--- Day changed Sat Jan 01 2011
01:27 -!- sht [sht@2607:f0d0:2001:8b::50:1337] has quit [Read error: Operation timed out]
02:23 -!- linze [~linze@546B9DC8.cm-12-4c.dynamic.ziggo.nl] has joined #openvpn
02:26 < linze> have a healty newyear 
02:26 < linze> all of you of course
02:34 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
02:50 -!- LowKey [rhel@unaffiliated/lowkey] has quit [Excess Flood]
02:50 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
02:55 -!- LowKey [rhel@unaffiliated/lowkey] has left #openvpn []
03:07 -!- gallatin [~gallatin@dslb-094-220-127-133.pools.arcor-ip.net] has joined #openvpn
03:39 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has quit [Ping timeout: 240 seconds]
03:49 -!- master_of_master [~master_of@p57B56EC1.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
03:51 -!- master_of_master [~master_of@p57B53150.dip.t-dialin.net] has joined #openvpn
03:53 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has joined #openvpn
04:36 -!- common- [~common@p5DDA4282.dip0.t-ipconnect.de] has joined #openvpn
04:39 -!- common [~common@p5DDA49B5.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
04:39 -!- common- is now known as common
04:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
05:04 < reiffert> http://mirror.netcologne.de/CCC/27C3/mp4-h264-HQ/4245-en-adventures_in_analyzing_stuxnet.mp4
05:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:06 < hyper_ch> hi reiffert
05:43 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
05:48 -!- gallatin [~gallatin@dslb-094-220-127-133.pools.arcor-ip.net] has quit [Quit: Client exiting]
06:09 -!- linze [~linze@546B9DC8.cm-12-4c.dynamic.ziggo.nl] has quit [Quit: tot kijk]
07:15 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:25 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
07:25 -!- mode/#openvpn [+o mattock] by ChanServ
08:53 -!- p3rror [~mezgani@41.140.182.165] has joined #openvpn
09:10 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
09:35 -!- seekwill [~wfong@pdpc/supporter/professional/will] has quit [Ping timeout: 246 seconds]
09:37 -!- s7r [~s7r@66.90.75.126] has joined #openvpn
09:50 -!- pa [~pa@host129-21-dynamic.61-82-r.retail.telecomitalia.it] has joined #openvpn
09:50 -!- pa [~pa@host129-21-dynamic.61-82-r.retail.telecomitalia.it] has quit [Changing host]
09:50 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:11 -!- albech [~thomas@119.42.78.92] has quit [Quit: Ex-Chat]
10:15 -!- seekwill [~wfong@pdpc/supporter/professional/will] has joined #openvpn
10:22 -!- p3rror [~mezgani@41.140.182.165] has quit [Read error: Connection reset by peer]
10:28 -!- seekwill [~wfong@pdpc/supporter/professional/will] has quit [Ping timeout: 240 seconds]
10:55 -!- seekwill [~wfong@pdpc/supporter/professional/will] has joined #openvpn
10:57 -!- seekwill [~wfong@pdpc/supporter/professional/will] has quit [Read error: Operation timed out]
11:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
11:10 -!- seekwill [~wfong@c-76-121-185-117.hsd1.wa.comcast.net] has joined #openvpn
11:10 -!- seekwill [~wfong@c-76-121-185-117.hsd1.wa.comcast.net] has quit [Changing host]
11:10 -!- seekwill [~wfong@pdpc/supporter/professional/will] has joined #openvpn
11:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:20 -!- seekwill [~wfong@pdpc/supporter/professional/will] has quit [Ping timeout: 272 seconds]
11:20 -!- seekwill [~wfong@c-76-121-185-117.hsd1.wa.comcast.net] has joined #openvpn
11:20 -!- seekwill [~wfong@c-76-121-185-117.hsd1.wa.comcast.net] has quit [Changing host]
11:20 -!- seekwill [~wfong@pdpc/supporter/professional/will] has joined #openvpn
11:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
11:33 -!- p3rror [~mezgani@41.140.156.236] has joined #openvpn
11:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:49 -!- p3rror [~mezgani@41.140.156.236] has quit [Ping timeout: 240 seconds]
11:56 -!- linze [~linze@546B9DC8.cm-12-4c.dynamic.ziggo.nl] has joined #openvpn
11:57 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:42 -!- p3rror [~mezgani@41.140.170.36] has joined #openvpn
12:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
12:49 -!- Some_Person [~Sam@unaffiliated/someperson/x-249303] has joined #openvpn
12:50 < Some_Person> Besides disconnecting/reconnecting, is there any way to quickly shut off and turn on the OpenVPN connection on a Windows PC? (hopefully via command line)
12:56 < Some_Person> Is anybody here?
12:56  * qermit is here
12:57 < Some_Person> In case I wasn't clear, I want to be able to leave the OpenVPN client connected to the server, but disable/enable its routing on the PC
12:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:58 < qermit> Some_Person: uno momento :)
13:01 < Some_Person> thanks
13:03 < qermit> i think you can write some script (in VBS or sth like that)
13:04 < qermit> just drop routes
13:06 < Some_Person> How?
13:08 < Some_Person> Sorry, but I'm really a newbie with OpenVPN and network stuff. How do I accomplish this?
13:08 < qermit> i use route command
13:11 < qermit> http://www.bigresource.com/VB-Detect-route-table-change-GKCP3tuY3H.html
13:11 <@vpnHelper> Title: Visual Basic :: Detect Route Table Change (at www.bigresource.com)
13:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
13:42 -!- Some_Person [~Sam@unaffiliated/someperson/x-249303] has quit [Quit: Leaving]
13:44 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:44 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:57 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has quit [Quit: No Ping reply in 90 seconds.]
13:58 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has joined #openvpn
14:18 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has quit [Ping timeout: 255 seconds]
14:26 -!- krzee [~k@openvpn/community/support/krzee] has quit [Remote host closed the connection]
14:26 -!- linze [~linze@546B9DC8.cm-12-4c.dynamic.ziggo.nl] has quit [Quit: tot kijk]
14:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
14:43 -!- Rolybrau [~Rolybrau@207-167.79-83.cust.bluewin.ch] has joined #openvpn
14:43 -!- Rolybrau [~Rolybrau@207-167.79-83.cust.bluewin.ch] has quit [Changing host]
14:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:03 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:04 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
15:12 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
15:12 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
15:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:15 -!- p3rror [~mezgani@41.140.170.36] has quit [Read error: Connection reset by peer]
15:25 <@vpnHelper> RSS Update - forum: Ubuntu 10.4 configuration <http://forums.openvpn.net/topic7452.html#p8894>
15:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
15:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:51 -!- maxJadi [~maxJadi@cust-95-80-31-205.csbnet.se] has joined #openvpn
16:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
16:18 -!- p3rror [~mezgani@41.140.100.35] has joined #openvpn
16:19 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
16:42 -!- p3rror [~mezgani@41.140.100.35] has quit [Ping timeout: 240 seconds]
16:56 -!- maxJadi [~maxJadi@cust-95-80-31-205.csbnet.se] has quit [Ping timeout: 264 seconds]
16:56 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:20 -!- boswarrior [~mrnice@84.115.26.221] has quit [Quit: Ex-Chat]
17:21 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
18:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
18:21 -!- s7r [~s7r@66.90.75.126] has left #openvpn []
18:48 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
19:59 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
19:59 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
19:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:02 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
20:06 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 240 seconds]
20:10 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
20:11 -!- n0de_ [~n0de@ns301443.ovh.net] has joined #openvpn
20:14 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:21 -!- n0de_ [~n0de@ns301443.ovh.net] has quit [Quit: n0de_]
20:44 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has joined #openvpn
20:44 < ashes> hello
20:46 < ashes> i'm trying to setup openvpn over ad-hoc wifi. my two systems can communicate when openvpn is not running, but not when it is running. the openvpn log doesn't seem to log anything
20:47 < ashes> i get host unreachable when i try to ping
20:47 < ashes> linux to linux
20:51 < ashes> no iptables
20:58 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
20:58 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
21:09 -!- chuckf [~chuckf@ubuntu/member/chuckf] has joined #openvpn
21:09 < chuckf> !welcome
21:09 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:10 < chuckf> !route
21:10 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
21:10 < chuckf> !goal
21:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:27 -!- CheBuzz_Home [~CheBuzz_H@72-57-90-84.pools.spcsdns.net] has joined #openvpn
21:30 < CheBuzz_Home> I have OpenVPN running in routed configuration.  I want to route traffic between two clients, 10.1.0.6 with ptp of 10.1.0.5 and 10.1.0.14 with ptp 10.1.0.13.  I have setup routing on the two local networks to send all traffic through the VPN, but I don't see how to setup routing on the server to allow the two to talk.  Any help?
21:31 < CheBuzz_Home> Local net 1: 192.168.2.0/24  I used route add -net 192.168.3.0/24 gw 10.1.0.5
21:31 < CheBuzz_Home> Local net 2: 192.168.3.0/24  I used route add -net 192.168.2.0/24 gw 10.1.0.13
21:34 -!- chuckf [~chuckf@ubuntu/member/chuckf] has quit [Ping timeout: 272 seconds]
21:54 < CheBuzz_Home> Nevermind, found the answer here: http://openvpn.net/index.php/open-source/documentation/howto.html#scope
21:54 <@vpnHelper> Title: HOWTO (at openvpn.net)
22:02 -!- chuckf [~chuckf@ubuntu/member/chuckf] has joined #openvpn
22:15 < krzee> also
22:15 < krzee> !c2c
22:15 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
22:15 <@vpnHelper> clients
22:23 -!- atan [~atan@unaffiliated/atan] has left #openvpn ["null"]
22:33 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
22:40 < krzee> ohh the local nets
22:40 < krzee> see my routing document
22:40 < krzee> !route
22:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
22:41 < krzee> even if you already solved it, you may enjoy that read
22:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
22:56 < CheBuzz_Home> krzee: Thanks!  Will definitely read over it, even though I did already solve it.
22:57 < CheBuzz_Home> What I don't understand is what the iroute command does.
22:57 < krzee> its explained there ;)
22:57 < krzee> but the cliffs notes version:
22:57 < krzee> !iroute
22:57 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
22:58 < CheBuzz_Home> Ah, so it adjusts internal routing with the openvpn process.
22:59 < krzee> exactly
22:59 < krzee> any time there is a foreign subnet behind the client which communicates over the vpn, you need iroute
22:59 < CheBuzz_Home> So technically I wouldn't even need the route command, if I didn't want the server to be able to talk to the LANs. 
23:00 < krzee> correct, but youd still need iroute and push routes in order for the clients to still be able to
23:00 < krzee> and youd need client-to-client
23:00 < CheBuzz_Home> Right.  That makes sense.
23:00 < krzee> thats the piece of magic that would make that work
23:01 < krzee> because with that option, the routing takes place within openvpn
23:01 < krzee> !c2c
23:01 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
23:01 <@vpnHelper> clients
23:01 < krzee> without it, the servers routing table would come into play
23:05 -!- roue [~roue@75-134-143-252.dhcp.roch.mn.charter.com] has joined #openvpn
23:05 < roue> hola
23:05 < krzee> buenas
23:07 < krzee> si hablas ingles, es la idioma preferida aqui
23:09 < roue> I'm trying to run and openvpn client on my holiday-acquired Chumby (insiginia 8" infocast). I already have an openvpn server (2.1_rc11, packaged with Debian 5) running fine and clients connect with no problem. For the chumby I needed to build the tun.ko kernel module (which seems to load properly), and cross compiled liblzo, openssl, and openvpn 2.1.4 without serious issue. I've generated keys and can start up the client and everythin
23:09 < roue> g seems to negotiate properly, but then once the connection is established I can't ping anything from the chumby or access anything on my internal network that the vpn permits access to from other clients. The configuration is identical to my debian 5 laptop (except for new private key and cert), so I'm not sure what's going on. 
23:09 < roue> When connecting the chumby reports that the initialization sequence completed, but a few minutes later I get and inactivity timeout and everything shuts down.
23:10 < roue> hola is the only Spanish I know. :)
23:10 < krzee> lol
23:11 < krzee> ill reply as i read...
23:11 < krzee> a) update your server
23:11 < krzee> what OS is a chumby?
23:11 < krzee> post logfile with verb 5 from the chumby
23:12 < krzee> i would venture to guess that its having issues adding the routes or something
23:14 < roue> the chumby runs linux (it's an arm cpu, 800mhz, 128m ram, basically a souped up digital picture frame). I can upgrade the server, but running the distro packaged version lets me be lazy. Course, lazy doesn't help if it doesn't work :) I do see routes in place after the connection starts up (and before the timeout) and they look correct. I'll try the verbose logging. 
23:15 < krzee> in case chumby doesnt log with syslog (common on embedded devices with low storage)
23:15 < krzee> !logfile
23:15 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
23:16 < krzee> rc11 certainly has bugs
23:16 < krzee> it was only an rc for a reason ;)
23:17 < krzee> try to hurry
23:17 < krzee> to you have til the end of the fight before im going home
23:17 < roue> ha.
23:17 < roue> what fight?
23:17 < krzee> sitting around the office with beer watching the UFC fights
23:17 < roue> ahh.
23:17 < krzee> only place i found that got the fight, lol
23:18 < roue> who has you working on new year's day?
23:18 < roue> or, I guess you're not working ...
23:18 < krzee> lol i worked christmas
23:18 < roue> geeze.
23:18 < krzee> networks dont stop for holidays
23:18 < roue> depends on which networks :)
23:18 < krzee> ;]
23:19 < krzee> but the fatty xmas bonus takes away any complaints
23:21 < roue> ah, then you must work somewhere more serious than I do.
23:21 < krzee> plus the owner never harasses when i say "if we buy *this* i can do some serious shit with it, it will be good for us"
23:21 < krzee> hes more like "do you need 2?"
23:21 < krzee> heh
23:21 < roue> mind if I ask where you work?
23:22 < krzee> i garuntee you wouldnt have heard of it
23:23 < roue> secret military skunkworks, then, eh?
23:23 < krzee> heh
23:23 < krzee> im not even in usa
23:23 < roue> Lots of people have a military.
23:23 < krzee> ok you caught me, i run networks for the kgb ;)
23:24 < krzee> its round 4 out of 5... should be getting that logfile
23:28 < roue> the extended log file isn't showing squat different. There's a line of "WWrWrWrWrWRWrWrWrWr... and then the timeout happens just as I saw before. route shows the internal network address listed with tun0 as the Iface and my default gateway looks right.
23:28 < roue> here's the log http://pastebin.ca/2036392
23:29 < roue> the output from route is at the bottom.
23:30 < roue> network topology is (internet)<--> linux router running deb 5 openvpn server <--> netgear wireless route <--> chumby where the chumby gets it's 192.168.x.x ip from the netgear. 
23:31 < roue> and the internal network that the vpn normally provides access to is 10.0.1.0/24, and the vpn is 10.0.2.0/24 
23:31 < krzee> the chumby cant ping ITS OWN vpn ip?
23:32 < roue> it can.
23:32 < roue> that's the 10.0.2.13
23:32 < krzee> nope
23:32 < roue> 10.0.2.14 is the server endpoint (I think)
23:32 < krzee> !/30
23:32 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
23:32 < krzee> .13 is internal to openvpn, part of the net30 topology
23:33 < roue> I've probably been doing this wrong all along.
23:34 < roue> I'm using /etc/openvpn/ccd files to configure each client manually.
23:34 < roue> mostly they say "ifconfig-push 10.0.2.2 10.0.2.3" where I thought 10.0.2.2 was the ip address that the client had assigned to tun0
23:35 < krzee> !static
23:35 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
23:35 < krzee> i think you found your problem =]
23:36 < krzee> wow they called the fight a draw
23:36 < krzee> such BS
23:36 < krzee> maynard won that fight
23:36 < roue> so it only stopped working because I hit some magic number?
23:36 < roue> not sure I follow, yet. But I'll read the docs you outlined.
23:36 < krzee> do you have anything special setup with firewalling where certain clients get special access?
23:37 < roue> no
23:37 < krzee> if not, consider using topology subnet (assuming ALL endpoints use 2.1+)
23:37 < roue> that would dynamically assign ip addresses?
23:37 < krzee> then you get to forget about all the net30 specific crap
23:37 < krzee> you could still assign via ccd
23:37 < krzee> "example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0"
23:38 < krzee> (from above factoid)
23:38 < krzee> !topology
23:38 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
23:38 < ashes> when i use tap openvpn, and ping, work. when i use tun, there is no route. what am i doing wrong?
23:38 < krzee> net30 only exists because of some windows lamesauce that prevented them from doing it this way from the start, until they came up with a way to do it (which is outlined in the above mail post)
23:39 < krzee> ashes,
23:39 < krzee> !configs
23:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
23:39 < krzee> i will be online from krzie in a bit
23:39 < krzee> for now, ill bbiaf =]
23:39 < krzee> feel free to pastebin them now, show me when i get back
23:41 < roue> thanks for your help.
23:43 < ashes> http://pastebin.com/XyZNNp63
23:45 -!- seekwill [~wfong@pdpc/supporter/professional/will] has quit [Quit: Leaving]
23:46 < ashes> i haven't seen an example client config for linux. it's always windows
23:48 < CheBuzz_Home> krzee: So by default ifconfig-pool-linear will be used in later releases?
23:51 < krzee> ok i didnt leave yet... so ill answer stuff then go
23:51 < krzee> roue, np =]
23:51 < krzee> ashes, 
23:51 < krzee> try commenting ifconfig-pool-persist ipp.txt when you go to tun
23:52 < krzee> OR try adding topology subnet
23:52 < krzee> regarding having not seen sample configs outside of windows
23:52 < krzee> !sample
23:52 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
23:53 < krzee> CheBuzz_Home, not quite, topology subnet is said to be on the table for future default settings... but i cant confirm that is true (i should ask that in a dev meeting sometime)
23:53 < krzee> topology subnet and ifconfig-pool-linear are similar, but different ;)
23:53 < krzee> now, bbiaf, headed home
23:54 < ashes> krzee: i commented it out, and no change
23:55 < ashes> the client/server can ping eachother, until i run openvpn server with tun, then the ping has no route. stop the openvpn server and ping works again
23:55 < ashes> with tap everything is fine too
23:58 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has quit [Read error: Connection reset by peer]
--- Day changed Sun Jan 02 2011
00:00 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has joined #openvpn
00:07 < CheBuzz_Home> Add topology subnet,  does ifconfig-pool-persist no longer have effect with that?
00:09 < ashes> i'm not even sure which device i should use, tun or tap. for the moment i want to use openvpn to authenticate wifi clients, and encrypt wifi traffic, from within my home, to secure my network from my neighbours and people in the coffee shop downstairs, using NAT. later, i want to tunnel from a remote coffee shop's wifi to my house, as a wide area default gateway, so that again my network traffic coming in an out of my laptop is encry
00:11 < ashes> within my home i think tun is the right device, because it's just routing, but from a remote location i might need a bridge
00:15 < ashes> in either case, i think my client can behave the same way. get an ip from a dhcp server, connect to the openvpn server's external ip, and get NAT from there
00:20 -!- me345 [~me345@adsl-75-15-250-79.dsl.bkfd14.sbcglobal.net] has joined #openvpn
00:25 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
00:35 < krzie> werd
00:35 < krzie> im back
01:36 -!- Andy253 [~andrew@00022a00c408.click-network.com] has joined #openvpn
01:37 < Andy253> Hello, I would like to finish setting up my VPN, such that when I access the server, I can access any resource the server can (Not bridged, but NAT), how would I go about doing this?
02:00 < CheBuzz_Home> krzie: Add topology subnet,  does ifconfig-pool-persist no longer have effect with that?
02:01 < krzie> reiffert, you're right, dialog is awesome
02:01 < krzie> CheBuzz_Home, its not that... its that by default tap will give ips like .2 .3 .4 and so will tun with topology subnet
02:01 < krzie> tun by default will only be able to use .6 .10 .14 etc
02:02 < krzie> !ipp
02:02 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
02:02 < krzie> your openvpn may be suggesting bad ips
02:02 < krzie> its worth checking
02:02 < CheBuzz_Home> Ok, I moved the old file to ipp.txt.old
02:02 < CheBuzz_Home> I wonder if it might still be picking that up?
02:03 < krzie> shouldnt
02:03 < krzie> (no)
02:03 < krzie> and you stopped and started the server process after, right?
02:04 < CheBuzz_Home> Correct.
02:06 < krzie> i cant scroll up, can you paste the logs and configs (without comments) on pastebin
02:11 < ashes> when my openvpn server (10.17.103.1) starts, when comparing the output of tap and tun, using tun adds this "/sbin/ip route add 10.17.103.0/24 via 10.17.103.2". my client is "10.17.103.2". could this be why ping stops working when i use tun ?
02:13 < krzie> nope
02:13 < krzie> well
02:13 < ashes> i don't know where it's getting the "10.17.103.2" ip from, except maybe from an arp lookup
02:13 < krzie> are you using static ips?
02:13 < ashes> yes, static ips
02:13 < krzie> ok then yes
02:13 < krzie> unless you use topology subnet or change the ips
02:14 < krzie> didnt we go over that? it feels like i was just talking about that
02:15 < ashes> i think i missed some of the conversation
02:15 < ashes> topology subnet worked
02:16 < krzie> !static
02:16 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
02:16 < krzie> !/30
02:16 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
02:17 < krzie> !topology
02:17 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
02:18 < Andy253> Would I be wanting a bridge between my WAN interface and tap0 to access any service on the WAN interface, without allocating another IP?
02:19 < krzie> huh?
02:19 < Andy253> I have one public IP assigned to a box, I need a VPN to access any resource beyond that IP
02:19 < Andy253> So, effectively, a NAT
02:20 < krzie> !redirect
02:20 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
02:20 < krzie> that?
02:20 < Andy253> That sounds like client-side
02:20 < krzie> you want all traffic from the client to flow through the server?
02:20 < Andy253> All the internet traffic will flow through the VPN, that part should be ready to go, but the server side is wrong
02:21 < Andy253> Yes
02:21 < krzie> that is the above redirect
02:21 < krzie> !redirect
02:21 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
02:21 < krzie> what OS is your server?
02:21 < Andy253> Linux
02:21 < krzie> !linnat
02:21 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
02:22 < krzie> !linipforward
02:22 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
02:22 < Andy253> IP forwarding is on
02:22 < krzie> and the NAT rule...?
02:22 < Andy253> http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html <- is what I was following
02:22 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
02:22 < krzie> you dont need a bridge
02:23 < krzie> !tunortap
02:23 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
02:23 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
02:27 < Andy253> I still can't see any traffic on tap0 from the VPN client
02:28 < krzie> you're doing it wrong
02:28 < krzie> !sample
02:28 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
02:28 < krzie> you want something like that
02:28 < krzie> with !def1
02:28 < krzie> !def1
02:28 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
02:28 < Andy253> oh right, I need to change the server line
02:28 < krzie> and the NAT rule on your server from above
02:28 < krzie> and you want tun, not tap
02:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
02:36 < Andy253> krzie, how about http://pastebin.com/2JxRCHd2 ?
02:36 < Andy253> The client is handled by NM, so that will be a whole long troubleshooting process
02:37 < Andy253> The server just spits ou "bad source address from client [IP], packet dropped" over and over
02:37 < Andy253> s/ou/out/
02:38 < krzie> lets take it from the top
02:39 < krzie> why are you using tcp?
02:39 < Andy253> I don't really have a reason
02:39 < krzie> !tcp
02:39 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
02:40 < krzie> you can remove:
02:40 < krzie> local 0.0.0.0
02:40 < krzie> port 1194
02:40 < krzie> tls-server
02:40 < Andy253> Ah, I wasn't thinking of TCP over TCP
02:40 < krzie> (they are redundant)
02:41 < krzie> whats in the ccd file?
02:42 < Andy253> Nothing right now
02:42 < krzie> ok
02:42 < krzie> so you are running that now?
02:42 < Andy253> Right
02:43 < krzie> can your client ping 10.8.1.1?
02:43 < Andy253> Nope
02:43 < krzie> did you try NAT on the client side? sounds like you may have
02:44 < Andy253> Well, now its timing out on connecting with UDP
02:44 < krzie> must change both configs...
02:46 < Andy253> More like iptables getting in the way :)
02:46 < Andy253> Okay, now the client is connected.
02:47 < Andy253> SENT CONTROL [andrew]: 'PUSH_REPLY,route 10.8.1.0 255.255.255.0,topology net30,ping 30,ping-restart 120,ifconfig 10.8.1.6 10.8.1.5' (status=1)
02:48 < krzie> can your client ping 10.8.1.1?
02:48 < Andy253> Nope
02:48 < krzie> can your server ping 10.8.1.6?
02:48 < Andy253> Now its back to the bad source address from client, packet dropped
02:48 < krzie> paste that error
02:49 < Andy253> MULTI: bad source address from client [172.16.1.166], packet dropped
02:49 < krzie> ahh
02:49 < krzie> and that is its LAN ip, right?
02:49 < Andy253> Yes
02:49 < Andy253> The server has no access to that subnet
02:49 < krzie> ive seen this a time or 2, never known why it happens
02:50 < krzie> for some reason your OS is sending traffic out your tun0 with src address of its eth0 IP
02:50 < krzie> i have NO idea why it is doing this, wish i did
02:50 < Andy253> Well, I guess that's NM's fault
02:50 < krzie> but there is a workaround
02:50 < krzie> first of all
02:50 < krzie> !netman
02:50 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from an openvpn expert on the mail list
02:50 < Andy253> Ugh
02:51 < krzie> or at least make it work without netman first
02:51 < Andy253> I was hoping not to have install more software
02:51 < krzie> more!?
02:51 < Andy253> As every machine I need to access from has nm-openvpn ready to go
02:51 < reiffert> krzie: have a look here, it's great fun: http://mirror.netcologne.de/CCC/27C3/mp4-h264-HQ/4245-en-adventures_in_analyzing_stuxnet.mp4
02:51 < krzie> you have openvpn installed
02:52 < krzie> you dont need netman
02:52 < krzie> just run openvpn <configfile>
02:52 < krzie> lol
02:52 < Andy253> True on that
02:52 < krzie> you are actually adding an extra piece of software when using netman
02:52 < Andy253> Netman was allready approved though
02:52 < krzie> i dont care, im saying that while i help you dont use it
02:53 < krzie> then if you want it after, go for it
02:53 < Andy253> So what about using Netman + openvpn client?
02:53 < krzie> what?
02:53 < Andy253> Will they conflict?
02:53 < krzie> you dont need openvpn client
02:53 < Andy253> I bet they will fight over default routes
02:53 < krzie> you already have openvpn
02:54 < Andy253> -client
02:54 < Andy253> Just openvpn vs NM
02:54 < krzie> dude, forget about netman for a min
02:54 < Andy253> Well, it's what is managing the wireless card in these devices
02:54 < krzie> thats fine
02:54 < krzie> minimize it and forget about it
02:56 < krzie> reiffert, nice thanx!
02:56 < krzie> reiffert, did you go?
02:58  * krzie goes back a dir and wgets
02:59 < Andy253> Hm, apparently it doesn't want to run because it can't find the GID for group www
03:00 < Andy253> There is no group "www" either..
03:00 < krzie> oh right, you must have missed 1 part
03:00 < krzie> !sample
03:00 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
03:00 < Andy253> Oh yes.
03:00 < Andy253> Of coure
03:00 < krzie> see #2
03:00 < Andy253> Of course*
03:00 < krzie> ;]
03:00 < Andy253> -_-
03:01 < reiffert> krzie: I was working when 27c3 took place, so nah, I was just watching some lectures
03:01 < krzie> weird the index page is actually downloading as index.html
03:02 < krzie> ill scan wget page but instead i might just parse the html for all to wget
03:04 < Andy253> Now it's connected, but still unable to ping gateway
03:05 < krzie> can your client ping 10.8.1.1?
03:06 < krzie> can your server ping 10.8.1.6?
03:06 < Andy253> No, and the client thinks the gateway is 10.8.1.9 now
03:06 < Andy253> Server can't ping 10.8.1.10 either
03:06 < krzie> ok so client is 10.8.1.10
03:06 < Andy253> It changed
03:07 < krzie> add topology subnet to the server config
03:07 < krzie> it will be less confusing to you
03:07 < krzie> also be sure to adjust firewalls
03:07 < Andy253> I have two tun devices on the server now
03:07 < krzie> oh you are running openvpn 2x
03:07 < krzie> lol
03:07 < krzie> kill both and start another, but only 1
03:07 < Andy253> pgrep openvpn | wc -l returns 2, yep...
03:09 < Andy253> Nice, my init script starts 2 copies now
03:10 < Andy253> And there is a tun0 even when openvpn is not running
03:15 < krzie> your init script starts 2 copies cause you have 2 configs in the dir it scans
03:16 < Andy253> so much for my file.conf.old standard.
03:17 < krzie> mkdir old
03:17 < Andy253> Still 2 server instances though
03:18 < krzie> you saying it still starts both configs?
03:19 < Andy253> It's starting two servers from the same config file
03:20 < Andy253> One is running as root, other as nobody
03:21 < Andy253> now I have two running as root
03:21 < krzie> ifconfig
03:22 < Andy253> tap0 and tun1 exist
03:22 < krzie> how do you know its starting 2 from the same config?
03:22 < Andy253> the process command line argument has the same configuration file listed
03:23 < Andy253> http://pastebin.com/JANBeEe3
03:23 < krzie> kill them both
03:23 < krzie> for now just start openvpn with openvpn <configfile>
03:24 < Essobi> sup krzzzzz
03:24 < krzie> kill -9 5181 5193
03:24 < krzie> openvpn /etc/openvpn/server.conf
03:24 < krzie> wassup Essobi!
03:24 < Essobi> krzie: happy nude year
03:24 < krzie> i hope so!
03:24 < krzie> same to you
03:24 < Essobi> hehe
03:24 < Essobi> spanks
03:25 < Andy253> Still makes two instances
03:25 < krzie> add this to the config file:
03:26 < krzie> log /etc/openvpn/openvpn.log
03:26 < Andy253> I already have a log file
03:28 < Andy253> openvpn-auth-pam.so is causing the multiple instances.
03:28 < krzie> pastebin it
03:29 < Andy253> http://pastebin.com/kL6G80xp
03:31 < krzie> whoa
03:31 < krzie> OpenVPN 2.1.0
03:31 < krzie> could be time to update ;)
03:31 < krzie> but should be fine
03:31 < Andy253> It's Ubuntu 10.04 LTS
03:32 < Andy253> It would be running gentoo, but the machine is too old to really mean much in gentoo
03:32 < Andy253> And CentOS wasn't an option because I was going to hold off until CentOS6
03:33 < krzie> ok, so connect in the client
03:33 < krzie> the 2 processes is normal
03:34 < Andy253> The client is connected.
03:34 < krzie> can they ping eachother?
03:35 < krzie> have you added entries in the firewall for them to be able to?
03:36 < Andy253> That part is working now
03:36 < krzie> they can ping eachother?
03:36 < Andy253> Yep
03:36 < krzie> does the server have its NAT rule?
03:37 < krzie> add this to the server config
03:37 < krzie> !def1
03:37 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
03:37 < krzie> push "redirect-gateway def1"
03:39 < Andy253> What about client side?
03:39 < krzie> what about it?
03:40 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has quit [Ping timeout: 240 seconds]
03:40 < Andy253> It's not using the VPN outside of the 10.8/24 gateway
03:40 < krzie> [05:37]  <krzie> add this to the server config
03:40 < krzie> [05:37]  <krzie> push "redirect-gateway def1"
03:42 < Andy253> Okay, so I had to restart the openvpn client, because apparently on auto-reconnect it does not reaload settings, anyway.
03:43 < krzie> right
03:43 < Andy253> Now everything outside of 172.16.0.0/13 and 10.8.0.0/24 is dead
03:43 < krzie> your NAT is wrong, you dont have ip forwarding enabled, or your firewall is blocking it in the forward chain
03:43 < krzie> show me the NAT rule
03:44 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
03:44 < Andy253> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE
03:44 < Andy253> eth1 = WAN 
03:44 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Client Quit]
03:44 < krzie> Sun Jan  2 01:28:19 2011 us=778457 /sbin/route add -net 10.8.1.0 netmask 255.255.255.0 gw 10.8.1.2
03:44 < krzie> your log says you use 10.8.1./24
03:45 < Andy253> There we go
03:45 < Andy253> It's working now
03:46 < Andy253> 0.25Mb/s and correct IP
03:46 < krzie> =]
03:46 < Andy253> I need to fix my bandwith limits
03:47 < Andy253> also, what can I do about ping-times? (keepalive)
03:47 < Andy253> I need to get my phone connected up, and I don't want to waste battery life.
03:47 < krzie> huh?
03:48 < Andy253> My phone will be connecting via VPN as well, and I don't want to waste battery life with PINGs every 10 seconds
03:49 < krzie> make your own decisions re: keepalive
03:49 < krzie> theres a trade-off between it seeing its disconnected and reconnecting vs needing to send pings
03:49 < Andy253> I'd rather set it on a per-client basis, if that is possible
03:49 < krzie> sure, but not using the keepalive setting
03:49 < Andy253> Right
03:49 < krzie> see the manual
03:49 < krzie> keepalive is just a helper
03:50 < krzie> it sets a couple settings, and pushes settings to the clients
03:50 -!- master_of_master [~master_of@p57B53150.dip.t-dialin.net] has quit [Ping timeout: 272 seconds]
03:50 < krzie> set them yourself, and dont push to clients
03:50 < krzie> !push
03:50 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
03:50 < Andy253> NetworkManager is now working btw.
03:50 < krzie> cool
03:50 < krzie> i needed it out of my way
03:51 < krzie> if you wanna use it now that it works, go for it ;]
03:51 < Andy253> Now I just need to run my script to deploy the changes against all my machines and I will be good to go
03:51 -!- master_of_master [~master_of@p57B53E65.dip.t-dialin.net] has joined #openvpn
03:51 < krzie> =]
03:52 < Andy253> And get my Nokia N900 ready
03:52 < krzie> that sucker has a internal wifi that can crack WEP
03:52 < Andy253> It can do just about anything
03:52 < krzie> which is badass for a phone
03:53 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has joined #openvpn
03:53 < Andy253> Looks like my rollout went good
03:54 < Andy253> I had openvpn setup before, but my certificates expired
03:54 < krzie> they just gotta be re-signed
03:55 < Andy253> I took the time to redo openvpn because it was on a different machine
03:56 < Andy253> I may setup per-machine certs now, I coulden't before because of the network access
03:56 < krzie> its a good idea to
04:22 -!- m4rku5 [~markus@cl-2320.ham-01.de.sixxs.net] has joined #openvpn
04:22 < m4rku5> !welcome
04:22 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:24 < m4rku5> hi, I am using ifconfig-push which the server reads from client-config-dir, on the server i can see client/...:1194 ... Learn: 172.17.2.11 -> client/...:1194  however the client does not use this ip (i.e. the tun0 interfae has no IP assigned)
04:40 -!- common [~common@p5DDA4282.dip0.t-ipconnect.de] has quit [Ping timeout: 265 seconds]
04:40 -!- CheBuzz_Home [~CheBuzz_H@72-57-90-84.pools.spcsdns.net] has quit [Ping timeout: 260 seconds]
04:41 -!- common [~common@p5DDA460C.dip0.t-ipconnect.de] has joined #openvpn
04:44 < ashes> what keeps someone from bypassing openvpn authentication, on a wifi network, and using my nat directly?
04:47 -!- CheBuzz_Home [~CheBuzz_H@99-204-6-112.pools.spcsdns.net] has joined #openvpn
04:50 -!- m4rku5 [~markus@cl-2320.ham-01.de.sixxs.net] has left #openvpn ["Leaving"]
04:51 -!- Andy253 [~andrew@00022a00c408.click-network.com] has quit [Quit: Never trust a computer you can't throw out a window. - Steve Wozniak]
04:51 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has joined #openvpn
04:54 < krzie> ashes, encryption...
04:56 < ashes> i mean, just spoof the client mac address, get an ip from dhcp, and use the NAT, without openvpn
04:57 < krzie> use what NAT
04:58 < krzie> the one on the other side of an openvpn tunnel...?
04:58 < ashes> a home setup, where openvpn, NAT, and dhcpd, are running on the same system, with a wifi network
04:58 < krzie> you are only NAT'ing the vpn network
04:59 < ashes> the vpn's ip
05:00 < krzie> the encryption stops it
05:04 < ashes> i'm not talking about my legit traffic. i mean someone using my server as a gateway, without encryption
05:05 < ashes> what is used to default deny non-authenticated connections?
05:08 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has quit [Quit: alhadi]
05:12 < ashes> the iptables rules, or firewall rules, i find for openvpn would allow anyone to use the server as a gateway, including hosts that have not authenticated with openvpn
05:12 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has joined #openvpn
05:44 < reiffert> ashes: what keeps you from changing your firwall rules, so that your server gets more secure?
06:03 < krzie> ashes, your NAT rule only NATs the vpn subnet, which your routing table says only goes over tun0
06:05 < ashes> ok
06:11 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
06:14 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has quit [Remote host closed the connection]
06:14 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has joined #openvpn
06:23 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
06:30 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
07:04 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Read error: Operation timed out]
07:42 -!- atan3 [~atan@unaffiliated/atan] has joined #openvpn
07:45 -!- atan2 [~atan@unaffiliated/atan] has quit [Ping timeout: 240 seconds]
07:48 -!- me345 [~me345@adsl-75-15-250-79.dsl.bkfd14.sbcglobal.net] has quit [Remote host closed the connection]
07:49 -!- atan [~atan@unaffiliated/atan] has joined #openvpn
07:49 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
07:49 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:50 -!- atan3 [~atan@unaffiliated/atan] has quit [Quit: null]
07:51 -!- CheBuzz_Home [~CheBuzz_H@99-204-6-112.pools.spcsdns.net] has quit [Ping timeout: 240 seconds]
07:51 -!- atan [~atan@unaffiliated/atan] has left #openvpn []
07:52 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
07:52 -!- mode/#openvpn [+o mattock] by ChanServ
08:03 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
08:03 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has left #openvpn []
08:22 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has quit [Ping timeout: 246 seconds]
08:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:46 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Like it?  Visit #hydrairc on EFNet]
09:29 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
09:39 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
09:39 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
09:39 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
09:52 -!- SOG [~SOG@n11649233137.netvigator.com] has joined #openvpn
09:54 -!- SOG [~SOG@n11649233137.netvigator.com] has quit [Client Quit]
10:20 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
11:10 -!- s7r [~s7r@66.90.75.87] has joined #openvpn
11:10 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has quit [Remote host closed the connection]
11:19 -!- ki7rw [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has joined #openvpn
11:20 -!- ki7rw is now known as n0sq
11:20 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
11:20 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
11:37 -!- hanasaki [~hanasaki@76.92.220.37] has joined #openvpn
11:37 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has quit [Read error: Connection reset by peer]
11:38 < hanasaki> any way to do openvpn w/o distributing client certs?
11:38 < ecrist> you can use static keys, but it's no where near as secure.
11:41 -!- ki7rw [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has joined #openvpn
11:43 -!- ki7rw [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has quit [Read error: Connection reset by peer]
11:43 < hyper_ch> hi ecrist
11:54 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
12:03 < hanasaki> what's a static key?  hmmm maybe use pptpd instead?
12:10 < Bushmills> !howto
12:10 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
12:10 < Bushmills> quickstart tells
12:19 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has joined #openvpn
12:25 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has joined #openvpn
12:27 -!- n0sq [~quassel@mo-65-41-216-18.sta.embarqhsd.net] has left #openvpn []
12:29 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
12:36 -!- UnterPerro_ [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
12:36 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
12:36 -!- UnterPerro_ is now known as UnterPerro
12:45 -!- hanasaki [~hanasaki@76.92.220.37] has left #openvpn []
13:04 < Rienzilla> hmm
13:04 < Rienzilla> is it possible to use a certificate on a smartcard for authentication with openvpn?
13:08 < Rienzilla> hmm lmgtfy... nm :)
13:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
13:12 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has quit [Ping timeout: 246 seconds]
13:14 -!- s7r [~s7r@66.90.75.87] has left #openvpn []
13:19 < reiffert> Rienzilla: smartcard stuff should work with pam. there is an pam plugin for openvpn.
13:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:31 < Essobi> Rienzilla: I read a whitepaper on that somewhere..
13:34 -!- hacim [~micah@debian/developer/micah] has left #openvpn []
13:41 -!- UnterPerro_ [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
13:41 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
13:41 -!- UnterPerro_ is now known as UnterPerro
13:41 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Client Quit]
13:47 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has quit [Changing host]
13:47 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has joined #openvpn
13:56 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has joined #openvpn
14:21 < krzie> im sure it can be done, but have never attempted it
14:22 < krzie> (jjk's book has a chapter on it)
14:32 <@vpnHelper> RSS Update - forum: Need help with config files/keys will pay <http://forums.openvpn.net/topic7460.html>
14:51 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:09 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
15:09 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
15:14 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
15:15 -!- sia^pwnnt is now known as sia
15:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
15:20 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has quit [Quit: alhadi]
15:29 -!- Kurogane [~kuro@190.87.80.64] has joined #openvpn
15:33 -!- n0de_ [~n0de@ns301443.ovh.net] has joined #openvpn
15:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:12 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 265 seconds]
16:13 -!- n0de_ [~n0de@ns301443.ovh.net] has quit [Quit: n0de_]
16:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:32 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
16:35 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
16:36 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
16:37 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 276 seconds]
16:37 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
16:38 -!- rkantos [robin@hp1.jaketus.net] has quit [Ping timeout: 276 seconds]
16:38 -!- ksk [ksk@im.knubz.de] has quit [Ping timeout: 276 seconds]
16:38 -!- tessier [~treed@mail.copilotco.com] has quit [Ping timeout: 276 seconds]
16:38 -!- diphthong [~diphthong@69.172.135.243] has quit [Ping timeout: 276 seconds]
16:38 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 276 seconds]
16:39 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Ping timeout: 276 seconds]
16:40 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
16:40 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
16:40 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
16:40 -!- ksk [ksk@im.knubz.de] has joined #openvpn
16:44 -!- Netsplit *.net <-> *.split quits: jhelwig, jfkw, dictvm, juhovh, nb, DarthGandalf, daemon, Antarez, tjz, openvpn2009,  (+2 more, use /NETSPLIT to show all of them)
16:44 -!- nb_ is now known as nb
16:44 -!- Netsplit *.net <-> *.split quits: Hamlin, Visual`
16:44 -!- Martin` is now known as Martin
16:45 -!- Martin is now known as Guest99287
16:46 -!- reiffert_ [~thomas@mail.reifferscheid.org] has joined #openvpn
16:46 -!- Netsplit over, joins: openvpn2009, jfkw, batrick, tjz
16:46 -!- 92AAB05FD [~nb@fedora/nb] has joined #openvpn
16:46 -!- Netsplit over, joins: jhelwig, juhovh, Antarez, daemon, dictvm, DarthGandalf, oc80z
16:46 -!- rkantos_ [robin@hp1.jaketus.net] has joined #openvpn
16:47 -!- Netsplit over, joins: Hamlin, Visual`
16:48 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Quit: Leaving]
16:51 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
16:52 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
16:54 -!- Netsplit *.net <-> *.split quits: lupine_85, blackpenguin, rkantos_, Hamlin, Meliorator, abeehc, Visual`, renihs
17:03 -!- abeehc_ [~bob@d207-6-195-163.bchsia.telus.net] has joined #openvpn
17:03 -!- rkantos_ [robin@hp1.jaketus.net] has joined #openvpn
17:03 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
17:03 -!- Visual` [~visualsta@unaffiliated/visualstation] has joined #openvpn
17:08 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
17:11 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
17:13 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
17:27 -!- Netsplit *.net <-> *.split quits: jhelwig, jfkw, dictvm, juhovh, reiffert_, DarthGandalf, nijotz, daemon, Antarez, 92AAB05FD,  (+4 more, use /NETSPLIT to show all of them)
17:27 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
17:27 -!- Guest99287 is now known as Martin
17:28 -!- Martin is now known as Guest93089
17:28 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
17:28 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
17:29 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
17:29 -!- Meliorator [~m@dunnington.eu] has joined #openvpn
17:29 -!- Netsplit over, joins: openvpn2009, nijotz, reiffert_, jfkw, batrick, tjz, 92AAB05FD, jhelwig, juhovh, Antarez (+4 more)
17:29 -!- UnterPerro_ [~UnterPerr@32.161.24.124] has joined #openvpn
17:32 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Ping timeout: 240 seconds]
17:32 -!- UnterPerro_ is now known as UnterPerro
17:34 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 272 seconds]
17:41 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
17:44 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
17:47 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
17:47 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
17:47 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:50 -!- n0de_ [~n0de@ns301443.ovh.net] has joined #openvpn
17:52 -!- 92AAB05FD is now known as nb_
18:06 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
18:14 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
18:17 -!- n0de_ [~n0de@ns301443.ovh.net] has quit [Quit: n0de_]
18:17 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
18:19 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
18:19 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has left #openvpn []
18:58 -!- UnterPerro_ [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
18:58 -!- UnterPerro [~UnterPerr@32.161.24.124] has quit [Read error: Connection reset by peer]
18:58 -!- UnterPerro_ is now known as UnterPerro
19:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
19:31 -!- _skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 260 seconds]
19:40 -!- sia is now known as sia^pwnnt
19:41 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
19:44 -!- _skrusty [~skrusty@83.166.176.39] has joined #openvpn
19:48 < krzee> hyper_ch, i got my web interface up =]
19:48 < krzee> i ended up scratching the php... it was doable in bash with cgi
19:49 < krzee> im sure if i was a php guy that would be better, but this is perfect for my needs
19:50 < dschuett> krzee: may i ask what you did? web interface for?
19:51 < krzee> internal access only interface for running accounting bash scripts
19:51 < dschuett> nice!
19:51 < krzee> so the boss can run it from his cell phone by clicking a button
19:52 < krzee> thanx
19:52 < krzee> im pretty stoked about it =]
19:52 < dschuett> it is always fun finishing a new program... i write a lot of php programs
19:52 < dschuett> php-mysql
19:53 < krzee> i had to access mssql
19:53 < krzee> that was a journey
19:53 < krzee> heh
19:53 < dschuett> haha, do you write a lot?
19:54 < krzee> but perl::sybase and freetds+unixODBC got it done
19:54 <@vpnHelper> RSS Update - forum: OpenVPN Adapter Order / DNS issues <http://forums.openvpn.net/topic7461.html>
19:54 < krzee> really i only write bash
19:54 < krzee> but i have been writing tons of bash ;]
19:54 < dschuett> bash is ALWAYS useful! - you really can't go wrong with bash
19:56 < krzee> might have to customize the loading.gif now ;)
19:56 < dschuett> of course...gotta make it pretty :D
19:57 < krzee> along those lines i need to play with outputting my page in columns, its fairly ugly as is
19:57 < krzee> but yanno... first you make it work, then you make it nice
19:57 < dschuett> yeah, the hard part is done!
19:57 < krzee> and if i never make it look nice, im still happy with the results!
19:59 -!- CheBuzz_Home [~CheBuzz_H@99-204-6-112.pools.spcsdns.net] has joined #openvpn
20:00 < dschuett> i'm sure you'll get it looking good!
20:00 < krzee> thanx
20:00 -!- n0de_ [~n0de@ns301443.ovh.net] has joined #openvpn
20:01 -!- CheBuzz_Home [~CheBuzz_H@99-204-6-112.pools.spcsdns.net] has left #openvpn []
20:19 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has left #openvpn []
20:27 -!- n0de_ [~n0de@ns301443.ovh.net] has quit [Ping timeout: 255 seconds]
20:28 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
20:28 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
20:28 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:33 -!- n0de_ [~n0de@ns301443.ovh.net] has joined #openvpn
20:37 -!- WinstonSmith [~true@g231241145.adsl.alicedsl.de] has joined #openvpn
20:37 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 272 seconds]
20:38 -!- WinstonSmith_ [~true@g231228010.adsl.alicedsl.de] has joined #openvpn
20:40 -!- WinstonSmith__ [~true@g231228010.adsl.alicedsl.de] has joined #openvpn
20:42 -!- WinstonSmith [~true@g231241145.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:43 -!- WinstonSmith_ [~true@g231228010.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:52 -!- albech [~thomas@119.42.78.242] has joined #openvpn
21:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
21:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:29 -!- n0de_ [~n0de@ns301443.ovh.net] has quit [Ping timeout: 255 seconds]
21:34 -!- sia^pwnnt is now known as sia
21:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
22:28 <@vpnHelper> RSS Update - forum: Check my config files please <http://forums.openvpn.net/topic7462.html>
22:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
22:58 -!- EvilMachine [~navid@dslb-088-077-145-003.pools.arcor-ip.net] has joined #openvpn
22:58 < EvilMachine> hello. :)
22:59 < EvilMachine> guys, is there a way to trigger a script when openvpn is *completely done*?
22:59 < EvilMachine> i mean when the initialization is complete
22:59 < EvilMachine> right now the up script gets triggered before ititialization is done
23:00 < EvilMachine> t=n
23:00 < EvilMachine> which means one can't use it to trigger starting the bridge on top of it
23:01 < EvilMachine> because dhcp will fail without openvpn fully working
23:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:08 < EvilMachine> even --up-delay doesn't help. :/
23:11 -!- openvpn2009 [patel@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 240 seconds]
23:14 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:17 -!- openvpn2009 [patel@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
23:21 -!- EvilMachine [~navid@dslb-088-077-145-003.pools.arcor-ip.net] has quit [Quit: leaving]
23:24 < krzie> !script
23:24 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
23:24 -!- openvpn2009 [patel@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 276 seconds]
23:24 < krzie> heh, he left quick
23:25 < krzie> well if he comes back, show him --route-up cmd along with --up-delay
23:26 < krzie> but for starting a bridge i believe he wants --up
23:29 -!- openvpn2009 [patel@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
--- Day changed Mon Jan 03 2011
00:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:59 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:59 -!- mode/#openvpn [+o mattock] by ChanServ
01:45 -!- WinstonSmith__ [~true@g231228010.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
01:49 -!- WinstonSmith [~true@g231228010.adsl.alicedsl.de] has joined #openvpn
01:57 < krzie> reiffert_, stuxnet took this guy for a ride!
01:58 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:00 -!- dazol is now known as dazo
02:00 -!- dazo [~dazo@nat/redhat/x-zpucjklrmralavmn] has quit [Changing host]
02:00 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
02:04 -!- reiffert_ is now known as reiffert
02:04 < reiffert> krzie: it would have take me months to analyze. Their speed is impressive.
02:05 < reiffert> taken
02:09 < reiffert> krzie: what I dislike is their way of doing things. MS didnt analyze, they just were discovering things.
02:10 < reiffert> e.g. their first thoughtt was "Of, this is a userspace hack". and then by accident they recognized two kernel drivers.
02:11 < reiffert> s,Of,Oh,
02:19 < krzie> aye
03:15 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
03:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:17 < kraut> moin
03:19 -!- tjz [~pc@bb116-14-171-63.singnet.com.sg] has joined #openvpn
03:19 -!- tjz [~pc@bb116-14-171-63.singnet.com.sg] has quit [Changing host]
03:19 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
03:23 < reiffert> moin krzie 
03:24 < reiffert> moin kraut 
03:24 < reiffert> :)
03:24 < kraut> gude reiffert und frohes neues
03:25 < reiffert> jo frohes neues jahr
03:49 -!- master_of_master [~master_of@p57B53E65.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
03:51 -!- ultramage [umage@kurobara.netvor.sk] has joined #openvpn
03:51 -!- master_of_master [~master_of@p57B5775B.dip.t-dialin.net] has joined #openvpn
03:52 < ultramage> hi, I want openvpn's tap interface to have a certain ethernet address, so that a specific ipv6 address is auto-assigned to it... is this possible?
03:52 < ultramage> I defined an ifconfig action in the 'up' handler, but it seems that's too late
03:53 < dazo> ultramage: yes, create the device manually (openvpn --mktun) ... and then use ifconfig (or iproute2?) to change the MAC address
03:54 < ultramage> the interface is created automatically at startup :/
03:54 < ultramage> doing it manually every time is not an option
03:54 < dazo> you need to hack that script then
03:54 < dazo> hmmm .... have you checkout --lladdr?
03:54 < dazo>        --lladdr address
03:54 < dazo>               Specify the link layer address, more commonly known as  the  MAC
03:54 < dazo>               address.  Only applied to TAP devices.
03:55 < ultramage> O.o
03:55 < ultramage> o.O
03:55 < ultramage> I'm sure I scanned for 'MAC' when I was looking in the manual earlier
03:56 < ultramage> I guess google gave me the 2.0 manual which does not have this -.-
03:56 < dazo> why google when you have man? ;-)
03:57 < ultramage> reading the manual in my browser is a bit easier than reading it in a ssh console
03:57 < dazo> gah ... this gui generation ....
03:57 < dazo> :-P
03:58 < reiffert> searching in manpages:   /  searchterm    return
03:58 < reiffert> skip spaces
03:59 < ultramage> yea, but it's not as good as a pointy clicky 1920x1080 browser
03:59 < reiffert> searching case insensitive: man -i 
03:59 < ultramage> plus reading monospaced font is not good for the eyes =p
03:59 < dazo> ultramage: what is not possible to do from a command line is not worth doing ;-)
03:59 < reiffert> pointing and clicking on a 1920x1080 browser on a website without links gives you faster results?
03:59 < ultramage> ctrl+f 
04:00 < reiffert> ultramage: /  so saved one char
04:00 < ultramage> anyways, thanks for the config setting, works like a charm
04:00 < dazo> ultramage: try '/' when viewing a man page ... and then 'n' for next it
04:00 < reiffert> or p(revious)
04:00 < reiffert> and man -j 5 to have more context
04:00 < ultramage> I can tell you that it's ass compared to doing it in a gui... and if I have a gui I'm not going to cripple myself for no real reason :)
04:00 < reiffert> (all the browsers that I do know cant do that)
04:01 < reiffert> alias gui=man
04:01 < ultramage> xD
04:02 < dazo> that's the difference between users and lusers ... gui makes you dumber ... really ...
04:02 < ultramage> now now
04:02 < dazo> (Just think about the 80's, where it was expected that you needed to know programming to use a computer in general)
04:02 < Bushmills> ultramage: http://docs.verhau.de/cgi-bin/dwww?type=runman&location=openvpn/8
04:02 <@vpnHelper> Title: openvpn(8) - Man pages (at docs.verhau.de)
04:02 < ultramage> yes yes
04:02 < ultramage> I just prefer the official site for official docs :p
04:03 < ultramage> and I'm used to the color scheme
04:04 < reiffert> color scheme like bold and plain text?
04:04 < ultramage> :) and the white/blue background with blue text
04:04 < reiffert> you can have that with your ssh terminal as well
04:04 < dazo> reiffert: you know the gui generation ... it's not the contents which is important, just how it looks like
04:04 < reiffert> yeah.
04:04 < Bushmills> why not let somebody read it to you
04:05 < reiffert> Bushmills: he's the guy supposed to do the reading.
04:05 < dazo> Bushmills: do you have links to audio-man pages? ;-)
04:05 < ultramage> you must have some hidden grudge
04:06 < Bushmills> reiffert: didn't say "for you" but "to you"
04:06 < reiffert> ultramage: "experience"
04:06 < Bushmills> just as a way to avoid colour scheme and font issues and such
04:07 < ultramage> my experience says a badly done ui is inferior to commandline
04:07 < ultramage> but a properly done ui dominates console
04:08 < ultramage> that is unless all you do all day is writing automated shell scripts
04:09 < Bushmills> searching a man page doesn'r require writing shell scripts all day
04:09 < Bushmills> regardless whether you search using a browser or a command line
04:10 < reiffert> 10:55 < ultramage> I'm sure I scanned for 'MAC' when I was looking in the manual earlier
04:12 < reiffert> using gui's should be done when you are able to.
04:12 <@vpnHelper> RSS Update - forum: JonDo vs OpenVPN - They Claim To Be More Secure <http://forums.openvpn.net/topic7355.html#p8898>
04:32 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:32 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:37 -!- common- [~common@p5DDA4794.dip0.t-ipconnect.de] has joined #openvpn
04:38 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:38 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:40 -!- common [~common@p5DDA460C.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
04:40 -!- common- is now known as common
04:51 -!- ksk [ksk@im.knubz.de] has quit [Quit: leaving]
04:52 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:52 -!- ksk [ksk@im.knubz.de] has joined #openvpn
05:13 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:13 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:14 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
05:31 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 276 seconds]
05:34 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
05:41 -!- ksk [ksk@im.knubz.de] has quit [Quit: leaving]
05:49 -!- ThiefMaster [~thief@unaffiliated/thiefmaster] has joined #openvpn
05:49 < ThiefMaster> hi, is it possible to have openvpn listen on an ipv6 address?
05:51 < dazo> ThiefMaster: yes and no ... with the official releases, no ... but with the openvpn-testing 'allmerged' version (development test version) it is possible
05:52 < dazo> ThiefMaster: Complete IPv6 support is planned for OpenVPN 2.3 .... we're expecting to start beta of 2.3 in 3-4 months
05:52 < ThiefMaster> k
05:54 < dazo> ThiefMaster: we need people to test the allmerged and the beta releases ... so if you're willing to help out and report issues to us, that would be great!
05:54 < ThiefMaster> maybe later ;) i need something working right now so i'm lazy and using the version from gentoo portage 
05:54 < ultramage> oh, one more random thing:
05:55 < dazo> fair enough ... the gentoo patch for IPv6 support is what's included into the -testing tree ... so that still helps out :)
05:55 < ultramage> on freebsd, when the vpn connection comes up, for some reason the default link-local route is not added for the tap interface
05:55 < dazo> ultramage: which version?
05:56 < ultramage> I'm currently working around this by a scripted ifconfig action on 'up', but it's not idea
05:56 < ultramage> *l
05:56 < ultramage> OpenVPN 2.1.3 i386-portbld-freebsd8.1 [SSL] [LZO2] built on Sep  9 2010
05:56 < dazo> ThiefMaster: https://community.openvpn.net/openvpn/wiki/TesterDocumentation ... there are links here to devel snapshots ... just in case you're curious ;-)
05:56 <@vpnHelper> Title: TesterDocumentation – OpenVPN Community (at community.openvpn.net)
05:56 < ultramage> I wasn't doing ipv6 over vpn before so I don't remember if 8.0/2.0.x was doing this before as well
05:57 < dazo> ultramage: Just to be sure I understand you correctly ... the FreeBSD build is with IPv6 support or not?
05:58 < ultramage> yes, ipv6 works :)
05:58 < dazo> ecrist: do you know which patches FreeBSD adds for IPv6 support?
05:59 < ultramage> I just restarted openvpn with the script disabled, and suddenly couldn't talk link-local ipv6 with my freebsd machine because the route didn't get added
05:59 < dazo> ultramage: My immediate thought is that this is something JJO (IPv6 transport patch writer) needs to have a look at ...
05:59 < ultramage> I have no clue what's causing this, could be some oversight during interface creation 
06:00 < ultramage> I think freebsd runs a rc script when interfaces are created, I could be mistaken though
06:00 < ultramage> I have the suspicion that sometimes it works, sometimes it doesn't
06:00 < dazo> It might either be specific to FreeBSD ... or a more general issue in the implementation ... but I don't know yet, leaning towards specific FreeBSD issue ... at least if it is JJO's patch which FreeBSD uses
06:00 < ultramage> I'll let you know what happens after tomorrow's restart
06:01  * ultramage checks
06:01 < reiffert> "sometimes it works and sometimes it doesnt" reminds me of a gui os.
06:01 < dazo> ultramage: please bring this one up to the openvpn-devel mailing list ... JJO pays attention to that list
06:01 < dazo> reiffert: I didn't know FreeBSD was a gui OS :-P
06:01 < reiffert> :)
06:01 < ultramage> hm, all I see is a rc script
06:02 < ultramage> unless you're referring to an internal patch that your configure script applies during build time
06:02 < ultramage> freebsd ports do not include any source-level patches to openvpn
06:03 < ultramage> /sbin/route add -inet6 fe80::1\%tap1 -prefixlen 64 -interface tap1
06:04 < ultramage> (this is my workaround)
06:04 < dazo> ultramage: OpenVPN 2.1.3 does not support IPv6 at all, out of the box ... but JJO has written the transport patch (listen/connect to IPv6 addresses), which FreeBSD obviously must have added ... unless they added another patch doing pretty much the same
06:05 < ultramage> although I have two other virtual interfaces and their fe80:: routes get assigned fine
06:05 < dazo> so this is a compile time patch
06:05 < ultramage> dazo: I'm not referring to ipv6 transport... I'm using a tap interface so it shouldn't matter
06:06 < dazo> ultramage: well, then you need to add that yourself ... as OpenVPN knows nothing about IPv6 at all, thus it will not configure any IPv6 addresses
06:06 < ultramage> it's that after the opevnpn connection is established between the two endpoints, and they start talking to each other, the link-local mechanism fails because one of the endpoints does not set a route
06:06 < ultramage> I'm not sure openvpn is even supposed to do that... I thought it is done automagically by the OS somehow
06:07 < ultramage> I'll monitor the issue for a few more days, draw some conclusions and post on the mailing list if it keeps occuring
06:07 < dazo> that's a different issue then ... that's either a bug in the FreeBSD TUN/TAP driver ... or the case that no IPv6 addresses are configured on the interface, thus no need to add link-local stuff automatically
06:07 < ultramage> fe80::%ng0/64                     link#5                        U           ng0
06:07 < ultramage> fe80::%tun0/64                    link#6                        U          tun0
06:08 < ultramage> these two come up just fine, so :/
06:08 < ultramage> hopefully someone will know a way to fix that, because I have no idea at all :)
06:12 -!- albech [~thomas@119.42.78.242] has quit [Quit: Ex-Chat]
06:12 -!- sia is now known as sia^pwnnt
06:18 < ecrist> dazo: not off hand, but I can look it up
06:19 < dazo> ecrist: thx ... after some more enlightening info in the discussion, I doubt any IPv6 patches are added
06:21 < reiffert> ultramage: why tun0 comes up when using tap0?
06:23 < ultramage> reiffert: tun0 is another virtual interface (sixxs.net ipv6 tunnel)
06:27 < reiffert> try again please, bringing tun0 down first.
06:27 < ThiefMaster> how do i allow vpn clients to access the physical network of the server?
06:28 < ultramage> heh, right, as if I was going to cut off my only alternative means of talking to the machine
06:28 < reiffert> ultramage: my crystal ball is broken, sorry that I didnt know.
06:28 < dazo> ThiefMaster: firewalling and routing, that's the things you need to look at
06:28 < reiffert> ThiefMaster: read this:
06:28 < reiffert> !route
06:28 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
06:29 < ultramage> ThiefMaster: either make the server a router on the OS level, or fudge around with openvpn to get some pseudo-equivalent of a router
06:35 -!- Kurogane [~kuro@190.87.80.64] has quit [Read error: Connection reset by peer]
06:37 -!- Netsplit *.net <-> *.split quits: krzee, lupine_85, krzie, ThiefMaster, qermit, Fiouz, nb, hyper_ch, APTX, mace,  (+4 more, use /NETSPLIT to show all of them)
06:43 -!- ThiefMaster [~thief@port-92-200-112-159.dynamic.qsc.de] has joined #openvpn
06:43 -!- ThiefMaster [~thief@port-92-200-112-159.dynamic.qsc.de] has quit [Changing host]
06:43 -!- ThiefMaster [~thief@unaffiliated/thiefmaster] has joined #openvpn
06:44 < ThiefMaster> bah it really sucks.. no unprotected wireless lans in my area.. so how the fuck am i supposed to test if my vpn stuff works :x
06:44 < dazo> ThiefMaster: mobile network?
06:45 < ultramage> what do you mean 'test'? :)
06:45 < ThiefMaster> nope - expensive and i don't have umts etc anyway
06:45 < ThiefMaster> ultramage: testing if i can access machines in my LAN via vpn for example
06:45 < ultramage> ah.
06:45 < ultramage> virtual machine ?
06:46 < reiffert> send me a client cert and I will try out.
06:46 < ThiefMaster> would also have access to the lan, wouldn't it?
06:46 < ultramage> well, technically yes :S
06:46 < ThiefMaster> reiffert: nice offer, but i'd rather do that with someone i know ;)
06:46 < ultramage> give him a temporary cert :)
06:46 < reiffert> ThiefMaster: ultramage knows me.
06:48 < ultramage> ThiefMaster: actually, the VM approach will work
06:48 < ultramage> you just need to say "route <your lan addresses> through the vpn connection"
06:49 < ultramage> then it won't matter if the machine can actually get to them directly
06:49 < ThiefMaster> push "route 192.168.2.0 255.255.255.0" in the server's config  (192.168.2/24 is my lan)?
06:49 < ultramage> route add 192.168.0.1/24 10.0.0.1 metric 10
06:50 < ultramage> if it's a one-time test, you can just cripple your own routing tables directly from the commandline
06:51 < ThiefMaster> k
06:51 < ultramage> or even adding a permanent route to your vpn server, then changing 0.0.0.0/0's gateway (it's how I run from here)
06:52 -!- freaky[t]_ [alpha@freakyy.de] has quit [Ping timeout: 240 seconds]
06:53 -!- Netsplit over, joins: maxJadi, lupine_85, krzie, krzee, nb, wolfric, hyper_ch, APTX, fahadsadah, qermit (+3 more)
07:01 < ThiefMaster> ultramage: won't that kill the vpn connection as i'm also using the 192.128.2.x ip to connect to the vpn server
07:01 < ultramage> that's why I said to first add a permanent route with highest priority to that one machine :)
07:01 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
07:01 < ThiefMaster> ah
07:02 < ThiefMaster> do you know how i do that on windows? never used its route command much
07:02 < ultramage> route -p add RealIP/32 RealGateway METRIC 1
07:02 < ThiefMaster> ty
07:02 < ecrist> dazo: there are no patches added to openvpn on freebsd
07:03 < ultramage> route -p change 0.0.0.0/0 VpnGateway METRIC 300
07:03 < ecrist> that's what I thought but wanted to confirm before i started spouting off.
07:03 < dazo> ecrist: thx!  That's what I began to sense
07:03 < ultramage> ThiefMaster: also, netstat -arn (or 'route print') will show you what the current rules are
07:04 < ecrist> had there been any patches, I would have gotten them cleaned up long ago.
07:04 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
07:08 < ultramage> heh, I love new year... my CA certificate expired, taking my entire cluster test setup down with it
07:08 < reiffert> happy easter then.
07:15  * dazo never uses anything less than 10 years on certificates used for test purposes only
07:19 < ThiefMaster> ok.. using 'push "route 192.168.2.0 255.255.255.0"' pinging a machine in the lan works - at least it receives the ping. however, the responses are lost
07:20 < ThiefMaster> do i need to configure something else on the vpn server to route the responses back through the vpn?
07:21 < ThiefMaster> oh.. do i need to add routes on the machines in the LAN so they know the gateway for the vpn?
07:22 < dazo> ThiefMaster: you might need to have a reverse route too ... put that on the default gateway, or on the client itself ... so that the packet from the LAN client goes through the OpenVPN server
07:22 < ThiefMaster> on the gateway itself.. so a 10.66.66.0/24 via 192.168.2.123 route on my lan's router would do it? for all clients in it?
07:23 < dazo> yes, in most cases
07:23 < dazo> some routers do not like to route traffic back to another gateway on the same network where the traffic came from ... but that's more and more seldom this is seen
07:24 < ThiefMaster> i'm using a dd-wrt router
07:24 < dazo> should be good enough
07:24 < ThiefMaster> should 'route add -net 10.66.66.0/24 192.168.2.123 dev br0' work?
07:24 < dazo> (even though I personally wouldn't trust the dd-wrt firmware, but that's a different story)
07:24 < dazo> ThiefMaster: yeahm that looks correct
07:25 < dazo> not sure if you need 'dev br0'
07:26 < ThiefMaster> bah.. i hate those stripped utils on routers.. no error message but apparently it did not add the route
07:26 < dazo> heh ... try OpenWRT instead :-P
07:29 < ThiefMaster> ah..  route add -net 10.66.66.0/24 gw 192.168.2.123 dev br0
07:29 < ThiefMaster> forgot the 'gw'
07:32 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
07:34 -!- ksk [ksk@im.knubz.de] has joined #openvpn
07:43 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
08:06 < ThiefMaster> i've decided to simply make all my machines vpn clients.. seems to be less trouble
08:06 < ThiefMaster> however, when i want to make my linux client both server and client the client fails when adding a route
08:06 < ThiefMaster> Jan 03 15:03:49 [openvpn] /sbin/ip route add 10.66.66.0/24 via 10.66.66.10
08:06 < ThiefMaster> Jan 03 15:03:49 [openvpn] ERROR: Linux route add command failed: external program exited with error status: 2
08:09 < ThiefMaster> oh nvm looks like i don't even need to make the server box a client, too
08:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
08:24 -!- sia^pwnnt is now known as sia
08:28 < dschuett> ThiefMaster: yeah, i was going to ask why you were making the server a client as well?
08:28 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
08:32 -!- ultramage [umage@kurobara.netvor.sk] has left #openvpn []
08:52 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
08:54 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
09:10 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
09:10 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
09:10 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:12 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Quit: Leaving]
09:13 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
09:13 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
09:23 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
09:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:48 <@vpnHelper> RSS Update - forum: Automatically put on alliases on tun interface <http://forums.openvpn.net/topic7463.html>
09:57 -!- WinstonSmith [~true@g231228010.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
09:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
10:03 < kai_office> !goal
10:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:05 < kai_office> I would like to understand more about the documentation here: http://man.chinaunix.net/linux/efw-admin-guide-html-chunk/efw.vpn.openvpn.html  -- Not very far down the page, it has a section titled "block DHCP responses coming from tunnel". I'd like to figure out how to do this. It looks like the OpenVPN-AS software simply has a "checkbox" for this. Is that true?
10:05 <@vpnHelper> Title: OpenVPN (at man.chinaunix.net)
10:07 < kai_office> Oh, a little closer look, and they are running the Endian firewall, which uses OpenVPN as their VPN solution.
10:09 < ThiefMaster> how do i get windows7 to identify my vpn? currently it's always "unidentified network" which also means it's always classified as a "public network"
10:19 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
10:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
10:23 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
10:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:29 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
10:30 -!- ThiefMaster [~thief@unaffiliated/thiefmaster] has quit []
10:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:34 -!- AltWalt [~AltWalt@unaffiliated/altwalt] has joined #openvpn
10:38 < AltWalt> I would like to create a openvpn server thats hosted  on linux through wmware workstation. I do not want the vpn clients to access resources outside of the vpn. Is this unrealistic?
10:41 < kai_office> AltWalt: Ya, you can limit the VPN network to only see VPN traffic. You can limit it even more, by only allowing VPN Clients to see traffic between it and the VPN server (eliminating client-to-client traffic).
10:46 < AltWalt> kai_office: thank you
10:47 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
10:52 <@vpnHelper> RSS Update - forum: Question about what OpenVPN on a DD-WRT router can do? <http://forums.openvpn.net/topic7464.html>
11:04 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 265 seconds]
11:06 -!- sporedi [~chatzilla@mail.utmxtm.com] has joined #openvpn
11:06 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
11:09 < reiffert> kai_office: dhcp request dont make it over a layer tunnel.
11:09 < reiffert> kai_office: they do when using bridged setup (layer 2). On linux you can block them with the help of ebtables (yeah, ebtables, not iptables).
11:10 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 240 seconds]
11:10 < kai_office> reiffert: never heard of ebtables. Is it a replacement firewall for iptables, or can it be supplimental?
11:11 < reiffert> It's an additional stuff you need when using bridges (layer 2).
11:12 < reiffert> see here for info http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html
11:12 <@vpnHelper> Title: ebtables/iptables interaction on a Linux-based bridge (at ebtables.sourceforge.net)
11:15 < reiffert> ecrist: how can I reset my password for the bot?
11:16 < reiffert> http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png :)
11:18 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
11:19 < reiffert> cron2: any idea how to reset the password for the vpnHelper bot?
11:24 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
11:24 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
11:26 -!- AltWalt [~AltWalt@unaffiliated/altwalt] has quit [Quit: leaving]
11:28 < kai_office> reiffert: thanks for pointing me at ebtables. I found something that sounds exactly what I want it to be: http://lists.netfilter.org/pipermail/netfilter/2005-February/058753.html
11:28 <@vpnHelper> Title: blocking dhcp on bridge (at lists.netfilter.org)
11:29 < kai_office> I'm not sure how to make sure how to match exactly their interfaces. They seem to have a private and public interface bridged, where I have a private interface and a VPN interface bridged. 
11:29 < kai_office> If I want to block outbound DHCP to the VPN, it seems like I should just set "$PUB" to my tap device (ie: tap0). Does that sound right?
11:30 < reiffert> 50:50 chance to do it right in the beginning.
11:31 < kai_office> reiffert: I don't follow you, sorry. My goal is to simply eliminate the possibility of a machine on one side of the VPN does not see DHCP at all on the other side of the VPN.
11:31 < reiffert> note that there might be an output chain for ebtables as well.
11:31 < kai_office> In either direction.
11:31 < kai_office> reiffert: good point.
11:36 < reiffert> eliminate that a machine on one side does *NOT* see DHCP at all?
11:38 < kai_office> reiffert: I have two gateways running dhcpd. One is logged in via a bridge to the other, so that both LANs appear as a large extended LAN (layer 2 is important.) I want to ensure that each LAN set gets the most "local" gateway via DHCP.
11:39 < kai_office> So each dhcpd server should only serve DHCP to their "half" of the new expanded LAN
11:39 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:40 < reiffert> yeah.
11:41 < reiffert> I once used that setup as well. I switched it to routed setup a while back
11:41 < kai_office> Sounds like I should be blocking FOWARD on the bridge device (br0), and INPUT on the tap device (tap0). Does that sound right?
11:41 < reiffert> Apple can handle remote bonjour registration quite well
11:41 < kai_office> reiffert: Ya, we don't care much for routed, we're only interested in the layer2 broadcasts, with the exception of DHCP :)
11:41 < reiffert> and those network neighbourhood bunnies are a minority in that case
11:42 < reiffert> kai_office: depends on if you have additional road warriors that need an address from your dhcp server.
11:42 < kai_office> I think the road warriors only need the IP they get from OpenVPN.
11:43 < kai_office> The road warriors are not as important as everybody else :) There's only going to be one or two anyway, and they could be routed, and nobody will care :)
11:46 < reiffert> I switched to exactly the opposite.
11:46 < kai_office> reiffert: lol
11:47 < reiffert> Those people who need to access computers on the other side will have to use \\ip.add.ree.ss or \\the-computer-name
11:47 < reiffert> there is *no* other reason to have bridged setup ... just those managers who doesnt understand computers.
11:47 < kai_office> reiffert: we are mostly a Linux shop, so between ssh tunnels and port forwarding, a routed VPN provides very little.
11:48 < reiffert> wheres the broadcast deal then?
11:49 < kai_office> We want UPnP devices to appear on eachother's networks :)
11:49 < kai_office> Which is working great, btw.
11:49 < reiffert> use avahi then.
11:52 < kai_office> reiffert: I haven't been able to figure out how to get any UPnP client to use a routed network to reach or see the UPnP server. Will avahi need to run on the UPnP server or UPnP client?
11:53 < reiffert> it will has to run on your gateways
11:53 < reiffert> doing the announcements
11:53 < reiffert> the SSDP part.
11:54 < kai_office> interesting
11:54 < kai_office> I'll definiately look at that again. I didn't know avahi would plug that hole.
11:54 < kai_office> But, I'm one step away from having what I think I want with OpenVPN, if I can block those pesky DHCP packets.
11:55 < reiffert> e.g. the avai running on site A will announce those services that live on site B
11:56 < kai_office> reiffert: And then with a routed network, UPnP clients at site B will be able to uni-cast to the UPnP server at site A. Is that all that's required then? Routed OpenVPN + Avahi (for SSDP) ?
11:57 < reiffert> jup
12:02 < kai_office> reiffert: cool
12:04 -!- dazo is now known as dazo_afk
12:04 < reiffert> note that is a feature in avahi, preventing forwarding loops
12:04 < reiffert> s,feature,bug,
12:04 < reiffert> so you will have to announce the services in proxy mode
12:04 < reiffert> working just fine.
12:09 < kai_office> reiffert: Ok, I'll look into that if openVPN bridging + etables for DHCP blocking turns into a nightmare. Right now, it looks like it'll do exactly what I want it to do.
12:09 < reiffert> I kept it like your way for over one year.
12:22 < kai_office> reiffert: so what made you change it?
12:30 -!- s7r [~s7r@66.90.75.115] has joined #openvpn
12:32 -!- Cephalon_ [~Cephalon_@eshf72.static.otenet.gr] has joined #openvpn
12:32 < Cephalon_> !welcome
12:32 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:32 < Cephalon_> !goal
12:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:34 < Cephalon_> hello ppl, i have a question, does anyone knows how to do openvpn bonding with two or more vpn connections ??
12:39 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
12:49 <@vpnHelper> RSS Update - forum: Check my config files please <http://forums.openvpn.net/topic7462.html#p8902> || openvpn bonding <http://forums.openvpn.net/topic7465.html>
12:54  * ecrist is closing paypal account.
12:54 <@vpnHelper> RSS Update - forum: Linux client stall at Initialization Sequence Completed <http://forums.openvpn.net/topic7403.html#p8903>
13:02 -!- lkeijser [~leon@fedora/lkeijser] has joined #openvpn
13:03 < lkeijser> hi, is there a way to keep track who was connected for which period of time?
13:04 < Cephalon_> lkeijser you can enable logs on server
13:05 < lkeijser> Cephalon_: true, and i could probably do some grepping to make an entire "user X was connected for Y hours this month" but i was hoping for a more elegant method
13:06 < Cephalon_> that's the only way i know  ;)
13:06 < lkeijser> like for example. if i can have openvpn trigger every time a user (dis)connects, i can log this in a database
13:06 < lkeijser> yeah i was afraid of that :)
13:06 < Cephalon_> if someone knows something different you ll be lucky  ;)
13:06 < krzie> sure, you can have it trigger
13:06 < krzie> --client-conect and --client-disconnect
13:06 < krzie> !script
13:06 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
13:07 < lkeijser> krzie: oh nice, let's have a look, thanks
13:07 < Cephalon_> nice option krzie, i didn't know about that...thanx ;)
13:08 < krzie> np
13:09 < hyper_ch> hi krzie
13:09 < krzie> hey hyper_ch 
13:09 < hyper_ch> congrats
13:09 < krzie> thanx!
13:09 < hyper_ch> been meaning to work on it but Minecraft interfered
13:09 < krzie> i ended up using bash as a cgi, works great
13:11 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Quit: Leaving]
13:16 < hyper_ch> krzie: how's your hotmail account?
13:16 < krzie> hotmail?
13:17 < reiffert> krzie: how can I reset my vpnHelper password?
13:17 < krzie> ild guess it expired around the time microsoft bought it, lol
13:17 < reiffert> my password was bought by microsof? Uh Oh!
13:17 < reiffert> ecrist: why closing paypal?
13:18 < hyper_ch> paypal is evil
13:18 < reiffert> ecrist: how can I reset my vpnHelper password?
13:18 < krzie> reiffert, i didnt even know you had a password on vpnHelper 
13:19 -!- sia is now known as sia^pwnnt
13:19 < reiffert> krzie: ecrist told me that I'm supposed to have the other day
13:19 < reiffert> however.
13:19 < krzie> lemme take a look
13:19 < reiffert> !learn ebtables as http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png
13:19 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
13:19 < reiffert> just tell him that, no need for a password then.
13:19 < reiffert> !ebtales
13:19 < reiffert> !ebtables
13:20 < reiffert> !factoids search --values ebtables
13:20 <@vpnHelper> "bridge-fw" is in bridging mode you could still have a firewall handle who'sdoing what. On linux it's ebtables and reiffert says it's working great.
13:20 < krzie> ahh you do
13:20 < krzie> never end a factoid with a link
13:20 < reiffert> whats my password, something like one two three?
13:20 < krzie> it appends , when you add another
13:21 < krzie> hold on a minute, im working on that, lol
13:21 < krzie> (ive never had to reset a password on it)
13:21 < reiffert> just teach vpnHelper.
13:21 < reiffert> that ebtables thing. you can stop searching that password stuff then
13:22 < krzie> ok, change it to not end with a link
13:22 < reiffert> !learn ebtables as http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png period
13:22 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
13:23 < krzie> message me a new password
13:23 < krzie> meh, that factoid sucks tho
13:23 -!- sporedi [~chatzilla@mail.utmxtm.com] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.12/20101026210630]]
13:23 < krzie> you should actually say something, lol
13:23 < reiffert> something
13:24 < reiffert> !learn ebtables To get some fascinating howtos point your browsers to http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png and be sure to read that fucking stuff.
13:24 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
13:24 < krzie> ya thats hella motivating me to making it so you can add factoids...
13:25 < reiffert> just use copy and waste
13:25 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
13:26 < reiffert> !learn ebtables To get some fascinating howtos point your browsers to http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png and bla bla bla
13:26 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
13:26 < krzie> ok, im gunna go take a shower instead
13:26 < reiffert> sigh.
13:26 < reiffert> those links are great.
13:26 < reiffert> !learn ebtables To get some fascinating howtos point your browsers to http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png annever end factoids with a link because krzie says so.
13:26 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
13:26 < krzie> so i have to read them so i can say what they are in a semi-intelligent factoid?
13:27 -!- CharlieSu [~CharlieSu@ec2-174-129-218-86.compute-1.amazonaws.com] has joined #openvpn
13:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 265 seconds]
13:28 < reiffert> !learn ebtables as Linux uses ebtables for firewalling layer 2 bridges. See http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png to understand how layer 2 and layer 3 works in linux and how to use ebtables.
13:28 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
13:28 < krzie> yay
13:28 < krzie> !learn ebtables as Linux uses ebtables for firewalling layer 2 bridges. See http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png to understand how layer 2 and layer 3 works in linux and how to use ebtables
13:28 <@vpnHelper> Joo got it.
13:28 < krzie> that wasnt so hard was it?
13:28 < reiffert> you skipped the last period.
13:29 < CharlieSu> I'm trying to get a openVPN server running that allows multiple nodes to connect to it.   The following works for a single host (openvpn --proto tcp-server --port 80 --dev tun1 --secret ovpn.key --ifconfig 10.4.0.1 10.4.2.1) but I want to do multiple hosts like this.  (openvpn --proto tcp-server --port 80 --dev tun1 --secret ovpn.key --ifconfig 10.4.0.1 10.4.2.0/24)  What am I doing wrong?
13:29 < krzie> if we add a second one it will add a comma
13:29 < reiffert> !bridge-fw
13:29 <@vpnHelper> "bridge-fw" is in bridging mode you could still have a firewall handle who'sdoing what. On linux it's ebtables and reiffert says it's working great.
13:29 < reiffert> !learn bridge-fw as see !ebtables
13:29 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
13:29 < krzie> !learn bridge-fw as [ebtables]
13:29 <@vpnHelper> Joo got it.
13:29 < reiffert> !bridge-fw
13:29 <@vpnHelper> "bridge-fw" is (#1) in bridging mode you could still have a firewall handle who'sdoing what. On linux it's ebtables and reiffert says it's working great., or (#2) "ebtables" is Linux uses ebtables for firewalling layer 2 bridges. See http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png to understand how layer 2 and layer 3 works in
13:29 <@vpnHelper> linux and how to use ebtables
13:30 < krzie> meh
13:30 < reiffert> see,  there is ".,"
13:30 < krzie> !forget bridge-fw 1
13:30 <@vpnHelper> Joo got it.
13:30 < krzie> not any more
13:30 < reiffert> mhm there you 
13:30 < reiffert> !bridge-fw
13:30 <@vpnHelper> "bridge-fw" is "ebtables" is Linux uses ebtables for firewalling layer 2 bridges. See http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png to understand how layer 2 and layer 3 works in linux and how to use ebtables
13:30 < krzie> CharlieSu, you need --server
13:30 < reiffert> can I get my beer now, krzie?
13:31 < krzie> reiffert, ill never stop a man from getting his beer
13:31 < CharlieSu> krzie: ok.. i'll look at that switch..  nothing else?
13:31 < reiffert> thanks pa
13:32 < reiffert> CharlieSu: take a look at the official howto, it comes with sample configs/
13:32 < krzie> !howto
13:32 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
13:32 < krzie> !sample
13:32 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
13:33 < krzie> !man
13:33 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
13:34 < CharlieSu> reiffert: ok.  
13:38 -!- lkeijser [~leon@fedora/lkeijser] has quit [Quit: Leaving]
13:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:50 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
13:51 < ecrist> !ebtables
13:51 <@vpnHelper> "ebtables" is Linux uses ebtables for firewalling layer 2 bridges. See http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png to understand how layer 2 and layer 3 works in linux and how to use ebtables
13:51 -!- Kottizen [kottizen@unaffiliated/icanhasfreenode] has joined #openvpn
13:51 < Kottizen> what is the difference between the community vpn and the other?
13:51 < ecrist> reiffert: because paypal has decided to start holding my funds for 21 days upon receipt
13:52 < reiffert> !factoids search as
13:52 <@vpnHelper> 'ask', 'winpass', 'pastebin', '2.1-winpass-script', 'easy-rsa-unix', 'broadcast-relay', 'authpass', 'paste', 'nopaste', 'password-only', 'bcast', 'AS', and 'basic'
13:52 < ecrist> for no reason what so ever.
13:52 < reiffert> !AS
13:52 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations
13:52 <@vpnHelper> options supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
13:52 < ecrist> they claim I don't have enough payment receipt history, so this is a safe guard.
13:52 < reiffert> ecrist: uh. paypal sucks.
13:52 < Kottizen> I see
13:52 < ecrist> though, I've been a customer since ~2005 and haven't had a single disputed transaction, and I have a verified address, and I'm registered as a business
13:52 < Kottizen> is there any AS I can use without paying? five concurrent users
13:53 < ecrist> so, I'll use google payments or something else.
13:53 < reiffert> Kottizen: pleae use the links provided above.
13:54 < reiffert> ecrist: and does anyone accept google payments yet?
13:54 < ecrist> you can still pay with paypal as a CC processor.
13:54 < ecrist> you just have to click on the "I don't have an account" link.
13:54 < Kottizen> reiffert: yes, but that one isn't free
13:55 < ecrist> Kottizen: the coummunity/open source OpenVPN doesn't have a gui like AS does
13:55 < reiffert> Kottizen: 20:52 < Kottizen> is there any AS I can use without paying? -> No
13:55 < ecrist> but AS is built upon openvpn.
13:55 < Kottizen> reiffert: ok thanks
13:55 < Kottizen> ecrist: thanks
13:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:03 -!- Cephalon [~Cephalon@ppp-94-64-44-159.home.otenet.gr] has joined #openvpn
14:17 -!- CSMan [~csman@unaffiliated/csman] has joined #openvpn
14:17 < CSMan> hi there
14:17 < CSMan> I have a problem keeping a connection alive
14:18 < dschuett> CSMan - What is your setup
14:18 < dschuett> ?
14:18 < CSMan> trying to connect from a vmware machine with NAT networking to an external VPN
14:18 < CSMan> it connects but the connection is reset after 60 seconds more or less
14:18 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has quit [Ping timeout: 276 seconds]
14:19 -!- art0rius [~art0rius@mail.botetourtva.us] has joined #openvpn
14:20 < art0rius> hello all
14:20 < CSMan> any hints?
14:21 < art0rius> !goal I have openvpn running on a server, and it's doing fine.  I had set up another server configuration file, and my openvpn server starts them both, but it starts my second one twice (I have two separate PID's for the second config file).  Any reason why that happens?  This is on a CentOS 5.5 server using 2.1.4
14:21 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
14:24 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has joined #openvpn
14:25 < krzee> art0rius, is it using priv seperation?
14:25 < krzee> ie, --user and --group
14:25 < art0rius> hmm, hang on, I'll check, I know that I have the config set up to authenticate through PAM, whereas my original server.conf file isn't using that
14:26 < art0rius> krzee, nope, the daemons aren't running with that
14:27 < krzee> ps auxwww|grep vpn
14:27 < krzee> and pastebin the server config without comments
14:28 < art0rius> actually, in my server config, I do have the service being downgraded to user nobody and group nobody after it is started, this is in both config files
14:28 < krzee> !--
14:28 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
14:28 < krzee> when i asked about --user, thats what i was asking
14:28 < art0rius> sorry, that's not showing up in my ps output, but it is in both server config files
14:28 < krzee> thats why theres 2 procs, it needs root to add ifconfig and routes when each client connects
14:29 < art0rius> so should I not have the daemon downgrade set in my second config file then?  since the first config file is already doing that?
14:30 < krzee> no no, its fine
14:30 < krzee> you just shouldnt worry about the extra process ;)
14:31 < art0rius> gotcha, I see nobody as the owner of one of the processes, and root as the other for the second config file, whereas the first one just has nobody running it, that makes sense
14:32 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
14:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:41 < secretary_linux> typically speaking, restarting the openvpn service will not interrupt service to current connections, right? looks like the ubuntu script at least just kills the pid listed in the pidfile and no killalls - but I need to be sure I'm not going to disconenct anyone (assuming the service does come back up ok)
14:45 < CharlieSu> Anyone setup OVPN on Ec2 before?  I'm trying on a Ubuntu instance and anytime I add a bridge interface and bring it up my instance goes dark.  No more network connectivity.  Any ideas?   This is the config I'm adding.  https://gist.github.com/e9ed7188be1d1ee04f16
14:45 <@vpnHelper> Title: gist: e9ed7188be1d1ee04f16 - GitHub (at gist.github.com)
14:47 < dschuett> CharlieSu: have you tried using routed instead of bridged?
14:47 < CharlieSu> dschuett: I haven't.  What are the benefits? 
14:48 < dschuett> CharlieSu: follow this guide line by line and you will have a fully working vpn: http://library.linode.com/networking/openvpn/ubuntu-10.04-lucid
14:48 <@vpnHelper> Title: Deploy VPN Services with OpenVPN - Secure Communications with OpenVPN on Ubuntu 10.04 (Lucid) - Linode Library (at library.linode.com)
14:48 < Kottizen> someone who is good with pptp?
14:48 < CharlieSu> dschuett: does it care that it is ec2? 
14:48 < krzee> !pptp
14:48 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read
14:48 <@vpnHelper> about why to not use pptp
14:49 < dschuett> CharlieSu- Shouldn't matter
14:54 < CharlieSu> krzee: is PPTP tied to bridged or routed?  Can I use SSL based without a bridged network?
14:54 < krzee> pptp is unrelated to openvpn whatsoever
14:55 < krzee> !notcompat
14:55 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
14:56 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 255 seconds]
14:58 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
15:02 < Bushmills> CharlieSu: "Can I use SSL based without a bridged network?" - yes. openvpn (ssl based) can be used in a routed setup 
15:02 < reiffert> Bushmills: "Cn I onw?" - yes. openvpn .. two!?
15:03 < reiffert> that sofa is too small.
15:03 < reiffert> Bushmills: "Can I one?" - yes. openvpn .. two!?
15:04 < Bushmills> first question was answered by krzee already. i assume the second question doesn't relate to the first.
15:04 < Bushmills> after all, he asked for "ssl based", not for "pptp"
15:12 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Ping timeout: 276 seconds]
15:13 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
15:13 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
15:15 < krzee> time for me to figure out getting openvpn onto an HTC evo running android
15:15  * krzee heads to the xda forums
15:16 < hyper_ch> krzee: I started testing a super complicated linux distro :)
15:18 -!- sia^pwnnt is now known as sia
15:21 -!- johnpatcher [~johnpatch@dslb-088-064-225-199.pools.arcor-ip.net] has joined #openvpn
15:22 < johnpatcher> Hi, I've got some issues with a bridged mode vpn. I can successfully connect to the server, but can't reach any client with a simple ping. Any clue what this could be? Do I need to push any routes in bridged mode?
15:23 -!- johnpatcher [~johnpatch@dslb-088-064-225-199.pools.arcor-ip.net] has quit [Client Quit]
15:23 -!- johnpatcher [~johnpatch@dslb-088-064-225-199.pools.arcor-ip.net] has joined #openvpn
15:26 < secretary_linux> johnpatcher: have you checked your firewalls?
15:28 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
15:30 -!- johnpatcher [~johnpatch@dslb-088-064-225-199.pools.arcor-ip.net] has quit [Ping timeout: 246 seconds]
15:30 -!- johnpatcher565 [~johnpatch@dslb-088-064-225-199.pools.arcor-ip.net] has joined #openvpn
15:30 < johnpatcher565> well, i opened up udp port 1194. the openvpn server runs directly on the router. so do i have to check anything else? the connection itself can be established ...
15:32 < secretary_linux> johnpatcher565: seems you may want to make sure the clients don't have firewalls blocking data too
15:32 < johnpatcher565> nope, no firewalls on the clients
15:32 < johnpatcher565> i can't even ping the router itself with its internal ip
15:34 < secretary_linux> johnpatcher565: are you trying to ping the clients from the router or from a machine behind the router?
15:34 < krzee> hyper_ch, what distro?
15:34 < johnpatcher565> I tried to ping machines behind the router, and the router itself from my vpn client, which is, according to the gui, connected successfully
15:34 < hyper_ch> krzee: NixOS
15:35 < krzee> johnpatcher565, why are you using a bridge...?
15:35 < secretary_linux> johnpatcher565: well if you've only opened udp port 1194 on the router, your clients will won't be able to ICMP ping it. you should try pinging the addresses assigned by server to client machines, from the router machine itself
15:36 < secretary_linux> will = still
15:36 < johnpatcher565> secretary_linux: w8, I'm not that fast ;). So I should try to ping the vpn client from the router?
15:37 < hyper_ch> krzee: it's a lot different from confy distros like debian/*buntu/fedora/suse
15:39 -!- johnpatcher [~johnpatch@dslb-088-064-225-199.pools.arcor-ip.net] has joined #openvpn
15:39 -!- johnpatcher565 [~johnpatch@dslb-088-064-225-199.pools.arcor-ip.net] has quit [Quit: http://irc2go.com/]
15:45 < johnpatcher> well, i even can't reach the client from the router with a simple ping :(
15:47 < CSMan> openvpn client in vmware w/windows to remote server anybody?
15:47 < CSMan> i keep getting sigusr1
15:50 < krzee> hyper_ch, how ya liking it
15:50 < hyper_ch> it's intersting
15:50 < krzee> johnpatcher, why are you even using a bridge
15:50 < hyper_ch> I like the part about the build from config
15:50 < hyper_ch> so that you can revert anytime to a previous built config
15:52 -!- johnpatcher [~johnpatch@dslb-088-064-225-199.pools.arcor-ip.net] has quit [Ping timeout: 260 seconds]
15:52 < krzee> cool
15:54 -!- s7r [~s7r@66.90.75.115] has left #openvpn []
15:56 -!- CSMan [~csman@unaffiliated/csman] has left #openvpn []
15:57 < art0rius> erg, having TLS issues
15:57 < art0rius> I've got two server configs running on the same server, and the main one works fine
15:58 < art0rius> however, my second one keeps giving me TLS-Error messages, such as "fatal tls error check_tls_errors_co restarting"
15:58 < art0rius> I'm using the same ca.crt file between both client configs, so I know my ca.crt file isn't corrupt
15:58 < art0rius> since the one client config connects and routes just fine
15:59 < hyper_ch> krzee: if you're bored, have a look at it
15:59 < krzee> hyper_ch, ild have to be pretty bored... im not much into linux
15:59 < hyper_ch> maybe it will change you
16:00 < krzee> did they make the hier closer to freebsd?  do they use gentoo's emerge?
16:00 < krzee> gentoo emerge is the only linux package manager that doesnt annoy me
16:00 < reiffert> :(
16:01 < krzee> portage, whatever its called
16:01 < reiffert> it's the most annoying thing out there.
16:02 < krzee> !?  the most annoying is rpms and especially whatever that lamesauce package manager that redhat uses, followed closely by pkg_add and synaptic
16:02 < krzee> my favorite is freebsd ports followed by gentoo's simply because its an attempt to be ports ;)
16:03 < krzee> hell i prefer osX macports to that redhat nastiness (wth is that called again!?)
16:03 < reiffert> I hate macports, ports and emerge. It just never happens to *just work* when I try to compile things.
16:04 < reiffert> then I start fixing stuff and stuff and stuff, getting somewhat closer to the package I was trying to install intentionally
16:04 < reiffert> and then I utterly fail for fixing this particular package I'm after for hours.
16:04 < reiffert> I just hate it.
16:04 < krzee> dunno what you've had problems with, but ive been using it for years and very very rarely have any issue
16:05 < art0rius> here's my pastebin of my server configuration file that's giving me grief:  http://pastebin.com/8PMW19Cp
16:05 < reiffert> My last macports attempt made me fix 50 packages within 3 months, gaining maintainer status for things getting faster
16:05 < art0rius> the thing that I wonder about is the duplicate-cn part, 
16:06 < krzee> art0rius, pastebin both of them, and the logs from both sides of the failure
16:06 < art0rius> krzee, you want both servers or just the server and client?
16:07 < krzee> both servers
16:07 < krzee> and the client that fails
16:07 < krzee> and logs from server and client that fail
16:07  * Bushmills remembers krzee downloadng and installing 2 GiB of files to install a 500 k program :) 
16:07 < reiffert> krzee: we might share thoughts about rpm, for sure. I cant even say anything bad about fbsd ports that *just work* (more often) ;)
16:08 < reiffert> Bushmills: did it "just work"?
16:08 < Bushmills> i think it took about a week
16:09 < krzee> Bushmills, yes... xcode
16:09 < krzee> reiffert, yep, just worked
16:09 < krzee> took awhile to download tho cause i was grabbing over a satellite connection ;)
16:10 < krzee> but i do agree that macports is far from perfect
16:10 < krzee> its freebsd ports that is my favorite
16:11 < art0rius> i just uploaded the server one a moment ago that's causing me issues, here's the client for that connection (this is the log output):  www.pastebin.com/skLw95n7
16:11 < art0rius> I'll get the config up in a moment for the client
16:12 < art0rius> www.pastebin.com/mkKv52k2 is the client config
16:15 < reiffert> krzee: tried debian yet?
16:16 < art0rius> here's my log portion from the server:  http://pastebin.com/F0Jj8wTG
16:17 < reiffert> http://213.251.145.96/cable/1990/07/90BAGHDAD4237.html
16:18 -!- Kottizen [kottizen@unaffiliated/icanhasfreenode] has left #openvpn []
16:19 -!- caesay [~caesay@unvanquished/associate/sniperx] has quit [Read error: Operation timed out]
16:19 -!- caesay [~caesay@173.236.15.70] has joined #openvpn
16:19 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Read error: Operation timed out]
16:20 -!- markus__ [~markus@c83-250-36-93.bredband.comhem.se] has quit [Read error: Operation timed out]
16:20 -!- caesay is now known as Guest66737
16:20 -!- _skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 276 seconds]
16:20 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
16:20 -!- markus__ [~markus@c83-250-36-93.bredband.comhem.se] has joined #openvpn
16:22 < art0rius> krzee:  any thoughts?  I've been scouring google for an answer, but it's a common issue with a lot of possible causes
16:23 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
16:23 -!- common [~common@p5DDA4794.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
16:23 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
16:23 < hyper_ch> krzee: it's better than portage
16:24 -!- common [~common@p5DDA4794.dip0.t-ipconnect.de] has joined #openvpn
16:26 < krzee> reiffert, yep, in fact i have a debian virtual machine on the laptop
16:26 < krzee> personally, i prefer gentoo over the other linii
16:27 < krzee> yay just rooted the htc evo
16:29 < krzee> art0rius, a couple of those pastebins already expired
16:29 < krzee> so i never got to see themn
16:32 < art0rius> shoot
16:32 -!- _skrusty [~skrusty@83.166.176.39] has joined #openvpn
16:33 < art0rius> here's the server log again:  http://pastebin.com/TUeeLQPj
16:34 < art0rius> the server config:  http://pastebin.com/6eN2vuJp
16:35 -!- Cain` [~Geek@41.141.252.98] has joined #openvpn
16:35 -!- Cain` [~Geek@41.141.252.98] has quit [Changing host]
16:35 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
16:35 < art0rius> the client-config:  http://pastebin.com/VuH0N5RY
16:36 -!- ping_pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
16:36 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
16:36 -!- Bushmills1 [~l@scarydevilmonastery.net] has joined #openvpn
16:36 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Disconnected by services]
16:36 < art0rius> the client log:  http://pastebin.com/nv9BxUMr
16:36 -!- Netsplit *.net <-> *.split quits: kai_office, Apachez, ping-pong, gdb```, Clete2
16:36 -!- Clete2_ is now known as Clete2
16:37 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Operation timed out]
16:37 -!- Netsplit over, joins: kai_office
16:37 -!- Bushmills1 is now known as Bushmills
16:37 -!- Cain` is now known as Cain
16:42 -!- gdb``` [~user@2001:4830:2446:b5:214:4fff:fe4a:f0] has joined #openvpn
16:42 -!- Apachez [~apachez@unaffiliated/apachez] has joined #openvpn
16:49 < art0rius> krzee:  I'm out, I'll take another stab at this tomorrow.
16:51 -!- art0rius [~art0rius@mail.botetourtva.us] has quit [Quit: Nothing to see here, move along]
16:57 -!- lbakalinsky [~levisbaka@99-50-83-21.lightspeed.lsanca.sbcglobal.net] has joined #openvpn
16:57 < lbakalinsky> Hi does openvpn access server have its own channel?
17:01 < krzee> no, it has a support forum
17:01 < krzee> !AS
17:01 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations
17:01 <@vpnHelper> options supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
17:01 < krzee> #4
17:01 < krzee> #4
17:05 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
17:06 < lbakalinsky> openvpn_as has a support forum, where?
17:07 < lbakalinsky> I know that openVPN community has a support forum.
17:07 < lbakalinsky> It's just that we use AS
17:07 < lbakalinsky> join /#moodle
17:08 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
17:08 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
17:08 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:12 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
17:15 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
17:15 -!- lbakalinsky [~levisbaka@99-50-83-21.lightspeed.lsanca.sbcglobal.net] has quit [Quit: Leaving]
17:23 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
17:23 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:24 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
17:26 -!- Guest66737 is now known as caesay
17:26 -!- caesay [~caesay@173.236.15.70] has quit [Changing host]
17:26 -!- caesay [~caesay@unvanquished/associate/sniperx] has joined #openvpn
17:32 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 272 seconds]
17:35 -!- Malard|Home [~ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
17:35 -!- Malard [~ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
17:36 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
17:36 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
17:37 -!- Guest93089 is now known as Martin
17:38 -!- Martin is now known as Guest47835
17:40 -!- nb [~nb@fedora/nb] has joined #openvpn
17:40 -!- Malard [ident@xbmc/staff/malard] has quit [Ping timeout: 246 seconds]
17:41 -!- Malard|Home [~ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
17:41 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
17:41 -!- Malard|Home [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
17:41 -!- Malard|Home [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
17:41 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
17:45 < wolfric> i did a openvpn something.conf. I can see it in the log files constantly retrying as it's failed. how can i cancel this?
17:46 < krzee> same way you cancel any running application in your OS
17:46 < krzee> in unix this would be the kill command...
17:46 < reiffert> mhm.
17:47 < reiffert> - or - disabling the service.
17:49 < reiffert> eg launchd on os x
17:52 -!- pyther24 [~pyther@unaffiliated/pyther] has joined #openvpn
17:52 < pyther24> Hello
17:53 < pyther24> Does anyone have any suggestions on how to easily give users certs and a config file?
17:53 -!- pyther24 is now known as pyther
17:59 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
18:02 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
18:10 < Bushmills> pyther: create a temporary ssh/scp account, let them download config+certs packed into an archive. delete user account after pack has been retrieved.
18:19 < reiffert> send by email in password protected zip file
18:19 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:28 <@vpnHelper> RSS Update - forum: Question about what OpenVPN on a DD-WRT router can do? <http://forums.openvpn.net/topic7464.html#p8904>
18:31 < pyther> Bushmills: my users aren't that smart :P
18:38 < krzee> !win_rollup
18:38 <@vpnHelper> "win_rollup" is please see http://www.secure-computing.net/wiki/index.php/OpenVPN/HowTo_for_Windows_2 for dazo's writeup on making unattended windows installers for openvpn
18:39 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 240 seconds]
18:39 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
18:47 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
18:51 -!- cron2_ [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 240 seconds]
18:52 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
18:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:03 -!- cron2_ [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 264 seconds]
19:17 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
19:26 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
19:28 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
19:30 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has quit [Ping timeout: 255 seconds]
19:31 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has joined #openvpn
19:31 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has quit [Changing host]
19:31 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has joined #openvpn
19:39 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
19:50 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
19:51 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:51 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
20:02 < Bushmills> pyther: mine still manage to drag a file with mouse to local machine 
20:05 -!- WinstonSmith [~true@g231228010.adsl.alicedsl.de] has joined #openvpn
20:06 < pyther> Bushmills: yah I was just trynig to make it easier for them instead of having to navigate to C:\program files\openvpn\config
20:08 < Bushmills> i forgot who once said: "make something that even an idiot can use, and only idiots will use it"
20:09 < pyther> Bushmills: well it boils down too... if I don't give them a click here and press extract thing, I'll be getting called up to help them at home :-/
20:09 -!- WinstonSmith_ [~true@f052097036.adsl.alicedsl.de] has joined #openvpn
20:09 -!- WinstonSmith [~true@g231228010.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:11 < Bushmills> contrary to the experience many others had (or say they had), I found that ordinary users are actually able to learn. it also boosts their self esteem.
20:24 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
20:44 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
21:06 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
21:06 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
21:06 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:35 < krzee> pyther, 
21:35 < krzee> !win_rollup
21:35 <@vpnHelper> "win_rollup" is please see http://www.secure-computing.net/wiki/index.php/OpenVPN/HowTo_for_Windows_2 for dazo's writeup on making unattended windows installers for openvpn
21:35 < krzee> bbl
21:38 -!- WinstonSmith_ is now known as WinstonSmith
21:44 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:48 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 276 seconds]
22:17 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has left #openvpn []
22:21 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:30 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 265 seconds]
22:53 -!- corretico [~corretico@201.201.44.82] has quit [Remote host closed the connection]
23:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
23:19 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
--- Day changed Tue Jan 04 2011
00:17 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
00:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
01:21 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:21 -!- mode/#openvpn [+o mattock] by ChanServ
01:32 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
01:42 < krzie> heh openvpn on android is a PITA
02:04 -!- krzie [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
02:06 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
02:08 -!- idle-boy [~idle-boy@nat/yahoo/x-ikvfubrpwgkyivuo] has joined #openvpn
02:18 < hyper_ch> krzee: I've heard you're a sed guru :)
02:21 -!- WinstonSmith [~true@f052097036.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
02:31 < krzie> wouldnt say guru, but i use it
02:31 < krzie> if i can help, i will
02:33 -!- WinstonSmith [~true@g231243252.adsl.alicedsl.de] has joined #openvpn
02:34 < krzie> grr im so close to working openvpn on android
02:34 < hyper_ch> krzie: how do you replace the first occurance only in a file and that occurence is even two "''" with sed?
02:35 < krzie> gimme example?
02:35 < krzie> of input and desired output
02:37 < hyper_ch> $webroot = ''; $fileroot = '';
02:38 < hyper_ch> no, I would like to replace the webroot var with a string and then the fileroot var -->   $webroot = '/var/www/some/dir'; $fileroot = '/data/home/';
02:39 < krzie> and not every occurance, only the one where it assigns to them
02:40 < krzie> and you dont wanna do this manually because its many files
02:40 < krzie> am i right?
02:40 < hyper_ch> Just the first occurence of '' should be replace
02:41 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:41 < hyper_ch> with the next sed rule I can then replace the second occurence
02:41 < hyper_ch> don't bang your head on it
02:42 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
02:44 < krzie> ok my way is super ugly, and not the best way
02:44 -!- Netsplit *.net <-> *.split quits: openvpn2009, derekv, Antarez, chuckf, grishnav, daemon, kai_office, nb_, jhelwig, _zero_,  (+20 more, use /NETSPLIT to show all of them)
02:44 -!- Netsplit *.net <-> *.split quits: Typone, Bushmills, master_of_master, Guest47835, krphop, Jarpse, Champi, idle-boy, kraut, ashes,  (+7 more, use /NETSPLIT to show all of them)
02:44 < krzie> ill msg it
02:47 -!- Netsplit over, joins: freaky[t], ksk, Meliorator, oc80z, DarthGandalf, dictvm, daemon, Antarez, juhovh, jhelwig (+4 more)
02:47 -!- Netsplit over, joins: cron2_, kai_office, renihs, diphthong, grishnav, derekv, rot13, js_
02:48 -!- Netsplit over, joins: idle-boy, Bushmills, master_of_master, kraut, belZe, ashes, pa, ScriptFanix, Champi, Jarpse (+3 more)
02:48 -!- Martin [martin@shell.ipv6.octocore.net] has joined #openvpn
02:48 -!- Netsplit over, joins: kisom, Typone, LeRrA
02:48 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
02:48 -!- Martin is now known as 14WAAFT4F
02:48 -!- Netsplit over, joins: common, openvpn2009, d457k, Malard|Home, sigius, chuckf
02:48 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
02:48 -!- Netsplit over, joins: _zero_
02:48 -!- mode/#openvpn [+o dazo] by ChanServ
02:49 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Write error: Broken pipe]
02:49 -!- dazo_ [~dazo@openvpn/community/developer/dazo] has joined #openvpn
02:49 -!- mode/#openvpn [+o dazo_] by ChanServ
02:49 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
02:50 -!- dazo_ is now known as dazo
02:56 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has left #openvpn []
02:57 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
03:02 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Read error: Connection timed out]
03:03 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
03:03 -!- mode/#openvpn [+o dazo] by ChanServ
03:11 -!- Cephalon [~Cephalon@ppp-94-64-44-159.home.otenet.gr] has quit [Ping timeout: 240 seconds]
03:11 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:11 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:11 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:24 -!- Cephalon [~Cephalon@ppp-94-64-44-159.home.otenet.gr] has joined #openvpn
03:25 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:25 -!- 14WAAFT4F is now known as Martin
03:26 -!- Martin is now known as Guest93881
03:31 -!- Cephalon_ [~Cephalon_@eshf72.static.otenet.gr] has quit [Ping timeout: 255 seconds]
03:33 -!- Guest93881 is now known as Martin
03:33 -!- Martin is now known as Guest3082
03:36 -!- Cephalon_ [~Cephalon_@eshf72.static.otenet.gr] has joined #openvpn
03:50 -!- master_of_master [~master_of@p57B5775B.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
03:52 -!- master_of_master [~master_of@p57B5330F.dip.t-dialin.net] has joined #openvpn
04:02 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
04:04 <@vpnHelper> RSS Update - forum: Automatically put on alliases on tun interface <http://forums.openvpn.net/topic7463.html#p8906> || Firewall blocked https traffic <http://forums.openvpn.net/topic7466.html>
04:10 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:10 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
04:10 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
04:10 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
04:18 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
04:18 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
04:21 -!- cron2_ is now known as cron2
04:21 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
04:21 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
04:31 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 264 seconds]
04:34 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
04:38 -!- common- [~common@p5DDA4786.dip0.t-ipconnect.de] has joined #openvpn
04:40 -!- common [~common@p5DDA4794.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
04:40 -!- common- is now known as common
05:04 -!- _skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
05:11 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:11 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:11 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:18 -!- Cephalon_ [~Cephalon_@eshf72.static.otenet.gr] has quit []
05:18 -!- _skrusty [~skrusty@83.166.176.39] has joined #openvpn
05:30 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
05:34 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has joined #openvpn
05:34 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has quit [Changing host]
05:34 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
05:45 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 265 seconds]
05:46 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
05:48 -!- krzie [~k@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
06:16 -!- sporedi [~chatzilla@mail.utmxtm.com] has joined #openvpn
06:19 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 250 seconds]
06:20 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
06:45 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
07:01 -!- sia is now known as sia^pwnnt
07:02 -!- sia^pwnnt is now known as sia
07:12 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
07:25 -!- sporedi [~chatzilla@mail.utmxtm.com] has quit [Ping timeout: 240 seconds]
07:28 -!- art0rius [~art0rius@mail.botetourtva.us] has joined #openvpn
07:28 < art0rius> is there an openvpn users mailing list anymore that I can join?  I found plenty of archives, but no info on how to subscribe to one
07:57 < ecrist> !list
07:57 < ecrist> !mailinglist
07:57 < ecrist> !maillist
07:57 < ecrist> oh, vpnHelper isn't here.
07:57 < ecrist> yes, there is a mailing list.
07:57 < ecrist> google "openvpn mailing list"
07:59 < art0rius> thanks, found it.
08:03 -!- WinstonSmith [~true@g231243252.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
08:08 -!- Visual` [~visualsta@unaffiliated/visualstation] has quit [Ping timeout: 246 seconds]
08:09 -!- tessier [~treed@mail.copilotco.com] has quit [Ping timeout: 255 seconds]
08:11 -!- Visual` [~visualsta@unaffiliated/visualstation] has joined #openvpn
08:31 -!- WinstonSmith [~true@g225027135.adsl.alicedsl.de] has joined #openvpn
08:32 -!- zmay [~zmay@89-212-225-234.dynamic.t-2.net] has joined #openvpn
08:44 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
08:47 -!- sporedi [~chatzilla@mail.utmxtm.com] has joined #openvpn
08:47 -!- Visual` [~visualsta@unaffiliated/visualstation] has quit [Ping timeout: 240 seconds]
08:49 -!- Visual` [~visualsta@unaffiliated/visualstation] has joined #openvpn
09:03 -!- thomaschaaf [5b36fb7f@gateway/web/freenode/ip.91.54.251.127] has joined #openvpn
09:05 -!- nb [~nb@fedora/nb] has quit [Read error: Operation timed out]
09:05 -!- x-demon [xdemon@lex.io] has quit [Read error: Operation timed out]
09:07 < thomaschaaf> I'm having some trouble setting up openvpn :( I want to get this: http://dl.dropbox.com/u/5910/Jing/2011-01-03_2359.png going
09:09 < Rienzilla> if you insist on using the same ip range on both sides, use dev tap, and bridge the tap device with the dom0's lan interface on both dom0's
09:09 < thomaschaaf> I have a connection between the two Xen servers and can ping back and forth but just with the standard setup (10.8.0.0) I want to change the server to server 192.168.0.0 255.255.0.0 but it won't let me
09:10 < Rienzilla> if you want a routed vpn (dev tun), then do no use addresses in the same subnet
09:11 < thomaschaaf> okay so tap :) thanks 
09:11 < ecrist> !tunortap
09:12 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:12 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:12 < ecrist> !tunortap
09:12 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
09:12 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
09:13 -!- nb [~nb@fedora/nb] has joined #openvpn
09:13 < Rienzilla> meh, I disagree
09:13 < thomaschaaf> I want to access the mysql from the hosted server in the office so I guess it's "gaming lan" :D
09:13 < Rienzilla> sure, tun is more efficient, but tap can be much much much more easier to set up
09:13 < Rienzilla> -more
09:14 < Rienzilla> not really
09:14 < thomaschaaf> I am open to both sides ;)
09:14 < Rienzilla> well
09:14 < thomaschaaf> I just want it to work in the end
09:14 < ecrist> thomaschaaf: you need routed, no reason for ethernet level vpn
09:14 < Rienzilla> if you use tun, you will have to use different ip ranges on both sides of the tunnel
09:15 < thomaschaaf> ecrist: routed?
09:15 < Rienzilla> routed == tun
09:15 < thomaschaaf> okay great so we have 2 saying tap and 2 saying tun?
09:15 < Rienzilla> well no
09:16 < Rienzilla> you are forgetting my if
09:16 < Rienzilla> IF you don't renumber, you cannot use tun
09:16 < Rienzilla> if you do renumber, you should use tun
09:16 < Rienzilla> the latter probably is a little more work, but more elegant and more efficient
09:17 < thomaschaaf> can I make it 192.168.3.* for the server? and have 192.168.0,1,2.* for office?
09:17 < Rienzilla> yes
09:18 < Rienzilla> (proviuded you use a 255.255.255.0 netmask, which you probably will)
09:18 < thomaschaaf> in the office we have 255.255.0.0 so that desktops (.0.*) can talk to servers(.1.*)
09:19 < thomaschaaf> I would want .3.* to be accessible from the desktops aswell
09:19 < Rienzilla> *shiver*
09:20 < Rienzilla> if you use a routed solution, you will no longer have "one big network"
09:20 < Rienzilla> clients will send packets to the local lan directly to the lan, and packets for any other destination (including your hosted environment) to their default gateway
09:20 < ecrist> thomaschaaf: how many vpn clients are you going to have?
09:21 < Rienzilla> the default gateway will have to decide whether to send the packet out to the internet, or thrugh the vpn
09:21 -!- x-demon [xdemon@lex.io] has joined #openvpn
09:21 < thomaschaaf> ecrist: I just want both virtual machine hosts to be connected through vpn
09:21 < zmay> same question here, i am just playing abit with VPN, nothing serious, setting it up at home, should i use tap then?
09:21 < Rienzilla> (tbh, for a quick solution i'd recommend glueing them together with tap, reading a book about ip networking, and then adjust accordingly)
09:23 < ecrist> we tend to steer folks away from tap as it can cause serious issues if you're not careful, for example, if you're testing locally to the server
09:23 < Rienzilla> yes
09:23 < Rienzilla> it may induce all kind of evil packetloops :P
09:24 < zmay> so tun is the choice then
09:24 < Rienzilla> for most applications, tun is the best choice, yes
09:24 < thomaschaaf> so I think I need to read more about networking :(
09:24 < Rienzilla> thomaschaaf: absolutely
09:25 < thomaschaaf> Rienzilla: small startup founder and have to know everything :D what a great job it is
09:25 < Rienzilla> get some basic idea about ip routing. Then it will be fairly easy to set up
09:26 < thomaschaaf> so final work should be tun right?
09:26 < thomaschaaf> word
09:26 < thomaschaaf> or I should somehow get it to work with tun..
09:26 < Rienzilla> how are your dom's connected to the net?
09:26 < Rienzilla> (to the public internet, I mean)
09:27 < Rienzilla> ...and are the dom0's the default gateway for the machines in the office and in the hosted environment?
09:28 < Rienzilla> If the answer to both is yes, setting up a routed openvpn is going to be fairly easy
09:28 < Rienzilla> uhm
09:28 < Rienzilla> to the latter
09:28 < Rienzilla> lol
09:29 < CharlieSu> How can I have my openVPN clients automatically handle a openVPN server restart? 
09:30 < thomaschaaf> some machines are directly connected to the internet and have two vifs (www server internal net and external net) others like mysql only have one vif which is connected to the internal net)
09:30 <@dazo> !topology
09:30 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
09:30 <@dazo> !/30
09:30 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
09:31 < Rienzilla> meh, then you need static routes on all those clients
09:31 <@dazo> Rienzilla: ^^  tun mode don't need to be complicated with separate /30 subnets ... use --topology subnet
09:31 <@dazo> Rienzilla: you need routes also with tap mode
09:32 < Rienzilla> the tun mode itself isn't complicated, but making sure that all machines on the net send their packets where they're supposed to go can be tricky
09:32 < Rienzilla> if you'd use 192.168/16 on both sides and let the dom0's bridge, you don't need routes 
09:32 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Read error: Connection reset by peer]
09:32 < sno> just spent a week trying to get a vpn client connection shared ^ :) finally working
09:32  * sno needs to learn more iptables
09:33 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
09:33 <@dazo> Rienzilla: but you add a lot of overhead, sending broadcast traffic over the tunnel
09:33 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
09:33 < thomaschaaf> Rienzilla: am I not using 192.168/16 on both sides?
09:33 <@dazo> + you get layer 2 headers in addition
09:34 <@dazo> thomaschaaf: I'm recommending tun mode as well, unless you explicitly need ethernet frames to be passed over the tunnel
09:34 < Rienzilla> dazo: I am aware of that. I'm just saying that in thomas's case it's gonna require much less effort to set up. (Which is something different from saying it's the best solution. A mercedes also takes longer to build than a crappy bicycle)
09:37 <@dazo> CharlieSu: have a look at --keepalive in the man page
09:38 < thomaschaaf> can someone recommend me something to read?
09:38 <@dazo> !route
09:39 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
09:39 <@dazo> thomaschaaf: ^^^
09:39 <@dazo> and:
09:39 <@dazo> !howto
09:39 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
09:39  * Rienzilla generally wants to only make configuration changes on servers and routers. The thought of having to maintain static routes to some subnet via some vpn machine on all clients on both sides of the tunnel gives me severe headaches :-)
09:41 -!- _skrusty is now known as sdkrusty
09:41 -!- sdkrusty is now known as skrusty
09:41 <@dazo> Rienzilla: You do know about --push?
09:41 < Rienzilla> yes
09:42 < Rienzilla> I'm talking about the machines on the lan, that know nothing about openvpn
09:42 <@dazo> then what is this crap about static routes?  you need routes no matter which solution you go for ... and --push "route <mynetwork> <netmask>" does the rest, centrally controlled from the server
09:43 <@dazo> they should just contact the default gateway ... which would know about the openvpn subnet
09:43 <@dazo> (subnets)
09:43 < Rienzilla> that's the problem
09:44 <@dazo> the only way to avoid routing tables ... is routing daemons ... or bridging networks, giving you the extra penalty of broadcast traffic over the VPN - which severely can impact the network performance
09:44 < Rienzilla> his machines have 2 interfaces. One public interface, and one for the office network. I'm not even sure he can control the routing on the defalt gateway of the machines, and I;m not even sure the vpn server is on that same network
09:45 <@dazo> in that little setup, there's no gain doing bridging then ... because you just need to have overview over less than a handful of subnets
09:45 < thomaschaaf> I'm gonna go ofline for a bit.. can'T think anymore :(
09:45 < thomaschaaf> thansk guys
09:46 < Rienzilla> np
09:50 < Rienzilla> There is also little harm in bridging, because the handful of clients will only generate very moderate broadcast traffic. Anyway, call me stupid, but I don't see anyone with zero experience in how routing works setting up the routes on their dsl modems and their openvpn servers in the correct way to make a vpn work properly. At least not in an hour or two.
09:50 -!- thomaschaaf [5b36fb7f@gateway/web/freenode/ip.91.54.251.127] has quit [Ping timeout: 265 seconds]
09:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:52 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
09:52 <@dazo> Rienzilla: bridging is much more complex .... yes, it sounds darn easy ... but there are many pitfalls with bridging which is tricky to foresee for inexperienced users, hence we recommend tun mode primarily, and let tap mode and bridging for more advanced users
09:52 < CharlieSu> dazo: thanks
09:53 <@dazo> Rienzilla: I'll say as Linus Torvalds says: "If you disagree with me, that's fine!  I'll just call you stupid and ugly" ;-)
09:54 < CharlieSu> dazo: says keepalive is for server, not client. 
09:54 < Rienzilla> haha :-)
09:54 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:55 <@dazo> CharlieSu: it's for both ... in fact, it's a macro for --ping and --ping-restart .... so on the server, it will push --ping and --ping-restart values to the clients
09:55 < CharlieSu> dazo: gotcha.. thanks
09:55 < Rienzilla> yes, I have locked myself out of one of my networks due to XenServer discarding STP packets, resulting in a bridgeloop :)
09:55 <@dazo> CharlieSu: if used on the clients, it will just expand to --ping and --ping-restart directly
09:58 < Rienzilla> so the policy is 'advise tap to inexperienced users' for the same reason you don't let your ten your old play with a chainsaw :P
09:58 < Rienzilla> tean-year-old* 
09:58 < Rienzilla> advise tun* 
09:58 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Quit: No Ping reply in 180 seconds.]
09:58 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
09:58 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
09:58 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:00 <@dazo> Rienzilla: yeah, basically .... when they do get tun working, it's easier to understand what's happening and to take such a config up one more level is much easier ... and after all, if you do networking stuff and don't understand the basic routing practices, you shouldn't do networking and especially not VPN ... you need that knowledge to understand how things works anyway
10:00 <@dazo> no matter tun or tap ... you still need to understand routing
10:01 < Rienzilla> That's true. Unfortunately, a lot of the people who come for help here because it doesn't work lack that knowledge
10:02 <@dazo> yeah, that's true ... that's why I believe it's better to learn these guys the basics first ... learn to walk before running
10:03 -!- takamichi [~pri@85.232.213.54] has quit [Remote host closed the connection]
10:06 < Rienzilla> haha I sometimes tend to give people duct tape to fix their cars :P
10:07 < Rienzilla> anyway
10:07 < Rienzilla> dinner time
10:07 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
10:10 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
10:14 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
10:16 < ecrist> a
10:16 -!- Irssi: #openvpn: Total of 130 nicks [3 ops, 0 halfops, 0 voices, 127 normal]
10:16 < ecrist> !factoids
10:16 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:16 -!- macsppadic is now known as plussppadic
10:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 272 seconds]
10:21 -!- art0rius_ [~art0rius@mail.botetourtva.us] has joined #openvpn
10:24 -!- art0rius [~art0rius@mail.botetourtva.us] has quit [Ping timeout: 240 seconds]
10:27 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 276 seconds]
10:27 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
10:29 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:29 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:29 <@vpnHelper> RSS Update - forum: Small issues with a working vpn tunnel <http://forums.openvpn.net/topic7468.html#p8915>
10:29 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
10:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:31 -!- zmay [~zmay@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
10:47 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 250 seconds]
10:47 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
10:48 -!- WinstonSmith [~true@g225027135.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
10:48 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
10:49 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:49 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:50 -!- WinstonSmith [~true@g231243252.adsl.alicedsl.de] has joined #openvpn
10:50 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
10:50 < Essobi> krzie: whatup whatup
10:51 < krzie> wassup man
10:51 < Essobi> sos
10:51 < krzie> i think i have pnuemonia
10:51 < Essobi> awww sheeit, keep that away from me
10:51 < Essobi> umm... like.. invest in a waterpipe?  lol
10:51 < krzie> haha
10:52 < krzie> im just gunna go get a nubulizer and antibiotics
10:52 < Essobi> word
10:52 < Essobi> nebs help alot
10:53 < Essobi> hot showers too w/o any airducts going
11:08 -!- plussppadic [~sonupunno@88.211.55.77] has quit [Quit: plussppadic]
11:13 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
11:13 < Essobi> krzie: hope you feel better man.
11:14 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
11:14 -!- WinstonSmith [~true@g231243252.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:17 -!- kai_office [~kai@asa-2.fbp.ore.fiber.net] has left #openvpn []
11:18 < gladiatr> krzie, pneuomonia, huh?  rude...
11:19 < gladiatr> krzie, I just got my over my first dance with gastrointeritis...
11:19 -!- cephalon_ [~Cephalon@ppp-94-64-34-132.home.otenet.gr] has joined #openvpn
11:20 < krzie> ouch
11:20 < krzie> Essobi, thx
11:21 < Essobi> gladiatr: gi shit ain't fun... (pun intended)
11:22 -!- s7r [~s7r@178.73.198.33] has joined #openvpn
11:23 -!- Cephalon [~Cephalon@ppp-94-64-44-159.home.otenet.gr] has quit [Ping timeout: 255 seconds]
11:24 < gladiatr> Essobi, lol.  Indeed.  Kinda gives you a little taste of the Evil that is cholera (except, of course, that gi goes away)
11:24 < Essobi> Heh.
11:24 -!- pezhore [~pezhore@cpe-67-247-84-194.rochester.res.rr.com] has joined #openvpn
11:24 < Essobi> Drink lots of fluids and keep your BAC low for a while, you'll be fine. ;)
11:25 < pezhore> Hello everyone, quick question. I can't seem to get Openvpn to work on my Ubuntu 10.10 laptop - getting a no such device (errno=19)
11:25 < gladiatr> modprobe tun
11:26 < pezhore> FATAL: Module tun not found.
11:26 < pezhore> I guess that tells me that module hasn't been compiled? maybe?
11:26 < gladiatr> odd
11:26 <@dazo> pezhore: are you running your ubuntu under some kind of virtualisation?
11:26 < gladiatr> that's a stock ubuntu install?
11:27 < gladiatr> find /lib/modules/$( uname -r ) |grep tun.ko
11:27 <@dazo> or have you compiled your own kernel?  or using a non-stock kernel?
11:27 < pezhore> stock install... but sort of under virutalization
11:27 <@dazo> what kind of "sort of"?
11:27 < pezhore> Its running on my Cr48 laptop... the only way to get it on there was to first install it under a VM
11:27 < pezhore> then dd it over
11:28 < fahmad> hey everyone
11:28 < gladiatr> hi, fahmad
11:28 < gladiatr> You should still have a complete modules install, regardless.
11:29 < pezhore> gladiatr: that's what I thought... and I see a /dev/net/tun
11:30 < pezhore> hrm is there a way to re-install that module?
11:33 < gladiatr> Where did you do the initial install?
11:33 < gladiatr> Was that in a vm?
11:33 < pezhore> yes it was in Virtualbox
11:33 < gladiatr> I haven't messed with 10.10... I can't imagine they would've statically added that module...
11:34 <@dazo> pezhore: reinstall the kernel packages ... or just kernel modules, if that's a separate package
11:34 <@dazo> it's a while since I played with Ubuntu, so I don't recall
11:34 < krzie> any of you got any experience with android?
11:35 < pezhore> krzie: I do, what are you looking to do?
11:35 < pezhore> dazo: I'll give that a shot. Thanks for your help
11:35 < gladiatr> sudo aptitude reinstall linux-image-$( uname -r)
11:35 < krzie> pezhore, i have tun loaded, am starting openvpn, but it cant find 'route' or 'ifconfig'
11:36 < krzie> and i cant make symbolic links, read-only filesystem
11:36 < pezhore> rooted device?
11:36 < krzie> yes
11:36 < pezhore> do you have adb access? 
11:36 < krzie> yes
11:37 < krzie> thats how im starting it during testing
11:37 < pezhore> I would try using adb to remount the /system partition in rw, create the symbolic links, then reboot (or remount as ro)
11:37 < pezhore> that may help
11:37 < pezhore> what device out of curiosity?
11:37 < krzie> your advice is solid, matches the web, but it wont let me remount
11:37 < krzie> EVO (aka supersonic)
11:38 < pezhore> hrm
11:38 < pezhore> I've also got the evo
11:38 < pezhore> let me fire up adb
11:38 < krzie> MacBook-Pro:platform-tools krzee$ ./adb remount
11:38 < krzie> remount failed: Operation not permitted
11:39 -!- WinstonSmith [~true@g225027135.adsl.alicedsl.de] has joined #openvpn
11:41 < pezhore> yea, I think you'll need to do in adb shell something like mount -o rw,remount -t ext2 /dev/block/mtdblock4 /system
11:41 < pezhore> i'm not 100% on it being of typeext2
11:41 < pezhore> *type ext2
11:42 < pezhore> actually looks like its yaffs2
11:43 < krzie> # mount -o rw,remount -t ext2 /dev/block/mtdblock4 /system
11:43 < pezhore> word of advise... when you're working in adb shell, the first thing I do is: busybox sh
11:43 < krzie> # mkdir test
11:43 < krzie> mkdir failed for test, Read-only file system
11:43 < pezhore> oh
11:43 < pezhore> hrm
11:43 < krzie> oh sweet didnt know i had sh
11:43 < pezhore> yea gives you history and auto complete
11:43 < pezhore> :)
11:43 < pezhore> try mkdir /system/test
11:44 < pezhore> because you'll probably be in / still
11:44 < krzie> oh damn, it works@!
11:44 < krzie> you rock
11:44 < pezhore> :D
11:44 < pezhore> I try
11:44 < pezhore> be sure to reboot when you're done with the symbolic links
11:44 < pezhore> having a rw system partition can be a security risk
11:45 < pezhore> rebooting will take care of that
11:45 < gladiatr>   /log storage/docs/android/things_to_know_for_when_I_am_forced_onto_an_android_problem_that_will_inevitably_piss_me_off.txt
11:45 < krzie> lol
11:45 < krzie> it was so surprisingl;y easy to root
11:46 -!- sporedi [~chatzilla@mail.utmxtm.com] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.12/20101026210630]]
11:46 < gladiatr> nice
11:46 < pezhore> tell me about it. almost as easy as the Nook Color
11:47 < krzie> gladiatr, file this link in that text as well... http://forum.xda-developers.com/showthread.php?t=881747.
11:48 < Essobi> gladiatr: lol, nice log..
11:48 < gladiatr> kick ass
11:48 < Essobi> gladiatr: ex co-worker of mine had a habit of expressing how he really felt in project names and commit messages.
11:48 < krzie> haha
11:49 < Essobi> gladiatr: Id_rather_stab_my_eyes_out_then_work_on_this_stupid_fing_project
11:49 < Essobi> heh
11:50 < gladiatr> hehe!  At work, a past-time of mine is to express things generally spoken of in the expletive or profane using my mad english skills.  It's always so much fun to watch the expression on managerial faces when they realize what is being said and at the same time, realizing that they have no basis for getting on my case for saying it.
11:50 < krzie> well in that case...
11:51 < krzie> touch HTC_EVO_is_the_dopest_phone_i_have_ever_seen.txt
11:51 -!- wunderkin [~kbockman@69-92-51-205.cpe.cableone.net] has joined #openvpn
11:52 < wunderkin> !welcome
11:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:52 < gladiatr> krzie, Yeah.  I think it looks pretty impressive as well.  I picked up this N900 for the low, low price of nothing around the time I was phone shopping, so my choice of android platforms was put off until I'm ready to retire it.
11:53 < wunderkin> !goal
11:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:53 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
11:53 < krzie> gladiatr, n900 can crack wep!
11:53 < Essobi> You guys see the latest Android bug? lol
11:53 < krzie> only phone i know of that has a wifi adapter that can do passive reinjection
11:53 < gladiatr> krzie, Yeah.  Sweet, little computer
11:53 < wunderkin> !route
11:53 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
11:53 < pezhore> hrm... seems my uname-r is't found... linux-image-2.6.32.23+drm33.10 :(
11:53 < Essobi> krzie: The one where it sens TXTs to the wrong contacts?
11:53 < Essobi> krzie: it's lol worthy
11:54 < krzie> Essobi, the n900 does that??
11:54 < krzie> ohh
11:54 < krzie> android bug
11:54 < krzie> no didnt hear of that
11:54 < Essobi> yea.. rather humerous.
11:54 < Essobi> no less lol worthy then the iphones alarm app failing after 1-1-11.
11:55 < krzie> i was about to mention that!
11:56 < gladiatr> that's just Apple's way of letting its users know that It's All About to End--take it easy..
11:57 < wunderkin> heh
11:58 < krzie> but thats no worse than antennagate
11:58 < krzie> "dont hold it like that"
11:59 < Essobi> lol
11:59 < Essobi> gladiatr: That's 2012, not 2011. ;)
11:59 < Essobi> antennagate was lol worthy cause the RF engineer TOLD them it was going to happen and they ignored them.
11:59 < gladiatr> hehe
12:05 < fahmad> hey 
12:05 < wunderkin> hey, sorry to interrupt, lol, but how can i config openvpn (or is this another layer?) so that i can assign floating ips behind the client and the other clients will be able to access it.. i'm already using client-to-client.. i'm using tun interface now.. guessing i would need a bridge but not sure how to configure it.. the server has a regular public ip and i want to use local ips for the vpn.. when i tried to bridge with the external i
12:05 < fahmad> i have very strange issue that openvpn is not giving me good speed however on same server i am getting 4 Mbps speed ...
12:06 < fahmad> any idea ?
12:06 < krzie> wunderkin, you saying you want to access the LAN behind a client?
12:06 -!- pezhore [~pezhore@cpe-67-247-84-194.rochester.res.rr.com] has left #openvpn []
12:06 < wunderkin> krzie: yeah, but it's not like each client is on their own separate network block.. i want to use an ip on the same network and move it between clients (for ha)
12:07 < gladiatr> fahmad, what's the upstream bandwidth on your client connection?
12:08 < fahmad> gladiatr: its 100 Mbps port
12:08 < krzie> wunderkin, i dont understand what you mean
12:08 < gladiatr> fahmad, is that the server or the client?
12:08 < fahmad> server ...
12:09 < gladiatr> fahmad, what's the upstream bandwidth on the client?
12:09 < fahmad> hold
12:09 < gladiatr> k
12:10 < wunderkin> krzie: each client will be assigned an ip on the 10.0.0.0/24 block.. but i want to manually add an ip to 1 of the clients (a floating ip) also on 10.0.0.0/24.. and i want to be able to access it on any of the clients on the vpn.. i can access all clients via their primary ip using client-to-client, but i'm guessing the only way to be able to access other ips on that server (same network) would be to bridge
12:12 < krzie> you want 1 of the clients to have a static ip?
12:12 < fahmad> 10 MB connection @ client end
12:12 < fahmad> wunderkin: use ccd with ifconfig pool
12:13 < fahmad> !ccd
12:13 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
12:13 < wunderkin> krzie: they all will be assigned a static fixed ip.. that part is fine
12:13 < fahmad> !ifconfig-pool
12:13 < gladiatr> fahmed, 10M on the upstream?
12:13 < fahmad> yup
12:14 < krzie> wunderkin, sorry man, i dont understand what your goal is
12:14 < gladiatr> Are you routing all your client traffic through the bridge?
12:14 < fahmad> i am not using bridge
12:15 < krzie> wunderkin,  you dont need a bridge, that i know so far
12:15 < krzie> (you didnt mention needing layer2)
12:15 < gladiatr> ahh.. my vision blurred between yours and wunderkin's entries lol
12:16 < wunderkin> krzie: each client is assigned a static fixed ip, but i also want to assign an ip alias to the vpn interface.. this is a floating ip that will move to different clients, i need to be able to access the floating ip from any of the vpn clients.. they're all on the same network
12:16 < krzie> fahmad, you use udp right?
12:16 -!- dazo is now known as dazo_afk
12:16 < fahmad> krzie: yes also tcp
12:17 < krzie> tcp you can expect speed issues
12:17 < krzie> udp, test your mtu
12:17 < krzie> !mtu
12:17 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
12:17 < fahmad> ok
12:18 < krzie> wunderkin, whats the purpose of the "floating ip"
12:18 < wunderkin> krzie: for high availability.. i assign a particular ip to whatever server is holding that role at the time
12:20 < krzie> if you use topology subnet you can assign whatever ip you want manually
12:20 < krzie> is you use default topology, you cannot
12:20 < krzie> !topology
12:20 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
12:24 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:26 < wunderkin> krzie: thanks, i'll check out the different topolgy options, so if i use subnet, this isn't going to require a separate subnet per client?  
12:27 -!- WinstonSmith [~true@g225027135.adsl.alicedsl.de] has quit [Read error: Connection reset by peer]
12:27 -!- WinstonSmith [~true@g225027135.adsl.alicedsl.de] has joined #openvpn
12:27 < krzie> correct
12:27 < wunderkin> oh ok.. i'll try that out.. thanks
12:28 < krzie> np
12:34 < wunderkin> with that option, now i can't even ping the static ip from the server
12:37 < krzie> static IPs are different with that option
12:37 < krzie> !static
12:37 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
12:39 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Quit: Leaving]
12:41 -!- tacidsky [~tacidsky@vps.tacidsky.com] has joined #openvpn
12:41 < tacidsky> Where can I find the public key to verify that the openvpn source tarball from?
12:42 < tacidsky> Ah I found it, nevermind
12:42 -!- tacidsky [~tacidsky@vps.tacidsky.com] has left #openvpn ["duh"]
12:42 < wunderkin> krzie: aha, thought it looked wrong.. ok well fixed that but i still can't ping any aliased ips on the tun interface from another client
12:43 < krzie> can the server?
12:43 < wunderkin> not from the server no, i added the alias on a client though
12:43 < krzie> oh and btw, how could that possibly help with HA?
12:44 < wunderkin> its for the app side, so i know what server is master and what's a secondary
12:44 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Leaving]
12:45 -!- agrajag [~agrajag^@CAcert/Assurer/agrajag] has joined #openvpn
12:47 -!- linguini [~user@c-71-193-179-58.hsd1.wa.comcast.net] has joined #openvpn
12:48 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:50 < wunderkin> and by server, i don't mean openvpn ;D  i'm pretty sure i have to bridge for this.. 
12:51 < linguini> I use openvpn to connect two servers, one of which is behind a load-balancing NAT router with 2 public IP addresses.  I have added 'remote wan1' and 'remote wan2' along with float to openvpn.conf.  But it still seems to choke when one of the 2 IP addresses goes down.  Should I expect "float" to work for me?
12:51 < linguini> I see nothing from openvpn in my log files; I just notice that the VPN doesn't work during the outage.
12:53 -!- newmember [~chatzilla@209.82.97.117] has joined #openvpn
12:54 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
12:57 -!- WinstonSmith [~true@g225027135.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
13:00 < wunderkin> another question, i believe by default multicast is supported over openvpn? i believe it is converted to broadcast?
13:10 -!- WinstonSmith [~true@g225027135.adsl.alicedsl.de] has joined #openvpn
13:16 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:36 <@vpnHelper> RSS Update - forum: Small issues with a working vpn tunnel <http://forums.openvpn.net/topic7468.html#p8916>
13:48 <@vpnHelper> RSS Update - forum: OpenVPN with Small Business Server 2003 <http://forums.openvpn.net/topic7469.html>
13:52 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has joined #openvpn
13:53 < grendal_prime> hey guys i need to set up a vpn for quick and dirty work where i will have 10 people dropping in and working on a project.  I dont want to have to distribute keys.  I would like them to just be given a key from the server for a session.  Is there a howto...or..i mean what method of deployment would that be exactly?
13:53 <@vpnHelper> RSS Update - forum: Tapinstall.exe failed to install. Help!!! OpenVPN 1.3.4 <http://forums.openvpn.net/topic7458.html#p8918>
13:55 < secretary_linux> grendal_prime: from my understanding, what you want to do is impossible, and for good reason
13:59 < grendal_prime> seems odd it would be impossible.
13:59 < grendal_prime> https works like that
14:11 -!- newmember [~chatzilla@209.82.97.117] has quit [Ping timeout: 264 seconds]
14:20 < dschuett> if i want a linux server to be a client of an openvpn server where do i store the client files in linux?
14:21 -!- s7r [~s7r@178.73.198.33] has quit [Ping timeout: 241 seconds]
14:24 < wunderkin> dschuett: same directory, just make a client config, use different port
14:27 < dschuett> make client config use different port?
14:28 < dschuett> oh, no these are on seperate servers
14:33 < wunderkin> oh.. that depends on your config
14:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:34 < wunderkin> if you use a package, etc.. i'm not sure where the default is when compiling by source.. should be in the install how-to
14:37 < dschuett> ok, so i just added client.conf, ca.crt, myname.crt, myname.key to /etc/openvpn/ and restarted openvpn...it says it started ok but i don't see my tun interface ??? - this is a ubuntu 10.04 client.
14:38 < wunderkin> check /var/log/messages
14:40 -!- ecrist changed the topic of #openvpn to: OpenVPN 2.1.4 Most Current || 2.2-beta5 Released 03-Dec-2010 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: http://forums.openvpn.net || Developers: #openvpn-devel
15:01 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
15:15 -!- WinstonSmith [~true@g225027135.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
15:19 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has joined #openvpn
15:20 < alhadi> hello
15:20 < alhadi> have a problem
15:20 < alhadi> using a ubuntu 10.10 and downloaded tar file for openvpn 2.1.4 and it is ./configure , make and make install and then i copied the folder to /etc/openvpn.
15:21 < alhadi> when i type openvpn /etc/openvpn/server.conf
15:21 < alhadi> gives error
15:22 -!- thomaschaaf [59b6dd52@gateway/web/freenode/ip.89.182.221.82] has joined #openvpn
15:22 < alhadi> -bash: /usr/sbin/openvpn: No such file or directory  <error>
15:22 < thomaschaaf> Hey I am looking at http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing and don't get what I should put for "server" 
15:22 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
15:23 < alhadi> anyone can help
15:24 < thomaschaaf> alhadi: is that a question or an exclamation?
15:25 < alhadi> question that i am waiting for answer
15:25 < alhadi> that how can i start openvpn
15:25 < alhadi> have conf ready
15:27 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
15:28 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has quit [Ping timeout: 240 seconds]
15:31 -!- WinstonSmith [~true@e179016111.adsl.alicedsl.de] has joined #openvpn
15:37 -!- blee_laptop [~blee@211.71.118.70.cfl.res.rr.com] has joined #openvpn
15:37 < thomaschaaf> openvpn server.conf
15:39 < blee_laptop> has anyone succesfully set up a tap client in fedora 14?
15:40 < blee_laptop> My tun connection works fine, tap isnt
15:42 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
15:43 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
15:45 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has joined #openvpn
15:46 < Essobi> blee_laptop: I'm sure someone had.
15:46 < Essobi> blee_laptop: are the devices showing up in ifconfig?  Checked logfiles?
15:47 -!- cephalon_ [~Cephalon@ppp-94-64-34-132.home.otenet.gr] has quit [Quit: tin kana]
15:50 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
15:52 -!- nb [~nb@fedora/nb] has joined #openvpn
15:52 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
15:59 -!- agagag [~anton@eudaimonia.goto10.org] has left #openvpn []
16:08 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:12 <@vpnHelper> RSS Update - forum: Connect problem to lan gateway <http://forums.openvpn.net/topic7470.html>
16:12 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
16:13 -!- chuckf [~chuckf@ubuntu/member/chuckf] has quit [Remote host closed the connection]
16:15 < thomaschaaf> I configured the server like this: http://pastie.org/1429564 on the client I open the connection. When I ping 192.168.1.1 on the client I don't get any response am I doing something wrong?
16:18 -!- frewsxcv [~frewsxcv@pine-green.feralhosting.com] has joined #openvpn
16:18 < krzee> what is 192.168.1.1?
16:18 -!- frewsxcv [~frewsxcv@pine-green.feralhosting.com] has left #openvpn []
16:19 < thomaschaaf> another computer which is in the 192.168.0.0 network I pushed that network so I thought it would be available?
16:19 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 255 seconds]
16:22 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has quit [Ping timeout: 240 seconds]
16:23 < krzee> does openvpn run on the router for that LAN?
16:23 < thomaschaaf> the openvpn is connected to the LAN with the eth1
16:24 < krzee> is it the LAN's default gateway?
16:24 < thomaschaaf> krzee: the openvpn is connected to the LAN with the eth1
16:24 < krzee> that doesnt answer my question...
16:25 < thomaschaaf> I'm sorry I don't understand then :(
16:25 < krzee> this should help
16:25 < thomaschaaf> the client is not connected to the LAN
16:25 < krzee> !route_outside_openvpn
16:25 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
16:27 < krzee> the router that 192.168.1.1 uses needs to know about the VPN
16:27 < thomaschaaf> the openvpn server is not the gateway for the entire lan
16:27 < krzee> THAT was the question
16:27 < krzee> you definitely need what i said above
16:27 < thomaschaaf> 192.168.1.1 is the actual nat/dhcp etc server
16:28 < krzee> oh by the way
16:28 < krzee> something makes no sense
16:28 < krzee> you have these:
16:28 < thomaschaaf> krzee: I am woundering wheather my "server" config makes send
16:28 < thomaschaaf> sense
16:28 < krzee> server 10.1.1.0 255.255.255.0
16:28 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has joined #openvpn
16:28 < krzee> AND you have
16:28 < krzee> route.1.1.0 255.255.255.0 AND an iroute for 10.1.1.0
16:29 < krzee> is 10.1.1.X the client's LAN?
16:29 < thomaschaaf> well the lan of the "client" is 10.1.1.0 
16:29 < krzee> then you need to change the entry for server
16:29 < thomaschaaf> to anything else?
16:29 < krzee> make it server 10.8.0.0 255.255.255.0
16:29 < thomaschaaf> okay
16:29 < krzee> then
16:30 < krzee> your server lan's router needs 2 entries to its routing table
16:30 < krzee> 1 for 10.8.0.0/24 and 1 for 10.1.1.0/24
16:30 < krzee> to go to the LAN ip of your server
16:30 < krzee> and your client lan's router needs 2 entries as well
16:30 < krzee> 1 for 10.8.0.0/24 and 1 for 192.168.0.0/16
16:32 < thomaschaaf> krzee: hmm I am a beginner in these things :( 
16:33 < krzee> then go read this
16:33 < krzee> !route
16:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
16:33 < krzee> read the whole thing well, but especially read "ROUTES TO ADD OUTSIDE OPENVPN"
16:33 < krzee> because that section outlines your problem
16:34 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has joined #openvpn
16:34 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
16:34 < thomaschaaf> I understand the section but don't know how to actually add routes
16:34 < krzee> what kind of routers do you use?
16:35 < krzee> (also, you're aware that your problem is unrelated to openvpn, right? ;] )
16:35 < thomaschaaf> just the normal "route" command on debian 
16:35 < thomaschaaf> yes I am :(
16:35 < krzee> your routers are running debian?
16:35 < thomaschaaf> yes
16:35 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
16:36 -!- smerz [~smerz@smerz.demon.nl] has quit [Ping timeout: 264 seconds]
16:38 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
16:38 -!- Cain` is now known as Cain
16:38 < thomaschaaf> I give up for the night 
16:38 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has quit [Ping timeout: 240 seconds]
16:40 < alhadi> hello krzee
16:41 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
16:42 -!- thomaschaaf [59b6dd52@gateway/web/freenode/ip.89.182.221.82] has quit [Ping timeout: 265 seconds]
16:46 < krzee> hey alhadi 
16:46 <@vpnHelper> RSS Update - forum: openvpn bonding <http://forums.openvpn.net/topic7465.html#p8920>
16:47 < alhadi> i am using your script :)
16:47 < alhadi> open vpn
16:47 < krzee> the confgen?
16:47 < alhadi> yes sir :)
16:47 < krzee> awesome!
16:47 < alhadi> confgen, genserver, genclient
16:47 < krzee> hows it working for you?
16:47 < alhadi> well
16:47 < alhadi> i generate them
16:47 < alhadi> but openvpn dont start
16:47 < alhadi> donno what is mistake
16:48 < krzee> did you look at your logfile?
16:48 < alhadi> actually No tbh.
16:48 < krzee> if you pastebin the logfile ill tell ya whats wrong
16:48 < krzee> !logfile
16:49 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
16:49 < alhadi> !man verb
16:49 < krzee> !man
16:49 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
16:51 < alhadi> i used to do the logging stuff in linux but forgot. let me recall
16:52 < alhadi>  /var/log/messages
16:52 < alhadi> fianlly
16:52 < alhadi> brb
16:57 -!- art0rius_ [~art0rius@mail.botetourtva.us] has quit [Quit: Nothing to see here, move along]
16:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
17:00 < alhadi> krzee irc:~/openvpn-confgen#.. now trying to start openvpn again
17:00 < alhadi> refreshed the install too
17:03 <@vpnHelper> RSS Update - forum: Internet Routing Issue <http://forums.openvpn.net/topic7471.html>
17:05 < alhadi> irc:/etc/openvpn# /etc/init.d/openvpn start
17:05 < alhadi> Starting virtual private network daemon: server failed!
17:06 < alhadi> after generating keys
17:06 < alhadi> i dont know where it goes
17:08 < alhadi> that script did not configured the keys..
17:09 < alhadi> http://www.pastie.org/private/j9ijoruxcxq3b61uxnd1w
17:09 < alhadi> krzee if you can check please
17:21 < krzee> i will, work is getting busy so gimme a few
17:21 < krzee> ya my script doesnt do the keys yet
17:22 < krzee> after ecrist re-codes ssl-admin to take cmdline args i will build that in using ssl-admin
17:33 < alhadi> sure
17:33 < alhadi> sounds good. btw i love your script. made life easy for me :)
17:35 < alhadi> i hope it did also keys so the hassle to do it done by the script itself. let me try workaround to see if i can setup keys in anyway.
17:35 < alhadi> its ubuntu and i dont see a folder under /etc/openvpn/easy-ras anywhere
17:36 < alhadi> it just says /etc/openvpn and 2 conf files, one server.conf and update-resolve.conf
17:42 < krzee> find / -name easy-rsa
17:46 < krzee> ahh ya your error was the keys
17:46 < krzee> !pki
17:46 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
17:46 <@vpnHelper> specially as a server (see !servercert)
17:46 < krzee> once you find your easy-rsa with the above command
17:46 < krzee> you also wanna make:
17:46 < krzee> !dh
17:46 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
17:46 < krzee> and
17:46 < krzee> !hmac
17:46 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
17:46 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
17:49 -!- sht [sht@2607:f0d0:2001:8b::50:1337] has joined #openvpn
17:56 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Remote host closed the connection]
17:56 <@vpnHelper> RSS Update - forum: Restricted client-client traffic <http://forums.openvpn.net/topic7472.html>
18:00 < alhadi> ok
18:01 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
18:04 -!- Kurogane [~kuro@190.87.80.64] has joined #openvpn
18:18 < blee_laptop> Essobi: no, im getting an error where it says it cant load the tap driver
18:18 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
18:18 < blee_laptop> and the connection dies
18:18 < blee_laptop> sorry, totally late reply
18:19 < |Mike|> windows related blee_laptop ?
18:19 < blee_laptop> No, fedora 14
18:19 < blee_laptop> Using knetworkmanager
18:19 < blee_laptop> let me fpaste a log
18:20 < |Mike|> !ubuntu
18:20 <@vpnHelper> "ubuntu" is dont use network manager!
18:20 < blee_laptop> hmm?
18:20 < blee_laptop> tun's work fine
18:20 < blee_laptop> tap's dont
18:20 < |Mike|> your server is using tun or tap?
18:20 < |Mike|> !tunortap
18:20 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
18:20 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
18:20 < blee_laptop> server is tap
18:21 < blee_laptop> I have a tun and a tap, tun is working great
18:21 < blee_laptop> my tap connection not so much
18:21 < |Mike|> udp versus tcp ":p
18:21 < blee_laptop> http://pastebin.ca/2038475
18:22 < blee_laptop> i think its something to do with line 20
18:22 < blee_laptop> I forgot to mention, that I have plenty of other clients connected to my tap server
18:22 < blee_laptop> but
18:22 < blee_laptop> just not me :-(
18:23 < blee_laptop> I see successful connection server side, then it just disconnects
18:23 < |Mike|> line 10 and 11 are security issue's
18:23 < blee_laptop> i will fix that
18:23 < |Mike|> chmod/chown stuff
18:23 < blee_laptop> I was messing with permissoins during my troubleshooting process
18:24 < |Mike|> line 20 and 21 might be the problem, but i can't see why
18:24 < |Mike|> !tell blee_laptop [logs]
18:25 < blee_laptop> okay just a minute :)
18:29 < blee_laptop> |Mike|: server: http://pastebin.ca/2038477
18:30 < krzee> [16:20]  <blee_laptop> tun's work fine
18:30 < krzee> [16:20]  <blee_laptop> tap's dont
18:30 < krzee> well why do you want tap anyways?
18:30 < krzee> there are some reasons to use it... but normally its not the right choice
18:30 < blee_laptop> I did not set up the tap server
18:30 < krzee> do you know why you want it?
18:30 < blee_laptop> Its bridged onto our local lan
18:30 < krzee> for lan gaming?
18:31 < blee_laptop> for a cluster of windows xp VMs
18:31 < blee_laptop> no
18:31 < blee_laptop> file sharing
18:31 < krzee> !wins
18:31 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
18:31 < blee_laptop> Hmmm? I dont have an issue with wins
18:31 < krzee> you dont need or want tap just to resolve NETBIOS
18:31 < krzee> you can resolve NETBIOS over tun with wins
18:32 < krzee> windows filesharing is layer3
18:32 < krzee> only the NETBIOS resolution is layer2, but if you use wins it is layer3
18:32 < krzee> so use wins, forget about tap, done
18:32 < blee_laptop> all name resolution is set in the routing tables anyways
18:32 < krzee> umm no
18:33 < krzee> routing tables dont have ANYTHING to do with name resolution
18:33 < krzee> maybe you meant hosts file
18:33 < blee_laptop> i think im using the wrong word
18:33 < blee_laptop> right
18:33 < blee_laptop> hosts file
18:33 < krzee> so bottom line, you dont need tap
18:33 < blee_laptop> To be honest, I do not know the reason for choosing a tap device
18:33 < blee_laptop> this system was given to me
18:34 < krzee> cool, time to do it right
18:34 < krzee> and btw you said its all in the hosts file, but i doubt that
18:34 < |Mike|> indeed, you should have red the uttered lines of vpnHelper when i hitted '!tunortap'
18:34 < krzee> that would mean you had the same hosts file in every machine
18:34 < krzee> and if that is true, the 80s called and they want their config back
18:34 < |Mike|> distrubuted, could be 
18:35 < |Mike|> but that's insane, nobody would use that since the start of teh internets :P
18:35 -!- Malard|Home [~ident@xbmc/staff/malard] has quit [Quit: —I-n-v-i-s-i-o-n— 3.2 (July '10)]
18:35 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
18:35 < |Mike|> damn, i would ban someone for such a quit message :$
18:36 < blee_laptop> krzee: we have to edit the hosts file because of quickbooks DBM
18:36 < blee_laptop> its really silly and frustrating
18:36 < blee_laptop> and cant wait till we stop using QB
18:37 < krzee> hah
18:37 < blee_laptop> but thats another headache altogether
18:37 < blee_laptop> Anyways
18:37 < krzee> i find it hard to believe that QB cant get info from a NS
18:37 < krzee> but ill choose to believe ya ;)
18:37 < blee_laptop> thanks, because its working now and i dont want to touch it again
18:37 < blee_laptop> :P
18:38 < blee_laptop> so there isnt an issue with bridging a tun onto the virtual network interfaces for our vms?
18:38 < krzee> i can make my door stay shut with duct-tape, but i dont consider it the right way ;]
18:38 < krzee> you dont need a bridge!
18:38 < blee_laptop> Hmm...
18:38 < blee_laptop> We access all the VM's via the openvpn tunnel
18:39 < krzee> you only thought you needed a bridge because of windows filesharing
18:39 < blee_laptop> by bridging the vpn onto their local virtual interfaces
18:39 < blee_laptop> sorry, wow im completely distrated
18:39 < krzee> you connect each VM seperately!?
18:39 < blee_laptop> I guess thats a pretty major component to this whole thing ><
18:39 < blee_laptop> Yeah we have like 6 people who need access to quickbooks
18:39 < krzee> they are in the same lan?
18:39 < blee_laptop> no, all over the state
18:40 < krzee> oh ok
18:40 < krzee> and all they require is windows filesharing?
18:40 < blee_laptop> Windows filesharing is for the QB DBM
18:40 < blee_laptop> off mapped network drives
18:40 < krzee> oh they are mapped drives... you dont even need WINS
18:40 < krzee> lol
18:40 < blee_laptop> that is something I failed miserably at
18:40 < krzee> you can map the drive by vpn IP
18:41 < blee_laptop> anywho
18:41 < blee_laptop> So, with all that being said
18:41 < blee_laptop> yes, I still need to bridge this vpn onto the local vmnet
18:41 < krzee> in other words, you are doing way too much work
18:41 < krzee> no you dont!
18:41 < blee_laptop> :-o
18:41 < krzee> what do you think a bridge is?
18:41 < krzee> what is the purpose of a bridge?
18:42 < blee_laptop> I need to make the local lan of the vm machines
18:42 < blee_laptop> accessible from the vpn ><
18:42 < |Mike|> those lines remind me of beeing a newby with openvpn :P
18:42 < krzee> [16:41]  <krzee> what do you think a bridge is?
18:42 < krzee> [16:41]  <krzee> what is the purpose of a bridge?
18:42 < blee_laptop> im a newbie, i get a pass :P
18:42 < |Mike|> fail.
18:43 < krzee> !route
18:43 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
18:43 < blee_laptop> it bridges 2 networks together? 
18:43 < krzee> you dont need a bridge for lans
18:43 < krzee> but the internet is a bunch of networks
18:43 < krzee> my network and yours are connected
18:43 < krzee> but not bridged
18:44 < blee_laptop> Hmm, but dont we want to bridge it at layer2 not layer 3
18:44 < krzee> why would you?
18:44 < krzee> what layer2 protocol do you need...?
18:44 < Apachez> arp ?
18:44 < krzee> you said all you use is windows filesharing... that is layer3
18:44 < blee_laptop> mpls? jk
18:45 < Apachez> l2 is also nice if you have the same network on both places
18:45 < |Mike|> Apachez: not in known networks imho
18:45 < blee_laptop> I do follow you
18:45 < Apachez> no need for ip planing
18:45 < krzee> Apachez, until you collide
18:45 < krzee> its better to just do it right
18:45 < krzee> bridging is only needed when you need layer2 to go beyond the endpoints
18:45 < Apachez> you can collide in l3 aswell
18:45 < blee_laptop> I always liked the idea of bridging it
18:46 < blee_laptop> but i guess routing works..
18:46 < krzee> blee_laptop, i always liked the idea of leaving my house open at night... doesnt make it the best idea
18:47 < krzee> Apachez, yes, you can, if you do it wrong
18:47 < blee_laptop> well you need more guns
18:47 < blee_laptop> brb :-o
18:47 < Apachez> theres nothing that says that L3 is the right choice
18:48 < krzee> Apachez, sure there is
18:48 < krzee> !tunortap
18:48 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
18:48 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
18:48 < Apachez> in your fucked up world perhaps
18:48 < krzee> my bot just said it
18:48 < Apachez> but not in the rest of the world were we live
18:48 < krzee> cool, you supprt his bridge then
18:49 < krzee> instead of just arguing, make yourself useful
18:49 < wunderkin> yeah! help me too ;)
18:49 < wunderkin> krzee = krzie?
18:50 < krzee> yep
18:50 < wunderkin> extra krazies
18:50 < wunderkin> maybe Apachez can help me setup a bridge ;D ;D
18:50 < krzee> yep, sounds like he can
18:50 < wunderkin> i'm not sure how else i can do it
18:51 < krzee> do what?  i forget what your goal was
18:52 < Apachez> I guess something with your "mum" and stuff like that
18:52 < Apachez> those horny suckers with a goal in their mind
18:52 < Apachez> and then they find out "ohh wait, I need some line encryption here"
18:52 -!- mode/#openvpn [+o krzee] by ChanServ
18:52 -!- mode/#openvpn [+b *!*apachez@*unaffiliated/apachez] by krzee
18:52 <@krzee> or that
18:52 <@krzee> bye
18:52 -!- Apachez was kicked from #openvpn by krzee [Apachez]
18:52 -!- mode/#openvpn [-o krzee] by krzee
18:54 < wunderkin> unless i add routes and stuff, sounds harder that way
18:54 < wunderkin> the floating ip guy :P
18:54 < krzee> oh right, i still havnt grasped the point of doing it that way
18:55 -!- WinstonSmith [~true@e179016111.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
18:55 < wunderkin> of what? having a floating ip? 
18:56 < krzee> having a second VPN ip in the same subnet, only inside the vpn
18:59 < wunderkin> the servers are connected via vpn to secure everything and have a logical network.. h.a. uses a floating ip to assign to the current server that is available for that role.. if that goes down then something else takes it.. 
19:01 < krzee> ahh
19:01 < krzee> doesnt i t do some layer2 stuff to accomplish that?
19:01 < krzee> it*
19:02 < wunderkin> it uses vrrp (or carp) and multicasts.. i guess you can use unicast in some software but limited to 2 servers
19:03 < krzee> and everything in this setup is actually connected to the vpn (not a lan)?
19:03 < wunderkin> yeah.. vpn.. they are on vps around the us.. have to start out cheap ;D
19:04 < krzee> i believe you need tap
19:04 < krzee> not a bridge, but tap
19:05 < wunderkin> if i don't bridge, how can i do the floating ip? i believe it has to be turned into like a switch and use arp to see where the ip is.. 
19:05 < krzee> tap does arp and all that
19:05 < wunderkin> oh ok
19:05 < krzee> it just doesnt go outside the vpn
19:05 < wunderkin> that's fine.. and then i can multicast too then yeah?
19:05 < krzee> thats why i asked:    <krzee> and everything in this setup is actually connected to the vpn (not a lan)?
19:06 < wunderkin> yeah
19:06 < krzee> correct
19:06 < wunderkin> cool
19:07 < blee_laptop> what have I done :-o
19:07 < blee_laptop> so whose fixing my tap :)
19:08 < dschuett> blee_laptop
19:08 < dschuett> what problem are you having
19:08 < wunderkin> krzee: thanks, will check that out
19:08 < krzee> wunderkin, np
19:09 < blee_laptop> dschuett: my client connects, and then dies
19:09 < dschuett> well that sucks! haha
19:10 < blee_laptop> var/log/messages on client : http://pastebin.ca/2038475
19:10 < dschuett> briged or routed?
19:10 < blee_laptop> server end is bridged
19:12 < wunderkin> krzee: yeah cool.. i'm able to use ip aliases now at least.. will probably take a bit for me to get HA setup
19:13 < secretary_linux> is it possible to bridge on one end and route on the other?
19:13 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
19:15 -!- smerz [~smerz@smerz.demon.nl] has quit [Read error: Connection reset by peer]
19:17 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has left #openvpn []
19:25 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
19:35 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 276 seconds]
19:42 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 246 seconds]
19:46 < krzie> secretary_linux, no, not possible
19:46 < krzie> wunderkin, cool =]
19:47 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
19:53 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
19:53 -!- mode/#openvpn [+o vpnHelper] by ChanServ
19:59 -!- linguini [~user@c-71-193-179-58.hsd1.wa.comcast.net] has quit [Quit: ERC Version 5.3 (IRC client for Emacs)]
20:03 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
20:07 < ecrist> secretary_linux: yes, it is, but not from within openvpn.  both ends need to be the same, but you can add additional routing from there.
20:17 < krzie> good point, i was only thinkin of as related to openvpn
20:19 < krzie> blee_laptop, you might want to try getting it running without network manager at first, then when your openvpn setup works as you wish you can use network manager if you like
20:20 < krzie> that way your logs may be more useful
20:20 < ecrist> been having a metric crap-load of internet issues at my place lately.
20:20 < ecrist> :\
20:20 < krzie> ill trade ya
20:20 < krzie> hehe
20:20 < blee_laptop> krzie: yeah i was gonna do it
20:20 < blee_laptop> im getting distracted with trying to flash something onto my phone :P
20:21 < krzie> ahh cool, i went through rooting / flashing / etc a htc evo last night
20:21 < krzie> that phone is amazing, i need to find the equiv phone that will accept a sim chip
20:22 < krzie> ecrist, you been checking out the CCC vids?  had some great talks
20:22 < ecrist> CCC?
20:22 < krzie> im watching "recent advances in ipv6 insecurities"
20:22 < ecrist> did you omit a P?
20:23 < ecrist> CCCP
20:23 < krzie> 27C3
20:23 < ecrist> heh
20:23 < ecrist> wow, never heard of 'em
20:23  * ecrist reads
20:24 < krzie> http://mirror.netcologne.de/CCC/27C3/mp4-h264-HQ/
20:24 <@vpnHelper> Title: Index of /CCC/27C3/mp4-h264-HQ (at mirror.netcologne.de)
20:24 < krzie> enjoy
20:24 < krzie> the vid on stuxnet was good, the one im watching is really good
20:24  * ecrist wonders if it's run by Dan Langille.
20:25 < krzie> im home with pneumonia
20:25 < krzie> the boss sent me home cause i sound like shit
20:25 < ecrist> hrm, it's a german site
20:25 < krzie> ya man, you never heard of CCC?
20:25 < blee_laptop> krzie: I have a samsung captivate/galaxy s
20:26 < blee_laptop> that would be the closest equiv, but wait till after CES alot of new stuff coming out
20:26 < blee_laptop> tegra 2 based stuff
20:27  * ecrist loves his myTouch 4g
20:27  * ecrist hated his Galaxy S
20:27 < krzie> ya someone mentioned the mytouch 4g
20:28 < krzie> ecrist, you played with an EVO?
20:28 < ecrist> yeah, my buddy has one.  too big for me, tbh
20:29 < krzie> hows it compare?
20:29 < blee_laptop> ecrist: i hate it
20:29 < blee_laptop> alot
20:29 < blee_laptop> that being said
20:29 < ecrist> krzie: I like my myTouch
20:29 < blee_laptop> alot of improvments in the past few months from rom devs
20:29 < blee_laptop> nothing from samsung, never buying anything that relies on software updates from samsung
20:30 < krzie> i wouldnt take their software updates anyways
20:30 < krzie> ill be an unlocker
20:30 < blee_laptop> Well
20:30 < krzie> <-- not in usa
20:30 < blee_laptop> they need to release the source files
20:30 < blee_laptop> so rom makers and make stuff
20:30 < blee_laptop> they havent released it yet
20:30 < blee_laptop> not for froyo at least
20:31 < ecrist> krzie: IPv6 needs to be enabled on fbsd to get RA to do anything.
20:31 < blee_laptop> Where ya from krzie?
20:32 < krzie> im from california
20:32 < krzie> (from)
20:32 < blee_laptop> where are you located krzie? :P
20:33 < krzie> caribbean
20:33 < blee_laptop> ah nice
20:35 < pyther> if I do something like "    ifconfig-push 10.8.1.1 10.8.1.2
20:35 < pyther> " in a ccd file, do I need to excludes those addresses from the address pool in server.conf?
20:38 < krzie> whats your server line look like in the server config pyther ?\
20:39 < pyther> server 10.25.252.0 255.255.255.0
20:39 < pyther> krzie: ^^
20:39 < krzie> then 10.8.1.1 10.8.1.2 arent in the pool anways ;]
20:40 < pyther> krzie: I was going to use 10.25.252.3 10.25.252.4
20:40 < krzie> nope
20:40 < krzie> !/30
20:40 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
20:41 < krzie> and if you are using topology subnet or tap, you dont use ptp style ifconfig-push
20:41 < krzie> !static
20:41 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
20:41 < krzie> .4 isnt a valid IP to push
20:42 < pyther> krzie: yah my brain is the gotter
20:42 < krzie> but once you start using the IPs, no there is no way that i know of to exclude IPs from the pool
20:42 < pyther> so 10.25.252.5 and 10.25.252.6
20:42 < pyther> ahh ok
20:42 < krzie> i just give high IPs for the static
20:42 < krzie> but heres what i assume would happen if you used .6 static
20:42 < krzie> lets say someone else connects and gets .6
20:43 < krzie> then your static guy connects
20:43 < pyther> ahh ok so I should just cut my pool size down to 128
20:43 < pyther> !topology
20:43 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
20:43 < krzie> your server gives him .6, now its route to .6 is to the static client, and the first ,.6 will timeout, then reconnect and get .10
20:43 < krzie> with the timeout being defined by your keepalive setting
20:44 < pyther> yah dirty path that I'd prefer not to go down
20:44 < krzie> i just use topology subnet and give out high IPs static
20:44 < krzie> since im not going to have so many people connected at once
20:45 < krzie> hell by the time you use the whole /24 (in topology subnet) you will be having problems with openvpn not being multi-threaded
20:46 < pyther> krzie: is there any down fall to using topology subnet?
20:47 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:47 < krzie> there is a possible one, depending on your needs
20:47 < pyther> krzie: and that is?
20:47 < krzie> if theres a special privledge to being a certain ip (firewall or something)
20:47 < krzie> in net30 a user cannot manually override his IP
20:48 < krzie> in topology subnet he can
20:48 < pyther> ahh, but I could run ifconfig blah blah and get a new ip that would work?
20:50 < pyther> krzie: did I understand that right?
20:53 -!- nb is now known as Guest89494
20:53 -!- nb_ is now known as nb
20:53 < krzie> pyther, correct
20:53 < krzie> in topology subnet that is possible
20:53 < krzie> in net30 it is not
20:53 < pyther> hmm I wonder if I should worry about that
20:54 < pyther> I'm using eurephia which is dynamically adding enteries to the firewall when a user connects
20:54 < krzie> do certain people get certain access based on them being a certain IP?
20:55 < krzie> is eurephia giving them access or taking away access with those firewall entries
20:55 < pyther> krzie: yep pretty much
20:55 < pyther> I was going to have a static rule for one user, my self
20:55 < krzie> if it gives them access, and otherwise they would have none, thats fine, if it takes access, and otherwise they would have more, thats not
20:55 < pyther> and that would just give me ssh access
20:56 < pyther> so all I do is topology subnet?
20:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
20:56 < krzie> its up to you
20:56 -!- Guest89494 [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
20:56 < pyther> krzie: I better leave it, my "big" boss is going to test it out tomorrow
20:56 < pyther> don't want an egg on my face!
20:57 < krzie> my big boss doesnt know what an IP is
20:57 < krzie> nor does he care to
20:58 < pyther> krzie: mine might know but my point is I don't want to break things :P
20:58 < krzie> [22:40]  <pyther> krzie: I was going to use 10.25.252.3 10.25.252.4
20:58 < krzie> that would have broken things ;)
20:59 < pyther> krzie: it late here well late enough where my brain isn't thinking 100%
20:59 < pyther> and I'm editing firewall rules, oh my!
20:59 < pyther> which leads my to my next question, anyone have a list/website that states the ports that needs to be open for samab/windows file sharing?
21:00 < krzie> !google samba ports
21:00 <@vpnHelper> Chapter 18. Securing Samba: <http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-samba.html>; [Samba] Samba Ports: <http://lists.samba.org/archive/samba/2002-January/036471.html>; Samba Server Security: <http://www.samba.org/samba/docs/server_security.html>
21:00 < pyther> Should the samba ports be the same as the windows ports?
21:01 < krzie> yes, it only exists for compatibility with windows
21:01 < krzie> they made better protocols that dont share compatibility ;]
21:02 < pyther> hehe
21:02 < krzie> the last link from vpnHelper's google has "using a firewall" with the ports listed
21:03 < pyther> yah I saw that, that should help
21:03 < pyther> krzie: you know much about iptables?
21:04 < krzie> im a freebsd guy
21:04 < blee_laptop> does freebsd not use iptables?
21:04 < pyther> krzie: well I'll ask anyways because I think this is a generic (stupid) question....
21:06 < krzie> blee_laptop, nope, iptables is a linux thing
21:06 < pyther> In my FORWARD chain I have a rule that calls the vpn_users chain and matches ctstate NEW, any rules that get called under vpn_user don't need to check ctstate NEW, correct? Since it matched the first time in the FORWARD chain
21:06 < krzie> freebsd has pf ipf and ipfw
21:06  * pyther can't type
21:06 < krzie> pyther, dunno, in pf its way more straight forward
21:06 < krzie> no "chains" and whatnot
21:06 < krzie> but there is #iptables
21:07 < pyther> I guess I'll pop my head in there, and try type better :)
21:08 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
21:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:09 < pyther> krzie: thanks for the help, I think I might play with topology subnet when the next rc comes out
21:09 < pyther> gives me a reason to play with the server
21:09 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Client Quit]
21:13 < krzie> np
21:13 < krzie> the next rc?
21:14 < pyther> krzie: I meant beta, I'm running 2.2beta5 since it had some code integrated into that eurephia needs
21:14 < krzie> ahh cool
21:14 < pyther> I don't quite remember what it does, some type of extra authentcation/key information is sent over
21:15 < krzie> i dunno either, but im sure its cool, eurephia looks really cool =]
21:16 < pyther> Love the security aspect
21:16 < pyther> a cert is tied to a user
21:16 < pyther> so a users cert and username + password would have to be compromissed
21:17 < pyther> therefore a stolen laptop/mobile device doesn't mean access to the vpn
21:18 < krzie> well that existed prior
21:18 < krzie> but it ties things together better
21:19 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:19 < pyther> did it? I thought the username wasn't directly linked to the cert
21:19 < pyther> but my favorite part is the dynamic iptable updates
21:20 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
21:22 < krzie> oh ok thats true
21:22 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
21:22 < krzie> the username was not connected to the cert, but the passphrase on the key was ;]
21:22 < krzie> (which is still a good idea)
21:23 < krzie> ecrist, why does vpnHelper keep repeating himself with those pastebins?
21:25 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
21:27 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
21:27 -!- mode/#openvpn [+o vpnHelper] by ChanServ
21:27 < krzie> heheh i guess he wont repeat anymore! ;]
21:27 < krzie> ahh nm hes baq
21:29 <@vpnHelper> RSS Update - forum: help with Static Key Mini-HOWTO <http://forums.openvpn.net/topic7473.html>
21:37 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
21:38 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
21:43 -!- mcordoba [~mcordoba@201.203.152.35] has joined #openvpn
21:43 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has left #openvpn []
21:44 -!- mcordoba [~mcordoba@201.203.152.35] has left #openvpn ["Saliendo"]
21:44 -!- mcordoba [~mcordoba@201.203.152.35] has joined #openvpn
21:52 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:58 -!- pyther [~pyther@unaffiliated/pyther] has quit [Read error: Operation timed out]
21:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
22:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:21 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:22 -!- mcordoba [~mcordoba@201.203.152.35] has quit [Quit: Saliendo]
22:35 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
22:54 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
22:54 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
22:54 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:06 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
23:07 -!- WinstonSmith [~true@e177090098.adsl.alicedsl.de] has joined #openvpn
23:17 -!- x-demon [xdemon@lex.io] has quit [Ping timeout: 260 seconds]
23:18 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
23:19 -!- x-demon [xdemon@lex.io] has joined #openvpn
23:19 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
23:22 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
23:28 -!- openvpn2009 [patel@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has quit [Changing host]
23:28 -!- openvpn2009 [patel@openvpn/corp/admin/patel] has joined #openvpn
23:28 -!- openvpn2009 [patel@openvpn/corp/admin/patel] has left #openvpn []
23:29 -!- openvpn2009 [patel@openvpn/corp/admin/patel] has joined #openvpn
23:29 -!- mode/#openvpn [+o openvpn2009] by ChanServ
23:29 -!- openvpn2009 is now known as patelx
23:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:51  * ecrist feels like the local BOFH
--- Day changed Wed Jan 05 2011
00:06 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
00:06 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
00:08 -!- jhelwig [~jhelwig@li229-87.members.linode.com] has quit [Ping timeout: 240 seconds]
00:09 -!- ScriptFanix [~vincent@hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
00:09 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
00:13 < krzie> why?
00:13 < ecrist> just do
00:15 < hyper_ch> howdy
00:15  * Bushmills hands his LART, in a nice gift wrapper, over to ecrist
00:16 < ecrist> LART?
00:16 < Bushmills> http://scarydevilmonastery.net
00:17 < ecrist> 0
00:17 < Bushmills> luser attitude readjustment tool
00:21 < ecrist> I fucking hate comcast.
00:21  * ecrist considers social media bomb.
00:26 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:28 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
01:03 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
01:33 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
01:40 -!- wunderkin [~kbockman@69-92-51-205.cpe.cableone.net] has quit [Quit: Leaving.]
02:02 -!- moses [~moses@unaffiliated/moses/x-6794817] has joined #openvpn
02:07 < moses> question
02:08 < moses> my sshd server isnt working when im behind my work proxy, so im gonna go with openvpn
02:08 < moses> is this intelligent?
02:14 -!- WinstonSmith_ [~true@g225024003.adsl.alicedsl.de] has joined #openvpn
02:15 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has joined #openvpn
02:15 < HoboSteaux> is there a place with all of the settings and what they do?
02:17 < hyper_ch> moses: not really... as you are at work, there are pretty good reasons why you can't use it... best to clear it up with the tech guys
02:17 < hyper_ch> HoboSteaux: the man pages?
02:17 < hyper_ch> man openvpn > openvpn.txtz
02:17 < hyper_ch> -z
02:18 -!- WinstonSmith [~true@e177090098.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
02:18 < HoboSteaux> oh hahah duh
02:18 < hyper_ch> !tell HoboSteaux [howto]
02:18 < HoboSteaux> ive been dumping webpages for a 5 hr car ride tomorrow
02:21 -!- jhelwig [~jhelwig@li229-87.members.linode.com] has joined #openvpn
02:23 < hyper_ch> why that?
02:30 -!- WuXorT [~WuXorT@fxip-0012a.externet.hu] has joined #openvpn
02:30 < WuXorT> hello
02:31 < WuXorT> !welcome
02:31 < WuXorT> !goal
02:32 < renihs> moses, most likely your ssh server isnt going to "work" behind your work proxy neither ...:)
02:32 < renihs> your openvpn server i mean
02:32 < moses> ok
02:33 < WuXorT> can I get a little bit of information? I'm looking for a router that can do OpenVPN server
02:33 < renihs> i assume "proxy" is a firewall, and i also assume it wont allow connections behind it without modifications :)
02:33 < renihs> speak to your firewall admin :)
02:34 < HoboSteaux> WuXorT: i know dd-wrt firmware supports it
02:34 < WuXorT> without the need of firmware upgrading or tinkering
02:34 < WuXorT> ive heard there are ones that supports them built in
02:34 < hyper_ch> WuXorT: than aks Doctor Google
02:35 < HoboSteaux> if its residential, flashing is your best bet
02:35 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
02:35 < HoboSteaux> & this is a great place to start: http://www.dd-wrt.com/wiki/index.php/Supported_Devices
02:35 < WuXorT> yeah, ive looked at this webpage
02:36 < WuXorT> my boss states he've encountered a draytek router which could do openvpn out of the box
02:36 < WuXorT> without firmware upgrade and anything
02:38 < WuXorT> google said me f u
02:39 < HoboSteaux> so if its for a business, id do a spearate ovpn server
02:39 < HoboSteaux> separations always beautiful
02:40 < WuXorT> yeah, its for business, but he doesnt want to involve a server
02:40 < WuXorT> we currently use a draytek router which supports pptp and l2tp, but now its old, and we have to change a little bit
02:41 < WuXorT> oh brb
02:41 < HoboSteaux> http://www.draytek.us/draytek-vpn-solution.html
02:43 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 255 seconds]
02:44 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Operation timed out]
02:44 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
02:45 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
02:46 < WuXorT> well primarily looking for a cisco if available :)
02:46 < WuXorT> draytek seems to malfunction when used for years
02:46 < WuXorT> so we kinda going for a "quailtyer" solution
02:48 < WuXorT> but it looks like now we can't avoid flashing
02:50 -!- WinstonSmith_ [~true@g225024003.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
02:52 -!- WinstonSmith_ [~true@g225024003.adsl.alicedsl.de] has joined #openvpn
03:05 -!- WinstonSmith_ is now known as WinstonSmith
03:07 < WuXorT> anyway thanks for your help, goodbye :)
03:07 -!- WuXorT [~WuXorT@fxip-0012a.externet.hu] has quit []
03:20 -!- WinstonSmith_ [~true@g225024003.adsl.alicedsl.de] has joined #openvpn
03:20 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:20 -!- WinstonSmith [~true@g225024003.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
03:21 -!- WinstonSmith_ is now known as WinstonSmith
03:21 -!- WinstonSmith [~true@g225024003.adsl.alicedsl.de] has quit [Client Quit]
03:21 -!- WinstonSmith [~true@g225024003.adsl.alicedsl.de] has joined #openvpn
03:32 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
03:36 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
03:36 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
03:36 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
03:37 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:47 < renihs> heh, seriously, someone looking for a cisco box with openvpn? :)
03:47 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has quit [Ping timeout: 240 seconds]
03:48 < macsppadic> morning 
03:48 < renihs> thats funny somehow :)
03:50 -!- master_of_master [~master_of@p57B5330F.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
03:51 -!- dazo_afk is now known as dazo
03:52 -!- master_of_master [~master_of@p57B57625.dip.t-dialin.net] has joined #openvpn
03:58 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
04:01 -!- thomaschaaf [c1af1a44@gateway/web/freenode/ip.193.175.26.68] has joined #openvpn
04:09 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:09 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:11 -!- Guest3082 is now known as Martink
04:12 -!- Martink is now known as Guest8450
04:12 -!- Guest8450 is now known as Martin`
04:23 -!- WinstonSmith [~true@g225024003.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
04:24 < thomaschaaf> why is the p to p on my client "10.8.0.5"? It's ip is 10.8.0.6 and the vpn servers is 10.8.0.1 and it's p to p is 10.8.0.2
04:31 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
04:32 -!- WinstonSmith [~true@g225024003.adsl.alicedsl.de] has joined #openvpn
04:37 <@dazo> thomaschaaf: that's normal ... and is a p-t-p artefact ...
04:37 <@dazo> !/30
04:37 <@dazo> gah ... vpnhelper is not here
04:37 -!- gregd [~gregd@188-220-38-34.zone11.bethere.co.uk] has joined #openvpn
04:38 <@dazo> thomaschaaf: you can avoid that by adding --topology subnet to your configs
04:38 < thomaschaaf> okay
04:38 < gregd> guys, can someone explain me why the access-server cannot be accessed via any IE borwser? it comes up with an JS error: XMLHttpRequest is undefined
04:38 -!- common- [~common@p5DDA470C.dip0.t-ipconnect.de] has joined #openvpn
04:38 <@dazo> thomaschaaf: normally openvpn uses a /30 (255.255.255.252) subnet for each client ... hence, --topology /30 is the default
04:39 -!- common [~common@p5DDA4786.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
04:39 -!- common- is now known as common
04:39 <@dazo> gregd: I'm sorry ... we don't support AS here ... we're asked to redirect AS users to it's own user forums/support
04:39 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:40 < gregd> dazo: fair enough
04:45 < thomaschaaf> I have a problem with networking http://dl.getdropbox.com/u/5910/Jing/2011-01-05_1113.png is my setup now when I tracert from the virtual server host to "192.168.1.1" gets stuck on the vpn box http://pastie.org/1430651 this is the routing table on the vpn box also the route on the virtual server: http://pastie.org/1430654 would someone be able to help? I know it is mostly routing but also some openvpn.. and I was told to use tun
04:48 -!- WinstonSmith [~true@g225024003.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
04:50 -!- Malard [ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
04:50 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
04:50 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
04:50 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
04:52 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has joined #openvpn
04:55 -!- gregd [~gregd@188-220-38-34.zone11.bethere.co.uk] has quit [Quit: gregd]
04:59 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
05:11 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:11 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:11 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:21 -!- Malard [ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
05:21 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
05:23 -!- jhelwig [~jhelwig@li229-87.members.linode.com] has quit [Quit: jhelwig]
05:28 -!- jhelwig [~jhelwig@li229-87.members.linode.com] has joined #openvpn
05:30 <@dazo> thomaschaaf: make sure you have enabled ip_forwarding ... and double check your iptables setup and your routing tables
05:30 <@dazo> ahh ... routing tables are here
05:31 <@dazo> both your openvpn boxes needs ip_forwarding ... and I suspect it might be iptables being the issue here
05:32 < thomaschaaf> dazo: iptables were empty
05:32 < thomaschaaf> I'm now trying to do it with tap :(
05:34 <@dazo> thomaschaaf: this is not a tap issue
05:35 <@dazo> thomaschaaf: check out with tcpdump on the openvpn client and server ... and then see where the traffic goes or do not go
05:35 <@dazo> tcpdump -n -i <interface>, is a good starter
05:35 < thomaschaaf> k :)
05:36 <@dazo> thomaschaaf: what you are most probably hitting now, is something which would bite you even in tap mode
05:37 -!- WinstonSmith [~true@g225024003.adsl.alicedsl.de] has joined #openvpn
05:39 < thomaschaaf> back to the tun config :D
05:45 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
06:00 < thomaschaaf> dazo: it's not really telling me anything except that it never gets a echo reply
06:14 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Read error: Connection reset by peer]
06:14 < thomaschaaf> if someone could help me to the point where I can ping the other machines in the LAN I'd buy them a pizza :/
06:14 < Bushmills> those machines probably don't like pizzas
06:15 < thomaschaaf> the question is whether you do ;)
06:15 < Bushmills> i tend to think of myself in the first person
06:17 < Bushmills> i s'ppose you'd need to read and apply ...
06:17 < Bushmills> !route
06:17 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 246 seconds]
06:18 < Bushmills> you may want to do it once vpnhelper is online again
06:19 < thomaschaaf> I have read that :/ 
06:19 < thomaschaaf> thats the sad thing
06:20 < thomaschaaf> is there somekind of tracing tool other than traceroute which tells me where my packets are going? they seem to go to the vpn server and not move
06:20 < thomaschaaf> and I don't understand why
06:20 < Bushmills> mtr
06:21 < Bushmills> routing or firewall
06:21 -!- pyther24 [~pyther@unaffiliated/pyther] has joined #openvpn
06:21 < thomaschaaf> I am pretty sure it's routing
06:21 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 250 seconds]
06:21 < Bushmills> s/ or firewall//
06:21 -!- d457k [~heiko@vpn.astaro.de] has quit [Read error: Connection reset by peer]
06:22 < thomaschaaf> does mtr work with command line? or does it need x?
06:22 < Bushmills> X not needed
06:22 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
06:22 < Bushmills> though it can be called in operation modes which require curses 
06:23 < Bushmills> another good way to look at where your packets are going is with   netstat -rn   or   route -n
06:24 < thomaschaaf> http://dl.getdropbox.com/u/5910/Jing/2011-01-05_1324.png
06:24 < thomaschaaf> um yea
06:24 < thomaschaaf> great so they go to ???
06:25 < thomaschaaf> Bushmills: my routing table looks like this http://pastie.org/1430893
06:25 <@dazo> thomaschaaf: if you use tcpdump on the client and server ... you will see where the packet goes ... check both the internal LAN and the tun device, to see if it goes in/out on the correct devices
06:25 < thomaschaaf> dazo: they just arrive at the tun0
06:26 < thomaschaaf> and never go anywhere from there
06:26 <@dazo> thomaschaaf: on which box?
06:26 < thomaschaaf> but I think the routing looks correct
06:26 < thomaschaaf> vpn
06:26 <@dazo> client or server?
06:26 < thomaschaaf> it goes from client to server to nowhere
06:26 < Bushmills> "just arrive at the tun0" "never go anywhere from there"   ... ip forwarding
06:26 <@dazo> thomaschaaf: that's your "vpn box"?
06:27 < thomaschaaf> is turned on
06:27 < thomaschaaf> vpn box = server
06:27 < thomaschaaf> http://dl.dropbox.com/u/5910/Jing/2011-01-05_1113.png
06:27 < thomaschaaf> thats the setup
06:28 < Bushmills> "is turned on" - how do zou know?
06:28 <@dazo> the vpn box ... that's a Xen based VM guest?
06:28 < thomaschaaf> cat /proc/sys/net/ipv4/ip_forward
06:28 < thomaschaaf> dazo: yea on the other system
06:28 <@dazo> "the other system"?  That confuses me
06:29 < thomaschaaf> so there is office and hosted
06:29 <@dazo> yeah, and the vpnbox is in the "Xen Office" block?  So that's a Xen VM?
06:29 < thomaschaaf> yes 
06:31 < thomaschaaf> dazo: so the ping does go vpn client -> vpn server -> ???
06:31 <@dazo> goodie ... then it can be something with the Xen setup ... I don't know much about Xen and tun devices, but I do know you sometimes need some extra tweaks there .... but if you see the traffic *on* the vpnbox's tun device and not on the eth device *on* the vpnbox (that means, inside the VM) ... then it first something inside that VM which needs to be solved
06:31 < thomaschaaf> and vpn client <-> vpn server is possible
06:31 <@dazo> where is the VPN client in this setup?
06:32 < thomaschaaf> hosted is client
06:32 <@dazo> okay, so if that client can ping the VPN server's IP address on the tun device, that's a first good test
06:33 <@dazo> the second is to ping, from the vpn client, the VPN servers eth interface ... if that's not doable ... you'll have to have some firewalls blocking somewhere, or a route issue
06:33 < thomaschaaf> works
06:34 < thomaschaaf> from the vpn client I can ping "192.168.1.52"
06:34 <@dazo> goodie!  Can you ping something behind the VPN eth0 interface?  your router, f.ex?
06:34 < thomaschaaf> nope
06:35 <@dazo> if you then do tcpdump on the eth interface on your vpnbox (server) ... what do you see?
06:35 < Bushmills> 192.168.1.x?  there's no interface in that subnet in http://dl.dropbox.com/u/5910/Jing/2011-01-05_1113.png
06:35 < Bushmills> oh yes, there is. nm
06:36 <@dazo> :)
06:36 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
06:36 < thomaschaaf> dazo: nothing other than ssh 
06:40 < thomaschaaf> on 192.168.1.1 I did a tcpdump too
06:40 < thomaschaaf> 13:40:29.555895 IP 192.168.1.1 > 192.168.1.1: ICMP echo request, id 30060, seq 28, length 64
06:41 <@dazo> uhm ... that's a "ping to self"
06:41 <@dazo> that looks odd
06:41 < thomaschaaf> thats why nothing ever came back..
06:41 < thomaschaaf> now I just need to get that working
06:42 < thomaschaaf> :(
06:42 <@dazo> do you have some NAT rules which tricks you on that box?
06:42 <@dazo> or somewhere else?
06:42 < thomaschaaf> its the router
06:42 <@dazo> if you do the ping from the VPN client ... you should see the IP address of the VPN client ... either it's LAN IP or VPN IP
06:43 < thomaschaaf> yea I don't know why it's doing that :(
06:43 < Bushmills> when you followed !route, !clientlan or !serverlan, did you applied what !clientlan said, or did you look at !serverlan?
06:44 <@dazo> ecrist: where have you hidden vpnHelper now?
06:44 -!- Kurogane [~kuro@190.87.80.64] has quit [Read error: Connection reset by peer]
06:46 < thomaschaaf> but it looks correct in the routing table or not?
06:47 <@dazo> http://pastie.org/1430651 .... which box is ths again?
06:48 < thomaschaaf> dazo: openvpn server
06:48 < thomaschaaf> (office)
06:49 <@dazo> okay ... it might be you need to have a look at your Xen dom0 to see what happens there as well, on the bridge and interfaces you have there
06:50 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
06:54 -!- d303k [~heiko@vpn.astaro.de] has joined #openvpn
06:54 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Ping timeout: 260 seconds]
06:55 < thomaschaaf> dazo: I think the openvpn server (office) is sending the package wrong.. although I don't understand how it sends it without going through eth1 on it (tcpdump -n -i eth1) gives nothing
06:56 < thomaschaaf> did tcpdump -vv -n -i eth1 | grep ICMP
06:56 -!- eKKiM [~eKKiM@ks311098.kimsufi.com] has joined #openvpn
06:56 < thomaschaaf> 12:56:20.631907 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 192.168.1.1 > 192.168.1.1: ICMP echo request, id 36716, seq 1, length 64
06:57 < reiffert> please add -e to tcpdump
06:57 < eKKiM> Hi, can i force an application to not use OpenVPN if openvpn is active?
06:57 < reiffert> eKKiM: same questions would be: how to tell an application what routing table to choose
06:57 < eKKiM> ok
06:58 < reiffert> eKKiM: but as routing tables are done by the operating system .. 
06:58 < eKKiM> how to tell an application what routing table to choose?
06:58 < thomaschaaf> reiffert: 12:57:58.179907 00:16:3e:56:ab:64 > 00:16:3e:1c:fa:97, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 192.168.1.1 > 192.168.1.1: ICMP echo request, id 36972, seq 1, length 64
06:58 < eKKiM> i'm using ubuntu..
06:58 < reiffert> thomaschaaf: so what do we have here, two different MAC Addresses. To whom do they belong?
06:58 <@dazo> eKKiM: it's all defined by the routing tables
06:58 < reiffert> eKKiM: means: no way.
06:58 < eKKiM> problem is the following..
06:58 < eKKiM> i tunnel openvpn over ssh
06:59 < eKKiM> in windows it works great
06:59 < eKKiM> but in linux if i connect to openvpn it kills my ssh connection thus openvpn fails to connect.
07:00 < reiffert> dazo: something completly different: Will openvpn clients get posiibilities to ignore options that the server pushes (but just some of them)?
07:00 < thomaschaaf> 00:16:3e:56:ab:64 openvpn server(office)  (192.168.1.52) and 00:16:3e:1c:fa:97 is the router (192.168.1.1)
07:01 < reiffert> thomaschaaf: why is the openvpn server thinking, that 192.168.1.1 belongs to itself?
07:01 < thomaschaaf> where would such info be stored?
07:01 < thomaschaaf> ifconfig doesn't say that ;)
07:01 < reiffert> thomaschaaf: somewhere around /etc and /var/log for additional helpful places.
07:02 <@dazo> also check the arp tables, maybe?
07:02 < thomaschaaf> I'll grep -i "192.168.1.1" /etc  then?
07:02 < reiffert> grep -rli 192.168.1.1 /etc/*
07:02 <@dazo> -R not -r, iirc
07:02 < thomaschaaf> http://pastie.org/1430981
07:02 < reiffert> dazo: -r
07:03 <@dazo> ahh, -r was not available earlier ... -R, -r and --recursive is the same now
07:03 < reiffert> thomaschaaf: add -H to grepoptions
07:03 < reiffert> thomaschaaf: and we really cant rely on what the host thinks is a valid arp table. It just doesnt help here.
07:04 < eKKiM> Can i use static routing to my SSH Server to not disconnect ssh on openvpn connect?
07:04 < reiffert> thomaschaaf: my wild guess is, that you fucked up openvpn config, so that openvpnv thinks that it is 192.168.1.1.
07:04 < reiffert> eKKiM: see here:
07:04 < reiffert> !redirect
07:05 < reiffert> !def1
07:05 < eKKiM> !redirect
07:05 < thomaschaaf> there is nothing in /etc..
07:05 < reiffert> doh, vpnhelper is gone.
07:05 < eKKiM> =(
07:06 < reiffert> thomaschaaf: from the openvpn server, paste online this: server config, route when openvpn is not started, ifconfig when openvpn is not started, route and ifconfig when openvpn runs.
07:06 < thomaschaaf> reiffert: okay
07:07 < reiffert> thomaschaaf: additionally paste the *same* from an openvpn client. before openvpn connection gets established and after.
07:07 < reiffert> client.conf as well
07:07 < eKKiM> reiffert can i find same info as vpnhelper somewhere on the web?
07:07 < reiffert> eKKiM: the openvpn manpage. see option def1 for --redirect-gateway option
07:08 < reiffert> 14:00 < thomaschaaf> 00:16:3e:56:ab:64 openvpn server(office)  (192.168.1.52) and 00:16:3e:1c:fa:97 is the router (192.168.1.1)
07:08 < reiffert> thomaschaaf: be sure to add the routing table of your router as well. as far as you get it.
07:09 < thomaschaaf> k
07:09 < reiffert> 00:16:3e:1c:fa:97 is the router (192.168.1.1)
07:09 < reiffert>  this one
07:12 < ecrist> dazo: my home internet connection sucks the past week or two
07:12 < ecrist> I am using IRC from a server at work.  :)
07:12 < reiffert> ecrist: could you fire up vpnhelper please
07:12 < ecrist> no, I can't
07:12 < ecrist> my home connection is down still
07:13 < reiffert> The last thing I remember is, that you managed something that it automatically restarts if down
07:13 < ecrist> comCRAP should be here in about an hour
07:13 < reiffert> So it isnt running on krzie's server anymore?
07:13 < ecrist> yeah, and my home connection is down.
07:13 < ecrist> it is, krzee's server is in my basement.
07:13 < reiffert> ah.
07:13 < reiffert> :)
07:16 < thomaschaaf> reiffert: http://pastie.org/1430997 client will folow
07:19 < reiffert> so far this looks ok to me. I remember some bug where openvpn was not working correctly on subnet masks different from /24 ...
07:19 < reiffert> dazo: any ideas on hardcoded /24 masks in openvpn?
07:19 < reiffert> maybe it's me mixing stuff up in my brain
07:20 < thomaschaaf> http://pastie.org/1431006
07:20 < reiffert> thomaschaaf: please plase ifconfig from your router as well
07:20 < reiffert> s,plase,paste,
07:21 < thomaschaaf> reiffert: http://pastie.org/1431009
07:21 < eKKiM> route option fixed it
07:21 < eKKiM> tyvm 
07:21 -!- eKKiM [~eKKiM@ks311098.kimsufi.com] has quit []
07:22 < reiffert> thomaschaaf: please plaste complete firewall from openvpn server, especially the nat table.
07:22 < thomaschaaf> iptables -L ?
07:22 < reiffert> iptables -t nat -L -v -n
07:22 < reiffert> iptables -t filter -L FORWARD -v -n
07:23 < thomaschaaf> http://pastie.org/1431018
07:23 < reiffert> both
07:23 < thomaschaaf> other is empty
07:23 < reiffert> thos have a look at your last post
07:23 < reiffert> s,thos,so,
07:23 < reiffert> anything that comes up in your mind?
07:23 < reiffert> send all your money to my paypal account.
07:24 -!- Visual` [~visualsta@unaffiliated/visualstation] has quit [Ping timeout: 240 seconds]
07:24 < reiffert> :p
07:24 < thomaschaaf> :D
07:24 < thomaschaaf> no :(
07:24 < thomaschaaf> what does that mean?
07:24 < reiffert> no as in nothing in your brain?
07:24 < reiffert> see line 6 here: http://pastie.org/1431018
07:24 < thomaschaaf> how do I fix it?
07:24 < reiffert> let see for the iptables manpage
07:25 -!- Visual` [~visualsta@unaffiliated/visualstation] has joined #openvpn
07:25 < reiffert> http://pastie.org/1431028
07:26 < reiffert> thomaschaaf: you fucked up the source address in your Source Nat.
07:26 < reiffert> thomaschaaf: it should be ...oooOO 192.168.1.WHATHERE?
07:27 < thomaschaaf> reiffert: I don't understand what I should do now? flush?
07:27 < thomaschaaf> or should I replace it?
07:27 < reiffert> zero points to thomaschaaf.
07:27 < reiffert> yeah, pleace that rule with a correct one.
07:27 < reiffert> but first:
07:28 < reiffert> please answer me, what do you think does that line?
07:28 < thomaschaaf> it sends everything to 192.168.1.1
07:28 < reiffert> wrong.
07:28 < thomaschaaf> it rewrites the to parameter to 192.168.1.1 for everything?
07:29 < reiffert> It replaces the source address (same knows as NAT or MASQUERADING)
07:29 < reiffert> s,knows,known,
07:29 < reiffert> thomaschaaf: so listen, here's the deal:
07:30 < reiffert> either replace that line by --to-source 192.168.1.52 or step away from masquerading and use pure routing instead.
07:30 < reiffert> pure routing has the benefit, that other hosts in your lan can talk to services that run on the openvpn client.
07:31 < thomaschaaf> I want that
07:31 < reiffert> but it requires that you a) remove the masquerading stuff on the openvpn server and b) tell your router 192.168.1.1 to send packets with destination 10.8.0.0/24 to 192.168.1.52. route add -net 10.8.0.0/24 gateway 192.168.1.52
07:31 <@dazo> reiffert: shouldn't be anything like that hardcoded, afaik
07:32 < Rienzilla> i use oepnvpn with /29s
07:32 < reiffert> thomaschaaf: "I want that" is routing or masquerading?
07:32 < Rienzilla> works fine
07:32 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
07:32 < thomaschaaf> Routing as far as I can tell
07:32 < reiffert> Rienzilla: I once tried with /22 and it failed for some reason I dont remember.
07:33 -!- luneff [~yury@84.51.195.188] has joined #openvpn
07:33 < reiffert> thomaschaaf: great. So after you've done all the changes paste: route routing table, openvpn server iptables nat table.
07:33 < thomaschaaf> reiffert: http://dl.dropbox.com/u/5910/Jing/2011-01-05_1113.png this is what I am trying to accomplish
07:33 < Rienzilla> i have not tried masks larger than 24, but i cant imagine why that wouldnt work
07:33 < reiffert> Rienzilla: for one obvious reason: hardcoded netmasks at some place.
07:33 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
07:34 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:34 < reiffert> !google 3+3
07:34 <@vpnHelper> 3OH!3 on Myspace Music - Free Streaming MP3s, Pictures & Music ...: <http://www.myspace.com/3oh3>; Chelsea 3-3 Aston Villa - Premierleague.com: <http://www.premierleague.com/page/Headlines/0,,12306~2256452,00.html>; Chelsea 3-3 Aston Villa | Premier League match report | Football ...: <http://www.guardian.co.uk/football/2011/jan/02/chelsea-aston-villa-premier-league>
07:34 < reiffert> hrmn, 3+3 should be 6.
07:34 < Rienzilla> i think our uni has an openvpn which you route a /16 through
07:34 < reiffert> thomaschaaf: s,route routing table,routing table of router,
07:34 <@dazo> Rienzilla: OpenVPN supports bigger subnets than /24 ... I think the hard coded limit is /16
07:35 < thomaschaaf> reiffert: I don't quiet understand how that stuff got there :/
07:35 < reiffert> thomaschaaf: pardon?
07:35 < thomaschaaf> reiffert: to be honest I am confused what to do :(
07:35 < ecrist> reiffert: it seems there is a bug in some python library which is why vpnHelper stops reconnecting on it's own.
07:35 < reiffert> thomaschaaf: nevermind, just do those two little changes, they are:
07:35 < Rienzilla> (why is there a hardcoded limit?
07:36 < reiffert> thomaschaaf: ssh openvpn-server iptables -t nat -D POSTROUTING 1
07:36 < reiffert> thomaschaaf: ssh router route add -net 10.8.0.0/24 gw 192.168.1.52
07:36 < thomaschaaf> done
07:36 < ecrist> http://pastebin.ca/2038759
07:36 <@dazo> Rienzilla: to avoid making people do silly things ... and who needs to route a bigger net than /16 through a VPN?  then you're doing something very odd
07:37 < thomaschaaf> reiffert: 
07:37 < thomaschaaf> http://pastie.org/1431053
07:37 < reiffert> thomaschaaf: so, does it work now
07:37 < reiffert> ?
07:37 < thomaschaaf> I think it does
07:37 < reiffert> now back to sending all your money to my paypal account
07:37 <@dazo> ecrist: that pastebin indicates a bug in supybot ... lacking typecasting of a string to int, probably
07:38 <@dazo> sorry, int to string, I mean
07:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:38 < thomaschaaf> so I am buying 2 people pizza if they like..
07:38 <@vpnHelper> RSS Update - forum: Connect problem to lan gateway <http://forums.openvpn.net/topic7470.html#p8931>
07:38 < thomaschaaf> of the guys that helps
07:39 < thomaschaaf> helped
07:39 < reiffert> pizza sounds like a great idea.
07:45 < krzie> mmmm
07:45 < krzie> ppizza
07:51 < gladiatr> indeed
07:55 -!- thomaschaaf [c1af1a44@gateway/web/freenode/ip.193.175.26.68] has quit [Ping timeout: 265 seconds]
07:57 -!- thomaschaaf [c1af1a44@gateway/web/freenode/ip.193.175.26.68] has joined #openvpn
08:01 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
08:01 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Client Quit]
08:03 -!- jfk_ [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
08:04 -!- Malard [ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
08:04 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
08:04 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
08:04 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
08:08 < reiffert> thomaschaaf: does it *still* work?
08:09 < thomaschaaf> reiffert: most things work but some don't work as excepted
08:09 < thomaschaaf> e.g. I can't ping a machine 192.168.1.10 from the vpn client
08:10 < reiffert> should work.
08:10 < reiffert> check that the route to 10.8 exists on your router.
08:10 < thomaschaaf> it does I can ping the router e.g. 192.168.1.1
08:10 < reiffert> paste ifconfig, route iptables etc from 192.168.1.10 host
08:11 < thomaschaaf> it's a windows workstation
08:11 < reiffert> shutdown the firewall on that machin
08:11 < reiffert> e
08:11 < thomaschaaf> the thing is I can ping from the vpn server
08:11 < reiffert> shutdown the firewall on that machine
08:12 < thomaschaaf> hmm okay
08:13 < thomaschaaf> works now I feel stupid :/
08:13 < reiffert> "for free" :)
08:15 < gladiatr> lol
08:15 < thomaschaaf> reiffert: this might be asking a bit much but I also wanted to be able to ping/ssh into the machines too 
08:15 < thomaschaaf> and I am unable to ping 10.1.1.1 or 10.8.0.6
08:15 < reiffert> thomaschaaf: from where to where?
08:16 < thomaschaaf> e.g. from router to openvpn client
08:16 < reiffert> you should be able to ping ..
08:16 < reiffert> start some tcpdumps to see where the packets go.
08:20 < thomaschaaf> the last place I can see them is on the router 15:18:34.897835 IP 192.168.1.10 > 10.8.0.6: ICMP echo request, id 1, seq 42, length 40
08:20 < reiffert> paste routing table of router.
08:20 < thomaschaaf> reiffert: http://pastie.org/1431134
08:21 < reiffert> It's the firewall running on that router.
08:22 < reiffert> something else comes up to mind.
08:22 < reiffert> the router sends an "ICMP REDIRECT" message to 192.168.1.10 telling to talk to 192.168.1.52 directly. so fire up tcpdump on 192.168.1.52 as well
08:22 < thomaschaaf> it does not arrive there
08:23 < reiffert> paste 192.168.1.1's firewall then
08:23 < reiffert> iptables -L -v -n && iptables -t nat -L -v -n
08:24 < thomaschaaf> reiffert: http://pastie.org/1431146
08:24 < thomaschaaf> I haven't looked at it myself yet :(
08:25 < thomaschaaf>  107 11950 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable
08:25 < thomaschaaf> thats it huh?
08:25 < reiffert> Just some line. Cant tell, no contect.
08:25 < reiffert> context
08:27 < thomaschaaf> reiffert: http://pastie.org/1431146 line 17
08:27 < thomaschaaf> last of Chain FORWARD (policy DROP 0 packets, 0 bytes) 
08:29 < reiffert> start with:
08:29 < reiffert> iptables -I FORWARD -i eth1 -j ACCEPT
08:29 < reiffert> iptables -I FORWARD -o eth1 -j ACCEPT
08:30 < thomaschaaf> reiffert: yey
08:30 < reiffert> what I really dislike is the -t nat POSTROUTING rule .. ! -o lo -j MASQUERADE might cause some trouble here.
08:30 < reiffert> yey?
08:30 < thomaschaaf> ping goes through
08:30 < reiffert> ok, here is the evil and very difficult part:
08:32 < reiffert> starting the ssh connection. You have to open a terminal somehow and enter those characters: ess ess aitch username @ host
08:32 < reiffert> finding the "@" sign is one of harderst.
08:32 < thomaschaaf> what does that do?
08:33 < reiffert> open a secure shell session on "host"
08:33 < reiffert> basically that is what you were trying to do.
08:33 < reiffert> 15:15 < thomaschaaf> reiffert: this might be asking a bit much but I also wanted to be able to ping/ssh into the machines too 
08:33 < thomaschaaf> ph :D
08:34 < reiffert> welcome to layer 3.
08:35 < thomaschaaf> reiffert: thank you so much :)
08:35 < reiffert> thanks for the pizza
08:36 < thomaschaaf> reiffert: everything works now as I wanted except one last part I'll try to get that to work on my own *fingers crossed* on the xen I have the tun0 and dummy0 device I want to "route" those so that the xen clients are able to ping the router 192.168.1.1 too :P
08:36 < thomaschaaf> reiffert: I don't know if you saw what I was trying to create: http://dl.dropbox.com/u/5910/Jing/2011-01-05_1113.png
08:41 < thomaschaaf> reiffert: ich könnt jetzt schon aufgeben :'(
08:41 < thomaschaaf> woops wrong language
08:42  * reiffert hides behind Bushmills 
08:42 < thomaschaaf> okay okay I understand :( sorry go eat your pizza :P
08:43 < thomaschaaf> btw what did you get?
08:43 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
08:44 < reiffert> I'm fixing some problems on OX right now with a customer getting mon my nerves and a remote management application driving nuts
08:44 < reiffert> thats what I get right now.
08:47 -!- blee_laptop [~blee@211.71.118.70.cfl.res.rr.com] has quit [Remote host closed the connection]
08:49 < thomaschaaf> why is there no command such as becomefriends tun0 dummy0 :(
08:51 -!- Malard [ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
08:51 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
08:51 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
08:51 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
09:00 < Bushmills> pizza?
09:01 < ecrist> indeed.
09:02 < ecrist> thomaschaaf: OS X doesn't have a bridge interface.
09:02 < ecrist> :\
09:02 < reiffert> ecrist: apple stopped the bridge part in 2001 and removed it finally
09:03 < ecrist> yeah, really fucking retarded, if you ask me.
09:03 < reiffert> ecrist: so even if you try to compile a custom kernel with network bridging, you have to modernize the code itself for over 10 years.
09:03 < reiffert> and I tried.
09:04 < ecrist> Dear Apple, can we haz bridge interface?  kthxbai
09:04 < reiffert> the code itself is still in the sources, but ifdef'ed out by preprocessor macros
09:05 < ecrist> http://icanhascheezburger.files.wordpress.com/2007/07/128287207305861615bridgecatsez1.jpg
09:06 < Bushmills> but didn't he saz he was back to routing config, no more bridge
09:06 < Bushmills> say
09:06 < ecrist> I'm just talking in general.
09:06 < ecrist> it's been a beef of mine for quite a while that OS X doesn't have a bridge interface
09:12 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
09:12 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
09:12 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
09:14 < gladiatr> hey, ecrist, was it really fucking retarded that apple removed the os x bridge interface?
09:14 < gladiatr> hehe
09:21 < ecrist> it was, indeed.
09:25 < Bushmills> another reason to endorse routed configs
09:25 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:30 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
09:30 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
09:30 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
09:43 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
09:48 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
09:48 <@vpnHelper> RSS Update - forum: Restricted client-client traffic <http://forums.openvpn.net/topic7472.html#p8932>
09:56 -!- daguz1 [~leo@208.1.63.50] has joined #openvpn
10:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:07 -!- macsppadic [~sonupunno@88.211.55.77] has left #openvpn []
10:07 -!- dazo is now known as dazo_afk
10:14 -!- wunderkin [~kbockman@69-92-51-205.cpe.cableone.net] has joined #openvpn
10:25 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
10:36 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
10:37 < ecrist> friggin vpnhelper
11:06 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
11:18 < reiffert> 17:37 < ecrist> friggin vpnhelper
11:19  * gladiatr drowns vpnhelper in a bucket of fat
11:19 < alhadi> hello
11:24 < gladiatr> hi alhadi
11:24 < alhadi> having weird problem
11:24 < Essobi> alhadi: stop picking at it, it's infected.
11:25 < alhadi> hehe
11:26 < alhadi> actually service fail donno why, saw log it says --MARK--
11:26 < Essobi> ...
11:26 -!- Malard|Home [ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
11:26 -!- Malard|Home [ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
11:26 -!- Malard|Home [ident@xbmc/staff/malard] has joined #openvpn
11:26 < Essobi> MARK is just a standard watermarking log.. that's your syslogger generating, has nothing to do with openVPN.
11:27 < alhadi> ok..
11:27 < alhadi> i started using linux like last week. so learning every bit of it
11:27 < Essobi> Yurp..
11:27 < alhadi> But openvpn is little complicated to me
11:27 < Essobi> Google is your friend.
11:27 < alhadi> but thanks to krzee script
11:27 < alhadi> it helped me make the conf files
11:27 < Essobi> You're got years and years of reading to catchup on.
11:27 < alhadi> but service wont start
11:27 < alhadi> yep
11:28 < Essobi> Not that it's entirely relevant still
11:28 < Essobi> but
11:28 < gladiatr> Be nice to the fetuses, Essobi.  Their skin is still very delicate.
11:29 < Essobi> lol
11:29 < Essobi> alhadi: http://www.textfiles.com/hacking/UNIX/unix001.txt
11:29 < Essobi> alhadi: Some Old school unix
11:29 <@vpnHelper> RSS Update - forum: openvpn bonding <http://forums.openvpn.net/topic7465.html#p8934> || Restricted client-client traffic <http://forums.openvpn.net/topic7472.html#p8933>
11:29 -!- Malard [ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
11:29 < Essobi> 1986 bishes
11:30 < Essobi> I wrecked so much shit back in the day after reading that.. lol
11:30 < gladiatr> g-files ... oh yeah
11:31 < gladiatr> essobi, ever spend much time on the old x.25 nets?
11:31 < Essobi> gladiatr: x25 pads?  Fo sho.
11:31 < Essobi> Tymnet, and TelEnet too.
11:31 < gladiatr> good freakin' times
11:31 < Essobi> lol
11:32 < Essobi> Yea, I was in the scene when graybox was what all the 'cool kids' were doing.
11:32 < gladiatr> don't complain too heartily about windows until you've danced with tops20
11:32 < Essobi> It was so lame.
11:33 < Essobi> AT&T conference calls, wrecking COCOTS, and blastin nickletones at the bell phones.
11:33 < gladiatr> I still have the red box I built
11:33 < gladiatr> heh
11:33 < Essobi> Nice.
11:33 < gladiatr> it still worked in my home town til about 10 years ago
11:34 < Essobi> I trashed mine once all the physical detects went in here.. I live near a pretty big metro so we got all the tech backwash.
11:34 < Essobi> The COCOTS were crap thou all the way up through high-school.
11:34 < gladiatr> Yeah.  They replaced the step-by-step switch in the old village in 1992
11:34 < gladiatr> (yes.  they actually skipped xbar there)
11:35 < Essobi> drop a tollfree vm, and pound out till it hang up and itd drop you right into an unguarded dialtone
11:35 < gladiatr> hehehe
11:35 < Essobi> no shiz? supposedly there's a LEC indiana still running xbar
11:35 < Essobi> in indiana..
11:36 < Essobi> To bad all his ingress trunks are tone guarded.. Blue boxing was just a hair before mytime, but damnit, it would've been fun.
11:36 < gladiatr> I can't imagine so.  The FCC mandated ESS upgrades from coast-to-coast either in the late 80's or early 90's--accompanied all of the federal money that went into t-com upgrades
11:36 < gladiatr> I hear you
11:36 < alhadi> Essobi http://www.pastie.org/private/uu2i4frxcibooj9r75kifq
11:36 < Essobi> they're an ilec.
11:36 < alhadi> cannot generate the key in ubuntu
11:36 < alhadi> pki says no file found
11:36 < alhadi> ./build no file found
11:36 < alhadi> :(
11:37 < Essobi> They're independantly ran, and the population of the town is under 100 people, so I've heard.
11:37 < gladiatr> alhadi, everything is in /etc/openvpn, correct?
11:37 < alhadi> gladiatr only 2 files
11:37 < gladiatr> damn.  That's awesome
11:37 < Essobi> gladiatr: Perhaps it's just the shangralah of phreaks but.. *SHRUG*
11:37 < alhadi> one is server.conf and other is update.resolve.conf
11:37 < gladiatr> hehehehe!
11:38 < alhadi> 2 files :(
11:38 < alhadi> cant even generate a key
11:38  * alhadi is stuck
11:38 < Essobi> gladiatr: I wound up working for a LEC for 8 years... Phones lost all their fun for me after that.
11:38 < Essobi> alhadi: Are you running it as root?
11:38 < alhadi> yes
11:38 < alhadi> running as root
11:39 < gladiatr> openssl dhparam -out /etc/openvpnn/dh1024.pem 1024
11:39 < Essobi> Wed Jan  5 17:35:30 2011 us=837960 Cannot open dh2048.pem for DH parameters: err
11:39 < Essobi> Yea.. key's are missing.
11:39 < alhadi> yes
11:39 < alhadi> once this is done server will start
11:39 < thomaschaaf>  reiffert: That pizza was worth every penny thank you :-*
11:39 <@vpnHelper> RSS Update - forum: openvpn bonding <http://forums.openvpn.net/topic7465.html#p8935>
11:39 <@vpnHelper> RSS Update - pastebin: Miscellany <http://pastebin.ca/2031403> || lorddoskias <http://pastebin.ca/2031400> || harry_ <http://pastebin.ca/2031076> || harry_ <http://pastebin.ca/2031074> || Mine <http://pastebin.ca/2027845> || Something <http://pastebin.ca/2027836> || Anonymous <http://pastebin.ca/2027834> || Mine <http://pastebin.ca/2027832> || Untitled <http://pastebin.ca/2027830> || Miscellany <http://pastebin.ca/2027827> || So
11:40 < gladiatr> essobi, Yeah.  I hear you.  Same thing kinda happened with tech in general, for me.  Now ahm jus anotha old, soul-sucked bastard hehe
11:41 < gladiatr> alhadi, well you also have no certificates.  Man... go here.  Read.  Re-read.  Absorb.  Ponder.  Play.  Implement.  Then come ask questions? :)  http://openvpn.net/index.php/open-source/documentation.html
11:41 <@vpnHelper> Title: Documentation (at openvpn.net)
11:42 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Leaving]
11:42 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
11:45 -!- Malard|Home [ident@xbmc/staff/malard] has quit [Ping timeout: 246 seconds]
11:56 <@vpnHelper> RSS Update - forum: Connect problem to lan gateway <http://forums.openvpn.net/topic7470.html#p8936>
11:57 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
11:58 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
11:58 -!- mode/#openvpn [+o vpnHelper] by ChanServ
11:58  * ecrist removes pastebin rss feed
11:59 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
12:01 < gladiatr> dear god...
12:08 < wunderkin> thank you lol
12:10 <@vpnHelper> RSS Update - forum: openvpn bonding <http://forums.openvpn.net/topic7465.html#p8937>
12:19 -!- CharlesB [8e161032@gateway/web/freenode/ip.142.22.16.50] has joined #openvpn
12:20 < CharlesB> Right so... I have WindowsXP SP2 Pro here behind "dick-admin secured newtork" that blocks connections to anything other than port 80, and everything has to go through the local HTTP proxy.  What do?
12:21 < CharlesB> My home box has Linux with SSHD running on port 80 right now.  How would I go about setting up a VPN instead, and tunneling all my programs through it so I'd have normal program usage?
12:21 < CharlesB> !welcome
12:21 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:21 < CharlesB> Oh, I see.
12:21 < CharlesB> !goal
12:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:22 < CharlesB> My goal is to be able to use regular internet applications such as "Mumble" and "TeamSpeak" , Skype, etcetera, behind "dick-admin secured network"
12:24 < CharlesB> !redirect
12:24 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:24 < CharlesB> sigh.. seems confusing :/
12:24 < ecrist> now a days, it's easier to just tether to your cell phone. ;)
12:25 < CharlesB> :(
12:25 < CharlesB> I can't
12:26 < CharlesB> ALL network connections are blocked, signals like wifi and the rest are blocked by the same dick-admin
12:26 < gladiatr> you work for the doe or something?
12:27 < gladiatr> or perhaps an involuntary guest of a psychiatric healthcare facility? :D
12:30 < ecrist> hehe
12:30 < ecrist> what about DNS, CharlesB ?
12:30 < ecrist> is UDP port 53 filtered?
12:31 < CharlesB> Lol...
12:31 < CharlesB> ecrist, I can only connect to externel IPs on port 80 and SOMETIMES 443.
12:31 < CharlesB> That's it.
12:31 -!- thomaschaaf [c1af1a44@gateway/web/freenode/ip.193.175.26.68] has quit [Quit: Page closed]
12:34 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
12:35 < ecrist> have you tried UDP ports?
12:36 < CharlesB> Yes, I've tried UDP.
12:36 < CharlesB> Basically, I opened all ports on my home box, and ran a portscanner here on it (tcp and udp), nothing go through except TCP port 80 :(
12:37 < ecrist> how did you 'open all ports on your home box'
12:38 < CharlesB> Lol, py script that listens on all ports for something, then dumps each to a file.
12:40 < gladiatr> CharlesB, you're no fun.  You were supposed to say something along the lines of "sysctl -w net.inet.fly_open=1"
12:43 < CharlesB> lol... Windows host with linux VMs :/
12:51 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
12:51 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
12:51 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
12:54 -!- CharlesB [8e161032@gateway/web/freenode/ip.142.22.16.50] has left #openvpn []
12:59 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
12:59 <@vpnHelper> RSS Update - forum: openvpn bonding <http://forums.openvpn.net/topic7465.html#p8938>
13:06 <@vpnHelper> RSS Update - forum: 3g works router adsl don´t <http://forums.openvpn.net/topic7428.html#p8939>
13:18 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
13:39 < gladiatr> SCIENCE!
13:58 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 240 seconds]
14:01 < Essobi> lol
14:01 < Essobi> sysctl -w net.inet.youre_screwed_if_you_enable=0
14:06 -!- Malard [ident@xbmc/staff/malard] has quit [Ping timeout: 255 seconds]
14:14 < gladiatr> exactly!
14:23  * ecrist imagines ~2000 instances of netcat running.
14:23 -!- pyther24 [~pyther@unaffiliated/pyther] has quit [Quit: leaving]
14:24 <@vpnHelper> RSS Update - forum: Restricted client-client traffic <http://forums.openvpn.net/topic7472.html#p8940>
14:28 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Remote host closed the connection]
14:29 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
14:29 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
14:29 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
14:33 -!- vtanwyl [~vtanwyl@h-68-167-193-94.mclnva23.static.covad.net] has joined #openvpn
14:36 -!- vtanwyl is now known as toma
14:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:45 -!- toma [~vtanwyl@h-68-167-193-94.mclnva23.static.covad.net] has quit [Quit: using sirc version 2.211+KSIRC/1.3.12]
14:52 -!- sia is now known as sia^pwnnt
14:59 -!- sia^pwnnt is now known as sia
15:02 < alhadi> http://www.pastie.org/private/zqymkbvk6cvjecyixmnfaw
15:02 < alhadi> unable to connect
15:02 < alhadi> TLS error
15:02 < alhadi> since 11 hours i am configuring
15:02 < alhadi> Help
15:03 < alhadi> krzee u here?
15:03 < alhadi> i have the log now
15:05 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Quit: Leaving]
15:09 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has quit [Quit: alhadi]
15:10 < Essobi> aww he logged.
15:10 < Essobi> if he shows up again, tell'm krzie is sick and down for the count atm
15:29 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
15:33 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
15:45 -!- ss0 [~Adium@5.sub-75-222-8.myvzw.com] has joined #openvpn
15:47 < ss0> I have an openvpn server, that I can connect to but I can't even ping the private Ip of the server. It was working previously but we upgraded some switches internally and went with a new ip addressing scheme. Could anyone help me understand what i screwed up?
15:48 < ss0> It seems to be pushing routes properly… 
15:50 < Bushmills> ss0: what did your initial trouble shooting yield, besides "can't ping"? 
15:51 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has joined #openvpn
15:51  * Bushmills diagnoses sharply:  "if you can't ping, then the problem is that there i something wrong"
15:51 < Bushmills> is
15:53 < ss0> Bushmills:  well i can't contact other hosts also connected to the server. from the logs it shows the routes being pushed. so I am assuming it has to be an issue with how things are routed on the server.
15:53 < Bushmills> from that follows: if there is something wrong, best remedy is often to fix it.
15:53 < ss0> Bushmills:  I orignally set this up in bridged mode, several months ago and used it off an on with no problems. I guess I don't know what to do next to get the information needed to narrow down the problem.
15:53 -!- luneff [~yury@84.51.205.26] has joined #openvpn
15:54 < Bushmills> do a bit of trouble shooting. like, use tcpdump, tshark, mtr, traceroute.
15:54 < Bushmills> netcat can also be helpful
15:55 < ss0> Bushmills:  well I see zero traffic on the tap0 interface with tcpdump
15:56 < Bushmills> there must be a reason for that
15:57 < ss0> If I had any idea what that reason was I would not be asking for help in irc no offense. The routing tables look like they should work, I can see it grab an ip from the server in the logs with no problem. It must be a routing issue but I don't know what kind.
15:58 < Bushmills> well, i know that you can't ping "something" and that you don't see traffic on tap0.   that's not quite enough to say "your problem is on line 15 of your config file /xxx/yyy/zzz
15:58 < Bushmills> "
15:58 < ss0> ip forwarding is set to one, the firewall is stopped. ugh. I guess I could just slap pfsense on the box and be done with it.
15:59 < Bushmills> apart from that, i am of no help with bridged configs 
15:59 < ss0> Bushmills:  well I appreciate you trying anyway.
15:59 -!- alhadi [~thunderst@ner-as45159.alshamil.net.ae] has quit [Quit: alhadi]
16:01 -!- s7r [~s7r@95.154.230.202] has joined #openvpn
16:04 -!- ss0 [~Adium@5.sub-75-222-8.myvzw.com] has quit [Ping timeout: 240 seconds]
16:06 -!- ss0 [~Adium@131.sub-75-222-121.myvzw.com] has joined #openvpn
16:14 -!- ss0 [~Adium@131.sub-75-222-121.myvzw.com] has left #openvpn []
16:24 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
16:29 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 265 seconds]
16:36 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:38 -!- WinstonSmith [~true@g225024003.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
16:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:47 <@vpnHelper> RSS Update - forum: Restricted client-client traffic <http://forums.openvpn.net/topic7472.html#p8941>
16:50 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
16:52 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
16:59 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p8942>
17:04 -!- Visual` [~visualsta@unaffiliated/visualstation] has quit [Ping timeout: 265 seconds]
17:06 -!- Visual` [~visualsta@unaffiliated/visualstation] has joined #openvpn
17:10 -!- bitterman [~yury@84.51.205.26] has joined #openvpn
17:13 -!- luneff [~yury@84.51.205.26] has quit [Ping timeout: 240 seconds]
17:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:33 -!- bitterman [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
17:34 -!- bitterman [~yury@84.51.205.26] has joined #openvpn
17:49 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
17:53 -!- bitterman [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
17:54 -!- bitterman [~yury@84.51.205.26] has joined #openvpn
17:58 -!- darth_bitterman [~yury@84.51.205.26] has joined #openvpn
18:00 -!- bitterman [~yury@84.51.205.26] has quit [Ping timeout: 250 seconds]
18:04 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:06 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
18:07 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
18:09 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 240 seconds]
18:10 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
18:15 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
18:15 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
18:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:23 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
18:28 -!- darth_bitterman [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
18:29 -!- darth_bitterman [~yury@84.51.205.26] has joined #openvpn
18:37 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
18:57 <@vpnHelper> RSS Update - forum: Comms keeps stopping - ping fails <http://forums.openvpn.net/topic7476.html>
19:09 <@vpnHelper> RSS Update - forum: Comms keeps stopping - ping fails <http://forums.openvpn.net/topic7476.html#p8944>
19:14 < |Mike|> lol
19:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 272 seconds]
19:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:41 -!- dangerdave [~dangerdav@c-76-28-192-192.hsd1.wa.comcast.net] has joined #openvpn
19:42 < dangerdave> Okay, how long does build-dh 2048-bit typically take you on, say, a Core i5? Minutes? Hours? Days? I'm several hours into it...
19:42 < dangerdave> !welcome
19:42 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:42 < dangerdave> !goal
19:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:56 -!- dangerdave [~dangerdav@c-76-28-192-192.hsd1.wa.comcast.net] has quit [Quit: dangerdave]
20:04 < wunderkin> hours? hmm
20:04 < |Mike|> y
20:20 -!- darth_bitterman [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
20:20 -!- darth_bitterman [~yury@84.51.205.26] has joined #openvpn
20:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:45 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
20:45 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
20:45 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:51 <@vpnHelper> RSS Update - forum: Converting from OpenSwan? <http://forums.openvpn.net/topic7477.html>
20:52 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
20:58 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
20:59 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 264 seconds]
21:15 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has joined #openvpn
21:15 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has quit [Changing host]
21:15 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
21:33 -!- s7r [~s7r@95.154.230.202] has left #openvpn []
21:34 -!- bitterman [~yury@84.51.205.26] has joined #openvpn
21:37 -!- darth_bitterman [~yury@84.51.205.26] has quit [Ping timeout: 240 seconds]
21:37 -!- bitterman [~yury@84.51.205.26] has quit [Client Quit]
21:38 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 255 seconds]
22:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:22 -!- corretico [~corretico@201.201.44.82] has quit [Remote host closed the connection]
22:24 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
22:25 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
22:25 < grendal_prime> hey i need openvpn to send an email when a specific client connects.
22:34 < grendal_prime> wow
22:34 < grendal_prime> ecrist, i have comcast..i love it.
22:37 < grendal_prime> is anyone here?
22:48 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Remote host closed the connection]
22:48 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
23:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
23:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
23:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
23:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:02 -!- gdb``` [~user@2001:4830:2446:b5:214:4fff:fe4a:f0] has quit [Read error: Operation timed out]
23:05 < ashes> grendal_prime: i suggest scanning logs with a shell script in cron, and email if a grep matches the ip or host you want
23:05 -!- gdb``` [~user@dr-wily.ipv6.mit.edu] has joined #openvpn
23:11 -!- moses [~moses@unaffiliated/moses/x-6794817] has quit [Ping timeout: 240 seconds]
23:11 -!- moses [~moses@unaffiliated/moses/x-6794817] has joined #openvpn
23:15 < grendal_prime> needs to be a little quicker than that..but i found something thanks for the idea.
23:15 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
23:27 -!- jfk_ [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
--- Day changed Thu Jan 06 2011
00:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
00:26 -!- WinstonSmith [~true@dslb-088-073-092-170.pools.arcor-ip.net] has joined #openvpn
00:33 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Ping timeout: 276 seconds]
00:38 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 272 seconds]
01:52 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
01:56 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:03 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:03 -!- mode/#openvpn [+o mattock] by ChanServ
02:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
02:42 -!- wunderkin [~kbockman@69-92-51-205.cpe.cableone.net] has quit [Quit: Leaving.]
02:43 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 265 seconds]
02:57 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
02:59 -!- sia is now known as sia^pwnnt
03:13 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:15 -!- macsppadic is now known as Directorsppadic
03:16 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
03:17 -!- dazo_afk is now known as dazo
03:18 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:30 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:41 -!- luneff [~yury@84.51.205.26] has joined #openvpn
03:43 -!- WinstonSmith [~true@dslb-088-073-092-170.pools.arcor-ip.net] has quit [Ping timeout: 265 seconds]
03:43 -!- WinstonSmith_ [~true@g225025106.adsl.alicedsl.de] has joined #openvpn
03:50 -!- master_of_master [~master_of@p57B57625.dip.t-dialin.net] has quit [Ping timeout: 265 seconds]
03:52 -!- master_of_master [~master_of@p57B5386B.dip.t-dialin.net] has joined #openvpn
04:04 -!- sia^pwnnt is now known as sia
04:22 -!- WinstonSmith_ [~true@g225025106.adsl.alicedsl.de] has quit [Read error: Connection reset by peer]
04:27 < hyper_ch> krzee: http://xs-sniper.com/blog/2011/01/04/bypassing-flash%E2%80%99s-local-with-filesystem-sandbox/
04:27 <@vpnHelper> Title: Billy (BK) Rios » Bypassing Flash’s local-with-filesystem Sandbox (at xs-sniper.com)
04:34 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:34 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:35 -!- WinstonSmith_ [~true@e179002106.adsl.alicedsl.de] has joined #openvpn
04:36 -!- WinstonSmith_ is now known as WinstonSmith
04:39 -!- common- [~common@p5DDA489C.dip0.t-ipconnect.de] has joined #openvpn
04:42 -!- common [~common@p5DDA470C.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
04:42 -!- common- is now known as common
04:44 -!- silverraindog [~angus@host86-185-35-153.range86-185.btcentralplus.com] has joined #openvpn
04:44 < silverraindog> good day
04:45 < silverraindog> quick question, if i give a static ip in the ccd client file to a client, would the server honour that and not dish out the ip to any other machine ?
04:49 <@dazo> silverraindog: yes, unless your pool is full and that static IP address is not in use when a new connection comes.  Then this might be used for that client
04:50 <@dazo> you can avoid this by giving static IP addresses outside the pool-range
04:51 -!- krzie [~k@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
04:51 < silverraindog> dazo: thank you!
04:52 <@dazo> you're welcome
05:01 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
05:09 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has joined #openvpn
05:09 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has quit [Changing host]
05:09 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
05:12 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:52 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
05:54 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 240 seconds]
05:54 -!- twister004_ is now known as twister004
06:07 <@vpnHelper> RSS Update - forum: server and client <http://forums.openvpn.net/topic7475.html#p8946>
06:08 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
06:10 -!- SOG [~SOG@solution1.hsia.citycenter.com] has joined #openvpn
06:14 -!- SOG [~SOG@solution1.hsia.citycenter.com] has quit [Client Quit]
06:14 -!- SOG [~SOG@solution1.hsia.citycenter.com] has joined #openvpn
06:14 -!- SOG [~SOG@solution1.hsia.citycenter.com] has quit [Client Quit]
06:14 -!- SOG [~SOG@solution1.hsia.citycenter.com] has joined #openvpn
06:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
06:21 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
06:21 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
06:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
06:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
06:22 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
06:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:26 -!- luneff [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
06:27 -!- luneff [~yury@84.51.205.26] has joined #openvpn
06:47 -!- alhadi [~thunderst@92.99.235.168] has joined #openvpn
06:50 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Read error: Connection reset by peer]
06:55 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
07:01 <@vpnHelper> RSS Update - forum: Problem with client-connect script <http://forums.openvpn.net/topic7478.html>
07:02 -!- alhadi [~thunderst@92.99.235.168] has quit [Quit: alhadi]
07:03 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
07:12 -!- minto_ [~chatzilla@91.142.198.67] has joined #openvpn
07:13 < minto_> !welcome
07:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:13 < minto_> !howto
07:13 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
07:13 < minto_> hello
07:14 < minto_> can someone help me with establishing vpn i have problems 
07:14 < minto_> i did generate keys
07:14 < minto_> i did config files 
07:14 < minto_> and when i try to run server i get dh1024.pem error
07:18 < minto_> anyone ?
07:19 < minto_> http://paste.pocoo.org/show/k2S9c5ii6bABIAqR47So/
07:21 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: rebooting]
07:21 <@dazo> minto_: What does line 5 in your pastebin say?
07:22 < minto_> i know
07:22 < minto_> but that directory existys
07:22 < minto_> exists*
07:22 <@dazo>  dh1024.pem is supposed to be a file ... and OpenVPN is never wrong in its error messages
07:23 < minto_> anyway i dont have such file in keys
07:23 <@dazo> it wants to read that file, as you've told it to do so ... and when it can't find it, it can't read it, it will exit
07:23 < minto_> i have only 3 keysa as in config one
07:23 <@dazo> Then, clean up your config file according to what !logs says ... and you might see your mistake
07:24 < minto_> ah no wai i see it
07:24 < minto_> so why he dont want to read it
07:24 <@dazo> either, don't load the dh1024.pem file .... or generate one ... it's all described in the !howto and in the !man pages
07:24 <@dazo> !logs
07:24 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
07:24 <@dazo> if you don't want to read it, you don't want to understand it ... and nobody here wants to help you
07:25 < minto_> this is so complicated
07:25 < minto_> !pb
07:25 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
07:25 <@dazo> It is, if you don't read ... search for dh1024.pem in your config file ... and read what your own config file says in the lines above
07:26 < minto_> im reading it right now
07:26 <@dazo> then you will figure out how to get one step further
07:28 < minto_> so this dh dh1024.pem i must make to something like that dh /etc/openvpn/keys/dh1024.pem?
07:29 -!- sia is now known as sia^pwnnt
07:29 <@dazo> I haven't read your complete config file ... but more likely /etc/openvpn ... it all depends on where your distributions starts OpenVPN from.  Or you can give the 'dh' option a full path to the file
07:30 < minto_> i did yea this one is done now i get another one 
07:30 < minto_> sigh
07:31 < minto_> now i get cannot load private key  but path to file is correct
07:32 < minto_> hmmm
07:32 < minto_> now this is something strange
07:32 < minto_> i need private key but it somehow didnt generate it
07:33 < minto_> i have only ca
07:33 < krzie> you're talking here when you should be following this:
07:33 < krzie> !pki
07:33 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
07:33 <@vpnHelper> specially as a server (see !servercert)
07:33 <@dazo> then you need to re-read the documentation ... it states clearly that you first create CA keys and certificate, then you create server key and certificates, and then client keys and certificates
07:35 < minto_> well i did so
07:35 < minto_> yet i dont have it
07:36 < minto_> i did it by openvpn how-to
07:36 <@dazo> Neither PKI, OpenVPN nor OpenSSL does magic ... if you have skipped one step, it's not going to appear by itself
07:36 <@dazo> really!
07:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:39 < minto_> ok this one is solved too
07:39 < minto_> now i have
07:40 < minto_> Socket bind failed on local address [AF_INET]XXX.XXX.XXX.XXX:1194: Cannot assign requested address
07:40 < minto_> by the way that http://openvpn.pastebin.ca/ gives me 500 error
07:40 < Rienzilla> hmm
07:41 < Rienzilla> if I push redirect-gateway def1, how does openvpn make sure traffic to the tunnel endpoint is not routed into the tunnel?
07:42 < krzie> Rienzilla, redirect-gateway adds a route to vpn server over pre-existing gateway
07:43 < Rienzilla> hmm. It's not there 
07:43 < Rienzilla> is it possible that that route gets removed by refreshing a dhcp lease?
07:44 < krzie> it is
07:44 < Rienzilla> hmm
07:44 < krzie> theres a bypass dhcp flag as well
07:44 < minto_> are there some additional command to conf files when using vmware ?
07:45 < krzie> minto_, no, you need to do as !pki says
07:45 < minto_> !pki
07:45 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
07:45 <@vpnHelper> signed specially as a server (see !servercert)
07:45 < krzie> and the bind error was you running openvpn 2 times
07:46 < minto_> !servercert
07:46 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key, or (#2) this will help with !mitm
07:46 < krzie> thats too advanced for you, ignore that
07:46 < krzie> make it like in !pki
07:46 < minto_> i see ...
07:46 < minto_> well anwyay keys are set up propertly nmow i just get this socket error now
07:47 < krzie> because you already have openvpn running
07:47 < krzie> (as i said bove)
07:47 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
07:47 < krzie> *above
07:47 < krzie> gladiatr!
07:47 < minto_> hmmm kk
07:47 < gladiatr> wheee!  good morning!
07:47 < krzie> g'mornin
07:49 < Rienzilla> hmm that must be the issue
07:50 < Rienzilla> my clients drop after ~ their dhcp lease time, and when I look they have a route to 0.0.0.0/1 and 128.0.0.0/1, but none to the tunnel endpoint
07:50 < gladiatr> rude clients.  beat them for their rudeness...
07:51 < Rienzilla> I have beat them severl times
07:51 < Rienzilla> with a stick
07:52  * gladiatr prefers chickens...
07:52 < gladiatr> heh.  ok.  coffee... brain normalization in progress... please continue with business...
07:54 -!- minto_ [~chatzilla@91.142.198.67] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
07:56 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Nine out of ten l33t h4x0rz prefer it]
07:56 < krzie> Rienzilla, and when they connect you see that they do have the route to the vpn endpoint?
07:57 < Rienzilla> I haven't checked yet,but they must have, because they work
07:57 <@vpnHelper> RSS Update - forum: SOLVED Windows Server 2008 - incorect address in TAP conn... <http://forums.openvpn.net/topic7256.html#p8948>
07:58 < krzie> well you run the server, should be easy to connect a client
08:01 < Rienzilla> yes, but these clients are in a shitty location :)
08:01 < Rienzilla> (in a bus, and it rains), but hold on, i'll give it a try
08:01 < krzie> but i mean, im sure the server isnt at your house, just connect in
08:01 < |Mike|> :-)
08:06 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
08:16 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
08:33 -!- minto [~chatzilla@ryd002.multi-play.net.pl] has joined #openvpn
08:33 < minto> hello again
08:33 < minto> i sitll have problem i jsut cant get it working
08:33 < minto> !welcome
08:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:33 < minto> !goal
08:33 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:34 < minto> i still get socket is binded
08:34 < minto> but i cant use other ip adress than 192.168.0.x cause its virtual machine
08:34 < minto> and i dont have open vpn running before as i did stop it and start again
08:35 < gladiatr> on your server?
08:35 < minto> http://paste.pocoo.org/raw/NCHUUl2KQI46TkfYnzAY/
08:36 < minto> yes
08:36 < krzie> i told you your problem 3 times
08:36 < minto> you told me that it was already running
08:36 < minto> so i did stop daemon and start it again
08:37 < minto> sorry im quite noobish in linux
08:37 < gladiatr> killall -9 openvpn
08:37 < minto> ah thnx it worked :D
08:38 < minto> ^^
08:38 < gladiatr> always always always check your process table.  Init scripts are just that: scripts.  They make certain assumptions.  When those assumptions aren't necessarily so, the scripts will fail and sometimes give you faulty feedback
08:38 < minto> ill remember that :0
08:38  * krzie bets he doesnt know how to check his processes table
08:39  * gladiatr cackles
08:39 < gladiatr> man ps
08:39 < minto> that i did know |^|^
08:39 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
08:40 < minto> wth 0_0
08:41 < minto> can client autoconnect to vpn on deafult settings ?
08:42 < gladiatr> default... settings... I do not see...
08:42 < minto> the one for example config one
08:43 < minto> oh nvm ill figure it out somehow :)
08:43 < gladiatr> go get 'em, tiger
08:46 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 255 seconds]
08:49 <@vpnHelper> RSS Update - forum: Problem with client-connect script <http://forums.openvpn.net/topic7478.html#p8949>
08:51 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
08:54 -!- minto [~chatzilla@ryd002.multi-play.net.pl] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
09:03 < krzie> i honestly wasnt trying to be condesending
09:03 < krzie> i really think he didnt know how to find the process list
09:04 < krzie> im not even saying anything bad about that, i just dont know why people try to run openvpn when they dunno their os
09:05 < gladiatr> Dunno.  I thought it was funny. :)  
09:05 < gladiatr> their os... or basic ipv4 networking
09:06 < gladiatr> Don't get me wrong.  I think it's cool that people are interested in securing their links and whatnot, but... yeeeeaaah
09:06 < krzie> yep
09:06 < gladiatr> back in a few.  Must reboot... 
09:06 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Quit: Leaving]
09:07 -!- kmbcz [~androirc@32.165.181.138] has joined #openvpn
09:10 < kmbcz> I want to set up a site to site vpn from a data center to an office, and make a range of ips from the data center available for thee computers at the office available to set as static ips. What's the best way to accomplish this? 
09:11 <@dazo> !ccd
09:11 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
09:11 < krzie> you also want 
09:11 < krzie> !topology
09:11 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
09:12 < krzie> then you need 2 ips to waste, 1 for the server part of the vpn, 1 for its broadcast
09:12  * dazo wonders if we should propose --topology subnet as the default for OpenVPN 2.3 ....
09:12 < krzie> you get a +1 from me
09:12 < kmbcz> Yeah it will just be a /28 I need to use
09:13 < krzie> kmbcz, then you assign the IPs directly from --server
09:13 -!- abeehc_ [~bob@d207-6-195-163.bchsia.telus.net] has quit [Remote host closed the connection]
09:13 < krzie> as dazo said, you assign static IPs with --ccd
09:13 < krzie> !static
09:13 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
09:14 < kmbcz> Is there some way I can avoid playing with ips in openvpn and just bridge a nic on the server to a nic on the gateway virtually? 
09:15 < kmbcz> That would be infinitely easier
09:15 < krzie> yes, but it will a) be less secure and b) i cant help with it
09:15 < kmbcz> Security isn't a big deal
09:16  * krzie baffles
09:16 < krzie> ok, gimme root then!
09:16 < kmbcz> Lol
09:16 -!- moses [~moses@unaffiliated/moses/x-6794817] has quit [Read error: Connection reset by peer]
09:16 < krzie> ill try to stay within your bandwidth constraints ;)
09:17 < kmbcz> I just need to assign those ips at this location, that's my only requirement
09:19 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
09:19 < krzie> gladiatr, you missed the quote of the day
09:20 < krzie> gone only 13min and you missed it
09:20 < gladiatr> damn
09:20 < gladiatr> do tell
09:20 < krzie> [11:15]  <kmbcz> Security isn't a big deal
09:21 < kmbcz> Lmao
09:21 < gladiatr> and... where do I find... this... J. S. Sebastian...
09:21 < gladiatr> wow
09:21 < gladiatr> did this individual log off after typing these characters?
09:22 < krzie> nope, hes right here lh[is]ao
09:23 < gladiatr> well, yes indeed.  there he is.
09:23 < kmbcz> It's not in this situation, though. Nothing unsecured will by flying over my vpn
09:24 < kmbcz> Not that there is any secure data
09:24 <@dazo> sounds like security through obscurity for me, though
09:24 < krzie> hes going to bridge his external interface at his colo
09:24 <@vpnHelper> RSS Update - forum: OpenVPN to filter DHCP requests in bridge mode <http://forums.openvpn.net/topic7479.html>
09:25 < gladiatr> well, yeah... in the whole disconnected, powered-off and locked in a room buried under the rubble of the world trade center context...
09:25 < krzie> kmbcz, bridges arent insecure, but its meant to be bridged to an *internal* interface
09:25 < kmbcz> Ah, I see
09:26 < kmbcz> Might you be able to point me in the right direction, at least? 
09:26 < krzie> i did
09:26 < krzie> the *right* direction is !topology !static and using inet routable ips in --server
09:26 < krzie> ;]
09:27 < krzie> if you mean the right direction for bridging, that would be !bridge
09:27 < krzie> but thats not the *right* direction ;]
09:31 < kmbcz> Hah alright
09:31 < kmbcz> That's the simple direction though, no? 
09:32 < kmbcz> For somebody with limited Openvpn experience? 
09:32 < krzie> nope
09:32 < krzie> bridging is more difficult imo
09:32 < krzie> actually the routed method is quite simple... you arent even connecting in LANs
09:33 < krzie> plus your redirect setup wouldnt even need NAT
09:33 < kmbcz> Ahh. I still have to bridge on the gateway though,  no? 
09:34 < krzie> in fact i believe youd be done already if you spent the last 20 minutes working on it instead of talking about bridging
09:34 < krzie> and to the last question, no
09:34 -!- SOG [~SOG@solution1.hsia.citycenter.com] has quit [Quit: I will be back!]
09:34 < kmbcz> Hmm. Okay. Both servers still require two nics? Time to go shopping
09:35 < krzie> nope
09:35 < krzie> no extra nics needed
09:35 < krzie> just virtual adapters, called tun
09:38 < kmbcz> So on the client end I just plug it the single nic into the same switch as the incoming internet and set the client machines gateway to the gateway vpn machine? 
09:39 < krzie> you change nothing
09:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:39 < krzie> server is already on the net, as is the client
09:39 < krzie> you dont change any of that
09:39 < krzie> you just create a virtual connection (aka vpn) over the existing connection
09:40 < krzie> !vpn
09:40 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
09:44 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
09:46 < kmbcz> The client machines need to be assignable through their native interface though, not through additional software
09:46  * gladiatr thinks, "I believe it when you say you want to create visually stunning CGI films like Tron.  I just think a better place to start would be... oh... a crudely rendered teacup spinning on a plate..."
09:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:46 < kmbcz> So how do they run through the gateway machine if I don't change any if that? 
09:51 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
09:53 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 260 seconds]
09:53 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html>
10:00 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
10:07 -!- roue [~roue@75-134-143-252.dhcp.roch.mn.charter.com] has quit [Remote host closed the connection]
10:19 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
10:23 <@vpnHelper> RSS Update - forum: Converting from FreeSwan? <http://forums.openvpn.net/topic7477.html>
10:40 <@vpnHelper> RSS Update - forum: Converting from FreeSwan? <http://forums.openvpn.net/topic7477.html#p8952>
10:40 < krzie> [11:46]  <kmbcz> The client machines need to be assignable through their native interface though, not through additional software
10:41 < krzie> then openvpn is not an option
10:41 < krzie> !notcompat
10:41 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
10:41 < krzie> see #2
10:42 < kmbcz> That was the point of having the gateway machine, no? 
10:42 < kmbcz> So I could natively assign the ips through that machine
10:42 < krzie> you said no additional software
10:42 < krzie> you will need openvpn
10:43 < Bushmills> then the gateway is vpn client, not the machines which you call clients
10:43 < krzie> which happens to be additional software (not their native interface)
10:43 < kmbcz> Right
10:43 < Bushmills> gateway - as client - needs extra software: openvpn
10:43 < kmbcz> Yes, and the
10:44 < krzie> Bushmills, hes not using lans behind clients, the gateway is his server
10:44 -!- luneff [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
10:44 < krzie> he wants to use internet routable IPs whih currently belong to his server, for his clients
10:44 -!- luneff [~yury@84.51.205.26] has joined #openvpn
10:45 < kmbcz> Right, and they should be assignable to any machine in that lan
10:45 < krzie> wait wait
10:45 < krzie> "in that lan"
10:45 < kmbcz> Office is lan
10:45 < krzie> thats the first you mentioned a lan
10:46 -!- luneff [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
10:46 < krzie> ok looks like Bushmills was right
10:46 < krzie> he understood something which i did not
10:46 < Bushmills> lucky guess
10:48 -!- Directorsppadic [~sonupunno@88.211.55.77] has left #openvpn []
10:48 -!- Directorsppadic [~sonupunno@88.211.55.77] has joined #openvpn
10:48 -!- wunderkin [~kbockman@69-92-51-205.cpe.cableone.net] has joined #openvpn
10:48 -!- wunderkin [~kbockman@69-92-51-205.cpe.cableone.net] has left #openvpn []
10:49 < krzie> ok well i have never tested this, but i think it should work...
10:50 < krzie> same setup i mentioned earlier
10:50 < krzie> the vpn client will take the first IP in the pool
10:50 < krzie> then it needs to run a dhcp server for its LAN, and give out the other IPs in the pool
10:50 < krzie> those lan machines must route through it as their default gateway
10:50 < kmbcz> Right. I can run it static though, right? 
10:51 < kmbcz> Without adhcp? 
10:51 < krzie> sure, just dont use the dhcp server
10:51 < krzie> but they MUST know the vpn client as their default gateway
10:51 < kmbcz> Yes, okay. And do I need the lan on a second nic? 
10:52 < kmbcz> Or same is fine? 
10:52 < krzie> you are losing the LAN ips all together
10:52 < kmbcz> Right
10:52 < krzie> so what are you talking about?
10:53  * gladiatr whispers, "Pie"
10:53 < kmbcz> So the internet and vpn are on the same switch, the machines that use the ips just set the gateway machine as the gateway, right? 
10:55 < krzie> your vpn client will be their router
10:55 < kmbcz> Gotcha. And is this just a pretty standard site to site vpn? 
10:55 < krzie> if it also connects to a different router, and must have some other ip and be on some other network in order to communicate with its router, then it needs a second nic for that
10:55 <@vpnHelper> RSS Update - forum: OpenVPN to filter DHCP requests in bridge mode <http://forums.openvpn.net/topic7479.html#p8953>
10:56 < kmbcz> Gotcha
10:56 < kmbcz> And the remote machine doesn't need one, right? 
10:57 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
10:58 < krzie> nope
10:58 < kmbcz> By remote I mean server
10:58 < kmbcz> Awesome
10:58 < krzie> its not being a router for a lan
10:58 < krzie> you dont need the 2nd nic because of the vpn, you need it because your vpn client needs to act as a router for its lan now
10:59 < krzie> before, you said clients, which led me to believe that only vpn clients needed IPs from the server
10:59 < krzie> in which case you wouldnt need another nic anywhere
10:59 -!- int_0x80_ [~int0x80@int0x80.big-daddy.fr] has joined #openvpn
10:59 < int_0x80_> hello
10:59 < int_0x80_> some french here ?
11:00 < krzie> nope
11:01 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p8954>
11:01 < int_0x80_> do you know some french irc channels where it speaking about openvpn ?
11:02 -!- mathias [~mathias@p5B095E45.dip.t-dialin.net] has joined #openvpn
11:02 < krzie> nope, but there is a european forum online
11:02 -!- mathias is now known as Guest35397
11:02 < kmbcz> :-) thank you for all your help
11:03 < krzie> i dont think they do french tho
11:03 < Guest35397> hi, I would like to configure 3 openvpn server instances on a single machine with "topology subnet" and the _same_ subnet. Basically I want everybody no matter how he connected to be in the same OpenVPN subnet. Is that possible? I am asking because breaking something would lock me out ;)
11:03 <@dazo> I think the European forum does English and German, but not French
11:04 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Remote host closed the connection]
11:04 < gladiatr> Guest35397, I can't imagine how that would work
11:06 < gladiatr> why 3 instances?
11:06 < gladiatr> or why the same subnet?
11:07 <@dazo> Guest35397: I believe it can be done - in theory, by having each openvpn instance with different IP addresses (or IP less openvpn servers) providing IP addresses from separate pools ... and then you bridge all the tap adapters on the server into one device ... and use routing based on that interface
11:07 <@dazo> but I share gladiatr questions ... why why?
11:08 < gladiatr> Right, but then you wouldn't be using the topology subnet option which is for a routed connection, yes?
11:09 <@dazo> gladiatr: tap is more or less topology subnet
11:09 < gladiatr> lol.  Ok.  There is that.
11:10 < gladiatr> I was thinking more of the specific configuration directive rather than the concept.
11:11  * krzie chimes in as the third "why!?"
11:11 < krzie> planning on having like 600 clients and need to spread across multiple cores?
11:13 <@dazo> that explains multiple processes ... but not why on the same subnet 
11:13 <@vpnHelper> RSS Update - forum: Problem with client-connect script <http://forums.openvpn.net/topic7478.html#p8955>
11:16 < krzie> if my prior explanation rings true, that part would just be a lack of understanding of routing
11:16 < krzie> (which is super common)
11:17 <@dazo> agreed
11:18 < Guest35397> gladiatr: I have three instances because one is a split tunnel over UDP, another full tunnel over UDP and another full tunnel over TCP port 443 to bypass most proxy servers
11:18 < Guest35397> thx for the hints, I will think about it
11:18 < gladiatr> cool.
11:18 <@dazo> Guest35397: but why do they need to be on separate subnets?
11:18 <@dazo> on *same* subnet, I mean
11:19 < Guest35397> so that I dont have to push around so many routes 
11:19 < Guest35397> that was my idea :D
11:19 < gladiatr> You might want to consider going with a bridged environment then
11:19 < gladiatr> the layer 2 traffic is a  pita, but then everything is a trade-off :)
11:19 < Guest35397> hmm yeah - I tried to avoid layer 2 tunneling ;)
11:19 < gladiatr> me too
11:20 < gladiatr> if at all possible
11:20 <@dazo> that's not possible when you start with bridging
11:20 -!- Directorsppadic [~sonupunno@88.211.55.77] has quit [Quit: Directorsppadic]
11:20 <@dazo> bridging requires TAP
11:21 < gladiatr> You could also pick your client networks (for your 3 connections) out of a larger subnet.  You'd still need entries on the server, but then you would still only need a single route for other parts of your network
11:24 < Guest35397>  gladiatr : true - good old supernetting :D
11:24 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p8956>
11:24 < gladiatr> :D
11:25 < gladiatr> You have no idea (ok, you might) how many times I shot myself in that particular fashion by laying out address space w/out contemplating route propagation :P
11:27 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
11:28 < Guest35397> :D
11:29 -!- Guest35397 [~mathias@p5B095E45.dip.t-dialin.net] has quit [Quit: leaving]
11:38 -!- pyther24 [~pyther@unaffiliated/pyther] has joined #openvpn
11:42 < gladiatr> food...
11:49 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 276 seconds]
11:54 <@vpnHelper> RSS Update - forum: Problem with client-connect script <http://forums.openvpn.net/topic7478.html#p8957>
11:59 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
12:07 -!- zero_d [~zero@nl.gigabit.perfect-privacy.com] has joined #openvpn
12:07 -!- krzie [~k@openvpn/community/support/krzee] has quit [Ping timeout: 272 seconds]
12:08 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
12:08 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
12:08 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
12:09 < zero_d> want log into my vpn, got this error: http://nopaste.me/paste/4d2605272dd9f.html
12:09 < zero_d> whats wrong?
12:10 <@vpnHelper> RSS Update - forum: Converting from FreeSwan? <http://forums.openvpn.net/topic7477.html#p8958>
12:13 -!- s7r [~s7r@213.229.87.31] has joined #openvpn
12:14 -!- zero_d [~zero@nl.gigabit.perfect-privacy.com] has quit [Remote host closed the connection]
12:15 -!- zero_d [~zero@nl.gigabit.perfect-privacy.com] has joined #openvpn
12:22 <@vpnHelper> RSS Update - forum: Problem with client-connect script <http://forums.openvpn.net/topic7478.html#p8959>
12:22 -!- kmbcz [~androirc@32.165.181.138] has quit [Ping timeout: 255 seconds]
12:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:30 -!- sia^pwnnt is now known as sia
12:47 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
12:48 -!- zero_d [~zero@nl.gigabit.perfect-privacy.com] has quit [Remote host closed the connection]
12:49 -!- zero_d [~zero@nl.gigabit.perfect-privacy.com] has joined #openvpn
12:55 -!- luneff [~yury@84.51.205.26] has joined #openvpn
12:55 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
13:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:07 -!- luneff [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
13:08 -!- luneff [~yury@84.51.205.26] has joined #openvpn
13:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
13:13 -!- luneff [~yury@84.51.205.26] has quit [Quit: Leaving]
13:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:26 <@vpnHelper> RSS Update - forum: Problem with client-connect script <http://forums.openvpn.net/topic7478.html#p8960>
13:29 -!- corretico [~corretico@201.201.44.82] has quit [Remote host closed the connection]
13:32 <@vpnHelper> RSS Update - forum: Problem with client-connect script <http://forums.openvpn.net/topic7478.html#p8961>
13:34 -!- Malard [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
13:34 -!- Malard [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
13:34 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
13:37 <@vpnHelper> RSS Update - forum: Converting from FreeSwan? <http://forums.openvpn.net/topic7477.html#p8962>
13:40 -!- zero_d [~zero@nl.gigabit.perfect-privacy.com] has quit [Remote host closed the connection]
13:41 -!- zero_d [~zero@213.163.65.50] has joined #openvpn
13:42 -!- daemon [~daemon@serial.daemonrage.net] has quit [Excess Flood]
13:43 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
13:45 -!- dazo is now known as dazo_afk
13:45 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
13:48 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p8965> || OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p8964> || Problem with client-connect script <http://forums.openvpn.net/topic7478.html#p8963>
13:54 -!- zero_d [~zero@213.163.65.50] has quit [Remote host closed the connection]
13:54 <@vpnHelper> RSS Update - forum: 3g works router adsl don´t <http://forums.openvpn.net/topic7428.html#p8966>
13:55 -!- zero_d [~zero@nl.gigabit.perfect-privacy.com] has joined #openvpn
13:59 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p8967>
13:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
14:05 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p8968>
14:05 -!- daemon is now known as jsEvalBot
14:05 -!- jsEvalBot is now known as daemon
14:10 <@vpnHelper> RSS Update - forum: Problem with client-connect script <http://forums.openvpn.net/topic7478.html#p8970> || OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p8969>
14:24 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:24 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:27 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p8971>
14:30 -!- pyther24 [~pyther@unaffiliated/pyther] has quit [Quit: leaving]
14:36 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 255 seconds]
14:38 -!- kim0 [~kim0@ubuntu/member/kim0] has joined #openvpn
14:38 < kim0> Hi folks
14:38 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
14:38 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
14:38 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
14:39 < kim0> I've been running an openvpn setup for 2 years now, been awesome
14:39 < kim0> today, things are suddenly too slow (ping takes 6000ms)
14:39 < kim0> how can I locate the bottleneck please ?
14:40 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:57 -!- sia is now known as sia^pwnnt
15:01 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has joined #openvpn
15:01 < Bushmills> kim0: mtr.   
15:01 < grendal_prime> is it possible to get the macaddress of a connected tap ?
15:03 < grendal_prime> so basically a windows machine connects via a tap device, i need to look at the (and yes i know its randomly generated) mac address of the tap on the client machine.
15:06 < kim0> Bushmills: thnx, just tried it, but I am testing the 2 vpn end points. Thus mtr result is a single line saying avg latency = 6000ms with loss=7%
15:06 < Bushmills> mtr public server address instead
15:07 < Bushmills> that'll show all hops between client and server
15:07 < kim0> ah damn :)
15:13 < kim0> Bushmills: mtr is showing a level3 router in san jose is dropping 96% of packets
15:13 < Bushmills> repeat mtr the opposite direction, just to make sure.
15:13 < kim0> Bushmills: however mtr uses icmp right ? I understand ISP differentiate against that
15:14 < Bushmills> but not commonly by introducing a multi-second lag
15:15 < Bushmills> in addition, your observation is consistent with the lag experienced with your openvpn connection
15:16 < Bushmills> with -u, you can use mtr with udp datagrams instead of icmp
15:17 < int_0x80_> some french people here please ?
15:18 < kim0> Bushmills: thanks for being so helpful! Can I ask you to take a quick look over the results (I can pastebin them) ?
15:20 < Bushmills> if i'm called "helpful", i must have done something wrong :P 
15:20 < kim0> hehe :) nah not really 
15:20 < kim0> lol
15:22 < Bushmills> i suppose, looking at the result will only let me conclude that there's an overloaded level3 router between your server and client
15:22 < kim0> Bushmills: Yeah .. I mean if you can confirm that's the reason (most likely)
15:23 < kim0> then it would be helpful indeed
15:23 < kim0> Bushmills: for example .. in the first trace .. I'm not sure why lines 18 and 19 show high loss as well
15:23 < Bushmills> doesn't it look as there's a routing loop in it?
15:24 < kim0> Bushmills: how can you see that
15:24 < kim0> Bushmills: these are 2 traces .. US2EG then EG2US
15:24 < Bushmills> there's a router which seems to appear several times, as different hop in the route
15:25 < Bushmills> ae-84-84.csw3.SanJose1.Level3.net
15:26 < kim0> Bushmills: yeah that's weird
15:27 < kim0> Bushmills: Any explanations for the loss on linse 18,19 ?
15:27 < Bushmills> anyway, looks like there's fairly little you can do besides waiting it out
15:28 < kim0> I'm not even sure how mtr can determine where the loss happened ? a loss is a loss .. the packet disappeared somewhere right!
15:28 < kim0> I know about ttl and returning an icmp message .. but a loss is different huh
15:30 -!- Malard|Home [ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
15:30 -!- Malard|Home [ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
15:30 -!- Malard|Home [ident@xbmc/staff/malard] has joined #openvpn
15:31 < kim0> Bushmills: weird huh
15:32 < Bushmills> it can, as all hops are pinged one by one
15:33 -!- Malard [ident@xbmc/staff/malard] has quit [Ping timeout: 265 seconds]
15:33 < kim0> Bushmills: but if hop3 is the one dropping packets .. and it pings hop4 and a packet is dropped .. how can it know if it were hop3 or hop4 that dropped it
15:33 < Bushmills> i think it subtracts accumulated time from all previous hops from the one currently measured
15:34 < Bushmills> by knowing that hop2 isn't lossy yet, and the effects of hop 3 show in hop 4, and can therefore be extrapolated on hop4 measurements
15:35 < Bushmills> after all, it measured hop3 before it measured hop4
15:35 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:36 < kim0> but that sounds horribly inaccurate
15:36 < kim0> IMO once hop3 drops 95% packets like in my case .. the rest of the route becomes dark
15:37 -!- Malard [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
15:37 -!- Malard [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
15:37 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
15:37 < Bushmills> which is why i suggested to mtr the opposite direction too
15:38 < kim0> I wish one could manually choose the route to avoid the faulty router 
15:38 < kim0> lots of good things were killed in the name of security hehe
15:38 < Bushmills> you could - if those routers were yours
15:39 -!- s7r [~s7r@213.229.87.31] has left #openvpn []
15:40 < kim0> hehe
15:40 < kim0> Bushmills: Thanks man, really appreciate the help
15:40 -!- Malard|Home [ident@xbmc/staff/malard] has quit [Ping timeout: 250 seconds]
15:45 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- s0 d4Mn l33t |t'z 5c4rY!]
15:50 < grendal_prime> tap mac address? is that possible?
15:50 < grendal_prime> from the server?
15:51 -!- luneff [~yury@84.51.205.26] has joined #openvpn
15:54 -!- hexa [~hexa@modemcable102.60-82-70.mc.videotron.ca] has joined #openvpn
15:55 < hexa> hi, is it possible to set the tun ip something else then 172.16.0.1 for example... since I already have a gateway on .1.. ?
15:55 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
15:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 265 seconds]
15:56 < hexa> can I set server 172.16.0.10 netmask ?
15:59 < Bushmills> hexa: do you overlap ethernet- and openvpn subnet addresses?
15:59 < hexa> Bushmills, ethernet and openvpn subnet??
16:00 < Bushmills> how can you have a gateway on 172.16.0.1 if it's not the openvpn server?
16:00 < hexa> Bushmills, well it is but it's ip is set on a carp device.. if I get ifconfig: ioctl (SIOCAIFADDR): File exists
16:01 < Bushmills> or, better, why is your openvpn subnet 172.16.0.0 when you have a gateway on  172.16.0.1?
16:02 < hexa> Bushmills, you mean I need to run openvpn in another subnet then my internal lan..
16:02 < hexa> makes sense
16:02 < Bushmills> right
16:02 < hexa> hehe thx :)
16:02 < grendal_prime> ya...otherwise you want to use a bridge
16:02 < hexa> yeah got it :) doh
16:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:13 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 260 seconds]
16:22 -!- Malard [~ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
16:22 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
16:23 -!- luneff [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
16:23 -!- luneff [~yury@84.51.205.26] has joined #openvpn
16:28 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has joined #openvpn
16:29 -!- zero_d [~zero@nl.gigabit.perfect-privacy.com] has quit [Remote host closed the connection]
16:33 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
16:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
16:46 -!- hexa [~hexa@modemcable102.60-82-70.mc.videotron.ca] has left #openvpn ["Leaving"]
16:55 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
16:55 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Excess Flood]
16:55 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
16:57 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
16:58 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Remote host closed the connection]
17:04 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 264 seconds]
17:07 -!- WinstonSmith_ [~true@g231217167.adsl.alicedsl.de] has joined #openvpn
17:07 -!- WinstonSmith [~true@e179002106.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
17:10 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
17:13 -!- WinstonSmith_ [~true@g231217167.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
17:24 -!- WinstonSmith_ [~true@f052099193.adsl.alicedsl.de] has joined #openvpn
17:30 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has quit [Quit: Ex-Chat]
17:33 -!- luneff [~yury@84.51.205.26] has quit [Quit: Leaving]
17:34 -!- davneg [~lunix@otherreality.net] has quit [Read error: Connection reset by peer]
17:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:56 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:24 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:24 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:27 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
18:39 < pyther> Hi
18:39 < pyther> If I push routes that already exit on the local system what will happen? Well they simply not go into affect?
18:40 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
18:40 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
18:40 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:42 < Bushmills> they'll exist twice, ad the first will be used. though whether they're duplicated may depend on operating system.
18:47 < pyther> Bushmills: the first being the local, I would assume it would have a lower metric?
18:48 < Bushmills> i assume that the routes are identical, therefore also same metric
18:49 < pyther> well one would push out to my remote network and the other would push out to the local network, no?
18:50 < Bushmills> i don't know the routes zou're pushing.
18:50 < Bushmills> you're .
18:51 < pyther> say I push 10.250.1.10/255 and there is the local lan is 10.250.1.0/24
18:52 < Bushmills> then you'd have two conflicting routes. one will have precedence.
18:53 < pyther> Bushmills: ok, which one? I would assume that the local router would probably have a lower metric taking precedence, correct?
18:53 < Bushmills> may depend on OS. the last rule added having precedence makes most sense
18:54 < pyther> hmm, do you know about windows?
18:55 < Bushmills> when i google for windows, i might know what that is
18:55 < Bushmills> a graphical shell for msdos, iirc
18:56 < pyther> o_o
18:56 < pyther> Hmm on vista the remote route has a metric of 30 and the local route has a metric of 286
18:57 < Bushmills> metric should be of no relevance unless you're using a routing protocol for dynamic routing
18:57 < pyther> no, I thought a metric was used to determine the best route to go with
18:58 < pyther> ?
18:58 < Bushmills> that's how routing protocols can be told which of the overlapping/conflicting routes is more preferable 
18:58 < krzie> its most specific route wins
18:59 < krzie> and in windows, if they are = the metric does get used
18:59 < pyther> so the windows uses the most specific route? What if the two routes are the same
18:59 < pyther> ahh ok
19:08 -!- sia^pwnnt is now known as sia
19:40 <@vpnHelper> RSS Update - forum: android-openvpn-settings <http://forums.openvpn.net/topic7481.html>
20:00 < krzie> grr i wanna answer that one, but cant
20:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
20:05 -!- WinstonSmith_ [~true@f052099193.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
20:09 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
20:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:16 <@vpnHelper> RSS Update - forum: Private network config <http://forums.openvpn.net/topic7482.html>
20:32 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
20:33 -!- Bebop2Steady [~Bebop2Ste@124-168-169-88.dyn.iinet.net.au] has joined #openvpn
20:34 <@vpnHelper> RSS Update - forum: android-openvpn-settings <http://forums.openvpn.net/topic7481.html#p8975> || Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html>
20:37 < Bebop2Steady> Good morning/evening to all. If any adventurous soul can help out -- I started a new thread at the forum ( link above ^ ) with a question of how to effectively implement 2-hop or double-vpn. I'm stuck for now, on step one, which is teh basic understanding of teh concept.
20:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:43 < HoboSteaux> hey im trying to do speed/resource testing using different encryptions etc. whats a suuper simple setup for this?
20:46 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p8976>
20:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:52 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p8977>
20:56 -!- roe [~roe___@unaffiliated/roe] has joined #openvpn
20:56 < roe> !welcome
20:56 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:57 < roe> !goal
20:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:58 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p8979> || Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p8978>
21:16 -!- p3rror [~mezgani@41.140.30.16] has joined #openvpn
21:19 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has left #openvpn []
21:34 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p8980>
21:46 <@vpnHelper> RSS Update - forum: Private network config <http://forums.openvpn.net/topic7482.html#p8982> || Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p8981>
21:52 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p8983>
22:02 -!- p3rror [~mezgani@41.140.30.16] has quit [Ping timeout: 240 seconds]
22:04 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p8984>
22:14 -!- p3rror [~mezgani@41.140.34.211] has joined #openvpn
22:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
22:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:24 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 240 seconds]
23:33 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
23:40 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
--- Day changed Fri Jan 07 2011
00:01 -!- Bebop2Steady [~Bebop2Ste@124-168-169-88.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
00:31 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has quit [Quit: Leaving]
01:15 -!- gdb``` [~user@dr-wily.ipv6.mit.edu] has quit [Read error: Operation timed out]
01:15 -!- WinstonSmith [~true@g230121201.adsl.alicedsl.de] has joined #openvpn
01:19 -!- WinstonSmith [~true@g230121201.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
01:36 -!- WinstonSmith [~true@f052096061.adsl.alicedsl.de] has joined #openvpn
01:42 -!- dazo_afk is now known as dazo
01:59 -!- Satpol [~satpol@unaffiliated/satpol] has joined #openvpn
02:06 -!- p3rror [~mezgani@41.140.34.211] has quit [Ping timeout: 240 seconds]
02:19 -!- p3rror [~mezgani@41.140.47.113] has joined #openvpn
02:42 -!- p3rror [~mezgani@41.140.47.113] has quit [Ping timeout: 240 seconds]
02:43 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
02:44 -!- skrusty [~skrusty@83.166.176.39] has quit [Read error: Operation timed out]
02:47 -!- dazo is now known as dazo_afk
02:54 -!- p3rror [~mezgani@41.140.40.137] has joined #openvpn
02:59 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
03:00 -!- dazo_afk is now known as dazo
03:11 -!- alhadi [~thunderst@178.33.209.33] has joined #openvpn
03:11 < alhadi> http://www.pastie.org/private/gjr1n42h3pjiadtsog2fw
03:11 < alhadi> why is the TLS key verifying itself?
03:12 < alhadi> i connected 11:55 AM and then 12:55 PM after 60 minutes it rechecks it, and under client1.ovpn i added regneg = 0
03:12 < alhadi> reneg-sec 0
03:12 < alhadi> infact i added that, shuld it means it wont give that again?
03:12 < alhadi> but still it gives me
03:15 < krzie> do you know why it renegs?
03:16 < alhadi> no
03:16 < alhadi> could you tell me
03:16 < krzie> you get a new key every hour
03:16 < krzie> it is part of what is called forward security
03:16 < alhadi> i see
03:16 < krzie> if i somehow am able to decrypt your traffic, i can only get the hours worth
03:16 < alhadi> so regneg-sec 0 is okay under client1.ovpn?
03:16 < krzie> so lets say you get a yrs worth of my traffic saved
03:17 < krzie> then you get my cert / key
03:17 < alhadi> oh
03:17 < krzie> you can still only decrypt my CURRENT traffic
03:17 < krzie> cause the key is being changed every reneg
03:17 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:17 < alhadi> sounds good
03:17 < krzie> this is an important advantage of certs over static key
03:17 < krzie> you dont wanna remove the reneg
03:17 < krzie> dont mess with it ;]
03:17 < alhadi> sure
03:17 < alhadi> actually
03:18 < alhadi> i put it reneg-sec 0
03:18 < krzie> remove that line
03:18 < alhadi> it was not there as default
03:18 < krzie> it wasnt there, and shouldnt be there
03:18 < alhadi> ok
03:18 < krzie> luckily it did nothing cause your server controls that ;)
03:18 < alhadi> hehe
03:18 < alhadi> can i show you my server.conf?
03:19 < krzie> if you wanna... is something wrong?
03:19 < alhadi> well just to confirm if my settings is alright or i am in trouble
03:19 < krzie> ok
03:19 < alhadi> you are good security guys but noob like me can make us vulnerable
03:19 < alhadi> one moment
03:20 < krzie> you said you used my confgen tho, should be fine
03:20 < krzie> (as long as you didnt do things like try to remove reneg, lol)
03:21 < alhadi> krzie shuld pm you the pastie?
03:21 < alhadi> or here fine?
03:21 < krzie> nah heres fine
03:21 < alhadi> http://www.pastie.org/private/z22slvyjjetdxozbyz2hrq
03:21 < alhadi> client1.conf ^^
03:22 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
03:22 < alhadi> http://www.pastie.org/private/rfgdxdnzofrybjvjmgc90g
03:22 < alhadi> openvpn.conf ^^
03:23 < krzie> why DES-EDE3-CBC ?
03:23 < alhadi> triple des
03:23 < alhadi> 192 bit
03:23 < alhadi> shuld go for default then?
03:24 < krzie> In general Triple DES with three independent keys (keying option 1) has a key length of 168 bits (three 56-bit DES keys), but due to the meet-in-the-middle attack the effective security it provides is only 112 bits. Keying option 2 reduces the key size to 112 bits. However, this option is susceptible to certain chosen-plaintext or known-plaintext attacks[13][14] and thus it is designated by NIST to have only 80 bits of security.[7]
03:24 < juhovh> DES is pretty oldschool :)
03:25 < alhadi> oh
03:25 < hyper_ch> all play and no works makes hyper_ch a jolly boy :)
03:25 < krzie> haha nice hyper_ch 
03:25 < alhadi> shuld have know that before
03:25 < hyper_ch> howdy krzie
03:25 < alhadi> thats why i pasted here so you profesional ppl can help noob
03:25 < alhadi> :)
03:25 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 276 seconds]
03:25 < krzie> but dude
03:26 < krzie> why change things without learning about them?
03:26 < hyper_ch> krzie: people like to toy around with things... even if they don't understand them :)
03:26 < krzie> i mean so far you killed your encryption level and removed forward security
03:26 < krzie> pls tell me when i look at server i wont see client-cert-not-required
03:26 < alhadi> :(
03:27 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
03:27 < alhadi> krzie i am just gonna use default openvpn.gen only
03:27 < alhadi> brb
03:27 < alhadi> made by krzee
03:27 < alhadi> :)
03:27 < krzie> the default cipher is blowfish
03:27 < alhadi> ok noted :)
03:28 < krzie> blowfish is widely trusted
03:28  * hyper_ch still thinks that blowfish sounds like a very dirrty word :)
03:29 < krzie> haha
03:30 < krzie> however it looks like the author of blowfish recommends twofish over it
03:30 < krzie> (same author)
03:36 -!- alhadi [~thunderst@178.33.209.33] has quit [Ping timeout: 240 seconds]
03:38 < hyper_ch> any difference?
03:38 < krzie> yep, wikipedia them
03:40 < hyper_ch> use kompare to see the diffs?
03:48 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 246 seconds]
03:50 -!- master_of_master [~master_of@p57B5386B.dip.t-dialin.net] has quit [Ping timeout: 265 seconds]
03:51 -!- master_of_master [~master_of@p57B54F79.dip.t-dialin.net] has joined #openvpn
03:54 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:57 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
04:02 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:12 -!- SOG [~SOG@solution1.hsia.citycenter.com] has joined #openvpn
04:18 -!- mrle0 [~fin@82.132.243.47] has joined #openvpn
04:19 -!- alhadi [~thunderst@92.99.235.168] has joined #openvpn
04:19 < alhadi> Hello
04:19 < alhadi> krzie http://www.pastie.org/private/nb0ophw8bro35d4p9k301q
04:19 < alhadi> openvpn.conf
04:19 < alhadi> generated by the krzee script
04:20 < alhadi> http://www.pastie.org/private/itkd2ebi1hmruawqgzlvg
04:20 < alhadi> client1.conf
04:20 < alhadi> .ovpn*
04:23 < alhadi> looks good?
04:26 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:26 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:34 -!- alhadi [~thunderst@92.99.235.168] has quit [Ping timeout: 250 seconds]
04:34 -!- alhadi [~thunderst@178.33.209.33] has joined #openvpn
04:38 -!- alhadi2 [~thunderst@178.33.209.33] has joined #openvpn
04:38 < alhadi2> hi
04:38 -!- alhadi2 [~thunderst@178.33.209.33] has quit [Client Quit]
04:38 -!- alhadi2 [~thunderst@178.33.209.33] has joined #openvpn
04:39 -!- alhadi [~thunderst@178.33.209.33] has quit [Disconnected by services]
04:39 -!- alhadi2 is now known as alhadi
04:39 -!- alhadi [~thunderst@178.33.209.33] has quit [Changing host]
04:39 -!- alhadi [~thunderst@unaffiliated/alhadi] has joined #openvpn
04:39 -!- common- [~common@p5DDA4728.dip0.t-ipconnect.de] has joined #openvpn
04:41 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
04:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:43 -!- common [~common@p5DDA489C.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
04:43 -!- common- is now known as common
04:49 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p8985>
04:50 -!- alhadi [~thunderst@unaffiliated/alhadi] has quit [Quit: alhadi]
04:50 -!- dazo is now known as dazo_afk
04:59 -!- alhadi [~thunderst@178.33.209.33] has joined #openvpn
05:02 -!- mrle0 [~fin@82.132.243.47] has quit [Remote host closed the connection]
05:03 -!- mrle0 [~fin@82.132.243.41] has joined #openvpn
05:04 -!- dazo_afk is now known as dazo
05:05 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:07 -!- WinstonSmith [~true@f052096061.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
05:08 -!- mrle0 [~fin@82.132.243.41] has quit [Quit: Leaving]
05:12 -!- alhadi [~thunderst@178.33.209.33] has quit [Read error: Connection reset by peer]
05:12 -!- alhadi [~thunderst@178.33.209.33] has joined #openvpn
05:16 -!- alhadi [~thunderst@178.33.209.33] has quit [Read error: Connection reset by peer]
05:17 -!- alhadi [~thunderst@178.33.209.33] has joined #openvpn
05:20 -!- WinstonSmith [~true@g230121201.adsl.alicedsl.de] has joined #openvpn
05:25 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
05:25 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
05:25 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:29 -!- WinstonSmith [~true@g230121201.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
05:37 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 250 seconds]
05:41 <@vpnHelper> RSS Update - forum: how to create certificates for "--remote-cert-tls" <http://forums.openvpn.net/topic7484.html>
05:46 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
05:49 -!- WinstonSmith [~true@e179004000.adsl.alicedsl.de] has joined #openvpn
05:49 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
05:51 -!- dazo is now known as dazo_afk
05:56 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has joined #openvpn
05:56 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has quit [Changing host]
05:56 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
06:05 -!- dazo_afk is now known as dazo
06:12 <@vpnHelper> RSS Update - forum: no access to net behind working vpn <http://forums.openvpn.net/topic7485.html>
06:16 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:20 -!- SOG [~SOG@solution1.hsia.citycenter.com] has quit [Ping timeout: 240 seconds]
06:23 -!- p3rror [~mezgani@41.140.40.137] has quit [Ping timeout: 240 seconds]
06:36 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
06:36 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
06:39 -!- dazo is now known as dazo_mtg
06:44 -!- s7r [~s7r@89.238.173.233] has joined #openvpn
06:51 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
06:59 -!- WinstonSmith [~true@e179004000.adsl.alicedsl.de] has quit [Remote host closed the connection]
07:01 -!- sporedi [~chatzilla@mail.utmxtm.com] has joined #openvpn
07:02 -!- WinstonSmith [~true@g230121201.adsl.alicedsl.de] has joined #openvpn
07:04 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
07:05 -!- elenril [~wiskas@2002:c155:9a2e:1:d43e:64ff:fe5d:2429] has joined #openvpn
07:05 -!- sporedi [~chatzilla@mail.utmxtm.com] has quit [Read error: Connection reset by peer]
07:06 < elenril> hello
07:06 < elenril> does openvpn have a dhcp client built-in or it calls an external program?
07:06 -!- sporedi [~chatzilla@mail.utmxtm.com] has joined #openvpn
07:07 -!- sporedi [~chatzilla@mail.utmxtm.com] has quit [Client Quit]
07:07 < elenril> (i'm trying to get dhcpv6 working automagically over the tunnel)
07:10 -!- WinstonSmith [~true@g230121201.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
07:14 < Bushmills> neither. though server assigns ip addresses, static or dynamic, to clients
07:19 < elenril> ah
07:21 < elenril> anyways, that only seems to be implemented for ipv4
07:21 < elenril> i wonder what would be the best way to call a dhcp client on startup
07:23 < hyper_ch> s/r/d
07:29 -!- WinstonSmith [~true@e179004000.adsl.alicedsl.de] has joined #openvpn
07:46 -!- p3rror [~mezgani@41.140.177.92] has joined #openvpn
08:03 -!- raomin [~romain@86.66.22.240] has quit [Ping timeout: 240 seconds]
08:10 < venom00ut> hello, when using UDP to connect to a vpn server, does OpenVPN makes some additional check of the packet integrity?
08:10 < gladiatr> elenril, I think the only way to accomplish what you're asking would be to bridge your client(s) rather than routing them.  
08:11 < ecrist> venom00ut: no
08:11 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
08:11 < ecrist> if it's corrupt, openvpn cannot decrypt it
08:12 < venom00ut> ecrist, thanks
08:12 -!- Satpol [~satpol@unaffiliated/satpol] has quit [Quit: Leaving]
08:17 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Read error: Operation timed out]
08:17 -!- raomin [~romain@86.66.22.250] has joined #openvpn
08:20 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
08:32 -!- huli [~ericlee@220.181.143.94] has joined #openvpn
08:34 < huli> hi, how to set up the OpenVPN server in bridge mode?
08:37 < huli> There's only one nic in OpenVPN server.
08:39 < gladiatr> huli, in that case, you wouldn't actually bridge the tap device with a physical device.  Just treat tap as your stand-alone "internally facing" network card.
08:40 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
08:40 -!- raomin [~romain@86.66.22.250] has quit [Remote host closed the connection]
08:41 < huli> gladiatr: I see. so is there any thing need to set up  for client side?
08:41 < gladiatr> huli, what do you mean, exactly?
08:42 < huli> gladiatr: I mean, if client uses Linux as well, does client need to set up something special?
08:43 < gladiatr> huli, are you just wanting to join the one linux system to the bridge or will it be acting as a gateway for additional systems?
08:44 < gladiatr> huli, I take it you will be tunneling all of your traffic?
08:44 < huli> gladiatr: Okay, a client is an external machine, and if I set up my OpenVPN server in bridge mode, does the client need to set up something when he/she wants to have access my OpenVPN server?
08:46 < gladiatr> Not really.  Just specify tap rather than tun as your dev type
08:48 < huli> gladiatr: understand. I need to enable packets forward in OpenVPN server, so do I need to set up another gateway?
08:48 < gladiatr> huli, for...
08:48 < gladiatr> huli, do you mean a route?
08:48 < huli> gladiatr: yes
08:49 < huli> gladiatr: My OpenVPN is in 192.168.10.x and I think tap0 is also in this range. 
08:49 < gladiatr> huli, if you want to route all client connections over the VPN, you'll need to do two things: 
08:49 < huli> yes?
08:50 < gladiatr> huli, 1: configure your client system with a static host route to your openvpn server
08:50 < gladiatr> huli, and... (checking the docs...)
08:51 < huli> gladiatr: if the client is in Internet, it's all the same, right?
08:53 < gladiatr> huli,  nevermind what i typed above.  You'll want to use the "redirect-gateway def1" directive in your server.conf
08:53 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:53 < gladiatr> huli, I'm not understanding your question.
08:54 < huli> gladiatr: sorry. Actually I can ping my OpenVPN in my home well.
08:54 < huli> So I think that should be okay
08:55 < gladiatr> if you're happy, I'm happy :)
08:55 < huli> thanks gladiatr
08:55 < gladiatr> no problem
08:59 -!- SOG [~SOG@n11649233199.netvigator.com] has joined #openvpn
09:01 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
09:10 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p8988>
09:16 < alhadi> krzie :)
09:16 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p8989>
09:16 < alhadi> the openvpn works fine , every hour key rehashing
09:16 < alhadi> it will give me new key every hour
09:16 < alhadi> :D
09:16 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
09:17 -!- luneff [~yury@84.51.195.188] has joined #openvpn
09:28 -!- SOG_ [~SOG@solution1.hsia.citycenter.com] has joined #openvpn
09:28 <@vpnHelper> RSS Update - forum: Two clients got the same IP <http://forums.openvpn.net/topic7486.html>
09:29 -!- SOG_ [~SOG@solution1.hsia.citycenter.com] has quit [Client Quit]
09:29 -!- dazo_mtg is now known as dazo
09:33 -!- SOG [~SOG@n11649233199.netvigator.com] has quit [Ping timeout: 264 seconds]
09:34 <@vpnHelper> RSS Update - forum: Two clients got the same IP <http://forums.openvpn.net/topic7486.html#p8992> || OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p8991>
09:38 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 255 seconds]
09:40 <@vpnHelper> RSS Update - forum: Two clients got the same IP <http://forums.openvpn.net/topic7486.html#p8993>
09:46 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
09:46 <@vpnHelper> RSS Update - forum: Two clients got the same IP <http://forums.openvpn.net/topic7486.html#p8994>
09:47 -!- Ben___ [560ca404@gateway/web/freenode/ip.86.12.164.4] has joined #openvpn
09:47 < Ben___> hello?
09:48 -!- Ben___ is now known as Guest10151
09:48 < alhadi> hi
09:49 < Guest10151> can you give me a bit of help?
09:49 < alhadi> explain your problem
09:49 < Guest10151> I've got an OpenVPN server setup
09:49 < alhadi> ok
09:49 < Guest10151> just trying to setup authentication
09:49 < alhadi> alright what error?
09:50 < Guest10151> we've got an Active Directory environment
09:50 < Guest10151> just trying to integrate it
09:50 < Guest10151> need some basic pointers...
09:50 < Guest10151> sorry, a bit vague, I know
09:51 < Guest10151> we use LDAP authentication for our virtual learning envvironment
09:52 < Guest10151> so, I figured we'd use that
09:52 < Guest10151> just not sure how to drag the users across
09:53 < gladiatr> Is your openvpn server process running on windows?
09:54 < Guest10151> no, ubuntu
09:54 < gladiatr> excellent.  You might want to check this out, then: http://code.google.com/p/openvpn-auth-ldap/
09:54 <@vpnHelper> Title: openvpn-auth-ldap - Project Hosting on Google Code (at code.google.com)
09:55 < gladiatr>  ^^ such a helpful lil bot ^^
09:55 < Guest10151> heh
09:55 < Guest10151> thanks, I'll take a look
10:10 <@vpnHelper> RSS Update - forum: Two clients got the same IP <http://forums.openvpn.net/topic7486.html#p8996> || no access to net behind working vpn <http://forums.openvpn.net/topic7485.html#p8995>
10:16 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
10:16 <@vpnHelper> RSS Update - forum: [newbie/2.0.9] Checking that OpenVPN is OK? <http://forums.openvpn.net/topic7487.html>
10:17 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
10:22 <@vpnHelper> RSS Update - forum: how to create certificates for "--remote-cert-tls" <http://forums.openvpn.net/topic7484.html#p8998>
10:31 -!- dazo is now known as dazo_afk
10:32 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
10:33 -!- Malard [~ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
10:33 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
10:33 <@vpnHelper> RSS Update - forum: [newbie/2.0.9] Checking that OpenVPN is OK? <http://forums.openvpn.net/topic7487.html#p8999>
10:34 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
10:36 -!- Guest10151 [560ca404@gateway/web/freenode/ip.86.12.164.4] has quit [Quit: Page closed]
10:38 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
10:38 < iceberg> !welcome
10:38 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:39 < iceberg> !goal
10:39 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:39 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p9001> || Two clients got the same IP <http://forums.openvpn.net/topic7486.html#p9000>
10:39 < iceberg> !route
10:39 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
10:40 -!- huli [~ericlee@220.181.143.94] has quit [Quit: Leaving.]
10:40 < iceberg> !redirect
10:40 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
10:42 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 255 seconds]
10:43 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
10:44 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:44 -!- Malard|Home [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
10:44 -!- Malard|Home [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
10:44 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
10:44 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received*IP* (si=3 op=P <http://forums.openvpn.net/topic7488.html>
10:48 -!- Malard [ident@xbmc/staff/malard] has quit [Ping timeout: 264 seconds]
10:52 -!- iceberg_ [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
10:52 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Read error: Connection reset by peer]
10:52 -!- iceberg_ is now known as iceberg
10:53 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
10:55 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:55 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:57 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
11:03 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
11:03 -!- mode/#openvpn [+o vpnHelper] by ChanServ
11:13 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
11:13 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 272 seconds]
11:13 < fahmad> hello
11:13 < fahmad> Bushmills: arround ?
11:15 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received*IP* (si=3 op=P <http://forums.openvpn.net/topic7488.html#p9003>
11:18 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
11:18 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
11:18 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
11:19 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
11:20 -!- Malard|Home [~ident@xbmc/staff/malard] has quit [Ping timeout: 255 seconds]
11:20 <@vpnHelper> RSS Update - forum: Two clients got the same IP <http://forums.openvpn.net/topic7486.html#p9004>
11:22 -!- Malard [ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
11:22 -!- Malard [~ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
11:22 -!- Malard [~ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
11:22 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
11:24 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
11:27 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p9005>
11:27 -!- roe [~roe___@unaffiliated/roe] has left #openvpn ["Leaving"]
11:28 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 276 seconds]
11:29 < krzie> bmmcwhirt you here?
11:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:34 < iceberg> yes
11:34 -!- iceberg is now known as bmmcwhirt
11:35 < bmmcwhirt> forgot my efnet nick was on there
11:36 < krzie> werd
11:36 < krzie> ok so whats your goal?
11:37 < krzie> and as for the .5 thing
11:37 < krzie> !/30
11:37 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
11:38 < bmmcwhirt> connect sever 5-10 remote machines to my local network as well as have their internet traffic routed through the vpn.
11:38 < bmmcwhirt> s/sever/several
11:38 < krzie> ok so
11:38 < krzie> share the server lan with all clientds
11:38 < krzie> AND
11:39 < krzie> !redirect
11:39 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
11:39 < krzie> is that right?
11:39 < bmmcwhirt> correct, I was leaving the redirect part out of my config till I had the first problem solved
11:40 < krzie> dont worry about the .5 thing
11:40 < krzie> its normal
11:40 < krzie> !serverlan
11:40 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
11:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:41 < krzie> you mentioned gateway_enable="YES"
11:41 < bmmcwhirt> correct
11:41 < krzie> that enables ip forwarding
11:41 < krzie> so thats good
11:41 < krzie> pastebin server config with no comments
11:42 < krzie> although its prolly right, since you read my routing writeup
11:42 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:44 < bmmcwhirt> http://pastebin.ca/2040416    
11:49 -!- sigius [~sigius@93.125.185.45] has quit [Read error: Connection reset by peer]
11:51 < krzie> lost this
11:51 < krzie> err
11:51 < krzie> lose this:
11:51 < krzie> route 10.8.0.0 255.255.255.0
11:52 < bmmcwhirt> ok, I added that when traffic wasn't moving across the tunel
11:52 < krzie> see --server in the manual
11:52 < krzie> you saying your client couldnt ping 10.8.0.1?
11:53 < bmmcwhirt> correct, thats why I manually set a rotue to it
11:53 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:53 < bmmcwhirt> I thought it was because of the .5 .6 stuff
11:54 < krzie> but if you look at --server
11:54 < bmmcwhirt> but you said I was mistaken about that, however when I manualy made a route I was able to ping it
11:54 < krzie> you'll see you already had that route set ;]
11:55 < bmmcwhirt> just to be clear rmove both the route and push lines for 10.8.0.0 correct?
11:55 < krzie> well that depends
11:55 < krzie> 1sec
11:56 < krzie> you want clients to be able to communicate with eachother?
11:56 < bmmcwhirt> no
11:56 < krzie> yes, remove that line too
11:56 < bmmcwhirt> just to talk to private lan 
11:56 < bmmcwhirt> ok
11:57 < krzie> 10.2.2.0/24 is the lan behind the server?
11:57 < bmmcwhirt> correct
11:57 < krzie> let me better explain what the route directive does ;]
11:57 < krzie> you have route 10.2.2.0 255.255.255.0
11:57 < krzie> this tells your vpn server process to add a route to that subnet, which says that to reach that subnet it must communicate over the VPN
11:58 < krzie> thats why you DO push the route
11:58 < krzie> !push
11:58 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
11:58 < krzie> when the clients run the pushed route, its what you want
11:58 < krzie> when your server runs it, it is not
11:58 < bmmcwhirt> ok
11:58 < krzie> remove route 10.2.2.0 255.255.255.0  from your server
11:59 < krzie> now... ipp.txt...
11:59 < krzie> !ipp
11:59 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
11:59 < krzie> i almost always recommend to remove that line
11:59 < krzie> if you want static ips, give static ips
11:59 < bmmcwhirt> I think that line is just left over from the sample config anyway
12:02 < krzie> so ya... looks good
12:02 < bmmcwhirt> I havent reconnected to the vpn yet as when I do it will drop my irc connection. Now I had read that each machine on 10.2.2.o that I want to talk to also needs to know where to send packets for 10.8.0.0 right?   so I have on them 'route add 10.8.0.0/24 10.2.2.50'  with 10.2.2.50 being the vpn server, or is that not neceary?
12:02 < Essobi> krzie: sup
12:02 < krzie> you could choose to drop privs and stuff, but may as well wait until its working
12:03 < krzie> bmmcwhirt, wanna gimme a client config first then?
12:03 < krzie> just in case
12:03 < krzie> bmmcwhirt, that IS necessary, unless you can add the route to their default gateway
12:03 < krzie> !route_outside_ovpn
12:03 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
12:04 < bmmcwhirt> ok, I will add that later to the cisco, right now I just put it in the rc.conf of that one machine
12:04 < krzie> cool
12:04 < krzie> err you cant add routes exactly like that in rc.conf
12:04 < krzie> but ill assume you know how
12:06 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:06 < alhadi> hey krzie :)
12:06 < krzie> hey =]
12:06 -!- p3rror [~mezgani@41.140.177.92] has quit [Ping timeout: 246 seconds]
12:06 < alhadi> your conf helped me alot. now VPN no problem
12:06 < krzie> =]
12:06 < alhadi> got a good VPS for less price will install your script and bingo done :)
12:07 < alhadi> france VPS and netherland VPS
12:07 < krzie> glad it helped, i dont get much feedback from that script
12:07 < alhadi> ah ok
12:07 < alhadi> well you have one feedback from me :)
12:07 < alhadi> lucky to find that landing on the net..
12:08 < bmmcwhirt> ok here was the client conf you asked for before I restart the vpn    http://pastebin.ca/2040434
12:09 < krzie> alhadi, ya where DID you find that anyways?
12:09 < krzie> bmmcwhirt, simple enough... although you should prolly enable server cert verification
12:10 < bmmcwhirt> is there a ! for docs on that?
12:10 < alhadi> ubuntu forums
12:11 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:11 < krzie> whoa cool
12:11 < krzie> bmmcwhirt, kinda
12:11 < krzie> !servercert
12:11 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key, or (#2) this will help with !mitm
12:12 < krzie> !mitm
12:12 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially, or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates, or (#3) then use: ns-cert-type server in the client config
12:12 < krzie> odds are you already used easy-rsa build-key-server
12:12 < bmmcwhirt> yes
12:12 < krzie> which means all you need to do is add 
12:12 < krzie> ns-cert-type server
12:12 < krzie> to client config
12:12 < alhadi> ^^
12:12 < bmmcwhirt> simple enough
12:12 < alhadi> i did exactly the same
12:12 < alhadi> :P
12:12 < krzie> =]
12:13 < alhadi> thanks to the ppl here
12:13 < alhadi> especally krzee
12:13 < alhadi> and krzie
12:13 < krzie> alhadi, thats cool it was in the ubuntu forums, i didnt know anyone posted about it
12:13 < bmmcwhirt> ok, going to try this, I shall return.
12:13 < krzie> i am krzee too =]
12:13 < alhadi> hehe :D
12:14 < krzie> alhadi, you have that link handy?
12:14 < alhadi> actually i am too sure if it was ubuntu forums but i just found in a site dont actually remember. my random guess went to ubuntu forums
12:14 < alhadi> sec
12:15 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
12:15 -!- bmmcwhirt [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Read error: Connection reset by peer]
12:15 < krzie> one day hopefully hyper_ch will finish the html confgen
12:15 -!- iceberg is now known as bmmcwhirt
12:17 < alhadi> http://forums.openvpn.net/topic4683.html
12:17 <@vpnHelper> Title: OpenVPN Support Forum openvpn-confgen : Cert / Config management (at forums.openvpn.net)
12:17 < alhadi> sorry it was openvpn
12:17 < alhadi> not ubuntu
12:17 < alhadi> my random guess was totally wrong
12:17 < krzie> awww post was made by me
12:17 < alhadi> and i will post that in ubuntu with tutorial :)
12:17 < alhadi> your script
12:18 < krzie> ;]
12:18 < alhadi> i hope that this script will make ppl like me easy to make conf and generate keys as well
12:19 < alhadi> generating keys is easy now for me :P
12:19 < krzie> it will be nice when it actually makes the configs
12:19 < alhadi> just have to do source ./vars , ./vars then ./clean-all
12:19 < alhadi> yep
12:19 < bmmcwhirt> krzie:  works!    now I should be able to add in the redirect line and restart server and client and that should go smoothly?
12:19 < krzie> if ecrist doesnt rewrite ssl-admin soon i think im going to re-write easy-rsa to fit into my script
12:19 < krzie> bmmcwhirt, no
12:20 < alhadi> sounds like a plan :)
12:20 < bmmcwhirt> ok
12:20 < krzie> i really like ssl-admin, so i prefer to wait for that
12:20 < alhadi> sure
12:20 < krzie> bmmcwhirt, see this:
12:20 -!- p3rror [~mezgani@41.140.156.223] has joined #openvpn
12:20 < krzie> !redirect
12:20 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:20 < alhadi> i dont know much about ssl-admin
12:20 < krzie> !ssl-admin
12:20 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
12:21 < alhadi> oh freebsd
12:21 < alhadi> unix based
12:21 < krzie> (!redirect @ bmmcwhirt  and !ssladmin @ alhadi )
12:21 < ecrist> gah
12:21 < alhadi> thanks :)
12:21 < alhadi> shuld give freebsd a try now
12:21 < alhadi> lol
12:21 < ecrist> krzie: i will unfriend you if you do that. :P
12:22 < ecrist> krzie: do me a favor, put a ticket in on my trac and mention what options you want and give examples of how  you expect it to work.  I'll actually fix it in the next week or two
12:22 < bmmcwhirt> krzie:  forwarding is already enabled on the FBSD server, what is nat used for as FBSD by default doesnt use NAT for gateway. Only to do port to port redirection and that requires a kernel rebuild and is almost never done on FBSD
12:22 < krzie> oh cool
12:23 < krzie> bmmcwhirt, your vpn subnet is not inet routable
12:23 < alhadi> !def1
12:23 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
12:23 < krzie> you must NAT it
12:23 < alhadi> oh
12:23 < krzie> ecrist, awesome, will do
12:23 < alhadi> !nscert
12:24 < bmmcwhirt> ok, so Im not doing internet gateway today as a kernel rebuid is going to take 6hrs  :)
12:24 -!- seraphim [~euro@host-091-097-036-227.ewe-ip-backbone.de] has joined #openvpn
12:24 < bmmcwhirt> thats something to let run over the weekend
12:24 < alhadi> bmmcwhirt good luck
12:24 < krzie> 6 hours!?!?
12:24 < alhadi> shuld take less
12:24 < seraphim> hi
12:24 < krzie> you on a pentium 1?
12:24 < alhadi> 6 hours is too much
12:24 < bmmcwhirt> it's all on a ESXi VM so it's not fast
12:24 < alhadi> hello seraphim
12:25 < seraphim> got a problem using openvpn server on debian lenny + openvpn on win xp
12:25 < bmmcwhirt> this is a test bed so it's a 400Mhz VM with 256M ram
12:25 < krzie> seraphim, were you on efnet like 10 yrs ago? if so we have a friend in common
12:25 < seraphim> nope krzie
12:25 < krzie> ahh ok
12:26 < bmmcwhirt> krzie:  I very much appreciate your help, here is a virtual pitcher of high quality high gravity beer
12:27 < krzie> bmmcwhirt, thanx, anything besides virtual would interfere with the antibiotics
12:28 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
12:28 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
12:28 < alhadi> lol
12:28 < bmmcwhirt> doh, antibiotics suck, at least for me they make all my fod taste metalic
12:29 < krzie> seraphim, 
12:29 < krzie> !goal
12:29 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
12:30 < seraphim> http://pastebin.com/1AYn1T7e <-- this is the log from the client with verbose 5
12:30 < seraphim> <ip> and <servername> are replaced by me
12:30 < seraphim> I can´t connect to the vpn server
12:32 < seraphim> i created every cert and keyfile following the instructions at http://openvpn.net/index.php/open-source/documentation/howto.html#pki
12:32 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:35 < seraphim> can anyone help me with that?
12:37 < bmmcwhirt> one other thing, when I first started my openVPN voyage I was looking for a book that I could use to get started, however they all seemed like they were form 5 years ago or more which is pretty out of date for software. Id there anything current in publish that anyone would recommend, especially if it's available as an ebook so I don't have to carry a big book or have internet access to read it.
12:37 < krzie> seraphim, 
12:38 < krzie> !certverify
12:38 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
12:38 < krzie> bmmcwhirt, there is one coming soon
12:39 < bmmcwhirt> krzie: excellent, do you know the title/author so I can put a notice on it on amazon?
12:39 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received*IP* (si=3 op=P <http://forums.openvpn.net/topic7488.html#p9008> || Restricted client-client traffic <http://forums.openvpn.net/topic7472.html#p9007> || OpenVPN to filter DHCP requests in bridge mode <http://forums.openvpn.net/topic7479.html#p9006>
12:39 < krzie> the openvpn cookbook by jan just kuster
12:39 < krzie> last name mis-spelt
12:39 < bmmcwhirt> thank you
12:39 < krzie> Jan Just Keijser 
12:40 < krzie> one of the best openvpn experts
12:40 < krzie> very highly respected in the community
12:40 < bmmcwhirt> excellent, packet has it up in raw format where I can just buy it now and get the new chapters as they come out!  So great I love that option.
12:41 < seraphim> hmm got it, forgott to rehash the config with the new ca.crt
12:41 < seraphim> but
12:41 < seraphim> i´m connected but nothing more, i don´t get an IP
12:41 < krzie> new log to post then...
12:41 < krzie> in fact...
12:41 < krzie> !configs
12:41 < seraphim> k wait...
12:41 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
12:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:46 < seraphim> http://pastebin.com/Zkz3uGCp
12:48 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
12:51 < seraphim> any idea?
12:52 < alhadi> seraphim
12:52 < alhadi> comment this 74.remote-cert-tls server
12:52 < alhadi> and try?
12:53 < alhadi> 37.;push "redirect-gateway" need uncomment
12:56 < seraphim> hmm
12:57 < krzie> brb, talking to my mom re: my pneumonia
12:57 < alhadi> ok
12:57 < seraphim> http://pastebin.com/GgwjKq1S
12:57 < seraphim> new log
12:57 < seraphim> but still not working
12:57 < seraphim> afk for a few minutes
12:57 < seraphim> brb
12:58 < krzie> Fri Jan 07 19:44:08 2011 us=578000 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
12:58 < krzie> ???
12:58 < krzie> howd you make your certs?
12:59 < seraphim> re
12:59 < seraphim> easy-rsa
13:00 < krzie> ok, weird, i never seen that message
13:00 < seraphim> following http://openvpn.net/index.php/open-source/documentation/howto.html#pki
13:00 <@vpnHelper> Title: HOWTO (at openvpn.net)
13:00 < krzie> you make your CA with that too?
13:00 < seraphim> yeah
13:00 < seraphim> using the howto
13:04 -!- s7r [~s7r@89.238.173.233] has quit [Ping timeout: 265 seconds]
13:04 -!- Malard|Home is now known as Malard
13:08 < seraphim> brb in a few minutes
13:09 -!- WinstonSmith [~true@e179004000.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
13:11 < alhadi> seraphim http://forums.openvpn.net/topic4683.html try this. after creating certs/key , i did this and it allowed me atleast to have a working openvpn server :)
13:11 <@vpnHelper> Title: OpenVPN Support Forum openvpn-confgen : Cert / Config management (at forums.openvpn.net)
13:11 < hyper_ch> hi vpnHelper
13:12 -!- mihpares [~euro@host-091-097-036-227.ewe-ip-backbone.de] has joined #openvpn
13:12 < mihpares> re
13:12 < mihpares> <--seraphim
13:12 -!- seraphim [~euro@host-091-097-036-227.ewe-ip-backbone.de] has quit [Ping timeout: 276 seconds]
13:13 < krzie> mihpares, your end goal is JUST a client - server connection?
13:13 < krzie> if so
13:13 < krzie> !sample
13:13 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
13:15 < mihpares> it is
13:15 < mihpares> may a second or third client in the future
13:15 < krzie> then go ahead and use my sample configs (of course changing file names/paths)
13:15 < krzie> thats good for multiple clients
13:16 < mihpares> your sample configs? you mean the one mentioned by vpnHelper?
13:16 < krzie> youd need more for redirecting inet traffic over the vpn, or sharing the LAN over the vpn
13:16 < krzie> !sample
13:16 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
13:16 < krzie> those ^
13:16 < mihpares> ^^ ok
13:16 < mihpares> i´ll try them
13:17 < alhadi> wow
13:17 < alhadi> nice
13:19 -!- Guest2911 [~mathias@p5B096973.dip.t-dialin.net] has joined #openvpn
13:20 <@vpnHelper> RSS Update - forum: Two clients got the same IP <http://forums.openvpn.net/topic7486.html#p9009>
13:20 < mihpares> hmm i´ve got no ta.key file oO
13:20 < krzie> !hmac
13:20 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
13:21 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
13:21 < krzie> #2
13:21 < Guest2911> hi, I have an openvpn server in multi-client mode and a machine that connects to it. This machine is the default gateway of another network. I would like to be able to reach this "client subnet" from the VPN network. Is there anything in openvpn that might cause problems? I have the setup almost working but the VPN Server cannot ping into the client subnet. So can it be openvpn that is preventing this kind of access?
13:21 < mihpares> ok
13:21 < krzie> !clientlan
13:21 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
13:21 <@vpnHelper> better explanation
13:22 < krzie> you said its the router for the lan, so you can skip !route_outside_openvpn
13:22 < Guest2911> krzie: yes
13:22 < mihpares> hmm
13:23 < mihpares> Starting virtual private network daemon: server failed!
13:23 < krzie> start it via commandline
13:23 < krzie> not via your OS scripts
13:23 < krzie> openvpn /path/to/config
13:24 < mihpares> hmm wait i think i´ve got it...
13:25 <@vpnHelper> RSS Update - forum: [solved] Two clients got the same IP <http://forums.openvpn.net/topic7486.html#p9009>
13:25 < mihpares> Fri Jan  7 20:28:20 2011 us=327010 failed to find GID for group vpn
13:25 < mihpares> Fri Jan  7 20:28:20 2011 us=327042 Exiting
13:26 < mihpares> now it´s this error message
13:26 < mihpares> first try i got one path wrong
13:26 < mihpares> now this
13:26 < hyper_ch> krzie: you have a furball, right?
13:27 < krzie> nope, only 1 pussy at my house, and i have to take it out to parties and stuff ;]
13:27  * gladiatr chuckles
13:27 < morbidwar> hello, could someone explain me how or what do i need to do to activate the "push route"? do i need to set up a route in the router if the vpnd is not running on the routers hardware?
13:27 < krzie> mihpares, go ahead and remove the user / group lines from the config
13:28 < hyper_ch> krzie: four-legged pussies are much easier and cheaper to maintain :)
13:28 < gladiatr> morbidwar, yes.  
13:28 < gladiatr> hyper_ch, it depends on whether or not they still have their claws.
13:28 < mihpares> Fri Jan  7 20:31:11 2011 us=824456 IFCONFIG POOL: base=10.8.1.4 size=62
13:28 < mihpares> Fri Jan  7 20:31:11 2011 us=824488 Initialization Sequence Completed
13:28 < morbidwar> gladiatr: thanks
13:28 < mihpares> now it´s stuck :P
13:28 < gladiatr> np
13:29 < hyper_ch> gladiatr: they have their claws... but they would never ever use them on me... except in rar
13:29 < mihpares> Fri Jan  7 20:31:37 2011 us=484111 SIGINT[hard,] received, process exiting
13:29 < mihpares> ^^
13:29 < hyper_ch> rare cases when they suddenly get excited
13:29 < hyper_ch> or scared
13:29 < hyper_ch> like a couple of days ago due to fireworks
13:29 < mihpares> k daemon is up now
13:29 < mihpares> now the client...
13:30 < mihpares> do i need the ta.key at my local client, too?
13:30 < mihpares> it´s win xp
13:30 < mihpares> not linux
13:30 < gladiatr> hyper_ch, oh, I was thinking of the furniture and such (regarding expense of their keeping)
13:31 < hyper_ch> furniture is there to be used and not to look pretty
13:31 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received*IP* (si=3 op=P <http://forums.openvpn.net/topic7488.html#p9010>
13:31 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
13:31 < gladiatr> mihpares, yes.  ta.key needs to be on all of you client machines.
13:31 < mihpares> k
13:32 < gladiatr> hyper_ch, Yeah, but I have (had?) a pretty comfy chair that, over the last several years, has come to look more like a pile of hay
13:32 < gladiatr> s/you/your
13:32 < hyper_ch> gladiatr: time to get a new one :)
13:33 < mihpares> k connection successfull but still no IP address assigned to the adapter...
13:33 < gladiatr> hyper_ch, hehehe
13:34 < mihpares> http://pastebin.com/yzPeBxmU
13:34 < mihpares> client log
13:35 < gladiatr> mihpares, patience, grasshopper.  What your client log shows there is that your client isn't done connecting
13:35 < mihpares> I´m waiting for about 3 minutes...
13:35 < gladiatr> oh...
13:36 < gladiatr> and line 315 is as far as it got?
13:36 < mihpares> yep
13:37 < mihpares> brb, supper time
13:39 < Guest2911> hi, using iroute openvpn says "option 'iroute' cannot be used in this context" - why?
13:40 < gladiatr> Guest2911, it can only be used in a per-client configuration context
13:41 -!- bmmcwhirt [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Quit: bmmcwhirt]
13:41 < gladiatr> because if you want to use iroute and you have the same logical network existing on the other side of more than one client, you've got other problems.
13:41 < gladiatr> (of the network architecture variety)
13:42 < gladiatr> !iroute
13:42 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
13:43  * gladiatr pats vpnHelper 
13:44 < hyper_ch> vpnHelper is a really smart person
13:45 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 250 seconds]
13:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:48 -!- Guest2911 [~mathias@p5B096973.dip.t-dialin.net] has quit [Quit: leaving]
13:51 < mihpares> re
13:52 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
13:52 < mihpares> still no IP address assigned to the adapter
13:55 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 255 seconds]
13:57 < morbidwar> gladiatr: could you give me a hint where to look on push route? i've setup a route on the router (the vpnd is not running on the routers hardware), i enabled the ip_forward on the vpn machine, do i need to use masquerade on the vpn to be able to reach the lan's ip?
13:57 <@vpnHelper> RSS Update - forum: LAN to LAN issues <http://forums.openvpn.net/topic7446.html#p9011>
13:58 < mihpares> btw krzie sorry for that may profane question, but is there a way connecting to the openvpn server via cisco vpn client?
14:00 -!- mathias__ [~mathias@p5B096973.dip.t-dialin.net] has joined #openvpn
14:01 < mihpares> hmm
14:01 < mihpares> found something at the log
14:01 < mihpares> http://pastebin.com/JWy9ur7i
14:03 <@vpnHelper> RSS Update - forum: how to create certificates for "--remote-cert-tls" <http://forums.openvpn.net/topic7484.html#p9012>
14:04 < krzie> mihpares, 
14:04 < krzie> !notcompat
14:04 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
14:04 < mathias__> hi, when a client connects I would like to automatically establish a route in the server's routing table to a subnet behind that client - in the ccd file, I created an entry "route 10.0.0.0 255.255.255.0 remote_host" but openvpn said "option 'route' cannot be used in this context" - is there another way?
14:05 < mihpares> ok
14:05 < mihpares> and the tls timeoutß
14:05 < mihpares> ?
14:07 < krzie> im not sure, havnt been paying attention, dealing with my pneumonia right now
14:07 < mihpares> [21:01:11] <mihpares> http://pastebin.com/JWy9ur7i
14:07 < mihpares> ou
14:07 < mihpares> not good
14:07 < mihpares> get well soon ^^
14:07 < krzie> if not other errors, then its firewall or wrong port/ip/proto
14:08 < krzie> likely other errors above tho
14:08 < mihpares> hmm lets kill the fw...
14:09 < mihpares> nope fw was off, the same error...
14:09 < mihpares> are any port forwards needed on client side?
14:09 < mihpares> may i forgott one
14:09 < mihpares> ...
14:15 < mathias__> hi, when a client connects I would like to automatically establish a route in the server's routing table to a subnet behind that client - in the ccd file, I created an entry "route 10.0.0.0 255.255.255.0 remote_host" but openvpn said "option 'route' cannot be used in this context" - is there another way?
14:16 -!- alhadi [~thunderst@178.33.209.33] has quit [Ping timeout: 240 seconds]
14:23 < reiffert> mathias__: hi. see here:
14:23 < reiffert> !route
14:23 < reiffert> !man
14:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
14:23 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
14:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 265 seconds]
14:24 -!- alhadi [~thunderst@92.99.235.168] has joined #openvpn
14:28 -!- mathias__ [~mathias@p5B096973.dip.t-dialin.net] has quit [Quit: leaving]
14:33 -!- p3rror [~mezgani@41.140.156.223] has quit [Read error: Connection reset by peer]
14:35 < gladiatr> morbidwar, if your openvpn server is not the remote network's internet gateway, you need to add a static route on the internet gateway stating something along the lines of: route add -net vpn_client_network/mask gw internal_IP_of_vpn_server
14:35 -!- elenril [~wiskas@2002:c155:9a2e:1:d43e:64ff:fe5d:2429] has left #openvpn []
14:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:36 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
14:37 < morbidwar> gladiatr: and it's possible to route thru the vpn a public ip?
14:37 < gladiatr> morbidwar, to do that you would need to also add a nat rule on your internet gateway for your vpn client subnet
14:38 < gladiatr> morbidwar, but yes--at that point, you could route your vpn client traffic through your server-side internet gateway
14:41 < gladiatr> morbidwar, or, more specifically, you would route your traffic through the openvpn server which would, in turn, route your connection through the internet gateway
14:44 < morbidwar> i think i'm missing something
14:46 < morbidwar> i;m not able to forward the trafic from the vpn client to the lan
14:46 < gladiatr> is there a route to your LAN subnet on your client?
14:46 < alhadi> hello
14:46 -!- Visual` [~visualsta@unaffiliated/visualstation] has quit [Quit: leaving]
14:47 < alhadi> http://www.pastie.org/private/gybjkzj9omw5wkabnng48a
14:47 < alhadi> what could be the problem?
14:47 -!- p3rror [~mezgani@41.140.174.108] has joined #openvpn
14:47 -!- dollabill [~mike@199.44.8.98] has quit []
14:47 -!- Visual` [~visualsta@unaffiliated/visualstation] has joined #openvpn
14:48 < gladiatr> alhadi, it looks like you're trying to start openvpn as an unprivileged user.
14:53 < morbidwar> gladiatr: http://pastebin.com/nejzef6c
14:55 < reiffert> morbidwar: openvpn uses an interface. so whatever can be done to interfaces on your operating system, can also be done to openvpn. In particular routing is as easy as it is when you do it without openpvn.
14:55 < gladiatr> wow.  those routing tables kinda make my eyes hurt
14:56 < reiffert> morbidwar: instead of routing you can have masquerading and such thing, whatever your operating system offers you.
14:57 < morbidwar> reiffert: i will try to masquerade
14:57 < gladiatr> Yeah.  You may as well nat the vpn client network from the openvpn server
14:57 < reiffert> Masquerading comes with disadvantages, e.g. you have to port forward things in order to access services.
14:59 < krzie> and disadvantages
15:00 < reiffert> ?
15:00 < krzie> e.g. no accountability
15:00 < krzie> better to correctly setup routing
15:01 < krzie> morbidwar, read this
15:01 < krzie> !route
15:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
15:02 < krzie> yes, the nat-hack has its use, but it surely should not be the first choice
15:02 < gladiatr> Yeah, but it's late and it's Friday and everyone should know not to buy a russian car that was made on Friday or a bottle of vodka that was made on a Monday :D
15:03 < krzie> or a car made from russia, or a bottle of vodka made in usa
15:03 < krzie> or for that matter, beer from usa
15:03 < reiffert> :)
15:03 < reiffert> (and not from France)
15:03 < gladiatr> hahaha
15:04 < krzie> grey goose is arguably the best vodka out here
15:04 < krzie> (note, i did say "out here")
15:04 < hyper_ch> Stolichnaya
15:04 < krzie> ya i prefer stoli
15:05 < hyper_ch> there is "beer from usa"?
15:05 < krzie> and lucky for me its "the cheap vodka" out here
15:05 < krzie> well, there is piss-water they call beer
15:05 < hyper_ch> §:)
15:05 < krzie> i thought it was beer before i started traveling
15:06 < hyper_ch> now you were spoiled
15:06 < gladiatr> reminds me of a joke an ex-gf (Scottish lass) told me: what is the similarity between american beer and having sex in a canoe?
15:07 < krzie> lol, whats that
15:07 < gladiatr> it's like f'ing close to water
15:07 < hyper_ch> lol
15:08 < gladiatr> I admire my associates that can still tolerate PBR and the Beast... such inexpensive habits.
15:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
15:17 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Ping timeout: 276 seconds]
15:20 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Quit: Leaving]
15:21 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
15:23 <@vpnHelper> RSS Update - forum: Random problem with roadwarriors on windows machines <http://forums.openvpn.net/topic7489.html>
15:24 < morbidwar> krzie: thanks but i already do that
15:24 -!- mihpares [~euro@host-091-097-036-227.ewe-ip-backbone.de] has left #openvpn []
15:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:34 < alhadi> Sat Jan 08 01:33:00 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
15:34 < alhadi> what does this mean?
15:48 <@vpnHelper> RSS Update - forum: Random problem with roadwarriors on windows machines <http://forums.openvpn.net/topic7489.html#p9014>
16:01 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
16:01 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
16:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:07 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Remote host closed the connection]
16:18 <@vpnHelper> RSS Update - forum: Incorrect Login <http://forums.openvpn.net/topic7490.html>
16:33 < alhadi> hello
16:33 < alhadi> i am connected to the openvpn but there is no internet
16:33 < alhadi> !paste
16:33 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
16:35 < Bushmills> !redirect
16:35 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
16:36 < alhadi> !ipforward
16:36 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:36 < alhadi> !linipforard
16:36 < alhadi> !linipforward
16:36 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:37 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
16:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:38 < alhadi> !nat
16:38 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
16:40 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
16:40 -!- Cain` is now known as Cain
16:50 < alhadi> !linnat
16:50 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
17:00 < alhadi> anyone here can help me?
17:00 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has joined #openvpn
17:01 < Bushmills> http://scarydevilmonastery.net/masq
17:06 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:08 < alhadi> hmm
17:08 < alhadi> shall i paste my openvpn.conf and client conf?
17:10 < Bushmills> no. say what your problem is. if it is related to "internet over vpn", vpn config won't help a lot - that's config of operating system on server 
17:11 < alhadi> yes internet over vpn
17:12 < Bushmills> anything else, or just that?
17:14 < krzie> alhadi, if you wanted that, why didnt you say so when running my config?
17:14 < krzie> err
17:14 < krzie> config-generator
17:15 < alhadi> actually these conf were setup according to my VPS provider
17:15 < alhadi> its another openvpn server
17:15 < alhadi> i got 2 openvpn server
17:15 < alhadi> 1 working fine. other not
17:15 < krzie> erm
17:15 < krzie> you run the server or not?
17:15 < alhadi> not me
17:15 < Bushmills> you can't set up nat on a server which you don't control
17:15 < krzie> ya, this isnt yours to config
17:16 < krzie> run their config, if it doesnt work you need to talk to them
17:16 < alhadi> i am talking
17:16 < alhadi> taking too much time spending
17:16 < krzie> well you're wasting your time here with that
17:16 < Bushmills> try   redirect-gateway   in client config
17:17 < krzie> we cant really help you if you dont control the server
17:17 < krzie> ya you could try that ^
17:18 < alhadi> no luck
17:21 < krzie> you need support from whoever runs the server
17:21 < krzie> unless you have an error in your logs you can post...
17:24 -!- s7r [~s7r@89.238.173.233] has joined #openvpn
17:26 < alhadi> http://www.pastie.org/private/atnpnrnrjrvetmobwlisxw
17:27 -!- shiz0 [~shiz0@HSI-KBW-109-192-060-032.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
17:27 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p9016>
17:28 < shiz0> !route
17:28 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
17:28 < shiz0> !clientlan
17:29 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
17:29 <@vpnHelper> better explanation
17:29 < alhadi> http://www.pastie.org/private/4k6ow4bjffze6vmijqkhg
17:29 < Bushmills> alhadi: is that the client log when connecting to your provider vpn server?
17:29 < alhadi> my openvpn.conf
17:29 < shiz0>  !serverlan
17:29 < alhadi> its the server log
17:30 < alhadi> status that my client is connecting from
17:30 < Bushmills> your server is the config which works?
17:30 < alhadi> http://www.pastie.org/private/nzofasjwlfggtntsc4nl5a
17:30 < alhadi> client config ^^
17:31 < alhadi> the VPS provider had a configed openvpn for its VPS users
17:31 < alhadi> i am using them
17:31 < shiz0> !serverlan
17:31 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
17:32 < krzie> alhadi, i thought you said you didnt run the server
17:32 < Bushmills> yeah, that's a bit confusing
17:32 < alhadi> i dont run the server but these status logs are comming from the FTP
17:32 < alhadi> sorry
17:32 < krzie> you just pastebin'ed a fucked up server conf
17:33 < alhadi> thats stored in my VPS. accessed them from a SSH
17:33 < krzie> but if its not yours, a) howd you get it and b) why would i care to tell you the problems with it
17:33 < alhadi> i copyied pasted
17:33 < alhadi> becuz i paid them VPS.
17:33 < krzie> lol
17:33 < krzie> so you DO run the server
17:33 < krzie> you just didnt configure it
17:33 < alhadi> yes i have axx for the server
17:34 < alhadi> yes the VPS configure for me
17:34 < alhadi> not me
17:34 < krzie> if you were to make changes, would they be accepted?
17:34 < alhadi> if i make changes then there is error on both sides
17:34 < krzie> lol
17:34 < alhadi> they first of all dont allow iptables and NAT
17:34 < alhadi> :(
17:35 < alhadi> root@irc:~# ping -I tun16 yahoo.com
17:35 < alhadi> PING yahoo.com (69.147.125.65) from 188.95.51.233 tun16: 56(84) bytes of data
17:36 < alhadi> cannot even ping yahoo from tun16 interface
17:36 < shiz0> !howto
17:36 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
17:36 < krzie> alhadi, you need support from them, as i said awhile ago
17:36 < alhadi> ok
18:02 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p9017>
18:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
18:33 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
18:42 -!- s7r [~s7r@89.238.173.233] has left #openvpn []
19:12 -!- shiz0_ [~shiz0@HSI-KBW-109-192-060-032.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
19:12 -!- shiz0 [~shiz0@HSI-KBW-109-192-060-032.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
19:18 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Read error: Operation timed out]
19:18 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
19:38 <@vpnHelper> RSS Update - forum: Random problem with roadwarriors on windows machines <http://forums.openvpn.net/topic7489.html#p9018>
20:09 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
20:27 -!- patelx [patel@openvpn/corp/admin/patel] has quit [Ping timeout: 250 seconds]
20:31 -!- patelx [patel@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
20:49 -!- alhadi [~thunderst@92.99.235.168] has quit [Quit: alhadi]
20:51 -!- patelx [patel@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has quit [Changing host]
20:51 -!- patelx [patel@openvpn/corp/admin/patel] has joined #openvpn
21:30 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has quit [Ping timeout: 240 seconds]
22:15 -!- huli [~ericlee@220.181.143.94] has joined #openvpn
22:31 -!- tessier [~treed@kernel-panic/copilotco] has joined #openvpn
23:07 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 250 seconds]
--- Day changed Sat Jan 08 2011
00:21 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
00:21 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
00:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
00:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
01:03 <@vpnHelper> RSS Update - forum: Your Web Design, Website Development, Domain, Web Hosting <http://forums.openvpn.net/topic7491.html>
01:15 <@vpnHelper> RSS Update - forum: TLS Blocked by provider, need to modify source code... <http://forums.openvpn.net/topic7439.html#p8844>
01:21 <@vpnHelper> RSS Update - forum: TLS Blocked by provider, need to modify source code... <http://forums.openvpn.net/topic7439.html#p9021> || TLS Error: TLS key negotiation failed <http://forums.openvpn.net/topic7395.html#p9020>
01:27 <@vpnHelper> RSS Update - forum: submitting bug reports <http://forums.openvpn.net/topic7436.html#p9024> || logout - dead link <http://forums.openvpn.net/topic7437.html#p9023> || Incorrect Login <http://forums.openvpn.net/topic7490.html#p9022>
01:31 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
01:33 -!- Bebop2Steady [~Bebop2Ste@124-168-169-88.dyn.iinet.net.au] has joined #openvpn
01:33 < krzie> !static
01:33 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
01:34 < Bebop2Steady> krzee i got a prob with fully concieving iroute + ccd + route   are you around for help at the mo'?
01:34 < krzie> did you read my routing doc?
01:35 < Bebop2Steady> yes.. I am reading it now..
01:35 < Bebop2Steady> ( and have read it a few times )
01:35 < krzie> so whats the problem
01:35 < Bebop2Steady> ITS RE: https://forums.openvpn.net/topic7483.html
01:35 <@vpnHelper> Title: OpenVPN Support Forum Double VPN || 2 Hop VPN || VPN-over-VPN : Server Administration (at forums.openvpn.net)
01:35 < krzie> ohhh
01:35 < krzie> heh
01:35 < krzie> vpnchains
01:36 < Bebop2Steady> yepz : ]
01:36 < Bebop2Steady> i can ping from mid chain to end.. but not from start cain to end
01:36 < krzie> your drawing is more accurate now
01:36 < krzie> looks like you do have a decent idea of where your problem is tho
01:36 < krzie> (based on your question)
01:37 < krzie> i bet you have MULTI errors in your logs
01:37 < Bebop2Steady> I've been trial'n'erroing.. not dug thru the logs yet. guess should have.
01:38 < krzie> lol
01:38 < krzie> umm yes
01:38 < Bebop2Steady> can i refer to the last pic i put.. n ask a question about iroute ?
01:38 < krzie> should have a term for each involved scrolling logs
01:38 < krzie> tail -F
01:38 < Bebop2Steady> ahh, so real time monmieoring of logs ?
01:38 < krzie> if your question is in regards to understanding what iroute is, yes
01:39 < krzie> real time is easier than anything else, isnt it?
01:39 < Bebop2Steady> defo
01:39 < krzie> when i figured this out i had that AND a tcpdump for each machine
01:40 < Bebop2Steady> and a 2nd computer screen to watch all the windows would be great
01:40 < krzie> apple is nice like that ;)
01:40 < krzie> pop back into expose and watch things flow
01:41 < Bebop2Steady> client-config-dir /etc/openvpn/ccd/server2
01:41 < Bebop2Steady> route 10.11.0.0 255.255.255.0
01:42 < krzie> see now we're getting more specific :-p
01:42 < Bebop2Steady> and then in the file ccd/server2   i have 
01:42 < Bebop2Steady> 10.11.0.0 255.255.255.0
01:42 < Bebop2Steady> oops   route  10.11.0.0 255.255.255.0
01:43 < krzie> i wont be offering that level of support on vpnchains
01:43 < Bebop2Steady> ahh ok i'll go back to a generalization 
01:44 < Bebop2Steady> is the ccd file with the iroute command in it, supposed to be on the server or client (i have it on server) ?
01:44 < krzie> what is a ccd entry?
01:44 < krzie> !ccd
01:44 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
01:45 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
01:45 < Bebop2Steady> ok, its what I thought.. got confused on anotehr sitde off google.. 
01:45 < krzie> that EXACT line you just read is from my routing page
01:45 < krzie> go read it more
01:46 < krzie> you cant read ity like you're trying to solve a problem
01:47 < krzie> read it to understand
01:47 < krzie> i wrote that doc after getting my first vpnchains setup running
01:49 < Bebop2Steady> ok i will read it again and again if need be.  another questio?  for my setup in the last pic.. how many instances of openvpn would require the ccd/iroute?  from my understanding, only 1st server on the 2nd physical machine....
01:50 < krzie> how many servers will have clients with foreign subnets behind it?
01:50 < krzie> start trying to dig the concepts out of my doc, not the details for your setup
01:50 < Bebop2Steady> just the 1..
01:51 < krzie> is your irc handle a ninja turtle reference?
01:51 < Bebop2Steady> yeah sorta :]
01:53 < Bebop2Steady> 80s style.. 
01:54 < Bebop2Steady> I better start by setting up the real time log monitoring. and then re-look at the guide you so kindly posted.
01:55 < Bebop2Steady> thank once again for helpin' me with some mprobs
01:55 < krzie> and if at any time you dont know where packets stop, tcpdump on tun devices
01:55 < krzie> you're welcome
01:56 < Bebop2Steady> thank you.. 
01:56 -!- Bebop2Steady [~Bebop2Ste@124-168-169-88.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
01:56 < krzie> hes not close, but i gave him some pretty good hints
02:01 <@vpnHelper> RSS Update - forum: Firewall blocked https traffic <http://forums.openvpn.net/topic7466.html#p9026> || [n00b] No traffic on tun0 over LAN <http://forums.openvpn.net/topic7451.html#p9025>
02:24 < reiffert>  moin
02:28 -!- WinstonSmith [~true@e179006086.adsl.alicedsl.de] has joined #openvpn
02:31 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
02:31 < djgerm> hi all
02:32 < djgerm> i am curious, i remember reading a few years back about using tcp being an issue with openvpn
02:32 < djgerm> something about retransmissions
02:33 < djgerm> is this still a problem?
02:33 < krzie> !tcp
02:33 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
02:33 < krzie> its not openvpn
02:33 < krzie> its the nature of tcp and what happens when you do tcp over tcp
02:37 < reiffert> djgerm: "something about retransmission" is a too vague description in order to answer your question.
02:37 < djgerm> the helper bots links answer them just fine. I might have more questions once I complete this reading.
02:38 < djgerm> (why don't these links come up under googling openvpn tcp in tcp?! hehe )
02:38 < reiffert> djgerm: I have a different opinion, but hey, the user is always right :)
02:39 < djgerm> different opinion from the idea that tcp in tcp is bad? do tell!
02:39 < djgerm> i want to believe!
02:40 < djgerm> well perhaps my question should be reasked as "What are the pros and cons of configuring openvpn for tcp? What are the Pros and cons of udp?"
02:41 < krzie> djgerm, the link is in the openvpn manual under --proto tcp
02:42 < krzie> reiffert, you have a different opinion than http://sites.inka.de/~bigred/devel/tcp-tcp.html  ?
02:42 <@vpnHelper> Title: Why TCP Over TCP Is A Bad Idea (at sites.inka.de)
02:43 < djgerm> well it is a 10 year old link… some things change. granted not many changes to TCP over the years =)
02:48 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:48 -!- mode/#openvpn [+o mattock] by ChanServ
02:51 < reiffert> krzie: I have a different opinion on "an issue", "some years back", "with openvpn" and "something about retransmissions"
02:52 < reiffert> I more like djgermn 2nd question :)
02:52 -!- WinstonSmith [~true@e179006086.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
02:53 < djgerm> so good. the consensus is still tcp in tcp should most likely be avoided in all but a handful of cases.
02:54 < djgerm> with openvpn at least =)
02:54 < krzie> ahh gotchya
03:14 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
03:42 -!- mathiassss__ [~mathias@p5B09511F.dip.t-dialin.net] has joined #openvpn
03:42 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:44 < mathiassss__> hi, I had a lot of trouble during the last days with openvpn and routing to a client-side network. Finally, I found that I needed the iroute option in addition to a routing table entry. Why is this iroute necessary? I dont see why a simple routing table entry should not be enough!? 
03:44 < reiffert> mathiassss__: see here (once again)
03:44 < reiffert> !route
03:44 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
03:44 < reiffert> !man
03:44 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
03:46 < mathiassss__> reiffert: "It tells openvpn which client owns which network." I know this already. My question as: Is there a reason why openvpn does not simple get this information from the routing table but maintains its own routing information?
03:48 < reiffert> you seem to ignore my proposal. live with it then.
03:50 -!- master_of_master [~master_of@p57B54F79.dip.t-dialin.net] has quit [Ping timeout: 265 seconds]
03:50 -!- s7r [~s7r@95.154.230.251] has joined #openvpn
03:51 < mathiassss__> reiffert: okay I will read it again ...
03:51 -!- master_of_master [~master_of@p57B55D9F.dip.t-dialin.net] has joined #openvpn
03:51 < reiffert> be sure to jut pick those parts you already know.
03:52 < mathiassss__> haha
03:54 < mathiassss__> "skips the push for the client" is this the part you mean? I just didnt read attentively enough
03:54 < reiffert> "are we in school?"
03:54 < reiffert> No
03:55 -!- mathiassss__ [~mathias@p5B09511F.dip.t-dialin.net] has quit [Quit: leaving]
04:01 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
04:01 < stony> h
04:01 < stony> i
04:01 < stony> i'm looking for an solution to encrypt layer2 traffic that is passing an fibre connected link
04:01 < stony> but i don't want to setup ip addresses outside the "tunnel" to pass the encrypted packages
04:02 < reiffert> openvpn can do that.
04:02 < stony> so that i'm only encrypt the original packages that should pass the fibre link - that's it
04:02 < stony> reiffert: yeah l2-vpn is not the problem for openvpn
04:02 < reiffert> great, glad to help you.
04:02 < stony> reiffert: but using it without ip on the outside to forward the encrypted packets - this is where i'm stuck
04:03 < reiffert> got the vpn interface attached to your bridge?
04:03 < stony> reiffert: you get me wrong
04:03 < stony> reiffert: the l2 vpn setup is working (did that 200 times or so)
04:03 < stony> reiffert: i want to use openvpn encrypting a real layer2 link without using ip addresses on this link *OUTSIDE* the tunnel
04:04 < stony> reiffert: the connection between the openvpn instances should be without ip
04:04 < reiffert> great. so let's think about how packets will travel through your kernel and what makes them appear on one or another interface.
04:05 < stony> reiffert: you still get me wrong - no offence - but i'll explain it a bit more in detail:
04:06 < reiffert> No harm on my side, I'm answering to your pieces..
04:06 < stony> network <-> 1 gbit/s ethernet connection (part of bridge) <- bsd system with bridge -> 1 gbit/s fibre connection (part of bridge) <- fibre  -> 1gig fibre (part of bridge) <- bsd system with bridge -> gbits copper connection <-> network
04:07 < stony> reiffert: now i want to encrypt the fibre part without using ip addresses on the path itself
04:07 < stony> reiffert: more like "encrypt everything that passes fibre device independend of protocol, size, whatever ...
04:09 < reiffert> I wonder what keeps you from doing so.
04:09 < stony> what i could do is: copper <-> bsd bridge <-> tap <-> openvpn <-> ip on fibre connection <-> fibre <-> ip  of other endpoint <-> ip on fibre <-> fibre nic <-> openvpn <-> tap <-> bsd bridge <-> ethernet nic
04:09 < stony> but this will produce a lot ip overhead i don't want
04:10 < stony> the communication between the openvpn daemons should be on l2 instead on l3
04:10 < reiffert> the tap devices dont carry an ip address, right?
04:10 < stony> reiffert: the tap device is *inside* the tunnel
04:10 < stony> reiffert: i'm talking about the *outside*
04:11 < stony> the communication between the openvpn daemons is the outside, the traffic they carry via the tap devices is the inside
04:11 < reiffert> ok, lets make an example.
04:11 < stony> i want to use: remote ma:ca:dd:re:ss:00
04:11 < stony> insteead of remote 1.2.3.4
04:11 < reiffert>  network <-> BSD <fibre> BSD <-> network right?
04:11 < stony> reiffert: yes
04:12 < reiffert> let's think about this setup without openvpn and see about layer 3 here.
04:12 < reiffert> both BSD boxes share one subnet?
04:12 < stony> reiffert: you still don't get it 
04:13 < reiffert> let's *THINK* just to have a closer look. to make an example. then come closer to your solution.
04:13 < stony> reiffert: network <-> bsd <-> fibre without any ip here, communication only via layer 2 (mac addresses) to provide ip overhead <-> bsd box <-> network
04:13 < stony> s/provide/avoid/
04:13 < reiffert> ok, question at this point:
04:14 < reiffert> on the left BSD box, what makes an incoming packet travel to the right BSD box, please explain.
04:15 < stony> packet -> eth nic -> left box -> tap device -> openvpn daemon -> fibre nic -> fibre -> fibre nic -> openvpn daemon -> tap device -> copper nic -> network
04:15 < stony> i left out the bridges but as we do layer2 *INSIDE* the tunnel i have to use bridges
04:15 < reiffert> If I may reask...
04:16 < reiffert> the incoming packet on the eth nic, left BSD will be an ip packet, right?
04:16 < stony> reiffert: no
04:16 < reiffert> ah.
04:16 < stony> reiffert: listen:
04:16 < reiffert> sorry for all this but it's hard for me to strip layer 3 out of my brain.
04:16 < stony> reiffert: to connect to openvpn daemons you need either tcp or udp (preferred) and two ip addresses to forward the packets between the daemons - right ?
04:17 < stony> s/to/two
04:17 < reiffert> stony: thats how communication between services work after the OSI layer.
04:17 < reiffert> s,.,description.,
04:17 < stony> reiffert: right, but i could also use mac addresses instead of ip addresses, can't i ?
04:18 < reiffert> stony: no, when asking the OSI layer description, you can not.
04:18 < stony> e.g. iSCSI uses ip addresses to forward the packets to the servers, but hyperscsi uses layer2 packets and mac addresses for that
04:18 < stony> so they avoid ip overhead 
04:18 < stony> and that's exactly what i want
04:19 < stony> when you have a 10km fibre link that carries layer 2 packets then it would be nice to use mac addresses for addressing the endpoints instead of putting the 3rd layer around the encrypted packets
04:19 < reiffert> stony: I think that you will have to patch the openvpn source code then and use whatever it takes instead of bind() listen() and accept().
04:19 < reiffert> stony: let me read some manpages, brb.
04:19 < stony> reiffert: k
04:20 < stony> i wonder if i can strip the layer3 of the packets on the local host and then forward the packet only in the layer2 container and add layer3 on the other side again 
04:20 < stony> hm
04:20 < reiffert> ah, on linux it's man 7 socket, leading to man 7 packet
04:21 < reiffert>        packet, AF_PACKET - packet interface on device level.
04:22 < stony> reiffert: hmm, but patching openvpn for that I don't know if i want todo that because of stability
04:22 < reiffert> stony: we should discuss this with dazo_afk.
04:22 < stony> hm ok
04:23 < stony> i need something like ipsec for layer 2 :)
04:24 < reiffert> stony: I think that if you still want encryption you will need to patch any VPN software, as VPN software's intention is to provide layer 3, right?
04:24 < stony> reiffert: there are switches that can do this trick ootb, but they're really expensive
04:25 < stony> and they are only protecting the traffic by password and not by cert
04:26 < stony> (or at least doing auth not by cert)
04:26 < reiffert> you can follow me with man 7 packet?
04:27 < stony> reiffert: sorry, was on the phone
04:27 < stony> just a sec
04:28 < stony> on bsd it would be PF_LINK
04:28 < stony> hmm, or PF_ATM
04:28 < stony> openvpn doing atm encryption would be awesome :D
04:29 < reiffert> it's man 7 pf_link on BSD?
04:29 < reiffert> (trying to get something on google)
04:30 < stony> best would be something like cat tap0 | openssl enc > /dev/mac/ma:ca:dd:re:ss:00 ;)
04:30 < stony> reiffert: no it's just man socket
04:30 < reiffert> http://www.freebsd.org/cgi/man.cgi?query=socket&apropos=0&sektion=0&manpath=FreeBSD+8.1-RELEASE&format=html
04:30 <@vpnHelper> Title: socket (at www.freebsd.org)
04:31 < stony> yeah
04:31 < stony> there is a PF_LINK (Link Layer Interface)
04:31 < reiffert> had a look at the openvpn source yet?
04:31 < stony> reiffert: no, why?
04:32 < krzie> lol
04:32 < krzie> cause you need to write a patch if you want that
04:32 < reiffert> right after the discussion with dazy.
04:32 < krzie> which is why reiffert looked in the manpage to give you a hint at what to patch
04:32 < reiffert> dazo
04:32 < reiffert> stony: did you check http://www.freebsd.org/cgi/man.cgi?query=mac&sektion=3&apropos=0&manpath=FreeBSD+8.1-RELEASE here?
04:32 <@vpnHelper> Title: mac(3) (at www.freebsd.org)
04:33 < stony> reiffert: yeah but that's not about the mac address or ll2
04:34 < stony> it's a different kind of access control like selinux
04:34 < reiffert> stony: I know, but what came up in mind is: have a layer2 link (with whatever software) and encrypt the communication with a user process.
04:34 < stony> reiffert: yeah, that's what my openssl example should do :D
04:35 < reiffert> mac_get_peer() for that case.
04:35 < reiffert> btw, man 7 packet: http://linuxmanpages.com/man7/packet.7.php
04:35 <@vpnHelper> Title: PACKET (at linuxmanpages.com)
04:36 < stony> reiffert: yes, but to get an endpoint of a socket i need layer 3 don't i ?
04:36 < reiffert> you dont.
04:37 < stony> the good part is that i don't need any arp-routes outside the tunnel on the fibre - i can just encrypt the packages, pass em to the line and at the other end i decrypt the packages again
04:37 < stony> i can even encrypt the mac addresses without getting into problems
04:37 < stony> so i only need to get openssl somewhere in between there
04:37 < reiffert> right now openvpn uses PF_INET, just change that to PF_PACKET
04:38 < stony> and i could do that by passing the data to openssl in userspace
04:38 < reiffert> "just" :)
04:38 < reiffert> VLN encryption came up to mind. anything there?
04:38 < stony> reiffert: yeah the little things in life cause the biggest problems ;)
04:38 < reiffert> s,VLN,VLAN,
04:39 < stony> reiffert: not really
04:39 < stony> (there)
04:40 < stony> bsd network interfaces are a bit more scriptable, i'll check the possibility to pass the packets to openssl in userland and then just forward em via the line
04:40 < stony> on the other hand, i can just use openvpn with overhead and be happy
04:41 < stony> but then i'll use ip addresses like 1.1.1.1 and 2.2.2.2 because then the packets aren't so big like when i use 192.168.100.100 and 192.168.200.200 because the numbers are lower 
04:41 < stony> SCNR ;)
04:42 <@vpnHelper> RSS Update - forum: TLS Blocked by provider, need to modify source code... <http://forums.openvpn.net/topic7439.html#p9027>
04:43 < reiffert> stony: those numbers are slower and this gains you packet length were exactly? SCNR
04:43 < reiffert> s,slower,lower,
04:44 -!- common [~common@p5DDA4728.dip0.t-ipconnect.de] has quit [Ping timeout: 265 seconds]
04:44 < stony> reiffert: yes ;)
04:44 < reiffert> So for Cisco it's called MACSec
04:44 < stony> yeah
04:44 < reiffert> And TrustSec
04:45 -!- common [~common@p5DDA41E4.dip0.t-ipconnect.de] has joined #openvpn
04:45 < stony> there are intel nics that do the trick ootb
04:45 < reiffert> MACSec seems to produce more overhead than TrustSec, where TrustSec can only be used on direct links which is what you want.
04:46 < reiffert> "ootb"?
04:46 < stony> reiffert: yeah - all i want is to encrypt the lines i don't have the possibility to protect them
04:46 < stony> reiffert: Out Of The Box
04:47 < stony> btw how does the openvpn daemon scale on smp boxes? only using one core or is it using more cores when there are more connections ?
04:48 < reiffert> 3.0 will be using multiple threads IIRC.
04:48 < reiffert> 3.0 is just a roadmap atm.
04:48 < stony> ok so it is better to get less cores and more mht
04:48 < stony> mhz
04:49 < krzie> you can also run an instance of openvpn on each core
04:49 < reiffert> http://www.v3.co.uk/vnunet/news/2191381/israeli-firm-boosts-ethernet
04:49 <@vpnHelper> Title: Israeli firm boosts Ethernet encryption - V3.co.uk - formerly vnunet.com (at www.v3.co.uk)
04:49 < stony> can is use tcp/udp on top of layer2 without ip ?
04:50 < stony> never thought of that, but could be possible, couldn't it?
04:50 < krzie> tcp/udp is IP
04:50 < krzie> s/is/is part of/
04:50 < stony> hm ok
04:51 < stony> reiffert: thanks for the link - but i prefer to use open source for real encryption :)
04:51 < reiffert> What about L2TP?
04:52 < stony> reiffert: same as openvpn with l2 tunnel
04:52 < stony> reiffert: it uses l3 to transport the packets
04:52 < reiffert> oh right.
04:52 < reiffert> sorry.
04:53 < stony> you know, i'll setup an infrastructure where everything exists three times: one time onside - two times offside in the data centers
04:53 < stony> and it will be connected by gbit/s fibre links
04:54 < stony> so i need to encrypt the data to avoid access anywhere on the public site where the data passes
04:54 < stony> s/onside/onsite
04:54 < stony> s/onsite/on-site
04:54 < stony> damn
04:55 < stony> so best to use is open/freebsd with openvpn
04:55 < stony> then we even have the fbi backdoor ;)
04:55 < reiffert> just buy those cisco switches you were talking about couple of minutes ago
04:55 < stony> in case we lock ourselfs out ;)
04:55 < stony> naa, cisco is a company that does security by obscurity
04:55 < stony> and i don't like that
04:55 < reiffert> ah, those openbsd ipsec stuff around couple of weeks ago..
04:56 < krzie> if you want the fbi backdoor you need ipsec
04:56 < reiffert> well then sed -e 's,PF_INET,PF_PACKET,g' openvpn/*
04:56 < krzie> aww you beat me to it
04:57 < stony> *g*
04:57 < reiffert> then hardcode the layer 2 address of the receiver ... done.
04:57 < reiffert> dont mess around with parsing config files.
04:57 < stony> yeah but the data is not encrypted
04:58 < reiffert> ?
04:58 < stony> reiffert: you've been talking about setting the mac address of the other endpoint manually in the arp cache?
04:59 < krzie> often a good idea... layer2 cant be trusted
04:59 < reiffert> stony: I'm still talking about patching openvpn
04:59 < stony> krzie: yeah 
04:59 < reiffert> 11:56 < reiffert> well then sed -e 's,PF_INET,PF_PACKET,g' openvpn/*
04:59 < reiffert> 11:57 < reiffert> then hardcode the layer 2 address of the receiver ... done.
05:00 < stony> reiffert: ah, i won't patch openvpn - I rely on openvpn's mature and stable code and don't want to mutilate it by my silly patches
05:00 < krzie> then you cant do it using openvpn
05:00 < reiffert> dazo_afk: please read up, it's about patching openvpn for that it can be used for layer 2 encryption (cisco sells this stuff atm)
05:00 < stony> if there is no other solution i'll use openvpn and put up with the overhead
05:01 < reiffert> dazo_afk: under the term MACSec and TrustSec
05:01 < reiffert> stony: buying cisco hardware - alternative.
05:01 < stony> reiffert: no - bsd and openvpn :)
05:02 < reiffert> http://www.youtube.com/watch?v=IUWDYU4KE4s
05:02 <@vpnHelper> Title: YouTube - Extreme - Strutter (Kiss Cover) (at www.youtube.com)
05:02 < stony> i need something i can rely on and that i trust
05:02 < reiffert> stony: trust the cisco technician :)
05:02 < stony> cisco gets people off the stage with the help of the police and a lawyer when they want to show some bugs in ios on a conference ...
05:03 < stony> that's not the way it should work 
05:03 < reiffert> http://www.node99.org/papers/l2auth.pdf
05:03 < krzie> stony, when that person is under NDA with cisco...?
05:04 < stony> krzie: you don't know the story, do you ?
05:04 < krzie> maybe i know a different one'
05:04 < stony> krzie: the guy that was working at a company that had a partner status with cisco - he discovered security bugs in the router os and send cisco the infos with the mark that he will share this info with the world on a congress half a year later
05:05 < reiffert> stony: it says something about EAP and 802.1X
05:05 < hyper_ch> good morning reiffert
05:05 < hyper_ch> hi krzie
05:05 < stony> reiffert: i'm using eap as well, but that's just for authentication and not encryption
05:05 < krzie> stony, and was he under NDA because of his job...?
05:05 < stony> krzie: nda?
05:05 < krzie> hey hyper_ch
05:05 < hyper_ch> kde 4.6 rc2 looks a lot sweeter already :)
05:05 < krzie> non disclosure agreement
05:05 < reiffert> stony: and how should someone sniff fibre then?
05:05 < stony> krzie: no
05:05 < krzie> a contract that says "i will wtfu"
05:05 < krzie> "i will stfu" *
05:06 < krzie> if that no is correct then the lawyers had nothing to stand on
05:06 < krzie> stony, got links to info...?
05:06 < stony> reiffert: the switch port is "dead" when you plug in your computer, then the system uses 802.1x to authenticate itself against the radius server in the back - then the radius server says "it's ok, i know this machine, put it on vlan 30"
05:06 < stony> reiffert: link up, system logged on, but *NOT* encrypted
05:06 < stony> reiffert: 802.1x is what you know as wpa enterprise on wifi
05:07 < reiffert> stony: sure and how to sniff a fbire connection?
05:07 < stony> reiffert: just put a bridge in the middle
05:07 < krzie> "just"
05:07 < krzie> heh
05:08 < reiffert> stony: by doing that the link gets down, right?
05:08 < stony> krzie: that's no problem - cut the cables, splice them to new pigtails and then put your switch with port monitoring in the middle
05:08 < djgerm> its not impossible.
05:08 < krzie> is cutting into fibre that easy?
05:08 < krzie> right, not impossible
05:08 < stony> reiffert: yes, but as the fibre goes only to the switch centre and then it is carried via the phone companies atm network, you can monitor the packets there as well
05:08 < krzie> also not "just"
05:09 < stony> krzie: splicing 12 fibre cables to the pigtails takes about 15 minutes
05:09 < stony> krzie: only splicing 2 cables 2 minutes
05:09 < reiffert> stony: then you are fucked anyways.
05:10 < stony> reiffert: that's why i want to encrypt the traffic :D
05:10 < reiffert> stony: you cant use layer 2 encryption on multiple fibre switches belonging to multiple layer 3 nets.
05:10 < djgerm> the NSA has a great security policy: assume everything is already compromised.
05:10 < reiffert> where as you dont keep every single one.
05:10 < stony> reiffert: i'm not doing that
05:10 < reiffert> stony: oh right, just that direct line at yours.
05:11 < reiffert> why not care about the weakest point first?
05:11 < reiffert> and why increase security other than at the weakest point?
05:11 < hyper_ch> reiffert: to feel better
05:12 < stony> reiffert: i do that
05:12 < stony> reiffert: but all i need is a way to encrypt data passing the "not under my control"-points
05:12 < stony> and those are always connections between buildings
05:13 < reiffert> Ah, strutter got written by Kiss. I knew I know it.
05:14 < reiffert> stony: right. encrypting all "not under my control" parts and optimizing those who share one subnet, so can talk via L2.
05:14 < stony> reiffert: yes
05:14 < reiffert> or whatever technology enables them.
05:16 < stony> wtf - i can't find even one link to the obscurity thing cisco did
05:16 < stony> it's just wiped of the net
05:16 < reiffert> :)
05:19 < stony> hehehe wikipedia: http://en.wikipedia.org/wiki/Michael_Lynn
05:19 <@vpnHelper> Title: Michael Lynn - Wikipedia, the free encyclopedia (at en.wikipedia.org)
05:19 < stony> that's the guy
05:21 < stony> http://news.bbc.co.uk/2/hi/technology/4724791.stm
05:21 <@vpnHelper> Title: BBC NEWS | Technology | Cisco acts to silence researcher (at news.bbc.co.uk)
05:21 < stony> the funny thing is: cisco has updates for the systems and said that they haven't been done by the owners of the systems
05:22 < stony> but they forgot to tell that you need an expensive contract to get the new releases
05:22 < stony> and that those updates are not free
05:22 < stony> i guess if the judge would have known that he wouldn't have signed any papers 
05:24 < krzie> ya that was a good talk
05:24 < krzie> single ping ownage
05:24 < krzie> s/ping/packet/
05:30 < reiffert> bl
05:30 < reiffert> bbl
05:30 < reiffert> nice talking
05:33 -!- EnginAy [~engin@78.179.187.85] has joined #openvpn
05:34 < EnginAy> !welcome
05:34 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:34 < EnginAy> my internet is restricted by ISP but I have a dedicated box in a local datacenter which runs ubuntu and is not restricted. Is openvpn for me ?
05:35 < reiffert> !def1
05:35 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
05:36 < reiffert> EnginAy: meaning: yes. see !howto
05:36 < reiffert> done.
05:40 < EnginAy> !hosto
05:40 < EnginAy> haha
05:40 < EnginAy> !howto
05:40 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
05:40 < EnginAy> not a great start
05:40 < stony> mahahahahahaha, sorry, but i have to post that: http://www.bildschirmarbeiter.com/video/profis_am_bau/
05:40 <@vpnHelper> Title: Profis am Bau! - Video auf bildschirmarbeiter.com (at www.bildschirmarbeiter.com)
05:44 < EnginAy> http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
05:44 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
05:45 -!- Bebop2Steady [~Bebop2Ste@124-168-169-88.dyn.iinet.net.au] has joined #openvpn
05:45 < EnginAy> does not mention where is the config file, which sure is not in /etc/openvpn on a default ubuntu installation
05:46 < Bebop2Steady> Which config file..
05:48 < Bebop2Steady> krzee you about? Stoppin by to say thx for your write up on chains. I got mine working finally, or close enough for today.
05:50 -!- alhadi [~thunderst@92.99.235.168] has joined #openvpn
05:51 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
06:00 -!- Bebop2Steady [~Bebop2Ste@124-168-169-88.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
06:02 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:23 -!- alhadi [~thunderst@92.99.235.168] has quit [Ping timeout: 240 seconds]
06:30 -!- alhadi [~thunderst@94.59.248.20] has joined #openvpn
06:31 -!- tessier [~treed@kernel-panic/copilotco] has quit [Ping timeout: 255 seconds]
06:36 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
06:42 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Ping timeout: 276 seconds]
07:14 -!- Shathak [proxyuser@p2044-ipbf207oomichi.oita.ocn.ne.jp] has joined #openvpn
07:24 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
07:24 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
07:24 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:32 -!- EnginAy [~engin@78.179.187.85] has quit [Ping timeout: 276 seconds]
07:34 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 240 seconds]
07:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
07:57 < stony> using ll2 addresses can't be implemented as a module, can it ?
08:06 -!- huli [~ericlee@220.181.143.94] has quit [Ping timeout: 240 seconds]
08:10 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
08:26 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
08:26 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
08:26 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:29 <@vpnHelper> RSS Update - forum: Help sharing printers in openvpn and windows xp <http://forums.openvpn.net/topic7492.html>
08:37 -!- p3rror [~mezgani@41.140.174.108] has quit [Ping timeout: 240 seconds]
08:48 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 272 seconds]
08:48 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 272 seconds]
08:49 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
08:59 -!- TripMine [~TripMine@unaffiliated/tripmine] has joined #openvpn
09:02 < TripMine> Hello, I've been able to establish a connection from the openvpn server to the client and was able to ping from the client to the gateway with responses. I cannot however communicate with any open ports on the server.
09:03 < TripMine> The server is on a VM and 1194 is forwarded through
09:03 < TripMine> no firewall is started on the VM.
09:04 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
09:04 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
09:04 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:06 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
09:11 <@vpnHelper> RSS Update - forum: To change port <http://forums.openvpn.net/topic7493.html>
09:13 -!- alhadi [~thunderst@94.59.248.20] has quit [Ping timeout: 240 seconds]
09:22 -!- sia is now known as sia^pwnnt
09:23 -!- sia^pwnnt is now known as sia
09:35 <@vpnHelper> RSS Update - forum: Ineternet speed after the openvpn connection <http://forums.openvpn.net/topic7448.html#p9030>
09:40 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
09:41 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
09:42 -!- WinstonSmith [~true@brln-4d0ce2d9.pool.mediaWays.net] has joined #openvpn
09:43 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has joined #openvpn
09:43 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has quit [Changing host]
09:43 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
09:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
09:58 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
10:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
10:39 -!- EnginAy [~engin@78.179.187.85] has joined #openvpn
10:39 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
10:39 < Peer^> !welcome
10:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:40 < Peer^> !goal
10:40 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:05 -!- sia is now known as sia^pwnnt
11:08 -!- WinstonSmith [~true@brln-4d0ce2d9.pool.mediaWays.net] has quit [Quit: Ex-Chat]
11:09 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
11:09 < fahmad> hello
11:10 < fahmad> !goal
11:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:15 < fahmad> i have question 
11:16 < fahmad> when i start openvpn using init script it starts three openvpn processes and when any these process goes down openvpn does not accept new connection
11:19 -!- Shathak [proxyuser@p2044-ipbf207oomichi.oita.ocn.ne.jp] has quit [Remote host closed the connection]
11:25 -!- shiz0_ [~shiz0@HSI-KBW-109-192-060-032.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
11:26 < fahmad> anyone ?
11:26 -!- Xen^ [~linux@vpn.server4sale.com] has joined #openvpn
11:30 -!- fahmad [~linux@unaffiliated/fahmad] has quit [Ping timeout: 255 seconds]
11:32 -!- Xen^ is now known as fahmad
11:32 -!- fahmad [~linux@vpn.server4sale.com] has quit [Changing host]
11:32 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
11:35 < fahmad> anyone ?
11:35 < fahmad> when i start openvpn using init script it starts three openvpn processes and when any these process goes down openvpn does not accept new connection
11:35 < fahmad> can someone tell me why this is happening
11:35 < fahmad> ?
11:35 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:39 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Ping timeout: 272 seconds]
11:41 -!- int_0x80_ [~int0x80@int0x80.big-daddy.fr] has quit [Remote host closed the connection]
11:41 -!- us3r [~aaron@CPE000d88382326-CM0012256eb04c.cpe.net.cable.rogers.com] has joined #openvpn
11:43 < us3r> Hey all
11:43 -!- us3r is now known as n1xus3r
11:44 < n1xus3r> I have the strangest thing happening to me
11:44 < Bushmills> fahmad: because you'ew running linux, possibly debian or ubuntu, and the init script starts one instance for each .conf file found in /etc/openvpn
11:44 < Bushmills> ergo, you have 3 *.conf files in /etc/openvpn
11:45 < n1xus3r> I have created an openVPN connection between vyatta and windows 7.  When I remote desktop into Windows 2008 server its very slow and lags....  When I rdp into a windows xp box it runs fine... Anyone have any idea what this could be?
11:47 < n1xus3r> Ive ran iperf tests on both the boxes and the speed was sufficient to run rdp smoothly.. But for some reason server 2008 would run rdp laggy and xp would run it fine
11:50 < fahmad> Bushmills: i am running centos 
11:50 < fahmad> Bushmills: you know when it get down it will not working ...
11:50 < n1xus3r> !welcome
11:50 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:51 < Bushmills> maybe because those multiple configs are not made to run at the same time, and conflict with each other
11:52 < Bushmills> when one goes down, a route may be removed which messes your system up
11:52 < fahmad> Bushmills: i am using only one config 
11:52 < Bushmills> just rename all the configs which you don't want to start, and start only with the one you mean to run
11:52 < fahmad> and i am using Radius Plugin for Radius Authentication by Ralf
11:53 < n1xus3r> Could it be because im using the beta rls of openpn on windows 7 for why only server 2008 rdp lags?
11:53 < Bushmills> "when i start openvpn using init script it starts three openvpn processes" - that's a sign that you're *not* "i am using only one config"
11:53 < fahmad> Bushmills: its the only one config which i have in /etc/openvpn is server.conf 
11:54 < Bushmills> then fix your init script
11:56 < fahmad> this init script was provided by openvpn source :)
11:57 < n1xus3r> Its like im a ghost in here
11:58 < Bushmills> n1xus3r: that's the problem with unpopular operating system choices
11:58 -!- Xen^ [~linux@vpn.server4sale.com] has joined #openvpn
11:58 -!- fahmad [~linux@unaffiliated/fahmad] has quit [Disconnected by services]
11:58 -!- Xen^ is now known as fahmad
11:58 -!- fahmad [~linux@vpn.server4sale.com] has quit [Changing host]
11:58 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
11:58 < fahmad> back
11:58 < n1xus3r> Windows?  Dont a lot of ppl use that for the "road warrior" configuration
11:59 < Bushmills> did all those lots of ppl reply to you?
12:00 < n1xus3r> Well its just an assumption
12:00 < n1xus3r> But its so weird I can rdp fine into an xp box
12:00 < Bushmills> !windows
12:00 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg, or (#3) also, http://secure-computing.net/files/windows_2.jpg
12:01 < n1xus3r> I can see this is not a big windows community damn..
12:01 < n1xus3r> Anywhere else I can get resources for this.. tried google
12:03 < n1xus3r> Or maybe there is some ppl in this chan who are more apt with windows configs... Such a weird issue.
12:03 < fahmad> Bushmills: how can i get openvpn init script fix as this has been given by openvpn
12:04 < Bushmills> fahmad: determine why it starts three openvpn instances
12:05 < fahmad> no idea why 
12:05 < fahmad> but its starting ...
12:05 < n1xus3r> what distro r u using?
12:05 < Bushmills> i also have no idea why. but you're sitting behind the machine where 3 instances are started, i am not.
12:06 < fahmad> n1xus3r: centos
12:06 < fahmad> Bushmills: humm
12:06 < fahmad> lemme check it on test machine
12:06 < fahmad> brb sec
12:06 < n1xus3r> try another possibly
12:06 -!- int_0x80_ [~int0x80@int0x80.big-daddy.fr] has joined #openvpn
12:10 < fahmad> even when i run this command it runs three processes /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server.pid --cd /etc/openvpn --config server.conf
12:12 < fahmad> i think its due to radiusplugin 
12:18 -!- EnginA [~engin@78.179.187.85] has joined #openvpn
12:21 -!- EnginAy [~engin@78.179.187.85] has quit [Ping timeout: 276 seconds]
12:33 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
12:44 -!- TripMine [~TripMine@unaffiliated/tripmine] has quit [Ping timeout: 250 seconds]
12:52 <@vpnHelper> RSS Update - forum: no access to net behind working vpn <http://forums.openvpn.net/topic7485.html#p9031>
12:56 -!- silverraindog [~angus@host86-185-35-153.range86-185.btcentralplus.com] has quit [Read error: Connection reset by peer]
12:57 -!- silverraindog [~angus@host86-185-35-153.range86-185.btcentralplus.com] has joined #openvpn
13:05 -!- p3rror [~mezgani@41.248.105.214] has joined #openvpn
13:11 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 240 seconds]
13:13 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
13:18 -!- p3rror [~mezgani@41.248.105.214] has quit [Ping timeout: 260 seconds]
13:25 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has quit [Remote host closed the connection]
13:25 -!- Netsplit *.net <-> *.split quits: tessier, d303k, nijotz, ksk, Rienzilla
13:26 -!- Netsplit over, joins: d303k, tessier, Rienzilla, ksk, nijotz
13:36 -!- n1xus3r [~aaron@CPE000d88382326-CM0012256eb04c.cpe.net.cable.rogers.com] has quit [Quit: n1xus3r]
13:40 <@vpnHelper> RSS Update - forum: [newbie/2.0.9] Checking that OpenVPN is OK? <http://forums.openvpn.net/topic7487.html#p9032>
13:41 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
13:47 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
14:04 -!- corretico [~corretico@201.201.44.82] has quit [Remote host closed the connection]
14:08 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
14:10 < stony> reiffert: hey, just for the discussion this morning - it can be done via the netgraph system on freebsd
14:11 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
14:28 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p9033>
14:30 -!- Engin [~engin@78.179.187.85] has joined #openvpn
14:31 -!- EnginA [~engin@78.179.187.85] has quit [Ping timeout: 276 seconds]
14:31 -!- alhadi [~thunderst@188.95.51.165] has joined #openvpn
14:33 -!- Bebop2Steady [~chatzilla@122.151.78.126] has joined #openvpn
14:50 -!- Malard|Home is now known as Malard
14:56 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
15:11 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
15:11 -!- p3rror [~mezgani@41.140.35.62] has joined #openvpn
15:19 -!- p3rror [~mezgani@41.140.35.62] has quit [Ping timeout: 240 seconds]
15:20 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Remote host closed the connection]
15:20 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
15:29 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has left #openvpn []
15:31 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- s0 d4Mn l33t |t'z 5c4rY!]
15:34 -!- p3rror [~mezgani@41.140.47.190] has joined #openvpn
15:37 -!- p3rror [~mezgani@41.140.47.190] has quit [Read error: Connection reset by peer]
15:39 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
15:39 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
15:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:58 -!- tessier [~treed@mail.copilotco.com] has quit [Ping timeout: 240 seconds]
16:12 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
16:13 -!- Engin [~engin@78.179.187.85] has quit [Ping timeout: 276 seconds]
16:38 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
16:40 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
16:40 -!- Cain` is now known as Cain
16:43 -!- p3rror [~mezgani@41.140.43.176] has joined #openvpn
17:00 -!- Bushmill1 [~root@178-26-21-130-dynip.superkabel.de] has joined #openvpn
17:04 -!- Iron_Chef [~alloy@tropyx.com] has joined #openvpn
17:04 < Iron_Chef> Hi, I'm trying, and having no luck, sending syslog messages over openvpn - any ideas?
17:04 -!- fredrika [~fredrika@c83-251-120-7.bredband.comhem.se] has joined #openvpn
17:05 < fredrika> Hi Guys. Got any tip on a good guide for setting up a openvpn server on ubuntu server?
17:05 < krzie> forget that it is ubuntu
17:05 < krzie> that doesnt mattr
17:05 < krzie> !howto
17:05 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
17:06 < krzie> Iron_Chef, make sure syslogd is listening on the ovpn ip as well
17:06 < Iron_Chef> I'm sure the vpn it working well, ssh, www etc all connect, just syslog messages get lost
17:06 < Iron_Chef> krzie: ah
17:07 < fredrika> krzie, I'll have a look. Thanks.
17:08 < krzie> oh and fredrika 
17:08 < krzie> !ubuntu
17:08 <@vpnHelper> "ubuntu" is dont use network manager!
17:08 < krzie> at least while testing
17:08 < krzie> you can use it once your vpn works right if you wanna
17:10 < Iron_Chef> ok, was not openvpn at all.  thanks anyway!
17:11 < krzie> fixed it?
17:11 < krzie> Iron_Chef, maybe 40% of questions here arent openvpn ;)
17:12 < krzie> if not more...
17:12 -!- KamelSnus [~carl@c80-216-40-208.bredband.comhem.se] has joined #openvpn
17:12 < krzie> normally firewalls / routing
17:12 < KamelSnus> Hi all!
17:12 < fredrika> krzie, wouldn't dream of it. I use it from a shell all the time at work. It just seems really complicated to set up at home. I mean, I already have a bridge det up, but it keeps refusing to start the daemon..
17:12 < krzie> oh god
17:12 < krzie> fredrika, you are using a bridge because of some web walkthrough, arent you...
17:13 < krzie> pls tell me why you want a bridged setup
17:13 < KamelSnus> My VPN-client (192.168.2.0/24) can't seem to get access to my LAN (192.168.1.0/24). I've done everything I can think of, I push the route in the config, I've set up the router to route the traffic to the vpn-server and... well I'm all out of ideas. Any directions would be very much appriciated...
17:14 < fredrika> krzie, I am. Sounds like Im off the mark?
17:14 < krzie> fredrika,
17:14 < krzie> !tunortap
17:14 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
17:14 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
17:14 < krzie> KamelSnus, lan behind server or client?
17:14 < KamelSnus> krzie: behind the server
17:15 < krzie> is the vpn server the router for its LAN?
17:15 < KamelSnus> Nope
17:15 < krzie> !route_outside_openvpn
17:15 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
17:15 < KamelSnus> I've added a route to the gateway for that LAN though
17:15 < krzie> !serverlan
17:15 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
17:16 < KamelSnus> !ipforward
17:16 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
17:16 < KamelSnus> :)
17:16 < fredrika> krzie, Well, does not the tun way need me to set up a new subnet? I really want the connected computer on the same local subnet as all my other stuff @ home
17:16 < KamelSnus> !linipforward
17:16 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
17:16 < krzie> fredrika, why do you think you want them on the same subnet?
17:17 < krzie> fredrika, 99% of people who say that dont understand routing... the remaining 1% run something weird the requires it
17:17 < fredrika> krzie, 'cause I do not know how to set up the routing.. ;)
17:17 < krzie> ;)
17:17 < krzie> !route
17:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
17:17 < KamelSnus> krzie: Hmm I seem to have done all that :&
17:18 < krzie> KamelSnus, i see you are using the most common subnet ever
17:18 < krzie> is your client also on the lan 192.168.1.X ?
17:18 < fredrika> krzie, perhaps that does it. I'll give it a shot. Thanks!
17:18 < krzie> fredrika, yw
17:18 < KamelSnus> krzie: haha yea I know
17:18 < krzie> fredrika, ALSO
17:18 < krzie> !confgen
17:19 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
17:19 < KamelSnus> krzie: client as in openvpn-client?
17:19 < KamelSnus> krzie: if so then no. the client isn't NAT:ed
17:19 < krzie> KamelSnus, your server's lan is 192.168.1.x, your vpn is 192.168.2.x, what LAN is the client on?
17:19 < krzie> ok, it has no lan
17:19 < krzie> gotchya
17:20 < KamelSnus> nope exactly
17:20 < krzie> !configs
17:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
17:20 < KamelSnus> Bot-master :D
17:20 < krzie> !bot
17:20 <@vpnHelper> "bot" is I'm a bot.. just a bot. krzee is my maintainer, and I haven't said anything, if you'd notice, the person who spoke just before me gave a !command to make me speak :P
17:20 < krzie> =]
17:21 < krzie> although...
17:21 < krzie> !forget bot
17:21 <@vpnHelper> Joo got it.
17:21 < KamelSnus> http://pastebin.com/Xn8Jgqg2
17:21 < krzie> !learn bot as I'm a bot.. just a bot. krzee and ecrist are my maintainers, and I haven't said anything, if you'd notice, the person who spoke just before me gave a !command to make me speak :P
17:21 <@vpnHelper> Joo got it.
17:22 < krzie> oh god
17:22 < krzie> and why are YOU bridging...
17:22 < KamelSnus> I like bridges :/
17:22 < KamelSnus> They make my life more interesting! :)
17:22 < krzie> what layer2 protocol do you need over your vpn?
17:23 < KamelSnus> http and ftp basically
17:23 < krzie> those are layer3
17:23 < KamelSnus> and ssh
17:23 < krzie> change server-bridge to server 192.168.2.0 255.255.255.0
17:23 < krzie> dev tap to dev tun
17:23 < krzie> unbridge your interfaces
17:24 < krzie> remove this line
17:24 < krzie> ifconfig-pool-persist ipp.txt
17:24 < KamelSnus> Ah sorry just ethernet then
17:24 < krzie> ethernet is layer2
17:24 < krzie> you just need IP
17:24 < krzie> aka layer3
17:24 < krzie> aka tun
17:24 < krzie> do what i said above, make the client match by changing it to dev tun
17:25 < KamelSnus> aye aye skipper! One minute :)
17:28 -!- int_0x80_ [~int0x80@int0x80.big-daddy.fr] has quit [Ping timeout: 240 seconds]
17:29 < KamelSnus> brb then
17:31 -!- fredrika [~fredrika@c83-251-120-7.bredband.comhem.se] has quit [Ping timeout: 276 seconds]
17:33 -!- KamelSnus [~carl@c80-216-40-208.bredband.comhem.se] has quit [Quit: Lost terminal]
17:34 -!- KamelSnus [~carl@c80-216-40-208.bredband.comhem.se] has joined #openvpn
17:34 < KamelSnus> Nope nothing :(
17:37 < KamelSnus> Can't see what i'm doing wrong... :/
17:37 < KamelSnus> Obviously I'm ding something wrong though
17:37 < KamelSnus> *doing
17:38 < krzie> paste BOTH configs now
17:38 < KamelSnus> Client and server?
17:39 < krzie> is there another that could be counted in "both" ?
17:42 < KamelSnus> http://pastebin.com/SerdAazu
17:43 -!- fredrika [~fredrika@c83-251-120-7.bredband.comhem.se] has joined #openvpn
17:43 < KamelSnus> The gateway for 192.168.1/24 has a route that points 192.168.2/24 to 192.168.1.200 (Which is the OpenVPN server)
17:44 -!- int_0x80_ [~int0x80@int0x80.big-daddy.fr] has joined #openvpn
17:45 < krzie> can the client ping 192.168.2.1?
17:46 < krzie> also, your client has --float
17:46 < krzie> you may have that backwards
17:46 < krzie> your CLIENT might change its ip, not your server, right?
17:46 < KamelSnus> yea
17:46 < krzie> ya its backwards
17:47 < KamelSnus> So I should thus rip float out of it I presume
17:47 < krzie> --float 
17:47 < krzie> Allow remote peer to change its IP address and/or port number, such as due to DHCP (this is the default if --remote is not used). --float when specified with --remote allows an OpenVPN session to initially connect to a peer at a known address, however if packets arrive from a new address and pass all authentication tests, the new address will take control of the session. This is useful when you are connecting to a peer which holds a dynamic add
17:47 < krzie> ress such as a dial-in user or DHCP client.
17:47 < krzie> yes, remove float
17:47 < Iron_Chef> openvpnas is telling me i'm using 10 users, but only lists 5 - is this normal?
17:47 < krzie> and since server doesnt have --remote, it already has --float so you dont need it there
17:48 < krzie> Iron_Chef, 
17:48 < krzie> !AS
17:48 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
17:48 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
17:48 < krzie> see #4
17:48 < krzie> we dont support AS here
17:48 < KamelSnus> Your a trooper mate. Thanks alot for spending your time on me! Please give me a minute to start irssi inside a screen
17:48 -!- KamelSnus [~carl@c80-216-40-208.bredband.comhem.se] has quit [Quit: leaving]
17:48 < Iron_Chef> ah ok
17:49 -!- KamelSnus [~root@c80-216-40-208.bredband.comhem.se] has joined #openvpn
17:49 < KamelSnus> There we are
17:49 -!- p3rror [~mezgani@41.140.43.176] has quit [Ping timeout: 276 seconds]
17:49 < KamelSnus> Let me try to ping 192.168.2.1
17:53 < krzie> dude
17:53 < krzie> do NOT irc as root
17:53 < krzie> EVER
17:54 < Iron_Chef> KamelSnus: yeah, really, root and irc are a huge hole
17:54 < krzie> disconnect immediately and join from a user account, trust me
17:59 < KamelSnus> Whups! Totally forget I was su on this box!
17:59 < KamelSnus> Good catch!
17:59 < KamelSnus> Thanks
17:59 < KamelSnus> brb
17:59 -!- KamelSnus [~root@c80-216-40-208.bredband.comhem.se] has quit [Quit: leaving]
18:00 -!- KamelSnus [~upload@c80-216-40-208.bredband.comhem.se] has joined #openvpn
18:00 < KamelSnus> There we are
18:00 < KamelSnus> Anyways.... nope I can't ping 192.168.2.1
18:00 < krzie> cool, pastebin some logs
18:01 < KamelSnus> Where does openvpn log btw? 
18:02 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
18:02 < krzie> !logfilew
18:02 < krzie> !logfile
18:02 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
18:08 < KamelSnus> some syslog; http://pastebin.com/ZuZFxU4X
18:18 < krzie> ahh
18:18 < krzie> your client configs dont have comp-lzo
18:18 < krzie> but your server does
18:18 -!- nb [~nb@fedora/nb] has joined #openvpn
18:18 < krzie> LOL that it happens to point at 42 and 69
18:19 < krzie> the 2 answers to life and everything
18:19 < krzie> (and universe)
18:20 -!- KamelSnus [~upload@c80-216-40-208.bredband.comhem.se] has quit [Remote host closed the connection]
18:20 < krzie> http://www.youtube.com/watch?v=aboZctrHfK8
18:20 <@vpnHelper> Title: YouTube - the answer to life, universe and everything (at www.youtube.com)
18:22 -!- N0b0dy [debian-tor@gateway/tor-sasl/n0b0dy] has joined #openvpn
18:29 -!- KamelSnus [~carl@c80-216-40-208.bredband.comhem.se] has joined #openvpn
18:30 < KamelSnus> Hi again
18:34 < KamelSnus> Did you get anything from those logs?
18:34 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
18:35 < krzie> [20:18]  <krzie> your client configs dont have comp-lzo
18:35 < krzie> [20:18]  <krzie> but your server does
18:36 < KamelSnus> Oh?
18:36 < KamelSnus> Would that case it?
18:36 < krzie> yes
18:37 < KamelSnus> just add "open-lzo" to the client-conf then I presume?
18:37 < krzie> you really feel the need to ask that?
18:37 < KamelSnus> I seem to get everything wrong today so... :/
18:37 < N0b0dy> type sudo dd if=/dev/urandom of=/dev/sda into the console
18:37 < N0b0dy> to fix the problem.
18:42 < KamelSnus> Oh!
18:43 < KamelSnus> krzie: Thank you SO much for your time! You cracked the nut
18:43 < krzie> yw
18:43 < KamelSnus> *happy happy* :)
18:44 < KamelSnus> Now I'm off to bed! I wish you a lovely evening!
18:44 < krzie> nite
18:44 -!- KamelSnus [~carl@c80-216-40-208.bredband.comhem.se] has quit [Quit: yaay]
18:44 < krzie> hah
18:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
18:46 < N0b0dy> Cain, you from efnet?
18:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:52 -!- Mushbills [~l@178-26-21-130-dynip.superkabel.de] has joined #openvpn
18:52 -!- fredrika [~fredrika@c83-251-120-7.bredband.comhem.se] has quit [Quit: Lämnar]
18:55 -!- Mushbills [~l@178-26-21-130-dynip.superkabel.de] has left #openvpn []
18:55 -!- Mushbills [~l@178-26-21-130-dynip.superkabel.de] has joined #openvpn
18:59 < Iron_Chef> what does this mean:
18:59 < Iron_Chef> Options error: Unrecognized option or missing parameter(s) in client.conf:109: <ca> (2.0.9)
18:59 < Iron_Chef> i've set up 6 machines the same, this one alone gives this error
19:00 < krzie> didnt you say you run AS?
19:01 < Iron_Chef> krzie: not on the clients
19:02 < Mushbills> 2.0.9 is kind of old
19:02 < krzie> a) if you're really running 2.0.9 go update, b) you prolly dont have the ca entry in the config
19:05 < Iron_Chef> ah, this server has a dodgey repo, will try with rpmforge
19:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
19:35 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
19:36 -!- Bushmill1 [~root@178-26-21-130-dynip.superkabel.de] has quit [Quit: Download Gaim: http://gaim.sourceforge.net/]
19:37 < N0b0dy> sky[xx] runs vsftpd 2.0.5
19:37 < N0b0dy> and transmission on port 9091
19:37 < N0b0dy> SECURITY EXPERT
19:38 < N0b0dy> should i rm the kid
19:41 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
19:47 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
19:53 -!- N0b0dy [debian-tor@gateway/tor-sasl/n0b0dy] has quit [Quit: leaving]
20:04 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
20:07 -!- s7r [~s7r@95.154.230.251] has left #openvpn []
20:07 -!- p3rror [~mezgani@41.140.43.5] has joined #openvpn
20:30 < reiffert> moin
20:30 < reiffert> Iron_Chef: 2.0.9 sounds like very ancient and broken software.
20:33 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 272 seconds]
20:54 -!- nb [~nb@fedora/nb] has joined #openvpn
21:00 < Bebop2Steady> general question about chains if krzee/anyone is around..
21:07 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
21:13 -!- Mushbills [~l@178-26-21-130-dynip.superkabel.de] has quit [Quit: Changing server]
21:15 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:19 < krzie> !ask
21:19 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, or (#2) http://www.latinsud.com/answer/, or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
21:19 < Bebop2Steady> Oh excellent thank you : ]
21:19 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
21:19 < Bebop2Steady> re: this vpn chain I have been working on, with a VPN over the innner chain..
21:20 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Ping timeout: 240 seconds]
21:20 < Bebop2Steady> I am finding it necessary to run openVPN client twice for the end-ser
21:20 < Bebop2Steady> I am curious if there's a way to only need it once
21:20 < Bebop2Steady> https://forums.openvpn.net/topic7483.html
21:20 <@vpnHelper> Title: OpenVPN Support Forum Double VPN || 2 Hop VPN || VPN-over-VPN : Server Administration (at forums.openvpn.net)
21:21 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
21:22 < Bebop2Steady> end user i mean... 
21:22 < reiffert> "Balls to the wall" - Accept   comes to mind
21:22 < Bebop2Steady> the peron who wants to utilize the secure chain..
21:23 < reiffert> http://www.youtube.com/watch?v=TMplgrlXo80
21:23 <@vpnHelper> Title: YouTube - accept - balls to the wall - new singer Mark Tornillo (at www.youtube.com)
21:23 < reiffert> "They're gonna break their chains"
21:24 < reiffert> Bebop2Steady: please explain those "chains". Never heard of any regarding network terms.
21:24 < krzie> oh those chains
21:24 < krzie> lol
21:24 < reiffert> krzie: what is doing there?
21:25 < krzie> hes talking about vpnchains
21:25 < reiffert> meaning?
21:25 < krzie> thats what i called it in my writeup here:
21:25 < krzie> !vpnchains
21:25 < krzie> erm
21:25 < reiffert> glad vpnHelper doesnt respond on that.
21:25 < krzie> http://secure-computing.net/wiki/index.php/OpenVPN/VpnChains
21:25 <@vpnHelper> Title: OpenVPN/VpnChains - Secure Computing Wiki (at secure-computing.net)
21:26 < reiffert> I call it routing.
21:26 < reiffert> Hey lets rename everything.
21:26 < krzie> erm
21:26 -!- reiffert is now known as krzee_
21:26 < krzie> you didnt read it
21:26 < krzee_> no, I was looking at a single picture.
21:26 -!- krzee_ is now known as reiffert
21:26 < krzie> i talk to server a, and it exits client b, while inside a vpn that client a and server b cant sniff
21:27 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
21:27 < krzie> although i can choose for it to exit any machine through a small setting change on my client machine
21:28 < reiffert> I dont see a benefit.
21:28 < krzie> then dont do it
21:28 < reiffert> Maybe someone should explain me the benefit.
21:28 < krzie> aka, line 2 of the link you just didnt read
21:28 < krzie> You may not see a practical purpose to doing this, and if that is the case: dont do it =] 
21:29 < Bebop2Steady> Agreed. mostly interested in the "how to" rather than "why to" for the moment
21:29 < reiffert> Right, I started at "I connect to SERVER-A"
21:30 -!- Engin [~engin@78.179.187.85] has joined #openvpn
21:31 < reiffert> doing something stupid for the purpose of doing something stupid? erm.
21:31 < krzie> if you dont see why, then you dont need it
21:31 < krzie> i didnt document it much more because i didnt want to get into any of that
21:32 < reiffert> ah, catching innocent users with pretty stupid stuff - that makes sense!
21:32 < reiffert> I like the idea.
21:36 < krzie> we could say it helps in offering plausible deniability
21:45 -!- p3rror [~mezgani@41.140.43.5] has quit [Read error: Connection reset by peer]
21:51 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Ping timeout: 255 seconds]
22:00 -!- p3rror [~mezgani@41.140.98.116] has joined #openvpn
22:02 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Network is unreachable]
22:02 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
22:03 -!- stony is now known as Guest77827
22:04 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
22:13 -!- p3rror [~mezgani@41.140.98.116] has quit [Ping timeout: 255 seconds]
23:00 -!- pyther [~pyther@unaffiliated/pyther] has quit [Quit: Lost terminal]
23:14 -!- Engin [~engin@78.179.187.85] has quit [Read error: Connection reset by peer]
23:14 -!- Engin [~engin@78.179.187.85] has joined #openvpn
23:19 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 264 seconds]
23:31 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
23:31 -!- mode/#openvpn [+o vpnHelper] by ChanServ
23:58 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
23:59 < mick_laptop> anyone know if it is possible to connect two remote locations in a way that if the connection on one goes down that the other ide will not be hosed?
--- Day changed Sun Jan 09 2011
00:00 < mick_laptop> I was thinking: [router w/ openvpn @ site A] <----- {intarwebs} ------> [router w/ openvn @site B]
00:00 < krzie> why would the other side be hosed?
00:11 < mick_laptop> internet goes down
00:11 < mick_laptop> i'd still like people to be able to connect remotely to the other side
00:17 < krzie> without access to the internet!?
00:29 -!- Engin [~engin@78.179.187.85] has quit [Ping timeout: 276 seconds]
00:32 < djgerm> this situation sounds enigmatic.
00:36 < mick_laptop> krzie: i mean if a site goes down then users (who have internet access elsewhere) can just connect to the other vpn server
00:36 < krzie> sure, just use 2 remote entries
00:38 -!- Bebop2Steady [~chatzilla@122.151.78.126] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
00:38 < mick_laptop> ok so to have the vpn connected though
00:38 < mick_laptop> so if you connect to one - you have access to the other
00:40 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
00:51 < Iron_Chef> when i run an openvpn client on a webserver, it stops serving http correctly and ssh for that matter
00:51 < Iron_Chef> definately stopping openvpn solves this problem
00:52 < Iron_Chef> i just want to use openvpn to shoot log files off site - what setting am i misplacing?
00:52 < krzie> your client is set to redirect-gateway isnt it
00:53 < Iron_Chef> ah
00:53 < krzie> and why dont you just syslog offsite
00:53 < krzie> oh wait you were trying that earlier... must have given up
00:54 < Iron_Chef> syslog is working fine over the vpn now
00:54 < Iron_Chef> all other servers are happy, just web server now
00:54 < Iron_Chef> i want to put it through the vpn to not have to pay for an IP just for a logger basically
01:00 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:03 < Iron_Chef> where do I tell it not to listen on the vpm ip?
01:05 < |Mike|> what's vpm?
01:07 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
01:07 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 264 seconds]
01:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
01:29 < Iron_Chef> a typo |Mike| 
01:37 < krzie> Iron_Chef, pls restate your question in a better way, i have no idea what you want
01:52 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
01:52 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:05 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 260 seconds]
02:09 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
02:09 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:12 < Iron_Chef> krzie: why does the webserver stop serving web when openvpn connects?
02:16 < Iron_Chef> !welcome
02:16 < Iron_Chef> !goal
02:20 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 250 seconds]
02:34 < alhadi> hi
02:34 < alhadi> krzie :) , the VPS support guys sorted a problem with a firewall.
02:34 < alhadi> said to be the cisco ASA device that not allowing dev tun16 to ping and redirect
02:34 < alhadi> now i am connected to VPN and works :)
02:35 < krzie> [02:52]  <krzie> your client is set to redirect-gateway isnt it
02:35 < krzie> you never answered
02:35 < krzie> @ Iron_Chef 
02:35 < krzie> alhadi, cool =]
02:35 < alhadi> :d ty
02:36 < alhadi> i am registering in openvpn forum now
02:36 < alhadi> brb
02:46 < Iron_Chef> krzie: I didn't see that setting anywhere
02:48 < krzie> Iron_Chef, pastebin client and server configs
02:54 < Iron_Chef> i'd rather not, if you can't answer that's ok.
02:55 < krzie> lol
02:55 < krzie> you're talking about your AS setup arent you
03:35 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
03:39 -!- WinstonSmith [~true@g231242069.adsl.alicedsl.de] has joined #openvpn
03:48 -!- WinstonSmith [~true@g231242069.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
03:51 -!- master_of_master [~master_of@p57B55D9F.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
03:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:52 -!- master_of_master [~master_of@p57B52F1C.dip.t-dialin.net] has joined #openvpn
04:01 -!- WinstonSmith [~true@f052101074.adsl.alicedsl.de] has joined #openvpn
04:09 -!- Bebop2Steady [~Bebop2Ste@124-149-37-222.dyn.iinet.net.au] has joined #openvpn
04:23 < Bebop2Steady> Socks server inside VPN. Interesting idea. I wonder of the potential applications, if any...
04:24 < krzie> !routebyapp
04:24 < krzie> !factoids search route
04:24 < krzie> grr vpnhelper is down
04:24 < krzie> 1min
04:24 < Bebop2Steady> dang
04:25 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
04:25 -!- mode/#openvpn [+o vpnHelper] by ChanServ
04:25 < krzie> !routebyapp
04:25 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
04:26 < Bebop2Steady> ahh thats getting pretty crazy / mind screwy
04:27 < Bebop2Steady> so you get in the VPN.. and then route some apps selectively even deeper into the VPN ?
04:27 < krzie> i allow certain apps to bypass the vpn
04:27 < krzie> others go through it
04:28 < krzie> ie: 2 web browsers, 1 goes over local isp other over vpn
04:28 < krzie> default is the vpn one
04:28 < krzie> torrents bypass the vpn
04:28 < krzie> default is to go over the vpn
04:29 < krzie> byproduct of not allowing lan machines to communicate with me, unless i add a rule for them to bypass the vpn
04:29 < krzie> (which i prefer)
04:29 < krzie> my responses go over the vpn, which has no route to the lan
04:32 < Bebop2Steady> I'm with ya up until byproduct... but dont try n explain.. I still gotta get my hands dirty some more with openvpn experiments.
04:38 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:40 -!- common- [~common@p5DDA4406.dip0.t-ipconnect.de] has joined #openvpn
04:43 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 240 seconds]
04:43 -!- common [~common@p5DDA41E4.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
04:43 -!- common- is now known as common
04:48 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
04:49 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
04:54 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
05:10 -!- Netsplit *.net <-> *.split quits: d303k, rkantos_, Hamlin, nijotz, ksk, takamichi
05:11 -!- Netsplit over, joins: takamichi, rkantos_, Hamlin
05:12 -!- Netsplit over, joins: d303k, ksk, nijotz
05:12 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Excess Flood]
05:12 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
05:22 -!- int_0x80_ [~int0x80@int0x80.big-daddy.fr] has quit [Ping timeout: 276 seconds]
05:36 -!- int_0x80_ [~int0x80@int0x80.big-daddy.fr] has joined #openvpn
05:36 -!- raidzx [~Andrew@2002:adc0:e0ad::adc0:e0ad] has joined #openvpn
05:39 -!- raidzxx [~Andrew@seance.openvpn.org] has quit [Ping timeout: 265 seconds]
05:40 -!- Bebop2Steady [~Bebop2Ste@124-149-37-222.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
06:11 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:14 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:19 -!- Stava [~Stava@h-86-192.A197.priv.bahnhof.se] has joined #openvpn
06:19 < Stava> Do I need to open any ports to use OpenVPN? (client) I'm currently unable to open any port :(
06:30 < reiffert> outbound udp/1194
06:30 < reiffert> inbound (server side) udo/1194
06:30 < reiffert> udo=udp
06:31 -!- int_0x80___ [~int0x80@int0x80.big-daddy.fr] has joined #openvpn
06:33 -!- int_0x80_ [~int0x80@int0x80.big-daddy.fr] has quit [Ping timeout: 276 seconds]
06:39 -!- int_0x80___ is now known as int_0x80_
06:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
06:48 -!- WinstonSmith [~true@f052101074.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
06:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:00 -!- int_0x80_ [~int0x80@int0x80.big-daddy.fr] has left #openvpn ["Quitte"]
07:02 -!- WinstonSmith [~true@g231217029.adsl.alicedsl.de] has joined #openvpn
07:36 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Read error: Operation timed out]
07:41 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
07:41 -!- Guest77827 is now known as stony
07:56 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
07:56 < deever> hi
07:57 < deever> after TLS succeeds, my client sends infinite PUSH_REQUESTs to the server:
07:57 < deever> Sun Jan  9 14:50:31 2011 SENT CONTROL [VPN]: 'PUSH_REQUEST' (status=1)
07:58 < deever> which on the server looks like:
07:58 < deever> Sun Jan  9 15:50:48 2011 PUSH: Received control message: 'PUSH_REQUEST'
08:00 < deever> how can i make the connection come to completion?
08:07 -!- fredrika [~fredrika@c83-251-120-7.bredband.comhem.se] has joined #openvpn
08:08 < fredrika> Hi guys. I'm trying to set up a openvpn server, with no luck. The daemon starts ok at the server, but when I try to connect from the client It stucks at "UDPv4 link remote: [AF_INET]". Does anyone know what happens at this "stage".
08:12 -!- alhadi [~thunderst@188.95.51.165] has quit [Quit: alhadi]
08:13 < deever> fredrika: does it work with TCP?
08:14 < fredrika> I have not tried. Was recommended to use UDP for recurity reasons.
08:15 < fredrika> deever, I'll have a go right away
08:19 < fredrika> deever, it does not. But I get another error. http://pastebin.com/Cw7TcrPm
08:26 < deever> xxx is a valid ip address in real? ;)
08:27 < deever> @fredrika
08:28 < deever> fredrika: and you can ssh betwenn client and server?
08:28 < fredrika> deever, yes
08:28 < fredrika> deever, the firewall is not the issue
08:29 < fredrika> deever, i tired to flush iptables and connect over lan without any luck
08:29 < deever> you could try to tunnel over ssh for make tat ....
08:29 < deever> ..ah, ok
08:30 < fredrika> seems really strange.
08:31 < deever> try explicitely bind the server (to an address)
08:32 < fredrika> how do i do that?
08:33 < fredrika> Im running on port 12054. It is set up in both server and client config, but could this still perhaps be the issue?
08:33 < deever> "local 12.34.56.78"
08:33 < fredrika> Or can I choose port freeley?
08:33 < fredrika> deever, aa sorry
08:33 < deever> with the ip you want to bind to
08:34 < deever> you better take the standard port (1194)
08:37 < fredrika> changed to port 1194, set the explicit bind. exacltey the same message as before (pastebin)
08:39 < deever> fredrika: very strange...mb you paste the configs too?
08:40 < fredrika> sure
08:40 < fredrika> hold on
08:42 < fredrika> deever, http://pastebin.com/B46cECux
08:44 < fredrika> btw, "home" is set up in my host file to be 10.39.7.5
08:50 < deever> try omitting this tls-auth stuff
08:56 -!- sia^pwnnt is now known as sia
08:58 < fredrika> deever, Ok. Now it complains about the certificates. I'll just try to create new ones.
08:58 < fredrika> thanks for the help!
08:59 < deever> fredrika: mb you try out first with PSK..;)
08:59 < fredrika> deever, sounds like a plan..
09:00 < deever> x509 is a different hassle than vpn...;)
09:00 < deever> plan?
09:02 < fredrika> deever, like something worth checking out....
09:10 < deever> ah, ok! ;)
09:11 < deever> can someome here tell me how i prevent the client from sending PUSH_REQUESTs and just continuing setting up the connection?
09:12 < deever> server: http://pastebin.com/E9bMiQQM  client: http://pastebin.com/SWxzJbLZ
09:29 -!- s7r [~s7r@83.170.111.154] has joined #openvpn
09:35 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:42 -!- alhadi [~thunderst@188.95.51.165] has joined #openvpn
09:43 -!- WinstonSmith [~true@g231217029.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
09:43 -!- agrajag [~agrajag^@CAcert/Assurer/agrajag] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:45 -!- WinstonSmith [~true@g231217029.adsl.alicedsl.de] has joined #openvpn
09:47 -!- alhadi [~thunderst@188.95.51.165] has quit [Client Quit]
09:47 -!- fredrika [~fredrika@c83-251-120-7.bredband.comhem.se] has quit [Ping timeout: 272 seconds]
09:49 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Remote host closed the connection]
09:52 -!- WinstonSmith [~true@g231217029.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
09:52 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
09:52 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
09:52 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:58 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
09:59 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
10:06 -!- WinstonSmith [~true@g231242069.adsl.alicedsl.de] has joined #openvpn
10:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
10:32 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
10:38 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 246 seconds]
10:39 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
10:39 -!- sia [115kluu@owned.ninjasinpyjamas.biz] has quit [Disconnected by services]
10:42 -!- sia_ [~115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
10:50 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
10:51 < deever> anyone here using openvpn as a L2 vpn? (with a bridge so the vpn uses the same IP subnet as the LAN)
10:53 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
10:53 < stony> deever: yes
10:53 < stony> deever:  but for ipx things, same ips as in the local lan can be used via layer3
10:53 < stony>  
10:54 < deever> stony: ipx? you mean that old l3 protocol? ;)
10:55 < stony> deever: yeah ipx/spx/netbui
10:55 < deever> lol...cool
10:56 < deever> stony: are you running openbsd on the server?
10:56 < stony> deever: on which server ?
10:56 < deever> on the openvpn server
10:56 -!- WinstonSmith [~true@g231242069.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
10:57 < stony> deever: no, but i know how to config brouting on free/openBSD as well
11:00 < deever> stony: does something look wrong in there for you? http://pastebin.com/qzzRu0qg
11:00 < stony> deever: when you tell me what you try todo - maybe
11:00 < stony> deever: you need a tap device if you want to bridge
11:00 < stony> tun is layer3
11:00 < deever> the tunnel itself works, but i can't even ping the router over the vpn
11:00 < deever> not on openbsd
11:01 < stony> deever: the firewall settings are adjusted so that the packets can flow towards the bridge ?
11:01 < deever> there you have to config 'dev tun0; dev-type tap'
11:02 < stony> deever: and assign the ip address to the bridge and not one of it's interfaces: ifconfig em1 delete; ifconfig bridge0 192.168.168.1/24
11:03 < stony> deever: and then check if the mac address of the client that tries to ping is in the arp cache
11:03 < stony> and if the mac of the system you try to ping is in the clients arp cache
11:03 < stony> if the arp cache is filled, then it's only a layer3 firewall problem
11:03 < deever> # ifconfig bridge0 192.168.168.1/24
11:03 < deever> ifconfig: SIOCAIFADDR: Inappropriate ioctl for device
11:03 < stony> is it up ?
11:03 < deever> good idea with the arp cache
11:05 < deever> the bridge? yes
11:05 < stony> check if the bridge is up or add an "up" ad the end: ifconfig bridge0 192.168.168.1/24 up
11:06 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 246 seconds]
11:06 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
11:06 < deever> i get the same error with ifconfig bridge0 192.168.168.1/24 up
11:06 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
11:07 < stony> deever: anything in the logs ?
11:07 < stony> deever: you deleted the ip from the ethernet nterface before ?
11:09 -!- WinstonSmith [~true@f052101074.adsl.alicedsl.de] has joined #openvpn
11:11 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
11:14 < deever> stony: it also happens after a reboot...hmmm
11:14 < stony> deever: i'm "only" running freebsd but it works as it should
11:16 -!- jambooda1 [~cog@pool-98-109-218-165.nwrknj.fios.verizon.net] has joined #openvpn
11:16 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 240 seconds]
11:19 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has left #openvpn []
11:27 -!- megabraker [c500bab3@gateway/web/freenode/ip.197.0.186.179] has joined #openvpn
11:27 < megabraker> hi guys 
11:28 < megabraker> my country have many problems with liberty of express please any one to help me to connect to a vpn server ? am really broke and if any one will help me i will be so gratefull
11:40 -!- megabraker [c500bab3@gateway/web/freenode/ip.197.0.186.179] has quit [Quit: Page closed]
11:49 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
11:50 -!- jambooda1 [~cog@pool-98-109-218-165.nwrknj.fios.verizon.net] has quit [Ping timeout: 240 seconds]
12:02 -!- thomaschaaf [59b74c9c@gateway/web/freenode/ip.89.183.76.156] has joined #openvpn
12:02 < thomaschaaf> !route
12:02 < thomaschaaf> where is VPNhelper?
12:03 -!- luneff [~yury@84.51.205.26] has joined #openvpn
12:07 < hyper_ch> thomaschaaf: it got scared of you
12:07 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
12:09 -!- luneff [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
12:09 -!- luneff [~yury@84.51.205.26] has joined #openvpn
12:30 -!- zakx [zakx@gentoo/contributor/zakx] has joined #openvpn
12:30 < zakx> hi, does anyone know if it's intentional that only one client can connect to the management interface at once?
12:31 < zakx> and, more important, how to get rid of this limitation
12:35 < stony> zakx: afaik it's only made for one client
12:35 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Quit: No Ping reply in 180 seconds.]
12:35 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
12:36 < thomaschaaf> anyone know whether there is a irc for poptop? I need openvpn and poptop to work together :/ #pptp seems dead on this irc server
12:36 < stony> thomaschaaf: openvpn cant handle pptp (iirc)
12:37 < zakx> meh, that seems to be somewhat unfortunate, especially because there's no server-based timeout either. so any open connection sitting at ENTER PASSWORD: could practically block all other processes relying on the interface
12:37 < stony> zakx: yeah, and this interface should only be accessible by a specific user on a spcific ip (localhost preferred)
12:38 < stony> zakx: but you can run openvpn as an inetd "client" and give each connection it's own daemon with it's own interface
12:38 < thomaschaaf> stony: they are not supposed to talk to each other directly just need some routing help with pptp :/ because I need to send a route out to the client which it needs to add on connect
12:38 < stony> thomaschaaf: on the openvpn or on the pptp side ?
12:38 < thomaschaaf> pptp :( else it would be easy
12:39 < stony> thomaschaaf: on pptp pppd is used and you can offer the client additional routes through pppd and it's config protocols
12:41  * stony gets something to eat
12:41 < stony> brb
12:42 -!- pcfreak30 [~derrick@cpe-098-027-009-128.triad.res.rr.com] has joined #openvpn
12:43 < pcfreak30> Hello. i am trying to run "openvpn --config client.ovpn"on ubuntu. my login is correct but it seems to error on DHCP. http://pastie.org/private/adjuu0lv8merjaz1zlzunw
12:50 -!- luneff [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
12:50 < stony> re
12:50 -!- luneff [~yury@84.51.205.26] has joined #openvpn
12:53 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
12:54 < pcfreak30> ?
12:56 -!- WinstonSmith [~true@f052101074.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
12:57 < stony> pcfreak30: is it a l2 or l3 connection ?
12:57 < pcfreak30> i dont follow
12:58 < pcfreak30> im on openvpn 2.1
12:58 < stony> tap or tun ?
12:58 < pcfreak30> i just realized and i saw a bug change log. its ubuntu 10.10
12:58 < stony> post your config please
12:58 < pcfreak30> h/o
12:59 < pcfreak30> http://pastie.org/private/vveavtezioqxitu5crwyfa
13:00 < pcfreak30> thats the part thats between all keys
13:00 < stony> but that's the client's config
13:00 < stony> i need the server side, because the push thingies come from the server
13:00 < pcfreak30> i dont follow
13:00 < pcfreak30> um i dont have that
13:00 < pcfreak30> i bought a service i dint run 1?
13:01 < pcfreak30> sh3lls.net
13:02 < stony> set the ping-timeout higher
13:03 < stony> ping-restart 100
13:03 < stony> they're sending ping-restart to your box but i guess it's to slow
13:03 -!- thomaschaaf [59b74c9c@gateway/web/freenode/ip.89.183.76.156] has quit [Quit: Page closed]
13:04 < stony> if you set it to 100 and it's still not working, check if you still can reach the openvpn server by ping
13:04 < pcfreak30> what number should i set it
13:04 < stony> ping-restart 100
13:04 < pcfreak30> and what bout the dhcp errors
13:04 < pcfreak30> what bout the dhcp errors
13:04 < pcfreak30> Sun Jan  9 13:30:42 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:4: dhcp-pre-release (2.1.0)
13:04 < pcfreak30> Sun Jan  9 13:30:42 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.1.0)
13:04 < pcfreak30> Sun Jan  9 13:30:42 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:6: dhcp-release (2.1.0)
13:04 < pcfreak30> Sun Jan  9 13:30:42 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:18: register-dns (2.1.0)
13:04 < stony> the vpn connection is restarted because of a ping timeout
13:05 < stony> that's your problem
13:05 < stony> so either the ping-request is to low ooooor - they're breaking your route to the vpn daemon
13:05 < pcfreak30> welli sdd to add that
13:06 < pcfreak30> as that setting didnt even exist
13:06 < pcfreak30> ping-restart*
13:06 < pcfreak30> testing
13:07 < pcfreak30> nope
13:07 < pcfreak30> still the same
13:08 < stony> can you paste the latest log again ?
13:08 < pcfreak30> should i install the 2.2betta5?
13:08 < stony> pcfreak30: no
13:08 < pcfreak30> think it mentiobed the exact error
13:10 < pcfreak30> http://pastie.org/private/vpjz5okkwphwx9tp2gaq
13:10 < stony> pcfreak30: everything was fine ...
13:11 < stony> you hit ctrl+c
13:12 < pcfreak30> no
13:12 < pcfreak30> my connection info didnt change when running
13:12 < pcfreak30> b4
13:12 < pcfreak30> and i get im not allowed to p9ng out
13:12 < pcfreak30> ping google.comderrick@dhammer:~$ ping google.com
13:12 < pcfreak30> PING google.com (74.125.67.99) 56(84) bytes of data.
13:12 < pcfreak30> ping: sendmsg: Operation not permitted
13:13 < stony> Sun Jan  9 14:07:14 2011 Initialization Sequence Completed
13:13 < stony> ^CSun Jan  9 14:07:39 2011 event_wait : Interrupted system call (code=4)
13:13 < stony> Sun Jan  9 14:07:39 2011 SIGTERM received, sending exit notification to peer
13:13 < stony> hm, i wonder what that ^C does on the 2nd line, and the SIGTERM ...
13:13 < pcfreak30> yes i know
13:13 < pcfreak30> i ctrl+c
13:13 < stony> yeah, you have to configure your firewall
13:13 < pcfreak30> b/c i couldnt ping out
13:13 < pcfreak30> for what ports
13:13 < stony> pcfreak30: i really want to help you, but if you lie to me, and i have to proof you wrong, than i won't help you anymore ...
13:14 < pcfreak30> um
13:14 < pcfreak30> please tell me why i would be lieinbg
13:14 < pcfreak30> hats just stupid in the first place
13:14 < stony> pcfreak30: i don't like metadiscussion ether
13:14 < stony> pcfreak30: connect, and try to ping the host you try to reach through the vpn
13:15 < pcfreak30> i bought a service. downloaded the comnfig. installed openvpn. followed instructions on penvpn.net and trying to get in
13:15 < stony> pcfreak30: yeah, but your firewall is blocking outgoing icmp
13:15 < stony> pcfreak30: you have to open your firewall to be able to ping
13:15 < stony> pcfreak30: are you running linux ?
13:15 < pcfreak30> ping what host
13:16 < pcfreak30> and whats ports do i need to allow?
13:16 < stony> icmp doesn't have ports
13:16 < pcfreak30> yes. ubuntu 10.04
13:16 < pcfreak30> i have firestarter
13:16 < pcfreak30> gui
13:17 < stony> all you need is: for i in INPUT FORWARD OUTPUT; do iptables -I $i 1 -p icmp -j ACCEPT; done
13:17 < stony> ppl blocking icmp are just stupid
13:17 < stony> i don't know where they have this crap from
13:17 < pcfreak30> and here i feel like a pc noob. kinda ironic being on that end
13:18 < stony> pcfreak30: just allow icmp incoming, outgoing and forwarded for all hosts
13:19 < pcfreak30> mk i ran that bash loop as root
13:19 < stony> pcfreak30: the Internet Control Message Protocol delivers the error reason why a connection is not working
13:19 < pcfreak30> any other shell scripts
13:19 < stony> (at least most of the time)
13:19 < stony> no, try to ping again
13:19 < pcfreak30> up any ports i do need to open on firestarter?
13:20 < stony> pcfreak30: again: icmp doesn't have ports
13:20 < pcfreak30> i know, just didnt know if i needed anything related to openvpn itself
13:21 < stony> pcfreak30: and what do you want to open in prodigy's song ?
13:21 < stony> connect and try to ping
13:23 < pcfreak30> 4 packets transmitted, 4 received, 0% packet loss, time 15282ms
13:23 < pcfreak30> dam
13:23 < pcfreak30> 4 packets transmitted, 4 received, 0% packet loss, time 15282ms
13:23 < stony> surprise!
13:23 < pcfreak30> it ping out but highly slow
13:24 < stony> yeah, that's because of the other endpoint
13:24 < pcfreak30> not sure of my network info should change in network-manasger and wont connect to google. just hope the service didnt rip me off
13:25 < pcfreak30> now
13:25 < stony> just test and see
13:25 < pcfreak30> iis there any way i can get this going via nwtwork-manager gui
13:25 < stony> maybe you have to check the nameservers
13:25 < stony> don't know
13:25 < pcfreak30> as ive tried to rip the key sets to their own files, but doesnt seem to go.
13:26 < stony> i have no glue, as i'm not running linux
13:26 < pcfreak30> i run linux for a reason though some times i feel things would go smoother in windows
13:27 < stony> pcfreak30: i'm running linux on servers, but not on desktop
13:27 < stony> pcfreak30: if you want a system without testing get winodow or mac os x
13:27 < pcfreak30> so why exactly is it that i can ping but i cant connect to the web.
13:28 < stony> pcfreak30: you have to open the connection to the outer world via the vpn interface
13:28 < pcfreak30> is it a config prob or i got ripped off?
13:28 < pcfreak30> please explain?
13:28 < stony> if you have tun0 something like iptables -A OUTPUT -s 0/0 -d 0/0 -p tcp --dest-port 80 -m state --state NEW -j ACCEPT should do
13:28 < pcfreak30> sry 4v acting like a noob. just never used vpn b4
13:28 < stony> and you need iptables -I INPUT 1 -m state --state related,established -j ACCEPT
13:29 < pcfreak30> so in simple terms without iptables cmds, is there any ports i can open gui wise to do the same
13:30 < stony> pcfreak30: suree, dest port 80
13:30 -!- luneff [~yury@84.51.205.26] has quit [Read error: Connection reset by peer]
13:30 -!- luneff [~yury@84.51.205.26] has joined #openvpn
13:30 < pcfreak30> im not a noob like most. just dont think sometimes and pretty new to doing this. just wish my router supported vpn
13:31 < pcfreak30> i still cant find a cheap model to flash dd-wrt onto. i have wert54gs but only 2 mb flash :(
13:31 < stony> yeah it's ok, please don't start crying
13:31 < pcfreak30> lol funny. i just rly would like to be able to get my xbox in the vpn. just a pain...
13:32 < pcfreak30> ill try to do this. will report back
13:32 < stony> pcfreak30: you need to know how layer2, layer3, routing, bridging and so on works, then you can do that
13:32 < pcfreak30> meh i know networking,just not deep enough i guess
13:32 < stony> it's not about the software you use, it's about to understand the technology behind the software
13:32 < pcfreak30> <stony> pcfreak30: and what do you want to open in prodigy's song ? <-=- whats that supposed to mean?
13:33 < stony> pcfreak30: ah just a typo
13:33 < pcfreak30> and i know
13:34 < Bushmills> pcfreak30: try   ping -n your_host  
13:34 < pcfreak30> stupid question. my host
13:34 < pcfreak30> u mean the vpn server?
13:35 < Bushmills> ping -n the_system_you_are_pinging_which_pings_slowly
13:35 < pcfreak30> btw to allow port 80 on the vpn. i need to open inbound or outbound
13:35 < pcfreak30> oh host as it target.lol. mk
13:35 < stony> pcfreak30: you need to open dest port 80 outbound
13:36 < pcfreak30> interesting. gui is set by permissive, so everything is open, nothing black listed
13:36 < pcfreak30> onoutbound
13:37 < deever> stony: it works now! :)
13:37 < stony> deever: :)
13:37 -!- luneff [~yury@84.51.205.26] has quit [Ping timeout: 240 seconds]
13:37 < stony> deever: error?
13:38 < pcfreak30> wellimean i never opened port 80.i mean beased on the config on firestarter gui its blacklist by default and nothing is blacklisted
13:38 < Bushmills> pcfreak30: for "can ping server but not internet", look at:
13:38 < Bushmills> !redirect
13:38 < Bushmills> hm. look at it once the bot is back
13:39 < deever> what i didn't know until now: on obsd you don't assign ip adresses to bridges, but configure the same network twice (on each member iface) and then bridge them together! :)
13:39 < Bushmills> in the meantime, read in manual about --redirect-gateway
13:39 < pcfreak30> Bushmills, you talking to me?
13:39 < stony> deever: wtf!?
13:40 < stony> Bushmills: it's just it's firewall that is not allowing anything out ...
13:40 < stony> Bushmills: everything else is working
13:40 < Bushmills> pcfreak30: that's why i started with  "pcfreak:"
13:40 < pcfreak30> hmm, didnt see that
13:40 < pcfreak30> lol
13:40 < pcfreak30> nvm,
13:41 < pcfreak30> so all in all to summarize. seems dhcp gives errors on connecting.i can ping extremely slow but i can not access the net due to fwl prob...
13:42 < Bushmills> so disable firewall for testing
13:47 -!- pcfreak30 [~derrick@cpe-098-027-009-128.triad.res.rr.com] has quit [Disconnected by services]
13:47 -!- pcfreak30 [~derrick@64.32.15.130] has joined #openvpn
13:47 < pcfreak30> ...
13:47 < pcfreak30> im in
13:47 < pcfreak30> fwl was screwing everything
13:48 < pcfreak30> had to reconnect though new ip
13:52 < deever> stony: ?
13:53 -!- p3rror [~mezgani@41.248.186.227] has joined #openvpn
13:54 < stony> deever: hm?
14:03 -!- pcfreak30 [~derrick@64.32.15.130] has quit [Ping timeout: 260 seconds]
14:08 < deever> stony: wtf what?
14:11 < stony> deever: eh?
14:13 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:13 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:13 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:18 -!- pcfreak30 [~derrick@cpe-098-027-009-128.triad.res.rr.com] has joined #openvpn
14:28 < stony> do i hit the e-mail-in-dn-problem again?
14:29 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
14:30 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
14:32 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
14:32 < stony> i do
14:32 < stony> *gna*
14:49 -!- p3rror [~mezgani@41.248.186.227] has quit [Ping timeout: 265 seconds]
14:51 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 272 seconds]
14:55 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
15:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
15:16 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
15:17 -!- jambooda1 [~cog@108.sub-174-252-10.myvzw.com] has joined #openvpn
15:18 -!- p3rror [~mezgani@41.140.38.61] has joined #openvpn
15:19 -!- Stava [~Stava@h-86-192.A197.priv.bahnhof.se] has quit [Read error: Connection reset by peer]
15:21 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 276 seconds]
15:25 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
15:27 -!- jambooda1 [~cog@108.sub-174-252-10.myvzw.com] has quit [Remote host closed the connection]
15:28 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
15:40 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
15:48 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Ping timeout: 240 seconds]
15:48 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
15:49 -!- p3rror [~mezgani@41.140.38.61] has quit [Ping timeout: 276 seconds]
15:52 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Remote host closed the connection]
15:54 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
15:57 -!- sia_ is now known as sia^pwnnt
16:12 -!- djgerm [~Your_Moms@c-67-169-142-196.hsd1.ca.comcast.net] has joined #openvpn
16:16 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Remote host closed the connection]
16:17 -!- p3rror [~mezgani@41.140.159.175] has joined #openvpn
16:22 -!- pcfreak30 [~derrick@cpe-098-027-009-128.triad.res.rr.com] has quit [Read error: Operation timed out]
16:22 -!- pcfreak30 [~derrick@cpe-098-027-009-128.triad.res.rr.com] has joined #openvpn
16:26 -!- jonkri [~jonkri@pontarius/jon] has joined #openvpn
16:26 < jonkri> !welcome
16:26 < jonkri> !goal
16:27 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
16:27 < jonkri> does openvpn support using openvpn using the control panel etc (without using a console or the openvpn gui package or whatever)?
16:35 < Bushmills> many use a text editor to edit the config files
16:35 < Bushmills> after that, it is just turning on and off. no gui needed for that
16:36 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Remote host closed the connection]
16:48 < jonkri> i don't know if that's acceptable for me from a usability and/or software dependency perspective
16:48 < jonkri> thanks Bushmills 
16:49 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
16:49 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
16:49 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:52 < Bushmills> jonkri: tendency seems to be that windows users prefer a toolbar applet for turning on and off openvpn, possibly because it is more clumsy there to run a connect script
16:53 < Bushmills> otoh, most users i know run let the system run openvpn during boot, and keep it running all the time
16:53 < Bushmills> therefore no user interface needed
17:18 < jonkri> ok, maybe that is the way to go then
17:19 < jonkri> are there no open source vpn servers that work with windows vpn configuration?
17:27 -!- s7r [~s7r@83.170.111.154] has left #openvpn []
17:29 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has quit [Remote host closed the connection]
17:29 -!- common [~common@p5DDA4406.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
17:29 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has joined #openvpn
17:32 -!- js_ [~js@213.180.83.163] has quit [Ping timeout: 276 seconds]
17:33 -!- js_ [~js@213.180.83.163] has joined #openvpn
17:34 -!- pcfreak30 [~derrick@cpe-098-027-009-128.triad.res.rr.com] has quit [Ping timeout: 276 seconds]
17:37 -!- common [~common@p5DDA4406.dip0.t-ipconnect.de] has joined #openvpn
17:38 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
17:44 -!- pcfreak30 [~derrick@cpe-098-027-009-128.triad.res.rr.com] has joined #openvpn
17:45 < krzie> jonkri, sure there are, but you wont get support for them here
17:45 < krzie> !pptp
17:46 < krzie> wtf!
17:47 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
17:47 -!- mode/#openvpn [+o vpnHelper] by ChanServ
17:47 < krzie> !version
17:47 <@vpnHelper> The current (running) version of this Supybot is 0.83.4.1.  The newest version available online is 0.83.4.1.
17:47 < krzie> grr
17:48 < krzie> jonkri, 
17:48 < krzie> !pptp
17:48 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read about
17:48 <@vpnHelper> why to not use pptp
17:48 < krzie> thats the ms protocol
17:51 -!- WinstonSmith [~true@g231241009.adsl.alicedsl.de] has joined #openvpn
17:51 < jonkri> ah, thanks
17:53 < jonkri> will use openvpn then :) just curious - are there any commercial products working with this default windows vpn configs? (are they using pptp?)
18:03 < Bushmills> yes. windows.
18:04 < jonkri> ok, thanks
18:04 < jonkri> good night people!
18:04 -!- jonkri [~jonkri@pontarius/jon] has quit [Quit: Leaving]
18:04 < Bushmills> though the term "working" would need clarification
18:05 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
18:13 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
18:17 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
18:48 -!- britt [~britt@h53.56.141.67.static.ip.windstream.net] has joined #openvpn
18:49 < britt> good evening. I am trying to configure OpenVPN with a bridged network interface (layer 2) and tried to test this in OSX. I read this only works successfully in Windows. Is this still a true fact?
18:53 < |Mike|> try reading the topic and follow the steps
18:53 < britt> !welcome
18:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:55 < Bushmills> britt: i heard that OSX doesn't support bridges.  linux otoh does.
18:55 < britt> Bushmills: thank you. That's actually a very helpful response.
18:56 < Bushmills> !tunortap
18:56 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
18:56 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
18:56 < britt> The only reason I would need Layer2 is for Windows SMB packets and NetBios stuff. I want to allow users on the VPN to access thier shared drives
18:57 < britt> hah
18:57 < Bushmills> then #2 would apply
18:57 < britt> !wins
18:57 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
18:58 < britt> Bushmills: excellent. Already doing that on my Samba instance. Thanks for you help. |Mike| thanks for telling me to check the topic
18:59 < |Mike|> yw
19:03 -!- britt is now known as heyyyy
19:03 -!- heyyyy is now known as bd1308
19:04 -!- p3rror [~mezgani@41.140.159.175] has quit [Ping timeout: 255 seconds]
19:05  * bd1308 <3|Mike|
19:05 < |Mike|> err?
19:05 < |Mike|> rtfm or die :-)
19:05 < |Mike|> (c) 2011
19:07 < bd1308> |Mike|: how concise mike. so many thoughts in so few words. congrats on the copyright
19:07 < |Mike|> now you have to pay me.
19:08 < bd1308> |Mike|: I only have a money order for $5000 from nigeria. can you provide change
19:09 < |Mike|> mossad can handle *
19:09 < bd1308> excellent
19:10 < |Mike|> smartiepants, nice to know you. I have to inform you that're ignored for now 2011/01/10 02:10:40
19:11 < bd1308> excellent
19:11 < |Mike|> CET.
19:12 < bd1308> Bushmills: thanks for being helpful man. I appreciate it. Nice to know there's some good people still on IRC. I've already got the config in samba setup, so i'll give that a try. It didnt appear OSX would do bridges so i'll try the other way. Thanks.
19:13 < Bushmills> np
19:15 -!- Bebop2Steady [~Bebop2Ste@124-149-37-222.dyn.iinet.net.au] has joined #openvpn
19:16 -!- WinstonSmith [~true@g231241009.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
19:21 -!- pcfreak30 [~derrick@cpe-098-027-009-128.triad.res.rr.com] has quit [Read error: Operation timed out]
19:22 -!- pcfreak30 [~derrick@64.32.15.130] has joined #openvpn
19:23 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
19:24 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Ping timeout: 265 seconds]
19:29 -!- WinstonSmith [~true@f052101172.adsl.alicedsl.de] has joined #openvpn
19:31 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Remote host closed the connection]
19:37 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
19:45 -!- pcfreak30 [~derrick@64.32.15.130] has quit [Quit: Leaving]
19:50 -!- jambooda1 [~cog@pool-98-109-218-165.nwrknj.fios.verizon.net] has joined #openvpn
19:51 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
19:54 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 240 seconds]
20:02 -!- p3rror [~mezgani@41.140.97.34] has joined #openvpn
20:08 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
20:10 -!- jambooda1 [~cog@pool-98-109-218-165.nwrknj.fios.verizon.net] has quit [Ping timeout: 240 seconds]
20:26 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
20:32 -!- Bushmills [~l@scarydevilmonastery.net] has left #openvpn []
20:44 -!- Bushmills [~l@scarydevilmonastery.net] has joined #openvpn
20:46 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
20:46 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
20:46 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:54 < derekv> I doubt this is news to anyone, but it seems like I can run openvpn as the command line as an unprivliged user in windows, the only thing that snags is adding the route
20:55 < derekv> Thats a heck of a thing if its the only hang up
20:57 -!- p3rror [~mezgani@41.140.97.34] has quit [Ping timeout: 240 seconds]
21:00 < derekv> one can push routes over dhcp
21:01 < derekv> windows should accept it since that is how its receiving the ip address
21:10 -!- p3rror [~mezgani@41.140.29.16] has joined #openvpn
21:15 < derekv> ahh... "When OpenVPN is running as a service, it will make a "best-effort" to remain always connected.  That means that whenever it senses that it can reach the server, it will try to connect, and when the server is not reachable or the internet connection is down, it will go into a wait state." (-Yonen.. a long time ago)
21:16 < derekv> So the only thing your losing out on is a bit of manual control and a nifty status tray icon 
21:16 < derekv> And those things should eventually be fixed.
21:17 < derekv> If I understand correctly.
21:30 < derekv> and the ability to very strong protections on the keyfile I guess
21:32 <@vpnHelper> RSS Update - forum: [newbie/2.0.9] Checking that OpenVPN is OK? <http://forums.openvpn.net/topic7487.html#p9036>
21:38 <@vpnHelper> RSS Update - forum: Help sharing printers in openvpn and windows xp <http://forums.openvpn.net/topic7492.html#p9038> || To change port <http://forums.openvpn.net/topic7493.html#p9037>
21:46 < Bebop2Steady> For openvpn service sellers (selling access to openvpn servers for web browsing etc), what would be the best method for authenticating users?
21:47 < Bebop2Steady> by 'best' I mean easiest to automate
21:50 < Bebop2Steady> eurephia.net looks good for an automated system, but the manual says its for TAP only.
21:53 < krzie> derekv, the ability to put ANY protections on the keyfile, other than filesystem permissions
21:55 < derekv> krzee, Yea I put filesystem permissions in the group of "not very strong protections"
21:56 < derekv> krzie 
22:17 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
22:21 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
22:21 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
22:25 < Bebop2Steady> auth-user-pass-verify + client-cert-not-required + username-as-common-name looks to be the easiest to automate with scripts i guess.
22:33 < krzie> aka
22:33 < krzie> !authpass
22:33 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
22:42 -!- alhadi [~thunderst@188.95.51.165] has joined #openvpn
22:46 < Bebop2Steady> User/pass is highly *not* recomended why? I am guessing the idea is that a cert is harder to steal?
22:50 < krzie> will you be auditing against brute forcing?
22:50 < krzie> basically, when you ONLY use passwords, your entire vpn is as secure as your password
22:50 < krzie> but for what you were talking about, maybe thats ok to you
22:51 < krzie> personally, none of my setups will be only password
22:51 < krzie> i use 4096bit rsa certs, with passphrases on the keys
22:55 < Bebop2Steady> I will be auditing against brute forcing, and then blocking with iptables..
22:58 -!- WinstonSmith [~true@f052101172.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
22:59 < Bebop2Steady> Automation is the killer for me. I'm not profficent enough with linux to script up an automated system for managing users + certs for a VPN chain (where they need to be auth'd by two seperate servers).
23:03 < Bebop2Steady> by 'they' i mean end-users... 
23:05 < Bebop2Steady> Actually.. with vpnchains it would be interesting to just disable auth all-togther once the end-users are inside the first VPN/LAN 
23:05 < Bebop2Steady> Then just manage certs for the entry server, that would be managable.
23:15 < derekv> From reading the docs, it says here that the probability of finding yourself in a universe compatible with your existence is 1...
23:16 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:17 < Bebop2Steady> Unless you never find yourself.
23:17 -!- bd1308 [~britt@h53.56.141.67.static.ip.windstream.net] has quit [Quit: leaving]
23:19 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
23:22 < Bebop2Steady> also, quote: "If you go back 10 generations (250 years) the chance of you being born at all is  at most 1 divided by 6 x 10100" .. so I dare say, your chances of finding yourself in a universe compatible with your existence has to be equal or less than 1 divided by 6 x 10100
23:23 < Bebop2Steady> 6 x 10 exp 100
23:23 < Bebop2Steady> aka 1 in 60000000000000000000000000000000000 00000000000000000000000000 000000000000000000000000000000000000
23:27 < Bebop2Steady> so, the probabilty of *finding yourself* in a compatible universe cannot be 1, since *finding yourself* first requires *existing* 
23:28 < djgerm> !multidimensional_philosophy
23:28 < djgerm> hmmm no entry...
23:29 -!- djgerm [~Your_Moms@c-67-169-142-196.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
23:49 -!- alhadi [~thunderst@188.95.51.165] has quit [Read error: Connection reset by peer]
23:50 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
--- Day changed Mon Jan 10 2011
00:07 -!- sht [sht@2607:f0d0:2001:8b::50:1337] has quit [Read error: Operation timed out]
00:08 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:09 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
00:34 -!- sht [sht@2607:f0d0:2001:8b:20c:29ff:fe08:9753] has joined #openvpn
00:36 -!- Xen^ [~linux@vpn.server4sale.com] has joined #openvpn
00:37 -!- fahmad [~linux@unaffiliated/fahmad] has quit [Ping timeout: 260 seconds]
00:38 -!- Bebop2Steady [~Bebop2Ste@124-149-37-222.dyn.iinet.net.au] has quit [Ping timeout: 248 seconds]
00:54 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
01:08 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 264 seconds]
01:11 -!- takamichi [Takamichi@85.232.213.54] has joined #openvpn
01:25 -!- dazo_afk is now known as dazo
01:27 <@vpnHelper> RSS Update - forum: how to add a kernel's route on the openvpn server? <http://forums.openvpn.net/topic7219.html#p9039>
01:28 -!- fipu_ [c341fe04@gateway/web/freenode/ip.195.65.254.4] has joined #openvpn
01:28 < fipu_> Hi guys
01:29 < fipu_> I use openvpn access server
01:29 < fipu_> how can I set the VPN-Server IP (in the VPN)?
01:29 < fipu_> I use 10.1.1.0/24 and want that the server get 10.1.1.1 that the server is reachable by the clients
01:30 < fipu_> actually if I make a traceroute to 10.1.1.1 from a Client in the VPN (10.1.1.100) then the first hop is 5.5.0.1 (VPN-Server?)
01:54 < kraut> moin
01:54 < fipu_> moin kraut 
01:54 < fipu_> kennst du dich mit dem access server aus?
01:54 < kraut> access server?
01:54 < kraut> ich kenn mich nur mit dem "community" server aus
01:55 < hyper_ch> !english
01:55 < kraut> davon ab, bitte englisch verwenden.
01:55 < kraut> hyper_ch: calm down
01:55 < fipu_> :P
01:55 < hyper_ch> too bad there's no factoid
01:56 < fipu_> mh, so can someone help me with my problem?
01:56 < hyper_ch> kraut: did you see me shout?
01:56 < fipu_> and get another problem now
01:56 < kraut> fipu_: if you don't tell me what's your problem is, i can't help you.
01:56 < fipu_> I disabled "Should clients be allowed to access network services on the VPN gateway IP address?" but I can still ping the VPN-Server
01:56 < kraut> gui?!
01:56 < fipu_> let us check this one first please :)
01:57 < fipu_> that's the bigger problem
01:59 -!- albech [~thomas@119.42.78.59] has joined #openvpn
02:00 < fipu_> kraut: ?
02:00 < kraut> are you talking about any gui?
02:01 < fipu_> What do you mean with any gui?
02:01 < kraut> graphical user interface
02:01 < fipu_> I know
02:01 < fipu_> Client is a windows xp sys
02:02 < fipu_> otherwise I don't know what you mean with gui
02:02 < fipu_> openvpn access server webUI
02:02 < fipu_> :)
02:02 < fipu_> If you mean that
02:02 < kraut> where did you enabled this option? within the configuration file or with a gui?
02:02 < kraut> webui!?
02:03 < fipu_> yes?
02:03 < fipu_> not good?
02:03 < kraut> hmm, i have no idea about this a ccess server
02:03 < fipu_> ok...
02:03 < fipu_> someone else?
02:03 < hyper_ch> any reason why you use access server?
02:04 -!- zamba [marius@flage.org] has joined #openvpn
02:04 < kraut> fipu_: normally with the community server (i hate this naming) you need just the option "client-to-client"
02:04 < fipu_> I know
02:04 < fipu_> I used the "non gui" server before
02:05 < fipu_> hyper_ch: yes, Client management
02:05 < fipu_> and see connected user
02:05 < fipu_> easy revoke certificates etc.
02:06 < krzie> !AS
02:06 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
02:06 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
02:06 < krzie> #4
02:06 < krzie> we dont support AS here
02:12 < hyper_ch> good morning krzie
02:12 < krzie> moin
02:13 < krzie> playin with my cgi's
02:13 < hyper_ch> that sounds rather dirty ;)
02:13 < krzie> ;]
02:15 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:16  * dazo things cgi's is so 1990.....
02:17 <@dazo> s/ings/inks/
02:24 < krzie> sure, but perfect for this
02:25 < krzie> i never needed them in the 90's
02:25 < krzie> ;]
02:40 -!- zakx [zakx@gentoo/contributor/zakx] has left #openvpn []
02:55 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
03:14 -!- Malard [~ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
03:15 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
03:16 -!- mrle0 [~fin@82.132.243.47] has joined #openvpn
03:16 -!- Malard|Home [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
03:16 -!- Malard|Home [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
03:16 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
03:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:18 -!- nb [~nb@fedora/nb] has quit [Read error: Operation timed out]
03:20 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
03:22 -!- nb [~nb@fedora/nb] has joined #openvpn
03:29 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
03:31 -!- mrle0 [~fin@82.132.243.47] has quit [Quit: Leaving]
03:41 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
03:48 -!- master_of_master [~master_of@p57B52F1C.dip.t-dialin.net] has quit [Read error: Operation timed out]
03:52 -!- master_of_master [~master_of@p57B56916.dip.t-dialin.net] has joined #openvpn
03:53 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
03:56 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
04:02 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:08 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 240 seconds]
04:21 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:21 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:41 -!- common- [~common@p5DDA4467.dip0.t-ipconnect.de] has joined #openvpn
04:44 -!- common [~common@p5DDA4406.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
04:44 -!- common- is now known as common
05:01 <@vpnHelper> RSS Update - forum: Can somebody help me with OPENVPN Please? <http://forums.openvpn.net/topic7495.html>
05:06 -!- Bebop2Steady [~Bebop2Ste@124.169.156.37] has joined #openvpn
05:11 -!- Visual` [~visualsta@unaffiliated/visualstation] has quit [Quit: leaving]
05:26 -!- s7r [~s7r@178.16.22.27] has joined #openvpn
05:36 -!- s7r [~s7r@178.16.22.27] has quit [Ping timeout: 240 seconds]
05:37 -!- WinstonSmith [~true@e177089065.adsl.alicedsl.de] has joined #openvpn
05:37 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 260 seconds]
05:38 -!- s7r [~s7r@212.117.186.78] has joined #openvpn
05:46 -!- Xen^ [~linux@vpn.server4sale.com] has quit []
05:50 -!- fipu_ [c341fe04@gateway/web/freenode/ip.195.65.254.4] has quit [Ping timeout: 265 seconds]
05:54 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:56 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Operation timed out]
05:56 -!- Cain` is now known as Cain
06:10 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
06:10 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
06:10 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:15 < Bebop2Steady> Good bash script around for generating client certs, with 1 argument passed (common name/username)?
06:20 < kraut> easy-rsa?
06:23 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
06:23 < Bebop2Steady> oh yea.. i mean easy rsa
06:27 < Bebop2Steady> I could have been more clear... specifically I mean adfding new clients later. so if/when i randomly need to add a client, I dont have to go looking up tutorials and guides and risk stuffing something up.
06:30 < Bebop2Steady> !auth
06:30 < Bebop2Steady> !welcome
06:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:35 < Bebop2Steady> 'build-key' looks like the main one I shoudl be doing per new client
06:38 <@dazo> Bebop2Steady: that sounds correct to me .... or build-key-pass if you want to password protect the key ... or build-key-pkcs12 if you want a certificate/key bundle (one file containing CA cert, client cert and client key)
06:39 < Bebop2Steady> thx.. I have been following a wiki.. and i think the prob is that i keep doing too many steps for new clients
06:39 <@dazo> Bebop2Steady: which wiki?
06:40 < Bebop2Steady> http://library.linode.com/networking/openvpn/debian-5-lenny
06:40 <@vpnHelper> Title: Deploy VPN Services with OpenVPN - Secure Communications with OpenVPN on Debian 5 (Lenny) - Linode Library (at library.linode.com)
06:40 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
06:40 <@dazo> you basically need to do the . ./vars thing and then ./build-key{,-pass,-pkcs12} ... and then copy the needed files to the new client, and that's it
06:41 < Bebop2Steady> ahh so the . ./vars is required for every new client?
06:41 <@dazo> not every new client ... but each time you close the your shell
06:41 <@dazo> . ./vars prepares several environment variables for you
06:42  * dazo finds that as a completely silly way of doing it ... but I might not see the complete picture
06:42 <@dazo> (however, my opinion is about the easy-rsa implementation, and nothing else)
06:42 < Bebop2Steady> and for each new client i generate, .. how many files are new?
06:43 < Bebop2Steady> I guess these 2:
06:43 < Bebop2Steady> client1.crt
06:43 < Bebop2Steady> client1.key
06:43 <@dazo> client.key and client.crt  (their names will change, according to the "client name" you provide)
06:43 <@dazo> so you need client.{key,crt} and ca.crt to be sent to the client
06:43 <@dazo> if you use the -pkcs12 ... you only get a client.p12 file instead
06:43 < Bebop2Steady> and ca should always be the same..
06:43 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
06:43 <@dazo> yes
06:44 < Bebop2Steady> and the .conf or .ovpn can stay same too....
06:44 <@dazo> CA is always the same ... that is the certificate of the instance signing the key ... and the clients use ca.crt to validate the server
06:44 <@dazo> you'll need to adopt the conf file to match the name of the client keys/cert files ... everything else stays the same
06:45 <@dazo> (re: CA ... the ca.crt is also used on the server side, to validate the client certificates .... and the complete easy-rsa directory do not need to stay on the openvpn server at all, in fact it is recommended to not have it on the openvpn server)
06:46 < Bebop2Steady> well that is an interesting point..
06:46 < Bebop2Steady> the rsa tools sometimes say "commit?" and database updated
06:47 <@dazo> yeah, it's means updating the CA files in the easy-rsa dir (or wherever you set the CA path in ./vars)
06:47 < Bebop2Steady> what is this database? and does it mean I cant use a seperate location/node/hardware to take care of generating certs and ca stuff ?
06:47 <@dazo> it's in fact that directory which should be super-duper secret ... and can be completely offline when you don't need to sign new keys
06:48 < Bebop2Steady> ahh the db is a dir
06:48 <@dazo> the database is basically a register over all keys that CA have signed
06:49 <@dazo> and since easy-rsa also creates keys, signing requests and certificates and stores them ... it is highly recommended to have them on a completely different box
06:49 < Bebop2Steady> i prefer to have them on a dif box..
06:49 < Bebop2Steady> can they be generated/created on the different box, and then scp'd to the vpn server ?
06:49 <@dazo> and if you loose the ca.key (or it gets stolen) ... you can't trust your CA any more ... as other can then create new client certificates 
06:50 <@dazo> Bebop2Steady: yes, you can create all on a different box ... and the server only needs server.key, server.crt and ca.crt ... nothing more
06:50 < Bebop2Steady> oh thats great :]
06:50 <@dazo> (well, dh.pem might come in addition)
06:50 < Bebop2Steady> i can stop make a mess of all these files on my vpn
06:50 <@dazo> that's the core principle of PKI ... the trusted third party, which client and server trusts 
06:51 -!- alhadi [~thunderst@188.95.51.165] has joined #openvpn
06:52 < Bebop2Steady> thank you for this much valued information / insight. I can get to work on some tiny up.. full restart actually.
06:52 <@dazo> :)
06:52 <@dazo> Bebop2Steady: you're welcome!
06:53 < alhadi> hello
06:53 < Bebop2Steady> :] thx 
06:53 <@dazo> !welcome
06:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:53 <@dazo> alhadi: ^^^
06:54 < alhadi> i see
06:54 < alhadi> :)
06:54 < alhadi> !logs
06:54 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
06:54 < alhadi> one moment i'll set verb to 5
06:55 < alhadi> !pb
06:55 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
06:56 -!- mrle0 [~fin@85.69.2.81.in-addr.arpa] has joined #openvpn
07:06 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
07:09 -!- mrle0 [~fin@85.69.2.81.in-addr.arpa] has quit [Read error: Operation timed out]
07:11 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
07:12 -!- mrle0 [~fin@85.69.2.81.in-addr.arpa] has joined #openvpn
07:12 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
07:16 -!- Stylles [bd0b38eb@gateway/web/freenode/ip.189.11.56.235] has joined #openvpn
07:16 < Stylles> Hi
07:18 -!- macsppadic is now known as Directorsppadic
07:33 -!- Stylles [bd0b38eb@gateway/web/freenode/ip.189.11.56.235] has quit [Ping timeout: 265 seconds]
07:40 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:40 -!- gladiatr [~gladiatr@madeline.boneyard.lawrence.ks.us] has joined #openvpn
07:47 -!- mrle0 [~fin@85.69.2.81.in-addr.arpa] has quit [Quit: Leaving]
07:55 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:59 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Quit: Leaving]
07:59 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
08:04 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
08:04 -!- iceberg is now known as bmmcwhirt
08:05 -!- bmmcwhirt [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Client Quit]
08:05 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
08:05 -!- iceberg is now known as bmmcwhirt
08:30 -!- theDoc [~Link@bb219-74-102-217.singnet.com.sg] has joined #openvpn
08:31 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
08:37 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
08:46 < peper> hello
08:47 < peper> I have followed http://openvpn.net/index.php/open-source/documentation/howto.html#pki
08:47 <@vpnHelper> Title: HOWTO (at openvpn.net)
08:47 < peper> and the tunnel seems to be set up correctly
08:48 < peper> but when I ping I see in the interface stats the packates are sent
08:48 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
08:48 < peper> but no replies are coming back
08:48 < peper> any common pitfalls?
08:48 -!- bmmcwhirt [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Read error: Connection reset by peer]
08:51 -!- theDoc [~Link@bb219-74-102-217.singnet.com.sg] has quit [Quit: Lost terminal]
08:52 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
08:54 < dschuett> peper: what OS are you running the server on?
08:56 < peper> dschuett: linux
08:56 -!- rjd_ [~rjd@212.112.31.11] has joined #openvpn
08:56 < peper> dschuett: i see the pings on both the client an server interfaces
08:56 < peper> but no responses sent back
08:58 < dschuett> pastebin your server and client configs
08:58 <@dazo> peper: sounds like routing is wrong ... on the server, check with tcpdump on your internal lan interface and your tun/tap device ... to see where the packets go
08:58 < peper> dazo: i checked tcpdump -i any and I can only see the ICMP echo
08:58 < peper> no replies
08:59 < peper> I currently use one box for client and server for testing
08:59 <@dazo> peper: is your openvpn server also the default gateway for your LAN?
08:59 < peper> no
09:00 < peper> http://paste.pocoo.org/show/318297/
09:00 <@dazo> peper: that might be the reason ... try to either set the route to your VPN subnet on the client you're trying to reach, or on the default gateway ... so that your VPN subnet goes via the LAN interface of your openvpn server
09:00 < peper> client and server conf, ifconfig and route output
09:01 <@dazo> peper: and if that's not working ... check firewalls 
09:02 <@dazo> peper: when you say tcpdump -i any and I can only see the ICMP echo ... I presume you see ICMP echo going out on your LAN interface on your openvpn server
09:02 < dschuett> peper: yes you will more than likely have to set a route since your are not using the openvpn server on your default gw - as dazo said.
09:03 < peper> could you give me an example?
09:03 < peper> it seems like some routes has been added
09:04 <@dazo> but you need it also either on a) your default gateway (which is not your openvpn server, as you said)  or   b)  on the LAN client itself you are trying to ping
09:04 <@dazo> you then need a route like:  route add -net <your VPN subnet> netmask <VPN subnet mask> gw <OpenVPN LAN IP addr>
09:04 < peper> it's the same box
09:05 <@dazo> then we're away from the fast track
09:05 <@dazo> !logs
09:05 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
09:05 <@dazo> !configs
09:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
09:05 <@dazo> !goal
09:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:13 < Bebop2Steady> I have same problem once. Solved it witrh:      iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
09:21 -!- daguz1 [~leo@208.1.63.50] has left #openvpn []
09:22 -!- dschuett [~dschuett@216.229.21.250] has quit [Ping timeout: 276 seconds]
09:25 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
09:28 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:37 < ecrist> hola
09:37 -!- Irssi: #openvpn: Total of 125 nicks [2 ops, 0 halfops, 0 voices, 123 normal]
09:37 < Bebop2Steady> I've a theoretical question:  Can a route be pushed from the 3rd node back to the laptop.. I am curious can the route get thru the middle node which has no server instance? http://i52.tinypic.com/2dkhded.jpg
09:38 < Bebop2Steady> ( also, hola ecrist)
09:42 < Bebop2Steady> I'm thinking the answer to be *no*, unless clients can push routes to servers also...
09:45 < gladiatr> If I'm reading your diagram correctly and understanding your question properly, I would say that you wouldn't need to.  If CountryC and B are aware of each other, route-wise, your client system would be able to communicate with B
09:46 -!- luneff [~yury@84.51.195.188] has joined #openvpn
09:46 < Bebop2Steady> thx for response.  country A has got client-to-client mode off.. laptop wants to be able to ping country C   
09:47 < gladiatr> ohhh... I see
09:48 < Bebop2Steady> I'm pushing route from C (server) to B (client)... and then.. I cant see how to push it further back to A
09:49 < Bebop2Steady> I can put a Server instance on B though.. and push it with that.. just wondering if its necessary, logically and technically.
09:49 < gladiatr> That would require (I think), an iroute and a route definition on server A to set up return routes for getting packets sent to server C.  
09:49 < Bebop2Steady> ahh OK.. I have route + iroute on C... so should have it on A too ?
09:50 < gladiatr> I'm thinking that would take care of it
09:51 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
09:55 < Bebop2Steady> thx for your help.. ima head off n try it.
09:56 < Bebop2Steady> 3am here though. so better sleep b4 i get too tited.
09:56 -!- Bebop2Steady [~Bebop2Ste@124.169.156.37] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
10:14 -!- Chris___ [goose@well.i.made.ur-mom.go.honk-honk.org] has joined #openvpn
10:15 < Chris___> I'm having an issue with my VPN connection, that I can't preform DNS lookups, so I can't effectively do anything :/
10:15 < gladiatr> windows client?
10:16 < gladiatr> Chris___, is this a windows client?
10:16 < Chris___> no, Debian Squeeze
10:16 < Chris___> I've tried manually assigning 8.8.8.8 and 8.8.4.4 as DNS servers in the network-manager config, but that hasn't fixed it
10:17 < gladiatr> oh... network manager... /shudder
10:17 < Chris___> lol
10:17 < gladiatr> I'm not trying to blow you off, honestly, but I would get in touch with the debian package mantainer for the openvpn plugin
10:17 < Chris___> although when I'm "connected" I can't ping 10.8.0.1, so I'm not sure *where* the issue is
10:18 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
10:18 < Chris___> well, I've used the debian openvpn plugin on my previous install without a hitch
10:18 < gladiatr> It is *supposed* to update your dns client settings.  If it's not, it's not an openvpn issue, but an issue with network manager
10:18 < Chris___> I think I might've just broke something in my setup
10:18 < Chris___> any way I can just check to make sure the issue is with network-manager and not openvpn?
10:19 < gladiatr> Unless your openvpn binary is actually broken, you're dealing entirely with network manager for your configuration and connection management.
10:20 < iceberg> Friday krzie helped me get my OpenVPN where I can access my local network, now I am trying to add tunneling all traffic through the VPN.   OS=FreeBSD 8.1    Configs: pastebin.com/k20UarHD    
10:20 < gladiatr> Appologies to anyone in That Particular Business, but network manager is great when it works, but it's a right, proper whore to troubleshoot when it isn't
10:21 -!- SOG [~SOG@n11649233199.netvigator.com] has joined #openvpn
10:21 < Chris___> alright, I'll try #Debian then
10:21 < gladiatr> cool.  good luck, man
10:21 < peper> dazo: sorry, had to go away for a bit. my goal is to test a secure connection between 2 hosts
10:22 < gladiatr> SOG... does that mean something besides "somewhat wetter than damp"?
10:22 < peper> dazo: and I wanted to do that on a single host
10:23 < peper> cause the other host has a firewall and I don't want that getting in the way
10:24 -!- idle-boy [~idle-boy@nat/yahoo/x-ikvfubrpwgkyivuo] has quit [Ping timeout: 260 seconds]
10:24 < Chris___> I lied, also. I can do dns lookups from shell with "host", but that's it, can't ping my server host, or do anything else
10:26 -!- albech [~thomas@119.42.78.59] has quit [Quit: Ex-Chat]
10:27 < gladiatr> can you do lookups normally before you make your openvpn connection?
10:27 < Chris___> with "host"? yes
10:27 < Chris___> "host" works before and after I make the vpn connection
10:27 < peper> dazo: server conf: http://paste.pocoo.org/show/318343/ client conf http://paste.pocoo.org/show/318344/
10:28 < gladiatr> are you running nscd by any chance?
10:28 -!- dazo is now known as dazo_afk
10:29 < peper> route: http://paste.pocoo.org/show/318345/ ifconfig http://paste.pocoo.org/show/318346/
10:29 < Chris___> ..oh wait
10:30 < Chris___> I think I"m an idiot
10:30 < gladiatr> lol
10:30 < gladiatr> do tell
10:31 -!- goose [~goose@samson.honk-honk.org] has joined #openvpn
10:31 < goose> for future reference, I'm a gorram idiot. I forgot to enable compression in my client-side config.
10:31 -!- goose is now known as Guest68482
10:32 < peper> dazo_afk: by seeing icmp echo requests I meant that I see 17:31:52.398825 IP 10.8.0.6 > 10.8.0.1: ICMP echo request, id 38942, seq 70, length 64
10:32 < peper> dazo_afk: on both tun0 and tun1
10:32 -!- Guest68482 is now known as goose
10:32 < peper> dazo_afk: and I don't see any replies sent on -i any even
10:32 -!- goose [~goose@samson.honk-honk.org] has quit [Client Quit]
10:34 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
10:34 -!- d303k [~heiko@vpn.astaro.de] has quit [Remote host closed the connection]
10:37 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
10:41 -!- Directorsppadic [~sonupunno@88.211.55.77] has left #openvpn []
10:45 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
10:47 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
10:47 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Remote host closed the connection]
10:48 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
10:49 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
10:53 -!- dazo_afk is now known as dazo_afk_afk
10:54 -!- SOG_ [~SOG@solution1.hsia.citycenter.com] has joined #openvpn
10:55 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 264 seconds]
10:56 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
10:56 < morbidwar> !help
10:56 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
10:57 < morbidwar> does anybody have a tutorial on how to setup a "roadwarrior" scenario in openvpn?
10:58 -!- SOG [~SOG@n11649233199.netvigator.com] has quit [Ping timeout: 240 seconds]
10:58 -!- SOG_ is now known as SOG
10:59 < gladiatr> wetter than damp--dryer than soaked: It's SOG!
10:59 < gladiatr> :D
10:59 < gladiatr> sorry
10:59 < iceberg> I found it humorous 
11:01 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
11:08 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
11:28 -!- LeRrA [~lerra@c-d09872d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
11:31 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
11:40 -!- p3rror [~mezgani@41.140.29.16] has quit [Ping timeout: 240 seconds]
11:41 <@vpnHelper> RSS Update - forum: Can somebody help me with OPENVPN Please? <http://forums.openvpn.net/topic7495.html#p9041>
11:49 < iceberg> anyone here know how to configure FBSD for 'redirect-gateway'  I thought I had my nat set correctly but still no go  config: http://pastebin.com/k20UarHD
11:49 < ecrist> sysctl net.inet.ip_forwarding=1
11:49 < ecrist> sysctl net.inet.ip.forwarding=1
11:49 < ecrist> the second one
11:50 < iceberg> yea that is set by rc.conf with enable_gateway="YES"
11:50 < ecrist> yup
11:50 < iceberg> that doesnt solve my problem Ie had that the whole time
11:51 < iceberg> I tried enabeling opfw nat as suggested elsewhere on the net but that didnt help either
11:51 < ecrist> how about sharing specifically what you want to do
11:52 < ecrist> do you have a freebsd machine as a server for an openvpn network, and you want to route client internet connections through the vpn server?
11:52 <@vpnHelper> RSS Update - forum: [newbie/2.0.9] Checking that OpenVPN is OK? <http://forums.openvpn.net/topic7487.html#p9042>
11:53 -!- p3rror [~mezgani@41.140.35.17] has joined #openvpn
11:53 < iceberg> Friday krzie helped be get my basid openvpn set up, so I can access my 10.2.2 subnet that all works fine, now I am just trying to add in the pass everything through the vpn.  server is FBSD 8.1 and various clients but my test client is Mac OS X tunelblick
11:54 < ecrist> I can't help if you use ipfw, but if you use pf, I can.
11:54 < ecrist> !bsdnat
11:54 <@vpnHelper> "bsdnat" is see !fbsdnat
11:54 < ecrist> !fbsdnat
11:54 <@vpnHelper> "fbsdnat" is see http://cavanantha.wordpress.com/2007/09/16/nat-on-freebsd-using-pf/ for a basic howto for NAT on FreeBSD
11:54 < iceberg> Im not biased so I can switch Ive never used pf so it'll be new to me
11:55 < ecrist> imho, pf is considerably more powerful than ipfw, and I used to be an ipfw user
11:55 < iceberg> that link is a 404
11:55 < ecrist> blast
11:55 < iceberg> pf is the netBSD firewall port correct?
11:55 < ecrist> gah, no
11:55 < ecrist> openbsd
11:56 < gladiatr> pf = happy making
11:56 < iceberg> eww
11:56 < ecrist> freebsd backports it into the kernel.
11:56 < iceberg> theo = bad
11:56 < ecrist> edit /etc/pf.conf
11:57 < ecrist> add nat on $wan_if from 10.0.2.0/24 to any -> wan.ip
11:57 < ecrist> change wan_if and the IP subnet and wan.ip to the right values
11:57 < ecrist> actually, here
11:57 < iceberg> ok, no default pf.conf is pf a port I need to add first?
11:59 < ecrist> iceberg: http://secure-computing.net/files/scratch.txt
12:01 < iceberg> ok and thats just the pf.conf?
12:02 < iceberg> the just load pf in the rc.conf and set pf_rules to point to that?
12:03 < ecrist> yup
12:03 <@vpnHelper> RSS Update - forum: Can somebody help me with OPENVPN Please? <http://forums.openvpn.net/topic7495.html#p9043>
12:04 < iceberg> and do I need to remove anything other than ipfw_load from my rc.conf? 
12:04 < ecrist> no
12:06 < iceberg> ok, restarting the server
12:06 < ecrist> you didn't need to restart the server
12:06 < ecrist> it's not windows, man
12:06 < ecrist>  /etc/rc.d/pf reload
12:06 < ecrist> or
12:06 < iceberg> it was esier that clearing out all the other nat garbage I had
12:06 < ecrist> pfctl -e
12:07 < ecrist>  /etc/rc.d/ipfw stop
12:07 < iceberg> I had been tinkering trying to get it working
12:07 < iceberg> see all back up
12:07 < iceberg> solid state drives are fast
12:08 < iceberg> my IRC will drop when I connect as you are probably aware so I will brb
12:15 < iceberg> is "No ALTQ Support" an issue?
12:17 < ecrist> nope
12:17 < iceberg> something is as it didnt work
12:17 < iceberg> em0 is my public interface 
12:18 < iceberg> there were just two things in that script I needed to sub right? the if name and the ip?
12:19 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has joined #openvpn
12:19 < HoboSteaux> im looking for help on topology
12:20 < iceberg> ecrist: you sure there wasnt anyting else in my rc.conf I posted that neede rmoved other than ipdw_enable?  in my /var/log/messages it looks like somethign is still kicking ipfw on
12:21 < HoboSteaux> i have 3 computers on the same network, one of them bein an ovpn server. I am trying to to speedtests on encryption, etc, so i need there to be an ovpn link fromone computer to the server and then out to the third comp
12:21 < ecrist> iceberg: pastebin your rc.conf
12:21 < HoboSteaux> what would be the best way to do this?
12:22 < ecrist> HoboSteaux: create a vpn server and have both ends connect to hit, then pass traffic from one end to the other.
12:22 < HoboSteaux> wouldnt the encryption take place on the clients only then?
12:23 < iceberg> http://pastebin.com/YC6kEBFX
12:28 -!- luneff [~yury@84.51.197.224] has joined #openvpn
12:29 < ecrist> iceberg: remove line 16, 20, 21, 22, 23, 24
12:30 < ecrist> and the pf_rules is really already set to default, so that could be removed, as well
12:31 < HoboSteaux> as i understand it ecrist, the encryption occurs at the fringes of the network; if two item on the same vpn talk, they would be doing all the encryption instead of the server
12:31 < ecrist> no
12:31 < ecrist> the server encrypts traffic to each client
12:32 < HoboSteaux> oh i did not know that ty
12:32 < ecrist> so, if two clients talk, client 1 encrypts to the server, the server decrypts, re-encrypts for cleint-2 and forwards the traffic
12:32 < HoboSteaux> good to know that every stream is secure per client
12:33 < ecrist> there is never a negotiation between clients, not sure why you'd have that idea.
12:34 < iceberg> ecrist: still after the openVPN is established I can only access my local net I can not get out to the internet.
12:36 -!- p3rror [~mezgani@41.140.35.17] has quit [Read error: Connection reset by peer]
12:45 < ecrist> on the cli: pfctl -s nat
12:47 < iceberg> nat on em0 inet from 10.0.0.0/16 to any -> 64.141.147.212
12:47 < iceberg> em0 being my public interface
12:47 < ecrist> and is your vpn on the 10.0.0.0/16 subnet?
12:47 < iceberg> 10.8.0.0/24  so yea
12:48 < ecrist> in your server config, do you have "push 'redirect-gateway def1'"
12:48 < iceberg> push "redirect-gateway def1 bypass-dhcp"
12:48 < ecrist> um, 10.8.0.0/24 is not inside 10.0.0.0/16
12:49 < ecrist> change 10.0.0.0/16 to 10.8.0.0/24 and save
12:49 < ecrist> then run "/etc/rc.d/pf reload"
12:49 < iceberg> ok, giving that a try
12:52 < krzie> [13:55]  <ecrist> imho, pf is considerably more powerful than ipfw, and I used to be an ipfw user
12:52 < krzie> i also used ipfw / ipf, pf is the best
12:52 < ecrist> nat is *so* much easier
12:52 < ecrist> s/nat/everything/
12:52 < krzie> the scrub command by itself is all anyone should need to make the switch
12:53 < ecrist> heh, that breaks lots of stuff on our network.
12:53 < iceberg> success
12:53 < iceberg> thank you
12:53 < ecrist> we have about 23232 subnets flying around and it confuses pf it seems.
12:53 < ecrist> iceberg: it's easier to help when I have *all* the information I need. :)
12:53 < iceberg> it all works now, much appriciate it
12:54 < krzie> packet scrubbing breaks things in your network ecrist?
12:54 < ecrist> very much
12:54 < krzie> like what?
12:54 < krzie> i never seen that
12:54 < iceberg> ecrist: true, and I have several things going on so the /16 instead of /8 passed me
12:55 < ecrist> krzie: what causes it is when I have a pair of systems that are on both subnets (think jails) and a jail on one subnet is sending to another IP on another subnet (which bounces back to the same host)
12:55 < ecrist> pf sees that as spoofing
12:55 < iceberg> now I have to go do lots of reading on pf, as Ive not used it before
12:55 < ecrist> krzie: you should know by now that I often find a way to break things. ;)
12:57 < krzie> ohh
12:57 < krzie> i gotchya
12:57 < krzie> ;]
12:58 < iceberg> one last question, if I add more client keys later does the ca need rebuilt of something or do the new client keys get added during the process?
13:00 < ecrist> nope
13:00 < krzie> !factoids search
13:00 <@vpnHelper> (factoids search [<channel>] [--values] [--{regexp} <value>] [<glob> ...]) -- Searches the keyspace for keys matching <glob>. If --regexp is given, it associated value is taken as a regexp and matched against the keys. If --values is given, search the value space instead of the keyspace.
13:00 < ecrist> just sign more keys and hand them out
13:00 < krzie> !factoids search --values ca
13:00 <@vpnHelper> 'winroute', 'router', 'pastebin', 'push', 'ifconfig', 'bridge-dhcp', 'hmac', 'net30', 'dhcp', 'all', 'nobind', 'servercert', 'mitm', 'menu', 'wintaphide', 'linnat', 'ccd', 'lintrafaccnt', 'ask', 'crl', 'crl', 'local', 'wins', 'broadcast-relay', 'firestarter', 'notcompat', 'configs', 'mtu-test', 'iporder', 'access-server', 'paste', 'nopaste', 'fbsdnat', 'mtu', 'win2k8', 'subnet', 'tunortap', 'bcast',
13:00 <@vpnHelper> 'client-to-client', 'certverify', 'samesubnet', 'sockd', 'c2c', 'tls-auth', 'win_tcplimit', 'tcp', 'sample', '/30', 'ssl-admin', 'ldap_iptables', 'log', 'logfile', 'iphone', 'snapshots', 'testing', '', 'client-connect', 'script', 'AS', 'layer2', 'badtime', 'winpath', 'confgen', 'dupe', 'pki', 'osxboot', 'pki', 'wireless', 'duplicate', 'static-key', 'mbuf', 'statickey', 'pb', 'diagram', 'epel5', 'current',
13:00 <@vpnHelper> 'openvzlinnat', and 'forum'
13:01 < krzie> damn i thought i wrote one that had the overall idea of how pki works
13:02 < krzie> maybe...
13:02 < krzie> !pki
13:02 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
13:02 <@vpnHelper> specially as a server (see !servercert)
13:02 < krzie> iceberg, see #2
13:05 < iceberg> ok, Ive use other encrypted tunnels where the client has to know it's private key and the servers public not just having a signed key so I wasn't sure how x509 worked
13:05 < iceberg> but that seems simple enough
13:06 < krzie> same deal
13:07 < krzie> except 2-directional auth
13:08 < krzie> what you were talking about is when the client verifies the server only, like web servers
13:12 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Quit: iceberg]
13:14 -!- s7r1 [~s7r@212.117.186.78] has joined #openvpn
13:14 -!- s7r [~s7r@212.117.186.78] has quit [Ping timeout: 240 seconds]
13:18 -!- s7r1 [~s7r@212.117.186.78] has quit [Ping timeout: 265 seconds]
13:19 -!- s7r [~s7r@212.117.186.78] has joined #openvpn
13:19 -!- s7r is now known as Guest60088
13:24 -!- SOG [~SOG@solution1.hsia.citycenter.com] has quit [Ping timeout: 240 seconds]
13:31 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
13:36 < alhadi> Hi krzie :)
13:37 -!- sht [sht@2607:f0d0:2001:8b:20c:29ff:fe08:9753] has quit [Read error: Operation timed out]
13:37 -!- SOG [~SOG@solution1.hsia.citycenter.com] has joined #openvpn
13:39 -!- SOG [~SOG@solution1.hsia.citycenter.com] has quit [Remote host closed the connection]
13:39 -!- SOG [~SOG@n11649233199.netvigator.com] has joined #openvpn
13:40 -!- SOG [~SOG@n11649233199.netvigator.com] has quit [Client Quit]
13:42 < gladiatr> man date
13:42 < gladiatr> bah
14:09 < ecrist> buy her flowers, dress nice.
14:09 < ecrist> see man woman
14:14 < gladiatr> lmao
14:14 < gladiatr> No manual entry for woman
14:18 < hyper_ch> ecrist: wh do you want to bribe her?
14:23 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
14:25 -!- Antarez [kruse@tranquility.quidor.net] has quit [Quit: wopwopwop]
14:26 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has joined #openvpn
14:28 < krzie> lol
14:29 <@vpnHelper> RSS Update - forum: Problem with routes in Windows 7 <http://forums.openvpn.net/topic7200.html#p9044>
14:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:45 -!- WinstonSmith [~true@e177089065.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
14:46 -!- stony is now known as gisikon
14:46 -!- gisikon is now known as stony
14:47 <@vpnHelper> RSS Update - forum: JonDo vs OpenVPN - They Claim To Be More Secure <http://forums.openvpn.net/topic7355.html#p9045>
14:51 < alhadi> krzie when ever i connect to the VPN , windows 7 identifies as unidentified network
14:52 < alhadi> is there a workaround to make this interface identify ?
14:54 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p9046>
14:57 < krzie> not sure, have seen that problem before
14:57 < krzie> its something windows 7 added, im sure a workaround was found, lots of people have had the problem
14:57 < krzie> should be all over the web / mail lists
14:57 < krzie> !win7
14:58 < krzie> when you find it lemme know and ill add it to !win7
14:59 < alhadi> sure
14:59 <@vpnHelper> RSS Update - forum: backslash problem VPN fail windows xp client <http://forums.openvpn.net/topic7383.html#p9048> || Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p9047>
14:59 < alhadi> thanks m8
14:59 < alhadi> or
14:59 < alhadi> shuld i post a message in forum?
14:59 < alhadi> it might help others
14:59 < krzie> sure
14:59 < alhadi> cheers
14:59 < krzie> i can put the message on the bot too
15:00 < krzie> so thats prolly better
15:00 < alhadi> sounds good
15:00 < alhadi> yes i like vpnHelper
15:00 < alhadi> he is cute
15:00 < krzie> hehe
15:00 < alhadi> ^^ :D
15:00 < krzie> !tell alhadi thank you
15:00 < krzie> (he messages)
15:00 < alhadi> wow
15:00 < alhadi> he is smart
15:00 < alhadi> :)
15:00 < krzie> more useful like this
15:00 < alhadi> indeed
15:00 < krzie> !tell alhadi [howto]
15:01 < alhadi> i had my own irc network but i never made a bot like this ever..
15:01 < alhadi> so nice to see its very usefull for ppl like us lol
15:01 < krzie> it is a supybot
15:01 < krzie> !version
15:01 <@vpnHelper> The current (running) version of this Supybot is 0.83.4.1.  The newest version available online is 0.83.4.1.
15:02 < alhadi> nice
15:02 < krzie> there is a channel for them, #supybot
15:02 < alhadi> thanks
15:02 < alhadi> :)
15:03 < alhadi> i'll go and see the workaround
15:03 < alhadi> i saw somewhere to add a manual route and if you see my log you will see gateway 192.168.1.1 pops in that why i guess its unable to identify
15:03 < alhadi> !pb
15:03 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
15:03 < ecrist> !tell krzie leave me alone.
15:04 < alhadi> site is slow
15:04 <@vpnHelper> RSS Update - forum: Someone PLEASE HELP!!! OPENVPN SOFT RESETTING FAILED HANDSHA <http://forums.openvpn.net/topic7384.html#p9050> || how to add a kernel's route on the openvpn server? <http://forums.openvpn.net/topic7219.html#p9049>
15:05 < krzie> haha
15:06 < alhadi> lol
15:06 < krzie> alhadi, its because windows 7 doesnt like using an "unidentified network" as your default gateway
15:06 < alhadi> indeed
15:08 < krzie> !learn win7 as http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/8a3e9b05-353b-4250-a023-066a085e9657 for a workaround to the windows 7 "unidentified network" issue you get when using redirect-gateway
15:08 <@vpnHelper> Joo got it.
15:08 < krzie> there ya go
15:08 < krzie> hit #1 on my google
15:09 < alhadi> wow
15:09 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 260 seconds]
15:09 < krzie> search was:  windoes 7 unidentified network openvpn
15:09 <@vpnHelper> RSS Update - forum: what is the exact vpn information to use ? <http://forums.openvpn.net/topic7494.html#p9051>
15:10 < alhadi> nice
15:16 <@vpnHelper> RSS Update - forum: OpenVPN with Small Business Server 2003 <http://forums.openvpn.net/topic7469.html#p9053> || Windows 2003 support <http://forums.openvpn.net/topic7474.html#p9052>
15:16 -!- alhadi [~thunderst@188.95.51.165] has quit [Read error: Connection reset by peer]
15:21 <@vpnHelper> RSS Update - forum: error read UDPv4: Connection reset by peer (WSAECONNRESET) ( <http://forums.openvpn.net/topic7397.html#p9054>
15:24 -!- mrle0 [~fin@cpc1-nrte25-2-0-cust619.8-4.cable.virginmedia.com] has joined #openvpn
15:28 <@vpnHelper> RSS Update - forum: How to sign my own TAP driver? <http://forums.openvpn.net/topic7453.html#p9058> || error read UDPv4: Connection reset by peer (WSAECONNRESET) ( <http://forums.openvpn.net/topic7397.html#p9057> || How do I do a complete cleanup after openvpn installation <http://forums.openvpn.net/topic7457.html#p9056> || Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p9055>
15:32 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
15:33 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Remote host closed the connection]
15:33 <@vpnHelper> RSS Update - forum: Running a down script prior to route del <http://forums.openvpn.net/topic7406.html#p9060> || TLS Blocked by provider, need to modify source code... <http://forums.openvpn.net/topic7438.html#p9059>
15:38 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has quit [Ping timeout: 240 seconds]
15:38 < krzie> !pki
15:38 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
15:38 <@vpnHelper> specially as a server (see !servercert)
15:40 <@vpnHelper> RSS Update - forum: Need help with config files/keys will pay <http://forums.openvpn.net/topic7460.html#p9062> || How to create my own TAP driver installer (Windows) <http://forums.openvpn.net/topic7401.html#p9061>
15:45 -!- p3rror [~mezgani@41.140.33.59] has joined #openvpn
15:45 <@vpnHelper> RSS Update - forum: Different networks, DNS-Server does not work <http://forums.openvpn.net/topic7378.html#p9064> || Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9063>
15:48 -!- iceberg [~iceberg@64.141.147.212] has joined #openvpn
15:50 -!- iceberg [~iceberg@64.141.147.212] has quit [Read error: Connection reset by peer]
15:51 -!- alhadi [~thunderst@188.95.51.165] has joined #openvpn
15:51 <@vpnHelper> RSS Update - forum: Problem installing TAP adapter (split topic) <http://forums.openvpn.net/topic7390.html#p9067> || VPN before 2 routers <http://forums.openvpn.net/topic7369.html#p9066> || openvpn exceptions ?!! <http://forums.openvpn.net/topic7373.html#p9065>
15:51 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has joined #openvpn
15:51 < alhadi> found a solution temp
15:53 < alhadi> need to go control panel and then network sharing and wizard / adaptor setting / tap-win32 network connection right click properties then IP-v4 and the go to add a gateway 2.2.0.5 or dont add 2 gateway
15:53 < alhadi> also a workaround was to disable DHCP from router and keep static IP's
15:53 < alhadi> that worked
15:53 < alhadi> now i can see my both local interface and virtual interface both identified as public/private
15:55 < iceberg> even though duplicate-cn is not enabled on my server, it is allowing me to connect from two different machines at the same time (both behind a nat on the same public ip, but it shouldn't allow it at all should it?)
15:55 -!- bitterman [~yury@84.51.197.224] has joined #openvpn
15:57 < krzie> iceberg, the first client shouldnt be able to ping the server anymore, until it times out and reconnects, at which point the second one should have the same symptoms, and they continue to fight
15:58 < iceberg> ok, that semms what was going on. There is no way to prevent it from connecting at all is there?
15:58 -!- luneff [~yury@84.51.197.224] has quit [Ping timeout: 240 seconds]
16:00 < gladiatr> iceberg, revoke that certificate and issue new ones
16:02 <@vpnHelper> RSS Update - forum: Help?? <http://forums.openvpn.net/topic7361.html#p9068>
16:02 -!- bitterman [~yury@84.51.197.224] has quit [Quit: Leaving]
16:02 < iceberg> I know I can revoke the cert, I just wondered if there was a way to prevent the 2nd client from connecting.
16:03 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
16:04 < gladiatr> Nope.  If it has your dh key and a valid certificate, there's nothing to prevent it from connecting.
16:06 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
16:07 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
16:07 <@vpnHelper> RSS Update - forum: WARNING: potential route subnet conflict <http://forums.openvpn.net/topic7354.html#p9070> || unable to connect to vpn network <http://forums.openvpn.net/topic7357.html#p9069>
16:09 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
16:09 -!- mrle0 [~fin@cpc1-nrte25-2-0-cust619.8-4.cable.virginmedia.com] has quit [Quit: Leaving]
16:14 <@vpnHelper> RSS Update - forum: Client to other client behind subnet <http://forums.openvpn.net/topic7338.html#p9075> || making packets <http://forums.openvpn.net/topic7342.html#p9074> || Can't reinstall OpenVP-AS <http://forums.openvpn.net/topic7345.html#p9073> || Connections bypassing OpenVPN? <http://forums.openvpn.net/topic7347.html#p9072> || Alternative methods to delegate IP to clients? <http://forums.openvpn.net/topic7349.html#p9071>
16:14 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
16:20 -!- alhadi [~thunderst@188.95.51.165] has quit [Quit: alhadi]
16:22 -!- p3rror [~mezgani@41.140.33.59] has quit [Read error: Connection reset by peer]
16:25 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has left #openvpn []
16:29 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has left #openvpn []
16:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:37 -!- p3rror [~mezgani@41.140.34.28] has joined #openvpn
16:42 -!- Guest60088 [~s7r@212.117.186.78] has left #openvpn []
16:50 -!- Bebop2Steady [~Bebop2Ste@124.169.156.37] has joined #openvpn
16:58 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Ping timeout: 276 seconds]
16:59 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
17:00 <@vpnHelper> RSS Update - forum: OpenVPN or how to configure it from the Windows 7 <http://forums.openvpn.net/topic7496.html>
17:04 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has joined #openvpn
17:05 < HoboSteaux> so i just made my first tun. it connects, gets an ip, but can not commpunicate
17:06 <@vpnHelper> RSS Update - forum: OpenVPN or how to configure it from the Windows 7 <http://forums.openvpn.net/topic7496.html#p9077>
17:06 < HoboSteaux> the hardware address of the tun on the client is 16 sets of 00-
17:07 < HoboSteaux> nm both client and server have that
17:09 < Bebop2Steady> what does it mean "cant communitcate"?
17:09 < HoboSteaux> i can not ping across it
17:10 < HoboSteaux> i have a correct ip address with the right subnet
17:10 < Bebop2Steady> you got a local IP of 10.x.x.6    and cant ping to  10.x.x.1?
17:10 < HoboSteaux> yeah
17:11 < Bebop2Steady> server machine has firewall enabled? iptables etc ?
17:14 < HoboSteaux> i did have an old nat, disabling it and trying again
17:14 < Bebop2Steady> # Respond to pings
17:14 < Bebop2Steady> iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
17:15 < HoboSteaux> currently it has a blank policy
17:16 < HoboSteaux> same with client
17:17 < HoboSteaux> added that rule, still no response
17:19 -!- p3rror [~mezgani@41.140.34.28] has quit [Ping timeout: 240 seconds]
17:21 < Bebop2Steady> I'm still a bit noob at this so cant offer more suggestions.. lil help from experts needed.
17:22 < HoboSteaux> heh :P i can do the bridge vpns fine... but then again they are easy
17:22 < Bebop2Steady> probably unrelated, but have you done:    echo 1 > /proc/sys/net/ipv4/ip_forward                   yet ?
17:23 < Bebop2Steady> (on server)
17:25 < Bebop2Steady> what guide did you follow to do the setup?  I got one that has never let me down, as far as getting to the ping server stage.
17:25 < HoboSteaux> a couple of em
17:25 < HoboSteaux> meshed em together
17:25 < HoboSteaux> using the howto config file
17:27 < krzie> !logs
17:27 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
17:27 < krzie> !configs
17:27 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
17:27 < krzie> ^ @ HoboSteaux 
17:27 < krzie> and whats your goal...?
17:27 < HoboSteaux> kk ty krzie
17:27 < HoboSteaux> simple tun setup
17:27 < krzie> no lans, no accessing internet over vpn?
17:28 < HoboSteaux> yeah
17:28 < krzie> !sample
17:28 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
17:28 < krzie> there ya go
17:29 < HoboSteaux> ty
17:30 < Bebop2Steady> i got a quick conceptual question for u krzie:   http://i52.tinypic.com/2dkhded.jpg
17:31 < krzie> looks right
17:31 < Bebop2Steady> with that one -- i want client-to-client to be *off*, so I am thinking now, to get route from country C to laptop.... then it needs a server instance in the middle one
17:32 -!- alhadi [~thunderst@92.96.242.8] has joined #openvpn
17:32 < krzie> except the user wouldnt be .7
17:32 < krzie> he'ld be .10 :-p
17:32 < Bebop2Steady> ahh
17:32 < krzie> !/30
17:32 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
17:32 < Bebop2Steady> he is 10 when i put in practice...
17:32 -!- p3rror [~mezgani@41.140.169.219] has joined #openvpn
17:32 < Bebop2Steady> i was wondering why
17:33 < krzie> umm
17:33 < krzie> wait what are you talking about re: routes?
17:33 < Bebop2Steady> lap top to be able to ping both servers in coutry C
17:33 < Bebop2Steady> with client-to-client swicthed to off
17:33 < krzie> why would it want to ping both!?
17:33 < krzie> client-to-client wont help anyways
17:34 < krzie> !c2c
17:34 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
17:34 <@vpnHelper> clients
17:34 < krzie> ohhh
17:34 < krzie> lol
17:34 < krzie> you still havnt caught onto an important part
17:34 < krzie> i bet you still get MULTI errors in your log
17:35 < Bebop2Steady> not in my openvpn logs...
17:35 < Bebop2Steady> or are they in var/log/messages?
17:35 < krzie> they are whereever you said they should be
17:35 < krzie> !logfile
17:35 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
17:35 < Bebop2Steady> i took your advice and have tail-f /etc/openvpn/*.log  on 
17:44 -!- agrajag [~agrajag^@c-24-131-78-108.hsd1.pa.comcast.net] has joined #openvpn
17:44 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
17:47 -!- alhadi [~thunderst@92.96.242.8] has quit [Quit: alhadi]
17:49 < HoboSteaux> krzie: this is the latter part of my client log file:
17:49 < HoboSteaux> http://pastebin.com/A9KFuuZp
17:50 < HoboSteaux> still not working
17:50 -!- p3rror [~mezgani@41.140.169.219] has quit [Ping timeout: 240 seconds]
17:56 -!- corretico [~corretico@201.201.44.82] has quit [Ping timeout: 246 seconds]
17:59 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
18:02 -!- mezgani_ [~mezgani@41.140.27.249] has joined #openvpn
18:03 -!- mezgani_ is now known as p3rror
18:03 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Remote host closed the connection]
18:06 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Read error: Operation timed out]
18:08 -!- lupine_85 [~lupine_85@2001:41c8:10:462::99] has joined #openvpn
18:09 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
18:11 < Bebop2Steady> !topology
18:11 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
18:14 -!- silverraindog [~angus@host86-185-35-153.range86-185.btcentralplus.com] has quit [Read error: Operation timed out]
18:14 < krzie> HoboSteaux, i said i wanted both configs and both logfiles, not half of a logfile and nothing else
18:14 < krzie> Mon Jan 10 15:43:39 2011 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1541'
18:14 < krzie> Mon Jan 10 15:43:39 2011 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
18:14 < krzie> the first 2 lines are very important
18:14 < HoboSteaux> alright hold on a second sorry
18:18 < HoboSteaux> client log: http://pastebin.com/kh4UdqRY
18:18 < HoboSteaux> client config: http://pastebin.com/UMBFD2wg
18:20 < HoboSteaux> server log: http://pastebin.com/qJFw83vw
18:20 < HoboSteaux> server config: http://pastebin.com/tmn5JLMg
18:23 < krzie> funny, those logs dont have the error you said you were having...
18:23 < krzie> you pasted half a logfile at first, which doesnt match either of these
18:23 < HoboSteaux> hahah yeahhh... i found the error, but its back to not being able to connect
18:24 < HoboSteaux> i fixed the old error, now its just not able to send data over the interface
18:26 -!- alhadi [~thunderst@92.99.235.139] has joined #openvpn
18:26 -!- tessier [~treed@mail.copilotco.com] has quit [Ping timeout: 250 seconds]
18:29 -!- s7r [~s7r@212.117.186.78] has joined #openvpn
18:46 -!- Malard|Home [~ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
18:46 < krzie> erm
18:46 < krzie> i just noticed,
18:46 < krzie> remote 10.10.0.111 1194
18:47 < HoboSteaux> yeah thats the real address of the server
18:48 < krzie> so you want nothing more than a point to point vpn inside your existing lan
18:48 < HoboSteaux> yes
18:48 < krzie> is this for securing wifi or something...?
18:49 < HoboSteaux> i want somethign to run speed tests on
18:49 < HoboSteaux> different encrytions, etc
18:49 -!- newbie|3 [~Bebop2Ste@124.169.156.37] has joined #openvpn
18:50 < krzie> connect the client in
18:50 < krzie> ping 10.8.1.1 from the client
18:50 < krzie> if those logs are still correct, it should work
18:51 < HoboSteaux> wtf. magicsauce. i literally presses up a bit to find that ping and it somehow worked this time
18:51 < HoboSteaux> ty, i have no clue what i did wrong lol
18:53 -!- Bebop2Steady [~Bebop2Ste@124.169.156.37] has quit [Ping timeout: 248 seconds]
19:06 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
19:12 -!- alhadi [~thunderst@92.99.235.139] has quit [Quit: alhadi]
19:16 -!- sparkymarkd [~mark@190.197.41.96] has joined #openvpn
19:18 -!- tessier_ [~treed@mail.copilotco.com] has joined #openvpn
19:26 < newbie|3> krzie, I thought of one possible clarification for the OpenVPN/Routing wiki
19:26 < newbie|3> oops
19:27 < newbie|3> newbie|3 = bebop2steady
19:31 -!- sparkymarkd [~mark@190.197.41.96] has quit [Ping timeout: 240 seconds]
19:32 < newbie|3> In the diagram with 3 box's (servers/clients)
19:32 < newbie|3> The diagram has 1 server and 2 clients ?
19:32 < newbie|3> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
19:32 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
19:44 -!- common [~common@p5DDA4467.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
19:52 -!- common [~common@p5DDA4467.dip0.t-ipconnect.de] has joined #openvpn
20:19 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9078>
20:24 -!- silverraindog [~angus@host86-185-36-14.range86-185.btcentralplus.com] has joined #openvpn
20:31 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
20:40 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
20:44 -!- s7r [~s7r@212.117.186.78] has left #openvpn []
20:45 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 276 seconds]
20:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:54 < krzie> newbie|3, you cant have 2 servers... so yes
20:54 < krzie> lol
20:54 < krzie> and if you read the words instead of just the pictures...
20:55 < krzie> "Our user had a openvpn server with a lan (10.10.2.0) behind it, and 2 client with lans behind them:"
20:58 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
21:17 -!- diphthong [~diphthong@69.172.135.243] has quit [Ping timeout: 276 seconds]
21:18 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
21:26 -!- _zero__ [~zero@noc.toile-libre.net] has joined #openvpn
21:28 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
21:28 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
21:29 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Client Quit]
21:31 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
21:35 -!- Netsplit *.net <-> *.split quits: mick_laptop, _zero_, rjd_, Clete2
21:37 -!- Netsplit over, joins: rjd_, mick_laptop, Clete2
21:52 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
22:00 -!- corretico [~corretico@201.201.44.82] has quit [Remote host closed the connection]
22:07 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
22:07 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
22:07 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:19 <@vpnHelper> RSS Update - forum: Linux client problem <http://forums.openvpn.net/topic7497.html>
22:22 -!- StupidWeasel [~weasel@unaffiliated/stupidweasel] has joined #openvpn
22:22 < StupidWeasel> !goal
22:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:22 < StupidWeasel> Heh, just what I was going to type. Neat.
22:24 < krzie> which part...
22:25 < StupidWeasel> Hiya folks, I'd like to use openvpn to connect two computers, for lan gaming purposes. Would it be enough to have this machine as the server - and just have the client connect?
22:25 < StupidWeasel> Making the game use the openvpn adaptor?
22:27 < krzie> sounds about right
22:28 < krzie> if the 2 gaming machines are running openvpn, and no other machines in the lan need gaming access, you can use a routed tap setup
22:28 < krzie> like this, but with dev tap
22:28 < krzie> !sample
22:28 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
22:28 < krzie> if you need other lan machines to play as well, you need a bridge, which i cant help with
22:28 < StupidWeasel> Excellent, that sounds just right. 
22:29 < StupidWeasel> And nope, only two machines currently.
22:30 < StupidWeasel> Thanks a lot krzie. I was fairly certain that I was reading the correct tutorial, but wanted to confirm before I really dug in :)
22:31 -!- newbie|3 [~Bebop2Ste@124.169.156.37] has quit [Read error: Connection reset by peer]
22:31 -!- newbie|3 [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has joined #openvpn
22:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
23:09 < newbie|3> krzie i'm close to breaking thru over here. lil help from the master and i could be free. i made a new diagram, with full config included for easy dianostics. if you can sneak a peek at it lemmme know..
23:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
23:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:32 < newbie|3> ping to last server in vpnchain, but cannot get a vpn connect to it. the initial packet arrives, and thats it.
23:39 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:42 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
23:43 < newbie|3> I got diagram of my routes pushd and ccd entries mapped so if someexpert looks at it the problem will be immediately evident 
23:44 < newbie|3> !route
23:44 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
23:48 < newbie|3> the server says initial packer recieved, then "WWRWRWRWRWWWWRRRWRWRW", which I guess is [W]rite [R]ead ....
23:49 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
--- Day changed Tue Jan 11 2011
00:04 < krzie> newbie|3, if thats the type of setup you want, you wont be getting more help from me... LEARN the stuff and you will understand it ;]
00:06 -!- sparkymarkd [~mark@200.32.232.149] has quit [Remote host closed the connection]
00:08 < newbie|3> one incy bincy last tiny little peice of help ?
00:09 < newbie|3> nah.. ok..  i agree
00:09 < newbie|3> I'm deconstructing is starting with something a lil easier 
00:16 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
01:02 -!- newbie|3 [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
01:05 -!- StupidWeasel [~weasel@unaffiliated/stupidweasel] has quit [Ping timeout: 240 seconds]
01:13 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:14 < hyper_ch> good morning world
01:24 <@vpnHelper> RSS Update - forum: UPnP over openVPN, is it possible? <http://forums.openvpn.net/topic7498.html>
01:24 < krzie> upnp over vpn... heh
01:25 < krzie> i dont even trust upnp over ethernet ;]
01:25 < krzie> or wifi
01:25 < krzie> or any other networking method
01:25 < krzie> good morning hyper_ch 
01:26 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has joined #openvpn
01:28 < hyper_ch> isn't upnp the root of all evil on computers?
01:28 < Bebop2Steady> dying here :[     http://i55.tinypic.com/ftomq9.jpg                           <----- according to my interpretation of all the available info, i looks like that would work. Through no lack of trying though, I cant get it. 
01:29 < krzie> hyper_ch, no, thats women
01:29 < hyper_ch> :)
01:29 < krzie> as proven by the famous proof
01:29 < hyper_ch> there are women on computers?
01:29 < krzie> women = time + money... etc
01:29 < hyper_ch> women = time
01:29 < hyper_ch> money = time
01:29 < hyper_ch> money = evil
01:30 < krzie> http://www.anvari.org/db/fun/Gender/Proof_that_Girls_are_Evil.jpg
01:30 < hyper_ch> I know :)
01:30 < hyper_ch> seen it before
01:30 < hyper_ch> but women are not on computers
01:30 < hyper_ch> so the root of all evil on computers can still be upnp
01:37 < Bebop2Steady> the other root of evil on computers is that you eventually get tired and your brain stops. And simple problems become unsolvable.
01:40 < krzie> really? i thought it was walkthroughs
01:40 < krzie> that lead people to ask more questions of others than of manuals
01:40 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
01:41 < Bebop2Steady> walkthroughs are god-sent.. so are manuals though. not sure if the distcinction has a great difference
01:41 < krzie> huuuuge difference
01:41 < krzie> one says "this is what the software can do, learn it"
01:42 < krzie> other says "heres how you can blindly make the software do exactly this"
01:42 < Bebop2Steady> yeah in any case.. manual + walktrhough compliment each other nicely..
01:43 < Bebop2Steady> dont re-invent the wheel, so long as u understand its uses
01:47 < krzie> btw, if theres only 2 machines you dont need a chain at all
01:47 < krzie> (finally looked at above link)
01:48  * krzie shops for a mytouch 4g
01:48 < Bebop2Steady> ( big yay! )  um.. 
01:48 < krzie> hey i know
01:48 < krzie> buy me a mytouch 4g and ill not only teach you everything about vpnchains but ill even set them up for you
01:49 < krzie> :-p
01:50 < Bebop2Steady> : ] just the teaching would be fine.. despite my frequent questions, I prefer to learn it all too 
01:52 < Bebop2Steady> that design I made had teh same problem as the 3 stack.. ima have to deconstruct it and start again ( again ) .. eventually I'll get there.
01:53 < Bebop2Steady> i learned all that iroute + route + push to the max already.. some invisible problem stopping me now
01:55 < Bebop2Steady> ima go shopping.. not for a mytouch 4g, but a rather simpler element -------- *food*
01:55 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
02:15 -!- alhadi [~thunderst@92.99.235.139] has joined #openvpn
02:17 -!- alhadi [~thunderst@92.99.235.139] has quit [Client Quit]
02:18 -!- alhadi [~thunderst@s3.airvpn.org] has joined #openvpn
02:20 -!- dazo_afk_afk is now known as dazo
02:24 < krzie> moinmoin dazo
02:24 <@dazo> krzie: moinmoin :)  whazzup?
02:24 < krzie> not much, shopping a lil for my new phone
02:25 <@dazo> cool :)  decided for what you want?
02:25 < krzie> cant get an evo cause its cdma only *gah*  but im gunna go for a mytouch 4g
02:25 < krzie> even tho i must admit i considered the n900 cimply because it can do wifi monitor mode reinjection
02:26 < krzie> simply*
02:26 <@dazo> :)
02:27 <@dazo> Well, I'm a F/OSS geek, so I always shop what is most open :)  But, I'm more on the extreme side though :)
02:28 < krzie> wouldnt an android phone be more open?
02:28 < krzie> is maemo source online?
02:28 < krzie> ahh yes it is
02:29 <@dazo> it's second on my list ... you still need to jail it ... in maemo, you just install the "Gain root" application from the apps repository, officially supported
02:29 < krzie> the root app i used on the evo was so stupid simple i was shocked
02:29 < krzie> but it was not simply install an app from the repo
02:29 < krzie> that is coo
02:29 < krzie> +l
02:30 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Read error: Operation timed out]
02:31 <@dazo> on maemo and MeeGo devices, your device is much more comparable to a normal computer ... you are in control, you install whatever and remove whatever you want ... if you break it, you need to reflash it ... and even flashing tools are available for Linux, OSX and Windows
02:31 <@dazo> Andriod and others, don't give such powers "out-of-the-box" to its users, therefore I don't consider them really open
02:32 < krzie> valid point
02:32 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has joined #openvpn
02:32 < krzie> too bad its not so actively developed for
02:32 < krzie> that was certainly part of my decision
02:32 <@dazo> btw ... maemo5 won't die anytime soon .... it seems that Nokia won't officially provide a supported MeeGo version (even though dual-boot from SD card is now supported in the latest PR release) ... but Nokia promised to support maemo5 for a long time, afair
02:32 < krzie> (i mean as compared to IOS / android)
02:32 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
02:33 < krzie> it still bothers me to call iphoneOS IOS... hey this isnt a cisco device!
02:33 <@vpnHelper> RSS Update - forum: Can somebody help me with OPENVPN Please? <http://forums.openvpn.net/topic7495.html#p9081>
02:34 <@dazo> that's a valid point, even though compared to a year ago ... the application selection has grown tremendously, it started with about 30-40 apps, now there's over 700 ... but of course, not comparable to apple/android
02:34 < krzie> then again they do have 1 app that nobody else does
02:34 <@dazo> openvpn?
02:34 < krzie> the FULL aircrack-ng suite
02:34 <@dazo> yeah :)
02:35 < krzie> iphone AND android have openvpn ;]
02:35 <@dazo> yeah, if you root your device :)
02:35 <@dazo> jail, I mean
02:35 < krzie> which im certain to do
02:35 < krzie> its not even a real phone for me until i do...
02:36 < krzie> an iphone is an ipod touch in this country until you jailbreak / unlock it
02:36 <@dazo> it's a phone even though not jailbroken ... it's just not suitable for much more than phone calls :-P
02:36 <@dazo> ahh
02:36 < krzie> not even suitable for phone calls ;]
02:36 <@dazo> ahh ... yeah, that's even worse
02:37 < krzie> does that go for the n900 too?
02:37 <@dazo> n900 is not locked like that at all, at least here in Europe
02:37 < krzie> cool
02:38 <@dazo> I bought mine completely without subscription to a provider ... and switch SIM cards depending on the country I go to
02:38 < krzie> ive been rockin the iphone for about a year (a friend in au gave me his about a yr ago) but recently i had to setup an evo for the boss to use with openvpn to see the cgi scripts i have been making from afar
02:38 < krzie> i fell in love with that thing
02:40 <@dazo> heh :) iphone deserves credits for pushing the market, making useful smartphones ... earlier it was just silly "smart"phones ... but Android have done a good job, on the user side
02:40 < reiffert> moin
02:40 <@dazo> moin, reiffert :)
02:40 < krzie> yep, i agree
02:40 < krzie> mornin reif
02:40 < alhadi> krzie hello :) you know any openvpn provider ?
02:41 < alhadi> gonna switch the one i have
02:41 < krzie> not really, theres a couple mentioned on the forum
02:41 < reiffert> dazo: did you recognize the layer-2 discussion some days ago?
02:41 < alhadi> sure
02:41 < krzie> i provide my own vpn services
02:41 < krzie> (for me)
02:42 < alhadi> thats great
02:42 <@dazo> reiffert: not sure I do recall it right now .... but a few hints might help refresh memory :)
02:42 < alhadi> looking a a good provider
02:42 < alhadi> i'll see forum now thx
02:42 < reiffert> dazo: it's where openvpn can play together with ciscos MACSec and TrustSec
02:42 < krzie> (same reason i dunno a good webhost or vps provider)
02:42 < reiffert> dazo: could
02:43 <@dazo> reiffert: was I even in that discussion? :-P
02:43 < reiffert> dazo: bascially the client and the server will talk to each other with layer-2 frames. Skip IP overhead.
02:43 < krzie> basically the idea is allowing layer2 to be the transport for openvpn
02:43 < reiffert> dazo: I mentioned your name twice.
02:43 < reiffert>  :)
02:43 <@dazo> reiffert: ahh :)  I'll check scrollback once again
02:43 < reiffert> krzie: what do you think, 3 days ago, maybe 4?
02:44 < krzie> not sure, the week has blurred into 1 long long pneumonia filled day
02:44 < reiffert> :)
02:44 <@dazo> <stony> [08-01 11:01:24] i'm looking for an solution to encrypt layer2 traffic that is passing an fibre connected link
02:44 < krzie> yep thats him
02:44 < reiffert> yeah that one
02:45 <@dazo> gee ... that's a long discussion
02:45 < krzie> made me jealous... he gets fibre and im on 3mbit/1mbit
02:45 < reiffert> dazo: but as I recall he was asking in the middle of the european night.
02:45 < reiffert> DarthGandalf: allright then, "long discussion" fits.
02:46 < reiffert> my tab completition hurts
02:46 < reiffert> completi(ti)on
02:47 < reiffert> :)
02:47 < reiffert> What will help you when you already have plenty of coffee? More coffee!
02:48 < krzie> crack!
02:48 < krzie> o_O
02:49 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
02:58 <@dazo> reiffert: yeah ... well, I just struggle to understand some details ... but that can be because I'm so locking into the traditional Ethernet world .... if using MAC addresses, how would that be useful outside your own network?  How will it be possible to bring such traffic "outside your building" using MAC addresses as the addressing scheme, crossing routers?
02:58 <@dazo> s/locking/locked/
03:00 < reiffert> simply spoken: you dont.
03:00 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:01 < reiffert> it's for the purpose of having encrypted local links.
03:01 < reiffert> same what cisco's MACSec and/or TrustSec do.
03:02 < reiffert> TrustSec is for local links only and MACSec can do routing IIRC.
03:02 < reiffert> We already do have the Routing stuff.
03:03 < reiffert> Skipping the IP stuff for local links is what might be intresting.
03:03 <@dazo> hmm ... well, it probably gets more useful when you do the routing part ... but, yeah, we already got that covered ...
03:04 <@dazo> it sounds interesting ... but I'm likely to say this is more suitable for OpenVPN3 ... as there the "socket" part will be its own module, which will normally be TCP/IP based (AF_INET/AF_INET6) ... but that can be swapped out for such use-cases to use AF_PACKET instead
03:05 < krzie> yep, iirc we mentioned that
03:05 < reiffert> great. I just wanted to make sure you put i ton the roadmap.
03:05 <@dazo> in the current code base ... doing that will require a lot of hacking
03:05 <@dazo> socket.c which covers most of this, is a nasty piece of code ... which is really difficult to read and understand
03:05 <@dazo> (which is also why listening to multiple ports have never really been implemented)
03:05 < krzie> (not that it would be *more* suitable, but that it would be easier... i dont think we knew what it entailed to do currently)
03:06 <@dazo> krzie: yeah ... exactly my point
03:06 < reiffert> dazo: so you will handle the part from "here" to "putting it on the roadmap"?
03:07 <@dazo> I'll put it into the roadmap as a potential module
03:07 < reiffert> back to "fighting the law"
03:07 < reiffert> (thanks)
03:07 < krzie> openvpn3 will be so awesome
03:07 < reiffert> .oO I fought the law, and the law won :)
03:08 < krzie> "sure, that would just be a new module" will be commonplace for new features
03:08 < krzie> from using layer2 as transport all the way to using DNS as the transport, and much much more
03:09 < reiffert> http://www.youtube.com/watch?v=16u0wwCfoJ4
03:09 <@vpnHelper> Title: YouTube - The Clash - I Fought The Law (at www.youtube.com)
03:09 <@dazo> krzie: yeah, I'm just wondering when we will be able to really kick-off that development cycle ... rewriting thing from scratch is very very seldom a clever idea, so we need to clean up the current code base and massage that one to become more modular .... and the SSL module stuff being reviewed is one big leap in that direction, we just need many more of such leaps
03:11 < reiffert> The more planning you do, the more straight forward the actual coding will get
03:11 < reiffert> but at some point someone has to start writing the inner loop.
03:12 < reiffert> (The dead kennedies cover I like much more)
03:12 < reiffert> http://www.youtube.com/watch?v=jbCqwl2geQg
03:12 <@vpnHelper> Title: YouTube - Dead Kennedys - I Fought the Law (at www.youtube.com)
03:12 -!- macsppadic is now known as Directorsppadic
03:18 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:21 -!- mrle0 [~fin@85.69.2.81.in-addr.arpa] has joined #openvpn
03:23 -!- alhadi [~thunderst@s3.airvpn.org] has quit [Quit: alhadi]
03:28 -!- alhadi [~thunderst@92.99.235.139] has joined #openvpn
03:28 -!- patelx [patel@openvpn/corp/admin/patel] has quit [Ping timeout: 260 seconds]
03:28 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
03:28 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
03:28 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
03:31 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
03:32 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:34 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 255 seconds]
03:34 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:41 -!- SOG [~SOG@solution1.hsia.citycenter.com] has joined #openvpn
03:50 -!- master_of_master [~master_of@p57B56916.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
03:51 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:52 -!- master_of_master [~master_of@p57B544B0.dip.t-dialin.net] has joined #openvpn
03:53 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
03:54 -!- alhadi [~thunderst@92.99.235.139] has quit [Quit: alhadi]
03:56 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
04:01 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:06 < kraut> moin
04:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
04:09 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:09 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:13 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
04:13 -!- mode/#openvpn [+o mattock] by ChanServ
04:37 <@vpnHelper> RSS Update - forum: Firewall blocked https traffic <http://forums.openvpn.net/topic7466.html#p9082>
04:42 -!- common- [~common@p5DDA441B.dip0.t-ipconnect.de] has joined #openvpn
04:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
04:45 -!- common [~common@p5DDA4467.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
04:45 -!- common- is now known as common
04:46 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:46 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:46 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:51 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:53 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html>
04:58 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
05:03 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
05:10 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
05:22 -!- venom00 [~wer@unaffiliated/venom00] has joined #openvpn
05:23 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
05:24 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 272 seconds]
05:24 -!- venom00 [~wer@unaffiliated/venom00] has quit [Client Quit]
05:25 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
05:29 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 272 seconds]
05:29 -!- SOG [~SOG@solution1.hsia.citycenter.com] has quit [Ping timeout: 240 seconds]
05:35 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
05:38 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
05:39 -!- venom00 [~wer@unaffiliated/venom00] has joined #openvpn
05:49 -!- venom00 [~wer@unaffiliated/venom00] has quit [Quit: ☃]
05:50 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
05:55 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:57 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
05:57 -!- Cain` is now known as Cain
05:58 -!- Cain [~Geek@unaffiliated/cain] has quit [Client Quit]
05:59 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:29 -!- WinstonSmith [~true@g231231059.adsl.alicedsl.de] has joined #openvpn
06:45 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
06:54 -!- luneff [~yury@84.51.195.188] has joined #openvpn
06:58 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
07:05 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
07:06 -!- lupine_85 [~lupine_85@2001:41c8:10:462::99] has quit [Changing host]
07:06 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
07:09 < Bebop2Steady> my latest and greatest unsuccess: --> http://i53.tinypic.com/k0o6sn.jpg
07:15 -!- Iron_Chef [~alloy@tropyx.com] has left #openvpn []
07:17 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
07:20 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
07:20 -!- WinstonSmith [~true@g231231059.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
07:29 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has quit [Quit: iceberg]
07:30 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
07:32 -!- s7r [~s7r@212.78.230.220] has joined #openvpn
07:33 -!- WinstonSmith [~true@e179010020.adsl.alicedsl.de] has joined #openvpn
07:34 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
07:45 -!- markus__ [~markus@c83-250-36-93.bredband.comhem.se] has quit [Remote host closed the connection]
07:52 < gladiatr> mmm... awesomeness... freebsd-ppc subject line: [ANNOUNCE] Playstation 3 support now in HEAD
07:55 -!- WinstonSmith [~true@e179010020.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
08:04 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
08:04 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
08:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:06 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
08:06 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
08:10 -!- pete-joh [~pete-joh@triton.dsv.su.se] has joined #openvpn
08:10 < pete-joh> Hi, can openvpn tunnel udp traffic too?
08:11 < pete-joh> or only TCP?
08:12 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
08:13 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
08:13 < gladiatr> as in: through an established tunnel?
08:14 < |Mike|> pete-joh: !welcome
08:14 < |Mike|> !tell pete-joh welcome
08:14 < |Mike|> !tell pete-joh [welcome]
08:26 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
08:28 -!- WinstonSmith [~true@e179010020.adsl.alicedsl.de] has joined #openvpn
08:29 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
08:30 < iceberg> do most people around here use a UI to manage certificates or just console?
08:33 < gladiatr> <- console
08:33 < morbidwar> console iceberg 
08:34 <@dazo> iceberg: console and gui (tinyCA2 and xca)
08:35 < iceberg> ok, I assumed most used console, those of you that do did you just add the vars variables to you shell rc file?
08:36 < gladiatr> I don't.  I source the vars file whenever I interact with the CA
08:37 < iceberg> ahh I have an account specifically for that I don't do it from a user or root account
08:38 < gladiatr> cool.  Even then, I'd still keep the config within the CA directory structure (personal preference) and just source the vars file from .*profile
08:39 < iceberg> ok, thansk for the advice
08:40 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
08:43 < pete-joh> gladiatr: yep,
08:45 -!- sporedi [~chatzilla@mail.utmxtm.com] has joined #openvpn
08:51 -!- Directorsppadic [~sonupunno@88.211.55.77] has left #openvpn []
08:53 < gladiatr> pete-joh, yes.
09:02 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:07 < sporedi> !taportun
09:07 < pete-joh> gladiatr: nice, are there any bandwidth or performance penalties?
09:09 < gladiatr> sec
09:11 < sporedi> when to use tap or tunnel what is boat ?
09:12 < gladiatr> pete-joh, It depends on your usage patterns and internet connectivity.
09:13 < gladiatr> pete-joh, like most things, I guess.
09:13 -!- krzie [~k@openvpn/community/support/krzee] has quit [Ping timeout: 272 seconds]
09:18 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:20 -!- iceberg_ [~iceberg@64.141.147.212] has joined #openvpn
09:20 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Read error: Connection reset by peer]
09:21 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
09:25 -!- iceberg_ [~iceberg@64.141.147.212] has quit [Ping timeout: 272 seconds]
09:25 -!- sporedi [~chatzilla@mail.utmxtm.com] has left #openvpn []
09:29 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:29 < pete-joh> gladiatr: bandwidth overhead may be constant?
09:31 < gladiatr> pete-joh, how do you mean?
09:32 < pete-joh> gladiatr: packet data overhead needed should be the same if network sends a packet that is 1b or 1000b?
09:33 < gladiatr> I believe that to be true.
09:33 < pete-joh> gladiatr: k,i was thinking about voip-server use-case, maybe traffic peak capacity 100 calllegs transmitting/receiving 160byte rtp packets every 20ms.
09:34 < pete-joh> gladiatr: the vpn channel would be between two servers, would it work?
09:35 < gladiatr> Are your internet connections symmetrical?
09:37 < jambooda> Hello,  does anyone know of any good documentation on how to compile lzo statically into openvpn?  I want everything else to be dynamic but lzo should be static.
09:38 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
09:39 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
09:39 < pete-joh> gladiatr: hm i have no idea :)
09:41 < gladiatr> pete-joh, is the upstream and downstream bandwidth the same on both of your internet connections?
09:42 -!- iceberg_ [~iceberg@64.141.147.212] has joined #openvpn
09:43 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Read error: Connection reset by peer]
09:43 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
09:47 -!- iceberg_ [~iceberg@64.141.147.212] has quit [Ping timeout: 260 seconds]
09:49 < pete-joh> gladiatr: yep, incoming and outgoing traffic are using the same port
09:52 < gladiatr> hrm... ok, well, if you have access to symetrical, reasonably high-speed connections on both ends, you should have a decent experience.  You might end up needing to tweak your configuration to optimize it after you've done your initial testing.
09:52 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
09:54 < iceberg> when I add:     push "dhcp-option DNS 10.2.2.1"      my client just continually reconnects, if I remove the line it is fine.  Client config:  http://pastebin.com/RLy0vkPD      The error I get is 'No Such Key' but if I remove the DNS push the key I have works just fine. Client OS: OS X, Client: tunelblick     any help would be appreciated.
09:55 < pete-joh> gladiatr: alright nice
09:57 -!- Blues-Man [~bluesman@host33-5-dynamic.3-79-r.retail.telecomitalia.it] has joined #openvpn
09:59 < gladiatr> iceberg, have you searched the tunnelblick mailing lists for this error?
09:59 -!- Blues-Man [~bluesman@host33-5-dynamic.3-79-r.retail.telecomitalia.it] has left #openvpn []
10:01 < iceberg> I searched google in general and found that that line only works for windows clients, how do I push dns settings to non-windwos clients?
10:04 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:04 < gladiatr> Huh.  I'm not in a position to check (I don't have a mac with me), but I configured a couple os x systems in the last 6 months and didn't have that sort of issue.
10:04 < gladiatr> Everything I'm seeing (from googling openvpn tunnelblick DNS) is all quite old (pre-2008)
10:05 < iceberg> actually there is a new posting from Dec, with no replies
10:06 < iceberg> http://code.google.com/p/tunnelblick/issues/attachmentText?id=61&aid=3358861294701302015&name=DNSresetVPN.log&token=e99e51d0e046d5ed6236a0c3dd2cc67b
10:06 <@vpnHelper> Title: DNSresetVPN.log (filesize) - tunnelblick - Project Hosting on Google Code (at code.google.com)
10:06 < gladiatr> Ahh.  I mean, TB uses a standard openvpn configuration file.  You could always use an up-script to fix up your DNS settings.  I looked it up once (but don't recall) the particular incantation to manually configure DNS on os x
10:07 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
10:07 < iceberg> well it wont always be a mac
10:07 < gladiatr> bwah?
10:07 -!- Bushmills [~l@scarydevilmonastery.net] has left #openvpn []
10:08 < iceberg> not everyone here uses a mac
10:08 < iceberg> so I would prefer to control the DNS settings from the server
10:09 < gladiatr> oh, sure.  You can still get the data from the server, but if tunnelblick is distributing a broken openvpn client, I'm just suggesting you could have an up-script that you distribute with the os x configuration to take care of Doing The Right Thing with the server supplied DNS config data.
10:11 < gladiatr> The only thing I'm seeing in the TB 3.1 Known Issues page is that the supplied script won't set the default search domain.
10:11 < iceberg> Im about to test it on the openvpn porable for windows to see if it's a config issue or just local to tunnelblick
10:12 -!- takamichi [Takamichi@85.232.213.54] has quit [Ping timeout: 246 seconds]
10:13 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
10:17 < iceberg> ok, it's defiantly tunelblick
10:18 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Remote host closed the connection]
10:18 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
10:20 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Remote host closed the connection]
10:20 -!- iceberg_ [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
10:21 -!- iceberg [~iceberg@64.141.147.212] has joined #openvpn
10:21 -!- p3rror [~mezgani@41.140.27.249] has quit [Read error: Connection reset by peer]
10:24 <@vpnHelper> RSS Update - forum: OpenVPN or how to configure it from the Windows 7 <http://forums.openvpn.net/topic7496.html#p9084>
10:24 -!- iceberg_ [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Ping timeout: 250 seconds]
10:30 -!- Bushmills [~l@scarydevilmonastery.net] has joined #openvpn
10:37 -!- p3rror [~mezgani@41.140.39.76] has joined #openvpn
10:42 -!- mrle0 [~fin@85.69.2.81.in-addr.arpa] has quit [Quit: Leaving]
10:50 -!- p3rror [~mezgani@41.140.39.76] has quit [Ping timeout: 264 seconds]
10:53 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 272 seconds]
10:53 -!- takamichi [Takamichi@85.232.213.54] has joined #openvpn
10:54 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
11:00 <@vpnHelper> RSS Update - forum: Pushing Routes <http://forums.openvpn.net/topic7500.html>
11:02 -!- p3rror [~mezgani@41.140.25.30] has joined #openvpn
11:06 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
11:07 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving.]
11:11 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
11:12 <@vpnHelper> RSS Update - forum: Pushing Routes <http://forums.openvpn.net/topic7500.html#p9086>
11:13 < gladiatr> Dear vpnHelper, Hi.  My name is Stephen.  I am completely misinformed as to the nature of biology on this nice little planet of yours.  I've noticed you have Cows.  I have been told they are quite versatile.  But, I was wondering: I thought I would have some new friends over for dinner last week, so I obtained a cow and butchered it, as per the instructions that came with the cow.  But, I do not understand why, after following all the 
11:13 < gladiatr> How do I make my cow give me green beans?
11:13 < gladiatr> Sincerely,
11:13 < gladiatr> Stephen the Alien
11:15 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
11:17 -!- dazo is now known as dazo_afk
11:17 <@vpnHelper> RSS Update - forum: Pushing Routes <http://forums.openvpn.net/topic7500.html#p9087>
11:24 <@vpnHelper> RSS Update - forum: UPnP over openVPN, is it possible? <http://forums.openvpn.net/topic7498.html#p9088>
11:24 -!- p3rror [~mezgani@41.140.25.30] has quit [Ping timeout: 240 seconds]
11:29 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:35 -!- iceberg_ [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
11:36 -!- p3rror [~mezgani@41.140.152.197] has joined #openvpn
11:39 -!- iceberg [~iceberg@64.141.147.212] has quit [Ping timeout: 240 seconds]
11:39 -!- iceberg_ is now known as iceberg
11:44 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
11:51 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Operation timed out]
11:54 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
12:00 -!- powerunits [~aa@116.71.183.202] has joined #openvpn
12:00 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
12:02 < powerunits> hi 
12:02 < powerunits> every one i have openvpn server on windows. it was working fine. all clients could connet to it easly.. 
12:02 < powerunits> but for some reason
12:02 < powerunits> i stoped working..
12:03 < powerunits> some clinets can connect and come can't 
12:03 < powerunits> some can't
12:03 < powerunits> http://pastebin.com/TCe9y0jb
12:03 < powerunits> here is the clients log file.. please 
12:03 < powerunits> can some one help me on this?
12:04 < reiffert> hi powerunits.
12:04 < reiffert> when did you install the stuff and when was the last time it was fully working?
12:04 < powerunits> hi
12:05 -!- benner [~benner@kortu.kalade.lt] has joined #openvpn
12:05 < benner> hi
12:05 < powerunits> well i installed openvpn server on windows 2003 4 months back
12:05 < powerunits> till last week it was working fine..
12:05 < gladiatr> your clocks are no correct: VERIFY ERROR: depth=1, error=certificate is not yet valid:
12:05 < benner> !welcome
12:05 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:05 < reiffert> powerunits: do you dont seem to hit the "a certificate got expired" problem.
12:05 < gladiatr> s/no/not
12:06 < benner> !redirect 
12:06 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:06 < reiffert> powerunits: but have a look at gladiatr's response.
12:06 < benner> !def1
12:06 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
12:06 < powerunits> humm
12:06 < reiffert> krzee: can we have vpnHelper to answer by /msg or /notice or something similar please?
12:07 < reiffert> krzee: like !foo nickname -> /msg nickname !foo
12:07 < powerunits> let me send you all config files as well
12:07 < reiffert> s,!foo$,[foo],
12:07 < reiffert> powerunits: why all the config files. please fix:
12:07 < reiffert> VERIFY ERROR: depth=1, error=certificate is not yet valid:
12:08 < reiffert> powerunits: two possible reasons: when you started creating the certificate, the clock was running way into the future, or it is running way into the past right now.
12:09 < gladiatr> Well, the log files have a Nov. 1 date stamp...
12:09 < reiffert> gladiatr: which year?
12:09 < powerunits> oooh may be this is coz of i changed time on my client machine
12:10 < gladiatr> 2010, but still...
12:10 < reiffert> powerunits: maybe = the reason.
12:10 < powerunits> today when i started my client machine..
12:10 < powerunits> it gave me time error
12:10 < powerunits> then i went into bios and correct time settings
12:10 < powerunits> after that on that vpn client machine
12:11 < powerunits> i am unable to connect
12:11 < reiffert> powerunits: shall I copy paste again or will you provide recent logfiles or are you trying to fix the date/time problem?
12:12 < reiffert> vorsicht, kunde droht mit auftrag :)
12:12 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
12:12 < powerunits> its still showing worng time
12:12 < powerunits> Mon Nov  1 07:12:05 EDT 2010
12:13 < gladiatr> Hrm... needless to say, this would explain the problem.
12:14 < powerunits> i changed the time
12:14 < powerunits> now its connected
12:14 < powerunits> :)
12:14 < powerunits> thanks alot for giving me this hint :)
12:14 < gladiatr> no problem :)
12:14 < reiffert> just search for "error" in the logfile.
12:14 < reiffert> you are welcome
12:14 < powerunits> thanks
12:15 < powerunits> by the way i used this command date --set="11 JAN 2011 23:10:00"
12:15 < powerunits> to change to time
12:15 -!- benner [~benner@kortu.kalade.lt] has quit [Ping timeout: 240 seconds]
12:15 < powerunits> now does this command change the time for ever
12:15 < powerunits> or after reboot it will go back to old time?
12:18 < reiffert> depends on your bios and your operating system. try it out.
12:18 < gladiatr> Your system clock should be able to keep you within a reasonable proximity to the "correct" time
12:18 < gladiatr> If it isn't, there is something wrong with your motherboard.
12:19 < powerunits> i checked .. after rebooting system.. system shows me correct time :)
12:19 < powerunits> thanks guys for your help
12:21 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Quit: iceberg]
12:21 -!- benner [~benner@kortu.kalade.lt] has joined #openvpn
12:21 -!- benner [~benner@kortu.kalade.lt] has left #openvpn []
12:33 -!- p3rror [~mezgani@41.140.152.197] has quit [Ping timeout: 240 seconds]
12:40 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:41 -!- powerunits [~aa@116.71.183.202] has quit []
12:41 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:46 -!- p3rror [~mezgani@41.140.181.215] has joined #openvpn
12:51 -!- pete-joh [~pete-joh@triton.dsv.su.se] has quit [Quit: leaving]
13:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
13:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
13:20 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
13:35 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Ping timeout: 272 seconds]
13:36 -!- d12fk [~heiko@vpn.astaro.de] has joined #openvpn
13:57 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
14:00 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:01 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 260 seconds]
14:02 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
14:04 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
14:05 -!- stony is now known as Guest11684
14:07 -!- Guest11684 is now known as gisikon
14:09 -!- p3rror [~mezgani@41.140.181.215] has quit [Ping timeout: 240 seconds]
14:10 -!- tona [~boingboin@189.162.124.99] has joined #openvpn
14:10 < tona> hello guys 
14:11 < tona> where can i download manual at pdf?
14:13 < gisikon> tona: http://www.web2pdfconvert.com/getPDF.aspx?path=1ffb2865-8122-4e0d-b1f6-868c5e6877dfwww-openvpn-net.pdf
14:14 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
14:22 -!- KipMacy [~kmacy@unaffiliated/kipmacy] has joined #openvpn
14:23 -!- risc427 [~risc@dss.datastreamer.net] has joined #openvpn
14:24 < risc427> anyone around?
14:29 < reiffert> nope
14:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:39 -!- raidzxx [~Andrew@seance.openvpn.org] has joined #openvpn
14:40 -!- Netsplit *.net <-> *.split quits: js_, kisom, raidzx, blackpenguin, Bushmills, sno, pa, Martin`, belZe, fbh,  (+8 more, use /NETSPLIT to show all of them)
14:42 -!- Netsplit over, joins: raidzx, kisom, belZe, Bushmills, _zero__, diphthong, js_, sia^pwnnt, ScriptFanix, blackpenguin (+8 more)
14:43 -!- raidzx [~Andrew@2002:adc0:e0ad::adc0:e0ad] has quit [Ping timeout: 274 seconds]
14:44 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
14:47 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:49 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
14:56 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
15:01 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
15:15 -!- nb is now known as i
15:16 -!- gisikon is now known as stony
15:16 -!- KipMacy [~kmacy@unaffiliated/kipmacy] has quit [Quit: Lost terminal]
15:18 -!- i is now known as nb
15:19 -!- p3rror [~mezgani@41.140.183.184] has joined #openvpn
15:20 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
15:21 < morbidwar> hello everyone
15:22 < morbidwar> can somebody help me? everytime i'm running bridge-start (the bridging script that cames with openvpn) the network goes down
15:23 -!- tona [~boingboin@189.162.124.99] has quit []
15:26 -!- p3rror [~mezgani@41.140.183.184] has quit [Remote host closed the connection]
15:33 -!- newbie|2 [~kvirc@124-169-6-237.dyn.iinet.net.au] has joined #openvpn
15:34 < krzie> morbidwar, why do you want a bridge...?
15:35 -!- KipMacy [~kmacy@unaffiliated/kipmacy] has joined #openvpn
15:35 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html>
15:35 < morbidwar> krzie: i resolved, added > eth_gw="x.x.x.x" and route add default gw $eth_gw
15:35 < morbidwar> it was deleting the default route
15:36 -!- dschuett [~dschuett@216.229.21.250] has quit [Ping timeout: 240 seconds]
15:42 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 260 seconds]
15:42 -!- KipMacy [~kmacy@unaffiliated/kipmacy] has quit [Quit: Lost terminal]
15:56 -!- sparkymarkd [~mark@200.32.232.149] has quit [Ping timeout: 240 seconds]
15:56 -!- sparkymarkd [~mark@h69-21-196-174.mdsnwi.dedicated.static.tds.net] has joined #openvpn
16:00 -!- risc427 [~risc@dss.datastreamer.net] has quit [Quit: Leaving]
16:02 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 260 seconds]
16:06 -!- s7r [~s7r@212.78.230.220] has left #openvpn []
16:06 -!- newbie|2 [~kvirc@124-169-6-237.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
16:07 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Read error: Connection reset by peer]
16:07 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Remote host closed the connection]
16:08 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
16:14 -!- p3rror [~mezgani@41.140.40.103] has joined #openvpn
16:19 -!- KipMacy [~kmacy@unaffiliated/kipmacy] has joined #openvpn
16:27 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 265 seconds]
16:42 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
16:55 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
16:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:58 -!- Xgates [debian-tor@gateway/tor-sasl/xgates] has joined #openvpn
16:59 < Xgates> Hi guys
17:00 < Xgates> I have a problem with a VPN service dropping me typically every hour and I made a post if anyone can help;
17:00 < Xgates> https://forums.openvpn.net/topic7503.html
17:14 < krzie> Xgates, 
17:14 < krzie> !man
17:14 < krzie> you asked about --inactive
17:14 < krzie> read about it in the manual
17:14 < krzie> damn bot is down again, 1sec
17:15 < krzie> also read about --keepalive
17:15 -!- sparkymarkd [~mark@h69-21-196-174.mdsnwi.dedicated.static.tds.net] has quit [Ping timeout: 240 seconds]
17:16 < Xgates> thanks where's this manual at? 
17:16 < Xgates> on my box or online?
17:16 < krzie> oh damn the bots server is down
17:16 < krzie> ecrist, ^
17:16 < krzie> you have a manual on your box, AND one at www.openvpn.net/man-beta
17:19 < Xgates> so are these options cmds --inactive --keepalive something everyone should be using for situations like this and because I'm not using them it's why I have this problem?
17:21 < krzie> not sure, i have never *not* used keepalive
17:21 < Xgates> do you use --inactive as well?
17:22 < krzie> nope, just --keepalive, go read what it is
17:22 < Xgates> Well the link you gave me points here;
17:22 < Xgates> http://www.openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html
17:23 < Xgates> there are only 3 entries so at this point I don't get, is this a cmd to run or an option to place in the client.conf and use?
17:23 < krzie> !--
17:23 < krzie> grrr
17:23 < krzie> damn bot
17:23 < krzie> it is either
17:24 < gladiatr> bzzzT *pop*
17:24 -!- corretico [~corretico@201.201.44.82] has quit [Remote host closed the connection]
17:24 < Xgates> ok so then this would be all I need to use that?
17:24 < Xgates> openvpn --auth-nocache --keepalive  --config /etc/openvpn/config.conf --ca /etc/openvpn/certs/ca.crt
17:25 < krzie> Xgates, every single config option can be used at cli or in the config
17:25 < krzie> at cli with --, in config without the --
17:25 < Xgates> ok
17:25 < Xgates> ok I see...
17:26 < Xgates> I don't see anything about a certain amount of numbers needed for keepalive
17:26 < Xgates> So as a cli option this is all you use --> --keepalive ?
17:26 < Xgates> like I showed above...
17:26 < krzie> no...
17:27 < krzie> --keepalive n m 
17:27 < krzie> A helper directive designed to simplify the expression of --ping and --ping-restart in server mode configurations. 
17:27 < krzie> For example, --keepalive 10 60 expands as follows:
17:28 < krzie> pay attention to the example
17:28 < krzie> then read about the options that are included in --keepalive
17:28 < krzie> and note, you dont actually need any cli options, you can put any/all in the config
17:29 < krzie> (but what you are doing is fine too)
17:29 < Xgates> I'm a geek of many years and even as a Geek it makes little sense...
17:29 < Xgates> like n m as an example what is this representing?
17:30 < krzie> dude, its directly under the lines i pasted
17:30 < krzie> For example, --keepalive 10 60 expands as follows: 
17:30 < krzie>  if mode server:
17:30 < krzie>    ping 10
17:30 < krzie>    ping-restart 120
17:30 < krzie>    push "ping 10"
17:30 < krzie>    push "ping-restart 60"
17:30 < krzie>  else
17:30 < krzie>    ping 10
17:30 < krzie>    ping-restart 60
17:30 < krzie> so then you should read about --ping and --ping-restart
17:31 < Xgates> sorry for seeming dense here but to me this is very little information to understand...
17:31 < Xgates> and THANKS for helping :)
17:31 < krzie> yw
17:31 < krzie> would be easier if my bot was here
17:33 < Xgates> well I'm not totally dead here I understand what keepalive is about...
17:33  * Xgates reads
17:33 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 276 seconds]
17:34 < Xgates> is the manual in mistake?
17:34 < krzie> not to my knowledge...
17:35 < Xgates> Isn't the --ping-restart n listed there by what we are reading suppose to be M instead of N like ---> --ping-restart m ?
17:35 < Xgates> cause we are talking about a n m and when you said to look at ping and ping restart I see no mention of m only two n
17:36 < krzie> lol ignore the letters used and understand their meaning
17:36 < Xgates> ok
17:36 < krzie> valid point tho, i will bring it up
17:37 < Xgates> yeah since it does say --keepalive n m hehe ;p
17:37 < Xgates> ok so I get this now...
17:37 < Xgates> is there any figures that are considered a 'Default' to use?
17:38 < Xgates> is --keepalive 10 60  -- the 10 60 common?
17:38 < Xgates> I like to use defaults when possible that cover common ground for most situations...
17:38 < krzie> yep, very common
17:39 < Xgates> ok good I'll use that then
17:39 < Xgates> is the placement in the cmd I'm using ok?
17:39 < Xgates> --> openvpn --auth-nocache --keepalive 10 60 --config /etc/openvpn/config.conf --ca /etc/openvpn/certs/ca.crt
17:44 < krzie> order doesnt matter unless your config overrides things set before it
17:44 < Xgates> the client.conf or the conf from the VPN service?
17:45 < Xgates> right now I'm not using any client.conf
17:45 < Xgates> I just run the cmds are all to start and that's it
17:46 < krzie> --config /etc/openvpn/config.conf
17:46 < krzie> what do you call THAT
17:46 < krzie> ;]
17:50 < Xgates> That's what I was talking about I haven't been using it
17:50 < Xgates> I did before but not at the moment
17:53 < Xgates> ahh my bad
17:53 < Xgates> that's the VPN service providers config not the OpenVPN client.conf
17:53 < Xgates> krzie: you use Windows or Linux?
17:54 < Xgates> my bad I was talking about the client.conf that is in /usr/doc/openvpn-2.1.4/sample-config-files/ if I needed to use that
17:54 < krzie> osX and freebsd
17:54 < Xgates> ok bsd might have the same path and configs
17:54 < Xgates> or close to it...
17:56 < Xgates> Ahh the technical name, heheh, 'The Client Side OpenVPN config' :)
17:56 < Xgates> http://pastebin.com/Mq5CBbQj
17:57 < Xgates> yeah my bad when I reinstalled OpenVPN I didn't put this back in /etc/openvpn
17:58 < Xgates> errrr 
17:59 < krzie> no comments please
17:59 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Ping timeout: 276 seconds]
17:59 < Xgates> This is what's in /etc/openvpn/config.conf --->       http://pastebin.com/Xsvy33HK
17:59 < Xgates> I take it that is all I need
17:59 < krzie> and location does not matter, just use full paths
18:00 < Xgates> my bad, I guess the sample config is just like the one that the VPN provider gave me 
18:00 < krzie> and osx/linux/bsd configs are the same... windows too although they have a couple optional config options and paths are different style
18:01 < krzie> waitwait
18:01 < krzie> you have a vpn provider and dont run your own server?
18:01 < Xgates> but you see what I'm saying? I think I confused myself with my lack of experience with OpenVPN that I thought 'The Client Side OpenVPN config' was something different I used but that the config I showed in the second pastebin URL is that config that the VPN provider gives you, that you use, correct?
18:02 < krzie> looks like it
18:02 < Xgates> no I don't run a server I'm just using a VPN service
18:02 < krzie> you gotta get help from them really
18:02 < krzie> any options they push to you will override your own
18:02 < Xgates> yeah np hopefully the --keepalive will help
18:03 < krzie> so for example when you added keepalive, it prolly does nothing
18:03 < Xgates> well their config doesn't have keepalive in it
18:03 < krzie> you have their config!?
18:03 < krzie> the SERVER config...?
18:03 < Xgates> No client config they give you ---> http://pastebin.com/Xsvy33HK
18:03 < krzie> right
18:03 < krzie> im telling you that their server config will override your client stuff
18:03 < krzie> if they choose
18:04 < krzie> you need to get support from THEM
18:04 < Xgates> yes I know
18:04 < Xgates> I just didn't know if keepalive was still something I used regardless and, typically speaking they wouldn't override something like this
18:05 < krzie> if they use keepalive, it overrides your
18:05 < krzie> yours*
18:05 < Xgates> I'll ask them, ok...
18:05 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
18:05 -!- mode/#openvpn [+o vpnHelper] by ChanServ
18:05 < krzie> yay!
18:05 < ecrist> krzie: I was re-racking all the gear, cleaning out dust, rerouting power, etc.
18:06 < krzie> ahh sweet
18:06 < ecrist> my whole home lan has been down for about 2 hours
18:06 < krzie> ahh you IRC from remote?
18:06 < ecrist> yeah, I IRC from a work machine that's under-utilized.
18:07  * ecrist poofs to eat dinner
18:09 < Xgates> THANKS krzie for your help, I'll add in the --keepalive and see if it helps in the meantime while I wait on them...
18:09 < Xgates> LATER
18:09 -!- Xgates [debian-tor@gateway/tor-sasl/xgates] has quit [Quit: Ping Timeout ( 0.0 Seconds )]
18:15 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Quit: Leaving]
18:32 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
18:32 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
18:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:45 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
18:49 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
18:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
19:09 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
19:13 -!- rkantos_ [robin@hp1.jaketus.net] has quit [Ping timeout: 246 seconds]
19:26 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
19:34 -!- grishnav [~grishnav@209.160.52.134] has quit [Ping timeout: 276 seconds]
19:39 -!- pyther24 [~pyther@unaffiliated/pyther] has joined #openvpn
19:39 < pyther24> Hmm
19:40 < pyther24> my linux hosts can get to two /32 addresses, but my windows host can't
19:40 < |Mike|> what.
19:40 < pyther24> does windows not like /32 addresses?
19:40 < |Mike|> firewall.
19:40 < pyther24> |Mike|: are you talking to me?
19:40 < |Mike|> Yes sir.
19:40 < pyther24> well I'm connecting using the same user
19:41 < pyther24> meaning the same firewall rules should be applied when I connect
19:42 < |Mike|> you can reach those /32's when the windows firewalls are off?
19:42 < pyther24> no, but I can reach them on my linux box
19:44 < pyther24> gah never mind, now it is timing out
19:45 < pyther24> I thought it worked today
19:45 < pyther24> hmm maybe I had my resolv.conf messed up today
19:45 < |Mike|> search domains?
19:48 < pyther24> nah that is right, if I dig the internal dns name I get an internal ip address
19:49 < pyther24> I have a route in my table for it
19:51 < pyther24> I'm such an idiot
19:51 < pyther24> it's the firewall
19:51 < pyther24> gah I feel stupid!
19:54 -!- p3rror [~mezgani@41.140.40.103] has quit [Ping timeout: 240 seconds]
20:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:05 -!- Stylles [c915ad9b@gateway/web/freenode/ip.201.21.173.155] has joined #openvpn
20:06 < Stylles> Anyone know well vpn pptp?...........
20:06 < Stylles> Anyone know well vpn pptp?...........
20:07 -!- p3rror [~mezgani@41.140.34.55] has joined #openvpn
20:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:14 -!- pyther24 [~pyther@unaffiliated/pyther] has left #openvpn []
20:14 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
20:16 < pyther> probably a bad idea to make changes to the vpn config file remotely :P
20:19 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
20:21 -!- djgerm2 [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
20:22 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 255 seconds]
20:25 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has quit [Ping timeout: 265 seconds]
20:27 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
20:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
20:49 -!- p3rror [~mezgani@41.140.34.55] has quit [Ping timeout: 276 seconds]
20:49 -!- mirobmwgi [~mirovengi@99-3-161-173.lightspeed.mmphtn.sbcglobal.net] has joined #openvpn
20:50 < mirobmwgi> !welcome
20:50 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:55 < mirobmwgi> !goal
20:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:57 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
20:58 < mirobmwgi> !howto
20:58 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
21:01 -!- p3rror [~mezgani@41.140.42.91] has joined #openvpn
21:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:13 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:13 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:13 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:27 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
21:27 < KipMacy> how can i restrict a vpn client's network access ?
21:30 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
21:31 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
21:35 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
21:55 < krzie> KipMacy, how would you stop someone on your LAN's network access?
21:56 < KipMacy> threat of death
21:58 < theDoc> krzie: vlans segregation + acls + monitoring
22:00 < krzie> firewalls?
22:00 < krzie> (good point on vlans tho)
22:11 -!- p3rror [~mezgani@41.140.42.91] has quit [Ping timeout: 265 seconds]
22:11 < KipMacy> i haven't tried at all but can i make the openvpn server sit on more than one vlan?
22:12 < KipMacy> openvpn server in unix
22:12 -!- pyther [~pyther@unaffiliated/pyther] has quit [Read error: Operation timed out]
22:19 <@vpnHelper> RSS Update - forum: UPnP over openVPN, is it possible? <http://forums.openvpn.net/topic7498.html#p9098>
22:25 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
22:27 -!- gladiatr [~gladiatr@madeline.boneyard.lawrence.ks.us] has quit [Quit: My damn controlling terminal disappeared!]
22:48 < theDoc> krzie: Just need to becareful of l2 attacks.
22:48 < theDoc> Most of them are thwartable if you have a good admin around.
22:52 < krzie> theDoc, true
23:02 -!- Stylles [c915ad9b@gateway/web/freenode/ip.201.21.173.155] has quit [Ping timeout: 265 seconds]
23:07 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
23:20 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
23:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
23:29 < krzie> KipMacy, dont worry bout layer2 if you use tun
23:29 < krzie> just use a firewall
23:29 < krzie> doc was pointing out that i misspoke ;]
23:29 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Disconnected by services]
23:29 < krzie> and services disconnected him for it!
23:30 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
23:30 < reiffert> moin
23:30 < krzie> moin reif!
23:31 < reiffert> krzie!
23:38 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9100> || cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html>
23:41 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
23:42 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
23:44 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9101>
23:50 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9102>
23:55 <@vpnHelper> RSS Update - forum: OpenVPN In Linux - Do You Need To Configure Anything? <http://forums.openvpn.net/topic7503.html#p9104> || cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html#p9103>
--- Day changed Wed Jan 12 2011
00:02 <@vpnHelper> RSS Update - forum: UPnP over openVPN, is it possible? <http://forums.openvpn.net/topic7498.html#p9105>
00:08 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9107> || Linux client problem <http://forums.openvpn.net/topic7497.html#p9106>
00:14 <@vpnHelper> RSS Update - forum: OpenVPN or how to configure it from the Windows 7 <http://forums.openvpn.net/topic7496.html#p9109> || Pushing Routes <http://forums.openvpn.net/topic7500.html#p9108>
00:19 < krzie> and something else I just realized, many well managed hotspots despite their insane port and traffic restrictions allow IPSec VPNs on port 1293!!!
00:19 < krzie> So I also added 1293 TCP/UDP, which seems to work just fine at this problematic hotspot! In fact I'm posting this over my VPN from that very hotspot right now.
00:19 <@vpnHelper> RSS Update - forum: Setting TCP or UDP from the client side? <http://forums.openvpn.net/topic7336.html#p9111> || Firewall blocked https traffic <http://forums.openvpn.net/topic7466.html#p9110>
00:19 < krzie> cool!
00:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
00:22 -!- tessier_ [~treed@mail.copilotco.com] has quit [Quit: leaving]
00:26 <@vpnHelper> RSS Update - forum: Routing Questions <http://forums.openvpn.net/topic7306.html#p9113> || Data output <http://forums.openvpn.net/topic7314.html#p9112>
00:29 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
00:32 <@vpnHelper> RSS Update - forum: cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html#p9114>
00:37 < theDoc> krzie: Do you know if the ipsec code has been cleared by the bsd guys?
00:37 -!- us3r [~aaron@CPE000d88382326-CM0012256eb04c.cpe.net.cable.rogers.com] has joined #openvpn
00:37 < theDoc> The last I heard, they were reviewing the code because of someone screaming about a backdoor in it.
00:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:40 < krzie> havnt heard anything newer than that as well
00:41 < krzie> even when its "cleared" i wont trust it
00:41 -!- us3r [~aaron@CPE000d88382326-CM0012256eb04c.cpe.net.cable.rogers.com] has quit [Client Quit]
00:43 < theDoc> I'm not touching ipsec anymore.
00:43 < theDoc> That probably includes ipsec implentations in cisco devices.
00:46 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
00:50 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9115>
00:51 -!- dazo_afk is now known as dazo
01:06 -!- jacky_bro [~hk@209.25.231.82] has joined #openvpn
01:06 < jacky_bro> !welcome
01:06 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:07 < jacky_bro> !route
01:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
01:07 <@vpnHelper> RSS Update - forum: Linux client problem <http://forums.openvpn.net/topic7497.html#p9116>
01:24 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9117>
01:25 -!- WinstonSmith [~true@e179010020.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
01:25 -!- WinstonSmith [~true@e179010020.adsl.alicedsl.de] has joined #openvpn
01:30 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9120> || cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html#p9119> || No internet from units inside LAN when TUN bridge is up <http://forums.openvpn.net/topic7505.html>
01:31 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:33 -!- jacky_bro [~hk@209.25.231.82] has quit [Remote host closed the connection]
01:33 -!- jkjk [~hk@209.25.231.82] has joined #openvpn
01:33 -!- jkjk is now known as jacky_bro
01:36 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9122> || Linux client problem <http://forums.openvpn.net/topic7497.html#p9121>
01:36 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
01:39 < krzie> reiffert, is the offer still open for you to help me get krz.ee?
01:40 < krzie> i talked to the guy from .ee and he said it is fine
01:48 <@vpnHelper> RSS Update - forum: No internet from units inside LAN when TUN bridge is up <http://forums.openvpn.net/topic7505.html#p9123>
01:58 -!- WinstonSmith [~true@e179010020.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
01:59 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
02:07 -!- takamichi [Takamichi@85.232.213.54] has quit [Ping timeout: 240 seconds]
02:07 -!- takamichi [Takamichi@85.232.213.54] has joined #openvpn
02:09 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
02:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:15 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:15 -!- mode/#openvpn [+o mattock] by ChanServ
02:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:16 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
02:18 <@vpnHelper> RSS Update - forum: cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html#p9125>
02:30 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9126>
02:36 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9128> || cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html#p9127>
02:42 <@vpnHelper> RSS Update - forum: creating additonal users <http://forums.openvpn.net/topic7506.html> || Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9130> || cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html#p9129>
02:52 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
02:57 -!- rot13 [~var@unaffiliated/rot13] has quit [Ping timeout: 276 seconds]
02:57 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
02:57 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
02:58 -!- jacky_bro [~hk@209.25.231.82] has quit [Remote host closed the connection]
02:58 -!- jkjk [~hk@209.25.231.82] has joined #openvpn
03:01 -!- jkjk [~hk@209.25.231.82] has quit [Remote host closed the connection]
03:01 -!- jacky_bro [~hk@209.25.231.82] has joined #openvpn
03:06 <@vpnHelper> RSS Update - forum: Pushing Routes <http://forums.openvpn.net/topic7500.html#p9132>
03:10 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:15 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has quit [Ping timeout: 264 seconds]
03:19 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:21 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:24 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has joined #openvpn
03:24 <@vpnHelper> RSS Update - forum: Pushing Routes <http://forums.openvpn.net/topic7500.html#p9133>
03:36 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p9134>
03:37 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
03:39 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:39 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:47 < hyper_ch> hello there
03:48 < Rienzilla> hehe I guess after all the tun/tap talk in the past weeks there is nobody here willing to help me debugging a networking issue involving a tap vpn? :-)
03:48 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9135>
03:50 -!- master_of_master [~master_of@p57B544B0.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
03:52 -!- master_of_master [~master_of@p57B56AC2.dip.t-dialin.net] has joined #openvpn
03:58 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
04:09 -!- pielgrzym [~pielgrzym@1str003.multi-play.net.pl] has joined #openvpn
04:09 < pielgrzym> hi
04:09 < pielgrzym> my logwatch today was full of this: Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #6580 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings: 1 Time(s)
04:09 < pielgrzym> what does that mean?
04:10 < pielgrzym> openvpn v 2.1~rc11-1 on debian lenny
04:10 < pielgrzym> or maybe I'll actually read the manpage :D
04:10 < pielgrzym> sorry
04:10 < Rienzilla> lol
04:11 < Rienzilla> http://pastebin.com/ufvkJLvy
04:12 < pielgrzym> ok, so I'm somehow gettin replayed packages via udp
04:12 < pielgrzym> but
04:13 < pielgrzym> I have like a dozen exactly same machines
04:13 < pielgrzym> with exactly same vpn config (port, udp etc)
04:13 < pielgrzym> and only this one vm gets the error :/ what is the usual source of such warning?
04:16 < pielgrzym> temporarly I've change to tcp for vpn proto
04:17 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
04:18 -!- Guest82698 [~root@a89-183-28-170.net-htp.de] has joined #openvpn
04:18 -!- Guest82698 [~root@a89-183-28-170.net-htp.de] has quit [Quit: leaving]
04:21 <@dazo> pielgrzym: you get such replay warnings when there are network issues.  UDP does not have sequence ordering of packets or any kind of "packet handshake" like TCP does
04:22 <@dazo> OpenVPN numbers all the its packets, so if the server sends packet 1, 2, 3, 4, 5 .... you might end up receiving 1,2,4 ... which normally is fine, but the replay warning comes when packet 5 and 3 arrives afterwards
04:23 <@dazo> This is how UDP is designed
04:23 <@dazo> while TCP will make sure that all the packets, even though they arrive as 1,2,4,5,3 is sent to the receiving application as 1,2,3,4,5
04:24 <@dazo> TCP also have time-out on the packets and connections, which UDP does not
04:24 <@dazo> however, beware that using VPN over TCP is not recommended
04:24 <@dazo> !tunortap
04:24 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
04:24 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
04:25 <@dazo> !factoids
04:25 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
04:25 <@dazo> gah!
04:25 <@dazo> I meant:
04:25 <@dazo> !tcp
04:25 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
04:25 < pielgrzym> dazo: ah, so it's might be my overcomplicated iptables config on xen dom0 (some machines get bridging, some nat, some nat + port forwarding etc)?
04:26 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
04:26 <@dazo> pielgrzym: nope, it has to do with some of the routing between your boxes and the ISPs and/or the routing between the ISPs
04:27 <@dazo> packet loss is quite common, and packet re-ordering is even more common
04:27 <@dazo> to happen
04:27 < pielgrzym> dazo: ah :) this is stranger than since it's the only box that causes problems and all the bridged boxes have exactly the same config (different ips though)
04:27 < pielgrzym> dazo: so what would you recommend? ignore the messages and switch back to udp? or stay on tcp?
04:28 <@dazo> stay on udp ... replay warnings aren't necessarily nasty ... but you can improve it with some replay options to OpenVPN
04:28 < pielgrzym> ok 
04:28 <@dazo> to make it tolerate bigger spans in the packet reordering
04:29 <@dazo> read up on --replay-window
04:29 < pielgrzym> ok :) thanks!
04:29 < reiffert> did you think about provider mtu yet?
04:29 <@dazo> you're welcome!
04:29 < pielgrzym> and if I use udp I should use tun, right?
04:30 <@dazo> reiffert: nope, but that's a good point!
04:30 < pielgrzym> reiffert: mtu? let me check
04:30 <@dazo> pielgrzym: ^^ see reiffert's comment
04:30  * dazo so often forgets to think about mtu
04:31 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Ping timeout: 272 seconds]
04:33 < pielgrzym> dazo, reiffert it seems the mtu is default 1500 (I can ping -s 1480)
04:33 < Rienzilla> any ideas about  http://pastebin.com/ufvkJLvy ?
04:34 < pielgrzym> dazo, reiffert haha, I'm soo dumb :D ping experimenting instead of using plain old ifconfig :D
04:35 <@dazo> pielgrzym: also look in the openvpn log file for MTU warnings
04:35 <@dazo> you may also want to have a look at --mtu-test in the man page as well
04:36 < pielgrzym> dazo: ah, thanks!
04:37 <@dazo> pielgrzym: however, just as a side note ... I would recommend you to upgrade your openvpn 2.1_rc11), as that is very outdated 
04:37 <@dazo> (but that's most probably not related to your issues right now)
04:38 < pielgrzym> dazo: thanks :) I'll use lenny backports to do it fast and slic ;)
04:40 <@dazo> pielgrzym: at least 2.1.0/2.1.1 or 2.1.4 is recommended ... 2.1.2/2.1.3 might give you some routing issues
04:40 < pielgrzym> dazo: it's not in the backports - I'll have to find some dev or build it by hand :)
04:40 <@dazo> http://openvpn.net/index.php/open-source/downloads.html
04:40 <@vpnHelper> Title: Downloads (at openvpn.net)
04:41 < Rienzilla> curse of debian :/
04:41 < pielgrzym> Rienzilla: nah, it's a blessing - I'm transisting my boxes from gentoo - which was overcomplicated to manage after 2 years
04:41 <@dazo> pielgrzym: if you're brave, you can go for 2.2-beta5  (even though, we're trying to get 2.2-RC out soon, it's just delayed due to windows build issues)
04:41 < Rienzilla> yes, it's the reason I use debian too everywhere.
04:41 < pielgrzym> dazo: nope, it's an prod enviorment :) no betas :)
04:42 < Rienzilla> but you're gonna have outdated software
04:42 -!- common- [~common@p5DDA49AC.dip0.t-ipconnect.de] has joined #openvpn
04:42 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
04:42 <@dazo> pielgrzym: well, the changes from 2.1 are minor ... and I can guarantee it being quite stable ... using it myself privately and in production on two firewalls (one server, one client)
04:43 < pielgrzym> Rienzilla: yes, but hopefully more secure :) on a desktop box I still use rolling distros (arch, gen2), but a server IMHO should be a little outdated ;) 
04:43 < pielgrzym> dazo: I'll take a peek then ;)
04:43 < Rienzilla> yes, I agree. Although, on servers which need some newer stuff, ubuntu server is a nice alternative
04:43 <@dazo> pielgrzym: I share your pain with Gentoo ... I just chose the CentOS road instead of Debian when setting up new boxes :)
04:43 < pielgrzym> Rienzilla: haven't tried that - but nice idea ! :)
04:44 < Rienzilla> and squeeze will be released soon :)
04:44 < Rienzilla> which will get me off 2.1rc11 too :)
04:44 <@dazo> Rienzilla: I don't know about Debian but RHEL/CentOS backports all needed security fixes ... and guarantee that it will just work(tm) until the major release is deprecated (which is 7 years life time, afair)
04:45 < Rienzilla> debian does the same
04:45 < pielgrzym> dazo: initially me too (dom0 is still centos 5.5), but it's much easier to setup django/twisted enviorment on debian (no IUS repo tweaking, no dep hell when installing memcached etc) :) I like centos though - fabulously easy way to setup selinux :)
04:45 -!- jacky_bro [~hk@209.25.231.82] has quit [Ping timeout: 276 seconds]
04:45 < Rienzilla> so you don't have to be afraid of security holes in outdated software. It's just that you don't get new features
04:45 -!- common [~common@p5DDA441B.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
04:45 -!- common- is now known as common
04:46 < pielgrzym> dazo: and yes, rhel/centos backports are security backports, debian backports are feature backports :)
04:46 < Rienzilla> debian backports are not really debian
04:46 <@dazo> reiffert: yes, exactly
04:46 <@dazo> Rienzilla: ^^ 
04:46 <@dazo> (sorry, reiffert)
04:46 < pielgrzym> gotta go :) 
04:46 < Rienzilla> any idea on my networking issue by the way? I'm pretty puzzled about it
04:46 < pielgrzym> dazo: Rienzilla thanks a lot for help and nice talk :)
04:47 < Rienzilla> later pielgrzym 
04:47 < pielgrzym> and reiffert thans for mtu idea :)
04:47 <@dazo> Rienzilla: I dunno, and I should do some work which pays my bills soon :)
04:47 < pielgrzym> bye :)
04:47 <@dazo> c'ya!
04:47 < Rienzilla> haha yeah that shit has to be done too :-)
04:49 <@vpnHelper> RSS Update - forum: No internet from units inside LAN when TUN bridge is up <http://forums.openvpn.net/topic7505.html#p9136>
04:49 < rkantos> why does my lock screen lag for a second when the screen is switched on?
04:49 < rkantos> lol, wrong chan
04:51 < reiffert> Solved?
04:51 < reiffert> you can set whatever mtu with the help of mtu
04:52 < reiffert> problem comes up when carrier doesnt provide such a mtu
04:52 < reiffert> s,help of mtu, help of ifconfig,
04:54 <@dazo> reiffert: I think he is going to investigate that further, and also probably test with --mtu-test (at least that would be clever)
05:00 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
05:00 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9137>
05:07 <@vpnHelper> RSS Update - forum: OPENVPN plugins for DreamBox <http://forums.openvpn.net/topic7507.html>
05:07 < reiffert> hm, dreambox. 
05:08 < reiffert> best stuff out there. e.g. dreambox 8000.
05:08 < hyper_ch> hi reiffert
05:10 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
05:12 < reiffert>                                                                                                                                                                                                                                                                                                                                     n n n n n n n n n n n n nn n      
05:12  * reiffert blaimes the financial office.
05:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:28 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:31 -!- ksk [ksk@im.knubz.de] has quit [Remote host closed the connection]
05:33 < hyper_ch> reiffert: do you have a torrent client at hand that can do magnet links?
05:33 <@vpnHelper> RSS Update - forum: OPENVPN plugins for DreamBox <http://forums.openvpn.net/topic7507.html#p9139>
05:34 -!- s7r [~s7r@94.46.240.202] has joined #openvpn
05:35 -!- ksk [ksk@im.knubz.de] has joined #openvpn
05:39 <@vpnHelper> RSS Update - forum: Help setting up OpenVPN.... <http://forums.openvpn.net/topic7316.html#p9140>
05:45 <@vpnHelper> RSS Update - forum: help me create a vpn server and client in windows <http://forums.openvpn.net/topic7393.html#p9142> || OPENVPN plugins for DreamBox <http://forums.openvpn.net/topic7507.html#p9141>
05:51 <@vpnHelper> RSS Update - forum: OPENVPN plugins for DreamBox <http://forums.openvpn.net/topic7507.html#p9143>
05:55 -!- VirusTB [~VirusTB@145.93.237.142] has joined #openvpn
05:56 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
05:58 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
05:58 -!- Cain` is now known as Cain
06:00 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
06:02 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
06:02 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
06:02 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
06:02 <@vpnHelper> RSS Update - forum: OPENVPN plugins for DreamBox <http://forums.openvpn.net/topic7507.html#p9144>
06:04 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 264 seconds]
06:09 <@vpnHelper> RSS Update - forum: OPENVPN plugins for DreamBox <http://forums.openvpn.net/topic7507.html#p9145>
06:13 -!- Ozzapoo__ [7ca84f19@gateway/web/freenode/ip.124.168.79.25] has joined #openvpn
06:14 < Ozzapoo__> Hi. My VPN server is really slow, I can only get ~2kBps at most
06:14 < Ozzapoo__> Yet I can download a test file from the server over http at 700kBps. 
06:14 < Ozzapoo__> How can I speed up my vpn?
06:16 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
06:19 < renihs> dont download p0rn or similiar on the same line?
06:19 < Ozzapoo__> Very funny
06:20 < renihs> :) afaik there is no traffic limit feature per default
06:20 < renihs> maybe the firewall is limiting the traffic?
06:20 < renihs> to the vpn service port
06:20 < Ozzapoo__> Unlikely
06:21 < Ozzapoo__> I'm using a different port from the default
06:21 < renihs> so what?
06:21 < renihs> maybe only the known ports are set for full speed, maybe it uses l7 technics
06:21 < renihs> i tend to limit ALL unknown traffic to <20kbs :)
06:21 < Ozzapoo__> lol
06:22 < Ozzapoo__> How do I check whether or not I have a firewall
06:22 < renihs> the only thing i could imagine would be a mtu problem causing massive fragmentation, but even that should not get that low
06:23 < renihs> about the firewall, dunno, ask the network admin? :)
06:27 < renihs> afaik, openvpn has no builtin traffic limiting features 
06:27 < renihs> so i doubt the cause is to be searched there
06:31 -!- Ozzapoo__ [7ca84f19@gateway/web/freenode/ip.124.168.79.25] has quit [Ping timeout: 265 seconds]
06:33 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
06:33 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
06:35 -!- krzie [~k@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
06:40 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
06:40 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
06:42 -!- silverraindog [~angus@host86-185-36-14.range86-185.btcentralplus.com] has quit [Ping timeout: 255 seconds]
06:47 -!- VirusTB [~VirusTB@145.93.237.142] has quit [Ping timeout: 240 seconds]
06:50 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
07:01 <@vpnHelper> RSS Update - forum: Openvpn with a nat 4 or 5 clicks and no internet <http://forums.openvpn.net/topic7508.html>
07:21 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:40 -!- silverraindog [~angus@host86-178-116-255.range86-178.btcentralplus.com] has joined #openvpn
07:46 < sno> hi, on my openvpn server i have push "route 192.168.0.0 255.255.0.0, i wish to add a static route different from this, do i need to put this on an additional line or do i need an upscript?
07:47 < sno> this would be in addition to the existing route
07:52 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
07:52 < gladiatr> wheeee
07:55 -!- qermit [~qermit@unaffiliated/pantofel] has quit [Remote host closed the connection]
07:55 <@vpnHelper> RSS Update - forum: OPENVPN plugins for DreamBox <http://forums.openvpn.net/topic7507.html#p9148> || How do I do a complete cleanup after openvpn installation <http://forums.openvpn.net/topic7457.html#p9147>
08:01 <@vpnHelper> RSS Update - forum: Openvpn with a nat 4 or 5 clicks and no internet <http://forums.openvpn.net/topic7508.html#p9149>
08:04 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has joined #openvpn
08:08 < Bebop2Steady> if anyone is up for a challenge:   https://forums.openvpn.net/topic7483.html     <-- all day stuck on 1 problem.
08:08 <@vpnHelper> Title: OpenVPN Support Forum Double VPN || 2 Hop VPN || VPN-over-VPN : Server Administration (at forums.openvpn.net)
08:09 < Bebop2Steady> long story short: using openvpn, is it possible to connect to an openvpn server, then connect to another openven server with the first.. ( so the 2nd server address is 10.x.x.1) .. ?
08:11 < Bebop2Steady> and the 2nd server has redirect gateway def1
08:13 < gladiatr> To clarify, you're making both connections from the client system?
08:13 < Bebop2Steady> yes..
08:14 < gladiatr> Sure.  You can build tunnels within tunnels until your throughput degrades to 300bps :)
08:15 < Bebop2Steady> I made a diagram.. can u see where its gone wrong ?
08:15 < Bebop2Steady> http://i51.tinypic.com/4k73aa.jpg
08:15 < gladiatr> maybe not quite that far... at a certain point things will start to time-out, but you get the idea
08:15 < gladiatr> ugh.  manual IPing.  :P :)
08:16 < Bebop2Steady> manual everything !
08:16 < gladiatr> Weren't you saying that you want to make a connection to countryB from the client?
08:16 < Bebop2Steady> client ->  A  then client -> B while in A
08:17 < gladiatr> more specifically: client -> A, A -> B, client -> C (through VPN), yes?er
08:17 < gladiatr> -> = VPN link
08:17 < gladiatr> bah.  third part should read: client -> B 
08:18 < Bebop2Steady> client -> A  ,  A -> B ,  client -> B    i thikn
08:18 < Bebop2Steady> then exit B in to the WWW
08:20 < gladiatr> Sure.  That will work.  I would suggest availing yourself of the nice macro directives (server and client) that openvpn provides, though--just a lot simpler.  The sort of configuration you're wanting is actually quite simple if you just break it down into its components.  Without seeing the complete configuration, I'm gonna predict that proper routes aren't being instantiated.
08:21 < gladiatr> But, connectivity-wise, as long as your firewalls aren't in the way, there's nothing preventing this concept from being implementable.
08:24 < Bebop2Steady> Are the macros in the man.. I've read the man fairly thouruly
08:24 < Bebop2Steady> by usual standards anyways
08:24 < Bebop2Steady> a thorough skim and then a more thourough skim
08:25 < gladiatr> --server and --client
08:27 < gladiatr> Just sayin... if you're struggling with getting your configuration functional, use the automated features provided by openvpn.  You can always go back and retrofit specific, static configs after the networking bits are passing traffic.
08:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
08:28 < gladiatr> !server
08:30 < Bebop2Steady> i got my routes here:    http://i54.tinypic.com/xat3c6.jpg
08:30 < Bebop2Steady> its all working down to the last point.. I cant ping to tun0 on the right hand side
08:31 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:31 < Bebop2Steady> when I try ping to the ip on tun0,  then in tcpdump, its tun1 that is sending the reply  ( so my client does get the reply)
08:31 < gladiatr> I imagine that you don't have a return route to the network your client is on
08:31 < Bebop2Steady> but tun0 has the next vpn server on it, so i need to be able to reach it
08:31 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
08:32 < Bebop2Steady> i wanted to try iptables mangle route, but its not included with iptables any more.
08:32 < Bebop2Steady> ( mangle route is discontinued or something )
08:33 < gladiatr> um... ok
08:34 < Bebop2Steady> i've tried and documenetd at least 5 different configs or server / client
08:34 < Bebop2Steady> and I made diagrams of each one
08:34 < Bebop2Steady> so I tried different combinations of servers and clients on each physical server
08:34 < Bebop2Steady> i think thats what you mean by --server   --client ?
08:36 < Bebop2Steady> also, all the IPs u see in my diagram, are assigned by openvpn.. i just get to choose the subnets .. ie:   10.x.x.1  for the server address.. then clients get IP assigned by openvpn 
08:37 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
08:38 < Bushmills> right hand route to 10.77.1.0 says tun1. that's subnet of tun0 left hand
08:38 -!- macsppadic [~sonupunno@88.211.55.77] has left #openvpn []
08:38 < Bushmills> seems that left tun0 has right tun1 as end point
08:39 < Bushmills> and vice versa
08:39 < Bebop2Steady> right hand and left hand both have a tun0 and tun1 each (2 tuns per physical machine..)  sorry u cant see much from the pic i posted
08:39 < Bebop2Steady> ahh
08:39 < Bebop2Steady> i get u
08:39 < Bushmills> ok. then let me ask you, instead:
08:39 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Remote host closed the connection]
08:39 < Bushmills> ok. no need to ask, then?
08:40 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
08:40 < Bebop2Steady> tun0 and tun 0 and furthest apat..   
08:40 < Bebop2Steady> and tun1 and tun1 are on the p-t-p link
08:41 < Bushmills> "when I try ping to the ip on tun0,  then in tcpdump, its tun1 that is sending the reply" - that's correct and consistent with your setup
08:41 < Bebop2Steady> ahh my setup must be wrong then
08:41 < Bebop2Steady> im pinging to the IP at tun0     and its tun1 that sends the reply
08:42 < Bushmills> right. because tun1 is its end point
08:42 < Bebop2Steady> im trying to ping 10.77.2.1
08:43 < Bebop2Steady> and my client is to the left or the left 
08:43 < Bushmills> that's an address in the subnet of tun1, left hand, and tun0, right hand
08:43 < Bebop2Steady> left of left i mean
08:43 < Bebop2Steady> 1 sec
08:45 < Bushmills> rather than specifying tun, as dev in config, you can explicitely say  tun0 or tun1
08:47 < Bebop2Steady> im grabbing a full screen grab of all the tuns/everyhting.. 1 more min
08:51 < Bebop2Steady> http://i52.tinypic.com/2h3dimt.jpg
08:51 < Bebop2Steady> everything on the left is one box/country         everything on the right is the other box/country
08:52 < Bebop2Steady> u can see on the right tun0 never gets any movement on tcpdump
08:52 < Bebop2Steady> the bottom 4 quadrants are TUN TCPdumps
08:52 -!- WinstonSmith [~true@e178177136.adsl.alicedsl.de] has joined #openvpn
08:54 < Bebop2Steady> heres a propper diagram (already posted above)   http://i51.tinypic.com/4k73aa.jpg
08:55 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:55 < Bushmills> that's nice that you show me around your system. but your basic gripes still apply: subnet on left tun0 connects to right tun1, and vice versa.
08:56 < Bebop2Steady> ahh is that a problem ?
08:56 < Bushmills> no, shouldn't be a problem. it merely explains why what replies to requests, sent on tun0 (left) go to tun1 (right)
08:57 < Bebop2Steady> but on the right is 10.77.2.1  on tun 1.. how can i get packets to it ?
08:57 < Bebop2Steady> i mean on tun -0
08:57 < Bebop2Steady> on the right 
08:58 < Bebop2Steady> so my goal is to get packets to tun0 / 10.77.2.1   when sending from 10.77.1.6 /left
08:58 < Bushmills> ping 10.77.2.1
08:59 < Bebop2Steady> i do that..
08:59 < Bebop2Steady> and i get replys
08:59 < Bebop2Steady> but the tun0 / right tcpdump stays inactive...   and the activiy from pings is only on tun1 / right              tun 0 +1 left
09:00 < Bebop2Steady> after all that.. i dont care at the end who can ping who...  but the real proble is that i cant connect to the openvpn server at 10.77.2.1
09:01 < Bushmills> if you ping, on right hand machine, a 10.77.2.x address while tcpdumping tun0, you see the echo request and replies, right? 
09:01 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
09:02 < Bebop2Steady> 1 sec
09:02 < Bushmills> btw, why is your gateway, left hand, for 10.77.2.0 net  10.50.50.1?
09:04 < Bebop2Steady> the p-t-p linking left to right  -- has ip 10.50.50.1
09:04 < Bebop2Steady> and its other side is 10.50.50.2
09:05 < Bebop2Steady> its not the same IPs as the diagram...
09:05 < Bushmills> but that's tun1 on right side, not tun0 - which would be the 10.77.2.x subnet right side
09:05 < Bebop2Steady> i think diagram is 10.150.5.1 
09:06 < Bebop2Steady> yeah its linked to tun1
09:06 < Bushmills> and that's where your echo requests come in, right side?
09:06 < Bebop2Steady> tun1     10.50.50.1   -------- p t p ----------- 10.50.50.2  tun1
09:06 -!- WinstonSmith [~true@e178177136.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
09:06 < Bebop2Steady> yes.. they come in there
09:07 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:07 < Bebop2Steady> as for your question before..
09:08 < Bebop2Steady> the tcpdump was inactive when i did a right side ping to right side 10.77.2.1
09:08 < Bebop2Steady> left/ping/left is also inactive
09:09 < Bebop2Steady> only when i ping left to right it lights up tcpdump
09:10 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:11 < Bushmills> simplify your routing. let one client/server/subnet/interface left side talk to one client/server/subnet/interface right side. don't try to route tunneled packets through another tunnel than the one established for that subnet
09:12 < Bushmills> (as in the case of 10.77.2.0 routed through 10.50.50.1 instead of letting it simply reach end point on the tun interface with subnet 10.77.2.0)
09:12 < Bebop2Steady> heres the ping to 10.77.2.1    from pc at home      http://i51.tinypic.com/vrd5df.jpg
09:13 < Bebop2Steady> u mean try a difrernt setup ?
09:13 -!- FSprofi [~chatzilla@77.119.210.250.wireless.dyn.drei.com] has joined #openvpn
09:13 < FSprofi> !welcome
09:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:13 < FSprofi> !goal
09:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:13 < Bushmills> for a start, drop the 10.50.50.0 subnet
09:13 < FSprofi> !redirect
09:13 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
09:14 < Bebop2Steady> OK.. 1 sec.. I show u a pic for each setup i've tried.. all ended the same.. 
09:14 < Bebop2Steady> http://i53.tinypic.com/b7z0p3.jpg
09:15 < Bebop2Steady> http://i53.tinypic.com/k0o6sn.jpg
09:15 < Bebop2Steady> http://i52.tinypic.com/2mczswp.jpg     <-------- this one was the closts to working 
09:15 < Bebop2Steady> http://i56.tinypic.com/rad9ns.jpg
09:16 < Bebop2Steady> http://i56.tinypic.com/2eme70n.jpg   < ----  added an extra server to that one.. sam eresult
09:16 < Bebop2Steady> thats about all..
09:16 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
09:18 < Bebop2Steady> but.. im ready to hear what you started to tell me..
09:18 -!- WinstonSmith [~true@e179011179.adsl.alicedsl.de] has joined #openvpn
09:18 < Bebop2Steady> if its differnt then i will try it
09:19 < Bebop2Steady> so long as it matches the goal
09:20 < Bebop2Steady> I've already got working single VPNS
09:20 < Bebop2Steady> and a standrd double vpn is not what I'm after.
09:21 < Bebop2Steady> standard double vpn has decrytption at the tun on both vpns
09:21 < Bebop2Steady> where as layered or embeded vpn has decrytion at the exit only
09:22 < Bebop2Steady> so the goal is layered/embeded/chained vpn or whatever the name is
09:22 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
09:24 < Bebop2Steady> Bushmills: ?
09:25 -!- WinstonSmith [~true@e179011179.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
09:27 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
09:31 < Bebop2Steady> https://forums.openvpn.net/topic7483.html    I be out .. . . ideas if any, most welcome in the thread.
09:31 <@vpnHelper> Title: OpenVPN Support Forum Double VPN || 2 Hop VPN || VPN-over-VPN : Server Administration (at forums.openvpn.net)
09:31 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
09:33 < FSprofi> how do I get over the 10mbit/s limit on the tun device on windows?
09:33 < ecrist> it's not really a limit
09:34 < ecrist> it just shows that it's a 10Mb link
09:34 < ecrist> it will do more than that
09:34 <@dazo> iirc, it's just a register value which needs to be changed, and it will show almost whatever you want
09:35 < gladiatr> aka: placeholder value
09:35 < FSprofi> k thx
09:35 < gladiatr> or you can just throw more pigeons at it... :P
09:36 -!- WinstonSmith [~true@e179011179.adsl.alicedsl.de] has joined #openvpn
09:41 -!- Irssi: #openvpn: Total of 122 nicks [3 ops, 0 halfops, 0 voices, 119 normal]
09:56 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:57 -!- dazo is now known as dazo_afk
10:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
10:01 -!- radisnki [radisnki@drsd-4dbd840f.pool.mediaWays.net] has joined #openvpn
10:02 -!- radisnki [radisnki@drsd-4dbd840f.pool.mediaWays.net] has quit [Client Quit]
10:03 -!- OiPolloi [~sena@gw.identity.pt] has joined #openvpn
10:04 < OiPolloi> !welcome
10:04 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:05 < OiPolloi> !goal
10:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:09 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
10:09 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
10:10 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:11 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 265 seconds]
10:12 < Rienzilla> Anyone an idea about http://pastebin.com/ufvkJLvy ?
10:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:16 < gladiatr> Those switches are just layer-2 switches, right?  Not some sort of wonky application-layer poo flinging monkey switches?
10:18 < Rienzilla> Maybe the are able to do some higher level switching, but I didn't configure them to
10:18 < Rienzilla> (they're HP Procurve 2650's)
10:18 < gladiatr> k
10:18 < Rienzilla> one more thing, the MAC address of the far end vpn appliance is in the port address list for the switchport connected to the local vpn appliance
10:19 < Rienzilla> (which indicates, I think, that the vpn and bridging is working properly)
10:19 < Rienzilla> furthermore, I have tcpdump'ed with ethernet headers, and the packets are directed towards the correct mac's
10:20 < Rienzilla> (so it's not some other device claiming it has the same IP or something like that)
10:20 < gladiatr> I haven't found the spot where this might be happening, but my intuition is screaming "layer-2 broadcast loop"
10:20 < gladiatr> hrm...
10:20 < Rienzilla> it must be something like that, but... why are packets sent beyond the tunnel endpoint working?
10:21 < Rienzilla> (and, if there'd be a loop, i'd expect huge packetloss, and large pingtimes for the packets that do get through, right?)
10:21 < gladiatr> are you using linux for your openvpn appliances?
10:21 < Rienzilla> tyes
10:22 < gladiatr> do you have stp active on your bridge devices?
10:22 < Rienzilla> no, not on these
10:23 < Rienzilla> (there is an stp-enabled bridge configured on the same appliance, but the packets don't use that bridge interface anywhere
10:23 < gladiatr> are the bridge IP addresses on the bridge device or the ethernet devices?
10:23 < Rienzilla> on the bridge devices everywhere
10:23 < gladiatr> k
10:24 < Rienzilla> I'm really puzzled that the packets don't even end up on the ethernet interface of the local vpn appliance
10:25 < Rienzilla> it must be eaten by either the switch, or maybe by the local ethernet device before it enters the os 
10:26 < gladiatr> What system has 10.170.1.1?
10:26 < gladiatr> oh, nm
10:26 < Rienzilla> that is the ip of the bridge of the remote vpn device
10:26 < Rienzilla> (one of its ip's)
10:27 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has quit [Quit: leaving]
10:27 < gladiatr> Ok.  And the 3 addresses that you mentioned are attached to the same bridge interface (shouldn't matter)
10:27 < Rienzilla> yes
10:28 < Rienzilla> and they all show the same behaviour
10:29 < gladiatr> re-run your test, except using tcpdump's -e switch
10:29 < Rienzilla> I already have
10:29 < gladiatr> and paste the output
10:29 < Rienzilla> lemme find the pastebin
10:29 < gladiatr> sweet
10:29 < Rienzilla> http://pastebin.com/PSWmsydV
10:30 < Rienzilla> nothing weird about mac addresses
10:30 < gladiatr> oh.
10:30 < gladiatr> wait a minute... did you disable the netfilter/bridge interaction?
10:31 < Rienzilla> uhm
10:31 < Rienzilla> not consciously :)
10:32 < Rienzilla> what do you meqn
10:32 < Rienzilla> mean*
10:32 < gladiatr> what's the output of : /sbin/sysctl -a |grep bridge-nf-call
10:33 < Rienzilla> on the vpn appliance right
10:33 < gladiatr> yes
10:33 -!- djgerm2 [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
10:35 -!- albech_ [~thomas@119.42.78.109] has joined #openvpn
10:38 < Rienzilla> http://pastebin.com/ScPE7fBh (remote end)
10:38 < Rienzilla> local end is identical
10:38 <@vpnHelper> RSS Update - forum: creating additonal users <http://forums.openvpn.net/topic7506.html#p9150>
10:39 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:40 < gladiatr> do this on your vpn systems: for x in $( sysctl -a |grep bridge-nf-call |cut -d" " -f1  ); do sysctl -w $x=0; done
10:41 < Rienzilla> what does that do?
10:41 < gladiatr> it sets those 3 sysctl variables to 0 :)
10:41 < Rienzilla> yes, I understand that :)
10:41 < gladiatr> the details are..
10:42 < Rienzilla> we disable bridge firewalling with it?
10:42 < gladiatr> it removes iptables hooks into your bridges
10:42 < gladiatr> yes
10:42 < Rienzilla> I have no iptables rules whatsoever on the machines
10:42 < gladiatr> Because unless you are insane (or much more hardcore than I), you really don't want to have to mess with layer-2 fireewall rules
10:42 -!- luneff [~yury@84.51.195.188] has joined #openvpn
10:42 < Rienzilla> I have systems with layer-2 firewalls :-)
10:42 < gladiatr> they have their place... 
10:43 < gladiatr> just not when it comes to troubleshooting bridged connections :)
10:43 < Rienzilla> (bridging based captive portals :))
10:43 < gladiatr> and  "bah and fiddlesticks" on you not actually having any active firewalls
10:43 < gladiatr> I thought I might be onto something
10:43 < gladiatr> :)
10:43 < Rienzilla> anyway, there's no firewall or ebtables rules active here
10:43 < gladiatr> k
10:43 < Rienzilla> (besides, I'd have to have a really cool rule to have a one in 60 chance to accept a packet :P)
10:44 < Rienzilla> and aso
10:44 < Rienzilla> also*
10:44 < Rienzilla> if it were bridgefirewalling, I would see the packet coming in in the ethernet interface
10:44 < gladiatr> hehe
10:45 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
10:45 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:46 < gladiatr> and this is only regarding the IP addresses that are assigned to the bridge device...
10:46 < Rienzilla> yes
10:47 < Rienzilla> machines further down the road work fine
10:47 < ecrist> 10:45 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:49 < gladiatr> and they are all assigned to subinterfaces off of br0 (or whatever you've named your bridge)
10:49 < Rienzilla> -22: br-oob: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
10:49 < Rienzilla>     link/ether 00:0c:42:5b:95:0c brd ff:ff:ff:ff:ff:ff
10:49 < Rienzilla>     inet 10.170.1.1/24 brd 10.170.1.255 scope global br-oob
10:49 < Rienzilla>     inet 10.170.1.163/24 brd 10.170.1.255 scope global secondary br-oob:1
10:49 < Rienzilla>     inet 10.170.1.250/24 brd 10.170.1.255 scope global secondary br-oob:2
10:50 < Rienzilla> whops, that was a little more than expected
10:50 < Rienzilla>     inet6 fe80::20c:42ff:fe5b:950c/64 scope link
10:50 < Rienzilla>        valid_lft forever preferred_lft forever
10:52 < ecrist> gah, the pasting
10:52 < Rienzilla> sorry for that
10:52 < gladiatr> (it burns!  it burns!)
10:55 < gladiatr>   state UNKNOWN: I'm curious about this... none of my bridges have this tag...
10:58 < Rienzilla> all of mine do
10:58 < Rienzilla> it might be due to a tap device being enslaved?
10:58 -!- mirobmwgi is now known as mirovengi
10:59 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:00 < gladiatr> paste the output of: brctl show
11:01 < gladiatr> append the output of: ip a s
11:01 < gladiatr> as well
11:02 -!- WinstonSmith [~true@e179011179.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
11:05 < Rienzilla> http://pastebin.com/WDPWf3xc
11:06 < Rienzilla> the relevant bridges in this config are called br-oob
11:07 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
11:08 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
11:09 < gladiatr> which one is your tap interface?
11:11 < Rienzilla> renameit-oob
11:12 < gladiatr> are your VPN is currently connected?
11:16 < Bushmills> compiz %
11:16 < gladiatr> *and*
11:16 < Rienzilla> yes
11:16 < Rienzilla> ....do I have two identical macs on the same switch...?
11:22 < gladiatr> hrm... something.  somethingsomething.  
11:23 < Rienzilla> I think im onto something
11:24 < Rienzilla> I got it
11:24 < Rienzilla> omg
11:24 <@vpnHelper> RSS Update - forum: server certificate management - change email address? <http://forums.openvpn.net/topic7509.html>
11:24 -!- albech_ [~thomas@119.42.78.109] has quit [Quit: Ex-Chat]
11:24 -!- radisnki [radisnki@drsd-4dbd840f.pool.mediaWays.net] has joined #openvpn
11:24 < Rienzilla> it is indeed the switch
11:26 < radisnki> Hi! I try to install OpenVPN on my VPS running Ubuntu 10.10. Is there a good tutorial available for doing this?  I just want to surf the internet using my server and maybe play some games together with my friends...
11:28 < Rienzilla> (hold on, i'll post the comp[lete explanation shortly)
11:30 < gladiatr> k
11:30 < gladiatr> !welcome
11:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:38 < Rienzilla> the mac of a bridge device is apparently inherited from one its enslaved interface
11:39 < Rienzilla> on the remote endpoint there's several bridges with the same mac, because they have enslaved vlan devices from the same interface (eth0.2 eth0.2424 etc)
11:41 -!- maestroSteve [~barnwells@70-90-14-205-pa-nj-de.hfc.comcastbusiness.net] has joined #openvpn
11:41 < Rienzilla> two of those bridges are connected to my local switch here. One via the VPN, and one via our local uplink. 
11:42 < Rienzilla> albeit on a different vlan, but I highly suspect that the switch is screwing this up and switching the traffic to the wrong port, or /dev/null
11:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
11:46 < gladiatr> good times
11:46 < Rienzilla> thanks for thinking along
11:48 -!- katoen [ce024205a3@xs8.xs4all.nl] has joined #openvpn
11:48 < gladiatr> No problem.  I'm glad the problem actually surfaced! :)
11:54 < katoen> hi there. If i want the openvpn server (windows 2008 server) to forward traffic to other networks it is attached to, would i also need to create a file in the ccd-directory with the server's common name with the iroute command?
11:55 < katoen> or would ip forwarding be enough?
11:57 -!- radisnki [radisnki@drsd-4dbd840f.pool.mediaWays.net] has quit []
11:58 < Bushmills> !route
11:58 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
11:58 < Bushmills> !serverlan
11:58 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
11:59 < Bushmills> not sure whether these take account of possibility of windows as server 
12:01 -!- takamichi [Takamichi@85.232.213.54] has quit [Ping timeout: 260 seconds]
12:01 -!- grishnav [~grishnav@209.160.52.134] has joined #openvpn
12:01 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
12:04 < katoen> Bushmills: thanks
12:10 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
12:11 -!- maestroSteve [~barnwells@70-90-14-205-pa-nj-de.hfc.comcastbusiness.net] has quit [Quit: Leaving]
12:18 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 246 seconds]
12:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
12:18 -!- radisnki [radisnki@drsd-4dbd840f.pool.mediaWays.net] has joined #openvpn
12:18 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
12:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
12:18 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
12:18 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
12:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:19 -!- p3rror [~mezgani@41.140.43.58] has joined #openvpn
12:19 -!- luneff [~yury@84.51.195.188] has joined #openvpn
12:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:26 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
12:27 < radisnki> Hi!  I've setup an OpenVPN server on Ubuntu 10.10. While connecting to my server (using Win7 64-Bit), the log says:  "Read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)"  I tried Google but it didn't help...   Server is definately running and I think I created the certificates correctly. Here's my server config: http://pastebin.com/LXKmmb2Y   aand the client config:  
12:27 < radisnki> http://pastebin.com/rn23UuFS
12:31 -!- Xaevo [~Xaevo@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has joined #openvpn
12:31 < Xaevo> heyo
12:31 < Xaevo> my server won't connect to the internet anymore after installing OpenVPN, it's a linux ubuntu box
12:32 < Xaevo> especially ZNC
12:33 < Xaevo> ZNC doesn't connect anymore :<
12:34 < hyper_ch> my guess it's a firewall/nat problem
12:34 < hyper_ch> znc works fine through the vpn
12:35 < radisnki> @hyper_ch: Can you help me? :'(  btw, if it helps, here are my installation steps: http://pastebin.com/xgEFKRq8
12:35 < Xaevo> hyper_ch, not talking about trough the vpn
12:35 < hyper_ch> radisnki: I don't know windows
12:35 < Xaevo> i am talking about znc on the same box as my vpn server
12:36 < Bushmills> no you didn't
12:36 < Bushmills> you said "my server won't connect to the internet anymore"
12:36 < hyper_ch> !tell radisnki [welcome]
12:37 < hyper_ch> hi Bushmills
12:37 < Bushmills> "to the internet" != "talking about znc on the same box as my vpn server"
12:37 < Xaevo> Bushmills "my server (the linux box) won't connect to the internet anymore"
12:37 < Bushmills> hi hyper_ch
12:37 < Xaevo> znc connects over the internet too
12:37 < Xaevo> but yeah, can't ping google either from shell
12:37 < hyper_ch> !target
12:37 < Xaevo> but can internet -trough- the vpn
12:38 < hyper_ch> !tell Xaevo [goal]
12:38 < Xaevo> i am not natively english
12:38 < Xaevo> so sue me :/
12:38 < Bushmills> Xaevo: send us a crystal ball, maybe we can see what your are attempting - and your setup - from that
12:38 < Xaevo> :|
12:38 < Xaevo> i am rather clear imho
12:39 < Xaevo> my server (the linux box) doesn't connect to the internet anymore
12:39 < Xaevo> but if i connect with my pc to my OpenVPN server i have internet
12:39 < Bushmills> all we know is - you can't connect with server to the internet, but especially to a service on the server
12:39 < Xaevo> no, ZNC can't connect to the irc networks anymore either
12:40 < Bushmills> why can't you connect to the internet?
12:40 < Xaevo> that's what i am asking you
12:40 < Bushmills> how are we supposed to know?
12:40 < Xaevo> "#openvpn"
12:41 < Bushmills> maybe you didn't pay the bills?
12:41 < ecrist> lol
12:42 < hyper_ch> bushmills can be almost as mean as me
12:42 < hyper_ch> that even rhymse
12:42 < hyper_ch> rhymes :)
12:42 < hyper_ch> bushmills can be
12:42 < hyper_ch> almost as mean as me
12:42 < Bushmills> mean? that's my idea of having fun :)
12:42 < theDoc> lol, this is great.
12:43 < theDoc> Someone just sent me an email regarding zonealarm
12:43 < hyper_ch> Bushmills: some people would call that being mean
12:43 < hyper_ch> theDoc: is your zonealarm outdated and you need to upgrade to the pay-version for securing your computer?
12:44 < hyper_ch> radisnki: paste your configs
12:45 < theDoc> hyper_ch: lol, no. I don't use zone alarm. Someone was saying that their zonealarm flagged one of my domains as "malicious".
12:45 < hyper_ch> theDoc: how can a domain be malicious?
12:46 < Xaevo> shees :|
12:46 < Xaevo> please, just help me
12:46 < theDoc> http://forums.zonealarm.com/showthread.php?t=73330
12:47 < Bushmills> Xaevo: insufficient data
12:47 < Xaevo> what do you want to know?!
12:47 < Xaevo> shees!
12:47 < Bushmills> logs, configs, route table
12:48 < Xaevo> anders ga ik gewoon in het nederlands verder :|
12:48 < Bushmills> ja hoor dat mag ook wel
12:48  * Xaevo headdesks
12:48 < Xaevo> graag
12:48 < Bushmills> maar niet op deze kanaal
12:48 < Xaevo> waardanwel D:<
12:49 < Xaevo> but yeah
12:50 < Xaevo> i installed openvpn using ubuntu's guide
12:50 < Xaevo> bridged my eth0 adapter
12:50 < Bushmills> ouch
12:50 < Xaevo> to br0, which is also tap0
12:50 < Bushmills> why?
12:50 < hyper_ch> radisnki: don't ask in query... ask in here
12:50 < Xaevo> because the guide said so?
12:50 < Bushmills> !tunortap
12:50 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
12:50 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
12:50 < theDoc> Don't ask in query, we all want a laugh :P
12:50 < Bushmills> f**k that guide
12:50 < Bushmills> !howto
12:50 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
12:51 < radisnki> @theDoc: I asked here, but my question wasn't answered yet :)
12:51 < theDoc> radisnki: lol, jking man.
12:51 < theDoc> It's 3am, I just got up
12:52 < radisnki> You don't know how I can solve "read UDPv4 [ECONNREFUSED]: Connection refused (code=111)"  or?
12:52 < Bushmills> don't query me, i have an /autoignore on unsolicited queries
12:52 < Xaevo> so i shouldn't be using tun? :<
12:52 < theDoc> radisnki: The error is quite obvious, Connection Refused.
12:52 < Xaevo> radisnki, forward the right ports
12:53 < theDoc> Have you given the server a kiss on her nose yet?
12:53 < theDoc> They're like women, they like chocolates and flowers.
12:54  * Bushmills has never seen a server get bloated from chocolate
12:54 < Bushmills> sticky, maybe
12:54 < radisnki> @theDoc:  I tried everything :D   @Xaevo: I tried this: "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE"
12:54 < Xaevo> i don't use iptables
12:55 < Xaevo> i have a rad firewall in my router :/
12:55 < theDoc> radisnki: No you haven't tried everything.
12:55 < theDoc> If you did, it would be working, ;p
12:55 < Bushmills> Xaevo: unless you have a special need for tap / bridge, tun would be most adequate
12:55 < Xaevo> but Bushmills, no TAP but TUN?
12:55 < Xaevo> and also no bridge?
12:55 < Bushmills> right
12:56 < radisnki> @Bushmills:  Any mistakes in my installation?  http://pastebin.com/xgEFKRq8
12:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
12:56 < theDoc> radisnki: iptables -F && openvpn /path/to/server/config && ps aux | grep openvpn
12:56 < theDoc> I'd do that for a start
12:57 < Bushmills> am i supposed to mentally debug that, or try that out?
12:57 < radisnki> you can do both :D
12:58 < Bushmills> your confidence in my might be overrated
12:58 < Bushmills> me
12:58 < theDoc> radisnki: Few things, is your client connecting to the right ip:port?
12:59 < radisnki> yes, I think so, here are my configs (again): http://pastebin.com/LXKmmb2Y  &  http://pastebin.com/rn23UuFS
12:59 < theDoc> radisnki: I'm not going to read configs for free at 3am.
12:59 < theDoc> I'm just throwing suggestions out for you to think about :P
13:00 < radisnki> iptables -F crashed my server
13:00 < Bushmills> no. it only denies access
13:00 -!- Xaevo [~Xaevo@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
13:01 < theDoc> lol, it only denies access. You didn't say you had other shit running on it
13:01 < Bushmills> might have helped to set policies first
13:01 < theDoc> Bushmills: That's true.
13:01  * ecrist queries Bushmills just so he can get ignored.
13:04  * gladiatr chuckles
13:05 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has joined #openvpn
13:05 < X-Vo> back
13:08 < theDoc> gratz on making it back to the interweb.
13:09 -!- astrostl [~astrostl@128.252.233.244] has joined #openvpn
13:09 < astrostl> is there a way to determine which certificate names are blocked by a CRL?
13:10 < astrostl> something in index.txt maybe?  I see single-letter flags at the beginning of each account listing.
13:10 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9152>
13:10 < gladiatr> yup.  The R means "revoked"
13:11 < astrostl> what flags are there other than R and V?
13:11 < astrostl> V - validated/verified?  active in some way?
13:12 < gladiatr> I'm pretty sure that's it
13:13 < astrostl> cool, thx
13:14 < gladiatr> np
13:17 < astrostl> so if i've got something like 4 V entries for a given user, they must have 4 valid keys :-|
13:17 -!- radisnki [radisnki@drsd-4dbd840f.pool.mediaWays.net] has quit []
13:17 -!- Jondice1 [~brandon@rrdhcp-172-285.redrover.cornell.edu] has joined #openvpn
13:18 < Jondice1> !welcome
13:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:20 < gladiatr> astrostl, hrm.  What's the duration of validity for the certs you're creating?
13:20 < astrostl> don't know, looking at an established instance
13:21 < astrostl> checked a model crt and it looks like 10 years
13:22 <@vpnHelper> RSS Update - forum: Pushing Routes <http://forums.openvpn.net/topic7500.html#p9153>
13:22 < gladiatr> Ok.  The certificate subjects have to be identical.  Dunno... perhaps there's a switch you can throw to make openssl not care, but I can't imagine why you'd do that.
13:24 < astrostl> the second and third columns have unique data
13:24 < astrostl> i'm thinking that it was a create cert / create cert (overwriting) issue
13:24 < astrostl> which means the first one could be valid, even if no longer present - right?
13:26 < gladiatr> huh.  Yeah.  I'd check with the user--get the serial off of the cert that's in use and manually mark the others as revoked.
13:27 < astrostl> can that be done just by putting an R in the index.txt?
13:27 < astrostl> doesn't need to be applied to the crl.pem?
13:30 < gladiatr> ohhh yeah.  fallin' asleep here.  Yes.  You are correct.
13:33 < katoen> how do i get vpnhelper to pm me with info :-) I don't want to spam the channel
13:34 < Jondice1> !goal
13:34 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:35 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 272 seconds]
13:35 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
13:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
13:37 < Jondice1> openvpn defaults to using 10.8.0/24, which works fine for me.  I added ccd files and route commands in server.conf for 10.8.1.0/24 as in the HOWTO .  The only step I didn't bother with was iptables since I didn't want to set an access policy.  IP addresses from 10.8.1.0/24 are correctly assigned as per the ccd file, but I cannot ping them from the server even though I can ping 10.8.0.0/24 systems.
13:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:39 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
13:39 < Jondice1> Is there some other step that needs to be done other than adding route 10.8.1.0 255.255.255.0 and (e.g.) ifconfig-push 10.8.2.5 10.8.2.6 in a ccd file to get the systems on this subnet visible to other VPN subnets?
13:39 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
13:39 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
13:39 < Jondice1> well, I mean the route command is in the server file, sorry for being unclear
13:40 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
13:40 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
13:42 < Jondice1> ok, it seems I was using the wrong IP with ping; I was using the second address 10.8.2.6 instead of the first 10.8.2.5
13:43 < Jondice1> i knew it had to be something really dumb
13:48 < Bushmills> needs to be done to achieve what?
13:48 < Bushmills> !goal
13:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:49 < Jondice1> sorry, to add and categorize more ip addresses on the VPN
13:50 < Bushmills> add more clients
13:50 < Jondice1> yes
13:51 < Jondice1> it seems to be fine now, I will test client-to-client connectivity next, but otherwise it is working beautifully 
13:51 -!- p3rror [~mezgani@41.140.43.58] has quit [Ping timeout: 265 seconds]
13:55 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has joined #openvpn
14:02 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
14:04 -!- p3rror [~mezgani@41.140.46.73] has joined #openvpn
14:11 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Ping timeout: 240 seconds]
14:11 -!- djgerm [~Your_Moms@64-60-122-187.static-ip.telepacific.net] has joined #openvpn
14:16 -!- luneff [~yury@84.51.195.188] has quit [Read error: No route to host]
14:23 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
14:23 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
14:23 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
14:23 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
14:30 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 260 seconds]
14:30 <@vpnHelper> RSS Update - forum: Pushing Routes <http://forums.openvpn.net/topic7500.html#p9154>
14:30 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has joined #openvpn
14:31 < Azoff> hello
14:31 < Azoff> !goal
14:31 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:33 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
14:33 < Azoff> I've just started testing anonine with openvpn (https://www.anonine.com/en/guides) with debian
14:33 <@vpnHelper> Title: Anonine : Guides (at www.anonine.com)
14:34 < Azoff> as the server provides a default route in order to route everything through the tunnel
14:34 < Azoff> how can I safly replace the existing default route from the ISP with the one set by openvpn?
14:40 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:40 -!- p3rror [~mezgani@41.140.46.73] has quit [Read error: Connection reset by peer]
14:44 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:44 < Bushmills> look up, in manual, --redirect-gateway
14:45 < Bushmills> also check out def1 
14:46 < Bushmills> to avoid local route on client changed by openvpn server, read about  --route-nopull
14:46 < Azoff> oki, thanks
14:46 < Bushmills> (and --route-noexec)
14:50 < Azoff> Bushmills: do I understand the --redirect-gateway correct....?
14:51 < Azoff> there were a route for 128.0.0.0/128.0.0.0
14:51 < Azoff> and a route for 0.0.0.0/128.0.0.0
14:52 < Azoff> but the existing one for 0.0.0.0/0.0.0.0 with ISP route were left
14:52 < Azoff> so, from the documentation @ http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html; step 2 weren't executed (maybe the 'def1' flag were active
14:52 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
14:54 < Azoff> btw, debian uses version 2.1~rc11-1
14:57 < ecrist> debian is behind, and we don't support it
14:59 < Azoff> I known that there are behind, I am just looking for a solution that works
15:01 < Bushmills> Azoff: those two /1 routes are the result of def1
15:02 < Bushmills> def cause those 2 routes to be added, rather than the original 0.0.0.0/0 overwritten
15:02 < Bushmills> def1
15:02 < Azoff> will that still give me the "real" gw to be through the vpn?
15:03 < Bushmills> debian sid has  2.1.3-2
15:03 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
15:03 < Bushmills> those two routes will catch all traffic for which no other route exists, and no traffic will go through original default gateway
15:04 < Azoff> ok
15:04 < Azoff> I'll have to retry the setup once again
15:06 -!- astrostl [~astrostl@128.252.233.244] has quit [Ping timeout: 260 seconds]
15:09 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
15:12 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 272 seconds]
15:15 < Azoff> Bushmills: when I bring up the vpn, the routes are added and when I try to ping any ip on the internet, there's no response
15:16 < Azoff> but if I remove the /0 gateway, the network works again
15:16 < Bushmills> is that your server you're connecting to?
15:17 < Azoff> no, it's the company Anonine that has the server
15:17 < Bushmills> what is the /0 gateway?
15:18 < Azoff> 0.0.0.0         79.136.32.1     0.0.0.0         UG    0      0        0 eth0
15:18 < Bushmills> (def1 sets up two /1 gateways, and won't touch the former default)
15:18 < Azoff> and the other two is: 0.0.0.0         178.73.201.1    128.0.0.0       UG    0      0        0 tap1
15:18 < Bushmills>  /1 routes, i mean
15:19 < Azoff> 128.0.0.0       178.73.201.1    128.0.0.0       UG    0      0        0 tap1
15:21 < Bushmills> if connecting to openvpn server gives you those two 128.0.0.0 netmask routes, the 0.0.0.0/0.0.0.0 route is the same as before connecting, right? 
15:21 < Azoff> yes
15:21 < Azoff> that's correct
15:21 < Bushmills> and removing that one does what?
15:22 < Azoff> after removing the default gw from my ISP, I can access the internet once again
15:22 < Bushmills> " default gw from my ISP" what is that?
15:23 < Azoff> 79.136.32.1
15:23 < Bushmills> after all, before you said " but if I remove the /0 gateway..."
15:23 < Bushmills> and you confirmed "the 0.0.0.0/0.0.0.0 route is the same as before connecting"
15:23 < Bushmills> thus i am not sure now what you are removing
15:23 < Azoff> yes, but somehow the /1 interferes, or is it the /0 that interferes...?
15:24 -!- ampex [~sterling@circu.it] has joined #openvpn
15:24 < Bushmills> use traceroute or mtr to look where packets go, in both state of "working" and "not working"
15:25 -!- p3rror [~mezgani@41.248.185.32] has joined #openvpn
15:25 < Azoff> route del default gw 79.136.32.1 # this is the command for removing the ISP gw that brings up the network
15:26 -!- risc427 [~risc@dss.datastreamer.net] has joined #openvpn
15:27 < Azoff> mtr just shows the header and no hop
15:27 -!- grapsus [~grapsus@acces1192.res.insa-lyon.fr] has joined #openvpn
15:27 < Azoff> I guess it gets confused by the two routes
15:27 < risc427> anyone have any experience with how an OpenVPN client validates the server cert and vice versa?
15:28 < Bushmills> i can't see how that's possible, provided you have the two 128.0.0.0 routes
15:28 < Azoff> Bushmills: shall I test putting the 'redirect-gateway' in the config?
15:28 < Azoff> (without the 'def1')
15:28 < Bushmills> server is pushing it already, or you wouldn't have those 128.0.0.0 routes
15:29 < Azoff> can the server push the clients to use with 'def1' flag set?
15:29 < Bushmills> that's what it is doing
15:30 < Azoff> oki, so there's no way to make it use whithout def1 set?
15:30 -!- p3rror [~mezgani@41.248.185.32] has quit [Ping timeout: 240 seconds]
15:30 < Bushmills> those ways i told you to read about
15:32 < ampex> risc427 and I are a bit confused as to how exactly one might exploit OpenVPN using a "Man-in-the-Middle" attack. It seems that client and server certificates are validated based upon purpose out of the box regardless of whether remote-cert-tls is specified in the configuration. In light of this I'm not sure that the steps documented here are necessary: http://openvpn.net/index.php/open-source/documentation/howto.html#secnotes
15:32 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:32 < ampex> Any ideas?
15:32 < Azoff> neither of those will work in this case..? unless I use the --redirect-gateway, I have no clue what route to use? or am I missing something?
15:33 < Bushmills> what gateway to use with default route you can see from the 128.0.0.0 routes
15:34 -!- dschuett [~dschuett@216.229.21.250] has quit [Ping timeout: 255 seconds]
15:36 < Azoff> sorry, but I can't see how --route-nopull can be a solution. If I use it, I won't get the ip of the gateway through the vpn... so there's no way for me to add it *after* the vpn link has been established
15:37 < Bushmills> but that's the purpose of it, to *not* get the server provided routes set
15:37 < Azoff> not realy, I wan't to send all trafic through the vpn link
15:39 < Bushmills> if massaging your route table after connecting and having set routes as puished by server works better for you, execute an --up script
15:39 < Azoff> and in the up script, just remove the default route from the isp?
15:39 < Azoff> that could work
15:40 -!- OiPolloi [~sena@gw.identity.pt] has quit [Quit: OiPolloi]
15:40 < Azoff> I'll give it a shot
15:40 < ampex> Azoff: you can't get rid of your default gateway because then you lose internet connectivity
15:40 < Bushmills> though i think deleting your default route (after two 128.0.0.0 routes were set) is no solution. it merely disables internet access after you disconnect from openvpn server again
15:41 < Azoff> hm, can I somethow get the info from the push_reply and replace the default gateway on my own?
15:41 < Azoff> btw, is this a bug in this old version of openvpn or is it a kernel related problem?
15:42 < Bushmills> maybe the problem is elsewhere. try to ping an ip address rather than a hostname.
15:42 < Azoff> I've heard something about 2.6.36 having a new route table handling (uses metric to decide witch gw to use)
15:43 < gladiatr> Azoff, linux has had multiple routing table support for quite some time
15:43 < Azoff> ok
15:44 < gladiatr> Now, if you were to tell me that they have finally implemented a functional dead-gateway-detection mechanism... well... you know, I might very well squeal like a little girl 
15:44 < Azoff> debian lenny uses 2.6.26, does the support exist in that kernel?
15:45 < gladiatr> yarp
15:45 < ampex> Azoff: I came in after you had described your problem, what's the exact issue you're experiencing?
15:46 < Azoff> hm, I did get a response on the ping now, but I'm certain that it didn't respond before
15:46 -!- plaerzen [~cam@vip1.tundraeng.com] has joined #openvpn
15:46 < Bushmills> you tried ip address instead of host name?
15:46 < Azoff> ampex: maybe it's a non-issue after all
15:46 < Azoff> Bushmills: yes, ip
15:46 < Azoff> no dns involved yet..
15:46 < Bushmills> that's your problem
15:47 < Bushmills> the name server your system uses is your provider's
15:47 < Bushmills> that doesn't allow queries coming from an address outside of their net
15:47 < Azoff> Bushmills: yes, but I used the *IP*, not a *host* :)
15:48 < Bushmills> because you use an *ip address* now, it works
15:48 < Bushmills> try again with a host name
15:48 < Azoff> yes, and I used an ip address before too and it didn't work then
15:49 -!- plaerzen [~cam@vip1.tundraeng.com] has left #openvpn ["Leaving"]
15:49 < Azoff> nm.
15:49 < Azoff> it looks like it's working now
15:49 < Bushmills> then !blame vpn provider
15:49 < Azoff> just have to figure out how to not get the ISP nameservers
15:49 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
15:50 < Bushmills> my favorite solution is to run a recursive name server on local machine or net
15:50 < Azoff> thanks for your patience...
15:50  * Bushmills smirks evilly
15:50 < Bushmills> i'm not patient
15:52 < Azoff> I got this: PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 80.67.0.2,dhcp-option DNS 91.213.246.2,route-gateway ,ping 10,ping-restart 30,ifconfig 178.73.197.42 255.255.255.128
15:52 < Azoff> crap
15:53 < Azoff> is there any way to push that dns into the /etc/resolv.conf?
15:53 < Bushmills> with a --up script
15:54 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Operation timed out]
15:54 < Azoff> ok
15:54 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
15:54 < Essobi> DEEEEAD BEEEEEEF
15:54 -!- stony is now known as Guest63011
15:59 -!- mirovengi [~mirovengi@99-3-161-173.lightspeed.mmphtn.sbcglobal.net] has left #openvpn []
16:00 -!- risc427 [~risc@dss.datastreamer.net] has quit [Quit: Leaving]
16:11 -!- FSprofi [~chatzilla@77.119.210.250.wireless.dyn.drei.com] has quit [Read error: Connection reset by peer]
16:19 -!- s7r [~s7r@94.46.240.202] has left #openvpn []
16:21 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
16:21 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
16:27 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Changing host]
16:27 -!- rot13 [~var@unaffiliated/rot13] has joined #openvpn
16:32 -!- p3rror [~mezgani@41.140.42.17] has joined #openvpn
16:33 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
16:59 <@vpnHelper> RSS Update - forum: UPnP over openVPN, is it possible? <http://forums.openvpn.net/topic7498.html#p9155>
17:01 -!- p3rror [~mezgani@41.140.42.17] has quit [Read error: Connection reset by peer]
17:15 -!- p3rror [~mezgani@41.140.158.116] has joined #openvpn
17:27 -!- gomix [~gomix@fedora/gomix] has joined #openvpn
17:27 < gomix> HELP
17:27 < gomix> lol
17:27 < gomix> im trying a bridging config
17:27 < gomix> client win xp
17:28 < gomix> arp is not working fully
17:28 < gomix> but partially
17:28 < gomix> server gets the remote macs...
17:28 < gomix> client does not
17:28 < gomix> server is a debian
17:29 < Bushmills> !tunortap
17:29 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
17:29 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
17:30 < gomix> well i'll come later again ;) got to move...
17:30 < gomix> and try with a linux client
17:32 -!- gomix [~gomix@fedora/gomix] has quit [Read error: Operation timed out]
17:43 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:49  * krzee is finally back to work
18:05 -!- Guest63011 [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Connection reset by peer]
18:06 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
18:06 -!- stony is now known as Guest59138
18:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
18:12 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:12 -!- silverraindog [~angus@host86-178-116-255.range86-178.btcentralplus.com] has quit [Ping timeout: 240 seconds]
18:17 <@vpnHelper> RSS Update - forum: creating additonal users <http://forums.openvpn.net/topic7506.html#p9156>
18:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:30 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Read error: No route to host]
18:35 <@vpnHelper> RSS Update - forum: Cisco IPSEC VPN Client on Linux causing Kernel Panic <http://forums.openvpn.net/topic7427.html#p9161> || Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p9160> || logout - dead link <http://forums.openvpn.net/topic7437.html#p9159> || Automatically put on alliases on tun interface <http://forums.openvpn.net/topic7463.html#p9158>
18:35 < Dougy> boredom
18:36 < Dougy> hai guys
18:38 < krzee> dougifresh
18:38 < krzee> wassup man
18:39 < krzee> im working on a new home for that server thats wasting space in your closet
18:40 < krzee> a very longtime friend is getting 50mbit to his house... may have space to colo it at his house ;]
18:40 < Dougy> im surprised you remembered that
18:40 < Dougy> i just was gonna ask if you still wanted it and if you even remembered it
18:40 < krzee> i got good tabs on where my servers sit ;]
18:40 < Dougy> my new busines only has 2u of colo
18:40 < Dougy> so got no room for you right now
18:40 <@vpnHelper> RSS Update - forum: Linux client problem <http://forums.openvpn.net/topic7497.html#p9167> || Is OPEN VPN right for me? <http://forums.openvpn.net/topic7263.html#p9166> || Ineternet speed after the openvpn connection <http://forums.openvpn.net/topic7448.html#p9165> || Incorrect Login <http://forums.openvpn.net/topic7490.html#p9164> || Random problem with roadwarriors on windows machines <http://forums.openvpn.net/topic7489.html#p9163> || H
18:41 < krzee> yep do still want it... its not bothering you to keep it where it is for now is it?
18:41 < krzee> dont wanna be a pita, will find another spot for storage if its any bother
18:41 < Dougy> nope its thrown on the floor on the basement with the other 25U or so of equipment i have
18:41 < krzee> ahh cool :)
18:42 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
18:44 < Dougy> just got piles of it
18:56 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Ping timeout: 276 seconds]
19:02 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
19:03 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
19:08 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
19:18 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
19:20 < Dougy> krzee: ping
19:20 < krzee> pong
19:20 < Dougy> i need  your brain
19:20 < Dougy> i fail at designing stuff in my head
19:20 < Dougy> can you help me try and figure out what i need to do for this vpn set up?
19:21 < krzee> sure
19:21 < krzee> !goal
19:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:21 < krzee> ;]
19:21 < Dougy> working on it lol
19:21 < Dougy> i was just wondering if you had time now, if not i would've put it on the forum
19:21 < Dougy> so
19:22 < Dougy> i have my box in MD - i want to set up a domain controller + openvpn on it.. and then set my home router with vpn firmware to connect to the vpn.. so i can connect to domain controller that way
19:22 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
19:22 < Dougy> is that logical? secure communication between
19:22 < Dougy> and then in the office i can set up another router w/vpn firmware and join it as well
19:22 < krzee> logical to colo windows... not in my opinion :-p
19:22 < krzee> but yes, that should work
19:22 < Dougy> i guess now i need to ask questions in ##windows
19:22 < Dougy> oh
19:22 < Dougy> um
19:23 < krzee> !windows
19:23 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg, or (#3) also, http://secure-computing.net/files/windows_2.jpg
19:23 < Dougy> so real fast.. how would it work? a /24 subnet per location?
19:23 < Dougy> and push routes?
19:23 < Dougy> thats the real part that i never understood
19:24 < krzee> you mean /24 per location within openvpn?
19:24 < Dougy> yeah.. or wait
19:25 < Dougy> on the client (router) would you just set it to route all the LAN traffic (say each place was 192.168.1.0/24) to the VPN adapter ip?
19:25 < Dougy> ie route 192.168.1.0 255.255.255.0 10.5.5.2 (say .2 is the ip the server gave the client)
19:25 < krzee> you want the office / house to route all traffic through the server?
19:25 < Dougy> not all
19:25 < Dougy> well hrmm
19:25  * Dougy rubs chin
19:26 < krzee> ya i have no idea what you're looking for
19:26 < Dougy> it's hard to explain it, LOL
19:26 < Dougy> hrm
19:26 < krzee> try gliffy.com
19:26 < krzee> !diagram
19:26 <@vpnHelper> "diagram" is You can use a site such as http://gliffy.com to create a network diagram as well as programs such as Visio, Dia, or OmniGraffle
19:26 < Dougy> I guess yeah, i could redirect all traffic through the vpn
19:26 -!- stan_man_can [stan_man_c@CPE00222d6bc398-CM00222d6bc395.cpe.net.cable.rogers.com] has joined #openvpn
19:26 < stan_man_can> !goal
19:27 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:27 < Dougy> so jeff how does it work on the actual router.. if i want to reroute all traffic. set def1 on server, when the wrt54g downstairs connects, it'll just send all traffic through the vpn?
19:27 < krzee> Dougy, it would be a combination of !route and !redirect
19:27 < krzee> youd use !route for the lans behind the routers
19:28 < krzee> and !redirect for getting those routers to use the server as the default gateway
19:28 < Dougy> yeah, thats what makes my head spin a lil bit
19:28 < krzee> which part?
19:28 < krzee> its the 2 most commonly desired setups
19:28 < stan_man_can> I'm going on vacation with my laptop and i would like to use openVPN to have a secure connection for internet access while i'm on open and free wifi signals ect... I'm have a VPS with Linode running Ubuntu 10.04.01 ... Any help on getting it setup ?
19:28 < krzee> hell, you could use my confgen to make that :-p
19:29 < krzee> stan_man_can, yes
19:29 < krzee> stan_man_can, see these:
19:29 < Bushmills> !howto
19:29 < krzee> !sample
19:29 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
19:29 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
19:29 < krzee> !redirect
19:29 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
19:29 < krzee> oh and:
19:29 < krzee> !pki
19:29 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
19:29 < Bushmills> too late for ^^^^  :)
19:29 <@vpnHelper> specially as a server (see !servercert)
19:30 < Bushmills> static key may do
19:30 < stan_man_can> erg
19:30 < krzee> understand the config options used in !sample by reading the manual, make your certs and stuff with !pki, then once the client can ping the server via VPN ip, setup !redirect
19:30 < stan_man_can> how long will it take to understand and setup?
19:30 < Bushmills> !howto
19:30 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
19:30 < krzee> depends on your knowledge of networking and pki
19:30 < Bushmills> check out quick start
19:30 < stan_man_can> no former knowledge
19:30 < krzee> then it will take a long time
19:31 < stan_man_can> Hmm
19:31 < krzee> you need to understand networking!
19:31 < stan_man_can> yeah
19:31 < stan_man_can> I leave on Saturday
19:31 < Bushmills> stan_man_can: will you be the only one connecting to your vpn?
19:31 < stan_man_can> need to move in the mean time
19:31 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
19:31 < krzee> then better get started!
19:31 < stan_man_can> yeah i'll be the only one connecting Bush
19:31 < krzee> you can use static key like Bushmills said then
19:31 < Bushmills> no need for the whole pki gorilla then. check out static keys
19:31 < krzee> but that only skips making pki (which is easy and spelt out command by command in !pki anyways)
19:32 < Dougy> this site is fucking
19:32 < Dougy> boss
19:32 < stan_man_can> maybe I'll just rent one for 2 weeks :D
19:32 < Dougy> krzee: ok well so just to help set my head straight.. lets say home LAN is 192.168.1.0/24 and the server is 10.5.5.0/24.. and my home router got .2
19:33 < Dougy> i'd set the vpn to route that /24 to .2 ?
19:33 < krzee> no, you would let openvpn set the gateway for routing
19:34 < krzee> like in my routing document
19:34 < Dougy> i guess i dont get the concept of lans behind hte vpn
19:34 < Dougy> the
19:34 < Dougy> etc
19:34 < krzee> then read my document!
19:34 < krzee> !route
19:34 -!- silverraindog [~angus@host86-178-116-79.range86-178.btcentralplus.com] has joined #openvpn
19:34 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
19:34 < Dougy> bookmarked
19:35 < Dougy> im having too much fun playing with this freakin diagram thing
19:35 < Dougy> lol
19:35  * Bushmills seems to remember that Dougy had bookmarked that link before
19:35 < stan_man_can> I'm sure it's not your guy's forte since you run your own but know a decent company to rent a vpn from ?
19:35 < Dougy> Bushmills: i format my pc about once every 3 months
19:35 < Dougy> boredom
19:35 < Dougy> i formatted the other day to switch to x64 instead of x86
19:36 < Bushmills> so why do you bookmark it then?
19:36 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
19:37  * Bushmills thinks Dougy can't format vpnHelper
19:38 < Dougy> http://www.gliffy.com/pubdoc/2417373/L.png
19:38 < Dougy> I guess that's what I want
19:38 < krzee> thats basically a useless diagram
19:38 < krzee> it says NOTHING of what you want
19:38 < krzee> lol
19:38 < Dougy> lol
19:38 < Dougy> what's missing?
19:38 < Dougy> other then lan ips
19:38 < Bushmills> wrt54g has 4 MiB flash?
19:38 < Dougy> some models eod
19:38 < Dougy> do
19:39 < Dougy> my home one runs dd-wrt fine
19:39 < krzee> the fact that you want !route AND/OR !redirect
19:39 < Bushmills> ssl takes up about 1 MiB on those routers.  openvpn another 300 kB or so
19:39  * Dougy will redirect all traffic
19:39 < Dougy> tis fine
19:39 < krzee> Bushmills, ya wrt54g is a very common router to run linux firmware on
19:39 < krzee> (with openvpn)
19:40 < Dougy> Firmware: DD-WRT v24-sp2 (10/10/09) vpn
19:40 < Dougy> Time: 20:40:10 up 6 days, 39 min, load average: 0.00, 0.00, 0.00
19:40 < Dougy> w00t
19:41 < Bushmills> i find 4 MiB a bit tight for openvpn on router.
19:41 < krzee> in fact iirc they even sold a wrt54gl with linux already on it (im not 100% on that, but i remember something about it)
19:44 -!- WinstonSmith [~true@g231243136.adsl.alicedsl.de] has joined #openvpn
19:48 -!- stan_man_can [stan_man_c@CPE00222d6bc398-CM00222d6bc395.cpe.net.cable.rogers.com] has quit []
19:49 -!- WinstonSmith [~true@g231243136.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
19:50 <@vpnHelper> RSS Update - forum: Automatically put on alliases on tun interface <http://forums.openvpn.net/topic7463.html#p9168>
19:52 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
20:07 -!- takamichi [~pri@85.232.213.54] has quit [Remote host closed the connection]
20:12 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
20:12 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
20:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:13 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
20:20 <@vpnHelper> RSS Update - forum: Cannot ping from client to server's lan dynamic IP addresses <http://forums.openvpn.net/topic7510.html>
20:35 -!- Guest52073 [~kvirc@124-169-6-237.dyn.iinet.net.au] has joined #openvpn
20:37 < Guest52073> A challenge, if you are daring:                  http://i52.tinypic.com/4lqb92.jpg          
20:37 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9170>
20:38 -!- Guest52073 [~kvirc@124-169-6-237.dyn.iinet.net.au] has left #openvpn []
20:39 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has joined #openvpn
20:40 < Bebop2Steady> Yes.. a challenge it is
20:42 < krzee> just about any of those diagrams you keep making will work when you understand routing and iroute well enough
20:42 < krzee> remember you dont ALWAYS need to push your routes, lol
20:46 < Bebop2Steady> ya krzee is talking to me.. i know not to push this topic too far with you though. Well I'm to the next level of understanding routes now
20:48 -!- djgerm [~Your_Moms@64-60-122-187.static-ip.telepacific.net] has quit [Quit: Leaving.]
20:48 < ecrist> sup bitches?
20:48 < krzee> sup eric
20:55 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
20:56 < Bebop2Steady> routes ->   http://i51.tinypic.com/9zx643.jpg
20:57 < Bebop2Steady> pushes + iroutes  ->  http://i52.tinypic.com/4lqb92.jpg
20:58 < krzee> heh
20:58 < Bebop2Steady> layer 1 / chain 1 vpn is working great.  its the layer/chain/vpn on top that stopping progress.
20:59 < krzee> the first layer should not be working great with that config
20:59 < krzee> it should go to hell when country A connects to country C
21:02 < Bebop2Steady> http://i51.tinypic.com/2m4ccjd.jpg
21:03 < Bebop2Steady> Its working great
21:03 < Bebop2Steady> every poitn can ping every point, and tcp dump shows all the tun's are active
21:04 < Bebop2Steady> and i can even lay the 2nd layer down with an errorless connect
21:04 < Bebop2Steady> its just that when the 2nd layer is connected, my pc cant ping the nodes after that
21:05 < krzee> makes sense
21:05 < krzee> and i guess i see why layer1 didnt break
21:05 < krzee> more luck than knowledge ;]
21:05 < Bebop2Steady> why luck ?
21:06 < krzee> cause when you override a route that needs to be there, it doesnt get overridden only because the existing endpoint is loopback
21:06 < Bebop2Steady> i planned it all put according to the man pages
21:06 < Bebop2Steady> what override do u mean ?
21:06 < krzee> but when you do that again later to the client, its not the case and it gets overwritten like you told it to
21:06 < krzee> now go learn more ;]
21:07 < krzee> do you know what a push route is?
21:07 < krzee> when you use a push route you say the following:
21:07 < krzee> "reach this network through ME"
21:08 < Bebop2Steady> yes
21:08 < krzee> do this
21:08 < krzee> STOP PUSHING
21:08 < krzee> just set routes in client configs... see if that makes more sense for you
21:08 < krzee> (and in server configs when appropriate, but dont push)
21:09 -!- pielgrzym [~pielgrzym@1str003.multi-play.net.pl] has quit [Ping timeout: 255 seconds]
21:09 < Bebop2Steady> ok no push..
21:09 < krzee> cause you're doing it wrong ? ;]
21:09 < krzee> (that was the tm logo)
21:10 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
21:10 < Bebop2Steady> are we talking no push for the layer 1 or 2 ?
21:10 < Bebop2Steady> because on layer one i only have 1 push
21:10 < krzee> at all
21:11 < Bebop2Steady> wouldnt replacing that 1 push, with a hardcoded route from the client side be just the same ?
21:12 < krzee> you're 1 useless question from /ignore
21:12 < krzee> :-p
21:12 < Bebop2Steady> i cant help being curious
21:14 < krzee> til you use it correctly, just dont use it
21:15 < Bebop2Steady> with my layer one push, what exactly is incorect about it ?
21:15 < krzee> i dont know or care if you used it right in that specific case
21:15 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
21:15 < krzee> i just know you dont understand what it does
21:16 < krzee> or at least dont know how to correctly use it
21:16 < Bebop2Steady> how do you knwo that ?
21:16 < krzee> cause i see why your setup doesnt work :-p
21:16 < krzee> it has to do with this
21:16 < krzee> http://www.threadbombing.com/data/media/30/Failboat.jpg
21:16 < krzee> ALL ABOARD!
21:17 < Bebop2Steady> inother words.. you have not a clue
21:17 < krzee> sure
21:17 < Bebop2Steady> all i ever hear is :  go leanr
21:17 < krzee> dont worry, wont hear anything else
21:17 < Bebop2Steady> or: you're not doing it right
21:17 < krzee> hrm wtf my ignore didnt work
21:17 < Bebop2Steady> but when it comes to specifics, you dodge
21:18 < Bebop2Steady> please do ignore so your useless replies stop
21:18 < krzee> ahh i see why
21:18 < krzee> remember, if i didnt give you clues youd still be at step 0
21:18 < Bebop2Steady> i got some real help last night when you werent around
21:19 < krzee> funny, you made negative progress
21:19 < krzee> there, ignore fixed =]
21:20 < dschuett> if i have a client connect in one location, and then connect again from another client using the same client crt and key - should i get the same ip address?
21:21 < theDoc> dschuett: It depends.
21:21 < dschuett> theDoc: do explain... i'm using a basic TUN settup with PKI
21:21 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
21:22 < theDoc> Doesn't matter if it's tun/tap.
21:22 < theDoc> !ccd
21:22 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
21:22 < theDoc> There are ways you can get the same ip.
21:23 < krzee> ipp.txt *might*, ifconfig-push in ccd WILL, ifconfig-push from client-connect script WILL
21:23 < dschuett> theDoc: the problem is that I AM getting the same ip address if i connect from two different locations using the same client.conf etc...
21:23 < dschuett> should it do that by default?
21:23 < Bebop2Steady> duplicate-cn
21:24 < Bebop2Steady> in server.conf if you want to re-use key + cert
21:24 < theDoc> dschuett: I don't know what you put into your configs, I cannot tell you.
21:24 < Bebop2Steady> then u get multi-ip
21:24 < Bebop2Steady> put this:  duplicate-cn
21:25 < Bebop2Steady> if you want to re-use the same cert and get different ip on different compluters
21:25 < dschuett> Bebop2Steady: ahhh, didn't even see that!
21:25 < Bebop2Steady> : ]
21:25 < dschuett> thanks!
21:26 < krzee> dschuett, you should make new certs for the new clients
21:26 < dschuett> theDoc: thanks for your help as well, I have just started messing around with openvpn for the first time, so it is good to know to the information you gave
21:26 < theDoc> duplicate-cn is bad, mainly because there's no control.
21:26 < krzee> yep
21:26 < Bebop2Steady> yeah.. it is..
21:26 < krzee> !dupe
21:26 <@vpnHelper> "dupe" is see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended)
21:26 < dschuett> krzee: i know :) i was just testing on a virtual box, and i didn't know if the reason i was getting the same ip was because of that
21:27 < theDoc> Don't use it for production, seriously.
21:27 < dschuett> theDoc: definitely don't plan to - thanks thought!
21:27 < krzee> the only time its decent in production is when you also use password auth
21:27 < theDoc> krzee: I'm still a fan of 2 factor auth, password + cert
21:28 < krzee> as am i
21:28 < krzee> ild like to play with those hardware tokens i scored a yr ago... its just so hard to find time
21:28 < krzee> and they require a windows server =/
21:29 < dschuett> theDoc: the only reason i will not be using password is because i will have two linux boxes that will be connecting two entire networks together, and i don't want to have to type a password in if the vpn were to go down
21:29 < theDoc> krzee: ew. That's like .. no
21:29 < theDoc> dschuett: Then just use certs.
21:29 < Dougy> im tired
21:29 < krzee> Dougy, hows your leg?
21:29 < Dougy> meh.. sore
21:30 < Dougy> achy
21:30 < Dougy> and both feet are starging to bruise randomly, and its annoying
21:30 < Dougy> take my shoe off and its black and blue
21:30 < krzee> =/
21:31 < krzee> theDoc, well the windows server could be lan only... PAM would be the only thing that needs to access it
21:31 < theDoc> krzee: Well, yes that's true.
21:31 < krzee> but still, i do agree
21:32 < krzee> i havnt yet played with that or access-server because of the windows requirements
21:32 < theDoc> krzee: I have AS running under loonix.
21:32 < krzee> linux server and client?
21:32 < theDoc> Mhm.
21:33 < krzee> meh i guess i could setup a pair of linux virtual machines sometime =/
21:33 < theDoc> btw, you guys seen that show the human centipede?
21:33 < theDoc> http://i.imgur.com/SQWLu.jpg -- :) :) :)
21:33 < theDoc> enjoy
21:33 < krzee> heres a treat for you too
21:33 < krzee> http://26.media.tumblr.com/tumblr_kyru8tWvRC1qa1ojxo1_400.jpg
21:33 < krzee> NSFW
21:35 < krzee> hahaha i know that spot dude
21:35 < krzee> ive been there
21:35 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
21:35 < krzee> its out here in the caribbean
21:36 < theDoc> lmao
21:37 < theDoc> krzee: Nice, your tits?
21:39 < krzee> haha nah not many sexy white girls out here
21:39 < krzee> they're all island-dark here
21:39 < krzee> i wouldnt mind borrowing them from time to time tho
21:42 < theDoc> lol
21:42 < theDoc> island dark is good dude.
21:42 < theDoc> Nice and healthy!
21:43 < krzee> they understand push route better than that bebop guy ;]
21:43 < theDoc> hahahahaha
21:43 < krzee> they pushed a route to me just by opening the pic!
21:43 < theDoc> More like inject route.
21:51 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has left #openvpn []
21:51 < Bebop2Steady> that krz is is quite a character
21:52 < theDoc> I'm all ready to push my route.
21:52 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
21:53 < krzee> lol
21:53 < Bebop2Steady> what krz dont understand about pushig routes is that it makes a network design more modular and portable, as compared to hardcoding
21:53 < krzee> oh and ya i do like island dark too
21:54 < krzee> but yanno, whatever you're used to isnt the best ;]
21:56 < theDoc> krzee: They're nice and bouncy.
22:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
22:19 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 264 seconds]
22:36 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
23:13 -!- pielgrzym [~pielgrzym@91.142.196.180] has joined #openvpn
23:23 -!- djgerm1 [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
23:27 -!- djgerm1 [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 240 seconds]
23:27 -!- djgerm [~Your_Moms@64-60-122-187.static-ip.telepacific.net] has joined #openvpn
23:51 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
23:58 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
--- Day changed Thu Jan 13 2011
00:13 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
00:23 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
00:23 < grendal_prime> hey guys.
00:25 < grendal_prime> Im going to be setting up a ananomous browser server.  I was just assuming i would us openvpn for this how would i go about pushing a route for only port 80/443 traffic.
00:29 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has joined #openvpn
00:30 < krzie> routes dont work by port
00:30 < krzie> they work by subnet
00:31 < krzie> maybe iptables can do something, not sure
00:44 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
01:04 < Bushmills> put a http proxy on vpn server, set web browsers to use that proxy through vpn
01:09 < krzie> tru
01:09 < krzie> optionally you could put an open socks server on the inside (only on vpn ip) and you can let any apps tunnel over it
01:10 < krzie> dante will accept udp and all, with built in rules you define about what is allowed or not
01:10 < krzie> !routebyapp
01:10 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
01:11 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 260 seconds]
01:15 <@vpnHelper> RSS Update - forum: Openvpn with a nat 4 or 5 clicks and no internet <http://forums.openvpn.net/topic7508.html#p9171>
01:27  * theDoc just thinks that routing by app is not for the end user.
01:27 < theDoc> Mostly, they'll want to push everything through the vpn.
01:27 < krzie> i agree
01:28 < krzie> although if i were offering the service i would do this:
01:28 < krzie> users get a client config with redirect-gateway def1
01:28 < krzie> if they so choose, they can comment that and use the internal-only open sockd
01:29 < theDoc> krzee: If anything, I have learnt that I shouldn't ask end users to edit config files or comment things out.
01:29 < theDoc> Already people have problems running an installer.
01:29 < theDoc> :(
01:29 < krzie> haha
01:29 < krzie> well i wouldnt direct them on it
01:30 < krzie> i would just say "there is an open sockd at this address:
01:30 < krzie> "
01:30 < krzie> if they know what that means, have at it 
01:30 < krzie> doesnt take anything extra from you ;)
01:31 < krzie> (ok a lil piece of the hw maybe, but would be running on a different core when that matters anyways
01:31 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
01:35 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:36 < theDoc> krzee: That's true.
01:38 -!- dazo_afk is now known as dazo
01:39 <@vpnHelper> RSS Update - forum: Openvpn with a nat 4 or 5 clicks and no internet <http://forums.openvpn.net/topic7508.html#p9172>
01:42 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 240 seconds]
01:43 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 260 seconds]
01:43 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
01:45 <@vpnHelper> RSS Update - forum: server certificate management - change email address? <http://forums.openvpn.net/topic7509.html#p9173>
01:45 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
01:46 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Read error: Operation timed out]
01:46 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:46 -!- mode/#openvpn [+o mattock] by ChanServ
01:49 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
01:49 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
01:51 <@vpnHelper> RSS Update - forum: Openvpn with a nat 4 or 5 clicks and no internet <http://forums.openvpn.net/topic7508.html#p9174>
01:53 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
01:53 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
01:53 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
01:57 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
02:02 < krzie> !route
02:02 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
02:02 <@vpnHelper> RSS Update - forum: Cannot ping from client to server's lan dynamic IP addresses <http://forums.openvpn.net/topic7510.html#p9176> || Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9175>
02:03 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
02:15 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9178> || Cannot ping from client to server's lan dynamic IP addresses <http://forums.openvpn.net/topic7510.html#p9177>
02:17 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:21 <@vpnHelper> RSS Update - forum: No internet from units inside LAN when TUN bridge is up <http://forums.openvpn.net/topic7505.html#p9179>
02:27 <@vpnHelper> RSS Update - forum: UPnP over openVPN, is it possible? <http://forums.openvpn.net/topic7498.html#p9180>
02:38 < katoen> hello, i'm frunning openvpn on a windows server, but somehow the connected lan is not showing up in the client's routing table. 
02:38 < katoen> also i'm running in :P
02:39 < katoen> i see this in my client's log "PUSH: Received control message: 'PUSH_REPLY,192.168.76.0 255.255.255.0,route 10.6.0.0 255.255.255.0"
02:40 < katoen> that being the LAN behind the server. 
02:41 < krzie> post the server and client config without comments
02:41 < krzie> !configs
02:41 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
02:42 < katoen> oki, let me try that
02:43 < katoen> oh, it appears it's working now
02:43 < katoen> not sure what i changed
02:44 < krzie> =]
02:44 < katoen> thanks for the response, anyways :-)
02:46 < krzie> np
02:49 <@vpnHelper> RSS Update - forum: logout - dead link <http://forums.openvpn.net/topic7437.html#p9182> || creating additonal users <http://forums.openvpn.net/topic7506.html#p9181>
02:49 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
02:55 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9183>
03:00 <@vpnHelper> RSS Update - forum: How do I do a complete cleanup after openvpn installation <http://forums.openvpn.net/topic7457.html#p9185> || Random problem with roadwarriors on windows machines <http://forums.openvpn.net/topic7489.html#p9184>
03:05 <@vpnHelper> RSS Update - forum: Linux client problem <http://forums.openvpn.net/topic7497.html#p9186>
03:10 -!- p3rror [~mezgani@41.140.158.116] has quit [Ping timeout: 240 seconds]
03:11 <@vpnHelper> RSS Update - forum: Openvpn with a nat 4 or 5 clicks and no internet <http://forums.openvpn.net/topic7508.html#p9187>
03:17 <@vpnHelper> RSS Update - forum: Cannot ping from client to server's lan dynamic IP addresses <http://forums.openvpn.net/topic7510.html#p9188>
03:23 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9190> || Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9189>
03:25 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:25 -!- venom00 [~wer@unaffiliated/venom00] has joined #openvpn
03:29 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9192> || Openvpn with a nat 4 or 5 clicks and no internet <http://forums.openvpn.net/topic7508.html#p9191>
03:35 < krzie> http://mirror.netcologne.de/CCC/27C3/mp4-h264-HQ/27c3-4149-en-i_control_your_code.mp4
03:35 < krzie> great talk
03:40 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
03:40 <@vpnHelper> RSS Update - forum: Cannot ping from client to server's lan dynamic IP addresses <http://forums.openvpn.net/topic7510.html#p9193>
03:45 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9195> || Openvpn with a nat 4 or 5 clicks and no internet <http://forums.openvpn.net/topic7508.html#p9194>
03:45 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
03:46 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
03:51 -!- master_of_master [~master_of@p57B56AC2.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
03:51 <@vpnHelper> RSS Update - forum: Cannot ping from client to server's lan dynamic IP addresses <http://forums.openvpn.net/topic7510.html#p9196>
03:52 -!- master_of_master [~master_of@p57B55F20.dip.t-dialin.net] has joined #openvpn
03:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:57 <@vpnHelper> RSS Update - forum: OpenVPN to filter DHCP requests in bridge mode <http://forums.openvpn.net/topic7479.html#p9197>
04:00 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
04:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
04:03 <@vpnHelper> RSS Update - forum: Backup route <http://forums.openvpn.net/topic7385.html#p9199> || [MOVED] windows client and ubuntu virtual machine server <http://forums.openvpn.net/topic7443.html#p9198>
04:04 < krzie> !pwfile
04:04 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
04:04 -!- s7r [~s7r@94.46.240.225] has joined #openvpn
04:07 < krzie> !/30
04:07 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
04:09 <@vpnHelper> RSS Update - forum: New user question <http://forums.openvpn.net/topic7422.html#p9200>
04:16 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:16 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:16 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:25 < s7r> hello, when I browse a HTTPS website over openvpn connection (encrypted with AES256) does the HTTPS encryption from the website certificate establishes between my computer and the site, or between the VPN server and the site?
04:27 <@vpnHelper> RSS Update - forum: OpenVPN routing issues? <http://forums.openvpn.net/topic7480.html#p9202> || OpenVPN to filter DHCP requests in bridge mode <http://forums.openvpn.net/topic7479.html#p9201>
04:28 < krzie> your computer
04:28 < krzie> but the IP the https server sees is your server
04:28 < krzie> its encrypted to you, and once at the server its also encrypted inside the tunnel to you
04:29 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:30 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
04:30 -!- maxJadi [~maxJadi@dhcp-166-8.nomad.chalmers.se] has joined #openvpn
04:30 -!- maxJadi [~maxJadi@dhcp-166-8.nomad.chalmers.se] has quit [Changing host]
04:30 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:43 -!- common- [~common@p5DDA482E.dip0.t-ipconnect.de] has joined #openvpn
04:43 -!- common [~common@p5DDA49AC.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
04:43 -!- common- is now known as common
04:45 <@vpnHelper> RSS Update - forum: No connect option <http://forums.openvpn.net/topic7512.html#p9206> || LAN to LAN issues <http://forums.openvpn.net/topic7446.html#p9205>
04:46 < krzie> !linnat
04:46 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
04:51 <@vpnHelper> RSS Update - forum: max-clients <http://forums.openvpn.net/topic7431.html#p9207>
04:53 < s7r> krzie: so it will be an encrypted tunnel inside the vpn tunnel
04:53 < krzie> correct
04:53 < s7r> and this tunnel inside the vpn tunnel will be between my computer (not the vpn server) and the remote site? 
04:53 < krzie> its only inside the vpn tunnel between the client and server... its encrypted even after the vpn tunnel between the client and webserver
04:54 < s7r> i assume the same thing applies to SSH connections?
04:54 < krzie> to ANY connections
04:54 < s7r> yes I understand :-) but the VPN server will see it encrypted
04:54 < krzie> your server doesnt connect on your behalf to anything
04:54 < krzie> it just NATs
04:54 < s7r> the vpn server will see encrypted data when SSH or HTTPS connections
04:54 < krzie> like your home router
04:55 < krzie> correct
04:55 < s7r> many thanks for the clarification
04:55 < s7r> i understand now
04:55 < krzie> np
04:55 < s7r> i thought the connections would be crypted from the vpn server to the remote site, not my computer
04:55 < s7r> will this feature work exactly as it works nowadays when ipv6 will be fully implemented? do you have any idea?
04:55 < krzie> its not a feature
04:56 < krzie> its just the design
04:56 < krzie> it passes packets... it doesnt make connections
04:56 < krzie> so yes
04:56 < krzie> btw ipv6 is fully implimented in some places
04:56 < krzie> !snapshots
04:56 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
04:56 < krzie> !ipv6
04:56 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
04:57 < krzie> that link is to the patch that openvpn devel snapshot uses, so you can use it as the documentation for it
04:57 < krzie> (for ipv6 in openvpn)
04:58 < krzie> if you do use it, please report how it works for you
04:58 < s7r> so it will be the exactly the same thing ? when we use ipv6?
04:58 < krzie> this will help it become accepted into the stable branch
04:58 <@dazo> s7r: I'm running the OpenWRT version from cron2 (!ipv6 link #1 above) and a development snapshot, to get IPv6 connectivity when I'm not at home ... it works just flawlessly
04:58 < krzie> it doesnt matter what protocols you use, the server does not make connections for the client, it just passes packets
04:59 <@dazo> s7r: yes, IPv6 will be tackled in the same way as IPv4 ... you will have some new arguments for providing IPv6 addresses to clients, that's the only new thing basically
04:59 < s7r> ok, that's what i wanted to know
04:59 < s7r> if anything changes in ipv6
04:59 < s7r> as i keep reading nat will be discarded, since openvpns works as NATs
04:59 < s7r> i thought ipv6 will terminate it :)
05:00 < krzie> huh?
05:00 < s7r> yeah crazy thinking :-p
05:01 <@dazo> Yeah, there is no NAT in IPv6 ... as the address scope is so big that everyone can get their own IPv6 address
05:02 <@dazo> but that's a good thing, actually ... NAT is a hack to make IPv4 survive longer ... but it breaks many protocols and complicates a lot of things
05:02 < s7r> yes but this won't prevent openvpn from working
05:02 <@dazo> nope
05:02 <@dazo> NAT is for IPv4 ... and will stay for IPv4
05:03 <@dazo> IPv4 and IPv6 are two different protocols, so you cannot compare them directly
05:03 <@dazo> even though much in IPv6 specs is based on IPv4 ... things which are good in IPv4, kind of
05:05 < krzie> and some things that are bad
05:05 < krzie> http://mirror.netcologne.de/CCC/27C3/mp4-h264-HQ/27c3-3957-en-ipv6_insecurities.mp4
05:05 < krzie> ;]
05:06 < s7r> some uninformed people are posing on forums 
05:06 < s7r> that vpns and proxy and sock servers will disappear when ipv6 reaches
05:06 < s7r> because ipv6 does not support NAT / packetforwarding
05:06 < krzie> ehh?
05:06 < s7r> not true i assume
05:07 < krzie> they just dont understand why we use NAT
05:07 < s7r> yes if you google ipv6 it's funny how many things you will read :)) posted by uninformed persons
05:07 <@vpnHelper> RSS Update - forum: Updates on Openvpn appliance <http://forums.openvpn.net/topic7513.html>
05:13 <@vpnHelper> RSS Update - forum: Updates on Openvpn appliance <http://forums.openvpn.net/topic7513.html#p9209>
05:25 <@vpnHelper> RSS Update - forum: To change port <http://forums.openvpn.net/topic7493.html#p9210>
05:25 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
05:31 <@vpnHelper> RSS Update - forum: No connect option <http://forums.openvpn.net/topic7512.html#p9211>
05:32 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:32 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:32 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:37 <@vpnHelper> RSS Update - forum: cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html#p9212>
05:39 < krzie> !route
05:39 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
05:41 -!- pielgrzym [~pielgrzym@91.142.196.180] has left #openvpn ["= Hejka / Hi peeps :]"]
05:44 <@vpnHelper> RSS Update - forum: cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html#p9213>
05:56 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:56 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has joined #openvpn
05:57 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
05:57 -!- Cain` is now known as Cain
06:03 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
06:17 -!- luneff [~yury@84.51.195.188] has joined #openvpn
06:26 -!- sporedi [~chatzilla@mail.utmxtm.com] has joined #openvpn
06:28 < sporedi> is l2  tunnel/bridge are interoperable (i mean if i am using vendor A  @location A and vendor B @location B ) 
06:32 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
06:33 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
06:34 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
06:35 -!- takamichi [~pri@85.232.213.54] has quit [Remote host closed the connection]
06:36 <@vpnHelper> RSS Update - forum: Is OPEN VPN right for me? <http://forums.openvpn.net/topic7263.html#p9214>
06:40 < reiffert> sporedi: I do not understand you. Please explain.
06:42 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
06:43 < sporedi> ok
06:44 < sporedi> let me better way
06:47 < sporedi> i have 2 office 1 office is in usa and 2nd office in germany now in usa  i am using firewall/vpn from vendror abc and  in germany i am using firewall/vpn from vendor xyz but they both are using open vpn 
06:48 < sporedi> in this case will i able to connect this two offices 
06:48 < reiffert> please ask vendor abc and xyz.
06:49 < sporedi> they are not able to provide the info or they dont want to provide info 
06:49 < reiffert> Who is vendor abc and xyz?
06:50 < sporedi> let me confirmed the usa site 
06:51 < sporedi> ok vmware and endian 
06:53 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
06:58 < Bushmills> sporedi: "i have one machine in country a and one machine in country b. will i be able to use openvpn between them?"
06:59 < Bushmills> oh, i forgot to say, they are both behind a firewall
06:59 < krzie> Bushmills, you can connect them with a crossover cable if you live on the border ;]
06:59 < sporedi> Bushmills: sorry i am not expert on this but i think yes using 
07:00 < Bushmills> sporedi: that's great. there is your answer.
07:00 < Bushmills> krzie: none of the machines have ethernet connections
07:00 < krzie> heheh
07:00 < krzie> firewire!
07:01 < Bushmills> one uses wifi, the other usbnet
07:02 < krzie> got microwave antenna/reciever equipment handy?
07:02 < krzie> maybe some bluetooth dongles...
07:02 < reiffert> Paket Radio?
07:02 < krzie> carrier pigeons?
07:02 < Bushmills> maybe i can use the keyboard LEDs as transmitter, and a webcam as receiver
07:03 < Bushmills> or, with a PA on one side, tunnel ip over kansas city standard?
07:05 < krzie> ip over smoke signal
07:05 < Bushmills> satellite heat signature reading
07:05 < reiffert> ip over irc.
07:05 < krzie> hah
07:09 < reiffert> 	0x0000:  4500 0054 1d99 0000 4001 979c c0a8 b317
07:09 < reiffert> 	0x0010:  c163 9050 0800 8db0 719f 0000 69f9 2e4d
07:09 < reiffert> 	0x0020:  6966 0c00 0809 0a0b 0c0d 0e0f 1011 1213
07:09 < reiffert> 	0x0030:  1415 1617 1819 1a1b 1c1d 1e1f 2021 2223
07:09 < reiffert> 	0x0040:  2425 2627 2829 2a2b 2c2d 2e2f 3031 3233
07:09 < reiffert> 	0x0050:  3435 3637
07:09 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:09 < krzie> reiffert, still up for helping me on the payment side of getting krz.ee?
07:10 < reiffert> sure
07:10 < krzie> last we talked of it ecrist couldnt send them the $ cause they only wanted to take bank xfer, and we found that your registrar does .ee
07:10 -!- sporedi [~chatzilla@mail.utmxtm.com] has left #openvpn []
07:10 < reiffert> yeah
07:10 < krzie> ill msg you the .ee contact (needed for reg)
07:11 < reiffert> But as far as I can remember, my registrar needs a registrant address within .ee, so an .ee contact.
07:11 -!- dschuett [~dschuett@216.229.21.250] has quit [Read error: Connection reset by peer]
07:13 < krzie> yep, can use his
07:13 < krzie> he'll need to go sign stuff again i think
07:13 < krzie> even tho he signed stuff with his gov for this domain when ecrist started
07:16 < krzie> gunna head to work and get coffee, bbiaf from krzee
07:37 < krzee> baq
07:38 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:38 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:44 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 250 seconds]
07:50 <@vpnHelper> RSS Update - forum: OPENVPN plugins for DreamBox <http://forums.openvpn.net/topic7507.html#p9215>
08:01 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
08:02 < dschuett> if i want to add a new client do i have to run ANYHTHING else besides " . /etc/openvpn/easy-rsa/2.0/build-key client2" ??
08:03 < |Mike|> y
08:03 < dschuett> Mike: what else needs to be done?
08:04 < |Mike|> read the topic sir :)
08:05 < dschuett> !goal
08:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:05 < dschuett> !welcom
08:05 < dschuett> !welcome
08:05 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:11 < dschuett> |Mike|: OpenVPN is installed on my gateway that is in front of a lan. - I have everything working just fine, i just don't know what i need to do to allow a second client to connect. I thought build-key client2 would do it but it is asking me to edit and run source ./vars should i have to do that?
08:13 -!- macsppadic [~sonupunno@88.211.55.77] has left #openvpn []
08:22 -!- WinstonSmith [~true@g231243155.adsl.alicedsl.de] has joined #openvpn
08:29 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
08:33 -!- WinstonSmith [~true@g231243155.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
08:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:36 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 265 seconds]
08:37 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
08:46 -!- WinstonSmith [~true@g231243155.adsl.alicedsl.de] has joined #openvpn
08:47 < Bushmills> the second part of it, yes
08:48 < Bushmills> nice if it tells you what to do, isn't it?
08:49 -!- venom00 [~wer@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
08:49 <@vpnHelper> RSS Update - forum: Ineternet speed after the openvpn connection <http://forums.openvpn.net/topic7448.html#p9216>
08:51 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
08:52 < dschuett> Bushmills: so do i have to change anything in vars? - or is it a big no no if it stays the same
08:52 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
08:55 < Bushmills> once you have edited it to your taste, you can leave it as it is,.
08:56 < dschuett> ok, so if i have already done this once ... for my first client, why is it asking again? - or do you just have to run "source ./vars" before each client?
08:56 < dschuett> Bushmills ^^
08:57 < Bushmills> just before you run build-key
08:57 < Bushmills> if you get tired of doing that, source it from those scripts
09:00 < dschuett> alright - so the only two things you need to do to build a new client key is to run "source ./vars" and the "build-key client2" ??
09:01 < dschuett> Bushmills: oh, and what do you mean "source it from those scripts"?
09:02 < Bushmills> by that i mean "let the scripts do what otherwise you'd have to do manually"
09:05 < dschuett> Bushmills: so that means hard-code my values in vars? - which i have already done
09:07 < Bushmills> "source" is script talk for "include". rather than "include" the file manually, modify script, or create a new script, which includes that vars file for you before calling build-key
09:08 < Bushmills> without sourcing vars, your settings may be in it, but no script uses them
09:11 -!- chr1s [5d61f643@gateway/web/freenode/ip.93.97.246.67] has joined #openvpn
09:12 < chr1s> hi, I want to benchmark running openvpn on ubuntu and centos, any thoughts as the best way to do this (already measured transferring large files)
09:13 < gladiatr> !welcome
09:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:13 < gladiatr> !goal
09:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:20 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
09:21 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has quit [Client Quit]
09:25 < Bushmills> chr1s: monitor RX bytes and TX bytes of ifconfig tun0
09:26 < chr1s> thanks
09:26 < Bushmills> alternatively, add stub firewall rules, which have no other purpose than traffic counting
09:33 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:48 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:54 -!- chr1s [5d61f643@gateway/web/freenode/ip.93.97.246.67] has quit [Quit: Page closed]
09:57 < gladiatr> he'll be back, you know
10:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
10:04 -!- dschuett [~dschuett@216.229.21.250] has quit [Read error: Connection reset by peer]
10:06 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
10:22 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
10:26 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:36 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
10:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:46 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Quit: Lost terminal]
10:52 < dschuett> any reason why dnsmasq won't resolve through virtualbox with openvpn?
10:54 < gladiatr> dnsmasq is running on the vm host?
10:54 < gladiatr> or the vm?
10:57 < dschuett> gladiatr: i have a gateway at my house running openvpn infront of a LAN, I am at work now on my windows 7 machine- and i can VPN into my home network  just fine (with DNS working). - I then installed virtual box on the same windows 7 machine. And have Ubuntu 10.10, - i can connect just fine to the vpn but DNS isn't resolving for my home network hosts
10:58 < dschuett> sorry **And have Ubuntu 10.10 installed on virtual box**
10:58 < dschuett> I don't know if this is a linux issue, or if it is because it is a VM
10:58 < dschuett> G0dfath3r!
10:59 < dschuett> oops, wrong IRC
10:59 < gladiatr> on this, the day of your daughter's wedding 
10:59 < gladiatr> lol
10:59 < dschuett> haha
10:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:59 < gladiatr> Well...
11:00 < gladiatr> You're gonna have to do something to update your dnsmasq config on the client with the DNS client information that's pushed from the server.
11:00 < gladiatr> I've been lazy about getting into dnsmasq and tend to bypass it (in this case, the only system I have that's using it is my phone, so...)
11:01 < gladiatr> so, I'm not sure exactly what exactly dnsmasq expects to have happen 
11:01 < dschuett> i don't have dnsmasq installed on my client, as it shouldn't be needed... It works on every windows machine
11:01 < gladiatr> Right, but you're running an Ubuntu 10.10 host that you're connecting to your home network via openvpn, correct?
11:02 < dschuett> right
11:04 < gladiatr> At this stage, the Ubuntu system is going to be operating independently from the host operating system.  For it to function properly as a client, at least as it pertains to your ability to do proper DNS lookups for your home network, you'll need to have some scriptage hooked in to update your client configuration.
11:05 < gladiatr> or rather, your cilent DNS configuration.
11:07 < dschuett> is this because it is a VM?
11:07 < gladiatr> From what I'm seeing in the dnsmasq man page, you can give it the -R directive to prevent it from reading /etc/resolv.conf and can then use a --server directive on the CLI to specify your new DNS server.
11:07 < gladiatr> No
11:08 < gladiatr> Linux doesn't have a per-interface DNS configuration like Windows
11:08 < dschuett> Which i have already done AND i use push "dhcp-option DNS 10.8.0.1" to force the clients to use that as DNS
11:09 < gladiatr> Right.  If you look in your client logs on the Ubuntu VM, you'll see the DNS information being pushed down from the server.  
11:09 < gladiatr> It is being delivered, your client just hasn't been told to do anything with it yet.
11:11 < gladiatr> You can access it and Do What Needs To Be Done using the --up hook.  You'll find all of the information that the server is pushing assigned to various environment variables.
11:12 < dschuett> ahhh, gotcha... makes sense... could you elaborate more on --up hook?
11:13 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
11:13 < gladiatr> it's just a directive in your cilent.conf file.  Give it a path to an executable shell script (or whatever your scripting language of choice is)
11:13 < gladiatr> So, for instance, you could create a file that looks like...
11:13 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
11:14 < gladiatr> http://pastebin.com/tV9y2sRy
11:14 < gladiatr> when you connect to the server, the up script will execute and leave you with a file in /tmp that shows all the environment variables available to that script hook.
11:15 < gladiatr> From there you can either update your /etc/resolv.conf file directly or stop and restart dnsmasq with the proper command line options to point you to the correct DNS server.
11:16 < gladiatr> To save yourself a headache, put the script in /etc/openvpn.  In your cilent conf. file, give it the fully qualified path to your script (up /etc/openvpn/myscript.sh) and remember to make it executable (chmod 755 /etc/openvpn/myscript.sh)
11:17 < gladiatr> Once you have this working, you can use a slightly different script that will put things back to the way they need to be when not connected to a VPN server
11:21 < dschuett> gladiatr: awesome! Thanks!
11:21 < gladiatr> you betcha :)
11:22 < gladiatr> Yeah.  The windows client kinda spoils you... until it doesn't work properly and then it makes you wish you had hooked up with that hippy chick in college and joined that art commune in Mexico...
11:22 < gladiatr> or somethin
11:23 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:23 < dschuett> lol..... i guess that is one way to put it!
11:23 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Remote host closed the connection]
11:25 < dschuett> gladiatr: so what line do i have to add in my client.conf to get that script to run?
11:26 < gladiatr> The directive is "up"
11:26 < gladiatr> and then the path to and name of your script
11:26 < gladiatr> There is "up"
11:26 < gladiatr> and then there is "down"
11:26 < gladiatr> !up
11:26 < gladiatr> !down
11:27 < gladiatr> !fail
11:27 < dschuett> so just : up /etc/openvpn/myscript.sh   ???
11:27 < gladiatr> Yes.
11:27 < dschuett> gladiatr: damn vpnhelper haha
11:28 < gladiatr> hehe
11:31 < dschuett> gladiatr: ok, so here is the thing... i can ping 192.168.0.1 (which is my nameserver on my home LAN) but if i set that manually in /etc/resolve.conf it still doesn't resolve DNS ???
11:32 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
11:34 < gladiatr> right.  that's because you're using the dnsmasq program
11:37 < gladiatr> It reads /etc/resolv.conf when it starts and not again unless it is restarted.  that's what I was talking about earlier: you can turn off dnsmasq alltogether and just edit /etc/resolv.conf, you can edit resolv.conf and then restart dnsmasq OR you can leave resolv.conf alone and restart dnsmasq with the -R --server [IP of your remote DNS server] and dnsmasq will ignore the contents of resolv.conf
11:37 < gladiatr> (at least according to what I'm seeing in the dnsmasq man page)
11:39 -!- dazo is now known as dazo_afk
11:44 < dschuett> gladiatr: but my understanding is that it ONLY has to be on one machine (and shouldn't have to be installed on clients) because that would defeat the purpose of a DNS server
11:44 < gladiatr> dnsmasq is a DNS forwarder, not a DNS server
11:44 < gladiatr> it needs an actual DNS server host to talk to
11:45 < gladiatr> The purpose, as I'm reading it, of using dnsmasq instead of just relying on the libc resolver routines and /etc/resolv.conf is to give dhcp systems and dynamic firewall environments a relatively simple way of updating the DNS server info for the local host
11:46 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:46 -!- WinstonSmith [~true@g231243155.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:46 -!- WinstonSmith [~true@g231243155.adsl.alicedsl.de] has joined #openvpn
11:50 < Bushmills> actually, dnsmasq has some features of an authoritative name server. but for this application, recursion would be needed, and that's what dnsmasq doesn't do. 
11:51 < Bushmills> i tend to suggest maradns as lightweight name server which can do recursion, can be authoritative and is configurable as upstream forwarder 
11:52 < Bushmills> on top, it is available for both unixoids and windowoids, freely.
11:54 < Bushmills> but it won't resolve host names from a /etc/hosts file
11:55 < gladiatr> Dunno.  I'm not running ubuntu 10.10 on anything at the moment--not sure what the logic is for including it in the default workstation installation if not for config manipulation simplification.
11:57 < Bushmills> dnsmasq? more serverish, probably because it combines dhcpd, dns forwarder, tftpd in one package 
11:57 < gladiatr> Egads.
11:57 -!- WinstonSmith [~true@g231243155.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:58 < Bushmills> actually, a bit more than just dns forwarder, as it serves from hosts file, and the dhcp request provided names, if any, plus allows to define RRs in the config file
11:59 < gladiatr> Yeah.  That kinda sounds a bit more than needs to be installed for a "desktop" system...
11:59 < Bushmills> so for a LAN, or on a router, it can make a lot of sense 
11:59 < gladiatr> Right.  It just seems to pop up frequently these days on debian-derived systems within distributions that aren't necessarily targeted at the server (ie: maemo) :)
11:59 < Bushmills> maradns, in contrast, is a "real" name server
12:01 < gladiatr> Indeed.  Looking at its docs now...
12:02 < Bushmills> as recursor also eminently desktop suited
12:06 < gladiatr> dschuett, is your intent to use this ubuntu vm as a gateway to your home network?
12:07 -!- dazo_afk is now known as dazo
12:10 -!- WinstonSmith [~true@g231243155.adsl.alicedsl.de] has joined #openvpn
12:17 -!- p3rror [~mezgani@41.140.31.52] has joined #openvpn
12:18 -!- djgerm [~Your_Moms@64-60-122-187.static-ip.telepacific.net] has quit [Quit: Leaving.]
12:21 -!- WinstonSmith [~true@g231243155.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
12:23 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
12:25 < iceberg> is there an openvpn client for windows that doesnt need admin at all? the portable version tried to install some driver and you cant do that w/o admin
12:27 < gladiatr> nope
12:27 < gladiatr> You've got to have the tap-win32 driver 
12:28 < gladiatr> And you have to be able to add and remove things from the routing table.
12:28 < gladiatr> Both of those require admin privileges
12:28 < gladiatr> (stupid windows /hrmph)
12:29 < krzee> !win_noadmin
12:29 <@vpnHelper> "win_noadmin" is (#1) http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin-Rev1.1.html for HowTo Run OpenVPN as a non-admin user in Windows, or (#2) and http://article.gmane.org/gmane.network.openvpn.user/24873 for vista
12:30 < krzee> iirc it hasnt been figured out how to do this after XP
12:30 < iceberg> krzee: yea that method requires admin access
12:30 < krzee> oh well sure
12:30 < krzee> you'll NEVER get openvpn running with no access to admin
12:30 < iceberg> I need a solution for when I goto a business and have no privs at all
12:31 < krzee> otherwise, just to run, it only needs access to add routes and whatnot
12:31 < iceberg> ssh was an epic failure because you can steal the kwys and there is no way to limit ssh to one connection per user
12:31 < krzee> iceberg, cell phone, laptop
12:31 < krzee> virtual machine
12:31 < krzee> (if you can do *that* without admin...)
12:32 < iceberg> I was just gona say vbox needs admin rights
12:34 < iceberg> if it's even possible I hate windows more than ever
12:35 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
12:35 < gladiatr> You are still alive.  It is possible.
12:36 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
12:36 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
12:36 < krzee> !windows
12:36 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg, or (#3) also, http://secure-computing.net/files/windows_2.jpg
12:37 < gladiatr> awesome
12:37 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
12:37 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
12:40 < X-Vo> when i connect to my vpn it won't pick up it's External IP, how do i fix this?
12:44 < krzee> !redirect
12:44 < gladiatr> !welcome
12:44 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:46 < gladiatr> X-Vo, you have been double-vpnhelper'd.  Beware lest your head explode...
12:47 < X-Vo> =o
12:48 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
12:52 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Ping timeout: 240 seconds]
12:52 -!- djgerm [~Your_Moms@64-60-122-187.static-ip.telepacific.net] has joined #openvpn
12:56 < X-Vo> and is it possible to connect to e.g. 192.168.1.1 and such when using my vpn?
12:56 < Bushmills> !goal
12:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:56 < Dougy> need some help with openvpn on windows
12:56 < Dougy> it started properly, and it exists in routing table
12:56 < Dougy> and server get 10.5.5.4 but i can't ping it
12:57 < Dougy> firewall?
12:57 < Bushmills> no idea. somewhat terse problem description
12:57 < krzee> server didnt get .4
12:58 < Dougy> oh says base is .4
12:58 < Dougy> but .1 doesnt ping either
12:58 < Dougy> oh wait, it does
12:58  * Dougy facepalm
12:58 < krzee> heh
12:58 -!- p3rror [~mezgani@41.140.31.52] has quit [Ping timeout: 240 seconds]
12:59 < Bushmills> !howto
12:59 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
12:59  * krzee hands Bushmills a clue-stick to beat Dougy with
12:59 < Bushmills> Dougy: ^^^^  :P
12:59 < Dougy> I have the howto open already
12:59 < Dougy> just  misread
12:59 < Bushmills> bookmarked?
12:59 < Dougy> no
12:59 < Dougy> memorized
12:59 < Dougy> :O
12:59 < Bushmills> for future reference aka deletion?
12:59 < Dougy> im always on there
12:59 < Dougy> i use the 3 ip block thing for reference all the time
12:59 -!- WinstonSmith [~true@e178179130.adsl.alicedsl.de] has joined #openvpn
13:00 < Dougy> where it tells how big the 10 and the 172w blocks are
13:00 < Dougy> etc
13:00 < krzee> umm
13:00 < krzee> you mean
13:00 < krzee> !1918
13:00 < krzee> ?
13:00 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, adn 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html
13:00 < Dougy> yeah that
13:00 < Dougy> i just load the howto as it says it and its convenient
13:01 < Dougy> bout to head to advance auto parts
13:03 < Dougy> balls
13:03 < Dougy> they dont have the part in stock
13:03 < Dougy> ajsfkdghnljjag
13:04 < Dougy> what is 'nsCertType' in ddd-wrt
13:04 < Dougy> dd-wrt
13:05 < krzee> meh
13:05 < krzee> !man
13:05 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
13:06 < Dougy> oh that's on there?
13:06  * Dougy loads
13:12 -!- Jondice1 [~brandon@rrdhcp-172-285.redrover.cornell.edu] has quit [Ping timeout: 246 seconds]
13:12 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
13:16 -!- KipMacy [~kmacy@unaffiliated/kipmacy] has quit [Remote host closed the connection]
13:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:19 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
13:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
13:22 < Dougy> thats lame
13:22 < Dougy> my server made hte certs not valid till later
13:22 < Dougy>             Not Before: Jan 13 18:33:03 2011 GMT
13:22 < Dougy> hrmmph
13:22 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
13:30 < ecrist> set the date right...
13:37 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has quit [Ping timeout: 255 seconds]
13:37 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
13:43 -!- agrajag [~agrajag^@c-24-131-78-108.hsd1.pa.comcast.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
13:52 -!- mezgani_ [~mezgani@41.140.43.168] has joined #openvpn
13:54 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Quit: iceberg]
13:55 -!- mezgani_ is now known as p3rror
13:56 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
13:59 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
14:01 -!- gomix [~gomix@fedora/gomix] has joined #openvpn
14:03 -!- diphthong [~diphthong@69.172.135.243] has quit [Quit: leaving]
14:03 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
14:05 -!- diphthong [~diphthong@69.172.135.243] has quit [Client Quit]
14:05 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
14:07 -!- gomix [~gomix@fedora/gomix] has left #openvpn []
14:08 -!- grendal_prime_ [~sgraham@riverbank.fpdomain.com] has joined #openvpn
14:08 < grendal_prime_> hey guys
14:08 < grendal_prime_> i got a werid on here.  I have working openvpn server. and im trying to get the clients to see the internal network.
14:09 < grendal_prime_> pushing a route and i have the iroute in the ccd.  but the clients cannot see the network on the other side.
14:10 < rjd_> they tunnel all their traffic through the vpn server?
14:10 < rjd_> and that works?
14:10 < krzee> !ipv6
14:10 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
14:10 -!- skrusty [~skrusty@83.166.176.39] has joined #openvpn
14:14 < Dougy> hm
14:14 < Dougy> haing an odd xen issue
14:15 < gladiatr> !iroute
14:15 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
14:22 -!- grendal_prime_ [~sgraham@riverbank.fpdomain.com] has quit [Ping timeout: 276 seconds]
14:23 < Dougy> this is so odd
14:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:36 < Dougy> just had a job ofer to work for http://www.liveprofile.com/
14:36 < Dougy> neato
14:36 <@vpnHelper> Title: LiveProfile - Stay Connected (at www.liveprofile.com)
14:37 -!- p3rror [~mezgani@41.140.43.168] has quit [Read error: Connection reset by peer]
14:38 -!- sia^pwnnt is now known as adawda
14:38 < Dougy> it's 18:33 GMT.. certs still dont want to work
14:38 < Dougy> lame 
14:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
14:44 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has joined #openvpn
14:45 -!- Jondice1 [~brandon@rrdhcp-172-285.redrover.cornell.edu] has joined #openvpn
14:45 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has quit [Client Quit]
14:46 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has joined #openvpn
14:46 < Manny> hi :)
14:47 < Manny> what solution do you recommend for letting only certain applications run the network traffic over a VPN? Most solutions use iptables, e.g., http://serverfault.com/questions/95813/only-tunnel-certain-applications-via-openvpn
14:47 <@vpnHelper> Title: linux - Only tunnel certain applications via OpenVPN - Server Fault (at serverfault.com)
14:47 < Manny> do you have any other ideas?
14:47 < krzee> !routebyapp
14:47 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
14:47 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Read error: No route to host]
14:47 < Manny> krzee, thanks
14:47 < Manny> !sockd
14:47 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
14:48 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
14:49 < Manny> krzee, is there any step-by-step howto, or am I expected to be experienced and longanimous to collect all the information myself?
14:49 < krzee> np
14:50 < krzee> no howto, but one isnt needed really
14:50 < gladiatr> longanimous... I like that.  I don't think I've ever seen it used in a sentence before.  Thanks, manny :)
14:51 -!- p3rror [~mezgani@41.140.155.31] has joined #openvpn
14:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:52 < Manny> krzee, for instance, "get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination." -- I thought I have one subnet for the VPN tun0 device, and one for the eth0 devices. So how should I filter by subnet? This seems a bit odd...
14:52 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has joined #openvpn
14:54 < krzee> you run it listening on tun0 and using eth0 to leave
14:54 < krzee> dante supports this
14:54 < Manny> krzee, ah ok, I wasn't aware of such one-way traffic configurations. I'll try to fiddle a bit around, and ask if I have any problems.
14:55 < Manny> krzee, what do you suggest as a proxifier replacement for linux? iptables rules?
14:55 < Manny> oups, what a stupid remark
14:55 -!- adawda is now known as sia^pwnnt
14:56 < Manny> maybe something like tsocks?
14:56 < krzee> socksify or something
14:57 < Manny> krzee, thanks a million. I wasn't aware of dante.
14:57 < krzee> np
15:00 < krzee> internal: 10.8.1.1 port = 1080
15:00 < krzee> external: 66.11.114.212
15:00 < krzee> this tells it to only listen on 10.8.1.1 port 1080
15:00 < krzee> and to use 66.11.114.212 as its outbound
15:00 < krzee> (quite handy for this)
15:01 < krzee> you can also get crafty with the ruleset... mine allows all because if you are in my vpn you are ME
15:01 < krzee> and if you are me, you should be able to do anything!
15:01 < krzee> (dante also allows udp, whereas socks via ssh does not)
15:02 -!- grendal_prime_ [~sgraham@riverbank.fpdomain.com] has joined #openvpn
15:03 -!- ^scott^ [~scott@stthom.org] has left #openvpn []
15:03 < grendal_prime_> ok gladiatr sorry i got bounced...so...basically do the machines on the internal network all have to have a static route that tells them where the 10.8.0.0 nework is?
15:03 < grendal_prime_> !route
15:03 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
15:04 < krzee> grendal_prime
15:04 < krzee> !route_outside_openvpn
15:04 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
15:04 < krzee> in that section of !route it tells in detail
15:04 < krzee> you CAN add the route to every lan machine if you want... or just to their gateway
15:04 < krzee> with the second option being far easier of course
15:05 < gladiatr> yeah.  what krzee said :)
15:07 -!- Guest59138 [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Connection reset by peer]
15:09 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
15:13 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
15:14 -!- p3rror [~mezgani@41.140.155.31] has quit [Ping timeout: 240 seconds]
15:16 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: time to go]
15:19 <@vpnHelper> RSS Update - forum: IP address of client still visible <http://forums.openvpn.net/topic7514.html>
15:23 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:23 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 250 seconds]
15:23 -!- ginoe [~ginoe@6-pra-5.acn.waw.pl] has joined #openvpn
15:24 < ginoe> hi can someone help me with building openvpn on windows ?
15:25 < ginoe> i try with that: https://community.openvpn.net/openvpn/wiki/BuildingOnWindows but when i run python build_all.py i get https://community.openvpn.net/openvpn/wiki/BuildingOnWindows
15:25 <@vpnHelper> Title: BuildingOnWindows – OpenVPN Community (at community.openvpn.net)
15:25 < ginoe> any idea whay ?
15:25 < ginoe> sorry error msg: IOError: [Errno 2] No such file or directory: 'C:\\cprojects\\openvpn-build\\openvpn-2.2\\tapinstall\\sources.in'
15:25 < cron2> ginoe: you could go with the old build system ("domake-win", it's a script but has the documentation right in it)
15:25 < cron2> or you need to get 
15:26 < cron2> 2.2-RC with mattock's python build patches
15:26 < ginoe> where can i get that 2.2-RC ?
15:26 < krzee> !download
15:26 < cron2> "wait for it to be released"
15:26 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
15:26 -!- p3rror [~mezgani@41.248.184.76] has joined #openvpn
15:26 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has quit [Quit: Ex-Chat]
15:26 < cron2> krzee: we have released 2.2-RC already?
15:27 <@dazo> ginoe:  mattock is working hard on the building scripts on Windows .... that's what's holding the 2.2-RC back, so that we have proper/working scripts in that release
15:27 < cron2> ginoe: what I tried to say is "python building is very new and stuff is missing"
15:27 <@dazo> cron2:  krzee:  2.2-RC is still not released ... due to the windows building issues :(
15:27 < cron2> the old msys/mingw building works
15:27 < cron2> domake-win
15:27 <@dazo> that should probably work, yes
15:28 < ginoe> ok - is ther some tutorial for that ? (msys)\
15:28 < cron2> ginoe: google for msys, follow the instructions how to install that
15:28 < cron2> windows building is not for the faint of heart
15:30 < cron2> sorry if I sound harsh - that's not actually my intention - but I just don't have an easy-to-follow HOWTO available, just "domake-win, google, and grab the precompiled tap driver from the download page"
15:30 <@vpnHelper> RSS Update - forum: how to create certificates for "--remote-cert-tls" <http://forums.openvpn.net/topic7484.html#p9218>
15:31 < ginoe> cron2 - no it's not problem to me -  i have right now msys and try to install openssl lzo and pkc11
15:32 < krzee> ohhh RC
15:32 < krzee> right, we've released beta, my bad
15:36 <@vpnHelper> RSS Update - forum: OpenVPN to filter DHCP requests in bridge mode <http://forums.openvpn.net/topic7479.html#p9219>
15:36 -!- dschuett [~dschuett@216.229.21.250] has quit [Ping timeout: 246 seconds]
15:37 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
15:38 < grendal_prime_> ya this is hella frustrating
15:41 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has joined #openvpn
15:41 < Manny> !welcome
15:41 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:42 < Manny> !goal
15:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:42 < Manny> !seen krzee
15:42 <@vpnHelper> krzee was last seen in #openvpn 9 minutes and 18 seconds ago: <krzee> right, we've released beta, my bad
15:42 < Manny> x(
15:43 < Manny> I am trying to configure dante for my tun0 iface. In my case, I only had a Cisco VPN server, so I had to use vpnc to set up the tun0 iface. However, IMO the rest should be identical to OpenVPN, right?
15:43 -!- ginoe [~ginoe@6-pra-5.acn.waw.pl] has quit [Remote host closed the connection]
15:43 < Manny> I tried to follow the suggestions by...
15:43 < Manny> !routebyapp
15:43 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
15:43 < Manny> !sockd
15:43 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
15:43 < Manny> I don't understand how to "ONLY RUN THIS ON THE INTERNAL VPN IP!"
15:44 < Manny> do I need to take the tun0's IP, and set it as external IP of dante.conf?
15:45 < Manny> is "internal: eth0 port = 1080" and "external: MY-tun0-IP" ok?
15:46 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
15:49 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has left #openvpn ["Ex-Chat"]
15:49 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has joined #openvpn
15:56 -!- p3rror [~mezgani@41.248.184.76] has quit [Ping timeout: 240 seconds]
15:57 -!- andol [andreas@ubuntu/member/andol] has joined #openvpn
15:58 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has quit [Quit: Ex-Chat]
15:59 -!- sbrath [~sbrath@unaffiliated/sbrath] has joined #openvpn
16:09 -!- p3rror [~mezgani@41.140.38.157] has joined #openvpn
16:13 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
16:29 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has joined #openvpn
16:29 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
16:39 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
16:40 < Dougy> haviong some issues.. http://paste2.org/p/1190834 <-- i know the client is missing remote line, remove dit so it'd stop screwing it self up
16:41 < Dougy> the vpn connects fine.. but i lose all connectivity here at the house
16:41 < Dougy> i can ping 10.5.5.6 (vpn ip my router gets).. but nothing else.. and cant connect to router via that ip.. so my connectivity is useless
16:41 < Dougy> i'd like to have def1 at some point too so all traffic goes through that .109 ip
16:47 <@dazo> Dougy:  read up on !route
16:47 <@dazo> !route
16:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
16:48 <@dazo> that error message you refer to is mentioned here and why
16:48 < Dougy> ive been reading it
16:48 < Dougy> i just noticed i missed iroute for the 192.168.1.0/24 vlan
16:48 < Dougy> so i added it for myself
16:48 < Dougy> was that my only issue?
16:49 <@dazo> from the log file it seems so
16:49 < Dougy> ok.. wish me luck....
16:49 <@vpnHelper> RSS Update - forum: how to create certificates for "--remote-cert-tls" <http://forums.openvpn.net/topic7484.html#p9220>
16:50 < Dougy> here goes nothing
16:51 < Dougy> im still online!
16:51 < Dougy> w00t
16:51 < Dougy> so um dazo 
16:51 < Dougy> if i add def1, it should just send all traffic through right
16:51 <@dazo> yeah, basically that's the idea
16:51 < Dougy> ok
16:51 < Dougy> brb testing again
16:51 -!- grendal_prime_ [~sgraham@riverbank.fpdomain.com] has quit [Quit: Ex-Chat]
16:52 < Dougy> nope :(
16:52 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has joined #openvpn
16:53 < Manny> re! :)
16:53 < Dougy> dazo: i can still communicate in the LAN fine... b ut no external connectivity :(
16:53 < Manny> third time...
16:53 <@dazo> Dougy:  check your routing table after connecting to the VPN
16:53 < Dougy> Thu Jan 13 22:52:06 2011 /sbin/ifconfig tun1 10.5.5.6 pointopoint 10.5.5.5 mtu 1500
16:53 < Dougy> Thu Jan 13 22:52:07 2011 ERROR: Linux route add command failed: external program exited with error status: 255
16:53 < Manny> I am unable to configure dante + vpnc, as suggested by !routebyapp and !socksd. I know, it's a vpnc question -- but it should be (more or less) the same for openvpn. The problem is:
16:53 < Dougy> i assume that means something
16:54 <@dazo> Manny:  this is #openvpn ... not #dante or #vpnc
16:54 < Dougy> dazo: any ideas?
16:54 <@vpnHelper> RSS Update - forum: quetions about pushing routes <http://forums.openvpn.net/topic7515.html>
16:54 < Dougy> or just try it and pastebin routing table
16:55 <@dazo> Dougy:  that basically means it struggled with adding a route ... so you need to have log files on verb 4 probably to see more what is happening
16:55 <@dazo> Dougy:  you are starting openvpn with admin/root privileges?
16:55 < Manny> dazo, I know, but dante + vpnc is a lot like dante + openvpn, right? :) I mean, I followed the !socksd howto, that's why I am mentioning it. I would LOVE to try out openvpn as well, but I only have a cisco protocol server available @ university
16:55 < Dougy> brb.. will pastebin
16:55 <@dazo> Manny:  vpnc != openvpn ... except that both are VPN solutions ... but they are very different
16:55 < Manny> dazo, ...but both create a tunX device, right?
16:56 <@dazo> vpnc != openvpn
16:56 < Manny> isn't it "just" the protocol?
16:56 < Manny> you are very strict. I am trying to find out whether anybody followed the !socksd tutorial, and ran into the same trouble with OpenVPN :)
16:57 <@dazo> Manny ... on this channel you can expect help with #openvpn primarily .... some people here might know a lot about other things ... but don't expect that we can help with whatever here
16:57 < Dougy> dazo: http://paste2.org/p/1190853
16:58 < Manny> my problem is that danted works like a charm, with "internal: 127.0.0.1 port = 1080", and "external = tun0", and the rest of danted as !socksd, but only IFF my default gateway is set to tun0
16:58 < Dougy> have one idea.. windows ip forwarding..
16:59 < Manny> the same applies conversely: "internal: 127.0.0.1 port = 1080" and "external = eth0" only works if my default gateway is set to eth0's
16:59 < Manny> "set to tun0" = "set to tun0's". By "set to X's", I mean that it is set to the gateway taken from ifconfig.
17:01 < Dougy> bah
17:01 < Dougy> !windows
17:01 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg, or (#3) also, http://secure-computing.net/files/windows_2.jpg
17:01 < Dougy> !factoids search windows 2008
17:01 <@vpnHelper> No keys matched that query.
17:01 < Dougy> !factoids search win2008
17:01 <@vpnHelper> No keys matched that query.
17:01 < Dougy> !factoids search win2k8
17:01 <@vpnHelper> "win2k8" is Server 2008 assigns the OpenVPN TAP Adapter v9 as an Unidentified network which the default Local Security Policy of Server 2008 assigns as being a Public Interface with restricted access. To fix it do this: Go into Control Panel / Administrative Tools / Local Security Policy / Network List Manager Policies / Unidentified Networks. Set Location Type to Private.
17:03 <@dazo> Dougy:  it looks like you are trying to setup the same route twice
17:03 <@dazo> look at line 21, 33 and 34
17:04 < Dougy> in the pastebin?
17:04 < Dougy> or in config file(s0
17:04 <@dazo> yeah
17:04 <@dazo> pastebin
17:04 <@dazo> the last one
17:04 < Dougy> intereting
17:04 < Dougy> you didnt see it duped in config files did you
17:04 <@vpnHelper> RSS Update - forum: quetions about pushing routes <http://forums.openvpn.net/topic7515.html#p9222>
17:04 < Dougy> i mean, i did the 'server 10.5.5.0 255.255.255.0' and the push route
17:04 < Dougy> is that my issue?
17:05 <@dazo> sorry, my box crashed and I just recovered ... I lost that window
17:05 < Dougy> which window
17:05 < Dougy> the pastebin?
17:05 < Dougy>  server 10.5.5.0 255.255.255.0 and push "route 10.5.5.0 255.255.255.0" <-- causing my dupe issue?
17:06 <@dazo> Dougy:  yes, I think so
17:07 <@dazo> --server does a push route like that as well
17:07 < Dougy> alrighty well thats not helping my stupid ip forwarding issue
17:07 < Dougy> once vpn connects, i can ping the vpn ip .1 and the windows server's public IP
17:07 < Dougy> but connectivity just ends there
17:07 < Dougy> thats just windows ip forwarding issue right
17:08 <@dazo> Dougy:  you do remember to NAT the traffic from the tunnel and "out to the world"?
17:08 <@dazo> server is windows based?
17:09 < Dougy> yeah
17:09 < Dougy> domain controller
17:09 < Dougy> vpn server
17:09 < Dougy> in one
17:09 <@dazo> ugh ... okay, I know nothing about windows unfortunately, so I have no idea how to do such stuff there
17:10 < Dougy> well, the openvpn aspect works properly
17:10 < Dougy> i know almost noitihng about windows server, either dazo 
17:10 < Dougy> so we are on the same page here
17:10 <@dazo> :)
17:11 <@dazo> well, I'm pretty confident it has to be some NAT issues then ... or ... if your server is behind a firewall which NAT's the windows server as well ...
17:11 < Dougy> nope server is colocated
17:11 <@dazo> okay, then you simply need to figure out NAT on Windows
17:12 < reiffert> !factoids search nat
17:12 <@vpnHelper> 'nat', 'linnat', 'fbsdnat', 'pfnat', 'freebsdnat', 'bsdnat', 'donate', 'winnat', and 'openvzlinnat'
17:12 < reiffert> !winnat
17:12 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows, or (#2) http://www.nanodocumet.com/?p=14 for windows XP
17:12 < Dougy> dude
17:12 < Dougy> i love you
17:12  * Dougy tests
17:13 < Dougy> bah server 2003
17:16 -!- p3rror [~mezgani@41.140.38.157] has quit [Ping timeout: 255 seconds]
17:17 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
17:18 < Manny> ok, thanks
17:18 < Manny> see you
17:18 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has quit [Quit: Ex-Chat]
17:19 < Dougy> little confused dazo
17:19 < Dougy> should i enable NAT on the tap interface
17:19 < Dougy> or the actual ethernet interfafce
17:20 <@dazo> Dougy:  uhh ... in my head, it would be the ethernet interface, you want traffic going in/out of that one to be NATed to the servers IP address
17:21 <@dazo> but I know this is Microsoft too ... they might have a different opinion than me
17:21  * Dougy will play with it
17:23 < Dougy> enabled it on both with no love
17:23 < Dougy> hmm
17:24 < reiffert> on the ethernet interface, of course.
17:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:33 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
17:35 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has joined #openvpn
17:37 < Dougy> im out of ideas
17:38 < Dougy> http://www.upload3r.com/serve/130111/1294961926.png
17:38 < Dougy> no luck
17:43 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
17:44 <@dazo> Dougy:  I believe you in that window you show there need to set your public IP address
17:44 <@dazo> it says "Your ISP provider assigns this address pool"
17:45 <@dazo> but this is just a wildguess though
17:46 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
17:46 <@vpnHelper> RSS Update - forum: OpenVPN to filter DHCP requests in bridge mode <http://forums.openvpn.net/topic7479.html#p9223>
17:50 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 246 seconds]
17:52  * dazo calls this a day
17:53 -!- dazo is now known as dazo_afk
17:57 -!- s7r [~s7r@94.46.240.225] has left #openvpn []
18:03 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
18:12 -!- p3rror [~mezgani@41.140.103.245] has joined #openvpn
18:14 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9224>
18:20 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
18:20 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
18:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:30 <@vpnHelper> RSS Update - forum: Management localhost 7505 <http://forums.openvpn.net/topic7516.html>
18:35 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Ping timeout: 276 seconds]
18:41 -!- p3rror [~mezgani@41.140.103.245] has quit [Remote host closed the connection]
19:06 <@vpnHelper> RSS Update - forum: Linux client problem <http://forums.openvpn.net/topic7497.html#p9226>
19:26 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Ping timeout: 272 seconds]
19:35 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
19:44 -!- sia^pwnnt is now known as adawda
20:04 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:28 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has quit [Ping timeout: 260 seconds]
20:36 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
20:53 -!- corretico [~corretico@201.201.44.82] has quit [Remote host closed the connection]
20:59 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
21:02 -!- djgerm [~Your_Moms@64-60-122-187.static-ip.telepacific.net] has quit [Quit: Leaving.]
21:13 < Dougy> dazo i dont think so
21:13 < Dougy> time to fight with it more
21:19 < Dougy> http://paste2.org/p/1191226 why does that look so wron
21:19 < Dougy> g
21:29 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
21:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
21:32 -!- corretiko [~corretico@201.201.44.82] has joined #openvpn
21:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:38 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
21:47 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
21:54 < Dougy> fuckkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk
21:54 < Dougy> anyon here set up openvpn with def1 on windoze 2008
22:15 < Dougy> ok igot it
22:15 < Dougy> but..
22:15 < Dougy> now i can surf web properly.. but my local LAN is acting up... i can ping 192.168.1.1 but cant load in browser
22:15 < Dougy> if i push route for 192.168.1.0 255.255.255.0.. should i be able to reach it from the server? things inside the 192 that is
22:16 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 240 seconds]
22:17 < Dougy> i can ping 10.5.5.1 but not .6 (.6 is my router)
22:22 < Dougy> krzie: help
22:23 < krzie> heh
22:23 < krzie> !route_outside_openvpn
22:23 < Dougy> im almost ther
22:23 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
22:24 < Dougy> its 11pm
22:24 < Dougy> and that jsut went so far over my head
22:25 < krzie> then bookmark it for when you can understand it better
22:25 < Dougy> :(
22:25 < krzie> and go read that section of !route
22:25 < Dougy> i realize im missing a route or 2
22:25 < krzie> i documented it all
22:25 < krzie> "explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route"
22:25 < Dougy> thats what i ahve infront of me
22:25 < Dougy> can you do 'route ip netmask <dest>' ?
22:26 < krzie> ask your manual
22:26 < Dougy> ok, let me rephrase
22:26 < Dougy> am i on the right path to what i need?
22:26 < krzie> if you're reading my routing document yes
22:26 < Dougy> yeah i am
22:26 < Dougy> Lets say our server is 10.10.2.10 on its lan, and uses 10.10.2.1 as its default route, and you want the 2.x lan to be accessible or able to access over the vpn.
22:26 < Dougy> 2.1 would need a route for every network that 2.x will access or be accessed by. That means in our example:
22:26 < Dougy> 10.10.2.1 must know that for 10.10.1.x 10.10.3.x and the vpn internal network (for example, 10.8.0.x), it sends the traffic to 10.10.2.10 
22:26 < Dougy> This is true for any number of lans you want to connect, whether server or client.
22:26 < Dougy> that
22:27 < Dougy> i guess im just not mentally translating that to a route rule
22:27 < Dougy> @MAN
22:27 < Dougy> ER
22:28 < Dougy> !man
22:28 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
22:29  * Dougy dies
22:29 < Dougy> so krzie i need 'route 192.168.1.0 255.255.255.0 192.168.1.1' ?
22:29 < krzie> umm no
22:30 < krzie> in fact, hell no
22:30 < krzie> lol
22:30  * Dougy headdesks
22:30 < Dougy> i should be careful
22:30 < Dougy> i have a sharps container on my desk
22:30 < krzie> i didnt even need to read anything above
22:30 < krzie> route 192.168.1.0 255.255.255.0 192.168.1.1 by itself just makes no sense
22:30 < Dougy> i guess
22:30 < krzie> if 192.168.1.1 is 1 hop away, why wouldnt the rest of the lan be...?
22:30 < Dougy> i thought about setting it to 10.5.5.1 but that's useless
22:30 < Dougy> or isnt it
22:31 < Dougy> 10.5.5.1 is the server
22:31 < krzie> make a gliffy diagram and include things that matter this time
22:31 < krzie> also, how many VPNs are you setting up dude?
22:31 < Dougy> what would they be
22:31 < Dougy> just one..
22:31 < Dougy> one server.. and client is my home rotuer
22:31 < Dougy> router even
22:31 < krzie> you keep coming up with new issues, seems like the 3rd vpn
22:31 < Dougy> i set one up for shits and giggles about every month or two
22:31 < Dougy> then take it down after i get bored with it
22:32 < krzie> so you are using my friday night time for shits and giggles?
22:32 < Dougy> actually no
22:32 < Dougy> this time it has a purpose
22:32 < Dougy> purpose of this is to redirect all traffic through vpn..vpn is on same server as a domain controller.. so all pc's can surf the web with that IP and connect to domain controller
22:32 < Dougy> 2 in one i guess
22:33 < Dougy> what really has me perplexed right now is that i can ssh to 192.168.1.1 but cant load web page
22:35 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has joined #openvpn
22:35 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has quit [Changing host]
22:35 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
22:35 < Dougy> oh now it works
22:38 < Dougy> ok bed
22:38 < Dougy> will tackle that last route tomorrow
22:40 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 240 seconds]
22:55 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has joined #openvpn
23:00 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has quit [Ping timeout: 260 seconds]
23:06 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has joined #openvpn
23:07 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 240 seconds]
23:07 -!- WinstonSmith [~true@e178179130.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
23:10 -!- LedZeplin [jbearer@74.46.1343.static.theplanet.com] has joined #openvpn
23:11 < LedZeplin> !welcome
23:11 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:12 < LedZeplin> !goal
23:12 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:12 -!- grapsus [~grapsus@acces1192.res.insa-lyon.fr] has quit [Remote host closed the connection]
23:13 < LedZeplin> !howto
23:13 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
23:13 < LedZeplin> !topology
23:13 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
23:20 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has joined #openvpn
23:23 < Bebop2Steady> A general question for the openvpn expert:    If I have 2 different vpn providers (eg: perfect privacy, xerobank) -- can I open one instance of openvpn client on my windows pc, then after it connects --   open a 2nd instance of openvpn client to the other provider, and therefore create a nested vpn situation. Is there any specific change that would need to be manually added to the windows route ta
23:23 < Bebop2Steady> ..route table...
23:25 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:25 < Bebop2Steady> just for a proof of concept i setup 2 openvpn servers that work fine on their own, but as soon as i try to run them at the same time -- I cant surf net anymore.
23:26 < Bebop2Steady> I'm starting to think that openvpn or windows is not designed to behave this way
23:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
23:47 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
23:48 < Bebop2Steady> any helpers on who know about double vpn ?
23:53 -!- corretiko [~corretico@201.201.44.82] has quit [Read error: Connection reset by peer]
23:53 < Bebop2Steady> well, if you do -- I have started a thread:   https://forums.openvpn.net/post9160.html
23:53 <@vpnHelper> Title: OpenVPN Support Forum Double VPN || 2 Hop VPN || VPN-over-VPN : Server Administration (at forums.openvpn.net)
23:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
--- Day changed Fri Jan 14 2011
00:07 -!- Bebop2Steady [~Bebop2Ste@124-169-6-237.dyn.iinet.net.au] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
00:22 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has joined #openvpn
00:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
00:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
00:33 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has quit [Ping timeout: 250 seconds]
00:38 -!- Chris___ [goose@well.i.made.ur-mom.go.honk-honk.org] has left #openvpn ["God doesn't send firemen to hell; if he did, he knows we'd just put it out!"]
01:03 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has joined #openvpn
01:04 -!- andol [andreas@ubuntu/member/andol] has left #openvpn []
01:10 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
01:14 -!- harry_ [~harry@224.sub-174-252-37.myvzw.com] has joined #openvpn
01:14 < harry_> greetings
01:15 -!- harry_ [~harry@224.sub-174-252-37.myvzw.com] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
01:27 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:27 -!- mode/#openvpn [+o mattock] by ChanServ
01:32 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 260 seconds]
01:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:57 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has quit [Ping timeout: 260 seconds]
02:00 <@vpnHelper> RSS Update - forum: cannot ping and samba share between ubuntu server and winxp <http://forums.openvpn.net/topic7504.html#p9227>
02:00 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
02:04 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has joined #openvpn
02:22 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has quit [Quit: Lost terminal]
02:24 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
02:32 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
02:39 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
02:47 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
02:52 -!- dazo_afk is now known as dazo
02:59 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:03 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
03:04 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
03:04 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
03:04 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
03:18 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:21 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
03:26 < Malard> hi, i've got a tun working between server and client and i can send data between both ends on routes that were pushed from the server and addresses that are in the same 10.20.0.0/23 as the client (dont ask about the range size), however i have a seperate range that i want the server to route traffic towards the client (10.1.1.0/29) the client can ping that ip correctly, and on the server side 
03:26 < Malard> traffic gets routed to the vpn server correctly
03:26 < Malard> and i've created a static route that mirrors the same as the 10.20.0.0/23 route
03:26 < Malard> 10.1.1.0 10.8.0.2 255.255.255.248 UG 0 0 0 tun0
03:27 < Malard> 10.20.0.0 10.8.0.2 255.255.254.0 UG 0 0 0 tun0
03:27 < Malard> do I need to do anything special with openvpn?
03:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:41 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
03:45 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 264 seconds]
03:45 -!- Malard|Home [~ident@xbmc/staff/malard] has quit [Ping timeout: 246 seconds]
03:50 -!- master_of_master [~master_of@p57B55F20.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
03:52 -!- master_of_master [~master_of@p57B55C08.dip.t-dialin.net] has joined #openvpn
04:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:18 < hyper_ch> krzie: http://www.embedded-bits.co.uk/2011/1-second-linux-boot-to-qt/
04:18 <@vpnHelper> Title: 1 second Linux boot to Qt! « Embedded Bits (at www.embedded-bits.co.uk)
04:18 < macsppadic> hey hyper_ch that looks very cool
04:33 < reiffert> the slides..++
04:34 < hyper_ch> macsppadic: :)
04:34 < hyper_ch> reiffert: ?
04:35 < reiffert> http://www.slideshare.net/andrewmurraympc/elce-the
04:36 < reiffert> the last comment is nice
04:36 < reiffert> "Looks nice, but maybe you should optimize the touch screenspeed instead, there is quite a delay when you press the screen.
04:36 < reiffert> A speed up there, makes a lot more sense than the booting time."
04:39 < hyper_ch> :)
04:40 -!- albech_ [~thomas@124.157.211.210] has joined #openvpn
04:44 -!- common- [~common@p5DDA484E.dip0.t-ipconnect.de] has joined #openvpn
04:45 -!- common [~common@p5DDA482E.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
04:45 -!- common- is now known as common
04:58 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:16 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has joined #openvpn
05:16 < ashes> hi
05:17 < ashes> i haven't had good luck with redirect-gateway, so i used: route add default gw 10.17.103.1 dev tun0
05:17 < ashes> and now packets are using tun0 on both the client and server systems
05:18 < |Mike|> lol
05:18 < ashes> but the server isn't forwarding anything. it's really bizare
05:19 < ashes> the vpn is over wlan0. the client can't ping the eth0 ip on the server, but i see the packets getting to tun0 on the server
05:19 < ashes> sorry if i'm like jumping in half way through a conversation with myself
05:19 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has joined #openvpn
05:19 < ashes> or something
05:20 < Manny> !socksd
05:20 < Manny> !routebyapp
05:20 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
05:21 < Manny> !sockd
05:21 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
05:21 < Manny> could anybody explain me "www.ircpimps.org/sockd.conf"? What IPs do I have to insert in my local copy? tun0's? eth0's? Why are there two distinct IPs?
05:22 < Manny> to my understanding, this should be "external: tun0", and maybe "internal: 127.0.0.1 port = 1080"
05:24 <@vpnHelper> RSS Update - forum: Roadwarriors with Internet thru VPN; Branch offices w/o <http://forums.openvpn.net/topic7517.html>
05:29 < Manny> can anybody offer me a openvpn server for testing purposes? x)
05:30 < Manny> I'd just like to test whether my config files work OK
05:39 < ashes> when i get ping working, i'll let you know
05:53 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
05:57 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:58 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
05:58 < ashes> ok
05:59 -!- Cain` is now known as Cain
05:59 < ashes> if i ping the other system's vpn ip (the ip on it's tun device), should ifconfig -a show some byte traffic on the tun0 device?
06:00 -!- adawda is now known as sia^pwnnt
06:03 < ashes> getting the openvpn daemons to shake hands, and getting the two systems to ping eachother, doesn't mean the traffic is encrypted. nothing is happening on my tun devices
06:11 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
06:13 -!- skrusty [~skrusty@83.166.176.39] has quit [Ping timeout: 240 seconds]
06:19 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
06:20 < Manny> hrm I think I'll just use split tunneling, since I only need a certain IP / domain range. I'll just follow http://lists.unix-ag.uni-kl.de/pipermail/vpnc-devel/2009-February/002990.html
06:20 <@vpnHelper> Title: [vpnc-devel] Tutorial: client side split tunnel (at lists.unix-ag.uni-kl.de)
06:21 -!- krzie [~k@openvpn/community/support/krzee] has quit [Quit: Leaving]
06:25 < Manny> very nice...it seems to work like a charm
06:26 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has quit [Quit: Ex-Chat]
06:30 -!- s7r [~s7r@46.37.189.61] has joined #openvpn
06:48 -!- macsppadic is now known as Directorsppadic
06:59 -!- Coffe [~niszsse@sto.alatest.se] has joined #openvpn
07:01 < Coffe> Hi, i have 3 offices, that needs to be able to conenct , what is the recommended way of doing this. today  wan1 connects to wan2 and wan3  and wan3 connects to wan2 
07:01 < Coffe> they all have there own config. 
07:01 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
07:06 < |Mike|> make 1 the server and the rest clients?
07:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Connection reset by peer]
07:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:09 < ecrist> it's what I would do.
07:16 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:21 <@vpnHelper> RSS Update - forum: [n00b] No traffic on tun0 over LAN <http://forums.openvpn.net/topic7451.html#p9229>
07:30 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has quit [Quit: iceberg]
07:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:03 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
08:07 -!- luneff [~yury@84.51.195.188] has joined #openvpn
08:18 -!- corretico [~corretico@201.201.44.82] has quit [Remote host closed the connection]
08:18 -!- albech_ [~thomas@124.157.211.210] has quit [Quit: Ex-Chat]
08:22 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
08:23 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
08:23 -!- Cain` is now known as Cain
08:26 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:35 -!- corretiko [~corretico@190.241.62.50] has joined #openvpn
08:40 -!- WinstonSmith [~true@e178179130.adsl.alicedsl.de] has joined #openvpn
08:46 -!- Busch [b24d4e60@gateway/web/freenode/ip.178.77.78.96] has joined #openvpn
08:46 < Busch> !welcome
08:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:46 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
08:47 < Busch> Is there a chanche to use server, tun and ipv6? Is it a technical limitation?
08:51 < gladiatr> hrm...
08:51 < gladiatr> !ipv6
08:51 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
09:01 <@dazo> Busch: or grab the latest openvpn-testing/allmerged snapshot
09:01 <@dazo> gah ... it says !snapshots
09:09 < ecrist> what?
09:10 < gladiatr> exactly
09:10 < ecrist> heh
09:14 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has joined #openvpn
09:14 < Manny> hello
09:17 < ecrist> hi
09:19 < gladiatr> greetings
09:34 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:37 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has joined #openvpn
09:40 -!- dmarkey [~dmarkey@188.141.16.113] has joined #openvpn
09:40 < dmarkey> if I want to add a route command after a specific client connects, how could i do it
09:41 < renihs> me hitting road but you want to google openvpn ccd
09:42 < renihs> "client-config-dir ccd" :)
09:42 <@vpnHelper> RSS Update - forum: irouted subments on client <http://forums.openvpn.net/topic7518.html>
09:42 < dmarkey> yea i have a ccd
09:42 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:42 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:45 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:46 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
09:47 <@vpnHelper> RSS Update - forum: IP address of client still visible <http://forums.openvpn.net/topic7514.html#p9231>
09:49 -!- p3rror [~mezgani@41.140.159.203] has joined #openvpn
09:50 -!- Directorsppadic [~sonupunno@88.211.55.77] has left #openvpn []
09:53 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:54 < katoen> when using preconfigured IPs using ccd, i noticed that when a 'non-ccd' host connects, it might get an IP from any of the preconfigured ones. How could i prevent this from happening?
09:55 -!- albech [~thomas@119.42.76.198] has joined #openvpn
09:56 < gladiatr> katoen, try using a proper 'server' directive in either the global scope or in ccd/DEFAULT that specifies an appropriate address range for non-specific clients
09:57 -!- Manny [~chris@p549660BB.dip.t-dialin.net] has quit [Quit: Ex-Chat]
09:57 < katoen> gladiatr: ah i see
09:58 < gladiatr> I haven't tested that sort of configuration, myself.  You might need to monkey with it, but it sounds like you're experiencing overlap from a server directive's subnet definition and the static addresses assigned to your defined clients.
09:58 <@vpnHelper> RSS Update - forum: irouted subments on client <http://forums.openvpn.net/topic7518.html#p9232>
09:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
09:59 -!- WinstonSmith_ [~true@e177093238.adsl.alicedsl.de] has joined #openvpn
09:59 < katoen> gladiatr: i think so, too. I was looking for a way to seperate between these types of clients
10:01 < gladiatr> You might also add some data to the ifconfig-pool-persist file to reflect the static address assignments, but I'm afraid your static clients might still get stomped on if you should ever start running low on unassigned addresses
10:02 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
10:03 -!- WinstonSmith [~true@e178179130.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
10:07 -!- WinstonSmith_ is now known as WinstonSmith
10:22 -!- WinstonSmith [~true@e177093238.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
10:23 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
10:27 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Client Quit]
10:32 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
10:35 <@vpnHelper> RSS Update - forum: Tunnel low speed <http://forums.openvpn.net/topic7519.html>
10:41 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 240 seconds]
10:41 <@vpnHelper> RSS Update - forum: [n00b] No traffic on tun0 over LAN <http://forums.openvpn.net/topic7451.html#p9234>
10:49 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
10:50 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
10:51 -!- Coffe [~niszsse@sto.alatest.se] has quit [Quit: Leaving]
10:52 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:53 -!- X-Vo [Ezzie@5ED0FA69.cm-7-1d.dynamic.ziggo.nl] has quit []
10:56 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has joined #openvpn
10:57 -!- albech [~thomas@119.42.76.198] has quit [Quit: Ex-Chat]
11:03 < grendal_prime> Im seeing alot of these web based client scripts for connecting to openvpn..is there something in the ose for doing this?
11:03 < grendal_prime> like a cgi that calls openvpn locally type deal?
11:04 < grendal_prime> the paid access version has it and ive seen it on several of these anono browser type services.
11:06 < gladiatr> I am without clue on that subject
11:06 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
11:12 < grendal_prime> ok..
11:13 < grendal_prime> soooo there is a few scripts out there that can be put on a web server on the actuall openvpn server.  They allow the client two click on a link that calls this cgi script.  looks like it makes a request to a file on your local machine which then fires up openvpn client on your local machine.
11:14 < grendal_prime> you still have to config the local script..but that ..well its pretty easy to modify that i think
11:41 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
11:44 -!- Busch [b24d4e60@gateway/web/freenode/ip.178.77.78.96] has quit [Ping timeout: 265 seconds]
11:53 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Max SendQ exceeded]
11:55 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
12:00 < Dougy> i realize this is !notopenvpn.. but.. anyone with dd-wrt familiar with the openvpn init? i need to change it..  openvpn --config /tmp/openvpn/openvpn.conf --route-up /tmp/openvpn/route-up.sh --down /tmp/openvpn/route-down.sh --daemon <-- i need to edit that.. so it doesnt load the .sh scripts..
12:00 < Dougy> where does one do that
12:04 < gladiatr> are you able to get a shell on your router?
12:05 < Dougy> yeah i'm ssh'd in
12:05 < Dougy>  i'd grep -R the / but there is no -R
12:05 < gladiatr> do something like this: nvram show |grep -i openvpn
12:05 < gladiatr> Not sure, but I would imagine that's an nvram variable (somewhere)
12:06 < gladiatr> Not 100% sure on that, though
12:06 < Dougy> nothing about the scripts
12:06 < gladiatr> anything at all about openvpn?
12:06 < Dougy> plenty
12:06 < Dougy> nothing to do with init scripts, just the certs and config
12:06 < Dougy> while im here
12:06 < Dougy> !tap
12:06 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything where the
12:06 <@vpnHelper> protocol uses MAC addresses instead of IP addresses.
12:06 < Dougy> nope not useful
12:07 <@dazo> Dougy: just a heads-up as you say you're using dd-wrt ... http://www.devttys0.com/2010/12/breaking-ssl-on-embedded-devices/
12:07 <@vpnHelper> Title: /dev/ttyS0 » Blog Archive » Breaking SSL on Embedded Devices (at www.devttys0.com)
12:07 < Dougy> just need to figure out one more route as well.. so that the server can ping my home lan of 192.168.1.0/24
12:07 <@dazo> (the dd-wrt team have by the way not acknowledged this as a real problem)
12:08 < Dougy> ok, dazo, krzie trie to point me to the right pages, but i'm retarded
12:08 < Dougy> lets say i have my home router (LAN 192.168.1.0/24) connected to the server.. the router is .6 and the vpn is .1
12:08 < Dougy> what route(s) do i need to add to be able to make the vpn server ping 192.168.1.112
12:09 <@dazo> Dougy: my link was not related to your openvpn stuff ... just something you should beware of, related to the overall security on your box
12:09 < Dougy> yeeah
12:09 < Dougy> actually hold on i got an idea
12:10 <@dazo> it's a long while since I used dd-wrt ... but openvpn there uses some way of nvram to store configs, certs/keys and bootscripts
12:10 < gladiatr> sounds like perhaps you need...
12:10 < gladiatr> !iroute
12:10 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
12:10 < Dougy> nevermind
12:10 < Dougy> i had it set up right
12:10 < Dougy> i just could ssh to my router from the host node
12:10 < Dougy> vpn srver, rather
12:10 < Dougy> but ig uess now i need to figure out why icmp to nothing works
12:11 < Dougy> can ping clients -> server but not server -> clients
12:11 < Dougy> can ssh and rdp
12:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
12:13 < gladiatr> !snapshots
12:13 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
12:16 -!- dazo is now known as dazo_afk
12:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:33 -!- dollabill [~mike@199.44.8.98] has quit []
12:47 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
12:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:01 < gladiatr> Installing openvpn from source is so anticlimactic.  It isn't like installing bash or emacs or some other bloated, gnu package where you really feel like you've just trashed your filesystem if you slip up and forget to specify an alternate install prefix--with openvpn you get a binary and a man page.  C'mon dev team... that's like getting socks for christmas.  Step it up, will ya?
13:03 -!- p3rror [~mezgani@41.140.159.203] has quit [Ping timeout: 246 seconds]
13:32 < cpm> indeed
13:49 -!- virusuy [~luciano@r200-40-173-202.ae-static.anteldata.net.uy] has joined #openvpn
13:57 -!- befago [~befago@87-206-51-38.dynamic.chello.pl] has joined #openvpn
14:00 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
14:16 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:36 < reiffert> !revoke
14:36 < reiffert> !factoids search revoke
14:36 <@vpnHelper> No keys matched that query.
14:36 < reiffert> !factoids search --values revoke
14:36 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
14:36 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
14:36 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has left #openvpn []
14:37 -!- befago [~befago@87-206-51-38.dynamic.chello.pl] has quit [Quit: Wychodzi]
14:40 <@vpnHelper> RSS Update - forum: IP address of client still visible <http://forums.openvpn.net/topic7514.html#p9235>
14:41 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Quit: iceberg]
14:42 -!- corretiko is now known as coyotiko_
14:42 -!- coyotiko_ is now known as corretiko_
14:43 -!- corretiko_ is now known as corretiko__
14:43 -!- corretiko__ [~corretico@190.241.62.50] has quit [Quit: Leaving]
14:44 -!- corretiko [~corretico@190.241.62.50] has joined #openvpn
14:44 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
14:46 <@vpnHelper> RSS Update - forum: IP address of client still visible <http://forums.openvpn.net/topic7514.html#p9236>
15:01 -!- p3rror [~mezgani@41.248.190.46] has joined #openvpn
15:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
15:15 <@vpnHelper> RSS Update - forum: How to make air.zip n cer/key files?? <http://forums.openvpn.net/topic7520.html>
15:22 -!- dmarkey [~dmarkey@188.141.16.113] has quit [Read error: Connection reset by peer]
15:26 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
15:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:34 < ashes> the redirect-gateway option uses route with wlan0, instead of tun0, and IP traffic bypasses openvpn unencrypted. is this a bug? when i manually run the route command to use tun0, i use tcpdump and see traffic going out wlan0 on the openvpn port, and i see it arriving on the server through the tun0 device, but the server doesn't seem to route it... an otherwise functioning NAT doesn't route this traffic (iptables is passing and forwar
15:34 < ashes> i even see the ping attempts go out the external device of the server. it looks like the server doesn't know how to route the replies back
15:35 < gladiatr> what option are you using with the redirect-gateway directive?
15:38 < ashes> route gateway 10.17.103.1
15:38 < ashes> i don't think i used an option with redirect-gateway
15:39 < ashes> but i probably tried using def1
15:41 < gladiatr> !pastebin
15:41 < gladiatr> !paste
15:42 < gladiatr> dammit.
15:42 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
15:42 <@vpnHelper> Unable to download feed.
15:42 < gladiatr> Let's see the log file from your client connection
15:42 < gladiatr> as well as the output of netstat -rn (after the connection)
15:42  * gladiatr turns vpnHelper's crank a few more times
15:43 -!- qermit [~qermit@unaffiliated/pantofel] has joined #openvpn
15:44 < qermit> !pptp
15:44 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read about
15:44 <@vpnHelper> why to not use pptp
15:44 <@vpnHelper> RSS Update - forum: How to make air.zip n cer/key files?? <http://forums.openvpn.net/topic7520.html#p9238>
15:44 -!- qermit [~qermit@unaffiliated/pantofel] has left #openvpn ["No Route To host, probably drunken"]
15:47 -!- grishnav [~grishnav@209.160.52.134] has quit [Ping timeout: 240 seconds]
15:50 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
15:50 <@vpnHelper> RSS Update - forum: Management localhost 7505 <http://forums.openvpn.net/topic7516.html#p9240> || Roadwarriors with Internet thru VPN; Branch offices w/o <http://forums.openvpn.net/topic7517.html#p9239>
15:52 -!- corretiko [~corretico@190.241.62.50] has quit [Ping timeout: 260 seconds]
15:53 < ashes> http://pastebin.com/909FRvNs
15:54 < ashes> http://pastebin.com/YTHsQ555
16:01 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has joined #openvpn
16:02 -!- grishnav [~grishnav@209.160.52.134] has joined #openvpn
16:06 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 276 seconds]
16:15 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
16:18 -!- virusuy [~luciano@r200-40-173-202.ae-static.anteldata.net.uy] has quit [Ping timeout: 240 seconds]
16:21 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
16:34 < reiffert> I've got an openvpn issue
16:34 < reiffert> Jan 14 23:48:10 datenserver openvpn[11557]: daemon() failed: No such device (errno=19)
16:35 < reiffert> wtf?
16:35 -!- teddz [~teddz@dtmd-4d0bc9f5.pool.mediaWays.net] has joined #openvpn
16:35 < reiffert> it worked bevor I ran service restart
16:35 < reiffert> anyone?
16:44 < reiffert> solution: /dev/null was a file, not a special char device.
16:46 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 240 seconds]
16:47 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:48 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has quit [Quit: Ex-Chat]
16:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
17:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:37 -!- olivier__ [~olivier@86.67.97.202] has joined #openvpn
17:37 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
17:38 < olivier__> Hi There
17:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:48 -!- WinstonSmith [~true@e177093238.adsl.alicedsl.de] has joined #openvpn
17:56 < olivier__> I do not use openvpn but I do have troubles with a dlink firewall as a vpn server. I don't know where to ask for help. The problem is I can connect from home, I am given a IP address from the remote lan, can ping the remote IP adresses, but I cant see the smb hosts nor access the web services, name resolving isnt working. I guess there's something wrong with the ip filtering rules but I don't have a clue :s
18:08 < s7r> anybody knows, if I connect on firefox via a socks 5 server, will that traffic (through the socks server) be encrypted?
18:08 < s7r> socks v5 provide encryption?
18:22 < olivier__> Does some one know another channel where I could find help for my VPN problem ? Network related chan ?
18:22 < reiffert> I'd call the dlink support.
18:24 < olivier__> reiffert: Already done, already followed all their steps, had my configuration checked by their level 2 hotline, and it was ok for them... :s
18:25 < reiffert> so why still looking at that dlink box?
18:30 < Dougy> does openvpn drop icmp? i dont get it
18:30 < olivier__> reiffert: because whatever client or outside connection I use for the test, it's the same problem. I'm sure they're still something wrong in the dlink settings. After all, their howto did'nt mention that the IP rules ordering in their web gui was important. I had that fixed, but it's still not ok.
18:30 < Dougy> i have it setup.. properly.. can ping 10.5.5.6 (router's (client) ip) and 10.5.5.1.. and stuff
18:30 < Dougy> and then from the server i can ssh to 192.168.1.1 (router's LAN IP) and rdp to .112 (my pc)
18:30 < Dougy> but no imcp
18:30 < Dougy> icmp
18:32 -!- WinstonSmith [~true@e177093238.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
18:32 <@vpnHelper> RSS Update - forum: Management localhost 7505 <http://forums.openvpn.net/topic7516.html#p9241>
18:39 < reiffert> olivier__: want me to test from here?
18:40 < olivier__> reiffert: sure I'd like to ! let me add a login for you
18:40 < reiffert> olivier__: what kind of vpn is it? ipsec, pptp, xx?
18:40 -!- holistah [~ryan@108-66-219-113.uvs.irvnca.sbcglobal.net] has joined #openvpn
18:41 < olivier__> reiffert: pptp
18:41 < reiffert> great, my OS X can handle it.
18:42 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
18:45 < olivier__> reiffert: I pm you the credentials ok ?
18:45 < reiffert> k
18:49 < holistah> I currently have a westcoast subnet 10.136, an eastcoast subnet 10.168, permenant VPN tunnel between the 2, and roaming VPNs on subnet 10.169 via the 10.168 router... if I added roaming VPNs to the 10.136 router as subnet 10.137, would someone be able to simultaneously connect to both east and west roaming VPNs, and then have packets take a direct route to their respective subnets instead of travelling over the permalink? I shouldn'
19:07 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Operation timed out]
19:07 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
19:08 < reiffert> for anyone intrested in dlink routers: the dlink router doesnt provider a nameserver which is why the stuff fails.
19:08 < reiffert> as of now. but we are digging deeper
19:29 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
19:41 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
19:42 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
19:44 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
19:45 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
19:46 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Client Quit]
20:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
20:10 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Read error: Operation timed out]
20:11 -!- olivier__ [~olivier@86.67.97.202] has quit [Quit: Ex-Chat]
20:21 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
20:23 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
20:29 < ashes> my openvpn client never configures itself to use tun0 with routing. it uses wlan0 directly, and bypasses openvpn
20:45 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9242>
21:01 -!- corretico [~corretico@201.201.44.82] has quit [Ping timeout: 276 seconds]
21:03 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
21:09 -!- s7r [~s7r@46.37.189.61] has left #openvpn []
21:12 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
21:14 -!- corretico [~corretico@201.201.44.82] has quit [Read error: Connection reset by peer]
21:21 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
21:23 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
21:27 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
21:38 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
21:38 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 272 seconds]
21:43 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9243>
21:59 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
22:00 -!- teddz_ [~teddz@dtmd-4db2e337.pool.mediaWays.net] has joined #openvpn
22:04 -!- teddz [~teddz@dtmd-4d0bc9f5.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:20 < Bushmills> !winroute
22:20 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin
22:20 < Bushmills> ashes: ^^^
23:03 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
23:11 < ashes> i was using the same ip for tun0 and wlan0
--- Day changed Sat Jan 15 2011
00:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
00:59 -!- teddz_ [~teddz@dtmd-4db2e337.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
01:07 -!- krzee [~k@ftp.secure-computing.net] has joined #openvpn
01:07 -!- krzee [~k@ftp.secure-computing.net] has quit [Changing host]
01:07 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
01:11 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
01:24 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
01:36 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
01:41 -!- djgerm1 [~Your_Moms@64-60-122-187.static-ip.telepacific.net] has joined #openvpn
01:43 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 240 seconds]
01:45 -!- djgerm1 [~Your_Moms@64-60-122-187.static-ip.telepacific.net] has quit [Ping timeout: 260 seconds]
02:02 <@vpnHelper> RSS Update - forum: How to make air.zip n cer/key files?? <http://forums.openvpn.net/topic7520.html#p9244>
02:12 -!- djgerm [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
02:12 -!- albech [~thomas@119.42.77.66] has joined #openvpn
02:31 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:41 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
03:45 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
03:48 -!- master_of_master [~master_of@p57B55C08.dip.t-dialin.net] has quit [Read error: Operation timed out]
03:51 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:52 -!- master_of_master [~master_of@p57B55533.dip.t-dialin.net] has joined #openvpn
04:03 -!- venom00 [~wer@unaffiliated/venom00] has joined #openvpn
04:05 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
04:16 -!- venom00 [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
04:20 <@vpnHelper> RSS Update - forum: Layer 2 Problem (Layer 3 works) <http://forums.openvpn.net/topic7521.html>
04:24 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
04:26 <@vpnHelper> RSS Update - forum: Layer 2 Problem (Layer 3 works) <http://forums.openvpn.net/topic7521.html#p9246>
04:39 -!- WinstonSmith [~true@g225027196.adsl.alicedsl.de] has joined #openvpn
04:42 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
04:43 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
04:44 -!- common- [~common@p5DDA4378.dip0.t-ipconnect.de] has joined #openvpn
04:44 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9247>
04:45 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
04:45 -!- common [~common@p5DDA484E.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
04:45 -!- common- is now known as common
04:51 <@vpnHelper> RSS Update - forum: Temporary disable client access <http://forums.openvpn.net/topic7522.html>
04:58 -!- venom00ut [~vsG@unaffiliated/venom00] has joined #openvpn
05:12 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
05:15 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 246 seconds]
05:15 -!- Malard [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
05:15 -!- Malard [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
05:15 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
05:17 -!- venom00 [~vsG@unaffiliated/venom00] has joined #openvpn
05:18 -!- Malard|Home [~ident@xbmc/staff/malard] has quit [Ping timeout: 264 seconds]
05:19 -!- venom00ut [~vsG@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
05:20 -!- venom00ut [~vsG@unaffiliated/venom00] has joined #openvpn
05:21 -!- krzie [~k@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
05:22 -!- venom00 [~vsG@unaffiliated/venom00] has quit [Ping timeout: 265 seconds]
05:48 -!- elHannios [~Hannos@82.113.121.196] has joined #openvpn
05:50 < elHannios> Howdy! Is the --mktun parameter creating tap or tun devices? In the ethernet bridging howto it creates a tap device, which is a whole differnet to a tun link device, imho?!
05:54 < elHannios> Or is the operation dependent on the argument of the --mktun parameter?
05:56 < elHannios> !welcome
05:56 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:57 < elHannios> !goal
05:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:57 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:57 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
05:58 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
05:59 -!- Cain` is now known as Cain
06:10 < elHannios> Hmm, I really can't find an answer. Can someone explain?
06:28 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
06:47 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:53 -!- tntcoda [58612e73@gateway/web/freenode/ip.88.97.46.115] has joined #openvpn
06:53 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has quit [Read error: Connection reset by peer]
06:53 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has joined #openvpn
06:59 < tntcoda> Hi, I've set up openvpn using a tap interface, and connected a client to it. This set up a client tap device running on 192.168.1.80. But im not sure how do I actually connect to hosts on the other network over the vpn? i.e 192.168.1.40 on the second network, I assumed when i ping that it would be auto routed through the tap, but it's not. Anyone point me in the right direction? The route is defined to route 192.168.1.0 to the tap in
07:43 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
07:46 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:53 <@vpnHelper> RSS Update - forum: Machine behind client cannot access service on vpn server <http://forums.openvpn.net/topic7523.html>
07:58 -!- teddz_ [~teddz@dtmd-4db2e337.pool.mediaWays.net] has joined #openvpn
08:06 -!- elHannios [~Hannos@82.113.121.196] has quit [Ping timeout: 240 seconds]
08:07 < Bushmills> !tunortap
08:07 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
08:07 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
08:07 -!- elHannios [~Hannos@82.113.121.201] has joined #openvpn
08:07 < Bushmills> !route
08:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
08:07 < Bushmills> !redirect
08:07 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
08:08 < Bushmills> tntcoda: ^^^
08:16 < tntcoda> ok thanks Bushmills, i think it might be because both my lans are 192.168.1.x
08:20 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
08:28 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
08:29 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
08:32 -!- raidzxx [~Andrew@seance.openvpn.org] has quit [Ping timeout: 240 seconds]
08:32 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
08:40 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
08:40 -!- venom00ut [~vsG@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
08:41 -!- gisikon [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
08:41 < gisikon> hi
08:41 < gisikon> any docs regarding plugin development?
08:46 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has quit [Ping timeout: 260 seconds]
08:47 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has joined #openvpn
08:50 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
08:53 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has quit [Ping timeout: 260 seconds]
08:54 -!- tntcoda [58612e73@gateway/web/freenode/ip.88.97.46.115] has quit [Quit: Page closed]
08:54 -!- WinstonSmith [~true@g225027196.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
08:54 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
08:58 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
08:59 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has joined #openvpn
09:06 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
09:10 -!- venom00ut [~vsG@unaffiliated/venom00] has joined #openvpn
09:12 -!- venom00 [~vsG@unaffiliated/venom00] has joined #openvpn
09:14 -!- elHannios [~Hannos@82.113.121.201] has left #openvpn ["Verlassend"]
09:15 -!- venom00ut [~vsG@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
09:17 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
09:26 -!- WinstonSmith [~true@g225027196.adsl.alicedsl.de] has joined #openvpn
09:32 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
09:43 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
09:53 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
10:04 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
10:13 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
10:18 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
10:18 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
10:18 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:19 -!- albech [~thomas@119.42.77.66] has quit [Quit: Ex-Chat]
10:19 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Remote host closed the connection]
10:23 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
10:27 < gisikon> any way to figure out how many computing power i need for $speed_throughput?
10:29 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 260 seconds]
10:31 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
10:40 -!- p3rror [~mezgani@41.248.190.46] has quit [Ping timeout: 276 seconds]
10:42 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
10:46 -!- teddz_ [~teddz@dtmd-4db2e337.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
10:51 -!- WinstonSmith [~true@g225027196.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
10:51 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
10:52 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
10:56 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
10:56 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
10:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:18 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
11:28 -!- WinstonSmith [~true@g225027196.adsl.alicedsl.de] has joined #openvpn
11:28 -!- djgerm [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving.]
11:31 -!- gisikon [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Connection reset by peer]
11:32 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
11:41 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
11:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 272 seconds]
11:44 -!- p3rror [~mezgani@41.140.183.104] has joined #openvpn
11:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:14 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 272 seconds]
12:20 -!- corretico [~corretico@201.201.44.82] has quit [Remote host closed the connection]
12:21 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
12:22 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:23 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
12:32 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
12:55 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
12:59 -!- gregd [~gregd@cpc3-sgyl29-2-0-cust457.sgyl.cable.virginmedia.com] has joined #openvpn
12:59 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Client Quit]
13:00 < gregd> guys, is it possible to configure openvpn server so it does allocate addresses to the clients from its network's dhcp server?
13:11 -!- venom00 [~vsG@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
13:12 -!- venom00 [~asdfds@unaffiliated/venom00] has joined #openvpn
13:13 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
13:19 -!- gregd [~gregd@cpc3-sgyl29-2-0-cust457.sgyl.cable.virginmedia.com] has quit [Quit: gregd]
13:21 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
13:22 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
13:25 -!- jambooda1 [~cog@pool-98-109-218-165.nwrknj.fios.verizon.net] has joined #openvpn
13:26 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 240 seconds]
13:28 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
13:29 -!- jambooda1 [~cog@pool-98-109-218-165.nwrknj.fios.verizon.net] has quit [Ping timeout: 240 seconds]
13:33 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Client Quit]
13:37 -!- jfkw [~jtk@12.193.26.194] has joined #openvpn
13:51 -!- gregd [~gregd@cpc3-sgyl29-2-0-cust457.sgyl.cable.virginmedia.com] has joined #openvpn
13:56 -!- lmns972 [~lmns972@cac94-8-82-245-26-103.fbx.proxad.net] has joined #openvpn
13:57 < lmns972> !welcome
13:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:58 < lmns972> !topology
13:58 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
13:59 -!- iceberg_ [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has joined #openvpn
13:59 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has quit [Read error: Connection reset by peer]
13:59 -!- iceberg_ is now known as iceberg
14:02 < lmns972> !sample
14:02 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:16 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:19 -!- iceberg_ [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has joined #openvpn
14:19 -!- iceberg [~iceberg@cpe-24-166-7-47.indy.res.rr.com] has quit [Read error: Connection reset by peer]
14:19 -!- iceberg_ is now known as iceberg
14:36 <@vpnHelper> RSS Update - forum: Client config works on one machine but not another <http://forums.openvpn.net/topic7524.html>
14:39 -!- common- [~common@p5DDA4378.dip0.t-ipconnect.de] has joined #openvpn
14:39 -!- corretico_ [~corretico@201.201.44.82] has joined #openvpn
14:40 -!- grishnav_ [~grishnav@209.160.52.134] has joined #openvpn
14:41 -!- mezgani_ [~mezgani@41.140.183.104] has joined #openvpn
14:42 -!- Some-body_ [~Vetinari@delta.cluenet.org] has joined #openvpn
14:42 -!- batrick_ [~batrick@nmap/developer/batrick] has joined #openvpn
14:43 -!- juhovh_ [~jvahaher@kekkonen.cs.hut.fi] has joined #openvpn
14:44 -!- irssi____ [~irssi@devastation.securewebs.net] has joined #openvpn
14:47 -!- Netsplit *.net <-> *.split quits: p3rror, dictvm, iceberg, juhovh, corretico, common, DarthGandalf, grishnav, gregd, oc80z,  (+1 more, use /NETSPLIT to show all of them)
14:48 -!- common- is now known as common
14:48 -!- mezgani_ [~mezgani@41.140.183.104] has quit [Ping timeout: 276 seconds]
14:51 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
14:52 -!- Some-body_ is now known as DarthGandalf
14:52 -!- DarthGandalf [~Vetinari@delta.cluenet.org] has quit [Changing host]
14:52 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
14:57 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
14:58 -!- Netsplit over, joins: oc80z
14:58 -!- Cain` is now known as Cain
14:59 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
15:01 -!- corretico_ [~corretico@201.201.44.82] has quit [Quit: Leaving]
15:02 -!- corretico [~corretico@201.201.44.82] has joined #openvpn
15:04 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
15:06 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
15:06 -!- mode/#openvpn [+o vpnHelper] by ChanServ
15:06 -!- caesay_ [~caesay@173.236.15.70] has joined #openvpn
15:07 -!- caesay [~caesay@unvanquished/associate/sniperx] has quit [Ping timeout: 264 seconds]
15:09 -!- corretiko [~corretico@201.201.44.82] has joined #openvpn
15:15 -!- grishnav_ [~grishnav@209.160.52.134] has quit [Quit: leaving]
15:15 -!- grishnav [~grishnav@209.160.52.134] has joined #openvpn
15:18 -!- p3rror [~mezgani@41.140.156.95] has joined #openvpn
15:21 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
15:22 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
15:22 -!- mode/#openvpn [+o mattock] by ChanServ
15:27 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Read error: Connection reset by peer]
15:30 -!- p3rror [~mezgani@41.140.156.95] has quit [Ping timeout: 240 seconds]
15:34 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
15:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:41 -!- p3rror [~mezgani@41.140.38.249] has joined #openvpn
15:50 -!- lmns972 [~lmns972@cac94-8-82-245-26-103.fbx.proxad.net] has quit [Quit: Bye bye]
16:06 -!- WinstonSmith [~true@g225027196.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
16:17 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
16:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:27 -!- siralex [~siralex@87-194-183-38.bethere.co.uk] has joined #openvpn
16:28 < siralex> Hi - How do I set up my openvpn server to allow access to 10.98.76.101 to my clients?
16:28 < siralex> I'm pushing a route 10.98.76.101 255.255.255.255 but no matter what I add or change I can't oing 10.98.76.101 from my laptop, but I can ping the gateway 10.98.76.66
16:30 < siralex> push "route 10.98.76.101 255.255.255.255"
16:30 -!- WinstonSmith [~true@g225027196.adsl.alicedsl.de] has joined #openvpn
16:30 < siralex> Or is there a way of allowing access to 192.168.1.101 over the vpn, though the clients network is 192.168.1.* also
16:32 -!- siralex [~siralex@87-194-183-38.bethere.co.uk] has quit [Client Quit]
16:32 -!- siralex [~siralex@87-194-183-38.bethere.co.uk] has joined #openvpn
16:33 -!- dmarkey [~dmarkey@188.141.16.113] has joined #openvpn
16:33 < dmarkey> does openvpn support a class A range being an iroute?
16:34 < dmarkey> i.e. 10.0.0.0 255.0.0.0
16:39 -!- siralex [~siralex@87-194-183-38.bethere.co.uk] has quit [Quit: Lost terminal]
17:15 -!- djgerm [~Your_Moms@c-67-169-142-196.hsd1.ca.comcast.net] has joined #openvpn
17:32 -!- WinstonSmith [~true@g225027196.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
17:44 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
18:03 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 240 seconds]
18:12 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
18:12 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
19:10 -!- p3rror [~mezgani@41.140.38.249] has quit [Ping timeout: 240 seconds]
19:20 < reiffert> moin
19:22 -!- p3rror [~mezgani@41.140.41.130] has joined #openvpn
19:57 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
19:58 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
20:01 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has quit [Client Quit]
20:02 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
20:03 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
20:30 < ecrist> moin
20:30 < reiffert> moin ecrist
20:30 < ecrist> dmarkey: in routed, no
20:30 < reiffert> wssup?
20:31 < ecrist> in bridged, openvpn knows nothing of IP classes
20:31 < ecrist> nm.  sick, so wife hasn't let me do any of the things that I needed to do today
20:32 < reiffert> tell her that it is very importand to do, maybe then she is feeling good when she keeps you from doing things :)
20:33 < ecrist> heh
20:44 -!- p3rror [~mezgani@41.140.41.130] has quit [Ping timeout: 240 seconds]
20:56 -!- p3rror [~mezgani@41.140.44.147] has joined #openvpn
21:10 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
21:11 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
21:23 -!- mezgani_ [~mezgani@41.140.25.117] has joined #openvpn
21:25 -!- p3rror [~mezgani@41.140.44.147] has quit [Ping timeout: 240 seconds]
21:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
21:31 -!- mezgani__ [~mezgani@41.140.38.150] has joined #openvpn
21:33 -!- mezgani_ [~mezgani@41.140.25.117] has quit [Ping timeout: 240 seconds]
21:33 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
21:35 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
21:37 -!- venom00 [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 272 seconds]
21:38 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
21:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
22:01 -!- teddz_ [~teddz@dtmd-4db2aea2.pool.mediaWays.net] has joined #openvpn
22:42 -!- teddz_ [~teddz@dtmd-4db2aea2.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
22:42 -!- teddz_ [~teddz@dtmd-4db2aea2.pool.mediaWays.net] has joined #openvpn
23:48 -!- teddz_ [~teddz@dtmd-4db2aea2.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
23:50 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 246 seconds]
--- Day changed Sun Jan 16 2011
00:08 -!- djgerm [~Your_Moms@c-67-169-142-196.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
00:15 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
00:16 -!- n0de_ [~n0de@2001:41d0:1:7151::1] has joined #openvpn
00:17 -!- n0de_ [~n0de@2001:41d0:1:7151::1] has quit [Client Quit]
00:19 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has joined #openvpn
00:22 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has quit [Client Quit]
00:24 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has joined #openvpn
00:31 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has quit [Quit: d3cyfer]
00:33 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has joined #openvpn
00:36 -!- flopsplat [634679f2@gateway/web/freenode/ip.99.70.121.242] has joined #openvpn
00:37 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has left #openvpn []
00:37 < flopsplat> is this the place for tunnelblick help?
00:54 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has joined #openvpn
00:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
00:58 -!- jfkw [~jtk@12.193.26.194] has quit [Quit: leaving]
00:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
01:01 -!- flopsplat [634679f2@gateway/web/freenode/ip.99.70.121.242] has quit [Ping timeout: 265 seconds]
01:50 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
02:01 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has quit [Ping timeout: 240 seconds]
02:15 -!- andrey___ [~chatzilla@95.73.216.247] has joined #openvpn
02:16 -!- andrey___ [~chatzilla@95.73.216.247] has quit [Client Quit]
02:34 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
03:04 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:51 -!- master_of_master [~master_of@p57B55533.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
03:53 -!- master_of_master [~master_of@p57B53308.dip.t-dialin.net] has joined #openvpn
04:00 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p9251>
04:36 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
04:41 < hyper_ch> ecrist: howdy
04:45 -!- common- [~common@p5DDA4BF7.dip0.t-ipconnect.de] has joined #openvpn
04:47 -!- common [~common@p5DDA4378.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
04:47 -!- common- is now known as common
04:59 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
05:00 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
05:42 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
05:58 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:59 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
05:59 -!- Cain` is now known as Cain
06:11 <@vpnHelper> RSS Update - forum: Server certificate expired. how to renew? <http://forums.openvpn.net/topic7525.html>
06:11 -!- Huza [~kvirc@gw-agrowest-liga-stud-ar119.dnttm.ro] has joined #openvpn
06:52 < Huza> Hello to all.
06:53 < Huza> I am trying to build a tunnel in order to configure a 2nd site to have ipv6. I found one tutorial over the web, but in here I see there are some openvpn specific variables like: ifconfig_pool_remote_ip
06:53 < Huza> But when I do a $ifconfig_pool_remote_ip on my machine, this variable is empty.
06:59 < Huza> ^ echo $ifconfig_pool_remote_ip
07:16 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
07:17 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
07:17 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
07:17 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has quit [Remote host closed the connection]
07:19 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
07:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
07:45 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has joined #openvpn
07:45 -!- pyther [~pyther@adsl-99-155-90-130.dsl.bcvloh.sbcglobal.net] has quit [Changing host]
07:45 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
07:54 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
07:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:00 < ecrist> sup d00dz?
08:01 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
08:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
08:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:13 < Bushmills> Huza: did you just type that in, interactively
08:13 < Huza> Yes.
08:13 < Bushmills> use it in an event script
08:14 < Huza> Hmm... so the variable is set by an event? I already have 1 client connected.
08:14 < Huza> And I can not get it's IP address using that method.
08:14 < Bushmills> --up or --client-connect are places to hook such a script in
08:14 -!- teddz_ [~teddz@dtmd-4db2aea2.pool.mediaWays.net] has joined #openvpn
08:15 < Huza> Thank you... I was lost, could not understand why I can not get any value for those variables.
08:43 -!- exa [~exa@x.factor.cc] has joined #openvpn
08:46 -!- s7r [~s7r@41.221.41.90] has joined #openvpn
09:00 -!- Huza [~kvirc@gw-agrowest-liga-stud-ar119.dnttm.ro] has quit [Quit: Bye bye!]
09:16 -!- WinstonSmith_ [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
09:16 -!- WinstonSmith_ [~true@e177088174.adsl.alicedsl.de] has quit [Remote host closed the connection]
09:23 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
09:23 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
09:23 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Client Quit]
09:32 -!- albech [~thomas@119.42.78.39] has joined #openvpn
09:34 -!- lmns972 [~lmns972@cac94-8-82-245-26-103.fbx.proxad.net] has joined #openvpn
09:34 -!- teddz_ [~teddz@dtmd-4db2aea2.pool.mediaWays.net] has quit [Quit: Ex-Chat]
09:34 < lmns972> !welcome
09:34 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:34 < lmns972> !wiki
09:34 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN, or (#2) Official wiki is at https://community.openvpn.net/openvpn/wiki
09:35 < lmns972> !sample
09:35 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
09:49 -!- mezgani__ [~mezgani@41.140.38.150] has quit [Read error: Connection reset by peer]
09:54 -!- DelphiWorld [~VoIpGuy@41.200.12.192] has joined #openvpn
09:55 < DelphiWorld> vpnHelper: help
09:55 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
09:55 < DelphiWorld> vpnHelper: openvpn
09:55 < DelphiWorld> can someone help me set up my openvpn server please!
10:04 < ecrist> !howto
10:04 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
10:04 -!- mezgani__ [~mezgani@41.140.169.222] has joined #openvpn
10:04 < ecrist> see /topic
10:06 -!- WinstonSmith_ [~true@e177088174.adsl.alicedsl.de] has joined #openvpn
10:06 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
10:09 -!- WinstonSmith_ [~true@e177088174.adsl.alicedsl.de] has quit [Remote host closed the connection]
10:18 -!- albech [~thomas@119.42.78.39] has quit [Quit: Ex-Chat]
10:24 < DelphiWorld> hey ecrist
10:27 < DelphiWorld> !help
10:27 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
10:30 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
10:30 < dvl> sitting at the GF's house, wishing the laptop had openvpn on it... 
10:30 < DelphiWorld> dvl: lol multiple gf's?
10:31 < dvl> DelphiWorld: valid point.  ;)
10:31 < DelphiWorld> dvl: :D
10:31 < dvl> Then I see I'm runing 2.1.1 and 2.1.4 is in the FreeBSD tree.... so I might as well upgrade that.  I have an hour or so to kill
10:32 -!- teddz [~teddz@dtmd-4db2aea2.pool.mediaWays.net] has joined #openvpn
10:34 < dvl> I'm just thinking that with OpenVPN on the laptop, the backup is easier.
10:34 < dvl> Perhaps I'll upgrade one of the clients first... see how that goes before hitting the server.
10:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:36 < DelphiWorld> yo yo [intra]lanman
10:37 < [intra]lanman> you're a yo yo
10:38 < DelphiWorld> [intra]lanman: :P
10:43 < dvl> Well, one client effortlessly upgraded.  On to the next.
10:44 < ecrist> dvl: 2.2-beta5 is stable
10:44 < ecrist> we're looking at an RC probably this week.
10:44 < dvl> ecrist: hello, LNTS.
10:44 < ecrist> LNTS?
10:44 < dvl> LTNS
10:44 < ecrist> oh
10:44 < ecrist> duh
10:44 < ecrist> ditto
10:45 < dvl> ecrist: Well, the FreeBSD tree has 2.1.4....
10:45 < ecrist> openvpn-devel has 2.2-beta5
10:45  * ecrist points to MAINTAINER
10:45 < ecrist> ;)
10:45 < dvl> I thought that'd been removed.
10:45 < ecrist> sorry, openvpn-beta has 2.2-beta5
10:45 < dvl> Nope, it's still there.
10:45 < ecrist> openvpn-devel has a weekly snapshot
10:46 < ecrist> it was removed, I started it back up about 8 months ago when we actually started doing development again.
10:46 < dvl> nice way to do it.
10:46 < ecrist> mathias still does the release port, I handle the two dev ports
10:46 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html>
10:49 -!- s7r [~s7r@41.221.41.90] has left #openvpn []
10:56 < dvl> That's all the clients upgraded.  I am now taking bets on a seamless server upgrade...  Do I hear $10?
10:56 < ecrist> no reason the server shouldn't upgrade smoothly
10:57 < ecrist> really, we're betting on your ability, not the software. ;)
10:59 < dvl> cd /usr/local/etc
10:59 < dvl> cp -rp openvpn openvpn.2.1.1
11:00 < dvl> portsnap fetch update
11:00 < dvl> portupgrade openvpn
11:00 < dvl> /usr/local/etc/rc.d/openvpn restart
11:07 < dvl> done.  thank you.
11:10 < ecrist> np
11:20 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
11:22 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 255 seconds]
11:23 -!- Malard|Home is now known as Malard
11:23 -!- irssi____ [~irssi@devastation.securewebs.net] has quit [Ping timeout: 276 seconds]
11:24 -!- irssi____ [~irssi@devastation.securewebs.net] has joined #openvpn
11:25 -!- mezgani__ is now known as p3rror
11:25 < DelphiWorld> lol p3rror
11:25 -!- DelphiWorld [~VoIpGuy@41.200.12.192] has left #openvpn ["I'm a happy Miranda IM user! Get it here: http://miranda-im.org"]
11:42 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
11:51 -!- p3rror [~mezgani@41.140.169.222] has quit [Ping timeout: 240 seconds]
11:57 -!- lmns972 [~lmns972@cac94-8-82-245-26-103.fbx.proxad.net] has quit [Quit: Bye bye]
11:58 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
12:16 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
12:51 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
12:51 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Operation timed out]
12:52 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
12:55 -!- p3rror [~mezgani@41.140.182.100] has joined #openvpn
12:57 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 255 seconds]
13:03 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
13:09 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Read error: Operation timed out]
13:10 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
13:18 <@vpnHelper> RSS Update - forum: ifconfig question <http://forums.openvpn.net/topic7527.html>
13:27 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
13:38 -!- Kurogane [~kuro@190.87.80.64] has joined #openvpn
13:50 -!- s7r [~s7r@41.221.41.90] has joined #openvpn
13:51 < s7r> hello. i want to connect to my openvpn server through a http proxy or socks5 .. the question is will the traffic be encrypted between my computer and the vpn server, or between the socls/proxy server and vpn server?
13:59 < Bushmills> between vpn client and vpn server
14:00 < s7r> it encrypts end to end ?
14:00 < s7r> aren't the packets sent from the socks server?
14:00 < s7r> i thought when i connect via proxy 
14:00 < s7r> the vpn server does not know my original IP
14:00 < s7r> how come it encrypts the traffic between the server and me, if i go over proxy?
14:01 < Bushmills> because the vpn is a tunnel between client and server
14:01 < Bushmills> what is between, including proxies, see the encrypted stream only
14:02 < s7r> but the VPN server will NOT see my actual IP address, if I connect to it via proxy right ?
14:02 < Bushmills> it will see one actual address, namely the vpn subnet address which the server has assigned to the clinet
14:02 < Bushmills> client
14:02 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
14:03 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 265 seconds]
14:06 < s7r> the server can't see from what IP i connect
14:06 < s7r> ?
14:08 -!- sia^pwnnt is now known as adawda
14:13 < Bushmills> it could if it wanted to
14:17 < s7r> yes and if it is wanted to see it, and i connect to that server via proxy
14:17 < s7r> will it see my ip or the proxy ip
14:19 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 272 seconds]
14:19 < Bushmills> http proxies pass, or can pass, the ip address of the requesting interface onwards.  
14:20 < s7r> and in case it doesn't pass ? it's an anonymous one
14:20 < Bushmills> if you are behind a proxy now, try http://scarydevilmonastery.net/myip.cgi and look at HTTP_X_FORWARDED_FOR
14:20 < s7r> the server won't see my real ip but it will be able to encrypt the connection between my computer and server?
14:23 < Bushmills> for a https connection between a web browser and a web server, going through a http proxy, applies the same: end to end encryption
14:23 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
14:32 -!- Huza [~kvirc@gw-agrowest-liga-stud-ar119.dnttm.ro] has joined #openvpn
14:34 -!- DelphiWorld [~VoIpGuy@41.200.22.50] has joined #openvpn
14:34 < DelphiWorld> hey back :P
14:34 < DelphiWorld> i have openvpn in centOs
14:35 < DelphiWorld> my vpn network cidr is 172.16.0.0/24
14:35 < DelphiWorld> in my client i see the default gateway is 172.16.0.5 while my server is 172.16.0.1
14:35 < DelphiWorld> how come?
14:35 -!- me345 [~me345@adsl-75-15-187-76.dsl.bkfd14.sbcglobal.net] has joined #openvpn
14:37 < DelphiWorld> !tun
14:37 < DelphiWorld> !tap
14:37 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything where
14:37 <@vpnHelper> the protocol uses MAC addresses instead of IP addresses.
14:38 -!- Malard [~ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
14:38 -!- Malard [~ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
14:38 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
14:38 -!- p3rror [~mezgani@41.140.182.100] has quit [Ping timeout: 240 seconds]
14:41 < DelphiWorld> !tun
14:42 -!- Lenhix|AfK [ElChaman@190.156.59.24] has joined #openvpn
14:51 -!- p3rror [~mezgani@41.248.190.60] has joined #openvpn
14:51 -!- s7r [~s7r@41.221.41.90] has left #openvpn []
14:54 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
14:55 -!- DelphiWorld_ [~VoIpGuy@41.200.5.200] has joined #openvpn
14:57 -!- DelphiWorld [~VoIpGuy@41.200.22.50] has quit [Ping timeout: 240 seconds]
15:13 -!- Luddhaa [~lud@90-230-114-135-no34.tbcn.telia.com] has joined #openvpn
15:13 < Luddhaa> hello
15:13 < Luddhaa> woho, there was a openvpn channel
15:13 < Luddhaa> ive been trying for two days to get openvpn working on windows 7 x64 with pfsense 1.2 as server
15:14 < Luddhaa> what is there to do about "TLS handshake failed2?
15:14 < Luddhaa> "
15:15 < Bushmills> !firewall
15:15 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
15:16 < Luddhaa> after connecting the client log file doesnt complain very much, its the server log file that complains
15:16 < Luddhaa> and since its pfsense i dont need to do anything in NAT to access the server
15:17 -!- DelphiWorld_ is now known as DelphiWorld
15:18 <@vpnHelper> RSS Update - forum: DD-WRT client, Ubuntu 10.04 LTS as server <http://forums.openvpn.net/topic7528.html>
15:26 -!- corretico [~corretico@201.201.44.82] has quit [Quit: Leaving]
15:28 -!- batrick_ is now known as batrick
15:28 -!- Luddhaa [~lud@90-230-114-135-no34.tbcn.telia.com] has quit []
15:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
15:38 -!- corretiko [~corretico@201.201.44.82] has quit [Quit: Leaving]
15:44 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
15:56 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
15:56 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Remote host closed the connection]
15:57 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
15:57 -!- adawda is now known as sia^pwnnt
16:03 < Rienzilla> hmm
16:03 < Rienzilla> what did I break when ping returns a ttl exceeded?
16:05 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
16:08 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Ping timeout: 241 seconds]
16:08 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
16:08 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
16:08 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:10 < Bushmills> too many hops. or, ping called with too few allowed hops. 
16:10 < Bushmills> routing problem or ping invocation problem
16:11 < Bushmills> most probable is a routing loop
16:16 -!- p3rror [~mezgani@41.248.190.60] has quit [Ping timeout: 240 seconds]
16:23 -!- pyther [~pyther@unaffiliated/pyther] has left #openvpn []
16:25 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
16:28 -!- p3rror [~mezgani@41.140.171.126] has joined #openvpn
16:36 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has left #openvpn []
16:38 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
16:38 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
16:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:40 -!- p3rror [~mezgani@41.140.171.126] has quit [Ping timeout: 240 seconds]
16:40 < DelphiWorld> night all
16:40 -!- DelphiWorld [~VoIpGuy@41.200.5.200] has left #openvpn ["I'm a happy Miranda IM user! Get it here: http://miranda-im.org"]
16:40 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:42 -!- me345 [~me345@adsl-75-15-187-76.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:44 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
16:52 -!- p3rror [~mezgani@41.140.26.192] has joined #openvpn
16:56 -!- sia^pwnnt is now known as adawda
17:12 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
17:17 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
17:20 -!- p3rror [~mezgani@41.140.26.192] has quit [Ping timeout: 240 seconds]
17:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
17:32 -!- p3rror [~mezgani@41.140.96.129] has joined #openvpn
17:33 -!- WinstonSmith [~true@e177088174.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
17:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:35 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
17:38 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
17:46 -!- WinstonSmith [~true@e177088033.adsl.alicedsl.de] has joined #openvpn
17:57 < dvl> Just got the laptop client working.  :)
17:58 < dvl> I'm using a passphrase-less key at present.  Worst case, if the laptop is stolen, I disable it.  I could add a passphrase....
18:00 < dvl> I like the GUI.  Nice.  Simple enough for non-techies.
18:00 -!- Huza [~kvirc@gw-agrowest-liga-stud-ar119.dnttm.ro] has quit []
18:01 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
18:35 <@vpnHelper> RSS Update - forum: Multiple Server Profiles <http://forums.openvpn.net/topic7529.html>
18:35 -!- no_maam [~no_maam@gate.cdc.informatik.tu-darmstadt.de] has quit [Read error: Operation timed out]
18:35 -!- no_maam [~no_maam@gate.cdc.informatik.tu-darmstadt.de] has joined #openvpn
18:51 -!- WinstonSmith [~true@e177088033.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
18:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:05 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:12 -!- k4k [~K4k@c-24-30-28-242.hsd1.ga.comcast.net] has joined #openvpn
19:13 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
19:14 < k4k> When editing /etc/init.d/openvpn, I'm following a how-to that says to put in lines for "iptables -t nat... --to 123.123.123.123" where 123.123.123.123 is public IP. Is that the external facing IP for the server or the IP of the server within the network?
19:15 < dvl> k4k: my guess, public IP is public. .... external facing IP....
19:16 < dvl> I have never used iptables
19:16 < k4k> crum, that's what I was thinking too but was hoping I was wrong :-(
19:20 < dvl> k4k: how about explaining the problem...
19:20 < k4k> no problem, just trying to setup openvpn on my centos server
19:20 < k4k> the instructions I was following said to setup something in the init file
19:22 < k4k> although, now that I'm reading through the file, the comments say that you don't have to uncomment this for it to work, it's just enabling some kind of firewall rules when openvpn starts
19:23 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
19:25 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
19:43 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
19:44 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
19:59 -!- UnterPerro_ [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
19:59 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
19:59 -!- UnterPerro_ is now known as UnterPerro
20:04 -!- p3rror [~mezgani@41.140.96.129] has quit [Read error: Connection reset by peer]
20:09 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 246 seconds]
20:11 -!- theDoc [~Link@173.236.41.36] has joined #openvpn
20:11 -!- theDoc [~Link@173.236.41.36] has quit [Changing host]
20:11 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
20:13 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
20:14 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
20:19 -!- p3rror [~mezgani@41.140.34.232] has joined #openvpn
20:29 < dvl> so difficult to edit the configuration file.... permissions...
20:43 < theDoc> Why?
20:43 < theDoc> It's just config files.
20:46 < dvl> permissions.  If it was unix, I'd just use sudo, but Windows... a bit more work.
20:47 < theDoc> Then the problem isn't permissions, it's Windows.
20:47  * theDoc waggles.
20:47 < dvl> theDoc: No, it's permissions, all bigotry aside.
20:48 < dvl> Just because you don't know how to solve an issue, doesn't make it a problem. ;)
20:48 < dvl> In this case, you = me.
20:49 < dvl> I think I'm getting 'Authenticate/Decrypt packet error: packet HMAC authentication failed' because I'm being NAT. 
20:49 < dvl> ...behind NAT.
20:50 < theDoc> Um, no.
20:50 < theDoc> HMAC errors aren't caused because you're behind NAT.
20:50 < dvl> Good.
20:50 < theDoc> dvl: Almost all of us are behind some form of NAT'ing now.
20:51 < theDoc> HMAC is used to verify the integrity/authenticity of a message.
20:52 < theDoc> Not sure where you got the impression that NAT is breaking HMAC.
20:52 < dvl> OK, that's good to know.  It's one less thing to suspect.
20:52 < dvl> I suspect NAT because this is the first client behind nat.  
20:52 < dvl> I've taken a .conf file from a working client, copied it over to here, and changed only the ca, cert, key, and tls-auth parameters.
20:53 < theDoc> tls-auth parameters? What did you change there?
20:54 < dvl> theDoc: My error.  tls-auth remains the same as other clients.
20:56 < theDoc> dvl: I suspect it's a config error somewhere, I haven't touched a config with HMAC for a while now but you need to make sure that both sides match.
20:56 < theDoc> iirc.
20:57 < dvl> theDoc: FWIW, I did a copy paste of the entire openvpn.conf file from a working client.  That was my starting point.  Looking closer now.
21:00 < dvl> could it be the FQDN?  
21:01 < dvl> the one in the cert... that certainly won't relate to the IP address in question.
21:01 < theDoc> Unlikely, to be honest.
21:05 < dvl> distinct progress, thanks.  I redid the copy paste.  Now it's pretty obvious:  VERIFY ERROR: depth=0, error=unable to get local issuer certificate
21:05 < dvl> :)
21:06 < dvl> This I'm sure I can resolve.
21:17 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
21:17 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
21:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
21:37 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
21:38 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
21:39 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
21:42 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has left #openvpn []
21:55 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
22:01 -!- teddz_ [~teddz@dtmd-4db2f571.pool.mediaWays.net] has joined #openvpn
22:03 -!- teddz [~teddz@dtmd-4db2aea2.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:38 -!- djgerm [~Your_Moms@c-67-169-142-196.hsd1.ca.comcast.net] has joined #openvpn
22:48 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
22:49 -!- djgerm [~Your_Moms@c-67-169-142-196.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
22:54 -!- corretico [~laguilar@201.201.44.82] has quit [Ping timeout: 276 seconds]
22:55 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
23:08 -!- Lenhix|AfK [ElChaman@190.156.59.24] has left #openvpn []
23:28 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:40 <@vpnHelper> RSS Update - forum: DD-WRT client, Ubuntu 10.04 LTS as server <http://forums.openvpn.net/topic7528.html#p9257>
23:41 -!- corretiko [~laguilar@201.201.44.82] has joined #openvpn
23:44 -!- teddz_ [~teddz@dtmd-4db2f571.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
23:44 -!- riddla1 [~Riddla@cm249.psi191.maxonline.com.sg] has joined #openvpn
23:45 < riddla1> howdy
23:45 < riddla1> i was just wondering, is it possible to have multiple local statements in an openvpn server conf?
23:45 < riddla1> i know, just try it... but my vpn is fairly active, and i would like to know before i restart it as it will drop a number of clients
23:47 -!- Kurogane [~kuro@190.87.80.64] has quit [Read error: Connection reset by peer]
--- Day changed Mon Jan 17 2011
00:09 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:10 -!- albech [~thomas@119.42.78.103] has joined #openvpn
00:28 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
00:52 <@vpnHelper> RSS Update - forum: Configuring 2 tunnels to access 2 networks on 1 server <http://forums.openvpn.net/topic7530.html>
00:52 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 246 seconds]
00:53 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
00:53 < grendal_prime> grrrrrrrrrr
00:54 < grendal_prime> this is making me crazy ..ive done this exact install on 5 machines in the last week.  Now on my home machine im getting this and i cant figure out the problem
00:55 < grendal_prime> Local Options hash (VER=V4): '691e95c7'
00:55 < grendal_prime> Expected Remote Options hash (VER=V4): '66096c33'
00:55 < grendal_prime> then all hell breaks looks and i get no connection
00:56 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
01:21 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Disconnected by services]
01:22 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
01:31 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
01:56 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
02:06 -!- Malard [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
02:06 -!- Malard [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
02:06 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
02:16 <@vpnHelper> RSS Update - forum: I am unable to access the keys directory keys: Invalid argum <http://forums.openvpn.net/topic7531.html>
02:51 -!- dazo_afk is now known as dazo
02:58 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
02:59 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
03:02 < macsppadic> morning all
03:04 < theDoc> moin'.
03:24 < kraut> moin
03:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:30 -!- mode/#openvpn [+o mattock] by ChanServ
03:41 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
03:49 -!- master_of_master [~master_of@p57B53308.dip.t-dialin.net] has quit [Read error: Operation timed out]
03:53 -!- master_of_master [~master_of@p57B55902.dip.t-dialin.net] has joined #openvpn
03:56 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
03:59 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
04:07 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 250 seconds]
04:10 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 265 seconds]
04:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
04:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:39 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
04:45 -!- common- [~common@p5DDA4873.dip0.t-ipconnect.de] has joined #openvpn
04:46 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:47 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:47 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:48 -!- common [~common@p5DDA4BF7.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
04:48 -!- common- is now known as common
05:00 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:00 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
05:02 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:02 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:16 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
05:22 < hyper_ch> ecrist: hi there
05:22 < hyper_ch> kraut: hi there
05:28 < hyper_ch> hi dazo
05:28 <@dazo> hi'ya!
05:29 < hyper_ch> dazo: can I bug with with some encryption stuff?
05:29 <@dazo> hyper_ch: you may try :)
05:29 < hyper_ch> well, currently (once more) encrypting my usb pendrive using truecrypt
05:29 < hyper_ch> and it offers a wide array of encryption algorithms and hash algorithms
05:30 < hyper_ch> any recommendations on what to use?
05:30 < hyper_ch> you have all possible combinations of aes - twofish - serpent... either alone, only two or all three
05:31 < hyper_ch> and as hash algorithm you can use ripmed-160, sha-512 or whirlpool
05:31 <@dazo> Well, I usually stay away from DES and RC encryptions (even though RC4 is claimed to be safe by some groups), and also 3DES if I can .... I usually end up with AES and blowfish variants
05:31 < hyper_ch> using three ciphers in a cascade makes it slower, right?
05:31 <@dazo> For hash algorithm, I prefer SHA512, due to the bigger data amount in the hash
05:32 <@dazo> that depends on the ciphers 
05:32 <@dazo> blowfish is not much CPU dependent ... it works almost as fast on old CPUs as on new CPUs
05:32 <@dazo> (I believe twofish is related to blowfish)
05:32 <@dazo> while AES is very much CPU dependent
05:33 < hyper_ch> as text it says: Three ciphers in a cascade operating in XTS mode. Each block is first encrypted with Serpent 256bit, then two fisch 256bit and fineall with aes 256bit. each cipher uses its own key. all keys are mutually independant
05:33 <@dazo> wow ... that's quite a combination
05:33 < hyper_ch> but rather slow?
05:34 < hyper_ch> I think I'll settle for AES / SHA-512
05:34 <@dazo> I wouldn't be too much concerned about AES+twofish .... but I don't know anything about serpent
05:34 < hyper_ch> ok, I use those two then :)
05:34 <@dazo> but then again ... it also depends on what kind of data you are going to save :)
05:35 <@dazo> I think the US government and also Visa/MasterCard finds AES256 alone good enough for sensitive data
05:35 < hyper_ch> so that the us gvt can spy on them :)
05:36 <@dazo> heh ... I dunno :)
05:36 < hyper_ch> thx for the input :)
05:37 < hyper_ch> interesting... df -h shows 29GB free space... truecrypt shows 26.8
05:37 < hyper_ch> does the truecrypt container format need the difference in space?
05:38 <@dazo> I don't know much about truecrypt at all, so I have no idea how that really works out ... I thought truecrypt allocated all the data as it needed and mounted that as a normal filesystem
05:39 < hyper_ch> ok :)
05:39  * hyper_ch gives dazo a super yummy super big cookie
05:39  * dazo looks forward to receiving it :)
05:54 -!- teddz_ [~teddz@dtmd-4db2f571.pool.mediaWays.net] has joined #openvpn
06:03 <@vpnHelper> RSS Update - forum: Temporary disable client access <http://forums.openvpn.net/topic7522.html#p9260>
06:09 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9261>
06:21 <@vpnHelper> RSS Update - forum: Machine behind client cannot access service on vpn server <http://forums.openvpn.net/topic7523.html#p9262>
06:27 <@vpnHelper> RSS Update - forum: Client config works on one machine but not another <http://forums.openvpn.net/topic7524.html#p9263>
06:27 -!- corretiko [~laguilar@201.201.44.82] has quit [Remote host closed the connection]
06:43 -!- ch077179 [~ch077179@nat/ibm/x-lqrnwrfrsurwjkqh] has joined #openvpn
06:43 < ch077179> !welcome
06:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:43 < ch077179> !goal
06:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:45 < ch077179> goal: I want to tunnel from my win32 workstation through an aix loginserver to a rhel target to use squirrel to administer the remote db on target. For this I need a permanent tunnel on a local port. How do I do that?
06:47 < ch077179> !howto
06:47 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
07:03 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
07:04 -!- riddla1 [~Riddla@cm249.psi191.maxonline.com.sg] has quit [Ping timeout: 240 seconds]
07:04 -!- riddla [~Riddla@cm223.epsilon172.maxonline.com.sg] has joined #openvpn
07:15 <@vpnHelper> RSS Update - forum: Temporary disable client access <http://forums.openvpn.net/topic7522.html#p9264>
07:28 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
07:31 -!- juhovh_ is now known as juhovh
07:31 -!- juhovh [~jvahaher@kekkonen.cs.hut.fi] has quit [Changing host]
07:31 -!- juhovh [~jvahaher@xmms2/developer/juhovh] has joined #openvpn
07:33 <@vpnHelper> RSS Update - forum: Multicast support in tap-win32 <http://forums.openvpn.net/topic7532.html>
07:35 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
07:37 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
07:40 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
07:40 -!- mode/#openvpn [+o mattock] by ChanServ
07:59 < dvl> Last night I managed to get the laptop to server connection working from a remote location.  I encountered a "VERIFY ERROR: depth=0, error=unable to get local issuer certificate" issue, but I'm sure I can resolve that today.  Only issue: I'm not remote today... 
08:00 < dvl> It would be nice to have a second ISP today...
08:03 < theDoc> If it's local, why can't you walk over to the server?
08:05 < dvl> theDoc: I'm trying to test an inbound connection... i.e. connecting my laptop to the server from a remote location.  I guess I could go visit Starbucks and try from there.
08:10 < theDoc> dvl: Yeah, or do it from a remote server.
08:15 <@vpnHelper> RSS Update - forum: Multicast support in tap-win32 (with patch) <http://forums.openvpn.net/topic7532.html>
08:24 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
08:25 -!- WinstonSmith [~true@g231217025.adsl.alicedsl.de] has joined #openvpn
08:26 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:27 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9266>
08:33 <@vpnHelper> RSS Update - forum: Configuring 2 tunnels to access 2 networks on 1 server <http://forums.openvpn.net/topic7530.html#p9267>
08:39 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9268>
08:47 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
08:51 <@vpnHelper> RSS Update - forum: DD-WRT client, Ubuntu 10.04 LTS as server <http://forums.openvpn.net/topic7528.html#p9269>
08:52 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 250 seconds]
09:06 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:12 -!- k4k [~K4k@c-24-30-28-242.hsd1.ga.comcast.net] has left #openvpn []
09:13 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
09:21 -!- Cain` [~Geek@41.141.252.98] has joined #openvpn
09:21 -!- Cain` [~Geek@41.141.252.98] has quit [Changing host]
09:21 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:21 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:21 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
09:22 -!- Cain` is now known as Cain
09:54 <@vpnHelper> RSS Update - forum: DD-WRT client, Ubuntu 10.04 LTS as server <http://forums.openvpn.net/topic7528.html#p9270>
09:57 -!- ch077179 [~ch077179@nat/ibm/x-lqrnwrfrsurwjkqh] has quit [Read error: Connection reset by peer]
10:01 -!- chr1s [5d61f643@gateway/web/freenode/ip.93.97.246.67] has joined #openvpn
10:02 < chr1s> hi, i'm having a problem with ip forwarding, can only ping server...I'm using systcl.conf has forward set to 1, anyone any thoughts?
10:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:03 < gladiatr> chr1s, are you seeing a route for your server-side network on your client?
10:03 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 276 seconds]
10:04 < chr1s> yes
10:05 < gladiatr> Is this a routed configuration?
10:06 < chr1s> routed configuration?
10:07 < gladiatr> !route
10:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
10:07 < gladiatr> what that document describes
10:08 <@dazo> or similar ... the point is, that bridge is not used (brctl on Linux, f.ex) on the TAP device
10:09 < gladiatr> indeed
10:09 < chr1s> yes it is, server on 10.10.0.1, clients get 10.90.0.*, push out route to 10.10.0.0/16
10:09 < gladiatr>   client -> server -> stuff you want to get to 
10:09 < gladiatr> :)
10:09 < chr1s> can't ping 10.10.3.1
10:10 < gladiatr> Can you ping the address of the openvpn server on the 10.10/16 network?
10:10 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
10:11 < chr1s> yes, just tested
10:11 < gladiatr> Is the openvpn server also the internet gateway for the 10.10/16 network?
10:11 < chr1s> no
10:11 < chr1s> juniper firewall
10:12 < chr1s> can I say that I have ubuntu vpn, same config with no probs, just centos box giving me problems
10:12 < gladiatr> Righto.  You'll need to add a route to the firewall system.  whatever the equivalent is for: add -net 10.90.0.0/24 gw [internal address of openvpn server]
10:13 < gladiatr> Your VPN configuration is right.  It's just none of the systems on 1010/16 know how to communicate with 10.90.0/24
10:13 <@dazo> reverse route?
10:14 < gladiatr> bwah?
10:14 <@dazo> missing reverse route ... so that the traffic hits the right box ... and then missing a route to go back via the tunnel
10:14 < chr1s> just checking firewall
10:15 -!- p3rror [~mezgani@41.140.34.232] has quit [Ping timeout: 265 seconds]
10:15 <@dazo> chr1s: try checking the traffic flow with tcpdump on the different interfaces ... to see if you can see if the traffic takes the path you expect it to
10:15 < gladiatr> (Don't know, I don't know such stuff. I just do eyes!)
10:16 < chr1s> gladiatr: you're the man :-) haven't fixed it yet but can see route for other vpn client address on firewall, have a 10.90 working, this is a 10.91, that was problem
10:17 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
10:17 < gladiatr> lol.  np
10:20 < chr1s> thanks and bye, tested and working!
10:20 -!- chr1s [5d61f643@gateway/web/freenode/ip.93.97.246.67] has quit [Quit: Page closed]
10:25 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
10:42 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:44 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
10:50 -!- macsppadic [~sonupunno@88.211.55.77] has left #openvpn []
11:00 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 240 seconds]
11:01 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
11:01 -!- dmarkey [~dmarkey@188.141.16.113] has quit [Read error: Connection reset by peer]
11:26 -!- ShaneN [~ShaneNeue@host-121-159-111-24.midco.net] has joined #openvpn
11:27 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
11:28 < ShaneN> Hello. I'm trying to set up openvpn for a small (5-10 machine) VPN. I've ran into an issue with one of the machines (A) not being able to ping another client (B). However, B can ping A. I do have "client-to-client" uncommented. Any suggestions?
11:31 < ShaneN> A can ping the OpenVPN server though
11:31 < gladiatr> check your firewall on client B
11:32 < ShaneN> Ok
11:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:33 < ShaneN> Gah, I'm a moron. Thank you!
11:33 < gladiatr> ;)
11:33 < ShaneN> I kept thinking it was A as that machine is heavily locked down
11:33 -!- albech [~thomas@119.42.78.103] has quit [Quit: Ex-Chat]
11:34 < LedZeplin> Is there an option in the client config to decline using the server supplied DNS server?  I didn't see any that sounded like they did that.
11:36 < gladiatr> Hrm.. I don't think so.  What's your client OS?
11:38 < gladiatr> Well, regardless, if you don't have control of the vpn server, you can always choose not to pull options from the server and manually set up the client with an up script.
11:38 < gladiatr> That'd mean you'd need to deal with any route instantiation and specialized server definitions (like wins or some such)
11:38 < gladiatr> but it's an option
11:42 < LedZeplin> I'm using Tunnelblick on OSX.   I have control of the vpn server, but I want the default option to be to provide dns to the clients.  I'm just looking for a way to opt out of the dns advertisment and to contine to use the currently configured dns servers for specific cases.
11:44 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
11:44 < LedZeplin> a setup script could be tricky because the "currently configured dns servers" wouldn't be static.  unless there is a way to save the dns settings before the connection is started and restore them after the connection is up.
11:44 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
11:44 < gladiatr> Gotcha.  You could also set up a client-specific config fragment with the client-config-dir option.
11:46 < LedZeplin> gladiatr: you mean a client specific config on the server? is that based on expecting a specific key or something?
11:46 < LedZeplin> s/key/certificate/
11:46 < gladiatr> Yup.  The actual file name is based on the CN of the client cert
11:47 < gladiatr> You can fish it out of your ipp file
11:47 < LedZeplin> that could work.  I'm just surprised that there isn't a -nodns option that I can put in my client side config file tho :(
11:47 < gladiatr> Yeah.  I can see where it would be convenient.
11:48 -!- grishnav [~grishnav@209.160.52.134] has quit [Quit: leaving]
11:48 -!- grishnav [~grishnav@209.160.52.134] has joined #openvpn
11:50 < LedZeplin> do you know if a setup script can do something before the connection is started? ie cp /etc/resolv.conf /tmp  then after the connection is established copy it back?
11:52 < gladiatr> Hrm... I would think so.  TB won't have access to the server push data until openvpn delivers it, so I would think it would still be working within openvpn's normal work flow
11:53 < gladiatr> I've only set that up on a few systems, so I haven't had reason to dive into that client too deeply.
11:54 < LedZeplin> ok. thanks for the help
11:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:54 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
11:54 < gladiatr> np.  good luck
12:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
12:20 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
12:29 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
12:29 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
12:34 -!- p3rror [~mezgani@41.140.159.243] has joined #openvpn
12:37 < dvl> Every time I go to create a new cert, which is very infrequent. I wind up using the wrong CA.... bugger me.
12:38 < dvl> Now that I've fixed that issue, hopefully for the last time.... 
12:38 -!- dazo is now known as dazo_afk
12:50 -!- WinstonSmith [~true@g231217025.adsl.alicedsl.de] has quit [Read error: Connection reset by peer]
12:53 -!- WinstonSmith [~true@g231217025.adsl.alicedsl.de] has joined #openvpn
12:56 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
13:00 < grendal_prime> ok...question.  We have been using openvpn for the backhaul on a project for some time.  Now.  several people are pleased with performance and want to use it more for things like. vpn connection from road warriors.
13:02 < ecrist> the answer is yes
13:02 < grendal_prime> The people that will be admining this server will need some sort of gui to do key management and deployment.  they are running into a few issues.  
13:03 < ecrist> there is no real GUI for that
13:03 < ecrist> you can use OpenVPN-AS which does some of that, though
13:03 < dvl> Mon Jan 17 13:36:39 2011 There is a problem in your selection of --ifconfig endpoints [local=10.8.1.40, remote=10.8.1.41].  The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver.  Try 'openvpn --show-valid-subnets' option for more info.
13:03 < ecrist> we don't support it here, however.
13:03 < dvl> Sorry, resolved that already.
13:03 -!- p3rror [~mezgani@41.140.159.243] has quit [Ping timeout: 240 seconds]
13:03 < grendal_prime> can you recommend a key management system of some sort.  We have tried the openvpn webmin tool it works ok..with s few difficulties.  
13:04 < grendal_prime> my thinking is that we will bang on the perl for that tool to fix the few things it does not do to our liking.
13:07 < dvl> We have vpn. :)
13:07 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
13:10 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Quit: leaving]
13:10 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
13:17 -!- p3rror [~mezgani@41.248.186.201] has joined #openvpn
13:19 -!- riddla [~Riddla@cm223.epsilon172.maxonline.com.sg] has quit [Quit: Leaving.]
13:19 -!- Brownoxford [~cabernet@pool-173-69-4-112.prvdri.fios.verizon.net] has joined #openvpn
13:21 < Brownoxford> Hi folks! I'm trying to hook up site-to-site between an office location and some hosted servers at Rackspace, and I would like routing to be automagic between all locations. It seems like my best option is to set up openvpn as a client on each of the remote servers (they are not behind a shared firewall), is there any reason not to do that?
13:27 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
13:27 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
13:32 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
13:32 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
13:32 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9271>
13:32 < gladiatr> Brownoxford, not at all.  Since your office is the common hub, it actually makes the most sense to do it that way.
13:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:33 < Brownoxford> gladiatr: Cool, thanks! It's the first time I'm doing this for site-to-site, and it seemed like quite a bit more work to set up routing on all of the remote sites through a common gateway machine without having a firewall on which to create the routes.
13:35 < gladiatr> If you're wanting your remote systems to talk to each other, you might also want to check out the following: http://backreference.org/2009/11/15/openvpn-and-iroute/
13:36 <@vpnHelper> Title: OpenVPN and iroute « \1 (at backreference.org)
13:38 < Brownoxford> Yup, thanks! That's pretty much what I'm doing.
13:39 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
13:39 < Brownoxford> good walk-through though
13:40 < ecrist> !iroute
13:40 < gladiatr> Indeed
13:40 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
13:40 < ecrist> !route
13:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
13:42 < Brownoxford> ecrist: I'm liking iroute with /32 networks so I can get OpenVPN to push routes correctly, are you saying that it isn't advised?
13:42 < ecrist> I don't think I said that...
13:42 < Brownoxford> .. by "correctly", I mean don't push a route to a server that hosts the network
13:43 < Brownoxford> ecrist: got it, I think I was reading to much into the 'LAN' part of iroute
13:43 < ecrist> I was simply pointing out the factoids gladiatr could have used to help you. ;)
13:43 < Brownoxford> :)
13:43  * ecrist kicks the FNG
13:43 < gladiatr> It's true.  I'm still learning vpnHelper's vocabulary.
13:44 < gladiatr> !smellycheeses
13:44 < gladiatr> heh
13:44 < gladiatr> !godlike wisdom
13:44  * gladiatr thumps the bot
13:46 < ecrist> !factoids
13:46 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
13:46 -!- smarkyou [~smarkyou@cpe-024-163-095-151.nc.res.rr.com] has joined #openvpn
13:47 < smarkyou> !welcome
13:47 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:49 < Brownoxford> How about firewalling with iptables... any reason not to just "-j ACCEPT" everything on "tun+"?
13:49 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9272>
13:51 -!- p3rror [~mezgani@41.248.186.201] has quit [Ping timeout: 240 seconds]
13:51 < smarkyou> !route
13:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
13:53 < smarkyou> !sample
13:53 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
13:59 -!- p3rror [~mezgani@41.140.170.156] has joined #openvpn
14:01 < reiffert> any reason to policy DROP on FORWARD?
14:03 -!- jpulgarin [~jpulgarin@190.251.81.82] has joined #openvpn
14:04 < jpulgarin> Hey guys, any idea about how to stop openvpn from running on ubuntu startup
14:04 < gladiatr> man update-rc.d
14:05 < jpulgarin> fixed!
14:06 < jpulgarin> changed AUTOSTART="openvpn" to AUTOSTART="none" in /etc/default/openvpn
14:06 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9273>
14:09 < gladiatr> schweet
14:14 < grendal_prime> ecrist,  hey the big problem that seems to be bothering everyone is that we cannot generate a canned config that has the user and group remed out.. it causes the mac's to fail and the windows boxes to fail.
14:14 < grendal_prime> im gonna beat u the perl so it just rems them by default
14:15 -!- p3rror [~mezgani@41.140.170.156] has quit [Ping timeout: 240 seconds]
14:18 -!- dschuett [~dschuett@216.229.21.250] has quit [Ping timeout: 240 seconds]
14:18 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
14:24 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:28 -!- p3rror [~mezgani@41.140.172.184] has joined #openvpn
14:31 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9274>
14:33 < dvl> Now that I have the Vista laptop up and running on the VPN, I can't access the laptop from the VPN... e.g. ping fail, nmap finds nothing, but other clients on the vpn don't exibit these characteristics.  However, all the other clients are Unix.  ;)
14:33 < dvl> I want to access the laptop to back it up.... e.g. Bacula.
14:36 -!- jpulgarin [~jpulgarin@190.251.81.82] has quit [Quit: Leaving]
14:37 < dvl> yes, confirmed.  Windows firewall.  Good.  :)
14:44 -!- pmow [~pmow@72.232.162.146] has joined #openvpn
14:46 < gladiatr> What about that bastion of ridiculousness that encompasses windows classification of certain network connections being "private" or "public" or "work" or "playtime" or ...
14:47 < pmow> !welcome
14:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:48 < pmow> !redirect
14:48 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:48 < pmow> !def1
14:48 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
14:48 < pmow> !nat
14:48 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:50 < pmow> I have a tunnel working just fine, but cannot route to the server's eth0 interface using VPN clients.  This is my goal.  I can route to internet traffic, but I'm looking for help on setting this up.  Currently I must connect using the tun0 interface IP (10.8.0.1)
14:51 < pmow> I'm doing ip forwarding as well as NAT.
14:51 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
14:52 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
14:54 -!- s7r [~s7r@41.221.41.90] has joined #openvpn
14:54 -!- s7r [~s7r@41.221.41.90] has quit [Remote host closed the connection]
14:55 -!- batrick [~batrick@nmap/developer/batrick] has quit [Ping timeout: 276 seconds]
14:55 < gladiatr> pmow, pastebin your server and client config
14:56 -!- LedZeplin [jbearer@74.46.1343.static.theplanet.com] has quit [Ping timeout: 265 seconds]
14:56 < pmow> sure
14:57 -!- p3rror [~mezgani@41.140.172.184] has quit [Read error: Connection reset by peer]
14:57 < pmow> http://pastie.org/1471291
14:58 < pmow> http://pastie.org/1471293
15:00 < gladiatr> what's with the bypass-dhcp?
15:01 < pmow> was something I had before
15:02 < gladiatr> k
15:02 < gladiatr> What sort of NAT rule do you have in place for your VPN client network?
15:02 < pmow> I had this working prior, but the box went down and the data center is taking their time finding me a new one.  So I installed on my other box, following instructions I made while getting it working
15:02 < gladiatr> ah
15:03 < pmow> iptables -A POSTROUTING --table nat ! -o tun0 -j MASQUERADE
15:03 < pmow> I also tried removing the ! -o tun0 
15:03 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
15:03 < pmow> I also tried adding a rule, to route to the box's eth0 ip address
15:03 < gladiatr> tun0 isn't your egress device, though, is it?  
15:03 -!- LedZeplin [jbearer@74.46.1343.static.theplanet.com] has joined #openvpn
15:04 < pmow> erm, no
15:04 < gladiatr> This rule will try to feed packets coming in from tun0 back into tun0.
15:05 < gladiatr> oh wait.  blurred eyes with the !
15:05 < pmow> this is loosely based on http://ubuntuforums.org/showpost.php?p=5076501&postcount=4
15:05 <@vpnHelper> Title: Ubuntu Forums - View Single Post - [ubuntu] Concise OpenVPN installation. . .? (at ubuntuforums.org)
15:08 < gladiatr> What does your forward chain look ilke?
15:09 < gladiatr> s/il/li
15:09 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
15:09 < gladiatr> and your input chain?
15:10 < pmow> I didn't set those
15:10 < gladiatr> It must be something iptables-related if you're forwarding traffic through to the internet.
15:10 < gladiatr> hrm...
15:10 < pmow> well, the internet works just fine
15:10 < pmow> it's only the box I can't route to
15:10 < pmow> route/get ot
15:11 < gladiatr> so you get nothing if you run: iptables --list INPUT -n
15:11 < gladiatr> ?
15:11 -!- p3rror [~mezgani@41.140.102.137] has joined #openvpn
15:12 < pmow> let me see
15:12 < pmow> correct ,nothing.
15:16 < gladiatr> this is something insanely simple...
15:16 < pmow> lol
15:16 < gladiatr> that is being missed...
15:16 < pmow> I'm sure it is
15:17 < pmow> maybe it's just a route add that needs to be pushed to the client?  but then the packet would be going to the tun interface, and missed
15:17 -!- Jondice1 [~brandon@rrdhcp-172-285.redrover.cornell.edu] has quit [Quit: Leaving]
15:17 < gladiatr>   /facepalm
15:17  * gladiatr sprinkles some water on his face to try and wake up
15:18 < gladiatr> Yeah.  You're gonna need to push a route for your internal network.
15:18 < pmow> the client is sending everything to the tunnel anyway...so it should be a server issue
15:18  * pmow pours gladiatr a shot 
15:18  * gladiatr chuckles
15:18 < pmow> of espresso
15:19 < pmow> actually, I'm in dire need
15:19 < gladiatr> so if you run /sbin/iptables-save on the server, the only thing your'e seeing is the postrouting rule from above?
15:19 < gladiatr> (indeed)
15:22 -!- p3rror [~mezgani@41.140.102.137] has quit [Ping timeout: 240 seconds]
15:22 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
15:23 < pmow> yes
15:23 < pmow> http://pastie.org/1471400
15:24 < gladiatr> what service are you trying to access on eth0?
15:24 < pmow> at the moment, sabnzbdplus - in the future, apache
15:24 < pmow> I can't ping either.
15:25 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has left #openvpn ["Leaving"]
15:25 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
15:25 < gladiatr> oops
15:26 < gladiatr> try this: /usr/sbin/lsof -Pn |grep LISTEN|grep "eth0's IP address"
15:27 < pmow> no such command
15:28 < pmow> nvm
15:28 < pmow> /usr/bin
15:28 < pmow> mysqld is listening on it, port 3306...
15:29 < pmow> bah - I had it on localhost.
15:29 < gladiatr> That's gonna be the only service available on eth0 then.  You might want to check your config for... that other thing you're running to make sure it's set up to bind to eth0's address
15:30 < gladiatr> oh wait
15:30 < pmow> okay, I changed the config, and it's listening
15:30 < gladiatr> s*t
15:30 < pmow> (still same deal though)
15:30 < gladiatr> Yeah.  eth0 is gonna be caught by *:port
15:30 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
15:31 < gladiatr> sorry mate.  I think I'm a bit to out of it this afternoon to be of much assistance. :P
15:31 < pmow> that's okay
15:31 < gladiatr> s/to/too
15:31 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
15:31 < majuk_> !welcome
15:31 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:31 < majuk_> !goal
15:31 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:36 < majuk_> Hi all. I want a secure connection between two comps on a LAN. Currently have the server set for TLS and ethernet bridging. Client gets 'connection refused' on trying to establish a connection. Relevant logs - Server: http://pastie.org/1471440 | Client: http://pastie.org/1471445
15:39 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9275>
15:42 < majuk_> I am able to SSH to the server via its bridged interface just fine, so it is responding on that interface.... so I don't know why I'm getting refusals when I try to connect. I am currently using TCP. With UDP, it just times out after 60s on the client side.
15:42 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
15:43 < pmow> heh
15:43 < pmow> I'm getting the same exact problem when doing that over a tunnel
15:45 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: Yes, Virginia...]
15:50 < majuk_> pmow, Awesome. Feeling included is half the battle. :D
15:51 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
15:53 < Dougy> once again
15:53 < Dougy> i cant log into the forum
15:53 < Dougy> there we go
15:54 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Client Quit]
15:59 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
16:01 -!- MrKeuner [~sur@unaffiliated/mrkeuner] has joined #openvpn
16:01 < MrKeuner> hello, I can connect to a vpn server that I have set up on a Ubuntu 10.04.1 from another 10.04.1. However, once I get connected I cannot ping anywhere. what may be the problem?
16:02 < pmow> you can't ping the vpn server?
16:02 < pmow> or "anywhere"
16:02 -!- Brownoxford [~cabernet@pool-173-69-4-112.prvdri.fios.verizon.net] has quit [Quit: Brownoxford]
16:02 < MrKeuner> I can ping the vpn server but not through its WAN ip, only through the LAN ip
16:03 < pmow> that's exactly why I'm here
16:03 < MrKeuner> nice to meet you :)
16:03 < pmow> cannot access VPN server interfaces other than VPN
16:03 < pmow> yeah, majuk_ is also having a similar problem
16:04 < MrKeuner> it was working at the time I set it up. though
16:04 < MrKeuner> haven't used it for a while...
16:04 < MrKeuner> pmow, no luck I suppose...
16:04 < pmow> naw
16:13 -!- pmow [~pmow@72.232.162.146] has quit [Quit: Leaving.]
16:16 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
16:18 -!- p3rror [~mezgani@41.140.38.34] has joined #openvpn
16:20 < majuk_> fwiw, I have the opposite problem. I can hit my VPN server on any open port BUT the VPN port.
16:36 -!- kim0 [~kim0@ubuntu/member/kim0] has left #openvpn []
16:40 -!- MrKeuner [~sur@unaffiliated/mrkeuner] has quit [Quit: Ex-Chat]
16:50 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
16:54 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
16:56 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
17:06 -!- WinstonSmith [~true@g231217025.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
17:09 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9276>
17:19 -!- WinstonSmith [~true@f052096152.adsl.alicedsl.de] has joined #openvpn
17:25 -!- teddz_ [~teddz@dtmd-4db2f571.pool.mediaWays.net] has quit [Quit: Ex-Chat]
17:30 -!- undecim [~undecim@24-119-130-33.cpe.cableone.net] has joined #openvpn
17:31 < undecim> I'm following http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html to setup a quick VPN connection... Where do I put the key and config files on the server?
17:31 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
17:35 -!- ShaneN [~ShaneNeue@host-121-159-111-24.midco.net] has quit [Read error: Connection reset by peer]
17:42 -!- grendal_prime [~sgraham@209.78.161.3] has joined #openvpn
17:44 < Bushmills> undecim: same dir as config file, or location given with full path in config
18:04 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
18:15 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
18:28 -!- teddz [~teddz@dtmd-4db2f571.pool.mediaWays.net] has joined #openvpn
18:31 < undecim> Okay, I've got the connection setup using the OpenVPN GUI on a Windows client. Now how do I forward all internet traffic through the VPN?
18:34 < Bushmills> !redirect
18:34 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
18:36 < undecim> ty
18:37 < undecim> !def1
18:37 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
18:44 < undecim> !nat
18:44 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
18:50 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:55 -!- WinstonSmith [~true@f052096152.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
18:55 -!- WinstonSmith [~true@f052096152.adsl.alicedsl.de] has joined #openvpn
18:56 < undecim> Windows client still has the same IP as reported by wimi.com
19:10 < undecim> added push "redirect-gateway def1" to the client config, and restarted the connection
19:11 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit []
19:12 < undecim> hmm... I made the client conf on a *nix system... would the line endings have something to do with it?
19:13 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:15 < undecim> Wait...
19:16 < undecim> Wrong config file
19:19 < undecim> Okay, it's in the server config file now, we restarted both the server and the client and still won't forward traffic :/
19:21 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
19:32 < undecim> I added "pull" to the client config and it gives me an error that says it can only be used in TLS mode? wtf?
19:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
19:49 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
19:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:53 < undecim> So I have to setup TLS to forward all traffic over the VPN?
19:58 -!- WinstonSmith [~true@f052096152.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:11 -!- WinstonSmith [~true@f052096152.adsl.alicedsl.de] has joined #openvpn
20:15 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:29 -!- WinstonSmith [~true@f052096152.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:29 -!- WinstonSmith [~true@f052096152.adsl.alicedsl.de] has joined #openvpn
20:33 -!- undecim [~undecim@24-119-130-33.cpe.cableone.net] has left #openvpn ["Leaving"]
21:09 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
21:12 -!- grendal_prime [~sgraham@209.78.161.3] has quit [Quit: Ex-Chat]
21:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
21:27 -!- djgerm [~Your_Moms@dsl-63-249-119-56.static.cruzio.com] has joined #openvpn
21:37 -!- djgerm [~Your_Moms@dsl-63-249-119-56.static.cruzio.com] has quit [Quit: Leaving.]
21:45 -!- undecim [~undecim@24-119-130-33.cpe.cableone.net] has joined #openvpn
21:46 < undecim> Okay. I think I finally got the windows client to start forwarding internet traffic.... Only problem is it seems to also be trying to forward OpenVPN traffic, and so just cuts off the internet connection completely.
21:47 < undecim> Any ideas?
21:56 < undecim> I've checked firewall rules and everything
22:01 -!- teddz_ [~teddz@dtmd-4d0bfe47.pool.mediaWays.net] has joined #openvpn
22:01 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
22:03 < smerz> if you need internet access then the vpn server needs to provide that
22:03 -!- teddz [~teddz@dtmd-4db2f571.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:04 < smerz> as all internet traffic goes through the vpn
22:05 < undecim> smerz: I Know
22:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
22:05 -!- roentgen_ [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:06 < undecim> smerz: I have the forwarding setup on the server and everything
22:06 < undecim> smerz: Though I think I may have fixed it...
22:06 < undecim> smerz: At least I'm hoping that's why my buddy with the client dropped from teamspeak, lol
22:07 < undecim> nvm....
22:07 < undecim> It's still broken
22:08 < smerz> just nat the whole VPN subnet
22:08 < smerz> worked for me :)
22:08 < undecim> That's done with iptables?
22:08 < smerz> yeah
22:08 < undecim> iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
22:08 < undecim> I did that
22:09 < undecim> Also forwarding is enabled
22:09 < undecim> Did I miss something?
22:09 < smerz> likely iptables not correct or complete. if you used def1 to redirect all traffic
22:10 < smerz> that's my guess. gotta go outside grab smth
22:12 < smerz> good luck :)
22:14 < undecim> Do I need to push a route option or something?
22:16 < undecim> Or...
22:16 < smerz> undecim  !def1
22:16 < smerz> @vpnHelper  "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
22:17 < smerz> that pushes all
22:17 < smerz> through vpn
22:17 < undecim> I know
22:17 < undecim> I used that
22:17 < smerz> except for DNS i think
22:17 < smerz> nor sure about dns
22:17 < smerz> but
22:17 < undecim> DNS i don't care about. It can go either way
22:17 < smerz> the iptables command aint right i think
22:17 < undecim> I think I copied that straight from the openvpn man pages...
22:18 < undecim> nvm.. guess I didn't
22:19 < smerz> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
22:19 < smerz> iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
22:19 < smerz> iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
22:19 < smerz> try these
22:19 < smerz> they work
22:19 < smerz> brb gotta go
22:19 < undecim> okay, I'll try
22:19 < undecim> ty
22:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
22:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:41 -!- riddla [~Riddla@cm249.psi191.maxonline.com.sg] has joined #openvpn
22:42 -!- teddz_ [~teddz@dtmd-4d0bfe47.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:42 -!- riddla [~Riddla@cm249.psi191.maxonline.com.sg] has left #openvpn []
22:49 < undecim> Okay, it's only a specific IP subnet I want to redirect traffic to. Can I just add a push "route ..." option to my server config?
22:52 < Bushmills> yes, you can
22:52 < smerz> you can
22:53 < Bushmills> smerz: redirect sets new default route. if dns queries are sent through default route, they'll be redirected through vpn too
22:54 < Bushmills> if there's a specific route set to a name server, it will take precedence over default route 
23:14 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
23:22 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has joined #openvpn
23:34 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
23:51 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
--- Day changed Tue Jan 18 2011
00:15 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
00:24 -!- roentgen_ [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
00:28 -!- LedZeplin [jbearer@74.46.1343.static.theplanet.com] has left #openvpn []
00:29 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Read error: Operation timed out]
00:45 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Ping timeout: 272 seconds]
00:47 -!- undecim [~undecim@24-119-130-33.cpe.cableone.net] has quit [Quit: Leaving]
00:57 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
00:59 -!- p3rror [~mezgani@41.140.38.34] has quit [Ping timeout: 240 seconds]
01:01 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 255 seconds]
01:15 -!- p3rror [~mezgani@41.140.101.48] has joined #openvpn
01:23 -!- iRabbit_ [~nfredrich@guest.egv.servercentral.net] has joined #openvpn
01:26 < iRabbit_> need to install OpenVPN Ubuntu 10.10.... sudo apt-get install openvpn?
01:27 < hyper_ch> yes
01:31 < iRabbit_> ok... keyword for the key and config?
01:34 < reiffert> iRabbit_: "howto"
01:34 < reiffert> iRabbit_: "read" "topic"
01:35 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
01:36 < iRabbit_> ?
01:36 < hyper_ch> !tell iRabbit_ [howto]
01:37 < iRabbit_> hyper_ch, !thank
01:37 < reiffert> I always thought that our topic is one of the most readable topics.
01:39 < iRabbit_> well... here's the deal... not a fan of some Linux stuff and need to get a keyword and config to email netops for a u/p.
01:40 < iRabbit_> so I can take this netbook into the pod, rather than do shit in the noc
01:41 < iRabbit_> so its an urgent thing. if its not going to take 10sec to do.... obvously reading a wiki takes longer... I'll have one of my admins do it for me :)
01:41 < iRabbit_> but thanks for the bathroom reading material :)
01:41 -!- Lantizia [~Lantizia@erebus.seaquake.net] has joined #openvpn
01:43 -!- iRabbit_ [~nfredrich@guest.egv.servercentral.net] has left #openvpn ["Ex-Chat"]
01:43 < Lantizia> Hey is it possibly to make an OpenVPN proxy?
01:44 < reiffert> openvpn does encrypted network layer 2/3 tunneling.
01:44 < reiffert> openvpn does not work as a proxy.
01:44 < Lantizia> e.g. I have an OpenVPN server I want to connect to... but myself and others would like to connect to my own server which connects to that server for us
01:45 < Lantizia> reiffert, can't see how that'd stop what I'm asking for
01:45 < reiffert> Lantizia: please define "openvpn proxy" then.
01:45 < Lantizia> I just did with my example
01:46 < reiffert> you made an example, you didnt define it.
01:46 < Lantizia> Well it's hard to define
01:46 < Lantizia> I essentially want to share a single OpenVPN connection with others using OpenVPN
01:46 < reiffert> it's hard to answer questions about a not well defined theoretical thing. Thanks.
01:47 < reiffert> ok, so here is how it will work:
01:47 < reiffert> [vpn endpoint]<------encrypted openvpn line ----->[vpn endpoint]======multiple others======[machine of those]
01:47 < reiffert> plural, maschines.
01:48 < reiffert> If I get you right, the communication between those multiple maschines and the right vpn endpoint is in your hand, right?
01:49 < Lantizia> more like...
01:49 < Lantizia>                                   [            ]<--encrypted line-->[vpn endpoint]
01:49 < Lantizia>                                   [            ]<--encrypted line-->[vpn endpoint]
01:49 < Lantizia> [vpn endpoint]<--encrypted line-->[vpn endpoint]<--encrypted line-->[vpn endpoint]
01:49 < Lantizia>                                   [            ]<--encrypted line-->[vpn endpoint]
01:49 < Lantizia>                                   [            ]<--encrypted line-->[vpn endpoint]
01:49 < Lantizia> the middle "endpoint" being my server
01:50 < Lantizia> the right hand "endpoints" being our users
01:50 < reiffert> yeah, this can be done with openvpn.
01:50 < Lantizia> the left hand "endpoint" being what we want to connect ti
01:50 < Lantizia> *to
01:50 < reiffert> left endpoint: openvpn server running
01:50 < reiffert> middle endpoint: openvpn server running, openvpn client running (for communication with left endpoint)
01:50 < reiffert> users: openvpn client running on all of them.
01:51 < Lantizia> indeed
01:51 < reiffert> communication between users and left endpoint: routing.
01:51 < reiffert> or: NAT
01:51 < reiffert> or: Bridging (layer 2)
01:51 < Lantizia> we only have one login to the target openvpn server... but want several to login you see
01:52 < reiffert> no, I dont see and I dont know anything about the limited setup details.
01:52 < Lantizia> left - only accepts one login... which is why we can't have more than one user connect to it
01:52 < reiffert> ok, nothing changes from my answers.
01:53 < Lantizia> middle - will take more than one login as I run it and will route to the "one login" server
01:53 < Lantizia> right - multiple users
01:53 < reiffert> so you still got: routing, nat, briding.
01:53 < reiffert> to make an exmaple:
01:53 < Lantizia> OK so how is this achieved ?
01:54 < reiffert> [10.10.30.1]<----->[10.10.20.1]<-------->[10.10.10.2]
01:54 < Lantizia> will openvpn server and client talk directly to each other on the middle endpoint (my server)?
01:54 < reiffert> you tell those clients: hey, if you want to get to 10.10.30.1, send everything to 10.10.20.1
01:54 < reiffert> route add -net 10.10.30.0 netmask 255.255.255.0 gw 10.10.20.1
01:54 < reiffert> done.
01:55 < Lantizia> not done... this doesn't explain how the middle part works
01:55 < reiffert> the middle will get a packet and will hand it to the left
01:56 < reiffert> the answer from the left will reach the middle which will hand it to one of those from the right.
01:56 < reiffert> this is done by pure routing
01:56 < Lantizia> ok the only thing is though... this is for full internet access... so 0.0.0.0/0
01:56 < reiffert> layer 3. routing.
01:56 < reiffert> ya, can be done with openvpn.
01:57 < reiffert> see here:
01:57 < reiffert> !howto
01:57 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
01:57 < reiffert> it will explain you the basic setup stuff
01:57 < Lantizia> it's not as simple as you think
01:57 < reiffert> then have a look here, it will explain the routing stuff
01:57 < reiffert> !route
01:57 < Lantizia> this really won't work
01:57 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
01:57 < reiffert> Lantizia: shut up.
01:57 < Lantizia>                                   [------------]<--encrypted line-->[vpn endpoint]
01:57 < Lantizia> [vpn endpoint]<--encrypted line-->[vpn endpoint]<--encrypted line-->[vpn endpoint]
01:57 < Lantizia>                                   [------------]<--encrypted line-->[vpn endpoint]
01:57 < Lantizia>                                   [------------]<--encrypted line-->[vpn endpoint]
01:57 < Lantizia> [vpn endpoint]<--encrypted line-->[vpn endpoint]<--encrypted line-->[vpn endpoint]
01:57 < Lantizia>                                   [------------]<--encrypted line-->[vpn endpoint]
01:57 < Lantizia>                                   [------------]<--encrypted line-->[vpn endpoint]
01:57 -!- Lantizia was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
01:57 < reiffert> then have a look at the "send everything 0/0" part here:
01:57 -!- Lantizia [~Lantizia@erebus.seaquake.net] has joined #openvpn
01:57 < reiffert> then have a look at the "send everything 0/0" part here:
01:57 < Lantizia>                                   [------------]<--encrypted line-->[vpn endpoint]
01:57 < Lantizia> now you see it won't work
01:58 < reiffert> and stop flodding this. just shut up.
01:58 < reiffert> !def1
01:58 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
01:58 < Lantizia> as the middle server connects to many openvpn servers
01:58 < hyper_ch> hi reiffert
01:58 < reiffert> Lantizia: look: you didnt say anything about multiple left servers.
01:58 < Lantizia> reiffert, no I was trying to start with a basic example
01:58 < reiffert> Lantizia: why didnt you do that?
01:59 < reiffert> Lantizia: it makes life harder as you said.
01:59 < Lantizia> yeah
01:59 < reiffert> Lantizia: I dont see why routing doesnt solve this.
01:59 < reiffert> hyper_ch: hey
01:59 < Lantizia> because all three left servers handle internet
01:59 < reiffert> Lantizia: so?
01:59 < Lantizia> so say in that example you've got 9 clients... if all of them are sending whatever is aimed at 0.0.0.0/0 to the middle.... which of the left servers does it give it to?
02:00 < Lantizia> when they also handle 0.0.0.0/0
02:00 < reiffert> whatever you configure the middle to do.
02:00 < reiffert> start adding some routing protocols. you will figure it out.
02:00 < reiffert> have fun.
02:00 < Lantizia> but I don't see any way of configuring it
02:01 < reiffert> try digging harder into routing protocols and round robin.
02:01 < Lantizia> and apparently neither do you
02:01 < reiffert> I dont see any problem.
02:02 < reiffert> hyper_ch: can you see why he thinks there is a problem?
02:02 -!- s7r [~s7r@94.198.100.92] has joined #openvpn
02:02 < hyper_ch> reiffert: don't even know what's it about :)
02:02 < Lantizia> middle server connects to 3 openvpn servers and itself runs 3 openvpn servers... so it runs 3 servers, and 3 clients... all 3 clients send packets destined for 0.0.0.0/0 and all 3 servers accept packets destined for 0.0.0.0/0
02:03 < hyper_ch> all those encrypted line texts were just too confusing so I gave up
02:03 < Lantizia> thus if client 9 wants to get out through left hand server 3... there is no way to define that
02:03 < reiffert> sure, there is.
02:04 < reiffert> [10.10.30.1]<----->[10.10.20.1]<-------->[10.10.10.2]
02:04 < Lantizia> wrong!
02:04 < reiffert> shut up.
02:04 < reiffert> on 10.2 you say: route add default gw 10.10.20.1
02:04 < Lantizia> you're presuming internal networks!
02:04 < reiffert> on 20.1 you say: route add default gw 10.10.30.1
02:04 < reiffert> those are openvpn ip networks.
02:06 < Lantizia> ok lets say I'm sitting at my pc on the right hand side... and I wanna get to 212.223.232.231... the openvpn connection only knows it can reach 10.10.30.1 via the openvpn server... not that IP
02:10 < reiffert> !route
02:10 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
02:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
02:11 < Lantizia> yeah forget it, you've finally grasped the complexity and do not know
02:12 < s7r> !proxy
02:12 < s7r> !socks
02:13 < reiffert> Lantizia: being an ignorant doesnt solve your problem.
02:13 < reiffert> Lantizia: doing like I said will.
02:14 < Lantizia> reiffert, and pretending you have some hidden answer doesn't solve it either
02:14 < Lantizia> your tone has been nothing but condescending since I got in here
02:14 < reiffert> Lantizia: shall we have a look how a packet from right will travel to 212.223.whatever?
02:14 < Lantizia> no I'm done with you
02:14 < reiffert> k, enjoy.
02:16 < reiffert> 10.10.10.2 doesnt know how to read 212 directly, so sending it to its default gw, 20.1
02:16 < reiffert> 20.1 doesnt know how to reach 212 directly, so sending it to its default gw, 30.1
02:16 < reiffert> 30.1 doesnt know how to reach 212 directly, sending it to its default gw, whatever this one is.
02:16 < Lantizia> and I'm saying _can't_ presume a default gq in this case
02:16 < Lantizia> *gw
02:17 < reiffert> 30.1 doesnt have a default gw?
02:17 < Lantizia> you _still_ do not understand
02:17 < Lantizia> so just drop it
02:17 < reiffert> so maybe it's because of all your explanations dont make it to my brain.
02:17 < reiffert> And I dont think that my brain is the cause.
02:19 < reiffert> 08:57 < Lantizia> now you see it won't work
02:19 < reiffert> no, I dont.
02:19 < reiffert> 08:56 < Lantizia> ok the only thing is though... this is for full internet access... so 0.0.0.0/0
02:19 < reiffert> line doesnt parse.
02:19 < Lantizia> ever heard the phrase "to beat a dead horse" ?
02:19 < reiffert> yeah, which is why I keep beating.
02:21 < Lantizia> ok lets define some terms here.... the "servers" - the openvpn servers I do not run that gives Internet access from various locations
02:21 < Lantizia> the "proxy" the openvpn server I _do_ run that I want many users connecting to... so they can go out through a choice of one of those "servers"
02:21 < Lantizia> the "clients" the people wanting access to a specific "server"
02:22 < Lantizia> if they simply connect to the "proxy" I see no logical way of determining which "server" they get relayed to... since each "server" offers the same service - general internet access
02:22 < hyper_ch> reiffert: a dead horse can't defend itself?
02:23 < reiffert> hyper_ch: it doesnt change a thing when you keep beating the dead horse.
02:23 < hyper_ch> and I thought you just enjoy beating things and even more so since it can't defend itself
02:25 < Lantizia> so to my mind you've some how got to link the insulate each connection to the servers from the "proxy" servers the clients have connected to
02:26 < Lantizia> '/link the/d'
02:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:44 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
02:45 -!- dazo_afk is now known as dazo
03:00 < reiffert> Lantizia: how is a client supposed to choose to which of those servers the packets will travel?
03:01 < Lantizia> exactly :P
03:01 < reiffert> Lantizia: is it important for a client to know/choose wo which of the servers its packets will travel?
03:01 < Lantizia> The only way I see is to run 3 openvpn servers on the proxy server
03:01 < Lantizia> reiffert, yes
03:02 < reiffert> why?
03:02 < Lantizia> because they are 3 different locations
03:02 < reiffert> Lantizia: is it important for a client to actually *change* the server?
03:02 -!- p3rror [~mezgani@41.140.101.48] has quit [Ping timeout: 240 seconds]
03:02 < Lantizia> why don't we stick to what the task is - rather than what is and is not important
03:03 < Lantizia> the scenario is the way it is because it has been deemed important already
03:03 < reiffert> Lantizia: why dont we stick to the scenario? Because the more I ask the more details you came up with. I still dont think that I got all the details so thats why I dont stop asking. However.
03:04 < Lantizia> i was thinking 3 openvpn servers running on the "proxy box" on 3 different ports... but how you then link those 3 servers with the 3 clients to connect to the left servers without "mixing" is the confusing part
03:04 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:04 < reiffert> Lantizia: the answer to your last confusing thing: routing.
03:04 < Lantizia> general routing won't help in this case
03:05 < Lantizia> i feel like we're going round in circles
03:05 < reiffert> why?
03:05 < Lantizia> i've already said why many times
03:06 < reiffert> pretending that something that will work is wrong wont make it a wrong.
03:06 < Lantizia> i'm not pretending anything here
03:07 < reiffert> you say that routing wont solve the thing that different clients have to reach differnet servers.
03:07 < reiffert> when running differnent openvpn servers on your middle.
03:08 < reiffert> let's make another example:
03:08 < Lantizia> how are you going to get openvpn server 1 on the proxy box talk to openvpn client 1?
03:08 < reiffert> [server1:10.1] -----
03:08 < Lantizia> and only openvpn server 2 talk to openvpn client 2... etc etc
03:08 < reiffert> [server2:20.1] -----
03:08 < reiffert> [server3:30.1] -----
03:08 < reiffert> those lines end up here:
03:09 < reiffert> [middle.openvpn1:10.2]
03:09 < reiffert> [middle.openvpn2:20.2]
03:09 < reiffert> [middle.openvpn3:30.2]
03:09 < reiffert> so far it represents your setup?
03:09 < Lantizia> i've no idea what you're trying to demonstrate
03:09 < Lantizia> but you're not answering the question because you don't have the answer
03:10 < reiffert> I want to demonstrate how routing will solve your case as far as you gave me the details.
03:10 < Lantizia> the question remains... "how are you going to get openvpn server 1 on the proxy box ONLY TO talk to openvpn client 1?"
03:10 < reiffert> routing, nat, or both.
03:10 < Lantizia> negative
03:11 < reiffert> can you explain the "negative" then please.
03:11 < Lantizia> I'm going now - better things to do than run around in circles
03:11 -!- Lantizia [~Lantizia@erebus.seaquake.net] has left #openvpn ["Leaving"]
03:11 < reiffert> what an ignorant.
03:19 < s7r> can I connect to an openvpn server via http proxy?
03:23 < hyper_ch> reiffert: you had a lot of patience :)
03:25 < s7r> yeah :D
03:25 < s7r> too much
03:27 < hyper_ch> I don't think you cann connect via http proxy
03:28 < hyper_ch> as a http proxy would only proxy http requests
03:28 < s7r> because the http proxy supports only http protocol
03:28 < s7r> exactyl
03:28 < s7r> but how come in the openvpn GUI
03:28 < s7r> at connect options
03:28 < hyper_ch> which is different from establishing a vpn tunnel between you and server
03:28 < s7r> http proxy is listed
03:28 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
03:28 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
03:28 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
03:28 < hyper_ch> that's the access server which is not supported here
03:28 < hyper_ch> IIRS
03:28 < s7r> not the access server
03:28 < hyper_ch> IIRC
03:28 < s7r> the community openvpn client
03:28 < s7r> for windows
03:28 < hyper_ch> what gui then?
03:28 < hyper_ch> oh windows... no clue :)
03:29 < s7r> at connect options it has conect via socks 4, socks 5 or http proxy
03:29 < s7r> socks 5 normally will work as it works with any tcp or udp protocol
03:29 < s7r> but http ?
03:30 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
03:30 < hyper_ch> I don't really know :) ask reiffert :) he has lots of patience at explaining things :)
03:30 < reiffert> 10:19 < s7r> can I connect to an openvpn server via http proxy?
03:31 < reiffert> s7r: yes, you can.
03:31 < s7r> I am noit goint to be as stressful as that person trust me 
03:31 < s7r> reiffert: isn't http proxy working only with http requests?
03:32 < reiffert> s7r: depends on the http proxy software.
03:33 < s7r> ok. one last question .if i establish the connection between my computer and the openvpn server via a http proxy or socks, will the traffic be encrypted between my computer and the vpn server or between the proxy server and openvpn server?
03:33 < reiffert> it will be encrypted.
03:34 < reiffert> (as long as you doesnt tell openvpn to not encrypt it)
03:37 < s7r> yes I know 
03:37 < s7r> but between my computer and the vpn server
03:37 < s7r> or proxy server and vpn server
03:37 < s7r> the proxy server will see the traffic encrypted or plain text?
03:37 < reiffert> Just found an public email from Lantizia, Subject: It's me again - sorry! Trouble doing 'nxsetup--install'
03:38 < reiffert> looks that he is pretty successful in being an ignorant
03:47 < theDoc> reiffert: You should troll him, ;p
03:51 -!- master_of_master [~master_of@p57B55902.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
03:52 -!- master_of_master [~master_of@p57B55AE7.dip.t-dialin.net] has joined #openvpn
03:56 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: Lost terminal]
03:57 -!- WinstonSmith [~true@f052096152.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
04:14 -!- WinstonSmith [~true@e177095131.adsl.alicedsl.de] has joined #openvpn
04:19 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
04:19 -!- mode/#openvpn [+o mattock] by ChanServ
04:46 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:46 -!- common- [~common@p5DDA48B3.dip0.t-ipconnect.de] has joined #openvpn
04:49 -!- common [~common@p5DDA4873.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
04:49 -!- common- is now known as common
04:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:53 <@vpnHelper> RSS Update - forum: Benefits of certificates vs. username/password auth. <http://forums.openvpn.net/topic7533.html>
04:59 -!- WinstonSmith [~true@e177095131.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
05:29 <@vpnHelper> RSS Update - forum: configure open vpn file <http://forums.openvpn.net/topic7534.html>
05:37 -!- _zero__ [~zero@noc.toile-libre.net] has quit [Ping timeout: 260 seconds]
05:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:40 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
05:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
06:01 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
06:16 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
06:42 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
06:50 -!- albech [~thomas@124.157.211.210] has joined #openvpn
06:51 -!- p3rror [~mezgani@41.140.168.15] has joined #openvpn
06:54 <@vpnHelper> RSS Update - forum: Linux Tap device 10Mbit <http://forums.openvpn.net/topic7535.html>
06:55 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
07:00 <@vpnHelper> RSS Update - forum: Machine behind client cannot access service on vpn server <http://forums.openvpn.net/topic7523.html#p9281> || configure open vpn file <http://forums.openvpn.net/topic7534.html#p9280>
07:06 <@vpnHelper> RSS Update - forum: Linux Tap device 10Mbit <http://forums.openvpn.net/topic7535.html#p9282>
07:06 < gladiatr> Pie is good.  That is all.
07:07 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
07:07 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
07:12 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9283>
07:13 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
07:27 -!- EugenA [~eugen@mnch-4d04f54a.pool.mediaWays.net] has joined #openvpn
07:28 < EugenA> general question: would openvpn help me to use nfs over internet?
07:28 <@dazo> EugenA: yes
07:29 < EugenA> ok, how do i connect to vpn server? it is already installed
07:30 < EugenA> i can make a connection from windows. now i need to create a connection from centos to openvpn server
07:30 <@dazo> EugenA: you need to configure server and client to your liking ... start them, and then connect ... then you need some kind of routing/networking configuration too
07:30 <@dazo> !howto
07:30 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
07:30 <@dazo> !route
07:30 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
07:33 < EugenA> i'm reading here http://www.openvpn.net/index.php/access-server/docs/admin-guides/182-how-to-connect-to-access-server-with-linux-clients.html
07:33 < EugenA> Login to the Access Server's Client Web Server and download the desired client config file (typically called "client.ovpn"
07:33 <@vpnHelper> Title: How to connect to Access Server from a Linux computer (at www.openvpn.net)
07:33 < EugenA> what is "Access Server's Client Web Server" ?
07:36 <@vpnHelper> RSS Update - forum: NOTE: could not get adapter index for ... <http://forums.openvpn.net/topic7537.html>
07:38 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Quit: Leaving]
07:38 < Dougy> !factoids search access server
07:38 <@vpnHelper> "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options supported
07:38 <@vpnHelper> which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
07:42 <@vpnHelper> RSS Update - forum: Linux Tap device 10Mbit <http://forums.openvpn.net/topic7535.html#p9285>
08:01 -!- p3rror [~mezgani@41.140.168.15] has quit [Ping timeout: 240 seconds]
08:02 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
08:05 -!- renihs_ [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
08:05 -!- Netsplit *.net <-> *.split quits: derekv, renihs, sigius
08:08 -!- Netsplit *.net <-> *.split quits: deever, Nappy, freaky[t], MJD, djgerm1, ScriptFanix, optiz0r
08:08 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
08:09 -!- djgerm [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
08:10 -!- Netsplit over, joins: ScriptFanix, Nappy, deever
08:10 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
08:11 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
08:11 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
08:13 -!- optiz0r [~optiz0r@miranda.sihnon.net] has joined #openvpn
08:14 -!- teddz_ [~teddz@dtmd-4d0bfe47.pool.mediaWays.net] has joined #openvpn
08:14 -!- [1]rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
08:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:20 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Ping timeout: 240 seconds]
08:20 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
08:20 -!- [1]rond is now known as rond
08:21 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
08:24 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
08:27 -!- p3rror [~mezgani@41.140.169.225] has joined #openvpn
08:27 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:30 -!- smarkyou [~smarkyou@cpe-024-163-095-151.nc.res.rr.com] has quit [Read error: Connection reset by peer]
08:31 -!- smarkyou [~smarkyou@cpe-024-163-095-151.nc.res.rr.com] has joined #openvpn
08:31 -!- smarkyou [~smarkyou@cpe-024-163-095-151.nc.res.rr.com] has left #openvpn []
08:32 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
08:32 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
08:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:37 -!- Typone [~nnnnnnnit@195.197.184.87] has quit [Ping timeout: 260 seconds]
08:38 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
08:39 -!- Typone [~nnnnnnnit@195.197.184.87] has joined #openvpn
08:43 < gladiatr> !factoids search port-share
08:43 <@vpnHelper> No keys matched that query.
08:43 < gladiatr> !factoids port-share
08:43 < hyper_ch> !port-share
08:43 < hyper_ch> !ports
08:43 < hyper_ch> !port
08:43 < ecrist> "No keys matched that query" means that key doesn't exist.
08:43 < hyper_ch> :(
08:43 < ecrist> !factoids
08:43 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
08:44 < hyper_ch> hi ecrist
08:44 < ecrist> hi, hyper_ch 
08:44 < gladiatr> Captain, we seem to have attempted to access the part of the entity's brain that was damaged in the crash...
08:47 < gladiatr> ecrist, (gotcha)
08:48 < gladiatr> wasn't sure if the search element of factoids was a keyword search or a please-wait-while-i-grep-my-data-store thing
08:50 < gladiatr> yesterday at 4pm, the freenode #openvpn channel bot, known by its users as vpnHelper, was arrested after reports came in of it grepping itself in front of city hall...
08:52 -!- p3rror [~mezgani@41.140.169.225] has quit [Ping timeout: 240 seconds]
08:52 < ecrist> lol
09:05 -!- p3rror [~mezgani@41.140.24.80] has joined #openvpn
09:11 -!- macsppadic is now known as bruceleesppadic
09:14 -!- EugenA [~eugen@mnch-4d04f54a.pool.mediaWays.net] has quit [Remote host closed the connection]
09:14 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9286>
09:19 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Organize your IRC]
09:20 -!- p3rror [~mezgani@41.140.24.80] has quit [Ping timeout: 250 seconds]
09:21 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:22 -!- kaisukaru [~marie@84-50-137-232-dsl.rkv.estpak.ee] has joined #openvpn
09:22 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:23 < kaisukaru> Is there any good clean solution to add user route addition right in Win7 or Vista, without giving admin to the user?
09:24 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
09:24 -!- Cain` is now known as Cain
09:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
09:27 < kaisukaru> (Using smartcard)
09:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:31 < gladiatr> Not to my knowledge.  
09:33 < kaisukaru> What are the solutions: 1.) run as admin, 2.) with XP, if you added user to network admins, route addition worked, but not with win7?, 2.) if UAC is enabled, even if you are admin, routes are not added - what are recommended solutions?
09:34 < gladiatr> Hrm... Yeah.  Sorry.  I'm not familiar enough with the way windows7 and vista drop and/or elevate privileges to be able to help with this one :(
09:41 -!- kaisukaru [~marie@84-50-137-232-dsl.rkv.estpak.ee] has quit [Read error: Connection reset by peer]
09:44 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:51 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
09:52 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
09:54 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:18 -!- albech [~thomas@124.157.211.210] has quit [Quit: Ex-Chat]
10:24 -!- threedaymonk [~threedaym@surimi.vm.bytemark.co.uk] has joined #openvpn
10:24 < threedaymonk> !welcome
10:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:25 < threedaymonk> !goal
10:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:26 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:31 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
10:38 < threedaymonk> I'm trying to connect an Android device to a VPN. I've connected it to eth0 of a Linux box, which gives it a 10.0.0.0/24 IP address via DHCP. The Linux box is currently connected to the VPN via another interface; it's exposed as tun0. How would I best wire the two together, so that all the Android device's traffic goes via the VPN?
10:38 -!- djgerm [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving.]
10:39 <@dazo> threedaymonk: using openvpn on Android?
10:40 < threedaymonk> dazo: It looks as if that requires root
10:40 < threedaymonk> (which I don't have!)
10:41 <@dazo> threedaymonk: openvpn requires root to setup the tun/tap device and to add routes
10:41  * gladiatr cradles his N900 like a rich fat lady with a pug...
10:41 < threedaymonk> dazo: sorry, I mean using openvpn an Android requires root *on Android* - I have root on the linux box.
10:41 <@vpnHelper> RSS Update - forum: Server certificate expired. how to renew? <http://forums.openvpn.net/topic7525.html#p9287>
10:42 <@dazo> threedaymonk: you need root on the Android as well
10:42 <@dazo> however, if you're going through some kind of GUI on Andriod, that basically should take care of it
10:44 < threedaymonk> dazo: I'm looking for a way that doesn't involve rooting the androiddevice, which I can't do
10:44 <@dazo> threedaymonk: then you can't use openvpn
10:44 -!- aree [~chatzilla@bgl93-7-88-189-218-150.fbx.proxad.net] has joined #openvpn
10:44 < aree> hello there
10:45 < aree> openvpn is it work same as NAT ? 
10:45 <@dazo> aree: openvpn (or VPN in general) is not the same as NAT
10:46 < threedaymonk> @dazo: There is no way to use iptables or something like that to redirect the traffic?
10:46 < aree> for assigning ip 
10:47 <@dazo> threedaymonk: you need to setup a tun/tap device with openvpn, that requires root access.  Further if tun.ko is not loaded (a kernel module), that needs to be loaded which requires root privileges ... and to run route commands as well, again requires root access ... even running iptables requires root access
10:47 < threedaymonk> @dazo I have root access on the Linux box
10:47 -!- kyrix [~ashley@c-67-160-84-118.hsd1.wa.comcast.net] has joined #openvpn
10:48 <@dazo> aree: VPN can more be compared to as a virtual network interface + cable ... where you get access to an internal network, and the traffic between the client and server is encrypted (normally, at least)
10:48 <@dazo> aree: NAT has also nothing to do with assigning IP addresses
10:49 <@dazo> aree: NAT is used to use (or hide) a private internal network behind one public IP address ... so that everyone on the inside is using the same public IP address when accessing Internet services
10:50 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
10:50 <@dazo> (a private internal network can mean LAN or VPN)
10:50 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
10:50 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
10:50 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
10:51 < aree> well i try to explain  my problem i got a public IP on a pc without router with nat setting on my vbox, host ubuntu guest centos ayecee schnuffle sacarlson 
10:51 < aree> well i try to explain  my problem i got a public IP on a pc without router with nat setting on my vbox, host ubuntu guest centos 
10:52 <@dazo> threedaymonk: but you wanted to use openvpn on Android as a client to a openvpn server?  if so, then also the openvpn client on Android need root privileges ... there is no way around that
10:52 <@dazo> aree: and you want your centos guest to access the Internet?
10:52 < aree> not a real centos a customize one, 
10:52 <@dazo> (via the Ubuntu host?)
10:52 < threedaymonk> dazo: No, I think you've misunderstood. I want to use the Linux box to connect the [black box with an ethernet cable] to the VPN.
10:53 <@dazo> threedaymonk: OpenVPN will work in that case ... All OpenVPN needs is a working Internet connection
10:53 <@dazo> but it needs to be started with root privileges
10:54 < threedaymonk> dazo: That's what I thought! :-) What I'm not clear on is how to route traffic between the two interfaces
10:54 <@dazo> threedaymonk: between which interfaces?
10:54 < aree> that customize Centos working on a web based interface, well on my ubuntu pc i got a Public IP which  something like : 82.198.X.X on centos i got an IP something like 10.0.2.15
10:54 < threedaymonk> dazo: essentially, between eth0 and tun0 on the linux box.
10:55 < threedaymonk> so that a device connected to eth0 seamlessly appears to be on the VPN
10:55 <@dazo> aree: this is not much openvpn related at all ... but you need to enable a NAT rule for on the Ubuntu box, to allow that ... I would probably recommend you to search help via some Ubuntu channels or forums
10:56 <@dazo> aree: I don't know how Ubuntu does their firewalling stuff nowadays ... and the ufw stuff was more confusing than usable for me when I tried that 2 years ago ... I've not been using Ubuntu since the Ibix release
10:56 < aree> let me finish ,       :) from ubuntu web browser if i put this IP 10.0.2.15 i can't able to display that customize OS web page
10:56 <@dazo> aree: this is still ubuntu stuff
10:57 < threedaymonk> dazo: at the moment, I've set up a DHCP server on eth0 to give the [black box] an IP address, but I don't know if that's necessarily the best start.
10:57 <@dazo> threedaymonk: you need to setup default routing ... to route traffic from wherever to your VPN network via your openvpn server
10:58 < threedaymonk> dazo: would that need to be done on the VPN server, or can I do it on this local linux machine?
10:58 <@dazo> sorry, not default routing ... but you need to set up *some* routing
10:59 <@dazo> threedaymonk: you need to do that on the default gateway in your network where your openvpn client is configured ... or on all the boxes which will use resources over the VPN
10:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:00 <@dazo> threedaymonk: you also need to do add some routes on the server side too, so that there are routes from the server side and back to your network behind your client
11:00 <@dazo> !route
11:00 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
11:00 <@dazo> threedaymonk: ^^
11:01 < threedaymonk> Would LAN behind OpenVPN in that case refer to LAN <---> OpenVPN server <---> internet or My computer <---> Internet <---> OpenVPN server <---> LAN ? It's the former that I want
11:02 < threedaymonk> I looked at that page earlier and it seemed to be the latter
11:05 <@dazo> threedaymonk: basically .... LAN-A <---> OpenVPN client <---> Internet <---> OpenVPN server <---> LAN-B
11:06 <@dazo> so to access LAN-B from LAN-A, you need basic routing ... LAN-A need to have routes stating the network of LAN-B with the OpenVPN client as the gateway
11:06 -!- gryzli [~gryzli@94.155.42.130] has joined #openvpn
11:06 <@dazo> LAN-B will need a reverse routing, where it will need to know the LAN-A network address and use OpenVPN server IP address as the the gateway
11:07 < threedaymonk> In my case, there's only LAN-A - it's a VPN to the internet
11:07 <@dazo> threedaymonk: that makes it to some degree simpler
11:07 <@dazo> as OpenVPN server will then need to NAT the outgoing traffic
11:08 < threedaymonk> which it already does, I think
11:08 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:08 <@dazo> threedaymonk: then you basically need to read up about --redirect-gateway in the man page
11:09 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
11:09 <@dazo> you just need that on the OpenVPN client side ... that will take care of setting up needed default routes on your OpenVPN client, which will route everything via the tunnel
11:10 -!- bruceleesppadic [~sonupunno@88.211.55.77] has left #openvpn []
11:10 < threedaymonk> so then, as long as my black box is using that device as the gateway, it should work
11:10 < threedaymonk> thanks, that's really helpful
11:10 < threedaymonk> I'll try it ...
11:11 <@dazo> threedaymonk: yeah, basically ... --redirect-gateway does setup some special routes, so that the traffic between the OpenVPN client and server is not trying to go through the tunnel ... and everything else goes through the tunnel
11:11 -!- WinstonSmith [~true@e177095131.adsl.alicedsl.de] has joined #openvpn
11:12 < threedaymonk> yes, I saw the mention about loops - that makes sense :-)
11:23 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:56 -!- WinstonSmith [~true@e177095131.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
12:10 -!- kyrix [~ashley@c-67-160-84-118.hsd1.wa.comcast.net] has quit [Ping timeout: 240 seconds]
12:10 -!- prettyrobots [~alan@66.93.0.189] has joined #openvpn
12:11 < prettyrobots> Can I use Open VPN to make a connection, like MySQL port 3306, encrypted transparently?
12:11 < prettyrobots> MySQL doesn't need to know anything.
12:11 -!- dazo is now known as dazo_afk
12:16 < ecrist> yes
12:22 < reiffert> Did anyone read up what Lantizia and I were discussing approx 12 hours ago?
12:23 < reiffert> Is it me who doesnt see a problem or was it him?
12:23 < reiffert> I need some input on this please.
12:23  * ecrist reads up
12:26 < ecrist> he was a dick, but I think I understand what he was getting after
12:26 < ecrist> !diagram
12:26 <@vpnHelper> "diagram" is You can use a site such as http://gliffy.com to create a network diagram as well as programs such as Visio, Dia, or OmniGraffle
12:30 -!- Flecks [~kvirc@95.68.37.7] has joined #openvpn
12:30 < Flecks> hello, made some tests with vpn etc...
12:31 < Flecks> i have 100mbit/sec connection on vpn server side and 200mbit/sec on client side
12:31 < ecrist> reiffert: http://secure-computing.net/files/maybe.png
12:31 < Flecks> in server side i have webserver in lan, i have also port forward in router
12:32 < Flecks> so when i download direct from webserver i get 5.7MB/sec
12:32 < Flecks> when i download trough vpn - i get only 3.2MB/sec
12:33 < Flecks> using SMB - i get only 700KB/sec
12:35 -!- prettyrobots [~alan@66.93.0.189] has quit [Quit: prettyrobots]
12:37 < gladiatr> Flecks, are your internet connections symmetrical? 
12:39 < Flecks> yes +/-...
12:39 < Flecks> but server is PIII 930Mhz
12:39 < Flecks> and when i copy files - i get 90+ CPU usage for openvpn process
12:39 < ecrist> Flecks: that seems odd
12:40 < gladiatr> indeed
12:40 < ecrist> our entire company uses an Dell PE 1650 with a single PIII at 1.113GHz
12:40 < Flecks> thats the problem?
12:40 < ecrist> and we use that to connect an entire office
12:40 < ecrist> we easily use 5+ Mbps
12:40 < Flecks> if i disable compression will this incrase speed?
12:41 < ecrist> you can try
12:41 < ecrist> we don't use compression here.
12:41 < Flecks> 5mbps is slow - i am talking about 5MBps here
12:41 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:42 < ecrist> it's only a decimal place of difference
12:48 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 265 seconds]
12:48 < Flecks> yeah, u r right ecrist, that didnt change anything
13:00 < Flecks> thx everyone, will try to set up server on faster pc
13:00 < reiffert> ecrist: yeah it looks what he was after, but I still think that routing would have solved his problem.
13:00 < reiffert> ecrist: allthough he didnt realize that.
13:00 < ecrist> oh, most definately
13:00 < ecrist> also, he was still an ass.
13:00 < ecrist> even vpnHelper thought so
13:01 -!- Flecks [~kvirc@95.68.37.7] has quit [Quit: KVIrc 4.1.1 Equilibrium http://www.kvirc.net/]
13:01 < gladiatr> did vpnHelper oh-so-slightly urinate on his shoes?
13:01 < ecrist> 01:57 -!- Lantizia was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.
13:02 < gladiatr> pow
13:02 -!- s7r [~s7r@94.198.100.92] has left #openvpn []
13:02 < reiffert> ecrist: thanks for having a look.
13:02 < ecrist> reiffert: your nat suggestion was the right answer, imho
13:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
13:13 < aree> oh ecrist the dangerous 
13:13 -!- aree [~chatzilla@bgl93-7-88-189-218-150.fbx.proxad.net] has left #openvpn []
13:16 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- In tests, 0x09 out of 0x0A l33t h4x0rz prefer it :)]
13:16 < ecrist> what?
13:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:31 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
13:46 -!- kentr [~Kent@adsl-99-38-177-206.dsl.pltn13.sbcglobal.net] has joined #openvpn
14:04 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Read error: Connection reset by peer]
14:14 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
14:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:43 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:43 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
14:53 -!- p3rror [~mezgani@41.140.98.151] has joined #openvpn
14:57 -!- hpa [hpa@terminus.zytor.com] has quit [Excess Flood]
14:58 -!- p3rror [~mezgani@41.140.98.151] has quit [Ping timeout: 240 seconds]
14:58 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
14:59 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
15:14 -!- p3rror [~mezgani@41.140.180.125] has joined #openvpn
15:19 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:26 -!- Malard [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
15:26 -!- Malard [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
15:26 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
15:32 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 276 seconds]
15:37 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 276 seconds]
15:39 -!- adawda is now known as sia^pwnnt
15:41 -!- p3rror [~mezgani@41.140.180.125] has quit [Ping timeout: 240 seconds]
15:49 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
15:54 -!- p3rror [~mezgani@41.140.178.209] has joined #openvpn
15:56 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
16:03 -!- gryzli [~gryzli@94.155.42.130] has quit [Quit: Leaving]
16:08 -!- p3rror [~mezgani@41.140.178.209] has quit [Ping timeout: 260 seconds]
16:13 <@vpnHelper> RSS Update - forum: TAP-Win32 connection unplugged <http://forums.openvpn.net/topic7538.html>
16:20 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:20 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
16:20 < Fleck> hey again
16:21 < Fleck> i have set up openvpn on better box, now when copy files trought tunnel, i get 10% cpu usage, still the speed is very slow
16:21 < Fleck> 3MB/sec
16:21 < Fleck> without vpn 12MB/sec
16:22 < Fleck> using http
16:22 < krzee> play with MTU
16:22 < krzee> !mtu
16:22 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
16:23 < Fleck> tried to set tun-mtu to 1500 and fragment to 1300
16:24 < ecrist> EmperorTom wrote a good mtu doc at that link above.
16:24 < ecrist> hey krzee, how goes vacation?
16:26 < Dougy> im tired as balls
16:26 < Dougy> good god
16:27 -!- p3rror [~mezgani@41.140.152.31] has joined #openvpn
16:28 < krzee> Fleck, but did you try testing what your actual MTU is?
16:28 < Fleck> in ifconfig i see 1500
16:29 < krzee> see #2 above
16:29 < Fleck> i did
16:30 -!- kentr [~Kent@adsl-99-38-177-206.dsl.pltn13.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:31 < krzee> ecrist, going well!
16:31 -!- kentr [~Kent@adsl-99-38-177-206.dsl.pltn13.sbcglobal.net] has joined #openvpn
16:31 -!- kentr is now known as kentr_away
16:31 < Fleck> when i start openvpn server i get strange line
16:31 < Fleck> Wed Jan 19 00:30:54 2011 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
16:31 < Fleck> 1576??
16:31 < ecrist> looks right
16:32 < krzee> Fleck, did you test your mtu as shown in #2 above?
16:32 < Fleck> krzee the problems is i can run tests on server side only
16:33 < Fleck> cannot connect to client at the moment
16:34 < krzee> because the vpn is not working or does the client not listen on the vpn address?
16:34 < Fleck> couse all clients are offline now
16:34 < krzee> i figure you should be able to get access to run tests from client since it can xfer files
16:34 < krzee> ahh
16:35 < Fleck> its midnight :D
16:38 < Fleck> maxevents=1028 << thats cool?
16:39 < Fleck> !slow
16:40 < Fleck> the only problem can be - is MTU?
16:40 < krzee> you use udp or tcp?
16:40 < Fleck> tried udp and tcp too
16:40 < Fleck> speed dosnt change
16:42 -!- p3rror [~mezgani@41.140.152.31] has quit [Read error: Connection reset by peer]
16:42 -!- Malard [~ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
16:42 -!- Malard [~ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
16:42 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
16:43 -!- kentr_away is now known as kentr
16:45  * Fleck scratches head\
16:46 < krzee> use udp and test mtu tomorrow when clients are on
16:46 < Fleck> tried today
16:46 < Fleck> got 1573
16:46 < reiffert> what openvpn version?
16:46 < krzee> nono, test it like in #2 above
16:47 < Fleck> OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 12 2010
16:47 < Fleck> server
16:47 < reiffert> ancient.
16:47 < Fleck> clients ar latest stable windows gui
16:48 < Fleck> reiffert so you say old versions where slow?
16:48 < reiffert> updating is worth a try.
16:50 < krzee> wait you said udp and tcp
16:50 < krzee> but also said
16:50 < krzee> [14:22]  <Fleck> using http
16:50 < krzee> what http proxy allows udp??
16:50 < Fleck> noo
16:50 < Fleck> not that way :)
16:50 < Fleck> using http i tested speed
16:51 < krzee> ahh
16:51 < Fleck> cause with http i can try with and without vpn (port forward)
16:51 < krzee> i use iperf
16:51 < krzee> but i dont have windows
16:52 < krzee> (which explains why its so dark here)
16:52 < Fleck> lol
16:52 -!- krzee [krzee@openvpn/community/support/krzee] has left #openvpn []
16:52 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:53 < krzee> ecrist, do we still have the onjoin set to ##openvpn?
16:54 < Fleck> reiffert OpenVPN 2.2-beta5 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Dec  4 2010 <<< better? :D
16:55 < Fleck> btw have one more question
16:55 < Fleck> i have built keys for many clients
16:55 < Fleck> now one goes away and i need to delete it
16:55 < Fleck> how can i do that?
16:56 < Fleck> !delete keys
16:57 < Fleck> TUN/TAP TX queue length set to 100 << this is cool?
16:57 -!- p3rror [~mezgani@41.140.168.37] has joined #openvpn
16:57 < krzee> !factoids
16:57 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:02 -!- ElitestFX [~ElitestFX@unaffiliated/elitestfx] has joined #openvpn
17:02 < ElitestFX> Hi
17:03 < ElitestFX> TLS: soft reset sec=0 bytes=19444637/0 pkts=47261/0
17:03 < ElitestFX> anyone know how to make it so openvpn does get killed?
17:06 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 272 seconds]
17:06 < Bushmills> !revoke
17:07 < Bushmills> !revoke-full
17:08 < ElitestFX> huh?
17:08 < ElitestFX> oh, that's a channel command
17:09 < reiffert> !revoke
17:09 < reiffert> !factoids search revoke
17:09 <@vpnHelper> No keys matched that query.
17:09 < reiffert> !factoids search --values revoke
17:09 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
17:09 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
17:10 < reiffert> !learn revoke as [crl]
17:10 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
17:11 < Fleck> :D
17:11 < reiffert> krzee: is [factoid] a reference, or a copy?
17:13 < Fleck> so i do ./revoke-full client ?
17:13 < reiffert> dont forget to source the vars file
17:14 < reiffert> 00:14 [fn] -!- Cannot join to channel ##openvpn (You must be invited)
17:14 < Fleck> ok thx reiffert 
17:14 < Fleck> what kind of bot is vpnHelper ?
17:14 < reiffert> supi
17:14 < Fleck> thx
17:16 < Fleck> cant find such bot in google ;P
17:18 < reiffert> supy
17:19 < Fleck> ok thx reiffert again...!
17:22 < krzee> reiffert, its output from a script ecrist runs from time to time
17:26 < reiffert> krzee: nah, when using !lear foo as [bar], is [bar] a copy of !bar, or is it a reference to !bar?
17:27 < krzee> copy
17:31 < reiffert> thats bad for cases where the content of !bar changes
17:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:43 < ecrist> the output to the webpage is generated from a copy of the factoids database that is scp'd from the host vpnHelper is on to my web server
17:53 -!- p3rror [~mezgani@41.140.168.37] has quit [Ping timeout: 240 seconds]
17:56 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
18:10 -!- WinstonSmith [~true@dslb-088-073-111-064.pools.arcor-ip.net] has joined #openvpn
18:15 -!- WinstonSmith [~true@dslb-088-073-111-064.pools.arcor-ip.net] has quit [Ping timeout: 264 seconds]
18:15 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
18:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:28 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
18:28 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
18:33 -!- WinstonSmith [~true@f052098117.adsl.alicedsl.de] has joined #openvpn
18:33 -!- p3rror [~mezgani@41.140.98.175] has joined #openvpn
18:39 -!- p3rror [~mezgani@41.140.98.175] has quit [Ping timeout: 240 seconds]
19:18 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:36 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit []
19:42 -!- prettyrobots [~alan@66.93.0.189] has joined #openvpn
19:45 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
20:05 -!- teddz_ [~teddz@dtmd-4d0bfe47.pool.mediaWays.net] has quit [Quit: Ex-Chat]
20:30 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:39 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
20:39 <@vpnHelper> RSS Update - forum: OpenVPN GUI and the management port <http://forums.openvpn.net/topic7539.html>
21:02 < theDoc> Guys, question on salting passwords in a db.
21:02 < theDoc> Doesn't the salt have to be stored in the db itself and if the db is breached, wouldn't that put all the passwords at risk?
21:14 -!- prettyrobots [~alan@66.93.0.189] has quit [Quit: prettyrobots]
21:29 -!- kentr [~Kent@adsl-99-38-177-206.dsl.pltn13.sbcglobal.net] has quit [Quit: kentr]
22:08 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
22:09 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
22:11 -!- boojit [~boojit@67-4-149-89.mpls.qwest.net] has joined #openvpn
22:12 < boojit> exit
22:12 -!- boojit [~boojit@67-4-149-89.mpls.qwest.net] has quit [Client Quit]
22:13 -!- boojit [~boojit@67-4-149-89.mpls.qwest.net] has joined #openvpn
22:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
22:52 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
22:54 < mosno> i am generating the vpn server cert and key with build-key-server. why does the openvpn documentation say to run "./build-key-server server" instead of "./build-key-server --server MyActualCommonName"?
22:54 < mosno> oh
22:54 < mosno> nevermind, i didn't think to read the script. anyway, i ran "./build-key-server TheCN"
22:56 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
22:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:25 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
23:36 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
23:54 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 260 seconds]
--- Day changed Wed Jan 19 2011
00:11 -!- dazo_afk is now known as dazo
00:21 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Remote host closed the connection]
00:25 -!- Netsplit *.net <-> *.split quits: oc80z, MJD, diphthong, _zero_, mosno, @dazo, smerz, derekv, Meliorator, rot13,  (+16 more, use /NETSPLIT to show all of them)
00:26 -!- ucekpolish1 [user@hq.ostc-pl.com] has joined #openvpn
00:29 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
00:29 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
00:31 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
00:31 -!- renihs_ [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
00:32 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
01:19 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:32 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
01:57 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:27 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
02:27 -!- d12fk [~heiko@vpn.astaro.de] has joined #openvpn
02:27 -!- katoen [ce024205a3@xs8.xs4all.nl] has joined #openvpn
02:27 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
02:27 -!- sbrath [~sbrath@unaffiliated/sbrath] has joined #openvpn
02:27 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
02:27 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
02:27 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
02:27 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
02:27 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
02:27 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
02:27 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
02:27 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
02:27 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
02:27 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
02:27 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
02:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
02:27 -!- holistah [~ryan@108-66-219-113.uvs.irvnca.sbcglobal.net] has joined #openvpn
02:27 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
02:27 -!- rot13 [~var@unaffiliated/rot13] has joined #openvpn
02:27 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
02:27 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
02:27 -!- Meliorator [~m@dunnington.eu] has joined #openvpn
02:27 -!- ServerMode/#openvpn [+o dazo] by niven.freenode.net
02:31 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
02:34 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
02:47 <@vpnHelper> RSS Update - forum: TAP-Win32 connection unplugged <http://forums.openvpn.net/topic7538.html#p9290>
03:10 < Fleck> !mtu
03:10 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
03:14 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
03:14 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
03:14 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
03:18 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:20 < macsppadic> morning all
03:21 < theDoc> question guys, is md5sum and md5("string") in php different?
03:21 < theDoc> We're seeing a different outputs on the same string.
03:22 < macsppadic> that wouldnt surprise me theDoc 
03:22 < macsppadic> its php
03:22 < macsppadic> :-)
03:22 < theDoc> macsppadic: Oh good god, which one do I trust then?
03:23 < macsppadic> http://blog.sam-pointer.com/2010/01/26/md5sum-vs-phps-md5-function
03:23 <@vpnHelper> Title: md5sum vs. PHP's md5() function (at blog.sam-pointer.com)
03:23 < hyper_ch> theDoc: does one return capitals and the other one doesn't?
03:23 < theDoc> hyper_ch: Both lower case.
03:24 < theDoc> wtfphp
03:25 < macsppadic> i rest my case 
03:25  * macsppadic has had nightmares upgrading phpbb
03:25 < theDoc> Now I just need to figure out which one to use for my radius deployment.
03:25 < macsppadic> sorry theDoc  not sure if that link helps you but just making you aware of the nature of the beast 
03:25 < hyper_ch> so php does it correctly and bash doesn't
03:25 < theDoc> macsppadic: It did.
03:26 < macsppadic> apparently 
03:26 < theDoc> hyper_ch: Yep, that's right.
03:26 < hyper_ch> interesting
03:26 < macsppadic> yeah 
03:26 < hyper_ch> and if you md5sum a file in bash and in php
03:26 < hyper_ch> no special switches needed?
03:26 < macsppadic> hyper_ch: never tested that out 
03:27 < theDoc> hyper_ch: You'll need to use -n for new line in bash.
03:27 < theDoc> php you can just md5("string")
03:27 < hyper_ch> php <3
03:27 < macsppadic> theDoc: what version of php is it ?
03:27 < theDoc> I can't believe no one has patched it.
03:27 < theDoc> macsppadic: 5
03:28 < macsppadic> ok so its not like an older version or something 
03:28 < theDoc> It gave me a massive WTF moment, :D
03:28 < macsppadic> trust me 
03:28 < macsppadic> it blew my mind wheni found that 
03:28 < macsppadic> :-D
03:28 < theDoc> macsppadic: Well, it's a bash problem, not so much of a php one.
03:28 < theDoc> macsppadic: My mind = blown now. I was running around making sure that I typed in md5sum correctly, :(
03:28 < macsppadic> but it drives u mad when u discover stuff like that afer spending hours try to debug the issue 
03:29 < theDoc> Tell me about it, I'm fixing my radius box and this has to happen.
03:29 < macsppadic> hehe
03:29 < theDoc> It gave me a wtf moment, along with the web developer.
03:29 < macsppadic> theDoc: i feel ur pain bro 
03:29 < macsppadic> hehee
03:29 < theDoc> and I was like, md5 is broken?!?!? WTF?!?!
03:29 < macsppadic> http://andrey.mikhalchuk.com/2008/02/04/why-nix-md5sum-and-php-md5-do-not-match.html
03:29 < reiffert> You all didnt play with md5 yet, right?
03:30 < reiffert> or with hexdump.
03:30 < reiffert> or what is a line break, yeah
03:30 < reiffert> this is #openvpn.
03:31 < macsppadic> reiffert: apologies yes this is not the channel for php cursing 
03:31 < theDoc> reiffert: Seldom, I usually use it to make sure my files are ok.
03:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
03:40 < Fleck> ok guys, with ping i get -s set max to 1472, with 1473 i get fragnentation error message
03:40 < reiffert> 1472 over the tunnel or outside?
03:41 < Fleck> tunel
03:49 -!- master_of_master [~master_of@p57B55AE7.dip.t-dialin.net] has quit [Read error: Operation timed out]
03:49 < reiffert> theDoc: md5 is definitly broken. You can find colission easily. That is you can pad whatever text foo, to have the same md5 value like text bar.
03:50 < theDoc> Hrrm.
03:50 < reiffert> http://www.mscs.dal.ca/~selinger/md5collision/
03:50 <@vpnHelper> Title: Peter Selinger: MD5 Collision Demo (at www.mscs.dal.ca)
03:52 < macsppadic> bloody ell 
03:53 -!- master_of_master [~master_of@p57B52CCB.dip.t-dialin.net] has joined #openvpn
03:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
03:56 < Fleck> reiffert from client to server 1472 and from server to client 1472 too
03:57 < Fleck> inside or outside dosnt matter
03:58 < Fleck> so i guess my problem is not mtu
03:59 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
04:00 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
04:01 -!- mode/#openvpn [+o mattock] by ChanServ
04:01 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 265 seconds]
04:01 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
04:02 -!- boojit [~boojit@67-4-149-89.mpls.qwest.net] has quit [Ping timeout: 264 seconds]
04:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:10 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
04:11 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:25 -!- alhadi [~thunderst@92.99.129.36] has joined #openvpn
04:25 -!- alhadi [~thunderst@92.99.129.36] has quit [Changing host]
04:25 -!- alhadi [~thunderst@unaffiliated/alhadi] has joined #openvpn
04:41 -!- dazo is now known as dazo_afk
04:46 -!- rot13 [~var@unaffiliated/rot13] has quit [Ping timeout: 276 seconds]
04:48 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
04:49 < Fleck> reiffert ok so, over tunnel - i get 5.2MB/sec downloading file with http
04:49 < Fleck> without vpn 11MB/sec :/
04:50 -!- common [~common@p5DDA48B3.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
04:52 -!- common [~common@p5DDA484C.dip0.t-ipconnect.de] has joined #openvpn
04:53 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 246 seconds]
04:53 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
04:54 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
04:59 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
05:01 < Fleck> anyone?? :(
05:06 <@vpnHelper> RSS Update - forum: configure open vpn file <http://forums.openvpn.net/topic7534.html#p9291>
05:11 < Fleck> !factoids search slow
05:11 <@vpnHelper> No keys matched that query.
05:11 < macsppadic> hey there Fleck whats up ?
05:12 < Fleck> macsppadic vpn slow :(
05:12 < Fleck> over tunnel - i get 5.2MB/sec downloading file with http
05:12 < Fleck> without vpn 11MB/sec :/
05:12 < macsppadic> whoa
05:12 < macsppadic> hmm 
05:12 < Fleck> thats 2x slower
05:12 < macsppadic> any traffic shaping happening for vpn data?
05:12 < macsppadic> within firewall or some such goodness
05:13 < Fleck> nope i dont have any traffic shaping 
05:13 < macsppadic> ok that s odd
05:14 < macsppadic> Fleck so tun or tap interface?
05:15 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
05:15 < macsppadic> thats odd 
05:15 < macsppadic> 2x speed reduction 
05:15 < Fleck> tap
05:18 < Fleck> no QoS enabled and no firewall enabled on router
05:20 < Fleck> any ideas guys?
05:20 < macsppadic> must confess cant think of any - 
05:21 < rjd_> could it not be the isp prioritizing down udp streams
05:21 < Fleck> i can try set vpn to listen on 80 port, maybe 1194 gets shaped in ISP somewhere
05:21 < rjd_> or something?
05:21 < macsppadic> rjd_: yes that could be 
05:21 < rjd_> test tcp over port 80 
05:21 < Fleck> ok!
05:21 < rjd_> and possibly udp over 53 :)
05:21 < macsppadic> :-)
05:21 < Fleck> hehe
05:21 < Fleck> ok
05:22 < rjd_> where is the vpn server, and from where are you testing the speed?
05:23 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:23 < Fleck> what do you mean by - where
05:24 < rjd_> geographical location
05:24 < rjd_> far away from you?
05:24 < rjd_> across the atlantic? :)
05:24 < Fleck> nope few KM
05:24 < rjd_> in the building next to you?
05:24 < Fleck> 5 max
05:25 < rjd_> and on the server itself you get how much in your test of speed?
05:25 < rjd_> and what do you test? some tcp download or a speedtest site?
05:26 < Fleck> rjd_ ok in server side i have router and in LAN i have one linux PC with openVPN server installed
05:27 < Fleck> on the same box i have web server
05:28 < Fleck> i have set up port forwarding to that webserver
05:28 < rjd_> and its from that web server you try to get the file?
05:28 < Fleck> now client has router and linux pc in lan
05:28 < Fleck> when from client side i download file from my webserver with portforwarding - i get 11MB/sec speed
05:28 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:28 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:28 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:28 < Fleck> if i do that over tunnel - i get 5.2MB/sec max
05:29 < rjd_> ok. test vpn over port 80 (or perhaps 443) and tcp
05:29 < Fleck> ok
05:29 < rjd_> dont know how much extra overhead the tcp over tcp will be, but I think you shoud be able to get about 75-80%
05:29 < rjd_> you already controlled that it's not lack of cpu resources on the vpn server?
05:29 < Fleck> udp is better?
05:29 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
05:30 < rjd_> yes,. because with tcp its tcp over tcp
05:30 < rjd_> pretty much an ack per ack or something :p
05:30 < Fleck> rjd_ when downloading over tunnel - openvpn "eats" about 20% CPU
05:30 < rjd_> transmission control.. on packets that already are transmission controlled..
05:31 < rjd_> ok, is it a quad core?
05:31 < Fleck> nope dual
05:31 < rjd_> ok
05:31 < Fleck> clients PC is laptop, also dual core
05:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Client Quit]
05:35 < theDoc> Ok, any radius monkeys in here? :)
05:37 < macsppadic> Fleck: yes with tcp over tcp - ack hell - can be problematic 
05:38 < macsppadic> theDoc: i know of it 
05:38 < macsppadic> probably just left the ocean in evolutionary terms tho as regards RADIUS
05:39 < theDoc> lmao
05:39 < theDoc> macsppadic: I just want to know, using SMD5-Password, what is the correct format of specifying the hash + salt?
05:39 < theDoc> is it supposed to be like, hash:salt or something?
05:40 < theDoc> and fuck google, there's almost nothing on that topic.
05:40 < macsppadic> doh- just googled 
05:40 < macsppadic> :-)
05:41 < theDoc> macsppadic: lmao, there's little to no information on the correct entry of hash + salt in sql.
05:41 < theDoc> I'm almost certain you can't just throw everything into the db and expect it to work.
05:42 < theDoc> That's my last problem.
05:42 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:43 < macsppadic> theDoc: forgive my ignorance - so RADIUS set to look at db and u have got SMD5 as the hash function 
05:44 < theDoc> macsppadic: SMD5 as the attribute.
05:44 < macsppadic> silly me 
05:44 < theDoc> Well, the passwords were basically md5($salt,$password)
05:44 < theDoc> of course, the salt is a static salt.
05:44 < theDoc> :D
05:45 < cpm> someone please pass the salt
05:45 < macsppadic> :-)
05:46 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
05:47 < Fleck> seems that client cant connect to udp 53, maybe udp 53 get redirected to isps DNS servers
05:47 < theDoc> grr.
05:48 < theDoc> This is the last effin' problem I have with radius.
05:48 < theDoc> @_@
05:48 < Fleck> anyway 1194 with udp was a bit faster, got 5.6MB/sec
05:48 < macsppadic> just trying to refresh my memory on RADIUS theDoc 
05:48 < macsppadic> :-)
05:48 < macsppadic> only tried it a while back n never botehred with it 
05:48 < theDoc> macsppadic: Well, please let me know if anything comes to mind, :P
05:48 < macsppadic> hehee
05:48 < macsppadic> i wonder why i never went back
05:48 < macsppadic> :-P
05:49 < Fleck> ohh no, my bad, 1153 port was on client side, ok so, no difference with port 53 udp, same ~ 5.6MB/sec
05:50 < theDoc> lmao
05:50 < theDoc> This radius documentation is skimpy as hell.
05:50 < macsppadic> yes that does bring back memories
05:50 < macsppadic> wasnt there something about particular authentication schemes PAP Or some such madness?
05:51 < macsppadic> blimey twas a while ago 
05:51 < theDoc> macsppadic: I have that sorted.
05:51 < macsppadic> ahh ok 
05:51 < theDoc> Only problem once again, is that the passwords don't match because I have no clue how to insert the salt into the db
05:51 < theDoc> :\
05:54 < Fleck> tcp 80 - same problem, 5.2MB/sec
05:54 < Fleck> seems that there is no ISP shaping going on
05:54 < Fleck> something else
05:56 < theDoc> 5.2MB, that's 40mbit! OMG! *waggles*
05:57 < Fleck> udp 5.6MB/sec
05:58 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
05:58 < Fleck> is there simpler encryption methods that don't "eat" so much cpu resources?
05:58 < macsppadic> theDoc:  found a trail here 
05:58 < macsppadic> http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg26079.html
05:58 <@vpnHelper> Title: RE: FreeRadius + MySQL & Encrypted passwords (at www.mail-archive.com)
05:59 < Fleck> laptops openvpn process is at 68% 
05:59 < macsppadic> doubt thats the one tho 
05:59 < theDoc> macsppadic: Yeah, I saw that already
05:59 < theDoc> :\
05:59 < theDoc> It isn't.
05:59  * theDoc twiddles his ears.
06:00 < macsppadic> yes now i remember why i hated this 
06:00 < macsppadic> bleeding lack of doc
06:01 < theDoc> lmao
06:01 < macsppadic> as per docs SMD5-Password is attribute - oh look it says its got with a salt as well 
06:01 < theDoc> Precisely but no one says how to format that string in the database!
06:01 < theDoc> That's my problem.
06:01 < macsppadic> what db are you using?
06:01 < theDoc> mysql
06:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:06 < Fleck> !password-only
06:06 <@vpnHelper> "password-only" is http://openvpn.net/archive/openvpn-users/2004-10/msg00418.html
06:07 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
06:07 <@vpnHelper> RSS Update - forum: Need help with OpenVPN setup <http://forums.openvpn.net/topic7540.html>
06:09 < macsppadic> theDoc: am sure u probably checked but just asking - in radius sql module any thing  that could possibly help?
06:10 < Fleck> so guys any ideas what to try next? :(
06:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:27 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
06:31 < gladiatr> Fleck, good morning :)   I was scanning your conversation here... you are essentially reporting that your throughput from the client is around 50% of a direct connection.  What sort of connection is the client using?
06:31 < Fleck> optic
06:31 < Fleck> 200Mbit/sec
06:31 < Fleck> i have optic 100Mbit/sec
06:33 < gladiatr> nice.  Was curious... what you're observing is common with asymmetrical client connections
06:35 < Fleck> well i have more or less symmetrical connections
06:36 < Fleck> anyway for asymmetrical - any fix? i can try that
06:38 < gladiatr> Not really.  It comes down to the tunnel is only going to operate as fast as the packets that maintain it move over the internet.
06:38 < Fleck> so what can i do now?
06:39 < gladiatr> One thing you might try, just to rule out this as a possibility (and if you are able) is to set up a client system on the same VLAN or network that your VPN server is connected to.
06:40 < Fleck> ohh btw i did with another client
06:40 < Fleck> with that clients we have symmetrical 100/100 im sure
06:40 < Fleck> same problem
06:41 < Fleck> anyway i dont have such difference between upload and download - thats for sure
06:41 < Fleck> not 50%
06:42 < Fleck> maybe 20%...
06:45 < gladiatr> hrm...
06:45 < gladiatr> Are you able to set things up for a local test?
06:46 < Fleck> sure i could try that
06:46 < Fleck> and if the same results?
06:46 -!- corretico [~laguilar@201.201.44.82] has quit [Remote host closed the connection]
06:47 < gladiatr> I will think on that while drinking my coffee :)
06:48 < Fleck> ;p
06:54 < Fleck> gladiatr ok
06:54 < Fleck> same thing :)
06:54 < Fleck> slow i mean
06:54 < gladiatr> hrm...
06:55 < Fleck> 4.6MB/sec
06:55 < gladiatr> and this is a routed/tun connection, yes?
06:55 < Fleck> yes, over tunnel
06:55 < gladiatr> (that's still not shabby, but I understand your concern with the speed difference)
06:55 < Fleck> direct 10+ MB/sec
06:57 < gladiatr> hrm.  what was the result of the mtu tests that you ran?
06:58 < Fleck> 1472 with ping
06:58 < Fleck> so +20 +8 = 1500
06:59 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
06:59 < gladiatr> Roger that.  At the moment, I've got nothin'.  I'll let this float around for a bit.  If anything occurs to me, I'll ping you with it. :\  
07:00 < Fleck> downloads stops locally
07:00 < Fleck> that points to mtu problem, right?
07:01 < gladiatr> what do you mean--stops locally?
07:01 < Fleck> btw locally vpnserver is with gigabit link (gigabit switch and card), but laptop local is 100mbit card so 100mbit link
07:02 < Fleck> stops, suddenly reports - downloaded :D
07:02 < gladiatr> still shouldn't be an issue.  Are you running jumbo frames on that switch?
07:02 < Fleck> dunno, thats simple home switch
07:02 < Fleck> with no management etc
07:02 < gladiatr> Ah.  Probably not then :)
07:04 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:04 < gladiatr> Do you, by any chance, have a crossover ethernet cable?
07:04 < Fleck> gladiatr naah, but i can make one! :)
07:04 < Fleck> have connectors and tool too
07:05 < Fleck> sec, will make one! :)
07:06 < gladiatr> Ok.  What just occured to me is that there are going to a lot frames hopping through that switch; that perhaps what is happening is that having such a high speed connection combined with the VPN tunnel packets might be stressing your switch's abilities
07:06 < gladiatr> ^^^ kind of a stretch
07:06 < Fleck> btw thx for helping... and ideas! :)
07:06 < gladiatr> So, as another test, perhaps connect the laptop directly to your vpn server with a crossover
07:06 < gladiatr> and rerun your transfers
07:07 < Fleck> ok, one moment please! :)
07:07 < gladiatr> This is kind of a reach, but I have encountered non-enterprise switches that experience performance degradation under high frame load
07:11 < Fleck> cable done, brb... :)
07:12 < gladiatr> k
07:16 -!- Fleck [~we@unaffiliated/fleck] has quit [Ping timeout: 264 seconds]
07:18 -!- Fleck [~we@85.158.73.148] has joined #openvpn
07:18 -!- Fleck [~we@85.158.73.148] has quit [Changing host]
07:18 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
07:18 < Fleck> same speed gladiatr 
07:18 < Fleck> ;D
07:19 < gladiatr> hrm.  Ok.  You now have a bright, shiny crossover cable to erm... keep until you need it... in a couple years or so :D
07:19 < Fleck> yeah :))
07:20 < Fleck> not a big deal/problem
07:20 < gladiatr> I'm out of ideas again.  I'll pop back in if something else occurs to me.
07:20 < Fleck> ;(
07:20 < theDoc> Fleck: Have you tried going over to the switch and planting a kiss on her head?
07:20 < Fleck> hehe :)
07:21 < theDoc> I heard chocolates work good too.
07:21 < theDoc> I'm also stuck :P
07:21 < theDoc> radius.
07:21 < theDoc> fml
07:21 < Fleck> heh
07:21 < Fleck> thats not good
07:22 < theDoc> http://www.youtube.com/watch?v=mhPUzgfBoS8&feature=related
07:22 <@vpnHelper> Title: YouTube - Jay Chou - Herbalist Manual MV (at www.youtube.com)
07:22 < theDoc> This is such an awesome song to rock to
07:22 < theDoc> :D
07:23 -!- gryzli [~gryzli@94.155.42.130] has joined #openvpn
07:24 < Fleck> gladiatr btw maybe something with TAP ?
07:24 < gladiatr> Hrm... 
07:26 < gladiatr> Yeah... not a big windows user here... I suppose to rule that out (or in) you could boot your laptop from a live  linux or bsd disk/SD with your client config/keys/etc to give it a try
07:27 < Fleck> not windows
07:27 < Fleck> linux
07:27 < Fleck> openvpns server
07:27 < gladiatr> oh... you're running a bridged connection?
07:27 < Fleck> i have tried allready linux and windows - no difference
07:28 < Fleck> yes i have br0 (took eht0 IP) and tap0
07:28 < gladiatr> ohohohoh.
07:28 -!- exa [~exa@x.factor.cc] has quit [Remote host closed the connection]
07:28 < gladiatr> hahahaha.  Stupid me for not asking clearly before.
07:28 < Fleck> sorry ;(
07:29 < Fleck> so now ideas?
07:29 < Fleck> just don't say its normal
07:29 < Fleck> :D
07:29 < gladiatr> That's pretty much 100% expected that you are going to cut your throughput by a significant amount.  Your VPN is processing all of your layer-2 traffic
07:29 < gladiatr> It is
07:29 < ecrist> Fleck: are you still troubleshooting your bandwidth issues?
07:29 < gladiatr> unfortunately
07:29 < gladiatr> ecrist, he is
07:29 < Fleck> ecrist yes
07:29 < reiffert> gladiatr: that layer two traffic is at 1-2KB/s
07:29 < ecrist> and how much are you actually getting?
07:29 < Fleck> ecrist 50%
07:30 < ecrist> I don't want relative, I want actual
07:30 < Fleck> well direct connection 11MB/sec
07:30 < Fleck> over tunnel 5.6MB/sec
07:31 < reiffert> Fleck: how fast is it for tun setup?
07:32 < Fleck> dunno, have not tried tun
07:32 < Fleck> i liked this kind of setup because...
07:32 < reiffert> try it, should last some minutes to change the setup.
07:32 < Fleck> really?
07:33 < theDoc> OH GOOD FUCKING GOD
07:33 < reiffert> no, really.
07:33 < theDoc> WHY DOESN'T THE PASSWORDS MATHC?!?!?!
07:33 < theDoc> >:o
07:33 < macsppadic> am back theDoc 
07:33 < macsppadic> any luck?
07:33 < reiffert> theDoc: your caps lock key is stuck.
07:33 < ecrist> Fleck: and that's on the PIII 733 or such, right?
07:33 < Fleck> ecrist not anymore
07:33 < Fleck> on dual core amd
07:34 < ecrist> openvpn isn't multithreaded, so it'll only use a single core.
07:34 < Fleck> 2.6ghz
07:34 < Fleck> and 1.6ghz for client - test pc
07:35 < Fleck> laptop
07:35 < theDoc> reiffert: :D
07:37 < reiffert> Fleck: just to be sure, change it to tun and try again.
07:37 < Fleck> where do i do that?
07:37 < reiffert> Fleck: what switch are you using and: is it a direct connection? please provide a traceroute
07:37 < reiffert> Fleck: server.conf, client.conf
07:38 < ecrist> Fleck: what are you using to test your bandwidth throughput
07:38 < reiffert> wget I think
07:38 < reiffert> 23:50 < Fleck> using http i tested speed
07:38 < reiffert> 23:51 < Fleck> cause with http i can try with and without vpn (port forward)
07:38 < Fleck> ecrist downloding simple file 4.2GB over http
07:38 < Fleck> yes ;)
07:39 < Fleck> thx reiffert :)
07:39 < ecrist> ok
07:39 < reiffert> Fleck: so what about the direct connection between server and client, is it direct?
07:39 < reiffert> what network components live inbetween?
07:39 < Fleck> reiffert: gladiatr suggested crossed cable - tried that - same speed
07:40 < Fleck> gigabit switch at the moment, but as i said - no difference
07:40 < ecrist> gigabit devices (most of them) do auto-sensing for crossover
07:41 < Fleck> ecrist i mean i tried crossover direct - server to client
07:41 < Fleck> w/o switch
07:41 < Fleck> and that made no difference at all
07:41 -!- Sky[x] [~SkyB0x@212.235.177.25] has joined #openvpn
07:41 < Fleck> btw
07:41 < Fleck> Options error: --server-bridge directive only makes sense with --dev tap
07:41 < ecrist> I understand, I was just stating you could have gotten away with just a straight-through cable between them
07:41 < Fleck> when i replaced tap with tun
07:42 < ecrist> tap = layer 2, tun = layer 3 for the most part
07:43 < Fleck> so its not so quick to change from tap to tun ;/
07:43 < reiffert> which gigabit switch?
07:44 < reiffert> and why do only have 11MB/s without openvpn when using GBIT?
07:44 < Fleck> reiffert doesnt matter - without switch = no difference
07:44 < Fleck> reiffert cause laptop has 100mbit card?
07:44 < reiffert> oh get some better testing environment.
07:44 < ecrist> reiffert: probably IO bound on disk on one system or the other.
07:44 < reiffert> 5 USD that the bottleneck is the laptop.
07:45 < Fleck> ;D
07:45 < reiffert> Fleck: try with a 10MB file.
07:45 < reiffert> (to exclude the hard drives)
07:45 < Fleck> ok let me try on other PC, not laptop, with gbit card
07:45 < reiffert> and changthen step to tun, just to be sure 
07:46 < Fleck> reiffert well doubt, cause direct is 11MB/sec... 
07:46 < reiffert> Cause I dont think (liek gladiatr does), that tap is the bottleneck.
07:46 < gladiatr> reiffert, s'ok.  I understand the logic, but in practice, a bridged connection is much less efficient than a routed connection.
07:47 < reiffert> gladiatr: much less for 1-2KB/s?
07:47 < gladiatr> heck yeah.
07:47 < gladiatr> And it gets progressively worse the more systems are a member of the bridged LAN
07:47 < reiffert> I dont see the "yeah" part?
07:47 < reiffert> I've got 1-2KB/s in a bridged setup with ~50 members.
07:48 < gladiatr> No multicast clients, huh?  Static arp? :)
07:49 < reiffert> no static arp.
07:50 < gladiatr> I'm not saying you can't configure a network environment that is vpn-bridge friendly--my experience is that most VPNs are bolted on to the network after it is being lived in.  Even modern linux distros are stinky with multicast services.
07:51 < gladiatr> (client/desktop targeted disros, that is)
07:51 < reiffert> I'm talking about 40 OS X maschines in my setup.
07:52 < Fleck> ok test done
07:52 < Fleck> with gigabit links over vpn i get 11MB/sec 
07:52 < Fleck> without 70MB/sec
07:52 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
07:52 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
07:52 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
07:54 < gladiatr> reiffert, Huh.  Stock network configuration?  I've got 4 macs in-house, so I'm not familiar with os x's network detritus--just that of windows, network printers and linux clients.
07:55 < Fleck> so the problem is even bigger with gigabit link
07:56 < ecrist> no, I think you're IO limited
07:56 < Fleck> ok where i incrase io limit?
07:57 -!- le0 [~fin@unaffiliated/le0] has quit [Client Quit]
07:59 < reiffert> gladiatr: OS X uses multicast and broadcast announcements for its service discovery announcements
07:59 < reiffert> Fleck: whats your debug level, verbose, verb that is?
07:59 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9293>
07:59 < Fleck> 3
07:59 < gladiatr> Ok.  Similar to the rest of the crowd then :)
08:00 < reiffert> Fleck: *thats* the question. Now change to tun.
08:00 < reiffert> Fleck: and get rid of that fragment, mss-fix and tun stuff.
08:01 < reiffert> Fleck: after switching to tun, try without encryption and without compression (lzo).
08:02 < reiffert> then we have a sane value for further adjustments.
08:03 < reiffert> s,tun stuff,mtu stuff,
08:03 < reiffert> Fleck: btw, what are the operating systems you are running?
08:04 < Fleck> i have win7 only here with gigabit card
08:04 < Fleck> tried linux and windows xp too
08:04 < Fleck> similar results everywhere
08:04 < reiffert> the windows tap driver is limited to 100mbit/s IIRC.
08:05 < Fleck> ok then thats why i get only 11MB/sec with gigabit link...
08:07 < reiffert> o get rid of that windows stuff.
08:10 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9294>
08:19 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:21 < Fleck> with tun and w/o encryption/compression i get around ~8MB/sec
08:21 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
08:42 -!- OiPolloi [~sena@gw.identity.pt] has joined #openvpn
08:43 < OiPolloi> hello
08:43 < secretary_linux> hi
08:46 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9295>
08:47 < OiPolloi> I'm using OpenVPN with password authentication (via a script with auth-user-pass-verify), and everything is working fine. However, when a user's password contains some special characters (like accented leters, for example), the script receives the password without those characters... Anyone knows what's happening here?
08:48 < OiPolloi> OpenVPN's documentation states that: "The password string can consist of any printable characters except for CR or LF."
08:49 < OiPolloi> So it should be fine...
08:51 -!- hid3 [~tst@lan-78-157-71-116.vln.skynet.lt] has joined #openvpn
08:52 < hid3> Hello everyone. Each time I try to connect from my laptop (Windows 7) to my server's VPN (linux/debian). I need to reconnect two times. The first time in status window I see those messages: http://pastebin.com/tfXyBii8 . After I disconnect / reconnect, then it connects normally. Any ideas what's wrong?
08:54 < Rienzilla> hmm these messages seem normal
08:55 < hyper_ch> I'd blame windows 7
09:07 < gladiatr> hid3, what is your route-delay set to?
09:08 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
09:08 -!- le0 [~fin@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
09:08 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
09:08 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:11 < gladiatr> Bueller...
09:13  * gladiatr goes outside to smoke...
09:13 -!- gladiatr is now known as gladiatr_smokin
09:16 -!- sentmen [bccdf3f6@gateway/web/freenode/ip.188.205.243.246] has joined #openvpn
09:16 < sentmen> Hi all
09:16 < sentmen> I have a problem
09:17 < sentmen> I have 2 linux servers
09:18 < sentmen> On the vpn server (server 1) i will start the openvpn server
09:18 < sentmen> But server 2 has no tap0
09:18 < sentmen> How can i install it again?
09:21 -!- OiPolloi [~sena@gw.identity.pt] has quit [Quit: OiPolloi]
09:22 -!- gladiatr_smokin is now known as gladiatr
09:22 <@vpnHelper> RSS Update - forum: Two link in load-balance causing tunnels the stop working <http://forums.openvpn.net/topic7541.html>
09:23 < gladiatr> sentmen, it will be created when openvpn initially opens the device
09:24 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:24 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
09:24 -!- Cain` is now known as Cain
09:25 < gladiatr> sentmen, if you need it beforehand, you create it with the command: openvpn --mktun --dev tap4
09:25 < gladiatr> (or whatever tap interface designation you need)
09:25 < gladiatr> !mktun
09:25 < gladiatr> !factoids search mktun
09:25 <@vpnHelper> No keys matched that query.
09:28 < hid3> gladiatr: I don't have any route-delay set...
09:28 < gladiatr> hid3, add the following to your client configuration and try connecting again: route-delay 5 20
09:29 < hid3> Thanks, will try it in a moment
09:31 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:32 < hid3> gladiatr: Thanks, it looks like this solved the problem
09:32 < gladiatr> schweet :0
09:32 < gladiatr> :)
09:32 -!- sentmen [bccdf3f6@gateway/web/freenode/ip.188.205.243.246] has quit [Ping timeout: 265 seconds]
09:35 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9297>
09:41 < theDoc> macsppadic: I cbf'ed to look at the md5 shit now, went with crypt.
09:41 < theDoc> Works like a charm.
09:42 < macsppadic> oh?
09:42 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
09:42 < macsppadic> so what u change in radius conf?
09:42 < theDoc> Yeah.
09:42 < theDoc> I just changed it in the sql db from smd5-password to crypt-password
09:42 < theDoc> and the m'fucking thing works like a charm.
09:44 < theDoc> macsppadic: for my own sanity.
09:44 < theDoc> I'm about to break my laptop and the vm.
09:44 < macsppadic> :-D
09:44 < macsppadic> wel glad thas worked
09:44 < macsppadic> i think issue with the damn smd5 to be honest 
09:44 < macsppadic> or rather support for it 
09:44 < theDoc> I was about to burst a vein, I tell you.
09:45 < macsppadic> am not surprised
09:45 < theDoc> The damn thing was eating away at my sanity.
09:50 < macsppadic> thank the lord thats sorted then 
09:51 < theDoc> macsppadic: I'm going to steer really far away from md5 salted hashes from now
09:51 < theDoc> All I hear from that is, PAIN!
09:51 < macsppadic> hehehe
09:51 < theDoc> Don't get me started, I was raging on this for a long time.
09:53 <@vpnHelper> RSS Update - forum: Need help with OpenVPN setup <http://forums.openvpn.net/topic7540.html#p9298>
09:53 -!- macsppadic is now known as Jokersppadic
09:53 -!- resno [~bryan@unaffiliated/resno] has joined #openvpn
09:53 -!- ElitestFX [~ElitestFX@unaffiliated/elitestfx] has left #openvpn ["Leaving"]
09:54 < resno> hello all. considering setting up a vpn for the office. is there a way to make it automatically setup the clients amchine?
09:54 < resno> windows*
09:55 < theDoc> resno: What's your idea of "automatically"?
09:56 < resno> eh, the user doesnt need to know alot about how it works, outside of credentials, etc
09:56 < resno> a novice user can almost just start and type in a few things and it works
09:57 < resno> or does an "expert" need to configure it
09:58 -!- sentmen [bccdf3f6@gateway/web/freenode/ip.188.205.243.246] has joined #openvpn
09:58 < sentmen> Hi all
09:59 < ecrist> resno: you'll need to configure, but it's pretty simple to install
09:59 < ecrist> the user does a generic install, and copies some files you provide to a directory
09:59 < ecrist> voila
09:59 < sentmen> I have 2 servers, server 1 is the openvpn server. The other is the vpn client (both in linux)
10:00 < sentmen> But when i install openvpn, the tap0 will not install
10:00 < sentmen> How can i install it manualy
10:02 < gladiatr> erm... modprobe tun
10:04 < sentmen> Can you also say what the command is for set manualy the tap1 device?
10:04 < sentmen> Because if i typ ifconfig tap0 don't show, but only tap1
10:05 < resno> ecrist: sweet thanks :)
10:05 < sentmen> Hmm...
10:06 < sentmen> If i typ "ifconfig tap0" it will show, but if i start the openvpn service he get no ip
10:07 -!- Jokersppadic [~sonupunno@88.211.55.77] has left #openvpn []
10:09 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has joined #openvpn
10:10 < void_pointer> !welcome
10:10 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:10 < void_pointer> !goal
10:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:10 < void_pointer> !route
10:10 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
10:10 < void_pointer> !redirect
10:10 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
10:11 < void_pointer> !def1
10:11 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
10:11 < void_pointer> !sample
10:11 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
10:15 < sentmen> If i typ "ifconfig tap0" it will show, but if i start the openvpn service he get no ip
10:18 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has quit [Ping timeout: 246 seconds]
10:19 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has joined #openvpn
10:19 < dvl> sentmen: What do the logs show?
10:22 < sentmen> dvl: I got it. He has started from tap, not tap0:)
10:22 < dvl> Progress.
10:45 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: Lost terminal]
10:45 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has quit [Ping timeout: 240 seconds]
10:45 -!- void_pointer [~void@173.192.53.132] has joined #openvpn
10:45 -!- void_pointer [~void@173.192.53.132] has quit [Changing host]
10:45 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has joined #openvpn
11:01 -!- chr1s [5d61f643@gateway/web/freenode/ip.93.97.246.67] has joined #openvpn
11:02 < chr1s> hi guys, does anyone know how I can benchmark openvpn connections?
11:03 -!- resno [~bryan@unaffiliated/resno] has left #openvpn []
11:03 < reiffert> !forward
11:03 < reiffert> !factoids search forward
11:03 <@vpnHelper> 'winipforward', 'linipforward', 'fbsdipforward', 'linportforward', 'osxipforward', and 'ipforward'
11:03 < reiffert> !winipforward
11:03 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
11:09 -!- s7r [~s7r@80.79.116.232] has joined #openvpn
11:10 -!- sentmen [bccdf3f6@gateway/web/freenode/ip.188.205.243.246] has quit [Ping timeout: 265 seconds]
11:12 < reiffert> !factoids search nat
11:12 <@vpnHelper> 'nat', 'linnat', 'fbsdnat', 'pfnat', 'freebsdnat', 'bsdnat', 'donate', 'winnat', and 'openvzlinnat'
11:12 < reiffert> !winnat
11:12 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows, or (#2) http://www.nanodocumet.com/?p=14 for windows XP
11:12 -!- hid3 [~tst@lan-78-157-71-116.vln.skynet.lt] has quit []
11:13 < s7r> krzee: u there?
11:15 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
11:18 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:20 -!- Shards_of_Narsil [~wsduvall@vtluug/member/ackthet] has joined #openvpn
11:20 <@vpnHelper> RSS Update - forum: benchmark openvpn connection <http://forums.openvpn.net/topic7542.html>
11:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
11:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:24 -!- p3rror [~mezgani@41.140.99.17] has joined #openvpn
11:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
11:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
11:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:31 -!- chr1s [5d61f643@gateway/web/freenode/ip.93.97.246.67] has quit [Quit: Page closed]
11:32 -!- WinstonSmith [~true@f052098117.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
11:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:37 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has quit [Ping timeout: 255 seconds]
11:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
11:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:41 -!- p3rror [~mezgani@41.140.99.17] has quit [Ping timeout: 240 seconds]
11:44 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:44 -!- p3rror [~mezgani@41.140.169.126] has joined #openvpn
11:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 250 seconds]
11:46 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:47 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
11:47 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:51 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501.html#p9300>
11:52 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
11:52 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:54 -!- p3rror [~mezgani@41.140.169.126] has quit [Read error: Connection reset by peer]
11:55 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
11:55 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:59 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
12:00 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:03 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501-15.html#p9301>
12:03 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
12:04 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:08 -!- p3rror [~mezgani@41.140.156.248] has joined #openvpn
12:08 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
12:09 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:12 < havoc> bah
12:12 < havoc> need to run ovpn as non-admin in win7
12:13 < havoc> I know there's a factoid on this
12:13 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Max SendQ exceeded]
12:13 < havoc> plus I've found stuff on google
12:13 -!- buntfalke_ [~nobody@openvpn-p0-052.triple-a.uni-kl.de] has joined #openvpn
12:13 -!- buntfalke_ [~nobody@openvpn-p0-052.triple-a.uni-kl.de] has quit [Changing host]
12:13 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:16 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
12:16 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:17 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 264 seconds]
12:19 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
12:21 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
12:21 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
12:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:21 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:21 < havoc> is this the definative way to run openvpn as non-admin in windows?  http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin.html
12:21 <@vpnHelper> Title: HowTo Run OpenVPN as a non-admin user in Windows (at openvpn.se)
12:24 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
12:25 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:29 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Excess Flood]
12:29 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:32 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
12:32 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:39 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501-15.html#p9302>
12:45 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501-15.html#p9303>
12:46 -!- jfkw [~jtk@216.115.1.60] has quit [Ping timeout: 240 seconds]
12:49 < gladiatr> havoc, That certainly worked for the xp/2000 generation; however, I haven't tested (or read about anyone testing) this method with vista or 7.
12:50 < havoc> yeah, this would be on win7
12:53 -!- mete [~metefr@84.200.12.194] has joined #openvpn
12:53 < mete> hi all
12:53 < mete> is there an option that openvpn listen only on one ip address for connections?
12:54 < gladiatr> mete, it's the "local" directive
12:55 -!- OhMyGuru [~OhMyGuru@81-67-200-162.rev.numericable.fr] has joined #openvpn
12:55 < OhMyGuru> yo
12:55 < gladiatr> !factoid search local
12:55 < mete> so in config "local 1.2.3.4"
12:55 < gladiatr> mete, yes
12:55 < mete> k ;) I try
12:56 < mete> thank you gladiatr
12:56 < gladiatr> np
12:56 < mete> I've searched for something like "lip" ;) 
12:56 < mete> because of "lport" xDD
12:57 < OhMyGuru> I have one computer connected to a dedicated server running openvpn, and I want this computer get the public IP address of the dedicated server (OpenVPN server) to go on the web
12:57 < OhMyGuru> and I don't get it on google :(
12:57 < gladiatr> For reference, the how-to on the openvpn.net doc page has a sample server configuration that has a decent inventory of commonly used options
12:58 < OhMyGuru> Anyone can help me ?
12:58 -!- Malard [~ident@xbmc/staff/malard] has quit [Quit: —I-n-v-i-s-i-o-n— 3.2 (July '10)]
12:59 < gladiatr> OhMyGuru, That wouldn't actually be possible; however, you could set up your openvpn server to nat your client network
12:59 < OhMyGuru> it's what I did I guess
12:59 -!- Malard [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
12:59 -!- Malard [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
12:59 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
12:59 < OhMyGuru> echo 1 > /proc/sys/net/ipv4/ip_forward
12:59 < OhMyGuru>  iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
13:00 < OhMyGuru> isn't it ?
13:00 < gladiatr> looks reasonable
13:01 < OhMyGuru> but probably that I have to tell to my computer to use the VPN as the gateway to go out on the web ?
13:01 < OhMyGuru> (I mean my computer still use the default gateway ? not the VPN one ?)
13:01 < gladiatr> yes
13:01 < gladiatr> !redirect
13:01 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:02 < OhMyGuru> ouch
13:02 < OhMyGuru> is it a client.conf option ?
13:03 < gladiatr> Nope.  That option is defined on within the server config
13:03 < OhMyGuru> ok
13:03 < mete> works perfect, thank you gladiatr
13:03 < gladiatr> mete, sweet!
13:03 < gladiatr> on/within/around/above/in-the-facinity-of
13:03 < gladiatr> :P
13:04 < gladiatr> s/fac/vac
13:04 < OhMyGuru> where should I use this option ?
13:04 < OhMyGuru> "--redirect-gateway"
13:04 < OhMyGuru> it's a command line option
13:04 < gladiatr> on the openvpn server.  
13:04 < OhMyGuru> mmmh
13:05 -!- rjd_ [~rjd@212.112.31.11] has quit [Ping timeout: 250 seconds]
13:05 < gladiatr> !def1
13:05 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
13:06 -!- rjd_ [~rjd@212.112.31.11] has joined #openvpn
13:07 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 265 seconds]
13:10 < OhMyGuru> mmh
13:11 < OhMyGuru> thats is ok, but no more DNS working on the computer
13:11 < gladiatr> You keep saying that... I do not think it means what you think it means...
13:11 < OhMyGuru> lol
13:11 < OhMyGuru> you're right
13:11 < OhMyGuru> sorry
13:11 < gladiatr> heh
13:13 -!- Netsplit *.net <-> *.split quits: APTX, katoen, krzee, ScriptFanix, buntfalke_, belZe, js_, d12fk, Meliorator, gladiatr,  (+49 more, use /NETSPLIT to show all of them)
13:14 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:15 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
13:16 < mete> ooops
13:18 -!- Netsplit over, joins: @dazo_afk, krzee, d12fk, Essobi, kisom, rjd_, OhMyGuru, buntfalke_, noisebleed, djgerm (+48 more)
13:18 -!- WinstonSmith [~true@e178176159.adsl.alicedsl.de] has joined #openvpn
13:18 < OhMyGuru> ty gladiatr !
13:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Max SendQ exceeded]
13:18 < gladiatr> you betcha :)
13:19 < OhMyGuru> see you
13:20 -!- OhMyGuru [~OhMyGuru@81-67-200-162.rev.numericable.fr] has left #openvpn ["Quitte"]
13:20 < gladiatr> see ya
13:20 < mete> wb ;)
13:20 < gladiatr> !factoid evil traitorous bot
13:21 < gladiatr> !factoid search evil traitorous bot
13:21 < mete> gladiatr: can openvpn listen on two ports with one server ?
13:21 < gladiatr> Hrm... good question.
13:21 < mete> would be nice xD because I'm setting up an openvpn server on port 80 and 443 for my mobile client :P
13:22 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
13:22 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
13:22 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
13:22 < gladiatr> spinning up my test vm here and will give it a try.  
13:22 < mete> nice ;)
13:25 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
13:28 < gladiatr> mete, it doesn't look like it
13:28 < gladiatr> You get to choose one or the other.  You can run multiple openvpn server instances on the same host, though.
13:29 < mete> ok
13:29 < mete> yep, that with the servers I know ;)
13:29 < mete> currently I've 3 running :P
13:29 < gladiatr> You just have to use  a unique subnets and tun device for each instance's client subnet
13:29 < mete> jep 
13:29 < mete> ;)
13:29 < mete> the basic routing stuff I know from openvpn :P
13:29 < mete> that i've learned
13:29 < mete> hehe
13:31 < mete> thank you for testig
13:31 < mete> :)
13:33 < gladiatr> you're welcome!
13:36 -!- QubeZ [~nkasu@64.128.254.34] has joined #openvpn
13:37 < QubeZ> hello all
13:37  * gladiatr waves
13:38 < QubeZ> I have servers in the Amazon EC2 cloud and one of them is an OpenVPN server. I've managed to do a site to site between my macbook at work and the Amazon hosted openvpn server.  Works beautifully.  My next step is to setup a server at our colo to go through the PIX and connect to the openvpn so that everyone behind our PIX can access the amazon ec2 without need to go through public IP's.  Is there a general howto I should reference to get started on this proces
13:38 < QubeZ> internal net -> openvpn server -> pix <--- INET ---> amazon ec2 openvpn server
13:39 < gladiatr> !factoid search iroute
13:39 < gladiatr> vpnHelper, you're killin' me here
13:39 < Fleck> :D
13:39 < QubeZ> hehe
13:40 < gladiatr> !clientlan
13:40 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
13:40 <@vpnHelper> better explanation
13:40 < gladiatr> !route
13:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
13:40 < gladiatr> !route_outside_openvpn
13:40 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
13:40 < gladiatr> serve me, bot...
13:40 < gladiatr> there's also a pretty good article on the subject of iroute here: http://backreference.org/2009/11/15/openvpn-and-iroute/
13:40 <@vpnHelper> Title: OpenVPN and iroute « \1 (at backreference.org)
13:41 < QubeZ> great thanks 
13:41 < gladiatr> And if you decide to go through with this, I can get you an excellent deal on bulk pigeons... oh wait... wrong blog entry..
13:41 < gladiatr> heh
13:43 < QubeZ> gladiatr: what if I wanted to not only have a p2p connection from my office to the openvpn server @ amazon, but also want the openvpn server @ amazon to serve real clients ie: i'm on my notebook remotely and need to connect into amazon.  Would it be better to vpn to my office here then from there i can get to the amazon since the openvpn is already established?
13:45 < gladiatr> It depends on the available bandwidth.  If you connect the office and the cloud and you already have things in place for users to connect to the office, I can't see why you wouldn't just connect via the office vpn server.  On the other hand, if you need to transfer lots of data between client systems and the cloud, the bandwidth usage could be problematic.
13:46 < QubeZ> gladiatr: it would be more for maintenance
13:46 -!- WinstonSmith [~true@e178176159.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
13:46 -!- WinstonSmith [~true@e178176159.adsl.alicedsl.de] has joined #openvpn
13:46 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:50 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Changing host]
13:50 -!- rot13 [~var@unaffiliated/rot13] has joined #openvpn
13:52 -!- p3rror [~mezgani@41.140.178.88] has joined #openvpn
13:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
13:57 -!- gladiatr is now known as gladiatr_afk
14:03 -!- Mish12 [~mish@194.28.69.111.dynamic.snap.net.nz] has joined #openvpn
14:03 < Mish12> !welcome
14:03 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:03 < Mish12> !goal
14:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
14:10 <@vpnHelper> RSS Update - forum: Virtual Boot Error <http://forums.openvpn.net/topic7543.html>
14:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:18 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:22 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501-15.html#p9305>
14:24 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
14:24 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
14:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:31 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 240 seconds]
14:35 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:45 -!- gpmidi_wrk [~mcintyrep@63.90.129.80] has joined #openvpn
14:45 <@vpnHelper> RSS Update - forum: benchmark openvpn connection <http://forums.openvpn.net/topic7542.html#p9307> || Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501-15.html#p9306>
14:47 < gpmidi_wrk> Are there any good web-ui based key management utils? I'm looking for something that would be simple to setup and would let me script the key management functions for provisioning new clients. I can write something that'll work very quickly but for obvious reasons I'd rather use something off-the-shelf if it exists. Note: I've already looked at a pair of heavy-weight key management programs but they seem like overkill for what I'm trying to do. 
14:51 -!- gryzli [~gryzli@94.155.42.130] has quit [Quit: Leaving]
14:55 < ecrist> closest thing I know of is ssl-admin, but it doesn't currently support scripting, and it's not a webui
14:57 < gpmidi_wrk> Is there any way other than using a post-connect script to update a dns record with the new IP of a client?
15:02 < ecrist> static IPs?
15:06 < gpmidi_wrk> In this case there would be 3+ load balanced servers, so a client would have to get an ip on different pools
15:07 < gpmidi_wrk> unless I go for an ethernet level bridge, which is what its looking like I'll have to do
15:16 -!- Fleck [~we@unaffiliated/fleck] has quit [Remote host closed the connection]
15:26 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:55 -!- p3rror [~mezgani@41.140.178.88] has quit [Ping timeout: 240 seconds]
16:00 -!- alhadi [~thunderst@unaffiliated/alhadi] has quit [Quit: alhadi]
16:04 <@vpnHelper> RSS Update - forum: build TAP-Win32 driver using the latest Windows Driver Kit <http://forums.openvpn.net/topic7544.html>
16:07 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
16:07 -!- mode/#openvpn [+o mattock] by ChanServ
16:08 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
16:13 < QubeZ> If I have an openVPN server and one machine behind it on another subnet yet I added a static route to it from my machine and back to the openVPN server from the other machine.  I am then connected to the VPN but cannot ping machine B (Machine A is the openvpn server)
16:13 < QubeZ> essentially, Machine A (vpn server) can ping Machine B.  My macbook can ping Machine A but not Machine B.
16:13 < Bushmills> !route
16:13 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
16:13 < Bushmills> !serverlan
16:14 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
16:14 < QubeZ> i have ip forwarding on the open vpn server and i've added the routes
16:14 < Bushmills> !firewall
16:14 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
16:14 < QubeZ> iptables if completely off
16:15 < QubeZ> hence me being able to ping B from A and vice versa.  Then my macbook over VPN can ping A but not B.
16:15 < QubeZ> A can get to B.. routes are statically set
16:16 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
16:17 < Bushmills> return route exists too?
16:17 < QubeZ> Bushmills: yes, B can ping A
16:17 < QubeZ> even if it didn't, i see ICMP echo request going from 10.8.0.1 (tun0) on server A go my server B.  However, running tcpdump on Server B shows nothing coming in.
16:17 < Bushmills> back route on A to macbook through vpn
16:18 -!- dominicus [~dominicus@unaffiliated/dominicus] has joined #openvpn
16:18 < Bushmills> i suppose it does ... macbook can ping A, right?
16:18 < dominicus> !welcome
16:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:19 < dominicus> !howto
16:19 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
16:19 < Bushmills> what does machine B do with packets destined to macbook?
16:19 < dominicus> !goal
16:19 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:20 < QubeZ> Bushmills: yup, here's a synopsis again.  Macbook VPN client pings Server A through VPN (10.8.0.1).  Server A can ping Server B on the regular LAN address 10.x.x.x.  B can also ping Server A via eth0 (lan address).  However, Mac cannot get to Server B through VPN.  So I'm trying to do:  Macbook (VPN) <---> INET <---> OpenVPN Server (tun0) aka Server A LAN -> Server B (LAN)
16:20 < Bushmills> what does machine B do with packets destined to macbook?
16:20 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
16:20 < QubeZ> Bushmills: im not even that far yet, I did a tcpdump on Server B while seeing my packets go through VPN to Server A to Server B yet Server B is not showing the ICMP echo requets.
16:20 < Bushmills> (i.e. replies)
16:21 < dominicus> When running "./build-key-server SERVER", what is "A challenge password" used for?
16:22 < Bushmills> QubeZ: "going through A" ..."not showing on B" .. sounds like their lost in the cable
16:22 -!- gpmidi_wrk [~mcintyrep@63.90.129.80] has left #openvpn []
16:22 < QubeZ> Bushmills: ya, weird stuff. Although if I just do a ping from Server A to B... it works over LAN.  Just not on Server A (tun) handoff to eth0 to Server B eth0
16:23 < QubeZ> its going through the tun0 on server A to eth0 just fine then off to Srv B but not receiving the requests.  If I got the requets and saw no responses then I know I have routing issues on Srv B but im not even that far yet
16:23 -!- dominicus [~dominicus@unaffiliated/dominicus] has quit [Quit: leaving]
16:30 -!- Netsplit *.net <-> *.split quits: Clete2, Essobi, mick_laptop, grishnav, ucekpolish1, djgerm, optiz0r
16:31 < QubeZ>  
16:31 < QubeZ> oops, sorry
16:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:32 -!- GCNR [~gabrielre@cpc1-nmal6-0-0-cust382.croy.cable.virginmedia.com] has joined #openvpn
16:32 < GCNR> Hi, I want to set up a VPN Connection using L2TP over IPSec to connect to a VPN using pre-shared key, username and password. I tried to follow some forum discussions and wiki articles, but I didn't succeed. Can anybody tell me how to do it or at least point me to a tutorial on how to do it? Thanks.
16:33 -!- Netsplit over, joins: Essobi, djgerm, ucekpolish1, optiz0r, grishnav, mick_laptop, Clete2
16:33 < GCNR> I forgot to say that I am using Ubuntu GNU Linux 10.10
16:40 -!- p3rror [~mezgani@41.140.99.43] has joined #openvpn
16:42 -!- GCNR [~gabrielre@cpc1-nmal6-0-0-cust382.croy.cable.virginmedia.com] has left #openvpn []
17:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
17:02 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
17:03 -!- Shards_of_Narsil [~wsduvall@vtluug/member/ackthet] has left #openvpn []
17:08 -!- WinstonSmith [~true@e178176159.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
17:08 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
17:22 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has joined #openvpn
17:22 -!- WinstonSmith [~xxx@e178176159.adsl.alicedsl.de] has joined #openvpn
17:29 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
17:31 -!- s7r [~s7r@80.79.116.232] has left #openvpn []
17:33 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
17:33 -!- ljvb [~jason@vps.vanbrecht.com] has joined #openvpn
17:33 < ljvb> evenin
17:34 < ljvb> anyone using the android port of openvpn?
17:42 -!- Malard [~ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
17:43 < ecrist> I couldn't get it working on my samsung vibrant, never tried on my mytouch 4g
17:45 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
17:53 -!- Malard [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
17:53 -!- Malard [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
17:53 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
17:59 < krzee> ljvb, i had
18:00 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
18:01 -!- teddz [~teddz@dtmd-4db23b7d.pool.mediaWays.net] has joined #openvpn
18:05 -!- QubeZ [~nkasu@64.128.254.34] has quit [Ping timeout: 264 seconds]
18:13 < krzee> i got it working on an HTC evo
18:13 < krzee> will pout it on my new mytouch 4g soon
18:13 -!- le0 [~fin@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
18:17 -!- p3rror [~mezgani@41.140.99.43] has quit [Ping timeout: 240 seconds]
18:32 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
18:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:46 -!- unspin_ [~unspin@S01060026f2f3042e.vc.shawcable.net] has joined #openvpn
18:47 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has quit [Read error: Connection reset by peer]
18:49 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
18:49 -!- mode/#openvpn [+o patelx] by ChanServ
18:53 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
19:00 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
19:05 -!- p3rror [~mezgani@41.140.46.229] has joined #openvpn
19:11 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
19:18 < ljvb> krzee mind posting your configs...  I have a working setup, 2 laptops, and remote network using certificates, but cannot for the life of me get my galaxy s working, it connects, but no routing or connectivity....
19:35 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
19:41 < theDoc> Are you pushing the correct routes?
19:45 < reiffert> Fleck: still using the laptop?
19:45 < reiffert> Fleck: still using windows?
19:55 < ljvb> just checked the log file (or rather just enabled logging heh...)  http://pastebin.com/AQv1Krgw is the error, unrecognized option blah blah blah for route and ifconfig
19:55 < ljvb> but I cannot seem to find anything via the usual google searches
20:01 -!- corretico [~laguilar@201.201.44.82] has quit [Ping timeout: 240 seconds]
20:19 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
20:30 < ljvb> hmm.. I think its the ifconfig in use.. was using /system/bin/ifconfig and not /system/xbin/ifconfig.. still have to delete the tun int and recreate it by hand to get vpn up (via adb)
20:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
20:39 < krzee> ljvb, you dont need my config
20:39 < mosno> i have setup openvpn to act as a server on a tunnel interface. i thought it would be nice to use uci to firewall the tun interface. i've successfully added a "vpn" zone, but i am having trouble adding a vpn interface, eg. uci network add interface gives me "network.@interface[0]=interface" instead of "network.vpn=interface". how can i get the latter? or am i trying to firewall openvpn in the wrong way?
20:40 < krzee> ljvb, you need to install busybox and make symbolic links to /system/xbin/ifconfig / route
20:43 < krzee> ljvb, also be sure to watch logfiles so you dont have to wonder what happened
20:43 < krzee> !logfile
20:43 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
20:44 < krzee> mosno, that is not an openvpn question
20:44 < krzee> !notovpn
20:44 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
20:44 < mosno> krzee: sorry i thought i was in #openwrt
20:44 < krzee> ahh
20:45 < krzee> =]
20:47 -!- p3rror [~mezgani@41.140.46.229] has quit [Read error: Connection reset by peer]
20:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:54 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:56 < ljvb> krzee odd.. I could have sworn I had BB installed since titanium backup requires it... but it might be a version built into the rom I am using
21:14 < ljvb> krzee you rock, thank you.. even though I saw that step over and over in my google searches.. it never occured to me to check to make sure the correct version of ifconfig and route were being used, since I assumed that bb was installed it would use those commands
21:37 -!- p3rror [~mezgani@41.140.26.1] has joined #openvpn
21:48 < ljvb> odd, I have to use a client config push dchp reference for my craptastic vista box, but my other boxes work fine without it.. wierd though, nslookup works fine on vista, but ping, tracert, any network traffic gets no dns resolution...
21:50 -!- teddz [~teddz@dtmd-4db23b7d.pool.mediaWays.net] has quit [Quit: Ex-Chat]
22:12 < ljvb> oh well, I found a work around, will figure out why at a later date
22:23 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
22:27 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
22:40 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
23:08 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
23:13 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
23:13 -!- mode/#openvpn [+o mattock] by ChanServ
23:37 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
23:43 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 260 seconds]
23:47 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
23:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
23:49 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:57 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 240 seconds]
23:58 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
23:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:59 -!- mick_laptop [~mick@clamwin/admin/mickhome] has quit [Remote host closed the connection]
--- Day changed Thu Jan 20 2011
00:01 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
00:05 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
00:05 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
00:05 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
00:05 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
00:06 < hyper_ch> ecrist: http://www.theregister.co.uk/2011/01/19/mac_linux_bot_vulnerabilities/
00:06 <@vpnHelper> Title: Bot attacks Linux and Mac but can't lock down its booty • The Register (at www.theregister.co.uk)
00:17 -!- WinstonSmith [~xxx@e178176159.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
00:19 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:33 -!- WinstonSmith [~xxx@dslb-088-073-115-198.pools.arcor-ip.net] has joined #openvpn
00:40 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
00:46 -!- WinstonSmith [~xxx@dslb-088-073-115-198.pools.arcor-ip.net] has quit [Ping timeout: 265 seconds]
00:58 -!- WinstonSmith [~xxx@e179004161.adsl.alicedsl.de] has joined #openvpn
01:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
01:12 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:51 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
02:03 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
02:23 < Fleck> reiffert well i tried laptop with knoppix live cd and simple tun without auth and crypt and comp... speed is the same, with or without tun
02:25 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
03:06 <@vpnHelper> RSS Update - forum: Two link in load-balance causing tunnels the stop working <http://forums.openvpn.net/topic7541.html#p9309>
03:07 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:07 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:12 <@vpnHelper> RSS Update - forum: VM Lab using OpenVPN <http://forums.openvpn.net/topic7545.html>
03:19 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:19 -!- mode/#openvpn [+o mattock] by ChanServ
03:20 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
03:21 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:21 < macsppadic> morning all 
03:35 < theDoc> macsppadic: Wanted to update you, :P
03:35 < theDoc> Got it with crypt (password,hash)
03:35 < macsppadic> hey theDoc 
03:35 < macsppadic> niiiice!
03:35 < theDoc> It works great with symbols and all now.
03:35 < theDoc> After spending like a gazillion hours on it
03:36  * macsppadic makes a mental note sure to forget after a day or so 
03:36 < macsppadic> hold on 
03:36 < macsppadic> so ur not using hte salt ?
03:36 < macsppadic> the even
03:36 < theDoc> er, not hash.
03:36 < theDoc> salt even.
03:36 < theDoc> enjoy folks. http://imgur.com/a/5TbPm
03:36 <@vpnHelper> Title: Nobodys Perfect - Imgur (at imgur.com)
03:37 < macsppadic> hehe 
03:37 < macsppadic> kewl thats sorted 
03:37 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 260 seconds]
03:37 < theDoc> macsppadic: Yeah, little to no sleep.
03:37 < theDoc> Tell me about it.
03:38 -!- takamichi [~pri@83.170.109.106] has joined #openvpn
03:51 -!- master_of_master [~master_of@p57B52CCB.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
03:53 -!- master_of_master [~master_of@p57B56488.dip.t-dialin.net] has joined #openvpn
03:59 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
04:02 -!- unspin_ [~unspin@S01060026f2f3042e.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
04:16 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
04:20 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 255 seconds]
04:24 <@vpnHelper> RSS Update - forum: Local Lan issue <http://forums.openvpn.net/topic7546.html>
04:26 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:36 < djgerm1> Are there many, any, known vulnerabilities with OpenVPN 2.1.1
04:36 < djgerm1> ?
04:48 <@vpnHelper> RSS Update - forum: Can't ping LAN behind VPN server <http://forums.openvpn.net/topic7547.html>
04:50 -!- common [~common@p5DDA484C.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
04:52 -!- common [~common@p5DDA474F.dip0.t-ipconnect.de] has joined #openvpn
05:16 -!- s7r [~s7r@80.79.116.248] has joined #openvpn
05:18 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
05:24 -!- takamichi [~pri@83.170.109.106] has quit [Ping timeout: 272 seconds]
05:24 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
05:25 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
05:26 -!- maxJadi [~maxJadi@dhcp-166-8.nomad.chalmers.se] has joined #openvpn
05:26 -!- maxJadi [~maxJadi@dhcp-166-8.nomad.chalmers.se] has quit [Changing host]
05:26 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:33 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:35 -!- binBASH [michael@office.cloud.hn] has joined #openvpn
05:41 < binBASH> Hi all, I setup openvpn to accept duplicate cn in certificates. I need some clients to have static ips so I've setup own certifates for these and put them in the client config dir. They are getting static ips now. For the other clients I use a cert with a generic common name. But for those clients the ips of the static clients get assigned as well. What is wrong?
05:49 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
05:56 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
06:09 < Peer^> hi! is it possible to mix or using both, single certs and pkcs#12 certs on one server config?
06:10 < reiffert> what are the differences between single certs and pkcs12?
06:12 <@vpnHelper> RSS Update - forum: Linux Tap device 10Mbit <http://forums.openvpn.net/topic7535.html#p9313>
06:15 < Peer^> pkcs12 is all in one: client.crt, client.key, ca.crt
06:20 < havoc> gah, no OpenVPN reg keys in win7?
06:23 < havoc> ah, under: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenVPN-GUI
06:34 < Peer^> ok, forget it. it cannot work
07:13 < havoc> too bad there aren't options for ovpnserv.exe
07:13 < havoc> openvpnserv.exe I mean
07:14 < Fleck> why not?
07:14 < havoc> it'd be nice to use the service to start specific configs
07:14 < Fleck> ohh
07:14 < Fleck> nv
07:14 < Fleck> nm
07:36 -!- knightstalker [~knightsta@shellium/member/KnightStalker] has joined #openvpn
07:36 < knightstalker> Hello,
07:36 < knightstalker> Can someone help me with TLS error?
07:37 < knightstalker> (I already googled...)
07:38 < ecrist> sure
07:40 < knightstalker> Thanks,so:
07:41 < knightstalker> server runs fine,and will say 'Initialization sequence completed',when I try to use my client it lags a bit on UDPv4 link local and link remote
07:41 < knightstalker> and would then say TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) and handshake failed
07:42 < havoc> knightstalker: firewall on client blocking something from server?
07:42 < knightstalker> ah
07:42 < knightstalker> can be!
07:42 < havoc> that's what I always check when I see tht exect error
07:42 < knightstalker> I asked the server VPS,they told me no firewall there
07:42 < knightstalker> but on client,I have a stupid router
07:42 < knightstalker> which ports I must exactly unblock?
07:43 < havoc> that error has always indicated a client-side firewall issue for me
07:43 < havoc> knightstalker: that I couldn't tell you
07:43 -!- komodo [~komodo@cl-971.mbx-01.si.sixxs.net] has joined #openvpn
07:43 < havoc> but knowing/assuming it's a client-side firewall issue gives you a bit more to google on :)
07:44 < havoc> knightstalker: I've had the issue w/ windows clients, but in those FW configs you allow the program, not a port
07:45  * knightstalker on linux
07:47 < hyper_ch> what ports do you have the vpn server running on?
07:47 < knightstalker> I first had it on 1194,but changed to 1200
07:48 < havoc> make sure you're allowing the correct protocol through on the FW too
07:48 < knightstalker> I selected TCP/UDP
07:51 < hyper_ch> then you have your client firewall to also allow that port
07:51 < knightstalker> yes i do :(
07:52 < knightstalker> hmm,lets restart router and retry
07:53 -!- p3rror [~mezgani@41.140.26.1] has quit [Ping timeout: 240 seconds]
07:54 -!- p3rror [~mezgani@41.140.171.100] has joined #openvpn
07:55 -!- knightstalker_ [~knightsta@109.109.43.139] has joined #openvpn
07:56 < knightstalker_> not helpful
07:57 -!- knightstalker [~knightsta@shellium/member/KnightStalker] has quit [Ping timeout: 240 seconds]
07:59 < komodo> hi, is there any way to setup clients on wndows with cryptoapicert an server on linux ? how shoul i get server cert and key on linux openpvn server? AFAIK i can export CA from certificate store, but what about server key and cert ?
07:59 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
08:01 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
08:01 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
08:09 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
08:19 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
08:35 < ljvb> question for anyone who has connected Vista (not my choice...) to openvpn, I'm having a dns issue.. I think, without using the dns push option in the client config on the ovpn server, I get no name resolution, even though using nslookup uses the correct DNS server and works just fine, but no services (ping, tracert, browser, applications etc) appear to be functioning without the push dns option
08:36 < ljvb> not using redirect either
08:40 < binBASH> Hi all, I setup openvpn to accept duplicate cn in certificates. I need some clients to have static ips so I've setup own certifates for these and put them in the client config dir. They are getting static ips now. For  the other clients I use a cert with a generic common name. But for those clients the ips of the static clients get assigned as well. What is wrong?
08:41 < ecrist> knightstalker_: sounds like you either have a firewall issue, or someone between you and the server is filtering UDP traffic
08:41 < knightstalker_> hmm
08:42 < ecrist> binBASH: sounds like something is foobar in your config
08:43 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
08:45 < gladiatr> ljvb, what happens when you do use nslookup from the cli?
08:47 < gladiatr> binBASH, does the pool specified in your server definition overlap with your static addresses?
08:47 <@vpnHelper> RSS Update - forum: Can't ping LAN behind VPN server <http://forums.openvpn.net/topic7547.html#p9315> || Local Lan issue <http://forums.openvpn.net/topic7546.html#p9314>
08:47 < binBASH> I found it out guys;)
08:47 < gladiatr> sweet
08:48 < binBASH> I had at first line server 10.8.0.0 255.255.255.0
08:49 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
08:49 < binBASH> and now I removed it and made server config manually in config with ifconfig and ifconfig-pool
08:49 < binBASH> that seems to work ;)
08:54 < gladiatr> good deal
08:55 < krzee> ljvb, glad it helped
08:56 < krzee> ljvb, i dont see the problem re: needing to change dns
08:56 < ljvb> gladiatr, nslookup from cmd works fine
08:57 < ljvb> krzee its more of an annoyance then a problem.. all the other hosts work fine, just the vista laptop that I need to fiddle with the DNS..
08:57 < krzee> then dont push the option
08:57 < krzee> just put it in the client config without the push
08:58 < gladiatr> make sure your tap device is ahead of your wireless/wired ethernet devices in your device priority list
08:58 < krzee> or push it in a ccd entry
08:58 < ljvb> its being pushed in the ccd entgry
08:58 < ljvb> that was the fix, but I am curious to know why I only have to do this for the one host (my work laptop)
08:59 < mort_gib> ljvb: You need to use another way of pushing the route in Vista
08:59 < ljvb> XP, android, openbsd and freebsd clients all work fine
08:59 < binBASH> cya all, byez and thx
09:00 -!- binBASH [michael@office.cloud.hn] has left #openvpn []
09:00  * ljvb hates vista... and for the love of $PICK_YOUR_DIETY.. this thing won't die (turned on in trunk in mid summer in vegas and utah), left in trunk on freezing evenings.. dropped (totally by accident) a few times.. and it keeps on ticking... 
09:01 < gladiatr> lol
09:01 < ljvb> mort_gib eh.. pushing the dns server via ccd solved the problem
09:02 < mort_gib> ljvb: Yeah, but you need to add a line in the Vista config for it to work properly
09:02 < ljvb> the exe line?
09:02 < mort_gib> Yes
09:02 < ljvb> route-method exe
09:02 < ljvb> its in there
09:02 < mort_gib> Ok, sorry
09:03 < mort_gib> Had LOT of shit with Vista, this is just one of them!
09:03 < ljvb> I suspect its something in the corp policy, I had to force the client binary to run as administrator
09:03 < ljvb> even though my user has full admin rights
09:03 < ljvb> uac can suck it
09:04 < mort_gib> ljvb: Yes well, now with UAC, all of a sudden we can "safely" allow all users to be in the administrator group...
09:04 <@vpnHelper> RSS Update - forum: Can't ping LAN behind VPN server <http://forums.openvpn.net/topic7547.html#p9316>
09:04 < ljvb> I'm up for a replacement in may, then I get windows 7 (sarcastic) yay... I kept pushing for a macbook pro.. but apparently corp does not want to support it
09:05 < mort_gib> ljvb: Well, in all fairness if you HAVE to use Windows, Win7 is not so bad
09:05 < ljvb> there is no safely allowing users in admin groups.. only reason I have it, is that many of the assessment tools I run require it (not everyone in the corp has admin rights, in fact most don't)
09:06 < mort_gib> I get crap from external consultants, that states "My software XXX" only runs if local users is administrator
09:06 < ljvb> bah.. I am being ejected from my cube..
09:07 < mort_gib> So it's trying to convince managers EVERY time that it's simply not true!
09:07 < mort_gib> How so, weak economy??
09:07 < havoc> gah, I can't believe that the only thing preventing a non-admin user (in windows) from running openvpn is adding routes
09:07 < havoc> there's gotta be a way to grant access to just add routes
09:08 < ljvb> no, apparently it was changed from hotelling (free for all office space) to an assigned cube.. I just stole my MD's office heh..
09:09 < ljvb> havoc yes, change the effective permissions of the route command itself, add the user you to to access it
09:09 < havoc> ljvb: would that be it?
09:09 < ljvb> <-- security consultant.. knows when he needs admin rights.. but also knows what not to do to get violated :) usually
09:09 <@vpnHelper> RSS Update - forum: IP address of client still visible <http://forums.openvpn.net/topic7514.html#p9317>
09:09 < havoc> or would they also need to be in the Network Administrators group or something?
09:10 < havoc> ok, so ovpn use "ip route add" by default, right?
09:10 < havoc> so I'd need to set the client config to use route.exe explicitly, and then add the user to the route.exe ACLs
09:11 < havoc> that sound correct?
09:11 < ljvb> havoc as far as I know.... I forget, but I am sure there is also an option equiv to suid
09:11 < ljvb> for windows
09:12 < havoc> but is the ability to add routes the only thing holding back non-admin users in windows?
09:12 < ljvb> but if you allow openvpn to run as administrator, the route command gets called as administrator
09:12 < ljvb> by non admin users
09:13 < ljvb> you need an admin of course to set that up initially
09:13 < havoc> right
09:14 < ljvb> under compatability properties of the binary (not the shorcut), just check run as adminstrator, problem solved)
09:14 < ljvb> but the downside of course, is that if a vuln/buffer overflow is found in ovpn, the resulting exploit leaves you as an admin
09:14 < havoc> yeah, if that's acceptable to this guy's IT dept
09:15 < gladiatr> ljvb, that's why no-bind should be the default on windows installs :P
09:15 < ljvb> my guess would be, unless its an officially supported application, the IT dep probably will not be very helpful
09:16 -!- mahdi_ja [~mahdi_ja@93.126.3.4] has joined #openvpn
09:16 < mahdi_ja> hi all
09:17 < gladiatr> see, that's where my evil mind would engineer a plot to image off the corporate windows installation, reinstall the laptop with linux then load the corp windows image onto a vm
09:17 < gladiatr> hiya, madi
09:17 < gladiatr> s/d/hd
09:18 < mahdi_ja> can i use openvpn to bypass govermentional internet filtering
09:18 < ljvb> gladiatr.. funny you mention that.. I did exactly that on my old corp dell, but I went the OSX route on the Dell, with p2v image of the original install
09:19 < gladiatr> hehe
09:19 < ljvb> had to.. for exchange support
09:20 < ljvb> mahdi_ja well.. it depends.. what gov it is.. will they hunt you down, torture you and throw yo in jail (say in China...), or are you talkign about US gov entities like DHS, IRS, etc
09:20 < ljvb> in the later, I would not recomend it.. since you will be caught.. and sanctioned
09:20 < gladiatr> indeed.  The philosophy of: If Caesar wants to sit in the corner and punch himself in the face, render unto Caesar an appropriate corner of the house to do so--just keep him away from the kitchen.
09:20 < mahdi_ja> ljvb, i want use this personally
09:20 < mort_gib> mahdi_ja: There are other more efficient ways...
09:21 < mahdi_ja> mort_gib, i examine all way but all of them not work in my country and are disabled
09:21 < gladiatr> mahdi_ja, I think you'll find that is the motivation for many of the online businesses that have popped up offering openvpn connections for a fee.
09:21 -!- macsppadic [~sonupunno@88.211.55.77] has left #openvpn []
09:22 < mahdi_ja> gladiatr, i want  create this free
09:22 < mort_gib> mahdi_ja: Where are you if I may ask?/
09:22 < mahdi_ja> mort_gib, iran
09:22 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
09:23 < mort_gib> Ok, well Iran had top notch help from the best in the west to keep you guys quiet :-(
09:23 < gladiatr> mahdi_ja, I understand :(
09:24 < mort_gib> http://anonymitynetwork.com/
09:24 <@vpnHelper> Title: Home ::: AnonymityNetwork.com ::: provide Virtual Private Network (at anonymitynetwork.com)
09:24 < gladiatr> mahdi_ja, the key is that you'll need a system somewhere that internet service is not restricted to connect to.  OpenVPN in and of itself is merely a program.
09:24 < ljvb> meeting time
09:24 < mort_gib> https://secretsline.biz/en/manual/read/how-to-hide-my-ip-address/
09:24 < mahdi_ja> gladiatr, i can not do this i my own system ?
09:24 <@vpnHelper> Title: VPN Service: vpn, openvpn, pptp, double vpn, vpn software, vpn service, windows vpn (at secretsline.biz)
09:25 < gladiatr> mahdi_ja, You certainly could, however, your connection would still be as restricted as the connection to your system.
09:26 < mort_gib> mahdi_ja: Firstly you would need a company, that has servers around the world to do this
09:26 < mahdi_ja> gladiatr, this means i must created openvpn in the other sysem and then connect to it
09:26 < gladiatr> mahdi_ja, correct
09:26 < mort_gib> mahdi_ja: If not, your ISp or the guys they report to would see some very suspicious traffic to one server and nothing to the rest of the Internet
09:27 < mahdi_ja> gladiatr, there is any free server for do it
09:27 < gladiatr> this I do not know.
09:28 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:28 -!- alhadi [~thunderst@92.99.132.49] has joined #openvpn
09:29 -!- anonymus [~yaa@178.177.82.39] has joined #openvpn
09:29 < anonymus> hi
09:29 < alhadi> hi
09:29 < anonymus> could anyone explain me why ip ad sh dev tun0 shows 
09:29 < anonymus> inet 192.168.0.1 peer 192.168.0.2/32 scope global tun0
09:30 < anonymus> why /32
09:30 < anonymus> and why 0.2
09:30 < anonymus> ??
09:30 < gladiatr> anonymus, it's a point to point link
09:30 < anonymus> i got it
09:30 < mahdi_ja> thanks all
09:30 < gladiatr> mahdi_ja, good luck, sir
09:30 -!- mahdi_ja [~mahdi_ja@93.126.3.4] has quit [Quit: Leaving]
09:31 < anonymus> but the opposite link has 192.168.0.5/24
09:31 < gladiatr> !topology
09:31 < anonymus> why does it show /32 0.2
09:31 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
09:31 < krzee> !/30
09:31 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
09:31 < gladiatr> ^^
09:31 < anonymus> hmm
09:31 < anonymus> i got it
09:32 < krzee> we're talking about making topology subnet the default soon
09:32 < anonymus> its just for information?
09:32 < krzee> maybe in 2.3
09:32 < krzee> anonymus, you asked...
09:32 < anonymus> i mean ip ad sh shown NOT REAL peer&
09:32 < anonymus> ?
09:33 < krzee> huh?
09:33 < anonymus> gtg/ thank u
09:35 -!- anonymus [~yaa@178.177.82.39] has quit [Read error: Connection reset by peer]
09:39 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
09:52 < alhadi> hi krzee :)
09:52 < krzee> Thanks go to Eric Crist for his work on #OpenVPN. To OpenVPN Technologies for joining with the community, which I think we all agree is for the better. To punk for phear and loathing in nl.  And of course thanks to the Efnet #IRCpimps
09:52 < alhadi> thank you eric crist :)
09:53 -!- teddz [~teddz@dtmd-4d0525a7.pool.mediaWays.net] has joined #openvpn
09:53 < alhadi> love openvpn
09:53 < krzee> thats for my bio in JJK's openvpn book
09:54 < alhadi> is there a book for openvpn?
09:54 < alhadi> recetly?
09:54 < alhadi> i'll buy it :)
09:54 < krzee> it will be out soon
09:54 < alhadi> cool
09:54 < alhadi> let me know :)
09:54 < alhadi> i am waiting for 2.3 version
09:54 < alhadi> openvpn
09:56 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 240 seconds]
10:02 < ecrist> neat, thanks krzee. :)
10:02 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
10:04 -!- komodo [~komodo@cl-971.mbx-01.si.sixxs.net] has quit [Quit: Konversation terminated!]
10:06 < krzee> =]
10:08 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Leaving]
10:09 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:11 < gladiatr> awesome.  I likes me some dead trees. :D
10:12 < gladiatr> who is the publisher?
10:13 <@vpnHelper> RSS Update - forum: UPnP over openVPN, is it possible? <http://forums.openvpn.net/topic7498.html#p9318>
10:13 < krzee> packt publishing
10:14 < krzee> its a good book
10:14 < krzee> if i wasnt getting a free copy ild buy one
10:16 < gladiatr> cool.  I'll keep my eyes peeled
10:27 -!- dvl [~dvl@pdpc/supporter/active/dvl] has left #openvpn ["Leaving"]
10:34 < alhadi> hey ecrist :)
10:34 < alhadi> whats a good book to study openvpn?
10:37 < ecrist> I *have* to buy one now, since my name will be in it.
10:37 < gladiatr> indeed!
10:40 < krzee> ill be linking to it in the bot when it comes out, its a very good book
10:40 < krzee> it covers what we usually cover in here, but it also does some setups i never knew possible
10:42 < krzee> good for learning openvpn, but also taught me a few things
10:43 < krzee> which i kinda expected when i heard JJK was the author
10:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:54 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
10:58 < ecrist> indeed
11:01 < alhadi> where do i buy?
11:01 < alhadi> oh it will be out
11:02 < alhadi> krzee :)
11:02 < alhadi> my friend would love buying too
11:02 < alhadi> we all are openvpn lover
11:03 < krzee> it will be at !book when it comes out
11:04 < krzee> http://www.amazon.co.uk/OpenVPN-Cookbook-Jan-Just-Keijser/dp/1849510105
11:04 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:05 < krzee> http://readlist.com/lists/lists.sourceforge.net/openvpn-users/3/17405.html
11:05 <@vpnHelper> Title: Re: OpenVPN (cook)book - ReadList.com (at readlist.com)
11:06 < krzee> me and Ralf agree
11:07 < gladiatr> Ralf?
11:07 < krzee> from that post in the last link
11:08 < gladiatr> ahh
11:11 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
11:41 -!- WinstonSmith [~xxx@e179004161.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:44 -!- s7r [~s7r@80.79.116.248] has quit [Ping timeout: 264 seconds]
12:20 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving.]
12:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: Leaving]
12:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
12:34 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
12:34 < fahmad> hello
12:34 < fahmad> is there anyway to disable inactivity timeout ?
12:35 < mete> you mean that you don't get disconnected?
12:35 <@vpnHelper> RSS Update - forum: Random problem with roadwarriors on windows machines <http://forums.openvpn.net/topic7489.html#p9319>
12:36 < fahmad> mete: yes
12:36 < mete> one moment
12:36 < mete> I think I've a option for that in my cfg
12:36 < mete> keepalive 10 60;
12:36 < mete> try this
12:37 < mete> in client and server cong
12:37 < mete> conf
12:38 < fahmad> but it will disconnect 
12:38 < fahmad> it check for ping for every 10 seconds
12:38 < fahmad> and then if does not get reponse for 60 seconds then disconnects
12:38 < mete> mine never gets disconnected...
12:40 < fahmad> humm
12:40 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:42 -!- anonymus [~yaa@178.176.66.224] has joined #openvpn
12:42 < anonymus> hi again
12:44 < anonymus> !topology
12:44 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
12:45 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
12:46 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
12:54 < ecrist> I may need to go buy that book
12:58 <@vpnHelper> RSS Update - forum: Server 2000...tapinstall.exe "not a valid Win32 app" error <http://forums.openvpn.net/topic7548.html>
13:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:04 < djgerm> is there a particularly good reason for locking down access to the openvpn port to only a handful of hosts?
13:04 < djgerm> vulnerabilities in openvpn 2.1.1?
13:05 < ecrist> if you're paranoid.
13:05 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
13:05 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
13:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
13:05 < ecrist> I've never done that, however.
13:05 < mete> with which access right it's good to store the config and key files? 600?
13:05 < hyper_ch> hi ecrist
13:07 < djgerm> other than paranoia haha
13:08 < krzee> ecrist, the book is worth it
13:10 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
13:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:28 <@vpnHelper> RSS Update - forum: OpenVPN tunnel status <http://forums.openvpn.net/topic7549.html>
13:41 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
13:41 -!- mode/#openvpn [+o patelx] by ChanServ
13:44 -!- xindz [karz@bounced.by.nbounce.com] has joined #openvpn
13:44 < mete> hi xindz ;)
13:44 < xindz> hi mete :D
13:44 < mete> I think they can help fast :P
13:44 < xindz> Lets see
13:45 < xindz> Hello, When im trying to connect to my OpenVPN server @ my pfsense router on port 443 i get this error: WARNING: Bad encapsulated packet length from peer (21331), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link. Whats wrong?
13:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
13:50 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
13:52 < xindz> mete seems dead here :/
13:53 < dschuett> pretty slow today
13:53 < mete> xD
13:53 < hyper_ch> doesn't openvpn have a cure against a cold?
13:54 < dschuett> it does! - only when using route mode though
13:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:02 -!- mezgani_ [~mezgani@41.140.179.31] has joined #openvpn
14:02 < gladiatr> 'dead' means everyone's vpn is chugging along splendidly :)
14:05 -!- p3rror [~mezgani@41.140.171.100] has quit [Ping timeout: 240 seconds]
14:09 -!- Jarpse [~jarpse@cluon.soleus.nu] has quit [Remote host closed the connection]
14:11 -!- mezgani__ [~mezgani@41.140.26.218] has joined #openvpn
14:12 -!- mezgani__ is now known as p3rror
14:12 < hyper_ch> dschuett: yey
14:13 < dschuett> gladiatr: VERY good point :)
14:13 < gladiatr> :D
14:13 -!- mezgani_ [~mezgani@41.140.179.31] has quit [Ping timeout: 240 seconds]
14:15 -!- ucekpolish1 [user@hq.ostc-pl.com] has quit [Ping timeout: 250 seconds]
14:28 <@vpnHelper> RSS Update - forum: Server 2000...tapinstall.exe "not a valid Win32 app" error <http://forums.openvpn.net/topic7548.html#p9322>
14:29 -!- p3rror [~mezgani@41.140.26.218] has quit [Ping timeout: 240 seconds]
14:30 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
14:33 -!- ucekpolish1 [user@hq.ostc-pl.com] has joined #openvpn
14:34 -!- rot13 [~var@unaffiliated/rot13] has quit [Ping timeout: 240 seconds]
14:36 -!- anonymus [~yaa@178.176.66.224] has quit [Quit: АХХХАХХААХХХАхахахахХхахаАААААААа11]
14:39 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
14:39 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
14:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
14:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:44 <@vpnHelper> RSS Update - forum: OpenVPN tunnel status <http://forums.openvpn.net/topic7549.html#p9324> || Linux client problem <http://forums.openvpn.net/topic7497.html#p9323>
14:51 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:53 < mete> is there a need to change the psk from time to time?
14:55 < hyper_ch> mete: it depends on your paranoia level
14:55 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392.html#p9325> || (Resolved)Svr 2000...tapinstall.exe "not a valid Win32 app" <http://forums.openvpn.net/topic7548.html#p9322>
14:56 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 255 seconds]
14:56 < gladiatr> mete, Yeah.  If you only have a few clients, it's easy enough to do, but as the number of clients grow, it becomes increasingly difficult.
14:56 < hyper_ch> ecrist: you're not an openvpn dev, are you?
14:57 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:58 < mete> is it possible to "secure" the key file? Idea: when I open the connection it asks for a password that the key file can be read?
14:58 < hyper_ch> mete: put it in a truecrypt container
14:59 < hyper_ch> but the auth certs could also be generated with a key IIRC
15:00 -!- knightstalker_ [~knightsta@109.109.43.139] has quit [Quit: Leaving]
15:01 < mete> how to do that hyper_ch?
15:01 < hyper_ch> !howto
15:01 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
15:01 < mete> if possible, I don't want to use additional software
15:02 < hyper_ch> hmmm, seems I am mistaken
15:04 < mete> hmmh
15:07 < xindz> Hello, When im trying to connect to my OpenVPN server @ my pfsense router on port 443 i get this error: WARNING: Bad encapsulated packet length from peer (21331), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link. Whats wrong?
15:07 <@vpnHelper> RSS Update - forum: Tunnel low speed <http://forums.openvpn.net/topic7519.html#p9326>
15:07 < krzee> mete, yes you can secure the private key using an openssl passphrase
15:08 < krzee> mete, what os do you use?
15:10 < mete> krzee: I'm using as server debian 5.0 minimal (linux), client is currently a Windows 7 6bit
15:10 < mete> 64bit
15:11 < krzee> ok so you want to know if the client can change his passphrase on his key?
15:11 < krzee> he can do it from within the GUI
15:12 < krzee> i dont have windows handy to say how exactly, but its not hard to find... the gui doesnt do much
15:12 < mete> ok
15:12 < mete> one moment
15:12 < mete> just starting the box :P
15:13 < dschuett> xindz: are you sure your address is correct that your are trying to connect to
15:14 < dschuett> is 443 open, and it ONLY being used by openvpn?
15:14 < xindz> Yes, 443 is open. But i have a multiwan setup
15:14 < dschuett> and is 443 forwarded to your openvpn server?
15:15 < xindz> yes
15:15 < mete> krzee: I found the option I think "change Password", if I press that button it says: your config gile does not contain any "key" or "pkcs12" option
15:15 < dschuett> i have seen this error when people misstype the DNS name or ipaddress
15:15 < dschuett> xindz ^^
15:15 < gladiatr> mete, it's an option in the drop-down(up?) of the openvpn-gui icon
15:16 < xindz> dischuett Using http://forum.pfsense.org/index.php/topic,7840.0.html that rule
15:16 <@vpnHelper> Title: OpenVPN on pfSense - Installation guide for (Windows) Dummies :-) (road-warrior) (at forum.pfsense.org)
15:16 < mete> jep gladiatr, this one I've pressed :P
15:16 < gladiatr> are you talking about a client certificate key or the dh key?
15:16 < mete> gladiatr: psk
15:17 < gladiatr> Okay.  Yeah.  The change passphrase option is just for the private rsa key for a client certificate.
15:17 < mete> I want use psk, and I want that the PSK is not as plain text on the disk
15:17 < dschuett> xindz: did you double check your remote ip address?
15:17 < dschuett> or are you using dns?
15:18 < xindz> using ip to my WAN interface
15:18 < mete> so with certs I can set a password for each certificate (server and client) gladiatr?
15:18 < mete> and on every connect it asks for the password?
15:18 < gladiatr> Yeah.  I think the suggestion of using an encrypted container of some sort would be your best bet.  I don't know if there's such a thing available under a  non-commercial  license for windows.
15:18 < gladiatr> mete, yup
15:19 < mete> ok, hmmhh
15:19 < mete> I will search a howto an set a test vpn up on the weekend, sounds like what I'm searching :P
15:19 < gladiatr> cool
15:19 < mete> thank you gladiatr
15:19 < gladiatr> sure
15:20 < mete> is it possible to only protect the server certificate? one client doesn't support ca with password I think
15:22 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
15:22 < gladiatr> Well, if they're running an openvpn client, it supports encryption of the private key.
15:23 < mete> I think this firewall software doesn't xD
15:23 < gladiatr> Even if you start the openvpn client from a command line (in windows or os x or whatever), it will still pause and wait for the user to input a passphrase when it encounters an encrypted key
15:23 < gladiatr> hrm... I'd try it out.  It might surprise you.
15:24 < mete> :P
15:24 < mete> otherwise it is possible only to use password for one site on one tunnel?
15:25 < gladiatr> Sure.  How you create and disseminate your certificates and keys is totally up to you
15:25 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
15:26 < mete> k ;)
15:26 < mete> I will give it a try 
15:26 < mete> thank you
15:29 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
15:41 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
15:48 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:48 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
15:59 -!- tuxx_ [~sometinel@81.95.4.165] has joined #openvpn
15:59 < tuxx_> hey guys...
15:59 < tuxx_> http://pastebin.com/NBM5fzgu
15:59 < tuxx_> /proc/sys/net/ipv4/ip_forward = 1
15:59 < tuxx_> i have those server/client configs
15:59 < tuxx_> and the connection goes up nicely
15:59 < tuxx_> however i wld like to divert all my client's traffic over the server
15:59 < tuxx_> as soon as i connect to the server
16:00 < tuxx_> i have no connectivity to the internet
16:00 < krzee> !linnat
16:00 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
16:00 < hyper_ch> hi krzee
16:00 < krzee> hey
16:00 < hyper_ch> krzee: you're an openvpn dev?
16:01 < krzee> nope
16:01 < hyper_ch> krzee: that means you don't walk around with a tinfoil hat all day long?
16:01 < krzee> of course i do
16:01 < hyper_ch> :)
16:01 < tuxx_> krzee: thanks ill give that a try.
16:02 < hyper_ch> off to bed... bye bye
16:03 < tuxx_> krzee: that alone doesnt seem to be doing the trick...
16:04 < tuxx_> krzee: as soon as i connect the server my connection is lost.. 
16:04 < tuxx_> i added the first iptables command
16:04 < tuxx_> to my server
16:04 < krzee> can you ping 10.8.0.1?
16:06 < tuxx_> krzee: ok my fault .. i wasnt using eth0 
16:06 < tuxx_> krzee: works now.. thanks alot mate
16:06 < krzee> np
16:29 -!- p3rror [~mezgani@41.140.46.163] has joined #openvpn
16:39 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 264 seconds]
16:41 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
16:43 -!- p3rror [~mezgani@41.140.46.163] has quit [Ping timeout: 240 seconds]
16:48 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Ping timeout: 240 seconds]
17:00 -!- p3rror [~mezgani@41.140.38.130] has joined #openvpn
17:09 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Remote host closed the connection]
17:20 <@vpnHelper> RSS Update - forum: os stucking after an big throught put <http://forums.openvpn.net/topic7550.html>
17:27 -!- p3rror [~mezgani@41.140.38.130] has quit [Ping timeout: 240 seconds]
17:36 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
17:49 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
17:53 < krzee> !wins
17:53 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
17:53 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 260 seconds]
17:57 -!- rkantos [robin@hp1.jaketus.net] has quit [Ping timeout: 260 seconds]
17:57 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
18:11 -!- tyler_d [~tyler_d@142.68.8.63] has joined #openvpn
18:18 -!- p3rror [~mezgani@41.140.98.135] has joined #openvpn
18:29 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
18:43 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Read error: Connection reset by peer]
18:53 -!- tyler_d [~tyler_d@142.68.8.63] has quit [Quit: tyler_d]
18:54 -!- tyler_d [~tyler_d@142.68.8.63] has joined #openvpn
18:54 -!- tyler_d [~tyler_d@142.68.8.63] has left #openvpn []
18:57 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
18:58 < grendal_prime> what whould be the preferd way of routing just http traffic from the client through the vpn server?
18:59 < grendal_prime> im looking at     push "redirect-gateway local def1"
18:59 < grendal_prime> but that seems to do all the traffic
19:00 < |Mike|> Yep.
19:05 -!- Sky[x] [~SkyB0x@212.235.177.25] has quit [Ping timeout: 276 seconds]
19:15 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
19:17 -!- patel is now known as openvpn2009
19:17 -!- openvpn2009 [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Changing host]
19:17 -!- openvpn2009 [~patel@openvpn/corp/admin/patel] has joined #openvpn
19:18 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 240 seconds]
19:23 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:51 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
20:10 -!- master_of_master [~master_of@p57B56488.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:12 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
20:18 -!- master_of_master [~master_of@p57B56488.dip.t-dialin.net] has joined #openvpn
20:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
20:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
20:33 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
20:41 -!- p3rror [~mezgani@41.140.98.135] has quit [Ping timeout: 272 seconds]
20:42 < ecrist> hyper_ch: what are you asking?
20:43 < ecrist> grendal_prime: you can't route just web traffic with only openvpn, you need to use something like pf and policy routing
21:26 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
21:27 -!- corretico [~laguilar@201.201.44.82] has quit [Remote host closed the connection]
21:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
21:36 < ljvb> *sigh* killed my phone.. stupid odin.. 
21:38 < mosno> does openvpn do any kind of packet filtering itself?
21:38 < mosno> ie. if i can see that netfilter counts a packet being output to the local tun0, can i assume that openvpn sends it to the remote tun0?
21:39 < ljvb> okay.. so android ovpn.. my connect keeps resetting every few seconds and reconnecting  (krzee.. you there??)
21:39 < mosno> because i can see ICMP echo replies return to my local tun0 when i ping the IP of the remote tun0, but not when i ping an IP in a subnet of the remote tun0
21:40 < mosno> ie. the local openvpn has a "route 192.168.1.0 255.255.255.0"
21:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:51 < ljvb> (sigh).. okay.. anyone who has had android and openvpn working... I cannot keep a stable connection.. last a few seconds then drops and recycles through the connection process
22:00 -!- teddz_ [~teddz@dtmd-4db2e331.pool.mediaWays.net] has joined #openvpn
22:00 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: Lost terminal]
22:04 -!- teddz [~teddz@dtmd-4d0525a7.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:10 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
22:11 < ljvb> screw it.. will deal with it later, going to sleep
22:35 -!- lkthomas [~lkthomas@058177217070.ctinets.com] has joined #openvpn
22:35 < lkthomas> hey guys
22:36 < lkthomas> I am trying to connect my openvpn client to openvpn server but it shows connection refused
22:36 < lkthomas> anyone have idea why ?
22:37 < mosno> to answer my own question, i think i needed iroute
22:37 < mosno> testing now
22:38 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
22:41 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 255 seconds]
22:42 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
22:43 < grendal_prime> ecrist ya i figured as much.
22:44 < grendal_prime> i guess just grabbing everything would be ok.
22:44 < grendal_prime> forcing all traffic through the vpn would be an ok option to start with
22:48 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
22:58 -!- WinstonSmith [~true@f052101120.adsl.alicedsl.de] has joined #openvpn
22:59 -!- WinstonSmith [~true@f052101120.adsl.alicedsl.de] has quit [Remote host closed the connection]
22:59 -!- WinstonSmith [~true@f052101120.adsl.alicedsl.de] has joined #openvpn
22:59 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
23:00 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
23:09 < lkthomas> anyone still alive ?
23:09 < lkthomas> I could telnet to port 1194
23:09 < lkthomas> but my openvpn client keep complain connection refused
23:14 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
23:15 -!- Zipper_32 [~Zipper_32@184.71.131.82] has joined #openvpn
23:21 < lkthomas> anyone mind to give me some hand please ?
23:22 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has joined #openvpn
23:46 -!- teddz_ [~teddz@dtmd-4db2e331.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
23:46 < hyper_ch> ecrist: ?
--- Day changed Fri Jan 21 2011
00:05 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
00:07 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
00:07 -!- Cain` is now known as Cain
00:11 -!- ping_pong [~qwerty@212-30-223-89.static.simnet.is] has quit [Ping timeout: 240 seconds]
00:13 -!- ping_pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
00:18 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: Lost terminal]
00:21 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:30 -!- lkthomas_ [~lkthomas@061093187003.static.ctinets.com] has joined #openvpn
00:33 -!- lkthomas [~lkthomas@058177217070.ctinets.com] has quit [Ping timeout: 240 seconds]
00:33 -!- lkthomas_ is now known as lkthomas
00:34 -!- lkthomas_ [~lkthomas@058177217070.ctinets.com] has joined #openvpn
00:38 -!- lkthomas [~lkthomas@061093187003.static.ctinets.com] has quit [Ping timeout: 246 seconds]
00:38 -!- lkthomas_ is now known as lkthomas
00:50 -!- Zipper_32 [~Zipper_32@184.71.131.82] has quit [Quit: Leaving]
00:50 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
00:51 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has quit [Ping timeout: 276 seconds]
01:05 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Read error: Operation timed out]
01:06 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
01:13 -!- prettyrobots [~alan@66.93.0.189] has joined #openvpn
01:14 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 240 seconds]
01:17 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:27 -!- pfein [~realnames@dynamic-66-243-239-34.ellensburg.fairpoint.net] has joined #openvpn
01:27 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
01:29 -!- WinstonSmith [~true@f052101120.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
01:38 -!- lkthomas_ [~lkthomas@061093187003.static.ctinets.com] has joined #openvpn
01:39 -!- ping_pong [~qwerty@212-30-223-89.static.simnet.is] has quit [Ping timeout: 255 seconds]
01:39 -!- ping_pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
01:39 -!- lkthomas [~lkthomas@058177217070.ctinets.com] has quit [Ping timeout: 272 seconds]
01:39 -!- lkthomas_ is now known as lkthomas
01:50 -!- prettyrobots [~alan@66.93.0.189] has quit [Quit: prettyrobots]
01:54 -!- lkthomas [~lkthomas@061093187003.static.ctinets.com] has quit [Read error: Connection reset by peer]
01:54 <@vpnHelper> RSS Update - forum: Linux client problem <http://forums.openvpn.net/topic7497.html#p9328>
01:57 -!- common [~common@p5DDA474F.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
01:57 -!- common [~common@p5DDA474F.dip0.t-ipconnect.de] has joined #openvpn
01:58 -!- pfein [~realnames@dynamic-66-243-239-34.ellensburg.fairpoint.net] has quit [Remote host closed the connection]
02:01 < kraut> moin
02:07 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 245 seconds]
02:15 < reiffert> moin kraut
02:17 -!- ping_pong is now known as ping-pong
02:21 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has joined #openvpn
02:30 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has quit [Read error: Connection reset by peer]
02:31 -!- void_pointer [~void@173.192.53.132] has joined #openvpn
02:31 -!- void_pointer [~void@173.192.53.132] has quit [Changing host]
02:31 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has joined #openvpn
02:33 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
02:40 -!- lkthomas [~lkthomas@058177217070.ctinets.com] has joined #openvpn
02:40 < lkthomas> hey guys
02:40 < lkthomas> is it possible to share same pki with multiple users ?
02:46 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
02:48 <@vpnHelper> RSS Update - forum: Can't ping LAN behind VPN server <http://forums.openvpn.net/topic7547.html#p9329>
02:48 < macsppadic> morning all
03:01 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has quit [Ping timeout: 240 seconds]
03:03 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
03:03 < Fleck> !smb
03:03 < Fleck> !samba
03:03 <@vpnHelper> "samba" is (#1) http://openvpn.net/faq#samba-routing for using samba with a routed tun, or use NETBIOS with a bridge, or (#2) http://www.openvpn.net/howto#samba if you run samba on linux and use tun mode
03:05 -!- albech [~thomas@124.157.245.126] has joined #openvpn
03:13 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 246 seconds]
03:15 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
03:15 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Read error: Operation timed out]
03:15 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 255 seconds]
03:15 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
03:16 -!- Nappy [~nappy@97.97.247.123] has joined #openvpn
03:20 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 272 seconds]
03:21 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
03:25 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
03:27 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 250 seconds]
03:27 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
03:29 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:38 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
03:51 -!- master_of_master [~master_of@p57B56488.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
03:52 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Quit: ☃]
03:52 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
03:53 -!- master_of_master [~master_of@p57B52D32.dip.t-dialin.net] has joined #openvpn
04:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:08 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
04:19 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
04:36 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
04:36 <@vpnHelper> RSS Update - forum: os stucking after an big throught put <http://forums.openvpn.net/topic7550.html#p9330>
04:48 -!- common [~common@p5DDA474F.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
04:52 -!- common [~common@p5DDA488B.dip0.t-ipconnect.de] has joined #openvpn
04:54 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:54 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:54 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:54 <@vpnHelper> RSS Update - forum: VM Lab using OpenVPN <http://forums.openvpn.net/topic7545.html#p9331>
05:00 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
05:06 -!- le0 [~fin@host217-43-215-207.range217-43.btcentralplus.com] has joined #openvpn
05:06 -!- le0 [~fin@host217-43-215-207.range217-43.btcentralplus.com] has quit [Changing host]
05:06 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
05:06 -!- tyler_d [~tyler_d@142.68.8.63] has joined #openvpn
05:06 -!- tyler_d [~tyler_d@142.68.8.63] has left #openvpn []
05:18 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:19 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
05:19 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:26 -!- teddz_ [~teddz@dtmd-4db2e331.pool.mediaWays.net] has joined #openvpn
05:30 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: Lost terminal]
05:49 -!- teddz_ [~teddz@dtmd-4db2e331.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
06:26 -!- tyler_d [~tyler_d@142.176.33.186] has joined #openvpn
06:26 -!- tyler_d [~tyler_d@142.176.33.186] has left #openvpn []
06:31 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 255 seconds]
06:31 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
06:35 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
06:51 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
06:59 < ecrist> -21F here this am.  fun fun
07:03 < havoc> -9F here, -28F windchill
07:04 < dschuett> 10F here :)
07:11 < Fleck> 28.4F here :D
07:18 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 255 seconds]
07:18 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
07:29 < dschuett> openvpn AND weather channel AIO!
07:29 < Fleck> ;D
07:35 < ljvb> sheesh, where the hell do some of you live.. the arctic?
07:41 < havoc> heh
08:05 < ecrist> Minnesota
08:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:11  * havoc is in WI
08:14 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
08:14 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:15 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 245 seconds]
08:15 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
08:16 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
08:24 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:27 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
08:30 -!- teddz [~teddz@dtmd-4db2e331.pool.mediaWays.net] has joined #openvpn
08:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
08:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
08:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 276 seconds]
08:41  * ljvb is from a place where winter is in the 60's.. and thats on a bad day.. 
08:42  * ljvb hates snows and ice.. and cold.. 
08:49 < ecrist> the coldest I've experienced was -56F with windchill at -79F
08:50 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
08:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:52 -!- gladiatr_afk is now known as gladiatr
08:52 < gladiatr> yeah.  that's a bit chilly.
08:57 -!- s7r [~s7r@95.154.230.174] has joined #openvpn
09:01 <@vpnHelper> RSS Update - forum: "TXT_DB error number 2" on build-key.bat client cert <http://forums.openvpn.net/topic7551.html>
09:16 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
09:20 -!- Fthis [6276ddd4@gateway/web/freenode/ip.98.118.221.212] has joined #openvpn
09:22 -!- iceberg is now known as iceberg_
09:23 -!- iceberg_ [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has quit [Quit: iceberg_]
09:23 -!- iceberg [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has joined #openvpn
09:23 -!- iceberg is now known as iceberg303
09:23 -!- iceberg303 [~iceberg@rrcs-70-63-54-202.central.biz.rr.com] has left #openvpn []
09:25 <@vpnHelper> RSS Update - forum: "TXT_DB error number 2" on build-key.bat client cert <http://forums.openvpn.net/topic7551.html#p9333>
09:31 <@vpnHelper> RSS Update - forum: Linux Tap device 10Mbit <http://forums.openvpn.net/topic7535.html#p9336> || [SOLVED] "TXT_DB error number 2" on build-key.bat <http://forums.openvpn.net/topic7551.html#p9335> || IP address of client still visible <http://forums.openvpn.net/topic7514.html#p9334>
09:37 <@vpnHelper> RSS Update - forum: configure open vpn file <http://forums.openvpn.net/topic7534.html#p9337>
09:39 < gladiatr> lkthomas, can you clarify what you mean?
09:40 < gladiatr> lkthomas, pki = public key infrastructure.  By definition a PKI serves multiple people/applications.  I get the feeling that's not what you're after, though...
09:40 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:49  * ecrist wonders if gladiatr is talking to himself.
09:49 < gladiatr> I must be...
09:49 < gladiatr> <lkthomas> is it possible to share same pki with multiple users ?
09:50 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
09:50 < gladiatr> ...and so I'm having a wonderful time, but I'd rather be whistling in the dark...
09:51 < ecrist> when did he say taht...
09:51 < ecrist> oh, nm
09:51 < ecrist> I just need to read up further
09:51 < gladiatr> hehe
09:53 < gladiatr> I just activated timestamps... probably not a bad idea... this fellow probably asked his question at 3am
09:53 < gladiatr> Oh.  Yeah.  Indeed so.  2:40 cst
10:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 276 seconds]
10:00 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
10:10 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
10:15 -!- p3rror [~mezgani@41.140.31.102] has joined #openvpn
10:22 -!- p3rror [~mezgani@41.140.31.102] has quit [Ping timeout: 240 seconds]
10:28 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
10:28 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
10:28 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:34 -!- p3rror [~mezgani@41.140.170.228] has joined #openvpn
10:35 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
10:35 -!- mode/#openvpn [+o mattock] by ChanServ
10:35 -!- mattock [~samuli@openvpn/corp/admin/mattock] has left #openvpn []
10:36 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
10:40 -!- p3rror [~mezgani@41.140.170.228] has quit [Ping timeout: 265 seconds]
10:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:53 -!- p3rror [~mezgani@41.140.174.215] has joined #openvpn
11:01 -!- p3rror [~mezgani@41.140.174.215] has quit [Ping timeout: 240 seconds]
11:01 -!- grendal_prime [~sgraham@206.128.84.26] has joined #openvpn
11:01 < grendal_prime> hey, is there a way with gateway-redirect to set a different ip as the getway?
11:03 < grendal_prime> i have a bridged setup and i need to push a different gateway to the clients ...the openvpn server is x.x.14.3 and i need the pushed gateway to be x.x.14.1 basically.
11:03 < grendal_prime> can i replace def1 with a specify ip?
11:04 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
11:05 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
11:06 < gladiatr> I don't think such a thing would work with the redirect-gateway directive; however, you might play around with pushing a 0.0.0.0 [desired gateway IP] route to your bridged client.
11:07 -!- gladiatr is now known as gladiatr_akf
11:07 -!- gladiatr_akf is now known as gladiatr_afk
11:08 -!- s7r [~s7r@95.154.230.174] has left #openvpn []
11:11 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
11:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:18 -!- p3rror [~mezgani@41.140.33.102] has joined #openvpn
11:22 -!- ljvb [~jason@vps.vanbrecht.com] has quit [Quit: My damn controlling terminal disappeared!]
11:27 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving.]
11:30 -!- Azoff [foobar@c83-252-248-115.bredband.comhem.se] has quit [Quit: reboot]
11:43 -!- p3rror [~mezgani@41.140.33.102] has quit [Ping timeout: 240 seconds]
11:48 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:50 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
11:50 -!- mode/#openvpn [+o mattock] by ChanServ
11:50 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Connection reset by peer]
11:53 -!- gladiatr_afk is now known as gladiatr
11:55 -!- p3rror [~mezgani@41.140.179.88] has joined #openvpn
11:56 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:57 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
11:57 -!- mode/#openvpn [+o mattock] by ChanServ
12:06 <@vpnHelper> RSS Update - forum: IP address of client still visible <http://forums.openvpn.net/topic7514.html#p9338>
12:12 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
12:12 <@vpnHelper> RSS Update - forum: os stucking after an big throught put <http://forums.openvpn.net/topic7550.html#p9339>
12:13 < mete> http://openvpn.net/index.php/open-source/documentation/howto.html#pki
12:13 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:13 < mete> here is a table of the pki files which were genearted during the process
12:14 < mete> in the last row is written "secret" and then in each line YES or NO
12:14 < mete> if there is written yes, so they must be stored secret?
12:18 < gladiatr> They should be encrypted.
12:19 < mete> ok so they are "save"
12:19 < gladiatr> ...
12:19 < gladiatr> whatcha mean?
12:19 < mete> what? xD
12:19 < mete> hmmh, where is the best to store the ca.key? ^^
12:20 < gladiatr> The best place is on an encrypted file system that only gets mounted on a system that runs no services and can only be accessed from a console.
12:20 < gladiatr> er... that only gets mounted when needed
12:20 < mete> hmmh ok
12:20 < mete> other question
12:21 < mete> when I set up a ca on a other client
12:21 < mete> as the server
12:21 < mete> which files I need to update on the openvpn server when I add a client?
12:21 < gladiatr> do you mean: when you set up a client with a certificate signed by my ca?
12:22 < gladiatr> meh.  pronoun disaster
12:22 < gladiatr> s/you/I
12:22 < mete> yes, and the CA is on another machine as the openvpn server 
12:23 < gladiatr> the CA itself needs to stay on a secured system.  The server and all of your clients need the ca.crt file.  At that point, no changes need to be made on the server.  All you have to do is create client certificates (signed by your CA) and distribute them
12:23 < mete> ok
12:24 < gladiatr> All the server needs, at that point, is to be able to see that the client cert has a valid signature
12:24 < mete> how the server knows which client cert is revoked?
12:24 < mete> do I need to revoke the cert on the openvpn server or on the server on which the CA is installed?
12:24 < gladiatr> whenever you revoke a certificate, you need to copy a new version of your crl file to the openvpn server.  Depending on how many certs you're planning on dealing with, you can do this manually or automatically
12:25 < gladiatr> client certificates can only be revoked by the CA
12:25 < mete> k
12:29 < mete> where do I need to specify the crl file in the openvpn config? I can't find anything in this config: http://openvpn.net/index.php/open-source/documentation/howto.html#examples
12:29 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:29 < mete> this openvpn is complex -.-
12:30 < gladiatr> !factoids search crl
12:30 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
12:30 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
12:30 < mete> start option
12:30 < mete> alright ;)
12:31 < mete> will set up a crypted VM for CA :)
12:31 < mete> then I will test that ;)
12:31 < gladiatr> :D
12:31 < mete> it sounds very secure then *gg* thanks gladiatr
12:31 < gladiatr> you bethca
12:32 < mete> where are you from gladiatr?
12:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
12:33 < gladiatr> NE Kansas, USA.  We don't believe in evolution, but, by god, we can crank out a mean vpn config :P :D
12:33 < mete> :PP
12:33 < mete> USa is cool
12:33 < mete> I go this summer to the usa 
12:33 < mete> to learn a bit english
12:34 < gladiatr> It doesn't sound likey you have too much more work to do.  You certainly understand it better than I understand... anything that isn't English.  heh
12:34 < mete> xD
12:35 < mete> written text I understand very good, but sometimes when I'm at the telephone and request support (symantec, hp, vmware) it sounds like a other language to me xD
12:36 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
12:37 -!- grendal_prime [~sgraham@206.128.84.26] has quit [Ping timeout: 240 seconds]
12:38 < gladiatr> It can be difficult.  With the outsourcing of phone support, it's not uncommon to be speaking with someone who speaks english as a 2nd or 3rd language anyway.  As I said: good for them.  If it bothered me enough, I'd learn their language and just ask them to speak in their native tongue.
12:38 < gladiatr> so, bravo for your motivation!
12:39 < mete> I'm working in a it consulting firm, so we have often to do with big software firms...
12:39 < mete> and the "good" support from vmware is in usa ;)
12:39 < mete> so I^ve to speak english to them :P
12:40 < mete> each time I call, I say them, that they have to speak fast to me ;) then it's mostly OK to phone with them
12:40 < mete> heh
12:40 < gladiatr> lol
12:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
12:41 < mete> in india they can speak german, but they haven't a clue to solve my problems :P
12:43 < gladiatr> Indeed.  I knew some guys that worked for a contractor that did tier 1 tech support a computer maker here in the states.  There was the information they were provided in a 3-ring binder and their own knowledge of troubleshooting Windows and PC issues, but that was it.  They had no access to internal troubleshooting databases.
12:43 < mete> hehe
12:43 < mete> we're a 7 people firm :P
12:44 < mete> and we've access to some databases and/or tech support
12:45 < mete> soo, debian netinstall is doing his job xD
12:45 < gladiatr> Yeah.  If you can become a recognized support partner for a lot of the larger companies, they let you into their Inner Sanctum of Knowledge (sometimes)(
12:45 < mete> hehe
12:46 < mete> only on bad thing by our company is, that we only have windows machines... :(
12:46 < mete> so all linux stuff is only private -.-
12:46 < mete> good that I startet when I was 14 to set up a linux box, heh
12:47 < gladiatr> hmmm... that's rough.  But the nice thing about Windows being so rickety is that there is lots of money to be made maintaining it.
12:47 -!- irssi____ [~irssi@devastation.securewebs.net] has quit [Ping timeout: 265 seconds]
12:47 < gladiatr> indeed
12:47 < mete> jep ;)
12:47 < mete> so, I ned to good :)
12:47 < mete> have a nice day gladiatr
12:48 < gladiatr> thank you very much!  And to you as well :)
12:50 -!- xindz [karz@bounced.by.nbounce.com] has quit [Ping timeout: 246 seconds]
12:52 -!- xindz [karz@bounced.by.nbounce.com] has joined #openvpn
13:03 -!- grendal_prime [~sgraham@dhcp64-134-224-30.fpscc.den.wayport.net] has joined #openvpn
13:07 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
13:11 -!- jhelwig [~jhelwig@li229-87.members.linode.com] has quit [Changing host]
13:11 -!- jhelwig [~jhelwig@puppetlabs/development/jhelwig] has joined #openvpn
13:17 -!- Mish12 [~mish@194.28.69.111.dynamic.snap.net.nz] has quit [Ping timeout: 240 seconds]
13:28 -!- dschuett [~dschuett@216.229.21.250] has quit [Ping timeout: 255 seconds]
13:28 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
13:31 -!- grendal_prime [~sgraham@dhcp64-134-224-30.fpscc.den.wayport.net] has quit [Read error: Operation timed out]
13:34 -!- Zipper_32 [~Zipper_32@72.53.35.91] has joined #openvpn
13:38 < Zipper_32> !welcome
13:38 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:38 < Zipper_32> !route
13:38 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
13:39 < Zipper_32> !redirect
13:39 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:39 < Zipper_32> !nat
13:39 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:48 -!- Malard [~ident@xbmc/staff/malard] has quit [Read error: Connection reset by peer]
13:49 -!- WinstonSmith [~true@g225028010.adsl.alicedsl.de] has joined #openvpn
13:50 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
13:50 -!- Malard|Home [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
13:50 -!- Malard|Home [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
13:50 -!- Malard|Home [~ident@xbmc/staff/malard] has joined #openvpn
13:54 -!- Malard [ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
13:56 -!- WinstonSmith [~true@g225028010.adsl.alicedsl.de] has quit [Read error: Connection reset by peer]
14:04 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
14:11 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:12 -!- p3rror [~mezgani@41.140.179.88] has quit [Ping timeout: 255 seconds]
14:15 -!- WinstonSmith [~true@g231242201.adsl.alicedsl.de] has joined #openvpn
14:17 -!- prettyrobots [~alan@66.93.0.189] has joined #openvpn
14:22 -!- p3rror [~mezgani@41.248.188.84] has joined #openvpn
14:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
14:28 -!- WinstonSmith [~true@g231242201.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
14:31 -!- WinstonSmith [~true@g231242201.adsl.alicedsl.de] has joined #openvpn
14:39 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 245 seconds]
14:43 -!- Rolybrau [~Rolybrau@62-67.78-83.cust.bluewin.ch] has joined #openvpn
14:43 -!- Rolybrau [~Rolybrau@62-67.78-83.cust.bluewin.ch] has quit [Changing host]
14:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:43 < mete> If you would like to password-protect your client keys, substitute the build-key-pass script.
14:43 < mete> can I use that for server key as well gladiatr? :)
14:49 < gladiatr> hrm... well, I use the easy-rsa scripts (version 2), so all I do to password protect keys is ./pkitool --pass --server servername.whee.com (or for clients, I leave out the --server)
14:49 < mete> hmmh
14:49 < mete> one moment xD
14:50 < mete> you have generated the keys
14:50 < mete> and afterwards you use pkitool?
14:52 < gladiatr> No.  I generate the certificate and the associated key at the same time with the above pkitool command
14:53 < mete> hmmh okay
14:53 < mete> is there a howto/short tut available? ^^
14:54 < mete> why there are 100 methods for that? xDDD
14:54 < mete> unbelivable$
14:55 < gladiatr> Hrm... 
14:56 < mete> or can you post the two commands? ^^
14:56 < mete> then I will try ;)
14:56 < mete> I'll make a snapshot before testing :P
14:57 -!- ljvb [~jason@vps.vanbrecht.com] has joined #openvpn
14:57 < gladiatr> Yeah.  It looks like a lot of the how-to's you find from searching google are for version 1.  It has been quite a while... I think I just looked at the scripts :)
14:57 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
14:58 < ljvb> openvpn on android.. I just rebooted my phone.. openvpn is disabled in the settings menu.. yet I am watching my vpn server log files.. and its trying to connect (getting bad lzo decompression header, but thats another issue).. why is ovpn even attempting to connect???
15:01 -!- Malard|Home [~ident@xbmc/staff/malard] has quit [Ping timeout: 276 seconds]
15:04 < gladiatr> out of curiosity, have you checked the support forums (or whatever they've got) for the openvpn package you're using?  krzee's is the only voice I've heard in here re: android and haven't seen him on today
15:05 < mete> hmmh, I think it's enoght save if I only crypt the  folder, in which the keys are? eg. /etc/openvpn/scripts/keys?
15:05 < gladiatr> mete, that would essentially accomplish the same thing, yes.
15:05 < ljvb> thats who I was hoping would be around.. heg.. I will go hunt down the developer forum when I a done my concall
15:06 < mete> k, that's the easiest way :P
15:06 < mete> for my crypted VM :P
15:10 -!- WinstonSmith [~true@g231242201.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
15:10 -!- WinstonSmith [~true@g231242201.adsl.alicedsl.de] has joined #openvpn
15:18 -!- p3rror [~mezgani@41.248.188.84] has quit [Ping timeout: 240 seconds]
15:22 < mete> hmmh
15:25 < mete> ./build-ca -pass
15:25 < mete> :)
15:26 -!- WinstonSmith [~true@g231242201.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
15:27 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
15:31 -!- p3rror [~mezgani@41.140.172.164] has joined #openvpn
15:33 < ljvb> bah.. cannot for the life of me find support forum or channel for the android port// 
15:37 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
15:39 -!- WinstonSmith [~true@e177092114.adsl.alicedsl.de] has joined #openvpn
15:42 < mete> so
15:42 < mete> all pem's crt's key's etc are created
15:42 < mete> xD
15:46 < mete> gladiatr: crl file is only generated, when I revoka a certificate?
15:47 < reiffert> yes.
15:47 < mete> k
15:48 < mete> can I create a "null" file and give that as crl file? so that I don't need to modify the command in the future?
15:48 < mete> :P
15:49 < gladiatr> that might work.  Or you could make a dummy cert that you immediately revoke to initialize the file
15:50 < gladiatr> I don't imagine that openvpn would choke on an empty file, but I've never tried it
15:50 < mete> k ;)
15:50 < mete> will try
15:50 < mete> :P
15:50 < mete> openvpn is a nice toy :P
15:52 < mete> interesting
15:53 < mete> I start openvpn with the new config file, but no error message
15:53 < mete> and openvpn isn't running
15:53 < mete> xD
15:54 -!- lteo [~lteo@lteo-1-pt.tunnel.tserv3.fmt2.ipv6.he.net] has joined #openvpn
15:58 < gladiatr> try running it from the command line.  openvpn --config /etc/openvpn/serverconfig.conf --verb 4
16:00 < mete> jep ;)
16:00 < mete> saw the error
16:00 < mete> heh
16:00 < mete> where do I specify the dh files? 01 and 02.pem? xD
16:00 < mete> dh 01.pem
16:01 < mete> doesn't work as parameter in the config file
16:01 < ljvb> okay.. so I figure the problem for the android port is somewhere within the openvpn settings/startup client front end.. because running openvpn client.ovpn works just fine from adb shell
16:01 < gladiatr> nope... hang on
16:02 < gladiatr> use this to generate your dh file: openssl dhparam -out dh1024.pem 1024
16:03 < mete> k, can I do this on the openvpn server, or must I generate it on the key machine?
16:03 < gladiatr> the server is fine
16:03 < mete> kk ;)
16:05 < ljvb> ssl-admin works great for managing certificates for clients
16:05 < ljvb> well, on fbsd it does, I am sure there is something similar for whatever OS your using
16:05 < dvl> FreeBSD FTW. ;)
16:06 < mete> ^^
16:06 < mete> console is better
16:06 < mete> :P
16:06 < ljvb> ssl-admin is just a menu driven perl script on the console
16:06 < ljvb> that calls openssl
16:07 < gladiatr> dvl, agreed :)
16:07 < ljvb> so.. yes.. its still console :P
16:07 < mete> ;)
16:07 < mete> :PP
16:07 < mete> so
16:07 < mete> server is startet
16:07 < mete> first step is done
16:07 < mete> xD
16:09 < gladiatr> woot!
16:11 < mete> first I install winscp on the client
16:11 < mete> to copy the files
16:11 < mete> xD
16:13 -!- gladiatr is now known as gladiatr_afk
16:15 -!- dvl [~dvl@pdpc/supporter/active/dvl] has left #openvpn ["Leaving"]
16:16 < Fthis> VNC/remote desktop sucks over my site-to-site VPN (static key)
16:17 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has joined #openvpn
16:17 < Fthis> it is fine over my TCP server/client setup though
16:17 < lteo> heard from someone today that openvpn will not work on windows 7 with a non-administrative user. is that true?
16:18 < Fthis> it probably just pops up an annoying box that you just click OK on and then it works until it BSOD's anyway so go ahead and try it
16:19 -!- prettyrobots [~alan@66.93.0.189] has quit [Quit: prettyrobots]
16:19 < gladiatr_afk> lteo, you have to be able to run openvpn with admin privileges so it can manipulate the routing table
16:19 -!- gladiatr_afk is now known as gladiatr
16:21 < mete> can I activate tls mode in config file? or is this on the cmd only? :S
16:22 < gladiatr> mete, anything you specify on the command line can be included in the configuration file
16:23 < lteo> gladiatr: thanks. what is the recommended way to give a non-admin user admin privileges to openvpn so that the routing table can be modified?
16:24 < mete> that's good
16:24 < mete> xD
16:24 < tuxx_> hey guys.. im having trouble generating
16:24 < tuxx_> the keys
16:24 < tuxx_> my server.crt is always empty
16:24 < mete> which command you used?
16:25 < tuxx_> . ./vars ; ./clean-all; ./build-server-keys
16:25 < tuxx_> i think
16:25 < gladiatr> lteo, there are two ways that I know of: make the user an "admin" user or give an "non-admin" user a password for an account that has admin privs.  Great choices, huh?  
16:25 < tuxx_> one sec
16:26 < tuxx_> mete: . ./vars; ./clean-all  ; ./build-ca ; ./build-key-server server; ./build-key-server server ; ./build-key client1;./build-key client2 ;./build-dh
16:26 < lteo> gladiatr: wow
16:26 -!- ucekpolish1 [user@hq.ostc-pl.com] has quit [Ping timeout: 246 seconds]
16:27 < gladiatr> lteo, yup.  It sucks.  dunno.  There might be some magical way of getting around that.  If so, I do not know what it is.
16:27 < tuxx_> mete: is that the correct way?
16:28 < tuxx_> mete: used from /usr/share/doc/openvpn/examples/easy-rsa/2.0
16:29 -!- gladiatr is now known as gladiatr_afk
16:31 < ljvb> grrrr.. okay.. bunch of issues with the android client.. 1, running it from the command line, and then killing it.. does not actually kill the client...
16:31 < ljvb> need to kill pid
16:32 < mete> should be OK
16:32 < mete> hmmh do I need a additional tls-auth key? xD
16:34 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Ping timeout: 272 seconds]
16:34 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
16:35 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
16:37 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Remote host closed the connection]
16:39 -!- p3rror [~mezgani@41.140.172.164] has quit [Ping timeout: 260 seconds]
16:44 < ljvb> aha.. resolv-retry infinite is what is causing the android client to puke.. consistently trying to log in to the server multiple times using the same certificate
16:47 -!- morbidwar [~morbidwar@78.96.23.179] has joined #openvpn
16:59 -!- prettyrobots [~alan@76.226.170.139] has joined #openvpn
16:59 -!- Malard [ident@xbmc/staff/malard] has quit [Ping timeout: 260 seconds]
17:00 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has joined #openvpn
17:00 -!- Malard [ident@dsl78-143-214-202.in-addr.fast.co.uk] has quit [Changing host]
17:00 -!- Malard [ident@xbmc/staff/malard] has joined #openvpn
17:00 -!- Fthis [6276ddd4@gateway/web/freenode/ip.98.118.221.212] has quit [Quit: Page closed]
17:01 < mete> fuck
17:02 < mete> tap32 driver doesn't work on w7 x64
17:02 < mete> -.-
17:02 < ecrist> thre is a tap driver
17:02 < mete> jep
17:02 < ecrist> that works on win 7
17:02 < mete> xD
17:02 < mete> I had a old openvpn
17:02 < ecrist> simply install the latest version
17:02 < ecrist> :)
17:02 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
17:02 < mete> that worked :P
17:02 < mete> doesn't work
17:02 < mete> ..
17:03 < ecrist> you make no sense.
17:03 < mete> openvpn-2.0.9-gui-1.0.3-install.exe
17:03 < mete> this package I've installed
17:03 < ecrist> that's not the latest.
17:03  * ecrist points to /topic
17:06 < mete> ok th 2.2 beta5 works
17:06 < mete> ;)
17:06 < mete> thx
17:06 < ecrist> 2.1.4 would work, too
17:06 < mete> yessss
17:06 < mete> cert is working
17:06 < mete> hah
17:06 < mete> xD
17:07 < mete> nice
17:07 -!- Guest52298 [43a40ced@gateway/web/freenode/ip.67.164.12.237] has joined #openvpn
17:07 < mete> cool thing
17:07 < ecrist> I though we banned the web client...
17:08 < Guest52298> wait I have a question
17:09 < Guest52298> I have a problem with the openvpn client. It's installed, and I can login, but I constantly get stuck on the "download the openvpn client" page and it never connects...
17:09 < Guest52298> "You will be automatically connected" - never happens
17:09 < ecrist> are you referring to OpenVPN Access Server?
17:10 < reiffert> download the openvpn client sounds like Access Server, does it?
17:10 < ecrist> yeah, it does to me
17:10 < Guest52298> yes
17:10 < Guest52298> openvpn-as
17:10 < reiffert> Guest52298: see here then:
17:10 < reiffert> !as
17:10 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
17:10 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
17:11 < Guest52298> ok
17:12 -!- Guest52298 [43a40ced@gateway/web/freenode/ip.67.164.12.237] has left #openvpn []
17:12 < reiffert> it took quite a while for vpnHelper to answer on !as
17:12 < reiffert> I'd guess it looked like 10 seconds for me. Saw it too?
17:12 < ecrist> I saw it instantly
17:12 < ecrist> but, I'm on the same lan as vpnHelper
17:13 < ecrist> though, he and I are connected to different servers
17:13 < reiffert> at least it's no brain lag on vpnHelper then.
17:13 < ecrist> oh, wait, my IRC client is now on a completely different network.
17:13 < ecrist> and 20 miles away
17:14 < ecrist> AND we're connected to different servers
17:14 < ecrist> I think it's you, reiffert
17:14 < reiffert> glad it's not vpnHelper, like I said
17:15 < reiffert> !as
17:15 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
17:15 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
17:15 < reiffert> normal now
17:17 -!- Malard [ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
17:17 < ljvb> exit
17:18 < ljvb> good thing I was not typing in a password
17:18 < ljvb> heh....
17:18 < ecrist> lol
17:18 < ecrist> I've done that
17:18 < ecrist> in this very channel
17:18 -!- Malard [~ident@hebe.travelrepublic.co.uk] has joined #openvpn
17:18 -!- Malard [~ident@hebe.travelrepublic.co.uk] has quit [Changing host]
17:18 -!- Malard [~ident@xbmc/staff/malard] has joined #openvpn
17:18 < ljvb> I have too.. many times.. hell.. I have been around since this place was linpeople.. very first day my nickserv password went to the channel
17:19 < ljvb> I need to learn to make sure there is a / and mouse focus is on correct window heh..
17:19 < ljvb> dinner time
17:19 < ljvb> will have to figure out the bad source address issue later.. wife is getting angry.. heh..
17:20 < reiffert> focus follows mouse can be configured.
17:23 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
17:24 -!- morbidwar [~morbidwar@78.96.23.179] has quit [Read error: Connection reset by peer]
17:30 -!- djgerm [~Your_Moms@adsl-99-139-49-113.dsl.pltn13.sbcglobal.net] has joined #openvpn
17:32 -!- Malard [~ident@xbmc/staff/malard] has quit [Ping timeout: 240 seconds]
17:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
17:53 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html>
18:02 < ljvb> irssi connectbot is we ierd...
18:04 < ljvb> hmmmm, won't do landscape
18:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:05 < ljvb> anyways, openvpn problems seem resolved... 
18:07 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
18:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:20 < ljvb> and in the stroke of the finger, iI f'd it all up again... ugg oh well, try later when iI get home
18:33 -!- WinstonSmith [~true@e177092114.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
18:36 -!- djgerm1 [~Your_Moms@adsl-99-139-49-113.dsl.pltn13.sbcglobal.net] has joined #openvpn
18:37 -!- djgerm [~Your_Moms@adsl-99-139-49-113.dsl.pltn13.sbcglobal.net] has quit [Read error: Connection reset by peer]
18:49 -!- WinstonSmith [~true@e177089110.adsl.alicedsl.de] has joined #openvpn
18:55 -!- gladiatr_afk [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
18:59 < krzee> hey
19:00 < krzee> oh cool you got it working?
19:00 < krzee> ^ @ ljvb 
19:12 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
19:13 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:13 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
19:14 -!- batrick [~batrick@nmap/developer/batrick] has quit [Client Quit]
19:15 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
19:16 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
19:17 <@vpnHelper> RSS Update - forum: Tunnel low speed <http://forums.openvpn.net/topic7519.html#p9341>
19:18 -!- djgerm1 [~Your_Moms@adsl-99-139-49-113.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving.]
19:23 < krzee> !winroute
19:23 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin
19:37 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
20:21 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
20:25 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
20:27 -!- prettyrobots [~alan@76.226.170.139] has quit [Quit: prettyrobots]
20:35 -!- agrajag [~agrajag^@c-24-131-78-108.hsd1.pa.comcast.net] has joined #openvpn
20:45 -!- WinstonSmith [~true@e177089110.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:45 -!- WinstonSmith [~true@e177089110.adsl.alicedsl.de] has joined #openvpn
20:50 -!- albech [~thomas@119.42.78.253] has joined #openvpn
20:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 255 seconds]
20:55 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
20:57 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
21:07 -!- krzee [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
21:10 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
21:15 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
21:15 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
21:15 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
21:26 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:34 < tuxx_> hey guys
21:36 < tuxx_> in windows 7
21:36 < tuxx_> i keep getting the following error msg when trying to connect to the server
21:36 < tuxx_> all tap-win32 adapters are in use.
21:38 < tuxx_> i deleted and recreated the tap interfaces
21:38 < tuxx_> also... im using "dev tun" in the config rather than dev tap
21:48 < theDoc> Do you really need briding?
21:48 < theDoc> bridging^
22:01 -!- teddz_ [~teddz@dtmd-4d0bfc45.pool.mediaWays.net] has joined #openvpn
22:04 -!- teddz [~teddz@dtmd-4db2e331.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
22:35 -!- teddz_ [~teddz@dtmd-4d0bfc45.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:36 -!- albech [~thomas@119.42.78.253] has quit [Ping timeout: 255 seconds]
22:49 -!- albech [~thomas@124.157.245.126] has joined #openvpn
22:53 -!- WinstonSmith [~true@e177089110.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
22:53 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 240 seconds]
23:02 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
23:05 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
23:05 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
23:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
23:15 -!- WinstonSmith [~true@g231231254.adsl.alicedsl.de] has joined #openvpn
23:38 < grendal_prime> grrrrr
--- Day changed Sat Jan 22 2011
00:06 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
00:07 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
00:07 -!- Cain` is now known as Cain
00:11 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
00:58 < hyper_ch> grendal_prime: awww :(
00:59 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
01:09 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:10 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
02:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
02:21 -!- WinstonSmith [~true@g231231254.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
02:35 -!- WinstonSmith [~true@e177090246.adsl.alicedsl.de] has joined #openvpn
02:37 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
02:38 -!- ucekpolish1 [user@hq.ostc-pl.com] has joined #openvpn
02:46 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
02:49 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Client Quit]
02:54 -!- WinstonSmith [~true@e177090246.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
03:11 -!- WinstonSmith [~true@g231231254.adsl.alicedsl.de] has joined #openvpn
03:19 -!- luneff [~yury@84.51.197.224] has joined #openvpn
03:19 -!- luneff [~yury@84.51.197.224] has quit [Client Quit]
03:23 -!- ucekpolish1 [user@hq.ostc-pl.com] has quit [Ping timeout: 272 seconds]
03:41 <@vpnHelper> RSS Update - forum: Two link in load-balance causing tunnels the stop working <http://forums.openvpn.net/topic7541.html#p9342>
03:52 -!- master_of_master [~master_of@p57B52D32.dip.t-dialin.net] has quit [Ping timeout: 265 seconds]
03:53 -!- master_of_master [~master_of@p57B54F2B.dip.t-dialin.net] has joined #openvpn
04:00 -!- WinstonSmith [~true@g231231254.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
04:10 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
04:16 -!- WinstonSmith [~true@e178180084.adsl.alicedsl.de] has joined #openvpn
04:41 -!- caesay_ [~caesay@173.236.15.70] has quit [Ping timeout: 255 seconds]
04:41 -!- caesay [~caesay@173.236.15.70] has joined #openvpn
04:42 -!- caesay is now known as Guest57877
04:48 -!- common- [~common@p5DDA402D.dip0.t-ipconnect.de] has joined #openvpn
04:49 -!- common [~common@p5DDA488B.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
04:49 -!- common- is now known as common
04:58 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
04:58 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
04:58 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
05:29 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
05:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:52 -!- xindz [karz@bounced.by.nbounce.com] has quit [Ping timeout: 246 seconds]
05:52 -!- xindz [karz@bounced.by.nbounce.com] has joined #openvpn
06:03 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
06:27 <@vpnHelper> RSS Update - forum: IP address of client still visible <http://forums.openvpn.net/topic7514.html#p9343>
06:29 -!- WinstonSmith [~true@e178180084.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
06:37 -!- teddz_ [~teddz@dtmd-4d0bfc45.pool.mediaWays.net] has joined #openvpn
06:58 <@vpnHelper> RSS Update - forum: OpenVPN Server + WL-500G - Routing over Client LAN <http://forums.openvpn.net/topic7553.html>
07:08 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
07:17 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Quit: Lost terminal]
07:58 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has joined #openvpn
08:07 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has left #openvpn []
08:17 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
08:37 < ecrist> good morning
08:50 -!- bfreis [~bruno@bd21aa1e.virtua.com.br] has joined #openvpn
08:51 < bfreis> Hi, if I have a Root CA that signed a Personnel CA and a Servers CA, then I create a certificate for OpenVPN signed by Servers CA and create certificates for the clients signed by Personnel CA, will it work?
08:51 <@vpnHelper> RSS Update - forum: OpenVPN Server + WL-500G - Routing over Client LAN <http://forums.openvpn.net/topic7553.html#p9345>
08:56 -!- bfreis [~bruno@bd21aa1e.virtua.com.br] has quit [Quit: bfreis]
08:56 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
08:57 < ecrist> he waited less than 5 minutes for an answer
08:57 <@vpnHelper> RSS Update - forum: Problems with RoadWarrior Setup on Windows Server 2008 <http://forums.openvpn.net/topic7391.html#p9346>
08:58 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:58 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
09:01 -!- p3rror [~mezgani@41.140.24.150] has joined #openvpn
09:03 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
09:16 < Dougy> ahh impatient people
09:16 < Dougy> just like me
09:25 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
09:26 < Dougy> howdy jpalmer 
09:26  * ecrist thought jpalmer had an openvpn cloak
09:37 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:39 < jpalmer> hey ecrist
09:40 < jpalmer> nah,  I never had an openvpn cloak
09:40 < jpalmer> hola Dougy 
10:17 -!- p3rror [~mezgani@41.140.24.150] has quit [Ping timeout: 240 seconds]
10:17 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 250 seconds]
10:20 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
10:29 -!- Guest57877 is now known as caesay
10:29 -!- caesay [~caesay@173.236.15.70] has quit [Changing host]
10:29 -!- caesay [~caesay@unvanquished/associate/sniperx] has joined #openvpn
10:48 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Quit: leaving]
10:55 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
11:08 -!- bragon [~Alexandre@81.93.247.165] has joined #openvpn
11:08 < bragon> Hi
11:08 < bragon> i there a way to unactive the "route push" directive on the client side ?
11:09 < bragon> a serveur push me route, and i don't want it.
11:10 -!- p3rror [~mezgani@41.140.181.130] has joined #openvpn
11:12 < bragon> route-noexec
11:13 -!- p3rror [~mezgani@41.140.181.130] has quit [Read error: Connection reset by peer]
11:14 < bragon> thanks :)
11:28 -!- p3rror [~mezgani@41.140.182.159] has joined #openvpn
11:43 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
11:46 -!- p3rror [~mezgani@41.140.182.159] has quit [Ping timeout: 240 seconds]
11:53 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has joined #openvpn
11:55 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
11:58 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 264 seconds]
11:58 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 264 seconds]
11:58 -!- openbsdnoob_ is now known as openbsdnoob
12:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
12:03 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:49 < ljvb> woooo, fixed my android client issues... now not to f it up again
12:50 < ljvb> although, the client sometimes runs ovpn multiple times causing problems
12:50 < ljvb> iI will live
13:01 -!- p3rror [~mezgani@41.140.168.28] has joined #openvpn
13:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:26 -!- Nappy [~nappy@97.97.247.123] has quit [Read error: Connection reset by peer]
13:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
13:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:41 -!- T0mmy [~theswedes@76-191-207-53.dsl.dynamic.sonic.net] has joined #openvpn
13:41 < T0mmy> 	Centimeter by centimeter he watched his cock grow thicker,
13:41 < T0mmy> spreading Christa's cunt ever wider in its wake.  Both of her hands came
13:41 < T0mmy> down to grip the base of his cock as she looked down in disbelief.  At
13:41 < T0mmy> least six inches were outside of her now, and she had taken him nearly all
13:41 < T0mmy> the way before.  Curt opened his eyes and stared in disbelief.  He was
13:41 < T0mmy> growing even faster this time!  His cumming continued to make him buck
13:41 < T0mmy> like a bronco as his shaft grew ever more horse-like.  Thicker and longer
13:41 < T0mmy> -twined with huge, thick veins- his erection plowed into Christa's tight
13:42 < T0mmy> bush like a dog trying to fit into a rabbit hole. 
13:42 < T0mmy> 	"Ahhh!  Curt!  Omigod ... you're goin' too ... far!"
13:42 < T0mmy> 	Drastically, Curt tried to pull himself out of Christa before he
13:42 < T0mmy> hurt her.  Her moaning and bucking were intense and -just before he could-
13:42 -!- T0mmy [~theswedes@76-191-207-53.dsl.dynamic.sonic.net] has left #openvpn []
13:45 < ljvb> WTF
13:56 < dvl> easily found via google.
14:02 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
14:02 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
14:02 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:05 <@vpnHelper> RSS Update - forum: Anonyproz OpenVPN Service Provider <http://forums.openvpn.net/topic2502.html#p9347>
14:18 -!- p3rror [~mezgani@41.140.168.28] has quit [Ping timeout: 240 seconds]
14:28 -!- grendal_prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
14:30 < grendal_prime_> ok we got the vpn working with the appliance we need it working with..now...next thing is...i want to restrict to only http/https through the vpn the rest out the local gateway.  i need to set up PF ?  what is this program?
14:39 -!- p3rror [~mezgani@41.140.25.220] has joined #openvpn
14:40 < dvl> pf is a packet filter provided with BSD (openbsd, freebsd, netbsd, etc).
14:40 < dvl> grendal_prime_: does that help?
14:41 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
14:44 -!- alhadi [~thunderst@92.99.132.49] has quit [Changing host]
14:44 -!- alhadi [~thunderst@unaffiliated/alhadi] has joined #openvpn
14:59 <@vpnHelper> RSS Update - forum: Can't ping LAN behind VPN server <http://forums.openvpn.net/topic7547.html#p9348>
15:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 240 seconds]
15:09 < grendal_prime> thanks thats what i though but...well eveyrthing just refers to it as...pf..can it be implimented on the server side??
15:10 < dvl> yes, pf is on the server side.
15:10 < dvl> I have no idea what 'everything just refers' is.
15:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:12 < grendal_prime> dude...its like a simple version of iptables?
15:13 < dvl> I have zero experience with iptables.  :)
15:14 < grendal_prime> sorry all the info i could find on pf...(thats what i ment by everything)  But i dont see how i can force a client to use a difffernt gateway by refusing it traffic on specific ports.
15:14 < grendal_prime> i guuess...if one gateway deosnt work it will try the next?
15:14 < grendal_prime> dont usually configure machines with multiple gateways...
15:15 < grendal_prime> anyway thanks for the help in wrapping my head around  just what the hell they are talking about.
15:15 -!- grendal_prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
15:19 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Read error: Operation timed out]
15:19 -!- p3rror [~mezgani@41.140.25.220] has quit [Ping timeout: 260 seconds]
15:23 -!- WinstonSmith [~true@g225025159.adsl.alicedsl.de] has joined #openvpn
15:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
15:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:34 -!- p3rror [~mezgani@41.248.110.154] has joined #openvpn
15:35 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:42 -!- teddz_ [~teddz@dtmd-4d0bfc45.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
16:10 -!- tactus^^ [~tactus@35.217.16.62.customer.cdi.no] has joined #openvpn
16:12 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 255 seconds]
16:14 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
16:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:15 -!- tactus^^ [~tactus@35.217.16.62.customer.cdi.no] has left #openvpn []
16:18 -!- areq [~areq@pld-linux/areq] has joined #openvpn
16:18 < areq> !welcome
16:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:18 < areq> hi
16:21 < areq> I have openvpn server - dev tap, auth by crt and now I'm searching way to prevent client to change ip obtained from dhcp
16:22 < areq> possible ?
16:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 240 seconds]
16:34 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Ping timeout: 240 seconds]
16:51 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
16:57 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
16:59 < Dougy> areq: set static ip's?
16:59 < Dougy> !ccd
17:00 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
17:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:03 -!- p3rror [~mezgani@41.248.110.154] has quit [Ping timeout: 240 seconds]
17:16 -!- dmarkey [~dmarkey@188.141.16.113] has joined #openvpn
17:16 < dmarkey> any tips on reducing openvpns memory usage
17:26 < reiffert> how huge is it for you?
17:28 < dmarkey> 4M
17:29 < dmarkey> which isnt much, but this is on an openwrt router
17:29 < krzee> 1993 called and wants its memory usage back
17:31 < dmarkey> I thought maybe there was an easy way like reducing buffers or something
17:32 < roentgen> dmarkey: how many clients?
17:34 < dmarkey> 1
17:34 < dmarkey> maybe 2
17:36 < roentgen> well it surely depends on the clients number ... it's 188M here
17:36 < roentgen> and 1.5 as a client
17:41 < krzee> since its openwrt im sure its single core
17:41 < krzee> you might find playing with the cipher to help
17:45 < dmarkey> i see
17:48 -!- WinstonSmith [~true@g225025159.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
17:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
18:10 < areq> Dougy: yes, but I can change manul this IP on clien side 
18:11 < areq> ip a d 10.9.9.3/24 dev tap0; ip a a 10.9.9.33/24 dev tap0 ; ip r a 10.9.0.0/16 via  10.9.9.1
18:11 < krzee> yes, just set the ip
18:11 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
18:12 < areq> unfortunately 10.9.9.33 works
18:12 < krzee> unfortunately?
18:12 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
18:13 < areq> on server I have per client IP iptables rules
18:13 < krzee> see --learn-address
18:13 < krzee> then you can dynamicly change firewall rules
18:13 < areq> i read about learn-address
18:13 < krzee> otherwise, the only way to stop clients from being able to change IPs is to use tun with topology net30
18:14 < areq> i'm going to use iptables -m mac --mac-source
18:14 < krzee> can change mac easier
18:15 < areq> yes, but must guess right mac
18:16 < krzee> security by obscurity
18:17 < areq> on tap MAC is random every connection ?
18:17 < krzee> not sure
18:19 -!- WinstonSmith [~true@e179006195.adsl.alicedsl.de] has joined #openvpn
18:20 -!- Zipper_32 [~Zipper_32@72.53.35.91] has quit [Ping timeout: 255 seconds]
18:21 < areq> on windows is the same ;/ on linux changes
18:22 < krzee> --learn-address :-p
18:22 < krzee> also, why do you need tap?
18:22 < krzee> lan gaming?
18:23 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
18:23 < areq> no, only "historical ballast"
18:23 < areq> now not easy to change - 200 users
18:24 < krzee> 200 users on tap?
18:24 < krzee> ild expect a broadcast storm
18:25 < areq> not concurrent, concurrent < 30
18:26 < areq> tun will be better then tap in general ?
18:27 < krzee> less overhead, no layer2 attacks
18:27 <@vpnHelper> RSS Update - forum: Tap installs, but doesn't show up in ipconfig. <http://forums.openvpn.net/topic7501-15.html#p9349>
18:30 < areq> tun + net30 - needs 2 IP for one client ?
18:30 < krzee> 4
18:30 < krzee> !/30
18:30 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
18:31 < areq> ok
18:32 < areq> easy way to bond ip with client common name from crt ?
18:33 < krzee> --client-connect
18:33 < krzee> !client-connect
18:33 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
18:33 < krzee> or
18:33 < krzee> !static
18:33 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
18:34 < areq> i use now client-connect with tap and push config to client
18:34 < areq> more or less the same
18:35 < areq> krzee: thanks
18:36 < areq> I see that change tap->tun is inevitable
18:54 -!- Zipper_32 [~Zipper_32@72.53.35.91] has joined #openvpn
19:03 -!- Zipper_32 [~Zipper_32@72.53.35.91] has quit [Ping timeout: 255 seconds]
19:18 -!- Zipper_32 [~Zipper_32@72.53.35.91] has joined #openvpn
19:22 <@vpnHelper> RSS Update - forum: VM Lab using OpenVPN <http://forums.openvpn.net/topic7545.html#p9350>
19:25 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
19:31 -!- teddz_ [~teddz@dtmd-4d0bfc45.pool.mediaWays.net] has joined #openvpn
19:54 < mete> I've running 3 openvpn servers on one host. all use the same certificate... is it possible to limit access from one client to only one openvpn server? Or do I need for that a new CA?
19:58 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
20:01 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
20:19 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
20:19 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
20:29 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
20:33 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
20:34 -!- batrick [~batrick@nmap/developer/batrick] has quit [Client Quit]
20:34 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
20:44 -!- Typone is now known as TypoNe
20:48 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Ping timeout: 255 seconds]
20:51 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
20:57 -!- teddz_ [~teddz@dtmd-4d0bfc45.pool.mediaWays.net] has quit [Quit: Ex-Chat]
21:05 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
21:17 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
21:29 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
21:49 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
22:02 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
22:12 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
22:32 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
22:38 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
22:53 -!- ksk [ksk@im.knubz.de] has left #openvpn []
22:53 -!- albech [~thomas@119.42.78.45] has joined #openvpn
23:35 < krzee> mete, you can do that
23:35 < krzee> use disable in a ccd entry
23:35 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
23:35 < krzee> or a CRL which you only use on 2 of the servers, but thats not a good method
--- Day changed Sun Jan 23 2011
00:07 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
00:08 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
00:09 -!- Cain` is now known as Cain
01:30 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
02:04 -!- dmarkey [~dmarkey@188.141.16.113] has quit [Ping timeout: 255 seconds]
02:11 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:53 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
03:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:33 -!- WinstonSmith [~true@e179006195.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
03:45 -!- ucekpolish1 [user@hq.ostc-pl.com] has joined #openvpn
03:49 -!- WinstonSmith [~true@g225030018.adsl.alicedsl.de] has joined #openvpn
03:53 -!- master_of_master [~master_of@p57B54F2B.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
03:54 -!- master_of_master [~master_of@p57B52FB0.dip.t-dialin.net] has joined #openvpn
04:49 -!- common- [~common@p5DDA444E.dip0.t-ipconnect.de] has joined #openvpn
04:52 -!- common [~common@p5DDA402D.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
04:52 -!- common- is now known as common
05:03 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
05:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:23 -!- p3rror [~mezgani@41.140.178.106] has joined #openvpn
05:32 -!- p3rror [~mezgani@41.140.178.106] has quit [Ping timeout: 276 seconds]
05:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
05:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:39 -!- p3rror [~mezgani@41.140.180.97] has joined #openvpn
05:50 -!- morbidwar [~ovidiu@78.96.23.179] has joined #openvpn
06:03 -!- morbidwar [~ovidiu@78.96.23.179] has quit [Remote host closed the connection]
06:05 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
06:05 -!- p3rror [~mezgani@41.140.180.97] has quit [Ping timeout: 240 seconds]
06:22 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:22 -!- mode/#openvpn [+o mattock] by ChanServ
06:42 -!- p3rror [~mezgani@41.248.104.243] has joined #openvpn
06:46 < mete> ok thank you krzee :)  ccd is not my friend, but I will try ;)
06:48 <@vpnHelper> RSS Update - forum: Problem installing, compiling problem <http://forums.openvpn.net/topic7554.html>
06:58 -!- p3rror [~mezgani@41.248.104.243] has quit [Ping timeout: 264 seconds]
07:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
07:06 -!- DoubleDouble [~DoubleDou@ns300272.ovh.net] has joined #openvpn
07:06 < DoubleDouble> hello
07:07 -!- DoubleDouble [~DoubleDou@ns300272.ovh.net] has left #openvpn []
07:09 < hyper_ch> ccd is a friend to everyone
07:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:20 -!- DoubleDouble [~DoubleDou@77.207.240.42] has joined #openvpn
07:24 < DoubleDouble> !welcome
07:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:24 < DoubleDouble> !redirect
07:24 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
07:25 < DoubleDouble> !nat
07:25 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
07:27 < DoubleDouble> !ipforward
07:27 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
07:27 < DoubleDouble> !linipforward
07:27 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
07:31 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
07:39 < DoubleDouble> !goal
07:39 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:43 -!- DoubleDouble [~DoubleDou@77.207.240.42] has quit [Quit: Bye!]
07:57 -!- p3rror [~mezgani@41.248.108.172] has joined #openvpn
08:13 -!- hackeron [~hackeron@gentoo/user/hackeron] has joined #openvpn
08:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:26 < hackeron> would this be a valid server-bridge? < server-bridge 10.8.0.4 255.255.255.0 10.8.0.5 10.8.254.254
08:27 -!- p3rror [~mezgani@41.248.108.172] has quit [Ping timeout: 240 seconds]
08:32 < hackeron> I meant 10.8.0.4 255.255.0.0 10.8.0.5 10.8.254.254
08:32 < hackeron> when I try that, it says: WARNING: Since you are using --dev tun with a point-to-point topology, the second argument to --ifconfig must be an IP address.  You are using something (255.255.0.0) that looks more like a netmask. (silence this warning with --ifconfig-nowarn)
09:02 -!- anonymus [~yaa@178.176.66.77] has joined #openvpn
09:02 < anonymus> hi
09:02 < anonymus> does openvpn support arp proxy?
09:06 < anonymus> ??
09:10 -!- teddz [~teddz@dtmd-4db23fc3.pool.mediaWays.net] has joined #openvpn
09:12 < anonymus> danke
09:12 < anonymus> :)
09:12 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
09:16 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
09:26 -!- anonymus [~yaa@178.176.66.77] has quit [Quit: АХХХАХХААХХХАхахахахХхахаАААААААа11]
09:49 < hackeron> every time I make a mistake on the server config, it seems to kill all my openvpn clients - is there anyway to prevent this from happening?
10:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:07 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
10:14 -!- p3rror [~mezgani@41.248.109.153] has joined #openvpn
10:16 -!- albech [~thomas@119.42.78.45] has quit [Quit: Ex-Chat]
10:26 < ecrist> howdy
10:27 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
10:27 < Deathzor> hey guys how good is LZO compression ? 
10:27 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
10:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:28 < ecrist> good enough openvpn uses it. ;)
10:36 < alhadi> :)
10:36 < alhadi> hey
10:36 -!- p3rror [~mezgani@41.248.109.153] has quit [Ping timeout: 240 seconds]
10:36 < alhadi> is it good idea to have nobody and nogroup in openvpn.conf?
10:37 < ecrist> depends on your level of paranoia.
10:37 < alhadi> ok well its only me who access the server and vpn
10:37 < ecrist> I wouldn't suggest running as root, unless there's something specific  you need
10:37 < alhadi> ah ok
10:37 < alhadi> i appreciate your suggestions
10:42 < alhadi> thanks ecrist
10:42 < alhadi> i have set that nobody
10:42 < alhadi> in openvpn.conf
10:43 < hackeron> anyone? every time I change the server config, even little things like my clienc-connect script it seems to kill all my openvpn clients - is there anyway to prevent this from happening?
10:44 < hackeron> or if not prevent, anyway to get openvpn clients to restart themselves? - maybe an upstart persist script?
10:49 -!- p3rror [~mezgani@41.140.155.55] has joined #openvpn
10:53 -!- morbidwar [~ovidiu@78.96.23.179] has joined #openvpn
10:54 -!- p3rror [~mezgani@41.140.155.55] has quit [Ping timeout: 260 seconds]
10:58 < ecrist> resolv-retry infinite in client config should do it
10:58 < alhadi> ecrist its possible to tweak openvpn for voip?
10:59 < hackeron> ecrist: it doesn't
10:59 < hackeron> ecrist: that's just related to dns
11:02 < krzee> hackeron, but they shouldnt die unless you have certain options specified or it hits some sort of exit point (ie: fatal error)
11:03 < hackeron> krzee: it seems to hit an exit point, but my question is how to I get it to keep retrying anyway?
11:03 < krzee> depends on what is making them exit
11:03 < krzee> its not natural...
11:04 < hackeron> an exit point or fatal error is too liberal - I edit my client-connect script, there is a minor error there and it kills my client openvpn daemon, which means I have to drive 30 miles to restart it
11:04 < hackeron> so I want openvpn to keep trying
11:04 < krzee> kills the client because the server actively says no
11:04 < hackeron> right
11:04 < krzee> as opposed to the server just not answering
11:04 < hackeron> right
11:05 < hackeron> how do I get it to keep trying?
11:05 < krzee> by looking through the manual for an option that goes with that ;]
11:05 < krzee> !man
11:05 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
11:05 < hackeron> krzee: I did look through it, can't find such an option? :/
11:08 < krzee> i dont see one either
11:08 < krzee> but it seems rather sane to me for it to exit at that point
11:08 < krzee> ild say to test your client-connect scripts well ;)
11:09 -!- p3rror [~mezgani@41.140.36.36] has joined #openvpn
11:10 < hackeron> krzee: my client-connect scripts do a lot, like set up dns, store info about client in a database, change proxy settings, some times things don't work as expected - I don't want it to kill my openvpn connections for no reason :/
11:11 < krzee> its not for no reason, its because your script returns error
11:11 < krzee> which is the method needed for your server to say not to allow the connection
11:11 < krzee> if the connection is *not allowed* why should the client sit there trying and trying
11:12 < hackeron> krzee: because the database was being restarted for instance?
11:12 < hackeron> krzee: connection will be allowed shortly, keep trying client :P
11:13 < krzee> what happens if you sleep it off?
11:13 < krzee> oh nm i was bout to say maybe you could sleep and restart the client
11:14 < krzee> which at first glance sounds like a decent idea
11:14 < hackeron> well, that's what I want to do really - how do I do that?
11:14 < krzee> thing is, openvpn is single threaded, so that would freeze your tunnel
11:14 < krzee> it wouldnt pass traffic at all while doing that
11:15 < krzee> unless it was a plugin...
11:15 < hackeron> as opposed to what?
11:15 < hackeron> the connection is now being killed, it doesn't pass traffic anyway
11:15 < krzee> have you looked at eurephia?
11:15 < hackeron> no, having a look
11:15 < krzee> no no i mean all existing clients would freeze
11:15 < krzee> !dazo
11:15 <@vpnHelper> "dazo" is "eurephia" is http://www.eurephia.net/
11:16 < hackeron> I don't want username and password authentication :/
11:17 < krzee> then dont use username / pass auth
11:17 < krzee> heh
11:17 < hackeron> maybe I just need to hack the init script - better yet rewrite it for upstart
11:17 < hackeron> then I can just the persist stanza and not fork openvpn - presto :P
11:17 -!- p3rror [~mezgani@41.140.36.36] has quit [Ping timeout: 240 seconds]
11:18 < hackeron> krzee: eurephia is username and password for openvpn from what I can tell...
11:18 < krzee> lol @ fork openvpn because you cant make your script work right
11:18 < krzee> it does a lot more than that, doesnt even need to do login/pass afaik
11:18 < krzee> and heres a big plus:
11:18 < hackeron> krzee: by *not* fork I mean not use --daemon
11:18 < krzee> scripts hang openvpn daemon for ANYTHING else
11:19 < krzee> oh ok i see what you meant by fork now ;]
11:19 < krzee> [09:18]  <krzee> scripts hang openvpn daemon for ANYTHING else
11:19 < krzee> plugins do not
11:19 < hackeron> hmmm
11:20 < krzee> plugins are started in a seperate thread
11:20 < hackeron> maybe I should just fork the scripts
11:20 < hackeron> can I do that?
11:20 < hackeron> (without a double fork)
11:20 < krzee> its not like the devs dont know about that :-p
11:21 < hackeron> is this legal? < client-connect /etc/openvpn/openvpn_control.py &
11:21 < krzee> lol
11:22 < hackeron> :P
11:22 < hackeron> see, now if it isn't - that's going to kill all my openvpn client connections :/
11:22 < hackeron> for no reason what so ever :/
11:22 < krzee> for no reason?
11:22 < hackeron> yeh, it's not like I don't want them to connect
11:22 < krzee> then dont have your script report an error
11:23 < hackeron> no where did I say for the clients not to connect :(
11:23 < hackeron> the script doesn't report an error
11:23 < krzee> if it exits happy, clients connect
11:23 < hackeron> openvpn doesn't like that I have a & at the end
11:23 < krzee> well ya, cause thats retarded
11:23 < hackeron> where's the error exactly?
11:23 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
11:23 < hackeron> well, if scripts block, not forking them is retarded too :)
11:23 < krzee> you really thought i was going to tell you about the fact that openvpn is single threaded and you were going to change that with a & in the config ;]
11:24 < hackeron> well, sure, that uses a unix fork - creates a new process
11:24 < hackeron> nothing to do with threads
11:24 < krzee> talk to the devs as far as that goes
11:24 < krzee> then plugins get forked, im sure theres a good reason the scripts dont
11:25 < krzee> its not as if they are unaware of the fact that they could / the fact that they dont
11:25 < krzee> openvpn 3 will be multi-threaded
11:25 < hyper_ch> there will be an openvpn 3?
11:25 < hackeron> my problem is there are many reasons why an openvpn server may decide to tell the client it can't connection - and I don't want any of them to make the client stop trying :P
11:25 < hackeron> guess while true; do openvpn; done :P
11:26 < krzee> hyper_ch, https://community.openvpn.net/openvpn/wiki/RoadMap
11:26 <@vpnHelper> Title: RoadMap – OpenVPN Community (at community.openvpn.net)
11:26 < krzee> hyper_ch, its nothing more than a roadmap currently
11:27 < hackeron> krzee: looks great, how many years before it's here? :)
11:27 < krzee> no time too soon
11:27 < hackeron> heh, roadmap made almost a year ago, fingers crossed it will be here before jesus' second coming :P
11:28 < hackeron> for now, how to fork scripts, hmmmm
11:28 < krzee> you dont
11:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
11:28 < krzee> period
11:28 < krzee> if that is needed, you code a plugin
11:28 < hackeron> nahhh, I guess I'll use a unix double fork as a workaround
11:29 < krzee> whatev, i tried
11:29  * krzee goes back to his vacation
11:29 < hackeron> and modify the client init scripts to keep trying :)
11:29 < hackeron> I don't want to spend a week writing a plugin when what I want can easily be achieved with a double fork
11:30 < hackeron> I don't use those scripts for permission contro
11:30 < hackeron> control*
11:30 < hackeron> I use them for logging and proxying
11:30 < hackeron> so there's no reason why openvpn should quit on error in my case - so I'll double fork and get the initial process to return 0 as the exit code - then it doesn't block either
11:31 < hackeron> I don't see a single disadvantage to this approach
11:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:37 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
11:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:55 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
12:12 < hackeron> question, if I set up a bridged ethernet vpn, the server can see all clients and clients can see server and eachother - the server is 3000 miles away. When I ping between clients, is openvpn clever enough to establish a p2p connection, or does everything have to go through the central server?
12:24 < belZe> hackeron: maybe "client-to-client" parameter is what youre looking for
12:24 < belZe> Because the OpenVPN server mode handles multiple clients through a single tun or tap interface, it is effectively a router. The --client-to-client flag tells OpenVPN to internally route client-to-client traffic rather than pushing all client-originating traffic to the TUN/TAP interface.
12:29 < krzee> hackeron, everything goes through central server
12:29 < krzee> i have an idea for p2p connections in the wishlist
12:29 < krzee> but it wont be considered until ovpn3
12:31 < hackeron> thanks
12:36 < krzee> as far as client-to-client goes...
12:36 < krzee> !c2c
12:36 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
12:36 <@vpnHelper> clients
12:37 < hackeron> heh, well, it's not really client to client :) -- it's client to server to client
12:38 < krzee> right
12:39 < krzee> that config option is only about how they are treated in the server
12:42 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
12:51 < alhadi> does openvpn have some tweaks for voip?
12:54 < morbidwar> hello, i have a little problem, the server isn't starting, the log says "cannot load the CA cert. file path null..." i have the ca.crt with 644 rights
12:54 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Quit: Quitte]
12:54 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
12:54 < dvl> morbidwar: "file path null" <== that might be the problem to fix.
12:56 < morbidwar> dvl: i understand that, but i copied the file from /etc/openvpn/keys/ca.crt to /etc/openvpn/ca.crt edited the server config file, but no change
12:56 < dvl> morbidwar: *shurg*
12:57 < morbidwar> dvl: what's that
12:57 < morbidwar> ?
12:57 < dvl> morbidwar: It is a typo.  I meant shrug.
12:57 < dvl> I have no idea what the problem is.
12:58 < morbidwar> i rebooted the machine but no success
12:58 < morbidwar> damn
12:58 < dvl> Rebooting rarely solves a problem.
12:58 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 272 seconds]
12:59 < krzee> dvl, you must not be a windows user ;)
13:00 < morbidwar> i know :(
13:00 < krzee> alhadi, any specific problem you need to solve?
13:00 < dvl> What's that?
13:00 < alhadi> well i am a majic jack user, everytime i put openvpn one , call drops.
13:00 < hyper_ch> but rebooting helps usually on windows
13:00 < alhadi> i checked with majic jack they said check your openvpn configuration
13:01 < krzee> alhadi, your ovpn config redirects gateway...?
13:01 < alhadi> yes
13:01 < alhadi> redirect-gateway def1
13:01 < alhadi> shall i pastebin ovpn file ?
13:01 < krzee> try commenting that out then starting it
13:01 < alhadi> ok
13:01 < alhadi> one moment
13:01 < krzee> or try connecting to magic jack after connecting
13:05 < alhadi> hmm
13:05 < alhadi> did not worked
13:05 < alhadi> i could not access website
13:06 < alhadi> krzee pastebin openvpn.conf?
13:06 < krzee> you could access the website, just didnt go over openvpn
13:06 < krzee> i dont think i need to see your config
13:07 < krzee> makes sense to me that your call would drop when you change gateways
13:07 < alhadi> ya
13:07 < alhadi> it has some firewall
13:07 < alhadi> in my vps
13:08 < krzee> what if you leave redirect-gateway there and connect before connecting to magic jack
13:08 < alhadi> i dont know what tweaks majic jack support told me for openvpn
13:08 < krzee> they had you tweak openvpn?
13:08 < alhadi> they said me to look or fine tune your openvpn conf
13:08 < alhadi> they tell me it seems an MTU problem
13:08 < alhadi> so suggested me to look for openvpn support
13:08 < krzee> and did you check that...?
13:09 < alhadi> no since my level of experience is limited to try newer stuff
13:09 < alhadi> i came here to ask if possible to fine tune it
13:09 < krzee> ok go ahead and pastebin both configs
13:09 < krzee> !configs
13:09 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
13:09 < alhadi> one moment
13:10 < alhadi> !pb
13:10 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
13:11 < alhadi> this pastebin does not work here
13:11 < alhadi> .ca one
13:11 < krzee> seems to be down
13:13 < alhadi> http://www.pastie.org/private/nrjgllhrm6hwrod3wl7fg   [client.ovpn]
13:14 < alhadi> http://www.pastie.org/private/qevdhmlv5olpdmwzsqi2aw   [openvpn.conf]
13:14 < krzee> ahh your provider made the server config right?
13:14 -!- EugenMayer [~eugen@frbg-4d028f01.pool.mediaWays.net] has joined #openvpn
13:15 < alhadi> ya
13:15 < alhadi> if
13:15 < alhadi> i turn off that ipconfig-noexec
13:15 < krzee> i find it interesting that you use a static device in windows like that
13:15 < alhadi> then openvpn will never start
13:15 < krzee> and it works
13:15 < EugenMayer> hello. Is it possible to define in the server config, which tun interface to use ( 0,1,2 )
13:15 < alhadi> ya it works
13:15 < alhadi> they set me different VPN interface
13:15 < krzee> EugenMayer, yep, by using static tun devices
13:15 < alhadi> eth0 dedicated for VPN
13:15 < krzee> EugenMayer, if they are already made, use dev tun0 dev tun1 etc
13:15 < EugenMayer> krzee: how would that actaully look like?
13:15 < EugenMayer> ah
13:16 < krzee> instead of dev tun (which is for dynamic devices)
13:16 < EugenMayer> do they need to be created on bootime then krzee?
13:16 < krzee> i dont think they go away
13:16 < krzee> --mkdev or something for the creation
13:17 < alhadi> i dont know how to fine tune as the this configuration works for others..
13:17 < EugenMayer> krzee: well i just created a 3rd vpn but it seems like it cant create tun2
13:17 < krzee> you just have dev tun?
13:17 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
13:17 < krzee> or you have dev tun2
13:17 < krzee> cause with dev tun2 you must already have tun2 created
13:18 < krzee> dev tun will make the device and use it
13:18 < krzee> dev tunX requires tunX to already exist
13:18 < EugenMayer> hmm
13:18 < EugenMayer> they dont exist yet. tun0 tun1 has been there before because of the dynamic tun
13:18 < krzee> openvpn --mktun --dev tun2
13:18 < krzee> OR
13:18 < krzee> just use dynamic devices
13:19 < EugenMayer> well no, because of m yFW
13:19 < EugenMayer> *my FW
13:19 < krzee> ok
13:19 < krzee> then ya
13:19 < krzee> openvpn --mktun --dev tun2
13:19 < krzee> kill the other servers, rinse, repeat
13:19 < EugenMayer> Sun Jan 23 20:19:27 2011 TCP/UDP: Socket bind failed on local address [undef]:10001: Address already in use
13:19 < EugenMayer> hmm
13:20 < krzee> obvious error is obvious
13:20 < EugenMayer> i killed the server and created tun0 -tun2 as persistent devices
13:21  * EugenMayer sighs
13:21 < krzee> but the processes are alive
13:21 < EugenMayer> damn the port.. forgot to use the different port :/
13:21 < EugenMayer> sorry.
13:21 < EugenMayer> worked.
13:21 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Changing host]
13:21 -!- rot13 [~var@unaffiliated/rot13] has joined #openvpn
13:21 < EugenMayer> krzee++
13:21 < EugenMayer> Thanks!
13:21 < krzee> np =]
13:24  * alhadi now my turn :)
13:25 < krzee> ok alhadi 
13:25 < alhadi> so
13:25 < krzee> you dont have any mtu options yet
13:25 < krzee> thats good
13:25 < krzee> now go do this:
13:25 < krzee> !mtu
13:25 < alhadi> sure
13:25 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
13:25 < krzee> play with #2 and try #1 too
13:27 <@vpnHelper> RSS Update - forum: Can't ping LAN behind VPN server <http://forums.openvpn.net/topic7547.html#p9352>
13:33 <@vpnHelper> RSS Update - forum: Can't ping LAN behind VPN server <http://forums.openvpn.net/topic7547.html#p9353>
13:40 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
14:20 -!- p3rror [~mezgani@41.140.25.218] has joined #openvpn
14:24 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
14:24 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
14:26 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
14:26 -!- Cain` is now known as Cain
14:28 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
14:38 -!- p3rror [~mezgani@41.140.25.218] has quit [Read error: Connection reset by peer]
14:44 -!- EugenMayer [~eugen@frbg-4d028f01.pool.mediaWays.net] has left #openvpn []
14:53 -!- p3rror [~mezgani@41.248.191.220] has joined #openvpn
15:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:27 -!- p3rror [~mezgani@41.248.191.220] has quit [Ping timeout: 240 seconds]
15:27 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:32 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
15:32 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
15:44 -!- p3rror [~mezgani@41.140.97.246] has joined #openvpn
15:48 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Wibbly Wobbly IRC]
15:54 -!- rawDawg [~rawdawg@cpe-24-166-49-207.neo.res.rr.com] has joined #openvpn
15:59 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Quit: Quitte]
16:00 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
16:05 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
16:12 -!- littlepenguin [~wingrows@ip-62-143-182-156.unitymediagroup.de] has joined #openvpn
16:15 < littlepenguin> hi i have created successfull a connection with openvpn and the interface is created but i cannot access anything.when i stop the connection network works again normal
16:17 -!- morbidwar [~ovidiu@78.96.23.179] has quit [Read error: Connection reset by peer]
16:17 < dvl> littlepenguin: does your setup include setting a gateway?
16:18 < littlepenguin> yes ifconfig shows all neccessary informations
16:18 < dvl> !welcome
16:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:18 < dvl> littlepenguin: start with that
16:20 < littlepenguin> thx
16:32 -!- littlepenguin [~wingrows@ip-62-143-182-156.unitymediagroup.de] has quit [Ping timeout: 276 seconds]
16:33 < dvl> oh....
16:34 -!- littlepenguin [~wingrows@ip-62-143-182-156.unitymediagroup.de] has joined #openvpn
16:34 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
16:35 < littlepenguin> !redirect
16:35 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
16:37 < littlepenguin> !ipforward
16:37 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:38 < littlepenguin> !linipforward
16:38 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:40 -!- littlepenguin [~wingrows@ip-62-143-182-156.unitymediagroup.de] has quit [Remote host closed the connection]
16:46 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
16:52 -!- panfist [~stachursk@c-76-98-78-178.hsd1.nj.comcast.net] has joined #openvpn
16:59 -!- WinstonSmith [~true@g225030018.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
17:07 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:24 -!- WinstonSmith [~true@f052096247.adsl.alicedsl.de] has joined #openvpn
17:31 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
17:35 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
17:38 < derekv> how do you use ssl-admin to make the server certificate?
17:38 < derekv> I see the stuff in openssl-conf for it
17:42 -!- le0 [~fin@82.132.243.43] has joined #openvpn
17:42 -!- le0 [~fin@82.132.243.43] has quit [Changing host]
17:42 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
17:50 < derekv> nevermind (duh)
17:56 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 250 seconds]
17:58 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
18:07 < derekv> huh
18:07 < reiffert> huh!
18:07 < derekv> generating dh params takes a long time
18:07 < reiffert> it's like searching for prime numbers.
18:08 < reiffert> the longer you search, the bigger the numbers that it will find, the more secure the communication.
18:09 < reiffert> basic explanation (note that this is RSA, but it doesnt matter): http://mathcircle.berkeley.edu/BMC3/rsa/node4.html
18:09 <@vpnHelper> Title: RSA Encryption (at mathcircle.berkeley.edu)
18:12 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
18:12 < derekv> nice explination
18:13 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
18:13 < reiffert> take a pencil to fully understand ;)
18:15 -!- p3rror [~mezgani@41.140.97.246] has quit [Ping timeout: 240 seconds]
18:18 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
18:31 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
18:33 -!- p3rror [~mezgani@41.140.153.9] has joined #openvpn
18:35 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
18:38 -!- p3rror [~mezgani@41.140.153.9] has quit [Ping timeout: 240 seconds]
18:42 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
18:43 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
18:49 -!- WinstonSmith [~true@f052096247.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
18:50 -!- WinstonSmith [~true@f052096247.adsl.alicedsl.de] has joined #openvpn
18:50 -!- p3rror [~mezgani@41.140.103.58] has joined #openvpn
19:00 -!- mosno [~mosno@unaffiliated/mosno] has quit [Read error: Connection reset by peer]
19:05 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
19:25 -!- nb [~nb@fedora/nb] has quit [Read error: Connection reset by peer]
19:34 -!- nb [~nb@fedora/nb] has joined #openvpn
19:49 -!- kyrix [~ashley@c-67-160-84-118.hsd1.wa.comcast.net] has joined #openvpn
19:50 < derekv> one thing I mean to understand at some point is the algorithm for picking large primes
19:58 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
20:19 < derekv> does tls-auth mean that there is more cpu load on the server, from having to decrypt and also verify a hash
20:20 < derekv> not that its a concern for me, I just like to understand 
20:46 < derekv> anyone ever set up / seen a system to rotate the ta.key ? 
21:05 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
21:48 -!- WinstonSmith [~true@f052096247.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
22:00 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
22:00 -!- teddz_ [~teddz@dtmd-4d052e37.pool.mediaWays.net] has joined #openvpn
22:03 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
22:04 -!- teddz [~teddz@dtmd-4db23fc3.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:38 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
22:54 -!- kyrix [~ashley@c-67-160-84-118.hsd1.wa.comcast.net] has quit [Ping timeout: 272 seconds]
23:14 -!- teddz_ [~teddz@dtmd-4d052e37.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
23:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
23:32 -!- xk [foobar@124-168-244-97.dyn.iinet.net.au] has joined #openvpn
23:42 -!- rawDawg [~rawdawg@cpe-24-166-49-207.neo.res.rr.com] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
--- Day changed Mon Jan 24 2011
00:03 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
00:13 <@vpnHelper> RSS Update - forum: VM Lab using OpenVPN <http://forums.openvpn.net/topic7545.html#p9354>
00:58 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
01:00 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 255 seconds]
01:01 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
01:01 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:13 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has left #openvpn []
01:24 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
01:30 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Remote host closed the connection]
01:38 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:38 -!- mode/#openvpn [+o mattock] by ChanServ
01:50 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving.]
02:13 <@vpnHelper> RSS Update - forum: VM Lab using OpenVPN <http://forums.openvpn.net/topic7545.html#p9355>
02:17 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
02:19 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9356>
02:19 -!- sia^pwnnt is now known as sia
02:19 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
02:31 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9357>
02:37 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Quit: nijotz]
02:37 <@vpnHelper> RSS Update - forum: OpenVPN GUI and the management port <http://forums.openvpn.net/topic7539.html#p9358>
02:37 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
02:38 < reiffert> derekv: picking large primes: e.g. lucas lehmer test is a fast algorithm for testing a number to be prime
02:38 < reiffert> (lucas lehmer test was made for special prime numbers)
02:51 < reiffert> derekv: in general (2^x)-1 are intresting numbers to be prima.
02:51 -!- lau [~lau@unaffiliated/lau] has joined #openvpn
02:51 < reiffert> (or was it (2^x)+1 ?)
02:51 < lau> !welcome
02:51 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:52 < lau> !goal
02:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:53 < lau> hi, I am running openvpn v2.1.0 , I set keys via easy_rsa 2.0 tools http://openvpn.net/easyrsa.html
02:55 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9360>
02:55 < reiffert> I cant see any question or goal.
02:56 < reiffert> Maybe I should gt myself into the bath.
02:56 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
02:56 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
02:56 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
02:57 -!- acecile [~gandalf@adsl02.metz.linbox.com] has joined #openvpn
02:57 < acecile> hi
02:57 < acecile> could someone help me to figure out how to list all certs ? I mean the active one and the revoked ones
02:58 < reiffert> moin krzee 
02:58 < krzee> moin
02:58 < reiffert> heard anything about your estonian contact?
03:00 < krzee> are we waiting on him to sign papers?
03:00 < lau> I lost the 2.0 folder with all the files generated with http://openvpn.net/easyrsa.html for the time being I only get the files in the /etc/openvpn
03:01 < lau> ca.crt ca.key crl.pem  dh1024.pem server.key  server.pem ta.key
03:01 < krzee> i havnt heard anything from him
03:01 < lau> my goal is to build a consistent easy_rsa key environment with this file 
03:01 < lau> how can I do this ?
03:02 < krzee> lau, start over, you wont be able to make a CRL for already existing certs
03:02 < krzee> so just start over
03:03 < reiffert> krzee: I think we are waiting for him. Please ask him if he has heart anything from the officials
03:04 < reiffert> lau: build consistent = impossible. restore your backup = hell that was easy.
03:05 < lau> ok thx
03:07 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9361>
03:22 -!- dazo_afk is now known as dazo
03:28 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:33 -!- xk [foobar@124-168-244-97.dyn.iinet.net.au] has left #openvpn []
03:35 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
03:37 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9362>
03:51 -!- master_of_master [~master_of@p57B52FB0.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
03:53 -!- master_of_master [~master_of@p57B5530B.dip.t-dialin.net] has joined #openvpn
03:55 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9363>
03:56 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
03:56 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
03:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:06 < macsppadic> morning all 
04:13 <@vpnHelper> RSS Update - forum: NOTE: could not get adapter index for ... <http://forums.openvpn.net/topic7537.html#p9364>
04:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:40 -!- dazo is now known as dazo_afk
04:41 -!- dazo_afk is now known as dazo
04:42 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:43 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:43 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:43 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:50 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has quit [Read error: No route to host]
04:51 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
04:52 -!- common [~common@p5DDA444E.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
04:54 -!- common [~common@p5DDA481A.dip0.t-ipconnect.de] has joined #openvpn
05:20 -!- takamichi [~pri@85.232.213.54] has quit [Read error: Connection reset by peer]
--- Log closed Mon Jan 24 05:21:53 2011
--- Log opened Mon Jan 24 05:21:59 2011
05:21 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
05:21 -!- Irssi: #openvpn: Total of 123 nicks [3 ops, 0 halfops, 0 voices, 120 normal]
05:22 -!- Dougy [me@tech.qsi.net] has joined #openvpn
05:22 -!- Irssi: Join to #openvpn was synced in 47 secs
05:27 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
05:57 -!- ksk [ksk@im.knubz.de] has joined #openvpn
05:58 -!- ksk [ksk@im.knubz.de] has quit [Remote host closed the connection]
06:05 -!- ksk [ksk@im.knubz.de] has joined #openvpn
06:15 -!- hid3 [~tst@lan-78-157-71-116.vln.skynet.lt] has joined #openvpn
06:16 < hid3> Hello everyone. I use Lenovo tools to manage wireless and wired connections on my laptop. I have a few profiles, and depending on profile, I have OpenVPN configured to be started after a successful connection is being established. 
06:16 < hid3> However, there's a problem:
06:16 < hid3> When OpenVPN tries to connect, it can't. If I wait a few moments and lauch it manually, everytthing works nice
06:16 < hid3> I suspect that the network conenction is not fully established at the moment when OpenVPN tries to connect.
06:17 < hid3> Is rthere any way to force a delay/pause for OpenVPN before trying to connect to a remote server?
06:17 < hid3> BTW, I'm using Windows 7 (32 bit)
06:28 < krzee> route-delay
06:28 < krzee> in the config
06:29 < hid3> Actually looks like up-delay did the trick, although I'm not 100% sure since it happened randomly
06:29 -!- anonymus [~yaa@178.176.95.62] has joined #openvpn
06:29 < anonymus> hi
06:30 < anonymus> http://pastebin.com/227xrE51
06:30 < anonymus> would anybody explain?
06:31 < anonymus> why it shows 10.10.10.2 peer
06:31 < anonymus> and \32 prefix
06:31 < anonymus> ??
06:31 < hid3> Pecause it is PtP interface?
06:31 <@vpnHelper> RSS Update - forum: Linux Tap device 10Mbit <http://forums.openvpn.net/topic7535.html#p9365>
06:31 < anonymus> but real ip of the peer is 10.10.10.5
06:32 < anonymus> and prefix 24
06:32 < hid3> Oh, tap device is 10 mbps. That's what I wondered for lots of time!
06:32 < anonymus> ?
06:33 < anonymus> tun
06:33 < anonymus> device
06:33 < hid3> yeah, tun
06:33 < hid3> in the forums the guy is using tap
06:33 < anonymus> aha
06:34 < hid3> Although both of them are 10 mbps, making them low priority for some connection managers
06:34 < hid3> anonymus, your issue is trivial. Live it it
06:34 < hid3> *with it
06:35 < anonymus> i just want to understand
06:35 < anonymus> i does work ok
06:35 < anonymus> does it use 2 connections or what
06:35 < hid3> Not sure about that but this might do something with a setting (don't remember which) which allows/disallows communication between openvpn clients
06:36 < anonymus> hmm
06:36 < anonymus> do you know where exactly to read about it?
06:36 < krzee> people get xfers over 10mbit
06:36 < krzee> it just displays as 10mbit
06:39 < krzee> anonymus, 
06:39 < krzee> !/30
06:39 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
06:39 < anonymus> route :         10.10.10.0/24 via 10.10.10.2 dev tun0
06:40 < anonymus> krzee, danke!
06:40 < krzee> np
06:42 < bragon> Hey
06:42 < hid3> krzee: will clients in "/30" mode will be able to see each other?
06:42 < hid3> !topology
06:42 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
06:42 < bragon> i'm using openvpn  2.1.3 on a Debian 5.0 box (AMD Geode by NSC 266.655 MHz) on a WRAP board
06:43 < bragon> i have a issue
06:43 < bragon> when i'm wgeting a big files, openvpn client stalled
06:43 < bragon> and never wake up again
06:43 < bragon> i suspect to have a low CPU to do that
06:44 < hid3> I think low cpu just limits your transfer speed
06:44 < bragon> can i make some tunning to workaround this issue ?
06:44 < bragon> hid3: i can't limit all my client.
06:44 < bragon> this box is a gateway
06:45 < bragon> i'm using tap / tcp-client / AES-256-CBC
06:46 < bragon> my conf : http://paste.geeknode.org/2d0a73db
06:48 < hid3> Why AES-256?
06:48 <@vpnHelper> RSS Update - forum: SOLVED: NOTE: could not get adapter index for ... <http://forums.openvpn.net/topic7537.html#p9364>
06:48 < bragon> hid3: because all my networks using this algo.
06:49 < bragon> it is better to use a nicer algo for the CPU ?
06:49 < bragon>  route -n | wc -l
06:49 < bragon> 73
06:49 < bragon> i have a huge openvpn network you'll see
06:49 < hid3> Blowfish I guess would be better/faster
06:50 < bragon> hum
06:50 < hid3> Or are you concerned about the cnahhel encryption very much?
06:50 < bragon> it's not very cool to have just on branch of the tree with a différent encrypt method
06:51 < bragon> i need to make a cohalition hub server who accept AES-256-CBC and blowfish on different port
06:53 < bragon> i don't have this issue on a : CPU: Geode(TM) Integrated Processor by AMD PCS (498.05-MHz 586-class CPU) with FreeBSD
06:54 < bragon> but i need to use this wrap board ...
06:54 < bragon> (borring to stop using this wonderfull device)
06:57 < bragon> i guess that i haven't the issue before, (because i ever (2 or 3 years ago) using this wrap in this openvpn network) without stalled issue.
06:58 < bragon> (on debian 4.0)
06:58 < bragon> hid3: any idea to limit the CPU consomation off the channel encryption ?
07:10 -!- anonymus [~yaa@178.176.95.62] has quit [Remote host closed the connection]
07:11 -!- acecile [~gandalf@adsl02.metz.linbox.com] has quit [Ping timeout: 240 seconds]
07:11 -!- acecile [~gandalf@adsl02.metz.linbox.com] has joined #openvpn
07:17 < kisom> bragon: your openvpn session should not stall regardless of what cipher you're using
07:17 < bauruine> hid3, did anyone ever tried nfs over openvpn? how is the performance? better than nfs over ssh? 
07:18 < kisom> bragon: try turning on verb 7 and check the logs for anything, see where it stalls
07:18 < kisom> also, have you checked for fault RAM?
07:18 < kisom> faulty*
07:20 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
07:24 < bragon> kisom: i don't suspect ram because i can (for exemple) make openvpn 2.1.3 directly on this poor hardware.
07:24 < bragon> if my ram failed, i'll see it with compilation i guess
07:25  * bragon trying verb 7
07:27 < bragon> http://paste.geeknode.org/77e30c4d
07:27 < bragon> my vpn client stalled in TUN READ
07:28 < bragon> kisom: good test :)
07:32 < bragon> trying to make a kernel with tun/tap inside instead of in module
07:36 <@vpnHelper> RSS Update - forum: Can't ping LAN behind VPN server <http://forums.openvpn.net/topic7547.html#p9366>
07:37 < bragon> Ok
07:38 < bragon> During the wget my openvpn client don't send ping to the serveur
07:38 < bragon> so the server stalled the connexion
07:38 < bragon> i guess
07:38 < bragon> when the wget stalled
07:38 < bragon> my client are new able to sent ping
07:38 < bragon> so all will be ok after the connexion stalled
07:42 < bragon> the TUN buffer write and write and write and write ... and was not able to pong to the server.
07:42 < bragon> i suspect a tun/tap kernel module bug
08:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:07 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 245 seconds]
08:11 -!- xuedi [~xuedi@125.33.9.33] has joined #openvpn
08:12 < xuedi> Hello, is there any way to use openvpn without tun/tap? Happy chinese new year, xuedi 
08:13 < juhovh> hehe, xuedi :P
08:17 < xuedi> yeah, guess i stuck with ssh portbinding :-( i miss openvpn, so fast and lightweight ...
08:18 < juhovh> no root access?
08:20 < xuedi> i have root access, but all those virtual cloud hosting these days have no tun/tap modules ...
08:21 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
08:22 -!- p3rror [~mezgani@41.140.103.58] has quit [Ping timeout: 240 seconds]
08:37 -!- kisom [~kisom@c-d0dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
08:39 -!- p3rror [~mezgani@41.140.153.201] has joined #openvpn
08:40 -!- albech [~thomas@119.42.78.108] has joined #openvpn
08:43 -!- kisom [~x@c-d0dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
08:54 < ljvb> xuedi do what I do.. use a vps service, slightly more expensive then cloud based, but so much more useful
08:55  * ljvb uses a freebsd based vps, full control over kernel and userland
08:56 < juhovh> xuedi: no module loading support either?
08:56 < juhovh> guess it's to prevent abuse then
08:57 < xuedi> i don't plan to use it as a proxy, i need to combine our company network to some online servers, where where running openvpn for many years now, always stable and fast, now the company is moring into 'the cloud' :-(
08:57 < xuedi> the VPS do not suport tun/tap ...
09:08 < rjd_> it's because openvz and linux vserver are userland virtualization, so called containers, so they require the hoster to insmod the tuntap on the HN
09:09 < rjd_> and to not have to fulfill every customer request, they simply dont
09:13 < bragon> just finish to cross compile a kernel to add tun/tap inside and not in module
09:13 < bragon> dans same issue
09:13 < bragon> openvpn client stall   --.-K/s
09:14 < bragon> -_-"
09:14 < cron2> vserver is not really a "virtual machine" - it's more an isolation environment, but still has only "global" hardware components, no own kernel
09:14  * bragon not able to touch my is finger the issue
09:14 < cron2> so even if the host machine had a tun driver, effects in a vserver environment would be weird
09:14 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:15 < xuedi> yeah i miss the good old root servers, was so much more easy ...
09:15 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:15 < ecrist> sounds a lot like freebsd jails
09:15 < ljvb> vserver == jail
09:15 -!- Cain` is now known as Cain
09:15 < cron2> ecrist: yes, vserver is very similar to jail
09:16 < bragon> it is possible to hack vserver to use openvpn Inside
09:16 < bragon> but if your vserver can create virtual interface it's a shame ...
09:16 < bragon> :)
09:16 < cron2> ecrist: some difference in the details (who can see what processes and such), but the overall concept is the same - "here's a directory + IP address assignment, $this group of processes is constrained to it"
09:16 < ljvb> its why I decided to pay for the vps over the standard cloud/jail crap
09:17 < bragon> if you realy want to use openvpn inside a VM you need to use a KVM or XEN VM.
09:17 < cron2> KVM, XEN, vmware, ...
09:17 < ecrist> cron2: nice. 
09:17 < ljvb> I have never had much luck with xen
09:17 < bragon> i don't know vmware is.
09:17 < cron2> (but I'M not sure if I would want to trust a VM hoster with my VPN secrets)
09:17 < bragon> it's GPL ?
09:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
09:17 < ljvb> from an admin side or things, I knowvmware esxi works for me
09:17 < cron2> bragon: commercial software, similar to "XEN commercial"
09:18 < ljvb> although my freebsd vps is hosted on a XEN services
09:18 < bragon> cron2: it was a joke :)
09:18 < xuedi> i thought there might be a way to have a software emulation for a bridged network that allowed openvpn to run, but google says nothing :-(
09:18 < cron2> xuedi: you need your own kernel and your own local routing table - and vserver doesn't give you that
09:18 < ljvb> interfaces, require kernel access
09:18 < bragon> anyone for my previous issue on an embeded device ?
09:19 < bragon> interfaces require SYS_NET capability of root access :)
09:20 < bragon> http://linux-vserver.org/Capabilities_and_Flags
09:20 <@vpnHelper> Title: Capabilities and Flags - Linux-VServer (at linux-vserver.org)
09:20 < ljvb> I mean creating interfaces, unless you compile the drivers into the kernel, you will need to load the driver as a module
09:20 < xuedi> to bad ... this will mean 20 permanent ssh portbinging sessions open all the time, real dirty design ...
09:20 < ljvb> who compiles a massive kernel with all the drivers built in anymore?
09:20 < bragon> Network capabilities (ncaps) 
09:21 < ljvb> then again.. I have not really futzed with linux since slackware 2 :P
09:21 < bragon> ljvb: me
09:21 < ljvb> my only linux box is a print server, and its a basic stock install, nothing custom
09:21 < bragon> all the drivers i need.
09:22 < bragon> i don't make module support
09:22 < bragon> it's generaly useless
09:22 < xuedi> @bragon: i agree, a all in kernel is still quite small and more easy to handle ...
09:22 < bragon> (for a server)
09:22  * cron2 likes being able to add USB devices upon necessity without having to recompile+reboot
09:22 < ljvb> why...
09:22 < bragon> my workstation have module support ... but less module i have, more happy i'm
09:23 < bragon> cron2: on a server you generaly don't need to have module.
09:23 < bragon> on a workstation or a laptop it's différent.
09:24 < ljvb> bah.. tmux blew up on me
09:24 -!- ljvb [~jason@vps.vanbrecht.com] has quit [Quit: fixing tmux]
09:26 < bragon> tmux <3
09:26 -!- ljvb [~jason@vps.vanbrecht.com] has joined #openvpn
09:28 -!- p3rror [~mezgani@41.140.153.201] has quit [Ping timeout: 240 seconds]
09:29 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:35 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
09:36 < ScriptFanix> bragon: but then you'll have to keep your kernel up to date manually.. which is why i stick to debian's module-rigged kernel
09:36 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
09:39 < bragon> ScriptFanix: when you have a park of server, it's not really time-eat to keep your kernel up to date manually.
09:39 < bragon> you build a generique kernel for all, your need and maintain it.
09:40 < bragon> ScriptFanix: any idea for my WRAP openvpn ISSUE ?
09:40 < bragon> :)
09:45 < ScriptFanix> no idea
09:51 <@vpnHelper> RSS Update - forum: OpenVPN GUI and the management port <http://forums.openvpn.net/topic7539.html#p9367>
09:58 -!- rawDawg [~rawdawg@adsl-99-57-58-238.dsl.bcvloh.sbcglobal.net] has joined #openvpn
10:01 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:16 -!- maxJadi [~maxJadi@dhcp-166-99.nomad.chalmers.se] has joined #openvpn
10:16 -!- maxJadi [~maxJadi@dhcp-166-99.nomad.chalmers.se] has quit [Changing host]
10:16 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
10:32 -!- WinstonSmith [~true@g231217139.adsl.alicedsl.de] has joined #openvpn
10:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:33 -!- albech [~thomas@119.42.78.108] has quit [Quit: Ex-Chat]
10:39 -!- WinstonSmith [~true@g231217139.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:04 < bragon> ok i found my issue :)
11:06 < bragon> Lan Client ---> gw1 ---> GWvpn --> gw1 ----> ppp -----> HUBvpn ---> GWvpn/gw1 -> Lan Client
11:06 < bragon> it's not very cool for the mss and pmtu
11:08 < ljvb> stupid internets from phone... grrr
11:13 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
11:13 -!- WinstonSmith [~true@e179013031.adsl.alicedsl.de] has joined #openvpn
11:18 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
11:20 -!- xuedi [~xuedi@125.33.9.33] has left #openvpn []
11:25 -!- linze [~linze@190.178.18.46] has joined #openvpn
11:29 -!- WinstonSmith [~true@e179013031.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:34 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:34 < ScriptFanix> bauruine: I use NFS/tcp over OpenVPN/udp, works like a charm. Never tried NFS over ssh though (This message has been postponed.)
11:43 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:53 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
11:53 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:17 -!- akam [~akam@95.78.90.245] has joined #openvpn
12:17 < akam> !welcome
12:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:18 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
12:19 < akam> !howto
12:19 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
12:28 -!- openvpn2009 [~patel@openvpn/corp/admin/patel] has left #openvpn []
12:28 -!- openvpn2009 [~patel@openvpn/corp/admin/patel] has joined #openvpn
12:28 -!- mode/#openvpn [+o openvpn2009] by ChanServ
12:28 -!- openvpn2009 is now known as patelx
12:31 < akam> i'm sorry for disturb your silent, but may i ask a question?
12:31 < akam> how can i use client specific options to run 'route add -net ...' script on openvpn server, when a remote client connected?
12:33 -!- linze [~linze@190.178.18.46] has quit [Quit: tot kijk]
12:38 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
12:43 < ecrist> see client-connect and client-disconnect in the man page.
12:43 < ecrist> !man
12:43 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
12:47 < akam> thank you for answer
12:48 < akam> but i do that
12:48 < akam> Options error: option 'client-connect' cannot be used in this context
13:01 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
13:02 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:02 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
13:15 -!- dazo is now known as dazo_afk
13:19 <@vpnHelper> RSS Update - forum: Routing to LAN's behind server <http://forums.openvpn.net/topic7555.html>
13:19 -!- WinP000 [~WinP000@ool-18b991b0.dyn.optonline.net] has joined #openvpn
13:20 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
13:21 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
13:25 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html>
13:47 -!- Darkclaw66 [~Darkclaw@unaffiliated/darkclaw66] has joined #openvpn
13:47 < Darkclaw66> I am trying to revoke a certificate but it's not letting me
13:48 < Essobi> I managed to get easyrsa all scripted up with our keys. :)
13:49 < ecrist> I am so sorry, Essobi 
13:49 < Darkclaw66> anyone help me
13:49 < Essobi> ecrist: ;)
13:49 < Essobi> ecrist: munge as it is, it's working.
13:50 < Darkclaw66> i didnt keep the .crt file but I have the .pem 
13:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 250 seconds]
13:52 < Essobi> Darkclaw66: using the --crl-verify option?
13:56 < Darkclaw66> hmm 
13:56 < Darkclaw66> ./revoke-full 04 --crl-verify?
14:00 < Darkclaw66> that didnt work
14:01 < Darkclaw66> Error opening 04.crt 04.crt
14:24 -!- CharlieSu [~CharlieSu@ec2-174-129-218-86.compute-1.amazonaws.com] has left #openvpn []
14:26 < Darkclaw66> which file that is generated I shouldn't give to the client?
14:27 < Darkclaw66> theres .crt, .csr, and .key
14:29 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 250 seconds]
14:34 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
14:43 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9369>
14:47 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
14:48 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
14:48 < Darkclaw66> fail channel
14:48 -!- Darkclaw66 [~Darkclaw@unaffiliated/darkclaw66] has quit []
14:50 -!- admiral0 [~admiral0@151.61.35.233] has joined #openvpn
14:50 < admiral0> hi
14:51 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
14:51 < admiral0> how does openvpn handle multiple clients with same ip on tap?
14:51 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
14:53 < admiral0> !goal
14:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:54 < hyper_ch> someone who reads the channel topic? what happened?
14:54 < admiral0> :D
14:55 < hyper_ch> what do you mean with same ip on tap?
14:55 < admiral0> well, if you're interested, i'm trying to do bonding over vpn
14:56 < hyper_ch> I don't like bondage :)
14:56 < hyper_ch> !tunortap
14:56 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:56 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
14:56 < admiral0> over vifs of the wlan
14:56 < admiral0> i connect several times with vifs
14:56 < hyper_ch> I have no idea what that is
14:57 < admiral0> then successfully open n openvpn connections
14:57 < admiral0> vif=virtual interface
14:57 < admiral0> the problem is when i do ifenslave
14:57 < admiral0> ifenslave bond0 tap0 tap1 ... tapn
14:57 < admiral0> all goes BOOM
14:57 < hyper_ch> why do you connect server times?
14:58 < admiral0> bandwidth restrictions, i hate them
14:58 < hyper_ch> aren't there other ways to restrict bandwidth?
14:58 < admiral0> no, i am escaping restriction
14:58 < admiral0> i use bonding on several connections
14:59 < admiral0> restrictionis ip-based
14:59 < hyper_ch> oh
14:59 < hyper_ch> I have no clue about that
15:00 < admiral0> the problem is that openvpn doesn't like when i ifconfig tapn down;
15:00 < admiral0> and when i set an ip
15:00 < admiral0> it tries to reconnect
15:01 < hyper_ch> simple solution would be not to tap down
15:02 < admiral0> harder one?
15:02 < admiral0> :D
15:02 < admiral0> persist-what?
15:03 < hyper_ch> I like simple solutions
15:04 < admiral0> i don't. i have made a 83 lines perl connection script :D
15:04 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
15:05 < admiral0> the unpleasant complication with this network was that it blocks all udp and has a proxy :\
15:06 < hyper_ch> perl is evil
15:06 < admiral0> perl=voodoo
15:13 -!- p3rror [~mezgani@41.140.169.162] has joined #openvpn
15:14  * hyper_ch strokes his beloved php
15:14 < hyper_ch> and bash
15:21 < venom00ut> why do you disable the feature allowing to save credential to file?
15:21 < venom00ut> I know I can recompile it with that feature enabled, but I've to recompile it at each new version
15:25 < venom00ut> ehi, hello admiral0! :D
15:25 < admiral0> :D hi buddy
15:39 -!- p3rror [~mezgani@41.140.169.162] has quit [Ping timeout: 240 seconds]
15:39 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:43 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
15:52 -!- p3rror [~mezgani@41.140.29.28] has joined #openvpn
15:58 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 272 seconds]
15:58 -!- p3rror [~mezgani@41.140.29.28] has quit [Read error: Operation timed out]
16:13 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
16:13 -!- p3rror [~mezgani@41.140.103.172] has joined #openvpn
16:17 -!- rawDawg [~rawdawg@adsl-99-57-58-238.dsl.bcvloh.sbcglobal.net] has quit [Ping timeout: 276 seconds]
16:40 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:42 < WinP000> would anyone be able tell me if its possible to chain two to different openVPN connections together ?
16:44 -!- master_of_master [~master_of@p57B5530B.dip.t-dialin.net] has quit [Quit: leaving]
16:46 -!- admiral0_ [~admiral0@151.61.35.233] has joined #openvpn
16:46 -!- admiral0 [~admiral0@151.61.35.233] has quit [Quit: Konversation terminated!]
16:47 -!- master_of_master [~master_of@p57B5530B.dip.t-dialin.net] has joined #openvpn
16:49 -!- p3rror [~mezgani@41.140.103.172] has quit [Read error: Connection reset by peer]
16:59 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 240 seconds]
17:01 -!- grapsus [~grapsus@acces1031.res.insa-lyon.fr] has joined #openvpn
17:15 < Essobi> WinP000: 'chain'?
17:17 < WinP000> yes as in say i connect to my openVPN provider to conceal my ip, and then want to connect to a  remote share that only works with openVPN
17:19 < WinP000> Essobi, ^^
17:21 < Essobi> ... so an openvpn tunneled over another openvpn?
17:21 < WinP000> correct
17:21  * Essobi has nightmares about EoIP..
17:22 < Essobi> You could, but it'd be a mess of hackery.
17:22 < WinP000> Essobi has nightmares about EoIP.. <- how come ?
17:22 < Essobi> Ethernet over IP?  It's skerreh. Heh.
17:24 < WinP000> would it be possible to do it through a VM ?
17:25 -!- jambooda1 [~cog@75.99.192.166] has joined #openvpn
17:25 < Essobi> IDK.. they way I see it working..
17:25 < Essobi> setup your router to connect to the first VPN..
17:25 < Essobi> then create a DMZ off of it, that will only route to the VPN's GW..
17:25 < Essobi> then run another vpn client off that to tunnel through the first.
17:26 < WinP000> sadly i don't have a router that supports openVPN,  so say I setup openVPN to the my vpn provider on the host, then nat the guest machine and run another vpn client ?
17:27 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 272 seconds]
17:27 < Essobi> perhaps so long as the route to the gw that the 2nd openvpn is preferred over the default route
17:29 -!- jambooda1 [~cog@75.99.192.166] has quit [Ping timeout: 240 seconds]
17:34  * WinP000 prepares to epicly fail
17:34 -!- WinP000 [~WinP000@ool-18b991b0.dyn.optonline.net] has quit [Quit: WinP000]
17:52 <@vpnHelper> RSS Update - forum: Internet Connection Sharing with openvpn <http://forums.openvpn.net/topic7392-15.html#p9370>
17:53 -!- Zipper_32 [~Zipper_32@72.53.35.91] has quit [Ping timeout: 255 seconds]
17:56 -!- teddz_ [~teddz@dtmd-4d052e37.pool.mediaWays.net] has joined #openvpn
17:58 -!- cj [~cjac@adsl-207-32-175-232.rockisland.net] has joined #openvpn
17:58 < cj> moo
18:02 < cj> is there a way to create clear tunnels with openvpn?  The udp tunnel I get from openvpn is more stable and reliable than anything I've used in corporate environments.  I'd like to use it on the 44 net, though, and CFR 47.97.113(4) says crypto is right out.
18:02 < cj> http://edocket.access.gpo.gov/cfr_2004/octqtr/47cfr97.113.htm
18:02 <@vpnHelper> Title: Section (at edocket.access.gpo.gov)
18:10 < reiffert> "clear"?
18:13 -!- Zipper_32 [~Zipper_32@72.53.35.91] has joined #openvpn
18:18 < cj> non-encrypted
18:18 < cj> or encrypted with a null cipher
18:18 -!- Zipper_32 [~Zipper_32@72.53.35.91] has quit [Ping timeout: 255 seconds]
18:19 -!- Zipper_32 [~Zipper_32@72.53.35.91] has joined #openvpn
18:19 < reiffert> thats possible, yeah.
18:20 < reiffert> !factoids search encryption
18:20 <@vpnHelper> "encryption" is Why symetric encryption is better: http://www.ketufile.com/Symmetric_vs_Asymmetric_Encryption.pdf
18:20 < reiffert> !factoids search --values encryption
18:20 <@vpnHelper> 'noenc', 'dh', 'encryption', and 'statickey'
18:20 < reiffert> !noenc
18:20 <@vpnHelper> "noenc" is (#1) if you're going to disable encryption, you might as well build a GRE tunnel, or (#2) but you would use cipher none
18:20 < reiffert> !encryption
18:20 <@vpnHelper> "encryption" is Why symetric encryption is better: http://www.ketufile.com/Symmetric_vs_Asymmetric_Encryption.pdf
18:20 < reiffert> I guess it's --cipher none
18:21 < reiffert> quoting the manpage:               Set alg=none to disable encryption.
18:22 -!- p3rror [~mezgani@41.140.98.97] has joined #openvpn
18:23 -!- p3rror [~mezgani@41.140.98.97] has quit [Client Quit]
18:23 -!- admiral0_ [~admiral0@151.61.35.233] has quit [Read error: Connection reset by peer]
18:24 -!- admiral0_ [~admiral0@151.61.35.233] has joined #openvpn
18:24 -!- p3rror [~mezgani@41.140.98.97] has joined #openvpn
18:42 -!- admiral0_ [~admiral0@151.61.35.233] has quit [Remote host closed the connection]
18:45 -!- p3rror [~mezgani@41.140.98.97] has quit [Ping timeout: 240 seconds]
18:45 < cj> thanks, reiffert :)
18:46 -!- ashes [~ashes@modemcable247.172-202-24.mc.videotron.ca] has quit [Read error: Operation timed out]
18:47 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
18:53 -!- prettyrobots [~alan@adsl-76-241-186-132.dsl.sfldmi.sbcglobal.net] has joined #openvpn
18:58 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
19:05 -!- WinstonSmith [~true@e177090133.adsl.alicedsl.de] has joined #openvpn
19:07 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
19:17 -!- takamichi [~pri@85.232.213.54] has quit [Read error: Connection reset by peer]
19:17 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
19:18 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:27 < Dougy> so krzee 
19:27 < Dougy> you heard of awknet>
19:27 < Dougy> ?
19:31 < krzee> sounds familiar
19:32 < krzee> brb
19:32 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
19:34 -!- rawDawg [~rawdawg@cpe-76-188-25-9.neo.res.rr.com] has joined #openvpn
19:38 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
19:38 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
19:38 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
19:38 -!- rawDawg [~rawdawg@cpe-76-188-25-9.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
19:47 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:04 <@vpnHelper> RSS Update - forum: OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html>
20:13 -!- p3rror [~mezgani@41.140.39.60] has joined #openvpn
20:33 -!- Zipper_32 [~Zipper_32@72.53.35.91] has quit [Quit: Leaving]
20:35 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
20:35 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
20:35 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:35 -!- p3rror [~mezgani@41.140.39.60] has quit [Read error: Connection reset by peer]
20:38 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:38 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
21:13 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
21:29 -!- prettyrobots [~alan@adsl-76-241-186-132.dsl.sfldmi.sbcglobal.net] has quit [Quit: prettyrobots]
21:39 -!- teddz_ [~teddz@dtmd-4d052e37.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
21:40 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
21:42 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has joined #openvpn
21:46 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
21:53 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
21:53 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
21:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
22:51 -!- valen [424bc910@gateway/web/freenode/ip.66.75.201.16] has joined #openvpn
22:53 < valen> Anyone able to answer a few questions regarding routing vpn traffic to my vm's?
22:58 < rjd_> valen: shoot, and someone might be able to help
22:59 < valen> alright. well i've got three virtualbox vm's running on the same machine as my vpn server. I want to set those three vm's to host only mode... how can I route my vpn traffic to them?
23:01 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:04 < valen> I'm not sure what to set the routing to on the vm host or guests.
23:05 < valen> I can't just "push route 192.168.56.0" which is the subnet the vm's are on if set to host-only mode
23:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
23:12 -!- p3rror [~mezgani@41.140.101.87] has joined #openvpn
23:25 -!- p3rror [~mezgani@41.140.101.87] has quit [Ping timeout: 240 seconds]
23:26 < rjd_> valen: the host needs to route packets, and if you tunnel all traffic then you wouldnt need specific routes to the internal networks of those guests
23:26 < rjd_> but if you only tunnel some traffic, you would need to push specific routes
23:33 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Read error: Operation timed out]
23:34 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
23:55 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has quit [Quit: prettyrobots]
--- Day changed Tue Jan 25 2011
00:04 -!- grapsus [~grapsus@acces1031.res.insa-lyon.fr] has quit [Ping timeout: 265 seconds]
00:13 -!- alhadi [~thunderst@unaffiliated/alhadi] has quit [Ping timeout: 276 seconds]
00:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:16 -!- grapsus [~grapsus@acces1031.res.insa-lyon.fr] has joined #openvpn
00:18 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:58 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
01:12 -!- WinstonSmith [~true@e177090133.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
01:23 <@vpnHelper> RSS Update - forum: OpenVPN GUI and the management port <http://forums.openvpn.net/topic7539.html#p9372>
01:29 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9373>
01:35 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9374>
01:41 -!- alhadi [~thunderst@188.95.51.233] has joined #openvpn
01:41 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9376> || OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html#p9375>
01:45 -!- alhadi [~thunderst@188.95.51.233] has quit [Ping timeout: 240 seconds]
01:47 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9377>
01:53 <@vpnHelper> RSS Update - forum: Windows client and Tomcat? <http://forums.openvpn.net/topic7552.html#p9378>
02:05 -!- valen [424bc910@gateway/web/freenode/ip.66.75.201.16] has quit [Disconnected by services]
02:07 -!- dazo_afk is now known as dazo
02:15 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:19 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
02:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:47 < lau> in the openvpn.log I can see a line 
02:47 < lau> /sbin/route del -net 172.16.20.0 netmask 255.255.255.0
02:48 < lau> ERROR: Linux route delete command failed: could not execute external program
02:49 < lau> this is the server log. Does this mean that /sbin/route needs to be ran on open vpn server
02:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:50 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
02:52 -!- macsppadic is now known as linodesppadic
03:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:19 < renihs_> no it seems it couldnt execute the route command on client side
03:19 < renihs_> afaik
03:20 < renihs_> usually a route is added though, but without further information i guess this is guessing :p
03:24 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9379>
03:27 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
03:34 -!- mtx_init [~mtx_init@unaffiliated/medex] has joined #openvpn
03:36 < mtx_init> Hello, I am trying to set up openvpn, when I source the vars file it tells me to run ./clean-all, which I do.  But then it tells me to source my vars.  I have edited the vars file with the information but it doesn't seem to want to budge. any ideas?
03:52 -!- master_of_master [~master_of@p57B5530B.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
03:54 -!- master_of_master [~master_of@p57B578A5.dip.t-dialin.net] has joined #openvpn
04:00 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9380>
04:25 -!- lkthomas [~lkthomas@058177217070.ctinets.com] has quit [Quit: lkthomas]
04:31 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:31 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:31 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:42 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9381>
04:43 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 245 seconds]
04:48 <@vpnHelper> RSS Update - forum: Does OpenVPN generate MAC Pause (01:80:c2:00:00:01) packets? <http://forums.openvpn.net/topic7557.html>
04:48 -!- teddz_ [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has joined #openvpn
04:53 -!- common [~common@p5DDA481A.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
04:54 -!- common [~common@p5DDA48A3.dip0.t-ipconnect.de] has joined #openvpn
05:02 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
05:03 -!- lupine_85 [~lupine_85@2001:41c8:10:462::99] has joined #openvpn
05:03 -!- teddz_ [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
05:06 -!- basselito [02413aa8@gateway/web/freenode/ip.2.65.58.168] has joined #openvpn
05:06 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
05:07 < basselito> !welcome
05:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:10 -!- linodesppadic [~sonupunno@88.211.55.77] has quit [Read error: No route to host]
05:11 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
05:17 -!- basselito [02413aa8@gateway/web/freenode/ip.2.65.58.168] has quit [Ping timeout: 265 seconds]
05:18 -!- teddz_ [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has joined #openvpn
05:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
05:24 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9383>
05:25 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:28 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Read error: No route to host]
05:28 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
05:30 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9384>
05:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:35 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
05:35 -!- mode/#openvpn [+o mattock] by ChanServ
05:38 < bo_root> when i try to generate new key i get: string is too long, it needs to be less than  2 bytes long, any hint?
05:46 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
05:48 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9385>
06:06 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9386>
06:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:18 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9387>
06:30 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9388>
06:32 -!- maxJadi [~maxJadi@dhcp-166-99.nomad.chalmers.se] has joined #openvpn
06:32 -!- maxJadi [~maxJadi@dhcp-166-99.nomad.chalmers.se] has quit [Changing host]
06:32 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:36 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9389>
06:48 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9390>
06:49 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
06:50 < Splex> is it possible to specify alternate credentials for each <connection>?
06:51 < Bushmills> there is no connection before proper credentials were verified
06:51 < Bushmills> though my idea of "connection" may differ from yours
06:52 < Splex> i want to have a client connect to one vpn server, if unable, then connect to the next server in line, etc... where the client has a different set of certs for each server
06:52 < Splex> i saw the <connection></connection> option in the manual
06:52 < Bushmills> you can have multiple remote statements
06:52 < Splex> but it seems I cannot put separate certs for each one
06:53 < Bushmills> but not 100% sure whether you'll be rotated to the next on authenticate failure
06:53 < Splex> according the the manual " An OpenVPN client will try each connection profile sequentially until it achieves a successful connection"
06:53 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9391>
06:54 < Bushmills> worth to try that out
06:55 < Splex> i have tried it, but how can I specify a separate ca/cert/key for each server?
06:56 < Bushmills> by using a config section per server
06:58 < Splex> what do you mean 'config section'?  do you mean <connection></connection> block?
06:59 < Bushmills> yes. manual calls them   connection profiles
06:59 < Splex> right, but the question i have:  how to specify the ca/cert/key for each connection profile?
06:59 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
07:00 < Bushmills> having   remote, ca, cert and key  inside the profiles should do
07:00 < Bushmills> using different keys per server
07:00 < Splex> the manual says:  The following OpenVPN options may be used inside of a <connection> block: bind, connect-retry, connect-retry-max, connect-timeout, float, http-proxy, http-proxy-option, http-proxy-retry, http-proxy-timeout, local, lport, nobind, port, proto, remote, rport, socks-proxy, and socks-proxy-retry.
07:01 < Splex> when i try to put ca, cert, key in the profile, there are errors in the log: 
07:01 < Splex> Options error: remote: bad protocol associated with host wb.ath.cx: 'servers'
07:01 < Splex> Use --help for more information.
07:01 <@dazo> Splex: the man page is correct ... you cannot use ca/cert/key inside a connection blok
07:02 <@dazo> in fact, that sounds odd to do so, IMHO
07:02 < Splex> dazo, how would i have a different ca/cert/key for each host then?
07:02 < Bushmills> seems like you need a different solution then
07:02 <@dazo> <connection> only takes care of connection to a server ... ca/cert/key is connected to your identity - which is used as authentication
07:03 < Splex> each host has its own CA
07:03 < Bushmills> maybe, ask first:  why try to connect to a server for which you don't have proper authentication
07:03 <@dazo> so connection is not designed for using multiple identities 
07:03 < Bushmills> include in client config only those remotes where you can connect to
07:04 < Splex> ok, I see.  so really, each client config is 'per identity'
07:04 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555.html#p9392>
07:04 <@dazo> you can also use --config inside a config file .... as a kind of "include" file
07:04 <@dazo> Splex: yes, that's kind of a way to see it
07:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:10 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555-15.html#p9393>
07:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:13 < Splex> dazo: I want to have the client follow one config file, if fail, try the next, etc...  would this be possible with the '--config inside a config file' method that you suggested?
07:14 <@dazo> Splex: no, you need a script to do that for you ... however, you can put all the generic parts into a "common-config" which is "included" via --config
07:14 < Splex> ahh
07:16 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555-15.html#p9394>
07:22 -!- macsppadic is now known as migrator
07:22 <@vpnHelper> RSS Update - forum: OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html#p9396> || Routing to LANs behind server <http://forums.openvpn.net/topic7555-15.html#p9395>
07:28 < xindz> Hey, Im using Ubuntu 10.4 and I wonder were i can set the default gateway? I want to use tap0 (openVPN). My client config -> http://pastebin.com/nL23NCsE
07:33 <@vpnHelper> RSS Update - forum: OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html#p9397>
07:57 < ljvb> there any decent front ends to ovpn that don't require a millione dependencies anx libs
07:57 < ljvb> the ones on openvpn.net are all out of date or suck.
07:58 -!- mtorn [~mtornwall@a181.broadband.quicknet.se] has joined #openvpn
07:58 < ecrist> what do you mean by front end?
07:59 < mtorn> Hello everyone, I'm struggling with my OpenVPN tunnel -- I have two routers flashed with DD-WRT configured to form an OpenVPN tunnel. They are 10.0.0.1 and 10.1.0.1, respectively. From 10.1.0.1 I can ping 10.0.0.1 (the OpenVPN server) though the tunnel, but if I try to ping the 10.0.0.1 router from a client on the 10.1.0.x network, it doesn't seem to get any reply through the tunnel. Ideas? Thanks.
08:00 < ljvb> something that ties into the management interface (if enabled in the config)
08:01 < Splex> mtorn: do you have 'client-to-client' in the config?
08:01 < ljvb> just looking for something to mess around with today.. its a slow work day and I have a base fbsd vm sitting here staring at me yelling at me to do something with it
08:01 < mtorn> Splex, I set it up mostly through the DD-WRT web interface but I'll take a look -- what does it do?
08:01 < ljvb> splex you should not need client-client to ping the router, only other ovpn clients
08:02 < ljvb> lemme rephrase, you should not need it to ping the ovpn gateway ip
08:02 < ljvb> which I am guessing is the router
08:03 < Dougy> newegg selling 8gb ddr3 1333 for 60
08:03 < Dougy> if anyone needs
08:03 < Dougy> im sure they are low on stock by now
08:03 < Splex> ljvb: yeah i was thinking of the client connecting to the 10.1.0.1 router with openvpn..
08:04 < mtorn> ljvb, yes -- the 10.0.0.1 router is the ovpn server, and the 10.1.0.1 router acts as an openvpn client. I can't ping 10.0.0.1 from a client on the 10.1.0.0 net
08:04 < Splex> mtorn: you are talking about clients on the LAN pinging the other LAN gateway?
08:04 < mtorn> Splex, right
08:04 -!- komodo [~komodo@cl-971.mbx-01.si.sixxs.net] has joined #openvpn
08:04 < Splex> mtorn, then i suspect it is either a firewall issue, or routing
08:04 < mtorn> Splex, to elaborate: my computer --> ovpn client (local router) --> tunnel --> ovpn server (remote router)
08:05 < Splex> got it
08:05 < mtorn> when I read the tcpdump output it would appear that echo request packets go INTO tun1 on the ovpn client, but they don't get replied to
08:05 < Splex> localrouter can ping the ovpn server?
08:05 < mtorn> on the other hand when I ping 10.0.0.1 from 10.1.0.1 and listen in on tun1 @ 10.1.0.1 I see replies
08:05 < mtorn> yes it can
08:06 < Splex> sounds like maybe an issue with iptables rules?
08:07 < mtorn> Splex, thought so and flushed the FORWARD chain -- nothing
08:07 < mtorn> and yeah my policy is ACCEPT :)
08:08 < Splex> echo 1 > /proc/sys/net/ipv4/ip_forward ?
08:08 < mtorn> done it
08:08  * ljvb uses fb sd
08:08 < ljvb> cannot helped with linux
08:08 < Splex> iptables -A INPUT -i tun+ -j ACCEPT
08:08 < Splex> iptables -A FORWARD -i tun+ -j ACCEPT
08:08 < Splex> ?
08:08 < ljvb> and apparently I like to put random spaces in things
08:09 < mtorn> Splex still nothing :(
08:09 < ljvb> asynchronous routing problem?
08:10 < mtorn> what's that
08:10 < ljvb> maybe
08:10 < Splex> what does the routing table look like on the 10.1.0.1 router?
08:10 < mtorn> sec
08:10 < ljvb> when traffic goes in one way, and out another, but does not know the return path to the original request
08:10 -!- teddz_ [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has quit [Quit: Ex-Chat]
08:10 < Splex> and also, what does it look like on the 10.0.0.1 router?
08:10 < Splex> yeah, was just thinking that too
08:11 -!- mtx_init [~mtx_init@unaffiliated/medex] has quit [Quit: mtx_init]
08:11 < ljvb> I had that issue when trying to do natting over the vpn tunnel 
08:11 < ecrist> ljvb: regarding a front end, the windows gui is being rolled into openvpn and is going to be greatly improved in 2.2, iirc
08:11 < ecrist> tunnelblick on mac is sufficient.
08:11 < mtorn> http://pastebin.com/pQhF1sGW
08:11 < mtorn> ^^ routing table on 10.1.0.1 ^
08:12 < Splex> mtorn, what about 10.0.0.1?
08:12 < ljvb> in an attempt to bypass ISP filtering (fios), I setup openvpn on a vps, with my fios network connecting to it, then attempted to use port forwarding and natting to forward requests on say www on the vps IP back to the fios network, but the fios network responded by sending out the traffic via the default route
08:12 < Splex> (routing table)
08:12 < mtorn> sec again
08:12 -!- teddz [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has joined #openvpn
08:13 < ljvb> and no, I did not use redirect as I do not want all traffic going through the vps
08:14 < ljvb> although I suspect if I setup bgp, I could have resolved the issue..
08:15 < mtorn> Splex, http://pastebin.com/Wmwxmn1c is the 10.0.0.1 route -n
08:15 < Splex> just as i suspected, 10.0.0.1 doesn't know where to send 10.1.0.0/24 packets
08:16 < ljvb> use iroute in a ccd client config?
08:16 < Splex> try adding another entry for tun0 to route 10.1.0.0/24 to tun0
08:16 < Splex> on the 10.0.0.1 router
08:17 < mtorn> ljvb, I set up an "iroute 10.1.0.0 255.255.255.0" on the ccd that goes to the 10.1.0.1 router
08:17 < mtorn> and yeah Splex I'll give it a shot
08:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
08:18 < ljvb> did you name the file correctly (I spent 3 hours trying to figure out why my laptop connecting to my server could not talk to the fios network.. turned out to e a tyupo in the ccd file name
08:18 -!- teddz [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
08:20 < mtorn> ljvb, no, I checked that :)
08:20 < Splex> and, check the ipp file to make sure the ccd matches the host in that file
08:20 < Splex> but first, make sure things work by manually adjusting the routing table :)
08:21 < ljvb> not sure if its required, but do you have the push route statements in the main config?
08:21 < mtorn> Splex, what should the exact command be?
08:22 < ljvb> for my two networks (192.168.15/24 and 192.168.100/24) I had to add push route statements
08:22 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Operation timed out]
08:23 -!- mant1s [~mant1s@2002:8d72:d426::8d72:d426] has joined #openvpn
08:23 -!- mant1s [~mant1s@2002:8d72:d426::8d72:d426] has quit [Changing host]
08:23 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:23 -!- acecile` [~gandalf@adsl02.metz.linbox.com] has joined #openvpn
08:23 -!- chantra_1fk [~chantra@ns38827.ovh.net] has quit [Ping timeout: 264 seconds]
08:23 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
08:24 < mtorn> alright turns out I already had both the 10.0.0.0 and 10.1.0.0 routes pushed on 10.0.0.1 (not sure why the 10.0.0.0 was there; didn't set it up myself)
08:25 < Splex> mtorn: route add -net 10.1.0.0/24 tun0 should do
08:25 < mtorn> Splex alright I'll give that a shot in a sec
08:27 -!- Irssi: #openvpn: Total of 134 nicks [4 ops, 0 halfops, 0 voices, 130 normal]
08:27 -!- acecile [~gandalf@adsl02.metz.linbox.com] has quit [Ping timeout: 255 seconds]
08:28 -!- chantra_afk [~chantra@unaffiliated/chantra] has joined #openvpn
08:30 < mtorn> brb, rebooting my local router -- thanks for the help so far guys!
08:30 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
08:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
08:30 <@vpnHelper> RSS Update - forum: VMware View 4.5 using OpenVPN <http://forums.openvpn.net/topic7558.html>
08:34 < mtorn> Splex, that route did the trick! Thanks a lot!:)
08:34 < Splex> great!
08:34 < Splex> np
08:39 < ljvb> mtorn while that resolved the issue, there is still a configuration prolem somewhere you need to resolve
08:39 < ljvb> unless you want to manually add the route each time you reboot
08:40 -!- master_of_master [~master_of@p57B578A5.dip.t-dialin.net] has quit [Quit: leaving]
08:41 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has joined #openvpn
08:44 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has quit [Client Quit]
08:47 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:48 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
08:50 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has joined #openvpn
08:54 -!- dazo is now known as dazo_afk
08:55 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- s0 d4Mn l33t |t'z 5c4rY!]
08:55 -!- komodo [~komodo@cl-971.mbx-01.si.sixxs.net] has quit [Quit: Konversation terminated!]
08:57 -!- dazo_afk is now known as dazo
08:57 < mtorn> ljvb, what else do I need?
08:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
09:01 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
09:10 -!- mtorn [~mtornwall@a181.broadband.quicknet.se] has quit [Ping timeout: 246 seconds]
09:12 -!- mtorn [~mtornwall@a073.broadband.quicknet.se] has joined #openvpn
09:12 -!- master_of_master [~master_of@p57B578A5.dip.t-dialin.net] has joined #openvpn
09:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:15 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:16 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:17 -!- Cain` is now known as Cain
09:21 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has quit [Quit: prettyrobots]
09:23 -!- p3rror [~mezgani@41.248.104.182] has joined #openvpn
09:25 -!- silverra1ndog [~angus@host86-135-91-53.range86-135.btcentralplus.com] has joined #openvpn
09:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:27 -!- silverraindog [~angus@host86-178-116-79.range86-178.btcentralplus.com] has quit [Ping timeout: 272 seconds]
09:32 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has joined #openvpn
09:34 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has quit [Client Quit]
09:34 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has joined #openvpn
09:34 -!- prettyrobots [~alan@adsl-99-30-95-142.dsl.sfldmi.sbcglobal.net] has quit [Client Quit]
09:36 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
09:39 -!- alhadi [~thunderst@ner-as22720.alshamil.net.ae] has joined #openvpn
09:54 -!- mtorn [~mtornwall@a073.broadband.quicknet.se] has quit [Ping timeout: 276 seconds]
09:55 -!- mtorn [~mtornwall@a181.broadband.quicknet.se] has joined #openvpn
10:04 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
10:05 -!- p3rror [~mezgani@41.248.104.182] has quit [Ping timeout: 240 seconds]
10:08 < bo_root> when generating CA.. Now edit the vars file and set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters.. do i need to set any other thing in vars?
10:09 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
10:10 < ecrist> don't think so
10:10 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:11 < bo_root> i got http://pastebin.com/MxnqdAJZ
10:12 -!- prettyrobots [~alan@66.93.0.189] has joined #openvpn
10:14 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:17 -!- mtorn [~mtornwall@a181.broadband.quicknet.se] has quit [Ping timeout: 246 seconds]
10:19 -!- mtorn [~mtornwall@a073.broadband.quicknet.se] has joined #openvpn
10:19 -!- p3rror [~mezgani@41.140.44.15] has joined #openvpn
10:20 < dvl> bo_root: what directory are you in?
10:20 < bo_root>  /usr/local/etc/openvpn
10:21 < dvl> bo_root: and what are you trying to do?
10:22 < bo_root> i am following this howTo http://www.openvpn.net/index.php/open-source/documentation/howto.html#quick
10:22 <@vpnHelper> Title: HOWTO (at www.openvpn.net)
10:22 < bo_root> section Generate the master Certificate Authority (CA) certificate & key
10:22 < dvl> bo_root: You're using easy-rsa here?
10:23 < dvl> bo_root: If so, usually, I create a separate dir for that, keep it away from OpenVPN, just to be clean.
10:23 < bo_root> i copied because: "it's best to copy this directory to another location such as /etc/openvpn"
10:23 < dvl> bo_root: note: it is . ./vars (two dots)
10:24 < bo_root> # . ./vars
10:24 < bo_root> /usr/local/bin/.: Permission denied.
10:24 < bo_root> tried that also
10:24 < dvl> echo $SHELL
10:25 < bo_root>  /bin/csh
10:25 < dvl> and what OS are you using?
10:25 < bo_root> FreeBSD
10:25 < dvl> same here.
10:25 < dvl> Unfortunately, it appears that script is bash-centric.  Do you have bash installed?
10:25 < dvl> export is a bash thing
10:25 < bo_root> ok let me try
10:25 < dvl> bo_root: Let me find you my article on easy-dns  it works
10:25 < bo_root> ok
10:26 < dvl> I meant rsa, not dns
10:26 < dvl> http://www.freebsddiary.org/openvpn-easy-rsa.php
10:26 <@vpnHelper> Title: The FreeBSD Diary -- Creating your own Certificate Authority (at www.freebsddiary.org)
10:26 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
10:26 < dvl> bo_root: Let me know if you encounter any problems doing it that way. Please start again from scratch.
10:27 < bo_root> ok i will let u know
10:31 <@vpnHelper> RSS Update - forum: OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html#p9399>
10:32 -!- mtorn [~mtornwall@a073.broadband.quicknet.se] has quit [Ping timeout: 265 seconds]
10:33 -!- mtorn [~mtornwall@a181.broadband.quicknet.se] has joined #openvpn
10:34 -!- mtorn [~mtornwall@a181.broadband.quicknet.se] has quit [Client Quit]
10:37 <@vpnHelper> RSS Update - forum: [SOLVED] IP address of client still visible <http://forums.openvpn.net/topic7514.html#p9343>
10:39 < dvl> bo_root: progress?
10:41 < bo_root> i will start in 20min, something came up, but dont worry, will let u know
10:43 -!- migrator is now known as macsppadic
10:43 <@vpnHelper> RSS Update - forum: Problem installing, compiling problem <http://forums.openvpn.net/topic7554.html#p9400>
10:44 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has joined #openvpn
10:44 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has quit [Changing host]
10:44 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
10:53 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:55 <@vpnHelper> RSS Update - forum: Benefits of certificates vs. username/password auth. <http://forums.openvpn.net/topic7533.html#p9401>
11:02  * gladiatr entertains thoughts of violence in regards to anyone that design a fc adapter driver that lacks support for LUN masking...
11:02 < gladiatr> s/gn/gns/
11:03 < Essobi> gladiatr: eww
11:03  * gladiatr nods
11:04 < gladiatr> I miss Digital
11:04 < ecrist> what is LUN masking?
11:04 < gladiatr> heh
11:05  * gladiatr bonks ecrist 
11:05 < bo_root> dvl: here?
11:06 < dvl> bo_root: always
11:06  * ecrist dons 'dunce' cap
11:06 < gladiatr> ecrist, really?  Never had the pleasure of working with SAN tech, huh?
11:06 < ecrist> sure, work with it now, just not familar with LUN masking
11:07 < gladiatr> it's software tech that allows you to configure target hosts to specify (or block) which LUNs on a given fabric it will interact with.
11:07 < gladiatr> usually done by wwiwid
11:07 < gladiatr> er
11:07 < gladiatr> wwwid
11:08 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
11:09 < gladiatr> These blastedly expensive sunfire systems I've got to deal with came with qlogic adapters (2240 series) that are apparently one of the only modern fiber channel adapter controllers that do not have driver support for such a thing.  And to get that sort of functionality out of sun disk arrays would require firmware licenses that are about half the cost of the array itself.
11:09 < gladiatr> </rant>
11:11 < ecrist> never dealt with fibrechannel
11:11 < ecrist> we only do SAS
11:11 < gladiatr> blessed art though amongst geeks and such
11:11 < gladiatr> heh
11:12 < gladiatr> it's a neat idea--just stupidly expensive to do it correctly.
11:12 < gladiatr> building a fiber channel network, that is.
11:13 < ecrist> we use a pair of heads connected with 6Gbps SAS and export that array with NFS
11:19 < gladiatr> Yeah.  At least with that sort of setup, you can tear off a piece of your storage and export it as an iscsi volume if you Absolutely Must Have Local File Systems
11:25 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
11:29 -!- p3rror [~mezgani@41.140.44.15] has quit [Ping timeout: 240 seconds]
11:32 -!- teddz [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has joined #openvpn
11:35 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:49 -!- p3rror [~mezgani@41.140.173.219] has joined #openvpn
11:53 -!- prettyrobots [~alan@66.93.0.189] has quit [Quit: prettyrobots]
12:00 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:05 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:06 -!- teddz [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has quit [Quit: Ex-Chat]
12:08 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
12:11 -!- teddz [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has joined #openvpn
12:14 < Splex> if there is a server/client key that i generated and don't need, is it enough to just delete it?  or, do i really need to 'revoke' it?
12:16 <@dazo> Splex: if you revoke it, you are absolutely sure nobody can use it afterwards (as long as the server uses the CRL file) ... in case somebody managed to make a copy or restore the file from the filesystem
12:17 < Splex> even if i am certain it is totally wiped?
12:17 < Splex> my understanding is that if i generate a crl file, need to propogate to clients, correct?
12:18 < gladiatr> the crl is only necessary on the server
12:18 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
12:18 < Splex> gladiatr, dazo: i am specifically looking at removing a server key
12:19 < Splex> that hasn't been used
12:19 < Splex> generated it, and realized i don't need it
12:19 < ecrist> Splex: you need to actually revoke it
12:19 < ecrist> s/need/should/
12:19 < Splex> even if i securely wipe it?
12:19 <@dazo> in that case, revoking is bogus, practically ... especially if you used f.ex. shred to delete it
12:19 < gladiatr> I'm with ecrist on this.  You might as well.  It will keep your CA consistent 
12:20 <@dazo> but to play by the book and according to good practice, revoking is the safest
12:20 < Splex> ok, but in the case of a sever key, wouldn't the clients need the crl file?
12:20 <@dazo> nope
12:21 < Splex> if somehow someone was able to resurrect the server key, how would the revoking be known?
12:21 <@dazo> CRL is mostly used to revoke client certificates ... propagating CRL's to a vast majority of users is a lot more work
12:22 <@dazo> (not even sure you can use --crl on the client side) ... but for the CA administration, it's good practice anyway
12:22 <@dazo> Splex: ahh ... sorry, I miss-read your question ... yeah, clients would basically need CRL too, yeah
12:23 <@dazo> or to have some kind of OCSP service running, probably
12:23 < Splex> but as far as the CA is concerned, if i shred the server cert, it would not have any record it ever existed, correct?
12:24 < gladiatr> It would still exist as far as your CA is concerned.
12:24 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
12:24 < ecrist> the right thing, the 'proper' thing is to revoke it, Splex 
12:24 < ecrist> that is all
12:24 -!- zahary [~Adium@83.148.96.87] has joined #openvpn
12:27 < Splex> ok, another question, if there are multiple VPN servers, connecting to eachother, each allowing clients to connect...  I am thinking of having a separate CA for each server.  Is this a good idea (more secure) instead of having a single CA issuing certs for all servers and clients?
12:27 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has left #openvpn ["Leaving"]
12:27 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
12:27 < gladiatr> are all of your clients going to be able to connect to any of your servers?
12:29 -!- p3rror [~mezgani@41.140.173.219] has quit [Ping timeout: 240 seconds]
12:32 < Splex> the clients would have access to the whole network, but with the multiple CA idea, each server could generate a separate client cert, so that the clients would have a different set of certs for each server it connects to (hence my question earlier about having a different set of credentials for each connection profile)
12:33 <@dazo> Splex: that sounds like a nightmare to administer
12:33 < gladiatr> indeed
12:35 < Splex> in what way?
12:38 < gladiatr> Well, let's say you have 4 vpn servers, each with a server key generated from a seperate CA.  If you have 5 users that need to connect to those 4 servers, you have to generate, distribute and maintain 24 certificates
12:38 < zahary> hey guys, can you suggest some complimentary software that would allow clients to see who else is on the VPN network?
12:39 < Splex> each vpn server would be like an 'access server', the vpn servers would connect to eachother.. so in most cases, the clients wouldn't need to connect to all servers
12:39 < gladiatr> Splex, essentially, though, you can handle this with a single CA.  
12:40 < gladiatr> zahary, echo -en "cat /etc/openvpn/ipp.txt" > ~/public_html/index.cgi" :D
12:40 < gladiatr> ohoh... chmod 755 ~/public_html/index.cgi
12:41 < Splex> would there be any significant security benefity by having separate CAs?
12:41 < Splex> s/benefity/benefit
12:41 < gladiatr> Not really.
12:41 < gladiatr> The only problem with having a unified CA structure is if that structure is compromised.
12:41 < zahary> is that the client table at the server? can clients themself acquire this list?
12:42 < Splex> thats what i was concerned about, if a CA is compromised
12:42 < gladiatr> zahary, no.  Sorry about the bad joke :)  Essentially, you can parse ipp.txt or get the same info from the openvpn management port using whatever method you see fit.
12:42 < bo_root> dvl: ..
12:43 < gladiatr> Splex, the rule with a CA is that it should be on an encrypted file system on a system with little or no remote accessibility
12:44 < Splex> yeah, i understand that part.  I was thinking 'if a location is compromised, including any offline drives/boxes'
12:44 < zahary> oh, i see. well, I can just install a jabber server on the VPN network, but I was shopping around for simpler methods
12:44 < gladiatr> Splex, that's where the encrypted filesystem comes in.
12:44 < dvl> bo_root: 
12:44 < gladiatr> That way, regardless of whether someone lays hands on your hardware, they will have a hell of a time actually getting at your data.
12:46 -!- dazo is now known as dazo_afk
12:46 < bo_root> dvl: yes, i am having problems with bash..
12:47 < dvl> bo_root: details?
12:47 < bo_root> just a sec, i will pastebin
12:48 < Splex> gladiatr: what if I want to have multiple admins have the ability to issue certs.  would it be better to have more than one CA?
12:49 < dvl> Splex: I am quite you you want just one CA.  Others will confirm.
12:50 < bo_root> dvl: http://pastebin.com/nyGQHf1F
12:53 < Splex> dvl, would it be ok to duplicate the CA to multiple locations?
12:53 < Splex> so each location could generate certs
12:53 < gladiatr> Splex, no.  You don't want them out of sync
12:53 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
12:54 < Splex> gladiatr, so, in that case, i would want multiple CAs?
12:55 -!- morbidwar [~ovidiu@78.96.23.179] has joined #openvpn
12:56 < gladiatr> Splex, ... ok.  I'm getting the feeling that what you actually are trying to describe is a scenario with multiple, independent entities (you and N number of friends/cohorts/partners in crime/etc) that you want to set up a virtual private network system with.  If this is the case then sure.  The admin of each site should have their own CA and grant access to whomever they want.  If you choose to leash your network to theirs, that's 
12:56 < gladiatr> a non-technical trust issue.
12:57 < gladiatr> What you asked was whether it was more secure for you (singular) to operate multiple CAs in the original scenario.  Doing that makes no sense and doesn't enhance the security of your site(s)
12:58 < dvl> bo_root: login as root.  Invoke the bash shell.
12:58 < dvl> # bash
12:58 < dvl> bo_root: then try again.
12:59 < bo_root> dvl: same thing
12:59 < Splex> gladiatr: yes, i guess that is essentially a clear way to look at it... multiple separate VPNs that will then connect to eachother based on a trust scenario
13:00 < Splex> but really, it is all one system
13:01 < dvl> bo_root: I have no references to whichopensslcnf in my easy-rsa directory
13:02 < Splex> its just that I don't really want it to all be 'centralized'
13:02 < dvl> bo_root: Are you using /usr/local/share/doc/openvpn/easy-rsa/ as your starting point?
13:03 < bo_root> no i copied it to dofferent dor, now i will try from oroginal one, just let me change values
13:03 < bo_root> different dir*
13:04 < dvl> bo_root: No, you're find doing a cp.
13:05 < dvl> bo_root: fixed
13:05 < dvl> $ . ./vars
13:05 < dvl> -bash: /home/dan/easy-rsa/2.0/whichopensslcnf: Permission denied
13:05 < dvl> NOTE: If you run ./clean-all, I will be doing a rm -rf on /home/dan/easy-rsa/2.0/keys
13:05 < dvl> chmod +x /home/dan/easy-rsa/2.0/whichopensslcnf
13:05 < dvl> ^ do that line
13:05 < bo_root> ok
13:05 < gladiatr> Right.  Agent Boris stabs agent Bullwinkel in the dark and grabs his laptop.  He has 1 client key that he can use to access any of the servers that is connected to all the other servers and their connected networks.  Or he ends up with 3 keys that he can use to connect to each of said servers.  
13:06 < dvl> bo_root: For future, pastebins need to have the exact command and output.  :)
13:07 < bo_root> ok
13:07 < bo_root> now it was ok
13:07 < bo_root> after i made it executable
13:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:08 < dvl> Good.
13:09 < bo_root> tnx
13:10 < Splex> gladiatr: and in both cases the certs would need to be revoked... and the crl propogated to the servers
13:10 < gladiatr> yup
13:11 < Splex> in most cases, the clients wouldn't need to have access to more than one server
13:11 < Splex> just the 'closest one' and perhaps one redundancy
13:15 -!- morbidwar [~ovidiu@78.96.23.179] has quit [Remote host closed the connection]
13:15 <@vpnHelper> RSS Update - forum: OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html#p9402>
13:26 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:26 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:26 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:36 < dvl> bo_root: FYI, I just updated that easy-rsa article to include the error you encountered.
13:38 < bo_root> ok, from there on everything went smoothly
13:41 < dvl> bo_root: good!
13:43 < ecrist> I should rewrite ssl-admin so we can do away with easy-rsa
13:48 < Splex> regarding my question earlier about revoking a cert, i actually want to change it from a server cert to a client cert.  is that possible?
13:49 -!- zahary [~Adium@83.148.96.87] has left #openvpn []
13:50 < gladiatr> careful there, ecrist.  I kinda dig the easy-rsa :P
13:51 < alhadi> !pb
13:51 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
13:53 < gladiatr> Splex, nope.  Gotta roll a new one
13:54 < ecrist> !ssl-admin
13:54 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
13:54 < ecrist> imho, easy-rsa is a POS
13:55 < gladiatr> it's a total POS, but it runs just handily on strip-down embedded systems that have few support libraries and barely 2 extra cpu cycles to rub together ;)
13:56 < gladiatr> not that I'd ever do that
13:56 < gladiatr> but I could
13:56 < gladiatr> if I wanted to 
13:56 < gladiatr> or
13:56 < gladiatr> to make a point or something.
13:57 < ecrist> heh
13:58 < Splex> gladiatr: if i revoke a cert and roll a new one, can it have the same CN as the old?
13:58 < gladiatr> yes
13:58 < ecrist> yes
13:58 < gladiatr> as a matter of fact, that's the only way to use the same CN without your CA yelling at you.
14:00 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
14:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:11 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:15 < gladiatr> hiya krzee
14:15 < krzee> hey man
14:16 < krzee> <-- chillen at the airport
14:17 < reiffert> which airport is it?
14:17 < krzee> san francisco
14:18 < gladiatr> good times
14:18 < krzee> ya man
14:18 < gladiatr> could be worse.  could be salt lake city... or Cincinnati
14:18 < krzee> the weed in the north bay got SOOOO cheap
14:19 < krzee> damn near everyone grows now, people were giving me ounces of good for $20
14:19 < gladiatr> damn, man.  
14:20 < gladiatr> *cough* UPS *cough*
14:20  * gladiatr giggles
14:21 < krzee> haha damn missed ya by a day
14:21 < krzee> i coulda UPS'ed a bit to a dropsite for ya, if it got caught it would have only been small $ lost
14:22 -!- WinstonSmith [~true@e179020210.adsl.alicedsl.de] has joined #openvpn
14:22  * gladiatr announces, "We are not discussing and/or condoning and/or condoning the discussion of the violation of interstate controlled substance laws.  This is a conversation about kernel schedulers."
14:23 < gladiatr> *cough*
14:23 < krzee> correct!
14:23 < dvl> Poor linux...
14:23  * gladiatr giggles
14:23 < krzee> non-encrypted kernel schedulers!
14:23 < krzee> hehe
14:23 < gladiatr> that's right!
14:24 < gladiatr> and... the perfect kind of pizza for munching after... erm... smoking one...
14:24 < ecrist> we term that as 'letting the smoke out' around here
14:24 < gladiatr> I like it
14:25 < krzee> ya i like that one too
14:26 < krzee> oh man my boy in the south bay had good inet
14:26 < krzee> i consistently got over 1MB/s
14:26 < krzee> *jealous*
14:28 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 272 seconds]
14:33 < gladiatr> fiber?
14:34 < krzee> nah just good cable or dsl
14:34 < krzee> and my dsl at hmoe blows
14:34 < krzee> home*
14:36 < gladiatr> someday... we won't be a third-world broadband country
14:36 -!- p3rror [~mezgani@41.248.188.73] has joined #openvpn
14:36 < ecrist> my cable at home is good.
14:37 < krzee>   yes, it is
14:37 < gladiatr> who is your provider up there?
14:37 < krzee> i garuntee you wouldnt wanna colo at my house ;)
14:37 < gladiatr> lol
14:37 < ecrist> comcast business
14:37 < krzee> (vpnhelper is on a box of mine at ecrist's house)
14:38 < krzee> i do colo at his house, he certainly wouldnt wanna use mine
14:38 < krzee> heheh
14:38 < ecrist> hehe
14:38 < krzee> what do you have?  50mbit?
14:38 < ecrist> 22mbit
14:39 < krzee> gah
14:39 < krzee> i pay more than you for 3/1
14:39 < ecrist> my bandiwdth needs don't surpass that.
14:39 < ecrist> 22/2, actually
14:39 < ecrist> for $10 more /mo I can upgrade to 22/5
14:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:39 < krzee> realistically, not many people have home bandwidth needs even near that
14:39 < ecrist> and for $100 more /mo, I can get 50/10
14:40 < krzee> haha $10 for 3mbit more up
14:40 < krzee> i can pay like 300 more for 20 down but i keep 1mbit up
14:40 < gladiatr> ecrist, the most the local cable co. provides for upstream is 1
14:40 < ecrist> I'm on an old price plan, the $10 bumps me to their new plan at the current speeds
14:40 < krzee> and ive considered it
14:40 < reiffert> :)
14:41 < reiffert> krzee: get a house next to a local data center and dig a wire
14:41 < ecrist> now, the DC where $work has hosting we've capped at 15/15, but we can bump that to gigE with a phone call
14:41 < krzee> well im looking into getting fiber to the office, if that happens im putting a bed in there somewhere
14:41 < krzee> lol
14:41 < ecrist> don't really want to see that bill if we use that much, though.
14:42 < reiffert> 100/5 is about 100 US$ via tv cable
14:43 < krzee> reiffert, they use docsis3 there??
14:43 < reiffert> (for business). for consumer it's about half the price
14:43 < reiffert> krzee: think so.
14:43 < krzee> impressive
14:43 < krzee> afaik most of usa is still on docsis2 (ecrist being an exception)
14:43 < reiffert> 128/5 for 45 EUR
14:43 < krzee> then again most my info on that is like 3 yrs old
14:43 < reiffert> http://www.unitymedia.de/produkte/internet.html
14:43 <@vpnHelper> Title: Kabel DSL Flatrate von Unitymedia zum günstigen Festpreis (at www.unitymedia.de)
14:44 < reiffert> ~~ 60 USD
14:44 < ecrist> Minneapolis was comcast's first docsis3 rollout
14:44 -!- p3rror [~mezgani@41.248.188.73] has quit [Ping timeout: 250 seconds]
14:44 < krzee> yep
14:44 < ecrist> I was customer number 6 or something silly
14:44 < reiffert> :)
14:44 < krzee> you got docsis3 around the time i learned to hack docsis2
14:44 < ecrist> heh
14:44 < gladiatr> they've gone to docsis3 here, but they're milking their market
14:44 < gladiatr> krzee, you hack your modem?
14:44 < reiffert> but they run on bad firewalls, I can choose whatever valid IP from their subnet that I like to.
14:45 < krzee> gladiatr, i have a hacked modem, not in cable range anymore
14:45 < krzee> so im on DSL
14:45 < gladiatr> gotcha
14:45 < reiffert> when they once disabled my account, their dhcp server gave me a private IP, but taking any official one made me being up again
14:45 < reiffert> (although the VOIP stopped working then)
14:46 < krzee> lol thats funny reif
14:46 < reiffert> however, I was "online enough" to call the agents to ask why my account was disabled
14:46 < krzee> they forgot to block your modems MAC
14:46 < reiffert> I can choose the modem MAC to whatever I like :)
14:46 < krzee> ahh =]
14:46 < reiffert> so even taking one of my neighbours that my tcpdump saw in that subnet previously
14:46 < krzee> jtag'ed it up?
14:47 < krzee> does that still work on docsis3?
14:47 < reiffert> you have two devices here. one is for docsis and one for ip layer 3.
14:47 < reiffert> the docsis cable modem played well all the time.
14:47 < reiffert> just the gateway got a private IP
14:48 < reiffert> they ship with two modes: one is: cablemodem + gateway and the other is cablemodem standalone
14:49 < reiffert> I got the former, so I guess thats the cause why I could play with it so well
14:49 < reiffert> s,cause,reason, eh?
14:50 < reiffert> then I moved to a different location in last year and now I'm stuck to 2/0.384 for nearly the same price
14:50 < reiffert> *SIGH*
14:51 < krzee> looks like docsis3 is in fact hacked
14:51 < krzee> cool
14:51 < krzee> (although yours seems to be more a config issue on their behalf)
14:51 < reiffert> yeah
14:51 < krzee> and yep good s///
14:52 < reiffert> I'd add s,nearly,almost,
14:54 < krzee> time to board
14:54 < krzee> bbl
14:54 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:57 -!- p3rror [~mezgani@41.140.25.146] has joined #openvpn
15:05 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
15:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:20 -!- p3rror [~mezgani@41.140.25.146] has quit [Read error: Operation timed out]
15:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
15:30 < mete> hmmh
15:31 < mete> do I need to restart the openvpn server if I modify a ccd file? a diconnect of the client should be enough, isnt it?
15:34 < gladiatr> correct
15:34 < mete> hmmh
15:34 < mete> interesting
15:34 < mete> xD
15:34 -!- p3rror [~mezgani@41.140.38.247] has joined #openvpn
15:35 < mete> don't know why, but ccd isn't working xD
15:35 < reiffert> !configs
15:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
15:35 < gladiatr> are your file names identical to the user lines in ipp.txt?
15:35 < gladiatr> openvpn replaces a lot of non alpha-numeric characters with _
15:35 < reiffert> bet he's doing stuff that cant be done within ccd's
15:35 < gladiatr> '_'
15:36 < mete> ööööö
15:36 < gladiatr> reiffert, indeed
15:36 < mete> I think I know where the error is
15:36 < mete> ipp.txt ;)
15:36 < mete> I will check that first myself :P
15:36 < reiffert> yeah, the error is ipp.txt
15:36 < mete> so I learn the stuff ;)
15:37  * reiffert does by reading.
15:37 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 265 seconds]
15:39 < mete> I will paste the client and server config ^^ one moment :)
15:41 < mete> server conf: http://pastebin.com/zH4ETyHh
15:41 -!- p3rror [~mezgani@41.140.38.247] has quit [Ping timeout: 260 seconds]
15:42 < mete> client conf: http://pastebin.com/tmYan855
15:42 < mete> server is debian 5.0 and client is windows 7
15:42 < mete> client get always IP 172.16.99.6 from the server... why?
15:42 < reiffert> see what --server expands to.
15:43 < mete> I don't know what you mean reiffert? sorry...
15:43 < reiffert> I wonder why people do xxx.xxx their openvpn config. guess what the certs are for.
15:43 < reiffert> #
15:43 < reiffert> server 172.16.99.0 255.255.255.0
15:43 < reiffert> get yourself into manpage and see what --server expands to.
15:46 < mete> allocate addresses to clients out of the given network/netmask.  The server itself will take the ".1" address of the given network  for  use
15:46 < mete>               as the server-side endpoint of the local TUN/TAP interface.
15:48 < reiffert> blah blah blah
15:48 < reiffert>               For example, --server 10.8.0.0 255.255.255.0 expands as follows:
15:49 < mete> I've read that reiffert
15:51 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
15:52 < reiffert> and you are sure that you are recognizing the ifconfig lines in there?
15:53 < mete> yeah, so if no ccd is specified a client get a ip from this range... that's good
15:53 < mete> but what is, if I've a client which needs a "fix ip"?
15:53 -!- p3rror [~mezgani@41.140.178.167] has joined #openvpn
15:53 -!- zahary [~Adium@83.148.96.87] has joined #openvpn
15:54 < reiffert> ls -al /etc/openvpn/ccd
15:54 < mete> -rw-r--r-- 1 root root   39 25. Jan 22:29 laptop02
15:55 < reiffert> ls -al /etc/openvpn/ccd
15:55 < reiffert> there's a reason for -al
15:55 < mete> http://pastebin.com/yRF7Wb1y
15:56 < reiffert> grep laptop02 /var/log/syslog
15:56 < ecrist> sometimes, I really like good root beer.
15:57 < mete> http://pastebin.com/Zk7xJ59Y
15:58 < reiffert> mete: guess it has something to do with topology
15:58 < reiffert> !topology
15:58 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
15:59 < gladiatr> ecrist, hear, hear
15:59 -!- gladiatr is now known as gladiatr_afk
15:59 < reiffert> mete: you were removing ipp.txt yet?
16:01 < mete> this is a new setup, I never used ipp.txt or ccd before ^^
16:01 < reiffert> is there a file named ipp.txt?
16:02 < mete> OpenVPN 2.1_rc11 x86_64-pc-linux-gnu  <-- so my version should be OK for "topology subnet"
16:02 < mete> nope reiffert
16:02 -!- silverra1ndog is now known as silverraindog
16:03 < ecrist> gah, you need to update your software
16:04 < ecrist> 2.1.0 was released over a year ago
16:04 < ecrist> there were 23 RC releases, iirc, and you have 11
16:04 < ecrist> i'm guessing you're using a debian repo, but that's no excuse
16:05 < hyper_ch> of course that is an excuse :)
16:05 < reiffert> its not.
16:05 < hyper_ch> it is :)
16:05 < hyper_ch> everybody <3 debian stable
16:05 < mete> jep, debian repo :P
16:05 < mete> this is the test sys I had :P
16:06 < mete> will install it compiling it by hand, if I have a nicely running conf :P
16:06 < mete> currently I'm using "another" vpn software ;)
16:06 < mete> openvpn I'm testing currently
16:06 < mete> heh
16:07 < mete> reiffert: I've added the line "topology subnet" on the server side, now my client becomes 172.16.99.2
16:08 < zahary> can someone help me understand this suggestion:
16:08 < zahary> http://www.fedoraforum.org/forum/showthread.php?t=185008
16:09 -!- p3rror [~mezgani@41.140.178.167] has quit [Ping timeout: 240 seconds]
16:09 < zahary> I'm having the same problem, and I indeed had to generate by hand index.txt and serial at some later point in the setup as it was suggested here:
16:09 < zahary> http://oldwiki.openwrt.org/OpenVPNTunHowTo.html
16:09 <@vpnHelper> Title: OpenVPNTunHowTo (at oldwiki.openwrt.org)
16:11 < ecrist> zahary: so you don't have a valid SSL server certificate?  that's an easy fix.
16:11 < mete> yeah, I'm going to bed... It's 11 o'clock here... so good night guys and thanks for the help ;) will google tommorow ;)
16:11 < ecrist> it would be nice to see your logs.
16:12 < zahary> well, now I think I have all everything in place ca.crt, ca.ket server.crt and key and shared.key generated by openvpn --genkey --secret
16:12 < zahary> I'm getting this at startup:
16:13 < zahary> # /usr/local/sbin/openvpn --config /usr/local/etc/openvpn/server.conf 
16:13 < zahary> Wed Jan 26 00:10:59 2011 OpenVPN 2.1.3 i386-apple-darwin10.5.0 [SSL] [LZO2] built on Jan 25 2011
16:13 < zahary> Wed Jan 26 00:10:59 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
16:13 < zahary> Wed Jan 26 00:10:59 2011 Diffie-Hellman initialized with 1024 bit key
16:13 < zahary> Wed Jan 26 00:10:59 2011 Cannot load private key file shared.key: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
16:13 < zahary> Wed Jan 26 00:10:59 2011 Error: private key password verification failed
16:13 < zahary> Wed Jan 26 00:10:59 2011 Exiting
16:13 -!- zahary was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
16:16 -!- zahary [~Adium@83.148.96.87] has joined #openvpn
16:17 < zahary> sorry for pasting the log here, I'll know better next time
16:17 < zahary> so maybe some mismatch in my OpenVPN/OpenSSL versions? have the format of this key file changed somehow?
16:17 < ecrist> nope
16:18 < ecrist> 16:13 < zahary> Wed Jan 26 00:10:59 2011 Error: private key password verification failed
16:18 < ecrist> you entered the wrong password when prompted.
16:18 < zahary> well, the first time I tried it it set password on the key and tried to enter it correctly multiple times
16:19 < zahary> now on the second attempt I made it password free
16:19 < ecrist> well, your log indicates you're using the wrong password
16:19 < zahary> * I set * in the first message
16:19 < zahary> now it doesn't even prompt me
16:20 < ecrist> ok, so show me a current log
16:20 < ecrist> use a pastebin.com or something though
16:24 < zahary> http://pastebin.com/6SRZTxCZ
16:24 < zahary> this is the whole process from the start, I only edited some stuff like company names, etc
16:25 < zahary> my config featured 2 wrong file names before I arrived at this error
16:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
16:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:32 < zahary> can you tell me what your static/shared key looks like? it's interesting that if I change the keyfile to some of the RSA keys (ca.key, server.key) the error message is different
16:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
16:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
16:38 < ecrist> you're using static keys, those are just text strings
16:38 < ecrist> I'd suggest reading the man page
16:39 < ecrist> no idea what you're trying to do on line 147
16:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:46 -!- filipp [~filipp@cs181000061.pp.htv.fi] has joined #openvpn
16:56 -!- sia is now known as sia^pwnnt
16:57 -!- p3rror [~mezgani@41.140.101.101] has joined #openvpn
16:59 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
16:59 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
16:59 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
17:13 -!- opt [~a@174.3.227.184] has joined #openvpn
17:13 < opt> hi
17:14 < opt> i've managed to successfully create a tap connection, but when i try to access network resources from that intranet, i can't see any of them
17:14 -!- p3rror [~mezgani@41.140.101.101] has quit [Ping timeout: 265 seconds]
17:15 < opt> not only does name resolution not work, but if i try to ping or ssh to specific ip addresses, the network stack acts as if it doesn't know how to access those
17:15 < opt> i can see during initialization that openvpn is receiving adequate ROUTE and DNS commands, but it seems that these aren't affecting the machine
17:15 < opt> i'm running openvpn as root
17:16 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
17:17 < opt> the last lines of initialization are /sbin/ip route add lines
17:17 < opt> via the ip address set up on the tap0 iface
17:18 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
17:18 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
17:18 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
17:19 < filipp> Hi all. I'm trying to set up a bridged VPN connection between two sites. For some reason only broadcast traffic (eg. DHCP, Bonjour) seems to get through. Can't access any of the remote machines. This is pfSense 1.2.3 running OpenVPN 2.0.6. Any hints/ideas highly appreciated. :-)
17:24 -!- zahary [~Adium@83.148.96.87] has left #openvpn []
17:24 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
17:24 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
17:24 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:25 -!- ricky [~ricky@fedora/ricky] has joined #openvpn
17:29 < opt> never mind, it works!
17:29 < filipp> :)
17:31 < reiffert> krzee: still on the runway?
17:36 < krzee> nope i have arrived
17:39 < krzee> wasnt a long flight
17:41 -!- sia^pwnnt is now known as sia
17:47 -!- s7r [~s7r@178.73.198.12] has joined #openvpn
17:55 < filipp> should the tap0 interfaces have somekind of IP addresses in a "bridged" VPN connection?
17:56 < krzee> nope, the bridge interface should
17:56 < filipp> a, ic
17:56 < filipp> thank you
17:56 < krzee> np
17:58 < filipp> neither of mine do, maybe that's what causing this problem...
17:59 < krzee> first, stop there
17:59 < krzee> why are you bridging?
17:59 < filipp> :)
17:59 -!- s7r [~s7r@178.73.198.12] has quit [Remote host closed the connection]
17:59 < filipp> I need to share DHCP between two sites :(
17:59 < krzee> why?
17:59 < filipp> we're trying to netboot machines over inet
17:59 < krzee> ahhh ok\
18:00 < krzee> you must have a serious pipe
18:00 < filipp> actually...
18:00 < filipp> the data is very small
18:00 < filipp> just a few megs, some diagnostic software that runs on EFI
18:00 < krzee> ahh osx netboot
18:00 < filipp> yup
18:01 < krzee> One of the big concerns most people have is that using NetBoot will take up a large amount of bandwidth. This is a definite concern, and no one should attempt using NetBoot without having 100Base-T or faster connections to the workstations that will be booted from a server. That said, NetBoot isn't as bandwidth-intensive as you might think. The only time NetBoot will create bandwidth problems is if multiple computers are booting from the ser
18:01 < krzee> ver simultaneously.
18:02 < filipp> true. But this is a bit different, I'm not booting OS X
18:02 < filipp> just some EFI code, but it needs to have the machine on the same broadcast domain as the netboot server, otherwise the diagnostics won't work
18:03 -!- opt [~a@174.3.227.184] has quit [Ping timeout: 276 seconds]
18:03 < krzee> what OS is your server?
18:03 < krzee> im gunna take a 100% random guess and say freebsd
18:04 < filipp> 10.6.5 server. But OpenVPN is on pfSense
18:04 < krzee> openvpn server process is on pfsense?
18:04 < filipp> yes
18:04 < filipp> as well as dhcp
18:05 < krzee> gotchya
18:05 < krzee> might wanna try to catch ecrist
18:06 < krzee> hes much better with bridges than me
18:06 < filipp> cool, thanks
18:06 < krzee> my helping with bridges is normally just explaining to people why they dont want one
18:06 < filipp> :D
18:06 < krzee> but you in fact DO want one
18:06 < krzee> hehe
18:07 < filipp> yeah, we've been running tun just fine for a year now. I even managed to boot the machine with that, just had to use bless to manually tell it where to boot... but then the diagnostic software just wouldn't run.
18:08 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
18:10 < filipp> I work for an AASP in Finland, Apple's made a pretty cool platform called AST, runs entirely on EFI, memory tests, components, HDD, sensors, etc... we'd like to provide it to our customers (resellers). I happened to have some PC Engines boards around so I figured, instead of setting up a mac mini server for each customer, I tried to give them the VPN box instead :)
18:10 < filipp> sounded cool on paper... and still seems like it's not totally out of the question :)
18:11 < filipp> oh, and it's the prettiest EFI application I've ever seen too. LOL ;-)
18:13 < krzee> that is super cool!
18:13 < filipp> :)
18:13 < krzee> im very interested to hear how that works for you after you get your bridge up
18:13 < filipp> cool, I'll let you know, for sure
18:14 < filipp> if nothing else, then I'll probably brag about it on my blog :-D
18:14 < filipp> http://unflyingobject.com/blog/
18:14 <@vpnHelper> Title: unflyingobject.com | for the thrill of understanding (at unflyingobject.com)
18:14 -!- p3rror [~mezgani@41.140.102.179] has joined #openvpn
18:15 < krzee> oh and my guess was right
18:15 < filipp> :D
18:15 < filipp> yup
18:15 < krzee> [16:03]  <krzee> im gunna take a 100% random guess and say freebsd
18:15 < krzee> =]
18:15 < filipp> exactly
18:15 < filipp> :D
18:15 < filipp> LOL
18:16 < filipp> unfortunately AST doesn't run on FreeBSD
18:16 -!- filipp [~filipp@cs181000061.pp.htv.fi] has quit [Remote host closed the connection]
18:17 -!- filipp [~filipp@cs181000061.pp.htv.fi] has joined #openvpn
18:18 -!- opt [~a@174.3.227.184] has joined #openvpn
18:31 -!- opt [~a@174.3.227.184] has left #openvpn ["Leaving"]
18:43 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
18:46 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Operation timed out]
18:55 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
18:59 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
19:08 -!- Meliorator [~m@dunnington.eu] has quit [Ping timeout: 276 seconds]
19:19 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
19:20 -!- ksk [ksk@im.knubz.de] has quit [Read error: Operation timed out]
19:25 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
19:25 -!- filipp [~filipp@cs181000061.pp.htv.fi] has quit [Quit: Computer has gone to sleep]
19:30 -!- ksk [ksk@im.knubz.de] has joined #openvpn
19:41 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
20:04 -!- dredd [5d2334dd@gateway/web/freenode/ip.93.35.52.221] has joined #openvpn
20:04 < dredd> hello
20:04 < dredd> i'm trying to route internet traffic i get Route addition via IPAPI succeeded  test routes succeded..
20:04 < dredd> but i cannot browse anything......
20:05 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
20:05 < dredd> i have router 192.168.1.1 then openvpn on 192.168.1.2
20:05 < Bushmills> !redirect
20:05 -!- p3rror [~mezgani@41.140.102.179] has quit [Ping timeout: 240 seconds]
20:05 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
20:05 < dredd> i used redirect
20:06 < Bushmills> and what else?
20:06 < dredd> i just can't solve any address i guess
20:06 < dredd> i tryed default def1  , local def1
20:06 < dredd> and nothing..
20:07 < Bushmills> use a public name server, like 8.8.8.8
20:10 -!- p3rror [~mezgani@41.140.24.240] has joined #openvpn
20:11 -!- dredd [5d2334dd@gateway/web/freenode/ip.93.35.52.221] has quit [Ping timeout: 265 seconds]
20:12 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:12 -!- dredd [83af0c56@gateway/web/freenode/ip.131.175.12.86] has joined #openvpn
20:12 < dredd> sorry
20:12 < dredd> connection problems
20:12 -!- master_of_master [~master_of@p57B578A5.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:14 < dredd> i was saying i have router 192.168.1.1 openvpn on 192.168.1.2 connected to 192.168.1.1 through wireless , i'm using the "standard" server config file with no bridge and ip 10.8.0.1 for the server 10.8.0.2 for the client 
20:15 < dredd> connection is green and i used both push "redirect-gateway def1" and "local def1"
20:16 < dredd> i also added push dhcp option to 10.8.0.1 ...
20:16 < Bushmills> (03:05:58) dredd: i used redirect
20:16 < Bushmills> (03:06:17) Bushmills: and what else?
20:17 < Bushmills> nat on server?  ip forwarding?
20:17 < dredd> my router is from my provider i can only set port mapping and virtual server
20:17 < dredd> port is open..
20:18 < Bushmills> if you can't enable nat and ip forwarding on server, you can't use it as gateway to internet
20:18 < Bushmills> you may be able to run a web proxy, and use it with your web browser
20:19 < dredd> i need that
20:20 < dredd> cause i'm going to china
20:20 < dredd> i'm looking if i can enable ip forwarding someway
20:20 < Bushmills> run your openvpn server on a machine which you have control over
20:21 < Bushmills> that "somehow" is then merely a matter of ...
20:21 < Bushmills> !redirect
20:21 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
20:21 -!- p3rror [~mezgani@41.140.24.240] has quit [Ping timeout: 240 seconds]
20:22 < dredd> ip forwarding and port forwarding are different?
20:22 < Bushmills> note the mention of  "as well as"
20:22 < Bushmills> yes
20:23 < dredd> maybe in the router configuration is called virtual server
20:24 < dredd> that's the dfference
20:24 < dredd> i forward all the packets going to openvpn port to 192.168.1.2
20:25 < dredd> is that what you  mean?
20:25 < Bushmills> no
20:26 < dredd> !ipforward
20:26 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
20:26 < dredd> !winipforward
20:26 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
20:27 < dredd> uhm? a reg file=
20:28 < dredd> wha you think bushmills can i solve this?
20:29 < Bushmills> many people use such a setup. whether you can, is a question i am not able to answer
20:30 < dredd> ok maybe i'll just give up
20:30 < Bushmills> but there's not much "solving" involved if the instructions are clearly laid out
20:30 < dredd> yes maybe it's the ipforwarding
20:30 -!- cj [~cjac@adsl-207-32-175-232.rockisland.net] has quit [Ping timeout: 255 seconds]
20:31 < dredd> because the route is successfully added..
20:31 < ljvb> giving up is never the answer
20:32 < dredd> what is the answer then?
20:32 < ljvb> dunno, I just re-attached to my session and have not scrolled up
20:32 -!- cj [~cjac@adsl-207-32-175-232.rockisland.net] has joined #openvpn
20:32 < ljvb> I just saw the last few lines.. and the result is me stating that giving up is not the answer :P
20:32 < ljvb> I know.. not really much help
20:33 < dredd> :O
20:34 -!- p3rror [~mezgani@41.140.42.24] has joined #openvpn
20:36 < Bushmills> maybe you're better of using a service which does exactly this redirecting to internet for you, if following those instructions to set up ip forwarding intimidate you
20:36 < Bushmills> better off
20:37 -!- dredd [83af0c56@gateway/web/freenode/ip.131.175.12.86] has quit [Ping timeout: 265 seconds]
20:40 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:43 -!- sia is now known as sia^pwnnt
20:52 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
21:03 -!- master_of_master [~master_of@p57B54E59.dip.t-dialin.net] has joined #openvpn
21:40 < derekv> ahhm so dumb.  i made a client cert I'm using to test the new server, and i set a password on it, and I forgot the password.
21:40 < derekv> an astute observer might ask, "Why is he telling me this?".  A: see point 1
21:44 < derekv> (it would also help me to connect to the test server if I started it)
21:45 -!- WinstonSmith [~true@e179020210.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
21:46 -!- WinstonSmith [~true@e179020210.adsl.alicedsl.de] has joined #openvpn
21:46 < derekv> Ah yes that does help quite a bit.
21:52 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
21:57 < ecrist> hola
22:00 -!- teddz_ [~teddz@dtmd-4db22f9c.pool.mediaWays.net] has joined #openvpn
22:00 < derekv> hey ecrist , i'm redoing my server finally using ssl-admin this time to help
22:00 < ljvb> I use that
22:01 < ecrist> nice, I hear it's a decent software. ;)
22:01 < ljvb> makes life so much more easy
22:01 < derekv> here's something awkward (not ssl-admin related I don't think), i generated a ta.key as per instructions, copied it to my client, added the lines tls-auth ta.key 1 to the client config and the same to the server (with a 0)
22:01 < derekv> it connects
22:02 < derekv> however I opened the ta.key on the client and flipped around some of the octals, and it then it still connects.
22:03 < ljvb> hmm. I do not use tls at the moment
22:03 -!- teddz [~teddz@dtmd-4db2bbd5.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:04 < ljvb> bed time
22:04 < derekv> brb 
22:09 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
22:09 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
22:09 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:52 < derekv> I guess the other question is do I want tls-auth
22:52 < derekv> I was just doing it because it's listed in the hardening section
22:53 < derekv> ah, it seems to work as expected without the direction parameter
23:01 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:07 -!- alhadi [~thunderst@ner-as22720.alshamil.net.ae] has quit [Ping timeout: 240 seconds]
23:15 -!- alhadi [~thunderst@92.99.142.66] has joined #openvpn
23:21 -!- WinstonSmith [~true@e179020210.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
23:22 -!- WinstonSmith [~true@e179020210.adsl.alicedsl.de] has joined #openvpn
23:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
23:52 -!- p3rror [~mezgani@41.140.42.24] has quit [Ping timeout: 260 seconds]
--- Day changed Wed Jan 26 2011
00:04 -!- hardluck1024 [~hardluck@204.16.202.131] has joined #openvpn
00:05 < hardluck1024> yo, how do i configure a server to not redirect all internet traffic over the vpn
00:05 < hardluck1024> ive been trying different stuff for hours
00:07 < hardluck1024> i thought by default it wouldnt redirect
00:09 -!- teddz_ [~teddz@dtmd-4db22f9c.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
00:10 -!- hardluck1024 [~hardluck@204.16.202.131] has quit [Remote host closed the connection]
00:10 -!- hardluck1024 [~hardluck@85.131.129.175] has joined #openvpn
00:12 -!- WinstonSmith [~true@e179020210.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
00:15 -!- filipp [~filipp@cs181000061.pp.htv.fi] has joined #openvpn
00:20 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 240 seconds]
00:22 -!- hardluck1024 [~hardluck@85.131.129.175] has quit []
00:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Operation timed out]
00:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
00:38 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 260 seconds]
00:39 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
00:41 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
00:42 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
00:42 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
00:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
00:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Client Quit]
00:54 -!- WinstonSmith [~true@g231241115.adsl.alicedsl.de] has joined #openvpn
01:13 -!- WinstonSmith [~true@g231241115.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
01:35 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:36 <@vpnHelper> RSS Update - forum: VMware View 4.5 using OpenVPN <http://forums.openvpn.net/topic7558.html#p9403>
02:02 -!- ucekpolish1 [user@hq.ostc-pl.com] has quit [Quit: Leaving.]
02:09 -!- Splex [~splex@unaffiliated/splex] has quit [Ping timeout: 240 seconds]
02:12 <@vpnHelper> RSS Update - forum: VMware View 4.5 using OpenVPN <http://forums.openvpn.net/topic7558.html#p9404>
02:14 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Connection reset by peer]
02:14 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
02:15 -!- zuma [c16dfe13@gateway/web/freenode/ip.193.109.254.19] has joined #openvpn
02:17 < zuma> if i have openvpn running on a wrt router, can i establish vpn connections to it straight from within Windows (using the wizard), or would i need a openvpn client for that? 
02:17 < filipp> zuma: I think you need the client, Windows does not have builtin OpenVPN support, afaik
02:20 < zuma> i see
02:20 < zuma> :'(
02:20 < zuma> thanks for the reply!
02:21 < Bushmills> zuma: if you have openvpn client running on router, with an openvpn server remotely,you don't need a client on windows
02:22 < Bushmills> instead, you can use the router for its divine purpose, namely routing traffic, also through the vpn 
02:24 < zuma> Bushmills: i was hoping of having it the other way around, the router acting as the vpn termination point.
02:24 < Bushmills> remote client with server on router would work the same way
02:26 < zuma> I shall be trying that this evening! :D
02:29 -!- p3rror [~mezgani@41.140.47.248] has joined #openvpn
02:31 -!- scrapheap [~scrapheap@p54A09346.dip0.t-ipconnect.de] has joined #openvpn
02:31 < scrapheap> !welcome
02:31 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
02:34 -!- scrapheap [~scrapheap@p54A09346.dip0.t-ipconnect.de] has left #openvpn []
02:35 -!- WinstonSmith [~true@e179009221.adsl.alicedsl.de] has joined #openvpn
02:40 -!- aditsu [~aditsu@n1164943155.netvigator.com] has joined #openvpn
02:40 -!- ruunsi [d47458e2@gateway/web/freenode/ip.212.116.88.226] has joined #openvpn
02:41 < ruunsi> Hey, I have a problem with my openvpn server @ my pfsense router. When i am connected i can ping/connect to my local machines but i can't surf the net using my openvpn connection. Tried to set push "default-gateway". My client uses Ubuntu 10.4
02:41 < aditsu> hi, how can I run 2 openvpn servers that use the same subnet for clients?
02:42 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 240 seconds]
02:42 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
02:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:45 -!- p3rror [~mezgani@41.140.47.248] has quit [Ping timeout: 272 seconds]
02:48 < Bushmills> run them at different sites, on seperate LANs
02:52 -!- ruunsi [d47458e2@gateway/web/freenode/ip.212.116.88.226] has quit [Quit: Page closed]
02:54 < aditsu> Bushmills: was that for me? I actually want to run the servers on the same computer
02:55 < rjd_> aditsu: I suppose you can, and having them share the ip pool file.. Try it out :)
02:55 < rjd_> Even though it probably makes more sense to have each daemon use its own subnet
02:57 -!- p3rror [~mezgani@41.140.159.68] has joined #openvpn
03:05 -!- p3rror [~mezgani@41.140.159.68] has quit [Ping timeout: 240 seconds]
03:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:11 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:17 < aditsu> rjd_: I actually tried, but it had ip / route conflicts
03:17 < aditsu> brb
03:20 < rjd_> ah yeah
03:25 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
03:25 -!- WinstonSmith [~true@e179009221.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
03:29 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
03:38 < filipp> hi krzee!
03:39 -!- p3rror [~mezgani@41.140.169.30] has joined #openvpn
03:39 -!- loa [~loa@46.147.4.60] has joined #openvpn
03:40 < loa> hello. how i can set default folder for my keys?
03:57 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:57 < krzee> hey filipp 
03:57 < krzee> loa, by using cd in the config
03:57 < krzee> note, that will set the path for EVERYTHING after it, not just the kets
03:58 < krzee> keys*
03:58 < loa> krzee, and where log file will be?
03:58 < loa> i can use cd few times?
04:02 < filipp> krzee: I got the openvpn bridge/netboot thingamagig to work! :) it was actually really simple. Create the bridges on both ends and give the LAN port on the client an IP within the remote subnet.
04:02 < krzee> !logfile
04:02 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
04:02 -!- p3rror [~mezgani@41.140.169.30] has quit [Ping timeout: 265 seconds]
04:03 < krzee> loa, just use full paths
04:03 < krzee> !path
04:03 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
04:03 < filipp> can now just boot a Mac with the n-key and it runs the diagnostic :)
04:03 < filipp> pretty sweet
04:03 < krzee> hey thats cool!
04:03 < filipp> :)
04:03 < krzee> have you tested doing a few of those at once over the vpn?
04:04 < filipp> good idea
04:04 < krzee> (to see if bandwidth may bite you)
04:04 < filipp> yeah, I'll run some tests today
04:05 < filipp> openvpn is cool
04:08 < krzee> i agree
04:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:15 -!- p3rror [~mezgani@41.140.46.66] has joined #openvpn
04:27 -!- p3rror [~mezgani@41.140.46.66] has quit [Ping timeout: 240 seconds]
04:51 -!- common- [~common@p5DDA47D4.dip0.t-ipconnect.de] has joined #openvpn
04:53 -!- common [~common@p5DDA48A3.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
04:53 -!- common- is now known as common
04:55 -!- p3rror [~mezgani@41.140.98.205] has joined #openvpn
05:01 -!- DND2 [~arabia@94.200.7.26] has joined #openvpn
05:01 < DND2> hi guys, can i seek help here regarding openvpn gui?
05:01 < DND2> whenever i get connected to openvpn, byt browsing capabilities are gone
05:02 < DND2> im using windows 7
05:04 < Bushmills> don't --redirect-gateway,  or set up vpn server to do !nat and !ipforward
05:08 -!- filipp [~filipp@cs181000061.pp.htv.fi] has quit [Quit: Computer has gone to sleep]
05:09 -!- p3rror [~mezgani@41.140.98.205] has quit [Ping timeout: 240 seconds]
05:22 -!- p3rror [~mezgani@41.140.157.8] has joined #openvpn
05:22 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
05:29 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
05:33 <@vpnHelper> RSS Update - forum: Create subnet on the fly <http://forums.openvpn.net/topic7559.html>
05:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:36 -!- p3rror [~mezgani@41.140.157.8] has quit [Ping timeout: 240 seconds]
05:37 -!- teddz_ [~teddz@dtmd-4db22f9c.pool.mediaWays.net] has joined #openvpn
05:48 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 272 seconds]
05:49 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
05:50 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
05:55 -!- DND2 [~arabia@94.200.7.26] has left #openvpn []
05:58 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
05:58 -!- mode/#openvpn [+o mattock] by ChanServ
06:03 <@vpnHelper> RSS Update - forum: Create subnet on the fly <http://forums.openvpn.net/topic7559.html#p9406>
06:07 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
06:08 -!- filipp [~filipp@cs181000061.pp.htv.fi] has joined #openvpn
06:09 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
06:15 <@vpnHelper> RSS Update - forum: Create subnet on the fly <http://forums.openvpn.net/topic7559.html#p9407>
06:15 -!- Oxwivi [~chatzilla@2.49.198.177] has joined #openvpn
06:16 < Oxwivi> Hello.
06:17 < Oxwivi> Anyone available to help a noob in need?
06:18 < Oxwivi> I just copied an .ovpn file into the config directory, but to connect to it, I need to input username and password, where do I do that?
06:18 < Oxwivi> On Windows, with GUI.
06:19 < Oxwivi> Hello?
06:19 < Oxwivi> Please respond, anyone!
06:22 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
06:27 -!- TypoNe is now known as Typone
06:33 -!- Oxwivi_ [~chatzilla@173.0.4.103] has joined #openvpn
06:35 -!- Oxwivi [~chatzilla@2.49.198.177] has quit [Ping timeout: 240 seconds]
06:38 -!- Oxwivi_ [~chatzilla@173.0.4.103] has quit [Ping timeout: 240 seconds]
06:38 -!- albech_ [~thomas@124.157.245.126] has joined #openvpn
06:40 -!- p3rror [~mezgani@41.140.30.220] has joined #openvpn
06:45 <@vpnHelper> RSS Update - forum: Create subnet on the fly <http://forums.openvpn.net/topic7559.html#p9408>
06:45 -!- p3rror [~mezgani@41.140.30.220] has quit [Ping timeout: 240 seconds]
06:45 -!- filipp [~filipp@cs181000061.pp.htv.fi] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
06:59 -!- p3rror [~mezgani@41.140.179.62] has joined #openvpn
07:01 -!- Oxwivi [~chatzilla@2.49.198.177] has joined #openvpn
07:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:02 < Oxwivi> Greetings, fellow OVPN users.
07:02 < Oxwivi> I join you today to request assistance in the usage of OVPN.
07:03 < Oxwivi> If any comrade is willing to help this pitiful self out of his ignorance, I request you to say my name.
07:04 < krzee> "I need to input username and password"
07:04 < krzee> what makes you think you need to...?
07:06 < Oxwivi> The VPN service requires me to do so.
07:06 < Oxwivi> The service that I'm trying to connect to that is.
07:06 < ecrist> Oxwivi: openvpn gui, or the cli application will ask you for those details
07:06 < krzee> then you need support from them
07:06 < Oxwivi> But it doesn't/
07:06 < krzee> and you need to get support from them :-p
07:07 < Oxwivi> Well, have you heard of proXPN?
07:07 < krzee> no
07:07 < Oxwivi> Their service is based on OVPN, but they don't support the official client.
07:07 < krzee> nor would it make a difference if i had, unless i had root access to their machines
07:07 < krzee> and we dont support their service
07:08 < Oxwivi> I know, I know...
07:08 < ecrist> oh, well, we only support the openvpn client here
07:08 < Oxwivi> Tell me about .cfg files and how it's used in OVPN, please.
07:08 < krzee> and if they dont support the official client, it sounds like you found the problem
07:08 < Oxwivi> Yeah, I'm trying to get to use proXPN using officiall OVPN client not hteirs.
07:09 < krzee> and thats where you are going wrong
07:09 < krzee> !compat
07:09 < Oxwivi> Their client is supported but not available in *nix, which I will attempt to use later.
07:09 < krzee> !notcompat
07:09 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
07:09 < krzee> see #2
07:09 < Oxwivi> They use OVPN, it's a fact.
07:09 < krzee> no, they use something BASED on openvpn according to you above
07:09 < krzee> [05:07]  <Oxwivi> Their service is based on OVPN, but they don't support the official client.
07:10 < Oxwivi> Well, OVPN can be used to connect to their service, but the instructions I found were not in English.
07:10 < Oxwivi> So I'm trying to solve it on my own.
07:11 < krzee> lol
07:11 < krzee> they use pptp
07:11 < ecrist> Oxwivi: it still sounds like you need to contact their support.  it's difficult for us to help you when we don't know all the right information
07:11 < ecrist> a PPTP service would pose a problem for openvpn...
07:11 < krzee> why do you think they use openvpn...?
07:11 < Oxwivi> The installed directory of OVPN and proXPN client has the same directory structure. So I figured the pretty much work the same way.
07:11 < krzee> http://proxpn.com/iphone.php
07:11 <@vpnHelper> Title: proXPN - Create a FREE VPN Account - Secure your internet connection instantly. (at proxpn.com)
07:12 < krzee> oh maybe not only pptp tho
07:12 < krzee> "Please note that PPTP VPN for iPhone is available with proXPN Premium accounts only."
07:12 < Oxwivi> Yep, PPTP is available for the paid users only.
07:12 < krzee> Oxwivi, did they include the openvpn source code?
07:13 < Oxwivi> Source code of what exactly?
07:13 < krzee> openvpn!
07:13 < Oxwivi> The client or .ovpn?
07:13 < krzee> SOURCE CODE
07:13 < Oxwivi> Their client is proprietary.
07:14 < krzee> then if its based on openvpn they are breaking the license that openvpn was released under
07:14 < krzee> breaking the law breaking the law
07:14 < Oxwivi> Let's contact OVPN lawyers?
07:14 < Oxwivi> :D
07:15 < krzee> Q: Can I use an OpenVPN client instead of yours?
07:15 < krzee> A: While it is theoretically possible, we strongly recommend against this (you'll get much better performance with our client) and offer no support for it. But you're welcome to try it if you like. You'll just need to create an account first.
07:15 < krzee> actually ya, i think i will point ovpn corporate to it
07:15 < Oxwivi> As I've been trying to convince you...
07:16 < Oxwivi> Anyway, if you're willing to look more into helping me, have a look at this: http://windowssignature.blogspot.com/2011/01/proxpn-config-in-openvpn-tutorial.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+AllWindowsUsefulInformationtipsTricksEtc+%28All+Windows+Useful+Information+%28tips%2C+tricks%2C+etc%29%29
07:16 <@vpnHelper> Title: All Windows Useful Information (tips, tricks, etc): proXPN config in OpenVPN - Tutorial (complete, working sa lahat ng networks!) (at windowssignature.blogspot.com)
07:16 < krzee> nope, i wont be supporting their product for the
07:16 < krzee> them
07:17 < Oxwivi> Uh?
07:17 < ecrist> wow, looking at the package contents for their application, the even have a 'client.up.tunnelblick.sh' script
07:17 < krzee> we support openvpn here, not your pay service
07:17 < ecrist> though, there's nothing wrong with using openvpn in your own project...
07:17 < Oxwivi> Yeah, but I ain't paying.
07:17 < ecrist> you do have to provide source code, though.
07:18 < krzee> ecrist, correct, as long as you distribute the ovpn source
07:18 < ecrist> Oxwivi: allow me to rephrase what krzee just said.  we don't support commercial vpn services.  that's their job.
07:18 < krzee> err ya what you said ;]
07:18 < ecrist> whether you pay or not.
07:18 < Oxwivi> Stingy! :o
07:19 < Oxwivi> It's not like they're gonna benifit anyway. :(
07:19 < krzee> but thanx for pointing out a company that seems to be failing to do the 1 small thing the GPL requires of them
07:19 < ecrist> Oxwivi: I'm sorry, but we have to draw a line somewhere.
07:19 < Oxwivi> I suppose, I suppose...
07:19 < Oxwivi> Well too bad.
07:19 < ecrist> their package even includes the openvpn binary
07:20 < Oxwivi> Indeed.
07:20 < ecrist> Oxwivi: I can offer you a bit of insight, though.
07:20 < Oxwivi> Yes?
07:20 < ecrist> their mac os application includes all the openvpn configs you'd need
07:20 < krzee> ecrist, am i the only one baffling that you need to spend more to get a pptp vpn?
07:21 < krzee> (with their service)
07:21 < Oxwivi> Hmm... well, I don't know how to play around with Mac binaries.
07:21 < ecrist> openvpn will indeed ask for username and password.  in addition, you have the ability to compile with password save feature, and simply save the username and password in a text file so you're not prompted.
07:21 < krzee> or do you think they decided "ok, we'll do it since you asked, but you must pay for stupidity"
07:21 < ecrist> krzee: perhaps, but it's a commercial endeavor and they've found a way to make a buck.
07:22 < ecrist> to be honest, I won't fault them for that, I do not like them not distributing the source, or making mention anywhere of HOW to get the source
07:22 < ecrist> that being said, I despise the GPL in general, so my bunched panties aren't really all *that* bunched up. ;)
07:22 < Oxwivi> It didn't ask for authentication, and when I introduced a .cfg file with username and password it says something like it won't authenticat from that file.
07:23 < krzee> i agree re: gpl ecrist, i assume you are more of a bsd license fan like myself
07:23 < ecrist> yup
07:24 < ecrist> this proxpn app is a modified version of tunnelblick.
07:24 < ecrist> at least the mac version
07:24 < ecrist> at least they say so in the version output
07:24 < ecrist> 2011-01-26 07:23:10 *proXPN: OS X 10.6.6; 2.2.6 based on Tunnelblick 3.1beta09 (1947); OpenVPN 2.1.4
07:25 < krzee> hahah
07:25 -!- p3rror [~mezgani@41.140.179.62] has quit [Ping timeout: 255 seconds]
07:26 < ecrist> aside from their gpl violation, their service does look pretty reasonable
07:27 < Oxwivi> Very so, good speed and no problems faced so far.
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000 Current Parameter Settings:
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000   config = 'ProXPN.ovpn'
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000   mode = 0
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000   show_ciphers = DISABLED
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000   show_digests = DISABLED
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000 NOTE: --mute triggered...
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000 226 variation(s) on previous 5 message(s) suppressed by --mute
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000 OpenVPN 2.1.3 i686-pc-mingw32 [SSL] [LZO2] built on Nov  7 2010
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000 Sorry, 'Auth' password cannot be read from a file
07:28 < Oxwivi> Wed Jan 26 17:27:42 2011 us=715000 Exiting
07:28 < Oxwivi> Is what I get when I try to connect.
07:28 < krzee> whoaaaa
07:28 < krzee> pastebin dude
07:28 < krzee> (like any other help channel on IRC)
07:29 < Oxwivi> Uh, forgot about that sorry
07:29 < ecrist> I'm surprised vpnHelper didn't kick you.
07:29 < ecrist> !kick Oxmivi for good measure.
07:29 <@vpnHelper> Error: You don't have the #openvpn,op capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
07:29 < loa> how i can set bind address?
07:30 < ecrist> damn
07:30 < ecrist> Oxwivi: show  your configs, please
07:30 < loa> for example i want bind openvpn on specific address.
07:30 < krzee> loa, see --local in the manual
07:30 < Oxwivi> Just a sec.
07:30 < krzee> !man
07:30 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
07:31 -!- renihs_ is now known as renihs
07:31 < loa> krzee, can this be done from config?
07:31 < krzee> !--
07:32 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
07:32 < krzee> (as copy/pasted into my bot from the manual)
07:32 < Oxwivi> http://pastebin.com/nXfU5UT2
07:32 < loa> cool
07:33 < ecrist> Oxwivi: you need a copy of openvpn that's compiled with password-save, or you need to remove line 19 from your config
07:34 < Oxwivi> Removing line 19 seems to be the easiest choice.
07:34 < Oxwivi> Ii would need password-save if I want auto-right?
07:34 < Oxwivi> *I would
07:34 < Oxwivi> *auto-connect, right?
07:34 < krzee> correct
07:35 < Oxwivi> Yay, learned something new, learned something new...
07:39 < Oxwivi> After that attempted to connect again, not asking me to authenticate and looks like it's in some sort of loop.
07:41 < Oxwivi> http://pastebin.com/4bjfhcGy
07:44 < Oxwivi> Looks like ye lot has lost interest, eh?
07:44 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
07:44 < krzee> is it caught in a "get support from the provider" loop?
07:44 < krzee> looks like it is to me
07:45 < Oxwivi> Dunno, didn't say anything like that, take a look at the last pastebin.
07:45 < krzee> i did
07:46 < Oxwivi> That's all it says when I try to connect.
07:46 < Oxwivi> And loops after the reset line.
07:46 < krzee> it points to the reason i told you that you needed support from them instead of here 40 mins ago
07:46 < krzee> because without having control / access to logs of the server, we cant help!
07:47 < krzee> (well ok, thats the *main* reason)
07:47 < Oxwivi> Gah, sorry dude.
07:48 < krzee> np
07:48 < krzee> and actually thanx, had never heard of them
07:49 < loa> krzee, i have such config http://www.pasteall.org/18617 is he right?
07:49 < loa> strange when i rung openvpn --config /etc/openvpn/openvpn.conf all working.
07:49 < loa> but when service openvpn restart
07:49 < krzee> read this again loa 
07:49 < krzee> !--
07:49 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
07:49 < loa> it sais Cannot open dh1024.pem for DH parameters: error:02001002:system library:
07:50 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
07:50 < krzee> meh
07:50 < krzee> remove -- from in front of local
07:50 < krzee> and, that error means that /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem does not exist
07:51 < loa> krzee, it exists.
07:51 -!- p3rror [~mezgani@41.140.173.91] has joined #openvpn
07:51 < krzee> show me this:
07:51 < krzee> ls -l /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
07:51 < loa> with openvpn --config /etc/openvpn/openvpn.conf everything is perfect
07:51 < loa> chatcity /etc/openvpn # ls -l /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
07:51 < loa> -rw-r--r-- 1 root root 245 Jan 26 16:38 /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
07:51 < krzee> then what isnt working...?
07:52 < loa> krzee, when i use service openvpn restart
07:52 < krzee> thats a script supplied by your OS
07:52 < loa> yes.
07:52 < krzee> i dont even know what it looks like to be honest with you
07:54 -!- Oxwivi_ [~chatzilla@173.0.14.6] has joined #openvpn
07:56 < loa> krzee, how i can figure out what happened.
07:56 -!- Oxwivi [~chatzilla@2.49.198.177] has quit [Ping timeout: 240 seconds]
07:56 < loa> how i can see which options are used?
07:56 -!- Oxwivi_ is now known as Oxwivi
07:56 < loa> i see that script executes all *.conf
07:56 < loa> in /etc/openvpn
07:56 < krzee> loa, do you see anything in your logfile that hints at something...?
07:57 < loa> trying to do more verbose.
07:59 < loa> krzee, look like he does not use cd /etc/openvpn/easy-rsa/2.0/keys
07:59 < loa> looks *
07:59 < krzee> verb 4 should be fine
07:59 < loa> other vars are look
07:59 < loa> i setted 9
08:00 < krzee> oh hell no
08:00 < krzee> lol
08:00 < loa> all options are mine.
08:00 < krzee> does service restart KILL it and start over?
08:00 < hyper_ch> KDE 4.6 is out :)
08:00 -!- Oxwivi_ [~chatzilla@173.0.14.8] has joined #openvpn
08:00 < krzee> if not, remember you dropped priviledges to nobody/users
08:01 < loa> krzee, tried stop start, error again.
08:01 < loa> openvpn --config /etc/openvpn/openvpn.conf this command from root works.
08:01 < loa> in any directory
08:02 -!- Oxwivi [~chatzilla@173.0.14.6] has quit [Ping timeout: 240 seconds]
08:02 < loa> i am going crazy.
08:02 < krzee> then you likely need support from your OS's support channel
08:02 -!- Oxwivi_ is now known as Oxwivi
08:02 < krzee> since openvpn is not to blame
08:02 < krzee> when you run openvpn, it works
08:02 < krzee> when you run openvpn by using your OS's method, it does not
08:02 < krzee> im not saying its off-topic for here, it certainly is not off topic
08:03 < krzee> if you were using freebsd or osx ild be able to help
08:03 < loa> krzee, just looks like cd parameter don't work.
08:03 < krzee> then use full paths
08:03 < krzee> lol
08:03 < krzee> !path
08:03 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
08:03 < loa> krzee, client keys must be in server folder or no?
08:03 -!- Oxwivi_ [~chatzilla@173.0.14.9] has joined #openvpn
08:04 < krzee> [02:02]  <krzee> loa, just use full paths
08:04 < krzee> [02:02]  <krzee> !path
08:04 < krzee> whoa i told you that 4 hours ago!
08:04 < krzee> loa, no
08:04 < krzee> server checks that client cert was signed by the ca that the server.conf has
08:04 < krzee> and likewise the client does the same
08:04 < loa> krzee, with full paths config began look complicated.
08:05 < krzee> paths look complicated/
08:05 < krzee> ?
08:06 -!- Oxwivi [~chatzilla@173.0.14.8] has quit [Ping timeout: 240 seconds]
08:06 -!- Oxwivi_ is now known as Oxwivi
08:07 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Ping timeout: 240 seconds]
08:07 < loa> now all working.
08:08 < loa> krzee, thank you, but repeating same path 5 times is annoing.
08:08 < krzee> np
08:08 < krzee> blame your OS
08:08 < krzee> they likely put some default path for certs in their OS specific startup script
08:09 < krzee> it would start openvpn with something like openvpn --config <config> --cd <path>
08:09 < krzee> or something
08:09 < krzee> at least thats my guess
08:09 < krzee> anyways, full paths are always safe
08:09 -!- Oxwivi_ [~chatzilla@2.49.198.177] has joined #openvpn
08:09 < loa> hmm
08:12 -!- Oxwivi_ [~chatzilla@2.49.198.177] has quit [Client Quit]
08:13 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
08:13 -!- Oxwivi [~chatzilla@173.0.14.9] has quit [Ping timeout: 276 seconds]
08:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:15 < bo_root> i am just setting up server.conf, my servers ip is 172.30.1.123, so in the server section i put: server 172.30.0.0 255.255.255.0 ? is that right
08:15 < bo_root> and then push "route 10.0.0.0 255.255.255.0"
08:15 < rjd_> the servers ip on it's primary network interface?
08:15 -!- p3rror [~mezgani@41.140.173.91] has quit [Read error: Connection reset by peer]
08:16 < rjd_> tun or tap?
08:16 < bo_root> tun
08:16 < krzee> good morning [intra]lanman 
08:16 < bo_root> rjd_: yes that is ip of primary interface
08:17 < [intra]lanman> heya krzee 
08:17 < rjd_> if the servers primary network interface is on 172.30.1.0/24, then you could use 172.30.0.0/24 (as long as it's not already occupied by another network)
08:17 < rjd_> but if its a 172.30.0.0/23 or larger, then you're doing it wrong
08:18 < krzee> [06:15]  <bo_root> and then push "route 10.0.0.0 255.255.255.0"
08:19 < bo_root> i am checking this howto http://www.secure-computing.net/wiki/index.php/FreeBSD_OpenVPN_Server/Routed#Install_OpenVPN
08:19 <@vpnHelper> Title: FreeBSD OpenVPN Server/Routed - Secure Computing Wiki (at www.secure-computing.net)
08:20 < krzee> oh
08:20 < krzee> remove the push line
08:20 < krzee> i will do the same from that page
08:20 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 240 seconds]
08:21 < krzee> lol i should have removed it and just said "hey, that push line isnt in there!"
08:21 < krzee> ;]
08:21 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
08:21 -!- gladiatr_afk is now known as gladiatr
08:23 < bo_root> ok so i will use 172.30.0.0/24 because network is not larger, and also not occupied
08:24 < krzee> there, changed that on the wiki... running it by ecrist
08:26 < bo_root> now i have question about dev tun, i created it, but whats next, what ip to assign..
08:29 -!- SOG [~SOG@222.125.204.83] has joined #openvpn
08:29 < krzee> the server config option handles that
08:33 < bo_root> ok, brb
08:33 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
08:37 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
08:39 -!- akam [~akam@95.78.90.245] has quit [Quit: Óõîæó ÿ îò âàñ]
08:40 -!- zuma [c16dfe13@gateway/web/freenode/ip.193.109.254.19] has left #openvpn []
08:43 -!- grapsus [~grapsus@acces1031.res.insa-lyon.fr] has quit [Disconnected by services]
08:43 -!- grapsus [~grapsus@acces1031.res.insa-lyon.fr] has joined #openvpn
08:45 < bo_root> good, looks like it works
08:55 < krzee> =]
08:58 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Read error: Operation timed out]
08:59 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 272 seconds]
09:02 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
09:03 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
09:08 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
09:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
09:12 < Splex> If i have a server that runs a ovpn service and also connects to another ovpn server, do I need to make 2 separate ssl certs? one client cert and one server cert?
09:13 < krzee> should, yes
09:13 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html>
09:14 < Splex> even if the CA only issues certs for the servers?
09:16 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:17 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:17 -!- Cain` is now known as Cain
09:18 < krzee> huh?
09:20 <@vpnHelper> RSS Update - forum: Does OpenVPN generate MAC Pause (01:80:c2:00:00:01) packets? <http://forums.openvpn.net/topic7557.html#p9410>
09:20 < Splex> krzee: i am thinking of having a CA that issues certs only for my ovpn servers.  the servers would connect to eachother (run a ovpn server and client process)  im wondering if i should issue two separate certs (one for each process) or use one cert for both processes..  does a cert have to be defined as a server/client cert?  or can it be both?
09:21 < krzee> connecting servers to eachother in a mesh or a ring?
09:21 < krzee> or hub/spoke
09:22 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:24 < Splex> krzee: like this: 1->0, 2->1+0, 3->2+1+0, etc
09:25 < Splex> so that a connection exists between all peers
09:25 < krzee> aka "mesh"
09:25 < Splex> ok, wasn't sure if thats what you meant by mesh
09:26 < krzee> i would either do that with an entirely seperate PKI or with ptp tunnels
09:26 < krzee> likely the first option
09:26 < krzee> then i would use dev tap in normal routed mode (not bridged)
09:26 < krzee> and i would run a routing protocol over the top of that
09:26 < krzee> so that i would always choose the best path
09:27 < krzee> such as this guy did
09:27 < krzee> !rip
09:27 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
09:27 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:29 -!- WinstonSmith [~true@e179004223.adsl.alicedsl.de] has joined #openvpn
09:30 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
09:37 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
09:39 < Splex> krzee: thx for the link, question: should one of those configs have 'tls-server' instead of 'tls-client'?
09:40 < krzee> hehe yes, good catch
09:41 < krzee> ouch
09:41 < Splex> and i presume one of them shouldn't have a 'remote' entry
09:41 < krzee> he fubar'ed those configs pretty good
09:41 < Splex> yeah
09:41 < Splex> i get the idea in general though
09:41 < krzee> well both CAN have remote, but dont need to
09:41 < Splex> ahh, if 'server' it would just ignore?
09:41 < krzee> and the IPs should be same but reversed in the ifconfig
09:41 < krzee> well those configs dont have a server or client
09:41 < Splex> the ifconfig is reversed
09:41 < krzee> those are ptp configs
09:42 < krzee> no, one ifconfig he has 172.1.71 other has 172.1.2
09:42 < Splex> ah yes
09:42 < Splex> i somehow missed the '71'
09:43 < Splex> just looked at the last octet
09:52 < krzee> the guy who wrote that realized it could be done with ptp configs
09:53 < krzee> what i didnt know until quite a bit of time later, a dev tap routed config could have done what he needed
09:55 < Splex> oh?
09:56 < krzee> yep
09:56 < krzee> cause then openvpn passes layer2 so no need for an internal routing table
09:56 < gladiatr> Heh.  I didn't know (until someone mentioned it a couple weeks ago) that you could have a routed connection while using the tap interface.
09:57 < ecrist> you can?
09:57 < gladiatr> So it has been said.  I haven't experimented with it yet.
09:59 < krzee> yes
09:59 < krzee> err wait, ecrist you know that
10:09 < Splex> krzee: is there a page with more info on using dev tap in this manner?
10:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:14 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:18 < dvl> OK, I
10:18 < dvl> OK, I'm just sayin': OpenVPN is so frickin' stable.  It just runs and runs.
10:19 < gladiatr> indeed
10:19 < ecrist> dvl: :)
10:19 < gladiatr> until the End arrives or rats poop in your server's power supply :o
10:19 < dvl> About that...
10:20 < dvl> Other tools in that category: stunnel & bacula & nagios.
10:20 < dvl> oh wait... who did I just insult?
10:20 < ecrist> if you have problems with nagios crashing, you're doing something wrong.
10:22 < gladiatr> nagios' only systemic problem tends to be those that use it.
10:22 < ecrist> o.O
10:22  * ecrist uses nagios
10:23  * ecrist actually know Ethan Galstad
10:23 < dvl> I do like Nagios... I started on NetSaint, and moved over....
10:23 < gladiatr> that's not a criticism of nagios--only those that don't have the patience or will to configure it properly.  
10:23 < ecrist> oh, I would argue openvpn has that exact same issue, gladiatr 
10:24 < dvl> I do like Fruity (now called Lilac) as a tool for configuring Nagios.
10:24 < dvl> Yes, OpenVPN has a high barrier to entry.  
10:24 < ecrist> I use vim to configure nagios.
10:24 < gladiatr> My 5th from present project is the complete reconfiguration of the local nagios alert structure.  I refuse to be included on the paging cycle. 
10:24 < ecrist> we use RSS for the majority of our notifications
10:25 < gladiatr> dvl, I would agree but add: it is IP networking that has the high barrier to entry.  Once you've got a grasp of IPv4, OpenVPN is almost a cake-walk.
10:25 < ecrist> and a bot, which I happen to be sprucing up as we speak, to annouce the RSS feeds in some various jabber channels
10:25 < gladiatr> that's elegant
10:25 < dvl> gladiatr: I think more of the CA creation... it's .. challenging.
10:25 < ecrist> dvl: you need to see ssl-admin, then.
10:25 < ecrist> it's pretty brain-dead.
10:26 < ecrist> !ssl-admin
10:26 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
10:26 < gladiatr> dvl, agreed.  OpenSSL is rather... obtuse in both interface and documentation
10:26 < dvl> gladiatr: However, open-rsa helps a great deal, but even that is rather hard to get going.  hence: http://www.freebsddiary.org/openvpn-easy-rsa.php
10:26 <@vpnHelper> Title: The FreeBSD Diary -- Creating your own Certificate Authority (at www.freebsddiary.org)
10:26 < gladiatr> cd /usr/ports/security/ssl-admin && make install
10:27 < Splex> how does ssl-admin compare with easy-rsa?
10:27 < gladiatr> dvl, indeed
10:28 < dvl> gladiatr: Oh, I wouldn't trust that port... look at who maintains it.
10:28  * gladiatr chuckles
10:28 -!- pk__ [pankajyada@gateway/shell/bshellz.net/x-rngkadmjsbmyvyok] has joined #openvpn
10:28 < dvl> I am impressed at the number of FreeBSD users here.
10:28 < pk__> hello
10:29 < pk__> where should i place the configuration so that it is automatically started
10:29 < pk__> as a service
10:29 < pk__> on ubuntu
10:30 < Splex> if the ubuntu init script is anything like archlinux, just drop the .conf files in /etc/openvpn and make sure the init script is called on boot
10:30 < gladiatr> dvl, since 1995!
10:30 < dvl> gladiatr: since 1998 here
10:30 < gladiatr> dvl, I remember with the Diary went online.  Awesome site, by the way (in case you needed any more affirmation :P :)
10:31 < gladiatr> pk__, /etc/openvpn
10:31 < ecrist> yeah, that ssl-admin maintainer is a POS, for sure.
10:31 < dvl> gladiatr: do ya?  Do you remember it at http://dvl-software.com?
10:31 <@vpnHelper> Title: DVL Software Limited (at dvl-software.com)
10:31 < dvl> gladiatr: thanks
10:31 < ecrist> dvl: not only do I maintain it, I wrote it. :)
10:32 < gladiatr> dvl, I didn't recall the domain-name--just being very pleased with its contents! 
10:32 < dvl> ecrist: oh shite!
10:32 < dvl> gladiatr: thank you
10:32 < gladiatr> in PHP no less
10:32 < dvl> gladiatr: Yes, I think that was my first PHP stuff... there was no such thing as a blog then AFAIK.
10:32 < gladiatr> dvl, no problem, man.  I've sent dozens of people your way.
10:33 < gladiatr> lol.  I was talkin' about ssl-admin!  muwahaha
10:33 < dvl> oh.... ssl-admin is PHP?  nice.  Too many people slag off PHP.
10:33 < ecrist> no, ssl-admin is perl
10:34 < ecrist> I do write lots of stuff in PHP, though.
10:34 < gladiatr> man.  Tough crowd here :)
10:34 < ecrist> and it's not even friday!
10:34 < gladiatr> indeed!
10:35 < ecrist> dvl: I would guess most of the regulars in here are freebsd folks.  by regulars, the non-idlers.
10:35 < gladiatr> Nah.  I'm just a bitter-anti-PHP sysadmin.  I've had to take too many web server's offline due to someone's ill-conceived php code.
10:36 < dvl> Well, yeah, bad code can happen in many languages.
10:36 < Splex> that and config files ;)
10:36 < gladiatr> Indeed.  I suppose if I wasn't so gd lazy, I'd just pick it up and learn to fix it.
10:37 < ecrist> gladiatr: that's how/why I learned it
10:37 -!- Irssi: #openvpn: Total of 142 nicks [4 ops, 0 halfops, 0 voices, 138 normal]
10:37 < gladiatr> awesome
10:37 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
10:37 < ecrist> crikey, we're almost at 150 users in here.
10:37 < Splex> its because openvpn is so awesome!
10:39 < gladiatr> attracted by my keen wit and dry sense of humor, no doubt...
10:39 < ecrist> well, ~2 years ago, there were 6
10:40 < dvl> ecrist: let me check...
10:41 < dvl> ecrist: back in Creating your own Certificate Authority 27 November 2008..... that's just over 2 years ago
10:43 < ecrist> yeah, I remember when you popped in here asking questions, looking all suspicious.
10:44 < ecrist> we had a sniper on the ledge, just in case.
10:44 < gladiatr> hehe
10:47 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:48 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:52 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:00 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:03 < rkantos> explain the jitter issue to me guys.
11:03 < rkantos> is it the waviness when using the equalizer?
11:04 < ecrist> I think you're in the wrong channel
11:09 < bo_root> :D
11:11 < gladiatr> http://tinyurl.com/5svhzwd
11:11 <@vpnHelper> Title: alt.drugs.psychedelics FAQ (at tinyurl.com)
11:17 < Essobi> ....
11:17 < Essobi> hah
11:17 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
11:19 < gladiatr> perfectly explains the waviness when taking Equalizer and the associated jitteriness...
11:19 < gladiatr> If a strange man, in day-glow pants, comes up to you in a bar and offers you Equalizer, just say "no".
11:20 < Essobi> Never take pills from a stripper.
11:20 < gladiatr> indeed.
11:20 -!- albech_ [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
11:20 < Essobi> And remember kids, only you can prevent forest fires.
11:26 <@vpnHelper> RSS Update - forum: OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html#p9411>
11:27 -!- peper [~peper@gentoo/developer/peper] has quit [Remote host closed the connection]
11:27 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
11:33 -!- alex88 [~alex88@78.134.49.1] has joined #openvpn
11:33 < alex88> !welcome
11:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:40 < pk__> i am trying to create a server cert using easy-rsa tools
11:40 < pk__> but it says index.txt not found
11:40 < pk__> where is this index.txt supposed to come from?
11:41 < pk__> by the way can't i avoid this key thing and use a id-password based authentication
11:52 < gladiatr> pk__, it should live in your keys directory.  If it doesn't exist: "touch keys/index.txt"
11:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 272 seconds]
12:03 < pk__> gladiatr: if i dont want any security can't i avoid this certificate and key system
12:04 < gladiatr> Well, if you don't want *any* security, you can just use a gre tunnel :)
12:05 < gladiatr> !factoids search static
12:05 <@vpnHelper> 'static', 'static_key_details', 'dlink_static_route', 'static-key', and 'statickey'
12:05 < gladiatr> !factoids search static_key_details
12:05 <@vpnHelper> "static_key_details" is http://svn.openvpn.net/projects/openvpn/web/trunk/faq-static-key-explanation.txt for an explanation of how static key files are used
12:05 < gladiatr> !factoids search static-key
12:05 <@vpnHelper> "static-key" is when you use --secret, you are using a static key. this is only valid for point-to-point setups. Static keys are less secure in that they never change. If someone captures your traffic, and then gains your static key a year from now, they can decrypt the captured traffic. Setups that use certs re-key every hour by default
12:05 < gladiatr> !factoids search statickey
12:05 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key>, or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time.
12:06 < pk__> can i use static keys fgor multiple clients?
12:16 < gladiatr> I think so.  It's just that everyone will have the same key.
12:16 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
12:16 < gladiatr> I'm not entirely sure how it works with assigning IP addresses, either.
12:17 < gladiatr> with certificates, the server keeps a list (ifconfig-pool-persist) keys from the CN of the certificate.
12:17 < gladiatr> not sure how that works with a certificateless installation
12:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
12:33 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
12:39 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:47 -!- Oxwivi [~chatzilla@173.0.0.221] has joined #openvpn
12:48 < Oxwivi> YOOHOO!
12:48 < Oxwivi> Anybody home?!
12:49 < Essobi> NEVAAAAR
12:50 < Oxwivi> Yay, someone revives as an udead!
12:50 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Quit: leaving]
12:50 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
12:51 < Oxwivi> Welcome back, Essobi.
12:51 < Oxwivi> Can you interpret .ovpn files?
12:57 -!- common [~common@p5DDA47D4.dip0.t-ipconnect.de] has quit [Quit: Friends don't let friends drink and IRC]
13:01 < krzee> anyone with the manual can
13:01 < krzee> !man
13:01 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
13:02 < Oxwivi> Well, I'm a beginner I can't interpret a complete one.
13:02 < krzee> i suggest going 1 line at a time
13:03 < Oxwivi> Remember I was asking about help for proXPN?
13:03 -!- fipu_ [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has joined #openvpn
13:03 < fipu_> Hi guys
13:03 < Oxwivi> I finally successfully used OVPN with proXPN, so I want to know how those differences affected the behaviour.
13:03 < krzee> i do remember
13:03 < Oxwivi> Hello.
13:04 < krzee> hey fipu_ 
13:04 < Oxwivi> *differences in config.
13:04 < gladiatr> krzee, evil...
13:04 < fipu_> I'm back to the openvpn comminuty, Acces Server seems to be crappy...
13:05 < fipu_> Is it possible to integrate crt, key and ca in client's config file?
13:05 < fipu_> so I have only one file per client
13:06 < krzee> pkcs11
13:06 < krzee> (^@fipu_)
13:06 < fipu_> what is that?
13:07 < bo_root> any clue why my port forwarding stop workking after i moved my addresses from 192.168 to 172.30 ?
13:11 < fipu_> krzee: for example the ca, can I inlcude command <ca> and </ca> in my clients config and put the ca between it?
13:14 < krzee> ooos
13:14 < krzee> oops
13:14 < krzee> i meant pkcs12
13:14 < krzee> --pkcs12 file 
13:14 < krzee> Specify a PKCS #12 file containing local private key, local certificate, and root CA certificate. This option can be used instead of --ca, --cert, and --key.
13:14 < krzee> pkcs11 is for smartcards, my mistake
13:14 < krzee> bo_root, im guessing you use redirect-gateway and did not change your NAT rule
13:14 < krzee> gladiatr, too true ;]
13:15 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
13:15 -!- fipu_ [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has quit [Ping timeout: 265 seconds]
13:16 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
13:19 -!- lupine_85 [~lupine_85@2001:41c8:10:462::99] has quit [Changing host]
13:19 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
13:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:20 < gladiatr> Wow.  You know your a noob when you start reading a paragraph that starts off: Migration for Troglodytes, and two sentences in you say to yourself, "Hey, wait a minute..."
13:20 < ecrist> I don't have an 'a'
13:21 < ecrist> what about a b noob?
13:21 < ecrist> </grammarnazi>
13:22 < gladiatr> oo... homonym crime as well... s/w your/w you're/
13:23 < gladiatr> ecrist, that's good... it keeps me humble.
13:24 < ecrist> wouldn't that be a Polyseme?
13:25 < Oxwivi> krzee, would you take a look and tekk me the differences between two config files?
13:26 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:26 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
13:27 < gladiatr> hrm... I don't think so--one is a contraction, so they don't actually express the same sense.
13:27 < alex88> hi guys, im trying to running openvpn on a vps system, i've configured all and it was giving me Permission denied error 13, so i've called support and they told me that tun/tap module has been loaded into kernel, now i'm getting Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)...that means they haven't loaded kernel modules?
13:27 < gladiatr> alex88, what do you get when you type: lsmod |grep tun
13:28 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
13:28 < alex88> gladiatr, all lsmod command is empty cause kernel is virtualized in vps.. i can't use lsmod, modprobe and insmod commands..
13:28 < gladiatr> rude.
13:29 < gladiatr> I don't know what to tell you, alex.
13:29 < alex88> i'm just thinking, have they really enabled it? but something they had done because the error number has changed.. from permission denied to no such device :/
13:29 < ecrist> oh, after looking it up, you're right, it's a homonym
13:29 < alex88> gladiatr, np, i'll change hoster.. these seems noobs..
13:30 < gladiatr> alex88, to run openvpn, you're going to need access to the kernel and the system routing tables.  Whether or not they're virtualized, some kind of layer needs to present those to the openvpn program.
13:30 <@vpnHelper> RSS Update - forum: Odd Issue <http://forums.openvpn.net/topic7561.html>
13:30 < gladiatr> Or it will be a sad program.  And anyone that has seen Tron knows what happens when a program gets sad...
13:31 < alex88> gladiatr, i know, on older vpn i just ask support to enable, they do and i was running vpn fine..but still lsmod was empty..
13:31 < alex88> gladiatr, btw np i'll continue hammering support
13:33 -!- gladiatr is now known as gladiatr_afk
13:35 < Essobi> gladiatr_afk: don't make me get 'User' on you.
13:38 -!- buntfalke [~nobody@openvpn-p0-207.triple-a.uni-kl.de] has joined #openvpn
13:38 -!- buntfalke [~nobody@openvpn-p0-207.triple-a.uni-kl.de] has quit [Changing host]
13:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:43 -!- Oxwivi [~chatzilla@173.0.0.221] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
13:59 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:03 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
14:03 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
14:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:04 -!- gladiatr_afk is now known as gladiatr
14:04 < gladiatr> lol
14:25 -!- fipu_ [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has joined #openvpn
14:25 < fipu_> re
14:25 < fipu_> krzee: for example the ca, can I inlcude command <ca> and </ca> in my clients config and put the ca between it?
14:27 < fipu_> Other question, I specified a challenge password at creating of the certificate for the server
14:28 < fipu_> but I don't have to enter the password if I start the openvpn server
14:28 -!- p3rror [~mezgani@41.140.27.176] has joined #openvpn
14:30 < fipu_> krzee: arround?
14:32 < ecrist> you must have done something wrong, then.
14:36 < krzee> fipu_, i once read *something* regarding putting those files into the config... dont remember it tho
14:36 < fipu_> ok, I try it
14:36 < fipu_> I think it works
14:36 < fipu_> because the config file from my old access server has this in it
14:36 < krzee> try it
14:36 < fipu_> like <ca> </ca> and <key> </key> etc.
14:36 < fipu_> ok
14:37 < krzee> access-server uses openvpn at its core, so if it works there it may very well work in openvpn
14:37 < fipu_> and I have an other question, I specified a challenge password at creating my VPN Servers certificate
14:37 < krzee> and as for password protecting the key file, you can do that after the fact as well
14:37 < fipu_> but I don't get the request to enter it at starting the server
14:37 < krzee> there is a different script to use for password protecting the key file
14:37 < fipu_> ah ok
14:37 < krzee> like build-client-pass or whatever its called
14:37 < fipu_> how can I use it?
14:38 < fipu_> ah ok
14:38 < krzee> but now that its already made...
14:38 < fipu_> what is meant with "challenge password" ?
14:38 < krzee> a simple openssl command will do
14:39 < krzee> no idea
14:39 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
14:39 < fipu_> ok strange
14:39 < fipu_> so I have to use build-client-pass
14:39 < fipu_> right?
14:39 < krzee> !learn strip-passphrase as see http://blog.lib.umn.edu/silvi003/codenotes/2008/08/how_to_strip_a_passphrase_from.html to learn how to strip a passphrase from a key file
14:39 <@vpnHelper> Joo got it.
14:40 < krzee> yep
14:40 < fipu_> ok, thank you I try
14:41 < krzee> !learn change-passphrase as see http://openvpn.net/archive/openvpn-users/2005-03/msg00230.html for how to change (or add) a key's passphrase
14:41 <@vpnHelper> Joo got it.
14:41 < fipu_> Can I use "build-key-pass" instead of "build-key-server"?
14:42 < fipu_> ok, thanks
14:42 < fipu_> I use the ssl command
14:42 < fipu_> thank you
14:42 < krzee> np
14:42 < krzee> build-key-pass is for the client (with passphrase)  build-key-server is for the server
14:43 < bo_root> can someone check this log to direct me where the problem is, probably something with tls handshake of course.. http://pastebin.com/xD4TMmca
14:44 < krzee> looks like firewall
14:44 < krzee> or generally *something* preventing the initial connection
14:45 < bo_root> and from client side http://pastebin.com/3EuRyMAp
14:47 < krzee> looks like that log may have been cut off early
14:47 < bo_root> u mean from client side
14:47 < krzee> yep
14:48 < bo_root> let me try to get whole log, client is on other side, he just sent me abit..
14:48 < bo_root> nop, he said that is whole log
14:48 < krzee> does your server have other clients?
14:49 < bo_root> nop
14:49 < bo_root> but is behind a router
14:49 < krzee> ahh
14:49 < bo_root> so that is the problem?
14:49 < krzee> maybe the port forward is bad
14:49 < krzee> maybe the firewall is bad on the server
14:50 < bo_root> port forwarding is set to 1194
14:50 < bo_root> UDP
14:52 < krzee> maybe the forward chain isnt set to allow tun interface
14:52 < krzee> honestly i cant tell, its a general networking problem of some sort
14:52 < krzee> no way for me to know exactly what
14:53 < bo_root> yes i understand, tnx anywhy
14:58 < gladiatr> There's a lot to complain about regarding Cisco, but I have to say: they make a damned fine switch.  
14:58 < gladiatr> And I wish I had one...
14:58 < gladiatr> instead of these lousy Linksys things...
14:58 < gladiatr>  /pout
14:59 < krzee> lol
15:00 -!- alex88 [~alex88@78.134.49.1] has quit [Ping timeout: 276 seconds]
15:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:05 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
15:09 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
15:10 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 272 seconds]
15:11 < ambro718> Hi. I'm using TAP-Win32 from a custom program. It appears that many packets are "lost" before my program can read them from the device. What could be the problem?
15:12 < ambro718> This happens especially frequently when I run Windows in a virtual machine with VirtualBox.
15:14 < Essobi> .....
15:14 < gladiatr> ambro718, I would like to introduce you to my buddy, Jesus...
15:14 < gladiatr> ;)
15:15 -!- WinstonSmith [~true@e179004223.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
15:15 < Essobi> gladiatr: So his packets can be 'Saved'?
15:15  * gladiatr nods
15:15 < Essobi> Fleck: ROFL
15:15 < Essobi> err
15:15 < Essobi> gladiatr: ROFL
15:15 < Fleck> :D
15:15  * Essobi uses his best preacher voice..
15:15 -!- WinstonSmith [~true@e179004223.adsl.alicedsl.de] has joined #openvpn
15:15 < Essobi> Hello, my friiiends.  
15:15 < gladiatr> ambro718, honestly, ambro718, I have no idea.  
15:15 < Essobi> I'm here today, to tell you, yes YOU, can save your packets.
15:17 < gladiatr> Turn(uh) from(mm) the Evil that is(uh) the (canyousayamen) Win32(uh) networK stack(uh)
15:17 < ambro718> gladiatr: do you think they went to packet-heaven?
15:17 -!- morbidwar [~ovidiu@78.96.23.179] has joined #openvpn
15:17 < Essobi> gladiatr: HALLA-LU-YA
15:17 < gladiatr> ambro718, we can only hope
15:17 < Essobi> ambro718: Umm.. What're you doing with your TAP?
15:17 < Essobi> ambro718: I mean.. I'm no TAP expert but I know a bit about network programming. ;
15:17 < ambro718> Essobi: Implementing a VPN ?
15:17 < Essobi> ;)
15:18 < Rienzilla> my packets went to the dark side today :(
15:18 < Essobi> Rienzilla: LOL.. Use teh source, Luke.
15:18 < Rienzilla> that wasnt funny dammit
15:18 < Rienzilla> lol
15:19 < ambro718> just for the record, my VPN software is open source, http://code.google.com/p/badvpn/
15:19 <@vpnHelper> Title: badvpn - Project Hosting on Google Code (at code.google.com)
15:19 < Rienzilla> god called out of bed at a terrible early time
15:19 < Essobi> ambro718: Bad vpn.. Baaad.
15:20 < ambro718> Essobi: No. It's perfect. It's like God.
15:20 < Essobi> ambro718: Umm.. Can you drop packets if you block on the read for too long?  IDK shit about TAP but I'm familiar with high-end sniffers.
15:20 < ambro718> Essobi: I don't block anywhere (at all). Everything is event-driven.
15:21 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
15:21 < ambro718> here's the relevent piece of code if that's of any help, http://code.google.com/p/badvpn/source/browse/trunk/tuntap/BTap.c
15:21 <@vpnHelper> Title: BTap.c - badvpn - Project Hosting on Google Code (at code.google.com)
15:21 < Essobi> ambro718: Hmm.. Interesting.
15:21 < Essobi> ambro718: I'm looking at your page.
15:22 < ambro718> maybe I should increase some buffer size in the driver?
15:22 < Essobi> Ugh, I hate GPL...
15:22 < Essobi> Heh.. Yea, I would.
15:22 < Essobi> Or implement a circular buffer so you have no chance to exhaust it.
15:22 < Essobi> well.. less chance
15:22 < ambro718> Essobi: What's with GPL?
15:23  * Essobi looks down at his BSD tattoo.
15:23 < Essobi> *SHRUG*
15:23 < gladiatr> lol
15:25 < Essobi> ambro718: socks2tun is a pretty tight idea
15:27 < Essobi> ooooh.. you could do some interesting shit with that, on a firewall, and TOR. :)
15:27 < ambro718> Essobi: thanks
15:28 < ambro718> uses lwIP internally
15:28 < Essobi> ambro718: you use what what?
15:29 < Essobi> Oh right.. 
15:29 < Essobi> lwIP... I read that as a 1.
15:29 < ambro718> Essobi: the lwIP network stack; it needs to implement TCP
15:29 < Essobi> Uhh... you realize that's BSD licensed right?
15:30 < ambro718> Essobi: does this have some significance?
15:35 < Essobi> you can't statically link BSD and GPL code.
15:35 < ambro718> Essobi: who says that?
15:35 < Essobi> The GPL license.
15:35 < Essobi> You have to use LGPL
15:36 < ambro718> But it's my code. How could I possibly have violated it?
15:37 < ambro718> whatever, I'm not a lawyer, I may as well change it to LGPL... when I have the time...
15:37 < gladiatr> Essobi, actually, I think it's the other way around.  You can use BSD licensed code for pretty much anything--it's just that the BSDishness of it will be TAINTed by the GPLness of the rest of it
15:38 < Essobi> *SHRUG*  Read up on it when you have time.  I'm not a lawyer either, but gladiatr is more on point I think.
15:38 < Essobi> gladiatr: I think that viral portion of the license that requires anything you use with it to be gpl too, is voided in the lgpl
15:38 < gladiatr> ahhh
15:39 < rkantos> goddamn channel alwaya wrong... damn
15:42 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
15:43 < bo_root> do i need to manually open port 1194 in OS for openvpn to work?
15:44 < gladiatr> are you running a fireawll?
15:44 < gladiatr> s/aw/wa
15:45 < bo_root> no
15:46 < bo_root> i got it..
15:47 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
15:47 < krzee> heh thanx for saying what it was
15:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:54 -!- gladiatr is now known as gladiatr_afk
15:54 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
16:04 -!- morbidwar [~ovidiu@78.96.23.179] has quit [Remote host closed the connection]
16:05 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:13 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
16:18 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
16:20 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
16:27 -!- p3rror [~mezgani@41.140.27.176] has quit [Ping timeout: 255 seconds]
16:36 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
16:38 -!- aditsu_ [~aditsu@n1164943143.netvigator.com] has joined #openvpn
16:40 -!- aditsu [~aditsu@n1164943155.netvigator.com] has quit [Ping timeout: 240 seconds]
16:40 -!- aditsu_ is now known as aditsu
16:53 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 240 seconds]
16:54 -!- takamichi [~pri@83.170.109.106] has joined #openvpn
16:55 < krzee> Dougy,
16:55 < krzee> yanno the specs of my server in your closet?
16:59 -!- ampex [~sterling@circu.it] has quit [Ping timeout: 240 seconds]
17:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:01 < fipu_> I have a problem to connect my server 2008 (64bit) to the openvpn server
17:01 < fipu_> same config works on win xp client
17:02 < fipu_> Initialization Sequence Completed With Errors ( see http://openvpn.net/faq.html#dhcpclientserv )
17:02 <@vpnHelper> Title: FAQ Community (at openvpn.net)
17:02 < fipu_> I use route-method exe
17:03 < krzee> http://openvpn.net/index.php/open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html
17:06 -!- ampex [~sterling@circu.it] has joined #openvpn
17:06 < fipu_> which one should I use? ip-win32 ipapi?
17:06 < krzee> trial / error
17:06 < krzee> i dont use windows
17:06 < krzee> i just read the faq ;]
17:07 < fipu_> ok, thank you I try it
17:07 < fipu_> :)
17:09 < fipu_> krzee: it works with ip-win32 ipapi! nice one, thanks!
17:10 < fipu_> and now I go to bed, gn8 @ all
17:10 < fipu_> mission complete :P
17:10 < krzee> np
17:13 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
17:20 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Read error: Connection reset by peer]
17:20 -!- djgerm1 [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
17:34 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
17:36 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
17:36 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
17:36 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
18:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
18:03 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:03 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:09 -!- alex88 [~alex88@78-134-88-60.dynamic.eolo.it] has joined #openvpn
18:12 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has joined #openvpn
18:14 -!- alex88 [~alex88@78-134-88-60.dynamic.eolo.it] has quit [Ping timeout: 240 seconds]
18:21 -!- takamichi [~pri@83.170.109.106] has quit [Ping timeout: 240 seconds]
18:22 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
18:23 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
18:23 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
18:23 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:26 -!- SOG [~SOG@222.125.204.83] has quit [Quit: SOG]
18:29 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Ping timeout: 240 seconds]
18:33 -!- Shubuntu [~chatzilla@2.176.119.9] has joined #openvpn
18:33 < Shubuntu> hi, can you guys help me set up openvpn on ubuntu?
18:34 < Shubuntu> i've followed this: http://library.linode.com/networking/openvpn/ubuntu-10.10-maverick
18:34 <@vpnHelper> Title: Deploy VPN Services with OpenVPN - Secure Communications with OpenVPN on Ubuntu 10.10 (Maverick) - Linode Library (at library.linode.com)
18:34 < Shubuntu> can you please first of all tell me how to make openvpn log actions to i can see what's going on
18:34 < Bushmills> !howto
18:34 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
18:35 < Bushmills> there's also a man page
18:36 < krzee> !logfile
18:36 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
18:37 < krzee> and what Bushmills said
18:38 < Bushmills> http://docs.verhau.de/cgi-bin/dwww/usr/share/man/man8/openvpn.8.gz?type=man
18:38 <@vpnHelper> Title: openvpn(8) - Man pages (at docs.verhau.de)
19:02 -!- mosno [~mosno@unaffiliated/mosno] has quit [Ping timeout: 240 seconds]
19:08 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
19:12 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
19:13 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
19:15 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
19:28 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:34 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Quit: reboot]
19:36 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has joined #openvpn
19:44 < arnotixe> Hi all I have a openvpn network with some 10 clients spread over the province. Works nice. Now, I'd like for the clients to access a network behind the openvpn server. Would that be possible? See my situation on http://dug.im/d8d7b
19:44 < arnotixe> I was thinking maybe NAT on the openvpn server is correct for my situation here?
19:53 < krzee> not needed
19:53 < krzee> i dont fully catch your diagram, but have you read my writeup?
19:53 < krzee> !route
19:53 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
19:54 < krzee> i made a pretty comrehensive doc on routing lans behind openvpn
19:54 < krzee> the nat-hack is rarely needed
19:56 < arnotixe> thank you for your link, I'll read it NOT skim it :)
19:57 < krzee> ;]
19:57 < krzee> then its not too likely you'll have a problem, and you're welcome
19:57 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
19:57 < krzee> if you only have a server lan, its actually a bit shorter than my doc
19:57 < krzee> !serverlan
19:57 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
19:58 < krzee> and your openvpn client is likely .6, not .7
20:01 < arnotixe> ah, yes that was just a dummy ip, to show the net.
20:03 < arnotixe> hmm ok I think I see the problem on your http://www.secure-computing.net/wiki/index.php/Graph - I have no way of adding the 10.8.0.0 route to the gateway on the vpn server's lan, because it's a corporate managed router...
20:03 <@vpnHelper> Title: Graph - Secure Computing Wiki (at www.secure-computing.net)
20:08 -!- teddz_ [~teddz@dtmd-4db22f9c.pool.mediaWays.net] has quit [Quit: Ex-Chat]
20:08 < krzee> then you must do the workaround explained in !route section ROUTES TO ADD OUTSIDE OPENVPN or the nat-hack
20:13 < Shubuntu> guys i'm trying to entirely bypass my local isp. i've set up openvpn and can connect to it, i've set up the option: "redirect-gateway def1 bypass-dhcp bypass-dns" at the end of my client.conf file, but still can't browse to webpages blocked my isp
20:13 < Shubuntu> please help
20:16 < arnotixe> krzee, ok and as far as i can see the ROUTES TO ADD OUTSIDE OPENVPN is talking about adding routes other places. The only place I can set routes is on the openvpn machine itself... So I guess that means nat-hack then right?
20:16 < arnotixe> Shubuntu, have you tried looking at your network with wireshark? Helps a lot when you wonder what really happens to your packets, and where they go.
20:16 < krzee> nope
20:17 < krzee> if you read the section you will see the work around
20:17 < krzee> (adding the route to the lan machines themselves)
20:17 < krzee> if you cant do EITHER of those, its nat-hack time
20:17 < krzee> (although at that point im also thinking your admin wont like what you're doing ;] )
20:17 -!- teddz [~teddz@dtmd-4db22f9c.pool.mediaWays.net] has joined #openvpn
20:18 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 240 seconds]
20:20 < arnotixe> hehe well I do have permission to run the openvpn server on our network, it's just that the router itself is accessible only to our ISP...
20:20 < krzee> wow, super-weaksauce
20:20 < krzee> if you want any sort of accounting for who did what you want to get them to add the route
20:20 < krzee> since using NAT will make you all come from the vpn server's lan ip
20:22 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
20:22 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has joined #openvpn
20:22 < arnotixe> yes, I'm aware of that. It doesn't matter, since all the openvpn server does is blamed on me anyway. And the openvpn is actually not routing machines with users on them, but an access control system's remote nodes. They just have a cheap router flashed with dd-wrt stuck inside them and Voilá we're connected to the openvpn :)
20:23 -!- openbsdnoob_ is now known as openbsdnoob
20:24 < arnotixe> I'll go look for nat-hack I think.
20:26 < arnotixe> !nat-hack
20:26 < arnotixe>  ;) ?
20:26 < krzee> you just NAT the vpn subnet to the lan ip
20:26 < krzee> !linnat
20:26 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
20:28 < derekv> anyone designed / seen a windows client installer that generates a private key for the user, emails it or otherwise sends a csr to the admin, etc
20:28 -!- rawDawg [~rawdawg@cpe-24-166-49-207.neo.res.rr.com] has joined #openvpn
20:43 -!- teddz [~teddz@dtmd-4db22f9c.pool.mediaWays.net] has quit [Quit: Ex-Chat]
20:45 -!- ampex [~sterling@circu.it] has quit [Ping timeout: 265 seconds]
20:46 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:46 -!- ampex [~sterling@circu.it] has joined #openvpn
20:52 -!- albech_ [~thomas@124.157.245.126] has joined #openvpn
21:00 < krzee> no, not such a bad idea tho
21:00 < krzee> the un-attended installers i have seen are based upon the idea that certs were already made
21:00 < krzee> such as 
21:00 < krzee> :
21:00 < krzee> !dazo
21:00 <@vpnHelper> "dazo" is "eurephia" is http://www.eurephia.net/
21:00 < krzee> err no
21:00 < krzee> !win_rollup
21:00 <@vpnHelper> "win_rollup" is please see http://www.secure-computing.net/wiki/index.php/OpenVPN/HowTo_for_Windows_2 for dazo's writeup on making unattended windows installers for openvpn
21:06 -!- master_of_master [~master_of@p57B54E59.dip.t-dialin.net] has quit [Ping timeout: 272 seconds]
21:07 -!- master_of_master [~master_of@p57B55D51.dip.t-dialin.net] has joined #openvpn
21:08 -!- jambooda [~cog@pool-98-109-218-165.nwrknj.fios.verizon.net] has joined #openvpn
21:08 -!- jambooda [~cog@pool-98-109-218-165.nwrknj.fios.verizon.net] has quit [Changing host]
21:08 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
21:15 < derekv> Yea I've seen a couple links like that.
21:16 < derekv> I mean, if you have a secure link, its cool, or if the key has a decent passphrase
21:16 < derekv> you could have an installer "dial up" over some secure like like sftp or somesuch, or even just https, grab the certificate that way
21:22 < ljvb> yay for snow.. boo for snow on driveways.. yay for snow blowers.. boo for ran out of gas.. completely off topic.. but damnit I'm cold and cranky
21:28 < derekv> so you've got this installer wrapper, which the user executes on their machine, and it is responsible for checking itself, and making sure it matches a hash, which it downloads itself, and if it does not match this hash, it kindly aborts execution.
21:30 < derekv> I'm tired and its not making any sense.  I wish I had energy enough to work on this some more tonight.
21:31 < Shubuntu> guys can you please help me with my openvpn authentication something's amiss, here's my iptables confing: http://pastebin.mozilla.org/989126, and here's the error i keep getting: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) any help is appreciated
21:37 -!- WinstonSmith [~true@e179004223.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
21:41 < derekv> it would be nice if I were more familier with the tools available for windows scripting and management, you could probably do something quite secure involving code signing 
21:42 < derekv> and not have to pay for any certs, as long as you could install the correct trusted certificates ahead of time (eg with group policy)
21:43 -!- djgerm1 [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
21:53 -!- rawDawg [~rawdawg@cpe-24-166-49-207.neo.res.rr.com] has quit [Read error: Connection reset by peer]
21:54 < derekv> crap... actually... something that pulls pulls the .ovpn config files or syncs them, maybe along the lines of a version control system, something like git, you could even email out the patches.  combine with signing, either, an approved commit's hash is signed on the server or, the email attachement containing the patchs is signed.
21:54 < derekv> combined with build scripts
21:54 < derekv> the "build" would stick in client specific details and make the .ovpn, etc, make/obtain new keys if nessisary
21:56 < derekv> would be a really good way to cope with any eventual need to change client's config scripts programmatically
22:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
22:24 -!- aditsu [~aditsu@n1164943143.netvigator.com] has left #openvpn []
22:32 -!- Shubuntu [~chatzilla@2.176.119.9] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
22:52 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has quit [Ping timeout: 272 seconds]
22:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
22:57 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has joined #openvpn
23:04 < arnotixe> krzee, oh yes that's just a little detail there: The openvpn box is on a win xp box... I found http://openvpn.net/archive/openvpn-users/2006-09/msg00031.html that talks about how to set it up, and at least something happens: Sniffing with wireshark (on the xp box) I see the xp box no longer is responding to incoming packets to the openvpn server... Maybe it's too much for xp with three NICs to deal with. Do you have any links to xp-nat-how
23:04 < arnotixe> tos/articles? My situation now: http://dug.im/86e20
23:04 <@vpnHelper> Title: Re: [Openvpn-users] how to do NAT on Windows XP? (at openvpn.net)
23:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:13 < krzee> !winnat
23:13 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows, or (#2) http://www.nanodocumet.com/?p=14 for windows XP
23:19 -!- UnterPerro [~UnterPerr@c-75-74-122-61.hsd1.fl.comcast.net] has quit [Ping timeout: 255 seconds]
23:21 < krzee> but you might need to get a real OS
23:21 < krzee> for the server
23:21 < krzee> (or give up on the nat-hack)
23:22 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
23:23 < arnotixe> yes how I would like to do that *sigh*
23:23 < arnotixe> But there are two major obstacles: The very proprietary access control server software must run on windows. 
23:23 < arnotixe> 2) The server is 6000km up north...
23:23 < krzee> then see link #2 above
23:23 < krzee> read the comments too
23:24 < arnotixe> I could maybe stick the whole windows "OS" into virtualbox though, and use the linux box as a real router :D
23:24 < arnotixe> I'll see the link
23:36 < krzee> or you could use windows as the real os, and use a linux VM (if you need to)
23:36 < krzee> i dont use windows, so all i can do is wish you luck with the above guide ;]
23:42 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
23:53 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
--- Day changed Thu Jan 27 2011
00:03 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
00:15 < arnotixe> yahoo! krzee, thank you. I needed the comments from that openvpn users mail mentioned by vpnhelper, but I also needed to add the internal network card as "full" too, since my vpn tunnel is coming in thru the public_network, and I wanted to access the internal_network interface. I pasted the netsh show interfaces output on http://pastebin.com/5REcgv3P and my problem as image on http://dug.im/86e20 but now it WORKS thank you very much
00:15 < arnotixe> Could be worth a mention in some docs maybe, if someone runs into the same trouble that they have two lans they want  to NAT?
00:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
00:21 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:11 -!- rjd_ [~rjd@212.112.31.11] has left #openvpn []
01:23 -!- zeshoem [~mnathani@70.52.168.144] has joined #openvpn
01:23 < zeshoem> !welcome
01:23 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:23 < zeshoem> !goal
01:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:24 < zeshoem> !/30
01:24 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
01:42 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:42 -!- mode/#openvpn [+o mattock] by ChanServ
01:47 -!- DonalDuck [~alex@212.59.96.74] has joined #openvpn
01:48 < DonalDuck> привет всем
01:48 < DonalDuck> подскажите пожалуйста что означает параметр persist-key
01:49 < DonalDuck> сохранение пароллей
02:06 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
02:08 < zeshoem> how does one configure openvpn for the first time?
02:08 < zeshoem> what localhost port /ssl does one use
02:10 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:10 -!- DonalDuck [~alex@212.59.96.74] has left #openvpn ["Konversation terminated!"]
02:19 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has quit [Ping timeout: 240 seconds]
02:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:39 <@vpnHelper> RSS Update - forum: OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html#p9413>
02:42 < zeshoem> How can I verify that dev Tun is enabled on my box?
02:43 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
02:43 < Bushmills> ifconfig, if up,  or  modprobe -l tun
02:44 < zeshoem> I am on a vps
02:44 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9414>
02:44 < zeshoem> modprobe -l tun >> FATAL: Could not load /lib/modules/2.6.18-028stab070.7/modules.dep: No such file or directory
02:51 < zeshoem> http://pastebin.com/gafVccpP
02:51 < zeshoem> I get those errors when attempting to start the openvpn server
03:06 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
03:11 -!- bo_root [~x@89-212-216-119.dynamic.t-2.net] has joined #openvpn
03:12 < bo_root> i had problems with connecting client to my server, so i removed router, now i have wan ip, what should i put in server.conf under server section
03:12 <@vpnHelper> RSS Update - forum: Odd Issue <http://forums.openvpn.net/topic7561.html#p9415>
03:12 < bo_root> before i had server 172.30.0.0/24
03:15 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:21 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Ping timeout: 240 seconds]
03:22 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:23 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
03:25 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Client Quit]
03:25 -!- bo_root [~x@89-212-216-119.dynamic.t-2.net] has quit [Ping timeout: 276 seconds]
03:25 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:32 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:32 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:44 < Bushmills> zeshoem:    "failed to run iptables-restore "   there's your problem, as the error messages which you posted indicate
03:50 -!- macsppadic is now known as Directorsppadic
03:59 <@vpnHelper> RSS Update - forum: Does OpenVPN generate MAC Pause (01:80:c2:00:00:01) packets? <http://forums.openvpn.net/topic7557.html#p9416>
04:04 -!- Directorsppadic is now known as macsppadic
04:15 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Read error: Connection reset by peer]
04:29 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9417>
04:39 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
04:42 -!- mosno [~mosno@unaffiliated/mosno] has quit [Read error: Connection reset by peer]
04:43 -!- mosno [~mosno@mail.crebrokers.com] has joined #openvpn
04:43 -!- mosno [~mosno@mail.crebrokers.com] has quit [Changing host]
04:43 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
04:44 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
04:45 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has quit [Quit: Lost terminal]
04:46 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
04:51 < krzee> arnotixe, maybe you could make a small writeup on the wiki
04:51 < krzee> =]
04:52 < krzee> (if interested, go for it!)
04:52 < krzee> !wiki
04:52 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN, or (#2) Official wiki is at https://community.openvpn.net/openvpn/wiki
04:54 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:54 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:54 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:54 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
04:59 <@vpnHelper> RSS Update - forum: Odd Issue <http://forums.openvpn.net/topic7561.html#p9418>
05:03 < krzee> !/30
05:03 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
05:11 <@vpnHelper> RSS Update - forum: Multiple Server Profiles <http://forums.openvpn.net/topic7529.html#p9420> || ifconfig question <http://forums.openvpn.net/topic7527.html#p9419>
05:14 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has left #openvpn []
05:16 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:16 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:16 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:17 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9421>
05:26 -!- macsppadic is now known as migrator
05:47 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
06:11 -!- ampex [~sterling@circu.it] has quit [Ping timeout: 250 seconds]
06:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Operation timed out]
06:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:16 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
06:16 -!- ampex [~sterling@circu.it] has joined #openvpn
06:22 <@vpnHelper> RSS Update - forum: Installing VPN with Win Xp <http://forums.openvpn.net/topic7499.html#p9422>
06:56 < arnotixe> krzee, yes, I went and created an account. Just going to work now, but after that I'll see what can be done :)
07:03 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
07:08 <@vpnHelper> RSS Update - forum: Installing problem with WinXP <http://forums.openvpn.net/topic7562.html>
07:13 -!- SwK [~swk@freeswitch/developer/swk] has joined #openvpn
07:16 < SwK> any hints on a good opensource management interface for openvpn? appearently my google skillz are crap
07:17 < gladiatr_afk> what sort of management are you looking for?
07:17 -!- gladiatr_afk is now known as gladiatr
07:18 < SwK> create/delete client credentials monitor usage etc
07:18 < SwK> i got idiots that will have to support it that arent smart enuff for cli w/ easy-rsa
07:19 < gladiatr> Hrm... unfortunately common scenario.
07:19 < SwK> yeah I kinda figured... 
07:20 < SwK> either my google-fu fails or am i one of a million people looking for something that doesnt exist?
07:20 < gladiatr> note: I've never looked at any of this, but... http://openvpn-web-gui.sourceforge.net/
07:20 <@vpnHelper> Title: OpenVPN Web GUI 0.3.x (at openvpn-web-gui.sourceforge.net)
07:21 < gladiatr> doesn't look like it has seen a lot of action recently, though
07:21 < SwK> yeah... that just does basic monitoring... unfortunately it looks abandoned
07:21 -!- freaky[t] [alpha@freakyy.de] has quit [Remote host closed the connection]
07:21 < gladiatr> indeed
07:24 < gladiatr> there's this, but it doesn't appear at all geared to potato heads... http://openvpn.jowisoftware.de/
07:24 <@vpnHelper> Title: OpenVPN Manager - The Project » OpenVPN Manager (at openvpn.jowisoftware.de)
07:25 < gladiatr> are your users running windows by any chance?  http://www.mertech.com.au/mertech-products-openvpnusermanager.aspx
07:25 <@vpnHelper> Title: Mertech Solutions - Home :: Products :: OpenVPN User Manager (at www.mertech.com.au)
07:26 < SwK> mix of OSX Linux and Windows
07:26 < SwK> gotta be someting web based that runs off linux
07:26 < SwK> i am an anti-m$ biggot lol
07:27 < gladiatr> heh.  preachin' to the choir...
07:28 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
07:30 < SwK> gladiatr, that second link was windows lol
07:31 < gladiatr> Yeah.  I'm not seein' anything that fits what you're after.
07:31 < gladiatr> unfortunately...
07:31 < gladiatr> yeah..
07:31 < SwK> :/ looks like thats something else to add to the write it list lol
07:31 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:31 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:31 < gladiatr> Hrm.... you might think about giving openvpn access server a look.  It's commercial, but it'll run on anything openvpn will run with
07:32 < gladiatr> or there is that :)
07:32 < SwK> if we weren't so cheap around here.. i'm just a poor broke oss programmer
07:33 < gladiatr> I feel your pain
07:40 < SwK> there is something else you might be able to help me with and thats routing all traffic over the tunnel
07:40 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
07:40 < ecrist> !def1
07:40 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
07:40 < SwK> on my mac while testing I keep loosing the access to anything 
07:41 < SwK> yeah thats exactly what I keep seeming to has issue with
07:53 < SwK> i think i found the issue there... looks like its in tunnelblick 
07:53 < gladiatr> that's a great package... when it works :P
07:55 < SwK> i see that lol
07:57 < gladiatr> Smart guys... but going to them when things are not working correctly was kinda like going to a doctor in the midst of an allergic reaction and being sent away because the doctor eats that very thing all the time without problems.
08:00 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
08:01 -!- mosno [~mosno@unaffiliated/mosno] has quit [Read error: Connection reset by peer]
08:01 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
08:06 -!- mosno [~mosno@unaffiliated/mosno] has quit [Ping timeout: 265 seconds]
08:06 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9424>
08:10 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
08:10 < SwK> any hints on a good mac client?
08:10 -!- teddz [~teddz@dtmd-4db23304.pool.mediaWays.net] has joined #openvpn
08:11 < ecrist> tunnelblick does work, you can use the raw openvpn binary out of it, worst case
08:11 < ecrist> what, specific issue are you having?
08:11 < SwK> it keeps binding the routes outside the vpn
08:11 < SwK> specifically http://code.google.com/p/tunnelblick/issues/detail?id=107 <--- this
08:11 <@vpnHelper> Title: Issue 107 - tunnelblick - tunnelblick incorrectly sets default gateway when "redirect-gateway def1" set on "tap" vpn - Project Hosting on Google Code (at code.google.com)
08:12 < SwK> and it doesnt just do it when using the def1 setting it does it for any routes... 
08:15 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
08:15 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
08:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:16 < ecrist> what version of tunnelblick, and have you tried the plain old openvpn client?
08:17 < SwK> its whatever the latest 'stable' they have 
08:18 < ecrist> that issue looks like an openvpn issue, and not a tunnelblick issue
08:18 -!- mosno [~mosno@mail.crebrokers.com] has joined #openvpn
08:18 -!- mosno [~mosno@mail.crebrokers.com] has quit [Changing host]
08:18 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
08:18 -!- dazo_afk is now known as dazo
08:18 < SwK> version of openvpn in there help any?
08:19 -!- albech_ [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
08:19 < ecrist> well, they're running openvpn 2.1.4 if you really do have the latest.
08:19 < SwK> yeah
08:19 < SwK> i just verified that
08:19  * ecrist uses tunnelblick
08:20 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
08:20 < SwK> server is 2.1.4 on centos 5.5
08:20 < ecrist> why does the server not issue IPs instead of DHCP?
08:20 < SwK> the server issues IPs
08:21 < SwK> static routed block no natted
08:21 < SwK> just assigned a /24 to it heh
08:21 < ecrist> well, the issue you pointed out claims it's waiting for DHCP.  with --server-bridge, you can optionally issue IPs from within openvpn itself.
08:22 < SwK> well the symptom description is the pretty close to whats happening here
08:23 < ecrist> can you pastebin, which connected, 'netstat -rn' from a terminal?
08:23 < SwK> you want just the routes added from my server?
08:23 < ecrist> no, everything, please
08:24 < SwK> ok you have a prefered pastebin/
08:24 < ecrist> !pb
08:24 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
08:24 < ecrist> but any one that works for you
08:25 < SwK> http://pastebin:freeswitch@pastebin.freeswitch.org/15159
08:25 < SwK> yes theres a pw in there lol i have never seen a pastebin spammed so bad as ours
08:26 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
08:28 <@vpnHelper> RSS Update - forum: OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html#p9426>
08:29 < ecrist> I would rather we not use the freeswitch pastebin in the future.
08:30 < ecrist> I don't see any tap adapters in the routing table...
08:30 < SwK> tun0
08:31 < SwK> is that possibly my problem i borked the config lol
08:31 < ecrist> yes
08:31 < ecrist> !configs
08:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
08:32 < SwK> boom thats it.
08:33 < SwK> i had it set for tun instead of tap ont he client side... changed it and most of my issues went away
08:33 <@vpnHelper> RSS Update - forum: Installing problem with WinXP <http://forums.openvpn.net/topic7562.html#p9427>
08:33 < ecrist> :)
08:34 < ecrist> I really doubted your issue was with tunnelblick
08:34 < ecrist> tunnelblick mostly just adds some snazz to the openvpn binary
08:34 < SwK> tunnelblick its pretty easy to use
08:34 < SwK> and the configs I can server generate
08:34 < ecrist> openvpn is pretty stable, not to say there won't be issues, but we don't see major bugs like that often...
08:34 < SwK> cool
08:35 < SwK> the things we do to avoid routing roadblocks lol
08:35 < gladiatr> just have to keep an eye out for the flying monkeys...
08:37 < SwK> now I just has to find a good windows client to use and I'm good thanks guys!
08:37 < gladiatr> openvpn-gui <- :)
08:37 < ecrist> SwK: openvpn packages a windows gui
08:37 < SwK> thanks i go play now... thanks guys
08:38 < ecrist> np
08:38 < gladiatr> It is simple, elegant and it works
08:38 < gladiatr> have fun!
08:38 <@vpnHelper> RSS Update - forum: OpenVPN using TUN on Plugbox <http://forums.openvpn.net/topic7556.html#p9428>
08:38 < SwK> http://openvpn.se/ <-- that the right onw?
08:39 <@vpnHelper> Title: OpenVPN GUI for Windows (at openvpn.se)
08:39 < ecrist> no
08:39 < ecrist> !download
08:39 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
08:39 < SwK> kool thanks
08:43 -!- migrator is now known as embarassment
08:50 -!- dazo is now known as dazo_afk
08:54 <@vpnHelper> RSS Update - forum: help.. <http://forums.openvpn.net/topic7563.html>
08:56 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:05 -!- le0 [~fin@unaffiliated/le0] has quit [Remote host closed the connection]
09:05 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
09:06 -!- dazo_afk is now known as dazo
09:18 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:18 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9430>
09:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:18 -!- Cain` is now known as Cain
09:24 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
09:37 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
09:38 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:38 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
09:45 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:46 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
09:48 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
09:48 -!- SwK [~swk@freeswitch/developer/swk] has quit [Ping timeout: 264 seconds]
09:49 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:49 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:50 -!- SwK [~swk@190.124.45.100] has joined #openvpn
09:50 -!- SwK [~swk@190.124.45.100] has quit [Changing host]
09:50 -!- SwK [~swk@freeswitch/developer/swk] has joined #openvpn
09:53 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
09:56 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
09:59 -!- havoc [~havoc@neptune.chaillet.net] has quit [Read error: Operation timed out]
09:59 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
10:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:11 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:14 -!- p3rror [~mezgani@41.140.152.177] has joined #openvpn
10:16 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
10:18 < pk__> i configured openvpn on a vps host
10:18 < pk__> now i need to enable nat 
10:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:22 -!- p3rror [~mezgani@41.140.152.177] has quit [Ping timeout: 246 seconds]
10:27 -!- teddz [~teddz@dtmd-4db23304.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
10:31 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
10:36 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
10:37 -!- p3rror [~mezgani@41.140.176.236] has joined #openvpn
10:41 -!- embarassment is now known as macsppadic
10:53 -!- SOG [~SOG@222.125.204.83] has joined #openvpn
10:56 < dvl> I pity pleas like this: http://forums.openvpn.net/topic7563.html
10:56 <@vpnHelper> Title: OpenVPN Support Forum help.. : Wishlist (at forums.openvpn.net)
10:56 < dvl> oh wait.. is that the wrong one
10:56 < dvl> Yes, that's the right one.
11:03 -!- p3rror [~mezgani@41.140.176.236] has quit [Ping timeout: 240 seconds]
11:16 -!- p3rror [~mezgani@41.140.46.61] has joined #openvpn
11:16 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
11:25 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
11:26 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
11:26 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Remote host closed the connection]
11:28 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- *I* use it, so it must be good!]
11:31 -!- p3rror [~mezgani@41.140.46.61] has quit [Ping timeout: 240 seconds]
11:37 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:44 < gladiatr> indeed
11:49 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:50 <@vpnHelper> RSS Update - forum: Can I use OpenVPN with a Windows Server domain? <http://forums.openvpn.net/topic7564.html>
11:51 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:04 < pk__> my vpn server's ip is 10.254.0.1 and client's is 10.254.0.6
12:05 < pk__> i have set push "redirect-gateway" in server.conf
12:05 < pk__> when i do ifconfig on client
12:06 < pk__> inet addr:10.254.0.6  P-t-P:10.254.0.5
12:06 < pk__> it shows this
12:06 < pk__> what is this 10.254.0.5
12:09 < ecrist> !/30
12:09 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
12:14 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
12:17 < reiffert>   !iroute
12:17 < reiffert> !route
12:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
12:20 < reiffert> how can I use iroute with static key?
12:22 < gladiatr> hrm... should be able to pick up a default file out of your ccd directory
12:30 < pk__> but as i set NAT on the server shouldn't the client's gateway be 10.254.0.1 instead of 10.254.0.5?
12:31 < pk__> as the server's ip on this virtual network is 10.254.0.1
12:41 -!- grishnav [~grishnav@209.160.52.134] has quit [Remote host closed the connection]
12:45 -!- WinstonSmith [~true@g225024208.adsl.alicedsl.de] has joined #openvpn
12:53 -!- gladiatr is now known as gladiatr_afk
12:54 -!- Shubuntu [~chatzilla@2.176.112.110] has joined #openvpn
12:59 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
13:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:05 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 245 seconds]
13:07 -!- p3rror [~mezgani@41.140.169.72] has joined #openvpn
13:07 <@vpnHelper> RSS Update - forum: ifconfig question <http://forums.openvpn.net/topic7527.html#p9432>
13:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:11 -!- p3rror [~mezgani@41.140.169.72] has quit [Client Quit]
13:11 -!- p3rror [~mezgani@41.140.169.72] has joined #openvpn
13:14 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:16 -!- dazo is now known as dazo_afk
13:25 -!- p3rror [~mezgani@41.140.169.72] has quit [Ping timeout: 240 seconds]
13:31 < Shubuntu> guys why would i get udp port open|filtered and service as unknown from an nmap?
13:31 < Shubuntu> is openvpn not listening correctly then?
13:33 < ecrist> sounds like a firewall is filtering traffic, and nmap probably doesn't know how to speak openvpn's protocol
13:36 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
13:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
13:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 246 seconds]
13:59 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
14:01 -!- Shubuntu [~chatzilla@2.176.112.110] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
14:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:35 < fipu_> !topology
14:35 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
14:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
14:39 < fipu_> hi guys
14:40 < fipu_> I'm using topology subnet and since I use it I can't assign the IP-adress over ccd
14:40 < fipu_> ip-win32 ipapi does not work anymore
14:41 < fipu_> Clients interface does not come up for a long time and I get the error that it completes with errors
14:41 < fipu_> win 2k8 server
14:44 < mete> xD
14:45 < mete> fipu_ miöngi!
14:46 < fipu_> mete: miööööngiiii problem glöst xD
14:46 < fipu_> mete: lauft perfekt jetzt!!!! jede client nur 1 IP und mit ccd
14:46 < fipu_> xDDD
14:46 < fipu_> mete: home tel pls
14:46 < mete> bisch miöngi?
14:46 < fipu_> ja sit ich mit dir chatte
14:47 < mete> du bisch vermöngelet!
14:48 < fipu_> ja weg dir!
14:50 -!- dredd [5d232120@gateway/web/freenode/ip.93.35.33.32] has joined #openvpn
14:51 < dredd> hi
14:52 < dredd> i can't make it to route the traffic to my openvpn even if i use route def-gateway in server...
14:52 < dredd> my openvpn server is behind a router
14:52 < ecrist>  /topic
14:54 -!- teddz [~teddz@dtmd-4db23304.pool.mediaWays.net] has joined #openvpn
14:56 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 265 seconds]
14:58 -!- p3rror [~mezgani@41.140.102.91] has joined #openvpn
15:03 < dredd> anybody here?
15:04 < dvl> dredd: Never start IRC with that.
15:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:04 < dredd> with what?
15:04 < dredd> i didn't start with that look up
15:05 < dvl> http://workaround.org/getting-help-on-irc
15:05 <@vpnHelper> Title: Getting help on IRC | literacy and subtleties for open-source bigots and other weirdos (at workaround.org)
15:06 < dredd> didn't the question come up?
15:06 < dredd> i can't make it to route the traffic to my openvpn even if i use route def-gateway in server...y openvpn server is behind a router
15:09 < dredd> dvl what are you referring to?
15:10 <@vpnHelper> RSS Update - forum: backslash problem VPN fail windows xp client <http://forums.openvpn.net/topic7383.html#p9433>
15:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:16 <@vpnHelper> RSS Update - forum: 3g works router adsl don´t <http://forums.openvpn.net/topic7428.html#p9434>
15:22 -!- p3rror [~mezgani@41.140.102.91] has quit [Ping timeout: 272 seconds]
15:25 < dvl> dredd: no error messages?
15:26 < dvl> have you enabled logging?
15:26 < dredd> simply i'm connected (green)
15:26 < dredd> but when i try to open pages its all blank
15:26 < dredd> i think maybe my open vpn server can't reach its router or forward my packets
15:28 -!- dredd_ [83af0c09@gateway/web/freenode/ip.131.175.12.9] has joined #openvpn
15:28 < dredd_> i have (green connection) no errors routing is successful..
15:28 < dredd_> but anytime i try to open one webpage it stays blank
15:29 < dredd_> the gateway changes to my openvpn server if i check wiht ipconfig /all
15:29 < dvl> perhaps the gateway is not forwarding packets
15:30 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:30 < dredd_> my openvpn server is connected to its gateway router via wireless
15:30 < dredd_> should i set something to forward the packets?
15:31 -!- dredd [5d232120@gateway/web/freenode/ip.93.35.33.32] has quit [Ping timeout: 265 seconds]
15:31 < dvl> dredd: no error messages?
15:31 < dvl> have you enabled logging?
15:31 < dredd_> maybe i should use route add 10.0.0.2 255.255.255.0 192.168.1.2  ?
15:32 < dredd_> no i ve got no error messages?
15:32 < dredd_> no i ve got no error messages
15:34 < dredd_> what do you think?
15:36 -!- WinstonSmith [~true@g225024208.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
15:36 -!- p3rror [~mezgani@41.248.105.152] has joined #openvpn
15:37 < dvl> dredd_: I have no idea what an appropriate route would be for you.  :)
15:37 < dredd_> i don't know too but i didn't use that yet
15:38 < dredd_> my gateway is 192.168.1.1 my openvpn server 192.168.1.2 vpn interface is 10.8.0.1
15:41 < dvl> dredd_: I have this in my openvpn server: push "route 10.34.0.0 255.255.255.0"
15:41 < dredd_> mmh
15:41 < dvl> dredd_: where 10.34.0.0 is the network on the other side of my OVPN
15:42 < dredd_> so you mean your client?
15:42 < dvl> dredd_: This is from my server configuration
15:42 < Bushmills> !ipforward
15:42 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:42 < Bushmills> !nat
15:42 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:42 < dvl> my server configurat also has: server 10.23.34.0 255.255.255.0
15:42 < dredd_> 10.34.0.0 is the interface of the vpn server?
15:43 < Bushmills> dredd_: that's what you need to enable on your server for passing requests to internet through it
15:43 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
15:43 < dvl> dredd_: no.  10.34.0.0 is the network on the other side of my OpenVPN server.... it's what the client will want to connect to.
15:43 < dvl> client --->>> OPENVPN SERVER ->>>> 10.34.0.0
15:44 < dredd_> ok|
15:44 < dredd_> ok!
15:44 < dvl> dredd_: what what Bushmills said
15:44 < dredd_> i'll try with that
15:44 < dvl> dredd_: WATCH what Bushmills said
15:44 < dredd_> yes he told me yesterday
15:45 < Bushmills> hm .. more like 2 minutes ago
15:45 < dredd_> well yes that's the second time you told me :P
15:45 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:46 < Bushmills> oh well. technology hasn't changed so much since then
15:46 < Bushmills> solution is still the same, then
15:46 < dredd_> i guess if i had control over it 
15:47 < dvl> PANIC~!  dredd_ is not in control!  PANIC~!
15:47 < dredd_> hihiih
15:48 < Bushmills> with servers over which you don't have control over, it is actually easier
15:48 < Bushmills> simply ask someone who has to set that up for you.
15:49 < dvl> dredd_: When all else fails, this is how I got what I wanted working. What you want may not be what I wanted.  http://www.freebsddiary.org/openvpn-routed.php
15:49 <@vpnHelper> Title: The FreeBSD Diary -- OpenVPN - creating a routed VPN (at www.freebsddiary.org)
15:52 -!- dredd_ [83af0c09@gateway/web/freenode/ip.131.175.12.9] has quit [Ping timeout: 265 seconds]
15:56 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
16:06 -!- p3rror [~mezgani@41.248.105.152] has quit [Ping timeout: 240 seconds]
16:12 -!- WinstonSmith [~true@f052100153.adsl.alicedsl.de] has joined #openvpn
16:16 <@vpnHelper> RSS Update - forum: Client concurrently using 2 different VPN servers? <http://forums.openvpn.net/topic7565.html>
16:19 -!- p3rror [~mezgani@41.140.176.249] has joined #openvpn
16:28 <@vpnHelper> RSS Update - forum: which is the format of a package created by openvpn? <http://forums.openvpn.net/topic7566.html>
16:29 -!- p3rror [~mezgani@41.140.176.249] has quit [Ping timeout: 240 seconds]
16:33 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:35 < Essobi> So.. Why doesn't openvpn support serving up more then one non-contiguous address space?
16:41 < krzee> you mean 2 seperate ifconfig-pool's?
16:42 -!- p3rror [~mezgani@41.140.47.107] has joined #openvpn
16:42 < fipu_> Hi guys
16:42 < fipu_> Get a strange error at trying import my config
16:42 < fipu_> "IMPORT_ERROR: Profile or its references could not be read"
16:42 < krzee> import your config into what...?
16:42 < fipu_> into vpn client
16:42 < fipu_> sorry
16:43 < fipu_> for missing information
16:43 < krzee> what vpn client...?
16:43 < fipu_> openvpn
16:43 < krzee> ohhh
16:43 < krzee> access-server
16:43 < krzee> heh
16:43 < krzee> we dont support access-server here
16:43 < krzee> community openvpn doesnt have some special client
16:43 < krzee> the same app is server AND client, depending on your config file
16:43 < krzee> however, access-server does have that stuff
16:43 < krzee> !AS
16:43 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
16:43 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
16:44 < fipu_> I have this one with the gui
16:44 < fipu_> for windows
16:46 < fipu_> ok, no problem, I try it with openVPN gui
16:46 < fipu_> normal windows client
16:46 < fipu_> not that crappy one from access server
16:47 < fipu_> on windows server 2008 that one from access server works too
16:47 < fipu_> but not on wsk3 :P
16:47 < fipu_> "w2k3"
16:47 -!- p3rror [~mezgani@41.140.47.107] has quit [Ping timeout: 265 seconds]
17:00 -!- grishnav [~grishnav@174.138.170.75] has joined #openvpn
17:18 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
17:22 < fipu_> have a question again :P
17:23 < fipu_> I have two Clients, one with 172.16.1.2 and the other one with 172.16.1.3, no I want to create an iptables rule to deny ssh from client1 to client2
17:23 < fipu_> (deny port 22)
17:23 < fipu_> how can I do that?
17:23 < fipu_> which chain should I use?
17:23 < fipu_> INPUT with interface tun0?
17:25 < krzee> are you using client-to-client in your server config?
17:26 < krzee> but really your question has nothing to do with openvpn
17:26 < fipu_> yes
17:26 < krzee> !iptables
17:26 <@vpnHelper> "iptables" is (#1) o test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT;, or (#2) then run iptables -F, iptables -Z after being SURE policies are set to accept, or (#3) please see http://openvpn.net/man#lbBD for more info, or (#4) see http://www.secure-
17:26 <@vpnHelper> computing.net/wiki/index.php/OpenVPN/Firewall
17:26 < fipu_> I'm using client-to-client
17:26 < fipu_> krzee: not directly, yes
17:26 < krzee> hrm, thought there was a netfilter link in there
17:26 < krzee> if you want to do the filtering on the server, you cant use client-to-client
17:27 < krzee> if you want the client to be running his own firewall, then you can
17:27 < krzee> !c2c
17:27 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
17:27 <@vpnHelper> clients
17:27 < fipu_> ah ok
17:27 < fipu_> so I can disable it and create iptables forward rules
17:27 < fipu_> from each ip to the other
17:27 < fipu_> right?
17:27 < krzee> sounds right
17:27 < fipu_> ok, thank you
17:27 < fipu_> I try it
17:35 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 272 seconds]
17:41 < fipu_> krzee: does not work. without client-to-client I can not access 172.16.1.3 from 172.16.1.2. I used this iptables rule: iptables -A FORWARD -i tun0 -s 172.16.1.2 -d 172.16.1.3 -j ACCEPT
17:41 < fipu_> Do you have an idea?
17:43 < fipu_> mhh
17:44 < fipu_> or someone else?
17:45 < krzee> fix your firewall
17:45 < krzee> and i dunno the rules you need
17:46 < krzee> but i do know its for sure iptables, not openvpn
17:48 < reiffert> how to find the oldest and the most recent directory?
17:50 < reiffert> ls -t | tail -1 || head -1
17:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:10 -!- grishnav [~grishnav@174.138.170.75] has left #openvpn []
18:15 < arnotixe> krzee, OK I did an honest attempt on adding a NAT-HACK page to the wiki https://community.openvpn.net/openvpn/wiki/NatHack  Sorry about the formatting, maybe someone will fix it later :D
18:15 <@vpnHelper> Title: NatHack – OpenVPN Community (at community.openvpn.net)
18:18 < krzee> ahh cool you put this in it too
18:18 < krzee> !winipforward
18:18 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
18:21 < krzee> thanks, very nice
18:21 < krzee> ill clean it up a little, but that is great
18:26 < reiffert> is there something in shell that generates the string "1 2 3 4 5" when I throw "5" at it?
18:27 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
18:27 < reiffert> seq 5
18:28 < reiffert> jot for the bsds
18:28 < krzee> WHOA
18:28 < krzee> never knew bout jot
18:29 < krzee> i used {1..5}
18:29 < reiffert> jot is somewhat different to seq. keep it in mind.
18:29 < krzee> right jot inserts a \n it seems
18:29 < reiffert> na, the paramters differ.
18:29 < krzee> ahh that too
18:30 < reiffert> seq 5
18:30 < reiffert> equals jot 1 1 5
18:30 < reiffert> or something
18:30 < krzee> but if seq 5 outputs "1 2 3 4 5"
18:30 < krzee> thats different
18:30 < krzee> jot gives newlines
18:30 < reiffert> I can live with the newlines
18:30 < krzee> cool
18:30 < reiffert> a=5; inc=0; for i in $(seq $a); do dow=$(date +"%u" -d "-$i day"); if [ $dow -eq "7" ]; then inc=1; fi; done; echo inc:$inc
18:31 < krzee> that doesnt need to be portable, right?
18:31 < krzee> besides seq, the date command would change
18:32 < reiffert> it is expect the seq and date part.
18:32 < reiffert> :)
18:32 < krzee> cool
18:32 < reiffert> and on Macports I port install gnuutils
18:32 < reiffert> or gnucore or something 
18:35 < krzee> oh cool
18:35 -!- teddz [~teddz@dtmd-4db23304.pool.mediaWays.net] has quit [Quit: Ex-Chat]
18:36 < reiffert> I have to install rsync on OS X, so theres no differnce in additionally installing the gnu stuff
18:38 < krzee> the seq part could be replaced with for i in {1..$a}, but date would still keep it gnu
18:38 < reiffert> I tried, it breaks things:
18:38 < reiffert> camerasrv:/var/www/kamera# a=5; inc=0; for i in {1..$a}; do dow=$(date +"%u" -d "-$i day"); if [ $dow -eq "7" ]; then inc=1; fi; done; echo inc:$inc
18:38 < reiffert> date: invalid date `-{1..5} day'
18:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:39 < reiffert> dontaskme why, cause this one works:
18:39 < reiffert> for i in {1..5}; do echo i:$i; done
18:40 < reiffert> where as:
18:40 < reiffert>  a=5; for i in {1..$a}; do echo i:$i; done
18:40 < reiffert> i:{1..5}
18:40 < krzee> ahh
18:42 -!- anitxor [~xor@cryptoanarchy.org] has joined #openvpn
18:44 < anitxor> hai. i am using "auth-user-pass-verify /bin/true via-env" to make clients connect without having to give any real password or username at all, but i am having troubles with the client complaing about 
18:44 < anitxor> Fri Jan 28 01:44:03 2011 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
18:44 < anitxor> Fri Jan 28 01:44:03 2011 TLS Error: TLS object -> incoming plaintext read error
18:45 < anitxor> i double-checked the certificate ca.crt and remade the server certificate twice :|
18:45 < anitxor> any ideas?
18:45 < krzee> i guess that just doesnt work
18:45 < krzee> [16:44]  <krzee> # a=5; for i in {1..$a}; do echo $i; done
18:45 < krzee> [16:44]  <evalbot> krzee: {1..5}
18:45 < krzee> [16:44]  <krzee> =/
18:45 < krzee> [16:44]  <e36freak> !{
18:45 < krzee> [16:44]  <greybot> range and choice notation: {a,b,c}1 and {a..c}1 both expand to a1 b1 c1, {a..c}{1..3} expands to a1 a2 a3 b1 b2 b3 c1 c2 c3
18:45 < krzee> [16:44]  <e36freak> bah
18:45 -!- krzee was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
18:45 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
18:45 < krzee> [16:44]  <e36freak> use a C style foor loop
18:45  * krzee fights vpnHelper 
18:48 < anitxor> http://pastebin.com/5regkgnQ <-- if someone wish to help me, here is the config files :)
18:48 < krzee> anitxor, why even use auth-user-pass-verify???
18:48 < krzee> that makes NO sense
18:49 < anitxor> ok :O so it seems that i misunderstood it then :)
18:49 < krzee> whats your goal?
18:49 < anitxor> what should i do to make it accept all clients, without them passing any certificates?
18:49 < anitxor> the purpose of this server is not to validate the clients, but to just give them a vpn tunnel. no matter what.
18:50 < krzee> !authpass
18:50 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
18:50 < krzee> just use --client-cert-not-required
18:50 < krzee> dont bother adding password protection
18:51 < anitxor> only that, no --auth-user-pass-verify?
18:51 < anitxor> ok, testing :)
18:51 < anitxor> thanks for looking into this case :D
18:52 < krzee> np
18:52 < krzee> right, no reason to add password protection if you dont want password protection
18:53 < anitxor> Options error: No client-side authentication method is specified.  You must use either --cert/--key, --pkcs12, or --auth-user-pass
18:55 < krzee> ohh i just thought of something too
18:55 < anitxor> :)?
18:55 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
18:55 < krzee> if they dont have a cert or a login, how would your server know what their common-name is
18:56 -!- SOG [~SOG@222.125.204.83] has quit [Quit: SOG]
18:56 < anitxor> when i used /bin/true as the user-validating script it "almost worked", except it failed when the client tried to verify the servers certificate for some reason
18:57 < krzee> oh
18:57 < anitxor> the clients will have to enter some random strings for user and pass, but its ok i guess
18:57 < krzee> then keep that there and add the line i gave you
18:57 < anitxor> but it had --client-cert-not-required already :) the problem was with the client not accepting the servers certificate
18:58 < anitxor> thanks for helping btw :D :D
19:00 < krzee> so what was the error?
19:01 < anitxor> http://pastebin.com/vna6VVyJ
19:01 < anitxor> i made a new pastebin with the logfiles also :)
19:04 < krzee> oh wait so you can use certs
19:04 < krzee> !dupe
19:04 <@vpnHelper> "dupe" is see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended)
19:04 < anitxor> using the same key is not secure at all :[
19:04 < krzee> umm
19:04 < krzee> are you trying to use NO key!?
19:05 < anitxor> i am thinking that the openVPN server is like a https server. we dont care about the clients, but only the server.
19:05 < anitxor> at least, same security consideration
19:05 < krzee> umm
19:05 < krzee> you are thinking wrong
19:05 < anitxor> oh :O plz inform me :D :D 
19:05 < krzee> very very wrog
19:06 < krzee> *wrong*
19:07 < anitxor> the idea i have is that anyone should be able to connect without me having to build a huge certificate factory that automatically ships lots of files to the clients. they should be able to just download a tarfile and use it, and every client should receive its own key. just like https
19:07 < krzee> umm
19:07 < krzee> so i should be able to connect?
19:07 < anitxor> yes
19:07 < krzee> but you dont know me
19:07 < anitxor> i dont care
19:08 < anitxor> chaosnet, for immediate deployment. information must be free.
19:08 < krzee> then why do you care if i have the client key that EVERYONE uses?
19:08 -!- diphthong [~diphthong@69.172.135.243] has quit [Ping timeout: 240 seconds]
19:08 < anitxor> because ppl will be able to listen in on what you are saying. you should be able to be anonymous in the eyes of authorities.
19:09 < krzee> ahh ok
19:09 < krzee> Fri Jan 28 02:00:07 2011 VERIFY ERROR: depth=0, error=certificate is not yet valid: /C=ZZ/ST=ZZ/L=ZZ/O=ZZ/CN=luxembourg/emailAddress=dont@mail.
19:09 < krzee> well theres your error
19:09 < anitxor> ppl are being killed and tortured in egypt because they are twittering "bad" sentences. now they shut down the countries network, but some other countries also need VPNs
19:09 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
19:09 < krzee> one of these 3 machines has a time that is wrong
19:09 < anitxor> oh! :D
19:09 < krzee> a) client b) server c) CA
19:10 < anitxor> but the CA is not even connected :O
19:10 < krzee> it signed the cert
19:10 < anitxor> ahaaaa... not yet valid :D
19:10 < krzee> (and said when the sig is valid)
19:10 < anitxor> i see! :D :D :D :D :D :D
19:10 < anitxor> T H A N K S :D :D
19:10 < krzee> yw
19:11 < anitxor> :D
19:11  * anitxor hugs krzee 
19:13 < Bushmills> reiffert:  [[ $n_days > $(date +%w) ]] && echo "includes sunday"
19:14 < krzee> i <3 [[ for not needing ""
19:15 < Bushmills> ((n_days > $(date +%w)))
19:15 < Bushmills> better
19:17 < Bushmills> made new friends, krzee?
19:17 < anitxor> krzee is awesum
19:17 < krzee> hehe
19:17 < Bushmills> not when he's sober
19:18  * krzee tries to remember when that was
19:18 < krzee> oh right, before vacation started ;]
19:18 < Bushmills> that was when you were preoccupied with where to get a beer from
19:27 < reiffert> fail for basic math.
19:31 < reiffert> :q
19:31 < Bushmills> yes, all those tricky symbols :P
19:44 < reiffert> thanks
19:53 -!- SOG [~SOG@183.11.157.152] has joined #openvpn
19:54 -!- SOG [~SOG@183.11.157.152] has quit [Client Quit]
19:55 -!- cj [~cjac@adsl-207-32-175-232.rockisland.net] has quit [Ping timeout: 255 seconds]
19:56 -!- cj [~cjac@adsl-207-32-175-232.rockisland.net] has joined #openvpn
20:11 -!- p3rror [~mezgani@41.140.26.196] has joined #openvpn
20:19 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
20:28 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
20:29 -!- zeshoem [~mnathani@70.52.168.144] has quit []
20:43 -!- p3rror [~mezgani@41.140.26.196] has quit [Ping timeout: 260 seconds]
20:45 <@vpnHelper> RSS Update - forum: Windows 7 OpenVPN client connection issue <http://forums.openvpn.net/topic7567.html>
20:50 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
21:06 -!- master_of_master [~master_of@p57B55D51.dip.t-dialin.net] has quit [Ping timeout: 272 seconds]
21:07 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:07 -!- master_of_master [~master_of@p57B560B2.dip.t-dialin.net] has joined #openvpn
21:11 -!- nb_ [~nb@fedora/nb] has joined #openvpn
21:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
22:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:23 < arnotixe> !linnat
22:23 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
22:40 < arnotixe> krzee, ok I fixed up the nathack page a bit, formatting and adding linux server setup examples.
22:40 <@vpnHelper> RSS Update - forum: help.. <http://forums.openvpn.net/topic7563.html#p9438>
22:48 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
22:58 <@vpnHelper> RSS Update - forum: clean-all.bat errors <http://forums.openvpn.net/topic7568.html>
23:08 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
23:14 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
23:31 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 240 seconds]
23:31 -!- twister004 [~chatzilla@117.207.240.40] has joined #openvpn
23:45 -!- twister004_ [~chatzilla@mail2.polariswireless.com] has joined #openvpn
23:45 -!- twister004 [~chatzilla@117.207.240.40] has quit [Ping timeout: 240 seconds]
23:45 -!- twister004_ is now known as twister004
--- Day changed Fri Jan 28 2011
00:04 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
00:05 -!- twister004 [~chatzilla@mail2.polariswireless.com] has quit [Ping timeout: 240 seconds]
00:05 -!- twister004_ is now known as twister004
00:22 -!- holopaw [~holopaw@206.125.175.3] has joined #openvpn
00:28 < holopaw> !welcome
00:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:28 < holopaw> !route
00:28 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
00:28 < holopaw> !redirect
00:29 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
00:29 < holopaw> !def1
00:29 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
00:32 < holopaw> !logs
00:32 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
00:32 < holopaw> !pb
00:32 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
00:35 -!- holopaw_ [~holopaw@184.91.54.112] has joined #openvpn
00:36 -!- zeshoem [~mnathani@70.52.168.144] has joined #openvpn
00:36 < zeshoem> I have connected to a Linux Open VPN server from a Linux Client, but internet traffic is not going through the VPN tunnel
00:36 < zeshoem> how can I troubleshoot this?
00:36 < krzee> !redirect
00:36 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
00:37 < krzee> you are missing 1 or more of those
00:37 < zeshoem> !ipforward
00:37 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
00:37 < zeshoem> !linipforward
00:37 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
00:38 < zeshoem> !nat
00:38 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
00:38 -!- holopaw [~holopaw@206.125.175.3] has quit [Ping timeout: 264 seconds]
00:38 < zeshoem> !linnat
00:38 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
00:38 -!- mosno [~mosno@unaffiliated/mosno] has quit [Ping timeout: 240 seconds]
00:39 < zeshoem> Doesnt the webinterface configure the nat part for you?
00:39 < holopaw_> ok, my nat works fine, im able to redirect all traffic but in the client log its saying the routes are failing and im not sure if i should be concerned about this http://openvpn.pastebin.ca/2040720
00:41 -!- loa [~loa@46.147.4.60] has quit [Read error: Connection reset by peer]
00:42 < zeshoem> Thu Jan 27 20:31:27 2011 NOTE: unable to redirect default gateway -- Cannot read current default gateway from system
00:42 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
00:46 < krzee> zoobab, web interface doesnt exist in openvpn, you must be talking about access-server
00:46 < krzee> !AS
00:46 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
00:46 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
00:46 < krzee> i meant zeshoem ^
00:46 < krzee> see #4 for access-server help
00:48 < krzee> holopaw_, in the config with the errors try this
00:48 < krzee> route-method exe
00:48 < krzee> if that doesnt work, trial and error with these:  http://openvpn.net/index.php/open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html
00:49 < krzee> !winroute
00:49 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin
00:49 < krzee> !learn winroute add http://openvpn.net/index.php/open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html   you might also want to see that and use trial and error with those solutions
00:49 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
00:49 < krzee> !learn winroute as http://openvpn.net/index.php/open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html   you might also want to see that and use trial and error with those solutions
00:49 <@vpnHelper> Joo got it.
00:50 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:50 -!- mode/#openvpn [+o mattock] by ChanServ
01:12 < zeshoem> my openvpn server is on a linux box with a dynamic Public IP (DSL) I am using Access Server. How do I go about setting the default route?
01:12 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:12 < krzee> zeshoem, by going here for professional access-server support
01:13 < krzee> it comes with access-server
01:13 < krzee> http://openvpn.net/index.php/access-server/support-center.html
01:13 <@vpnHelper> Title: Support Center (at openvpn.net)
01:14 < krzee> this channel is for the community version
01:14 < zeshoem> If I want to use openvpn without the access server do I need to hand code the config files?
01:14 < krzee> depends
01:14 < krzee> whats your goal?
01:14 < zeshoem> There are 3 stages to my goal at this point
01:15 < zeshoem> First stage is 2 linux boxes, with 2 public internet addresses and establish Open VPN. Use Internet IP of 2nd box while browsing from the first box
01:15 < krzee> ok
01:15 < krzee> stage 2?
01:16 < zeshoem> Stage 2 is a windows box hooked up to the linux client from stage 1 and be able to use the linux server ip you can say NAT
01:17 < zeshoem> Stage 3 is best represented by a diagram.
01:17 < krzee> you meant linux server i assume
01:17 < krzee> and thats the EXACT same thing as stage 1
01:17 < krzee> the only normal difference between a windows config and linux config is the paths
01:18 < krzee> sometimes windows needs help getting routes to work, but thats case by case
01:18 < zeshoem> no the win box will use the linux client as the gateway
01:18 < zeshoem> and the linux client will talk to openvpn server
01:18 < krzee> so a client using another client's internet IP?
01:18 < zeshoem> yes
01:19 < krzee> more difficult, but can be done
01:19 < zeshoem> Stage 3: http://mnathani.com/DualNetworkVPN.jpg
01:19 < zeshoem> Stage 3 can not use NAT, needs to route all ips 
01:20 < krzee> you must NAT on the server to use internet IP through gateway
01:20 < krzee> unless you have IPs to spare on the server
01:20 < krzee> then you assign the whole subnet
01:20 < zeshoem> Stage 3 will not route internet traffice through VPN
01:21 < zeshoem> only the specific subnets
01:21 < krzee> LAN subnets?
01:21 < zeshoem> Lan subnets, yes
01:21 < krzee> ok...
01:21 < krzee> all stages start with:
01:21 < krzee> !sample
01:21 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
01:21 < krzee> !pki
01:21 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
01:21 <@vpnHelper> specially as a server (see !servercert)
01:22 < krzee> stage 1:
01:22 < krzee> !!redirect
01:22 < krzee> !redirect
01:22 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
01:22 < krzee> stage 3:
01:22 < krzee> !route
01:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
01:22 < krzee> stage 2, finish the above 2 and we'll talk ;]
01:23 < zeshoem> I am very new to OpenVPN
01:23 < zeshoem> I appreciate your patience
01:23 < zeshoem> Thank you
01:23 < krzee> np
01:23 < zeshoem> I have a lot of reading ahead of me
01:23 < krzee> yep
01:23 < krzee> already understand some networking?
01:23 < zeshoem> I understand the concepts
01:24 < zeshoem> its the specifics of how Openvpn does things and needs to be configured thats challenging at this point
01:24 < krzee> thats the easy part if you understand the other stuff
01:24 < krzee> like when/why nat is needed and how to use it
01:24 < krzee> !linnat
01:24 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
01:24 < krzee> especially how routing works
01:25 < krzee> any of the openvpn specific stuff regarding routing is in !route
01:25 < zeshoem> Nat is like when your destination network is not going to know how to get back to you if you send a packet with your real ip
01:25 < krzee> yep, src address impersonation
01:25 < zeshoem> so you have to use an IP it can return a response to
01:26 < krzee> ip forwarding is needed any time packets need to pass from 1 interface to another
01:27 < krzee> so basically, in all 3 stages
01:27 < krzee> !linipforward
01:27 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
01:27 < krzee> or
01:27 < krzee> if you wanna pay for access-server, it will support stages 1 and 3 for sure, dunno bout stage 2
01:28 < krzee> and they will help you with any setup with a web gui
01:28 < krzee> and professional support
01:29 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
01:29 < zeshoem> I didnt even realize there were 2 different packages. 
01:29 < krzee> yep
01:29 < krzee> professional version and community version
01:29 < zeshoem> I was confused cos OpenVpn is at version 2 something
01:30 < zeshoem> and the web kept saying 1.6 something
01:30 < krzee> right, but both are based on openvpn 2 source
01:30 < krzee> community version is more configurable, access-server is a wrapper of sorts for the community version if i understand it right
01:31 < krzee> but it does more, makes things easier for the user
01:31 < krzee> oh not just a wrapper, theres a bunch of patches i think i remember hearing
01:31 < krzee> but i dont know much about access-server
01:32 < krzee> its not hard to make the setups by hand if you understand networking
01:32 < krzee> the manual is GREAT
01:32 < zeshoem> does it require a lot of Iptables
01:32 < krzee> nope
01:33 < krzee> gotta allow the tun interface to forward, gotta setup NAT which is at !linnat
01:33 < krzee> theres an iptables section in the openvpn manual
01:33 < krzee> !man
01:33 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
01:33 < krzee> !download
01:33 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
01:34 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:36 < zeshoem> I am at the point for generating master CA cert and key
01:36 < zeshoem> but I dont get " Next, initialize the PKI. On Linux/BSD/Unix:"
01:37 < zeshoem> whats . ./vars ?
01:37 < krzee> [23:37]  <krzee> !source
01:37 < krzee> [23:37]  <greybot> ''source <script>'' or ''. <script>'' reads and executes the commands from <script> into the current shell, only one script per invocation the rest is passed as arguments to it
01:38 < krzee> (in #bash ;])
01:38 < zeshoem> ok .. but which folder should I be in
01:38 < zeshoem> I am not sure where openvpn got installed
01:38 < krzee> find / -name easy-rsa
01:40 < zeshoem> looks like its not installed
01:41 < zeshoem> I unzipped the tar, but got distracted installed a dependecy
01:53 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
01:54 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
01:54 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:03 < zeshoem> I got my first non Access server connection working
02:13 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9440>
02:15 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Ping timeout: 276 seconds]
02:18 < zeshoem> !nat
02:18 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
02:18 < zeshoem> !linnat
02:18 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
02:28 < zeshoem> Back with the same:  NOTE: unable to redirect default gateway -- Cannot read current default gateway from system
02:28 < zeshoem> I have redirect-gateway configured
02:32 < krzee> post the config, routing table, and logfile on a pastebin
02:32 < zeshoem> k
02:34 -!- SwK [~swk@freeswitch/developer/swk] has quit [Ping timeout: 240 seconds]
02:35 -!- dazo_afk is now known as dazo
02:37 < zeshoem> http://pastebin.com/C5EA55gb
02:39 < zeshoem> Here is my Ifconfig http://pastebin.com/zCNCkLwc
02:39 < zeshoem> I should mention I am using a virtuozzo Virtual Private Server
02:40 -!- SwK [~swk@freeswitch/developer/swk] has joined #openvpn
02:40 < krzee> !logfile
02:40 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
02:41 < krzee> that was your status file, not logfile
02:42 < krzee> you have
02:42 < krzee> user vpn
02:42 < krzee> group vpn
02:42 < krzee> you made that user/group?
02:42 < zeshoem> I did
02:42 < krzee> ok
02:42 < zeshoem> The VPN works
02:42 < zeshoem> its the route all internet traffic 
02:42 < krzee> post the logfile
02:43 < krzee> SwK, hey man
02:43 < zeshoem> I cant find it
02:43 < krzee> !logfile
02:43 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
02:43 < zeshoem> guess I will put log in my config
02:48 < zeshoem> Here comes the log file >>  http://pastebin.com/TyVpukJi
02:48 -!- twister004 [~chatzilla@59.90.34.167] has quit [Read error: Connection reset by peer]
02:49 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
02:50 -!- twister004_ is now known as twister004
02:51 -!- loa [~loa@46.147.10.68] has joined #openvpn
02:56 -!- hid3 [~tst@lan-78-157-71-116.vln.skynet.lt] has left #openvpn []
03:08 < krzee> client log please
03:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:11 < zeshoem> sec
03:14 < zeshoem> http://pastebin.com/MLCELkJ0
03:14 < reiffert> moin
03:14 < krzee> moin
03:14 < zeshoem> Mornin
03:17 < reiffert> tunnelblick on osx running on 100% cpu. I stopped it.
03:17 < reiffert> 1s later Thunderbird runs on 100% cpu
03:17 < reiffert> wtf?
03:23 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9441>
03:23 < krzee> reiffert, weird
03:24  * krzee checks the excuse of the day calendar
03:33 < reiffert>  :)
03:35 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9442>
03:36 < krzee> !learn nathack as see  https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
03:36 <@vpnHelper> Joo got it.
03:50 < krzee> zeshoem, ohhh its ppp0
03:50 < krzee> i think ive seen this before
03:52 < krzee> http://permalink.gmane.org/gmane.network.openvpn.user/29555
03:52 <@vpnHelper> Title: redirecting all traffic over a 3G connection (at permalink.gmane.org)
03:52 < zeshoem> how do you mean
03:52 -!- WinstonSmith [~true@f052100153.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
03:53 -!- WinstonSmith [~true@f052100153.adsl.alicedsl.de] has joined #openvpn
03:53 < zeshoem> redirect-gateway local then?
03:54 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:54 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
03:57 -!- WinstonSmith [~true@f052100153.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
03:58 -!- WinstonSmith [~true@f052100153.adsl.alicedsl.de] has joined #openvpn
04:00 < zeshoem> I dont have any Iptable Rule currently to allow nat
04:00 < zeshoem> you mentioned TUN needs nat enabled
04:00 < zeshoem> earlier
04:01 < krzee> its not that tun needs nat
04:02 < krzee> its that when you want to redirect traffic out to the net over the vpn, you send your traffic with the VPN ip as your src
04:03 < krzee> if that VPN IP is not inet routable, you need NAT... just like when in a LAN
04:04 < zeshoem> Now will that NAT occur on the client side or the server side?
04:05 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:05 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:05 < zeshoem> if you saw my interfaces from ifconfig I dont know what Nat rule to apply
04:05 < krzee> server, hes the only one with an interface on the subnet you want to NAT as
04:05 < zeshoem> my Server Ifconfig http://pastebin.com/zCNCkLwc
04:08 < zeshoem> could this be a permission issue
04:08 < zeshoem> as openvpnclient is running as www who does not have rights to modify routing table?
04:08 < krzee> it adds routes before dropping privs
04:10 < krzee> when you go to the above link, look at the thread to the left
04:10 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
04:11 < krzee>  Jan Just Keijser is definitely someone to pay attention to
04:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
04:14 -!- mode/#openvpn [+o mattock] by ChanServ
04:18 < zeshoem> Apparantly they made a patch back then
04:18 < zeshoem> but its surprising that 3 years later its still an issue
04:18 < krzee> point me to the patch?
04:19 < zeshoem> http://readlist.com/lists/lists.sourceforge.net/openvpn-users/2/11004.html
04:19 <@vpnHelper> Title: Re: openvpn and ppp - ReadList.com (at readlist.com)
04:19 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
04:19 < zeshoem> The actual file is no longer online Oops! This link appears to be broken.
04:19 < krzee> mattock, ping
04:20 <@mattock> krzee: pong
04:20 < krzee> ^
04:20 < zeshoem> regular table tennis huh
04:20 < krzee> could be good meeting topic :)
04:20 -!- bragon [~Alexandre@81.93.247.165] has quit [Ping timeout: 265 seconds]
04:21 -!- bragon [~Alexandre@81.93.247.165] has joined #openvpn
04:23 <@mattock> oh, quite long post :)
04:27 -!- le0 [~fin@87.112.250.227] has joined #openvpn
04:27 -!- le0 [~fin@87.112.250.227] has quit [Changing host]
04:27 -!- le0 [~fin@unaffiliated/le0] has joined #openvpn
04:31 < zeshoem> http://readlist.com/lists/lists.sourceforge.net/openvpn-users/2/10999.html
04:31 <@vpnHelper> Title: Re: openvpn and ppp - ReadList.com (at readlist.com)
04:31 < zeshoem> that link shows the diff for the patch
04:32 < zeshoem> not sure if it can be rolled into one for current versions
04:35 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
04:43 -!- le0 [~fin@unaffiliated/le0] has quit [Quit: Leaving]
04:49 <@dazo> zeshoem: can you please explain me briefly why you think that patch is needed?
04:49 -!- mosno [~mosno@unaffiliated/mosno] has quit [Read error: Connection reset by peer]
04:49  * dazo struggles to follow the long scrollback
04:50 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
04:50 -!- WinstonSmith [~true@f052100153.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
04:51 -!- WinstonSmith [~true@f052100153.adsl.alicedsl.de] has joined #openvpn
04:52 -!- ucekpolish [~ucek@217.153.248.118] has joined #openvpn
04:54 -!- alhadi [~thunderst@92.99.142.66] has quit [Ping timeout: 260 seconds]
04:54 < zeshoem> I cant get redirect-gateway to work. krzee suggested that its a ppp0 issue and pointed me to that thread
04:54 < zeshoem> where a lot of other users are having similare issues on DSL / wireless modem type links
04:55 < zeshoem> They seemed to have got something working back then
04:56 <@dazo> zeshoem: so it doesn't detect default gateway when ppp0 is used together with --redirect-gateway?
04:59 < zeshoem> Thats right
04:59 < zeshoem> even the redirect-gateway local option doesnt work
05:02 -!- alhadi [~thunderst@92.96.199.17] has joined #openvpn
05:03 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has joined #openvpn
05:04 <@dazo> zeshoem: okay, I'll try to see if I can test this out ... my N900 turns up as a ppp0 device now, so that should make a test case pretty close to what you see
05:06 < zeshoem> I must warn you that I am a new OpenVPN user, so chances are I fudged some config
05:08 -!- alhadi [~thunderst@92.96.199.17] has quit [Ping timeout: 240 seconds]
05:10 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:12 <@dazo> zeshoem: that's why I want to test it out myself first, as I want to see if it works or not with ppp0
05:12 <@dazo> zeshoem: I used openvpn with ppp0 device yesterday, but that was without redirect-gateway
05:15 -!- alhadi [~thunderst@dxb-as73836.alshamil.net.ae] has joined #openvpn
05:15 <@vpnHelper> RSS Update - forum: Using OpenVPN on a domain controlled laptop <http://forums.openvpn.net/topic7569.html>
05:33 <@vpnHelper> RSS Update - forum: Using OpenVPN on a domain controlled laptop <http://forums.openvpn.net/topic7569.html#p9444>
05:35 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
05:35 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
05:35 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:55 < alhadi> 1 x OpenVPN 2 Cookbook: RAW
05:55 < alhadi>  1 x OpenVPN 2 Cookbook: RAW [eBook] 
05:56 < alhadi> ordering :)
06:01 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has joined #openvpn
06:02 -!- alhadi [~thunderst@dxb-as73836.alshamil.net.ae] has quit [Ping timeout: 240 seconds]
06:07 -!- ucekpolish [~ucek@217.153.248.118] has quit [Ping timeout: 260 seconds]
06:09 -!- alhadi [~thunderst@dxb-as73208.alshamil.net.ae] has joined #openvpn
06:22 -!- ucekpolish [user@lodz.ostc-pl.com] has joined #openvpn
06:25 -!- alhadi [~thunderst@dxb-as73208.alshamil.net.ae] has quit [Quit: alhadi]
06:32 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has quit [Read error: Operation timed out]
06:35 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
06:43 -!- s7r [~s7r@89.39.174.74] has joined #openvpn
06:56 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
06:56 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
06:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:04 -!- ucekpolish [user@lodz.ostc-pl.com] has quit [Ping timeout: 255 seconds]
07:10 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
07:33 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has quit []
07:37 -!- grapsus [~grapsus@acces1031.res.insa-lyon.fr] has quit [Remote host closed the connection]
07:37 <@vpnHelper> RSS Update - forum: logout - dead link <http://forums.openvpn.net/topic7437.html#p9445>
07:41 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
07:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:51 -!- WinstonSmith [~true@f052100153.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
08:04 -!- WinstonSmith [~true@f052101160.adsl.alicedsl.de] has joined #openvpn
08:13 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
08:27 < ecrist> !debian
08:29 < ecrist> !learn debian as Although we are aware the Debian stable package repository has OpenVPN 2.1rc11, to offer support, we require users to run the current version of OpenVPN.  See !download for information on where/how to obtain a recent release.
08:29 <@vpnHelper> Joo got it.
08:35 < hyper_ch> awwww :(
08:35 < hyper_ch> ecrist: you know that squeeze will be become stable in two weeks?
08:37 <@dazo> is it announced?
08:37 < hyper_ch> so in two weeks it will be v. 2.1.3-2 in debian stable :)
08:37 < hyper_ch> (is that any better?)
08:38 <@dazo> if it's not announced, we can't be really sure, can we? ;-)
08:38 < hyper_ch> it was announced
08:40 <@dazo> goodie :)
08:40 < hyper_ch> http://lists.debian.org/debian-devel-announce/2011/01/msg00003.html
08:40 <@vpnHelper> Title: Release Update: timings, status and awesomeness (at lists.debian.org)
08:41 <@dazo> 2.1.3 is good for now, as I believe the debian 2.1.3-2 == 2.1.4
08:41 < hyper_ch> http://packages.debian.org/squeeze/openvpn
08:42 <@vpnHelper> Title: Debian -- Details of package openvpn in squeeze (at packages.debian.org)
08:42 <@dazo> but hopefully soon, we're going to have 2.2-RC out the door (it's been held back due to challenging issues with Windows builds) ... so in a month or two, we might have released 2.2.0
08:42 < hyper_ch> oh noes... another 3 years or so until debian updates again ;)
08:42 < hyper_ch> dazo: you're a dev?
08:42 <@dazo> heh
08:43 <@dazo> I'm quite involved in the 2.2 stuff, yeah .... I'm the maintainer of openvpn-testing.git
08:44 < hyper_ch> what would be great is if openvpn would establsih secured tunnels between two clients so that not all traffic has to go through the server
08:44 < hyper_ch> would that be feasible somehow?
08:45 <@dazo> hyper_ch: yeah ... it's just so darn challenging to tackle in a good way, with authentication of the clients between each other and so on ... in theory, it makes sense and sounds easy ... but implementing it ... woohaaa, that's something to look at for openvpn3 
08:46 < ecrist> what is squeeze?
08:46 <@dazo> the code name for Debian 6
08:46 < hyper_ch> well, I don't know much about cryptography (except it's an aweful lot of maths) and neither about network protocols (except they are important), ........
08:47 < hyper_ch> ecrist: I assume you don't use debian much?
08:47 <@dazo> hyper_ch: ecrist == FreeBSD ... and you can probably add "only" infront of it too ;)
08:47 < ecrist> not at all
08:48 < ecrist> naw, I use a Mac, too. ;)
08:48 < hyper_ch> OpenBSD
08:48 < hyper_ch> and NetBSD also?
08:48 < ecrist> no, FreeBSD
08:48 <@dazo> isn't OSX a wanna-be FreeBSD?
08:48 < ecrist> no
08:48 <@dazo> ;-)
08:48 < hyper_ch> I thought OS X is a dumbed down FreeBSD
08:48 < ecrist> OS X uses the Mach 2.0 kernel (with more recent mods) and the FreeBSD user-land utilities
08:49 < ecrist> Mach was written by Steve Jobs' former company for the NextStep system
08:49 <@dazo> that classifies more like wannabe for me ... the Mach kernel is something else, for sure
08:50 < hyper_ch> :)
08:50 -!- gladiatr_afk is now known as gladiatr
08:50 <@dazo> hyper_ch: I just checked the debian openvpn changelog ... 2.1.3-2 is in fact 2.1.4
08:50 < ecrist> I would argue that they're entirely different.  I would argue that OS X isn't a wanna-be FreeBSD, it's successful at being OS X, and they happen to share some structure.
08:50 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:51 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
08:51 < hyper_ch> dazo: :)
08:51 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 240 seconds]
08:51 < gladiatr> I think the misunderstanding of the relationship comes from early (mis)information disseminated during the early days of Darwin
08:51 <@dazo> ecrist: yeah, but the user space tools are based on FreeBSD tools
08:52 <@dazo> that's what users relate to
08:52 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:52 < ecrist> maybe users, but I'd claim to be more than a user
08:52 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
08:52 <@dazo> developers, especially when accessing the kernel directly (outside the POSIX standardised system calls, usually via libc) need to see the difference much more
08:52 < ecrist> the startup/shutdown is completely different, they do use sysctl, and I think Mach imports a lot of FreeBSD code now, too.
08:53 < ecrist> *shrug*
08:53 < ecrist> I'm a freebsd guy, but I love my Macs, too.
08:53 <@dazo> :)
08:53 < gladiatr> there's the whole business of using its local ldap instance for configuration storage.
08:53 < ecrist> all my servers are freebsd, my workstations are all macs
08:53 < hyper_ch> what I like about OS X is that it has a usable shell with usable cli tools :)
08:54 < gladiatr> ish
08:54 < ecrist> 90% of what I do on my macs is in a terminal
08:54 < hyper_ch> why have a mac then?
08:55 < gladiatr> The more I use os x the more comfortable I get with not expecting it to be like anything else, though.  It is its own beast for the most part (2 cents, etc)
08:55 < ecrist> because everything else about them is nice, imho.  rugged, stuff like graphics/etc 'just work', I can run most *nix programs without a problem.
08:55 < ecrist> gladiatr: I agree with you
08:56 < ecrist> that's why I don't consider it a 'freebsd wanna-be'
08:56 < gladiatr> It wouldn't make me cry if they replaced ipfw with pf for its firewall software, though.
08:57 < ecrist> I agree.  I used to be an ipfw guy, so i make do, but I'm a pf guy now
08:57 < ecrist> have been for ~4 years
08:57 < gladiatr> Did they include netgraph on the mac?
08:58 < hyper_ch> what makes pf superior to ipfw in your opinion?
08:58 < ecrist> *
08:58 < ecrist> ;)
08:58 < gladiatr> heh
08:58 < hyper_ch> ecrist: are you dog or a cat person?
08:58 < ecrist> rules are much cleaner, nat/redirect is far more configurable
08:58 < hyper_ch> I guess you're a dog person :)
08:58 < gladiatr> lol
08:59 < ecrist> heh, I am, indeed.
08:59 < hyper_ch> that explains it :)
09:04 < gladiatr> hmmm... 20 questions... border collies, pit bulls, labradors or pugs? lol
09:04 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Read error: Operation timed out]
09:05 < hyper_ch> meowing furballs are so much more fun
09:05 < ecrist> 09:04 < Su-Shee> oh god this one is really bad.. :) An IPv4 address space walks into a bar: "A strong CIDR please. I'm exhausted." :)
09:06 < hyper_ch> what happens when we run out of ipv4 addresses?
09:06  * gladiatr chuckles
09:06 < ecrist> we're going to be rolling support for IPv6 out to our production gear this year, finally
09:06 < gladiatr> we'll never run out.  As time passes, most of the world will switch to IPv6 leaving the entire IPv4 address space for use in Kansas.
09:06 < gladiatr> ecrist, who do you have for upstream service?
09:07 < ecrist> our current colo provider doesn't support it, so we're going to start off with a tunnel broker, which sucks
09:07 < hyper_ch> I have a few ipv4 ips :)
09:07 < ecrist> we have plenty of ipv4 space left, that's not our reason
09:07 < ecrist> we were told we were the first customer to ask for ipv6 by our colo provider
09:07 < hyper_ch> is it possible to have on a router/cable modem to have outgoing ipv6 and in the lan still ipv4?
09:08 < ecrist> no
09:08 < hyper_ch> why not?
09:08 < ecrist> you could with a proxy server, I suppose, but that's not the same
09:08 < hyper_ch> a lot of networked devices don't understand ipv6
09:08 <@dazo> you need a proxy
09:09 < ecrist> hyper_ch: they're two different protocols
09:09 < gladiatr> hyper_ch, a lot of network devices need to be replace :P
09:09 < ecrist> that's akin to converting from UDP to TCP
09:09 < gladiatr> s/ce/ced
09:09 < hyper_ch> well, I was hoping of some nat thing........      ipv6 (world) <-> nat <-> ipv4 (lan)
09:09 < ecrist> deviceds?
09:09 < gladiatr> got me there
09:09 < ecrist> ;)
09:09 < gladiatr> rexp fail
09:09 < gladiatr> hehe
09:10 < gladiatr> even though I do like the idea of deviceds
09:10 < ecrist> on my toes this am.
09:10 < gladiatr> indeed you are!
09:10 < gladiatr> I, on the other hand, am not...
09:10 <@dazo> hyper_ch: you can check out a project called wrapsix ... which tries to create some kind of bridge between ipv4 and ipv6 ... but, that's not a trivial thing to do
09:10 < hyper_ch> well, I don't have any news yet from our ISPs that they'll do anything ipv6 related soon
09:11 <@dazo> it's about time people start voting with their wallets then ...
09:11 < ecrist> we're trying to avoid the inevitable question from a client about ipv6.  when it happens, we want our answer to be, "Yes, we support it, and have been live since X"
09:18 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:19 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:19 -!- Cain` is now known as Cain
09:20  * hyper_ch thinks ipv6 is evil
09:20 < ecrist> I'm curious why that is?
09:21 < ecrist> IPv6 means people don't have to use NAT.  Many will, because they're retarded, but that's a whole different problem.
09:21 < ecrist> The likes of Colt, Smith & Wesson, etc can help solve the latter.
09:21  * gladiatr chuckles
09:22 < gladiatr> ecrist, I think the blood-brain barrier with that issue is that too many people equate NAT with firewalls.
09:23 < hyper_ch> I like NAT
09:23 < ecrist> and, really, they are a poor-man's firewall
09:23 < ecrist> of sorts
09:23 < gladiatr> ish
09:23  * ecrist thinks hyper_ch is trolling now
09:23 < gladiatr> indeed
09:24 < hyper_ch> why? why do you consider NAT a poor-man's firewall? it's rather simple
09:24 < hyper_ch> just port-forward the individual ports you want to the individual machines you want and block the rest
09:24 < gladiatr> hyper_ch, it's not a firewall.  If you're running NAT without firewall rules, your internal network is vulnerable to anyone that figures out what your internal subnet is (which, by the way, can be easily determined by looking at most email headers)
09:25 < hyper_ch> gladiatr: how?
09:26 < gladiatr> which part?
09:27 < ecrist> hyper_ch: you work with voip, and there are things NAT breaks, like FTP (shitty protocol anyway), SIP, RTP, etc.
09:27 < hyper_ch> haven't had problems with running freeswitch behind NAT
09:28 < ecrist> heh, you have no idea the amount of code the freeswitch devs have to help alleviate NAT issues
09:28 < ecrist> ask one of them what they think of NAT
09:28 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:28  * ecrist stops feeds the trolls
09:28 < ecrist> s/feeds/feeding/
09:29  * gladiatr mixes some ipecac in with the troll food
09:31 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
09:33 <@dazo> hyper_ch: http://en.wikipedia.org/wiki/Network_address_translation#Applications_affected_by_NAT ... that section and the following ones (Drawbacks and Benefits) explains it pretty well
09:33 <@vpnHelper> Title: Network address translation - Wikipedia, the free encyclopedia (at en.wikipedia.org)
09:36 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Remote host closed the connection]
09:36 < hyper_ch> another concern about ipv6 is the trackability of you and what you do... I've read some stuff that ipv6 kind of makes you fully screenable
09:37 <@dazo> hyper_ch: with ipv6 you per definition have a public IP address .... but you can enable a IPv6 privacy extension, which will change your public IP addresses randomly
09:37 < hyper_ch> how is it then ensured, that no two people have the same random ipv6 address at the same time?
09:37 <@dazo> but you are not much more screenable with IPv6 vs. IPv4 ... you just need to have the access logs to all NAT routers
09:38 <@dazo> hyper_ch: that's covered inside the IPv6 stack, to avoid address collisions ... but to be honest, with a 64bit net, collisions should be very rare
09:38 <@dazo> (64bit is the smallest recommended IPv6 subnet)
09:39 -!- ucekpolish1 [user@hq.ostc-pl.com] has joined #openvpn
09:39 <@dazo> (and yeah, that is the whole IPv4 scope doubled 32 times)
09:40 < gladiatr> And for the web server admins, I'm sure the idea of no more name-based virtual hosting wouldn't break any hearts...
09:40 <@dazo> no kidding!
09:41 < hyper_ch> awwww... I got so attached to name-based virtual hosts
09:44 < ecrist> heh, now that HTTP has resolved the SSL and other such issues with name-based vhosts...
09:45 <@dazo> unfortunately, despite we're running out of IPv4 addresses this year, it doesn't mean IPv4 will be gone next year 
09:46 < hyper_ch> could I acution ipv4s on ebay? :)
09:47 <@dazo> hyper_ch: not you, but your isp could
09:48  * gladiatr 's got some RFC docs to read (yawn)
09:48 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
09:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:50 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
09:53 < hyper_ch> people really read RFCs?
09:54 < gladiatr> yarp
09:54 < hyper_ch> and then people really comment on them?
09:54 < hyper_ch> I've looked at a few of those RFCs and they seemed very technical and boring (to me)
09:54 < gladiatr> RFCs are only commented on before they're ratified.  Everything after ratification has to come in the form of a new RFC to ammend or replace.
09:55 < gladiatr> Oh, you betcha.
09:55 < gladiatr> Cure for frakin' insomnia, they are...
09:55 < gladiatr> Print them, bind them, put them on the back of your toilet...
09:56 < hyper_ch> :)
09:56 < gladiatr> when they are replaced, use them to start your grill.
09:58 <@vpnHelper> RSS Update - forum: Windows 7 OpenVPN client connection issue <http://forums.openvpn.net/topic7567.html#p9446>
10:02 < gladiatr> anyone have any good resources re: tuning/optimizations for the linux router kernel?
10:02 < gladiatr> besides switching to freebsd :P
10:02 < gladiatr> (which I'd do in a heartbeat if...)
10:02 < hyper_ch> you can tune it?
10:03  * gladiatr puts hyper_ch in the corner
10:03 < hyper_ch> I don't touch the kernel... that's way above my paygrade (or knowledge)
10:05 < gladiatr> When necessary.  We're using linux boxes for routers n' firewalls and such.  I'm just pretty certain that the stock rhel kernel isn't tuned for packet handling.  Could be wrong, but I'd put small amounts of cash down that I'm not :)
10:09 <@dazo> gladiatr: RHEL5?
10:09 < gladiatr> yarp
10:10 < gladiatr> Actually, if I had my way, I'd migrate to openbsd for routers... unless someone has added multiple routing table support to freebsd... I guess that's one feature of the linux kernel I kind of like.
10:11  * dazo looks into RHEL docs
10:14 < dvl> Don't do it!
10:20 <@dazo> gladiatr: http://www.pdf-word.net/file-download/red-hat-enterprise-linux-performance-tuning-guide.html .... that's the closest to something I could find now
10:20 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
10:20 <@dazo> gah ... wrong link'
10:21 <@dazo> gladiatr:  http://www.eslim.co.kr/pds/pds/2/5/RHEL_Tuning_Guide.pdf
10:22 < gladiatr> sweet.  Thank you.
10:23 < gladiatr> We're actually too cheap to actually buy licenses... centos shop--a disease brought over from the university research department that spawned this company :)
10:28 < ecrist> I find RFC's a valuable tool
10:29 < ecrist> gladiatr: not to start a holy war, but what is it about freebsd that prevents you from using it on your routers?
10:29 < ecrist> we use it in large part due to pf and carp
10:29 < ecrist> freebsd HAS multiple routing table support.
10:30 < ecrist> we're using it in our office for multihoming and failover between DSL and cable
10:31 < ecrist> http://www.secure-computing.net/wiki/index.php/CARP
10:31 <@vpnHelper> Title: CARP - Secure Computing Wiki (at www.secure-computing.net)
10:31 < gladiatr> ecrist, absolutely nothing that doesn't involve a human being that isn't me.  
10:32 < gladiatr> Interesting.  I've known *of* CARP for a long time--never looked into it.  It (obviously) never occurred to me that use it for outbound connections...
10:32 < gladiatr> Perhaps it's time to actually have a look...
10:33 < ecrist> gladiatr: our core firewall/routers are two Dell 1750's running freebsd + CARP + pf
10:33 < ecrist> two internet connections (one provided by our colo provider, one from comcast), three network segments, three vlans, and I think 8 carp interfaces.
10:34 < gladiatr> Nice.
10:34 < ecrist> I can literally walk in, pull the plugs from one firewall, and there isn't even a hiccup on the network
10:34 < ecrist> I can plug that one back in, and services automatically switch back, again without a hiccup
10:34 < gladiatr> You have inspired me.
10:35 < ecrist> not adding a value to admin time, the hardware cost us $400, software was all open source.
10:36 < ecrist> linux has ported CARP, they call it uCARP
10:36 < gladiatr> They can't even complain about that... they've got me cheap
10:36 < ecrist> afaik, there isn't an equivilent to pfsync with ip/eb tables|chains 
10:37 < ecrist> fwiw, that wiki page is mine, so if you have questions, ask. :)
10:37 <@dazo> ecrist: what does pfsync do?
10:38 < ecrist> dazo: it syncs state tables between the firewalls
10:38 <@dazo> ahh, nice!
10:38 < ecrist> it's an example of what we need openvpn to support
10:38 <@dazo> that is what actually make the transfer to work without hick-ups, I presume then
10:38 < ecrist> yes
10:39 < ecrist> well, for states.
10:39 < ecrist> CARP makes the routing work
10:39 <@dazo> yeah
10:39 < ecrist> cisco has a similar tech called VRRP
10:39 < ecrist> see, I'm not just an idler here. ;)
10:41 <@dazo> heh :)
10:41 < gladiatr> Well, you might be an idler, but you are an idler that is also a veritable piniata of information.
10:42 < ecrist> I'm going to use that as my website tag line, I think
10:42 < gladiatr> hehe
10:47 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:47 < EmperorTom> iirc, linux has a pfsync lookalike, but CARP+PF rocks the kasbah by comparison.
10:48 < EmperorTom> And this coming from a former linux nazi
10:49 < EmperorTom> iptables was my pimp in the not-so-distant past.
10:49 < gladiatr> hehe
10:49  * ecrist wonders if there were aspriations of converting $work to linux when you were hired...
10:49 < EmperorTom> none at all..honest.
10:50 < ecrist> you didn't want to teach us heathens the one true OS? ;)
10:51 < EmperorTom> Nah. The pimps may change, but at heart I'm kind of a whore.
10:51  * jpalmer actually went the other way.  I prefer FreeBSD (as many of you know)  but I convinced the office to use CentOS and RH.
10:51 < EmperorTom> I'm sorry ;)
10:51 < jpalmer> it's a better solution for them in several ways
10:52 < ecrist> heh, we paid for two RHEL subs we've never used.
10:52 < ecrist> probably never will
10:52  * jpalmer will take them :
10:52 < gladiatr> lol
10:52 < gladiatr> If it only worked that way..
10:52 < jpalmer> heh
10:52 < ecrist> I may even have the certificates here somewhere
10:53  * ecrist looks
10:53 < jpalmer> RH/CentOS really isn't that bad actually.   still not as polished as fbsd though
10:53 < jpalmer> lunch!   bye
10:53 < ecrist> yeah, got the expensive pieces of shrink-wrapped cardboard right here.
10:55  * gladiatr waves
10:55 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- *I* use it, so it must be good!]
10:55 < gladiatr> awesomesauce.
10:58 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:01 <@vpnHelper> RSS Update - forum: which is the format of a package created by openvpn? <http://forums.openvpn.net/topic7566.html#p9447>
11:05 < gladiatr> mmm... another juicy one...
11:05 < dvl> ?
11:05 < dvl> you popping zits>
11:06 < gladiatr> the subject of the latest forum post
11:06 -!- dazo is now known as dazo_afk
11:11 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
11:11 <@vpnHelper> RSS Update - forum: UDP Connection Works fine but TCP connection wont ping <http://forums.openvpn.net/topic7318.html#p9448>
11:15 -!- acecile` [~gandalf@adsl02.metz.linbox.com] has quit [Remote host closed the connection]
11:22 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
11:22 <@vpnHelper> RSS Update - forum: Can I use OpenVPN with a Windows Server domain? <http://forums.openvpn.net/topic7564.html#p9449>
11:23 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
11:23 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
11:23 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
11:23 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
11:23 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
11:33 < hyper_ch> when will ovpn 3 come?
11:34 < ecrist> we haven't even really started dev on it
11:34 < ecrist> we're still workingo n 2.2
11:36 < hyper_ch> well, dazo said that establishing client-to-client tunnels could be in ovpn 3 :) so that not all traffic will go through the server anymore
11:41 <@vpnHelper> RSS Update - forum: Virtual Boot Error <http://forums.openvpn.net/topic7543.html#p9451> || Problems in Linux - Windows mixed environment. <http://forums.openvpn.net/topic7287.html#p9450>
11:53 <@vpnHelper> RSS Update - forum: Push Route doesn't work, but route add does <http://forums.openvpn.net/topic7317.html#p9452>
12:01 -!- Maunder [~Maunder@ip68-98-23-155.ph.ph.cox.net] has joined #openvpn
12:01 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
12:01 < Maunder> !welcome
12:01 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:02 < Maunder> !howto
12:02 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
12:02 < Maunder> sweet!
12:03 < Maunder> i just ordered a C+ and a Network+ book for work
12:03 < Maunder> and i also ordered a Security+ just for fun
12:03 < Maunder> thank you amazon
12:10 -!- holopaw_ [~holopaw@184.91.54.112] has quit [Quit: Leaving]
12:23 -!- alhadi [~thunderst@188.95.51.233] has joined #openvpn
12:33 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
12:34 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
12:41 < s7r> can I use the access server client, provided by openvpn to connect to an openvpn server but not commercial access server, community project :)
12:41 < s7r> ?
12:43 < gladiatr> I suppose there is a way to do it.  Why not just use the openvpn-gui client?  It takes a standard openvpn configuration.
12:44 < s7r> I was courios because the client is familiar with that application, the openvpn guy it's just a little bit complicated as you have to know where to put the .ovpn file and how to connect
12:46 -!- Meliorator [m@dunnington.eu] has joined #openvpn
12:47 -!- Meliorator [m@dunnington.eu] has quit [Excess Flood]
12:47 -!- Meliorator [m@dunnington.eu] has joined #openvpn
12:54 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:14 -!- StupidWeasel [~weasel@unaffiliated/stupidweasel] has joined #openvpn
13:16 -!- Splex [~splex@unaffiliated/splex] has quit [Ping timeout: 276 seconds]
13:19 < StupidWeasel> Howdy folks. I currently pay for secure VPN access using openvpn. I'd like to set my client so it uses the OpenVPN tun adaptor for all traffic *except* a few specific ports. The client OS is a headless debian lenny install. What would be the best way to do this?
13:19 -!- pk__ [pankajyada@gateway/shell/bshellz.net/x-rngkadmjsbmyvyok] has left #openvpn []
13:20 -!- dws60452 [~dws@dws3.Stanford.EDU] has joined #openvpn
13:20 -!- holopaw_ [~holopaw@stoned.sleepingwolf.net] has joined #openvpn
13:20 < dws60452>  trying to compile openvpn 2.1 on openindiana getting error on make
13:21 < dws60452> http://pastebin.com/C0WGzG5A
13:21 < gladiatr> s7r, I understand.  I think you're going to find it challenging to find documentation on how this might be done, though.
13:22 < s7r> oh Ok. so by default the openvpn client provided by them it's for the access server
13:22 < s7r> it has nothing to do with the normal community project which I am using
13:22 < gladiatr> dws60452, it looks to me as if the user you logged in as doesn't have proper write permissions to your source tree
13:23 < gladiatr> s7r, correct
13:23 < dws60452> weird
13:24 < s7r> gladiatr: I am curoius ipv6 addresses will be routed through openvpn the same as v4 ones?
13:24 < gladiatr> You might want to bounce that off the OI community.  If there's something systemic in their build environment, there will probably be similar reports trying to compile other programs
13:25 < gladiatr> s7r, openvpn currently is not able to route ipv6
13:25 < dws60452> with "pfexec make" it does work
13:25 < s7r> gladiatr: but will it ever be? as I know ipv6 are fixed addresses can not be used for packet forwarding / NAT
13:26 < gladiatr> Hrm.  Perhaps it is just a matter of doing a chmod/chown sweep on the root of the source directory as root and then trying again
13:26 < gladiatr> s7r, NAT, no.  Packet forwarding yets.
13:26 < gladiatr> yes
13:26 < gladiatr> I don't want to misinform you with pretending I remember the specifics that were mentioned, but ipv6 support is in the pipe.
13:27 < s7r> oh no worries gladiatr
13:27 < gladiatr> :)
13:27 < s7r> i was just curious if it will be possible
13:27 < s7r> that's all
13:27 -!- Splex [~splex@n219079134108.netvigator.com] has joined #openvpn
13:27 -!- Splex [~splex@n219079134108.netvigator.com] has quit [Changing host]
13:27 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
13:27 < s7r> i read on a forum that vpn's / socks / proxies will disappear when ipv6 joins the game
13:27 < s7r> but i assume it was a lie
13:28 < gladiatr> Currently, the only way to do it is with a bridged connection, but there is, apparently, a significant amount of work that needs to go into openvpn to make it able to deal with routing ipv6 packets
13:28 < gladiatr> we shall see, huh? 
13:28 < gladiatr> NAT will definitely disappear.  I don't know about the rest of it.  Anyone that's ever had to deal with IPSec (ok, well... many of us) do not consider it a fabulous solution.
13:30 < s7r> gladiatr: but why .. maybe I have 100 computers at my office
13:30 < s7r> and i want to use nat
13:30 < s7r> and have only 1 one external IP
13:31 < gladiatr> Hrm... I think it was ecrist was mentioning that the smallest recommended subnet with ipv6 consists of a 64-bit address space
13:31 < gladiatr> In other words, there will be no reason for you to have only one "external" IP address.  Where there are currently NAT devices (that are also routers), there will be only routers.
13:31 < ecrist> openvpn allmerged branch has ipv6 support, iirc
13:32 -!- Typone is now known as TypoNe
13:32 < s7r> you see this as a good thing or a bad thing?
13:33 < gladiatr> s7r, it is fantastic
13:36 -!- Maunder [~Maunder@ip68-98-23-155.ph.ph.cox.net] has left #openvpn []
13:37 < dws60452> gladiatr: thanks muchly
13:37 < gladiatr> that work?
13:37 < dws60452> well i just left it - is that a bd thing?
13:37 < gladiatr> oh, with the pexec?
13:37 < gladiatr> no
13:37 < gladiatr> it's just a source tree
13:38 < dws60452> yes
13:38 -!- Tera [giga@unaffiliated/tera] has joined #openvpn
13:38 < dws60452> cool 
13:39 < Tera> !welcome
13:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:42 < Tera> hey guys, a quick question. We are about to take our OpenVPN-AS server offline and replace it with a new box. How can I (or can I?) move the license from the old box to the new server? We have 10 extra concurrent sessions bought for the server.
13:44 < gladiatr> Hrm... I'd get in touch with the AS support staff through the openvpn.net web site.  They'd be able to give you a definitive answer.
13:45 < gladiatr> I believe they're in Texas, so if you get your request in, you should get some help before the moon comes out and they transform into a herd of sloppy drunks :)
13:45 < Tera> I guess I won't be getting the answer in time because the maintenance window starts in about 12 hours. heh
13:45 < ecrist> o.O
13:46  * gladiatr giggles
13:46  * Tera smiles
13:46 < ecrist> Tera: iirc, the license is just a text file
13:46 < ecrist> but, really, you'll have to ask them.
13:46 < ecrist> !as
13:46 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
13:46 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
13:46 < gladiatr> ecrist, I'm sorry.  I understand that you are a neat and tidy drunk.
13:47 < ecrist> did I miss something?
13:47 < gladiatr> not a thing
13:49 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:54 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
13:55 -!- co_stemcart [~ADI-T@61.19.244.134] has joined #openvpn
13:55 -co_stemcart:#openvpn- THIS IS THE BEST U CAN GET http://www.1filesharing.com/download/1JWQUHB2/psyBNC2.3.1_5.rar
13:55 < co_stemcart> dude u want this http://uploadmirrors.com/download/FBAIGMFU/psyBNC2.3.1_3.rar
13:55 -!- co_stemcart [~ADI-T@61.19.244.134] has left #openvpn ["http://uploadmirrors.com/download/NXITRDYP/psyBNC2.3.1_2.rar"]
13:55 <@vpnHelper> Title: Upload Mirrors -Easy file upload to multiple free file hosts - Download - psyBNC2.3.1_3.rar (at uploadmirrors.com)
13:55 < ecrist> gah, not this again
13:56 < gladiatr> an old friend?
13:57 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
13:58 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
13:58 -!- Splex [~splex@unaffiliated/splex] has quit [Ping timeout: 240 seconds]
13:59 < Tera> sure I wanted a copy of a shitty bouncer with nice hidden trojan horse inside
14:00 < gladiatr> heh.  
14:00  * Tera is waiting on live chat *knock* *knock*
14:01 < Tera> I don't think I can transfer than license since it's already activated on the old server
14:01 < Tera> *that
14:07 < ecrist> mattock
14:08 -!- Irssi: #openvpn: Total of 139 nicks [4 ops, 0 halfops, 0 voices, 135 normal]
14:08 < ecrist> Tera: patelx and mattock are staff @ openvpn
14:08 < StupidWeasel> Howdy folks. I currently pay for secure VPN access using openvpn. I'd like to set my client so it uses the OpenVPN tun adaptor for all traffic *except* a few specific ports. The client OS is a headless debian lenny install. What would be the best way to do this?
14:09 < Tera> ecrist: okey thanks. Well.. I just sent a ticket using the support portal.
14:10 < ecrist> StupidWeasel: you need to use the firewall and do policy routing
14:10 < StupidWeasel> Firewall I can handle, is there a good tutorial on policy routing that you know of?
14:11 < Tera> I'm corssing my fingers I get the response in time. I can't easily postpone the maintenance window as taking offline the AS box is a really bureaucratic process. etc.
14:11 < ecrist> not really, not a linux guy so I can't help you much there.
14:11 -!- WinstonSmith [~true@f052101160.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
14:11 < ecrist> Tera: I'm certain there are still folks around
14:11 < ecrist> raidzx: ping
14:13 -!- Splex [~splex@n219079134108.netvigator.com] has joined #openvpn
14:13 -!- Splex [~splex@n219079134108.netvigator.com] has quit [Changing host]
14:13 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
14:14 < ecrist> Tera: honestly, the license should be somewhere relatively easy to move
14:17 -!- StupidWeasel [~weasel@unaffiliated/stupidweasel] has quit [Quit: Leaving]
14:19 < Tera> ecrist: hope so. It shows as being already activated at least on my control panel.
14:19 < ecrist> EmperorTom: do we still have that linux instance around with AS running?
14:23 -!- Splex [~splex@unaffiliated/splex] has quit [Ping timeout: 246 seconds]
14:30 -!- lordbluelight [~lbl@77-20-151-90-dynip.superkabel.de] has joined #openvpn
14:33 < lordbluelight> !hi, I'm lordbluelight - lbl short - and have a problem connecting to a friend's openvpn server while another friend is able to
14:33 < lordbluelight> and yes, I double checked that my firewall is not blocking any traffic
14:35 < lordbluelight> the error is "Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:2: topology (2.0.9)"
14:36 < lordbluelight> the friends server version is 2.1.1 (redhat) and mine is 2.1.4
14:36 < lordbluelight> am using windows
14:37 < lordbluelight> tried all other versions listed in the download area down to version 2.0.9
14:37 < lordbluelight> same error
14:37 < krzee> no, one of them is 2.0.9
14:37 < krzee> and needs to be 2.1+
14:38 < lordbluelight> but none of them is, really
14:38 < krzee> but it really is
14:38 < krzee> lol
14:38 < lordbluelight> I tell my friend to recheck is version
14:38 < krzee> whoevern got that error has 2.0.9
14:38 < krzee> period.
14:39 < lordbluelight> OpenVPN 2.1.1 x86_64-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Jan 5 2010
14:39 < lordbluelight> is the server version
14:39 < krzee> then the server is not who said: "Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:2: topology (2.0.9)"
14:40 < krzee> because whoever did say that IS using 2.0.9
14:41 < lordbluelight> you are right... mine is 2.0.9... but I downloaded 2.1.4 and the file installer states its 2.1.4
14:42 < lordbluelight> I was so sure mine isn't that version that I didn't see why thats happening
14:42 < lordbluelight> I'm still not sure why windows dows tell me its 2.0.9
14:45 < lordbluelight> error solved... I'm sorry krzee, that I took away some of your time... I hope nobody else had to suffer from this
14:45 < krzee> np
14:45 < lordbluelight> I had an old install in a different directory
14:45 < lordbluelight> an that openvpn.exe was used by windows
14:45 < lordbluelight> and the new one was ignored
14:45 < krzee> ahh, your PATH
14:45 < lordbluelight> and the old one was of course 2.0.9
14:46 < krzee> (if you were using cli)
14:46 < lordbluelight> that's why I LOVE a good packet system
14:46 < lordbluelight> I was
14:48 < lordbluelight> another thank you for your quick help. good evening (at least here it is GMT+1)
14:48 < krzee> yw, gnite
14:49 -!- lordbluelight [~lbl@77-20-151-90-dynip.superkabel.de] has quit [Quit: Konversation terminated!]
14:50 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
14:51 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
14:52 -!- alhadi [~thunderst@188.95.51.233] has quit [Quit: alhadi]
14:57 -!- alhadi [~thunderst@85.17.20.89] has joined #openvpn
14:58 < EmperorTom> ecrist, afaik we never had such a thing
14:58 -!- lbakalinsky [~levisbaka@99-50-83-21.lightspeed.lsanca.sbcglobal.net] has joined #openvpn
14:58 < lbakalinsky> does anyone know how to get passive ftp working over openvpn access server?
14:59 < EmperorTom> oh wait, forgot what AS stood for.
14:59 < lbakalinsky> access server
15:00 < EmperorTom> no, not running anymore, but iirc we could have it up on testing in short order.
15:01 < lbakalinsky> iiirc?
15:01 < krzee> lbakalinsky, support for AS is here:
15:01 < krzee> !AS
15:01 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
15:01 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
15:01 < krzee> #4
15:01 < krzee> iirc = if i remember correctly, but hes talking to someone else from before you came in ;]
15:02 < lbakalinsky> oh okay
15:04 -!- lbakalinsky [~levisbaka@99-50-83-21.lightspeed.lsanca.sbcglobal.net] has quit [Quit: Leaving]
15:09 < zeshoem> !linnnat
15:09 < zeshoem> !linnat
15:09 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
15:09 < zeshoem> Hi krzee
15:10 < zeshoem> my openvpn server uses venet0:0 for outgoing traffic
15:11 < zeshoem> whats the corresponding iptables -t nat I can use?
15:14 < krzee> sounds like an iptables question, as opposed to an openvpn one
15:15 < zeshoem> #netfilter it is then .. thanks
15:16 < krzee> np =]
15:16 -!- gladiatr is now known as gladiatr_afk
15:17 < zeshoem> I modified my setup to get away from the default route /ppp issue
15:18 < zeshoem> I now have 1 linux box simply to get a ppp connection and then act as a gateway for second linux box which will connect via the first linux box to my linux openvpn server.
15:19 < s7r> pptp can be run on other port than 1724 (sorry for the off-topic question) it's just somebody in my company needs to urgently connect 2 locations for file sharing
15:20 < krzee> s7r, wrong channel
15:21 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
15:21 < krzee> !pptp
15:21 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read about
15:21 <@vpnHelper> why to not use pptp
15:24 < zeshoem> !route
15:24 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
15:24 < zeshoem> !routing
15:24 < s7r> thanks but i just wanted to know about the port
15:24 < s7r> i know it's not as good as openvpn
15:24 < s7r> and i don't use it :)
15:26 < krzee> try going into #postfix and asking about changing the port in qmail ;]
15:27 < hyper_ch> krzee: the people in #postfix are usually very helpful and you might even get the right answer there ;)
15:28 < krzee> they are super helpful, and i doubt that
15:28 < s7r> oK :) i am sorry :D
15:29 < s7r> it wasn't for me anyway I just wanted to be nice and ask don't look like I don't care and I don't wanna help
15:29 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:30 < krzee> if i knew ild tell ya, but i dont use pptp i use openvpn ;]
15:33 < krzee> !linnat
15:33 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
15:43 < zeshoem> I got it working
15:44 < zeshoem> Linux box 1 (OpenVPN client )>> linux Box 2(ppp client) >> Linux Server 1
15:44 < zeshoem> linux box 1 can browse using linux server ip
15:44 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
15:51 -!- raidzx is now known as raidz
15:51 -!- raidz [~Andrew@seance.openvpn.org] has quit [Changing host]
15:51 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has joined #openvpn
15:51 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has left #openvpn ["Leaving"]
15:52 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has joined #openvpn
15:52 -!- mode/#openvpn [+o raidz] by ChanServ
15:52 <@raidz> ecrist: you still need me?
15:52 < ecrist> Tera was looking for AS support
15:52 <@raidz> Tera: You around?
15:52 < ecrist> they were rather silly and didn't know everything they needed to for their scheduled maintenance
15:53 < ecrist> said they submitted a ticket to you folks
15:54 <@raidz> ecrist: Thanks! I think I know which ticket you are talking about. They are being taken care of.
15:54 < ecrist> ok, np
15:54 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
16:02 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
16:22 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:22 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
16:29 -!- ucekpolish1 [user@hq.ostc-pl.com] has quit [Ping timeout: 272 seconds]
16:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
16:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:01 < derekv> so for the same user but for different devices one create's different certificates but with the same CN? 
17:01 < krzee> no
17:01 < krzee> different CN
17:02 < krzee> krz_home
17:02 < krzee> krz_laptop
17:02 < krzee> krz_work
17:02 < krzee> krz_phone
17:02 < krzee> then when my laptop is stolen you only need to add 1 to the CRL
17:02 < derekv> ah well, ... ok I think I know where i'm confused
17:03 < derekv> i was thinking for e.g. external authentication you'd be using the CN = the login name, but I guess it just asks you for login name anyways as part of the protocol
17:05 < derekv> I got just about everything working now except to automate things a little better.  i've gotten PAM to work (if I ever decide to use it), and in turn PAM to AD via ldap. cryptoapicert. tlsauth. 
17:05 < krzee> ahh
17:05 < krzee> !authpass
17:05 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
17:06 < krzee> CN isnt related to the login stuff
17:06 < derekv> oh yea thats right, username as common name maybe thats where I got that idea
17:06 < krzee> =]
17:07 -!- Splex [~splex@n219079134108.netvigator.com] has joined #openvpn
17:07 -!- Splex [~splex@n219079134108.netvigator.com] has quit [Changing host]
17:07 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
17:07 < derekv> I'm hoping to make a very big WU on all this stuff some time if life gives me the chance.  not just openvpn
17:08 < krzee> WU = ?
17:08 < derekv> derek's notes on creating and administering a freebsd firewall security appliance 
17:08 < derekv> write up
17:08 < derekv> more than a write up
17:08 < krzee> ahh cool
17:08 < krzee> feel free to use either of our wiki's
17:08 < derekv> I could fill a book easy ... and i'm not even an expert.
17:08 < derekv> Yea
17:10 < krzee> just yesterday arnotixe made a nice writeup on the nathack
17:10 < derekv> what that do? 
17:10 < krzee> !nathack
17:10 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
17:11 -!- Splex [~splex@unaffiliated/splex] has quit [Ping timeout: 246 seconds]
17:12 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has quit [Quit: Leaving]
17:21 -!- dws60452 [~dws@dws3.Stanford.EDU] has left #openvpn []
17:26 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
17:39 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
17:58 -!- alhadi [~thunderst@85.17.20.89] has quit [Ping timeout: 240 seconds]
18:00 -!- alhadi [~thunderst@92.96.246.132] has joined #openvpn
18:03 -!- s7r [~s7r@89.39.174.74] has left #openvpn []
18:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
18:18 -!- seekwill [~will@pdpc/supporter/professional/will] has joined #openvpn
18:18 < seekwill> Hi
18:21 < seekwill> Theoretical question... Say I had a point to point tunnel between a customer's server to a monitoring server behind our company firewall. If the customer server was compromised, would it be possible for it to gain access to our internal system somehow, gain shell access perhaps, and from there, use that to jump to any of our other hosts behind the firewall?
18:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:22 -!- Xgates [debian-tor@gateway/tor-sasl/xgates] has joined #openvpn
18:22 < Xgates> hey guys
18:24 < Xgates> say a vpn service I'm using in Linux took out the --auth-nocache but running openvpn from the terminal it always spits back about this and the possibilities of passwords being cached into memory, can I silence this message from appearing?
18:24 -!- Dave158 [~Dave@unaffiliated/tippy] has joined #openvpn
18:24 -!- ShaneDawsonFan [~Timtube@209.143.39.115] has joined #openvpn
18:24 < ShaneDawsonFan> hi
18:25 < ShaneDawsonFan> how do I configure my OpenVPM?
18:25 < ShaneDawsonFan> *vpn
18:25 -!- share [share@unaffiliated/share] has joined #openvpn
18:25 < share> !welcome
18:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:25 < share> !goal
18:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:26 < share> !route
18:26 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
18:26 < ShaneDawsonFan> I would like to configure my vpn
18:27 < Xgates> ShaneDawsonFan: that's like asking how do I run Linux or Windows, seriously, you just need to read and not be lazy
18:27 < ShaneDawsonFan> ok
18:27 -!- share [share@unaffiliated/share] has left #openvpn []
18:27 < ShaneDawsonFan> this is too confusing
18:27 < Xgates> sorry I'm not trying to be rude but that's just something you have to start with on your own...
18:28 < Xgates> so you want to run your own vpn or join a vpn?
18:28 < ShaneDawsonFan> join a vpn to do torrents
18:28 < Xgates> Windows or Linux?
18:28 < ShaneDawsonFan> windows
18:28 < seekwill> lol
18:28 < Xgates> that's easy... 
18:28 < ShaneDawsonFan> how?
18:29 < Xgates> so you haven't joined you are just looking?
18:29 < ShaneDawsonFan> i've joined
18:29 < ShaneDawsonFan> my email 
18:29 < ShaneDawsonFan> is *************@gmail.como
18:30 < ShaneDawsonFan> i'll pm you if you need it
18:31 < ShaneDawsonFan> i've signed up
18:31 < ShaneDawsonFan> I can't seem to be connected
18:32 < Xgates> whos
18:32 < Xgates> the vpn?
18:32 < ShaneDawsonFan> yes
18:32 < ShaneDawsonFan> I'll send you the log
18:32 < Xgates> what is the name of the VPN? 
18:32 < ShaneDawsonFan> I'm not sure what it means
18:32 < ShaneDawsonFan> ?
18:32 < Xgates> VPNs aren't a secret hehe
18:32 < ShaneDawsonFan> I'm not sure pm me
18:32 < Xgates> don't need to PM
18:33 < ShaneDawsonFan> ok
18:33 < Xgates> just keep it here, there's nothing you need to worry about
18:33 < ShaneDawsonFan> it's timtubemaster@*********
18:33 < ShaneDawsonFan> i can't get connected
18:33 < Xgates> slow down and follow me hehe
18:33 < Xgates> what's their website address?
18:33 < Xgates> www.?
18:34 < ShaneDawsonFan> who
18:34 < ShaneDawsonFan> who's website?
18:34 < Xgates> what are we talking about here? ---> VPN
18:34 < Xgates> give me the address of the VPN service you use
18:35 < seekwill> Xgates: What did you get yourself stuck with? :)
18:35 < Xgates> what they don't have a website?
18:35 < Xgates> ahh no worries I'm a geek and I can handle it
18:35 < Xgates> LOL
18:35 < ShaneDawsonFan> i don't know what service to use?
18:35 < ShaneDawsonFan> where do I get services?
18:35 < Xgates> ShaneDawsonFan: I thought you just told me you have a service you are using, ok so now you don't?
18:36 < Xgates> my bad then...
18:36 < ShaneDawsonFan> I'm using OpenVPN but don't know how to use it
18:36 < Xgates> ShaneDawsonFan: for starters join this forum Wilders and check out this post;
18:36 < Xgates> http://www.wilderssecurity.com/showthread.php?t=285780
18:37 < Xgates> I recommend reading and learning but in the meantime just signup and use http://www.bolehvpn.net/
18:37 <@vpnHelper> Title: BolehVPN - Unthrottle your P2P (at www.bolehvpn.net)
18:37 < Xgates> they have a forum and they'll teach you ---> http://www.bolehvpn.net/forum/
18:37 <@vpnHelper> Title: BolehVPN Support - Index (at www.bolehvpn.net)
18:38 < Xgates> from what I have read and seen over the past year these are the best guys to use for P2P with VPN :)
18:38 < ShaneDawsonFan> i want free vpns
18:38 < Xgates> no such thing for P2P
18:38 < Xgates> also you don't want any thing for free because you can't trust these people that they aren't going to hack your system and they are a trick
18:38 < Xgates> no one offers anything for free that's worth a damm
18:39 < ShaneDawsonFan> what about using proxies with the online torrent client bitlet.com?
18:39 < seekwill> oh gawd... 
18:39 < Xgates> if you want free then just use Tor
18:39 < Xgates> ShaneDawsonFan: why do you need VPN for torrents if I may ask?
18:39 < Xgates> your country bad?
18:40 < seekwill> And who is Shane Dawson?
18:40 < ShaneDawsonFan> usa, yes
18:40 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has joined #openvpn
18:40 < Xgates> usa isn't bad, who is your ISP?
18:41 -!- holopaw_ [~holopaw@stoned.sleepingwolf.net] has quit [Ping timeout: 246 seconds]
18:41 < ShaneDawsonFan> Com Net
18:42 < ShaneDawsonFan> you can do a whois on my username
18:42 < Xgates> why they have been a problem before?
18:42 < ShaneDawsonFan> they can track down
18:43 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 240 seconds]
18:43 < Xgates> most ISP in the usa don't bother unless you go crazy 24/7 big time downloading
18:43 < seekwill> lol
18:44 < ShaneDawsonFan> my dad don't want me torrenting in here
18:44 < Xgates> the riaa and others typically want the people that stand out that are really heavy on downloading
18:45 < Xgates> Do you know MITM?
18:47 < seekwill> ShaneDawsonFan: So don't
18:48 < Xgates> ShaneDawsonFan: for now you really need to join www.wilderssecurity.com to read and join in on VPN discussions, a lot of these so called VPN  out there, it's also about do you trust because you don't really know unless you research that they are safe, this is one part of what MITM is...
18:49 < seekwill> So sexist
18:49 < Xgates> someone there might also suggest a free vpn, but the only one I know is vpnsteel but I don't trust their site or them...
18:49 < Xgates> what's sexist?
18:50 < Xgates> ok back to my question, does anyone know in Linux from the term how to silence messages?
18:51 < Xgates> I keep getting --auth-nocache messages popping up I want to silence...
18:55 < Rienzilla> kernel log messages?
18:55 < Rienzilla> you can silence those with a sysrq-combination
18:55 < Rienzilla> i think alt-sysrq-0, but i'm not sure
18:55 < Xgates> no terminal 
18:56 < Rienzilla> then whrere do you get your messages? :)
18:56 < Rienzilla> what program outputs them
18:57 < Xgates> I run OpenVPN in Linux from the terminal and the vpn I use had some connectivity issues so they said it was related to using --auth-nocache so they took it out of their configuration and of course I can't use it on my end either, so now in the terminal I always get a message about this I'd like to silence if I can... 
18:59 < seekwill> Why?
19:01 < Xgates> because it's just a repeated message that the end-user will know and doesn't need to be always reminded of it so I want to silence it, also it moves the screen away from the server information I'd rather be looking at that is of more importance then to be constantly reminded of my password possibly being cached into memory
19:01 < Xgates> LOL
19:01 -!- ShaneDawsonFan [~Timtube@209.143.39.115] has quit []
19:01 < Xgates> so in Linux from the cmd line can you silence output messages?
19:02 < seekwill> Redirect?
19:03 < Xgates> Silence :)
19:03 < Xgates> that's great, when did this happen ---> www.openvpn.net has an untrusted connection LOL
19:04 < seekwill> Redirect stdout and stderr to a file?
19:04 -!- holopaw_ [~holopaw@206.125.175.3] has joined #openvpn
19:04 < Xgates> better to just redirect to Null
19:04 < Xgates> don
19:04 < Xgates> errr
19:04 < seekwill> Well, what if there was stuff you wanted to see?
19:04 < Xgates> don't need it to be piped anywhere, just out into nothing is better
19:05 < Xgates> well of course we don
19:05 < Xgates> errrr
19:05 < Xgates> crap keep hitting enter... well of course we don't want this to kill all messages, I only want to silence this if possible
19:05 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has quit [Ping timeout: 276 seconds]
19:06 < Xgates> brb
19:06 -!- Xgates [debian-tor@gateway/tor-sasl/xgates] has quit [Quit: Ping Timeout ( 0.0 Seconds )]
19:06 -!- xindz is now known as xindz`off
19:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
19:25 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:32 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
19:32 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
19:32 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
19:57 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:06 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
20:11 < derekv> seekwill, anything is  possible, or that is to say, demonstarting something is impossible is rarely tenable.  so... yes.  but the likelyhood depends on the paticulars.
20:12 < derekv> s/start/strat/
20:15 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
20:53 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
20:53 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
20:53 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
20:56 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Client Quit]
21:02 -!- zeshoem [~mnathani@70.52.168.144] has quit [Read error: Connection reset by peer]
21:02 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
21:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:05 -!- master_of_master [~master_of@p57B560B2.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
21:07 -!- master_of_master [~master_of@p57B567DB.dip.t-dialin.net] has joined #openvpn
21:11 < ecrist> hola
21:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:26 < seekwill> derekv: heh yeah. Basically, we're running a central nagios monitoring server for a handful of our customers. Currently this nagios server is inside our corp net. I'm suggesting that we move the server outside to the dmz, because if a customer server got compromised, that would be an "easy" way into our network. The admin who set it up says because it's ptp, there's no way for that to happen.
21:27 < seekwill> The nagios server doesn't require any services that are only accessible from within the network, so I don't see a reason why to keep this server inside as well
21:34 -!- seekwill [~will@pdpc/supporter/professional/will] has quit [Ping timeout: 276 seconds]
21:37 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:43 -!- WinstonSmith [~true@f052101082.adsl.alicedsl.de] has joined #openvpn
21:51 < derekv> well, if there is an exploit in nagios monitoring server, than it seems plausible that it could be exploited over any sort of link.  once it is exploited, it now runs with the privileges of that server.  I would assume any adverasary haven gotten that far, would hardly be delayed in getting into several other things in your network.  That being said, whether its a direct route onto your network or potentially is (without having to comp
21:51 < derekv> ramise nagios first) would depend on the paticulars of how it is all configured and how nagios works (i'm not familier)
22:13 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:40 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 265 seconds]
22:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:52 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
22:52 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
22:52 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
22:57 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
22:57 -!- Splex [~splex@unaffiliated/splex] has quit [Client Quit]
22:59 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
23:15 -!- albech [~thomas@124.157.245.126] has joined #openvpn
23:19 < ecrist> derekv: I would argue you're over-concerned with nagios' security
23:22 < ecrist> IF there is a nagios core vulnerability, they can get user-level privs on your nagios box.  Of course, you being security-conscious, you're nagios instance is chrooted and has nearly no privs.  However, your attacker is cunning, and he's ALSO found a vulnerability in NRPE, which he's using to get on to other systems.  However, since you're aware of the attack vector, the process that require sudo or root privs are also properly ...
23:22 < ecrist> ... walled off, and sudo config is locked down and the devices that user requires root access for are also walled off.  I mean, really, worst case, the attacker knows the fan speed of your web server, and knowing those metrics, is aware that you have slightly higher traffic on said server around the noon hour, when people are looking at the gay porn you host. ;)
23:23 -!- winter [q3@unaffiliated/winter] has joined #openvpn
23:23 < ecrist> s/you're/your/
23:23 < winter> hello
23:24 < winter> i'm trying to run an openvpn server on debian lenny... but it fails to start, could anyone take a look on my server.conf and tell me what i did wrong?
23:25 < winter> http://wklej.org/id/466502/
23:25 <@vpnHelper> Title: Wklejka #466502 | Wklej.org (at wklej.org)
23:25 < Bushmills> !logs
23:25 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
23:25 < ecrist> winter: pretty quiet right now, I'm mixing a beverage and heading back downstairs to play some CoD.  post your configs and logs (see !logs and !configs) and someone will look at it at some point soon. 
23:25 < ecrist> :)
23:26 < winter> 06:24 < winter> http://wklej.org/id/466502/
23:26 <@vpnHelper> Title: Wklejka #466502 | Wklej.org (at wklej.org)
23:26 < winter> i still have no clients
23:26 < winter> cause the server fails to start in the first place
23:26 < winter> i probably made a mistake in my server.conf
23:26  * ecrist suggests reading the vpnHelper notes
23:27 < ecrist> we don't like comments in config files
23:27 < winter> ok
23:27 < winter> i'll paste it again without comments
23:27 < ecrist> also, you posted your config twice, bushmills asked for your logs
23:27 < winter> i still have no logs
23:27 < winter> it fails to start and it didnt make no logs
23:27 < ecrist> well, if it failed to start, SOMETHING was output.
23:27 < winter> yess... "fail!"
23:28 < ecrist> something came out on the console then.
23:28 < winter> i just runned /etc/init.d/openvpn start and it didnt start, it failed, that's all
23:28  * ecrist points to suggestion on how to solve THAT problem by vpnHelper, as well
23:28 < Bushmills> server-bridge with tun?
23:28 < ecrist> hehe
23:28  * ecrist leave Bushmills to it
23:28 < winter> Bushmills: yess
23:29 < Bushmills> ecrist knows tap. i know tun
23:29 < Bushmills> make up youir mind which one you want
23:31 < winter> http://wklej.org/id/466503/
23:31 <@vpnHelper> Title: Wklejka #466503 | Wklej.org (at wklej.org)
23:31 < winter> this one have no comments
23:33 < winter> Bushmills: i want tun because i've read that it allows for lan gaming or smaba shareing
23:33 < Bushmills> use better, i.e. more correct documents than the one you read
23:34 < winter> http://openvpn.net/index.php/open-source/documentation/howto.html ?
23:34 <@vpnHelper> Title: HOWTO (at openvpn.net)
23:34 < Bushmills> !tunortap
23:34 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
23:34 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
23:35 < Bushmills> if the document is correct, than the problem must be the reading
23:35 < winter> so i should use tap
23:35 < Bushmills> then ...
23:36 < winter> but why it wont start
23:39 < Bushmills> i'm not going to try to start a server with your config file, only to get a look at the logs
23:40 < winter> #find /var/log -name "*openvpn*" | wc -l
23:40 < winter> 0
23:40 < Bushmills> try full path
23:41 < winter> you mean?
23:41 < Bushmills>   log         openvpn.log 
23:43 < Bushmills> and make up your mind whether you want to recreate or append to log
23:45 < winter> it still logs nothing
23:45 < winter> hopeless
23:46 < winter> i'm pretty sure that i forced it to run some time ago, now it hates me
23:46 < Bushmills> use example config, know to work. confirm that log files are written. modify it towards your current config.
23:47 < winter> ok, good idea
23:47 < winter> let me just finish my cigarette
23:50 < winter> ok it runned with default conf
23:50 < winter> i'll start to modify it
23:59 < winter> strange, it runs now
23:59 < winter> but tap09 has no address
23:59 < winter> tap0*
--- Day changed Sat Jan 29 2011
00:02 < winter> and still there are no logs, probably because it's running on user nobody and group nogroup
00:10 < winter> no
00:20 -!- zeshoem [~mnathani@70.52.168.144] has joined #openvpn
00:38 < zeshoem> Greetings, I have the following setup and would appreciate some assistance getting it to work: http://mnathani.com/OpenvpnXp.JPG
00:42 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
00:45 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Client Quit]
00:46 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 240 seconds]
01:12 < zeshoem> I am currently getting the following error:   Sat Jan 29 02:09:33 2011 us=956274 client1/70.52.A.B:53816 MULTI: bad source address from client [192.168.30.10], packet dropped
01:49 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
01:55 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
01:56 -!- WinstonSmith [~true@f052101082.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
02:08 < zeshoem> !linroute
02:08 < zeshoem> !liroute
02:08 < zeshoem> !route
02:08 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
02:08 < zeshoem> !redirect
02:08 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
02:08 < zeshoem> !ipforward
02:09 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
02:09 < zeshoem> !linipforward
02:09 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
02:22 -!- WinstonSmith [~true@e179002158.adsl.alicedsl.de] has joined #openvpn
02:33 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
02:48 -!- holopaw_ [~holopaw@206.125.175.3] has quit [Ping timeout: 265 seconds]
02:48 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has joined #openvpn
02:49 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Ping timeout: 276 seconds]
02:49 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
03:37 -!- zeshoem [~mnathani@70.52.168.144] has quit [Ping timeout: 240 seconds]
03:41 -!- zeshoem [~mnathani@70.52.168.144] has joined #openvpn
03:44 -!- venom00ut [~asdfds@unaffiliated/venom00] has joined #openvpn
03:47 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has quit [Read error: Connection reset by peer]
03:47 -!- holopaw [~holopaw@206.125.175.3] has joined #openvpn
04:01 -!- djgerm [~Your_Moms@2607:f6f0:100:1:6233:4bff:fe06:d048] has joined #openvpn
04:10 -!- s7r [~s7r@89.39.174.74] has joined #openvpn
04:26 -!- Fleck [~we@unaffiliated/fleck] has quit [Remote host closed the connection]
04:30 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
05:03 -!- holopaw [~holopaw@206.125.175.3] has quit [Read error: Connection reset by peer]
05:04 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has joined #openvpn
05:16 -!- xindz`off is now known as xindz
05:17 -!- WinstonSmith [~true@e179002158.adsl.alicedsl.de] has quit [Ping timeout: 260 seconds]
05:33 -!- WinstonSmith [~true@g225029202.adsl.alicedsl.de] has joined #openvpn
05:59 < zeshoem> ping
06:04 -!- zeshoem [~mnathani@70.52.168.144] has quit [Read error: Operation timed out]
06:05 -!- zeshoem [~mnathani@70.52.168.144] has joined #openvpn
06:15 -!- WinstonSmith [~true@g225029202.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
06:16 -!- zoobab [zoobab@vic.ffii.org] has left #openvpn []
06:24 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
06:30 -!- WinstonSmith [~true@e179009002.adsl.alicedsl.de] has joined #openvpn
06:35 -!- djgerm [~Your_Moms@2607:f6f0:100:1:6233:4bff:fe06:d048] has quit [Quit: Leaving.]
06:42 -!- xindz is now known as xindz`off
06:54 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
06:54 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
06:54 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:35 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 276 seconds]
07:36 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
07:39 -!- TypoNe is now known as Typone
08:06 -!- SOG [~SOG@n11649233222.netvigator.com] has joined #openvpn
08:11 -!- mosno [~mosno@unaffiliated/mosno] has quit [Disconnected by services]
08:18 -!- xindz`off is now known as xindz
08:25 < ecrist> good morning, children
08:33 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
08:34 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:35 <@vpnHelper> RSS Update - forum: Read UDPv4: No buffer space available (WSAENOBUFS) code=1005 <http://forums.openvpn.net/topic7570.html>
09:14 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:17 -!- Cain` [~Geek@41.141.252.98] has joined #openvpn
09:17 -!- Cain` [~Geek@41.141.252.98] has quit [Changing host]
09:17 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:20 -!- Cain` is now known as Cain
09:32 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
09:42 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:51 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
09:59 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
09:59 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
09:59 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
10:00 -!- Dave158 [~Dave@unaffiliated/tippy] has quit [Read error: Connection reset by peer]
10:09 -!- echoSMILE [~smile@unaffiliated/echosmile] has joined #openvpn
10:09 < echoSMILE> !welcome
10:09 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:09 < echoSMILE> !goal
10:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:10 -!- dredd [5d233c46@gateway/web/freenode/ip.93.35.60.70] has joined #openvpn
10:10 < dredd> ok!
10:10 < echoSMILE> * Check your logs to see why startup failed
10:10 < echoSMILE> where i can see that log? :>
10:10 < dredd> Bushmills you remember me :?= 
10:10 < dredd> :P
10:13 -!- Diavol|Laptop [~Demon@83.251.86.251] has joined #openvpn
10:13 < Diavol|Laptop> !welcome
10:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:14 < Diavol|Laptop> !goal
10:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:14 < Diavol|Laptop> !logs
10:14 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
10:14 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
10:15 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
10:15 < Diavol|Laptop> hmm
10:17 -!- Diavol|sever [53fb56fb@gateway/web/freenode/ip.83.251.86.251] has joined #openvpn
10:17 < Diavol|sever> hi
10:18 < Diavol|sever> i folow https://help.ubuntu.com/community/OpenVPN
10:18 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
10:18 < Diavol|sever> and i am done with most of the guide
10:18 < Diavol|sever> but when i do sudo /etc/init.d/openvpn restart
10:19 < dredd> here is my configuration  http://pastebin.com/5CDemtvE i would like to access internet over my vpn 
10:19 < Diavol|sever> i get that * Autostarting VPN 'server'            [fail]
10:19 < dredd> the connection is green.. but when i try to open a web page i can't it's blank
10:19 < Diavol|sever> what could it be for problem
10:19 < Diavol|sever> ?
10:20 -!- echoSMILE [~smile@unaffiliated/echosmile] has quit [Quit: leaving]
10:21 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
10:22 < Diavol|sever> people?
10:23 < dredd> wait someone will wake up
10:23 < Diavol|sever> mmm
10:24 -!- LumberCartel [~LumberCar@24.86.160.252] has joined #openvpn
10:25 < LumberCartel> Hello folks.  Does the OpenVPN "log" option (which I will need to use to supress console output) limit the size of the log file?  Or does it just grow indefinitely?
10:26 -!- alhadi [~thunderst@92.96.246.132] has quit [Ping timeout: 240 seconds]
10:27 -!- alhadi [~thunderst@85.17.20.89] has joined #openvpn
10:27 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9454>
10:29 < Diavol|sever> http://pastebin.com/FhwfJwkL min /etc/openvpn/server.conf
10:30 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
10:30 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
10:31 < Diavol|Laptop> !configs
10:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
10:31 < Diavol|Laptop> !welcome
10:31 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:32 < Diavol|Laptop> !interface
10:32 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
10:35 -!- Dominicus [~chatzilla@unaffiliated/dominicus] has joined #openvpn
10:36 < LumberCartel> Diavol|Laptop:  Do you have a question about your configuration file?
10:36 < Dominicus> !welcome
10:36 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:37 < dredd> !howto
10:37 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
10:37 < Diavol|Laptop> LumberCartel, whel, i dont know what is wrong
10:37 < Diavol|Laptop> i think that it chould be my config file
10:37 < LumberCartel> Could you be more specific about your problem?
10:37 < dredd> here is my configuration  http://pastebin.com/5CDemtvE i would like to access internet over my vpn , connection is green with no errors
10:39 < Diavol|Laptop> LumberCartel, whell i folowed the guide on https://help.ubuntu.com/community/OpenVPN when i came to sudo /etc/init.d/openvpn restart i get that server not start
10:39 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
10:39 < Diavol|Laptop> i get that * Autostarting VPN 'server'            [fail]
10:40 < LumberCartel> Diavol|Laptop:  Have you checked the system log files?  They often provide a lot more insight into the problem.  I assume you're using Unix.
10:40 < Diavol|sever> yes, ubuntu
10:40 < LumberCartel> Ah, sorry, I see you're using Linux.  =)
10:41 < Diavol|sever> whit syslogs do you want to see?
10:41 < LumberCartel> You did create your DH key, right?  I find that people sometimes miss this step.
10:42 < LumberCartel> No, I'm suggesting that you take a look at it.  It may contain sensitive information that you don't want to share online.
10:42 < Diavol|sever> ok
10:42 < krzee> the log shouldnt have sensitive info
10:42 < Diavol|sever> i did 'openvpn --genkey --secret ta.key' 
10:42 < krzee> (but im bout to get on a plane)
10:42  * LumberCartel assumes that Linux is similar to NetBSD (which he uses) in that the output may be stored in /var/log/messages
10:43 < LumberCartel> krzee:  It depends on what's righting to it.  I agree that it shouldn't though.
10:43 < LumberCartel> s/righting/writing/
10:43 < LumberCartel> Diavol|Laptop:  That's your TLS key, not your DH stuff.
10:44 < LumberCartel> If you did the "build-dh" step, then you should be fine.
10:44 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
10:45 < LumberCartel> See lines 19 through 24 of your configuration file (the one you posted)?  Make sure each of those files is there, and that they actually have some contents in them.  Do NOT share these online.
10:45 -!- sia^pwnnt is now known as sia
10:46 < Diavol|sever> diavol@DiavilServer:/etc/openvpn$ ls ca.crt      down.sh   ipp.txt             server.conf  server.key  update-resolv-conf dh1024.pem  easy-rsa  openvpn-status.log  server.crt   ta.key      up.sh
10:47 < dredd> LumberCartel:  can you take a look at my pastebin?
10:47 < Diavol|sever> LumberCartel: yes, i have all the key files in the /etc/openvpn/
10:47 < LumberCartel> dredd:  Okay (I was hoping someone else would help you because I'm already trying to help Diavol|Laptop).
10:47 < dredd> :)
10:48 < dredd> dont worrry!
10:48 < LumberCartel> Whew!  =D
10:48 < dredd> hiih
10:49 < LumberCartel> Diavol|Laptop:  So can you check your syslog for errors from OpenVPN?
10:49 < LumberCartel> dredd:  What do you mean by "access the internet with OpenVPN?"
10:49 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
10:50 < dredd> tunnel everything
10:50 -!- Meliorator [m@dunnington.eu] has quit [Remote host closed the connection]
10:50 < Diavol|sever> br0: port 1(eth0) entering forwarding state
10:50 < LumberCartel> dredd:  Well, you obviously can't tunnel the OpenVPN tunnel itself.  =P
10:50 < dredd> no of course
10:51 < dredd> but i can't even ping the openvpn server on the virtual lan though it says it is connected..
10:51 < dredd> and the everything goes fine
10:51 < dredd> *that
10:51 < LumberCartel> Your best bet will be to set up a proxy.
10:51 < LumberCartel> ...then configure your software to proxy through it.
10:52 < LumberCartel> Also, look into "gateway" options in the "man openvpn" page.
10:52 < Diavol|sever> LumberCartel: no errors in /var/logs/messages when restarting vpn
10:52 < dredd> so you mean proxy 10.8.0.1 ?
10:52 < dredd> but in this way if i have a proxy to access internet it becomes problematic
10:53 < dredd> to gateway i use push "redirect-gateway def1"
10:55 -!- Meliorator [m@dunnington.eu] has joined #openvpn
10:55 < LumberCartel> The problem with pushing your gateway to something in 10.8.0.1 is that you'll probably get disconnected.
10:56 < dredd> yes..
10:56 < dredd> that is what happens..
10:56 < dredd> but the connection is always green..
10:57 < dredd> because i'm also behind a proxy in the client..
10:57 < dredd> but right now i'm trying to make it work from a different station where internet is completely accessible
10:58 < Bushmills> dredd: vaguely
10:59 < LumberCartel> Sorry, my youngest daughter is sick and I had to attend to her.
10:59 < LumberCartel> Diavol|Laptop:  No errors, but it doesn't start?
11:00 < Diavol|Laptop> yes
11:01 < Diavol|Laptop> but now i lookt in syslog
11:01 < Diavol|Laptop> there i found:
11:01 < Diavol|sever> Jan 29 17:51:02 DiavilServer ovpn-server[4579]: RESOLVE: Cannot resolve host address: <127.0.0.1>: [HOST_NOT_FOUND] The specified host is unknown.
11:01 < Diavol|sever> what for host addres do it want?
11:04 < LumberCartel> You need to specify the public IP address.
11:04 < LumberCartel> ...because your OpenVPN clients will need to connect to that IP.
11:04 < LumberCartel> 127.0.0.1 is localhost.
11:05 < Diavol|sever> ok
11:06 < LumberCartel> So, for line 4, just specify an IP address instead of what you have there now.  It should read something like this:  local 83.251.86.251
11:07 < LumberCartel> If you don't specify an IP at all, then 0.0.0.0 will be used to bind to all interfaces...
11:07 < LumberCartel> But this isn't always desireable...
11:07 < LumberCartel> ...because remote users who come on site will still wind up getting connected and then stuff won't work.
11:08 < LumberCartel> if you only listen on the public IP, then OpenVPN will fail to connect for them when they're connected locally, which is definitely better.
11:08 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
11:09 < Diavol|sever> still fail
11:09 < LumberCartel> dredd:  You see, if you override the gateway, then the OpenVPN tunnel will be pushed through the gateway instead of its current route, and then you'll lose your VPN connection.  After the VPN connection is lost, then the gateway will go back to what it was and your VPN will connect again, and you'll be stuck in a crazy loop.
11:09 < Diavol|sever> Jan 29 18:08:34 DiavilServer ovpn-server[4755]: RESOLVE: Cannot resolve host address: <83.251.86.251>: [HOST_NOT_FOUND] The specified host is unknown.
11:09 < LumberCartel> Diavol|Laptop:  Is that actually the public IP address of the computer you're configuring OpenVPN server on?
11:10 < Diavol|Laptop> yes
11:10 < dredd> thanks for the clarification i didn't know that
11:10 < LumberCartel> Are you specifying the IP address as a pure IP address, or are there other characters there?  Please past just that line here.
11:10 < LumberCartel> s/past/paste/
11:10 < dredd> but why i can't even ping the vpn server? and what would be the solution to redirect the traffic?
11:11 < LumberCartel> dredd:  Might be due to ICMP traffic being disabled on the other side, or a firewall issue on your side.
11:11 < LumberCartel> dredd:  A lot of people shut off ICMP due to Widows vulnerabilities.
11:11 < LumberCartel> s/shut off/block/
11:11 < dredd> ok..
11:12 < Diavol|Laptop> LumberCartel, yes, it is realy my ip adress, it is what i need to go to when i go to my webpage
11:12 < LumberCartel> Diavol|Laptop:  That wasn't my question.  Could you paste just that one line here?  I suspect you might have other characters on that line that are causing a problem.
11:13 < Diavol|Laptop> and my webpage are on the same computer as i try to config openvpn on
11:13 < Diavol|Laptop> whith line?
11:13 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:13 < LumberCartel> The line that starts with the word "local"
11:14 < Dominicus> !logs
11:14 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
11:14 < Dominicus> !configs
11:14 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
11:14 < Diavol|sever> local <83.251.86.251> ## ip/hostname of server
11:14 < Dominicus> !interface
11:14 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
11:14 < LumberCartel> Diavol|Laptop:  Change it to this:  local 83.251.86.251
11:14 < LumberCartel> Diavol|Laptop:  You have extra characters there that don't belong.
11:15 < Diavol|Laptop> hmm
11:15 < Diavol|Laptop> still fail
11:15 < LumberCartel> Well, "<" and ">" are not valid characters for hostnames or IP addresses.
11:15 < Diavol|sever> local 83.251.86.251
11:15 < LumberCartel> What error do you get now when you start?
11:15 < Diavol|sever> is it now
11:15 < LumberCartel> It is correct now.
11:16 < Diavol|sever> Jan 29 18:16:12 DiavilServer ovpn-server[4871]: TLS-Auth MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ] Jan 29 18:16:12 DiavilServer ovpn-server[4871]: TCP/UDP: Socket bind failed on local address [AF_INET]83.251.86.251:1194: Cannot assign requested address Jan 29 18:16:12 DiavilServer ovpn-server[4871]: Exiting
11:16 -!- dredd [5d233c46@gateway/web/freenode/ip.93.35.60.70] has quit [Ping timeout: 265 seconds]
11:16 < LumberCartel> Okay, so now you have progress.
11:16  * LumberCartel smirks.
11:17 < Diavol|sever> :)
11:17 < LumberCartel> Type this command:  ps ax | grep openvpn
11:17 < LumberCartel> Is anything already running?
11:18 < Diavol|sever> no
11:19 < Dominicus> !pb
11:19 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
11:19 < LumberCartel> Well, usually that error will appear for one of two reasons -- the IP address isn't actually bound locally (unlikely in your case), or something else is already listening on that IP and port number.
11:20 -!- Irssi: #openvpn: Total of 138 nicks [4 ops, 0 halfops, 0 voices, 134 normal]
11:21 < LumberCartel> Of course, if something crashed without letting go of the port and your OS didn't clean things up properly, then it could just be lingering from earlier.  In that case, a reboot may be your only option.
11:21 < Diavol|Laptop> hmm
11:22 < Diavol|Laptop> i will try
11:23 < LumberCartel> It seems you're not the only one experiencing this problem:  http://www.sporticia.com/blog/unix/openvpn-tcpudp-socket-bind-failed-2
11:23 -!- dredd [5d233c46@gateway/web/freenode/ip.93.35.60.70] has joined #openvpn
11:23 -!- corretico [~laguilar@201.201.44.82] has quit [Read error: Connection reset by peer]
11:23 < dredd> LumberCartel:  so what would be the solution, is my config file wrong?
11:24 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
11:25 < LumberCartel> I think your configuration file is okay.  I suspect you have some firewall issues interfering with ICMP traffic somewhere.  Can you actually connect to something hosted on the remote system, such as a web server or something like that?
11:26 < dredd> i just installed i freeproxy server 
11:26 < dredd> *a free proxy server in the computer where openvpn server is on and redirection works..
11:27 < dredd> so i guess is something wrong in the configuration of openvpn
11:27 < dredd> and gateway issues
11:27 -!- diavol|server [53fb56fb@gateway/web/freenode/ip.83.251.86.251] has joined #openvpn
11:27 -!- Diavol|sever [53fb56fb@gateway/web/freenode/ip.83.251.86.251] has quit [Ping timeout: 265 seconds]
11:28 < LumberCartel> OpenVPN won't interfere with ICMP.  The fact that you can connect to the remote system is good.
11:28 < LumberCartel> Diavol|Laptop:  Is it binding now?
11:28 < LumberCartel> Easy way to check if OpenVPN is running:  /etc/rc.d/openvpn status
11:28 < dredd> i can! i'm connected right now with vnc
11:29 < dredd> i can't just redirect the traffic 
11:29 < LumberCartel> Or, if you're not on the wonderful RC system then this will suffice:  ps ax | grep openvpn
11:29 < LumberCartel> dredd:  Well, that's where gateway redirection comes in.
11:30 < LumberCartel> dredd:  So, if your local computer's gateway is changed to that remote computer, you'll be okay except for that catch-22 with the VPN traffic getting clobbered.
11:30 < LumberCartel> dredd:  This is why I suggested using a proxy server setup.
11:30 < dredd> if i use push "redirect-gateway local def1" then everything goes blank in my client
11:30 < LumberCartel> dredd:  That's the problem.
11:31 < dredd> so if i cant push and f i can't use proxy
11:31 < dredd> what can i do?
11:31 < LumberCartel> I'm not aware of OpenVPN having any option to redirect the gateway for everything EXCEPT its own connection.  =(
11:31 < dredd> argh
11:31 < dredd> it's seems strange i mean that is the purpose of vpns..
11:32 < LumberCartel> Well, you could try it.  Make sure you have another way to get into the server if you're not connected via VPN first though.
11:33 < dredd> what do you mean by that?
11:33 < LumberCartel> dredd:  Look in the man page for this flag:  --redirect-gateway flags
11:33 -!- DirtySanchez [~mago@187.131.145.138] has joined #openvpn
11:33 < LumberCartel> dredd:  What I meant was this:  1. Make sure you can connect remotely to the server when the VPN is not functioning.  2. Try setting the gateway stuff and see it if works.
11:34 < dredd> 1. i can i'm currently setting up the openvpn config file through vnc connection 
11:34 < dredd> 2. i did maybe i'm wrong :S
11:35 < LumberCartel> I've seen mixed results with this gateway stuff.  Some OSes really suck for handling routing.
11:35 < LumberCartel> That's why you'll need to experiment.
11:36 < LumberCartel> Diavol|Laptop:  How is your VPN working now?
11:36 < dredd> should i push the dhcp options?
11:36 < LumberCartel> I suggest changing as little as possible when experimenting.  It makes it easier to understand what's going on.
11:37 < dredd> yes galileo told me :P
11:37  * LumberCartel laughs.
11:37 < Diavol|Laptop> LumberCartel, not working
11:37 < LumberCartel> Darn it.  =(
11:38 < Diavol|Laptop> but in the link you shared 
11:38 < LumberCartel> What error is in your log file now?
11:38 < Diavol|Laptop> it says that i ahve to have a bridge-util in rc5.d
11:38 < LumberCartel> Oh, is that all?
11:38 < Diavol|Laptop> LumberCartel, the same in syslog
11:38 < LumberCartel> I think I encountered a problem like this in NetBSD.
11:39 < LumberCartel> The utility has a different name on our OSes as I recall.
11:39 < Diavol|Laptop> but i looks like i have problems with britge-util
11:39 < LumberCartel> On NetBSD the tool is called "brctl" instead.
11:40 < Diavol|Laptop> hmm
11:40 < dredd> Pushing the redirect-gateway option to clients will cause all IP network traffic originating on client machines to pass through the OpenVPN server. The server will need to be configured to deal with this traffic somehow, such as by NATing it to the internet, or routing it through the server site’s HTTP proxy.
11:41 < dredd> so i added this one
11:41 < dredd> route add 10.8.0.6 255.255.255.0 192.168.1.2 
11:43 < LumberCartel> dredd:  For the client, I think it will try to find 192.168.1.2 locally.
11:44 < dredd> mmh?
11:44 < dredd> that line is on the server
11:44 < LumberCartel> dredd:  Oh, then that's fine.
11:44 < LumberCartel> dredd:  It's correct in that you'll need to set up NAT though (I recommend "pf" but there are many options available -- pick your favourite).
11:45 < dredd> pf? 
11:45 < LumberCartel> dredd:  With NAT, you won't need a proxy as long as your gateway stuff works properly.
11:45 < dredd> i 'm on windows on both client and server
11:45 < LumberCartel> Oh, ouch.
11:45 < LumberCartel> Yeah, you'll need third-party products then.
11:45 < dredd> wow it's getting hot here
11:46 < dredd> third-party product like?
11:46 < LumberCartel> Windows, unfortunately, is one of those OSes that sucks at routing internet traffic.
11:46 < dredd> ahhh
11:46 < LumberCartel> Well, for example, NAT -- if you have a hardware router, or some software, those won't come from Microsoft.
11:46 < dredd> but how can the proxy server work
11:46 < dredd> and openVpn doesn't
11:47 < LumberCartel> Well, your comptuer can be configured to use a proxy which is done by specifying the proxy server's IP address.  This doesn't affect routing -- screwing around with the gateway does.
11:48 < dredd> so with this sentence i understand the problem is in the client
11:48 < dredd> not in the server
11:48 < dredd> right
11:48 < LumberCartel> Diavol|Laptop:  I don't use the "up" and "down" directives at all to configure the bridge.  Instead, I have an /etc/ifconfig.bridge0 file that contains two lines:
11:48 < LumberCartel> create
11:48 < LumberCartel> !brconfig $int add wm0 up
11:49 < Diavol|Laptop> ok
11:49 < Diavol|Laptop> i try with it
11:50 < LumberCartel> Diavol|Laptop:  You'll need to change "wm0" to the correct NIC though, so make sure you're OS works the same way as NetBSD does when you do this -- the command "brconfig" might be different for you too.
11:51  * LumberCartel notes that with so many different flavours of Unix and distributions of Linux there has been an unfortunate problem with some variation that is only increasing over time.
11:51 < Diavol|Laptop> agree
11:51  * Diavol|Laptop using arch and ubuntu
11:51 < Diavol|Laptop> and it is a verry big different
11:52  * LumberCartel is using NetBSD and in the process of phasing out his Widows boxen.
11:56 -!- LumberCartel is now known as PhilKenSebben
11:57 -!- PhilKenSebben is now known as LumberCartel
11:58 < LumberCartel> dredd:  Does the VNC connection work if you try to connect through OpenVPN?  Your server's IP should be 10.8.0.1 in this case.
11:59 < dredd> i can't ping!
11:59 < dredd> so i didn't even try vnc
11:59 < LumberCartel> Try VNC to that IP.
11:59 < LumberCartel> If you're prompted for a password, then it's working.
12:00 < dredd> i'll give it a try wait 
12:00  * LumberCartel nods.
12:00 < dredd> because if i connect i loose web connection
12:01 < dredd> :)
12:01 < dredd> *if i connect to the vpn
12:06 -!- diavol|server [53fb56fb@gateway/web/freenode/ip.83.251.86.251] has quit [Quit: Page closed]
12:08 -!- Daiavol|Server [53fb56fb@gateway/web/freenode/ip.83.251.86.251] has joined #openvpn
12:08 -!- dredd [5d233c46@gateway/web/freenode/ip.93.35.60.70] has quit [Ping timeout: 265 seconds]
12:08 < Diavol|Laptop> !brconfig $int add wm0 up
12:13 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
12:15 -!- SOG_ [~SOG@n11649233222.netvigator.com] has joined #openvpn
12:17 -!- SOG [~SOG@n11649233222.netvigator.com] has quit [Ping timeout: 265 seconds]
12:17 -!- SOG_ is now known as SOG
12:19 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
12:21 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
12:26 -!- Daiavol|Server [53fb56fb@gateway/web/freenode/ip.83.251.86.251] has quit [Quit: Page closed]
12:29 -!- LumberCartel [~LumberCar@24.86.160.252] has quit [Quit: RFCs the easy way -- http://www.openrfc.org/]
12:44 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
12:45 < EugeneKay> Would somebody be so kind as to point me at a high-res(100x100+) or SVG version of the OpenVPN logo? I'm making a "proper" icon for my phone's VPN button.
13:00 < EugeneKay> Oooh, found one that works.
13:01  * EugeneKay waves
13:01 -!- EugeneKay [EugeneKay@eugenekay.com] has left #openvpn ["Leaving"]
13:26 -!- Dominicus [~chatzilla@unaffiliated/dominicus] has quit [Ping timeout: 265 seconds]
13:27 < DirtySanchez> Hello im trying to configure a openvpn server, it seems that i have everything up and runing, the thing is i cant get an external remote computer to connect to my server it says "key negotiation faild to accur within 60 secs check your network connectivity"
13:28 < DirtySanchez> i got openvpn runing on default port.. i have flushed all iptables and have set ufw to allow openvn go in and out
13:28 -!- Dominicus [~chatzilla@184-203-56-61.pools.spcsdns.net] has joined #openvpn
13:28 < DirtySanchez> the thing is when i do a nmap to scan open ports on my own machine, it says i have all ports closed
13:28 < DirtySanchez> can someone here help me?
13:29 -!- Dominicus [~chatzilla@184-203-56-61.pools.spcsdns.net] has quit [Changing host]
13:29 -!- Dominicus [~chatzilla@unaffiliated/dominicus] has joined #openvpn
13:33 -!- dredd [5d233c46@gateway/web/freenode/ip.93.35.60.70] has joined #openvpn
13:33 < dredd> i've been trying a lot but i cannot make redirecting connection to work in my opevpn
13:33 < dredd> :(
13:41 < hyper_ch> ecrist: http://gizmodo.com/5746639/perform-the-kama-sutra-with-your-laptop
13:41 <@vpnHelper> Title: Perform the Kama Sutra with Your Laptop (at gizmodo.com)
13:51 -!- s7r [~s7r@89.39.174.74] has left #openvpn []
13:52 < Bushmills> dredd: if you lose net, that's a sign that *redirection* works
13:52 < Bushmills> but it is also a sign that the server doesn't forward your requests
13:54 < Bushmills> (that means, your problem is most likely not one of openvpn setup, but of server configuration)
13:55 -!- dredd [5d233c46@gateway/web/freenode/ip.93.35.60.70] has quit [Ping timeout: 265 seconds]
13:55 -!- dreddd [5d233c46@gateway/web/freenode/ip.93.35.60.70] has joined #openvpn
13:55 < dreddd> yes Bushmills 
13:56 < dreddd> but what i should do to make it really work!
13:56 < hyper_ch> Bushmills: the above link is also good for you
13:56 < Bushmills> set up your server accordingly
13:56 < dreddd> i'm trying 
13:57 < dreddd>  http://pastebin.com/5CDemtvE  this is my configuratoin
13:59 < Bushmills> (20:54:55) Bushmills: (that means, your problem is most likely not one of openvpn setup, but of server configuration)
14:00 < Bushmills> now what you show is your vpn setup
14:01 < Bushmills> it is useless to look at the files which are unlikely to cause the problem
14:04 -!- dreddd [5d233c46@gateway/web/freenode/ip.93.35.60.70] has quit [Ping timeout: 265 seconds]
14:06 -!- DREDD [5d233c46@gateway/web/freenode/ip.93.35.60.70] has joined #openvpn
14:06 < DREDD> yes Bushmills  i understand the problem is in the server :(
14:10 < Bushmills> why don't you fix it, then?
14:11 < DREDD> because i don't know how to do it :)
14:11 < DREDD> otherwise i wouldn't be here eheh
14:11 -!- DREDD is now known as dredd
14:11 < Bushmills> !redirect
14:11 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:11 < Bushmills> !ipforward
14:11 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:11 < Bushmills> !nat
14:11 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:12 < Bushmills> !firewall
14:12 < dredd> you already made me see that
14:12 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
14:12 < Bushmills> but that's all what is about it, except maybe 
14:12 < Bushmills> !dns
14:12 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4
14:12 < dredd> i don't it just doesn't work..
14:12 < Bushmills> many prefer to run a recursor on the vpn server, or even on the client
14:13 < Bushmills> http://scarydevilmonastery.net/masq   <- for linux
14:14 < Bushmills> second line is  nat, third line is enabling ip forwarding
14:14 -!- dreddd1 [5d233c46@gateway/web/freenode/ip.93.35.60.70] has joined #openvpn
14:14 < dreddd1> how does a recursor work
14:14 < dreddd1> first do you think my configuration is right?
14:14 < Bushmills> a recursive name server.  i haven't even seen your config - unless you mean your vpn config
14:15 < Bushmills> but, as determined already, that's not your problem
14:15 < Bushmills> losing internet when connecting to vpn is a sign that redirect-gateway is in operation, and successful
14:16 -!- dredd_ [5d233c46@gateway/web/freenode/ip.93.35.60.70] has joined #openvpn
14:16 -!- WinstonSmith [~true@e179009002.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
14:16 < dredd_> sorry for my connection... i need to use a wireless in order to bypass my firewall
14:16 < Bushmills> your client goes through the vpn, but your server doesn't play along.  most likely.   try with ip address instead of host name, by pinging, for example.
14:16 -!- Dominicus [~chatzilla@unaffiliated/dominicus] has quit [Ping timeout: 240 seconds]
14:16 < dredd_> yes i can't ping.. 
14:16 < dredd_> ping 10.8.0.1 fails
14:17 < Bushmills> if ping to an address is just as unsuccessful, the problem is not (only) dns
14:17 < Bushmills> i don't know what 10.8.0.1 is.  definitely not an address routed to internet
14:17 -!- dredd [5d233c46@gateway/web/freenode/ip.93.35.60.70] has quit [Ping timeout: 265 seconds]
14:18 < Bushmills> therefore a bad example for testing forwarding to internet
14:19 -!- dreddd1 [5d233c46@gateway/web/freenode/ip.93.35.60.70] has quit [Ping timeout: 265 seconds]
14:19 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
14:19 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
14:19 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:19 < dredd_> well pinging google doesnt work 
14:20 -!- Dominicus [~chatzilla@184-203-56-61.pools.spcsdns.net] has joined #openvpn
14:20 < dredd_> i'm trying to solve my vpn problem with hamachi..
14:24 -!- alhadi [~thunderst@85.17.20.89] has quit [Quit: alhadi]
14:28 -!- DirtySanchez [~mago@187.131.145.138] has quit [Quit: Leaving]
14:33 -!- WinstonSmith [~true@g225025190.adsl.alicedsl.de] has joined #openvpn
14:37 -!- dredd_ [5d233c46@gateway/web/freenode/ip.93.35.60.70] has quit [Ping timeout: 265 seconds]
14:38 -!- Dominicus [~chatzilla@184-203-56-61.pools.spcsdns.net] has quit [Changing host]
14:38 -!- Dominicus [~chatzilla@unaffiliated/dominicus] has joined #openvpn
14:38 <@vpnHelper> RSS Update - forum: Unable to RDP over tunnel. <http://forums.openvpn.net/topic7571.html>
14:44 < Dominicus> I'm having a devil of a time figuring out what I'm doing wrong. I can establish a vpn session, but I can't ping/telnet:22 to the vpn server. http://pastebin.com/apDeg7e5. Please let me know if I need to provide more information. I'm new at setting up TAP devices, so I'm not even sure if I'm doing that right.
14:48 -!- dredd [83af0c56@gateway/web/freenode/ip.131.175.12.86] has joined #openvpn
14:49 < Dominicus> !goal
14:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:50 < dredd> apparently i've been able to tunnel through hamachi... the problem is in the environment where i want to tunnel i cannot log in to hamachi :D
14:50 < Bushmills> Dominicus: firewall, or telnet server not bound to vpn interface
14:52 < Dominicus> Bushmills: I'm not really sure what that means. lol
14:54 < Bushmills> chances are that telnet simply doesn't listen to the vpn interface.   netstat can be used to check that
14:54 < Bushmills> take notice that often, telnet daemon is only invoked indirectly, through inetd or similar
14:57 <@vpnHelper> RSS Update - forum: Handshake Issues <http://forums.openvpn.net/topic7572.html>
14:57 < Dominicus> Bushmills: I was actually trying to use telnet to see if I could communicate with the ssh port (tcp     0     0 0.0.0.0:22     0.0.0.0:*     LISTEN), because I was unable to ping the ip address of the server's ethernet/br0 interface. I can only assume, that the OpenVPN server isn't being bridged properly to the debian linux's networking setup.
15:02 -!- dredd [83af0c56@gateway/web/freenode/ip.131.175.12.86] has quit [Quit: Page closed]
15:13 -!- Diavol|Laptop [~Demon@83.251.86.251] has quit [Ping timeout: 246 seconds]
15:14 -!- Diavol|Laptop [~Demon@83.251.86.251] has joined #openvpn
15:19 < winter> Bushmills: i stayed to say thanks
15:19 < winter> it seems that it's working now
15:21 < Bushmills> oh, you said "can't ping" - i somehow read "can ping" and understood that only telnet didn't work
15:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
15:34 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
15:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
15:37 -!- s7r [~s7r@89.39.174.74] has joined #openvpn
15:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:57 -!- venom00ut [~asdfds@unaffiliated/venom00] has quit [Quit: ☃]
16:09 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
16:18 < mete> helo guys
16:18 < mete> is it normal that tcp openvpn connections has a very high latency when there is some traffic?
16:23 < Bushmills> not really, but that may be a sign of packet loss
16:24 < Bushmills> could also be an indication for MTU sizes not suitable
16:25 -!- Dominicus [~chatzilla@unaffiliated/dominicus] has quit [Ping timeout: 250 seconds]
16:25 < mete> hmmmh
16:25 < mete> what MTU should I use?
16:26 < mete> with udp the link is much faster
16:26 < fipu_> mete: miiiönngiiiii
16:26 < fipu_> xDDD
16:28 < Bushmills> !tcp
16:28 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
16:29 < Bushmills> look up --mtu-test in man page
16:33 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
16:34 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
16:41 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:52 < mete> Bushmills: do I need to set the parameter on client or server side? or on both?
16:52 < mete> :)
16:52 < Bushmills> makes most sense to run it on client after server has been started
16:54 < mete> k, do I need to test that on each client?
16:55 -!- WinstonSmith [~true@g225025190.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
16:55 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 265 seconds]
16:56 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
16:57 -!- Typone is now known as TypoNe
17:07 -!- Lantizia [~Lantizia@erebus.seaquake.net] has joined #openvpn
17:09 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Ping timeout: 240 seconds]
17:11 < Bushmills> no. only on those you're interested in optimal MTRs
17:12 < mete> Options error: --mtu-test only makes sense with --proto udp
17:12 < mete> hmmh
17:12 < mete> ^^
17:12 < Bushmills> for those on same site, you can probably assume that results would be identical
17:13 < mete> so I need to test that on upd for the mtu Bushmills?
17:18 -!- DirtySanchez [~mago@187.158.23.151] has joined #openvpn
17:19 < DirtySanchez> can someone here help me setting up openvpn? im having trouble connecting from outside my lan.. openvpn doesnt seem to be open in my computer
17:20 < DirtySanchez> openvpn port*
17:20 < bo_root> port forwarding on router
17:20 -!- lau_ [~lau@websiteburo-188-46.cnt.nerim.net] has joined #openvpn
17:20 < DirtySanchez> i did already.. still cant connect, im doing a nmap scan in my machine and it doesnt seem to be open
17:21 < bo_root> which OS are u using
17:21 < DirtySanchez> TCPv4_SERVER link local (bound): 192.168.1.102:1194
17:21 < DirtySanchez> ubuntu
17:23 < DirtySanchez> i flushed iptables
17:23 < DirtySanchez> disable ufw too
17:24 -!- lau [~lau@unaffiliated/lau] has quit [Ping timeout: 272 seconds]
17:27 < mete> Bushmills: Sun Jan 30 00:22:56 2011 NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1557,1557] remote->local=[1557,1557]
17:29 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
17:31 < Bushmills> that's uncritical. not a reason for high latency#
17:31 < mete> hmmh k
17:32 < mete> my problem is, that when I'm pushing 200-300kbps over the tcp ovpn tunnel, ping goes up to 200-300ms
17:32 < mete> if the link hasn't any load, the ping is about 30ms
17:33 < mete> internet connection is on both ends 50/50mbit
17:35 < Bushmills> how do you limit transfer speed to 200 kbps?
17:36 < mete> I'm not limiting transfer speed
17:36 < mete> ;)
17:36 < mete> rdp uses about 200kbps
17:37 < Bushmills> try another means to transfer with similar speed. for example, use wget with rate limiter, doing a lengthy transfer from a web server.
17:38 < Bushmills> check latency while transfer is going on
17:38 < mete> over the vpn or over normal internet?
17:38 < Bushmills> over vpn, same as rdp
17:38 < mete> one moment
17:38 < mete> ping is about 200-300ms
17:40 < Bushmills> use mtr then, to see what hop causes the rise of latency
17:40 < mete> I had that done already ;)
17:40 < Bushmills> i.e. mtr'ing the vpn server ethernet address
17:40 < mete> the vpn server has this latency
17:41 < mete> with udp I haven't this problem...
17:42 < Bushmills> do you experience packet loss during transfer?
17:42 < mete> over the normal internet link I've 1 packet loss in about 1000 packets
17:42 < mete> same over the udp link
17:42 < mete> over tcp link I haven't any packet loss
17:48 -!- Diavol|Laptop [~Demon@83.251.86.251] has quit [Ping timeout: 255 seconds]
17:49 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
17:50 < Bushmills> my guess would have been that the QoS aspects of T.128 protocol of rdp increases lag of ICMP and other packets - but that's unlikely if the same increase of latency results from tcp transfer with wget. not using rdp.
17:51 < Bushmills> so i don't know what causes it. seems you have a simple solution by using udp for vpn tunnel
17:51 < mete> udp is bad :P
17:51 < Bushmills> !udp
17:51 < Bushmills> !tcp
17:51 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
17:51 < mete> I've a prob that in some firms I can't use udp... because it's blocked...
17:51 -!- TheOnly [~theonly@cpc12-sgyl29-2-0-cust6.sgyl.cable.virginmedia.com] has joined #openvpn
17:51 < mete> so I need there to use tcp port 80 or 443
17:53 < s7r> if you tunnel on TCP I recommend you chaning the MTU, try mtu test and openvpn will tell you the recommended value
17:53 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
17:54 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has quit [Ping timeout: 272 seconds]
17:54 < mete> s7r: you can only use test mtu with udp
17:54 < mete> Options error: --mtu-test only makes sense with --proto udp
17:54 < mete> and with udp I've done that... --> Sun Jan 30 00:22:56 2011 NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1557,1557] remote->local=[1557,1557]
17:55 < s7r> all your traffic on UDP is blocked?
17:56 < mete> not here currently, but in another firm it is
17:56 < mete> ;)
17:56 -!- arnotixe [~arnotixe@190.131.174.161] has joined #openvpn
17:57 < mete> only port 80 and 443 are open (tcp)
18:00 < TheOnly> has anyone experience weird openvpn behaviour, trying to add completely messed up routes (using net-tools)? I only experience this issue when using openvpn >= 2.1.1 on the client side. 2.00 works fine
18:00 < TheOnly> experienced*
18:00 < TheOnly> both sides are running openvpn on linux
18:01 -!- arnotixe [~arnotixe@190.131.174.161] has quit [Ping timeout: 255 seconds]
18:10 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has joined #openvpn
18:16 -!- TheOnly [~theonly@cpc12-sgyl29-2-0-cust6.sgyl.cable.virginmedia.com] has quit [Quit: Leaving]
18:19 <@vpnHelper> RSS Update - forum: Handshake Issues <http://forums.openvpn.net/topic7572.html#p9457>
18:21 < mete> Bushmills: I've set now the mtu for testing to 1300 on server and client side
18:21 < mete> now ping only goes up 10ms
18:21 < mete> when I'm pushing about 30mbit/s
18:22 < Bushmills> hm. interesting
18:22 < mete> jep
18:22 < mete> hehe
18:22 < mete> more than 30mbit my vpn endpoint can't handle (CPU)
18:24 -!- WinstonSmith [~true@e179001255.adsl.alicedsl.de] has joined #openvpn
18:25 < Bushmills> pity we trusted too much in the mtu-test results, because we were on a pretty good track then with the initial temptative diagnosis of the problem
18:26 -!- DirtySanchez [~mago@187.158.23.151] has quit [Quit: Leaving]
18:30 < mete> its very interesting
18:30 < mete> because I used a similar setup 2 years ago
18:30 < mete> and I haven't had these problems 
18:30 < mete> only thing, I'm now using cert, and earlier I used psk
18:54 -!- s7r [~s7r@89.39.174.74] has left #openvpn []
19:05 -!- rawDawg [~rawdawg@cpe-24-166-49-207.neo.res.rr.com] has joined #openvpn
19:44 <@vpnHelper> RSS Update - forum: How to specify my OpenVPN-AS license key? <http://forums.openvpn.net/topic7573.html>
19:57 -!- xindz is now known as xindz`off
20:09 < mete> Bushmills: mtu 1300 seems good for me :)  I will test other MTU values later ;)
20:09 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
20:11 < Bushmills> 1492, 1484, 1476 may be worth testing
20:12 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 255 seconds]
20:14 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
20:17 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has quit [Ping timeout: 240 seconds]
20:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
20:32 -!- rawDawg [~rawdawg@cpe-24-166-49-207.neo.res.rr.com] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
20:42 < mete> should I use AES-128-CBC or AES-256-CBC? AES-256-CBC is consumpating a lot of cpu... xD
20:44 < derekv> 256 bit keys are excessive when 128 can be considered unbreakable.  and AES-256 isn't really any stronger.
20:44 < mete> ok, so 128 will be OK :)
20:44 < mete> 500mhz firewall is a bit slow for 256bit xD
20:45 < Bushmills> blowfish should be faster than aes
20:45 < derekv> yep.  unless your adverasary is the goverment, in which case, there is a whole different set of considerations better suited for a cypherpunks mailing list or somesuch
20:47 < mete> hmmh, I will test that Bushmills :) thanks
20:48 < mete> Î'm going to bed and will test that afterwards :)
20:48 < mete> thank you guys and good night
20:51 < derekv> no hacker is going to break AES or blowfish. any penetration will come from a weakness in the implementation, or more likely, a weakness in the software at the endpoints, or more likely still, a configuration error or mishandling of keys by administratiors, or more likely still, some sort of social engineering, or even more likely than that, your client or some internal windows box getting pwnt via a banner ad and IE exploit and now, s
20:51 < derekv> ome for profit hacker in bolivia is in your networks logging your keystrokes
20:55 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
20:58 -!- Lantizia [~Lantizia@erebus.seaquake.net] has quit [Ping timeout: 240 seconds]
21:06 -!- master_of_master [~master_of@p57B567DB.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
21:08 -!- master_of_master [~master_of@p57B54713.dip.t-dialin.net] has joined #openvpn
21:32 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
21:33 -!- N|KO [niko@174.89.243.98] has joined #openvpn
21:35 < N|KO> hey guys, i have a question, i have setup openvpn on centos, i can connect to the server from windows 7 and browse and all... but I cannot do that through iphone, i am getting connect but cant browse... any clues?
21:36 < N|KO> I wasnt being able to browse on windows 7 till I have setup the default gateway on the NIC
21:36 < Bushmills> try to browse by using an ip address instead of a host name
21:37 < N|KO> ok one sec..
21:39 < N|KO> hm
21:39 < N|KO> that seems to work
21:40 < N|KO> like, it shows as the page appears but it still tries to get more data...like searching
21:40 < Bushmills> pushing name server via dhcp option requires additional work on non-windows
21:41 < N|KO> its funny cause i connected the usb stick with my cellphone providers simcard
21:41 < N|KO> and it wouldnt browse either
21:41 < Bushmills> try to use a publicly available name server, like 8.8.8.8, on client
21:42 < N|KO> ok, so I would need to add it as a name server for the 3G connection?
21:43 < Bushmills> yes, instead of the 3G network provider name server, which most likely rejects requests from the network of your vpn server 
21:44 < N|KO> ok, so 8.8.8.8 is google's name server?
21:44 < N|KO> I presume it would also work for my regular non vpn 3g connect?
21:44 < Bushmills> right. 
21:44 < Bushmills> depends
21:45 < N|KO> okay, so the strange part is why wouldnt the connection work through the usb stick connected to win 7
21:45 < Bushmills> because of a problem, i'd say
21:46 < N|KO> lol
21:47 < N|KO> what if i push dns 8.8.8.8 from the vpn server to client?
21:47 < N|KO> would that work?
21:48 < Bushmills> for windows, yes. for others, only with additional setup on client.
21:49 < N|KO> ok so for windows, if i have on server something like: push "dhcp-option DNS 8.8.8.8"
21:49 < N|KO> should be ok?
21:49 < Bushmills> looks ok
21:49 < N|KO> thx..
21:50 < N|KO> ill try this 
21:50 < N|KO> for my win connect that isnt working
21:50 < Bushmills> !winroute
21:50 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
21:50 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
21:50 < Bushmills> often a problem too
21:52 -!- N|KO` [~niko@74.63.255.231] has joined #openvpn
21:53 -!- N|KO [niko@174.89.243.98] has quit [Read error: Connection reset by peer]
21:53 -!- N|KO` [~niko@74.63.255.231] has quit [Read error: Connection reset by peer]
21:53 -!- N|KO [~niko@174.89.243.98] has joined #openvpn
21:53 < N|KO> That worked fine..
21:53 < N|KO> amazing
21:54 < N|KO> disabled the nice def gate way... perfect
21:54 < N|KO> nik
21:54 < N|KO> NIC
21:54 < N|KO> lol
21:55 < N|KO> ok, ill look up how to use a nameserver on flavor of bsd
21:55 < N|KO> which is what iphone runs
21:59 < N|KO> Thanks Bush :)
21:59 -!- N|KO [~niko@174.89.243.98] has quit []
22:19 -!- alhadi [~thunderst@188.95.51.233] has joined #openvpn
22:24 -!- hackeron [~hackeron@gentoo/user/hackeron] has quit [Ping timeout: 240 seconds]
22:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:36 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
22:48 -!- corretico [~laguilar@201.201.44.82] has quit [Remote host closed the connection]
23:01 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 240 seconds]
23:05 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
--- Day changed Sun Jan 30 2011
00:23 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
01:02 < derekv> crap
01:02 < derekv> linux client won't work, won't create tun
01:06 < derekv> logs look ok on both sides
01:07 < derekv> if do ifconfig tun0 up, then try to run dhclient tun0 with verb 8, I see packets trying to cross
01:10 < derekv> got it to work
01:10 < derekv> after manually setting ifconfig and route
01:27 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
01:27 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
01:27 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
01:29 < derekv> --pull
01:30 < derekv> now its 2:30am.
01:30 < derekv> how is it that it works in windows fine without that option but in linux its required
01:31 < krzee> windows must be using --client
01:32 < krzee> which is just a helper directive that includes --pull
01:35 < derekv> my config include client... 
01:36 < derekv> no wait it includes tls-client i guess thats not the same thing heh
01:36 < derekv> i want my two hours back
01:37 < derekv> crap, the windows config I started from does not have a line that says tls-client
01:38 < derekv> thats some sort of transcription error
01:39 < derekv> but there _is_ a tls-client option
01:39  * derekv scratches head
01:41 < derekv> --tls-client + --pull = --client
01:41 < derekv> lol
01:41 < krzee> ;]
01:41 < krzee> read the manual i see
01:42 < derekv> its one of those things that reading the manual start to finish won't always help.
01:43 < krzee> nope, but when using options in a config, should read the manual on them
01:43 < derekv> i almost wonder if by some unlucky manuver I yanked "tls-" in front of the client directive, and since that is also a valid option, didn't of course catch it
01:44 -!- SOG [~SOG@n11649233222.netvigator.com] has quit [Quit: SOG]
01:52 < Bushmills> reading docs is for weenies. real men figure it out empirically.
01:52 < zeshoem> is there an openvpn client for android?
02:02 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
02:02 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Remote host closed the connection]
02:10 -!- winter [q3@unaffiliated/winter] has left #openvpn []
02:21 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
02:29 -!- HelpImStuck [~chatzilla@161.185.187.81.in-addr.arpa] has joined #openvpn
02:30 < HelpImStuck> Good Morning All,  I am stuck!,  Im trying to create an openVPN Connection to a hosted server,  I fear that what I want to do is impossible so I thought I would ask before I gave up...
02:30 < HelpImStuck> I want to connect the the public IP of the hosted server, and get an address on the same subnet Bridge?
02:33 < HelpImStuck> I seem to be able to get that far but can only see the host machine despite being given an adress in the same block,  The other issue is that I will want to connect to the web server on that machine be be seen by the server coming from the bridged address not the one assigned to my laptop but I guess that if I change routes at the client end I will not be able to then connect to the vpn end point.
02:34 < Bushmills> you'd want at least two public ip addresses - one for the public interface one the remote machine, one to route
02:34 < HelpImStuck> I have a /24 public IP's that I am trying to connect and also a separate /28 also public routed block, I have no control over the router though.
02:35 < HelpImStuck> Bushmills: I was thinking that, and thats not a problem, as you can see I have a few :)
02:37 < HelpImStuck> so..  Assume the server is on 100.100.71.5, webservers etc that I need to get to,  I could give 100.100.71.6 aswell if that would help infact I tried server-bridge 100.100.71.6 255.255.255.0 100.100.71.7 100.100.71.8  and then tried to connect to 100.100.71.6
02:38 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
02:41 < HelpImStuck> I also considered using the other block as a routed block eg server 200.200.5.16 255.255.255.240,  This would also be okay as long as when I get the 200.200 address on client I can talk to 100.100.71.5 address 200.200..    Im sorry if this seems babble,  I have lots of options but dont seem to get anything to work, most solutions seem to expect that a port has been forwarded from a router...
02:41 < HelpImStuck> ...via nat but I have public IP on the server.   
02:42 < HelpImStuck> Bushmills is it okay for both public address to be on the same subnet that I will ultimately end up on too ?
02:42 < HelpImStuck> Does vmware cause any issues?
02:58 < reiffert> !vmware
02:59 < reiffert> !factoids search --values vmware
02:59 <@vpnHelper> No keys matched that query.
03:03  * HelpImStuck just spotted !welcome
03:03 < HelpImStuck> !welcome
03:03 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:04 < HelpImStuck> !goal
03:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:05 < HelpImStuck> !interface
03:05 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
03:06 < HelpImStuck> !/30
03:06 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
03:09 < HelpImStuck> goal: to get address on datacenter lan for laptop and change default route on laptop to use tunnel. /24 public on LAN, also /28 routed to open vpn server.
03:09 < HelpImStuck> Can someone please give me some pointers?
03:10 < HelpImStuck> !redirect
03:10 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
03:11 < HelpImStuck> I assume no need for NAT if you were allocated a public IP
03:47 < HelpImStuck> I think the issue is with my br0 and vmware esx,  can someone suggest how to test this?
03:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:55 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
04:01 < reiffert> HelpImStuck: I would do it like Bushmills  was recommending.
04:10  * Bushmills denies everything
04:18 -!- Guest73950 [~dafdc@173.0.8.237] has joined #openvpn
04:21 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
04:22 < HelpImStuck> reiffert,  Thanks, soudns good, I have tried but for some reason the tunnel will not establish to the 2nd IP I added it as br0:1 so machine has br0= 71.5 and br0:1= 71.6. I can access the webserver on both addresses but can only vpn to .5
04:22 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
04:25 -!- Guest73950 [~dafdc@173.0.8.237] has quit [Ping timeout: 276 seconds]
04:26 -!- xindz`off is now known as xindz
04:33 -!- Lantizia [~Lantizia@erebus.seaquake.net] has joined #openvpn
04:34 -!- SOG [~SOG@n1121206002.netvigator.com] has joined #openvpn
04:38 < HelpImStuck> Please can someone tell me what im missing?
04:42 -!- SOG [~SOG@n1121206002.netvigator.com] has quit [Quit: I will be back!]
04:42 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
04:55 -!- Diavol|Laptop [~Demon@c83-251-86-251.bredband.comhem.se] has joined #openvpn
05:02 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has quit [Read error: Connection reset by peer]
05:02 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has joined #openvpn
05:04 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has quit [Read error: Connection reset by peer]
05:04 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has joined #openvpn
05:04 -!- Diavol|Laptop [~Demon@c83-251-86-251.bredband.comhem.se] has left #openvpn ["→"]
05:17 -!- WinstonSmith [~true@e179001255.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
05:37 -!- WinstonSmith [~true@g225031148.adsl.alicedsl.de] has joined #openvpn
05:46 -!- TypoNe is now known as Typone
05:54 -!- HelpImStuck [~chatzilla@161.185.187.81.in-addr.arpa] has quit [Ping timeout: 240 seconds]
06:01 -!- HelpImStuck [~chatzilla@161.185.187.81.in-addr.arpa] has joined #openvpn
06:06 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 260 seconds]
06:07 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
06:14 <@vpnHelper> RSS Update - forum: Add new membres <http://forums.openvpn.net/topic7574.html>
06:28 -!- HelpImStuck [~chatzilla@161.185.187.81.in-addr.arpa] has quit [Ping timeout: 240 seconds]
06:28 -!- HelpImStuck [~chatzilla@7.71.155.90.in-addr.arpa] has joined #openvpn
06:31 < Bushmills> HelpImStuck:  reiffert would say "a coffee", krzee probably "a beer", and your mom "some vitamines"
06:34 -!- HelpImStuck [~chatzilla@7.71.155.90.in-addr.arpa] has quit [Ping timeout: 264 seconds]
06:36 -!- HelpImStuck [~chatzilla@161.185.187.81.in-addr.arpa] has joined #openvpn
06:38 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
06:38 < sedulous> Does OpenVPN 2.2.x contain Gert Döring's IPv6 (TUN) payload patch?
06:40 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
06:40 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
06:40 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:44 -!- Meliorator [m@dunnington.eu] has quit [Ping timeout: 276 seconds]
06:47 < reiffert> Bushmills: :)
06:59 -!- HelpImStuck [~chatzilla@161.185.187.81.in-addr.arpa] has quit [Ping timeout: 240 seconds]
07:26 -!- alhadi [~thunderst@188.95.51.233] has quit [Ping timeout: 240 seconds]
07:46 -!- Typone [~nnnnnnnit@195.197.184.87] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.1.0]
07:48 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
07:52 < ecrist> sedulous: yes, iirc
08:00 <@vpnHelper> RSS Update - forum: MULTI: bad source address from client <http://forums.openvpn.net/topic7575.html>
08:04 < sedulous> ecrist: cool
08:10 -!- Meliorator [m@dunnington.eu] has joined #openvpn
08:10 -!- Meliorator [m@dunnington.eu] has quit [Max SendQ exceeded]
08:11 -!- Meliorator [m@dunnington.eu] has joined #openvpn
09:02 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 240 seconds]
09:02 -!- takamichi [~pri@174.37.86.108] has joined #openvpn
09:07 -!- takamichi [~pri@174.37.86.108] has quit [Ping timeout: 265 seconds]
09:07 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
09:13 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 240 seconds]
09:13 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
09:18 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:19 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:20 -!- Cain` is now known as Cain
09:36 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:52 -!- alhadi [~thunderst@94.59.252.59] has joined #openvpn
10:08 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:16 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The alternative IRC client]
10:39 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
10:42 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:42 -!- nb_ is now known as nb
10:46 -!- s7r [~s7r@89.39.174.74] has joined #openvpn
10:49 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
11:33 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
11:37 -!- alhadi [~thunderst@94.59.252.59] has quit [Ping timeout: 240 seconds]
11:44 -!- alhadi [~thunderst@92.96.193.53] has joined #openvpn
12:00 -!- ksk [ksk@im.knubz.de] has quit [Remote host closed the connection]
12:07 -!- alhadi [~thunderst@92.96.193.53] has quit [Ping timeout: 240 seconds]
12:14 -!- alhadi [~thunderst@94.59.253.71] has joined #openvpn
12:28 -!- alhadi [~thunderst@94.59.253.71] has quit [Ping timeout: 240 seconds]
12:35 -!- alhadi [~thunderst@92.99.143.151] has joined #openvpn
12:36 -!- uni4dfx [~uni4dfx@89-212-249-153.dynamic.t-2.net] has joined #openvpn
12:37 < uni4dfx> !welcome
12:37 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:37 < uni4dfx> !goal
12:37 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:39 < uni4dfx> Alright, I would like to make my LAN accessible from anywhere. I have a Linux NAT router, which works fine, but it's all configured based on eth0. And since the bridge mode requires me to dump eth0 and use br0 instead, I'm wondering if there is a way to avoid this?
12:48 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:50 < uni4dfx> !interface
12:50 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
13:10 < reiffert> uni4dfx: call your bridge eth0 and rename eth0 to lanif
13:10 < reiffert> uni4dfx: then bridge tap0 and lanif to eth0, done.
13:12 < reiffert> or have tap0/tun0 and use routing. routing will be fine.
13:13 < uni4dfx> i'll try the renaming trick first, thanks!
13:13 < reiffert> good luck.
13:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 272 seconds]
13:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
13:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:27 < alhadi> hello
13:29 -!- rolls` [~rollin@190.120.228.48] has joined #openvpn
13:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:33 < rolls`> !welcome
13:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:34 < rolls`> !redirect
13:34 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:34 < rolls`> !def1
13:34 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
13:40 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
13:40 -!- ikla [~lbz@c-98-245-144-60.hsd1.co.comcast.net] has joined #openvpn
13:40 < ikla> error=unable to get local issuer certificate   what causes that?
13:40 < ikla> just created new ca and keys
13:41 -!- alhadi [~thunderst@92.99.143.151] has quit [Ping timeout: 240 seconds]
13:47 -!- alhadi [~thunderst@92.96.214.149] has joined #openvpn
13:53 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
14:13 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
14:14 < rolls`> !ipforward
14:14 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:14 < rolls`> !nat
14:14 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:19 -!- WinstonSmith [~true@g225031148.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
14:21 < rolls`> !linipforward
14:21 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
14:22 < rolls`> !winipforward
14:22 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
14:22 < rolls`> !linnat
14:22 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
14:26 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
14:27 < ecrist> sup d00ds?
14:28 < rolls`> not much
14:29 < Tera> Waiting for Christmast
14:29 < rolls`> long wait
14:29 < ecrist> for what?
14:29 < rolls`> <Tera> Waiting for Christmast   <---that
14:29 < ecrist> Tera: how did your schedules maintenance go?
14:30 < Tera> ecrist: perfect. Could say it pretty much went like on the movies. :)
14:31 < ecrist> good, congrats
14:31 < Tera> We're going to deploy more OpenVPN-AS servers in the future I guess. Great product.
14:33 < ecrist> good to hear.  never used it much, myself.
14:56 -!- alhadi [~thunderst@92.96.214.149] has quit [Ping timeout: 240 seconds]
15:03 -!- alhadi [~thunderst@92.96.219.4] has joined #openvpn
15:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:19 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:24 -!- xindz is now known as xindz`off
15:41 < s7r> at what layer openvpn operates? application layer ?
15:41 < ecrist> no, network layer
15:43 < venom00ut> ecrist, well it depends if you're using tun or tap, isn't it?
15:46 < s7r> ecrist: layer 2?
15:50 < s7r> ?
16:04 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has quit [Remote host closed the connection]
16:04 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has joined #openvpn
16:09 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:14 -!- Cain [~Geek@unaffiliated/cain] has left #openvpn []
16:16 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
16:20 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 265 seconds]
16:54 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
17:06 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 240 seconds]
17:15 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
17:19 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
17:20 -!- grapsus [~grapsus@acces1110.res.insa-lyon.fr] has joined #openvpn
17:22 -!- grapsus [~grapsus@acces1110.res.insa-lyon.fr] has quit [Remote host closed the connection]
17:22 -!- grapsus [~grapsus@acces1110.res.insa-lyon.fr] has joined #openvpn
17:25 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
17:37 -!- s7r1 [~s7r@89.39.174.74] has joined #openvpn
17:38 -!- s7r [~s7r@89.39.174.74] has quit [Read error: Connection reset by peer]
17:55 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
17:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
18:08 -!- Guest83437 [~s7r@89.39.174.74] has joined #openvpn
18:10 -!- s7r1 [~s7r@89.39.174.74] has quit [Ping timeout: 265 seconds]
18:12 -!- Guest83437 [~s7r@89.39.174.74] has quit [Ping timeout: 240 seconds]
18:18 -!- holopaw [~holopaw@stoned.sleepingwolf.net] has quit [Ping timeout: 276 seconds]
18:21 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 272 seconds]
18:25 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
18:33 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 246 seconds]
18:38 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
18:46 -!- rkantos [robin@hp1.jaketus.net] has quit [Ping timeout: 255 seconds]
18:47 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
18:51 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
18:54 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Ping timeout: 276 seconds]
18:55 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
19:00 -!- agrajag [~agrajag^@c-24-131-78-108.hsd1.pa.comcast.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:01 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Ping timeout: 255 seconds]
19:01 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
19:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:37 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
19:37 -!- grapsus [~grapsus@acces1110.res.insa-lyon.fr] has quit [Remote host closed the connection]
20:02 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
20:04 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
20:04 -!- Cain` is now known as Cain
20:23 < Dougy> 2010-02-18 RackMonkey is now available as a FreeBSD port. Thanks go to Eric F Crist. For more details see FreshPorts. 
20:23 < Dougy> gooo ecrist
20:29 -!- WinstonSmith [~true@f052096105.adsl.alicedsl.de] has joined #openvpn
21:05 -!- master_of_master [~master_of@p57B54713.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:08 -!- master_of_master [~master_of@p57B57E32.dip.t-dialin.net] has joined #openvpn
21:08 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
21:24 -!- WinstonSmith [~true@f052096105.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
21:30 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
21:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
21:55 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
22:02 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:10 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
22:39 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
23:17 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:20 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
23:27 -!- WinstonSmith [~true@f052099219.adsl.alicedsl.de] has joined #openvpn
23:31 -!- WinstonSmith [~true@f052099219.adsl.alicedsl.de] has quit [Remote host closed the connection]
23:39 -!- WinstonSmith [~true@e179003071.adsl.alicedsl.de] has joined #openvpn
23:43 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Ping timeout: 240 seconds]
--- Day changed Mon Jan 31 2011
00:16 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 255 seconds]
00:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:29 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
01:12 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
01:16 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:16 -!- mode/#openvpn [+o mattock] by ChanServ
01:25 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Ping timeout: 240 seconds]
01:27 -!- networkn [~email@smtp.sapphiresolutions.co.nz] has joined #openvpn
01:28 < networkn> in a server/client config with windows 2003 as the server and windows 7 as the client.. if I can from the client access the server network completely, but I from the server end I can only access the client by using the tunnel client end ip, what is the likely issue? I have turned off firewall at both ends
01:30 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 260 seconds]
01:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:31 < networkn> the identical config works perfectly in xp
01:31 < networkn> as the client side
01:31 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
01:32 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9461>
01:35 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:38 <@vpnHelper> RSS Update - forum: Windows 7 OpenVPN client connection issue <http://forums.openvpn.net/topic7567.html#p9463> || Read UDPv4: No buffer space available (WSAENOBUFS) code=1005 <http://forums.openvpn.net/topic7570.html#p9462>
01:44 <@vpnHelper> RSS Update - forum: Unable to RDP over tunnel. <http://forums.openvpn.net/topic7571.html#p9464>
01:47 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
01:51 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
01:56 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
02:10 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
02:16 -!- WinstonSmith [~true@e179003071.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
02:22 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
02:22 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
02:33 -!- WinstonSmith [~true@e177095057.adsl.alicedsl.de] has joined #openvpn
02:38 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
02:52 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
03:01 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
03:04 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
03:09 <@vpnHelper> RSS Update - forum: Compiling OpenVPN Client <http://forums.openvpn.net/topic7576.html>
03:15 <@vpnHelper> RSS Update - forum: iptables config for Openvpn <http://forums.openvpn.net/topic7577.html>
03:30 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
03:31 < networkn> in a server/client config with windows 2003 as the server and windows 7 as the client.. if I can from the client access the server network completely, but I from the server end I can only access the client by using the tunnel client end ip, what is the likely issue? I have turned off firewall at both ends. XP Works fine with the same exact config file
03:42 < uni4dfx> !firewall
03:42 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
03:43 -!- jujugre [~julienb@artis3.probesys.com] has joined #openvpn
03:43 < jujugre> Hi
03:45 < jujugre> i have a two network VPN bridge configured, is it possible that a broadcast coming from network1 pass through network2 and coming back to network1, again again again, so a loop taking down my two network?
03:47 < uni4dfx> !ping
03:47 <@vpnHelper> pong
03:48 < uni4dfx> well that's useful
04:01 -!- dazo_afk is now known as dazo
04:18 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 250 seconds]
04:21 <@vpnHelper> RSS Update - forum: Help needed to setup a certificate only based OpenVPN Server <http://forums.openvpn.net/topic7578.html>
04:25 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
04:30 < uni4dfx> alright, i've pushed the routes, i've disabled the firewall and yet i still can't ping anything... where do i go from here?
04:35 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
04:36 < Fleck> uni4dfx well can you ping gateway?
04:36 < uni4dfx> Fleck no
04:36 < Fleck> maybe you block icmp?
04:36 < Fleck> have you disabled all firewalls for testing?
04:36 < uni4dfx> Fleck i've set all policies to ACCEPT
04:36 < uni4dfx> in iptables
04:36 < Fleck> vpn connection established?
04:37 < uni4dfx> yes
04:37 < Fleck> and u still cant connect remote IP ?
04:37 < uni4dfx> hmm i think the problem is with my bridging configuration
04:37 < uni4dfx> yeah
04:37 < uni4dfx> does server-bridge need to match the br0 interface?
04:38 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
04:38 < Fleck> uni4dfx whats your config tun or tap ?
04:38 <@vpnHelper> RSS Update - forum: Help needed to setup a certificate only based OpenVPN Server <http://forums.openvpn.net/topic7578.html#p9468>
04:38 < uni4dfx> tap
04:38 < Fleck> ohh multiclient - > server ?
04:38 < uni4dfx> correct
04:39 < Fleck> bro usually is lan ip
04:39 < Fleck> br0
04:39 < uni4dfx> it is, yes
04:39 < uni4dfx> it's 192.168.2.1
04:39 < Fleck> ok and local client got 192.168.2.X IP ?
04:40 < uni4dfx> the client got 192.168.2.200, because i've set the range from 200-250
04:40 < Fleck> cool
04:40 < Fleck> and you can't ping 2.1 correct?
04:40 < uni4dfx> oh i mean that's the VPN client
04:40 < uni4dfx> the local LAN clients are 2.x yes
04:40 < uni4dfx> and yes i can't ping 2.1
04:41 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
04:41 < Fleck> rserver-bridge 192.168.2.1 255.255.255.0 192.168.2.200 192.168.2.250 << have you this line in server-bridge?
04:41 < uni4dfx> exactly like this yup
04:42 < Fleck> sounds like problem in clients side...
04:43 < uni4dfx> could be
04:43 < uni4dfx> although it doesn't have a firewall
04:43 < uni4dfx> btw, on openvpn.net i've read that it's best not to use standard networks for VPN like 10.0.0.x and 192.168.x.x
04:43 <@vpnHelper> RSS Update - forum: iptables config for Openvpn <http://forums.openvpn.net/topic7577.html#p9469>
04:43 < Fleck> client is windows or *nix ?
04:43 < uni4dfx> linux
04:44 < Fleck> have you tried to ping with ping -I tap0 or whatever your vpn interface is ?
04:44 < uni4dfx> nope, let's see
04:45 < uni4dfx> unreachable too
04:46 < Fleck> i mean ping -I tap0 192.168.2.1
04:46 < uni4dfx> yeah that's what i did
04:46 < Fleck> hmm
04:46 < uni4dfx> hmm i can't see the tap0 device on my server
04:46 < uni4dfx> could that be a problem
04:46 < Fleck> yeah :D
04:46 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:46 < Fleck> ifconfig -a
04:46 < Fleck> try
04:46 < uni4dfx> i see it with ifconfig -a
04:46 < Fleck> ok
04:46 < Fleck> then its cool
04:46 < uni4dfx> but not without
04:47 < uni4dfx> ah ok, i thought it had to be active
04:47 < Fleck> well it is active, u can see that with RX and TX bytes
04:48 < uni4dfx> oh good point
04:48 < uni4dfx> it's only doing RX, but no TX
04:48 < Fleck> strange
04:49 < Fleck> TX in serverside is upload
04:49 < uni4dfx> yeah
04:49 < uni4dfx> hmm, when i ping it from the client
04:49 < uni4dfx> RX goes up
04:49 < Fleck> so now try tcpdump -n icmp and ping from client - do you see ping packets coming in?
04:49 < uni4dfx> but no TX
04:49 < Fleck> wait
04:50 < Fleck> on client side no TX ?
04:50 < Fleck> then client in not sending to server
04:50 < uni4dfx> client side is the opposite
04:50 < uni4dfx> only TX but no RX
04:50 < Fleck> ohh
04:52 < Fleck> can you paste bridge-start script in pastebin or somwhere ?
04:52 < Fleck> and have you bridge-utils installed?
04:52 < uni4dfx> yup, one sec
04:55 <@vpnHelper> RSS Update - forum: Help needed to setup a certificate only based OpenVPN Server <http://forums.openvpn.net/topic7578.html#p9470>
05:09 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 265 seconds]
05:12 -!- dRaziel [~kvirc@109.226.102.54] has joined #openvpn
05:13 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
05:18 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
05:18 -!- uni4dfx [~uni4dfx@89-212-249-153.dynamic.t-2.net] has quit [Read error: Connection reset by peer]
05:29 < Fleck> pure guy :)
05:35 -!- uni4dfx [~uni4dfx@89-212-249-153.dynamic.t-2.net] has joined #openvpn
05:37 -!- tuxx_ [~sometinel@81.95.4.165] has left #openvpn []
05:40 < uni4dfx> Fleck should get a big reward :)
05:40 -!- sia is now known as sia^pwnnt
05:40 -!- sia^pwnnt is now known as sia
05:40 < Fleck> i am new here :P
05:41 -!- sia is now known as sia^pwnnt
05:45 < dRaziel> hello all
05:45 < dRaziel> Greetings of children, the help is necessary to me I do openvpn server with billing abills who can help with a script gui for clients c login and password input? 
05:46 -!- uni4dfx [~uni4dfx@89-212-249-153.dynamic.t-2.net] has quit [Ping timeout: 255 seconds]
05:46 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
05:47 < dRaziel> For windows users
05:47 -!- lau_ [~lau@websiteburo-188-46.cnt.nerim.net] has quit [Quit: bye!]
05:49 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
05:50 < Fleck> cant help
05:50 < Fleck> have only crt auth tried
05:51 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
05:52 <@vpnHelper> RSS Update - forum: Help needed to setup a certificate only based OpenVPN Server <http://forums.openvpn.net/topic7578.html#p9471>
05:56 -!- SwK [~swk@freeswitch/developer/swk] has quit [Disconnected by services]
05:56 -!- swk_ [~swk@user-24-214-191-78.knology.net] has joined #openvpn
05:56 -!- SwK [~swk@freeswitch/developer/swk] has joined #openvpn
05:59 -!- uni4dfx [~uni4dfx@89-212-249-153.dynamic.t-2.net] has joined #openvpn
06:05 -!- EugenMayer1 [~eugen@frbg-4d02947f.pool.mediaWays.net] has joined #openvpn
06:06 < EugenMayer1> Hello. Is it possible to design a VPN network that way, that e.g. some clients can access /8 /24 of the networks and some clients can access all other clients, but most of the clients cannot communicate c2c
06:06 < EugenMayer1> for the first part of the question i currently use 3 different VPN networks .. 10.7.0.0 .. 10.8.0.0 and 10.9.0.0
06:07 < EugenMayer1> that means i need 3 ports, 3 different keys for a client which needs to be in all 3 networsk and so forth. I though about a way to merge down those 3 networks to one, while keeping the seperation
06:09 -!- dRaziel [~kvirc@109.226.102.54] has left #openvpn ["Может и вернусь"]
06:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
06:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:27 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:27 -!- mode/#openvpn [+o mattock] by ChanServ
06:42 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
06:42 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
06:42 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
07:02 < Bushmills> EugenMayer1: i split the /24 net into two /25, for more and less privileged clients.  more privileged client get their address from ccd config, and permissions are controlled by service configuration and iptables.
07:03 < Bushmills> !ccd
07:03 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
07:03 < EugenMayer1> i have ccd up already
07:04 < EugenMayer1> "service configuration" ?
07:04 < Bushmills> without client-to-client in config, seems your requirements are met by appropriate firewall configuration
07:04 < EugenMayer1> so all you do is actually having one networks
07:04 < EugenMayer1> 10.9
07:05 < Bushmills> depends on your viewpoint.  
07:05 < Bushmills> from openvpn view, yes.  from service view, now
07:05 < Bushmills> no
07:05 < EugenMayer1> and pushing clients ( respectivly of their permssions ) into different subnets and firefwall that, right?
07:05 < Bushmills> some services allow access from addresses within a /25 net.   
07:06 < EugenMayer1> ok
07:06 -!- s7r [~s7r@89.39.174.74] has joined #openvpn
07:07 < s7r> at what layer openvpn works ? network layer or application layer because it's unclear
07:07 < Bushmills> s7r: your choice. layer 2 or 3
07:07 < Bushmills> !tunortap
07:07 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
07:07 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
07:08 < s7r> Bushmills: how is it my choice? Tthe ssl encryptions how can it happen at network layer? doesn't it have to MUST be application layer?
07:08 < Bushmills> mac destined traffic (layer 2) works over bridged configs.
07:08 < s7r> yes, I know but I use tun not tap as I have only IP traffic
07:08 < s7r> this is application layer right?
07:09 < EugenMayer1> Bushmills: one phyical server runs several openvpn daemins ( port 1 2 3 ) with networks 10.1 10.2 10.3 .. Can someone who has been connected in 10.1 with ccd add a route for 10.2 and it works out?
07:09 < Bushmills> layer 3 is ip traffic
07:09 < s7r> yep transport layre
07:09 < Bushmills> ip address level rather than mac address level
07:09 < s7r> thanks Bushmills
07:13 <@vpnHelper> RSS Update - forum: Need VPN expert for project <http://forums.openvpn.net/topic7579.html>
07:13 < Bushmills> s7r: ssl is for establishing the tunnel.  layer 2 or 3 traffic is for traffic sent through the tunnel.
07:14 < Bushmills> for latter traffic, methods of establishing the tunnel are transparent
07:16 < Bushmills> EugenMayer1: no, as 2nd openvpn server doesn't know about that client, and hasn't built an association between its vpn address and its ethernet address
07:16 < Bushmills> i mean, client can add a route, but server doesn't care about packets from that client
07:16 < EugenMayer1> Bushmills: but if the client just adds a rroute
07:16 < ecrist> s7r: I answered that question yesterday
07:17 < EugenMayer1> that 10.1.0.1 should be its router for 10.2. .. wouldnt it get routed?
07:17 < Bushmills> routing what?  tunneled traffic can only be routed after establishing a tunnel
07:18 < Bushmills> no tunnel -> nothing to route through
07:18 < EugenMayer1> Bushmills: wait, just to rephrase.
07:18 < EugenMayer1> (i make the example simpler). 2 networks, 10. and 11
07:18 < EugenMayer1> both openvpn daemins run on one phisical server under different ports, serving those 2 networks.
07:19 < EugenMayer1> One client connects to the daeomng for 10. and gets and ip out of that range.
07:19 < Bushmills> about which server two knows nothing
07:19 < EugenMayer1> Not the client adds a route manually, routing all packages to 11. through 10.0.0.1 ( openvpn server )
07:20 < EugenMayer1> s/not/now
07:20 < Bushmills> client hasn't established connection to server 2
07:20 < EugenMayer1> yes, he hasnt. He trys to "attack" into that network
07:20 < Bushmills> think of:   my client has connected to my server.  can my client - because of that - use your vpn server now?
07:21 < EugenMayer1> "connects to my server" -> "conntects to vpn server 10." ?
07:22 < Bushmills> i just need to add a route, after all, right?
07:22 < Bushmills> "to vpn server 10." -> to any of your vpn servers
07:23 < Bushmills> if i had to, i'd choose the address my server assigns identical to those yours assigns ..-
07:26 < EugenMayer1> hm
07:33 < janjust> EugenMayer1: for your evil client to attack server 2 via your server 1 you'd need a trust relationship (and routing) set up between servers 1 and 2. if you have such a route set up, and if server 2 "knows" about the 10.x network from server 1 then yes, this "attack" would be possible . Otherwise, no
07:33 < EugenMayer1> Ah, ok
07:36 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
07:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
07:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:05 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
08:18 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
08:19 -!- dRaziel [~draziel@109.226.102.54] has joined #openvpn
08:19 -!- dRaziel [~draziel@109.226.102.54] has left #openvpn []
08:31 -!- EugenMayer1 [~eugen@frbg-4d02947f.pool.mediaWays.net] has left #openvpn []
08:33 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
08:36 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
08:39 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 240 seconds]
08:44 -!- s7r [~s7r@89.39.174.74] has quit [Ping timeout: 240 seconds]
08:44 <@vpnHelper> RSS Update - forum: Windows 7 OpenVPN client connection issue <http://forums.openvpn.net/topic7567.html#p9473>
08:44 -!- s7r [~s7r@ACBF7A63.ipt.aol.com] has joined #openvpn
08:45 -!- Cdh [~chris@infedyn018.informatik.uni-stuttgart.de] has joined #openvpn
08:45 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
08:46 < Cdh> !welcome
08:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:48 < Cdh> !goal
08:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:49 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has joined #openvpn
08:49 -!- mant1s [~mant1s@cpe-76-179-1-48.maine.res.rr.com] has quit [Changing host]
08:49 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:52 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:01 -!- IRQ [~IRQ@c-217-115-40-2.cust.bredband2.com] has joined #openvpn
09:01 < IRQ> I am searching for the OpenVPN Sys Req (50-80 users).... Do you know?
09:01 < IRQ> Hi
09:01 < ecrist> hi
09:01 < ecrist> pretty much any machine you put it on will suffice
09:04 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:04 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:08 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 250 seconds]
09:12 -!- xindz`off is now known as xindz
09:12 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:12 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:19 -!- Cain` [~Geek@41.141.252.98] has joined #openvpn
09:19 -!- Cain` [~Geek@41.141.252.98] has quit [Changing host]
09:19 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:20 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:21 -!- Cain` is now known as Cain
09:22 -!- Cdh [~chris@infedyn018.informatik.uni-stuttgart.de] has left #openvpn []
09:22 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:26 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 240 seconds]
09:31 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
09:32 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
09:33 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
09:34 -!- Cain is now known as Guest45148
09:34 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:34 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:35 -!- Fleck [~we@unaffiliated/fleck] has quit [Ping timeout: 246 seconds]
09:36 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:37 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 240 seconds]
09:37 -!- Guest45148 [~Geek@41.141.252.98] has quit [Ping timeout: 240 seconds]
09:41 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
09:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
09:42 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
09:46 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
09:49 -!- Cain` is now known as Cain
09:49 -!- WinstonSmith_ [~true@e178168076.adsl.alicedsl.de] has joined #openvpn
09:51 -!- WinstonSmith [~true@e177095057.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
09:55 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
09:56 -!- neozerosv [~neozerosv@debian.ues.edu.sv] has joined #openvpn
09:58 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
10:04 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:07 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:08 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
10:12 -!- ljvb [~jason@vps.vanbrecht.com] has quit [Quit: brb]
10:16 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
10:24 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
10:26 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Ping timeout: 276 seconds]
10:38 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:40 -!- bo_root [~x@89-212-218-2.dynamic.t-2.net] has joined #openvpn
10:49 -!- jujugre [~julienb@artis3.probesys.com] has left #openvpn []
10:50 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
11:04 -!- bo_root [~x@89-212-218-2.dynamic.t-2.net] has quit [Remote host closed the connection]
11:11 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:24 -!- bo_root [~x@zmayac-1-pt.tunnel.tserv24.sto1.ipv6.he.net] has joined #openvpn
11:24 -!- bo_root [~x@zmayac-1-pt.tunnel.tserv24.sto1.ipv6.he.net] has left #openvpn []
11:36 -!- decktrio_ [~quassel@adsl-85-122-188.mco.bellsouth.net] has joined #openvpn
11:40 -!- s7r [~s7r@ACBF7A63.ipt.aol.com] has quit [Ping timeout: 246 seconds]
11:44 <@vpnHelper> RSS Update - forum: route problem, Connection established (client-config-dir) <http://forums.openvpn.net/topic7580.html>
12:12 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Read error: Operation timed out]
12:15 -!- WinstonSmith_ [~true@e178168076.adsl.alicedsl.de] has quit [Quit: Ex-Chat]
12:16 -!- WinstonSmith [~true@e178168076.adsl.alicedsl.de] has joined #openvpn
12:27 -!- decktrio_ [~quassel@adsl-85-122-188.mco.bellsouth.net] has quit [Remote host closed the connection]
12:29 -!- decktrio [~quassel@adsl-85-122-188.mco.bellsouth.net] has joined #openvpn
12:33 -!- EugenMayer [~eugen@frbg-4d02947f.pool.mediaWays.net] has joined #openvpn
12:34 < EugenMayer> Hello, i have 4 different VPN networks. Some of my clients are in all 4, some only in one. What would be the best way to handle the certificates of the clients?
12:35 < zeshoem> !topology 
12:35 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
12:35 < EugenMayer> iam using ccd in all networks. I think it would be handy to use the same ca for all, but should i use the same key for all networks? If yes, how then restrict a client into a network ( without working with revokation lists as blaclists)
12:35 < EugenMayer> zeshoem: was that for me?
12:36 < zeshoem> it was not
12:36 < zeshoem> !iporder
12:36 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
12:37 < zeshoem> !static
12:37 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
12:38 -!- decktrio [~quassel@adsl-85-122-188.mco.bellsouth.net] has quit [Remote host closed the connection]
12:38 <@vpnHelper> RSS Update - forum: route problem, Connection established (client-config-dir) <http://forums.openvpn.net/topic7580.html#p9475>
12:42 -!- gladiatr_afk is now known as gladiatr
12:42 < gladiatr> boooo, power outtages
12:48 -!- dazo is now known as dazo_afk
12:54 -!- EugenMayer [~eugen@frbg-4d02947f.pool.mediaWays.net] has quit [Quit: Leaving.]
12:55 -!- alhadi [~thunderst@92.96.219.4] has quit [Ping timeout: 272 seconds]
13:01 -!- alhadi [~thunderst@92.96.249.125] has joined #openvpn
13:04 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:08 <@vpnHelper> RSS Update - forum: iptables config for Openvpn <http://forums.openvpn.net/topic7577.html#p9476>
13:53 -!- decktrio [~quassel@adsl-85-122-188.mco.bellsouth.net] has joined #openvpn
13:53 -!- alhadi [~thunderst@92.96.249.125] has quit [Ping timeout: 240 seconds]
14:00 -!- alhadi [~thunderst@92.96.226.9] has joined #openvpn
14:03 <@vpnHelper> RSS Update - forum: Windows 7 OpenVPN client connection issue <http://forums.openvpn.net/topic7567.html#p9477>
14:04 -!- s7r [~s7r@AC8183B2.ipt.aol.com] has joined #openvpn
14:05 -!- gladiatr is now known as gladiatr_afk
14:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
14:13 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
14:13 -!- alhadi [~thunderst@92.96.226.9] has quit [Quit: alhadi]
14:16 -!- morbidwar [~ovidiu@78.96.23.179] has joined #openvpn
14:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:25 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
14:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
14:28 < up_the_irons> Been digging around, but could not find the answer to this -- Is there a way for OpenVPN to push a different set of name servers based on the source IP of the client?  something like, "if <source-ip> == a.b.c.d, push "dhcp-option DNS 10.0.0.2", else, push "dhcp-option DNS 192.168.1.5""
14:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:37 -!- decktrio [~quassel@adsl-85-122-188.mco.bellsouth.net] has quit [Remote host closed the connection]
14:38 < nb> up_the_irons, ccd files?
14:49 < up_the_irons> nb: i'll look into those ,thanks
14:54 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
14:54 -!- dschuett [~dschuett@216.229.21.250] has joined #openvpn
14:54 < dschuett> ahhhhh
14:55 < dschuett> going crazy here, my vpn just stopped working out of nowhere
14:55 < dschuett> and i think it is the redirecting of the default gw option that doesn't seem like it is getting pushed to the clients
14:58 < dschuett> i can still connect just fine, but i can't ping anything on the server side subnet
14:59 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
14:59 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
14:59 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:01 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
15:01 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
15:01 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
15:01 < dschuett> why am i not getting a log file anymore on the client machine?
15:03 < krzee> !logfile
15:03 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
15:04 < SwK> krzee
15:04 < krzee> hey ken!
15:04 < SwK> lol
15:05 < dschuett> krzee, i'm having a crisis...all of a sudden i can't ping the subnet behind my openvpn server...i can still ping the 10.8.0.0 address of the tun interface on the server, but nothing behind it nor its actually 192.168.0.1 interrface
15:05 < dschuett> it seems as if the redirecting of the d gw isnt' getting pushed to the clients
15:05 < krzee> then troubleshoot it
15:05 < dschuett> i'm trying :P
15:06 < krzee> it *seems* ?
15:06 < krzee> that should be an easy thing to confirm
15:06 < dschuett> should that show up in route -rn?
15:06 < krzee> what OS has route -rn?
15:06 < dschuett> linux
15:06 < dschuett> oopos n
15:06 < krzee> you meant netstat -rn
15:07 < dschuett> yes... i did :)
15:07 < krzee> post your client logfile
15:07 < krzee> and check if ip forwarding is enabled on your server
15:08 < krzee> im guessing maybe you did the temp solution for ip forwarding, and have rebooted
15:09 < dschuett> krzee: nothing will print to my logfile
15:10 < krzee> !logfile
15:10 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
15:13 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
15:13 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
15:13 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
15:13 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:22 -!- grapsus [~grapsus@acces1110.res.insa-lyon.fr] has joined #openvpn
15:25 < dschuett> krzee, nothing gets printed to my log file using windows
15:25 < dschuett> for the client that is
15:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:25 -!- dschuett [~dschuett@216.229.21.250] has left #openvpn []
15:28 -!- morbidwar [~ovidiu@78.96.23.179] has quit [Remote host closed the connection]
15:38 -!- 20QAANR3Y [~quassel@adsl-85-122-188.mco.bellsouth.net] has joined #openvpn
15:45 -!- 20QAANR3Y [~quassel@adsl-85-122-188.mco.bellsouth.net] has quit [Remote host closed the connection]
15:46 -!- 77CAAOCVM [~quassel@adsl-85-122-188.mco.bellsouth.net] has joined #openvpn
16:02 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Ping timeout: 276 seconds]
16:02 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
16:09 -!- 77CAAOCVM [~quassel@adsl-85-122-188.mco.bellsouth.net] has quit [Remote host closed the connection]
16:13 -!- decktrio [~quassel@adsl-85-122-188.mco.bellsouth.net] has joined #openvpn
16:13 -!- decktrio [~quassel@adsl-85-122-188.mco.bellsouth.net] has quit [Client Quit]
16:13 -!- decktrio [~quassel@adsl-85-122-188.mco.bellsouth.net] has joined #openvpn
16:21 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 240 seconds]
16:22 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
16:41 < Dougy> up_the_irons: ! 
16:41 < Dougy> hi
16:42 -!- WinstonSmith [~true@e178168076.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
16:44 -!- decktrio [~quassel@adsl-85-122-188.mco.bellsouth.net] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
16:46 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:49 < up_the_irons> Dougy: hey :)
16:49 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: ironing in communal space is stressful]
16:50 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
16:51 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
16:52 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
16:56 -!- WinstonSmith [~true@f052098102.adsl.alicedsl.de] has joined #openvpn
17:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
17:14 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
17:18 -!- Rolybrau [~Rolybrau@2-179.79-83.cust.bluewin.ch] has joined #openvpn
17:18 -!- Rolybrau [~Rolybrau@2-179.79-83.cust.bluewin.ch] has quit [Changing host]
17:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:40 < Dougy> up_the_irons: how goes
17:50 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
17:50 < up_the_irons> Dougy: good, yourself?
18:06 -!- s7r [~s7r@AC8183B2.ipt.aol.com] has left #openvpn []
18:12 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 240 seconds]
18:14 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
18:21 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
18:22 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
18:51 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
18:56 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
18:56 < Ramblurr> when using auth-user-pass, is it possible to prompt for additional information?
19:09 -!- Lantizia [~Lantizia@erebus.seaquake.net] has quit [Ping timeout: 272 seconds]
19:11 -!- Lantizia [~Lantizia@erebus.seaquake.net] has joined #openvpn
19:12 < ecrist> like what?
19:15 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has joined #openvpn
19:17 < Ramblurr> ecrist: just some additional text input
19:17 < dschuett> ok so i an a routed vpn set up... client can connect just fine and client can ping subnet behind openvpn server, now how to i allow the subnet behind my openvpn serve to ping the subnet behind the openvpn client?
19:17 < dschuett> have*
19:17 < ecrist> Ramblurr: like, username, password, and sexual preference?
19:17 < Ramblurr> yup basically
19:17 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
19:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
19:18 < ecrist> sounds like a good wishlist item.
19:18 < Ramblurr> i thought the auth plugin might be able to, but the plugin doesn't handle prompting the user
19:18 < Ramblurr> the server prompts the user and hands off the input to the plugin :\
19:18 < ecrist> I'm guessing it would be fairly simple to implement.
19:19 < ecrist> right
19:19 < ecrist> !wishlist
19:19 <@vpnHelper> "wishlist" is https://forums.openvpn.net/viewforum.php?f=10 for the openvpn wishlist
19:19 < ecrist> post something there, I'll bring it up on your behalf on Thursday's meeting.
19:22 < dschuett> i have enabled the client-config-dir ccd route 192.168.1.0 255.255.255.0 and have created a /etc/openvpn/ccd directory with the client file in it containing: iroute 192.168.1.0 255.255.255.0 but i still can't ping the subnet behind the client machine from the subnet behind my openvpn server. Any ideas?
19:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:30 < ecrist> Ramblurr: ^^^
19:34 < dschuett> anyone? :(
19:35 < ecrist> !configs
19:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
19:35 < ecrist> !iroute
19:35 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
19:35 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:37 < dschuett> ecist: i tried doing a: route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.8.0.1 and it still doesn't work
19:41 < dschuett> ecrist: http://pastebin.com/aa6hkgN0 http://pastebin.com/zzkr0FCU
19:43 < dschuett> ecrist: line 21-22 in the server.conf WERE uncommented before i tried manually adding the route
19:45 < ecrist> ok, I'll be back online in about 30 minutes, I'll look more closely at it then, unless someone else picks it up
19:46 < dschuett> awesome, thanks!
19:47 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
19:48 < djgerm> whats the deal with pushing a default route?
19:48 < djgerm> how is it done!?
19:49 < djgerm> !default
19:49 <@vpnHelper> (default <name>) -- Returns the default value of the configuration variable <name>.
19:53 -!- xindz is now known as xindz`off
19:57 < ecrist> !def1
19:57 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
19:58 < ecrist> dschuett: I would strongly recommend against that particular subnet
19:58 < ecrist> !1918
19:58 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, adn 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html
20:00 < ecrist> also, per !configs, above, we don't like to see comments in the pastebin
20:00 < dschuett> oh, sorry. Is there a grep command that limits that
20:00 < ecrist> 19:35 < ecrist> !configs
20:00 < ecrist> 19:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$'  server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see  !pb for our preferred pastebin
20:01 < ecrist> see #1 in what vpnHelper said
20:01 < dschuett> ahhh got it
20:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
20:01 < dschuett> so you're saying don't use 10.8.0.0...?
20:02 < ecrist> no, don't use 192.168.[10].0/24
20:02 < ecrist> I recommend the 172.16/12 or the 10/16
20:02 < dschuett> oh, ok. I see what you're saying
20:02 < ecrist> also, windows clients need to run openvpn as an administrator to get the routes set upon connection
20:03 < dschuett> ok, that shouldn't be a problem. 
20:03 < dschuett> right now i'm just dealing with a linux openvpn sever and a linux openvpn client
20:04 < dschuett> i think part of the problem is that the openvpnclient isn't the gateway of that network...
20:05 < ecrist> the remote lan needs to know how to route BACK to the vpn
20:06 < dschuett> right, so i think it would be a lot easier if the openvpn client was also the gateway of that network
20:07 < ecrist> much easier
20:07 < ecrist> check out the following:
20:07 < ecrist> !route
20:07 < ecrist> !iroute
20:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
20:07 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
20:07 < ecrist> those will both help you tremendously
20:07 -!- Guest45148 [~Geek@41.141.252.98] has joined #openvpn
20:08 -!- optiz0r [~optiz0r@miranda.sihnon.net] has quit [Ping timeout: 250 seconds]
20:08 -!- fipu_ [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has quit [Ping timeout: 265 seconds]
20:08 -!- optiz0r [~optiz0r@miranda.sihnon.net] has joined #openvpn
20:09 < dschuett> ecrist: thanks! - is there a reason when i enabled the client-config-dir ccd route 192.168.1.0 255.255.255.0 and have created a /etc/openvpn/ccd directory with the client file in it containing: iroute 192.168.1.0 255.255.255.0 that is DOES show when i do a route -n
20:09 < dschuett> isn't that the kernels routing table?
20:09 < ecrist> yes, openvpn adds them.
20:09 < dschuett> gotcha
20:11  * ecrist poofs for the evening.  I'll be around again in ~11 hour
20:16 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Ping timeout: 264 seconds]
20:18 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
20:23 < Dougy> up_the_irons: doing ok, doing ok
20:25 -!- dschuett [~dschuett@ip68-99-4-225.om.om.cox.net] has quit [Quit: Leaving.]
20:28 < jpalmer> later ecrist
20:47 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
20:48 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:49 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
20:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
20:52 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
20:53 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
21:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:05 -!- master_of_master [~master_of@p57B57E32.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:07 -!- master_of_master [~master_of@p57B53E80.dip.t-dialin.net] has joined #openvpn
21:14 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
21:25 < djgerm> any ideas why a windows machine wouldn't be accepting the default route when it connects to the openvpn server? mac and linux machines are getting that default route just fine.
21:29 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
21:34 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
21:36 -!- Guest45148 [~Geek@41.141.252.98] has quit [Ping timeout: 245 seconds]
21:41 -!- alhadi [~thunderst@92.96.226.9] has joined #openvpn
21:43 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
21:52 -!- mehmann [~c@91.100.27.233.generic-hostname.arrownet.dk] has joined #openvpn
22:01 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:03 < mehmann> okey ,,, crack smooking question
22:04 < mehmann> does openvpn and openssh have similar library dependencies suchs as libssl or whatnot,, and if yes , would that be a security concern if i want to shield off ssh access from the outside ?
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:08 -!- WinstonSmith [~true@f052098102.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
22:19 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
23:05 -!- mehmann [~c@91.100.27.233.generic-hostname.arrownet.dk] has quit [Quit: Lost terminal]
23:07 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
23:07 -!- Guest45148 [~Geek@41.141.252.98] has joined #openvpn
23:08 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 245 seconds]
23:23 -!- networkn [~email@smtp.sapphiresolutions.co.nz] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
23:27 -!- alhadi [~thunderst@92.96.226.9] has quit [Ping timeout: 276 seconds]
23:30 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
23:32 -!- Guest45148 [~Geek@41.141.252.98] has quit [Read error: Operation timed out]
23:34 -!- alhadi [~thunderst@92.96.230.158] has joined #openvpn
--- Day changed Tue Feb 01 2011
00:00 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has joined #openvpn
00:02 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
00:03 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Ping timeout: 255 seconds]
00:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:29 <@vpnHelper> RSS Update - forum: Unable to RDP over tunnel. <http://forums.openvpn.net/topic7571.html#p9478>
00:55 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
01:07 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:08 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
01:15 < djgerm1> !def1
01:15 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
01:35 <@vpnHelper> RSS Update - forum: iptables config for Openvpn <http://forums.openvpn.net/topic7577.html#p9479>
01:37 -!- bburhans [~bburhans@unvanquished/developer/bpb] has joined #openvpn
01:38 < bburhans> !welcome
01:38 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:38 < bburhans> !goal
01:38 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:43 < bburhans> Windows client connecting to a Linux server. With no "secret" in my client config, I get "No client-side auth method specified; use cert/key, pkcs12, or auth-user-pass." With a secret, I get "specify only one of tls-server, tls-client, or secret." I'm using a static pre-shared key generated on the server and copied to the config directory on the windows client.
01:44 < bburhans> I should note that this is specifying only --config foobarbaz and running openvpn from the command line. Does that instead run it as a server? :/
01:59 -!- uni4dfx [~uni4dfx@89-212-249-153.dynamic.t-2.net] has quit [Ping timeout: 255 seconds]
02:00 -!- uni4dfx [~uni4dfx@89-212-106-11.dynamic.t-2.net] has joined #openvpn
02:41 -!- dazo_afk is now known as dazo
02:45 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
02:47 -!- EugenMayer [~eugen@frbg-5f732aa4.pool.mediaWays.net] has joined #openvpn
02:47 < EugenMayer> Hello can is use pkcs#12 on the server side?
02:48 -!- anitxor [~xor@cryptoanarchy.org] has quit [Ping timeout: 255 seconds]
02:52 < EugenMayer> ok, its possible
03:07 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
03:07 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
03:07 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
03:09 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:10 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Client Quit]
03:11 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
03:16 -!- zmay [~zmay@89-212-225-234.dynamic.t-2.net] has joined #openvpn
03:17 < zmay> i am trying to test vpn from MS client,  in client.config it requests cert and key in .pem format?
03:18 < zmay> i have CA.crt not CA.pem
03:19 -!- zmay [~zmay@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
03:20 <@dazo> gee ... give people time to respond!
03:26 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:26 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:28 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Quit: ☃]
03:32 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
03:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:40 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:45 -!- barbosa [~barbosa@189.27.116.254.dynamic.adsl.gvt.net.br] has joined #openvpn
04:04 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:14 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:21 < EugenMayer> does the handshake fail if the dh changed? Tue Feb  1 11:20:40 2011 188.40.211.227:42932 TLS Error: TLS handshake failed
04:25 -!- Lenoob [~Lenoob@unaffiliated/lenoob] has joined #openvpn
04:25 < Lenoob> !welcome
04:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:25 < Lenoob> !redirect
04:25 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
04:26 < Lenoob> mmh, hello i need some help because i have follow this https://secure.intovps.com/knowledgebase/19/How-to-install-and-configure-OpenVPN.html and at the daemon startup it say :
04:26 <@vpnHelper> Title: IntoVPS - Knowledgebase - How to install and configure OpenVPN (at secure.intovps.com)
04:27 -!- anitxor [~xor@cryptoanarchy.org] has joined #openvpn
04:27 < Lenoob> Jan 31 23:18:44 vps ovpn-server[14310]: Cannot open dh1024.pem for DH parameters: error:02001002:system library:fopen:No such$
04:28 < Lenoob> or directory: error:2006D080:BIO routines:BIO_new_file:no such file
04:30 < Lenoob> !def1
04:30 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
04:32 < EugenMayer> with my handshake issue... i just switched for the client / server to use p12 .. and now i read in the client log Certificate does not have key usage extension
04:33 -!- luneff [~yury@84.51.195.188] has joined #openvpn
04:33 < EugenMayer> does this relate to the server key or client key ( both p12 )
04:33 < Lenoob> EugenMayer: you speak to me ?
04:33 < Bushmills> Lenoob: try:
04:33 < Bushmills> !howto
04:33 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
04:33 < EugenMayer> Lenoob: well asking general
04:34 <@dazo> EugenMayer: TLS handshake issues is not related to dh param file
04:34 <@dazo> (not afaik)
04:34 < EugenMayer> dazo: yes i see, its something with the cert "usage"
04:34 <@dazo> the DH params file is basically a big prime number which helps speeding up some of the encryption algorithms
04:35 -!- SintaxBSD [heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has joined #openvpn
04:35 < EugenMayer> dazo: AFAIK its also used for salting sessions
04:35 <@dazo> EugenMayer: "usage" and certs ... that indicates some missing flags in the certificate files, indeed
04:35 -!- sigius [~sigius@93.125.185.45] has quit [Read error: Connection reset by peer]
04:35 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
04:35 < Lenoob> I look a tutoriel that normally work but what is my mistake in this case?
04:36 <@dazo> EugenMayer: yes, it can be used for that ... when speaking about SSL sessions
04:36 < EugenMayer> dazo: my issue now is, i expect the root cert having this issue. i cant see how to change the flags using xca
04:36 < Lenoob> vpnHelper: version
04:36 <@vpnHelper> The current (running) version of this Supybot is 0.83.4.1.  The newest version available online is 0.83.4.1.
04:36 < Lenoob> \o/
04:36 < EugenMayer> AFAIR i tested the connection using p12 on the client side but nor ca / crt on the server and it worked. Now i changed the server to p12 and running into this issue
04:36 <@dazo> EugenMayer: you need to create new certificates, I don't think you can modify flags after certificates have been created
04:37 < EugenMayer> dazo: well, recreating the root ca means recreating all its childred?
04:37 < Lenoob> Can you help me? I read the tutorial and could not find my mistake
04:37 <@dazo> EugenMayer: root CA recreating means all children ... but ...
04:37 <@dazo> Lenoob: patience
04:37 < Lenoob> ok
04:38 < EugenMayer> dazo: well that means a _full_ day job for me replacing the client certs on the servers..
04:38 < Bushmills> Lenoob: if you followed that tutorial, and the server doesn't start, the tutorial would be wrong.  if the tutorial is right, you missed a step.
04:38 < Lenoob> In 10 minutes I returned to school for this reason
04:38 <@dazo> EugenMayer: if your setup worked with normal PEM/DER certs ... then it sounds like the p12 server cert contains the wrong cert
04:38 < EugenMayer> dazo: i see
04:38 < Lenoob> Bushmills: I have follow an other tutorial
04:38 < Lenoob> https://secure.intovps.com/knowledgebase/19/How-to-install-and-configure-OpenVPN.html
04:38 <@vpnHelper> Title: IntoVPS - Knowledgebase - How to install and configure OpenVPN (at secure.intovps.com)
04:38 < Bushmills> sorry, i'm not going to read the tutorial for you to find out what is wrong with it.
04:39 < EugenMayer> dazo: http://pastebin.com/AiqJFGrB
04:39 < Lenoob> Because I followed the tutorial gives specifications at my own vps
04:40 < EugenMayer> dazo: http://pastebin.com/Evy37rjx those are my extensions on the server.crt ( ca )
04:41 < EugenMayer> all i did is importing the current certs into xca and then exporting p12 for server and client
04:41 <@dazo> EugenMayer: try on your server.p12 file .... openssl pkcs12 -in server.p12 -clcerts -nokeys | openssl x509 -noout -text
04:41 <@dazo> EugenMayer: ahh!  You cannot use your CA cert for your OpenVPN server cert 
04:42 < EugenMayer> DOH!
04:42  * EugenMayer facepalms.
04:42 < EugenMayer> oh my goodness. Sorry for wasting your time :/
04:42 < EugenMayer> i just got confused a bit, iam really sorry
04:42 < EugenMayer> dazo++
04:42 < EugenMayer> Thank you!
04:43 < Lenoob> But looking at the error you can not find what this error?
04:43 <@dazo> EugenMayer: no problem :) ... but you can use pkcs12 certs for server ... you just need to include both server.crt and ca.crt into the pkcs12 file :)
04:43 -!- Eirel [d980a5da@gateway/web/freenode/ip.217.128.165.218] has joined #openvpn
04:43 <@dazo> Lenoob: read that error very carefully ... and tell me what you think is wrong
04:43 < SintaxBSD> I don't see much talk of openvpn being used with android on the forums, any of you guys do such a thing ?
04:43 <@dazo> (hint: your error is very obvious, written in clear text)
04:44 < Eirel> hi guys I've got a problem. I'd like to assign a fixe IP adress to each client connecting to my vpn server, but the adresses are not set...And if I put ccd-exclusive, I can't connect at all...Please anybody help me
04:44 <@dazo> SintaxBSD: you need to root your andriod ot make it work
04:44 < Lenoob> He does not find the file Clées
04:44 < Bushmills> Lenoob: i can't say more about the error cause than the error already does
04:44 < Lenoob> the keys file *
04:44 < SintaxBSD> dazo yep ;-p
04:44 < Lenoob> I'm french I do not understand very well this error also
04:45 < SintaxBSD> i'm running aosp 2.3 with native openvpn support
04:45 <@dazo> Lenoob: when OpenVPN cannot read a file ... you need to figure out why it cannot read it ... check your config file carefully, and make sure all paths are correct
04:45 <@dazo> give full paths to the file if needed
04:46 < EugenMayer> dazo: and who wonders, using my server crt it works
04:46 <@dazo> SintaxBSD: well, I don't think it's spoken much about OpenVPN on Andriod, basically because those who roots their devices usually make it work without too much hassle ... and that nobody really have tried or manged to find a non-rooting solution 
04:46 < EugenMayer> i still cant believe it.. this was way to stupid by me :/
04:46 <@dazo> EugenMayer: \o/
04:46 < Lenoob> but ... the file exist and is on /etc/openvpn/easy(rsa/keys !
04:47 < SintaxBSD> dazo it supports vpn's without rooting but only IPSEC/L2TP
04:47 <@dazo> Lenoob: OpenVPN still cannot access that file ... that's the error, and you need to figure out why ... wrong paths are the most common error
04:47 < SintaxBSD> i set up an openvpn server on my freebsd machine and tested it with my phone from inside my lan and it worked, and i get to work and try it and it doesnt work.. wish i could clone freeopenvpn.com's server settings :-\
04:48 < Lenoob> Or set or is this file?
04:48 < Lenoob> Where set *
04:48 <@dazo> Lenoob: wild cards won't work
04:48 <@dazo> SintaxBSD: use --verb 4 on client and server configs ... then you usually get better idea what happens
04:48 <@dazo> SintaxBSD: it might be you have a firewall issue though
04:48 < Lenoob> One moment I do not understand
04:49 -!- anitxor [~xor@cryptoanarchy.org] has quit [Ping timeout: 240 seconds]
04:49 < Bushmills> SintaxBSD: "doesn't work" is not very descriptive of the error symptoms
04:50 < SintaxBSD> well i can use freeopenvpn.com fine, i need to fine tune mine to be similar.. maybe i should try that --verb 4, but the problem im having is testing via my WAN IP from inside my LAN, it doesnt like that loopback im guessing
04:50 <@dazo> Lenoob: !configs
04:50 <@dazo> !configs
04:50 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
04:50 < EugenMayer> Lenoob: just stop refusing. Its the mood of this channel: They will teach you to understand and not simply solve your problem
04:50 -!- anitxor [~xor@cryptoanarchy.org] has joined #openvpn
04:50 < EugenMayer> Its not always that way in #freenode but its that way here. And actually i like it
04:51 -!- AntiSociaL [AntiSociaL@unaffiliated/antisocial] has joined #openvpn
04:51 < EugenMayer> Those people helping here are just trying to stop people returning with every noobish question, like in a chain.
04:51 <@dazo> EugenMayer++
04:51 < SintaxBSD> EugenMayer that doesnt work on everyone though unfortunately
04:51 < EugenMayer> They point you to docs, point you and give you hints but YOU have to do that work, not them.
04:51 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
04:51 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
04:52 -!- bitterman [~yury@84.51.195.188] has joined #openvpn
04:52 < EugenMayer> Lenoob: i know you just want to get the job "done"..but hey, thats not paid support
04:52 < EugenMayer> People help others to understand here - not to do their job. Thats simply it.
04:52 < SintaxBSD> EugenMayer don't forget the language barrier
04:52 < Lenoob> I must go. Thank you
04:52 < Lenoob> go out *
04:52 < EugenMayer> Bye
04:53 -!- Lenoob [~Lenoob@unaffiliated/lenoob] has left #openvpn ["WeeChat 0.3.5-dev"]
04:53 -!- luneff [~yury@84.51.195.188] has quit [Ping timeout: 255 seconds]
04:53 < EugenMayer> in germany we call that "Beratungsresistent" .. you is kind of "resistent against any advice"
04:53 < Eirel> nobody? I suppose that's quite simple but don't know why...
04:54 < EugenMayer> !ccd
04:54 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
04:54 < EugenMayer> Eirel: read the docs carefully, esp. the "topology" part
04:55 < EugenMayer> Eirel: switch your server to verb 3 and be sure to have the logs set (status and main)
04:55 < EugenMayer> it should actually be very descriptive what the erros tell you about the connection. Be sure to use openvpn $config on the client, so you see whats happening there.
04:56 < EugenMayer> (so its not daemonizing)
04:57 < EugenMayer> does anybody in here use xca for cert management?
04:57 < EugenMayer> I really like it.
05:01 <@dazo> EugenMayer: I've testing it out, I've been using TinyCA2 for a long time ... but xca is slicker somehow, but not always as intuitive as TinyCA2 is in the very beginning
05:01 <@dazo> but I like the features and flexibility of xca
05:01 < EugenMayer> well the 0.9 branch is pretty cool
05:02 < EugenMayer> they also support dh generation now. It just plain easy to use. You can now generate templates out of every existing certs and stuff like that. Awesome work
05:02 <@dazo> indeed!
05:06 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:06 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:06 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:06 < janjust> morning dazo, nice mail on openvpn-users ;-)
05:08 -!- SintaxBSD [heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has quit []
05:09 < Eirel> is there a possibility to get the common name associated to a client/key? to be sure that's the exact same I use in ccd dir
05:10 < janjust> the common name is present in the client certificate
05:10 < janjust> use 'openssl x509 -subject -noout -in client.crt' to list the client subject name
05:11 < janjust> the common name is the part after the (first) /CN= occurrence, with spaces translated to underscores (_)
05:11 < EugenMayer> Eirel: thats _exactly_ what you do.
05:11 < EugenMayer> <common-name>
05:12 < janjust> alternatively you can also look in the server log file when the client connects: the server log will mention the client common name as well
05:12 < EugenMayer> thats how you name the file which is for the client with the <common-name>
05:12 < EugenMayer> ah, sorry Eirel. I missread it
05:12  * EugenMayer dances
05:12 < EugenMayer> all 4 networks are up
05:14 -!- SintaxBSD [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has joined #openvpn
05:14 < EugenMayer> My last question i probably not solveable properly. I have setup a DNS to resolve the domains in my internal networks. Pushing those DNS settings to linux client is working. Now one issue is the normal DNS chain. Is it possible to do somethin like "only use that DNS for 10.8.0.0" and use your others for all others? I expect this is only solveable by dnsmasq
05:15 < EugenMayer> because if the first DNS ( in my case one of the internal networks ) answerts, there is no way the second DNS of the client ( lets say one of his routers ) fires later. So i have to configure my DNS to forward requests to the root DNS servers to resolve all the VPN clients dns requests.. which i kind of not want to do... ( performance )
05:15 < EugenMayer> Iam sure you guys have also running into those issues. How to deal with it. Only on client side yet or?
05:15 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
05:19 -!- barbosa [~barbosa@189.27.116.254.dynamic.adsl.gvt.net.br] has left #openvpn ["Fui embora"]
05:20 < janjust> hi EugenMayer , what you're referring to is known as split DNS. It is possible to configure Linux DNS resolver to query a set of DNS servers in order 
05:20 < janjust> on Windows this is much harder to do
05:20 < Bushmills> EugenMayer: some name server can be configured with something called "split horizon" which serves from zone files depending on who requests it
05:20 < EugenMayer> You both are right but still
05:20 < janjust> on Linux, edit the /etc/nsswitch.conf file 
05:20 < EugenMayer> this would need to be done one the client.
05:21 < SintaxBSD> wont it also cache the requests? after trying both DNS servers 
05:21 < janjust> the "global" solution is to set up a DNS server on the VPN server, redirect all clients to it, and do the split horizon DNS there
05:21 < EugenMayer> Wait, we just have to see the order. Lets say iam a client of one VPN network. Before i connect, i use 8.8.8.8 for DNS resolving, lets name it gooogle
05:22 < EugenMayer> when i connect, i get pushed a new dns, lets say 10.8.0.1, lets call that one internal
05:22 < EugenMayer> internal gets pushed before google, so 
05:22 < EugenMayer> nameserver internal
05:22 < EugenMayer> nameserver google
05:22 < Bushmills> that one will also become your new recursive name server
05:22 < EugenMayer> now, when i try to resolve an external IP, interal will be asked first. He will answer (and not timeout)
05:23 < Bushmills> google would then only be used when internal fails to replay
05:23 < Bushmills> reply
05:23 < EugenMayer> then it comes to your "split".
05:23 < EugenMayer> yes but fails to reply is only in terms of "timeout" and not "cant resolve"
05:23 < EugenMayer> and thats the issue with the current DNS protocol
05:23 < Bushmills> google *won't* be used when internal simply returns a "hostname doesn't exist"
05:23 < EugenMayer> yes.
05:24 < EugenMayer> Thats my issue. So internal WILL have to resolve _every_ dns request for now on. What is bad.
05:24 < Bushmills> so you could simply replace google against internal
05:24 < EugenMayer> you mean change the order?
05:24 < Bushmills> yes, it will have to recurse. 
05:24 < EugenMayer> that wont help either.
05:25 < EugenMayer> google will not be able to resolve domaint.internal.local
05:25 < EugenMayer> so "hostname does not exists" and so internal never gets asked.
05:25 < Bushmills> what's wrong with letting internal recurse?
05:25 < EugenMayer> Performance
05:25 < EugenMayer> It really lacks a lot of performance
05:25 < Bushmills> would be most likely  better
05:26 < EugenMayer> not in my case. It could be that something is wrong with my setup. e.g. dig cant resolve internals, nslookup can
05:26 < EugenMayer> hostname / hostname -f are correct though and i can ping both
05:26 < EugenMayer> foo and foo.domain.local
05:27 < Bushmills> dig @internal  hostname
05:27 < EugenMayer> My real issue here is, that also all my customers will be part of that network (maintaince and the backup network..both VPN), and they all have a webservice running. So i have to resolve everything the webserver needs for all clients. I kind of dont think this will scale to good :/
05:28 < EugenMayer> so my attempt would be using dnsmasq which have cool rules to do stuff like
05:28 < EugenMayer> "if this, ask that, if that ask the other"
05:28 < EugenMayer> at least for the servers
05:29 < EugenMayer> Bushmills: just by your experience, do you think its rather bad to use a ESXI vm be that kind of VPN host?
05:30 < Bushmills> i wouldn't say "bad" but i don't have esxi experience
05:30 < EugenMayer> the I/O is ok to "not so good". Iam not sure how oVPN performs here e.g. CPU usage or something else
05:30 < Bushmills> just fiddling with kvm myself
05:30 < SintaxBSD> esxi is amazing =]
05:31 < EugenMayer> yeah will will try proxmox next
05:31 < EugenMayer> Bushmills: dont hazzle with KVM directly, use proxmox.
05:31 < Bushmills> what'S the difference, or advantage?
05:32 < EugenMayer> Bushmills: that host hosts 4 different ovpn deamons, so 4 different networks, on DNS and bacula ( which is only active at night and only the director, not the storage)
05:32 < EugenMayer> Bushmills: proxmox is kind of GUI / manager
05:32 < EugenMayer> its also an appliance
05:32 < Bushmills> ah. i'm not running gui
05:32 < EugenMayer> have a look at it
05:32 < Bushmills> simply scripted some administrative stuff
05:32 < EugenMayer> it will help you managing kvm and openvz at the same time
05:33 < janjust> hmmm I was just reading up on the nsswitch.conf man page
05:33 < EugenMayer> well then script migration :)
05:33 < janjust> it states that when a service returns 'not found' then the default action is continue
05:33 < EugenMayer> janjust: try it :)
05:33 < janjust> perhaps you can (ab)use this to query multiple DNS servers, or switch from dns to wins
05:34 < EugenMayer> janjust: that would come down to dnsmasq i guess
05:34 < EugenMayer> which does also some caching, which is just a nice addition
05:34 < janjust> dnsmasq would be the easiest to abuse for this
05:34 < EugenMayer> Bushmills: you ever ran a virt-env for longer time?
05:35 < Bushmills> vserver i've been running for some time, but that's more a kind of chroot on steroids
05:36 < EugenMayer> if "chroot on steroids" is just another word for "bullshit", then yes
05:36 < Bushmills> not "have been" .. still running it
05:36 < EugenMayer> you really cand compare vserver and ESXi at all
05:36 < EugenMayer> that would be kind of ~500% faster or rather more
05:36 < Bushmills> vserver does it's job, and it does it well. depends on the needs.
05:37 < EugenMayer> It is pure slowleness.
05:37 < Bushmills> vserver? that's native speed.
05:37 < EugenMayer> ah sorry :/
05:37 < EugenMayer> i totally mixed vserver with the vserver part from VMware
05:37 < EugenMayer> vserver is "rather" like openvz, just worse
05:38 < janjust> EugenMayer:  do you mean vmware server? I've been using vmware server 1.0 for quite some time
05:38 < EugenMayer> proxmox lets you manage both, KVM ( real virt ) and openvz ( not real, but faster )
05:38 < EugenMayer> 1.0 is much better then 2.0
05:38 < janjust> performance is not great, but running windows on vmware server is a hell of a lot faster than running windows under kvm
05:38 < Bushmills> http://linux-vserver.org
05:38 < EugenMayer> never ever upgrade :)
05:38 <@vpnHelper> Title: Linux-VServer (at linux-vserver.org)
05:39 < EugenMayer> janjust: compared to ESXi it is really bad. i expected KVM be a bit slower to ESXi due to the missing "thin busybox"
05:39 < Bushmills> i use kvm for on and servers. no intention to run windows there :)
05:39 < EugenMayer> janjust: but thats what proxmox deals with KVM, and thats pretty coool
05:40 < EugenMayer> Bushmills: well iam a webdev.. so IE6 testing, Ie7 testing..
05:40 < EugenMayer> Ie8..
05:40 < EugenMayer> All those crappy software needs some testing. Beside all those AD / kerb / shibboleth things, or win DC for testing..
05:41 < EugenMayer> And i rather put those things on one our ESXi servers instead of having it on my desktop
05:41 < janjust> yes but ESXi costs $$$ :S
05:41 < EugenMayer> 0€
05:41 < EugenMayer> exactly
05:41 < EugenMayer> ESXi != ESX
05:41 < EugenMayer> ;-)
05:41 < janjust> EugenMayer:  about the split horizon DNS: there's one more thing to try
05:42 < janjust> aaah OK, didn't know about a free version of ESX(i)
05:42 < SintaxBSD> ESXi is free btw.
05:42 < EugenMayer> ESX = not free
05:42 < EugenMayer> ESXi = free
05:42 < SintaxBSD> ESX is not, and ESX = going away to be replaced by esxi
05:42 < EugenMayer> and yes VMware will beat the crap out of you with there product naming
05:42 < EugenMayer> SintaxBSD: dont they? :=)
05:42 < janjust> EugenMayer:  try adding 'options attempts:3 rotate' to the /etc/resolv.conf file
05:43 < SintaxBSD> but you can pay for an esxi license, it does have limitations
05:43 < janjust> don't know if that will work but it's worth a shot
05:43 < EugenMayer> janjust: and configureing the internal DNS to not forward?
05:43 < janjust> exactly
05:43 < EugenMayer> i will try, thanks!
05:43 < janjust> if the resolver keeps trying after the first DNS server reports 'not found' then it should try the next DNS server (based on 'rotate')
05:44 < Bushmills> wouldn't that just slow down resolving?
05:44 < janjust> Bushmills:  hell yes
05:44 < EugenMayer> hell then it does not need to beused!
05:44 < EugenMayer> no then i go for dnsmaqs
05:44 < EugenMayer> i only have *deb / nix clients
05:45 < EugenMayer> so i can use it everywhere i need. And for those windows clients may come
05:45 < EugenMayer> they should be punished and therefore have slower resolving. 
05:45 < Bushmills> but then, your traffic still goes through your server, just as it would if your name server did recursing
05:45  * EugenMayer yes i dont like M$ software, expcept Visual Studio - which is awesome :)
05:45 < EugenMayer> Bushmills: nope
05:46 < EugenMayer> dnsmash will just check "well if it is 10.8" got for that DNS
05:46 < EugenMayer> "all others, use that"
05:46 < Bushmills> dnsmasq would then simply proxy to google
05:46 < EugenMayer> yes but it can split. And as it is localy, it does not need to use the internal VPN network
05:47 < Bushmills> ah, dnsmasq on client machines, that is.
05:47 < Bushmills> misunderstood. i thought you'd put it on server
05:47 < EugenMayer> no
05:47 < EugenMayer> and yes
05:47 < EugenMayer> "on servers which are clients of the VPNs"
05:48 < EugenMayer> but not onthe "DNS server" :)
05:48 < EugenMayer> Yeah great, i should use server in even more contexts
05:49 < SintaxBSD> lol
05:49 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
05:49 < Bushmills> what's the advantage of running dnsmasq "there" over running split horizon recursive name servers which are also slaves of your vpn zone?
05:50 < EugenMayer> no "on the dns server"
05:50 < EugenMayer> it does not help ( maybe the caching, but generally does not )
05:51 < EugenMayer> on the client it does a lot, because you can "split" there. 
05:51 < EugenMayer> external -> 8.8.8.8
05:51 < EugenMayer> internal -> 10.8.
05:51 < EugenMayer> so for external resolving a DNS package never hits your internal VPN
05:51 < SintaxBSD> could always use a hosts file for internal
05:51 < Bushmills> i thought the "no" referred to "running dnsmasq on client machines"
05:52 < EugenMayer> no not the no
05:52 < EugenMayer> :D
05:52 < EugenMayer> Bushmills: sorry for getting you confused :)
05:53 < EugenMayer> SintaxBSD: hosts where? On the client? And if i change a IP, i just change hosts on all clients
05:53 < EugenMayer> no thanks :)
05:53 -!- bitterman [~yury@84.51.195.188] has quit [Quit: Leaving]
05:53 < Bushmills> and NIS is obsolescent
05:54 < Bushmills> though NIS would be a simple solution
05:55 < EugenMayer> odd one of the networks is not reachable - network timeout. 
05:55 < EugenMayer> Same FW configuration, just a different port
05:55 < EugenMayer> hm
05:56 < SintaxBSD> maybe run a dns server on the vpn server and synchronize it with an internet accessible dns server like editdns.net to pass off the load?
05:57 < Bushmills> there are no "dns servers"
05:57 < SintaxBSD> ....
05:58 < EugenMayer> SintaxBSD: i rather would use my own machine then
05:58 < EugenMayer> just buy a dedicated and run a DNS on it only
05:58 < EugenMayer> "private dns"
05:58 < SintaxBSD> wont that work? 
05:58 < SintaxBSD> Bushmills were you talking to me?
05:58 < EugenMayer> Tue Feb  1 12:58:35 2011 us=663252 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
05:58 < Bushmills> there is the DNS, and there are name servers :P
05:58 < EugenMayer> that is actually just a normal timeout, or?
05:59 < SintaxBSD> you lost me with that jargon
06:00 < Bushmills> "DNS name server" would still be acceptable :)
06:00 < SintaxBSD> Domain Name System Name Server ?
06:00 < Bushmills> yes
06:00 < SintaxBSD> that sounds ridiculous
06:01 < SintaxBSD> i don't see what the difference is
06:01 < EugenMayer> guys what could be the reson for an TLS handshake timeoutß
06:01 < Bushmills> maybe that's why there's an acronym for it
06:02 < SintaxBSD> DNS Name server, never seen it like that
06:02 < Bushmills> not a big issue, "dns server" sounds a bit like "www server"
06:02 < Bushmills> just ... odd
06:03 < SintaxBSD> you're doing a great job of confusing me
06:03 < SintaxBSD> dns server sounds odd?
06:03 < Bushmills> it does, indeed.
06:03 < SintaxBSD> how is that so?
06:04 < EugenMayer> i can reach the server with telnet on its port .. hmm :/
06:04 < Bushmills> as it sounds like it would be a server which serves the dns, instead of just a zone.
06:05 < SintaxBSD> EugenMayer is that making any sense to you ?
06:05 < Bushmills> or, host names from that zone
06:05 < EugenMayer> Guys iam trying not to follow you
06:05 < EugenMayer> because my current confusion level is 90%
06:05 < SintaxBSD> lol
06:05 < EugenMayer> it will outbound 100% if i will try
06:05 < EugenMayer> :)
06:06 < SintaxBSD> he's got the other 90% going on
06:06 < Bushmills> well, call them "dns servers" if you like, while you're busy, you might also want to download internet.
06:07 < SintaxBSD> is English your primary language ?
06:07 < EugenMayer> <- ? no.
06:07 < EugenMayer> VERIFY ERROR: depth=0, error=unsupported certificate purpose: 
06:08 < EugenMayer> thats on the server side..so it can be reached. Nice a brand new error. Great.
06:10  * EugenMayer hits himself hard.
06:11 < EugenMayer> Ok, now iam getting close. 
06:11 <@vpnHelper> RSS Update - forum: can I install racoon ipsec and openvpn in the same server? <http://forums.openvpn.net/topic7581.html>
06:12 < EugenMayer> When i dont use client-to-client, clients should actually not be able to talk to eachother, dont they?
06:12 < EugenMayer> (because they can)
06:12 < EugenMayer> iam not sure client-to-client is only for tap
06:13 < Bushmills> EugenMayer: when you don't use client-to-client, clients may still be able to - but routing is done through host OS, rather than openvpn
06:13 < Bushmills> and client-to-client can be used with tun
06:14 < EugenMayer> hmm, but when i ping 10.8.0.10
06:14 < Eirel> can someone tell me if there's anything wrong in this configuration: server.conf http://pastebin.com/gnRTwp53, servertestweb in /etc/openvpn/ccd/: http://pastebin.com/La20ZMHd. The adress is not fixed on my windows openvpn client...
06:14 < EugenMayer> from 10.8.0.11 and the only it  can reach 10.8.0.10 is VPN, how should the OS route that?
06:15 < EugenMayer> Bushmills: should i rather not rely on c-to-c and just firewall the interfaces?
06:15 < Bushmills> is 10.8.0.10 the p-t-p adress of 10.8.0.11?
06:15 < Bushmills> can't say, depends on your objectives
06:16 < Bushmills> if you want to be able to firewall inter-client traffic, you should *not* use client-to-client
06:16 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
06:17 < EugenMayer> Bushmills: ok, so use the clients FW for that
06:17 <@vpnHelper> RSS Update - forum: can I install racoon ipsec and openvpn in the same server? <http://forums.openvpn.net/topic7581.html#p9481>
06:17 < EugenMayer> Bushmills: well or change the forward rules on the VPN hosts, or?
06:17 < Bushmills> client-to-client shortcuts that
06:18 < EugenMayer> hrm
06:18 < Bushmills> not using client-to-client makes that the responsibility of the OS
06:19 < EugenMayer> i see
06:19 < EugenMayer> OS -> the os of the VPN server(s)
06:19 < Bushmills> yes
06:19 < EugenMayer> what i need is configured "one way" connection to some clients from a client
06:19 -!- SintaxBSD [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has quit [Read error: Connection reset by peer]
06:19 -!- Sintax` [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has joined #openvpn
06:20 < Bushmills> no client-to-client, and firewall rule on vpn server
06:20 < EugenMayer> lets say 10.8.0.2 should be able to reach 10.0.8.0 completly, why no other should reach any 
06:20 < Bushmills> or, firewall rule on client
06:20 < EugenMayer> i see
06:20 < EugenMayer> Thank you a lot Bushmills
06:20 < Bushmills> np
06:21 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
06:22 -!- alhadi [~thunderst@92.96.230.158] has quit [Ping timeout: 240 seconds]
06:22 < EugenMayer> Bushmills: you remember by nslookup / dig issue?
06:23 < EugenMayer> nslookup works, while dig does not. even not with dig @10.8.0.1 internal
06:23 < Bushmills> dig @internal hostname
06:23 < EugenMayer> tried - not workin
06:23 < EugenMayer> it works if i use de FQDN though
06:23 < Bushmills> then name server on 10.8.0.1 needs correct setup
06:24 < Bushmills> is name server supposed to guess what domain a host name is in?
06:24 < Bushmills> you query, name server looks up a match.
06:26 < Bushmills> (dig will ignore the "search" statement in your resolv.conf)
06:26 < EugenMayer> i see
06:26 < EugenMayer> what does it not ignore?
06:27 < EugenMayer> the issue is, if i connect to the VPN all things like apache restart or surfing gets slow
06:27 < Bushmills> it will query the nameserver given in hosts.conf
06:27 < Bushmills> the line "SERVER:" will tell
06:28 < Bushmills> ehm ... resolv.conf  i mean
06:28 < EugenMayer> "SERVER?"
06:28 < Bushmills> third line from the end
06:28 < EugenMayer> you mean query the server using the local hostname?
06:28 < Bushmills> no. the line in dig's output, beginning with "SERVER:"
06:29 < EugenMayer> 10.8.0.1
06:29 < EugenMayer> in my case
06:29 < EugenMayer> i think i got you
06:31 < Eirel> nobody?
06:31 < EugenMayer> Bushmills: well no i think everthink is setup correctly
06:32 < EugenMayer> the hostname can be resovled by .1 .. hostname -f looks good as hostname does
06:32 < EugenMayer> nslookup works good using foo and foo.domain.local
06:32 < EugenMayer> dog @.1 foo
06:32 < EugenMayer> does not work, foo.domain.local does work
06:33 < EugenMayer> and the apache2 restart takes hours again... why..
06:37 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
06:41 < EugenMayer> ah..its missing tis FQDN..
06:57 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has joined #openvpn
07:03 -!- AntiSociaL [AntiSociaL@unaffiliated/antisocial] has left #openvpn []
07:07 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 240 seconds]
07:13 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has quit [Quit: Leaving.]
07:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:25 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
07:30 <@vpnHelper> RSS Update - forum: can I install racoon ipsec and openvpn in the same server? <http://forums.openvpn.net/topic7581.html#p9482>
07:31 -!- pk___ [dce36163@gateway/web/freenode/ip.220.227.97.99] has joined #openvpn
07:36 <@vpnHelper> RSS Update - forum: Virtual Boot Error <http://forums.openvpn.net/topic7543.html#p9483>
07:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
07:43 -!- pk___ [dce36163@gateway/web/freenode/ip.220.227.97.99] has quit [Quit: Page closed]
07:43 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Quit: We're all going to die.]
07:45 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
07:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:07 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
08:13 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Quit: leaving]
08:18 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
08:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
08:24 -!- Zdenek [~Zdenek@73.125.broadband9.iol.cz] has joined #openvpn
08:27 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
08:32 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
08:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:51 -!- Zdenek [~Zdenek@73.125.broadband9.iol.cz] has left #openvpn [" www.qip.im "]
08:55 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:10 -!- Eirel [d980a5da@gateway/web/freenode/ip.217.128.165.218] has quit [Quit: Page closed]
09:12 -!- WinstonSmith [~true@g231242151.adsl.alicedsl.de] has joined #openvpn
09:13 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:17 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:20 -!- WinstonSmith [~true@g231242151.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
09:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:21 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
09:21 -!- OneWay [~OneWay@76.91.121.73] has joined #openvpn
09:22 < OneWay> !goal
09:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:25 -!- crazed [~crazed@unaffiliated/cr4z3d] has joined #openvpn
09:25 < crazed> !welcome
09:25 < crazed> !goal
09:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:27 < OneWay> Hi, I'd like to find out how to use an OpenVPN server simultaneously both as a VPN server (for OpenVPN clients) and as a VPN tunnel endpoint.  I'm having issues finding examples for such a configuration.  Also, if I was given a 12 character pre-shared key, is that too short for OpenVPN?  Thank you.
09:27 < crazed> i'm working on a machine that has one network interface that connects to the public internet. it has firewall ACLs that allow it to talk to other hosts behind the same firewall. i'd like to use openvpn to connect to this host, and then be able to talk freely to the other hosts behind the firewall
09:28 < crazed> there are some constraints though, i can't simply do briding because i can't take IPs from the same range
09:28 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
09:29 < crazed> i was wondering if there was a way to nat when coming out of a tap device 
09:29 < crazed> so tap0 is 10.8.0.1, eth0 is 192.168.1.1, have all traffic come out of tap0 as 192.168.1.1
09:30 < OneWay> Our OpenVPN server (linux) is currently serving for OpenVPN clients.
09:33 -!- EugenMayer [~eugen@frbg-5f732aa4.pool.mediaWays.net] has quit [Quit: Leaving.]
09:33 -!- WinstonSmith [~xxxx@e178179017.adsl.alicedsl.de] has joined #openvpn
09:33 < crazed> nvm
09:33 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:36 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
09:36 < OneWay> !welcome
09:36 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:38 < OneWay> If I'm in the wrong channel, please let me know, thank you.
09:42 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html>
09:46 < gladiatr> OneWay, hey there
09:47 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
09:47 < gladiatr> OneWay, what you'll want to do is to run two instances of OpenVPN.  For the client instance, just make sure you're using the no-bind option
09:47 < gladiatr> then your server instance will be free to bind to 1193
09:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:47 < gladiatr> It's generally a good idea to use the no-bind option for client configurations regardless.
09:47 < OneWay> Hi, thank you.  You mean client instance as in point-to-point tunnel?
09:48 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
09:48 < gladiatr> No.  I mean two separate openvpn processes: one that's acting as your client and another one that accepts connections from other clients
09:49 < gladiatr> My definition of client vs. server has to do with which end is initiating the connection and which one is listening for said connections.
09:49 -!- Eirel [d980a5da@gateway/web/freenode/ip.217.128.165.218] has joined #openvpn
09:49 < Eirel> hi all. Can anybody explain me exactly how to assign specific static ip address to each client who will connect to my openvn server plz
09:50 < gladiatr> !ccd
09:50 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
09:50 < Eirel> actually, I've already try cdd directory, but it doesn't work, like if server does not see this dir
09:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
09:51 < gladiatr> !pastebin
09:51 < gladiatr> !paste
09:51 < gladiatr> !factoids search pastebin
09:51  * gladiatr nudges vpnHelper 
09:51 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
09:51 <@vpnHelper> Unable to download feed.
09:51 <@vpnHelper> "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
09:52 < gladiatr> Eirel, show me your server configuration
09:52 < Eirel> what do you want me to paste? My server.conf?
09:52 < Eirel> k
09:52 < gladiatr> please
09:53 < Eirel> http://pastebin.com/E0gN3QKb
09:53 < gladiatr> Now paste your server startup log.  Please set "verb 4" 
09:55 < Eirel> k
09:55 < Eirel> wait a seconde
09:55 < gladiatr> np
09:58 < Eirel> there you are:http://pastebin.com/9QyGWTqu
10:00 < gladiatr> Restart your openvpn server process and paste the log output of that.  I need to see what it says when it parses your configuration file.
10:00 < OneWay> Hi, gladiatr.  From what you've said, I understand that I should run multiple instances of OpenVPN.  Is there a recommended best-practice guide or book for this?  Is it better to use a separate directory?  Also, a peer gave me a 12 character pre-shared secret.  Is this a compatible arrangement?
10:00 < gladiatr> OneWay, what operating system are you using?
10:01 < OneWay> CentOS 5.4 ish
10:01 < Eirel> ok
10:02 < gladiatr> OneWay, k.  It isn't necessary to separate your configurations into different directories.  Essentially, you will leave your client configuration the way it is and have a new file that defines your server configuration.  For that, the how-to on the openvpn.net site has good information for setting that up.
10:02 < OneWay> oh, I'm sorry.  Normally it's CentOS 5.x.  This particular box is using Fedora Release 11 for some reason.
10:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:02 < gladiatr> That's ok.  It's really only a big difference if you're running Windows.
10:02 < Eirel> here's the log when launching openvpn: http://pastebin.com/TNjLH7Y7
10:03 < OneWay> Thank you.  I'll look it up then.  And regarding the short pre-shared key?  Do you have any thoughts on that please?
10:04 < gladiatr> OneWay, from the /etc/init.d/openvpn file: http://pastebin.com/WZViGy8X
10:04 < gladiatr> OneWay, what about it?
10:05 < gladiatr> Eirel, ok.  Are your configuration files located in /etc/openvpn?
10:05 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
10:05 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
10:05 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
10:06 < gladiatr> OneWay,  are you wanting to use the same psk for your server as well?
10:06 < gladiatr> !factoid search psk
10:06 < gladiatr> !factoid search pre-shared
10:09 < gladiatr> !static-key
10:09 <@vpnHelper> "static-key" is when you use --secret, you are using a static key. this is only valid for point-to-point setups. Static keys are less secure in that they never change. If someone captures your traffic, and then gains your static key a year from now, they can decrypt the captured traffic. Setups that use certs re-key every hour by default
10:09 < OneWay> I kind of understand.  Use that example to auto-start multiple instances of OpenVPN.
10:09 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:10 < gladiatr> Exactly.
10:10 < Eirel> gladiatr, yep. server.conf is in /etc/openvpn and the ccd dir too
10:10 < gladiatr> Eirel, I just noticed you're using the chroot option.  For your ccd files to be readable after the server starts up, you'll need to move the ccd directory into /etc/openvpn/chroot
10:10 < Eirel> already done
10:11 < OneWay> Regarding PSK, yes, it's meant for the same server, I believe.  But I wasn't given a tunnel IP.  We only exchanged IP network info so far.
10:11 < gladiatr> K.  Have you tried w/out using the chroot directive?  I've not actually experimented with it, so I'm not familiar with its idiosyncrasies. 
10:11 < Eirel> there's a "local" copy of cdd dir in my /etc/openvpn/jail (chroot dir)
10:11 < gladiatr> hrm...
10:12 < Eirel> hum...I'll give it a try
10:12 < gladiatr> k.  Sorry I don't have a definitive suggestion at that point.  Let me know if that works.  Your configuration looks very typical, otherwise.
10:13 < Eirel> holy s***...That's working w/out the chroot option
10:13 < Eirel> great job, thx
10:14 -!- Janos [~Janos@190.10.52.113] has joined #openvpn
10:14 < gladiatr> :)
10:14 < gladiatr> I'll muck around with the chroot thing when I get a chance.  I'm now curious what it needs to be happy.
10:19 < OneWay> gladiatr, did that answer your PSK question?
10:19 < gladiatr> OneWay, partially.  So, you want to use the same key to authenticate clients connecting to your server that you're using to connect with your existing vpn link?
10:21 < OneWay> oh, the server is already functioning as a VPN server for OpenVPN clients.  Apart from that, we're needing to connect our network with a business partner via a point-to-point tunnel, thus requiring this 2nd instance of OpenVPN.
10:21 < Eirel> lol ok. thank you anyway ^^
10:21 < gladiatr> Eirel, you're very welcome
10:23 < gladiatr> OneWay, Ok.  Well, the paragraph above states the problem with using a static key with a vpn.  You can certainly use an additional tunnel for making that connection.  The one thing that you'll need to add to your existing configuration is a route to your client's network.
10:24 < OneWay> Yes, that makes sense.  So the tunnel IP's are not necessary then?  Just the peer routes?
10:25 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
10:26 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
10:27 < gladiatr> If I'm understanding what you're describing, yes.  The IP addresses assigned to each end of your new tunnel are only useful for routing.  Oh, one more thing: you'll need to push a route to your client network to your client's network as well.  The system on their end will need to know how to send packets back to your first vpn's clients.
10:28 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
10:29 < OneWay> Similar to how we push the routes to the vpn clients?  Okay.  I'll give that a try.  Thank you very much.
10:30 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
10:30 < gladiatr> OneWay, you're very welcome
10:31 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
10:37 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:38 < Janos> hi, have 2 firewalls using openvpn to tunnel traffic from their internal lan to the remote (using tun) and it works great as always, when packets come from my firewall to the remote lan, source address is the the ip set on the tun device as expected, but because of some requirements i need the source ip of the packets to come from my internal ip, i can achieve this by manually doing "ip...
10:38 < Janos> ...route replace x.x.x.x/x via y.y.y.y/y dev tun0 src z.z.z.z", now the question, is it possible to specify a src address in openvpn so that this is set automatically for me ?
10:39 -!- Eirel [d980a5da@gateway/web/freenode/ip.217.128.165.218] has quit [Quit: Page closed]
10:43 < Janos> AFAIK linux ifconfig is not able to do this, only the ip command can, so if openvpn uses ifconfig in linux i guess it can't be done
10:43 < gladiatr> Janos, I don't think so.  I think this is one of those cases where it wouldn't make sense to burden the openvpn code-base with functionality that is taken care of by other parts of the networking stack.
10:48 < Janos> gladiatr: well the only other way i could think on how to do this without doing it manually is a "onConnect" openvpn script which would still be part of openvpn, so in my opinion it does makes a lot of sense, i mean common, i can set the metric but not the src address :)
10:49 < Janos> gladiatr: i think the limitation has more to do with the fact that openvpn uses ifconfig and not ip to configure the interfaces, maybe it's time to switch :P
10:49 < gladiatr> Janos, oh sure.  That's the reason those script hooks exist.  What I was saying was just that those mechanisms (in this case via iproute2) do a much better job manipulating those parts of the network configuration than openvpn ever could.
10:49 < gladiatr> Janos, I think that decision has more to do with openvpn being geared towards a cross-platform environment.
10:52 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
10:54 < Janos> gladiatr: you are right on that point, cross-plataform > "rarely used options", but if i had to bet, i would say you guys have to hook your parameters to an OS specific tool since this tools are different on most platforms so maybe have the minimum required for all platforms and well if a platform is more flexible than other why not just pass through the other ones :)
10:54 < Janos> gladiatr: but anyway, thanks for your answer, going to start working on my hook script
10:54 < majuk> Hi all. I am getting the error "self signed certificate in chain" when connecting my client to the server. I re-generated my ca.crt and client keys to make sure I didn't use a password, now I'm a bit confused.
10:55 < gladiatr> Janos, :)  have fun!
10:56 < majuk> Still getting the same error, not sure what the cause is. Any guidance appreciated.
10:56 < gladiatr> majuk, what utility/script/program are you using to generate your certificates?
10:56 < majuk> gladiatr, the easy-rsa scripts (build-[ca,key])
10:57 < majuk> And all key generation is happening on the CA
10:58 < gladiatr> Hrm... yeah.  Sorry.  I've encountered this before.  My solution has always been to create a root CA and then generate an intermediate CA from whence I create my client keys :\
10:58 < gladiatr> I'm pretty sure this isn't THE solution, but it is a solution 
10:58 < majuk> Hmmmmmmm..... well I'm willing to try anything.
10:59 < majuk> So I need to generate it on my client and then do a CSR?
10:59 < majuk> Oh, I got you.
10:59 < majuk> So I need ANOTHER CA. Huh.
10:59 < majuk> Well, I can do that too.
10:59 -!- ampex [~sterling@circu.it] has quit [Remote host closed the connection]
11:01 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has quit [Ping timeout: 240 seconds]
11:02 < gladiatr> Yeah.  I have both in the same directory structure.  Just create a new vars file so you'll have something like vars.root and vars.vpn
11:02 < gladiatr> generate the intermediate CA certificate from the root and plop it into the keys.vpn directory as its ca.crt
11:03 < gladiatr> Like I said, I'm sure there's a Better Way, but that's how I've dealt with it.
11:03 < gladiatr> Just make sure you give your root CA a 20-year lifespan or some such :)
11:03 -!- grapsus [~grapsus@acces1110.res.insa-lyon.fr] has quit [Ping timeout: 276 seconds]
11:04 -!- djgerm1 [~Your_Moms@adsl-75-24-88-30.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving.]
11:09 < hyper_ch> I knew it, Java is evil:  http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/
11:10 <@vpnHelper> Title: Java Hangs When Converting 2.2250738585072012e-308 - Exploring Binary (at www.exploringbinary.com)
11:10 < gladiatr> hyper_ch, indeed!
11:11 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
11:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:12 < hyper_ch> Bing fail - https://searchengineland.com/google-bing-is-cheating-copying-our-search-results-62914
11:12 <@vpnHelper> Title: Google: Bing Is Cheating, Copying Our Search Results (at searchengineland.com)
11:13 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
11:21 < majuk> gladiatr, So do I do a ./build-ca with my new vars.vpn or just copy the old ca stuff from keys.root?
11:22 < majuk> index.txt and serial are specifically what I'm talking about
11:24 < majuk> Ah, ./clean-all generated those files, nvm
11:24 < majuk> Hi, I am teh nubsauce.
11:27 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:31 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 276 seconds]
11:34 -!- WinstonSmith [~xxxx@e178179017.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:34 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
11:34 < majuk> gladiatr, so I must have misunderstood. I created a new vars.vpn (with keys.vpn as its key dir), #. ./vars.vpn; ./clean-all, then copied my old ca.crt and key into the new keys.vpn dir, generated a client and still get the self-signed error.
11:36 < gladiatr> majuk, sorry.  had to afk there.  Just move the key 
11:36 -!- WinstonSmith [~true@e178179017.adsl.alicedsl.de] has joined #openvpn
11:37 < majuk> Ah, so copy keys/ca.key to keys.vpn/ca.crt ?
11:37 < gladiatr> leave your root ca keys/certs where they originally were created.  Just copy the intermediate ca key  and cert into the vpn.keys directory
11:37 < gladiatr> no.
11:37 < majuk> Sorry man, I'm a dunce. :D
11:37 < gladiatr> bah.  No worries, man.  It is a bit confusing.  Generate the intermediate CA cert/key from the original ca and then copy *those* files into vpn.keys
11:37 < majuk> So I need to run another ./build-ca with a different common name?
11:38 < gladiatr> I think the script is ./build-inter
11:38 < gladiatr> let me look...
11:38 < majuk> Ah! Ok
11:38 < majuk> Yea, you're right
11:38 < gladiatr> It has been awhile since I set this up...
11:38 < majuk> Well you kicked my ass at it. ;D
11:38 < gladiatr> lol
11:40 < majuk> gladiatr, Mmmk, this is starting to make sense. You are a scholar, sir.
11:40 < gladiatr> You're very welcome!  Glad I could be of service :D
11:43 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:47 -!- OneWay [~OneWay@76.91.121.73] has quit []
11:48 < majuk> gladiatr :( Same error. wtf. So I generated an intermediary key with vars.root, copied that vpnca.crt and .key into the NEW keys.vpn as ca.crt and .key, gen'd a new client key using vars.alt.
11:50 < gladiatr> did you cat both the ca/root and ca/vpn keys together and put them on the client?
11:50 < gladiatr> ...and generate a server key out off the vpn ca?
11:52 < majuk> No, but I will now.
11:52 < majuk> Sorry man, I is speschul.
11:52 < gladiatr> lol!
11:53 < gladiatr> There are certain types of knowledge that human-kind does not disengage from the womb with a predilection towards... ssl key generation/signing/management is such a body of knowledge...
11:55 < majuk> I IS SPESCHUL MAJUK! I NO COMPUTAHS!
11:55 < majuk> ;P
11:55  * gladiatr chuckles
11:56 < majuk> I tried the bridging method first. Talk about disasters.
11:56 -!- Lenoob [~Lenoob@unaffiliated/lenoob] has joined #openvpn
11:56 < gladiatr> The first time I encountered the glories of actual tls spec compliant software was setting up tls negotiating between several hundred linux lab computers and an openldap server.  Those were frustrating times...
11:56 < Lenoob> !welcome
11:56 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:56 < Lenoob> !redirect
11:56 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
11:56 < aef> hi, is it possible to replace the current DNS server of a Windows XP client with a server pushed one? i doesn't seem to work in my case with push "dhcp-option DNS 1.2.3.4"
11:56 < gladiatr> majuk, Yeah.  If you need to bridge, it's always good to tackle that later
11:57 < Lenoob> !def&
11:57 < Lenoob> !def1
11:57 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
11:57 < majuk> gladiatr, Yea, I'll get there. One day.
11:57 < gladiatr> aef, does it show up under your tap driver when you run ipconfig from the cli?
11:57 < majuk> One glorious day!
11:57 < gladiatr> hehe
11:57 < gladiatr> aef, er... ipconfig /all
11:58 < aef> gladiatr: well yes, but is it used?
11:58 < gladiatr> aef, has it ever worked?
11:58 < aef> gladiatr: as the one of my ethernet device is still there
11:58 < gladiatr> aef, right.  Welcome to the world of windows networking :)  What version of Windows are you using?
11:58 < aef> XP
11:59 < gladiatr> k.  Hang on.  I need to spin up my xp vm.
12:00 < aef> i have to be sure the openvpn set dns server is used and no request leak into the regular one
12:00 < gladiatr> Okee doke.  Click... start -> control panel -> network settings -> advanced -> advanced settings.
12:01 < gladiatr> aef, make sure your vpn connection is at the top of that list
12:02 < aef> oh ok
12:02 < gladiatr> was it not at the top of the list?
12:02 < aef> so i have to be sure it's above my native ethernet?
12:02 < aef> yeah
12:02 < gladiatr> Yup.
12:02 < aef> well, thanks then
12:03 < gladiatr> This bit me about a month ago with a Vista machine.  Man... I wanted to eat a bunny raw after I figured that one out :)
12:03 < gladiatr> you're very welcome
12:08 < Lenoob> !ipforward
12:08 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
12:08 < Lenoob> !linipforward
12:08 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
12:09 < Lenoob> Where is sysctl.conf ?
12:11 < Lenoob> mmh i have found it
12:11 < Lenoob> but what i have to restart for apply this ?
12:12  * majuk cries
12:12 < majuk> gladiatr, Same error man. I must be doing something remarkably wrong.
12:12 < Janos> gladiatr: trying with my hook script, according to the man, the clients should use ipchange, and i don't see any variable which gives me the remote peer, i can access it with 'ip route get' but just wanted to make sure, there is no no variable with the remote peer ip right ? using 2.1_rc11
12:14 < Lenoob> !nat
12:14 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
12:14 < gladiatr> Lenoob, sysctl -p will re-read your sysctl.conf
12:14 < Lenoob> gladiatr: thanks
12:14 < gladiatr> Janos, you can get that from your ipp.txt file
12:15 < Lenoob> !linat
12:15 < Lenoob> !linnat
12:15 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
12:15 < gladiatr> majuk, hrm... you've made sure to blow away all your old certs and ca files and whatnot?
12:15 < majuk> gladiatr, Yup. Tell you what, I'm gonna go to lunch and start this over from scratch when I get back
12:15 < Lenoob> sorry for flood
12:15 < gladiatr> Lenoob, you can also always manually set any variables you want--just have to make sure /etc/sysctl.conf has them for the reboot--by using sysctl -w <variable>=<value>
12:16 < gladiatr> majuk, righto, sir.  
12:16 < gladiatr> Lenoob, no worries, man.  That's what vpnhelper is here for
12:17 < Janos> gladiatr: where can i find that ?
12:17 -!- alhadi [~thunderst@dxb-as73769.alshamil.net.ae] has joined #openvpn
12:18 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Read error: Operation timed out]
12:19 < Lenoob> !redirect
12:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
12:19 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:19 < Lenoob> !def1
12:19 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
12:21 < Lenoob> its dont work ...
12:21 < Lenoob> what i have to paste ? i can connect to the vpn but when i am on the vps i can't access the net
12:21 < |Mike|> pastie.org
12:22 < |Mike|> !tell Lenoob logs
12:22 < Lenoob> Ok
12:22 < Lenoob> in /etc/openvpn/openvpn-status.log ?
12:22 <@vpnHelper> RSS Update - forum: Login / Password authentication, using static key ? <http://forums.openvpn.net/topic7583.html>
12:23 < Lenoob> http://pastie.org/1518935
12:27 < Lenoob> |Mike|: you know what is the prob?
12:28 < |Mike|> hm?
12:28 < |Mike|> let me look
12:28 < Lenoob> ok
12:29 < Dougy> Lenoob: 
12:29 < Dougy> what OS is the server
12:29 < Lenoob> ubuntu 10.10 server
12:29 < Dougy> !linipforward
12:30 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
12:30 < Lenoob> i have st it to 1
12:30 < Lenoob> it *
12:30 < Lenoob> set *
12:30 < Dougy> if you are using def1, and can connec t to vpn, but not internet
12:30 < Dougy> then you are missing an iptables rule
12:30 < Lenoob> i dont have iptable
12:30 -!- tosse [tosse@tosse.pp.se] has joined #openvpn
12:30 < Dougy> you must
12:30 < Dougy> you have to run a rule for it to work
12:30 < Dougy> if you want to use def1
12:30 < Lenoob> I dont have iptables
12:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:31 < Lenoob> I have uninstalled it
12:31 < Lenoob> mmh
12:31 < Dougy> then reinstall it
12:31 < Dougy> or you're SOL
12:31 < Lenoob> SOL ?
12:31 < Dougy> shit out of luck
12:31 < tosse> can i use tls if i just use static ip's between the hosts? 
12:32 < Lenoob> I have it installed oO
12:32 < Lenoob> I dont want it !
12:32 < Dougy> then add the rule
12:32 < Dougy> if you are going to continue to grumble at me
12:32 < Dougy> then i won't help you
12:33 < Dougy> plain adn simple
12:33 < Lenoob> ok sorry
12:33 < Dougy> use iptables or you're shit out of luck with using def1
12:33 < Lenoob> 'off
12:33 < Dougy> that is the only way i've ever heard of
12:33 < Dougy> the masquerading rule is listed on the howto
12:33 < Dougy> !howto
12:33 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
12:34 -!- morbidwar [~ovidiu@78.96.23.179] has joined #openvpn
12:35 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
12:39 -!- jfkw [~jtk@216.115.1.60] has quit [Read error: No route to host]
12:39 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
12:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:48 < morbidwar> hello
12:48 -!- xindz`off is now known as xindz
12:49 < morbidwar> can somebody help me with one bridge-server?
12:51 -!- mant1s [mant1s@141.114.215.240] has joined #openvpn
12:51 -!- mant1s [mant1s@141.114.215.240] has quit [Changing host]
12:51 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
12:51 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
12:52 -!- Lenoob [~Lenoob@unaffiliated/lenoob] has left #openvpn ["WeeChat 0.3.5-dev"]
12:57 <@vpnHelper> RSS Update - forum: Can't find tap-win32 adapter <http://forums.openvpn.net/topic7584.html>
12:58 -!- tosse [tosse@tosse.pp.se] has left #openvpn []
12:58 < morbidwar> i have 3 computers. 1 the first is the router and the dhcpd (has 1 public ip 82.78.xxx.193 and 1 private 192.168.0.1 , 2 the second is the vpn server machine (that has 1 public ip 82.78.xxx.209 and 192.168.0.79), i setup my server with this configuration http://pastebin.com/PL8eE2gR but i cannot ping 192.168.0.1 or 192.168.0.2 or 192.168.0.5 (0.2 and 0.5 are server that are running)
13:00 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:14 -!- dazo is now known as dazo_afk
13:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
13:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:14 -!- WinstonSmith [~true@e178179017.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
13:18 -!- ikla [~lbz@c-98-245-144-60.hsd1.co.comcast.net] has quit [Read error: Connection reset by peer]
13:23 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
13:23 < majuk> gladiatr, alright, here we go again.
13:23 < majuk> *cue Bon Jovi*
13:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 250 seconds]
13:26 -!- morbidwar [~ovidiu@78.96.23.179] has quit [Remote host closed the connection]
13:30 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
13:31 < gladiatr> lol
13:32 < ecrist> I should get around to calculating the irc stats again some time
13:32 < ecrist> !irstats
13:32 < ecrist> !ircstats
13:32 <@vpnHelper> "ircstats" is (#1) 30-Day Stats: http://www.secure-computing.net/logs/openvpn-last30.html, or (#2) All-Time Stats: http://www.secure-computing.net/logs/openvpn.html
13:36 < gladiatr> !learn win-dns as From cmd.exe: if ipconfig /all shows the proper DND server adcdress assigned to the tap device...  Please choose !win-dns-xp or !win-dns-vista-7
13:36 <@vpnHelper> Joo got it.
13:36 < gladiatr> !learn win-dns-vista-7 as click start -> control panel -> network and sharing center -> change adapter settings -> <ALT> -> advanced -> advanced settings.  Make sure your VPN connection is at the top of the list
13:36 <@vpnHelper> Joo got it.
13:36 < gladiatr> !learn win-dns-xp as click start -> control panel -> network connections -> advanced -> advanced settings.  Make sure your VPN connection is at the top of the list.
13:36 <@vpnHelper> Joo got it.
13:37 < gladiatr> !win-dns
13:37 <@vpnHelper> "win-dns" is From cmd.exe: if ipconfig /all shows the proper DND server adcdress assigned to the tap device... Please choose !win-dns-xp or !win-dns-vista-7
13:37 < gladiatr> !learn win-dns as From cmd.exe: if ipconfig /all shows the proper DNS server adcdress assigned to the tap device...  Please choose !win-dns-xp or !win-dns-vista-7
13:37 <@vpnHelper> Joo got it.
13:37 < gladiatr> !win-dns
13:37 <@vpnHelper> "win-dns" is (#1) From cmd.exe: if ipconfig /all shows the proper DND server adcdress assigned to the tap device... Please choose !win-dns-xp or !win-dns-vista-7, or (#2) From cmd.exe: if ipconfig /all shows the proper DNS server adcdress assigned to the tap device... Please choose !win-dns-xp or !win-dns-vista-7
13:38 < gladiatr> rude.
13:38 < ecrist> rude?
13:38 < gladiatr> I was hoping for a replacement to fix my typo
13:38 < gladiatr> !unlearn win-dns
13:38 < gladiatr> heh
13:38 < ecrist> !forget win-dns
13:39 <@vpnHelper> Error: 2 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
13:39 < ecrist> !forget win-dns *
13:39 <@vpnHelper> Joo got it.
13:39 < gladiatr> excellent.  new bits of bot-speak
13:39 < gladiatr> !learn win-dns as From cmd.exe: if ipconfig /all shows the proper DNS server adcdress assigned to the tap device...  Please choose !win-dns-xp or !win-dns-vista-7
13:39 <@vpnHelper> Joo got it.
13:44 < majuk> gladiatr, k, so I got my keys.root generated including an intermediate vpnca.[key,crt] and the DH parameters.
13:44 < gladiatr> most excellent
13:44 < majuk> So now I initialize my vars.vpn, ./clean-all, then copy over vpnca.key and .crt, yes?
13:45 < majuk> Then server key, DH params and my clients?
13:45 < gladiatr> Yup.  Make sure you use the --server arg with the pkitool when generating your server key as well.  It's easy to forget
13:46 < majuk> Can do. Keep your fingers crossed.
13:51 -!- raidz [~Andrew@seance.openvpn.org] has joined #openvpn
13:51 -!- raidz [~Andrew@seance.openvpn.org] has quit [Changing host]
13:51 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has joined #openvpn
13:51 -!- mode/#openvpn [+o raidz] by ChanServ
13:53 -!- kerfe [~a@47.pool85-60-129.dynamic.orange.es] has joined #openvpn
13:56 -!- zeshoem [~mnathani@70.52.168.144] has quit []
14:07 -!- alhadi [~thunderst@dxb-as73769.alshamil.net.ae] has quit [Ping timeout: 240 seconds]
14:09 -!- WinstonSmith [~true@g225031254.adsl.alicedsl.de] has joined #openvpn
14:11 <@vpnHelper> RSS Update - forum: Can I use OpenVPN with a Windows Server domain? <http://forums.openvpn.net/topic7564.html#p9487>
14:22 < majuk> gladiatr, Well, ok, at least I got a DIFFERENT error this time. "unable to get local issuer certificate"
14:23 -!- SwK [~swk@freeswitch/developer/swk] has quit [Quit: This computer has gone to sleep]
14:25 -!- alhadi [~thunderst@92.96.221.97] has joined #openvpn
14:26 < gladiatr> majuk, did you put both CA certificates on the client system?
14:26 < majuk> gladiatr, HA, just doing that. :D
14:27 < gladiatr> most excellent
14:27 < majuk> Do I need to cat them together like you said?
14:27 < majuk> I assume so.
14:27 < majuk> Because you said iy
14:28 < majuk> VERIFY OK!!!
14:28 < majuk> gladiatr WINS!!!
14:29 < majuk> zomg I love you.
14:29 < gladiatr> woot!
14:29 < gladiatr> lol
14:29 < gladiatr> glad I could save you that particular headache
14:29 < jpalmer> ooh!  man love!   //*shields eyes*//
14:29  * gladiatr chuckles
14:29 < gladiatr> SOME THINGS CANNOT BE UNSEEN!
14:29 < majuk> Pffft, I could be a woman.
14:29 < majuk> Who are we kidding, there are no women on the internet.
14:29 < gladiatr> true that
14:30 < gladiatr> ha!  don't let the girls I know hear you say that :P 
14:30 < ecrist> http://img.photobucket.com/albums/v516/musiclord/hotchick1.jpg
14:30 < majuk> GIRL = Guy In Real Life
14:30 < ecrist> NSFW
14:30 < Essobi> hahahaha
14:30 < gladiatr> nice
14:30 < gladiatr> heh
14:30 < jpalmer> one of my alltime fav quotes.   "The internet. where boys are boys, men are boys, and 14 year old girls are FBI agents"
14:30 < majuk> ecrist, lol, our CEO is 10 feet over my shoulder, thanks hoss.
14:30 < majuk> :P
14:30 < majuk> jpalmer, Hahahahahaha
14:31 < Essobi> majuk: He said NSFW!
14:31 < majuk> Essobi, Pffft, after
14:31 < gladiatr> Man, the worst social frack up I ever made was looking confused when a mortally hot girl told me she was the president of the KU IEEE chapter
14:31 < gladiatr> needless to say, she didn't speak to me afterwards
14:31 < majuk> HAHAHAHAHA
14:31 < majuk> Wow.
14:32 < Essobi> gladiatr: hahaha
14:32 < gladiatr> I said, and I kid you not, "IEEE?"
14:32 < Essobi> Hahaha
14:32 < Essobi> Hormones shut down your brain?
14:32 < gladiatr> I was 23.  That was, thankfully, a long, long time ago.
14:32 < gladiatr> Essobi, big time
14:32 < Essobi> lol
14:32 < Essobi> nice
14:33 < gladiatr> Since then, when talking to females, I wait until their eyes start to glaze over before ratcheting down the technical detail of my convo
14:35 < Essobi> hehehe
14:35 < Essobi> Still single huh?
14:35 < Essobi> I kid..
14:36 < ecrist> sub singledom { foreach $girl (@girls){ print "$technical_crap"; continue; }; }
14:36 < gladiatr> hehe!  Nah.  Actually married a girl who did mainframe programming on wall street when she lived in NYC.  (she quit that and went into nursing, but by-far enough of a geek-chick :)
14:36 < gladiatr> lol
14:36  * Essobi high-fives gladiatr.
14:37 < Essobi> Got myself a geek-wife too. heh
14:37 < gladiatr> rawr
14:38 < gladiatr> The best of the best
14:38 < gladiatr> Yup.  Never was one to go in for those... individuals that didn't have enough going on in the brain to keep the temp above 0K
14:41  * ecrist wonders where the case of ear medicine was placed for todays nerd-fest.
14:42  * gladiatr chuckles
14:47 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.4]
14:54 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
14:57 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:59 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
15:02 < djgerm> can someone explain the difference between
15:02 < djgerm> push "redirect-gateway"
15:02 < djgerm> push "redirect-gateway def1 bypass-dhcp"
15:04 < Sintax`> ohhh well if it isnt jpalmer
15:11 -!- grapsus [~grapsus@acces1040.res.insa-lyon.fr] has joined #openvpn
15:12 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
15:19 < gladiatr> djgerm, redirect-gateway adds a host route to the openvpn server so you don't loose your local internet connectivity when the new default route (to the other end of the tunnel) is set to forward all of your internet traffic over the tunnel.   def1 creates the default route without destroying the original default route but sets it up such that it is picked first.  Apparently some client systems will puke if their default route is re
15:19 < gladiatr> moved and then replaced.
15:29 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
15:58 < majuk> Hmmm, ok, TLS handshake is failing, timing out. I have my local lan on 10.0.0.0/8 and my server on 10.1.0.0/16, but apparently they can't communicate? I mean, they *should* be able to route to each other, but here I am. :\
15:59 < majuk> fwiw, my client's ip is 10.1.1.246/8
15:59 < majuk> And my server's tun is indeed on 10.1.0.1/16
15:59 -!- WinstonSmith [~true@g225031254.adsl.alicedsl.de] has quit [Read error: Operation timed out]
16:00 < majuk> Oh, no, the tun address is on 10.1.0.1/32
16:00 < majuk> That doesn't seem right.
16:02 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
16:02 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
16:02 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:05 -!- mebus [~mebus@cl-42.cgn-01.de.sixxs.net] has joined #openvpn
16:05 < majuk> More specifically, server side I get "SSL3_GET_CLIENT_CERTIFICATE:no certificate returned"
16:05 < gladiatr> hrm...
16:05 < mebus> what does "TLS Error: local/remote TLS keys are out of sync: <ip>:50349" mean?
16:07 < gladiatr> did you generate a new dha key?
16:07 < gladiatr> if so make sure the new one is on the client as well
16:08 < mebus> gladiatr: talking to me?
16:08 < gladiatr> mebus, yeah.
16:09 < gladiatr> majuk, pastebin the log from the client-side.  verb 4 please
16:09 < mebus> gladiatr: no, I didn't but the server was restarted
16:10 < gladiatr> mebus, hrm... ok.  I googled the error--the only things I found seem to indicate that this error pops up when a vpn client connection is stuttering
16:10 < majuk> gladiatr rgr, 1 sec
16:10 < mebus> gladiatr: hm. 
16:11 < gladiatr> mebus, did you restart your client after the server was bounced?
16:17 < majuk> gladiatr You got PMs
16:17 < mebus> gladiatr: yes
16:17 -!- WinstonSmith [~true@dslb-088-074-012-179.pools.arcor-ip.net] has joined #openvpn
16:20 < mebus> gladiatr: there was a second stupid openvpn process running on the client
16:21 < gladiatr> doh!
16:26 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:27 -!- WinstonSmith [~true@dslb-088-074-012-179.pools.arcor-ip.net] has quit [Ping timeout: 240 seconds]
16:40 -!- xindz is now known as xindz`off
16:41 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Remote host closed the connection]
16:42 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
16:46 < majuk> HOT BABIES
16:47 -!- loa [~loa@46.147.10.68] has quit [Read error: Operation timed out]
16:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:49 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
16:50 < majuk> gladiatr is my hero. I just want you all to know that.
16:51 < gladiatr> lol
16:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
16:53 < ecrist> !donate
16:53 < ecrist> :)
16:53 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel., or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc., or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
16:53 < gladiatr> ^^ ^^ ^^
16:56 < majuk> I am all over it.
16:56 < gladiatr> rawr
16:56 < majuk> And all over YOU, stud.
16:56 < majuk> kk, gotta jet. See y'all tomorrow.
16:58 < gladiatr> later majuk
17:00 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
17:01 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
17:01 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
17:03 -!- Rolybrau [~Rolybrau@45-152.79-83.cust.bluewin.ch] has joined #openvpn
17:03 -!- Rolybrau [~Rolybrau@45-152.79-83.cust.bluewin.ch] has quit [Changing host]
17:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:16 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
17:22 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Operation timed out]
17:25 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 260 seconds]
17:36 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
17:38 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
17:38 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
17:41 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 265 seconds]
17:59 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
18:02 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has left #openvpn []
18:17 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 246 seconds]
18:18 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
18:20 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
18:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
18:54 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Read error: Connection reset by peer]
18:55 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
19:02 <@vpnHelper> RSS Update - forum: Multiple Server Profiles <http://forums.openvpn.net/topic7529.html#p9488>
19:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:18 -!- kerfe [~a@47.pool85-60-129.dynamic.orange.es] has quit [Quit: • IRcap • 8.6 •]
19:23 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Read error: Connection reset by peer]
19:31 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
19:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 255 seconds]
19:58 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
20:00 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Read error: Connection reset by peer]
20:21 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
20:24 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Read error: Connection reset by peer]
20:28 -!- zeshoem [~mnathani@70.52.168.144] has joined #openvpn
20:32 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Quit: Leaving]
20:34 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
20:34 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 255 seconds]
20:37 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 264 seconds]
20:39 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
20:42 < Dougy> so timewarner bought navisite
20:42 < Dougy> wow
20:45 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:47 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:47 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
20:51 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
20:59 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Ping timeout: 265 seconds]
21:00 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 255 seconds]
21:00 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
21:02 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
21:04 -!- master_of_master [~master_of@p57B53E80.dip.t-dialin.net] has quit [Read error: Operation timed out]
21:07 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Ping timeout: 265 seconds]
21:07 -!- master_of_master [~master_of@p57B560E6.dip.t-dialin.net] has joined #openvpn
21:11 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
21:11 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
21:11 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
21:33 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
21:51 -!- alhadi [~thunderst@92.96.221.97] has quit [Ping timeout: 240 seconds]
21:54 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Ping timeout: 240 seconds]
21:55 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
22:01 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:09 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Ping timeout: 240 seconds]
22:13 <@vpnHelper> RSS Update - forum: Certificate Creation Errors: build-ca <http://forums.openvpn.net/topic7585.html>
22:18 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
22:20 -!- kentr [~Kent@c-76-102-121-47.hsd1.ca.comcast.net] has joined #openvpn
22:20 < kentr> Anyone willing to help with a server config?
22:21 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
22:33 -!- bba [~bba@93.1.40.113] has joined #openvpn
22:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
22:43 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Read error: Operation timed out]
22:47 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
22:59 -!- kentr [~Kent@c-76-102-121-47.hsd1.ca.comcast.net] has quit [Quit: kentr]
23:12 < Sintax`> im sure they might be if you continue
23:31 -!- Guest45148 [~Geek@41.141.252.98] has joined #openvpn
23:33 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 245 seconds]
23:48 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:55 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
--- Day changed Wed Feb 02 2011
00:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 255 seconds]
00:11 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
00:12 < ecrist> http://tech.slashdot.org/story/11/02/01/2314252/Comcast-Activates-IPv6-Trial-Users
00:12 <@vpnHelper> Title: Comcast Activates IPv6 Trial Users - Slashdot (at tech.slashdot.org)
00:25 -!- trentster [~trentster@202-89-187-3.static.dsl.amnet.net.au] has joined #openvpn
00:25 -!- Janos [~Janos@190.10.52.113] has quit [Remote host closed the connection]
00:26 < trentster> Hey all. I am having a hard time trying to revoke a certificate for a particular user. all other revocations work perfectly. This user when I try and revoke I get this error "ERROR:name does not match"  Please could someone help as I badly need to revoke this user...
00:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
00:42 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
00:42 < trentster> anyone?
01:28 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
01:31 <@vpnHelper> RSS Update - forum: Can't find tap-win32 adapter <http://forums.openvpn.net/topic7584.html#p9490>
01:33 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:37 <@vpnHelper> RSS Update - forum: Login / Password authentication, using static key ? <http://forums.openvpn.net/topic7583.html#p9491>
01:42 -!- trentster [~trentster@202-89-187-3.static.dsl.amnet.net.au] has quit [Quit: trentster]
01:48 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 255 seconds]
01:51 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
01:53 <@vpnHelper> RSS Update - forum: 2 VPN connections at once (Different browsers) <http://forums.openvpn.net/topic7586.html>
02:00 <@vpnHelper> RSS Update - forum: 2 VPN connections at once (Different browsers) <http://forums.openvpn.net/topic7586.html#p9493>
02:02 -!- Guest45148 [~Geek@41.141.252.98] has left #openvpn []
02:02 -!- Guest45148 [~Geek@41.141.252.98] has joined #openvpn
02:04 -!- Guest45148 [~Geek@41.141.252.98] has quit [Quit: Sayaunara ^_^]
02:05 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
02:12 <@vpnHelper> RSS Update - forum: Certificate Creation Errors: build-ca <http://forums.openvpn.net/topic7585.html#p9494>
02:30 <@vpnHelper> RSS Update - forum: iptables config for Openvpn <http://forums.openvpn.net/topic7577.html#p9495>
02:42 -!- EugenMayer [~eugen@frbg-5d84f4ae.pool.mediaWays.net] has joined #openvpn
02:42 -!- alhadi [~thunderst@92.96.221.97] has joined #openvpn
02:43 < EugenMayer> Hello
02:43 < alhadi> Hello
02:44 < EugenMayer> When i traceroute the hops to a client in the VPN, i only get * * * .. all the time. When i ping, it takes ~5 seconds before the first ping arrives ( while the latency is 40ms ). Is it to be expected that i have loops in my routing?
02:45 < EugenMayer> I dont push any  routes, but iam as a client, including the client i ping - both connected to 3 different VPN networks ( 10.7 10.8 10.9. 10.6 )
02:45 < EugenMayer> All networks are hosted on one machine, 4 different ports ofc
02:48 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9496>
02:48 < EugenMayer> what i wonder about is this http://pastebin.com/5Jv51HF8
02:48 < EugenMayer> why all routes are going to 178.1 ? I would have expected that 10.8.0.0 is routed through 10.8.0.1 and so forth
02:59 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:01 -!- silverraindog [~angus@host86-135-91-53.range86-135.btcentralplus.com] has quit [Remote host closed the connection]
03:04 -!- xxtjaxx [~andreas@kde/developer/marschke] has joined #openvpn
03:05 -!- jmm_ [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
03:06 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
03:11 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:13 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has joined #openvpn
03:13 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has quit [Changing host]
03:13 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:15 < Bushmills> what route would you like a packet, destined to, say, 10.200.1.1, take?
03:16 -!- barbosa [~barbosa@189.27.121.69.dynamic.adsl.gvt.net.br] has joined #openvpn
03:29 -!- dazo_afk is now known as dazo
03:37 < renihs> Bushmills, if no specific route, the default route? :)
03:37 < renihs> with that information treshold, the question is pointless
03:44 -!- WinstonSmith [~true@g231216221.adsl.alicedsl.de] has joined #openvpn
03:50 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
03:53 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
03:55 < Bushmills> renihs: read up in log. my question was a reaction to a question by somebody else
03:56 < Bushmills> as such, it is not pointless, and the additional information can be extracted from context
03:57 < renihs> i scrolled up like 3 pages (1 day ago)
03:57 < renihs> cant find anything but whatever :)
03:57 < renihs> maybe we should starting to distribute crystal spheres
03:57 < Bushmills> http://scarydevilmonastery.net/snap/1296640636043997506d.png
03:58 < renihs> you aere kiddin right?
03:58 < renihs> :)
03:59 < renihs> maybe direkt the question to the person you are anwering, for everybody else, this question just looks like you are throwing it in here
04:01 < Bushmills> less than half an hour latency, no other communication in betrween? what is so hard about connecting my line to the previous limnes?
04:01 < Bushmills> grr.. typos
04:02 < IRQ> Hi
04:02 < IRQ> I am searching for the OpenVPN Sys Req (50-80 users).... Do you know?
04:02 <@vpnHelper> RSS Update - forum: 2 VPN connections at once (Different browsers) <http://forums.openvpn.net/topic7586.html#p9497>
04:07 < Bushmills> IRQ: anything above 386SX, with more than 128 MiB (depending on OS) should do
04:09 < IRQ> Bushmills, so a DELL 1950 with dualcore and 2gb ram should do?
04:09 < Bushmills> perfect 
04:09 < IRQ> Bushmills, Thank You
04:09 < IRQ> and for 100+ users..?
04:10 < Bushmills> fromon a certain number of users, i'd think of running more than one openvpn server.
04:10 < Bushmills> openvpn doesn't scale too well to larger numbers of users
04:11 < Bushmills> at about 100, many would probably draw that practical limit
04:13 < IRQ> ok
04:13 < janjust> I know of people with OpenVPN setups serving thousands of users (just not all at once)
04:14 < IRQ> Thank You Bushmills 
04:14 < janjust> it depends on the amount of client
04:14 < janjust> +traffic
04:16 -!- twister004 [~chatzilla@59.90.34.167] has quit [Read error: Connection reset by peer]
04:17 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:17 < IRQ> Thank You janjust 
04:20 <@vpnHelper> RSS Update - forum: 2 VPN connections at once (Different browsers) <http://forums.openvpn.net/topic7586.html#p9498>
04:26 -!- iggy_ [~iggy@fw-1.dby1.griffin.com] has joined #openvpn
04:26 < iggy_> hi there. I'm having a problem with a vista box connecting to an openvpn server. It connects, gets a default route from openvpn but a traceroute fails with   1  Transmit error: code 1231.
04:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
04:26 < iggy_> anyone seen this before?
04:28 < iggy_> !elcome
04:28 < iggy_> !welcome
04:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:28 < iggy_> !goal
04:28 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:34 -!- SOG [~SOG@183.1.144.219] has joined #openvpn
04:38 < Bushmills> !winroute
04:38 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
04:38 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
04:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:43 -!- WinstonSmith [~true@g231216221.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
04:43 <@vpnHelper> RSS Update - forum: Login / Password authentication, using static key ? <http://forums.openvpn.net/topic7583.html#p9499>
04:47 < janjust> iggy: try pinging the VPN server IP first
04:47 < janjust> does that work?
04:50 <@vpnHelper> RSS Update - forum: Login / Password authentication, using static key ? <http://forums.openvpn.net/topic7583.html#p9500>
04:52 < iggy_> erm.. not sure the client is in China and I'm in the uk..
04:53 < iggy_> which address should I be pinging? the default gateway?
04:53 -!- iggy_ is now known as iggy_work
04:53 < iggy_work> or the .1 server address?
04:54 < janjust> the .1 server address
04:54 < janjust> first make sure the VPN is functional before trying to set default routes
04:55 < iggy_work> ok. will come back when I have a response
04:55 < iggy_work> thanks
04:55 < janjust> no prob
04:55 -!- iggy_work [~iggy@fw-1.dby1.griffin.com] has left #openvpn ["Ex-Chat"]
05:02 <@vpnHelper> RSS Update - forum: Login / Password authentication, using static key ? <http://forums.openvpn.net/topic7583.html#p9501>
05:02 < Bushmills> it's a long way to china
05:03 -!- WinstonSmith [~true@g225028160.adsl.alicedsl.de] has joined #openvpn
05:08 <@vpnHelper> RSS Update - forum: Login / Password authentication, using static key ? <http://forums.openvpn.net/topic7583.html#p9502>
05:09 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 245 seconds]
05:45 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:47 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
06:19 < ecrist> good morning.
06:27 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
06:27 -!- barbosa [~barbosa@189.27.121.69.dynamic.adsl.gvt.net.br] has quit [Ping timeout: 240 seconds]
06:27 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 255 seconds]
06:30 < krzee> good morning!
06:32 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has joined #openvpn
06:40 < reiffert> moin :)
06:40 <@vpnHelper> RSS Update - forum: CND script OpenVpn <http://forums.openvpn.net/topic7587.html>
06:46 <@vpnHelper> RSS Update - forum: CND script OpenVpn <http://forums.openvpn.net/topic7587.html#p9505>
07:02 -!- alhadi [~thunderst@92.96.221.97] has quit [Quit: alhadi]
07:03 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
07:16 -!- SOG [~SOG@183.1.144.219] has quit [Remote host closed the connection]
07:17 -!- SOG [~SOG@183.1.144.219] has joined #openvpn
07:18 -!- SOG [~SOG@183.1.144.219] has quit [Client Quit]
07:19 -!- teddz [~teddz@dtmd-4d0bcf1d.pool.mediaWays.net] has joined #openvpn
07:21 -!- _zero__ [~zero@noc.toile-libre.net] has joined #openvpn
07:22 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
07:26 -!- montana [~montana@212.117.173.72] has joined #openvpn
07:28 < montana> Hi, I am running openvpn on Windows server 2008, the beta. Im having some stability problems with clients disconnecting, not being able to connect from times to time. Would this likely be a problem of using the beta? 
07:28 <@vpnHelper> RSS Update - forum: 2 VPN connections at once (Different browsers) <http://forums.openvpn.net/topic7586.html#p9506>
07:28 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has quit [Ping timeout: 264 seconds]
07:31 < |Mike|> !tell montana [logs]
07:35 <@vpnHelper> RSS Update - forum: CND script OpenVpn <http://forums.openvpn.net/topic7587.html#p9507>
07:35 < ecrist> montana: it's possible, but we'd need to know something more empirical
07:36 < ecrist> also, despite the beta tag, we've hardly heard any problems with the beta
07:36 -!- EugenMayer1 [~eugen@frbg-5f731637.pool.mediaWays.net] has joined #openvpn
07:36 -!- EugenMayer [~eugen@frbg-5d84f4ae.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
07:36 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 255 seconds]
07:37 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
07:39 -!- grapsus [~grapsus@acces1040.res.insa-lyon.fr] has quit [Ping timeout: 265 seconds]
07:44 -!- grapsus [~grapsus@acces1040.res.insa-lyon.fr] has joined #openvpn
07:49 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
07:49 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
07:49 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
07:53 <@vpnHelper> RSS Update - forum: CND script OpenVpn <http://forums.openvpn.net/topic7587.html#p9508>
08:05 <@vpnHelper> RSS Update - forum: OpenVPN on a Nokia phone with Symbian^3 <http://forums.openvpn.net/topic7588.html>
08:11 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 245 seconds]
08:13 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
08:13 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
08:13 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:24 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
08:35 -!- pif [~ldm@zenon.apartia.fr] has joined #openvpn
08:36 < pif> hi, is an ovpn tunnel more,less or as efficient as a ssh tunnel?
08:38 < gladiatr> more efficient
08:38 < pif> how?
08:39 < gladiatr> SSL/TLS uses asymmetric crytop to establish symmetric keys which are renewed periodically.  Symmetric key convos are less taxing.  SSH uses asymmetric crypto for everything.
08:40 < gladiatr> And that's about as technical as I can get on that subject :)
08:40 < pif> hmm, good point
08:41 < gladiatr> ssh vpn's are still useful for foxhole type work, but for a permanent/semi-permanent connection, I use OpenVPN <insert tooth gleam>
08:42 < pif> foxhole? don't know that expression
08:42 < pif> you mean quick'n'dirty ? :) 
08:42 < gladiatr> http://en.wikipedia.org/wiki/Foxhole :)
08:42 <@vpnHelper> Title: Defensive fighting position - Wikipedia, the free encyclopedia (at en.wikipedia.org)
08:42 < gladiatr> yar
08:43 < pif> right
08:44 < pif> plus, ovpn encapsulated in udp takes less bandwidht that tcp-only ssh?
08:45 < pif> or not ?
08:48 < ecrist> yes
08:48 < ecrist> tcp requires extra verificiation of packets, whereas udp is a 'best-effort' service
08:48 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Read error: Operation timed out]
08:49 < pif> and 'verification' is already done at the ovpn level (inside the tunnel)?
08:51 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:53 -!- barbosa [~barbosa@189.27.121.69.dynamic.adsl.gvt.net.br] has joined #openvpn
08:59 < ecrist> pif: essentially, yes
08:59 < ecrist> either a packet decrypts, or not
09:00 < ecrist> not sense it dealing with packets that don't decrypt
09:00 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
09:01 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 255 seconds]
09:01 -!- xindz`off is now known as xindz
09:05 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:05 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
09:08 -!- teddz [~teddz@dtmd-4d0bcf1d.pool.mediaWays.net] has quit [Quit: Ex-Chat]
09:11 <@vpnHelper> RSS Update - forum: CND script OpenVpn <http://forums.openvpn.net/topic7587.html#p9510>
09:14 -!- kerfe [~a@47.pool85-60-129.dynamic.orange.es] has joined #openvpn
09:19 -!- threedaymonk [~threedaym@surimi.vm.bytemark.co.uk] has quit [Ping timeout: 260 seconds]
09:19 -!- threedaymonk [~threedaym@surimi.vm.bytemark.co.uk] has joined #openvpn
09:23 <@vpnHelper> RSS Update - forum: 3g works router adsl don´t <http://forums.openvpn.net/topic7428.html#p9511> || WinXP installation <http://forums.openvpn.net/topic7589.html>
09:25 -!- albech [~thomas@124.157.245.126] has joined #openvpn
09:29 <@vpnHelper> RSS Update - forum: Multiple Server Profiles <http://forums.openvpn.net/topic7529.html#p9513> || TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9512>
09:35 <@vpnHelper> RSS Update - forum: OpenVPN connection does not always work for some clients <http://forums.openvpn.net/topic7526.html#p9514>
09:38 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
09:51 -!- panfist [~stachursk@c-76-98-78-178.hsd1.nj.comcast.net] has quit [Ping timeout: 240 seconds]
09:57 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:58 < majuk> !donate
09:58 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel., or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc., or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
09:58 -!- panfist [~stachursk@c-76-98-75-186.hsd1.nj.comcast.net] has joined #openvpn
09:59 < majuk> Well I suppose I'm setting up a PayPal account today as well, then.
10:04 -!- alhadi [~thunderst@188.95.51.233] has joined #openvpn
10:09 < ecrist> iirc you don't need an actual paypal account to pay someone with paypal
10:09 -!- rot13 [~var@unaffiliated/rot13] has quit [Ping timeout: 240 seconds]
10:11 < majuk> ecrist, Oh ho? Well then, maybe I won't.
10:11 < majuk> Set up an account.
10:11 < majuk> I will give moneys.
10:13 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
10:14 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has joined #openvpn
10:19 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Read error: Connection reset by peer]
10:19 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
10:22 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:23 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
10:25 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
10:30 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 265 seconds]
10:30 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has quit [Remote host closed the connection]
10:30 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
10:32 < gladiatr> indeed!  pizza and beer for the dev team!  (or borscht and vodka (such as the case may be) :D)
10:34 < majuk> Damn, how much do I have to donate to get in on that party?!
10:34 < majuk> :D
10:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 265 seconds]
10:34 < gladiatr> hehe
10:35 < gladiatr> Master the ancient art of network crypto coding in C
10:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:36 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 260 seconds]
10:36 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
10:36 -!- jesperj [~jesperj@unaffiliated/jesperj] has joined #openvpn
10:38 -!- barbosa [~barbosa@189.27.121.69.dynamic.adsl.gvt.net.br] has left #openvpn ["Fui embora"]
10:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:41 -!- ixiion [768fe6a9@gateway/web/freenode/ip.118.143.230.169] has joined #openvpn
10:41 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 264 seconds]
10:42 < ixiion> !welcome
10:42 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:42 < ixiion> !goal
10:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:42 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
10:44 < jesperj> Am I the only one who finds it strange that the Wikipedia entry for "IPv6" (http://en.wikipedia.org/wiki/IPv6) does not have anything written about the privacy issue of that the IPv6 IP (often) includes the host MAC address (and that for example privacy/hiding your IP via VPN has problems with IPv6, and the aspect that when IPv6 becomes standard, this will affect everyone who uses VPN for example)?
10:44 <@vpnHelper> Title: IPv6 - Wikipedia, the free encyclopedia (at en.wikipedia.org)
10:44 < jesperj> (Or have I misunderstood the Ipv6 / VPN issue since this info is not included in the Wikipedia article?)
10:45 <@dazo> why is IPv6 + VPN a problem?
10:46 < jesperj> google "ipv6 vpn privacy"
10:46 -!- ixiion [768fe6a9@gateway/web/freenode/ip.118.143.230.169] has quit [Ping timeout: 240 seconds]
10:46 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
10:47 <@dazo> jesperj: you mean the "Huge privacy flaw found in VPN systems" by Wired UK?
10:47 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
10:48 < jesperj> dazo: That is one example of a website that highlights it yes
10:49 <@dazo> jesperj: that article is quite clueless and tabloid ... you have something called IPv6 privacy extension, which takes care of that
10:49 <@dazo> it basically changes your IPv6 address regularly ... and is even enabled by default on Windows, iirc
10:49 <@dazo> in Linux and probably other *nix based systems IPv6 privacy extensions needs to be enabled 
10:51 <@dazo> however, if you use IPv6 via a OpenVPN based VPN ... you'll get a separate IPv6 segment, with different addresses anyway
10:52 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
10:52 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 245 seconds]
10:53 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
10:53 < jesperj> dazo: so, with IPv6 privacy extensions, the IP adress (even though it getting changed regularly) doesn't have the problem of the last part being made up from the host MAC then?
10:54 < jesperj> if it just changes the IP and keeps the MAC part, the problem still exists if I understand it correctly
10:54 <@dazo> jesperj: nope, it will use random values instead of the MAC address
10:54 < jesperj> ok
10:54 <@dazo> you cannot change the IPv6 prefix ... then the traffic would never go back to you, so you can only change what's available inside your IPv6 prefix
10:55 < jesperj> Do you mean prefix or suffix? I thought the MAC part was used for the last bit of the IP
10:55 <@dazo> if you have a /64 based prefix ... that means you have 64 bits to modify ... which is usually mostly common (ie. the smallest IPv6 subnet)
10:56 <@dazo> IPv6 prefix is the beginning of the address ... f.ex. 2001:abcd:1234::/xx
10:56 -!- ixiion [768fe6a9@gateway/web/freenode/ip.118.143.230.169] has joined #openvpn
10:57 <@dazo> the IPv6 prefix is given out by your ISP ... and is usually a /48, /56 or in some cases a /64 prefix
10:57 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 246 seconds]
10:58 <@dazo> with /48 ... you can setup 64K of /64 subnets ... with /56 you get 256 /64 subnets ... and /64 is a single /64 subnet
10:58 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
10:59 <@dazo> rot13: connection issues?
11:03 < ixiion> hello
11:03 < ixiion> back
11:03 < ixiion> i have a vpn outside the counrty
11:03 < ixiion> as i said iam in B*rma
11:03 < ixiion> i got it already to work can to connect into the real internet
11:04 < ixiion> but not iam on another place
11:04 < ixiion> and here they have a transparent proxy
11:04 < ixiion> i dont know how to configure *penvpn to use the the ptransparent proxy
11:04 <@dazo> jesperj: this is actually a pretty sane discussion ... http://www.linuxquestions.org/questions/general-10/ipv6-privacy-793260/
11:04 <@vpnHelper> Title: IPv6 privacy (at www.linuxquestions.org)
11:05 < ixiion> before i used it with a fix proxy ip adess to proxy:8080 wich worked fine
11:06 < ixiion> now i dont have any proxy ip adress to connect throught
11:06 < ixiion> through
11:06 < ixiion> how to configure the vpn to deal with the transparent proxy?
11:06 < ixiion> can i find out the transparent proxy ip and port and set this into to configuration?
11:07 <@dazo> ixiion: do you want to establish your OpenVPN connection via that proxy?  Or do you want your browser to connect to the proxy *via* OpenVPN?
11:08 < jesperj> Thanks dazo. Will check it out. I am curious to find if someone else has mentioned the privacy extentions and how they would solve this problem of the ipv6 part, in some of the discussions online.
11:08 -!- SmokeyD [~SmokeyD@f12099.upc-f.chello.nl] has joined #openvpn
11:08 < ixiion> this is a goverment controlled proxy
11:08 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
11:08 < ixiion> you can not get into the free internet without using proxys over here
11:08 < jesperj> I think this Criticism/Speculation/whatever shuld be added to the Wikipedia entry, with facts that sorts the situation out,
11:09 <@dazo> jesperj: agreed
11:09 < ixiion> that what iam using the openvpn for
11:09 <@dazo> ixiion: We understand your reason for using openvpn ... this use case isn't unusual in some countries at all
11:09 < ixiion> yes okay
11:10 < SmokeyD> hey everyone. I have a windows XP openvpn client machine where the TAP-Win32 device doesn't seem to want to set the ip address sent by the openvpn server
11:10 < SmokeyD> the client log says Notified TAP-Win32 driver to set a DHCP IP/Netmask of ... on interface ...
11:11 < ixiion> when i was in another city  i had to setup openvpn to use 203.81.64.37:8080 to connect though
11:11 < ixiion> and then it worked fine
11:11 <@dazo> ixiion: but to make OpenVPN connect via an external proxy, you need to look up --http-proxy or --socks-proxy 
11:11 <@dazo> in the openvpn man page
11:11 < SmokeyD> and then it logs  TEST ROUTER:... and Route: Waiting for TUN/TAP interface to come up
11:11 <@dazo> !man
11:11 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
11:11 < ixiion> but now i dont have to setup any proy settings over here
11:11 < ixiion> its a tcp only proxy
11:12 < SmokeyD> it logs those lines for quite a while. And in the mean time the TAP interface does come up if I look in windows' network connections, but it doesn't have an IP address
11:12 <@dazo> ixiion: and then you need to look up --redirect-gateway in the man page ... which will redirect all your internet traffic via OpenVPN
11:12 < ixiion> !
11:12 < ixiion> i can connect to the openvpn server
11:13 < ixiion> and i can use the internet via the openvpn server
11:13 < ixiion> i have a client sde porblem
11:13 < ixiion> client side problem
11:13 < ixiion> currently at the place where iam i dont have any proxy ip 
11:14 < ixiion> i think it is a transparent proxy
11:14 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
11:14 < ixiion> the os uses this configuration automatically
11:14 < ixiion> but i have no clue how to get openvpn to use the transparent proxy settings
11:15 < ixiion> or atleast to find out what the hard values of the transparten proxy are
11:15 <@dazo> ixiion: I'm sorry, if it's transparent in the OS ... then I have no idea how OpenVPN would detect that or not
11:15 < ixiion> it obviosly does not detect it
11:16 < ixiion> thats why i get no connection
11:16 < ixiion> its not in the OS
11:16 < ixiion> the OS GET the proxy settings from the transparent proxy i think - like automagic configuration
11:17 < ixiion> i don not realy understand how trnasparent proxys are working -  soory
11:18 <@dazo> ixiion: this is quite outside OpenVPN as a topic ... so I'm sorry, most people here probably can't help you too much
11:19 <@dazo> however ... a transparent proxy is usually completely transparent ... which means, you shouldn't notice it ... all the proxy stuff happens on a router or gateway, outside of your local computer
11:20 <@dazo> auto-configured proxy is something completely different, where a server will instruct a client/computer how to use the proxy - if that computer can understand such "instructions"
11:20 < ixiion> yeah that how a regual proxy can working usally too
11:20 < ixiion> outside of my computer ...
11:20 <@dazo> in a proper transparent proxy solution ... there is nothing you can do yourself to avoid it, it's out your control
11:23 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
11:24 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
11:24 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
11:24 < bo_root> my servers private ip is x.x.1.125 client gets x.x.0.6, i can ping him, he can't ping me, what's wrong?
11:26 < gladiatr> firewall
11:26 < ecrist> !client-to-client
11:26 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other clients
11:26 < ecrist> perhaps
11:27 < bo_root> i uncommened client-to-client
11:27 < gladiatr> *cough* (firewall)
11:27 < bo_root> i am not using firewall on my server
11:28 < gladiatr> right.  But you said the server can't ping you.
11:28 < gladiatr> server=he?
11:28 < bo_root> i am the server, i can ping the client, client cant ping the server
11:28 < jesperj> dazo: http://torrentfreak.com/huge-security-flaw-makes-vpns-useless-for-bittorrent-100617/
11:28 <@vpnHelper> Title: Huge Security Flaw Makes VPNs Useless for BitTorrent | TorrentFreak (at torrentfreak.com)
11:28 < gladiatr> ahh
11:28 < jesperj> The comments are most interesting
11:29 < bo_root> shouldn't client also get adress like x.x.1.x
11:29 < gladiatr> jesperj, generically lumping VPNs (all of them) in with pptp is like lumping all men with beards in with Charlie Manson :P
11:30 < gladiatr> The client should be getting an address out of whatever pool is designated in the server's openvpn config
11:30 < jesperj> It would be interesting to setup a lab for this using virtual machines and virtual networks, simulating the isp, the user client, the bittorrent tracker and the evesdropper/IP sniffer user
11:30 < bo_root> ok i get that, but is that relevant or not, server to have x.x.1.x and client x.x.0.x
11:31 <@dazo> jesperj: geee .... 
11:31 < gladiatr> bo_root, what OS are you running?
11:31 < bo_root> FreeBSD
11:31 < ecrist> bo_root++
11:31 < gladiatr> lol
11:31 < gladiatr> what's the output of: sysctl -a |grep net.inet.ip.forwarding?
11:32 < bo_root> 0
11:32 < ecrist> !configs
11:32 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
11:32 < gladiatr> bo_root, you're fired
11:32 < gladiatr> bo_root, sysctl -w net.inet.ip.forwarding=1
11:33 < bo_root> ok let me try now
11:33 < gladiatr> and set GATEWAY_ENABLE=YES in /etc/rc.conf
11:33 < jesperj> gladiatr: I don't know enough about the technicalities really but, besides pptp being affected, it is not clear to me at least yet that the IP privacy leakage does not concern other VPN methods than pptp, nor if the core of the problem is with ipv6, certain VPN methods, a  combination, or what.
11:33 <@dazo> jesperj: I'm using openvpn to get IPv6 connectivity at work (we only have IPv4 out of the building) ... and in OpenVPN I have defined a separate /64 net for IPv6 via OpenVPN .... and it gets a pretty simple IP address ..... 2001:abcd:1234::1:0/64 
11:33 < bo_root> ok, tnx
11:33 < gladiatr> np
11:34 < jesperj> dazo: What did you mean with "gee ....." in this case?
11:34 < bo_root> brb
11:34 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
11:34 <@dazo> jesperj: gee ... as in clueless user comments ... and the very first comment said it all :)   "I think half of the readers are running around yelling "OH FUCK FUCK " and burning their hardrives while looking at their street behind their blinds..."
11:34 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 255 seconds]
11:35 <@dazo> that comment is the most wise comment I noticed :)
11:36 < jesperj> dazo: Oh... lol. Right. But scrolling down there are many comments worth reading despite the garbage comments
11:37 < gladiatr> dazo, I dunno, man.  I kinda liked the beavis and butthead reference...
11:37 <@dazo> gladiatr: heh ... yeah, there are more good ones in between ... but it's a lot of garbage in between
11:37 -!- EugenMayer1 [~eugen@frbg-5f731637.pool.mediaWays.net] has quit [Quit: Leaving.]
11:37 < jesperj> here is one fragment of a comment for example : "However i don’t see why translating IPv6 to IPv4 should expose the real address. Doesn’t happen on IPv4 NAT in your modem/router. I can only guess #65 is right that its a M$ only problem (as usual) by sending non-requiered information"
11:39 < jesperj> "Huge Security Flaw Makes VPNs Useless for BitTorrent IF YOU USE ipv6 just disable or uninstall ipv6 and no problems." < These "just disable ipv6"  comments are stupid since ipv6 will become standard.
11:39 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has joined #openvpn
11:39 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
11:40 <@dazo> jesperj: nah ... I like them!   Then the silly users can use IPv4 as much as they want, live in their own little closed bubble ... and the rest, which are the clever ones, can live in peace :-P
11:40 <@dazo> and as the clever ones will only be available in IPv6 ... they won't get these questions like "Hey, my Internet doesn't work any more!?!"
11:41 < jesperj> "I mean, if you are running IPv6 over IPv4 in plaintext (like is the norm until native IPv6 support takes over), then of course the IPv6 connections are done outside the VPN."
11:42  * dazo wonders if IPv6 will turn out to become Darwins theory in the computer age ... survival of the fittest in practise :)
11:42 < bo_root> gladiatr: client can get to my pc using address 172.30.0.1, is that right or it should also be able to access it from my 172.30.1.125
11:43 <@dazo> jesperj: I think I lost track of what that guy is trying to say .... security is not related to where the traffic goes ... but that what content you send away is secured before it is sent out
11:43 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
11:44 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
11:45 <@dazo> oh man, this comment thread is just full of crap :)
11:45 < jesperj> heh
11:46 < jesperj> yeah I can't sort out what is relevant, worth checking out further, and what seems plausible
11:46 < jesperj> lots of possibly contradicting statements it seems
11:47 -!- toortog [nesm6@38.111.17.107] has joined #openvpn
11:48 <@dazo> jesperj: yeah ... clueless + panic mode ... and you get such comments
11:49 <@dazo> "So is using ipv6 on a Mac effected or is this just a Microsoft problem?" ... lol
11:49 < jesperj> I need to go afk. I'll bbl and hope to sort out what the deal really is with that stuff. ttyl.
11:49 < jesperj> heh
11:49 < jesperj> :)
11:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:50 < jesperj> "It is only a problem if you got one of those old  imacs with half-transparent cases. Opaque cases are fine..."
11:50 < jesperj> ;)
11:51 <@dazo> lol
11:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:55 -!- mete [~metefr@84.200.12.194] has joined #openvpn
11:56 < ecrist> too bad I'm lazy, and this is IRC instead of jabber/XMPP
11:56 < ecrist> I'm just finishing up a re-factor of our jabber RSS bot for $job
11:57 < ecrist> I do plan on releasing the code publicly, though
12:00 < krzee> cool what does he do?
12:00 <@dazo> ecrist: a jabber openvpn channel could be cool :)
12:01  * dazo should probably check out jabber more
12:07 -!- ixiion [768fe6a9@gateway/web/freenode/ip.118.143.230.169] has quit [Ping timeout: 240 seconds]
12:08 <@dazo> lol ..... An IPv4 address space walks into a bar. He says to the bartender,"A strong CIDR please. I'm exhausted."
12:08 < ecrist> krzee: give me a bit, I'll publish the source
12:08 <@dazo> (might be old though)
12:09 < ecrist> dazo: I posted that in here last week.
12:09 < ecrist> I still lol'd
12:09 <@dazo> ahh :)
12:11 < ecrist> krzee: so far, parses RSS feeds and formats them.
12:11 < ecrist> and it uses a 'real' config file now, which it didn't used to do
12:14 < gladiatr> because if its not hard-coded in a struct it's not l33t? :D
12:17 < ecrist> gladiatr: for ~4 years, our jabber/irc bot was 100% hard-coded
12:17 < ecrist> we've been making lots of changes lately, adding RSS feeds, removing RSS feeds, etc etc, so I wrote it to include Config::Auto
12:18 < ecrist> which is pretty nice, tbh
12:19 < ecrist> krzee: https://www.secure-computing.net/trac/browser/trunk/sphynx
12:19 <@vpnHelper> Title: sphynx in trunk – SCN Open Source (at www.secure-computing.net)
12:19 < ecrist> sphynx2 is the actual main program
12:24 -!- zhorX [~happyface@warp.skyhook.ca] has joined #openvpn
12:24 < zhorX> !welcome
12:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:25 < zhorX> !goal
12:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:27 -!- SmokeyD [~SmokeyD@f12099.upc-f.chello.nl] has quit [Quit: Ex-Chat]
12:29 -!- rawDawg [~rawdawg@cpe-65-25-121-235.neo.res.rr.com] has joined #openvpn
12:30 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:30 < zhorX> Hello, I've got openvpn running on something like 300 boxes running linux. Nothing fancy, just so we can access the box behind a nat via ssh. Lately, some 10 boxes are creating a "MULTI: bad source address" and I see the LAN address of the box appear in the logs.
12:30 < zhorX> I'm not trying to route behind at all or anything
12:30 < zhorX> And never saw that message before for all 300 prod units
12:31 < zhorX> any clue whatsoever would be nice
12:32 < zhorX> I've also done tcpdumps on the tun0 interface of the clients that have that problem and only see legit traffic (on the /30 between the box and server)
12:34 < zhorX> I'll be hovering around here if anybody feels generous
12:36 -!- alhadi [~thunderst@188.95.51.233] has quit [Ping timeout: 255 seconds]
12:36 < krzee> zhorX, no idea what changed on those boxes?
12:37 < ecrist> !google 'openvpn MULTI: bas source address'
12:37 <@vpnHelper> FAQ Community: <http://openvpn.net/index.php/open-source/faq.html>; OpenVPN 2.0 HOWTO: <http://openvpn.net/howto.html>; Re: [Openvpn-users] Re: openvpn and ccd - OpenVPN - Open Source VPN: <http://openvpn.net/archive/openvpn-users/2006-04/msg00235.html>
12:37 < zhorX> ecrist: oh I've googled
12:37 < krzee> he said hes not trying to use a lan behind the box
12:37 < zhorX> everybody talks about routing behind the box and using ccd
12:37 < zhorX> I dont need that, I'm using two /16 private networks
12:37 < krzee> you might have found that random *thing* that happens on some OS sometimes where they send the eth0 ip even tho they are communicating from tun0
12:37 < zhorX> onlyh for server/client traffic
12:37 < zhorX> thats what I think
12:38 < zhorX> the os is ubuntu 9.04
12:38 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:38 < krzee> zhorX, look at the packets leaving the client with tcpdump on the client's tun0
12:38 < zhorX> but now that I've got direct ssh trhough a forward and can do tcpdumps on the clients, I cant see anything with a LAN address going through the tunnel
12:39 < zhorX> krzee: exactly my toughts, but no dice
12:39 < krzee> see if they are going to VPN_server_ip with src address of eth0
12:39 < zhorX> 13:40:02.173369 IP 10.9.2.134.55048 > 10.9.0.1.www: . ack 1 win 92 <nop,nop,timestamp 143295937 646761782>
12:40 < krzee> what is 10.9.2.134?
12:40 < zhorX> thats all I've got, all the time, cant see anything with LAN IP going through vpn with source header address wrong
12:40 < zhorX> 10.9.0.1=server
12:40 < zhorX> anything else in /16 is client
12:40 < krzee> why /16 for clients?
12:40 < zhorX> scaling?
12:40 < krzee> openvpn cant scale like that
12:41 < krzee> it will go kaboom first, its single threaded
12:41 < zhorX> all clients get /30 addresses no?
12:41 < zhorX> tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00   inet addr:10.9.2.134  P-t-P:10.9.2.133  Mask:255.255.255.255
12:41 < krzee> ahh by default they are, they dont have to be tho
12:41 < krzee> !/30
12:41 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
12:41 -!- KaiForce [~chatzilla@adsl-70-228-82-202.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
12:41 < zhorX> I know what a /30 is :)
12:42 < zhorX> I'm just saying, even with a /30, openvpn is still talking with the .1 address to clients.
12:42 < krzee> so the client has 10.9.2.134?
12:42 < zhorX> I dont know how that can work, but I'm a core routing dude, not a vpn master
12:42 < krzee> not LAN ip, but VPN ip?
12:42 < zhorX> yes
12:42 < zhorX> yes
12:43 < zhorX> eth0      Link encap:Ethernet  HWaddr 20:cf:30:9d:3c:6b   inet addr:172.16.78.130  Bcast:172.16.78.255  Mask:255.255.255.0
12:43 < krzee> then show the entire MULTI error
12:43 -!- alhadi [~thunderst@92.96.221.97] has joined #openvpn
12:43 < zhorX> ok, let me see if I can get it from the logs
12:44 < krzee> grep MULTI openvpn.log | tail -n1
12:45 < zhorX> the log is currently 7G
12:45 < zhorX> hehe
12:45 < zhorX> here's one, not from that one but its the error I'm getting
12:45 < zhorX> Mon Jan 31 10:10:23 2011 us=171043 485b.39b1.d45f/67.71.180.141:37864 MULTI: bad source address from client [172.16.10.252], packet dropped
12:46 -!- rawDawg2 [~rawdawg@cpe-65-25-121-235.neo.res.rr.com] has joined #openvpn
12:46 < reiffert> seeh
12:46 < reiffert> !route
12:46 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
12:46 < reiffert> especially the iroute stuff.
12:46 < zhorX> I dont need iroute, I dont care about the lan behind the client
12:46 < reiffert> well but you do care about the lan behind the server?
12:46 -!- rawDawg [~rawdawg@cpe-65-25-121-235.neo.res.rr.com] has quit [Ping timeout: 250 seconds]
12:47 < zhorX> nope
12:47 < zhorX> if I did I'd push routes to the client
12:47 < krzee> your client is sending packets to 10.9.0.1 with 172.16.10.252 as its src address
12:47 < zhorX> yes
12:47 < krzee> 172.16.10.252 is its LAN ip?
12:47 < reiffert> see above then.
12:47 < zhorX> that what I dont get
12:47 < zhorX> 172 is the client LAN ip
12:47 < zhorX> 10.9.2.134 is the client tun0 ip
12:47 < zhorX> 10.9.0.1 is the server ip
12:47 < krzee> i have seen this a number of times
12:47 < zhorX> I just want tun to tun
12:48 < krzee> never figured out the issue
12:48 < reiffert> zhorX: openvpn version?
12:48 < zhorX> good question, hold
12:48 < krzee> since you have 300 boxen and only 10 effected, ild say you are in a perfect position to figure it out
12:48 < reiffert> zhorX: put routing table online 
12:48 < krzee> the problem is not openvpn
12:48 < krzee> the OS decides what src address to use
12:48 < zhorX> client= OpenVPN 2.1_rc11 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Mar  9 2009
12:49 < reiffert> uh, 2 years old.
12:49 < zhorX> server=OpenVPN 2.1_rc11 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Mar  9 2009
12:49 < zhorX> I know
12:49 < reiffert> uh, 2 years old.
12:49 < zhorX> prod stuff usually you dont upgrade unless you really need to
12:49 < krzee> but i have no clue what to change in the OS... this has been on the mail list a number of times
12:49 < reiffert> 2.1rc11 is buggy.
12:49 < alhadi> hi krzee :)
12:49 < krzee> zhorX, there are a number of known bugs in that version
12:49 < alhadi> any update with the script ?
12:50 < zhorX> /proc/sys/net/ipv4/ip_forward is NOT set to 1 on client
12:50 < reiffert> krzee: firewall, policy routing, kernel, choose one or more.
12:50 < krzee> alhadi, what script?
12:50 < alhadi> openvpngen
12:50 < alhadi> the one you made
12:50 < alhadi> need a more automated one :)
12:50 < zhorX> reiffert: fo you still want client routing table?
12:50 < krzee> oh, no updates will happen til ecrist finished ssl-admin-v2
12:51 -!- rawDawg2 [~rawdawg@cpe-65-25-121-235.neo.res.rr.com] has quit [Ping timeout: 276 seconds]
12:51 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 265 seconds]
12:51 <@vpnHelper> RSS Update - forum: Can't find tap-win32 adapter <http://forums.openvpn.net/topic7584.html#p9515>
12:52 < krzee> reiffert, lol no fair putting "kernel" at the end of those options
12:52 -!- zeshoem [~mnathani@70.52.168.144] has quit [Ping timeout: 240 seconds]
12:53 < ecrist> krzee: I should really do that
12:53 < ecrist> I think I'll have to do it for the current version
12:53 < ecrist> you never sent me that email....
12:54  * krzee thinks...
12:54 < krzee> was i supposed to send an email saying what options ild require?
12:54 < ecrist> yes
12:54 < krzee> lol
12:54 < ecrist> and how you wanted ssl-admin to work.
12:54 < ecrist> then I told you I'd get it coded. :)
12:55 < krzee> my bad =]
12:55 < ecrist> no worries, I forgot all about it until just now.
12:56 < zhorX> krzee: so you guys would suggest upgrading openvpn to the latest rev?
12:56 < ecrist> s/suggest/require it to help/
12:56 <@dazo> zhorX: yes, that is the suggestion
12:59 < zhorX> dazo: thank you very much then
13:01 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
13:03 -!- venom00ut [~dafdc@net-188-218-185-16.cust.dsl.vodafone.it] has joined #openvpn
13:03 -!- venom00ut [~dafdc@net-188-218-185-16.cust.dsl.vodafone.it] has quit [Changing host]
13:03 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
13:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Quit: No Ping reply in 180 seconds.]
13:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
13:06 -!- teddz [~teddz@dtmd-4d0bcf1d.pool.mediaWays.net] has joined #openvpn
13:08  * gladiatr loathes network manager...
13:08 < ecrist> !ubuntu
13:08 <@vpnHelper> "ubuntu" is dont use network manager!
13:09 < gladiatr> I don't.  Unfortunately some of the potato heads where I work insist on it.
13:09 <@dazo> ecrist: I'm not sure, but it might be that Ubuntu has fixed NM in their later releases 
13:10 < ecrist> dazo: perhaps, but we still can't reliably troubleshoot  issues
13:10 < gladiatr> indeed
13:10 <@dazo> ecrist: fair point ... except that it should be doable now to telnet to localhost 1194 with NM ... and do "log" there, and you'll get the complete log
13:11 -!- s7r [~s7r@89.39.174.74] has joined #openvpn
13:11 < gladiatr> ok then.  Test drive time:  wtf does this mean?  VPN connection 'caltesting' failed to connect: 'No VPN secrets!'
13:11 <@dazo> gladiatr: I've been using NM with OpenVPN in Fedora 12, 13 and 14 ... and it's actually been working out pretty decent, as long as you don't have special config options NM-openvpn don't support
13:11 < s7r> isn't openvpn community project accepting donations? where is the devel list / website and donation page?
13:12 < gladiatr> dazo, yeah.  I spent 45 minutes dl'ing and installing an ubuntu 10.10 vm to help a developer who is stuck at home.  the openvpn plugin worked great for me.  Unless this guy needs to be shot, his config wsa identical to my own (different cert/key, but otherwise)  and that was the garbage that NM spat out
13:12 < gladiatr> s/wsa/was
13:13 < gladiatr> even had him reinstall the plugin just to be sure something hadn't gone wonky 
13:13 <@vpnHelper> RSS Update - forum: How to check if source IP of the client is "a given one"? <http://forums.openvpn.net/topic7590.html>
13:13 <@dazo> gladiatr: and he also used 10.10 with the same architecture as your VM?
13:13 < gladiatr> yup
13:13 < gladiatr> 10.10 i386
13:13 < gladiatr> Even verified that his install wasn't an upgrade
13:13 <@dazo> nasty
13:14 < gladiatr> indeed
13:14 < gladiatr> So, yeah.  Until something very obvious that he is doing wrong presents itself, I maintain my general loathing of NM :)
13:16 <@dazo> as long as you don't do it on Fedora :-P
13:16 -!- uni4dfx [~uni4dfx@89-212-106-11.dynamic.t-2.net] has quit [Remote host closed the connection]
13:17 <@dazo> well, I have no clue what Ubuntu does to make their distro quite unreliable .... it might work find on one box, duplicating it to a different box with the same specs, and it collapses
13:17 <@dazo> or maybe not
13:17 <@dazo> that's the Ubuntu thrill 
13:17 < gladiatr> Indeed.
13:18  * dazo calls this a day
13:18 < gladiatr> The ersatz IT manager insists that Fedora is too unstable for daily use in a business environment.  heh
13:18 < gladiatr> It is, as you have observed, a day.
13:19 < gladiatr> Yeah.  Time to take the dog out in the drifts... he's... givin' me that look...
13:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:24 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 245 seconds]
13:26 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:35 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Connection reset by peer]
13:36 -!- dazo is now known as dazo_afk
13:37 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:40 < s7r> on a computer with 1 single public IP, can openvpn be installed and clients route traffic throught that computer - use that public IP when they go online  / browse sites etc?
13:40 < krzee> yes
13:40 < krzee> !redirect
13:40 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:41 < s7r> !nat
13:41 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:41 < s7r> krzee: I can route both public IPs or private IPs right? When I route public IPs they are all in DMZ mode for the client, but private IP will be just simple NAT right ?
13:42 < s7r> !linnat
13:42 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
13:43 < krzee> you said you only have 1 ip
13:44 < krzee> doesnt sound like public ips are an option
13:44 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
13:45 < s7r> yes of course i was just asking because i was courios how my isp does it for it's openvpn packages whcih are ofcourse not free :)
13:47 < krzee> "it's" = "it is"
13:47 < s7r> yeah sorry :)
13:48 < s7r> without '
13:53 -!- ginoe [~ginoe@client-4-224.surfsafe.pl] has joined #openvpn
13:53 < ginoe> hi
13:54 < krzee> !ping
13:54 <@vpnHelper> pong
13:55 < ginoe> can someone tell my how can i build my own tap driver based on that provider by openvpn? i need to create diffrent tap interfaces than openvpn
13:56 < krzee> what do you need to change?
13:57 < ginoe> maybe i don't need to create new driver - i create custom openvpn installation and i need to disable automatic metric on created interface
13:57 -!- xxtjaxx [~andreas@kde/developer/marschke] has left #openvpn []
13:58 < krzee> (this is not for anyone here)
13:58 < krzee> !hmac
13:58 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
13:58 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
13:58 < ginoe> i have visual basic script that can do that but i need to find my tap driver not all openvpn tap interfaces it is possible that user have allready installed some tap interfaces
13:59 < krzee> ecrist, my list is ready
13:59 < krzee> what email shall i shoot it to?
14:00 < krzee> oh nm that was a response
14:00 < krzee> i thought it was a reject notice it was so fast, lol
14:03 -!- kentr [~Kent@c-76-102-121-47.hsd1.ca.comcast.net] has joined #openvpn
14:03 < kentr> Anyone willing to help with a server config?
14:04 < Essobi> nevaaar
14:04 < Essobi> shoot your question.. someone will be around to take a peek
14:05 < gladiatr>   /nick gladiatr
14:05 < Essobi> ;)
14:05 < ecrist> krzee: lol
14:05 < hyper_ch> hi krzee
14:06 < hyper_ch> and ecrist
14:06 < ecrist> krzee: recall, from that email address to the one you're using, there's no real transport, just delivery. :)
14:06 < gladiatr> wheee
14:06 < gladiatr> (there is no Dana... only Zuel...)
14:08 < hyper_ch> ecrist: http://blogs.msdn.com/b/interoperability/archive/2011/02/01/greater-interoperability-for-windows-customers-with-html5-video.aspx  :(
14:08 <@vpnHelper> Title: Greater Interoperability for Windows Customers With HTML5 Video - Interoperability @ Microsoft - Site Home - MSDN Blogs (at blogs.msdn.com)
14:11 < kentr> Our network is setup like this: OpenVPN server at 192.168.1.100.  DHCP server and DNS server at 192.168.1.2, WAN router / gateway at 192.168.1.254.  All other machines on the server-side LAN at 192.168.1.* .  Router DHCP service is disabled.    When connected, I can reach the OpenVPN server, can ping 192.168.1.100 from my machine, but can't reach any other machines on the server-side LAN.  Tried bridged mode, but couldn't connect at all, s
14:12 < kentr> back to routed.  I've followed the steps in the how-to for routed mode to the best of my ability, but still no go. 
14:12 < gladiatr> What are you using for your vpn client subnet?
14:13 < kentr> server config has push "route 192.168.1.0 255.255.255.0", client config has pull.  IF forwarding appears to be enabled.  I don't understand the iptables & route stuff well enough to know if something's wrong there.
14:13 < kentr> gladiatr:  Is that in the client config file?
14:13 < gladiatr> Right.  What is your vpn client subnet, though?
14:13 < gladiatr> What does your "server" directive in your vpn server config look like?
14:14 < kentr> gladiatr:  checking
14:14 < gladiatr> k
14:14 < kentr> gladiatr:  server 10.8.0.0 255.255.255.0
14:15 < gladiatr> righto.  You need to add a static route to your wan router/gateway to the effect of 10.8.0.0/24 gw 192.168.1.100
14:15 < gladiatr> !factoids search route
14:15 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', and 'route_override'
14:15 < gladiatr> !router
14:15 <@vpnHelper> "router" is if you are using one of those hacked up linksys linux routers, and you are not logging... dont expect help until you turn on logging so you can post them
14:15 <@vpnHelper> RSS Update - forum: how to connect servers openvpn on windows <http://forums.openvpn.net/topic7591.html>
14:16 < gladiatr> !route
14:16 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
14:16 < gladiatr> kentr, none of these are relevant.  I'm just looking
14:16 < kentr> gladiatr:  server is Ubuntu 9.
14:17 < gladiatr> k.  You would need to add...
14:17 < gladiatr> up route add -net 10.8.0.0/24 gw 192.168.1.100
14:17 < gladiatr> to /etc/network/interfaces
14:19 < gladiatr> and it needs to go at the bottom of the stanza that defines the ethernet device that's carrying the 192.168.1.254 address
14:19 < kentr> gladiatr:  thx.  You called it the WAN gateway.  Did you mean add this to the the actual router that's connected to our ISP, not the OpenVPN server?
14:20 < gladiatr> right
14:20 < kentr> gladiatr:  oooh.  So this is configuring our network router to bridge the gap between the LAN and the VPN virtual network?
14:20 < gladiatr> that's the default gateway for all the systems on the 192.168.1.0/24 network.  If you don't set a route on the gateway system, it won't know where to send the packets when your 192.168.1.0/24 systems try to talk back to your VPN clients on the 10.8.0.0/24 network
14:21 < gladiatr> just makin' sure everyone knows where everything needs to go :)
14:22 < gladiatr> an alternative would be to add a route to each of your client systems, but that would just be silly
14:23 < kentr> gladiatr:   that's making sense,  now.  I'm guessing that's what is meant by this text in the distro config that I kept scratching my head over: Remember that these private subnets will also need to know to route the OpenVPN client address pool (10.8.0.0/255.255.255.0) back to the OpenVPN server.
14:24 < gladiatr> indeed.
14:24 < kentr> gladiatr++ . Is there a karma bot in here?
14:24 < gladiatr> lol
14:26 < krzee> no but i think vpnHelper could learn to do that
14:26  * gladiatr nudges vpnHelper 
14:27  * gladiatr mutters, "Evolve, damn you..."
14:35 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
14:35 -!- rmblr [~rmblr@quassel.jefferai.org] has joined #openvpn
14:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
14:35 -!- alhadi [~thunderst@92.96.221.97] has quit [Read error: Connection reset by peer]
14:35 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 240 seconds]
14:35 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has quit [Ping timeout: 240 seconds]
14:36 -!- deever [~deever@78.46.68.172] has joined #openvpn
14:36 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:36 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:36 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:36 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
14:36 -!- mode/#openvpn [+o vpnHelper] by ChanServ
14:36 < ecrist> !whoami
14:36 <@vpnHelper> support
14:37 < ecrist> !karma
14:37 -!- sia^pwnnt is now known as sia
14:38 < ginoe> ok, i have compile tap driver but now i have tap0901.map i tap0901.pdb - how can i make cat file ?
14:43 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
14:43 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
14:43 -!- mode/#openvpn [+o vpnHelper] by ChanServ
14:44 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
14:45 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has joined #openvpn
14:46 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
14:46 -!- mode/#openvpn [+o vpnHelper] by ChanServ
14:46 < ecrist> gladiatr++
14:46 < krzee> vpnHelper++
14:47 < krzee> !karma
14:47 <@vpnHelper> Error: I have no karma for this channel.
14:47 -!- ginoe [~ginoe@client-4-224.surfsafe.pl] has left #openvpn []
14:47 < krzee> !list karma
14:47 <@vpnHelper> clear, dump, karma, load, and most
14:47 < krzee> !most
14:47 <@vpnHelper> (most [<channel>] {increased,decreased,active}) -- Returns the most increased, the most decreased, or the most active (the sum of increased and decreased) karma things. <channel> is only necessary if the message isn't sent in the channel itself.
14:48 < krzee> !karma #openvpn
14:48 <@vpnHelper> Error: I have no karma for this channel.
14:48 < gladiatr> lol
14:49 < krzee> !karma vpnHelper 
14:49 <@vpnHelper> vpnHelper has neutral karma.
14:49 < ecrist> vpnHelper: ecrist +
14:49 < krzee> !karma gladiatr
14:49 <@vpnHelper> gladiatr has neutral karma.
14:49 < ecrist> vpnHelper: krzee++
14:49 < krzee> !karma krzee
14:49 <@vpnHelper> Karma for "krzee" has been increased 1 time and decreased 0 times for a total karma of 1.
14:49 < ecrist> vpnHelper: krzee--
14:49 < ecrist> !most
14:49 <@vpnHelper> (most [<channel>] {increased,decreased,active}) -- Returns the most increased, the most decreased, or the most active (the sum of increased and decreased) karma things. <channel> is only necessary if the message isn't sent in the channel itself.
14:49 < ecrist> !most active
14:49 <@vpnHelper> "krzee": 2
14:50 < ecrist> !most increased
14:50 <@vpnHelper> "krzee": 1
14:50 < ecrist> vpnHelper: ecrist++
14:50 <@vpnHelper> Error: You're not allowed to adjust your own karma.
14:50 < ecrist> :(
14:50 < krzee> vpnHelper, ecrist++
14:51 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 272 seconds]
14:51 < ecrist> !karma
14:51 <@vpnHelper> Highest karma: "ecrist" (1) and "krzee" (0).  Lowest karma: "krzee" (0) and "ecrist" (1).  You (ecrist) are ranked 1 out of 2.
14:52 < ecrist> gladiatr++
14:52 <@vpnHelper> Joo got it.
14:52 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
14:52 < ecrist> !most
14:52 <@vpnHelper> (most [<channel>] {increased,decreased,active}) -- Returns the most increased, the most decreased, or the most active (the sum of increased and decreased) karma things. <channel> is only necessary if the message isn't sent in the channel itself.
14:53 < ecrist> !clear
14:53 <@vpnHelper> (clear [<channel>] <name>) -- Resets the karma of <name> to 0.
14:53 < ecrist> !clear #openvpn
14:53 <@vpnHelper> (clear [<channel>] <name>) -- Resets the karma of <name> to 0.
14:53 < ecrist> !clear #openvpn *
14:53 <@vpnHelper> Joo got it.
14:53 < ecrist> muahahaha
14:54 < gladiatr> awesome
14:59 < ecrist> can someone who doesn't have specific bot access give it a try?
15:00 -!- not_gladiatr [~gladiatr@madeline.boneyard.lawrence.ks.us] has joined #openvpn
15:00 < not_gladiatr> !karma
15:00 <@vpnHelper> Highest karma: "ecrist" (1), "gladiatr" (1), and "krzee" (0).  Lowest karma: "krzee" (0), "ecrist" (1), and "gladiatr" (1).
15:00 < not_gladiatr> vpnHelper, ecrist++
15:01 <@vpnHelper> Joo got it.
15:01 < not_gladiatr> !karma
15:01 <@vpnHelper> Highest karma: "ecrist" (2), "gladiatr" (1), and "krzee" (0).  Lowest karma: "krzee" (0), "gladiatr" (1), and "ecrist" (2).
15:01 < not_gladiatr> vpnHelper, ecrist--
15:01 < ecrist> w00t
15:01 <@vpnHelper> Joo got it.
15:01 < not_gladiatr> vpnHelper, ecrist--
15:01 < not_gladiatr> vpnHelper, ecrist--
15:01 <@vpnHelper> Joo got it.
15:01 < not_gladiatr> vpnHelper, ecrist--
15:01 <@vpnHelper> Joo got it.
15:01 <@vpnHelper> Joo got it.
15:01 < not_gladiatr> muwahahaha
15:01 < not_gladiatr> !karma
15:01 <@vpnHelper> Highest karma: "gladiatr" (1), "krzee" (0), and "ecrist" (-2).  Lowest karma: "ecrist" (-2), "krzee" (0), and "gladiatr" (1).
15:01 < not_gladiatr> vpnHelper, ecrist++
15:01 < not_gladiatr> vpnHelper, ecrist++
15:01 < not_gladiatr> vpnHelper, ecrist++
15:01 <@vpnHelper> Joo got it.
15:01 <@vpnHelper> Joo got it.
15:01 <@vpnHelper> Joo got it.
15:02 < gladiatr> now, see, you need to put some timing code in there... make it respond with something along the lines of, "Don't play with it--you'll go blind."
15:02 -!- not_gladiatr [~gladiatr@madeline.boneyard.lawrence.ks.us] has quit [Client Quit]
15:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
15:07 < ecrist> gladiatr: /mode +b works, too
15:07 < ecrist> you'll note you weren't able to affect a user more than one point in either direction
15:07 < ecrist> #openvpn - now with karma!
15:10 < kentr> ecrist:  Nice :-) ecrist++
15:11 <@vpnHelper> Joo got it.
15:11 < gladiatr> ecrist, indeed!
15:11 < gladiatr> !karma
15:11 <@vpnHelper> Highest karma: "ecrist" (1), "gladiatr" (1), and "ecrist:  Nice :-) ecrist" (1).  Lowest karma: "krzee" (0), "ecrist" (1), and "gladiatr" (1).  You (gladiatr) are ranked 1 out of 4.
15:13 < gladiatr> hrm... need to adjust the regex
15:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:25 -!- rmblr is now known as Ramblurr
15:25 -!- Ramblurr [~rmblr@quassel.jefferai.org] has quit [Changing host]
15:25 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
15:37 -!- kentr [~Kent@c-76-102-121-47.hsd1.ca.comcast.net] has left #openvpn []
15:46 -!- IRQ [~IRQ@c-217-115-40-2.cust.bredband2.com] has quit [Disconnected by services]
15:54 -!- xindz is now known as xindz`off
15:54 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
15:55 -!- panfist [~stachursk@c-76-98-75-186.hsd1.nj.comcast.net] has quit [Remote host closed the connection]
15:56 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:01 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:18 < reiffert> H
16:30 -!- WinstonSmith [~true@g225028160.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
16:43 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 240 seconds]
16:46 -!- WinstonSmith [~true@dslb-088-073-124-123.pools.arcor-ip.net] has joined #openvpn
16:57 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
17:10 <@vpnHelper> RSS Update - forum: Certificate Creation Errors: build-ca <http://forums.openvpn.net/topic7585.html#p9518>
17:12 -!- bo_root [~x@89-212-225-234.dynamic.t-2.net] has quit [Remote host closed the connection]
17:23 < Dougy> vpnHelper, Dougy++
17:23 <@vpnHelper> Error: You're not allowed to adjust your own karma.
17:23 < Dougy> :(
17:24 -!- soulse [~me@i.am.soulse.org] has joined #openvpn
17:24 < soulse> is possible to configure a vpn (using openvpn) compatible with cisco vpn client?
17:25 -!- AddeBC [AddeBC@c193-150-231-214.bredband.comhem.se] has joined #openvpn
17:40 < ecrist> lol
17:41 < reiffert> vpnHelper: Dougy++
17:41 <@vpnHelper> Joo got it.
17:41 < reiffert> vpnHelper: karma Dougy
17:41 <@vpnHelper> Karma for "Dougy" has been increased 1 time and decreased 0 times for a total karma of 1.
17:41 < reiffert> vpnHelper: Dougy--
17:41 <@vpnHelper> Joo got it.
17:41 < reiffert> vpnHelper: Dougy--
17:41 <@vpnHelper> Joo got it.
17:41 < reiffert> vpnHelper: karma Dougy
17:41 <@vpnHelper> Karma for "Dougy" has been increased 1 time and decreased 2 times for a total karma of -1.
17:41 < ecrist> !clear #openvpn ecrist: Nice :-)
17:41 <@vpnHelper> Joo got it.
17:41 -!- reiffert is now known as reiffert_
17:41 < reiffert_> vpnHelper: reiffert++
17:41 <@vpnHelper> Joo got it.
17:41 -!- reiffert_ is now known as reiffert
17:42 < ecrist> nice
17:43 < ecrist> something leads me to believe I could code a better Karma plugin
17:43 < ecrist> except that I don't know python
17:43 < reiffert> have me do it for you :p
17:43 < ecrist> go ahead
17:44 < ecrist> I wouldn't stop ya. :)
17:44 < reiffert> nah it would raise my karma to inf :)
17:44 -!- nDuff [~cduffy@rrcs-97-79-207-2.sw.biz.rr.com] has joined #openvpn
17:45 < ecrist> some things it seems to be missing: 1) regex fail 2) karma should not be able to be increased if the nick isn't present 3) karma should only be able to be increased by registered and identified nicks
17:45 < reiffert> 3 sucks.
17:46 < ecrist> 4) a user should not be able to increase or decrease karma for a user more than one point
17:46 < reiffert> karma--
17:46 <@vpnHelper> Joo got it.
17:46 < ecrist> heh
17:46 < reiffert> karma karma
17:46 < reiffert> vpnHelper: karma karma
17:46 <@vpnHelper> Highest karma: "ecrist" (1), "gladiatr" (1), and "ecrist:  Nice :-) ecrist" (1).  Lowest karma: "Dougy" (-1), "karma" (-1), and "krzee" (0).  You (reiffert) are ranked 1 out of 7.
17:46 < ecrist> !clear #openvpn ecrist: Nice :-) ecrist
17:46 <@vpnHelper> Joo got it.
17:46 < Bushmills> places
17:46 < ecrist> !karma karma
17:46 <@vpnHelper> Highest karma: "ecrist" (1), "gladiatr" (1), and "ecrist:  Nice :-) ecrist" (1).  Lowest karma: "Dougy" (-1), "karma" (-1), and "krzee" (0).  You (ecrist) are ranked 1 out of 7.
17:47 < ecrist> !clear *
17:47 <@vpnHelper> Joo got it.
17:47 < ecrist> !karma karma
17:47 <@vpnHelper> Highest karma: "ecrist" (1), "gladiatr" (1), and "ecrist:  Nice :-) ecrist" (1).  Lowest karma: "Dougy" (-1), "karma" (-1), and "krzee" (0).  You (ecrist) are ranked 1 out of 7.
17:47 < ecrist> gah
17:47 < reiffert> karma sucks
17:47 < reiffert> karma--
17:47 <@vpnHelper> Joo got it.
17:47 < ecrist> I agree
17:47 < ecrist> karma--
17:47 <@vpnHelper> Joo got it.
17:47 < ecrist> !karma karma
17:47 <@vpnHelper> Highest karma: "ecrist" (1), "gladiatr" (1), and "ecrist:  Nice :-) ecrist" (1).  Lowest karma: "karma" (-3), "Dougy" (-1), and "krzee" (0).  You (ecrist) are ranked 1 out of 7.
17:47 < ecrist> !unload Karma
17:47 <@vpnHelper> Joo got it.
17:49 < reiffert> karma--
17:49 < reiffert> at least unload() seems to work
17:52 < AddeBC> When starting openVPN i have this message: Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {1BD5AFB4-0ECF-4D7E-9431-526DF80F4287} [DHCP-serv: 10.8.0.2, lease-time: 31536000]  in Server config the subnet is /24 why is this?
17:54 < ecrist> !/30
17:54 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
17:55 < ecrist> 255.255.255.252 is a /32, it's using a 2-bit host mask to provide 4 ip addresses, network, broadcase, and two endpoints.
17:56 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
17:58 < reiffert> wrong.
17:58 < reiffert> it's a /30
17:59 < ecrist> doh, that's what i meant
17:59 < AddeBC> Ok ive been setting this up for about 6 hours now reading about everything since this is first time with openVPN, asking on irc is always my last resort... however the problem i am having is that the Windows Serevr running Openvpn as server can ping client ip 10.8.0.6
17:59 < AddeBC> but from my internal network i can not ping 10.8.0.1
18:01 < AddeBC> in the windows server routes table i got the following: 10.8.0.0    255.255.255.0         10.8.0.2         10.8.0.1
18:01 < ecrist> you need to pass the route to them
18:01 < AddeBC> Thus its saying gateway is on 10.8.0.2
18:01 < AddeBC> is that correct?
18:01 < ecrist> that looks right
18:01 < AddeBC> isnt the GW 10.8.0.1
18:02 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
18:02 < ecrist> read the link above
18:03 < AddeBC> I am... slowly right now... but my brain is melting... sooooo tired...  ;)
18:03 < AddeBC> i have added a route already on the win server that routes back to my internal network at home
18:04 -!- mosno [~mosno@unaffiliated/mosno] has quit [Remote host closed the connection]
18:04 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
18:22  * ecrist decides to get around to krzee's CLI request tonight
18:25 -!- AddeBC [AddeBC@c193-150-231-214.bredband.comhem.se] has quit [Ping timeout: 260 seconds]
18:28 -!- WinstonSmith [~true@dslb-088-073-124-123.pools.arcor-ip.net] has quit [Ping timeout: 272 seconds]
18:30 -!- AddeBC [AddeBC@c193-150-231-214.bredband.comhem.se] has joined #openvpn
18:41 -!- sia is now known as sia^pwnnt
18:46 < ecrist> gah
18:46  * ecrist notices spammers took over his ticket system
18:49  * ecrist has considered buying three of the Atlassian packages
18:50 < ecrist> s/buying/obtaining free copies of/
18:53 -!- kerfe [~a@47.pool85-60-129.dynamic.orange.es] has quit [Quit: • IRcap • 8.6 •]
18:54 < s7r> can I transform my windows server into openvpn server?
18:54 < ecrist> that question doesn't even make sense
18:54 < arnotixe> !karma karma
18:55 < ecrist> we've removed karma
18:55 < s7r> why do you say thigs ecrist ?
18:55 < ecrist> what?
18:56 < arnotixe> hehe I was just reading the scrollback log :)
18:57 < ecrist> s7r: perhaps you can rephrase your question to something I understand so I can better help you
18:58 < s7r> I don't know what could I rephrase, I want to know if a machine with Windows Operating System isntalled on it can act as an OpenVPN server
18:58 < s7r> :)
18:59 < AddeBC> ecrist may i bother you just a bit again? ;)
18:59 < AddeBC> s7r: yes
18:59 < ecrist> s7r: *that* I understand.  Yes, you can run openvpn as a server running Windows OS
18:59 < ecrist> AddeBC: you may, indeed
18:59 < s7r> thank you.
19:00 < AddeBC> s7r: You want a good guide?
19:00 < s7r> I would love it
19:00 < AddeBC> http://openvpn.net/index.php/open-source/documentation/howto.html
19:00 <@vpnHelper> Title: HOWTO (at openvpn.net)
19:01 < AddeBC> I followed that one and it helped me alot
19:01 < s7r> thank you
19:02 < ecrist> AddeBC: what did you need help with?  I may not be at a terminal much longer
19:03 < AddeBC> ecrist: i have been reading the link, and checking my conf  and pulling my hair :S  I just cant find the prob... But i beleive it is something TSTUPID ive overlooked. So i wrote down my conf
19:03 < AddeBC> http://pastebin.com/8BBZy3u0
19:04 < AddeBC> Could you just i through that and i think you will understand my setup a bit... i posted the openVPN output from the server at the bottom
19:06 < ecrist> line 13 should read 'route add 10.10.10.0 mask 255.255.255.0 10.8.0.1'
19:06 < ecrist> the .2 address is not used in this case (the first /30 subnet)
19:07 < ecrist> make sure ip forwarding is enabled on the windows server (don't remember where to enable that
19:07 < AddeBC> on teh vpn interface?
19:08 < s7r> AddeBC: here is how to enable ip forwarding http://support.microsoft.com/kb/315236
19:08 <@vpnHelper> Title: How to Enable TCPIP Forwarding in Windows XP (at support.microsoft.com)
19:08 < s7r> same settings for win 2003 server
19:09 < AddeBC> found this: netsh interface ipv4 set int "[name of the NIC]" forwarding=enabled
19:09 < AddeBC> s7r: i run 2008
19:10 < AddeBC> thanks though :D
19:10 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
19:11 < s7r> http://www.windowsreference.com/networking/disable-ip-source-routing-in-windows-server-2008-windows-vista/
19:11 < s7r> here is for win 2008 AddeBC
19:11 < s7r> no worries i just googled it for you, i know how it is to be busy and don't have time to google things :D
19:11 < AddeBC> thanks mate... always appreciated...
19:12 -!- s7r [~s7r@89.39.174.74] has left #openvpn []
19:19 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:21 -!- WinstonSmith [~true@g231217036.adsl.alicedsl.de] has joined #openvpn
19:35 -!- teddz [~teddz@dtmd-4d0bcf1d.pool.mediaWays.net] has quit [Quit: Ex-Chat]
19:36 -!- teddz [~teddz@dtmd-4d0bcf1d.pool.mediaWays.net] has joined #openvpn
19:37 -!- merky [~ben@meh-2-pt.tunnel.tserv15.lax1.ipv6.he.net] has joined #openvpn
19:38 < merky> does anyone here use openbsd?
19:38 < merky> !welcome
19:38 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:38 < merky> !goal
19:38 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:39 < AddeBC> Anyone? : openvpn[8869]: Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:2: topology (2.0.6)
20:22 < dvl> AddeBC: well, sounds like push options is wrong.
20:23 < dvl> AddeBC: but without a config to look at, we're just guessing.
20:27 -!- albech [~thomas@124.157.245.126] has joined #openvpn
20:54 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
21:06 -!- master_of_master [~master_of@p57B560E6.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
21:08 -!- master_of_master [~master_of@p57B561A6.dip.t-dialin.net] has joined #openvpn
21:55 -!- WinstonSmith [~true@g231217036.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
22:12 < krzee> ecrist, today is the special day for your web cert
22:15 -!- WinstonSmith [~true@g231217036.adsl.alicedsl.de] has joined #openvpn
22:19 -!- WinstonSmith [~true@g231217036.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
22:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 265 seconds]
22:44 < ecrist> krzee: I noticed
22:44 < ecrist> :\
22:44  * ecrist re-ups
22:48 < krzee> merky, move forward to your real question
22:59  * ecrist waits on godaddy's systems. :(
23:04 < ecrist> krzee: new SSL certificate installed
23:05 < ecrist> thanks for the pointer on that one
23:07 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:09 <@vpnHelper> RSS Update - forum: Can't ping LAN behind VPN server <http://forums.openvpn.net/topic7547.html#p9519>
23:15 <@vpnHelper> RSS Update - forum: ifconfig question <http://forums.openvpn.net/topic7527.html#p9520>
23:19 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:21 <@vpnHelper> RSS Update - forum: openvpn client error <http://forums.openvpn.net/topic7560.html#p9521>
23:27 <@vpnHelper> RSS Update - forum: MULTI: bad source address from client <http://forums.openvpn.net/topic7575.html#p9522>
23:33 -!- teddz [~teddz@dtmd-4d0bcf1d.pool.mediaWays.net] has quit [Quit: Ex-Chat]
23:35 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
23:41 < krzee> ecrist, np
23:45 <@vpnHelper> RSS Update - forum: how to connect servers openvpn on windows <http://forums.openvpn.net/topic7591.html#p9523>
23:56 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has quit [Ping timeout: 272 seconds]
--- Day changed Thu Feb 03 2011
00:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
00:16 -!- arnotixe [~arnotixe@190.131.174.161] has joined #openvpn
00:21 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:37 -!- arnotixe [~arnotixe@190.131.174.161] has quit [Ping timeout: 255 seconds]
00:38 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has joined #openvpn
00:39 <@vpnHelper> RSS Update - forum: Need VPN expert for project <http://forums.openvpn.net/topic7579.html#p9524>
00:45 -!- Sintax` [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has quit [Read error: Connection reset by peer]
00:46 -!- SintaxBSD [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has joined #openvpn
01:04 <@vpnHelper> RSS Update - forum: WinXP installation <http://forums.openvpn.net/topic7589.html#p9525>
01:09 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:10 <@vpnHelper> RSS Update - forum: How to specify my OpenVPN-AS license key? <http://forums.openvpn.net/topic7573.html#p9527> || Client concurrently using 2 different VPN servers? <http://forums.openvpn.net/topic7565.html#p9526>
01:28 <@vpnHelper> RSS Update - forum: CND script OpenVpn <http://forums.openvpn.net/topic7587.html#p9529> || Can't find tap-win32 adapter <http://forums.openvpn.net/topic7584.html#p9528>
01:40 <@vpnHelper> RSS Update - forum: How to check if source IP of the client is "a given one"? <http://forums.openvpn.net/topic7590.html#p9530>
01:45 -!- alhadi [~thunderst@92.96.236.209] has joined #openvpn
01:45 -!- zeshoem [~mnathani@70.54.143.106] has joined #openvpn
01:51 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:51 -!- mode/#openvpn [+o mattock] by ChanServ
01:52 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:04 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
02:06 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Ping timeout: 240 seconds]
02:34 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9531>
02:36 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
02:37 -!- networkn [~networkn@121.98.152.39] has joined #openvpn
02:38 < networkn> I am wondering if there are known issues with openvpn and mcafee firewalls? 
02:40 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9532>
02:53 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
03:02 -!- dazo_afk is now known as dazo
03:05 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:28 <@vpnHelper> RSS Update - forum: Using OpenVPN on a domain controlled laptop <http://forums.openvpn.net/topic7569.html#p9533>
03:34 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:35 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
03:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:47 -!- takamichi [~pri@85.232.213.54] has quit [Remote host closed the connection]
03:52 <@vpnHelper> RSS Update - forum: Route delete error on win7 64bit <http://forums.openvpn.net/topic7592.html>
04:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:10 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
04:10 -!- dazo is now known as dazo_afk
04:11 -!- alhadi [~thunderst@92.96.236.209] has quit [Ping timeout: 255 seconds]
04:16 -!- dazo_afk is now known as dazo
04:26 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
04:26 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
04:26 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
04:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
04:43 -!- networkn [~networkn@121.98.152.39] has quit []
04:57 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
05:04 <@vpnHelper> RSS Update - forum: Route delete error on win7 64bit <http://forums.openvpn.net/topic7592.html#p9535>
05:13 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:16 -!- le0 [~le0@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
05:19 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
05:19 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
05:19 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
05:24 -!- le0 [~le0@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
05:26 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
05:32 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: whoops!]
05:33 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
05:33 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
05:33 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
05:35 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9536>
05:36 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has joined #openvpn
05:46 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9537>
05:53 -!- le0 [~le0@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
05:56 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
05:56 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
05:56 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
06:05 -!- w00 [~wu@188.26.246.143] has joined #openvpn
06:05 < w00> hello
06:06 < w00> i have an openvpn server that pushes some routes to the clients, issue is i have Windows clients that don't use admin accounts.. and on the normal accounts it can't set the routes, how could i solve this?
06:08 < krzee> is it windows XP?
06:08 < w00> yeah
06:09 < w00> Getting it to run as admin is not really an option
06:09 < krzee> !win_noadmin
06:09 <@vpnHelper> "win_noadmin" is (#1) http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin-Rev1.1.html for HowTo Run OpenVPN as a non-admin user in Windows, or (#2) and http://article.gmane.org/gmane.network.openvpn.user/24873 for vista
06:09 < krzee> comes down to addig the user to the networking group
06:09 < w00> oh, neat, reading on, thank you :)
06:09 < krzee> np
06:10 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Remote host closed the connection]
06:15 -!- ucekpolish [~ucek@hq.ostc-pl.com] has joined #openvpn
06:15 -!- le0 [~le0@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
06:23 <@vpnHelper> RSS Update - forum: Problem with OpenVPN Windows 7 and Routing <http://forums.openvpn.net/topic7593.html>
06:53 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9540>
07:00 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
07:00 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
07:00 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
07:11 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9541>
07:11 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
07:14 -!- le0 [~le0@unaffiliated/le0] has quit [Ping timeout: 240 seconds]
07:14 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:15 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
07:15 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
07:15 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:17 -!- WinstonSmith [~true@g225031077.adsl.alicedsl.de] has joined #openvpn
07:17 <@vpnHelper> RSS Update - forum: how to connect servers openvpn on windows <http://forums.openvpn.net/topic7591.html#p9542>
07:21 -!- Comradin [~marcus@marcus-franke.net] has joined #openvpn
07:22 < Comradin> !welcome
07:22 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:22 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9543>
07:22 < Comradin> hehe
07:22 < Comradin> nice
07:22 < Comradin> !route
07:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
07:24 -!- DonalDuck [~alex@212.59.96.74] has joined #openvpn
07:24 < DonalDuck> hi
07:25 < ecrist> hello
07:25 < DonalDuck> i need help
07:27 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9544>
07:29 < DonalDuck> please tell me why the openvpn server using the client gives iftsonfig un tun interfaces 192.168.20.6 and network first-then-prime 192.168.20.2
07:31 -!- Kurogane [~kuro@190.87.95.13] has joined #openvpn
07:32 < ecrist> !/30
07:32 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
07:32 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9545>
07:32 < ecrist> DonalDuck: see what vpnHelper said
07:37 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582.html#p9547>
07:43 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582-15.html#p9548>
07:44 < DonalDuck> where it can be changed
07:47 < AddeBC> Ok, now i am really confused...
07:47 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 265 seconds]
07:47 < AddeBC> Set a OpenVPN Server up on windows, client connects, so certs are fine.
07:48 < AddeBC> But on the openVPN server the routes which open VPN creates by itself says gateway for VPN connections are 10.8.0.2 - This ip i cant even ping
07:48 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582-15.html#p9549>
07:49 < krzee> AddeBC, 
07:49 < krzee> !/30
07:49 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
07:49 < AddeBC> krzee... absolutely, but the gateway, shouldnt it be pingable?
07:50 < AddeBC> i can from the server ping the client 10.8.0.6
07:50 < AddeBC> the iface 10.8.0.1
07:50 < krzee> nope
07:50 < krzee> .6 and .1 should
07:50 < krzee> .2 and .5 are internal to openvpn only
07:51 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
07:51 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
07:51 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:51 < AddeBC> So if i add a route on teh server to the remote client bnetwork what shall i set as gateway?
07:51 < AddeBC> 1 or 2
07:51 < krzee> you dont
07:51 < krzee> you let openvpn do it
07:52 < AddeBC> the push commands sets routes on client, how do i tell openVPN to make a route locally then?
07:52 < krzee> !push
07:52 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
07:53 < krzee> push doesnt set routes on clients...
07:53 < krzee> push makes config options act as if they were in client config
07:53 -!- DonalDuck [~alex@212.59.96.74] has quit [Remote host closed the connection]
07:53 < krzee> to have them act on the server, dont push them
07:53 -!- xindz`off is now known as xindz
07:54 < AddeBC> could you give an example how to do that in serevr config..not push a route
07:54 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582-15.html#p9550>
07:54 < krzee> !route
07:54 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
07:59 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582-15.html#p9551>
07:59 < AddeBC> thx
08:04 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
08:04 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582-15.html#p9552>
08:05 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
08:05 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
08:05 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:11 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582-15.html#p9553>
08:17 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within 60 seconds <http://forums.openvpn.net/topic7582-15.html#p9555> || Route delete error on win7 64bit <http://forums.openvpn.net/topic7592.html#p9554>
08:18 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
08:18 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
08:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:27 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
08:27 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
08:27 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
08:30 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has quit [Ping timeout: 245 seconds]
08:43 < AddeBC> !topology
08:43 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
08:48 < AddeBC> I am getting "Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]"  from the fowwlowing:  'PUSH_REPLY,dhcp-option DNS 208.67.222.222,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'  I cant see any problems, anyone else?
08:48 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
08:52 -!- maxJadi [~maxJadi@dhcp-166-74.nomad.chalmers.se] has joined #openvpn
08:52 -!- maxJadi [~maxJadi@dhcp-166-74.nomad.chalmers.se] has quit [Changing host]
08:52 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:55 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
08:56 < ecrist> AddeBC: what version of openvpn are you running on the machine that gets the error?
08:57 -!- gladiatr_afk is now known as gladiatr
08:58 -!- alhadi [~thunderst@ner-as44531.alshamil.net.ae] has joined #openvpn
08:58 -!- w00 [~wu@188.26.246.143] has left #openvpn []
08:58 < AddeBC> ecrist: OpenVPN 2.0.6 i386-portbld-freebsd7.2 [SSL] [LZO] built on Dec 4 2009
09:00 < ecrist> that would be your problem.
09:00 < AddeBC> no way to get it working?
09:00 < ecrist> not sure why you're running 2.0.anything on freebsd
09:00 < ecrist> AddeBC: no, 2.0.6 doesn't support topology
09:00 < AddeBC> openVPN on pfSense
09:00 < ecrist> BS
09:01 < ecrist> I know for a fact pfSense has the latest version of openvpn
09:01 < AddeBC> probably if you run pfSense 2.0 BETA - i prefer the stable on crucial systems...
09:02 < ecrist> 2.0.6 is something around 6 years old.
09:02 < ecrist> 2.1 was release 14 months ago
09:03 < AddeBC> well thats what came with 1.2.3 stable
09:03 < ecrist> so, in summary, 2.0.6 won't support topology, and we don't support < 2.1
09:03 < AddeBC> okidoki
09:03 < ecrist> I don't care, to be honest, what came with it
09:03 < ecrist> I know pfSense, specifically FreeBSD, and I know the core developer/founder of pfSense, Scott, and their stuff is more up to date than that.
09:04 < ecrist> also, I'm one of the FreeBSD port maintainers for openvpn, so I know the current versions are available to those systems
09:04 < AddeBC> Well i have installed there official package
09:04 < ecrist> as a matter of fact, the freebsd ports tree is usually updated BEFORE the release announcements are made for openvpn
09:06 < AddeBC> i just checked the automatic update for pfsense and no updates available... so afaik 2.0.6 is whats delivered with 1.2.3
09:18 < gladiatr> mmm... FreeBSD 9
09:20 < AddeBC> ecrist: thanks for popping over there... i was getting confused by all different views :)
09:22 < ecrist> no worries.
09:22 < ecrist> I met a lot of those guys at BSDCan last year.
09:22 < ecrist> I'll probably be drinking beer with them again in May.
09:22 < dvl> Good plan.
09:23 < ecrist> :)
09:23 < ecrist> I'm dragging EmperorTom with me, this year.
09:23 < dvl> Who?
09:24 < ecrist> a coworker
09:24 < dvl> You'll have to find me before the opening talk, let me know who you are.
09:24 < ecrist> hopefully jpaetzel behaves himself this year, and I don't get him in trouble. :)
09:24 -!- Adde_BC [~AddeBC@c193-150-231-214.bredband.comhem.se] has joined #openvpn
09:24 < ecrist> we met a couple times last year
09:24 < ecrist> but I will be sure to do so.
09:25 < dvl> Yeah, but I'm not sure I knew you were the OpenVPN guy.
09:25 -!- AddeBC [AddeBC@c193-150-231-214.bredband.comhem.se] has quit [Ping timeout: 260 seconds]
09:25 < ecrist> fat, ugly dude, crew cut, goatee
09:25  * gladiatr chuckles
09:25 < dvl> That's most of the attendees.
09:25 < ecrist> right
09:25 < ecrist> I was registered under ClaimLynx (and will be again)
09:26 < ecrist> jpaetzel was trying to talk me into speaking on openvpn this year.  perhaps next year
09:26 < gladiatr> but then there's the segment of the population I belong to: thin/gaunt, shaggy top, rockin' UNIX beard lol
09:26 < gladiatr> ecrist, you mean in front of other people in an organized fashion?
09:27 < ecrist> aye
09:27 < ecrist> @BSDCan
09:27 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 265 seconds]
09:27 < gladiatr> Where is it being held this year?
09:27 < gladiatr> I /dev/null those emails... don't want to become morose about not going...
09:28 < ecrist> it is at U of Ottawa every year
09:28 < gladiatr> cool
09:29 < dvl> I think you should talk on OpenVPN
09:29 < dvl> this year?  gladiatr how long have you been following BSDCan?
09:30 < gladiatr> I've seen the emails come through for at least the last 5 years.
09:30 < gladiatr> (I think)
09:30 < dvl> gladiatr: and you've never noticed the location?  ;)
09:31 < gladiatr> hehe
09:31 < gladiatr> Someday...
09:32 < gladiatr> It's usually the same every year: BSDCan announcement comes in (call for papers/reg. info/etc).  Me: /sniff /pout /mutter "can't go.." <delete>
09:32 < ecrist> that was my past behavior I conned^H^H^Hvinced my employer to pay my way
09:35 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:36 < gladiatr> Hrm... Well, to give you an idea how cheap the org. that I work for is: we're currently discussing possible solutions to the frozen compressor that goes to the unit in the server room here.  The best solution, so far presented by the company from which this hotel-room-grade device was purchased, is that a pipe be installed from the roof to provide passive cooling for the remainder of the winter months.
09:37 < gladiatr> The device that is currently non-functional is, apparently, referred to as a "comfort" model--rough definition being: one that provides warm-month climate control to biological organisms--not electronic devices.
09:38 < ecrist> there have been studies indicating that cooling is not as important as some may think
09:38 < ecrist> I would guess you folks would be fine without any additional cooling.
09:39 < gladiatr> It's a very small room.  The rack is densely packed with 2 and 4U sunfire systems.  
09:39 < gladiatr> They were all screaming and threatening to shut down.
09:39 < ecrist> open a window. :)
09:39 < gladiatr> Inside room
09:39 < ecrist> or, move into a real data center.
09:40 < gladiatr> YES!  
09:40 < gladiatr> :D
09:40 < ecrist> I have ~1/4 rack of gear in my basement
09:40 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
09:40 < ecrist> that room is noticeably warmer than others in my house, but I don't do any extra cooling 
09:41 < gladiatr> Yeah.  Me too.  It's actually nice to have the extra heat in the basement during the winter months.
09:42 < ecrist> I'm thinking of either 1) moving my gear out of my house to a real data center, or 2) getting a couple mac minis, throwing freebsd on them, and calling it good.
09:45 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:46 < ecrist> dvl: I will put something together for next year's BSDCan, something more suitable for the 2-days of talkes, rather than the more technical conference days, I'm thinking.
09:47 < dvl> ecrist: do it today
09:47 < gladiatr> lol
09:49 < gladiatr> For the Q&A session, you can just open a private session with vpnHelper
09:49 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
09:49 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
09:49 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
09:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:54 < Adde_BC> ecrist: could you clarify something for me...
09:56 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
09:56 < Adde_BC> My pfSense at home with openVPN i wish to connect to my server at a ISP. That serevr only has a external ip so it has no internal LAN. My thinking was to use teh 10.8.0.1 adress to access the server since i have no lan on the other side to route with... is this where the problem could lie?
09:58 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:03 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:07 < ecrist> what is the point of connecting to the server, access stuff on the server securely?
10:07 < Adde_BC> netbios shares etc
10:08 < ecrist> and everything currently runs on the production IP?
10:08 < ecrist> s/production/public/
10:08 < Adde_BC> Its a web/sqkl/mailserver  with a external ip
10:09 < Adde_BC> basicly i want to map the web folder on the serevr to work on files
10:09 < ecrist> ah, in that case, put a private IP on that system, and use that to access those shares.
10:10 < Adde_BC> i only have one nic interface
10:10 < ecrist> i.e. web/sql/mailserver on public IP, netbios/ftp/whatever on 10.8.0.1 IP
10:10 < ecrist> so?
10:10 < ecrist> you can have multiple IPs on a single ethernet interface
10:10 < Adde_BC> yes axactly thats what my plan was
10:10 < Adde_BC> <ecrist> i.e. web/sql/mailserver on public IP, netbios/ftp/whatever on 10.8.0.1 IP
10:10 < ecrist> better yet, just use the openvpn interface for that stuff
10:10 < Adde_BC> yes thats what im trying
10:11 < Adde_BC> and as far as i am now... the serevr with openVPN at my isp got 10.8.0.1
10:11 < Adde_BC> my firewall at home with openVPN got 10.8.0.6
10:11 < Adde_BC> serevr can ping 10.8.0.6
10:11 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Read error: Operation timed out]
10:12 < Adde_BC> and firewall can ping 10.8.0.1
10:12 < Adde_BC> however the computers behind firewall cant ping 10.8.0.1
10:12 < ecrist> let's work on the first part, first
10:12 < ecrist> get netbios to share with the 10.8.0.1 network
10:13 < ecrist> make sure your client can see those shares
10:13 < Adde_BC> Once i get the network to see eachother (get the vpn link working) that is no problem...
10:13 < Adde_BC> or?
10:14 < ecrist> ok, then you need to tell all the machines on the network behind your client that for the 10.8.0.0/24 network, they need to talk to <ip_of_VPN_client>
10:14 < ecrist> route add -net 10.8.0.0/24 <ip_of_VPN_client> -p or something
10:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
10:16 -!- rb_ [~rb@c-67-163-22-139.hsd1.il.comcast.net] has joined #openvpn
10:16 < Adde_BC> Route in my client workstation: 10.8.0.0    255.255.255.0         10.8.0.6      10.10.10.20     11
10:16 < Adde_BC> Pinging 10.8.0.1 with 32 bytes of data:
10:16 < Adde_BC> Reply from 10.10.10.20: Destination host unreachable.
10:16 < Adde_BC> Request timed out.
10:17 < ecrist> netstat -rn
10:17 < ecrist> oh, wait
10:17 < rb_> Hi, I have a config.zip file with a .ovpn and .crt file in it. Can I connect to the server using the .ovpn and .crt file in one command?
10:17 < ecrist> on the vpn client, do you have ip_forwarding enabled?
10:17 < rb_> I'm using linux btw
10:17 < ecrist> and is the firewall allowing the traffic?
10:17 < ecrist> rb_: sure
10:18 < rb_> How do I do  that?
10:18 < ecrist> usually just openvpn --config file.ovpn
10:18 < ecrist> !man
10:18 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
10:18 < Adde_BC> no on the VPN server (the windows server with openVPN) i enabled ipforwarding
10:18 < rb_> but I need the .crt file too
10:18 < rb_> when I do that it gives me an error
10:19 < rb_> Should I post it?
10:19 < ecrist> !pb
10:19 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
10:19 < Adde_BC> Firewall on the server allowing everything on tap0 interface
10:19 < ecrist> !configs
10:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
10:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:19 < ecrist> rb_: the crt should be referenced in the config
10:20 < rb_> Oh
10:21 -!- neozerosv [~neozerosv@debian.ues.edu.sv] has quit [Quit: Lost terminal]
10:22 < rb_> Is it supposed to be in /etc/openvpn?
10:23 < ecrist> doesn't matter where it is
10:23 < Adde_BC> ecrist:  Firewall on the server allowing everything on tap0 interface
10:23 < rb_> Oh okay, theres nothing in that directory. So I have to create one right
10:24 < ecrist> rb_: I don't know what your'e doing
10:24 < ecrist> openvpn --config file.ovpn  should be all you need
10:24 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
10:24 < rb_> http://paste.pocoo.org/raw/331662/
10:25 < ecrist> file.ovpn should have your openvpn config, with full paths to certificates, etc
10:25 < rb_> that is what happens when I do that
10:25 < ecrist> you're not root
10:25 < rb_> oh wow
10:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:30 < rb_> *Facepalm* Looks like its working so far
10:30 < rb_> thanks
10:30 < rb_> I guess i'm connected if the initialization sequence is completed right?
10:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
10:34 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html>
10:37 < rb_> Can I local-portforward a connection, like on an ssh server?
10:38 < gladiatr> ssh functions doesn't change when using it over a tunnel, silly
10:38 < gladiatr> or are you asking if openvpn has ssh-like functionality?
10:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:39 < rb_> gladiatr, I want to connect to a server, then put '127.0.0.1:port' as proxy in firefox
10:40 < rb_> Brb
10:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:40 < gladiatr> Think of your VPN connection as a long, invisible ethernet cable that can't be cut with construction equipment :)  OpenVPN won't do it for you, but it will carry the packets for the software that will (such as SSH)
10:41 < rb_> Okay
10:41 < rb_> So I configure the application to connect with openvpn?
10:42 < rb_> What I'm trying to do is use the openvpn as a proxy for firefox
10:43 < rb_> and the only way I can think of doing that is port forwarding it to soemthing like 5150
10:43 -!- zhorX [~happyface@warp.skyhook.ca] has quit [Read error: Operation timed out]
10:43 < rb_> then connecting to a proxy in firefox like 127.0.0.1:5150
10:45 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:46 < gladiatr> rb_, no.
10:46 < rb_> I can't do that?
10:46 < gladiatr> the wrongness of your thinking threatens to overwhelm the very fabric of existence :D
10:47 < gladiatr> OpenVPN does not do this
10:47 < rb_> Please elaborate :P
10:47 -!- zhorX [~happyface@warp.skyhook.ca] has joined #openvpn
10:48 < gladiatr> OpenVPN provides an encrypted network connection--a tunnel--that acts as a conduit for packets from your client system to the network(s) on the server side of the link.  This can be private networks attached to the servers or you can configure openvpn to forward all of your client's traffic through to the other side.
10:49 < gladiatr> That's it
10:49 < rb_> Okay, I want to forward my network traffic through the openvpn tunnel to the server then
10:50 < gladiatr> !redirect
10:50 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
10:50 < gladiatr> :D
10:50  * gladiatr gives vpnHelper a cookie
10:50 < rb_> Okay thanks :)
10:50 < Bushmills> rb_: you can run a proxy on the vpn server, and use it from your browser, by giving the vpn server address
10:50 < rb_> Bushmills, Do I need a port?
10:51 < rb_> !def1
10:51 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
10:51 < Bushmills> yes, sure. the port where the proxy listens on
10:51 < rb_> Okay
10:52 < rb_> I think redirecting all my traffic will be more effective though
10:52 < Bushmills> if you don't want to connect to a proxy, but still have your traffic go through openvpn server, then redirect traffic
10:52 < rb_> yeah
10:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:52 < Bushmills> but consider that a proxy can cache stuff, and may also request ahead of the client
10:53 < ecrist> 10:28 [Freenode] -!- WALLOP tomaw:  Hi all.  Following on from issues yesterday, we're currently experiencing the result of a configuration mistake.  Sadly it's going to require a restart to  fix which will disconnect all webchat users.
10:53 < Bushmills> also, a proxy makes it easier to redirect selectively (i.e. web traffic), rather than all traffic
10:53 < ecrist> hahaha, like disconnecting webchat users is a downside
10:54 < rb_> Okay
10:55 < rb_> So if my server has all the necassary parts enabled, shouldn't my .ovpn file have all the info; like the gateway
10:56 < Bushmills> --redirect-gateway sets up the new routes
10:56 < ecrist> no, that's passed by the server, generally
10:57 < rb_> oh
10:58 < rb_> Okay so if everything is okay with the server, is there a different switch then?
10:58 < Bushmills> the power button needs to be "on"
10:59 < rb_> ..So theres no switches to redirect traffic?
10:59 < Bushmills> none beyond those you've been told already
10:59 < Bushmills> except if you're running windows, there is ..
10:59 < Bushmills> !winroute
10:59 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
10:59 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
11:00 < rb_> I'm running arch linux
11:00 < Bushmills> and of course, the recursive name server your client uses for resolving, must also respond when receiving queries from the vpn server now 
11:03 < rb_> I'm a bit confused on the redirection part, so far the in the man page i've seen something about --redirect-gateway
11:03 < Bushmills> did you read what you've been pointed to?
11:04 < Bushmills> !redirect
11:04 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
11:08 < rb_> Okay I guess that worked with only that
11:08 < rb_> I thought there was some extra configuration
11:08 < rb_> like with my core files or something
11:08 < rb_> Thanks :)
11:09 < rb_> Sorry for if I wasn't really following. thanks for the help
11:09 < rb_> Bye 
11:09 -!- rb_ [~rb@c-67-163-22-139.hsd1.il.comcast.net] has left #openvpn ["Leaving"]
11:12 -!- s7r [~s7r@74.3.165.161] has joined #openvpn
11:13 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:27 -!- Guest85059 [~OpenBSD@130.235.200.84] has joined #openvpn
11:28 < Guest85059> Some with experience of openvpn client on OpenBSD?
11:29 -!- Guest85059 is now known as Jonas[LTH]
11:29 < Jonas[LTH]> !welcome
11:29 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:29 < Jonas[LTH]> !goal
11:29 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:30 < Jonas[LTH]> !howto
11:30 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
11:30 < s7r> IP routing and IP forwarding is the same thing ? In windows I reffer
11:33 < Jonas[LTH]> I have get the error msg cannot allocate TUN/TAP dev dynamically on my openBSD 4,7 even if is says in the manual on www.openvpn.net that it should fix this dynammically. Is there anyone here with a solution for this?
11:34 < Bushmills> try specifying tun0 insttead of tun in your --dev 
11:35 < Bushmills> or tun1, whatever the next free tun device is
11:36 < s7r> Bushmills: can you please help me solve this issue.. ip routing or ip forwarding (in windows) are the same thing ?
11:37 < Bushmills> i'd first have to google what windows is
11:38 < Bushmills> in other contexts than windows, they're not exactly the same. but terminology tends to be fuzzy
11:38 < s7r> ok...
11:39 < s7r> so what's each
11:39 < s7r> what do they do
11:39 -!- dws60452 [~dws@dws3.Stanford.EDU] has joined #openvpn
11:39 < Bushmills> where forwarding relates merely to interface hopping, routing has also an addressing component in it 
11:40 < Bushmills> routing doesn't even have to involve multiple interfaces
11:41 < s7r> so if i have only 1 one public IP - i can make a VPN server out of that box
11:41 < s7r> and route client's traffic through that server?
11:41 < Bushmills> yes,sure
11:41 < s7r> where forwarding must have multiple Interfaces or public IP?
11:41 < Bushmills> when openvpn server starts, it will provide an additional interface
11:42 < Bushmills> incoming client traffic will be seen on that virtual interface
11:43 < Bushmills> it will behave like a physical NIC, but is only a software representation of one
11:43 < s7r> yes, a virtual adapter
11:43 < s7r> but IP routing has to be enabled in order to make this happen right?
11:43 < Bushmills> that the traffic to that interface comes originally through your physical NIC, is completely transparent 
11:43 < s7r> pr IP forwarding what should I enable
11:44 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html#p9557>
11:44 < Bushmills> what is "that" in context of "make that happen"?
11:46 < s7r> redirect client's entire internet traffic via the openvpn server with 1 single external public IP address
11:47 < Bushmills> routing is involved anyway, even with one single nic and no vpn.  ip forwarding will have to be added
11:47 < Bushmills> !ipforward
11:47 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
11:47 < s7r> !winipforward
11:47 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
11:47 < s7r> ah I know how to enable it
11:47 < s7r> but what does it actually do
11:47 < Bushmills> oh well, this applies to you, even with one single nic:
11:47 < Bushmills> !redirect
11:47 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
11:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 272 seconds]
11:48 < Bushmills> it allows servers to move packets between NIC boundaries 
11:49 < s7r> between the physycal internet adapter (local area connection) and tap win 32 virtual adapter?
11:49 < s7r> that is what ip forward actually does?
11:50 < Bushmills> for example, yes.
11:50 < s7r> thanks thanks thanks thanks
11:50 < s7r> i googled 1 hour an explanation
11:50 < s7r> and couldn't find it
11:50 < s7r> thanks for turning the light on in my head Bushmills
11:51 < Bushmills> np, was a small task only
11:51 < s7r> on a forum it was posted that IP forwarding stays for Forwarding the traffic addressed to the PUBLIC IP to a NAT (subnet) ip ... but that would be port forwarding / mapping
11:51 < s7r> it has nothing to do with ip forwarding as I see here right?
11:53 < Bushmills> rephrase
11:55 < s7r> somebody posted on a forum, that IP forwarding is used when you want to forward/redirect all traffic for an external public IP to a NAT (subnet internal ip). for example if you have a web page hosted on 10.0.0.1, you forward the external IP to the internal one and you can browse that page from the internet
11:56 < s7r> but this would be port forwarding / mapping 
11:56 < s7r> i assume these are total different things
11:57 < Bushmills> well, you'll have to turn on ip forwarding for that purpose, but that's not the only situation in which you need to turn ip forwarding on 
11:57 < Bushmills> port forwarding refers to something different again
11:58 < Bushmills> just "forwarding" is not very specific about what nature the forwarding is
11:58 < Bushmills> could be you mail service forwarding your snail mail to a different address
11:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:01 < s7r> ok. another strange thing
12:01 < s7r> I am currently behind a NAT on my defautl connection, i have more PCs and 1 single external IP ...
12:02 < s7r> if I scan that external IP (provided by my ISP) I have no open ports... when I open Utorrent which I enabled to use UPnP I find port 3035 open (without making any settings or port forwardings in the router).
12:03 < s7r> when I connect to the openvpn server, I connect just fine no problem but if I scan the vpn IP I can't find that port open when utorrent is running
12:05 < Bushmills> your torrent client did probably not bind to the openvpn interface.  
12:05 < Bushmills> order of starting may be a factor
12:05 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
12:05 < Bushmills> otherwise, configuration is
12:07 < s7r> the openVPN is natted to, I have as VPN IP 10.0.0.5
12:07 < s7r> the vpn server has 1 external IP both for listening on and redirecting client's traffic
12:07 < s7r> could UPnP be disabled from the VPN?
12:09 -!- Jonas[LTH] [~OpenBSD@130.235.200.84] has quit [Read error: Connection reset by peer]
12:12 -!- WinstonSmith [~true@g225031077.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
12:13 -!- Jonas[LTH] [~OpenBSD@130.235.200.84] has joined #openvpn
12:13 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:15 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:19 < s7r> UPnP is enabled by default in openvpn ? or it has to be configured
12:20 -!- swk_ [~swk@user-24-214-191-78.knology.net] has quit [Ping timeout: 255 seconds]
12:20 < ecrist> um, openvpn doesn't do UPnP
12:22 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
12:22 < s7r> it's impossible?
12:22 < s7r> well that is the problem why my torrent is not working over the vpn
12:22 < s7r> problem solved i guess
12:23 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
12:23 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
12:23 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:23 < ecrist> s7r: UPnP is something you put on a firewall
12:23 < ecrist> or a NAT device (usually one and the same)
12:24 < ecrist> openvpn is neither of those
12:24 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
12:25 < s7r> so UPnP has to be enabled in the firewall of the openvpn server ? :)
12:26 < ecrist> if, by 'openvpn server' you mean the host OS on which openvpn is executed, yes
12:26 < ecrist> the openvpn server process, however, doesn't do UPnP
12:26 < s7r> yes
12:26 < s7r> that's correct
12:26 < s7r> thank you
12:27 -!- Jonas[LTH] [~OpenBSD@130.235.200.84] has quit [Read error: Connection reset by peer]
12:28 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has quit [Quit: Leaving]
12:29 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:31 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:31 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:33 -!- sigi__ [~sigius@93-125-185-45.dsl.alice.nl] has quit [Client Quit]
12:35 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Quit: Leaving]
12:37 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
12:39 -!- Jonas[LTH] [~OpenBSD@130.235.200.84] has joined #openvpn
12:43 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
12:44 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
12:51 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
12:55 -!- Jonas[LTH] [~OpenBSD@130.235.200.84] has quit [Ping timeout: 276 seconds]
12:56 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Quit: Leaving]
12:57 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:15 < dws60452> how to troubleshoot this
13:15 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
13:15 < dws60452> http://pastebin.com/7ApLY595
13:16 < dws60452> clearly i have problem with the tun0 device, but I can't figure out what is wrong
13:20 -!- Jonas[LTH] [~OpenBSD@130.235.200.84] has joined #openvpn
13:20 < gladiatr> paste your server and client configs
13:20 < dws60452> i don't have access to server config :-(
13:21 < gladiatr> let's have the client config then :)
13:22 < dws60452> http://pastebin.com/m1TM30HH
13:24 < gladiatr> how are you starting openvpn?
13:24 < dws60452> pfexec openvpn /path/to/clientfile
13:25 < dws60452> if I try to plumb tun0, I get an error that the interface doesn't exist
13:25 < gladiatr> It won't until openvpn starts
13:26 < gladiatr> do you get the same result if you run openvpn after su - root ?
13:26 < dws60452> lemme try that
13:26 < gladiatr> I've never done the opensolaris dance, so I'm not really up on the idiosyncrasies of pfexec
13:28 < dws60452> yes i get the same error
13:29 < dws60452> Feb  3 11:31:12 hw-dws-laptop2 ip: [ID 627376 kern.error] tun0: DL_ATTACH_REQ failed: DL_BADPPA
13:29 < dws60452> Feb  3 11:31:12 hw-dws-laptop2 ip: [ID 728316 kern.error] tun0: DL_BIND_REQ failed: DL_OUTSTATE
13:30 < dws60452> those are logged to messages when I do ifconfig tun0 plumb
13:30 < dws60452> only thing I found when googling was about 64bit drivers - this is 32bit laptop
13:31 < gladiatr> did you install the tun and tap packages?
13:32 < dws60452> yes
13:32 < gladiatr> oh
13:33 < dws60452> i downloaded from http://www.whiteboard.ne.jp/~admin2/tuntap/ and did configure, make, make install
13:33 <@vpnHelper> Title: TAP driver for Solaris (at www.whiteboard.ne.jp)
13:33 < gladiatr> Yeah.  No idea.  There's nothing wrong with your openvpn config, though
13:34 < gladiatr> hrm... check this site out, perhaps.  http://www.higherpass.com/opensolaris/Tutorials/Installing-And-Configuring-Openvpn-In-Opensolaris/
13:34 <@vpnHelper> Title: OpenSolaris - Installing and Configuring OpenVPN in OpenSolaris - OpenSolaris Tutorials (at www.higherpass.com)
13:35 < dws60452> yeah i guess i could try the csw and see what happens
13:35 < dws60452> i am trying to teach myself something about compiling from source
13:35 < dws60452> but it is hard when you're not really a programmer :-(
13:35 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:35 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:36 < dws60452> thanks i may be back :-)
13:36 < gladiatr> good luck! :)
13:42 -!- s7r [~s7r@74.3.165.161] has left #openvpn []
13:54 -!- dazo is now known as dazo_afk
14:15 <@vpnHelper> RSS Update - forum: OPENVPN plugins for DreamBox <http://forums.openvpn.net/topic7507.html#p9558>
14:18 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
14:34 -!- fraggeln [fraggeln@bober.fraggelberget.nu] has joined #openvpn
14:35 < fraggeln> !welcome
14:35 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:35 < fraggeln> !goal
14:35 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:36 < fraggeln> is anyone using openvpn togeather with quagga (ospf) ?
14:39 <@vpnHelper> RSS Update - forum: Able to connect to tun, but can't ping or access anything <http://forums.openvpn.net/topic7595.html>
14:41 < krzee> some people are
14:42 < fraggeln> Yea, me to, but I have some performance issues :/
14:43 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Ping timeout: 240 seconds]
14:43 < gladiatr> I have before.
14:44 -!- meanman [~chatzilla@167.206.126.114] has joined #openvpn
14:44 < meanman> !welcome
14:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:44 < gladiatr> How many routers are you dealing with?
14:45 < meanman> !configs
14:45 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
14:45 < fraggeln> gladiatr: I have 3 quaggas and a cisco c3750
14:45 < meanman> !interface
14:45 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
14:45 < meanman> !route
14:45 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
14:45 < gladiatr> How are you connecting them?
14:46 < fraggeln> gladiatr: openvpn ;)
14:46 < gladiatr> :P
14:46 < majuk> ror, good answer.
14:46  * gladiatr bonks majuk :D
14:46 < fraggeln> server A, is the vpn-server, server B is configured as a client, and is running quagga, with 2 subnets behind.
14:47 < gladiatr> that's it?
14:47 < fraggeln> Server C us configed as a client and runs quagga as well, and has a c3750 on the inside running ospf as well.
14:47 < gladiatr> ahh
14:47 < gladiatr> ok.  what sort of openvpn connection are you using?
14:47 < fraggeln> tap.
14:47 < fraggeln> I can paste my server-config on a pastebin.
14:48 < gladiatr> hang on here..
14:48 < gladiatr> so you're not connecting B and C together?  So, A is your routing nexus
14:49 < fraggeln> correct.
14:49 < gladiatr> What OS are you using?
14:49 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html#p9560>
14:49 < fraggeln> anyway, when im running this setup I have no performance problems, but, when I configure server A and server B as openvpn-servers and have server C connect to both A and B to get some redundancy, i get very very poor performance in the network.
14:49 < fraggeln> linux debian.
14:49 < gladiatr> right.  broadcast storms
14:49 < gladiatr> probably
14:50 < gladiatr> do you have stp enabled on your bridge devices?
14:50 < fraggeln> stp?
14:50 < gladiatr> spanning tree protocol
14:50 < fraggeln> well, I have spanningtree on the cisco.
14:51 < fraggeln> dunno if they are configured on the tap-interfaces.
14:51 < gladiatr> not the tap interfaces--the bridge interfaces
14:51 < fraggeln> br0?
14:51 < fraggeln> I only have a tap0 and a tap1 interface.
14:51 < gladiatr> You can see your bridges with brctl show
14:52 < fraggeln> -su: brctl: command not found :)
14:52 < gladiatr> /sbin/brctl
14:52 < fraggeln> -su: /sbin/brctl: No such file or directory :)
14:53 < gladiatr> What you're probably seeing is a layer-2 broadcast storm.  When a broadcast goes out over your bridge, it doesn't have anywhere to stop.  If A sends to B and C and B sends to C and C sends to A and C sends to B and B sends to A and... blah
14:53 < gladiatr> meh.  /usr/sbin/
14:53 < gladiatr> at a certain point it melts down due to lack of bandwidth
14:53 < fraggeln> gladiatr: its not installed.
14:54 < gladiatr> oh... you're using routed connections over tap?
14:54 < fraggeln> yea.
14:54 < Adde_BC> in practic what will change if i use the site-to-site  parameter in openVPN, will anything change
14:54 < gladiatr> well frak me
14:54 < gladiatr> heh
14:54 < gladiatr> sorry.  I keep forgetting that works now.
14:55 < fraggeln> np mate.
14:55 < gladiatr> Can't help you then.  When I was using openvpn for ospf work, I was bridging the routers into a single layer-2 backbone for route propagation.  Not sure what problems might arise when the routed kind of connection.  I would still think you would have issues with broadcast storms.
14:56 < gladiatr> But I'm not sure how that could be mitigated at that layer
14:56 < gladiatr> I guess those would be multicast storms... meh.  Anyhow.  I'm going to shut up now. :)
14:56 < fraggeln> its a good thought tho.
14:57 < fraggeln> I will see if I can find anything about spanningtree or something.
14:57 < fraggeln> all angles now are good angles, since im stuck :/
14:58 < fraggeln> or ill just wipe everything and start over and build it from scratch :)
15:11 < meanman> hi all, can anybody help me with an openvpn dns problem?
15:11 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
15:12 < meanman> i have a router running tomatousb that runs an openvpn server that works, just can't resolve hostnames of devices on my server's lan
15:14 < Adde_BC> is it Possible to run openVPN as server and connect using built in windows pptp or l2tp?
15:15 < fraggeln> Adde_BC: afaik, no.
15:16 < meanman> anybody here use tomato based openvpn
15:16 -!- gladiatr is now known as gladiatr_afk
15:16 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
15:25 <@vpnHelper> RSS Update - forum: forwarding issue <http://forums.openvpn.net/topic7596.html>
15:29 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
15:30 < meanman> can anybody help me with trying to get dns pushed to clients?
15:42 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
15:49 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
15:50 -!- xindz is now known as xindz`off
16:01 -!- jesperj [~jesperj@unaffiliated/jesperj] has left #openvpn ["Leaving"]
16:04 -!- spike7 [spike7@unaffiliated/spike7] has joined #openvpn
16:05 < spike7> !welcome
16:05 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:05 < spike7> !goal
16:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:06 < spike7> !goal i just want a secure connection between my 64bit windows 7 pc and my linux server
16:07 < krzee> !sample
16:07 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
16:07 < krzee> !pki
16:07 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
16:07 <@vpnHelper> specially as a server (see !servercert)
16:07 < krzee> OR
16:07 < krzee> you can just use a static key config, as explained in the howto
16:07 < krzee> !howto
16:07 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
16:07 < spike7> i've already been looking at http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
16:07 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
16:07 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
16:08 < spike7> i *probably* have a firewall issue... i'm using the openvpn gui on the client, it gets stuck while at "connecting"
16:08 < krzee> see your logs
16:09 < krzee> !logfile
16:09 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
16:09 < spike7> client or server log?
16:09 < krzee> usually good to look at both
16:09 < spike7> last lines in the client log are:
16:09 < spike7> Thu Feb 03 22:04:20 2011 UDPv4 link local (bound): [undef]:1194
16:09 < spike7> Thu Feb 03 22:04:20 2011 UDPv4 link remote: 94.75.207.35:1194
16:09 < reiffert> getting stuck during connect() most probably sounds like a firewall.
16:10 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
16:10 -!- Guest73950 [~dafdc@net-188-218-185-16.cust.dsl.vodafone.it] has joined #openvpn
16:10 < krzee> true
16:10 < spike7> can i tell if it's a server or client firewall issue?
16:10 < reiffert> spike7: get a crystall ball.
16:10 < krzee> should be using verb 5 when troubleshooting firewall
16:10 < spike7> ok
16:11 < krzee> then you see each R and W
16:11 -!- BobSapp [~user@87-194-41-128.bethere.co.uk] has joined #openvpn
16:11 < reiffert> krzee: when you see a W there, what then?
16:11 < reiffert> does it mean it has reached the other side?
16:11 < reiffert> does it tell you where the firewall is?
16:11 < reiffert> no, no.
16:12 < spike7> btw, if i change the server config, will a reload be enough? or should i restart it completely
16:12 < krzee> well when its WWWWWWWWW its prolly your firewall, as opposed to the other side getting R and W
16:12 < reiffert> spike7: just curious, try port tcp/443 and udp/53 instead of udp/1194
16:12 < spike7> i have httpd and dns on those ports already
16:13 < reiffert> so stop them for the period of testing.
16:14 < spike7> ok, with verb 5 i'm not getting any R or Ws, but the server did just put this in syslog
16:14 < spike7> Feb  3 23:13:38 hosted-by ovpn-simple[27275]: Peer Connection Initiated with [AF_INET]109.224.130.237:1194
16:14 < spike7> Feb  3 23:13:39 hosted-by ovpn-simple[27275]: Initialization Sequence Completed
16:15 < meanman> my vpn is connecting, i just cannot resolve lan hostnames from a client
16:15 < reiffert> verb 5 on the server only puts those two lines?
16:15 < spike7> i'm looking in syslog, is it maybe outputting somewhere else?
16:16 < spike7> i've got the debian openvpn package from testing
16:16 < reiffert> spike7: did you restart the server?
16:16 < spike7> ah, no
16:16 < reiffert> that is /etc/init.d/openvpn restart
16:16 < reiffert> meanman: make your client use a nameserver then.
16:16 < spike7> client is saying: Thu Feb 03 22:15:31 2011 us=24000 NOTE: failed to obtain options consistency info from peer -- this could occur if the remote peer is running a version of OpenVPN before 1.5-beta8 or if there is a network connectivity problem, and will not necessarily prevent OpenVPN from running (0 bytes received from peer, 0 bytes authenticated data channel traffic) -- you can disable the options consistency check with --disable-occ.
16:17 < reiffert> spike7: and your server and client openvpn versions are?
16:18 < spike7> 2.1.3
16:18 < meanman> reiffert: i'm using tomotousb firmware on my router and running an openvpn server on that, i have specified it to advertise DNS to clients and respond to DNS, also on my ipconfig /all, the proper DNS is filled in
16:18 < reiffert> spike7: sure that both are the same?
16:19 < spike7> OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 21 2010
16:19 < spike7> OpenVPN 2.1.3 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Aug 20 2010
16:19 < reiffert> meanman: so check that your dns requests a) reach the server b) get answered by the server and c) reach back to the client.
16:20 < reiffert> krzee: any ideas on spike7?
16:20 < krzee> he prolly has weird config mismatch between client & server
16:20 < meanman> reiffert: i don't know how to do that, do you know how under windows xp
16:20 < krzee> !configs
16:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
16:20  * krzee hopes his phone works...
16:20 < reiffert> meanman: run tcpdump on your server and the equivalent on your windows box. it's called wireshark.
16:20 < spike7> !pb
16:20 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
16:21 < meanman> reiffert: cool, thanks, i'll start with that
16:21 < spike7> what's a ccd entry?
16:21 < reiffert> meanman: like this: tcpdump -n -i tun0 port 53
16:21 < reiffert> meanman: and wireshark with the expression filter: port 53 or proto ICMP
16:21 < reiffert> oh, and on the server side:
16:21 < reiffert> meanman: like this: tcpdump -n -i tun0 port 53 or proto ICMP
16:22 < meanman> okok
16:22 < reiffert> spike7: "an entry in the client config directory"
16:22 < meanman> sorry *ok
16:22 < spike7> ah ok, i don't think i have one
16:22 < reiffert> meanman: and on windows it's probably the interface named tap or tap0 or tap-win32 or something similar
16:22 < reiffert> spike7: dont be supposed to have one
16:22 < spike7> ok
16:23 < reiffert> spike7: bring configs and logs online.
16:23 < reiffert> spike7: both, server and client
16:23 < reiffert> bbl
16:23 < spike7> i'm pastebinning now
16:23 < reiffert> got to do some training for the computer science exam I'm going to write on saturday
16:26 < meanman> reiffert: might i add, i used nslookup and was able to resolve a hostname, just cannot resolve with anything else
16:30 < spike7> reiffert, krzee, http://openvpn.pastebin.ca/2044351
16:33 < spike7> turns out there were some Ws in the client log, i didn't see them there at the top
16:33 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Read error: Connection reset by peer]
16:37 -!- meanman [~chatzilla@167.206.126.114] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
16:38 < krzee> on the one without remote
16:38 < krzee> maybe listen?
16:39 < krzee> nah i guess not
16:39 < krzee> (i dont use static key, but the mini howto doesnt need listen)
16:39 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
16:40 < spike7> i'll try it, the server does have two network interfaces
16:42 < spike7> this is strange, the server is getting RWRW in it's log, but the client only has WWWWW
16:42 < krzee> oh
16:42 < krzee> looks like firewall
16:43 < krzee> like reiffert said
16:44 < krzee> client's firewall
16:45 < spike7> shouldn't the inbound udp packets get forwarded automatically because of the outbound traffic?
16:45 < spike7> i should note the client is behind NAT
16:45 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 265 seconds]
16:45 -!- BobSapp [~user@87-194-41-128.bethere.co.uk] has quit [Quit: leaving]
16:51 -!- Guest73950 [~dafdc@net-188-218-185-16.cust.dsl.vodafone.it] has quit [Read error: Connection reset by peer]
16:51 < krzee> its the tuntap device that is being blocked ;]
16:52 < spike7> blocked how?
16:52 < krzee> by your windows firewall or some other security software
16:52 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
16:52 < spike7> ok, how do i need the windows firewall set up?
16:52 < krzee> bbiab going to stores and getting haircut
16:52 < spike7> i don't have another software firewall
16:53 < spike7> what firewall rules?
16:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
16:55 < hyper_ch> windows and firewall? don't those two terms exclude one another?
16:55 < spike7> you'd think so
16:57 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
16:57 < spike7> i disabled the windows firewall for Local Area Connection 3 (the TAP-WIN32 adapter)
16:57 < spike7> but it didn't help
16:58 < reiffert> disable it for all Local Area Connections. Just for testing.
16:58 < spike7> ok
17:01 < spike7> i turned it completely off, it didn't help
17:03 < spike7> ok, wireshark time
17:05 < spike7> alright, i'm not getting anything from the server at all
17:05 < spike7> not receiving any udp packets
17:07 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 260 seconds]
17:07 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
17:10 < spike7> ah, i think i've found the problem
17:11 < spike7> i forwarded udp 1194 from my router
17:11 < spike7> Thu Feb 03 23:09:50 2011 us=682000 TCP/UDP: Incoming packet rejected from 94.75.207.100:1194[2], expected peer address: 94.75.207.35:1194 (allow this incoming source address/port by removing --remote or adding --float)
17:12 < spike7> server is sending packets on the wrong interface >_<
17:17 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
17:17 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
17:17 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:17 < spike7> adding a local directive to the server config fixed it
17:17 < spike7> thanks for your help guys
17:18 < spike7> appologies to krzee who suggested local half an hour ago ;x
17:21 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
17:28 < spike7> does anyone know the status of ipv6 support? is it supported on windows yet? in which versions?
17:30 < krzee> !ipv6
17:30 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
17:35 < spike7> hmm
17:35 < spike7> !snapshots
17:35 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
17:40 < spike7> am i to understand that i can just use bridging mode instead?
17:49 < krzee> dont even need bridging mode i dont think
17:49 < krzee> dev tap should be fine
17:49 < krzee> assuming you are trying to pass ipv6 traffic and not integrate it into the vpn
17:50 < krzee> the ipv6 patches are for like --server-ipv6
17:52 < spike7> basically what i want is to get my client on the internet via ipv6. i have a /64 block on the server, and i was hoping to be able to assign one of the address to the client
17:54 < spike7> do i need the patches for that? i think i need to get radvd to advertise to the client and have it autoconfigure
18:12 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Ping timeout: 240 seconds]
18:16 < spike7> krzee, how would i go about setting up a tap without bridging? the howto seems to say that tap == bridging
18:32 -!- SintaxBSD is now known as Sin-a
18:32 -!- Sin-a is now known as SintaxBSD
18:34 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
19:00 < krzee> a tun setup, but with dev tap
19:02 < spike7> ah yeah, i found a guide with a tap setup using server mode
19:02 < spike7> once i have that, how do i add ipv6 to it?
19:02 < krzee> dunno
19:02 < krzee> maybe someone else will
19:03 < spike7> hmm, with tap broadcasts work, right? so perhaps i can just run radvd on 10.0.0.1
19:03 < spike7> that should assign the client a v6 address
19:04 < spike7> then if i enabled ipv6 forwarding on the server would that just work?
19:24 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:43 < aef> hi, is there a way to let openvpn client automatically download the current certificate revocation list via http?
20:08 -!- albech [~thomas@124.157.245.126] has joined #openvpn
20:18 < krzee> client doesnt need the CRL
20:19 < krzee> hrm well i always figured it didnt... but i guess you can CRL a server too
20:24 <@vpnHelper> RSS Update - forum: MULTI: bad source address from client <http://forums.openvpn.net/topic7575.html#p9562>
20:26 < Kurogane> Anyone knows it's normal when i'm connect in openvpn-as and i donwload full my cpu go to 100% in win7.
20:38 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
20:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:44 -!- spike7 [spike7@unaffiliated/spike7] has quit [Quit: Leaving]
20:57 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
21:06 -!- master_of_master [~master_of@p57B561A6.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
21:08 -!- master_of_master [~master_of@p57B5601B.dip.t-dialin.net] has joined #openvpn
21:09 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
21:13 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Operation timed out]
21:13 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
21:24 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
21:26 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 240 seconds]
21:26 -!- twister004_ is now known as twister004
21:27 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:27 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:27 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:34 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Ping timeout: 240 seconds]
21:34 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
21:39 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
22:04 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
22:06 < stevieman> Im trying to get ipenvpn to run and it's failing, /var/logs/messages states Cannot load certificate file server.crt: error:02001002:system library:fopen:No such file or directory:
22:07 < stevieman> !welcome
22:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:07 < stevieman> !goal
22:07 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:08 < stevieman> !goal I want to browse the net over my vpn
22:08 < stevieman> Im trying to get openvpn to run and it's failing, /var/logs/messages states Cannot load certificate file server.crt: error:02001002:system library:fopen:No such file or directory:
22:09 < stevieman> !sample
22:09 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
22:10 < stevieman> !howto
22:10 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
22:17 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
22:25 -!- twister004 [~chatzilla@59.90.34.167] has quit [Read error: Connection reset by peer]
22:37 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
23:22 -!- no_maam [~no_maam@gate.cdc.informatik.tu-darmstadt.de] has quit [Ping timeout: 255 seconds]
23:31 -!- grapsus [~grapsus@acces1040.res.insa-lyon.fr] has quit [Ping timeout: 240 seconds]
23:35 -!- grapsus [~grapsus@acces1040.res.insa-lyon.fr] has joined #openvpn
23:47 -!- no_maam [~no_maam@gate.cdc.informatik.tu-darmstadt.de] has joined #openvpn
--- Day changed Fri Feb 04 2011
00:03 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
00:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
00:08 -!- no_maam [~no_maam@gate.cdc.informatik.tu-darmstadt.de] has quit [Ping timeout: 250 seconds]
00:08 -!- no_maam [~no_maam@gate.cdc.informatik.tu-darmstadt.de] has joined #openvpn
00:12 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
00:17 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Client Quit]
00:30 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 265 seconds]
00:30 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
00:33 -!- allencch [~allencch@203.82.95.6] has joined #openvpn
00:35 < allencch> hello, i am a newbie about using openvpn with almost zero knowledge about vpn. i would like to ask is it possible to create an openvpn server, then through the server, access the internet with a mobile broadband?
00:45 < zeshoem> allencch: is the device connecting to the openvpnserver going to be a computer or a mobile device?
00:46 < allencch> zeshoem,  the mobile device will be connected to the computer
00:47 < allencch> zeshoem, i am thinking that, a computer which can connected to the internet, will become an openvpn server
00:47 < zeshoem> so the mobile device is to be the openvpn client?
00:48 < allencch> zeshoem, sorry that, the mobile broadband is a wireless broadband device for internet connection, something like ethernet connection
00:50 < allencch> that means, there is no mobile device, but a computer connected to the internet through a mobile broadband
01:01 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:12 < zeshoem> allencch: I am confused. Openvpn needs 2 devices, a server and a client
01:13 < zeshoem> the computer with mobile broadband = server I assume
01:13 < zeshoem> whats the client?
01:13 < allencch> zeshoem, can i make the computer as a server, at the same time as a client? just like a http server with a web-browser as a client at the same time?
01:14 < zeshoem> What are you trying to achieve by this setup?
01:14 < allencch> i would like to learn the setup of vpn
01:15 < zeshoem> I would recommend using 2 devices
01:15 -!- fraggeln [fraggeln@bober.fraggelberget.nu] has left #openvpn []
01:15 < zeshoem> even if they are virtual, say running on vmware or something
01:15 < allencch> zeshoem, okay
01:15 < allencch> i would try it
01:18 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 260 seconds]
01:21 < allencch> zeshoem, thank you
01:21 -!- allencch [~allencch@203.82.95.6] has quit [Quit: Leaving]
01:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:35 <@vpnHelper> RSS Update - forum: forwarding issue <http://forums.openvpn.net/topic7596.html#p9563>
01:41 <@vpnHelper> RSS Update - forum: Able to connect to tun, but can't ping or access anything <http://forums.openvpn.net/topic7595.html#p9564>
02:03 < anitxor> http://cryptoanarchy.org/files/vpn/VPN-client.tar ← free & simple OpenVPN proxy
02:14 -!- grapsus [~grapsus@acces1040.res.insa-lyon.fr] has quit [Ping timeout: 250 seconds]
02:16 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Ping timeout: 250 seconds]
02:21 < kraut> moin
02:21 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html#p9565>
02:43 -!- alhadi [~thunderst@ner-as44531.alshamil.net.ae] has quit [Read error: Connection reset by peer]
02:46 -!- alhadi2 [~thunderst@178.18.17.41] has joined #openvpn
02:46 -!- alhadi2 [~thunderst@178.18.17.41] has quit [Write error: Connection reset by peer]
02:52 -!- dazo_afk is now known as dazo
02:53 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
02:55 -!- UnterPerro_ [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
02:55 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
02:55 -!- UnterPerro_ [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Client Quit]
03:00 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 250 seconds]
03:02 -!- jmm_ is now known as madamPIPI
03:02 <@vpnHelper> RSS Update - forum: CND script OpenVpn <http://forums.openvpn.net/topic7587.html#p9566>
03:03 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
03:05 -!- ricky [~ricky@fedora/ricky] has left #openvpn []
03:42 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
03:56 -!- Jonas[LTH] [~OpenBSD@130.235.200.84] has quit [Ping timeout: 240 seconds]
04:05 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:05 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:16 -!- zeshoem [~mnathani@70.54.143.106] has quit []
04:20 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
04:27 -!- Blues-Man [~bluesman@host74-30-dynamic.27-79-r.retail.telecomitalia.it] has joined #openvpn
04:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
04:33 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:57 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 272 seconds]
05:01 <@vpnHelper> RSS Update - forum: OpenVPN on Amazon EC2 Windows 2008 Instances <http://forums.openvpn.net/topic7597.html>
05:14 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Read error: Connection reset by peer]
05:21 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
05:22 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:53 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 260 seconds]
06:00 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:01 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
06:01 -!- maxJadi [~maxJadi@dhcp-166-74.nomad.chalmers.se] has joined #openvpn
06:01 -!- maxJadi [~maxJadi@dhcp-166-74.nomad.chalmers.se] has quit [Changing host]
06:01 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:05 -!- nb [~nb@fedora/nb] has joined #openvpn
06:12 -!- s7r [~s7r@74.3.165.161] has joined #openvpn
06:25 -!- Blues-Man [~bluesman@host74-30-dynamic.27-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
06:39 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
06:39 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
06:40 -!- s7r [~s7r@74.3.165.161] has left #openvpn []
06:40 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has quit [Ping timeout: 272 seconds]
06:41 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has joined #openvpn
06:45 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
06:47 -!- corretico [~laguilar@201.201.44.82] has quit [Quit: Leaving]
06:50 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
07:08 -!- gryzli [~gryzli@94.155.42.130] has joined #openvpn
07:10 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
07:22 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
07:24 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
07:30 -!- uni4dfx [~uni4dfx@89-212-108-44.dynamic.t-2.net] has joined #openvpn
07:31 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
07:32 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
07:33 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
07:45 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
07:46 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
07:46 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
07:46 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Remote host closed the connection]
07:46 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
07:46 -!- sigi [~sigius@93.125.185.45] has joined #openvpn
07:46 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Remote host closed the connection]
07:46 -!- sigi [~sigius@93.125.185.45] has quit [Client Quit]
07:46 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
07:49 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
07:50 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
07:51 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:59 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
08:02 -!- moldy [~rene@unaffiliated/moldy] has joined #openvpn
08:02 < moldy> hi
08:03 < moldy> "'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)"
08:03 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
08:03 < moldy> is that normal? what role does the ip address 10.8.0.9 play here?
08:03 -!- alhadi [~thunderst@109.169.41.47] has joined #openvpn
08:03 -!- kerfe [~a@47.pool85-60-129.dynamic.orange.es] has joined #openvpn
08:04 -!- spike7 [spike7@unaffiliated/spike7] has joined #openvpn
08:05 < moldy> no idea what is going on here... this obviously confuses some recent linux clients (networkmanager)
08:05 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
08:06 < moldy> openvpn seems to push 10.8.0.9 as the default gateway... but i have not assigned or configured that ip address anywhere
08:07 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
08:08 < hyper_ch> !tell moldy [welcome]
08:08 < moldy> and on the client, 10.8.0.10, which is supposed to be the openvpn server, is the client itself. wtf...
08:09 < moldy> hyper_ch: thanks
08:09 < Bushmills> moldy: that's the p-t-p address
08:09 < moldy> ah sorry, i got confused
08:10 < moldy> but there is still something fishy going on here, i believe
08:10 < Bushmills>  /net30 only gives an address space of 4 addresses, in which "remote", i.e. other end of tunnel, needs to be - which is expressed as the point-to-point address
08:10 < Bushmills> only two usable addresses, actually
08:11 < moldy> !/30
08:11 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
08:11 < Bushmills> !ubuntu
08:11 <@vpnHelper> "ubuntu" is dont use network manager!
08:12 < moldy> hehe
08:12 < uni4dfx> When I use bridged mode, does this mean ALL vpns need to have the same network address?
08:12 < moldy> Bushmills: the problem i am coming from is exactly that manual openvpn connection with ubuntu clients works, while NM does not (users report that they can connect to the vpn, but are unable to ping the vpn server)
08:13 < Bushmills> moldy: let them ping the server vpn address, not the p-t-p address
08:13 < Bushmills> and check their routes
08:13 < moldy> Bushmills: they were trying the server address, and least that's what they told me... trying to reproduce it right now
08:15 < uni4dfx> for example, my LAN is 192.168.1.0/24... but I want my VPN clients to get addresses from 10.8.0.0/24... is that possible?
08:15 < Bushmills> sure.
08:15 < Bushmills> but - what do you need bridging for?
08:16 < uni4dfx> full LAN access
08:16 < Bushmills> what would be less "full" of LAN access, were you to use a routed setup?
08:17 < uni4dfx> well for example i wouldn't see any samba shares
08:17 < Bushmills> !wins
08:17 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
08:17 < Bushmills> !tunortap
08:17 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
08:17 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
08:17 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
08:17 < Bushmills> see #2
08:18 < uni4dfx> yeah, LAN gaming too
08:18 < Bushmills> a bridge just connects the bridged interfaces
08:18 < uni4dfx> i'm using tap already and everything works well, it's just causing lots of conflicts because almost every LAN in the world is also 192.168.1.0/24
08:19 < Bushmills> what subnets you use on the network is not affected by bridge. only by interfaces listening and responding to traffic
08:20 < uni4dfx> but i can only set the IP to br0
08:20 < uni4dfx> i can't set it to eth1 or tap0
08:22 < Bushmills> the br doesn't even need an ip address
08:22 < uni4dfx> every tutorial i've seen disagrees with that
08:22 < Bushmills> and yes, you can have bridged interfaces keep the addresses, with the br having none
08:24 < uni4dfx> so which IP do i put under "server-bridge" then?
08:24 < uni4dfx> the config explicitly says it needs to be the bridge device
08:25 < uni4dfx> which i'm assuming is br0, and not tap0 or eth0/1...
08:25 < Bushmills> try none, or 0.0.0.0
08:25 < gladiatr_afk> the network config scripts of debian derivatives get confused if you try to bring up an interface without an IP address.  That's probably what you're seeing in the sites you're reading uni4dfx.
08:25 -!- gladiatr_afk is now known as gladiatr
08:26 < uni4dfx> gladiatr that sounds very likely
08:26 < Bushmills> funny, i run debian with an bridge without ip address
08:26 -!- alhadi [~thunderst@109.169.41.47] has quit [Ping timeout: 240 seconds]
08:27 < Bushmills> though that's not for openvpn, but for virtual servers, their virtual interfaces on a bridge with the host interface
08:27 < uni4dfx> Bushmills so you set the IP to eth and tap interfaces respectively and leave br0 without one?
08:27 < moldy> when a kubuntu 10.10 client connects with NM, it cannot reach the vpn server, nor the internet. output of route -n: http://nopaste.info/89cccd7d8a.html (sorry for the bad formatting)
08:28 < moldy> to me, it seems that it's using the vpn server as the default gateway?
08:28 < gladiatr> Bushmills, might have been something that was fixed.  I had to hack the startup scripts on sarge.  It offended my sensibilities to have to assign even a junk IP to a bridge device to get it to come online.
08:29 < Bushmills> moldy: 79.228.242.59 is the vpn server? has it been set up to to NAT and ip forwarding?
08:29 < Bushmills> to do ..
08:30 < Bushmills> gladiatr: ah, ok. i didn't use the debian init scripts for bridge setup
08:30 < moldy> Bushmills: NAT no, but ip forwarding could be the problem here...
08:31 < moldy> Bushmills: the vpn server is also acting as an ipv6 gateway... could this be causing the problem here?
08:31 < Bushmills> moldy: as that server became gateway for default route, you'd need NAT to reach internet
08:31 < Bushmills> !redirect
08:31 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
08:31 < moldy> Bushmills: i understand that, but i don't quite understand why it is becoming the gw for that route
08:33 < gladiatr> meditate on the words of vpnHelper and you will be enlightened (or at the very least, informed)
08:33 < moldy> i am pretty confident i didn't tell it to do this. and it's only an issue with some clients (network-manager)
08:33 < moldy> gladiatr: i don't want redirecting.
08:33 < gladiatr> then remove it from your server configuration :)
08:34 < moldy> gladiatr: it's not there
08:34 < gladiatr> that's the only option that would cause your default route to be over-written
08:34 < moldy> gladiatr: then why is it only overwritten for NM clients, not for windows, os x, non-nm linux?
08:34 < gladiatr> NM?
08:35 < moldy> gladiatr: network-manager
08:35 < gladiatr> oh dearlilbabyjesusfetus.  
08:36 < gladiatr> hrm... if you can answer why the network manager openvpn plugin acts the way it does, when  it does, and where it does, please let me konw.
08:36 < gladiatr> s/kno/kno
08:36 < moldy> ;p
08:37 < gladiatr> Yeah.  I can't help you there.  I wasted 90 minutes downloading an ubuntu 10.10 iso, installing it in a VM to try to get some insight why one of our developers couldn't get that plugin to work.  It worked great for me.  With the identical config, it wouldn't even connect on his laptop.
08:37 < moldy> i'm in a similar situation
08:38 < Bushmills> moldy: it becomes gateway because either the server pushes a redirect-gateway, or the client has redirect-gateway in its config
08:38 < gladiatr> My solution was to borrow his laptop over the lunch break, copy his certs and a vpn config into /etc/openvpn and teach him the mysterious ways of starting things via init scripts (or in this case, ubuntu's half-assed 'service' utility)
08:38 < Bushmills> "why is it only overwritten for NM clients, not for windows..."
08:38 < Bushmills> !winroute
08:38 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
08:38 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
08:39 < moldy> i am pretty confident it's the client. server config: http://pastebin.com/vsPHE0qZ
08:40 < Bushmills> doesn't matter which one, as long as one does it.
08:41 < moldy> it matters for fixing it, doesn't it?
08:42 < uni4dfx> Bushmills could you please share your interfaces config file, i wanna see how you did it :)
08:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:42 < Bushmills> depends whether you want traffic redirected through vpn server
08:42 < Bushmills> if no, there's nothing to fix
08:43 < gladiatr> moldy, this isn't a blow-off.  Really.  I'd be glad to help if I could, but I have found no easy way to troubleshoot NM BS--I would bring this up with the network-manager people
08:43 < moldy> gladiatr: yeah, i agree. thanks.
08:44 < moldy> Bushmills: i agree there is nothing to fix openvpn-wise, but apparently there is something to fix nm-wise.
08:44 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
08:44 < gladiatr> network-manager: sometimes, when you need fertilizer, a steaming pile of shit is just what the doctor ordered...
08:44 < Bushmills> uni4dfx: http://scarydevilmonastery.net/snap/1296830624146325466d.png - note that interfaces doesn't set up bridge or virtual interfaces. the commented out section at the end is essentially what happens, outside of interfaces
08:45 < uni4dfx> thanks!
08:47 -!- WinstonSmith [~true@e178178147.adsl.alicedsl.de] has joined #openvpn
08:47 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
08:47 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
08:47 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
08:50 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
08:52 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
08:52 -!- uni4dfx [~uni4dfx@89-212-108-44.dynamic.t-2.net] has quit [Ping timeout: 265 seconds]
08:56 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:57 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has joined #openvpn
09:01 -!- s7r [~s7r@74.3.165.161] has joined #openvpn
09:04 -!- uni4dfx [~uni4dfx@89-212-108-44.dynamic.t-2.net] has joined #openvpn
09:11 < stevieman> Im trying to get openvpn to run and it's failing, /var/logs/messages states Cannot load certificate file server.crt: error:02001002:system library:fopen:No such file or directory:
09:11 < stevieman> the .crt files are located in /etc/openvpn/keys
09:12 < hyper_ch> !tell stevieman [welcome]
09:13 < stevieman> which is where I am trying to run service openvpn start
09:13 < stevieman> hyper_ch: do I need to do goal etc everytime I log into the channel?
09:14 < stevieman> !goal
09:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:14 < gladiatr> lol
09:15 < gladiatr> stevieman, use qualified paths. 
09:15 < gladiatr> stevieman, /etc/openvpn/keys/yourfile.crt
09:16 < stevieman> gladiatr: I tried that in the server.conf file as per the howto I found here last night
09:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
09:17 < gladiatr> remove the user and group options from the configuration file
09:18 < gladiatr> there are two reasons why you might be getting that error message: the file doesn't exist (as per the given path) or the user openvpn is running as doesn't have the correct permissions.
09:19 < stevieman> gladiatr: still failed just going to check the logs
09:19 < gladiatr> pastebin your server config
09:20 < stevieman> k one second
09:23 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
09:23 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
09:23 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:25 < stevieman> gladiatr: http://pastebin.com/R3mcmrZX
09:27 < gladiatr> ok.  show me the output of ls -l /etc/openvpn |grep keys
09:28 < stevieman> gladiatr: drwx------ 2 root root  4096 Feb  3 23:28 keys
09:28 < gladiatr> ok.  show me the output of ls -l /etc/openvpn/
09:29 < stevieman> gladiatr: http://pastebin.com/CYS4r84W
09:29 < gladiatr> ok.  show me the output of ls -l /etc/openvpn/keys
09:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
09:30 < stevieman> gladiatr: http://pastebin.com/T0yFk9fQ
09:31 < gladiatr> You're on linux, yes?
09:31 < stevieman> yes
09:31 < stevieman> CentOS
09:31 < gladiatr> what's the output from /usr/sbin/sestatus
09:31 < stevieman> disabled
09:34 < gladiatr> hrm... paste your log
09:36 < stevieman> gladiatr: http://pastebin.com/SpKc1ANB
09:36 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
09:36 < gladiatr> try again with verb 4
09:36 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:37 -!- xindz`off is now known as xindz
09:38 < stevieman> gladiatr: at the bottom of server.conf correct?
09:38 < gladiatr> sure
09:39 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
09:42 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
09:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:44 < stevieman> gladiatr: Failed again
09:44 < stevieman> http://pastebin.com/8LDf5XJX
09:44 < stevieman> sorry that's /var/log/messages
09:45 < gladiatr> that's ok.  The information is all there
09:45 < gladiatr> what's the output of lsmod |grep tun
09:48 < s7r> the openvpn server listens for incoming client connections on the physycal NIC (default internet connection with public IP) or on the Tap win 32 virtual adapter?
09:48 < stevieman> gladiatr: I get nothing
09:48 < gladiatr> s7r, physical NIC
09:48 < gladiatr> stevieman, modprobe tun
09:49 < gladiatr> then try starting openvpn again
09:49 < stevieman> I did the modprobe and got this: FATAL: Could not load /lib/modules/2.6.18-194.8.1.el5.028stab070.5/modules.dep: No such file or directory
09:49 < s7r> gladiatr: thanks. and the virtual adapter will be active after client gets connected, in order to route his traffic there right?
09:50 < gladiatr> s7r, It actually activates when the openvpn server starts up
09:50 < gladiatr> but yeah, it'll come into play network-wise when a client connects
09:50 < s7r> thanks sir
09:51 < gladiatr> np
09:51 < s7r> if i would want to disable UPnP for NATed openvpn clients
09:51 < s7r> where should i look into the firewall of tap win 32 adapter
09:51 < s7r> or firewall of the default physycal NIC
09:52 < s7r> currently the entire internet traffic for clients is routed through the vpn
09:52 < gladiatr> Error: knowledge and/or desire to acquire knowledge in regards to stated topic exceeded.  Please rephrase your question.
09:52 < gladiatr> *bzzzt*
09:53 < gladiatr> s7r, Yeah.  I've never tired trying to get the windows firewall to interact with tap, but it *should* work just the same as any other device.
09:53 < s7r> as far as I can see yes, at least it should 
09:53 < s7r> but I don't know where to make the change
09:53 < s7r> in win tap 32 adapter firewall
09:53 < s7r> or the physycal nic firewall
09:54  * ecrist didn't think this was #networking-201
09:54 < s7r> the server has only 1 public IP and all clients get IP with 10.0.0.1 / 24
09:54 < gladiatr> ecrist, hehe
09:54 < s7r> but they are NATed and they browse the internet with the vpn server IP
09:54 < s7r> i want to disable UPnP for them wile on the vpn because their utorrent applications opens port on the vpn public IP
09:54 < gladiatr> s7r, blur your vision and pretend the tap device is an actual physical device.
09:55 < gladiatr> s7r, because logically, it is
09:55 < gladiatr> no different
09:55 < gladiatr> than the physical.
09:55 < gladiatr> blue pill/red pill
09:58 < s7r> should I bridge the virtual adapter with the physycal NIC ?
09:58 < gladiatr> You're over-thinking this.  The VPN is currently functional, right?
09:59 < s7r> yep
09:59 <@vpnHelper> RSS Update - forum: Route delete error on win7 64bit <http://forums.openvpn.net/topic7592.html#p9568>
09:59 < s7r> you are right
09:59 < s7r> :)
10:01 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has joined #openvpn
10:02 < Varazir> Hello, I have some questions about OVPN AS, routing problem in windows 7
10:02 < gladiatr> !factoids search AS
10:02 <@vpnHelper> 'ask', 'winpass', 'pastebin', '2.1-winpass-script', 'easy-rsa-unix', 'broadcast-relay', 'authpass', 'paste', 'nopaste', 'password-only', 'bcast', 'AS', 'basic', 'strip-passphrase', and 'change-passphrase'
10:03 < gladiatr> !AS
10:03 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
10:03 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
10:03 < Varazir> I know 
10:03 < gladiatr> Sweet :)
10:04 < Varazir> some of you works there 
10:04 < ecrist> right, but this still isn't the openvpn as support channel
10:04 < Varazir> I know 
10:04 < ecrist> :)
10:07 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
10:09 < ambro718> Hi. I'm having problems creating another TAP-Win32 driver in Windows 7 (64-bit). I click on the "Add a new TAP virtual ethernet adapter" shortcut, but it just says "tapinstall failed". Running tapinstall manually also produces the same "tapinstall failed" error, with no details.
10:09 < Varazir> well I have to wait untill I get to TS more :P the connection goes bad :( 
10:14 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
10:17 < ecrist> ambro718: try running it as an administrator
10:18 -!- Bert_2 [~bert@ip-62-235-169-30.dsl.scarlet.be] has joined #openvpn
10:19 -!- dRaziel [~draziel@188.122.249.79] has joined #openvpn
10:19 < dRaziel> hello 
10:22 < Bert_2> Hi, I'm having some issues with the most basic setup in the documentation. I'm using my own desktop as a VPN server to bypass my NAT router when i'm away, but the documentation asks for 2 IPs, can it be the same IP or what does the "ifconfig" option actually need ?
10:23 < stevieman> gladiatr: So I got the tun/tap enabled on my vps and now when I do a service openvpn start I get this message: openvpn-status.log: unrecognized service
10:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:23 < gladiatr> @_o
10:23 < gladiatr> paste the log--again at verb 4 please
10:27 < dRaziel> Hi, At me Ubuntu 10.10 The help is necessary to me I connect the client to the openvpn to the server and there is here a such  SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)  SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)   Connection on the server какбы проиходит but несоздается tap the interface  In what there can be a problem?  In server broad gulls client-connect command failed: could not 
10:27 < dRaziel> client-connect command failed: could not execute external program  PUSH: Received control message: 'PUSH_REQUEST'  PUSH: Received control message: 'PUSH_REQUEST'
10:28 -!- p3rror [~mezgani@41.140.156.35] has joined #openvpn
10:31 < stevieman> gladiatr: http://pastebin.com/50GY0XKc
10:31 < gladiatr> #
10:31 < gladiatr> Feb  4 19:14:13 207767 openvpn[9941]: Initialization Sequence Completed  < looks like you're in business
10:35 < stevieman> gladiatr: Oh well that is cool, I was a little confused why I didn't get an "OK" and got that unrecongnized service message
10:36 < ambro718> ecrist: thanks, it worked
10:36 < ecrist> :)
10:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
10:39 -!- gladiatr is now known as gladiatr_afk
10:41 < Bert_2> Does the default IP and subnet in the option "server 10.8.0.0 255.255.255.0" need to be the one in your network, or specifically another one ?
10:45 < Bushmills> another, unused, one, that subnet becomes the subnet of which vpn addresses are assigned to vpn clients
10:47 < Bushmills> 10.217.83.0 255.255.255.0 would be a good one
10:48 < Bert_2> Bushmills: k, thx
10:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:50 < Bushmills> i use 10.86.80.0   ->   86 is ascii of "V",  80 of "P".  there was no space for "N" anymore
10:50 < Bert_2> is it okey to use the default: 10.8.0.0 (my local network is 192.168.1.0)
10:50 < Bert_2> ?
10:51 < Bushmills> chances of collisions are higher because everybody seems to use 10.8.0.0
10:51 < Bert_2> Bushmills: collisions when other VPN server are introduced into the network, you mean ?
10:52 < Bushmills> yes. like, a client has another vpn connection to another server, which also assigns from 10.8.0.0
10:55 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
10:56 < Bert_2> Bushmills: I'm using the 172.16.0.0 range now, I don't know any service using that range
10:57 < Bushmills> 10.x.x.x allows more random choice, though
11:00 < dRaziel> guys, In what there can be a problem, on the server and the client writes 
11:00 < dRaziel> client-connect command failed: could not execute external program  PUSH: Received control message: 'PUSH_REQUEST' 
11:00 < dRaziel> Also there is no interface
11:00 < dRaziel> Prompt please
11:01 < Bushmills> what's did you set script-security to?
11:02 < dRaziel> Bushmills: script-security 2
11:03 < Bushmills> read in man page about client-connect
11:03 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
11:04 < Bushmills> sorry, not clearly said there. read about --script-security
11:05 < Bushmills> also specify full path to external program or script
11:08 -!- grapsus [~grapsus@acces1181.res.insa-lyon.fr] has joined #openvpn
11:12 -!- WinstonSmith [~true@e178178147.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:13 < stevieman> So now I'm trying to setup an openvpn client on a Vista box. I grabbed 2.1.4 and when I run the client.opvn file it says it cannot find the ca.crt file even though I specified the path. If I do c:\certs\ca.crt I get an error message about backslashes if I do c:\\certs\ca.crt or "c:\\certs\ca.crt" if can't find the file again
11:18 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
11:18 <@dazo> stevieman: have you tried c:/certs/ca.crt ?
11:19 < stevieman> dazo: um no, let me try that right now
11:20 < stevieman> dazo: No such file message again
11:21 <@dazo> hmm ... could it be some file access restrictions?
11:21 -!- gladiatr_afk is now known as gladiatr
11:21 <@dazo> also on the c:\certs dir?
11:21 -!- p3rror [~mezgani@41.140.156.35] has quit [Ping timeout: 240 seconds]
11:21 < gladiatr> it is.  It's that infernal UCE business.
11:21 < gladiatr> Put the certs in your \program files\openvpn\config directory
11:21 < gladiatr> and yeah... you have to use \\ instead of a single \
11:22 -!- alhadi [~thunderst@109.169.41.47] has joined #openvpn
11:22 <@dazo> cool!  windows is finally getting a grasp of security features ... it's gotta be feeling way too strict for windows users ... but I do like it!
11:23 < gladiatr> heheh
11:23 <@dazo> it's actually a similar issue on Fedora 14 with SELinux ... certificates needs to be stored in ~/.certs ... or else OpenVPN will not be allowed to read the certs 
11:24 <@dazo> to be honest, that's not a bad idea at all
11:24 <@dazo> (or in /etc/openvpn of course)
11:26 < stevieman> ok, so I wonder how I handle directories names with spaces I get an error at c:\\Program
11:28 < gladiatr> stevieman, actually just had a look at the config I put together for the windows users here.  openvpn/win automatically sets the config root to openvpn\config
11:29 < gladiatr> try not qualifying your paths
11:29 < gladiatr> with the certificates in the config directory
11:29 < stevieman> gladiatr: I tried without qualifying paths, it didn't work
11:30 < gladiatr> where are your certificates, though?
11:30 < stevieman> I tried with Program_Files and now I am getting a message about the client1.crt file
11:30 < stevieman> in config
11:34 -!- p3rror [~mezgani@41.140.98.230] has joined #openvpn
11:34 -!- gladiatr is now known as gladiatr_afk
11:39 < stevieman> here is the full error I am getting on the client1.crt http://pastebin.com/Kc6KSB81
11:50 -!- WinstonSmith [~true@e178178147.adsl.alicedsl.de] has joined #openvpn
11:52 < dRaziel> The client at connection becomes isolated on
11:52 < dRaziel> SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)  SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
11:52 < dRaziel> please help me) guys)0
11:58 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
12:00 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
12:00 < stony> hi girls, guys
12:00 < dRaziel> hi
12:00 < stony> listen up, following scenario:
12:01 -!- p3rror [~mezgani@41.140.98.230] has quit [Ping timeout: 240 seconds]
12:01 < stony> i have this nice and shiny windows network, running inside 10.1.1.0/24, and i have one of those open sauce firewalls, which is used as router and as openvpn endpoint
12:01 < stony> the clients are connected to openvpn and use layer3 inside the tunnel
12:02 < stony> so i enable proxy arp for as specific subnet of the /24 subnet and the packets are forwarded as they should
12:02 < stony> ip address is learned from a radius server, but this is another discussion
12:02 < stony> now, when one of those shiny windows servers, broadcast their existance to 10.1.1.255 i say "hey mr firewall, be a nice guy and copy that packet over to the tun device of openvpn" 
12:03 < stony> so i get a "roger that" and the broadcast packet is copied
12:03 < stony> the question now is: how can i tell openvpn to forward this packet to all the clients?
12:03 < stony> i can set iroute for the broadcast to all client connections, but then the packet is not copied
12:03 < stony> it's more like "first one wins"
12:03 < stony> any ideas?
12:03 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:06 < Bert_2> I think I have a VPN running between my laptop and my desktop now, what is the best way to check whether it is working ?
12:06 < stony> Bert_2: ping the other endpoint
12:07 < Bert_2> stony: odd, both the client and the server can ping the server, but none can ping the client
12:08 < stony> Bert_2: who's the server and the client? how come that you have three endpoints in a 2 machine connection?
12:09 < Bert_2> stony: the server is 172.16.0.1 and the client is 172.16.0.2
12:09 < Bert_2> both of these are in my regular network as well 192.168.1.100 & 192.168.1.158
12:09 < stony> Bert_2: you have to enable ip forwarding on the server
12:10 < stony> and you have to tell the systems in 192.168.1.0/24 how they can reach 127.16.0.2
12:10 < Bert_2> is that an option in server.conf ?
12:10 < stony> Bert_2: i have no clue what you're using
12:11 < Bert_2> k
12:11 < Bert_2> I'll just try for a bit ;)
12:11 < Bert_2> thx anyway
12:11 < stony> is it a linux box ?
12:11 < Bert_2> yeah
12:11 < stony> Bert_2: you know something about routing and arp and stuff?
12:11 < Bert_2> I'm using 2 linux boxes based on the default config on the documentation site
12:11 < Bert_2> I know just the bare minimum
12:12 < Bushmills> "the server can ping the server" ... "but none can ping the client"   i.e. the client can't ping the client - that is, can't ping itself?
12:12 < Bert_2> Bushmills: correct, it can't ping itself in the VPN subnet
12:12 < Bushmills> what do you ping?
12:12 < Bert_2> so, I guess the client is not connected
12:12 < Bert_2> "ping 172.16.0.2"
12:12 < Bushmills> where did you get the client ip address from?
12:13 < Bert_2> ifconfig
12:13 < stony> Bert_2: the easiest way is todo a bridge between the vpn clients and the local network
12:13 < Bushmills> you're sure that's not the p-t-p address you're trying to ping?
12:13 < stony> Bert_2: then you can just ping the systems
12:13 < Bert_2> ow wait, yes it is
12:13 < stony> Bert_2: but you have a bit of overlay, because layer2 is transported
12:13 < Bert_2> it is the p-t-p address
12:13 < Bert_2> what I'm trying to do is make sure the VPN is working
12:14  * Bushmills runs away, screaming
12:14 < Bert_2> Bushmills: sorry man, VPN and networking is not my thing
12:14 < stony> Bert_2: [x] i want to read the routing howto
12:14 < Bert_2> stony: thx, will do
12:14 < stony> Bert_2: [x] i want to read the ISO/OSI model and explanations
12:14 < Bert_2> is it on the documentation page
12:14 -!- dRaziel [~draziel@188.122.249.79] has left #openvpn ["Может и вернусь"]
12:14 < Bert_2> cause the openvpn site is very messy
12:14 < stony> Bert_2: [x] i want to read something about (R)ARP
12:15 -!- p3rror [~mezgani@41.248.185.254] has joined #openvpn
12:15 < hyper_ch> you scared Bushmills away?????? noooooooooooooo................ :(((((((((((((((((
12:15 < stony> Bert_2: [x] i want to read something of $packetfilter_of_choice
12:15 < stony> Bert_2: you have to make sure either routing, brouting or bridging is working
12:15 < stony> Bert_2: if this is not the case, your vpn will never work
12:16 < stony> Bert_2: it's not on the openvpn site
12:17 < stony> Bert_2: those are networking fundamentals
12:21 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
12:37 -!- p3rror [~mezgani@41.248.185.254] has quit [Ping timeout: 240 seconds]
12:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:41 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
12:41 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
12:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
13:05 -!- Bert_2 [~bert@ip-62-235-169-30.dsl.scarlet.be] has quit [Remote host closed the connection]
13:11 -!- p3rror [~mezgani@41.140.43.132] has joined #openvpn
13:16 -!- p3rror [~mezgani@41.140.43.132] has quit [Ping timeout: 240 seconds]
13:17 -!- alhadi [~thunderst@109.169.41.47] has quit [Ping timeout: 276 seconds]
13:23 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
13:32 -!- p3rror [~mezgani@41.140.27.108] has joined #openvpn
13:35 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
13:35 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
13:35 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
13:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
13:38 -!- dazo is now known as dazo_afk
13:43 -!- p3rror [~mezgani@41.140.27.108] has quit [Ping timeout: 255 seconds]
13:45 -!- soulse [~me@i.am.soulse.org] has left #openvpn []
13:55 -!- Soci3ty [~Soci3ty@tango127.server4you.net] has joined #openvpn
13:56 <@vpnHelper> RSS Update - forum: Can connect to VPN and get IP but not ping <http://forums.openvpn.net/topic7598.html>
14:15 -!- Lenhix [~lenhix@190.85.44.26] has joined #openvpn
14:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
14:34 -!- Lenhix [~lenhix@190.85.44.26] has quit [Ping timeout: 245 seconds]
14:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:39 -!- Lenhix [~lenhix@190.85.44.26] has joined #openvpn
14:53 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
15:14 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
15:14 <@vpnHelper> RSS Update - forum: how to connect servers openvpn on windows <http://forums.openvpn.net/topic7591.html#p9570>
15:15 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
15:16 -!- gorkhaan [~gorkhaan@87.229.108.75] has joined #openvpn
15:18 -!- p3rror [~mezgani@41.140.102.28] has joined #openvpn
15:23 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
15:24 < steve> what would cause windows 7 to ignore a route of 0.0.0.0 mask 0.0.0.0 via openvpn for _certain_ routes? I get "destination host unreachable" from the openvpn TAP adapter... literally am pulling my hair out
15:24 < steve> if i add a manual route for these rogue routes to force it through the remote gateway (through openvpn) it works
15:25 < steve> I really don't understand why 0.0.0.0 isn't catching everything
15:28 < krzee> steve, anything more specific
15:28 < steve> never mind, I think all my subnets for the LANs were screwed
15:28 < steve> subnets were overlapping all over the place
15:28 < krzee> (any more specific routes will override
15:42 -!- grapsus [~grapsus@acces1181.res.insa-lyon.fr] has quit [Ping timeout: 265 seconds]
15:52 -!- WinstonSmith [~true@e178178147.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
15:53 -!- Lenhix [~lenhix@190.85.44.26] has quit [Ping timeout: 260 seconds]
15:55 -!- p3rror [~mezgani@41.140.102.28] has quit [Ping timeout: 240 seconds]
15:58 -!- Lenhix [~lenhix@190.85.44.26] has joined #openvpn
16:07 -!- p3rror [~mezgani@41.140.45.165] has joined #openvpn
16:12 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has quit [Ping timeout: 240 seconds]
16:17 -!- grapsus [~grapsus@acces1181.res.insa-lyon.fr] has joined #openvpn
16:19 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
16:26 -!- gryzli [~gryzli@94.155.42.130] has quit [Quit: Leaving]
16:26 <@vpnHelper> RSS Update - forum: Router Setup <http://forums.openvpn.net/topic7599.html>
16:26 < stony> steve: your problem is, that 0.0.0.0 mask 0.0.0.0 is killing the vpn connection itself
16:26 < stony> steve: you have to add a 32bit route 1.2.3.4/32 via $gateway to make sure the vpn itself works
16:27 < stony> steve: and then you can override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 
16:27 < stony> somewhere in the faq or howto on openvpn.net
16:28 < reiffert> !def1
16:28 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
17:00 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
17:01 -!- Lenhix [~lenhix@190.85.44.26] has quit [Quit: Mindwall!!]
17:03 -!- Bert_2 [~bert@ip-62-235-169-30.dsl.scarlet.be] has joined #openvpn
17:04 -!- p3rror [~mezgani@41.140.45.165] has quit [Ping timeout: 246 seconds]
17:05 -!- kerfe [~a@47.pool85-60-129.dynamic.orange.es] has quit [Ping timeout: 255 seconds]
17:06 < Bert_2> My client is clearly not working, what should I look for: pastebin.com/Ytix2j5n I used the configuration as described in the openvpn documentation
17:11 < Bert_2> my bad, I got it working
17:13 -!- Bert_2 [~bert@ip-62-235-169-30.dsl.scarlet.be] has quit [Remote host closed the connection]
17:18 -!- gorkhaan [~gorkhaan@87.229.108.75] has quit [Read error: Operation timed out]
17:19 -!- luneff [~yury@84.51.213.147] has joined #openvpn
17:21 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
17:42 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
17:48 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
17:50 -!- WinstonSmith [~xxxxx@e178178147.adsl.alicedsl.de] has joined #openvpn
17:56 -!- p3rror [~mezgani@41.140.43.35] has joined #openvpn
18:10 -!- WinstonSmith [~xxxxx@e178178147.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
18:36 -!- luneff [~yury@84.51.213.147] has quit [Quit: Leaving]
18:43 <@vpnHelper> RSS Update - forum: Able to connect to tun, but can't ping or access anything <http://forums.openvpn.net/topic7595.html#p9572>
18:50 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Ping timeout: 240 seconds]
18:51 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
19:03 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
19:31 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:42 -!- xindz is now known as xindz`off
19:55 -!- s7r [~s7r@74.3.165.161] has left #openvpn []
20:09 -!- no_maam [~no_maam@gate.cdc.informatik.tu-darmstadt.de] has quit [Ping timeout: 246 seconds]
20:09 -!- no_maam [~no_maam@gate.cdc.informatik.tu-darmstadt.de] has joined #openvpn
20:27 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
20:28 -!- `mx [~mikey@zoidberg.ghettowebhosting.com] has joined #openvpn
20:29 < `mx> I am having issues getting my openvpn srv to src the client ip to the dst hosts. It keep showing the main ip of my openvpn server.  
20:30 < `mx> anyone know how to set it so when i connect to the dst it is my vpn ip that the srv hands out?
20:43 -!- spike7 [spike7@unaffiliated/spike7] has quit [Quit: Leaving]
20:46 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:53 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
21:06 -!- master_of_master [~master_of@p57B5601B.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
21:07 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
21:08 -!- master_of_master [~master_of@p57B52C2F.dip.t-dialin.net] has joined #openvpn
21:22 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
21:32 -!- N|KO [niko@174.89.243.98] has joined #openvpn
21:32 < N|KO> hey guys, I have openvpn installed on my iphone, it works fine... but it always disconnects.. does anyone have any advices? the openvpn on windows boxes has no issue...
21:41 -!- albech [~thomas@124.157.245.126] has joined #openvpn
21:45 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
22:17 <@vpnHelper> RSS Update - forum: OpenVPN routing fails, but only sometimes. (windows client) <http://forums.openvpn.net/topic7600.html>
22:23 -!- d1b [~db@d1b.org] has joined #openvpn
22:23 < d1b> hi um
22:29 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
22:36 < stevieman> is anyone still arond?
22:48 <@vpnHelper> RSS Update - forum: OpenVPN GUI Server IP <http://forums.openvpn.net/topic7601.html>
22:55 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
23:53 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
23:54 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
--- Day changed Sat Feb 05 2011
00:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 260 seconds]
00:12 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
00:20 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
00:29 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
02:11 -!- kerfe [~a@47.pool85-60-129.dynamic.orange.es] has joined #openvpn
02:12 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 272 seconds]
02:13 -!- rot13 [~var@81.20.132.64] has joined #openvpn
02:18 -!- rot13 [~var@81.20.132.64] has quit [Ping timeout: 272 seconds]
02:19 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
02:23 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
02:24 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
02:29 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 260 seconds]
02:29 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
02:34 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 265 seconds]
02:35 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
02:39 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 255 seconds]
02:40 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
02:45 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
02:46 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
02:51 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 260 seconds]
02:51 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
02:55 -!- zeshoem [~mnathani@70.54.143.106] has joined #openvpn
02:56 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
02:57 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
03:01 -!- kerfe1 [~a@77.pool85-60-147.dynamic.orange.es] has joined #openvpn
03:02 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 245 seconds]
03:02 -!- SintaxBSD [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has quit [Ping timeout: 276 seconds]
03:02 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
03:04 -!- kerfe [~a@47.pool85-60-129.dynamic.orange.es] has quit [Ping timeout: 250 seconds]
03:04 -!- Kurogane [~kuro@190.87.95.13] has quit [Read error: Connection reset by peer]
03:06 -!- p3rror [~mezgani@41.140.43.35] has quit [Ping timeout: 255 seconds]
03:06 -!- SintaxBSD [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has joined #openvpn
03:12 -!- SintaxBSD [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has quit [Ping timeout: 240 seconds]
03:17 -!- SintaxBSD [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has joined #openvpn
03:17 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
03:27 < Bushmills> `mx: your openvpn server has been set up to NAT client traffic?
03:53 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
03:53 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
03:53 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
03:55 <@vpnHelper> RSS Update - forum: Route (windows) traffic through openVPN gateway <http://forums.openvpn.net/topic7602.html>
03:57 -!- juhovh [~jvahaher@xmms2/developer/juhovh] has quit [Ping timeout: 240 seconds]
03:57 -!- SintaxBSD [~heloworld@pool-96-252-202-20.tampfl.fios.verizon.net] has quit []
04:23 -!- juhovh [~jvahaher@kekkonen.cs.hut.fi] has joined #openvpn
04:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
04:37 <@vpnHelper> RSS Update - forum: Router Setup <http://forums.openvpn.net/topic7599.html#p9576>
04:43 <@vpnHelper> RSS Update - forum: OpenVPN GUI Server IP <http://forums.openvpn.net/topic7601.html#p9577>
05:02 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
05:18 -!- venom00ut [~dafdc@unaffiliated/venom00] has joined #openvpn
05:49 <@vpnHelper> RSS Update - forum: VPN gateway tunel for private browsing <http://forums.openvpn.net/topic7603.html>
05:57 -!- alhadi [~thunderst@85.17.20.89] has joined #openvpn
06:01 <@vpnHelper> RSS Update - forum: How to check if source IP of the client is "a given one"? <http://forums.openvpn.net/topic7590.html#p9579>
06:02 -!- xindz`off is now known as xindz
06:11 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has quit [Remote host closed the connection]
06:13 -!- WinstonSmith [~true@g225031035.adsl.alicedsl.de] has joined #openvpn
06:18 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
06:25 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
06:28 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
06:31 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
06:39 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
06:55 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
07:18 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Remote host closed the connection]
07:19 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
07:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:19 -!- stony is now known as Guest27729
07:26 < N|KO> hey guys, I have openvpn installed on my iphone, it works fine... but it always disconnects.. does anyone have any advices? the openvpn on windows boxes has no issue...
07:26 -!- venom00ut [~dafdc@unaffiliated/venom00] has quit [Quit: ☃]
07:28 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
07:30 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
07:35 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Quit: ☃]
07:35 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
07:36 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
07:37 < Bushmills> log files may give a clue
07:38 < Bushmills> or --keepalive could fix that
07:40 -!- grapsus [~grapsus@acces1181.res.insa-lyon.fr] has quit [Remote host closed the connection]
07:45 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
07:49 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:49 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
07:49 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
07:49 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:50 -!- Cain [~Geek@unaffiliated/cain] has quit [Client Quit]
07:51 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:53 -!- Cain [~Geek@unaffiliated/cain] has quit [Client Quit]
07:57 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:02 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Quit: Leaving.]
08:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
08:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
08:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:22 -!- Tera [giga@unaffiliated/tera] has quit [Ping timeout: 255 seconds]
08:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:26 < N|KO> hey, keepalive 10 120 is set on the server side..
08:27 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
08:29 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
08:32 < N|KO> Bushmills I am using vpn for listening to pandora radio because I am in canada
08:33 < N|KO> I am wondering, whats a bigger battery drain, openvpn or an ssh tunnel
08:33 < N|KO> cause I can also tunnel -D8080 and use as socks to listen to the radio, i have an american vps
08:33 < N|KO> :)
08:47 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection timed out]
08:48 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
08:51 -!- luneff [~yury@84.51.213.147] has joined #openvpn
08:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
08:55 <@vpnHelper> RSS Update - forum: OpenVPN GUI Server IP <http://forums.openvpn.net/topic7601.html#p9580>
08:59 -!- p3rror [~mezgani@41.140.38.201] has joined #openvpn
09:04 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
09:09 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
09:09 -!- p3rror [~mezgani@41.140.38.201] has quit [Read error: Connection reset by peer]
09:12 -!- smartphone [~fish@c-76-26-209-236.hsd1.sc.comcast.net] has joined #openvpn
09:12 < smartphone> !welcome
09:12 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:13 < smartphone> !redirect
09:13 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
09:13 < venom00ut> N|KO, openvpn involves a virtual interface, routing and all the rest, an ssh tunnel is much simpler
09:13 < smartphone> !goal
09:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:14 < venom00ut> however I don't think it's an decisive factor on battery life 
09:22 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
09:24 -!- bitterman [~yury@84.51.213.147] has joined #openvpn
09:26 -!- Guest27729 [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Operation timed out]
09:27 -!- luneff [~yury@84.51.213.147] has quit [Ping timeout: 245 seconds]
09:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:36 -!- smartphone [~fish@c-76-26-209-236.hsd1.sc.comcast.net] has left #openvpn []
09:53 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
10:00 < `mx> Is there a way to have both full and split tunnels depending on a persons login? 
10:02 -!- Blues-Man [~bluesman@host74-30-dynamic.27-79-r.retail.telecomitalia.it] has joined #openvpn
10:11 < reiffert> `mx: what's the difference between full and split?
10:11 < reiffert> `mx: you might want to read about client-config-dir. can have different options on per client certificate basis:
10:11 < reiffert> !ccd
10:11 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
10:13 -!- bitterman [~yury@84.51.213.147] has quit [Read error: Connection reset by peer]
10:13 -!- bitterman [~yury@84.51.213.147] has joined #openvpn
10:29 -!- Adde_BC [~AddeBC@c193-150-231-214.bredband.comhem.se] has quit [Ping timeout: 240 seconds]
10:34 -!- p3rror [~mezgani@41.248.106.247] has joined #openvpn
10:37 -!- Blues-Man [~bluesman@host74-30-dynamic.27-79-r.retail.telecomitalia.it] has quit [Ping timeout: 272 seconds]
10:45 -!- AddeBC [~AddeBC@c193-150-231-214.bredband.comhem.se] has joined #openvpn
10:46 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
10:46 -!- stony is now known as Guest40849
10:47 -!- Guest40849 is now known as gisikon
10:47 -!- p3rror [~mezgani@41.248.106.247] has quit [Ping timeout: 240 seconds]
10:49 -!- Blues-Man [~bluesman@host74-30-dynamic.27-79-r.retail.telecomitalia.it] has joined #openvpn
10:56 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
10:59 -!- darth_bitterman [~yury@84.51.213.147] has joined #openvpn
10:59 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
10:59 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
10:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:59 -!- jambooda [~cog@unaffiliated/jambooda] has joined #openvpn
11:01 -!- p3rror [~mezgani@41.140.156.163] has joined #openvpn
11:01 -!- lteo [~lteo@lteo-1-pt.tunnel.tserv3.fmt2.ipv6.he.net] has quit [Ping timeout: 260 seconds]
11:02 -!- bitterman [~yury@84.51.213.147] has quit [Ping timeout: 240 seconds]
11:02 -!- lteo [~lteo@lteo-1-pt.tunnel.tserv3.fmt2.ipv6.he.net] has joined #openvpn
11:04 -!- jambooda [~cog@unaffiliated/jambooda] has quit [Read error: Connection reset by peer]
11:12 -!- p3rror [~mezgani@41.140.156.163] has quit [Ping timeout: 240 seconds]
11:25 < `mx> reiffert: full vpn is where the default route is munipulated and split is where you only have specific routes
11:25 -!- cyrus_mc [~cyrus@70.49.157.138] has joined #openvpn
11:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:34 -!- cyrus_mc [~cyrus@70.49.157.138] has quit [Quit: leaving]
11:34 < reiffert> `mx: then ccd is your thing.
11:41 -!- Lenhix [ElChaman@190.156.59.24] has joined #openvpn
11:44 <@vpnHelper> RSS Update - forum: How to set rights for user to run OpenVPN client (Linux) <http://forums.openvpn.net/topic7604.html>
11:54 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
11:59 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
12:00 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
12:09 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 240 seconds]
12:09 < steve> is it possible to push a route to a client with a specific gateway also specified?
12:11 -!- gisikon is now known as stony
12:11 < stony> steve: ehr, you always push the gateway with the route
12:12 < stony> steve: without gateway no route
12:12 < steve> well i've googled and found examples which just include a netblock and a subnet
12:12 < steve> no gateway
12:12 < steve> push "route 192.168.4.0 255.255.255.0" << like that
12:12 < stony> steve: you have to push a route with the gateway
12:13 < steve> no gateway in sight
12:13 < steve> where abouts would I specify the gw?
12:13 < stony> this makes the pushing machine the gateway
12:13 < steve> ah
12:13 < steve> what would be the syntax to spcify a gw outright?
12:13 < stony> steve: man openvpn
12:14 < stony> --route network/IP [netmask] [gateway] [metric]
12:14 < stony> push "route 1.2.3.0/24 1.2.3.4"
12:14 < steve> so the same syntax but with the gw on the end
12:14 < steve> yeah
12:14 < steve> thanks
12:14 < stony> and read the manualk
12:14 < stony> really
12:16 < steve> :P
12:18 -!- bitterman [~yury@84.51.213.147] has joined #openvpn
12:18 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
12:21 -!- darth_bitterman [~yury@84.51.213.147] has quit [Ping timeout: 240 seconds]
12:21 -!- Blues-Man [~bluesman@host74-30-dynamic.27-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
13:00 -!- WinstonSmith [~true@g225031035.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
13:09 -!- p3rror [~mezgani@41.140.170.8] has joined #openvpn
13:12 -!- xindz is now known as xindz`off
13:15 -!- WinstonSmith [~true@e178182071.adsl.alicedsl.de] has joined #openvpn
13:32 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
13:35 -!- BugDave [~macks@unaffiliated/mackss] has joined #openvpn
13:36 -!- bba [~bba@93.1.40.113] has joined #openvpn
13:46 < BugDave> has anyone here used zeroshell vmware for mac?
13:49 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
13:50 < BugDave> i'm really having a hell of a time with it :-/
13:54 -!- xindz`off is now known as xindz
13:56 -!- BugDave [~macks@unaffiliated/mackss] has quit [Quit: Leaving]
14:00 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
14:00 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
14:08 -!- p3rror [~mezgani@41.140.170.8] has quit [Ping timeout: 240 seconds]
14:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
14:17 -!- WinstonSmith [~true@e178182071.adsl.alicedsl.de] has quit [Read error: Connection reset by peer]
14:18 -!- WinstonSmith [~true@e178182161.adsl.alicedsl.de] has joined #openvpn
14:18 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
14:22 -!- p3rror [~mezgani@41.140.154.234] has joined #openvpn
14:36 -!- lteo [~lteo@lteo-1-pt.tunnel.tserv3.fmt2.ipv6.he.net] has quit [Ping timeout: 260 seconds]
14:36 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
14:37 -!- lteo [~lteo@lteo-1-pt.tunnel.tserv3.fmt2.ipv6.he.net] has joined #openvpn
14:45 -!- p3rror [~mezgani@41.140.154.234] has quit [Ping timeout: 240 seconds]
14:54 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has joined #openvpn
14:58 -!- p3rror [~mezgani@41.140.154.162] has joined #openvpn
15:00 < stevieman> !welcome
15:00 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:00 < stevieman> !goal to browse the web over my VPN
15:00 < stevieman> !logs
15:00 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
15:01 < stevieman> where would I find the logs for openvpn on ubuntu?
15:06 < ecrist>  
15:18 < stevieman> when I try to start my openvpn client on ubuntu it fails and I'd like to figure out why. /var/log/messages has nothing in it for openvpn
15:35 -!- p3rror [~mezgani@41.140.154.162] has quit [Ping timeout: 240 seconds]
15:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
15:48 < Bushmills> logs are where you told openvpn to put them
15:56 < stevieman> I installed Openvpn with apt-get and I don't see anything in client.conf regarding logs
16:09 -!- p3rror [~mezgani@41.140.159.195] has joined #openvpn
16:13 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
16:14 -!- p3rror [~mezgani@41.140.159.195] has quit [Ping timeout: 240 seconds]
16:18 -!- dws60452 [~dws@dws3.Stanford.EDU] has quit [Ping timeout: 255 seconds]
16:23 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
16:26 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
16:28 -!- p3rror [~mezgani@41.140.36.143] has joined #openvpn
16:31 -!- gorkhaan [~gorkhaan@87.229.108.75] has joined #openvpn
16:34 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
16:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:39 < Bushmills> that's why there are no logs
16:46 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:57 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
16:59 -!- bitterman [~yury@84.51.213.147] has quit [Quit: Leaving]
17:00 -!- p3rror [~mezgani@41.140.36.143] has quit [Read error: Connection reset by peer]
17:07 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
17:11 -!- gorkhaan [~gorkhaan@87.229.108.75] has quit [Read error: Operation timed out]
17:12 -!- gorkhaan [~gorkhaan@87.229.108.75] has joined #openvpn
17:14 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has joined #openvpn
17:18 -!- kerfe1 [~a@77.pool85-60-147.dynamic.orange.es] has quit [Ping timeout: 255 seconds]
17:22 -!- WinstonSmith [~true@e178182161.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
17:27 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:30 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
17:30 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
17:40 -!- p3rror [~mezgani@41.140.44.146] has joined #openvpn
17:46 -!- p3rror [~mezgani@41.140.44.146] has quit [Ping timeout: 276 seconds]
17:49 -!- WinstonSmith [~true@e179016163.adsl.alicedsl.de] has joined #openvpn
18:00 -!- AddeBC [~AddeBC@c193-150-231-214.bredband.comhem.se] has quit []
18:01 -!- AddeBC [~AddeBC@c193-150-231-214.bredband.comhem.se] has joined #openvpn
18:04 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
18:04 < EO_> Hi peoples.
18:05 < EO_> For whatever reason, I'm trying to get killall -HUP openvpn working as documented.  ie: openvpn re-reads config, and keeps running.  But instead it keeps exiting.  After fixing many permission issues, I'm stuck on the following error after a HUP:
18:05 < EO_> Feb  5 16:03:08 jo openvpn[19347]: Note: Cannot ioctl TUNSETIFF tun0: Operation not permitted (errno=1)
18:06 < EO_> I have it set to persist-tun, and have defined "dev tun0"
18:07 < AddeBC> After creating a site-to-site network, is it possible to get stations to respond with there hostnames? WHat have i missed in setup?
18:07 < EO_> AddeBC: define "respond with their hostnames".  Sounds like a DNS issue, unrelated to VPN.
18:08 < AddeBC> SMBHostnames... for exampel ping SEREVR1 instead of Ping 10.8.0.6
18:09 < EO_> Oh.  Doesn't SMB require they be on the same broadcast domain?  Are you using tap?
18:09 < AddeBC> using tun
18:09 < EO_> PS: I think the actual protocol is called WINS
18:10 < AddeBC> on the same net you usually can ping hostnames without a wins server
18:10 < nDuff> WINS also has a unicast variant
18:10 < nDuff> though it takes a little work to set up
18:10 < EO_> but that requires being in the same ethernet segment.  aka: broadcast domain
18:10 < EO_> which tun will NOT do
18:10 < AddeBC> ok, then its not important then it would be easier to setup a local dns ;)
18:10 < EO_> you need to do an ethernet bridge using tap, if you expect that
18:11 < EO_> or just setup DNS as god intended =)
18:11 < AddeBC> Thanks for the quick response though... i was just curious if i had missed some setting :)
18:12 < EO_> I suspect noone will solve my -HUP problem though.
18:12 < nDuff> EO_, eh? the unicast version of WINS, by definition, doesn't require being in the same broadcast domain
18:12 < AddeBC> Im a quick learning noob... 2 days ago ide never touched openVPN, now ive setup a site to site with three remote networks and a L2TP client login :)
18:13 < AddeBC> So thanks for info :)
18:13 < EO_> nDuff: he was saying without WINS
18:14 < nDuff> ahh.
18:14 -!- gorkhaan [~gorkhaan@87.229.108.75] has quit [Ping timeout: 245 seconds]
18:15 < EO_> heh, soon as I re-config'd my openvpn to listen on 1194, I immediately started getting attacked.  nice.
18:15 < EO_> from some australian IP
18:16 < ecrist> I've never had my openvpn instance attacked
18:16 < nDuff> ...OpenVPN is easy enough to harden (preauth keys, chroot invocations, etc) that I'd think folks would choose easier targets.
18:17 < EO_> 60.240.100.132:58599 WARNING: Bad encapsulated packet length from peer (4930), which must be > 0 and <= 1543 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attemping restart...]
18:17 < EO_> grep for that maybe ?
18:18 < ecrist> I assure you, I've not gotten attacked.
18:18 < ecrist> not to say it cannot happen, but thus far, it has not.
18:18 < EO_> oh.  turns out this isn't new at all.  must be cuz I've been running it on TCP:443 and people do HTTPS scans.
18:19 < ecrist> that is contrary to what you stated above...
18:19 < ecrist> 18:15:40 < EO_> heh, soon as I re-config'd my openvpn to listen on 1194, I immediately started getting attacked.  nice.
18:19 < EO_> ecrist: let me explain
18:19 < ecrist> that comment implies you only started getting attacked after moving to 1194
18:19 < EO_> it's been listening on *:443 for a long time
18:19 < EO_> and working well
18:20 < EO_> today I tried to make -HUP work, but when trying to bind() :443 as openvpn user the process got denied cuz the port # is < 1024
18:20 < EO_> so re-config'd it to listen on the 1194 default (>1024) and that allowed the permissions to allow it.  I also wrote a firewall re-direct rule to forward all :443 -> :1194
18:20 < EO_> so it's listening on both
18:21 < EO_> I just noticed the attack-like messages now, and thought it was due to the move to 1194, but further log searching has shown the messages for a long time
18:21 < EO_> (that was a lot of typing)
18:21 < Bushmills> EO_: do you drop privileges, with --user or --group?
18:22 < EO_> Bushmills: yea
18:22 < Bushmills> that may be the cause
18:22 < EO_> yeah, for sure.  But I thought persist-tun wouldn't need to re-open tun0
18:23 < Bushmills> "Don't close and reopen TUN/TAP device  or  run  up/down  scripts across SIGUSR1..." 
18:24 < Bushmills> try USR1 instead of HUP
18:24 < EO_> doh!
18:24 < EO_> ok, I see my error now.  HUP doesn't respect persist-tun.
18:25 < EO_> but, USR1 doesn't re-read config
18:25 < EO_> so the whole point of signalling is lost :(
18:25 < EO_> (at least in my intended use of those signals)
18:26 < EO_> oh well.  it's no biggie.  a whole-service restart will just put the clients offline temporarily.
18:27 < EO_> On a completely different note, is it possible to have a client push routes to the server without the server knowing what they might be?  Like on server side say 'pull', and on client side say 'push "route 1.2.3.4 255.255.255.0"'?
18:28 < Bushmills> you can execute client-connect script on server
18:28 < EO_> Sorta like OSPF route-sharing between peers, not a centralized routing administration
18:28 < Bushmills> but i don't know a mechanism within openvpn to communicate routes from client to server
18:29 < ecrist> What bushmills said, but I'd suggest OSPF or BGP if you'er going to do stuff like that
18:29 < EO_> wonder what happens if you put pull in server config :)
18:29 < EO_> Feb  5 16:29:39 jo openvpn[3932]: Options error: --pull cannot be used with --mode server
18:29 < EO_> wonder no more!
18:31 < EO_> ecrist: yeah, I thought about that.  I do run OSPF on this router that hosts the OVPN server.  But, I'm not sure it's do-able.
18:31 < ecrist> it is doable
18:31 < ecrist> !bgp
18:31 < ecrist> !ospf
18:31 < ecrist> there is a post or wiki article about it
18:31 < ecrist> let me find it
18:32 < ecrist> here's someone that setup RIP 
18:32 < ecrist> http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting
18:32 <@vpnHelper> Title: OpenVPN/RIPRouting - Secure Computing Wiki (at www.secure-computing.net)
18:32 < EO_> as you do that, let me show the problam
18:32 < EO_>     inet 192.168.45.1 peer 192.168.45.2/32 scope global tun0
18:32 < EO_> hrm, or I'll just read the damn web page 1st :)
18:32 < ecrist> :)
18:33 < EO_> If a link goes down, I want routes to change so that traffic can be carried through other VPNs in a mesh network. <-- that's hot
18:34 < ecrist> there are some pretty smart people around here.
18:35 < EO_> ok, his #1 point on "what didn't work" is why I thought it wouldn't work.
18:35  * EO_ reads on.
18:36 < EO_> and #2 I also thought would be busted.
18:36 < ecrist> :)
18:38 < EO_> doesn't p2p kill the ability to support windows clients though? :/
18:38 < ecrist> no, I do not think so.
18:38 < ecrist> perhaps old versions, but not any longer
18:38 < EO_> and I quote: Only use when none of the connecting clients are Windows systems.
18:39 < EO_> (right from openvpn man page)
18:40 < ecrist> oh, well there's your answer
18:40 < EO_> well this is quite the quagmire
18:41 < nDuff> EO_, topology p2p is outdated in favor of topology subnet
18:42 < nDuff> EO_, ahh, you're saying this in the context of the RIPRouting page? p2p != topology p2p
18:42 < nDuff> EO_, "p2p" referred to in the RIPRouting page is the non-server mode
18:43 < EO_> bwah?!
18:43 < EO_> there's different definitions of p2p?
18:43 < nDuff> EO_, ...as in, the mode OpenVPN 1.x used to always use.
18:44 < EO_> I also have not used topology subnet.  I see it's brand new in 2.1
18:45 < nDuff> EO_, ...aka the mode that's mandatory when using static key authentication
18:45 < nDuff> ...so yes, there are different definitions of "p2p". "topology" isn't relevant in non-server mode at all.
18:46 < EO_> I think I grok.
18:47 < nDuff> *nod*. "p2p" meaning there isn't a client and a server, they're just equal peers.
18:48  * EO_ wonders what the implications of switching for cli-srv to p2p are
18:48 < EO_> for=from
18:48 < ecrist> p2p can only be two end points
18:49 < EO_> I guess all the peers have to play nice in terms of IP allocations
18:49 < ecrist> i.e. one to one, whereas with --mode server, you can have multiple client connect to a single server
18:49 < EO_> ah
18:50 < EO_> you guys are incredibly helpful :)
18:50 < EO_> so now I wonder if this brand new subnet topology can solve the dynamic routing problem without resotrting to p2p mode!
18:50 < ecrist> quite possibly
18:51 < nDuff> topology subnet still leaves you with a hub-and-spoke model
18:52 < EO_> nDuff: which is fine for me actually.  as long as each spoke can announce routes into the hub, via OSPF.
18:52 < EO_> (and there's no iroute hassles)
18:53 < EO_> I guess I should try to setup a sample system with topo subnet and see what it looks like
18:54 < EO_> unless someone here is running a subnet topo and can paste their tun0...
19:01 < ecrist> EO_: follow the instructions on that wiki page and you'll be on your way
19:03 < EO_> Yeah I understand the page, but it's not as awesome as I want it.
19:16 < EO_> 2048 bit diffe hellman on Atom CPU.  This is amusing.  :)
19:32 -!- xindz is now known as xindz`off
19:33 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 240 seconds]
19:34 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
19:41 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 272 seconds]
19:42 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
19:42 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
19:53 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
20:00 < EO_> oooo this is wonderful!
20:00 < EO_> I think the subnet mode has a very good chance of solving this dynamic routing problem
20:01 < EO_> I setup a sample server/client, and I see how it works now
20:01 < EO_> hrm, should setup a 2nd client and test if client-to-client works
20:03 < EO_> perhaps a windows client this time
20:05 < EO_> hrm, not off to a great start.  an error during installing tap-win32 device driver.  d'oh.
20:06 -!- WinstonSmith [~true@e179016163.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:23 < EO_> hrm, where do I get "version 8.2 or higher of the TAP-Win32 driver"?  For Win 7 x64.
20:26 < EO_> nevermind, I was using the GUI version.  the official has the new driver nicely included.
20:28 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
20:30 < EO_> now, let's try some route sharing
20:30 < EO_> and especially in client-to-client mode
20:31 -!- Kurogane [~kuro@190.87.95.13] has joined #openvpn
20:32 < stevieman> How do I turn on logging for a apt-get installed openvpn client?
20:33 < nDuff> stevieman, ...through the config file, same as a client installed any other way? Search for "syslog" in the man page.
20:34 < stevieman> nDuff: thanks
20:34 < nDuff> (or just --log)
20:40 < stevieman> arg how is it that I can't get log working
20:42  * nDuff isn't clairvoyant. (What are you trying, and what is it doing?)
20:45 < stevieman> I'm trying to launch the client using /etc/init.d/openvpn start and I get a fail on the try. My server is logging to /var/log/messages but my client machine running ubuntu isnt logging there so I don't know why it is failing
20:46 < EO_> stevieman: /var/log/syslog
20:46 < nDuff> stevieman, when I say "what are you trying", I'm asking for the log-related lines in your config file.
20:46 < stevieman> nDuff: sorry
20:47 < stevieman> I misunderstood
20:47 < nDuff> stevieman, ...depending on those lines, the contents of your syslog.conf may also be relevant.
20:47 < stevieman> nDuff: I see some entries in syslog
20:50 < EO_> routing: fail :(
20:51 < EO_> the server's openvpn instance doesn't even send the packets out
20:52  * EO_ wonders if the server openvpn process even sees the routed packets
20:54 < EO_> oh you little bugger.  openvpn DOES see the ping requests.  Just drops them dead instead of forwarding them on.
20:55 < nDuff> do you have an appropriate iroute defined?
20:55 < EO_> nope, the whole point was to bypass the need for iroutes and let normal routing tables handle it all
20:56 < nDuff> this is in p2p or client/server mode?
20:56 < EO_> client/server with subnet topology
20:56 < nDuff> ahh, right.
20:56 < EO_> .3 is a client that holds a routable subnet 192.168.56.0/24
20:57 < EO_> the server (.1) has a route 192.168.56.0/24 via .3
20:57 < EO_> the kernel sends the packets to the tun0 as the kernel routing table dictates, and openvpn process does the read()s of the packets
20:57 < EO_> but then I guess openvpn figures "my internal routing table has no 192.168.56.0/24, so screw this packet"
20:58  * nDuff doesn't expect you to be able to get away from iroutes when using client/server mode
20:59 < nDuff> ...didn't contradict ecrist earlier because, frankly, I've been away from OpenVPN for rather a long time.
20:59 < EO_> You'd figure the default would be for openvpn to consult the kernel routing table for 192.168.56.0/24, see that it's .3, and then see that .3 _IS_ iroutable
20:59 < nDuff> ...well, maybe I'm misunderstanding what you're trying to do.
21:00  * nDuff actually has his own work he should be focusing on, though.
21:01 < EO_> yeah, I'm totally blowing off work too =)
21:01 < EO_> but screw them, it's the weekend!
21:01 < EO_> this project have a git repo?
21:01 < EO_> or, any kinda repo?
21:02 < nDuff> http://svn.openvpn.net/
21:02 <@vpnHelper> Title: OpenVPN Subversion Repository (at svn.openvpn.net)
21:02 < EO_> thanks
21:02 < stevieman> should I have ca.key or ca.crt?
21:02 < EO_> stevieman: only on the server
21:03 < nDuff> stevieman, it's only the CA certificate needed to validate certificates signed by that CA.
21:03 < stevieman> so my client needs a ca.crt correct?
21:04 < nDuff> to validate the server's certificate, yes.
21:05 < EO_> you can do all that + auth with a single .p12 file though, no?
21:05 < nDuff> *nod*
21:06 -!- master_of_master [~master_of@p57B52C2F.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
21:07 < EO_> wonder if I can mod the code to consult kernel routing table before dropping the packet
21:07 < EO_> that'd be keep
21:07 < EO_> keen
21:08 -!- master_of_master [~master_of@p57B52FE0.dip.t-dialin.net] has joined #openvpn
21:29 < EO_> Sun Feb  6 03:27:55 2011 us=300368  read from TUN/TAP returned 84
21:29 < EO_> Sun Feb  6 03:27:55 2011 us=300422 GET INST BY VIRT: 192.168.56.1 [failed]
21:29 < EO_> and there's the fail
21:29 < EO_> all hail the verbose debugging mode :)
21:44 < EO_>  * Walk (don't run) through the routing table,
21:44 < EO_> hehe, nice comments in multi.h :)
21:58 < EO_> sweet.  I think I found the spot where the software's gotta check host routes to find which client to send the packet to.
21:59 < EO_> now how do you query the kernel routing table.  heh.
21:59 < EO_> and WHICH routing table, cuz there's multiple
22:00 < nDuff> OpenVPN already has cross-platform code for doing that
22:01 < EO_> I saw code to query directly-attached routes
22:01 < EO_> let's dig a bit more
22:01 < nDuff> ahh -- if --show-net doesn't include what you're looking for, maybe it doesn't.
22:04 < EO_>   const MIB_IPFORWARDTABLE *rt = get_windows_routing_table (&gc);
22:04 < EO_> uhhh
22:04 < EO_> that's not wrapped with an #ifdef
22:04 < EO_> disturbing
22:05 < EO_> yeah, --show-net is listed under the Windows-specific-options section of the man page
22:06 < nDuff> Mmm. Apologies for leading you in the wrong direction.
22:07 < EO_> no prob, 60 seconds isn't much :)
22:10 < EO_> hrm, I bet iproute2 will have this code
22:10 < EO_> they implement it when you go "ip route get 1.2.3.4"
22:10 < EO_> they return a single IP
22:12 -!- t39r0ck [~t39pr0ck@adsl-76-200-144-200.dsl.pltn13.sbcglobal.net] has joined #openvpn
22:14 < t39r0ck> who
22:15 < ecrist> !git
22:15 <@vpnHelper> "git" is (#1) OpenVPN testing: git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git, or (#2) Browse Git: http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=summary
22:15 < ecrist> EO_: that's the official repo, where current dev takes place
22:15 < ecrist> we're in the midst of moving everything over to git
22:17 < ecrist> also, regarding your dropped packet issue, the wiki article I pointed you to works because it's using TAP adapters, which is at the ethernet layer, where as the tun adapters operate at the IP layer.  The problem with the latter is that if openvpn doesn't know, internally, what to do with a packet it drops it.  that's why you need to have iroutes and ip_forwarding sysctl enabled in the kernel.
22:21 < ecrist> nDuff: what are you contradicting me on?
22:22 < EO_> ecrist: I'm trying to add a case to multi_get_instance_by_virtual_addr() to optionally query the system's routing information to determine next-hop gateway, and then go through the vhash for a match.
22:23 < EO_> ecrist: (which should work with tun)
22:23 < ecrist> EO_: there is a #openvpn-devel, dazo is a good guy to hit up for hints/insight on the code base
22:23 < ecrist> he's usually around about 10 hours from now
22:23 < ecrist> though, tomorrow is sunday
22:24 < EO_> let me tell ya, the code for openvpn reads a lot easier than that for iproute2 :)
22:24 < ecrist> I'm cautious as there may be a good reason the code doesn't already do what you're suggesting.
22:24 < ecrist> lol
22:24 < EO_> but thanks for the tips
22:25 < EO_> maybe cuz it's inefficient?
22:25 < ecrist> no problem.
22:25 < ecrist> that could be the reason, there could be some cross-platform issues, as well.
22:25 < EO_> it's looking like to lookup a route you gotta open a PF_NETLINK socket with the kernel and do commands back & forth.
22:26 < ecrist> also, make sure any potential patches you send upstream are against git head, and not SVN or a release
22:26 < EO_> good
22:26 < EO_> I <3 git
22:26 < EO_> :)
22:26 < ecrist> :)
22:26 < ecrist> !devel
22:27 < ecrist> !snapshots
22:27 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
22:27 < EO_> this would be my 2nd patch into openvpn ever. woooo.
22:27 < ecrist> that's 2 more than me.
22:28 < EO_> The 1st one I did dealt with incredibly lossy internet connections in China -> USA.
22:28 < EO_> It just sent each packet twice cuz the data loss was so bad.
22:32 < EO_> 3 months ago was the last commit to openvpn-testing?
22:32 < EO_> yikes.
22:32 < ecrist> no
22:32 < ecrist> heh
22:32 < EO_> I thought this was more active.
22:32 < ecrist> WAY more active
22:32 < ecrist> allmerged
22:32 < EO_> http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=log
22:32 <@vpnHelper> Title: SourceForge - openvpn/openvpn-testing.git/log (at openvpn.git.sourceforge.net)
22:32 < EO_> so what's with the log?
22:33 < EO_> Am I using the wrong repo?
22:34 < ecrist> last I see for allmerged is:
22:34 < ecrist> commit ae1de75c0fa5e4802218193e8441dbfa95a6f75c
22:34 < ecrist> Merge: c0f8e9f 04d8e4c
22:34 < ecrist> Author: David Sommerseth <dazo@users.sourceforge.net>
22:34 < ecrist> Date:   Mon Jan 17 21:59:19 2011 +0100
22:34 < EO_> oooo
22:34 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
22:34 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
22:34 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:34 < EO_> wrong branch
22:34 < EO_> ok
22:34 < ecrist> right now we're working on getting 2.2-rc released
22:35 < EO_> so should I patch against master or allmerged?
22:35 < ecrist> hrm,allmerged
22:37 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
22:38 < EO_> git checkout -t origin/allmerged <-- mysterious shortcuts :)
22:38 < ecrist> I still don't know git very well, and sourceforge's interface doesn't help me
22:38 < EO_> that shortcut I pasted creates a local branch, sets it up to track the remote branch, and checks it out.  all in 1 go.
22:39 < ecrist> that's what my snapshot script does
22:40  * ecrist aways, got stuff to do.  
22:40 < ecrist> see you around, EO_ 
22:40 < EO_> cya
22:45 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:49 < reiffert> live: http://www.bathursttiming.com/
22:49 <@vpnHelper> Title: Bathurst 12 Hour (at www.bathursttiming.com)
23:52 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
--- Day changed Sun Feb 06 2011
00:23 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
00:44 < EO_> holy crap is working with netlink difficult
01:09 < hyper_ch> hmmm, debian squeeze turned stable :)
01:15 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:53 -!- Kurogane [~kuro@190.87.95.13] has quit [Remote host closed the connection]
02:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
03:01 < EO_> no patch drop tonight.  so burned out on code.  netlink/rtnetlink has killed me.
03:01 < EO_> time for some quality projector time
03:01 < EO_> (at least I think I deciphered the stupid netlink protocol.  4 layers!)
03:16 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Ping timeout: 240 seconds]
03:17 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
03:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
03:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:19 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
04:25 -!- freaky[t] [alpha@freakyy.de] has quit [Remote host closed the connection]
04:28 <@vpnHelper> RSS Update - forum: Force DNS on specific domain name <http://forums.openvpn.net/topic7605.html>
04:33 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
04:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
04:35 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:36 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
04:39 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:41 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Quit: leaving]
04:51 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
05:18 -!- merlijn [merlijn@home.mhofstra.nl] has joined #openvpn
05:20 < merlijn> hiya, I was wondering if you can add a username/password for authentication in the client config? searching the howto and other pages just give me ways to do it interactively
05:30 -!- xindz`off is now known as xindz
05:51 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
05:52 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
06:00 -!- WinstonSmith [~true@e179022054.adsl.alicedsl.de] has joined #openvpn
06:00 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
06:05 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
06:09 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
06:10 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
07:03 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
07:07 -!- t39r0ck [~t39pr0ck@adsl-76-200-144-200.dsl.pltn13.sbcglobal.net] has quit [Quit: t39r0ck]
07:12 -!- WinstonSmith [~true@e179022054.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
07:13 -!- xindz is now known as xindz`off
07:27 -!- WinstonSmith [~true@e178183042.adsl.alicedsl.de] has joined #openvpn
07:45 -!- merlijn [merlijn@home.mhofstra.nl] has left #openvpn ["Time makes no sense"]
07:49 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 245 seconds]
07:50 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:59 -!- teddz [~teddz@dtmd-4db2d4fa.pool.mediaWays.net] has joined #openvpn
08:06 -!- scandic [~Adium@frnk-4d01d46f.pool.mediaWays.net] has joined #openvpn
08:06 < scandic> Hey *
08:06 < scandic> !welcome
08:06 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:10 < scandic> I got some servers and a /24 network (public) in a datacenter. Now I would like to create a VPN to my home and assign a /28 network of these public IPs to my home network. I did it with a single host and it works but I don't find anything about a "net-to-net bridge". Is this possible?
08:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:54 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
08:54 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
08:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:57 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:00 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
09:10 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
09:33 -!- albech [~thomas@124.157.245.126] has joined #openvpn
09:46 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
09:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:04 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
10:05 -!- xindz`off is now known as xindz
10:20 -!- alhadi [~thunderst@85.17.20.89] has quit [Quit: alhadi]
10:30 < AddeBC> Still having trouble with pptp on osx, anyone?
10:44 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
10:53 -!- teddz [~teddz@dtmd-4db2d4fa.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
11:04 -!- alhadi [~thunderst@94.59.251.31] has joined #openvpn
11:15 -!- alhadi [~thunderst@94.59.251.31] has quit [Quit: alhadi]
11:29 -!- alhadi [~thunderst@94.59.251.31] has joined #openvpn
11:34 -!- mebus [~mebus@cl-42.cgn-01.de.sixxs.net] has left #openvpn []
11:35 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
11:49 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
11:55 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
12:08 -!- teddz [~teddz@dtmd-4db2d4fa.pool.mediaWays.net] has joined #openvpn
12:17 -!- teddz [~teddz@dtmd-4db2d4fa.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
12:17 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has quit [Ping timeout: 240 seconds]
12:22 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
12:27 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
12:33 <@vpnHelper> RSS Update - forum: connected to Tap server.. but can't ping or access anything <http://forums.openvpn.net/topic7606.html>
12:58 -!- trelane [~trelane@funtoo/staff/trelane] has joined #openvpn
13:14 < hyper_ch> ecrist: hi
13:41 -!- brendan0powers [~brendan@office.resara.com] has joined #openvpn
13:45 < brendan0powers> In the openvpn client config file, I can put multiple remote lines to allow for load balancing and fail-over
13:45 < brendan0powers> I was wondering if instead, I added multiple addresses to a DNS host name
13:46 < brendan0powers> That way if I needed to change servers. I wouldn't need to modify the client configs.
13:47 < brendan0powers> I'm wondering if that would work, and if so, how it would differ from adding multiple servers to the client config file
13:47 < Bushmills> that's poor load balancing - a record can and will be cached for as long as TTL is set 
13:48 < Bushmills> you can just as well set multiple --remote statement with different host names, and change their records if you change servers
13:49 < Bushmills> though that's also no balancing, but client driven failover 
13:49 < brendan0powers> I guess I'm more worried about failover
13:50 < brendan0powers> although at some point I will need real load-balancing
13:52 < brendan0powers> although, wouldn't adding remote-random create a random distrobution of clients through all of the defined servers?
13:55 < Bushmills> in conjunction with --remote, yes
13:56 < brendan0powers> Alright, I think that will do what I need for now
13:57 < brendan0powers> Thanks for the clarification.
14:04 -!- brendan0powers [~brendan@office.resara.com] has left #openvpn ["Konversation terminated!"]
14:07 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:12 -!- kraut [~kraut@blackhole.netzdeponie.de] has left #openvpn []
14:15 -!- Desg_xd [~desg@adsl-33-131-193.asm.bellsouth.net] has joined #openvpn
14:15 < Desg_xd> hey can anyone help me setup openvpn in linux?
14:19 < hyper_ch> !tell Desg_xd [howto]
14:22 < Desg_xd> i mean i got it downloaded and everything
14:22 < Desg_xd> i just dont know where to use the cry file
14:22 < Desg_xd> and opvn file
14:23 < Desg_xd> crt*
14:24 < hyper_ch> check the certificate section of the howto
14:25 -!- luneff [~yury@84.51.213.147] has joined #openvpn
14:27 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
14:28 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
14:29 < Desg_xd> yeh but
14:30 < Desg_xd> idk all the stuff nesscary to do it
14:30 < Desg_xd> i have the configs file
14:30 < Desg_xd> i have a .ovpn fle and a .crt file where can i move them so that i will be able to connect
14:31 -!- xindz is now known as xindz`off
14:34 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
14:34 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
14:34 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:46 -!- scandic [~Adium@frnk-4d01d46f.pool.mediaWays.net] has quit [Quit: Leaving.]
14:46 -!- arosen [~arosen@130.127.39.173] has joined #openvpn
14:48 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:06 < Bushmills> specify full path, or place them in the same directory as the config file
15:15 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
15:34 -!- uni4dfx [~uni4dfx@89-212-108-44.dynamic.t-2.net] has quit [Read error: Operation timed out]
15:41 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
15:44 -!- luneff [~yury@84.51.213.147] has quit [Quit: Leaving]
15:49 -!- uni4dfx [~uni4dfx@89-212-181-161.dynamic.t-2.net] has joined #openvpn
15:53 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
16:01 -!- bba [~bba@93.1.40.113] has joined #openvpn
16:04 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
16:09 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
16:24 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
16:29 < arosen> Hello, I'm trying to setup a L2 vpn. The problem I'm having is that I want to put clients in the same subnetwork as the vpn server they are connecting to. So it seems like after they connect the connection gets broken because its trying to send vpn data though the tap rather than the eth. 
16:29 < arosen> Is there a solution for that or do I need to just assign addresses from different pools? 
16:31 < Bushmills> arosen: a host route to the public ip address of server through ethernet interface of client
16:32 < Bushmills> but you'll probably experience more problems
16:34 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html>
16:35 < arosen> If I configure server-bridge I don't have to use dhcp to assign client addresses right? 
16:42 -!- WinstonSmith [~true@e178183042.adsl.alicedsl.de] has quit [Ping timeout: 255 seconds]
16:44 -!- Bushmills [~l@scarydevilmonastery.net] has left #openvpn []
16:45 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Read error: Operation timed out]
16:46 < arosen> if i have two interfaces on my vpn server. I want clients to connect via the ip address of the first interface and then be in the subnet the the second interface is in. How would my routing tables look like?  (IE for the default gw? ) 
16:46 <@vpnHelper> RSS Update - forum: Can connect to VPN and get IP but not ping <http://forums.openvpn.net/topic7598.html#p9585>
16:46 < arosen> This is for A L2 vpn. 
16:47 -!- scandic [~scandic@frnk-4d01d46f.pool.mediaWays.net] has joined #openvpn
16:49 -!- Bushmills [~l@scarydevilmonastery.net] has joined #openvpn
16:49 < EO_> wtf errors in linux/netlink.h
16:51 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Would you like to know more?]
17:02 -!- scandic [~scandic@frnk-4d01d46f.pool.mediaWays.net] has quit [Quit: Verlassend]
17:02 -!- scandic [~scandic@frnk-4d01d46f.pool.mediaWays.net] has joined #openvpn
17:05 -!- trelane [~trelane@funtoo/staff/trelane] has quit [Quit: Leaving]
17:06 -!- scandic [~scandic@frnk-4d01d46f.pool.mediaWays.net] has quit [Client Quit]
17:06 -!- scandic [~scandic@frnk-4d01d46f.pool.mediaWays.net] has joined #openvpn
17:07 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
17:08 -!- WinstonSmith [~true@f052096076.adsl.alicedsl.de] has joined #openvpn
17:10 -!- sercn [~Jazmine@41.73.14.242] has joined #openvpn
17:11 -!- scandic [~scandic@frnk-4d01d46f.pool.mediaWays.net] has quit [Client Quit]
17:11 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
17:20 -!- sercn [~Jazmine@41.73.14.242] has quit []
17:27 -!- Soci3ty [~Soci3ty@tango127.server4you.net] has quit [Ping timeout: 255 seconds]
17:28 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
17:30 -!- Gnewt [~vector@a.box.iownyour.info] has joined #openvpn
17:30 < Gnewt> I can't ping from my server to my clients. My iptables config allows all outbound. Wondering if it might be a routing issue.
17:30 < Gnewt> Any ideas?
17:34 < Bushmills> could be firewall on clients
17:35 < reiffert> start tcpdump or wireshark when on windows
17:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 265 seconds]
17:43 -!- scandic [~scandic@dslb-084-059-112-077.pools.arcor-ip.net] has joined #openvpn
17:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:54 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has quit [Ping timeout: 240 seconds]
17:55 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
18:04 < Gnewt> hmm
18:04 < Gnewt> 16:04:46.851088 IP (tos 0x0, ttl 64, id 20673, offset 0, flags [DF], proto TCP (6), length 60) a.box.iownyour.info.41864 > 10.8.0.3.52525: S, cksum 0xc576 (correct), 3223580822:3223580822(0) win 5840 <mss 1368,sackOK,timestamp 1487782737 0,nop,wscale 5>
18:05 < Gnewt> Seems like the packets are coming in
18:05 < Gnewt> And the box I ran that in does not have a firewall installed, it's a new Gentoo box
18:10 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 245 seconds]
18:22 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
18:43 -!- bba[bis] [~bba@93.1.40.113] has joined #openvpn
18:43 -!- bba [~bba@93.1.40.113] has quit [Read error: Connection reset by peer]
18:44 -!- Lenhix [ElChaman@190.156.59.24] has quit [Read error: Connection reset by peer]
18:45 -!- scandic [~scandic@dslb-084-059-112-077.pools.arcor-ip.net] has quit [Quit: Linkinus - http://linkinus.com]
18:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:57 -!- Lenhix [ElChaman@190.156.59.24] has joined #openvpn
18:57 -!- teddz [~teddz@dtmd-4db2d4fa.pool.mediaWays.net] has joined #openvpn
19:21 < EO_> Mon Feb  7 01:20:43 2011 us=83787  read from TUN/TAP returned 84
19:21 < EO_> Mon Feb  7 01:20:43 2011 us=83833 HOSTROUTE: Attempting hostroute processing for 192.168.56.1
19:21 < EO_> Mon Feb  7 01:20:43 2011 us=83872 HOSTROUTE: Ended hostroute processing without a match.
19:21 < EO_> Mon Feb  7 01:20:43 2011 us=83926 GET INST BY VIRT: 192.168.56.1 [failed]
19:21 < EO_> woohoo!
19:21 < EO_> Finally something compiled.
19:34 < ecrist> http://linux.slashdot.org/story/11/02/06/0155215/Debian-60-Released-In-GNULinux-FreeBSD-Flavors
19:34 <@vpnHelper> Title: Debian 6.0 Released In GNU/Linux, FreeBSD Flavors - Slashdot (at linux.slashdot.org)
19:51 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Quit: Leaving]
19:56 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
20:39 -!- WinstonSmith [~true@f052096076.adsl.alicedsl.de] has quit [Ping timeout: 246 seconds]
20:39 -!- diphthong [~diphthong@69.172.135.243] has quit [Quit: leaving]
20:39 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
20:41 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
20:49 < stevieman> I am getting a permission denied for this file /var/run/openvpn.client.pid ho do I fix the permission error?
20:51 < stevieman> ah, never um mind :)
21:06 -!- master_of_master [~master_of@p57B52FE0.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
21:08 -!- master_of_master [~master_of@p57B56CED.dip.t-dialin.net] has joined #openvpn
21:11 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
21:17 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:33 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
21:53 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
21:55 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
22:01 -!- teddz_ [~teddz@dtmd-4db22dce.pool.mediaWays.net] has joined #openvpn
22:04 -!- teddz [~teddz@dtmd-4db2d4fa.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:09 -!- zeshoem [~mnathani@70.54.143.106] has quit []
22:16 -!- teddz_ [~teddz@dtmd-4db22dce.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:48 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:00 <@vpnHelper> RSS Update - forum: Can connect to VPN and get IP but not ping <http://forums.openvpn.net/topic7598.html#p9586>
23:24 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9587>
23:44 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:54 <@vpnHelper> RSS Update - forum: Few random questions <http://forums.openvpn.net/topic7608.html>
--- Day changed Mon Feb 07 2011
00:18 <@vpnHelper> RSS Update - forum: Can connect to VPN and get IP but not ping <http://forums.openvpn.net/topic7598.html#p9589>
00:24  * Desg_xd is away: I'm busy
00:30 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
00:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
00:54 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9590>
01:48 -!- bba[bis] [~bba@93.1.40.113] has quit [Quit: Leaving...]
02:06 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:06 -!- mode/#openvpn [+o mattock] by ChanServ
02:08 -!- mbe5345 [~mb@76.10.222.65] has joined #openvpn
02:08 < mbe5345> !welcome
02:08 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:09 < mbe5345> !goal
02:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:09 < mbe5345> !configs
02:09 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
02:09 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
02:10 < mbe5345> hi?
02:10 -!- mbe5345 [~mb@76.10.222.65] has left #openvpn []
02:11 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
02:32 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:35 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:44 -!- dazo_afk is now known as dazo
02:50 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:01 -!- raomin [~romain@86.66.22.65] has joined #openvpn
03:06 < raomin> Hi. I have a little question : how could I push routes to my client so that everything is routed except 192.168.0.0/16 ?
03:07 < raomin> "everything is routed" => "everything is routed through the tunnel"
03:54 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
04:04 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 265 seconds]
04:10 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
04:10 -!- macsppadic [~sonupunno@88.211.55.77] has left #openvpn []
04:14 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
04:17 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:24 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:24 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:34 < raomin> I have a little question : how could I push routes to my client so that everything is routed through the tunnel (redirect-gateway) except 192.168.0.0/16 that is kept routed directly...?
05:00 -!- madamPIPI [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has quit [Quit: Lost terminal]
05:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:12 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:16 -!- Oxwivi [~Oxwivi@ner-as29287.alshamil.net.ae] has joined #openvpn
05:16 <@vpnHelper> RSS Update - forum: Not able to ping remote LAN subnet <http://forums.openvpn.net/topic7609.html>
05:17 < Oxwivi> How do you run a client from Ubuntu?
05:18 < Oxwivi> I've also installed network-manager-openvpn and ran from there.
05:18 < Oxwivi> But it did not ask for my username and password as it's supposed to.
05:19 < Oxwivi> The config worked properly with Windows GUI as .ovpn.
05:21 < Oxwivi> Anybody out there undead or alive?
05:27 < Peer^> < dead
05:28 < Oxwivi> Peer^ you just revived as an undead, please help! (You can even bite me, if you wish!)
05:41 < renihs> usually one puts the vpn.config in /etc/openvpn and starts openvpn with /etc/init.d/openvpn start :)
05:41 < renihs> OR you use network manager
05:41 < renihs> with which you simply load the vpn.config file as well (and provide cert or like)
05:41 < renihs> but i am clueless about ubuntu :)
05:43 < Oxwivi> renihs, tanks for the reply, sorry I'm late.
05:44 < Oxwivi> Anyway. I had restarted OpenVPN once, and it did ask me in the terminal, but I did not know if it went well.
05:44 < Oxwivi> Since I used a run program to execute the command.
05:44 < Oxwivi> And I don't know how to control it in CLI.
05:45 < renihs> just use the init script 
05:45 < renihs> as i wrote above but dunno about ubuntu, network manager should work fine
05:45 < Oxwivi> Uh, I'm not too much of a techie person, still learning...
05:45 < renihs> provide the config/cert and stuff in /etc/openvpn  (most likely)
05:46 < renihs> and try to  /etc/init.d/openvpn start
05:46 < Oxwivi> Just a sec, I'll update you right now.
05:46 < renihs> rename your config to openvpn.conf (or make a link)
05:46 < Oxwivi> I'm tryin g it now in VirtualBox, to tell you the truth.
05:46 < renihs> doesnt make a difference
05:46 < Oxwivi> It did run even with a different name.
05:47 < Oxwivi> Anyway, lemme boot it up.
05:50 < Oxwivi> Oh great, can't run it due to lack of memory...
05:51 < renihs> tried you have, failed you did :)
05:52 < Oxwivi> Ineed so...
05:53 < Oxwivi> Well, I posted a support request thread in the Ubuntu Forums anyhow
05:53 < Oxwivi> What OS do you use?
05:53 < renihs> gentoo :)
05:54 < renihs> takes longer to gasp, requires alot reading and understanding but gives nice control 
05:54 < renihs> requires alot time though
05:54 < Oxwivi> I'd switch to it if somehow there's a package manager that will get and compile my softwares...
05:54 < renihs> (to learn)
05:54 < Oxwivi> Automatically.
05:54 < renihs> there is :)
05:54 < renihs> its called portage
05:54 < Oxwivi> Link me!
05:54 < renihs> and unlike binary distros, it is able to handle reverse dependencies as well :)
05:55 < renihs> www.gentoo.org? :)
05:55 < Oxwivi> I'm not sure I'm familiar with reverse dependencies.
05:55 < Oxwivi> No, I meant the link to portage thing.
05:55 < renihs> portage exists only on gentoo
05:55 < renihs> and some bsd afaik
05:56 < Oxwivi> I see, so it acts as some sort of package manager?
05:56 < renihs> y
05:56 < renihs> abit more than that but essentially yes
05:56 < renihs> for the average user, its a comfortable way to just install packages :)
05:56 < renihs> (and compile them for you)
05:56 < Oxwivi> Awesome, if it's features are included in AppStream, awesomer!
05:57 < Oxwivi> I suppose you heard of it?
05:58 < Oxwivi> Gentoo is a rolling release distro, right?
05:58 < renihs> i dont know what appstream is, nor what a "rolling" distro is
05:58 < renihs> gentoo is a source distro
05:58 < renihs> the opposite of a bin distro :)
05:59 < Oxwivi> Rolling release as in, updated constantly as opposed to one big release that distros like Ubuntu, Fedora, openSuSE does.
06:00 < renihs> that would be fitting
06:00 < renihs> you emerge world (update world) whenever you see fit
06:00 < Oxwivi> AppStream is being created in colloboration with all the big Linux player to make an universal cross-distro package manafer.
06:00 < renihs> or you update only security fixes
06:00 < Oxwivi> *manager
06:00 < Oxwivi> I see.
06:00 < renihs> well, i have portage, dont need anything else :)
06:00 < renihs> its perfect for my needs
06:01 < Oxwivi> Portage has GUI frontend?
06:01 < renihs> always has been, hopefully always will remain perfect :)
06:01 < renihs> it does but nobody uses it
06:01 < renihs> forgot its name but there is some gui thingie
06:01 < Oxwivi> And what repo does it use to get the apps?
06:01 < Oxwivi> Gentoo's own?
06:02 < renihs> y
06:02 < renihs> portage has >10k apps
06:02 < renihs> last time i checked (about 2 years ago)
06:02 < Oxwivi> What about proprietary apps like Flash, Java or drivers?
06:03 < renihs> they are in portage as well
06:03 < renihs> but different license
06:03 < Oxwivi> Source code?
06:03 < Oxwivi> Cool.
06:03 < renihs> obviously not :)
06:03 < renihs> those are closed, but you can fetch/install them with portage :)
06:04 < renihs> howver gets abit offtopic :)
06:04 < Oxwivi> So portage pulls the binary instead of source code...
06:04 < renihs> better join the respective gentoo channels to ask more questions :)
06:04 < renihs> y
06:04 < Oxwivi> Thanks for all the info anyway. :D
06:05 < renihs> yw
06:23 -!- Lenhix [ElChaman@190.156.59.24] has quit [Quit: Mindwall!!]
06:24 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
06:50 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
07:01 <@vpnHelper> RSS Update - forum: Not able to ping remote LAN subnet <http://forums.openvpn.net/topic7609.html#p9592>
07:06 -!- teddz_ [~teddz@dtmd-4db22dce.pool.mediaWays.net] has joined #openvpn
07:07 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9593>
07:09 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
07:12 -!- raomin [~romain@86.66.22.65] has quit [Quit: leaving...]
07:13 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9595> || Not able to ping remote LAN subnet <http://forums.openvpn.net/topic7609.html#p9594>
07:15 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
07:16 -!- WinstonSmith [~true@e179005236.adsl.alicedsl.de] has joined #openvpn
07:19 -!- Oxwivi [~Oxwivi@ner-as29287.alshamil.net.ae] has quit [Quit: Leaving]
07:37 -!- Lenhix [~lenhix@200.119.13.10] has joined #openvpn
07:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
07:54 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
07:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:59 -!- s7r [~s7r@89.39.174.74] has joined #openvpn
08:11 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.0.5]
08:21 -!- luneff [~yury@84.51.195.188] has joined #openvpn
08:38 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html#p9596>
08:38 -!- gladiatr_afk is now known as gladiatr
08:43 -!- WinstonSmith [~true@e179005236.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
08:50  * gladiatr says, "Whee, verily, and happy Monday and such unto you!"
08:56 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:59 -!- WinstonSmith [~true@g225025243.adsl.alicedsl.de] has joined #openvpn
09:01 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has joined #openvpn
09:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:06 <@vpnHelper> RSS Update - forum: Is OPEN VPN right for me? <http://forums.openvpn.net/topic7263.html#p9597>
09:09 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:10 < majuk> Herro kittens.
09:12  * gladiatr waves
09:12 < cpm> herro
09:12 < gladiatr> kittehs...
09:26 -!- xindz`off is now known as xindz
09:37 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
09:37 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
09:37 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
09:41 -!- grapsus [~grapsus@acces1181.res.insa-lyon.fr] has joined #openvpn
09:41 <@vpnHelper> RSS Update - forum: Is OPEN VPN right for me? <http://forums.openvpn.net/topic7263.html#p9599> || Connecting openVPN to checkpoint with username and password <http://forums.openvpn.net/topic7610.html>
09:48 -!- Hartimer [~peixoto@gw.identity.pt] has joined #openvpn
09:48 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html#p9601> || Route delete error on win7 64bit <http://forums.openvpn.net/topic7592.html#p9600>
09:48 < Hartimer> !welcome
09:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:48 < Hartimer> !goal
09:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:49 -!- [intra]lanman [~lanman@96.61.34.34] has joined #openvpn
09:49 -!- [intra]lanman [~lanman@96.61.34.34] has quit [Changing host]
09:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:49 < Hartimer> OpenVPN does not accept local caracters as valid password caracters (e.g. ã, é, ç). is there a way to change this behavior
09:51 < krzee> Hartimer, when you say password what exactly do you mean?
09:51 < krzee> that cn be taken quite a few ways when talking about ovpn...
09:51 < krzee> can*
09:52 < Hartimer> krzee, ah ok. so, my config asks for username/password. i mean that password
09:52 < Hartimer> the credentials are created elsewhere
09:52 < krzee> ahh ok
09:53 < Hartimer> i searched the source code. it does not allow for those caracters because they fail to pass the "isprint" condition
09:53 < krzee> so the password works with the other chars but when ovpn asks for the password (not the key file being encrypted, but the server actually wanting the pass) it doesnt work?
09:54 < Hartimer> krzee, exactly
09:54 < krzee> ok, you belong in #openvpn-devel =]
09:54 < Hartimer> it  converts those chars to either '_' or removes them at all (depending where you "sniff" it)
09:55 < krzee> ive never heard of that issue, but those would be the people who you should talk to...
09:55 < Hartimer> didn't know about that :)
09:55 < Hartimer> thks
09:55 < krzee> i THINK its more of an issue with the "3rd party" scripts for checking passes
09:55 < krzee> since openvpn by itself doesnt check passes or anything of that nature
09:55 < Hartimer> krzee, it does
09:56 < krzee> but those guys are also involved with those scripts, so its still the right place i believe
09:56 < Hartimer> "if ((flags & CC_PRINT) && isprint (c)) return true;"
09:56 < Hartimer> this condition is the problem
09:58 < stevieman> !howto
09:58 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
09:59 < krzee> i already like you stevieman =]
09:59 < stevieman> krzee: why's that?
09:59 < krzee> you typed !howto before asking something
10:00 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:00 -!- grapsus [~grapsus@acces1181.res.insa-lyon.fr] has quit [Read error: Operation timed out]
10:00 < stevieman> krzee: :)
10:00 < krzee> anything specific you're looking for?
10:02 < stevieman> Krzee: How to forward a specific port through my openvpn server
10:03 < krzee> so the server's port goes to the client?
10:03 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
10:03 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9602>
10:05 < krzee> if so, its a routing / NAT issue, not openvpn... but we can still try to help
10:05 < stevieman> Krzee: um maybe, I'm new at networking.  I want an app on my client to send it's data through the server.
10:05 < majuk> Pfft, I get an hour glass and nothing else installing on Win 7 in Vista compat mode. Lawd I hate M$.
10:07 -!- s7r [~s7r@89.39.174.74] has left #openvpn []
10:07 < krzee> stevieman, ok, so you only want a single app on the client to route through the server... but no other apps?
10:08 < krzee> if so...
10:08 < krzee> !routebyapp
10:08 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
10:08 < stevieman> krzee: yes that is it
10:09 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:09 < stevieman> !sockd
10:09 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
10:09 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
10:09 < stevieman> krzee so I run the sockd on the server?
10:10 < krzee> right
10:10 < krzee> you would run the socks server as an open proxy, but ONLY inside the vpn
10:10 < krzee> then you can use many programs through it, or ANY program if you use something like proxifier
10:11 < stevieman> k, does it make a difference if both machines are linux? I'm just searching for the proxifier in Google right now
10:11 < stevieman> krzee, so I config socks.conf to run only on the 10.x ip
10:11 < krzee> i dont think proxifier is for linux, but also i think there are free linux alternatives
10:12 < krzee> i dont use *nix (except osx) as a desktop so im not sure... but i think you can use socksify
10:12 < krzee> stevieman, DEFINITELY
10:13 -!- WinstonSmith [~true@g225025243.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
10:14 < stevieman> so I am looking at the socksd.conf file right now. The zero IP address I assume I fill in with the servers internal IP and the clients internal IP?
10:15 -!- grapsus [~grapsus@acces1181.res.insa-lyon.fr] has joined #openvpn
10:20 < krzee> internal: 10.8.1.1 port = 1080
10:20 < krzee> external: 66.11.114.212
10:20 < krzee> internal is what you connect to
10:20 < krzee> external is what you show up as
10:20 -!- WinstonSmith [~true@g225025243.adsl.alicedsl.de] has joined #openvpn
10:22 < stevieman> krzee: right, then further down in the script there is client pass from 0.0.0.0/0 to 0.0.0.0/0 then a few pass lines that are similar with one having a port gt 1023 option
10:22 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 276 seconds]
10:23 < krzee> that is config stuff in the dante app... its basically a built in firewall
10:25 < stevieman> krzee: ok, so the from would be the client IP and the to would be the server IP or the other way around?
10:26 <@dazo> !tcpip
10:27 <@dazo> !learn tcpip as http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf
10:27 <@vpnHelper> Joo got it.
10:30 <@dazo> !learn tcpip as See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
10:30 <@vpnHelper> Joo got it.
10:30 <@dazo> krzee: ^^  I believe that's a (fat but) good reference for basic TCP/IP stuff ... which I don't consider too heavy
10:32 <@dazo> !route
10:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
10:32 <@dazo> !learn route as See !tcpip for more info about a more basic networking guide
10:32 <@vpnHelper> Joo got it.
10:33 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:34  * krzee goes for a read
10:34 < krzee> hey gladiatr got a spoof! good stuff
10:34 < krzee> ^5 @ gladiatr 
10:34 < gladiatr> lol
10:35 < gladiatr> chrome + ubuntu = fail
10:44 -!- Fthis [6276ddd4@gateway/web/freenode/ip.98.118.221.212] has joined #openvpn
10:45 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:45 < Fthis> anyone have any tips on tuning openvpn for performance?
10:47 < gladiatr> !mtu
10:47 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
10:48 < Fthis> what about TCP/443 connections?
10:49 < gladiatr> what about it?
10:49 < Fthis> doesn't --mtu-test only work for TCP?
10:49 < Fthis> err UDP
10:49 < gladiatr> MTU is layer-2
10:49 < majuk> Negative.
10:50 < Fthis> thanks very much i'm gonna try this out
10:51 < gladiatr> I'm not trying to be terse.  It's just that MTU tuning is the only way I know of to really tune openvpn.  You might also check out doing something with qos via iptables/iproute2
10:51 < gladiatr> kk
10:51 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
10:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:52 < Fthis> i don't think i have a QoS issue.  with no other traffic on the line, i am having very weird problems, just like MTU describes
10:54 < Fthis> Options error: --mtu-test only makes sense with --proto udp
10:55 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
10:56 < gladiatr> I'm not talking about qos regarding the vpn tunnel.  I was thinking about it in terms of the traffic traversing the tunnel.
10:56 < Fthis> is there a way to do an mtu-test on TCP?
10:59 < gladiatr> is there a particular reason you want to use TCP for your vpn link?
11:00 < Fthis> this is a road warrior setup, it has to be friendly to firewalls and stuff
11:01 < Fthis> i also use two different site-to-site UDP connections that have similiar/same problems, i will work on that later though.  first thing's first
11:01 < gladiatr> Unless you're using a high-latency link (such as satellite), you do not want to use TCP.  Save yourself the headache and use UDP.  
11:02 < gladiatr> Are you currently using some sort of MTU setting in your configs?A
11:03 < Fthis> nope, cipher is set to default, comp-lzo is on, and i don't have any tuning applied or anything
11:03 < gladiatr> gotcha
11:04 < Fthis> i understand that UDP is better than TCP for this, but what do i do if UDP is blocked?
11:04 < gladiatr> Hrm... use port 53? :)
11:04 < Fthis> i am dealing with low latency dsl and cable connections
11:05 < Fthis> thats an idea i guess.  let me try
11:05 < Fthis> i bet security teams will love this
11:12 < Fthis> doesn't seem to be working, probably due to the BlueCoat proxy server that all traffic is forced through
11:15 < gladiatr> Hrm... well, if you've got that kind of a network proxy, you're probably right about tcp being your only option.  That being said, you might just have to suck it up and deal with the connection being present if not non-idea. :(
11:15 < gladiatr> *ideal
11:16 < Fthis> TCP is that bad?  its unusable for any real transfer or VNC, etc
11:17 < gladiatr> http://sites.inka.de/bigred/devel/tcp-tcp.html
11:17 <@vpnHelper> Title: Why TCP Over TCP Is A Bad Idea (at sites.inka.de)
11:18 -!- mant1s [~mant1s@130.111.162.229] has joined #openvpn
11:18 -!- mant1s [~mant1s@130.111.162.229] has quit [Changing host]
11:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
11:18 < krzee> !tcp
11:18 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
11:18 < Fthis> but i can't avoid it :(
11:18 < krzee> well there you go!
11:18 < Fthis> is openvpn not a valid solution for a road warrior setup?
11:19 < krzee> it wont be ideal... but it will work
11:19 < Fthis> what about other SSL solutions like Citrix or Juniper?
11:19 < krzee> if you must force it through that proxy, see all options that start with --proxy
11:19 < krzee> !man
11:19 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
11:19 < Rienzilla> will performance on bad connections be better with tcp?
11:20 < krzee> honestly i cant speak much on other ssl solutions... im an openvpn guy
11:20 < Fthis> i want to be an openvpn guy too
11:20 < Rienzilla> what's the problem with openvpn + roadwarrior?
11:20 < Rienzilla> it works pretty much anywhere
11:21 < krzee> Rienzilla, no problem with road warriors
11:21 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 240 seconds]
11:21 < Rienzilla> no need for support for funky gre-like protocols
11:21 < krzee> just that TCP isnt ideal... thats all
11:21 < Rienzilla> but udp works pretty much anywhere as well
11:21 < krzee> but thats the same for ANY method of redirecting traffic
11:21 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:21 < krzee> Rienzilla, yep... in fact thats one of the reasons openvpn was made
11:22 < krzee> or so i assume, from James' slideshow in !tcp
11:24 -!- Ramblurr [~rmblr@quassel.jefferai.org] has joined #openvpn
11:24 -!- Ramblurr [~rmblr@quassel.jefferai.org] has quit [Changing host]
11:24 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
11:34 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
11:39 <@vpnHelper> RSS Update - forum: Using OpenVPN for safer on-the-go web broswing? <http://forums.openvpn.net/topic7611.html>
11:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:42 -!- dazo is now known as dazo_afk
12:04 -!- WinstonSmith [~true@g225025243.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
12:13 < stevieman> So is setting up dante enough on my server to get socks working?
12:15 -!- deever [~deever@78.46.68.172] has left #openvpn []
12:16 < stevieman> Am I correct in thinking that I also have to run dante on my client aswell?
12:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
12:17 -!- WinstonSmith [~true@g225025243.adsl.alicedsl.de] has joined #openvpn
12:21 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p9604>
12:21 < anitxor> active directory :'(
12:23 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
12:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:34 < krzee> stevieman, no
12:34 < krzee> stevieman, dante is a socks server, many programs have socks clients built in (most web browsers for example)
12:35 < stevieman> krzee: no? I found a socksify program for linux, how does the socksify program know to send to data for the app over the vpn tunnel?
12:36 < krzee> by using ONLY the vpn address as the server
12:36 < krzee> you can only access the vpn IP over the vpn...
12:38 < stevieman> krzee: right, so the socksify program ( which was in dante-client package) says I use it by running 'socksify appname'
12:39 < krzee> cool... ive never used it
12:40 < stevieman> I assumed that I need to run dante-client on my vpn client machine
12:41 < krzee> once you have the vpn up and can ping the internal IP, it stops having anything to do with openvpn
12:41 < stevieman> ah ok, well I'm at that point then
12:41 < stevieman> I thought openvpn did more than that
12:42 < krzee> nope... openvpn just lets routing direct stuff over the VPN
12:42 < stevieman> ah interesting, such a wrong assumption on my part
12:47 -!- Lenhix [~lenhix@200.119.13.10] has quit [Ping timeout: 260 seconds]
12:52 -!- Lenhix [~lenhix@200.119.13.10] has joined #openvpn
12:53 -!- Desg_xd [~desg@adsl-33-131-193.asm.bellsouth.net] has quit [Remote host closed the connection]
12:56 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
12:58 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
13:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 265 seconds]
13:05 < stevieman> anyone know of a good Dante howto?
13:10 -!- teddz_ [~teddz@dtmd-4db22dce.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
13:13 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
13:15 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html#p9605>
13:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:17 -!- AddeBC [~AddeBC@c193-150-231-214.bredband.comhem.se] has quit [Ping timeout: 250 seconds]
13:23 -!- AddeBC [~AddeBC@c193-150-231-214.bredband.comhem.se] has joined #openvpn
13:27 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9606>
13:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
13:37 -!- Hartimer [~peixoto@gw.identity.pt] has quit [Ping timeout: 240 seconds]
13:40 < majuk> Mmmmm, 40% loss. Sexy-crappy wifi.
13:41 < krzee> sux
13:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
13:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
13:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:49 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has quit [Ping timeout: 255 seconds]
13:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:55  * ecrist waves
13:55  * hyper_ch waves back
13:56  * majuk waves front
13:57  * ecrist has pneumonia and his feeling sorry for himself.
13:58 < krzee> oh shit
13:58 < majuk> yikes
13:58 < hyper_ch> why do you have such a thing?
13:58 < krzee> i had that recently, fucking sucks
13:59 < ecrist> one of the drugs has a side effect that make tendons and cartilage week.  my dr told me if I go lift weights, I run the risk of removing muscle from bone. :(
13:59 < ecrist> s/week/weak/
13:59 < krzee> one of the drugs...?
13:59 < ecrist> yeah, the other is prednisone
13:59 < krzee> shouldnt you just be on antibiotics??
13:59 < krzee> oh shit they got you on steroids
13:59 < ecrist> yup
14:00 < krzee> serious steroids too
14:00 < ecrist> yup
14:00 < krzee> prednisone is hardcore
14:00 < krzee> =/
14:00 < krzee> sorry to hear that man, i hope you get better soon
14:00 < ecrist> this is what I get for not listening to the wife and going to the doctor three weeks ago
14:01 < krzee> omg 3 weeks of pnuemonia!?
14:01 < ecrist> no, I think the actual pnuemonia just started.  temps of 103 last night and today
14:01 < krzee> ahh ya it starts with fever
14:02 < ecrist> fevered dreams and all that.  apparently I was telling the wife some interesting disjointed stories overnight.
14:02 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has joined #openvpn
14:02 < krzee> lol
14:02 < krzee> lopi!
14:02  * ecrist aways
14:03 < krzee> ecrist, lopi is the main dev for iX (linux on iphone)
14:05 -!- WinstonSmith [~true@g225025243.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
14:06 < ecrist> oh, nice
14:07 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has joined #openvpn
14:07 < loa> what can be wrong if client connects to my openvpn network, but can't connect to services of openvpn network?
14:08 < loa> this things happens when this client changed network provider.
14:08 < loa> thing *
14:08 < stevieman> is anyone here running dante-server?
14:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
14:09 < krzee> stevieman, this is the openvpn help channel... we dont support dante
14:09 < stevieman> know where I can get some help on Dante? My google foo has failed me
14:09 < krzee> nope, i just read the manual
14:11 < stevieman> krzee: thats part of the problem. the command I should be able to use to launch dante is not working.
14:11 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
14:12 < krzee> sucks, cant help with that... like i said this is the openvpn help channel
14:12 < krzee> !notovpn
14:12 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
14:13 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
14:17 < majuk> stevieman, There's not an IRC channel for Dante?
14:17 < majuk> There's an IRC for everything!
14:18 < Bushmills> loa, routing or ip forwarding
14:18 < krzee> whether there is or not, this isnt it =]
14:19 < loa> Bushmills, on client machine?
14:19 < Bushmills> more likely on server
14:19 < Bushmills> but can also be client 
14:19 < Bushmills> !route
14:19 < loa> Bushmills, there no routing or ip forwarding just services on 172.16.0.1
14:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:20 < Bushmills> i understand "on network" not as "on server"
14:20 < loa> Bushmills, what is proxyarp?
14:20 < Bushmills> what services can't you connect to?
14:21 < loa> Bushmills, squid, email
14:21 < loa> smtp pop3
14:21 < Bushmills> and those are on hosts in the network behind the openvpn server?
14:22 < loa> yes
14:22 < Bushmills> then read the !route docs
14:23 < loa> Bushmills, man, all works for me, and for that client on the other internet provider.
14:23 < Bushmills> ok, if all works for you, then the problem has evaporated
14:23 -!- Rolybrau [~Rolybrau@219-94.3-85.cust.bluewin.ch] has joined #openvpn
14:23 -!- Rolybrau [~Rolybrau@219-94.3-85.cust.bluewin.ch] has quit [Changing host]
14:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:24 < loa> evaporated? can you refrase it?
14:24 < Bushmills> no more problem. all works 
14:24 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:31 < stevieman> majuk: you think there would be
14:32 -!- s7r [~s7r@74.3.165.161] has joined #openvpn
14:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:40 < stevieman> just an FYI, I know this isn't the place but the dante deamon has been renamed from danted to socksd
14:43 < reiffert> sucksd
14:44 < stevieman> maybe the wonderful dante.conf file here should be renamed to socks.conf
14:46 -!- WinstonSmith [~true@g225025243.adsl.alicedsl.de] has joined #openvpn
14:51 <@vpnHelper> RSS Update - forum: Fix for subnet range conflicts <http://forums.openvpn.net/topic7612.html>
15:01 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
15:02 -!- gladiatr is now known as gladiatr_72
15:02 -!- s7r [~s7r@74.3.165.161] has quit [Ping timeout: 245 seconds]
15:02 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
15:03 -!- gladiatr_72 is now known as gladiatr_afk
15:04 -!- s7r [~s7r@89.39.174.74] has joined #openvpn
15:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
15:13 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Network is unreachable]
15:15 -!- teddz_ [~teddz@dtmd-4db22dce.pool.mediaWays.net] has joined #openvpn
15:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:31 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has quit [Quit: Leaving]
15:38 -!- xindz is now known as xindz`off
15:39 -!- uni4dfx [~uni4dfx@89-212-181-161.dynamic.t-2.net] has quit [Remote host closed the connection]
15:47 -!- jobicreatingweb [~jobicreat@adsl-228.109.242.63.tellas.gr] has joined #openvpn
15:47 < jobicreatingweb> hello
15:48 < jobicreatingweb> how can i run this in a terminal openvpn [server config file] ? or how can i see a log that on my server the open vpn is running?
15:52 < jobicreatingweb> sudo openvpn /etc/openvpn/easy-rsa/server.conf
15:52 < jobicreatingweb> is it this?
15:54 < nDuff> jobicreatingweb, openvpn --config your-server.conf
15:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
15:58 < jobicreatingweb> i have already configure it
16:00 -!- WinstonSmith [~true@g225025243.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
16:01 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
16:02 < majuk> jobicreatingweb, What platform you're on would be a good start
16:02 < jobicreatingweb> sorry
16:02 < jobicreatingweb> ubuntu 10.04
16:02 -!- Fthis [6276ddd4@gateway/web/freenode/ip.98.118.221.212] has quit [Ping timeout: 245 seconds]
16:02 < majuk> jobicreatingweb, Then the 'sudo openvpn /path/to/server.conf' would be correct
16:03 < jobicreatingweb> http://pastebin.com/bsBkVQYh    can you see this please
16:06 -!- jobicreatingweb [~jobicreat@adsl-228.109.242.63.tellas.gr] has left #openvpn []
16:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:13 -!- WinstonSmith [~true@g230120155.adsl.alicedsl.de] has joined #openvpn
16:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
16:16 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
16:16 -!- stony is now known as Guest42016
16:17 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
16:17 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
16:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:27 < majuk> Impatience.
16:28 < majuk> It's interesting to me how some people just refuse to actually read logs.
16:29 < majuk> Or mebbe he missed generating his DH pem and I'm being mena.
16:37 -!- WinstonSmith [~true@g230120155.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
16:38 -!- WinstonSmith [~true@g230120155.adsl.alicedsl.de] has joined #openvpn
16:39 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:40 -!- WinstonSmith_ [~true@dslb-088-073-080-001.pools.arcor-ip.net] has joined #openvpn
16:41 -!- s7r [~s7r@89.39.174.74] has left #openvpn []
16:42 -!- WinstonSmith [~true@g230120155.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
16:44 -!- WinstonSmith_ is now known as WinstonSmith
16:53 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
16:53 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Read error: Operation timed out]
16:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 245 seconds]
16:58 -!- WinstonSmith [~true@dslb-088-073-080-001.pools.arcor-ip.net] has quit [Ping timeout: 255 seconds]
16:59 < Dougy> i see the forum is doing quite well
17:02 <@vpnHelper> RSS Update - forum: Fix for subnet range conflicts <http://forums.openvpn.net/topic7612.html#p9609> || Using OpenVPN for safer on-the-go web broswing? <http://forums.openvpn.net/topic7611.html#p9608> || Login / Password authentication, using static key ? <http://forums.openvpn.net/topic7583.html#p9503>
17:07 -!- Lenhix [~lenhix@200.119.13.10] has quit [Quit: Mindwall!!]
17:11 -!- WinstonSmith [~true@g230120155.adsl.alicedsl.de] has joined #openvpn
17:19 -!- barbosa [~barbosa@187.58.34.184] has joined #openvpn
17:22 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
17:26 -!- teddz_ [~teddz@dtmd-4db22dce.pool.mediaWays.net] has quit [Quit: Ex-Chat]
17:26 -!- barbosa [~barbosa@187.58.34.184] has quit [Ping timeout: 265 seconds]
17:44 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:00 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Read error: Operation timed out]
18:06 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
18:06 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
18:16 -!- WinstonSmith [~true@g230120155.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
18:22 -!- WinstonSmith [~true@g230120155.adsl.alicedsl.de] has joined #openvpn
18:24 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
18:25 < stevieman> very quick questioin, I have openvpn running on my server, and a client on my computer here. They can ping each other over the 10.8 network. Does this mean I have openvpn setup properly?
18:35 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.2]
18:37 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
18:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:38 < |Mike|> no
18:47 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
18:51 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:11 -!- bba [~bba@93.1.40.113] has joined #openvpn
19:14 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:27 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
19:31 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
19:40 -!- Kurogane [~kuro@190.87.95.13] has joined #openvpn
19:48 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
20:08 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 240 seconds]
20:24 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
20:42 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has joined #openvpn
20:45 -!- WinstonSmith [~true@g230120155.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:54 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
21:00 -!- WinstonSmith [~true@g230122122.adsl.alicedsl.de] has joined #openvpn
21:07 -!- master_of_master [~master_of@p57B56CED.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
21:07 -!- WinstonSmith [~true@g230122122.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
21:09 -!- master_of_master [~master_of@p57B55840.dip.t-dialin.net] has joined #openvpn
21:10 < Gnewt> I still can't ping any of my clients from my server itself. Does anybody have an idea of what might be going wrong?
21:10 < theDoc> What does tcpdump tell you?
21:11 < Gnewt> I am new at tcpdump, but one sec
21:12 < Gnewt> 19:12:16.992401 IP (tos 0x0, ttl 64, id 29611, offset 0, flags [DF], proto TCP (6), length 60) a.box.iownyour.info.33897 > 10.8.0.3.52525: S, cksum 0x795a (correct), 1438750726:1438750726(0) win 5840 <mss 1368,sackOK,timestamp 1585441709 0,nop,wscale 5>
21:12 < Gnewt> I am not sure how to interpret that but it seems serenity (10.8.0.3) is receiving the packets
21:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
21:12 < Gnewt> however, shouldn't the source be 10.8.0.1, not a.box.iownyour.info (public IP)?
21:13 < theDoc> What are you dumping and where from?
21:13 < Gnewt> sorry,
21:13 < Gnewt> I am running a netcat listen on serenity, which is 10.8.0.3
21:13 < Gnewt> I am running tcpdump -vv -i tun0 on serenity as well
21:13 < Gnewt> and I am running nc 10.8.0.3 52525 on fidelity, which is 10.8.0.1
21:13 < Gnewt> so that's the output from serenity, the box I can't access
21:14 < Gnewt> fidelity shows something similar:
21:14 < Gnewt> 19:14:15.889522 IP (tos 0x0, ttl 64, id 3911, offset 0, flags [DF], proto TCP (6), length 60) a.box.iownyour.info.37560 > 10.8.0.3.52525: Flags [S], cksum 0x0f3b (correct), seq 3296705168, win 5840, options [mss 1460,sackOK,TS val 1585558999 ecr 0,nop,wscale 5], length 0
21:14 -!- tjz [~pc@bb121-7-242-189.singnet.com.sg] has joined #openvpn
21:14 -!- tjz [~pc@bb121-7-242-189.singnet.com.sg] has quit [Changing host]
21:14 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
21:15 < theDoc> Gnewt: For a start, do you mind not using your box's names? I'm not sure who fidelity is.
21:15 < Gnewt> absolutely
21:15 < theDoc> Thanks.
21:15 < Gnewt> I am listening and running tcpdump in 10.8.0.3
21:15 < Gnewt> And I am trying to connect from 10.8.0.1
21:15 < theDoc> right, ok. Is that your vpn server?
21:15 < Gnewt> it is
21:15 < theDoc> .1 is your client, right?
21:15 < Gnewt> .1 is my server, .3 is my client
21:16 < Gnewt> I can't connect from .1 to anything else.
21:16 < Gnewt> (I mean, any clients)
21:17 < theDoc> None of your clients can connect to your server? What errors are you seeing?
21:18 < Gnewt> I'm sorry, my clients can connect to my server
21:18 < Gnewt> and they are on the VPN
21:18 < Gnewt> 10.8.0.0/24 is my private subnet within the VPN
21:18 < Gnewt> clients can connect to the server and out to the net
21:18 < Gnewt> but the server cannot connect to services running on the clients' private IPs
21:18 < Gnewt> so I cannot ping any clients from my server.
21:18 < Gnewt> .1 is my server, .3 is one of my clients.
21:20 < theDoc> Can you run tcpdump on your client and ping from the server?
21:20 < theDoc> Do the ICMP's reach the client?
21:20 < Gnewt> Yep, they do
21:20 < Gnewt> tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 96 bytes
21:20 < Gnewt> 19:20:40.132945 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) a.box.iownyour.info > 10.8.0.3: ICMP echo request, id 19867, seq 1, length 64
21:21 < Gnewt> I think it is odd that the packets seem to come from a.box.iownyour.info, which is 64.62.228.94
21:21 < theDoc> and do you see the client giving back a response?
21:21 < Gnewt> rather than 10.8.0.1
21:21 < Gnewt> no, I don't, not on tun0
21:21 < Gnewt> let me monitor eth0 for a sec
21:21 < theDoc> Gnewt: Did you alter your hosts file or something?
21:24 < Gnewt> No, on 10.8.0.3 all I have is 127.0.0.1 localhost
21:24 < Gnewt> nothing relating to the VPN on either
21:24 < Gnewt> but a.box.iownyour.info is a real domain, it just points to my eth0 address, not my internal IP
21:24 < Gnewt> which seems odd to me?
21:25 < theDoc> Let me guess, single NIC?
21:25 < Gnewt> Yep
21:26 < theDoc> Gnewt: How about pinging from the client to the server?
21:27 < Gnewt> works just fine
21:27 < Gnewt> but the difference
21:27 < Gnewt> is that the source IP of the echo reply shows up as 10.8.0.1
21:27 < Gnewt> which seems right
21:27 < Gnewt> 19:27:20.708792 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.8.0.3 > 10.8.0.1: ICMP echo request, id 12800, seq 4, length 64
21:27 < Gnewt> 19:27:20.740998 IP (tos 0x0, ttl 64, id 48120, offset 0, flags [none], proto ICMP (1), length 84) 10.8.0.1 > 10.8.0.3: ICMP echo reply, id 12800, seq 4, length 64
21:28 < Gnewt> There are no public IPs there
21:28 < theDoc> right, so from client > server it's ok.
21:28 < Gnewt> yep
21:28 < theDoc> however, from server > client, it's taking the eth0 ip instead of tun0.
21:28 < Gnewt> yes.
21:28 -!- alhadi [~thunderst@94.59.251.31] has quit [Ping timeout: 240 seconds]
21:29 < theDoc> Gnewt: I don't have a clue to this problem at the moment, lemme go for lunch first and mull over it.
21:29 < Gnewt> ok, thanks for the help :)
21:29 < Gnewt> In the meantime it might be a problem with my routes
21:29 < Gnewt> I will look over that.
21:29 < krzee> ive seen this a few times
21:29 < theDoc> It could be, although ..
21:29 < krzee> not sure WHAT causes it... would like to know
21:29 < theDoc> krzee: Yeah, same here.
21:30 < theDoc> btw, o/ krzee 
21:30 < krzee> hey =]
21:30 < krzee> ^5
21:30 < Gnewt> Doesn't this look weird?
21:30 < krzee> although ive never seen the server do it... was always the client before
21:30 < Gnewt> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
21:30 < Gnewt> 10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
21:30 < Gnewt> 10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
21:31 < theDoc> I had to lol at the HBgary incident, btw.
21:31 < krzee> Gnewt, nope
21:31 < theDoc> Gnewt: Is that your entire routing table?
21:31 < Gnewt> but this is from 10.8.0.1
21:31 < Gnewt> no
21:31 < krzee> you using topology subnet on the server...?
21:31 < Gnewt> but it is my entire table regarding the VPN
21:32 < Gnewt> I don't know :-/
21:32 < Gnewt> set up a long time ago
21:32 < Gnewt> let me chec,
21:32 < Gnewt> check*
21:32 < Gnewt> looks like I am not.
21:32 < krzee> !/30
21:32 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
21:32 < theDoc> krzee: Even so, using topology subnet shouldn't break it like that.
21:33 < krzee> no it shouldnt, but he didnt understand why it has .2 in the routing table
21:33 < krzee> his routing table is fine ;)
21:33 < Gnewt> It just looks odd that 10.8.0.0 should go through 10.8.0.2, when 10.8.0.2 is actually a client on the VPN
21:33 < Gnewt> could that be the issue?
21:33 < krzee> Gnewt, you doing anything in IP tables?
21:33 < theDoc> right, right.
21:33 < Gnewt> Because 10.8.0.2 is my laptop
21:33 < krzee> im guessing you have a bad NAT rule somewhere
21:33 < Gnewt> krzee: Yeah, on the server, but irrelevant because it still functions the same way with iptables flushed.
21:33 < krzee> umm, you CANT have a client on .2
21:34 < krzee> you using static ips for your clients and forcing them to use .2 and .3...?
21:34 < Gnewt> Yes. Is that an issue haha? Sounds like it is...
21:34 < krzee> did you read the link you were just given?
21:34 < Gnewt> not yet, was checking my iptables
21:34 < Gnewt> one sec
21:35 < krzee> oh god the anchor is broken in the link
21:35 < krzee> lemme find
21:35 < Gnewt> yea
21:35 < Gnewt> http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html
21:35 < krzee> ahh good
21:35 < theDoc> krzee: Correct me if I'm wrong but using routed would basically give you subnet 0, 4, 8, etc.
21:36 < theDoc> krzee: Why can't you get a client address with .2?
21:36 < krzee> .1 for server, .6 .10 .14
21:36 -!- alhadi [~thunderst@92.96.238.104] has joined #openvpn
21:36 < krzee> theDoc, read the link Gnewt just pasted
21:36 < krzee> its regarding how topology net30 works
21:36 < Gnewt> Isn't this just a workaround for Windows though?
21:37 < Gnewt> or is it still broken because of that?
21:37 < theDoc> krzee: I could assign another ip to the server, no or is that by design?
21:37 < krzee> Gnewt, topology net30 exists because its a workaround for windows... that doesnt change the fact you are using it
21:37 < Gnewt> Am I? It's not in my configs, but is it by default?
21:37 < krzee> and net30 isnt needed anymore anyways, and wont be default in some upcoming version
21:38 < Gnewt> So would changing my client IPs to .6,.10,.14 etc help?
21:38 < Gnewt> And if I read correctly, pushing them routes of .7, .11, .15?
21:38 < krzee> or using topology subnet in the server config (assuming ALL ends are 2.1+)
21:38 < krzee> dont push them routes, lol
21:38 < Gnewt> er, not pushing them routes
21:38 < krzee> openvpn knows how to do that stuff itself
21:38 < Gnewt> but ifconfig command
21:39 < krzee> in fact paste your configs
21:39 < krzee> !configs
21:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
21:39 < krzee> cause if you're talking about ifconfig and routes to .7 .11 etc, im thinking you prolly have some ugliness in your configs
21:41 < Gnewt> http://pastebin.ca/2044424
21:43 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
21:45 < Gnewt> krzee: Doesn't seem too ugly but I don't know :p
21:53 -!- stevieman [~Longfield@d67-193-155-11.home3.cgocable.net] has quit [Ping timeout: 240 seconds]
22:06 < Gnewt> hm I changed to ifconfig-pool but still same issue
22:07 -!- Kurogane [~kuro@190.87.95.13] has quit [Remote host closed the connection]
22:12 < krzee> you dont need ifconfig-pool
22:12 < krzee> you dont need tls-server
22:13 < krzee> and your ifconfig-push is bad
22:13 < krzee> !static
22:13 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
22:13 < Gnewt> I removed ifconfig-pool after ovpn failed
22:13 < Gnewt> I just have that server directive
22:14 < Gnewt> I removed ifconfig-push
22:14 < Gnewt> one sec I'll remove tls-server
22:14 < krzee> tls-server doesnt matter
22:14 < krzee> its implied by using --server
22:15 < krzee> in fact if you look at --server in the manual, you will see its just a helper directive that has ifconfig-pool and tls-server in it
22:15 < Gnewt> ok, the box now has
22:15 < Gnewt> inet addr:10.8.0.6  P-t-P:10.8.0.5
22:15 < krzee> yep
22:15 < krzee> thats right
22:15 < Gnewt> but still can't ping 10.8.0.6 from 10.8.0.1
22:15 < krzee> client is what OS?
22:16 < Gnewt> gentoo
22:16 < Gnewt> but that's not the issue
22:16 < krzee> could very well be firewall
22:16 < Gnewt> 20:16:25.345283 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) a.box.iownyour.info > 10.8.0.6: ICMP echo request, id 20165, seq 2, length 64
22:16 < Gnewt> The server is sending packets from the wrong source address
22:17 < krzee> the OS chooses the soruce address, not openvpn
22:17 < krzee> source*
22:17 < Gnewt> hmm
22:17 < Gnewt> well where to go from here...
22:17 < krzee> prolly #linux or something similar... ild LOVE to know the solution as well
22:17 < Gnewt> alright
22:17 < Gnewt> will check in a bit, after homework is finished
22:18 < Gnewt> thanks for your help!
22:18 < krzee> you arent the first bit by this
22:18 < krzee> np man
22:18 < Gnewt> yeah it's an annoying issue
22:18 < Gnewt> seeya for now
22:18 < theDoc> Gnewt: Try #gentoo
22:18 < Gnewt> ok
22:19 < krzee> and ild surf through sysctl -a
22:19 < krzee> see if anything looks interesting
22:19 < Gnewt> should I be looking for anything in particular?
22:19 < krzee> no idea
22:23 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
22:31 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:37 -!- albech [~thomas@124.157.245.126] has joined #openvpn
22:40 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Read error: Operation timed out]
22:46 -!- Ramblurr [~rmblr@quassel.jefferai.org] has joined #openvpn
22:46 -!- Ramblurr [~rmblr@quassel.jefferai.org] has quit [Changing host]
22:46 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
22:51 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:53 -!- epaphus [~Administr@201.199.62.74] has joined #openvpn
22:53 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:54 < epaphus> Hello. Its been a while since i dont generate certs and leys for clients. Can I use the "server.key" in /etc/openvpn along with the ca.crt to generate crts and keys for users ? 
22:54 < epaphus> or should that probably be the wrong key for ca.crt ?
22:55 < nDuff> epaphus, correct, you need the CA key
22:55 < nDuff> (correct that server.key is wrong)
22:55 < epaphus> oh uh.
22:56 < nDuff> ...otherwise anyone who compromised your VPN server could manufacture certificates that a replacement, uncompromised server would be forced to honor
23:07 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
23:07 -!- UnterPerro_ [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
23:07 -!- UnterPerro_ is now known as UnterPerro
23:07 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Client Quit]
23:07 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
23:12 < Gnewt> What should my server-side routing look like?
23:13 -!- Gnewt [~vector@a.box.iownyour.info] has quit [Quit: leaving]
23:14 < theDoc> It should look correct, imo
23:14 < theDoc> ;p
23:16 -!- epaphus [~Administr@201.199.62.74] has quit [Quit: Saliendo]
23:18 -!- Gnewt [~vector@a.box.iownyour.info] has joined #openvpn
23:18 < Gnewt> So anyway my routes look fine
23:26 < krzee> lol doc
23:31 < theDoc> lol
23:36 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 240 seconds]
23:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 265 seconds]
23:39 -!- Ramblurr [~rmblr@quassel.jefferai.org] has joined #openvpn
23:39 -!- Ramblurr [~rmblr@quassel.jefferai.org] has quit [Changing host]
23:39 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
23:40 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
--- Day changed Tue Feb 08 2011
00:03 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
00:15 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:30 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
00:46 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
00:57 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:03 < theDoc> Anyone has a recommendation for a server host based in UK?
01:03 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
01:06 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
01:09 -!- Lopi is now known as Lopi|idle
01:12 < nDuff> theDoc, I'm pretty happy with Linode, and they have a London datacentre
01:12 < theDoc> nDuff: I need a dedicated or a colo'ed box.
01:12 < theDoc> :)
01:25 -!- davie [~davie@unaffiliated/davie] has joined #openvpn
01:25 < davie> !goal
01:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:25 < davie> !welcome
01:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:28 -!- davie [~davie@unaffiliated/davie] has left #openvpn []
01:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:31 -!- mode/#openvpn [+o mattock] by ChanServ
01:31 -!- twister004 [~chatzilla@59.90.34.167] has quit [Read error: Connection reset by peer]
01:31 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
01:31 -!- twister004_ is now known as twister004
01:39 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 245 seconds]
01:42 -!- krzie is now known as krzee
01:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 265 seconds]
01:50 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:58 -!- loa [~loa@pppoe-188-187-40-113.volgograd.ertelecom.ru] has quit [Read error: Connection reset by peer]
02:01 -!- loa [~loa@46.147.58.196] has joined #openvpn
02:10 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 265 seconds]
02:27 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: theDoc]
02:28 -!- loa [~loa@46.147.58.196] has quit [Ping timeout: 240 seconds]
02:36 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 246 seconds]
02:36 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
02:37 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
02:38 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 246 seconds]
02:38 -!- twister004_ is now known as twister004
02:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:40 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
02:42 -!- dazo_afk is now known as dazo
02:49 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
02:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
03:02 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
03:02 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
03:02 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
03:06 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:26 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
03:31 -!- albech [~thomas@119.42.78.35] has joined #openvpn
03:40 -!- Hartimer [~peixoto@gw.identity.pt] has joined #openvpn
03:43 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
03:52 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: theDoc]
03:58 -!- loa [~loa@46.147.21.165] has joined #openvpn
04:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
04:14 -!- mode/#openvpn [+o mattock] by ChanServ
04:16 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 265 seconds]
04:20 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
04:30 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9611>
04:36 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
04:36 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html#p9612>
04:37 < fahmad> I have Server in US having 32 static ips, now i want to connect machine which is located at PK location and it have WAN/LAN. LAN is connected with another three devices have different ips of US Server. My question is how can i reach them when i connect Server --> Windows 2003 machine as client ?
04:39 < fahmad> any one ?
04:41 < krzee> i dont understand the question
04:41 -!- Devaux [~roger@dyn-cable-customer.161.23.138.91.yetnet.ch] has joined #openvpn
04:41 <@vpnHelper> RSS Update - forum: Not able to ping remote LAN subnet <http://forums.openvpn.net/topic7609.html#p9614> || Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9613>
04:41 < Devaux> Hi
04:41 < Devaux> Is there a possibility to include config files in the windows-installer?
04:42 < krzee> win_rollup
04:42 < krzee> !win_rollup
04:42 <@vpnHelper> "win_rollup" is please see http://www.secure-computing.net/wiki/index.php/OpenVPN/HowTo_for_Windows_2 for dazo's writeup on making unattended windows installers for openvpn
04:43 < fahmad> krzee: lemme show pic
04:43 < Devaux> I've found thousands of howtos...
04:43 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 260 seconds]
04:43 < Devaux> ...but this one I didn't found
04:43 < fahmad> may be you can understand thaat
04:43 < krzee> =]
04:44 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
04:46 <@vpnHelper> RSS Update - forum: Problem pinging some hosts on LAN side. <http://forums.openvpn.net/topic7613.html>
04:47 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:47 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:48 < fahmad> FYI, http://filedb.experts-exchange.com/incoming/2008/10_w41/t66291/Network1.jpg
04:48 < fahmad> sort of this 
04:48 < fahmad> but with Static IP 
04:49 < krzee> nope, that doesnt clarify anything
04:49 < fahmad> krzee: okay
04:52 < fahmad> krzee: i have server which have openvpn server installed. it have 32 ips addresses e.g. 202.43.199.100-132, first ip is assigned to openvpn server and i want to connect windows 2003 client which is located at other location and it have two ethernet cards LAN and WAN. LAN is connect with switch and switch have three devices connected with ip 202.43.199.101, 202.43.199.102 and 202.43.199.103 what i want is to ping them from 202.43.199.100
04:53 < krzee> you used bridging i take it?
04:53 < fahmad> krzee: yes
04:53 < fahmad> but i need working example for this :(
04:53 < krzee> and the server does not have the ips .101 .102 .103, only the lan machines do, right?
04:53 < fahmad> yes
04:53 < fahmad> right
04:54 < krzee> pastebin the output from arp -a
04:54 < krzee> and netstat -rn
04:54 < krzee> you prolly just need to put 3 route entries in the server config
04:54 < krzee> route 202.43.199.101 255.255.255.255
04:55 < krzee> for each of the 3 ips
04:55 < fahmad> ok
04:55 < krzee> and of course the client needs IP forwarding enabled
04:55 < fahmad> krzee: means windows 2003 right
04:55 < krzee> is windows 2003 the client...?
04:55 < fahmad> yes
04:55 < krzee> then yes
04:55 < krzee> hehe
04:56 < krzee> !winipforward
04:56 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
04:56 < fahmad> yup
04:56 < fahmad> i knew this and learn it from here :)
04:56 < fahmad> should i use private ip
04:56 < fahmad> hold lemme show you config
04:56 < fahmad> k
04:58 <@vpnHelper> RSS Update - forum: Problem pinging some hosts on LAN side. <http://forums.openvpn.net/topic7613.html#p9616>
04:58 < fahmad> FYI, http://paste.ubuntu.com/564351/
04:59 < krzee> [02:53]  <krzee> you used bridging i take it?
04:59 < krzee> [02:53]  <fahmad> krzee: yes
04:59 < krzee> liar
04:59 < fahmad> sorry
04:59 < fahmad> i just made config :$
04:59 < fahmad> hehe
04:59 < fahmad> sorry
04:59 < fahmad> i forget to change tun to tap
04:59 < fahmad> :P
05:00 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
05:00 < krzee> theres more to bridging than changing tun to tap
05:00 < fahmad> ifconfig ...
05:00 < krzee> its an entirely different setup
05:00 < fahmad> server-bridge 
05:00 < fahmad> yes
05:00 < fahmad> sorry
05:00 < fahmad> lemme make config
05:01 < krzee> so you just assigned ips on the client's lan that exist on the servers lan... but they cant even access the internet now... right?
05:01 < fahmad> yes
05:02 < fahmad> i even can not ping from server
05:02 < krzee> right
05:02 < krzee> cause your setup doesnt do anything twords actually handing out those IPs
05:02 < krzee> and im very much not skilled with bridge setups
05:02 < fahmad> ok
05:02 < fahmad> :)
05:03 < krzee> so cant be of much more help than saying "you're doing it wrong"
05:03 < fahmad> i will do setup and ask here for help :)
05:03 < krzee> heheh
05:03 < fahmad> hehe
05:03 < fahmad> thanks krzee you are help full
05:03 < krzee> yw
05:03 < fahmad> can you reffer me some working bridge example ?
05:03 < krzee> !bridge
05:03 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc, or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ, or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
05:04 < fahmad> ok
05:04 < fahmad> thanks
05:04 < krzee> yw
05:05 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
05:05 < krzee> note, the bridge-start script ends up leaving you without a default gateway iirc
05:05 < krzee> lol, left too soon
05:28 <@vpnHelper> RSS Update - forum: Problem pinging some hosts on LAN side. <http://forums.openvpn.net/topic7613.html#p9617>
05:30 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:34 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9618>
05:35 -!- s7r [~s7r@74.3.165.161] has joined #openvpn
05:35 < Devaux> Hmmm
05:36 < Devaux> "Self-validation of OpenVPN-InstCfgWiz failed.  Please contact your system administrator."
05:36 < krzee> what is OpenVPN-InstCfgWiz
05:36 < krzee> sounds access-server related
05:37 < krzee> oh
05:37 < krzee> the win_rollup thing
05:37 < krzee> ya i dunno anything about that stuffs
05:37 < Devaux> :)
05:38 < krzee> even nearly retarded people have had no problem putting a couple files where i tell them to
05:39 < Devaux> :)
05:39 < krzee>   # Download URLs ... **MUST BE CHANGED**
05:39 < krzee>   #
05:39 < krzee>   StrCpy $URL_InstCfgWizHash       "http://www.example.com/vpninstall/OpenVPN-InstCfgWiz.exe.md5"
05:39 < krzee>   StrCpy $URL_OpenVPNinstaller     "http://www.example.com/vpninstall/openvpn-installer.exe"
05:39 < krzee>   StrCpy $URL_OpenVPNinstallerHash "http://www.example.com/vpninstall/openvpn-installer.exe.md5"
05:39 <@vpnHelper> Title: IANA Example domains (at www.example.com)
05:39 <@vpnHelper> Title: IANA Example domains (at www.example.com)
05:39 <@vpnHelper> Title: IANA Example domains (at www.example.com)
05:39 < krzee> you changed those right?
05:39 < Devaux> Jupp
05:39 < Devaux> And the md5-files are accessible and 32bit
05:40 < Devaux> Byte
05:40 < krzee> and you checked the hashes...?
05:40 < krzee> ##  It will download a hash from the web server containing a MD5 hash of the current install wrapper.
05:40 < krzee> ##  If the downloaded hash do not match the calculated hash for the installer, the installer aborts
05:40 < krzee> ##  immediately.
05:40 < krzee> thats whats happening
05:41 < Devaux> I generated the hashes as described
05:41 < krzee> dunno then
05:42 -!- Hartimer [~peixoto@gw.identity.pt] has quit [Quit: Ex-Chat]
05:52 <@vpnHelper> RSS Update - forum: Problem pinging some hosts on LAN side. <http://forums.openvpn.net/topic7613.html#p9619>
05:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
05:54 -!- montana [~montana@212.117.173.72] has quit [Ping timeout: 240 seconds]
05:56 -!- montana [~montana@212.117.173.72] has joined #openvpn
06:00 -!- montana [~montana@212.117.173.72] has quit [Ping timeout: 240 seconds]
06:01 -!- montana [~montana@212.117.173.72] has joined #openvpn
06:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:18 -!- WinstonSmith [~true@g231243174.adsl.alicedsl.de] has joined #openvpn
06:56 < ecrist> I love that my wiki gets enough traffic spammers are interesting in free-loading, but fuck them.
06:59 < loa> what can be wrong with openvpn client on windows 7, that he don't set route to my 172.16.0.0 netwrok?
06:59 < loa> network
06:59 < ecrist> you're not running as administrator
07:00 < loa> i checked it on linux and on windows xp
07:00 < loa> ecrist, i see that there are routes but not 172.16.0.0
07:00 < loa> so routes are working
07:01 < ecrist> then you're not pushing them
07:04 < loa> i have such in server config push "route 172.16.0.0 255.255.255.0"
07:04 < loa> server 172.16.0.0 255.255.255.0
07:05 < loa> and client-to-client
07:06 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has joined #openvpn
07:11 <@vpnHelper> RSS Update - forum: Force DNS on specific domain name <http://forums.openvpn.net/topic7605.html#p9620>
07:11 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
07:11 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
07:12 < Bushmills> !winroute
07:12 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
07:12 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
07:12 < Bushmills> loa ^^
07:14 < loa> Bushmills, thank you, but i already send config to client with this modification, waiting for reply.
07:14 < loa> Bushmills, it can be that some routes are set, but some are not, without using this optin?
07:14 < loa> option *
07:16 <@vpnHelper> RSS Update - forum: newbie question about dhcp <http://forums.openvpn.net/topic7614.html>
07:17 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
07:19 < ecrist> loa: no, either they get set, or not
07:19 < ecrist> !configs
07:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
07:20 < ecrist> loa ^^
07:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:20 < loa> oh) if you look at my configs it will be very cool!
07:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:23 < loa> client http://www.pasteall.org/18996
07:24 < loa> server http://www.pasteall.org/18997
07:24 < loa> ecrist, ^^
07:27 < ecrist> !logs
07:27 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
07:34 < loa> ecrist, i can't do it later.
07:35 < loa> ecrist, you are permanent visitor of this channel?
07:36 < ecrist> I am around, yes
07:36 < ecrist> I'm even more than a visitor. :)
07:38 < loa> ecrist, dev?
07:39 < ecrist> no, just a supporter
07:39 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:39 < ecrist> regardless, I'm around
07:40 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
07:54 -!- xindz`off is now known as xindz
08:15 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
08:31 < fahmad> krzee: still arround ?
08:32 < fahmad> can you look this config http://paste.ubuntu.com/564472/
08:32 < fahmad> and lemme know
08:38 -!- teddz [~teddz@dtmd-4db2f98d.pool.mediaWays.net] has joined #openvpn
08:59 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has joined #openvpn
09:04 -!- AddeBC [~AddeBC@c193-150-231-214.bredband.comhem.se] has quit [Ping timeout: 240 seconds]
09:05 -!- AddeBC [~AddeBC@mail.feab.se] has joined #openvpn
09:10 < fahmad> hello
09:11 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:12 -!- gladiatr_afk is now known as gladiatr
09:13 < fahmad> can some one tell me with bridge ?
09:13 < fahmad> http://paste.ubuntu.com/564502/
09:18 < gladiatr> fahmad, what would you like to know?
09:19 < fahmad> well i could not able to ping machine having ip 173.193.48.196 on client side lan
09:20 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 240 seconds]
09:20 < gladiatr> ok.  Is your VPN server also the internet gateway for the 173.193.48 network?
09:20 < gladiatr> nm.  bridging.  right
09:21 < fahmad> yes
09:21 < gladiatr> you've got linux on both ends?
09:21 < fahmad> server side is linux and client side is windows 2003 enabled port forwarding ...
09:22 < gladiatr> k.  pastebin the output of ipconfig /all on your 2003 system
09:22 < fahmad> ok
09:22 < fahmad> hold
09:22 < fahmad> lemme connect again
09:23 < hyper_ch> linux <3
09:29 < fahmad> http://paste.ubuntu.com/564508/
09:29 < fahmad> this is what i get
09:31 -!- Adde_BC [~AddeBC@c193-150-231-214.bredband.comhem.se] has joined #openvpn
09:31 < gladiatr> paste a 'verb 5' log from the client
09:31 -!- AddeBC [~AddeBC@mail.feab.se] has quit [Ping timeout: 250 seconds]
09:31 < gladiatr> sorry if some of this is repeat
09:31 < fahmad> ok
09:32 < fahmad> http://paste.ubuntu.com/564510/
09:35 < fahmad> any idea
09:36 < gladiatr> hrm... is this one of those things where you want to use one of a block of public IP addresses that are assigned to the remote server?
09:37 < gladiatr> I guess what I'm not understanding is why you would have your client connecting to the IP address that is also the gateway address in your server-bridge definition.
09:38 < fahmad> ok
09:39 < gladiatr> what are you trying to accomplish?
09:40 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
09:40 < gladiatr> the error that needs attention is: WARNING: --remote address [173.193.48.192] conflicts with --ifconfig subnet [173.193.48.202, 255.255.255.0] -- local and remote addresses cannot be inside of the --ifconfig subnet.
09:40 < fahmad> gladiatr: ok now
09:40 < fahmad> i can ping lan ip
09:40 < gladiatr> what did you modify?
09:41 < fahmad> now
09:41 < fahmad> i can ping LAN which is bridge
09:41 < fahmad> but i can not ping that using openvpn server
09:42 < fahmad> i.e. 173.193.48.196
09:44 < gladiatr> please paste the output of the following two commands (server side): 
09:44 < gladiatr> brctl show
09:44 < fahmad> which command ?
09:44 < gladiatr> ipconfig -a
09:45 < fahmad> why i need brctl in linux ?
09:45 < fahmad> http://paste.ubuntu.com/564512/ 
09:45 < gladiatr> rut ro
09:46 < gladiatr> well, you're trying to configure a bridge.  You have to build the bridge with your tap interface (on the linux side) and the physical network interface you want your client to be able to join.
09:46 < gladiatr> Without that step, the rest of it is rather pointless.
09:46 < fahmad> humm
09:46 < fahmad> any other way
09:46 < fahmad> ?
09:47 < fahmad> gladiatr: ok tell me what should i do now
09:47 < fahmad> i will do it right away
09:47 < gladiatr> An example of what you should see on the server side is: http://pastebin.com/se2PTrEh
09:48 < gladiatr> :)
09:48 < gladiatr> k.  sec
09:48 < fahmad> ok
09:48 < fahmad> checking
09:48 < gladiatr> what Linux distribution are you using?
09:48 < fahmad> debian
09:48 < fahmad> ubuntu :$
09:48 < gladiatr> k.
09:48 < gladiatr> That works.  The configuration files are all the same.
09:49 < fahmad> yup
09:49 < fahmad> so what to do now
09:49 -!- Adde_BC [~AddeBC@c193-150-231-214.bredband.comhem.se] has quit []
09:50 < gladiatr> on the server: aptitude install bridge-utils 
09:50 < fahmad> ok
09:50 < gladiatr> Do you have physical access to the server?
09:50 < fahmad> done
09:50 < fahmad> yes
09:50 < fahmad> not physical
09:50 < fahmad> its in DC
09:51 < gladiatr> Hrm... Do you have someone on-site that can help you unbugger it if something should go wrong?
09:51 < fahmad> yes
09:51 < fahmad> i can do ticket
09:51 < gladiatr> Good deal.
09:51 -!- Lenhix [~lenhix@mail.superricas.com] has joined #openvpn
09:51 < gladiatr> On the server-side, cp /etc/network/interfaces /root/interfaces.bak
09:51 < fahmad> ok
09:52 < gladiatr> paste the output of ifconfi g-a
09:52 < gladiatr> er
09:52 < gladiatr> ifconfig -a
09:52 < fahmad> did that before ...
09:52 < fahmad> http://paste.ubuntu.com/564512/ 
09:52 < gladiatr> ahh... gotcha
09:53 < gladiatr> pastebin /etc/network/interfaces
09:53 < fahmad> ok
09:54 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
09:54 < fahmad> http://paste.ubuntu.com/564521/
09:57 < fahmad> gladiatr: still there ?
09:57 < gladiatr> Yar
09:58 < fahmad> k
09:58 < gladiatr> Just trying to make sure the info I give you has the least chance of locking you out of your system :)
09:58 < fahmad> ok
09:58 < fahmad> :)
09:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:59 -!- xLP [~xLP@mail-out.lpcorp.fr] has joined #openvpn
10:05 < xLP> I have a little concern regarding security... Some of my clients should not be able to access some resources, so I have a firewall, filtering per IP. Each client has an ip defined in client conf file. I was wondering if a client has (probably thru the usage of a patched OpenVPN version) the possibility to get another IP than the one defined?
10:06 < fahmad> use ccd
10:06 < fahmad> !ccd
10:06 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
10:06 < xLP> yes yes, I use ccd
10:06 < xLP> sorry, I said "client conf file", I mean files in my ccd
10:07 < fahmad> then its your server who is going to assign your client ip address using ifconfig-push
10:07 < xLP> iow, can I assume that OpenVPN will only let in packets from john with the ip assigned to john
10:08 < xLP> or if in case john would decide to change its IP later, OpenVPN would allow another IP
10:08 < fahmad> well john will have only ip which is assigned to him
10:08 < xLP> but join may use ifconfig to change it
10:08 < xLP> john
10:08 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:08 < fahmad> john can not change ip by him self until or unless you change it in ccd/john
10:08 < fahmad> :)
10:09 < fahmad> ok
10:13 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
10:13 < xLP> I've just tried it under Windows, and john can change its IP :)
10:13 < xLP> of course, due to the topology of OpenVPN version I'm using, john will not access the VPN anymore
10:13 < fahmad> humm
10:14 < xLP> (I'm on the topology where OpenVPN makes subnets with only 2 hosts possible, 1 being for the server, 1 for the client)
10:14 < xLP> my concern is for the "new topology", where there's only one big subnet for everyone
10:15 < xLP> in such a topology, if john would change its IP, would OpenVPN server let him go thru, or say "no way, john has to be 10.1.1.1, not 10.1.1.2, I'll drop this packet!"
10:19 < xLP> (new topology being "subnet" topology)
10:28 <@dazo> xLP: I believe OpenVPN keeps track of which IP addresses belongs to which client itself ... so if john changes the IP address, it will go to the server, and through the tunnel ... but the reply will go to the "proper" client ... so it will not go back to john
10:28 <@dazo> unless, openvpn detects that the new IP address from the client is unused ... and it will change it's "index", so that john now automatically gets the new address instead
10:29 < theDoc> moin' all.
10:29 < fahmad> but it will not happen in ccd case :)
10:30 <@dazo> fahmad: if you modify the IP address on the tun/tap interface manually, it can happen
10:30 < fahmad> humm
10:31 <@dazo> xLP: if security is a concern, it's better to use dynamic firewall updates, which is not connected to fixed IP addresses ... you can check out http://www.eurephia.net/ for one way of doing it
10:31 <@vpnHelper> Title: eurephia :: a flexible OpenVPN authentication module (at www.eurephia.net)
10:32 < Devaux> authetication?
10:33 <@dazo> Devaux: with proper authentication, you can dynamically update firewall rules depending on the client ... and if the client tries some trickery, the firewall will block these attempts
10:34 -!- luneff [~yury@84.51.195.188] has joined #openvpn
10:35 -!- Guest42016 is now known as stony
10:35 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:40 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:41 -!- Kurogane [~kuro@190.87.95.13] has joined #openvpn
10:43 < Devaux> dazo: Yes. But there is "authetication" written on the homepage ;)
10:43 <@dazo> Devaux: ahhhh!  oh, thanks!  I've not seen that
10:43  * dazo goes to correct
10:43 < Devaux> :)
10:45 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
10:58 < fahmad> gladiatr: there
11:08 -!- TheCritic [~TheCritic@c-24-30-114-73.hsd1.ga.comcast.net] has joined #openvpn
11:08 < TheCritic> is there a zero install openvpn client for windows?
11:09 <@dazo> TheCritic: nope, you need to have TUN/TAP driver installed, which is a virtual network adapter
11:10 < TheCritic> I "thought" I saw something a while back that it was in the works.... have you heard anything about it on the horizon?
11:10 <@dazo> nothing in the works, afaik
11:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
11:11 -!- [intra]lanman [~lanman@h96-61-34-34.mdsnwi.tisp.static.tds.net] has joined #openvpn
11:11 -!- [intra]lanman [~lanman@h96-61-34-34.mdsnwi.tisp.static.tds.net] has quit [Changing host]
11:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:11 <@dazo> at least nothing which has been sent to the development list for review .... I dunno what the Access Server guys works on though, but that's the closed source, commercial version 
11:11 < TheCritic> thx
11:11  * dazo only knows about the open source version
11:11 < TheCritic> as we all should
11:11 < TheCritic> :P
11:11 <@dazo> :)
11:18 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
11:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
11:20 -!- Lenhix [~lenhix@mail.superricas.com] has quit [Quit: Lunch]
11:20 -!- albech [~thomas@119.42.78.35] has quit [Quit: Ex-Chat]
11:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:28 -!- [intra]lanman [~lanman@h96-61-34-34.mdsnwi.tisp.static.tds.net] has joined #openvpn
11:28 -!- [intra]lanman [~lanman@h96-61-34-34.mdsnwi.tisp.static.tds.net] has quit [Changing host]
11:28 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:44 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Quit: leaving]
11:44 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
11:44 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Client Quit]
11:46 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
11:49 -!- dazo is now known as dazo_afk
12:04 -!- s7r [~s7r@74.3.165.161] has quit [Ping timeout: 240 seconds]
12:08 < Gnewt> Odd issue...
12:08 < Gnewt> When I push "ifconfig-push 10.8.0.2 10.8.0.1", which apparently shouldn't work(??), everything works fine!
12:09 < Gnewt> But when I remove that and just use the server directive (ifconfig-pool/tls-server), I get assigned 10.8.0.6 but nothing works, I can't route traffic.
12:11 < stevieman> very quick questioin, I have openvpn running on my server, and a client on my computer here. They can ping each other over the 10.8 network. Does this mean I have openvpn setup properly?
12:12 < theDoc> Sorta.
12:13 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
12:15 < Gnewt> psh you people and your pinging and your correct source addresses
12:19 < ecrist> stevieman: I believe I answered that question yesterday
12:19 < ecrist> !/30
12:20 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
12:20 < ecrist> Gnewt: 
12:20 < stevieman> ecrist: Sorry I was called away from my computer yesterday after I asked, I didn't see your response
12:21 < ecrist> without knowing more about your configuration, it sounds like the base VPN is correctly setup.  That's make a lot of assumptions, such as that you're using the 10.8/16 subnet as your vpn subnet
12:33 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:41 < Gnewt> ecrist: I'm telling you that when I use /30, it doesn't work :p
12:42 < Gnewt> but when I don't, and I give my clients the IPS .2, .3, .4 etc, it does work.
12:43 < xLP> thank you guys for your answers!
12:45 < xLP> Gnewt: sounds normal that in subnet .2 .3 .4 work
12:47 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has quit [Quit: Leaving]
12:48 < ecrist> !tell Gnewt [configs]
12:48 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:52 -!- xLP [~xLP@mail-out.lpcorp.fr] has quit []
12:53 < Gnewt> ecrist: http://pastebin.com/aeZ6pxri
12:54 < Ramblurr> is it possible to allow _either_ client certs OR a correct user/pass?
13:01 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 240 seconds]
13:02 < ecrist> um, no, Rablurr
13:03 < ecrist> Gnewt: if you're using ccd-exlusive, can you show me an example ccd entry that works, and one that doesn't?
13:04 < ecrist> or, what do you mean 'nothing works'
13:04 < Gnewt> everything works like this except for the fact that packets are being sent from the wrong source address by the server (not the client as usual)
13:04 < ecrist> it's not very revealing
13:04 < Gnewt> what I was saying before is when I remove the ifconfig-push entries
13:04 < Gnewt> I can't route from client to net through server
13:04 < ecrist> to what net?
13:04 < Gnewt> capital I Internet
13:05 < Gnewt> so to google.com for example
13:05 < ecrist> there is nothing in your config that leads me to belive that would work.
13:05 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html#p9622>
13:05 < ecrist> !def1
13:05 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
13:06 < Gnewt> So can I push redirect-gateway def1 just the same?
13:07 -!- Ramblurr [~rmblr@quassel.jefferai.org] has joined #openvpn
13:07 -!- Ramblurr [~rmblr@quassel.jefferai.org] has quit [Changing host]
13:07 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
13:08 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
13:08 < ecrist> aye
13:12 -!- sia^pwnnt [~115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 260 seconds]
13:12 -!- co_26_jakpuss [~Zu|fi@41.234.202.176] has joined #openvpn
13:12 -!- co_26_jakpuss [~Zu|fi@41.234.202.176] has left #openvpn ["http://www.1filesharing.com/download/0PF3RZH5/psyBNC2.3.1_6.rar"]
13:20 -!- Lantizia [~Lantizia@erebus.seaquake.net] has quit [Read error: Operation timed out]
13:21 -!- sia^pwnnt [~115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
13:31 < diphthong>    /window 2
13:32 < ecrist> no
13:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:32 < ecrist> that's my highlight window
13:37 -!- Lantizia [~Lantizia@erebus.seaquake.net] has joined #openvpn
13:39 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
13:43 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Remote host closed the connection]
13:47 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
13:49 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
13:51 < gladiatr> !factoids brtables
13:51 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has left #openvpn ["Leaving"]
13:51 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
13:51 < gladiatr> !factoids search brtables
13:51 <@vpnHelper> No keys matched that query.
13:54 < krzee> nvr hearda it
13:54 < ecrist> me either
13:54 < krzee> google thinks im looking for bar tables
13:55 < ecrist> ! factoids search tables
13:55 <@vpnHelper> 'iptables', 'ldap_iptables', and 'ebtables'
13:55 < ecrist> is ebtables what you're looking for, gladiatr ?
13:55 < gladiatr> indeed
13:55 < gladiatr> Not quite sure where I was getting brtables...
13:55 < gladiatr> :P
13:58 < gladiatr> and thanks :)
14:00 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
14:06 -!- Ramblurr [~rmblr@quassel.jefferai.org] has joined #openvpn
14:06 -!- Ramblurr [~rmblr@quassel.jefferai.org] has quit [Changing host]
14:06 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
14:06 <@vpnHelper> RSS Update - forum: sctp implementation in openvpn <http://forums.openvpn.net/topic7615.html>
14:18 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:18 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
14:19 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:19 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
14:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:25 < Rienzilla> haha bar tables :D
14:25 < krzee> hey there were some nice ones too ;)
14:25 < Rienzilla> :)
14:35 < gladiatr> true enough
14:36 < gladiatr> ok.  So, riddle me this: what is up with these vpn reseller services that assign small blocks of public IP addresses?
14:36 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:50 < ecrist> well, the assign small block of public IPs
14:50 < ecrist> I assume so people can appear to be hosting stuff in whatever country the service resides in
14:53 < gladiatr> Hm... I suppose.  It just seems a VPS would make more sense in that situation.
14:54 < ecrist> why?  if I already have a host somewhere, and I only want 'native' connectivity from somewhere else...
14:54 <@vpnHelper> RSS Update - forum: Remote VPN Problem <http://forums.openvpn.net/topic7594.html#p9624>
14:55 < gladiatr> True, but domain-wise, you're still only going to be in one spot at a time.  The efficiency hit that you're going to take with that sort of network configuration just seems to be a bit on the not-worth-it side.
14:55 < ecrist> heh, talk to hurricane electric.
14:56 < ecrist> they have a busines model doing a boat load of that very thing
14:56 < gladiatr> Hehe!  Well, yeah, but their business model is based on providing connectivity where it often doesn't exist.
14:57 -!- WinstonSmith [~true@g231243174.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
14:57 < ecrist> same thing, if you think about it
15:00 < gladiatr> Yeah.  I've never had to deal with any of those particularly nasty national firewalls or proxies.
15:10 -!- Gnewt [~vector@a.box.iownyour.info] has quit [Remote host closed the connection]
15:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:14 -!- WinstonSmith [~true@e179007078.adsl.alicedsl.de] has joined #openvpn
15:15 -!- antiwire [~antiwire@unaffiliated/antiwire] has joined #openvpn
15:18 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
15:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:21 -!- antiwire [~antiwire@unaffiliated/antiwire] has left #openvpn ["..and you run and run you to catch up with the Sun but it's sinking. Racing around to come up behind you again."]
15:23 -!- gladiatr is now known as gladiatr_akf
15:23 -!- gladiatr_akf is now known as gladiatr_afk
15:25 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
15:27 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has left #openvpn []
15:32 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 250 seconds]
15:34 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:36 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
15:38 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
15:39 -!- xindz is now known as xindz`off
15:46 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
15:54 -!- teddz [~teddz@dtmd-4db2f98d.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
16:02 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:06 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
16:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:35 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:36 < diphthong> is there a way to make a mesh vpn with lots of openvpn instances and creative routing?
16:45 < ecrist> yup
16:45 < ecrist> !mesh
16:45 <@vpnHelper> "mesh" is (#1) openvpn does not do mesh networking, or (#2) see !rip
16:45 < ecrist> !rip
16:45 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
16:45 < ecrist> that's what I was looking for
16:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
16:54 -!- p3rror [~mezgani@41.140.155.6] has joined #openvpn
16:57 -!- TheCritic [~TheCritic@c-24-30-114-73.hsd1.ga.comcast.net] has quit [Quit: TheCritic]
17:17 -!- rkantos [robin@hp1.jaketus.net] has quit [Read error: Operation timed out]
17:25 -!- p3rror [~mezgani@41.140.155.6] has quit [Ping timeout: 240 seconds]
17:35 -!- dws60451 [~dws@dws3.Stanford.EDU] has joined #openvpn
17:35 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
17:36 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
17:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:41 -!- p3rror [~mezgani@41.140.34.137] has joined #openvpn
17:46 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
17:50 -!- p3rror [~mezgani@41.140.34.137] has quit [Ping timeout: 240 seconds]
17:52 -!- aap [~drew@cpe-174-101-232-161.cinci.res.rr.com] has joined #openvpn
17:57 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:57 -!- [intra]lanman [~lanman@h96-61-34-34.mdsnwi.tisp.static.tds.net] has joined #openvpn
17:57 -!- [intra]lanman [~lanman@h96-61-34-34.mdsnwi.tisp.static.tds.net] has quit [Changing host]
17:57 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:00 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
18:02 -!- bba [~bba@93.1.40.113] has joined #openvpn
18:03 -!- p3rror [~mezgani@41.140.100.110] has joined #openvpn
18:06 -!- scandic [~scandic@frnk-4d01c741.pool.mediaWays.net] has joined #openvpn
18:07 < scandic> hey *
18:08 < scandic> I configured a bridge (tap) and it's working for the configured network. However I don't get it to route all traffic trough the tunnel. There's no firewall enabled :) Someone might lead me to the right way?
18:11 < scandic> Server is FreeBSD 8, Client is MacOS X 10.6. The network is a public one.
18:22 < scandic> Wonder when the last conversation was posted here^^
18:24 -!- scandic [~scandic@frnk-4d01c741.pool.mediaWays.net] has quit [Quit: Linkinus - http://linkinus.com]
18:30 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
18:35 < Ramblurr> is it possible to allow _either_ client cert authentication OR a correct user/pass?
18:35 < Ramblurr> that is, i want to setup some boxes to automatically connect to the vpn with certs
18:35 < Ramblurr> and then use LDAP auth (which i have setup via pam) for regular clients
18:35 -!- aap [~drew@cpe-174-101-232-161.cinci.res.rr.com] has quit [Quit: leaving]
18:42 -!- Lopi|idle is now known as Lopi
18:59 < arosen> Hello, I know this seems like a weird setup but I have an Openvpn server running a L2 vpn and then several client  nodes that are bridging their wlan0 interface with the TAP interface. And then I allow other clients to connect to this bridged interface.  
19:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
19:00 < arosen> What i'm kind of seeing is L3 packets getting sent out from time to time on the hole network even when a host isn't on that node. 
19:00 < arosen> This is because its acting as learning bridge and has to flood these packets right? 
19:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:18 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
19:20 -!- WinstonSmith [~true@e179007078.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
19:20 <@vpnHelper> RSS Update - forum: Set Clients TAP-Device Default Gateway <http://forums.openvpn.net/topic7616.html>
19:21 -!- WinstonSmith [~true@e179007078.adsl.alicedsl.de] has joined #openvpn
19:25 -!- crazed_ [~crazed@2607:f2f8:af50::2] has joined #openvpn
19:26 < arosen> Does anyone know what exactly client-to-client does? It seems like when I run this. In my setup I don't see this L3 packets getting flood to all openvpn clients. 
19:26 -!- crazed [~crazed@unaffiliated/cr4z3d] has quit [Ping timeout: 260 seconds]
19:30 -!- crazed [~crazed@unaffiliated/cr4z3d] has joined #openvpn
19:32 -!- crazed_ [~crazed@2607:f2f8:af50::2] has quit [Ping timeout: 260 seconds]
19:32 -!- crazed [~crazed@unaffiliated/cr4z3d] has quit [Read error: Operation timed out]
19:35 -!- crazed [~crazed@unaffiliated/cr4z3d] has joined #openvpn
19:39 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:46 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
19:54 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:55 -!- Kurogane [~kuro@190.87.95.13] has quit [Read error: Connection reset by peer]
20:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:03 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
20:03 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
20:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:19 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
20:24 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 272 seconds]
20:25 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
20:30 -!- WinstonSmith [~true@e179007078.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:34 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
20:34 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
20:34 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
20:44 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit []
20:45 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
20:46 -!- zeshoem [~mnathani@76.64.14.149] has joined #openvpn
20:47 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:57 -!- zeshoem [~mnathani@76.64.14.149] has quit []
20:59 -!- zeshoem [~mnathani@76.64.14.149] has joined #openvpn
21:06 -!- master_of_master [~master_of@p57B55840.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:08 -!- master_of_master [~master_of@p57B56B03.dip.t-dialin.net] has joined #openvpn
21:10 -!- p3rror [~mezgani@41.140.100.110] has quit [Ping timeout: 240 seconds]
21:23 -!- p3rror [~mezgani@41.140.28.95] has joined #openvpn
21:50 -!- p3rror [~mezgani@41.140.28.95] has quit [Ping timeout: 240 seconds]
21:53 -!- arosen [~arosen@130.127.39.173] has left #openvpn []
22:07 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 255 seconds]
22:10 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
22:16 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
22:24 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 276 seconds]
22:24 -!- ivenkys [~ivenkys@81.168.100.197] has joined #openvpn
22:25 -!- Netsplit *.net <-> *.split quits: sedulous, DarthGandalf, TypoNe, moldy, areq, toortog, ScriptFanix, belZe, Agin, js_,  (+71 more, use /NETSPLIT to show all of them)
22:25 -!- Netsplit over, joins: EmperorTom, Essobi, EvilJStoker, chantra_afk, kisom, @patelx, cron2, master_of_master, Ramblurr, bba (+70 more)
22:26 -!- Netsplit *.net <-> *.split quits: Fiouz, APTX, fahadsadah, |Mike|, dvl, @raidz, zhorX, bauruine, crazed
22:26 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
22:29 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
22:29 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
22:29 -!- crazed [~crazed@unaffiliated/cr4z3d] has joined #openvpn
22:29 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
22:29 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
22:29 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
22:29 -!- zhorX [~happyface@warp.skyhook.ca] has joined #openvpn
22:29 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has joined #openvpn
22:29 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
22:29 -!- ServerMode/#openvpn [+o raidz] by jordan.freenode.net
22:31 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
22:34 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
22:34 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:37 < ecrist> ah, it's been a while since freenode was DDOSed
22:38 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
22:41 < ecrist> fuck you, spammers of my wiki, fuck you indeed
22:45 -!- mbe5345 [~mb@76.10.222.65] has joined #openvpn
22:45 < mbe5345> hi?
22:48 < ecrist> hi!
22:48 < ecrist> were you expecting a grander entrance?
22:52  * ecrist poofs
22:58 -!- asdfasf [~mb@cpe-75-84-106-218.socal.res.rr.com] has joined #openvpn
22:58 < asdfasf> :)
22:59 < asdfasf> i have a question
23:01 -!- mbe5345 [~mb@76.10.222.65] has quit [Ping timeout: 240 seconds]
23:01 -!- asdfasf [~mb@cpe-75-84-106-218.socal.res.rr.com] has left #openvpn []
23:31 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
--- Day changed Wed Feb 09 2011
00:11 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
00:19 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:54 -!- Kurogane [~kuro@190.87.95.13] has joined #openvpn
00:59 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:27 -!- Kurogane [~kuro@190.87.95.13] has quit [Read error: Connection reset by peer]
01:28 <@vpnHelper> RSS Update - forum: authenticate client - server <http://forums.openvpn.net/topic7617.html>
01:39 -!- Lopi is now known as Lopi|idle
01:47 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
01:50 -!- zeshoem [~mnathani@76.64.14.149] has quit [Ping timeout: 246 seconds]
02:09 -!- zeshoem [~mnathani@70.52.169.200] has joined #openvpn
02:09 -!- zeeshoem [~mnathani@70.52.169.200] has joined #openvpn
02:10 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:14 -!- pif [~ldm@zenon.apartia.fr] has quit [Ping timeout: 255 seconds]
02:18 -!- zeeshoem [~mnathani@70.52.169.200] has quit []
02:22 -!- pif [~ldm@zenon.apartia.fr] has joined #openvpn
02:47 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
02:52 -!- raomin [~romain@86.66.22.65] has joined #openvpn
02:52 < raomin>  I have a little question : how could I push routes to my client so that everything is routed through the tunnel (redirect-gateway) except 192.168.0.0/16 that is kept sent directly out of the tunnel...?
02:54 < krzee> 1sec
02:54 < krzee> !factoids search split
02:54 <@vpnHelper> "splitdns" is see http://www.thekelleys.org.uk/dnsmasq/doc.html for dnsmasq, which will let you do split-dns setups
02:54 < krzee> meh
02:54 < krzee> thats not it
02:54 < krzee> lemme find the forum post
02:54 < raomin> ok
02:55 < krzee> !learn splitroute as https://forums.openvpn.net/topic7161.html for how to do something along these lines:  route everything EXCEPT something over the tunnel
02:55 <@vpnHelper> Joo got it.
02:55 < krzee> there ya goes =]
02:56 < raomin> cool, great !
02:57 -!- albech [~thomas@124.157.245.126] has joined #openvpn
02:57 < krzee> np
02:58 < albech> how can i check that my server is actually accepting connections on port 1194? with netstat -ln it shows: udp 0 0 0.0.0.0:1194 0.0.0.0:* but no LISTEN afterwards
02:59 < albech> I have no firewall running on this box ;)
03:01 -!- macsppadic is now known as embarassppadic
03:01 < albech> when trying to connect to the server nothing appear in the server log file and in the client log file i get a timeout error after a while
03:02 < raomin> krzee: Let's say I'm on 192.168.0.2, so 192.168.0.1/24 is sent directly on eth0 ...
03:03 < raomin> krzee: wouldn't 'route 192.168.0.0 255.255.255.0 net_gateway" add explicit route for 192.168.0.0/24 to my previous gateway and not directly on eth0 ?
03:03 -!- dazo_afk is now known as dazo
03:03 < krzee> your previous gateway wasnt the router for 192.168.0.0/24...?
03:04 < raomin> No, it would have been 196.168.0.1 as I'm directly on this lan. Let me sumup the example :
03:05 < krzee> right, 196.168.0.1 was the gateway, and will still work when you set it as the gateway for 196.168.0.1/24
03:05 < krzee> did you even try it??
03:05 < raomin> Nop, just guessing... 
03:05 < krzee> heh
03:05 < krzee> just go do it
03:07 < raomin> Right, will try it. But, as I see it, I'll end up with a route for 192.168.0.0/24 to 192.168.0.1 instead of directly sent on eth0... But i'm checking now.
03:08 < krzee> so how do you think your traffic went before you overwrote your default gateway... either you think it went to 192.168.0.1 then as well, or you think that it was finding the address in the arp table and not needing to use the arp table
03:09 < krzee> which i believe is the case... are you even sure you need to use split routing in this case?
03:09 < krzee> you were losing connectivity to your LAN and are doing this to fix it?
03:13 < raomin> My bad : Lan accessibility is maintained.
03:13 < raomin> I though redirect gateway would overcome ot
03:13 < raomin> -ot +it
03:14 < krzee> "that it was finding the address in the arp table and not needing to use the arp table"  i meant not needing to use the routing table
03:16 < raomin> Hee... would the routing table goes first before the arp table ?
03:17 < krzee> backwards
03:18 <@dazo> Wouldn't it first check if the IP address belongs to the local network, and then do an arp lookup?
03:18 < raomin> anyway, when i'm connected with redirect gateway, I still have routes for the LAN of my interface, although with higher metric than the tunnel gateway
03:19 < raomin> I agree with dazo
03:19 <@dazo> If you have 192.168.1.20 ... and destination is 194.102.30.10 ... no point of doing arp lookup ... execpt of getting the router address, of cource
03:19 <@dazo> s/cource/course/
03:19 < raomin> yes, the arp request would be for 194.102.30.10
03:19 <@dazo> if doing arp first, yes
03:20 < raomin> but in case of a pre-existing arp entry for 192.168.1.20, I dont know...
03:21 < krzee> dazo, yes
03:21 -!- rond [~me@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Read error: Connection reset by peer]
03:29 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:29 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:54 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:54 -!- mode/#openvpn [+o mattock] by ChanServ
03:58 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
04:01 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9627>
04:12 < fahmad> Hello
04:13 < fahmad> krzee: i have come to point and configure bridge but i could not able to ping ips from other location ...
04:13 < fahmad> lemme show you my config
04:17 < krzee> but why show me?
04:18 < krzee> i told you i dont know bridges and cant really help with it
04:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
04:18 < krzee> that hasnt changed
04:18 < fahmad> ok but some one else can do help in this channel http://pastie.org/private/kfab3woattdljhec7pfqq
04:18 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
04:18 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
04:18 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:18 < krzee> yep
04:21 < fahmad> any one please help
04:23 < krzee> in case anyone sees fahmad's request for help... i guess ill let you know what he wants since he didnt, lol... he has a server with 32 IPs and would like to have 3 machines on the client LAN using those internet routable IPs
04:24  * fahmad hugs krzee
04:24 < fahmad> :)
04:28 < fahmad> btw i can not even ping peers 
04:28 < fahmad> from server
04:31 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:35 -!- embarassppadic is now known as lgcsppadic
04:51 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 250 seconds]
05:48 < fahmad> I have a server with 32 IPs and would like to have 3 machines on the client LAN using those internet routable IPs http://pastie.org/private/kfab3woattdljhec7pfqq
05:48 < fahmad> can someone please help me 
05:55 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Read error: Connection reset by peer]
06:03 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
06:05 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
06:07 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 246 seconds]
06:10 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
06:25 -!- Devaux [~roger@dyn-cable-customer.161.23.138.91.yetnet.ch] has quit [Quit: leaving]
06:33 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 240 seconds]
06:39 -!- theDoc [~Link@110.92.105.163] has joined #openvpn
06:40 -!- theDoc [~Link@110.92.105.163] has quit [Changing host]
06:40 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
06:57 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Quit: leaving]
06:59 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
07:08 < fahmad> hello
07:08 < fahmad> can some one please help me
07:08 < fahmad> i can ping from client but can not ping from server to client :(
07:13 < Bushmills> why not?
07:18 < Rienzilla> maybe firewall on the client is dropping incoming pings
07:19 < fahmad> Bushmills: no firewall its bridge
07:19 < fahmad> http://pastie.org/private/kfab3woattdljhec7pfqq
07:24 < fahmad> any idea
07:29 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 240 seconds]
07:30 -!- theDoc [~Link@110.92.105.163] has joined #openvpn
07:30 < ecrist> a bridge doesn't mean you cannot have a firewall
07:30 < ecrist> as a matter of fact, my home network is firewalled with a transparent bridge.
07:30 < fahmad> ecrist: i know i have disabled it
07:30 < fahmad> sir
07:31 -!- mode/#openvpn [+o ecrist] by ChanServ
07:31 -!- theDoc [~Link@110.92.105.163] has quit [Changing host]
07:31 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
07:31 -!- mode/#openvpn [-bbbb *!*apachez@*unaffiliated/apachez *!*@c-68-45-35-171.hsd1.nj.comcast.net *!*@c-69-141-28-48.hsd1.pa.comcast.net *!*@195.117.61.5] by ecrist
07:31 -!- Irssi: No bans in channel #openvpn
07:31 -!- mode/#openvpn [-o ecrist] by ecrist
07:34 < fahmad> got it working now :)
07:54 -!- pif [~ldm@zenon.apartia.fr] has quit [Quit: leaving]
08:00 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 240 seconds]
08:04 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
08:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
08:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:34 -!- gladiatr_afk is now known as gladiatr
08:42 < Rienzilla> fahmad: was it a firewall? :D
08:42 < ecrist> heh
08:46 < fahmad> Rienzilla: nope
08:47 < fahmad> it was route and config issue AFAIK
08:58 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
08:58 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
08:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
09:00 -!- raomin [~romain@86.66.22.65] has quit [Quit: leaving...]
09:00 <@vpnHelper> RSS Update - forum: authenticate client - server <http://forums.openvpn.net/topic7617.html#p9628>
09:01 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
09:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:06 < gladiatr> ahhh... google translate.  Thou hast, again, made me as unto a smart person rather than dim...
09:08 -!- fahmad [~linux@unaffiliated/fahmad] has quit [Quit: bye every one]
09:09 < gladiatr> fahmad's tap devices hadn't been bridged on either end as well.
09:09 < gladiatr> problem solved.  Joy in the land.
09:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
09:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:28 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
09:30 <@vpnHelper> RSS Update - forum: Does OpenVPN generate MAC Pause (01:80:c2:00:00:01) packets? <http://forums.openvpn.net/topic7557.html#p9629>
09:32 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:42 <@vpnHelper> RSS Update - forum: Set Clients TAP-Device Default Gateway <http://forums.openvpn.net/topic7616.html#p9630>
09:50 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 255 seconds]
09:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:53 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
09:53 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
09:59 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
10:01 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
10:03 -!- cpf_ [~cpf@91.183.51.181] has joined #openvpn
10:03 < cpf_> !welcome
10:03 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:04 < cpf_> !route
10:04 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:05 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
10:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
10:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:07 -!- cpf_ [~cpf@91.183.51.181] has quit [Read error: Connection reset by peer]
10:08 -!- cpf_ [~cpf@91.183.51.181] has joined #openvpn
10:08 -!- M^tt [~matt@mail.datatote.co.uk] has joined #openvpn
10:08 < M^tt> hello :)
10:10 < M^tt> is there a build of openvpn for i386 based windows ce 5.0 ?
10:11 -!- cpf_ [~cpf@91.183.51.181] has quit [Read error: Connection reset by peer]
10:11 -!- cpf_ [~cpf@91.183.51.181] has joined #openvpn
10:13 < gladiatr> M^tt, I think google is your friend for that information.  There isn't a winCE version that the openvpn project is involved with.
10:14 < M^tt> Most seem to be arm ppc based so im guessing thats a no go on i386 :(
10:14 -!- xattack [~enrique@dsl-200-67-222-214-sta.prod-empresarial.com.mx] has joined #openvpn
10:15 < M^tt> ta for the reply gladiatr :)
10:15 < gladiatr> good luck! 
10:16 -!- luneff [~yury@84.51.213.147] has joined #openvpn
10:18 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
10:20 <@vpnHelper> RSS Update - forum: newbie question about dhcp <http://forums.openvpn.net/topic7614.html#p9631>
10:25 -!- cpf_ [~cpf@91.183.51.181] has quit [Ping timeout: 250 seconds]
10:27 -!- cpf_ [~cpf@91.183.51.181] has joined #openvpn
10:30 < cpf_> Ok, been looking a lot for this: I need to be able to reach the client subnet (192.168.2.0/24) from the server subnet (192.168.3.0/24), where the vpn subnet is 192.168.66.0/24. I can access 192.168.66.0/24 (incl. the client)
10:30 < cpf_> Also the server router has a route for 192.168.2.0/24 over the tunnel (through the route option in config)
10:35 <@vpnHelper> RSS Update - forum: Connecting openVPN to checkpoint with username and password <http://forums.openvpn.net/topic7610.html#p9632>
10:36 -!- M^tt [~matt@mail.datatote.co.uk] has quit [Quit: Leaving]
10:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
10:41 <@vpnHelper> RSS Update - forum: Few random questions <http://forums.openvpn.net/topic7608.html#p9633>
10:41 < cpf_> And firewalls are off on both sides, quick-and-dirty.
10:41 < gladiatr> !iroute
10:41 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
10:42 < cpf_> !ccd
10:42 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
10:43 < cpf_> Ok, that's quite annoying, both client and server are dd-wrt...
10:44 -!- p3rror [~mezgani@41.140.152.203] has joined #openvpn
10:44 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
10:45 < gladiatr> rude
10:45 < gladiatr> I appreciate dd-wrt.  I'm glad it exists.  It's a right, proper whore to configure if you're not a "typical" user
10:46 < gladiatr> ,though.
10:46 < cpf_> I love dd-wrt, but I'm just exploring it.
10:46 <@vpnHelper> RSS Update - forum: connected to Tap server.. but can't ping or access anything <http://forums.openvpn.net/topic7606.html#p9634>
10:46 < cpf_> There was nothing really intended by it apart from the fact I just know little about it yet, and don't want to brick my router...
10:47 < cpf_> So I'm on-edge not to do anything wrong.
10:48 < gladiatr> dd-wrt is like my ex-girlfriend that I  get along if we don't run into each other too often.  And sometimes we scrog by the lake, but that's usually followed by extreme awkwardness.
10:48 < gladiatr> Hrm... you have the erm... switch thingie to run the tftp cilent when your router boots, right?
10:48 < gladiatr> I forget what they call it.
10:50 < cpf_> I'm getting the hang of it though... Most annoying part is to be unable to save files and expect them to presist.
10:51 < cpf_> gladiatr, GREAT, ccd worked, now to persist it :)
10:51 < gladiatr> I *think* they've got a version of dd-wrt in the archives that actually gives you a writable file system.
10:51 < gladiatr> excellent!
10:51 -!- p3rror [~mezgani@41.140.152.203] has quit [Ping timeout: 240 seconds]
10:51 < cpf_> What I do to persist is a script on startup that echo's the files.
10:51 < cpf_> Since they're not big, it should not have too much trouble.
10:52 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:56 -!- Lopi|idle is now known as Lopi
10:56 <@vpnHelper> RSS Update - forum: VPN gateway tunel for private browsing <http://forums.openvpn.net/topic7603.html#p9636> || How to set rights for user to run OpenVPN client (Linux) <http://forums.openvpn.net/topic7604.html#p9635>
10:56 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
10:56 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
11:00 -!- luneff [~yury@84.51.213.147] has quit [Read error: Connection reset by peer]
11:04 -!- cpf_ [~cpf@91.183.51.181] has quit [Ping timeout: 240 seconds]
11:05 -!- rezzen [~rezzen@nat/transgaming/x-wqqbigtsrkhvgfwa] has joined #openvpn
11:06 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
11:06 -!- p3rror [~mezgani@41.248.111.174] has joined #openvpn
11:09 < rezzen> Seeking advise for how to troubleshoot severe VPN performance degradation. Traffic from head office to branch (only in that direction) has suddenly gone from 10MB/s+ to less than 30KB/s. Unencrypted traffic is not impacted.
11:09 < rezzen> degradation has been consistent over past 24 hours
11:10 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
11:10 < ecrist> how the heck are we supposed to know?
11:10 < ecrist> I doubt it's your vpn
11:11 < gladiatr> squirrels...
11:11 < rezzen> ecrist, i'm not expecting anyone here to know. i am expecting people here to know what angles one can approach what appears to be an OpenVPN related performance issue.
11:11 < fahmad> hey
11:11 < gladiatr> heya fahmad
11:11 < ecrist> rezzen: tcpdump is a good place to start
11:11 < ecrist> logs, perhaps
11:12 < ecrist> check system load averages on your vpn endpoints.
11:12 < ecrist> check your traffic shaping rules
11:12 < fahmad> i have question let suppose i have 32 ips and i want to allow 4 ips to client only like one for his client and 3 for his lan how can i restrict it ?
11:12 < ecrist> contact your ISP, see if they're shaping UDP traffic, as some have been know to.
11:13 -!- gladiatr is now known as gladiatr_afk
11:16 < rezzen> ecrist, have done all but the last suggestion. i'm looking at that now. thanks
11:17 -!- p3rror [~mezgani@41.248.111.174] has quit [Ping timeout: 240 seconds]
11:19 -!- gladiatr_afk is now known as gladiatr
11:20 < gladiatr> fahmad, look into this
11:20 < gladiatr> !iroute
11:20 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
11:20 < fahmad> humm
11:21 < fahmad> any working example ?
11:22 < gladiatr> this is the best page I've found on the subject: http://backreference.org/2009/11/15/openvpn-and-iroute/
11:22 <@vpnHelper> Title: OpenVPN and iroute « \1 (at backreference.org)
11:24 < fahmad> thanks
11:24 < gladiatr> no problem :)
11:26 -!- lgcsppadic [~sonupunno@88.211.55.77] has quit [Quit: lgcsppadic]
11:31 -!- p3rror [~mezgani@41.248.105.220] has joined #openvpn
11:32 -!- Crenshinibon [~chatzilla@69.43.65.71] has joined #openvpn
11:33 < Crenshinibon> Hey guys, just a quick question, what language is OpenVPN written?
11:35 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
11:36 < Crenshinibon> I would like to implement a form of security for voice traffic when using OpenVPN. Does anyone know what language it is written in?
11:38 < Crenshinibon> !welcome
11:38 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:38 <@vpnHelper> RSS Update - forum: Set Clients TAP-Device Default Gateway <http://forums.openvpn.net/topic7616.html#p9637>
11:39 < Crenshinibon> !goal
11:39 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:39 < Crenshinibon> !goal Implement Security
11:39 < stony> when i have a layer 3 vpn between hosts and the main network, how can i tell openvpn to forward the broadcast packet, which has been copied to the tun interface, to all clients
11:40 < Crenshinibon> !goal I would like to secure voice traffic using open VPN. I'm also wondering what language this is written in. Am I correct in assuming that it's Java.
11:42 -!- xattack [~enrique@dsl-200-67-222-214-sta.prod-empresarial.com.mx] has quit [Read error: No route to host]
11:42 -!- luneff [~yury@84.51.213.147] has joined #openvpn
11:43 -!- Crenshinibon [~chatzilla@69.43.65.71] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
11:50 -!- p3rror [~mezgani@41.248.105.220] has quit [Ping timeout: 240 seconds]
11:55 -!- cpf_ [~cpf@188.189.105.237] has joined #openvpn
11:55 <@vpnHelper> RSS Update - forum: Set Clients TAP-Device Default Gateway <http://forums.openvpn.net/topic7616.html#p9638>
11:59 < gladiatr> stony, It doesn't work that way.  If you want to propagate broadcasts or multicasts, you'll need to use a bridged configuration.
12:01 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has left #openvpn ["Leaving"]
12:01 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
12:17 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
12:21 -!- dazo is now known as dazo_afk
12:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:22 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 276 seconds]
12:27 -!- s7r [~s7r@74.3.165.161] has joined #openvpn
12:28 -!- cpf_ [~cpf@188.189.105.237] has quit [Ping timeout: 255 seconds]
12:39 < s7r> how can I make a configuration file which will do like this: first try to connect on port 1194 UDP, i ncase it's blocked 443 TCP and in case this is blocked too 80 TCP ?
12:39 < s7r> can I do this?
12:39 < ecrist> you cannot
12:40 < s7r> clients will be from different locations and not all of them have unblocked the same ports
12:40 < s7r> so I am thinking for a wayout
12:40 < gladiatr> um... just run two openvpn processes using the same configuration (different log file locations, of course)
12:42 < s7r> I have a sample openvpn config fro ma third party (one file .ovpn) and i have in it:
12:42 < s7r> <connect>
12:42 < s7r> remote 10.0.0.1 1194
12:42 < s7r> proto udp
12:42 < s7r> </connect>
12:42 < hyper_ch> hi ecrist
12:42 < s7r> and immediately after <connect>
12:42 < s7r> remote 10.0.0.1 443
12:42 < s7r> proto tcp
12:42 < s7r> remote 10.0.0.1 80
12:42 < s7r> proto tcp
12:42 < s7r> </connect>
12:42 < s7r> the same file
12:42 -!- s7r was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
12:42 < gladiatr> blau
12:43 -!- s7r [~s7r@74.3.165.161] has joined #openvpn
12:43 < s7r> sorry
12:43 < gladiatr> lol
12:43 < gladiatr> s7r, so what's with the connect </connect business?  You talking about AS?
12:44 < s7r> gladiatr: I am talking about a .ovpn file on my computer which tries different protocols and ports on the same server, the same config file
12:44 < fahmad> i think he wants same proto tcp and udp in same client config
12:44 < s7r> in case firt does not work second and so on
12:44 < s7r> I want : if the client has not port blocked 1194 UDP to use that. if that is blocked to use TCP 443. if that is blocked too to use TCP 80
12:45 < gladiatr> what sort of clients?
12:46 < s7r> what do you mean what sort of clients? clients connecting to the openvpn server to route their itnernet traffic through my server and access blocked content by their ISPs
12:46 < gladiatr> ...
12:46 < gladiatr> windows?  linux?  bsd?  iphones?
12:47 < s7r> windows
12:47 < s7r> clients are on windows
12:47 < s7r> most of them
12:47 < gladiatr> gotcha.  
12:49 < fahmad> O_o
12:49 < gladiatr> Hrm... Well, I'd suggest perhaps including netcat with your client distribution and have a script which uses it to try connecting to your VPN ports in the preferred order
12:49 < gladiatr> I only suggest netcat as there's a version that works with windows.  It would mean having a .bat file for starting up the client rather than the gui.  otherwise, I think you'd be stuck telling your clients to try one until something works :\
12:50 < s7r> gotcha - good point
12:50 < s7r> but what is with the <connect></connect>
12:50 < s7r> the configuration file I have does this with no additional software
12:50 < s7r> how is it possible for this provider to do this ?
12:50 < fahmad> i think we can not use it with community version <connect></connect>
12:51 < s7r> could he use other software than OpenVPN community project
12:51 < fahmad> they are using AS
12:51 < s7r> ohhhhh
12:51 < gladiatr> ahhh
12:51 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
12:51 < s7r> that was the issue
12:51 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
12:51 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
12:51 < s7r> now everything makes sense
12:51 < s7r> sorry gladiatr never crossed my mind they use their own scripts for Openvpn
12:51 < s7r> i thought they had the community project
12:51 < gladiatr> np mate
12:52 < s7r> so the <connect></connect> tag is a tag which can be used only with AS right?
12:52 < fahmad> yes AFAIK
12:52 < fahmad> if wrong someone correct me :)
13:03 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
13:05 -!- alhadi [~thunderst@92.96.238.104] has quit [Quit: alhadi]
13:08 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
13:09 < stony> gladiatr: why do i have to use a bridged configuration when i want to forward broadcasts ?
13:10 < gladiatr> my example...
13:11 < gladiatr> tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
13:11 < gladiatr>           inet addr:10.10.7.6  P-t-P:10.10.7.5  Mask:255.255.255.255
13:11 < gladiatr> I'm using 10.10.7.0/24 as my vpn network
13:11 < gladiatr> where is a broadcast going to go on this device?
13:11 < gladiatr> :)
13:11 < stony> gladiatr: you know things like brouting and proxy arp?
13:11 < gladiatr> I'm familiar with proxy arp, but not brouting
13:12 < stony> gladiatr: try to get this:
13:12 < stony> gladiatr: i have a network 10.1.1.0/24
13:12 < stony> the vpn part of the network is 10.1.1.0/28
13:13 < stony> so every client that connects to the vpn on a layer 3 (three) connection gets an ip somewhere between 10.1.1.1 and 10.1.1.15
13:13 < stony> as the subnet mask on the vpn client is /24 as well, i can use .15
13:13 < stony> then the client routed 10.1.1/24 to the tun device
13:13 < stony> and the vpn router routes 10.1.1.0/28 to the tun device of openvpn
13:13 < stony> proxy arp is enabled
13:14 < stony> so when 10.1.1.254 is asking for 10.1.1.1 it gets the mac of the router, and sends the packet to the router on layer2 the same way as if it is sending a packet to the router to forward to a different subnet
13:14 < stony> so when i have /24 in the vpn clients network and /24 on the local network
13:15 < stony> i can say "hey mr. firewall, whenever you see a packet going to 10.1.1.255 just copy it over to the tun device opened by openvpn
13:15 < stony> then the packet is send to openvpn but openvpn itself is not forwarding it to the clients...
13:15 < stony> so it's working completly, but when it comes to openvpn it stops
13:15 < gladiatr> So... it's not working completely.
13:15 < stony> yep
13:16 < stony> the problem is that openvpn is not forwarding the packet to _ALL_ clients
13:16 < stony> only to a random one
13:16 < stony> when i use a tun device per client ( running openvpn as inetd program) it works
13:16 < stony> but imho this is just wasting of ressources
13:17 < gladiatr> out of curiosity, are you using the topology switch?
13:17 < stony> topology w0t?
13:17 < stony> this means: i'm not using it
13:17 < gladiatr> hehe
13:18 < stony> there's no need for that
13:18 < gladiatr> your clients are each taking up the typical /30 
13:18 < stony> but i'm running mpls in the back
13:18 < stony> no my clients are all getting a /24
13:18 < stony> that's the "magic" behind brouting ;)
13:19 < gladiatr> slow down there buddy.  If you're using a tun device on the server, each client is taking up 4 addresses on your VPN network.
13:19 < stony> gladiatr: nope
13:19 < stony> btw there are also ptp tun devices for winodow now :D
13:23 < stony> gladiatr: still there ?
13:23 < gladiatr> ish
13:23 < stony> you're so silent - division by zero error?
13:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:24 < gladiatr> Not sure what to add.   
13:25 < stony> ehehehe
13:37 -!- s7r [~s7r@74.3.165.161] has quit [Ping timeout: 250 seconds]
13:56 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
14:14 -!- dollabill [~mike@199.44.8.98] has quit []
14:23 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
14:25 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
14:37 -!- rezzen [~rezzen@nat/transgaming/x-wqqbigtsrkhvgfwa] has quit [Quit: rezzen]
14:40 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:54 -!- lisa [~lisa@titanium.thedoh.com] has joined #openvpn
14:55 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has joined #openvpn
14:56 < HoboSteaux> I have 2 interfaces and want all incoming ovpn traffig going in one, and out to network via the other. should i bridge or bond?
15:09 -!- [Enrico] [U2FsdGVkX1@gentoo/contributor/Enrico] has joined #openvpn
15:11 < [Enrico]> hi there :) . i'm using openvpn server on my router and i'm connecting via networkmanager plugin. do you know if there is a switch to make it using  --remote-cert-tls server option by any chance? with the "default" config it warns me no server auth method is enabled. so i found a switch for tls-remote and the result is -> --tls-remote server which seems to work for what i understand, but i read in the howto it is not the preferred method
15:17 -!- gladiatr is now known as gladiatr_afk
15:21 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html>
15:27 < anitxor> [Enrico]: i thought it was the prefered method?
15:28 < [Enrico]> anitxor: as i read the howto the preferred method is  --remote-cert-tls server option, but i can't find it in networkmanager openvpn plugin config
15:28 < [Enrico]> anitxor: actually i'm able to use --tls-remote server option with the nm plugin (and it works)
15:29 < [Enrico]> since i have a self managed CA this is not really a problem, but still this is not the preferred method
15:29 < anitxor> oh
15:30 < [Enrico]> anitxor: my reference is this http://openvpn.net/index.php/open-source/documentation/howto.html#mitm
15:30 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:30 < anitxor> i accidently mixed them
15:30 < anitxor> what kind of router do you use for openvpn?
15:30 < [Enrico]> the reason why i use networkmanager is: it is really handy, for routing and things like that
15:31 < [Enrico]> anitxor: i have a buffalo WZR-HP-G300NH
15:31 < [Enrico]> running dd-wrt currently (dd-wrt is the factory firmware for this router), i might switch to openwrt in the future..... dunno
15:32 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
15:32 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
15:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:32 < [Enrico]> anitxor: i will use the vpn to WOL (wake up on lan) my pc from a remote location
15:32 < anitxor> [Enrico]: oh sorry, i dont know how to do such things. i always used openbsd or debian to setup openvpn. quite simple once one has learned how to use ip, pf, iptables, route..
15:33 < [Enrico]> anitxor: oh well the server setup is the same as in debian. i'm talking about the client config
15:33 < anitxor> it takes a few days to learn it all, but its worth it :)
15:33 < [Enrico]> since i'm not calling openvpn directly, i'm using the networkmanager openvpn plugin as i said
15:33 < anitxor> ooooh
15:33 < [Enrico]> anitxor: yeah seems really worth. i like openvpn, definetly more secure then pptp which is a big security hole
15:34 < anitxor> indeed!
15:34 < anitxor> dosnt pptp use rc4 or something also
15:34 < anitxor> for encryption
15:34 < [Enrico]> i think it use ms-chap, a bug mess in short
15:34 < [Enrico]> uses*
15:35 < anitxor> [Enrico]: but the networkmanager is just a frontend for automatically configuring openvpn scripts and activiting them, right? isnt it possible to modify the scripts by hand also?
15:36 < [Enrico]> anitxor: i dunno, that's the point :)
15:36 < anitxor> or why not just write a simple config file and type "openvpn --config /path/to/client.config.file --daemon"
15:36 < anitxor> ...as root
15:36 < [Enrico]> anitxor: couse networkmanager is really handy in handling routes and so on :)
15:36 < [Enrico]> and i don't need to be root to start the vpn
15:36 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Changing host]
15:36 -!- rot13 [~var@unaffiliated/rot13] has joined #openvpn
15:36 < [Enrico]> it is just handy nothing more
15:37 < anitxor> [Enrico]: if you want to, you could instruct the server side of openvpn to automatically push routes to the client side, making routing invisible for the clients
15:37 < [Enrico]> anitxor: i done it :)
15:37 < anitxor> :D
15:38 < [Enrico]> anitxor: of couse i asked in the #nm channel first but no one answered for now
15:38 -!- bba [~bba@93.1.40.113] has joined #openvpn
15:38 < [Enrico]> so i came here to see if someone else already solved my problem
15:40 < anitxor> :) sorry that i couldnt help you out
15:40 < [Enrico]> anitxor: don't worry. thanks for the try :D
15:40 < anitxor> i has no idea why one should use networkmanager, i mostly try my best to avoid it since it trashes all my routing with its automagical behaviours
15:41 < hyper_ch> network manager <3
15:41 < anitxor> and it tries to fsck up the dhcp stuff at all times
15:41 < [Enrico]> anitxor: i like it very much couse i can do routing via networkmanager very easly
15:41 < anitxor> :)
15:41 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
15:41 < [Enrico]> anitxor: of couse if you configure nothing in it, it will erase all your routing
15:41 < [Enrico]> it should be smart enough to learn from the current config may be ;)
15:42 < [Enrico]> for now it isn't eheheh
15:42 < [Enrico]> but if you have the patience to understand how it manage routes. you can make routing with just 2 clicks and no root password
15:47 < [Enrico]> may be i can try to have a look at the networkmanager openvpn source code
15:49 < [Enrico]> mhm ok a quick ack on the source code tells me there is no support for it (i think)
15:49 -!- p3rror [~mezgani@41.248.184.237] has joined #openvpn
15:51 < [Enrico]> i will use tls-remote for now. but i will eventually fill a feature request for networkmanager
15:57 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
15:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:00 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:12 < ecrist> !ubuntu
16:12 <@vpnHelper> "ubuntu" is dont use network manager!
16:14 -!- ixmatus [~ixmatus@ip174-65-67-198.sd.sd.cox.net] has joined #openvpn
16:16 < ixmatus> I have an OpenVPN server running (on a FreeBSD box) behind a wireless router (DD-WRT) - all set up properly, port forwarding to the FreeBSD/OpenVPN server, and I have the client setup. Client can connect but I am unable to ping anything within the network
16:16 < ixmatus> I setup tap0 interface and the bridge0 interface
16:16 < ixmatus> could someone with a bit of experience help me out?
16:17 < ixmatus> been at this for a while and can't get it to fly
16:18 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
16:18 -!- Lantizia [~Lantizia@erebus.seaquake.net] has quit [Ping timeout: 240 seconds]
16:18 < [Enrico]> ixmatus: a little side note: i can't ping too, but couse my router firewall is configured to drop ping packets, so it might be normal. still i can for example use ssh and so on
16:20 < ixmatus> nada
16:20 < ixmatus> pretty sure I setup the bridge right too
16:20 < ixmatus> shouldn't I be able to ping clients within the network though anyway?
16:21 < [Enrico]> i have no idea to be honest. i began my openvpn adventure just today eheheh
16:22  * ecrist reads up
16:23 < ixmatus> I had this same issue with the DD-WRT OpenVPN server too, figured I could solve it by putting the OpenVPN server on another machine behind the router and just forward it all...
16:23 < ixmatus> I'm not getting any sauce on the OpenVPN forums either...
16:23 < ixmatus> PPTP sucks balls (particularly with OS X)
16:23 < ecrist> !configs
16:23 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
16:23 < ecrist> ixmatus: ^^^
16:24 < ixmatus> will do, one sec
16:26 < ixmatus> server config: http://pastebin.com/g1jfFyC4
16:27 < anitxor> ixmatus: why do you push the google DNS?
16:28 -!- cpf_ [~cpf@94-226-3-72.access.telenet.be] has joined #openvpn
16:28 < ixmatus> honestly, couldn't figure out if that was supposed to push a DNS (as I have configured on the router) or if that was for a locally owned DNS
16:28 < ixmatus> so I opted to push that, should I be commenting it out?
16:28 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
16:29 < ixmatus> client config: http://pastebin.com/JQU0iXkg
16:29 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
16:29 < anitxor> ixmatus: no? :) i dont think it will break stuff if you push the google DNSes, rather the opposite. just that google will see what sites the users access (which is not a good thing?)
16:30 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
16:30 < ixmatus> Google DNS is faster than my ISP's
16:30 < ixmatus> anything I don't want people to see I just use TOR
16:31 <@vpnHelper> RSS Update - forum: Clients cannot ping each other. <http://forums.openvpn.net/topic7607.html#p9640>
16:33 -!- Lantizia [~Lantizia@erebus.seaquake.net] has joined #openvpn
16:33 < anitxor> ixmatus: likely this line is the most important one to debug: "server-bridge 192.168.0.10 255.255.255.0 192.168.0.50 192.168.0.100"
16:33 < anitxor> ixmatus: oes your server listen at 192.168.0.10?
16:33 < anitxor> (it has an interface that responds to ping at that ip?)
16:34 < ixmatus> well, here's my setup: the FreeBSD server that is running OpenVPN has an assigned IP of 192.168.0.10
16:34 < ixmatus> it's on the re0 interface
16:34 < ixmatus> the router just forwards anything coming in on 1194 to 192.168.0.10
16:34 < ixmatus> so, I'm assuming that is a yes
16:34 < anitxor> :)
16:35 < ixmatus> 192.168.0.50-100 -> do those IP's need to be handled in any sort of meaningful way by the router?
16:35 < ixmatus> DHCP on the router is handing out a range of 192.168.0.2-20
16:36 < ecrist> ixmatus: you don't have a firewall between your vpn and lan, do you?
16:36 < ixmatus> nope
16:36 < ixmatus> the router has a firewall on it, I'll disable it to see if that makes a difference, but I assumed it only walled everything between the router and the WAN modem
16:37 < ecrist> when a client connects, do they get an IP?
16:37 < ecrist> oh, durr, I think I see the problem.
16:37 < ixmatus> ??
16:37 < ecrist> you should change the IP range you're using
16:37 -!- ixmatus [~ixmatus@ip174-65-67-198.sd.sd.cox.net] has quit [Read error: Connection reset by peer]
16:37 < ecrist> lol
16:37 -!- ixmatus [~ixmatus@ip174-65-67-198.sd.sd.cox.net] has joined #openvpn
16:38 < ecrist> you should change the IP range you're using
16:38 < ecrist> !1918
16:38 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, adn 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html
16:38 < ixmatus> hmm
16:38 < ecrist> my guess is the remote ip range conflicts with the client's local ip range
16:39 < ecrist> so, where the server is, use something like 192.168.5.0/24 instead of 192.168.[01].0/24
16:39 < ecrist> those two are WAY too common
16:39 < anitxor> oh
16:39 < ixmatus> hmmm
16:40 < [Enrico]> ecrist: that's a good point :)
16:40 < ecrist> I'm not just a pretty face. ;)
16:40 < [Enrico]> lol :D
16:40 < ecrist> I actually *do* contribute once in a while
16:41 < ixmatus> so, I should change the ip assignments that DHCP hands out so I can assign the OpenVPN server a private netblock?
16:42 < ecrist> I'd change the entire lan address scheme where the server sits to a less-common range
16:42 < ixmatus> okay
16:42 < ixmatus> I'll give that a shot
16:42 < ixmatus> thanks for the help
16:42 < ixmatus> I really do appreciate it
16:42 < ecrist> that way you can keep your bridging setup
16:42 < ecrist> no problem.
16:42  * ixmatus is off...
16:42 -!- ixmatus [~ixmatus@ip174-65-67-198.sd.sd.cox.net] has left #openvpn []
16:43 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has joined #openvpn
16:56 < [Enrico]> i'm off to sleep. good night :)
16:57 -!- [Enrico] [U2FsdGVkX1@gentoo/contributor/Enrico] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
16:58 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
16:58 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
16:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:01 -!- ixmatus [~ixmatus@ip174-65-67-198.sd.sd.cox.net] has joined #openvpn
17:03 < ixmatus> well, that was a no go
17:04 < ixmatus> do any of you know what I can do to get logs/debugs of what is going on with OpenVPN and my network interfaces?
17:06 < reiffert> echo "verb 5" >> client.conf
17:06 -!- cpf_ [~cpf@94-226-3-72.access.telenet.be] has quit [Ping timeout: 276 seconds]
17:07 < ixmatus> elevated verb levels don't give me anything useful
17:07 < ixmatus> everything between the client and server is copasetic
17:07 < ixmatus> it has to be the interfaces, because the logs on client/server are all happy
17:08 < reiffert> openvpn stop; ifconfig -a > /tmp/1; openvpn start; sleep 60; ifconfig -a  > /tmp/1; diff -u /tmp/1 /tmp/2
17:10 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:14 < ecrist> !logs
17:14 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
17:14 < ecrist> ixmatus: what, specifically, isn't working?
17:14 < ecrist> do clients connect, and do they get IPs?
17:15 < ixmatus> yes
17:15 < ixmatus> gimme a second to paste logs, I rebooted the server
17:15 < ixmatus> client connects fine
17:15 < ixmatus> gets an IP
17:16 < ixmatus> after about a minute the tap0 interface on the client gets an additional 169 address though (on top of the one assigned by the VPN)...
17:16 < ecrist> that seems odd.  windows client, I assume?
17:17 < ixmatus> OS X
17:17 < ecrist> even more strange
17:17 < ecrist> you're using the same combo I am, really
17:17 < ecrist> freebsd server, os x client
17:17 < ecrist> with dev tap
17:17 < krzee> ecrist, if you catch fahmad on at night, he could use some of your bridging expertise =]
17:18 < ecrist> I'm talked to him here and there.
17:18 < krzee> and did you see the final version of my bio on JJK's book>?  you're in it :)
17:18 < ecrist> don't think he cares much for me. ;)
17:18 < ecrist> yeah, I saw that.  I was in the first one, too. :)
17:19 < ixmatus> pasting logs
17:19 < ixmatus> client log: pastebin.com/d9Sdv6vy
17:20 < ixmatus> server log: http://pastebin.com/b9DHXD6y
17:20 < ixmatus> both set to verb 3
17:21  * ecrist wonders if viscosity has an issue
17:21 < ixmatus> tried it with a different client too
17:21 < ecrist> tunnelblick?
17:21 < ixmatus> Shimo
17:21 < ecrist> ixmatus: looks like you have multiple clients using the same certificate...
17:22 < ixmatus> just one
17:22 < ixmatus> I created the certs today
17:22 < ecrist> line 17 of your server logs indicates otherwise
17:22 < ixmatus> probably because of two different clients? as in Viscosity and Shimo?
17:23 < ecrist> i think you either have an extra instance of a client running, or a second machine using the same cert
17:23 < ixmatus> I know my laptop is the only client to have the client certs though
17:23 < ixmatus> mm
17:23 < ecrist> open a terminal in OS X, type "ps auxwww | grep vpn"
17:24 < ecrist> kill all those processes you see for 'openvpn' and start a fresh connection
17:25 < ixmatus> no dice
17:25 < ecrist> verb up to 5 for client and server, please
17:27 < ixmatus> doing so
17:27 < ixmatus> btw, for your FreeBSD server
17:27 < ixmatus> you also create a bridge interface, right? (that's what I'm doing, just checking)
17:27 < ixmatus> ifconfig bridge0 create
17:27 < ixmatus> ifconfig bridge0 addm re0 addm tap0 up
17:27 < ixmatus> correct?
17:27 < ixmatus> (in a script, obvioiusly)
17:30 < ecrist> my static tap interface and bridge interfaces are created in rc.conf
17:30 < ecrist> openvpn just manipulates them, and I have an up/down script
17:31 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:32 < ixmatus> same here
17:33 < ixmatus> Client log: http://pastebin.com/42k4ejXZ
17:33 -!- zhorX [~happyface@warp.skyhook.ca] has quit [Read error: Operation timed out]
17:33 < ecrist> is your bridge0 interface 'up'
17:33 < ecrist> and your tap0 interface ?
17:33 < ixmatus> yes
17:33 < ixmatus> Server log http://pastebin.com/fWbinFQA
17:34 < ixmatus> ifconfig: http://pastebin.com/Ucw52d7a
17:34 < ecrist> ifconfig tap0 up
17:34  * ecrist cheers
17:34 < ecrist> shoots one in the hoop
17:34 < ecrist> **swoosh**
17:35  * ixmatus types...
17:35 < ixmatus> holy shit
17:36 < ixmatus> yyyyeeeeeah!
17:36 < ecrist> see, not just a pretty face
17:36 < ixmatus> if you were in San Diego I would buy you beer
17:36 < ecrist> now, sir
17:36 < ixmatus> so strange
17:37 < ixmatus> ooh
17:37 < ixmatus> I know why
17:37 < ixmatus> darh
17:37 < ecrist> in your rc.conf, make sure you have
17:37 < ixmatus> ifconfig_tap="up"
17:37 < ixmatus> it should be tap0
17:37 < ecrist> cloned_interfaces="bridge0 tap0"
17:37 < ecrist> ifconfig_tap="up"
17:37 < ixmatus> oh?
17:37 < ecrist> sorry, tap0
17:37 < ixmatus> I don't have the cloned_interfaces directive in there
17:37 < ecrist> slipped on the keyboard
17:37 < ixmatus> what does that do?
17:38 < reiffert> put him some beer on top of his paypal account :)
17:38 < ecrist> cloned_interfaces does the ifconfig create command, but I think newer versions of the netstart scripts will detect it
17:38 < ecrist> ifconfig_tap0="up"
17:38 < ecrist> that's what you need. :)
17:38 < ixmatus> ahhh
17:39 < ixmatus> gotcha
17:39 < ixmatus> I was running an ifconfig bridge0 create script...
17:39 < ixmatus> so that makes that unnecessary
17:39 < ecrist> yes
17:39 < ixmatus> reiffert is right, I do owe you something, I banged my head on this for the last five days
17:39 < ecrist> from our server
17:39 < ecrist> cloned_interfaces="bridge0 tap0"
17:39 < ecrist> ifconfig_bridge0="inet 10.0.5.5 netmask 255.255.0.0 addm em0 addm tap0 up"
17:39 < ecrist> ifconfig_tap0="up"
17:40 < ixmatus> I don't have the netmask in the bridge0 directive, I'll add that in there too
17:40 < ecrist> CIDR notation is OK in there, as well
17:41 < ixmatus> 10.0.5.5 is the same as your em0 interface's inet?
17:41 < ecrist> ifconfig_bridge0="inet 10.0.5.5/16 addm em0 addm tap0 up" works too
17:41 < ecrist> heh, no
17:41 < ecrist> we just happen to put the IP on the bridge interface, instead of the physical interface for that vlan
17:42 < ixmatus> oh oh oka
17:42 < ecrist> we have ~8 vlans, 10 different subnets, lots of static routing
17:42 < ecrist> and we're going to roll out quagga for BGP/IGRP for our AS later this year.
17:42 < ecrist> should be excitiing
17:43 < ixmatus> are you a sysadmin?
17:43  * reiffert really wonders about the using bridge part unless you have to :)
17:43 < ecrist> yes
17:43 < ecrist> reiffert: until openvpn 2.3 comes out, it'll make ipv6 on the vpn much easier. ;)
17:43 < ixmatus> mmm, well thank you very much for helping this frustrated programmer...
17:43 < ecrist> no problem, ixmatus 
17:44  * ecrist poofs
17:44 < reiffert> ecrist: ah, interesting.
17:45 < ecrist> also, reiffert, I'm lazy, and AFP and CIFS/SAMBA work real swell like this
17:45 < reiffert> :)
17:45 < ecrist> it works just fine for ~20 machines
17:45 < reiffert> yap
17:46 < ecrist> we *have* been burnt by an errant sysadmin (/me eyes EmperorTom) causing routing loops, though...
17:46 < ecrist> however, we're equipped to deal with issues (and actually know what a loop is, and a broadcast storm, etc etc)
17:47 < ecrist> tg for STP
17:47 < ecrist> :)
17:47 < reiffert> I was just about to type the letters STP, burn, bridge, vlan :)
17:48 < reiffert> ecrist: ever tried what happens when you plugin a bridge into two network ports to one of your switches?
17:49 < ecrist> nope, don't really want to either.  I prefer to keep special smoke where it blongs
17:50 < reiffert> It will be very intresting to see how the equipment will react to something like these kind of broadcast storms :)
17:50  * ecrist really poofs
17:50 < reiffert> to poof?
18:05 -!- anitxor [~xor@cryptoanarchy.org] has quit [Ping timeout: 250 seconds]
18:06 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:06 -!- anitxor [~xor@cryptoanarchy.org] has joined #openvpn
18:09 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
18:09 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
18:09 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
18:10 -!- ixmatus [~ixmatus@ip174-65-67-198.sd.sd.cox.net] has left #openvpn ["ERC Version 5.3 (IRC client for Emacs)"]
18:33 -!- pfein [~human@213.163.65.50] has joined #openvpn
18:44 -!- Lantizia [~Lantizia@erebus.seaquake.net] has quit [Read error: Operation timed out]
19:02 -!- Lantizia [~Lantizia@erebus.seaquake.net] has joined #openvpn
19:13 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
19:37 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Connection reset by peer]
19:44 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
19:46 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
19:52 < HoboSteaux> I have 2 interfaces and want all incoming ovpn traffig going in one, and out to network via the other. should i bridge or bond?
19:55 < nDuff> bridge
19:56 < pfein> question: I've got virtualbox VM i'd like to set up so that it *only* routes traffic through an openvpn
19:56 < pfein> if the vpn is down for some reason, it should just fail
19:56 < pfein> any suggestions on how do to that? my iptables-fu is week
20:06 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
20:15 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 272 seconds]
20:16 -!- takamichi [~pri@85.232.213.54] has quit [Remote host closed the connection]
20:19 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
20:19 -!- stony is now known as Guest59638
20:21 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:43 -!- pfein [~human@213.163.65.50] has quit [Quit: Konversation terminated!]
20:48 -!- pfein [~human@dynamic-66-243-239-34.ellensburg.fairpoint.net] has joined #openvpn
21:01 -!- pfein [~human@dynamic-66-243-239-34.ellensburg.fairpoint.net] has quit [Read error: Connection reset by peer]
21:07 -!- master_of_master [~master_of@p57B56B03.dip.t-dialin.net] has quit [Ping timeout: 265 seconds]
21:09 -!- master_of_master [~master_of@p57B566F8.dip.t-dialin.net] has joined #openvpn
21:44 -!- fahmad [~linux@vpn.server4sale.com] has joined #openvpn
21:44 -!- fahmad [~linux@vpn.server4sale.com] has quit [Changing host]
21:44 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
22:29 <@vpnHelper> RSS Update - forum: Administrator Rights TAP driver Install <http://forums.openvpn.net/topic7619.html>
22:47 -!- fahmad [~linux@unaffiliated/fahmad] has quit [Quit: brb]
23:12 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:21 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Remote host closed the connection]
23:23 -!- Ramblurr [~rmblr@quassel.jefferai.org] has joined #openvpn
23:23 -!- Ramblurr [~rmblr@quassel.jefferai.org] has quit [Changing host]
23:23 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
23:58 -!- albech [~thomas@124.157.245.126] has joined #openvpn
--- Day changed Thu Feb 10 2011
00:03 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Read error: No route to host]
00:04 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
00:07 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Client Quit]
00:08 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
00:13 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
00:17 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:22 -!- bba [~bba@93.1.40.113] has quit [Quit: Leaving...]
00:46 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
00:52 -!- takamichi [Takamichi@85.232.213.54] has joined #openvpn
01:04 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
01:20 -!- pfein [~human@rotterdam.perfect-privacy.com] has joined #openvpn
01:24 < pfein> if my VPN provider gave me config files that create TUN, can i modify those to use TAP instead?
01:24 < pfein> or is there server-side stuff going on too?
01:25 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:29 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:31 -!- bba [~bba@212.51.174.146] has joined #openvpn
01:33 < hyper_ch> pfein: you can easily try that out yourself, right?
01:44 < pfein> hyper_ch: well, before I go digging through mountains of docs/googles, I figured I'd check if I was wasting my time
01:44 < pfein> i changed dev tun to dev tap, it failed to connect, here i am
01:45 < pfein> like, I just want to know if it's possible, not asking you to do it for me
01:55 < reiffert> pfein: 
01:55 < reiffert> !goal
01:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:56 < pfein> ok!
01:56 < pfein> Goal: I have a virtualbox VM; i'd like to set things up so that it's *only* network access is over my vpn
01:56 < pfein> if the vpn goes down for some reason, the packets get dropped
01:57 < reiffert> when the packets get dropped (all of them), the vpn wouldnt come up once.
01:57 < pfein> ?
01:58 < reiffert> dude, when the vpn client is not allowed to talk to the vpn server, there wont be any vpn connection.
01:58 < reiffert> so what the minimum requirement for your setup is a host route from the vpn client to your vpn server.
01:59 < pfein> well, I was thinking i'd make the vpn connection on the host and iptables<mumble> to the interface exposed by the VM
01:59 < reiffert> how far did you get?
02:02 < pfein> mm, i think i got the host iptables forward right (maybe?), but the routes on the guest seemed all messed up
02:04 < pfein> was trying to get it working with eh0 first, seemed similar
02:04 < pfein> tho tbh, it looks like virtualbox can set up the bridge for you, but only with a tap, not a tun (hence original question)
02:04 < reiffert> skip the firewall part. set it to allow everything. dont do anything.
02:05 < reiffert> does the vpn connection work?
02:05 < pfein> vpn on the host? sure
02:05 < reiffert> great.
02:05 < reiffert> show me the routing table of your vb host when vpn is connected.
02:06 < reiffert> !paste
02:06 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
02:06 < pfein> the firewall was to drop packets from guest over eth0 but accept them over vpn...
02:07 < reiffert> your vpn connection packets use eth0.
02:07 < pfein> yes
02:07 < pfein> i understand
02:07 < reiffert> iptables -P OUTPUT DROP
02:08 < reiffert> iptables -I OUTPUT -o eth0 --dport 1194 -d the.server -j ACCEPT
02:08 < reiffert> be sure to push
02:08 < reiffert> !def1
02:08 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
02:08 < reiffert> #3
02:09 < reiffert> iptables -I OUTPUT -o tun0 -j ACCEPT
02:09 < reiffert> That's what I would try first.
02:10 < pfein> so i want vboxnet0 (software iface to guest exposed on host by vbox) to route over tun0 and dropped on eth0;
02:10 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9642>
02:10 < reiffert> I have to leave now as I have to prepare some vpn setup for my customers right now. He will join in 20 minutes and I didnt have coffee nor loud music today.
02:10 < pfein> reiffert: well, go fix that my good sir!
02:10 < pfein> ty for your help
02:23 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
02:23 -!- p3rror [~mezgani@41.248.184.237] has quit [Ping timeout: 240 seconds]
02:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:38 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:38 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
02:38 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
02:40 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:43 -!- dazo_afk is now known as dazo
02:50 -!- pfein [~human@rotterdam.perfect-privacy.com] has quit [Remote host closed the connection]
02:55 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:02 -!- fahmad [~linux@unaffiliated/fahmad] has quit [Ping timeout: 260 seconds]
03:02 -!- fahmad [~linux@vpn.server4sale.com] has joined #openvpn
03:02 -!- fahmad [~linux@vpn.server4sale.com] has quit [Changing host]
03:02 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
03:17 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
03:25 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has joined #openvpn
03:25 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has quit [Changing host]
03:25 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:26 -!- Guest59638 [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Operation timed out]
03:27 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
03:31 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
03:31 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
03:32 -!- stony is now known as Guest39847
03:43 -!- IcePic [jj@freenode/sponsor/icepic] has joined #openvpn
03:44 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:45 < IcePic> Hi, I have a working openvpn setup with three vpn servers, serving three different needs where all of them have a pool of ips from which clients randomly receive a /30 and all is fine. Now I would like a fourth one where I can force the users of those to always get the same specific /30s so I later on inside my network can firewall specific certs(users) to only see very specific ports.
03:45 < IcePic> How do one go about setting up static mappings in openvpn? 
03:46 < IcePic> ..for more than one user, of course. The basic example of one-client-one-server is fine, but if I aim at 10+ different clients/certs that I need to be able to differentiate by tunnel-ip later
03:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
03:47 < janjust> IcePic: does each vpn server have its own subnet?
03:47 < IcePic> as of now, yes.
03:48 < IcePic> I have no lack of ip ranges to use, just dont know how to not make the pool behind the 4th server be dynamic
03:49 < IcePic> I could have one server instance per client of course, using a port of its own, but I was hoping for a easier solution
03:50 < janjust> there are 3 options: use a 1) ifconfig-pool-persist file  2) use a client-connect script 3) use client-configuration files for each client
03:50 < janjust> options 2 and 3 are a bit more work but are guaranteed to work, if you get it right
03:50 < janjust> option 1 is the easiest but you need to populate the ifconfig-pool-persist file first
03:52 < IcePic> and it would need to have a gazillion seconds lifetime
03:52 < janjust> the reason that I mention "guaranteed to work" is that with the ifconfig-pool-persist option you can get some nasty side effects if more clients connect then your subnet allows
03:52 < janjust> just set it to 0 after the file is populated - then it is never updated
03:53 < IcePic> it would mean I need the client to connect, so I can figure out which ip they got, then adapt local rules to that after the first connect
03:53 < IcePic> ..for the Nth client
03:54 < janjust> if you know the list of certificates that will be allowed to connect you can prepopulate the file as well
03:54 < janjust> each line is of the form 'client-cert-name,client-ip-address'
03:55 < janjust> where in your case the IP address is the /30 address block (e.g. 10.200.0.4, 10.200.0.8, etc)
03:55 < IcePic> yes, that could work. 
03:56 < IcePic> I was worried about openvpn expiring stuff under my feet, but if 0 works, then its basically static and controlled by me
03:56 < janjust> it could and should; however, as I said, openvpn *may* decide to recycle addresses from the ifconfig-pool-persist file if more clients connect than the "server" pool allows
03:56 < janjust> that how it works, as explained in the man page
03:56 < IcePic> great
03:58 -!- Rolybrau [~Rolybrau@140-65.78-83.cust.bluewin.ch] has joined #openvpn
03:58 -!- Rolybrau [~Rolybrau@140-65.78-83.cust.bluewin.ch] has quit [Changing host]
03:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:59 < IcePic> janjust: thanks for all the help
04:00 < janjust> IcePic: no problem, good luck and you could also consider switching to 'topology subnet' mode - that will save you the /30 addresses
04:10 <@vpnHelper> RSS Update - forum: Route delete error on win7 64bit <http://forums.openvpn.net/topic7592.html#p9643>
04:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 246 seconds]
04:18 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:26 < reiffert> !static
04:26 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
04:27 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:27 <@vpnHelper> RSS Update - forum: Route delete error on win7 64bit <http://forums.openvpn.net/topic7592.html#p9644>
04:36 -!- luneff [~yury@84.51.213.147] has quit [Read error: Connection reset by peer]
04:37 -!- luneff [~yury@84.51.213.147] has joined #openvpn
04:39 -!- Ri0t [765e1ff5@gateway/web/freenode/ip.118.94.31.245] has joined #openvpn
04:40 -!- Ri0t [765e1ff5@gateway/web/freenode/ip.118.94.31.245] has left #openvpn []
04:40 <@vpnHelper> RSS Update - forum: forwarding issue <http://forums.openvpn.net/topic7596.html#p9649> || Route delete error on win7 64bit <http://forums.openvpn.net/topic7592.html#p9647> || non interactive key generation - windows ver <http://forums.openvpn.net/topic7620.html>
04:46 <@vpnHelper> RSS Update - forum: forwarding issue <http://forums.openvpn.net/topic7596.html#p9650>
04:58 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:58 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:04 <@vpnHelper> RSS Update - forum: Route delete error on win7 64bit <http://forums.openvpn.net/topic7592.html#p9648>
05:05 < reiffert> routing problem: the server should do "route 123 255" after client X conncets. and should do "route 234 255" when client Y connects.
05:05 < reiffert> so I entered:
05:05 < reiffert> route 234 255 in ccd/X
05:05 < reiffert> route 123 255 in ccd/Y
05:05 < reiffert> (exchange X and Y on the last two lines)
05:05 < reiffert> but it doesnt happen. what am I supposed to do/change here?
05:06 < janjust> reiffert: are you sure the CCD files are picked up? try using an absolute path in 'client-config-dir' 
05:06 < reiffert> I'm sure those files are picked up, as they contain iroute stuff and the ifconfig-push lines which work just fine.
05:07 < reiffert> root@reifferscheid:/etc/openvpn/ccd1194# cat hans 
05:07 < reiffert> iroute 10.1.50.0 255.255.255.0
05:07 < reiffert> ifconfig-push 10.8.12.4 255.255.255.0
05:07 < reiffert> route 10.1.50.0 255.255.255.0
05:07 < reiffert> first two lines work, 3rd line does not.
05:08 < janjust> ah, you've put a route statement inside the ccd file... that indeed does not work
05:08 < reiffert> note: the *server* should add this route when client hans connects.
05:08 < janjust> route statement need to go into the global section. there's a patch for this so that 'route' statements can be put inside ccd files but that's not released yet
05:08 < reiffert> It didnt work when I kept the line in the global section as well.
05:09 < reiffert> (hence the ccd attempt)
05:09 < janjust> are you using 'topology subnet' ?
05:09 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
05:09 < reiffert> so I have to enter "route add -net 10.1.50.0 255.255.255.0 dev tun0" manually.
05:09 < reiffert> subnet, rifht.
05:09 < reiffert> right
05:10 < janjust> then try adding 'route 10.1.50.0 255.255.255.0 10.1.50.1' to the server config file (i.e. explicitly add the vpn server IP)
05:11 < reiffert> the vpn server ip is 10.8.12.1
05:11 < janjust> alright, then put 'route 10.1.50.0 255.255.255.0 10.8.12.1' in the server config
05:13 < reiffert> works, thanks!
05:13 < janjust> no problem
05:28 <@vpnHelper> RSS Update - forum: Does OpenVPN generate MAC Pause (01:80:c2:00:00:01) packets? <http://forums.openvpn.net/topic7557.html#p9652>
05:34 <@vpnHelper> RSS Update - forum: Does OpenVPN generate MAC Pause (01:80:c2:00:00:01) packets? <http://forums.openvpn.net/topic7557.html#p9653>
05:44 -!- luneff [~yury@84.51.213.147] has quit [Quit: Leaving]
05:48 -!- bba [~bba@212.51.174.146] has quit [Ping timeout: 276 seconds]
06:43 -!- luneff [~yury@84.51.195.188] has joined #openvpn
06:44 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:59 -!- bba [~bba@212.51.174.146] has joined #openvpn
07:03 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
07:20 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
07:20 -!- takamichi [Takamichi@85.232.213.54] has quit [Read error: Operation timed out]
07:20 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
07:21 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
07:26 -!- dazo is now known as dazo_afk
--- Log closed Thu Feb 10 08:01:33 2011
--- Log opened Thu Feb 10 08:01:38 2011
08:01 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
08:01 -!- Irssi: #openvpn: Total of 139 nicks [5 ops, 0 halfops, 0 voices, 134 normal]
08:02 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
08:02 -!- Irssi: Join to #openvpn was synced in 56 secs
08:16 -!- [Enrico] [U2FsdGVkX1@gentoo/contributor/Enrico] has joined #openvpn
08:17 < [Enrico]> hi there :). what type of VPN do you suggest for a slow connection? bridge or routing? (just one client so scalability is not a problem). also tcp or udp?
08:18 < [Enrico]> currently i'm using routing with udp and a 2048 key...... it feels fair slow, and i think couse the connection is not the best
08:28 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
08:29 -!- takamichi [~pri@85.232.213.54] has joined #openvpn
08:39 <@vpnHelper> RSS Update - forum: Administrator Rights TAP driver Install <http://forums.openvpn.net/topic7619.html#p9654>
08:41 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
08:47 -!- gladiatr_afk is now known as gladiatr
08:49 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 240 seconds]
08:50 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
08:59 -!- theDoc [~Link@110.92.105.163] has quit [Changing host]
08:59 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
09:04 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:17 -!- xindz`off is now known as xindz
09:17 -!- raomin [~romain@86.66.22.65] has joined #openvpn
09:32 -!- sef [~sef@69.94.13.17] has joined #openvpn
09:32 < sef> !welcome
09:32 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:33 < sef> !howto
09:33 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
09:34 < ecrist> sef gets a gold star
09:35 < sef> heh, well I remember someone mentioning a script to walk through configuring openvpn in here once, can't find it now
09:35 < ecrist> !confgen
09:35 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
09:36 < sef> sweet, thanks!
09:36 < ecrist> no problem.
09:41 -!- macsppadic is now known as emacspaddic
09:41 < gladiatr>  mmm... those scripts are full of awesomeness.
09:44 -!- emacspaddic is now known as macsppadic
09:48 < [Enrico]> !route
09:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:51 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has joined #openvpn
09:51 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has quit [Changing host]
09:51 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
09:52 -!- luneff [~yury@84.51.195.188] has joined #openvpn
09:58 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: buh-bye ubuntu...]
10:06 -!- dazo_afk is now known as dazo
10:13 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:19 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:26 -!- cmeiklejohn [cmeiklejoh@pdpc/supporter/active/cmeiklejohn] has joined #openvpn
10:27 < cmeiklejohn> Hi there
10:34 -!- p3rror [~mezgani@41.140.159.12] has joined #openvpn
10:36 -!- alhadi [~thunderst@92.96.238.104] has joined #openvpn
10:38 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:42 < cmeiklejohn> Was just wondering if someone could help me out with a openvpn problem i'm experiencing in debian.
10:42 < cmeiklejohn> !welcome
10:42 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:43 -!- pfein [~human@nl.gigabit.perfect-privacy.com] has joined #openvpn
10:43 < cmeiklejohn> !/goal
10:43 < cmeiklejohn> !goal
10:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:44 -!- raomin [~romain@86.66.22.65] has quit [Remote host closed the connection]
10:45 -!- raomin [~romain@86.66.22.65] has joined #openvpn
10:49 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:53 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
10:54 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
10:54 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
10:54 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
10:56 -!- macsppadic is now known as blamevlad
10:59 -!- bba [~bba@212.51.174.146] has quit [Quit: Leaving...]
11:00 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
11:02 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
11:04 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
11:05 -!- luneff [~yury@84.51.195.188] has quit [Read error: No route to host]
11:06 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
11:06 -!- Blackhold [~Blackhold@195.160.225.34] has joined #openvpn
11:06 < Blackhold> hi
11:06 < Blackhold> is possible to connect to vpn without certificate?
11:11 < [Enrico]> it is
11:11 < [Enrico]> but still you need a CA to auth the server iirc
11:12 < [Enrico]> but the client can just provide a user password or a pre shared key
11:12 < Blackhold> I'm trying to connect a machine without graphical interface
11:12 < Blackhold> with username and password would be enough
11:12 -!- blamevlad [~sonupunno@88.211.55.77] has quit [Quit: blamevlad]
11:13 < Bushmills> !howto
11:13 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
11:13 < Bushmills> Blackhold:  see quickstart
11:13 < Bushmills> method of connecting, using PSKs is explained there
11:14 < Blackhold> Bushmills: I would like to not use certificates
11:14 < Blackhold> I would like to tell to end user to put an ip, a username and password
11:14 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
11:15 -!- sef [~sef@69.94.13.17] has left #openvpn []
11:15 < Bushmills> there's no cert involved with PSKs
11:18 < Blackhold> now first I'm trying with a linux machine without graphical interface
11:27 -!- p3rror [~mezgani@41.140.159.12] has quit [Ping timeout: 240 seconds]
11:33 -!- azizLIGHTS [~azizLIGHT@ec2-50-17-254-25.compute-1.amazonaws.com] has joined #openvpn
11:33 < azizLIGHTS> why my tunnel speed so slow
11:35 -!- Guest39847 is now known as stony
11:37 < stony> azizLIGHTS: i'll check the crystal ball, just a second...
11:37 < stony> ...it's because there is so much traffic on it ...
11:38 < azizLIGHTS> there is no traffic my friend
11:38 < azizLIGHTS> 30kB/s when my connection can go 500kB/s
11:38 < azizLIGHTS> and cpu usage is 0%
11:38 < stony> azizLIGHTS: you know, the part with the crystal ball was just ironic
11:39 < azizLIGHTS> what it means
11:39 < stony> azizLIGHTS: you provide so much information, we can't even get it sorted
11:40 < azizLIGHTS> what info you need from me stony ?
11:42 < azizLIGHTS> i am on Ubuntu 10.04.2 LTS  2.6.32-312, openvpn 2.1.0-1ubuntu1.1 
11:42 < azizLIGHTS> client is win7 with openvpngui 1.03
11:43 < stony> you're running a layer 2 or 3 connection ?
11:44 < azizLIGHTS> i do not know unfortauntly
11:44 < stony> tun or tap devices?
11:44 -!- pfein [~human@nl.gigabit.perfect-privacy.com] has quit [Remote host closed the connection]
11:44 -!- raomin [~romain@86.66.22.65] has quit [Quit: leaving...]
11:45 < azizLIGHTS> i have "dev tun" line in my /etc/openvpn/server.conf
11:45 < azizLIGHTS> my win7 client has a tap adapter
11:45 < azizLIGHTS> tap-win32 adapter v8
11:46 -!- p3rror [~mezgani@41.140.179.38] has joined #openvpn
11:47 < stony> azizLIGHTS: hm, ok and you're using /30 subnets ?
11:47 < azizLIGHTS> how to check this?
11:48 < stony> what did you configure on the server when it comes to hand out ip addresses to the clients?
11:48 <@dazo> azizLIGHTS: you check the subnet mask on your VPN IP addresses
11:48 < azizLIGHTS> i obtained the server.conf from stratumsecurity blog..
11:50 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
11:50 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
11:50 < azizLIGHTS> is this useful for that question: "Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.80.6/255.255.255.252 "
11:51 < azizLIGHTS> my server conf looks like this guys: http://www.stratumsecurity.com/sites/default/files/server.conf
11:52 < azizLIGHTS> that answer the question?
11:53 < azizLIGHTS> "It uses the IP address scheme of 10.8.80.0/24 for VPN clients" this it?
11:53 < stony> hm
11:53 < stony> it's hard to say, but i would really go for cpu usage and traffic on both sites
11:53 < stony> because using /24 with /30 doesn't make sense
11:54 < stony> or he's using /24 to allocate /30s out of it
11:54 < stony> that could be possible
11:54 < stony> but when the connection works, and you can ping the other endpoint the problem is somewhere else
11:54 < azizLIGHTS> connection works, but just slow
11:55 < azizLIGHTS> maybe my isp is throttling somehow?
11:55 < azizLIGHTS> can this be posibility 
11:57 -!- bba [~bba@93.1.40.113] has joined #openvpn
11:59 -!- dws60451 [~dws@dws3.Stanford.EDU] has quit [Remote host closed the connection]
12:00 -!- p3rror [~mezgani@41.140.179.38] has quit [Ping timeout: 240 seconds]
12:00 < stony> azizLIGHTS: sure
12:01 < azizLIGHTS> pls advice me what i can do to make it faster
12:14 -!- p3rror [~mezgani@41.140.38.164] has joined #openvpn
12:20 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html>
12:23 < azizLIGHTS> what is required to change the port ?
12:23 < azizLIGHTS> maybe this port is throttled
12:23 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
12:24 < ecrist> update your config file
12:24 < ecrist> --port
12:24 < azizLIGHTS> what does --port mean
12:24 < ecrist> !man
12:24 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
12:26 < azizLIGHTS> i cant just edit the config?
12:27 -!- p3rror [~mezgani@41.140.38.164] has quit [Ping timeout: 240 seconds]
12:27 < ecrist> yes, you can,
12:27 < ecrist> there is a config option, port
12:27 < ecrist> change the port number
12:27 < krzee> !--
12:27 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
12:28 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:28 < azizLIGHTS> idk what is difference between --port --lport --rport
12:28 < krzee> read the manual on each?
12:29 < azizLIGHTS> i just wnat to change port
12:29 < ecrist> azizLIGHTS: read the man page
12:29 < krzee> [10:24]  <ecrist> --port
12:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:30 < azizLIGHTS> is ;something a comment in the config?
12:30 < azizLIGHTS> or active setting
12:31 < krzee> ; and # are comments
12:31 < krzee> !comment
12:31 < krzee> !comments
12:32 < krzee> !learn comment as you can use ; or # to make comments in the config file
12:32 <@vpnHelper> Joo got it.
12:41 <@vpnHelper> RSS Update - forum: help.. <http://forums.openvpn.net/topic7563.html#p9656>
12:45 -!- p3rror [~mezgani@41.140.155.197] has joined #openvpn
12:51 <@vpnHelper> RSS Update - forum: Windows auto-connect when starting gui <http://forums.openvpn.net/topic7623.html>
12:52 -!- [Enrico] [U2FsdGVkX1@gentoo/contributor/Enrico] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
12:54 -!- s7r [~s7r@89.39.174.74] has joined #openvpn
12:56 < s7r> <connect></connect> tags are available only when using AS ? don't work with community project?
12:57 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:58 -!- p3rror [~mezgani@41.140.155.197] has quit [Ping timeout: 240 seconds]
13:08 < krzee> s7r, 
13:08 < krzee> !man
13:08 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
13:08 < krzee> those manuals are for the community version
13:08 < krzee> they talk about <connect> tags =]
13:08 < krzee> err <connection>
13:09 < s7r> krzee: i can not find anything about connect tags
13:10 < s7r> i just want to know if they can be used within the community project or I should have AS to use them
13:10 < krzee> s7r, have you tried looking in the manual?
13:10 < s7r> yes I searched <connect>
13:10 < s7r> but no results :p
13:10 < krzee> ahh, because its <connection>
13:11 < s7r> can't find <connection> either 
13:11 < krzee> i started typing <connect> and it highlighted the first part of <connection> before i got to <con
13:11 < s7r> i have the man page opened in front right now
13:11 < krzee> you are at http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html ?
13:12 <@vpnHelper> Title: OpenVPN 2.1 (at openvpn.net)
13:12 < s7r> i was looking on te 2.0 manual
13:12 < krzee> 2.0 is pretty old
13:13 < s7r> yes this was exactly what i was looking for
13:13 < s7r> :X
13:13 < s7r> thx
13:13 < krzee> yw
13:13 < s7r> i thought only AS could do it but fortunately good community project is still reliable :D
13:13 < krzee> =]
13:20 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
13:21 -!- bba [~bba@93.1.40.113] has joined #openvpn
13:26 -!- s7r [~s7r@89.39.174.74] has left #openvpn []
13:30 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
13:31 -!- alhadi [~thunderst@92.96.238.104] has quit [Ping timeout: 255 seconds]
13:36 -!- dazo is now known as dazo_afk
13:41 -!- alhadi [~thunderst@92.96.217.226] has joined #openvpn
13:45 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
13:51 -!- Blackhold [~Blackhold@195.160.225.34] has quit [Quit: leaving]
13:55 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:56 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
14:02 -!- WIthout [Quota@175.139.16.178] has joined #openvpn
14:11 -!- p3rror [~mezgani@41.140.34.0] has joined #openvpn
14:12 < WIthout> which os to best to setup openvpn with authentication ?
14:18 < krzee> any sort of unix
14:18 < krzee> (or linux)
14:22 < gladiatr> that crazy talk.
14:23 < gladiatr> at/at's
14:26 < hyper_ch> hi krzee
14:28 < krzee> hey
14:32 < hyper_ch> krzee: are you good with multi nic routing?
14:33 < krzee> like joining 2 networks?
14:33 < krzee> or having 2 uplinks?
14:33 < hyper_ch> no, like having two dsl modem routers and running them at the same time
14:33 < hyper_ch> 2 uplinks
14:33 < ecrist> that's called multihoming
14:33 < krzee> sure, but whats the actual goal?
14:33 < ecrist> and it's a pain in the ass
14:33 < krzee> its a pain in the ass depending on your actual goal
14:34 < krzee> if you only want outbound to google to go through 1, thats pretty basic
14:34 < hyper_ch> it's not me who has it but someone I know who servers a great piece of software from his home connections
14:34 < krzee> or maybe inbound services only working from 1 isp, and other for outbound usage... still not so hard
14:35 < hyper_ch> and he has some problems setting things up properly
14:35 < lisa> does openvpn retransmit dropped UDP packets?
14:35 < krzee> hyper_ch, you still didnt say his goal
14:35 < hyper_ch> not so sure about it.... all those routing is above my simple brain
14:36 < krzee> without a goal, nothing is possible
14:36 < hyper_ch> if I understand correctly he wants to route web/svn through one uplink and use the other one for himself
14:40 < krzee> just needs 2 routing tables
14:40 < krzee> much like this:
14:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:41 < krzee> https://forums.openvpn.net/topic7175.html
14:41 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN with redirect-gateway renders public ip inaccessable : Configuration (at forums.openvpn.net)
14:43 < hyper_ch> krzee: he's not online right now :(
14:44 < hyper_ch> I'll forward the link
14:44 < hyper_ch> but at least I was right that we have some routing geniouses here
14:47 < krzee> then he puts each router on the same subnet
14:47 < krzee> only default route for lan needs to give dhcp (if either will)
14:48 < krzee> ie: .1 is default .254 is web/SVN only
14:48 < hyper_ch> thx, I'll forward that
14:51 -!- p3rror [~mezgani@41.140.34.0] has quit [Read error: Connection reset by peer]
15:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:06 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
15:07 -!- p3rror [~mezgani@41.248.184.191] has joined #openvpn
15:09 -!- alhadi [~thunderst@92.96.217.226] has quit [Ping timeout: 240 seconds]
15:09 -!- alhadi2 [~thunderst@85.17.20.89] has joined #openvpn
15:28 < WIthout> Hi, my openvpn connected but unable to surf any webs
15:28 < WIthout> is it iptables setting wrong?
15:29 < krzee> !redirect
15:29 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:30 < WIthout> !def1
15:30 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
15:31 < WIthout> !nat
15:31 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:31 -!- xindz is now known as xindz`off
15:38 < WIthout> krzee: i've redirect completed, i can surf web with openvpn now... but there's problem, the vpn seems very slow loading webs etc 
15:38 < WIthout> the network is fine
15:40 < Bushmills> WIthout: check whether the first name server in your resolv.conf responds
15:41 -!- azizLIGHTS [~azizLIGHT@ec2-50-17-254-25.compute-1.amazonaws.com] has quit [Quit: leaving]
15:54 < krzee> also, test speeds with iperf
15:54 < krzee> and remember that all your traffic first goes to the vpn server, then to the internet, so it SHOULD be slower
15:55 -!- mahogany [~per@s83-177-27-76.cust.tele2.se] has joined #openvpn
15:55 < mahogany> Hello
15:58 < mahogany> I've been trying for hours to make this work without luck. I want to route traffic to an internet IP through an OpenVPN connection since that server only accepts traffic originating from inside our office network. I've tried to add all sorts of routes without getting the desired effect. Can I accomplish this via some setting in my .ovpn file? I cannot modify the server config. I'm running OpenVPN on a Windows machine.
16:01 < Bushmills> mahogany: is the accepted address an internet-routed address? 
16:03 < mahogany> yes
16:03 < Bushmills> therefore you can connect to that server, when not routing through openvpn, but fail when routing through openvpn?
16:05 < mahogany> Well, what I have now is [laptop] -> [internet] -> [public server]. The problem is [public server] only accepts SSH connection if the client IP is our office NAT server. So I'd like to do [laptop] -> [open vpn] -> [NAT] -> [public server]. Which according to "tracert IP" seems to work. Although putty can't reach the host.
16:06 < mahogany> When I don't route the traffic through the OpenVPN putty can reach the host, the host just refuses the connection.
16:06 < Bushmills> !clientlan
16:06 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
16:06 <@vpnHelper> better explanation
16:06 < mahogany> (I added route IP 255.255.255.255 to my ovpn file).
16:06 < Bushmills> read this ^^^
16:06 < Bushmills> ehm. no. wrong
16:07 < Bushmills> you use openvpn to connect to office site, before NAT.  
16:07 < mahogany> Yes.
16:07 < mahogany> So I want to route the traffic to that specific IP via the NAT server inside the office LAN. Which I think should be possible since I'm connected to that LAN via OpenVPN.
16:08 < Bushmills> so you can reach openvpn server. can you reach anything on the lan behind it?
16:08 < mahogany> yes.
16:09 < Bushmills> did you check with mtr or traceroute, both directions, where your traffic to server is lost? 
16:09 -!- p3rror [~mezgani@41.248.184.191] has quit [Ping timeout: 240 seconds]
16:13 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
16:13 < mahogany> I think it might be the OpenVPN server that doesn't correctly route the traffic back to my laptop.
16:14 < mahogany> After adding "route [public server ip] 255.255.255.255" to my ovpn file, tracert shows me that traffic to that IP does go through the NAT in the office LAN.
16:14 < mahogany> But, when I try to connect to that server on port 22 (or 80 via firefox) it just times out.
16:15 < Bushmills> "go through NAT" means "reaches server"?
16:15 < mahogany> Yes.
16:15 < Bushmills> thus, server replies to traceroute, and replies reach notebook through openvpn?
16:16 < mahogany> Yup.
16:16 < Bushmills> doesn't sound like a routing problem. firewall is more likely. 
16:17 < mahogany> Probably something that has to be changed on the OpenVPN server.
16:17 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
16:17 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
16:17 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:18 < Bushmills> try mtr, which can trace the route using tcp packet, on port 80, for example
16:19 < mahogany> Installing it now! :)
16:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:30 < mahogany> This just isn't working and it's a bit late to dive into. I'll bother our sysadm with it tomorrow. :) Thanks for your help Bushmills!
16:33 -!- mahogany [~per@s83-177-27-76.cust.tele2.se] has quit [Quit: leaving]
16:39 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
16:39 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
16:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
16:54 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
16:59 -!- golubeff [~golubeff@208.87.217.226] has joined #openvpn
17:04 < golubeff> Hey guys. I'm trying to set up routing from my vpn server. I want my VPN server to route all traffic through my VPN client. This is very unusual condition, because usually people route traffic from VPN client through VPN server, not the other way around. So I set up routing on my VPN server like this: route add -host <external ip> dev tun0 gw 10.8.0.2. 10.8.0.2 is P-t-P server ip. My client tun0 has 10.8.0.6 and 10.8.0.6 p-t-p. I set up masquerading on 
17:04 < golubeff> machine within iptables. I also enabled ip_forward on client machine. Now I'm trying to ping <external ip> from server. I expect that package to go through my client machine and return the same way. But no ping return. At the same time I can ping 10.8.0.6 from my VPN server. And I can ping <external ip> from my VPN client. I have no idea, how should I figure this out. I really need your help. 
17:05 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
17:09 -!- [intra]lanman [~lanman@h96-61-34-34.mdsnwi.tisp.static.tds.net] has joined #openvpn
17:09 -!- [intra]lanman [~lanman@h96-61-34-34.mdsnwi.tisp.static.tds.net] has quit [Changing host]
17:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:13 < WIthout> what's the bestway to manage 40client at once? 
17:15 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
17:15 < Bushmills> !clientlan
17:15 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
17:15 <@vpnHelper> better explanation
17:16 < Bushmills> golubeff: ^^^maybe that describes your needs
17:16 < Bushmills> WIthout: by delegation
17:20 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
17:20 < golubeff> !ccd
17:20 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
17:21 < golubeff> !route_outside_openvpn
17:21 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
17:22 < golubeff> well, it turns out, i've done all that stuff already.
17:28 < ecrist> if you did 'all that stuff' you'd have a working vpn
17:29 -!- mant1s [~mant1s@130.111.162.229] has joined #openvpn
17:29 -!- mant1s [~mant1s@130.111.162.229] has quit [Changing host]
17:29 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:29 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
17:36 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has quit [Read error: No route to host]
17:36 -!- noogenesis [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
17:38 < golubeff> !iroute
17:38 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
17:40 -!- p3rror [~mezgani@41.140.41.68] has joined #openvpn
17:45 -!- p3rror [~mezgani@41.140.41.68] has quit [Read error: Connection reset by peer]
17:50 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
17:50 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
17:50 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Operation timed out]
17:57 -!- mant1s [mant1s@2002:8d72:d42a::8d72:d42a] has joined #openvpn
17:57 -!- mant1s [mant1s@2002:8d72:d42a::8d72:d42a] has quit [Changing host]
17:57 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
17:58 -!- WIthout [Quota@175.139.16.178] has quit [Ping timeout: 250 seconds]
17:58 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
17:59 -!- WIthout [Quota@175.139.16.178] has joined #openvpn
18:02 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has left #openvpn ["Leaving"]
18:12 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:12 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
18:12 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
18:12 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
18:17 -!- p3rror [~mezgani@41.140.42.165] has joined #openvpn
18:21 -!- golubeff [~golubeff@208.87.217.226] has quit [Read error: Connection reset by peer]
18:21 -!- alhadi2 [~thunderst@85.17.20.89] has quit [Ping timeout: 240 seconds]
18:23 -!- golubeff [~golubeff@208.87.217.226] has joined #openvpn
18:23 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
18:23 -!- golubeff [~golubeff@208.87.217.226] has quit [Client Quit]
18:23 -!- loa [~loa@46.147.21.165] has quit [Read error: No route to host]
18:24 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
18:44 -!- Quota [Quota@175.139.16.178] has joined #openvpn
18:44 -!- WIthout [Quota@175.139.16.178] has quit [Read error: Connection reset by peer]
18:50 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 245 seconds]
18:51 -!- bba [~bba@93.1.40.113] has joined #openvpn
19:08 -!- Quota [Quota@175.139.16.178] has quit [Ping timeout: 245 seconds]
19:08 -!- WIthout [Quota@175.139.16.178] has joined #openvpn
19:10 -!- WIthout [Quota@175.139.16.178] has quit [Read error: Connection reset by peer]
19:17 -!- Meliorator [m@dunnington.eu] has quit [Read error: Connection reset by peer]
19:29 -!- p3rror [~mezgani@41.140.42.165] has quit [Ping timeout: 265 seconds]
19:35 -!- Meliorator [m@dunnington.eu] has joined #openvpn
19:35 -!- Meliorator [m@dunnington.eu] has quit [Max SendQ exceeded]
19:36 -!- Meliorator [m@dunnington.eu] has joined #openvpn
19:39 -!- zamba [marius@flage.org] has quit [Ping timeout: 272 seconds]
19:39 -!- golubeff [~golubeff@208.87.217.226] has joined #openvpn
19:41 -!- p3rror [~mezgani@41.140.46.146] has joined #openvpn
19:42 < golubeff> I've managed to set up access from server to lan over client. The problem was that initially i missed iroutes. So my server can now access LAN over client. But it still does not work for the Internet, located over client. What could be the reason for it? 
19:43 < golubeff> To be more specific, I can access Internet, if I specify iroute 8.8.8.8 255.255.255.255, but it does not work. if I specify it as iroute 0.0.0.0 0.0.0.00
19:45 -!- zamba [marius@flage.org] has joined #openvpn
19:53 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:53 -!- p3rror [~mezgani@41.140.46.146] has quit [Ping timeout: 276 seconds]
19:55 -!- golubeff_ [~golubeff@75.101.111.180] has joined #openvpn
19:59 -!- golubeff__ [~golubeff@208.87.217.226] has joined #openvpn
19:59 -!- golubeff [~golubeff@208.87.217.226] has quit [Ping timeout: 255 seconds]
19:59 -!- golubeff__ is now known as golubeff
19:59 -!- golubeff_ [~golubeff@75.101.111.180] has quit [Ping timeout: 240 seconds]
20:00 -!- golubeff_ [~golubeff@75.101.111.180] has joined #openvpn
20:02 -!- golubeff__ [~golubeff@208.87.217.226] has joined #openvpn
20:03 -!- golubeff___ [~golubeff@75.101.111.180] has joined #openvpn
20:04 -!- golubeff [~golubeff@208.87.217.226] has quit [Ping timeout: 255 seconds]
20:04 -!- golubeff___ is now known as golubeff
20:05 -!- golubeff_ [~golubeff@75.101.111.180] has quit [Ping timeout: 240 seconds]
20:07 -!- golubeff__ [~golubeff@208.87.217.226] has quit [Ping timeout: 255 seconds]
20:14 -!- golubeff_ [~golubeff@208.87.217.226] has joined #openvpn
20:15 -!- jfkw [~jtk@216.115.1.60] has quit [Quit: leaving]
20:15 -!- golubeff__ [~golubeff@75.101.111.180] has joined #openvpn
20:17 -!- golubeff [~golubeff@75.101.111.180] has quit [Ping timeout: 240 seconds]
20:17 -!- golubeff__ is now known as golubeff
20:18 -!- golubeff_ [~golubeff@208.87.217.226] has quit [Ping timeout: 255 seconds]
20:25 -!- golubeff [~golubeff@75.101.111.180] has quit [Ping timeout: 246 seconds]
20:32 -!- golubeff [~golubeff@75.101.111.180] has joined #openvpn
20:35 -!- josephyancey [18db7087@gateway/web/freenode/ip.24.219.112.135] has joined #openvpn
20:36 -!- golubeff [~golubeff@75.101.111.180] has quit [Ping timeout: 246 seconds]
20:37 < josephyancey> does openvpn have a proxy built into it?  Basically, I need access to the internal network and all traffic from the client to come from the server.
20:38 < josephyancey> can that be accomplished via openvpn?
20:40 <@vpnHelper> RSS Update - forum: Excluding an IP range from redirect gateway <http://forums.openvpn.net/topic7065.html#p9658>
20:43 -!- golubeff_ [~golubeff@208.87.217.226] has joined #openvpn
20:44 -!- golubeff__ [~golubeff@75.101.111.180] has joined #openvpn
20:47 -!- golubeff___ [~golubeff@208.87.217.226] has joined #openvpn
20:47 -!- golubeff_ [~golubeff@208.87.217.226] has quit [Ping timeout: 255 seconds]
20:49 -!- golubeff__ [~golubeff@75.101.111.180] has quit [Ping timeout: 276 seconds]
20:52 -!- golubeff___ [~golubeff@208.87.217.226] has quit [Quit: golubeff___]
20:57 -!- albech [~thomas@119.42.76.234] has joined #openvpn
20:58 -!- josephyancey [18db7087@gateway/web/freenode/ip.24.219.112.135] has quit [Ping timeout: 246 seconds]
20:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
21:05 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:06 -!- master_of_master [~master_of@p57B566F8.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:08 -!- master_of_master [~master_of@p57B52CCB.dip.t-dialin.net] has joined #openvpn
21:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
--- Log closed Thu Feb 10 21:22:13 2011
--- Log opened Thu Feb 10 21:22:18 2011
21:22 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
21:22 -!- Irssi: #openvpn: Total of 131 nicks [4 ops, 0 halfops, 0 voices, 127 normal]
21:23 -!- Irssi: Join to #openvpn was synced in 51 secs
21:23 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
21:30 -!- Netsplit *.net <-> *.split quits: ping-pong, N|KO, mete, tjz, areq, sigius, optiz0r
21:39 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
21:57 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:57 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:57 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:01 -!- krzie [krzee@hemp.ircpimps.org] has joined #openvpn
22:01 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
22:01 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
22:01 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
22:01 -!- N|KO [niko@174.89.243.98] has joined #openvpn
22:01 -!- mete [~metefr@84.200.12.194] has joined #openvpn
22:01 -!- optiz0r [~optiz0r@miranda.sihnon.net] has joined #openvpn
22:01 -!- areq [~areq@pld-linux/areq] has joined #openvpn
22:06 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
22:34 <@vpnHelper> RSS Update - forum: Route (windows) traffic through openVPN gateway <http://forums.openvpn.net/topic7602.html#p9659>
22:40 <@vpnHelper> RSS Update - forum: OpenVPN routing fails, but only sometimes. (windows client) <http://forums.openvpn.net/topic7600.html#p9661> || Packaging of Open VPN <http://forums.openvpn.net/topic7279.html#p9660>
22:49 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:52 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:28 -!- albech_ [~thomas@119.42.76.234] has joined #openvpn
23:31 -!- albech [~thomas@119.42.76.234] has quit [Ping timeout: 240 seconds]
--- Day changed Fri Feb 11 2011
00:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
00:21 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:29 -!- zamba [marius@flage.org] has quit [Ping timeout: 260 seconds]
00:30 -!- zamba [marius@flage.org] has joined #openvpn
00:33 -!- ucekpolish [~ucek@hq.ostc-pl.com] has quit [Ping timeout: 246 seconds]
00:59 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:21 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
01:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:30 -!- mode/#openvpn [+o mattock] by ChanServ
01:34 -!- bba [~bba@93.1.40.113] has quit [Quit: Leaving...]
01:38 -!- takamichi [~pri@85.232.213.54] has quit [Ping timeout: 240 seconds]
01:57 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:58 -!- sunshineduck [~sunshined@74.117.157.235] has joined #openvpn
01:59 < sunshineduck> !welcome
01:59 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:00 < sunshineduck> !goal
02:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:01 < sunshineduck> so do i just ask
02:01 < sunshineduck> or what
02:01 < sunshineduck> >_>
02:02 < sunshineduck> !wiki
02:02 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN, or (#2) Official wiki is at https://community.openvpn.net/openvpn/wiki
02:03 -!- wylker [~chatzilla@adsl-70-234-250-7.dsl.rcsntx.sbcglobal.net] has joined #openvpn
02:07 -!- cmeiklejohn [cmeiklejoh@pdpc/supporter/active/cmeiklejohn] has quit [Read error: Operation timed out]
02:08 -!- cmeiklejohn [cmeiklejoh@pdpc/supporter/active/cmeiklejohn] has joined #openvpn
02:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
02:12 -!- sunshineduck [~sunshined@74.117.157.235] has quit [Ping timeout: 255 seconds]
02:15 -!- sunshineduck [~sunshined@74.117.157.235] has joined #openvpn
02:31 -!- bba [~bba@212.51.174.146] has joined #openvpn
02:36 < wylker> can anyone confirm that in tun mode openvpn does not forward udp traffic?
02:38 < IcePic> I can prove the opposite
02:40 < IcePic> So whatever made you think that, is based on something else not working for you, some filter or some grave misunderstanding.
02:41 < wylker> well it started with something not working
02:41 < wylker> which led me to look for solutions
02:41 < wylker> which led to someone saying it didnt' work
02:41  * nDuff wonders if wylker is talking about broadcast traffic.
02:41 < wylker> lol
02:41 < nDuff> wylker, standard unicast UDP absolutely works.
02:42 < wylker> ugh
02:42 < wylker> well then im back to something jsut not working
02:43 < wylker> i'm trying to help a friend, running openvpn server on an openvz VPS
02:43 < wylker> so its a config I had never done before
02:43 < wylker> he's basically just trying to get some games to work from inside his school's firewall
02:43 < wylker> the client connects ok but it seems traffic is just not getting through
02:44 < IcePic> Make structured tests then, using a game as a network debug tools is bound to give you a hard time
02:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:44 -!- IcePic [jj@freenode/sponsor/icepic] has left #openvpn []
02:45 < wylker> that leads us into the land of things wylker doesn't know about
02:55 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
02:57 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 260 seconds]
03:02 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:02 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
03:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
03:07 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
03:08 -!- stony is now known as Guest85341
03:12 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:19 <@vpnHelper> RSS Update - forum: Does OpenVPN generate MAC Pause (01:80:c2:00:00:01) packets? <http://forums.openvpn.net/topic7557.html#p9662>
03:35 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
03:38 -!- ivenkys [~ivenkys@81.168.100.197] has quit [Ping timeout: 246 seconds]
03:48 -!- dazo_afk is now known as dazo
03:55 <@vpnHelper> RSS Update - forum: connect from server to client <http://forums.openvpn.net/topic7420.html#p9663>
03:55 -!- dustybin [~dustybin@78-86-171-176.zone2.bethere.co.uk] has joined #openvpn
03:56 < dustybin> is there a such thing as a official openvpn client software?
03:56 < dustybin> for windows
04:02 -!- raomin [~romain@86.66.22.65] has joined #openvpn
04:04 -!- dazo [~dazo@openvpn/community/developer/dazo] has left #openvpn ["Leaving"]
04:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 245 seconds]
04:18 -!- d12fk [~heiko@vpn.astaro.de] has quit [Remote host closed the connection]
04:19 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:25 <@vpnHelper> RSS Update - forum: sctp implementation in openvpn <http://forums.openvpn.net/topic7615.html#p9664>
04:28 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
04:39 < dustybin> i cannot get tunnel brick to work on os x, i keep on getting:  Cannot allocate TUN/TAP dev dynamically
04:39 < dustybin> i can tun tap kext in extensions 
04:40 < dustybin> *have
04:40 < dustybin> could this be down to my firewall?
04:47 -!- zeshoem [~mnathani@70.52.169.200] has quit [Ping timeout: 255 seconds]
04:48 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:48 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:48 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:52 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:53 -!- zeshoem [~mnathani@70.52.169.200] has joined #openvpn
05:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:04 -!- zeshoem [~mnathani@70.52.169.200] has quit []
05:17 <@vpnHelper> RSS Update - forum: updating OpenSSL locks OpenVPN, why? <http://forums.openvpn.net/topic7624.html> || Does OpenVPN generate MAC Pause (01:80:c2:00:00:01) packets? <http://forums.openvpn.net/topic7557.html#p9665>
05:23 <@vpnHelper> RSS Update - forum: Administrator Rights TAP driver Install <http://forums.openvpn.net/topic7619.html#p9667>
05:30 <@vpnHelper> RSS Update - forum: Running a down script prior to route del <http://forums.openvpn.net/topic7406.html#p9669> || updating OpenSSL locks OpenVPN, why? <http://forums.openvpn.net/topic7624.html#p9668>
05:31 -!- yelo_ [~yelo@actualys.pck.nerim.net] has joined #openvpn
05:32 < yelo_> !welcome
05:32 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:32 < yelo_> !route
05:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
05:36 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
05:37 < yelo_> !configs
05:37 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
05:38 < yelo_> !redirect
05:38 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
05:38 < yelo_> !nat
05:38 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
05:38 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
05:38 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
05:38 -!- mode/#openvpn [+o dazo] by ChanServ
05:38 -!- alhadi [~thunderst@92.96.217.226] has joined #openvpn
05:39 < yelo_> i need help
05:40 < yelo_> my openvpn subnet is 10.8.0.0/24 and i have a lan on 192.168.6.0/24
05:40 < yelo_> i can ping from the lan to a client on the vpn and vice versa
05:40 < yelo_> but samba doesn't work
05:40 < yelo_> did add the host_allow rule
05:41 < yelo_> plz help :)
05:41 < dustybin> your problem is your firewall
05:41 < yelo_> [root@hansel ~]$ iptables --list
05:41 < yelo_> Chain INPUT (policy ACCEPT)
05:41 < yelo_> target     prot opt source               destination         
05:41 < yelo_> Chain FORWARD (policy ACCEPT)
05:41 < yelo_> target     prot opt source               destination         
05:41 < yelo_> ACCEPT     all  --  192.168.6.0/24       10.8.0.0/24         
05:41 < yelo_> Chain OUTPUT (policy ACCEPT)
05:41 < yelo_> target     prot opt source               destination
05:41 -!- yelo_ was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
05:41 -!- yelo_ [~yelo@actualys.pck.nerim.net] has joined #openvpn
05:42 < yelo_> http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ
05:42 <@vpnHelper> Title: OpenVPN/FAQ - Secure Computing Wiki (at www.secure-computing.net)
05:42 < yelo_> should i use the Setup-script rules?
05:43 < yelo_> do you mean the firewall on the openvpn server?
05:43 < |Mike|> and clients
05:44 < yelo_> did a iptables --flush on clients
05:44 < yelo_> i dunno which rule to add to be honest
05:48 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Quit: mv LAN/NFS-srv DMZ/]
05:54 <@vpnHelper> RSS Update - forum: Windows clients client-to-client slow speed, ftp errors <http://forums.openvpn.net/topic7625.html>
06:00 <@vpnHelper> RSS Update - forum: updating OpenSSL locks OpenVPN, why? <http://forums.openvpn.net/topic7624.html#p9671>
06:04 < yelo_> when from my client i launch wireshark and try to access a samba share, i have Standard Query, no such name
06:04 < yelo_> i'm lost...
06:06 <@vpnHelper> RSS Update - forum: PPPoE through an IPSEC VPN <http://forums.openvpn.net/topic7626.html#p9674> || Windows clients client-to-client slow speed, ftp errors <http://forums.openvpn.net/topic7625.html#p9672>
06:12 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
06:12 <@vpnHelper> RSS Update - forum: Windows clients client-to-client slow speed, ftp errors <http://forums.openvpn.net/topic7625.html#p9675>
06:18 -!- bba [~bba@212.51.174.146] has quit [Remote host closed the connection]
06:20 -!- WIthout [Quota@175.139.16.178] has joined #openvpn
06:24 <@vpnHelper> RSS Update - forum: PPPoE through an IPSEC VPN <http://forums.openvpn.net/topic7626.html#p9677> || Windows clients client-to-client slow speed, ftp errors <http://forums.openvpn.net/topic7625.html#p9676>
06:24 -!- yelo_ [~yelo@actualys.pck.nerim.net] has quit [Ping timeout: 240 seconds]
06:29 < Bushmills> dustybin: problem was more likely:
06:29 <@vpnHelper> RSS Update - forum: updating OpenSSL locks OpenVPN, why? <http://forums.openvpn.net/topic7624.html#p9678>
06:29 < Bushmills> !wins
06:29 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
06:36 <@vpnHelper> RSS Update - forum: updating OpenSSL locks OpenVPN, why? <http://forums.openvpn.net/topic7624.html#p9680> || PPPoE through an IPSEC VPN <http://forums.openvpn.net/topic7626.html#p9679>
06:41 <@vpnHelper> RSS Update - forum: Windows clients client-to-client slow speed, ftp errors <http://forums.openvpn.net/topic7625.html#p9681>
06:41 -!- yelo_ [~yelo_@actualys.pck.nerim.net] has joined #openvpn
06:45 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
06:48 <@vpnHelper> RSS Update - forum: Windows clients client-to-client slow speed, ftp errors <http://forums.openvpn.net/topic7625.html#p9683> || updating OpenSSL locks OpenVPN, why? <http://forums.openvpn.net/topic7624.html#p9682>
06:52 -!- bauruine_ [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
06:52 -!- bauruine_ [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
06:54 <@vpnHelper> RSS Update - forum: Windows clients client-to-client slow speed, ftp errors <http://forums.openvpn.net/topic7625.html#p9684>
06:56 -!- bba [~bba@212.51.174.146] has joined #openvpn
07:00 <@vpnHelper> RSS Update - forum: Windows clients client-to-client slow speed, ftp errors <http://forums.openvpn.net/topic7625.html#p9685>
07:05 -!- wylker [~chatzilla@adsl-70-234-250-7.dsl.rcsntx.sbcglobal.net] has quit [Read error: Connection reset by peer]
07:05 -!- wylker [~chatzilla@adsl-70-234-250-7.dsl.rcsntx.sbcglobal.net] has joined #openvpn
07:05 <@vpnHelper> RSS Update - forum: updating OpenSSL locks OpenVPN, why? <http://forums.openvpn.net/topic7624.html#p9686>
07:05 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
07:09 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
07:09 -!- yelo_ [~yelo_@actualys.pck.nerim.net] has quit [Ping timeout: 240 seconds]
07:11 -!- krzie [krzee@hemp.ircpimps.org] has quit [Quit: Leaving]
07:11 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
07:11 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
07:11 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
07:18 <@vpnHelper> RSS Update - forum: Quick "noob" question <http://forums.openvpn.net/topic7627.html>
07:22 -!- yelo_ [~yelo_@actualys.pck.nerim.net] has joined #openvpn
07:25 -!- Firge [~Firge@201.216.214.185] has joined #openvpn
07:26 -!- JyZyXEL [~lol@a88-113-58-11.elisa-laajakaista.fi] has joined #openvpn
07:26 < JyZyXEL> ovpn-client[17417]: /sbin/ifconfig tun0 192.168.2.6 pointopoint 192.168.2.5 mtu 1500
07:26 < JyZyXEL> ovpn-client[17417]: /sbin/route add -net 192.168.0.1 netmask 255.255.255.0 gw 192.168.2.5
07:26 < JyZyXEL> ovpn-client[17417]: ERROR: Linux route add command failed: external program exited with error status: 4
07:27 < JyZyXEL> why is it doing that
07:31 < yelo_> did you try the command only in a shell ?
07:31 < yelo_> route add -net 192.168.0.1 netmask 255.255.255.0 gw 192.168.2.5
07:31 < ecrist> no pasting in the channel, please
07:31 < yelo_> sry /!\
07:33 < JyZyXEL> ecrist: the rule on freenode has generally been no pastig of >3 lines to the channel
07:33 < ecrist> k, well, this is our rule
07:34 < yelo_> i need help on my openvpn conf
07:34 < JyZyXEL> >=1?
07:34 < yelo_> ecrist can you help ?
07:34 < ecrist> !configs
07:34 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
07:35 < JyZyXEL> yelo_: that command just prints the --help
07:35 <@vpnHelper> RSS Update - forum: Quick "noob" question <http://forums.openvpn.net/topic7627.html#p9688>
07:35 < yelo_> which linux flavor is it?
07:35 < yelo_> man route
07:35 < JyZyXEL> yelo_: Debian 5.0
07:36 < ecrist> JyZyXEL: error status 4 is the exit status for the linux route command.  you'll need to see the man page for the exact cause.
07:36 < ecrist> my guess is you're not running as root, or you have an error in some syntax.
07:37 < yelo_> i have a samba linked to a ldap, both machines subnet and vpn can ping each other, but can't access this bloody samba
07:37 < yelo_> i'm going nuts
07:37 < JyZyXEL> im guessing its a b ug
07:37 < yelo_> did try some iptables rules but that doesn't work
07:38 < yelo_> if they can ping, that means that the route are correct right?
07:38 < JyZyXEL> ovpn-client is using the command wrong
07:38 < JyZyXEL> shouldn't it be using ip route anyways?
07:39 < ecrist> JyZyXEL: it's not a bug
07:40 < ecrist> yelo_: in what way can you not get to the samba shares?
07:41 < ecrist> a little more information would be helpful
07:41 < |Mike|> tcp connection as far as i can read
07:41 < yelo_> like in nautilus network browse for example
07:41 < yelo_> when i use wireshark on my client
07:41 < yelo_> the packet show Standard query, No such name
07:42 < ecrist> sounds like you need a WINS server
07:42 < ecrist> can you connect to your samba share by IP?
07:42 < yelo_> dunno the command
07:42 < ecrist> !wins
07:42 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
07:42 < JyZyXEL> well the server im connecting has: 'server 192.168.2.0 255.255.255.0' and 'push "route 192.168.0.1 255.255.255.0"' and my client is not behind a nat
07:42 < ecrist> this appears to be more a samba question than an openvpn question, yelo_ 
07:42 < yelo_> gonna explain my network architecture
07:42 < JyZyXEL> using the default server and client configs
07:43 < yelo_> i have a dns server on 192.168.6.43
07:43 < ecrist> JyZyXEL: looks like you may have a conflicting subnet, which could be part of your problem.
07:43 < yelo_> i have a ldap on .47 connected to the dns
07:43 < yelo_> the dns is controlled in some way by the ldap entries
07:43 < yelo_> machines, hosts, ip etc
07:43 < ecrist> this is still all outside the realm of openvpn
07:44 < yelo_> i was thinking that the firewall on my vpn server was not forwarding the packet correctly
07:44 < JyZyXEL> what do you mean conflicting subnet?
07:44 < ecrist> !tell JyZyXEL [logs]
07:44 < yelo_> put if they can ping...
07:45 -!- dazo is now known as dazo_afk
07:45 < ecrist> yelo_: you don't seem to understand how samba/cifs works in the backend.  the name resolution uses broadcast packets, and you have two different ip subnets, thus two separate broadcast domains.
07:45 < ecrist> a wins server resolves that issue
07:47 < JyZyXEL> ecrist: but the logs contain ip-addresses and certificate details
07:48 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 245 seconds]
07:48 < ecrist> there are some basic details, but nothing that can really be used to exploit your system.  if you want help, you need to provide your logs
07:51 < yelo_> http://pastebin.com/1c8nUgdj
07:51 < yelo_> ecrist that's my smb.conf global section
07:52 < yelo_> you will see that it's connected to a ldap
07:52 < ecrist> yelo_: I don't want your samba config, go to #samba for that
07:52 < ecrist> I don't care that it's connected to ldap
07:52 < yelo_> ok
07:52 < ecrist> your issue is WINS, I assure you.
07:52 < yelo_> ok will try this
07:52 < yelo_> thx 4 helping
07:52 < ecrist> np
07:53 < janjust> JyZyXEL:  where did you get your debian 5 build of openvpn?
07:53 < JyZyXEL> from the main repository
07:53 < janjust> normally openvpn uses 'ip route' commands, not 'ifconfig' and 'route'
07:54 < JyZyXEL> i know, it seems silly it uses old tools like route
07:54 < JyZyXEL> nobody uses ifconfig or route anymore
07:54 < janjust> a 'route' exit code 4 means 'route' is used wrongly - what does your routing table look like before openvpn starts
07:54 < janjust> do you already have a 192.168.0.0/24 network?
07:54 < JyZyXEL> no my client is hooked straight to bridged cable modem
07:55 < janjust> just do a 'netstat -rn' and look for the networks 
07:55 < JyZyXEL> the networks?
07:56 < janjust> yes, output like
07:56 < janjust> http://spiegel.nikhef.nl/mirror/centos/5.5/os/SRPMS/net-tools-1.60-81.el5.src.rpm
07:56 < janjust> whoops wrong output
07:56 < janjust> output like
07:56 < janjust> 169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
07:56 < ecrist> janjust: trying to get him to get his logs, my guess is he's already got that subnet in the routing table.
07:56 < janjust> ecrist:   I know, that's why I want to see the routing table prior to launching openvpn
07:56 < ecrist> *shrug* i just want to see the logs.
07:57 < JyZyXEL> janjust: well its a bit late for prior to launching now
07:57 < ecrist> JyZyXEL: post your logs
07:58 < janjust> JyZyXEL:  stop the openvpn server, reboot the machine, don't start openvpn , but first capture the output of 'netstat -rn'
07:58 < JyZyXEL> i don't dare to reboot a remote machine
07:58 < janjust> THEN start openvpn with flag --verb 5 and look for any errors in the logs
07:59 < janjust> I meant the debian 5 box - isn't that the local one?
07:59 < JyZyXEL> no thats the client
07:59 < JyZyXEL> obviously i cannot test vpn with a local box
07:59 < janjust> OK, stop openvpn on the client, reboot it, and capture 'netstat -rn' before trying to connect to the server
08:00 < janjust> yes you could, but that's besides the point 
08:00 < ecrist> or, just post your damn log file
08:00 -!- yelo_ [~yelo_@actualys.pck.nerim.net] has quit [Quit: i <3 pork (http://dev.ojnk.net)]
08:01 < krzee> ps auxww|grep [o]penvpn|wc -l
08:01 < janjust> krzee: 42
08:01 -!- dazo_afk is now known as dazo
08:02 < JyZyXEL> i think a similar error is happening with windows client also
08:02  * ecrist gives up
08:03 < JyZyXEL> Warning: address 192.168.0.1 is not a network address in relation to netmask 255.255.255.0
08:03 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
08:03 < janjust> wait wait wait.... 
08:03 < janjust> hold on a sec: where did the 192.168.0.1 (one!) come from?
08:03 < janjust> that's not a network address, that's a host address
08:04 < janjust> you can't use 'route add 192.168.0.1 netmask 255.255.255.0' - you're mixing a host address and a subnet network mask
08:04 < JyZyXEL> in my server.conf i have 'push "route 192.168.0.1 255.255.255.0"'
08:05 < janjust> JyZyXEL:  there's your problem
08:05 < janjust> that's not valid TCP/IP syntax
08:05 < JyZyXEL> its supposed to be 192.168.0.0?
08:05 < janjust> use either 'push "route 192.168.0.0 255.255.255.0" if you want access to the network 192.168.0/24
08:05 < janjust> or use 'push "route 192.168.0.1 255.255.255.255"' if you want access only the host 192.168.0.1
08:06 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
08:06 < JyZyXEL> that fixed the error
08:07 < JyZyXEL> on both windows and linux clients
08:07 < janjust> excellent
08:08 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 240 seconds]
08:08 < JyZyXEL> now i just whish i could ping my gateway from the clients hehe
08:08 < janjust> which gw?
08:08 < JyZyXEL> the one thats running the server
08:08 < JyZyXEL> but thats just a firewall configuration fail probably
08:08 < janjust> if 
08:09 < janjust> if 'gw' means the machine acting as openvpn server then you're not reaching it via the VPN itself
08:09 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
08:09 < janjust> the VPN server itself is usually reached directly , outside of the VPN tunnel
08:09 < JyZyXEL> oh
08:09 < JyZyXEL> but shouldn't i be able to ping it thru the tunnel?
08:09 < janjust> or you could try reaching the vpn server on it's VPN server address, most like 192.168.2.1 for your setup
08:09 < janjust> depends on the command you use
08:09 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
08:10 < janjust> 'ping 192.168.2.1' should go via the tunnel ; ping <gw-ip> goes outside the tunnel
08:10 < JyZyXEL> actually, now that i think about it, i have ICMP Echo's blocked :)
08:11 < ecrist> see, if he'd have posted the logs like I said...
08:11 < JyZyXEL> pinging a machine behind the gateway (192.168.0.100) worked
08:11 < janjust> ecrist:  LOL
08:11 < JyZyXEL> ecrist: im just afraid for my job
08:12 < JyZyXEL> my boss would kill me if he found out some log files filled with internal network information when he googles the name of our company
08:13 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
08:13 <@vpnHelper> RSS Update - forum: Windows clients client-to-client slow speed, ftp errors <http://forums.openvpn.net/topic7625.html#p9689>
08:13 < WebDawg> I want a client to client setup for about 4 boxes.
08:13 < WebDawg> Anyone have a guide?
08:14 < janjust> sorry, can't resist: http://www.packtpub.com/openvpn-2-cookbook/book
08:14 < WebDawg> All I want to do is have an interface on one box that would let me connect to the others.
08:14 <@vpnHelper> Title: OpenVPN 2 Cookbook: RAW Book & eBook | Packt Publishing Technical & IT Book Store (at www.packtpub.com)
08:15 < krzee> WebDawg, 'client to client'  = ? when you sat it?
08:15 < janjust> WebDawg:  it would always go via a server
08:15 < janjust> or you'd have to set up a point-to-point connection between all 4 boxen
08:15 < WebDawg> No.  I have a server.conf that I am configuring.  I want other boxes to connect to it.
08:15 < janjust> simply add 'client-to-client' to the server config and the clients can see each other
08:16 < janjust> but all traffic from client to client will flow via the server
08:16 < WebDawg> Yeh.
08:16 < WebDawg> heh
08:16 < WebDawg> I want the boxes to use thier own internet connection but still have this optional interface that they can access.
08:16 < krzee> !learn book as http://www.packtpub.com/openvpn-2-cookbook/book    check out JJK's awesome cookbook for openvpn 2!
08:16 <@vpnHelper> Joo got it.
08:17 < WebDawg> All the guides that I find want to join lans, do roadwarror, etc.
08:17 < janjust> lol krphop 
08:17 < janjust> I meant krzee 
08:17 < krzee> you gave instructions on setting up configs i didnt even know were possible
08:17 < janjust> WebDawg:  did you actually *try* setting up a server with 'client-to-client' enabled?
08:17 < krzee> great book!
08:18 < janjust> krzee:  thx! I had great fun writing it, and it's available next week, if I understood it correctly
08:18 -!- theDoc [~Link@110.92.102.28] has quit [Ping timeout: 240 seconds]
08:18 < krzee> jjk, did our feedbacks in comments go to you?
08:18 < janjust> sure did krzee 
08:18 < krzee> cool
08:18 < janjust> very useful comments... I incorporated most of them in the text
08:19 < janjust> you'll see it when you get your complimentary copy ;-)
08:19 < krzee> cant wait!
08:19 < janjust> I added your 'hand out public IP' suggestion as a recipe 
08:19 < ecrist> when is it supposed to go on sale, janjust?
08:19 < janjust> really liked that one
08:20 < janjust> next week or so, ecrist ; you can already order it at packt & amazon
08:20 < ecrist> ah
08:20 < janjust> 342 stinking pages :S
08:21 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
08:21 < krzee> cool!
08:22 < krzee> hey maybe you would have some explanation for something i saw
08:23 < krzee> http://secure-computing.net/wiki/index.php/OpenVPN/VpnChains
08:23 <@vpnHelper> Title: OpenVPN/VpnChains - Secure Computing Wiki (at secure-computing.net)
08:23 < JyZyXEL> on a windows client how do you make the DNS go thru ovpn?
08:24 < janjust> JyZyXEL:  on the server add 'push "dhcp-option DNS <DNS-IP>"'
08:24 < krzee> when i made a chain of vpns, and used iperf, then made a vpn over the existing chain, effectively treating the chain as untrusted, then use iperf inside, i got *better* throughput (all UDP)
08:24 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
08:24 < JyZyXEL> and the next question is, how do you make all traffic go thru the vpn :)
08:24 < WebDawg> janjust I am right now
08:24 < krzee> JyZyXEL, 
08:24 < krzee> !redirecy
08:24 < krzee> !redirect
08:24 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
08:25 < krzee> what server OS?
08:25 < JyZyXEL> krzee: asking me?
08:25 < krzee> yes
08:25 < janjust> iperf is better via a chain of tunnels than outside? most likely you're going through deep inspection firewalls?
08:25 < JyZyXEL> Windows XP client
08:25 < krzee> *server*
08:25 < janjust> I've seen ping times go down drastically when using openvpn tunnels - almost always caused by NATting and badly configured firewalls
08:26 < janjust> WebDawg:  whaddoyamean?
08:26 < krzee> janjust, actually i mean like UDP over UDP over UDP was better than UDP over UDP chained
08:27 < krzee> if you look at my diagram on the above link, i made a vpn from me to 10.8.0.10 over the existing vpn
08:27 < janjust> yep , I now see what you've done
08:27 < krzee> the client-b had a server running as well
08:27 < janjust> if I can find the time I'll duplicate your setup.. see if I get the same results
08:28 < janjust> krzee, where in your diagram is 10.8.2.1?
08:30 < krzee> "Now I could choose to run a VPN server on CLIENT-B, listening only on 10.8.0.10, but using the subnet 10.8.2.x"
08:30 < janjust> yeah just found it; and were there any special things in the setups for the client or server? fragment? mssfix? tun-mtu?
08:30 < krzee> none
08:31 < janjust> compression? cipher?
08:31 < krzee> yes on comp-lzo
08:31 < krzee> default cipher
08:31 < krzee> 4096 everything
08:31 -!- theDoc [~Link@110.92.102.28] has quit [Changing host]
08:31 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
08:32 < janjust> hmmm I'd be interested to see what happens if you turn off comp-lzo
08:33 < janjust> and maybe also disable encryption - just to see if it has an effect on performance
08:35 < krzee> ya i should have recorded those too
08:35 <@vpnHelper> RSS Update - forum: Does OpenVPN generate MAC Pause (01:80:c2:00:00:01) packets? <http://forums.openvpn.net/topic7557.html#p9690>
08:38 -!- xindz`off is now known as xindz
08:39 < janjust> running tunnels over tunnels with encryption and compression enabled can lead to funny results
08:40 < janjust> it reminds me a bit of zipping zip files again - every once in a while a zipped zip file would compress up to 20%
08:40 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Read error: Operation timed out]
08:40 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
08:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:43 -!- Guest85341 [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 272 seconds]
08:45 < krzee> crazy
08:45 -!- d12fk [~heiko@vpn.astaro.de] has joined #openvpn
08:45 <@vpnHelper> RSS Update - forum: updating OpenSSL locks OpenVPN, why? [SOLVED] <http://forums.openvpn.net/topic7624.html#p9691>
08:46 < krzee> i figured since default is adaptive it would sample and see its not gaining, so not use compression by its own decision
08:46 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
08:48 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
08:48 -!- stony is now known as Guest53728
08:52 < janjust> krzee: the problem is the combo of encryption+compression: the encrypted compressed data might very well be compressible again
08:54 < krzee> ohhh interesting, it didnt occur to me that the lzo had to happen inside the encryption, and they encryption changes everything
08:54 < krzee> s/they/the/
08:54 < janjust> actually, I don't know what happens first, the compression or the encryption. I figure the data is compressed first, then encrypted
08:55 < krzee> i figure it has to, for the encryption to work
08:55 < krzee> compressing after would change the data, corrupt it
08:55 < krzee> wouldnt it?
08:56 < janjust> hmm if you encrypt first, then compress, then decompress then decrypt it would work
08:56 < janjust> but HMAC testing would fail
08:56 < janjust> so I guess that it's the other way round
08:56 < krzee> ya
08:57 < wylker> is there anything in particular in the client setup for win 7 you have to do to make sure 100% of all traffic goes through openVPN?
08:57 < wylker> i have a tunnel that seems to be working but some applications (games mostly) do not appear to be seeing all of their traffic
08:58 < janjust> krzee: "Use the source, Luke" : forward.c, line ~440 : it first compresses, then encrypts
08:58 < JyZyXEL> !def1
08:58 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
08:58 < krzee> janjust, if that theory ends up holding, and explains my increase in throughput, then by adding a compress on each side it could increase performance!
08:58 < krzee> (maybe!)
08:59 < janjust> wylker:  if you have "redirect-gateway def1" in the client config then all traffic should go through the vpn
08:59 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
08:59 < wylker> ok that is in there
08:59 < janjust> however, if a game tries to send a packet with the wrong source address through the tunnel it will be dropped
08:59 < wylker> could it be because we're using tun instead of tap?
08:59 < janjust> wylker:  depends on the type of game but yes, it could have an effect
09:00 < janjust> some games/apps want to send non-IP traffic, which is not forwarded over an tun link
09:01 < krzee> but unless you need the lan behind the vpn endpoint, you dont need a bridge, just a routed tap setup is fine
09:01 < wylker> here is the part that is beyond me: i was told to use a tun setup because the server is running on openVZ
09:02 < janjust> a 'tun' setup is best in most case, wylker 
09:02 < janjust> try switching to 'dev tap
09:03 < janjust> to see if it has an effect - just don't start bridging
09:03 < wylker> ok will do thanks
09:03 < janjust> openvz should grok 'dev tap' unless it's even more horribly broken than I fear
09:03 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 250 seconds]
09:04 < wylker> well
09:04 < wylker> the explanation i was given
09:04 < krzee> iirc the dev is made static outside on the host
09:05 < krzee> and permission is given to the child setup
09:05 < krzee> aka, no static tap made for him, nothing coming
09:05 < janjust> ah ok krzee, I was afraid of something like that
09:05 < wylker> something about the iptables entry
09:05 < krzee> i could be wrong... but that rings a bell in my head for openvz
09:05 < wylker> not being able to use ummm
09:05 < wylker> shit...
09:05 < krzee> and cant do NAT in child OS
09:05 < krzee> only host
09:05 < wylker> masquerade
09:06 < wylker> yes
09:06 < krzee> right
09:06 < wylker> because there is no nat module in the kernel
09:06 < krzee> !openvznat
09:06 < janjust> shouldn't be required anyways... 
09:06 < krzee> !openvz
09:06 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
09:06 < wylker> now the tun/tap device is enabled
09:06 < wylker> that is something the host allows
09:06 < janjust> OK , try connecting the clients to it  and see if they "see" each other
09:06 < wylker> here is the tutorial the hosting company gave me
09:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
09:07 < wylker> https://secure.intovps.com/knowledgebase/19/How-to-install-and-configure-OpenVPN.html
09:07 <@vpnHelper> Title: IntoVPS - Knowledgebase - How to install and configure OpenVPN (at secure.intovps.com)
09:07 < wylker> try it with dev tap?
09:07 < krzee> give it a shot
09:07 < krzee> it cant hurt to try
09:07 < wylker> hehe true
09:07 -!- na3r_ [~naser@78.109.196.15] has joined #openvpn
09:07 < wylker> i will try and get back to you guys one way or the other thanks
09:07 < krzee> if your server can make a tap device, it should be fine
09:08 < wylker> client not available to me at this exact second
09:08 < krzee> you just wont be able to use the inet over it unless they NAT tap and not just tun+
09:08 < na3r_> how can i use openvpn in fedora 14?
09:08 < janjust> no prob wylker  ; otherwise , set 'verb 5' or higher on the server and look in the log file for errors
09:08 < janjust> na3r_:  I use openvpn in FC14 without any problems; just do 'yum install openvpn' 
09:08 < wylker> will do thanks
09:09 < krzee> na3r_, the config will be the same as any other unix-like os
09:09 < wylker> oh
09:09 -!- theDoc_ [~Link@110.92.102.28] has joined #openvpn
09:09 < wylker> have any of you guys used this tool?
09:09 < wylker> http://translate.google.com/translate?hl=en&sl=de&u=http://www.hanksoft.de/service/46-udpbroadcastforwarder&ei=1fNUTfa_PIfTgQeatfjJDA&sa=X&oi=translate&ct=result&resnum=1&ved=0CBkQ7gEwAA&prev=/search%3Fq%3Dhttp://www.hanksoft.de/service/46-udpbroadcastforwarder%26hl%3Den%26safe%3Doff%26prmd%3Divns
09:09 <@vpnHelper> Title: Google Translate (at translate.google.com)
09:09 < wylker> thats the translated link the site is german
09:09 < janjust> I've seen a posting about running udp broadcasters/forwarders
09:09 < wylker> its a broadcast forwarder i guess
09:10 < janjust> but never had to use them 
09:10 < krzee> cool, i only knew bcrelay from pptp package
09:10 < wylker> i guess if the tap thing doesn't work i can try that
09:10 < janjust> this is a windows package IIRC
09:10 < janjust> yep wylker 
09:10 < na3r_> krzee:could u give me some doc?
09:10 < krzee> !howto
09:10 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
09:10 < janjust> na3r_:  try reading the manual pages, online docs, https://openvpn.net/howto etc
09:11 < krzee> !man
09:11 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
09:11 < krzee> !factoids search
09:11 <@vpnHelper> (factoids search [<channel>] [--values] [--{regexp} <value>] [<glob> ...]) -- Searches the keyspace for keys matching <glob>. If --regexp is given, it associated value is taken as a regexp and matched against the keys. If --values is given, search the value space instead of the keyspace.
09:11 < krzee> !factoids search --values bcrelay
09:11 <@vpnHelper> "bcast" is pptp source tree has bcrelay in it, bcrelay can be used to relay broadcasts over a tun setup
09:11 < na3r_> krzee:that site is filtered in iran
09:11 < janjust> openvpn.net is filtered in iran? yikes!
09:12 < krzee> !learn bcast as http://www.hanksoft.de/service/46-udpbroadcastforwarder seems to be a windows program for relaying bcast (use google translate if needed)
09:12 <@vpnHelper> Joo got it.
09:12 < krzee> hrm, i guess we need to mirror the howto on scn
09:12 < na3r_> janjust:yeah :(
09:12 < krzee> ecrist, you still here?
09:12 < krzee> na3r_, hang on, ill see about getting that up somewhere else
09:13 < na3r_> krzee:tnx guy
09:14 < na3r_> can i use openvpn with gprs?
09:14 < krzee> depends on your provider... i have done it before
09:14 < krzee> it makes an already slow connection slower, but did work
09:15 -!- Netsplit *.net <-> *.split quits: aef, grapsus, cron2, mete, Cain, areq, d12fk, ping-pong, hpa, batrick,  (+22 more, use /NETSPLIT to show all of them)
09:15 -!- Netsplit *.net <-> *.split quits: mace, cj, Dougy, renihs, diphthong, fahadsadah, kloeri, nb, rkantos, jpalmer,  (+30 more, use /NETSPLIT to show all of them)
09:15 < na3r_> i use mtn-irancell
09:15 < janjust> na3r_:  manual : http://www.nikhef.nl/~janjust/openvpn/openvpn-2.1-manual.html
09:15 <@vpnHelper> Title: OpenVPN 2.1 (at www.nikhef.nl)
09:15 < janjust> howto: http://www.nikhef.nl/~janjust/openvpn/openvpn-howto.html
09:15 <@vpnHelper> Title: HOWTO (at www.nikhef.nl)
09:15 < na3r_> tnx
09:18 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has joined #openvpn
09:18 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
09:18 -!- peper [~peper@saturn.piotrj.org] has joined #openvpn
09:21 < na3r_>     openvpn --remote may.kg --dev tun1 --ifconfig 10.4.0.2 10.4.0.1 --verb 9 
09:21 < dvl> I get the idea in my head that I want to start signing my DNS zones... then I go looking for a tutorial and fail.  Then the idea goes way for a while.
09:21 < na3r_> what shoule i replace with may.kg
09:21 < na3r_> sorry for my english
09:22 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
09:22 -!- lisa_ [~lisa@titanium.thedoh.com] has joined #openvpn
09:22 -!- rkantos_ [robin@84.239.137.74] has joined #openvpn
09:22 -!- Guest16008 [~caesay@173.236.15.70] has joined #openvpn
09:22 -!- toortog [nesm6@notsecure.net] has joined #openvpn
09:22 -!- jwm [jwm@dev.dist.us] has joined #openvpn
09:22 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
09:22 -!- EmperorT1m [~EmperorTo@216.17.68.153] has joined #openvpn
09:22 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
09:22 -!- Guest53728 [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
09:22 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
09:22 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
09:22 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
09:22 -!- Firge [~Firge@201.216.214.185] has joined #openvpn
09:22 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
09:22 -!- wylker [~chatzilla@adsl-70-234-250-7.dsl.rcsntx.sbcglobal.net] has joined #openvpn
09:22 -!- WIthout [Quota@175.139.16.178] has joined #openvpn
09:22 -!- alhadi [~thunderst@92.96.217.226] has joined #openvpn
09:22 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
09:22 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
09:22 -!- raomin [~romain@86.66.22.65] has joined #openvpn
09:22 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
09:22 -!- areq [~areq@pld-linux/areq] has joined #openvpn
09:22 -!- optiz0r [~optiz0r@miranda.sihnon.net] has joined #openvpn
09:22 -!- mete [~metefr@84.200.12.194] has joined #openvpn
09:22 -!- N|KO [niko@174.89.243.98] has joined #openvpn
09:22 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
09:22 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
09:22 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
09:22 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
09:22 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
09:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:22 -!- Lantizia [~Lantizia@erebus.seaquake.net] has joined #openvpn
09:22 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has joined #openvpn
09:22 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has joined #openvpn
09:22 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
09:22 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
09:22 -!- grapsus [~grapsus@acces1181.res.insa-lyon.fr] has joined #openvpn
09:22 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
09:22 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
09:22 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
09:22 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
09:22 -!- rot13 [~var@unaffiliated/rot13] has joined #openvpn
09:22 -!- moldy [~rene@unaffiliated/moldy] has joined #openvpn
09:22 -!- nb [~nb@fedora/nb] has joined #openvpn
09:22 -!- Comradin [~marcus@marcus-franke.net] has joined #openvpn
09:22 -!- ServerMode/#openvpn [+o mattock] by jordan.freenode.net
09:22 -!- nDuff [~cduffy@rrcs-97-79-207-2.sw.biz.rr.com] has joined #openvpn
09:22 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
09:22 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
09:22 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
09:22 -!- cj [~cjac@adsl-207-32-175-232.rockisland.net] has joined #openvpn
09:22 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
09:22 -!- chantra_afk [~chantra@unaffiliated/chantra] has joined #openvpn
09:22 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
09:22 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
09:22 -!- Dougy [me@tech.qsi.net] has joined #openvpn
09:22 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
09:22 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
09:22 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
09:22 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
09:22 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
09:22 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
09:22 -!- jhelwig [~jhelwig@puppetlabs/development/jhelwig] has joined #openvpn
09:22 -!- x-demon [xdemon@lex.io] has joined #openvpn
09:22 -!- mace [~mace@debian/developer/mace] has joined #openvpn
09:22 -!- meepmeep [meepmeep@212.24.104.229] has joined #openvpn
09:22 < JyZyXEL> what do you do when your connecting to your home network thats using 192.168.0.0/24 from a network thats also using 192.168.0.0/24
09:22 < janjust> na3r_:  you need a remote server to connect to
09:22 < JyZyXEL> what do you do when your connecting to your home network thats using 192.168.0.0/24 from a network thats also using 192.168.0.0/24
09:22 < JyZyXEL> so theres like a collision
09:22 < janjust> the remote server address would be '--remote <remoet-IP>
09:22 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Excess Flood]
09:22 < JyZyXEL> !collision
09:22 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
09:22 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
09:22 < krzee> JyZyXEL, 
09:22 < krzee> !samesubnet
09:22 <@vpnHelper> "samesubnet" is clients can not connect to a server pushing its lan if on the same subnet. you can only reach your subnet on layer2 or through your gateway, when you create a route for it you will try to reach your gateway over the vpn which dies because you cant reach your gateway
09:23 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 248 seconds]
09:23 < na3r_> which ip i must use?
09:23 -!- zamba [marius@flage.org] has joined #openvpn
09:23 < krzee> change the subnet to something less common
09:23 <@vpnHelper> RSS Update - forum: PPPoE through an IPSEC VPN <http://forums.openvpn.net/topic7626.html#p9692>
09:23 < na3r_> i'm newby to openvpn
09:23 < janjust> na3r_:  try it with 10.4.0.1 10.4.0.2 , that should work for a start
09:24 -!- threedaymonk [~threedaym@surimi.vm.bytemark.co.uk] has joined #openvpn
09:24 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:24 < na3r_> Options error: --local and --remote addresses must be distinct from --ifconfig addresses
09:25 -!- chantra_1fk [~chantra@ns38827.ovh.net] has joined #openvpn
09:25 < na3r_> i used this command
09:25 < na3r_> openvpn --remote 10.4.0.1 --dev tun1 --ifconfig 10.4.0.1 10.4.0.2 --verb 9
09:25 < janjust> na3r_, which remote server are you trying to connect to?
09:25 -!- Netsplit *.net <-> *.split quits: derekv, lupine_85, renihs, sedulous, d457k, up_the_irons, cpm, rot13, Guest53728, nb,  (+7 more, use /NETSPLIT to show all of them)
09:25 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
09:26 < janjust> na3r_, as I said, you need to get access to a remote server, or a second computer
09:26 < janjust> what is the address of your endpoint, i.e. the other PC
09:27 -!- Netsplit over, joins: jwm, d457k, derekv, Guest53728, belZe, cpm, fahadsadah, Martin`, up_the_irons, rot13 (+7 more)
09:27 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Max SendQ exceeded]
09:27 < na3r_> i just wanna use for internet filtering
09:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:28 < janjust> na3r_, please read up on what openvpn is first; I get the feeling this might not be what you're looking for
09:28 < krzee> na3r_, unless you have another server on the internet, you need a VPN service
09:28 < janjust> you can "just install openvpn" and expect internet filtering or bypassing of internet filtering
09:28 < krzee> which openvpn.net does offer
09:28 < na3r_> oh,yup
09:28 -!- bba [~bba@212.51.174.146] has quit [Remote host closed the connection]
09:29 < krzee> http://openvpn.net/index.php/hosted-access-server/overview.html
09:29 < janjust> or try signing up on strongvpn.com
09:29 <@vpnHelper> Title: Overview (at openvpn.net)
09:29 < na3r_> do u have something else for me?
09:29 < krzee> you can use openvpn with openvpn.net's hosted service!
09:29 < krzee> (what i linked above)
09:29 < janjust> well krzee, if openvpn.net is blocked it would be hard to get a connection :./
09:29 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
09:30 -!- chantra_afk [~chantra@unaffiliated/chantra] has quit [Write error: Broken pipe]
09:30 < krzee> ohhh
09:30 -!- meepmeep [meepmeep@212.24.104.229] has quit [Ping timeout: 493 seconds]
09:30 < krzee> good point, +1 for eu connectivity
09:30 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
09:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
09:33 -!- dazo is now known as dazo_afk
09:33 <@vpnHelper> RSS Update - forum: change out IP <http://forums.openvpn.net/topic7628.html>
09:33 -!- na3r_ [~naser@78.109.196.15] has quit [Remote host closed the connection]
09:34 -!- na3r_ [~naser@78.109.196.15] has joined #openvpn
09:35 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
09:35 -!- na3r_ [~naser@78.109.196.15] has left #openvpn []
09:36 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
09:36 -!- bba [~bba@212.51.174.146] has joined #openvpn
09:37 -!- na3r_ [~naser@78.109.196.15] has joined #openvpn
09:37 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
09:37 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
09:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:38 < na3r_> if i buye a vpn account
09:38 < na3r_> can connect to it with openvpn with l2tp connection
09:38 <@vpnHelper> RSS Update - forum: change out IP <http://forums.openvpn.net/topic7628.html#p9694>
09:39 < janjust> na3r_:  depends on the vpn account; if you buy an account at , for example strongvpn, you can access it using either openvpn or pptp or l2tp
09:41 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
09:41 -!- luneff [~yury@84.51.195.188] has joined #openvpn
09:42 -!- dazo_afk is now known as dazo
09:44 -!- theDoc_ [~Link@110.92.102.28] has quit [Ping timeout: 276 seconds]
09:44 <@vpnHelper> RSS Update - forum: change out IP <http://forums.openvpn.net/topic7628.html#p9695>
09:44 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
09:48 -!- na3r_ [~naser@78.109.196.15] has quit [Ping timeout: 240 seconds]
09:48 -!- na3r_ [~naser@78.109.196.4] has joined #openvpn
09:51 -!- na3r_ [~naser@78.109.196.4] has left #openvpn []
09:59 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
10:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
10:04 < ecrist> !howto
10:04 <@vpnHelper> "howto" is OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto
10:04 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 240 seconds]
10:08 < krzee> !book
10:08 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
10:08 -!- janjust_ [~janjust@194.171.97.194] has joined #openvpn
10:08 -!- janjust_ [~janjust@194.171.97.194] has quit [Client Quit]
10:09 < krzee> !learn howto as http://www.secure-computing.net/openvpn/howto.php for a mirror
10:09 <@vpnHelper> Joo got it.
10:09 < ecrist> :)
10:09 < ecrist> all you gotta do is ask. 
10:10 < krzee> thanx
10:11 < ecrist> would seem the anchors aren't working, though.
10:11  * ecrist works on fixing it
10:11 < krzee> cyanogenmod6 + openvpn-settings = great/easy setup for openvpn on android
10:13 < ecrist> gah, so many links with relative URLs
10:13  * ecrist starts weeping
10:14 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
10:17 -!- SSD [~sunshined@74.117.157.235] has joined #openvpn
10:17 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:18 -!- sunshineduck [~sunshined@74.117.157.235] has quit [Ping timeout: 245 seconds]
10:29 -!- dazo is now known as dazo_afk
10:36 -!- cmeiklejohn [cmeiklejoh@pdpc/supporter/active/cmeiklejohn] has quit [Quit: WeeChat 0.3.3]
10:39 < hyper_ch> krzee: ecrist: http://images.sjau.ch/img/d652539e.png
10:42 < krzee> hah
10:43 -!- dvl [~dvl@pdpc/supporter/active/dvl] has left #openvpn ["Leaving"]
10:43 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
10:43 < dvl> oops
10:44 < ecrist> nice
10:46 -!- jfkw [~jtk@216.115.1.60] has quit [Ping timeout: 250 seconds]
10:46 < hyper_ch> krzee: :)
10:47 -!- jfkw [~jtk@216.115.1.60] has joined #openvpn
10:48 -!- bba [~bba@212.51.174.146] has quit [Quit: Leaving...]
10:52 < JyZyXEL> when you want all the traffic to go thru ovpn does it have to be a server based setting?
10:53 < ecrist> yes
10:53 < ecrist> !def1
10:53 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
10:53 < ecrist> you'll also need to do nat or something similar.
10:54 < JyZyXEL> "Many OpenVPN client machines connecting to the internet will periodically interact with a DHCP server to renew their IP address leases. The redirect-gateway option might prevent the client from reaching the local DHCP server (because DHCP messages would be routed over the VPN), causing it to lose its IP address lease."
10:54 < JyZyXEL> i wonder if theres a workaround?
10:59 -!- theDoc [~Link@110.92.102.28] has quit [Changing host]
10:59 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
11:02 < ecrist> it's not really that common a problem, JyZyXEL 
11:04 < JyZyXEL> oh
11:04 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 260 seconds]
11:04 -!- Guest53728 is now known as gisikon
11:05 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
11:16 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Ping timeout: 272 seconds]
11:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: No route to host]
11:22 -!- luneff [~yury@84.51.195.188] has quit [Read error: Connection reset by peer]
11:25 -!- luneff [~yury@84.51.195.188] has joined #openvpn
11:26 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
11:29 <@vpnHelper> RSS Update - forum: PPPoE through an IPSEC VPN <http://forums.openvpn.net/topic7626.html#p9696>
11:29 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:30  * krzee doubletakes
11:34 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Ping timeout: 276 seconds]
11:37 -!- theDoc [~Link@110.92.102.28] has quit [Changing host]
11:38 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
11:39 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
11:40 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
11:44 -!- bitterman [~yury@84.51.195.188] has joined #openvpn
11:45 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 276 seconds]
11:46 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
11:48 -!- caesay [~caesay@173.236.15.70] has joined #openvpn
11:49 -!- zamba_ [marius@flage.org] has joined #openvpn
11:49 -!- threeday1onk [~threedaym@surimi.vm.bytemark.co.uk] has joined #openvpn
11:49 -!- jfkw_ [~jtk@216.115.1.60] has joined #openvpn
11:50 -!- bba [~bba@93.1.40.113] has joined #openvpn
11:51 -!- renihs [~lemming@83.65.34.34] has joined #openvpn
11:51 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 255 seconds]
11:51 -!- threedaymonk [~threedaym@surimi.vm.bytemark.co.uk] has quit [Ping timeout: 255 seconds]
11:51 -!- zamba [marius@flage.org] has quit [Ping timeout: 255 seconds]
11:51 -!- Guest16008 [~caesay@173.236.15.70] has quit [Ping timeout: 255 seconds]
11:51 -!- jfkw [~jtk@216.115.1.60] has quit [Ping timeout: 240 seconds]
11:51 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 265 seconds]
11:51 -!- toortog [nesm6@notsecure.net] has joined #openvpn
11:51 -!- luneff [~yury@84.51.195.188] has quit [Read error: No route to host]
11:51 -!- zamba_ is now known as zamba
11:51 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
11:51 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
11:51 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
11:52 -!- caesay is now known as Guest45507
11:52 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
12:01 -!- threeday1onk [~threedaym@surimi.vm.bytemark.co.uk] has quit [Ping timeout: 276 seconds]
12:02 -!- threedaymonk [~threedaym@surimi.vm.bytemark.co.uk] has joined #openvpn
12:06 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
12:08 -!- albech_ [~thomas@119.42.76.234] has quit [Quit: Ex-Chat]
12:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
12:26 -!- grapsus [~grapsus@acces1181.res.insa-lyon.fr] has quit [Quit: Quitte]
12:27 < |Mike|>  
12:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:33 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
12:33 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
12:33 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:56 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Operation timed out]
12:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:59 -!- lisa_ is now known as lisa
12:59 <@vpnHelper> RSS Update - forum: Can connect to VPN and get IP but not ping <http://forums.openvpn.net/topic7598.html#p9697>
13:00 < dustybin> ive tried connecting to my VPN using 2 OS X openVPN clients, and now a windows openVPN client,  each client shows different kinds of error messages.. i stand no chance :-(
13:00 < dustybin> the windows clients shows: read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054
13:01  * dustybin feels lost and scared
13:02 -!- theDoc [~Link@110.92.102.28] has quit [Ping timeout: 260 seconds]
13:03 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
13:06 -!- bitterman [~yury@84.51.195.188] has quit [Quit: Leaving]
13:08 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
13:10 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
13:12 -!- SSD [~sunshined@74.117.157.235] has quit [Ping timeout: 240 seconds]
13:17 -!- Lantizia [~Lantizia@erebus.seaquake.net] has quit [Ping timeout: 255 seconds]
13:34 -!- alhadi [~thunderst@92.96.217.226] has quit [Quit: alhadi]
13:43 < JyZyXEL> so windows file sharing will work with routed ovpn if theres a WINS server?
13:55 < krzee> s/if/unless/
13:56 < JyZyXEL> are you saying WINS only makes it worse?
13:57 < hyper_ch> wins? /me shivers
13:57 < krzee> no, im saying WINS is the only way to get smb resolution, which is why you say sharing doesnt work
13:57 < krzee> you can access the share by IP, right?
13:57 < JyZyXEL> yes
13:57 < JyZyXEL> thats the only way i ever access a share
13:58 < krzee> that should be fine over tun
13:58 < krzee> but if you want \\computername\share  then you need WINS
13:59 < JyZyXEL> wouldn't the \\computername resolve thru normal DNS too?
13:59 < hyper_ch> why use computer names when you have so lovely IPs?
13:59 < krzee> JyZyXEL, you could use a hosts.conf file
14:00 < JyZyXEL> or a dns server?
14:00 < krzee> not sure
14:00 < krzee> google it
14:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:05 < ecrist> this isn't #samba
14:08 -!- luneff [~yury@84.51.213.147] has joined #openvpn
14:17 -!- theDoc [~Link@110.92.102.28] has quit [Ping timeout: 240 seconds]
14:22 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
14:22 -!- luneff [~yury@84.51.213.147] has quit [Read error: Connection reset by peer]
14:23 -!- luneff [~yury@84.51.213.147] has joined #openvpn
14:24 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
14:33 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:33 -!- Firge [~Firge@201.216.214.185] has quit [Quit: Ex-Chat]
14:35 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:36 -!- bitterman [~yury@84.51.213.147] has joined #openvpn
14:37 -!- bitterman [~yury@84.51.213.147] has quit [Client Quit]
14:40 -!- luneff [~yury@84.51.213.147] has quit [Ping timeout: 240 seconds]
14:41 -!- dustybin [~dustybin@78-86-171-176.zone2.bethere.co.uk] has left #openvpn []
15:13 -!- ickmyn [~kjg@p4FC70D0C.dip0.t-ipconnect.de] has joined #openvpn
15:13 < ickmyn> !welcome
15:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:14 < ickmyn> !goal
15:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:16 < ickmyn> hello, i have a openvpn server. when i connect to it from my win7 client everything is ok. but from ubuntu 9.10 the speed is very slow. is this a knowing issue?
15:23 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:37 -!- alhadi [~thunderst@92.96.217.226] has joined #openvpn
15:46 -!- kloeri_ is now known as kloeri
15:56 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has quit [Read error: Operation timed out]
15:57 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
16:03 -!- theDoc [~Link@110.92.102.28] has quit [Ping timeout: 255 seconds]
16:03 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
16:36 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
16:52 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
16:55 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
16:59 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
17:08 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:10 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
17:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 245 seconds]
17:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
18:03 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:47 -!- zeshoem [~mnathani@bas1-toronto46-1177856456.dsl.bell.ca] has joined #openvpn
18:58 -!- ickmyn [~kjg@p4FC70D0C.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
19:05 -!- jfkw_ [~jtk@216.115.1.60] has quit [Ping timeout: 240 seconds]
19:07 -!- jfkw [~jtk@68-185-16-42.static.mdfd.or.charter.com] has joined #openvpn
19:12 -!- jfkw [~jtk@68-185-16-42.static.mdfd.or.charter.com] has quit [Quit: leaving]
19:14 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Ping timeout: 240 seconds]
19:36 -!- bba [~bba@93.1.40.113] has quit [Ping timeout: 250 seconds]
19:36 -!- bba [~bba@85.17.82.129] has joined #openvpn
19:40 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
19:44 -!- xindz is now known as xindz`off
19:45 -!- bba[bis] [~bba@93.1.40.113] has joined #openvpn
19:48 -!- bba [~bba@85.17.82.129] has quit [Ping timeout: 240 seconds]
20:12 -!- mveplus [~Martin@125.70.70.221] has joined #openvpn
20:24 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
20:31 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
20:56 < wylker> thanks to the people that helped last night
20:56 < wylker> switching to dev tap did indeed work on the openVZ vps
20:57 < wylker> and allowed broadcasting to work as well
21:01 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
21:03 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
21:07 -!- master_of_master [~master_of@p57B52CCB.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
21:09 -!- master_of_master [~master_of@p57B563EB.dip.t-dialin.net] has joined #openvpn
21:11 -!- Guest45507 is now known as caesay
21:11 -!- caesay [~caesay@173.236.15.70] has quit [Changing host]
21:11 -!- caesay [~caesay@unvanquished/associate/sniperx] has joined #openvpn
21:26 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
22:05 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
22:10 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
22:15 -!- nb [~nb@fedora/nb] has joined #openvpn
22:30 -!- zeshoem [~mnathani@bas1-toronto46-1177856456.dsl.bell.ca] has quit []
22:50 -!- WormFood [~wormfood@183.15.99.82] has joined #openvpn
22:50 -!- holistah [~ryan@108-66-219-113.uvs.irvnca.sbcglobal.net] has quit [Ping timeout: 240 seconds]
22:51 < WormFood> "FRAG TTL expired i=%d" <-- what causes this to happen? Over the last year, I've tried off and on to figure out what the hell that is, what is causing it, and if it is a problem or not.
22:52 < WormFood> it does not appear to be a problem, in the fact that everything appears to work ok, but I suspect it may be a performance impact....just not sure.
23:43 -!- albech [~thomas@124.157.245.126] has joined #openvpn
23:45 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
--- Day changed Sat Feb 12 2011
00:37 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:38 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
00:42 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Ping timeout: 240 seconds]
00:45 -!- p_body [~p_body@p54B28F89.dip0.t-ipconnect.de] has joined #openvpn
00:45 < p_body> !welcome
00:45 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:46 < p_body> !goal
00:46 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:54 -!- zeshoem [~mnathani@bas1-toronto46-1177856456.dsl.bell.ca] has joined #openvpn
00:55 < p_body> Hello, I want to use openvpn for remote service some machines - there for I would like to have some sort of central server where all online machines are listed, access rules can be set. Technicians should be able to connect to the openvpn server in the machines through this server    -  does anyone know if something similar is available as an open source project? - I tried to find something useful on the web, but I guess I am missing the "rea
01:41 -!- albech [~thomas@124.157.245.126] has quit [Ping timeout: 255 seconds]
01:42 -!- albech [~thomas@124.157.245.126] has joined #openvpn
01:55 < Bushmills> p_body:   run on that server:     ssh <openvpnserver> cat <youropenvpnstatusfile>. for access rules -> firewall. remote administration of firewall through ssh is quite feasable.
01:56 < Bushmills> for "all online machines" not limited to openvpn,  do  arp -a
01:57 < hyper_ch> good morning Bushmills
01:57 < Bushmills> hello hyper_ch, good morning indeed
01:57 < hyper_ch> why is your morning so good?
01:57 < Bushmills> fresh bread, fresh butter, fresh ham, fresh coffee.
01:58 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 260 seconds]
01:58 < hyper_ch> fresh marmelade?
01:58 < p_body> morning Bushmills, hyper_ch
01:58 < Bushmills> fresh jam i actually have, but not considered for breakfast today
01:58 < hyper_ch> :)
01:58 < Bushmills> quinces
01:58 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
02:00 < p_body> not sure how that will "solve" the problem of having a central server to manage the connections
02:00 < Bushmills> i also have no idea. maybe because i don't know what problem there is to solve
02:03 < p_body> I have one server - like the man in the middle - a number of machines the will have openvpn server installed - but only option for outbound traffic to the server - and a number of clients that should be able to connect to the servers (also only capable of connection to the server in the middle)  
02:05 < p_body> I want to have the "requests" from the openvpn servers from the machines listed on the central server 
02:06 < p_body> basically some sort of reverse poxy for the openvpn servers
02:06 < Bushmills> essentially, openvpn server configured as a gateway
02:06 < Bushmills> !route
02:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
02:08 < Bushmills> p_body: consider openvpn not the service doing things, but the connection, enabling you to connect to services
02:09 < Bushmills> you wouldn't ask from a network cable to work as proxy, would you?
02:10 < p_body> ? 
02:11 < Bushmills> openvpn is more of a network cable than a proxy
02:11 < p_body> I managed to connect to the machine like I want - as long as I connect from the client to the server
02:11 < p_body> from the cabel point of view : I want to have a server in the middle of the cabel where I can decide who can use the route to a server
02:12 < Bushmills> then you'd set up that server according to your needs
02:13 < p_body> that is what I want to do - just trying to find out if there is something like that available already 
02:13 < Bushmills> do you also have an openvpn question?
02:15 < p_body>  for me it is (was) an openvpn question
02:16 < Bushmills> i understood it as "i am looking for a program which lets the server do what i intend it to do"
02:16 < p_body> sorry - then it is my bad english
02:17 < p_body> I m basically looking for some sort of teleservice solution for my company
02:17 < p_body> the main goal
02:17 < p_body> one idea was to use something based on openvpn
02:18 < p_body> because the connection from one client to the server works perfect
02:19 < p_body> now I am looking for a way in managing a number of 200 servers which only have access to the internet trough one outgoing port 
02:20 < p_body> and the clients are blocked by our firewall to directly connect to the servers - even if inbound traffic is allowed
02:21 < p_body> so the idea was to find some sort of additional software for the server in the middle (hoping someone here knows if something like that is available) 
02:22 < p_body> @Bushmills: and if the software has the "do what I mean button" I would appreciate it ;)
02:23 < Bushmills> use the same you'd use, weren't you to use openvpn, but switches and network cables instead.  i think i mentioned ssh and firewall already.  though those don't have buttons.
02:34 -!- zeshoem [~mnathani@bas1-toronto46-1177856456.dsl.bell.ca] has quit []
02:48 -!- albech [~thomas@124.157.245.126] has quit [Ping timeout: 255 seconds]
02:51 < hyper_ch> you can't turn the firewall on and off with a button on your computer?
02:53 < Bushmills> i can't. there is no button on my router which turns it off.
02:53 < hyper_ch> Bushmills: the power button
02:53 < hyper_ch> no power on the router
02:53 < Bushmills> none there
02:53 < hyper_ch> no hacking in from the outside
02:53 < hyper_ch> awww :(
02:54 < Bushmills> needs pulling the plug
02:54 < hyper_ch> btw, how will you do LANs with IPv6? I still have problems with the concept :(
02:55 < Bushmills> unique ip address, every machine
02:55 < Bushmills> no need for NAT
02:55 < hyper_ch> but you want to have your own small lan
02:55 < hyper_ch> seperated from the rest
02:55 < hyper_ch> by nat/firewall...
02:55 < Bushmills> firewall it
02:55 < hyper_ch> how do you do that?
02:56 < Bushmills> by a rule which blocks it.  interface of gateway, or ip address range of your subnet.
02:56 < hyper_ch> with nat it's easy
02:56 < hyper_ch> you create a private subnet
02:56 < Bushmills> you got a while /32, /48 or /64 subne
02:56 < Bushmills> subnet
02:56 < Bushmills> whole
02:57 < hyper_ch> I tought each device will have a unique, predetermined ipv6 address
02:57 < Bushmills> no, not predetermined. that's ip addresses, not MAC addresses
02:58 < hyper_ch> I think to remember something a while back that allowed tracking of devices because of predetermined ipv6 on them
02:58 < Bushmills> arp, translating from ip adresses to mac addresses, will still be around
02:59 < Bushmills> anyway, 10 am. gotta run
03:00 < hyper_ch> you gotta run on a saturday morning? :)
03:00 < hyper_ch> thx
03:01 -!- albech [~thomas@119.42.76.234] has joined #openvpn
03:13 < WormFood> Where are all these "FRAG TTL expired i=%d" coming from in my log files, and how do I resolve it? It seems unlikely to me, that many messages about this in the log files would be normal.
03:14 < WormFood> where is there more info about this? I've google my ass off for months, and still can't find a single piece of information that is helpful.
03:17 -!- theDoc [~Link@110.92.102.28] has quit [Read error: Operation timed out]
03:19 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
03:19 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
03:36 -!- dazo_afk is now known as dazo
04:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
04:19 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:35 -!- dazo is now known as dazo_afk
04:44 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:47 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
04:47 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
04:47 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
04:58 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
05:37 -!- mveplus [~Martin@125.70.70.221] has quit [Ping timeout: 255 seconds]
05:37 -!- mveplus [~Martin@ec2-50-16-199-99.compute-1.amazonaws.com] has joined #openvpn
06:01 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:01 -!- mode/#openvpn [+o mattock] by ChanServ
06:12 -!- s7r [~s7r@82.76.239.174] has joined #openvpn
06:19 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Quit: leaving]
06:28 -!- wylker [~chatzilla@adsl-70-234-250-7.dsl.rcsntx.sbcglobal.net] has left #openvpn []
06:38 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
06:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
06:39 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Remote host closed the connection]
06:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:57 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Quit: Leaving]
06:58 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
07:24 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:25 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
07:29 -!- alhadi [~thunderst@92.96.217.226] has quit [Quit: alhadi]
07:30 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
07:30 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Client Quit]
07:39 -!- teddz [~teddz@dtmd-4d0bc45d.pool.mediaWays.net] has joined #openvpn
07:46 -!- luneff [~yury@46.61.69.103] has joined #openvpn
07:48 -!- WinstonSmith [~true@dslb-088-073-101-141.pools.arcor-ip.net] has joined #openvpn
08:00 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Read error: Operation timed out]
08:00 -!- ickmyn [~kjg@p4FC70240.dip0.t-ipconnect.de] has joined #openvpn
08:03 -!- teddz [~teddz@dtmd-4d0bc45d.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
08:09 -!- WinstonSmith [~true@dslb-088-073-101-141.pools.arcor-ip.net] has quit [Ping timeout: 272 seconds]
08:10 -!- WinstonSmith [~true@dslb-088-073-101-141.pools.arcor-ip.net] has joined #openvpn
08:14 < JyZyXEL> can server config files use includes?
08:27 -!- WinstonSmith [~true@dslb-088-073-101-141.pools.arcor-ip.net] has quit [Ping timeout: 265 seconds]
08:38 < ickmyn> JyZyXEL i never see one that uses includes, so i think no
08:39 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
08:39 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
08:52 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
08:53 -!- nDuff [~cduffy@rrcs-97-79-207-2.sw.biz.rr.com] has quit [Quit: Leaving]
08:57 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
08:59 -!- ickmyn [~kjg@p4FC70240.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
09:01 -!- alhadi [~thunderst@92.99.203.225] has joined #openvpn
09:03 -!- WinstonSmith [~true@e177095185.adsl.alicedsl.de] has joined #openvpn
09:07 -!- WinstonSmith [~true@e177095185.adsl.alicedsl.de] has quit [Remote host closed the connection]
09:08 -!- alhadi [~thunderst@92.99.203.225] has quit [Ping timeout: 240 seconds]
09:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
09:20 -!- corretico [~laguilar@201.201.44.82] has quit [Remote host closed the connection]
09:23 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
09:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:31 -!- me345 [~me345@adsl-75-15-250-229.dsl.bkfd14.sbcglobal.net] has joined #openvpn
09:46 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:51 -!- mveplus [~Martin@ec2-50-16-199-99.compute-1.amazonaws.com] has quit [Ping timeout: 246 seconds]
10:05 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
10:08 -!- mveplus [~Martin@125.70.70.221] has joined #openvpn
10:17 < JyZyXEL> so do you just run two servers if you wanna be able to decide if you want redirect-gateway or not?
10:23 -!- albech [~thomas@119.42.76.234] has quit [Quit: Ex-Chat]
10:28 -!- lisa [~lisa@titanium.thedoh.com] has left #openvpn []
10:41 -!- akine [~dark@209-84-179-94.pool.ukrtel.net] has joined #openvpn
10:48 -!- takamichi [Takamichi@46.11.13.117] has joined #openvpn
11:06 -!- luneff [~yury@46.61.69.103] has quit [Quit: Leaving]
11:11 -!- akine [~dark@209-84-179-94.pool.ukrtel.net] has quit [Quit: Leaving.]
11:14 < s7r> sorry for the off-topic question - I need to connect 2 routers each one holding 10 computers subnet. for physical connection for 2 routers what cable should i use straight through or crossover?
11:14 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
11:15 < anitxor> straight through - but its a high degree chance it will work with any cable
11:15 < anitxor> oh waits. .. i dont know
11:16 < s7r> ok so router (a) and router (b) .. cable from router A will get out from one of it's 8 ports (not wan port). should it get into router B at WAN port or any port will do?
11:18 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
11:19 < anitxor> s7r: is it ordinary home routers? do they has NATing?
11:19 < s7r> yes ordinary home routers
11:19 < s7r> yes - one of them is also connected to the internet
11:20 < s7r> the other is not
11:20 < s7r> both have private subnets one of them with 192.168.1.1/24 and second 192.168.7.1/24
11:21 < anitxor> i would plug B's wan port into one of router A's client ports, and turn off NAT at router B.
11:22 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
11:22 < anitxor> and i dont think it matters which cable use plug in between the routers, they will likely do fine with whatever cable you find :)
11:22 < s7r> that is what i was thinking also
11:22 < s7r> and i will put router B to get autoconfiguration
11:22 < s7r> the same as it will be another PC on router A
11:23 < s7r> but my concern is why do I have to turn off NAT? i want both networks to see each other and exchange data / filesharing
11:24 < anitxor> if you plug router B's wan port into one of router A's client ports, and keeps NAT on router B -- all of B's computers will look like as if they are all just one single computer (they share their IP). you should probably keep NAT on router A however
11:25 < anitxor> if you keep NAT on router B, it will be a NAT inside your LAN
11:25 < anitxor> and half the computers will think that the other half of the computers are one single computer
11:33 < s7r> oh right
11:33 < s7r> what u recommend ?
11:35 < s7r> if i turn off NAT on router B what IP will i give to the computers connected to router B?
11:39 < s7r> anitxor: and besides this NAT problem which you are totally right - how should I cut the cable as I am doing it now - straight or crossover?
11:49 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
11:53 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
11:56 < EugeneKay> Have an IPv4 server setup, routed. Fiddling with IPv6, would like to get OpenVPN to work with it. Insanity? 
12:02 -!- xindz`off is now known as xindz
12:04 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has quit [Read error: Connection reset by peer]
12:10 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Read error: Connection reset by peer]
12:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
12:17 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
12:18 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has quit [Changing host]
12:18 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has joined #openvpn
12:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:30 -!- mveplus [~Martin@125.70.70.221] has quit [Ping timeout: 240 seconds]
12:31 -!- mveplus [~Martin@125.70.70.221] has joined #openvpn
12:47 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
12:47 -!- kzar [~kzar@yax.org.uk] has joined #openvpn
12:49 < kzar> I'm new to OpenVPN, I've set up a server and a client using a static key. I've got the server running, client's connected and both have the tun0 interface. Problem is pings to the client address from the server and vice versa don't work. I've made sure the ports are open on my server, any ideas what I should check / do?
12:49 < kzar> (I'm using port 53 UDP for the record in case that complicates matters.)
12:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:01 < kzar> Oh that's interesting I get a `No route to host (code=113)` error on the server when trying to ping from the client.
13:10 <@vpnHelper> RSS Update - forum: Modifying Windows GUI <http://forums.openvpn.net/topic7629.html>
13:25 -!- alhadi [~thunderst@92.99.203.225] has joined #openvpn
13:26 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  Want to be different? Try HydraIRC -> http://www.hydrairc.com <-]
13:26 -!- xindz is now known as xindz`off
13:35 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
13:35 < anitxor> kzar: maybe if you are using UDP 53, it blocks your DNS and your computers dont know how to make DNS lookups
13:36 < kzar> anitxor: Yea that's possible although I'm using IP addresses for the pings
13:36 < anitxor> ok.
13:36 < kzar> I'm starting to think incoming udp 53 on the client side are being blocked
13:37 < kzar> pings to client from the server don't show up in any logs, pings from client to server show up in server's logs with the operation not permitted stuff
13:38 < kzar> (Which means I'm in the regretful position of messing with IOS and trying to figure out how the hell to allow incoming UDP traffic :( )
13:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
13:43 < EugeneKay> *nix clients?
13:44 < EugeneKay> What's the routing table look like on the client box?
13:50 -!- xindz`off is now known as xindz
13:53 < kzar> EugeneKay: How do I check that sorry?
13:53 < EugeneKay> "route" in bash
13:55 < kzar> http://paste.lisp.org/display/119612 (10.10.10.* is my lan, 10.10.9.1 is the vpn server and 10.10.9.2 is the vpn client)
13:56 < EugeneKay> That looks right. Can you ping the VPN IP address of the server?
13:57 < kzar> EugeneKay: Nope, that results in "Operation not permitted" messages in the openvpn log of the server
13:57 < EugeneKay> That's something
13:57 < EugeneKay> Oh, you're mising a route
13:58 < EugeneKay> You need 10.10.9.0 255.255.255.0 to go via 10.10.9.1
13:58 < EugeneKay> Try, on the client, ip route add 10.10.9.0 netmask 255.255.255.0 gw 10.10.9.1
13:59 < EugeneKay> You'll probably also want a route for the server's lan 
13:59 < EugeneKay> I'm guessing that your server is also the default GW for other boxen on its' LAN?
14:02 < kzar> EugeneKay: No I'm actually hoping to tunnel access to the internet through openvpn
14:02 -!- luneff [~yury@84.51.213.147] has joined #openvpn
14:02 < kzar> I only have that one server in the subnet so I don't have to worry about bridging my local network I guess
14:02 < EugeneKay> Then you'll need to push a default route from the server
14:02 < kzar> EugeneKay: I added that rule and the pings are still giving me operation not permitted, I've updated my paste with my new route table
14:03 < EugeneKay> You'll want something like push "redirect-gateway def1" in your client-specific conf on the server
14:04 < EugeneKay> Operation not permitted message means the packet is actually getting to the server. That's a plus ;-)
14:04 < EugeneKay> Try SSHing to the server's IP
14:04 < kzar> EugeneKay: That gives me the same oepration not permitted stuff
14:05 < EugeneKay> Hrm.
14:05 < kzar> EugeneKay: Yea my suspicion is that it's server -> client that's being blocked
14:05 < EugeneKay> Paste your server.conf for me? :-p
14:05 < EugeneKay> Oh, stupid question. SELinux enabled?
14:06 < kzar> EugeneKay: I'm unsure, how would I check?
14:06 < EugeneKay> Well, what's the OS?
14:06 < EugeneKay> (server-side)
14:07 < kzar> Oh sorry, I'm running Debian both ends
14:07 < EugeneKay> Then the answer is "no" 
14:12 < kzar> I mean I've tried flushing all the iptables rules on the client to rule that out
14:12 < EugeneKay> server.conf?
14:12 < kzar> my only other thought is my Cisco ADSL router that's between the client and the internet (server is over the internet)
14:12 < kzar> EugeneKay: Oh right, sorry I pasted it on that pastie
14:13 < EugeneKay> There's no line for "server"
14:15 < kzar> EugeneKay: Do I need one? I was following this small howto and it didn't mention it http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
14:15 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
14:15 < EugeneKay> The server needs to have an IP address for it's tun0 interface, yes :-p
14:16 < kzar> EugeneKay: I thought that was specified with the ifconfig line?
14:17 < EugeneKay> That server directive specifies the IP address range to give out
14:18 < EugeneKay> Try this http://eugenekay.pastebin.com/PwjT6dEY
14:20 < kzar> EugeneKay: That gives me "Unrecognized option or missing parameter(s) in tun0.conf:3: server (2.1_rc11)"
14:21 < kzar> oh wait
14:22 -!- no_maam [~no_maam@gate.cdc.informatik.tu-darmstadt.de] has quit [Ping timeout: 240 seconds]
14:22 -!- alhadi [~thunderst@92.99.203.225] has quit [Quit: alhadi]
14:25 < kzar> EugeneKay: So I changed that line to "server 10.10.9.0 255.255.255.0" but then it gives me another error that the server directive clashes with using a secret key
14:25 < kzar> I suspect this is a red herring
14:25 < EugeneKay> Oh derp.
14:26 < Bushmills> static key?  that's peer to peer only. no server-client(s)
14:27 < kzar> Oh I've possible used the wrong terminology, sorry. I am only ever going to need 1 client to connect to my server at any one time though
14:28 < EugeneKay> Yeah. FOrgot about that :-p
14:28 < kzar> EugeneKay: Thanks for the help anyway, I'm going to bike down and buy a curry lol
14:29 < kzar> I suspect I've got to mess with my router, I'll give it some thought anyway, going cross-eyed for now
14:39 < gisikon> ah, openvpn rox when you can use it to stream television from your home tv-box to a location a few hundred kilometers away :D
14:48 -!- N|KO [niko@174.89.243.98] has quit []
15:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 265 seconds]
15:08 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
15:08 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
15:08 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:20 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:22 -!- p_body [~p_body@p54B28F89.dip0.t-ipconnect.de] has quit [Quit: Leaving.]
15:36 -!- luneff [~yury@84.51.213.147] has quit [Quit: Leaving]
15:54 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
16:27 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Ping timeout: 272 seconds]
16:27 -!- gisikon [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 272 seconds]
16:27 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 272 seconds]
16:28 -!- d457k [~heiko@vpn.astaro.de] has joined #openvpn
16:31 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
16:35 -!- gisikon [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
16:35 -!- gisikon is now known as Guest43578
16:35 -!- me345 [~me345@adsl-75-15-250-229.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:38 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 240 seconds]
16:43 -!- anitxor [~xor@cryptoanarchy.org] has quit [Quit: Reconnecting]
16:57 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
17:02 -!- takamichi [Takamichi@46.11.13.117] has quit [Ping timeout: 250 seconds]
17:02 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
17:15 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Connection reset by peer]
17:15 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
17:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
17:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
17:43 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 255 seconds]
17:44 -!- takamichi [Takamichi@46.11.13.117] has joined #openvpn
18:09 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:25 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
18:25 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
18:26 -!- xindz is now known as xindz`off
18:37 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
19:05 -!- theDoc [~Link@110.92.102.28] has quit [Ping timeout: 246 seconds]
19:06 -!- theDoc [~Link@110.92.102.28] has joined #openvpn
19:19 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Read error: Connection reset by peer]
19:24 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
19:29 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
19:52 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
19:54 -!- mveplus [~Martin@125.70.70.221] has quit [Ping timeout: 276 seconds]
20:05 -!- mveplus [~Martin@ec2-50-16-199-99.compute-1.amazonaws.com] has joined #openvpn
20:13 -!- EugeneKay is now known as EugeneKaway
20:18 -!- s7r [~s7r@82.76.239.174] has left #openvpn []
20:34 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:53 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
20:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
20:59 -!- corretico [~laguilar@201.201.44.82] has quit [Remote host closed the connection]
21:03 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
21:07 -!- master_of_master [~master_of@p57B563EB.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
21:09 -!- master_of_master [~master_of@p57B54A2F.dip.t-dialin.net] has joined #openvpn
21:15 -!- EugeneKaway is now known as EugeneKay
21:43 -!- mveplus [~Martin@ec2-50-16-199-99.compute-1.amazonaws.com] has quit [Ping timeout: 240 seconds]
22:00 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Read error: Connection reset by peer]
22:00 -!- mveplus [~Martin@125.70.70.221] has joined #openvpn
22:01 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:12 -!- zeshoem [~mnathani@bas1-toronto46-1177856456.dsl.bell.ca] has joined #openvpn
22:23 -!- EugeneKay is now known as EugeneKaway
23:25 -!- mveplus [~Martin@125.70.70.221] has quit [Ping timeout: 240 seconds]
23:25 -!- mveplus [~Martin@ec2-50-16-199-99.compute-1.amazonaws.com] has joined #openvpn
23:32 -!- hpa [hpa@terminus.zytor.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
--- Day changed Sun Feb 13 2011
00:59 < WormFood> Where are all these "FRAG TTL expired i=%d" coming from in my log files, and how do I resolve it? It seems unlikely to me, that many messages about this in the log files would be normal.
00:59 < WormFood> where is there more info about this? I've googled my ass off for months, and still can't find a single piece of information that is helpful.
01:07 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
01:07 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
01:07 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
01:14 < WormFood> does ANYONE know ANYTHING about this problem? This seems to be a black hole....lots of work goes into it, but  no useful information comes out of it.
01:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
02:05 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 255 seconds]
02:10 -!- toortog [nesm6@notsecure.net] has joined #openvpn
02:25 < oc80z> what did google say?
02:25 < oc80z> sounds like a stuck beacon error i had once.
02:26 < oc80z> heh, but not quite, same difficultie stressd.
02:28 < WormFood> google does not say anything
02:28 < WormFood> all the pages I've found say nothing helpful
02:31 < oc80z> why does it need to be fixed
02:38 -!- alhadi [~thunderst@92.99.203.225] has joined #openvpn
02:41 -!- mveplus [~Martin@ec2-50-16-199-99.compute-1.amazonaws.com] has quit [Ping timeout: 240 seconds]
02:54 -!- mveplus [~Martin@118.114.136.242] has joined #openvpn
03:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:41 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Read error: Operation timed out]
03:49 -!- mveplus [~Martin@118.114.136.242] has quit [Ping timeout: 240 seconds]
03:51 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
04:03 -!- mveplus [~Martin@118.114.136.242] has joined #openvpn
04:20 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 265 seconds]
04:23 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:49 -!- Meliorator [m@dunnington.eu] has quit [Ping timeout: 276 seconds]
05:07 -!- gisikon [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
05:07 -!- Guest43578 [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Connection reset by peer]
05:07 -!- gisikon is now known as Guest53924
05:22 < krzee> [23:54]  <Bushmills> check out  http://openvpn.scarydevilmonastery.net                                
05:22 < krzee> [23:55]  <Bushmills> http://openvpn.scarydevilmonastery.net/make  is the web page generator, i could set it so you could edit it if you wanted                                
05:22 < krzee> [00:12]  <Bushmills> i need another version of howto, though, as i don't manage to grab it with links translated to relative host/path.  as far, the sections all refer to original openvpn.net site.                                
05:22 <@vpnHelper> Title: openvpn documentation (at openvpn.scarydevilmonastery.net)
05:28 -!- WormDude [~wormfood@121.34.196.43] has joined #openvpn
05:28 -!- Meliorator [m@dunnington.eu] has joined #openvpn
05:29 -!- Meliorator [m@dunnington.eu] has quit [Excess Flood]
05:29 -!- Meliorator [m@dunnington.eu] has joined #openvpn
05:30 -!- WormFood [~wormfood@183.15.99.82] has quit [Disconnected by services]
05:30 -!- WormDude is now known as WormFood
05:55 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
05:55 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
05:55 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:05 -!- Guest53924 is now known as stony
06:09 -!- Dropje [~yge@5351300C.cm-6-2a.dynamic.ziggo.nl] has joined #openvpn
06:12 < Dropje> hello, a co-worker and me setup openvpn for our colocation. everything works great except for windows clients. We use push "dhcp-option DOMAIN your.domain" to push our DNS search prefix and that works great on linux clients. On windows clients however it adds instead of replaces the DNS search prefix which results in not having it configured correctly.. Any ideas on how to replace instead of add it?
06:14 < hyper_ch> replace windows with linux clients :)
06:16 < Dropje> haha hyper_ch i would love to ;) but unfortunately some of our co-workers use windows..
06:17 < Dropje> it kinda works though, but it places the search prefix as a secondary instead of primary
06:17 < Dropje> best would be to replace the current used
06:21 -!- cherwin__ [~cherwin@jvs39c-gw.xs4all.nl] has joined #openvpn
06:21 < Dropje> hey cherwin__  :)
06:21 < cherwin__> Dropje: Hi :-)
06:22 < cherwin__> Yeah it's a pain in the butt. Why can every interface have it's own suffix?
06:22 < cherwin__> How does Windows know what suffix to add to a query?
06:23 < Dropje> it probably uses primary > secondary.. 
06:28 < cherwin__> What do you mean, if the first suffix doesn't yield any results, then it will use the second? That would suck in so many levels I don't even know where to begin.
06:29 < Dropje> especially if you are using recursion, since every valid lookup would generate a result..
06:29 < Dropje> but yeah, thats what i mean
06:31 < cherwin__> You're using 64 bit Windows, right?
06:32 < cherwin__> Try using http://openvpn.se/ with 32 bit Windows.
06:32 <@vpnHelper> Title: OpenVPN GUI for Windows (at openvpn.se)
06:33 < Dropje> thats not gonna help us, since it doesnt work like it should with 64 bit windows
06:34 < Dropje> cherwin__: we can't possibly let people change to 32 bit.
06:35 < cherwin__> I don't want people to change architecture. I just want to know if it works. If it does, maybe we can replicate the behaviour in some way.
06:36 < Dropje> cherwin__: ill put it on my netbook's windows install
06:37 < cherwin__> We could use WMI to enforce what we want.
06:37 < cherwin__> Nice.
06:43 < cherwin__> As last resort, that is. Surely we aren't the first who've encountered this issue.
06:44 < reiffert> openvpn comes with the openvpn gui now.
06:45 < reiffert> it works on 64bit windows.
06:47 < Dropje> reiffert: i've just installed it and yes it works.. but no it doesnt work with the DNS search suffix
06:48 < cherwin__> reiffert: I think Dropje tried every GUI on this page https://community.openvpn.net/openvpn/wiki/RelatedProjects#ClientGUI
06:48 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
06:48 < Dropje> i've installed the package from openvpn.net.. it pushes the DNS search suffix on the TAP adapter 
06:48 < cherwin__> TUN?
06:48 < Dropje> according to ipconfig /all TAP :)
06:49 < reiffert> Dropje: interesting. please file a bug report.
06:49 < Dropje> reiffert: well, it does work.. but instead of replacing the search suffix, it adds it as secondary
06:50 < reiffert> did it work as you were expecting it to work?
06:50 -!- s7r [~s7r@82.77.116.57] has joined #openvpn
06:50 < cherwin__> reiffert: Nope.
06:50 < Dropje> no, since my primary suffix is my internal domain.. it does a lookup at the external DNS server which replies my external IP.. it shouldnt even use my internal suffix
06:51 < reiffert> cherwin__: so please file a but report then.
06:51 < cherwin__> reiffert: Will do.
07:25 < cherwin__> reiffert: https://community.openvpn.net/openvpn/ticket/86
07:25 <@vpnHelper> Title: #86 ([win32/win64] push "dhcp-option DOMAIN" adds suffix to the tun adapter) – OpenVPN Community (at community.openvpn.net)
07:36 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
07:39 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
07:51 -!- Coffe [~niszsse@sto.alatest.se] has joined #openvpn
07:52 < Coffe> Hi , is following the guide on the homepage.  i am getting this error on the client .> VERIFY ERROR: depth=0, error=unsupported certificate purpose:
07:58 < Coffe> i guess i might have made a error in creating the certificate. but aint sure.
08:00 < cherwin__> Coffe: Post your client.conf + server.conf.
08:00 < cherwin__> pastebin.org
08:00 < Coffe> cherwin__,  sure thing .
08:00 < cherwin__> Correction pastebin.com.
08:03 < Coffe> http://pastebin.se/203135
08:03 < Coffe> dod not get .org to work . so i used a other, hope that is okey
08:05 < cherwin__> Yeah, that's OK. I corrected myself. It's pastebin.com.
08:05 < Coffe> should i post it there to ? or  will the .se work ?
08:06 < cherwin__> No, it's OK. :-)
08:06 < Coffe> maby its the server parameter ? should it be a local ip ? or the external of my server?
08:08 < cherwin__> The config looks just fine. I think you screwed up the client certificate.
08:08 < cherwin__> http://gozer.ectoplasm.org/blog/archive/2007/07/openvpn_verify.html
08:08 <@vpnHelper> Title: gozer's blog: OpenVPN VERIFY ERROR: unsupported certificate purpose (at gozer.ectoplasm.org)
08:09 < Coffe> okey , so can i just do ./build-key coffe ? to generate a new ? or is there other steps i need to do  ?
08:12 < cherwin__> Yes, try to generate a new key.
08:13 < cherwin__> I reckon that you use Windows?
08:13 < Coffe> no
08:13 < Coffe> ubuntu
08:14 < cherwin__> Then use "dev tun" in your config.
08:14 < Coffe> i did run build-key server , not build-key-server
08:14 < Coffe> okey
08:14 < cherwin__> Try that first.
08:15 < Coffe> yes, server is tun and client tap . lol tnx
08:15 < Coffe> will try 
08:15 <@vpnHelper> RSS Update - forum: OSPF Simulation Tutorial for Beginners (Interactive, Visual) <http://forums.openvpn.net/topic7630.html>
08:16 < cherwin__> Should have seen that sonner.
08:16 < cherwin__> s/sonner/sooner/
08:16 < Coffe> still same problem.
08:17 < Coffe> but for server, should one user build-key or build-key-server ?
08:17 < cherwin__> build-key-server
08:17 < Coffe> ok, that i did not do
08:17 < Coffe> so i will test that
08:19 < cherwin__> Did you not read the howto? Read this part http://openvpn.net/index.php/open-source/documentation/howto.html#pki
08:19 <@vpnHelper> Title: HOWTO (at openvpn.net)
08:20 < Coffe> i am reading it 
08:20 <@vpnHelper> RSS Update - forum: How Does OSPF Neighbor State Change <http://forums.openvpn.net/topic7631.html>
08:21 < Coffe> that is what i am following
08:22 < Coffe> i did also check a debian howto . so thats why 
08:24 < Coffe> Tnx.  now it worked. got a other problem . but its i am doing testing as user . 
08:24 < Coffe> Tnx alot cherwin__ 
08:25 < Coffe> so if i add new client, is there any other thing then just build-key newclient ? or is that all  ?
08:25 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
08:25 < zxd> do I need to specify subnet mask in server.conf  , in the route line
08:25 < zxd> client-config-dir ccd
08:25 < zxd> route
08:25 < zxd> if it's a single host
08:26 < Dropje> zxd: yes you do
08:27 < zxd> like this : route 212.3.4.12 255.255.255.255  Dropje  ?
08:28 < Dropje> if thats the only host yes that should work
08:29 < Dropje> zxd: the problem i ran into was parsing the client config because i wasnt using the correct CN
08:32 < zxd> Dropje,  ah
08:33 < zxd> Dropje,  that's right 
08:33 < zxd> that is why it isn't working
08:34 < Dropje> zxd: is it working now?
08:35 < reiffert> are you on topology subnet?
08:36 < zxd> Dropje, how can I know it read the config in ccd
08:36 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 240 seconds]
08:37 < reiffert> zxd: you could add a push "echo hello world" in there.
08:37 < zxd> yes it work atlast
08:37 < zxd> damn
08:38 < zxd> I am getting flooded with this
08:38 < zxd> 2011-02-13T09:37:52.433648-05:00 li141-148 openvpn[25653]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
08:38 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
08:39 < Dropje> http://readthefuckingmanual.net/error/383/
08:39 <@vpnHelper> Title: readthefuckingmanual.net - solutions to error messages (at readthefuckingmanual.net)
08:39 < Dropje> nice domain naim xD
08:39 < Dropje> *name
08:39 < zxd> ah it rashed on the other side
08:39 < zxd> crashed
08:39 < Coffe> strange. its pushing client1s ip as a route . to client 1.
08:41 < Coffe> i guess its due to its not recon as the right client.
08:42 < Dropje> zxd: check that website, might be useful 
08:42 < reiffert> Coffe: 
08:42 < reiffert> !configs
08:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
08:46 < cherwin__> Coffe: Is your setup working?
08:47 < Coffe> cherwin__,  i can connect now yes. but client gets routing of its local network to the server. 
08:47 < cherwin__> Coffe: I don't quite understand what you're saying.
08:48 < Dropje> Coffe: follow reiffert's instructions
08:48 < Dropje> !configs
08:48 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
08:48 < Coffe> will do a new posting .. hang on
08:49 < reiffert> take your time, I'm out for a smoke
08:49 < Coffe> omg. i think my firewall died
08:49 < Coffe> :/ 
08:49 < reiffert> burry it
08:50 < Coffe> i guess 
08:52 < kzar> How can I do a test to see if UDP on a certain point is getting through? I've got a Debian box either end and I just want to double check that the port's really open and being routed through
08:53 < reiffert> kzar: netcat -l -u 12345
08:53 < reiffert> kzar: and on the client side do: nc -u host 12345
08:53 < reiffert> then type in some words, they should make it to the server side.
08:54 < reiffert> where 12345 is the port no.
08:54 < Dropje> reiffert: i thinku can also use nmap?
08:54 < Dropje> nmap -sU -PN
08:54 < cherwin__> reiffert: He has openvpn already running at that port guys.
08:54 < cherwin__> Just use tcpdump port 12345
08:55 < reiffert> Dropje: one is the "i do belief something"-approach and the other one is "I see it's working".
08:55 < Dropje> reiffert: "its working" 
08:56 < Dropje> reiffert: but you're right
09:01 < kzar> reiffert: Cool that worked, makes me think "why the hell doesn't openvpn bloody work then?!" though heh
09:01 -!- EugeneKaway is now known as EugeneKay
09:01 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:02 < Dropje> kzar: what do the logs tell you?
09:02 < kzar> "read UDPv4 [EHOSTUNREACH]: No route to host (code=113)" in the server's logs when I try and ping the server from the client
09:03 < kzar> OH I see the problem
09:03  * kzar whoops
09:03 < kzar> I have two ip addresses on my server, it's using one and expecting the other. Is there a way to force the server to use eth0 instead of eth0:1 ?
09:04 < Coffe> so back :) 
09:07 < cherwin__> kzar: local 0.0.0.0 to listen on both interfaces.
09:07 < cherwin__> kzar: Obviously you can just pick an IP to bind on.
09:09 < Coffe> Dropje, cherwin__  reiffert --> http://pastebin.com/RMiyDTE9
09:09 < cherwin__> kzar: It's odd though. The default server.conf listens on all interfaces.
09:09 -!- funyun [~lolwhut@cpe-174-100-118-132.neo.res.rr.com] has joined #openvpn
09:09 < kzar> cherwin__: That did the trick :) I added `local expected-ip` to the server
09:10 < kzar> cherwin__: Problem was my hostname has an ip of .25 but my server was sending the replys back from my other ip address .45 or something
09:10 < funyun> hi. i'm interested in buying a vpn from one of these sites using openvpn. but i was wondering, is it possible to just make the vpn work in command line? like using irssi and things. but have my browser using my real ISP?
09:10 < kzar> cherwin__: So the client freaked because it was an untrusted ip address
09:12 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
09:12 < Dropje> funyun: you should use a shell somewhere ;)
09:12 < funyun> Dropje: what's that? and where can i get one?
09:13 < Dropje> a shell is just a linux host somewhere.. you will be using the ip of that host
09:13 < kzar> funyun: Well you could rent a VPS somewhere and set it up yourself, it's pretty cheap and you get to use it for web hosting, email hosting or whatever you want as well
09:14 < cherwin__> funyun: You asking that question makes me wonder why you want to have such a setup.
09:14 < kzar> funyun: You trade money for time though, that's the bad side
09:14 < Dropje> cherwin__: i agree ;)
09:14 < funyun> for irssi. plus my friend told me a vpn can actually boost your download speed
09:15 < funyun> is that true?
09:15 < cherwin__> funyun: It really depends. It's a bit of a void statement.
09:15 < Dropje> funyun: a vpn to a remote site and downloading from that site could be better download speed.. but that would mean that you download on that remote site.. how do you want to get it to your network?
09:16 < Dropje> you'll be using the same internet line as you would download local
09:16 < Dropje> so in that case its nonsense
09:16 < kzar> funyun: What I often do is SSH to my VPS, tell that to download from bitorrent using the much faster connection and then scp it back home directly
09:16 < kzar> funyun: It's a lot faster but it all depends what your upload speed is like and what-not
09:17 < Dropje> kzar: it really depends on the goal.. your actual speed of getting it to your local computer wouldnt change
09:17 < funyun> kzar: yes. that's also what i wanted to use it for
09:17 < Dropje> kzar: you are referring to a seed box
09:18 < kzar> funyun: Well in that case you don't really need to set up OpenVPN, you just need access to a shell like Dropje said with the right ports open. Just install rtorrent or something similar and then scp stuff home
09:18 < cherwin__> funyun: kzar: There are so many factors to consider. And the end result is meager at best.
09:18 < kzar> Dropje: Well it does help sometimes, it just depends but you're right it's often a bit pointless
09:19 < kzar> (For example my ISP charges a lot more for upload during the day time and I'm on ASDL and we all know what the A stands for.)
09:20 < Coffe> in my ipp.txt . client is named after its fqnd,, but its ccd is a short name. the same name i used when creating clients certificate. 
09:20 < cherwin__> Consider switching ISPs.
09:21 < Dropje> Coffe: you should be using the CN in ccd.. for example: coffe.client.vpn.domain.com
09:21 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
09:21 < funyun> alright. thanks for all the info guys :)
09:21 < kzar> cherwin__: Yea you're right, there's a flip-side though. For example a techy answers the phone and actually helps me out
09:23 < cherwin__> kzar: Yeah that's nice. It's a lost art for ISPs to have adequate tech support.
09:23 < kzar> Thanks for the help everyone by the way, so relieved my lil' VPN is workign now :)
09:23 < cherwin__> kzar: You're welcome.
09:23 < Dropje> yw 
09:23 < Coffe> Dropje,  tnx
09:26 < Coffe> so , last question :) if i like to add a new client . do i need to generate all again. or just the client certificate ?
09:26 < Dropje> Coffe: ofcourse just the client
09:26 < Coffe> Dropje,  Tnx :)
09:30 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 260 seconds]
09:35 <@vpnHelper> RSS Update - forum: Possible to use a key token with OpenVPN? <http://forums.openvpn.net/topic7632.html>
09:57 -!- luneff [~yury@84.51.213.147] has joined #openvpn
10:06 < Coffe> in client-to-client. should all clients net adresses be listed there ?
10:06 < cherwin__> Coffe: Nope.
10:06 < ecrist> what?
10:09 < Coffe> cherwin__, okey , i am doing  3 offices connecting to main office.
10:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:17 < Coffe> found a typ. tnx alot for the help :)
10:18 -!- ivenkys [~ivenkys@81.168.100.197] has joined #openvpn
10:18 -!- ivenkys [~ivenkys@81.168.100.197] has quit [Changing host]
10:18 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
10:23 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Client Quit]
10:25 < reiffert> anyone trying startSSL.com certificates recently?
10:26 < jpalmer> reiffert: yes
10:26 < jpalmer> not with openvpn though,  but yes.
10:26 < |Mike|> for my website, yep 
10:26 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
10:29 < reiffert> do they provide subject alternative names extensions?
10:37 < jpalmer> for the free cert,  they give you the top level domain,  and a single subdomain.  so if you want a cert for www.example.com,  it will also be good for "example.com"
10:39 < kzar> So I got my VPN working between two Debian boxes but the next step was to try connecting from my Macbook. I'm not having much luck though, when I try and ping the server from my laptop loads of these errors show up in the server's log http://paste.lisp.org/display/119637
10:39 < reiffert> I need webmail.domain, mail.domain, domain2, domain3, domain4 alltogether in one cert.
10:41 < cherwin__> reiffert: Wildcard cert.
10:41 < cherwin__> You can ask for a cert *.example.com
10:43 < reiffert> cherwin__: should be subject alternative names for the domain2,3,4 stuff..
10:44 < cherwin__> I have no idea if that's even possible.
10:48 -!- funyun [~lolwhut@cpe-174-100-118-132.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
10:48 -!- funyun [~lolwhut@199.58.160.52] has joined #openvpn
10:55 -!- funyun [~lolwhut@199.58.160.52] has left #openvpn []
11:04 -!- Coffe [~niszsse@sto.alatest.se] has quit [Ping timeout: 260 seconds]
11:05 -!- albech [~thomas@124.157.245.126] has joined #openvpn
11:08 -!- Coffe [~niszsse@sto.alatest.se] has joined #openvpn
11:12 -!- Coffe [~niszsse@sto.alatest.se] has quit [Client Quit]
11:16 -!- mveplus [~Martin@118.114.136.242] has quit [Quit: Leaving]
11:16 < Dropje> reiffert: you can use a Organisational wildcard
11:17 < Dropje> these are not restricted to domain
11:18 < Dropje> they are kinda pricey though i think
11:18 < EugeneKay> AFAIK it is not possible to do multiple-FQDNs in a single X.509 cert
11:19 < EugeneKay> Which is why SSL virtual hosting is done per-IP
11:19 < EugeneKay> You get a single address, or a wildcard. Nothing in between.
11:26 < stony> EugeneKay: it is
11:26 < stony> EugeneKay: you just add multiple DN's
11:27 < EugeneKay> Does any commercial cert authority do that ?
11:27 < stony> openssl req -new -batch -subj '/C=country/ST=state/O=organisation/OU=orgunit/DN=www.google.de/DN=www.yahoo.com'
11:27 < stony> EugeneKay: yes
11:27 < stony> EugeneKay: they all do it
11:28 < EugeneKay> Learn something new every day
11:28 < stony> so called "wildcard certificates"
11:28 < stony> it's either *.domain.com
11:28 < stony> or a.domain.com, b.domain.com ...
11:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
11:36 -!- elux [~peter@209.222.3.12] has joined #openvpn
11:36 < elux> hey guys
11:37 < elux> does openvpn let me setup a vpn with pptp?
11:39 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
11:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:43 -!- bitterman [~yury@84.51.213.147] has joined #openvpn
11:45 -!- luneff [~yury@84.51.213.147] has quit [Ping timeout: 240 seconds]
11:47 < ecrist> elux: no
11:48 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
11:53 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 240 seconds]
11:55 -!- kzar [~kzar@yax.org.uk] has quit [Remote host closed the connection]
11:55 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
12:14 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
12:15 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
12:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
12:29 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
12:29 -!- mode/#openvpn [+o mattock] by ChanServ
12:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:39 -!- montana [~montana@212.117.173.72] has quit [Ping timeout: 250 seconds]
13:08 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
13:12 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
13:34 -!- somebody [~somebody@S010600254bd0f31e.vn.shawcable.net] has joined #openvpn
13:36 < somebody> Hi, got a question about setting up a simple bridged network.  so i have to create a bridge interface, br0, and bind that to eth0.  my only question is, in the /etc/network/interfaces file, under the br0 section, do i want to enter the same IP address as eth0, or something different?
13:38 < reiffert> the former.
13:39 < somebody> ok 
13:41 < somebody> i wonder...im doing this is a virtual machine (rackspace cloud) are they just gonna let me randomly take an internal IP? probably not...
13:45 < somebody> wait im retarded, the former means the first thing i said, right? ;)
13:49 < ecrist> right
13:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
13:55 -!- nickio [~nick@78-86-120-249.zone2.bethere.co.uk] has joined #openvpn
13:57 < somebody> lol
14:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:14 -!- rasengan [~rasengan@unaffiliated/rasengan] has joined #openvpn
14:14 < rasengan> anyone able to successfully run 2 openvpn instances on 1 server?
14:20 < somebody> fffffffuuuuuuuuuuuu this is a lot more complicated than i thought, lol
14:24 < belZe> rasengan: Yes
14:29 < reiffert> somebody: fu? support ends. You are welcome.
14:30 < somebody> thx :P
14:30 < reiffert> rasengan: here's a working example:  http://pastebin.com/GKeMEvUY
14:39  * belZe pokes reiffert
14:40 < elux> is there a native mac os x client that can vpn and pass through traffic on a linux openvpn server?
14:40 < reiffert> elux: yes.
14:40 < elux> reiffert: cool. which protocol?
14:40 < reiffert> elux: openvpn.
14:40 < elux> openvpn has its own protocol?
14:41 < elux> i was hoping pptp, l2tp or ipsec
14:41 < reiffert> in terms of "openpvn" does not speak "ipsec": yes.
14:41 < reiffert> !notovpn
14:41 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
14:41 < reiffert> !factoids search ipsec
14:41 <@vpnHelper> No keys matched that query.
14:41 < elux> well.. i wouldnt say so
14:41 < reiffert> !factoids search --values ipsec
14:41 <@vpnHelper> 'notcompat' and 'pptp'
14:41 < reiffert> !notcompat
14:41 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
14:41 < elux> i am trying to understand what openvpn does.. and which standard protocols its implements for vpn access
14:42 < elux> gotcha. it uses ssl
14:42 < nickio> in AS, are there any docs for adding another vpn node? So the client can select which one to connect to (without having to manually enter the connection details)
14:43 < reiffert> nickio: please contact the official AS support, thanks.
14:43 < reiffert> !AS
14:43 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
14:43 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
14:43 < nickio> reiffert, oky koky ;)
14:44 < elux> http://www.thesparklabs.com/viscosity/
14:44 <@vpnHelper> Title: Viscosity - OpenVPN Client for Mac (at www.thesparklabs.com)
14:44 < elux> beauty. there is this
14:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:44 < reiffert> elux: openvpn works for windows, linux and os x and various other OS and for a huge set of mobile phones.
14:45 < elux> reiffert: iphone?
14:45 < reiffert> elux: yes.
14:45 < elux> oh cool. how?
14:45 < reiffert> what do you mean, how?
14:45 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
14:45 < elux> well the iphone only supports l2tp, pptp and ipsec
14:46 < reiffert> elux: wrong.
14:46 < elux> good :
14:46 < elux> :)
14:46 < elux> so where can i setup the ssl vpn then? in settings > network > vpn .. i just see those 3 protocols
14:47 < reiffert> hi belZe
14:47 < belZe> hey
14:47 < reiffert> elux: openvpn iphone >> google
14:48 < elux> :P
14:48 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
14:54 < Dropje> elux: you can't without a Jaibreak
14:54 < elux> i figured that was the answer
14:54 < Dropje> elux: OpenVPN is only available through Cydia
14:54 < Dropje> damn Apple ;)
14:55 < elux> i am sure over time they'll support it
14:55 < elux> does openvpn support virtual user/password authentication?
14:55 < elux> virtual as in i dont need system accounts ..
14:56 < reiffert> elux: yes.
14:56 < elux> nice
14:56 -!- Desg_xd [~desg@adsl-217-8-166.asm.bellsouth.net] has joined #openvpn
14:56 < elux> okay. last question :P sorry ...... what is a good guide for configuring openvpn? ive searched google and found a bunch of crap. mostly just a series of commands without explaination
14:57 < reiffert> !howto
14:57 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:57 < elux> thx
15:00 -!- elux_ [~peter@CPE000e08e74ad2-CM00194757201e.cpe.net.cable.rogers.com] has joined #openvpn
15:01 -!- elux_ [~peter@CPE000e08e74ad2-CM00194757201e.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
15:01 -!- elux [~peter@209.222.3.12] has quit [Read error: Connection reset by peer]
15:01 -!- shasderi1s [~shasderia@109.175.239.8] has joined #openvpn
15:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
15:16 < Desg_xd> yo how do i LZO headers were not found
15:16 < Desg_xd> LZO library available from http://www.oberhumer.com/opensource/lzo/
15:16 <@vpnHelper> Title: oberhumer.com: LZO real-time data compression library (at www.oberhumer.com)
15:16 < Desg_xd> i wget'd it
15:16 < Desg_xd> i thought i installed it
15:17 < Desg_xd> and it wont work still
15:19 < krzee> you in openbsd?
15:20 < Desg_xd> nope
15:20 < Desg_xd> ubuntu
15:20 < krzee> then i dunno, should just work
15:20 < Desg_xd> do i have to restart a installing
15:20 < krzee> try using synaptic
15:20 < Desg_xd> kk
15:20 < ecrist> sup krzee?
15:20 < krzee> sup eric
15:20 < krzee> enjoying the single life brutha
15:20 < ecrist> my fevered dreams are something straight out of a pink floyd video this past week.
15:21 < krzee> oh damn you're STILL sick!?!?
15:21 < ecrist> heh, yeah
15:21 < ecrist> not so bad today, though
15:21  * ecrist sitting in the office right now
15:21 < ecrist> spending my sunday fighting with freeswitch
15:21  * krzee rolling blunt right now
15:21 < ecrist> I hate you.
15:22 < krzee> aww no, i need to go get a blunt paper, brb
15:23 < reiffert> :)
15:25 < Desg_xd> which one do i nstall from synaptic
15:26 < Essobi> ecrist: lol
15:26 < Essobi> ecrist: What's wrong with FS?
15:26 < ecrist> Essobi: moving to new hardware today, wants to fight me the whole way
15:26 < ecrist> right now, nothing wants to register
15:27 < Desg_xd> oh ok'
15:27 < Desg_xd> just clicked on all of em and worked now
15:27 < Essobi> Ah, gotcha.
15:27 -!- Fthis [44c314b8@gateway/web/freenode/ip.68.195.20.184] has joined #openvpn
15:27 < Desg_xd> now it says configure: error: OpenSSL Crypto headers not found.
15:27 < Essobi> ecrist: I'm playing with with weeeee tiny netbsd boxen atm.
15:29 < Fthis> hey guys.  i have an openvpn configured for a "site-to-site" UDP connection with static keys.  server is cablemodem, client is aDSL, both in the same city/state.  it's reallyreally slow.  mtu-test doesn't offer anything useful.  what can i do?
15:32 <@vpnHelper> RSS Update - forum: VPN for unrestricted internet access to people overseas <http://forums.openvpn.net/topic7633.html>
15:33 < Desg_xd> anyone help with the configure: error: OpenSSL Crypto headers not found.
15:33 < ecrist> we need more information than that.
15:33 < Fthis> Desg_xd: looks like you need to install openvpn dependencies
15:33 < ecrist> things should 'just work' if you're doing things right.
15:34 < Desg_xd> what are openvpn dependencies
15:34 < Desg_xd> and i just had downloaded the lpo
15:34 < Fthis> things that openvpn depends on
15:34 < Desg_xd> lzo)
15:34 < Fthis> what OS?
15:34 < Desg_xd> ubuntu
15:34 < Fthis> how did you install?
15:35 < Fthis> apt-get install openvpn?
15:35 < Desg_xd> nah
15:35 < Desg_xd> from website
15:35 -!- cherwin__ [~cherwin@jvs39c-gw.xs4all.nl] has quit [Quit: leaving]
15:35 < Fthis> undo everything and use apt-get install openvpn
15:37 < Desg_xd> kk done
15:39 < Desg_xd> no idea what to do now
15:39 < Fthis> now you RTFM
15:39 < Desg_xd> no
15:39 < Desg_xd> like
15:39 < Desg_xd> i have a crt file
15:40 < Desg_xd> and a .ca file
15:40 < Fthis> yes
15:40 < reiffert> Fthis: rtfm.
15:40 < reiffert> !howto
15:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:41 < Desg_xd> no i have a .crt and a .ovpn
15:42 < Desg_xd> nothing in that i read told me where to move those files to to connect to the vpn
15:42 < Fthis> Desg_xd: your questions are answered in the manual, it's all very clear, even for a beginner
15:43 < reiffert> Desg_xd: the howto covers that.
15:44 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
15:46 < Desg_xd> so reiffert how do i use this ovpn file
15:46 < Desg_xd> it says windows only
15:52 < reiffert> where?
15:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:53 < Desg_xd> On Windows they are named server.ovpn and client.ovpn.
15:53 < Desg_xd> and i have a ovpn file
15:53 < reiffert> Desg_xd: so?
15:53 < Desg_xd> ... im not on windows 
15:53 < reiffert> Desg_xd: 
15:53 < reiffert> !goal
15:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:54 < Desg_xd> i want to connect to a vpn with a ovpn file and a crt file
15:55 < reiffert> just one crt file? What's it's content?
15:55 < Bushmills> don't focus on what name the config file has, instead focus on what it containts
15:55 < Bushmills> contains
15:55 < Bushmills> for openvpn, the contents of the config file are important. 
15:55 < EugeneKay> ovpn will be the configuration file, crt will be the CA of the PKI root. You are missing a client-cert and a client-key.
15:56 < Desg_xd> well
15:56 < Desg_xd> i didnt get a client-cert and a client-key
15:56 < EugeneKay> Talk to whoever gave you the ovpn file
15:56 < EugeneKay> They'll know more about your organization's OpenVPN configuration than we can glean via IRC ;-)
15:56 < reiffert> EugeneKay: I wonder if you cant have them in a single file..
15:57 < EugeneKay> reiffert - probably, but to what end?
15:57 < reiffert> EugeneKay: using shared secrets require one crt as well.
15:57 < Bushmills> !pkcs12
15:58 < EugeneKay> Ah, so the ovpn could have the shared secret.
15:58 < Bushmills> !pkcs11
15:58 < Bushmills> hm
15:58 < reiffert> !factoids search --values pkcs12
15:58 <@vpnHelper> No keys matched that query.
15:58 < reiffert> !factoids search --values pkcs
15:58 <@vpnHelper> No keys matched that query.
15:58 < reiffert> !factoids search pkcs
15:58 <@vpnHelper> No keys matched that query.
15:58 < EugeneKay> The bot hates you
15:59 < krzee> !factoids
15:59 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
15:59 < reiffert> krzee: who deleted the pkcs factoid?
16:00 < krzee> dont remember having seen one
16:00 < EugeneKay> !factoids search pki
16:00 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
16:00 <@vpnHelper> signed specially as a server (see !servercert)
16:04 -!- Fthis [44c314b8@gateway/web/freenode/ip.68.195.20.184] has quit [Ping timeout: 245 seconds]
16:12 -!- rasengan [~rasengan@unaffiliated/rasengan] has left #openvpn []
16:14 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
16:14 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
16:14 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
16:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:46 < Essobi> krzee: sufficiently blunted?
16:46 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
16:46 < krzee> quite :)
16:47 < Essobi> word
16:47 < Essobi> Grape?
16:47 < krzee> strawberry
16:47 < Essobi> hehe
16:56 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <-]
16:59 -!- Desg_xd [~desg@adsl-217-8-166.asm.bellsouth.net] has quit [Remote host closed the connection]
17:10 < krzee> !learn mirror as http://openvpn.scarydevilmonastery.net for a mirror of the docs
17:10 <@vpnHelper> Joo got it.
17:17 < reiffert> Bushmills: the first link on o.s.n points to howto3.html, should be howto.html
17:18 < reiffert> Bushmills: but for howto.html the document links still have to be replaced..
17:25 -!- bba[bis] [~bba@93.1.40.113] has quit [Remote host closed the connection]
17:25 -!- bba [~bba@93.1.40.113] has joined #openvpn
17:28 -!- shasderi1s [~shasderia@109.175.239.8] has quit [Read error: Connection reset by peer]
17:32 < Bushmills> rather than patching up a grabbed copy, i prefer to get hold of one which makes that unnecessary
17:33 < Bushmills> those have been put online not for general enjoyment, but for a specific purpose
17:34 < Bushmills> and the link to howto.html is entirely unsuited for that purpose
17:40 < reiffert> howto3.html links get you to howto.html ..
17:42 < |Mike|> lol
17:44 < Bushmills> would you like to patch of the document?
17:44 < Bushmills> path up the document ...
17:44 < Bushmills> grr
17:44 < Bushmills> patch up...
17:45 < reiffert> like sed -e < > someth?
17:45 < Bushmills> (doing blind typing in darkness on not too familiar keyboard)
17:46 < Bushmills> yes, that's what incrementelly lead from howto.html to howto3.html
17:46 < Bushmills> there are evidently more things to substitute
17:47 -!- s7r [~s7r@82.77.116.57] has quit [Ping timeout: 240 seconds]
17:48 < reiffert> Bushmills: but again, links from howto3.html lead to howto.html right now
17:48 < Bushmills> do you want to fix those?
17:49 < reiffert> it's up to you, isnt it?
17:49 < Bushmills> why?
17:55  * ecrist cheers
17:56 -!- s7r [~s7r@82.77.116.57] has joined #openvpn
17:56 < ecrist> sorry, OT, but my voip phones are registered, faxing works, and I get to go home now.
17:56  * ecrist does a dance.
17:56 -!- s7r is now known as Guest85387
17:56 -!- Guest85387 [~s7r@82.77.116.57] has left #openvpn []
18:08 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
18:13 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
18:22 <@vpnHelper> RSS Update - forum: Routing help for OpenVPN server behind NAT <http://forums.openvpn.net/topic7634.html>
18:58 -!- bba[bis] [~bba@93.1.40.113] has joined #openvpn
19:02 -!- bba [~bba@93.1.40.113] has quit [Ping timeout: 276 seconds]
19:10 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
19:27 -!- bitterman [~yury@84.51.213.147] has quit [Quit: Leaving]
19:42 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
19:51 -!- somebody [~somebody@S010600254bd0f31e.vn.shawcable.net] has quit [Quit: Leaving]
20:02 -!- bba[bis] [~bba@93.1.40.113] has quit [Remote host closed the connection]
20:02 -!- bba [~bba@93.1.40.113] has joined #openvpn
20:11 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
20:28 < ecrist> sup d00ds?
21:00 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
21:02 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
21:07 -!- master_of_master [~master_of@p57B54A2F.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:09 -!- master_of_master [~master_of@p57B53A62.dip.t-dialin.net] has joined #openvpn
21:37 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
21:43 -!- Fthis [4a48a286@gateway/web/freenode/ip.74.72.162.134] has joined #openvpn
21:45 < Fthis> i have the following openvpn setup: UDP, site-to-site (static key), routed. files transfer at full speed, however web browsing and fileshare browsing loads EXTREMELY slow.  mtu-test doesn't offer me any advice.  what can i do?
21:52 -!- albech [~thomas@119.42.76.234] has joined #openvpn
21:54 < ecrist> hrm
21:54 < ecrist> Fthis: I'm guessing you have some internet slowness.
21:54 < ecrist> keep in mind if you're using the vpn connection to route internet traffic, you're taking a double hit for each vpn client.
21:54 < ecrist> from/to the client, from/to the internet
21:55 < Fthis> i am not using the VPN as a default gateway.  when i said web browsing is slow, i meant browsing a web server on the other LAN
21:55 < Fthis> and the connections are 30/5mbit cable and 10/1 aDSL
21:55 < ecrist> how are you measuring 'slowness'
21:55 < Fthis> correction, it's 8/768kbit aDSL
21:56 < ecrist> is it something empirical?
21:56 < Fthis> for example, doing "ls -l" in an ssh console on a remote host will scroll a line per second.  ouch
21:57 < ecrist> and if you do it outside the vpn, it's faster?
21:57 < ecrist> !configs
21:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
21:57 < ecrist> !logs
21:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
21:57 < Fthis> viewing a page of graphs in Cacti, assuming you are familiar with it, it takes 2 seconds per graph
21:57 < Fthis> if i do ssh site-to-site it's perfectly fine
21:57 < ecrist> Fthis: cacti graphs are generated on the fly, how long do they take when your'e local?
21:58 < Fthis> split second when local
21:58 < Fthis> these are just examples because i have no actual numbers to show you
21:58 < Fthis> allow me to paste my configs
22:00 < Fthis> this is the server: http://pastebin.com/KD4dbEkE
22:01 < ecrist> find a way to show me some numbers.
22:02 < Fthis> this is the client: http://pastebin.com/T089FxH8
22:02 < Fthis> anything you can suggest?
22:02 < Fthis> as far as showing you numbers
22:03 < ecrist> hrm, something like: off the vpn, 'time wget URL'  on the vpn, 'time wget URL'
22:03 < ecrist> shows me load times on/off the vpn
22:04 < Fthis> you got it
22:04 < ecrist> :)
22:06 < Fthis> wgets seem to go at top speed.  wtf?
22:07 < ecrist> heh, that's good.
22:07 < Fthis> pointing a web browser at the same thing takes a few seconds
22:07 < ecrist> sounds like a DNS issue, perhaps?
22:07 < Fthis> i don't think so
22:07 < Fthis> remember downloading porn images on your 56k when you were 13?
22:07 < Fthis> thats how jpegs look over this VPN
22:08 < ecrist> that doesn't make sense, though, Fthis 
22:08 < Fthis> oh hang on.  wget isn't grabbing images i don't think.  i don't have the options right
22:09 < ecrist> wget most certainly should...
22:11 -!- k1rk [~kirk@96.44.188.116] has joined #openvpn
22:11 < k1rk> I am trying to set up an OpenVPN server on Ubuntu and I have run into an error starting the VPN, and I'm not sure what to do to troubleshoot it.
22:12 < k1rk> script failed: could not execute external program
22:13 < k1rk> http://goput.it/t93.txt
22:13 < ecrist> k1rk: what ever is in openvpn.up is failing
22:15 < k1rk> ecrist, thanks, was thinking that was what was going on. This is that file. v
22:15 < k1rk> oops. http://goput.it/9h4.txt
22:15 < Fthis> here look.  i performed this test on the VPN server.  it is wget --mirroring the cacti server.  this is typical speeds:
22:15 < Fthis> 15.2K/s   in 0.8s 
22:15 < Fthis> 10.4K/s   in 0.7s
22:15 < Fthis> 15.9K/s   in 1.7s
22:16 < Fthis> 13.3K/s   in 1.4s
22:16 < Fthis> and so on and so forth
22:16 -!- trelane [~trelane@funtoo/staff/trelane] has joined #openvpn
22:16 < ecrist> ok...
22:17 < trelane> !welcome
22:17 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:17 < trelane> !goal
22:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:17 < k1rk> ecrist, why would that be failing to execute?
22:17 < trelane> My openvpn works fine, I just can't find documentation on which version of TLS OpenVPN supports
22:18 < Fthis> k1rk: check out your "/openvpn.up" sript
22:18 < Fthis> script
22:18 < ecrist> k1rk: your shbang needs to be first
22:18 < Fthis> oh i didn't see the second link
22:18 < ecrist> also, use a full path, rather than relative.
22:18 < ecrist> that's a dirty way to add routes.
22:19 < k1rk> ecrist, I'm open to suggestions as to how I should.  I would like to be able to get online thorough this server. That's really all I need from it.
22:19 < k1rk> I'd like compression and encryption eventually but obviously it should be working first. :P
22:20 < k1rk> This is my first time doing this. Last time I setup a vpn I used PPTP on Windows Server because it was easy. 
22:20 < ecrist> !def1
22:20 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
22:22 < ecrist> k1rk: what is your !goal?
22:23 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
22:23 < k1rk> !goal
22:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:24 < Fthis> ekirk: i'll also add that VNC connections are miserable
22:24 < k1rk> I want to access the Internet over the VPN.  The VPN is running on a VPS, so there are no private networks\addresses.  I just really need host-only and NAT. 
22:24 < ecrist> k1rk: pretty straight-forward, then.
22:25 < k1rk> ecrist, is there a good walkthrough?  The one on the Ubuntu wiki is a mess.
22:25 < ecrist> setup a vpn using a viratul IP range in the 10.0.8.0/24 subnet, setup nat outboudn from 10.0.8.0/24 via the inet interface on the vpn server, !def1, done
22:25 < k1rk> I am enrolled in a Cisco CCNA prep class, and I have a friend I work with who is a networking major.  I am not unfamiliar with this stuff, just with openvpn in particular.
22:26 < ecrist> first, setup running VPN.
22:26 < ecrist> !howto
22:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:26 < ecrist> doesn't have to go anywhere yet.
22:26 < ecrist> get a basic one setup where you can ping the VPN server ip over the VPN
22:28 < k1rk> ecrist, I think I have the server at that already.  I have the client installed on 7 but I haven't found where to put server info yet.
22:29 < ecrist> the config and certs/keys usually go in c:\program files\openvpn\config
22:29 < ecrist> I think.
22:29 < k1rk> I haven't generated any certs though. Just that one secret.
22:30 < trelane> My openvpn works fine, I just can't find documentation on which version of TLS OpenVPN supports, can anyone point me to a document with a list of standards openvpn complies with?
22:30 < k1rk> I will attempt to do that now.
22:31 < ecrist> trelane: what do you mean?
22:32 < ecrist> openvpn uses whatever openssl you compile with.  iirc 1.0.0 was tested
22:32 < trelane> ecrist, the TLS standard, not GNUTLS, but I think you just answered my question
22:32 < Fthis> ecrist: this is a stretch but, is there any disadvantage to running a VPN server on VMware ESXi?
22:35 < ecrist> Fthis: depends on the OS, iirc
22:35 < Fthis> ubuntu server
22:35 < ecrist> there's some OS that requires special tweaks or kernel modules, but it's something like VZos or some such stupid thing
22:36 < ecrist> for ubuntu, I don't think so...
22:36  * ecrist goes to watch TV.
22:36 < ecrist> l8r peeps
22:37 < Fthis> later thanks
22:42 -!- Fthis [4a48a286@gateway/web/freenode/ip.74.72.162.134] has quit [Quit: Page closed]
22:45  * EugeneKay screams something about OpenSSL 
22:47 -!- newbie872 [~IRC@188.49.241.131] has joined #openvpn
22:48 < newbie872> hello, openvpn is running but it's not li's not listening.
22:49 < newbie872> when i do netstat nothing under state
22:59 <@vpnHelper> RSS Update - forum: Few random questions <http://forums.openvpn.net/topic7608.html#p9704>
23:02 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:03 -!- nickio [~nick@78-86-120-249.zone2.bethere.co.uk] has quit [Read error: Connection reset by peer]
23:04 -!- nickio [~nick@78-86-120-249.zone2.bethere.co.uk] has joined #openvpn
23:08 < k1rk> ecrist, I have it set up now so I can ping the server's IP
23:09 < k1rk> ecrist, now how do I set it to be my client PC's gateway for the Internet?
23:11 -!- EugeneKay is now known as EugeneKaway
23:11 <@vpnHelper> RSS Update - forum: VPN for unrestricted internet access to people overseas <http://forums.openvpn.net/topic7633.html#p9705>
23:15 -!- saliak1 [~saliak@ip68-9-228-184.ri.ri.cox.net] has joined #openvpn
23:17 < saliak1> I have a general question about VPNs.  I'm curious how the concept of having two ip addresses works, and is resolved in a vpn scenario.  for example, on my LAN i have one ip (for example, 192.168.1.10).  I connect to a VPN and get another ip address for that network.  How does one administering the VPN make sure that it's Ips aren't the same as my LAN ip? I know they could use adresses like 10.8.7.6.xx, but it's not gaurenteed, right?  then
23:17 < saliak1> , from there, do all the machines on the VPN network need to have the same IP addressing scheme as those provided by the vpn server?  What are these types of issues called (i'd like to read more aobut them, but am not sure what to search for)
23:17 <@vpnHelper> RSS Update - forum: OpenVPN on Amazon EC2 Windows 2008 Instances <http://forums.openvpn.net/topic7597.html#p9706>
23:23 -!- newbie872 is now known as seekh
23:29 -!- albech [~thomas@119.42.76.234] has quit [Read error: Connection reset by peer]
23:33 -!- saliak1 [~saliak@ip68-9-228-184.ri.ri.cox.net] has quit [Quit: This computer has gone to sleep]
23:41 < diphthong> that guys wins the Least Helpful award
23:46 -!- albech [~thomas@119.42.78.231] has joined #openvpn
23:48 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
--- Day changed Mon Feb 14 2011
00:04 -!- seekh [~IRC@188.49.241.131] has quit []
00:10 -!- Fthis [4a48a286@gateway/web/freenode/ip.74.72.162.134] has joined #openvpn
00:11 < Fthis> ecrist you still here?  i fixed it
00:13 < Fthis> it was an ESXi/linux problem.  the solution was to use older e1000 nic driver rather than the newer vmxnet3.  it was instantaneous.  some kind of bug
00:13 -!- Fthis [4a48a286@gateway/web/freenode/ip.74.72.162.134] has quit [Client Quit]
00:49 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:49 -!- mode/#openvpn [+o mattock] by ChanServ
01:03 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:08 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:19 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
01:43 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:21 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Connection reset by peer]
02:25 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
02:26 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
02:27 -!- stony is now known as Guest50975
02:32 <@vpnHelper> RSS Update - forum: openvpn_as on xen vps <http://forums.openvpn.net/topic7635.html#p9708>
02:38 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
02:38 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
02:38 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
02:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:54 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
03:42 -!- dazo_afk is now known as dazo
03:46 -!- Comradin [~marcus@marcus-franke.net] has left #openvpn []
04:00 -!- kaushal [~kaushal@182.72.14.170] has joined #openvpn
04:00 < kaushal> hi
04:00 < kaushal> is there a openvpn client for Fedora ?
04:02 < krzee> sure, it runs on most OS
04:05 < kaushal> ok
04:06 < kaushal> krzee: I mean rpm package or installed via yum package manager ?
04:14 -!- Dropje [~yge@5351300C.cm-6-2a.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
04:15 < Bushmills> the client is called "openvpn"
04:15 < Bushmills> as it happens, that's also the server
04:16 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
04:17 < kaushal> ok
04:18 < kaushal> Bushmills: so what i understand is run openvpn as a daemon mode in client config to connect to remote openvpn server ?
04:18 < Bushmills> right
04:19 < kaushal> ok
04:20 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
04:21 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:33 <@vpnHelper> RSS Update - forum: Possible to use a key token with OpenVPN? <http://forums.openvpn.net/topic7632.html#p9710> || Modifying Windows GUI <http://forums.openvpn.net/topic7629.html#p9709>
04:35 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:35 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:35 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:39 -!- maxJadi [~maxJadi@dhcp-166-10.nomad.chalmers.se] has joined #openvpn
04:39 -!- maxJadi [~maxJadi@dhcp-166-10.nomad.chalmers.se] has quit [Changing host]
04:39 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:10 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:10 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:10 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:23 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Remote host closed the connection]
05:26 -!- ucekpolish1 [user@hq.ostc-pl.com] has joined #openvpn
05:47 -!- kaushal [~kaushal@182.72.14.170] has quit [Quit: leaving]
06:10 -!- jacky_bro [~hk@64.250.115.43] has joined #openvpn
06:10 < jacky_bro> hi i got a problem with the certificate date and time setting
06:10 < jacky_bro> my system date is feb 14  but when i generate ca.crt , date is feb 15 
06:11 < WormFood> so, fix your system time
06:11 < jacky_bro> when the client join to server using that certificate , the error is invalid certi and check your system setting like that 
06:11 < WormFood> what time is it there?
06:11 < WormFood> is the server the same time?
06:11 < jacky_bro> in my client feb 14 6:40 PM
06:12 < jacky_bro> on server
06:12 < jacky_bro> Mon Feb 14 20:19:05 UTC 2011
06:12 < WormFood> so you're in central asia?
06:12 < WormFood> or, australia?
06:12 < jacky_bro> yea south east asia
06:12 < jacky_bro> and server is in us
06:12 < WormFood> your server is what OS?
06:12 < jacky_bro> centos , bbtw it's vps
06:12 < WormFood> no matter
06:13 < WormFood> and you're generating the certs on your local machine?
06:13 < hyper_ch> centos... iiiieeeks
06:13 < WormFood> yeah, ScentOS stinks
06:13 < WormFood> it takes a CENTury to update
06:13 < jacky_bro> i generate on centos for ca.crt 
06:13 < WormFood> and it can't worth a Cent ;)
06:13 < WormFood> I used to be forced to run CentOS.....couldn't wait to switch hosting companies
06:14 < WormFood> anyways....where are you generating your client certs
06:14 < jacky_bro> i dont' use cert for client
06:14 < WormFood> ok...I have the same thing...my server is in USA, and I'm in SE asia...and I have no problems
06:14 < jacky_bro> i use client-cert-not-required setting
06:14 < WormFood> I generate the client certs on my local machine
06:15 < jacky_bro> yea i have 2 vps ,  the first one is ok 
06:15 < WormFood> you have a timezone issue
06:15 < jacky_bro> when i check the ca.crt  in server  it's feb 14 
06:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:15 < jacky_bro> but i copy ca.crt to client machine , and it's feb 15 
06:16 < WormFood> sorry I need to go... girlfriend almost here...gotta pick her up at the bus stop
06:16 < WormFood> sorry
06:16 < jacky_bro> it's ok thank anyway
06:16 < WormFood> if you're still here when I get back (probably an hour or more), if you still need help, I'll try
06:16 < jacky_bro> thank you 
06:17 < jacky_bro> but when i change the date to feb 15 in client , i can connect
06:17 < jacky_bro> :D
06:17 < WormFood> client needs to use UTC time
06:17 < jacky_bro> woww
06:18 < WormFood> but that should be taken care of, so check your time zone in the client
06:18 < WormFood> can't think of anything else
06:18 < WormFood> 再见 bye
06:18  * WormFood walks out the door
06:18 < jacky_bro> bye
06:25 -!- takamichi [Takamichi@46.11.13.117] has quit [Ping timeout: 246 seconds]
06:26 -!- takamichi [~pri@83.170.109.106] has joined #openvpn
06:35 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
06:35 < dorp> !welcome
06:35 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:36 -!- takamichi [~pri@83.170.109.106] has quit [Ping timeout: 276 seconds]
06:36 < dorp> !goal
06:36 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:36 < dorp> !howto
06:36 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:37 < daemon> !goal I would like to make several several severs appear as if on on my lan
06:38 < Bushmills> "on my LAN" means what, ip addresses in same subnet, or ARP level traffic?
06:38 -!- takamichi [~pri@83.170.109.106] has joined #openvpn
06:39 < daemon> v4/v6 ip address on the same subnet 
06:40 < Bushmills> then a tun based config, one server, several clients, maybe client-to-client enabled, should do.  not sure about ipv6, though.
06:42 < daemon> ok dokey ta
06:42 < dorp> Hey, I've setup openvpn daemon on a remote (wan) linux environment. Now I'm connecting to it from a windows environment using the openvpn client. the icon says connected, log ends with: "Initialization Sequence Completed" ... but it seems that my traffic still routes through my 'old' (local) gateway? I've missed a step?
06:43 < Bushmills> !redirect
06:43 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
06:43 < Bushmills> !winroute
06:43 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
06:43 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
06:44 < dorp> Bushmills: thanks a lot, give me a few minutes to see where it takes me :)
06:44 < dorp> !def1
06:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
06:48 < dorp> (a side note, the previous 'howto' link is broken, it seems that this is the direct one: http://openvpn.net/index.php/open-source/documentation/howto.html )
06:48 <@vpnHelper> Title: HOWTO (at openvpn.net)
06:52 < dorp> (brb)
06:52 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
06:52 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
06:52 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
06:53 < Bushmills> http://openvpn.net/howto  that one?
06:53 < janjust> yeah that link seems broken
06:53 < Bushmills> appears to be a redirect to  http://openvpn.net/index.php/open-source/documentation/howto.html 
06:53 <@vpnHelper> Title: HOWTO (at openvpn.net)
06:54 < Bushmills> check your browser
06:54 < janjust> hehe it is working again now - just seconds ago I got a 404
06:56 -!- dorp [~dorp@195.210.186.130] has quit [Ping timeout: 240 seconds]
06:56 -!- k1rk [~kirk@96.44.188.116] has quit [Remote host closed the connection]
06:57 < janjust> jacky_bro:  does your date/timezone problem still exist?
06:58 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has quit [Ping timeout: 246 seconds]
06:58 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has joined #openvpn
06:58 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has quit [Changing host]
06:58 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has joined #openvpn
07:10 < krzee> !mirror
07:10 <@vpnHelper> "mirror" is http://openvpn.scarydevilmonastery.net for a mirror of the docs
07:10 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
07:11 < krzee> !howto
07:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:11 < krzee> !man
07:11 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
07:11 < janjust> !krzee
07:12 < janjust> hmmm no answer? time to create one :=]
07:12 < krzee> !learn mirror as http://www.secure-computing.net/openvpn/ for another
07:12 <@vpnHelper> Joo got it.
07:12 < krzee> theres one for !dazo
07:12 < janjust> kewl
07:12 < janjust> !dazo
07:12 <@vpnHelper> "dazo" is "eurephia" is http://www.eurephia.net/
07:12 < krzee> since i can never spell the plugin
07:12 < krzee> lol
07:12 < janjust> lol
07:15 < dorp> just making sure I understand correctly...  the flag --redirect-gateway may be replaced with the configure "push "redirect-gateway def1"" , and it belongs to the server-side, right?
07:16 < krzee> !push
07:16 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
07:16 < krzee> !def1
07:16 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
07:16 < janjust> dorp:  --redirect-gateway on the client is the same as a server 'push "redirect-gateway"'
07:16 < krzee> whether you push or not is just your preference
07:16 < janjust> but I'd recommend to alwaysw use 'def1'
07:16 < krzee> and whether or not you use def1 is also your preference, like janjust said normally people want to use def1
07:19 < janjust> cherwin?
07:19 < dorp> mmm....
07:21 -!- Guest50975 is now known as stony
07:21 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
07:21 < dorp> thanks guys, another attempt - brb
07:21 -!- dorp [~dorp@195.210.186.130] has left #openvpn []
07:23 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 246 seconds]
07:25 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:26 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
07:28 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has quit [Client Quit]
07:29 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
07:29 -!- winter [q3@unaffiliated/winter] has joined #openvpn
07:30 < winter> !tunortap
07:30 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
07:30 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
07:31 -!- winter [q3@unaffiliated/winter] has left #openvpn ["cya"]
07:34 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
07:35 < dorp> I'm still stuck :| - trying to route all traffic through the tunnel, added to the server's conf: push "redirect-gateway def1" , and now the client won't use the local gateway, but when trying to ping: 4.2.2.1 (IP) - no response
07:35 < Bushmills> !nat
07:35 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
07:36 < dorp> !linnat
07:36 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
07:36 < Bushmills> unless you have set up server to route requests to wlan interface, it has no reason to do so
07:36 < dorp> !openvzlnnat
07:36 < dorp> !openvzlinnat
07:36 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
07:38 < dorp> if my host is cotained (VE), it means that I only need to keep the PREROUTING, and remove the previous "POSTROUTING" I added?
07:39 < dorp> (so iptables -t nat -L show only PREROUTING?)
07:39 < dorp> (I'll try both ways, brb)
07:40 -!- dorp [~dorp@195.210.186.130] has quit [Quit: dorp]
07:43 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
07:44 < dorp> well guys - thanks a lot. I'm on the right track... now I may ping IPs, DNS is broken... I'll google a bit, I want to believe it's trivial
07:45 < dorp> push "dhcp-option DNS 10.8.0.1"  , found :)
07:45 < janjust> that works best for Windows clients 
07:45 < janjust> or if you use a 'pull-resolv' package on linux/bsd
07:46 < dorp> (brb)
07:46 < dorp> (I hope I'm not flooding you)
07:46 -!- dorp [~dorp@195.210.186.130] has quit [Client Quit]
07:54 -!- jmm [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has left #openvpn []
07:56 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
07:59 < dorp> welp, apparently it's not trivial for me :)... the howto says: "OpenVPN clients will route DNS queries through the VPN, and the VPN server will need handle them" , by handle, it means I must run a resolver at the openvpn's machine? (bind?)
07:59 < janjust> dorp: no that is not required; however the VPN server must be able to forward the DNS queries to a working DNS server
07:59 < janjust> e.g. to the DNS server specified on the openvpn server itself (e.g. check /etc/resolv.conf and copy the address)
08:00 < dorp> janjust: is there anything more that I should do, but "push "dhcp-option DNS 10.8.0.1"" ?
08:00 < janjust> you need to replace 10.8.0.1 with the IP address of the DNS server that you want to use
08:00 < dorp> oh
08:00 < janjust> check whatever is listed in /etc/resolv.conf on the OpenVZ server and use that
08:02 < dorp> I must use the one of /etc/resolv.conf? because I've tried the default too, that came with the conf "208.67.222.222" , and I get from nslookup: Can't find server name for address 208.67.222.222: Query refused
08:02 < janjust> just to get things straight: #1) you're connecting to an OpenVPN server with redirect-gateway def1 
08:03 < dorp> janjust: with push "redirect-gateway def1" , yes
08:03 < janjust> #2) you're pushing a dns server to the client using "push dhcp-option 208.67.222.222" or something similar
08:03 < janjust> before altering anything, try this first on the client (windows or linux):
08:03 < janjust> type 'nslookup'
08:03 < janjust> then at the next prompt, type
08:04 < janjust> 'server 208.67.222.222'
08:04 < dorp> (I may ping 208.67.222.222" , btw)
08:04 < janjust> then type 
08:04 < janjust> 'www.google.com' (or any other host)
08:04 < dorp> right now? (before the tunnel?)
08:04 < janjust> nope, after the tunnel is up
08:05 < dorp> janjust: one moment, brb
08:05 -!- dorp [~dorp@195.210.186.130] has quit [Quit: dorp]
08:07 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
08:07 < dorp> janjust: *** [208.67.222.222] can't find www.google.com: Query refused
08:07 < janjust> my guess is there is something wrong with your iptables setup 
08:07 < dorp> janjust: I forgot to mention, that I've failed to tunnel using UDP
08:08 < janjust> can you try the same query before the tunnel is up?  (I can query that DNS server from here just fine)
08:08 < dorp> (yes, before the tunnel it works fine - dig www.google.com @208.67.222.222)
08:09 < dorp> janjust: when I tried to use the tunnel over UDP - I got "TLS key negotiation failed to occur within 60 seconds"
08:09 < janjust> that's a firewalling issue on either the client or the server side
08:09 < janjust> could also be caused by a faulty router in between
08:10 < dorp> I'm using hotel's wifi :\
08:11 < janjust> that might very well explain why they're blocking UDP
08:11 < dorp> so I suppose my quest comes to an end? :/
08:12 < janjust> not necessarily ; it should still be possible to get a working openvpn tunnel
08:12 < janjust> but there's definitely something fishy about your openvz/iptables setup
08:12 < dorp> yes, the tunnel is working via TCP, it's the dns that doesn't
08:13 < janjust> err, are you sure? establish the tunnel, then try a 'ping 208.67.222.222' 
08:13 < dorp> if I could access another remote machine I could validate whether my openvpn server is at fault, but can't atm
08:13 < janjust> did that work? 
08:13 < dorp> janjust: I can ping it, yes (I mentioned it earlier)
08:13 < janjust> and what happens if you ping www.l.google.com (or rather, it's IP: 74.125.79.99) after the tunnel is up?
08:14 < dorp> I can't ping the host - I may ping the IP just fine (I managed to ping other IPs that I know of)
08:15 < janjust> then all you're looking at is a simple DNS issue , perhaps on the OpenVZ side; can you check if DNS is working on the openvz server
08:16 < dorp> now I see something unexpected, apparently that this machine runs a resolver by itself
08:17 < dorp> resolv.conf 127.0.0.1 ----- ps xauf|grep named ... exists
08:17 < janjust> the openvz box? if that is the case then use the VPN server IP as the DNS server
08:17 < dorp> janjust: I tried that the first time :| ... let me look at the response I got
08:18 < janjust> or, on the VPN client, after the tunnel is up, try this: dig www.google.com @<VPN server IP>
08:18 < dorp> wait, when you say "server ip" , you mean 10.8.0.1 ? or actual wan address?
08:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 272 seconds]
08:20 < dorp> (brb, tries)
08:20 -!- dorp [~dorp@195.210.186.130] has quit [Quit: dorp]
08:22 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
08:23 < dorp> janjust: I can ping the vpn's host. but dns says: Can't find server name for address 173.12.197.30: Query refused ... (ip been changed)
08:24 < janjust> what is your client OS?
08:25 -!- EugeneKaway is now known as EugeneKay
08:25 < dorp> janjust: windows xp pro sp3
08:25 -!- k1rk [~kirk@96.44.188.116] has joined #openvpn
08:25 < k1rk> !goal
08:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:26 < k1rk> My !goal is to be able to access the Internet through my VPN.  At present, I have the ability to ping the server's lan IP from my client.  How do I go about setting up the NAT?
08:26 < janjust> dorp: try running 'nslookup' on the win xp box, not 'dig'
08:26 < janjust> I just want to make sure it's not a weird 'dig' config
08:27 < janjust> !nat
08:27 < dorp> janjust: I been using nslookup till now
08:27 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
08:27 < dorp> "Query refused" is a message from nslookup
08:28 < dorp> (dig returned: Status: REFUSED)
08:29 < dorp> janjust: I guess I better yet drive to the next hotel and see if it's working from there, so I'll know who's at fault?
08:29 < janjust> dorp:  I've never seen the windows nslookup command return a 'dig returned: ' message
08:29 < dorp> lol
08:29 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:30 < dorp> janjust: I meant that the messages that I've pasted, "Can't find server name for address .... Query refused" belongs only to 'nslookup'
08:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:32 < janjust> sounds like the dns server on the openvz box is configured a bit too strict
08:33 < janjust> if also 'nslookup' , then 'server 208. blablah' , then 'www.google.com' does not work then the networking on the openvz box is too tight
08:33 < EugeneKay> Nothing like a VPS to ruin my day.
08:33 < janjust> hehe indeed, EugeneKay 
08:34  * EugeneKay clings to his VMware
08:34 < EugeneKay> It actually *is* a VM!
08:35 < dorp> but I've tried public resolvers such as 208.67.222.222 , it can still be the fault of the vps when it's a public resolver?
08:35 < janjust> if the vps is blocking outbound traffic it can, dorp
08:36 < dorp> janjust: even so it's working outside of the tunnel? :\ .. I may connect to resolver of the vps now (publically)
08:36 < EugeneKay> Firewall? :-p
08:36 < janjust> dorp, try this 'nslookup', then 'set d2', then 'server <VPN server IP>' , then 'www.google.com'
08:37 < dorp> janjust: from within the tunnel?
08:37 < janjust> yes from within the tunnel
08:37 < dorp> EugeneKay: on the client?
08:37 < EugeneKay> No, server.
08:38 < dorp> (brb)
08:38 -!- dorp [~dorp@195.210.186.130] has quit [Quit: dorp]
08:38 < janjust> hmmm just thought of another work-around: use 'push "redirect-gateway def1 bypass-dns" '
08:41 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
08:43 < dorp> janjust:  full paste: http://pastebin.com/ULem4tba
08:43 < dorp> (public IP been replaced)
08:46 < janjust> the DNS server is refusing queries alright... 
08:46 < janjust> just after you left I thought of a work-around
08:46 < dorp> janjust: but only via the tunnel it refuses
08:46 < janjust> try using 'push  "redirect-gateway def1 bypass-dns" ' on the server side
08:46 < dorp> bypass-dns? :
08:46 < janjust> this should set up the tunnel but leave a direct route to the DNS server
08:46 < dorp> let me read, one moment
08:47 < janjust> all traffic except DNS traffic will flow via the tunnel
08:48 < dorp> so now I should comment the 'push dhcp-option' ?
08:48 < dorp> (brb)
08:48 -!- dorp [~dorp@195.210.186.130] has quit [Quit: dorp]
08:51 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
08:51 < dorp> janjust: I'm about to cry... :\
08:52 < dorp> janjust: the bypass-dns works. I may resolve www.google.com , and I may ping www.google.com . but when I try: telnet www.google.com 80 .... "connect failed"
08:52 -!- k1rk [~kirk@96.44.188.116] has quit [Remote host closed the connection]
08:54 < janjust> you definitely have a strange routing issue - one more thing to try is to add 'tun-mtu 1200' to both client and server
08:54 < janjust> see if that helps
08:54 < janjust> small packets seem to get through, larger packets may not
08:55 < dorp> janjust: what about the issue of UDP? the only workaround there is to use TCP, right?
08:56 < janjust> that is correct, dorp
08:57 < dorp> (brb, trying tun-mtu on both client/server)
08:57 -!- dorp [~dorp@195.210.186.130] has quit [Quit: dorp]
08:58 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
08:59 < dorp> janjust: welp, I can't see any chance with tun-mtu :|
08:59 < dorp> any change*
09:00 < janjust> sorry about that, dorp... don't know what else to test . what does 'route print' show on the client after the tunnel is up? is the default route indeed via the openvpn server? what does 'tracert -d www.google.com' produce?
09:01 < dorp> you have nothing to be sorry about :) ... thank you very much for your help! ... let me activate the tunnel again, one moment please
09:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:02 -!- dorp [~dorp@195.210.186.130] has quit [Client Quit]
09:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
09:03 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
09:04 < dorp> janjust: traceroute shows only 1:  389 ms   425 ms   324 ms  74.125.232.19
09:04 < dorp> janjust: makes sense?
09:07 < janjust> dorp: that does not make much sense; I would have expected many hops in between
09:09 < dorp> janjust: pastebin of route: http://pastebin.com/4WvCXiKJ
09:20 < janjust> OK I've seen the route output - that looks perfectly OK
09:20 < janjust> but the 'tracert -d' does not make sense
09:21 -!- janjust [~janjust@openvpn/community/support/janjust] has left #openvpn ["Leaving"]
09:21 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
09:33 < dorp> janjust: well mate, thanks once again. I suppose all that's left... is to check from another hotel and to find out whether it's the client's or the server's fault
09:35 -!- grapsus [~grapsus@acces1206.res.insa-lyon.fr] has joined #openvpn
09:38 < janjust> that would be my suggestion as well, dorp... my bet is that there is something funny going on with your vpn server, not the hotel, actually
09:38 -!- luneff [~yury@84.51.197.93] has joined #openvpn
09:39 < dorp> janjust: I was wondering, if I'm connecting to a remote machine via remote-desktop or alike.. and then try to route the traffic via the tunnel, I'm going to be blocked out? or already-existing connection will be kept alive with the original route?
09:40 < dorp> (my question makes sense?)
09:40 < janjust> in 99% of the cases your remote-desktop session will be killed
09:41 < dorp> mmm... so it's a serious risk
09:42 < dorp> I guess I can set a timer, for a restart within ~10 minutes or so... so I'll be able to gain access again
09:43 < janjust> < out
09:43 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
09:48 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
09:52 < dorp> Great news! ... my remote machine experience the same problem as well... so now let's replace the server
10:00 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:16 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
10:28 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:42 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
10:42 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 240 seconds]
10:43 -!- EugeneKay is now known as EugeneKaway
10:45 -!- EugeneKaway is now known as EugeneKay
10:55 -!- dorp [~dorp@195.210.186.130] has quit [Ping timeout: 264 seconds]
10:57 -!- albech [~thomas@119.42.78.231] has quit [Quit: Ex-Chat]
10:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:00 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
12:19 -!- nooba [~maul@54032BD2.catv.pool.telekom.hu] has joined #openvpn
12:21 < nooba> hi, I'm not good at this networking stuff, so my question may sound stupid: if I set up an openvpn access from my laptop or cell phone towards my home network that's always active, will it work even when I'm actually home and reaching the internet through the same network?
12:27 < Bushmills> as long as client can connect to the openvpn server, which ip address (or hostname) you have specified in the client config file, yes 
12:28 < nooba> will the client realize that I'm home and it doesn't have to go through the openvpn server to reach the other computers?
12:28 < Bushmills> only if you set it up to be aware of that
12:29 < nooba> ok, thanks
12:29 < nooba> guess I'll come back if there are any complications
12:29 < reiffert> :)
12:29 < Bushmills> is that a threat?
12:29 < nooba> definetely
12:30 -!- takamichi [~pri@83.170.109.106] has quit [Ping timeout: 276 seconds]
12:30 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
12:32 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
12:33 -!- nooba [~maul@54032BD2.catv.pool.telekom.hu] has quit [Quit: leaving]
12:42 -!- dazo is now known as dazo_afk
12:47 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 240 seconds]
12:48 -!- diphthong [~diphthong@69.172.135.243] has quit [Quit: leaving]
12:52 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
12:54 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
13:03 -!- wdconnors [~wdconnors@ip24-250-132-32.ga.at.cox.net] has joined #openvpn
13:03 -!- wdconnors [~wdconnors@ip24-250-132-32.ga.at.cox.net] has quit [Client Quit]
13:08 -!- wdconnors [18fa8420@gateway/web/freenode/ip.24.250.132.32] has joined #openvpn
13:15 -!- wdconnors [18fa8420@gateway/web/freenode/ip.24.250.132.32] has left #openvpn []
13:25 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
13:25 < majuk_> !donate
13:25 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel., or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc., or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
13:25 < majuk_> SERIOUSLY. I'm doing this now
13:32 < majuk_> Done. Go getchoor dollars!
13:35 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Quit: Lost terminal]
13:36 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
13:37 < majuk_> gladiatr, I want to see pictures of the sausage and beer!
13:39 -!- s7r [~s7r@82.76.237.104] has joined #openvpn
13:41 < Essobi> ....
13:41 < Essobi> That is by far a strange message to hear out of context.
13:43 < majuk_> Pervert. :P
13:44 < majuk_> I donated money. gladiatr said he was going to party on it.
13:44 < majuk_> SO.
13:44 < majuk_> Beef and brew.
13:44 < majuk_> It's actually a fringe gay thing.
13:44 < majuk_> Don't tell his wife.
13:46 < EugeneKay> Well, unless she's into that sort of thing
13:47 < majuk_> Oh, no, she is. I'm saying, don't ruin the Valentines surprise.
13:48 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:03 < ecrist> http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations
14:03 <@vpnHelper> Title: OpenVPN/Donations - Secure Computing Wiki (at www.secure-computing.net)
14:06 < ecrist> majuk_: thanks for the donation
14:12 < majuk_> ecrist, rgr
14:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:40 -!- JyZyXEL [~lol@a88-113-58-11.elisa-laajakaista.fi] has quit [Ping timeout: 276 seconds]
14:42 -!- JyZyXEL [~lol@a88-115-37-73.elisa-laajakaista.fi] has joined #openvpn
15:22 -!- s7r [~s7r@82.76.237.104] has left #openvpn []
15:24 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
15:29 -!- bba [~bba@93.1.40.113] has quit [Ping timeout: 260 seconds]
15:46 -!- onkel [onkel@gateway/shell/shellium.org/x-mscarcrgimqyouze] has joined #openvpn
15:47 < onkel> Hia guys! Q: Is there any problem running openvpn under Windows 7? I'm trying to attach a new computer to my friend's network, but I myself have no Windows 7 to try. Thx.
15:49 < EugeneKay> OpenVPN GUI thingy works fine on my laptop as a client.
15:49 < EugeneKay> Never tried it as a server, and I never would use Windows as a server OS.
15:50 < onkel> EugeneKay: Thanks. Client is OK. We have Linux servers only.
15:50 < EugeneKay> I've also only tried the TUN driver, but ostensibly TAP works well if you're using it(again, I wouldn't)
15:51 < onkel> Well, we use TAP driver in the network, because we need bridging.
15:53 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:53 < EugeneKay> You don't "need" it, you just don't have routing setup correctly :-p
16:13 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
16:27 -!- HoboSteaux [HoboSteaux@nat/wsulug/x-ltqmlliavogkigsn] has left #openvpn []
17:07 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:09 -!- grapsus [~grapsus@acces1206.res.insa-lyon.fr] has quit [Quit: Quitte]
17:12 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
17:12 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
17:13 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 255 seconds]
17:46 -!- bba [~bba@93.1.40.113] has joined #openvpn
17:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 272 seconds]
19:08 -!- zeshoem [~mnathani@bas1-toronto46-1177856456.dsl.bell.ca] has quit []
19:41 -!- jacky_bro [~hk@64.250.115.43] has quit [Ping timeout: 265 seconds]
19:58 -!- jacky_bro [~hk@64.250.115.43] has joined #openvpn
20:00 -!- jfkw [~jtk@216.115.6.82] has quit [Quit: leaving]
20:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
20:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
20:29 < ecrist> sup d00ds?
20:38 -!- theDoc [~Link@110.92.102.28] has quit [Ping timeout: 250 seconds]
20:45 -!- jacky_bro [~hk@64.250.115.43] has quit [Remote host closed the connection]
21:01 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
21:05 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 260 seconds]
21:07 -!- master_of_master [~master_of@p57B53A62.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
21:09 -!- master_of_master [~master_of@p57B53538.dip.t-dialin.net] has joined #openvpn
21:16 -!- k4k [~K4k@c-24-30-28-67.hsd1.ga.comcast.net] has joined #openvpn
21:16 < k4k> How can you pass an alternate server.conf file to openvpn upon startup when running it as a daemon? I know you can just type "openvpn alternate/server.conf" and start it but I would rather it run in the background
21:17 < k4k> I have placed server.conf in /etc/openvpn/ however startup is pulling something other than my server.conf file because it only allows me to connect when I specifically run "openvpn /etc/openvpn/server.conf"
21:45 -!- trelane` [~trelane@funtoo/staff/trelane] has joined #openvpn
21:47 -!- trelane [~trelane@funtoo/staff/trelane] has quit [Ping timeout: 276 seconds]
21:53 -!- trelane` is now known as trelane
22:01 -!- trelane` [~trelane@66.93.203.199] has joined #openvpn
22:01 -!- trelane` [~trelane@66.93.203.199] has quit [Changing host]
22:01 -!- trelane` [~trelane@funtoo/staff/trelane] has joined #openvpn
22:03 -!- trelane [~trelane@funtoo/staff/trelane] has quit [Ping timeout: 240 seconds]
22:04 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
22:22 -!- kaushal [~kaushal@182.72.14.170] has joined #openvpn
22:22 < kaushal> hi
22:25 < kaushal> can someone please explain me about http://pastebin.ubuntu.com/567203/ ?
22:27 < kaushal> specially line 7 and 8
22:29 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:29 < trelane`> the first identifies the local and remote end of the tunnel, and the second adds a route into the far side's table
22:29 < trelane`> err near side's
22:29 < trelane`> sorry
22:37 < kaushal> ok
22:37 < kaushal> trelane`: near side meaning local ?
22:38 < trelane`> right
22:38 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
22:38 < kaushal> ok
22:38 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
22:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:39 < kaushal> so if you look at the pastebin again
22:39 < kaushal> so that route would be in SM location ?
22:39 < kaushal> I mean the first commented line
23:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
23:03 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
23:06 < dorp> I was wondering if anybody is experienced with openvz based difficulties? I been trying 2 different openvz providers, and my tunnel is still 'weird', I'll elaborate: I would like to tunnel all my traffic through the vps (openvpn server)
23:09 < dorp> I've stumbled few walls, first of all - I can't use UDP - only tcp. Then I can't push a DNS server, even if I'm trying to use the resolver of the vps - it fails. nslookup says: "Query refused"
23:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 272 seconds]
23:09 < dorp> Only one time I managed to make DNS 'work' by using bypass-dhcp, and then I couldn't telnet anything. (even so I could ping www.google.com , but telnet www.google.com 80 - won't connect)
23:09 < dorp> (my client is windows xp pro sp3)
23:17 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
23:17 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
23:17 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
23:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:21 -!- EugeneKay is now known as EugeneKaway
23:22 -!- EugeneKaway is now known as EugeneKay
23:23 -!- noisebleed_ [~quassel@lula.inescn.pt] has joined #openvpn
23:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
23:24 -!- CrazySpai [~CrazySpai@2607:f358:1:fed5:22:0:c07a:b798] has joined #openvpn
23:24 < CrazySpai> !welcome
23:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:25 < CrazySpai> !howto
23:25 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
--- Day changed Tue Feb 15 2011
00:05 -!- cherwin_ [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
00:07 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Ping timeout: 276 seconds]
00:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:17 -!- bba [~bba@93.1.40.113] has quit [Quit: Leaving...]
00:21 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 245 seconds]
00:40 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
00:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:48 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:48 -!- mode/#openvpn [+o mattock] by ChanServ
01:01 <@vpnHelper> RSS Update - forum: Routing help for OpenVPN server behind NAT <http://forums.openvpn.net/topic7634.html#p9711>
01:11 -!- WinstonSmith [~true@dslb-088-073-121-169.pools.arcor-ip.net] has joined #openvpn
01:11 -!- WinstonSmith [~true@dslb-088-073-121-169.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
01:12 -!- bba [~bba@212.51.174.146] has joined #openvpn
01:17 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:43 <@vpnHelper> RSS Update - forum: How to route through a VPN server for a single remote web? <http://forums.openvpn.net/topic7636.html>
01:51 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:12 -!- cherwin_ [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Remote host closed the connection]
02:12 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
02:46 -!- dazo_afk is now known as dazo
03:06 -!- Dropje [~yge@5351300C.cm-6-2a.dynamic.ziggo.nl] has joined #openvpn
03:13 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
03:15 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
03:19 -!- kaushal [~kaushal@182.72.14.170] has quit [Quit: leaving]
03:36 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
03:45 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
04:04 -!- SOG [~SOG@183.11.157.48] has joined #openvpn
04:14 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:37 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 276 seconds]
04:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
04:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:53 -!- SOG [~SOG@183.11.157.48] has quit [Quit: SOG]
04:56 -!- raomin [~romain@86.66.22.65] has quit [Quit: leaving...]
05:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:05 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:05 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:05 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:08 <@vpnHelper> RSS Update - forum: How to route through a VPN server for a single remote web? <http://forums.openvpn.net/topic7636.html#p9713>
05:27 -!- WormFood [~wormfood@121.34.196.43] has quit [Ping timeout: 240 seconds]
05:33 -!- dorp [~dorp@195.210.186.130] has quit [Ping timeout: 240 seconds]
05:40 -!- WormFood [~wormfood@183.15.97.125] has joined #openvpn
05:51 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
06:04 -!- bba [~bba@212.51.174.146] has quit [Ping timeout: 240 seconds]
06:31 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
06:31 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has joined #openvpn
06:32 -!- mode/#openvpn [+o raidz] by ChanServ
06:32 -!- caesay [~caesay@unvanquished/associate/sniperx] has quit [Read error: Operation timed out]
06:32 -!- caesay [~caesay@173.236.15.70] has joined #openvpn
06:32 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Read error: Operation timed out]
06:33 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
06:33 -!- caesay is now known as Guest49839
06:44 -!- xindz`off is now known as xindz
07:04 -!- bba [~bba@212.51.174.146] has joined #openvpn
07:25 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:26 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:41 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
08:24 -!- s7r [~s7r@82.77.117.70] has joined #openvpn
08:26 <@vpnHelper> RSS Update - forum: Cygwin setup network adapter <http://forums.openvpn.net/topic7637.html>
08:27 < s7r> what is IP masquarade?
08:28 < gladiatr> !nat
08:28 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
08:28 < s7r> IP masquarade is the same with NAT
08:28 < s7r> i basically know what not is and what does
08:29 < janjust> masquerading is a special form of NATting , that's all
08:29 < gladiatr> there's a difference? lol
08:29 < janjust> NATting usually translates a fixed source or destination address to another address (SNAT or DNAT)
08:30 < janjust> masquerading allows you to "hide" traffic by making it all appear to come from another adapter
08:30 < gladiatr> Ah.  I always made that distinction as "one-to-one" or "one-to-many" nat
08:30 < janjust> hehe gladiatr , that's also a good way of putting it
08:31 < janjust> snat/dnat is one to one natting, masquerading is one-to-many natting
08:32 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
08:33 -!- xxtjaxx [~andreas@kde/developer/marschke] has joined #openvpn
08:33 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
08:34 < s7r> thanks
08:34 < s7r> so masquarading is not just NAT
08:34 < s7r> you can make it appeart that is comming from another adapter
08:35 < janjust> from another adapter is not the right wording; you can make it appear from another IP address
08:36 < xxtjaxx> Whats more suitable to set a different resolver push `"route-up echo 'nameserver $SOME_DNS_IP'> /etc/resolv.conf"` or rather push "up  echo 'nameserver $SOME_DNS_IP'> /etc/resolv.conf" or something completely different? Speaking only of a pure linux/unix env though
08:40 < gladiatr> Interesting.  Is it even legal to push up scripts from the server?
08:40 < gladiatr> (I've just never tried it)
08:40 < janjust> xxtjaxx:  it'd be must better to install the 'pull-resolv-conf' plugin or to use the appropriate network manager plugins
08:41 < janjust> then use 'push "dhcp-option DNS <IP>"' on the server to push out the DNS IP
08:41 < janjust> gladiatr:  nope, that is not allowd AFAIK 
08:42 < janjust> it also wouldn't scale: the server does not know the OS of the client connecting , so how can it push the right script?
08:42 < janjust> what if you push a linux script to a Windows host or vice versa
08:42 < xxtjaxx> janjust: that plugin is to be installed on the server not the client right? 
08:43 < gladiatr> Anyway, that would kinda piss me off if a vpn connection started mucking with the contents of my /etc dir without my knowledge :)
08:43 < gladiatr> xxtjaxx, nope.  Client-side
08:43 < xxtjaxx> janjust: as mentioned this is a linux/unix environment purely
08:43 < xxtjaxx> doh..
08:43 < janjust> same here, gladiatr 
08:43 < gladiatr> xxtjaxx, just distribute the scripts with your client configs and certs and such
08:44 < janjust> I read that xxtjaxx , but pushing up/route-up scripts does not know that *you* only have a linux/unix env
08:45 < xxtjaxx> that'd mean I would distribute scripts/certs to strangers.
08:46 < xxtjaxx> anyway. goodpoint. anybody know if they are part of the openvpn-client packages in  Debian?= 
08:47 < gladiatr> checking...
08:48 < gladiatr> looks like it comes with its own little scripty called update-resolv-conf.  
08:48 < xxtjaxx> ah.
09:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 272 seconds]
09:08 -!- sfwerwfw [~ubuntu@ec2-184-73-249-219.compute-1.amazonaws.com] has joined #openvpn
09:08 < sfwerwfw> !welcome
09:08 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:09 < sfwerwfw> !goal
09:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:09 < ecrist> sfwerwfw gets a gold star for today
09:10  * gladiatr cheers
09:11 < sfwerwfw> !logs
09:11 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
09:11 < sfwerwfw> !config
09:11 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
09:11 < sfwerwfw> !configs
09:11 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
09:12 < sfwerwfw> !topology
09:12 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
09:12 < sfwerwfw> !man
09:12 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
09:17 < ecrist> !factoids
09:17 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
09:17 < ecrist> sfwerwfw: ^^^^ the whole list is right there, if i'ts faster for you. ;)
09:19 < sfwerwfw> thanks
09:21 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:45 < EugeneKay> !vend
09:45 < EugeneKay> Worth a shot.
09:48 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:49 < ecrist> heh
09:49 < ecrist> !beer
09:49 < sfwerwfw> !vend
09:49 <@vpnHelper> "beer" is its what's for dinner!
09:51 < gladiatr> excellent
09:54 < EugeneKay> http://itvends.com
09:54 <@vpnHelper> Title: It Vends! (at itvends.com)
09:55 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
09:55 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
09:55 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
09:59 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:59 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:07 <@vpnHelper> RSS Update - forum: Updating only specific users default routes <http://forums.openvpn.net/topic7638.html>
10:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
10:17 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:19 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
10:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
10:38 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Remote host closed the connection]
10:40 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
10:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
10:53 -!- Kurogane [~kuro@190.87.89.47] has joined #openvpn
10:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:02 -!- bba [~bba@212.51.174.146] has quit [Quit: Leaving...]
11:31 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
11:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:42 < Essobi> laaaanmaaaaaaaan
11:43 < Essobi> Muhahaha, you can nevar hide!
11:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 272 seconds]
11:55 -!- areq_ [~areq@q.areq.eu.org] has joined #openvpn
11:56 -!- Netsplit *.net <-> *.split quits: EugeneKay, EmperorT1m, rkantos_, cron2, Cain, mete, aef, onkel, areq, JyZyXEL,  (+28 more, use /NETSPLIT to show all of them)
11:57 -!- Netsplit *.net <-> *.split quits: Dougy, WebDawg, Nappy, renihs, Agin, sfwerwfw, cj
11:59 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
11:59 -!- ivenkys [~ivenkys@81.168.100.197] has joined #openvpn
12:00 -!- Netsplit over, joins: openbsdnoob
12:00 -!- Dougy_ [me@tech.qsi.net] has joined #openvpn
12:01 -!- mete [~metefr@84.200.12.194] has joined #openvpn
12:01 -!- Dropje [~yge@5351300C.cm-6-2a.dynamic.ziggo.nl] has joined #openvpn
12:02 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Remote host closed the connection]
12:02 < Essobi> :\
12:03 -!- Ramblurr [~rmblr@quassel.jefferai.org] has joined #openvpn
12:04 -!- fahadsadah_ [fahad@equal.cluenet.org] has joined #openvpn
12:05 -!- alhadi [~thunderst@92.99.203.225] has joined #openvpn
12:05 -!- rkantos_ [robin@84.239.137.74] has joined #openvpn
12:05 -!- WIthout [Quota@175.139.16.178] has joined #openvpn
12:05 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has joined #openvpn
12:05 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
12:05 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
12:05 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
12:06 -!- Acrono [~kuro@190.87.89.47] has joined #openvpn
12:06 -!- sfwerwfw [~ubuntu@ec2-184-73-249-219.compute-1.amazonaws.com] has joined #openvpn
12:06 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
12:06 -!- renihs [~lemming@83.65.34.34] has joined #openvpn
12:06 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
12:06 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
12:06 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
12:06 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
12:06 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
12:06 -!- EmperorT1m [~EmperorTo@216.17.68.153] has joined #openvpn
12:06 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
12:06 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
12:06 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
12:06 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
12:06 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
12:07 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
12:08 < gladiatr> rude...
12:08 < gladiatr> the interwebs must serve...
12:10 -!- toortog [nesm6@notsecure.net] has joined #openvpn
12:10 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:10 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:10 -!- optiz0r [~optiz0r@miranda.sihnon.net] has joined #openvpn
12:10 -!- cj [~cjac@adsl-207-32-175-232.rockisland.net] has joined #openvpn
12:10 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
12:10 -!- bba [~bba@93.1.40.113] has joined #openvpn
12:10 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has joined #openvpn
12:10 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
12:10 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
12:10 -!- JyZyXEL [~lol@a88-115-37-73.elisa-laajakaista.fi] has joined #openvpn
12:10 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
12:10 -!- Netsplit *.net <-> *.split quits: toortog, Cain, MadTBone, sigius, optiz0r, cj
12:10 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
12:12 -!- roentgen [~arthur@2001:4d18:3:1:ffff:ffff:ffff:1] has joined #openvpn
12:14 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
12:18 -!- dazo is now known as dazo_afk
12:19 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
12:19 < hyper_ch> hi ecrist
12:22 -!- trelane` [~trelane@funtoo/staff/trelane] has quit [Read error: Connection reset by peer]
12:23 -!- Netsplit over, joins: toortog, sigius, optiz0r, MadTBone
12:23 -!- trelane` [~trelane@66.93.203.199] has joined #openvpn
12:23 -!- mode/#openvpn [+o cron2] by ChanServ
12:23 -!- trelane` [~trelane@66.93.203.199] has quit [Changing host]
12:23 -!- trelane` [~trelane@funtoo/staff/trelane] has joined #openvpn
12:24 -!- Cain is now known as Guest60326
12:24 < ecrist> hi hyper_ch 
12:25 < hyper_ch> ecrist: you're good with zip and rar?
12:26 -!- toortog [nesm6@notsecure.net] has quit [Quit: changing servers]
12:26 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 265 seconds]
12:26 -!- toortog [nesm6@notsecure.net] has joined #openvpn
12:26 -!- [intra]lanman is now known as Guest42536
12:27 < ecrist> hyper_ch: not sure what that means, but I'm capable of decompressing and compressing file sets.
12:28 < hyper_ch> ecrist: well, rar has a "-hp" and zip has a "-e" option for setting a password. which one is better?
12:30 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 240 seconds]
12:31 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:32 -!- toortog [nesm6@notsecure.net] has quit [Read error: Connection reset by peer]
12:33 -!- toortog [~toortog@notsecure.net] has joined #openvpn
12:33 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Max SendQ exceeded]
12:34 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:36 < ecrist> heh, imho encrypting or password protecting a zip file is silly
12:38 < hyper_ch> it's not for me
12:38 < hyper_ch> it's for some windows users to feel safe
12:38 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Max SendQ exceeded]
12:39 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:39 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has quit [Quit: leaving]
12:39 -!- Guest42536 [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Quit: Leaving]
12:39 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
12:39 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
12:39 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
12:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:39 -!- trelane` [~trelane@funtoo/staff/trelane] has quit [Read error: Connection reset by peer]
12:40 -!- trelane` [~trelane@66.93.203.199] has joined #openvpn
12:40 -!- trelane` [~trelane@66.93.203.199] has quit [Changing host]
12:40 -!- trelane` [~trelane@funtoo/staff/trelane] has joined #openvpn
12:41 -!- cj_ [~cjac@adsl-207-32-175-232.rockisland.net] has joined #openvpn
12:41 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Max SendQ exceeded]
12:41 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
12:42 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:43 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:45 < ecrist> hyper_ch: imho it doesn't really matter.
12:46 < hyper_ch> :)
12:46 < hyper_ch> I'm just gonna make a performance check with rar, zip, 7zip, xz
12:50 -!- s7r [~s7r@82.77.117.70] has left #openvpn []
12:50 -!- gladiatr is now known as gladiatr_afk
12:53 -!- cj_ [~cjac@adsl-207-32-175-232.rockisland.net] has quit [Ping timeout: 255 seconds]
12:54 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Remote host closed the connection]
12:54 -!- Netsplit *.net <-> *.split quits: optiz0r, toortog, MadTBone
12:55 -!- Netsplit over, joins: MadTBone, optiz0r
12:55 -!- Netsplit *.net <-> *.split quits: sigius
12:55 -!- Netsplit over, joins: sigius
13:01 -!- trelane` is now known as trelane
13:03 -!- jfkw_ [~jtk@216.115.6.82] has joined #openvpn
13:03 -!- jfkw [~jtk@216.115.6.82] has quit [Read error: No route to host]
13:07 -!- mant1s [mant1s@141.114.214.191] has joined #openvpn
13:07 -!- mant1s [mant1s@141.114.214.191] has quit [Changing host]
13:07 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
13:13 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:18 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
13:20 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
13:20 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
13:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:21 -!- grapsus [~grapsus@acces1206.res.insa-lyon.fr] has joined #openvpn
13:30 -!- Acrono [~kuro@190.87.89.47] has quit [Read error: Connection reset by peer]
13:32 -!- Kurogane [~kuro@190.87.89.47] has joined #openvpn
13:55 -!- wdconnors [~wdconnors@ip24-250-132-32.ga.at.cox.net] has joined #openvpn
13:56 < majuk__> Can anyone tell me if a 'source foo.txt' include in my hosts file will parse out the hosts contained in foo.txt?
13:57 < majuk__> Apparently it will not. Pootiddles.
13:57 < secretary_linux> majuk__: you could try something like this - http://unlettered.org/2009/05/13/managing-multiple-etchosts-files-in-mac-os-x/ -- seems over complicated to me though
13:57 <@vpnHelper> Title: Managing multiple /etc/hosts files in Mac OS X « The Unlettered Gentleman (at unlettered.org)
13:58 < secretary_linux> oh, I wasn't looking at the channel and just assumed you meant /etc/hosts and not something else
13:58 < majuk__> Yea, I did.
13:59 < majuk__> I just have a bunch of subnets on my VPN and wanted to chunk up the host assignments to make it easier to manage.
13:59 < majuk__> Looks like I might just have to do it through DHCP and set MAC/IP assignments.
14:00 -!- wdconnors [~wdconnors@ip24-250-132-32.ga.at.cox.net] has quit [Ping timeout: 276 seconds]
14:01 < majuk__> Buh, which is not good because our servers all have the same hostnames. :| Someone slap my IT Director for me.
14:02 < ecrist> yeah, all ours are called server.example.com
14:02 < ecrist> I think we missed a dilogue in the gooey
14:02 < majuk__> lol
14:03 < majuk__> Yuuuuhhhh. Silly networking.
14:03 < majuk__> Silly system administration.,
14:09 < secretary_linux> majuk__: you could always try DNS :)
14:14 < majuk__> secretary_linux, Yea, that's what I'm doing now. Just wanted to do it the 'easy' way immediately.
14:15 < majuk__> But no dice, SO!
14:20 -!- Guest60326 [~Geek@41.141.252.98] has quit [Quit: Sayaunara ^_^]
14:21 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
14:21 -!- Guest60326 [~Geek@unaffiliated/cain] has joined #openvpn
14:22 -!- Guest60326 is now known as Cain
14:22 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
14:22 -!- |Mike|_ [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
14:23 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
14:23 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Disconnected by services]
14:23 -!- Fiouz_ [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
14:23 -!- gladiatr_ [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
14:23 -!- buntfalke_ [~nobody@openvpn-p0-127.triple-a.uni-kl.de] has joined #openvpn
14:23 -!- buntfalke_ [~nobody@openvpn-p0-127.triple-a.uni-kl.de] has quit [Changing host]
14:23 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:24 -!- noogenesis [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
14:24 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
14:24 -!- Essobi_ [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
14:24 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:25 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Disconnected by services]
14:25 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
14:25 -!- xinaFtpircS [vincent@hanaman.riquer.fr] has joined #openvpn
14:26 -!- dvl- [~dvl@nyi.unixathome.org] has joined #openvpn
14:27 -!- Netsplit *.net <-> *.split quits: ivenkys, derekv, WormFood, kloeri, dvl, Essobi, nb, roentgen, bauruine, CrazySpai,  (+8 more, use /NETSPLIT to show all of them)
14:27 -!- kloeri_ is now known as kloeri
14:27 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
14:28 -!- Netsplit over, joins: WormFood
14:29 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
14:29 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 240 seconds]
14:30 -!- Dropje [~yge@5351300C.cm-6-2a.dynamic.ziggo.nl] has joined #openvpn
14:30 -!- gladiatr_ is now known as gladiatr
14:30 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
14:30 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
14:32 -!- nb [~nb@fedora/nb] has joined #openvpn
14:36 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
14:37 < majuk__> Oh monkey junk. I have to use a tap interface for DHCP. Crap on a crap cracker.
14:38 -!- noisebleed_ [~quassel@lula.inescn.pt] has quit [Ping timeout: 255 seconds]
14:41 -!- dvl- is now known as dvl
14:42 -!- dvl [~dvl@nyi.unixathome.org] has quit [Changing host]
14:42 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
14:48 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
14:52 < majuk__> So, I notice that openvpn keeps track of virtual IPs associated with VPN unique names in ipp.txt
14:52 < majuk__> Are those associations lost on the clients?
14:53 < majuk__> That would be super handy if I could use those to resolve some hosts.
15:02 < krzee> !ipp
15:02 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
15:03 < majuk__> I don't care about the IP assignment, I want DNS resolution.
15:03 < krzee> [12:53]  <majuk__> That would be super handy if I could use those to resolve some hosts.
15:04 < majuk__> Right. Resolve hosts via those unique names.
15:15 -!- raidzxx [~Andrew@seance.openvpn.org] has joined #openvpn
15:16 -!- crazed [~crazed@unaffiliated/cr4z3d] has joined #openvpn
15:16 -!- CrazySpai [~CrazySpai@2607:f358:1:fed5:22:0:c07a:b798] has joined #openvpn
15:19 -!- onkel [onkel@gateway/shell/shellium.org/x-ywzhewnutsjxdgln] has joined #openvpn
15:20 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
15:21 -!- gladiatr is now known as gladiatr_afk
15:22 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has joined #openvpn
15:22 < Lars_G> Hi all.
15:23 < Lars_G> Question if OpenVPN is not in the router/firewall on my location I'll have to make a static route either on the router to openvpn's network via it's lan address right? or even share the static route if I can via dhcp
15:25 -!- Netsplit *.net <-> *.split quits: raidzx, Nappy, WebDawg, WormFood, sfwerwfw, renihs, Agin
15:25 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Connection reset by peer]
15:30 <@vpnHelper> RSS Update - forum: out of cpu power: how to retard cuncurrent connections? <http://forums.openvpn.net/topic7639.html>
15:31 -!- WormFood [~wormfood@183.15.97.125] has joined #openvpn
15:32 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
15:32 -!- sfwerwfw [~ubuntu@ec2-184-73-249-219.compute-1.amazonaws.com] has joined #openvpn
15:32 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
15:33 -!- xindz is now known as xindz`off
15:33 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
15:34 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
15:43 -!- bob368 [~bob@166.205.8.180] has joined #openvpn
15:44 < majuk__> So is it typical to have individual VPN servers at various sites which then join a central VPN to contain broadcasts and simplify things like, oh I don't know, DNS resolution?
15:45 < majuk__> Then you just need to manage routes on the central VPN.
15:46 < majuk__> And the endpoint VPN servers, I suppose.
15:46 < majuk__> Ugh, I've been up for 36 hours, someone just shoot me.
15:47 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
15:47 -!- stony is now known as Guest11678
15:47 < majuk__> Oh, no, that won't work either. I am teh dubm.
15:52 -!- Guest11678 [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Connection reset by peer]
15:53 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
15:58 <@vpnHelper> RSS Update - forum: Updating only specific users default routes <http://forums.openvpn.net/topic7638.html#p9717>
16:02 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
16:03 <@vpnHelper> RSS Update - forum: out of cpu power: how to retard cuncurrent connections? <http://forums.openvpn.net/topic7639.html#p9718>
16:05 -!- raidzxx is now known as raidz
16:05 -!- raidz [~Andrew@seance.openvpn.org] has quit [Changing host]
16:05 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has joined #openvpn
16:08 -!- bob368 [~bob@166.205.8.180] has quit [Ping timeout: 255 seconds]
16:11 -!- jimcooncat [~jim@pool-71-173-85-153.ptldme.east.myfairpoint.net] has joined #openvpn
16:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:14 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
16:19 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has quit [Quit: leaving]
16:26 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
16:26 -!- mode/#openvpn [+o patelx] by ChanServ
16:30 <@vpnHelper> RSS Update - forum: out of cpu power: how to retard cuncurrent connections? <http://forums.openvpn.net/topic7639.html#p9719>
16:33 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Connection reset by peer]
16:34 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has joined #openvpn
16:34 -!- janjust [~janjust@s5596c956.adsl.wanadoo.nl] has quit [Changing host]
16:34 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
16:35 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 276 seconds]
16:37 -!- bauruine_ is now known as bauruine
16:44 -!- jimcooncat [~jim@pool-71-173-85-153.ptldme.east.myfairpoint.net] has left #openvpn ["Ex-Chat"]
16:59 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
17:16 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
17:17 -!- Kurogane [~kuro@190.87.89.47] has quit [Ping timeout: 264 seconds]
17:35 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
17:36 -!- stony is now known as Guest47010
17:39 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Quit: Távozom]
17:39 <@vpnHelper> RSS Update - forum: Howto route just the trafic for the other location <http://forums.openvpn.net/topic7640.html>
17:48 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Ping timeout: 272 seconds]
17:49 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
17:59 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
18:01 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
18:06 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:08 < dorp> I was wondering if anybody is experienced with openvz based difficulties? I been trying 2 different openvz providers, and my tunnel is still 'weird' - I use redirect-gateway def1 , and when I try to telnet to an IP of a remote host, it can't connect. (while ping works fine)
18:09 -!- |Mike|_ [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Quit: Reconnecting]
18:09 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
18:10 < |Mike|> define "weird"
18:10 < |Mike|> and please, read the topic Dougy_ 
18:10 < |Mike|> erm, dorp 
18:10 < dorp> |Mike|: I thought I just did, I can ping an IP - but can't telnet it
18:10 < |Mike|> then, read the topic
18:10 < |Mike|> || Your problem is your firewall, really. ||  <-- 
18:11 < dorp> |Mike|: unfortunately I've read the topic, and the documentation. couple of days ago a member wasted hours to try to diagnose the issue, but he estimated it's openvz related
18:12 < dorp> |Mike|: do you have a suggestion of what kind of firewall behavior/rule might cause said behavior?
18:25 < |Mike|> you might want to contact your dom0 administrator for this issue.
18:25 < ecrist> !openvz
18:25 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
18:29 -!- Dougy_ is now known as Dougy
18:29 -!- Dougy [me@tech.qsi.net] has quit [Changing host]
18:29 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
18:30 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
18:30 < dorp> when I think of it, there is one thing that I do differently - I compile the latest stable, (and the latest beta) from source. is it possible that it causes said issue?
18:31 < djgerm> hi, if I've lost my ca.key passphrase, but I need to revoke some keys, can I just move the keys I want to revoke?
18:31 < dorp> because other than that I do everything at described by said guide, and the howto guidelines
18:31 < djgerm> or chmod 000 them
18:33 < djgerm> hi, if I've lost my ca.key passphrase, but I need to revoke some keys, can I just move the keys I want to revoke?
18:33 < krzee> no
18:33 < krzee> !crl
18:33 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
18:33 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
18:33 < krzee> you MUST sign the CRL with the ca.key
18:33 < krzee> so no, you are screwed and must rebuild your pki fro scratch
18:34 < djgerm> oh.
18:34 < djgerm> good to know!
18:34 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 276 seconds]
18:35 < krzee> dorp, no
18:35 < krzee> if you can ping over the vpn, the vpn is not your problem
18:35 < krzee> either the service doesnt listen to the vpn ip, or your firewall isnt configured right
18:36 < ecrist> heh
18:36 < dorp> krzee: when you say "service doesn't listen" , how can I validate it?
18:36 < djgerm> netstat -an
18:36 < ecrist> nmap
18:36 < ecrist> netsat -an
18:36 < ecrist> sockstat
18:36 < ecrist> lsof
18:36 < krzee> sockstat is bsd only
18:36 < krzee> i <3 sockstat
18:37 < dorp> I don't understand, which service doesn't listen? openvpn?
18:37 < ecrist> lsof -i TCP -i UDP
18:37 < krzee> telnet
18:37 < krzee> [16:35]  <krzee> if you can ping over the vpn, the vpn is not your problem
18:37 < ecrist> krzee: that lsof command gives you similar output, but nothing can beat sockstat imho
18:37 < ecrist> s/sockstat/freebsd/
18:38 < krzee> lsof is real strong
18:39 < |Mike|> oi ecrist and mister kr
18:39 < |Mike|> zee
18:39 < ecrist> hey, |Mike| 
18:39 < krzee> oi oi oi
18:39 < dorp> well guys, I've tried 2 different clients, and 2 different vps providers, anything else I might try?
18:39 < |Mike|> long time no see :-)
18:39 < krzee> i go to australia next monday
18:40 < |Mike|> other side of the world for me krzee :d
18:40 < krzee> yep
18:40 < krzee> but you said oi, which makes me think of AUSSIE AUSSIE AUSSIE    OI OI OI
18:40 < |Mike|> i'm an aussie fan ( aussie asin australian shepherd)
18:42 < |Mike|> going on holidays @ aussie land krzee ?
18:43 < EugeneKay> krzee - I can get you a deal on kangaroo rentals
18:43 < |Mike|> car supplier w/o brakes? :P
18:44 < |Mike|> (j/k)
18:45 < krzee> lol EugeneKay 
18:45 < krzee> yep |Mike| 
18:45 < |Mike|> for how long sir?
18:45 < EugeneKay> As long as I have people's attention, I spose I should re-ask the question that brought me (back) in here..... 3(?) days ago.
18:45 < krzee> sure EugeneKay 
18:46 < EugeneKay> OpenVPN. IPv6. Preferably routed. Possible, or insanity?
18:46 < krzee> |Mike|, like 3 weeks
18:46 < krzee> !ipv6
18:46 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
18:46 < EugeneKay> I want a /human/ answer.
18:46 < EugeneKay> Patch + recompile sounds closer to "insanity"
18:46 < krzee> read how the patch works at link #1
18:46 < krzee> and use !snapshots for a release with the patch in it
18:47 < EugeneKay> !snapshots
18:47 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
18:47 < krzee> and please report your findings
18:47 < EugeneKay> FWIW, that link is broken - trailing comma buggers it
18:47 < ecrist> works for me
18:47 < |Mike|> for xchat clients yeah
18:47 < EugeneKay> And those look like tarballs...... definitely insanity.
18:47 < ecrist> fix your url parser. ;)
18:48 < ecrist> what's wrong with a tarball?
18:48 < dorp> another issue: tracert IP  -- returns after -1- hop (within the tunnel)
18:48 < ecrist> what ip are you tracing?
18:48 < EugeneKay> I stick with CentOS/Fedora because I happen to like having everything update with "yum"
18:48 < krzee> EugeneKay, sounds like its too insane for you then
18:48 < ecrist> EugeneKay: you won'at get devel snapshots that way
18:49 < dorp> ecrist: google's IP for example, 74.125.232.18
18:49  * EugeneKay twiddles thumbs patiently, then
18:49 < krzee> in fact, imho fwanting RPMs is insane ;]
18:49 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:49 < |Mike|> make your own rpm's or debs!
18:49 < ecrist> switch to freebsd, the snapshots are current in the freebsd ports tree
18:49 < EugeneKay> Eh. There are reasons for Debian, reasons for Red Hat, reasons for FreeBSD.
18:49 < EugeneKay> I was raised on Red Hat, I stick with Red Hat.
18:50 < |Mike|> eek, the cat.
18:50 < ecrist> well, honestly, you're barking up the wrong pity tree.
18:50 < |Mike|> os/distro hatered ==> #2,000
18:50 < EugeneKay> I know. I can live withotu IPv6. The infrastructure I would be deploying it on isn't even bought yet.
18:50 < EugeneKay> And the colo facility doesn't have IPv6 - it would all be over Hurricane Electric tunnels anyway.
18:51 < |Mike|> reliable setup?
18:51 < EugeneKay> 6in4 tunnels? As long as you config them to start at boot, they work fine, says my testing.
18:51 < ecrist> I use HE tunnels, works fine
18:52 < |Mike|> also in production environments?
18:52 < ecrist> we're hoping to have our own AS by end of month, though, so we'll get rid of that.
18:52 < ecrist> |Mike|: yes, in production
18:52 < krzee> thats fine, also ipv6 would flow over tap just fine
18:52 < krzee> since tap is layer2
18:52 < krzee> but --server-ipv6 does exist if installing from source isnt too hard for you ;)
18:52 < ecrist> 50% of reason we're using tap atm
18:53 < EugeneKay> Once I get the new stuff up and running with routed IPv4, I may try fiddling with TAP as part of my IPv6 rollout test.
18:54 < EugeneKay> But that is at least 2 months out.
18:54 < |Mike|> only 2 months?
18:55 < EugeneKay> I'm a 2-man shop.
18:56 < EugeneKay>  Also, if I read the docs right, TAP won't play well with my DSL line
18:56 < krzee> should be fine
18:58  * EugeneKay shrugs
18:58 < EugeneKay> I'll worry about it next quarter.
18:58  * EugeneKay sticks around to harass krzee 
18:59 < krzee> ;]
19:00 -!- leejohn [~loloski@124.106.204.189] has joined #openvpn
19:01 < ecrist> lol
19:01 < ecrist> krzee: !donate
19:01 < leejohn> good day guys, what ip address should i supply for ifconfig on roadwarrior style vpn
19:01 < ecrist> 10.8.0.0/24 is fine, usually.
19:01 < ecrist> !1918
19:01 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, adn 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html
19:01 < leejohn> 10.8.0.0 255.255.255.0 ?
19:02 < ecrist> leejohn: yes
19:02 < ecrist> though, myself, I usually go with something in the 172.16/12 for VPNs as homes use ranges in the 192.168/16 and corporate networks use the 10/8
19:04 < leejohn> ecrist, i just want to clarify something do i have to align that ip address to the subnet where the server internal is located
19:04 < leejohn> ?
19:04 < ecrist> no, but if you don't, you'll need to make sure it's routable
19:04 -!- dorp [~dorp@195.210.186.130] has quit [Quit: dorp]
19:18 -!- Zyclops [~Adium@59.111.18.162] has joined #openvpn
19:18 < Zyclops> hey 
19:18 < leejohn> ecrist, thanks! i got it now, what i did was to assign a different subnet to the target lan as per your instruction so 10.8.0.1 and .2 is just like a PTP device
19:18 < Zyclops> does openvpn keep a log of all the websites you visit?
19:18 < Zyclops> if so where is it
19:18 < leejohn> Zyclops, you have to use squid for that matter
19:19 < Zyclops> ahh cool
19:19 < Zyclops> so that's a no?
19:19 < leejohn> Zyclops, yes
19:19 < leejohn> Zyclops, you have to use a proxy server in order to monitor the site
19:19 < Zyclops> thats good, our entire company runs behind openvpn
19:20 < Zyclops> bit of a privacy issue since everyone has access to the vpn server computer .. so just wanted to check it wasn't logging everything
19:22 < diphthong> someone could be logging all dns requests
19:35 -!- bburhans_ [~bburhans@unvanquished/developer/bpb] has joined #openvpn
19:35 -!- bburhans [~bburhans@unvanquished/developer/bpb] has quit [Remote host closed the connection]
19:41 -!- luneff [~yury@84.51.197.93] has joined #openvpn
20:03 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
20:10 -!- rawDawg [~rawdawg@cpe-76-190-219-231.neo.res.rr.com] has joined #openvpn
20:14 < EugeneKay> OpenVPN by itself does not do logging of that sort. There are a range of other ways to keep tabs upon at-work pr0n watching, though.
20:16 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Ping timeout: 250 seconds]
20:16 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
20:18 -!- bburhans_ is now known as bburhans
20:19 -!- SOG [~SOG@113.118.51.171] has joined #openvpn
20:22 -!- jfkw_ [~jtk@216.115.6.82] has quit [Quit: leaving]
20:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:35 -!- CrazySpai [~CrazySpai@2607:f358:1:fed5:22:0:c07a:b798] has quit [Quit: Leaving]
20:50 -!- Guest49839 is now known as caesay
20:50 -!- caesay [~caesay@173.236.15.70] has quit [Changing host]
20:50 -!- caesay [~caesay@unvanquished/associate/sniperx] has joined #openvpn
20:52 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
21:07 -!- master_of_master [~master_of@p57B53538.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
21:09 -!- master_of_master [~master_of@p57B5366F.dip.t-dialin.net] has joined #openvpn
21:24 -!- leejohn [~loloski@124.106.204.189] has quit [Ping timeout: 260 seconds]
21:41 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 272 seconds]
21:43 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:43 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:43 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:46 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
21:58 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has joined #openvpn
22:02 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
22:02 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:06 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has quit [Ping timeout: 240 seconds]
22:16 -!- Zyclops [~Adium@59.111.18.162] has left #openvpn []
22:21 -!- noogenesis is now known as derekv
22:35 -!- leejohn [~loloski@124.106.204.189] has joined #openvpn
22:45 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
22:55 -!- zeshoem [~mnathani@bas1-toronto46-1177856283.dsl.bell.ca] has joined #openvpn
22:57 -!- rawDawg [~rawdawg@cpe-76-190-219-231.neo.res.rr.com] has quit [Ping timeout: 276 seconds]
23:01 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:04 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
23:04 < SJrX> Hmmmm
23:05 < SJrX> Trying to get OpenVPN setup on a router, but keep getting:  TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
23:05 < SJrX> I've checked with tcpdump
23:05 < SJrX> the client keeps spamming the server with UDP packets
23:05 < SJrX> and there is no response
23:05 < SJrX> then all of a sudden it will respond again
23:05 < SJrX> with the first part of the handshake
23:06 < SJrX> I do get the verifies
23:25 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
23:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
--- Day changed Wed Feb 16 2011
00:08 -!- zamba [marius@flage.org] has quit [Ping timeout: 272 seconds]
00:09 -!- zamba [marius@flage.org] has joined #openvpn
00:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
00:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
01:00 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
01:00 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
01:00 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
01:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:05 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
01:47 -!- xinaFtpircS is now known as ScriptFanix
02:04 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
02:07 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:24 -!- dorp [~dorp@173.0.50.133] has joined #openvpn
02:24 < dorp> !openvzlinnat
02:24 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
02:25 < dorp> guys, this one didn't work for me - this one did: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <IP>
02:26 -!- bburhans [~bburhans@unvanquished/developer/bpb] has left #openvpn []
02:26 < dorp> (somebody can please teach the bot?)
02:27 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
02:27 -!- luneff [~yury@84.51.197.93] has joined #openvpn
02:30 < EugeneKay> Alternatively, "Don't use OpenVZ"
02:34 -!- bba [~bba@212.51.174.146] has joined #openvpn
02:35 -!- EugeneKay is now known as eugenekaway
02:40 -!- toortog [nesm6@notsecure.net] has joined #openvpn
02:42 -!- cj [~cjac@adsl-207-32-175-232.rockisland.net] has joined #openvpn
02:43 < dorp> eugenekaway: You're very helpful
02:45 -!- raomin [~romain@86.66.22.65] has joined #openvpn
02:48 < raomin> Hi all. I have a little problem with one roadwarrior, maybe you could help : On windows, the first connexion is ok, then he stops the service (through gui) and go into standby. After resuming, he restart the openvpn service (through GUI also), the tunnel is up the route also but NO DNS is set despite the correct logs and correct dhcp options... Any idea ?
02:48 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
02:49 < raomin> ... to be precise : the only DNS set is the one of his ISP.
02:50 < dorp> raomin: most likely I can't help you, but if you'll pastebin the result of "nslookup www.google.com" before, and after - then maybe others will be able to
02:51 < raomin> I have no access to the computer... but I can see on my FW logs that he's trying to access to an ISP DNS.
02:51 < raomin> and only this. Not the one configured on openvpn serv
02:52 < raomin> What's strange is that the first connexion is OK...
02:52 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
02:52 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
02:52 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
03:14 -!- dorp [~dorp@173.0.50.133] has quit [Ping timeout: 240 seconds]
03:16 -!- dazo_afk is now known as dazo
03:40 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:45 -!- zamba [marius@flage.org] has quit [Ping timeout: 276 seconds]
04:04 -!- Bushmills [~l@scarydevilmonastery.net] has left #openvpn []
04:04 -!- Bushmills [~l@scarydevilmonastery.net] has joined #openvpn
04:07 -!- leejohn [~loloski@124.106.204.189] has quit [Remote host closed the connection]
04:08 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:08 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:23 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has quit [Read error: Operation timed out]
04:23 -!- dorp [~dorp@173.0.50.133] has joined #openvpn
04:24 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
05:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:26 -!- maxJadi [~maxJadi@dhcp-164-195.nomad.chalmers.se] has joined #openvpn
05:26 -!- maxJadi [~maxJadi@dhcp-164-195.nomad.chalmers.se] has quit [Changing host]
05:26 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:38 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
05:44 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
05:44 -!- mode/#openvpn [+o mattock] by ChanServ
05:48 -!- bba [~bba@212.51.174.146] has quit [Remote host closed the connection]
05:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:07 -!- albech [~thomas@124.157.245.126] has joined #openvpn
06:22 -!- SOG [~SOG@113.118.51.171] has quit [Quit: SOG]
06:49 -!- k1rk [~kirk@96.44.188.116] has joined #openvpn
06:58 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 276 seconds]
07:01 -!- bba [~bba@212.51.174.146] has joined #openvpn
07:03 -!- Coffe [~niszsse@sto.alatest.se] has joined #openvpn
07:03 < Coffe> Hi getting my logfile flooded with  Bad LZO decompression header byte: 0
07:16 < krzee> make sure your comp-lzo settings are = on both sides
07:18 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has left #openvpn []
07:19 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
07:25 -!- Guest60326 [~Geek@unaffiliated/cain] has joined #openvpn
07:25 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
07:26 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:26 -!- Guest60326 is now known as Cain
07:33 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
07:37 -!- nickio [~nick@78-86-120-249.zone2.bethere.co.uk] has quit [Read error: Connection reset by peer]
07:37 -!- nickio [~nick@78-86-120-249.zone2.bethere.co.uk] has joined #openvpn
07:46 -!- SOG_ [~SOG@222.125.196.155] has joined #openvpn
07:46 -!- eugenekaway is now known as EugeneKay
07:47 < EugeneKay> dorp - it is a valid solution >_>
07:52 -!- SOG_ [~SOG@222.125.196.155] has quit [Quit: I will be back!]
07:53 < dorp> EugeneKay: Sure, It would've been a valid answer to your question last night - wonders what kind of reaction would you give for such a helpful suggestion
07:53 < EugeneKay> dorp - what, to IPv6 Y/N? That was exactly the question I asked :-p
07:55 -!- Guest60326 [~Geek@unaffiliated/cain] has joined #openvpn
07:57 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:57 -!- Guest60326 is now known as Cain
08:14 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
08:14 < Fleck> !factoids help
08:14 < Fleck> !search
08:14 < Fleck> how was it ;D ?
08:14 < Fleck> !goal
08:14 -!- zxd [~zxd@95.211.21.37] has quit [Ping timeout: 276 seconds]
08:19 < ecrist> the bot is offline right now.
08:19 < ecrist> :(
08:20 < ecrist> my home network is in a service outage, where the bot is housed.
08:20 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
08:22 < Fleck> ohh
08:22 < Fleck> i have question
08:22 < Fleck> can i bridge using TUN ?
08:22 < Fleck> or maybe - can i do net to net and peer to net on the same box?
08:24 < ecrist> you can bridge any interface, but I don't think it'll actually do anything useful with tun adapter
08:24 < EugeneKay> "bridge using TUN"
08:25 < Fleck> bot had info about preshared key auth
08:26 < dorp> ecrist: hey, do you happen to have access to the bot?
08:26 < ecrist> not easy access, but yes, I do.
08:26 < dorp> !openvzlinnat
08:27 < dorp> ^^ didn't work in 2 VEs I've tried, but this one did: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <IP>
08:27 -!- gladiatr_afk is now known as gladiatr
08:32 < Fleck> ecrist whats the best encryption to use for slow pc ?
08:32 < ecrist> no idea.
08:32 < Fleck> :)
08:39 -!- p3rror [~mezgani@41.248.109.91] has joined #openvpn
08:50 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:50 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:50 <@vpnHelper> RSS Update - forum: PCI Cmpliance? <http://forums.openvpn.net/topic7641.html#p9722>
08:52 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
08:52 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:52 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:53 < ecrist> welcome back vpnhelper
08:54 -!- lteo [~lteo@lteo-1-pt.tunnel.tserv3.fmt2.ipv6.he.net] has left #openvpn []
08:57 -!- rasengan [~rasengan@unaffiliated/rasengan] has joined #openvpn
08:57 < EugeneKay> !vend
08:57 < rasengan> Hi, I have a semi problem..  has anyone seen this error and know what to do Wed Feb 16 22:46:45 2011 There is a problem in your selection of --ifconfig endpoints [local=10.4.10.10, remote=255.255.255.0].  The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver.  Try 'openvpn --show-valid-subnets' option for more info.
08:57 < EugeneKay> Bot is clearly defective
08:58 < rasengan> o.o;
08:58 < rasengan> !welcome
08:58 < rasengan> !goal
08:58 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:58 < rasengan> goal: i would like to connect to openvpn
08:59 < rasengan> problem: that error listed above
08:59 < rasengan> help: i was wondering if anyone has seen or heard of thi issue and know any steps i could take or could point me in the direction of the good
08:59 -!- p3rror [~mezgani@41.248.109.91] has quit [Read error: Connection reset by peer]
09:00 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
09:00 < ecrist> !howto
09:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:00 < ecrist> rasengan: see that
09:00 < ecrist> or !man
09:02 <@vpnHelper> RSS Update - forum: Howto route just the trafic for the other location <http://forums.openvpn.net/topic7640.html#p9724> || PCI Cmpliance? <http://forums.openvpn.net/topic7641.html#p9723>
09:04 < rasengan> ?
09:04 < rasengan> ecrist oh yes i have already deployed openvpn :)
09:04 < rasengan> right now there is just this problem that i have pasted above.
09:04 < rasengan> ;/
09:05 < ecrist> rasengan: that problem describes itself.
09:05 < ecrist> it tells you what the problem is, if you read it
09:08 < rasengan> ecrist: The thing is, this was working but 24 hours ago.
09:08 < rasengan> ecrist: o_o;
09:08 < ecrist> no, it wasn't
09:08 < ecrist> you changed something
09:08 < ecrist> openvpn doesn't magically stop working.
09:08 < rasengan> ecrist: Oh
09:13 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:14 <@vpnHelper> RSS Update - forum: PCI Cmpliance? <http://forums.openvpn.net/topic7641.html#p9725>
09:14 -!- p3rror [~mezgani@41.140.178.85] has joined #openvpn
09:16 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has joined #openvpn
09:18 < rasengan> thanks ecrist
09:18 < rasengan> you were right
09:19 < ecrist> :)
09:19 < ecrist> I have that tendency
09:26 < rasengan> heh ;o
09:26 <@vpnHelper> RSS Update - forum: PCI Cmpliance? <http://forums.openvpn.net/topic7641.html#p9726>
09:26 < rasengan> i feel like darth vader
09:26 < rasengan> telling look skywalker - u were right u were right
09:26 < rasengan> ;o
09:32 <@vpnHelper> RSS Update - forum: random drops with openvpn over http proxy <http://forums.openvpn.net/topic7642.html>
09:32 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
09:32 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
09:32 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
09:33 -!- zxd [~zxd@95.211.21.37] has quit [Ping timeout: 276 seconds]
09:34 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
09:35 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Client Quit]
09:35 -!- azizLIGHTS [~azizLIGHT@ec2-50-17-254-25.compute-1.amazonaws.com] has joined #openvpn
09:36 < azizLIGHTS> is it normal that you stay connected via ssh when you connect/disconnect openvpn (the ssh server is the openvpn server also)
09:37 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
09:37 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
09:37 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
09:38 < ecrist> azizLIGHTS: yes/no
09:38 < ecrist> ssh won't drop the connection unless there's an actual interruption in the flow of data
09:38 < ecrist> if you're tailing a log file or something, it'll usually drop the session when openvpn goes down, but if you're at an idle terminal, you won't lose your session
09:39 -!- livevilfr [~livevilfr@45.108.100-84.rev.gaoland.net] has joined #openvpn
09:40 < azizLIGHTS> im staring at a screen session that shows current time with seconds
09:41 < azizLIGHTS> it does not seem to get interrupted
09:41 < azizLIGHTS> (in the ssh)
09:41 -!- zxd [~zxd@95.211.21.37] has quit [Ping timeout: 250 seconds]
09:41 < janjust> ecrist, azizLIGHTS : is this a problem when using SSH over OpenVPN? 
09:41 < azizLIGHTS> im not sure, im just wondering if its intended
09:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
09:42 < azizLIGHTS> seems convenient
09:42 < azizLIGHTS> but is a risk or no?
09:42 < ecrist> no it's not
09:42 < ecrist> because as soon as you try to pass traffic, it's going to fail.
09:43 < ecrist> it just appears as though the connection is still live
09:43 < janjust> it's not a risk; the reason I asked is because a colleague of mine often has problems when running ssh over an OpenVPN tunnel
09:43 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
09:47 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:50 -!- zxd [~zxd@95.211.21.37] has quit [Read error: Operation timed out]
09:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:54 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
09:54 -!- rolls` [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
09:54 -!- rolls` [~rollin@190.120.228.48] has joined #openvpn
09:55 -!- bluethundr [~bluethund@ip-160-79-209-130.rev.intellispace.net] has joined #openvpn
09:59 -!- dorp [~dorp@173.0.50.133] has quit [Ping timeout: 276 seconds]
10:00 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
10:03 -!- zxd [~zxd@95.211.21.37] has quit [Ping timeout: 240 seconds]
10:07 -!- k1rk [~kirk@96.44.188.116] has quit [Remote host closed the connection]
10:10 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:15 < bluethundr> hello openvpn! I am attempting to setup a simple simon static key connection in a test lab
10:15 < bluethundr> I can test the config no problem
10:16 < bluethundr> but if I do a ping test from the client to the server and vice versa the ping times out
10:16 < bluethundr> http://pastie.org/1571142
10:16 < bluethundr> may I have an opinion on this issue? thx in advance
10:16 -!- zxd [~zxd@213.108.249.197] has joined #openvpn
10:17 -!- mant1s [mant1s@141.114.212.251] has joined #openvpn
10:17 -!- mant1s [mant1s@141.114.212.251] has quit [Changing host]
10:17 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
10:17 -!- marksaitis [~MK@82.144.242.158] has joined #openvpn
10:18 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:33 < Coffe> bluethundr,  any firewall ?
10:34 < bluethundr> Coffe, iptables
10:34 < bluethundr> I've unblocked the port 1194 udp on the server
10:34 < Coffe> maby are blocking it ?
10:34 -!- zxd [~zxd@213.108.249.197] has quit [Ping timeout: 255 seconds]
10:35 < Coffe> can you ping local ip ?
10:36 < bluethundr> this is the line in iptables that I added to open up the port
10:36 < bluethundr> [root@mimi:~] $ grep 1194 /etc/sysconfig/iptables -A INPUT -m state --state NEW -m udp -p udp --dport 1194 -j ACCEPT
10:36 < bluethundr> Coffe, let me check
10:37 < bluethundr> yes I can ping the local address
10:38 -!- zxd [~zxd@213.108.249.197] has joined #openvpn
10:39 < bluethundr> this is what I get if I do an ifconfig on the server
10:39 < bluethundr> http://pastie.org/1571255
10:42 < havoc> you guys have a handy link for why not to use bridging?
10:43 < bluethundr> hmm getting a different error this time
10:43 < bluethundr> http://pastie.org/1571266
10:43 -!- bba [~bba@212.51.174.146] has quit [Quit: Leaving...]
10:43 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has quit [Quit: Leaving.]
10:46 -!- bba [~bba@212.51.174.146] has joined #openvpn
10:47 < jpalmer> !bridge
10:47 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc, or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ, or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
10:47 -!- zxd [~zxd@213.108.249.197] has quit [Ping timeout: 240 seconds]
10:48 < havoc> jpalmer: thanks, those are the ones I found
10:50 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
10:50 < bluethundr> jpalmer, have you had a chance to look at the pastes I've provided? :)
10:51 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 276 seconds]
10:51 -!- eeble|work [~andy@wsip-70-169-162-125.dc.dc.cox.net] has joined #openvpn
10:51 < jpalmer> bluethundr: I just sat down,  so no..  and I'm getting ready to un to a meeting in 10 mins.  sorry
10:51 < eeble|work> Hi, I'm trying to run ipv6 over openvpn, and it works just fine so long as I use a TAP adapter.  Unfortunately, if I bridge the tap adapter on the client side, the br0 interface never picks up the route advertizements from radvd
10:51 < eeble|work> usually I do: start openvpn tunnel, bring up tap0, done.
10:52 < eeble|work>  with the bridge, I did: start openvpn, add tap0 to br0, bring up tap0 (ifconfig tap0 0.0.0.0 up promisc), bridge doesn't pick up an address from radvd
10:52 < bluethundr> jpalmer, ok no problem 
10:52 < eeble|work> it's probably something small that I'm forgetting, but I'm at a loss
10:52 < eeble|work> (without the bridge client-side, the tap0 adapter does stateless autoconfiguration)
10:52 < jpalmer> eeble|work: it's typically considered rude, to cross-post between multiple channels.
10:54 -!- Coffe [~niszsse@sto.alatest.se] has quit [Quit: Leaving]
10:56 < bluethundr> here is the route -n from the openvpn server http://pastie.org/1571308
10:57 < eeble|work> jpalmer, sorry, I figured it might be one or the other. good point though
10:57 -!- bba [~bba@212.51.174.146] has quit [Quit: Leaving...]
11:00 < bluethundr> this is an nmap of the server.. it looks like the port isn't open but the service is started and running and the port was opened on teh iptables of the server
11:00 < bluethundr> http://pastie.org/1571326
11:01 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
11:02 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
11:02 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
11:07 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has joined #openvpn
11:08 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
11:09 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
11:11 -!- marksaitis [~MK@82.144.242.158] has quit [Ping timeout: 276 seconds]
11:22 -!- p3rror [~mezgani@41.140.178.85] has quit [Ping timeout: 240 seconds]
11:26 < bluethundr> hmm I think I may need to add a static route to the client
11:33 < bluethundr> it seems that tho I have dev defined in the config on the the client side the interface is not turning up in an ifconfig
11:33 < bluethundr> http://pastie.org/1571452
11:35 -!- p3rror [~mezgani@41.140.182.166] has joined #openvpn
11:39 -!- eeble|work [~andy@wsip-70-169-162-125.dc.dc.cox.net] has quit [Remote host closed the connection]
11:46 -!- livevilfr [~livevilfr@45.108.100-84.rev.gaoland.net] has quit [Ping timeout: 246 seconds]
11:51 -!- alhadi [~thunderst@92.99.203.225] has quit [Quit: alhadi]
11:55 -!- Guest47010 is now known as stony
11:58 -!- bba [~bba@93.1.40.113] has joined #openvpn
11:59 -!- s7r [~s7r@ACBE7DA1.ipt.aol.com] has joined #openvpn
12:00 -!- SJrX is now known as SJr
12:03 < bluethundr> hey guys still having issues with openvpn
12:03 < bluethundr> http://pastie.org/1571556
12:04 < bluethundr> I can ping the tun address on each host but I can't ping any remote hosts with openvpn running
12:10 -!- mezgani_ [~mezgani@41.140.38.244] has joined #openvpn
12:11 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:11 -!- p3rror [~mezgani@41.140.182.166] has quit [Ping timeout: 240 seconds]
12:15 -!- noogenesis [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
12:16 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has quit [Ping timeout: 255 seconds]
12:25 -!- marksaitis [~MK@82.144.242.158] has joined #openvpn
12:26 -!- livevilfr [~livevilfr@49.105.100-84.rev.gaoland.net] has joined #openvpn
12:34 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
12:37 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
12:40 -!- Ramblurr [~rmblr@quassel.jefferai.org] has quit [Remote host closed the connection]
12:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Max SendQ exceeded]
12:42 -!- noogenesis [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has quit [Ping timeout: 246 seconds]
12:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:42 -!- Ramblurr [~rmblr@quassel.jefferai.org] has joined #openvpn
12:42 -!- Ramblurr [~rmblr@quassel.jefferai.org] has quit [Changing host]
12:42 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
12:42 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
12:47 < bluethundr> no further thoughts, fellas?
12:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:48 < bluethundr> ahhh...maybe the firewall on the client?
12:50 -!- dazo is now known as dazo_afk
12:50 <@vpnHelper> RSS Update - forum: YANQ (Yet another newb question) <http://forums.openvpn.net/topic7643.html>
12:55 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:57 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
12:57 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
12:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
13:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
13:09 -!- nickio [~nick@78-86-120-249.zone2.bethere.co.uk] has quit [Read error: Connection reset by peer]
13:10 -!- nickio [~nick@78-86-120-249.zone2.bethere.co.uk] has joined #openvpn
13:17 -!- areq_ [~areq@q.areq.eu.org] has quit [Changing host]
13:17 -!- areq_ [~areq@pld-linux/areq] has joined #openvpn
13:23 < marksaitis> If my certificate and DH files are in easy-rsa/keys folder, how do I specify their location in my *.ovpn config file? Is it possible to specify partial path?
13:23 < marksaitis> any openvpn experts here?
13:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:28 < ecrist> put the path in the config
13:29 < marksaitis> ecrist, full path?
13:29 < marksaitis> can I not use relative path?
13:29 < ecrist> yes
13:29 < ecrist> it needs to be relative to the config file
13:29 < marksaitis> I see!
13:30 < marksaitis> what slashes does it accept? \ or / ?
13:30 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
13:30 -!- bba [~bba@93.1.40.113] has joined #openvpn
13:30 < marksaitis> does that look good? ca ..\easy-rsa\keys\ca.crt
13:30 < ecrist> marksaitis: what ever is appropriate for your OS
13:31 < ecrist> in windows, you need to escape your backslashes, though
13:31 < marksaitis> ecrist ok, its win :)
13:31 -!- rasengan [~rasengan@unaffiliated/rasengan] has left #openvpn []
13:31 < ecrist> so c:\\program~1\\foobeans\\path
13:32 < marksaitis> ecrist, well yeah i got an error again saying i need double backslashes
13:32 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Operation timed out]
13:33 < ecrist> like my example.
13:34 < marksaitis> ecrist, how about a relative path
13:34 < marksaitis> ?
13:34 < marksaitis> from the config file?
13:34 < marksaitis> I just tried it but with no luck again
13:34 < ecrist> use full path
13:35 < marksaitis> ecrist, so relative paths are not supported? Can I use path in quotes? Like "C:\\program files\\"?
13:35 < marksaitis> with spaces in it
13:37 < ecrist> yes
13:37 < marksaitis> ecrist, good, thank you :) I will try that then. So as i understood relative path is unsuported on windows
13:39 < ecrist> it's generally a good idea to use full path
13:41 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
13:41 < marksaitis> and so I did: dh ""C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\dh1024.pem"
13:42 < marksaitis> Wed Feb 16 19:34:58 2011 Cannot open  for DH parameters: error:02001012:system library:fopen:Improper link: error:2006D002:BIO routines:BIO_new_file:system lib
13:42 < marksaitis> I tripple check it, the dh file is really there :)
13:43 < ecrist> you probably need to escape the parens
13:44 -!- Essobi_ is now known as Essobi
13:44 < marksaitis> ecrist ?
13:45 < Fleck> help, i have p12 file, cool but every time i connect to vpn i have to enter password... i managed to extract files from p12, but dunno how to tell vpn client to use those...
13:45 < marksaitis> ecrist, it works! :) thanks
13:45 < marksaitis> YES
13:45 < ecrist> no problem marksaitis 
13:46 < marksaitis> you can write down a mark of A+ to your todays records :)))
13:47 < ecrist> w00t
13:47 < marksaitis> ecrist :D nothing, just an old joke
13:49 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9729>
13:55 -!- Netsplit *.net <-> *.split quits: WebDawg, onkel
13:57 < marksaitis> ecrist , how about this one, I just tried the client
13:57 < marksaitis> Wed Feb 16 19:56:21 2011 Cannot load certificate file C:\Program Files (x86)\OpenVPN\easy-rsa\keys\client.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
13:59 < marksaitis> ecrist - nothing :) it seems my certificate is completely empty. OMG, hell knows why
14:00 -!- puny [~puny@pool-98-110-183-168.bstnma.fios.verizon.net] has joined #openvpn
14:01 < puny> !welcome
14:01 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:01 -!- rolls` [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
14:01 < puny> !goals
14:01 -!- rolls` [~rollin@190.120.228.48] has joined #openvpn
14:01 < puny> !logs
14:01 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
14:02 < marksaitis> ecrist, is build-dh requiried every time after you use build-key to make certs for aditional users?
14:02 < marksaitis> :)
14:04 -!- Netsplit over, joins: WebDawg
14:05 < puny> hmm, I am getting random packet loss all over the place
14:08 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
14:12 -!- livevilfr [~livevilfr@49.105.100-84.rev.gaoland.net] has quit []
14:14 < reiffert> try tcp then.
14:14 -!- onkel [onkel@2001:470:1f07:915::4] has joined #openvpn
14:15 < puny> yeah I was thinking of doing that in the name of troubleshooting but I'm trying to avoid sending out new configs to all my users
14:18 -!- s7r [~s7r@ACBE7DA1.ipt.aol.com] has quit [Ping timeout: 246 seconds]
14:20 -!- rubin110 [~rubin110@70-36-142-176.dsl.dynamic.sonic.net] has joined #openvpn
14:21 < rubin110> Hi there, is there some magical way of being about to hit the public IP address of an openvpn server while being connected to it through openvpn?
14:21 < rubin110> er being able
14:28 -!- elux [~peter@96.45.198.150] has joined #openvpn
14:32 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
14:36 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
14:36 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
14:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:38 -!- roentgen [~arthur@2001:4d18:3:1:ffff:ffff:ffff:1] has joined #openvpn
14:38 -!- roentgen [~arthur@2001:4d18:3:1:ffff:ffff:ffff:1] has quit [Changing host]
14:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
14:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:45 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 272 seconds]
14:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:48 < Dropje> quick question: while doing a build-key what doest the "challenge password" do/mean?
14:49 < Dropje> !goal
14:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:52 < Dropje> !?
14:52 < Dropje> !config
14:52 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
14:53 < ecrist> !configs
14:53 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
14:53 < ecrist> Dropje: challenge password is for the key, so in order to use your certificate key pair, you have to enter the challenge password.
14:55 < Dropje> ecrist: thanks for your reply but im not sure what you mean. if i dont use a challenge password while building the server key and leave it blank during build-key for the client it should work right?
14:56 < ecrist> yup
14:57 < Dropje> but the other way around: building the server key with a challenge password and building a client key without doesnt work?
14:57 < ecrist> nope, that works, too
14:57 < Dropje> haha you lost me :p
14:58 < ecrist> challenge password is just a way to protect the SSL key
14:58 < ecrist> so, just because someone gets your certificate/key pair files, they can't use them to sign anything without the challenge password.
14:58 < Dropje> ahhhh ok 
14:58 < ecrist> most openvpn installs don't use them except on the signing certificate/root ca
14:58 < Dropje> thanks thats clear
15:04 -!- cherwin_ [~cherwin@jvs39c-gw.xs4all.nl] has joined #openvpn
15:05 < cherwin_> How does the crl.pem work? If I revoke a key, I don't see the file getting updated. How does OpenVPN know the certificate is revoked?
15:06 < krzee> !crl
15:06 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
15:06 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
15:06 < cherwin_> Yeah, I've read that in the howto. It still doesn't explain how it works.
15:07 < cherwin_> How does OpenVPN know that a certain certificate is revoked?
15:07 < krzee> it says what cant connect, and is signed by the ca.key
15:07 < krzee> by looking at the CRL!
15:07 < krzee> its a list of revoked certificates
15:07 < krzee> you must upload it to the server yourself :-p
15:08 < cherwin_> But I only see 1 entry. Even if I revoke multiple certificates.
15:08 < krzee> then you did something wrong
15:08 < cherwin_> . ./vars && ./revoke-full <cn>
15:08 < cherwin_> How can that possibly go wrong?
15:09 < cherwin_> It's just the standard easy-rsa 2.0.
15:09 < ecrist> mostly because easy-rsa sucks balls
15:09 < cherwin_> Care to elaborate?
15:09 < ecrist> yeah, I hate easy-rsa
15:10 < cherwin_> Why?
15:10 < ecrist> it's "hokey"  too much going on and overly complex
15:10 < ecrist> !ssl-admin
15:10 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
15:18 < Fleck> !p12
15:24 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has left #openvpn []
15:44 -!- marksaitis [~MK@82.144.242.158] has quit [Remote host closed the connection]
15:45 -!- cherwin_ [~cherwin@jvs39c-gw.xs4all.nl] has quit [Quit: leaving]
15:47 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:52 -!- Marksaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
15:53 -!- Marksaitis_ [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
15:53 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
15:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:55 -!- mezgani_ is now known as mezgani
15:55 -!- mezgani is now known as p3rror
16:01 -!- elux [~peter@96.45.198.150] has quit [Quit: Bye!]
16:04 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
16:06 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Quit: Leaving]
16:09 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Connection reset by peer]
16:13 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
16:16 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
16:18 -!- Guest60326 [~Geek@unaffiliated/cain] has joined #openvpn
16:23 <@vpnHelper> RSS Update - forum: Internet Crash <http://forums.openvpn.net/topic7644.html>
16:24 < hyper_ch> openvpn makes the internet crash?
16:25 < puny> hehe
16:25 < puny> that sounds like a job for al gore!
16:26 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:44 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 272 seconds]
17:01 -!- raidzx is now known as raidz
17:02 -!- raidz [~Andrew@seance.openvpn.org] has quit [Changing host]
17:02 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has joined #openvpn
17:02 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has left #openvpn ["Leaving"]
17:03 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has joined #openvpn
17:03 -!- mode/#openvpn [+o raidz] by ChanServ
17:19 -!- michelp [~michel@198.145.35.12] has joined #openvpn
17:20 < michelp> !goal
17:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:25 < michelp> Hi, I have an ubuntu 10.04 LTS machine that I have successfully connected to my vpn server.  I can ping IPs on the vpn no problem.  What I can't figure out is how to resolve *.vpn names from a nameserver on the vpn while I am connected to the vpn.  I thought i could add it to /etc/resolv.conf, but that file is generated by NetworkManager and I am concerned that any edits I make there will be overwritten.  Anyone have a clue they can send my way about the 
17:25 < michelp> right place to set this up?
17:26 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
17:30 < krzee> !pushdns
17:30 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
17:30 < krzee> i think networkmanager will pick up those options, not sure
17:31 < krzee> i dont use networkmanager and often recommend not using it during testing, but first just try adding the option and seeing if networkmanager picks it up by itself
17:31 < krzee> if not, see #4 above
17:33 < michelp> krzee, ah, thanks a lot
17:33 < michelp> i'll give that a shot
17:33 < michelp> unfortunately i'm the only one in house running on ubuntu, everyone else is running osx
17:34 < michelp> and they do it some other hardwired way
17:47 -!- nb [~nb@fedora/nb] has joined #openvpn
17:58 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:04 -!- WinstonSmith [~true@e178172239.adsl.alicedsl.de] has joined #openvpn
18:07 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:07 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:07 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:20 < michelp> krzee, thanks for the tips, i actually ended up using network-manager-openvpn plugin another colleague of mine tipped me to, it works great!
18:20 < michelp> at least, on this network ;)
18:20 < michelp> we'll see how smoothly it transitions to my home
18:21 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 246 seconds]
18:26 -!- WinstonSmith [~true@e178172239.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
18:33 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
18:40 -!- michelp [~michel@198.145.35.12] has quit [Ping timeout: 240 seconds]
18:41 -!- WinstonSmith [~true@e178172239.adsl.alicedsl.de] has joined #openvpn
18:42 -!- p3rror [~mezgani@41.140.38.244] has quit [Ping timeout: 276 seconds]
18:51 -!- jackmcbarn [~jackmcbar@2002:47c7:7dd2::2] has joined #openvpn
18:51 < jackmcbarn> !welcome
18:51 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:51 < jackmcbarn> !goal
18:51 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:52 < jackmcbarn> i want to set up ipv6 routing over openvpn. i already have openvpn working over tap, and local ipv6 works fine. it says theres no "route-ipv6" directive though. was the patch that included this merged yet?
18:55 -!- p3rror [~mezgani@41.140.46.95] has joined #openvpn
19:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
19:08 -!- majuk__ [~majuk@cpe-70-112-3-105.austin.res.rr.com] has joined #openvpn
19:12 < ecrist> jackmcbarn: you'll need to use one of the devel snapshots to get ipv6 support
19:12 < ecrist> !snapshots
19:12 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
19:17 < jackmcbarn> does ubuntu have a ppa with a dev snapshot?
19:18 -!- WinstonSmith [~true@e178172239.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
19:19 -!- majuk__ [~majuk@cpe-70-112-3-105.austin.res.rr.com] has quit [Read error: Operation timed out]
19:19 -!- WinstonSmith [~true@e178172239.adsl.alicedsl.de] has joined #openvpn
19:25 -!- jfkw [~jtk@216.115.6.82] has quit [Quit: leaving]
19:27 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
19:34 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has joined #openvpn
19:41 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:41 -!- luneff [~yury@84.51.197.93] has quit [Quit: Leaving]
19:46 -!- p3rror [~mezgani@41.140.46.95] has quit [Ping timeout: 240 seconds]
19:49 < ecrist> jackmcbarn: I doubt it, we don't maintain the ubuntu repos
19:54 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:06 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
20:17 -!- p3rror [~mezgani@41.140.41.83] has joined #openvpn
20:19 -!- WinstonSmith_ [~true@g231231197.adsl.alicedsl.de] has joined #openvpn
20:22 -!- WinstonSmith [~true@e178172239.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
20:25 -!- p3rror [~mezgani@41.140.41.83] has quit [Ping timeout: 264 seconds]
20:29 < jackmcbarn> okay, ty for your help ecrist 
20:29 -!- jackmcbarn [~jackmcbar@2002:47c7:7dd2::2] has left #openvpn ["Leaving"]
20:33 < ecrist> no problem.
20:39 -!- p3rror [~mezgani@41.140.40.188] has joined #openvpn
20:58 -!- WinstonSmith_ [~true@g231231197.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
21:07 -!- master_of_master [~master_of@p57B5366F.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
21:09 -!- master_of_master [~master_of@p57B535D9.dip.t-dialin.net] has joined #openvpn
21:09 -!- cron2_ [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 246 seconds]
21:23 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:23 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:23 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:26 -!- jhelwig [~jhelwig@puppetlabs/development/jhelwig] has joined #openvpn
21:28 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
21:36 -!- albech [~thomas@119.42.78.82] has joined #openvpn
22:31 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
22:31 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
22:31 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:31 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
22:46 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
22:49 -!- albech_ [~thomas@124.157.245.126] has joined #openvpn
22:52 -!- albech [~thomas@119.42.78.82] has quit [Read error: Operation timed out]
22:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 240 seconds]
23:01 -!- Matchstick [~Matchstic@72.52.94.228] has joined #openvpn
23:02 < Matchstick> !welcome
23:02 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:03 < Matchstick> !goal
23:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:03 < Matchstick> !route
23:03 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
23:07 -!- djgerm [~Your_Moms@dsl-63-249-90-234.static.cruzio.com] has quit [Quit: Leaving.]
23:08 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:11 -!- Matchstick [~Matchstic@72.52.94.228] has quit [Read error: Connection reset by peer]
23:19 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
23:19 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
23:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:28 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has joined #openvpn
23:54 < EugeneKay> !factoids
23:54 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
--- Day changed Thu Feb 17 2011
00:08 -!- d457k [~heiko@vpn.astaro.de] has quit [Read error: Operation timed out]
00:09 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
00:10 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:21 -!- luneff [~yury@84.51.197.93] has joined #openvpn
00:21 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:24 -!- p3rror [~mezgani@41.140.40.188] has quit [Ping timeout: 240 seconds]
00:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
00:37 -!- p3rror [~mezgani@41.140.97.187] has joined #openvpn
00:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
00:48 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
00:49 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
01:09 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has quit [Ping timeout: 250 seconds]
01:09 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:19 <@vpnHelper> RSS Update - forum: Routing help for OpenVPN server behind NAT <http://forums.openvpn.net/topic7634.html#p9731>
01:20 -!- djgerm [~Your_Moms@76-191-159-34.static.dsltransport.net] has left #openvpn []
01:21 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has joined #openvpn
01:26 -!- caesay [~caesay@unvanquished/associate/sniperx] has quit [Changing host]
01:26 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
01:36 < cherwin> !welcome
01:36 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:40 -!- WebDawg [~whoami@officialg0d.com] has quit [Quit: I WIN!]
02:07 -!- zeeshoem [~mnathani@bas1-toronto46-1177856283.dsl.bell.ca] has joined #openvpn
02:13 -!- EugeneKay is now known as EugeneKaway
02:13 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9732>
02:14 -!- bba [~bba@93.1.40.113] has quit [Quit: Leaving...]
02:26 -!- maxJadi [~maxJadi@dhcp-164-195.nomad.chalmers.se] has joined #openvpn
02:26 -!- maxJadi [~maxJadi@dhcp-164-195.nomad.chalmers.se] has quit [Changing host]
02:26 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
02:27 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
02:28 -!- luneff [~yury@84.51.197.93] has joined #openvpn
02:32 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
02:32 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
02:33 -!- luneff [~yury@84.51.197.93] has joined #openvpn
02:37 -!- Briareos1 [~B@13-98-136-94.static.net4you.net] has joined #openvpn
02:37 < Briareos1> good morning
02:43 < Briareos1> I am thinking about a setup whith only one machine which is directly connected to internet (public IP address). still it should _ONLY_ accept tunnel connections an then serve it's services only to tunneled-in users/machines
02:43 < Briareos1> But I am stuck at where to start
02:43 < Briareos1> can you point me to a direction?
02:48 <@vpnHelper> RSS Update - forum: Windows Client Source Code + Build Instructions <http://forums.openvpn.net/topic7073.html#p9733>
02:51 -!- master_of_master [~master_of@p57B535D9.dip.t-dialin.net] has quit [Read error: Operation timed out]
02:51 -!- master_of_master [~master_of@p57B535D9.dip.t-dialin.net] has joined #openvpn
02:52 -!- peper [~peper@saturn.piotrj.org] has quit [Read error: Operation timed out]
02:52 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
03:17 < krzee> Briareos1, 
03:17 < krzee> !howto
03:17 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:19 < Briareos1> ty krzee, i'll have a look
03:20 < krzee> yw
03:21 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
03:21 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
03:24 < Briareos1> krzee: huh i remember this from when i set up pfSense back then :) do you know which part might help with my current case?
03:28 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
03:29 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Read error: Operation timed out]
03:29 <@vpnHelper> RSS Update - forum: YANQ (Yet another newb question) <http://forums.openvpn.net/topic7643.html#p9734>
03:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
03:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:30 -!- mode/#openvpn [+o mattock] by ChanServ
03:30 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
03:30 -!- oc80z [oc80z@blea.ch] has joined #openvpn
03:31 -!- rkantos_ [robin@84.239.137.74] has quit [Ping timeout: 255 seconds]
03:31 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
03:32 -!- Coffe [~niszsse@sto.alatest.se] has joined #openvpn
03:33 < Coffe> Hi, we are connecting a office down in china. but connection between us, are not good at all, should one use TCP then ? is there any other tweaks to make the connection more stable. , having a 60% packetloss on the vpn right now.
03:34 -!- bba [~bba@212.51.174.146] has joined #openvpn
03:39 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has joined #openvpn
03:39 < MarKsaitis> hey
03:39 < MarKsaitis> does anyone know why my VPN client does not get remote sites gateway setting? :)
03:42 < hyper_ch> remote sites gateway setting?
03:42 <@vpnHelper> RSS Update - forum: Windows auto-connect when starting gui <http://forums.openvpn.net/topic7623.html#p9735>
03:43 < MarKsaitis> hyper_ch, yeah. The only thing my TAP device on the client gets is ITs ip and subnetmask
03:43 < MarKsaitis> no gateway and no dns
03:44 < hyper_ch> !tell MarKsaitis [welcome]
03:46 < MarKsaitis> hyper_ch, ?
03:46 < MarKsaitis> !redirect
03:46 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
03:46 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:46 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:46 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:48 <@vpnHelper> RSS Update - forum: Internet Crash <http://forums.openvpn.net/topic7644.html#p9736>
03:49 < MarKsaitis> hyper_ch, does it mean redirect-gateway def1 directive tells vpnclient to use remote gateway?
03:50 < hyper_ch> redirect-gateway def1 will route all traffic through the vpn
03:50 -!- zxd [~zxd@95.211.21.37] has quit [Ping timeout: 276 seconds]
03:50 < MarKsaitis> hyper_ch, it doesnt :
03:50 < hyper_ch> it does
03:51 < MarKsaitis> I have just got these two lines added at the end of config and reconnected to VPN server
03:51 < MarKsaitis> redirect-gateway def1
03:51 < MarKsaitis> dhcp-option DNS 10.0.0.2
03:51 < hyper_ch> !tell MarKsaitis [configs]
03:51 < MarKsaitis> dhcp option worked - now I have remote DNS on TAP Device
03:52 < MarKsaitis> but redirect gateway thing did not make a change :)
03:52 < MarKsaitis> hyper_ch, I dont think pastebin is needed for 2 lines :)
03:54 -!- findingroute [~route2@89-201-153-147.dsl.optinet.hr] has joined #openvpn
03:55 < findingroute> !welcome
03:55 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:55 < MarKsaitis> hyper_ch, well, reidrect-gateway def1 is the only thing which does no difference whether its commented or uncommented
03:55 < MarKsaitis> !configs
03:55 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
03:56 < findingroute> hi, need some help with setting up openvpn, anyone willing to help // point me in right direction? :)
03:56 < hyper_ch> findingroute: what are you trying to do?
03:57 < MarKsaitis> hyper_ch, please help :)
03:57 < findingroute> :) 
03:57 < hyper_ch> MarKsaitis: I don't see any question by you
03:57 < findingroute> trying to access network behind one of the clients from vpn
03:58 < MarKsaitis> hyper_ch, how to make client TAP device have gateway option set to some ip address?
03:58 < hyper_ch> MarKsaitis: told you how
03:58 < hyper_ch> !tunortap
03:58 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
03:58 < findingroute> my client is in 10.3.0.0/24 range, vpn is 10.10.10/24, client on 10.3.0.0/24 network have 10.10.10.11 ip on vpn 
03:58 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
04:00 < MarKsaitis> hyper_ch, well I am using TAP, and as I said, I can not make my clients TAP device get "default gateway" setting. It's always empty but I want it to have an IP address
04:01 < hyper_ch> findingroute: I still don't see where the problem is or what network you try to access
04:01 < hyper_ch> !tell MarKsaitis [tunortap]
04:01 < findingroute> i am trying from vpn to access 10.3.0.0/24 network
04:01 -!- zxd [~zxd@213.108.249.197] has joined #openvpn
04:02 < MarKsaitis> hyper_ch, i already said that I do not need tunortap, I am already using TAP.
04:03 < hyper_ch> MarKsaitis: then go on using TAP
04:04 < MarKsaitis> hyper_ch, I am already using TAP. Thats not the point here. I am just saying that client does not get Gateway IP set for it when it connects
04:06 < hyper_ch> findingroute: http://backreference.org/2009/11/15/openvpn-and-iroute/
04:06 <@vpnHelper> Title: OpenVPN and iroute « \1 (at backreference.org)
04:07 < MarKsaitis> any experts here?
04:09 < hyper_ch> findingroute: hope that helps
04:11 < MarKsaitis> hyper_ch, do I need to have any kind of "redirect-gateway" options on the server side config? Or is it only for the client side config?
04:11 < MarKsaitis> hyper_ch, it really does not work. I can ping remote sites gateway IP, but its just not being selected to be TAPs gateway on the client
04:12 < MarKsaitis> I am using WIN2008R2 - server, Win7 64bit - client. Latest OpenVPN beta thing.
04:13 < MarKsaitis> I can ping every single remote sites computer, browse shares and everything else, except that client TAP interface does have empty Gateway option
04:19 < findingroute> hyper_ch: ty 
04:20 < hyper_ch> findingroute: haven't tried it myself but it looks sound
04:22 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
04:25 -!- Briareos1 [~B@13-98-136-94.static.net4you.net] has left #openvpn ["Konversation terminated!"]
04:33 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
04:33 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
04:33 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:06 < MarKsaitis> does anyone would know why the hell "build-key client" command would no longer work? It just outputs some usage information instead! Havent even touched it, was woring yesterday! Windows Server 2008R2
05:07 < MarKsaitis> latest openvpn
05:09 < MarKsaitis> and build-dh just freezes the command prompt
05:09 < MarKsaitis> wtf
05:12 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:12 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:12 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:14 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 250 seconds]
05:17 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
05:19 -!- WormDude [~wormfood@183.38.239.185] has joined #openvpn
05:23 -!- WormFood [~wormfood@183.15.97.125] has quit [Ping timeout: 264 seconds]
05:29 < Bushmills> "outputs some usage information" seems to indicate that build-lkey is somehow unhappy with your command line
05:38 < MarKsaitis> Bushmills, nah, it was just me being stupid. I forgot to initiate vars before that
05:38 < MarKsaitis> but I still can't get redirect-gateway def1 working and web search revealed I am not the only one
05:39 < Bushmills> things which work one day, and don't without anything having changed, often indicate a difference in ... procedure .., applied by the user
05:39 < Bushmills> windows client?
05:39 < MarKsaitis> yes its windows 7 client
05:40 < Bushmills> !winroute
05:40 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
05:40 < MarKsaitis> Bushmills, as i said, it works fine now as it did yesterday. i just forgot to execute vars
05:40 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
05:42 < MarKsaitis> Bushmills, is "redirect-gateway def1" directive supposed to make so that client uses its local gateway? Or does it do so client gets remote gateway?
05:42 < MarKsaitis> its a general question
05:43 < Bushmills> no, it is meant to use openvpn server as gateway, but also adds a host route to vpn server, so the tunnel won't collapse
05:43 < MarKsaitis> I see
05:44 < Bushmills> adds that route to server to the client routing table
05:44 < MarKsaitis> so I do not need it in windows, do I
05:44 < Bushmills> depends on your definition of "need"
05:44 < MarKsaitis> well, I want to route completely everything. I want tu use vpn server gateway and so on
05:44 < MarKsaitis> I want FULL VPN
05:44 < MarKsaitis> :)
05:44 < MarKsaitis> on windows client
05:45 < Bushmills> that's what redirect-gateway is for
05:45 < janjust> MarKsaitis:  then you must use "redirect-gateway def1" AND you must run openvpn with elevated privileges on the win7 client
05:45 < Bushmills> but server has to be set up to accommodate clients which want to use it as gateway
05:45 < Bushmills> !redirect
05:45 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
05:45 < MarKsaitis> janjust, :) trust me, no go
05:46 < MarKsaitis> what is that route exe thing?
05:46 < Bushmills> to appease windows
05:46 < janjust> MarKsaitis:  after the openvpn client starts, what does the routing table look like on the win7 client?
05:49 < MarKsaitis> well, it looks bigger. But there is no route 0.0.0.0 to openvpn serv
05:51 -!- bba [~bba@212.51.174.146] has quit [Remote host closed the connection]
05:52 < janjust> MarKsaitis:  there should be 2 routes to the openvpn server
05:52 -!- raomin [~romain@86.66.22.65] has quit [Quit: leaving...]
05:52 < janjust> one starting with 0.0.0.0, the other with 128.0.0.0
05:53 < janjust> if not then the routes were not added successfully; rerun with 'verb 5' or higher and look in the client log file
05:54 < MarKsaitis> janjust, than, I will try that later on. Afaik, win7 needs something aditional to route gateway as well, but I dont know what that is
05:54 < janjust> ok MarKsaitis 
05:54 < janjust> << out for lunch
06:03 < MarKsaitis> route-method exe
06:03 < MarKsaitis> route-delay 2
06:03 < MarKsaitis> seemed to do the job! :)
06:18 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
06:20 -!- p3rror [~mezgani@41.140.97.187] has quit [Ping timeout: 240 seconds]
06:35 -!- Guest60326 is now known as Cain
06:39 < janjust> MarKsaitis:  excellent news 
06:39 < MarKsaitis> janjust, oh YES
06:39 < MarKsaitis> :)
06:39 < MarKsaitis> loving it
06:43 -!- ginoe [~ginoe@ra-src.redefine.pl] has joined #openvpn
06:43 < ginoe> hi
06:43 < ginoe> it is possible to specifiy IP address in openvpn config file on client side ?
06:44 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has quit [Read error: Connection reset by peer]
06:44 < janjust> hi ginoe, depends on whether the server allows it; most servers do not but I'm guessing that you could configure the server to accept different IP addresses
06:45 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
06:45 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has joined #openvpn
06:46 < ginoe> janjust: yes, i have full control on server, i need to create client configuration file with specific ip - i don't wan't to user ipconfig-push on server - how can i do that ?
06:47 < janjust> ginoe:  one option would be to use a 'tap' setup : that way the server only looks at the MAC address of the client. you can then specify any IP address on the client side
06:48 < janjust> the client IP would need to fall inside an IP range that the server knows about, however. this has less to do with OpenVPN itself and more with generic TCP/IP routing
06:49 < ginoe> janjust: ok, that's clear for me, but it is possible to use openvpn on client side with ip defined in config file or i need to manualy set ip on interface ?
06:51 < janjust> you can set the IP inside the client file, pretty much like is done in the HOWTO examples for static point-to-point routing 
06:52 < janjust> e.g. add a line 'ifconfig 10.11.12.13 255.255.255.0' to the client config
06:52 < ginoe> ok, thanks
07:04 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
07:14 -!- knick [~knick@ipd50a9e19.speed.planet.nl] has joined #openvpn
07:15 < knick> Hi guys - I got OpenVPN installed on a machine here, and at LAN I can access it just fine - but not from the outside, I put that server in a DMZ and all ports should be open now, I can connect to any port except the one from OpenVPN, even if I change that port in the config
07:15 -!- ginoe [~ginoe@ra-src.redefine.pl] has left #openvpn []
07:16 < knick> Now topic says that the problem is my firewall, but I wonder what that might be ..
07:17 < janjust> hoi knick ; what's the server OS? what's your openvpn setup? udp or tcp based?
07:17 -!- p3rror [~mezgani@41.140.172.10] has joined #openvpn
07:18 < knick> janjust, at this moment TCP based - udp wont give any other results, Im running CentOS on there
07:19 < knick> This is what netstat shows:
07:19 < knick> tcp        0      0 0.0.0.0:1194                0.0.0.0:*                   LISTEN      3582/openvpn        
07:19 < janjust> is it true centos or is it openvz?
07:19 < knick> True centos
07:19 < knick> I can recall vpn's wont really work on vps' es
07:20 < janjust> that helps, for a start ;-) .... openvpn can be made to work on vps but it's a bit trickier
07:20 < knick> It's not the openvpn client itself though - even nmap shows the port is closed
07:20 < janjust> your openvpn setup is listening on tcp:1194 alright. what does a remote scan show ? (you can privmsg me the IP address and I can scan the box myself)
07:20 < knick> Sure
07:21 < janjust> what about the dmz? does it have a firewall?
07:21 -!- p3rror [~mezgani@41.140.172.10] has quit [Ping timeout: 240 seconds]
07:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
07:38 -!- p3rror [~mezgani@41.248.108.221] has joined #openvpn
07:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:57 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
07:57 -!- Guest60326 [~Geek@unaffiliated/cain] has joined #openvpn
07:59 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:59 -!- Guest60326 is now known as Cain
08:00 < Essobi> sup
08:01 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has quit [Read error: Connection reset by peer]
08:01 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has joined #openvpn
08:08 -!- EmperorT1m is now known as EmperorTom
08:14 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
08:14 < hyper_ch> hi there
08:15 < janjust> hi hyper_ch 
08:15 < hyper_ch> you know any sip provider that has "cheap" rates to call cell phones
08:16 < janjust> this is an openvpn forum, hyper_ch 
08:16 < janjust> not a cell phone forum
08:16 < hyper_ch> oh... wrong channel :)
08:21 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
08:26 -!- fefo [~fefo@rohypnol.gjh.sk] has joined #openvpn
08:26 < fefo> :))))
08:26 < reiffert> hyper_ch: moin :)
08:26 < hyper_ch> huhu reiffert
08:27 < fefo> nice topic, but unfortunatelly I think firewall is not the problem ;)
08:27 < reiffert> really?! :)
08:27 < fefo> when I initiate large datatransfer via tun-tunnel, it falls down..
08:27 < reiffert> how large is minimum of large?
08:28 < fefo> doesn't matter, I do scp $some_movie -> other end..
08:28 < reiffert> it does matter.
08:28 < reiffert> try to find the minimum size for when your tunnel goes down please.
08:28 < fefo> ok, 700MB file ?
08:28 < fefo> do you think it is mtu problem ?
08:29 < fefo> because ssh and http are good..
08:29 < janjust> fefo:  if a ping works and a file copy does not then in most cases its the mtu size
08:29 < reiffert> I dont think anything without further infos.
08:29 < reiffert> janjust: so far we just know "tunnel goes down for large file" nothing more.
08:29 < fefo> ok, going to try different file sizes
08:30 < janjust> i know reiffert , this is just a first guestimate
08:30 < reiffert> janjust: guessing doesnt lead to anything.
08:30 < reiffert> janjust: start with 1MB, if that fails, half the size, if it works, double.
08:30 < reiffert> s,janjust,fefo,
08:31 < reiffert> dd if=/dev/zero bs=512k count=2 of=zero.dat
08:31 < reiffert> be sure to not use com-lzo.
08:31 < reiffert> comp-lzo
08:31 < fefo> I use comp-lzo
08:31 < ecrist> scp uses SSH...
08:31 < reiffert> ecrist: oh, right.
08:32 < reiffert> ecrist: if it doesn use sftp with secure auth + plain transfer?!
08:32 < ecrist> FTP with TLS is different than scp, which is a subsystem to ssh
08:32 < ecrist> scp, everything in encrypted
08:33 < reiffert> ah great.
08:33 < ecrist> fefo: it really sounds like a firewall issue, perhaps something to do with state tables
08:34 < reiffert> let him bring up the minimum size first
08:34 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
08:36 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
08:37 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html>
08:46 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
08:52 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
08:52 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
08:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
09:01 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9738>
09:01 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 240 seconds]
09:01 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
09:01 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
09:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:02 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:02 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:07 -!- findingroute [~route2@89-201-153-147.dsl.optinet.hr] has quit [Quit: Lost terminal]
09:07 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
09:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:11 -!- p3rror [~mezgani@41.248.108.221] has quit [Read error: Connection reset by peer]
09:12 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:12  * majuk__ waves
09:12 < majuk__> Who wants to write a truckload of ccd configs for me? ;)
09:12 < ecrist> man sh
09:12 < ecrist> :)
09:13 < ecrist> I'll write them for you, majuk__.  $0.05 each, minimum of 100.
09:13 < gladiatr> heh
09:13 < gladiatr> /bin/bash is your friend
09:14 < majuk__> Oh, so, I already donated $40, so I got 800 coming to me? :D
09:14 < gladiatr> majuk__, you know about the ccd/DEFAULT file, right?
09:14 < majuk__> gladiatr, rgr. I need to define access groupings.
09:14 < gladiatr> or are these all unique?
09:15 < majuk__> It's not that big a deal, I just hit my knee on my desk support and felt like complaining.
09:15 < gladiatr> lol
09:16 < fefo> ecrist, reiffert, janjust: this is my config: http://pastebin.com/rQDUMY7e
09:16 -!- zxd [~zxd@213.108.249.197] has quit [Ping timeout: 246 seconds]
09:16 < janjust> majuk__, special offer: ecrist writes the first 100 for you for $0.05 , I'll write the second 100 for you for *only* $0.10 each
09:16 < fefo> the files are created, but I have to wait till nobody is using that vpn..
09:16 < reiffert> "wait"?
09:16 < majuk__> janjust, Oh HO, we got bids!
09:17 < reiffert> fefo: so what about the minimum file size for when the tunnel goes down?
09:17 < fefo> reiffert: dunno yet
09:17 < reiffert> so please, give it a try, thanks.
09:18 < reiffert> uh oh, ca, cert, key and dh all have the same name. stupid.
09:18 < reiffert> the port is non numerical
09:18 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
09:18 < reiffert> the server line doesnt contain a valid net address
09:18 < janjust> reiffert is feeling particularly obnoxious today?
09:19 < fefo> :))
09:19 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
09:19 < reiffert> janjust: I'll better lean back then, have fun guessing.
09:22 < janjust> fefo what are the client and server OS involved; what kind of firewalls/iptables are you running
09:22 < janjust> and why do you have to wait before you can use the files you created?
09:23 < ecrist> ooh, a vpn that uses TCP
09:23 < ecrist> !tcp
09:23 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
09:24 < ecrist> fefo: your configs don't do us much good.
09:26 -!- p3rror [~mezgani@41.140.44.209] has joined #openvpn
09:27 <@vpnHelper> RSS Update - forum: Howto route just the trafic for the other location <http://forums.openvpn.net/topic7640.html#p9739>
09:28 < fefo> ecrist: I cannot avoid because my boss is smartass
09:28 < fefo> and he insists on TCP
09:28 < fefo> ..
09:28 < fefo> no matter on arguments I provide
09:28 < ecrist> ok, but TCP is likely helping to cause your exact problem.
09:30 < fefo> ecrist: I could try to convince hime again.. but..
09:31 < fefo> I have to prove that..
09:31 < fefo> it is tcp-related issue..
09:31 < ecrist> *shrug* do or don't, I'm just trying to help.
09:31 < ecrist> what you could do is try UDP, if your problem goes away, you're set
09:31 < fefo> yyeah, I know and I am thankful
09:34 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
09:35 -!- DennisG [~x@52494E8A.cm-4-2b.dynamic.ziggo.nl] has joined #openvpn
09:35 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
09:35 < DennisG> hi folks - i've got a strange problem - clients are not able to ping eachother, but are able to ping the server. I tried to add client-t0-client to my config but no succes..
09:36 < secretary_linux> DennisG: client-t0-client or client-to-client? :) if that's not it, could it be your server's firewall rules?
09:36 < DennisG> client-to-client, my bad.. haha 
09:36 < DennisG> hmm well, in fact the server have no firewall
09:37 < janjust> DennisG:  tap or tun setup ? which client OS (firewalling?) ?
09:37 < janjust> if 'client-to-client' is used the server firewall is completely bypassed
09:37 < janjust> the cilent-side FW can block things 
09:37 < janjust> s/cilent/client
09:37 < DennisG> tun over tcp-server and debian 6 and both the server and the client have no firewall
09:38 < janjust> and you're pinging client A's VPN IP from client B, both connected to the server?
09:38 < DennisG> no, but i can ping the server
09:39 < janjust> can the server reach both clients at the same time? 
09:39 < DennisG> yes
09:39 < janjust> run the server with 'verb 7' or higher and then ping clientB from clientA
09:39 < janjust> on the server you should see many RwRwRw lines 
09:40 < DennisG> ok, lets try that.. thnx :)
09:41 < janjust> the pattern is both Rw and rW - I forgot exactly what meant what, but it does indicate the direction of traffic
09:41 < janjust> another thing to try is to run tcpdump on client B (tcpdump -nnl -i tun0 icmp) and then watch for incoming traffic
09:42 < DennisG> okay, i should give that a try - thank you. Just wondering if i have to put client-to-client in the client configs, too?
09:42 < janjust> nope
09:42 < DennisG> ok :)
09:43 < janjust> we'd need more details on your configuration to really be able to help, of course
09:43 < DennisG> yeah - i was just accessing my server and putting it on pastebin :)
09:44 < fefo> *sigh* now I've copied there a plenty of diffenrent files with different sizes.. beggining at 100B ending 27MB..
09:44 < fefo> nothing..
09:45 < DennisG> http://pastebin.com/8S4yGhAJ those are my configs
09:47 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
09:49 < janjust> DennisG:  ieeew: you're using a client-config-dir AND client-cert-not-required AND client-to-client AND username-as-common-name 
09:49 < janjust> are the client-config files picked up correctly? if so, using which common-name?
09:50 < DennisG> janjust: in fact the client-config-dir empty
09:50 < janjust> fefo: try transferring a really large file using something other than 'scp' (e.g. use 'nc' /netcat)
09:50 < DennisG> whats wrong with client-to-client and username-as-common-name (okay, cert-not-requierd isnt that secure, i know, but still...)?
09:51 < DennisG> phone is ringing, sorry - brb
09:51 < janjust> it's the 'client-config-dir' that worried me, DennisG, as well as the 'ifconfig-pool-persist' . both depend heavily on the certificate common-name; in theory you can replace them with the username but if something does not work it'd be one of the first things I'd want to disable
09:52 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has quit [Ping timeout: 240 seconds]
09:55 -!- knick [~knick@ipd50a9e19.speed.planet.nl] has quit [Quit: Leaving]
09:56 < fefo> this is new ;)
09:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
09:56 < fefo> ping: sendto: No buffer space available
09:57 < ecrist> that screams of a firewall issue
09:57 < fefo> yep
09:57 < fefo> but it shows up only now
10:00 < fefo> ah, it shows only when tunnel is down..
10:00 < fefo> and only from fw
10:03 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
10:04 -!- p3rror [~mezgani@41.140.44.209] has quit [Ping timeout: 240 seconds]
10:11 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 246 seconds]
10:15 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:18 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 272 seconds]
10:22 -!- p3rror [~mezgani@41.140.159.210] has joined #openvpn
10:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:27 < naquad> hi
10:27 < naquad> how do i block/delete/disable user authorized by key?
10:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:27 < reiffert> naquad: 
10:28 < reiffert> !revoke
10:28 < reiffert> !crl
10:28 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
10:28 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
10:28 < naquad> thank you :)
10:28 < reiffert> yw
10:35 -!- p3rror [~mezgani@41.140.159.210] has quit [Ping timeout: 240 seconds]
10:37 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9740>
10:40 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Ping timeout: 272 seconds]
10:43 -!- michelp [~michel@198.145.35.12] has joined #openvpn
10:43 <@vpnHelper> RSS Update - forum: [OpenVPN client] TAP-WIn32 speed <http://forums.openvpn.net/topic7646.html>
10:47 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Read error: Operation timed out]
10:47 -!- p3rror [~mezgani@41.140.180.75] has joined #openvpn
10:58 -!- p3rror [~mezgani@41.140.180.75] has quit [Ping timeout: 240 seconds]
11:01 -!- Netsplit *.net <-> *.split quits: onkel
11:02 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
11:03 -!- areq_ is now known as areq
11:03 -!- Coffe [~niszsse@sto.alatest.se] has quit [Quit: Leaving]
11:06 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
11:12 <@vpnHelper> RSS Update - forum: [OpenVPN client] TAP-WIn32 speed <http://forums.openvpn.net/topic7646.html#p9742>
11:13 -!- p3rror [~mezgani@41.248.108.88] has joined #openvpn
11:21 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Leaving]
11:23 -!- EugeneKaway is now known as EugeneKay
11:25 -!- cj [~cjac@adsl-207-32-175-232.rockisland.net] has quit [Ping timeout: 240 seconds]
11:28 -!- elux [~peter@96.45.198.150] has joined #openvpn
11:32 -!- Netsplit over, joins: onkel
11:32 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:32 -!- cj [~cjac@adsl-207-32-175-127.rockisland.net] has joined #openvpn
11:32 -!- s7r [~s7r@188.25.159.40] has joined #openvpn
11:35 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
11:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
11:35 -!- albech_ [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
11:35 -!- Netsplit *.net <-> *.split quits: onkel
11:42 -!- rolls` [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
11:42 -!- rolls` [~rollin@190.120.228.48] has joined #openvpn
11:57 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:00 -!- s7r [~s7r@188.25.159.40] has quit [Ping timeout: 246 seconds]
12:04 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has quit [Ping timeout: 255 seconds]
12:04 -!- p3rror [~mezgani@41.248.108.88] has quit [Ping timeout: 240 seconds]
12:08 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Quit: Leaving]
12:17 -!- p3rror [~mezgani@41.140.183.226] has joined #openvpn
12:21 -!- Kurogane [~kuro@190.87.78.120] has joined #openvpn
12:23 -!- WIthout [Quota@175.139.16.178] has quit [Disconnected by services]
12:26 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
12:31 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
12:32 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
12:36 -!- azizLIGHTS [~azizLIGHT@ec2-50-17-254-25.compute-1.amazonaws.com] has left #openvpn []
12:37 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
12:38 -!- naquad [~naquad@174.142.224.219] has left #openvpn ["Ухожу я от вас"]
12:45 -!- bba [~bba@93.1.40.113] has joined #openvpn
12:52 -!- dferris [~dferris@216-243-150-87.static.iphouse.net] has joined #openvpn
12:52 -!- dferris [~dferris@216-243-150-87.static.iphouse.net] has quit [Client Quit]
12:52 -!- dferris [~dferris@216-243-150-87.static.iphouse.net] has joined #openvpn
12:54 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:56 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
12:56 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
12:56 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:59 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
13:04 -!- DennisG [~x@52494E8A.cm-4-2b.dynamic.ziggo.nl] has quit []
13:05 -!- sfwerwfw [~ubuntu@ec2-184-73-249-219.compute-1.amazonaws.com] has left #openvpn ["WeeChat 0.3.2"]
13:26 -!- p3rror [~mezgani@41.140.183.226] has quit [Ping timeout: 240 seconds]
13:26 -!- rawDawg [~rawdawg@adsl-99-57-58-238.dsl.bcvloh.sbcglobal.net] has joined #openvpn
13:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:36 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
13:36 < majuk__> !ipp
13:36 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
13:36 < majuk__> !iporder
13:36 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
13:37 < majuk__> !statix
13:37 < majuk__> !static
13:37 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
13:43 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 264 seconds]
13:50 -!- trelane` [~trelane@66.93.203.199] has joined #openvpn
13:50 -!- trelane` [~trelane@66.93.203.199] has quit [Changing host]
13:50 -!- trelane` [~trelane@funtoo/staff/trelane] has joined #openvpn
13:50 -!- trelane [~trelane@funtoo/staff/trelane] has quit [Read error: Connection reset by peer]
13:59 -!- moldy [~rene@unaffiliated/moldy] has left #openvpn []
14:14 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9743>
14:22 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
14:22 -!- p3rror [~mezgani@41.140.156.112] has joined #openvpn
14:24 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
14:29 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
14:33 -!- gladiatr is now known as gladiatr_afk
14:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:42 -!- alhadi [~thunderst@92.99.203.225] has joined #openvpn
14:42 -!- alhadi [~thunderst@92.99.203.225] has quit [Changing host]
14:42 -!- alhadi [~thunderst@unaffiliated/alhadi] has joined #openvpn
14:44 <@vpnHelper> RSS Update - forum: don't have easy-rsa directory - how can I get it? <http://forums.openvpn.net/topic7647.html>
14:46 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:46 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:46 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:59 -!- bba [~bba@93.1.40.113] has joined #openvpn
15:00 -!- puny [~puny@pool-98-110-183-168.bstnma.fios.verizon.net] has quit [Quit: Lost terminal]
15:10 -!- gladiatr_afk [~sdspence@openvpn/community/support/gladiatr] has left #openvpn ["Leaving"]
15:16 -!- trelane` is now known as trelane
15:19 -!- p3rror [~mezgani@41.140.156.112] has quit [Ping timeout: 240 seconds]
15:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
15:33 -!- p3rror [~mezgani@41.140.38.229] has joined #openvpn
15:43 -!- merky [~ben@meh-2-pt.tunnel.tserv15.lax1.ipv6.he.net] has quit [Ping timeout: 260 seconds]
15:46 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:47 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:51 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Read error: Operation timed out]
15:58 -!- merky [~ben@meh.net.nz] has joined #openvpn
16:02 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
16:14 -!- rawDawg [~rawdawg@adsl-99-57-58-238.dsl.bcvloh.sbcglobal.net] has quit [Ping timeout: 250 seconds]
16:16 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
16:27 -!- p3rror [~mezgani@41.140.38.229] has quit [Read error: Connection reset by peer]
16:31 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has joined #openvpn
16:46 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
16:47 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
16:48 -!- nickio_ [~nick@78-86-120-249.zone2.bethere.co.uk] has joined #openvpn
16:49 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
16:50 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
16:51 -!- nickio [~nick@78-86-120-249.zone2.bethere.co.uk] has quit [Ping timeout: 240 seconds]
16:55 -!- p3rror [~mezgani@41.140.43.239] has joined #openvpn
16:55 < krzee> !factoids --search pw
16:55 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
16:55 < krzee> hrmz
16:56 < krzee> !factoids --search pass
16:56 <@vpnHelper> 'winpass', '2.1-winpass-script', 'authpass', 'password-only', 'strip-passphrase', and 'change-passphrase'
16:56 < krzee> !change-passphrase
16:56 <@vpnHelper> "change-passphrase" is see http://openvpn.net/archive/openvpn-users/2005-03/msg00230.html for how to change (or add) a key's passphrase
17:01 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
17:03 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Read error: Operation timed out]
17:04 -!- darth_bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
17:10 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
17:31 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has quit [Read error: Operation timed out]
17:52 -!- EugeneKay is now known as EugeneKaway
17:56 -!- p3rror [~mezgani@41.140.43.239] has quit [Ping timeout: 240 seconds]
17:57 -!- bitterman [~yury@84.51.197.93] has quit [Quit: Leaving]
18:05 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
18:12 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
18:16 -!- nb_ [~nb@fedora/nb] has joined #openvpn
18:17 -!- tjz [~pc@bb121-7-242-189.singnet.com.sg] has joined #openvpn
18:17 -!- tjz [~pc@bb121-7-242-189.singnet.com.sg] has quit [Changing host]
18:17 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
18:17 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
18:18 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
18:18 -!- elux [~peter@96.45.198.150] has quit [Quit: Bye!]
18:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:40 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:40 -!- nb_ is now known as nb
18:43 -!- elux_ [~peter@96.45.198.150] has joined #openvpn
18:44 -!- elux_ [~peter@96.45.198.150] has quit [Client Quit]
18:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
19:08 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
19:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
19:14 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
19:17 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
19:17 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
19:22 -!- rawDawg [rawdawg@cpe-76-190-211-0.neo.res.rr.com] has joined #openvpn
19:23 -!- rawDawg [rawdawg@cpe-76-190-211-0.neo.res.rr.com] has quit [Client Quit]
19:33 -!- jfkw [~jtk@216.115.6.82] has quit [Quit: leaving]
19:41 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
19:41 < dorp> !nat
19:41 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
19:42 < dorp> (is it optional to list all the bots !flags?)
19:42 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
19:47 -!- dorp [~dorp@195.210.186.130] has quit [Quit: dorp]
20:07 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:15 -!- EugeneKaway is now known as EugeneKay
20:20 -!- dorp [~dorp@173.0.50.133] has joined #openvpn
20:25 -!- unspin [~unspin@199.7.158.40] has joined #openvpn
20:33 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
20:41 -!- unspin [~unspin@199.7.158.40] has quit [Ping timeout: 246 seconds]
21:01 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
21:06 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
21:07 -!- master_of_master [~master_of@p57B535D9.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
21:09 -!- master_of_master [~master_of@p57B537FD.dip.t-dialin.net] has joined #openvpn
21:33 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:41 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
22:34 -!- blackxored [~user@ubuntu/member/blackxored] has joined #openvpn
22:36 < blackxored> Hello guys, I hope you are doing ok, onto my question, i'm usign openvpn 2.1 on a ubuntu lucid host, whenever I'm on dialup and not at work where I use it as well, i experience this huge amount of packet loss, by different intervals on different times, I might think at the very beginning it was dialup but without the vpn I have almost 0 packet loss, any clues?
22:36 < blackxored> the logs only show from time to time modem status int, and then write udpv[4] no buffer space available, that last one i believe it also shows at work
22:36 < blackxored> can any of you point me to the right direction, if any?
22:40 < blackxored> no one?
22:58 -!- zeeshoem [~mnathani@bas1-toronto46-1177856283.dsl.bell.ca] has quit []
23:13 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:16 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
23:25 < EugeneKay> We're mostly drunk.
23:32 -!- blackxored [~user@ubuntu/member/blackxored] has quit [Ping timeout: 240 seconds]
23:51 -!- dorp [~dorp@173.0.50.133] has quit [Read error: Connection reset by peer]
--- Day changed Fri Feb 18 2011
00:30 -!- EugeneKay is now known as EugeneKaway
00:31 -!- EugeneKaway is now known as EugeneKay
00:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:58 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:25 -!- Kurogane [~kuro@190.87.78.120] has quit [Remote host closed the connection]
01:25 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:25 -!- mode/#openvpn [+o mattock] by ChanServ
01:25 <@vpnHelper> RSS Update - forum: don't have easy-rsa directory - how can I get it? <http://forums.openvpn.net/topic7647.html#p9745>
01:37 -!- bba [~bba@212.51.174.146] has joined #openvpn
01:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
02:09 <@vpnHelper> RSS Update - forum: [OpenVPN client] TAP-WIn32 speed <http://forums.openvpn.net/topic7646.html#p9746>
02:20 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:29 -!- bba [~bba@212.51.174.146] has quit [Ping timeout: 260 seconds]
02:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:35 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 272 seconds]
02:43 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
02:45 -!- albech [~thomas@124.157.245.126] has joined #openvpn
03:08 -!- nb [~nb@fedora/nb] has joined #openvpn
03:21 <@vpnHelper> RSS Update - forum: [OpenVPN client] TAP-WIn32 speed <http://forums.openvpn.net/topic7646.html#p9747>
03:27 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9748>
03:33 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9749>
03:34 -!- sp4rc [~chatzilla@62.12.129.186] has joined #openvpn
03:34 -!- alhadi [~thunderst@unaffiliated/alhadi] has quit [Quit: alhadi]
03:34 < sp4rc> !welcome
03:34 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:35 < sp4rc> !goal
03:35 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:37 < sp4rc> guys, my question is not directly related to openvpn itself. I am trying to install the openvpn-gui (openvpn.se) on my windows 7 system (as administrator!). the thing is, the installer just hangs at the step: "Create shortcut C:\Users\...." 
03:37 < sp4rc> is anyone running this gui on windows 7? 
03:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
03:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:52 -!- alejandro [~alejandro@adsl-76-230-238-127.dsl.pltn13.sbcglobal.net] has joined #openvpn
03:52 < sp4rc> anyone?
03:52 < alejandro> can someone help me with this error connecting...read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)?
03:53 < alejandro> !welcome
03:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:54 < alejandro> !goal
03:54 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:55 < alejandro> I am having trouble connecting to my vpn from my windows virtualbox.
03:56 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
03:56 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
03:56 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:57 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9751> || help on routing <http://forums.openvpn.net/topic7618.html#p9750>
03:59 -!- p3rror [~mezgani@41.140.168.222] has joined #openvpn
04:01 -!- sp4rc [~chatzilla@62.12.129.186] has quit [Remote host closed the connection]
04:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
04:07 < janjust> ping krzee
04:09 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9752>
04:15 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9753>
04:16 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has joined #openvpn
04:18 -!- knick [~mini@ipd50a9e19.speed.planet.nl] has joined #openvpn
04:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:27 < hyper_ch> hi reiffert
04:32 <@vpnHelper> RSS Update - forum: Connecting to client has failed. <http://forums.openvpn.net/topic7648.html>
04:37 -!- alejandro [~alejandro@adsl-76-230-238-127.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving]
04:37 <@vpnHelper> RSS Update - forum: Connecting to client has failed. <http://forums.openvpn.net/topic7648.html#p9755>
04:41 < hyper_ch> hi ecrist
04:48 -!- dazo_afk is now known as dazo
04:49 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Ping timeout: 264 seconds]
04:52 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
04:54 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:54 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:54 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:10 -!- maxJadi [~maxJadi@dhcp-166-10.nomad.chalmers.se] has joined #openvpn
05:10 -!- maxJadi [~maxJadi@dhcp-166-10.nomad.chalmers.se] has quit [Changing host]
05:10 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:11 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9756>
05:42 -!- x-demon [xdemon@lex.io] has quit [Quit: Cya!]
05:45 -!- x-demon [xdemon@lex.io] has joined #openvpn
05:47 <@vpnHelper> RSS Update - forum: tls-auth... can I use the same shared keys? <http://forums.openvpn.net/topic7649.html>
05:59 <@vpnHelper> RSS Update - forum: tls-auth... can I use the same shared keys? <http://forums.openvpn.net/topic7649.html#p9758>
06:01 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
06:03 -!- s7r [~s7r@AC815439.ipt.aol.com] has joined #openvpn
06:06 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
06:12 < hyper_ch> hi dazo
06:23 -!- p3rror [~mezgani@41.140.168.222] has quit [Read error: Connection reset by peer]
06:29 <@dazo> hyper_ch: hey!
06:29 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
06:29 < hyper_ch> dazo: have you used LastPass?
06:29 <@dazo> nope ... what's that?
06:30 < hyper_ch> it's an addon for firefox, chrome/ium, ie, opera
06:30 < hyper_ch> and it's a password manager
06:30 < hyper_ch> I just wonder how "secure" it is and thought someone in here has an idea
06:31 <@dazo> ahh ... I have a biological password manager ... I've found them the safest models ... but some users complain that it forgets passwords too often :-P
06:32 < hyper_ch> well, I'm unhappy with chrome/ium default password manager
06:32 <@dazo> but seriously ... I would never trust closed source password managers ... I would really look into the code to see if it does networking stuff ... if it does, I'd skip it
06:33 < hyper_ch> well, as far as I understand it, lastpass encrypts the stuff, and sends them to the laspass account
06:33 < hyper_ch> so that you can synchronize them on different devices
06:33 <@dazo> aha ... hmmm ... nah, I wouldn't trust it
06:34 <@dazo> but I am *conservative*!
06:34 < hyper_ch> better to write them down on postits and stick them on your screen, right?
06:34 <@dazo> and (IT security) paranoid
06:34 <@dazo> hyper_ch: if your office is in a room with access control and logs with whom went in and out, then yes ;-)
06:34 < hyper_ch> I wouldn't mind you evaluating lastpass and tell me what you think then of it :)
06:35 < hyper_ch> as far as I discovered, lastpass seems ok but then I know way too little about such things
06:35 <@dazo> I am sceptic in the moment remote storage is mentioned ... I'd rather then use something which can synchronise locally ... from device A to B directly, and not through a service I cannot control
06:37 < hyper_ch> dazo: that's why I was so fond of Mozilla Weave... it was planned to relese the code so you can run your own weave server to sync stuff to
06:38 <@dazo> yeah, that I believe much more in
06:38 < hyper_ch> I like Chrome/ium but it still has a few things I don't like
06:39 -!- d1b [~db@d1b.org] has quit [Remote host closed the connection]
06:52 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9759>
06:58 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9760>
07:05 < ecrist> good morning.
07:14 < janjust> morning ecrist 
07:16 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9761>
07:21 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
07:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:32 -!- trelane [~trelane@funtoo/staff/trelane] has quit [Read error: Connection reset by peer]
07:39 -!- Sipster [~Sipster@modemcable045.5-200-24.mc.videotron.ca] has joined #openvpn
07:41 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has joined #openvpn
07:44 <@vpnHelper> RSS Update - forum: DDNS required for both server and client? <http://forums.openvpn.net/topic7650.html>
07:44 < sakhi> Hi, I need to connect to the OpenVPN server using an ubuntu desktop how do I configure it?
07:45 < sakhi> I usually ssh into my servers.
07:49 < ecrist> !man
07:49 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
07:52 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has quit [Ping timeout: 246 seconds]
07:53 < Bushmills> sakhi: text editor
07:56 <@vpnHelper> RSS Update - forum: DDNS required for both server and client? <http://forums.openvpn.net/topic7650.html#p9763>
08:10 <@dazo> [OT] http://aur.archlinux.org/packages/lolbash/lolbash/lolbash.sh
08:11 < sakhi> Bushmills: text editor = vi
08:12 < Bushmills> usable
08:12 < sakhi> yep
08:19 < knick> sakhi; i suggest you -dont- use network-manager-openvpn
08:20 < hyper_ch> there are people who really can handle vi?
08:20 < knick> hyper_ch; of course
08:20 < sakhi> knick: its giving problems already. 
08:20 < sakhi> hyper_ch: indeed I'm one of them
08:20 < knick> sakhi; that software package is 1 big problem
08:20  * hyper_ch thinks nano is good enough
08:20 < knick> ^
08:20 < knick> nano ftw
08:21 < sakhi> naNO?
08:21 < knick> but vi has tons of possibilities
08:21 < hyper_ch> knick: Microsoft Word has also thousands of functions - which I don't need to write letters
08:21  * janjust is a 16yr veteran vi user :)
08:22 < hyper_ch> I'm one of those 98% of the users that merely use 2% of the functionality
08:22  * janjust did not mean to say he is 16 yrs old :S
08:23 < knick> lies
08:23 < knick> we got you all figured out now janjust
08:23 < knick> instead of doing homework you play with linux 
08:23 < janjust> lol knick ; indeed, that's what I've been doing for the last 16 years
08:23 < knick> lolol
08:24 < janjust> well, errr, no, I started using Linux about 12 yrs ago
08:24 < Bushmills> noob :P
08:24 < knick> unix then
08:25 < janjust> hehe Bushmills , you can still find my MSDOS posts from 1989 in usenet archives :P
08:25 < knick> microsoft denial of service
08:26 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
08:26 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
08:29 < janjust> damn... oldest stuff I can find in google is from 1994 
08:32 <@dazo> wasn't that about the time Google was "born"?
08:33 < janjust> perhaps, but I still think they should archives of usenet newsgroups before that date
08:33 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
08:33 <@dazo> yeah, I don't argue about that :)
08:33 < janjust> I'm still listed as contributor in the comp.os.msdos.programmer FAQ - but that's from 2002
08:34 <@dazo> LOL ... http://www.forrester.com/rb/Research/cant_pay,_wont_pay_why_paid_digital/q/id/58011/t/2?src=Alert%20RSS_CustomFeed&cm_mmc=Research_Alert-_-email-_-02_18_11-_-58011 ... this report costs $499 :-P
08:34 <@vpnHelper> Title: Can't Pay, Won't Pay: Why Paid Digital Content Isn't Working - Forrester Research (at www.forrester.com)
08:35 < janjust> lol
08:35 < janjust> somebody should get the article and upload it to a torrent site
08:35 <@dazo> hahaha ... yeah, that would be ... priceless! ;-)
08:36 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
08:38 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9764>
08:49 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Ping timeout: 240 seconds]
08:50 <@vpnHelper> RSS Update - forum: don't have easy-rsa directory - how can I get it? <http://forums.openvpn.net/topic7647.html#p9765>
08:55 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
09:01 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
09:01 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9766>
09:08 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645.html#p9767>
09:14 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645-15.html#p9769>
09:19 -!- Diffen2 [~diffen2@78-82-119-199.tn.glocalnet.net] has joined #openvpn
09:25 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:26 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645-15.html#p9770>
09:26 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 240 seconds]
09:35 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
09:43 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
09:44 <@vpnHelper> RSS Update - forum: howto create a openvpn separate server process <http://forums.openvpn.net/topic7651.html> || Ping only at the opening of VPN <http://forums.openvpn.net/topic7645-15.html#p9771>
10:04 -!- alienn [~nicki@sphinx.link-m.de] has joined #openvpn
10:04 < alienn> hi there
10:04 < ecrist> howdy
10:04 < alienn> I have a question regarding renegotiation
10:06 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Read error: Operation timed out]
10:06 < alienn> I have openvpn 2.1.3 and I'm using one time passwords. The connection from a client is dropped after 1 hour (default value of reneg-sec).
10:06 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Quit: Leaving]
10:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
10:07 < alienn> When I put `reneg-sec 21600` (=6 hours) into my server config file and `reneg-sec 0` (disable renegotiation) into my client file I still get disconnected after 1 hour.
10:08 < ecrist> what do the logs show?
10:08 < ecrist> !logs
10:08 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
10:08 < alienn> On the client I get "Options error: option 'reneg-sec' cannot be used in this context" and on the server it still displays "renegotiate_seconds = 3600" during startup
10:09 < ecrist> !configs
10:09 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
10:09 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
10:09 < alienn> ecrist: I'll post a pastebin if the it is available again.
10:10 < alienn> !pb
10:10 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
10:11 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
10:11 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:12 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:16 -!- knick [~mini@ipd50a9e19.speed.planet.nl] has quit []
10:19 -!- Stasik [5fde8020@gateway/web/freenode/ip.95.222.128.32] has joined #openvpn
10:19 < Stasik> hey
10:19 < Stasik> help me please
10:19 < Stasik> i try to install openvpn on windows7
10:20 < Stasik> but have the exclamation mark on Tap-32 driver
10:20 < Stasik> !welcome
10:20 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:20 < Stasik> !goal
10:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:20 < Stasik> I would like to access a vpn server using windows openvpn client
10:23 < ecrist> Stasik: did you install 2.1.4?
10:24 < Stasik> yep
10:24 < Stasik> but tried 2.2beta TOO
10:24 < Stasik> same prob
10:32 -!- crazed [~crazed@unaffiliated/cr4z3d] has quit [Read error: Connection reset by peer]
10:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:32 < Stasik> no ideas?
10:32 < Stasik> no ideas?
10:32 < Stasik> i see that fucking exclamation mark
10:33 < ecrist> no idea.  I know 2.2beta and 2.1.4 both work on windows 7
10:38 -!- crazed [~crazed@unaffiliated/cr4z3d] has joined #openvpn
10:38 -!- Stasik [5fde8020@gateway/web/freenode/ip.95.222.128.32] has quit [Ping timeout: 245 seconds]
10:40 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
10:40 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
10:40 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:48 -!- alienn [~nicki@sphinx.link-m.de] has quit [Quit: Leaving]
11:00 -!- diffen3 [~diffen2@78-82-119-199.tn.glocalnet.net] has joined #openvpn
11:00 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 276 seconds]
11:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:03 -!- Diffen2 [~diffen2@78-82-119-199.tn.glocalnet.net] has quit [Ping timeout: 240 seconds]
11:12 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 240 seconds]
11:12 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
11:13 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
11:13 -!- raomin [~romain@86.66.22.65] has joined #openvpn
11:14 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
11:25 -!- teddyb [8fef4beb@gateway/web/freenode/ip.143.239.75.235] has joined #openvpn
11:26 < teddyb> !welcome
11:26 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:26 < teddyb> !howto
11:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:26 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
11:30 -!- dazo is now known as dazo_afk
11:30 < teddyb> guys im gonna put this question out here while i look at the help files again, im trying to use open vpn and it connects (the indicator goes green but then no website loads), im behind a proxy and firewall which i cant change the settings of and ive disabled my own firewall
11:33 < teddyb> !goal
11:33 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:33 < teddyb> and yes my goal is to access the internet
11:40 < teddyb> !redirect
11:40 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
11:40 < teddyb> !def1
11:40 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
11:41 < teddyb> !man
11:41 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
11:49 < teddyb> how exactly do i use --redirect-gateway ?
11:49 < ecrist> !logs
11:49 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
11:49 < ecrist> teddyb: we can help more if you provide logs
11:52 < teddyb> i dont have server logs but i can provide the client ones, http://pastebin.com/apD87ZSJ
11:53 < teddyb> !pb
11:53 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
11:53 < teddyb> woops
11:55 < teddyb> dont know if the verb is set to 5 on those logs
11:55 < teddyb> and i cant open pastebin.ca
11:58 -!- Some_Person [~sam@unaffiliated/someperson/x-249303] has joined #openvpn
11:59 < Some_Person> I've got a problem. I'm running the openvpn client on debian, and although the connection is working, DNS is not
12:00 < Some_Person> I can access sites through the VPN by IP address, but not by domain
12:00 < ecrist> teddyb: any pastebin is fine
12:01 < ecrist> Some_Person: you need to push DNS then
12:01 < ecrist> !dns
12:01 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4
12:01 < Some_Person> ecrist: I don't have access to my server's config right now
12:01 -!- p3rror [~mezgani@41.140.168.229] has joined #openvpn
12:01 < teddyb> ok so far all i got is this http://pastebin.com/apD87ZSJ i tried starting the client in --verb 5 but it gave me an error
12:02 < Some_Person> Can this be set on the client end somehow?
12:02 < Some_Person> I can already ping/access my home router
12:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
12:03 < Some_Person> anyone?
12:04 < EugeneKay> I'm still working on "getting out of bed"
12:05 -!- Some_Person [~sam@unaffiliated/someperson/x-249303] has quit [Quit: Leaving]
12:07 < ecrist> lame sauce
12:07 < teddyb> ecrist did you get my log?
12:08 < ecrist> yup, line 45 is your problem.'
12:08 < ecrist> you have a subnet conflict
12:09 < teddyb> oh, is there much i can do about it?
12:10 < ecrist> yes, you need to either change the IP addressing on the local LAN or on the VPN
12:11 -!- p3rror [~mezgani@41.140.168.229] has quit [Ping timeout: 240 seconds]
12:15 -!- relentless [~relentles@unaffiliated/relentless] has joined #openvpn
12:15 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:17 < teddyb> can i request a specific ip address from the router? im on my campus wifi so have very little control over it ?
12:18 < EugeneKay> No, you can't change the subnet without control over the server .conf
12:18 < EugeneKay> And changing your campus LAN's subnet would require an Act of Dog
12:19 < teddyb> guess ill be getting a new server (one that i can control the .conf :) )
12:21 < dvl> ecrist: Are you at BSDCan 2011 or PGCon 2011?
12:23 < relentless> I am looking for a way to VPn into a server ans join the Active Directory Domain of that server. Am I able to do that?
12:25 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has joined #openvpn
12:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
12:26 < EugeneKay> !howto
12:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:26 < Varazir> Hello 
12:26 < EugeneKay> relentless - you want to setup a TUN, with your windows server as the server.
12:27 < Bushmills> "teddyb: how exactly do i use --redirect-gateway ?" ... you put "redirect-gateway" into your config
12:28 < Varazir> patelx or raidz around ? 
12:29 < teddyb> bushmills thats good to know, thought you had to start it with --redirect -gateway when opening it
12:29 < Bushmills> if you're not using a config file, yes. but then you'd have to specify everything else on command line as well
12:31 < teddyb> ahh i see
12:32 < teddyb> also ive got a question, what type of hardware would i want to be able to support 1 gigabit of traffic comming from 100 users connected though open vpn
12:32 < ecrist> dvl: I'm going to be at BSDCan 2011
12:33 < Bushmills> the type of hardware i'd use would be a computer.
12:33 < teddyb> a digital one :O
12:34 < Bushmills> wouldn't hurt to have one with decent CPU performance
12:35 < teddyb> Intel Quad Core Xeon 3220, 4 x 2.40GHz be enough?
12:36 < dvl> OpenVPN doesn't impose much load at all, from what I've seen. I do multi-GB backups over it.
12:37 -!- grapsus [~grapsus@acces1206.res.insa-lyon.fr] has quit [Read error: Connection reset by peer]
12:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:40 -!- diffen3 [~diffen2@78-82-119-199.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
12:41 -!- p3rror [~mezgani@41.140.183.59] has joined #openvpn
12:41 < Bushmills> teddyb: sounds ok.
12:41 -!- xindz`off is now known as xindz
12:42 < teddyb> nice
12:42 < Bushmills> may be worth to play with comp-lzo setting.  choose an efficient encryption algo, like blowfish
12:44 < teddyb> k
12:44 < Bushmills> my very rough estimation is that the gigabit link with full load keeps one core busy for about 100%
12:45 -!- albech [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
12:46 -!- teddyb [8fef4beb@gateway/web/freenode/ip.143.239.75.235] has quit [Quit: Page closed]
12:48 -!- teddyb [8fef4beb@gateway/web/freenode/ip.143.239.75.235] has joined #openvpn
12:49 -!- Frenk [4fc0a469@gateway/web/freenode/ip.79.192.164.105] has joined #openvpn
12:49 < teddyb> sorry got disconected, thats nice to know that it wont be too high load, what about ram? 8gigs suffice?
12:49 < Frenk> !howto
12:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:49 -!- EyesIsMine [~Nitch@unaffiliated/theeyes] has joined #openvpn
12:49 -!- EyesIsMine [~Nitch@unaffiliated/theeyes] has left #openvpn []
12:50 -!- relentless [~relentles@unaffiliated/relentless] has quit [Read error: Connection reset by peer]
12:51 < Frenk> Hello, can someone help me please? I have one client and one server. I want the client (windows 7) to connect to the IP of the server (Debian) and use its Internet connection. Its just one client and its for one day only.
12:51 < hyper_ch> hi Bushmills
12:51 < Bushmills> hi hyper_ch
12:51 < Bushmills> !redirect
12:51 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:51 < hyper_ch> Bushmills: I hope you had a pleasant day
12:52 < Bushmills> Frenk: ^^^
12:52 < Frenk> Bushmills: Bushmills =)
12:52 < Bushmills> Frenk: and ...
12:52 < Bushmills> !winroute
12:52 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
12:52 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
12:53 < Bushmills> hyper_ch: t'was ok. nothing exceptional, but allright
12:54 < hyper_ch> Bushmills: do you happen to use LastPass as addon for website password management?
12:54 < Bushmills> i've known worse :)
12:54 < Bushmills> hyper_ch: don't know that. is that one of those centralized authenticating services?
12:55 < hyper_ch> Bushmills: it is :)
12:56 < Bushmills> like .. bitcard and ... hm... what was the name ...
12:57 < Bushmills> i think google also does authenticate access to remote sites now
12:59 < hyper_ch> lastpass seems "secure" from a paranoid point of view.... but as I don't understand much I hoped some people in here have experience with it or had a closer look at it
12:59 < Bushmills> not me
13:02 -!- p3rror [~mezgani@41.140.183.59] has quit [Read error: Connection reset by peer]
13:02 -!- teddyb [8fef4beb@gateway/web/freenode/ip.143.239.75.235] has quit [Quit: Page closed]
13:08 < Frenk> I have a question: I installed OpenVPN and now the How-To tells me to: ./pkitool hostname  [Note] 	  Replace hostname with the actual hostname of the machine connecting to the VPN.  - If I do not know the hostname of the machine?
13:08 < Bushmills> use its ip address
13:08 < Bushmills> oh. sorry. for key generation
13:08 < Frenk> can I use anything I like?
13:09 < Bushmills> yes. pick something mnemonic
13:11 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:14 -!- mant1s [mant1s@141.114.213.55] has joined #openvpn
13:14 -!- mant1s [mant1s@141.114.213.55] has quit [Changing host]
13:14 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
13:34 -!- Luddha [~ludd@h59ec0024.seluldx.dyn.perspektivbredband.net] has joined #openvpn
13:34 < Luddha> hello
13:34 < Luddha> i guess this is wrong place for routing questions even if its about openvpn?
13:35 < EugeneKay> !route
13:35 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:35 < EugeneKay> You can ask, but no guarantees.
13:35 < EugeneKay> Frenk - using the FQDN is a "good idea", but you can use any name that you want to refer to the key.
13:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:38 -!- Frenk [4fc0a469@gateway/web/freenode/ip.79.192.164.105] has quit [Ping timeout: 246 seconds]
13:41 < Luddha> im running openvpn on a client machine on my home subnet 10.10.10.0, and my openvpn server has ip 192.168.10.1, if i connect from outside my router, do i want the NAT to open up port to the client that runs the openvpn server (10.10.10.10) or do i want it to open the port to the openvpn server (192.168.10.1)? i know its not really a routing question, but i can become
13:45 < Luddha> EugeneKay do you know the answer of my question? :D
13:46 < EugeneKay> "nat to upen up port"
13:46 < EugeneKay> Do you mean firewall ?
13:46 < EugeneKay> In a properly routed configuration you don't need any nat commands
13:50 < Luddha> i use NAT as firewall, is that incorrect?
13:50 < Luddha> well, lets skip the terminology then
13:50 < EugeneKay> In iptables, filter should be your firewalling table
13:50 < EugeneKay> While nat is for, well, nat.
13:50 < Luddha> ok :)
13:50 < Luddha> here comes another try then
13:51 < Luddha> when i run port scanner from t1shopper, the port that ive opened just as normal isnt responding
13:51 < Luddha> is that because my router doesnt know the way to the openvpn server?
13:51 < EugeneKay> You'll need to open two things on the server's firewall: the protocol/port that OpenVPN is listening on on the external IP(the one that you're connecting), and something to allow traffic from the subnet being assigned to VPN traffic to wherever it is you want it to go.
13:52 < Bushmills> !route
13:52 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:52 < Bushmills> Luddha: ^^^
13:52 < EugeneKay> !firewall
13:52 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
13:52 < EugeneKay> That's closer to what he's after.
13:53 < Bushmills> !english
13:53 < Bushmills> :D
13:53 < EugeneKay> !beer
13:53 <@vpnHelper> "beer" is its what's for dinner!
13:54 < Bushmills> !4:20
13:54  * gladiatr chuckles
13:55 < Luddha> EugeneKay so its the openvpn server that routes together the two subnets? ive turned off software firewalls on the openvpn server, so that shouldnt be a problem
13:55 < EugeneKay> Correct. All traffic goes through the server, and then out to wherever it needs to
13:55 < Luddha> ok
13:56 < EugeneKay> If your openvpn server is not the "default" gw for it's "local" subnet, then you'll want to add a route on whatever is, to ensure that stuff goes to the right place
13:56 < Luddha> so what i should do is to add a route on the openvpn server from 10.10.10.10 to 192.168.10.1
13:56 < EugeneKay> You have a LAN behind a client you're trying to route to?
13:57 < Luddha> this is what i want to do: from my roadwarrior, i want to connect to my openvpn server and then connect via RDP to the openvpn server.
13:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:57 -!- p3rror [~mezgani@41.140.98.255] has joined #openvpn
13:57 < EugeneKay> ohgodusingwindowsasopenvpnserverkillitwithfire
13:58 < Luddha> lol
13:58 < Luddha> just knew that would come
13:58 < gladiatr> indeed
13:58 < Luddha> but thats how it is for now
13:58 < Bushmills> !windows
13:58 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg, or (#3) also, http://secure-computing.net/files/windows_2.jpg
13:59 < EugeneKay> #2 is a 404
13:59 < EugeneKay> Derp, it's the comma
13:59 < EugeneKay> fukken windows
14:00 < Bushmills> EugeneKay: #2 shows http://scarydevilmonastery.net/snap/1298059200186013883d.png 
14:00 < EugeneKay> Yeah, XChat includes the trailing comma in links
14:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
14:14 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has quit [Ping timeout: 240 seconds]
14:16 < Luddha> EugeneKay are you still willing to help me?
14:16 < ecrist> !forget windows
14:16 <@vpnHelper> Error: 3 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
14:16 < ecrist> !forget windows *
14:16 <@vpnHelper> Joo got it.
14:17 < ecrist> !learn windows as pcs are like air conditioners, they work fine unless you open windows
14:17 <@vpnHelper> Joo got it.
14:17 < ecrist> !learn windows as http://secure-computing.net/files/windows.jpg for funny
14:17 <@vpnHelper> Joo got it.
14:17 < EugeneKay> Luddha - I don't know enough about Windows routing to be able to
14:17 < Luddha> okidoki
14:17 < ecrist> !learn windows as http://secure-computing.net/files/windows_2.jpg for more funny
14:17 <@vpnHelper> Joo got it.
14:17 < ecrist> !windows
14:17 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
14:18 < Luddha> well, FYI im running a asus p5q pro mobo and i dont think there is any non-windows OS that supports the on board NIC. that why im stuck with winblows
14:18 < Luddha> tried debian, ubuntu, solaris and more
14:18 < Luddha> redhat
14:18 < ecrist> Luddha: freebsd?
14:18 < Luddha> tried too
14:18 < Luddha> *BSD doesnt work either
14:19 < Luddha> ecrist do you know about windows routing table?
14:19 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
14:20 < Luddha> well, this should be for all OSes: i want to add a route from my local IP and mask to the openvpn server IP right? and the default gateway is my local router?
14:20 -!- Diffen2 [~diffen2@78-82-119-199.tn.glocalnet.net] has joined #openvpn
14:20 < ecrist> what route do you want to add?
14:21 < Luddha> i cant open a port from my router to my openvpn server, and it seems like its the local client running the openvpn server that fails routing 
14:22 < Luddha> i have a roadwarrior that is going to connect to my openvpn server, then RDP to it
14:22 < Luddha> locally, i can connect my roadwarrior and then RDP to my openvpn server
14:23 < Luddha> but when i port scan with t1shopper, it doesnt seem like the port is correctly opened since there is nothing answering
14:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:24 -!- gladiatr is now known as gladiatr_afk
14:25 < ecrist> http://i.crackedcdn.com/phpimages/photoshop/5/6/1/43561.jpg?v=1
14:27 -!- p3rror [~mezgani@41.140.98.255] has quit [Ping timeout: 260 seconds]
14:39 <@vpnHelper> RSS Update - forum: DDNS required for both server and client? <http://forums.openvpn.net/topic7650.html#p9773>
14:49 -!- p3rror [~mezgani@41.140.38.179] has joined #openvpn
15:04 -!- Diffen2 [~diffen2@78-82-119-199.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
15:11 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 260 seconds]
15:30 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
15:31 < EugeneKay> That is a terrible Venn diagram
15:33 <@vpnHelper> RSS Update - forum: VPN bridging help? <http://forums.openvpn.net/topic7652.html>
15:39 -!- bba [~bba@93.1.40.113] has joined #openvpn
15:43 -!- p3rror [~mezgani@41.140.38.179] has quit [Ping timeout: 240 seconds]
15:45 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
15:47 -!- dvl [~dvl@pdpc/supporter/active/dvl] has left #openvpn ["Leaving"]
15:47 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
15:48 -!- JyZyXEL [~lol@a88-115-37-73.elisa-laajakaista.fi] has quit [Ping timeout: 264 seconds]
15:51 <@vpnHelper> RSS Update - forum: Client fails to connect first time when using DDNS <http://forums.openvpn.net/topic7653.html>
15:52 -!- JyZyXEL [~lol@a88-112-69-207.elisa-laajakaista.fi] has joined #openvpn
15:56 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:56 -!- p3rror [~mezgani@41.140.177.48] has joined #openvpn
15:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:34 <@vpnHelper> RSS Update - forum: Client fails to connect first time when using DDNS <http://forums.openvpn.net/topic7653.html#p9776>
16:50 < Luddha> is it possible to have an openvpn server with only one NIC if a vpn client connects from outside the local network?
16:50 < Bushmills> Luddha: tcpdump or tshark on openvpn server whether packets are actually getting there
16:51 < Bushmills> if not -> review router config
16:51 < Bushmills> yes, possible (one NIC)
16:51 < Luddha> ok
16:51 < Luddha> hmm
16:51 < ecrist> yes
16:51 < Luddha> ive been sitting here trying every damn way with the router
16:51 < Luddha> running pfsense 1.2
16:52 < Luddha> gotta be the router since i can connect locally to my openvpn server
16:52 < Bushmills> well, if you know already, then there is no need to check and you can -> review router config immediately
16:55 < Luddha> hmm
16:55 < Luddha> review the router config?
16:55 < Luddha> thats what ive been doing for 2 hours
16:55 < Bushmills> or better, change it such that it does what you intend it to
16:55 < Luddha> even though im not very good at it, ive tried all different ways
16:55 -!- raidz [~Andrew@seance.openvpn.org] has joined #openvpn
16:55 -!- raidz [~Andrew@seance.openvpn.org] has quit [Changing host]
16:55 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has joined #openvpn
16:55 -!- mode/#openvpn [+o raidz] by ChanServ
16:56 < Bushmills> well, without the router routing incoming vpn packets to vpn server, you won't be able to connect
16:56 < Luddha> if i could make a computer to always do what i wanted it to, i wouldnt be fascinated by it, but that doesnt say that i like being stuck with the same friggin problem for hours and hours
16:56 < Luddha> right
16:57 < Luddha> so how do i make it route the packets the right way?
16:57 <@vpnHelper> RSS Update - forum: Client fails to connect first time when using DDNS <http://forums.openvpn.net/topic7653.html#p9777>
16:57 < Bushmills> depends
16:58 < Luddha> on?
16:58 < Bushmills> manufacturer, model, firmware
16:58 < Luddha> pfsense 1.2
17:00 < Luddha> so i add a static route with my openvpn server machine:s local LAN IP set as destination?
17:00 < Luddha> and Gateway set as the IP to my DHCP server or the openvpn server?
17:00 < Luddha> interface WAN or LAN?
17:01 < Luddha> now all vpn packages goes to that machine, but how do i make the packages go from the machine to my openvpn server software?
17:01 < Bushmills> i doubt that that is necessary, as the machines behind router supposedly are on the same network as the router's LAN port(sO)
17:02 < Luddha> yes they are
17:02 < Bushmills> so there is no gateway between VPN server and router
17:02 < Luddha> no there is not
17:03 < Bushmills> therefore you don't need to set up a route, with gateway, on router
17:03 < Luddha> when the vpn server is running and i run ipconfig (ifconfig in opensauce) it doesnt have a default gateway
17:03 < Luddha> so what i want to do is to?
17:03 < Bushmills> that must be a different problem.  as far you seemed to know that the vpn packets don't arrive at vpn server because of router.
17:04 < Bushmills> better fix one problem at a time, instead of hopping from one to another
17:04 < Luddha> ok im sorry, but i didnt see the jump
17:04 < Luddha> but ive got time
17:04 < Luddha> and i really appreciate the help i get
17:05 < Bushmills> don't bother about missing default gateway on vpn server until that server receives packets to which it tries to reply to
17:05 < Luddha> ok
17:06 < Luddha> which means that i shouldnt care about anything else until T1shopper port scanner says that the port is open?
17:06 < Bushmills> i'd use a packet sniffer on vpn server machine
17:07 < Luddha> ok
17:07 < Luddha> which will monitor where all incoming and outgoing packets received while being pinged for example goes?
17:08 < Bushmills> it will monitor what you ask it to
17:08 -!- p3rror [~mezgani@41.140.177.48] has quit [Ping timeout: 240 seconds]
17:08 < Bushmills> and in your case, you'd ask it to watch out for incoming openvpn packets
17:09 < Luddha> ok
17:09 < Luddha> so ill get tcpdump
17:09 < Bushmills> such as
17:11 < Luddha> darn
17:12 < Luddha> need winpcap for windows
17:13 < Luddha> ill go with tshark instead
17:15 < Luddha> go
17:15 < Luddha> up and running 
17:16 < Luddha> Bushmills now ive got the packages
17:18 -!- bragon [~Alexandre@81.93.247.165] has quit [Ping timeout: 276 seconds]
17:25 -!- p3rror [~mezgani@41.140.179.194] has joined #openvpn
17:25 -!- Luddha [~ludd@h59ec0024.seluldx.dyn.perspektivbredband.net] has quit []
17:30 <@vpnHelper> RSS Update - forum: Windows 7, strange issues. <http://forums.openvpn.net/topic7654.html>
17:31 -!- Netsplit *.net <-> *.split quits: x-demon
17:31 -!- Netsplit *.net <-> *.split quits: master_of_master
17:32 -!- Netsplit over, joins: master_of_master
17:34 -!- Netsplit over, joins: x-demon
18:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:17 -!- p3rror [~mezgani@41.140.179.194] has quit [Ping timeout: 240 seconds]
18:24 -!- Sipster [~Sipster@modemcable045.5-200-24.mc.videotron.ca] has quit [Ping timeout: 240 seconds]
18:25 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
18:26 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
18:26 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
18:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:29 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:49 -!- dorp [~dorp@173.0.50.133] has joined #openvpn
18:50 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:51 < dorp> anybody mind to remind me what is the bot's trigger for iptables nat route?
18:52 < Bushmills> !nat
18:52 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
18:53 < dorp> !linnat
18:53 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
18:53 < dorp> Bushmills: thanks
18:53 < Bushmills> np
18:53 < dorp> !openvzlinnat
18:53 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
18:53 -!- xindz is now known as xindz`off
18:53 < dorp> anybody has permission to add a comment for !openvzlinnat?
18:54 < Bushmills> somebody has
18:55 < dorp> Bushmills: said somebody mind to add something to it? :)
18:55 < Bushmills> i don't know whether that somebody does
18:56 < dorp> heh, well.. if that somebody hears me... please add: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <IP>
18:56 < Bushmills> !snat
18:57 < Bushmills> !factoids search snat
18:57 <@vpnHelper> No keys matched that query.
18:57 < Bushmills> forwarded
18:58 < s7r> by default openvpn will use blowfish as a cipher?
18:58 < Bushmills> yes, it does
18:58 < s7r> this in case no cipher is included in the config files right ?
18:58 < Bushmills> right
18:58 < dorp> Bushmills: thanks, I'm positive it would help others
18:58 < s7r> when using blowfish as a cipher what is the hash algorithm?
18:59 < s7r> key exchange
18:59 < s7r> and how many bits does the key have :p
18:59 < Bushmills> sha1, iirc. not 100% sure though
19:00 < Bushmills> key length is specified upon creation
19:01 < s7r> what is the maximum supported , in case you know
19:01 < Bushmills> again, not sure. 4096 is what i believe it to be
19:02 < Bushmills> though that's SSL determined
19:02 < Bushmills> openvpn should be rather agnostic for those details
19:03 < s7r> openvpn should and does support the entire openssl library as far as I know
19:03 < s7r> so it shouldn't be a problem
19:03 < s7r> 4096 key is for paranoids :))
19:03 < s7r> i was thinking mostly 512
19:03 < s7r> since even the system to crack an 128 bit key does not exist yet
19:03 < Bushmills> afaik, 128 bit keys were cracked years ago.
19:04 -!- p3rror [~mezgani@41.140.27.243] has joined #openvpn
19:04 < s7r> are you serious?
19:04 < s7r> than how come AES128 is used heavely worldwide even by governments
19:04 < Bushmills> yes. took about 4 months, massivley parallel
19:05 -!- sayuke [~crc@149.171.12.46] has joined #openvpn
19:05 < s7r> look what a security guy says on its blog
19:05 < s7r> 128 bit AES offers a total of 3.4 x 10^38 individual keys.
19:06 < s7r> It is estimated         that if a DES key generator were able to discover 1 DES key per second,         it would take 149 thousand-billion (149 trillion) years to crack a single         128 bit AES key. 
19:06 < s7r> Currently, the technology is not available.
19:07 < Bushmills> " RSA claims that 1024-bit keys are likely to become crackable some time  between 2006 and 2010 and that 2048-bit keys are sufficient until 2030."  (from http://en.wikipedia.org/wiki/Key_size)
19:07 <@vpnHelper> Title: Key size - Wikipedia, the free encyclopedia (at en.wikipedia.org)
19:07 < sayuke> hey all, I have an openvpn server set up, and I can connect to it from the client, everything works. But if I add a 'route $CLIENT_IP 255.255.255.255' to the server.conf file, then the server will hang on startup. Anyone ever have a similar problem?
19:08 < Bushmills> " For example as of May 2007[update], a 1039 bit integer was factored with the special number field sieve using 400 computers over 11 months.[2]  The factored number was of a special form; the special number field  sieve cannot be used on RSA keys. The computation is roughly equivalent  to breaking a 700 bit RSA key."
19:08 < EugeneKay> s7r Bushmills - There are differences between symmetric and asymmetric keys
19:09 < Bushmills> yes. i assume asymmetric keys is what matters here
19:09 < s7r> EugeneKay: i know there are differences
19:09 < s7r> but if you could explain as simple as you can what they are
19:09 < s7r> i would be forever thankful
19:10 < EugeneKay> http://www.lmgtfy.com/?q=symmetric+asymmetric+cryptography&l=1
19:10 <@vpnHelper> Title: Let me google that for you (at www.lmgtfy.com)
19:11 < EugeneKay> In short, asym requires "longer" keys than sym
19:12 < s7r> oh
19:12 < s7r> EugeneKay: not many differences at all
19:12 < s7r> still the key size is essential
19:13 < EugeneKay> Despite what Dr Ruth Westheimer says, bigger is always better.
19:13 < s7r> but currently , 128 is enough according to security websites
19:13 < EugeneKay> Use the biggest available.
19:13 < s7r> yes, it appears we are on the same page at this chpater
19:14 < s7r> :D
19:14 < s7r> still, it won't be impossible to crack
19:14 < s7r> nothing is impossible when taling abou computers
19:14 < s7r> but ... if you can't make for somebody impossible to read your data at least make it damn hard for them :D
19:14 < EugeneKay> Impossible? No. Impractical for personal banking usage? Yes.
19:17 < sayuke> strace is reporting that mmap2 from the loading of libpthread isnt returning. wtf
19:23 < s7r> EugeneKay, Bushmills do you happen to know - if I connect to my openvpn server via a socks or HTTP proxy, will the traffic / tunnel be encrypted between my computer and the vpn server or between the socks / proxy and vpn server? in other words traffic will go through the proxy / socks encrypted or plain ?
19:23 < dorp> Anybody familiar with a beginners guide for opevpn under android based smartphones? (google isn't my friend)
19:23 < dorp> (as-in client)
19:23 < EugeneKay> OpenVPN will encrypt it between the proxy and the OpenVPN server. The socks/http proxy encrypts it between you and the proxy.
19:23 < Bushmills> s7r: yes, will be encrypted.
19:24 < EugeneKay> Any time you use a proxy server, the proxy can sniff your traffic.
19:24 < s7r> I know, if the admin there, can intercept the traffic with few commands
19:24 < Bushmills> assuming your openvpn runs on your own computer, of course
19:24 < s7r> but the question was if the traffic goes through there encrypted or plain
19:24 < s7r> yes Bushmills of course, the openvpn client is in my computer
19:25 < s7r> the proxy server is in different country
19:25 < EugeneKay> If you're concerned about your privacy, use a SSH tunnel and run tor through that, then into your OpenVPN server ;-)
19:26 < EugeneKay> "Yo dawg I heard you like privacy so I put a tunnel in your tunnel in your tunnel so you can port forward while you proxy while you route"
19:27 < s7r> didn't understand your suggestion
19:27 < Bushmills> I'd add some decoy traffic
19:27 < s7r> i know what a ssh tunnel is but the concern was about a proxy server which you can find on the internet, to do ssh tunnel you need a server with ssh access
19:27 -!- michelp [~michel@198.145.35.12] has quit [Ping timeout: 276 seconds]
19:29 < s7r> so i will stick to what Bushmills said and hope the traffic is encrypted end-to-end when using proxy
19:29 < s7r> and proxy sees encrypted traffic
19:32 < Bushmills> http://scarydevilmonastery.net/openvpn.png  <- dependency graph of openvpn under linux (debian)
19:32 < Bushmills> might need legend
19:34 -!- jfkw [~jtk@216.115.6.82] has quit [Quit: leaving]
19:36 -!- p3rror [~mezgani@41.140.27.243] has quit [Ping timeout: 276 seconds]
19:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
19:38 < s7r> i don't understand a thing from there :))
19:38 < s7r> looks like chinese
19:45 -!- sayuke [~crc@149.171.12.46] has quit [Ping timeout: 240 seconds]
19:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:49 -!- s7r [~s7r@AC815439.ipt.aol.com] has left #openvpn []
19:50 < dorp> so no android fans? :\
19:50 < ecrist> I'm an android fan...
19:51 < dorp> hey :) , any chance you're familiar with a beginners guide for openvpn-client under android?
19:51 < dorp> (google brings up weird 'guidelines')
20:03 -!- p3rror [~mezgani@41.140.26.24] has joined #openvpn
20:09 -!- nickio_ [~nick@78-86-120-249.zone2.bethere.co.uk] has quit [Read error: Connection reset by peer]
20:10 -!- nickio_ [~nick@78-86-120-249.zone2.bethere.co.uk] has joined #openvpn
20:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:26 -!- sayuke [~crc@149.171.12.46] has joined #openvpn
20:33 -!- sayuke [~crc@149.171.12.46] has quit [Ping timeout: 240 seconds]
20:40 -!- sayuke [~crc@149.171.12.46] has joined #openvpn
20:42 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:44 -!- p3rror [~mezgani@41.140.26.24] has quit [Ping timeout: 240 seconds]
21:00 -!- UnterPerro [~UnterPerr@216.246.168.6] has joined #openvpn
21:05 < sayuke> if in server.conf you have "route $CLIENT_IP", which then causes all traffic sent to $CLIENT_IP to be sent back through openvpn's loop interface, then how can you connect to openvpn from $CLIENT_IP
21:08 -!- master_of_master [~master_of@p57B537FD.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
21:10 -!- master_of_master [~master_of@p57B53BF6.dip.t-dialin.net] has joined #openvpn
21:10 < Bushmills> sayuke: you don't
21:10 < Bushmills> openvpn interface address is different from ethernet address you're connecting from.
21:11 < sayuke> im obviously missing something then, but how do you route traffic through openvpn
21:11 < Bushmills> but traffic back to client goes to address of openvpn virtual interface
21:11 < Bushmills> !redirect
21:11 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
21:11 < Bushmills> that adds a host route to server ethernet address through original gateway
21:11 < sayuke> thanks
21:12 < reiffert> Mushbills
21:12 < Bushmills> my alter ego
21:13 < reiffert> fighting os x installer on vmware server, after reading tons of forum bla bla
21:15 -!- dorp [~dorp@173.0.50.133] has quit [Ping timeout: 240 seconds]
21:19 < sayuke> the config file has 'server 10.0.0.0 255.255.255.0' and as expected takes the address 10.0.0.1. However the clients route table shows traffic being redirected to 10.0.0.5. Any ideas?
21:20 < sayuke> sorry im playing with my route tables, I dont know if this last message was posted. May be a dup
21:20 < sayuke> the config file has 'server 10.0.0.0 255.255.255.0' and as expected takes the address 10.0.0.1. However the clients route table shows traffic being redirected to 10.0.0.5. Any ideas?
21:26 < Bushmills> that's fine. client ip address is probably 10.0.0.6
21:28 -!- sayuke [~crc@149.171.12.46] has quit [Ping timeout: 260 seconds]
21:30 -!- ucekpolish1 [user@hq.ostc-pl.com] has quit [Ping timeout: 276 seconds]
21:34 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
21:34 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
21:34 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:36 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
21:40 -!- sayuke [~crc@149.171.12.46] has joined #openvpn
21:45 -!- sayuke [~crc@149.171.12.46] has quit [Ping timeout: 240 seconds]
21:50 -!- JyZyXEL [~lol@a88-112-69-207.elisa-laajakaista.fi] has quit [Ping timeout: 255 seconds]
21:52 -!- JyZyXEL [~lol@a88-112-69-207.elisa-laajakaista.fi] has joined #openvpn
21:54 -!- Agin_ [~Agin@greenzone.copyleft.no] has joined #openvpn
21:57 -!- Deathzor_ [~deathtje@216.67.225.106] has joined #openvpn
21:59 -!- raw__ [~raw@chipotle118.server4you.de] has joined #openvpn
22:00 -!- UnterPerro [~UnterPerr@216.246.168.6] has quit [Quit: UnterPerro]
22:00 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Ping timeout: 255 seconds]
22:00 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 255 seconds]
22:00 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 255 seconds]
22:00 -!- Deathzor [~deathtje@216.67.225.106] has quit [Ping timeout: 255 seconds]
22:00 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
22:00 -!- UnterPerro [~UnterPerr@216.246.168.6] has joined #openvpn
22:00 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
22:03 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Remote host closed the connection]
22:03 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
22:08 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
22:10 -!- tjz_ [~pc@bb121-7-242-189.singnet.com.sg] has joined #openvpn
22:39 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
22:46 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
22:46 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
22:47 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
22:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 272 seconds]
23:01 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:06 -!- Diffen2 [~diffen2@78-82-119-199.tn.glocalnet.net] has joined #openvpn
23:21 -!- Diffen2 [~diffen2@78-82-119-199.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
23:24 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
23:28 -!- tjz_ [~pc@bb121-7-242-189.singnet.com.sg] has quit [Quit: bbl.]
23:28 -!- tjz [~pc@bb121-7-242-189.singnet.com.sg] has joined #openvpn
23:28 -!- tjz [~pc@bb121-7-242-189.singnet.com.sg] has quit [Changing host]
23:28 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
23:29 -!- UnterPerro [~UnterPerr@216.246.168.6] has quit [Quit: UnterPerro lives to save another day]
--- Day changed Sat Feb 19 2011
00:01 -!- Deathzor_ [~deathtje@216.67.225.106] has quit [Read error: Operation timed out]
00:09 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has joined #openvpn
00:10 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
00:14 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has quit [Ping timeout: 272 seconds]
00:59 -!- me345 [~me345@75.15.250.181] has joined #openvpn
01:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
01:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 272 seconds]
01:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:11 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:11 -!- mode/#openvpn [+o mattock] by ChanServ
02:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
02:36 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
02:36 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:12 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has joined #openvpn
03:13 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
03:18 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
03:37 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
03:48 <@vpnHelper> RSS Update - forum: cannot ping server <http://forums.openvpn.net/topic7655.html>
03:50 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
03:53  * EugeneKay is tempted to start a forum topic: Cannot read manual, please help
04:01 -!- SOG [~SOG@n11649233179.netvigator.com] has joined #openvpn
04:05 -!- me345 [~me345@75.15.250.181] has quit [Read error: Connection reset by peer]
04:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
04:13 -!- Anubis [~Quetzalco@89.137.126.161] has joined #openvpn
04:13 -!- Anubis [~Quetzalco@89.137.126.161] has left #openvpn []
04:17 < Bushmills> !howto
04:17 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:17 < Bushmills> :P
04:29 < reiffert> EugeneKay: moron
04:29 < EugeneKay> reiffert - thanks!
04:30 < reiffert> try the forums. looks like you can write at least.
04:31 < EugeneKay> reiffert - I was making a joke, playing upon the bot's tendency to post every single forum topic to the #channel ;-)
04:56 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Remote host closed the connection]
05:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
05:07 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
05:07 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Remote host closed the connection]
05:08 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
05:14 -!- WormDude [~wormfood@183.38.239.185] has quit [Read error: Connection reset by peer]
05:15 -!- WormDude [~wormfood@183.39.81.213] has joined #openvpn
05:18 < Bushmills> yes, annoying sometimes, those forum post headers. but /ignoring vpnHelper completely makes it more difficult to use it for helping purposes 
05:38 < EugeneKay> /eat vpnHelper 
05:53 -!- threedaymonk [~threedaym@surimi.vm.bytemark.co.uk] has quit [Remote host closed the connection]
05:58 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 246 seconds]
05:59 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
06:03 -!- albech [~thomas@119.42.77.127] has joined #openvpn
06:24 -!- xindz`off is now known as xindz
06:35 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
06:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
06:43 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
06:43 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
06:44 -!- _zero__ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
06:46 -!- raidz [~Andrew@openvpn/corp/admin/andrew] has quit [Ping timeout: 246 seconds]
07:08 -!- katoen_ [5c825874d5@xs8.xs4all.nl] has joined #openvpn
07:08 -!- sbrath_ [~sbrath@admin1.guild.com] has joined #openvpn
07:08 -!- reiffert_ [~thomas@mail.reifferscheid.org] has joined #openvpn
07:09 -!- raomin_ [~romain@86.66.22.65] has joined #openvpn
07:12 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Read error: Connection reset by peer]
07:13 -!- xindz [karz@bounced.by.nbounce.com] has quit [Ping timeout: 246 seconds]
07:13 -!- sbrath [~sbrath@unaffiliated/sbrath] has quit [Ping timeout: 246 seconds]
07:13 -!- katoen [ce024205a3@xs8.xs4all.nl] has quit [Ping timeout: 246 seconds]
07:13 -!- raomin [~romain@86.66.22.65] has quit [Ping timeout: 246 seconds]
07:13 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 246 seconds]
07:14 -!- xindz [karz@bounced.by.nbounce.com] has joined #openvpn
07:17 <@vpnHelper> RSS Update - forum: CCD directory is not being recogonized <http://forums.openvpn.net/topic7656.html>
07:19 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
07:40 -!- luneff [~yury@84.51.195.188] has joined #openvpn
07:40 <@vpnHelper> RSS Update - forum: openvpn server config for airlink raven xe please help <http://forums.openvpn.net/topic7657.html>
07:59 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:59 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:05 <@vpnHelper> RSS Update - forum: One allowed connection per IP, last one closes older attempt <http://forums.openvpn.net/topic7658.html>
08:12 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
08:15 -!- p3rror [~mezgani@41.140.39.35] has joined #openvpn
08:17 <@vpnHelper> RSS Update - forum: source ip address of all traffic via openvpn tunnel <http://forums.openvpn.net/topic7659.html>
08:18 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 240 seconds]
08:24 -!- fefo [~fefo@rohypnol.gjh.sk] has left #openvpn []
08:35 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
08:49 -!- s7r [~s7r@ACBE6E8E.ipt.aol.com] has joined #openvpn
08:53 -!- snapcase [~snapcase@soundwave.snapcase.net] has joined #openvpn
08:55 < s7r> in openvpn AS , from the web GUI can I set the key size (bits) and select the cipher ?
09:18 -!- p3rror [~mezgani@41.140.39.35] has quit [Ping timeout: 264 seconds]
09:21 -!- Brumbazz [kvirc@dhcp25.signon3.se.beevpn.com] has joined #openvpn
09:30 -!- p3rror [~mezgani@41.248.185.169] has joined #openvpn
09:30 < Brumbazz> !welcome
09:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:31 < Brumbazz> !goal
09:31 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:31 < Brumbazz> Hello:) First, sorry my English, it’s not my first language. I am considering to setup a Openvpn server on my dedicated box.  But I can’t figure out, what is the most secure way to login in to my Openvpn-server.  Pre-shared secret key, certificate, or username/password. What do you guys recommend? And is it possible  to decrypt an openvpn connection ? Thanks :)
09:44 -!- Brumbazz [kvirc@dhcp25.signon3.se.beevpn.com] has quit [Ping timeout: 268 seconds]
09:53 -!- p3rror [~mezgani@41.248.185.169] has quit [Ping timeout: 264 seconds]
10:09 -!- p3rror [~mezgani@41.140.25.124] has joined #openvpn
10:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 272 seconds]
11:01 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
11:01 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
11:16 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:31 -!- albech [~thomas@119.42.77.127] has quit [Quit: Ex-Chat]
11:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
11:39 -!- Mtn_Bkng_Dave [~whome@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
11:40 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
11:40 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
11:41 -!- Mtn_Bkng_Dave [~whome@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Client Quit]
11:44 -!- bba [~bba@93.1.40.113] has quit [Remote host closed the connection]
11:44 -!- bba [~bba@93.1.40.113] has joined #openvpn
11:47 -!- zxd [~zxd@95.211.21.37] has quit [Read error: Connection reset by peer]
11:47 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
12:03 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
12:03 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
12:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:08 -!- MeMyself [~MeMyself@178.114.239.171.wireless.dyn.drei.com] has joined #openvpn
12:10 < MeMyself> Hello, is it possible to force all traffic trough vpn?
12:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
12:13 < MeMyself> !welcome
12:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:13 < MeMyself> !goal
12:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:14 < MeMyself> !goal i would like to force all the traffic trough vpn
12:15 < MeMyself> !configs
12:15 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
12:16 < MeMyself> !interface
12:16 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
12:17 < MeMyself> !sample
12:17 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
12:17 < MeMyself> is that all for unix?
12:18 < MeMyself> anyone alive?
12:21 < MeMyself> nobody is reponding why?
12:28 -!- MeMyself [~MeMyself@178.114.239.171.wireless.dyn.drei.com] has quit []
12:29 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
12:38 -!- Diffen2 [~diffen2@78-82-119-199.tn.glocalnet.net] has joined #openvpn
12:48 < dvl> I do like people wondering 'nobody is reponding why?'
13:01 -!- p3rror [~mezgani@41.140.25.124] has quit [Read error: Connection reset by peer]
13:02 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
13:04 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
13:05 -!- Luddha [~ludd@h59ec0024.seluldx.dyn.perspektivbredband.net] has joined #openvpn
13:05 < Luddha> hello
13:05 < robotti^> is ipv6 possible over openvpn? when using static shared ipv4 address? on wan side? can clients have ipv6 address from ISP?
13:05 < Luddha> Bushmills hi
13:05 < robotti^> like vpn server connection have static ipv4 and ipv6 addresses?
13:07 < robotti^> one static ipv4, that is router for ipv4 traffic
13:07 < robotti^> and then ipv6 address for openvpn client users?
13:11 < robotti^> will it work when using tap interface?
13:11 < robotti^> but no with tun interface?
13:17 < s7r> robotti^: what do you mean
13:17 < s7r> you have dual stack ?
13:17 < s7r> with ipv4 and ipv6 ?
13:17 < robotti^> yes, or I an not sure how is configured by ISP
13:18 -!- p3rror [~mezgani@41.140.34.7] has joined #openvpn
13:18 < robotti^> it can be also 6to4, but I am hoping it is dual stack.
13:19 < robotti^> I should test it
13:21 < s7r> i do not think openvpn supports ipv6 routingm
13:21 < s7r> maybe someone here can confirm if i am worng
13:21 < s7r> wrong*
13:22 < robotti^> running OpenVPN server will be running on ipv4 address, but I was planning that, clients get ipv4 address like over nat and ipv6 from ISP. 
13:22 < robotti^> from router dhcp get their lan ip-adresses, and ipv6 addresses from ISP network
13:23 < robotti^> over tap interface, it should work, because it should work like ethernet interface
13:26 < robotti^> Point-to-point IPv6 tunnels are supported on OSes which have IPv6 TUN driver support (this includes Linux and the BSDs). IPv6 over TAP is always supported as is any other protocol which can run over Ethernet.
13:27 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
13:30 < s7r> didn't know that
13:30 < s7r> so if the OS supports IPv6 sockets than TAP adapter support ipv6 automatically ?
13:31 < robotti^> yes. if you have working tap-connection, you can use 
13:31 < robotti^> yes. if you have working tap-connection, you can use every protocol supported on ethernet
13:31 < robotti^> like IPX?
13:31 < robotti^> because you can transfer ethernet frames over tap-connection
13:32 < robotti^> If I understand it correctly.
13:32 -!- mete [~metefr@84.200.12.194] has quit [Remote host closed the connection]
13:33 < robotti^> Then we should have possiblities to run dual stack connections over OpenVPN connection
13:33 < robotti^> or many different kind connections
13:40 < s7r> sounds interesting
13:40 -!- mete [~metefr@84.200.12.194] has joined #openvpn
13:40 < robotti^> yes
13:41 < s7r> robotti^: but if you enable ipv6 in tap properties
13:41 < s7r> on the other side, the server has to be configured to assign ipv6
13:42 < s7r> you need to modify both client/ server configs not just client
13:42 < robotti^> yes I know.
13:42 < s7r> right?
13:42 < robotti^> it is lot to configure?
13:42 < robotti^> it is
13:54 -!- p3rror [~mezgani@41.140.34.7] has quit [Ping timeout: 264 seconds]
13:57 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:57 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:00 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Quit: No Ping reply in 180 seconds.]
14:00 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
14:04 < s7r> robotti^: you use the openvpn community project or as
14:05 -!- a1fa [~a1fa@unaffiliated/a1fa] has joined #openvpn
14:05 < a1fa> hello.. my openvpn is closing the connection several seconds after i connect:
14:05 < a1fa> Sat Feb 19 13:54:47 2011 us=437000 TCP/UDP: Closing socket
14:05 < a1fa> Sat Feb 19 13:54:47 2011 us=437000 SIGTERM[hard,] received, process exiting
14:05 < a1fa> it does not give much more rason
14:07 -!- luneff [~yury@84.51.197.93] has joined #openvpn
14:11 < s7r> !man
14:11 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
14:14 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
14:24 -!- Diffen2 [~diffen2@78-82-119-199.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
14:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:25 < krzee> !linnat
14:25 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
14:29 < s7r> krzee: openvpn works on virtual private servers also? with vnet adapters not eth0 ?
14:29 < s7r> i knew it does not work on vnet
14:31 < krzee> i dont see why not
14:31 < krzee> ive run vpns inside vmware
14:33 -!- p3rror [~mezgani@41.140.177.173] has joined #openvpn
14:40 -!- p3rror [~mezgani@41.140.177.173] has quit [Ping timeout: 264 seconds]
14:44 <@vpnHelper> RSS Update - forum: Client fails to connect first time when using DDNS <http://forums.openvpn.net/topic7653.html#p9784>
14:50 < s7r> krzee: and inside vmware you have vnet? I mean you have a single physical NIC which is virtualized by vmware?
14:51 < s7r> and you run openvpn just fine?
14:52 < krzee> correct
14:52 < krzee> thats how i have done testing
14:52 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 240 seconds]
14:52 < s7r> i can't find the link on openvpn.net where it said that will not run on vnet
14:53 < s7r> in vmware how you have nat to physical nic or bridge?
14:53 -!- p3rror [~mezgani@41.140.33.245] has joined #openvpn
14:54 < krzee> you were prolly reading about access-server stuff, they have an actual vmware appliance
14:54 < krzee> (although that does work too...)
14:56 < s7r> yeah i saw they have special for vmware virtualization
14:56 <@vpnHelper> RSS Update - forum: Client fails to connect first time when using DDNS <http://forums.openvpn.net/topic7653.html#p9785>
14:57 < s7r> !vnet
14:57 < s7r> !venet
14:58 -!- p3rror [~mezgani@41.140.33.245] has quit [Ping timeout: 264 seconds]
15:07 < krzee> BUT
15:08 < krzee> just because they made a vmware virtual appliance download for access-server does not mean anything about the community version
15:08 -!- mete [~metefr@84.200.12.194] has joined #openvpn
15:08 < hyper_ch> hi krzee
15:08 < s7r> yes, you are right. i don't know why i head the idea that i've read on community project page
15:08 < s7r> that it will not run on virtual machines
15:09 < s7r> however now i know this si false as you have openvpn inside vmware (community project) right ?
15:09 < krzee> oh and i use NAT
15:09 < hyper_ch> krzee: may I ask you something?
15:09 < krzee> as opposed to bridge mode
15:10 < krzee> (for my vmware)
15:10 -!- p3rror [~mezgani@41.140.154.152] has joined #openvpn
15:10 < krzee> hyper_ch, of course
15:10 < hyper_ch> krzee: do you know LastPass and if so, you consider it as safe?
15:11 < krzee> never heard of it
15:11 < krzee> ohhhhh thats not true
15:11 < hyper_ch> it's a password manager browser extension
15:11 < krzee> i think someone here (maybe you?) mentioned it before
15:11 < hyper_ch> I asked the last couple of days all the familiar faces/nicks in here
15:14 < a1fa> hello
15:14 < hyper_ch> hi al
15:14 < hyper_ch> a1fa: 
15:14 < a1fa> :)
15:14 < a1fa> so this is driving me nuts
15:14 < a1fa> my vpn connects then immediatley disconnects
15:15 < hyper_ch> you don't seem to be a nut yet
15:15 < a1fa> and it does that
15:15 < hyper_ch> set a higher verbosity level
15:15 < hyper_ch> for the log
15:16 < a1fa> client or server
15:16 < hyper_ch> both?
15:16 < a1fa> http://pastebin.com/m9GAuZaH
15:20 < a1fa> even in verbose mode
15:20 < a1fa> there is nothign
15:20 < a1fa> verbose 10
15:21 < a1fa> Sat Feb 19 15:20:43 2011 us=718000 Connection reset, restarting [0]
15:21 < a1fa> Sat Feb 19 15:20:43 2011 us=718000 PID packet_id_free
15:21 < a1fa> Sat Feb 19 15:20:43 2011 us=718000 SSL alert (write): warning: close notify
15:21 < a1fa> that'sit
15:21 < krzee> verb 10 is way too high
15:21 < krzee> use verb 5
15:22 < krzee> Feb 19 15:14:52 openvpn[28605]: CLIENT-IP-ADDRESS:5841 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1559', remote='link-mtu 1543'
15:22 < krzee> Feb 19 15:14:52 openvpn[28605]: CLIENT-IP-ADDRESS:5841 WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
15:22 < krzee> that is not good
15:22 < krzee> your configs dont match
15:23 < a1fa> i never had to configure that before
15:23 < krzee> !configs
15:23 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
15:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
15:25 < a1fa> http://pastebin.com/c5kpKs85
15:26 < a1fa> server config
15:26 < a1fa> http://pastebin.com/XBfDk8gk
15:26 < a1fa> client config
15:27 < a1fa> ok
15:27 < a1fa> changing the cifer fixes the problem
15:28 < a1fa> it just does not make sense
15:28 < a1fa> it does not make sense that it would even connect
15:32 < a1fa> thanks krzee
15:33 -!- KevinT [~KevinTrav@69-161-26-211.static.acsalaska.net] has joined #openvpn
15:33 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
15:34 < krzee> np
15:34 < KevinT> im n00b, but Ill ask this anyways: this is my first time setting up an OpenVPN-AS server
15:34 < krzee> alfa
15:35 < krzee> !tcp
15:35 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
15:35 < krzee> KevinT, 
15:35 < krzee> AS gets support from here:
15:35 < krzee> !AS
15:35 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
15:35 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
15:35 < krzee> KevinT, see #4 above
15:36 < KevinT> krzee: ok
15:37 -!- p3rror [~mezgani@41.140.154.152] has quit [Read error: Connection reset by peer]
15:39 -!- KevinT [~KevinTrav@69-161-26-211.static.acsalaska.net] has left #openvpn []
15:40 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:43 < s7r> krzee: 
15:43 < s7r> still there?
15:53 < krzee> yeo
15:56 -!- bba [~bba@93.1.40.113] has quit [Quit: bba]
16:01 -!- s7r [~s7r@ACBE6E8E.ipt.aol.com] has quit [Changing host]
16:01 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
16:03 < krzee> !factoids
16:03 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:04 < EugeneKay> !goatse
16:06 < s7r> gelatine http://www.youtube.com/watch?v=8BZDWpZZbgs :)
16:06 <@vpnHelper> Title: YouTube - Aaliyah Maria Shakes Her Big Ass Booty (at www.youtube.com)
16:09 < krzee> very nice
16:10 < s7r> haha
16:11 -!- Luddha [~ludd@h59ec0024.seluldx.dyn.perspektivbredband.net] has quit []
16:54 -!- K4k_ [~K4k@c-24-98-78-253.hsd1.ga.comcast.net] has joined #openvpn
16:55 -!- k4k [~K4k@c-24-30-28-67.hsd1.ga.comcast.net] has quit [Ping timeout: 240 seconds]
17:01 -!- xindz [karz@bounced.by.nbounce.com] has left #openvpn []
17:02 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
17:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
17:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:48 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has joined #openvpn
17:49 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has left #openvpn []
17:52 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:54 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has joined #openvpn
17:54 < darkdrgn2k3> hey all
17:54 < darkdrgn2k3> stupid question but openvpn is not compatible with an Astaro right?
18:00 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has left #openvpn []
18:07 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has quit [Ping timeout: 250 seconds]
18:08 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has joined #openvpn
18:18 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
19:03 -!- sayuke [~crc@149.171.12.61] has joined #openvpn
19:07 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:08 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:14 -!- zeshoem [~mnathani@bas1-toronto46-1177856283.dsl.bell.ca] has quit []
19:52 < EugeneKay> What the hell is an Astaro
19:56 -!- nickio_ [~nick@78-86-120-249.zone2.bethere.co.uk] has quit [Read error: Connection reset by peer]
19:57 -!- nickio_ [~nick@78-86-120-249.zone2.bethere.co.uk] has joined #openvpn
20:00 -!- dArK_IcE [~lawl@a79-168-163-83.cpe.netcabo.pt] has joined #openvpn
20:00 < dArK_IcE> !goal
20:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:02 < dArK_IcE> I would like to traffic shaping the clients on INGOING traffic
20:02 < dArK_IcE> --shaper n
20:02 < dArK_IcE> Limit bandwidth of outgoing tunnel data to n bytes per second on the TCP/UDP port. If you want to limit the bandwidth in both directions, use this option on both peers.
20:02 < dArK_IcE> both peers? but we cant use --shaper on server right?
20:02 < dArK_IcE> is that possible?
20:03 < EugeneKay> Buy a bigger pipe.
20:04 < dArK_IcE> :(
20:20 -!- dArK_IcE [~lawl@a79-168-163-83.cpe.netcabo.pt] has quit []
20:27 -!- rubin110 [~rubin110@70-36-142-176.dsl.dynamic.sonic.net] has left #openvpn []
21:08 -!- master_of_master [~master_of@p57B53BF6.dip.t-dialin.net] has quit [Ping timeout: 272 seconds]
21:09 -!- master_of_master [~master_of@p57B53F4C.dip.t-dialin.net] has joined #openvpn
21:15 -!- WormDude is now known as WormFood
21:25 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:27 -!- SOG [~SOG@n11649233179.netvigator.com] has quit [Read error: Connection reset by peer]
21:28 -!- SOG [~SOG@n11649233179.netvigator.com] has joined #openvpn
21:29 -!- sayuke [~crc@149.171.12.61] has quit [Ping timeout: 246 seconds]
21:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:40 -!- SOG [~SOG@n11649233179.netvigator.com] has quit [Read error: Connection reset by peer]
21:54 < Essobi> lol
22:02 <@vpnHelper> RSS Update - forum: OpenVPN routing fails, but only sometimes. (windows client) <http://forums.openvpn.net/topic7600.html#p9786>
22:08 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
22:08 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
22:08 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:09 -!- zeshoem [~mnathani@bas1-toronto46-1177856283.dsl.bell.ca] has joined #openvpn
22:10 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Client Quit]
22:11 -!- Kobaz [~kobaz@its.kobaz.net] has joined #openvpn
22:12 < Kobaz> i have a ccd set up so that a client has a fixed ip.. but every time it connects, it gets an ip of a different CN
22:12 < Kobaz> i tried clearing ipp.txt and openvpn-status.log
22:12 < Kobaz> it keeps getting the wrong ip
22:13 < Kobaz> Learn: 10.9.8.6 -> fupa-john/98.113.106.210:47810
22:13 < Kobaz> but yet i have in the ccd/fupa-john: ifconfig-push 10.9.8.8 10.9.8.7
22:14 < Kobaz> i already have a ccd/kyle: ifconfig-push 10.9.8.6 10.9.8.5
22:15 < Kobaz> and openvpn keeps putting fupa-john,10.9.8.4  in ipp.txt
22:15 < Kobaz> so. something is seriously out of wack
22:19 < Kobaz> i turned verb up to 10, and there's no indication as to why it would keep giving out wrong ips
22:19 < Kobaz> it's reading the correct ccd file
22:24 -!- lampliter [~esj@c-76-19-126-1.hsd1.ma.comcast.net] has joined #openvpn
22:25 < lampliter> having problems with open vpn on dd-wrt
22:26 < lampliter>  TCP/UDP: Incoming packet rejected from 80.235.105.142:1024[2], expected peer address: 80.235.105.142:1110 (allow this incoming source address/port by removing --remote or adding --float)
22:26 < lampliter> ideas?
22:26 < Kobaz> add float to your config
22:42 -!- UnterPerro [~UnterPerr@216.246.168.6] has joined #openvpn
22:50 -!- sayuke [~crc@149.171.12.61] has joined #openvpn
22:51 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
22:51 -!- luneff [~yury@84.51.197.93] has joined #openvpn
23:04 < lampliter> hmm.  just add float.  will try
23:10 -!- albech [~thomas@119.42.77.127] has joined #openvpn
23:10 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
23:10 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
23:10 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
23:20 -!- lampliter1 [~esj@c-76-19-126-1.hsd1.ma.comcast.net] has joined #openvpn
23:20 -!- lampliter [~esj@c-76-19-126-1.hsd1.ma.comcast.net] has quit [Read error: Connection reset by peer]
23:22 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
23:23 -!- luneff [~yury@84.51.197.93] has joined #openvpn
23:25 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
23:28 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
23:41 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
23:41 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
23:44 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
23:47 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
--- Day changed Sun Feb 20 2011
00:03 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has joined #openvpn
00:04 < darkdrgn2k3> afternoon
00:04 < darkdrgn2k3> any one know if the astaro's ssl vpn is compatible with openvpn
00:05 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
00:12 -!- luneff [~yury@84.51.197.93] has joined #openvpn
00:13 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
00:15 -!- darth_bitterman [~yury@84.51.197.93] has quit [Ping timeout: 276 seconds]
00:25 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
00:28 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 246 seconds]
00:34 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
00:34 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
00:43 < EugeneKay> From what I can work out, Astaro's "ssl vpn" is simply a renamed OpenVPN
00:44 < EugeneKay> So, yes.
00:46 -!- UnterPerro [~UnterPerr@216.246.168.6] has quit [Quit: UnterPerro lives to save another day]
00:48 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
00:48 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
00:52 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
00:52 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
00:54 < darkdrgn2k3> EugeneKay: thats what i thoguht LOL very cool
00:54 < EugeneKay> FWIW, I absolutely despise security appliances that "automaitcally handle everything"
00:55 < darkdrgn2k3> its what we got
00:56 < darkdrgn2k3> i hate applicance that save things automatically
00:56 < darkdrgn2k3> if you screw up you could lock yourself out
00:56 < EugeneKay> Got a spare 1U you can load up with loonix? :-p
00:57 < darkdrgn2k3> lol naa boss wants to go with a supported platform
00:57 -!- sayuke [~crc@149.171.12.61] has quit [Ping timeout: 240 seconds]
00:58 < EugeneKay> Better value to send you to a class to learn to actually do what the thing claims to do.
00:58 < darkdrgn2k3> hey 
00:58 < darkdrgn2k3> for my datacenter ib uilt my own firewall
00:59 < darkdrgn2k3> hmm
00:59 < EugeneKay> Yeah but you can't get "Certified" from that
00:59 < darkdrgn2k3> "Be sure to enter a maximum of 30 network definitions in the network tab. Otherwise OpenVPN is  unable to start correctly. "
00:59 < darkdrgn2k3> whats it talking about
01:00 < EugeneKay> The former will keep your boss happy
01:00 < EugeneKay> I haven't a clue. Probably some arbitrary Astero restriction.
01:00 < darkdrgn2k3> damit i just did the math
01:00 < darkdrgn2k3> openvpn cant do 80 connections on a tun right?
01:01 < EugeneKay> No reason I know of that it can't
01:01 < EugeneKay> There is a max-clients diretive you can set
01:01 < darkdrgn2k3> right i just have to specify a larger subnet
01:01 < darkdrgn2k3> LOL in their docs -> You can find another good documentation on the OpenVPN team website: http://openvpn.net/index.php/documentation/faq.html 
01:01 <@vpnHelper> Title: FAQ Community (at openvpn.net)
01:15 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
01:15 -!- KevinT [~KevinTrav@69-161-26-211.static.acsalaska.net] has joined #openvpn
01:16 < KevinT> So I set up my server, and I have the following
01:16 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
01:16 < KevinT> 10.0.0.0/8
01:16 < KevinT> 172.16.0.0/12
01:16 < KevinT> 192.168.0.0/16
01:16 < KevinT> but I only have access to 192.168.2.x and not 192.168.3.x
01:16 < KevinT> do I use reverse routes or masquerading?
01:22 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
01:26 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
01:29 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
01:29 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
01:29 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
01:29 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
01:29 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
01:29 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
01:35 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
01:36 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has quit [Ping timeout: 250 seconds]
01:36 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
01:38 -!- darth_bitterman [~yury@84.51.197.93] has quit [Ping timeout: 272 seconds]
01:46 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
01:46 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
01:55 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
01:55 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
02:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:31 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
02:33 -!- lampliter1 [~esj@c-76-19-126-1.hsd1.ma.comcast.net] has left #openvpn []
02:34 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
02:38 < Bushmills> the one who could answer that is you
02:45 < hyper_ch> hi Bushmills
02:50 < Bushmills> 'morning hyper_ch
02:51 < Bushmills> grmbl ... i forgot to take a cable which i could use now with me :(
03:05 < hyper_ch> oh noes
03:05 < hyper_ch> isn't everything wireless nowaday?
03:06 < Bushmills> not my legacy gps
03:07 < hyper_ch> why do you need gps? you are not inside your four walls?
03:07 < Bushmills> i'm on a mobile connection, on a netbook, right now
03:07 < hyper_ch> don't you know the outside world is really, really dangerous?
03:08 < hyper_ch> there are billions and gazillions of viruses that infect people every year
03:08 < hyper_ch> and you can get hit by a car or struck by a lightning
03:08 < hyper_ch> you could get shot
03:08 < Bushmills> but in your 4-wall enclosure, there's radon
03:08 < hyper_ch> a radon?
03:08 < hyper_ch> you have no idea how dangerous the world can be outside
03:08 < Bushmills> no, just radon. seeping in through the walls
03:09 < Bushmills> why do you think i have no idea?
03:09 < hyper_ch> because you use irc
03:10 < Bushmills> no, i don't. have you ever seen me using irc?
03:10 < hyper_ch> yes, all the time
03:10 < hyper_ch> and by using irc you are a nerd
03:10 < Bushmills> you must be mistaken
03:10 < hyper_ch> and nerds don't know how the outside world works
03:11 < Bushmills> that idea is obsolescent, changed since there are mobile devices
03:11 < belZe> >:o
03:18 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
03:21 -!- darth_bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
03:25 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
03:29 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 276 seconds]
03:50 -!- ik_5 [~ik@109.226.17.43] has joined #openvpn
03:50 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
03:51 < ik_5> !welcome
03:51 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:51 < ik_5> !goal
03:51 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:01 < ik_5> hi, I require to connect a cell phone to an asterisk pbx, where the vpn will be on the PBX itself, and in the middle firewall. I can not find a guide that explains how to do so. is there a specific name for what I'm trying to do ?
04:23 <@vpnHelper> RSS Update - forum: Client fails to connect first time when using DDNS <http://forums.openvpn.net/topic7653.html#p9787>
04:40 -!- a1fa1 [~a1fa@24.144.36.244] has joined #openvpn
04:41 -!- a1fa [~a1fa@unaffiliated/a1fa] has quit [Ping timeout: 268 seconds]
04:41 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
04:47 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
05:05 <@vpnHelper> RSS Update - forum: One allowed connection per IP, last one closes older attempt <http://forums.openvpn.net/topic7658.html#p9788>
05:11 <@vpnHelper> RSS Update - forum: source ip address of all traffic via openvpn tunnel <http://forums.openvpn.net/topic7659.html#p9790> || CCD directory is not being recogonized <http://forums.openvpn.net/topic7656.html#p9789>
05:14 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 272 seconds]
05:17 -!- EugeneKay is now known as EugeneKaway
05:18 -!- EugeneKaway is now known as EugeneKay
05:20 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:23 <@vpnHelper> RSS Update - forum: route all client's traffic via single client ip <http://forums.openvpn.net/topic7660.html>
05:24 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
05:26 -!- zeshoem [~mnathani@bas1-toronto46-1177856283.dsl.bell.ca] has quit [Ping timeout: 276 seconds]
05:32 -!- zeshoem [~mnathani@bas1-toronto46-1279266471.dsl.bell.ca] has joined #openvpn
05:32 -!- zeeshoem [~mnathani@bas1-toronto46-1279266471.dsl.bell.ca] has joined #openvpn
05:43 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
06:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
06:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:19 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
06:19 -!- EugeneKay is now known as EugeneKaway
06:30 <@vpnHelper> RSS Update - forum: appliance woking : You do not have Administrative permission <http://forums.openvpn.net/topic7661.html>
06:30 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
06:30 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
07:29 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
07:30 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
07:30 < Fleck> TLS Error: unrouteable control packet received from... any ideas?
07:31 < Fleck> clocks are in sync! :)
07:35 -!- luneff [~yury@84.51.197.93] has joined #openvpn
07:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
07:51 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
07:53 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
07:53 -!- ik_5 [~ik@109.226.17.43] has left #openvpn ["Leaving"]
07:54 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
07:56 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
08:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Operation timed out]
08:01 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:06 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
08:07 -!- ChUbB [~IceChat7@cpc2-aztw12-0-0-cust229.aztw.cable.virginmedia.com] has joined #openvpn
08:09 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
08:09 < ChUbB> can someone point me in the right direction, i want to stop some clients from connecting, i am running openvpn with no gui front end
08:13 < reiffert_> !crl
08:13 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
08:13 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
08:17 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has joined #openvpn
08:19 < ChUbB> I want it so i can disable/enable users at will, would that work ?
08:20 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
08:23 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
08:25 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
08:28 -!- darth_bitterman [~yury@84.51.197.93] has quit [Quit: Leaving]
08:49 -!- dArK_IcE [~lawl@a79-168-163-83.cpe.netcabo.pt] has joined #openvpn
08:49 < dArK_IcE> I would like to traffic shaping the clients on INGOING traffic
08:49 < dArK_IcE> --shaper n
08:49 < dArK_IcE> Limit bandwidth of outgoing tunnel data to n bytes per second on the TCP/UDP port. If you want to limit the bandwidth in both directions, use this option on both peers.
08:49 < dArK_IcE> both peers? but we cant use --shaper on server right?
08:49 < dArK_IcE> is that possible?
08:57 < reiffert_> on linux it's possible.
08:57 < reiffert_> http://lartc.org see imq
08:57 <@vpnHelper> Title: Linux advanced Routing & Traffic Control HOWTO (at lartc.org)
09:04 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
09:05 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
09:06 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
09:18 -!- zeeshoem [~mnathani@bas1-toronto46-1279266471.dsl.bell.ca] has quit []
09:33 < dArK_IcE> reiffert_ thx
09:34 < dArK_IcE> Yeah, i was asking about openvpn options
09:34 < dArK_IcE> i thought it was possible
09:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
09:47 -!- dArK_IcE [~lawl@a79-168-163-83.cpe.netcabo.pt] has quit []
10:08 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
10:08 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
10:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:28 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
10:47 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
10:48 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
10:57 -!- a1fa1 [~a1fa@24.144.36.244] has left #openvpn []
11:04 -!- VisionNL [~anonymous@tuig.nikhef.nl] has joined #openvpn
11:05 < VisionNL> !book
11:05 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
11:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
11:33 -!- albech [~thomas@119.42.77.127] has quit [Quit: Ex-Chat]
11:34 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:01 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:32 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
12:34 -!- ChUbB [~IceChat7@cpc2-aztw12-0-0-cust229.aztw.cable.virginmedia.com] has quit [Quit: Beware of programmers who carry screwdrivers.]
12:34 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
12:38 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
12:40 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
12:47 < Kobaz> i have a ccd set up so that a client has a fixed ip.. but every time it connects, it gets an ip of a different CN.  i tried clearing ipp.txt and openvpn-status.log, it keeps getting the wrong ip
12:47 < hyper_ch> Kobaz: config?
12:48 < Kobaz> i have in the ccd/fupa-john: ifconfig-push 10.9.8.8 10.9.8.7
12:48 < Kobaz> but the CN fupa-john keeps getting 10.9.8.6
12:48 < Kobaz> i already have a ccd/kyle: ifconfig-push 10.9.8.6 10.9.8.5
12:49 < Kobaz> http://pastebin.com/qf3M0h8b my ovpn config
12:49 < Kobaz> from the server side
12:49 < hyper_ch> I tend to think you juse use the wrong keyfile
12:49 < Kobaz> i even regenerated the key file
12:50 < Kobaz> when i see the client connect in the server log, it connects with the CN fupa-john
12:50 < hyper_ch> try:   ifconfig-push 10.9.8.8 10.9.8.9
12:50 < Kobaz> i turned verb up to 10, and there's no indication as to why it would keep giving out wrong ips, it's even reading the correct ccd file
12:50 < hyper_ch> and sometimes you have to use higher ips
12:50 < Kobaz> i've never had any issue with using any ips other than .1/.2 and .255/.254
12:52 < Kobaz> every single one of my other openvpn servers i use subnet.evennumber subnet.evennumber-1
12:53 < Kobaz> i changed it do 10.9.8.8 10.9.8.9... no change on the client
12:53 < Kobaz> it's like it's not reading that file, and it's using a different one
12:53 < Kobaz> i should run strace on openvpn
12:54 < Fleck> ns-cert-type client << i have this in server config - is that OK?
12:54 < Kobaz> ooooh
12:54 < Kobaz> open("msm-server/ccd/fupa-john", O_RDONLY) = -1 EACCES (Permission denied)
12:54 < Kobaz> that would be a problem
12:54 < Kobaz> strace ftw
12:55 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:56 < Kobaz> yay
12:56 < Kobaz> fixed
12:56 < Kobaz> now i have another weird weird problem that i fixed by generating all my certs and keys
12:57 < Kobaz> but i had a server with cert A, but it wouldn't allow connections from clients using cert A, only cert B would work
12:57 < Kobaz> so only if the certs were different, would it allow a client to connect
12:57 < Kobaz> i thought the whole point of all this public key stuff was everything had to match
12:57 < hyper_ch> Fleck: depends on what you want to do
12:58 < hyper_ch> Kobaz: I'm not following you
12:58 < Kobaz> it was allowing a client to connect with an incorrect ca.crt
12:58 < Kobaz> but only that incorrect ca.crt would work
12:58 < Kobaz> if i made the ca.crt's match on the client and server, i couldn't make them connect
12:58 < hyper_ch> !howto
12:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:59 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has joined #openvpn
12:59 < hyper_ch> Kobaz: follow this http://openvpn.net/index.php/open-source/documentation/howto.html#pki --> it tells you how to generate the certs and where to put them
12:59 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:59 < Kobaz> hyper_ch: I don't need a howto, i've been using openvpn for 5+ years... this is a bug
12:59 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
12:59 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
12:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:00 < hyper_ch> as you say
13:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 246 seconds]
13:00 < Kobaz> if the ca.crt's do not match on the client and server, it should not allow that client to connect due to cert mismatch
13:01 < Kobaz> it might have had something to do with using a vulnerable debian generated certs and keys
13:13 -!- KevinT [~KevinTrav@69-161-26-211.static.acsalaska.net] has left #openvpn []
13:23 < Fleck> hyper_ch well i have selected X.509 certificate for
13:23 < Fleck> vpn server
13:24 < Fleck> and i have .pem file ca... for server
13:24 < Fleck> but not for clients
13:26 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
13:26 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
13:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
13:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:34 < Dropje> evening all.. my co-worker and me have setup learn-address to apply dynamic access policy's.. When Windows clients send a disconnect evertything works fine and the script deletes the iptables rule after 30 seconds.. On Linux clients (using console or the network-manager) it takes about 5 minutes for the server to see a client disconnect and run the client-disconnect script (which deletes te iptables rule). Is there a way to speed this up? To
13:35 < darkdrgn2k3> hey 
13:35 < darkdrgn2k3> whats the differnce bettwen a "site to sitE" vpn and a remote access vpn
13:35 < Fleck> !auth
13:35 < Fleck> !factoids search auth
13:35 <@vpnHelper> 'authpass' and 'tls-auth'
13:35 < Fleck> !authpass
13:36 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
13:36 < darkdrgn2k3> was that to me?
13:36 < Dropje> site to site means a permanent connection between two sites.. 
13:36 < Fleck> no ;)
13:36 < darkdrgn2k3> oh ok :-P
13:36 < darkdrgn2k3> ok well
13:36 < Dropje> pushing eachothers subnets so it seems like your always in the same network
13:37 < darkdrgn2k3> wonder if you can do both at the same time
13:37 < darkdrgn2k3> i got 80 remote offices (1 person offices) with a dynamic connnection
13:37 < Dropje> why not :)?
13:37 < darkdrgn2k3> which setup would be the best you think
13:37 < Dropje> what do you mean with 80 remote offices?
13:38 < Dropje> 80 clients/users or 80 different offices?
13:38 < darkdrgn2k3> well nhere is the layout
13:38 < darkdrgn2k3> we have a new ASTARO firewall installed at the head office
13:38 < darkdrgn2k3> i have 80 offices currently (1-2 people per offices) across the country that are just running of a dsl connection
13:38 < darkdrgn2k3> i want to connect them back to head offices
13:38 < Fleck> !factoids search binary
13:38 <@vpnHelper> No keys matched that query.
13:39 < Fleck> !factoids search file
13:39 <@vpnHelper> 'pwfile' and 'logfile'
13:39 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
13:39 < Fleck> !pwfile
13:39 < darkdrgn2k3> astaro seems to have openvpn as their "SSL VPN"
13:39 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
13:39 < Fleck> where can i download windows binary with --enable-password-save ?
13:39 < darkdrgn2k3> so im thinking of buying a bunch of asus RT-N10 or similar, load it with openwrt and openvpn
13:39 < darkdrgn2k3> and distribute them to create a managable network
13:40 < darkdrgn2k3> not sure what the best way to do it would be
13:41 < darkdrgn2k3> "site to site" vpn or remote access vpn
13:41 < Dropje> hmm dunno tbh.. I think i would prefer separte client access since you only have 1 or 2 employees per office
13:42 < Dropje> also its more manageable and accountable to have it like that
13:42 < darkdrgn2k3> thats what im thinking 
13:42 < Dropje> but it really depends.. i wouldnt want like 10 offices with 100 employees each having there own user certs etc..
13:42 < Dropje> you would want to have site to site access in that case
13:43 < darkdrgn2k3> i wodner if i could just deploy certs on the routers...
13:43 < darkdrgn2k3> kinda a site to site network but use "users"
13:44 < Dropje> i know what you mean but i cant really advise you on hardware that supports that
13:44 < Dropje> also i wouldnt prefer that security wise
13:45 < Dropje> it would mean that there are wireless networks (prolly not WPA-Enterprise secured) all over the place connecting to you main company
13:45 < Fleck> ecrist online?
13:45 < ecrist> aye
13:45 < Fleck> https://forums.openvpn.net/topic7093.html
13:45 <@vpnHelper> Title: OpenVPN Support Forum Automatically fill in username and password : Authentication Scripts (at forums.openvpn.net)
13:46 < Fleck> where can i dowload one binary? :)
13:46 < Fleck> with --enable-password-save ?
13:46 < Fleck> for windows
13:46 < darkdrgn2k3> Dropje: we dont use wifi
13:46 < ecrist> Fleck: we don't have one, yet
13:47 < Fleck> ;(
13:47 < ecrist> when we release 2.2-RC, the windows build will have that feature enabled.
13:47 < Fleck> and that will be?
13:47 < Fleck> after?
13:47 < darkdrgn2k3> any idea how to use a ASTARO config file lol
13:47 < ecrist> Fleck: probably this week.
13:47 < Fleck> ecrist!!! :)
13:47 < Dropje> darkdrgn2k3: well if thats not the case i would say do as you prefer.. to have a more manageable and accountable setup use remote access.. for convenience (new ppl joining every day or so) i would say site to site
13:48 < ecrist> we're just waiting on jamesyonan to sign the packages and post them
13:48 < Fleck> ook
13:48 < Fleck> waiting.... for that pack :)
13:48 < ecrist> either that, or we're waiting on mattock or dazo to merge the build system patches
13:48 < Dropje> darkdrgn2k3: also if you want to push the local offices's subnets site to site prolly would be easier for the user
13:49 < ecrist> !iroute
13:49 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
13:49 < Dropje> ecrist: could you read up a bit and check my question :p? seems like i drifted off
13:50 < ecrist> Dropje: 
13:50 < ecrist> !ubuntu
13:50 <@vpnHelper> "ubuntu" is dont use network manager!
13:50 < ecrist> we strongly recommend against network manager
13:50 < Dropje> i use fedora ;)
13:50 < Dropje> but its not only networkmanager
13:51 < Dropje> its also when sending a SIGINT in console
13:52 < Dropje> ecrist: i just want the OpenVPN daemon to kill the client faster
13:52 < Dropje> ecrist: we also had some problems with ppl putting their computers in stand-by without quitting the vpn connection.. this resulted in OpenVPN keeping the connection open
13:52 < Fleck> ecrist why?
13:52 < ecrist> --client-disconnect
13:53 < Fleck> i am using network manager... works great :/
13:53 < ecrist> Fleck: because we don't like troubleshooting problems with XYZ openvpn wrapper
13:53 < Fleck> yeah thats correct
13:57 < Dropje> ecrist: will --client-disconnect work since the VPN daemon does not receive a shutdown message?
13:58 < ecrist> it should, but it may take as long as your keepalive ping timeout
13:59 < Dropje> ecrist: ok cool, gonna experiment with that..
14:05 < darkdrgn2k3> if i have the 3 config files for the client (crt key and cacert) how can i tell the diff between them
14:05 < darkdrgn2k3> ie how can i ditnfiy which one is whihc
14:06 < ecrist> open them and read them
14:06 < darkdrgn2k3> ecrist: how do i read them
14:06 < darkdrgn2k3>     ca_cert
w  -----BEGIN RSA PRIVATE KEY-----
14:06 < darkdrgn2k3> MIICWwIBAAKBgQDUbYdN13ridIzQBPI2+pin2G9DFaJ7Ysqkxe1sDtpUOvOphgXS....
14:09 < darkdrgn2k3> nm foudn it
14:09 < darkdrgn2k3> whats better
14:09 < darkdrgn2k3> udp or ctp
14:09 < darkdrgn2k3> tcp
14:09 < Fleck> ecrist btw, for win binary - woulde be great to deny user pass anyway without for example config option: i-understand-the-risk-and-whant-to-store-password-in-file or something like that :D
14:10 < Fleck> darkdrgn2k3 udp is faster... at least here... :)
14:10 < Fleck> so i prefer udp
14:11 < darkdrgn2k3> hmm
14:11 < darkdrgn2k3> Sun Feb 20 15:11:01 2011 TLS_ERROR: BIO read tls_read_plaintext error: error:140 90086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
14:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:35 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:36 < darkdrgn2k3> any one know if --enable-password-save is enabled in windows?
14:36 < darkdrgn2k3> default  pacakge
14:43 -!- majuk_ [~majuk@cpe-70-112-3-105.austin.res.rr.com] has joined #openvpn
14:45 < Fleck> darkdrgn2k3 LOL read our conversation with ecrist :)
14:47 < majuk_> If I use route directives to add routes to subnetA which is on the local LAN of clientA... those clients need to have addresses in that range for this to work? Furthermore, if I also give clientA a server and have the local-side users VPN to it with addresses in that subnet, will that work?
14:48 < majuk_> yes/no/heyshutup are all acceptable answers.
14:50 < Bushmills> "for this to work"  .. that "this" refers to "If I use route directives"?   #
14:51 < majuk_> Right, so routing between clientA's group and clientB's group
14:51 < Bushmills> though what the "work" refers to i can only guess
14:52 < majuk_> Basically, I'd like to not futz with the addressing already on clientA's group, so it would be handy if I could give them all virtual addresses on another VPN and then tell the central server about it through routes
14:53 < majuk_> Just wondering if anyone has any input as to how/if that will work before I start banging my head against it.
14:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
14:53 < Bushmills> now i try to draw a connection between "local side users" and "VPN"
14:54 < majuk_> Is this your idea of asking questions?
14:54 < Bushmills> you local users will walk to clientA where they have VPN connectivity?
14:55 < majuk_> They have a network connection. ClientA is both a client and a server. So they connect to ClientA, get a virtual address which I am hoping I can then point to with route statements from the central server
14:56 < majuk_> My local comps only have network visibility to clientA, not out to the WAN
14:56 < majuk_> Hence the need.
14:56 < Bushmills> ah. the users run server, which is the remote VPN end, from point of view of VPN client on ClientA
14:57 < darkdrgn2k3> how big can an image be for a 4 meg flash chip
14:58 < Bushmills> with appropriate magnification, i'd say two square meters.
14:58 -!- arosen [~arosen@130.127.39.173] has joined #openvpn
14:59 -!- arosen [~arosen@130.127.39.173] has left #openvpn []
14:59 < darkdrgn2k3> Bushmills: wa wa waaaa...
15:00 < darkdrgn2k3> wrong channel :-P
15:02 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Remote host closed the connection]
15:04 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
15:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:06 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
15:06 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:08 < majuk_> Bushmills, No. But thanks, I guess.
15:09 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:09 < ecrist> I wouldn't listen to him, krzee's a bitch.
15:10 < majuk_> Ooooo, burn./
15:19 <@vpnHelper> RSS Update - forum: source ip address of all traffic via openvpn tunnel <http://forums.openvpn.net/topic7659.html#p9793>
15:20 < krzee> way too faded to talk shit back
15:21 < krzee> need sleep
15:22 -!- mengu [~Death@unaffiliated/mengu] has joined #openvpn
15:22 < mengu> hi. how can i find out if vpn is connected to the network?
15:29 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
15:36 < dvl> I find the muffled *clunk-clunk* sound from the basement rather reassuring.
15:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
15:38 < ecrist> mengu: what do you mean?
15:39 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has quit [Ping timeout: 246 seconds]
15:42 < s7r> what's the link for openvpn lists?
15:42 < s7r> users ?
15:42 < ecrist> !mailinglist
15:42 < ecrist> !list
15:42 <@vpnHelper> Admin, BadWords, Channel, ChannelLogger, Config, Factoids, FloodPrevent, Google, Misc, Owner, Relay, Seen, Services, User, and Web
15:42 < ecrist> !factoids search mail
15:42 <@vpnHelper> "mail" is (#1) http://sourceforge.net/mail/?group_id=48978, or (#2) http://news.gmane.org/gmane.network.openvpn.user for the openvpn-users archive
15:42 < ecrist> there you go
15:43 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has joined #openvpn
15:43 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has quit [Changing host]
15:43 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
15:43 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
15:45 < s7r> thx
15:46 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
15:52 -!- nickio_ [~nick@78-86-120-249.zone2.bethere.co.uk] has quit [Quit: Leaving]
15:52 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
15:56 -!- EugeneKaway is now known as EugeneKay
15:56 < EugeneKay> !factoids search bacon
15:56 <@vpnHelper> No keys matched that query.
16:00 < krzee> http://www.funnyjunk.com/funny_pictures/1112420/Bacon+bra/
16:01 <@vpnHelper> Title: Bacon bra (at www.funnyjunk.com)
16:01 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:06 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has joined #openvpn
16:08 -!- dorp [~dorp@173.0.50.133] has joined #openvpn
16:08 < dorp> !nat
16:08 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
16:08 < dorp> !linnat
16:08 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
16:08 < dorp> !openvzlinnat
16:08 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
16:09 < dorp> common guys, who has access to add a comment to the bot?
16:26 < krzee> what?
16:26 < krzee> i saw what you said, but thats not needed for openvz, its actually part of !linnat
16:27 < krzee> it worked for your goal, it is not the only way to do it, and is certainly not openvz specific
16:27 < krzee> and since its a combo of #1 and #2 in !linnat i didnt bother adding it again
16:27 < krzee> am i missing something...? i dont use openvz
16:29 < dorp> krzee: when I had issues with my vps, I been told to use !openvzlinnat 's "iptables -t nat .... *" ... so it was a wrong suggestion?
16:31 < krzee> you definitely needed NAT
16:31 < krzee> but it didnt have to necesarily define the IP to nat as
16:31 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
16:31 < krzee> and even if you did have to, that info is already in !linnat
16:32 < krzee> what you are saying to add is already in !linnat
16:32 < dorp> krzee: I see. I was under the assumption that 'vps' users should use !openvzlinnat 
16:32 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
16:33 < krzee> well its important info for them to be aware of
16:33 < krzee> but the NAT command itself actually CANT be done by the user, must be done by the admin
16:33 < krzee> " since openvz cant do NAT inside containers"
16:34 < dorp> krzee: I actually thought it meant that "since it can't ... this is a workaround..." kind of deal, I guess it's my bad
16:35 < krzee> well you tell me, were you able to make it work by adding that to the container itself?
16:36 < dorp> krzee: I don't have access to the container, only to the VE
16:36 < krzee> i dont use openvz but from reading and helping people with it im pretty sure you must have done it on the host machine
16:36 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:36 < krzee> so you added the NAT in the virtual machine?
16:36 < dorp> yes, I tried to add the PREROUTING ... DNAT
16:37 < krzee> and it worked?
16:37 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
16:38 < dorp> (which failed... then after a couple of days of trying to understand what I did wrong... (Because other VEs failed as well)... I came to realize that: POSTROUTING .. SNAT ... works
16:38 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
16:38 < dorp> )
16:38 < krzee> interesting
16:38 < krzee> ok gimme the command that worked for you, ill add it in case it helps someone
16:39 < dorp> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP>
16:39 < dorp> This one
16:39 < krzee> info from a link that i had in !openvznat before said that wouldnt work
16:39 < krzee> but if it did for you, thats what counts!
16:40 < krzee> !learn openvznat as a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP>
16:40 <@vpnHelper> Joo got it.
16:40 < dorp> heh, you can add it as an alternative or something... so people would try both ways
16:40 < dorp> just you guys wasted so much time to help me with my faulty tunnel... I thought the least I could do is to make sure future users won't waste the same time over again
16:43 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
16:45 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has quit [Quit: Leaving]
16:47 -!- luneff [~yury@84.51.197.93] has joined #openvpn
16:47 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
16:51 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:02 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
17:03 -!- Fleck [~we@unaffiliated/fleck] has quit [Read error: Operation timed out]
17:05 -!- snapcase [~snapcase@soundwave.snapcase.net] has quit [Ping timeout: 276 seconds]
17:21 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has quit [Ping timeout: 264 seconds]
17:25 -!- rolls` [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
17:25 -!- rolls` [~rollin@190.120.228.48] has joined #openvpn
18:00 < majuk_> So, I see my server giving out "dhcp-option DNS ###.###.###.###" command to clients, but their resolv.conf doesn't update.
18:01 < reiffert_> it's not up to openvpn to handle/update resolv.conf
18:02 < reiffert_> but openvpn allows 3rd party software (scripts) to update it.
18:03 < majuk_> So i need to have a script to intercept that option?
18:03 < majuk_> hmm.
18:06 < EugeneKay> majuk_ - you need to fiddle with your OS's dhclient
18:06 < reiffert_> Right. I think for OS X there is such a thing, as well as for Debian Linux
18:07 < majuk_> kk, i'll look into it
18:07 < reiffert_> http://www.google.de/search?q=linux+openvpn+resolv.conf
18:07 <@vpnHelper> Title: linux openvpn resolv.conf - Google-Suche (at www.google.de)
18:08 < reiffert_> http://www.subvs.co.uk/openvpn_resolvconf
18:08 <@vpnHelper> Title: openvpn and resolv.conf | SubVS.co.uk (at www.subvs.co.uk)
18:09 < reiffert_> majuk_: the major reason for this to be is the different handling for nameservers on the different OS. E.g. on OS X you can have a separate nameserver on a per domain basis.
18:15 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 268 seconds]
18:27 < majuk_> Ugh, I hate feeling like I need hand-holding.
18:27 < majuk_> Particularly when I've had this amount of caffiene.
18:45 -!- dorp [~dorp@173.0.50.133] has quit [Ping timeout: 250 seconds]
19:02 < majuk_> Mmmk, so I added the script up and down calls to client.conf and resolv.conf still doesn't update. The script is executable...? Not sure what I'm missing.
19:02 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:04 -!- luneff [~yury@84.51.197.93] has quit [Quit: Leaving]
19:23 -!- dferris [~dferris@216-243-150-87.static.iphouse.net] has left #openvpn []
19:28 -!- sayuke [~crc@149.171.13.50] has joined #openvpn
19:37 -!- adc__ [~client@basil.andriss.com] has joined #openvpn
19:37 < Bushmills> read log - it says something about script-security
19:40 -!- sayuke [~crc@149.171.13.50] has quit [Ping timeout: 240 seconds]
20:15 < adc__> !welcome
20:15 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:17 < adc__> !goal
20:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:19 < adc__> !sample
20:19 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
20:19 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
20:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:19 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
20:21 < adc__> hmm, so does #openvpn cover openvpn-as
20:25 < ecrist> no
20:25 < ecrist> !as
20:25 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
20:25 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
20:32 < adc__> my openvpn-as server is working, doing all that it needs to do, but it seems that neither this channel nor the forum covers it
20:32 < adc__> I guess the idea is you must go through official channels for everything?
20:34 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Ping timeout: 260 seconds]
20:34 < majuk_> Bushmills, Nah, I've got script-secuirty set at 2. No warning about not being able to call the script
20:34 -!- caesay [~caesay@173.236.15.70] has joined #openvpn
20:34 < majuk_> In fact, it warns me it /will/ be able to exec scripts.
20:35 -!- caesay is now known as Guest69789
20:36 < majuk_> set script-security to 3, no change. :|
20:37 -!- snapcase [~snapcase@soundwave.snapcase.net] has joined #openvpn
20:38 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 250 seconds]
20:38 < adc__> !wiki
20:38 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN, or (#2) Official wiki is at https://community.openvpn.net/openvpn/wiki
20:41 < adc__> so openvpn-as requires use licenses to use, but the openvpn 2.1.x or 2.2x does not?
20:42 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
20:42 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
20:42 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:53 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
21:07 -!- master_of_master [~master_of@p57B53F4C.dip.t-dialin.net] has quit [Ping timeout: 272 seconds]
21:09 -!- master_of_master [~master_of@p57B53878.dip.t-dialin.net] has joined #openvpn
21:18 -!- adc__ [~client@basil.andriss.com] has left #openvpn []
21:36 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
21:39 -!- WinstonSmith [~true@e177091216.adsl.alicedsl.de] has joined #openvpn
21:52 -!- albech [~thomas@119.42.77.127] has joined #openvpn
22:12 -!- reiffert_ is now known as reiffert
22:38 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
22:38 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
22:38 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:52 -!- albech_ [~thomas@119.42.77.127] has joined #openvpn
22:56 -!- albech [~thomas@119.42.77.127] has quit [Ping timeout: 276 seconds]
23:03 -!- kisom [~x@c-d0dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
23:12 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has joined #openvpn
23:28 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
23:35 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
23:39 -!- WinstonSmith [~true@e177091216.adsl.alicedsl.de] has left #openvpn ["Ex-Chat"]
--- Day changed Mon Feb 21 2011
00:15 -!- Deathzor [~deathtje@216.67.225.106] has quit [Ping timeout: 250 seconds]
00:17 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:23 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
00:25 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
00:59 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:01 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:04 -!- cj [~cjac@adsl-207-32-175-127.rockisland.net] has quit [Ping timeout: 240 seconds]
01:10 -!- cj [~cjac@adsl-207-32-175-127.rockisland.net] has joined #openvpn
01:10 -!- Deathzor [~deathtje@216.67.225.106] has quit [Ping timeout: 264 seconds]
01:17 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
01:27 <@vpnHelper> RSS Update - forum: Client fails to connect first time when using DDNS <http://forums.openvpn.net/topic7653.html#p9794>
01:33 -!- mengu [~Death@unaffiliated/mengu] has left #openvpn []
01:33 <@vpnHelper> RSS Update - forum: source ip address of all traffic via openvpn tunnel <http://forums.openvpn.net/topic7659.html#p9796> || route all client's traffic via single client ip <http://forums.openvpn.net/topic7660.html#p9795>
01:36 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
01:39 <@vpnHelper> RSS Update - forum: OpenVPN routing fails, but only sometimes. (windows client) <http://forums.openvpn.net/topic7600.html#p9797>
01:45 <@vpnHelper> RSS Update - forum: CCD directory is not being recogonized <http://forums.openvpn.net/topic7656.html#p9798>
01:48 -!- dorp [~dorp@173.0.50.133] has joined #openvpn
02:00 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
02:01 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
02:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
02:03 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:24 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
02:26 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 240 seconds]
02:28 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:31 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
02:38 -!- Bogdar [~bogdan@86.57.155.90] has joined #openvpn
02:38 < Bogdar> Hello!
02:38 < Bogdar> Is it possible to 'bind' specified IP to some celient (certificate) name ?
02:39 < Bogdar> For now, sometime IP moves from host to host which cause lot of toubles with FW
02:43 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:43 -!- mode/#openvpn [+o mattock] by ChanServ
02:44 -!- Guest73950 [~dafdc@net-188-218-143-218.cust.dsl.vodafone.it] has joined #openvpn
02:44 -!- Guest73950 [~dafdc@net-188-218-143-218.cust.dsl.vodafone.it] has quit [Client Quit]
02:55 -!- dorp [~dorp@173.0.50.133] has quit [Ping timeout: 240 seconds]
02:59 -!- albech_ [~thomas@119.42.77.127] has quit [Ping timeout: 240 seconds]
02:59 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
03:00 -!- Multiply_ [535fd8d5@gateway/web/freenode/ip.83.95.216.213] has joined #openvpn
03:01 -!- Multiply_ is now known as Multiply
03:02 -!- albech_ [~thomas@124.157.245.126] has joined #openvpn
03:09 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
03:10 -!- raw__ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 276 seconds]
03:15 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
03:34 -!- dazo_afk is now known as dazo
03:35 -!- Multiply [535fd8d5@gateway/web/freenode/ip.83.95.216.213] has quit [Ping timeout: 245 seconds]
03:36 -!- dorp [~dorp@195.210.186.130] has quit [Ping timeout: 240 seconds]
03:38 -!- Multiply [~Multiply@unaffiliated/multiply] has joined #openvpn
03:41 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
03:41 -!- dorp [~dorp@195.210.186.130] has quit [Client Quit]
03:41 -!- dorp [~dorp@195.210.186.130] has joined #openvpn
03:41 -!- dorp [~dorp@195.210.186.130] has left #openvpn []
03:43 < Multiply> !wins
03:43 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
03:45 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
03:45 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
03:45 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:45 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 240 seconds]
03:45 < Bushmills> !tunortap
03:45 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
03:45 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
03:45 < Bushmills> #2
03:47 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
03:49 -!- mode/#openvpn [+o janjust] by ChanServ
03:53 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Operation timed out]
03:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:56 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Quit: ☃]
03:56 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
03:57 -!- Multiply [~Multiply@unaffiliated/multiply] has quit [Ping timeout: 272 seconds]
03:57 <@vpnHelper> RSS Update - forum: Windows 7, strange issues. <http://forums.openvpn.net/topic7654.html#p9799>
04:04 <@vpnHelper> RSS Update - forum: cannot ping server <http://forums.openvpn.net/topic7655.html#p9801> || One allowed connection per IP, last one closes older attempt <http://forums.openvpn.net/topic7658.html#p9800>
04:04 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
04:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
04:10 -!- Multiply_ [~Multiply@unaffiliated/multiply] has joined #openvpn
04:14 < Multiply_> What I want: Samba and OpenVPN server on the same machine. Windows clients using windows shares, connecting up against OpenVPN, and then to samba, thru the VPN. I have Samba working locally on the server, and OpenVPN connects just fine, and I can ping 10.8.0.1 successfully. (My client IP is 10.8.0.6) - I just can't access \\10.8.0.1 or \\servername or anything similar. I can access these 
04:14 < Multiply_> locally on the server thru smbclient tho.
04:15 <@janjust> Multiply_:  this sounds more like a Samba issue... did you add the right IP range and/or interface to the smb.conf to allow access from the VPN ?
04:16 < Multiply_> I tried 10.8.0.0/24, and even without it in samba.
04:16 <@janjust> what happens if you try to telnet to port 139 (or 445) from a VPN client?
04:17 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:17 < Multiply_> using PuTTy - Network error: Invalid argument
04:17 < Multiply_> On both ports
04:18 -!- Multiply_ is now known as Multiply
04:21 < Multiply> janjust: I tried setting interfaces to 10.8.0.0/24 again, but it didn't change anything.
04:21 < Multiply> janjust: And I just tested ssh thru the VPN, and it works like a charm.
04:22 <@janjust> if SSH to the Samba server works then it's not really an OpenVPN issue
04:22 <@janjust> but a Samba issue ; is there a firewall on the server blocking access to tcp ports 139 or 445?
04:22 <@janjust> do you have 'nmap' on the clients? can you run an nmap scan ?
04:23 < Multiply> There should be no firewalls setup. I don't know about nmap tho.
04:24 < Multiply> http://paste2.org/p/1259198 <- It says IPv6 I don't know if that means anything? :P
04:25 <@janjust> hmmm that should not matter too much, it should also allow IPv4 connections; you might wanna try binding smbd to IPv4 though (but then again, this is off-topic for this channel)
04:26 < Multiply> I just checked on my own server I setup like a year ago, and it says IPv6 too, which works on IPv4, so it's not that.
04:26 <@vpnHelper> RSS Update - forum: Client fails to connect first time when using DDNS <http://forums.openvpn.net/topic7653.html#p9802>
04:26 < Multiply> I'll try to head to the other channel and see if you know something.
04:26 < Multiply> Thanks for the help, janjust :)
04:27 <@janjust> np
04:33 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:33 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:34 -!- raomin_ [~romain@86.66.22.65] has quit [Quit: leaving...]
04:50 <@janjust> Multiply:  just out of curiousity: what happens if you add a line 'interfaces = lo eth0 tun0' to the smb.conf file and then restart smbd?
04:52 < Multiply> janjust, I'll try.
04:52 <@janjust> (provided that tun0 is your vpn adapter on the server)
04:53 < Multiply> I don't think I made one, actually.
04:53 < Multiply> There's only lo and eth0
04:54 < EugeneKay> The lo interface always reminds me of baby birds eating their mother's regurgitate.
04:54 <@janjust> if you're running only one openvpn server and you're using 'mode tun' then 'tun0' is your server adapter; you can verify using 'ifconfig' or by looking at the server logs
04:57 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:57 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:58 < Multiply> It's tun0 indeed
04:59 < Multiply> I just found out the server is using xidentd, but I don't know if that complicates things
05:00 < Multiply> xinetd*
05:00 <@janjust> nope should not matter
05:00 <@janjust> something is blocking access to ports 139 or 445 via the VPN - that needs to be resolved first
05:02 < Multiply> I really can't see what I'm doing wrong.
05:10 -!- WormFood [~wormfood@183.39.81.213] has quit [Read error: Connection reset by peer]
05:11 -!- WormFood [~wormfood@183.38.237.195] has joined #openvpn
05:14 <@vpnHelper> RSS Update - forum: Two-factor authentication with PKCS11 <http://forums.openvpn.net/topic7662.html>
05:29 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
05:47 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Quit: ☃]
05:50 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 240 seconds]
05:53 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
05:54 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
06:00 -!- Multiply [~Multiply@unaffiliated/multiply] has quit []
06:01 -!- maxJadi [~maxJadi@dhcp-166-10.nomad.chalmers.se] has joined #openvpn
06:01 -!- maxJadi [~maxJadi@dhcp-166-10.nomad.chalmers.se] has quit [Changing host]
06:01 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:02 <@vpnHelper> RSS Update - forum: Two-factor authentication with PKCS11 <http://forums.openvpn.net/topic7662.html#p9804>
06:06 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
06:10 -!- grapsus [~grapsus@acces1094.res.insa-lyon.fr] has joined #openvpn
06:12 < Dropje> !ubuntu
06:12 <@vpnHelper> "ubuntu" is dont use network manager!
06:13 < reiffert> :)
06:17 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
06:21 < Dropje> haha just wanted to show it to a co-worker :)
06:33 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
06:33 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
06:36 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [K-Lined]
06:37 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
06:51 <@vpnHelper> RSS Update - forum: CCD directory is not being recogonized <http://forums.openvpn.net/topic7656.html#p9805>
06:55 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
06:59 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 264 seconds]
07:03 <@vpnHelper> RSS Update - forum: CCD directory is not being recogonized <http://forums.openvpn.net/topic7656.html#p9806>
07:07 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
07:09 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
07:10 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
07:25 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Nine out of ten l33t h4x0rz prefer it]
07:28 -!- rolls` [~rollin@190.120.228.48] has quit [Ping timeout: 250 seconds]
07:29 -!- rolls` [~rollin@190.120.228.48] has joined #openvpn
07:38 < Fleck> ecrist any news? :)
07:38 < ecrist> no
07:39 < ecrist> the patches we're waiting for were sent back for rebasing as they were against an old tree.
07:39 < ecrist> we'll announce when it's ready
07:39 < Fleck> ok ;)
08:07 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9807>
08:12 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:22 < ajbelayer> is there a way to use macros/custom variables in the service_description?
08:23 < ecrist> what?
08:24 <@janjust> ajbelayer, are you sure you are in the right channel?
08:24 < ajbelayer> no :-D
08:25 < ajbelayer> too many windows open sorry
08:26 < ecrist> no worries.
08:26 -!- Lopi [~lopi@173-9-230-97-Illinois.hfc.comcastbusiness.net] has quit [Ping timeout: 255 seconds]
08:31 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
08:31 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9808>
08:37 <@vpnHelper> RSS Update - forum: Windows 7, strange issues. <http://forums.openvpn.net/topic7654.html#p9809>
08:43 <@vpnHelper> RSS Update - forum: Windows 7, strange issues. <http://forums.openvpn.net/topic7654.html#p9810>
08:43 -!- luneff [~yury@84.51.195.188] has joined #openvpn
08:49 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9811>
08:50 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
08:55 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:01 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9813>
09:01 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
09:15 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
09:19 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9814>
09:23 -!- gladiatr [~gladiatr@madeline.boneyard.lawrence.ks.us] has joined #openvpn
09:23 -!- gladiatr [~gladiatr@madeline.boneyard.lawrence.ks.us] has quit [Changing host]
09:23 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
09:24 -!- gladiatr_afk [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
09:25 <@vpnHelper> RSS Update - forum: Two-factor authentication with PKCS11 <http://forums.openvpn.net/topic7662.html#p9815>
09:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:31 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9817> || Two-factor authentication with PKCS11 <http://forums.openvpn.net/topic7662.html#p9816>
09:37 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p9818>
09:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:39 < EugeneKay> !shutup
09:41  * janjust wonders what happens if he kicks the vpnHelper :)
09:48 < takamichi> After being connected for a few hours to one of our servers, the clients stop routing through the VPN and go back to their default gateways whilst still indicating they are connected. What is the most likely reason for this?
09:50 <@janjust> takamichi:  check for dhcp renewals on the client side
09:51 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 276 seconds]
09:51 < takamichi> @janjust: interesting thank you.. however it only happens on one server out of many and they are all identically configured.
09:52 <@janjust> hmmm peculiar; in that case, check the client and server logs to see what happens after "a few hours" : normally the vpn client will print out something when it is reconfiguring itself
09:52 <@janjust> if the routes disappear "magically" then I'd definitely suspect a DHCP renewal on the client side - perhaps due to a different route metric?
09:52 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has joined #openvpn
09:53 < takamichi> @janjust: I've reviewed all the client logs, just normal rekeying every hour, no erros. I have yet to tackle the server logs. I will investigate the client side DHCP. Thank you!
09:55 <@janjust> np
09:55 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
10:10 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:12 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
10:12 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:13 -!- i7-Cud4 [~thoor@i.got.so.shitfaced.co] has joined #openvpn
10:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:20 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has quit [Ping timeout: 250 seconds]
10:22 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has joined #openvpn
10:37 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
10:44 -!- maxJadi [~maxJadi@dhcp-166-10.nomad.chalmers.se] has joined #openvpn
10:44 -!- maxJadi [~maxJadi@dhcp-166-10.nomad.chalmers.se] has quit [Changing host]
10:44 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
10:49 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Quit: Leaving.]
10:52 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
10:55 -!- EugeneKay is now known as EugeneKaway
10:57 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
10:59 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has joined #openvpn
11:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:00 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has quit [Client Quit]
11:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
11:00 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has joined #openvpn
11:01 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
11:03 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
11:03 -!- EugeneKaway is now known as EugeneKay
11:04 <@vpnHelper> RSS Update - forum: cannot ping server <http://forums.openvpn.net/topic7655.html#p9819>
11:08 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
11:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:35 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
11:39 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Read error: Operation timed out]
11:42 -!- UnterPerro [~UnterPerr@32.163.121.196] has joined #openvpn
11:55 -!- michelp [~michel@75-92-165-199.war.clearwire-wmx.net] has left #openvpn ["Leaving"]
12:14 -!- luneff [~yury@84.51.197.93] has joined #openvpn
12:20 -!- albech_ [~thomas@124.157.245.126] has quit [Quit: Ex-Chat]
12:38 -!- EugeneKay is now known as EugeneKaway
12:39 -!- EugeneKaway is now known as EugeneKay
12:40 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
12:40 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
12:40 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:52 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
12:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
12:58 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html>
13:00 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has quit [Quit: Leaving]
13:05 -!- UnterPerro [~UnterPerr@32.163.121.196] has quit [Read error: Connection reset by peer]
13:07 -!- mant1s [mant1s@hannah-ruhl.um.maine.edu] has joined #openvpn
13:07 -!- mant1s [mant1s@hannah-ruhl.um.maine.edu] has quit [Changing host]
13:07 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
13:08 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
13:09 -!- dazo is now known as dazo_afk
13:14 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
13:42 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Quit: Changing server]
13:43 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
13:44 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Client Quit]
13:45 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
14:02 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
14:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:12 -!- luneff [~yury@84.51.197.93] has quit [Quit: Leaving]
14:30 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:33 -!- Kobaz [~kobaz@its.kobaz.net] has left #openvpn []
14:53 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
14:53 < majuk> lawl, so I figured out my problem with DNS last night. Didn't have resolvconf installed. :D
14:54 < majuk> gg
14:54 < majuk> Still doesn't particularly explain why my Win clients aren't getting their DNS server entry updated. But that's not real high on my priority list right now.
15:03 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
15:22 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
15:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:28 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
15:29 < majuk> Anynone use freesshd a lot and can tell me what idiotic thing I am doing to make it reject scp connections? /msg me plz, I heart you
15:31 < s7r> service failed to start due to unresolved dependencies: set(['user', 'iptables_openvpn'])
15:31 < s7r> what to do?
15:40 <@vpnHelper> RSS Update - forum: cannot ping server <http://forums.openvpn.net/topic7655.html#p9821>
15:43 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has joined #openvpn
15:43 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has quit [Changing host]
15:43 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
15:45 < s7r> :)
15:46 <@vpnHelper> RSS Update - forum: One or many keys <http://forums.openvpn.net/topic7664.html> || TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p9822>
15:50 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:58 <@vpnHelper> RSS Update - forum: One or many keys <http://forums.openvpn.net/topic7664.html#p9824>
16:12 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
16:12 -!- alex88_ [~alex88@unaffiliated/alex88] has joined #openvpn
16:13 < alex88_> hi guys..
16:13 < alex88_> !welcome
16:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:13 < alex88_> !goal
16:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:14 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 260 seconds]
16:15 < alex88_> lol..btw, i've a working setup that uses redirect-gateway def1 to router clients connections trough vpn server, how can i make some clients to not route traffic? make another server config on another port?
16:20 < janjust> hi alex88_ , that's one method, an alternative is to use a client-config-dir for those clients and in that directory place a file with a 'push-reset' statement. The name of the file must be the same as the client certificate common name (/CN= part)
16:21 < alex88_> janjust, thank you for helping, so if the clients routes traffic depends on the certificate? is there a simplier way changing it client-side? because i don't always need to route traffic..
16:22 < janjust> you can also issue the 'push-reset' or a 'route-nopull' on the client side
16:23 < janjust> whoops, correction: the push_reset can only be specified server side
16:23 < janjust> the route-nopull is a client thingie (new for 2.1, IIRC)
16:25 < alex88_> janjust, route-nopull worked perfectly.. thank you very much!
16:25 < alex88_> have a nice time
16:25 -!- alex88_ is now known as alex88
16:25 < janjust> no, same to you
16:25 < janjust> s/no/np
16:31 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 276 seconds]
16:31 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
16:38 -!- janjust [~janjust@openvpn/community/support/janjust] has left #openvpn ["Leaving"]
16:42 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
16:46 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
16:53 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p9825>
16:59 < dvl> Anyone running spamd/spamdb syncronization between remote hosts?  
16:59 < dvl> It seems interesting to me.
17:00 -!- takamichi [~pri@46.11.13.117] has quit [Read error: Connection reset by peer]
17:01 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
17:07 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
17:33 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:36 -!- jfkw [~jtk@216.115.6.82] has quit [Ping timeout: 276 seconds]
17:44 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
17:52 -!- sayuke [~crc@149.171.13.24] has joined #openvpn
17:52 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 240 seconds]
18:33 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
18:41 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
18:44 -!- p3rror [~mezgani@41.248.186.202] has joined #openvpn
18:44 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
18:49 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
19:01 -!- sayuke [~crc@149.171.13.24] has quit [Ping timeout: 260 seconds]
19:01 < dvl> OpenVPN came up during a discussion of what to ask potential sysadmins.... I suggested this question: why should you tunnel over udp instead of tcp?
19:01 < dvl> I knew the answer only because I'd used OpenVPN.
19:01 < dvl> That was the question I suggested we ask.
19:14 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
19:23 < darkdrgn2k3> hey what kinda stress does openwrt put on the processor
19:23 < darkdrgn2k3> IE: embeded board say a 200 mhz vs a 350 or 400
19:31 < reiffert> darkdrgn2k3: this is openvpn, not openwrt.
19:32 < darkdrgn2k3> reiffert: sorry i ment openvpn
19:33 < darkdrgn2k3> reiffert: what kinda stress for openvpn put on a processor
19:33 < darkdrgn2k3> (sorry my base will be openwrt in the end LOL)
19:38 < darkdrgn2k3> more specifically im looking at one tunnel client
19:38 < EugeneKay> If you're using openwrt, chances are that you're running it off the wrong end of a DSL line.
19:38 < EugeneKay> You'll run out of bandwidth before you run out of cpu
19:39 < darkdrgn2k3> EugeneKay: awsome.. so a 200mhz board will be alright 
19:39 < EugeneKay> Sure
19:39 < darkdrgn2k3> for a pppoe connection and and openvpn 
19:39 < darkdrgn2k3> *an
19:39 < EugeneKay> It's a router. It's designed to do this sort of thing :-p
19:40 < darkdrgn2k3> EugeneKay: yes but not openvpn :-P 
19:40 < darkdrgn2k3> soo i wanna make sure if im gonna be buying 80 of them that it will work
19:40 < darkdrgn2k3> decently
19:41 < EugeneKay> Best advice I can give is buy one and try it
19:41 < darkdrgn2k3> EugeneKay: plan to ... :)
19:41 < EugeneKay> Guessing the routers are the clients?
19:41 < darkdrgn2k3> yeh
19:41 < darkdrgn2k3> server is an ASTARO firewall
19:41 < EugeneKay> Should have no problem at all, then.
19:41 < EugeneKay> Hell, my phone does openvpn with no cpu load
19:42 < darkdrgn2k3> LOL i know dont you love android :)
19:42 < darkdrgn2k3> just have to verify that the astaro doesnt have a 30 connection limit
19:42 < EugeneKay> Probably does. Commercial implementations are like that.
19:42 < EugeneKay> Talk to your vendor.
19:42 < darkdrgn2k3> yeh i will..
19:42 < darkdrgn2k3> were testing it right now
19:43 < darkdrgn2k3> but we have 80 branch offices...
19:43 < EugeneKay> No reason it shouldn't work.
19:43 < darkdrgn2k3> i did a proof of concept alreayd (reverse engearing their dum config file with all the crts and config in one file)
19:44 < EugeneKay> If you've got an ESXi server handy, clone up a bunch of VMs and point 'em at the server
19:45 < darkdrgn2k3> you mean to max it out andsee
19:45 < EugeneKay> Ayup
19:45 < darkdrgn2k3> i could just use one vm box :-P
19:45 < darkdrgn2k3> and launch tone of processes with differt cert
19:45 <@vpnHelper> RSS Update - forum: Open extra port <http://forums.openvpn.net/topic7665.html>
19:46 < darkdrgn2k3> "Allowed networks: 
19:46 < darkdrgn2k3> Be sure to enter a maximum of 30 network definitions in the network tab. Otherwise OpenVPN is 
19:46 < darkdrgn2k3> unable to start correctly."
19:46 < darkdrgn2k3> im wondering if thats remote networks maybe
19:47 < EugeneKay> If it is, then it's an artificial limit on the routing table
19:50 < darkdrgn2k3> yeh i figured that.... 
19:50 < darkdrgn2k3> gatta ask the vendor..
19:50 < darkdrgn2k3> just glad that its not a basterdized openvpn deployment
20:11 -!- toortog [nesm6@38.111.17.107] has joined #openvpn
20:18 -!- alex88 [~alex88@unaffiliated/alex88] has quit [Quit: Sto andando via]
20:21 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
20:21 -!- jfkw [~jtk@216.115.6.82] has quit [Client Quit]
20:37 -!- sayuke [~crc@149.171.13.24] has joined #openvpn
21:02 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
21:02 -!- sayuke [~crc@149.171.13.24] has quit [Ping timeout: 276 seconds]
21:06 -!- corretico [~laguilar@201.201.44.82] has quit [Read error: Connection reset by peer]
21:09 -!- master_of_master [~master_of@p57B53878.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
21:10 -!- master_of_master [~master_of@p57B538E2.dip.t-dialin.net] has joined #openvpn
21:22 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p9827>
21:24 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
21:27 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
21:47 -!- albech [~thomas@119.42.77.127] has joined #openvpn
21:51 -!- K4k_ is now known as K4k
21:56 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:16 <@vpnHelper> RSS Update - forum: Setup on Win2008 R2 <http://forums.openvpn.net/topic7666.html>
22:50 -!- sayuke [~crc@149.171.13.24] has joined #openvpn
22:52 -!- albech_ [~thomas@124.157.245.126] has joined #openvpn
22:56 -!- albech [~thomas@119.42.77.127] has quit [Ping timeout: 276 seconds]
23:14 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:51 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
--- Day changed Tue Feb 22 2011
00:21 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:22 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:23 -!- darkdrgn2k3 [~darkdrgn2@bas2-toronto44-1177753753.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
00:25 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
01:00 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:22 -!- majuk_ is now known as majuk-b-ded
01:28 <@vpnHelper> RSS Update - forum: CCD directory is not being recogonized <http://forums.openvpn.net/topic7656.html#p9829>
01:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:44 -!- EugeneKay is now known as iPhone4
01:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:01 -!- iPhone4 is now known as EugeneKay
02:04 <@vpnHelper> RSS Update - forum: appliance woking : You do not have Administrative permission <http://forums.openvpn.net/topic7661.html#p9831> || Setup on Win2008 R2 <http://forums.openvpn.net/topic7666.html#p9830>
02:28 -!- sayuke [~crc@149.171.13.24] has quit [Ping timeout: 276 seconds]
02:38 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
02:41 -!- dazo_afk is now known as dazo
02:50 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 246 seconds]
02:54 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
02:55 -!- EugenMayer1 [~eugen@frbg-5d84f6b9.pool.mediaWays.net] has joined #openvpn
02:55 < EugenMayer1> how would i force my openvpn client to not craete routes?
02:56 < EugenMayer1> with one client, iam 2 times in the same net. I want to client to always use one specific itnerface (one specific ip )
02:58 < hyper_ch> any php gurus in here?
03:14 -!- maxJadi [~maxJadi@dhcp-164-206.nomad.chalmers.se] has joined #openvpn
03:14 -!- maxJadi [~maxJadi@dhcp-164-206.nomad.chalmers.se] has quit [Changing host]
03:14 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
03:17 -!- venom00ut [~venom00@unaffiliated/venom00] has quit []
03:17 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
03:27 -!- raomin [~romain@86.66.22.65] has joined #openvpn
03:29 < xxtjaxx> invalid argument code=22 what hapens there?  is there a list of openvpn error codes and what they mean?
03:30 < cron2> xxtjaxx: that sounds more like an operating system error - if you give us a bit more context (like "the last 3 lines of the output") it should be easier to say what's wrong
03:30 < xxtjaxx> k
03:32 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:32 -!- mode/#openvpn [+o mattock] by ChanServ
03:32 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:34 < xxtjaxx> cron2: http://pastebin.com/J9Ay8qwi there you go. 
03:34 < xxtjaxx> its a simple tcp tunnel 
03:44 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Quit: Leaving]
03:45 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
03:45 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
03:46 <@vpnHelper> RSS Update - forum: Routing request from VPN client to an internal server. <http://forums.openvpn.net/topic7667.html>
03:51 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
04:04 -!- maxJadi [~maxJadi@dhcp-164-206.nomad.chalmers.se] has joined #openvpn
04:04 -!- maxJadi [~maxJadi@dhcp-164-206.nomad.chalmers.se] has quit [Changing host]
04:04 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:06 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:06 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:06 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
04:08 -!- SVM_ [5fddd316@gateway/web/freenode/ip.95.221.211.22] has joined #openvpn
04:09 -!- SVM_ [5fddd316@gateway/web/freenode/ip.95.221.211.22] has quit [Client Quit]
04:17 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:17 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:17 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:21 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
04:33 <@vpnHelper> RSS Update - forum: Open extra port <http://forums.openvpn.net/topic7665.html#p9834> || Routing request from VPN client to an internal server. <http://forums.openvpn.net/topic7667.html#p9833>
04:40 -!- superc [~superc@tmo-099-210.customers.d1-online.com] has joined #openvpn
04:41 < superc> hi. I've some problems with openvpn. I get a connection established between openvpn client and server, get ips, routing.. but I cannot ping the other side. what am I missing?
04:52 < janjust> superc:  without more info it is impossible to tell; which OS, what configuration; which IP are you trying to ping etc
04:52 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:52 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:52 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:53 < superc> ok. I installed untangle appiance with openvpn as server and an openwrt image as client
04:53 < superc> tomatovpn firmware... logs look okay
04:53 < superc> what information do you need
04:54 < superc> I get an ip assigned by the server that I can ping on the client... I cannot ping the peer-to-peer address of the server
04:54 < janjust> superc:  that is normal; try pinging the VPN IP of the server (usually the .1 address)
04:55 < superc> no, doesn't work
04:56 < superc> thats the routing table on the client: http://pastebin.com/TFUPfUhv
04:58 < janjust> but what is the IP of the VPN server? 
04:58 < superc> the vpn server has a public ip
04:58 < janjust> that's not really possible - what is the VPN IP of the VPN server? 
04:59 < superc> you mean the ptp address?
04:59 < janjust> I mean the address of the 'tun' device on the VPN server
05:00 < superc> on the server there is a device tun0 with ip 192.168.89.1 and p-z-p: 192.168.89.2
05:01 < janjust> try pinging the 192.168.89.1 address on the client (provided that the client has an address of e.g. 192.168.89.5)
05:01 < superc> this is what I don't really understand. because when connecting on the client I see in the logs: /sbin/ifconfig tun11 192.168.89.9 pointopoint 192.168.89.10 mtu 1500
05:02 < janjust> superc:  that is perfectly well possible
05:02 < janjust> what happens if you ping 192.168.89.9 from the VPN server?
05:02 < superc> ok I'm on the client now: PING 192.168.89.1 (192.168.89.1): 56 data bytes 
05:02 < superc>  
05:02 < superc> --- 192.168.89.1 ping statistics --- 
05:02 < superc> 8 packets transmitted, 0 packets received, 100% packet loss
05:03 < superc> I cannot ping 192.168.89.9 on the server neither
05:03 < janjust> then you're most likely looking at firewall issues
05:03 < janjust> check iptables whether access to the 'tun' device is allowed
05:03 < superc> on client or server?
05:03 -!- EugenMayer1 [~eugen@frbg-5d84f6b9.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
05:04 < janjust> both
05:05 < superc> client: http://pastebin.com/zrtmBQmV
05:08 < superc> the server I cannot paste because its vnc.. but it really looks restrictive... 
05:13 < janjust> don't know about the server iptables rules - they look a bit odd but might be normal for an untangle appliance
05:13 < janjust> try adding on both client and server :
05:14 < janjust> iptables -I INPUT -i tun+ -j ACCEPT
05:14 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 240 seconds]
05:14 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
05:16 < superc> no change
05:17 < superc> is it input or forward chain?
05:17 < janjust> when pinging the VPN IPs it is the INPUT chain
05:17 < janjust> for routing traffic it's the FORWARD chains
05:17 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
05:18 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
05:18 < janjust> restart the client and server openvpn processes with 'verb 7' - this will produce a lot of debug output but when you're pinging the server from the client you should see 'Rw' and 'Wr' on both ends
05:19 < superc> verb 7 ?
05:19 < janjust> yep, add that line to both the client and server configs
05:19 < superc> the command is not recognized
05:20 < superc> just verb 7 on the commandline?
05:20 < janjust> on the command line it is '--verb 7'
05:21 < superc> ok, did it on the server
05:21 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
05:22 < janjust> now when you ping the server from the client you should see some lines 'wr' on the server
05:22 < janjust> if not, then the traffic is not getting through at all
05:23 < superc> ah. I think the command didn't work
05:23 < superc> he last thing was exiting
05:23 < superc> socket bind failed on local address [undef]: address already in use
05:24 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
05:25 < janjust> do a 'killall openvpn' first 
05:25 < superc> ok. now theres lots of debug output
05:25 < superc> write to tun/tap: invalid argument (code=22)
05:26 < superc> and then udpv4 read: from ....ip... data len=133
05:27 < superc> but on every 3rd line this write to tun/tap: invalid argument
05:28 < janjust> sounds like there is something wrong with the openvpn installation in untangle....
05:29 < superc> I googled it... someone missed "comp-lzo" in his config
05:29 < superc> what does this mean?
05:30 < janjust> compare your openvpn server and client configs
05:30 < janjust> both should have 'comp-lzo' or neither should have it; also, make sure you're not adding 'route' or 'push "route" statements at this stage
05:31 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
05:31 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
05:31 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
05:37 < superc> ok I changed this setting to comp-lzo on both sides... still the same
05:55 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: gtg]
05:58 < janjust> hmmm superc , post your client and server config files on pastebin so we can have a look 
05:59 < krzee> good mornin jjk
06:00 < superc> ok this is client: http://pastebin.com/cTb5Q6CY
06:10 < superc> server: http://pastebin.com/rhqj3EEH
06:10 < superc> took some time to get ssh access to the server
06:10 -!- dazo is now known as dazo_afk
06:11 < janjust> yo krzee whassup
06:12 < superc> mh from server I can ping 192.168.93.1... that is the clients ip
06:12 < janjust> superc:  your server configuration is screwed up - does not make a lot of sense to me
06:13 < janjust> also your client config contains 'up updown/sh' - what's in that script?\
06:13 < superc> mh... client is openwrt (tomatovpn firmware)... I don't know what they did there
06:14 < janjust> just try to find the 'updown.sh' and list it
06:14 < superc> ok
06:14 < superc> updown.sh: http://pastebin.com/a6AkzYS8
06:15 < superc> ok, but what exactly doesn't make sense?
06:15 < superc> some wrong ip somewhere?
06:15 < janjust> superc:  see http://pastebin.com/wrVjgduq for a sanitized server cofnig
06:15 < janjust> ah OK, the updown.sh scripts look OK
06:16 < superc> ok, now you removed all of the routing parameters?
06:16 < janjust> for debugging yes; more importantly, I added 'server 192.168.89.0 255.255.255.0' 
06:16 < janjust> what was there did not make a lot of sense in a client/server setup
06:17 < superc> btw client is a router with the local network 192.168.93.0 behind
06:17 < superc> so actually 192.168.93.0 should be routed to 192.168.0.0
06:17 < janjust> first get the VPN endpoints to work, then work on routing: start from within, then work your way outwards
06:18 < janjust> superc:  you cannot route subnet 192.168.93.0 to subnet 192.168.0.0
06:19 < janjust> << out for lunch, back in 30 minutes or so
06:19 < superc> why not?
06:20 < superc> Ok, installed your config
06:20 < superc> still get this invalid arguments
06:20 < superc> and cannot ping 192.168.89.1
06:27 <@vpnHelper> RSS Update - forum: openvpn server .. very cryptic file cert open error. help? <http://forums.openvpn.net/topic7668.html>
06:31 < superc> mh... when I ping 192.168.89.1 from client and look at tcpdump on server I get the following:
06:31 < superc> 13:29:46.494017 IP tmo-099-210.customers.d1-online.com.21483 > 192.168.0.30.openvpn: UDP, length 133
06:31 < superc> so it looks like the ip packet is coming from a public ip isn't it?
06:35 -!- vahokif [~vahokif@dyn1215-41.wlan.ic.ac.uk] has joined #openvpn
06:35 < vahokif> hi
06:35 < vahokif> this might not be exactly on topic
06:36 < vahokif> I wrote a program for windows that redirects UDP packets to the tap-win32 adapter
06:36 < vahokif> I know it works because other adapters receive the packets
06:37 < vahokif> but tap-win32 seems to ignore them, even if they're identical to ones I can see going through it with wireshark
06:37 < vahokif> do you have any idea what's going on?
06:37 < EugeneKay> !windows
06:37 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
06:37 < vahokif> not my fault I'm afraid
06:37 < vahokif> it's one line with iptables :D
06:38 < vahokif> I'm writing this for a friend but he can't use linux
06:39 < EugeneKay> Yes yes, the proverbial friend in need.
06:39 < EugeneKay> :-p
06:39 < hyper_ch> but linux is so much simpler to use than windows
06:40 < vahokif> yeah but the whole point is to play games
06:40 < vahokif> he has draconian firewalling at his uni
06:40 < vahokif> no udp traffic
06:40 < hyper_ch> games are a waste of time, you better put your time into studying at university
06:40 < vahokif> I am
06:41 < vahokif> I run arch dammit
06:41 < hyper_ch> why don't you just get 3g?
06:41 < EugeneKay> It has the gee bees
06:41 < EugeneKay> Seriously though, I know absolutely nothing about how Windows handles UDP packets.
06:41 < vahokif> the thing is that we've found a perfect vpn service
06:41 < EugeneKay> Other than poorly.
06:41 < vahokif> but it has a bandwidth cap
06:41 < vahokif> so we'd prefer to use the main connection when possible
06:42 < EugeneKay> Honestly, if it's firewall avoidance you're after, just use TOr.
06:43 < vahokif> >games
06:43 < vahokif> >tor
06:43 < vahokif> what
06:43 -!- MarKsaitis [~MarKsaiti@host81-138-103-233.in-addr.btopenworld.com] has joined #openvpn
06:43 < EugeneKay> Oh, this is for online gaming.
06:43 < EugeneKay> I thought you meant Windows as a whole :v
06:50 -!- EugeneKay is now known as EugeneKaway
06:52 <@vpnHelper> RSS Update - forum: openvpn server .. very cryptic file cert open error. help? <http://forums.openvpn.net/topic7668.html#p9836>
06:57 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
06:57 <@vpnHelper> RSS Update - forum: Open extra port <http://forums.openvpn.net/topic7665.html#p9837>
06:57 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:57 -!- vahokif [~vahokif@dyn1215-41.wlan.ic.ac.uk] has quit [Quit: Leaving.]
06:58 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
07:04 -!- EugeneKaway is now known as EugeneKay
07:09 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
07:14 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
07:15 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
07:15 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
07:15 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
07:15 <@vpnHelper> RSS Update - forum: openvpn server .. very cryptic file cert open error. help? <http://forums.openvpn.net/topic7668.html#p9838>
07:25 < superc> mh strange...
07:25 < superc> in the meanwhile I got successfully connected
07:25 < superc> I just did not have to ping 192.168.89.1 but 192.168.0.30 what is the ip of the openvpn server
07:26 < superc> but there is still something strange. it took about 5 minutes now, after dialin, to be able to ping 192.168.0.14 (another server on the net) whereas 192.168.0.30 worked immediately... wtf???
07:27 < superc> within this time I didn't do any changes
07:30 < janjust> interesting superc  ; looks like your setup is entirely bridged without you knowing it ;-)
07:30 < superc> this is actually as I want it
07:30 < janjust> as for the other hosts becoming visible after a while: could be a routing/bridging issue where the server side needs to "discover" that there's a new client on the net
07:31 < janjust> heeh good 4 u ; I have no clue what your setup looks like now, so I also have no clue what to do about the 5 minute delay
07:31 -!- dazo_afk is now known as dazo
07:31 < superc> strange thing the delay
07:32 < superc> especially because 192.168.0.30 is pingable
07:32 < janjust> I would have expected that - the openvpn endpoints are the first to work
07:32 < janjust> it's the other hosts on the server-side lan which take longer
07:32 < superc> ok but if the server gets available after 5 minutes I can live with that... But most likely it won't... I'm sure about that :-)
07:33 < superc> so 192.168.0.30 is openvpn server
07:33 < superc> thats what I meant... I can't explain what this 192.168.89.x is for
07:33 < janjust> in your setup it apparently is, superc  ; time to read the untangle docs a bit better?
07:33 < superc> especially why the server has 192.168.89.1 and .2 whereas the client has .8 and 9 as ip and ptp
07:34 < superc> yes probably
07:34 < janjust> do an 'iptables -t nat -L -n -v' on the client and server - perhaps some funky NATting rules are in place
07:34 < superc> but thanks very much for your help so far
07:34 < janjust> no prob
07:34 < superc> ok I try
07:36 < superc> this is the output: http://pastebin.com/VcgNuNfB
07:36 < superc> looks a bit complex
07:37 < janjust> yes indeed, but no really weird NATting rules... so that cannot be it 
07:37 < janjust> good luck with the documentation;-)
07:37 < superc> thanks... tomorrow when the server is unavailable :-)
07:38 < ecrist> sup bitches?
07:39 < hyper_ch> hi ecrist
07:39 < hyper_ch> and janjust
07:40 < janjust> hi hyper_ch  ; nah ecrist , it's just that his setup is working and neither he nor I understand why :D
07:40 < ecrist> o.O
07:40 < ecrist> sup == what's up
07:40 < ecrist> you == bitches.
07:40 < ecrist> :)
07:40 < janjust> aaah ok, thought you meant something else, mofo
07:41 < hyper_ch> ecrist: I heard you're the resident php guru?
07:43 < ecrist> could be, hyper_ch 
07:44 < hyper_ch> ecrist: mind looking at something?
07:44 < ecrist> sure
07:46 < hyper_ch> ecrist: (1) go here  http://www.bvger.ch/publiws/pub/news.jsf   (2) change the date to yesterday (3) scroll down and you will see, there are more results than being displayed, so there's a second page to be clicked... unforunately it's all stupid Ajax stuff and I just can't get curl to fetch the right thing:  http://pastebin.com/EJwdmycU
07:46 <@vpnHelper> Title: Entscheiddatenbank BVGerBVGer-Header (at www.bvger.ch)
07:48 < hyper_ch> oh... and they don't have a rss feed :(
07:52 < ecrist> ok, so what do you want me to do?
07:52 < ecrist> you asked about PHP, not AJAX
07:52 < ecrist> curl/wget aren't going to play well with ajax
07:53 < hyper_ch> ecrist: ajax does make post request
07:53 < hyper_ch> which you should be able to do yourself with curl... I try and fail miserably
07:54 < ecrist> what, specifically, are you trying to do?
07:54 < hyper_ch> ecrist: writing a script to fetch the daily published decisions there
07:55 < hyper_ch> the problem is when there's more than 10 a day, because I need to figure out how to get results 11-20, 21-30 etc
07:55 < ecrist> ah
07:55 < ecrist> give me a few to look at this
07:56 < hyper_ch> I used firebug to check what post vars are being sent to the server when I hit the "page 2" link
07:56 < janjust> hyper_ch:  try running a network sniffer whilst going to page 11-20, 21-30 etc - that way you can capture exactly what is posted (coz the ajax page looks like a *mess*)
07:58 < hyper_ch> janjust: the federal court makes it all available in html.. very simple to parse...
07:58 < hyper_ch> the federal administrative court did use the same system but they changed to that ajax stuff now
07:58 < janjust> yeah I realize, hyper_ch , I was just wondering if you knew exactly what was posted to the server - I hadn't seen your firebug thing yet
07:59 < hyper_ch> janjust: :)
07:59 < hyper_ch> they used to have it like this http://www.bger.ch/index/juridiction/jurisdiction-inherit-template/jurisdiction-recht/jurisdiction-recht-urteile2000neu.htm
07:59 <@vpnHelper> Title: Schweizerisches Bundesgericht (at www.bger.ch)
07:59 < ecrist> hyper_ch: that website is a piece of crap
08:00 < hyper_ch> ecrist: :) I know
08:00 < ecrist> their are two posts just to get a single page update, and the amount of post data is asinine
08:01 < hyper_ch> two posts?
08:01 < ecrist> yes, I'm seeing two
08:01 < hyper_ch> let me check in firebug
08:01 < hyper_ch> I thought there was only one
08:01 < ecrist> that's what I'm using, firebug
08:02 < hyper_ch> hmmmm
08:02 < hyper_ch> firing up firefox
08:03 -!- vahokif [~vahokif@dyn1199-185.wlan.ic.ac.uk] has joined #openvpn
08:03 < hyper_ch> what's wrong... firebug won't hosw anything now
08:06 < hyper_ch> ecrist: I see only one
08:06 < ecrist> hyper_ch: really, this isn't a question about PHP and more a question about reverse engineering the post/get of a swedish website
08:06 < hyper_ch> ecrist: swiss :)
08:06 < ecrist> if need be, I can do it, but I'd rather not. 
08:07 -!- vahokif [~vahokif@dyn1199-185.wlan.ic.ac.uk] has quit [Read error: Connection reset by peer]
08:07 < ecrist> mea culpa, swish
08:07 < ecrist> swiss
08:07  * janjust would ask for obscene amounts of money before reverse engineering *that* site
08:07 < hyper_ch> I'd do it myself but I just can't spot where I go wrong
08:07 < ecrist> fortunately I understand enough french to be dangerous
08:08 < hyper_ch> you can have the site translate to french if you prefer :)
08:08 -!- superc [~superc@tmo-099-210.customers.d1-online.com] has left #openvpn []
08:08 < ecrist> I know, that's what I did.
08:09 < hyper_ch> it's like destiny.... they knew you'd look at it and hence they already offered a french version, just for you ecrist
08:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:11 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has joined #openvpn
08:11 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has quit [Changing host]
08:11 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
08:14 < ecrist> lol
08:14 < ecrist> hyper_ch: as janjust suggested, I'd work on it for a fee, but I cannot guarantee results.
08:17 < hyper_ch> :(
08:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
08:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
08:28 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:41 -!- luneff [~yury@84.51.197.93] has joined #openvpn
08:44 -!- luneff [~yury@84.51.197.93] has quit [Client Quit]
08:54 <@vpnHelper> RSS Update - forum: openvpn server .. very cryptic file cert open error. help? <http://forums.openvpn.net/topic7668.html#p9839>
08:59 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
09:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:07 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 250 seconds]
09:07 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:11 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
09:26 -!- raw [~raw@chipotle118.server4you.de] has joined #openvpn
09:27 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
09:32 -!- EugeneKay is now known as EugeneKaway
09:35 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:36 -!- Blues-Man [~bluesman@host137-190-dynamic.43-79-r.retail.telecomitalia.it] has joined #openvpn
09:36 <@vpnHelper> RSS Update - forum: Anonyproz OpenVPN Service Provider <http://forums.openvpn.net/topic2502.html#p9840>
09:42 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
09:56 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:00 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p9841>
10:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
10:02 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
10:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:08 -!- voglster [~voglster@161.sub-174-253-77.myvzw.com] has joined #openvpn
10:09 < voglster> strange problem, using openvpn in tunnel mode, i can ping, ssh, scp to anything on my network but http and rdp doesnt seem to work, anyone run into this issue or can you point me in the right direction?
10:12 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:13 < ecrist> voglster: sounds like a firewall problem.
10:14 < voglster> ecrist, firewalls are off on everything windows host.. no firewall... openvpn server... no firewall bet behind the router (udp port forwarding) and my laptop no firewall
10:15 < ecrist> openvpn doesn't restrict ports or anything like that
10:15 < voglster> ecrist, and if i use pptp vpn it works fine
10:15 < ecrist> so, if you can ping over the vpn, everything else should work.
10:15 < voglster> ecrist, exactly why i am scratching my head
10:17 < voglster> any other thoughts? just makes no sense to me why everything else works
10:17 < ecrist> no clue
10:17 < ecrist> try a packet dump, see if you see something specific
10:17 < ScriptFanix> does pinging with big packets work ?
10:18 < ScriptFanix> thinking MTU problem…
10:18 < ecrist> mtu issue, perhaps?
10:18 < ScriptFanix> you're not filtering ICMP, are you?
10:18 < voglster> nope not filtering ICMP
10:19 < voglster> and i cna try large packets
10:19 < voglster> brb this may disconnect me when i connect
10:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:23 -!- voglster [~voglster@161.sub-174-253-77.myvzw.com] has quit [Ping timeout: 240 seconds]
10:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:30 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:33 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The alternative IRC client]
10:39 -!- voglster [~voglster@66.226.243.126] has joined #openvpn
10:49 -!- MarKsaitis [~MarKsaiti@host81-138-103-233.in-addr.btopenworld.com] has quit [Remote host closed the connection]
10:53 -!- luneff [~yury@84.51.197.93] has joined #openvpn
11:04 -!- voglster [~voglster@66.226.243.126] has quit [Ping timeout: 272 seconds]
11:12 -!- Blues-Man [~bluesman@host137-190-dynamic.43-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
11:20 -!- voglster [~voglster@161.sub-174-253-77.myvzw.com] has joined #openvpn
11:30 -!- EugeneKaway is now known as EugeneKay
11:34 -!- albech_ [~thomas@124.157.245.126] has quit [Ping timeout: 240 seconds]
11:42 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
11:47 -!- albech_ [~thomas@124.157.202.17] has joined #openvpn
11:47 -!- voglster [~voglster@161.sub-174-253-77.myvzw.com] has quit [Ping timeout: 276 seconds]
11:51 -!- waeawewa [~waeawewa@180.191.91.12] has joined #openvpn
11:52 < waeawewa> hello ?
11:52 < waeawewa> anyone online ?
11:52 < waeawewa> !welcome
11:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:52 < waeawewa> !goal
11:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:52  * EugeneKay eats a McDouble, no pickles
11:52 < waeawewa> !configs
11:52 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
11:52 < EugeneKay> !factoids
11:52 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
11:52 < waeawewa> hello ?
11:52 < EugeneKay> Read there ^
11:52 < waeawewa> anyone online? i need help :(
11:52 < waeawewa> !howto
11:52 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:57 -!- waeawewa [~waeawewa@180.191.91.12] has quit []
12:11 < ecrist> lol
12:11 < ecrist> just over 5 minutes
12:11 < ecrist> impatient I think
12:12 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
12:13 -!- luneff [~yury@84.51.197.93] has joined #openvpn
12:18 -!- MarKsaitis [~MarKsaiti@82.132.139.174] has joined #openvpn
12:29 <@vpnHelper> RSS Update - forum: Setup on Win2008 R2 <http://forums.openvpn.net/topic7666.html#p9842>
12:39 -!- albech_ [~thomas@124.157.202.17] has quit [Quit: Ex-Chat]
12:43 -!- voglster [~voglster@161.sub-174-253-77.myvzw.com] has joined #openvpn
12:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
12:48 -!- oracle [~o2@unaffiliated/spice] has joined #openvpn
12:49 -!- voglster [~voglster@161.sub-174-253-77.myvzw.com] has quit [Ping timeout: 250 seconds]
12:50 -!- EugeneKay is now known as EugeneKaway
12:50 -!- MarKsaitis [~MarKsaiti@82.132.139.174] has quit [Remote host closed the connection]
12:51 -!- EugeneKaway is now known as EugeneKay
12:54 -!- dazo is now known as dazo_afk
12:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:03 -!- voglster [~voglster@66.226.243.126] has joined #openvpn
13:04 -!- EugeneKay is now known as EugeneKaway
13:05 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
13:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:08 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
13:10 < ecrist> Fleck: ping
13:10 < ecrist> http://build.openvpn.net/downloads/releases/
13:10 <@vpnHelper> Title: Index of /downloads/releases (at build.openvpn.net)
13:10 < ecrist> check out preveiw 8, should have --enable-passwd-save at compile
13:11 -!- MarKsaitis [~MarKsaiti@82.132.211.125] has joined #openvpn
13:22 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
13:25 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
13:26 < Fleck> ecrist!!! :)) thx!
13:29 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 240 seconds]
13:32 < ecrist> np
13:33 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
13:36 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
13:37 < s7r> i configured an openvpn connection and when i try to connect from windows i get the note
13:37 < s7r> openvpn requires --script-security 2 to run ..
13:37 < s7r> what can  I do ? i have the latest version installed
13:37 < ecrist> !logs
13:37 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
13:38 < s7r> Tue Feb 22 21:35:23 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
13:41 < s7r> ecrist: http://pastebin.com/89U4rTh0
13:42 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
13:43 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:43 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:43 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:45 < Fleck> ecrist works!!! :))
13:46 < Fleck> thats sooo great! :) /me happy :D
13:49 < ecrist> s7r: see line 284 of your log paste
13:50 < s7r> yes i see it
13:51 < s7r> key negociation failed
13:51 < s7r> why is this
13:51 < s7r> because script security?
13:52 < ecrist> no, it says right there to check network connectivity
13:52 < ecrist> that other thing is a warning, not an error.
13:53 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
13:53 < s7r> well I ahve network connectivity just good
13:53 < Fleck> i had the same error when server was configuret to auth with certs, but user was not :D
13:53 < s7r> i don't know why is it happening
13:53 < s7r> Fleck: how did you fix that error ?
13:53 < majuk> s7r, Check server's logs
13:54 < Fleck> s7r two ways - configure your client to auth with certs or configure server to use user/pass auth and configure client the same way
13:54 < Fleck> but yes - check servers log
13:55 < Fleck> maybe you have different problem
13:55 < Fleck> i did have error in servers log that client did not send cert... :)
13:55 < Fleck> or something like that
13:56 < s7r> i think i am missing something in the client ovpn file
13:56 < s7r> i cant find any logs on the server
13:56 < majuk>  /var/log/daemon.log usually
13:56 < majuk> s7r, ^^
13:57 < s7r> i do not have that file
13:57 < s7r> file does not exist
13:58 < Fleck> s7r maybe /var/log/openvpn/something.log 
13:59 < majuk> Or it might be set to a low log level.
13:59 -!- MarKsaitis [~MarKsaiti@82.132.211.125] has quit [Remote host closed the connection]
13:59 < majuk> Though there should still be something.
13:59 < majuk> Somewhere.
13:59 < s7r> i have the vpn set to no logs
13:59 < s7r> and verb 0
13:59 < s7r> in the client config file
14:00 < s7r> server sorry
14:00 < s7r> on the server.conf
14:00 < Fleck> then enable logs
14:00 < Fleck> and try again
14:00 < majuk> Probaably want to change that. ;)
14:02 < s7r> i have changed 
14:02 < s7r> and tried to connect
14:02 < s7r> but no openvpn.log created yet
14:02 < s7r> in /etc/openvpn
14:02 < s7r> or /var/log
14:03 < majuk> Restart the server daemon?
14:03 -!- voglster [~voglster@66.226.243.126] has quit [Ping timeout: 260 seconds]
14:03 < majuk> That would be key.
14:03 < s7r> ues
14:04 < s7r> majuk now i have log
14:05 < Fleck> ;)
14:05 < s7r> Tue Feb 22 20:03:35 2011 us=770853 Cannot open dh1024.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
14:05 < s7r> Tue Feb 22 20:03:35 2011 us=770865 Exiting
14:06 < majuk> So you need to generate your diffie-helman pem file. You skipped a step in setup.
14:07 < s7r> can you please tell me how i create it
14:07 < s7r> it was missed in the tutorial i've read
14:17 < Fleck> ecrist btw, next releases will have --enable-passwd-save compile option?
14:17 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has quit [Quit: Leaving]
14:19 -!- agrajag [~agrajag^@c-24-131-78-108.hsd1.pa.comcast.net] has joined #openvpn
14:21 -!- agrajag [~agrajag^@c-24-131-78-108.hsd1.pa.comcast.net] has quit [Changing host]
14:21 -!- agrajag [~agrajag^@CAcert/Assurer/agrajag] has joined #openvpn
14:26 -!- agrajag [~agrajag^@CAcert/Assurer/agrajag] has left #openvpn ["Leaving"]
14:29 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:31 < s7r> i have configured the dh file
14:31 < s7r> and still the same error
14:31 < s7r> i run ./build-dh
14:35 < Fleck> did you edit your config to point to yout dh?
14:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 246 seconds]
14:41 -!- Netsplit *.net <-> *.split quits: js_, pa, cron2, s7r, jpalmer, sno, robotti^, corretico, ScriptFanix, sedulous,  (+17 more, use /NETSPLIT to show all of them)
14:41 -!- Martin` is now known as Martin
14:42 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
14:42 -!- Martin is now known as Guest23763
14:43 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
14:43 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
14:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
14:43 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
14:51 < ecrist> Fleck: all future releases should have it from this point forward.
14:52 < Fleck> oook, thats cool!:)
14:52 < Fleck> thx ecrist 
14:53 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
14:53 -!- scandic [~scandic@186.Red-88-25-55.staticIP.rima-tde.net] has joined #openvpn
14:54 -!- Guest23763 is now known as Martin
14:54 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
14:54 -!- Martin is now known as Guest81705
15:00 -!- corretico [~laguilar@201.201.44.82] has joined #openvpn
15:00 -!- ScriptFanix [vincent@hanaman.riquer.fr] has joined #openvpn
15:00 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
15:00 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
15:00 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
15:00 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
15:00 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
15:00 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
15:00 -!- crazed [~crazed@unaffiliated/cr4z3d] has joined #openvpn
15:00 -!- nb [~nb@fedora/nb] has joined #openvpn
15:00 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
15:00 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
15:00 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
15:00 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
15:00 -!- bluethundr [~bluethund@ip-160-79-209-130.rev.intellispace.net] has joined #openvpn
15:00 -!- Bushmills [~l@scarydevilmonastery.net] has joined #openvpn
15:00 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
15:00 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
15:00 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
15:00 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
15:00 -!- js_ [~js@213.180.83.163] has joined #openvpn
15:00 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
15:00 -!- Champi [Champi@rootshell.fr] has joined #openvpn
15:00 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
15:00 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
15:00 -!- pa [~pa@unaffiliated/pa] has quit [Max SendQ exceeded]
15:00 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
15:00 -!- mode/#openvpn [+o cron2] by ChanServ
15:02 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Read error: Connection reset by peer]
15:05 -!- Netsplit *.net <-> *.split quits: cj, @mattock, kloeri, raw, katoen_, grapsus, rkantos, EugeneKaway, master_of_master, majuk-b-ded,  (+30 more, use /NETSPLIT to show all of them)
15:06 -!- Netsplit over, joins: Nappy
15:06 -!- Netsplit over, joins: @mattock, i7-Cud4, majuk, blackpenguin, ajbelayer, takamichi, raomin, master_of_master, toortog, Hamlin (+9 more)
15:06 -!- majuk-b-ded [~majuk@cpe-70-112-3-105.austin.res.rr.com] has quit [Write error: Broken pipe]
15:07 -!- Netsplit over, joins: EmperorTom, freaky[t], EO_, daemon, nijotz, derekv, Ramblurr, @patelx, EugeneKaway, aef (+2 more)
15:07 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
15:07 -!- Netsplit over, joins: [intra]lanman, hyper_ch, mant1s, raw, p3rror, rkantos, secretary_linux, cherwin
15:07 -!- Nappy is now known as Guest9701
15:14 -!- EugenMayer [~eugen@frbg-5d84f6b9.pool.mediaWays.net] has joined #openvpn
15:15 -!- EugenMayer [~eugen@frbg-5d84f6b9.pool.mediaWays.net] has quit [Client Quit]
15:21 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
15:23 -!- scandic [~scandic@186.Red-88-25-55.staticIP.rima-tde.net] has quit [Read error: Operation timed out]
15:31 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
15:38 -!- voglster [~voglster@66.226.243.126] has joined #openvpn
15:39 -!- SOG [~SOG@n11649233179.netvigator.com] has joined #openvpn
15:50 -!- Netsplit *.net <-> *.split quits: _zero_, zeshoem, fahadsadah, Rolybrau, |Mike|, jpalmer, @cron2, star314, Champi, Bushmills,  (+22 more, use /NETSPLIT to show all of them)
15:50 -!- Guest81705 is now known as Martin
15:50 -!- Martin is now known as Guest30833
15:50 -!- Netsplit over, joins: @cron2, d457k, SOG, star314, sno, fbh, Champi, js_, Rienzilla, LeRrA (+22 more)
15:50 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Max SendQ exceeded]
15:52 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:54 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
16:02 -!- Bronko [~frank@dtmd-4d0bdc19.pool.mediaWays.net] has joined #openvpn
16:02 < Bronko> hi guys, know anybody how can i connect the PC 
16:02 < Bronko> or all PC on the Server side over openvpn ?
16:02 < Bronko> i mean the network of the Server side
16:04 < majuk> Bronko, openvpn.net/index.php/open-source/documentation/howto.html#scope
16:05 < Bronko> thx majuk
16:05 < majuk> Bronko, np
16:05 < Bronko> is there any a example config ?
16:05 < majuk> A bunch at the bottom of that page.
16:05 < Bronko> or is it only the push statement ?
16:06 < Bronko> ahhh i see
16:08 < Bronko> is ip fowarding on win 2008 srv standard ?
16:09 -!- p3rror [~mezgani@41.248.186.202] has quit [Ping timeout: 264 seconds]
16:10 < hyper_ch> win server? ieeks
16:10 < Bronko> ya
16:11 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 276 seconds]
16:13 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
16:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:17 < Bronko> ah ok guys the openvpn is very good thx for the howto#scope link
16:17 < Bronko> n8
16:18 -!- Bronko [~frank@dtmd-4d0bdc19.pool.mediaWays.net] has quit [Remote host closed the connection]
16:20 -!- luneff [~yury@84.51.197.93] has joined #openvpn
16:25 -!- sayuke [~crc@149.171.12.159] has joined #openvpn
16:33 < havoc> this may be a silly question, but can bandwidth/throughput be increased by futzing with MTU?
16:34 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
16:35 < havoc> or is it primarily a function of CPU cycles?
16:40 <@vpnHelper> RSS Update - forum: Trouble setting up OpenVPN appliance in bridged mode <http://forums.openvpn.net/topic7670.html>
16:46 < voglster> roadwarrior config... connecting to my home network.  openvpn setup in tunnel mode (as its not the default gateway of my home network)  i can ping anything on my home network but cannot connect (ssh or http) to anything else on the network but the openvpn server and the default router.  Any thoughts what am I missing?
16:47 < majuk> havoc, IIRC, with Gigabit networking, you can do jumbo frames to increase total throughput, but the gain is marginal. Basically shaving overhead by reducing the number of TCP packets and, therefor, a reduced number of packet headers.
16:47 < havoc> ah, thanks
16:50 -!- voglster [~voglster@66.226.243.126] has quit [Ping timeout: 240 seconds]
17:03 -!- voglster [~voglster@31.sub-174-253-75.myvzw.com] has joined #openvpn
17:04 < voglster> lets try this again and see if dont get disconnected this time
17:04 < voglster> roadwarrior config... connecting to my home network.  openvpn setup in tunnel mode (as its not the default gateway of my home network)  i can ping anything on my home network but cannot connect (ssh or http) to anything else on the network but the openvpn server and the default router.  Any thoughts what am I missing?
17:05 < voglster> to even make things wierder... i have another subnet on my home network... and i can connect/ping/do everything fine on that network... 
17:10 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
17:14 -!- voglster [~voglster@31.sub-174-253-75.myvzw.com] has quit [Ping timeout: 272 seconds]
17:17 -!- voglster [~voglster@66.226.243.126] has joined #openvpn
17:18 -!- js_ [~js@213.180.83.163] has quit [Ping timeout: 260 seconds]
17:28 -!- raomin [~romain@86.66.22.65] has quit [Read error: Operation timed out]
17:28 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p9844>
17:30 -!- raomin_ [~romain@86.66.22.65] has joined #openvpn
17:31 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
17:32 -!- js_ [~js@213.180.83.163] has joined #openvpn
17:37 -!- tamlol12 [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has joined #openvpn
17:37 < tamlol12> Hello
17:37 -!- voglster [~voglster@66.226.243.126] has quit [Ping timeout: 272 seconds]
17:37 < tamlol12> I have a very big problem with openvpn routing, I'm going to tell you the situation
17:39 < tamlol12> I use topology subnet. I have a server and a client (1). The client (1) is connected to an other openVPN with a different subnet. I want to access a client (2) from my VPN-Server that is connected over the other VPN with client (1)
17:39 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
17:40 < tamlol12> So I added the route at my VPN-Server with client subnet from client (2) and I selected the IP from client (1) as gateway.
17:40 < tamlol12> can someone help me pls?
17:41 -!- p3rror [~mezgani@41.140.29.4] has joined #openvpn
17:45 < tamlol12> hello?
17:45 < tamlol12> Can someone help me pls?
17:46 < |Mike|> read the topic sir.
17:46 < tamlol12> |Mike|: lol no
17:46 < tamlol12> !welcome
17:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:47 < tamlol12> !goal
17:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:48 < tamlol12> |Mike|: so, can you help me? Or do you need additional information?
17:48 < |Mike|> !tell tamlol12 [logs]
17:48 < |Mike|> !tell tamlol12 [configs]
17:52 < tamlol12> there is nothing written in there... the routing does not work. The config does not affect to this problem, I can tell you everything you need. So I pose the question differently: How can I route Traffic from my VPN Server through my client to an other server that is connected to the client. The client is connected to two VPN-Servers with different subnet.
17:58 < |Mike|> it has to be sir
17:59 < |Mike|> !tell tamlol12 [route]
18:15 < Bushmills> !clientlan
18:15 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
18:15 <@vpnHelper> better explanation
18:15 < Bushmills> ^^^ tamlol12
18:16 < Bushmills> that assumes that you can access client2 from client1
18:20 -!- voglster [~voglster@65.107.181.2.ptr.us.xo.net] has joined #openvpn
18:34 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:35 -!- voglster_ [~voglster@66.226.243.126] has joined #openvpn
18:38 -!- voglster [~voglster@65.107.181.2.ptr.us.xo.net] has quit [Ping timeout: 272 seconds]
18:49 -!- zeshoem [~mnathani@bas1-toronto46-1279266471.dsl.bell.ca] has quit []
19:01 -!- voglster_ [~voglster@66.226.243.126] has quit [Ping timeout: 264 seconds]
19:02 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
19:03 -!- luneff [~yury@84.51.197.93] has joined #openvpn
19:13 -!- voglster_ [~voglster@65.107.181.2.ptr.us.xo.net] has joined #openvpn
19:16 -!- zeshoem [~mnathani@bas1-toronto46-1279266471.dsl.bell.ca] has joined #openvpn
19:20 -!- voglster_ [~voglster@65.107.181.2.ptr.us.xo.net] has quit [Quit: Leaving]
19:20 -!- tamlol12 [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has quit [Ping timeout: 272 seconds]
19:21 -!- jfkw [~jtk@216.115.6.82] has quit [Quit: leaving]
19:27 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 272 seconds]
19:38 -!- SOG_ [~SOG@222.125.196.155] has joined #openvpn
19:42 -!- SOG [~SOG@n11649233179.netvigator.com] has quit [Ping timeout: 246 seconds]
19:42 -!- SOG_ is now known as SOG
19:52 -!- mant1s [~mant1s@130.111.162.229] has joined #openvpn
19:52 -!- mant1s [~mant1s@130.111.162.229] has quit [Changing host]
19:52 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:59 -!- sayuke [~crc@149.171.12.159] has quit [Ping timeout: 268 seconds]
20:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
20:27 -!- sayuke [~crc@149.171.12.159] has joined #openvpn
20:33 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:44 <@vpnHelper> RSS Update - forum: Working Appliance, need to configure router <http://forums.openvpn.net/topic7671.html>
20:46 -!- p3rror [~mezgani@41.140.29.4] has quit [Ping timeout: 264 seconds]
21:01 < ecrist> !enable-passwd-save
21:01 -!- p3rror [~mezgani@41.140.37.76] has joined #openvpn
21:02 < ecrist> !learn enable-passwd-save as --enable-passwd-save is enabled on windows builds starting with 2.2 preview 8 and will be default going forward from 2.2 release
21:02 <@vpnHelper> Joo got it.
21:02  * ecrist poofs
21:07 -!- master_of_master [~master_of@p57B538E2.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
21:10 -!- master_of_master [~master_of@p57B535EA.dip.t-dialin.net] has joined #openvpn
21:19 -!- sayuke [~crc@149.171.12.159] has quit [Ping timeout: 264 seconds]
21:20 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
21:29 -!- luneff [~yury@84.51.197.93] has quit [Quit: Leaving]
21:29 -!- sayuke [~crc@149.171.12.159] has joined #openvpn
21:31 <@vpnHelper> RSS Update - forum: Setup on Win2008 R2 <http://forums.openvpn.net/topic7666.html#p9846>
21:31 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
21:48 -!- voglster [~voglster@66.226.243.126] has joined #openvpn
21:49 -!- p3rror [~mezgani@41.140.37.76] has quit [Ping timeout: 264 seconds]
21:56 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
21:58 < fahmad> hey
21:58 < fahmad> !ipv6
21:58 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
21:58 < fahmad> !snapshots
21:58 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
21:58 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:58 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:04 -!- SOG [~SOG@222.125.196.155] has quit [Quit: I will be back!]
22:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
22:49 -!- sayuke [~crc@149.171.12.159] has quit [Ping timeout: 276 seconds]
22:52 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
23:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:20 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:33 -!- albech [~thomas@119.42.77.127] has joined #openvpn
23:39 -!- hackeron [~hackeron@gentoo/user/hackeron] has joined #openvpn
23:40 < hackeron> hey, question, I have "status openvpn-status.log" in my openvpn config - I look in the file and I only see each client's external IP but not the internal IP openvpn assigns :/ - how do I get the internal IP?
23:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
--- Day changed Wed Feb 23 2011
00:10 -!- Xen^ [~linux@vpn.server4sale.com] has joined #openvpn
00:13 -!- fahmad [~linux@unaffiliated/fahmad] has quit [Ping timeout: 246 seconds]
01:16 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has joined #openvpn
01:25 <@vpnHelper> RSS Update - forum: Trouble setting up OpenVPN appliance in bridged mode <http://forums.openvpn.net/topic7670.html#p9847>
01:48 -!- Netsplit *.net <-> *.split quits: sedulous, WebDawg, APTX, TypoNe, toortog, ScriptFanix, belZe, K4k, crazed, raw,  (+48 more, use /NETSPLIT to show all of them)
01:48 -!- Netsplit *.net <-> *.split quits: Bogdar, snapcase, UnterPerro, Peer^, meepmeep, sia^pwnnt, Dropje, jwm, fahadsadah, mant1s,  (+64 more, use /NETSPLIT to show all of them)
01:53 -!- Netsplit over, joins: dazo_afk
01:53 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:53 -!- Netsplit over, joins: Rolybrau, jpalmer, Bushmills, hyper_ch, hackeron, void_pointer, Xen^, albech, mant1s, simplechat (+35 more)
01:53 -!- ServerMode/#openvpn [+oo dazo_afk cron2] by jordan.freenode.net
01:54 -!- Netsplit over, joins: EmperorTom, Essobi, freaky[t], `mx, raw, batrick, havoc, aef, EugeneKaway, @patelx (+75 more)
02:05 -!- Netsplit *.net <-> *.split quits: snapcase
02:05 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:05 -!- void_pointer [~void@unaffiliated/void-pointer/x-0665301] has quit []
02:24 -!- Netsplit *.net <-> *.split quits: Rolybrau, belZe, sbrath_, _zero_, buntfalke_, master_of_master, oracle
02:25 -!- Netsplit *.net <-> *.split quits: rolls`, ucekpolish, Bogdar, UnterPerro, i7-Cud4, EugeneKaway, ScriptFanix, Peer^, rkantos, secretary_linux,  (+114 more, use /NETSPLIT to show all of them)
02:36 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
02:36 -!- Netsplit over, joins: hackeron, `mx, morbidwar, renihs, oc80z, raidzx, reiffert, mete, sakhi, naquad
02:36 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
02:36 -!- Netsplit over, joins: EmperorTom, Rolybrau, jpalmer, Bushmills, hyper_ch, @dazo_afk, buntfalke_, Xen^, albech, mant1s (+38 more)
02:36 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
02:36 -!- Netsplit over, joins: Essobi, freaky[t], @patelx, Ramblurr, derekv, nijotz, daemon, EO_, WebDawg, katoen_ (+58 more)
02:42 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
02:46 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
02:50 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9851>
02:50 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
02:50 -!- MarKsaitis [~MarKsaiti@host81-138-103-233.in-addr.btopenworld.com] has joined #openvpn
03:03 -!- EugeneKay is now known as EugeneKaway
03:09 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:09 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:13 -!- EugeneKaway is now known as EugeneKay
03:16 -!- p3rror [~mezgani@41.140.30.245] has joined #openvpn
03:26 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p9852>
03:32 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9853>
03:35 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:35 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
03:39 -!- zeshoem [~mnathani@bas1-toronto46-1279266471.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
03:44 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9854>
03:44 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
03:44 -!- zeshoem [~mnathani@bas1-toronto46-1177856691.dsl.bell.ca] has joined #openvpn
03:44 -!- zeeshoem [~mnathani@bas1-toronto46-1177856691.dsl.bell.ca] has joined #openvpn
03:44 -!- zeeshoem [~mnathani@bas1-toronto46-1177856691.dsl.bell.ca] has quit [Remote host closed the connection]
03:53 -!- dazo_afk is now known as dazo
03:59 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has joined #openvpn
03:59 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has quit [Changing host]
03:59 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:12 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 272 seconds]
04:16 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
04:16 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Remote host closed the connection]
04:17 <@vpnHelper> RSS Update - forum: Windows auto-connect when starting gui <http://forums.openvpn.net/topic7623.html#p9855>
04:28 -!- JyZyXEL [~lol@a88-112-69-207.elisa-laajakaista.fi] has quit [Read error: Connection reset by peer]
04:33 -!- Xen^ [~linux@vpn.server4sale.com] has quit []
04:36 -!- raomin_ [~romain@86.66.22.65] has quit [Quit: leaving...]
04:39 -!- KuRupt [~bezou_rox@130.171.64-86.rev.gaoland.net] has joined #openvpn
04:55 -!- KuRupt [~bezou_rox@130.171.64-86.rev.gaoland.net] has quit [Ping timeout: 250 seconds]
05:05 -!- zeshoem [~mnathani@bas1-toronto46-1177856691.dsl.bell.ca] has quit [Ping timeout: 272 seconds]
05:09 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:09 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:09 -!- WormFood [~wormfood@183.38.237.195] has quit [Ping timeout: 240 seconds]
05:11 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
05:14 -!- zeshoem [~mnathani@bas1-toronto46-1279266196.dsl.bell.ca] has joined #openvpn
05:15 -!- zeeshoem [~mnathani@bas1-toronto46-1279266196.dsl.bell.ca] has joined #openvpn
05:22 -!- WormFood [~wormfood@183.15.96.162] has joined #openvpn
05:22 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9856>
05:31 -!- zxd_ [~zxd@213.108.249.197] has joined #openvpn
05:34 -!- zxd [~zxd@95.211.21.37] has quit [Ping timeout: 240 seconds]
05:34 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9857>
05:37 -!- zxd_ [~zxd@213.108.249.197] has quit [Ping timeout: 276 seconds]
05:37 -!- raomin [~romain@86.66.22.65] has joined #openvpn
05:38 -!- zxd_ [~zxd@95.211.21.37] has joined #openvpn
05:41 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has quit [Ping timeout: 276 seconds]
05:44 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
05:46 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
05:52 -!- freaky[t] [alpha@freakyy.de] has quit [Remote host closed the connection]
05:52 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9858>
05:57 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
06:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
06:14 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
06:18 -!- zxd_ [~zxd@95.211.21.37] has quit [Read error: Connection reset by peer]
06:18 -!- zxd_ [~zxd@95.211.21.37] has joined #openvpn
06:21 -!- zxd_ [~zxd@95.211.21.37] has quit [Client Quit]
06:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:55 -!- ronsel [~ronsel@dslb-088-074-160-248.pools.arcor-ip.net] has joined #openvpn
06:56 < ronsel> hi guys, which one is a goog gui tool to create certificates for mac
06:59 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p9859>
07:01 < ecrist> !ssl-admin
07:01 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
07:02 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:11 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9860>
07:22 -!- voglster [~voglster@66.226.243.126] has quit [Ping timeout: 272 seconds]
07:23 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9861>
07:27 -!- Diffen2 [~diffen2@c-2472e555.042-17-73746f11.cust.bredbandsbolaget.se] has left #openvpn ["Leaving"]
07:40 <@vpnHelper> RSS Update - forum: How to change MAC address <http://forums.openvpn.net/topic7673.html> || Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p9862>
07:42 -!- dvsxutact [~dvsxutact@ip68-228-166-118.ok.ok.cox.net] has joined #openvpn
07:43 < dvsxutact> hey guys, bit of a weird issue, i have a local network 192.168.1.x and a OpenVPN Connection to a remote network 192.168.2.x , for some reason the pc with the openvpn connection (connection to the 2.x network) can ping 192.168.2.1 but none of the other pc's on the network, and the pc's on the 2nd network cannot ping the 192.168.1.x machines... is there any guides to setting up what im trying 
07:43 < dvsxutact> todo or do all the pc's need to be on the 192.168.1.x network?
07:46 < janjust> dvsxutact: this is a routing issue mostly; read http://openvpn.net/index.php/open-source/documentation/howto.html#scope for details
07:46 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9865> || How to change MAC address <http://forums.openvpn.net/topic7673.html#p9864>
07:46 <@vpnHelper> Title: HOWTO (at openvpn.net)
07:46 < dvsxutact> ty, i just found it ;)
07:46 < janjust> perhaps the vpnHelper also knows a few tricks but the HOWTO definitely's got the right info
07:46 < ecrist> !route
07:46 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
07:46 < ecrist> !iroute
07:46 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
07:47 < janjust> hehe thx ecrist 
07:47 -!- corretico [~laguilar@201.201.44.82] has quit [Ping timeout: 260 seconds]
07:47 < ecrist> janjust: !factoids is nice, too, if you've not seen it
07:47 < ecrist> !factoids
07:47 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
07:47 < dvsxutact> i just added the push "192.168.2.0 255.255.255.0" to the config file..
07:47 < janjust> yo ecrist , did you know you are mentioned in the 'About the reviewers' section of my !book
07:47 < dvsxutact> to expose the other machines...
07:48 < ecrist> janjust: krzee said he mentioned my name. :)
07:48 < janjust> I've got the first paper copy right in front of me and yes, he mentioned your name
07:48 < ecrist> I'm pleased. :D
07:49 < ecrist> the community has come pretty far in the last ~3 years
07:49 < ecrist> this channel used to have an average of 6 users
07:49 < ecrist> there used to be no forum whatsoever, and the community and openvpn tech didn't even talk to eachother
07:49 < janjust> first the SF.net was the most important place
07:50 < janjust> then the mailing list became dominant, now it seems the forums and this IRC channel are becoming increasingly important
07:50 < ecrist> #openvpn-devel is extremely important
07:50 < janjust> well , if you kick out the channel lurkers we're still left with only ~6 users :P
07:50 -!- zeeshoem [~mnathani@bas1-toronto46-1279266196.dsl.bell.ca] has quit [Read error: Operation timed out]
07:51 < ecrist> all the core interaction takes place on IRC with the mailing list as a second medium for non-IRCers
07:51 < ecrist> heh
07:51 -!- voglster [~voglster@31.sub-174-253-75.myvzw.com] has joined #openvpn
07:51 < ecrist> janjust: http://www.secure-computing.net/logs/openvpn-last30.html
07:51 <@vpnHelper> Title: #openvpn statistics created with mIRCStats v1.23 by ecrist (at www.secure-computing.net)
07:51 < janjust> yeah, well, I'm not completely used to IRC yet - I liked the mailing list a lot better, actually, as I was not/am not continuously on this channel
07:51 < ecrist> last updated the 11th of Feb, but a good snapshot
07:51 -!- zeshoem [~mnathani@bas1-toronto46-1279266196.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
07:52 < janjust> hehe ecrist , how can it be accurate if I'm not mentioned :P (and krzee 1216 lines?)
07:52 < ecrist> janjust: http://quadpoint.org/articles/irssi
07:52 <@vpnHelper> Title: A Guide to Efficiently Using Irssi and Screen | quadpoint.org (at quadpoint.org)
07:53 < ecrist> janjust: that was a 30-day snapshot
07:53 < ecrist> !irclogs
07:53 <@vpnHelper> "irclogs" is Channel logs are available at http://secure-computing.net/logs/openvpn.txt and are updated in real-time while ecrist is online.
07:53 < ecrist> !ircstats
07:53 <@vpnHelper> "ircstats" is (#1) 30-Day Stats: http://www.secure-computing.net/logs/openvpn-last30.html, or (#2) All-Time Stats: http://www.secure-computing.net/logs/openvpn.html
07:53 < janjust> lol , I know, just kidding
07:53 < ecrist> I failed to mention I have a sed script which removes all mentions of you. ;)
07:54 < janjust> hehe
07:54 < ecrist> I'm holding your IRC existence here as a hostage until I find a copy of your new book.
07:54 < janjust> irssi seems cool - 
07:54 < janjust> I'm just here on this channel to promote my book, of course
07:54 < janjust> as soon as the sales skyrocket I'm off again
07:54 < ecrist> that's what I use.  coupled with screen on a *nix box, I never have to disconnect from IRC, but I can move around and reconnect to my active session.
07:55 < ecrist> well, the quicker you leave, the quicker we can start bad-mouthing you.
07:55 < janjust> lol
07:55 < ecrist> who am I kidding, we'll say it to your face.
07:57 -!- voglster [~voglster@31.sub-174-253-75.myvzw.com] has quit [Ping timeout: 276 seconds]
07:57 <@vpnHelper> RSS Update - forum: WinXP Openvpn Performance <http://forums.openvpn.net/topic7674.html>
07:58 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
07:59 < s7r> how can i fix this error
07:59 < s7r> Cannot open dh1024.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
07:59 < janjust> s7r: which platform? what's the path to your dh1024.pem file in the server config?
07:59 < s7r> !fopen
07:59 < s7r> ubuntu 10.04
07:59 < s7r> openvpn 2.1.4
08:00 < s7r> yes dh1024.pem is in /etc/openvpn/easy-rsa/keys
08:00 < s7r> along with ca.crt, server.crt, server.key etc etc
08:00 < s7r> i have done ./build-dh
08:00 < s7r> when setup
08:00 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
08:00 < janjust> check the permissions of the file *AND* the directory
08:00 < s7r> janjust: how ?
08:00 < janjust> I normally copy over the dh1024.pem file, ca.crt and server.{crt,key} files to another directory 
08:00 < s7r> :D
08:01 < janjust> `ls -ald /etc/openvpn/easy-rsa/keys /etc/openvpn/easy-rsa/keys/*`
08:01 < janjust> or simply run openvpn as 'root' (remove "user ... ; group ..." from the server config) and see if it works then
08:02 < janjust> if so, then you've definitely got a permissions problem
08:02 <@vpnHelper> RSS Update - forum: New Mod: maikcat <http://forums.openvpn.net/topic7675.html>
08:04 < s7r> openvpn is as root
08:04 < s7r> user nobody and group are commented
08:04 < s7r> with ; at the begining
08:04 < s7r> so they are not active
08:04 < s7r> in server.conf
08:06 < janjust> then, as root, try opening the file exactly as it is specified in the server config, using a text editor (e.g. vi /etc/openvpn/easy-rsa/keys/dh1024.pem)
08:06 < s7r> yes i can see a file ---BEGIN DH PARAMETERS-- bla bla
08:06 < s7r> via vi
08:07 < s7r> the command you told me
08:07 -!- zeshoem [~mnathani@bas1-toronto46-1177980118.dsl.bell.ca] has joined #openvpn
08:07 -!- zeeshoem [~mnathani@bas1-toronto46-1177980118.dsl.bell.ca] has joined #openvpn
08:07 < janjust> hmmm try running openvpn with 'openvpn --config yourserverconfig --dh /etc/openvpn/easy-rsa/keys/dh1024.pem'
08:08 -!- voglster [~voglster@66.226.243.126] has joined #openvpn
08:08 < s7r> done
08:09 < s7r> root@mailserver:/etc/openvpn# openvpn --config server.conf --dh /etc/openvpn/easy-rsa/keys/dh1024.pem
08:09 < s7r> no output
08:09 < janjust> you mean, it starts up?
08:09 < s7r> i didn't get any output
08:09 < s7r> but if i do
08:09 < s7r> /etc/init.d/openvpn restart
08:09 < janjust> is there a 'log ...' or 
08:09 < janjust> 'log-append ...' line in the server config?
08:09 < s7r>  *   No VPN is running.
08:09 < s7r>  * Starting virtual private network daemon(s)...                                 *   Autostarting VPN 'server'                                           [fail]
08:10 < s7r> yes there is a openvpn.log
08:10 < janjust> check that file when you run it from the command line
08:10 < s7r> vi /etc/openvpn/openvpn.log
08:11 < s7r> i see a log, with verb 5 recorede
08:11 < s7r> many lines
08:11 < janjust> does it end with "Initialization Sequence Completed" ?
08:14 < s7r> nope
08:14 < s7r> it ends with this
08:14 < s7r> Cannot open dh1024.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
08:14 < s7r> Wed Feb 23 14:02:12 2011 us=229141 Exiting
08:15 < s7r> Exiting is the last line in the log
08:15 < Guest30833> I have an openvpn server running in bridge mode, but when I push the gateway, it sets the openvpn server as default gateway. BUt can't it be the normal router in the network?
08:15 -!- Guest30833 is now known as Martin`
08:17 < janjust> s7r: 14:02 is that the time when you started it on the command line?
08:17 < janjust> comment out the 'log' or 'log-append' line and try again
08:18 < janjust> Martin`: when you "push the gateway" what do you mean? "push "redirect-gateway def1" ? then indeed the OpenVPN server becomes the default gateway
08:18 <@vpnHelper> RSS Update - forum: How to change MAC address <http://forums.openvpn.net/topic7673.html#p9869> || WinXP Openvpn Performance <http://forums.openvpn.net/topic7674.html#p9868>
08:18 < Martin`> janjust: yes, I mean that
08:19 < Martin`> push "redirect-gateway"
08:20 < janjust> Martin`: configure openvpn to use an external DHCP server: that way the clients pick up the IP info from the DHCP Server, including the gateway
08:20 < Martin`> hmm is that also possible :P
08:21 < janjust> Martin`: yes :)  use 'server-bridge' without any arguments, in which case all DHCP-like requests are forwarded out onto the server-side subnet
08:21 < Martin`> and comment out the push gateway ?
08:22 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:22 < janjust> indeed, that's not needed in that case
08:22 < Martin`> I have now "server-bridge 10.1.1.111 255.255.255.0 10.1.1.200 10.1.1.254"
08:22 < Martin`> but just remove the rest behind server-bridge ?
08:22 < janjust> comment out that line, replace it with 'server-bridge'
08:22 < Martin`> ok
08:23 < janjust> you DO need an external DHCP Server on your server-side LAN that is willing to provide DHCP addresses to the VPN clients, though
08:23 < Martin`> I think the router will do that?
08:23 <@vpnHelper> RSS Update - forum: How to change MAC address <http://forums.openvpn.net/topic7673.html#p9870>
08:23 < janjust> most routers do , yes, unless you've configured them NOT to do that
08:24 < Martin`> ok lets test is, am I able to see it in openvpn log if it works?
08:24 < janjust> you can see it on the client side and on the DHCP server : check the IP address (and gateway) assigned to the client
08:24 < Martin`> ok
08:24 < Martin`> going to test :P
08:25 < s7r> i did as you said janjust and now i don't get the dh eror any more
08:25 < s7r> i get
08:25 < s7r> ote: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)
08:25 < s7r> Wed Feb 23 14:24:14 2011 us=498145 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
08:25 < s7r> Wed Feb 23 14:24:14 2011 us=498785 Cannot allocate TUN/TAP dev dynamically
08:25 < s7r> Wed Feb 23 14:24:14 2011 us=498799 Exiting
08:26 < janjust> s7r: running openvpn on ubuntu shouldn't be this hard... please double check that you're running as root
08:26 < s7r> yes sir I am, trust me 
08:26 < s7r> if you don't believe me i give you the root paswd
08:27 < s7r> as i do not have any sensitive data
08:27 <@dazo> janjust: s7r is running via an openvz VPS
08:27 < s7r> yeah but i have the tun/tap module activated and it should work according to them
08:28 < janjust> openvz? running ubuntu? I thought that was always a CentOS clone
08:28 < janjust> hmmm s7r: try doing a 'rmmod tun ; modprobe tun'
08:28 < s7r> look dazo, janjust i did exactly as here https://secure.intovps.com/knowledgebase/19/How-to-install-and-configure-OpenVPN.html
08:28 <@vpnHelper> Title: IntoVPS - Knowledgebase - How to install and configure OpenVPN (at secure.intovps.com)
08:28 < s7r> and according to them this procedure worked for everybody (except for me) :)
08:29 < Martin`> janjust: hmm it does not get an ip anymore :P
08:29 < daemon> s7r, I use intovps with poptop and openvpn
08:29 < daemon> both work perfectly
08:29 < daemon> even though IO actually followed the guide on the openvpn site
08:30 < s7r> yes but for me it isn't working
08:30 < s7r> since last night i am trying to get it work
08:30 < daemon> <s7r> Wed Feb 23 14:24:14 2011 us=498145 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
08:30 < daemon> <s7r> Wed Feb 23 14:24:14 2011 us=498785 Cannot allocate TUN/TAP dev dynamically
08:30 < daemon> ls /dev/net | grep tun
08:30 < daemon> ls /dev/net | grep tap
08:30 < daemon> see if any devices exist
08:30 < daemon> if they do not you will have to enable them in config panel
08:30 < s7r> t@mailserver:/etc/openvpn# ls /dev/net | grep tun
08:30 < s7r> tun
08:31 <@dazo> daemon: would ifconfig -a | egrep "tun|tap" be a way to check that as well?
08:31 < s7r> /dev/net/tun exists
08:31 < daemon> dazo, should work
08:31 < janjust> Martin`: I was afraid of that :P 
08:31 < Martin`> hmm no wait, he said he has an ip now :P
08:31 < daemon> s7r, ok in openvpn config tell it the device statically 
08:31 < s7r> how?
08:31 < janjust> Martin`: yes it can take a while, but make sure it's not a 169 address
08:31 < Martin`> no it is an adres in his internal subnet :)
08:32 < janjust> so the dhcp server on the vpn side did not respond? hmmm
08:32 < daemon> s7r, device=/dev/tun0 I THINK one second let me check
08:32 < Martin`> janjust: yes that one responed?
08:32 < janjust> Martin`: so it's now working :D ?
08:33 <@dazo> daemon: s7r:  dev /dev/tun0  probably
08:33 < Martin`> hmm think, not, the default route is not changed I think 
08:33 < daemon> s7r, ^ note that yours will probably be 'tun' not tun0
08:34 < janjust> Martin`:  otherwise , restore the original 'server-bridge' line and add a 'push "route 0.0.0.0 0.0.0.0 <IP of server-side GW>"' to the server config
08:34 <@vpnHelper> RSS Update - forum: How to change MAC address <http://forums.openvpn.net/topic7673.html#p9871>
08:34 < Martin`> ok
08:34 < daemon> s7r, if it still fails to work disable tun in config panel on intovps
08:34 < s7r> how is telling me 
08:34 < daemon> and then reenable it
08:34 < s7r> tun0 no such file or directory
08:34 < janjust> then you're pushing out the server-side GW explicitly ; there's a good chance that you'll loose the conneciton though ;-)
08:36 < Martin`> when I do push gateway, then there will a route added tot the client site gateway :P
08:37 < s7r> daemon: i have done it
08:37 < s7r> enabled again and restarted the machine
08:37 < Martin`> route to openvpn server via local gateway 
08:37 < s7r> now i wait to get it up
08:37 < Martin`> I mean
08:38 < Martin`> hmm he has now 2 default gateways :(
08:38 < Martin`> default            10.58.0.254        UGSc            4       16     en1
08:38 < Martin`> default            10.1.1.1           UGScI           0        0    tap0
08:39 <@vpnHelper> RSS Update - forum: How to change MAC address <http://forums.openvpn.net/topic7673.html#p9872>
08:40 < s7r> daemon: if i let it iwth tun0
08:40 < s7r> it says no device found
08:40 < s7r> if i let it with tun
08:40 < s7r> it says cannot allocate dynamically
08:40 < Martin`> janjust: I think the same thing will hapen when I do it like you say? 
08:40 < janjust> Martin`: so the route was added correctly, but the original route is still intact.. that's both good and bad ...
08:40 < Martin`> yes :(
08:41 < janjust> actually it makes sense that there are two default routes: it's just an extra (default) route for this adapter
08:41 < Martin`> yes
08:42 < janjust> you can change the metric of the vpn default route so that it "wins" from the regular route...
08:42 < janjust> this depends a little bit on the client OS (MacOS?) though
08:42 < Martin`> but the first one needs to be changed that the first gateway only be used for connection to the openvpn server
08:42 < Martin`> yes
08:43 < janjust> eh? do you wish to redirect all traffic to the openvpn server or not?
08:43 < Martin`> yes
08:43 < janjust> you can also push out an explicit route to the vpn server itself
08:44 < s7r> isnt' any way to make my openvpn work?
08:44 < janjust> using 'push "route <VPN-server-IP> 255.255.255.255 net_gateway" ' (where net_gateway is a special keyword)
08:44 < Martin`> I mean that, that hapens when I use "push "redirect-gateway"" 
08:45 < Martin`> ok and  <VPN-server-IP> is the servers remote ip?
08:45 < janjust> yep
08:45 < Martin`> this is server side?
08:45 < janjust> if you're push'ing , yes
08:45 < Martin`> ok
08:45 < janjust> you can also add the same statements to the client config without the push
08:45 < janjust> that's actually easier when debugging routing issues like this
08:46 < Martin`> hmm but does the push delete the default gateway too?
08:46 < janjust> it shouldn't but it might ;-)
08:48 < Martin`> Lets test :P
08:51 < janjust> Martin`: another thing to try is to use 'redirect-gateway def1' and 'route-gateway <IP-of-server-side-GW>' together
08:51 < janjust> that might also work
08:51 < s7r> root@mailserver:/dev/net# cat /dev/net/tun
08:51 < s7r> cat: /dev/net/tun: No such device
08:51 < s7r> but there is a tun in /dev/net if i type "dir"
08:51 < s7r> wtf?
08:52 < janjust> s7r: that's normal for a device like this; what does 'ifconfig -a | grep tun' or 'lsmod | grep tun' give?
08:52 < s7r> nothing
08:52 < s7r> i typed both commands
08:52 < s7r> and no output
08:52 < janjust> then your 'tun' device is not loaded properly - check the VPN config again
08:53 < s7r> what else should i check
08:53 < s7r> i have checked everything
08:53 < s7r> and i done everything as they say
08:53 < janjust> sorry, I meant VPS , not VPN. 
08:53 < s7r> ohh
08:54 < s7r> yeap
08:54 < s7r> i have enabled it there too
08:54 < Martin`> this is #openvpn not #openvps :P
08:54 < s7r> multiple times
08:54 < janjust> go to an intovps forum and ask there - there's very little openvpn can do if the tun device is not present
08:55 < janjust> Martin`, you seem connected via Uitgeest, is that correct?
08:56 < Martin`> yes
08:56 < Martin`> why?
08:56 < Martin`> :P
08:56 < Martin`> how did you find that :(
08:57 < janjust> hehe just checking, mede-lander :P
08:57 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
08:57 < Martin`> :P
08:57 < janjust> your connecting IP is octocore.net and that's based in Uitgeest
08:57 < Martin`> hmm strange
08:58 < Martin`> domain is uitgeest?
08:58 < janjust> nope, octocore
08:58 < Martin`> ip is registered on velserbroek
08:58 < Martin`> :P
08:58 < Martin`> but host octocore.net is located in amsterdam
08:58 < Martin`> but I life in uitgeest
08:58 < Martin`> :P
08:59 < janjust> domain octocore.net is registered to somebody in uitgeest
08:59 < Martin`> true :)
08:59 < ecrist> is that anywhere near octopussy?
08:59 < janjust> lol ecrist 
08:59 < Martin`> :P
08:59 < Martin`> I think I don't like the use of dhcp server
08:59 < Martin`> it is slow :P
09:00 < janjust> then try 'redirect-gateway' + 'route-gateway' 
09:00 < Martin`> ok
09:00 < janjust> haven't tested that one myself, I must add
09:03 < Martin`> hmm no wait, the tap0 isnt in bridge anymore
09:04 < janjust> tap0 on the client or on the server?
09:04 < Martin`> server
09:04 < janjust> hmmm that's a server side issue, it's not something openvpn can do by itself 
09:05 < Martin`> well it was an upscript maken the bridge, but it only works one time :P
09:06 < Martin`> or it needs to destroy/create bridge during restart :P
09:06 < Martin`> But thats one thing it can be done later
09:06 < Martin`> during server boot: create bridge, during openvpn start add tap0 to bridge
09:07 < janjust> there's a 'bridge-start' script that comes with openvpn itself that works pretty well
09:07 < janjust> or just read chapter 3 of my book :P
09:07 < janjust> !book
09:07 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
09:07 < Martin`> your book?
09:08 < Martin`> nice :)
09:09 < janjust> <<< gotta go for now, do some shopping before the snow hits town
09:09 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
09:12 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:20 -!- voglster [~voglster@66.226.243.126] has quit [Ping timeout: 264 seconds]
09:23 <@vpnHelper> RSS Update - forum: ipv6 payload patch: ipv6 addr not set on linux client tap0 <http://forums.openvpn.net/topic7676.html>
09:29 <@vpnHelper> RSS Update - forum: Setup on Win2008 R2 <http://forums.openvpn.net/topic7666.html#p9874>
09:30 -!- spiekey [~mario@projekte.imos.net] has joined #openvpn
09:30 < spiekey> Hello!
09:30 < spiekey> i installed openvpn with ./configure && make && make install, but i only get the sbin and share directories.
09:30 < spiekey> has this changed recently?
09:31 < EugeneKay> Bugger if I know. I use yum.
09:35 <@vpnHelper> RSS Update - forum: How to change MAC address <http://forums.openvpn.net/topic7673.html#p9875>
09:36 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:41 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9876>
09:47 <@vpnHelper> RSS Update - forum: Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html>
09:50 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Ping timeout: 276 seconds]
09:53 < ecrist> what are you expecting?
09:56 < |Mike|> beer, tits, wet t-shirt contest, pot
10:03 < majuk> ...love.
10:06 < EugeneKay> !beer
10:06 <@vpnHelper> "beer" is its what's for dinner!
10:12 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
10:27 < majuk> lol
10:30 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:44 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
10:44 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
10:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:46 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 268 seconds]
10:47 -!- onkel_ [onkel@gateway/shell/shellium.org/x-wkxgpsctzdaotbvy] has joined #openvpn
10:47 <@vpnHelper> RSS Update - forum: config for fast server? <http://forums.openvpn.net/topic7678.html>
10:47 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Read error: Operation timed out]
10:48 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
10:49 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
10:56 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Read error: Connection reset by peer]
10:58 <@dazo> spiekey: I'm not sure I understand you correctly ... but what more would you expect?
10:58 <@dazo> openvpn is basically just the openvpn binary
11:04 -!- onkel_ is now known as strec
11:07 < gladiatr> a binary and a man page
11:09 < EugeneKay> 77890-p5gu[]\
11:15 < gladiatr> indeed...
11:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
11:17 < spiekey> could i create my certificates and stuff manually, too?
11:17 < spiekey> without using the easy-rsa stuff?
11:18 < spiekey> i already have a ca and certs...
11:19 -!- voglster [~voglster@66.226.243.126] has joined #openvpn
11:20 < ecrist> yes
11:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
11:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
11:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
11:25 -!- voglster [~voglster@66.226.243.126] has quit [Ping timeout: 272 seconds]
11:26 < EugeneKay> I would recommend using an intermediate, openvpn-specific ca crt
11:27 < spiekey> whats that?
11:27 < EugeneKay> A ca cert signed by your "root" ca
11:28 < spiekey> oh yes...thats the plan
11:28 < EugeneKay> I keep separate intermediate CAs for Servers, People(code/email/browser identification), and OpenVPN access
11:29 < spiekey> i would like to use my certs for openvpn and apache2
11:29 < EugeneKay> Totally doable.
11:29 < spiekey> lets see if i can do it:)
11:30 < EugeneKay> Best way to get an idea of what you need where is to make up a "dummy" PKI with easy-rsa and then copy the layout with your "real" files.
11:30 < spiekey> yes...i already enabled set -x in the scripts to see what it does ;)
11:31 < EugeneKay> I used easy-rsa as a "base" for my PKI scripts.
11:31 < EugeneKay> Much shell scripting
11:31 < EugeneKay> Assuming I remember to login once a week to generate the new CRLs, everything goes smoothly
11:37 -!- ronsel [~ronsel@dslb-088-074-160-248.pools.arcor-ip.net] has quit [Ping timeout: 272 seconds]
11:52 -!- albech [~thomas@119.42.77.127] has quit [Quit: Ex-Chat]
11:53 -!- dazo is now known as dazo_afk
12:01 -!- zeshoem [~mnathani@bas1-toronto46-1177980118.dsl.bell.ca] has quit []
12:01 -!- zeeshoem [~mnathani@bas1-toronto46-1177980118.dsl.bell.ca] has quit []
12:02 -!- zeshoem [~mnathani@bas1-toronto46-1177980118.dsl.bell.ca] has joined #openvpn
12:08 -!- voglster [~voglster@31.sub-174-253-75.myvzw.com] has joined #openvpn
12:10 <@vpnHelper> RSS Update - forum: Routing/firewall Issue or a more fundamental problem? <http://forums.openvpn.net/topic7679.html>
12:10 -!- luneff [~yury@84.51.197.93] has joined #openvpn
12:13 -!- MarKsaitis [~MarKsaiti@host81-138-103-233.in-addr.btopenworld.com] has quit [Remote host closed the connection]
12:19 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
12:22 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
12:22 < s7r> still getting that tun/tap error
12:22 < ecrist> no idea what you're talking about
12:23 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
12:23 < s7r> Wed Feb 23 18:21:29 2011 us=761830 Cannot open TUN/TAP dev /dev/tun0: No such file or directory (errno=2)
12:23 < s7r> Wed Feb 23 18:21:29 2011 us=761843 Exiting
12:24 < s7r> i think openvpn should look in /dev/net/tun
12:24 < s7r> how i change this
12:25 < ecrist> dev /dev/net/tun
12:25 < ecrist> in config
12:27 < s7r> i change
12:27 < s7r> andn ow i get
12:27 < s7r> Options error: --server directive only makes sense with --dev tun or --dev tap
12:27 < s7r> Use --help for more information.
12:27 < ecrist> !configs
12:27 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
12:27 < ecrist> are you on openvz?
12:27 < ecrist> !openvz
12:27 < s7r> yeah
12:27 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
12:28 < ecrist> openvz is a pain in the ass
12:28 < ecrist> iirc, someone pointed you to that the other day
12:32 < s7r> so what can I do
12:32 < s7r> there is a tutorial on my vps provider
12:32 < s7r> explaining how to do it
12:32 < s7r> i have done it and still not working
12:32 < s7r> daemon here uses openvpn on the same vps as i have without any problems
12:36 < s7r> what can i do i am trying to fix this for over 10 hours
12:36 < s7r> in /dev/net there is something tun (if i type dir or ls)
12:36 < s7r> but according to openvpn.log it looks like that openvpn can not find any tun
12:37 < s7r> tun0
12:37 < s7r> if i change tun0 to tun simple it says that it can not allocate dynamic numbers etc
12:38 < ecrist> vpnHelper just linked something for you regarding openvx
12:38 < ecrist> openvz*
12:39 < s7r> i have browsed the links
12:39 < s7r> i have done exactly as in second one
12:39 < s7r> exactly step by step
12:40 < ecrist> well, then I don't know, I use a real OS
12:40 < ecrist> I'm guessing if you followed the links and did what was suggested, you'd have a working VPN
12:42 -!- oracle_ [~o2@unaffiliated/spice] has joined #openvpn
12:42 -!- oracle [~o2@unaffiliated/spice] has quit [Read error: Operation timed out]
12:43 -!- voglster [~voglster@31.sub-174-253-75.myvzw.com] has quit [Ping timeout: 240 seconds]
12:43 < s7r> this would be normal
12:43 < s7r> but i don't
12:46 < s7r> ecrist: what you suggest?
12:47 < spiekey> EugeneKay, if i sign and create my stuff manuall, then i dont need the Diff-Hellman anymore, right?
12:50 < ecrist> s7r: I already told you
12:50 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p9880>
12:55 < ecrist> spiekey: you still want the DH
12:55 <@vpnHelper> RSS Update - forum: connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html>
12:55 -!- voglster [~voglster@141.sub-174-253-85.myvzw.com] has joined #openvpn
12:56 < spiekey> ecrist, why?
12:56 < spiekey> i never saw dh beeing used when create self singed apache2 certs
12:56 < ecrist> !google what use diffie-hellman
12:56 <@vpnHelper> Diffie–Hellman key exchange - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange>; A Review of the Diffie-Hellman Algorithm and its Use in Secure ...: <http://www.sans.org/reading_room/whitepapers/vpns/review-diffie-hellman-algorithm-secure-internet-protocols_751>; RSA Laboratories - 3.6.1 What is Diffie-Hellman?:
12:56 <@vpnHelper> <http://www.rsa.com/rsalabs/node.asp?id=2248>
13:04 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
13:04 -!- luneff [~yury@84.51.197.93] has joined #openvpn
13:07 -!- Mahjongg [~nick@unaffiliated/mrkeuner] has joined #openvpn
13:26 -!- voglster [~voglster@141.sub-174-253-85.myvzw.com] has quit [Ping timeout: 272 seconds]
13:35 < Mahjongg> hello, my bridge conf is utilizing 192.168.0.* and my openvpn server conf is utlizing 172.18.100.* is this wrong?
13:36 < ecrist> no idea
13:36 < ecrist> !configs
13:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
13:37 < Mahjongg> !pb
13:37 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
13:37 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
13:38 -!- luneff [~yury@84.51.197.93] has joined #openvpn
13:38 < Mahjongg> having difficulty with openvpn pastebin will use another one
13:39 -!- voglster [~voglster@245.sub-174-253-71.myvzw.com] has joined #openvpn
13:40 < Mahjongg> ecrist, let me ask another way, when I define a bridge that must not use a real ip but a local ip such as 192.168 or 10.* is that right?
13:42 < dvl> Anyone with friends/family in Christchurch?
13:46 < Mahjongg> here is the server.conf: http://pastebin.com/9bEFppzC
13:46 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
13:47 < Mahjongg> OS ubuntu 10.04.2
13:47 < Mahjongg> openvpn 2.1.0
13:54 < Mahjongg> https://help.ubuntu.com/10.10/serverguide/C/openvpn.html assumes that the server has a bridge interface configured, but does not specify what scenario to use: "One scenario is setting up a bridge with multiple network interfaces, then using a firewall to filter traffic between two network segments. Another scenario is using bridge on a system with one interface to allow virtual machines direct access to the outside network."
13:55 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
13:55 < Mahjongg> is it the latter?
13:55 -!- kerfe [~a@129.pool85-60-128.dynamic.orange.es] has joined #openvpn
13:56 -!- voglster [~voglster@245.sub-174-253-71.myvzw.com] has quit [Ping timeout: 272 seconds]
14:03 < ecrist> majuk: coreect
14:03 < ecrist> Mahjongg: correct
14:03 < ecrist> !1918
14:03 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, adn 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html
14:04 < gladiatr> Also a good year for cheese.
14:07 < majuk> Awww, I thought I was special for a second.
14:07 < majuk> :(
14:10 < Mahjongg> ecrist, when I use this config for the bridge interface, vpnserver stops pinging google.com
14:10 < Mahjongg> https://help.ubuntu.com/10.10/serverguide/C/network-configuration.html#bridging
14:10 <@vpnHelper> Title: Network Configuration (at help.ubuntu.com)
14:11 < Mahjongg> do those values have to be the same as the values in openvpn server.conf file?
14:11 < Mahjongg> http://pastebin.com/9bEFppzC
14:19 < ecrist> majuk: no such luck.
14:19 < ecrist> :)
14:20 < ecrist> you don't need line 12, Mahjongg 
14:21 < ecrist> also, you cannot have lines 4 and 5 in the same config
14:21 < Mahjongg> here is my current interfaces http://pastebin.com/cqUN2K3b, should I use dhcp for the bridge as well?
14:21 < ecrist> !logs
14:21 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
14:23 < Mahjongg> ecrist, before starting openvpn I already lose Internet connection on the vpnserver
14:23 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p9882>
14:24 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 264 seconds]
14:26 < Varazir> Hello 
14:30 < Mahjongg> Could anyone help me with setting up a bridge on my system for openvpn?
14:30 < Mahjongg> I am having trouble deciding on the IP numbers to use
14:30 -!- gryzli [~gryzli@94.155.42.130] has joined #openvpn
14:34 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
14:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:35 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has joined #openvpn
14:35 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has quit [Changing host]
14:35 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
14:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
14:38 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Client Quit]
14:46 -!- gryzli [~gryzli@94.155.42.130] has quit [Quit: Leaving]
15:01 < Varazir> patelx: around `? 
15:01 < Varazir> or raidzx ? 
15:05 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
15:08 -!- strec [onkel@gateway/shell/shellium.org/x-wkxgpsctzdaotbvy] has left #openvpn []
15:12 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 250 seconds]
15:12 -!- p3rror [~mezgani@41.140.30.245] has quit [Ping timeout: 264 seconds]
15:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
15:25 -!- p3rror [~mezgani@41.248.111.90] has joined #openvpn
15:36 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Quit: leaving]
15:39 -!- spiekey [~mario@projekte.imos.net] has quit [Quit: Ex-Chat]
15:47 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
15:47 -!- Gandelf [~bp@gnuffy.net] has joined #openvpn
15:51 -!- katoen [e1bdd889cd@xs8.xs4all.nl] has joined #openvpn
15:51 -!- Netsplit *.net <-> *.split quits: fbh, _zero_, Bushmills, Rolybrau, |Mike|, master_of_master, @cron2, Champi, raomin, sedulous,  (+16 more, use /NETSPLIT to show all of them)
15:51 -!- oracle_ [~o2@unaffiliated/spice] has quit [Remote host closed the connection]
15:51 -!- Martin` is now known as Martin
15:52 -!- Netsplit *.net <-> *.split quits: WebDawg, toortog, K4k, raw, kloeri, meepmeep, Hamlin, @patelx, pa, nijotz,  (+26 more, use /NETSPLIT to show all of them)
15:52 -!- Martin is now known as 13WAA4HIR
15:54 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
15:54 -!- Netsplit over, joins: d457k, @cron2, Rolybrau, raomin, master_of_master, _zero_, sbrath_, belZe, ScriptFanix, |Mike| (+16 more)
15:57 -!- Mahjongg [~nick@unaffiliated/mrkeuner] has quit [Quit: Leaving]
16:01 <@vpnHelper> RSS Update - forum: connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html#p9884> || Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9883>
16:07 <@vpnHelper> RSS Update - forum: config for fast server? <http://forums.openvpn.net/topic7678.html#p9885>
16:11 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:11 -!- K4k_ [~K4k@c-24-98-78-253.hsd1.ga.comcast.net] has joined #openvpn
16:11 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
16:11 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
16:11 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
16:11 -!- EmperorTom [~EmperorTo@216.17.68.153] has joined #openvpn
16:11 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
16:11 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
16:11 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
16:11 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
16:11 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
16:11 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
16:11 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
16:11 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
16:11 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
16:11 -!- p3rror [~mezgani@41.248.111.90] has joined #openvpn
16:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:11 -!- zeshoem [~mnathani@bas1-toronto46-1177980118.dsl.bell.ca] has joined #openvpn
16:11 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
16:11 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
16:11 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
16:11 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has joined #openvpn
16:11 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
16:11 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
16:11 -!- raw [~raw@chipotle118.server4you.de] has joined #openvpn
16:11 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
16:11 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
16:11 -!- toortog [nesm6@38.111.17.107] has joined #openvpn
16:11 -!- i7-Cud4 [~thoor@i.got.so.shitfaced.co] has joined #openvpn
16:11 -!- rolls` [~rollin@190.120.228.48] has joined #openvpn
16:11 -!- grapsus [~grapsus@acces1094.res.insa-lyon.fr] has joined #openvpn
16:11 -!- cj [~cjac@adsl-207-32-175-127.rockisland.net] has joined #openvpn
16:11 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
16:11 -!- ServerMode/#openvpn [+o patelx] by jordan.freenode.net
16:12 -!- cj [~cjac@adsl-207-32-175-127.rockisland.net] has quit [Ping timeout: 240 seconds]
16:12 -!- cj [~cjac@adsl-207-32-175-127.rockisland.net] has joined #openvpn
16:12 -!- zeshoem [~mnathani@bas1-toronto46-1177980118.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
16:12 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Quit: nijotz]
16:12 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
16:12 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Client Quit]
16:12 -!- oracle [~o2@unaffiliated/spice] has joined #openvpn
16:12 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
16:13 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
16:15 -!- zeshoem [~mnathani@bas1-toronto46-1177856901.dsl.bell.ca] has joined #openvpn
16:15 -!- zeeshoem [~mnathani@bas1-toronto46-1177856901.dsl.bell.ca] has joined #openvpn
16:15 -!- sia^pwnnt_ [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
16:19 -!- Essobi_ [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
16:19 -!- caesay [~caesay@173.236.15.70] has joined #openvpn
16:20 -!- luneff [~yury@84.51.197.93] has quit [Quit: Leaving]
16:20 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
16:21 -!- sayuke [~crc@149.171.12.126] has joined #openvpn
16:22 -!- 45PABT3DD [~areq@q.areq.eu.org] has joined #openvpn
16:22 -!- 45PABT3DD [~areq@q.areq.eu.org] has quit [Changing host]
16:22 -!- 45PABT3DD [~areq@pld-linux/areq] has joined #openvpn
16:23 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:26 -!- MrKeuner [~sur@unaffiliated/mrkeuner] has joined #openvpn
16:26 -!- 45PABT3IV [~rollin@190.120.228.48] has joined #openvpn
16:26 -!- _zero__ [~zero@noc.toile-libre.net] has joined #openvpn
16:27 -!- takamichi is now known as 15SAAA5GN
16:27 -!- raomin__ [~romain@86.66.22.65] has joined #openvpn
16:28 -!- sia^pwnnt__ [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
16:29 -!- Netsplit *.net <-> *.split quits: _zero_, kloeri_, belZe, sbrath_, sia^pwnnt_, raomin
16:29 -!- sbrath [~sbrath@admin1.guild.com] has joined #openvpn
16:29 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
16:29 -!- Netsplit *.net <-> *.split quits: 15SAAA5GN, rolls`, majuk, ajbelayer, cj, i7-Cud4, [intra]lanman, Rundll, grapsus, WebDawg,  (+1 more, use /NETSPLIT to show all of them)
16:29 < |Mike|> word?
16:30 -!- Netsplit over, joins: belZe
16:31 -!- Netsplit *.net <-> *.split quits: @vpnHelper, Guest69789, Essobi, sia^pwnnt, areq
16:32 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
16:35 -!- EugeneKay is now known as EugeneKaway
16:35 -!- i7-Cud4 [~thoor@i.got.so.shitfaced.co] has joined #openvpn
16:35 -!- toortog [nesm6@notsecure.net] has joined #openvpn
16:35 -!- cj [~cjac@adsl-207-32-175-127.rockisland.net] has joined #openvpn
16:35 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
16:37 -!- grapsus [~grapsus@acces1094.res.insa-lyon.fr] has joined #openvpn
16:37 -!- i7-Cud4 [~thoor@i.got.so.shitfaced.co] has quit [Ping timeout: 240 seconds]
16:38 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
16:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:38 -!- caesay is now known as Guest95813
16:39 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
16:39 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 240 seconds]
16:39 -!- Netsplit over, joins: vpnHelper
16:39 -!- mode/#openvpn [+o vpnHelper] by ChanServ
16:39 -!- cj [~cjac@adsl-207-32-175-127.rockisland.net] has quit [Ping timeout: 240 seconds]
17:17 -!- kerfe [~a@129.pool85-60-128.dynamic.orange.es] has quit [Quit: • IRcap • 8.6 •]
17:18 < MrKeuner> hi, I can connect to my openvpn server fine. I do not see any errors on the server log, or on the client logs. (checking daemon.log in /var/log) However, once the connection is made, I cannot connect to any IP from the client machine. What could be wrong?
17:30 < MrKeuner> how can I track the problem?
17:32 < |Mike|> read the topic MrKeuner 
17:32 < MrKeuner> |Mike|, problem is my firewall?
17:33 < MrKeuner> !welcome
17:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:33 < MrKeuner> !goal
17:33 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:34 < MrKeuner> !howto
17:35 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:41 -!- Gandelf [~bp@gnuffy.net] has quit [Quit: WeeChat 0.3.4]
17:41 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
18:07 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
18:09 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
18:10 -!- luneff [~yury@84.51.197.93] has joined #openvpn
18:19 -!- zeshoem [~mnathani@bas1-toronto46-1177856901.dsl.bell.ca] has quit [Ping timeout: 246 seconds]
18:20 -!- zeeshoem [~mnathani@bas1-toronto46-1177856901.dsl.bell.ca] has quit [Ping timeout: 276 seconds]
18:20 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:20 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:20 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:25 -!- 5EXAB9W7N [~mnathani@bas1-toronto46-1177856892.dsl.bell.ca] has joined #openvpn
18:25 -!- zeshoem [~mnathani@bas1-toronto46-1177856892.dsl.bell.ca] has joined #openvpn
18:25 -!- 20QAATQS3 [~mnathani@bas1-toronto46-1177856892.dsl.bell.ca] has joined #openvpn
18:27 -!- oracle is now known as badmagicnumber
18:29 -!- EugeneKaway is now known as EugeneKay
18:32 -!- 5EXAB9W7N [~mnathani@bas1-toronto46-1177856892.dsl.bell.ca] has quit []
18:32 -!- zeshoem [~mnathani@bas1-toronto46-1177856892.dsl.bell.ca] has quit []
18:34 -!- 20QAATQS3 [~mnathani@bas1-toronto46-1177856892.dsl.bell.ca] has quit []
18:35 -!- i7-Cud4 [~thoor@i.got.so.shitfaced.co] has joined #openvpn
18:35 -!- toortog [nesm6@notsecure.net] has joined #openvpn
18:39 -!- cj_ [~cjac@adsl-207-32-175-127.rockisland.net] has joined #openvpn
18:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
18:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:08 -!- jfkw [~jtk@216.115.6.82] has quit [Quit: leaving]
19:09 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
19:14 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
19:14 -!- luneff [~yury@84.51.197.93] has joined #openvpn
19:22 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
19:23 -!- luneff [~yury@84.51.197.93] has joined #openvpn
19:44 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
19:45 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
19:47 -!- Deathzor [~deathtje@216.67.225.106] has quit [Ping timeout: 246 seconds]
19:47 -!- diphthong [~diphthong@69.172.135.243] has quit [Ping timeout: 272 seconds]
19:48 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 264 seconds]
19:48 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
19:48 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
19:52 -!- sayuke [~crc@149.171.12.126] has quit [Ping timeout: 264 seconds]
19:57 -!- open1 [ad210712@gateway/web/freenode/ip.173.33.7.18] has joined #openvpn
19:57 < open1> howdy
19:58 < open1> Does anyone know of some non-essential but large modules I can uninstall?  I want to get openvpn installed but I only have 468KB of space left.
20:00 < |Mike|> OS/distro?
20:00 < open1> haha I meant to join #openwrt :)
20:00 < open1> That would make a lot more sense
20:00 <@vpnHelper> RSS Update - forum: WinXP Openvpn Performance <http://forums.openvpn.net/topic7674.html#p9886>
20:01 < |Mike|> It sure does for you open1 
20:01 < open1> Thanks for following up though!
20:02 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:34 -!- badmagicnumber [~o2@unaffiliated/spice] has quit [Ping timeout: 264 seconds]
20:37 -!- badmagicnumber [~o2@unaffiliated/spice] has joined #openvpn
20:40 -!- open1 [ad210712@gateway/web/freenode/ip.173.33.7.18] has quit [Ping timeout: 272 seconds]
20:51 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
21:05 < Dougy> .
21:08 -!- master_of_master [~master_of@p57B535EA.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
21:09 -!- master_of_master [~master_of@p57B5375B.dip.t-dialin.net] has joined #openvpn
21:16 -!- sayuke [~crc@149.171.12.126] has joined #openvpn
21:21 -!- sia^pwnnt__ [115kluu@owned.ninjasinpyjamas.biz] has quit [Remote host closed the connection]
21:23 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
22:04 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has quit [Quit: leaving]
22:04 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
22:06 -!- zeshoem [~mnathani@bas1-toronto46-1177856892.dsl.bell.ca] has joined #openvpn
22:19 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
22:40 -!- luneff [~yury@84.51.197.93] has joined #openvpn
23:14 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:19 -!- albech [~thomas@124.157.202.17] has joined #openvpn
23:24 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
23:24 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
23:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:29 -!- i7-Cud4 [~thoor@i.got.so.shitfaced.co] has quit [Quit: changing servers]
23:29 -!- i7-Cud4 [~thoor@i.got.so.shitfaced.co] has joined #openvpn
23:36 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:56 -!- sayuke [~crc@149.171.12.126] has quit [Ping timeout: 264 seconds]
--- Day changed Thu Feb 24 2011
00:11 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
00:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:06 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
01:09 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
01:14 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
01:23 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
01:24 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
01:56 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has quit [Ping timeout: 240 seconds]
01:56 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has joined #openvpn
02:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
02:17 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
02:18 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
02:26 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:26 -!- mode/#openvpn [+o mattock] by ChanServ
02:27 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
02:32 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Operation timed out]
02:32 <@vpnHelper> RSS Update - forum: WinXP Openvpn Performance <http://forums.openvpn.net/topic7674.html#p9887>
02:33 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
02:34 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
02:35 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
02:35 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
02:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
02:41 -!- sia^pwnnt [115kluu@server1.bouncer4you.de] has joined #openvpn
02:45 <@vpnHelper> RSS Update - forum: Setup on Win2008 R2 <http://forums.openvpn.net/topic7666.html#p9888>
02:47 -!- MarKsaitis [~MarKsaiti@217.177.169.97] has joined #openvpn
02:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:00 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
03:06 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has quit [Ping timeout: 240 seconds]
03:06 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has joined #openvpn
03:07 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:07 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:08 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 264 seconds]
03:09 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
03:15 <@vpnHelper> RSS Update - forum: Internet Crash <http://forums.openvpn.net/topic7644.html#p9889>
03:15 < hyper_ch> openvpn crashed the internet?
03:19 < EugeneKay> Massively.
03:20 < EugeneKay> Looks like a redirect-gateway problem
03:20 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 240 seconds]
03:22 < krzee> lol
03:23 < Bushmills> that program has potential :)
03:26 < hyper_ch> if openvpn can crash the internet, then that might be the kill switch Obama is looking for :)
03:26 < EugeneKay> Anybody use Fail2Ban ?
03:26 <@vpnHelper> RSS Update - forum: connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html#p9890>
03:27 < hyper_ch> EugeneKay: lots of people us it
03:27 < EugeneKay> In association with OpenVPN
03:27 < reiffert> /usr/sbin/openvpn --redirect=crash --include-with=ciscovpn --include-with=pptp --include-with=wholeworld
03:28 < EugeneKay> Before I go on an adventure to develop a filter, wanted to know if anybody has made one
03:28 < EugeneKay> The fail2ban wiki doesn't list much
03:29 < Bushmills> i'd say the internet "crash" is related to dhcp request, overwriting the ovenvpn config caused changes in network setup 
03:30 < Bushmills> EugeneKay: throttling ssh requests through firewall is an effective measure to dampen the ssh brute forcers impact. other than that, i use denyhosts, not fail2ban
03:30 < hyper_ch> I also use denyhosts
03:31 < EugeneKay> I'm after more than just sshd banning.
03:31 < Bushmills> http://stats.scarydevilmonastery.net/localdomain/localhost.localdomain/hostsdeny-month.png  week6-7 is when i started to throttle ssh requests
03:33 < EugeneKay> Also, DenyHosts is written by somebody who had the "test" account brute-forced.
03:34 < reiffert> count of denied hosts is in "per second"?
03:34 < Bushmills> no, the total of denied hosts at any given time
03:38 < hyper_ch> denyhosts can deny for every service based by ip or hostname IIRC
03:38 < Bushmills> colour represents time expired since address was added to deny list. it remains there for 5 days
03:39 < hyper_ch> Bushmills: you use the group option to get denied hosts from others?
03:40 < Bushmills> hyper_ch: not anymore
03:41 -!- dazo_afk is now known as dazo
03:42 < Bushmills> turned it off in march. about here:  http://stats.scarydevilmonastery.net/localdomain/localhost.localdomain/hostsdeny-year.png
03:42 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
03:42 <@vpnHelper> RSS Update - forum: Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9891>
03:43 -!- dvrvm [~dvrvm@77-58-129-60.dclient.hispeed.ch] has joined #openvpn
03:43 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has quit [Ping timeout: 240 seconds]
03:43 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has joined #openvpn
03:43 < dvrvm> hi. is there a way to specify another default path for my config files on a windows (64) client?
03:44 < Bushmills> dvrvm:   openvpn /path/to/configfile
03:44 < Bushmills> alternatively,  openvpn --config /path/to/configfile
03:44 < dvrvm> Bushmills: i have to start openvpn as a service, so this doesn't help me
03:45 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
03:45 < dvrvm> (or, i could edit the service entry by hand...)
03:49 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9892>
03:51 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
03:52 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
04:01 <@vpnHelper> RSS Update - forum: IP phone connectivity <http://forums.openvpn.net/topic7681.html>
04:03 -!- _zero__ [~zero@noc.toile-libre.net] has quit [Write error: Connection reset by peer]
04:03 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
04:07 < robotti^> Bushmills: how to make such a cool log about ssh denies?
04:08 < hyper_ch> mrtg?
04:08 < Bushmills> i write a plugin for munin:  http://scarydevilmonastery.net/munin-plugins/local/hostsdeny
04:08 < Bushmills> wrote
04:08 < hyper_ch> robotti^: http://cp.roleplayer.org/cgi-bin/mailgraph.cgi
04:08 <@vpnHelper> Title: Mail Statistics for cp.roleplayer.org (at cp.roleplayer.org)
04:10 < Bushmills> got the same for denied /8 nets, rather than time until deny expired:   http://stats.scarydevilmonastery.net/localdomain/localhost.localdomain/hostsdenynetblock-month.png
04:11 < Bushmills> that's this plugin:  http://scarydevilmonastery.net/munin-plugins/local/hostsdenynetblock
04:13 < Bushmills> and some more here: http://scarydevilmonastery.net/munin.cgi
04:13 <@vpnHelper> Title: munin plugins (at scarydevilmonastery.net)
04:21 -!- VisionNL [~anonymous@tuig.nikhef.nl] has left #openvpn []
04:21 -!- luneff [~yury@84.51.197.93] has joined #openvpn
04:24 -!- darth_bitterman [~yury@84.51.197.93] has quit [Ping timeout: 276 seconds]
04:32 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has quit [Ping timeout: 240 seconds]
04:32 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has joined #openvpn
04:38 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has quit [Ping timeout: 240 seconds]
04:39 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has joined #openvpn
04:49 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
04:51 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
04:57 -!- ronsel [~ronsel@dslb-088-074-138-208.pools.arcor-ip.net] has joined #openvpn
05:02 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has joined #openvpn
05:07 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
05:10 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
05:16 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:16 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:16 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:26 -!- darth_bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
05:26 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
05:31 <@vpnHelper> RSS Update - forum: IP phone connectivity <http://forums.openvpn.net/topic7681.html#p9894>
05:37 <@vpnHelper> RSS Update - forum: Routing/firewall Issue or a more fundamental problem? <http://forums.openvpn.net/topic7679.html#p9896> || config for fast server? <http://forums.openvpn.net/topic7678.html#p9895>
05:59 -!- MarKsaitis [~MarKsaiti@217.177.169.97] has quit [Ping timeout: 240 seconds]
06:06 -!- MarKsaitis [~MarKsaiti@217.180.14.246] has joined #openvpn
06:17 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
06:30 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
06:31 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:43 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
06:46 -!- darth_bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
06:50 <@vpnHelper> RSS Update - forum: connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html#p9898> || Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9897>
06:56 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9901> || Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9900> || connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html#p9899>
07:02 <@vpnHelper> RSS Update - forum: How to avoid unencrypted connection to re-appear <http://forums.openvpn.net/topic7682.html>
07:04 -!- MarKsaitis [~MarKsaiti@217.180.14.246] has quit [Quit: Leaving]
07:23 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
07:26 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 246 seconds]
07:28 < ecrist> good morning.
07:29 < EugeneKay> Yup.
07:29 < EugeneKay> Question. Password auth can work alongside ssl-auth, yes?
07:31 < EugeneKay> Ie, a valid client cert AND a username+password is required. Ultimate goal would be to authorize users against LDAP/AD in addition to existing ssl files
07:33 -!- ronsel [~ronsel@dslb-088-074-138-208.pools.arcor-ip.net] has quit [Read error: Operation timed out]
07:34 -!- ronsel [~ronsel@dslb-088-074-138-208.pools.arcor-ip.net] has joined #openvpn
07:34 < EugeneKay> (It looks like this is possible, using the openvpn-auth-ldap package offa Google Code, but I've found no definitive "yes this setup works")
07:43 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
07:46 -!- darth_bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
07:56 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
07:57 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
07:59 <@dazo> EugeneKay: yes, that is possible ... I use that with eurephia on a couple of installations
07:59 <@dazo> !eurephia
07:59 <@vpnHelper> "eurephia" is http://www.eurephia.net/
08:05 < EugeneKay> Nifty.
08:06 -!- luneff [~yury@84.51.197.93] has joined #openvpn
08:09 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
08:11 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
08:11 -!- luneff [~yury@84.51.197.93] has joined #openvpn
08:16 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
08:20 -!- bluethundr [~bluethund@ip-160-79-209-130.rev.intellispace.net] has quit [Remote host closed the connection]
08:26 <@vpnHelper> RSS Update - forum: connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html#p9903>
08:44 <@vpnHelper> RSS Update - forum: connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html#p9904>
08:47 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:50 <@vpnHelper> RSS Update - forum: How to avoid unencrypted connection to re-appear <http://forums.openvpn.net/topic7682.html#p9905>
09:08 -!- p3rror [~mezgani@41.248.111.90] has quit [Ping timeout: 264 seconds]
09:08 <@vpnHelper> RSS Update - forum: How to avoid unencrypted connection to re-appear <http://forums.openvpn.net/topic7682.html#p9907> || Status file <http://forums.openvpn.net/topic7683.html>
09:10 -!- K4k_ is now known as K4k
09:13 <@vpnHelper> RSS Update - forum: How to avoid unencrypted connection to re-appear <http://forums.openvpn.net/topic7682.html#p9908>
09:14 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
09:18 <@vpnHelper> RSS Update - forum: connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html#p9909>
09:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
09:31 -!- Mahjongg [~nick@unaffiliated/mrkeuner] has joined #openvpn
09:33 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has left #openvpn []
09:34 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 240 seconds]
09:40 < Mahjongg> !welcome
09:40 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:41 < Mahjongg> !goal
09:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:41 < Mahjongg> !route
09:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:41 <@vpnHelper> RSS Update - forum: How to avoid unencrypted connection to re-appear <http://forums.openvpn.net/topic7682.html#p9912> || connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html#p9911> || Status file <http://forums.openvpn.net/topic7683.html#p9910>
09:44 < Mahjongg> hello, I have a network whose IP numbers are real wan IP numbers. In that should I be defining wan IP number pool in the server.conf? But in that case how can the openvpn server know which of those ips are already in use?
09:45 < EugeneKay> Assuming you're using routing, you don't want to do that, generally speaking.
09:46 < Mahjongg> EugeneKay, so if I am using bridging than I would have to?
09:46 < EugeneKay> Your vpn network IPs should be in a block outside of the locally-announced LAN's. If your vpn server isn't the same as the default gateway(as assigned by dhcp), you should set up a route for the ip block in question to go via the vpn server.
09:46 <@vpnHelper> RSS Update - forum: Routing/firewall Issue or a more fundamental problem? <http://forums.openvpn.net/topic7679.html#p9915> || Status file <http://forums.openvpn.net/topic7683.html#p9914> || Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p9913>
09:47 < EugeneKay> In bridged mode, the question is moot, as your VPN clients will receive IPs from the DHCP server, not from openvpn
09:52 < Mahjongg> !logs
09:52 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
10:00 < Mahjongg> OK, this seems far reach for me, so here is my problem if someone cares to help: I am in a campus network where each workstation has a wan IP. I am in a certain network which has certain permissions on accessing servers. I would like to set a openvpn server so that I can work from remote. I think I have installed openvpn correctly. I also have a br0 device which I am not so sure done correctly. I have created the client keys and clients are able to
10:00 < Mahjongg>  connect to the openvpn server and I do not observe errors on the client/server logs written to daemon.log
10:03 < Mahjongg> once a client establishes openvpn connection it gets a tap0 device assigned 172.18.100.106
10:04 < Mahjongg> and I think the openvpn server is using 172.18.100.101 but I fail to see this on the tap0 device on the server
10:04 < EugeneKay> Server's tap device won't have an IP
10:04 < Mahjongg> and certainly I cannot ping 172.18.100.101 from the client
10:04 < EugeneKay> Clent's TAP device is behaving like a loooooooooong ethernet cable that comes out the server's tap0 device
10:05 < EugeneKay> (note that I have never gotten bridging to work, mostly from lack of trying)
10:05 < Mahjongg> EugeneKay, would routing be easier?
10:05 < EugeneKay> In your case, no, because you don't have control over the default gateway of the server's LAN
10:05 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Remote host closed the connection]
10:05 < reiffert> server side: br0 carries former eth0 ip. two devices are bound to br0: eth0 and tap0
10:06 < reiffert> client side: tap0 adapter get's an ip address vom the server side dhcp server.
10:06 < reiffert> else switch to routing.
10:06 < EugeneKay> You could do a routed setup, with an eth0:0 device that is NAT'ed to the VPN
10:07 < reiffert> note that the :0 notation got depreceated on linux.
10:07 < reiffert> ip addr eth0 add foo/bar
10:07 < reiffert> ip addr show
10:07 < Mahjongg> reiffert, I think I have got the server side
10:07 < EugeneKay> Since when ?
10:07 < Mahjongg> br0 has old eth0 IP eth0 and tap0 does not have IP number now
10:08 < reiffert> EugeneKay: something 2.4.x
10:08 < EugeneKay> Hrm.
10:08 < Mahjongg> reiffert, but I do not think that the tap0 device on client is getting an ip from server side dhcp server
10:08 < EugeneKay> Well, I still use it on my CentOS/Fedora boxen without issue. 
10:08 < EugeneKay> I can't be arsed to decipher the madness that is NetworkManager - good old "network" works fine.
10:09 < Mahjongg> tap0 device on client is getting an IP from the pool what I put on the server.conf file
10:09 < Mahjongg> 172.18.*
10:10 < Mahjongg> should I remove the 172.18* related stuff in the server.conf?
10:10 < EugeneKay> Should be getting an IP from the server's LAN's dhcp server
10:10 < Mahjongg> https://help.ubuntu.com/10.10/serverguide/C/openvpn.html
10:10 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
10:10 < Mahjongg> I had used these directions
10:16 <@vpnHelper> RSS Update - forum: How to avoid unencrypted connection to re-appear <http://forums.openvpn.net/topic7682.html#p9916>
10:17 < gladiatr> reiffert, what is the New Standard for Designating sub-interfaces now?
10:19 < Mahjongg> EugeneKay, so I should be getting a wan IP for my tap0 device on the client, correct?
10:19 < EugeneKay> That's the idea
10:20 < Mahjongg> EugeneKay, since openvpn connection seems to be done correctly, may the problem be with my /etc/network/interfaces file?
10:20 < EugeneKay> I haven't the foggiest about Ubuntu
10:20 < Mahjongg> hehe OK
10:21 < Mahjongg> !pb
10:21 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
10:22 <@vpnHelper> RSS Update - forum: How to avoid unencrypted connection to re-appear <http://forums.openvpn.net/topic7682.html#p9917>
10:23 -!- jfkw [~jtk@216.115.6.82] has joined #openvpn
10:23 < Mahjongg> here's my interfaces: http://paste.ubuntu.com/571791/
10:23 < Mahjongg> !configs
10:23 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
10:24 < Mahjongg> here's my server.conf: http://paste.ubuntu.com/571792/
10:26 < Mahjongg> !dhcp
10:26 <@vpnHelper> "dhcp" is redirect-gateway bypass-dhcp gets around the problem of DHCP packets to the local DHCP server being incorrectly routed into the tunnel. Available in 2.1
10:28 < EugeneKay> !factoids
10:28 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:28 <@vpnHelper> RSS Update - forum: connection is reset immediatly even though credential check <http://forums.openvpn.net/topic7680.html#p9918>
10:29 < Mahjongg> EugeneKay, thanks
10:30 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
10:30 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
10:30 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:31 < gladiatr> complete ot, but anyone have any recommendations for enterprise gigabit switches besides cisco?
10:32 < ecrist> if you go HP, spend money, their cheap switchs (18001G) suck balls
10:32 < gladiatr> gotcha
10:34 -!- EugeneKay is now known as iPhone4
10:34 < gladiatr> I've been (remarkably) asked my views on stepping up from a worm-ridden stack of Linksys switches to something... else.
10:34 < iPhone4> If it ain't Cisco, it ain't enterprise
10:35 -!- iPhone4 is now known as EugeneKay
10:35 < ecrist> we've got a chassis switch from HP we've had for years, was a 4 module enclosure populated with 2 10/100 modules
10:35 < ecrist> been a nice switch.  since the el-cheapo HPs suck, we decided to purchase 2 gigE modules to fully populate the chassis, and it seems to work far better
10:36 < gladiatr> EugeneKay, that always been my choice, but these folks pinch pennies like priests pinch... well... anyway.  They're kinda cheap.
10:36 < ecrist> the chassis is circa 2002 or so, still runs like a champ.
10:36 < ecrist> gladiatr: how much capacity, and how 'enterprise' do you need to be?
10:37 < ecrist> we've been happy with linksys/cisco small business switches in an office setting.  we have a poe model we use to power our voip phones and provide network connections to the office
10:37 < ecrist> it even has two gbic ports
10:37 < gladiatr> They're going into a backup data center.  I'm primarily interested in layer-2 efficiency.
10:37 < ecrist> something like $400 at best buy
10:38 < gladiatr> hot vm transfers, and perhaps some iscsi work
10:38 < gladiatr> ecrist, you have described the local worm-ridden stack to a t ;)
10:38 < ecrist> the el-cheapo HPs broke down when trying to do fancier things like snmp monitoring and link aggregation
10:38 < gladiatr> ecrist, I crashed the management interface on the newest cisco/linksys switch by trying to run an snmpwalk on it
10:39 < ecrist> the snmp stuff we got fixed, they had 32 bit counters for traffic flow monitors which, when polled every 5 minutes, overrun at gigE speeds
10:39 < ecrist> at our request, they changed them to 64-bit counts and posted a firmware update
10:40 < ecrist> the lagg issue involves them hash source and destination, so a transfer between two systems will only use a single link, regardless of how many are in the lagg group
10:40 < gladiatr> nice.  I'll have to look into that.  The office couldn't been without its phone system after 5:30am... lousy things cost me sleep 
10:40 < ecrist> however, multiple systems transferring data to a single host will use the full lagg group
10:41 < ecrist> if you're not doing those things, these switches aren't too bad
10:41 < ecrist> HP ProCurve 1810G - 24 GE, P.1.18, eCos-2.0
10:42 < ecrist> if you need POE, you'll have to get something else, the 1810G doesn't do that
10:43 < gladiatr> The only poe needs we have are the phones--they can stay on a linksys switch
10:44 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p9919>
10:45 < ecrist> we paid $400/ea for those switches
10:50 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:57 -!- Mahjongg [~nick@unaffiliated/mrkeuner] has quit [Quit: Leaving]
11:02 -!- EugeneKay is now known as EugeneKaway
11:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
11:14 -!- luneff [~yury@84.51.197.93] has joined #openvpn
11:14 <@vpnHelper> RSS Update - forum: How do I configure OpenVPN as a Gateway client for Witopia? <http://forums.openvpn.net/topic7684.html>
11:15 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
11:18 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
11:19 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 276 seconds]
11:21 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
11:22 -!- darth_bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
11:23 -!- gladiatr is now known as gladiatr_afk
11:32 -!- Agin_ is now known as Agin
11:33 -!- albech [~thomas@124.157.202.17] has quit [Quit: Ex-Chat]
11:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:34 -!- ronsel [~ronsel@dslb-088-074-138-208.pools.arcor-ip.net] has quit [Quit: Dieser Computer ist eingeschlafen]
11:38 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
11:40 -!- MrKeuner [~sur@unaffiliated/mrkeuner] has quit [Quit: Ex-Chat]
11:47 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Po-ta-to, boil em, mash em, stick em in a stew.]
11:49 <@vpnHelper> RSS Update - forum: Windows auto-connect when starting gui <http://forums.openvpn.net/topic7623.html#p9921>
11:49 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
11:49 < kraut> howdy
11:50 < kraut> if i'm connected as client via tap to a network. am i able to bridge that tap device on client side?
11:50 < kraut> e.g. with my ethernet interface?
11:50 < ecrist> sure
11:50 < kraut> hmm, but how?
11:50 < ecrist> unless you're on a Mac, there is not bridging support in OS X
11:50 < kraut> if i create br0 and put tap0 to br0, i loose my connection
11:50 < kraut> linux
11:50 < kraut> maybe i'm just brainfucked
11:50 < ecrist> sounds like an IP conflict
11:50 < kraut> hmm, no
11:51 < kraut> an interface with ip would be added to a bridge will loose the ip layer connection
11:51 < ecrist> it shouldn't
11:51 < kraut> the tap device created by openvpn needs to be added to br0 and br0 _then_ need to be configured with the ip
11:51 < kraut> or not?
11:51 < ecrist> no
11:52 < kraut> hmm, but why do i loose connection if i do brctl addbr br0; brctl addif br0 tap0?
11:52 < ecrist> when interfaces are bridged, it doesn't matter which interface has the IP
11:52 < kraut> sure?
11:52 < kraut> i loose ip connection normally if i do that
11:52 < ecrist> br0, tap0, or eth0 can all have the IP
11:52 < kraut> give your host a try
11:52 < ecrist> I do not
11:52 < kraut> :P
11:52 < ecrist> ok, hang on
11:52 < kraut> *g*
11:52 < kraut> thanks mate
11:53 < kraut> f.e. i'm using on this notebook wlan0
11:53 < kraut> brctl addbr br0; brctl addif br0 wlan0 and then kaboom
11:54 < kraut> i could deconfigure the ip from tap0 and configure it to br0 and i got again the connection through the openvpn bridge
11:55 < ecrist> ok, just created a bridge interface, a tap interface, and added tap0 and em3 to it, no ip connection lost
11:58 -!- luneff [~yury@84.51.197.93] has joined #openvpn
12:03 < kraut> hmm
12:03 < kraut> wtf
12:03 < ecrist> fwiw, I did this on FreeBSD, the One True OS (TM)
12:04 < ecrist> ;)
12:04 < kraut> strange
12:04 < kraut> freebsd, linux, shouldn't matter in this case
12:04 < kraut> but thanks for that
12:05 < ecrist> they're completely different
12:05 < kraut> em3 is some kind of eth0?
12:05 < ecrist> freebsd names ethernet interfaces based on driver name
12:05 < kraut> for freebsd and linux junkies they are ocmpletly different
12:05 < kraut> but bridging should be mostly similiar
12:05 < ecrist> so, this is ethernet interface 3 that's using the em driver
12:05 < kraut> like solaris
12:05 < kraut> k
12:06 < ecrist> the box I did the testing on has 6 hard interface and 8 virtual interfaces
12:07 < ecrist> it sounds to me as though something in how linux handles generation of a bridge is fubar as it shouldn't wreck the layer 3 stuff 
12:07 < kraut> let me check
12:07 < kraut> i thought it was a standard behavoiur
12:08 < ecrist> no, it's not
12:08 -!- EugeneKaway is now known as EugeneKay
12:08 < kraut> or maybe any strange stp stuff
12:08 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
12:08 < ecrist> well, if there's another user on the lan connected to the same bridged vpn, there's a real possibility you created a loop
12:09 < kraut> can't be possible
12:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:10 < kraut> 3g android phone -> wlan teethering -> notebook as openvpn-client
12:11 < ecrist> but if they're connected to the same VPN, it *is* possible
12:11 < ecrist> don't matter what internet connection you're on
12:11 < kraut> what do you mean with both?
12:15 < kraut> hmm, brctl delif br0 tap0 and everything is fine agian
12:17  * kraut is confused
12:23 < ecrist> firewall?
12:27 -!- cj_ is now known as cj
12:32 < hyper_ch> any of you knows Dirk Becker?
12:38 -!- badmagicnumber is now known as oracle
12:40 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
12:43 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
12:43 -!- Essobi_ is now known as Essobi
12:44 -!- bitterman is now known as luneff
12:49 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
12:51 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
12:53 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
12:56 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 250 seconds]
12:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
13:01 -!- darth_bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
13:01 -!- petan [~kvirc@unaffiliated/petan] has joined #openvpn
13:01 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
13:02 < petan> I get troubles connecting from one machine all others are ok it just stopped working one day
13:02 < petan> I get some error with tls
13:03 < petan> Thu Feb 24 20:02:30 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
13:04 < petan> definitely it could be connectivity problem when I tried to connect with putty on that port I got connection rejected
13:04 < petan> is that possible that server rejects client?
13:05 < hyper_ch> ecrist: huhu
13:05 < hyper_ch> Bushmills: huhu
13:05 < Bushmills> hyper_ch: pong
13:06 < hyper_ch> Bushmills: you're my far northern neighbour, right?
13:06 < petan> anyone
13:06 -!- darth_bitterman [~yury@84.51.197.93] has quit [Client Quit]
13:08 -!- dazo is now known as dazo_afk
13:10 < ecrist> sup d00ds
13:10 < hyper_ch> ecrist: you're from the German lands also?
13:18 < ecrist> no, US
13:18 < hyper_ch> I see
13:21 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
13:21 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
13:21 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
13:24 -!- jwm [jwm@dev.dist.us] has quit [Ping timeout: 272 seconds]
13:24 -!- rot13 [~var@unaffiliated/rot13] has quit [Ping timeout: 272 seconds]
13:24 -!- jwm [jwm@dev.dist.us] has joined #openvpn
13:24 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
13:24 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has joined #openvpn
13:24 -!- [intra]lanman [~lanman@c-68-40-206-235.hsd1.mi.comcast.net] has quit [Changing host]
13:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:25 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Ping timeout: 240 seconds]
13:27 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 240 seconds]
13:27 -!- WebDawg [~whoami@officialg0d.com] has quit [Ping timeout: 264 seconds]
13:29 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
13:30 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
13:30 -!- Dougy [me@openvpn/community/user/dougy] has quit [Read error: Connection reset by peer]
13:30 -!- Dougy [me@tech.qsi.net] has joined #openvpn
13:31 -!- master_of_master [~master_of@p57B5375B.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
13:32 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
13:35 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 264 seconds]
13:35 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
13:36 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
13:36 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 246 seconds]
13:36 -!- hackeron [~hackeron@gentoo/user/hackeron] has quit [Ping timeout: 240 seconds]
13:36 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
13:37 -!- hackeron [~hackeron@cpc2-seve4-0-0-cust602.13-3.cable.virginmedia.com] has joined #openvpn
13:37 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
13:39 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Connection reset by peer]
13:39 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
13:39 < petan> anyone around
13:39 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
13:39 < petan> how can I open more ports for it
13:39 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
13:40 -!- master_of_master [~master_of@p57B5375B.dip.t-dialin.net] has joined #openvpn
13:40 < ecrist> for what?
13:40 < petan> server
13:40 < petan> ovpn
13:40 < ecrist> !man
13:40 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
13:40 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
13:40 < petan> I could only find port tehre
13:40 < ecrist> right
13:41 < petan> is it possible to open more than port
13:41 < petan> * one
13:41 -!- luneff [~yury@84.51.197.93] has joined #openvpn
13:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:41 < ecrist> if it were me, and I wanted OpenVPN to be available on more than one port, I'd do some redirection from teh firewall
13:41 < ecrist> no
13:41 < petan> I am having troubles connecting from certain computer to the 1194
13:41 -!- mete [~metefr@84.200.12.194] has joined #openvpn
13:41 < petan> so I would like it to listen on more ports
13:42 < petan> is there some option for config to do that
13:42 -!- p3rror [~mezgani@41.140.172.216] has joined #openvpn
13:42 < ecrist> I just said no
13:42 < petan> I didn't know what for :)
13:42 < ecrist> you can start another copy of openvpn though.
13:43 < petan> with same config?
13:43 < petan> or similar
13:43 < ecrist> probably not, but close
13:43 < petan> with different port
13:43 < ecrist> it would need a different rang
13:43 < petan> eh
13:43 < ecrist> the better way is with a firewall redirect, though
13:43 < petan> that would be a problem...
13:43 < ecrist> then you only need one copy
13:43 < ecrist> unless you're doing TCP and UDP
13:43 < ecrist> then you need two copies
13:44 < petan> is there a simple way to do this redirect on linux? not very familiar with fw there and not sure if there is some more than ipchains
13:44 < petan> I think I didn't install any sw firewall there
13:44 < ecrist> you'll have to ask in a linux channel
13:44 < petan> well
13:44 < ecrist> I could help you with pf on bsd, but that's it
13:44 < petan> it's debian
13:45 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
13:46 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
13:46 < ecrist> doesn't matter, I don't know linux firewalls
13:46 < ecrist> ;)
13:47 < reiffert> redirect from where to where and on which interface?
13:47 < petan> eh, eth0?
13:47 < petan> I would like another port to be available for ovpn
13:48 < petan> if possible the same as that on it's current port
13:48 < reiffert> just launch it a second time and change the port line in the server config.
13:48 < petan> I was just told it would not work
13:48 < petan> because the vpn subnet would colide
13:48 < petan> as far as I understood it
13:48 < reiffert> I run it 3 times and on three different ports. It works for me pal.
13:49 < petan> I will try :)
13:49 < petan> just hope it won't break the ssh connection then
13:49 < reiffert> you need to adjust the ip network and netmask and the openvpn tun device of course.
13:49 < petan> ah
13:49 < reiffert> so tun0 = 1st instance
13:49 < reiffert> tun1 = 2nd one and so on
13:49 < petan> it's tap
13:50 < reiffert> else try this:
13:50 < petan> anyway problem is that there are certain security settings so current subnet has exemption for certain things if it change
13:50 -!- oc80 [oc80z@blea.ch] has joined #openvpn
13:50 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
13:50 < petan> people who connect to another instance on another net would have troubles using that
13:50 < petan> that is why I wanted to use same
13:50 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 260 seconds]
13:50 < reiffert> iptables -t nat -I PREROUTING -p udp -i eth0 --dport 1234 -j REDIRECT --to-ports 1194
13:51 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 240 seconds]
13:51 < petan> reiffert: before I do that what exactly it does and how can I remove it later
13:51 < reiffert> remove it later:
13:51 < reiffert> iptables -t nat -D PREROUTING -p udp -i eth0 --dport 1234 -j REDIRECT --to-ports 1194
13:51 < petan> reiffert: I am going to do that over ssh is it ok? I had troubles in past, playing with network over ssh
13:51 < reiffert> it redirects incoming on eth0, udp/1234 to eth0, udp/1194
13:51 -!- rot13 [~var@81.20.132.64] has joined #openvpn
13:52 < petan> I just don't won't to get unable to connect back to fix it
13:52 < reiffert> petan: should be save.
13:52 < reiffert> petan: when playing with networks remotly, I schedule a reboot before playing. like this:
13:53 < reiffert> echo "reboot" | at 21:00
13:53 < reiffert> atq will show you the job and atrm <jobnum> will remove it from the scheduler.
13:53 < petan> ok
13:53 < reiffert> normally I forget to remove the job afterwards so guess whats happening.
13:53 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 240 seconds]
13:54 < petan> "/etc/init.d/networking restart should be same
13:54 < petan> I think
13:54 -!- mete [~metefr@84.200.12.194] has joined #openvpn
13:54 < petan> and it would not get box down
13:56 -!- rot13 [~var@81.20.132.64] has quit [Ping timeout: 276 seconds]
13:57 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
13:57 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
13:57 -!- p3rror [~mezgani@41.140.172.216] has quit [Ping timeout: 264 seconds]
13:58 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 240 seconds]
13:58 < petan> reiffert: wow :)
13:59 < petan> cool
13:59 < reiffert> petan: when unlucky, init.d/networking restart brings down the interface, terminates the ssh connection, the shell running onto it and the init.d/networking restart command
13:59 < reiffert> so your interface doesnt come up that way anymore.
14:00 < petan> it's done
14:00 < petan> ok
14:00 < petan> anyway I added restart to cron
14:00 < petan> so I think it would work
14:00 -!- oc80 [oc80z@blea.ch] has quit [Read error: Connection reset by peer]
14:01 < petan> that what you say happened to me in past too :)
14:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:01 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
14:01 < reiffert> echo "reboot" | at 23:22
14:01 < reiffert> atq
14:01 < reiffert> atrm 3
14:01 < reiffert> when 3 is the jobnumber. try this next time.
14:02 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 276 seconds]
14:02 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:03 < petan> I have problem with reboot command I don't want the machine to reboot...
14:03 < petan> so I would prefer it to just restart iface
14:03 -!- mete [~metefr@84.200.12.194] has joined #openvpn
14:03 < petan> there are some virtual ms sql servers on background
14:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:06 -!- petan [~kvirc@unaffiliated/petan] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
14:07 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 250 seconds]
14:07 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 240 seconds]
14:08 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:09 -!- mete [~metefr@84.200.12.194] has joined #openvpn
14:09 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
14:13 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 264 seconds]
14:13 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:17 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
14:17 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
14:18 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 240 seconds]
14:19 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:21 -!- mete [~metefr@84.200.12.194] has joined #openvpn
14:24 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 276 seconds]
14:24 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:29 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 276 seconds]
14:29 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:32 -!- `mx [~mikey@zoidberg.ghettowebhosting.com] has quit [Ping timeout: 240 seconds]
14:33 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 240 seconds]
14:33 -!- WormFood [~wormfood@183.15.96.162] has quit [Ping timeout: 272 seconds]
14:33 -!- `mx [~mikey@zoidberg.ghettowebhosting.com] has joined #openvpn
14:34 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 264 seconds]
14:35 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:35 -!- WormFood [~wormfood@183.15.96.162] has joined #openvpn
14:39 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
14:40 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:41 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
14:42 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:45 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 252 seconds]
14:45 -!- mete [~metefr@84.200.12.194] has joined #openvpn
14:45 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:46 < kraut> fine, bridge is working
14:46 < kraut> the bridge of the bridge ;)
14:50 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
14:51 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:52 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 240 seconds]
14:54 -!- mete [~metefr@84.200.12.194] has joined #openvpn
14:55 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 250 seconds]
14:56 -!- dvrlol [~dvrvm@77-58-129-60.dclient.hispeed.ch] has joined #openvpn
14:56 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:56 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
14:59 -!- dvrvm [~dvrvm@77-58-129-60.dclient.hispeed.ch] has quit [Ping timeout: 276 seconds]
15:01 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 250 seconds]
15:01 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:04 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
15:06 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
15:07 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:10 -!- p3rror [~mezgani@41.140.174.147] has joined #openvpn
15:12 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 276 seconds]
15:12 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:17 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 264 seconds]
15:18 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:23 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 276 seconds]
15:23 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
15:25 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
15:28 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 252 seconds]
15:28 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:33 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 264 seconds]
15:34 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:34 -!- p3rror [~mezgani@41.140.174.147] has quit [Ping timeout: 264 seconds]
15:39 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 260 seconds]
15:39 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:44 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 250 seconds]
15:44 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:45 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
15:49 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 276 seconds]
15:50 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:50 -!- p3rror [~mezgani@41.248.186.14] has joined #openvpn
15:54 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
15:55 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
15:59 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
16:00 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
16:05 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
16:06 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
16:07 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has joined #openvpn
16:08 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:11 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 264 seconds]
16:11 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
16:16 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 276 seconds]
16:17 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
16:21 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 250 seconds]
16:22 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
16:27 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
16:28 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
16:33 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 264 seconds]
16:33 -!- p3rror [~mezgani@41.248.186.14] has quit [Quit: Leaving]
16:33 -!- p3rror [~mezgani@41.248.186.14] has joined #openvpn
16:33 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
16:38 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Ping timeout: 240 seconds]
16:39 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has joined #openvpn
16:44 -!- EugeneKay is now known as EugeneKaway
16:44 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: No route to host]
16:45 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
16:45 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has joined #openvpn
16:45 -!- crazed is now known as pantimedias
16:46 -!- pantimedias is now known as crazed
16:47 -!- Bogdar [~bogdan@86.57.155.90] has quit [Read error: Operation timed out]
16:47 -!- Bogdar [~bogdan@86.57.155.90] has joined #openvpn
16:51 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has quit [Ping timeout: 264 seconds]
17:12 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
17:21 -!- i7-Cud4 [~thoor@i.got.so.shitfaced.co] has quit [Ping timeout: 240 seconds]
17:21 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
17:37 -!- EugeneKaway is now known as EugeneKay
17:42 -!- f1assistance1 [~Carl@cpe-024-211-247-099.nc.res.rr.com] has joined #openvpn
17:44 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has quit [Ping timeout: 260 seconds]
18:02 <@vpnHelper> RSS Update - forum: Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9922>
18:03 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
18:06 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has joined #openvpn
18:06 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has quit [Changing host]
18:06 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
18:11 -!- EugeneKay is now known as EugeneKaway
18:19 -!- Guest9701 [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Quit: Leaving]
18:20 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
18:24 -!- dvrlol [~dvrvm@77-58-129-60.dclient.hispeed.ch] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
18:41 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:41 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:56 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
19:10 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
19:18 -!- Colden [~client@unaffiliated/andriss] has joined #openvpn
19:19 < Colden> I can't seem to figure out where the web root is on the client web server
19:19 < Colden> I'd like to add a message :)
19:20 < Colden> even the logo file is missing
19:21 < Colden> there's no logo.png... such a mystery
19:22 -!- jfkw [~jtk@216.115.6.82] has quit [Quit: leaving]
19:32 < ecrist> sup doods?
19:32 < ecrist> Colden: what are you talking about?
19:54 < Colden> I guess there is no client web server in community openvpn?
19:57 < Bushmills> maybe you're looking for the web server of your network cable?
19:58 < ecrist> no
19:58 < ecrist> are you referring to Access Server, Colden?
19:59 < Colden> yeah, the access server comes with a client web server
19:59 < Colden> I guess the community vpn server does not?
19:59 < ecrist> ah, we don't support access server
19:59 < ecrist> no, the community version has no webserver
20:00 < Colden> ok
20:00 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
20:11 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
20:12 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
20:14 -!- Colden [~client@unaffiliated/andriss] has left #openvpn []
20:32 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has joined #openvpn
20:35 -!- oracle_ [~o2@unaffiliated/spice] has joined #openvpn
20:38 -!- oracle [~o2@unaffiliated/spice] has quit [Ping timeout: 260 seconds]
20:43 -!- rot13 [~var@vps-1005590-1468.united-hoster.de] has quit [Changing host]
20:43 -!- rot13 [~var@unaffiliated/rot13] has joined #openvpn
20:57 -!- sbrath [~sbrath@admin1.guild.com] has quit [Changing host]
20:57 -!- sbrath [~sbrath@unaffiliated/sbrath] has joined #openvpn
21:07 -!- master_of_master [~master_of@p57B5375B.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
21:09 -!- master_of_master [~master_of@p57B5369D.dip.t-dialin.net] has joined #openvpn
21:27 -!- f1assistance1 [~Carl@cpe-024-211-247-099.nc.res.rr.com] has left #openvpn []
21:39 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
21:39 <@vpnHelper> RSS Update - forum: config for fast server? <http://forums.openvpn.net/topic7678.html#p9923>
21:39 -!- sia^pwnnt [115kluu@server1.bouncer4you.de] has quit [Ping timeout: 240 seconds]
21:42 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:42 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:42 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:06 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
22:09 <@vpnHelper> RSS Update - forum: connection problem over GPRS <http://forums.openvpn.net/topic7685.html>
22:26 -!- jfkw [~jtk@24-216-252-176.dhcp.mdfd.or.charter.com] has quit [Quit: leaving]
22:29 -!- durando1 [~durando@cpe-76-178-226-137.maine.res.rr.com] has joined #openvpn
22:29 < durando1> hey guys i'm new to openvpn and trying to figure out if your the server or the client does it matter in terms of sharing resources like printers etc?
22:36 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
22:39 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html>
22:43 -!- groundnuty [~orzech@elj74.internetdsl.tpnet.pl] has joined #openvpn
22:43 < groundnuty> !goal
22:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:45 < groundnuty> hey, I have vpn setup with my university and its all working fine. On the internet there is a serwer which can be accessed (for example ssh) without any vpn - and its also working fine. There is a service/port on that server that can only be accessed from inside the university network.
22:46 < groundnuty> is there a way that I could make all my conections to that servers go through vpn->university network ?
22:55 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:57 <@vpnHelper> RSS Update - forum: Routing/firewall Issue or a more fundamental problem? <http://forums.openvpn.net/topic7679.html#p9927> || Routing request from VPN client to an internal server. <http://forums.openvpn.net/topic7667.html#p9926>
22:58 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
23:04 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:09 <@vpnHelper> RSS Update - forum: Routing request from VPN client to an internal server. <http://forums.openvpn.net/topic7667.html#p9928>
23:25 -!- sayuke [~crc@149.171.13.73] has joined #openvpn
23:25 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has joined #openvpn
23:28 < hjohnson> hey all, trying to figure out where packets are being dropped.  I am setting a bridged network, and have a bridge going with eth1 and tap0, openvpn server set to use tap0.  brctl shows both devices in the bridge.  I initiate the tunnel, and can ping the br0 ip address without trouble, but I can't ping anything on my internal network.
23:28 < hjohnson> any thoughts?
23:28 < hjohnson> I must be missing something
23:29 < hjohnson> server is running on debian linux
23:35 < hjohnson> ok, bridge device not actually forwarding packets... my bad
23:36 -!- sayuke [~crc@149.171.13.73] has quit [Ping timeout: 264 seconds]
23:36 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
23:37 -!- iTycoon [~Adium@c-67-186-122-97.hsd1.in.comcast.net] has joined #openvpn
23:37 < iTycoon> !Welcome
23:37 <@vpnHelper> "Welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:42 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
23:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
23:45 < hjohnson> ok, yep.. bridge set to not forward
23:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
--- Day changed Fri Feb 25 2011
01:06 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
01:30 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
01:40 < durando1> are both sides of openvpn able to share resources?
01:46 < hjohnson> durando1: in what sense?
01:46 < durando1> like can both sides share printers?
01:46 < durando1> files etc
01:46 < hjohnson> sure
01:46 < hjohnson> dpeends on how you configure it
01:47 < durando1> i'm using tomatousb router firmware
01:47 < hjohnson> right
01:47 < hjohnson> it can do what you want, yes
01:48 < durando1> great
01:48 < durando1> now i gotta figure out setting up the certificates
01:48 < hjohnson> I just set it up.. but it's a bit of a pain in the butt since there are a couple of little gotchas
01:48 < hjohnson> that's the easy part
01:48 < hjohnson> just use the easy-rsa scripts
01:48 < durando1> are they on the router?
01:48 < hjohnson> dunno
01:49 < hjohnson> never messed with tomato
01:49 < durando1> oh
01:49 < durando1> what did you use?
01:49 < hjohnson> running an alix 2d3 running voyage linux
01:50 < durando1> ah
01:50 < durando1> so what was the hard part?
01:50 < hjohnson> getting the configuration exactly right and realizing that I had to get the briding going
01:50 < hjohnson> and making the bridging come up on boot
01:51 -!- Engin [~engin@85.108.240.6] has joined #openvpn
01:51 < hjohnson> actually the hardest part was making it work with the hardware crypto
01:53 < durando1> oh hardware crypto?
01:53 < durando1> i dont think i'll have that issue in tomatousb
01:54 < hjohnson> yeah, the geode lx 800 has hardware aes-128
01:55 < hjohnson> anyhow bedtime
02:04 <@vpnHelper> RSS Update - forum: Routing request from VPN client to an internal server. <http://forums.openvpn.net/topic7667.html#p9929>
02:10 <@vpnHelper> RSS Update - forum: Routing/firewall Issue or a more fundamental problem? <http://forums.openvpn.net/topic7679.html#p9930>
02:15 -!- durando1 [~durando@cpe-76-178-226-137.maine.res.rr.com] has left #openvpn []
02:15 <@vpnHelper> RSS Update - forum: config for fast server? <http://forums.openvpn.net/topic7678.html#p9932> || Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9931>
02:18 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:22 -!- dazo_afk is now known as dazo
02:29 -!- WormFood [~wormfood@183.15.96.162] has quit [Quit: gotta shutdown router]
02:36 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
02:44 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
02:58 <@vpnHelper> RSS Update - forum: Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9933>
03:09 -!- WormFood [~wormfood@183.39.76.152] has joined #openvpn
03:10 <@vpnHelper> RSS Update - forum: Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9934>
03:18 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:20 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
03:22 <@vpnHelper> RSS Update - forum: Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9935>
03:27 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
03:31 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:53 -!- rot13 [~var@unaffiliated/rot13] has quit [Read error: Connection reset by peer]
04:04 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html>
04:07 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
04:07 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
04:30 -!- dazo_ [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:30 -!- mode/#openvpn [+o dazo_] by ChanServ
04:32 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Read error: Connection reset by peer]
04:33 -!- dazo [~dazo@nat/redhat/x-fxcnqreereodrzwi] has joined #openvpn
04:33 -!- dazo [~dazo@nat/redhat/x-fxcnqreereodrzwi] has quit [Changing host]
04:33 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:33 -!- mode/#openvpn [+o dazo] by ChanServ
04:36 -!- dazo_ [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 250 seconds]
04:40 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p9937>
04:46 <@vpnHelper> RSS Update - forum: connection problem over GPRS <http://forums.openvpn.net/topic7685.html#p9940> || VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p9939> || Auto connecting to VPN <http://forums.openvpn.net/topic7672.html#p9938>
04:47 -!- durando [~durando@cpe-76-178-226-137.maine.res.rr.com] has joined #openvpn
04:48 < durando> hey guys i'm using tomatousb (router firmware) for openvpn, i got both routers setup and make the connection and can see the client sucessfully connected on the server but when they are connected together i cant connect to client router at all......
04:55 < Bushmills> can you ping vpn client from server?
05:02 < durando> um
05:02 < durando> i'd imagine
05:03 < durando> but it essentially shuts the client router down when they are connected
05:03 < durando> at least for wireless connections
05:05 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:05 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:19 < Bushmills> how could you possibly ping a router in a shut down state?
05:20 < Bushmills> if your openvpn connection affects wireless, you either have some colliding subnets, or some routing conclicts
05:20 < durando> well its not shutdown just not allowing me to connect
05:20 < durando> hrmm routing conflicts
05:24 < durando> if i can get this out of the way i'd honestly only have 1 issue left to sort on these routers lol
05:24 < durando> this is a biggie
05:26 < Bushmills> does your vpn subnet differ from your LAN/WLAN subnet?
05:27 < durando> sorry i'm very much a noob here :(
05:27 < durando> i'm trying to figure it out
05:28 < durando> but yeah it does
05:28 < durando> or did
05:30 < durando> the vpn subnet is 10.8.0.6 the lan/wlan subnets are 192.168.1.1 etc
05:30 < durando> i am able to ping the router
05:31 < durando> but i'm unable to connect to the router wirelessly when its connected via vpn
05:31 < durando> i mean they both have the same realworld ip (for testing right now)
05:44 < s7r> anyone here uses intovps with openvpn on it
05:44 < s7r> ?
05:44 -!- durando [~durando@cpe-76-178-226-137.maine.res.rr.com] has quit [Quit: Leaving.]
05:44 < s7r> because their openvz supports tun/tap if you enable them -  i have did this over 50 times and still it is not working
05:44 < s7r> it says can not find device
06:01 -!- durando [~durando@cpe-76-179-211-49.maine.res.rr.com] has joined #openvpn
06:01 < durando> okay maybe i figured it out we'll see, what is the difference between tunnel and tap?
06:02 -!- EugeneKaway is now known as EugeneKay
06:06 < krzee> !tunortap
06:06 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
06:06 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
06:09 -!- durando [~durando@cpe-76-179-211-49.maine.res.rr.com] has quit [Read error: Connection reset by peer]
06:10 -!- durando [~durando@cpe-76-178-226-137.maine.res.rr.com] has joined #openvpn
06:10 -!- zeshoem [~mnathani@bas1-toronto46-1177856892.dsl.bell.ca] has quit [Ping timeout: 260 seconds]
06:11 -!- durando1 [~durando@cpe-76-179-211-49.maine.res.rr.com] has joined #openvpn
06:11 -!- durando [~durando@cpe-76-178-226-137.maine.res.rr.com] has quit [Read error: Connection reset by peer]
06:12 -!- durando1 [~durando@cpe-76-179-211-49.maine.res.rr.com] has quit [Read error: Connection reset by peer]
06:13 -!- durando [~durando@cpe-76-179-211-49.maine.res.rr.com] has joined #openvpn
06:14 -!- f1assistance1 [~Carl@cpe-024-211-247-099.nc.res.rr.com] has joined #openvpn
06:17 -!- durando1 [~durando@cpe-76-178-226-137.maine.res.rr.com] has joined #openvpn
06:19 -!- s7r [~s7r@unaffiliated/s7r] has quit [Read error: Connection reset by peer]
06:20 -!- durando [~durando@cpe-76-179-211-49.maine.res.rr.com] has quit [Ping timeout: 240 seconds]
06:20 -!- s7r [~s7r@82.77.119.200] has joined #openvpn
06:20 -!- s7r [~s7r@82.77.119.200] has quit [Changing host]
06:20 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
06:21 -!- durando1 [~durando@cpe-76-178-226-137.maine.res.rr.com] has quit [Ping timeout: 250 seconds]
06:23 -!- durando2 [~durando@cpe-76-179-211-49.maine.res.rr.com] has joined #openvpn
06:23 < durando2> alright i just setup tap/tcp
06:23 -!- zeshoem [~mnathani@bas1-toronto46-1279266453.dsl.bell.ca] has joined #openvpn
06:24 < durando2> both routers are connected but........i cant ping the internal ips from the other side
06:24 < durando2> client side is 192.168.2.1 and server side is 192.168.1.1
06:24 -!- s7r [~s7r@unaffiliated/s7r] has quit [Client Quit]
06:25 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
06:25 -!- zeeshoem [~mnathani@bas1-toronto46-1279266453.dsl.bell.ca] has joined #openvpn
06:26 < durando2> now maybe i screwed this up i did server is on same subnet on the client side and client address pool dhcp on the server side
06:29 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p9941>
06:30 < krzee> why tap?
06:30 < krzee> and why tcp?
06:31 < krzee> what is your goal...?
06:31 < durando2> i want to be able to have static ips on both sides of the network and beable to address those ips the same exact way on both sides of the network
06:32 < krzee> !route
06:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
06:32 < krzee> just use a normal tun network, and access each side by their normal LAN ips
06:32 < krzee> use something like 10.8.0.0/24 for VPN subnet
06:33 < durando2> i chose tcp because i understand its more accurate (slower) but more accurate than udp
06:35 < EugeneKay> TCP-over-TCP causes cancer
06:37 < durando2> so wait if i'm reading this correctly if machine 1 and 2 want to talk to eachother then i would point to 10.8.0.1 from 10.8.0.2
06:37 < durando2> ?
06:38 < durando2> what happens when the tunnel is broken?
06:38 < durando2> do they revert back to 10.whatever ips?
06:40 < krzee> huh??
06:40 < krzee> and regarding tcp being more accurate, not true
06:40 < krzee> openvpn manages retransmits when using udp
06:40 < krzee> as opposed to the protocol doing it
06:40 < durando2> okay great udp it is
06:40 < durando2> easy enough
06:40 < krzee> !tcp
06:40 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
06:41 < krzee> and why tap?
06:41 < durando2> so the issue i'm running into is when i tunnel it screws up my router so i cant get to it wirelessly
06:41 < durando2> on the client side
06:41 < durando2> probally a routing issue
06:41 < krzee> prolly
06:41 < krzee> [04:41]  <krzee> and why tap?
06:42 -!- Bogdar [~bogdan@86.57.155.90] has quit [Read error: Operation timed out]
06:42 < durando2> so weither the 2 routers are connected (via openvpn) or not i need the ips to stay the same
06:43 < krzee> and...?
06:43 < krzee> is that why you used tap?
06:43 < durando2> yeah
06:43 < durando2> i thought tun wouldn't allow for i
06:43 < durando2> t
06:43 < krzee> tap is for layer2, you dont need it
06:43 < krzee> tun will open ANOTHER adapter which will have a new ip
06:43 < krzee> your original adapter will still have its LAN iup
06:44 < krzee> ip*
06:44 < krzee> when you correctly setup routing you can use LAN ips
06:44 < krzee> (different LAN subnets of course)
06:44 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 240 seconds]
06:45 < krzee> !sample
06:45 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
06:45 < krzee> you can start with something like that, then add in the correct routing stuff
06:45 < krzee> make sure each LAN uses a different subnet
06:45 < krzee> then follow my guide at !route
06:46 < durando2> so lets try this scenario (i'll try to explain the best i can in my noobish way) if i setup client side with subnet 192.168.2.1 etc and on the server side i use subnet 192.168.1.1 etc when i'm sitting on a pc on the server side will i beable to point to 192.168.2.100 or will i have to use a 3rd setup 10.whatever
06:50 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
06:50 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
06:50 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
06:59 < Bushmills> when your server side lan is 192.168.2.x, and your client side lan is 192.168.1.x, connecting server and client through openvpn gives you an additional virtual network interface on both sides, with addresses in the openvpn subnet.
06:59 < durando2> okay
06:59 < Bushmills> either side can be a gateway from 192.168.x.x to openvpn subnet
07:00 < krzee> you would access 192.168.2.100
07:00 < durando2> does this mean every system has 2 ips?
07:00 < krzee> only the 2 vpn endpoints have 10. ips
07:00 < krzee> and those are used for routing over the vpn
07:00 < durando2> oh sweet
07:00 < Bushmills> without openvpn:  n ip addresses.  with openvpn, n+1 ip addresses
07:01 < durando2> so if i want to print off either one it would be 10 blah
07:01 < krzee> huh?
07:01 < durando2> cause the routers are the print servers
07:01 < krzee> if you set it up right you can still use the routers LAN ip
07:01 < durando2> that would be even better
07:02 < durando2> that way there its a seamless network
07:02 < krzee> have you started reading !route yet?
07:02 < durando2> so that 192.168.1.1 is always the home router whether i'm home or not etc
07:02 < krzee> you'll prolly wanna read it a couple times ;]
07:02 < krzee> also, be causeful using 192.168.1.x
07:02 < krzee> if you connect from random places at least
07:03 < Bushmills> causeful sounds like netless seamwork
07:03 < krzee> if its only for those 2 locations, it doesnt matter
07:03 < krzee> if you will have road warriors, be sure to use uncommon subnets
07:04 < krzee> that way when you connect from some wireless router out in the wild which uses 192.168.1.x (one of the 2 most common) you wont be screwed up
07:04 < durando2> well i wouldn't call myself a road warrior but i may need to hit the network remotely on occassion
07:04 < krzee> then dont use such a common subnet
07:05 < durando2> alright
07:05 < durando2> so 10.10.1.0
07:05 < durando2> etc
07:06 < EugeneKay> 10.10 is a bad one as well
07:06 < durando2> lol
07:06 < EugeneKay> 10.58.1.x, tho, is fine
07:06 < durando2> okay 10.58.1.x
07:07 < Engin> I want to abuse TAP-Win32 adapter. Can I use it as a secondary interface two my physical adapter ?
07:07 < EugeneKay> Or 172.17.35.x
07:07 < durando2> what about 10.50.1.x
07:07 < Engin> s/two/to
07:07 < EugeneKay> As long as it's nice and random
07:08 < durando2> yea something semi easy for me to remeber
07:08 < Bushmills> try  http://scarydevilmonastery.net/subnet.cgi
07:08 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
07:09 < durando2> 10.666.1.x
07:09 < durando2> lol
07:10 < durando2> is that doable?
07:12 < durando2> so now i gotta figure out how to keep the same ips for the routers on the openvpn subnet
07:12 < Bushmills> !ccd
07:12 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
07:13 < EugeneKay> That ^
07:14 < durando2> you guys keep pointing to me towards scripts and stuff but i'm doing this through a gui......
07:14 < EugeneKay> Config files should still be done manually
07:14 < EugeneKay> Windows GUI is just there torun t
07:14 < EugeneKay> to run it*
07:14 < Bushmills> would you rather want us to stop pointing you to stuff then?
07:18 < durando2> i'm using tomatousb (router firmware)
07:19 < Bushmills> i'm using openwrt, and the config files are still text files, and can be edited, even though there's a GUI as well.
07:20 < Bushmills> if you need tomato-specific editing of config files through GUI, you better ask #tomato
07:20 < ecrist> sup d00ds?
07:21 < krzee> durando2, we dont support any gui, we support openvpn
07:22 < EugeneKay> I'm still in bed ^_^
07:27 < Engin> what do clothes do you have on you
07:27 < EugeneKay> Blanket.
07:27 -!- durando [~durando@cpe-76-179-211-49.maine.res.rr.com] has joined #openvpn
07:27 < Engin> good to know
07:28 < janjust> no. too much information :-(
07:28 < krzee> lol
07:28 < EugeneKay> Damnit. Wrong option on my phone.
07:28 -!- durando2 [~durando@cpe-76-179-211-49.maine.res.rr.com] has quit [Read error: Operation timed out]
07:29 < durando> okay
07:29 < durando> new ips assigned and back to udp/tun
07:30 < durando> and doesn't look like i'm fried yet......
07:30 < durando> and i can ping both routers......
07:31 < durando> home is 10.50.1.x, work is 10.50.2.x, and the vpn is 10.50.3.x
07:33 < durando> and now that i've fixed the subnet issues i'm able to stay connected 
07:34 < durando> wow thats kinda nice
07:34 < durando> i definatly wouldn't have figured this much out without you guys
07:35 < durando> so now i guess the part i dont get is hitting the computer at 10.50.1.100 from this computer which is 10.50.2.201
07:36 < durando> does there have to be a 10.50.3.x something for that to work correctly?
07:37 < Bushmills> !clientlan
07:37 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
07:37 <@vpnHelper> better explanation
07:37 < janjust> durando:  you'd better read up on how tcp/ip works
07:37 < Bushmills> !serverlan
07:37 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
07:37 < durando> !ipforward
07:37 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
07:39 < durando> !route_outside_openvpn
07:39 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
07:39 < Engin> I'm trying to implement something. Any suggestions for creating a virtual network adapter which will use the physical network adapter. I just want another network interface for my phsyical adapter. It would be easy if I was on linux but I'm on win32
07:39 < Engin> I'm curious if TAP-Win32 could be abused for taht
07:40 < janjust> Engin:  how would a virt adapter use the physical adapter? what would you have done on linux?
07:40 < Engin> I'd just add another IP to the physical adapter
07:41 < Engin> the thing I want to achieve on windows is that, I want to keep the users confgiuration intact... (i.e. dhcp) and add a static (link-local) ip to the itnerface (i.e. 169.254.c.d)
07:41 < janjust> you don't need a virt adapter for that, that's an IP alias
07:41 < janjust> that can be done using netsh on windows
07:41 < Engin> on differnt subnets
07:41 < Engin> when I do it, dhcp is turned off
07:43 < durando> rereading the routing again......
07:45 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p9942>
07:46 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
07:46 -!- js_ [~js@213.180.83.163] has quit [Ping timeout: 250 seconds]
07:46 < hyper_ch> hi Bushmills
07:46 < Bushmills> 'morning hyper_ch 
07:46 < s7r> hy - just got openvpn working on the openvz shit... everything is ok now
07:47 -!- js_ [~js@213.180.83.163] has joined #openvpn
07:47 < s7r> i want to configure the server to listen on multiple ports, for ex. the client will first try to connect to 1194 udp, if not 443 udp, if not 443 tcp
07:47 < s7r> to take them in order 
07:47 < s7r> how can i do this ?
07:47 < hyper_ch> Bushmills: do you happen to know a person named Dirk Becker?
07:48 < Bushmills> you'd need, for now, multiple servers
07:48 < Bushmills> hyper_ch: funny, i just read the name yesterday
07:48 < s7r> the <connection> tag?
07:48 < Bushmills> but i forgot in which context that was
07:48 < hyper_ch> Bushmills: because I asked you then but never got a reply :(
07:48 < Engin> janjust, why do you think a tun/tap device is not what I'm looking for, it sure looks like it is.
07:49 < Engin> I just need the TAP-Win32 to inject packets that are written to it 
07:49 < Engin> to the physical adapter
07:49 -!- iTycoon [~Adium@c-67-186-122-97.hsd1.in.comcast.net] has quit [Quit: Leaving.]
07:49 < hyper_ch> Bushmills: I wonder because of this book http://www.dibiost.ch/dibiost/frontend/mediaInfo,0-561-354501233-200-0-0-0-0-0-0-0.html
07:50 <@vpnHelper> Title: Online-Bibliothek. OpenVPN (at www.dibiost.ch)
07:50 < s7r> --remote ?
07:50 < s7r> !remote
07:50 < s7r> !connection
07:50 < janjust> Engin:  I see what you mean... I thought IP aliasing was possible in windows, I guess it is not (in combination with dhcp)
07:50 < Bushmills> hyper_ch: i suppose i read the name in connection with freeswitch, because that's what i was busy with yesterday
07:51 < hyper_ch> :)
07:51 < hyper_ch> well, he wrote a book about openVPN and I thought you might know him
07:51 < janjust> s7r: the server will listen only a single port ; if you want multiple ports and protocols, run multiple instances of openvpn
07:51 < s7r> on the same server or how ?
07:52 < s7r> i have only one server with one ip
07:52 < janjust> s7r:  create multiple openvpn server configs and start them all 
07:52 < Bushmills> http://www.buch.ch/shop/bch_buc_startseite/mehrvonartikel/openvpn_galileo_computing/dirk_becker/ISBN3-8362-1671-X/ID22447493.html;jsessionid=277FD897590517F09888E98AE76F97E4.tc5?jumpId=1360899  this one?
07:52 <@vpnHelper> Title: Bcher: OpenVPN. Galileo Computing von Dirk Becker (at www.buch.ch)
07:52 < s7r> janjust: how ?
07:52 < s7r> openvpn --config server1.conf
07:52 < s7r> server2.conf and so one ?
07:52 < janjust> yep
07:52 < s7r> i have only root user
07:52 < s7r> is it ok ?
07:53 < janjust> server1 listens on proto udp, port 1194 ; server2 l istens on proto tcp, udp port 1194 etc
07:53 < s7r> got it
07:53 < s7r> and i run all of them as root right ?
07:53 < s7r> i do not need to conf multiple users on my ubuntu box
07:53 < Engin> what exactly the interface tap0901.sys creates ?
07:54 < janjust> you can run all of them as root, or as user 'nobody' or whatever
07:54 < s7r> ok and the client file will be like <connection>remote myserver 1194 udp</connection><connection>remote myserver 443 tcp and so on?
07:54 < janjust> Engin: I guess you're better off in the #openvpn-devel channel for this. You'd need to read the openvpn sources pretty carefully to see how you can write your own tap-win32 app
07:54 < janjust> s7r: yes
07:55 < Engin> I'm on that code right now actually
07:55 < s7r> many thanks janjust. one last thing. what is the command to see how many openvpn instances are running on the server?
07:55 < s7r> and how to kill just one of them or something
07:55 < Engin> let me join there
07:55 < janjust> s7r: I'd use something like 'ps -elf | grep openvpn' ; this will list the process ids ; you can then kill 1 of them using 'kill <PROCESS ID>'
07:56 < s7r> thanks man
07:56 < s7r> you couldn't explain it more clear
07:59 < janjust> np s7r, just buy my book and I'm happy 
08:02 < hyper_ch> Bushmills: the book looks rather interesting
08:03 -!- Andre___ [~f0rd42@pD958787B.dip.t-dialin.net] has joined #openvpn
08:03 < Andre___> Hello
08:03 < hyper_ch> hi andy
08:04 < Andre___> Can I allow a Single user (cert, key, etc) to login more than once from different machines?
08:04 < Andre___> Some kind of "general purpose login"
08:04 < janjust> Andre___:  use 'allow-duplicate-cn' but this is security risk
08:05 < Andre___> This is on the server, right?
08:05 < hyper_ch> best would be to create different certs, right?
08:05 < janjust> yep Andre___ 
08:05 < Andre___> I know about the risk, but it's for a trade show, and I don't want to issue hndres of Cerys for one week show
08:06 < Andre___> Thanks a lot
08:06 < janjust> issuing hundreds of certs can be as simple as a single script/command-line
08:06 < Andre___> Jes, but deploying them is a pain ( all users are sales people)
08:06 < janjust> correction Andre___ : sales people are a pain ;-)
08:07 < Andre___> As I said
08:08 < Andre___> :-)
08:09 < Andre___> Thanks a lot, will give it a try
08:09 < EugeneKay> PortableApps
08:09 < EugeneKay> Package it up, give everybody a .zip file with their .ovpn and keys
08:10 < Andre___> Some are one Macs
08:10 < EugeneKay> Mac users can die in a fire
08:10 < Andre___> I'll give the viscosity for mac and windows with the certs, that'it
08:12 < s7r> janjust: i run cp /etc/openvpn/server.conf /etc/openvpn/server1.conf, modified proto tcp and port 443 than run openvpn --config server1.conf
08:12 < s7r> and i got error linux can not add route
08:12 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:12 -!- Andre___ [~f0rd42@pD958787B.dip.t-dialin.net] has quit [Remote host closed the connection]
08:13 < reiffert> echo virtualbox > vmware server?"yes":"no";
08:13 < s7r> and i changed server 10.8.0.0 as it was in server.conf to 10.9.0.0 in server1.comf
08:13 < s7r> now when i start it everything bloks
08:13 -!- Andre___ [~f0rd42@pD958787B.dip.t-dialin.net] has joined #openvpn
08:13 < Andre___> Sorry, my client just crashed
08:14 < janjust> s7r : this totally depends on your server config
08:14 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:14 < Andre___> I meant my irc client
08:14 < janjust> start out with a server config as simple as possible; I've ran up to  6 instances of openvpn on a single server with a single nic without any problems
08:15 < s7r> janjust: what can i do?
08:16 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
08:17 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:18 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
08:19 < janjust> s7r: create a new short server config, as short as possible. make sure that works, no extra routing stuff. if that works, copy it over, change udp->tcp and port 1194->443 then try running both of them
08:20 -!- durando [~durando@cpe-76-179-211-49.maine.res.rr.com] has quit [Quit: Leaving.]
08:24 -!- f1assistance1 [~Carl@cpe-024-211-247-099.nc.res.rr.com] has left #openvpn []
08:27 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
08:28 < s7r> it says linux can not add route
08:28 < s7r> if i leave it just the same and do not modify server ip pool
08:34 < s7r> janjust: LINUX ROIUTE ADD COMMAND FAILED
08:34 < s7r> i did exactly as you said cp the conf and run it
08:34 < hyper_ch> s7r: tried to add it as root?
08:35 < s7r> yes
08:35 < s7r> i only have root access
08:35 < hyper_ch> iiieeks... only working as root... ieeeks
08:35 < s7r> should i sudo 
08:35 < s7r> sudo openvpn --config server1.conf
08:36 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
08:36 < s7r> SIOCADDRT: File eists janjust that is the error
08:36 < s7r> :p
08:39 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645-15.html#p9943>
08:43 -!- firestorm7 [~firestorm@unaffiliated/firestorm7] has joined #openvpn
08:44 < janjust> s7r: without your actual server configs it's impossible to tell what you did wrong
08:45 < s7r> i have a vps openvz, one public IP address, one openvpn instance running listening on port 1194 udp working just fine
08:45 <@vpnHelper> RSS Update - forum: config for fast server? <http://forums.openvpn.net/topic7678.html#p9944>
08:45 < s7r> i want to add another instance to listen on port 443 tcp
08:47 < janjust> s7r, post your working server config on pastebin and I'll have a look
08:48 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
08:49 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 240 seconds]
08:51 <@vpnHelper> RSS Update - forum: config for fast server? <http://forums.openvpn.net/topic7678.html#p9945>
08:54 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
08:57 <@vpnHelper> RSS Update - forum: config for fast server? <http://forums.openvpn.net/topic7678.html#p9946>
08:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
09:01 < firestorm7> hi, i use windows open vpn gui but it doesnt run,i always get an error message it looks so: http://img51.imageshack.us/f/openvpn.jpg/  can sb help me
09:01 <@vpnHelper> Title: ImageShack - Online Photo and Video Hosting (at img51.imageshack.us)
09:03 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
09:03 < s7r> sorry for disconnection
09:04 -!- WormFood [~wormfood@183.39.76.152] has quit [Ping timeout: 240 seconds]
09:04 < s7r> i have googled and it looks like it's  a common problem the SIOCADDRT file already exists and another vpn instance can't be opened
09:08 < firestorm7> i havent tried another but the username and password is correct, is sth in the config wrong?
09:08 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
09:08 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
09:08 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:16 -!- Engin [~engin@85.108.240.6] has quit [Ping timeout: 240 seconds]
09:25 < reiffert> !forward
09:25 < reiffert> !factoids search forward
09:25 <@vpnHelper> 'winipforward', 'linipforward', 'fbsdipforward', 'linportforward', 'osxipforward', and 'ipforward'
09:25 < reiffert> !winipforward
09:25 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
09:26 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
09:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
09:31 < s7r> to make an openvpn server out of a windows xp box with only one external ip, what should i enable ip forwarding , ip routing or both?
09:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:33 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
09:33 -!- mode/#openvpn [+o mattock] by ChanServ
09:34 -!- firestorm7 [~firestorm@unaffiliated/firestorm7] has left #openvpn []
09:37 < EugeneKay> !beer
09:37 <@vpnHelper> "beer" is its what's for dinner!
09:38 < EugeneKay> That should really just be "what's for dinner"
09:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
09:42 -!- dvsxutact [~dvsxutact@ip68-228-166-118.ok.ok.cox.net] has quit []
09:50 -!- FSprofi [~chatzilla@178.115.246.46.wireless.dyn.drei.com] has joined #openvpn
09:51 < FSprofi> can i start a server with udp and tcp listenports? and all who connect to one of the ports will be able to communicate to each other?
09:55 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
09:56 < cpf_> Is it possible to create something like this: PC A ---VPN--- VPNserver1 ---VPN--- VPNserver2 ---VPN--- NETWORK B so that PC A can reach NETWORK B?
09:57 < cpf_> Note: PC A is a client of VPNserver 1, VPNserver1 is a client of VPNserver2, and NETWORK B has a router as client on VPNserver2
10:03 -!- FSprofi [~chatzilla@178.115.246.46.wireless.dyn.drei.com] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
10:08 -!- Guest95813 is now known as caesay
10:08 -!- caesay [~caesay@173.236.15.70] has quit [Changing host]
10:08 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
10:08 -!- caesay is now known as no
10:08 -!- no is now known as caesay
10:18 -!- teddyb [8fef4beb@gateway/web/freenode/ip.143.239.75.235] has joined #openvpn
10:19 < teddyb> !help
10:19 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
10:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:29 < teddyb> hi im having trouple using openvpn under linux, im getting this far http://pastebin.com/CrN1dcn1 but dont seem to have internet after connecting
10:29 < teddyb> my os is ubuntu 10.10
10:36 < hjohnson> hmm yeah, because it's changing your default gateway
10:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
10:39 < teddyb> im assuming it shouldnt?
10:40 < hjohnson> well, it depends on your configuration
10:43 -!- Andre___ [~f0rd42@pD958787B.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
10:44 < teddyb> im using http://pastebin.com/cSdvBLR8 as my config
10:47 < s7r> SIOCADDRT - file already exists --- i get this error when trying to open a second instance of openvpn ... what can I do ?
10:48 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has left #openvpn []
10:54 < teddyb> anyone any idea what to do?
10:55 < teddyb> id be really gratefull
10:55 <@dazo> s7r: how does your 'dev' statement look like in your openvpn config?
10:55 <@dazo> !goal
10:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:55 <@dazo> teddyb: ^^^
10:55 < teddyb> i would like to access the internet
10:55 < s7r> dazo: what do you mean?
10:56 < s7r> dev tun0 for server.conf
10:56 < s7r> and dev tun1 for server1.conf
10:56 <@dazo> exactly
10:56 < s7r> the first config (server.conf) works perfectly
10:56 < s7r> it's configured to listen on udp 1194
10:56 < s7r> i want server1.conf to listen on tcp 443
10:56 < s7r> :D
10:56 <@dazo> s7r: can you please pastbin both server configs?
10:57 < s7r> and provide clients with <connection> remote</connection> so they will first try to connect
10:57 < s7r> yes sir
10:57 < s7r> 2 minutes
10:57 < s7r> to ssh to srever
10:57 <@dazo> teddyb: okay ... then we need your configs
10:57 <@dazo> !configs
10:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
10:59  * dazo wonders if teddyb is lacking some firewall/NAT stuff or net.ipv4.ip_forward is not enabled
10:59 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
11:00 < teddyb> http://pastebin.com/rwCej7Kj is the configs with comments removed
11:01 <@dazo> teddyb: what is this one?  "http-proxy 10.255.255.10 8080"
11:02 < teddyb> the proxy i have to go through to get internet access 
11:04 < s7r> dazo: http://pastebin.com/QnMaVXZi
11:04 < s7r> here is the server.conf which is working great
11:04 < s7r> server1.conf is just the same except port 443 proto tcp and dev tun1
11:05 < s7r> the rest is copy / paste the same as in that pastebin
11:06 <@dazo> teddyb: goodie ... when you connect, can you ping the VPN server IP address?  (the tunnel address) ... btw, this route line looks bogus as well
11:06 <@dazo> #
11:06 <@dazo> Fri Feb 25 16:17:09 2011 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 212.78.230.215
11:06 <@dazo> #
11:06 <@dazo> Fri Feb 25 16:17:09 2011 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 212.78.230.215
11:07 < majuk> Uhhh... wtf is that netmask?
11:07 <@dazo> 212.78.230.215 should be something else something else
11:07 <@dazo> that's a fine netmask
11:07 < majuk> Oh, it's bogus, you're a man
11:08 <@dazo> those two lines together replaces the default gateway ... this is a hack to avoid overwriting the default gateway
11:08 <@dazo> and they go in before the default gateway, thus temporarily (as long as openvpn runs) redirect the traffic via another gw
11:09 < s7r> dazo: looked over my paste bin?
11:09 -!- Andre___ [~f0rd42@p54BE4CC3.dip.t-dialin.net] has joined #openvpn
11:09 <@dazo> teddyb: you assigned public IP addresses to your VPN adapters?
11:09  * dazo is on thin ice in such setups
11:09 <@dazo> s7r: not yet ... looking now
11:10 < teddyb> i highly doubt it, i just downloaded that config file and installed openvpn
11:10 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
11:11 <@dazo> teddyb: so you have just copied a config file from the net and hoped it would work?
11:11 <@dazo> s7r:  how do you start the second openvpn service?  If you just replace port and dev opts with different port and dev name ... then it sounds like the same config file is loaded twice
11:12 < teddyb> yes, i was given a username and password (i also copied some keys and stuff)
11:13 <@dazo> teddyb: so you're not maintaining the server?  you're just a "normal user" in a prepared setup?
11:13 < teddyb> and answering your earlier question i can ping the vpn servers ip addy
11:13 < teddyb> yes dazo, but they know very little about setting it up for ubuntu
11:14 <@dazo> well, I'll have to leave that issue stay open from my side ... as I have no experience with using public IP addresses as the VPN addresses
11:15 <@dazo> it's possible ... but it requires a special setup, even though that's mostly on the server side
11:15 <@dazo> however, I don't want to confuse you with wrong info
11:16 < s7r> dazo: the second vpn service i start openvpn --config server1.conf
11:17 < teddyb> oh ok, im connected as far as i can tell, doing a traceroute to the vpn server i only have to do 1 hop
11:18 <@dazo> s7r: ahh!  I see the issue ... you need to put them on separate subnets as well ... the --server option
11:18 <@dazo> that's what's making the collision
11:18 -!- oracle [~o2@unaffiliated/spice] has joined #openvpn
11:21 < s7r> how do i do this?
11:21 < s7r> server 10.7.0.1
11:21 < s7r> ?
11:21 < teddyb> and i can ssh using terminal,
11:21 -!- oracle_ [~o2@unaffiliated/spice] has quit [Ping timeout: 250 seconds]
11:22 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
11:23 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has joined #openvpn
11:23 -!- oracle [~o2@unaffiliated/spice] has quit [Ping timeout: 250 seconds]
11:24 -!- oracle [~o2@unaffiliated/spice] has joined #openvpn
11:24 < teddyb> ok it seems my dns isnt working throught the vpn
11:30 < s7r> dazo: if i changed --server option
11:30 < s7r> and now if i config server1.conf
11:30 < s7r> openvpn --config server1.conf
11:30 < s7r> it freezes
11:30 < s7r> no output
11:30 < s7r> why so
11:30 < s7r> I have to press ctrl + c
11:30 <@dazo> what did you change it to?
11:30 < s7r> to get out of it
11:30 <@dazo> yeah, you do not have --daemon enabled
11:31 < s7r> oh shet
11:31 < s7r> :))
11:31 < s7r> tell me 
11:31 < s7r> how do i do it
11:32 <@dazo> s7r: either add --daemon to you command line ... or add 'daemon' to you server1.conf
11:33 < s7r> just this
11:33 < s7r> daemon ?
11:33 < s7r> where ? on top ?before dev tun1?
11:34 < s7r> or it doesn't matter?
11:34 <@dazo> wherever in the config
11:35 < s7r> yeah
11:35 < s7r> it's working now
11:35 < s7r> :D
11:35 < s7r> thanks dazo
11:35 < s7r> u're the best
11:35 <@dazo> nah
11:35 < s7r> >:D<
11:35 < s7r> and i can make
11:35 < s7r> server2.cnf
11:35 < s7r> if i want /
11:35 <@dazo> I'm happy it works :)
11:36 < s7r> and just the same enter daemon to conf file ?
11:36 < teddyb> how do you tell openvpn which dns to use
11:36 < s7r> or daemon1, daemon 2
11:36 < teddyb> cause its trying to use my campus one by the looks of it
11:38 < reiffert> !winnat
11:38 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows, or (#2) http://www.nanodocumet.com/?p=14 for windows XP
11:39 < s7r> dazo: for server2.conf i add the same daemon or daemon2 daemon1
11:39 < s7r> ?
11:39 <@dazo> correct
11:39 <@dazo> !search dns
11:39 <@vpnHelper> There were no matching configuration variables.
11:39 <@dazo> !find dns
11:39 <@dazo> !factoids
11:40 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
11:40 <@dazo> !pushdns
11:40 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
11:40 <@dazo> teddyb: ^^^
11:41  * dazo heads home
11:41 < teddyb> noooo
11:44 -!- dazo is now known as dazo_afk
11:48 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
11:51 < s7r> if i have 3 server config files... server.conf server1.conf and server2.conf all of them need to have daemon option in config, or just serve1.cnf and 2.conf ?
11:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:57 -!- cj [~cjac@adsl-207-32-175-127.rockisland.net] has quit [Ping timeout: 240 seconds]
11:58 -!- Bzek [~SK@access-46-42-32-43.kmtn.ru] has joined #openvpn
12:00 < Bzek> Hello. How to pull a message to a client when client is connected?
12:00 < Bzek> To his log file.
12:02 < Bzek> s/pull/push/
12:03 -!- teddyb [8fef4beb@gateway/web/freenode/ip.143.239.75.235] has quit [Quit: Page closed]
12:05 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 240 seconds]
12:06 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
12:09 -!- p3rror [~mezgani@41.248.186.14] has quit [Ping timeout: 264 seconds]
12:16 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
12:18 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html>
12:21 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Excess Flood]
12:22 -!- dvl [~dvl@nyi.unixathome.org] has joined #openvpn
12:24 -!- sigius [~sigius@93.125.185.45] has quit [Ping timeout: 240 seconds]
12:25 -!- p3rror [~mezgani@41.140.28.113] has joined #openvpn
12:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
12:28 -!- dvl [~dvl@nyi.unixathome.org] has quit [Changing host]
12:28 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
12:29 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 240 seconds]
12:29 <@vpnHelper> RSS Update - forum: Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9948>
12:31 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
12:32 < s7r> someone can look over these http://pastebin.com/fek16JLD i get them on widnwos is it normal ?
12:32 < s7r> vpn is working but these notices worry me are they normal ?
12:33 -!- Engin [~engin@85.108.106.130] has joined #openvpn
12:36 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 250 seconds]
12:36 < ecrist> s7r: those are fine.
12:37 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
12:40 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has left #openvpn []
12:42 -!- Engin [~engin@85.108.106.130] has quit [Ping timeout: 272 seconds]
12:50 -!- s7r [~s7r@unaffiliated/s7r] has quit [Read error: Connection reset by peer]
12:54 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
13:26 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
13:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:52 -!- atan [~atan@unaffiliated/atan] has joined #openvpn
13:53 -!- robotti^ [robotti@kapsi.fi] has quit [Ping timeout: 260 seconds]
13:53 < atan> Complete noob question here... but here goes. I'm interested in setting up a VPN so users can install the software on their computer, auto-connect when a special website is requested and, err, yeah that's about it. I need to allow only one active connection per person as well, some-how-some-way.
13:54 < atan> There wouldn't be a tutorial on how to do such a thing, would there?
13:54 < krzee> openvpn doesnt have anything allowing connect-on-demand
13:54 < krzee> unless you program it
13:55 < EugeneKay> You need a wrapper script
13:55 < atan> Is this connect-on-demand thing a cisco thing?
13:55 < EugeneKay> No, it's a concept 
13:55 < krzee> EugeneKay, where would the wrapper hook in?
13:55 < atan> I just recall the old VPN at work would prompt me when I tried to access a VPN site
13:55 < stony> atan: you can realize it via a routing daemon 
13:55 < krzee> atan, then it wasnt openvpn
13:56 < krzee> stony, routing daemon can run local apps when a certain route is attempted?
13:56 < EugeneKay> krzee - listens on 127.0.0.1:80, have the DNS for that site resolve to the same
13:56 < stony> krzee: it has a dummy interface all your routes go to, and when a packet arrives, it triggers the action to create the connection to the specific host,subnet ...
13:56 < EugeneKay> Request is received, script launches openvpn, and then forwards off to something on the far end of the tunnel
13:56 < krzee> stony, cool!  yep that would be a good way to do it
13:56 < stony> port forwarding with ssh ...
13:57 < stony> krzee: but a routing daemon is not somethin you can (want to)  install on a client 
13:57 < stony> krzee: you could use ipsec for what you want todo
13:57 < stony> krzee: ipsec policies are persistent and can be host based ...
13:57 < krzee> its not me
13:57 < krzee> uts atan
13:57 < krzee> its*
13:58 < stony> the best way should be ipsec
13:58 < stony> even win2k supports static ipsec policies
13:58 < atan> s/atan/clueless atan/
13:58 < stony> and when you do ipv6 it's as good as it can get
13:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:01 < atan> Now on another note is there currently any way to setup OpenVPN to, err, store certificates in MySQL? Say I want to have 100 people connect in but may want to void one or two of them every few weeks, add new ones, all without turning the VPN off/on for those currently connected.
14:02 < atan> I plan to have them connect with a username and password, the password being from a security token.
14:02 < krzee> store certs in mysql??
14:02 < krzee> are you familiar with how PKI works?
14:02 < atan> Not at all.
14:03 < krzee> the server does not have a copy of the client certs, it simply checks they were signed by the right CA
14:03 < krzee> !pki
14:03 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
14:03 <@vpnHelper> specially as a server (see !servercert)
14:03 < atan> Hmm. So CA does not need to be, nor should, be left on the server?
14:04 < krzee> best security would have it on a machine that has no network access at all
14:04 < krzee> especially not on the server
14:04 < atan> To prevent people from spoofing a server or spoofing a client, correct?
14:04 < atan> Perhaps the wrong word, spoof
14:04 < krzee> once someone can access the ca.key, your vpn is 100% owned
14:04 < atan> But to prevent someone from making a new, albeit legit one.
14:04 < atan> Ahh! 'owned', now words I can understand. Perfect.
14:04 < krzee> if a client cert is compromised, you just make a CRL
14:05 < atan> What is a CRL?
14:05 < krzee> !crl
14:05 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
14:05 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
14:05 < atan> Is CRL built in to the server crt?
14:05 < krzee> no
14:06 < krzee> in fact my bot just told you the config option used, and 2 ways to make a crl!
14:07 < atan> I see it says it is packaged with OpenVPN under easy-rsa but I wonder where this data is stored?
14:07 < atan> How does OpenVPN know the client connecting has been revoked?
14:07 < atan> --crl-verify doesn't make sense to me but only because I do not understand it fully
14:07 < krzee> ahh
14:07 < atan> is --crl-verify something that goes in the server config which points to a list of comp'd keys?
14:08 < krzee> ok well you make the certs all on 1 machine
14:08 < krzee> it keeps an index of the certs
14:08 < krzee> when you revoke one it makes a list of them and signs it with the ca.key
14:09 < atan> Let's talk about this list. Where is this list?
14:09 < atan> Assume the key bachine is offline I suppose.
14:10 < krzee> it doesnt exist unless you make it
14:10 < atan> I am trying to add/remove keys as I see fit without needing to replace existing keys.
14:10 < krzee> you put it on the server
14:10 < krzee> the server has no awareness of created certs
14:10 < atan> The server _only_ knows of revoked certs?
14:11 < krzee> only knows if the cert is valid and was signed by the ca.key that belongs to the ca.crt which it uses
14:11 < krzee> and if it has --crl-verify, then it can see if the cert was revoked
14:12 < atan> Is there a way to make it verify the client crt as opposed to just letting them in because it looks good?
14:12 < krzee> define "verify"
14:12 < krzee> being signed by the ca.key that belongs to the ca.crt which the server uses IS verified!
14:12 < atan> Sorry. Say the key making machine is offline. Some staffer makes a new key and uses it to connect without the right person knowing.
14:13 < krzee> staffer has access to the ca.key?
14:13 < atan> Hmm. Okay maybe a bad example.
14:13 < krzee> thats your answer tho
14:13 < krzee> ca.key is the right to make keys
14:13 < krzee> err
14:13 < krzee> the right to make certs
14:14 < atan> But from what I am gathering here any client can connect so long as they have a cert signed by the ca.key. So I could sign 100,000 client certs and hand them out like candy, then revoke the ones who no longer require access.
14:14 < atan> Is it insecure for any reason so sign then revoke?
14:15 < atan> I suppose I could better explain what I am trying to do to you if you have a minute or two?
14:15 < krzee> actually im about to leave
14:15 < atan> Right now I'm trying to make up silly example scenarios which I clearly suck at.
14:15 < atan> Oh, okay then perhaps another time if you're a frequent flyer :)
14:16 < secretary_linux> I thought the last question was pretty clear, I can't see that as an insecure scenario, my only question is: how to set up a revocation list on the server end?
14:16 < atan> secretary_linux, howdy
14:17 < secretary_linux> hiya- I'm jumping in mostly because I haven't yet had to reoke but know that it will happen in the future
14:17 < secretary_linux> revoke*
14:17 < krzee> you set it up on the CA, move it to the server
14:17 < atan> krzee, so I simply build a new server certificate using my private ca.key?
14:17 < krzee> same way you move client certs to their new home after you sign them :-p
14:17 < krzee> server certificate!?
14:18 < atan> Err. Okay I'm off in left field here.
14:18 < krzee> sorry dude, you need to read up on how PKI works
14:18  * atan youtubes this
14:18 < krzee> youtube!?
14:18 < hyper_ch> hi krzee
14:18 < krzee> try google
14:18 < krzee> hey hyper_ch 
14:19 < hyper_ch> krzee: happy weekend
14:19 < krzee> you're just in time to explain PKI while i leave!!!
14:19 < krzee> ;]
14:19 < krzee> thx!
14:19 < atan> hyper_ch, welcome ^_^
14:19 < hyper_ch> atan: thx
14:20 < atan> hyper_ch, are you well versed with this OpenVPN thing? :)
14:20 < hyper_ch> atan: compared to krzee, my knowledge is that of a very young infant
14:23 < atan> Is OpenVPN expensive?
14:23 < atan> Err, in terms of CPU.
14:23 < atan> If I want to stream videos over an OpenVPN connection am I going to need a seperate P4 computer for each streaming youtube video?
14:32 < ecrist> no
14:38 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:40 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
14:40 -!- grapsus [~grapsus@acces1094.res.insa-lyon.fr] has quit [Remote host closed the connection]
14:43 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
14:49 -!- glengoyne [~glengoyne@p549464D3.dip.t-dialin.net] has joined #openvpn
14:51 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p9949>
15:02 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
15:12 < krzee> atan, many people run openvpn on little linksys routers, and those have weak cpu
15:12 < krzee> of course you mentioned 100,000 client certs, your openvpn server may die around 200 :-p
15:12 < krzee> (active clients)
15:18 -!- glengoyne [~glengoyne@p549464D3.dip.t-dialin.net] has quit [Quit: Verlassend]
15:33 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p9950>
15:41 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
15:46 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
16:12 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
16:21 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 264 seconds]
16:26 -!- EugeneKay is now known as GayCarrot
16:31 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
17:03 -!- zeeshoem [~mnathani@bas1-toronto46-1279266453.dsl.bell.ca] has quit []
17:13 -!- zeshoem [~mnathani@bas1-toronto46-1279266453.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
17:20 -!- zeshoem [~mnathani@bas1-toronto46-1177980326.dsl.bell.ca] has joined #openvpn
17:37 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
17:39 < s7r> my iptables rules disappear after reboot
17:39 < s7r> and i have used iptables-save as root
17:40 < s7r> !iptablexz
17:40 < s7r> !iptables
17:40 <@vpnHelper> "iptables" is (#1) o test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT;, or (#2) then run iptables -F, iptables -Z after being SURE policies are set to accept, or (#3) please see http://openvpn.net/man#lbBD for more info, or (#4) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall
17:42 < ecrist> s7r: we don't support linux or iptables here.  those questions are best for a linux-specific channel
17:43 < LuckyY> s7r: check the iptables config file, my fedora ignores the iptables-save i needed to manually edit the config to save on stop/restart
17:44 < s7r> thank you LuckyY 
17:44 < s7r> i need to locate the iptables config file now :D
17:44 < LuckyY> /etc/sysconfig/iptables.conf on my fedora
17:45 < LuckyY> sorry iptables-config
17:46 < s7r> thanks LuckyY
17:46 < s7r> no idea why the sys ignores iptables-save
17:53 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
18:05 -!- GayCarrot is now known as EugeneKay
18:28 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
18:32 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
18:37 -!- Meliorator [m@dunnington.eu] has quit [Quit: changing servers]
18:38 -!- Meliorator [m@dunnington.eu] has joined #openvpn
18:39 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:39 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 240 seconds]
18:39 -!- hackeron [~hackeron@cpc2-seve4-0-0-cust602.13-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
18:39 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Ping timeout: 240 seconds]
18:40 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
18:40 -!- hackeron [~hackeron@cpc2-seve4-0-0-cust602.13-3.cable.virginmedia.com] has joined #openvpn
18:41 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
18:44 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
18:44 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
18:57 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 264 seconds]
19:08 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
19:12 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
19:21 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
19:25 -!- WormFood [~wormfood@183.38.238.22] has joined #openvpn
19:33 -!- oracle is now known as copkiller
19:35 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 264 seconds]
19:46 < s7r> how do i use the --auth-user-pass feature ?
19:46 < s7r> and how does it change the entire system as i have now certificate authentication
20:20 <@vpnHelper> RSS Update - forum: Works after install dies after reboot MD5 missing? <http://forums.openvpn.net/topic7689.html>
20:35 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
21:06 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
21:07 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
21:08 -!- master_of_master [~master_of@p57B5369D.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:10 -!- master_of_master [~master_of@p57B57BBA.dip.t-dialin.net] has joined #openvpn
21:16 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 246 seconds]
21:20 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Ping timeout: 246 seconds]
21:21 -!- ucekpolish [user@hq.ostc-pl.com] has joined #openvpn
21:21 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has quit [Ping timeout: 250 seconds]
21:23 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
21:24 -!- ping-pong [~qwerty@212-30-223-89.static.simnet.is] has joined #openvpn
21:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
21:39 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
21:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:12 -!- EugeneKay is now known as EugeneKaway
22:17 -!- EugeneKaway is now known as EugeneKay
22:26 <@vpnHelper> RSS Update - forum: Is there Automatic certificate file exchange ? <http://forums.openvpn.net/topic7690.html>
22:30 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
22:32 <@vpnHelper> RSS Update - forum: Is there Automatic certification file exchange ? <http://forums.openvpn.net/topic7690.html>
22:44 -!- EugeneKay is now known as EugeneKaway
22:50 <@vpnHelper> RSS Update - forum: What can OpenVPN do for my need? <http://forums.openvpn.net/topic7691.html>
23:35 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
--- Day changed Sat Feb 26 2011
00:10 -!- Bzek [~SK@access-46-42-32-43.kmtn.ru] has quit [Read error: Connection reset by peer]
00:18 -!- Bzek [~SK@access-46-42-32-134.kmtn.ru] has joined #openvpn
00:22 < Bzek> Hello. How to push a message to a client when client is connected?
01:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
01:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
01:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:50 -!- p3rror [~mezgani@41.140.28.113] has quit [Ping timeout: 264 seconds]
01:55 -!- p3rror [~mezgani@41.140.41.13] has joined #openvpn
02:17 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
02:31 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
02:54 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
03:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:14 -!- mode/#openvpn [+o mattock] by ChanServ
04:03 -!- drax2gma [~gma@fibhost-66-157-44.fibernet.hu] has joined #openvpn
04:03 < drax2gma> hello, anybody uses vuurmuur with openvpn?
04:04 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
04:13 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
04:25 -!- albech [~thomas@61.7.130.12] has joined #openvpn
04:55 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
05:01 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
05:09 < Bushmills> Bzek: you use one of the misc network services which may be running on the client
05:10 < Bushmills> connection event can be used server side to execute a client-connect script  
05:13 < s7r> Bushmills: i have 2 openvpn daemons one listening on port 443 tcp one on 1723 udp
05:13 < s7r> if i add another server.conf just to listen on port 1194 udp
05:13 < s7r> it can not connect 
05:14 < s7r> it says (in client log) connection time out, check your internet connection
05:14 < s7r> but all other daemons work very good
05:14 < Bzek> Bushmills: Thank you.
05:15 < s7r> and when i connect to 1723 udp it says in client log local UDPv4 link: 1194[udef] adn remote UDPv4 link: serverip:1723
05:17 < Bushmills> !firewall
05:17 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
05:17 < s7r> Bushmills: firewall on my computer or on server
05:17 < Bushmills> the one which may block traffic to udp/1194
05:20 < s7r> i assume the one on my computer
05:20 < s7r> as when I added the daemons listening on 1723 and 443 I did not change any settings in the server firewall
05:21 < drax2gma> what could be a problem if i cannot get back icmp & other packets from the openvpn client? however I can ping from that client to the whole vpn.
05:21 < Bushmills> !firewall
05:21 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
05:26 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 246 seconds]
05:38 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645-15.html#p9954>
05:43 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
05:45 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
05:53 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
05:59 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
05:59 < DIgitalFlux> Hi Guys
05:59 < DIgitalFlux> I'm having problems with an OpenVPN installation
06:00 < DIgitalFlux> basically, whatever i use for the proto, if it's tcp or udp, the client just waits for the server response
06:00 < DIgitalFlux> but it always times out ..
06:00 < DIgitalFlux> I can paste the configs/logs if someone is ready to help me with it ..
06:00 < s7r> pastebin DIgitalFlux
06:01 < DIgitalFlux> s7r: OK .. uploading
06:02 < DIgitalFlux> This is the server config -> http://pastebin.com/nTRGrrvw
06:04 < DIgitalFlux> And here is the client config -> http://pastebin.com/TCEYUF2a
06:05 < s7r> DIgitalFlux: http://pastebin.com/MGmGE7q7
06:05 < DIgitalFlux> On the server logs i have something like this http://pastebin.com/yRersNTX
06:05 < s7r> paste this to your server conf
06:05 < DIgitalFlux> And the client just has a TCP_CONNECT retries
06:06 < s7r> lol DIgitalFlux
06:06 < s7r> your server is configured to listen on udp
06:06 < s7r> and your client is configured to connect via tcp
06:06 < s7r> it won't work in 100 years :)
06:06 < s7r> paste the server config i gave you
06:07 < s7r> and i will make a client config for you too
06:07 < s7r> to make a test
06:07 < DIgitalFlux> s7r: Oh sorry
06:07 < DIgitalFlux> I actually edited that :)
06:07 < DIgitalFlux> s7r: put pasted the old version of the file
06:08 < DIgitalFlux> s7r: so you changed that dhcp part only ?
06:09 < s7r> and added tun0 to your device
06:09 < s7r> and removed client-to-client
06:09 < s7r> http://pastebin.com/FZPvH24Z
06:09 < s7r> this is your client config
06:09 < DIgitalFlux> s7r: I tried with both udp/tcp (identical) on both sides .. it's either TCP_CONNECT or something like UDP_WAIT
06:09 < s7r> now try to connect with those
06:09 < s7r> and look in server /etc/openvpn/openvpn.log
06:09 < DIgitalFlux> s7r: OK Thanks, checking ..
06:09 < s7r> if it gives you timeout than it's a firewall issue
06:13 < DIgitalFlux> s7r: Yeah it's still in a WAIT state ->  MANAGEMENT: >STATE:1298722390,WAIT,,,
06:13 < DIgitalFlux> But the firewall is flushed actually ..
06:14 < s7r> on both server and client ?
06:14 < Bushmills> only flushed? or also default policies set to accept traffic?
06:14 < s7r> did you activatet nat / masquerade on server?
06:14 < s7r> as you have a 10.8.0.0 pool
06:15 < DIgitalFlux> Bushmills: They all have a default policy of ACCEPT
06:15 < s7r> !linnat
06:15 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
06:15 < DIgitalFlux> s7r: Chain POSTROUTING (policy ACCEPT 15445 packets, 1098K bytes)
06:15 < DIgitalFlux>  pkts bytes target     prot opt in     out     source               destination
06:15 < DIgitalFlux>     0     0 MASQUERADE  all  --  *      venet0:0  10.8.0.0/24          0.0.0.0/0
06:15 < s7r> shouldn't destination be the public address of your server ?
06:15 < s7r> the ip on which it listens on?
06:15 < s7r> !openvzlinnat
06:16 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
06:16 < s7r> this is in case you use vps
06:16 < DIgitalFlux> s7r: hmm .. isee
06:16 < DIgitalFlux> s7r: that's true, it's an openvz node
06:16 -!- juhovh [~jvahaher@kekkonen.cs.hut.fi] has quit [Ping timeout: 250 seconds]
06:16 < s7r> DIgitalFlux: type this
06:16 < DIgitalFlux> s7r: well, but that firewall issue can lead to something like an openvpn server/client not being able to reach each other in the first place ?
06:16 < s7r> ifconfig -a | grep tun
06:16 < s7r> let us know the output
06:17 < DIgitalFlux> yes, tun0 is there
06:17 < DIgitalFlux> tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
06:17 < s7r> so it's not an openvz issue, it's something from firewall
06:17 < s7r> deactivate the firewall on client-side also
06:17 < s7r> and run iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <your ip>
06:17 < s7r> as the bot told you above
06:17 < s7r> than iptables-save
06:18 < s7r> and run /etc/init.d/openvpn restart
06:18 < s7r> i assume you did /etc/init.d/openvpn restart
06:18 < s7r> after you changed the configs?
06:18 < DIgitalFlux> s7r: yup of course :)
06:18 < s7r> otherwise you are still trying with the old ones
06:18 < DIgitalFlux> s7r: you guys are so helpful for even a n00b ;)
06:19 < s7r> I am not much of a hacker myself DIgitalFlux :D but yesterday i had the same issue
06:19 < s7r> setting up openvpn on openvz
06:19 < s7r> and people here helped me
06:19 < s7r> now it's my turn to help
06:19 < DIgitalFlux> s7r: Cool !, perfect timing :)
06:19 < s7r> this is how community works :D
06:19 < DIgitalFlux> OK stopped that firewall on OSX
06:19 < DIgitalFlux> Let recheck everything ..
06:20 < DIgitalFlux> by <your ip>, you mean the public ip address of the openvz node, correct ?
06:20 < s7r> yeah
06:20 < s7r> venet0:0 interface
06:20 -!- durando [~durando@cpe-76-178-226-137.maine.res.rr.com] has joined #openvpn
06:20 < s7r> but do not type interface name
06:20 < s7r> type IP directly
06:20 < DIgitalFlux> s7r: OK, trying that out
06:20 < durando> hey guys i think i finally got my openvpn setup correctly but i cant seem to ping all computers on both sides of the network someone told me this is normal?
06:21 < s7r> it depends how you configured
06:22 < Bushmills> !route
06:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
06:22 < Bushmills> !clientlan
06:22 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
06:22 <@vpnHelper> better explanation
06:22 < Bushmills> !serverlan
06:22 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
06:23 < s7r> durando: for example i have openvpn just to route traffic and i can not ping any of other clients
06:23 < s7r> i can only ping the server :)
06:23 < s7r> this totally depends on how you configured 
06:24 < durando> okay i've read that and my noob brain cant wrap it lol, what i did was on the server side i set the client subnet 10.50.2.x to push with client-client
06:24 < DIgitalFlux> Hmm .. ok the server
06:24 < DIgitalFlux> after directly restarting the daemon
06:24 < DIgitalFlux> i see some permissions denied errors
06:24 < DIgitalFlux> http://pastebin.com/nr5rCXxY
06:24 < DIgitalFlux> Is that normal ?
06:24 < durando> sorry i set the client router address 10.50.2.1
06:25 < durando> not .x
06:25 < s7r> DIgitalFlux: that is normal when you run multiple daemons
06:25 < s7r> but it says exiting at the end which is never good
06:25 < s7r> do you have multiple daemons ?
06:30 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
06:31 -!- DIgitalFlux [~DigitalFl@41.237.238.253] has joined #openvpn
06:31 -!- DIgitalFlux [~DigitalFl@41.237.238.253] has quit [Changing host]
06:31 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
06:31 < DIgitalFlux> s7r: Yup, I was disconnected :)
06:31 < DIgitalFlux> probably because of bad routes ..
06:32 < s7r> because in the second server config
06:32 < s7r> you have to have the line daemon
06:32 < s7r> and other pool
06:32 < s7r> eg instead of 10.8.0.0 try 10.7.0.0
06:32 < s7r> in second server
06:34 < DIgitalFlux> in second server ?
06:34 < DIgitalFlux> in the server node you mean ? :)
06:36 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p9955>
06:37 -!- ahmedelgamil [~DigitalFl@41.237.238.253] has joined #openvpn
06:37 < ahmedelgamil> s7r: on the server node, the interface shows something like this -> inet addr:10.7.0.1  P-t-P:10.7.0.2
06:37 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Read error: Connection reset by peer]
06:38 < ahmedelgamil> s7r: and on the client node it shows inet 10.7.0.6 --> 10.7.0.5
06:40 < s7r> yes iti s normal
06:40 < s7r> the second server conf should have tun1 instead of tun0 dev
06:40 < s7r> and other ip pool
06:41 < ahmedelgamil> s7r: if you mean by "server" -> a 2nd daemon, then no i only have one daemon running
06:41 < ahmedelgamil> s7r: what i want to achieve is to tunnel all of my intenet traffic through that VPN node but i also need to access my local machines ;)
06:41 -!- ahmedelgamil is now known as DigitalFlux
06:41 -!- DigitalFlux [~DigitalFl@41.237.238.253] has quit [Changing host]
06:41 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
06:42 < DigitalFlux> s7r: got it ?
06:45 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Remote host closed the connection]
06:46 < s7r> you need all clients to access each other
06:46 < s7r> ?
06:49 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
06:49 < DIgitalFlux> s7r: so basically, i can now do everything except dns queries :)
06:50 < DIgitalFlux> s7r: I can ping the openvpn server node and also my local network nodes
06:50 < s7r> and why dns queries do not work ?
06:50 < s7r> you have configured proper dns serverS?
06:50 < DIgitalFlux> s7r: however dns requests don't pass
06:50 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
06:50 < DIgitalFlux> I'm using google's 8.8.8.8.
06:50 < s7r> are you sure it's not a firewall issue?
06:50 < s7r> try opendns
06:50 < s7r> 208.67.222.222 and 208.67.220.220
06:50 < DIgitalFlux> s7r: ok checking ..
06:52 <@vpnHelper> RSS Update - forum: Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9956>
06:52 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Client Quit]
06:52 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
06:53 < DIgitalFlux> so basically it's redirecting all of the traffic to my local machine
06:53 < DIgitalFlux> ip_forwarding has to be activate on the client node too ?
06:53 < DIgitalFlux> s7r: ?
06:53 < s7r> no
06:53 < s7r> client has nothing to do with routing / forwarding
06:58 <@vpnHelper> RSS Update - forum: Works after install dies after reboot MD5 missing? <http://forums.openvpn.net/topic7689.html#p9957>
07:10 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has joined #openvpn
07:13 -!- durando [~durando@cpe-76-178-226-137.maine.res.rr.com] has quit [Quit: Leaving.]
07:14 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 264 seconds]
07:22 -!- DIgitalFlux [~DigitalFl@41.237.238.253] has joined #openvpn
07:22 -!- DIgitalFlux [~DigitalFl@41.237.238.253] has quit [Changing host]
07:22 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
07:22 < DIgitalFlux> s7r: Hi
07:23 < DIgitalFlux> s7r: So i can now ping and do almost everything
07:23 < DIgitalFlux> s7r: however looks like all of my http requests are redirected to the webserver installed on the same node that hosts the openvpn server :)
07:23 < DIgitalFlux> s7r: so basically going to whatever.com just redirects me to my web server !
07:24 < DIgitalFlux> s7r: problem with that iptables rule you paste may be ?
07:24 < s7r> i don' think so
07:24 < s7r> that is a NAT
07:24 < DIgitalFlux> s7r: hmm
07:25 < DIgitalFlux> S7r: can you please tell me if there is any other rules in your nat table ?
07:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
07:30 < s7r> sorry i was on the phone
07:30 < s7r> I have a single rule
07:30 < DIgitalFlux> s7r: np
07:30 < DIgitalFlux> I wonder what could cause such behaviour !
07:31 < s7r> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source <vps IP>
07:31 < DIgitalFlux> But i have to say i'm still suspecting that iptables rule
07:31 < DIgitalFlux> Ah it's SNAT not DNAT :)
07:32 < DIgitalFlux> s7r: that's a different rule from that one that you paste before, no ?
07:32 -!- cchekie [~Bush@84.235.14.36] has joined #openvpn
07:33 < cchekie> can i find openvpn server software rpm for centos
07:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:35 < s7r> yes
07:35 < s7r> DIgitalFlux: 
07:35 < s7r> the rules i pasted first was from vpnHelper and this one is the one i actually have on my box
07:36 < cchekie> where exactly?
07:37 -!- ahmedelgamil [~DigitalFl@109.169.67.71] has joined #openvpn
07:38 < ahmedelgamil> s7r: Thanks man, it's working just fine now ;)
07:39 -!- cchekie [~Bush@84.235.14.36] has left #openvpn []
07:39 < s7r> ahmedelgamil: u DIgitalFlux ?
07:39 < s7r> :D
07:40 < s7r> sorry it took me long to reply your questions but i was on the phone arguing
07:40 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
07:42 < ahmedelgamil> s7r: Come on man, i actually must pay you :P, Thanks again
07:43 < s7r> np
07:43 -!- clyons [~clyons@unaffiliated/clyons] has joined #openvpn
07:43 < s7r> stick around here
07:43 < s7r> maybe you can help someone at your turn :D
07:43 < ahmedelgamil> s7r: i actually read a whole book about OpenVPN before ! but that was long ago
07:43 -!- ahmedelgamil is now known as DigitalFlux
07:43 -!- DigitalFlux [~DigitalFl@109.169.67.71] has quit [Changing host]
07:43 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
07:43 < DigitalFlux> time to refresh those skills
07:45 < s7r> yep
07:45 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Read error: Connection reset by peer]
07:45 < s7r> what OS you have on your VPS?
07:45 < s7r> who manages vpnHelper there is a bug with iptables rule , i have the correct one
07:54 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
07:59 -!- DIgitalFlux [~DigitalFl@109.169.67.71] has joined #openvpn
07:59 -!- DIgitalFlux [~DigitalFl@109.169.67.71] has quit [Changing host]
07:59 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
08:02 -!- DIgitalFlux is now known as DigitalFlux
08:06 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Quit: Leaving]
08:19 < echoSMILE> is possible I define the server ip range the same on openvpn is running?
08:26 <@vpnHelper> RSS Update - forum: Works after install dies after reboot MD5 missing? <http://forums.openvpn.net/topic7689.html#p9958>
08:27 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has quit [Read error: Operation timed out]
08:30 -!- drax2gma [~gma@fibhost-66-157-44.fibernet.hu] has left #openvpn ["WeeChat 0.3.4"]
08:33 -!- DigitalFlux is now known as DigitalFlyx
08:33 -!- DigitalFlyx is now known as DigitalFlux
08:35 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Read error: Connection reset by peer]
08:37 -!- Andre___ [~f0rd42@p54BE4CC3.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
08:40 -!- DigitalFlyx [~DigitalFl@109.169.67.71] has joined #openvpn
08:44 -!- Andre__ [~f0rd42@p54BE367A.dip.t-dialin.net] has joined #openvpn
08:44 -!- Andre__ is now known as Guest37673
08:46 -!- copkiller [~o2@unaffiliated/spice] has quit [Ping timeout: 250 seconds]
08:48 < steve> if I have a private subnet masqueraded into tap0 which then runs over my openvpn tunnel to a public-accessible IP with a bridge on the other end of the VPN, is there any risk that the public IP could be used to access SMB shares and other private data on the masqueraded private subnet on the client side of the VPN?
08:48 < steve> or does the access stop at the public IP assigned to the client?
08:49 -!- copkiller [~o2@unaffiliated/spice] has joined #openvpn
08:50 -!- EugeneKaway is now known as EugeneKay
08:51 -!- luneff [~yury@84.51.197.93] has joined #openvpn
08:52 -!- DigitalFlyx [~DigitalFl@109.169.67.71] has quit [Ping timeout: 240 seconds]
08:53 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
09:04 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Write error: Connection reset by peer]
09:11 -!- fipu [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has joined #openvpn
09:11 < fipu> Hi!
09:12 < mete> miöngiii!!
09:12 < fipu> My openVPN Network Adapter is set to only 10 Mbit/s. Is that he maximum speed from the VPN tunnel? How can I increase it?
09:12 < fipu> mete: miiiiöööngiiii
09:13 < s7r> fipu: that is the speed for tun/tap driver 
09:13 < s7r> it has nothing to do with your real sped
09:13 < s7r> it is just there but you can get evem 1gbps if the other physical NIC and connection allow you
09:13 < s7r> of course, it was just an example 
09:14 < fipu> ok good
09:14 < fipu> because I have a 100 Mbit connection (up/down) to the internet. It's a dedicated server.
09:14 < fipu> s7r: Thank you for information.
09:15 < s7r> the 10mbit has no relevance fipu :)
09:15 < s7r> it is just how your OS sees the virtual adapter but the real speed is not affected
09:15 < s7r> it can be more or less
09:16 < s7r> depending on other factors
09:16 < s7r> and fipu you have 100mbit PORT speed - that does not mean you will actually download with 100mbit
09:16 < fipu> perfect :)
09:16 < s7r> it's not guaranteed speed
09:16 < s7r> however dedicated servers have speeds far above your needs :p
09:16 < s7r> so you are OK
09:16 < fipu> s7r: I know, it is 95 Mbit (ipferf)...
09:17 -!- zeshoem [~mnathani@bas1-toronto46-1177980326.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
09:17 < fipu> yes :D
09:25 < s7r> !linnat
09:25 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
09:25 -!- swills [~swills_@unaffiliated/steve/x-520345] has joined #openvpn
09:26 < swills> i have openvpn up and working. when clients connect, they can ping, etc. but they disconnect and reconnect, then they can't. i've found that if i delete their entry from the arp table, then it starts working. what can i do to prevent the problem?
09:28 < swills> Feb 26 10:26:34 dribble kernel: arp_proxy: ignoring request from 10.12.0.26 via tap0, expecting bce3
09:28 < swills> i get messages like that in logs
09:36 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
09:36 -!- WormFood [~wormfood@183.38.238.22] has quit [Ping timeout: 276 seconds]
09:48 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:50 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
--- Log closed Sat Feb 26 09:57:15 2011
--- Log opened Sat Feb 26 11:00:39 2011
11:00 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
11:00 -!- Irssi: #openvpn: Total of 130 nicks [5 ops, 0 halfops, 0 voices, 125 normal]
11:00 -!- EmperorTom [~EmperorTo@216.17.68.153] has joined #openvpn
11:01 -!- Irssi: Join to #openvpn was synced in 46 secs
11:03 -!- crazed [~crazed@unaffiliated/cr4z3d] has quit [Ping timeout: 260 seconds]
11:06 -!- DIgitalFlux [~DigitalFl@109.169.67.71] has joined #openvpn
11:06 -!- DIgitalFlux [~DigitalFl@109.169.67.71] has quit [Changing host]
11:06 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
11:13 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
11:17 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
11:28 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
12:02  * s7r http://www.youtube.com/watch?v=0uOjVw5w0Nk&feature=related -- nice ringtone for your mobile :)
12:02 <@vpnHelper> Title: YouTube - Gannicuss cock rages on! (at www.youtube.com)
12:15 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Quit: No Ping reply in 180 seconds.]
12:16 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
12:19 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
12:19 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
12:24 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has joined #openvpn
12:33 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
12:33 -!- 45PABT3DD is now known as areq
12:38 -!- Blues-Man [~bluesman@host199-112-dynamic.47-79-r.retail.telecomitalia.it] has joined #openvpn
12:48  * Blues-Man good blues bye
12:48 -!- Blues-Man [~bluesman@host199-112-dynamic.47-79-r.retail.telecomitalia.it] has quit [Read error: Connection reset by peer]
12:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
13:06 -!- DIgitalFlux [~DigitalFl@41.206.156.192] has joined #openvpn
13:06 -!- DIgitalFlux [~DigitalFl@41.206.156.192] has quit [Changing host]
13:06 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
13:11 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 272 seconds]
13:14 -!- albech [~thomas@61.7.130.12] has quit [Quit: Ex-Chat]
13:24 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 250 seconds]
--- Log closed Sat Feb 26 13:33:21 2011
--- Log opened Sat Feb 26 13:33:26 2011
13:33 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
13:33 -!- Irssi: #openvpn: Total of 129 nicks [5 ops, 0 halfops, 0 voices, 124 normal]
--- Log closed Sat Feb 26 13:34:58 2011
--- Log opened Sat Feb 26 13:38:26 2011
13:38 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
13:38 -!- Irssi: #openvpn: Total of 129 nicks [5 ops, 0 halfops, 0 voices, 124 normal]
13:38 -!- EmperorTom [~EmperorTo@216.17.68.153] has joined #openvpn
13:39 -!- Irssi: Join to #openvpn was synced in 46 secs
--- Log closed Sat Feb 26 13:42:40 2011
--- Log opened Sat Feb 26 13:43:27 2011
13:43 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
13:43 -!- Irssi: #openvpn: Total of 130 nicks [5 ops, 0 halfops, 0 voices, 125 normal]
13:44 -!- Irssi: Join to #openvpn was synced in 46 secs
--- Log closed Sat Feb 26 13:45:31 2011
--- Log opened Sat Feb 26 17:29:24 2011
17:29 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
17:29 -!- Irssi: #openvpn: Total of 132 nicks [4 ops, 0 halfops, 0 voices, 128 normal]
17:29 -!- EmperorTom [~EmperorTo@216.17.68.153] has joined #openvpn
17:30 -!- Irssi: Join to #openvpn was synced in 47 secs
17:33 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 240 seconds]
17:46 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
17:51 < s7r> can i use openvpn inside a vmware container or it's the same shit as openvz ?
18:01 < EugeneKay> OpenVPN works fine inside vmware
18:01 < EugeneKay> Because vmware actually is virtuallization, not containerization
18:01 < EugeneKay> VMware handles the virtual NICs "like a boss"
18:02 < s7r> EugeneKay: it's different than openvz ?
18:02 < EugeneKay> Totally different
18:02 < s7r> because on openvz i needed to contact the vps provider for enabling tun/tap devices
18:02 < s7r> no kernel issues on ubuntu inside vmware
18:02 < s7r> if i want to setup openvpn on it ?
18:02 < EugeneKay> None at all
18:03 < EugeneKay> It behaves, as far as the OS is concerned, near enough to real hardware as can be made
18:03 < s7r> wow
18:03 < s7r> what kind of hypervisor does it use ?
18:03 < EugeneKay> VMware.
18:03 < s7r> who does such a good job
18:04 < s7r> you are talking about the esxi product or the vshepre ?
18:04 < EugeneKay> All vmware products.
18:04 < s7r> or all of them do the virtualization the same ?
18:04 < s7r> thank yoiu EugeneKay 
18:04 < EugeneKay> They all use the same "client" drivers
18:04 < s7r> a proffessional opinion is always great
18:04 < s7r> i didn't know 
18:04 < s7r> and i wanted to find out more about vmware 
18:04 < EugeneKay> You can build a VM in workstation(or Player, or Fusion), zip it up, upload it to an ESX or ESXi or Server instance, unzip it, and run it
18:05 < s7r> because in case it was something like openvz shit it was not good for my goals...
18:05 < EugeneKay> You'll get a dialog box asking if "The VM has been copied or moved"
18:05 < EugeneKay> And then it boots
18:05 < EugeneKay> Assuming you have matching hardware - x86 / 64, with AMD-V / VT-x turned on
18:05 <@vpnHelper> RSS Update - forum: Expected Results Unobtainable! HELP! <http://forums.openvpn.net/topic7692.html>
18:06 < EugeneKay> There's really no reason to NOT use x64, with the virtuallization extensions turned on, nowadays
18:07 < s7r> x64 on the guest os 
18:07 < EugeneKay> There are some limitations with the less-popular products, Server and Player in particular, concerning the usage of newer versions of VMware TOols
18:07 < s7r> or on the virtual machines?
18:07 < EugeneKay> Guest = the vm
18:08 < s7r> yep
18:08 < s7r> and host - physical server where vm is located
18:08 < s7r> you said never use x64
18:08 < s7r> where should we never use x64 on guest or host ?
18:08 < EugeneKay> Always use x64
18:08 < s7r> oh always
18:08 < s7r> sorry man
18:08 < EugeneKay> The Virtuallization Extensions for modern CPUs, VT-X and AMD-V, give a lot more performance than you would have with them off(or on x86)
18:09 < s7r> basically all vmware products are compatible with each other - for example a machine configured on windows 7 with vmware workstation can be zipped and moved later to an esxi server ?
18:09 < EugeneKay> It has to do with cpu-ring code rewriting for the guest kernels
18:09 < EugeneKay> YUp.
18:09 < EugeneKay> It "just works"
18:09 < reiffert> thats wrong.
18:09 < s7r> even if the cpu is not 64 bit ?
18:10 < reiffert> e.g. OS X 10.6 works on Vmware Player, where it does not with Vmware Server.
18:10 < EugeneKay> reiffert - I just said that Server/Player have problems with some guests' tools
18:10 < EugeneKay> s7r - the host CPU will need to be x64, with AMD-V or VT-x, in order for it to work
18:11 < s7r> AMD-V is a special processor for virtualization ?
18:11 < EugeneKay> If your host CPU doesn't support those instructions, go buy a new one, because you're using an antique
18:11 < reiffert> I think that the major reason is the old VMServer release. 1.5 years old without any recent fixes.
18:11 < EugeneKay> It's an extension to the x64 spec
18:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
18:11 < EugeneKay> Server is an abandoned product, near as I can tell
18:11 < reiffert> Any successor?
18:12 < EugeneKay> Nope.
18:12 < s7r> vmware have too many damn products
18:12 < s7r> why don't they stick just to esxi and 
18:12 < EugeneKay> All of their vSphere shit you can ignore, by and large. It's just enterprisey crap
18:12 < reiffert> s7r: because they follow different approaches to virtualisation.
18:12 < s7r> yeah but the base is the same - the hypervisor is the same 
18:12 < s7r> at all products
18:12 < EugeneKay> Workstation is for boxen with a KB/Mouse, ESX/i is for bare metal.
18:12 < s7r> all of them handle machines the same
18:13 < reiffert> s7r: thats not correct.
18:13 < EugeneKay> Player, ACE and their kin are stripped-down Workstations
18:13 < EugeneKay> vSphere and such is just plugins to ESX/i
18:13 < s7r> vcentger
18:13 < s7r> they have a lot of shit
18:13 < EugeneKay> vCenter is management
18:13 < s7r> i know reiffert that esxi can be installed directly on bare metal
18:13 < s7r> and workstation needs to be on host OS
18:13 < reiffert> s7r: see, totally different approaches.
18:13 < s7r> but i was reffering that they handle the virutal machines the same
18:13 < s7r> after installed
18:14 < EugeneKay> The compatibility layer is the same, yup.
18:14 < s7r> and the way they handle resources  / kernel stuff
18:14 < s7r> is the same from esxi to workstation
18:14 < s7r> but they are totally different prodiucts with different goals as reiffert sahs
18:14 < s7r> says*
18:15 < EugeneKay> Ayup.
18:15 < EugeneKay> I use Workstation to build my VMs, then upload them to my NFS server, unzip it, and load it in ESXi
18:15 < reiffert> s7r: they even handle virtualisation itself in a different way.
18:16 < s7r> what do you mean reiffert i thought the basic was the same - vmware hypervisor :D
18:16 < reiffert> s7r: one is talking to the host hardware with a highly optimized way, the other needs to walk through the host OS api.
18:16 < EugeneKay> reiffert - In terms of how ring 0 code is handled, yes, they are slightly different. But the 7.x vmx format is compatible without conversion.
18:16 < EugeneKay> The guest doesn't need any changes made.
18:16 < EugeneKay> It "just works"
18:17 < reiffert> EugeneKay: sure, no doubt about that.
18:18 < s7r> reiffert: you mean that esxi is talking with the metal directly and since it's made for virtualization it handles resources in a better way than workstation
18:18 < EugeneKay> Less layers in the way
18:18 < s7r> which has to go via the host OS kernel which is not special for virtualization
18:18 < reiffert> jup
18:19 < s7r> totally right here - no doubt about this
18:19 -!- sayuke [~crc@149.171.12.61] has joined #openvpn
18:19 < EugeneKay> ESXi Guests have a ~10% loss in performance compared to running the application directly on the bare metal. Workstation is closer to 25%
18:19 < s7r> but i assume esxi can be installed on bare metal but on an enterprise server
18:19 < s7r> not on a home computer with 4gb of ram and amd processor 
18:19 < s7r> that is why workstation exists
18:20 < EugeneKay> ESXi runs fine on the Asus mobo and Core i7 under my desk
18:20 < EugeneKay> It's not certified for it, but it runs.
18:20 < EugeneKay> If you tear apart ESX/i, you'll find a very, very altered Red Hat
18:20 < s7r> EugeneKay: one more q
18:20 < s7r> the servers with a single NIC
18:20 < s7r> even if it is gigabit
18:21 < s7r> isn't any performance penality when virtualizing it ?
18:21 < s7r> if you have an 100mbps NIC, and 10 vms on the server than you can give MAX 10 mbps to each?
18:21 < EugeneKay> The NIC presented to the guest is always "Gigabit"
18:22 < EugeneKay> Actual throughput out the physical port is limited by line speed
18:22 < s7r> yes i know that even if you have a gigabit NIC it depends on your connection  . line
18:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:23 < s7r> but in case the line really provides you as much as the NIC can carry
18:23 < s7r> how the virtualization stuff affects it
18:23 < EugeneKay> I've maxed out 2xGbE ports bonded together
18:23 < EugeneKay> TO a vm
18:23 < EugeneKay> Without notable cpu load for the networking stack
18:24 < s7r> how did you maxed out 2x gigabit ethernet in a vm ?
18:24 < s7r> both of them are on the same physical server?
18:25 < EugeneKay> ESXi, bonded physical NICs to my switch, running perfstat to my NetApp
18:25 < EugeneKay> I can also do the same trick with one NIC on Workstation to the file server under my desk
18:26 < s7r> but in case there are more machines on a NIC
18:26 < s7r> virtualized there
18:26 < s7r> isn't any penality of performance ?
18:26 < s7r> regarding link speed
18:26 < EugeneKay> Not really, no.
18:27 < EugeneKay> I don't make a habit of exceeding the line speed on my NICs
18:28 < EugeneKay> UT3 beckons
18:28 -!- EugeneKay is now known as EugeneGaming
18:31 < s7r> cheerrs EugeneGaming and reiffert - > going to bed 
18:31 < mete> ambro718: about 20ms, normal it is 15ms
18:32 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
18:37 -!- sayuke [~crc@149.171.12.61] has quit [Ping timeout: 246 seconds]
18:41 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
18:45 < ambro718> mete: seems your OS has problems forwarding, and you're using OpenVPN's "net30" topology. You may be able to work around it by using the "subnet" topology.
18:47 -!- sayuke [~crc@149.171.12.61] has joined #openvpn
18:51 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
19:00 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
19:02 -!- sayuke [~crc@149.171.12.61] has quit [Ping timeout: 250 seconds]
19:03 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
19:04 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
19:15 -!- sayuke [~crc@149.171.12.61] has joined #openvpn
19:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
19:18 -!- WormFood [~wormfood@183.39.81.182] has joined #openvpn
19:25 < echoSMILE> I'm new to openvpn. On client can I use client.key and be questioned for a password on client?
19:29 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
19:30 < EugeneGaming> Yes.
19:32 < echoSMILE> thanks. and imagine my openvpn server are on 192.168.1.0 lan, can I remain that mask for clients too ?
19:43 < fipu> Hi
19:43 < fipu> Have a strange problem with openvpn
19:44 < fipu> if i upload a file to an other client the connection stucks all ~ 10 seconds
19:44 < fipu> ping loss
19:44 < fipu> and upload timeout
19:44 < fipu> after about 3-5 sec the upload continues and ping also
19:45 < fipu> in the same moment I can ping an other VPN-Client with no ping loss
19:52 < fipu> can someone help me?
19:57 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
20:16 -!- EugeneGaming is now known as EugeneKay
20:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:36 -!- aar0n [~aar0nsky@d47-69-246-113.try.wideopenwest.com] has joined #openvpn
20:40 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
20:40 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
20:44 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
20:45 -!- luneff [~yury@84.51.197.93] has joined #openvpn
20:45 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 264 seconds]
20:53 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
20:53 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
20:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:53 < fipu> if i upload a file to an other client the connection stucks all ~ 10 seconds
20:54 < fipu> ping loss
20:54 < fipu> and upload timeout
20:54 < fipu> after about 3-5 sec the upload continues and ping also
20:54 < fipu> in the same moment I can ping an other VPN-Client with no ping loss
21:06 -!- master_of_master [~master_of@p57B57BBA.dip.t-dialin.net] has quit [Read error: Operation timed out]
21:10 -!- master_of_master [~master_of@p57B5753F.dip.t-dialin.net] has joined #openvpn
--- Log closed Sat Feb 26 21:15:39 2011
--- Log opened Sat Feb 26 21:48:21 2011
21:48 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
21:48 -!- Irssi: #openvpn: Total of 131 nicks [4 ops, 0 halfops, 0 voices, 127 normal]
--- Log closed Sat Feb 26 21:48:37 2011
--- Log opened Sat Feb 26 21:48:46 2011
21:48 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
21:48 -!- Irssi: #openvpn: Total of 131 nicks [4 ops, 0 halfops, 0 voices, 127 normal]
21:49 -!- Irssi: Join to #openvpn was synced in 36 secs
21:49 -!- sayuke [~crc@149.171.12.61] has quit [Ping timeout: 250 seconds]
21:59 <@vpnHelper> RSS Update - forum: Connects no errors but no data goes through tunnel <http://forums.openvpn.net/topic7694.html>
21:59 -!- theDoc [~Link@110.92.103.180] has joined #openvpn
22:00 < theDoc> krzee: You around?
22:01 -!- needhelp1 [~needhelp1@unaffiliated/needhelp1] has joined #openvpn
22:01 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:02 < theDoc> say guys, anyone familiar with routing networks over a tun and tap adapter?
22:02 -!- needhelp1 [~needhelp1@unaffiliated/needhelp1] has quit [Client Quit]
22:02 < theDoc> I need to push all traffic to a particular subnet over the tap adapter and the rest over the tun adapter.
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:06 -!- needhelp1 [~needhelp1@unaffiliated/needhelp1] has joined #openvpn
22:10 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:10 < needhelp1> would it be ok if i ask some questions regarding a VPN service 
22:11 < theDoc> needhelp1: Yeah.
22:12 < needhelp1> if i wanted to surf the internet anonymously, using tor, i need to encrypt my connection starting from my computer, this is where the VPN come into play correct?
22:12 < theDoc> Yes.
22:13 < needhelp1> so, if im encrypting my info, and lets say im trying to access facebook, or posting on my wall, how can facebook decrypt my encrypted data? Or is it just the pipe that the data flows through that is encrpted ?
22:16 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
22:21 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:22 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Client Quit]
22:55 -!- theDoc [~Link@110.92.103.180] has quit [Ping timeout: 240 seconds]
22:56 -!- theDoc [~Link@110.92.103.180] has joined #openvpn
22:58 -!- EugeneKay is now known as EugeneKaway
23:01 -!- theDoc [~Link@110.92.103.180] has quit [Changing host]
23:01 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
--- Day changed Sun Feb 27 2011
00:12 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
00:12 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Ping timeout: 260 seconds]
00:12 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 260 seconds]
00:14 -!- d457k [~heiko@vpn.astaro.de] has joined #openvpn
00:15 -!- Bzek [~SK@access-46-42-32-134.kmtn.ru] has quit [Read error: Connection reset by peer]
00:16 -!- Bzek [~SK@access-46-42-29-225.kmtn.ru] has joined #openvpn
00:33 -!- albech [~thomas@61.7.130.12] has joined #openvpn
00:37 -!- DIgitalFlux [~DigitalFl@41.233.216.82] has joined #openvpn
00:37 -!- DIgitalFlux [~DigitalFl@41.233.216.82] has quit [Changing host]
00:37 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
00:39 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
00:39 -!- VUNiqpxg [steve@bouncer.stephen.marsh.name] has joined #openvpn
00:40 -!- Netsplit *.net <-> *.split quits: krzee, jwm, steve, needhelp1
00:42 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
00:44 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 272 seconds]
00:45 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
00:45 -!- Netsplit over, joins: jwm
00:46 -!- Netsplit over, joins: needhelp1
00:47 -!- needhelp1 [~needhelp1@unaffiliated/needhelp1] has left #openvpn ["Leaving"]
00:49 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
01:06 -!- DigitalFlyx [~DigitalFl@41.233.216.82] has joined #openvpn
01:09 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Read error: Connection reset by peer]
01:10 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
01:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:25 -!- albech_ [~thomas@124.157.202.17] has joined #openvpn
01:25 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
01:26 -!- stony is now known as Guest49899
01:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
01:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:28 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
01:28 -!- albech [~thomas@61.7.130.12] has quit [Ping timeout: 240 seconds]
01:48 -!- WormFood [~wormfood@183.39.81.182] has quit [Ping timeout: 240 seconds]
01:48 -!- WormFood [~wormfood@183.15.99.95] has joined #openvpn
02:01 -!- DigitalFlyx [~DigitalFl@41.233.216.82] has quit [Ping timeout: 240 seconds]
02:03 -!- DIgitalFlux [~DigitalFl@41.233.216.82] has joined #openvpn
02:03 -!- DIgitalFlux [~DigitalFl@41.233.216.82] has quit [Changing host]
02:03 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
02:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:04 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 251 seconds]
02:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:15 -!- zeshoem [~mnathani@bas1-toronto46-1177980372.dsl.bell.ca] has joined #openvpn
02:19 -!- clyons [~clyons@unaffiliated/clyons] has quit [Ping timeout: 240 seconds]
02:32 < Bushmills> wow, great idea to encrypt requests such that the remote side can't understand them anymore.
02:32 -!- aar0n [~aar0nsky@d47-69-246-113.try.wideopenwest.com] has quit [Remote host closed the connection]
02:48 < hyper_ch> hi Bushmills - are you being sarcastic?
02:59 < Bushmills> did it sound like i was?
03:01 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
03:05 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
03:05 < reiffert> na, it sounded just like a normal Bushmills.
03:06 < Bushmills> yes, my plain old acrid me
03:10 < hyper_ch> Bushmills: well, there are no sarcasm tags yet for irc so I can't really know for sure until I ask
03:11 < Bushmills> you were about to explain me why that kind of encryption would be a bad idea?
03:12 < hyper_ch> I just caught your phrase out of previous context and it sounds sarcastic
03:12 < Bushmills> ah. context was:   (05:13:41) needhelp1: so, if im encrypting my info, and lets say im trying to access facebook, or posting on my wall, how can facebook decrypt my encrypted data? Or is it just the pipe that the data flows through that is encrpted ?
03:13 < Bushmills> well, he didn't ask "if my data was sent encrypted, how come that everybody can read it after i posted it to the wall"
03:16 < hyper_ch> i see
03:30 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
03:33 <@vpnHelper> RSS Update - forum: Connects no errors but no data goes through tunnel <http://forums.openvpn.net/topic7694.html#p9962>
03:57 -!- Guest37673 [~f0rd42@p54BE367A.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
04:05 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
04:09 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
04:12 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
04:42 < fipu> Good morning!
04:42 < fipu> if i upload a file to an other client the connection stucks all ~ 10 seconds
04:42 < fipu> ping loss and upload timetout
04:42 < fipu> after about 3-5 sec the upload continues and ping also
04:42 < fipu> in the same moment I can ping an other VPN-Client with no ping loss
04:42 < fipu> What can be the problem?
05:03 < Bushmills> connection stuck for 10 seconds, but after 3-5 seconds it continues?
05:04 < Bushmills> 3-5 seconds after the 10 seconds stuck?
05:04 < Bushmills> or does it continue while still stuck?
05:20 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Ping timeout: 250 seconds]
05:43 -!- Guest49899 is now known as stony
05:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:00 -!- Tobias| [tobias@202-6-153-16.static.adam.com.au] has joined #openvpn
06:01 < Tobias|> If I connect to my VPN, it seems to block all traffic that goes through it
06:01 < Tobias|> According to the two clients I've tried connecting to it, it fails quietly and every connection I try to make through it times out
06:02 < Tobias|> Ooh
06:03 < Tobias|> Could very well be just that I'm firewalling DNS
06:25 < Tobias|> Ah
06:26 < Tobias|> It appears that DNS just isn't getting through openvpn
06:26 < Tobias|> Everything else works
06:30 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has joined #openvpn
06:39 -!- MarKsaitis [~MarKsaiti@cpc1-pool5-0-0-cust249.15-1.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
06:42 < Bushmills> still using recursive name server of internet provider while redirecting all traffic through openvpn? 
06:52 < Tobias|> It's possible
06:52 < Tobias|> I just am using server.conf
06:52 < Tobias|> The example one
06:53 < Bushmills> what name server you has has nothing to do with the openvpn config. therefore also not with the example config
06:53 < Bushmills> you use ...
06:53 < Bushmills> (unless you push a different one than client uses otherwise) 
06:54 < Tobias|> o_o
06:54 < Tobias|> The server can resolve domains fine
06:54 < Tobias|> The client, sans openvpn, can resolve names fine
06:55 < Bushmills> still using recursive name server of internet provider while redirecting all traffic through openvpn?  (on client, that is)
06:55 < Tobias|> How can I determine this?
06:55 < Bushmills> did you change it to anything else?
06:56 < Tobias|> I haven't changed the DNS config from the original
06:56 < Tobias|> I did alter it, but then I reverted
06:57 < Bushmills> well, i guess you'll have to do with very general advise.  many isp providers don't permit use of their recursive name servers when those are queried from outside their own net - which is what is a likely consequence of redirecting traffic through an openvpn server
06:57 <@vpnHelper> RSS Update - forum: Connects no errors but no data goes through tunnel <http://forums.openvpn.net/topic7694.html#p9963>
06:58 < Bushmills> that "don't permit" manifests as "no reply"
06:59 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has joined #openvpn
06:59 < Tobias|> This will likely complicate things
06:59 < Tobias|> But the VPN I'm presently running is being connected directly to over my LAN
07:01 < Tobias|> Will that have significant bearing?
07:01 < Tobias|> I want to make sure the VPN is working prior to me needing access to it
07:01 < Tobias|> There are no IP conflicts
07:26 < echoSMILE> remote-cert-tls server <- here the 'server' string is what? I'm getting: Options error: Unrecognized option or missing parameter(s) in VPN.ovpn:12: remote-cert-tls
07:43 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
07:43 < echoSMILE> forget :)
07:46 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
07:57 -!- EugeneKaway is now known as EugeneKay
07:59 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
08:08 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
08:34 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
08:42 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
08:51 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
08:51 -!- mode/#openvpn [+o mattock] by ChanServ
08:52 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: Leaving.]
09:15 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p9964>
09:21 <@vpnHelper> RSS Update - forum: TCP connection stop working <http://forums.openvpn.net/topic7695.html>
09:33 <@vpnHelper> RSS Update - forum: Testing routing <http://forums.openvpn.net/topic7696.html>
09:39 <@vpnHelper> RSS Update - forum: Testing routing <http://forums.openvpn.net/topic7696.html#p9967>
09:47 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
09:47 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
09:48 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
09:50 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
09:50 -!- mode/#openvpn [+o mattock] by ChanServ
09:54 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:54 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
09:54 -!- mode/#openvpn [+o mattock1] by ChanServ
09:54 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
10:05 -!- WormFood [~wormfood@183.15.99.95] has quit [Ping timeout: 246 seconds]
10:09 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:18 -!- WormFood [~wormfood@183.39.76.207] has joined #openvpn
10:20 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Quit: Leaving...]
10:22 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:28 <@vpnHelper> RSS Update - forum: VLS error <http://forums.openvpn.net/topic7697.html>
10:30 < fipu> Bushmills: I made some tests
10:30 < fipu> the FTP-transfer does only stuck if I ping the destination client (FTP-Server)
10:30 < fipu> it stucks about 10 seconds and then ping and FTP-transfer continues
10:53 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
11:31 < fipu> Bushmills: arround?
11:35 < hjohnson> hmm.. hardware crypto on my alix is working well, though a bit odd
11:36 < hjohnson> but I was able to push 40mbps of encrypted traffic through the box, so I'm happy
11:37 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has left #openvpn []
11:41 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
11:41 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Excess Flood]
11:42 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
11:48 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has joined #openvpn
11:48 < techqbert> how do i migrate an openvpn server? just copy /etc/ ?
11:48 < krzie> "openvpn server"
11:49 < krzie> are you talking about access-server with web based config, or community version...?
11:53 < techqbert> community version krzie. originally i was running it on openvpn
11:53 < techqbert> opensolaris*
11:54 < techqbert> now i'm migrating to freebsd for ZFS
11:54 < krzie> then you have no default location for files, backup whatever dir(s) the files are in
11:57 < EugeneKay> You'll need your config file and the PKI
11:58 < EugeneKay> No clue where OpenSolaris keeps it, but I use /etc/openvpn/
12:20 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Remote host closed the connection]
12:29 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Remote host closed the connection]
12:47 < techqbert> okay guys i think the files are at /etc/csw/openvpn/
12:47 < techqbert> will do. thanks so much.
12:48 -!- albech_ [~thomas@124.157.202.17] has quit [Quit: Ex-Chat]
12:48 < techqbert> think i'll have more trouble w permissions across systems that i should just create new keys/certificates ?
12:50 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
12:58 -!- BobSapp [~genome@87-194-41-128.bethere.co.uk] has joined #openvpn
12:58 < BobSapp> !welcome
12:58 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
12:58 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:59 < BobSapp> !goal
12:59 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:59 < BobSapp> !howto
13:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:04 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
13:10 -!- mant1s [mant1s@141.114.212.38] has joined #openvpn
13:10 -!- mant1s [mant1s@141.114.212.38] has quit [Changing host]
13:10 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
13:11 -!- echoSMIL1 [~censured@2.83.211.113] has joined #openvpn
13:14 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 272 seconds]
13:41 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
13:45 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
13:49 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
13:58 < s7r> can an openvpn server listen on a ipv4 address and assign to a client when he connects an ipv6 one ?
14:00 < EugeneKay> Try that again, with more explanation
14:01 < s7r> I have a server with ipv6 and ipv4 connectivity. can i configure openvpn to listen on the ipv4 address and assign to the clients ipv6 addresses?
14:01 < s7r> or at least assign them both v4 and v6 to make some kind of dual stack clients :D
14:02 < EugeneKay> OpenVPN v6, as I understand it, needs a LOT of work yet.
14:02 < EugeneKay> So, I'm gonna say no, not really.
14:02 < Rienzilla> it can over tap, at least
14:02 < EugeneKay> Yeah but TAP causes cancer and eats babies
14:03 < EugeneKay> If you have relatively static links(site-to-site), you could do IPv4 and then run 6in4 tunnels between sites
14:03 < Rienzilla> nah, tap enables you to do awesome things and it also enables you destroy a lot :)
14:03 < Rienzilla> and it might kill your dog :)
14:03 < EugeneKay> I don't want "awesome", I want "works without much buggering-about"
14:04 < Rienzilla> oh I like awesome
14:05 -!- BobSapp [~genome@87-194-41-128.bethere.co.uk] has quit [Quit: Lost terminal]
14:06 < s7r> so openvpn v6
14:06 < s7r> is far away from being possible?
14:07 < EugeneKay> Possible, but not worth the bother is my understanding
14:08 < EugeneKay> I *think* it's being worked on for the next version
14:08 < s7r> yeah you are right if people do not request the need for it
14:08 < s7r> why bother...
14:09 < s7r> it will be issued when it will be requested  - when all isps will route ipv6 native
14:09 < EugeneKay> Which I don't have yet
14:09 < s7r> for the tunnels available now the effort does not worth it
14:09 < EugeneKay> The next 5-10 years are gonna be marked by IPv4 pains
14:09 < EugeneKay> Massive ones.
14:09 < s7r> it's to hard to swtich from ipv4 to v6 over the night
14:10 < s7r> but ripe for example has 2 more blocks or something like this
14:10 < s7r> in time it will be done
14:10 < EugeneKay> The last /8's were allocated this month
14:10 < s7r> i personally preffer ipv4 and i think i am going to stick to it
14:10 < EugeneKay> But there is still huge swaths within those blocks to be handed out
14:11 < s7r> yeah
14:11 < s7r> what is youir oinion EugeneKay is it reall much more better than v4 as RIRs make advertising ?
14:11 < s7r> or is just some marketing bullshit
14:11 < s7r> opinion*
14:12 < EugeneKay> IPv4 address space is a purely artificial economy
14:12 < EugeneKay> IPv6 makes it disappear
14:12 < EugeneKay> There are the basic costs for /64 and /48 allocation, but those are a pure token cost when you consider how many IPs are being talked about
14:13 < EugeneKay> The smallest block that is supposed to be allocated to a DSL line in IPv6, for example, is /64.
14:13 < EugeneKay> All of IPv4 would fit into a single /96 IPv6 block
14:15 < EugeneKay> Another HUGE reason to go to IPv6 is sane handling of multicasting
14:15 -!- echoSMIL1 [~censured@2.83.211.113] has quit [Changing host]
14:15 -!- echoSMIL1 [~censured@unaffiliated/echosmile] has joined #openvpn
14:15 -!- echoSMIL1 is now known as echoSMILE
14:16 < s7r> i dont really understand multicasting
14:16 < s7r> i have read on wikipedia technic specs
14:16 < s7r> but not really sure if it will be better than broadcasting
14:18 < EugeneKay> Routing is one of those things that nobody really understands
14:18 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
14:18 < EugeneKay> They know enough to do their job, though
14:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
14:30 -!- p3rror [~mezgani@41.248.185.9] has quit [Ping timeout: 240 seconds]
14:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:13 -!- s7r [~s7r@unaffiliated/s7r] has quit [Read error: Connection reset by peer]
15:21 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
15:27 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has joined #openvpn
15:28 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
15:40 -!- EmperorTom [~EmperorTo@216.17.68.153] has joined #openvpn
15:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:01 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has joined #openvpn
16:03 <@vpnHelper> RSS Update - forum: Testing routing <http://forums.openvpn.net/topic7696.html#p9972> || Connects no errors but no data goes through tunnel <http://forums.openvpn.net/topic7694.html#p9971> || Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p9970> || Assertion failed at crypto.c:162 <http://forums.openvpn.net/topic7677.html#p9969>
16:03 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 240 seconds]
16:03 -!- openbsdnoob_ is now known as openbsdnoob
16:05 -!- optiz0r [~optiz0r@miranda.sihnon.net] has quit [Ping timeout: 240 seconds]
16:05 -!- optiz0r [~optiz0r@miranda.sihnon.net] has joined #openvpn
16:06 -!- d457k [~heiko@vpn.astaro.de] has quit [Ping timeout: 240 seconds]
16:06 -!- d303k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
16:09 <@vpnHelper> RSS Update - forum: Is there Automatic certification file exchange ? <http://forums.openvpn.net/topic7690.html#p9974> || VLS error <http://forums.openvpn.net/topic7697.html#p9973>
16:15 <@vpnHelper> RSS Update - forum: Connects no errors but no data goes through tunnel <http://forums.openvpn.net/topic7694.html#p9975>
16:15 -!- sayuke [~crc@uservpn.orchestra.cse.unsw.EDU.AU] has quit [Ping timeout: 250 seconds]
16:18 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
16:23 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has quit [Quit: techqbert]
16:28 -!- clyons [~clyons@unaffiliated/clyons] has joined #openvpn
16:29 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has joined #openvpn
16:32 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
16:41 -!- sayuke [~crc@149.171.13.36] has joined #openvpn
16:51 < fipu> Hi!
16:55 -!- fipu_ [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has joined #openvpn
16:55 < fipu_> re
16:56 < fipu_> Connection lost -.-
16:56 < fipu_> Can someone help me with my vpn-problem?
16:56 < fipu_> I ping the Client that is FTP-Server
16:56 -!- fipu [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has quit [Ping timeout: 272 seconds]
16:56 < fipu_> ping to other client do not stuck
16:56 < fipu_> and if I do not ping the VPN-Client that is the FTP-Server, the connection does not stuck.
16:58 < fipu_> Bushmills: arround?
17:05 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <-]
17:11 -!- VUNiqpxg is now known as steve
17:15 < hjohnson> wow, ocf hardware crypto is interrupt happy
17:30 -!- KBobHEMP [nobody@hemp.ircpimps.org] has joined #openvpn
17:59 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
18:08 -!- knom [~Adium@189.217.39.163] has joined #openvpn
18:09 < knom> !welcome
18:09 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:09 < knom> !goal
18:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:12 < knom> goal: I would like to access the internet through my vpn.  I've installed it on a debian box, it says it started fine, but when I do a 'netstat -ntpl | grep 1194' nothing comes back
18:13 < knom> so I'm trying to figure how it could be starting without binding to a port or if I have to change something with iptables
18:17 -!- bitterman [~yury@84.51.197.93] has quit [Quit: Leaving]
18:20 < EugeneKay> Tail the logfile when you start the service
18:23 < knom> is there a default log file?
18:24 < EugeneKay> Syslog, I believe. You'll want to specify it manually with whatever the logging option is
18:26 < knom> was a different configuration problem
18:26 < knom> thank you
18:26 -!- optiz0r [~optiz0r@miranda.sihnon.net] has left #openvpn []
18:44 -!- silvertip257 [~silvertip@unaffiliated/silvertip257] has joined #openvpn
18:47 < silvertip257> Is it possible to inform the openvpn server of the subnet behind the openvpn client?  (I already use a push option to inform the client of subnets connected directly to the server.)
18:48 < silvertip257> !welcome
18:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:48 < silvertip257> !goal
18:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:57 < silvertip257> I did more reading on the Openvpn Howto docs and all I see is the mention of ccd files with iroutes (on client) and routes (on server).
18:57 < knom> Now I'm successfully connecting using TunnelBlick, but it doesn't appear that any traffic is being sent the VPN, shouldn't it happen automatically/did I miss a step? 
18:58 -!- Tobias| [tobias@202-6-153-16.static.adam.com.au] has left #openvpn ["~"]
18:58 < silvertip257> knom: can you ping the server?  If you're surfing the net through the openvpn server, then I believe you need to push the redirect gateway option.
18:59 < silvertip257> I guess it's not feasible for there to be an option to automatically have the client push information about subnet(s) that exist behind it.
19:01 < knom> silvertip257, thanks. I think I can ping it so I'll follow up with push the redirect gateway 
19:02 < silvertip257> knom: so you are intending to go from client to vpn to the Internet?
19:02 < knom> yes
19:03 < knom> silvertip257: I can ping the vpn gw ip but not my vpn ip
19:05 < silvertip257> knom: if you try pinging your client's vpn ip from it, it should be resolved locally.  Check your routes (`route -n` on Linux; I don't use OSX).
19:06 < silvertip257> wait vpn ip = the ip of the server over the point-to-point?
19:08 -!- nb is now known as CAcert
19:08 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
19:09 -!- CAcert is now known as nb
19:12 < knom> silvertip257: yes
19:13 < knom> there is a client side program for os x  that seems to handle changing the routing tables
19:13 < silvertip257> knom: Sounds like a firewall problem (on the server?).  But it very well could be a routing/firewall problem on the client.
19:15 < silvertip257> knom: The bottom of this section on the Howto (http://openvpn.net/index.php/open-source/documentation/howto.html#policy) shows example iptables rules ... have you set them on your server?
19:15 <@vpnHelper> Title: HOWTO (at openvpn.net)
19:18 < knom> silvertip257: I've just opened up the FORWARD tables while I trouble shoot this, but think problem has something to do with my local configuration 
19:27 < silvertip257> knom: I don't use Tunnelblick/OSX so I can't offer much help; my suggestion would be to run tcpdump on the server and client to determine what is happening.  Good luck.
19:29 < knom> silvertip257: it's a routing error having something do with the client side configuration.  After I've successfully connected I see this: tun0: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1500
19:29 < knom> 	inet 172.16.0.6 --> 172.16.0.5 netmask 0xffffffff 
19:29 < knom> 	open (pid 8786)
19:29 < knom> silvertip257: I don't know what 172.16.0.6 --> 172.16.0.5 means
19:30 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
19:31 < silvertip257> Run `ifconfig tun0` on the OSX client - make note of the inet address.  Run that same command on your server and make note of the inet address.  This will give both of us an idea of what your network topology is like.
19:31 < silvertip257> knom: that exact syntax doesn't mean much to me, but if you troubleshoot a bit we may uncover something.
19:31 < silvertip257> exact syntax with the -->
19:32 < knom> if I post (part) of the configs could it help?
19:36 -!- sayuke [~crc@149.171.13.36] has quit [Ping timeout: 252 seconds]
19:38 < silvertip257> knom: go for it > pastebin.com
19:43 < knom> silvertip257: http://pastebin.com/rchLezKh
19:45 < silvertip257> knom: nothing looks out of the ordinary to me on that.  What about your tun0 interface configuration?
19:46 < knom> silvertip257:  that's all there is
19:46 < silvertip257> did you run `ifconfig tun0` on both client and server to take a look?
19:47 < silvertip257> That way we will know what address your client was assigned.  The server should be 172.16.0.1, so try pinging that in addition to the tun0 interface configs.
19:50 -!- elux_ [~peter@bas15-toronto63-1279272685.dsl.bell.ca] has joined #openvpn
19:50 < knom> silvertip257: http://pastebin.com/EM5xddSn
19:51 < knom> I can ping  172.16.0.1 from both client and server
19:51 < knom> but all traffic is being routed through  172.16.0.5
19:51 < knom> which I can't ping from either
19:51 < silvertip257> knom: right, 172.16.0.5 is an end point of the /30 point to point connection
19:52 < knom> silvertip257: I don't know what that means exactly or how to fix it
19:52 < silvertip257> Essentially every OpenVPN tunnel requires 4 ip addresses.  Two for the tunnel, one is broadcast, and the other is your client (I believe).
19:53 < silvertip257> knom:  try pinging 172.16.0.6 from the server, that should be it I believe.
19:53 < silvertip257> it = the IP of your OSX client
19:53 < knom> nope
19:54 < knom> can't ping it
20:00 < silvertip257> knom: let's take a look at your ipp.txt file
20:00 < knom> foo1,172.16.0.4
20:01 < silvertip257> ok so .4 and .5 are likely the end points of the tunnel; your OSX client is .6, and .7 is broadcast
20:02 < silvertip257> You (from my experience) won't be able to ping .4 or .5 and broadcast you won't ping anyways, but should be able to ping .6
20:03 < knom> I can't ping any of them
20:03 < silvertip257> But you could ping .1 (the server) and get a reply.  Right?
20:03 < knom> sorry, can't ping 4,5, or 6
20:04 < knom> can ping 1
20:04 < silvertip257> try pinging .6 from OSX and not the server
20:05 < knom> I did
20:05 < silvertip257> Did you get a reply on .6?
20:05 < knom> nope
20:05 < knom> 100% packet loss
20:06 < silvertip257> That is really odd ... if the client is .6 you should get a reply.  If you look at your routing table on OSX do you see a route for the 172.16.0.x network?
20:09 < knom> fetching
20:10 < knom> http://pastebin.com/Ysabs8Rm
20:13 < silvertip257> knom: yep, the tun0 interface is active and you do have routes to the 172.16.0.x/24 network.
20:13 < silvertip257> You're probably right that this is a client firewall/routing problem.  In which case I won't be much help to you with OSX.
20:13 < knom> silvertip257: okay.  thanks for all your help. 
20:14 < silvertip257> Wish I could have helped more.  I will want to work with Tunnelblick when I get my hands on a system running OSX. ;)
20:15 < knom> I'm sure you could one of us up and take it without too many problems
20:17 < silvertip257> knom: I'll see if I can't get a friend of mine to let me try Tunnelblick on my Openvpn server.  I don't know when I'll have time to do that or borrow a system, etc.
20:18 < knom> silvertip257: hopefully I'll be able to trouble shoot it before that but thanks and I'll be back and keep an eye out
20:19 < silvertip257> knom: give tcpdump a whirl on the server to see if the client is contacting the server.  That way you'll also get the ip of the client.
20:22 < knom> I know what the ip of the client is
20:23 < silvertip257> knom: `tcpdump -c 10 -i eth0 udp 1194` ... -c 10 dumps 10 packets and stops udp 1194 dumps only openvpn traffic
20:23 < silvertip257>  ... adjust eth0 to be the interface through which the client can contact the server.
20:23 < knom> server side or client side?
20:23 < silvertip257> actually it would be `sudo tcpdump -c 10 -i eth0 udp 1194` unless you're already using root.
20:24 < silvertip257> knom: if you've got tcpdump installed on OSX as well you can do it on both sides.  My intention was to do it on the server.
20:24 < knom> my client is pretty linux'd up
20:25 < silvertip257> knom: there's always the option of installing Wireshark on OSX (for a GUI)
20:25 < silvertip257> GUI that lets you sniff the traffic
20:25 < knom> I already have it installed
20:26 < silvertip257> knom: you're all set to start investigating what is happening on your network between those two systems.
20:26 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Ping timeout: 260 seconds]
20:28 < silvertip257> knom: you might use a filter in wireshark ... udp.port==1194 in the realtime filter (not capture filter) to capture only openvpn traffic
20:29 < knom> silvertip257: does it matter if I use tcp or udp?
20:29 < silvertip257> knom: your configs indicated you were using udp
20:30 < knom> I meant in  general
20:30 < silvertip257> When packet sniffing or for use as the transport protocol that openvpn uses?
20:32 < silvertip257> knom: ^ ; I read an article on why you should use udp for openvpn over tcp... see if I can't dig up a link
20:35 < silvertip257> knom: this isn't exactly the page I remember, but this will explain it a bit > http://openvpn.net/archive/openvpn-users/2003-08/msg00147.html
20:35 <@vpnHelper> Title: Re: [Openvpn-users] TCP or UDP (at openvpn.net)
20:37 < silvertip257> Good luck knom - I'm off for the night.
20:37 -!- silvertip257 [~silvertip@unaffiliated/silvertip257] has left #openvpn ["Leaving"]
20:38 -!- fipu_ [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has quit [Ping timeout: 272 seconds]
20:53 -!- knom [~Adium@189.217.39.163] has left #openvpn []
20:53 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
21:08 -!- master_of_master [~master_of@p57B5753F.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:09 -!- UdontKnow [~evaldo@freenode/staff/udontknow] has joined #openvpn
21:10 -!- master_of_master [~master_of@p57B53617.dip.t-dialin.net] has joined #openvpn
21:11 < EugeneKay> "UDP or gtfo"
21:15 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 272 seconds]
21:20 -!- EugeneKay is now known as EugeneKaway
21:20 -!- EugeneKaway is now known as EugeneKay
21:24 -!- Kindari [~william@wsip-98-173-32-131.sd.sd.cox.net] has joined #openvpn
21:26 < Kindari> Hey guys, I really know very little about OpenVPN, VPNs in general and anything but basic networking. At this time I am *not* trying to set it up, but I would really like to learn more about it. Anyone have any "for idiot" guides?
21:28 < hjohnson> if you use udp, you don't have to worry about the BDP for the tunnel itself
21:28 < hjohnson> (bandwidth delay product)
21:28 < EugeneKay> !factoids
21:28 < hjohnson> <-- networking geek
21:28 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
21:29 < EugeneKay> Healthy reading ^
21:29 < hjohnson> (in high latency, low loss networks.. satellite to be precise)
21:30 < Kindari> http://www.secure-computing.net/factoids.php
21:30 <@vpnHelper> Title: SCN: vpnHelper Factoids (at www.secure-computing.net)
21:30 < Kindari> stupid copy paste.
21:30 < EugeneKay> Herp da derp
21:30 < hjohnson> what I love is when people think that a tcp accelerator will workw hen it's on the black side of the network
21:30 < EugeneKay> Tcp accelerator laffo
21:31 < hjohnson> EugeneKay: eh, when you have 550ms of inherant latency, you basically need to use them
21:31 < EugeneKay> Or, buy an internet connection that doesn't involve astronauts
21:32 < hjohnson> EugeneKay: tough to o that when you're in the middle of a war zone, or out in the middle of the atlantic ocean. :)
21:32 < EugeneKay> Shut up and shoot / shut up and enjoy the ocean
21:33 < hjohnson> heh
21:33 < hjohnson> <--- the guy you call when you need 5mbps in and out of the ass end of nowhere.
21:33 < EugeneKay> I think I shall sleep
21:35 -!- elux_ [~peter@bas15-toronto63-1279272685.dsl.bell.ca] has quit [Quit: Bye!]
21:35 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
21:36 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
22:02 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
22:02 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
22:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:04 -!- zeshoem [~mnathani@bas1-toronto46-1177980372.dsl.bell.ca] has quit [Ping timeout: 264 seconds]
22:10 -!- zeshoem [~mnathani@bas1-toronto46-1177980372.dsl.bell.ca] has joined #openvpn
22:15 -!- EugeneKay is now known as EugeneKaway
22:18 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html>
22:54 <@vpnHelper> RSS Update - forum: Connects no errors but no data goes through tunnel <http://forums.openvpn.net/topic7694.html#p9977>
23:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
23:14 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
23:22 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has quit [Ping timeout: 240 seconds]
23:29 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Remote host closed the connection]
23:30 <@vpnHelper> RSS Update - forum: VLS error <http://forums.openvpn.net/topic7697.html#p9978>
23:48 -!- merky [~ben@meh.net.nz] has quit [Ping timeout: 276 seconds]
23:59 -!- Kindari [~william@wsip-98-173-32-131.sd.sd.cox.net] has quit [Ping timeout: 264 seconds]
23:59 -!- sigius [~sigius@93.125.185.45] has quit [Ping timeout: 264 seconds]
23:59 -!- `mx [~mikey@zoidberg.ghettowebhosting.com] has quit [Ping timeout: 264 seconds]
23:59 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Ping timeout: 264 seconds]
23:59 -!- master_of_master [~master_of@p57B53617.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
23:59 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
23:59 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
23:59 -!- `mx [~mikey@zoidberg.ghettowebhosting.com] has joined #openvpn
23:59 -!- Kindari [~william@wsip-98-173-32-131.sd.sd.cox.net] has joined #openvpn
--- Day changed Mon Feb 28 2011
00:00 -!- master_of_master [~master_of@p57B53617.dip.t-dialin.net] has joined #openvpn
00:16 -!- Bzek [~SK@access-46-42-29-225.kmtn.ru] has quit [Read error: Connection reset by peer]
00:16 -!- Bzek [~SK@access-46-42-36-169.kmtn.ru] has joined #openvpn
00:18 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Quit: No Ping reply in 540 seconds.]
00:18 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
01:04 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 240 seconds]
01:07 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
01:08 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
01:25 <@vpnHelper> RSS Update - forum: connection problem over GPRS <http://forums.openvpn.net/topic7685.html#p9979>
01:25 -!- techqbert_ [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has joined #openvpn
01:27 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
01:27 -!- techqbert_ is now known as techqbert
01:27 -!- DigitalFlyx [~DigitalFl@213.229.74.196] has joined #openvpn
01:29 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:29 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
01:31 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:31 -!- mode/#openvpn [+o mattock] by ChanServ
01:34 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
02:25 <@vpnHelper> RSS Update - forum: VLS error <http://forums.openvpn.net/topic7697.html#p9981> || Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p9980>
02:25 < s7r> what means disk i/0?
02:30 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
02:31 <@vpnHelper> RSS Update - forum: Ping only at the opening of VPN <http://forums.openvpn.net/topic7645-15.html#p9983> || Connects no errors but no data goes through tunnel <http://forums.openvpn.net/topic7694.html#p9982>
02:33 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
02:33 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
02:33 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
02:34 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
02:35 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
02:36 -!- DigitalFlyx [~DigitalFl@213.229.74.196] has quit [Read error: Connection reset by peer]
02:36 <@vpnHelper> RSS Update - forum: how do I respond to a private message using FF 3.6? <http://forums.openvpn.net/topic7699.html>
02:36 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
02:38 -!- LuckyY_ is now known as LuckyY
02:54 -!- DIgitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Quit: Bye!]
02:54 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
03:10 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: Leaving.]
03:11 -!- dazo_afk is now known as dazo
03:20 -!- WormFood [~wormfood@183.39.76.207] has quit [Ping timeout: 240 seconds]
04:23 -!- showtits [whatever@pool-173-66-87-101.washdc.fios.verizon.net] has quit [Quit: One day I'm going to find that peer guy and reset his connection.]
04:26 -!- raomin__ [~romain@86.66.22.65] has quit [Ping timeout: 260 seconds]
04:27 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
04:40 -!- raomin__ [~romain@86.66.22.65] has joined #openvpn
04:42 -!- albech [~thomas@61.7.136.173] has joined #openvpn
04:45 -!- raomin__ [~romain@86.66.22.65] has quit [Ping timeout: 272 seconds]
04:46 -!- raomin__ [~romain@86.66.22.65] has joined #openvpn
04:49 <@vpnHelper> RSS Update - forum: how do I respond to a private message using FF 3.6? <http://forums.openvpn.net/topic7699.html#p9985>
04:51 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:51 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:51 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:55 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p9986>
04:56 < hyper_ch> so pinging is not useful?
04:56 <@dazo> heh
04:58 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:58 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:59 -!- fipu [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has joined #openvpn
05:01 < hyper_ch> isn't it great how you can jump to big conclusions by just commenting on the title?
05:01 <@vpnHelper> RSS Update - forum: how do I respond to a private message using FF 3.6? <http://forums.openvpn.net/topic7699.html#p9988> || TCP connection stop working <http://forums.openvpn.net/topic7695.html#p9987>
05:01 -!- venom00ut [~venom00@unaffiliated/venom00] has left #openvpn []
05:01 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
05:06 -!- maxJadi [~maxJadi@dhcp-167-96.nomad.chalmers.se] has joined #openvpn
05:06 -!- maxJadi [~maxJadi@dhcp-167-96.nomad.chalmers.se] has quit [Changing host]
05:06 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:06 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p9989>
05:09 -!- Bzek [~SK@access-46-42-36-169.kmtn.ru] has quit [Ping timeout: 250 seconds]
05:10 -!- Bzek [~SK@access-46-42-36-169.kmtn.ru] has joined #openvpn
05:11 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p9990>
05:13 < KBobHEMP> learn 2 intranet plz
05:17 <@vpnHelper> RSS Update - forum: how do I respond to a private message using FF 3.6? <http://forums.openvpn.net/topic7699.html#p9991>
05:25 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
05:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:29 <@vpnHelper> RSS Update - forum: how do I respond to a private message using FF 3.6? <http://forums.openvpn.net/topic7699.html#p9992>
05:35 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
05:42 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p9993>
05:47 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Read error: Connection reset by peer]
05:50 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
05:54 <@vpnHelper> RSS Update - forum: how do I respond to a private message using FF 3.6? <http://forums.openvpn.net/topic7699.html#p9994>
05:58 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
06:00 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p9995>
06:00 -!- ahmedelgamil [~DigitalFl@41.237.73.195] has joined #openvpn
06:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
06:04 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
06:13 -!- gaddafi [~o2@unaffiliated/spice] has joined #openvpn
06:14 < gaddafi> i want to generate all my configuration for tls by hand
06:14 < gaddafi> i will need a guide for this
06:14 < gaddafi> actually, this is too complicated
06:14 < gaddafi> nevermind
06:14 < gaddafi> static keys will be fine
06:17 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
06:17 < MaxFrames> hello
06:19 < MaxFrames> I am following the official online tutorial on how to configure openvpn (on debian linux); I have come to the point where I am generating the server certificate and private key; the script is asking me to specify a "challenge password" (default is blank); the tutorial does not explain what this password is and does; can you help?
06:20 <@dazo> MaxFrames: Don't set any "Challenge password", leave it blank
06:20 < MaxFrames> OK
06:20 < MaxFrames> can you explain though what's the purpouse of this password?
06:21 <@dazo> I honestly don't know ... I've never cared about it, and it's used for some really more special setups 
06:21 <@dazo> janjust: ^^^ do you know?
06:21 < MaxFrames> myself I'm having trouble finding documentation about that
06:25 < MaxFrames> according to some website I found, it's used in the process of revoking the server certificate
06:27 < MaxFrames> this is the source: http://tools.ietf.org/html/rfc2986
06:27 <@vpnHelper> Title: RFC 2986 - PKCS #10: Certification Request Syntax Specification Version 1.7 (at tools.ietf.org)
06:28 < MaxFrames> I think I'll leave it blank
06:29 < MaxFrames> same goes for "optional company name"
06:30 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
06:32 < MaxFrames> another question, about client key creation: build-key-pass is the command to password protect the client key pair (as opposed to build-key); how does this password protection work (in other words: when is the password requested during vpn operations?)
06:33 -!- ahmedelgamil [~DigitalFl@41.237.73.195] has quit [Ping timeout: 240 seconds]
06:33 < janjust> MaxFrames:  the challenge password is normally not required ; it is used only for signing a certificate request with a password
06:34 < janjust> the person who signs the CSR will then need to know the challenge password before it can be signed and returned
06:34 < MaxFrames> understood, thanks
06:34 < janjust> this is to accept a rogue CA signing a CSR, which is a sophisticated MitM attack
06:34 < janjust> s/accept/prevent
06:35 < janjust> the 'build-key-pass' script uses a passphrase to protect the private key; each time Openvpn starts this passphrase needs to be supplied
06:35 < MaxFrames> each time openvpn starts on the client, you mean?
06:36 < janjust> yep ; or on the server, if you were to use a passphrase protected server key
06:36 < MaxFrames> OK; I think I'll password protect the client key; I don't mind having to type an additional complex password when I connect; I wanna be anal retentive in this thing
06:38 < janjust> a truly anal retentative person would use a hardware token ;-)
06:40 < MaxFrames> true :P
06:41 < MaxFrames> I've already created the ca.key and the server.key; if I find that I would like to change some parameter, can I start over?
06:41 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p9996>
06:41 < janjust> you can always start over, but if you change the ca.key file you will need to issue new certs for the server and all clients
06:41 < MaxFrames> ok
06:41 < janjust> the server key can be changed without too much hassle, as long as the ca.key is left intact
06:41 < janjust> it _IS_ possible to change the password of the ca.key file without having to regenerate keys 
06:42 < janjust> but it's not possible to change bitsize, modulus, nor any of the CA certificate properties
06:42 < MaxFrames> to start over, do I just delete ca.key and server.key and start over from ". ./vars" - "./clean-all" - "./build-ca"?
06:43 < MaxFrames> mm, i think ./clean-all already wipes all the keys
06:45 <@dazo> ./clean-all ... really cleans up, everything
06:45 < janjust> yes, ./clean-all is the way to start over...
06:45 < janjust> which part do you want to keep then?
06:45 -!- DigitalFlux [~DigitalFl@213.229.74.196] has joined #openvpn
06:45 -!- DigitalFlux [~DigitalFl@213.229.74.196] has quit [Changing host]
06:45 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
06:46 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p9998> || Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p9997>
06:46 < MaxFrames> I just want to keep ... nothing really, I'd like to start from scratch because I'd like to change the organization name and unit name
06:47 < janjust> then ./clean-all is the way to go ; change the vars file (which is not deleted by ./clean-all) and it's all yours
06:47 < MaxFrames> ok, sweet deal. doing it now
06:47 < MaxFrames> thanks so much for your help and patience (I'm afraid there will be more questions) :)
06:49 < janjust> no prob
06:52 < MaxFrames> Ef39S58c68
06:52 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10000> || Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p9999>
06:52 < MaxFrames> woopsie sorry
06:52 < MaxFrames> wrong chan
06:55 -!- ScriptFanix [vincent@hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.2]
06:56 -!- ScriptFanix [vincent@2001:910:100b::1] has joined #openvpn
06:58 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10002>
07:04 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10003>
07:09 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10004>
07:17 -!- gaddafi is now known as copkiller
07:19 < MaxFrames> cya tomorrow, thanks again
07:19 -!- MaxFrames [~MaxFrames@147.162.217.235] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc Insomnia 4.0.2, revision: 4744, sources date: 20100627, built on: 2010-08-01 17:01:07 UTC 4744 http://www.kvirc.net]
07:24 -!- `mx [~mikey@zoidberg.ghettowebhosting.com] has quit [Quit: leaving]
07:30 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
07:33 -!- EugeneKaway is now known as EugeneKay
07:35 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
07:35 <@vpnHelper> RSS Update - forum: how do I respond to a private message using FF 3.6? <http://forums.openvpn.net/topic7699.html#p10005>
07:37 < EugeneKay> lolwut
07:46 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10007> || how do I respond to a private message using FF 3.6? <http://forums.openvpn.net/topic7699.html#p10006>
07:49 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
07:52 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10008>
07:58 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10010> || dynamic IP <http://forums.openvpn.net/topic7700.html>
08:04 <@vpnHelper> RSS Update - forum: openvpn for mac help..... <http://forums.openvpn.net/topic7701.html>
08:15 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:16 -!- raomin__ [~romain@86.66.22.65] has quit [Ping timeout: 260 seconds]
08:19 -!- raomin__ [~romain@86.66.22.65] has joined #openvpn
08:27 -!- luneff [~yury@84.51.197.93] has joined #openvpn
08:28 -!- buntfalke [~nobody@openvpn-p0-230.triple-a.uni-kl.de] has joined #openvpn
08:28 -!- buntfalke [~nobody@openvpn-p0-230.triple-a.uni-kl.de] has quit [Changing host]
08:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:41 -!- EugeneKay is now known as EugeneKaway
08:50 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Remote host closed the connection]
08:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:53 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
08:53 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
08:55 -!- common [~common@p5DDA4CA4.dip0.t-ipconnect.de] has joined #openvpn
08:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:55 -!- fipu [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has quit [Ping timeout: 272 seconds]
08:56 < common> is it possible to have 2 instances of openvpn running on the same box, where both services run - basically the same config - one offering vpn via udp the other via tcp
08:57 < common> or will I run into issues with multiple tun devices having the same ip address & netmask
08:57 < common> or, in case I use a pre-created tun, will the services clash when accessing the single tun?
08:57 < s7r> common: yes that is possible
08:58 < s7r> copy your server.conf to server1.conf
08:58 < common> how? 2 tuns?
08:58 < s7r> in the first config you need to have dev tun0
08:58 < s7r> second config: tun1
08:58 -!- gladiatr_afk is now known as gladiatr
08:58 < s7r> add 'daemon' line in second config otherwise it won't start
08:58 < common> okay, so I have two interfaces serving the same address & network
08:59 < gladiatr> s7r, that's not possible with the same vpn network, though
08:59 < common> how does the kernel know which interface to use for routing packets
08:59 < s7r> change the IP pool if you are NAT-ting eg. if config 1 has server 10.8.0.0 255.255.255.0 change in second config tu 10.6.0.0 255.255.255.0
08:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:59 < s7r> you have 2 pools of IP and iptables rules for each
09:00 < common> no way to run using the same pool?
09:00 < gladiatr> nope
09:00 < s7r> no way
09:00 < common> k, thought so
09:00 < common> I'm currently debugging some really weird latency issue
09:00 < common> while the vpn server is idle, and the client is idle
09:00 < s7r> if you use the same pool the second daemon won't start it will tell you can't add linux route
09:01 < common> the latency over the vpn tunnel changes rapidly without any reason
09:01 < common> upto 700ms
09:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:01 < s7r> what cipher you use
09:01 < s7r> is compression enabled?
09:01 < common> aes-128 cbc, compression
09:02 < s7r> maybe it's some connection isp fault...
09:02 < s7r> did you run --mtu-test?
09:02 < common> no, must be new 
09:02 < common> I ran mtr on the client to the vpn server, latency was <30ms
09:03 < s7r> you have NAT ?
09:03 < common> I saturated the clients upstream, latency to the vpn server was <80ms
09:03 < common> yes
09:03 < s7r> with 10.8 IP ?
09:03 < common> yes
09:03 < s7r> what iptables rule did you give the server?
09:03 < s7r> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source <your server public ip>
09:03 < s7r> you did this ?
09:04 < common> when the clients upstream was saturated, the vpn had a latency of 5000ms and more
09:04 < s7r> check your iptables rule and restart the vpn service
09:04 < common> while the vpn-server was reachable within <80ms
09:04 < common> it is not an iptables issue
09:04 < common> I thought about packet loss for udp
09:05 < common> and wanted to enable a second daemon serving vpn via tcp
09:05 < common> just to compare to something
09:05 < common> it usually works, but sometimes latency kills everything
09:06 < gladiatr> Does this happen simultaneously on all connected clients?
09:06 < common> no idea
09:06 < common> one complained, and I was able to reproduce easily
09:08 < common> but I have no idea what causes this problem
09:08 < common> the server is idle, memory saturated, lines are clear
09:08 < common> I noticed though openvpn sometimes jumps to 30% cpu useage
09:18 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p10012>
09:19 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
09:21 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 260 seconds]
09:24 -!- kronos003 [~kronos003@206-188-75-41.cpe.distributel.net] has joined #openvpn
09:24 < kronos003> i need some help with a routing issue im having :: http://pastebin.com/2ni0apDJ :: i can get the traffic to redirect to my vpn, but ONLY if i tell it to redirect the traffic of the whole box. tell it to only redirect marked traffic and then things get sticky. i ONLY want marked traffic to go down the vpn tunnel
09:25 -!- EugeneKaway is now known as EugeneKay
09:26 -!- luneff [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
09:26 -!- luneff [~yury@84.51.197.93] has joined #openvpn
09:27 < gladiatr> kronos003, heya.  You're probably going to have better luck engaging #lartc on irc.oftc.net for that particular issue
09:28 < kronos003> what is lartc?
09:28 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
09:28 < gladiatr> linux advanced routing and traffic control
09:28 < gladiatr> and goat porn
09:28 < gladiatr> j/k
09:29 < kronos003> lol
09:29 < gladiatr> hehe
09:29 < gladiatr> If you haven't reviewed the docs at lartc.org, they're worth a look
09:29 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:29 < kronos003> i need to force ekiga down a vpn so i can make sure it connects reliably nomatter where im at
09:31 < gladiatr> Yeah.  If you're dealing with packet labeling and policy routing based on those labels, you've come to the wrong channel.  Just sayin' that you'll have better luck with the lartc crew
09:31 -!- luneff [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
09:33 < kronos003> i got the labeling part working - its the routing part thats got me stumped
09:34 < kronos003> what does the routing table need to look like? its clear openvpn is doing some strange voodoo to take over the traffic on the machine. i just want it to take over the marked traffic
09:35 < kronos003> that is marked traffic only
09:36 -!- bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
09:36 -!- bitterman [~yury@84.51.197.93] has joined #openvpn
09:45 -!- e-squizo [~fheinz@190.189.199.159] has joined #openvpn
09:46 < e-squizo> !welcome
09:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:47 < e-squizo> !iporder
09:47 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
09:47 < e-squizo> !interface
09:47 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
09:47 < e-squizo> !goal
09:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:51 -!- ScriptFanix [vincent@2001:910:100b::1] has quit [Quit: WeeChat 0.3.2]
09:51 < e-squizo> hi, folks. I'm trying to set up openvpn on an interface with a dynamic IP address. I got it to work using my dyndns domain name in the "local" directive, but this breaks when the IP address changes after openvpn was started. Is there any particular reason why there isn't an "interface" directive that would accept a network interface name instead of an IP address/domain name?
09:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:51 < e-squizo> I'd be willing to implement such a directive, if it were likely to be reasonably well received
09:52 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Read error: Connection reset by peer]
09:54 < kronos003> !lan
09:55 < kronos003> !route
09:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:55 < kronos003> !tcpip
09:55 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
09:59 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 260 seconds]
09:59 -!- theDoc [~Link@110.92.103.180] has joined #openvpn
10:00 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
10:00 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
10:00 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:01 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Quit: Leaving...]
10:03 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
10:05 < kronos003> i thinki it would be very helpful to understand the full reasons behind EACH line the 'push "redirect-gateway def1"' option tells the clients to execute - where would i find this?
10:06 -!- bitterman [~yury@84.51.197.93] has quit [Ping timeout: 240 seconds]
10:07 < gladiatr> man 8 openvpn
10:09 <@vpnHelper> RSS Update - forum: Backup/Fallback VPN <http://forums.openvpn.net/topic7702.html>
10:10 < ecrist> no
10:11  * ecrist pastes manpage for openvpn from section 8 to the channel
10:12 < gladiatr> not in section 8?
10:13 < gladiatr> :(
10:14 -!- Deathzor [~deathtje@216.67.225.106] has quit [Ping timeout: 250 seconds]
10:15 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
10:15 -!- atan2 [~atan@unaffiliated/atan] has joined #openvpn
10:15 < atan2> !goal
10:15 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:18 -!- atan [~atan@unaffiliated/atan] has quit [Ping timeout: 240 seconds]
10:25 < atan2> Okay I am looking for ideas on the best way to configure this application idea.
10:26 < gladiatr> Shoot
10:26 < EugeneKay> Fucking Magic (tm) is the best way.
10:26 < gladiatr> ^^ ^^ ^^ 
10:26 < atan2> I have ~3 servers. One is VPN for inbound connections. One is Apache(php). One is database(mysql). The database server is perhaps the most valuable in terms of data I don't want in the public domain. 
10:27 < atan2> I want my clients to connect up using VPN to the VPN server which will allow access (with Fucking Magic(TM)) over a private network the servers are on.
10:27 < atan2> I'm left with a few questions about this... hmm.
10:27 < atan2> 1. if the client connects to VPN server, and VPN server is connected to Apache server with another VPN... is there any point in HTTPS connections?
10:28 < gladiatr> It wouldn't hurt
10:28 < atan2> I figured the extra work might tax my apache server more than needed... but the hell if I know.
10:29 < gladiatr> The whole defense-in-depth model would suggest that a data stream stays as secure as possible from end-to-end.
10:29 < gladiatr> How many concurrent connections will your apache server be managing?
10:30 < gladiatr> ish
10:30 < atan2> I am not sure how to answer that as I have not studied this enough. In not too long there would be 2,500 people actively using this to access a web app.
10:31 < atan2> The web app would call home every 10 seconds or so to check for updates. So, err
10:31 < atan2> 25,000 per minute? :S
10:31 < atan2> Perhaps I should rethink my model a bit. Perhaps time for node.js to be used.
10:34 < atan2> gladiatr, did I lose you with crazy numbers?
10:34 < gladiatr> Nah.  Just doing/trying-to-do several things at once
10:35 < atan2> Ahh. Perfect. Well thanks for your input thus far :)
10:35 < atan2> Be back in a few minutes. Time for an out-of-chair experience.
10:36 < gladiatr> What sort of vpn link will it be using?  bridged or routed?
10:36 -!- darth_bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
10:37 -!- darth_bitterman [~yury@84.51.197.93] has joined #openvpn
10:40 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:41 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
10:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:42 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p10014>
10:43 < kronos003> atan2: what kind of volume are you running that you need your db server and your web server to be two different boxes?
10:44 -!- darth_bitterman [~yury@84.51.197.93] has quit [Read error: Connection reset by peer]
10:44 < kronos003> atan2: are you vpning the clients on the same tunnel as the web server and the db server?
10:46 < kronos003> atan2: i guess i should step back and ask what is your application, what is your volume of connects, what are your hardware specs on each server? and finnally how much security do you need from the outside world, and how well do you trust the folks connecting on the vpn?
10:48 < kronos003> atan2: did i read that right? 2500 users? 
10:51 < EugeneKay> 2500 simultaneous connections to OpenVPN is...... going to cause issues.
10:51 -!- copkille1 [~o2@unaffiliated/spice] has joined #openvpn
10:52 < kronos003> atan2: ok, whether to vpn the users to the webserver or not depends on how well you trust the webserver to withstand an attack. I personally WOULD NOT expose the db server to the world OR the vpn user if i could help it - im assuming you are using the DB server in sole support of the web app. i would allow connections to the DB server on a need to connect basis ONLY. if your hardware can support it, id combine the DB server onto the
10:53 < kronos003> atan2: but without knowing more about what you are doing and very importantly the specs of the hardware you are trying to do it on, itll be hard to advise you further
10:54 -!- copkiller [~o2@unaffiliated/spice] has quit [Ping timeout: 240 seconds]
10:54 < kronos003> EugeneKay: what kind of hardware do you think hell need to handle 2500 simultainious connections?
10:55 -!- theDoc [~Link@110.92.103.180] has quit [Read error: Operation timed out]
10:55 < EugeneKay> On a single box? I don't know that OpenVPN would be able to work within the limits of the networking stack in linux
10:56 < kronos003> EugeneKay: heh - well they do it on cisco ssl consentrators - i wonder what they use
10:56 < EugeneKay> Hardware ssl chips
10:56 < kronos003> i see
10:57 < EugeneKay> I don't know enough about how OpenVPN performs with even 100 simultaneous connections
10:57 < EugeneKay> But I would think that 2-3 servers would be needed.
10:57 <@dazo> OpenVPN is known to have issues when tackling more than 150-200 clients simultaneously ... what users usually do is to run multiple openvpn instances on different ports, using --remote-random and more --random statements in the client configs - with different port numbers, preferably pin them to separate CPU cores, 
10:57 < EugeneKay> The load won't be THAT much more than what 2500 simultaneous HTTPS sessions to Apache would load it with
10:57 < EugeneKay> That ^
10:58 -!- theDoc [~Link@110.92.103.180] has joined #openvpn
10:58 < EugeneKay> I would say a maximum of 100 clients per process, 2xquad core cpus gives roughly 800 users per physical server
10:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
10:59 <@dazo> it's important to beware of that OpenVPN is a single threaded application, so it won't take advantage of multiple cores ... hence running multiple servers
10:59 < EugeneKay> Neither is Apache - but it has prefork
10:59 < kronos003> EugeneKay: depending on the web app, you dcould do 2500 users and put the db server together on a quadcore box with 8gb of ram with not much trouble
11:00 <@dazo> Apache got threading support as well (with 2.2 at least)
11:00 <@dazo> (but it will look like one process via the normal 'ps' command)
11:01 < EugeneKay> If you're talking 1000+ simulteneous users, mayhaps a commercial solution is more appropriate
11:01 <@dazo> pre-fork forks out separate child processes, which is another technique ... both forking and threading have each their advantages and drawbacks
11:01 <@dazo> nah
11:01 < EugeneKay>  If ony so you have somebody to scream at when it all goes pear-shaped
11:01 -!- Sushiyant [~hamed@unaffiliated/sushiyant] has joined #openvpn
11:02 <@dazo> yeah, that's the only advantage :)
11:02 < EugeneKay> Also an important one.
11:02 < Sushiyant> Why my internet speed be come very slow when i use openvpn 
11:02 < EugeneKay> Because your tubes are clogged
11:03 < EugeneKay> Ensure that all your network cables are straight - the 0s will roll right through a kink in a cable, but the 1s get stuck
11:03 -!- Kindari [~william@wsip-98-173-32-131.sd.sd.cox.net] has left #openvpn []
11:03 < EugeneKay> (this is actually sound advice - kinked cables lead to internal fraying leads to intermitted packet loss when it is bumped just /so/)
11:04 <@dazo> Sushiyant: if you redirect all traffic via OpenVPN ... your experienced speed depends on a lot of factors ... whats the *upload* speed on both client and server side?
11:04 <@dazo> Sushiyant: second is ... what about MTU issues?  if you have MTU issues, that will reduce the speed
11:04 <@dazo> Sushiyant: third ... do you use TCP or UDP for OpenVPN?   TCP will reduce the throughput
11:04 <@vpnHelper> RSS Update - forum: One allowed connection per IP, last one closes older attempt <http://forums.openvpn.net/topic7658.html#p10015>
11:05 <@dazo> Sushiyant: fourth ... do you use TUN or TAP?  TAP gives extra overhead
11:05 < Sushiyant> dazo: I am using TUN
11:05 <@dazo> and there are a million more possibilities
11:05 < EugeneKay> I like my explanation best
11:06 <@dazo> heh
11:07 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
11:07 <@dazo> EugeneKay: http://dilbert.com/strips/comic/1996-05-02/
11:07 <@vpnHelper> Title: Dilbert comic strip for 05/02/1996 from the official Dilbert comic strips archive. (at dilbert.com)
11:07 < EugeneKay> I'm glad SOMEBODY has an appreciation for antique jokes
11:08 <@dazo> :)
11:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:12 < e-squizo> hi, folks. I'm trying to set up openvpn on an interface with a dynamic IP address. I got it to work using my dyndns domain name in the "local" directive, but this breaks when the IP address changes after openvpn was started. Is there any particular reason why there isn't an "interface" directive that would accept a network interface name instead of an IP address/domain name?
11:12 < e-squizo> I'd be willing to implement such a directive, if it were likely to be reasonably well received
11:13 < EugeneKay> Best advice I can give is to add a hook for openvpn to your dhclient script, and restart it if it's running
11:15 <@vpnHelper> RSS Update - forum: Connect ok but I get a lot of econnrefused and ehostunreach <http://forums.openvpn.net/topic7703.html>
11:15 <@dazo>        --local host
11:15 <@dazo>               Local host name or IP address for bind.  If specified, OpenVPN will bind to this address only.  If  unspecified,  OpenVPN  will  bind  to  all
11:15 <@dazo>               interfaces.
11:15 <@dazo> e-squizo: ^^  read carefully ... that is from the man page
11:15 < atan2> EugeneKay, kronos003, dazo, thank you for your words. I was out for a minute but read over what you were saying. I'm happy to share more details on what I'm planning in the hopes I end up with useful advice to take back with me :)
11:16 <@dazo> if binding to all interfaces (0.0.0.0) ... it should tackle IP address changing
11:16 <@dazo> but when that happens, it will most likely disconnect clients, and with retry enabled, restart the connection
11:17 -!- Sushiyant [~hamed@unaffiliated/sushiyant] has quit [Ping timeout: 260 seconds]
11:17 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
11:17 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
11:17 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
11:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
11:21 < e-squizo> dazo: sure, I know that. The point is that I want openvpn to be able to bind to just one interface, but I don't know the IP address of that interface at configuration time.
11:22 < e-squizo> to make matters worse, the DNS name of that interface may not yet be up-to-date when openvpn starts
11:22 <@dazo> e-squizo: that's not possible currently
11:23 < atan2> err... door be back again shortly
11:23 <@dazo> it's a known weakness ... and the one who is brave enough to overhaul socket.c ... will gain fame and glory
11:24 < gladiatr> and pie
11:24 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
11:27 < e-squizo> dazo: exactly my point. I'll be modifying openvpn to allow that. If such a contribution would not be considered a misfeature, then I'll invest the extra effort to tidy it up for submission.
11:27 < e-squizo> ok, I guess I'll tackle socket.c then :-)
11:27 <@dazo> e-squizo: well, that contribution really expects a decent overhaul of socket.c ... because most of the reasons we're missing such features is due to socket.c
11:28 < e-squizo> fame, glory and pie, here I come!
11:28 <@dazo> but it's also tightly connected to the event handler as well ... so this is a trap to stumble into ... 
11:28 < gladiatr> :D
11:29 <@dazo> e-squizo: If you're serious, sign up for the openvpn-devel list (if your not) and join #openvpn-devel 
11:30 < e-squizo> give me a little while to consider how serious I am :-)
11:30 < e-squizo> but I expect to be tackling this
11:30 <@dazo> lol ... getting cold feet already ;-)
11:30 <@dazo> if you're up to it ... it would be great!
11:30 < e-squizo> I mean: you DID make it sound insurmontable!
11:30 < EugeneKay> I want pie
11:31 < e-squizo> I have an idea that *should* work, and doesn't sound like it'd be so involved
11:31 <@dazo> I've followed many code paths in in OpenVPN ... and I fear every time I need to touch the event handler and socket.c ... as I often get lost on those paths
11:32 < kronos003> where do i find the error log for misrouted traffic
11:32 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p10017>
11:33 <@dazo> but granted, I'm not a dedicated openvpn developer ... I don't spend much time every day on openvpn coding
11:34 < krzee> mmm pie
11:34 <@dazo> kronos003: to my knowledge, there's no such error log thing
11:36 < kronos003> i need a place to watch for routing erros on the server
11:37 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
11:37 < kronos003> its funny i run the 'push "redirect-gateway def1"' and it "Just Works(TM)". but i cant get the routing right on the alternate table when i point a program at the alternate table
11:39 < atan2> The application I'm looking to port over to the web is a medical record manager. As such, the data it contains is quite valuable and I can't have it directly on the web per se.
11:40 < kronos003> atan2: in that case all security is warrented
11:41 < atan2> kronos003, oh very much so! 
11:41 < kronos003> atan2: 2500 users - how many offices and what prospective client oses and devices?
11:42 < atan2> Right now I'm looking at using one-time passwords along with a security token which is challenged every few seconds, username and password to get them connected up to the application.
11:42 < atan2> Currently there is somewhere around 2000 offices, most using the application on just one computer.
11:42 < atan2> There is a few offices with 4 or 5 clients connected to one server computer.
11:43 < atan2> The problem with them all is it's a true pain to update anything. One much venture around to each office and manually install the update. Yuck. Pure yuck.
11:44 < kronos003> atan2: i was going to ask if the app was hard enough to withstand public availability, but i think in your case if it were MY job on the line id have at least http authentication in front of the app (ive used that in a few cases and apache is very well hardened against attack
11:44 < atan2> 99% of the computers are running Windows. I'd say it's 1/5 Windows 98, 3/5 XP 0.8 Vista/7 and .2 linux
11:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
11:45 -!- albech [~thomas@61.7.136.173] has quit [Quit: Ex-Chat]
11:45 < kronos003> atan2: go with http auth on https - and then use authentication in the web app itself or be prepared to buy a dedicated VPN consentrator
11:45 < atan2> I should draw up a quick picture to explain how this user would connect.
11:45 < EugeneKay> That ^
11:45 < EugeneKay> Also, consider using client-specific SSL auth
11:46 < EugeneKay> So they have to have a file, and the password
11:46 < atan2> EugeneKay, this is the point of the token if this case I do believe.
11:46 < kronos003> awith the http auth option you can set a tripwire that locks an ip out for 24hrs(or arbitrary time) if the fail to get it right more than x tims
11:46 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
11:46 < kronos003> atan2: with the http auth option you can set a tripwire that locks an ip out for 24hrs(or arbitrary time) if the fail to get it right more than x tims
11:46 < atan2> kronos003, yes but it's just as well to build that into my script.
11:47 < atan2> The session ID will change on every page load so a MIM attack will be interesting.
11:47 < kronos003> atan2: use apaches builtin protection where you can - its been time tested against breach attempts
11:47 < atan2> They can steal the ID and content of the cookie but after 10 seconds the next page refresh will update it.
11:47 < atan2> They would need to steal it, and use it within 10 seconds having the correct token, username, password and on top of that each client can not connect to the VPN twice.
11:48 < atan2> If two connections are detected they'll both get booted out and whoever has the correct token can get back in.
11:48 < kronos003> atan2: dont get me wrong - build every bit of protection into the app itself - just use apache as another layer of "Fuck Off(TM)"
11:48 < atan2> Using the one-time passwords generated by an AES token should make it fun.
11:48 < atan2> kronos003, let's talk ab out this a little bit. Why would I use Apache http-auth over a simple form over https?
11:48 < kronos003> k so for thw web server you likelycan get away without using vpn
11:49 < kronos003> i use http auth over https
11:49 < atan2> kronos003, to add more fun to the mix I was going to have the VPN use the PAM to require a valid OTP generated by the connected token.
11:50 < atan2> The problem I see with using just https is we're working with just one layer of security. If someone gets in the middle... I don't know.
11:51 < kronos003> you connect to server, then it asks where you want to go, then looks at directive for destination and then asks for password, then runs app(your web form), now app has control, it asks for its own password, then your customer can get down to business,::: user would need 2 sets of identification, but joe Q hacker is gonna light up your security logs long before he gets in
11:52 < atan2> kronos003, I like the idea of Apache looking after it as it would be seperate from the application itself. This is interesting.
11:53 < atan2> Slight issue here I think. How do I change the session ID on the http-auth? I thought it used a static ID.
11:53 < atan2> So if someone were to steal the cookie they could connect up. Obviously this will be limited to IP ranges but if they were somewhere the attacker had access.. whoosp
11:53 < kronos003> as another user pointed out you could ussue client side certificates for your https server and their browserwould have to have the certificate installed inorder to access your site - that might be the better way to go since the user would only need to know one set of credentials and not 2 -(any problems would be a call to IT who would then make sure the target browserhas their cert installed) cutting off an office from the system wo
11:54 < kronos003> course ive not seen how apache would handle so many certificates
11:55 < kronos003> and im not sure how that would work so you would likely need to do some homework on that
11:55 < ScriptFanix> IIRC, cacert has some docs on this topic
11:56 < ScriptFanix> and they use this successfully
11:56 -!- sia^pwnnt is now known as adawda
11:57 < kronos003> atan2: so that would leave your db server. how do you plan to do your hosting? in house CO-LO or VPS?
11:57 < atan2> Actually I might be able to get away with what I have now. Only one login per IP, each IP is unique to a VPN session, and each VPN client is limited to one active connection. The connection requires a one-time password which will allow for replay detection by the server, and session IDs are changed every 10-20-30 seconds as a background request is completed.
11:57 < atan2> Then on top of that part the application requires a login which needs another one-time password. Magic!
11:58 < atan2> kronos003, the hosting is going to be interesting.
11:58 < atan2> Right now I am in love with the VPS market... but it's a shared box. Err.
11:58 < atan2> Doesn't seem like *quite* what I'm after. But the ability to scale in two snaps is... rawr.
11:58 < kronos003> atan2: vps might be able to do it but for that load you would need a BIG box
11:58 < atan2> Let me take a peek at the specs on the slices.
11:59 < atan2> 15872MB ran, 620GB drive
11:59 < kronos003> atan2: you also have to worry about data backup and fault tollerance
11:59 < atan2> ram
12:00 < kronos003> mysql or postgres?
12:00 < kronos003> i know how to tune mysql, but not postgres
12:01 < kronos003> there are things out there you can use to make mysql VERY fast and they are free
12:01 < kronos003> atan2: mysql or postgres?
12:02 < EugeneKay> Certificate based auth would be fine - that's what PKI is built for
12:04 < EugeneKay> Compromised certificates you just revoke, generate a freshie, and distirubute it to to the remote office
12:04 < EugeneKay> You can password-lock a .p12 bundle no problem
12:05 < EugeneKay> Time-based security would still be the responsibility of your app
12:09 < atan2> Sorry for the delay, call. 
12:09 < atan2> The database is based in MySQL
12:09 < EugeneKay> I'm in a WebEx myself. Customers. Ugh.
12:09 < kronos003> atan2: is there a reason you want the db server on a separate box?
12:09 < atan2> One part I would need to depend on the VPN for is to only allow one client to connect at a time.
12:10 < atan2> kronos003, just to keep it another box away from the end user.
12:10 < EugeneKay> 2500 users, only one connecting at a time?
12:10 < EugeneKay> Or one session per end-user at a time?
12:10 < atan2> Oh goodness no. 2500 connected at once.
12:10 < atan2> Each user represents a staff a member at a remote clinic.
12:10 < atan2> There may more more than one user in each clinic, and likely will be.
12:11 < kronos003> atan2: if they can compromise your webserver - they have access to whatever the webserver has
12:11 < kronos003> atan2: if they can compromise your webserver - they have access to whatever the webserver has access to
12:11 < atan2> kronos003, sort of. If they get root, perhaps, sure.
12:11 < kronos003> atan2: so you are charging for a per seat license?
12:11 < atan2> kronos003, per user per feature
12:12 < atan2> The scripts on the server are compiled and encoded to slow down any pain should someone get on the box.
12:12 < atan2> To make it more fun the data in the database may not all be human-readable.
12:12 < atan2> Images, for example, will be encrypted using a key stored in the users token along with a piece of data only they know.
12:13 < kronos003> atan2: put the db server on the box with the app
12:13 < atan2> So if someone does it get access to the images, for example, they will need to decrypt each one. Until CPU power^15 we're safe for a few days on each image even if the attacher has a wall of PS3s
12:13 < kronos003> the only reason you have a db server on another box is for failover
12:14 < atan2> kronos003, I suspect there will be more than one web server dishing out this application
12:14 < kronos003> i expected as much
12:14 < atan2> kronos003, I also suspect there will be a master database server and a few slaves working for it =\
12:15 < atan2> I'm happy running a small VPS for every 10 or 15 users, that's all fine if it can handle it.
12:15 < EugeneKay> Sounds like you need professional advice :-p
12:15 < atan2> There isn't a ton of data flying around the wire except when they go to upload a file.
12:15 < atan2> EugeneKay, oh likely =D
12:16 < kronos003> atan2: in that case your need of a vpn will be between the app server and the master db servers
12:16 -!- atan2 [~atan@unaffiliated/atan] has quit [Quit: null]
12:17 < kronos003> atan2: i would still recommend a caching  db server on the box to speed up requests(im not sure about the semantics of this)
12:17 -!- atan [~atan@unaffiliated/atan] has joined #openvpn
12:17 < atan> That was clearly the wrong button.
12:18 < kronos003> atan: you might need to look into cluster computing as a failover solution
12:19 < kronos003> atan: i would still recommend a caching  db server on the box to speed up requests(im not sure about the semantics of this)
12:19 < kronos003> basically if you want speed and stability - "Less Is More(TM)"
12:20 < hjohnson> wow... our IT guy, bless his soul, has figured out a way to setup the firewall that breaks openvpn
12:20 < EugeneKay> hjohnson - :443 ftw
12:20 < kronos003> atan: only make it as complicated as you need to
12:21 < hjohnson> EugeneKay: except htat I'm already using 443 for apache
12:21 < EugeneKay> Get another IP
12:22 < hjohnson> easier solution is to pop onto company wireless, which is on a DMZ, and not subject to the restriction :P
12:22 < kronos003> atan: and for the love of god make your app less disgusting than these compiled VBscript apps i see some of these places using (pretty pictures arent all there is to a good app)
12:22 < kronos003> hjohnson: lemme guess - you told him SSL right?
12:22 < EugeneKay> atan - a bit of free design advice is to modularize everything. Run your mysql instances in Master-Slave write/read configuration, run as many Apache instances as you need behind a pair of load balancers that do IP-takeover(with DNS round-robin to half/half between those)
12:23 < EugeneKay> Take out any one VM, and the whole thing keeps on purring(and sends an "Oh, shit! email")
12:23 < hjohnson> kronos003: no, I generally ignore him
12:23 < kronos003> ^^^^ what EugeneKay said
12:23 < hjohnson> kronos003: small company, he's a windows flunkie, so I tend to ignore him.
12:23 < atan> kronos003, so far my application has no images. It's very HTML5-ish. The idea is to be fast, and take advantage of the client computer over the server where possible.
12:23 < kronos003> atan: ^^^^ what EugeneKay said
12:24 < atan> EugeneKay, if I plan to bounce them around from server to server I would need to track their sessions on the database server... hmm. I do this currently for small applications. I wonder how this would scale =\
12:24 < EugeneKay> atan - memcached
12:24 < hjohnson> ooh spacewalk in progress
12:24 < hjohnson> I love watching spacewalks live
12:24 < kronos003> hjohnson: what is a windowz tech doing working on your router?
12:24 < hjohnson> kronos003: your guess is as good as mine.
12:25 < hjohnson> until recently, he prohibited outbound ssh because it was "insecure" yet he allowed pptp
12:25 < EugeneKay> memcached on the APache instances. If one of those goes down, only the sessions saved on that instance are lost(and then just need to login). Application detects failed memcachedserves, reblaances on the active ones
12:25 < kronos003> hjohnson: are you advaced it in your organization or is your role different?
12:25 < EugeneKay> But this is the sort of application design advice I normally charge for :-p
12:25 < hjohnson> kronos003: totally different... i build satellite networks for our customers.
12:26 < kronos003> i see
12:26 < hjohnson> so I have my own little IT empire at the company to run the network monitoring.
12:26 < kronos003> right now im working on forcing an app to use a vpn while the rest of the system uses the "normal" default gateway
12:27 < hjohnson> kronos003: why not just run it through a standard ssl connection?
12:27 < EugeneKay> I do that sort of thing with DNS tricks
12:30 < kronos003> hjohnson: app is ekiga andim running in a mobile situation - 'push "redirect-gateway def1"' works GREAT - but it redirects the whole box - right now ive got the app's traffic marked and set a rule to lookup a a table for all of this traffic. so far i cant seem to put anything in there to get the traffic to route through the vpn. i put rules in there and traffic stops flowing for that app. wipe the table and it starts working again, 
12:30 < kronos003> hjohnson: http://pastebin.com/1r1PBxYj
12:31 < kronos003> so right now im trying to get the routing right so only the marked traffic goes down the vpn
12:32 < kronos003> i know my marking is working. the problem is what rules do i put on the routing table to get it to flow down the vpn and not the local network
12:32 < EugeneKay> Look at what Tor does
12:32 < hjohnson> interesting side note, I read a paper recetly that even if it is encrypted, you can extract the conversation from a G.729 phone call through detailed traffic analysis
12:32 < EugeneKay> That's closer to what you're after
12:37 < ScriptFanix> hjohnson: it would be interesting to know if the language used has any incidence on thus technique's feasability
12:38 < hjohnson> ScriptFanix: absolutely
12:38 < krzee> of course it does
12:38 < hjohnson> ScriptFanix: it's a statistical analysis based on the codec's reaction to the english language.
12:38 < hjohnson> you could do the analysis based on other languages of course
12:38 < hjohnson> plus it generally helps to have a crib
12:38 < krzee> and adding some extra packets would obfuscate that
12:39 < krzee> since the outter tunnel will be ALL traffic going over the vpn, if you add something so its not just RTP, that attack wont work
12:40 < hjohnson> well, depends on whether youc an separate one station's traffic from another.
12:40 < krzee> and how would you...?
12:40 < krzee> you cant if you can only see the outside of the tunnel
12:41 < krzee> if the client and server have more than just RTP going over the tunnel, the attack does not exist
12:41 < hjohnson> ignore large packets, for example.
12:41 < hjohnson> since voice packets will all be small
12:41 < krzee> it would require only RTP going over the vpn... in fact i bet $$$ the attack was not made for analyzing packets going over a vpn
12:42 < hjohnson> it doesn't matter how they're encrypted, just statistical analysis of their timing.
12:42 < krzee> an attack like that would be perfectly geared twords srtp
12:42 < krzee> but you dont understand, adding other packets would kill that
12:42 < hjohnson> krzee: adding other small packets, yes.
12:42 < krzee> its not like every normal IP packet goes over the wire as-is
12:42 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
12:42 < hjohnson> but, for example, you can ignore all packets > 512 bytes
12:42 < hjohnson> since a voice packet, encrypted or not, will never be that large.
12:43 < krzee> on the inside of the tunnel they do, on the outside they do not
12:43 < krzee> unless im mistaken (maybe dazo can chime in here) small packets may be combined when looking at the outside of the vpn
12:43 < ScriptFanix> and you could still use a small MTU for your VPN
12:45 <@dazo> I believe this is all controlled by the MTU settings, probaly --tun-mtu in this case ... UDP should not have any particular congestion control like the Nagle algorithm TCP have
12:45 <@dazo> so if you're using UDP for your OpenVPN connection, you should actually not see too much of congestion control ... however, MTU will most likely influence this somehow
12:46 < krzee> dazo, if mtu is 1500 and 2 packets sized 500 need to go over the tunnel, will it be 1 packet of 1000 or 2 of 500 from the outside view?
12:46 < hjohnson> dazo: but OpenVPN doesn't queue up packets and send them together
12:46 < hjohnson> IPSec and HAIPE certainly don't.
12:47 <@dazo> hjohnson: I don't recall that code path in OpenVPN ... but I think it does that to some degree, but after a time out, it will kick out the packet
12:47 < ScriptFanix> hjohnson: you still have the option to send randomly timed small packets inside the VPN
12:47 < hjohnson> ScriptFanix: sure, and that's what defeats traffic analysis... 
12:48 < krzee> i really think it does combine packets as far as the OUTSIDE of the tunnel sees
12:48 < hjohnson> the only way to make it truely secure is to pad it out so you have a constant bitrate.
12:48 < krzee> but you could sniff your traffic to check
12:48 < hjohnson> krzee: that would defeat the whole point of using udp for voip communications to begin with.
12:48 < hjohnson> you absolutely do not want that queuing delay 
12:48 < krzee> no it would not
12:48 < krzee> not if you dont wait for a delay
12:48 < krzee> you dont have to wait long to allow other packets in
12:49 < krzee> like i said, i could be wrong, but i think thats how it goes, and it looks like dazo thinks so too
12:49 < krzee> best way to know is to test it
12:49 <@dazo> this whole thing is rather complex ... because if you just push out data as soon as you get it ... that will impact streams which might have small gaps in between ... to fill up the MTU makes mostly sense, but not to wait forever for it to fill up
12:49 < ScriptFanix> ping -f tunnel end :)
12:49 < krzee> and since you care, i nominate you to do the testing
12:50 < hjohnson> admittedly I don't know much about how openvpn works in this regard.
12:50 <@dazo> and waiting to fill up MTU, will influence low flow stream, which don't fill up the MTU segment immediately
12:50 < hjohnson> (most of my experience is with ipsec)
12:52 <@dazo> hjohnson: it would be great if you can try to do some analysis here, see how OpenVPN behaves, probably compared against IPSEC ... to see if there are things we can learn from IPSEC
12:52 < hjohnson> the reality is you are leaking information if your bitrates aren't constant.
12:52  * krzee fights off an ipsec joke relating to theo's somewhat recent post
12:53 < hjohnson> ipsec has the same problem.
12:53 < hjohnson> which is the reason for one of the more annoying features on HAIPE gear.
12:53 < hjohnson> you setup a cbr 256kbps encrypted tunnel, it will pad out any traffic so there is a constant, permanent 256kbps stream between the two devices.
12:54 < hjohnson> (or whichever bitrate you want)
12:55 < krzee> sounds like a nice way to add overhead!
12:56 < hjohnson> krzee: it's the only reliable way to defeat traffic analysis
12:56 < hjohnson> even then you have to be very careful to avoid timing attacks
12:56 < krzee> i feal you are mis-uding the world *only*
12:56 < krzee> using*
12:58 < hjohnson> krzee: if you're just adding random noise to the channel (by adding extra, small packets) all you're doing is reducing the SNR.  Sure you can reduce it to the point where it's very hard to extract the original content, but by the time you've gotten that far, you might as well just pad out your traffic.
12:59 < krzee> a small amount of random padding would achieve the same goal, but add (possibly) far less overhead
12:59 < hjohnson> http://openvpn.net/archive/openvpn-devel/2007-06/msg00010.html patch for openvpn to pack packets together.. dunno if it's in the main stream
12:59 <@vpnHelper> Title: [Openvpn-devel] Packing small packets to a bigger packet (at openvpn.net)
13:00 < hjohnson> krzee: it wouldn't completely. it's just adding noise to the system.  It's all statistical analysis
13:03 < krzee> if the noise was steady it would not change anything, if it is NOT steady it would screw up the analysis
13:03 < EugeneKay> I'm a fan of cryptosteganography.
13:04 < EugeneKay> Encode all information into hello.jpg
13:04 < krzee> haha
13:04 < krzee> theres a 1-click solution for stego on osX
13:05 < krzee> its actually pretty nice
13:06 < krzee> haha theres even one for the iphone now!
13:07 < krzee> isteg for osx, istego for iphone
13:08 < krzee> looks like the iphone version is weak tho
13:10 < krzee> iSteg is a frontend for the opensource tool outguess 2.0.
13:14 < hyper_ch> hi krzee :)
13:14 < krzee> not anymore =/
13:14 < krzee> too long of a layover, it wore off
13:15 < hyper_ch> got a minute for ppp0 / iptables?
13:15 < krzee> i dont use ppp or linux, but sure
13:15 < krzee> i have many minutes of boredom ahead of me
13:16 < hyper_ch> krzee: http://pastebin.com/HrFBjew9  --> would that work?
13:16 < hyper_ch> it's for setting up a 3g connection when the dsl goes down
13:16 < hyper_ch> would that mean that the server from where the 3g is started is then handling webserver and mail server traffic?
13:17 < krzee> over the DSL's ip!?
13:17 < krzee> no
13:17 < hyper_ch> no, over 3g
13:17 < hyper_ch> if dsl is down
13:17 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
13:18 < krzee> so people will know to switch to hit the 3g ip?
13:18 < hyper_ch> then attach the stick to the server
13:18 < hyper_ch> of course they will
13:18 < hyper_ch> you'll update the dns
13:18 < hyper_ch> zonefile I mean
13:18 < krzee> with a super low TTL i assume
13:18 < hyper_ch> it is super low :)
13:18 < krzee> note, not everyone honors TTL settings
13:18 < hyper_ch> because it's on a dyndns ip that changes every 24h anyway
13:19 < hyper_ch> dyn ip
13:19 < hyper_ch> but the question is whether the nating / port forwarding for those services is correct
13:19 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
13:19 < krzee> i think so
13:19 < krzee> without actually being someone who uses linux (iptables) it looks decent to me
13:20 < krzee> assuming ppp0 exists when those are loaded...
13:20 < hyper_ch> question is, are they actually even neede
13:20 < hyper_ch> I mean when that machine becomes the router with the established 3g connection
13:21 < hyper_ch> do you still need to portfoward incoming stuff ot its own?
13:21 < krzee> shouldnt be needed
13:21 < hyper_ch> even better
13:21 < hyper_ch> btw, I found a solution for my "cat problem"
13:21 < krzee> no need to nat to itself
13:21 < krzee> what was the cat problem?
13:22 < hyper_ch> didn't I tell you that I train my cats to use the human toilet?
13:22 < krzee> oh
13:22 < krzee> citykitty
13:22 < hyper_ch> citykitty?
13:22 < krzee> http://www.citikitty.com/
13:22 -!- MadTBone [~MadTBone@gw.msmnyc.edu] has joined #openvpn
13:22 <@vpnHelper> Title: CitiKitty® - The Cat Toilet Training Company - America's Favorite Cat Toilet Training Kit - As Seen on CNN, WSJ and More! (at www.citikitty.com)
13:22 < KBobHEMP> i lol'd
13:22 < Essobi> lol
13:23 < krzee> sup kbob
13:23 < krzee> using the socks i see :-p
13:23 < KBobHEMP> i just got up
13:23 < KBobHEMP> yea, freenode
13:23 < hyper_ch> krzee: well, training them to use the toilet is one thing... but it also needs to auto flush https://www.parish-supply.com/autoflush_specifications.htm
13:23 <@vpnHelper> Title: Automatic toilet flusher for tank toilets (at www.parish-supply.com)
13:23 < krzee> yanno on freenode you can register for a cloak (spoof) right?
13:23 < KBobHEMP> yep :P
13:23 < KBobHEMP> comcast gave me 98.x ip, so im locked out of my normal shell
13:23 < KBobHEMP> due to ip restrictions :P
13:24 < krzee> ahh
13:24 < KBobHEMP> and i forget the syntax to add it easily...so ive been lazy
13:24 < KBobHEMP> socks5 is ez
13:24 < KBobHEMP> socks 4 is ezier
13:24 < krzee> yep
13:24 < KBobHEMP> :D
13:24 < krzee> and thats why socks is there ;]
13:24 < KBobHEMP> i just need some wingate passes
13:24 < krzee> wingate, lulz
13:24 < KBobHEMP> then i can hack teh gibs0n
13:25 < KBobHEMP> how u doin?
13:26 < krzee> tired
13:26 < krzee> oh and bored
13:26 < krzee> wishing i had a blunt out here
13:26 < krzee> you?
13:27 < KBobHEMP> but on the bright side, you saved a bunch of money by switching to layovering
13:27 < krzee> haha
13:27 < KBobHEMP> im idling in tf2 whoring new weapons/items
13:27 < KBobHEMP> i got another nametag
13:27 < KBobHEMP> http://wiki.teamfortress.com/wiki/Name_tag
13:27 < krzee> speaking of which... theres a direct flight to melbourne from here... i need to see about switching to that for free
13:27 <@vpnHelper> Title: Name Tag - Team Fortress Wiki (at wiki.teamfortress.com)
13:27 < EugeneKay> Mein Kraft
13:27 < KBobHEMP> krzee: indeed
13:28 < krzee> in fact, brb
13:28 < krzee> gunna check that now
13:28 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:34 -!- dazo is now known as dazo_afk
13:48 < KBobHEMP> we killed the channel
13:49 < hjohnson> lol
13:53 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 240 seconds]
13:53 < kronos003> lets see if im still here
13:54 < kronos003> i just tried another routing config - no dice
13:54 -!- dupondje [~dupondje@laptop-jl-wireless.network.dupondje.be] has joined #openvpn
13:55 < dupondje> Hi, I would like to catch the pushed gateway in a custom up/up-route script. But the var route_vpn_gateway seems empty ?
14:07 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
14:07 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
14:10 -!- KBobHEMP [nobody@hemp.ircpimps.org] has quit []
14:23 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
14:24 < Bushmills> dupondje: try a bash up script, which outputs "${!route_gateway*}" to a temp file, look whether it contains a variable name like route_gateway_1
14:24 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
14:27 < dupondje> mmm bad command substitution ...
14:27 < dupondje> wtf :)
14:28 < Bushmills> bash. not sh
14:29 < dupondje> mmmm :) seems that isn't supported on dd-wrt :P
14:29 < Bushmills> then look at contents of variable $route_gateway_1
14:30 < dupondje> null :(
14:30 < Bushmills> alternatively, output  set | grep "^route_gateway"
14:30 < dupondje> damn
14:32 < dupondje> mmm :s nothing 
14:32 < dupondje> seems like route_gateway isn't set :s
14:34 < dupondje> ok
14:34 < dupondje> had route-nopull
14:35 < dupondje> changed it to route-noexec
14:35 < dupondje> and it works now :D
14:35 < dupondje> thanks
14:37 < Bushmills> wasn't expected. and wasn't what i asked.  
14:37 < Bushmills> looking for a variable with the name route_gateway_*, which the grep would have caught 
14:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:44 < dupondje> Bushmills: route_gayway_* is not set when route-nopull is set
14:45 < dupondje> route-noexec is better option, as then it pull's the route
14:45 -!- fipu [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has joined #openvpn
14:49 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has quit [Ping timeout: 240 seconds]
14:50 -!- dupondje [~dupondje@laptop-jl-wireless.network.dupondje.be] has quit [Read error: Connection reset by peer]
14:55 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has quit [Quit: techqbert]
14:56 -!- Bzek [~SK@access-46-42-36-169.kmtn.ru] has quit [Ping timeout: 264 seconds]
14:57 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has joined #openvpn
15:02 <@vpnHelper> RSS Update - forum: Expected Results Unobtainable! HELP! <http://forums.openvpn.net/topic7692.html#p10018>
15:03 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has left #openvpn []
15:03 -!- gladiatr is now known as gladiatr_afk
15:11 -!- copkille1 is now known as copkiller
15:18 -!- Bzek [~SK@access-46-42-31-38.kmtn.ru] has joined #openvpn
15:28 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 250 seconds]
15:30 -!- DigitalFlux [~DigitalFl@41.69.251.99] has joined #openvpn
15:30 -!- DigitalFlux [~DigitalFl@41.69.251.99] has quit [Changing host]
15:30 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
15:35 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Connection reset by peer]
15:35 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 276 seconds]
15:36 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
15:38 -!- EugeneKay is now known as EugeneKaway
15:42 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
15:43 -!- e-squizo [~fheinz@190.189.199.159] has quit [Quit: Leaving.]
15:43 -!- e-squizo [~fheinz@190.189.199.159] has joined #openvpn
16:02 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p10019>
16:20 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10020>
16:26 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10021>
16:41 -!- EugeneKaway is now known as EugeneKay
16:43 < kronos003> so this is wierd - im watching pings go out and come back in but the ping program isnt getting a response -WTF?
16:50 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
16:58 -!- nebula [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
16:58 -!- nebula is now known as patel
16:59 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has left #openvpn []
16:59 -!- atan2 [~atan@unaffiliated/atan] has joined #openvpn
17:02 -!- e-squizo1 [~fheinz@190.189.199.159] has joined #openvpn
17:03 -!- K4k_ [~K4k@c-24-98-78-253.hsd1.ga.comcast.net] has joined #openvpn
17:04 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
17:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
17:08 -!- Netsplit *.net <-> *.split quits: aef, e-squizo, theDoc, daemon, batrick, nijotz, @patelx, atan, Hamlin, havoc,  (+5 more, use /NETSPLIT to show all of them)
17:08 -!- Netsplit over, joins: daemon
17:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:12 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
17:12 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
17:13 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
17:13 < kronos003>  im marking traffic based on gid and sending it out of the vpn. bit i cant ping anybody. on wireshark i see it going out and coming back in, but the ping command is not getting a response - what am i doing wrong? :: http://pastebin.com/RGVSF1A9 :: looks like i forgot a few important peices of info - looks like the only reason stuff is getting out and getting a reply is that im using snat on my out to show the vpn adapter as the sour
17:13 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
17:14 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
17:14 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
17:14 -!- theDoc [~Link@110.92.103.180] has joined #openvpn
17:17 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
17:17 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
17:23 -!- luneff [~yury@84.51.202.179] has joined #openvpn
17:23 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
17:24 -!- bitterman [~yury@84.51.202.179] has joined #openvpn
17:26 -!- havoc__ is now known as havoc
17:27 -!- luneff [~yury@84.51.202.179] has quit [Ping timeout: 240 seconds]
17:33 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Quit: nijotz]
17:34 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
17:35 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
17:35 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p10022>
17:36 -!- bitterman [~yury@84.51.202.179] has quit [Read error: Connection reset by peer]
17:36 -!- bitterman [~yury@84.51.202.179] has joined #openvpn
17:40 < kronos003> update on my routing issue http://pastebin.com/ieggAjDC
17:42 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p10023>
17:45 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:05 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
18:06 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has joined #openvpn
18:07 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has quit [Remote host closed the connection]
18:09 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has joined #openvpn
18:24 -!- booi [~booi@204.14.158.226] has joined #openvpn
18:24 < booi> hey guys, is there any reason to keep user .{key,crt,csr}'s around? 
18:25 < booi> they aren't required to revoke a certificate right? i generate keys for them because our users aren't technical. for safety it would be best if i could delete them. 
18:25 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
18:26 < EugeneKay> .CSRs aren't needed by anybody, key/cert pairs are needed only for the clients they authenticate
18:27 < EugeneKay> Revocation needs a copy of the cert, for the serial number
18:28 < EugeneKay> Generally it is a good idea to keep a copy of everything with the ca key, just in case.
18:31 < hjohnson> well, truely good crypto practice exempted. :P
18:32 < hjohnson> (ideally the key/cert would be generated on the client, only send the unsigned cert ot the CA, have the CA sign it, and back again, so that the key material is never actually transmitted)
18:32 < EugeneKay> If the security of the CA is compromised, the whole thing should be tossed out anyway
18:32 < hjohnson> i've heard rumors about the lengths that verisign goes through to protect their root certificate (as they should)
18:33 < hjohnson> well, root key
18:34 < EugeneKay> IronKey USB drive and a safety deposit box would do the trick
18:34 < hjohnson> for your average person, sure.
18:35 < EugeneKay> Verisign's problem is still gonna be the same as any company's: malicious employees
18:35 < hjohnson> right, which is why you have to design your processes to make that as difficult as possible.
18:35 < hjohnson> (hence the lengths they go through)
18:35 < EugeneKay> Keeping them at gunpoint usually does the trick
18:35 < EugeneKay> Wait, that's Apple
18:37 < hjohnson> lol
18:37 < hjohnson> IIRC, the root key is kept on a machine that is only accessable via an RS232 connection, maybe even with only the Tx pin hooked up.
18:38 < hjohnson> if I was them, I'd have it setup so that the system holding the root key generates a new sub-key of the day and spits it out.
18:38 < EugeneKay> Apple II powar
18:39 < EugeneKay> I would run it on a Windows 98 box, just for the laughs
18:40 < hjohnson> hah
18:40 < EugeneKay> Hell, I run WIndows 98 on my PHONE for the laughs
18:41 -!- mant1s [~mant1s@130.111.162.10] has joined #openvpn
18:41 -!- mant1s [~mant1s@130.111.162.10] has quit [Changing host]
18:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:43 < booi> EugeneKay, sorry wasn't looking at the screen. So i should keep the .crt's around?
18:43 < EugeneKay> Yes.
18:43 < booi> do i really need to? seems like the serials are kept in index.txt
18:43 < hjohnson> booi: it makes life easier if you have to revoke a key
18:43 < EugeneKay> I don't think there's a revoke command that takes a raw serial number
18:44 < booi> i see. maybe i'll just keep everything around
18:44 < booi> like you said, if the ca is compromised it's game over anyway
18:44 < EugeneKay> Disk space is cheap
18:44 < hjohnson> and keys are small
18:44 < EugeneKay> If you want to make it secure, spend $100 on an Ironkey
18:44 < EugeneKay> Or gpg the directory up when you're not using it
18:44 < booi> i was thinking not on a space issue but on a, what "should" i keep and what should i not keep.
18:45 < hjohnson> booi: I would toss the key, keep the crt
18:45 < hjohnson> admittedly, i'm probably not paranoid enough about my own personal computer security (I just deal with paranoid security in my day to day work)
18:46 < booi> yeah, well this is a small business
18:46 < booi> i'd like to use best practices whenever feasible. 
18:46 < EugeneKay> You don't deal with paranoid security, you deal with idiot security
18:46 < EugeneKay> Paranoid security you can't sidestep by switching to a WiFi network ;-)
18:47 < kronos003> bob2: http://pastebin.com/LNwqSVwm
18:47 < kronos003> oops
18:47 < kronos003> well that link is the latest in my attempt at getting that vpn tunnel stuff working
18:47 < hjohnson> EugeneKay: eh, my own corporate security isn't what i'm talking about
18:48 < hjohnson> you want paranoid? oil, gas, and mineral exploration... they're a hell of a lot more paranoid than the military is.
18:48 < booi> whoops, almost deleted ca.key
18:48 < hjohnson> oops
18:48 < booi> lol. that would have been bad. 
18:49 < booi> either that or.. never turn off the server. 
18:49 < hjohnson> yeah, if you couldn't recover it, new certificates for everyone
18:49 < booi> wonder if you could extract it from memory
18:49 < EugeneKay> GPG copy to the rescue
18:49 < hjohnson> it'd be easier to extract it from the disk
18:49 < EugeneKay> Re-decrypt it
18:50 < EugeneKay> :v
18:50 < booi> hjohnson, yeah. i've never really done that on an ext3 fs before. only windows
18:50 < booi> or i guess.. fat32/ntfs
18:51 < hjohnson> http://en.wikipedia.org/wiki/AN/CYZ-10 old school toy, but better than paper tape for key distribution
18:51 <@vpnHelper> Title: AN/CYZ-10 - Wikipedia, the free encyclopedia (at en.wikipedia.org)
18:51 < hjohnson> just remember to lick the connector before you try to do a key fill
18:51 -!- bitterman [~yury@84.51.202.179] has quit [Quit: Leaving]
18:56 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
19:09 < kronos003> well this is interesting - with 'push "redirect-gateway def1"' engauged, 'ping www.yahoo.com -I tun' gets replies... turn it off and suddenly i dont get the replies - but the packets ARE getting out - WTF?
19:12 < Bushmills> kronos003: did you mention something about DNAT or SNAT earlier on?
19:12 < kronos003> Bushmills: yes but all that is off for this particular test
19:13 < kronos003> none of that got me any closer than i am now
19:13 < Bushmills> remove those rules. if you can ping either with or without redirect-gateway then, your problem is probably related to your SNAT/DNAT rules
19:13 < kronos003> im trying this with no special routes set up other than those set by the tunnel
19:14 < kronos003> redirect gateway=on = ping works as expected - redirect-gateway=off = ping gets there and comes back but not to the ping program (wireshark on the line)
19:14 < kronos003> rechecking to makesure i wipedout all the other rules just to be sure
19:15 < Bushmills> with redirect-gateway off, pinging external sites isn't routed through openvpn, and your problems most likely unrelated to openvpn setup 
19:16 -!- techqbert [~jim@c-68-32-38-158.hsd1.pa.comcast.net] has quit [Remote host closed the connection]
19:16 < kronos003> Bushmills: it should be if i specify the tun0 interface to the ping program
19:16 < Bushmills> then don't
19:17 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
19:17 < kronos003> Bushmills: this is what ive been working on http://pastebin.com/EjCEuN8R
19:18 < kronos003> trying any way i can to make this darn thing work by means OTHER than redirect-gateway for the whole machine
19:18 < Bushmills> ah.
19:19 < Bushmills> this is what i'm going to work on now:  http://scarydevilmonastery.net/snap/1298942314724136067d.png 
19:19 < kronos003> so my question is this. the program KNOWS its sending on tun0. yahoo sees the packets and responds. they make it ALL THE WAY back to tun0. but ping doesnt see the response WTF? btw im doing all of this as root to reduce complications
19:20 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p10024>
19:20 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:20 < kronos003> Bushmills: lol
19:21 < ecrist> sup bitches?
19:25 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:27 -!- kronos003 [~kronos003@206-188-75-41.cpe.distributel.net] has quit [Ping timeout: 240 seconds]
19:28 -!- kronos003 [~kronos003@206-188-75-41.cpe.distributel.net] has joined #openvpn
19:30 < kronos003> so my question is this. the program KNOWS its sending on tun0. yahoo sees the packets and responds. they make it ALL THE WAY back to tun0. but ping doesnt see the response WTF? btw im doing all of this as root to reduce complications
19:42 < hjohnson> kronos003: check your rp_forward
19:42 < hjohnson> kronos003: dollars to doughnuts you're getting burned by spoof protection
20:01 < kronos003> that was it - found it before i saw this
20:02 < kronos003> all is working as planned - ekiga goes down the vpn and all other traffic goes out the local interface - of interesting note, firefox when used as a test app does all its resolving on the local network but sends its traffic down the vpn
20:18 -!- fipu [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has quit [Ping timeout: 272 seconds]
20:52 -!- common- [~common@p5DDA4A11.dip0.t-ipconnect.de] has joined #openvpn
20:56 -!- common [~common@p5DDA4CA4.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
20:56 -!- common- is now known as common
21:03 -!- e-squizo1 [~fheinz@190.189.199.159] has quit [Quit: Leaving.]
21:09 -!- master_of_master [~master_of@p57B53617.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
21:10 -!- kronos003 [~kronos003@206-188-75-41.cpe.distributel.net] has quit [Ping timeout: 240 seconds]
21:10 -!- master_of_master [~master_of@p57B53558.dip.t-dialin.net] has joined #openvpn
21:12 -!- kronos003 [~kronos003@viggo.hefnerlabs.com] has joined #openvpn
21:17 -!- kronos003 [~kronos003@viggo.hefnerlabs.com] has quit [Ping timeout: 264 seconds]
21:17 -!- kronos003 [~kronos003@206-188-75-41.cpe.distributel.net] has joined #openvpn
21:18 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 264 seconds]
21:18 -!- Hamlin [~Hamlin@mountainmorningband.com] has joined #openvpn
21:18 -!- Hamlin [~Hamlin@mountainmorningband.com] has quit [Changing host]
21:18 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
21:32 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
21:32 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
21:32 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
21:42 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
21:45 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
21:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
22:01 <@vpnHelper> RSS Update - forum: clean-all.bat errors <http://forums.openvpn.net/topic7568.html#p10025>
22:02 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:08 -!- EugeneKay is now known as EugeneKaway
22:10 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:17 -!- booi [~booi@204.14.158.226] has quit [Read error: Connection reset by peer]
22:29 -!- TheShadow314 [~weechat@67.228.143.245-static.reverse.softlayer.com] has joined #openvpn
22:29 -!- TheShadow314 [~weechat@67.228.143.245-static.reverse.softlayer.com] has left #openvpn []
22:36 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
22:36 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:41 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 264 seconds]
23:06 -!- openvpn2009 [~a@openvpn/corp/admin/patel] has quit [Quit: ircN 8.00 for mIRC (20080809) - www.ircN.org]
23:15 -!- EugeneKaway is now known as EugeneKay
23:22 -!- EugeneKay is now known as EugeneKaway
23:32 <@vpnHelper> RSS Update - forum: auth-user-pass-verify script on windows <http://forums.openvpn.net/topic7704.html>
23:34 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:36 -!- twister004_ [~chatzilla@117.204.140.52] has joined #openvpn
23:37 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 240 seconds]
23:37 -!- twister004_ is now known as twister004
23:48 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
23:49 -!- twister004 [~chatzilla@117.204.140.52] has quit [Ping timeout: 250 seconds]
23:49 -!- twister004_ is now known as twister004
--- Day changed Tue Mar 01 2011
00:32 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10027>
00:53 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:02 <@vpnHelper> RSS Update - forum: auth-user-pass-verify script on windows <http://forums.openvpn.net/topic7704.html#p10028>
01:13 -!- echoSMIL1 [~censured@bl17-95-152.dsl.telepac.pt] has joined #openvpn
01:14 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 246 seconds]
01:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:23 -!- kronos003 [~kronos003@206-188-75-41.cpe.distributel.net] has quit [Ping timeout: 246 seconds]
01:30 -!- kronos003 [~kronos003@206-188-75-41.cpe.distributel.net] has joined #openvpn
01:30 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
01:32 <@vpnHelper> RSS Update - forum: auth-user-pass-verify script on windows <http://forums.openvpn.net/topic7704.html#p10029>
01:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:59 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 276 seconds]
01:59 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
02:13 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 264 seconds]
02:20 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
02:24 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 272 seconds]
02:31 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
02:32 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10030>
02:38 <@vpnHelper> RSS Update - forum: Connect ok but I get a lot of econnrefused and ehostunreach <http://forums.openvpn.net/topic7703.html#p10031>
02:44 -!- dazo_afk is now known as dazo
03:01 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
03:01 < MaxFrames> hello
03:03 < MaxFrames> I am following the official howto to install and set up openvpn on Debian  (http://openvpn.net/index.php/open-source/documentation/howto.html), and I've just finished creating the ca, server and client keys and certificates. In the "keys" subdirectory I can find all the files detailed in the howto, but also other files which the howto does not mention
03:03 <@vpnHelper> Title: HOWTO (at openvpn.net)
03:04 < MaxFrames> namely, there are two .CSR files (one for the server, and one for the client I've created), and also two .PEM files called 01.pem and 02.pem
03:05 -!- fruia [9e6e2bfa@gateway/web/freenode/ip.158.110.43.250] has joined #openvpn
03:05 < MaxFrames> I understand that CRT is the certificate (public key) and KEY is the private key; I understand that dh1024.pem is the file with the Diffie-Hellmann parameters for the server, but I don't know what the csr files and the two additional pem files are
03:06 <@dazo> MaxFrames: the 0[12].pem files are related to the CA itself ... that's its own copy of the different certificates being created
03:06 < fruia> hi guys, i've this client config http://pastebin.com/WdKFSqmT why it asks for proxy authentication?
03:06 <@dazo> the *.csr files are "Certificate Signing Request" files
03:07 < MaxFrames> so they all must reside on the server, right?
03:07 < MaxFrames> i.e. the client just needs its two crt and key files?
03:07 <@dazo> The process (which pki-tool "hides" for you) is that the private and public key is generated, then it creates a CSR, which the CA signs and then generates a CRT file 
03:08 < fruia> also logs says: ERROR: username from HTTP Proxy authfile is empty.. but i haven't specified any proxy auth.. 
03:08 <@dazo> MaxFrames: yes, in fact all those files in the CA directory can stay on a box not connected to any network at all
03:08 <@dazo> MaxFrames: the client needs ca.crt, client.crt and client.key ... the server needs ca.crt, server.crt and server.key
03:09 <@dazo> the only thing they share is the ca.crt, which is the so-called trusted third party, which they use to validate that the certificate of the other side is valid
03:09 <@dazo> (valid == the certificate is issued by a trusted third party ... which is the CA)
03:10 < MaxFrames> OK, understood. all the other files can be moved from the machine I used to generate the lot (which will act as the server) to an offline location because they will not normally be accessed
03:10 < MaxFrames> I hope that's correct
03:10 <@dazo> MaxFrames: correct!
03:10 < MaxFrames> thanks
03:11 <@dazo> The most valuable file in such a setup is the ca.key and it's password ... in the moment you get a "wild copy" of that file, all your certificates can no longer really be trusted
03:11 < fruia> auth are asked even before connecting so i don't think that server config is important..
03:11 <@dazo> as someone else can issue new certificates, posing as your CA
03:11 <@dazo> fruia: please read !welcome
03:11 <@dazo> !welcome
03:11 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:12 <@dazo> in particular, read !logs carefully
03:12 < fruia> !logs
03:12 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
03:12 <@dazo> and !configs as well ... we usually don't read config files with so much comment stuff
03:15 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 272 seconds]
03:15 < fruia> so, client logs http://pastebin.com/aMCcuUkP, client config, http://pastebin.com/ty9ZXasj
03:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
03:16 < MaxFrames> dazo: I'm now a bit confused about the ca.key file's password: when I created it (as per the howto) I was not prompted to enter a password (the only password I entered was for the client.key because I chose to use build-key-pass)
03:16 < MaxFrames> I used the ./build-ca command
03:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:17 <@dazo> MaxFrames: hmm ... I must admit I haven't used the easy-rsa tools in many years (I'm using xca and tinyca2 mostly) ... so if there are no password on your ca.key ... then you need to be even more careful with that file
03:17 <@dazo> it is possible to have keys without any passwords
03:17 <@dazo> also ca.key
03:18 < fruia> server log http://pastebin.com/paupctJj server config http://pastebin.com/GsdaeZRV
03:18 < MaxFrames> maybe I should start over and use some command like "./build-ca-pass" (if it exists at all)
03:19 < MaxFrames> in the light of all this (and other glitches I noticed yesterday), I must say that this official howto is particularly lacking, I'd better find another
03:19 < fruia> i don't get why on client logs there are some http_proxy setting that aren't set on the config..
03:22 < fruia> dazo: need anything else?
03:23 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 264 seconds]
03:23 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
03:23 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p10032>
03:23 <@dazo> fruia: you have something setting the proxy somewhere somehow ... or you are not starting with the right config file ...
03:23 <@dazo> #
03:23 <@dazo> Tue Mar 01 10:13:12 2011 us=384000 BEGIN http_proxy
03:23 <@dazo> #
03:23 <@dazo> Tue Mar 01 10:13:12 2011 us=384000   server = 'vpn.itshidden.com'
03:24 < fruia> dazo: yeah i've seen those lines, i've put the client.ovpn file into the config dir, it's read because the remote settings are there..
03:25 <@dazo> fruia: If using openvpn-gui, make sure you have not enabled proxy via the GUI settings
03:25 <@dazo> or try to start openvpn from the command line (as administrator)
03:25 < fruia> oh... there are... set by default? it's a fresh install
03:26 < fruia> sorry for that stupid question so.. thank you
03:26 <@dazo> I don't know how that's set ... I don't know anything about Windows at all
03:26 < fruia> i'm used on lin too.. it's not my pc
03:26 < fruia> btw thank you for your help..
03:26 -!- fruia [9e6e2bfa@gateway/web/freenode/ip.158.110.43.250] has quit [Quit: Page closed]
03:28 < Rienzilla> hmm
03:28 < Rienzilla> if pings from one client on my vpn to another client on the vpn resultin icmp ttl expired replies from the main router, what did I dod wrong?
03:43 -!- DigitalFlux [~DigitalFl@213.229.74.196] has joined #openvpn
03:43 -!- DigitalFlux [~DigitalFl@213.229.74.196] has quit [Changing host]
03:43 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
03:46 < MaxFrames> the command ./build-ca-pass does not seem to exist in my setup... I wonder how do I create a CA with easy-rsa so that the CA.key file is password protected
03:52 < MaxFrames> maybe that is not allowed at all with easy-rsa
03:52 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10033>
03:57 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 250 seconds]
03:58 -!- twister004 [~chatzilla@117.204.131.156] has joined #openvpn
03:58 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10035> || All clients get same IP? <http://forums.openvpn.net/topic7705.html>
04:01 -!- twister004_ [~chatzilla@117.204.133.228] has joined #openvpn
04:03 -!- twister004__ [~chatzilla@59.90.34.167] has joined #openvpn
04:04 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p10038> || All clients get same IP? <http://forums.openvpn.net/topic7705.html#p10037> || Ping only at the opening of VPN <http://forums.openvpn.net/topic7645-15.html#p10036>
04:04 -!- twister004 [~chatzilla@117.204.131.156] has quit [Ping timeout: 252 seconds]
04:04 -!- twister004__ is now known as twister004
04:07 -!- twister004_ [~chatzilla@117.204.133.228] has quit [Ping timeout: 240 seconds]
04:10 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10040> || Connect ok but I get a lot of econnrefused and ehostunreach <http://forums.openvpn.net/topic7703.html#p10039>
04:17 -!- twister004_ [~chatzilla@117.204.131.91] has joined #openvpn
04:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
04:18 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 264 seconds]
04:18 -!- twister004_ is now known as twister004
04:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:19 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
04:19 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
04:19 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:20 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:23 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p10041>
04:25 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
04:28 -!- twister004 [~chatzilla@117.204.131.91] has quit [Ping timeout: 276 seconds]
04:28 -!- twister004_ is now known as twister004
04:31 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:31 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:31 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:48 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 252 seconds]
04:51 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
04:57 <@dazo> MaxFrames: see this one for setting CA password: http://grid.ui.ac.id/blog/2007/03/23/how-change-private-keys-password
04:58 <@vpnHelper> Title: How to change private keys password | Grid Computing Research Group (at grid.ui.ac.id)
04:58 <@dazo> MaxFrames: give this openssl command your ca.key file
05:04 < MaxFrames> dazo: thanks; will this ask me for a password then?
05:06 <@dazo> MaxFrames: It will encrypt the key file, which needs a password to be used later on
05:07 < MaxFrames> OK, thanks very much
05:07 <@dazo> but it will create a "new" file, which is encrypted ... you can then delete/shred the old unencrypted key
05:08 < MaxFrames> I assume this can also be done on the server.key file (which also easy-rsa does not allow to password protect)
05:09 <@dazo> MaxFrames: that's correct
05:09 < janjust> MaxFrames:  the 'build-key-server' script is a wrapper for 'pkitool --interact --server' 
05:09 < MaxFrames> the only key file which easy-rsa can password protect is client.key
05:09 < janjust> to add password support you could do 'pkitool --interact --server --pass <serverkeyname>'
05:10 < MaxFrames> after I've created server.key?
05:10 < janjust> MaxFrames:  the only key which a handy wrapper is provided for is the build-key-pass *client* cert/pass indeed
05:10 < janjust> if the server.key is already created you can change the password using 'openssl rsa userkey.pem -des3 -out userkey.pem.new'
05:11 < janjust> (as listed on the page dazo posted)
05:12 -!- niobos [~niobos@hackerspace.be] has joined #openvpn
05:14 < niobos> !welcome
05:14 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:14 < niobos> !goal
05:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:15 < niobos> I'm trying to debug an openVPN problem, but my Google-foo is failing me. I was hoping you guys might be able to help (or start to flame me, I'll take that risk)
05:16 < janjust> hi niobos , what's the problem
05:16 < niobos> We use OpenVPN over TCP/443 (I know UDP is technically better, but TCP/443 gets us through firewalls much easier)
05:16 < niobos> The connection works fine
05:16 < niobos> but from time to time, the clients disconnect
05:16 < niobos> Server side tells me "connection reset"
05:17 < niobos> client side shows: Authenticate/Decrypt packet error: packet HMAC authentication failed
05:17 < niobos> Fatal decryption error (process_incoming_link), restarting
05:17 < niobos> I seem to be able to trigger this problem by pumping lots of data through the tunnel
05:17 < niobos> then after 10 to 20 minutes, the problem usually apears
05:17 < niobos> It happens on both Mac and Windows clients
05:18 < niobos> so I don't think it's a client-side OS issue
05:18 < janjust> interesting problem... hmmm, I wonder what happens if you do not use 'tls-auth' 
05:18 < janjust> because I assume you're using 'tls-auth' , otherwise you would not see HMAC issues
05:19 < niobos> unless tls-auth is on by default, grep tls conffile returns nothing
05:19 < janjust> ah, no it is not on by default
05:20 < niobos> maybe also noteworthy: The client successfully reconnects after that error
05:20 < niobos> but after a few minutes (3 in my most recent test), it gets the exact same error and reconnects again
05:20 -!- IOhannes [~zmoelnig@umlaeute.mur.at] has joined #openvpn
05:21 < IOhannes> !welcome
05:21 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:21 < IOhannes> !goal
05:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:21 < niobos> and to be completely honest, and to hint the topic: there is a firewall in between
05:22 < niobos> but since the connection starts and works for 10+ minutes, I'm fairly confident that that part works
05:22 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:22 < janjust> niobos:  I figured as much ;  can you try running things like 'ping -f -l 1472 <VPN IP>' (windows ping , set DON'T FRAGMENT flag)
05:23 < IOhannes> hi; i have an openVPN configured to allow my clients to connect to the local LAN from the world; it is configured to use username/password authentication (rather than client/certificates), using auth-ldap; and almost everything is working so far
05:23 < niobos> I'm on a Mac, but I can send a DF-flagged ping
05:23 < IOhannes> the only remaining thing is: persistant IPs!
05:23 < niobos> let me try
05:23 < IOhannes> it seems like a) my ipp.txt (ifconfig-pool-persist) is never updated 
05:24 < janjust> IOhannes:  using an ipp.txt file is the *third* recommended way for assigning persistent IPs
05:24 < janjust> the preferred methods are client-connect and learn-address scripts
05:24 < janjust> or perhaps a client-configuration file
05:24 < IOhannes> oha, 
05:24 < janjust> the ipp.txt file is updated only every 10 minutes , unless you specify an extra parameter
05:25 < janjust> but even with an ipp.txt file there is no guarantee that the assigned IPs are persistent
05:25 < niobos> janjust: I can ping through the tunnel up to 1472+8 bytes
05:25 < janjust> niobos:  good, so it's not an mtu issue... which cipher are you using? standard BF-CBC?)
05:26 < niobos> no cipher configured, so the default
05:27 < janjust> ok; are you seeing any replay warnings on the server?
05:28 < niobos> janjust: fyi, the server config is here: http://pastebin.com/FBTQrMWm
05:28 < IOhannes> janjust: skimming through the docs for e.g. learn-address, it seems like it will still give me a small problem: the common-name is not unique for multiple connections of a single user
05:28 < Bushmills> !ccd
05:28 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
05:28 < niobos> I'm not sure at what verbosity level the replay's show up
05:28 < niobos> I'm at verb 3, and don't soo any
05:28 < niobos> s/soo/see/
05:28 < janjust> IOhannes:  you can use 'username-as-common-name' for that
05:29 < janjust> niobos:  try increasing to 'verb 5'  ; I've just read your server config: I see you are using port-sharing
05:29 < Bushmills> there is --duplicate-cn
05:29 < janjust> can you try disabling that
05:30 < janjust> Bushmills:  he says he's using username+password auth 
05:30 < IOhannes> janjust: yea, but since one user always uses their same name, this will not be unique, if they connect multiple times
05:30 < Bushmills> oh. did he.
05:30 < IOhannes> but i'll have a look at duplicate-cn anyhow
05:30 < Bushmills> indeed
05:30 < janjust> IOhannes:  if you're using username+password *AND* a user can connect multiple times then you can *NEVER* assign persistent IPs
05:30 < janjust> it's simply not possible
05:31 < niobos> janjust: disabled port-sharing and re-running my test. This will take 10+ minutes until I can answer
05:31 < janjust> niobos:  I'll read your results after lunch then ;-)
05:32 < IOhannes> i understand the underlying problem (i cannot assing the persistant IPs multiple times)
05:32 < niobos> good, you're in the same timezone as I am, I'm about to take lunch as well
05:32 < IOhannes> but i'd like something like: "if the user connects and 'their' IP is free, take that, else take a new one"
05:32 < IOhannes> and me as well, btw :-)
05:33 < Bushmills> where does the need to connect multiple times as the same user come from?
05:33 < janjust> IOhannes:  the 'ifconfig-pool-persist' is about as close as you will get; otherwise you'd have to set up your own client-connect or learn-address script, where you can assign the "available" IP yourself
05:33 < bauruine> test
05:34 < niobos> hmm, good/bad news: it just restarted again, with the same errors (HMAC auth failed, decrypt error)
05:34 < IOhannes> janjust: it seems like client-connect/learn-address script shan't be too hard
05:34 < niobos> so either the timing is not predictable, or the disabling of port-sharing just made it worst
05:34 < niobos> I'm guessing it will be the first
05:34 < janjust> hehe me too, niobos 
05:35 < IOhannes> however, it would be nice to have some more info in the scripts, e.g. the MAC-address of the client....
05:35 < janjust> IOhannes:  the MAC address of the client is available only when you use 'dev tap' mode
05:35 < janjust> and then you get only the MAC address of the client TUN/TAP adapter
05:35 < niobos> but either case, the problem persists...
05:35 < IOhannes> janjust: oh, it happens that i run openVPN in tap-mode
05:36 < IOhannes> the idea is, to get some info on the client-machine
05:36 < janjust> niobos:  just for debugging, try disabling encryption altogether
05:36 < IOhannes> hopefully the mac of the tap would be sufficient for this
05:36 < janjust> IOhannes:  remember that it is always possible to fake a mac address
05:36 < IOhannes> if there _are_ clashes, then one would have to deal with them....
05:36 < IOhannes> i'm aware of that, but it seems like the chances are low
05:37 < niobos> do I re-enable port-sharing? of leave it off?
05:38 < IOhannes> my idea was to simply provide "sane default" IP-addresses
05:38 < janjust> hmmm niobos , I'd say that that should not matter too much
05:38 < janjust> IOhannes:  in that case, use a 'learn-address' script on the server side; when a client connects this script is called with several parms, the first one being "add" , the second one being the client's tap MAC address
05:39 < janjust> (and the third is the client common-name or username)
05:39 < IOhannes> thanks, a lot; i'll try that
05:40 < niobos> janjust: ok, I'll have to setup a seperate openvpn config anyway, since current clients will refuse to connect because of a config mismatch (unless I'm missing something)
05:40 < janjust> IOhannes:  I'd recommend to start out with the stupidest of stupid learn-address scripts, e.g. just do "echo $@" (if your server is unix-like based)
05:41 < janjust> niobos:  yes, that is correct, it'd have to be a separate server config, coz otherwise existing clients will freak out
05:43 < niobos> rightfully freak out, IMHO
05:43 < janjust> absolutely
05:44 < janjust> but HMAC failures suggest that packets get tampered with somewhere in between... 
05:44 < janjust> that's worrisome
05:45 < niobos> janjust: I figured that much, but I deemed that pretty much impossible, because TCP would not pass on corrupted packets to the openvpn client/server
05:45 -!- adawda is now known as sia^pwnnt
05:45 < janjust> well, a firewall can change a packet and decide to update the TCP checksum as well 
05:45 < niobos> true
05:45 < niobos> but only after 10+ minutes?
05:46 < janjust> my guess would be that the firewall is doing some kind of filtering: when a certain string is present in the packet the packet is dropped or altered
05:47 < janjust> you'd have to run a packet analyzer on both ends , with timestamp recording and synchronized clocks, and then compare the packets right before the HMAC errors occur
05:47 < niobos> it's linux iptables. I have a lot of experience with that, and never seen this (which does not prove that it's impossible)
05:48 < janjust> depends a bit on the packets... perhaps packets are being mangled? SNAT? DNAT?
05:49 < niobos> possibly SNAT or DNAT, but that will only change the IP-layer, no the TCP-data?
05:49 < janjust> yep
05:49 < janjust> another option is something as trivial as a bad networking cable
05:49 < niobos> synchronized tcpdump's are possible, but are a lot of work: 10+ minutes at 100Mbps is a LOT of pcap files!
05:50 < janjust> niobos:  yep, I know :-S ... 
05:50 < niobos> networking cable: that will result in CRC errors at the ethernet layer, yielding a TCP-retransmit
05:50 < niobos> unless you're really lucky to have the CRC and checksums work out...
05:50 < niobos> anyway, I'm setting up my cipher=none setup
05:50 < janjust> it *should* result in that, I agree 
05:51 < niobos> and I agree totally that *should* and *does* are two totally seperate things
05:52 < niobos> ok, it's up and pumping bytes.. Now we play the waiting game until the error shows up ;-)
05:52 < janjust> you're looking at random data corruption at a very low level ... there is a good reason why openvpn decides to drop packets with a bad HMAC signature
05:52 < niobos> In the mean time, I'd like to thank you already very much!
05:52 < janjust> no prob
05:53 < niobos> I'm just wondering, how would disabling cipher help to determine that?
05:53 < janjust> another thing to try would be to set up a client with a certificate - I see you're using 'client-cert-not-required' ; perhaps the ldap auth setup is causing intermittent problems
05:54 < janjust> by disabling the cipher you will have gotten rid of the HMAC errors (if I understand OpenVPN encryption correctly)
05:54 -!- MaxFrames [~MaxFrames@147.162.217.235] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc Insomnia 4.0.2, revision: 4744, sources date: 20100627, built on: 2010-08-01 17:01:07 UTC 4744 http://www.kvirc.net]
05:54 < janjust> but perhaps you will see a different error during your transfer tests now, which may lead to the real cause of the problem
05:54 < niobos> LDAP-problems are possible... but I don't see how they can cause HMAC errors? they can cause user-authentication problems
05:55 < niobos> hmm, shouldn't I disable auth instead of cipher to get rid of the HMAC's?
05:56 < janjust> an encrypted connection is set up based on several parameters, including server's dh1024.pem file, the server cert+key and also the client cert+key ; if you're not using a client cert+key this could affect the encryption
05:56 < niobos> true
05:56 < janjust> niobos:  good point... let's wait for this test-run and then re-run with --cipher none --auth none
05:56 < niobos> but then again: the crypto works fine for 10+ minutes...
05:56 < niobos> indeed
05:56 < niobos> and I'll eat my sandwich in between ;-)
05:57 < janjust> hehe I'll be back in 30 minutes or so
05:57 < janjust> enjoy your lunch
05:57 < niobos> thx and enjoy your lunch as well
05:58 -!- EugeneKaway [EugeneKay@eugenekay.com] has quit [Ping timeout: 250 seconds]
06:02 -!- EugeneKaway [EugeneKay@eugenekay.com] has joined #openvpn
06:13 < niobos> janjust: I don't know if you're back already. My tunnel is up for 24' and counting... So either the problem cipher related, or it just takes longer this time...
06:18 -!- theDoc [~Link@110.92.103.180] has quit [Read error: Connection reset by peer]
06:19 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
06:20 < Fleck> i have to enable promisc on br0 too... is this normal?
06:23 < niobos> janjust: I gave up after 30'. I'm retrying with bf-cbc now, to see if I can reproduce it with the original settings. If not, we have an additional parameter in this which I need to identify first
06:29 -!- ahmedelgamil [~DigitalFl@41.237.73.195] has joined #openvpn
06:29 < Fleck> ecrist online?
06:32 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 260 seconds]
06:42 -!- theDoc [~Link@unaffiliated/thedoc] has joined #openvpn
06:50 < janjust> <<< back 
06:51 < janjust> niobos:  you can also try it with just '--auth none' but it's not really the proper way to run a production service
06:51 < niobos> janjust: I'm not very sure about the reproducability of my experiment, but just received a different error
06:51 < niobos> and as much as I hate to admit it, you're probably right
06:51 < niobos> WARNING: Bad encapsulated packet length from peer (4023), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attemping restart...]
06:52 < janjust> ah interesting, let's see where this is triggered in the code ("use the source, Luke")
07:00 -!- theDoc [~Link@unaffiliated/thedoc] has quit [Ping timeout: 240 seconds]
07:01 -!- theDoc [~Link@110.92.103.180] has joined #openvpn
07:06 < niobos> janjust: ok, my preliminary results and conclusions:
07:07 < niobos> When connected through the firewall, I get connection errors after 10 to 20 minutes (4' and 15' in my test) of (active) connectivity
07:07 < niobos> when connected without the firewall, I don't receive any error after 30'
07:08 < niobos> so I'm afraid I have to admit to the /topic
07:08 < niobos> do you guys happen to know a program to test a TCP connection? i.e. just send random bytes and *verify* them?
07:11 < janjust> niobos:  I'd use something like 'netcat' (nc) or socat and simply run md5sum on both ends
07:11 < janjust> e.g. generate a file first on one end, md5sum it, then run 'nc' to transfer it and pipe the bytes through  md5sum again
07:15 < niobos> janjust: That was what I was thinking of
07:15 < niobos> but I hoped there would be a program that would be more detailed: *which* block of data is corrupt
07:16 < niobos> and I was hoping to find out that it's the binary representation of my IP that would get NATed in the middle of the packet
07:20 -!- dvrvm [~dvrvm@zux221-181-176.adsl.green.ch] has joined #openvpn
07:20 < dvrvm> hi. is there any replacement for the HKLM/SOFTWARE/OpenVPN-GUI allow_service / service_only keys on Win 7 Pro?
07:23 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10042>
07:24 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Operation timed out]
07:26 -!- atan2 [~atan@unaffiliated/atan] has quit [Read error: Connection reset by peer]
07:27 -!- atan2 [~atan@unaffiliated/atan] has joined #openvpn
07:28 -!- albech [~thomas@61.7.136.198] has joined #openvpn
07:31 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
07:31 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 272 seconds]
07:32 -!- stony is now known as Guest45294
07:34 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
07:36 < janjust> dvrvm:  do you mean win7 64bit? the 32bit registry keys are located elsewhere on win 64bit
07:38 -!- majuk [~majuk@cpe-70-112-3-105.austin.res.rr.com] has quit [Read error: Connection reset by peer]
07:41 <@vpnHelper> RSS Update - forum: OpenVPN client on XP as router?? <http://forums.openvpn.net/topic7706.html>
07:45 < ecrist> Fleck: now I am
07:45 < Fleck> ecrist :) cool, have question...
07:45 < Fleck> i needed to set up promisc mode to bro too
07:45 < Fleck> is that ok?
07:46 < ecrist> bro?
07:46 < Fleck> br0
07:46 < Fleck> allways thought i need to set up promisc for phisical interface and taps...
07:46 < Fleck> not bridge interface itself
07:46 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10045>
07:48 < ecrist> well, I can't answer that, remember, I'm not a linux guy.
07:49 < Fleck> ohh
07:49 < ecrist> although, doing it on the physical interface is the right way to do it
07:49 < Fleck> i did it on the physical, tap and also bridge
07:50 < Fleck> w/o bridge - some nat iptables rules was not working :D
07:50 < Fleck> thou routering worked great
07:50 < Fleck> *routing
07:53 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10047> || OpenVPN client on XP as router?? <http://forums.openvpn.net/topic7706.html#p10046>
07:59 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10048>
08:01 -!- theDoc [~Link@110.92.103.180] has quit [Read error: Operation timed out]
08:03 < dvrvm> janjust: my win is win 64 bit, yes
08:04 -!- theDoc [~Link@110.92.103.180] has joined #openvpn
08:05 <@vpnHelper> RSS Update - forum: All clients get same IP? <http://forums.openvpn.net/topic7705.html#p10051> || OpenVPN client on XP as router?? <http://forums.openvpn.net/topic7706.html#p10050> || dynamic IP <http://forums.openvpn.net/topic7700.html#p10049>
08:09 -!- WormFood [~wormfood@183.15.98.107] has joined #openvpn
08:11 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10053> || OpenVPN client on XP as router?? <http://forums.openvpn.net/topic7706.html#p10052>
08:15 < dvrvm> janjust: i can't find OpenVPN-GUI keys neither with the 32bit registry editor nor with the 64bit editor under Wow6432Node.
08:17 < janjust> dvrvm:  hold on, lemme fire up my win64 laptop
08:17 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10057> || OpenVPN client on XP as router?? <http://forums.openvpn.net/topic7706.html#p10056> || All clients get same IP? <http://forums.openvpn.net/topic7705.html#p10055> || What can OpenVPN do for my need? <http://forums.openvpn.net/topic7691.html#p10054>
08:23 <@vpnHelper> RSS Update - forum: All clients get same IP? <http://forums.openvpn.net/topic7705.html#p10059> || dynamic IP <http://forums.openvpn.net/topic7700.html#p10058>
08:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
08:29 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700.html#p10060>
08:35 <@vpnHelper> RSS Update - forum: All clients get same IP? <http://forums.openvpn.net/topic7705.html#p10061>
08:41 -!- niobos [~niobos@hackerspace.be] has quit [Quit: leaving]
08:45 -!- DigitalFlux [~DigitalFl@213.229.74.196] has joined #openvpn
08:45 -!- DigitalFlux [~DigitalFl@213.229.74.196] has quit [Changing host]
08:45 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
08:46 -!- ahmedelgamil [~DigitalFl@41.237.73.195] has quit [Ping timeout: 240 seconds]
08:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
08:56 -!- ahmedelgamil [~DigitalFl@41.237.73.195] has joined #openvpn
08:59 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 250 seconds]
09:00 -!- EugeneKaway is now known as EugeneKay
09:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:06 < janjust> dvrvm:  on my win7 64bit laptop I see the OpenVPN-GUI keys under HKLM\Software\Wow6432Node
09:12 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700-15.html#p10062>
09:20 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:24 -!- DigitalFlux [~DigitalFl@213.229.74.196] has joined #openvpn
09:24 -!- DigitalFlux [~DigitalFl@213.229.74.196] has quit [Changing host]
09:24 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
09:26 -!- ahmedelgamil [~DigitalFl@41.237.73.195] has quit [Ping timeout: 272 seconds]
09:35 < dvrvm> janjust: hm. i don't. i just have the "OpenVPN" keys
09:41 < janjust> dvrvm:  is the OpenVPN GUI package installed properly? can you try re-installing the *community* edition of OpenVPN using the installer from the *community* part of the openvpn.net website
09:42 -!- dazo is now known as dazo_afk
09:44 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
09:45 -!- Guest45294 is now known as stony
09:50 < dkr> I've got a user using a windows client who told me he had to keep restarting his connection.  So I asked him to bump up the log level and send me the logs.  the bizarre thing is that there is nothing strange in the log.  RwRwrW etc showing normal traffic,  a couple normal replay-window backtrack messages only going up to 7, and more normal traffic, then nothing, it just stops no error mesages at all and his connection is dead until he stops and starts ovpn client
09:51 < janjust> is this a windows vista/7 user?
09:51 < dkr> I think he used log level of 5,  I'll have him bump it up more.  but I'm a bit perplexed to see nothing,  I thought at least there would be ping timeout or something like that
09:51 < janjust> ask the user to do a 'route print' in a CMD window after the connection has stopped
09:52 < janjust> most likely the routes to the OpenVPN network have vanished due to a DHCP update
09:52 < dkr> no, xp i think.  at last the log shows C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1  which i think is xp, not vista.  not too familiar with windows
09:52 < janjust> the log message is bogus, basically , it could be either xp , vista or 7
09:53 < dkr> ah, ok.  that's a good idea to check the routign info.  but I don't think thatis the issue because he said he can't even get to google, and one of the defaults ovpn is adding is a default route to use the vpn
09:53 < janjust> also sounds like the server is pushing out "push redirect-gateway def1" , correct?
09:53 < dkr> if dhcp overrode it he would get to net using normal gw rather than vpn
09:53 < janjust> not sure about that - have the user check the routing table and post the output
09:53 < dkr> yeah,  although I was just thinking that seems abit silly and was planning to change i
09:53 < dkr> it
09:54 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
09:54 < pyther> Hello
09:55 < pyther> I was wondering when we migth see a stable 2.2 release?
09:55 < EugeneKay> Sometime between the cows coming home and pigs taking flight
09:55 < janjust> hy pyther , the person who can tell you is AFK
09:56 < dkr> pyther: "when it's ready" is the canonical answer. :)
09:56 < pyther> I figured dkr
09:56 < janjust> but release 2.2 will be here "Real Soon Now"
09:56 < pyther> is there sometime of timeline, a weeks, months, years....
09:57 < pyther> Just trying to plan some upgrade work
09:57 < janjust> I'd hope weeks; the original deadline was march 8th, IIRC
09:58 < pyther> ahh ok cool :)
09:58 <@vpnHelper> RSS Update - forum: FreeRadius & MySql <http://forums.openvpn.net/topic7707.html#p10064>
10:02 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
10:03 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:05 -!- WormFood [~wormfood@183.15.98.107] has quit [Ping timeout: 260 seconds]
10:17 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
10:17 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 272 seconds]
10:18 < EugeneKay> Oooooh, loosk like 2.2 is going to maybe work with IPv6
10:18 -!- WormFood [~wormfood@183.39.80.33] has joined #openvpn
10:18 -!- DigitalFlux [~DigitalFl@41.237.73.195] has joined #openvpn
10:18 -!- DigitalFlux [~DigitalFl@41.237.73.195] has quit [Changing host]
10:18 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
10:19 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:22 <@vpnHelper> RSS Update - forum: FreeRadius & MySql <http://forums.openvpn.net/topic7707.html#p10065>
10:22 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 240 seconds]
10:26 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:28 <@vpnHelper> RSS Update - forum: FreeRadius & MySql <http://forums.openvpn.net/topic7707.html#p10066>
10:52 -!- dvrvm [~dvrvm@zux221-181-176.adsl.green.ch] has quit [Ping timeout: 252 seconds]
10:52 -!- copkille1 [~o2@unaffiliated/spice] has joined #openvpn
10:53 -!- copkiller [~o2@unaffiliated/spice] has quit [Read error: Operation timed out]
11:05 -!- Bzek [~SK@access-46-42-31-38.kmtn.ru] has quit [Read error: No route to host]
11:17 -!- luneff [~yury@84.51.202.179] has joined #openvpn
11:24 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:27 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Connection reset by peer]
11:27 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
11:28 -!- stony is now known as Guest35756
11:32 -!- Ritche [~ritche@222.127.173.175] has joined #openvpn
11:32 -!- Ritche [~ritche@222.127.173.175] has quit [Changing host]
11:32 -!- Ritche [~ritche@shellium/member/soulesss] has joined #openvpn
11:32 < Ritche> hello what should i put here server 10.9.0.0 255.255.255.0 at the server.conf
11:32 < Ritche> if i have my own dedicated box
11:33 < Ritche> if i use that i am able to connect to vpn but
11:33 < Ritche> i cant browse
11:33 < Ritche> i cant connect to internet anymore
11:33 -!- pyther [~pyther@unaffiliated/pyther] has quit [Quit: Lost terminal]
11:35 < Bushmills> !redirect
11:35 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
11:36 -!- TheSilentTechie [~TheSilent@dslb-088-065-131-159.pools.arcor-ip.net] has joined #openvpn
11:38 < Ritche> same 
11:38 < Ritche> i did push "redirect-gateway"
11:38 < Ritche> and still the same no internet
11:38 < Ritche> !ipforward
11:38 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
11:40 < Ritche> anyone could help ?
11:40 < EugeneKay> !configs
11:40 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
11:41 < Ritche> all dead?
11:43 < EugeneKay> Lunch hour.
11:44 < Bushmills> Ritche: you don't have internet *because* you pushed redirect-gateway, but probably neglected to !ip_forward and !nat
11:48 < Ritche> so what is my server.conf settings should do ?
11:48 < Bushmills> !redirect-gateway
11:48 < Bushmills> read that
11:48 < EugeneKay> !factoids
11:48 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
11:49 < EugeneKay> ^
11:49 < Ritche> where what to read?
11:49 < Bushmills> ehm
11:49 < Bushmills> !redirect
11:49 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
11:49 < Bushmills> that
11:49 < Ritche> and the solution where?
11:50 < Ritche> and server-bridge dont work
11:50 < Ritche> Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/server.conf:9: server-bridge (2.2-beta5)
11:50 < Bushmills> did you manage to read that?
11:50 < Ritche> yes 
11:50 < Bushmills> did you also do what it suggests?
11:51 < Ritche> the hard part is it doesnt have guide on how to do that
11:51 < Ritche> heh
11:51 -!- mirco [~mirco@tmo-107-135.customers.d1-online.com] has joined #openvpn
11:51 < Bushmills> you know that you can enter those terms, starting with !, in here?
11:51 < Ritche> !server-bridge
11:51 < Ritche> !ipforward
11:51 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
11:52 < Ritche> !linipforward
11:52 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
11:52 < Ritche> yeah dont that
11:53 < Bushmills> anything else you have done, besides ip forwarding and adding redirect-gateway?
11:55 < Ritche> ill show u my conf
11:55 < Bushmills> won't help
11:55 < Ritche> server 10.9.0.0 255.255.255.0
11:55 < Ritche> push "redirect-gateway"
11:55 < Ritche> thats the important part right?
11:55 < Bushmills> no. all parts, mentioned in !redirect, are important
11:56 < EugeneKay> I would have considered helping you if you had pasted your config files when I asked for !configs
11:56 < EugeneKay> But instead I shall point and laugh at your misfortune.
11:56 < Ritche> !nat
11:56 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
11:56 < EugeneKay> And possibly go make a sammich.
11:56 < EugeneKay> mmmmmm sammich
11:56 < Ritche> !configs
11:56 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
11:56 < Ritche> ok wait ill paste bin it
11:57 < Ritche> server.conf http://pastebin.com/B9u9AQvy
11:57 < Ritche> client http://pastebin.com/9wSynP1X 
11:57 < Bushmills> ip forwarding and nat setup has nothing to do with openvpn
11:58 < Bushmills> don't put that in openvpn config
11:58 < Bushmills> set up your *operating system* accordingly
11:58 < EugeneKay> First problem, 208.67.220.220 and .222.222 are horrible DNS servers that don't obey any RFCs. Don't use them.
11:58 < Ritche> okay, any suggested dns server?
11:58 < EugeneKay> 8.8.8.8, or run your own resolver.
11:58 < Ritche> since i was just following the guide from here http://xsuperspeedx.blogspot.com/2010/09/how-to-install-openvpn-in-centos.html
11:59 <@vpnHelper> Title: Tips Trick 4 All: How to Install OpenVPN in CentOS (at xsuperspeedx.blogspot.com)
11:59 < EugeneKay> redirect-gateway will forward all of the clients traffic through the VPN. In order to support this you need to have the OpenVPN server either NAT on behalf of the vpn network, or it needs to route the traffic back-and-forth, which usually means having it be the default gateway for the LAN(on the server's side)
11:59  * Bushmills is not going to read that, just to find out why it misleads its readers into thinking that ip forwarding is done by editing the openvpn config 
12:00 < EugeneKay> I'm still unsure on what your !goal is
12:00 < EugeneKay> But a config is something to work with, at least ;-)
12:00 < EugeneKay> Another point, HowTo: guides are usually totally useless.
12:01 < EugeneKay> That one in particular has you building openvpn from soruce
12:01 < Bushmills> !howto
12:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:01 < Bushmills> :P
12:01 < EugeneKay> Which is, well, stupid.
12:02 < EugeneKay> "sudo yum install openvpn -y" will do half that work for you
12:02 < Ritche> its already installed
12:02 < Ritche> my problem is in my server.conf
12:02 < Ritche> i do no tknow what is the best conf for me
12:02 < EugeneKay> !goal
12:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:03 < EugeneKay> Remember, IRC is not a psychic medium
12:03 < Ritche> exactly my problem is when im connected to my vpn i cant access internet
12:04 < EugeneKay> What are you trying to DO with the vpn to begin with
12:04 < Ritche> surf google.com
12:04 < Ritche> and it wont load
12:04 < EugeneKay> Ok, so "I would like to access the internet over my vpn"
12:05 < EugeneKay> What sort of server is the server? VPS someplace?
12:05 < Ritche> yeah
12:05 < Ritche> dedicated server
12:05 < EugeneKay> You will need to add a line to your iptables nat table. If you don't have one, you will need to create it.
12:06 < EugeneKay> Paste a copy of /etc/sysconfig/iptables, please?
12:06 < Ritche> its empty
12:06 < EugeneKay> Odd. CentOS usually has at least a filter section with a firewall
12:07 < Ritche> this iptables should I add iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.66.4.4 -j ACCEPT
12:07 < Ritche> and so on?
12:07 < EugeneKay> No, that's for routed / forwarding
12:07 < EugeneKay> You want NAT
12:07 < EugeneKay> In essence, you're emulating a LAN behind your server that you are granting internet access through
12:07 < EugeneKay> Except instead of an eth1(physical NIC), you are using tun0(vpn link)
12:07 < Ritche> ok i want to access internet on my dedicated server and to use that ip instead of my real ip 
12:08 < Ritche> okay I like to use this ip 
12:08 < Ritche> eth0      Link encap:Ethernet  HWaddr 00:22:68:76:3E:C3
12:08 < Ritche>           inet addr:204.45.72.138  Bcast:204.45.72.143  Mask:255.255.255.248
12:08 < EugeneKay> http://eugenekay.pastebin.com/NefFLegt
12:09 < EugeneKay> Put that into /etc/sysconfig/iptables, service iptables restart, and give it a go.
12:09 < EugeneKay> The RH-Firewal lrules are just the default CentOS ones
12:09 < Ritche> ok hold on sir
12:10 < Ritche> ok done
12:10 -!- dazo_afk is now known as dazo
12:11 < EugeneKay> Also, I use the "def1" flag for my redirect-gateway clients. Works better, generally speaking
12:11 -!- R1983 [~ritche@trilogynetwork.org] has joined #openvpn
12:11 < R1983> thanks
12:11 < EugeneKay> Connected via the vpn?
12:11 < R1983> yeah 
12:12 < R1983> great help sir :)
12:12 < EugeneKay> There you go. I would suggest reading up on linux firewalling and putting some in
12:12 < R1983> okay thanks a lot and have a nice day 
12:12 < R1983> bbl 
12:13 < R1983> gotta save it
12:13  * EugeneKay runs off to get his sammich, now
12:13 -!- EugeneKay is now known as EugeneKaway
12:13 < R1983> thanks again :)
12:14 -!- R1983 [~ritche@trilogynetwork.org] has quit [Client Quit]
12:14 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
12:14 -!- Ritche [~ritche@shellium/member/soulesss] has quit [Ping timeout: 252 seconds]
12:16 -!- EugeneKaway is now known as EugeneKay
12:28 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:34 -!- Modular [~Modular@64.254.96.13] has joined #openvpn
12:35 < Modular> !welcome
12:35 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:35 < Modular> !goal
12:35 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:38 -!- EugeneKay is now known as EugeneKaway
12:40 < Modular> Hello everyone. I have an openvpn server at home running on Endian firewall. I use it with windows xp / windows 7 and linux(mint 10). On linux I can access my local LAN but cannot access the internet via browser. I can ping out side resources(8.8.8.8) so i believe its a routing issue or a DNS issue. THank you in advance for your help.
12:41 < xxtjaxx> Hey can I do something like cert "/etc/openvpn/keys/$(hostname).crt" in my client conf? 
12:41 < dkr> xxtjaxx: I don't think so
12:42 < Essobi> Hmm.. isn't there a web interface for openvpn or was that my imagination?
12:42 < Bushmills> !redirect
12:42 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:42 < Bushmills> Modular: ^^^
12:42 < xxtjaxx> Bushmills: \o/
12:42 < hjohnson> Modular: check rp_filter
12:43 < Modular> Bushmills: thank you I will try that. Question why does the same config work on xp the way i want it to?
12:43 < xxtjaxx> dkr: would be cool if so.
12:43 < Modular> !def1
12:43 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
12:44 < Bushmills> Modular: chances that your problem is not what !redirect says, but your server pushes a name server to client, which linuix doesn't take without additional action 
12:45 < Modular> bushmills: so i was right in assuming it was a DNS issue? 
12:45 < Bushmills> i can only speculate
12:45 -!- darkdrgn2k3 [~darkdrgn2@70.33.240.50] has joined #openvpn
12:46 < darkdrgn2k3> hey
12:46 < darkdrgn2k3> trying to isntall openvpn win32 application
12:46 < Bushmills> !winroute
12:46 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
12:46 < darkdrgn2k3> net start "openvpn service" yeids
12:46 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
12:46 < darkdrgn2k3> the system cannot find the file specified
12:46 < Modular> Bushmills: yeah i wasn't looking for definitive answer just a step in the right direction. I would prefer to understand not just fix this issue. 
12:47 < Bushmills> Modular: check whether a name server is pushed, then check whether client resolver config is updated. under linux, /etc/resolv.conf must reflect the change.
12:47 < Bushmills> which it won't be, without some action by client
12:49 < Modular> Bushmills: would that be in the config file or would that be modifying resolve.conf manually?
12:50 < Bushmills> either manually, or by executing an up script
12:50 -!- albech [~thomas@61.7.136.198] has quit [Quit: Ex-Chat]
12:51 < Modular> Bushmills: ty for your help. i really appreciate the insight. 
12:51 -!- IOhannes [~zmoelnig@umlaeute.mur.at] has left #openvpn []
12:51 < Bushmills> up script can read pushed name server from environment variable, and pass it to an updating mechanism, like resolvconf, are patches resolv.conf directly
12:52 < Bushmills> or patches ...
12:56 -!- mirco [~mirco@tmo-107-135.customers.d1-online.com] has quit [Quit: mirco]
12:58 -!- Gnewt [~vector@a.box.iownyour.info] has joined #openvpn
12:59 < Essobi> Where's the man pages for openvpn config on openvpn.net? :\
12:59 < Gnewt> Any reason OpenVPN might be sending packets from the wrong source address server-side?
13:00 < Essobi> Gnewt: Used the 'local' directive in your config?
13:01 < Essobi> I THINK that's what it does but I can't find the config documentation... just examples.
13:02 < darkdrgn2k3> is libpkcs11-helper-1.dll needed for openvpn
13:06 < Gnewt> I did, but I totally thought it did something else.
13:06 <@dazo> !man
13:06 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
13:07 <@dazo> Essobi: ^^ 
13:07 < Gnewt> --local host
13:07 < Gnewt> Local host name or IP address. If specified, OpenVPN will bind to this address only. If unspecified, OpenVPN will bind to all interfaces.
13:07 < Gnewt> mm
13:07 < Gnewt> I thought it was like 'bind'
13:07 < Gnewt> give me a sec to try without.
13:08 <@dazo> darkdrgn2k3: yes, libpkcs11-helper-1.dll is needed ... Windows builds enable the PKCS#11 support (smart card stuff), so it expects that dll to be able to work
13:08 <@vpnHelper> RSS Update - forum: Setup on Win2008 R2 <http://forums.openvpn.net/topic7666.html#p10067>
13:09  * hjohnson does another face-palm... no.. tcp accelerator outside of the VPN will not make things go faster... 
13:09 <@dazo> heh
13:11 < hjohnson> also L3 packet compression doesn't help either
13:11 < hjohnson> (header compression does, but that's another beast)
13:14 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p10068>
13:17 < xxtjaxx> hm I cannot push persist-key/tun?
13:18 < xxtjaxx> I get invalid arguments on TUN WRITE [17]'s
13:21 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
13:22 < darkdrgn2k3> dazo: any idea why openvpn.exe works infr but startting the servcice yeilds a System error 3 has occurred.
13:22 < darkdrgn2k3> The system cannot find the path specified.
13:23 <@dazo> darkdrgn2k3: sorry, I don't know such details ... I'm not a windows user, I just know a few things related to OpenVPN building issues on Windows
13:24 < darkdrgn2k3> hmm k
13:26 -!- zeeshoem [~mnathani@bas1-toronto46-1177980372.dsl.bell.ca] has joined #openvpn
13:30 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
13:34 < darkdrgn2k3> any one know why openvpnserv.exe wont start?
13:37 < ecrist> nope
13:40 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:40 < Essobi> dazo: ;)
13:40 -!- EugeneKaway is now known as EugeneKay
13:41 -!- luneff [~yury@84.51.202.179] has quit [Quit: Leaving]
13:42 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
13:44 < mant1s> Is there any way to use one certificate for multiple machines to connect to an openvpn server?
13:44 < EugeneKay> Yes. Enable the option for it.
13:44  * mant1s blushes 
13:44 < EugeneKay> I forget what it's named, but The GOogle should be able to tell you
13:46 < darkdrgn2k3> mant1s: duplicate-cn
13:47 < mant1s> nice, thanks EugeneKay darkdrgn2k3
13:49 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
13:50 -!- mirco [~mirco@tmo-106-102.customers.d1-online.com] has joined #openvpn
13:58 -!- TheSilentTechie [~TheSilent@dslb-088-065-131-159.pools.arcor-ip.net] has quit [Quit: Verlassend]
13:59 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
14:00 < s7r> i have 5 clients currently assigned to a server (each having its own cert and key). how can I remove only one of those clients and leave the rest unaffected ?
14:01 < xxtjaxx> http://pastebin.com/AtbanJDk << Why could this happen?
14:02 <@dazo> s7r: you want to revoke access for one of your clients?
14:02 < s7r> yes dazo 
14:02 < s7r> only one of them
14:02 < s7r> and the rest should be left as they are right now - unaffected
14:03 <@dazo> s7r: you need to revoke that certificate, and use the --crl option on the server ... the revoke operation should give you a crl file, which contains a list of revoked certificates
14:03 < s7r> if i delete the client certificates from the server (from the fodler /etc/openvpn/easy-rsa/keys)
14:03 < s7r> will this revoke the client's access to the vpn?
14:03 <@dazo> but you cannot undo a revoke ... you need to then create a new certificate for that client
14:03 <@dazo> s7r: nope
14:04 <@dazo> in fact /etc/openvpn/easy-rsa/keys can be located on a detached harddrive ... and everything would still work
14:04 < s7r> yes dazo i understand i do not want to undo this operation
14:04 < s7r> i want it permanent ...
14:04 < s7r> revoke access just for one of the clients
14:04 < s7r> i use for example openvpn --crl client5 ?
14:04 <@dazo> you don't need the complete CA on your openvpn server at all ... all the server needs is the ca.crt, server.crt and server.pem (in addition to the optional dh*.pem file)
14:05 <@dazo> s7r: almost .... when you use the revoke feature, a CRL file will be generated
14:05 <@dazo> a CRL file is basically a list of revoked certificates, signed with the CA key 
14:06 < s7r> so a simple openvpn --crl client5 will revoke client5 access?
14:06 <@dazo> nope
14:06 <@dazo> you need to use whatever tools you use for your CA to revoke certificates .... if you're using easy-rsa, I believe there is a ./revoke script somewhere
14:07 <@dazo> (or ./revoke-"something")
14:07 < s7r> easy-rsa ./clear-all
14:08 < ecrist> easy-rsa sucks
14:09 < s7r> dazo: ./revoke-full client2
14:09 < s7r> that is the scipt
14:09 < s7r> ecrist: what's the alternative?
14:10 < ecrist> !ssl-admin
14:10 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
14:11 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has joined #openvpn
14:11 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has quit [Changing host]
14:11 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
14:11 < s7r> ecrist: can i use that on ubuntu servers?
14:12 < mant1s> alight so I have duplicate-cn enabled. What do I need to do in order for those clients the same cert to get a different ip address from the pool?
14:12 < ecrist> s7r: yes
14:12 <@dazo> s7r: don't do ./clear-all .... that will remove everything, and you need to start from scratch
14:13 < s7r> yes dazo I know:) thanks. i did ../vars and ./revoke-full client5
14:13 < s7r> and according to man page client5 now should not be able to connect
14:13 < s7r> is this correct ecrist ?
14:13 <@dazo> s7r: almost ... you need to find the *.crl file and configure openvpn to read that crl file in your config
14:14 < s7r> .crl file is in /keys
14:14 < s7r> doesn't openvpn read this file by default ?
14:14 <@dazo> nope
14:14 < ecrist> s7r: if you're using a CRL in your openvpn config
14:15 < s7r> let me check the server.conf and confirm
14:15 <@dazo> s7r: openvpn needs to be told which files it needs to read ... openvpn is "stupid" in that way, it tries to do as little magic as possible 
14:16 <@dazo> ecrist: I'm pretty sure this is the first certificate revocation, so I don't expect it to know about any other crl files
14:16 <@vpnHelper> RSS Update - forum: Best config to reach a public DB <http://forums.openvpn.net/topic7708.html>
14:16 < s7r> nothing about crl in my server.conf]
14:17 < s7r> what line should i add
14:17 < ecrist> dazo: you can generate a CRL file with no actual revokates
14:18 < ecrist> revokations*
14:18 < ecrist> ssl-admin will do it for you, even. ;)
14:18 < s7r> crl /etc/openvpn/easy-rsa/keys/file.crl ?
14:18 <@dazo> ecrist: true, but not by default in easy-rsa, which s7r started with using
14:18 <@dazo> blah, bad sentence
14:18 < ecrist> regardless, easy-rsa sucks. ;)
14:19 < s7r> it's my first ovpn configuratiomn
14:19 < s7r> configuration*
14:19 < s7r> :D
14:19 < s7r> didn't really know there is an alternative to easy-rsa
14:19 < s7r> however the vpn works good - just need to revoke a client that's all :p
14:19 < s7r> hell if it's that complicated i will ./clear-all which i am sure it works and than i will add again 4 clients
14:21 < mant1s> So I got multiple clients connecting to my vpn with the same cert and I want OpenVPN to hand out individual addresses to each client instead of the same one it's currently giving. I have duplicate-cn enabled. any ideas?
14:21 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn ["Leaving"]
14:22 <@dazo> s7r: easy-rsa is simpler than using openssl directly ... however, ssl-admin, xca and tinyca2 (the two latter ones are gui apps) are probably more user friendly ... so if you decide to start all over, that might be good time to switch away from easy-rsa
14:22 <@dazo> mant1s: I presume you're using --client-config-dir and assign static IP addresses?
14:24 < mant1s> dazo, http://pastebin.com/LdtQS91q
14:24 -!- atan2 [~atan@unaffiliated/atan] has quit [Quit: null]
14:24 < mant1s> no i don't :/
14:24 <@dazo> mant1s: what kind of config file is this?
14:24 < mant1s> Vyatta's openvpn.. but if i know how to do it in OpenVPN i can translate it to their style 
14:25 <@dazo> for all know, Vyatta's openvpn solution might add more options without your explicit knowledge
14:25 < mant1s> same thing, different syntax
14:25 < mant1s> well, if you were to do it in pure openvpn what would you do?
14:28 <@dazo> basically, static IP addresses and --duplicate-cname wil not work well together ... because the cname in the certificate is what is the unique client "ID"
14:28 < mant1s> I'm not doing static ip's 
14:28 < mant1s> they're assigned DHCP
14:29 <@dazo> you said: "out individual addresses to each client instead of the same one it's currently giving" .... that sounded like static IPs
14:29 < mant1s> sorry, not what I was trying to say... I just want each client to have a dynamic address
14:29 < mant1s> but connect using the same cert
14:30 < mant1s> but currently each client that's connecting is getting the same ip address lol
14:30 <@dazo> that should work "out-of-the-box" with standard configs and --duplicate-cname ... if not, I suspect there's something in vyatta openvpn which does some dirty things
14:31 < mant1s> yeah I think my sytax was wrong now that I'm looking it over
14:32 < mant1s> This Vyatta SW is real nice
14:32 <@dazo> gah ... yeah, I read client-to-client as duplicate-cn
14:32 < mant1s> yeah it should be like openvpn-option "--duplicate-cn ....[more options]"
14:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:37 < xxtjaxx> when I build-key-server I can put the hostname into the CN field or is the fqdn necessary I plan to use this vpn from outside my domain so.
14:37 <@vpnHelper> RSS Update - forum: Compression not effective on routed VPN <http://forums.openvpn.net/topic7709.html>
14:38 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 272 seconds]
14:39 < darkdrgn2k3> how can i run a a script after the connection is estalbished
14:40 < EugeneKay> On the server or the client end?
14:40 < darkdrgn2k3> server
14:40 < EugeneKay> client-connect and client-disconnect directives
14:41 < EugeneKay> (inventively)
14:41 < darkdrgn2k3> does it pass any info to the script
14:42 < EugeneKay> Consult the man page for a full set of info
14:42 < darkdrgn2k3> i could if i would
14:42  * darkdrgn2k3 stupid
14:43 < darkdrgn2k3> should of typed man
14:43 < EugeneKay> It's also on openvpn.net
14:43 < EugeneKay> !man
14:43 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
14:43 < darkdrgn2k3> "common name and IP address "
14:43 < darkdrgn2k3> ip addresse of the remote or local end of the tunnel
14:45 < EugeneKay> Again, consult the man page. :-p
14:46 < darkdrgn2k3> and where do you think im getting this from lol
14:46 < EugeneKay> The two you're likely after are ifconfig_local and ifconfig_remote
14:46 < darkdrgn2k3> "he script is passed the common name and IP address of the just-authenticated client as environmental variables"
14:46 < EugeneKay> Scroll down to the ENvironmental Variables section it tells you about
14:46 < darkdrgn2k3> yeh lol just saw that
14:46 < darkdrgn2k3> so Env Var are like in the script right $common_name 
14:47 < EugeneKay> ${common_name} would be the way to do it in bash, but yes.
14:47 < EugeneKay> -connect and -disconnect scripts are great if you're trying to do active-active vpn site-to-site links
14:48 < darkdrgn2k3> yeh just trying to update a ddns server :-P
14:49 < EugeneKay> Using the common-name? 
14:49 < EugeneKay> That's one bit I have yet to work into my test lab scripts
14:50 < darkdrgn2k3> jsut a cheap bash script that executes nsupdate
14:50 < EugeneKay> Best way to do it
14:51 < darkdrgn2k3> sad part is my nsupdate crashes lol
14:51 < darkdrgn2k3> mem.c:877: INSIST(ctx->stats[i].gets == 0U) failed.
14:51 < EugeneKay> Lolz
14:51 < EugeneKay> I hate doing BIND, and my name is in the fucking book.
14:52 < darkdrgn2k3> lol really?
14:52 < EugeneKay> http://books.google.com/books?id=HggtWI1ShvMC&pg=PT304&lpg=PT304&dq=dns+and+bind+eugene+kashpureff&source=bl&ots=PQSxTVMCWn&sig=FSnGEVFuKqv_Z79f4AEW0Q_Leic&hl=en&ei=ZlxtTdPGIYP-8AbT_92NDQ&sa=X&oi=book_result&ct=result&resnum=1&ved=0CBIQ6AEwAA#v=onepage&q&f=false
14:52 <@vpnHelper> Title: DNS and BIND - Google Books (at books.google.com)
14:52 < EugeneKay> Well, Dad's. Bastard named me Jr.
14:52 < darkdrgn2k3> lol
14:55 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700-15.html#p10071>
14:59 < darkdrgn2k3> "Tue Mar  1 15:58:54 2011 160/142.59.39.193:2452 client-connect command failed: could not execute external program"
15:00 -!- mirco [~mirco@tmo-106-102.customers.d1-online.com] has quit [Quit: mirco]
15:00 < EugeneKay> Needs to be executable by the user running openvpn
15:01 < darkdrgn2k3> -rwxr-xr-x  1 root root  423 Mar  1 16:00 ddns
15:01 < EugeneKay> And the dir? ;-)
15:01 < darkdrgn2k3> hmm
15:02 < darkdrgn2k3> process is running as root lol
15:02 < EugeneKay> SELinux? Something? :-p
15:02 < darkdrgn2k3> SELINUX=disabled
15:02 < darkdrgn2k3> --script-security 2 right?
15:05 < EugeneKay> I believe so
15:05 < darkdrgn2k3> hmm in bind what does the 600 A <- 600 mean 
15:06 < EugeneKay> In the database fine? TTL of the record.
15:07 < EugeneKay> I generally omit it from my records, in the sake of brevity.
15:13 < darkdrgn2k3> so just leave it as A
15:15 < EugeneKay> A(ddress) is the type of record, which is what you want, yes
15:28 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:37 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
15:37 <@vpnHelper> RSS Update - forum: Best config to reach a public DB <http://forums.openvpn.net/topic7708.html#p10072>
15:39 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has joined #openvpn
15:39 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has quit [Changing host]
15:39 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
15:41 -!- darkdrgn2k3 [~darkdrgn2@70.33.240.50] has quit [Ping timeout: 272 seconds]
15:43 <@vpnHelper> RSS Update - forum: Compression not effective on routed VPN <http://forums.openvpn.net/topic7709.html#p10073>
15:43 -!- K4k_ is now known as K4k
15:46 -!- robotti^ [robotti@kapsi.fi] has quit [Ping timeout: 250 seconds]
15:46 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
16:04 < Dropje> i've been using PowerDNS for a while now, it really 'ownes' BIND in ease of configuration, speed of lookups and flexibility
16:13 -!- Modular [~Modular@64.254.96.13] has quit [Ping timeout: 240 seconds]
16:24 -!- dvrvm [~dvrvm@77-58-129-60.dclient.hispeed.ch] has joined #openvpn
16:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 250 seconds]
16:29 -!- Modular [~Modular@ip68-226-20-147.tc.ph.cox.net] has joined #openvpn
16:37 <@vpnHelper> RSS Update - forum: Compression not effective on routed VPN <http://forums.openvpn.net/topic7709.html#p10074>
16:46 -!- dvrvm [~dvrvm@77-58-129-60.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
16:50 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
17:03 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
17:07 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic7700-15.html#p10075>
17:13 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html>
17:17 -!- dazo is now known as dazo_afk
17:23 -!- Modular [~Modular@ip68-226-20-147.tc.ph.cox.net] has quit [Ping timeout: 264 seconds]
17:35 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
17:42 -!- Modular [~Modular@64.254.96.13] has joined #openvpn
17:55 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10077>
18:07 < Dougy> !tunortap
18:07 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
18:07 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
18:19 -!- Modular [~Modular@64.254.96.13] has quit [Quit: Leaving]
18:26 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10078>
18:28 -!- HoboSteaux_ [~HoboSteau@50.37.87.37] has joined #openvpn
18:28 < Dougy> so lets say i have a local vlan 10.2.2.0/24 and I want to set up a VPN for all clients to communicate with that.. server-bridge rihgt?
18:29 < HoboSteaux_> is there any way to make an openvpn network that works as p2p network, i want to remove routing through the server for every communication
18:32 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10079>
18:38 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10080>
18:40 < Essobi> HoboSteaux_: Uhh... No.
18:40 < HoboSteaux_> hahhaha
18:40 < Essobi> What's so funny?
18:41 < HoboSteaux_> the way i was shot down
18:41 < HoboSteaux_> it want just 'that would be super difficult, etc' it was 'no'
18:41 < HoboSteaux_> ok so how about this. i know you do dynamic servers
18:41 < HoboSteaux_> can do*
18:42 < HoboSteaux_> one master server that they connect to. this has a list of ips for local servers, n = users
18:43 < HoboSteaux_> then theoretically with a server/client on each side it would not require everyone to go through the master
18:46 -!- atan [~atan@unaffiliated/atan] has joined #openvpn
18:50 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10081>
18:56 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10082>
19:02 <@vpnHelper> RSS Update - forum: Best config to reach a public DB <http://forums.openvpn.net/topic7708.html#p10084> || Expected Results Unobtainable! HELP! <http://forums.openvpn.net/topic7692.html#p10083>
19:08 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10085>
19:10 -!- luneff [~yury@84.51.202.179] has joined #openvpn
19:11 -!- luneff [~yury@84.51.202.179] has quit [Read error: Connection reset by peer]
19:11 -!- luneff [~yury@84.51.202.179] has joined #openvpn
19:14 <@vpnHelper> RSS Update - forum: FreeRadius & MySql <http://forums.openvpn.net/topic7707.html#p10086>
19:20 <@vpnHelper> RSS Update - forum: TCP connection stop working <http://forums.openvpn.net/topic7695.html#p10087>
19:20 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
19:26 <@vpnHelper> RSS Update - forum: Double VPN || 2 Hop VPN || VPN-over-VPN <http://forums.openvpn.net/topic7483.html#p10088>
19:28 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
19:28 -!- luneff [~yury@84.51.202.179] has quit [Quit: Leaving]
19:37 -!- knom [~Adium@189.217.211.221] has joined #openvpn
19:38  * hjohnson shudders at the thought of having to use pptp
19:39 < EugeneKay> Could be worse.
19:39 < hjohnson> true enough
19:41 -!- knom [~Adium@189.217.211.221] has quit [Read error: Connection reset by peer]
19:44 -!- luneff [~yury@84.51.202.179] has joined #openvpn
19:51 < K4k> Does something need to be change in iptables on the vpn server in order for vpn user to be able to resolve addresses outside of the vpn network?
20:39 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
20:46 < ecrist> yes
20:46 < ecrist> !linnat
20:46 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
20:51 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
20:52 < Haraken> how do I tell the openvpn service to use a certain config when it starts by default?
20:52 < Haraken> on windows 2003
20:52 -!- luneff [~yury@84.51.202.179] has quit [Read error: Connection reset by peer]
20:53 -!- luneff [~yury@84.51.202.179] has joined #openvpn
20:53 -!- common- [~common@p5DDA4CE8.dip0.t-ipconnect.de] has joined #openvpn
20:55 < HoboSteaux_> would there be any way possible to permit traffic to go between clients in ovpn without it touching the server
20:56 -!- common [~common@p5DDA4A11.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
20:56 -!- common- is now known as common
21:08 -!- master_of_master [~master_of@p57B53558.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:09 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
21:10 -!- master_of_master [~master_of@p57B53595.dip.t-dialin.net] has joined #openvpn
21:11 < dvl> HoboSteaux_: No, that's not how it works.
21:12 < HoboSteaux_> i know how it conventionally works im trying to use it for different purposes tho lol
21:13 < dvl> HoboSteaux_: For what purposes?
21:13 < HoboSteaux_> i dont have a lot of bandwidth and im trying to do an openvpn server
21:14 < HoboSteaux_> its eating it all up... rapidly
21:14 < dvl> HoboSteaux_: the VPN exists between client and server, not between client and another client. By its nature, traffic must traverse through the VPN server.
21:27 -!- zeeshoem [~mnathani@bas1-toronto46-1177980372.dsl.bell.ca] has quit []
21:29 -!- luneff [~yury@84.51.202.179] has quit [Read error: Connection reset by peer]
21:29 -!- luneff [~yury@84.51.202.179] has joined #openvpn
21:51 < EugeneKay> Buy a VPS with a 100mb link, use it as your VPN server.
21:51 < EugeneKay> Linode works fine for this.
21:52 < atan> I looked at Linode earlier. Do you use them?
21:52 < EugeneKay> Indeed I do.
21:52 < atan> I am currently using Rackspace but my lord... $$$.
21:52 < EugeneKay> I don't use it for Server, but it works fine as a client.
21:52 < EugeneKay> Rackspace is hand-holding central ;-)
21:52 < atan> Rackspace is hand-in-your-pocket central. Pfft.
21:53 < EugeneKay> That too.
21:53 < atan> Right now I am taking advantage of their `clou` hosting.
21:53 < atan> cloud*
21:53 < atan> So far things are good. Websites have been up pretty near 100% of the time. 
21:53 < EugeneKay> I looked at them once, as they are the only NetApp provider in the market. They wanted $5k/mo for a system I could buy for $50k off the shelf, tops.
21:54 < atan> EugeneKay, do you know much about how they scale their VPS servers?
21:54 < EugeneKay> Linode?
21:54 < atan> Yeah.
21:54 < EugeneKay> Power down, resize the disk image, power up.
21:54 < atan> If I buy a small guy for $20/mo can I ramp that sucker up as I need to?
21:55 < atan> Any downtime to speak of?
21:55 < atan> Where are they located?
21:55 < EugeneKay> Nothing significant. They had one hiccup the week I signed up - datacenter power fuckup. Nothing since.
21:55 < EugeneKay> They have a coupla locations. Consult their FAQ
21:57 < EugeneKay> I've not had a reason to scale up from the $20/mo instance - I use it as NS2 for my domains, and some small side projects.
21:57 < EugeneKay> It's all very standard Xen stuff, they use an in-house developed(and thus, not shitted-up) cPanel, and they are honest about uptime.
21:57 < EugeneKay> Not the cheapest, not the most GB, not the most ram, but damnit, they keep me happy.
21:58 < atan> What is killing me with Rackspace is that I pay something near $120 to host a few shared sites on their cloud hosting. Another $15 or so for a smaller Asterisk server.
21:59 < atan> I love the idea of how they claim to scale on demand... but sometimes I want to beat them with a stick.
21:59 < ecrist> colopronto
21:59 < atan> I set cache=0 and turn around and things are cached on me.
21:59 < ecrist> their billing dept blows balls, but 100mb uplink for like $30/mo
21:59 < ecrist> you have to send them a server, though.
22:00 < EugeneKay> If I can find a decent datacenter in the Bay Area, I'll buy a whole damn rack worth.
22:00 < ecrist> I find it hard to believe you can't find a colo provider there.
22:00 < EugeneKay> Key word is decent. Most of them are on drugs or shady.
22:01 < ecrist> we pay about $1k/mo for two full racks
22:01 < EugeneKay> Last quote I got was 1200/mo for a full rack
22:01 < ecrist> we're paying for only 512k 95th %ile
22:01 < ecrist> but our uplink is 100mb, so we have bandwidth when we want it
22:02 < EugeneKay> Where are they?
22:02 < ecrist> Minneapolis, MN
22:03 < ecrist> usinternet.com
22:03 < EugeneKay> Bah. :-p
22:04 < EugeneKay> Colopronto looks reasonable, but I can't find a datacenter address
22:04 < ecrist> it's in Miami
22:04 < EugeneKay> Hurricane central. Skip.
22:06 < atan> So I'm thinking of using OpenVPN to connect my Apache box to MySQL box... foolish idea? =\ static key an awful idea?
22:07 < EugeneKay> I assume they're on the same line, in which case don't bother.
22:07 < EugeneKay> s/line/LAN
22:08 < EugeneKay> Use a keepalive wrapper script around a SSH tunnel from the apache machine to the MySQL one
22:08 < EugeneKay> A simpler solution is to enable MySQL's built-in SSL stuff, but that doesn't work for all driver wrappers. PHP supports it, but a php-odbc does not(groan)
22:09 < ecrist> pdo does, iirc
22:09 < atan> They are on the same network but so are other users.. =\
22:09 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:09 < EugeneKay> What's the apache application?
22:10 < atan> In house thinger?
22:10 < atan> It's a record manager
22:10 < EugeneKay> PHP-based?
22:10 < atan> Yep
22:10 < EugeneKay> Ok. You should be able to change the mysqli_pconnect()  calls to support SSL certs, then.
22:11 < atan> Is SSL really enough? :|
22:11 < EugeneKay> Unless your users are actively malicious, yes.
22:11 < EugeneKay> If you want to get paranoid, set the MySQL server to listen on 127.0.0.1, and do the SSH tunneling thing
22:12 < ecrist> you could use tagged vlans and proper switch configuration...
22:12 < EugeneKay> Until some assclown gets his hands on the switch and "gets rid of that performance mucking-up configuration"
22:13 -!- bitterman [~yury@84.51.202.179] has joined #openvpn
22:15 -!- luneff [~yury@84.51.202.179] has quit [Ping timeout: 240 seconds]
22:16 < ecrist> sounds like you need to learn how to admin a network, EugeneKay 
22:16 < ecrist> there should be no 'getting hold of a switch'
22:17 < EugeneKay> Oh, I admin my network fine. Nobody touches it on threat of 9mm hollowpoints.
22:17 < EugeneKay> But he's on a network shared "with other users"
22:17 < ecrist> heh. .40 S&W + 5.56x45 here
22:17 < ecrist> that's just me.
22:17 < EugeneKay> Pair of 9mms is just what I keep on my desk >_>
22:18 < ecrist> the boss carries a .38sp, his wife carries the same
22:19 < EugeneKay> http://img175.imageshack.us/img175/3537/dscn0537x.jpg
22:19 < EugeneKay> COntains gratuitious quantities of bathrobe
22:20 < ecrist> SKS?
22:20 < EugeneKay> CA-spec ak-47
22:20 < EugeneKay> I forget which plant it was stamped in, and I'm not getting it out to check
22:43 -!- echoSMIL1 [~censured@bl17-95-152.dsl.telepac.pt] has quit [Ping timeout: 276 seconds]
22:49 -!- darth_bitterman [~yury@84.51.202.179] has joined #openvpn
22:51 -!- bitterman [~yury@84.51.202.179] has quit [Ping timeout: 240 seconds]
22:52 -!- albech [~thomas@61.7.136.198] has joined #openvpn
23:01 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:04 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 240 seconds]
23:04 <@vpnHelper> RSS Update - forum: Expected Results Unobtainable! HELP! <http://forums.openvpn.net/topic7692.html#p10089>
23:09 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
23:09 -!- mode/#openvpn [+o dazo_afk] by ChanServ
23:10 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
23:13 -!- EugeneKay is now known as EugeneKaway
23:16 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 272 seconds]
23:21 -!- EugeneKaway is now known as EugeneKay
23:32 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
23:32 -!- mode/#openvpn [+o dazo_afk] by ChanServ
23:36 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:47 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 250 seconds]
23:48 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
23:48 -!- mode/#openvpn [+o dazo_afk] by ChanServ
--- Day changed Wed Mar 02 2011
00:11 <@vpnHelper> RSS Update - forum: wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html>
00:35 <@vpnHelper> RSS Update - forum: wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html#p10091>
00:47 <@vpnHelper> RSS Update - forum: wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html#p10092>
00:56 -!- HoboSteaux_ [~HoboSteau@50.37.87.37] has left #openvpn []
00:57 -!- HoboSteaux_ [~HoboSteau@50.37.87.37] has joined #openvpn
00:58 -!- HoboSteaux_ [~HoboSteau@50.37.87.37] has left #openvpn []
00:58 <@vpnHelper> RSS Update - forum: wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html#p10093>
01:02 -!- EugeneKay is now known as [o][o]
01:04 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
01:04 < hardwire> anybody found an option to delay packets by 20usec and collate small packets into large ones?
01:06 < hardwire> it would be interesting if openvpn compression spanned packets.
01:11 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:14 -!- DigitalFlux [~DigitalFl@213.229.74.196] has joined #openvpn
01:14 -!- DigitalFlux [~DigitalFl@213.229.74.196] has quit [Changing host]
01:14 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
01:15 -!- ucekpolish [user@hq.ostc-pl.com] has quit [Ping timeout: 260 seconds]
01:23 -!- [o][o] is now known as EugeneKaway
01:26 -!- theDoc [~Link@110.92.103.180] has quit [Ping timeout: 240 seconds]
01:26 -!- albech_ [~thomas@110.164.248.17] has joined #openvpn
01:28 -!- gim6626 [d4c05e50@gateway/web/freenode/ip.212.192.94.80] has joined #openvpn
01:28 -!- theDoc [~Link@110.92.102.37] has joined #openvpn
01:29 -!- gim6626 [d4c05e50@gateway/web/freenode/ip.212.192.94.80] has quit [Client Quit]
01:31 -!- albech [~thomas@61.7.136.198] has quit [Ping timeout: 276 seconds]
01:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Read error: Operation timed out]
01:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
02:06 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
02:20 < WormFood> can anyone explain what "FRAG TTL expired" means in my log files? It does not seem to cause any problems. Is it just informational?
02:21 <@vpnHelper> RSS Update - forum: Generate key and Certificate dynamically ? <http://forums.openvpn.net/topic7712.html>
02:27 <@vpnHelper> RSS Update - forum: Generate key and Certificate automatically ? <http://forums.openvpn.net/topic7712.html>
02:51 <@vpnHelper> RSS Update - forum: Generate key and Certificate automatically ? <http://forums.openvpn.net/topic7712.html#p10096>
02:52 < hyper_ch> hello people
02:56 -!- huwenfeng [~huwenfeng@220.181.71.219] has joined #openvpn
02:58 < huwenfeng> hi, you people, i am using openvpn to connect me and my friend to play LAN games,,  everything is OK, but the network delay is about 200ms. is there any method to reduce this delay? 
03:00 < huwenfeng> http://jquery.pastebin.com/kZddyDjx    this is my server's config file, any suggestions???
03:00 < huwenfeng> !welcome
03:00 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:02 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:02 < MarKsaitis> Hey!
03:05 < MarKsaitis> I have got a strange problem with my OpenVPN implementation. It has been working as normal in a production environment all the time, but one of our office guys has just flew to dubai and he can't connect. Log gives this strange message - http://pastebin.com/c0irAN5N
03:05 < MarKsaitis> only few lines here. PLEASE HELP :). Everything goes fine till these lines which brake everything
03:05 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
03:07 < huwenfeng> MarKsaitis: oh, sorry to here that..... i can not understand it.....
03:07 < MarKsaitis> me neither :)
03:07 < MarKsaitis> it usually works from within the UK
03:08 < huwenfeng> MarKsaitis: you got some experience in using openvpn.. so any methods to reduce network delay?
03:08 < huwenfeng> MarKsaitis: like using low bit encryption ? or not encrypt at all?
03:09 < MarKsaitis> I havent. I need it to be encrypted all the time :)
03:11 < huwenfeng> MarKsaitis: oh, i just use it to play games, so encryption is not necessay.  any other products to let me and my friend play LAN games? 
03:13 < MarKsaitis> huwenfeng, =) hamachi
03:13 < MarKsaitis> free version of hamachi
03:13 < MarKsaitis> good for LAN games across the internet
03:13 < MarKsaitis> well, its just quicker to use, thats all
03:15 <@vpnHelper> RSS Update - forum: Backup/Fallback VPN <http://forums.openvpn.net/topic7702.html#p10098> || All clients get same IP? <http://forums.openvpn.net/topic7705.html#p10097>
03:26 < MarKsaitis> any experts of my problem?
03:27 <@vpnHelper> RSS Update - forum: All clients get same IP? <http://forums.openvpn.net/topic7705.html#p10101> || Generate key and Certificate automatically ? <http://forums.openvpn.net/topic7712.html#p10100>
03:34 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
03:35 < Fleck> MarKsaitis seems that friends ISP is not using standart MTU
03:35 < Fleck> any reasons you dont use udp ?
03:38 < MarKsaitis> UDP?
03:38 < MarKsaitis> why UDP?
03:38 < MarKsaitis> log says that it was a MTU bigger than 20000
03:39 < MarKsaitis> can I force my server to use a MTU of around 1300 for anything at all?
03:39 -!- dazo_afk is now known as dazo
03:39 < MarKsaitis> Fleck,  :)
03:39 < Fleck> yes you can
03:39 < Fleck> but u have to do it on server and client
03:40 < Fleck> and UDP is usually faster thant TCP - because of encapsulation
03:40 < Fleck> not just because
03:40 < Fleck> but...
03:42 < MarKsaitis> I used TCP port 443 or 8443 just because I know it is unblocked in most of the places
03:42 < MarKsaitis> I am not sure about doing so with UDP
03:42 < MarKsaitis> =)
03:42 < MarKsaitis> why do you think switching to UDP would solve the problem?
03:42 < MarKsaitis> Fleck, :)
03:44 < Fleck> MarKsaitis because TCP has an overhead of 160 bytes per packet, UDP only 64
03:44 <@vpnHelper> RSS Update - forum: Generate key and Certificate automatically ? <http://forums.openvpn.net/topic7712.html#p10102>
03:44 < Fleck> bytes
03:44 < Fleck> On a 1500-byte packet that's 5% to 10% overhead.
03:45 < MarKsaitis> I am not concerned about performance improvements right now. Just tell me, why do you think it would fix MTU problems?
03:45 < Fleck> u can use UDP 53, usually used by DNS
03:45 < MarKsaitis> I appreciate your help
03:45 < MarKsaitis> :)
03:45 < Fleck> just said why i think it would fix! :)
03:46 < MarKsaitis> well, log says that MTU was > 20 000
03:46 < MarKsaitis> so if we minimize it by 10%, its still more than normal 1500 MTU
03:46 < MarKsaitis> so I dont get the fix :)
03:47 < Fleck> where do you see 20k ?
03:47 < Fleck> anyway you can try to set link-mtu 1500 etc to clients config
03:47 < Fleck> or 1576
03:48 < Fleck> whatever is your servers mtu
03:48 < MarKsaitis> ulated packet length from peer (32871), which must be > 0 and <= 1576 -- ple
03:48 < MarKsaitis> in here?
03:48 < Fleck> thats 32k :D
03:48 < Fleck> not 20k :D
03:48 < MarKsaitis> oh well, not a big difference
03:48 < MarKsaitis> but still way too much
03:48 < MarKsaitis> ;]
03:48 < MarKsaitis> :D
03:48 < Fleck> anyway - never seen such MTU :D
03:49 < Fleck> so i think that did not indicate MTU
03:50 < MarKsaitis> well, person is connecting from dubai to london
03:50 < MarKsaitis> ;]
03:50 < MarKsaitis> I have no idea who sets this big MTU
03:50 < MarKsaitis> ;]
03:53 < Fleck> anyway - try to set link-mtu
03:53 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
03:53 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
03:53 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:53 < MarKsaitis> is it for both server and client?
03:54 -!- raomin__ [~romain@86.66.22.65] has quit [Quit: leaving...]
03:54 <@vpnHelper> RSS Update - forum: OpenVPN + IPv6 <http://forums.openvpn.net/topic7713.html#p10104>
03:54 < Fleck> set it to default
03:55 < Fleck> then you will not have to set anything on server side
03:55 -!- raomin [~romain@86.66.22.65] has joined #openvpn
03:57 < janjust> MarKsaitis:  is what for both server and client?
03:57 < MarKsaitis> that mtu setting
04:00 < janjust> the mtu setting must be equal on both sides, and it's not possible to push it
04:01 < janjust> also, be aware that on windows, openvpn does not update the adapter's real MTU setting
04:03 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
04:04 < Fleck> janjust how can you check adapters MTU on windows?
04:05 < janjust> use something like 'DRTCP09.EXE' or whatever the thingie is called ; on Vista/7 you can also query it using 'netsh'
04:05 <@vpnHelper> RSS Update - forum: OpenVPN + IPv6 <http://forums.openvpn.net/topic7713.html#p10105>
04:06 < Fleck> MarKsaitis can you check adapters MTU on client side?
04:07 < MarKsaitis> how do I check windows tap adapters MTU? Its win vista on the client.
04:08 < Fleck> on Vista/7 you can also query it using 'netsh'
04:08 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:08 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:08 < janjust> http://www.kitz.co.uk/adsl/vistaMTU.htm
04:08 <@vpnHelper> Title: ::. Kitz - Vista MTU .:: (at www.kitz.co.uk)
04:08 < Fleck> check internet adapters mtu, not tap
04:10 < MarKsaitis> why the hell can in not just work :)))
04:11 < janjust> MarKsaitis:  Hey, it's windows! ;-)
04:11 < Fleck> lol
04:11 < MarKsaitis> =) well, if local OS adapters have 1500 MTU, does that mean ISP changes it to whatever they want?
04:12 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
04:12 < janjust> MarKsaitis:  yes, any provider/network between the client and server *can* alter the maximum transfer unit
04:12 < janjust> usually it is your ISP itself though
04:12 < MarKsaitis> bastards. I believe client has 1500 MTU
04:12 < janjust> the best way to detect the MTU between client and server is to run (on windows) : ping -f -l 1472 <remote-IP>
04:12 < MarKsaitis> default windows thing
04:12 < janjust> then lower the 1472 until you get a reply
04:13 < MarKsaitis> I think dupais ISP makes it 30K
04:13 < Fleck> i dont think so :D
04:13 < janjust> an mtu of 30K does not make sense
04:13 < MarKsaitis> Fleck, why not? ;]]]]
04:13 < Fleck> 99% sure its not true
04:13 < MarKsaitis> I believe so as well
04:13 < MarKsaitis> so who the hell makes it
04:13 < MarKsaitis> or is that message stupid ;]
04:13 < Fleck> as janjust said - it doesnt make sense
04:14 < MarKsaitis> janjust, I am trying that ping thing now
04:14 < janjust> MarKsaitis:  I've never seen an MTU larger than 6000 bytes (JumboFrames) ; I don't think there are many switches out there that support frames which are larger than that
04:14 < Fleck> yeah...
04:15 < MarKsaitis> :(
04:17 < MarKsaitis> that ping thing to find what mtu will it accept is hard to do
04:17 < MarKsaitis> ;]
04:17 < Fleck> better try udp first :D
04:18 < janjust> 1472 fails? then try 700
04:18 < janjust> if 700 works, then try 1000 
04:18 < janjust> if 1000 works, then try 1200
04:18 < Fleck> yeah = divison by 2 :D
04:18 < MarKsaitis> yes, 700 worked!
04:19 < MarKsaitis> oh no, 701 worked too
04:19 < MarKsaitis> ;]
04:19 < Fleck> :D
04:19 < janjust> hehe now try 1000
04:19 < WormFood> try 702 next ;)
04:19 < janjust> lol WormFood 
04:19 < Fleck> lol
04:19 < MarKsaitis> 1000 works too
04:19 < MarKsaitis> ;]
04:19 < janjust> ok, now try 1200
04:19 < MarKsaitis> 1200 works too, I got ur idea ;]
04:19 < janjust> if 1200 works, then try 1300, then 1400
04:19 < MarKsaitis> 1400 ok
04:19 < janjust> next: 1450
04:20 < MarKsaitis> 1412 was the last one to work
04:21 < MarKsaitis> what does it mean to me? Log still says it has got something more than 30 000 =)
04:21 <@vpnHelper> RSS Update - forum: OpenVPN + IPv6 <http://forums.openvpn.net/topic7713.html#p10107> || wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html#p10106>
04:21 < janjust> now, in the server and client configs, add 'tun-mtu 1440' 
04:21 < janjust> restart the connection
04:21 < MarKsaitis> but 1440 didnt work?
04:21 < MarKsaitis> :)
04:21 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:22 < MarKsaitis> should I do tun-mtu or link-mtu? i use TAP adapters
04:22 < MarKsaitis> janjust, thanx
04:22 < janjust> this is ethernet-mumbo jumbo: if your mtu is 1500 your maximum ping size is 1472 (is 1500-28)
04:23 < janjust> so if your maximum ping size is 1412 then your mtu is 1412+28 = 1440
04:23 < MarKsaitis> janjust, thank you :)
04:23 < janjust> I'd use tun-mtu; link-mtu = tun-mtu + X bytes (I don't recall what X is, but it's not 28)
04:23 < MarKsaitis> OK
04:23 < MarKsaitis> understood
04:24 < Fleck> :D
04:24 < MarKsaitis> janjust, what if I want this solution to be more universal as client travels a lot
04:25 < Fleck> try UDP :D
04:25 < Fleck> should work out of the box
04:25 < MarKsaitis> Fleck, why should it work out of the box? :)
04:25 < Fleck> MarKsaitis btw, set up two servers :D one with UDP, one with TCP and maybe more... with different MTU :D
04:27 < janjust> MarKsaitis:  this is a generic problem of setting up VPNs (not just OpenVPN); I'd set 'tun-mtu 1400' as that will work in 99% of the cases
04:27 <@vpnHelper> RSS Update - forum: wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html#p10108>
04:27 < janjust> if openvpn does not work with 'tun-mtu 1400' then there's something screwy in the remote network setup
04:28 < janjust> and this applies to both udp mode and tcp mode - the same mtu issues will arise
04:28 < MarKsaitis> thank you for the help
04:28 < janjust> also, for a 'road warrior' tcp mode works more often than udp mode : remote sites, incl hotels, are notorious for blocking udp traffic
04:28 < MarKsaitis> my current configs do not have any tun-mtu settings at all
04:28 < MarKsaitis> so I will ad tun-mtu 1400 =)
04:29 < janjust> but fleck's suggestion to set up 2 openvpn instances, one for udp and one for tcp (on port 443 to avoid some firewalls) is a good one
04:29 < MarKsaitis> janjust, yeah, thats why I use tcp
04:30 < MarKsaitis> I still din't get how MTU got this big :) 30K
04:30 < MarKsaitis> a complete mistery
04:31 < janjust> where did the 30K message come from?
04:32 < MarKsaitis> WARNING: Bad encapsulated packet length from peer (32871), which must be > 0 and <= 1576 -- pleas
04:32 < janjust> ow *that* message... right, now I remember
04:32 < MarKsaitis> if there is no tun-mtu setting, then what is being used by default?
04:32 < janjust> that has nothing to do with the MTU size, it's just that the packet that was transferred got messed up
04:32 < janjust> default=1500
04:33 < MarKsaitis> I see, so I do need tun-mtu to be 1400 on both serv and client and thats end of the story. I will try that when I will get a chance
04:35 < janjust> there's still something screwed up in your network/ISP , but you wouldn't be the first one ;-)
04:38 <@vpnHelper> RSS Update - forum: OpenVPN + IPv6 <http://forums.openvpn.net/topic7713.html#p10110> || TLS ERROR <http://forums.openvpn.net/topic7714.html>
04:38 < MarKsaitis> janjust, if server side has this 1400 mtu setting and client doesnt have any, what will be used in communication then?
04:38 < janjust> you will get very funny results, if the connection starts up at all
04:39 < MarKsaitis> Well, I am not testing from dubai one, but im testing from london to another office in there where server is
04:39 < janjust> during the initialisation phase the server and the client tell each other what their mtu size is; if there's a mismatch a warning is printed, and the connections proceeds, but it usually won't work
04:40 < MarKsaitis> and it seems ok
04:40 < MarKsaitis> it works if server has it and client doesnt
04:41 < MarKsaitis> I got these two
04:41 < MarKsaitis>  WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1476', remote='link-mtu 1576'
04:41 < MarKsaitis> WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1432', remote='tun-mtu 1532'
04:41 < Fleck> try to copy large files :D
04:41 < MarKsaitis> which doesnt make sense, as server now has 1400 mtu setting in config and client doesnt ;]
04:43 < MarKsaitis> i set tun-mtu in serber config file, restarted it. Why would it say local tun-mtu 1432 if its actually 1400 =))
04:43 -!- huwenfeng [~huwenfeng@220.181.71.219] has quit [Remote host closed the connection]
04:43 <@vpnHelper> RSS Update - forum: TLS ERROR <http://forums.openvpn.net/topic7714.html#p10112> || wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html#p10111>
04:43 < janjust> ah right... IIRC it's because you are using a tap adapter
04:43 < janjust> and there's no such thing as tap-mtu
04:44 < MarKsaitis> should I care about that? Or is it okay to have tun-mtu 1400 for me when using tap adapters?
04:47 < janjust> found it in the sources: for a tap adapter 32 bytes extra are added to the 'tun-mtu' setting
04:47 < janjust> well 1400+32 is still smaller than the 1440 that seemed to be the maximum
04:48 < janjust> if you want to be safe you could lower it , but it will have a negative impact on performance
04:48 < MarKsaitis> the strange thing is how its all refered. It looks like the same thing in config file and log, hence "tun-mtu" :)
04:48 < MarKsaitis> so I should set my tun-mtu 1400-32
04:50 -!- WormFood [~wormfood@183.39.80.33] has quit [Quit: rebooting (system upgrade)]
04:50 < janjust> it is a bit confusing, hence it might have been better to go for the link-mtu
04:51 < MarKsaitis> so I want my link-mtu to be 1400-76?
04:51 < MarKsaitis> and it still is the same stuff
04:51 < MarKsaitis> just looks a bit better
04:51 < MarKsaitis> doesn it
04:51 < janjust> nope, just try a tun-mtu of 1400 or 1400-32 ; you will need to play with it a bit to get the optimal setting
04:52 < janjust> if you want to be paranoid just go for link-mtu=1313 ;p
04:52 < MarKsaitis> I went for 1400-32 ;]
04:53 < MarKsaitis> hope that will make a difference cos am just about to have loads of clients for different servers with this all thing
04:54 <@vpnHelper> RSS Update - forum: they even block L2TP vpn in iran <http://forums.openvpn.net/topic7715.html> || OpenVPN + IPv6 <http://forums.openvpn.net/topic7713.html#p10113>
04:55 < MarKsaitis> janjust, I do appreciate your help a lot :)
04:55 < MarKsaitis> these sort of things should be a must to have in quick openvpn implementation guide
04:55 < janjust> MarKsaitis:  just buy my book, although I must add that the +32 bytes and +44 bytes link-mtu things are not in there ;-)
04:56 < MarKsaitis> show me ur book =)
04:56 < janjust> !book
04:56 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
04:57 < MarKsaitis> ok ;]
04:58 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
05:01 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 240 seconds]
05:01 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
05:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
05:02 < MarKsaitis> janjust, I must admit ur book looks all good and I wish u sucess with i :)
05:02 < janjust> thx MarKsaitis 
05:03 < MarKsaitis> I think there is a need for eBook management system on PCs these days, where it is easy to switch from book to book and easy to find things there would be a need for
05:03 < MarKsaitis> on demand
05:03 < MarKsaitis> books like that could be system's plugins, and all of that could be used by systems admins
05:03 < MarKsaitis> and books like that would be a good sucess
05:06 <@vpnHelper> RSS Update - forum: TLS ERROR <http://forums.openvpn.net/topic7714.html#p10115>
05:06 < MarKsaitis> I just hope that this modification will hope for client in dubai, I will only have few chances to set it up
05:11 < janjust> dubai is a tricky place - they do monitor/restrict internet access
05:14 -!- darth_bitterman [~yury@84.51.202.179] has quit [Quit: Leaving]
05:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:18 <@vpnHelper> RSS Update - forum: TLS ERROR <http://forums.openvpn.net/topic7714.html#p10116>
05:54 <@vpnHelper> RSS Update - forum: wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html#p10117>
06:00 <@vpnHelper> RSS Update - forum: wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html#p10118>
06:06 <@vpnHelper> RSS Update - forum: wrong p2p networks between a server and a client <http://forums.openvpn.net/topic7711.html#p10119>
06:41 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
06:41 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:46 -!- theDoc [~Link@110.92.102.37] has quit [Ping timeout: 240 seconds]
06:46 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10120>
06:48 -!- theDoc [~Link@110.92.102.37] has joined #openvpn
06:58 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 250 seconds]
06:59 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
07:02 -!- 13WAA4HIR is now known as Martink
07:40 <@vpnHelper> RSS Update - forum: Win 7 OpenVPN TUN / TAP adapter in VirtualBox with Ubuntu VM <http://forums.openvpn.net/topic7716.html>
07:45 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has joined #openvpn
07:53 < dschuett> I have connected another site(openvpn client) to my openvpn server(192.168.0.1). - I can ping the LAN behind my openvpn server FROM my new site, but i can't ping the internet (www.google.com). resolv.conf is set to use the DNS server on the side of the openvpn server(192.168.0.1)
08:02 -!- zeeshoem [~mnathani@bas1-toronto46-1177980372.dsl.bell.ca] has joined #openvpn
08:13 -!- albech_ [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
08:13 -!- albech [~thomas@110.164.248.17] has joined #openvpn
08:31 -!- luneff [~yury@84.51.202.179] has joined #openvpn
08:33 -!- luneff [~yury@84.51.202.179] has quit [Read error: Connection reset by peer]
08:34 -!- luneff [~yury@84.51.202.179] has joined #openvpn
08:34 < janjust> dschuett:  is it the resolver which fails or the actual internet link
08:35 -!- Diffen2 [~diffen2@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
08:35 < janjust> what happens if you ping 74.125.79.99
08:35 < janjust> (which is the address of www.google.com from one of my PCs)
08:59 <@vpnHelper> RSS Update - forum: Win 7 OpenVPN TUN / TAP adapter in VirtualBox with Ubuntu VM <http://forums.openvpn.net/topic7716.html#p10122>
09:04 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
09:05 < dschuett> janjust: I figured it out... my allow-query option in BIND was rejecting it.
09:06 < janjust> hehe, had little to do with openvpn then :)
09:12 -!- gladiatr_afk is now known as gladiatr
09:12 < gladiatr> Isn't this the part where someone comes out of the woodwork to declare that openvpn should Just Handle That Shit?
09:12 < gladiatr> :)
09:12 -!- bitterman [~yury@84.51.202.179] has joined #openvpn
09:15 -!- luneff [~yury@84.51.202.179] has quit [Ping timeout: 240 seconds]
09:17 -!- theDoc [~Link@110.92.102.37] has quit [Ping timeout: 240 seconds]
09:18 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
09:18 < MaxFrames> hello
09:19 < MaxFrames> I'm progressing in my first openvpn installation on debian linux. I've just started the server for the first time from the shell (openvpn [path-to-server.conf]). the last output line is "Initialization Sequence Completed". But the cursor did not come back. how do I go back to the shell prompt?
09:23 -!- darkdrgn2k [~darkdrgn2@70.33.240.50] has joined #openvpn
09:23 < darkdrgn2k> hi
09:23 < darkdrgn2k> uim trying to do a "client-connect /usr/bin/ddns"
09:23 < darkdrgn2k> the script is accessable by nobody (user/group ovpn runs as)
09:23 -!- theDoc [~Link@110.92.102.37] has joined #openvpn
09:23 < darkdrgn2k> but when client connects i get
09:23 < darkdrgn2k> client-connect command failed: could not execute external program
09:24 < janjust> darkdrgn2k:  did you add 'script-security 2' ?
09:24 < darkdrgn2k> Wed Mar  2 10:17:59 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
09:25 < darkdrgn2k> command line seems to be
09:25 < janjust> MaxFrames:  this is normal behavior; if you add "daemon" and "log-append /var/log/openvpn.log" to the server config it will daemonize itself
09:25 < darkdrgn2k> /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/pwdvpn.pid --config pwdvpn.conf --cd /etc/openvpn --script-security 2
09:25 < MaxFrames> so now to exit do I just ctrl+c it?
09:25 < janjust> MaxFrames:  yep
09:26 < janjust> darkdrgn2k:  /usr/bin/ddns is the script you're talking about? which language was it written in? what's on the first line (she-bang) of the script?
09:26 < MaxFrames> I did, and it threw a lot of warnings (operation not permitted, linux route delete command failed, permission denied)
09:26 < darkdrgn2k> bash
09:26 < MaxFrames> in the end it said "process exiting" anyway
09:27 < darkdrgn2k> hmmmm...
09:27 < darkdrgn2k> that sux
09:27 < darkdrgn2k> all i was missing was the #!/bin/sh 
09:27 < darkdrgn2k> lol
09:27  * darkdrgn2k bangs head against wall
09:28 < MaxFrames> janjust: excuse the lame question, but once I've started it with "openvpn server.conf daemon log-append /var/log/openvpn.log", what's the correct "clean" way of stopping/terminating it?
09:28 < darkdrgn2k> hmm
09:29 < darkdrgn2k> in the client connect script on the server  "${ifconfig_remote}" is which side. the server or client
09:29 < janjust> MaxFrames:  try starting it with --daemon --log-append /var/log/openvpn.log from the command line; remove the dashes if it's inside the server config file
09:30 < janjust> to kill a daemonized process, use --writepid /var/run/openvpn.pid on startup and do a "kill `cat /var/run.openvpn.pid`" 
09:30 < janjust> "killall openvpn" is also crude, but effective
09:30 < janjust> glad to be of help, darkdrgn2k  ;-)
09:31 < MaxFrames> so, no such thing as the handy  dhcp3-server's "start/stop" scripts?
09:31 < janjust> MaxFrames:  on debian? sure... how about /etc/init.d/openvpn ?
09:32 < MaxFrames> I guess :P
09:33 < darkdrgn2k> arg which ENVIRONEMTN VARIABLE is the client's ip address
09:33 < darkdrgn2k> (then one you use on the server side to access the remote pc)
09:34 < janjust> darkdrgn2k:  "${ifconfig_remote}" is the remote VPN IP ; ${untrusted_ip} is the non-VPN remote IP
09:35 < darkdrgn2k> cause im getting 10.243.0.2 on the server
09:35 < darkdrgn2k> but the remote pc says 0.10
09:35 < janjust> 10.243 is your VPN IP range?
09:36 < MaxFrames> by using log-append, do I risk ending up with a huge log filling up all the hard drive?
09:36 < darkdrgn2k> 10.243.0.0/255.255.0.0
09:36 < darkdrgn2k> server 10.243.0.0 255.255.0.0
09:36 < darkdrgn2k> and ipp.txt shows the cert at 10.243.0.8 no .2
09:36 < janjust> MaxFrames:  yes, you can also use "log /var/log/openvpn.log" ; this means the log file gets overwritten each time openvpn restarts; the log file can still fill up the hard disk though
09:36 < darkdrgn2k> .2 iirc is the server
09:37 < janjust> darkdrgn2k:  you're not using 'topology subnet' I presume ; then the *second* client is assign the .10 address
09:37 < MaxFrames> do you know of a way of using log-append and setting a size limit (i.e. the log is only overwritten if the size limit is reached), or shall I ask in #debian?
09:37 < janjust> s/assigned/&ed
09:38 < darkdrgn2k> second client?
09:38 < janjust> MaxFrames:  I'd use logrotate for that, but that's not openvpn specific
09:38 < darkdrgn2k> wait does client-connect run twice?
09:39 < janjust> nope, but if your ipp.txt file contains an entry '10.243.0.4 some-cert-name' then the next client gets the block '10.243.0.8/30' assigned, which translates to a VPN IP of 10.243.0.10 on the client
09:39 < darkdrgn2k> janjan. so why does the script get .2
09:39 < janjust> OTOH, if you're using a client-connect script then I'd stop using an ipp.txt file
09:39 < darkdrgn2k> janjan: the client-connect script just runs a dynamic dns update script..
09:41 < janjust> darkdrgn2k:  I'd not use a 'client-connect' script for this, try using a 'learn-address' script instead
09:41 < darkdrgn2k> whast the diff?
09:41 < janjust> the problem is that the client-connect script is used to assign a particular address to a client,  overruling whatever is listed in the ipp.txt
09:42 < janjust> so when the client-connect script runs openvpn has not decided yet which client IP to assign and will feed you the first address from the ip pool (probably .2 if you're using "topology subnet")
09:42 < darkdrgn2k> aaaaa
09:42 < janjust> then afterwards the ifconfig-pool-persist check comes along and it assigns whatever is found in the ipp.txt file
09:42 < darkdrgn2k> so change client-connect /usr/bin/ddns to learn-address /usr/bin/ddns
09:42 < janjust> I'd give it a shot
09:43 -!- WormFood [~wormfood@183.39.80.33] has joined #openvpn
09:43 < janjust> remember though that the learn-address script is called with different parameters ("add", "delete")
09:43 < darkdrgn2k> but the env variable remain the same right
09:43 < janjust> yep
09:43 <@dazo> almost
09:43 < darkdrgn2k> thast all i use anyway lol
09:44 <@dazo> there's very little env variables in when called with delete
09:44 <@dazo> and the arguments also differs if you're using tun or tap mode
09:44 < darkdrgn2k> when does the leanr scritp get fired
09:44 <@vpnHelper> RSS Update - forum: Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html>
09:45 <@dazo> and to add more fun ... especially in tun mode, I've seen --learn-script will also be called with an 'update' mode as well
09:45 < darkdrgn2k> arg still got 10.243.0.2
09:45 < janjust> hehe yep dazo
09:45 < janjust> darkdrgn2k:  delete the ipp.txt file and restart the server
09:45 < MaxFrames> mm, "/etc/init.d/openvpn start" does not seem to do anything
09:45 < darkdrgn2k> echo update add pc${common_name}.domain.net  648000 A ${ifconfig_remote}  >> /tmp/t${common_name}
09:45 <@dazo> darkdrgn2k: when it is called depends again on tun/tap mode ... in tun mode, it usually gets called almost instantly after authentication is done
09:45 < darkdrgn2k> thast right right?
09:45 < darkdrgn2k> ipconfig_remote
09:46 <@dazo> in tap mode ... it's called when the first package hits the tunnel
09:46 < MaxFrames> it says "Starting virtual private network daemon" but then "ps -ef | grep openvpn" reveals it's not running
09:46 < darkdrgn2k> im trying to set 10.243.10.10 to A
09:46 -!- durando [~durando@cpe-76-178-226-137.maine.res.rr.com] has joined #openvpn
09:46 < darkdrgn2k> sorry 0.10
09:46 < darkdrgn2k> bit i keep getting 0.2
09:46 < janjust> darkdrgn2k:  the learn-address script is called with the args "add remote-IP common-name"
09:46 < janjust> so $2 is simply the VPN IP of the remote client (in tun mode)
09:47 < durando> hey guys i have an openvpn setup but i cant seem to ping to the other side of the network from either place
09:47 < darkdrgn2k> hmm
09:47 < janjust> MaxFrames:  dunno how debian has implemented the /etc/init.d/openvpn script
09:47 < darkdrgn2k> soo
09:47 < darkdrgn2k> update add pc$3.test.net  648000 A $2  >> /tmp/t$3
09:48 < darkdrgn2k> look at that..
09:50 < darkdrgn2k> hey stupid question
09:50 <@vpnHelper> RSS Update - forum: Win 7 OpenVPN TUN / TAP adapter in VirtualBox with Ubuntu VM <http://forums.openvpn.net/topic7716.html#p10124>
09:50 < darkdrgn2k>  648000 <- thats the TTL of a entry
09:50 < darkdrgn2k> what does it mean
09:50 < darkdrgn2k> that after  648000 seconds it will delete itself or require refershing
09:51 <@dazo> it will not delete itself ... but the DNS clients can cache that info up to 648000, before checking against the server again
09:51 < darkdrgn2k> aa
09:51 < darkdrgn2k> so low number for ddns
09:51 < MaxFrames> confirmed, it is not running, ifconfig shows no TUN device
09:52 <@dazo> darkdrgn2k: yeah
09:52 < darkdrgn2k> ok cool
09:52 < darkdrgn2k> thanx
09:53 -!- EugeneKaway is now known as EugeneKay
09:53 < janjust> MaxFrames:  I think the debian /etc/init.d/openvpn script starts all entries /etc/openvpn/*.conf
09:53 < janjust> so if the entry is named /etc/openvpn/blah.conf it should get started - but to make sure, read the /etc/init.d/openvpn script
09:54 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Quit: Leaving]
09:54 < MaxFrames> ok, let me check
09:54 < gladiatr> Indeed.  And the log output ends up in /var/log/daemon.log
09:55 < gladiatr> the log header is ovpn-[nameofvpnconfigfile without the .conf]
09:55 <@vpnHelper> RSS Update - forum: Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10125>
09:55 < MaxFrames> woopsie.... my config files are in /etc/openvpn/config, and the script seems to point to /etc/openvpn for them
09:55 < EugeneKay> The CentOS init scripts do that. I named my client's conf files functionally by the (set of) server(s) they are connecting to, rather than simply client.conf, with a matching subdir/ for the keyfiles, etc.
09:56 -!- theDoc [~Link@110.92.102.37] has quit [Ping timeout: 250 seconds]
09:57 -!- theDoc [~Link@110.92.102.37] has joined #openvpn
09:57 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:57 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:57 < MaxFrames> now something has changed. I've copied server.conf to /etc/openvpn and tried again to start the daemon. result: "starting vpn daemon: server failed!"
09:57 < MaxFrames> no other clue as to why
09:57 < janjust> MaxFrames:  as gladiatr said, check the log file /var/log/daemon.log
09:58 < MaxFrames> right, sorry I missed that
09:59 < MaxFrames> ok, it says that it cannot find the dh1024.pem file
09:59 < janjust> MaxFrames:  make sure you supply absolute paths to the certificate and dh1024.pem files in the server config and try again
10:00 < MaxFrames> yet, it's there (in /etc/openvpn/easy-rsa/2.0/keys)
10:00 < MaxFrames> I'll try now
10:00 < janjust> the dir " /etc/openvpn/easy-rsa/2.0/keys" is not the best place to keep these files for production
10:00 <@vpnHelper> RSS Update - forum: Win 7 OpenVPN TUN / TAP adapter in VirtualBox with Ubuntu VM <http://forums.openvpn.net/topic7716.html#p10126>
10:01 < janjust> you'd better copy them over to another location; the truly security paranoid don't even store their VPN keys on the same PC as the vpn server itself
10:02 < MaxFrames> janjust: right; I'm just trying to see if it starts and stops correctly; then I'll stop it and store everything in a safe place
10:02 < gladiatr> janjust, not only that but I store them on an encrypted fs :)
10:02  * janjust sees that gladiatr is one of those truly security paranoid sysops
10:03 < gladiatr> indeed
10:03 < MaxFrames> the needed files will be server.crt, server.key, server.conf and dh1024.pem, if I'm not mistaken, all the others can/must be moved somewhere (safe) else
10:03 < MaxFrames> right?
10:03 < gladiatr> If nothing else, I want to be able to RMA my disk if the thing should go all boat anchor on me :)
10:03 < janjust> sounds right, MaxFrames 
10:04 < gladiatr> If you want to be just a little more secure, you can also use the tls-auth option as well
10:04 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 240 seconds]
10:04 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Quit: Leaving...]
10:05 -!- WormFood [~wormfood@183.39.80.33] has quit [Ping timeout: 250 seconds]
10:06 -!- WormFood [~wormfood@183.39.77.180] has joined #openvpn
10:06 <@vpnHelper> RSS Update - forum: Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10127>
10:06 < MaxFrames> gosh... I specified the full path to dh1024.pem in server.conf but nothing changed ("no such file")
10:07 < janjust> MaxFrames:  most likely caused by the fact that the file is not readable to the user which is used to run the openvpn process
10:07 < janjust> copy the dh1024.pem to /etc/openvpn/config , do a chmod 644 on it and try again
10:07 < MaxFrames> I'm in a root shell (and I used the same shell to run the dh generate script)
10:09 < MaxFrames> but sorry... I didn't notice that the daemon.log file was not updating it
10:09 < MaxFrames> *updating* (-it)
10:09 < MaxFrames> the last entry is 20 minutes ago
10:10 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
10:10 < MaxFrames> if I try to start the daemon now, it says "failed" but nothing new is logged to daemon.log
10:10 < MaxFrames> the error about dh1024.pem is from 20 minutes ago
10:10 < gladiatr> forgo the init script for now, then.  Just do: openvpn --config /etc/openvpn/yourconfig.conf  --verb 5
10:12 < majuk__> Hey all. Trying to get the OpenVPN client on Win 7 64bit. Install goes off, but when the installer calls tapinstall.exe, the program launches and doesn't proceed. The main install program doesn't notice and continues on like everything is ok. tapinstall.exe shows up in Task Manager like it's running, but...? Running it directly from ../bin/ has the same effect.
10:12 <@vpnHelper> RSS Update - forum: Win 7 OpenVPN TUN / TAP adapter in VirtualBox with Ubuntu VM <http://forums.openvpn.net/topic7716.html#p10128>
10:12 < MaxFrames> done. no message at all. (!!)
10:12 < MaxFrames> TUN did not come up
10:12 < majuk__> And I am using Vista compatibility mode.
10:12 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
10:14 < janjust> check the config file again MaxFrames , see where the log message are sent to
10:14 < gladiatr> what's the output of lsmod |grep tun?
10:14 < gladiatr> indeed
10:14 < janjust> majuk__:  download openvpn 2.1.4 and don't run it in vista compat mode ; it should install just fine 
10:14 < EugeneKay> Ugh vista
10:14 < MaxFrames> janjust: you are right, they are being redirected to /var/log/openvpn.log now
10:15 < EugeneKay> Nothing works right in Vista
10:15 < MaxFrames> can I pastebin the error?
10:15 < majuk__> janjust, Ah, ok, I'll give that a whirl
10:16 < janjust> MaxFrames:  sure, don't know if I have the time to look at it though ;-)
10:17 < MaxFrames> it's just a single line so I'll paste it here
10:17 <@vpnHelper> RSS Update - forum: Win 7 OpenVPN TUN / TAP adapter in VirtualBox with Ubuntu VM <http://forums.openvpn.net/topic7716.html#p10130> || Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10129>
10:17 < MaxFrames> "Cannot open dh1024.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2005D080:BIO routines:BIO_new_file:no such file"
10:18 < MaxFrames> it's like the problem is not with dh1024.pem itself, but with another file...
10:18 < gladiatr> For now, specify a fully-qualified path to your dh1024.pem file
10:18 < MaxFrames> done already, but no change
10:19 < majuk__> janjust, Negative, tapinstall.exe launches but no display, no nothing
10:20 < janjust> majuk__:  is the openvpn installer running with elevated privileges?
10:20 < majuk__> Yup.
10:20 < janjust> open up a command window with elev privileges and try running the tapinstall.exe command directly
10:21 < janjust> post the output on pastebin, I'm sure some developers will be interested to see what is failing
10:21 < janjust> MaxFrames:  post your server config on pastebin so we can have a look
10:21  * dazo puts on the "I'm not doing Windows development" t-shirt
10:21 <@dazo> :)
10:23 < janjust> hehe dazo
10:23 <@vpnHelper> RSS Update - forum: Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10131>
10:23 < majuk__> janjust, Have to do it some other time. The client just walked out the door with her laptop.
10:23 < janjust> majuk__:  BTW, what windows version was it on the laptop?
10:23 < janjust> ow right, never mind. doh. time to go home
10:23 < janjust> answering to too many posts at the same time
10:24 < majuk__> janjust, 7, 64bit
10:24 < janjust> FWIW: I've installed openvpn 2.1.4 on win 7 64bit without any problems
10:25 < janjust> so it __IS__ possible :) ... I just don't know what is going on on your customers' laptop
10:25 -!- Guest35756 is now known as stony
10:27 < MaxFrames> janjust: I'm progressing... it seems that every file must be in /etc/openvpn, it does not like other paths
10:27 < gladiatr> MaxFrames, you running selinux or some such?
10:27 < janjust> that's an ugly debian hack if that is true...
10:28 < janjust> <<< out for today ; bye
10:28 <@vpnHelper> RSS Update - forum: Win 7 OpenVPN TUN / TAP adapter in VirtualBox with Ubuntu VM <http://forums.openvpn.net/topic7716.html#p10132>
10:28 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:28 < gladiatr> It sounds like one of linux's sometimes useful/oft annoying kernel security gadgets
10:28 < gladiatr> later jan
10:28 < MaxFrames> gladiatr: debian lenny
10:29 < MaxFrames> yay! it WORKS! :)))
10:29 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:29 < gladiatr> what's the output of /usr/sbin/sestatus?
10:29 < gladiatr> sweet
10:32 -!- TheSilentTechie [~TheSilent@dslb-088-067-013-039.pools.arcor-ip.net] has joined #openvpn
10:36 < majuk__> janjust, There are no errors reported, tapinstall.exe just launches and sits idle. I couldn't figure out the syntax to run it from the command line, so that's all the information I have, unfortunately.
10:36 < majuk__> I guess there might be errors reported on the CLI if I had been able to do it that way
10:36 < majuk__> BUT, I did not.
10:38 < MaxFrames> thanks so much everybody for putting me on the right track. Enough for today. Cya!
10:38 < gladiatr> majuk__, there's a .bat file in the openvpn/bin directory that you can look at to get the CLI method of using the tool
10:38 < gladiatr> later Max :)
10:39 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has left #openvpn []
10:41 -!- MaxFrames [~MaxFrames@147.162.217.235] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc Insomnia 4.0.2, revision: 4744, sources date: 20100627, built on: 2010-08-01 17:01:07 UTC 4744 http://www.kvirc.net]
10:52 -!- copkiller [~o2@unaffiliated/spice] has joined #openvpn
10:53 < majuk__> gladiatr, Yea, it looks like it's not much of a priority for the client anyway. So just chalk it up to the fickle programming gods. She has enough crap on her laptop to smother a panda, so god knows what the problem is.
10:54 < gladiatr> poor panda
10:54 < majuk__> I'll try to get some feedback at our meeting next Monday... or, crap, I'll be in Kansas. Well, I'll try again sometime to see if I can get any useful feedback for y'all.
10:55 -!- copkille1 [~o2@unaffiliated/spice] has quit [Ping timeout: 276 seconds]
10:55 < gladiatr> Kansas, huh?  what unfortunate stroke of fate is bringing you here?
10:57 < majuk__> gladiatr, Company has a new client up that way, going to do the install of our equip.
10:57 < durando> anyone have experience running openvpn through tomatousb router firmware
10:57 < gladiatr> good times :)
10:57 < majuk__> lol, yea, I'm pumped.
10:58 < majuk__> I do like the women up that way, however. Gotta love mid-western girls.
10:58 < gladiatr> durando, not directly, no.  There have been several individuals that have passed through here and the forums that are, though.  You might want to do a search of those forums for some hints
10:58 < gladiatr> majuk__, indeed.  They can be entertaining
10:59 < gladiatr> Of course, They probably think of Us as miserable trogs, but that is as it is, huh? ;)
10:59 < durando> gladiatr: it appears that i have the connection but i cant talk to computers on either side of the network
11:00 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
11:02 < gladiatr> durando, yeah.  Seriously.  Check the tomato forums.  Under different circumstances I'd be happy to help troubleshoot this, but I'm kinda swamped with the RL work things atm.
11:02 < gladiatr> I like those alternafirmwares and all, but they all tend to use different definitions in their configuration interfaces and store their configurations in ways that make my head hurt to look at.
11:02 < durando> alright gladiatr i'll look but may hit you up again some other time if i cant figure it out i completely understand rl messing with stuff
11:03 < gladiatr> good luck.  groking the openvpn is worth it.
11:08 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:12 -!- darth_bitterman [~yury@84.51.202.179] has joined #openvpn
11:15 -!- bitterman [~yury@84.51.202.179] has quit [Ping timeout: 246 seconds]
11:19 <@vpnHelper> RSS Update - forum: PING: transmit failed, error code 1232. <http://forums.openvpn.net/topic7718.html>
11:23 < majuk__> gladiatr, Lowered expectations makes it that much easier to impress them.
11:23 < gladiatr> hehe
11:24 -!- Diffen2 [~diffen2@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
11:31 -!- durando [~durando@cpe-76-178-226-137.maine.res.rr.com] has left #openvpn []
11:31 -!- gladiatr is now known as gladiatr_afk
11:43 < hyper_ch> Bushmills: http://geekandpoke.typepad.com/geekandpoke/2011/03/architectural-best-practices.html
11:43 <@vpnHelper> Title: Geek And Poke: Architectural Best Practices (at geekandpoke.typepad.com)
11:48 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
11:53 -!- dazo is now known as dazo_afk
11:56 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:14 -!- asgw [~sc@unaffiliated/asgw] has joined #openvpn
12:16 <@vpnHelper> RSS Update - forum: OpenVPN is connected but does not work <http://forums.openvpn.net/topic7719.html>
12:17 < asgw> Hi... Got what is probably a simple question: I want to accept *all* openvpn traffic on a linux box using iptables,  Have added "iptables -A INPUT -i tun+ -j ACCEPT" but I'm getting 'No route to host' from other vpn clients, which are able to connect fine to this host on tcp port 80 which is separately explicitly open via iptables.
12:18 < asgw> Any ideas?
12:18 < asgw> !welcome
12:18 < asgw> !goal
12:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:18 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:26 < asgw> I can also connect locally to the openvpn IP/port I'm trying to connect to, just not remotely.
12:31 -!- TheSilentTechie [~TheSilent@dslb-088-067-013-039.pools.arcor-ip.net] has left #openvpn ["Verlassend"]
12:35 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
12:35 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Ping timeout: 246 seconds]
12:38 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
12:39 -!- bitterman [~yury@84.51.202.179] has joined #openvpn
12:42 -!- darth_bitterman [~yury@84.51.202.179] has quit [Ping timeout: 240 seconds]
12:45 <@vpnHelper> RSS Update - forum: Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10135>
12:47 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
12:47 < majuk__> I should really add this chan to my connect script.
12:51 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
12:55 -!- darth_bitterman [~yury@84.51.202.179] has joined #openvpn
12:58 -!- bitterman [~yury@84.51.202.179] has quit [Ping timeout: 272 seconds]
13:11 -!- dazo_afk is now known as dazo
13:11 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Ping timeout: 250 seconds]
13:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
13:24 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
13:27 < gladiatr_afk> run the same rule except use "iptables -I INPUT 1 -i tun...
13:27 -!- gladiatr_afk is now known as gladiatr
13:27 < gladiatr> no time to help debug your iptables config, but I would guess that your rule is being preempted by one higher up in the chain
13:47 -!- zeeshoem [~mnathani@bas1-toronto46-1177980372.dsl.bell.ca] has quit []
13:49 -!- darth_bitterman is now known as luneff
13:50 -!- _Dave123_ [Octo@nunk.deziweb.com] has joined #openvpn
13:50 < _Dave123_> hi, i have a openvpn server running. I also run Virtualbox with a vm guest (NAT) where I forward 1 port with
13:50 < _Dave123_> I like that port to be open on the main external IP interface, but it somehow defaults to the VPN internal ip
13:50 < _Dave123_> Is there anything I can do about this?
13:51 < _Dave123_> I correctly forward the IP in vbox, but it keeps listening on 10.8.0.1
13:52 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:58 < EugeneKay> Vbox and vmware NAT / forwarding is an ugly thing.I use bridged or host-only mode.
13:59 < _Dave123_> bridged doesnt work for me here with my dedicated server setup
13:59 < _Dave123_> so i need nat
13:59 < EugeneKay> Host-only is a lot more controllable than vbox nat
13:59 < _Dave123_> not sure what host-only is
13:59 < EugeneKay> Virtual LAN 
14:00 < _Dave123_> ok
14:00 < _Dave123_> its easy to set up? how does it work?
14:00 < _Dave123_> i can select it now and see what happens
14:00 < EugeneKay> Dunno in vbox, but in vmware you just pick Host Only
14:00 < EugeneKay> You get a host-only network adapter that exists "inside" the machine
14:01 < _Dave123_> i pick it in vbox now
14:03 < _Dave123_> ok started it
14:03 < _Dave123_> i have no internet access from the vm guest now
14:03 < _Dave123_> what should i change?
14:03 < EugeneKay> You need to enable NAT to that virtual nic on the host
14:03 < _Dave123_> how u mean? I just set Host-ONly as adapter
14:04 < EugeneKay> What you're doing is moving the NAT stuff from vbox to your host OS' control
14:04 < EugeneKay> Linux you're after the iptables rules
14:04 < _Dave123_> So I should use NAT and NOT Host-only now right?
14:04 < EugeneKay> No, you do Host-Only, but then setup the NAT yourself
14:05 < _Dave123_> i dont think that can work
14:05 < _Dave123_> I mean, I don't have a network connection now
14:05 < EugeneKay> It works fine for me
14:05 < _Dave123_> So I don't see how enabling NAT ports would help
14:05 < EugeneKay> Outgoing NAT
14:05 < _Dave123_> so open all ports then right?
14:05 < _Dave123_> how can I do this?
14:06 < EugeneKay> Something like iptables -t nat -A POSTROUTING -s 172.16.0.0/255.255.255.0 -o eth0 -j MASQUERADE
14:07 < EugeneKay> With 172.16.0.x being the ip address range of the host-only network, and eth0 your host's "Internet" connection
14:07 < _Dave123_> oh I've tried this earlier
14:07 < _Dave123_> There is no host only network
14:07 < _Dave123_> Only the external IP
14:07 < EugeneKay> Then you need one
14:07 < _Dave123_> ok thx im not gonna bother
14:07 < _Dave123_> I mean im busy with this a few hours already will just leave itthanks
14:30 -!- darkdrgn2k [~darkdrgn2@70.33.240.50] has quit [Ping timeout: 240 seconds]
14:34 <@vpnHelper> RSS Update - forum: Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html>
14:37 -!- darkdrgn2k [~darkdrgn2@70.33.240.50] has joined #openvpn
14:39 -!- pmatulis [~peter@64.34.151.178] has joined #openvpn
14:39 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
14:40 < pmatulis> should i be concerned by this: http://pastebin.com/dBhRZ1Wq ?
14:43 < majuk__> pmatulis, The 84. address is German. Not as worrying as Russian or Chinese, I suppose.
14:44 < pmatulis> majuk__: heh.  so these are access attempts?
14:45 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
14:49 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:50 <@vpnHelper> RSS Update - forum: Connect ok but I get a lot of econnrefused and ehostunreach <http://forums.openvpn.net/topic7703.html#p10137>
14:55 < dvl> ecrist: BSDCan 2011 list of talks should be out this week.
14:55 <@vpnHelper> RSS Update - forum: Help with internal routing <http://forums.openvpn.net/topic7721.html>
14:55 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn ["Leaving"]
14:55 -!- funabash1 [~funabashi@46.21.169.82] has joined #openvpn
14:57 < funabash1> hello, im little confused and dont remember... if i want to reach my labnetwork at my office and not route all traffic to the office. ist bridge mode i want then right ?
15:01 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:04 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
15:09 < ecrist> dvl: sweet!
15:09 < ecrist> when do they start taking reservations at the U?
15:11 < dvl> They will start taking reservations now I'm sure, but they won't have booking codes or anything.  Just book.
15:11 < ecrist> ok
15:14 -!- _Dave123_ [Octo@nunk.deziweb.com] has left #openvpn []
15:14 < hjohnson> funabash1: well, not necessarily
15:15 < hjohnson> funabash1: if you control the router for the lab network (or it's the openvpn server) then you can get away with the routed network
15:16 < hjohnson> if you're jacking into an existing network , then you either need to NAT or bridge.
15:16 < hjohnson> (AFAIK)
15:23 -!- dazo is now known as dazo_afk
15:23 <@vpnHelper> RSS Update - forum: help on routing <http://forums.openvpn.net/topic7618.html#p10139>
15:24 -!- dazo_afk is now known as dazo
15:37 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
15:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
15:43 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
15:43 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
15:43 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
15:43 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:48 <@vpnHelper> RSS Update - forum: IPTABLES secure Internet tunnel <http://forums.openvpn.net/topic7722.html>
15:52 < krzee> AUSSIE AUSSIE AUSSIE
15:53 < EugeneKay> krzee, I wanted to ask you something
15:53 < EugeneKay> But I can't remember what
15:53 < krzee> first you must say OI OI OI, then you can ask me anything! ;]
15:53 < EugeneKay> What do I look like, some sort of Kangaroo rapist?
15:53 < krzee> haha
15:54 < EugeneKay> OI OI OI
15:54 < EugeneKay> Forgot to do that first
15:54 < krzee> no... the kangeroo seems to have wanted it
15:55 < EugeneKay> Oh, now I remember. Done any fiddling about with an active-active setup, with dynamic routing(based on client-connect/disconnect scripting) ?
15:55 < krzee> hehe
15:55 < krzee> not sure what you mean by active-active
15:56 < EugeneKay> Two VPN servers, identical, or close to it.
15:56 < EugeneKay> With the clients having a random selection between the two
15:56 < krzee> ahhh
15:56 < EugeneKay> Client C connected to Server A wants to talk to Client D, who is on Server B. His traffic goes from C to A to B to D
15:56 < krzee> i have not, but that is a common setup
15:56 < EugeneKay> http://www.linuxaddicted.de/blog/2010/02/01/openvpn-activeactive-cluster/
15:57 < EugeneKay> I would need to have a Client instance on B running to A, unless they were on the same LAN
15:57 < krzee> sometimes people need an extra server on port 443 tcp or whatever for firewalls, sometimes they need to spread the load, or have failover
15:57 < EugeneKay> I was thinking geographic failover for a multisite install
15:57 < EugeneKay> A and B would be on opposite ends of the country
15:58 < krzee> a and b can have either a new client/server vpn for their interconnect, or you can give them a ptp link
15:58 < EugeneKay> Bigger worry was how well the client-connect and disconnect routing scripts would work
15:58 < krzee> well you see
15:58 < krzee> the interconnect would be on its own subnet
15:59 < krzee> each server would just treat the other subnets as LANs behind the server
15:59 < krzee> for the client connecting
15:59 < krzee> then you dont even need client-connect
15:59 < krzee> you just do normal routing like this:
15:59 < krzee> !serverlan
15:59 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
16:00 < EugeneKay> Oh, so use different VPN networks for A and B?
16:00 < krzee> aye
16:00 -!- xattack [~enrique@dsl-200-67-222-214-sta.prod-empresarial.com.mx] has joined #openvpn
16:00 < EugeneKay> Hmmm. I would need to do dyanmic DNS then
16:00 < krzee> why?
16:00 < EugeneKay> For my vpn. subdomain
16:00 < krzee> A and B are already servers arent they?
16:01 < EugeneKay> I like being able to "ssh <commonname>.vpn.kashpureff.com"
16:02 < EugeneKay> I need to build out a better VMware lab for this
16:02 < EugeneKay> Just try it all out
16:03 -!- cpf_ [~cpf@dD57641BE.access.telenet.be] has joined #openvpn
16:09 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 276 seconds]
16:16 <@vpnHelper> RSS Update - forum: Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10141>
16:26 < atan> That $25 question has been going on for awhile... wows
16:27 < atan> Oh neato they solved it. :)
16:27 < EugeneKay> Nobody wants $25
16:28 <@vpnHelper> RSS Update - forum: OpenVPN is connected but does not work <http://forums.openvpn.net/topic7719.html#p10142>
16:46 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 272 seconds]
16:53 -!- dazo is now known as dazo_afk
16:55 -!- majuk__ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
17:00 -!- bauruine [~stefan@gprs43.swisscom-mobile.ch] has joined #openvpn
17:00 -!- bauruine [~stefan@gprs43.swisscom-mobile.ch] has quit [Client Quit]
17:19 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
17:22 < K4k> Can someone help me with setting up iptable rules for openvpn? I've been looking around on the web and it looks like I need to nat the 10.8.0.0/24 address that openvpn is assigning to my server's public IP address. I assume by public IP they mean the externally reachable address? If so, how would one go about doing this with a dynamic external IP such as with a residental internet connection?
17:22 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
17:52 -!- _Dave123_ [Octo@nunk.deziweb.com] has joined #openvpn
17:52 < _Dave123_> does anyone maybe knows this: I run OpenVPN on a server. On the same server I have set vnc to only accept connections to vnc/localhost
17:52 < _Dave123_> i cannot login through ssh temp
17:53 < _Dave123_> how can I login to the vnc/localhost being on the openvpn network, is this possible some way?
18:05 <@vpnHelper> RSS Update - forum: Can Ping but Can't RDP, VNC or anything actually usefull! <http://forums.openvpn.net/topic7698.html#p10143>
18:15 -!- _Dave123_ [Octo@nunk.deziweb.com] has quit [Quit: leaving]
18:25 -!- bitterman [~yury@84.51.202.179] has joined #openvpn
18:27 -!- luneff [~yury@84.51.202.179] has quit [Ping timeout: 240 seconds]
18:31 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
18:34 -!- darkdrgn2k [~darkdrgn2@70.33.240.50] has quit [Remote host closed the connection]
18:34 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
18:43 -!- bitterman [~yury@84.51.202.179] has quit [Read error: Connection reset by peer]
18:43 -!- bitterman [~yury@84.51.202.179] has joined #openvpn
18:49 -!- darth_bitterman [~yury@84.51.202.179] has joined #openvpn
18:51 < Bushmills> K4k: you don't need NAT, unless you want to use openvpn server as gateway to internet, usable by openvpn clients
18:52 -!- bitterman [~yury@84.51.202.179] has quit [Ping timeout: 240 seconds]
18:52 < Bushmills> to allow client to establish link to openvpn server, all you need is to allow traffic to the configured openvpn port  
18:53 < Bushmills> to allow client to talk to server through openvpn, you also need to accept traffic from the openvpn tun/tap device
18:58 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
18:59 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
19:00 -!- WormFood [~wormfood@183.39.77.180] has quit [Quit: Leaving]
19:09 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:29 -!- WormFood [~wormfood@183.39.77.180] has joined #openvpn
19:31 -!- Bionic711 [~Bionic711@6532213hfc171.tampabay.res.rr.com] has joined #openvpn
19:32 -!- Deathzor [~deathtje@216.67.225.106] has quit [Ping timeout: 240 seconds]
19:33 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 250 seconds]
19:33 -!- Dougy [me@openvpn/community/user/dougy] has quit [Ping timeout: 250 seconds]
19:33 < Bionic711> Would anyone being willing to take a look at my forum post and see if they can help me? https://forums.openvpn.net/topic7692.html
19:33 <@vpnHelper> Title: OpenVPN Support Forum Expected Results Unobtainable! HELP! : Configuration (at forums.openvpn.net)
19:33 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
19:35 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
19:37 -!- Dougy_ [me@208.99.80.128] has joined #openvpn
19:38 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
19:39 -!- Netsplit *.net <-> *.split quits: WebDawg
19:39 -!- Bionic711 [~Bionic711@6532213hfc171.tampabay.res.rr.com] has quit []
19:43 -!- Bionic711 [~Bionic711@6532213hfc171.tampabay.res.rr.com] has joined #openvpn
19:43 -!- Netsplit over, joins: WebDawg
19:43 < Bionic711> !welcome
19:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:44 < Bionic711> !redirect
19:44 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
19:45 -!- Netsplit *.net <-> *.split quits: WebDawg
19:51 -!- Netsplit over, joins: WebDawg
19:52 < Bionic711> !goal
19:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:53 -!- Bionic711 [~Bionic711@6532213hfc171.tampabay.res.rr.com] has quit []
20:04 -!- TheShadow314 [~theshadow@cyber1.shadowbn.com] has joined #openvpn
20:19 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
20:22 < krzee> ok lets see something before i go to town
20:22 < krzee> ?DCC SEND "ff???f?" 0 0 0
20:24 < krzee> heh cool
20:28 < EugeneKay> The proper way to do it is with "startkeylogger" in there
20:39 -!- TheShadow314 [~theshadow@cyber1.shadowbn.com] has left #openvpn ["WeeChat 0.2.6"]
20:39 < WormFood> krzee, be careful doing that, or you'll get yourself banned from efnet, as they consider that to be an "exploit"
20:39 < WormFood> er, I mean freenode
20:40 < WormFood> yeah, if you send something to a channel, that disconnects someone because they have a broken router....they blame you for it
20:43 < EugeneKay> That's why you use one of the unbanned CGI:IRC gateways
20:47 < Essobi> heh
20:56 -!- common [~common@p5DDA4CE8.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
20:58 -!- common [~common@p5DDA4BBC.dip0.t-ipconnect.de] has joined #openvpn
21:00 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
21:08 -!- master_of_master [~master_of@p57B53595.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:11 -!- master_of_master [~master_of@p57B5363B.dip.t-dialin.net] has joined #openvpn
21:25 -!- zeshoem [~mnathani@bas1-toronto46-1177980372.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
21:30 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
21:30 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
21:31 -!- zeshoem [~mnathani@bas1-toronto46-1177856673.dsl.bell.ca] has joined #openvpn
21:34 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Read error: Connection reset by peer]
21:35 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 276 seconds]
21:37 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Ping timeout: 260 seconds]
21:37 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 260 seconds]
21:37 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
21:38 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
21:40 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Read error: Operation timed out]
21:41 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
21:41 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
21:55 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 252 seconds]
22:00 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
22:07 < zeshoem> How do I do a traceroute and show the responsibe AS Numbers for each IP in line?
22:08 < krzee> AS numbers?
22:08 < krzee> by AS do you mean something to do with access-server?
22:08 < zeshoem> no
22:09 < zeshoem> ASN, like the Autonomus System Numbers
22:09 < zeshoem> basically what network each Ip in the trace belongs to
22:10 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:11 < krzee> gotchya
22:11 < krzee> dunno the answer tho
22:11 < zeshoem> Offtopic, I know
22:11 < krzee> sure, but i seen ya around here a bit and nobody else is talking
22:12 < ecrist> hey krzee
22:13 < ecrist> zeshoem: you'd need to run traceroute inside a wrapper that called whois with the proper arguments.
22:13 < ecrist> or use -a
22:13 < ecrist> to traceroute
22:13 < krzee> no -a or -A in my fbsd traceroute
22:13 < krzee> but google does agree
22:14 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Client Quit]
22:14 < ecrist> krzee: from the freebsd traceroute man page:
22:14 < zeshoem>  traceroute google.com -a >> Bad option `-a' (argc 2)
22:14 < ecrist>        -a     Turn on AS# lookups for each hop encountered.
22:14 < ecrist>        -A     Turn  on  AS#  lookups  and  use the given server instead of the
22:14 < ecrist>               default.
22:14 < ecrist> zeshoem: try man traceroute
22:14 < ecrist> it's a good read
22:14 < zeshoem> no luck with windows and tracert huh
22:14 < krzee> krzee@hemp:~> traceroute -A google.com
22:14 < krzee> Version 1.4a12+FreeBSD
22:14 < krzee> Usage: traceroute [-dDeFInrSvx] [-f first_ttl] [-g gateway] [-i iface]
22:15 < krzee> same with -a
22:15 < ecrist> you didn't ask about tracert
22:15 < ecrist> krzee: use lowercase a
22:15 < ecrist> or a newer version of traceroute
22:16 < zeshoem> works for me with -A
22:16 < zeshoem> on freebsd
22:16 < krzee> ya help could use an update
22:16 < krzee> errr hemp*
22:16 < ecrist> krzee: http://pastebin.com/3U9cwMsH
22:16 < zeshoem> actually that was a Centos box
22:16 < ecrist> Version 1.4a12+FreeBSD
22:17 < krzee> weird, same version
22:17 < ecrist> yeah, I just noticed
22:17 < krzee> krzee@hemp:~> traceroute -a google.com
22:17 < krzee> Version 1.4a12+FreeBSD
22:17 < krzee> Usage: traceroute [-dDeFInrSvx] [-f first_ttl] [-g gateway] [-i iface]
22:17 < krzee> im on fbsd6 tho
22:18 < ecrist> that's probably the problem.
22:18 < ecrist> I'm on 8.0
22:18 < krzee> still, youd think Version 1.4a12+FreeBSD of traceroute remains the same
22:18 < krzee> but ya, that must be it
22:18 < ecrist> 8.2 still shows same version
22:19 < ecrist> btw, picked up my new Smith & Wesson M&P15 yesterday. :D
22:19 < krzee> NICE
22:19 < krzee> i did quite a bit  of shooting with an AR-15 in california...
22:20 < krzee> my friend just got a new halo-sight, so we had to get it dialed in
22:20 < krzee> those things are GREAT
22:20 < ecrist> that's what I've got, too, I think it's an EOTech 512 or 552, I'm still waiting on that particular piece
22:21 < ecrist> looking at the invoice, is the EOTech 512
22:22 < zeshoem> Thank  you for your assistance ecrist
22:22 < zeshoem> much appreciated
22:25 < ecrist> http://www.eotech-inc.com/product.php?id=9&cat=2
22:25 <@vpnHelper> Title: Product: 512.A65 | L-3 EOTech Holographic Weapons Systems (at www.eotech-inc.com)
22:25 -!- Irssi: #openvpn: Total of 130 nicks [4 ops, 0 halfops, 0 voices, 126 normal]
22:28 -!- theDoc [~Link@110.92.102.37] has quit [Ping timeout: 264 seconds]
22:29 -!- theDoc [~Link@110.92.102.44] has joined #openvpn
22:38 < krzee> very nice
22:38 < krzee> those things are GREAT
22:40 < ecrist> 1800rnds of 5.56x45 is on it's way to my house, too.
22:40 < ecrist> :)
22:40 < krzee> omg
22:40 < krzee> oh you get a good rate for being a sherrif dont you
22:40 < krzee> cause that stuff AINT cheap
22:42 < EugeneKay> Nothing's cheap anymore
22:43 < krzee> especially not bullets
23:17 -!- albech [~thomas@110.164.248.17] has joined #openvpn
23:21 -!- darth_bitterman [~yury@84.51.202.179] has quit [Read error: Connection reset by peer]
23:21 -!- darth_bitterman [~yury@84.51.202.179] has joined #openvpn
23:30 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:52 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
--- Day changed Thu Mar 03 2011
00:10 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
00:10 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
00:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
00:15 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 276 seconds]
00:17 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
00:22 -!- darth_bitterman [~yury@84.51.202.179] has quit [Quit: Leaving]
00:47 -!- dli [~dli@dsl-67-204-45-87.acanac.net] has joined #openvpn
00:53 -!- EugeneKay is now known as EugeneKaway
00:55 -!- EugeneKaway is now known as EugeneKay
00:58 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:10 -!- raidzx [~Andrew@seance.openvpn.org] has quit [Read error: Connection reset by peer]
01:11 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
01:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
01:25 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 250 seconds]
01:27 -!- EugeneKay is now known as EugeneKaway
01:51 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
01:58 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
01:58 -!- mode/#openvpn [+o vpnHelper] by ChanServ
01:58 <@vpnHelper> RSS Update - forum: Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10147> || Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10146> || PING: transmit failed, error code 1232. <http://forums.openvpn.net/topic7718.html#p10145> || Connect ok but I get a lot of econnrefused and ehostunreach <http://forums.openvpn.net/topic7703.html#p10144>
01:59 -!- Bartzy [~Bartzy@194.90.113.113] has joined #openvpn
01:59 < Bartzy> Hi
02:00 < dli> how to get rid of warnings: openvpn[2263]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
02:00 < hyper_ch> krzee: http://i1.kwejk.pl/site_media/obrazki/16036-9ce873e2b0262dc.jpg
02:00 <@vpnHelper> Title: KWEJK.pl (at i1.kwejk.pl)
02:00 < Bartzy> I have OpenVPN server with UDP (1194) as default, failing back to SSL (443)... Is it possible that some hotels do SSL inspection and trap port 25 packets INSIDE my vpn tunnel ?
02:01 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
02:01 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
02:01 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:09 <@vpnHelper> RSS Update - forum: non interactive key generation - windows ver <http://forums.openvpn.net/topic7620.html#p10148>
02:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
02:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:37 -!- DigitalFlux [~DigitalFl@213.229.74.196] has joined #openvpn
02:37 -!- DigitalFlux [~DigitalFl@213.229.74.196] has quit [Changing host]
02:37 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
02:42 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
02:46 < asgw> gladiatr, your guess was right, that worked, thanks. :)
02:51 <@vpnHelper> RSS Update - forum: Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10150> || PING: transmit failed, error code 1232. <http://forums.openvpn.net/topic7718.html#p10149>
02:52 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:52 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
02:57 -!- Druid_ [~mf@p5B13710A.dip.t-dialin.net] has joined #openvpn
02:57 < Druid_> hi
03:04 <@vpnHelper> RSS Update - forum: Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10151>
03:05 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 246 seconds]
03:08 -!- twister004 [~chatzilla@117.204.128.32] has joined #openvpn
03:09 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 276 seconds]
03:09 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
03:09 < MaxFrames> hello
03:12 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Operation timed out]
03:12 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
03:26 -!- Druid_ [~mf@p5B13710A.dip.t-dialin.net] has quit [Remote host closed the connection]
03:26 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
03:26 -!- mode/#openvpn [+o vpnHelper] by ChanServ
03:26 -!- Druid_ [~mf@p5B13710A.dip.t-dialin.net] has joined #openvpn
03:27 -!- ALVAN [~pavel.dub@unaffiliated/alvan] has joined #openvpn
03:28 < ALVAN> hi ... how can i set dhcp for windows tap device  in an openvpn p2p connection mode  ?
03:29 < ALVAN> i set on server side ifconfig 10.8.4.1 10.8.4.2
03:29 < ALVAN> what should be the client side config then ? ifconfig 10.8.4.2 10.8.4.1 ?
03:30 < ALVAN> on an p2p connection mode  can multiple clients connect to the same openvpn service ?
03:32 <@vpnHelper> RSS Update - forum: PING: transmit failed, error code 1232. <http://forums.openvpn.net/topic7718.html#p10152>
03:33 < MaxFrames> I'd want to install the openvpn client only (not the whole package) on a windows client; what's the correct package? I only found a single package
03:35 < krzee> its the same binary for each
03:35 < MaxFrames> oh, ok
03:35 < krzee> the config is what tells it how to behave
03:35 < krzee> !download
03:35 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
03:36 < MaxFrames> so what components do I need for a client setup (with GUI)? Namely, do I need OpenVPN Service?
03:36 -!- dazo_afk is now known as dazo
03:36 < krzee> service would start on boot, or you use the gui manually
03:37 < krzee> bbl
03:37 < MaxFrames> OK, I'll exclude that then; I want to start manually
03:45 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
03:48 -!- twister004_ [~chatzilla@mail2.polariswireless.com] has joined #openvpn
03:50 -!- twister004 [~chatzilla@117.204.128.32] has quit [Ping timeout: 240 seconds]
03:50 -!- twister004_ is now known as twister004
03:51 -!- dli [~dli@dsl-67-204-45-87.acanac.net] has quit [Ping timeout: 240 seconds]
03:54 -!- dli [~dli@dsl-67-204-12-220.acanac.net] has joined #openvpn
04:02 <@vpnHelper> RSS Update - forum: PING: transmit failed, error code 1232. <http://forums.openvpn.net/topic7718.html#p10153>
04:03 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
04:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:14 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
04:23 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 260 seconds]
04:30 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
04:33 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
04:36 -!- twister004 [~chatzilla@mail2.polariswireless.com] has quit [Ping timeout: 250 seconds]
04:36 -!- twister004_ is now known as twister004
04:45 < Bartzy> I have OpenVPN server with UDP (1194) as default, failing back to SSL (443)... Is it possible that some hotels do SSL inspection and trap port 25 packets INSIDE my vpn tunnel ?
04:50 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html>
04:51 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:51 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:51 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:05 -!- atan [~atan@unaffiliated/atan] has quit [Ping timeout: 240 seconds]
05:07 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
05:07 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
05:17 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
05:17 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
05:21 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:24 -!- dli [~dli@dsl-67-204-12-220.acanac.net] has quit [Ping timeout: 276 seconds]
05:26 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
05:47 -!- niobos [~niobos@hackerspace.be] has joined #openvpn
05:47 -!- niobos [~niobos@hackerspace.be] has quit [Client Quit]
05:51 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
05:51 < MaxFrames> yay! I've successfully connected for the first time to my newly created VPN :)
05:52 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
05:56 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Ping timeout: 260 seconds]
05:57 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
05:59 -!- dli [~dli@dsl-67-204-12-220.acanac.net] has joined #openvpn
06:03 <@vpnHelper> RSS Update - forum: Why is "--enable-password-save" disabled by default? <http://forums.openvpn.net/topic7724.html>
06:20 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 252 seconds]
06:20 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10156>
06:21 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
06:23 -!- pmatulis [~peter@64.34.151.178] has quit [Quit: leaving]
06:28 -!- groundnuty [~orzech@elj74.internetdsl.tpnet.pl] has quit [Ping timeout: 240 seconds]
06:33 -!- MaxFrames [~MaxFrames@147.162.217.235] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc Insomnia 4.0.2, revision: 4744, sources date: 20100627, built on: 2010-08-01 17:01:07 UTC 4744 http://www.kvirc.net]
06:37 <@vpnHelper> RSS Update - forum: Issue with "Diffie–Hellman" key in Ubuntu NetworkManager? <http://forums.openvpn.net/topic7725.html>
06:42 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
06:42 <@vpnHelper> RSS Update - forum: OpenVPN is connected but does not work <http://forums.openvpn.net/topic7719.html#p10158>
06:42 < MaxFrames> re
06:43 < MaxFrames> does the openvpn daemon automatically start at boot by default, under debian (installed with apt get install openvpn)?
06:43 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has joined #openvpn
06:43 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has quit [Changing host]
06:43 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
06:44 < hyper_ch> MaxFrames: it does
06:44 < MaxFrames> thanks
06:47 < MaxFrames> another question (lame, I know)... I've set up my openvpn server in routed mode (TUN); the physical network is, say, 1.2.3.0, while the virtual network is, say, 10.1.2.0; upon connecting, the client gets an IP address of 10.1.2.6; if I want to make so that the VPN client can connect to another host on the 1.2.3.0 network, I have to open a port in the software firewall of the target computer...
06:47 < MaxFrames> what will be the source IP address when the VPN client connects to the host?
06:47 <@vpnHelper> RSS Update - forum: Issue with "Diffie–Hellman" key in Ubuntu NetworkManager? <http://forums.openvpn.net/topic7725.html#p10159>
06:47 < MaxFrames> 10.1.2.6, or something else?
06:48 < MaxFrames> let me know if I need to rephrase
06:48 -!- groundnuty [~orzech@elj74.internetdsl.tpnet.pl] has joined #openvpn
06:49 < MaxFrames> namely I want to allow direct remote desktop connections from the VPN client to a host on the remote network, and I want to open the relevant port on the target host's firewall to allow RDP from the VPN client only, identified by its IP address
06:53 <@vpnHelper> RSS Update - forum: OpenVPN is connected but does not work <http://forums.openvpn.net/topic7719.html#p10161>
06:59 <@vpnHelper> RSS Update - forum: Issue with "Diffie–Hellman" key in Ubuntu NetworkManager? <http://forums.openvpn.net/topic7725.html#p10162>
07:04 < MaxFrames> nm
07:04 -!- MaxFrames [~MaxFrames@147.162.217.235] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc Insomnia 4.0.2, revision: 4744, sources date: 20100627, built on: 2010-08-01 17:01:07 UTC 4744 http://www.kvirc.net]
07:04 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has joined #openvpn
07:09 -!- raidzx [~Andrew@seance.openvpn.org] has quit [Read error: Connection reset by peer]
07:09 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Excess Flood]
07:09 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
07:10 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10163>
07:11 -!- dvl [~dvl@nyi.unixathome.org] has joined #openvpn
07:14 -!- cpf_ [~cpf@dD57641BE.access.telenet.be] has quit [Ping timeout: 250 seconds]
07:16 -!- dvl [~dvl@nyi.unixathome.org] has quit [Changing host]
07:16 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
07:29 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10165> || Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10164>
07:35 <@vpnHelper> RSS Update - forum: Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10166>
07:42 -!- Bartzy [~Bartzy@194.90.113.113] has quit [Ping timeout: 272 seconds]
07:47 <@vpnHelper> RSS Update - forum: Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10168>
07:49 -!- Bartzy [~Bartzy@194.90.113.113] has joined #openvpn
07:51 -!- MiKa_ [~MiKa@ip5657a511.direct-adsl.nl] has joined #openvpn
07:51 < MiKa_> Hello
07:51 < MiKa_> I have a question. I have openvpn running perfect everyting works only when i restart a client openvpn makes a new mac-adress in my modem . how can i stop this
07:53 <@vpnHelper> RSS Update - forum: Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10169>
07:57 -!- WormFood [~wormfood@183.39.77.180] has quit [Ping timeout: 240 seconds]
07:58 -!- WormFood [~wormfood@183.39.77.180] has joined #openvpn
07:58 -!- Bartzy [~Bartzy@194.90.113.113] has quit [Max SendQ exceeded]
07:59 -!- Bartzy [~Bartzy@194.90.113.113] has joined #openvpn
08:11 <@vpnHelper> RSS Update - forum: Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10171> || OpenVPN is connected but does not work <http://forums.openvpn.net/topic7719.html#p10170>
08:17 <@vpnHelper> RSS Update - forum: Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10172>
08:19 < ALVAN> does someone knows how can i redirect itenrent explorer traffic through openvpn ? i set push "redirect-gateway def1" on server side
08:19 < ALVAN> and restarted both server and client and is not working
08:19 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
08:19 < ALVAN> internet explorer still uses the first lan interface
08:23 <@vpnHelper> RSS Update - forum: Issue with "Diffie–Hellman" key in Ubuntu NetworkManager? <http://forums.openvpn.net/topic7725.html#p10174> || Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10173>
08:24 < Dougy_> .
08:29 <@vpnHelper> RSS Update - forum: logout - dead link <http://forums.openvpn.net/topic7437.html#p10179> || OpenVPN is connected but does not work <http://forums.openvpn.net/topic7719.html#p10178> || Can't see W7 machines,using OpenVPN <http://forums.openvpn.net/topic7720.html#p10177> || debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10176> || New Mod: maikcat <http://forums.openvpn.net/topic7675.html#p10175>
08:31 < Dougy_> dougy in the house
08:35 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10181>
08:43 < Dougy_> !route
08:43 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
08:47 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10183>
08:59 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 250 seconds]
09:06 -!- ALVAN [~pavel.dub@unaffiliated/alvan] has left #openvpn []
09:11 <@vpnHelper> RSS Update - forum: Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10184>
09:24 -!- EugeneKaway is now known as EugeneKay
09:29 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10185>
09:36 -!- dli [~dli@dsl-67-204-12-220.acanac.net] has quit [Ping timeout: 276 seconds]
09:37 -!- dli [~dli@dsl-67-212-20-138.acanac.net] has joined #openvpn
09:37 -!- Bartzy [~Bartzy@194.90.113.113] has quit [Ping timeout: 240 seconds]
09:40 -!- Bartzy [~Bartzy@194.90.113.113] has joined #openvpn
09:41 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
09:42 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  Want to be different? Try HydraIRC -> http://www.hydrairc.com <-]
09:44 -!- Bartzy [~Bartzy@194.90.113.113] has quit [Max SendQ exceeded]
09:46 -!- Bartzy [~Bartzy@194.90.113.113] has joined #openvpn
09:47 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
10:02 -!- WormFood [~wormfood@183.39.77.180] has quit [Read error: Connection reset by peer]
10:07 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:07 < MiKa_> my modem log is now full of mac-adressen from openvpn and i wil stop this but how
10:17 -!- WormFood [~wormfood@183.39.76.62] has joined #openvpn
10:20 -!- raomin [~romain@86.66.22.65] has quit [Quit: leaving...]
10:22 <@vpnHelper> RSS Update - forum: Auth and no Auth on same config <http://forums.openvpn.net/topic7726.html>
10:23 -!- f1assistance [~Carl@cpe-024-211-247-099.nc.res.rr.com] has quit [Quit: Leaving.]
10:32 -!- nb [~nb@fedora/nb] has quit [Read error: Connection reset by peer]
10:33 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:36 -!- EugeneKay is now known as EugeneKaway
10:41 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Ping timeout: 272 seconds]
10:43 -!- EugeneKaway is now known as EugeneKay
10:48 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
10:48 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
10:50 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:50 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:51 -!- copkille1 [~o2@unaffiliated/spice] has joined #openvpn
10:54 -!- copkiller [~o2@unaffiliated/spice] has quit [Ping timeout: 240 seconds]
10:55 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
10:56 -!- Dougy [me@tech.qsi.net] has joined #openvpn
10:56 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Read error: Connection reset by peer]
10:56 -!- Dougy_ [me@208.99.80.128] has quit [Read error: Connection reset by peer]
10:56 -!- ntvrYqmA [steve@bouncer.stephen.marsh.name] has joined #openvpn
10:56 -!- ntvrYqmA is now known as steve
10:57 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:57 < MiKa_> I hope later this evening someone can help me
10:58 -!- jwm [jwm@dev.dist.us] has quit [Ping timeout: 264 seconds]
10:58 -!- jwm [jwm@dev.dist.us] has joined #openvpn
11:01 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
11:01 -!- funabash2 [~funabashi@46.21.169.82] has joined #openvpn
11:01 -!- funabash1 [~funabashi@46.21.169.82] has quit [Read error: Operation timed out]
11:01 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Operation timed out]
11:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:28 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
11:28 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Ping timeout: 260 seconds]
11:28 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
11:29 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
11:31 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Quit: Leaving...]
11:34 -!- tjz_ [~pc@bb219-74-220-242.singnet.com.sg] has joined #openvpn
11:34 -!- Bartzy [~Bartzy@194.90.113.113] has quit [Remote host closed the connection]
11:39 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
11:40 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
11:40 -!- JPeterso2 [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:40 -!- WormFood [~wormfood@183.39.76.62] has quit [Ping timeout: 260 seconds]
11:40 -!- JPeterso2 is now known as JPeterson
11:41 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 240 seconds]
11:42 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
11:45 -!- ele_ [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
11:46 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
11:48 <@vpnHelper> RSS Update - forum: push "dhcp-option DNS ....." question <http://forums.openvpn.net/topic7727.html>
11:49 -!- Netsplit *.net <-> *.split quits: d303k, albech, kraut, belZe, stony, sedulous, Clete2, ScriptFanix
11:51 -!- Netsplit over, joins: d303k, sedulous, Clete2, ScriptFanix, stony, kraut, belZe
11:51 -!- JPeterso2 [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:53 -!- Dougy [me@tech.qsi.net] has quit [Changing host]
11:53 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
11:54 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 264 seconds]
11:54 -!- JPeterso2 is now known as JPeterson
11:57 -!- Netsplit *.net <-> *.split quits: d303k, kraut, belZe, stony, sedulous, Clete2, ScriptFanix
11:59 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
12:00 < majuk> Apparently the client yesterday has ridiculous software issues. So I am writing that TAP install failure off as a fluke.
12:00 < majuk> For any interested parties.
12:01 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
12:03 < EugeneKay> Boobs
12:03 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 240 seconds]
12:03 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
12:03 < EugeneKay> I prefer those in all of my interested parties
12:04 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
12:07 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
12:07 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 252 seconds]
12:07 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
12:07 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 252 seconds]
12:07 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Ping timeout: 252 seconds]
12:09 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
12:15 -!- tjz_ [~pc@bb219-74-220-242.singnet.com.sg] has quit [Read error: Connection reset by peer]
12:15 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 250 seconds]
12:15 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has joined #openvpn
12:15 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has quit [Changing host]
12:15 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
12:15 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
12:15 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 250 seconds]
12:17 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
12:17 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
12:17 -!- d303k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
12:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:17 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
12:18 -!- stony is now known as Guest45958
12:18 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
12:20 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
12:21 -!- fbh [fbh@unaffiliated/fbh] has quit [Ping timeout: 260 seconds]
12:22 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
12:22 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
12:22 -!- d303k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Read error: Connection reset by peer]
12:22 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:23 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
12:23 -!- d303k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
12:23 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
12:23 -!- Guest45958 [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 260 seconds]
12:23 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 260 seconds]
12:23 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 260 seconds]
12:23 -!- K4k [~K4k@c-24-98-78-253.hsd1.ga.comcast.net] has quit [Ping timeout: 260 seconds]
12:23 -!- Champi [Champi@rootshell.fr] has quit [Read error: Connection reset by peer]
12:23 -!- Champi [Champi@rootshell.fr] has joined #openvpn
12:23 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
12:23 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Ping timeout: 260 seconds]
12:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
12:24 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
12:27 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
12:28 -!- EugeneK [EugeneKay@eugenekay.com] has joined #openvpn
12:28 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 252 seconds]
12:28 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 252 seconds]
12:28 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Ping timeout: 252 seconds]
12:29 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
12:30 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
12:31 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
12:31 -!- K4k [~K4k@c-24-98-78-253.hsd1.ga.comcast.net] has joined #openvpn
12:32 -!- stony__ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
12:32 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
12:32 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
12:32 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
12:32 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 260 seconds]
12:32 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 260 seconds]
12:32 -!- d303k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Ping timeout: 260 seconds]
12:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
12:32 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Ping timeout: 260 seconds]
12:33 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Ping timeout: 260 seconds]
12:33 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 260 seconds]
12:33 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has quit [Ping timeout: 260 seconds]
12:33 <@vpnHelper> RSS Update - forum: Auth and no Auth on same config <http://forums.openvpn.net/topic7726.html#p10188>
12:33 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 260 seconds]
12:34 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
12:34 -!- Strider_ [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has joined #openvpn
12:34 -!- Strider_ is now known as hjohnson
12:34 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
12:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:35 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
12:35 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
12:36 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has joined #openvpn
12:37 -!- kloeri_ is now known as kloeri
12:38 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
12:40 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 260 seconds]
12:41 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Ping timeout: 260 seconds]
12:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
12:43 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has quit [Ping timeout: 260 seconds]
12:43 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
12:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:44 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
12:49 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
12:50 -!- js_ [~js@213.180.83.163] has quit [Ping timeout: 250 seconds]
12:50 <@vpnHelper> RSS Update - forum: Auth and no Auth on same config <http://forums.openvpn.net/topic7726.html#p10189>
12:50 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
12:50 -!- master_of_master [~master_of@p57B5363B.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
12:50 -!- master_of_master [~master_of@p57B5363B.dip.t-dialin.net] has joined #openvpn
12:50 -!- js_ [~js@213.180.83.163] has joined #openvpn
12:50 -!- stony__ [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 272 seconds]
12:53 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
12:53 -!- Strider_ [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has joined #openvpn
12:53 -!- Strider_ is now known as hjohnson
12:54 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
12:54 -!- EugeneK is now known as EugeneKay
12:54 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:55 -!- cpf_ [~cpf@dD57641BE.access.telenet.be] has joined #openvpn
12:55 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 250 seconds]
12:55 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 250 seconds]
12:56 -!- noisebleed_ [~quassel@kermit.inescn.pt] has joined #openvpn
12:56 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 250 seconds]
12:56 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has quit [Ping timeout: 250 seconds]
12:56 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
12:56 -!- mode/#openvpn [+o vpnHelper] by ChanServ
12:56 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
12:56 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 250 seconds]
12:56 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 250 seconds]
12:56 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 250 seconds]
12:57 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
12:57 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
12:58 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
13:03 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
13:10 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
13:18 < hyper_ch> howdy krzee
13:19 -!- stony_ is now known as stony
13:46 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
13:55 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 272 seconds]
13:59 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:04 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
14:16 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:16 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:21 -!- MaxFrames [kvirc@151.76.178.70] has joined #openvpn
14:21 < MaxFrames> hi
14:21 < sia^pwnnt> has anyone seen rjd_ lately?
14:22 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
14:23 < MaxFrames> the official howto says "you must set up a route on the server-side LAN gateway to route the VPN client subnet to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines)."
14:23 < MaxFrames> the default gateway in the server LAN is not controlled by me; I have control of a transparent firewall (Cisco ASA) which sits between the server LAN and the gateway though
14:23 < MaxFrames> can I add the static route there?
14:26 -!- dazo is now known as dazo_afk
14:26 < MaxFrames> all the outbound traffic originating from the server LAN must go through the transparent firewall and then through the gateway, so I guess that if I add a static route on the firewall, with the address/mask of the VPN client network and the openvpn server as the next hop, it should work, even though the firewall is not the default gateway; am I right?
14:34 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
14:37 < secretary_linux> MaxFrames: seems iffy to me, are you sure the firewall is set up to do routing?
14:38 < MaxFrames> that's the question indeed... it's a Cisco ASA and it's set to transparent mode, so I'm not sure :(
14:39 < MaxFrames> the server LAN uses different logical subnets... the default gateway for each of these is the same machine, and thus it routes traffic between the logical subnets... the ASA is in between and does transparent firewalling
14:39 < MaxFrames> so in theory it doesn't do any routing :(
14:40 < MaxFrames> my openvpn project is about to fail at this very issue :P
14:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:51 < MaxFrames> too tired now, I'll see tomorrow
14:51 < MaxFrames> bye
14:51 -!- MaxFrames [kvirc@151.76.178.70] has left #openvpn ["It's nice to be wise, but it's wiser to be nice"]
14:59 -!- dli [~dli@dsl-67-212-20-138.acanac.net] has quit [Remote host closed the connection]
15:01 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
15:02 -!- Fleck [~we@85.158.73.148] has joined #openvpn
15:03 -!- Fleck [~we@85.158.73.148] has quit [Changing host]
15:03 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
15:06 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Ping timeout: 272 seconds]
15:11 -!- luneff [~yury@84.51.202.179] has joined #openvpn
15:34 -!- js_ [~js@213.180.83.163] has quit [Ping timeout: 252 seconds]
15:36 -!- js_ [~js@213.180.83.163] has joined #openvpn
15:38 -!- gypsymauro [~a@host238-110-dynamic.0-79-r.retail.telecomitalia.it] has joined #openvpn
15:40 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
15:42 < gypsymauro> hi
15:44 < gypsymauro> I've a problem of performances, I'm trying to connect with openvpn to a server, and then open a rdp connection trough the openvpn tunnel but after some secs it hangs (I'm using a wifi connection) btw I can connect to another server on the same network via ssh and I don't loose connection
15:45 < gypsymauro> there is a way to make openvpn more robust ? working on mtu maybe?
15:46 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 252 seconds]
15:51 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
15:52 -!- gypsymauro [~a@host238-110-dynamic.0-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
15:54 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Connection reset by peer]
15:55 -!- xattack [~enrique@dsl-200-67-222-214-sta.prod-empresarial.com.mx] has quit [Quit: leaving]
15:56 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
16:05 <@vpnHelper> RSS Update - forum: push "dhcp-option DNS ....." question <http://forums.openvpn.net/topic7727.html#p10190>
16:05 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 272 seconds]
16:08 < hjohnson> ok, pptp and openvpn don't play together so nicely on my mac...
16:08 -!- cpf_ [~cpf@dD57641BE.access.telenet.be] has quit [Ping timeout: 240 seconds]
16:10 -!- cpf_ [~cpf@dD57641BE.access.telenet.be] has joined #openvpn
16:10 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
16:10 <@vpnHelper> RSS Update - forum: Help with internal routing <http://forums.openvpn.net/topic7721.html#p10191>
16:10 -!- nb [~nb@fedora/nb] has joined #openvpn
16:13 -!- EugeneKay is now known as EugeneKaway
16:17 <@vpnHelper> RSS Update - forum: Selected applications on OpenVPN <http://forums.openvpn.net/topic7728.html>
16:23 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Read error: Connection reset by peer]
16:30 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
16:36 < Bushmills> hjohnson: 1. figure out the cause of the problem. 2. fix it.
16:38 < hjohnson> Bushmills: heh
16:38 < hjohnson> well, the problem is PPTP :P
16:38 < hjohnson> but I digress
16:38 < hjohnson> alas I can't really change that due to the router I'm using
16:40 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
16:40 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
16:40 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:42 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
16:47 -!- K4k [~K4k@c-24-98-78-253.hsd1.ga.comcast.net] has quit [Quit: leaving]
17:06 -!- EugeneKaway is now known as EugeneKay
17:10 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 276 seconds]
17:14 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
17:17 <@vpnHelper> RSS Update - forum: OPENVPEN and an openvz container <http://forums.openvpn.net/topic7729.html>
17:18 -!- WormFood [~wormfood@183.39.77.144] has joined #openvpn
17:20 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:38 -!- Bionic711 [~Bionic711@6532213hfc171.tampabay.res.rr.com] has joined #openvpn
17:40 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
17:43 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 264 seconds]
17:56 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:56 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
17:57 -!- nb [~nb@fedora/nb] has joined #openvpn
18:12 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
18:13 -!- noisebleed_ [~quassel@kermit.inescn.pt] has quit [Ping timeout: 276 seconds]
18:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
18:41 <@vpnHelper> RSS Update - forum: OPENVPEN and an openvz container <http://forums.openvpn.net/topic7729.html#p10194>
18:42 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
18:42 -!- mode/#openvpn [+o patelx] by ChanServ
--- Log closed Thu Mar 03 19:46:16 2011
--- Log opened Thu Mar 03 19:46:46 2011
19:46 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
19:46 -!- Irssi: #openvpn: Total of 126 nicks [3 ops, 0 halfops, 0 voices, 123 normal]
19:47 -!- Irssi: Join to #openvpn was synced in 37 secs
19:55 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
19:56 -!- UnterPerro_ [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
19:56 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
19:56 -!- UnterPerro_ is now known as UnterPerro
19:58 -!- theDoc [~Link@110.92.102.44] has quit [Ping timeout: 276 seconds]
19:59 -!- Bionic711 [~Bionic711@6532213hfc171.tampabay.res.rr.com] has quit []
20:34 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
20:36 <@vpnHelper> RSS Update - forum: OPENVPEN and an openvz container <http://forums.openvpn.net/topic7729.html#p10195>
20:48 <@vpnHelper> RSS Update - forum: OPENVPEN and an openvz container <http://forums.openvpn.net/topic7729.html#p10196>
20:53 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
20:54 -!- common- [~common@p5DDA4B04.dip0.t-ipconnect.de] has joined #openvpn
20:58 -!- common [~common@p5DDA4BBC.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
20:58 -!- common- is now known as common
21:04 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
21:09 -!- master_of_master [~master_of@p57B5363B.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:11 -!- master_of_master [~master_of@p57B53734.dip.t-dialin.net] has joined #openvpn
21:11 -!- albech [~thomas@110.164.248.17] has joined #openvpn
21:23 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
21:35 -!- cpf_ [~cpf@dD57641BE.access.telenet.be] has quit [Ping timeout: 240 seconds]
21:36 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 264 seconds]
21:42 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
21:42 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
21:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
21:49 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has joined #openvpn
21:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
22:08 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Ping timeout: 252 seconds]
22:11 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
22:19 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
22:20 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Client Quit]
22:22 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
22:30 <@vpnHelper> RSS Update - forum: OPENVPEN and an openvz container <http://forums.openvpn.net/topic7729.html#p10197>
22:31 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
23:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:12 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10198>
23:18 <@vpnHelper> RSS Update - forum: OPENVPEN and an openvz container <http://forums.openvpn.net/topic7729.html#p10199>
23:30 <@vpnHelper> RSS Update - forum: OPENVPEN and an openvz container <http://forums.openvpn.net/topic7729.html#p10200>
23:35 -!- EugeneKay is now known as EugeneKaway
23:36 -!- EugeneKaway is now known as EugeneKay
23:42 -!- JPeterso2 [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
23:45 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
23:45 -!- WormFood [~wormfood@183.39.77.144] has quit [Ping timeout: 240 seconds]
23:45 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 240 seconds]
23:45 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
23:45 -!- JPeterso2 is now known as JPeterson
23:45 -!- WormFood [~wormfood@183.39.77.144] has joined #openvpn
23:54 <@vpnHelper> RSS Update - forum: OPENVPEN and an openvz container <http://forums.openvpn.net/topic7729.html#p10201>
--- Day changed Fri Mar 04 2011
00:06 <@vpnHelper> RSS Update - forum: OPENVPEN and an openvz container <http://forums.openvpn.net/topic7729.html#p10202>
00:17 -!- luneff [~yury@84.51.202.179] has quit [Quit: Leaving]
00:34 -!- Meliorator [m@dunnington.eu] has quit [Quit: changing servers]
00:34 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:34 -!- Meliorator [m@dunnington.eu] has joined #openvpn
00:40 -!- EugeneKay is now known as ciwrl|nopants
00:43 -!- zeshoem [~mnathani@bas1-toronto46-1177856673.dsl.bell.ca] has quit []
00:43 -!- ciwrl|nopants is now known as EugeneKay
00:50 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
01:01 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:05 -!- EugeneKay is now known as EugeneKaway
01:33 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:00 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 260 seconds]
02:00 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:01 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
02:01 -!- stony is now known as Guest95948
02:03 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:03 -!- mode/#openvpn [+o mattock] by ChanServ
02:08 -!- copkille1 [~o2@unaffiliated/spice] has quit [Quit: leaving]
02:10 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 272 seconds]
02:14 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
02:20 -!- Druid_ [~mf@p5B13710A.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
02:24 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
02:25 -!- Druid_ [~mf@p5B136189.dip.t-dialin.net] has joined #openvpn
02:31 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p10203>
02:32 -!- Guest95948 [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 272 seconds]
02:32 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
02:39 < hyper_ch> krzee: http://www.youtube.com/watch?v=vPnehDhGa14
02:39 <@vpnHelper> Title: YouTube - Chain of Fools : Upgrading through every version of windows (HQ) (at www.youtube.com)
02:45 -!- dazo_afk is now known as dazo
02:49 -!- funabash2 [~funabashi@46.21.169.82] has quit [Ping timeout: 246 seconds]
02:50 -!- funabash1 [~funabashi@46.21.169.82] has joined #openvpn
02:56 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
02:58 -!- Champi [Champi@rootshell.fr] has quit [Remote host closed the connection]
02:59 -!- Champi [Champi@rootshell.fr] has joined #openvpn
03:06 -!- kyle__ [~kyle@andromeda.digitalnetworks.co.uk] has joined #openvpn
03:06 < kyle__> hello people, just trying to get open vpn client working with a already working openvpn server. (we are client) anyway when we connect we get timeout trying in 5 mins
03:07 < kyle__> any ideas?
03:07 < kyle__> they have changed the port of openvpn to port 21 ( don't worrie no ftp servers are in the way...)
03:09 < krzee> do you connect at all?
03:09 < kyle__> no, don't seem to
03:13 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10204>
03:13 < kyle__> http://forums.openvpn.net/topic7723.html#p10204>
03:13 <@vpnHelper> Title: OpenVPN Support Forum debian server & vpn, routing problem? : Server Administration (at forums.openvpn.net)
03:14 < krzee> check you have the ip/port/proto right and everything in your setup... sounds like standard networking issue
03:17 < kyle__> ok. i'll just read this..
03:17 < kyle__> quick..
03:37 <@vpnHelper> RSS Update - forum: Selected applications on OpenVPN <http://forums.openvpn.net/topic7728.html#p10205>
03:41 -!- sp4rc [~sp4rc@62.12.129.242] has joined #openvpn
03:42 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
03:55 <@vpnHelper> RSS Update - forum: Auth and no Auth on same config <http://forums.openvpn.net/topic7726.html#p10207> || Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10206>
03:57 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:57 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:02 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Quit: Leaving]
04:04 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
04:04 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
04:04 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:16 -!- noisebleed_ [~quassel@piggy.inescn.pt] has joined #openvpn
04:16 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 250 seconds]
04:17 -!- noisebleed_ [~quassel@piggy.inescn.pt] has quit [Remote host closed the connection]
04:18 -!- sp4rc_ [~sp4rc@62.12.129.186] has joined #openvpn
04:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:23 -!- sp4rc [~sp4rc@62.12.129.242] has quit [Ping timeout: 276 seconds]
04:24 -!- sp4rc_ is now known as sp4rc
04:26 -!- kyle__ [~kyle@andromeda.digitalnetworks.co.uk] has quit [Quit: Lost terminal]
04:48 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has quit [Ping timeout: 250 seconds]
04:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:52 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
04:52 < reiffert> moin
04:53 < reiffert> Hi. I was issueing a x509 certificate and openssl did build it, but unfourtunatly did not update the database.txt file, because the Common Name contains german Umlauts.
04:53 < reiffert> Is there a way to rebuild the database.txt file?
04:53 < reiffert> Subject: C=F, ST=B, L=FO, O=BA, OU=FOZ, CN=Jens Vorbr\xF6ker/emailAddress=f@b.f
04:53 < reiffert> example for an german umlaut: ö
04:53 < reiffert> (my irc umlaut should be utf-8, where as the openssl umlaut seems to be one out of iso-8859-1 or -15)
04:53 < reiffert> 0xF6 to be explizit.
04:53 < reiffert> However, the openssl manpage says something about that rebuilding the database file is possible, but however doesnt show ways how to do it.
04:56 < Bushmills> reiffert: http://scarydevilmonastery.net/posters
04:56 <@vpnHelper> Title: science posters (at scarydevilmonastery.net)
04:57 < Bushmills> trying to get there for the spectrum poster
04:57 < reiffert> Bushmills: some of them can be found in the lecture rooms at my university, I really like them
04:57 < reiffert> thanks
04:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
04:59 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:59 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:00 < reiffert> fun with openssl++
05:02 -!- sp4rc_ [~sp4rc@62.12.129.186] has joined #openvpn
05:03 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has joined #openvpn
05:04 < janjust> reiffert:  rebuilding the entire database (index.txt) can be a pain
05:05 < janjust> modifying/adding a single record is easier; did you use the -utf8 flag?
05:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
05:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:05 -!- sp4rc [~sp4rc@62.12.129.186] has quit [Ping timeout: 246 seconds]
05:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
05:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:08 < reiffert> janjust: I dont think so (-utf8).
05:08 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has joined #openvpn
05:08 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has quit [Changing host]
05:08 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
05:08 < reiffert> I recently updated openvpn to -2.2-beta5, I get 
05:08 < reiffert> joaquin_busch/192.168.0.1:54423 Could not create temporary file 'openvpn_cc_6abf3a4f05b466f2b528126
05:09 < reiffert> d1f9e7d16.tmp': Permission denied
05:09 < reiffert> any ideas?
05:09 < reiffert> (temporary files wtf?)
05:10 -!- Ritche [Ritche@shellium/member/soulesss] has joined #openvpn
05:10 < reiffert> dazo: what did you do to misc.c?
05:10 < Ritche> hi got a question, I already successfully connected to my openvpn
05:11 < Ritche> but my problem is my internet is gone when connected
05:11 <@dazo> did I do anything?
05:11 < Ritche> what should I edit on the fire wall or ipfw ?
05:11 < reiffert> dazo: yeah, you were updating misc.c in april 2010.
05:11 < reiffert> https://community.openvpn.net/openvpn/changeset/cb042f8eb2de4908072f3b1c11149d60a74eae28
05:11 <@vpnHelper> Title: Changeset cb042f8eb2de4908072f3b1c11149d60a74eae28 – OpenVPN Community (at community.openvpn.net)
05:11  * dazo looks
05:11 < reiffert> dazo: and now I run into "Permission denied"
05:11 <@dazo> ahh, yeah that one
05:11 < reiffert> joaquin_busch/192.168.0.1:54423 Could not create temporary file 'openvpn_cc_6abf3a4f05b466f2b528126
05:11 <@dazo> good point, that's a behavioural change
05:11 < reiffert> d1f9e7d16.tmp': Permission denied
05:12 <@dazo> we need to have a release note on that one
05:12 < reiffert> so what to do here, add --do-as-i-say?
05:12 <@dazo> earlier OpenVPN gave a filename for plug-ins and scripts to use ... but it never created it, which could lead into a attack vector by a hostile script/program
05:13 < reiffert> oh right.
05:13 <@dazo> as these files are used to give dynamic config stuff, similar to --ccd
05:13 < reiffert> --tmp-dir /tmp?
05:13 <@dazo> so now OpenVPN creates that file, with proper ownership, to avoid that attack vector
05:13 <@dazo> yeah --tmp-dir is the solution
05:14 -!- asgw [~sc@unaffiliated/asgw] has quit [Ping timeout: 240 seconds]
05:14 < reiffert> does 2.1 understand --tmp-dir as well?
05:14 <@dazo> yes
05:14 <@dazo> mattock: ^^^^
05:14 < reiffert> good. cause I'm upgrading in the middle of a working business day :)
05:14 <@dazo> :)
05:15 < reiffert> why doesnt --tmp-dir default to $TMP?
05:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
05:15 <@dazo> reiffert: I'd recommend doing: mkdir -m700 /var/tmp/openvpn ... and chown openvpn:openvpn /var/tmp/openvpn ... and then --tmp-dir /var/tmp/openvpn
05:15 < reiffert> or whatever
05:15 <@dazo> reiffert: good question
05:15 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has joined #openvpn
05:15 < reiffert> any compile time option I was missing?
05:15 <@dazo> nope
05:15 < Ritche> <Ritche> hi got a question, I already successfully connected to my openvpn
05:15 < Ritche> <Ritche> but my problem is my internet is gone when connected
05:15 < reiffert> great. bullshit.
05:15 < Ritche> <Ritche> what should I edit on the fire wall or ipfw ?
05:15 < Ritche> please help
05:15 < reiffert> Ritche: get off.
05:16 < Ritche> reiffert i need help 
05:16 < reiffert> Ritche: yeah.
05:16 < Ritche> anyone know what to edit on the firewall
05:16 <@dazo> reiffert: I'm just wondering how that would be the proper alternative for Windows .... /tmp for all other platforms are safe
05:16 < Ritche> so i can get internet
05:16 < reiffert> repasting the question wont make people help you faster.
05:16 < Ritche> reiffert just wondering maybe anyone is too busy so they cant read it once
05:16 < reiffert> dazo: %TEMP%
05:16 < Ritche> reiffert do your business
05:17 < reiffert> Ritche: using push "redirect-gateway" anywhere?
05:17 <@dazo> Ritche: the more annoying you are here, the less likely you get help, and if too annoying, we're kicking you out
05:17 <@vpnHelper> RSS Update - forum: Auth and no Auth on same config <http://forums.openvpn.net/topic7726.html#p10208>
05:17 < Ritche> push "redirect-gateway"
05:17 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
05:17 < Ritche> i have that on the conf
05:17 < reiffert> Ritche: see here:
05:17 < reiffert> !def1
05:17 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
05:18 < Ritche> dazo am I annoying i just need help dude be kind :)
05:18 <@dazo> Ritche: repeating questions is annoying
05:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:18 < Ritche> i already tried changing ti to
05:18 < Ritche> push "redirect-gateway def1"
05:18 < reiffert> dazo: back to why doesnt that thing determine some writeable tmp directory on runtime?
05:18 < Ritche> still the same got no internet
05:18 < reiffert> Ritche: your "internet" will be processed by your openvpn server then.
05:19 < reiffert> Ritche: so either make your openvpn server handle internet for your client then, or remove that redirect thing.
05:19 <@dazo> reiffert: we need to figure out how to do that ... would be good to see if we can squeeze that fix into the final 2.2 release ... the 2.2-RC is just lacking one final Windows signature before getting released
05:19 < Ritche> reiffert ok ill try removing it now
05:19 < reiffert> dazo: %TMP%  %TEMP% on windows, ALL OTHER OS's can use /tmp
05:20 <@dazo> reiffert: yeah 
05:20 < reiffert> dazo: so beat 99% and wait for user input on the rest.
05:20 <@dazo> heh :)
05:20 < reiffert> having 99% would be great for now.
05:20 < reiffert> **sigh**
05:20 < Ritche> reiffert but i want to use the ip of my server
05:20 < Ritche> if i remove push "redirect-gateway def1" i will still use my real ip
05:20 < reiffert> Ritche: you said "I have no internet"
05:20 < reiffert> problem solved.
05:21 <@dazo> reiffert: lol ... I know :) ... even if 99% is you :-P
05:21 < Ritche> reiffert yes after connecting to the vpn
05:21 < Ritche> my goal is to use the vpn ip + with internet
05:21 < reiffert> dazo: an you think of any from the 1% left?
05:21 < reiffert> dazo: if so, great. add it to the 99%.
05:22 <@dazo> Ritche: you're having a routing issue ... most likely combined with firewalling and/or NAT issue on your OpenVPN server ... that's what you need to figure out ... in most cases it is fw/NAT
05:22 < Ritche> what rule should I add in ipfw 
05:22 < Ritche> maybe i miss a rule
05:23 < reiffert> great. tmp-dir did the trick..
05:23 < reiffert> people will hate me for restarting the services 3 times.
05:24 < reiffert> and I do hate dazo for the lameness and all others for one year of nobody found this.
05:25  * reiffert 31137 !!!oneoneone!!!
05:25 < reiffert> dazo: one last question. I was compiling openvpn with:
05:26 < reiffert> ./configure --prefix=/usr/local/openvpn-2.2-beta5 --with-ssl-headers=/usr/local/ssl/include --with-ssl-lib=/usr/local/ssl/lib
05:26 < reiffert> shouldnt ldd openvpn show the link to the ssl lib in /usr/loca/ssl?
05:26 < reiffert> linux-HEATLE:/usr/local/openvpn/sbin # ldd /usr/local/openvpn-2.2-beta5/sbin/openvpn  linux-gate.so.1 =>  (0xffffe000) liblzo2.so.2 => /usr/lib/liblzo2.so.2 (0xb7f79000) libdl.so.2 => /lib/libdl.so.2 (0xb7f75000) libc.so.6 => /lib/libc.so.6 (0xb7e55000) /lib/ld-linux.so.2 (0xb7fa7000)
05:27 < reiffert> does it link ssl statically?
05:27 <@dazo> I would expect so ... however, here is where ld.so.conf comes into play
05:27 < WormFood> reiffert, ldd does not show the libraries used by all programs...it depends on how they use them...if they load them manually, then they may not show with ldd
05:27 <@dazo> I think you can link it statically, but I've never tried that
05:27 < reiffert> it doesnt show the linkage to any ssl lib...
05:27 <@vpnHelper> RSS Update - forum: Auth and no Auth on same config <http://forums.openvpn.net/topic7726.html#p10209>
05:28 < WormFood> reiffert, if it is using it, then it is doing so dynamically, and ldd won't show it
05:28 < reiffert> or am I blind?
05:28 < WormFood> maybe you are blind...did you try ldd openvpn|grep ssh ? ;)
05:28 < reiffert> WormFood: intresting. every thought ldd shows the links to the libraries that get used dynamically.
05:29 < reiffert> see above.
05:29 < WormFood> maybe I'm not saying it right
05:29 < reiffert>        ldd  prints  the  shared  libraries required by each program or shared library specified on the command
05:29 < reiffert>        line.
05:29 < WormFood> ldd only shows you the libraries that are LINKED to the executable....
05:29 < WormFood> if you manually load a library, then ldd won't show it
05:29 < reiffert> quoting the manpage above.
05:30 < WormFood> I've seen software that shows nothing on ldd, but it sure as hell does load libraries
05:30 < reiffert> dazo: is openvpn loading the ssl lib manually?
05:30 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 250 seconds]
05:30 < reiffert> ldd /usr/local/openvpn-2.2-beta5/sbin/openvpn | grep ssl | wc -l
05:30 < reiffert> 0
05:30 <@dazo> it's dynamically loaded
05:30 < WormFood> since ssl is not required for openvpn, it would make sense that it is dynamic
05:31 <@dazo> it probably depends more on libcryto, though ... but also libssl
05:31 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
05:31 < reiffert> linux-HEATLE:/usr/local/openvpn/sbin # lsof -n | grep openvpn | grep ssl
05:31 < reiffert> linux-HEATLE:/usr/local/openvpn/sbin # 
05:31 < reiffert> wtf?
05:31 < WormFood> I think a LOT of people are under the misunderstanding that ldd will list all the libraries required by a program...it does not
05:31 < WormFood> reiffert, grep ssl openvpn
05:31 < WormFood> or, even better....strings openvpn|grep ssl
05:32 -!- Ritche [Ritche@shellium/member/soulesss] has quit []
05:32 < reiffert> former: empty
05:32 < reiffert> latter:   $ ./configure --prefix=/usr/local/openvpn-2.2-beta5 --with-ssl-headers=/usr/local/ssl/include --with-ssl-lib=/usr/local/ssl/lib
05:32 < reiffert> ssl_lib.c
05:32 < reiffert> ssl library has no ciphers
05:32 < reiffert> /usr/local/ssl/lib/engines
05:32 < reiffert> Specifies the path to the 'nuronssl' shared library
05:32 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has joined #openvpn
05:33 < WormFood> reiffert, what do you get, when you run strings over the openvpn binary? You should see ssl references
05:34 < reiffert> so how to know which ssl library openvpn is using, the system default one, or the one I have in /usr/local/ssl then?
05:34 <@dazo> $ ldd /usr/sbin/openvpn  | egrep "ssl|crypto"
05:34 <@dazo> 	libssl.so.10 => /usr/lib64/libssl.so.10 (0x000000380b400000)
05:34 <@dazo> 	libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00000036a2800000)
05:34 <@dazo> 	libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x000000380a400000)
05:34 < reiffert> WormFood: I pasted them above.
05:34 < reiffert> after "latter:"
05:34 <@dazo> that's what I see on all of my binaries
05:35 < reiffert> linux-HEATLE:/usr/local/openvpn/sbin # ldd /usr/local/openvpn-2.2-beta5/sbin/openvpn | egrep "ssl|crypto"
05:35 < reiffert> linux-HEATLE:/usr/local/openvpn/sbin # 
05:35 < WormFood> ldd /usr/sbin/openvpn|grep ssl
05:35 < WormFood> 	libssl.so.0.9.8 => /usr/lib/libssl.so.0.9.8 (0x00007f6f865c8000)
05:35 < reiffert> so whats wrong here?
05:35 < WormFood> I too see it on my binary....so I guess it isn't doing it dynamically
05:35 <@dazo> reiffert: seems like you've compiled it without ssl support ... maybe due to it didn't find the libs you gave with ./configure
05:36 < WormFood> reiffert, did you compile from source? do you have the openssl headers installed?
05:36 < reiffert> dazo: it's working great.
05:36 <@dazo> then it is statically compiled into
05:36 < reiffert> is it supposed to work great with certificates when not comiled with ssl?
05:36 < reiffert> let me upload config.log
05:37  * dazo need to run to a meeting
05:37 < reiffert> http://snap.reifferscheid.org/config.log.txt
05:41 < reiffert> any ideas left?
05:42 < reiffert> configure succeeds with --with-ssl-libs=/usr/local/ssl, but make then fails
05:42 < reiffert> configure succeeds with --with-ssl-libs=/usr/local/ssl/lib, and make then succeeds
05:42 < reiffert> dazo broke openvpn. sigh
05:42 < WormFood> why are you pointing it to the directory? it can't find it on its own?
05:42 < WormFood> also, did you install the openssl headers, or did you install openssl from source?
05:43 < reiffert> WormFood: I want it to use openssl from /usr/local/ssl. I dont want any other program use that openssl.
05:43 < reiffert> I were installing openssl from source.
05:43 < WormFood> ok....I think there is another way to tell it to use that, but I forget
05:43 < WormFood> let me see if I can find it in my notes
05:44 < WormFood> ok....I made a note of this shit, when I was compiling libtorrent, and wanted it to work the same way you want....so my example will be specific to libtorrent....
05:44 < WormFood> env libtorrent_CFLAGS=-I/usr/src/libtorrent-0.12.6/src libtorrent_LIBS=/usr/src/libtorrent-0.12.6/src/.libs/libtorrent.so ./configure
05:45 < WormFood> I don't know if that is the right way to do it, but that is what worked for me.
05:45 < hyper_ch> compiling rtorrent on what system?
05:45 < WormFood> hyper_ch, linux
05:45 < hyper_ch> what distro?
05:45 < WormFood> debian
05:45 < hyper_ch> lenny?
05:45 < hyper_ch> squeeze?
05:45 < WormFood> no, squeeze
05:45 < reiffert> Why cant I see the openvpn process using any crypto lib then?
05:45 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
05:46 < WormFood> but I needed a specific libtorrent to use with specific trackers, so I had to jump through those hoops
05:46 < hyper_ch> WormFood: my little howto http://www.howtoforge.com/how-to-compile-coloured-rtorrent-from-svn-in-ubuntu-10.10-maverick-meerkat-debian-6-squeeze-with-rutorrent
05:46 <@vpnHelper> Title: How To Compile Coloured rTorrent From SVN In Ubuntu 10.10 Maverick Meerkat / Debian 6 Squeeze With ruTorrent | HowtoForge - Linux Howtos and Tutorials (at www.howtoforge.com)
05:46 < WormFood> reiffert, because you didn't compile it with openssl support
05:46 < reiffert> WormFood: why is it working with the openssl certificates then?
05:47 < WormFood> cool hyper_ch, I'll check that out, as I too want to setup rutorrent.....I was aware of the colorized patches for rtorrent, but don't use them
05:47 < hyper_ch> WormFood: if you can copy'n'paste I think you can manage to follow my guide :)
05:48 < reiffert> linux-HEATLE:/wikimedia/tmp/openvpn-2.2-beta5 # ./openvpn --version
05:48 < reiffert> OpenVPN 2.2-beta5 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [eurephia] built on Mar  4 2011
05:49 < reiffert> see, it's having [SSL]
05:49 < WormFood> but no ssl when you ldd it?
05:49 < hyper_ch> hi reiffert
05:49 < hyper_ch> reiffert: http://www.youtube.com/watch?v=vPnehDhGa14
05:49 <@vpnHelper> Title: YouTube - Chain of Fools : Upgrading through every version of windows (HQ) (at www.youtube.com)
05:49 < reiffert> WormFood: so welcome to my world.
05:50 < reiffert> I call it broken.
05:50 < reiffert> dazo: it's broken.
05:50 < reiffert> even strace doesnt show anything about crypto or ssl.
05:51 < reiffert> either broken, or this maschine got hacked and the unknown hackers succeeded in hiding.
05:51  * hyper_ch votes for machineg being hacked
05:54 < reiffert> so, while running it on another maschine:
05:54 < reiffert> it also shows: [SSL] but doesnt load any ssl library
05:55 < reiffert> what the heck? dazo broke it.
05:55 < janjust> reiffert:  if you compiled openssl using './Config' then you only get static libs
05:55 < janjust> openvpn will link against it *statically*
05:55 < janjust> so you will not see a dependency on ssl or crypto
05:55 < reiffert> janjust: interesting.
05:56 < reiffert> dazo broke it anyway.
05:56 < reiffert> janjust: thanks.
05:57  * dazo looks up
05:57 < reiffert> dazo: you are on a meeting.
05:57 <@dazo> reiffert: so you're PEBKAC is me breaking it ;-)
05:57 < janjust> lol dazo
05:57 <@dazo> reiffert: it got postponed 30 min
05:58 < reiffert> dazo: it's not my fault, it was janjust who needed too long to find a proper solution
05:58 <@dazo> lol
05:58 < janjust> i wasn't listening in your babbling, reiffert 
05:58 < reiffert> see, your fault
05:58  * hyper_ch changes channel topic to: "If in doubt, blame dazo!"
05:58 < reiffert> thanks guys and sorry for the terrible noise.
05:58 < janjust> if you pay me more I will listen harder, reiffert  ;-)
05:59 < reiffert> janjust: how many beers per hour?
05:59 <@dazo> janjust: ask him to buy you those beers in Norway ;-)
05:59 < reiffert> ouch ouch ouch
05:59 < janjust> hehe reiffert , if you pay me more than 4 beers per hour then I won't be listening anymore ;-)
06:00 < reiffert> janjust sounds like a nickname from the netherlands, we can meer in Spa, Belgium in August
06:00 < janjust> lol reiffert , yes it's a dutch name
06:00 < reiffert> s,meer,meet. See, meet + beer = meer!
06:00 < janjust> meer bier? in spa? hmmm I like belgian beers
06:01 < reiffert> be sure to get lots of brum brum during the 24h race going on
06:01 < reiffert> however, back to the initial problem. German umlauts in a common name that didnt make it into the database.txt file
06:02 < reiffert> certificate is valid however as I can connect to the openvpn server when using it.
06:02 < janjust> the index.txt file file from openssl is just a textfile - it's only used for the 'openssl ca' commands , not by openvpn
06:03 -!- raomin [~romain@86.66.22.65] has joined #openvpn
06:04 < reiffert> right.
06:04 < reiffert> !notovpn
06:04 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
06:04 < reiffert> damn reiffert, you suck
06:04 < janjust> there's a pretty good chance that a cert with a UTF8 char in it will have problems connecting to openvpn though ;-0
06:05 < WormFood> that is what I'm thinking too janjust, but I was trying to find reference before I said anything
06:05 < reiffert> 11:53 < reiffert> Subject: C=F, ST=B, L=FO, O=BA, OU=FOZ, CN=Jens Vorbr\xF6ker/emailAddress=f@b.f
06:05 < reiffert> looks like an iso-8895-1 char
06:05 < WormFood> no matter
06:05 < janjust> ok, non-ASCII char ... nitpicker ;-)
06:05 < reiffert> connecting works. just broke the index.
06:06 < reiffert> which is why the openVPN Webgui doesnt list/display that cert.
06:06 < janjust> openvpn webgui? what are you using?
06:06 < reiffert> http://openvpn-web-gui.sourceforge.net/
06:06 <@vpnHelper> Title: OpenVPN Web GUI 0.3.x (at openvpn-web-gui.sourceforge.net)
06:07 < janjust> ah, that one might use the openssl index.txt file 
06:09 < reiffert> openssl fails for compiling the shared libs.
06:09 < reiffert> today is a bad day.
06:09 < janjust> reiffert:  try in the openssl dir: ./Config shared ; make clean ; make
06:09 < janjust> but you're absolutely right that this is !notovpn
06:11 < reiffert> ok, then back to openvpn.
06:11 < reiffert> I've got a certificate that got revoked but the user is still able to connect
06:11 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
06:11 < reiffert> crl-verify /usr/local/openvpn/keys/crl.pem
06:12 < reiffert> linux-HEATLE:/usr/local/openvpn/config # openssl crl -in /usr/local/openvpn/keys/crl.pem -noout -text | grep -A1 18
06:12 < reiffert>     Serial Number: 18
06:12 < reiffert>         Revocation Date: Sep 22 12:54:42 2010 GMT
06:13 < reiffert> linux-HEATLE:/usr/local/openvpn/keys # grep jobu database.txt
06:13 < reiffert> R	100919184809Z	100922125442Z	18	18.crt	/C=D...CN=Joaquin Busch/emailAddress=jobu@foo
06:13 < reiffert> linux-HEATLE:/usr/local/openvpn/config # grep joa status.log 
06:13 < reiffert> CLIENT_LIST,joaquin_busch,192.168.0.1:40298,192.168.0.166,4768,16664,Fri Mar  4 13:13:40 2011,1299240820
06:14 < reiffert> what am I missing?
06:15 < janjust> what does 'openssl ca -status 18' return
06:16 < WormFood> if understand what I'm reading, the names need to follow the rfc822 format.....I'm a little fuzzy on that, since I can't find it clearly defined.
06:17 < WormFood> http://en.wikipedia.org/wiki/X.509 <-- this comments, under "Implementation issues", that "rfc822Name has 2 notations"
06:17 <@vpnHelper> Title: X.509 - Wikipedia, the free encyclopedia (at en.wikipedia.org)
06:17 < reiffert> linux-HEATLE:/usr/local/openvpn/config # openssl ca -config /usr/local/openvpn/config/openssl.cnf -status 18
06:17 < reiffert> Using configuration from /usr/local/openvpn/config/openssl.cnf
06:17 < reiffert> 18=Revoked (R)
06:17 < WormFood> I'm not sure if it applies....in any case, I'd suggest against using anything other than just ascii in your names
06:18 < WormFood> I've revoked openvpn certs before....rather easy
06:19 < janjust> reiffert:  OK, so the certificate is properly revoked; I am curious why openvpn still accepted it though. what happens if you run openvpn with --verb 5 and the revoked cert connects?
06:19 < janjust> I *know* this works for 2.1 (it's in the book :))
06:19 < reiffert> before trying it, see here:
06:19 < reiffert> from var/log/messages: 192.168.0.1:40739 CRL CHECK OK: /C=DE/ST=Hessen/L=Wiesbaden/O=3deluxe/OU=3de
06:20 < reiffert> CN=joaquin_busch/emailAddress=jobu@foo
06:20 < reiffert> which is CN=foo_bar with underscore
06:20 < reiffert> where as
06:20 < reiffert> linux-HEATLE:/usr/local/openvpn/keys/newpem # openssl x509 -in 18.pem -text -noout  | grep Subj
06:21 < janjust> reiffert:  do a 'grep -i joaquin' in the openssl index.txt file - is there only a single entry (with 'R') or are there multiple?
06:21 < reiffert> unique
06:21 < reiffert> Subject: C=DE, ST=Hessen, L=Wiesbaden, O=3deluxe, OU=3de, CN=Joaquin Busch/emailAddress=jobu@foo
06:22 < reiffert> there is no underscore
06:22 < reiffert> Now I'm scared.
06:23 < janjust> reiffert:  openvpn translates the cert subject name; spaces are replaced with underscores, and there are some other mappings as well 
06:23 < janjust> (it's explained on the openvpn.net pages)
06:23 < janjust> << out for lunch, back in 30 mins)
06:24 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has quit [Ping timeout: 246 seconds]
06:25 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 264 seconds]
06:25 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
06:26 < reiffert> obviously it does not work properly. dazo broke it.
06:27 -!- Ritche [Ritche@shellium/member/soulesss] has joined #openvpn
06:28 < Ritche> hi on centos its done with iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
06:28 < Ritche> how about on freebsd ?
06:28 < reiffert> !nat
06:28 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
06:28 < reiffert> !bsdnat
06:28 <@vpnHelper> "bsdnat" is see !fbsdnat
06:28 < reiffert> !fbsdnat
06:28 < Ritche> !fbsdnat
06:28 <@vpnHelper> "fbsdnat" is see http://cavanantha.wordpress.com/2007/09/16/nat-on-freebsd-using-pf/ for a basic howto for NAT on FreeBSD
06:28 <@vpnHelper> "fbsdnat" is see http://cavanantha.wordpress.com/2007/09/16/nat-on-freebsd-using-pf/ for a basic howto for NAT on FreeBSD
06:28 < Ritche> Error 404 - Not Found
06:29 < Ritche> no page
06:29 < reiffert> http://www.freebsd.org/doc/en/books/handbook/network-natd.html
06:29 <@vpnHelper> Title: Network Address Translation (at www.freebsd.org)
06:31 < Ritche> no simple command just like iptables?
06:31 < reiffert> sure:
06:31 < reiffert> lynx http://www.freebsd.org/doc/en/books/handbook/network-natd.html
06:31 <@vpnHelper> Title: Network Address Translation (at www.freebsd.org)
06:33 < Ritche> ok
06:33 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has joined #openvpn
06:38 < ecrist> morning, bitches
06:39 < ecrist> Ritche: you trying to do nat on freebsd?
06:40 < Ritche> ecrist yes
06:40 < Ritche> cant make it work 
06:40 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has quit [Ping timeout: 240 seconds]
06:41 < Ritche> i mean replacement for iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE on freebsd
06:44 < ecrist> use pf
06:44 < Ritche> should i add it on kernel and recompile it again?
06:45 < ecrist> what version of freebsd?
06:45 < Ritche> 7.3
06:45 < ecrist> it's auto-loaded
06:45 < Ritche> +-(/usr/local/etc/openvpn)->/etc/rc.d/pf start
06:45 < Ritche> Enabling pf.
06:45 < Ritche> No ALTQ support in kernel
06:45 < Ritche> ALTQ related functions disabled
06:45 < Ritche> No ALTQ support in kernel
06:45 < Ritche> ALTQ related functions disabled
06:45 < Ritche> i cant start it
06:45 -!- Ritche was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
06:45 -!- Ritche [Ritche@shellium/member/soulesss] has joined #openvpn
06:45 < Ritche> sorry for the paste
06:45 < ecrist> that's started
06:45 < ecrist> those are just warning
06:46 < ecrist> ALTQ is traffic queueing and prioritization, which requires a special kernel
06:46 < ecrist> it's just letting you know that support isn't built in, you don't need it for nat
06:46 < Ritche> but still i cant still use my vpn ip 
06:46 < ecrist> pfctl -v -s rules
06:46 < ecrist> paste your pf.conf somewhere
06:46 < Ritche> k
06:47 < Ritche> http://pastebin.com/xqcPxZJh
06:47 < Ritche> ext_if="204.15.228.198" means this is my vpn ip?
06:47 < Ritche> or my real ip here
06:49 < ecrist> http://pastebin.com/vaAg83WW
06:50 < ecrist> updated/corrected
06:50 < Ritche> what should i put in ext_if="204.15.228.198" for the ip replacement since i just got that from an example
06:51 < ecrist> that IP should be your REAL ip
06:52 < ecrist> the IP you want VPN traffic nat'd to
06:52 -!- sp4rc [~sp4rc@62.12.129.242] has joined #openvpn
06:52 < Ritche> i should change that often if i am on dynamic right?
06:52 < ecrist> every time your IP changes
06:52 < ecrist> wrap that into your dyndns update script
06:53 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has joined #openvpn
06:53 < reiffert> how to rebuild the openssl index database?
06:54 < Ritche> /etc/pf.conf:10: invalid interface name '204.15.228.198'
06:54 < ecrist> paste your line 10 here
06:54 < ecrist> just line 10
06:55 < Ritche> nat on $ext_if from $vpn_network to any -> ($ext_ip)
06:55 -!- sp4rc_ [~sp4rc@62.12.129.186] has quit [Ping timeout: 250 seconds]
06:55 < ecrist> and did you change line 2 of the pf.conf to ext_if = "fxp0" or does it still say Eif or whatever?
06:55 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
06:56 < Ritche> ext_if = "fxp0"
06:56 < Ritche> thats line 2
06:56 < Ritche> i just copy all in http://pastebin.com/vaAg83WW
06:56 < ecrist> do you have an interface named fxp0?
06:56 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 272 seconds]
06:56 < ecrist> do this, pastebin output from 'ifconfig'
06:56 < Ritche> no i dont have
06:56 < Ritche> no fxp0
06:56 < Ritche> just re0
06:56 < ecrist> lol, then why are you using an interface you don't have?
06:57 < ecrist> pastebin ifconfig output, please
06:57 < Ritche> ok
06:57 < Ritche> http://pastebin.com/tepbA7f2
06:57 < Ritche> you will see a huge ip range :P
06:58 < ecrist> running a lot of jails on that box or something?
06:59 < ecrist> Ritche: change fxp0 on line two to re0
06:59 < ecrist> and then /etc/rc.d/pf restart
06:59 < Ritche> /etc/pf.conf:10: invalid interface name '204.15.228.198'
06:59 < Ritche> same
07:00 < ecrist> re-paste your pf.conf
07:00 <@vpnHelper> RSS Update - forum: IP Leaking <http://forums.openvpn.net/topic7730.html>
07:00 < Ritche> ok
07:01 < Ritche> http://pastebin.me/d66a6d92426552f737a8d2d2b40751cb
07:01 < ecrist> that ext_ip needs to be one of your IP addresses
07:02 < ecrist> it's complaining because you don't have 204.15.228.198 on any interfaces
07:02 < Ritche> yeah thats my real ip ?
07:03 < Ritche> or vpn ip ?
07:03 < ecrist> YES
07:03 < ecrist> dude, please start paying attention
07:03 < Ritche> that wont be on the ifconfig if that is my real ip
07:03 < ecrist> you need to nat to an IP that's on one of the interfaces
07:04 -!- Ehctir [Ritche@222.127.59.249] has joined #openvpn
07:04 -!- Ritche [Ritche@shellium/member/soulesss] has quit [Read error: Connection reset by peer]
07:05 < Ehctir> ecrist thanks it works now
07:05 < ecrist> :)
07:05 < Ehctir> e used myt old config
07:05 < Ehctir> and edit that eIF
07:05 < Ehctir> that fx thing to re0
07:05 < Ehctir> and it works :) thanks
07:05 < Ehctir> bbl let me try it here
07:05 -!- Ehctir [Ritche@222.127.59.249] has quit [Client Quit]
07:05 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has quit [Ping timeout: 276 seconds]
07:06 -!- Ritche [~ritche@mella.ph] has joined #openvpn
07:06 < Ritche> big thanks ecrist :)
07:06 < ecrist> no problem.
07:06 < Ritche> you are awesome :)
07:06 < ecrist> freebsd guy, is all
07:07 < ecrist> I'm far less awesome on linux. ;)
07:07 < Ritche> it randomly use any of those 128 ips
07:07 < Ritche> when i will reconnect it will use another ip 
07:07 < Ritche> that is normal or their is way to use a static ip on re0 
07:08 < ecrist> change ext_ip to one of those specific IPs
07:09 < Ritche> ahh ok
07:10 < Ritche> trying now bbl
07:10 -!- Ritche [~ritche@mella.ph] has quit [Client Quit]
07:10 <@vpnHelper> RSS Update - forum: IP Leaking <http://forums.openvpn.net/topic7730.html#p10211>
07:12 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
07:12 -!- Ritche [~ritche@lab007.room143.universal.edu.au] has joined #openvpn
07:12 < Ritche> still random
07:14 < janjust> reiffert:  as I said before, rebuilding the entire index.txt file is not trivial
07:14 < Ritche> oh no 
07:14 < Ritche> it randomly change my ip each 1 minute
07:14 < Ritche> lol
07:15 < Ritche> every refresh on http://www.whatsmyip.org/ my ip changed
07:15 <@vpnHelper> Title: What's My IP Address? Networking Tools & More (at www.whatsmyip.org)
07:18 < reiffert> janjust: seems like this is the major cause to the problems. Joaquin Busch got 3 certs, just one finds itself in the index.
07:19 < ecrist> Ritche: then you're doing something wrong.
07:19 < Ritche> ecrist yeah dont know which part to make it permanent ip
07:19 < reiffert> janjust: so rebuilding the whole bunny now. I wonder that there isnt something ready made.
07:19 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has joined #openvpn
07:19 < ecrist> paste your new pf.conf
07:19 < reiffert> janjust: at least my googleing doesnt show up something like *click here*
07:20 < Ritche> ecrist ahh because of this 
07:20 < Ritche> nat on $eIF from $vpn_network to any -> ($eIF
07:20 < Ritche> maybe replace it with nat on $eIF from $vpn_network to permanentip
07:20 < Ritche> change permanentip to ip of re0 ?
07:20 < ecrist> no,
07:20 < ecrist> nat on $eIF from $vpn_network to any -> ($eIP)
07:20 < Ritche> ok hold pasting it
07:21 < Ritche> that part should be edited i guess
07:21 < Ritche> since it says to any
07:21 < ecrist> the part after -> should be the IP you want it nat'd to
07:21 < Ritche> its random on the re0
07:21 < Ritche> ahh
07:21 < ecrist> you're wrong
07:21 < ecrist> to any means where the traffic is going to
07:21 < ecrist> it's randomized becuase you told pf to use any IP on the re0 interface
07:21 < janjust> reiffert:  I'm dreaming up a script right now, but it's the cert timestamp that is troubling me a bit
07:21 < Ritche> nat on $eIF from $vpn_network to any -> iphere
07:21 < Ritche> thats it?
07:21 < ecrist> seriously, if you'd pay attention to what I'm saying...
07:21 < ecrist> YES
07:22 < Ritche> ok 
07:22 < reiffert> janjust: should be the expire time stamp for valid certs, no?
07:23 < janjust> yep reiffert , but it's the format that I'm having trouble with 
07:23 < reiffert> ah lemme see on that
07:24 < reiffert> date -d "Feb 23 10:09:33 2011 GMT" +"%s"
07:24 < reiffert> 1298455773
07:24 < reiffert> ah well %Y%m%d and so on.
07:24 -!- Ehctir [~ritche@shellsnetwork.net] has joined #openvpn
07:24 < Ehctir> ecrist again thanks for the help
07:24 < Ehctir> works now
07:25 < ecrist> would have worked 20 mins ago if you'd paid attention. ;)
07:25 < ecrist> 07:08:24 < ecrist> change ext_ip to one of those specific IPs
07:25 < ecrist> 07:09:25 < Ritche> ahh ok
07:25 < ecrist> 07:10:21 < Ritche> trying now bbl
07:25 < Ehctir> hehe sorry just first timer :D
07:25 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
07:25 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
07:26 < janjust> reiffert:  I like the 'date -d' command but it does not produce the same timestamps as openssl
07:26 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 276 seconds]
07:26 < ecrist> so use the format, janjust
07:26 < reiffert> janjust: YYMMDDHHMMSSZ
07:26 -!- Ritche [~ritche@lab007.room143.universal.edu.au] has quit [Ping timeout: 250 seconds]
07:27 < reiffert> Z as the letter Z
07:27 < janjust> I have a cert here, with enddate Apr 18 08:39:25 2016 GMT
07:27 < janjust> (as reported by openssl x509 -enddate)
07:27 < reiffert> date -d "Feb 23 10:09:33 2011 GMT" +"%y%m%d%H%M%SZ"
07:27 < reiffert> 110223110933Z
07:28 < Ehctir> ecrist cya 
07:28 < janjust> if I run this through "date -d" I get 1460968765
07:28 < reiffert> date -d "Apr 18 08:39:25 2016 GMT" +"%y%m%d%H%M%SZ"
07:28 < reiffert> 160418103925Z
07:28 < janjust> the index.txt file, however, mentions 160418083925Z
07:28 < janjust> aaaah kewl... 
07:28 < reiffert> pretty close
07:28 < reiffert> but they still differe.
07:28 < janjust> nope, they're identicdal
07:28 -!- Ehctir [~ritche@shellsnetwork.net] has quit [Client Quit]
07:29 < reiffert> no, they are not.
07:29 < ecrist> no, they're not
07:29 < reiffert> 160418103925Z
07:29 < reiffert> 160418083925Z
07:29 < janjust> 160418083925Z
07:29 < janjust> I don't see a difference
07:29 < reiffert> off two hours.
07:29 < janjust> ow doh
07:29 < janjust> you're right... that the TZ
07:29 < reiffert> the UTC stuff.
07:29 < reiffert> there we are:
07:29 < reiffert> date -u -d "Apr 18 08:39:25 2016 GMT" +"%y%m%d%H%M%SZ"
07:29 < reiffert> 160418083925Z
07:30 < reiffert> 160418083925Z
07:30 < reiffert> seems equivalent now
07:30 < janjust> date -d "Apr 18 08:39:25 2016 GMT" --utc +"%y%m%d%H%M%SZ"
07:30 < janjust> yep
07:31 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
07:36 < reiffert> /usr/local/ssl/bin/openssl x509 -in 0E.pem -text -noout | grep Subject: | sed -e 's/, /\//g' | cut -b 17- | sed -e 's/ /\//'
07:38 < janjust> http://www.nikhef.nl/~janjust/openvpn/rebuild-index
07:39 < janjust> run it using 'rebuild-index ??.pem'
07:39 < janjust> I got the exact same index.txt back for my (sample) openssl db
07:39 < janjust> you will need to re-revoke certificates though
07:40 < janjust> and you may need to play with the '-utf8' flag when printing the certificate subject
07:42 < reiffert> Thank you, meer++
07:43 < janjust> hehe no prob
07:43 < reiffert> I wonder if duplicate CN's are valid for the index file.
07:43 < janjust> yes they are , reiffert , as long as the serial numbers are different
07:43 < reiffert> great.
07:44 < reiffert> I will have to take a training lesson on sed I guess.
07:44 < janjust> this is also how certs are revoked : a lookup is done of the subject DN + serial  and an 'R' is put in front of the entry; also a revoke/expiration date is added
07:44 < janjust> sed/awk , whatever... if it gets complicated or if performance becomes an issue, switch to perl
07:45 < reiffert> switch to training lesson :)
07:53 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
08:14 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 240 seconds]
08:25 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
08:30 -!- kronos003 [~kronos003@206-188-75-41.cpe.distributel.net] has quit [Quit: Changing server]
08:43 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
08:43 <@vpnHelper> RSS Update - forum: openvpn server config for airlink raven xe please help <http://forums.openvpn.net/topic7657.html#p10212>
08:57 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
08:57 < MaxFrames> hello
08:57 < MaxFrames> I'm having big trouble with my openvpn experiment... I hope you can help
08:58 < MaxFrames> to test connectivity, I'm remote desktop'ing to my home PC; my home PC is configured as the VPN client
08:59 < MaxFrames> as soon as I launch OpenVPN GUI (it's Windows XP), and the tray icon says that it has connected to the server, I lose remote desktop connectivity
08:59 < MaxFrames> and I cannot talk to the home PC anymore
09:00 < MaxFrames> I tested connectivity from home yesterday and it was working
09:00 < MaxFrames> meaning I had the green icon on the tray, and the log said that connection to the server was fine
09:01 < MaxFrames> but when I initiate the same operation remotely via RDP, I lose connection and I cannot go on
09:03 < MaxFrames> I haven't yet enabled IP forwarding on the server, and I haven't yet created a return route to the VPN clients network on the gateway; I'm just testing point to point connectivity between the client and the server
09:03 <@vpnHelper> RSS Update - forum: IP Leaking <http://forums.openvpn.net/topic7730.html#p10213>
09:03 < MaxFrames> I don't understand why I lose RDP connection to the client as soon as the point to point vpn link is established :(
09:09 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 264 seconds]
09:09 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 264 seconds]
09:09 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
09:11 -!- Deathzor [~deathtje@216.67.225.106] has quit [Ping timeout: 264 seconds]
09:11 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
09:12 -!- areq [~areq@pld-linux/areq] has quit [Ping timeout: 264 seconds]
09:15 < MaxFrames> I've rebooted the client at home (don't ask me how :P) and in the event log I found that the lease has been denied from the openvpn server to the client
09:15 < MaxFrames> DHCPNACK
09:15 < MaxFrames> this wasn't happening yesterday when I tried from home
09:15 -!- Netsplit *.net <-> *.split quits: Martink, jhelwig, SJr, fahadsadah_, MaxFrames, LeRrA, havoc, mace, sp4rc, x-demon,  (+8 more, use /NETSPLIT to show all of them)
09:16 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
09:16 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
09:16 -!- Deathzor_ [~deathtje@216.67.225.106] has joined #openvpn
09:16 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
09:16 -!- areq_ [~areq@q.areq.eu.org] has joined #openvpn
09:17 -!- paolo__ [~pa@host129-21-dynamic.61-82-r.retail.telecomitalia.it] has joined #openvpn
09:17 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
09:17 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
09:18 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Client Quit]
09:18 < reiffert> is there something that checks openssl index database frequently and checks for expiry dates?
09:18 < reiffert> and marks valid certificates for expiration or similar
09:18 < janjust> reiffert:  normally openssl uses the end date to check for expiration
09:18 < janjust> however, if you wish to renew a certificate before the end-date is near you have to explicitly "expire" it
09:18 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
09:18 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
09:18 -!- Peer^_ [~ttt@ks355877.kimsufi.com] has joined #openvpn
09:18 -!- dazo_ [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:18 -!- mode/#openvpn [+o dazo_] by ChanServ
09:19 -!- areq [~areq@q.areq.eu.org] has joined #openvpn
09:19 -!- areq [~areq@q.areq.eu.org] has quit [Changing host]
09:19 -!- areq [~areq@pld-linux/areq] has joined #openvpn
09:19 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
09:19 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
09:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:22 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
09:25 -!- Netsplit *.net <-> *.split quits: cron2, Peer^, areq_, @dazo, sbrath
09:26 -!- havoc_ [~havoc@neptune.chaillet.net] has joined #openvpn
09:26 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
09:26 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
09:26 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
09:26 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
09:26 -!- mace_ [~mace@n01.darksilence.net] has joined #openvpn
09:26 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Excess Flood]
09:26 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
09:27 -!- clyons_ [~clyons@unaffiliated/clyons] has joined #openvpn
09:27 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
09:29 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
09:30 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
09:30 -!- jhelwig_ [~jhelwig@li229-87.members.linode.com] has joined #openvpn
09:30 -!- CrazyFurry [xdemon@lex.io] has joined #openvpn
09:30 -!- havoc_ is now known as havoc
09:34 -!- dazo_ is now known as dazo
09:35 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
09:35 <@vpnHelper> RSS Update - forum: IP Leaking <http://forums.openvpn.net/topic7730.html#p10214>
09:39 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 276 seconds]
09:39 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:40 < reiffert> janjust: nah, I'd like to change a valid cert to "expired" on a regular basis
09:40 <@vpnHelper> RSS Update - forum: IP Leaking <http://forums.openvpn.net/topic7730.html#p10215>
09:41 < janjust> I'd simply edit the index.txt file and change the 'V' to an 'E' for the cert DN
09:41 < janjust> I've not seen any openssl based tool that do this for you
09:42 -!- mace_ [~mace@n01.darksilence.net] has quit [Changing host]
09:42 -!- mace_ [~mace@debian/developer/mace] has joined #openvpn
09:42 -!- mace_ is now known as mace
09:42 -!- paolo__ is now known as pa
09:42 -!- pa [~pa@host129-21-dynamic.61-82-r.retail.telecomitalia.it] has quit [Changing host]
09:42 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
09:46 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
09:46 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
09:50 -!- EugeneKaway is now known as EugeneKay
09:59 <@vpnHelper> RSS Update - forum: Issue with "Diffie–Hellman" key in Ubuntu NetworkManager? <http://forums.openvpn.net/topic7725.html#p10216>
10:01 -!- WormFood [~wormfood@183.39.77.144] has quit [Read error: Connection reset by peer]
10:05 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:10 -!- Netsplit *.net <-> *.split quits: Hamlin, Nappy
10:10 -!- Netsplit *.net <-> *.split quits: raw, meepmeep, 45PABT3IV
10:10 -!- Netsplit *.net <-> *.split quits: jhelwig_, rkantos, hpa, secretary_linux, asgw
10:10 -!- Netsplit *.net <-> *.split quits: @mattock, renihs, MJD, kloeri, SJrX, EugeneKay, fahadsadah, clyons_, Rolybrau, grapsus,  (+28 more, use /NETSPLIT to show all of them)
10:11 -!- Netsplit *.net <-> *.split quits: fbh, diphthong, @dazo, _zero_, janjust, stony_, lupine_85, Martin`, Druid_, sia^pwnnt,  (+3 more, use /NETSPLIT to show all of them)
10:11 -!- Netsplit *.net <-> *.split quits: chantra_1fk, APTX, DarthGandalf, Varazir, TypoNe, common, areq, ScriptFanix, xxtjaxx, Fleck,  (+55 more, use /NETSPLIT to show all of them)
10:18 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:18 -!- secretar1_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has joined #openvpn
10:18 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
10:18 -!- rolls` [~rollin@190.120.228.48] has joined #openvpn
10:18 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
10:18 -!- Ritche [soulesss@shellium/member/soulesss] has joined #openvpn
10:18 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
10:18 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
10:18 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
10:18 -!- CrazyFurry [xdemon@lex.io] has joined #openvpn
10:18 -!- jhelwig_ [~jhelwig@li229-87.members.linode.com] has joined #openvpn
10:18 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
10:18 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
10:18 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
10:18 -!- clyons_ [~clyons@unaffiliated/clyons] has joined #openvpn
10:18 -!- mace [~mace@debian/developer/mace] has joined #openvpn
10:18 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
10:18 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
10:18 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
10:18 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
10:18 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
10:18 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
10:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:18 -!- areq [~areq@pld-linux/areq] has joined #openvpn
10:18 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
10:18 -!- Peer^_ [~ttt@ks355877.kimsufi.com] has joined #openvpn
10:18 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
10:18 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
10:18 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
10:18 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:18 -!- Deathzor_ [~deathtje@216.67.225.106] has joined #openvpn
10:18 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
10:18 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
10:18 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:18 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
10:18 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
10:18 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has joined #openvpn
10:18 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
10:18 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has joined #openvpn
10:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:18 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
10:18 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
10:18 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
10:18 -!- Champi [Champi@rootshell.fr] has joined #openvpn
10:18 -!- funabash1 [~funabashi@46.21.169.82] has joined #openvpn
10:18 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
10:18 -!- Druid_ [~mf@p5B136189.dip.t-dialin.net] has joined #openvpn
10:18 -!- ServerMode/#openvpn [+o dazo] by verne.freenode.net
10:18 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
10:18 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
10:18 -!- Meliorator [m@dunnington.eu] has joined #openvpn
10:18 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
10:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:18 -!- albech [~thomas@110.164.248.17] has joined #openvpn
10:18 -!- master_of_master [~master_of@p57B53734.dip.t-dialin.net] has joined #openvpn
10:18 -!- common [~common@p5DDA4B04.dip0.t-ipconnect.de] has joined #openvpn
10:18 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
10:18 -!- nb [~nb@fedora/nb] has joined #openvpn
10:18 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
10:18 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
10:18 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
10:18 -!- js_ [~js@213.180.83.163] has joined #openvpn
10:18 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
10:18 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
10:18 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
10:18 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
10:18 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
10:18 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
10:18 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
10:18 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:18 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has joined #openvpn
10:18 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
10:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:18 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
10:18 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
10:18 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
10:18 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
10:18 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
10:18 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
10:18 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
10:18 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
10:18 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
10:18 -!- jwm [jwm@dev.dist.us] has joined #openvpn
10:18 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
10:18 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
10:18 -!- MiKa_ [~MiKa@ip5657a511.direct-adsl.nl] has joined #openvpn
10:18 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
10:18 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
10:18 -!- groundnuty [~orzech@elj74.internetdsl.tpnet.pl] has joined #openvpn
10:18 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
10:18 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
10:18 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
10:18 -!- Gnewt [~vector@a.box.iownyour.info] has joined #openvpn
10:18 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
10:18 -!- ServerMode/#openvpn [+ooo mattock patelx vpnHelper] by verne.freenode.net
10:18 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
10:18 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
10:18 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
10:18 -!- MadTBone [~MadTBone@gw.msmnyc.edu] has joined #openvpn
10:18 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
10:18 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
10:18 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
10:18 -!- UdontKnow [~evaldo@freenode/staff/udontknow] has joined #openvpn
10:18 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
10:18 -!- EmperorTom [~EmperorTo@216.17.68.153] has joined #openvpn
10:18 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
10:18 -!- swills [~swills_@unaffiliated/steve/x-520345] has joined #openvpn
10:18 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
10:18 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
10:18 -!- mete [~metefr@84.200.12.194] has joined #openvpn
10:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:18 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
10:18 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
10:18 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
10:18 -!- toortog [nesm6@notsecure.net] has joined #openvpn
10:18 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
10:18 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
10:18 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
10:18 -!- chantra_1fk [~chantra@ns38827.ovh.net] has joined #openvpn
10:18 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
10:18 -!- Dropje [~yge@5351300C.cm-6-2a.dynamic.ziggo.nl] has joined #openvpn
10:18 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has joined #openvpn
10:18 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
10:18 -!- xxtjaxx [~andreas@kde/developer/marschke] has joined #openvpn
10:18 -!- katoen [e1bdd889cd@xs8.xs4all.nl] has joined #openvpn
10:18 -!- Bushmills [~l@scarydevilmonastery.net] has joined #openvpn
10:18 -!- WormFood [~wormfood@183.39.79.182] has joined #openvpn
10:18 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
10:18 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
10:18 -!- MiKa__ [~MiKa@ip5657a511.direct-adsl.nl] has joined #openvpn
10:20 -!- EugeneK [EugeneKay@eugenekay.com] has joined #openvpn
10:21 -!- hardwire_ [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
10:21 -!- cherwin_ [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
10:23 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 252 seconds]
10:23 -!- jhelwig_ [~jhelwig@li229-87.members.linode.com] has quit [Ping timeout: 252 seconds]
10:23 < MaxFrames> anyone?
10:23 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Ping timeout: 252 seconds]
10:24 -!- Netsplit *.net <-> *.split quits: js_, EvilJStoker, Rienzilla, asgw, Rolybrau, MarKsaitis_, MJD, krzee, venom00ut, EO_,  (+8 more, use /NETSPLIT to show all of them)
10:24 -!- Netsplit *.net <-> *.split quits: renihs, @mattock, kloeri, SJrX, EugeneKay, @dazo, fahadsadah, clyons_, krphop, Fiouz,  (+20 more, use /NETSPLIT to show all of them)
10:24 -!- Netsplit *.net <-> *.split quits: chantra_1fk, APTX, DarthGandalf, Varazir, TypoNe, common, areq, ScriptFanix, xxtjaxx, katoen,  (+70 more, use /NETSPLIT to show all of them)
10:24 -!- Netsplit over, joins: kloeri
10:29 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
10:29 -!- jhelwig_ [~jhelwig@li229-87.members.linode.com] has joined #openvpn
10:29 -!- hpa_ [hpa@terminus.zytor.com] has joined #openvpn
10:29 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
10:29 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
10:29 -!- raw [~raw@chipotle118.server4you.de] has joined #openvpn
10:29 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
10:29 -!- cherwin_ [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
10:29 -!- hardwire_ [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
10:29 -!- EugeneK [EugeneKay@eugenekay.com] has joined #openvpn
10:29 -!- MiKa__ [~MiKa@ip5657a511.direct-adsl.nl] has joined #openvpn
10:29 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
10:29 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
10:29 -!- WormFood [~wormfood@183.39.79.182] has joined #openvpn
10:29 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:29 -!- secretar1_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has joined #openvpn
10:29 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
10:29 -!- rolls` [~rollin@190.120.228.48] has joined #openvpn
10:29 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
10:29 -!- Ritche [soulesss@shellium/member/soulesss] has joined #openvpn
10:29 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
10:29 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
10:29 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
10:29 -!- CrazyFurry [xdemon@lex.io] has joined #openvpn
10:29 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
10:29 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
10:29 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
10:29 -!- clyons_ [~clyons@unaffiliated/clyons] has joined #openvpn
10:29 -!- mace [~mace@debian/developer/mace] has joined #openvpn
10:29 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
10:29 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
10:29 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
10:29 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
10:29 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
10:29 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
10:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:29 -!- areq [~areq@pld-linux/areq] has joined #openvpn
10:29 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
10:29 -!- Peer^_ [~ttt@ks355877.kimsufi.com] has joined #openvpn
10:29 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
10:29 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
10:29 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
10:29 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:29 -!- Deathzor_ [~deathtje@216.67.225.106] has joined #openvpn
10:29 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
10:29 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
10:29 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
10:29 -!- ServerMode/#openvpn [+o dazo] by verne.freenode.net
10:29 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
10:29 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has joined #openvpn
10:29 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
10:29 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has joined #openvpn
10:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:29 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
10:29 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
10:29 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
10:29 -!- Champi [Champi@rootshell.fr] has joined #openvpn
10:29 -!- funabash1 [~funabashi@46.21.169.82] has joined #openvpn
10:29 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
10:29 -!- Druid_ [~mf@p5B136189.dip.t-dialin.net] has joined #openvpn
10:29 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
10:29 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
10:29 -!- Meliorator [m@dunnington.eu] has joined #openvpn
10:29 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
10:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:29 -!- albech [~thomas@110.164.248.17] has joined #openvpn
10:29 -!- master_of_master [~master_of@p57B53734.dip.t-dialin.net] has joined #openvpn
10:29 -!- common [~common@p5DDA4B04.dip0.t-ipconnect.de] has joined #openvpn
10:29 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
10:29 -!- nb [~nb@fedora/nb] has joined #openvpn
10:29 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
10:29 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
10:29 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
10:29 -!- js_ [~js@213.180.83.163] has joined #openvpn
10:29 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
10:29 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
10:29 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
10:29 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
10:29 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
10:29 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
10:29 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:29 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has joined #openvpn
10:29 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
10:29 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:29 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
10:29 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
10:29 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
10:29 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
10:29 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
10:29 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
10:29 -!- jwm [jwm@dev.dist.us] has joined #openvpn
10:29 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
10:29 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
10:29 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
10:29 -!- ServerMode/#openvpn [+ooo mattock patelx vpnHelper] by verne.freenode.net
10:29 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
10:29 -!- groundnuty [~orzech@elj74.internetdsl.tpnet.pl] has joined #openvpn
10:29 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
10:29 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
10:29 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
10:29 -!- Gnewt [~vector@a.box.iownyour.info] has joined #openvpn
10:29 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
10:29 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
10:29 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
10:29 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
10:29 -!- MadTBone [~MadTBone@gw.msmnyc.edu] has joined #openvpn
10:29 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
10:29 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
10:29 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
10:29 -!- UdontKnow [~evaldo@freenode/staff/udontknow] has joined #openvpn
10:29 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
10:29 -!- EmperorTom [~EmperorTo@216.17.68.153] has joined #openvpn
10:29 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
10:29 -!- swills [~swills_@unaffiliated/steve/x-520345] has joined #openvpn
10:29 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
10:29 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
10:29 -!- mete [~metefr@84.200.12.194] has joined #openvpn
10:29 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:29 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
10:29 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
10:29 -!- diphthong [~diphthong@69.172.135.243] has joined #openvpn
10:29 -!- toortog [nesm6@notsecure.net] has joined #openvpn
10:29 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
10:29 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
10:29 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
10:29 -!- chantra_1fk [~chantra@ns38827.ovh.net] has joined #openvpn
10:29 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
10:29 -!- Dropje [~yge@5351300C.cm-6-2a.dynamic.ziggo.nl] has joined #openvpn
10:29 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has joined #openvpn
10:29 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
10:29 -!- xxtjaxx [~andreas@kde/developer/marschke] has joined #openvpn
10:29 -!- katoen [e1bdd889cd@xs8.xs4all.nl] has joined #openvpn
10:29 -!- Bushmills [~l@scarydevilmonastery.net] has joined #openvpn
10:29 -!- renihs_ [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
10:30 < MaxFrames> too bad. I'll try again on monday, I hope someone will be available by then
10:30 -!- kloeri is now known as Guest74413
10:30 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
10:30 -!- albech_ [~thomas@61.7.136.188] has joined #openvpn
10:30 < MaxFrames> friday afternoon is not a good moment to try new things anyway
10:30 < krzee> MaxFrames, what was it...?
10:30 -!- albech [~thomas@110.164.248.17] has quit [Ping timeout: 264 seconds]
10:30 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has quit [Ping timeout: 264 seconds]
10:30 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Ping timeout: 264 seconds]
10:30 < MaxFrames> a question about bridging
10:30 -!- albech [~thomas@110.164.248.17] has joined #openvpn
10:31 -!- renihs [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Ping timeout: 264 seconds]
10:31 -!- albech [~thomas@110.164.248.17] has quit [Max SendQ exceeded]
10:31 < krzee> oh, i wont be useful
10:31 < krzee> well, likely
10:31 < krzee> unless you need to be talked out of doing it...
10:31 < krzee> why do you need a bridge?
10:31 < Ritche> krzee hi do you know how to enable identd in openvpn its says on irc identd not found.
10:31 < krzee> identd has NOTHING to do with openvpn
10:32 < Ritche> identd is installed already on the server
10:32 < Ritche> when im using znc or bnc
10:32 < Ritche> it does work
10:32 < Ritche> but when connecting to openvpn and use normal irc it doesnt
10:33 < krzee> when connected, and you go to www.secure-computing.net/ip.php  does the external IP of the vpn server show up?
10:33 < Ritche> yes
10:34 < Ritche> it shows the ip of my vpn
10:34 < krzee> oh right, theres no way for your server to know who owns the IRC process
10:34 < krzee> so when the server is queried for the username of the process, it doesnt know
10:34 < krzee> since the process isnt at all on the server
10:34 < Ritche> so no way to enable identd while connecting to the server?
10:34 < krzee> setup your identd to have a default response
10:34 < krzee> put it in debug mode
10:35 < krzee> your question ONLY relates to using identd, it has nothing to do with openvpn
10:35 < Ritche> okay i was just thinking there is another firewall setup for that sorry
10:36 -!- Netsplit *.net <-> *.split quits: dkr, hpa, asgw, EO_
10:36 < krzee> no worries
10:37 < MaxFrames> I'm considering it, because I don't have direct control of the server LAN gateway so I cannot add the static return route to the VPN clients subnet
10:37 -!- albech_ [~thomas@61.7.136.188] has quit [Read error: Connection timed out]
10:37 -!- albech_ [~thomas@110.164.248.17] has joined #openvpn
10:38 < MaxFrames> I could ask the IT department to add the route, but I'd prefer not to, and bridging would also allow me to use my existing DHCP server to assign a lease to the VPN clients
10:38 < krzee> MaxFrames, you can get around that 2 ways
10:38 < krzee> 1) add the return route on the machines on the lan that need vpn connectivity
10:38 < krzee> 2) the NAT hack
10:39 < EugeneK> "Lie."
10:39 < krzee> what lie?
10:39 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has quit [Ping timeout: 246 seconds]
10:39 -!- EugeneK is now known as EugeneKay
10:40 < MaxFrames> krzee: what are the issues with bridging you said?
10:40 -!- Netsplit over, joins: asgw
10:40 < krzee> MaxFrames, you dont need a bridge
10:41 < krzee> you only need a bridge when you need to tunnel layer2... you dont
10:42 < MaxFrames> what is 2)?
10:42 < MaxFrames> sorry?
10:42 < krzee> the NAT hack
10:42 < MaxFrames> what's the NAT hack you mentioned?
10:42 < krzee> since you cant add the return route, you NAT into the subnet
10:43 < EugeneKay> HAve identd lie
10:43 < EugeneKay> iptables -t nat -A POSTROUTING -s 10.8.0.0 255.255.255.0 -j MASQUERADE
10:43 < EugeneKay> Dep, with a -o eth0 in there
10:43 < MaxFrames> I agree that I dEugeneKay: is that for me?
10:43 < EugeneKay> Yes, it is.
10:44 < MaxFrames> let me digest it a while :P
10:44 < EugeneKay> Traffic from the VPN subnet will get NATed as it goes out eth0
10:44 < MaxFrames> OK, so the openvpn server will act as a nat router?
10:45 < WormFood> why are you using masquarade? are you on a dynamic IP?
10:45 < EugeneKay> Right.
10:45 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
10:45 < WormFood> ok...that is right....if you're on a static IP, you'd want to use SNAT
10:45 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
10:45 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 240 seconds]
10:46 -!- hardwire_ [~spencersr@69-161-26-211.static.acsalaska.net] has quit [Ping timeout: 240 seconds]
10:46 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
10:46 -!- groundnuty [~orzech@elj74.internetdsl.tpnet.pl] has quit [Ping timeout: 240 seconds]
10:46 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
10:46 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
10:46 -!- Agin_ [~Agin@greenzone.copyleft.no] has joined #openvpn
10:46 < MaxFrames> OK, my openvpn server is on a static IP, so what will the command be?
10:46 < krzie> !nathack
10:46 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
10:46 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Ping timeout: 240 seconds]
10:46 -!- Peer^_ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 240 seconds]
10:46 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
10:46 -!- js_ [~js@213.180.83.163] has quit [Ping timeout: 240 seconds]
10:46 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Ping timeout: 240 seconds]
10:46 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 240 seconds]
10:46 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 240 seconds]
10:46 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Ping timeout: 240 seconds]
10:46 -!- MadTBone [~MadTBone@gw.msmnyc.edu] has quit [Ping timeout: 240 seconds]
10:47 < MaxFrames> woops thanks
10:47 -!- renihs_ [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Ping timeout: 240 seconds]
10:47 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
10:47 -!- Ritche [soulesss@shellium/member/soulesss] has quit [Ping timeout: 240 seconds]
10:47 < WormFood> EugeneKay, try something like iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
10:47 < EugeneKay> I only have one IP address on eth0, so I stick with masquerade
10:47 < EugeneKay> WormFood - it's for MaxFrames ;-)
10:47 < EugeneKay> And why would eth1 be involved at all?
10:48 < EugeneKay> I don't think he even has an eth1
10:48 < WormFood> well, change it to fit your needs
10:48 -!- hpa_ is now known as hpa
10:48 < MaxFrames> no, just a single adapter eth0
10:48 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
10:48 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
10:48 < krzie> eth8 is thats what you use :-p
10:48 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has joined #openvpn
10:48 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
10:49 < EugeneKay> You'll probably want to stick the rule into your iptables config file
10:49 < EugeneKay> Wherever that is on your system
10:49 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
10:49 < MaxFrames> OK, this is good news really, I'll try all this asap
10:49 -!- 36DAA8UFG [~js@213.180.83.163] has joined #openvpn
10:49 < MaxFrames> but can you tell me in brief why routing is more desireable than bridging, even with the nat hack? I've read the FAQ but I'm still uncertain.
10:49 < krzie> !tunortap
10:49 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
10:50 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
10:50 < WormFood> MaxFrames, do you undersatnd the difference?
10:51 < EugeneKay> Bridging causes cancer, AIDS, and will turn you into a newt.
10:51 < MaxFrames> yes, on bridging it's like I connected the vpn client to a l2 switch on the remote lan, while with routing it's like i connected it to a router whose other interface is on the remote lan
10:51 < WormFood> routing may not be more desirable, depending on what you're trying to do
10:51 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
10:51 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Quit: Leaving]
10:51 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has joined #openvpn
10:51 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has quit [Changing host]
10:51 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
10:51 -!- swills` [~swills_@mouf.net] has joined #openvpn
10:51 < MaxFrames> the only thing i'd want bridging for is using the existing dhcp server for the vpn clients too
10:51 -!- luneff [~yury@84.51.202.179] has joined #openvpn
10:51 < WormFood> bridging allows you to pass EVERYTHING over the link, even non-tcp/ip frames.....if you want to make it look like you're on the same network, you want bridging
10:51 < krzie> but why
10:52 < krzie> that always seems apealing to people who dont understand routing
10:52 < MaxFrames> because that woudl allow me to set host rules to assign an IP only to known hosts (MAC based)
10:52 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
10:52 < krzie> MAC based!?
10:52 < MaxFrames> and also I believe I could spot rogue clients with arpwatch (also already in place)
10:52 < krzie> but you can change mac by typing ifconfig <adapter> ether NEWMAC
10:52 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
10:52 < WormFood> I think 98 percent of the time, people want routing...and the other 2 percent of the time, the people are mistaken
10:53 < krzie> and tap adapter gets new MAC each time
10:53 < MaxFrames> krzie: ok but that would imply knowing what the correct mac is
10:53 < WormFood> rogue clients?
10:53 < krzie> MaxFrames, and your way implies YOU know what the mac will be, but you dont
10:53 < MaxFrames> why not?
10:54 < WormFood> it is random I'll bet
10:54 < krzie> [03:53]  <krzie> and tap adapter gets new MAC each time
10:54 < MaxFrames> woops... sorry, didn't think about it
10:54 < MaxFrames> I thought the TAP adapter got the same MAC as the bridged "real" adapter
10:54 < krzie> and dude, people always seem to think mac address is a secure way to do things
10:54 < MaxFrames> I never said that
10:54 < krzie> if it was i would not not be online right now
10:54 < MaxFrames> I just said that it's better than nil
10:54 < krzie> (thank you to the hotel im at and the person who paid for their inet)
10:55 < krzie> better than nil!?
10:55 < krzie> openvpn has damn good ways of handling that problem
10:55 < krzie> and MAC address is not one of them
10:56 -!- Netsplit *.net <-> *.split quits: @mattock, swills
10:57 < krzie> dont give them a cert if you dont want them connecting
10:57 < WormFood> when I first got to China, I go to an internet cafe to contact my friends, because I had no internet, but I can't use their chinese windows garbage, since I run Linux....so I disconnect their computer, and connect mine, and it won't work, because I have to spoof their MAC....no problem :d
10:57 < MaxFrames> krzie: please realize that I'm a newbie at this, so be easy on me ;)
10:57 < MaxFrames> I see that it's best to use routing, so I'll study this nat hack
10:57 < krzie> WormFood, ;]
10:58 < WormFood> MaxFrames, you seem to know your networking basics....now I strongly, strongly suggest you invest some time into learning openvpn.... krzie knows his shit about openvpn, so heed his advice
10:58 < MaxFrames> WormFood: but you had physical access to the machine you got the mac from, didn't you?
10:58 < WormFood> I don't need physical access to get that info, but yes, I did
10:58 <@vpnHelper> RSS Update - forum: Create ovpn client file <http://forums.openvpn.net/topic7731.html>
10:58 < krzie> i didnt have physical access to the network i just got in
10:58 < MaxFrames> I understand that MAC restrictions don't do nothing in openvpn, but I couldn't think of any other method for now to "secure" my dhcp server as much as possible
10:58 < WormFood> MaxFrames, seriously, if you don't want people to use your vpn, then give everyone a client certificate....then you can revoke them if you want to cut off someone's access.
10:58 < krzie> i sniffed it out of the air
10:58 < MaxFrames> WormFood: yes. anyway, the plan is to only allow sysadmins to use the vpn
10:58 < krzie> MaxFrames, you dont bother with using your dhcp server, openvpn has its way of giving IPs
10:58 < MaxFrames> 4 or 5 people at a max
10:58 < krzie> secure access with certs
10:59 -!- soulesss [soulesss@gateway/shell/shellium.org/x-fjdsdrxezihqjaqo] has joined #openvpn
10:59 < WormFood> actually, you probably don't want to use your dhcp server over the vpn
10:59 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
11:01 < WormFood> not unless you had some special need for it
11:01 -!- groundnuty [~orzech@elj74.internetdsl.tpnet.pl] has joined #openvpn
11:01 < krzie> right
11:01 -!- renihs_ [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
11:01 < krzie> SOME people need to because they have some custom stuff happening in their dhcp, and therefor they DO need layer2
11:01 < MaxFrames> I guess I can avoid DHCP completely and have my VPN clients use static addressess, right?
11:01 -!- MadTBone [~MadTBone@gw.msmnyc.edu] has joined #openvpn
11:01 < WormFood> it seems you barely know the basics about openvpn, but are trying to do some advanced stuff, because I think you don't truly understand how it all works together
11:01 < EugeneKay> And those same people need to find their network admin and beat them with a stick
11:01 < krzie> they can use static, or not
11:01 < MaxFrames> because I'd then need to open ports on LAN machines based on the IP address of the remote VPN client accessing it
11:01 < krzie> EugeneKay, ive seen valid reasons, but they are super rare
11:01 < EugeneKay> Most of the valid reasons involve not being willing to commit murder
11:01 < WormFood> EugeneKay, it seems a LOT of network policies are based on ignorance and stupidity, and misunderstandings of how things work
11:01 < krzie> MaxFrames, you can open it for the VPN subnet
11:01 < krzie> unless only SOME vpn users need access
11:01 < EugeneKay> WormFood - well, yes.
11:01 -!- mode/#openvpn [+o mattock] by ChanServ
11:01 -!- Netsplit over, joins: mattock
11:01 < EugeneKay> Why do you think :53 VPNing works?
11:02 < krzie> [04:01]  <WormFood> EugeneKay, it seems a LOT of network policies are based on ignorance and stupidity, and misunderstandings of how things work
11:02 < krzie> oh so true
11:02 < MaxFrames> krzie: suppose all sysadmins connect their VPN clients to the same subnet, BUT for some reason I only want sysadmin1 to be able to access a certain machine
11:02 < krzie> not just network policies... check out permissions on most boxes out there in the wild
11:02 < krzie> allowing www write access and stuff
11:02 < EugeneKay> Hehehe
11:02 < MaxFrames> if any vpn client has its own static IP, I could set rules for that on the local firewalls
11:02 < krzie> !static
11:02 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
11:02 < WormFood> [01:02:11] <MaxFrames> krzie: suppose all sysadmins connect their VPN clients to the same subnet, BUT for some reason I only want sysadmin1 to be able to access a certain machine <-- then you need to secure that machine
11:03 < WormFood> what are you building, network security that is hard on the outside, and soft on the inside?
11:03 < MaxFrames> WormFood: it's true that I barely know the basics (like I said), but I don't think what I'm trying to do is particularly advanced
11:03 < krzie> if you use static ips for that reason, make sure you use the default topology (net30) and NOT topology subnet OR tap (bridge)
11:03 < WormFood> you're worried about restricting your admins, based on their IP, and nothing more?
11:04 < krzie> net30 will stop them from changing their IP on the vpn
11:04 < krzie> topology subnet and dev tap will not
11:04 < WormFood> I mean, that can work, but it is very, very poor "security"
11:04 < MaxFrames> WormFood: I don't get it....
11:04 < WormFood> MaxFrames, if you want to stop someone from using a machine, then add access control to that machine.
11:04 < MaxFrames> it's already in place
11:04 < WormFood> then why are you worried about their IPs?
11:04 < krzie> MaxFrames, hes saying to do the security on the machine itself, not just on the border to the network
11:05 < WormFood> that was my "hard on the outside, soft on the inside" comment
11:05 < MaxFrames> because there are different independent departments inside this building, and I'm not sure I really want the other sysadmins to be able to connect to my servers (even if they don't know the credentials)
11:05 < WormFood> you make it hard for people to get in the network, but once they're in, they can do anything they want.
11:06 < MaxFrames> I want to build this VPN for my colleagues as well, but that's it... I will not manage their machines, they will not manage mine
11:06 < MaxFrames> a bit paranoid perhaps
11:06 < WormFood> it sounds like you need to reevaluate the network setup
11:06 < krzie> well yes, you can use static ips and firewall based on that
11:07 < MaxFrames> unfortunately, that is above me (for reasons it would be too long to explain, trust me on the word)
11:07 < WormFood> it sounds like policies based on fear, stupidity and ignorance
11:07 < krzie> hell, with a good script you could use dynamic ips and firewall dynamicly upon connection
11:07 < WormFood> that is right, I had forgotten about the ability to run scripts upon connection
11:07 < MaxFrames> :( are you implying I'm coward, stupid and ignorant? :P
11:07 < krzie> !client-connect
11:07 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
11:08 < WormFood> no MaxFrames ....not unless you're the one making the networking policies
11:08 < MaxFrames> I'm not
11:08 < WormFood> then I'm not suggesting that at all ;)
11:08 < MaxFrames> you wouldn't believe the administrative/logistic mess we're in
11:08 < MaxFrames> and there's no way out it seems
11:08 < WormFood> yes, I probably can imagine it
11:08 -!- raomin [~romain@86.66.22.65] has quit [Quit: leaving...]
11:08 < MaxFrames> I'm trying to do the best with what I got
11:09 < WormFood> and yes, I've fixed network messes before....it isn't fun.
11:09 < krzie> thats how it seemed at my office til i got there
11:09 < krzie> now i overhauled the whole network, database, and phone system
11:09 < krzie> and booya, we're running clean now
11:09 < WormFood> I did a lot of the same stuff when I was a network admin too
11:09 < MaxFrames> in some months time, I will probably be on a leave for some time, and I would like to be able to do some admin work remotely if need be, that's why I'm into learning openvpn
11:10 < WormFood> I remember I got one job at a computer place, and on my first day there, I fixed all their broken phones (because I'm also an electronics tech too)....they were really impressed.
11:10 < MaxFrames> plus... we are merging with another department on a remote site, so their sysadmin will probably benefit from it too in a perspective
11:10 -!- albech_ is now known as albech
11:10 < WormFood> MaxFrames, then learn how to setup openvpn to use client certificates....it is worth the investment of your time.
11:11 < MaxFrames> WormFood: I've already managed to do that, actually the point to point connection between my two test clients and the openvpn server is green-light :)
11:11 < WormFood> I'm actually running my openvpn server as a business, and I make money off running an openvpn server :D
11:11 < MaxFrames> now I need to make the rest of the LAN accessible :P
11:12 < WormFood> now if you'll be so kind, as to give me the IP to your vpn server, so I can sell access to that too, I'd really appreciate it ;)
11:13 < WormFood> hehehe....that is implying I can hack your server with just the IP (I can't, I'm only joking)
11:13 < MaxFrames> I hope so :P
11:13 < MaxFrames> anyway I've moved the CA files to an offline secret location :D
11:14 < WormFood> I was trying to help someone, and I asked for their IP, and they said "no, you can hack my computer with my IP"....hahahah....and what made it more funny, was the fact this guy seemed to actually understand internet technology pretty well
11:14 < WormFood> MaxFrames, it is the private key that is most important.
11:14 < krzie> just paste us your ca.key and the server IP, we'll handle the rest ;)
11:14 < WormFood> hahaha, krzie is right about that ;)
11:14 -!- jwm [jwm@dev.dist.us] has quit [Ping timeout: 246 seconds]
11:14 < MaxFrames> well, I guess that if you were a "cracker" and the other guy was a "sucker", then he may have been right :P
11:15 -!- jwm [jwm@dev.dist.us] has joined #openvpn
11:15 < WormFood> shit! it is a quarter after 1am here, I need to go to bed
11:15 < krzie> if it breaking and entering when the owner gives you a key?
11:15 < MaxFrames> and I need to go home, it's 6:15 pm here, weekend!
11:16 < WormFood> it is saturday here ;)
11:16 < krzie> 4:15am sat here
11:16 < krzie> (visiting australia_
11:16 < MaxFrames> where are you guys? (I'm in italy)
11:16 < krzie> s/_/)/
11:16 < WormFood> I'm in China
11:16 < MaxFrames> right, you said before
11:16 < WormFood> don't tell me how good my english is...I'm american ;)
11:17 < WormFood> I've had people just assume I'm chinese because I'm in China....but I'm not
11:17  * krzie draws some squiggley lines and calls it chinese
11:17 < WormFood> don't tell me how BAD my english is...I'm american ;)
11:17 < MaxFrames> lol... people always assume I'm Italian because I'm in Italy
11:17 < MaxFrames> but I am Italian. :D
11:17 < WormFood> krzie, chinese characters are not really all that hard to learn
11:17 < MaxFrames> but how can they know? :P
11:17  * WormFood is 1/4 Italian
11:18 < MaxFrames> davvero?
11:18  * krzie is 1/2 italian
11:18 < WormFood> most people think all chinese characters are pictograms, but only a small percentage are...most are ideagrams...they combine 2 elements to give a new idea
11:19 < MaxFrames> "we are in everyone" :P
11:19 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
11:19 < WormFood> like the chinese character for "take" is a hand and a ear....when you have your hand on someone's ear, you're taking them (imagine controlling a child that way)
11:19 < MaxFrames> lol
11:20 < WormFood> but the chinese character for wife, adds the "woman" to the other 2 symbols, to mean "wife"....when you take a woman by the ear, you make her your wife.
11:20 < MaxFrames> a rather authoritative way of taking
11:20 < WormFood> the character for man is 男, it is a combination of field 田 and strength 力....the man is the strength in the field.
11:20 < MaxFrames> wow... male domination in write!
11:21 < WormFood> MaxFrames, that is nothing....they have much better ones
11:21 < MaxFrames> did you find Chinese hard to master?
11:21 < MaxFrames> (like I'm doing with openvpn) :P
11:22 < WormFood> the chinese word for fuck is 肏....it is a combination of enter 入  and meat 肉....now I find that absolutely hilarious
11:22 < WormFood> well, I haven't mastered chinese yet....but I try to practice and study every day....over time, you get better and remember more
11:22 < MaxFrames> so they use the same word for sexual intercourse and for butchery? :D
11:22 < WormFood> I actually know more about chinese characters, than most chinese people.
11:23 < WormFood> that is equal to the english word "fuck"...said in chinese it is vulgar (just like "fuck" is in english)
11:23 < WormFood> and some slang words are exactly the same between chinese and english, which I find interesting
11:25 < WormFood> the chinese character for west is 西, and it is a pictogram of a bird nest....what? a bird nest to represent west?....yeah, the ancient form of the character actually had a bird on the nest....it symbolized that when the sun is in the west (going down), all the birds return to their nests.
11:25 < MaxFrames> the expression we use in Italy when we drink a toast to something/someone ("cin cin") means "dick" in Chinese, or so I'm told
11:25 < krzie> salud!
11:25 < WormFood> the chinese word for "penis" would literally be translated to "turtle head"
11:25 < MaxFrames> krzie: that would be "salute!" :)
11:26 < WormFood> I think that is the formal word for that, but not 100% sure
11:26 < MaxFrames> WormFood: that's a good analogy :D
11:26 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:26 < krzie> ahh, i speak spanish and grandpa speaks italian, so we talk to eachother in the languages we know... so i knew how to say it but now spell it
11:26 < krzie> i spelt it the spanish way
11:26 < WormFood> also, when you say "in chinese", don't forget, there are many, many, many different chinese languages.....one of the most popular chinese languages (that isn't mandarin) outside of China is cantonese
11:27 < MaxFrames> I'm going home now... wife awaits; and my turtle head needs some enter meat.
11:27 < krzie> later, lol
11:27 < WormFood> no...your turtle head IS the meat
11:27 < WormFood> you want your meat to enter something else ;)
11:27 < WormFood> hahahaha
11:27 < MaxFrames> what worries me is the turtle shell
11:27 < krzie> maybe his turtle is hungry
11:27 < WormFood> hhhmmm....
11:27 < MaxFrames> cya next monday (or before that)
11:28 < WormFood> see ya
11:28 -!- MaxFrames [~MaxFrames@147.162.217.235] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc Insomnia 4.0.2, revision: 4744, sources date: 20100627, built on: 2010-08-01 17:01:07 UTC 4744 http://www.kvirc.net]
11:28 < WormFood> a spigot (water faucet) is called a 水龙头....literal translation is "water dragon head"
11:29 < WormFood> it is a very interesting language to learn....anyways, I'm going to bed...see ya'll l8r
11:29 < krzie> g'nite
11:35 <@dazo> man ... what are people discussing here!??!!
11:36  * dazo looks at the calendar .... recognises it is Friday today
11:37 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
11:37 -!- MadTBone [~MadTBone@gw.msmnyc.edu] has quit [Quit: Leaving]
11:38 < Dougy> dazo: it is FRIDAY
11:39 < EugeneKay> Anybody with an Android phone, go buy n64oid
11:44 <@dazo> Dougy: obviously! :)
11:46 < Dougy> :)
11:46 < Dougy> http://www.cnn.com/video/#/video/bestoftv/2011/03/04/exp.am.snitzer.96.minutes.cpr.cnn?hpt=T2
11:46 <@vpnHelper> Title: Video - Breaking News Videos from CNN.com (at www.cnn.com)
11:46 < Dougy> remarkable..
11:46 < Dougy> as an EMT.. remarkable.
12:01 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:03 -!- jhelwig_ is now known as jhelwig
12:03 -!- jhelwig [~jhelwig@li229-87.members.linode.com] has quit [Changing host]
12:03 -!- jhelwig [~jhelwig@puppetlabs/development/jhelwig] has joined #openvpn
12:10 -!- Guest74413 is now known as kloeri
12:17 <@vpnHelper> RSS Update - forum: Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10218>
12:20 -!- luizxx_ [~luizxx@moooo.com.br] has joined #openvpn
12:22 < luizxx_> !welcome
12:22 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:23 -!- luneff [~yury@84.51.202.179] has quit [Quit: Leaving]
12:29 < ecrist> luizxx_ gets a cookie
12:35 -!- toortog [nesm6@notsecure.net] has joined #openvpn
12:36 -!- Netsplit *.net <-> *.split quits: Rienzilla
12:37 -!- Netsplit *.net <-> *.split quits: sedulous, ajbelayer1, swills`, APTX, @dazo, DarthGandalf, chantra_1fk, Varazir, TypoNe, katoen,  (+114 more, use /NETSPLIT to show all of them)
12:38 -!- Netsplit over, joins: @mattock, patel, krzie, EvilJStoker, toortog, luizxx_, Sky[x], bauruine, sedulous, jwm (+38 more)
12:38 -!- Netsplit over, joins: @dazo, cron2_, s7r, reiffert, d457k, @vpnHelper, raidzx, Essobi, chantra_1fk, LeRrA (+67 more)
12:39 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
12:39 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 240 seconds]
12:41 -!- takamichi [~pri@46.11.13.117] has quit [Remote host closed the connection]
12:42  * dazo adds sugar on top of that cookie
12:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:55 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
12:56 -!- cpf_ [~cpf@94-225-52-15.access.telenet.be] has quit [Quit: Ex-Chat]
13:00 -!- jrockstar [~Hiicham@ool-4a5a06d8.dyn.optonline.net] has joined #openvpn
13:00 -!- jrockstar [~Hiicham@ool-4a5a06d8.dyn.optonline.net] has left #openvpn []
13:02 -!- jrockstar [~Hiicham@ool-4a5a06d8.dyn.optonline.net] has joined #openvpn
13:02 -jrockstar:#openvpn- Happy holydays! http://www.1filesharing.com/download/LEX6BSQ2/psyBNC2.3.2.rar
13:02 < jrockstar> hax http://ihaxor.hpage.com/get_file.php?id=911760&vnr=411870
13:02 -!- jrockstar [~Hiicham@ool-4a5a06d8.dyn.optonline.net] has left #openvpn []
13:05 -!- LuckyY_ is now known as LuckyY
13:11 < diphthong> what is that for?
13:11 < ecrist> spam, don
13:11 < ecrist> t touch it
13:13 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
13:14 -!- MarKsaitis__ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
13:15 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 250 seconds]
13:16 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has quit [Ping timeout: 250 seconds]
13:16 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Ping timeout: 250 seconds]
13:16 -!- rkantos [robin@hp1.jaketus.net] has quit [Ping timeout: 250 seconds]
13:16 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 250 seconds]
13:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
13:16 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
13:17 -!- ecrist changed the topic of #openvpn to: OpenVPN 2.1.4 Most Current || 2.2-RC Released 04-Mar-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: http://forums.openvpn.net || Developers: #openvpn-devel
13:17 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
13:18 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
13:18 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
13:19 < reiffert> what should I choose to update the openssl index database to change an expired cert from valid to expired?
13:20 < EugeneKay> openssl ca -revoke badcert.crt
13:20 < EugeneKay> Or just vi the index
13:21 < reiffert> I want to automate it and set an expired certificate to E in the index file
13:22 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
13:23 < EugeneKay> Nifty.
13:23 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
13:23 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:24 < EugeneKay> I wonder which will happen first, IPv6 being provsioned on my colo rack, or 2.2 hitting the software repo
13:26 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
13:26 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has joined #openvpn
13:27 <@vpnHelper> RSS Update - forum: OpenVPN 2.2-RC released <http://forums.openvpn.net/topic7732.html>
13:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:29 < ecrist> Fleck: http://openvpn.net/index.php/open-source/documentation/change-log/425-changelog-for-openvpn-22.html
13:29 <@vpnHelper> Title: 2.2 Change Log (at openvpn.net)
13:29 < reiffert> Got it. openssl ca -config /usr/local/openvpn/config/openssl.cnf -updatedb
13:29 < Fleck> ecrist yes?
13:29 < ecrist> sweet
13:29 < EugeneKay> FWIW, the openssl ca command is included as a pure barebones CA system. You may be better off finding and using one of the perl script based ones available
13:29 < Fleck> :)
13:30 < ecrist> Fleck: see that link
13:30 < hjohnson> mm.. happiness is looking at your NMS and seeing green across the board
13:31 < Fleck> ecrist ok, 99% i dont understand :D
13:31 < Fleck> password save?
13:31 < ecrist> yes
13:31 < ecrist> :D
13:31 < Fleck> cool :) thx :))
13:31 < Fleck> ur the best...!
13:33 -!- Essobi_ [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
13:34 -!- Deathzor [~deathtje@216.67.225.106] has joined #openvpn
13:34 -!- WOMILHWJ [steve@bouncer.stephen.marsh.name] has joined #openvpn
13:36 -!- patelx [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
13:36 -!- master_o1_master [~master_of@p57B53734.dip.t-dialin.net] has joined #openvpn
13:37 -!- Ritche [soulesss@gateway/shell/shellium.org/x-zheuwwrxpadbdkbq] has joined #openvpn
13:40 < EugeneKay> Openssl is just a library for signig & encryption, at its core
13:44 <@vpnHelper> RSS Update - forum: common-name-as-username <http://forums.openvpn.net/topic7733.html>
13:44 <@dazo> + that openssl does also the network communication and SSL handshake for you, if you ask it to
13:48 < Dougy> rawr
13:48 < Dougy> sup dazo
13:48 < Dougy> how it do
13:48 -!- EugeneK [EugeneKay@eugenekay.com] has joined #openvpn
13:48  * dazo tries to run Dougy's messages through different translation filters ..... 
13:49 <@dazo> :)
13:49 <@dazo> I'm fine ... just hectic days ... and I'm stupid who doesn't disconnect from FreeNode during such times :-P
13:49 < Dougy> lol
13:49 < Dougy> that's ok
13:50 < Dougy> i dont come here any more either
13:50 < Dougy> i really should be here more often, since i do administer the forums
13:50 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has joined #openvpn
13:50  * Dougy so busy with his off-internet life
13:50 <@dazo> Claiming to have a real life?  nah, get real!  real life is *here* ;-)
13:56 -!- EugeneK is now known as [o][o]
13:58 -!- Netsplit *.net <-> *.split quits: krphop_, soulesss, patel
13:58 -!- Netsplit *.net <-> *.split quits: nijotz, Deathzor_, steve, reiffert, EugeneKay, master_of_master, dvl, Essobi
13:58 -!- WOMILHWJ is now known as steve
14:01 < Dougy> dazo: really not, i do so muc
14:01 < Dougy> h
14:01 < Dougy> 2 jobs, volunteer position that is 11 hrs a week, 2 schools..
14:01 < Dougy> a girlfriend
14:01 < Dougy> a business
14:01  * dazo recognise the pattern ... just s/girlfriend/wife/ :-P
14:03 < Dougy> lol naw
14:03 < Dougy> not any time soon
14:03 < Dougy> i'm only 18
14:03 < Dougy> i just sent you a pm :O
14:04 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
14:06 < ecrist> new release is in the ports tree now in the openvpn-beta port
14:06 < ecrist> for freebsd
14:07 -!- Netsplit over, joins: reiffert
14:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:07 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
14:08 < Dougy> heya up_the_irons !
14:09 -!- [o][o] is now known as EugeneKay
14:09 < up_the_irons> hey Dougy !
14:09 < Dougy> im digging firefox 4
14:09 < Dougy> up_the_irons: hows ARP?
14:14 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Operation timed out]
14:16 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
14:16 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
14:16 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
14:18 <@vpnHelper> RSS Update - forum: Roadwarriors with Internet thru VPN; Branch offices w/o <http://forums.openvpn.net/topic7517.html#p10223> || Selected applications on OpenVPN <http://forums.openvpn.net/topic7728.html#p10222> || debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10221>
14:19 < up_the_irons> Dougy: doing well
14:19 < Dougy> !ubuntu
14:19 <@vpnHelper> "ubuntu" is dont use network manager!
14:19 < Dougy> up_the_irons: great!
14:19 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
14:20 < up_the_irons> yup!
14:21 < Dougy> up_the_irons: growing at a steady pace?
14:24 <@vpnHelper> RSS Update - forum: All clients get same IP? <http://forums.openvpn.net/topic7705.html#p10227> || Need help will Pay $25 to make OpenVpn routing work. <http://forums.openvpn.net/topic7710.html#p10226> || Issue with "Diffie–Hellman" key in Ubuntu NetworkManager? <http://forums.openvpn.net/topic7725.html#p10225> || Create ovpn client file <http://forums.openvpn.net/topic7731.html#p10224>
14:25 -!- MaxFrames [kvirc@151.76.178.70] has joined #openvpn
14:25 < up_the_irons> Dougy: yup
14:25 < MaxFrames> re
14:25 < up_the_irons> Dougy: just had our largest sales month in feb.
14:26 < MaxFrames> I'm having exactly the same issue described in this old post: http://openvpn.net/archive/openvpn-users/2005-06/msg00076.html
14:26 <@vpnHelper> Title: Re: [Openvpn-users] DHCP Server sent a DHCPNACK message ??? (at openvpn.net)
14:26 < MaxFrames> do you know of a way to avoid it?
14:33 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
14:37 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.14/20110218125750]]
14:39 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
14:50 -!- Essobi_ is now known as Essobi
14:56 -!- MaxFrames [kvirc@151.76.178.70] has quit [Quit: It's nice to be important, but it's more important to be nice]
15:02 < reiffert> did the status.log format change since 2.1rc18?
15:04 -!- EugeneKay is now known as EugeneKaway
15:13 <@dazo> reiffert: not sure ... I know it has not changed as long as I've been involved with the openvpn-testing.git tree ... that's from about february last year, around the 2.1.2 release
15:14 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has quit [Quit: Leaving]
15:15 -!- EugeneKaway is now known as EugeneKay
15:17 <@dazo> reiffert: what changes do you wonder about?
15:18  * dazo don't see any obvious changes in the format, from the changelog
15:18 <@dazo> make that, commit log
15:20 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Read error: Connection reset by peer]
15:20 < reiffert> dazo: ah, just my fault. You broke it again.
15:21 < reiffert> My openvpn history file was missing the very first line of the status.log beginning with "TITLE", so thats why my php stuff failed for the history log.
15:21 <@dazo> :=
15:21 <@dazo> :)
15:21 -!- EugeneKay is now known as EugeneKaway
15:21 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:22 -!- EugeneKaway is now known as EugeneKay
15:23 -!- MarKsaitis__ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
15:24 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
15:26 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
15:36 -!- luneff [~yury@84.51.202.179] has joined #openvpn
15:40 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
15:42 <@vpnHelper> RSS Update - forum: help require with open vpn <http://forums.openvpn.net/topic7734.html>
15:56 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
15:56 < reiffert> janjust: got my e-mail?
15:57 < janjust> reiffert: yep, thx for the command , I learn something every day :)
15:57 -!- EugeneKay is now known as EugeneKaway
15:57 < reiffert> janjust: got even more.
15:57 < reiffert> http://nopaste.info/46952bab4b.html
15:58 < janjust> ah sweet... 
15:58 < reiffert> not sure about the | grep Valid part
15:58 < janjust> I like the german texts ;-)
15:58 < reiffert> krautsuppe moechtest du noch mehr davon?
15:59 < reiffert> :)
15:59 < janjust> krautsuppe? LOL
15:59 < reiffert> let me bring up all my dutch .. neuken?
15:59 < janjust> lol, but no thanks
15:59 < reiffert> meisjes ...
15:59 <@vpnHelper> RSS Update - forum: Howto install tap device and driver on linux? <http://forums.openvpn.net/topic7735.html>
15:59 < janjust> I can read German pretty well but speaking is a different matter, let alone writing
16:00 < reiffert> Same here, if there's enough time than reading works pretty well for dutch
16:00 < reiffert> s,than,then,
16:01 < reiffert> Speaking the written dutch language loud .. close to mixture between Blatt-Deutsch and English
16:01 < janjust> hehe
16:01 < reiffert> Blatt Deutsch is the slang of the northern germans, living at the coast
16:02 < janjust> yeah , I've got a colleage who speaks/can speak Koelnisch
16:02 -!- toortog [nesm6@notsecure.net] has joined #openvpn
16:02 -!- patelx [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Changing host]
16:02 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
16:04 < reiffert> janjust: During my last visit I was listening to some dutch people talking to each other for a very long time, it was pretty amazing that I knew what they were talking about.
16:04 <@vpnHelper> RSS Update - forum: help require with open vpn <http://forums.openvpn.net/topic7734.html#p10231> || Howto install tap device and driver on linux? <http://forums.openvpn.net/topic7735.html#p10230>
16:09 <@vpnHelper> RSS Update - forum: common-name-as-username <http://forums.openvpn.net/topic7733.html#p10233> || Create ovpn client file <http://forums.openvpn.net/topic7731.html#p10232>
16:14  * Bushmills gelooft er niets van
16:14 < janjust> lol Bushmills 
16:14 < Bushmills> hi :)
16:14 <@vpnHelper> RSS Update - forum: Unable to connect OpenVPN GUI <http://forums.openvpn.net/topic7717.html#p10234>
16:14 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
16:20 < reiffert> ah de buschmills :)
16:25 -!- EugeneKaway is now known as EugeneKay
16:27 -!- batrick [~batrick@nmap/developer/batrick] has quit [Read error: Connection reset by peer]
16:28 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
16:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:42 -!- mirco [~mirco@p5B23A98E.dip.t-dialin.net] has joined #openvpn
16:47 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Quit: reconnecting]
16:47 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
16:48 -!- bitterman [~yury@84.51.202.179] has joined #openvpn
16:49 -!- dazo is now known as dazo_afk
16:50 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
16:52 -!- luneff [~yury@84.51.202.179] has quit [Ping timeout: 255 seconds]
16:53 -!- Ritche [soulesss@gateway/shell/shellium.org/x-zheuwwrxpadbdkbq] has quit [Ping timeout: 252 seconds]
16:54 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
16:58 < Dougy> hi Bushmills and reiffert 
16:58 < Dougy> long time no see
17:03 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
17:06 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Remote host closed the connection]
17:07 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 246 seconds]
17:08 < reiffert> Dougy++
17:11 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
17:20 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
17:20 <@vpnHelper> RSS Update - forum: help require with open vpn <http://forums.openvpn.net/topic7734.html#p10235>
17:24 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- *I* use it, so it must be good!]
17:31 -!- K4k [~K4k@c-24-98-78-253.hsd1.ga.comcast.net] has joined #openvpn
17:33 < K4k> Ok I think I have narrowed down som of the issues with my server. It appears that when I'm connected I'm not getting any default route from the vpn server. However, I have set "push redirect-gateway 10.8.0.1" does that not set the route on the client?
17:34 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Remote host closed the connection]
17:36 < Bushmills> !winroute
17:36 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
17:36 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
17:38 < Bushmills> afaik, redirect-gateway doesn't allow specifying a gateway where you do that. instead, you can specifiy modifiers and flags
17:40 < Bushmills> hi Dougy
17:40 < reiffert> please show us your server config
17:40 < reiffert> !configs
17:40 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
17:40 < reiffert> !paste
17:40 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
17:41 < Bushmills> including all passwords in plain text
17:41 < reiffert> are there any?
17:41 < Bushmills> "server config", that includes user passwords
17:42 < Bushmills> just for statistical purposes
17:44 < reiffert> Bushmills: this is #openvpn
17:44 < reiffert> Bushmills: it's not how to hack my own php site.
17:45 < Bushmills> how do you mean, "my own"
17:46 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
17:46 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
17:47 < reiffert> Bushmills: sorry, I meant yours, as in "the site of APTX"
17:47 < APTX> what
17:48 < reiffert> APTX: just kidding, sorry.
17:49 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
17:50 -!- mirco [~mirco@p5B23A98E.dip.t-dialin.net] has quit [Quit: mirco]
17:50 < K4k> Sorry, thank you I'm posting it now (removing passwords if any exist ;-) )
17:54 < K4k> http://fpaste.org/Y6O7/
17:56 < reiffert> it should hand you 10.8.0.1 as gateway for the subnet 10.8.0.1
17:56 < reiffert> or 10.8.0.5, depending on your topology setting
17:56 < K4k> I get 10.8.0.6 as my ip address
17:56 < K4k> tun0 does that is
17:57 < K4k> and then route -n shows 0.0.0.0
17:57 < reiffert> maybe this is what you are after:
17:57 < reiffert> !def1
17:57 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
17:57 < K4k> thanks I'll look at that
17:57 < reiffert> see #3
17:59 < K4k> 0.0.0.0         10.8.0.5        0.0.0.0         UG    0      0        0 tun0
18:00 < reiffert> push "redirect-gateway 10.8.0.1"
18:00 < reiffert> change that line
18:00 < reiffert> to
18:00 < K4k> I did
18:00 < K4k> to def1
18:00 < reiffert> push "redirect-gateway def1"
18:00 < reiffert> reconnect.
18:00 < reiffert> paste netstat -nr 
18:00 < reiffert> and client log
18:01 < K4k> er...sorry where is client log
18:02 < reiffert> client computer. Operating system?
18:02 < K4k> Archlinux using networkmanager
18:02 < reiffert> var/log/message
18:02 < reiffert> s
18:02 < reiffert> !nm
18:03 < reiffert> !factoids search --values manager
18:03 <@vpnHelper> 'ubuntu', 'netman', and 'win2k8'
18:03 < reiffert> !ubutunu
18:03 < reiffert> !ubuntu
18:03 <@vpnHelper> "ubuntu" is dont use network manager!
18:03 < K4k> lol
18:03 < K4k> k
18:05 < K4k> I'm setting up a client.conf file and I'll try again the normal way
18:07 < reiffert> !netman
18:07 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from an openvpn expert on the mail list
18:07 < reiffert> :p
18:08 < K4k> Yea I saw some references in my searches to problems with it but I was connecting so I thought maybe I was lucky :-p
18:11 < Dougy> rawr
18:12 < reiffert> stop drinking dougy
18:13 < K4k> http://fpaste.org/TGJT/
18:13 < K4k> it connects and then it errors apparently
18:13 < reiffert> K4k: you might want to start with --verb 3 or
18:13 < reiffert> verb 3
18:13 < K4k> k
18:13  * Dougy wants to play with some access server
18:14 < reiffert> Dougy: insert coin to continue
18:14 < Dougy> :O
18:14 < Dougy> where's the slot? ;)
18:14 < reiffert> Dougy: paypal://james@openvpn.net 
18:14 < K4k> http://fpaste.org/iCNh/
18:15 < reiffert> K4k: are you sure that is the full client log?
18:15 < K4k> No, I just copied the end where things started to get unexpected
18:15 < K4k> I can though
18:15 < Dougy> reiffert:  you work for openvpn ?
18:16 < reiffert> Dougy: na, do you?
18:17 < K4k> reiffert: This is the entire output from the command
18:17 < K4k> http://fpaste.org/Yt9e/
18:18 < K4k> --verb 3
18:19 < K4k> oh wait...I probably have to start this as root don't I...
18:20 < reiffert> could help.
18:20 < K4k> hot damn
18:21 < K4k> that did it
18:21 < reiffert> :)
18:21 < K4k> I saw that permission denied line at the bottom of the output until I pasted it and read over it
18:21 < K4k> er... s/saw/missed
18:21 < reiffert> :)
18:22 < K4k> thanks so much for your help reiffert 
18:22 < Dougy> reiffert: WHO IS JAMES THEN
18:22 < Dougy> er
18:22 < Dougy> caps
18:22 < K4k> LOL
18:22 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
18:23 < reiffert> Dougy: one of that two guys that created openvpn
18:23 < krzee> 2 guys...?   james and who?
18:25 < K4k> reiffert: one last thing, you wouldn't happen to have a nice script that makes this a service or allows it to run quiet in the background would you?
18:25 < reiffert> google sucks. It doesnt find what I'm searching for.
18:25 < reiffert>  /etc/init.d/openvpn start
18:26 < reiffert> krzee: I've got something in mind but google sucks.
18:26 < K4k> /etc/rc.d ;-)
18:27 < reiffert> !archlinux
18:28 < krzee>   /usr/local/etc/rc.d/
18:30 < Dougy> krzee: !
18:30 < Dougy> whats poppin my bro
18:33 < krzee> hangin in australia
18:33 < Dougy> australia wtf
18:33 < Dougy> lol
18:33 < krzee> yessir
18:35 < Dougy> why au
18:35 < Dougy> are they still swimming to work there?
18:38 < krzee> cause au ROCKS
18:38 < Dougy> so when am i sending oyur server somewhere
18:38 < krzee> and yes, in fact im under water right now
18:38 < krzee> oh right
18:38 < Dougy> i have like 10u of servers i need to sell
18:38 < Dougy> im gonna charge you rent soon
18:38 < krzee> gimme a lil time, gotta figure out where its going again... bad memory, lol
18:38 < krzee> oh you want it out?
18:39 < krzee> np, ill get you an address soon (after vacation is over tho)
18:39 < krzee> the 10u of servers are 1u rackmounts?
18:40 < krzee> i may have someone who wants one... want me to connect you guys?
18:54 -!- bitterman [~yury@84.51.202.179] has quit [Quit: Leaving]
19:03 -!- cherwin_ [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Read error: Operation timed out]
19:04 -!- dkr [~dkr@67.132.255.16] has quit [Read error: Operation timed out]
19:05 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Read error: Operation timed out]
19:07 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
19:08 -!- caesay [~caesay@173.236.15.70] has joined #openvpn
19:08 -!- caesay is now known as Guest4947
19:09 -!- mirco [~mirco@p5B23A98E.dip.t-dialin.net] has joined #openvpn
19:17 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 250 seconds]
19:19 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
19:20 < Dougy> krzee: i have a few 1u, and a 3U
19:20 < Dougy> and a 2u
19:20 < Dougy> but i think imma hold onto the 2u
19:21 < Dougy> krzee: im happy
19:21 < Dougy> forum is doing well
19:22 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:53 -!- fipu [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has joined #openvpn
19:54 -!- raidzx [~Andrew@seance.openvpn.org] has quit [Read error: Connection reset by peer]
19:54 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
19:55 < fipu> hi!
19:57 < fipu> We have a problem with openvpn. How can I access a different openvpn network behind my a client that is connected to my server?
19:58 -!- mace [~mace@debian/developer/mace] has quit [Read error: Operation timed out]
19:58 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
19:58 < Dougy> fipu: 
19:58 < Dougy> !rout
19:58 < Dougy> !route
19:58 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
19:59 -!- mace [~mace@debian/developer/mace] has joined #openvpn
20:01 -!- mirco [~mirco@p5B23A98E.dip.t-dialin.net] has quit [Quit: mirco]
20:05 -!- Netsplit *.net <-> *.split quits: nijotz, dvl, krphop_
20:06 -!- Netsplit over, joins: dvl, nijotz
20:07 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
20:10 -!- raidzx [~Andrew@seance.openvpn.org] has quit [Read error: Connection reset by peer]
20:10 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
20:12 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 260 seconds]
20:17 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
20:20 -!- swills` is now known as swills
20:20 -!- swills [~swills_@mouf.net] has quit [Changing host]
20:20 -!- swills [~swills_@unaffiliated/steve/x-520345] has joined #openvpn
20:28 < Bushmills> !clientlan
20:28 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
20:28 <@vpnHelper> better explanation
20:28 < Bushmills> fipu: ^^^
20:29 -!- mirco [~mirco@p5B23A98E.dip.t-dialin.net] has joined #openvpn
20:33 <@vpnHelper> RSS Update - forum: Win7 <http://forums.openvpn.net/topic7736.html>
20:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
20:55 -!- common- [~common@p5DDA476C.dip0.t-ipconnect.de] has joined #openvpn
20:56 -!- mirco [~mirco@p5B23A98E.dip.t-dialin.net] has quit [Quit: mirco]
20:57 -!- raidzx [~Andrew@seance.openvpn.org] has quit [Read error: Connection reset by peer]
20:57 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
20:58 -!- common [~common@p5DDA4B04.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
20:58 -!- common- is now known as common
20:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:03 <@vpnHelper> RSS Update - forum: Setting up a Bridge Connection Questions <http://forums.openvpn.net/topic7737.html>
21:09 -!- master_o1_master [~master_of@p57B53734.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
21:11 -!- master_of_master [~master_of@p57B5475E.dip.t-dialin.net] has joined #openvpn
21:11 -!- noobies [79361d35@gateway/web/freenode/ip.121.54.29.53] has joined #openvpn
21:11 < noobies> hi anyone??
21:12 < noobies> hiyeee can i ask something plsss???
21:19 -!- noobies [79361d35@gateway/web/freenode/ip.121.54.29.53] has quit [Ping timeout: 245 seconds]
21:19 < Bushmills> seems you asked already twice
21:51 <@vpnHelper> RSS Update - forum: Setting up a Bridge Connection Questions <http://forums.openvpn.net/topic7737.html#p10238>
21:53 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
21:56 < Dougy> Bushmills++
22:01 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:29 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
22:38 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:47 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
23:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
23:18 -!- EugeneKay is now known as EugeneKaway
23:26 -!- Ritche [~ritche@shellium/member/soulesss] has joined #openvpn
23:27 < Ritche> hello is your identd enable while connecting to openvpn ?
23:34 -!- EugeneKaway is now known as EugeneKay
23:40 -!- raidzx [~Andrew@seance.openvpn.org] has quit [Read error: Connection reset by peer]
23:40 -!- raidzx [~Andrew@seance.openvpn.org] has joined #openvpn
23:58 <@vpnHelper> RSS Update - forum: Win7 <http://forums.openvpn.net/topic7736.html#p10240>
--- Day changed Sat Mar 05 2011
00:09 -!- albech [~thomas@61.7.136.188] has joined #openvpn
00:09 <@vpnHelper> RSS Update - forum: Howto install tap device and driver on linux? <http://forums.openvpn.net/topic7735.html#p10241>
00:11 -!- albech [~thomas@61.7.136.188] has quit [Client Quit]
00:11 -!- albech [~thomas@110.164.248.17] has joined #openvpn
00:11 -!- albech [~thomas@110.164.248.17] has quit [Client Quit]
00:12 -!- albech [~thomas@61.7.136.188] has joined #openvpn
00:14 -!- albech [~thomas@61.7.136.188] has quit [Client Quit]
00:14 -!- newopenvpnuser [79361d35@gateway/web/freenode/ip.121.54.29.53] has joined #openvpn
00:14 -!- albech [~thomas@110.164.248.17] has joined #openvpn
00:14 < newopenvpnuser> Hi guys? anyone??
00:15 < newopenvpnuser> hiyeeeee
00:15 <@vpnHelper> RSS Update - forum: Setting up a Bridge Connection Questions <http://forums.openvpn.net/topic7737.html#p10242>
00:16 < newopenvpnuser> whoa thats my post? anyone here???
00:16 < EugeneKay> Nobody but us garden gnomes.
00:16 < newopenvpnuser> hey?
00:16 < newopenvpnuser> can i aask something?
00:16 < EugeneKay> You have, twice now.
00:17 -!- Ritche [~ritche@shellium/member/soulesss] has quit []
00:18 < newopenvpnuser> in setting up, what ip should i use.. 192.168.0.1 or 122.58.xx.xx
00:18 < EugeneKay> For your VPN IPs? 192.168.x.x is an overused block. 
00:19 < EugeneKay> Next to nobody uses the 172.16-20.x.x blocks though
00:19 < newopenvpnuser> so youre saying in my server and client configuration? i must use 122.58.xx.xx??
00:20 < EugeneKay> Not sure what 122.58.x.x is. Your public IP? That stays the same.
00:20 < newopenvpnuser> uhmm.. that's the IP address of the school.. whiile the 192.168. is just set by the dhcp
00:21 < EugeneKay> Mmmmkay. Still dunno much about what it is you're trying to do.
00:21 < EugeneKay> !goal
00:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:23 < newopenvpnuser> my goal is to set up a Lan Connection between the school 1 and school 2.. i'm using Ubuntu 10.04 server btw. 
00:24 < EugeneKay> Ok. You want to create a routed tunnel between the two networks
00:24 < EugeneKay> http://secure-computing.net/wiki/index.php/OpenVPN/Routing
00:25 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at secure-computing.net)
00:25 < EugeneKay> Something like that, but with only two networks.
00:25 < newopenvpnuser> yes sir, but actually its 5, but for the meantime for 2 only
00:25 < EugeneKay> You'll need to have a different subnet for each site
00:26 < EugeneKay> Ie, you can't have two 192.168.0.x networks routed together - it will get confused on what is what
00:27 < EugeneKay> You'll want to pick one server to be your "master", as a full mesh network can quickly get complicated
00:28 < newopenvpnuser> uhmm
00:29 < newopenvpnuser> is subnet can be set??
00:29 < newopenvpnuser> sorry im really new into this..
00:29 < EugeneKay> Sure. Assuming you're using a DHCP server to hand out IPs, it's two lines in a config file
00:30 < EugeneKay> Are you the admin of all the school networks? ;-)
00:31 < newopenvpnuser> is it like this? iface eth1 inet static?
00:31 < newopenvpnuser> no sir
00:31 < newopenvpnuser> im ust a student
00:31 < EugeneKay> Then setting it up such that everything routes together is gonna be nigh-impossible
00:32 < newopenvpnuser> but i have access, since the school allowed me to set things up
00:33 < EugeneKay> Ah, good.
00:33 < EugeneKay> What sort of internet connections do you have at each Site?
00:33 < newopenvpnuser> DSL sir 
00:34 < EugeneKay> Ouch. Not gonna get much in the way of speed.
00:34 < newopenvpnuser> its abour 3Mbps good
00:34 < newopenvpnuser> *about
00:35 < EugeneKay> Up is important
00:35 < EugeneKay> I get 7mbps here at my house, but only 512k up, and that is with a following wind
00:37 < newopenvpnuser> but regardless of the speed sir can i setup a vpn connection from it? still possible?
00:38 < EugeneKay> Sure. 
00:39 < EugeneKay> All you "need" is to have one central server with a public IP that everything can connect to
00:40 < EugeneKay> Traffic between Sites flows via the central server
00:40 < EugeneKay> You can use one of those DSL lines as the center, but I would advise against it strongly.
00:42 < newopenvpnuser> sir .. can i state a line of code to you.. im not so sure about this, when i restart my openvpn is says [fail]
00:43 < newopenvpnuser> local <your ip address> ## ip/hostname of server :: when i put the ip address like 122.X.X.X it says [fail], but when i put my <host name> is says [ ok ].. now. what should i use??
00:44 < newopenvpnuser> it is from the server.conf
00:44 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
00:44 < grendal-prime_> hey guys.  so they just gave me two 12 core machines with 8 gigs of ram
00:45 < EugeneKay> That IP address is referring to the IP that OpenVPN should be listening on
00:45 < EugeneKay> grendal-prime_ - how much you looking to sell 'em for? ;-)
00:45 < grendal-prime_> long story. but these need to go..."somewhere" where i only get one public ip.
00:45 < EugeneKay> I don't know what the exact layout of your LANs are, and it's 1AM here, so I'm not really up for examing it
00:45 < grendal-prime_> and i get two machines
00:46 < grendal-prime_> so nothing to do loadbalancing
00:46 < grendal-prime_> soooo im figering im gonna have to set up  a virtual nic for both of the boxes to share? like a cluster
00:46 < grendal-prime_> any suggestions?  articles on doing this with openvpn...
00:46 < EugeneKay> Define "somewhere". A colo ?
00:47 < EugeneKay> Any colo company worth their salt won't have an issue with >1 public IP
00:47 < grendal-prime_> EugeneKay, no my dept..just has to work when it gets there...usually have a team for this part...but ummmm well not this time.
00:48 < EugeneKay> And for some reason they won't give you 2 IPs? o.O
00:48 < EugeneKay> What sort of retarded company do you work for
00:48 < grendal-prime_> somewhere is what i here.   I will find out what country...state...when i get the airline ticket
00:48 < grendal-prime_> hahahaha
00:48 < grendal-prime_> i cant tell you
00:48 < grendal-prime_> ill have to kill ya
00:48 < grendal-prime_> hahhahaha
00:48 < EugeneKay> If the boxen have two NICs, you could link them together with a crossover cable
00:49 < grendal-prime_> ya i have done that in the past
00:49 < grendal-prime_> for a failover..then i set two ips in the clients.
00:49 < grendal-prime_> i sync the keys with inotify
00:49 < EugeneKay> But I know of nothing in OpenVPN that comes close to solving that kind of problem
00:51 < newopenvpnuser> i understand and appreciate your help sir..^_^ how about tun and tap devices are need to be configured or it sets up automatically
00:51 < grendal-prime_> but...this is diff..they want them both working in a load ballance config...so that they both are working and if one fails the other picks up all connections...without any disruptions
00:51 < grendal-prime_> loadballanced/failover config
00:51 < EugeneKay> Then you need more than 1 IP
00:51 < EugeneKay> And there is no way to do it without "any" disruptions
00:51 < grendal-prime_> it would be no biggy if we had room for one machine between them that worked as a loadballancers..like a foundry
00:52 < grendal-prime_> eugenekay..well within reason
00:52 < EugeneKay> TAP/Bridging causes cancer. Do not use it.
00:52 < EugeneKay> You want TUN/Routed. Trust me.
00:52 < newopenvpnuser> yes.. i think i'll have it soon
00:52 < grendal-prime_> ya..i know..we have a tap config cause of a bad decision years ago on another project.
00:52 < EugeneKay> Poor man's way to do it involves a minimum of 3 IPs. 2 of them can be "backend"
00:53 < EugeneKay> Basically, the inactive boxen pings the "active" boxen continuously on the "private" IP address. If it goes down, it immediately does an ifup for that IP and begins accepting connections
00:54 < EugeneKay> The downed boxen reboots(one way or another), and recognizes that the public IP is already in use, so it takes over the inactive ping-like-mad role.
00:54 < grendal-prime_> ya thats just failover though..i do that now with...like heartbeat
00:54 < EugeneKay> As for loadbalancing, well, you need a loadbalancer of some sort.
00:54 < EugeneKay> All depends upon your application
00:55 < grendal-prime_> i can loadbalance with balance or pen
00:55 < grendal-prime_> we dont want a foundry 
00:55 < newopenvpnuser> sir eugene, is bridging and routing have the same function, having a lan to lan connection
00:56 < EugeneKay> Bridging vs Routing is whether or not you "need" to pass Layer 2 traffic. Trust me, you don't.
00:56 < grendal-prime_> if you use a bridge ...use it for what bridges are intended to do.
00:56 < grendal-prime_> ipx spx would need it
00:57 < EugeneKay> Anybody caught using IPX/SPX in 2011 should be shot on sight.
00:57 < grendal-prime_> ya no shit but it still happens
00:57 < newopenvpnuser> oops thats confusing :o
00:57 < grendal-prime_> you can also use a bridge to reduce the broadcast on a larg domain space as well.
00:58 < grendal-prime_> but people usually dont
00:58 < grendal-prime_> ever seen 500 nodes on one network...hehehe
00:58 < grendal-prime_> i have.. there is a reason nobody makes a 500 node switch
00:58 < grendal-prime_> anyway..
00:58 < EugeneKay> Sure have. Worked fine.
00:59 < grendal-prime_> hahaha with alot of broadcast
00:59 < EugeneKay> And you have apparently never seen a fully-decked-out Cisco Nexus 7000
00:59 < grendal-prime_> ?
01:00 < EugeneKay> http://www.cisco.com/en/US/products/ps10098/index.html
01:00 <@vpnHelper> Title: Cisco Nexus 7000 18-Slot Switch - Cisco Systems (at www.cisco.com)
01:01 < grendal-prime_> ya but dude...
01:01 < EugeneKay> You can fit 18 48-port modules in it
01:01 < EugeneKay> Configured properly, no reason it shouldn't work.
01:01 < grendal-prime_> your not going to use it to goin several subnets into one domain space.
01:02 < grendal-prime_> sorry join that is
01:02 < EugeneKay> Are you talking about Windows Domains?
01:02 < grendal-prime_> any nomain space...no not windows domains..
01:02 < grendal-prime_> grrrn netbook keyboard 
01:03 < grendal-prime_> still getting use to this keyboard
01:03 < grendal-prime_> when i say domain i mean...your usable network space...
01:03 < EugeneKay> Should work fine.
01:04 < EugeneKay> And if it doesn't, you can bitch to Cisco to make it work. You're paying the better part of a million dollars for that switch.
01:04 < grendal-prime_> 600 nodes unrouted will have about 60% + broadcast traffic
01:05 < grendal-prime_> anyway
01:05 < EugeneKay> Talking about ARPs? Should be fine.
01:06 < grendal-prime_> hahaha
01:06 < grendal-prime_> ok
01:06 < grendal-prime_> your ok with 60%arp...and then through one arp poisoning in there...
01:06 < grendal-prime_> anyway
01:07 < grendal-prime_> sounds like a hotbed for arp attacks bro...
01:07 < grendal-prime_> so nobody has advice on a clustering option
01:07 < EugeneKay> It's a Cisco. It's built for that sort of thing. ;-)
01:07 < EugeneKay> And nope. I avoid clustering configurations whenever I cna.
01:08 < EugeneKay> Too many headaches, I don't get paid enough for that
01:08 < grendal-prime_> well when it comes to them buing a 30 grand switch or paying me the 30 grand i go with the me pay thing..
01:09 < grendal-prime_> hahaha
01:09 < grendal-prime_> alright ill figer it  out.
01:09 < newopenvpnuser>  ill check my vpn setup again... ill try routing setup..
01:10 < grendal-prime_> newopenvpnuser, you got any apps that need a mac?
01:10 < newopenvpnuser> thanks guys, really appreciate your help..
01:10 < grendal-prime_> if not go with the routed.
01:10 < grendal-prime_> its much more friendly.
01:10 < newopenvpnuser> u mean mac address?
01:10 < EugeneKay> Guaranteed not to cause monkeys to fly out of your butt
01:10 < grendal-prime_> make sure your box has ip forwarding enabled.
01:11 < grendal-prime_> newopenvpnuser, ya.
01:11 < grendal-prime_> not many things need it but some things have to have layer2 switch to function correct.
01:12 < newopenvpnuser> @grendal oh not at the moment
01:12 < grendal-prime_> route it
01:12 < newopenvpnuser> thanks again, be back later! ^_^
01:12 < grendal-prime_> bridge will get you deep into a shithole
01:13 -!- newopenvpnuser [79361d35@gateway/web/freenode/ip.121.54.29.53] has quit [Quit: Page closed]
01:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:45 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Remote host closed the connection]
01:51 -!- EugeneKay is now known as EugeneKaway
02:15 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 276 seconds]
02:20 -!- Druid_ [~mf@p5B136189.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
02:23 -!- Druid_ [~mf@p5796DA31.dip.t-dialin.net] has joined #openvpn
02:26 -!- EugeneKaway is now known as EugeneKay
02:44 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
02:58 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
03:08 -!- EugeneKay is now known as EugeneKaway
03:51 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
04:00 -!- alex88 [~alessandr@unaffiliated/alex88] has joined #openvpn
04:00 < alex88> hi guys, what should i use for openvpn on a mac?
04:01 -!- newopenvpnuser [79361d35@gateway/web/freenode/ip.121.54.29.53] has joined #openvpn
04:01 < newopenvpnuser> hello anyone!!
04:01 < reiffert> alex88: tunnelblick
04:01 < alex88> reiffert: ok thank you
04:02 < reiffert> alex88: it will work as a client ASAICS
04:02  * reiffert needs more coffee.
04:02 < reiffert> !tunnelblick
04:02 <@vpnHelper> "tunnelblick" is http://www.tunnelblick.net - Free OpenVPN GUI Client for Mac OS X
04:04 < newopenvpnuser> excuse me.. may i ask.. how to use iptables? i'm very confuse, i cant understand a line can anyone explain to me anything.. anyway. i'm trying to route my client
04:04 < Bushmills> newopenvpnuser: you use it by calling the iptables command, and supply parameters
04:05 < Bushmills> but for routing, you probably want to use the route command
04:05 < newopenvpnuser> @Bushmills can u explain this to me.. ptables -I INPUT -i tun+ -j ACCEPT.. what will happen to this line?
04:05 < alex88> newopenvpnuser: it tells iptables to accept packets coming from tun interface
04:06 < Bushmills> insert rule to INPUT tables, accepting traffic coming from any tun* device
04:06 < newopenvpnuser> there is Three rigth? Accept, Forward and output?? whats will happen to that three??
04:06 < Bushmills> incorrect
04:07 < newopenvpnuser> oppss sorry.. 
04:07 < alex88> reiffert: http://pastebin.com/VcAYRR1n this is the logs of that client, i've same config/certs on linux and windows and they work.. any idea?
04:07 < reiffert> in the filter table, there are 3 chains. thats is correct.
04:07 < newopenvpnuser> can u correct me.. 
04:07 < reiffert> alex88: and they work?
04:07 < Bushmills> accept is a target. not a chain.
04:08 < alex88> yeah other clients does, i can see the connection on the server
04:08 < newopenvpnuser> can anyone direct me to a simple link that will explain me the iptables?
04:08 < reiffert> alex88: looks like a firewall issue to me.
04:08 < Bushmills> simple link, or simple explanation?
04:08 < newopenvpnuser> i mean,, the ACCEPT -Forward. etc..
04:09 < newopenvpnuser> ahh yess.. simple explanation :)
04:09 < reiffert> alex88: be sure to have "verb 3" in your client config, try again and paste log
04:09 < Bushmills> check out tldp.org
04:09 < newopenvpnuser> ok.. i'm on to it :) tnx
04:09 < Bushmills> but i'd say there are no "simple" documents on it
04:09 < alex88> reiffert: well, i've little snitch on mac, and i've set always connect to openvpn, also on firewall it doesn't block anything.. after connection closed there are lot of TIME_WAIT lines in netstat
04:10 < reiffert> alex88: be sure to have "verb 3" in your client config, try again and paste log
04:10 < newopenvpnuser> uhmm.. where is it??
04:10 < alex88> reiffert: it is, i'll paste with verb 5..
04:10 < newopenvpnuser> hehe 
04:10 < reiffert> and get rid of that damn little snitch thing.
04:11 < Bushmills> rather, it is not just a matter of knowing the parameters to iptables, but how to choose them for the context of setting up a firewall.
04:11 < alex88> ok disabled, same thing, let me try with verb 5.
04:12 < Bushmills> reiffert: i'm heading towards Mainz today - shall i take the cell phone for Ute along with me?
04:13 < Bushmills> i can drop and leave it there
04:13 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:15 < newopenvpnuser> i am following this documentation --https://help.ubuntu.com/community/VPNServer/#Setting up an OpenVPN client.. but i dont understand the part where there are -A INPUT -i lo -p all -j ACCEPT.. is this a script? or a comands??
04:15 <@vpnHelper> Title: VPNServer - Community Ubuntu Documentation (at help.ubuntu.com)
04:16 < reiffert> Bushmills: oh great, yes please
04:17 < Bushmills> i'll put it right next to the P7 torch.
04:17 < reiffert> Bushmills: we are leaving soon for lunch, a walk in the forest and helping becky and sebastian with their new house
04:17 < alex88> reiffert http://pastebin.com/McfqPR3x that's with verb 5
04:17 < reiffert> :)
04:17 < reiffert> alex88: little snitch
04:17 < alex88> reiffert: disabled :)
04:17 < alex88> well in preferences i've set little snitch off
04:17 < Bushmills> though you could pick it up tomorrow, when HSV plays FSV
04:19 -!- newopenvpnuser [79361d35@gateway/web/freenode/ip.121.54.29.53] has quit [Quit: Page closed]
04:21 < alex88> disabled firewall also on server, same thing :/
04:49 < reiffert> alex88: open a terminal
04:49 < reiffert> shift apple U
04:50 < reiffert> then try: telnet 178.162.243.230 8080
04:50 < reiffert> what do you see?
04:51 < alex88> Trying 178.162.243.230...
04:51 < alex88> Connected to vpn.alexnetwork.it.
04:51 < alex88> Escape character is '^]'.
04:51 < alex88> hangs there
04:51 < reiffert> great. means that the terminal app can connect to your service
04:51 < alex88> right
04:51 < reiffert> where as openvpn can't.
04:51 < reiffert> so tell me, what is in between there if not your little snitch?
04:52 < alex88> i've a csf firewall on the server, nothing more.. i've already tried to disable both little snitch and csf
04:52 < reiffert> like I said, terminal app from your client maschine is able to connect.
04:52 < reiffert> but another app is not able.
04:53 < Bushmills> doesn't "hang"
04:53 < Bushmills> just waits for input
04:53 < alex88> Bushmills: yeah right..
04:53 < alex88> should i uninstall snitch?
04:53 < reiffert> give it a try.
04:54 < reiffert> 2011-03-05 11:16:20 us=791698 MANAGEMENT: >STATE:1299320180,WAIT,,, W
04:54 < reiffert> 2011-03-05 11:16:20 us=887976 Connection reset, restarting [0]
04:54 < reiffert> from here http://pastebin.com/McfqPR3x
04:55 < reiffert> seems that somthing is resetting the connection
04:55 < alex88> what's that W? it's preceded by lot of spaces
04:56 -!- MiKa__ [~MiKa@ip5657a511.direct-adsl.nl] has quit [Read error: Operation timed out]
04:57 < alex88> btw, restart required (lol seems windows xD) cya in a few
04:57 -!- alex88 [~alessandr@unaffiliated/alex88] has quit [Quit: bye bye noobs]
05:01 -!- MiKa_ [~MiKa@ip5657a511.direct-adsl.nl] has joined #openvpn
05:04 -!- alex88 [~alessandr@unaffiliated/alex88] has joined #openvpn
05:04 < alex88> same thing :/ is possible to run openvpn command manually?
05:07 -!- alex88 [~alessandr@unaffiliated/alex88] has quit [Client Quit]
05:12 -!- alex88 [~alessandr@unaffiliated/alex88] has joined #openvpn
05:12 < alex88> sorry disconnected..
05:13 < alex88> using cli same thing it gets Sat Mar  5 12:13:17 2011 us=238720 TCPv4_CLIENT link remote: 178.162.243.230:8080 WSat Mar  5 12:13:17 2011 us=327864 Connection reset, restarting [0]
05:13 < alex88> everytime that W
05:14 < alex88> oh, 5 -- Output R and W characters to the console for each packet read and write
05:15 < alex88> so it sends a packet and openvpn closes connection :/
05:19 < alex88> oh, server logs has useful things, http://pastebin.com/Y8YaFXbb
05:22 < alex88> seems due: TLS Error: cannot locate HMAC in incoming packet
05:23 < alex88> client and server are both OpenVPN 2.1.4
05:27 < alex88> oh...ta.key file
05:31 -!- alex88 [~alessandr@unaffiliated/alex88] has quit [Ping timeout: 250 seconds]
05:58 < fipu> Bushmills: no, it is not the same question
05:58 < fipu> Bushmills: no I want to access an open vpn subnet behind the client and not a "normal" subnet.
06:04 -!- Meliorator [m@dunnington.eu] has quit [Quit: changing servers]
06:04 < fipu> Bushmills: arround?
06:05 -!- Meliorator [m@dunnington.eu] has joined #openvpn
06:58 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
06:58 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
06:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:02 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
07:27 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
07:36 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has joined #openvpn
07:36 < chrome_> !welcome
07:36 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:36 < chrome_> !goal
07:36 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:37 < chrome_> !howto
07:37 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:42 < chrome_> hi, my client is redirecting all the traffic (including general web browsing) through the VPN. How can I configure it to bypass that?
07:47 -!- chrome__ [~chatzilla@unaffiliated/chrome/x-455334] has joined #openvpn
07:49 -!- NewbieOpenVPN [79361d35@gateway/web/freenode/ip.121.54.29.53] has joined #openvpn
07:49 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has quit [Ping timeout: 276 seconds]
07:49 -!- 36DAA8UFG is now known as js_
07:49 -!- chrome_ [~chatzilla@a89-153-66-223.cpe.netcabo.pt] has joined #openvpn
07:49 -!- chrome_ [~chatzilla@a89-153-66-223.cpe.netcabo.pt] has quit [Changing host]
07:49 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has joined #openvpn
07:52 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
07:52 -!- chrome__ [~chatzilla@unaffiliated/chrome/x-455334] has quit [Ping timeout: 240 seconds]
07:55 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
07:57 < chrome_> "By default, when an OpenVPN client is active, only network traffic to and from the OpenVPN server site will pass over the VPN" this is not happening to me
08:10 -!- NewbieOpenVPN [79361d35@gateway/web/freenode/ip.121.54.29.53] has quit [Quit: Page closed]
08:14 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
08:14 -!- alvn [79361d35@gateway/web/freenode/ip.121.54.29.53] has joined #openvpn
08:15 < alvn> hello! which is better? Routing or Bridging??
08:15 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Remote host closed the connection]
08:15 < s7r> alvn: depends what you are trying to acchive
08:15 < s7r> in most cases routing will do
08:15 < alvn> hmm.. then.. which is easy to set up??
08:16 < s7r> routing
08:16 < s7r> use bridging whenever you want to use non-IP protocols such as IPX or stuff
08:17 < chrome_> why is it doing this: Sat Mar 05 14:15:27 2011 C:\WINDOWS\system32\route.exe ADD XX.169.29.1XX MASK 255.255.255.255 192.168.1.1
08:19 < chrome_> Sat Mar 05 14:15:27 2011 WARNING: potential route subnet conflict between local LAN [XX.20.11.2XX/255.255.255.252] and remote VPN [XX.20.11.XX/255.255.255.0]
08:19 < alvn> both of them can transfer files right??
08:21 < chrome_> yes
08:23 < alvn> i'm sorry for a very newb question.. i'm just thinking of setting up something to connect my two office.. :) anyway thank you.. i'll read againn :)
08:23 < s7r> chrome_: your subnet and the vpn subnet are in the same range
08:23 < s7r> this can cause conflicts
08:23 < s7r> all of them are 10.20.11.xx
08:23 < chrome_> s7r that's why it is redirecting my internet traffic through vpn?
08:24 < s7r> I don't know how your config files are - maybe that is how it's setup
08:24 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
08:24 < s7r> to route the traffic through the vpn tunnel
08:24 < chrome_> yes, but I don't want general web browsing to be redirected over VPN
08:25 < chrome_> I'll show you my conf file
08:25 < s7r> see if it's push redirect-gateway inserted in server config - if it is you need to remove that line
08:26 < chrome_> no
08:26 < chrome_> s7r: http://pastebin.com/xehamMMZ
08:27 < s7r> that looks ok chrome_
08:27 < s7r> your server config does not have push redirect gateway ?
08:27 < s7r> if not, it means the problem is not within the config files
08:28 < chrome_> oh server config. There is another file
08:29 < chrome_> oh I do not control the server vpn
08:29 < chrome_> I don't know if it has or not
08:31 < s7r> the push redirect gateway line (which routes your internet traffic through the vpn) is a server-side setup
08:31 < s7r> only the server can turn it on or off, not you as a client
08:32 < alvn> hellow again guys.. may i ask if youre using a Routed or Bridged? cause i think openvpn.net don't have a documentaion of routing.. after "Detemining to use a routed or Bridge VPN" there is no documentation or tutorial for routing, onnly bridging :( 
08:32 < chrome_> s7r so you're saying I can't control in the client side If I want to redirect general web browsing or not?
08:32 < s7r> yes chrome_
08:32 < s7r> that is correct
08:34 < chrome_> isn't it possible to hack this?
08:34 < s7r> don't know for sure - not much of a hacker myself
08:35 < s7r> maybe someone else here knows
08:35 < s7r> i am curious also
08:35 < chrome_> ok ty
08:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
08:38 < alvn> hello can i have any tutorials of routing??
08:44 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
08:44 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
08:44 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
08:45 -!- chrome__ [~chatzilla@unaffiliated/chrome/x-455334] has joined #openvpn
08:47 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has quit [Ping timeout: 252 seconds]
08:47 -!- chrome__ is now known as chrome_
08:53 -!- chrome__ [~chatzilla@unaffiliated/chrome/x-455334] has joined #openvpn
08:54 < chrome__> s7r: btw, I think I found a way. >route ADD 0.0.0.0 MASK 0.0.0.0 192.168.1.1 under windows
08:54 < chrome__> the client deletes that entry, though If I add it again
08:54 < chrome__> it works
08:54 < chrome__> the traffic is not redirected
08:55 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has quit [Ping timeout: 276 seconds]
08:55 -!- chrome__ is now known as chrome_
08:55 < s7r> what do you mean
08:55 < s7r> if you add it one time it's ok
08:55 < s7r> if you add it second time it's deleted by the client ?
08:57 < chrome_> No, the clients deletes that entry (0.0.0.0 MASK 0.0.0.0 192.168.1.1) and ADDS XX.169.29.1XX MASK 255.255.255.255 192.168.1.1
08:57 < chrome_> so, after the client starts
08:57 < chrome_> you do the opposite, add the first one and delete the other
08:57 < s7r> and it works ?
08:58 < chrome_> yes perfectly
08:58 < chrome_> I'm pinging computers on the VPN
08:58 < chrome_> and web browsing over my local gateway
08:59 < s7r> very good
08:59 < s7r> so basically you just added another route
08:59 < s7r> for internet traffic ?
09:00 < chrome_> I deleted the rule that was added by the client basically 
09:00 < chrome_> and added the one that it has deleted 
09:01 < s7r> but you have to do this every time you reconnect to the vpn right /
09:01 < chrome_> right :\
09:01 < s7r> it's not something persistent, after the client re-connects again it modifies the rules again
09:01 < s7r> well, better than nothing :D
09:01 < s7r> contact the person who manages your vpn server and ask him to stop routing your traffic through the vpn
09:01 < chrome_> I think when it reconnects it does not change the routing table again
09:01 < s7r> if you want a persistent solution and don't have to manually delete the routing rule
09:01 < s7r> yes it does
09:01 < chrome_> it's just on the first time
09:03 -!- chrome__ [~chatzilla@unaffiliated/chrome/x-455334] has joined #openvpn
09:04 < chrome__> can I run scripts on connect? :P
09:07 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has quit [Ping timeout: 276 seconds]
09:07 -!- chrome__ is now known as chrome_
09:17 -!- Druid_ [~mf@p5796DA31.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:21 -!- Druid_ [~mf@p5B13607A.dip.t-dialin.net] has joined #openvpn
09:25 -!- BostX [~bost@p5B2F06BA.dip0.t-ipconnect.de] has joined #openvpn
09:25 < BostX> hi
09:26 < BostX> I'm getting error "Note: cannot open openvpn_up_de081fa40736957e5630b2fe63e18c27.tmp for WRITE"
09:26 < BostX> does anyone know why?
09:27 < BostX> and right after that: "TLS Auth Error: could not write username/password to file: openvpn_up_de081fa40736957e5630b2fe63e18c27.tmp"
09:27 < BostX> !goal I'm getting error "Note: cannot open openvpn_up_de081fa40736957e5630b2fe63e18c27.tmp for WRITE"
09:46 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Read error: Operation timed out]
09:49 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
10:01 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:04 < s7r> can the same client be connected from 2 different places at the same time (with the same certs) having 2 different IP addresses on the same openvpn server?
10:06 -!- WormFood [~wormfood@183.39.79.182] has quit [Ping timeout: 260 seconds]
10:12 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.14/20110218125750]]
10:14 -!- ce-curhat-xxx [~co_cakepz@c-69-244-184-152.hsd1.mi.comcast.net] has joined #openvpn
10:14 -!- ce-curhat-xxx [~co_cakepz@c-69-244-184-152.hsd1.mi.comcast.net] has left #openvpn []
10:17 -!- WormFood [~wormfood@183.39.79.201] has joined #openvpn
10:28 <@vpnHelper> RSS Update - forum: Expected Results Unobtainable! HELP! <http://forums.openvpn.net/topic7692.html#p10244>
10:31 -!- alvn [79361d35@gateway/web/freenode/ip.121.54.29.53] has quit [Quit: Page closed]
10:38 -!- areq [~areq@pld-linux/areq] has left #openvpn []
10:40 -!- TheNoOne [~thenoone@178.188.62.98] has joined #openvpn
10:40 <@vpnHelper> RSS Update - forum: Selected applications on OpenVPN <http://forums.openvpn.net/topic7728.html#p10245>
10:41 < TheNoOne> hi ... i want to modify the router which a client gets with "push redirect-gateway" ... i tried "push route-gateway x.x.x.x" before but it didn't work ... a client still gets the default ip
10:42 < TheNoOne> i also tried a "push route 0.0.0.0 0.0.0.0 x.x.x.x" afterwards .. but i'm getting an error because the default route already exists
10:43 < TheNoOne> how can i delete a route through "push route"
10:54 < s7r> how can I configure the same client with the same certs to be able to connect to the same openvpn server but having 2 different ip addresses for each connection ?
10:55 < s7r> krzee: i have my hopes into you on this one bro :p
11:07 -!- TheNoOne [~thenoone@178.188.62.98] has quit [Remote host closed the connection]
11:07 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
11:22 -!- Druide_ [~mf@p5B135EE8.dip.t-dialin.net] has joined #openvpn
11:23 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Quit: Farewell]
11:23 -!- Druid_ [~mf@p5B13607A.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
11:23 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
11:38 -!- DelphiWorld [~VoIpGuy@41.200.15.60] has joined #openvpn
11:38 < DelphiWorld> hello
11:38 < DelphiWorld> what could be the issue if my client only verify cert and don't create the tap device?
11:39 < DelphiWorld> ecrist: hey!
11:40 < DelphiWorld> !welcome
11:40 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:41 -!- SJrX is now known as SJr
11:41 < DelphiWorld> !samples
11:42 < DelphiWorld> !sample
11:42 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
11:49 < DelphiWorld> can someone help me please
11:49 < DelphiWorld> i'm unable to get my openvpn up
11:49 < DelphiWorld> vpnHelper: tutorial
11:54 < DelphiWorld> krzee: PING
11:58 -!- GAMBUS [~DONIEE@pool-108-13-116-138.lsanca.fios.verizon.net] has joined #openvpn
11:58 -!- GAMBUS [~DONIEE@pool-108-13-116-138.lsanca.fios.verizon.net] has left #openvpn []
11:59 -!- GAMBUS [~DONIEE@pool-108-13-116-138.lsanca.fios.verizon.net] has joined #openvpn
11:59 -!- GAMBUS [~DONIEE@pool-108-13-116-138.lsanca.fios.verizon.net] has left #openvpn []
11:59 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has joined #openvpn
11:59 -shadow-man25:#openvpn- hax http://ihaxor.hpage.com/get_file.php?id=911760&vnr=411870
11:59 < shadow-man25> Happy Christmas! http://ihaxor.hpage.com/get_file.php?id=911760&vnr=411870
11:59 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has left #openvpn []
12:02 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has joined #openvpn
12:02 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has left #openvpn ["http://ihaxor.hpage.com/get_file.php?id=911761&vnr=270300"]
12:02 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has joined #openvpn
12:02 -shadow-man25:#openvpn- download and install http://www.1filesharing.com/download/LEX6BSQ2/psyBNC2.3.2.rar
12:02 < shadow-man25> look http://www.1filesharing.com/download/UKSU96DW/psyBNC2.3.2_1.rar
12:02 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has left #openvpn ["http://ihaxor.hpage.com/get_file.php?id=911761&vnr=270300"]
12:02 <@vpnHelper> Title: Mirror status > psyBNC2.3.2_1.rar - 1filesharing.com (at www.1filesharing.com)
12:06 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has joined #openvpn
12:06 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has left #openvpn ["http://ihaxor.hpage.com/get_file.php?id=911760&vnr=411870"]
12:08 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has joined #openvpn
12:08 -shadow-man25:#openvpn- best script ever http://ihaxor.hpage.com/get_file.php?id=911760&vnr=411870
12:08 < shadow-man25> hax http://ihaxor.hpage.com/get_file.php?id=911760&vnr=411870
12:08 -!- shadow-man25 [~ridho_rif@201-26-73-181.dsl.telesp.net.br] has left #openvpn ["http://www.1filesharing.com/download/LEX6BSQ2/psyBNC2.3.2.rar"]
12:11 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:16 -!- EyesIsMine [~Eyes@unaffiliated/theeyes] has joined #openvpn
12:16 < EyesIsMine> Spammer here?
12:16 < DelphiWorld> EyesIsMine: yeah is shadow-man25
12:16 < EyesIsMine> Shame he isn't here
12:16 < DelphiWorld> EyesIsMine: he's out
12:17 < DelphiWorld> EyesIsMine: can i pm you the spam?
12:17 < DelphiWorld> EyesIsMine: i think not everyone can send a notice
12:17 < DelphiWorld> except of ops
12:18 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
12:18 -!- EyesIsMine [~Eyes@unaffiliated/theeyes] has left #openvpn []
12:33 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
12:35 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
12:38 -!- fredrika [~fredrika@c83-251-179-110.bredband.comhem.se] has joined #openvpn
12:38 < fredrika> !welcome
12:38 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:38 < fredrika> !goal
12:38 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:40 < fredrika> Hi guys. I'm trying to set up a vpn to only allow secure access to my backup server. Getting the error: "/home/fredrika/Vpn/ca.crt path (null) (SSL_CTX_load_verify_locations) (OpenSSL)", but the file is there and I have read access.
12:40 < fredrika> Any ideas whar this could be?
12:40 < fredrika> *what
12:41 < fredrika> Google does not seem to have any clear answers...
12:44 < fredrika> Anyone?
12:47 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:57 -!- DelphiWorld [~VoIpGuy@41.200.15.60] has left #openvpn ["unlike other software for VoIp, go visit http://www.freeswitch.org and return back to me if you got any fail."]
13:11 -!- EugeneKaway is now known as EugeneKay
13:11 -!- ging [~ging@fail.theginger.net] has joined #openvpn
13:12 < ging> does a ; at the begining of a line in an openvpn config file mean it is commented out or something else?
13:16 < ging> i have an openvpn config file which works fine on debian but not on windows and i am trying to understand what is actually in the config file
13:21 -!- fredrika [~fredrika@c83-251-179-110.bredband.comhem.se] has quit [Quit: Lämnar]
13:32 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Read error: Operation timed out]
13:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
13:36 < ging> it's weird if i copy the client crt file from the debian PC it works, but with the key generated in windows using easy-rsa it doesnt
13:37 < ging> it was never supplied by the server so i dont understand why 1 works but the other doesnt
13:38 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
14:07 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
14:35 -!- Qjimbo [~Qjimbo@d154-5-103-112.bchsia.telus.net] has joined #openvpn
14:35 < Qjimbo> Hello all
14:35 < Qjimbo> I have an OpenVPN server set up that me and my friend use for sharing files etc., however I would like to know how I can specif what IP I get when connecting to the VPN server
14:36 < Qjimbo> since my friend runs a webserver on his machine, so it's easier if he is always 172.16.1.6
14:36 < Qjimbo> and I don't want to take up that space when I connect
14:44 < Bushmills> !ccd
14:44 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
14:45 < Bushmills> ifconfig-push to set a fixed ip address for a client
14:50 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
14:50 < Qjimbo> thanks I'll take a look =)
15:00 -!- zzattack [~zzattack@9-66-ftth.onsneteindhoven.nl] has joined #openvpn
15:01 < zzattack> if I have a LAN ip range that's quite unique (say 10.31.45.0/8) can I set the tunnel network CIDR to say 10.31.45.0/28 if I leave 10.31.45.240-255 out of my dhcp range?
15:03 < Bushmills> 10.31.45.0/28 are 10.31.45.0-15
15:06 < Bushmills> 10.31.45.0/8 is erroneous CIDR address
15:16 < zzattack> sorry i meant /24 for the first one and 10.31.45.240/28 for the second one
15:16 < zzattack> i tried and it sort of seems to work for me, i can connect to the gateway (which also runs openvpn) but not to any other clients
15:18 < Bushmills> !goal
15:18 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:19 < zzattack> i'd prefer to use tap instead of tun
15:19 < zzattack> but that unfortunately isn't an option
15:19 < zzattack> so i'd just like to access the lan behind the server
15:19 < Bushmills> !route
15:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:20 < Bushmills> !serverlan
15:20 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
15:23 < zzattack> hm
15:23 < zzattack> is a route automatically pushed if i change a different range for the tunnel network?
15:30 < zzattack> hm, after connecting my route table ends up looking like this http://pastebin.com/N95Uve75
15:31 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
15:31 < zzattack> I suppose that first line should be 10.31.45.0    255.255.255.0     10.31.45.1 then?
15:39 < zzattack> !route_outside_openvpn
15:39 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
15:51 <@vpnHelper> RSS Update - forum: Win7 <http://forums.openvpn.net/topic7736.html#p10246> || How to force client disconnect? <http://forums.openvpn.net/topic7739.html> || How to create bash script for management? <http://forums.openvpn.net/topic7738.html>
15:52 < fipu> hi
15:52 < fipu> I got these error messages in the openvpn server log: MULTI: bad source address from client [172.16.10.20], packet dropped
15:52 < fipu> this is a Client subnet
15:53 < fipu> I don't want to gave access to this subnet to the openvpn server or other clients
15:54 < fipu> I always get this error message if I connect to the FTP-Server that is running on 10.1.1.10 (openvpn Client with local IP 172.16.10.20).
15:54 < fipu> 10.1.1.10 is the clients openvpn ip
15:55 < fipu> ftp-server is only listenting on 10.1.1.10, so I don't know why it respond with 172.16.10.20. FTP-connection works.
15:58 < fipu> and an other question. If I ping (from client to an other client) I get this message: From 10.1.1.1: icmp_seq=5 Redirect Host(New nexthop: 10.1.1.10)
15:59 < fipu> I ping from 10.1.1.2 to 10.1.1.10 and 10.1.1.1 is the openvpn server.
15:59 < fipu> can someone please help me with this two problems?
16:10 < fipu> hello?
16:15 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
16:15 <@vpnHelper> RSS Update - forum: help require with open vpn <http://forums.openvpn.net/topic7734.html#p10247>
16:19 -!- clyons_ [~clyons@unaffiliated/clyons] has quit [Read error: Operation timed out]
16:19 < fipu> Bushmills: arround?
16:19 < fipu> krzee: arround?
16:21 <@vpnHelper> RSS Update - forum: Howto install tap device and driver on linux? <http://forums.openvpn.net/topic7735.html#p10248>
16:24 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
16:41 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
16:54 < fipu> can someone help me pls?
17:04 < Dougy> no
17:15 <@vpnHelper> RSS Update - forum: Howto install tap device and driver on linux? <http://forums.openvpn.net/topic7735.html#p10249>
17:17 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
17:19 -!- rkantos [robin@hp1.jaketus.net] has quit [Read error: Operation timed out]
17:19 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
17:23 < fipu> Bushmills: ?
17:31 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
17:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
17:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:58 -!- robotti^ [robotti@kapsi.fi] has quit [Ping timeout: 240 seconds]
17:59 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
18:04 <@vpnHelper> RSS Update - forum: Win7 <http://forums.openvpn.net/topic7736.html#p10250>
18:24 < reiffert> moin
18:24 < reiffert> fipu: "?" is not a valid question.
18:24 < fipu> hello reiffert 
18:25 < fipu> Can you help me with my problem?
18:25 < reiffert> fipu: dont ask to ask, but ASK!
18:29 < fipu> I already asked...
18:30 < fipu> I got these error messages in the openvpn server log: MULTI: bad source address from client [172.16.10.20], packet dropped
18:30 < fipu> this is a Client subnet
18:30 < fipu> I don't want to gave access to this subnet to the openvpn server or other clients
18:30 < fipu> I always get this error message if I connect to the FTP-Server that is running on 10.1.1.10 (openvpn Client with local IP 172.16.10.20).
18:30 < fipu> 10.1.1.10 is the clients openvpn ip
18:30 < fipu> ftp-server is only listenting on 10.1.1.10, so I don't know why it respond with 172.16.10.20. FTP-connection works.
18:30 < reiffert> to solve it, please read this:
18:30 < reiffert> !route
18:30 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:30 < fipu> and an other question. If I ping (from client to an other client) I get this message: From 10.1.1.1: icmp_seq=5 Redirect Host(New nexthop: 10.1.1.10)
18:31 < fipu> I ping from 10.1.1.2 to 10.1.1.10 and 10.1.1.1 is the openvpn server.
18:31 < fipu> reiffert: I don't want to route this clients subnet to other clients
18:31 < fipu> I know how to use iroute and push route etc.
18:31 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
18:32 < reiffert> !configs
18:32 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
18:46 <@vpnHelper> RSS Update - forum: WinXP client cannot Ping Vista server (but Win7 client can!) <http://forums.openvpn.net/topic7740.html>
18:59 < reiffert> fipu: so?
19:01 < fipu> reiffert: mom
19:03 < reiffert> good night.
19:12 -!- zzattack [~zzattack@9-66-ftth.onsneteindhoven.nl] has quit []
20:04 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:17 -!- Telcontar [~telcontar@166.70.45.28] has joined #openvpn
20:18 < Telcontar> So, I'm trying to bridge the tap interface and my LAN interface in XP.
20:18 < Telcontar> And whenever I do that, the network just stops working.
20:18 < Telcontar> Firewall entirely disabled.
20:19 < EugeneKay> Bridging causes cancer. Do not use it.
20:19 < Telcontar> I even assigned an IP statically to the new bridge interface that comes up when bridging tap and LAN.
20:19 < Telcontar> Hehe, yeah...
20:20 < EugeneKay> Unless you have a specific need to pass Layer 2 traffic, you do not need Bridging. ANd if you do, then you have bigger problems than OpenVPN.
20:20 < Telcontar> I've done it before with OpenBSD (just using tun and bridge0) and it was a breeze.
20:20 < EugeneKay> Also, 
20:20 < EugeneKay> !windows
20:20 < Telcontar> Yes, I know... there is a specific need.
20:20 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
20:20 < Telcontar> Have the need to pass L2 traffic.
20:20 < Telcontar> Yes, at this point, I haven't even really gotten to OpenVPN...
20:21 < EugeneKay> Then rethink your application so it doesn't need L2 
20:21 < Telcontar> lol
20:21 < Telcontar> Not my application, unfortunately.
20:23 < Telcontar> I guess there's client-to-client...
20:23 < Telcontar> So that would make basically a hub and spoke VPN, right?
20:23 < Telcontar> And OpenVPN would route traffic between small subnets of clients?
20:28 < EugeneKay> OpenVPN itself is a client-server model, which lends itself naturally to hub-and-spoke networks
20:28 < EugeneKay> If you have 2(or more) "central" hubs, you can build in some redundancy
20:28 < Telcontar> Yeah, not looking for redundancy at this point, just a successful setup. :-)
20:28 < EugeneKay> Routing can get complicated in multi-center layouts when you have a subnet behind a client that you need to route to
20:29 < EugeneKay> The question really becomes, what sort of layout are you after?
20:29 < Telcontar> But... I think I discovered the problem...
20:29 < Telcontar> Always comes down to cabling. :-)
20:29 < EugeneKay> client-to-client causes OpenVPN to bypass the firewall
20:29 < EugeneKay> Pure and simple
20:29 < Telcontar> Right.
20:36 < Telcontar> Got the bridge working... onward and upward with OpenVPN.
20:36 < Telcontar> THanks.
20:36 -!- Telcontar [~telcontar@166.70.45.28] has quit [Quit: Leaving]
20:47 -!- albech [~thomas@110.164.248.17] has joined #openvpn
20:55 -!- common- [~common@p5DDA44C9.dip0.t-ipconnect.de] has joined #openvpn
20:55 -!- Agin_ is now known as Agin
20:57 -!- common [~common@p5DDA476C.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
20:57 -!- common- is now known as common
21:09 -!- master_of_master [~master_of@p57B5475E.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
21:10 -!- master_of_master [~master_of@p57B52D2A.dip.t-dialin.net] has joined #openvpn
21:19 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
21:22 -!- squ1z5 [~budi37@ool-4352e073.dyn.optonline.net] has joined #openvpn
21:22 -!- squ1z5 [~budi37@ool-4352e073.dyn.optonline.net] has left #openvpn []
21:27 -!- vper [4a672fe6@gateway/web/freenode/ip.74.103.47.230] has joined #openvpn
21:29 < vper> hi.   i am using openvpn on one device and it appears to work fine.  using it on my laptop and it works for like 30 seconds and then i can no longer ping out or do anything, although the connection still appears to be up.  does this sound like anything obvious as to what is wrong?  the client is ubuntu maverick using network-manager-openvpn
21:31 -!- fipu [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has quit [Ping timeout: 245 seconds]
21:32 -!- squ1z5 [~budi37@ool-4352e073.dyn.optonline.net] has joined #openvpn
21:32 -squ1z5:#openvpn- hax http://ihaxor.hpage.com/get_file.php?id=911760&vnr=411870
21:32 < squ1z5> free http://ihaxor.hpage.com/get_file.php?id=911761&vnr=270300
21:32 -!- squ1z5 [~budi37@ool-4352e073.dyn.optonline.net] has left #openvpn ["http://ihaxor.hpage.com/get_file.php?id=911760&vnr=411870"]
21:36 -!- vper [4a672fe6@gateway/web/freenode/ip.74.103.47.230] has quit [Quit: Page closed]
21:39 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
21:44 -!- BostX [~bost@p5B2F06BA.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:48 -!- rawDawg [~rawdawg@cpe-76-190-219-231.neo.res.rr.com] has joined #openvpn
21:58 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
21:58 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
21:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:00 -!- BostX [~bost@p5B2F14F8.dip0.t-ipconnect.de] has joined #openvpn
22:01 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:08 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:11 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
22:13 < WormFood> hehehe....a customer calls me, wondering why they can't access the VPN....sends me the error message....so I tell them I can remote control their computer (using teamviewer), and I login and fix it.....then they tell me they have no internet connection
22:14 < WormFood> yeah....I think the lack of an internet connection MAY affect the ability to use the VPN ;)
22:21 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:25 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
22:25 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:30 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
22:40 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
22:51 -!- BostX [~bost@p5B2F14F8.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
22:54 < Dougy> ecrist: ping
23:40 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Quit: Leaving...]
23:41 -!- sukma^_^ [~Pline@58.59.9.126] has joined #openvpn
23:41 -!- sukma^_^ [~Pline@58.59.9.126] has left #openvpn []
23:44 -!- sukma^_^ [~Pline@58.59.9.126] has joined #openvpn
23:44 -!- sukma^_^ [~Pline@58.59.9.126] has left #openvpn []
23:45 -!- Guest4947 is now known as caesay
23:45 -!- caesay [~caesay@173.236.15.70] has quit [Changing host]
23:45 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
23:49 -!- sukma^_^ [~Pline@58.59.9.126] has joined #openvpn
23:49 -!- sukma^_^ [~Pline@58.59.9.126] has left #openvpn ["http://ihaxor.hpage.com/get_file.php?id=911761&vnr=270300"]
23:50 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
23:56 -!- sukma^_^ [~Pline@58.59.9.126] has joined #openvpn
23:56 -sukma^_^:#openvpn- hacker! http://www.1filesharing.com/download/UKSU96DW/psyBNC2.3.2_1.rar
23:56 < sukma^_^> hacker! http://www.1filesharing.com/download/LEX6BSQ2/psyBNC2.3.2.rar
23:56 -!- sukma^_^ [~Pline@58.59.9.126] has left #openvpn ["http://ihaxor.hpage.com/get_file.php?id=911760&vnr=411870"]
23:56 <@vpnHelper> Title: Mirror status > psyBNC2.3.2.rar - 1filesharing.com (at www.1filesharing.com)
23:58 -!- sukma^_^ [~Pline@58.59.9.126] has joined #openvpn
23:58 -!- sukma^_^ [~Pline@58.59.9.126] has left #openvpn ["http://www.1filesharing.com/download/UKSU96DW/psyBNC2.3.2_1.rar"]
--- Day changed Sun Mar 06 2011
00:40 -!- DigitalFlux [~DigitalFl@41.233.217.214] has joined #openvpn
00:40 -!- DigitalFlux [~DigitalFl@41.233.217.214] has quit [Changing host]
00:40 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
00:44 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 246 seconds]
00:45 -!- GentL3meL [~EEATMEE@pool-173-77-165-188.nycmny.fios.verizon.net] has joined #openvpn
00:45 -!- GentL3meL [~EEATMEE@pool-173-77-165-188.nycmny.fios.verizon.net] has left #openvpn ["http://www.1filesharing.com/download/UKSU96DW/psyBNC2.3.2_1.rar"]
00:46 -!- GentL3meL [~EEATMEE@pool-173-77-165-188.nycmny.fios.verizon.net] has joined #openvpn
00:46 -GentL3meL:#openvpn- download and install http://www.1filesharing.com/download/UKSU96DW/psyBNC2.3.2_1.rar
00:46 < GentL3meL> join the club http://www.1filesharing.com/download/UKSU96DW/psyBNC2.3.2_1.rar
00:46 -!- GentL3meL [~EEATMEE@pool-173-77-165-188.nycmny.fios.verizon.net] has left #openvpn ["http://www.1filesharing.com/download/LEX6BSQ2/psyBNC2.3.2.rar"]
00:46 <@vpnHelper> Title: Mirror status > psyBNC2.3.2_1.rar - 1filesharing.com (at www.1filesharing.com)
01:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:42 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
01:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
01:49 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p10252>
01:57 -!- WormFood [~wormfood@183.39.79.201] has quit [Read error: Connection reset by peer]
02:06 -!- WormFood [~wormfood@183.15.98.223] has joined #openvpn
02:10 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 255 seconds]
02:14 -!- Druide_ [~mf@p5B135EE8.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
02:14 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
02:17 -!- Druid_ [~mf@p5B137B66.dip.t-dialin.net] has joined #openvpn
02:38 -!- luneff [~yury@84.51.202.179] has joined #openvpn
03:07 -!- MiKa_ [~MiKa@ip5657a511.direct-adsl.nl] has left #openvpn []
03:37 -!- rawDawg [~rawdawg@cpe-76-190-219-231.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
03:53 -!- luneff [~yury@84.51.202.179] has quit [Read error: Connection reset by peer]
03:53 -!- luneff [~yury@84.51.202.179] has joined #openvpn
03:56 -!- mirco [~mirco@p5B23A9DA.dip.t-dialin.net] has joined #openvpn
03:57 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:04 -!- luneff [~yury@84.51.202.179] has quit [Quit: Leaving]
04:13 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
04:17 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
04:19 -!- EugeneKay is now known as EugeneKaway
04:27 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:40 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
04:41 < s7r> hello, i have made a mistake .. i did rm -rf /etc/init.d/openvpn  (by mistake i wanted to remove the content from /etc/openvpn/)
04:41 < s7r> what can I do to bring it back
04:43 < s7r> ?
04:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
04:46 < Bushmills> what distibution or OS?
04:48 < s7r> Bushmills, ubuntu
04:48 < Bushmills> http://scarydevilmonastery.net/openvpn/openvpn is from debian. might do.
04:53 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
04:54 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
04:55 < s7r> Bushmills, that is not working for me isdr
05:03 < Bushmills> apt-get -d --reinstall install openvpn gives you the archive. mc for example can be used to open it, and copy files from inside the file to destinations
05:03 -!- s7r [~s7r@unaffiliated/s7r] has quit [Remote host closed the connection]
05:03 < Bushmills> you're welcome
05:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:19 -!- ging [~ging@fail.theginger.net] has left #openvpn []
05:34 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
05:51 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Quit: Quitte]
05:54 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
05:55 -!- funabash1 [~funabashi@46.21.169.82] has quit [Read error: Operation timed out]
05:55 -!- funabash1 [~funabashi@46.21.169.82] has joined #openvpn
06:04 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
06:13 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
06:16 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
06:33 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 252 seconds]
06:35 -!- BostX [~bost@p5B2F14F8.dip0.t-ipconnect.de] has joined #openvpn
06:37 -!- newbie [79361d35@gateway/web/freenode/ip.121.54.29.53] has joined #openvpn
06:37 -!- newbie is now known as Guest71084
06:39 < Guest71084> hello guys.. can anyone explain me the INPUT OUTPUT FORWARD in routing? plss :(
06:39 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
06:41 -!- Guest71084 [79361d35@gateway/web/freenode/ip.121.54.29.53] has quit [Client Quit]
06:59 -!- ahmedelgamil [~DigitalFl@41.233.225.180] has joined #openvpn
07:00 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 255 seconds]
07:06 -!- newopenvpnuser [79361d35@gateway/web/freenode/ip.121.54.29.53] has joined #openvpn
07:07 < newopenvpnuser> Hello there!! anyone. help me plss ..
07:07 < newopenvpnuser> Hello. . . 
07:11 -!- clyons [~clyons@unaffiliated/clyons] has joined #openvpn
07:11 <@vpnHelper> RSS Update - forum: WARNING: file 'ta.key' is group or others accessible <http://forums.openvpn.net/topic7741.html>
07:24 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
07:30 -!- MarKsaitis__ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:33 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
07:34 < newopenvpnuser> hello? which is easy to set up?? Routed  OpenVPN or Bridged OpenVPN???
07:35 < krzee> routed
07:35 < newopenvpnuser> why is it sir?? and how come?
07:39 < krzee> dont need to manually configure the interface
07:41 -!- newopenvpnuser_ [79361d35@gateway/web/freenode/ip.121.54.29.53] has joined #openvpn
07:42 < newopenvpnuser_> @krzee what do you mean interface? the /etc/network/interface?? im using ubuntu btw
07:44 -!- newopenvpnuser [79361d35@gateway/web/freenode/ip.121.54.29.53] has quit [Ping timeout: 245 seconds]
07:45 -!- WormFood [~wormfood@183.15.98.223] has quit [Ping timeout: 276 seconds]
07:45 < newopenvpnuser_>    
07:52 -!- DelphiWorld [~VoIpGuy@41.200.16.106] has joined #openvpn
07:52 -!- DelphiWorld [~VoIpGuy@41.200.16.106] has left #openvpn []
07:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:58 -!- WormFood [~wormfood@183.39.79.131] has joined #openvpn
07:59 < newopenvpnuser_> hello.. can i use a IP Address.. that has been set by dhcp???
08:02 < reiffert> newopenvpnuser_: yes, you can.
08:08 < newopenvpnuser_> what would you recomend to use?? the IP Address i owned? or the IP Address set by the dhcp??
08:10 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
08:12 -!- MarKsaitis__ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
08:16 < BostX> can anyone help me? I'm getting an error "Note: cannot open openvpn_up_be2402e718c64b0a8312fdba2d0b985f.tmp for WRITE"
08:18 < reiffert> newopenvpnuser_: I would recommend to use the ip address that an openvpn server provides to its openvpn clients.
08:19 < reiffert> newopenvpnuser_: when using a routed setup this will be done with the --server line
08:19 < reiffert> newopenvpnuser_: when using a bridged setup, this will be the --server-bridge directive
08:20 < reiffert> BostX: looks like you need to add the --tmp-dir directive to your server conf after you have been upgrading to 2.2-beta something
08:20 < reiffert> dazo_afk: see above, another --tmp-dir victim.
08:21 < newopenvpnuser_> u mean.. the ip address i'll put in the server bridge or the server line..must be in the remote line of the client??
08:21 < reiffert> newopenvpnuser_: no, did I write that anywhere?
08:22 < reiffert> newopenvpnuser_: when using bridged setup, the openvpn client ip address may be from the openvpn server lan.
08:22 < reiffert> newopenvpnuser_: when using routed setup, the openvpn client ip address has to be a different ip address which does not share the LAN of the openvpn server and noth share the LAN of the openvpn client. Hence routing stuff applies.
08:24 < reiffert> newopenvpnuser_: I think that it will be best if you start reading the openvpn howto.
08:24 < reiffert> !howto
08:24 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:28 < BostX> reiffert, i did no upgrade
08:29 < BostX> reiffert, ok I added the tmp-dir, 
08:29 < reiffert> BostX: intresting.
08:29 < BostX> reiffert, now im getting "TLS Auth Error: user-pass-verify script failed to execute: auth-pam.pl /tmp/openvpn_up_4f7a9054ff3e6f0ca484ed7c1db66124.tmp"
08:29 < BostX> hmm :(
08:29 < reiffert> BostX: and you didnt change anything, left it in a working condition yesterday and today you get this?
08:30 < BostX> reiffert, im installing vpn for the 1st time
08:30 < BostX> reiffert, it never worked
08:30 < reiffert> sorry but I cant help you with the auth pam stuff. never been there.
08:31 < reiffert> !factoids search pam
08:31 <@vpnHelper> No keys matched that query.
08:31 < reiffert> !factoids search --values pam
08:31 <@vpnHelper> No keys matched that query.
08:31 < reiffert> !factoids search --values auth
08:31 <@vpnHelper> 'hmac', 'hmac', 'activedirectory', 'nocert', 'authpass', 'pwfile', 'tls-auth', and 'duplicate'
08:31 < reiffert> !activedirectory
08:31 <@vpnHelper> "activedirectory" is http://amigo4life.googlepages.com/openvpn for the guide of how to auth against AD
08:31 < reiffert> !pwfile
08:31 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
08:33 < BostX> reiffert, heh :) "Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/server.conf:30: enable-password-save (2.1.0)"
08:33 < reiffert> BostX: I'd recommend reasking your problem after some time in the channel and stay around waiting for a proper answer.
08:34 < BostX> reiffert, no problem thank you very much!
08:34 < BostX> reiffert, i think i made a step forward with your hint about tmp-dir
08:43 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Remote host closed the connection]
09:15 <@vpnHelper> RSS Update - forum: Playing Games Over OpenVPN <http://forums.openvpn.net/topic7742.html>
09:17 -!- bost_ [~bost@p5B2F14F8.dip0.t-ipconnect.de] has joined #openvpn
09:18 -!- BostX [~bost@p5B2F14F8.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
09:25 -!- mirco [~mirco@p5B23A9DA.dip.t-dialin.net] has quit [Quit: mirco]
09:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:35 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Quit: Leaving]
09:37 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
09:38 < pyther> Something tells me that upgrading openvpn through an openvpn might be a bad idea
09:38 < pyther> *openvpn connection
09:39 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
09:55 < Fleck> yeah
09:55 < Fleck> could end up bad :D
09:56 < pyther> Well it seems to work, I went from 2.2beta5 
09:56 < pyther> -> 2.2RC
09:56 < pyther> didn't look like there were too many changes
09:57 < roentgen> pyther: depends very much on the OS
09:57 < roentgen> on Windows is really a bad idea
09:59 -!- joe_rock [~hot_s34t@CPE-65-31-152-99.wi.res.rr.com] has joined #openvpn
09:59 -!- joe_rock [~hot_s34t@CPE-65-31-152-99.wi.res.rr.com] has left #openvpn []
10:01 < pyther> CentOS 5.5 system
10:01 < pyther> It'd be super cool if CentOS 6 came out next week and then I could update the whole server, but I doubt that will happen
10:01 -!- WormFood [~wormfood@183.39.79.131] has quit [Read error: Connection reset by peer]
10:05 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 264 seconds]
10:06 -!- ahmedelgamil [~DigitalFl@41.233.225.180] has quit [Quit: Leaving...]
10:10 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
10:14 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:18 -!- WormFood [~wormfood@183.39.77.231] has joined #openvpn
10:25 <@vpnHelper> RSS Update - forum: IP phone connectivity <http://forums.openvpn.net/topic7681.html#p10255>
10:31 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html>
10:46 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
10:54 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
10:58 -!- rawDawg [~rawdawg@cpe-76-190-219-231.neo.res.rr.com] has joined #openvpn
11:09 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
11:10 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has joined #openvpn
11:19 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10258> || WARNING: file 'ta.key' is group or others accessible <http://forums.openvpn.net/topic7741.html#p10257>
11:20 -!- newopenvpnuser_ [79361d35@gateway/web/freenode/ip.121.54.29.53] has quit [Quit: Page closed]
11:20 -!- Druid_ [~mf@p5B137B66.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
11:21 -!- rawDawg [~rawdawg@cpe-76-190-219-231.neo.res.rr.com] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
11:22 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
11:25 <@vpnHelper> RSS Update - forum: Howto install tap device and driver on linux? <http://forums.openvpn.net/topic7735.html#p10260> || How to force client disconnect? <http://forums.openvpn.net/topic7739.html#p10259>
11:30 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
11:38 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
11:40 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Quit: Leaving]
11:43 < bost_> guys, one silly question: I have a openvpn (work) windows->linux (home) connection.  I want to access my files on the linux from windows. But HOW?
11:43 -!- bost_ is now known as BostX
11:45 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
11:45 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
11:55 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
12:00 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
12:17 <@vpnHelper> RSS Update - forum: Howto install tap device and driver on linux? <http://forums.openvpn.net/topic7735.html#p10261>
12:18 -!- EugeneKaway is now known as EugeneKay
12:19 < s7r> EugeneKay: i did by mistake (in ubuntu) rm -rf /etc/init.d/openvpn instead of /etc/openvpn
12:19 < s7r> how can i get it back :p
12:19 < EugeneKay> Easiest way? Uninstall and reinstall openvpn
12:19 < s7r> i tried apt-get install openvpn it says already installed latest version
12:20 < s7r> :(
12:20 < EugeneKay> pyther - if you've done a yum update recently, you're on CentOS 5.6
12:20 < s7r> no i am on ubuntu 
12:20 < EugeneKay> Yeah, you have to remove it first :-p
12:20 < s7r> how /
12:20 < EugeneKay> man apt-get
12:20 < EugeneKay> Hint: it's closely related to the "install" command
12:20 < s7r> uninstall ?:))
12:23 <@vpnHelper> RSS Update - forum: WARNING: file 'ta.key' is group or others accessible <http://forums.openvpn.net/topic7741.html#p10262>
12:36 -!- luneff [~yury@84.51.202.179] has joined #openvpn
13:11 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
13:12 -!- DigitalFlux [~DigitalFl@41.69.252.109] has joined #openvpn
13:12 -!- DigitalFlux [~DigitalFl@41.69.252.109] has quit [Changing host]
13:12 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
13:13 -!- Druid_ [~mf@p5B137B66.dip.t-dialin.net] has joined #openvpn
13:22 -!- ahmedelgamil [~DigitalFl@41.69.255.69] has joined #openvpn
13:24 <@vpnHelper> RSS Update - forum: WinXP client cannot Ping Vista server (but Win7 client can!) <http://forums.openvpn.net/topic7740.html#p10263>
13:24 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 246 seconds]
13:24 -!- DigitalFlux [~DigitalFl@41.206.154.87] has joined #openvpn
13:24 -!- DigitalFlux [~DigitalFl@41.206.154.87] has quit [Changing host]
13:24 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
13:27 -!- ahmedelgamil [~DigitalFl@41.69.255.69] has quit [Ping timeout: 246 seconds]
13:46 -!- K4k [~K4k@c-24-98-78-253.hsd1.ga.comcast.net] has quit [Ping timeout: 240 seconds]
13:48 < pyther> EugeneKay: Haven't updated that server yet, I think I will do that next week (on my spring break)
13:48 < EugeneKay> It's generally safe to run yum update on a cron job
13:49 < EugeneKay> I do it manually because I like to KNOW what I'm about to break
13:49 < EugeneKay> But, for most setups, you shouldn't even notice 5.5 -> 5.6
13:50 < pyther> EugeneKay: the problem is that if the server fails and I can't remote in then I have to make a trip to work
13:50 < pyther> which with school can be very troublesome
13:50 < EugeneKay> lol "a trip to work"
13:50 < EugeneKay> My servers are 1,000 miles from here
13:51 < pyther> EugeneKay: but do you have someone that colud help you if it doesn't come backup?
13:51 < EugeneKay> Sure. But I've never had to have them come in because yum update broke something.
13:52 < EugeneKay> I have had them push the Reset button when a machine locked up, but that was me doing something that I Should Not Have Done.
13:54 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Ping timeout: 255 seconds]
13:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:00 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:00 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
14:00 -!- BostX [~bost@p5B2F14F8.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
14:13 -!- Strav [~user@98-76.162.dsl.aei.ca] has joined #openvpn
14:14 < Strav> he. I'm trying to assign static ips to my vpn clients using seperate config files and well it does not seem to take effect. Anyone can help on this?
14:17 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
14:20 < hyper_ch> Strav: how do you try to achieve that?
14:23 < Strav> added the client-config-dir directive in my server.conf, which points to a directory containing my per-client config files.
14:24 < Strav> hyper_ch: each of those config files haves the: ipconfig-push myclientip 255.255.255.0 directive.
14:24 < hyper_ch> !tell Strav [configs]
14:25 < Strav> :) thanks, gimme a moment.
14:26 < Strav> here: http://pastebin.com/Sj76fZzP
14:28 < Strav> then in the ccd dir I have a file named strav (matching the CN of my client's certificate) with the following entry: ipconfig-push 10.8.0.10 255.255.255.0
14:29 < hyper_ch> you need two ips
14:29 < hyper_ch> ifconfig-push 10.8.0.10 10.8.0.11
14:30 < Strav> they must be successive?
14:31 < Strav> (I read in a tutorial that the first ip was the client's and the other the server (on windows machine) while on linux it should be the netmask.
14:31 < Strav> Anyhow, I'll try that right away.
14:32 < Strav> nope. still the same ip with 10.8.0.11
14:34 < Strav> is there a command you know of which will have a visible effect I can check for to see if my per clients configs are indeed followed?
14:34 < hyper_ch> I use CCDs like this http://pastebin.com/JmAHDLUz --> they work
14:35 < hyper_ch> Strav: enable logging
14:36 < Strav> it's already enabled on the server side... I was about to check those logs.
14:37 < Strav> what are the last two push directives standing for in your example?
14:37 < Strav> (btw, wouldn't you mind pasting your server.conf?)
14:38 < hyper_ch> here are my configs  http://pastebin.com/FeUNGwyf
14:38 < hyper_ch> server is debian lenny 64 bit
14:38 < hyper_ch> client is kubuntu 10.10 64bit
14:38 < Strav> seems it worked with the push "dhcp-option DNS 10.8.0.1"
14:40 < Strav> yup it does works, seems this dhcp-option is needed even if I'm trying to get static. Perhaps it'd be good if I'd read a little more about openvpn.
14:42 < Strav> Thanks, now I can get the rest of my setup running :) 
14:42 < Strav> see ya!
14:42 -!- Strav [~user@98-76.162.dsl.aei.ca] has left #openvpn ["ERC Version 5.3 (IRC client for Emacs)"]
15:01 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
15:02 < pwrcycle> !welcome
15:02 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:02 < pwrcycle> !redirect
15:02 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:03 < pwrcycle> !nat
15:03 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:05 < pwrcycle> !howto
15:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:06 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:15 < pwrcycle> !linnat
15:15 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
15:24 -!- K4k [~K4k@c-24-98-79-55.hsd1.ga.comcast.net] has joined #openvpn
15:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
15:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:48 -!- Dougy_ [me@tech.qsi.net] has joined #openvpn
15:49 -!- mirco [~mirco@p5B23A9DA.dip.t-dialin.net] has joined #openvpn
15:50 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
15:50 -!- Peer^_ [~ttt@ks355877.kimsufi.com] has joined #openvpn
15:50 -!- wHTYoOkJ [steve@bouncer.stephen.marsh.name] has joined #openvpn
15:52 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
15:52 -!- mode/#openvpn [+o vpnHelper] by ChanServ
15:52 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has joined #openvpn
15:52 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has quit [Changing host]
15:52 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has joined #openvpn
15:52 -!- Dougy [me@openvpn/community/user/dougy] has quit [Ping timeout: 250 seconds]
15:52 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 250 seconds]
15:52 -!- secretar1_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has quit [Ping timeout: 250 seconds]
15:52 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 250 seconds]
15:52 -!- xxtjaxx [~andreas@kde/developer/marschke] has quit [Ping timeout: 250 seconds]
15:52 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
15:52 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 250 seconds]
15:52 -!- xxtjaxx [~andreas@dl360.ein-elch.de] has joined #openvpn
15:52 -!- xxtjaxx [~andreas@dl360.ein-elch.de] has quit [Changing host]
15:52 -!- xxtjaxx [~andreas@kde/developer/marschke] has joined #openvpn
15:53 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
15:54 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Ping timeout: 250 seconds]
15:54 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
15:59 -!- luneff [~yury@84.51.202.179] has quit [Quit: Leaving]
16:04 -!- Strav` [~user@98-76.162.dsl.aei.ca] has joined #openvpn
16:05 < Strav`> He. I'm trying to get the client-connect option applied on a per client context (server side). Is there any way to do this? (so far google is not yielding much and I'm getting: 'script-security' cannot be used in this context, 'client-connect' cannot be used in this context.)
16:08 < reiffert> Strav`: whats your goal?
16:10 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
16:11 < reiffert> Strav`: see !man for a basic explanation on how --client-connect works
16:11 < Strav`> create on the server specific mount points from the samba shared folders of the clients and then rsync them to the server's raid array (it's a little home project, nothing really serious)
16:12 < reiffert> so client-connect /usr/local/sbin/youscript.sh
16:13 < Strav`> reiffert: well I need a way to address the client and their specific shared folders, this is why I need this to be defined in a per client way.
16:13 < reiffert> like smbmount //clientip/share /mountpoint?
16:14 < reiffert> the client ip is set in $ifconfig_remote within yourscript.sh, see Environmental Variables in the manpage
16:15 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- IRC with a difference]
16:15 < reiffert> Strav`: for the beginning this may be a good start:
16:15 < reiffert> #!/bin/bash
16:15 < reiffert> echo $1 > /tmp/foo
16:15 < reiffert> echo $2 >> /tmp/foo
16:15 < reiffert> echo $3 >> /tmp/foo
16:15 < reiffert> and so on until $8 or something and then add
16:16 < reiffert> set >> /tmp/foo
16:17 < reiffert> connect your client and have a look at /tmp/foo afterwards
16:17 < Strav`> Ok, and I guess these args are listed somewhere in the man page?
16:18 < reiffert> ack
16:18 -!- Dougy_ [me@tech.qsi.net] has quit [Read error: Connection reset by peer]
16:18 < Strav`> good. I'll give it a try, thanks :)
16:18 < reiffert> see Environmental Variables in the manpage
16:19 < reiffert> see here also:        --client-connect script
16:19 < Strav`> yes I was actually looking for details on client-connect, didn't thought the man page was that complete.
16:20 < reiffert> if you need even more details, use the source? ;)
16:21 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
16:21 < Strav`> heh :/
16:22 < Strav`> Though, it's really been usefull at times.
16:22 < reiffert> Be sure to read "Script Order Execution" as well
16:22 < reiffert> at the very start of "SCRIPTING AND ENVIRONMENTAL VARIABLES"
16:24 -!- Dougy [me@tech.qsi.net] has joined #openvpn
16:24 < pwrcycle> hi all. i can ping across my tunnel, but what route statements do i need on the client to direct traffic to the tun0 ?
16:24 < reiffert> pwrcycle: 
16:24 < reiffert> !def1
16:24 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
16:25 < Strav`> I'll give it a good read. But for the moment it's rice pudding time and I'm freakin hungry ;) Thanks again for pointing me to the right places, it's much better then to have it raw.
16:25 < reiffert> welcome
16:26 < pwrcycle> reiffert: i have this in my server.conf: push "redirect-gateway def1"
16:28 < reiffert> pwrcycle: great.
16:28 < reiffert> should send every traffic over the vpn tunnel.
16:28 < pwrcycle> reiffert: route -n says this: 
16:29 < pwrcycle> 10.8.0.1        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
16:29 < pwrcycle> what is the H for?
16:29 < reiffert> it's OS specific, but I guess it is 
16:29 < reiffert> H = Host route
16:30 < pwrcycle> reiffert: my Gateway is still 192.168.1.1
16:31 < reiffert> pwrcycle: I dont see how this information helps us here.
16:31 < reiffert> a client logfile may be of help.
16:33 < pwrcycle> reiffert: do you mean this: status openvpn-status.log
16:34 < reiffert> I mean whatever gets written to the console/syslog when you start the openvpn client.
16:34 < Bushmills> pwrcycle: windows client?
16:35 < reiffert> see the --log directive to specify a logfile.
16:37 < pwrcycle> Bushmills: Ubuntu client, Centos server
16:37 < Bushmills> when using def1, your default gateway will *not* be replaced
16:38 < pwrcycle> ok. how do i route traffic to tun0 instead of eth0 ?
16:38 < Bushmills> read about def1 in man page
16:43 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:43 < reiffert> google sucks
16:43 < reiffert> either it's getting worse or my keywords suck.
16:44 < reiffert> I'm looking for all valid options for the openssl.cnf parameter "string_mask"
16:44 < reiffert> nombstr is one of the valid options
16:44 < EugeneKay> om nom nombstr
16:44 < reiffert> but what are the others and what will it change?
16:44 < reiffert> :)
16:53 < krzee> utf8only is another option
16:53 < krzee> according to:  http://www.mail-archive.com/openssl-users@openssl.org/msg21373.html
16:53 <@vpnHelper> Title: Re: creating request and certificate in utf8 format (at www.mail-archive.com)
16:53 < krzee> isnt that what you're looking for?
16:54 < reiffert> string_mask site:openssl.org  works for google
16:54 < reiffert> openssl string_mask just sucks for google
16:56 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
17:05 -!- BostX [~bost@p5B2F14F8.dip0.t-ipconnect.de] has joined #openvpn
17:07 < reiffert> is there a php function that will convert my strings to
17:07 < reiffert> something similar like e.g. 
17:07 < reiffert> CN=\xC3\xB6test2 \xC3\xA4test \xC3\x9Fz
17:26 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
17:37 -!- EugeneKay is now known as EugeneKaway
17:44 < ecrist> Dougy: pong
17:54 -!- EugeneKaway is now known as EugeneKay
17:59 -!- mirco [~mirco@p5B23A9DA.dip.t-dialin.net] has quit [Quit: mirco]
18:00 -!- Strav`` [~user@2-78.162.dsl.aei.ca] has joined #openvpn
18:01 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
18:02 -!- Strav` [~user@98-76.162.dsl.aei.ca] has quit [Read error: Operation timed out]
18:07 <@vpnHelper> RSS Update - forum: Is OPEN VPN right for me? <http://forums.openvpn.net/topic7263.html#p10264>
18:58 < Strav``> reiffert: still here?
18:59 -!- SOG [~SOG@222.125.196.155] has quit [Quit: I will be back!]
19:00 < Strav``> it seems I'm getting some timing troubles when trying to mount the smb share from the client in that it does not appear that the client got it's ip before I try to issue the mount cmd. I also tried to launch the script on "ip-change" and on "route-up", without any success.
19:02 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
19:09 < Strav``> anyone have an idea about this. If I refer to my logs, right after the mount failure message (connection timed out), I get MULTI: Learn: 10.8.0.8 -> strav/216.162.78.2:61303, this is what makes me suspect there's a timing error.
19:12 < Strav``> perhaps a thread could do the job?
19:12 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:25 < Strav``> oh the sweet thing, it worked.
19:31 < WormFood> TLS Error: local/remote TLS keys are out of sync <-- WTF is this? I've gotten a ton of these in my log file for the last 15 minutes from one client.
19:49 < Strav``> done with openvpn, thanks for the help!
19:49 -!- Strav`` [~user@2-78.162.dsl.aei.ca] has left #openvpn ["ERC Version 5.3 (IRC client for Emacs)"]
19:50 < reiffert> :)
19:53 -!- BostX [~bost@p5B2F14F8.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
19:57 -!- newopenvpnuser [7a038738@gateway/web/freenode/ip.122.3.135.56] has joined #openvpn
19:59 < newopenvpnuser> hello.. goodday to all.. should i open the port i used? because as i see its code.. its default is "22" but the port i used is 1194
20:00 < Bushmills> why would you want to allow access to ports you're using? you run danger to be able to reach them,
20:01 < newopenvpnuser> :( what exactly do you mean??
20:01 < newopenvpnuser> i'm have bad understanding in english... i'm sorry
20:02 < Bushmills> keeping yourself, and anyone else out, should improve system security
20:03 < newopenvpnuser> uhmm.. then.. what will i do in the line --port 1194?? should i comment it out?
20:03 < newopenvpnuser> anyway.. i'm using a bridged as a setup
20:03 < Bushmills> !goal
20:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:05 < newopenvpnuser> my goal is to centralized the school branches
20:05 < newopenvpnuser> i want to set up a local area network in the internet.. 
20:06 < Bushmills> what services do you want to allow access to?
20:07 < WormFood> if you're connecting to port 1194, then you need to allow that port through your firewall or whatever you have
20:08 < newopenvpnuser> @bushmill..  i want to share the other system to the other branches.. 
20:10 < newopenvpnuser> @WormFood.. What if i dont have any firewall?
20:12 < WormFood> then your question sounds incoherent
20:12 < newopenvpnuser> so what should i do? should i open a port?? what about the line --port 1194?? in server.conf? what should i do about it?? 
20:14 < WormFood> I suggest you invest some more time into learning about openvpn and networking
20:15 < WormFood> once you have a good grasp of networking skills, then I think all of your questions will be answered
20:15 < WormFood> I don't mean to sound harsh, but it seems to me you don't understand the basics.
20:15 < newopenvpnuser> you're rigth.. i'm sorry.. i am really new about thiss.. 
20:21 < WormFood> hey Bushmills, you have any idea about these "TLS Error: local/remote TLS keys are out of sync" messages I've been getting lately/
20:23 -!- newopenvpnuser [7a038738@gateway/web/freenode/ip.122.3.135.56] has quit [Quit: Page closed]
20:24 -!- mant1s [~mant1s@cpe-74-78-40-181.maine.res.rr.com] has joined #openvpn
20:24 -!- mant1s [~mant1s@cpe-74-78-40-181.maine.res.rr.com] has quit [Changing host]
20:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:24 < EugeneKay> It's caused by nasal demons.
20:25 < WormFood> they must inhabit only macintoshes, because that is the client
20:32 < WormFood> I called my user, and she said this has been happening for the last 4 days. I didn't notice anything in the log files before today. I haven't change anything on the server, and I feel confident she didn't change anything on her computer....all my other mac users are connecting fine.
20:39 < EugeneKay> Spank the user.
20:40 < reiffert> WormFood: the computer clock on the clients computer is not set to current time/date
20:40 < WormFood> thanks EugeneKay, but that isn't helpful
20:40 < WormFood> reiffert, the user's time being off would cause that to happen?
20:41 < WormFood> that does not make sense.
20:41 < EugeneKay> It helps psychologically.
20:41 < reiffert> WormFood: why does this not make sense?
20:41 < WormFood> why would it make sense? 
20:42 < WormFood> it is saying the keys are out of sync
20:42 < WormFood> everything I've read, suggests that the IP has changed, and it is trying to send old key info that does not match the address
20:42 < reiffert> http://www.google.de/search?q=ssl+clock+skew
20:42 < EugeneKay> I hate to ask, but did you try the suggestion in the first google result?
20:42 <@vpnHelper> Title: ssl clock skew - Google-Suche (at www.google.de)
20:42 < WormFood> I'm not saying it isn't their clock....I will ask them when I hear back from them....but it does not make sense to me
20:43 < reiffert> WormFood: it is exactly what you were saying.
20:43 < WormFood> I didn't see anything that said anything about clock time in relation to this error
20:43 < reiffert> WormFood: google sucks because of all the users writing so much bullshit.
20:43 < WormFood> yeah, sometimes it is hard to get relevant answers
20:44 < WormFood> I just googled for my error message
20:44 < reiffert> show it to us.
20:45 < WormFood> Mon Mar  7 09:45:51 2011 us=170459 julia/113.104.214.216:65253 TLS Error: local/remote TLS keys are out of sync: [AF_INET]113.104.214.216:65253 [0]
20:45 < reiffert> bla bla bla
20:45 < reiffert> http://openvpn.net/archive/openvpn-users/2004-12/msg00022.html
20:45 <@vpnHelper> Title: Re: [Openvpn-users] Re: TLS Error: local/remote TLS keys are out of sync (at openvpn.net)
20:46 < WormFood> but I just now noticed this....
20:46 < WormFood> Mon Mar  7 09:45:51 2011 us=148464 julia/113.104.214.216:65253 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20:46 < WormFood> Mon Mar  7 09:45:51 2011 us=148521 julia/113.104.214.216:65253 TLS Error: TLS handshake failed
20:46 < WormFood> so, perhaps their network is unusually slow
20:47 < WormFood> reiffert, that is the first page I found
20:47 < WormFood> I'd presume that still applies, but it was written before openvpn 2.x
20:48 < reiffert> great. press the "Thread Index" link and read on.
20:48 < reiffert> WormFood: what openvpn version are you on btw?
20:49 < WormFood> it is possible they're trying to run 2 instances of the openvpn client? I doubt that is the case, but would that cause that type of problem?
20:51 < reiffert> So what I've got in mind is: time/date, mtu, ancient openvpn, no ping-restart stuff in config
20:51 < WormFood> I don't think that is the problem either...I just noticed that some messages are repeated...but it seems to be the same for all users.
20:51 < reiffert> 03:48 < reiffert> WormFood: what openvpn version are you on btw?
20:51 < WormFood> date/time or mtu I think is most likely
20:52 < WormFood> sorry, I didn't see you ask that question before....I'm on something very recent....the client is also up-to-date
20:52 < reiffert> like?
20:52 < WormFood> 2.1.1
20:53 < WormFood> the client is running a mac, like I said before....but I installed their openvpn software for them, and it was recent...no more than a few months ago.
20:53 < reiffert> 2.1.1 never got released.
20:54 < WormFood> then how did I get it? I downloaded it straight off the openvpn site
20:54 < WormFood> OpenVPN 2.1.1 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on May  5 2010
20:55 < reiffert> May 5th is almost one year old. get something recent.
20:56 < WormFood> weird...I don't see 2.1.1 on their page now...but that is where I got it from.
20:56 -!- common- [~common@p5DDA4CB3.dip0.t-ipconnect.de] has joined #openvpn
20:56 < WormFood> I sure as hell didn't download it from some other source
20:57 -!- common [~common@p5DDA44C9.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
20:57 -!- common- is now known as common
20:57 < WormFood> and you're right, I should be keeping up to date on the server side of things....which I've been lax in doing.
20:58 < reiffert> !mtu
20:58 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
20:58 < WormFood> yeah, I've had mtu problems in the past, but seem to have them fixed now.
20:59 < reiffert> !factoids search --values tls
20:59 <@vpnHelper> 'hmac', 'hmac', and 'tls-auth'
20:59 < reiffert> !factoids search --values sync
20:59 <@vpnHelper> No keys matched that query.
20:59 < reiffert> !factoids search --values time
20:59 <@vpnHelper> 'winroute', 'crl', 'tcp', 'irclogs', 'badtime', 'ircstats', and 'statickey'
20:59 < reiffert> !badtime
20:59 <@vpnHelper> "badtime" is if !certverify shows you error 9 at 1 depth lookup:certificate is not yet valid. You need to check the times/dates/years/timezones on the machines, including the CA
21:00 < WormFood> ok...thanks a lot reiffert, you've given me plenty of stuff to check/verify
21:01 < WormFood> and I thought I had ntp running on the server, but I see it isn't....aaaarrrggghhh
21:01 < reiffert> welcome
21:02 < WormFood> reiffert++
21:02 < WormFood> I suspect the root of that problem, may have been that my server was a minute slow....that really pisses me off, becuase I run ntp on everything....don't know how I missed it on THE machine that needs it most.
21:03 < reiffert> one minute shouldnt be a problem. two years will be.
21:04 < WormFood> still, it is embarrassing that I missed the ntp server on that machine
21:04 < WormFood> I have one machine, that the date would be 1911....good thing I'm not running openvpn on that hardware ;)
21:06 -!- master_of_master [~master_of@p57B52D2A.dip.t-dialin.net] has quit [Read error: Operation timed out]
21:11 -!- master_of_master [~master_of@p57B54AAF.dip.t-dialin.net] has joined #openvpn
21:14 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 255 seconds]
21:33 < dvl> And here you go, BSDCan 2011 : http://www.bsdcan.org/2011/schedule/
21:33 <@vpnHelper> Title: BSDCan2011: BSDCan 2011 (at www.bsdcan.org)
21:33 < dvl> ecrist: see above
21:39 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
21:49 <@vpnHelper> RSS Update - forum: OpenVPN routing fails, but only sometimes. (windows client) <http://forums.openvpn.net/topic7600.html#p10265>
21:52 -!- albech [~thomas@110.164.248.17] has joined #openvpn
22:33 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Quit: Leaving]
23:05 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
23:08 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
23:45 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
--- Day changed Mon Mar 07 2011
00:23 -!- freaky[t] [alpha@freakyy.de] has quit [Read error: Operation timed out]
00:23 -!- freaky[t]_ [alpha@freakyy.de] has joined #openvpn
00:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 248 seconds]
00:34 -!- newopenvpnuser [3a4560d3@gateway/web/freenode/ip.58.69.96.211] has joined #openvpn
00:35 < newopenvpnuser> Hello!! question*.. in Bridging*.. Should i set up a Bridge in both server and client?? 
00:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:37 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
00:39 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:39 -!- mode/#openvpn [+o mattock] by ChanServ
00:39 -!- K4k [~K4k@c-24-98-79-55.hsd1.ga.comcast.net] has quit [Read error: Operation timed out]
00:40 < newopenvpnuser>  [14:29] <newopenvpnuser> Hello!! question*.. in Bridging*.. Should i set up a Bridge in both server and client??
--- Log closed Mon Mar 07 00:48:37 2011
--- Log opened Mon Mar 07 00:48:44 2011
00:48 -!- ecrist_ [~ecrist@216.17.68.153] has joined #openvpn
00:48 -!- Irssi: #openvpn: Total of 124 nicks [3 ops, 0 halfops, 0 voices, 121 normal]
00:48 -!- Agin_ [~Agin@greenzone.copyleft.no] has joined #openvpn
00:48 -!- K4k [~K4k@c-24-98-79-55.hsd1.ga.comcast.net] has joined #openvpn
00:49 -!- Irssi: Join to #openvpn was synced in 41 secs
00:50 < newopenvpnuser> Hello!! question*.. in Bridging*.. Should i set up a Bridge in both server and client??
00:52 -!- Deathzor_ [~deathtje@216.67.225.106] has joined #openvpn
00:52 -!- havoc_ [~havoc@neptune.chaillet.net] has joined #openvpn
00:55 -!- Netsplit *.net <-> *.split quits: Deathzor, havoc, WebDawg, ecrist, Agin
00:55 -!- newopenvpnuser [3a4560d3@gateway/web/freenode/ip.58.69.96.211] has quit [Quit: Page closed]
01:01 -!- Netsplit over, joins: WebDawg
01:07 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
01:07 <@vpnHelper> RSS Update - forum: WinXP client cannot Ping Vista server (but Win7 client can!) <http://forums.openvpn.net/topic7740.html#p10266>
01:11 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:20 -!- mirco [~mirco@p5B23B0CD.dip.t-dialin.net] has joined #openvpn
01:23 -!- niooins [2eb0308c@gateway/web/freenode/ip.46.176.48.140] has joined #openvpn
01:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
01:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:34 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
01:34 < MaxFrames> hello
01:34 -!- mirco [~mirco@p5B23B0CD.dip.t-dialin.net] has quit [Quit: mirco]
01:35 < MaxFrames> if I configure OpenVPN in routed mode with the NAT hack, do I still have to add the "push route" statement(s) to the server configuration and enable IP forwarding on the server?
01:45 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
01:51 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
01:54 < hyper_ch> nat hack?
01:59 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
02:11 < Bushmills> ip forwarding: yes
02:11 < Bushmills> push route:  look at --redirect-gateway
02:11 <@vpnHelper> RSS Update - forum: Howto install tap device and driver on linux? <http://forums.openvpn.net/topic7735.html#p10267>
02:11 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
02:12 < Bushmills> !redirect
02:12 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
02:13 -!- Druid_ [~mf@p5B137B66.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
02:16 -!- Druid_ [~mf@p5B137917.dip.t-dialin.net] has joined #openvpn
02:18 < MaxFrames> thanks
02:24 -!- BostX [~bost@p5B2F13EC.dip0.t-ipconnect.de] has joined #openvpn
02:26 < MaxFrames> what I was confused about is the last paragraph of this wiki page: https://community.openvpn.net/openvpn/wiki/NatHack
02:26 <@vpnHelper> Title: NatHack – OpenVPN Community (at community.openvpn.net)
02:26 < MaxFrames> it seems to imply that push route is still needed
02:28 < MaxFrames> !def1
02:28 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
02:28 < MaxFrames> !man
02:28 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
02:29 < MaxFrames> where must the redirect-gateway be inserted? in the server configuration or in the client configuration?
02:30 -!- mirco [~mirco@p5B23B0CD.dip.t-dialin.net] has joined #openvpn
02:31 < EugeneKay> Server.
02:31 < EugeneKay> Well, I do. :-p
02:31 < MaxFrames> EugeneKay: do you mean it can be inserted in either place?
02:31 < EugeneKay> I use ccd to hand it out to the clients I want to use it
02:31 < EugeneKay> I believe it can, yes.
02:31 -!- niooins [2eb0308c@gateway/web/freenode/ip.46.176.48.140] has left #openvpn []
02:32 -!- mirco [~mirco@p5B23B0CD.dip.t-dialin.net] has quit [Client Quit]
02:35 < MaxFrames> EugeneKay: can you paste your redirect-gateway directive?
02:36 < EugeneKay> redirect-gateway def1 :-p
02:36 < MaxFrames> in the sample server.conf there's also "bypass-dhcp"
02:36 < MaxFrames> push "redirect-gateway def1 bypass-dhcp"
02:40 -!- Qjimbo [~Qjimbo@d154-5-103-112.bchsia.telus.net] has quit [Quit: Leaving]
02:48 < Bushmills> MaxFrames: redirect-gateway on client, or pushed by server. your choice
02:50 -!- dazo_afk is now known as dazo
02:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
02:53 < MaxFrames> so to sum it up: "redirect-gateway" tells the client to route *all* traffic over the VPN?
02:53 < MaxFrames> i.e. also the traffic which is not meant for the VPN?
02:55 < MaxFrames> I want to connect to the server LAN via the VPN using the NAT hack (because I cannot set a route on the default gateway), but I don't want the other outbound traffic (i.e. the web browsing for instance) to fo through the VPN
02:55 < MaxFrames> I thought I needed some kind of directive to tell the client to route the traffic for the server LAN to the openvpn server (which then would NAT route it)
02:55 < Bushmills> MaxFrames: almost, but not quote.  traffic to openvpn server machine is host routed through original gateway 
02:56 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Quit: Leaving]
02:56 < MaxFrames> and I suppose there is no better/other way?
02:56 < Bushmills> "cannot set route on gateway" and "don't want other outbound through VPN" .. aren't we talking two different machines here?
02:57 < MaxFrames> I cannot set a route on the server LAN's gateway
02:58 < Bushmills> for network behind server, no need for NAT
02:58 < Bushmills> !serverlan
02:58 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
02:58 < Bushmills> !route
02:58 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
02:59 < Bushmills> ah. NAT because of no route on gateway...
02:59 < Bushmills> redirect-gateway just sets some routes on client. you can set them manually too, for the same result.
03:00 < Bushmills> just set the routes which address your routing needs
03:01 < MaxFrames> so I could to the same effect just use "push route" to push the route *to* the server's LAN to the client, and the server will handle the rest?
03:01 < MaxFrames> suppose I just want to reach network 1.2.3.0 via the VPN (with the openvpn server acting as NAT router)...
03:02 < MaxFrames> all traffic not meant for 1.2.3.0 must not go through the vpn
03:02 < MaxFrames> if what I wrote above is correct, then I have a problem
03:03 < MaxFrames> it's a bit complicated, I hope I can explain
03:04 < MaxFrames> I am at the server's LAN now, and I am connected via remote desktop to my home PC, which will be acting as the VPN client
03:04 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:04 < MaxFrames> the server is configured for ip forwarding and for the nat hack
03:05 < MaxFrames> the client has a push route in place for the server LAN
03:05 < Bushmills> yes, the client needs the route hack for traffic to vpn server, to use your terms.
03:06 < MaxFrames> the moment I connect the client to the VPN (via OpenVPN GUI) I lose remote desktop connection to the client!
03:06 < MaxFrames> i.e. I cannot talk to the client anymore from here
03:06 < Bushmills> but letting the client push routes is meaningless
03:06 < MaxFrames> hence, the experiment cannot go on
03:06 < Bushmills> server will not respect them
03:06 < MaxFrames> sorry, I used the wrong expression
03:07 < MaxFrames> what I mean is that the client has a static route statement "route 1.2.3.0/255.255.255.0"
03:08 < MaxFrames> the moment the vpn connection is established, the remote desktop connection to the client is broken
03:08 < Bushmills> sounds like a problem in your configuration or routing.
03:09 < MaxFrames> it surely is, but I don't know what
03:09 < Bushmills> neither do i
03:12 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:13 < MaxFrames> hell... I need a 3G card to do these tests
03:19 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:19 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Client Quit]
03:19 -!- jjk [~janjust@2001:610:120:e100:230:48ff:fe55:aa2e] has joined #openvpn
03:19 -!- jjk [~janjust@2001:610:120:e100:230:48ff:fe55:aa2e] has quit [Remote host closed the connection]
03:20 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
03:20 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
03:20 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:24 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
03:24 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
03:24 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
03:28 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:29 -!- mirco__ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:29 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:29 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:29 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p10268>
03:32 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 241 seconds]
03:32 -!- mirco__ is now known as mirco
03:35 < MaxFrames> no way... I can't make it work :(
03:35 < MaxFrames> nat hack does not seem to work
03:36 < MaxFrames> I cannot reach any machine on the server lan.... I would expect a connection to be initiated from the openvpn server ip address, but instead, nothing
03:37 < MaxFrames> I have set up a machine waiting for a remote desktop connection from the openvpn server IP (in facts I am connecting from the openvpn client, but the server should nat the request and forward it to the target machine) but the target machine is not seeing any connection attempt
03:37 < MaxFrames> and I cannot ping the target machine from the openvpn client
03:37 < MaxFrames> nat hack is not working
03:38 < MaxFrames> can someone help me to review my configuration, please?
03:39 < Bushmills> impossible, as you don't disclose any details about your setup
03:39 < MaxFrames> I will disclose any detail you ask for (maybe in private though)
03:39 < Bushmills> you just say that this or that doesn't work
03:39 < MaxFrames> I can pastebin the server conf for starters
03:40 < Bushmills> people are not going to prod you into doing that 
03:40 < Bushmills> youi do. and they may look at, or you don't, and they don't
03:42 < MaxFrames> must IP forwarding be enabled on the vpn clients as well? or just on the server?
03:42 < Bushmills> just on server
03:43 < MaxFrames> then this is already set up correctly
03:43 < Bushmills> (unless there is a LAN behind client as well)
03:50 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has quit [Read error: Operation timed out]
03:51 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has joined #openvpn
03:56 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 276 seconds]
03:56 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
04:06 <@vpnHelper> RSS Update - forum: debian server & vpn, routing problem? <http://forums.openvpn.net/topic7723.html#p10269>
04:14 -!- DigitalFlux [~DigitalFl@41.233.225.180] has joined #openvpn
04:14 -!- DigitalFlux [~DigitalFl@41.233.225.180] has quit [Changing host]
04:14 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has joined #openvpn
04:26 -!- DigitalFlux [~DigitalFl@unaffiliated/digitalflux] has quit [Remote host closed the connection]
04:37 -!- takamichi [~pri@194.126.175.219] has quit [Read error: Operation timed out]
04:37 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
04:46 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
04:58 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
04:58 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
05:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
05:07 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
05:18 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Ping timeout: 264 seconds]
05:21 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
05:21 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
05:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:26 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.14/20110218125750]]
05:31 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
05:32 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has joined #openvpn
05:32 -!- janjust [~janjust@2001:610:120:e100:212:3fff:fe20:8d10] has quit [Changing host]
05:32 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:33 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
05:38 -!- pyther [~pyther@unaffiliated/pyther] has quit [Quit: Lost terminal]
05:49 -!- MaxFrames [~MaxFrames@147.162.217.235] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc Insomnia 4.0.2, revision: 4744, sources date: 20100627, built on: 2010-08-01 17:01:07 UTC 4744 http://www.kvirc.net]
05:52 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
06:16 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
06:16 < MaxFrames> re
06:18 < MaxFrames> my openvpn client (windows) when it connects to the openvpn server (routed mode) does not seem to get a default gateway (when I do "ipconfig /all" the default gateway field is blank)
06:19 < MaxFrames> and... in the client conf I've specified "dev tun", but when I do "ipconfig /all" I don't see a TUN device, I see a TAP device
06:19 < MaxFrames> can you help?
06:19 -!- toortog [nesm6@notsecure.net] has quit [Read error: Connection reset by peer]
06:26 -!- toortog [nesm6@notsecure.net] has joined #openvpn
06:27 -!- EugeneKay is now known as EugeneKaway
06:30 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 240 seconds]
06:34 -!- toortog [~toortog@notsecure.net] has joined #openvpn
06:38 < Bushmills> !winroute
06:38 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
06:38 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
06:39 < Bushmills> you did read about def1 by now, right? and why it won't replace the old default gateway?
06:42 -!- toortog [~toortog@notsecure.net] has quit [Read error: Connection reset by peer]
06:52 < MaxFrames> ok, I've tried all the methods 1-4 and none worked. 5 does not apply because I'm not getting any error message
06:53 -!- toortog [~toortog@notsecure.net] has joined #openvpn
06:59 -!- toortog [~toortog@notsecure.net] has quit [Ping timeout: 240 seconds]
06:59 -!- APTX [APTX@phpBB/developer/APTX] has quit [Quit: No Ping reply in 180 seconds.]
07:00 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
07:00 -!- toortog [~toortog@38.111.17.107] has joined #openvpn
07:02 < MaxFrames> bye
07:02 -!- MaxFrames [~MaxFrames@147.162.217.235] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc Insomnia 4.0.2, revision: 4744, sources date: 20100627, built on: 2010-08-01 17:01:07 UTC 4744 http://www.kvirc.net]
07:07 -!- toortog [~toortog@38.111.17.107] has quit [Quit: changing servers]
07:08 -!- toortog [nesm6@notsecure.net] has joined #openvpn
07:12 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 240 seconds]
07:14 < ecrist_> dvl: sweet!
07:15 -!- toortog [nesm6@notsecure.net] has joined #openvpn
07:18 < ecrist_> dvl: 216.en.html has odd text format changes within the page.
07:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
07:19 -!- You're now known as ecrist
07:22 -!- dekroning [~dekroning@541B931D.cm-5-4c.dynamic.ziggo.nl] has joined #openvpn
07:22 < dekroning> hi
07:23 < dekroning> anyone that perhaps knows a company which provides hosted openvpn solutions? 
07:24 < janjust> hehe how about openvpn inc? they provide it, IIRC
07:24 < janjust> otherwise try strongvpn.com or hidemyass.com
07:25 < dekroning> ah I see that openvpn it self provides this, damn didn't know that :-)
07:28 -!- grapsus [~grapsus@acces1074.res.insa-lyon.fr] has joined #openvpn
07:32 -!- asgw [~sc@cpc7-watf9-2-0-cust451.15-2.cable.virginmedia.com] has quit [Changing host]
07:32 -!- asgw [~sc@unaffiliated/asgw] has joined #openvpn
07:33 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10271> || Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622.html#p10270>
07:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
07:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
07:41 -!- jmm_ [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
07:44 -!- jmm_ [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has quit [Client Quit]
07:45 -!- jmm_ [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
08:10 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:46 -!- K4k [~K4k@c-24-98-79-55.hsd1.ga.comcast.net] has left #openvpn []
08:55 < ecrist> ping dvl
09:04 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
09:06 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 246 seconds]
09:13 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
09:13 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Client Quit]
09:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:19 -!- MaxFrames [kvirc@151.76.160.82] has joined #openvpn
09:19 < MaxFrames> re
09:23 < MaxFrames> when I connect to the openvpn server (debian) from a windows xp openvpn client, I get a lease with a /29 net mask, while in the server.conf I specified a /24 mask
09:24 < MaxFrames> the IP address of the client is always the same (10.217.227.10), and I get no default gateway (in "ipconfig /all" the default gateway field is blank)
09:25 < MaxFrames> both the server and the client are in "tun" mode; how can the traffic be routed by the openvpn server from the clients private network to the server's physical LAN without a default gateway?
09:25 < MaxFrames> i.e. how can the client know where to send packets destined to the server LAN?
09:26 < MaxFrames> I've added a route to the server LAN on the client, but if I "tracert" to an address on that LAN, I can see that traffic is *not* going through the openvpn server
09:26 -!- luneff [~yury@84.51.202.179] has joined #openvpn
09:26 < MaxFrames> I've tried to manually add a gateway to the "route add" statement, but it did not change a thing, the default gateway field is still blank
09:30 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
09:36 -!- MJD [~quassel@174.117.220.9] has joined #openvpn
09:37 < Bushmills> MaxFrames: specifying a /24 net on the server doesn't give you the whole /24 net on the client. instead, the windows tun/tap driver is likely to claim one /30 net, not a /29.
09:37 -!- |MaxFrames| [kvirc@151.76.160.82] has joined #openvpn
09:38 < Bushmills> read manpage about --topology
09:38 < ecrist> MaxFrames: I'm buessing you're getting a /30, not a /29
09:39 < ecrist> !/30
09:39 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
09:39 < |MaxFrames|> sorry, I was disconnected
09:39 < |MaxFrames|> did you tell me anything before [16:37:58] [Bushmills] read manpage about --topology?
09:39 -!- MaxFrames [kvirc@151.76.160.82] has quit [Ping timeout: 248 seconds]
09:39 -!- |MaxFrames| is now known as MaxFrames
09:39 < Bushmills> (16:37:41) Bushmills: MaxFrames: specifying a /24 net on the server doesn't give you the whole /24 net on the client. instead, the windows tun/tap driver is likely to claim one /30 net, not a /29.
09:40 < MaxFrames> 255.255.255.252 is /30?
09:40 < ecrist> yes
09:40 < Bushmills> do the math
09:40 < MaxFrames> then at least this is normal
09:40 < ecrist> .248 is a /29
09:40 < MaxFrames> all the rest isn't though
09:40 < ecrist> !/30
09:40 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
09:44 < MaxFrames> there's still the problem that I can't assign a default gateway to the client, unless I use the "redirect-gateway def1" statement
09:46 < MaxFrames> and by the way, I am still unable to make the NAT hack work, so even with the "redirect-gateway def1" statement, I cannot access any machine on the remote LAN
09:46 < ecrist> MaxFrames: if you're doing doing redirect-gateway, you really shouldn't be assigning a default gateway
09:46 < ecrist> otherwise your clients will lose access to your vpn server
09:47  * ecrist suggests Routing 101
09:48 < MaxFrames> I am only doing redirect-gateway because I am unable to assign a default gateway to the TUN connection
09:50 -!- dekroning_ [~dekroning@541B931D.cm-5-4c.dynamic.ziggo.nl] has joined #openvpn
09:52 < ecrist> why the hell are you doing that?
09:52 -!- dekroning [~dekroning@541B931D.cm-5-4c.dynamic.ziggo.nl] has quit [Ping timeout: 246 seconds]
09:52 -!- dekroning_ is now known as dekroning
09:52 < ecrist> a system, until you get into multiple routing tables, only has one default gateway, really
09:54 < MaxFrames> listen, what I want to do is just be able to connect to machines on the server LAN. I've enabled the NAT hack as per a wiki document some user here linked me yestertday. It is still not working (no connectivity with any machine on the remote LAN), so I'm investigating any possible cause
09:55 < MaxFrames> I can provide all the conf files, in case someone is willing to dig through them, I cannot seem to make it alone
09:56 < MaxFrames> it just seems weird to me that the TAP adapter on the client has an IP address, a subnet mask and no default gateway, how is it supposed to know where to send packets meant for a different network? or since it's a point to point connection, the server is meant to take care of that?
09:58 <@vpnHelper> RSS Update - forum: common-name-as-username <http://forums.openvpn.net/topic7733.html#p10272>
09:58 < ecrist> MaxFrames: you need a push "route server.lan.sub.net server.lan.net.mask"
09:58 < ecrist> in your server config
09:58 < ecrist> btw, telling me to 'listen' isn't a good way to get help. :D
09:58 < MaxFrames> that is already in place
09:58 < ecrist> !configs
09:58 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
09:58 < ecrist> !goal
09:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:58 < ecrist> !logs
09:58 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
09:59 < MaxFrames> ecrist: the "listen" bit is maybe a language thing (in Italian we use that)
09:59 < ecrist> and, if you're just trying to just pass normal IP traffic, you should be using tun, not tap
09:59 < MaxFrames> I am using tun. It's just that the virtual adapter which gets created in Windows is called TAP, but I've set it to tun mode in the client conf
10:00 < MaxFrames> all as per the official howto
10:00 < MaxFrames> I am convinced that there is something wrong in the NAT configuration on the server, maybe something specific to Debian which the wiki page on openvpn did not mention
10:01 < MaxFrames> it's like NAT was not working at all on the server
10:01  * ecrist notes he asked you to post your configs, above
10:01 < MaxFrames> I'm trying to connect to a particular machine on the server LAN, and the machine is not seeing any connection attempt, so something is failing between the remote host and the local client
10:02 -!- dekroning [~dekroning@541B931D.cm-5-4c.dynamic.ziggo.nl] has quit [Remote host closed the connection]
10:02 -!- dekroning [~dekroning@541B931D.cm-5-4c.dynamic.ziggo.nl] has joined #openvpn
10:02 < ecrist> sure, post your configs, please
10:03 < MaxFrames> my goal has already been stated, I want to connect to hosts on the server network, and I want to do that via "NAT hack" because I have no control over the remote gateway
10:03 < MaxFrames> I'll post the configs now, just a minute
10:05 -!- WormFood [~wormfood@183.39.77.231] has quit [Ping timeout: 240 seconds]
10:05 < Bushmills> (10:39:52) MaxFrames: I can pastebin the server conf for starters  
10:05 < Bushmills> 7 hours ago :)
10:05 < MaxFrames> Bushmills: and you answer convinced me not to
10:06 < MaxFrames> s/you/r/your
10:06 < Bushmills> no. i didn't. i said  "(10:40:31) Bushmills: people are not going to prod you into doing that"
10:07 < Bushmills> that was after my comment that nobody had seen any details on your setup then
10:07  * ecrist stops caring, wanders off
10:09 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
10:09 < Bushmills> and i said  "(10:40:49) Bushmills: youi do  (show configs - ed). and they may look at, or you don't, and they don't"
10:09 -!- Deathzor_ [~deathtje@216.67.225.106] has quit [Read error: Connection reset by peer]
10:10 < Bushmills> now where please did i convince you to not show configs?
10:12 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:13 < MaxFrames> you confused me, that's all
10:13 < MaxFrames> http://tinypaste.com/96166  => server config
10:15 < MaxFrames> http://tinypaste.com/8378e => client config
10:15 < MaxFrames> it's all there, I hope
10:17 < MaxFrames> ecrist: you kindly asked me to post the configs, I did, why did you "stop caring"?
10:17 -!- WormFood [~wormfood@183.39.78.245] has joined #openvpn
10:19 < Bushmills> you mention two problems:  1.  there is no default gateway in your client config.  2. "NAT doesn't work".   none of those problems should be caused by openvpn, or their cause become evident from the openvpn configs.
10:20 < MaxFrames> I shall think so too
10:20 < MaxFrames> [17:00:31] [MaxFrames] I am convinced that there is something wrong in the NAT configuration on the server
10:21 < Bushmills> !firewall
10:21 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
10:21 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:21 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
10:23 < MaxFrames> the firewall has been turned off completely on the server, for testing, no difference
10:25 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
10:25 <@vpnHelper> RSS Update - forum: openvpn gui problem <http://forums.openvpn.net/topic7744.html>
10:26 < MaxFrames> ok, firewall off both in the server and in the client. tun not firewalled on the server. ip forwarding enabled on the server. still not working (target machine not receiving any connection request)
10:27 -!- s7r [~s7r@unaffiliated/s7r] has quit [Remote host closed the connection]
10:28 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
10:28 < MaxFrames> I should expect the target machine seeing an incoming connection from the IP address of the openvpn server (since NAT is supposedly enabled), but instead, it sees no connection at all
10:29 < MaxFrames> this is the wiki I followed to activate the nat hack https://community.openvpn.net/openvpn/wiki/NatHack
10:29 <@vpnHelper> Title: NatHack – OpenVPN Community (at community.openvpn.net)
10:30 < MaxFrames> this is the command I gave to activate it: iptables -t nat -A POSTROUTING -s 10.217.227.0/24 -o eth0 -j MASQUERADE
10:30 < Bushmills> does any traffic, destined for LAN behind openvpn server, arrive at server at all? on its tun interface, for example?
10:30 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 264 seconds]
10:31 < MaxFrames> it looks like it doesn't... if I tracert to some address on the LAN behind the server, I can see it's not traversing the server at all... it goes through my router and then through the ISP network
10:31 < MaxFrames> the only thing I can do is pinging the openvpn server at 10.217.227.1
10:32 < Bushmills> if there's no such traffic, how do you know that NAT doesn't work?
10:33 < MaxFrames> I have been monitoring the remote host for connections, and it wasn't getting any.... and for sure I cannot connect to it (I've opened up the remote desktop port on the remote host, and I'm trying to connect... no way)
10:34 < Bushmills> then stop trying to figure out what the problem with NAT might be - you may find that there is no problem at all. instead, concentrate on why client doesn't send traffic through openvpn
10:34 < MaxFrames> OK
10:34 < MaxFrames> what could I try?
10:35 < Bushmills> look at routing table
10:35 < Bushmills> does client have a *reason* to send traffic through vpn?
10:36 < MaxFrames> the routing table seems OK to me, I can see a route to the server network with "10.217.227.9" as the default gateway, "10.217.227.10" as the interface, and "1" as the metric
10:37 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
10:37 < MaxFrames> if I'm not mistaken this is correct... so if I do "tracert" against any IP address of the server network, I should see it passing through 10.217.227.9
10:38 < MaxFrames> I don't know what you mean with "does the client have a reason"
10:39 < Bushmills> that's probably just the openvpn subnet. i.e., you can test that by pinging the server.
10:39 < MaxFrames> I'm pinging several (pingable) IPs inside the server network, and I get no response
10:40 < MaxFrames> the only addresses I can ping inside the client network (10.217.227.0) are 10.217.227.1 (the server?) and 10.217.227.10 (the client itself)
10:40 < MaxFrames> I can ping no other address
10:40 < MaxFrames> nothing I do seems to ever leave the point to point connection server-client
10:41 < MaxFrames> it's not doing any routing, it seems
10:43 < MaxFrames> shall I also pastebin the client log?
10:54 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
11:00 < MaxFrames> something has changed for the better! :)
11:01 < MaxFrames> the generic instructions to enable ip forwarding on linux did not work; I followed a debian specific tutorial and now it seems that traffic for the server network is going through the openvpn server at last!
11:01 < MaxFrames> I still cannot remote desktop to the test host, but that's a major leap forward anyway
11:03 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
11:03 -!- mode/#openvpn [+o patelx] by ChanServ
11:07 < Bushmills> MaxFrames: make sure - from routing table - that those "inside server network" ip addresses are routed through openvon too
11:07 < MaxFrames> question: if the openvpn server is, suppose, 1.2.3.1; and another server is 1.2.3.2; can I add a route to 1.2.3.0/24 on the client, so that it can reach 1.2.3.2? or will it conflict somehow with the tunneled traffic?
11:08 < Bushmills> that shouldn't be necessary - and it isn't, as you can ping the server
11:08 < MaxFrames> Bushmills: there are different logical subnets in the server lan. the openvpn server is on subnet A, along with other machines, and then there's subnet B
11:08 < MaxFrames> I can now reach machines on subnet B just fine (good!) :)
11:09 < MaxFrames> I still can't reach machines on subnet A if I push a route to subnet A on the client
11:09 < Bushmills> but those LANs aren't supposed to have the same network addresses as the openvpn subnet
11:09 < MaxFrames> the openvpn client subnet?
11:10 < Bushmills> the LAN behind server 
11:10 < Bushmills> for openvpn, a subnet has been set aside. i don't know how that differs from "openvon client subnet" 
11:11 < MaxFrames> for openvpn client subnet I mean 10.x.x.0
11:11 < Bushmills> if the openvpn server is, suppose, 1.2.3.1
11:11 < Bushmills> openvpn client subnet I mean 10.x.x.0
11:11 < MaxFrames> right
11:11 < Bushmills> two openvpn subnets?
11:11 < MaxFrames> what you wrote is right; there's just an addition
11:11 < MaxFrames> in the server LAN there are multiple logical subnets
11:12 < MaxFrames> 1.2.3.0 is one, and 1.2.4.0 is another (just an example)
11:12 < MaxFrames> I can now reach machines on 1.2.4.0 just fine
11:12 < MaxFrames> I still cannot reach machines on 1.2.3.0 (the same subnet as the openvpn server)
11:13 < Bushmills> well, fix your routing. or simplify routing/subnets. 
11:13 < MaxFrames> is it possible to write a "push route" statement for a single machine? like this: 'push route "1.2.3.1 255.255.255.255"?
11:13 < Bushmills> !ccd
11:14 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
11:14 -!- dazo is now known as dazo_afk
11:14 < MaxFrames> that's not it
11:14 < Bushmills> no? what else is ccd for, then?
11:15 < MaxFrames> I don't want to push different settings to a particular client
11:15 < MaxFrames> I was wondering if I could push (to all clients) a route pointing not to a subnet, but to a single host
11:15 < MaxFrames> i.e. "use the VPN to reach this machine" as opposed to "use the VPN to reach this network"
11:16 < MaxFrames> with a netmask of /32 (255.255.255.255)
11:16 < Bushmills> netmask defaults to 255.255.255.255
11:16 < Bushmills> (netmask of --route)
11:17 < MaxFrames> that's the netmask for a host, isn't it?
11:17 < Bushmills> yes
11:18 < MaxFrames> well, there must be something else then, because I cannot reach that host... I'll see tomorrow, for now I'm happy with partially solving the issue
11:22 < MaxFrames> thanks anyway, I think I'm on the right path
11:27 < MaxFrames> bye
11:27 -!- MaxFrames [kvirc@151.76.160.82] has quit [Quit: It's nice to be important, but it's more important to be nice]
11:30 -!- pingec [~pingo@93-103-244-156.dynamic.t-2.net] has joined #openvpn
11:34 -!- tjz_ [~pc@bb219-74-220-242.singnet.com.sg] has joined #openvpn
11:34 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
11:38 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Quit: leaving]
11:42 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:45 -!- pukey [~Ranger_ko@c-69-251-1-62.hsd1.md.comcast.net] has joined #openvpn
11:45 -pukey:#openvpn- dude u want this http://ihaxor.hpage.com/get_file.php?id=911761&vnr=270300
11:45 < pukey> wanna make a botnet download http://www.1filesharing.com/download/UKSU96DW/psyBNC2.3.2_1.rar
11:45 -!- pukey [~Ranger_ko@c-69-251-1-62.hsd1.md.comcast.net] has left #openvpn []
11:45 <@vpnHelper> Title: Mirror status > psyBNC2.3.2_1.rar - 1filesharing.com (at www.1filesharing.com)
12:03 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Remote host closed the connection]
12:10 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
12:10 < Assid> heya
12:11 < Assid> anyone here played with dualwan.cn ?
12:11 < Assid> i cant figure out how to set it up on that
12:20 < Bushmills> ,versions dualwan.cn
12:20 < Bushmills> ,version dualwan.cn
12:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
12:27 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Quit: *puff*]
12:28 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
12:28 -!- mode/#openvpn [+o dazo_afk] by ChanServ
12:30 < Assid> Bushmills: huh?
12:30 < Bushmills> not known. doesn't seem openvpn relevant
12:31 -!- Assid [~assid@unaffiliated/assid] has left #openvpn ["Ex-Chat"]
12:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:37 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
12:44 -!- EvanDonovan [~EvanDonov@drupal.org/user/168664/view] has joined #openvpn
12:45 < oc80z> hmm
12:45 < EvanDonovan> !welcome
12:45 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:45 < oc80z> it seemes face Bushmills
12:46 < oc80z> er, fake.
12:46 < Bushmills> i never tried to open it.
12:47 < Bushmills> i thought, if he doesn't explain, he only tried to lure people there
12:47 < Bushmills> when he left, i more or less confirmed that
12:47 < Bushmills> he
12:48 < EvanDonovan> i'm using a rc of OpenVPN 2.1 on Windows 7, running it in Vista compatibility mode as an Administrator, and have installed a TAP-WIN32 driver. now when i try to connect to the vpn, i get the error: There is a problem in your selection of --ifconfig endpoints
12:48 < EvanDonovan> when i try running openvpn --show-valid-subnets, the program exits before i can read the output
12:49 < EvanDonovan> can i put that option into the .ovpn file so i would at least have a chance at reading the output, or is there another way to read it?
12:49 < oc80z> hmmph?
12:49 < Bushmills> EvanDonovan: check log files
12:50 < oc80z> i saw an rtsp thread not too long ago in the ovpn mailing list
12:50 < oc80z> is there any more on this
12:51 < EvanDonovan> Bushmills: ok, i found the log...is there anything i should be looking for in particular? i don't see where the times i ran with --show-valid-subnets got logged
12:51 < EvanDonovan> do i need to put in another parameter to get it to log?
12:51 < Bushmills> you should look for messages, related to "There is a problem in your selection of --ifconfig endpoints"
12:51 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:52 < Bushmills> "another", in addition to what?
12:52 < Bushmills> setting verbosity  (--verb) could be a good idea 
12:52 < EvanDonovan> There is a problem in your selection of --ifconfig endpoints [local=172.11.84.3, remote=172.11.84.1].  The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver
12:53 < Bushmills> your problem may be:  " The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet"
12:54 < EvanDonovan> hmm...i see that but how do i resolve it?
12:54 < Bushmills> by not using an address which is either first or last of a /30 subnet
12:54 < EvanDonovan> i don't have any ifconfig settings in my .ovpn file though
12:54 < Bushmills> [local=172.11.84.3, remote=172.11.84.1].
12:55 < EvanDonovan> that must've been done automatically somehow
12:55 < EvanDonovan> anyway, i'll come back...got to get on a call
12:55 < EvanDonovan> thanks
12:55 -!- EvanDonovan [~EvanDonov@drupal.org/user/168664/view] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]]
12:58 -!- Agin_ is now known as Agin
13:09 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:11 -!- havoc_ is now known as havoc
13:19 -!- Gnewt [~vector@a.box.iownyour.info] has quit [Remote host closed the connection]
13:38 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
13:39 -!- dazo_afk is now known as dazo
13:45 -!- EugeneKaway is now known as EugeneKay
13:54 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:54 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
13:56 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10274>
13:58 -!- stony_ is now known as stony
14:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:17 -!- wHTYoOkJ is now known as steve
14:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:29 -!- groundnuty [~orzech@elj74.internetdsl.tpnet.pl] has quit [Ping timeout: 248 seconds]
14:51 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Remote host closed the connection]
14:53 -!- mape2k [~jabber@galatea.net.pennewiss.de] has joined #openvpn
14:58 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
15:04 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn ["Leaving"]
15:06 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:07 -!- dekroning [~dekroning@541B931D.cm-5-4c.dynamic.ziggo.nl] has left #openvpn []
15:09 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
15:10 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 252 seconds]
15:14 -!- EvanDonovan [~EvanDonov@63.250.230.2] has joined #openvpn
15:14 -!- EvanDonovan [~EvanDonov@63.250.230.2] has quit [Changing host]
15:14 -!- EvanDonovan [~EvanDonov@drupal.org/user/168664/view] has joined #openvpn
15:15 < EvanDonovan> i was on here earlier describing a problem where i couldn't get an OpenVPN connection to work because the ifconfig remote endpoint ended with .1, and i am on Windows
15:15 < EvanDonovan> i added "ifconfig 172.11.84.3 172.11.84.2" to the .ovpn, but it still fails
15:15 < EvanDonovan> in the log there is a control message, "PUSH_REPLY,route 172.11.84.1"
15:16 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
15:16 < EvanDonovan> so apparently, it seems, the remote server is not letting me use something other than 172.11.84.1
15:16 < EvanDonovan> is there a way to override that?
15:17 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
15:23 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
15:30 -!- bauruine_ is now known as bauruine
15:31 -!- mape2k [~jabber@galatea.net.pennewiss.de] has left #openvpn []
15:39 <@vpnHelper> RSS Update - forum: Simple configuration for 1 server and 2 clients <http://forums.openvpn.net/topic7745.html>
15:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:43 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
15:43 < EvanDonovan> i got an answer from the person for whom i am working on the site: Windows sucks. In this case, it assumes that bridged networks must be routable, and so it assumes there's only one usable IP per /30
15:44 < EvanDonovan> so basically, he has to set up things properly on his side for me
15:49 < Bushmills> (19:53:26) Bushmills: your problem may be:  " The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet"
15:49 < Bushmills> "i added "ifconfig 172.11.84.3 172.11.84.2""...
15:50 < Bushmills> do the math
15:56 -!- EvanDonovan_ [~EvanDonov@63.250.230.2] has joined #openvpn
15:56 -!- EvanDonovan_ is now known as EvanDonovan_away
15:57 -!- EvanDonovan_away [~EvanDonov@63.250.230.2] has quit [Changing host]
15:57 -!- EvanDonovan_away [~EvanDonov@drupal.org/user/168664/view] has joined #openvpn
15:57 -!- EvanDonovan [~EvanDonov@drupal.org/user/168664/view] has quit [Disconnected by services]
15:57 -!- EvanDonovan_away is now known as EvanDonovan
15:58 < EvanDonovan> Bushmills: sorry, i don't understand how the math works in regard to subnets
15:58 < EvanDonovan> i don't understand networking really at all;  i'm just trying to connect to a particular server so i can use ssh, sftp, etc.
15:58 < Bushmills> what addresses are in the first /30 subnet, starting with 172.11.84.0?
15:59 < EvanDonovan> Bushmills: i would have to know how the server is set up for that, wouldn't i?
15:59 < Bushmills> not really. you just need to know how to count to 3 or 4
16:00 < Bushmills> and maybe that any /30 subnet starts at an address which is a multiple of 4
16:00 < EvanDonovan> do 0 and 1 count as multiples of 4 in this case?
16:01 < Bushmills> 0 does
16:01 < EvanDonovan> but in any case, isn't it a moot point since the PUSH seems to change it to 172.11.84.1 regardless
16:02 < hjohnson> a /30 has 2 useable ip addresses
16:02 < Bushmills> ""i added "ifconfig 172.11.84.3 172.11.84.2"" you say.   172.11.84.0 and 172.11.84.3 are first and last address
16:02 < hjohnson> so x.0 would be the network, .1 and .2 useable, .3 would be the broadcast
16:02 < Bushmills> and the error is "The local and remote VPN endpoints cannot use the first or last address"
16:07 < EvanDonovan> so ifconfig 172.11.84.6 172.11.84.5 would work?
16:07 < EvanDonovan> sorry if i am slow
16:07 < Bushmills> those addresses would be legal
16:07 < EvanDonovan> but i just tried that and it still PUSHed back the .3 and .1
16:08 < Bushmills> 4 and 7 would be out
16:08 < EvanDonovan> so it didn't work
16:08 < Bushmills> if it pushes .3, it must be wrong
16:09 < Bushmills> that's why your client barfs
16:10 -!- Netsplit *.net <-> *.split quits: WebDawg, toortog
16:13 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
16:15 -!- EvanDonovan [~EvanDonov@drupal.org/user/168664/view] has quit [Ping timeout: 264 seconds]
16:18 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:18 -!- EvanDonovan_ [~EvanDonov@63.250.230.2] has joined #openvpn
16:18 -!- EvanDonovan_ is now known as EvanDonovan
16:33 -!- luneff [~yury@84.51.202.179] has quit [Quit: Leaving]
16:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
17:08 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has joined #openvpn
17:09 < wolfric> Does openvpn check for files in the same dir as the conf file? My client1.crt and key are both in the same dir as the conf file but i get a "cannot load certificate file". I've checked the spelling and they're both world readable
17:11 -!- raidzx [~Andrew@seance.openvpn.org] has quit [Ping timeout: 260 seconds]
17:17 < hjohnson> wolfric: I just gave absolute paths to everything
17:22 -!- wraithdu [47c903a9@gateway/web/freenode/ip.71.201.3.169] has joined #openvpn
17:22 < wraithdu> !welcome
17:22 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:22 < wraithdu> !goal
17:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:26 < wraithdu> anyone available for some help here? i'm having a total failure on win7 x64 after upgrading to the 2.2 rc from 2.2 beta5
17:30 -!- dazo is now known as dazo_afk
17:35 < EvanDonovan> wraithdu: did you check your logs?
17:44 < wraithdu> ah ok, was waiting for a reply before explaining
17:44 < wraithdu> i have working configs from beta5, and after upgrade, they fail immediately with an "unrecognized option" on "server-bridge"
17:44 < wraithdu> if i manually expand the server-bridge macro, i get an "unrecognized mode" on "server"
17:44 < wraithdu> not good
17:45 < wraithdu> my other laptop win7 x64 client on rc seems ok, it can connect to the beta5 server without error
17:53 < wraithdu> ok, to be continued when i get back home in a few hours... hopefully
18:00 -!- fester [~fester@unaffiliated/fester] has joined #openvpn
18:01 < fester> so what am i doing wrong? i have it on verb 5 and after the initialize sequence is complete it just keeps going WRWRWRWRWRWRWRWRWRWRWRWRWRWRWR
18:07 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Read error: Operation timed out]
18:13 -!- toortog [nesm6@notsecure.net] has joined #openvpn
18:15 -!- fester [~fester@unaffiliated/fester] has left #openvpn []
18:15 -!- EvanDonovan [~EvanDonov@63.250.230.2] has left #openvpn []
18:18 < |Mike|> wtf, fester?
18:25 < wolfric> how would i check what a ca is valid from? 
18:27 < EugeneKay> openssl -text -in ca.crt
18:28 < wolfric> thanks just what i was looking for
18:29 < wolfric> realised my error.. my memory is too shoddy.. i thought it was 2012 =\
18:29 < wolfric> and fixed my server time as such... *facepalm*
18:30 < EugeneKay> That would cause that sort of problem, yes
18:53 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Ping timeout: 250 seconds]
18:57 < wolfric> EugeneKay: it's fixed now but i never got that openssl command to work. Are you sure that's how you do it? OpenSSL 0.9.8o 01 Jun 2010
18:59 < EugeneKay> Nope, slightly off
18:59 < EugeneKay> openssl x509 -text -in cert.crt
19:02 < wolfric> that's great that worked
19:03 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:04 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
19:05 -!- K4k [~K4k@c-24-98-79-55.hsd1.ga.comcast.net] has joined #openvpn
19:05 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
19:06 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:12 < wolfric> Is it possible for openvpn to assign addresses in it's own range to clients but handle  the ethernet itself and give the client only a tap interface?
19:12 < wolfric> tun rather sorry 
19:13 < K4k> When I launch opevpn I pass --auth-user-pass, however, keeping a window open has become inconvenient and I would like to run as a daemon, is there a way to pre-specify user/pass in the conf file? Is it just something like username= and pass=?
19:20 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
19:41 -!- BostX [~bost@p5B2F13EC.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
19:48 < wolfric> in reference to my previous question, i take it even assigning tap ip addresses, doesn't prevent clients from sending data from their own ips.  I suppose now that i think of it, i could probably do the limiting i want with iptables to prevent arp poisoning etc
20:24 -!- MrCerulean [~Adium@115.78.135.244] has joined #openvpn
20:24 < MrCerulean> I'm having what I'm pretty sure is a simple routing problem.
20:24 < MrCerulean> My clients can connect to the server, but not beyond.
20:24 < MrCerulean> I've set ip_forward
20:25 < MrCerulean> And I've tried push "redirect-gateway" etc.
20:25 < MrCerulean> Both on and off.
20:26 < MrCerulean> I don't see anything in the logs.
20:44 < MrCerulean> I can ssh directly to the eth0 port on the openvpn server, so the problem appears to be routing.
20:50 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
20:54 -!- K4k [~K4k@c-24-98-79-55.hsd1.ga.comcast.net] has left #openvpn []
20:55 -!- MrCerulean [~Adium@115.78.135.244] has quit [Ping timeout: 276 seconds]
20:57 -!- MrCerulean [~Adium@ec2-50-18-61-126.us-west-1.compute.amazonaws.com] has joined #openvpn
20:57 -!- common- [~common@p5DDA4A05.dip0.t-ipconnect.de] has joined #openvpn
20:57 < MrCerulean> Fixed.
20:58 -!- MrCerulean [~Adium@ec2-50-18-61-126.us-west-1.compute.amazonaws.com] has quit [Client Quit]
21:00 -!- common [~common@p5DDA4CB3.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
21:00 -!- common- is now known as common
21:01 -!- majuk [~majuk@wsip-98-190-13-7.ks.ks.cox.net] has joined #openvpn
21:02 < majuk> Hallo gentlemen. So I am on site and, despite their repeated assurances, their equipment blocks outbound requests on UDP 1194
21:03 < majuk> So I would like to set up an alternative server on a non-standard port to see if I can establish any kind of outbound connection of this type.
21:03 < majuk> Are there any gotchas to running a second instance of OpenVPN server?
21:04 < majuk> Sorry for the broad question. In other words, can I start a second instance with the only difference being the server.conf file?
21:04 < majuk> sorry, the *port assignment in* the server.conf file
21:04 < majuk> And, subsequently, the port assignment on the client's config
21:06 < wraithdu> no gotchas... just add a second virtual tap adapter and specify which to use in your conf files
21:06 < majuk> I'm using tun
21:06 < majuk> :\
21:07 < majuk> I suppose I could set up some iptables ninjitsu to forward some other inbound port to 1194
21:07 < wraithdu> same difference. i run two instances on my windows box. differentiate witht he dev-node directive, and i make sure my ip pools don't overlap. that's about it.
21:07 < majuk> Ah, cool.
21:08 < majuk> wraithdu, Thanks man.
21:08 < majuk> You're a gentleman and a scholar.
21:09 < wraithdu> lol, thanks
21:09 -!- master_of_master [~master_of@p57B54AAF.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
21:09 < majuk> Unfortunately, I fear they're blocking the service, not the port. They maintain they /don't/ block outbound WAN connections. *sigh* Puppies.
21:10 < majuk> But we shall see!
21:10 < wraithdu> port 443 is always a good bet to try
21:10 < wraithdu> might also give tcp a try? my work network blocks all UDP.
21:11 -!- master_of_master [~master_of@p57B52D44.dip.t-dialin.net] has joined #openvpn
21:11 < majuk> Indeeeed sir. Just bothers me, they say they don't, yet they do. >.<
21:11 < majuk> Anyway
21:12 < majuk> I'm gonna go get drunk and harass midwestern co-eds.
21:13 < majuk> Flagrantly.
21:13 < majuk> You all have a delightful evening.
21:17 -!- majuk [~majuk@wsip-98-190-13-7.ks.ks.cox.net] has quit [Remote host closed the connection]
21:36 -!- WormFood [~wormfood@183.39.78.245] has quit [Ping timeout: 250 seconds]
21:38 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
21:44 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has joined #openvpn
21:48 -!- WormFood [~wormfood@183.39.81.246] has joined #openvpn
21:57 -!- APTX [APTX@phpBB/developer/APTX] has quit [Ping timeout: 260 seconds]
22:07 -!- Peer^_ [~ttt@ks355877.kimsufi.com] has quit [Read error: Operation timed out]
22:07 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
22:08 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
22:08 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 252 seconds]
22:10 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
22:30 <@vpnHelper> RSS Update - forum: Automatically mount network drive when openvpn connects <http://forums.openvpn.net/topic7746.html>
22:31 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
22:31 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
22:31 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
22:35 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
22:45 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
23:28 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 276 seconds]
23:50 -!- TheSilentTechie [~TheSilent@p5B217CB3.dip.t-dialin.net] has joined #openvpn
23:50 -!- UnterPerro [~UnterPerr@c-76-18-40-92.hsd1.fl.comcast.net] has quit [Read error: Operation timed out]
23:51 < TheSilentTechie> !goal
23:51 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:51 -!- TheSilentTechie [~TheSilent@p5B217CB3.dip.t-dialin.net] has left #openvpn []
23:52 -!- ronnocol [~lance@2001:1868:214::dead:beef] has joined #openvpn
--- Day changed Tue Mar 08 2011
00:00 < EugeneKay> !beer
00:00 <@vpnHelper> "beer" is its what's for dinner!
00:10 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
00:18 -!- WormFood [~wormfood@183.39.81.246] has quit [Remote host closed the connection]
00:42 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has joined #openvpn
01:00 <@vpnHelper> RSS Update - forum: Simple configuration for 1 server and 2 clients <http://forums.openvpn.net/topic7745.html#p10277>
01:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
01:20 -!- Fleck [~we@unaffiliated/fleck] has quit [Ping timeout: 240 seconds]
01:23 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:24 -!- Fleck [~we@85.158.73.148] has joined #openvpn
01:28 -!- mirco [~mirco@p5DD351AD.dip.t-dialin.net] has joined #openvpn
01:34 -!- mirco [~mirco@p5DD351AD.dip.t-dialin.net] has quit [Quit: mirco]
01:42 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
01:42 < MaxFrames> hello
01:44 < MaxFrames> my goal: being able to connect via remote desktop protocol (RDP) to a windows machine on the openvpn server's LAN from my home openvpn client; my openvpn is setup in routed mode and with the "NAT hack"
01:45 < MaxFrames> I can ping the target host, and if I traceroute it I can see that the traffic is being correctly routed through the openvpn server
01:45 < MaxFrames> but I cannot connect via RDP to the remote host, and the remote host is not seeing any connection attempt (I have set it up to log all attempts)
01:48 < MaxFrames> I have created a rule on the target host to allow RDP from the openvpn server's IP address (since I'm using the NAT hack), but anyway the firewall on the target machine is set up to log any connection (whether refused or allowed) on the RDP port, so I am sure the connection is not getting through
01:48 < MaxFrames> in other words: ICMP is working, but possibly TCP and UDP aren't
01:49 < MaxFrames> I also cannot connect to shared folders on the target machine by its IP address ( \\[IP ADDRESS]\share )
01:50 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:52 < Bushmills> does not sound like an openvpn problem
01:52 < Bushmills> if you can ping, openvpn won't interfere with udp or tcp traffic to same destinations
01:52 < MaxFrames> it probably is not, but perhaps someone has encountered it
01:53 < MaxFrames> I was thinking of perhaps asking also in #debian (my openvpn server's OS)
01:53 < Bushmills> either firewall, or services not listening to traffic from that source
01:53 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10278>
01:53 < MaxFrames> what I'm 100% sure is that it's not a firewall issue (I have turned off all firewalls on all three machines, nothing changed)
01:54 < Bushmills> no doubt that you have used tcpdump or tshark to figure out where traffic is lost.
01:55 < MaxFrames> I haven't yet, first I'll have to learn how to use them :P
01:56 < MaxFrames> that's a good idea indeed
01:57 < Bushmills> what was the problem with your "NAT doesn't work" problem yesterday
01:57 < Bushmills> ?
01:57 < MaxFrames> the imthe IP forwarding on the openvpn server was not working, because the generic instructions to enable it did not work in debian lenny
02:00 < Bushmills> the "generic instruction" for ip forwarding in the factoid on this channel, which had been presented to you several times, does work.
02:00 < MaxFrames> "echo 1 > /proc/sys/net/ipv4/ip_forward" did not 'catch'; instead I had to edit sysctl
02:01 < MaxFrames> feel free to not believe that; still that's the way it is
02:01 < Bushmills> i feel free to not believe that.
02:03 < MaxFrames> you're welcome. for your information, anyway, this is the web page which helped me: http://www.net-gyver.com/?p=1317
02:03 <@vpnHelper> Title: Networking Blog » How to enable IP Forwarding in Debian (at www.net-gyver.com)
02:03 < MaxFrames> method 1 (on the fly) did not work, for whatever reason
02:03 < MaxFrames> as soon as I edited sysctl and applied the new settings, problem was solved
02:04 < Bushmills> method 2 merely results in method 1 being performed on boot
02:05 < MaxFrames> so that's another thing to ask in #debian
02:11 < MaxFrames> what I can tell you is that "echo 1 > /proc/sys..." followed by "cat /proc/sys..." resulted in "1", but IP forwarding was not taking place and when I later again did "cat /proc/sys..." it resulted in 0
02:11 < MaxFrames> after I edited sysctl and then parsed it, the problem was solved
02:12 -!- Druid_ [~mf@p5B137917.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
02:13 < MaxFrames> I see you're in #debian too, good
02:15 -!- Druid_ [~mf@p5B136768.dip.t-dialin.net] has joined #openvpn
02:17 -!- ^shark_ [~Jerry_Jor@196.29.225.167] has joined #openvpn
02:23 <@vpnHelper> RSS Update - forum: How to create point to point vpn with full client access <http://forums.openvpn.net/topic7747.html> || Create ovpn client file <http://forums.openvpn.net/topic7731.html#p10279>
02:26 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:26 -!- kerfe [~a@83.pool85-60-134.dynamic.orange.es] has joined #openvpn
02:30 -!- twister004_ [~chatzilla@117.207.243.139] has joined #openvpn
02:31 < ^shark_> is ipsec in openvpn?
02:31 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 246 seconds]
02:31 -!- twister004_ is now known as twister004
02:33 < ^shark_> my telco is offering me a site-to-site vpn test on their cisco asa 5500 device with ipsec. i want to know if openvpn has ipsec encryption or only ssl
02:36 < ^shark_> ok got my answer at http://en.wikipedia.org/wiki/OpenVPN
02:36 <@vpnHelper> Title: OpenVPN - Wikipedia, the free encyclopedia (at en.wikipedia.org)
02:41 < Bushmills> nope
02:41 < Bushmills> openvpn is openvpn.  ipsec is ipsec.
02:41 < Bushmills> and pptp is pptp
02:41 < Bushmills> check out freeswan
02:42 -!- ^shark_ [~Jerry_Jor@196.29.225.167] has quit [Quit: Leaving.]
02:42 < Bushmills> you're welcome
02:45 -!- dazo_afk is now known as dazo
02:46 -!- ^shark_ [~Jerry_Jor@196.29.225.167] has joined #openvpn
02:47 < MaxFrames> jeez... it has happened again
02:47 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:47 < MaxFrames> ip forwarding disabled itself!
02:48 < MaxFrames> suddenly I can not even ping any more... I check ip_forward, and it has reverted to 0!
02:48 < EugeneKay> What's the OS?
02:48 < MaxFrames> debian
02:49 < EugeneKay> edit /etc/sysctl.conf
02:49 < EugeneKay> net.ipv4.ip_forward = 1
02:49 < MaxFrames> yeah, that's what I did
02:49 < EugeneKay> And now it's off o.O
02:49 < MaxFrames> in the file, it's still on "1"
02:50 < EugeneKay> And yet /proc/sys/whateveritis is 0
02:50 < MaxFrames> yes
02:50 < EugeneKay> "Nasal Demons"
02:50 < MaxFrames> "sysctl net.ipv4.ip_forward" results in "0"
02:50 -!- ^shark_ [~Jerry_Jor@196.29.225.167] has quit [Ping timeout: 276 seconds]
02:51 < MaxFrames> and also "cat /proc/sys/net/ipv4/ip_forward" results in "0"
02:51 < MaxFrames> yet the net.ipv4.ip_forward=1 line in sysctl.conf is uncommented
02:51 < MaxFrames> this is WEIRD
02:51 < EugeneKay> Something is turning it off, clearly.
02:52 < EugeneKay> Tail the logfile that sysctl outputs too
02:52 < EugeneKay> Wait for it to get switched :-p
02:52 < EugeneKay> And then murder whatever is changing it
02:52  * MaxFrames wishes he had this level of skill, but there's still a looooong way to go :P
02:53 < EugeneKay> I've no clue about debian
02:53 < EugeneKay> But I'd guess syslog, and then maybe /etc/messages
02:57 < MaxFrames> anyway the main problem is that this debian openvpn server is forwarding ICMP (I can ping remote hosts) but it's not forwarding TCP (I cannot tcping the same hosts on open TCP ports)
03:07 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
03:16 -!- ^shark_ [~Jerry_Jor@196.29.239.217] has joined #openvpn
03:19 -!- ^shark_1 [~Jerry_Jor@196.29.239.217] has joined #openvpn
03:21 -!- ^shark_ [~Jerry_Jor@196.29.239.217] has quit [Ping timeout: 276 seconds]
03:24 -!- ^shark_1 [~Jerry_Jor@196.29.239.217] has quit [Ping timeout: 252 seconds]
03:32 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:44 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
03:47 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:47 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:52 -!- twister004 [~chatzilla@117.207.243.139] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
03:57 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
04:16 -!- MaxFrames [~MaxFrames@147.162.217.235] has left #openvpn ["Reality is that which, when you stop believing in it, doesn't go away"]
04:18 -!- d457k [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Remote host closed the connection]
04:21 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has joined #openvpn
04:44 -!- EugeneKay is now known as EugeneKaway
04:44 -!- kerfe [~a@83.pool85-60-134.dynamic.orange.es] has quit [Quit: • IRcap • 8.6 •]
04:46 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:51 <@vpnHelper> RSS Update - forum: openvpn gui problem <http://forums.openvpn.net/topic7744.html#p10281>
04:57 <@vpnHelper> RSS Update - forum: How to create point to point vpn with full client access <http://forums.openvpn.net/topic7747.html#p10283> || Automatically mount network drive when openvpn connects <http://forums.openvpn.net/topic7746.html#p10282>
04:58 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:59 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:59 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:15 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:15 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:19 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
05:23 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
05:23 < MaxFrames> re
05:24 < MaxFrames> I'm progressing... now (thanks to tcpdump) I know for sure that the remote desktop connection from the openvpn client to the remote host is actually routed by the tun0 device to the eth0 interface, and actually forwarded by the openvpn server acting as a nat router
05:24 < MaxFrames> but the target host is not seeing any connection attempt! :O
05:30 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
05:30 -!- wraithdu [47c903a9@gateway/web/freenode/ip.71.201.3.169] has left #openvpn []
05:31 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
05:35 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 252 seconds]
05:35 -!- MaxFrames [~MaxFrames@147.162.217.235] has left #openvpn ["Reality is that which, when you stop believing in it, doesn't go away"]
05:36 < Bushmills> "actually forwarded by the openvpn server" ... "target host is not seeing any connection attempt" - router between openvpn server and remote host is broken
05:36 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688.html#p10284>
05:47 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10285>
05:57 -!- exus [~pavel@195.113.165.72] has joined #openvpn
05:57 < exus> hello all
05:59 < exus> i have openvpn server on ubuntu .. but, there is a problem with starting it.. every time, when i want start it, it crash.. here is log >
05:59 < exus> Tue Mar  8 12:54:43 2011 Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
05:59 < exus> Tue Mar  8 12:54:43 2011 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
05:59 < exus> Tue Mar  8 12:54:43 2011 Cannot open TUN/TAP dev /dev/tap0: No such file or directory (errno=2)
05:59 < Bushmills> exus: try to run  modprobe tun
06:00 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
06:03 < exus> still nothing
06:04 < Bushmills> nothing is good. before you had errors.
06:04 < janjust> exus:  I trust you *are* starting openvpn using something like 'su - -c ...' or 'sudo openvpn'
06:04 < exus> no.. /etc/init.d/openvpn start
06:05 < janjust> which user are you logged in as when you type this?
06:05 < exus> as root
06:05 < janjust> just checking :)
06:05 < janjust> what does 'lsmod | grep tun' give?
06:05 < exus> # lsmod | grep tun
06:05 < exus> Opening /proc/modules: No such file or directory
06:06 < Bushmills> what does   uname -a   say?
06:06 < exus> 2.6.32.25 #4 SMP Sat Feb 12 15:24:59 CET 2011 x86_64 GNU/Linux
06:07 < Bushmills> and   grep proc /etc/fstab ?
06:07 < janjust> no modules? try doing a '
06:07 < janjust> mount /proc
06:07 < janjust> or mount -t proc /proc
06:07 < janjust> but sounds like your ubuntu setup is screwed up ; time for the three-fingered salute (i.e. reboot) ?
06:08 < Bushmills> let hime make sure first that /proc is mounted during boot, through fstab
06:08 < janjust> true
06:09 < exus> grep proc /etc/fstab  .. say nothing.. 'mount /proc' > mount: proc already mounted
06:10 < janjust> if /proc is already mounted then why is there no /proc/modules file?
06:10 < Bushmills> try to add:  echo  "none  /proc  proc    defaults 0 0" >> /etc/fstab     before boot
06:11 < Bushmills> also look at output of      mount | grep proc
06:12 < exus> # mount | grep proc
06:12 < exus> proc on /proc type proc (rw,relatime)
06:13 < janjust> exus: add the line that Bushmills suggests, then reboot the box . make sure /proc is mounted and check for the existence of the /proc/modules file after startup
06:16 < exus> i do what he says, proc is already mounted and /proc/modules no such file or directory
06:19 < Bushmills> echo  "none  /proc  proc    defaults 0 0" >> /etc/fstab
06:19 < Bushmills> won't say such a thing
06:19 < Bushmills> or do you mean that's a message you get during boot?
06:21 < exus> for now thank for your help, now i must leave school and go home.. after i arrive to home, i will be back here.. bye
06:22 -!- exus [~pavel@195.113.165.72] has quit [Quit: Leaving]
06:34 -!- Netsplit *.net <-> *.split quits: Fleck, ivenkys, @dazo, pa, nijotz, mirco, grapsus, master_of_master, dvl
06:37 -!- Netsplit over, joins: dazo
06:37 -!- mode/#openvpn [+o dazo] by ChanServ
06:39 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
06:39 -!- Fleck [~we@85.158.73.148] has joined #openvpn
06:39 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
06:39 -!- master_of_master [~master_of@p57B52D44.dip.t-dialin.net] has joined #openvpn
06:39 -!- grapsus [~grapsus@acces1074.res.insa-lyon.fr] has joined #openvpn
06:39 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
06:39 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
06:39 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
06:39 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10286>
06:47 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: Leaving]
07:09 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p10287>
07:22 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p10288>
07:38 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
07:41 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
07:43 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
07:46 <@vpnHelper> RSS Update - forum: How to create multi-server vpn <http://forums.openvpn.net/topic7748.html>
07:46 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
07:51 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
07:51 <@vpnHelper> RSS Update - forum: Avoid dropping of connection <http://forums.openvpn.net/topic7749.html>
07:51 -!- asgw [~sc@unaffiliated/asgw] has quit [Quit: Ex-Chat]
07:52 < wolfric> Is it a rule that the vpn address range for clients cannot include the ip of the vpn server. I've set a static route to route the servers ip through my normal gateway. I saw this done for the 27c3 vpn 
07:59 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Quit: Leaving]
07:59 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
08:03 < ecrist> wolfric: you end with a chicken and egg problem if you include the vpn server's address
08:04 < ecrist> before the vpn is up, the vpn connection is made over the internet (normal, good), as soon as the session is established, the vpn server tells the client to route packets to it over the vpn.  now, the client tries routing packets to the vpn server of the vpn connection, which ends up getting dropped.
08:04 < ecrist> it's sort of like trying to eat yourself.
08:04 -!- opuk [~kupo@pipe.intertubez.net] has joined #openvpn
08:04 < ecrist> you'll never be able to finish. :)
08:05 -!- Druid_ [~mf@p5B136768.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
08:05 < opuk> any cons or gotchas on running an openvpn server on 443? 
08:05 -!- Druid_ [~mf@p5B136768.dip.t-dialin.net] has joined #openvpn
08:05 < ecrist> !tcp
08:05 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
08:08 < wolfric> ecrist: i got normal connections to it working fine with a static route to use my default gateway when trying to get to the vpn server ip. Any traffic inside the vpn however came up with no route to host
08:08 < wolfric> when i didn't have the route, of course the connection would just timeout as soon as it was made with no route to host
08:16 -!- MarKsaitis [~MarKsaiti@217.180.14.246] has joined #openvpn
08:23 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10291>
08:25 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
08:25 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
08:25 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:26 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 240 seconds]
08:35 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
08:35 <@vpnHelper> RSS Update - forum: Is OPEN VPN right for me? <http://forums.openvpn.net/topic7263.html#p10292>
08:47 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10293>
08:51 -!- Fleck [~we@85.158.73.148] has quit [Changing host]
08:51 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
08:58 -!- opuk [~kupo@pipe.intertubez.net] has left #openvpn []
09:02 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:02 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:06 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:07 -!- gladiatr is now known as gladiatr_afk
09:17 <@vpnHelper> RSS Update - forum: Win7 <http://forums.openvpn.net/topic7736.html#p10295> || Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10294>
09:30 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10296>
09:43 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
09:44 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
09:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
09:47 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
09:47 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622-15.html#p10297>
09:50 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:54 <@vpnHelper> RSS Update - forum: How to create point to point vpn with full client access <http://forums.openvpn.net/topic7747.html#p10298>
09:56 -!- MarKsaitis [~MarKsaiti@217.180.14.246] has quit [Ping timeout: 250 seconds]
10:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:00 <@vpnHelper> RSS Update - forum: Is OPEN VPN right for me? <http://forums.openvpn.net/topic7263.html#p10299>
10:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
10:06 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
10:06 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622-15.html#p10301> || How to create point to point vpn with full client access <http://forums.openvpn.net/topic7747.html#p10300>
10:10 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:11 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 248 seconds]
10:11 <@vpnHelper> RSS Update - forum: Is OPEN VPN right for me? <http://forums.openvpn.net/topic7263.html#p10302>
10:13 -!- [1]rond [~rond@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
10:18 <@vpnHelper> RSS Update - forum: Simple configuration for 1 server and 2 clients <http://forums.openvpn.net/topic7745.html#p10303>
10:30 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:30 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p10304>
10:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:38 -!- luneff [~yury@84.51.212.81] has joined #openvpn
10:40 -!- MaxFrames [kvirc@151.76.160.82] has joined #openvpn
10:40 < MaxFrames> hello
10:40 < MaxFrames> I've solved all my openvpn+nat issues :)
10:40 -!- luneff [~yury@84.51.212.81] has quit [Read error: Connection reset by peer]
10:41 < MaxFrames> there was just a forward rule missing in iptables, that's all :)
10:41 -!- luneff [~yury@84.51.212.81] has joined #openvpn
10:43 < MaxFrames> the best part is that I took the time to relax a bit, and the solution occurred to me
10:44 < MaxFrames> I shall amend the wiki page about the NAT hack though, because it's lacking and it does not mention all the required steps (hard for newbies)
10:44 -!- bitterman [~yury@84.51.212.81] has joined #openvpn
10:45 < MaxFrames> bbl
10:47 -!- luneff [~yury@84.51.212.81] has quit [Ping timeout: 250 seconds]
10:48 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has joined #openvpn
10:48 < mrlolplx> !welcome
10:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:49 < mrlolplx> !redirect
10:49 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
10:50 < mrlolplx> possible to have only some users internet flow through the vpn?
10:52 < roentgen> !ccd
10:52 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
10:52 < roentgen> mrlolplx: see that above
10:53 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
10:55 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
10:58 < mrlolplx> ok
10:59 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622-15.html#p10305>
11:02 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
11:13 < mrlolplx> im running access server, would i have to do it via console?
11:21 -!- MaxFrames [kvirc@151.76.160.82] has left #openvpn ["It's nice to be wise, but it's wiser to be nice"]
11:22 < wolfric> Could someone please confirm that that openvpn can't assign ips in the same range as the actual server even if a static ip pushes the openvpn server ip through the normal gateway
11:28 < ecrist> I already confirmed that, wolfric 
11:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:29 < ecrist> well, you can if you use tap, which is the easiest way to do that without odd subnetting
11:35 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
11:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
11:40 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has joined #openvpn
11:42 < dschuett> Does   push "redirect-gateway def1"  mean that all client's internet traffic will be routed through the VPN?
11:44 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro]
11:53 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has quit [Ping timeout: 260 seconds]
11:53 < wolfric> ecrist: i'm using tap
11:54 < wolfric> ecrist: it was done at 27c3 though so there must be some way
11:58 -!- darth_bitterman [~yury@84.51.212.81] has joined #openvpn
12:01 -!- bitterman [~yury@84.51.212.81] has quit [Ping timeout: 246 seconds]
12:11 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
12:14 < ecrist> wolfric: I have no idea what 27c3 is.
12:16 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:18 -!- darth_bitterman [~yury@84.51.212.81] has quit [Read error: Connection reset by peer]
12:26 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
12:26 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:28 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has joined #openvpn
12:29 < mrlolplx> !ccd
12:29 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
12:32 < wolfric> ecrist: google it
12:34 < mrlolplx> where can i find my server.conf when using access server on debian?
12:34 <@vpnHelper> RSS Update - forum: Simple configuration for 1 server and 2 clients <http://forums.openvpn.net/topic7745.html#p10306>
12:34 < mrlolplx> sorry if this can be found in the docs
12:38 < dkr> mrlolplx: /etc/openvpn ?
12:39 <@vpnHelper> RSS Update - forum: How to create point to point vpn with full client access <http://forums.openvpn.net/topic7747.html#p10307>
12:39 < mrlolplx> only have update-resolv-conf
12:39 < mrlolplx> in that folder
12:40 < mrlolplx> could it be /usr/local/openvpn_as/etc/as.conf ?
12:41 < dkr> well, I've no idea what "access server" means.  but in debian the openvpn configs are in /etc/openvpn...
12:41 < mrlolplx> openvpn-as?
12:42 < mrlolplx> http://openvpn.net/index.php/access-server/overview.html
12:42 <@vpnHelper> Title: Overview (at openvpn.net)
12:42 < dkr> are you sure you are using debian?
12:42 < mrlolplx> ... yes
12:42 < mrlolplx> squeeze to be exact
12:42 < dkr> weird. I don't have that package in squeeze
12:43 < mrlolplx> its not a debian package
12:44 < mrlolplx> i installed the ubuntu packages as the docs said to
12:45 < dkr> maybe dpkg -L openvpn-as to see where it put files
12:46 < dkr> I'm not clear from that overview what the difference is with 'access server' and regular openvpn...  I suppose it's the "enterprise management capabilities".  heh
12:48 < dkr> indeed.  apparently you are supposed to be using a web gui rather than editing config files
12:48 < hjohnson> heh, openvpn and pptp don't mix well on the mac... 
12:49 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has quit [Ping timeout: 264 seconds]
12:49 < hjohnson> alas, I wish I could change out the VPN router for my NMS system, but no cash to do that right now. :(
12:49 -!- mrlolplx [~neger@unaffiliated/mrlolplx] has joined #openvpn
12:49 < dkr> ok, actually the ldap integration sounds nifty but they are kind of lying when they say openvpn can't do that already
12:49 < mrlolplx> my client crashed
12:50 < dkr> http://code.google.com/p/openvpn-auth-ldap/
12:50 <@vpnHelper> Title: openvpn-auth-ldap - Project Hosting on Google Code (at code.google.com)
12:50 < dkr> mrlolplx: maybe dpkg -L openvpn-as to see where it put files
12:51 < dkr> or use the web gui to configure it...
12:51 < mrlolplx> !ccd
12:51 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
12:51 < mrlolplx> i dont see anything with client-config-dir in the gui
12:52 < dkr> therein lies the problem with "easy to use" web guis
12:52 < mrlolplx> indeed
12:52 < mrlolplx> i should really start over doing it the old fashioned way
12:53 < mrlolplx> but i actually bought licenses for as, so it would be kind of a waste
12:53 < ecrist> wolfric: not a good way to get help around here...
12:54 -!- celthundar [~celthunde@rofltech.net] has joined #openvpn
13:06 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:15 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
13:19 -!- BostX [~bost@p5B2F0497.dip0.t-ipconnect.de] has joined #openvpn
13:21 < wolfric> ecrist: It's basically a conference. I thought it would be more efficient if you just googled it rather than me trying to explain it. Security conference. They hired out a /16 this year and had vpn access
13:25 <@vpnHelper> RSS Update - forum: openvpn gui problem <http://forums.openvpn.net/topic7744.html#p10308>
13:30 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:32 < dschuett> how do you get each client to use the same gateway back to the server. Example client 1 has an ip address of 10.8.0.5 and in the routing table it shows the route to the vpn server to be 192.168.0.0  using the gateway 10.8.0.5. Why does it use its own ip as the gateway?
13:37 < dschuett> anyone?
13:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:47 < ecrist> wolfric: if you explain exactly what you're trying to do, and show us your configs, we can try to help
13:51 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has left #openvpn []
14:07 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
14:10 < wolfric> ecrist: https://forums.openvpn.net/topic7750.html
14:10 <@vpnHelper> Title: OpenVPN Support Forum bridge issue - no route to host : Configuration (at forums.openvpn.net)
14:10 < wolfric> just posted it
14:11 < wolfric> handy script
14:11 -!- mirco [~mirco@p5DD351AD.dip.t-dialin.net] has joined #openvpn
14:13 <@vpnHelper> RSS Update - forum: bridge issue - no route to host <http://forums.openvpn.net/topic7750.html>
14:14 -!- EugeneKaway is now known as EugeneKay
14:16 < wolfric> is the tap(0/1/2) etc supposed to change on the server for a client? It changes on the client but on the server it doesn't
14:16 < ecrist> no
14:16 < ecrist> do you have ifconfig -a from a client?
14:16 < ecrist> after openvpn is up?
14:17 < wolfric> yes it's in the forum post
14:17 < ecrist> oh, on the server, you're going to need client-to-client
14:17 < ecrist> doh, I see the ifconfig now, sorry
14:19 < wolfric> isn't client-to-client only if you want the different clients private subnets to talk to each other?
14:19 <@vpnHelper> RSS Update - forum: VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p10310>
14:19 < ecrist> no
14:19 < ecrist> your scheme will not work.  you need a different server IP to connect to the vpn
14:20 < ecrist> otherwise it's still going to clobber your vpn server IP
14:20 < wolfric> http://pastebin.com/HNUzvwKa
14:21 < wolfric> That's what this commented part says though
14:21 < ecrist> yes
14:21 < ecrist> trust me on client-to-client, unless you don't want your clients to be able to talk to eachother
14:22 < wolfric> i don't mind for the moment.  I'm just worried about the connecting to any other servers on the range
14:23 < ecrist> add the following to your server config
14:23 < ecrist> push "route 6.7.8.16 default"
14:23 < ecrist> oops, change default to net_gateway
14:24 -!- mirco_ [~mirco@p5DD35B59.dip.t-dialin.net] has joined #openvpn
14:24 <@vpnHelper> RSS Update - forum: bridge issue - no route to host <http://forums.openvpn.net/topic7750.html#p10311>
14:25 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
14:25 < reiffert> hi.
14:25 < reiffert> My client log is full of:
14:25 < ecrist> moin
14:26 < reiffert> Authenticate/Decrypt packet error: bad packet ID
14:26 < EugeneKay> IN THE NAME OF LUCIFER I COMMAND YOU TO SPILL THE BLOOD OF THE INNOCENT
14:26 < reiffert> mute them or adjust something?
14:26 < reiffert> despite the messages, it works.
14:26 < ecrist> I'd mute them.
14:26 < EugeneKay> The Google says that it's out-of-order packets
14:27 < EugeneKay> Either a replay attack is being attempted or the connection is shitty
14:27 < reiffert> well on the other hand I've got some smb authenticate issues and I want to be sure to not run into trouble.. so what about the adjustments that can be taken?
14:27 -!- mirco [~mirco@p5DD351AD.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
14:27 -!- mirco_ is now known as mirco
14:27 < reiffert> the connection is brilliant.
14:29  * ecrist knows of none
14:29 < reiffert> http://pastebin.com/8pSuvDRk
14:38 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
14:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
14:41 < wolfric> ecrist: that does something funny with the routes. Need to head off will try when i get back an internet hotspot later. New routes to the client try to tunnel6.7.8/24 through my default gw and then under through the tap
14:41 < wolfric> ecrist: cheers for the help
14:43 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
15:00 < reiffert>  those messages only appear in the vmware guest OS (windwos XP)
15:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
15:03 < mete> hi all
15:03 -!- dazo is now known as dazo_afk
15:13 -!- EugeneKay is now known as ciwrl|pants
15:14 -!- bbbeee [~OOo@c-62-220-181-209.cust.bredband2.com] has joined #openvpn
15:14 < bbbeee> HI room !!
15:14 < bbbeee> hmm. i am newbiew .. and want to deploy one thing
15:15 -!- ciwrl|pants is now known as EugeneKay
15:16 < bbbeee> SERVER (Publick IP) :::: Internet ::::: OFFice (Router 1 Public IP) >> Private IPs (LAN)
15:17 < bbbeee> this server is also PROXY Server so my LAN (private IPs) will use this Proxy SERVER..
15:17 < bbbeee> so .. what will be scenario ?
15:18 < bbbeee> hav to setup OpenVPN with router or what ? how can i allow my private IPs (Office LAN) will use this PROXY server and browse further ..
15:19 < bbbeee> routing*
15:19 < EugeneKay> You want to redirect the outgoing traffic going through your router through the OpenVPN tunnel to the Server?
15:20 < bbbeee> yes exactly and then from SERVER they will use Proxy service and so on...
15:20 < EugeneKay> !redirect-gateway
15:21 < EugeneKay> !redirect
15:21 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:22 < mrlolplx> !def1
15:22 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
15:22 < bbbeee> hmm.. my all office lan users will seperately use vpn client for connecting to OPEN VPN onf this remote server ? 
15:23 < EugeneKay> If you're lucky, your router can do it for them.
15:23 < EugeneKay> Oh, you cn get away without the redirect.
15:23 < EugeneKay> (in that scenario)
15:24 < bbbeee> hmm means OFFICE LAN >>> ROUTER :::::::::: OPENVPN (Remote Server) ?
15:24 < EugeneKay> With a few less :, yes
15:24 < EugeneKay> Go look up if your router supports dd-wrt or Tomato or something that does openvpn
15:24 < bbbeee> my LAN Router will communcate with OPENVPN ..hmm how will then hav to configure OPENVPN ?
15:24 < bbbeee> hmm if it dont support these things then ??
15:24 < EugeneKay> Just a straight client-server will work. 
15:25 < EugeneKay> Then you're screwed, and would have to put in a cheapie linux box, or setup openvpn on every machine.
15:25 < EugeneKay> A cheap linux box would work easiest, long-term
15:27 < bbbeee> hmm means hav to replace router with LINUX BOX and install Open vpn on it and then OPENVPN will be on BOTH ends..
15:28 < bbbeee> that LINUX box will use as a gateway and will share internet to my office clients.
15:28 < EugeneKay> No, you can setup a linux box adjacent the router, and specify in your router's config that stuff headed for the OpenVPN subnet is to be routed via that linux box
15:29 < bbbeee> hmm.. Office LAN <<<LINUX Box <<<- >>> ROUTER ::::::::::: OPENVPN (Remote Server)
15:29 < bbbeee> ?
15:29 < EugeneKay> You're obsessed with punctuation
15:30 < EugeneKay> But yes
15:30 < Dougy> .
15:30 < Dougy> .
15:30 -!- MaxFrames [kvirc@151.76.160.82] has joined #openvpn
15:31 < bbbeee> in Router i will hav to use PORT-Forward or else thing for forwarding request ?
15:31 < EugeneKay> static route
15:32 < bbbeee> hmm static route, how that static route will redirect ?
15:32 < EugeneKay> Magic.
15:32 < bbbeee> :)
15:32 < bbbeee> suppose 
15:33 < bbbeee> 10.0.0.0 network is my office LAN and linux box has 10.0.0.9 IP..
15:33 <@vpnHelper> RSS Update - forum: Avoid dropping of connection <http://forums.openvpn.net/topic7749.html#p10312>
15:33 -!- Strav [~user@dsl-216-221-38-247.aei.ca] has joined #openvpn
15:33 < bbbeee> Router 202.0.0.x :::::::::::: 166.x.x.x (open VPN) Router
15:34 < bbbeee> router also have 10.0.0.1*
15:34 < EugeneKay> You'll want different subnets all the way around
15:34 < EugeneKay> 10.0.0.x is well-abused
15:34 < Dougy> 10.69.69 :)
15:34 < bbbeee> :)
15:35 < wolfric> ecrist: push according to the howto is only used for tun. I'm using tap
15:35 < Dougy> wolfric: why tap
15:35 < Dougy> !tunortap
15:35 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
15:35 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
15:35 < EugeneKay> TAP will consume your mortal soul, cause cancer, and eat a dead baby.
15:35 < EugeneKay> Don't use TAP.
15:35 < bbbeee> Eugen: how ? didnt get 
15:36 < bbbeee> you meant i will hav to use different private IP range ?
15:36 < MaxFrames> less likely to conflict with something else
15:37 < bbbeee> openvpn also will assign range of IP ? so both on different subnet..
15:38 < reiffert> !wins
15:38 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
15:39 < bbbeee> EugeneKay: ? any more suggestion?
15:40 < EugeneKay> bbbeee - boobs
15:40 < bbbeee> haha
15:42 < bbbeee> if LAN has VLANs then linux box will hav iptable rules for redirecting ?
15:44 < EugeneKay> I hate VLANs
15:44 < EugeneKay> I love them, but I hate dealing with them.
15:44 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:47 < reiffert> bbbeee: redirecting as in?
15:48 -!- MaxFrames [kvirc@151.76.160.82] has quit [Quit: It's nice to be important, but it's more important to be nice]
15:49 < bbbeee> reiffert: yes
15:51 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has joined #openvpn
15:51 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has quit [Changing host]
15:51 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
15:51 < wolfric> What would be the best solution if i can't control the gateway on the network to access other servers on the vpn servers network? Other than nat.
15:52 < wolfric> the vpn servers network gateway in order to tell it that a certain alternative range is accessable via the vpn server*
15:52 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
15:53 < janjust> I'm not sure I'm following you, wolfric 
15:53 < janjust> either you can add a route to the server-side gateway or not
15:53 < janjust> if you cannot, you must either use NAT or you could add a route on each server that needs to be reachable from the VPN
15:53 < wolfric> i can't. if my vpn server is 1.2.3.66 and it's gateway is 1.2.3.1 then i can change 66 but i can't change .1
15:54 < janjust> which OS is your vpn server?
15:54 < wolfric> is that the ONLY way. I don't think i grasp exactly why you can't use the same range the vpn server and all the other servers on it's network are on
15:54 < wolfric> debian
15:54 -!- EugeneKay is now known as EugeneKaway
15:54 < janjust> ah, on linux there's another trick you can pull
15:55 < janjust> proxy ARP
15:56 < janjust> use a 'client-connect' script on the openvpn server which something like '/sbin/arp -i eth0  -Ds $ifconfig_pool_remote_ip eth0 pub' ; then assign an IP address to the VPN clients from the same range as the server-side LAN
15:56 < wolfric> What's the point in a bridge if you can't be on the same subnet as the nodes on the vpn servers side. Surely it all gets stripped away when it's routed
15:56 < janjust> if you're using bridging then you don't need to mess with changing the default GW
15:58 < wolfric> if i have let's say 1.2.3.0/24 and my vpn server is 1.2.3.10 let's say and all servers in that range are configured for /24, can i (using bridging) put a client in that /24 range? If not surely that defeats the purpose of briding as all the ethernet gets stripped off if you need to go to another subnet
15:58 -!- EugeneKaway is now known as EugeneKay
15:58 < janjust> yep that's possible wolfric 
15:59 < janjust> and nope, not all ethernet traffic gets stripped off in bridge(+tap) mode : in tap mode complete ethernet frames are forwarded over the VPN
16:00 < wolfric> right but if your servers are in a different subnet to your clients on the vpn then in order to send traffic over  to another subnet, the ethernet gets stripped off transfersing the subnet
16:00 < wolfric> https://forums.openvpn.net/topic7750.html that's what i was trying to do here and why i was using tap instead of tun. 
16:00 <@vpnHelper> Title: OpenVPN Support Forum bridge issue - no route to host : Configuration (at forums.openvpn.net)
16:00 < janjust> if the VPN server can reach the servers , then if your VPN clients are in the same subnet as the server then they should also be able to reach the servers
16:01 < wolfric> but they can't be in a tun right? that's why it requires either nat, gateway routing to find the vpn subnet or per server routing to find the vpn subnet
16:01 < wolfric> can't be in the same subnet*
16:02 < janjust> in a 'tun' subnet all ethernet headers are stripped before you enter the tunnel
16:02 < janjust> it's still possible to put the clients in the same subnet as the server, but you'd need proxyARP to do it
16:03 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
16:03 < wolfric> which do you reckon would be easier to set up?
16:04 < janjust> hehe, depends on YOUR networking knowledge ;-)
16:04 < janjust> a tun setup will give you better performance, however
16:04 < wolfric> and more security i guess
16:05 < janjust> or I could recommend to buy my book and read the last recipe of chapter 2 ;-)
16:05 < wolfric> your book? as in owner or author?
16:05 < janjust> author
16:05 < janjust> !book
16:05 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
16:05 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
16:06 < wolfric> Very nice. Are you a developer on openvpn then?
16:07 < janjust> more of a long-term supporter of openvpn
16:07 < janjust> I've done some development work but have been doing user support for quite some time
16:08 < reiffert> tun sucks for windows
16:08 < reiffert> tap is the way to go.
16:08 < wolfric> how so?
16:08 < janjust> hehe but bridging kills half your performance reiffert 
16:08 < reiffert> those overhead people are referring to .. what about it, those 2KB/s you loose, omg!
16:09 < wolfric> that really depends on the traffic
16:09 < wolfric> if you have large data packets then fine. If you fragment your traffic then each one needs an ethernet frame
16:09 < janjust> in that case I'd go for a tap-based setup with proxy ARPing so you can avoid bridging
16:09 < janjust> nah the problem with bridging is that when you copy a file to the server which does NOT go via VPN then performance is already crippled
16:10 < reiffert> copy file over broadcast?
16:11 < janjust> I don't know exactly what goes wrong, but if you bridge eth0+tun0 on a linux box, then copy a file over (using scp) then performance is half of what it is without the bridge
16:11 < janjust> seems that the kernel is copying the entire file over to the tap0 interface
16:11 < janjust> s/tun0/tap0 on the previous line
16:12 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Quit: Leaving]
16:12 <@vpnHelper> RSS Update - forum: openvpn gui problem <http://forums.openvpn.net/topic7744.html#p10313>
16:14 < reiffert> Didnt see that on that bunch of dialup clients I have..
16:14 < reiffert> But .. yet
16:14 < wolfric> janjust: are there any guides on the web on proxyarp?
16:14 < reiffert> s,But,,
16:15 < janjust> reiffert: grab a linux server, enable bridging (e.g. eth0+tap0) , then scp a file to the server from a machine on the same lan
16:15 < janjust> wolfric: yes, proxy arp info is available on the web, look for it in combination with ppp or pptp ; the /sbin/arp line I wrote here earlier pretty much does it
16:16 < reiffert> janjust: how do other OS behave?
16:16 < janjust> I must say that I haven't tested this on many other OSes
16:16 < janjust> the only one I would be able to test is windows 7 :S
16:17 <@vpnHelper> RSS Update - forum: How to create point to point vpn with full client access <http://forums.openvpn.net/topic7747.html#p10315> || VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p10314>
16:22 < janjust> reiffert: exactly why does tun suck on windows?
16:22 < wolfric> janjust: that arp command you mentioned. That would use eth0 mac address as the source when sending eth from the tun interface out right? 
16:23 < janjust> yep
16:23 < wolfric> janjust: but it wouldn't respond to arp requests for looks ups though
16:23 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p10316>
16:23 < janjust> yes it would 
16:23 < janjust> that's the whole idea about proxy ARPing : the server responds for the client using its own ARP address
16:24 < janjust> (the arp command assumes that the traffic is leaving the eth0 interface)
16:24 < wolfric> and it gets stripped off for the tun right?
16:24 < janjust> yes, when/before it is sent into the VPN tunnel
16:25 < wolfric> that's actually quite clever but simple
16:25 -!- funabash1 [~funabashi@46.21.169.82] has quit [Quit: leaving]
16:25 < janjust> also make sure to remove the proxy ARP entry when the client disconnects
16:25 < wolfric> why? 
16:26 < janjust> as otherwise the server will keep answering to ARP replies for a client that it no longer knows
16:26 < janjust> it will lower the load on the server, that's all
16:26 < wolfric> ah i see
16:26 < janjust> the one thing that does NOT work easily using proxy-ARPing is broadcast traffic 
16:26 < janjust> broadcast traffic from the server-side LAN is not automatically repeated out to all VPN clients
16:27 < wolfric> what layer broadcast?
16:27 < janjust> ethernet 
16:27 < janjust> and all traffic to 255.255.255.255
16:27 < janjust> there are 'repeater' packages out there to mimick this behaviour, but then I'd resort to using bridging
16:29 < wolfric> do you normally build a script to monitor openvpn to see when a client connects/disconects and run that script or is there a way of having that inside the server.conf and executing it per client?
16:29 < wolfric> monitor openvpn log*
16:29 < janjust> Read The Fine Manual, wolfric : client-connect
16:29 < janjust> !client-connect
16:29 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
16:29 < janjust> !client-disconnect
16:30 < wolfric> oh right yeah i remember reading about that now
16:32 < wolfric> cheers
16:33 < janjust> are you buying me a drink, wolfric  ;-) ?
16:34 < wolfric> I'll definitely owe you one if this works
16:34 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10317>
16:39 < mrlolplx> !ccd
16:39 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
16:45 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:51 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
17:20 < mrlolplx> my ccd configs isnt pushing the settings as i tell it to
17:20 < mrlolplx> any suggestions?
17:28 -!- celthundar [~celthunde@rofltech.net] has quit [Ping timeout: 276 seconds]
17:29 < mrlolplx> going to bed, better luck tomorrow!
17:29 < mrlolplx> .o/
17:29 -!- mrlolplx [~neger@unaffiliated/mrlolplx] has quit [Quit: Leaving]
17:34 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Quit: leaving]
17:36 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has joined #openvpn
17:36 -!- celthunder [~celthunde@rofltech.net] has joined #openvpn
17:40 -!- bbbeee [~OOo@c-62-220-181-209.cust.bredband2.com] has quit []
17:45 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
18:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
18:04 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
18:06 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:08 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
18:09 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:09 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
18:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
18:31 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
18:38 <@vpnHelper> RSS Update - forum: bridge issue - no route to host <http://forums.openvpn.net/topic7750.html#p10318>
18:40 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Ping timeout: 248 seconds]
18:43 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
18:43 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Quit: Leaving]
18:57 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
19:08 <@vpnHelper> RSS Update - forum: openvpn gui problem <http://forums.openvpn.net/topic7744.html#p10319>
19:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
19:18 -!- BostX [~bost@p5B2F0497.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
19:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 255 seconds]
19:24 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:32 -!- Strav` [~user@dsl-62-148.aei.ca] has joined #openvpn
19:34 -!- Strav [~user@dsl-216-221-38-247.aei.ca] has quit [Ping timeout: 246 seconds]
19:36 -!- Strav` [~user@dsl-62-148.aei.ca] has left #openvpn []
19:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
20:25 -!- p3rror [~mezgani@41.140.96.135] has joined #openvpn
20:28 -!- johnfg [~johnfg@spirit.org] has joined #openvpn
20:29 < johnfg> hi  folks
20:30 < johnfg> I have an updated debian system: lenny > squeeze.  The lenny's all set up with my office win xp pro machine.
20:31 < johnfg> Do I have to give the win xp machine the ca.crt from the squeeze, and it's key?  Is there a way to have more than one ca.crt so I can still set up between both lenny and squeeze and winxp?
20:32 < EugeneKay> ca.key stays private, ca.crt needs to be handed out
20:33 < johnfg> EugeneKay, But will I have to keep the ca.crt i generated on squeeze separate from the one i generated on lenny?  Depending on which I want to connect to?
20:33 < EugeneKay> You can keep the same PKI between installs
20:33 < EugeneKay> No need to generate a fresh 'un
20:34 < johnfg> OK, I think I get it.  I need to have the same on all 3 machines (or however many servers and clients).
20:35 < EugeneKay> Ca.crt is needed universally
20:35 < johnfg> ok, thanks!
20:35 < EugeneKay> ca.key is only needed when signing fresh keys(addmign clients)
20:35 < EugeneKay> per-machine keys are needed ONLY by the machine named
20:35 < EugeneKay> There's a table outlining it all in the Howto
20:38 < johnfg> EugeneKay, Right, and I consulted it (I've got it bookmarked :-)).  But I wasn't sure about the client connecting to 2 different servers.
20:40 < EugeneKay> If they use the same server.key, then no matter
20:42 < johnfg> Cool.  ok thanks.
20:42 < johnfg> will let you know when I get the tunnel set up here on squeeze.
20:50 <@vpnHelper> RSS Update - forum: openvpn 2.2RC can't run as server ? <http://forums.openvpn.net/topic7751.html>
20:53 < johnfg> EugeneKay, Because I don't have my log configured yet, even though I can ping 10.8.0.1, how can I tell if the win client is connected?  If the tunnel's up?
20:54 < johnfg> It looked like it did when I restarted openvpn on the winxp box, but the little messages aren't showing when I'm connected remotely.
20:54 < EugeneKay> Enable logs
20:57 -!- common- [~common@p5DDA4B34.dip0.t-ipconnect.de] has joined #openvpn
20:58 < johnfg> I've got them enabled on lenny, and check openvpn-status.log from time-to-time to see what the win machines are using, but I checked the server.conf on lenny, and it's not uncommented in server.conf.
20:58 < johnfg> Is there another place that I've got it enabled?
21:00 -!- common [~common@p5DDA4A05.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
21:00 -!- common- is now known as common
21:04 -!- johnfg [~johnfg@spirit.org] has quit [Ping timeout: 276 seconds]
21:06 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
21:09 -!- master_of_master [~master_of@p57B52D44.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
21:11 -!- master_of_master [~master_of@p57B53982.dip.t-dialin.net] has joined #openvpn
21:29 -!- johnfg [~johnfg@spirit.org] has joined #openvpn
21:30 < johnfg> Sorry, I got knocked off and had to reboot this system.
21:30 < johnfg> Is there another place than server.conf where logs are enabled?
21:38 < krzee> depends on how you start your openvpn process, your system method may have logging enabled, and if you use something like --daemon then it defaults through syslog
21:38 < krzee> !log
21:38 <@vpnHelper> An error has occurred and has been logged. Please contact this bot's administrator for more information.
21:38 < krzee> !logs
21:38 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
21:39 < krzee> err
21:39 < krzee> !logfilw
21:39 < krzee> !logfile
21:39 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
21:44 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has joined #openvpn
22:18 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
22:18 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
22:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:45 -!- johnfg [~johnfg@spirit.org] has quit [Quit: Leaving]
22:59 -!- Strav [~user@186-76.162.dsl.aei.ca] has joined #openvpn
23:01 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:04 < Strav> hi. I'm trying to assign a static ip to a windows client connecting to a linux openvpn server. So far, linux to linux connection with static ip is no problem. On windows side though, I'm getting the following error: "the local and remote vpn endpoints must exist within the same 255.255.255.252 subnet." I have a per client-config-dir and on linux, I'm using ifconfig-push 10.8.0.8 10.8.0.9 along with push "dhcp-option DNS 10.8.0.1"; this
23:04 < Strav> does not work for the windows client. I've seen some configs stating that the second parameter of ifconfig-push should be a netmask equal to 255.255.255.0 but that fails as well. Any thoughts?
23:09 -!- Strav` [~user@141-77.162.dsl.aei.ca] has joined #openvpn
23:12 -!- Strav [~user@186-76.162.dsl.aei.ca] has quit [Ping timeout: 246 seconds]
23:13 -!- Strav` [~user@141-77.162.dsl.aei.ca] has quit [Ping timeout: 246 seconds]
23:14 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:16 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 276 seconds]
23:18 -!- Strav [~user@dsl-61-57.aei.ca] has joined #openvpn
23:21 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has quit [Quit: Leaving]
23:34 < Strav> anyone here?
23:40 < Strav> ok, figured it out.
23:41 < Strav> thanks anyways.
23:41 -!- Strav [~user@dsl-61-57.aei.ca] has left #openvpn ["ERC Version 5.3 (IRC client for Emacs)"]
--- Day changed Wed Mar 09 2011
00:02 -!- tjz_ [~pc@bb219-74-220-242.singnet.com.sg] has quit [Quit: bbl.]
00:03 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has joined #openvpn
00:03 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has quit [Changing host]
00:03 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
00:04 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
00:05 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 276 seconds]
00:13 -!- Strav [~user@dsl-61-57.aei.ca] has joined #openvpn
00:15 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:18 < Strav> ... Another question (sorry I'm no windows admin): I have a windows client connected to my vpn; now I wish that this client would share some folders so it seems in order to do this, I have to set the vpn as a home or work network but I just can't. I can do it for the local network I'm on, but I'm not interested in exposing my shared folders to this network. Any clarifications would be appreciated.
00:23 < hjohnson> are you running a bridged network or routed?
00:23 < hjohnson> the windows sharing stuff works better with a bridged network, IIRC
00:24 < hjohnson> heh, using the hardware crypto on my edge router really is wanking
00:25 < Strav> I'm actually routed.
00:25 < hjohnson> right, which is probably the problem.
00:26 < hjohnson> windows browsing stuf is based on broadcasting, so unless you push a WINS server I don't think it will work.. 
00:26 < hjohnson> been close to a decade since I've been forced to support windows hosts though, so it might have changed
00:28 < Strav> I'll try bridging. Isn't there a nice document out there explaining the quirks of bridged vpns (an howto to put it simply ;)
00:28 < Strav> (one you'd recommend)
00:29 < hjohnson> there are quirks yeah... especially if you have a lot of broadcast traffic
00:30 < Strav> I don't plan to have that much. One thing though, my vpn server is actually connected via wifi, should I expect the bridging to go smooth on something else than eth?
00:31 < Strav> (it's one of those plugcomputer thing... in case you wonder why the wifi)
00:38 < Strav> Hmmm. To be clear: my point is to allow the server (the one running the openvpn daemon), to access a shared folder on the client. I just issued an smbclient and the connection worked but it couldn't open a session since I guess they're not on the same work group. You bet a bridged connection will help?
00:39 < EugeneKay> Bridging causes cancer in small dogs, gives you AIDS, and will eat your baby. Do not use it.
00:39 < EugeneKay> !wins
00:39 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
00:39 < EugeneKay> That will make your samba shtuff work.
00:40 < Strav> hhehe.
00:40 < Strav> thanks, I'll give it a read.
00:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 248 seconds]
00:46 < Strav> EugeneKay: I'm not certain if WINS will help. I already know my client's ip for it's statically assigned and I can reach it via samba; my two problems are: 1. I don't with the shared folders of the client to be exposed on anything else than the vpn, 2. I have to find how to properly initiate a samba session (the server reaching for the client's share).
00:47 < EugeneKay> You need to fiddle with the client's firewall to deny access to everything but the vpn interface
00:49 < Strav> iissh. So there isn't a way to just entrust the vpn as it's done with other networks?
00:49 < EugeneKay> That's how you do it, yesh.
00:49 < EugeneKay> Configure the VPN to be a Work network or whatever
00:52 < Strav> I'd like to but there's no visible option for that. On the client's side (windows 7), I see my vpn network listed as: unidentified network, with no option to set it as a work or home network. I've checked into the adapter settings (for there's some sharing stuff in there, but it only seems to grant connection sharing)
00:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
00:56 -!- [1]rond [~rond@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Ping timeout: 246 seconds]
01:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:04 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:06 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:14 -!- mirco [~mirco@p5DD35B59.dip.t-dialin.net] has quit [Quit: mirco]
01:16 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
01:22 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
01:27 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:35 -!- Strav [~user@dsl-61-57.aei.ca] has left #openvpn ["ERC Version 5.3 (IRC client for Emacs)"]
01:37 <@vpnHelper> RSS Update - forum: OpenVPN process monitoring <http://forums.openvpn.net/topic7752.html>
01:40 -!- Dropje [~yge@5351300C.cm-6-2a.dynamic.ziggo.nl] has quit [Ping timeout: 276 seconds]
01:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:07 <@vpnHelper> RSS Update - forum: OpenVPN process monitoring <http://forums.openvpn.net/topic7752.html#p10323> || openvpn 2.2RC can't run as server ? <http://forums.openvpn.net/topic7751.html#p10322>
02:09 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
02:09 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
02:09 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
02:11 -!- Druid_ [~mf@p5B136768.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
02:14 -!- Druid_ [~mf@p5796D0A4.dip.t-dialin.net] has joined #openvpn
02:35 -!- BostX [~bost@p5B2F0F98.dip0.t-ipconnect.de] has joined #openvpn
02:38 -!- BostX [~bost@p5B2F0F98.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
02:41 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 246 seconds]
02:43 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
02:43 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Remote host closed the connection]
03:01 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html>
03:09 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
03:10 < stephan48> hi, is there a way to 'push "redirect-gateway def1"' even after the client connected?
03:10 < EugeneKay> You can't push it, but the client can fiddle with their routing table
03:10 < stephan48> i want to make a app in which the client need to auth before getting permissions to f.e. route traffic over vpn or access protected hosts in vpn net(secured via firewall rules)
03:11 < EugeneKay> User+pass auth?
03:11 < stephan48> f.e. and so create custom rules based on user(and his in app entered credentials)
03:11 < stephan48> mh...
03:11 < EugeneKay> You can do that as part of the OpenVPN connect process.
03:11 < stephan48> we also have client certs
03:14 < stephan48> but mh .. user pw auth would be a way and then user ad commonname
03:16 < stephan48> would there even be a way to first auth cert(checking if the user is allowed to connect with that, so checking CRL) and then the entered credentials(f.e. credentials to enable different configurations f.e. forwarding of all traffic or access to protected stuff`)?
03:17 < EugeneKay> Yup.
03:17 < stephan48> cool
03:18 < stephan48> and pushing/reseting the gateway rule later is not possible?
03:18 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
03:18 < EugeneKay> I don't believe so, but I've been wrong before
03:18 < stephan48> we plan it for a livecd so f.e. i can grant it only permission to autologin via cert and user/pw for forwarding data over it
03:19 < stephan48> and me with my cert and user/pw also access to services on server(or other servers in vpn=
03:19 < EugeneKay> I'm not the most knowledgable - you'll have better luck during daytime US horus
03:19 < EugeneKay> I'm vampiring at 3AM right now :-p
03:19 < stephan48> 10am :)
03:19 < EugeneKay> But, with proper config, you *should* be able to set that up
03:19 < stephan48> here in north germany
03:20 < EugeneKay> Wait for folks to wake up, ask again.
03:20 < stephan48> ye
03:20 < EugeneKay> I believe the option you're after is auth-user-pass-verify
03:20 < EugeneKay> !factoids
03:20 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
03:20 < EugeneKay> !authpass
03:20 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
03:21 < EugeneKay> There's --username-as-common-name, which will let you do common-name-based ccd/ options
03:21 < EugeneKay> So you can use a common client cert, then people enter their user+pass, and get specific options to their user
03:21 < EugeneKay> That'll probbly work best for a mass-produced live cd
03:22 < EugeneKay> One client could potentially sniff another's traffic, as they'll all have the same key combo, though ;-)
03:22 < stephan48> no is just for me and 2-3 friends
03:23 < EugeneKay> username-as-common-name is also handy if you have a laptop that roams, and sometimes you want the gateway, and sometimes oyu don't.
03:23 < stephan48> ye
03:23 < EugeneKay> Just disconnect, reconnect with a diff username
03:23 < EugeneKay> Many ways to do it
03:23 < stephan48> f.e. here on work i sometimes want just secure access to my services but in school f.e. i want gateway over vpn
03:24 < stephan48> because i dont completly trust the sys admin
03:24 < EugeneKay> Windows laptop?
03:24 < stephan48> (thus the livecd with proxy)
03:24 < EugeneKay> Oh, livecd. Derp.
03:24 < stephan48> no leptop atm
03:24 < stephan48> laptop*
03:24 < EugeneKay> Well, you could consider a PortableApps usb key instead of a LiveCD
03:24 < stephan48> is on my to buy list after apprenticeship :)
03:25 < stephan48> enoadminrights
03:25 < stephan48> :)
03:25 < EugeneKay> Ah.
03:25 < EugeneKay> LiveUSB > LiveCD
03:25 < EugeneKay> It doesn't scratch and stop working one day
03:25 < stephan48> ye
03:25 < EugeneKay> And it's /persistant/
03:25 < stephan48> but you could damage the usb stick...
03:25 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:25 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:25 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:26 < stephan48> tbh.. it needs less time for me to kill an usb stick than a cd :)
03:26 < EugeneKay> The amoutn of force to make a flash drive stop working will snap a CD in half
03:26 < stephan48> but ye true
03:26 < EugeneKay> So
03:26 < stephan48> na... kill the usb jack and stick dead
03:26 < stephan48> i once had one in a 90 degree angle :)
03:26 < EugeneKay> Anyway.... I've not used the ubuntu openvpn implementation, but I think it has a GUI that prompts you for user-pass
03:26 < stephan48> ubuntu?!
03:26  * EugeneKay shrugs
03:26 < stephan48> stay away! :)
03:26 < EugeneKay> It's what all the cool kids use nowadays
03:27 < stephan48> debian ...
03:27 < stephan48> ubuntu makes only trubles
03:29 < EugeneKay> I was raised with Red Hat. Nowadays I use Fedora on VMs and CentOS on bare metal(old, but I don't have to reinstall every 6 months)
03:30 -!- bragon [~Alexandre@2001:758:1664::8888] has joined #openvpn
03:30 < bragon> Hi *!*@*
03:30 < bragon> i need to use this option on my openvpn serveur : push "dhcp-option DNS 10.75.1.1"
03:31 < bragon> "but" i need that only specifique client take DNS update
03:31 < EugeneKay> !ccd
03:31 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
03:31 < bragon> so, in configuration i don't want DNS update, is there a workaround to don't take DNS update on specific client ?
03:32 < EugeneKay> The best you can do is to push options per-client with ccd
03:33 < bragon> For exemple if i don't want the "push route" from the serveur i can add in my client the option : route-noexec
03:33 < bragon> if i don't want the push dns what are the option ?
03:33 < EugeneKay> You can't unpush an option, but you can push a negating option
03:33 < EugeneKay> If one exists
03:33 < bragon> EugeneKay: i can't do it, this VPN is ether in production since around 2 years with around ~240 clients ...
03:34 < bragon> (the cdd modification)
03:34 < EugeneKay> Sure you can. Write a shell script to create the ccd's for all the clients
03:34 < EugeneKay> Maintaining it will be hell
03:34 < EugeneKay> But hey, that's your problem!
03:34 < bragon> that sure
03:34 < EugeneKay> Another approach you can take is to run a second instance on a different IP:port without the optio
03:35 < EugeneKay> And then clients who need it different can use the other instance
03:35 < bragon> yep.
03:36 < bragon> it's the best way to do that i guess
03:37 < bragon> EugeneKay: thanks for your time.
03:37  * EugeneKay shrugs, pulls up blanket
03:37 < EugeneKay> I'm going to sleep, finally.
03:42 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
03:44 -!- d12fk [~heiko@2a01:198:4d7:1128:21f:c6ff:fe44:aec8] has quit [Read error: Operation timed out]
03:46 -!- d12fk [~heiko@vpn.astaro.de] has joined #openvpn
03:52 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
03:52 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
03:52 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:00 -!- EugeneKay is now known as EugeneKaway
04:12 -!- MaxFrames [~MaxFrames@147.162.217.235] has joined #openvpn
04:17 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 240 seconds]
04:18 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
04:20 -!- dazo_afk is now known as dazo
04:22 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10326> || OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10325>
04:28 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10328> || VPN BRIDGING <http://forums.openvpn.net/topic7687.html#p10327>
04:40 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10329>
04:47 -!- emman [7a038738@gateway/web/freenode/ip.122.3.135.56] has joined #openvpn
04:47 < emman> helloo.. wnyone!!1
04:47 < emman> anyone!!!
04:48 < emman> can i ask how will i able to transfer a file in openvpn access server?? please help.
04:49 < janjust> emman:  this channel is NOT for openvpn access server support, only for the community version of openvpn
04:50 < janjust> so sorry, cannot help
04:50 < emman> do you know the channel for openvpn access?? help plss
04:52 < janjust> AFAIK there is no irc channel for openvpn access server ; check the openvpn website for their support channels/emails
04:58 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10330>
05:01 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Ping timeout: 276 seconds]
05:02 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
05:04 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10331>
05:05 -!- emman [7a038738@gateway/web/freenode/ip.122.3.135.56] has quit [Quit: Page closed]
05:08 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has joined #openvpn
05:08 < mrlolplx> i cant get ccd to work
05:10 < mrlolplx> isnt it supposed to be like this? /etc/openvpn/ccd/common-name
05:11 < janjust> mrlolplx:  if you have configured your server to use 'client-config-dir etc/openvpn/ccd' , then yes
05:11 < janjust> !ccd
05:11 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
05:11 < mrlolplx> right, i will try giving it fulldir then
05:11 < mrlolplx> thx
05:12 < mrlolplx> in your example
05:12 < mrlolplx> you dont have a / in the beginning
05:12 < mrlolplx> is that on purpose?
05:15 < mrlolplx> :(?
05:15 -!- maxJadi [~maxJadi@dhcp-165-144.nomad.chalmers.se] has joined #openvpn
05:15 -!- maxJadi [~maxJadi@dhcp-165-144.nomad.chalmers.se] has quit [Changing host]
05:15 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:16 -!- lyl [~mlky@nat1.semler.dk] has joined #openvpn
05:18 < janjust> mrlolplx:  that was my mistake, should have been /etc/openvpn/ccd
05:18 < janjust> and check the common-name of the client, plus make sure the CCD file itself does NOT have an extension
05:19 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has quit [Ping timeout: 248 seconds]
05:19 -!- blaads [~mlky@86.48.48.53] has joined #openvpn
05:20 -!- blaads is now known as mrlolplx
05:20 -!- mrlolplx [~mlky@86.48.48.53] has quit [Changing host]
05:20 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has joined #openvpn
05:20 < janjust> mrlolplx:  that was my mistake, should have been /etc/openvpn/ccd
05:20 < mrlolplx> works \o/
05:20 < janjust> and check the common-name of the client, plus make sure the CCD file itself does NOT have an extension
05:20 < mrlolplx> i also added a / at the end, but i dont think that matters
05:20 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10332>
05:20 -!- lyl [~mlky@nat1.semler.dk] has quit [Ping timeout: 248 seconds]
05:21 < janjust> nope, a / at the end does not make a difference (but it won't hurt)
05:25 -!- blaads [~mlky@nat1.semler.dk] has joined #openvpn
05:25 -!- blaads [~mlky@nat1.semler.dk] has quit [Client Quit]
05:26 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10333>
05:27 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has quit [Ping timeout: 255 seconds]
05:29 -!- mrlolplx [~mlky@nat1.semler.dk] has joined #openvpn
05:29 -!- mrlolplx [~mlky@nat1.semler.dk] has quit [Changing host]
05:29 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has joined #openvpn
05:29 < mrlolplx> im having some trouble assigning an ip to my user
05:29 < mrlolplx> in my server.conf i have server 10.8.0.0 255.255.255.0
05:30 < mrlolplx> and client-config-dir /etc/openvpn/ccd/
05:30 < mrlolplx> route 10.9.1.0 255.255.255.0
05:31 < mrlolplx> and then ifconfig-push 10.9.1.1 10.9.1.10 in my ccd userflie
05:31 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10334>
05:33 < mrlolplx> but when i connect to the vpn it just says something like "assigning address"
05:34 < mrlolplx> forever
05:34 < mrlolplx> oh "obtaining configuration"
05:35 < MaxFrames> hello
05:36 < MaxFrames> I'm trying to connect to a target machine from an openvpn client in routed/nat hack mode, so the connection appears to the target machine as it came from the openvpn server
05:36 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10335>
05:37 < MaxFrames> on the target machine, I have a software firewall in place, and the port I'm trying to connect has been opened to incoming packets originating from the openvpn server's IP address
05:37 < MaxFrames> but there is also another kind of restriction on the firewall: the incoming connection is accepted if it comes from that IP address *and* from a known MAC address
05:38 < MaxFrames> i.e. there is a list of known MACs, and the firewall checks if the MAC address of the calling host is in that list; if it is, connection is granted, else it's refused
05:38 < MaxFrames> now... I've inserted the openvpn server's eth0 MAC address in the list, but connection is refused
05:40 < MaxFrames> I've also inserted all the following MACs in the list: openvpn client's physical adapter; openvpn client's TAP adapter (it's windows); virtual host's physical adapter (the openvpn server is a virtual machine), no one is accepted
05:41 < MaxFrames> so the question is: with openvpn set up in routed mode with the "nat hack", what's the MAC address of the forwarded packets originating from an openvpn client?
05:42 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10336>
05:43 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:44 < janjust> mrlolplx:  you're assigning an address outside of the VPN server rnage
05:44 < janjust> s/rnage/range
05:45 < janjust> that is possible but you need to be careful and you need to add an extra route
05:45 < janjust> an easy fix would be to use 'server 10.8.0.0 255.255.254.0' which means 10.9.0.0/24 is included
05:45 < MaxFrames> from the logs of the target machine, I've figured out the MAC address, and it looks like a random one... can you confirm please?
05:47 < janjust> MaxFrames:  I'll be out for lunch right after my next line so don't wait for any more answers 
05:48 < janjust> in tun mode the tun/tap-win32 adapter's MAC address is stripped before it enters the tunnel; the openvpn server does not even know the client-side MAC address. all packets forwarded/routed from the openvpn server to other machines will appear to come from the server itself, that is, the source MAC is set to the MAC address of the outgoing interface of the server
05:48 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
05:50 < MaxFrames> logical; but that does not seem to match my scenario. The MAC address the target machine is seeing is not the MAC address of the outgoing interface of the openvpn server. In facts, it's not any MAC address belonging to any of the involved machines.
05:50 < mrlolplx> janjust is there a deeper explanation on how to set it up in the docs? Would like to know how 255.255.254.0 makes the difference to include 10.9.0.0/24
05:51 < MaxFrames> the MAC address of the openvpn server is 00:0c:29:95:67:fc, while the MAC address the target machine is seeing is 00:0b:fd:c1:74:80
05:52 < MaxFrames> the only peculiarity in my scenario is that the openvpn server is a virtual machine running in vmware server; but that MAC address is not even the one of the vmware server (host machine)
05:52 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10337>
06:21 -!- blaads [~mlky@86.48.48.53] has joined #openvpn
06:21 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has quit [Disconnected by services]
06:21 -!- blaads is now known as mrlolplx
06:21 -!- mrlolplx [~mlky@86.48.48.53] has quit [Changing host]
06:21 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has joined #openvpn
06:27 -!- blaads [~mlky@nat1.semler.dk] has joined #openvpn
06:30 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has quit [Ping timeout: 264 seconds]
06:35 -!- blaads is now known as mrlolplx
06:35 -!- mrlolplx [~mlky@nat1.semler.dk] has quit [Changing host]
06:35 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has joined #openvpn
06:36 -!- MaxFrames [~MaxFrames@147.162.217.235] has left #openvpn ["Reality is that which, when you stop believing in it, doesn't go away"]
06:41 < janjust> mrlolplx:  I'm not sure if this is well explained in the openvpn docs; it's part of basic TCP/IP routing and subnetting; I've also written a few pages about it in the openvpn cookbook
06:45 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Quit: leaving]
06:46 -!- blaads [~mlky@86.48.48.53] has joined #openvpn
06:46 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has quit [Disconnected by services]
06:46 -!- blaads is now known as mrlolplx
06:46 -!- mrlolplx [~mlky@86.48.48.53] has quit [Changing host]
06:46 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has joined #openvpn
06:47 < mrlolplx> its ok janjust, i wiki'ed subnets and used 255.255.255.128, that did the trick
06:47 < mrlolplx> i tried your example but it still didnt work
06:49 < janjust> ow right, you were using 10.9.0.0 and 10.8.0.0 - that would mean a subnet of /15 and openvpn won't grok that... 
06:50 < mrlolplx> heh, my understanding of subnets hopefully gets better with time, but for now this works, so its all good ;)
06:50 < mrlolplx> i couldnt get the tls auth to work tho
06:50 < Bushmills> maxJadi: is there a another router between openvpn server and remote machine?
06:51 < Bushmills> sorry, meant  for maxframes who left already
06:51 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10338>
06:51 < mrlolplx> copied the file via sftp to my windows client, but it said the authentication something was wrong
06:52 < Bushmills> "something is wrong" problem can be dealt with by "fixing something"
06:53 < mrlolplx> thanks for the tip
06:54 < mrlolplx> i will find the exact error if you want, i just figured that with "authentication something" you might know which error i refer to
06:55 < mrlolplx> but i can see its not very specific >P
06:55 < Bushmills> you could consider filing a bug report, because a program, giving "something is wrong" as error message could be considered buggy
06:55 < mrlolplx> are you serious_
06:55 < mrlolplx> ?
06:56 < Bushmills> absolutely. i'd file a report as response to such a message
06:56 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10339>
06:56 < mrlolplx> http://pastebin.com/2r9W6CtV
06:57 < Bushmills> but OTOH, i found actually a use for an error message others would also complain about:  "error:  no error"
06:58 < janjust> mrlolplx:  check the tls-auth files on both ends, make sure they are identical; if you're using the directional parameter (tls-auth ta.key 0|1) then make sure one end has 0 , the other and has 1
07:01 < mrlolplx> ok, the only thing i havent checked is if the content of ta.key is exactly the same, but i just copied the file, so i dont see how it could be different
07:03 < ecrist> wolfric: I don't know where you get the idea that push is only for tun-based vpns, but you're wrong
07:04 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
07:06 < janjust> don't know mrlolplx , my bet is that the tls-auth parameters are out of sync (0 or 1 missing, or 1's on both end etc)
07:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:11 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
07:19 < mrlolplx> server is 0
07:19 < mrlolplx> client is 1
07:26 < wolfric> ecrist: but you wouldn't need it if you were using a tap and assigning addresses in the same range.
07:26 < ecrist> you don't seem to get it
07:26 < ecrist> I told you what to do.  did you try it?
07:26 < stephan48> tap was bridged and tun routed?
07:27 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
07:27 < ecrist> yes, stephan48 
07:32 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
07:35 < janjust> more or less, stephan48 : tun can pass only IP traffic and is used in a routed setup; tap can pass full ethernet frames and is often used in a bridged setup
07:35 < stephan48> ye
07:37 < janjust> mrlolplx:  run both client and server with 'verb 5' and check the (long) server and client logs for the HMAC values chosen. and, did you verify that the tls-auth key files are identical on both ends (e.g. using md5sum or cksum) ?
07:44 -!- hoot_spot [~User@p5DDBBD6F.dip.t-dialin.net] has joined #openvpn
07:44 < hoot_spot> Hi, I cannot create an account on the forums.
07:45 < hoot_spot> Is there a way to bind OpenVPN client to a specific adapter, so only applications I want to use the VPN I can bind also to the specific adapter?
07:45 < hoot_spot> And does the adapter have to have a specific IP or will any private IP work?
07:50 < ecrist> hoot_spot: why can't you create an account?
07:50 < ecrist> you set the address openvpn binds to with the --local option
07:50 < hoot_spot> ecrist I don't know. I went through with the form to create an account. Now it says 'bad password'. The password was saved in my browser and in my clipboard, so I am simply doing a copy and paste. No room for error.
07:51 < hoot_spot> there is also no 'reset password' option in case that might fix it.
07:51 < ecrist> well, instead of trying to copy and paste, try typing it twice in the registration form.
07:51  * ecrist can reset passwords
07:52 < hoot_spot> I use the pwgen extension for firefox, which puts the password in the clipboard. I pasted it twice in both boxes, so why wouldn't it be identical? It works on every other forum.
07:53 < ecrist> no idea, hoot_spot, but our registration process has worked for nearly 1000 users so far...
07:55 < hoot_spot> ooo ok. Well I won't bother then. You should make a 'reset password' option also on your custom software. Or just use php3BBS like everyone else does. This is retarded. Thanks for the help.
07:55 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10340>
07:55 -!- hoot_spot [~User@p5DDBBD6F.dip.t-dialin.net] has quit [Quit: Leaving]
07:56  * ecrist doesn't care
07:56 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
07:56 < ecrist> I told him I could reset his password.
07:57 < mrlolplx> some people dont want help
07:57 < mrlolplx> just complain ;)
07:57 < ecrist> I think he probably fits into that group
07:57 < mrlolplx> janjust im off for now, i might be online later, thanks for all the help so far
07:59 < mrlolplx> .o/
07:59 -!- mrlolplx [~mlky@unaffiliated/mrlolplx] has quit []
08:00 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10341>
08:06 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10342>
08:17 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 276 seconds]
08:17 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
08:19 -!- ecrist changed the topic of #openvpn to: OpenVPN 2.1.4 Most Current || 2.2-RC Released 04-Mar-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: http://forums.openvpn.net || Developers: #openvpn-devel || We won't put more work into your problem than you do, that's just silly.
08:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
08:21 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
08:21 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
08:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
08:32 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
08:35 -!- mant1s [~mant1s@cpe-74-78-40-181.maine.res.rr.com] has joined #openvpn
08:35 -!- mant1s [~mant1s@cpe-74-78-40-181.maine.res.rr.com] has quit [Changing host]
08:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:36 <@vpnHelper> RSS Update - forum: Windows 7 OpenVPN client connection issue <http://forums.openvpn.net/topic7567.html#p10344> || OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10343>
08:37 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
08:42 <@vpnHelper> RSS Update - forum: Windows 7 OpenVPN client connection issue <http://forums.openvpn.net/topic7567.html#p10346> || OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10345>
08:54 <@vpnHelper> RSS Update - forum: OpenVPN on Debian doesn't want to route? <http://forums.openvpn.net/topic7753.html#p10347>
08:58 -!- zxd_ [~zxd@95.211.21.37] has joined #openvpn
09:00 < zxd_> how do I disable all encryption openvpn
09:00 < zxd_> I get too many connections resets
09:00 < zxd_> behind the vpn
09:01 < zxd_> hmm I get this in the logs!
09:01 < zxd_> Mar  9 22:00:37 netvpsgw1 ovpn-vpsserver2[9902]: write UDPv4 [EMSGSIZE Path-MTU=1400]: Message too long (code=90)
09:03 < zxd_> I also get this Mar  9 21:53:27 netvpsgw1 ovpn-vpsserver2[9902]: Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #11079 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
09:03 < zxd_> thanks
09:04 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has joined #openvpn
09:06 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has quit [Client Quit]
09:13 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10348>
09:15 < zxd_> how do I define tun-mtu in config file
09:17 < janjust> zxd_:  sounds like you've got a bad internet line
09:17 < ecrist> !mtu
09:17 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
09:17 < janjust> you can define tun-mtu in the server and client config files using 'tun-mtu 1400' ; personally I'd start playing with 'fragment' first , however
09:21 < zxd_> why would you want to play with  'fragment' first?
09:21 < zxd_> what's the advantage
09:21 < zxd_> vs setting the mtu
09:40 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
09:42 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
09:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
09:51 < zxd_> janjust, yes --fragment 1300 did the trick
09:52 < zxd_> I don't know why but tun-mtu 1400 didn't do it
09:52 < zxd_> even though 1400 is the maximum MTU on the client side
09:52 < janjust> if your client or server is windows then it's harder to play with the mtu size
09:53 < janjust> that's why I suggested to first play with --fragment
09:53 < zxd_> janjust, it's like this, l2tp/ppp client to linux serv running openvpn that is connected to another linux server with openvpn
09:53 < zxd_> I route the traffic from ppp to the openvpn tunnel
09:53 < zxd_> the mtu on the ppp interfaces is 1400
09:54 < zxd_> the tun-mtu should have worked no?
09:54 < zxd_> if IP traffic being forwarded is not larger than 1400
09:54 < janjust> then set the tun-mtu to be *less than* 1400
09:54 < zxd_> why less?
09:54 < janjust> there's extra overhead for the openvpn encapsulation
09:55 < zxd_> hmm ah
09:55 < janjust> easiest way to test is to use 'ping -M do -l <size> <IP>' and play with the size
09:55 < janjust> this tells ping to set the 'don't fragment' flag
09:55 < janjust> if the packet fits you will get a response, otherwise not.
09:56 < zxd_> janjust, well yes, the mtu on the tun interface is before the encapsulation but the WAN interface that connects to the linux server ( openvpn server) they are both 1500
09:56 < janjust> now set the size to 1400 (which should fail), then 1000, then 1200, then 1300, then 1350 etc
09:57 < zxd_> what I think is that mtu-disc is screwing things up
09:57 < zxd_> because the link between the openvpn client and server is 1500
09:57 < zxd_> mtu
09:57 < zxd_> so it thinks it can send more than 1400
09:58 < janjust> you can also try running openvpn on both ends with --mtu-test
09:58 < zxd_> janjust, but that won't help me, because the traffic dosen't end on the openvpn client
09:58 < zxd_> janjust, it is forwarded to another interface with mtu of 1400
09:58 < zxd_> janjust, on the client side
09:59 < janjust> ah... well in that case use 'ping' with DON'T FRAGMENT to determine the maximum packet size
09:59 < zxd_> and then set that to --fragment parameter?
09:59 < zxd_> or tun-mtu
10:02 < janjust> tun-mtu ; but actually, if --fragment works for you why not stick with that?
10:06 < zxd_> because they state "It is only meant as a last resort when  path  MTU  discovery  is             broken.  Using this option is less efficient than fixing path MTU discovery for your IP link and using native IP fragmentation instead."
10:07 < janjust> that is true ; but your setup is quite complicated with the openvpn-to-ppp link
10:07 < janjust> not even sure if you *can* fix this using mtu path discovery
10:08 < janjust> it _IS_ possible to turn off mtu discovery using '--mtu-disc off'
10:09 < janjust> << out
10:09 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:11 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10349>
10:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
10:16 < zxd_> damit
10:16 < zxd_> I forgot my router is using l2tp aswell
10:16 < zxd_> another overhead
10:28 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
10:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:31 -!- drax2gma [~gma@fibhost-66-157-44.fibernet.hu] has joined #openvpn
10:31 < drax2gma> hi ppl
10:32 < drax2gma> please help somebody.. what if i set up a very simple tunnel with symmetric key, and I can ping only from the client side? I've tried everythingúű
10:33 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
10:43 < zxd_> what's the difference between  --link-mtu and --fragment
10:45 -!- drax2gma [~gma@fibhost-66-157-44.fibernet.hu] has left #openvpn ["WeeChat 0.3.4"]
10:46 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:49 -!- gladiatr_afk [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
10:53 -!- albech [~thomas@ppp-61-7-129-49.Standard.cathinet.com] has joined #openvpn
11:08 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
11:09 <@vpnHelper> RSS Update - forum: Simple configuration for 1 server and 2 clients <http://forums.openvpn.net/topic7745.html#p10350>
11:29 -!- luneff [~yury@84.51.212.81] has joined #openvpn
11:29 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
11:32 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
11:34 -!- albech [~thomas@ppp-61-7-129-49.Standard.cathinet.com] has quit [Quit: Ex-Chat]
11:49 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has quit [Remote host closed the connection]
11:51 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Quit: Leaving]
11:51 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Quit: Leaving]
12:04 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
12:15 -!- Sea [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
12:15 < Sea> Hi
12:16 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:16 < Sea> got a ( hopefully ) little question for openvpn :) Trieing to set it up, so I can surf from china, when I need to go there next week...
12:17 < Sea> I have a vRoot Server running and try to connect with the windows openvpn client to it. So far this works. Server assigns me an IP, but I dont get the routung to work
12:18 < Sea> routing
12:19 < Sea> vroot has debian running btw, and I followed this manual here: http://cihan.me/how-to-setup-openvpn-server-on-debian-lenny/
12:19 < gladiatr> vRoot?
12:19 <@vpnHelper> Title: How to setup OPENVPN Server on Debian Lenny | Cihan DOGAN’s IT Blog (at cihan.me)
12:19 < Sea> uhm o_0
12:20 < gladiatr> is vRoot some sort of hosting provider?
12:20 < gladiatr> Anyway, have you configured IPTables to NAT your vpn network?
12:20 < Sea> thats what wont work for me
12:20 -!- tf87 [~tf1987@office.neteasyinc.com] has joined #openvpn
12:20 < gladiatr> what won't work?
12:20 < Sea> well I guess ...
12:20 < gladiatr> heh
12:21 < Sea> the iptables
12:21 < ecrist> why not?
12:21 < gladiatr> Apparently Sea has incurred the wrath of Jesus...
12:22 < tf87> hello, I have setup an openvpn configuration on a vyatta router as a server with ptp topology. I have a client configuration setup with an iroute, client config on standard debian linux works great, but the client config on a dd-wrt v24 does not work
12:22 < ecrist> freebsd is the cure
12:22 < gladiatr> lol
12:22 < gladiatr> indeed
12:22 < tf87> i removed ( iptables -F ) the firewall on the dd-wrt, so that is not the issue
12:22 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
12:22 < gladiatr> hrm... food... must find... biab
12:22 -!- asdg [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
12:22 < asdg> iptables-restore v1.4.2: no command specified
12:22 < asdg> Error occurred at line: 17
12:22 < asdg> Try `iptables-restore -h' or 'iptables-restore --help' for more information.
12:22 < asdg> ....
12:23 -!- gladiatr is now known as gladiatr_afk
12:23 < asdg> thats what happens If I open the VPN :p
12:23 < ecrist> sounds like you  need to look at line 17 and fix the problem.
12:23 < Bushmills> tf87: best thing to do with a config which doesn't work is to change it such that it works
12:23 < ecrist> pretty straight forward.
12:23 < asdg> yeah but 17 is COMMIT :D
12:23 < tf87> does anyone know of an issue with  OpenVPN 2.1.1 mipsel-unknown-linux-gnu [SSL] [LZO2] [EPOLL] built on Aug  7 2010  ?
12:23 <@dazo> tf87: dd-wrt is pretty much crap (at least their attitude towards security in general) ... however, I'm using openwrt with openvpn in tun mode ... not sure if you with ptp mean tun mode or not multi-client 
12:24 < tf87> multi-client point-to-point topology
12:24 < tf87> such that clients can't talk to each other
12:24 -!- tntcoda [~tntcoda@94-195-160-204.zone9.bethere.co.uk] has joined #openvpn
12:24 <@dazo> you're confusing things now 
12:25 <@dazo> if you do not use --client-to-client ... clients cannot talk to eachother ... unless you allow it via firewalling on the router
12:25 -!- Sea [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 250 seconds]
12:25 < tntcoda> Hi, am i correct in thinking if two ends of a VPN are on the same subnet/ip range that it will explode?
12:25 < asdg> the error must be somewhere in the filter part, but I sont see one ...
12:25 < asdg> ah man
12:25 -!- asdg is now known as Sea
12:26 <@dazo> tntcoda: yes, unless you're bridging .... which is not recommended unless you really know what you are doing and why you are doing it
12:26 < Bushmills> tf87: mips openvpn runs nicely here, also able to talk to other openvpn clients.
12:27 < Sea> u guys do have another idea ?
12:27 < tf87> I think vyatta is calling the client-to-client option ptp
12:27 < tntcoda> dazo, ok thanks - so basically if my VPN client is on a laptop I need to ensure that whatever random/public network I plug it into doesnt clash with my server. Thats probably an over exaguratted clash risk though i guess
12:28 < tf87> 'PUSH_REPLY,route-gateway ***1,topology subnet,ping 10,ping-restart 60,route **** ****,ifconfig ***10 255.255.255.0'
12:28 <@dazo> tntcoda: nah, you might hit it from time to time ... but if you stay away from 192.168.x.x based IP's you're safe in 90% of call cases
12:28 < tf87> okay now the default is topology subnet
12:28 < tntcoda> ok thanks a lot :)
12:28 < tf87> but, in either case i cannot ping in either direction
12:28 < tf87> although the tunnel is "up"
12:29 < Bushmills> tntcoda: use http://scarydevilmonastery.net/subnet.cgi as openvpn subnet
12:29 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
12:30 <@dazo> tf87: sounds like firewalling ... double check with tcpdump or iptables -j LOG rules (on the dd-wrt) router
12:30 < tntcoda> Bushmills, thanks :) Would you normally have the VPN server as a single box on the subnet? Then provide routes through to the LAN? Or is it fairly common just to whack it on the same subnet as the LAN boxes you're exposing?
12:31  * dazo heads out for a while
12:32 < Bushmills> tntcoda: i don't understand your question, unless the answer "usually openvpn server and clients have addresses in a subnet dedicated to openvpn use" makes sense
12:33 -!- dazo is now known as dazo_afk
12:33 < tntcoda> Bushmills, ok thanks - i think that answers my question :)
12:40 < Sea> halp plz :( I bet its just some stupid thing but atm I dont see anything wrong there
12:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 246 seconds]
12:51 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
12:51 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
12:51 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:57 -!- dazo_afk is now known as dazo
13:11 -!- BostX [~bost@p5B2F03D7.dip0.t-ipconnect.de] has joined #openvpn
13:20 -!- mirco [~mirco@p5DD35B59.dip.t-dialin.net] has joined #openvpn
13:33 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:35 -!- tntcoda [~tntcoda@94-195-160-204.zone9.bethere.co.uk] has quit [Quit: Leaving]
13:36 -!- luizxx_ [~luizxx@moooo.com.br] has left #openvpn []
13:40 -!- Sea [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit []
13:42 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
13:43 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
13:50 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has quit [Ping timeout: 276 seconds]
13:51 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has joined #openvpn
13:51 -!- secretary_linux [~bplunkert@static-70-107-242-118.ny325.east.verizon.net] has quit [Changing host]
13:51 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has joined #openvpn
14:00 -!- freaky[t]_ [alpha@freakyy.de] has quit [Read error: Operation timed out]
14:01 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
14:07 -!- majuk [~majuk@mail.meadowlark.org] has joined #openvpn
14:07 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
14:09 < majuk> Hey guys. If anyone can lend me some insight on this clients failed connection attempt. The site claims it does no outbound blocking. 
14:09 < majuk> http://pastebin.com/iKPGaV1M
14:12 < majuk> I will accept, "Uh, yea they /do/ block outbound access." as an answer.
14:13 < majuk> Tried with and without 'nobind' option
14:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
14:15 < ecrist> not really a whole lot of log to look at...
14:16 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:16 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
14:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:22 -!- luneff [~yury@84.51.212.81] has quit [Quit: Leaving]
14:23 -!- dazo is now known as dazo_afk
14:24 -!- mirco_ [~mirco@p5DD35D15.dip.t-dialin.net] has joined #openvpn
14:26 -!- mirco [~mirco@p5DD35B59.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
14:26 -!- mirco_ is now known as mirco
14:27 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
14:27 -!- mode/#openvpn [+o mattock1] by ChanServ
14:27 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Connection reset by peer]
14:28 < majuk> ecrist, Yea, I know. I turned up the verbosity to 8 to get that much
14:28 -!- thebishop [~thebishop@66.187.140.174] has joined #openvpn
14:29 < thebishop> hello hello
14:29 < thebishop> has anyone found a way to connect via Network Manager?
14:37 < Fleck> anyone has tried webmins openvon plugin?
14:37 < Fleck> aka module
14:43 < ecrist> !ubuntu
14:43 <@vpnHelper> "ubuntu" is dont use network manager!
14:45 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
14:55 < Fleck> thebishop sure, done that several times ;P
14:55 < thebishop> Fleck, using the client.ovpn file?
14:55 < Fleck> nope
14:55 < thebishop>  ok, but it can be configured manually?
14:55 < Fleck> yes
14:55 < thebishop> ok thanks
14:56 < thebishop> Fleck, you know of a guide?
14:57 < Fleck> nope
14:57 < Fleck> just opened ,ovpn and tried to set up settings in net manager ;D
14:58 < thebishop> pl
14:58 < thebishop> ok
15:01 -!- EugeneKaway is now known as EugeneKay
15:09 -!- majuk [~majuk@mail.meadowlark.org] has quit [Remote host closed the connection]
15:29 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
15:36 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:43 -!- p3rror [~mezgani@41.140.96.135] has quit [Ping timeout: 246 seconds]
15:49 -!- noisebleed_ [~quassel@lula.inescn.pt] has joined #openvpn
15:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
15:50 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
15:51 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
15:52 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 260 seconds]
15:54 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:56 -!- p3rror [~mezgani@41.248.184.192] has joined #openvpn
16:12 -!- noisebleed_ [~quassel@lula.inescn.pt] has quit [Ping timeout: 252 seconds]
16:16 -!- thebishop [~thebishop@66.187.140.174] has quit [Ping timeout: 255 seconds]
16:16 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
16:16 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
16:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:17 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
16:32 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
16:55 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
16:58 <@vpnHelper> RSS Update - forum: one certificate two servers <http://forums.openvpn.net/topic7754.html>
17:00 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
17:13 < reiffert> .n
17:15 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
17:29 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Ping timeout: 246 seconds]
17:30 -!- dvl [~dvl@64.147.113.42] has joined #openvpn
17:40 -!- EugeneKay is now known as EugeneKaway
17:44 -!- Torpion [~torpion@ydb.me] has joined #openvpn
17:45 < Torpion> hello
17:45 < Torpion> I have a problem watching:
17:46 < Torpion> Unable to connect because your certificate is not yet valid, Check that your sytem time is correct
17:46 < Torpion> http://paste-bin.toile-libre.org//view.php?id=5
17:46 < Torpion> Can you help me please?
17:49 -!- EugeneKaway is now known as EugeneKay
17:52 < Torpion> EugeneKay: ?
17:53 < EugeneKay> Your certificate is not yet valid. TIme zone problem.
17:53 < EugeneKay> And I'm having dinner, shush.
17:55 < Torpion> owever my server is the right time?
17:56 < reiffert> try this:
17:56 < reiffert> openssl x509 -in thefile.crt -noout -text
17:56 < reiffert> check for startdate or something similar
17:56 < reiffert> could be done by
17:56 < reiffert> openssl x509 -in thefile.crt -noout -startdate    or something similar
18:02 < Torpion> reiffert: Thank you, but in which folder?
18:04 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
18:16 < reiffert> in the folder that contains your public key.
18:16 < reiffert> (the crt file)
18:19 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Quit: leaving]
18:34 <@vpnHelper> RSS Update - forum: Avoid dropping of connection <http://forums.openvpn.net/topic7749.html#p10352>
18:47 -!- genlight [~genlight@acl1-830bts.gw.smartbro.net] has joined #openvpn
18:48 < genlight> anyone here guys to help me?
18:48 < genlight> kindly help me out on my problem maam?
18:54 < genlight> anyone please?
18:54 < genlight> is anyone here?
18:57 < |Mike|> read the topic please.
19:02 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has joined #openvpn
19:03 < genlight> where to read the topic mike?
19:03 < wolfric> is it possible to push out 2 different addresses with openvpn to the client?
19:04 < hjohnson> Torpion: and/or your clock is reset to something like 1980 :P
19:05 < genlight> my problem is I dont know if my vpn server configuration is correct because my connection drops if my wireless signal change like hsdpa to 3g
19:06 < |Mike|> ./topic
19:06 < |Mike|>  Your problem is your firewall, really. || Type !welcome and !goal
19:06 < |Mike|>           before asking your questions. 
19:06 < genlight> sorry I am not familiar with mirc really.
19:06 < hjohnson> genlight: which makes sense, you're probably getting a new IP address on that transition.
19:07 < |Mike|> which means tcp/udp reset :)
19:07 < genlight> what about my firewall? how can I configure that tcp/udp? and why tcp/udp?
19:07 < hjohnson> |Mike|: can I hit him with a copy of Tanenbaum?
19:07 < |Mike|> (dear god, please bare with me)
19:07 < |Mike|> hjohnson: Yes sir!
19:08 < hjohnson> heh
19:08 < genlight> hjohnson: yes I am getting new ip from my vpn server
19:09 < genlight> sorry I am not very good at openvpn, i am really a beginner
19:09 < |Mike|> genlight: it's quite normal that your VPN connection drops if you switch from wireless to hsdpa / 3g or whatshowever other "connection"
19:09 < genlight> so that is normal?
19:09 < hjohnson> yes
19:09 < hjohnson> because when your wireless card switches from HSPA to 3G you probably get assigned a new address
19:10 < hjohnson> which means that your VPN tunnel has to be renegotiated.
19:10 < |Mike|> it's like pluggin cable A in, connect, pull it out and put cable B in and reconnect :-)
19:10 < genlight> why is that? but if i use the other free vpn service, even if the wireless connection change it does not drop.
19:11 < hjohnson> they should
19:12 < |Mike|> or their ttyl is really high
19:12 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
19:12 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
19:12 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
19:12 < |Mike|> (or low)
19:12 < genlight> ttyl, time to live?
19:12 < hjohnson> yeah
19:13 < genlight> can I change my time to live? will it solve the dropping problem?
19:13 < |Mike|> Yep, if you administer the server and client :)
19:14 < genlight> yes, I administer the server and client. can you please tell me how?
19:14 < |Mike|> Normally I would say "RTFM" :)
19:15 < genlight> rtfm?
19:15 < wolfric> read the fucking manual
19:16 < |Mike|> !tell genlight [howto]
19:16 < genlight> im really sorry sir but I have been reading for weeks now the manuals in openvpn webpage
19:17 < |Mike|> You might want to set the ttyl low because it will timeout fast if you change connection (lets say from wifi to g3/hsdpa)
19:18 < |Mike|> and it will reconnect quite fast after a disconnect.
19:18 < wolfric> |Mike|: what's ttYl
19:18 < wolfric> |Mike|: sure you don't mean ttl?
19:18 < |Mike|> wolfric: troll!
19:19 < wolfric> ...
19:19 < genlight> so if I set my ttl low, it will not drop my connection?
19:19 < |Mike|> And yes I do mean TTL instead of ttyl :-P
19:19 < genlight> even if the wireless signal type change?
19:19 < |Mike|> it will drop, but it reconnects faster 
19:20 < |Mike|> and won't take 10 minutes or whatever it has b een set to.
19:20 < genlight> how low should it be sir mike?
19:21 < |Mike|> I would set it to 40 to 60 seconds if you change connections that lot
19:24 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
19:25 < genlight> why? what is the default ttl sir mike because I dont think I have touched that ttl configuration on my server and client
19:30 < genlight> sir mike I have read the manual again but I have not seen time to live there?
19:30 < genlight> please direct me
19:37 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has joined #openvpn
19:37 < |Mike|> genlight: it's all explained in the howto.
19:39 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
19:39 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
19:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:40 < genlight> ok sir. but what is lower in ttl. is the value 40 lower value or 60 is the lower value?
19:40 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Ping timeout: 255 seconds]
19:40 < wolfric> genlight: could you repeat your problem for those who weren't here to see the start of it?
19:41 < genlight> why sir wolfric?
19:41 < wolfric> genlight: stop calling me sir
19:41 < genlight> sorry
19:41 < genlight> im just used to.
19:42 < wolfric> if all |Mike| seems to be able to say is rtfm, you sound like you could use another set of ears
19:42 -!- BostX [~bost@p5B2F03D7.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
19:43 -!- TheDoc [~teehee@unaffiliated/thedoc] has joined #openvpn
19:43 < genlight> my problem is: when my wireless connection signal type changes from hsdpa to 3g or other signal type and vice versa, my vpn connection drops.  can someone assist me further please.
19:43 < genlight> MIKE advised me to lower the TTL value and to lower my MTU value to 1492. any other advise please.
19:44 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
19:45 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has joined #openvpn
19:47 < wolfric> when you say drops? By default settings, it should kick back almost instantly. can you provide a copy of your server and client conf. 
19:47 < wolfric> what happens on your client side when it drops
19:48 < wolfric> what does openvpn display? Does it attempt to reconnect and spit an error? Or does it just keep going as if nothings wrong
19:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
19:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
19:52 < genlight> wolfric, if my connection drop it will attempt to reconnect but often times when reconnecting it takes a while to be connected again so it needs to really disconnect and connect again. and this is irritating.  that is why i am looking for ways how to prevent dropping of connection if possible.
19:52 < wolfric> also have you got persist-tun/tap?
19:52 < wolfric> your connection will drop of course. the question is is it not coming back up or just coming back up slowly
19:52 < genlight> yes I have persist-tun and persist-remote-ip
19:52 < wolfric> ah i see
19:53 < wolfric> well an easier way would be to set duplicate-cn
19:53 < wolfric> which allows multiple clients with the same cert to connect to the vpn
19:54 < wolfric> you're probably looking for keepalive which for me is set at 1 ping every 10 seconds and assume it's down at 120
19:55 < wolfric> the problem with this is that you could be disconnecting and reconnecting if you set it too low. While you want good connection if you DO disconnect, i'd say especially with 3g, you can loose packets and cause the server to kick you off when you don't need to be
19:55 < genlight> i have also keepalive option set to keepalive 5 30
19:55 < wolfric> how fast do you want to be back in business?
19:56 < genlight> what do you mean fast to be back in business? i guess it would be best if it will not drop.
19:56 < wolfric> not really possible (i don't think anyway)
19:56 < genlight> ok. so what is the next best thing?
19:56 < wolfric> you have to balance how fast you want to bounce back vs how much bandwidth you're willing to give up
19:57 < genlight> ok. so what is the next best thing?
19:57 < wolfric> try duplicate-cn
19:57 < wolfric> which means you can connect in again without the first connection timing out
19:57 < genlight> in my server config 
19:57 < wolfric> yes
19:58 < genlight> do I need to add that too in my client?
19:58 < genlight> do I need to add that too in my client config?
19:58 < wolfric> otherwise, try keepalive 5 15  
19:58 < wolfric> no
19:58 < genlight> keepalive 5 15 for my server and client config right?
19:59 < wolfric> no
19:59 < wolfric> if you're going for duplicate-cn then set keepalive 10 50 maybe for your server and don't set it in the client
19:59 < genlight> server only?
19:59 < wolfric> yes
19:59 < genlight> wait
20:00 < genlight> duplicate-cn and keepalive 10 50 for my server. how about on the client?
20:00 < wolfric> nothing on the client
20:01 < genlight> currently i have keepalive 5 30 on my client and server. should I remove keepalive in my client config ?
20:01 < wolfric> yes
20:02 < wolfric> keepalive pushes the config file to the client and makes it do the equivilent but halves it's timeout time
20:02 < genlight> why? dont my client config need that too?
20:02 < wolfric> read above
20:02 < wolfric> the server basically tells the client to do near enough to the same from what it has in it's on config file
20:03 < genlight> ow i see. i have read the openvpn manual but it does not says that only the server needs that option.
20:03 < wolfric> Not in so many words
20:03 < genlight> ok
20:03 < wolfric> if you read under keepalive you'd see that it resolves to "push keepalive" which pushes the keepalive option to the client
20:04 < genlight> let me read that again.
20:04 < wolfric> anyway i'm going to head off. Need my sleep
20:04 < wolfric> good luck
20:04 < genlight> thanks for the replies.
20:05 < genlight> .
20:06 < genlight> my second question would be: HOW CAN I CREATE A MULTIPLE SERVER VPN
20:06 < |Mike|> g'nite.
20:07 < genlight> ok. thanks mike. I guess it is night time there. thanks.
20:07 < genlight> good night to you all there.
20:08 -!- genlight [~genlight@acl1-830bts.gw.smartbro.net] has quit []
20:15 -!- luneff [~yury@84.51.212.81] has joined #openvpn
20:17 -!- Druid_ [~mf@p5796D0A4.dip.t-dialin.net] has quit []
20:19 -!- pingec [~pingo@93-103-244-156.dynamic.t-2.net] has quit []
20:20 -!- takamichi [~pri@46.11.13.117] has quit [Remote host closed the connection]
20:50 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
20:51 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 246 seconds]
20:58 -!- common- [~common@p5DDA4BEA.dip0.t-ipconnect.de] has joined #openvpn
20:58 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
21:00 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
21:00 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:01 -!- common [~common@p5DDA4B34.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
21:01 -!- common- is now known as common
21:09 -!- master_of_master [~master_of@p57B53982.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
21:10 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has joined #openvpn
21:11 -!- master_of_master [~master_of@p57B53651.dip.t-dialin.net] has joined #openvpn
21:51 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
21:55 -!- albech [~thomas@110.164.248.17] has joined #openvpn
21:57 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:00 -!- itai1 [~itai@uk1.ibvpn.com] has joined #openvpn
22:01 < itai1> hi, i've been using openvpn on ubuntu for a while without problems, starting today i cannot acess the internet WITHOUT using the VPN, must have change some of my config files , what can i do ?
22:09 -!- itai1 [~itai@uk1.ibvpn.com] has quit [Remote host closed the connection]
22:15 < WebDawg> heh
22:19 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
22:20 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
22:24 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 252 seconds]
22:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:51 <@vpnHelper> RSS Update - forum: Automatically mount network drive when openvpn connects <http://forums.openvpn.net/topic7746.html#p10353>
22:54 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:55 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
23:00 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
23:03 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
23:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
--- Day changed Thu Mar 10 2011
00:08 -!- EugeneKay is now known as EugeneKaway
00:08 -!- EugeneKaway is now known as EugeneKay
00:19 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 255 seconds]
00:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
00:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:43 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:55 -!- EugenMayer [~eugen@frbg-5d84f5bf.pool.mediaWays.net] has joined #openvpn
00:56 < EugenMayer> Hello. I have a VPN client which has 7 VPN connections in 4 different networks ( 10.88.0.0,10.99.0.0, 10.77.0.0, 10.66.0.0 )
00:57 < EugenMayer> into to 66 network, it has 4 IPs, .101 .102 .103 .104
00:58 < EugenMayer> I need those IPs to have IP-based firewalling of the apache server ( depending on which tun / ip is the incoming one =
00:58 < EugenMayer> now, when i ping one of the 66 ips, i get a "redirect hop". any ideas?
00:58 -!- mirco [~mirco@p5DD35D15.dip.t-dialin.net] has quit [Quit: mirco]
01:00 < EugenMayer> what i dont get is, why all my clients have
01:00 < EugenMayer> 10.66.0.0  -> 0.0.0.0 as route
01:00 < EugenMayer> and not 
01:00 < EugenMayer> 10.66.0.0 -> 10.66.0.1
01:03 < EugeneKay> Redirect hop means that your default gateway is routing the traffic to the openvpn server- that's normal.
01:05 < EugenMayer> EugenKay but i can reach the client form other clients on the 66 interface
01:05 -!- genlight [~genlight@acl1-830bts.gw.smartbro.net] has joined #openvpn
01:05 < EugenMayer> works perfectly with all the other networks
01:06 < EugenMayer> EugenKay shouldnt i change the gateway on the clients to route rhough 10.66.0.1 directly, and not 0.0.0.0?
01:06 < genlight> good day! can I ask my second question ?
01:07 < EugeneKay> If it works, don't screw it up
01:07 < EugeneKay> :-p
01:07 < genlight> how can I create a multi-server vpn?
01:07 < genlight> kindly guide me. thanks
01:07 < EugenMayer> genlight: different ports
01:07 < EugenMayer> thats it.
01:07 < EugeneKay> I think he's after multi-master.
01:07 < EugenMayer> ah i see
01:08 < EugenMayer> Actually it doe not work
01:08 < genlight> can you give me example please?
01:08 < genlight> can that be done in just one config file?
01:08 <@vpnHelper> RSS Update - forum: one certificate two servers <http://forums.openvpn.net/topic7754.html#p10354>
01:09 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
01:09 < EugeneKay> You need the two vpn servers, serving up two different vpn subnets, and a link between the two so traffic for the other can be routed properly.
01:09 < genlight> yes thanks. do I need to create another config file for that? 
01:10 < genlight> like remote x.x.x.x x
01:10 < EugeneKay> Yes, but the only change between them should be the subnet being served
01:10 < genlight> can you please give me an example eugenekay because i am really lost at this.
01:10 < EugeneKay> I don't know of one off-hand, sorry.
01:13 < genlight> http://pastebin.com/6Ja1BPTn   <<-- that is my current vpn server config. can you edit that for me so that I will know how to create multi-server vpn
01:13 <@vpnHelper> RSS Update - forum: Avoid dropping of connection <http://forums.openvpn.net/topic7749.html#p10356> || Automatically mount network drive when openvpn connects <http://forums.openvpn.net/topic7746.html#p10355>
01:14 < genlight> please
01:14 < EugeneKay> "server" is the line that controls what subnet is handed out
01:14 < EugeneKay> Changing one from 10.8.0.0 to 10.8.1.0 will work
01:15 < EugeneKay> Server B will also need to be setup with a second instance of openvpn, connected to Server A
01:15 < EugeneKay> Though, it looks like you're just using it to redirect the gateway through the openvpn server
01:16 < EugeneKay> If you don't need client-to-client communication, then you don't need to change a thing.
01:16 < genlight> how can I make multiple instance of vpn server?
01:17 < EugeneKay> Depending upon your startup scripts, each .conf in the /etc/openvpn/ dir will be run as a server instance
01:17 < EugenMayer> can a client declient the push of a route EugenKay?
01:17  * EugeneKay has three E's
01:17 < EugeneKay> -_-
01:18 < EugenMayer> as explained above, one client has 4 interfaces into one network, but the client should only use one
01:18 < genlight> how ? can you teach me that startup script. How can I stop,start or restart openvpn service?
01:18 -!- EugenMayer is now known as XEugenMayer
01:18 < XEugenMayer> EugeneKay: :)
01:18 < genlight> how ? can you teach me that startup script. How can I stop,start or restart openvpn service?
01:18 < EugeneKay> genlight - no, I don't think I can
01:19 < EugeneKay> XEugenMayer - At 1AM, I'm not too good with figuring out routing ::-p
01:19 < EugeneKay> But I'm sure there is a way
01:19 < XEugenMayer> Ok, no worries. Sleep well
01:21 < XEugenMayer> iam using ccd already, so might be done that way
01:24 -!- heftig [jan@archlinux/developer/heftig] has joined #openvpn
01:25 < heftig> is there a guide to troubleshoot connection problems?
01:25 <@vpnHelper> RSS Update - forum: Avoid dropping of connection <http://forums.openvpn.net/topic7749.html#p10357>
01:25 < genlight> can someone tell me how to stop,start and restart openvpn server
01:26 < XEugenMayer> EugeneKay: FYI: push-reset
01:26 < EugeneKay> XEugenMayer - sounds right
01:26 < heftig> I'm getting TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
01:26 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:26 < heftig> however connectivity seems to be fine
01:26 < genlight> can someone tell me how to stop,start and restart openvpn server please...
01:28 < XEugenMayer> genlight: 1. dont repeat yourself - 2. thats not a classroom, you have to somekind teach yourself and try yourself. 3. thats not a paid support. Be patiente if you ever want to get an answer. 4. Read the how to ask guide. Stop asking general question "how to build a house".
01:29 < XEugenMayer> EugeneKay: FYI: there is also a route-nopull option for the client, but it seems no to be in th 2.1.rc release, seems to be only in the stable
01:30 < genlight> but asking in general question is my real question at the moment.
01:31 < XEugenMayer> Then be lucky if you ever get an answer. 
01:31 < genlight> ;(
01:32 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 248 seconds]
01:33 < heftig> could this TLS Error also be caused by an invalid certificate?
01:34 < XEugenMayer> heftig: it could and it is
01:34 < XEugenMayer> be sure to have the right chain certs
01:34 < heftig> I'd expect some kind of rejection instead of a timeout
01:34 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
01:34 < XEugenMayer> maybe use verb 4 for debugggin
01:35 < heftig> last line is a VERIFY OK (verification of the server cert, it seems), then some more traffic (...WR...) and then it times out
01:36 -!- genlight [~genlight@acl1-830bts.gw.smartbro.net] has left #openvpn []
01:43 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
01:48 <@vpnHelper> RSS Update - forum: Is OPEN VPN right for me? <http://forums.openvpn.net/topic7263.html#p10358>
01:49 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
02:17 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:27 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
02:48 <@vpnHelper> RSS Update - forum: Avoid dropping of connection <http://forums.openvpn.net/topic7749.html#p10359>
02:59 -!- Agin_ [~Agin@greenzone.copyleft.no] has joined #openvpn
03:00 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Ping timeout: 246 seconds]
03:00 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:05 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has joined #openvpn
03:07 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has quit [Read error: Operation timed out]
03:07 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
03:09 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
03:10 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
03:17 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:31 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:31 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:31 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:31 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
03:45 -!- twister004_ [~chatzilla@117.204.137.251] has joined #openvpn
03:47 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 255 seconds]
03:47 -!- twister004_ is now known as twister004
03:51 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
03:52 -!- twister004 [~chatzilla@117.204.137.251] has quit [Ping timeout: 255 seconds]
03:52 -!- twister004_ is now known as twister004
03:57 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
03:59 -!- TheDoc [~teehee@unaffiliated/thedoc] has quit [Quit: Leaving]
04:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:07 < s7r> how can i configure a 4to6 tunnel at the end of vpn?
04:08 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
04:15 < EugeneKay> Ask your 4to6 tunnel provide
04:15 < EugeneKay> +r
04:16 < EugeneKay> Or do you mean to 4in6 over openvpn?
04:16 -!- Diffen [~diffen@90-227-126-239-no16.business.telia.com] has joined #openvpn
04:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
04:20 -!- dazo_afk is now known as dazo
04:22 -!- maxJadi [~maxJadi@dhcp-165-144.nomad.chalmers.se] has joined #openvpn
04:22 -!- maxJadi [~maxJadi@dhcp-165-144.nomad.chalmers.se] has quit [Changing host]
04:22 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:36 <@dazo> heftig: check that your clocks on server and clients are in sync ... wrong clocks will often reject certificates due to valid from and expiry dates
04:49 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
04:51 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:51 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:51 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:53 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
05:13 < stephan48> i have here a openvpn client which somehow seta a broken route on connect?(which prevents all traffic from flowing out).. how could i debug that?
05:14 < stephan48> /sbin/route add -net 172.16.0.31 netmask 255.255.255.255 gw 172.16.0.22
05:14 < stephan48> this route is created upon connect(i use the openvpn server as default gateway)
05:16 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:16 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:16 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:19 < Bushmills> what's the host route on client to openvpn gateway?
05:19 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
05:20 < stephan48> how you mean?
05:21 < Bushmills> how does client reach server?
05:21 < stephan48> http://pastebin.com/4PGac7wG+
05:21 < stephan48> http://pastebin.com/4PGac7wG
05:22 < stephan48> all routes
05:23 < stephan48> the paste contains all routes created
05:23 < Bushmills> 192.168.77.10 is the tun address of the vpn machine acting as gateway, and 172.16.0.22 is the ethernet address?
05:23 -!- boswarrior1 [~mrnice@78.142.173.114] has joined #openvpn
05:24 < stephan48> 172.16.0.22 <- LAN Gateway
05:24 < Bushmills> so what is wrong is  172.16.0.31?
05:24 < stephan48> ifconfig-push 192.168.77.9 192.168.77.10 <- the line from client config
05:25 < stephan48> 31 is the ipcop 
05:25 < Bushmills> client config pushes?
05:25 < Bushmills> that should be in server config
05:25 < stephan48> but when the route with 31 is in effect nothing gioes out
05:25 < stephan48> http://pastebin.com/ZyffAm2W <- client config
05:26 < Bushmills> couldn't it be that traffic *does* go through vpn, but gateway simply doesn't NAT it, or its ip_forward is disabled?
05:27 < Bushmills> a route through ethernet to openvpn server is required, when redirecting all other traffic through openvpn 
05:28 < Bushmills> otherwise,  the client couldn't reach the server (it can't send its openvpn traffic through openvpn, after all)
05:28 < janjust> stephan48:  what is the address of the remote vpn server your client is trying to connect to
05:29 < Bushmills> push "redirect-gateway def1" is not meant for client config
05:29 < stephan48> vpn.stejau.de port 443
05:30 < Bushmills> put redirect-gateway def1  into client config
05:30 < stephan48> gateway nats it and forwards correctly
05:30 < Bushmills> push "redirect-gateway def1" is supposed to go into server config
05:30 < stephan48> cause as soon as i remove the bogus route it works
05:30 < stephan48> k
05:30 < stephan48> and when i want it client based?
05:30 < janjust> which IP does vpn.stejau.de resolve to on the client?
05:30 < Bushmills> (12:30:00) Bushmills: put redirect-gateway def1  into client config
05:30 < stephan48> 178.63.116.151
05:30 < janjust> stephan48:  just put "redirect-gateway def1", without the push 
05:31 < janjust> the route that is added is added by openvpn to have a direct route to the openvpn server ; it does this before redirecting all traffic
05:32 < janjust> so the bogus route you are seeing is caused by the fact that the opevpn client thinks it needs to add this route ; you would also see direct routes like this when using "push "redirect-gateway def1 bypass-dhcp" in the server config
05:32 < Bushmills> ifconfig-push 192.168.77.9 192.168.77.10 is also not meant for client config
05:33 < stephan48> why?
05:33 < janjust> anything with "push" in it is a server config thing
05:33 < Bushmills> because the server doesn't allow being told what ip address to use 
05:33 < janjust> servers push, clients pull
05:33 < stephan48> ahm no not client config....
05:33 < janjust> pastebin your *entire* server config and client config and we might be able to tell you what goes wrong
05:34 < stephan48> the ccd thingy
05:34 < Bushmills> (12:25:52) stephan48: http://pastebin.com/ZyffAm2W <- client config
05:34 < stephan48> sry its the ccd config for the client
05:35 < stephan48> so i could also use redirect-gateway def1 in clients config(the thing the openvpn client uses)
05:35 < stephan48> ?
05:35 < stephan48> thats cool
05:36 < Bushmills> 172.16.0.31 is vpn server, 172.16.0.22 the gateway client uses to reach server?
05:36 < stephan48> no
05:36 < stephan48> http://pastebin.com/5BXBMQcR <- server config(server.conf) http://pastebin.com/FgPG5ucR <- client config 
05:36 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 246 seconds]
05:36 < stephan48> 172.16.0.31 <- local ipcop 172.16.0.22 <- local proxy serve
05:36 < stephan48> the 22 doesnt forward stuff(so it blocks all traffic)
05:37 < Bushmills> so that route makes sense
05:37 -!- boswarrior1 is now known as boswarrior
05:38 < Bushmills> it tells client "sent packages to 172.16.0.31 through 172.16.0.22 , rather than through openvpn - which couldn't be reached were we to send that traffic through openvpn too"
05:38 < stephan48> ye and because 172.16.0.22 doesnt forward traffic it blows up and fails?
05:39 < Bushmills> why shouldn't it forward traffic, being your local proxy?
05:39 < stephan48> it provides http proxy
05:39 < stephan48> its a school...
05:39 < Bushmills> seems it was your default gateway before
05:39 < stephan48> ye
05:39 -!- boswarrior is now known as hadrigan
05:39 < Bushmills> so openvpn clients thinks it must send traffic to openvpn server through the same machine
05:39 < stephan48> so sysadmin blocks us from reaching outside stuff via settings this host as gateway
05:40 < stephan48> ah
05:40 < Bushmills> how else can you reach outside, except through (former) default gateway ... 
05:41 < stephan48> 172.16.0.31 <--
05:42 < janjust> stephan48:  if 172.16.0.22 is a http proxy server then use 'http-proxy 172.16.0.22 80' in your client config
05:42 < stephan48> ye
05:42 < stephan48> but the route openvpn set used that host as gateway
05:42 < stephan48> and since it dont forward traffic it blocked the roule
05:42 < janjust> not if you use it as an http proxy
05:42 < stephan48> ye
05:42 < stephan48> but openvpn  set an blocking rule
05:43 < janjust> no it doesn't
05:43 < janjust> read what I wrote: add a line 'http-proxy 172.16.0.22 <port>' to your client config and try again
05:44 < stephan48> yes
05:44 < stephan48> but now we use the 172.16.0.31 directly 
05:45 < stephan48> which gives us on our livecd a direct connection to outside net
05:45 < stephan48> which is much better and much faster
05:45 < janjust> if 172.16.0.31 is the "real" gateway then use "route-gateway 172.16.0.31" in the client config
06:19 <@vpnHelper> RSS Update - forum: Automatically mount network drive when openvpn connects <http://forums.openvpn.net/topic7746.html#p10360>
06:24 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 248 seconds]
06:26 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
06:32 -!- luneff [~yury@84.51.212.81] has quit [Quit: Leaving]
06:34 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
06:47 -!- XEugenMayer [~eugen@frbg-5d84f5bf.pool.mediaWays.net] has left #openvpn []
06:51 < heftig> dazo: I don't have control over the server, and it's not running ntpd. I guess I can't check this
06:51 <@dazo> heftig: ahh, okay, then if your client is synced, you must presume the server is managed by skilled people :)
06:51 < heftig> yeah :|
06:52 < heftig> thanks
06:53 -!- heftig [jan@archlinux/developer/heftig] has quit [Quit: leaving]
06:53 -!- Agin_ is now known as Agin
06:54 < Bushmills> telnet <server> 13  may tell you its time
06:54 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
07:01 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
07:04 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
07:11 -!- dvl [~dvl@64.147.113.42] has quit [Changing host]
07:11 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
07:15 <@vpnHelper> RSS Update - forum: Issues with remote connectivity on OpenVPN (Ubuntu). Help! <http://forums.openvpn.net/topic7755.html>
07:17 -!- Diffen [~diffen@90-227-126-239-no16.business.telia.com] has quit [Quit: This computer has gone to sleep]
07:44 <@vpnHelper> RSS Update - forum: Issues with remote connectivity on OpenVPN (Ubuntu). Help! <http://forums.openvpn.net/topic7755.html#p10362>
07:49 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html>
08:01 -!- p3rror [~mezgani@41.248.184.192] has quit [Ping timeout: 246 seconds]
08:06 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html#p10364>
08:11 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 250 seconds]
08:11 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
08:15 -!- kala_ [kala@uba.linux.ee] has joined #openvpn
08:20 < EugeneKay> BRAINZ
08:23 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622-15.html#p10365>
08:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 255 seconds]
08:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
08:33 -!- EugeneKay is now known as EugeneKaway
08:33 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
08:50 -!- noisebleed_ [~quassel@kermit.inescn.pt] has joined #openvpn
08:51 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 264 seconds]
08:51 -!- p3rror [~mezgani@2001:0:53aa:64c:f4:4290:d673:9ec0] has joined #openvpn
08:59 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html#p10366>
09:05 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html#p10367>
09:09 < Torpion> hello 
09:09 < Torpion> Unable to connect because your certificate is not yet valid, Check that your sytem time is correct 
09:10 < Torpion> same problem when my certificates that expired in 2022 must
09:10 < Torpion> Can you help me please? 
09:11 < Torpion> Certificate is to be certified until Mar  8 04:00:14 2021 GMT (3650 days)
09:11 <@vpnHelper> RSS Update - forum: Installation OpenVpn Server on centos 5.5 (Trixbox) problem <http://forums.openvpn.net/topic7743.html#p10368>
09:12 -!- EugeneKaway is now known as EugeneKay
09:12 < ecrist> Torpion: when does the certificate become valid?
09:14 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:19 < Torpion> ecrist: 11032011
09:19 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
09:20 < Torpion> ecrist: 11/03/2011
09:20 -!- EugeneKay is now known as EugeneKaway
09:23 < ecrist> Torpion: what's the date now?
09:23 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html#p10369>
09:24 < Torpion> the 10/03/2011
09:24 < ecrist> there's your problem.
09:25 < ecrist> whoever generated the certificate set tomorrow's date for the start date
09:25 < ecrist> either set your clock ahead a day, or regenerate the certificate
09:26 < Torpion> ecrist: how to change the start date?
09:26 < ecrist> you set that when you generate the certificate
09:28 < Torpion> ecrist: PV 
09:28 < ecrist> please don't PM me
09:30 < Torpion> ecrist: Okay, well I'll try, thank you for your help:)
09:30 < ecrist> no problem.
09:30 < ecrist> otherwise, tomorrow you're problem goes away. :)
09:35 -!- EugeneKaway is now known as EugeneKay
09:47 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:52 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
09:56 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
09:56 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
09:58 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
10:02 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 260 seconds]
10:02 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
10:02 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
10:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:02 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
10:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
10:13 -!- mirco [~mirco@p5DD35D15.dip.t-dialin.net] has joined #openvpn
10:14 -!- hadrigan [~mrnice@78.142.173.114] has quit [Quit: Ex-Chat]
10:15 -!- xxtjaxx [~andreas@kde/developer/marschke] has quit [Ping timeout: 250 seconds]
10:15 -!- EugeneKay is now known as EugeneKaway
10:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
10:16 -!- xxtjaxx [~andreas@kde/developer/marschke] has joined #openvpn
10:19 -!- mirco [~mirco@p5DD35D15.dip.t-dialin.net] has quit [Quit: mirco]
10:19 <@vpnHelper> RSS Update - forum: Can't start OpenVPN as a service using init script <http://forums.openvpn.net/topic7757.html>
10:25 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:40 -!- jmm_ is now known as jww
10:43 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
10:49 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html#p10371>
10:50 -!- dazo is now known as dazo_afk
10:50 < Torpion> ecrist: I succeeded, openvpn works. I connect with my pc, but I can not access google.
10:55 <@vpnHelper> RSS Update - forum: redirect port from externt world to my vpn client does not w <http://forums.openvpn.net/topic7758.html>
11:13 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:15 -!- alexbligh [~alexbligh@94-116-101-173.dynamic.thecloud.net] has joined #openvpn
11:16 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
11:16 < alexbligh> Is there a way in a *client* script to force the use of particular fixed DNS servers whilst that config is connected? My VPN routes 10.0.0.0/8 (can't change that) which sometimes covers hotspot provided nameservers, and it doesn't provide its own nameservers :-/
11:16 < alexbligh> sorry, client *config file*
11:17 < alexbligh> !welcome
11:17 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:18 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
11:19 < Bushmills> alexbligh: using redirect-gateway? check out flag "bypass-dns"
11:21 < Bushmills> you can also use an --up script to replace resolv.conf against one of your own liking.
11:24 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
11:29 < alexbligh> Bushmills, I don't use the redirect-gateway feature. The problem is that the DNS server is not on the local subnet. The vpn client installs a VPN route which covers the servers. So I want to use (say) google's nameservers whenever connected using this profile (but not all profiles).
11:29 < alexbligh> Bushmills, or are you saying I should add "redirect-gateway bypass-dns"?
11:30 < Torpion> I succeeded, openvpn works. I connect with my pc, but I can not access google. 
11:30 < Bushmills> no. only if you did use redirect-gateway, might bypass-dns may have been an option
11:31 < alexbligh> I tried pushing a dhcp option in the client config but that doesn't work. I'm using tunnelblick here so don't want to change stuff outside the client config if possible.
11:31 < Bushmills> i suppose i'd put a script together which determines what name server to use during its execution when client connects
11:32 < Bushmills> can't you run a recursive name server locally somewhere, and use that alway, no matter what profile is used?
11:32 < alexbligh> Can the config file determine the script to use when connecting?
11:33 < alexbligh> No, because I don't want to use RDNS locally most of the time. I have another config where I get extra stuff in DNS (i.e. fake TLD). It's just one profile which is problematic
11:33 < Bushmills> i don't think so. not directly. but indirectly, by checking what makes the profiles differ from each other
11:33 < alexbligh> (locally == on my laptop btw!)
11:35 < alexbligh> Mmmm.... so the easiest option is going to be to persuade them to advertise DNS servers as DHCP options, yes?
11:35 < alexbligh> (which I have no idea why they aren't doing)
11:35 < Bushmills> no, because you asked for "is there a way in a *client* script"
11:35 < alexbligh> Bushmills, oh yes, I know. I am assuming the answer to that is "no, not easily".
11:36 < Bushmills> --up script
11:36 < alexbligh> client script would be far better
11:39 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
11:40 < Torpion> What dns to please?
11:40 < alexbligh> hmmm... custom up script is non-trivial using Tunnelblick
11:43 < Bushmills> Torpion: one which is provider-agnostic. (="public")
11:44 < Torpion> Bushmills: how you?
11:45 < Bushmills> very
11:45 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
11:48 -!- luneff [~yury@84.51.212.81] has joined #openvpn
11:49 < Torpion> Bushmills: ?
11:49 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
11:50 < Bushmills> you ask how am. very me say
11:51 < Bushmills> how you?
11:52 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
11:52 -!- mode/#openvpn [+o mattock] by ChanServ
12:05 < Torpion> How come when I connect to vpn from my pc, when I go to google, I put the same mistake on other pages
12:05 -!- alexbligh [~alexbligh@94-116-101-173.dynamic.thecloud.net] has quit [Quit: This computer has gone to sleep]
12:47 -!- noisebleed_ [~quassel@kermit.inescn.pt] has quit [Remote host closed the connection]
12:55 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
12:55 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
12:55 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
13:02 -!- EugeneKaway is now known as EugeneKay
13:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:06 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
13:06 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
13:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
13:24 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:25 -!- luneff [~yury@84.51.212.81] has quit [Quit: Leaving]
13:48 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
13:56 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
13:58 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:04 -!- grapsus [~grapsus@acces1074.res.insa-lyon.fr] has quit [Remote host closed the connection]
14:12 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
14:15 -!- BostX [~bost@p5B2F0338.dip0.t-ipconnect.de] has joined #openvpn
14:16 <@vpnHelper> RSS Update - forum: Windows 7 x64, routing, DHCP and a unstable VPN <http://forums.openvpn.net/topic7622-15.html#p10373>
14:26 < Bushmills> Torpion: because those other pages suffer from the same problem
14:31 < Torpion> Bushmills: and what to do?
14:32 < Bushmills> identify the cause of the problem
14:38 < EugeneKay> Your tubes are blocked. I recommend you call roto-rooter
14:39 < hjohnson> ok, doing iTunes home sharing over an openvpn internet connection may not be the brigtest idea i've had
14:39 < EugeneKay> I'm going to poke you in the eye with a rake.
14:41 < hjohnson> good test for the AES block on my router though
14:43 < Torpion>  do not know what to do: /
14:44 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:55 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
15:20 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Ping timeout: 260 seconds]
15:26 -!- pingec [~pingo@93-103-244-156.dynamic.t-2.net] has joined #openvpn
15:26 -!- robotti^ [robotti@kapsi.fi] has quit [Ping timeout: 248 seconds]
15:29 < pingec> !welcome
15:29 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:33 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
15:39 < Bushmills> "put the same mistake on other pages..." you might want to analyse what "same mistake" is, how it manifests, and from there, what could cause it.
15:40 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10374>
15:44 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
15:50 < pingec> !configs
15:50 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
15:51 < pingec> !howto
15:51 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:58 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:01 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
16:03 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
16:05 <@vpnHelper> RSS Update - forum: Wireshark showing no encryption in OpenVPN <http://forums.openvpn.net/topic7759.html>
16:14 -!- CrazyFurry [xdemon@lex.io] has quit [Read error: Operation timed out]
16:19 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
16:19 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
16:20 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
16:20 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 240 seconds]
16:20 -!- Bushmills [~l@scarydevilmonastery.net] has quit [Ping timeout: 260 seconds]
16:20 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
16:20 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
16:20 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has quit [Ping timeout: 260 seconds]
16:22 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has joined #openvpn
16:28 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
16:28 < Cubox> [Cubox] Pour faire du bon riz, il faut : Du bon riz et deux cubes de Cubox
16:28 < Cubox> Hello, the openvpn fait to start and i have nothing on the logs ...
16:28 < Cubox> /var/log/daemon.log don't have anything about this error
16:29 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 250 seconds]
16:29 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:29 < Cubox> !welcome*
16:29 < Cubox> !welcom
16:30 < Cubox> !welcome
16:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:30 < Cubox> !logs
16:30 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
16:30 < Cubox> !redirect
16:30 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
16:30 < Cubox> !ipforward
16:30 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:30 < Cubox> !liipforward
16:31 < Cubox> !linipforward
16:31 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:32 < Cubox> !nat
16:32 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
16:35 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
16:36 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.5-dev"]
16:37 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
16:42 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
16:42 -!- CrazyFurry [xdemon@lex.io] has joined #openvpn
16:47 < ecrist> howdy
16:50 < hjohnson> also dont' forget to turn on bridging. :P
16:53 -!- CrazyFurry [xdemon@lex.io] has quit [Ping timeout: 248 seconds]
16:57 -!- CrazyFurry [xdemon@lex.io] has joined #openvpn
17:17 <@vpnHelper> RSS Update - forum: Wireshark showing no encryption in OpenVPN <http://forums.openvpn.net/topic7759.html#p10376>
17:22 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:22 <@vpnHelper> RSS Update - forum: Routed and Bridged on the same server? <http://forums.openvpn.net/topic7760.html>
17:24 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
17:29 <@vpnHelper> RSS Update - forum: redirect port from externt world to my vpn client does not w <http://forums.openvpn.net/topic7758.html#p10378>
17:33 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 260 seconds]
17:58 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:59 <@vpnHelper> RSS Update - forum: Simple configuration for 1 server and 2 clients <http://forums.openvpn.net/topic7745.html#p10379>
17:59 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 246 seconds]
18:02 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
18:02 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Read error: Operation timed out]
18:03 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
18:03 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has quit [Read error: Operation timed out]
18:04 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has joined #openvpn
18:04 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
18:04 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
18:08 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
18:09 -!- datakid [~datakid@office.cybersource.com.au] has joined #openvpn
18:09 < datakid> hola, I'm trying to redirect _some_ net traffic over the vpn connection - basically, just want the servers in the vpn to resolv, but all other traffic to go through local connection to net
18:09 < datakid> is it possible?
18:10 < datakid> or is DNS resolution all or none?
18:12 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
18:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
18:16 < |Mike|> datakid: it is
18:16 < |Mike|> !def1
18:16 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
18:17 < datakid> |Mike|: tx
18:24 -!- datakid [~datakid@office.cybersource.com.au] has quit [Ping timeout: 264 seconds]
18:25 < |Mike|> yw
18:34 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
18:34 < EugeneKay> |Mike| - fwiw, he was asking about dns, not gateway. and the answer was yes, what he wanted is perfectly possible, and easy.
18:36 < |Mike|> fwiw?
18:38 < EugeneKay> http://lmgtfy.com/?q=fwiw
18:38 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
18:39 < |Mike|> ...
18:45 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
18:47 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
18:49 < |Mike|> EugeneKay: I wasn't planning to click your URL.
18:49 < EugeneKay> That would be a personal problem.
18:51 < |Mike|> basically because I have no browser installed.
19:29 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
19:31 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
19:39 <@vpnHelper> RSS Update - forum: vmware editon and suddenlink cable <http://forums.openvpn.net/topic7761.html>
20:00 -!- datakid [~datakid@office.cybersource.com.au] has joined #openvpn
20:00 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
20:14 -!- BostX [~bost@p5B2F0338.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
20:20 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
20:28 -!- noisebleed_ [~quassel@lula.inescn.pt] has joined #openvpn
20:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
20:58 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
20:58 -!- common- [~common@p5DDA4B46.dip0.t-ipconnect.de] has joined #openvpn
20:59 -!- common [~common@p5DDA4BEA.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
20:59 -!- common- is now known as common
21:09 -!- master_of_master [~master_of@p57B53651.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:11 -!- master_of_master [~master_of@p57B54A1D.dip.t-dialin.net] has joined #openvpn
21:11 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
21:26 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
21:34 <@vpnHelper> RSS Update - forum: Can't start OpenVPN as a service using init script <http://forums.openvpn.net/topic7757.html#p10381>
21:54 -!- datakid [~datakid@office.cybersource.com.au] has quit [Quit: datakid]
21:56 -!- interwebz [~thisguy@76.10.222.65] has joined #openvpn
21:57 < interwebz> !welcome
21:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:57 < interwebz> !goal
21:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:57 < interwebz> !goal increase speeds
21:58 < interwebz> that didnt work
21:58 -!- interwebz [~thisguy@76.10.222.65] has quit [Client Quit]
22:05 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
22:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:45 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Operation timed out]
22:53 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
22:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
22:57 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
23:05 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
--- Day changed Fri Mar 11 2011
00:01 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
00:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:04 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
00:05 -!- EugeneKay is now known as EugeneKaway
00:07 < ecrist> woohoo!  
00:07 < ecrist> 2.2-RC2 in pipeline
00:08 < ecrist> Mr. Jack Daniels too influential to make me care right now. ;)
00:09 < hardwire> he can be a smooth talker
00:09 < hardwire> just keep your panties on.
00:09 < ecrist> what?!?!  I didn't sign up for that
00:10 < ecrist> that's like saying, "here's the internet, don't look at porn"
00:16 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
00:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
00:58 <@vpnHelper> RSS Update - forum: Can't start OpenVPN as a service using init script <http://forums.openvpn.net/topic7757.html#p10382>
01:01 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:01 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
01:02 -!- stony is now known as Guest85799
01:42 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
02:21 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
02:23 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 250 seconds]
02:33 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 248 seconds]
02:40 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
02:41 -!- myp [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
02:42 -!- myp [~andrew@mx2.admin.tomsk.ru] has left #openvpn []
02:42 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
02:56 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
02:57 -!- jww [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has left #openvpn []
03:08 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
03:08 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:18 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
03:18 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Read error: Operation timed out]
03:21 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:27 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
03:28 <@vpnHelper> RSS Update - forum: Can't start OpenVPN as a service using init script <http://forums.openvpn.net/topic7757.html#p10383>
03:31 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:35 <@vpnHelper> RSS Update - forum: vmware editon and suddenlink cable <http://forums.openvpn.net/topic7761.html#p10384>
03:35 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 248 seconds]
03:36 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
03:42 -!- raw is now known as raw_
03:48 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:52 -!- diffen3 [~diffen@90-227-126-239-no16.business.telia.com] has joined #openvpn
04:00 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
04:10 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
04:10 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
04:10 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
04:16 -!- meepmeep_ is now known as meepmeep
04:17 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has left #openvpn []
04:20 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 260 seconds]
04:20 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
04:27 -!- Guest85799 [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Operation timed out]
04:28 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
04:28 -!- stony is now known as Guest35601
04:41 <@vpnHelper> RSS Update - forum: one certificate two servers <http://forums.openvpn.net/topic7754.html#p10385>
04:42 -!- dazo_afk is now known as dazo
04:42 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:50 -!- LuckyY_ is now known as LuckyY
04:53 <@vpnHelper> RSS Update - forum: iptables for openvpn <http://forums.openvpn.net/topic7762.html>
05:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:29 -!- diffen3 [~diffen@90-227-126-239-no16.business.telia.com] has quit [Quit: This computer has gone to sleep]
05:34 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Ping timeout: 255 seconds]
05:35 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
05:45 <@vpnHelper> RSS Update - forum: iptables for openvpn <http://forums.openvpn.net/topic7762.html#p10387>
05:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 276 seconds]
05:48 -!- diffen3 [~diffen@90-227-126-239-no16.business.telia.com] has joined #openvpn
06:30 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
06:30 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
06:30 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:34 -!- takamichi [~pri@46.11.13.117] has quit [Remote host closed the connection]
06:35 -!- takamichi [~pri@46.11.13.117] has joined #openvpn
06:53 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 276 seconds]
06:54 -!- loompek [~noname@noname.rula.net] has joined #openvpn
06:54 < loompek> mornin
06:54 < loompek> smee again
06:54 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
06:57 < loompek> is win32 gui for openvpn capable of reading encrypted client private keys? I'd like to generate some sort of easy configs i'd like to distribute to clients...
06:57 < loompek> !welcome
06:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:57 < loompek> !goal
06:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:00 -!- EugeneKaway [EugeneKay@eugenekay.com] has quit [Ping timeout: 248 seconds]
07:01 -!- diffen3 [~diffen@90-227-126-239-no16.business.telia.com] has quit [Quit: This computer has gone to sleep]
07:01 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
07:02 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Read error: Operation timed out]
07:03 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
07:04 -!- EugeneKaway [EugeneKay@eugenekay.com] has joined #openvpn
07:11 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Operation timed out]
07:15 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Ping timeout: 240 seconds]
07:17 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
07:18 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Ping timeout: 246 seconds]
07:36 -!- EugeneKaway is now known as EugeneKay
07:38 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
08:03 -!- p3rror [~mezgani@2001:0:53aa:64c:f4:4290:d673:9ec0] has quit [Read error: Operation timed out]
08:23 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn ["Leaving"]
08:25 -!- p3rror [~mezgani@2001:0:53aa:64c:342c:4290:d607:929a] has joined #openvpn
08:52 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Read error: Operation timed out]
08:59 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
09:02 -!- gladiatr_afk is now known as gladiatr
09:04 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
09:10 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
09:12 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:17 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Ping timeout: 264 seconds]
09:27 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
09:35 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has joined #openvpn
09:56 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
10:01 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
10:27 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:29 -!- cpf__ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
10:32 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
10:32 -!- cpf_ [~cpf@94-226-0-187.access.telenet.be] has quit [Ping timeout: 276 seconds]
10:35 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:36 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
10:44 <@vpnHelper> RSS Update - forum: Routed and Bridged on the same server? <http://forums.openvpn.net/topic7760.html#p10388>
10:45 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:50 <@vpnHelper> RSS Update - forum: Wireshark showing no encryption in OpenVPN <http://forums.openvpn.net/topic7759.html#p10389>
10:53 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
11:17 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
11:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:19 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
11:21 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
11:25 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
11:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:49 -!- p3rror [~mezgani@2001:0:53aa:64c:342c:4290:d607:929a] has quit [Read error: Operation timed out]
12:02 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
12:03 < MarKsaitis> Does anybody know any powerfull i7 sandy bridge laptops I could buy? In UK? :)
12:05 -!- p3rror [~mezgani@2001:0:53aa:64c:34dc:4290:d607:4257] has joined #openvpn
12:14 < krzee> try the local apple store
12:20 < EugeneKay> Rofl
12:41 -!- secretary_linux [~bplunkert@unaffiliated/secretary-linux/x-6720546] has quit [Remote host closed the connection]
12:44 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
12:50 -!- noisebleed_ [~quassel@lula.inescn.pt] has quit [Remote host closed the connection]
12:51 -!- BostX [~bost@p5B2F061C.dip0.t-ipconnect.de] has joined #openvpn
13:08 < dvl> I just bought one this morning.
13:09 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
13:13 -!- celthunder [~celthunde@rofltech.net] has quit [Read error: Operation timed out]
13:13 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:13 -!- celthunder [~celthunde@rofltech.net] has joined #openvpn
13:13 -!- cpf__ [~cpf@d515306D2.static.telenet.be] has quit [Read error: Operation timed out]
13:30 -!- dazo is now known as dazo_afk
13:39 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
13:53 -!- mirco [~mirco@p5DD357BB.dip.t-dialin.net] has joined #openvpn
13:58  * dvl reboot time
13:59 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.0.5]
14:16 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:22 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
14:22 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
14:25 -!- mirco_ [~mirco@p5DD34DE5.dip.t-dialin.net] has joined #openvpn
14:28 -!- mirco [~mirco@p5DD357BB.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
14:28 -!- mirco_ is now known as mirco
14:37 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:53 -!- [1]rond [~rond@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
15:09 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
15:26 -!- crest [~crest@p4FCBDC53.dip0.t-ipconnect.de] has joined #openvpn
15:47 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
16:07 <@vpnHelper> RSS Update - forum: Routed and Bridged on the same server? <http://forums.openvpn.net/topic7760.html#p10390>
16:12 -!- p3rror [~mezgani@2001:0:53aa:64c:34dc:4290:d607:4257] has quit [Read error: Operation timed out]
16:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
16:16 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
16:26 -!- p3rror [~mezgani@2001:0:53aa:64c:4b1:6982:d607:4257] has joined #openvpn
16:49 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:54 -!- mant1s [~mant1s@cpe-74-78-40-181.maine.res.rr.com] has joined #openvpn
16:54 -!- mant1s [~mant1s@cpe-74-78-40-181.maine.res.rr.com] has quit [Changing host]
16:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:24 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
17:24 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
17:24 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:31 <@vpnHelper> RSS Update - forum: No connect option <http://forums.openvpn.net/topic7512.html#p10391>
17:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
17:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:50 -!- adil452100 [~adil45210@41.143.13.21] has joined #openvpn
17:50 < adil452100> hello
17:50 < adil452100> i have a problem with openvpn on centos
17:50 < adil452100> with openvz
17:51 < adil452100> it works like a charm but when i activate the firwall
17:51 < adil452100> the connection in the client doesn't work
17:52 < adil452100> any body here ?
17:52 < adil452100> !welcome
17:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:52 < adil452100> !goal
17:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:53 < adil452100> !howto
17:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:55 < adil452100>  I would like to access the internet over my vpn
17:55 < adil452100> i have setup an openvpn server on centos (VPS of openvz) and it works great
17:56 < adil452100> except when i activate the firwall
17:56 < adil452100> i have checked that the 1194:udp is open
17:56 < adil452100> my iptables rules are :
17:56 < adil452100> iptables -A FORWARD -i tun0 -o venet0 -j ACCEPT
17:57 < adil452100> iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source $my_server_ip
17:57 < adil452100> any idea ?
18:03 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
18:03 -!- bragon [~Alexandre@2001:758:1664::8888] has quit [Ping timeout: 260 seconds]
18:11 -!- pingec [~pingo@93-103-244-156.dynamic.t-2.net] has quit []
18:14 -!- crest_ [~crest@p4FCBC18B.dip0.t-ipconnect.de] has joined #openvpn
18:16 -!- crest [~crest@p4FCBDC53.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
18:16 -!- crest_ is now known as crest
18:18 -!- adil452100 [~adil45210@41.143.13.21] has quit [Ping timeout: 264 seconds]
18:20 -!- adil452100 [~adil45210@41.143.13.21] has joined #openvpn
18:21 -!- adil452100 [~adil45210@41.143.13.21] has quit [Client Quit]
18:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
19:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:40 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
19:50 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10392>
20:00 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
20:02 <@vpnHelper> RSS Update - forum: How to create multi-server vpn <http://forums.openvpn.net/topic7748.html#p10393>
20:02 -!- BostX [~bost@p5B2F061C.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
20:20 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 255 seconds]
20:20 -!- ribasushi [~ribasushi@arx.rabbit.us] has joined #openvpn
20:20 < ribasushi> evening
20:20 < ribasushi> I have a server with several clients
20:22 < ribasushi> I want to set up source routing on the server, such that any local process that opens a socket from a specific server-local ip, will be routed through one of the vpn "clients"
20:22 < ribasushi> I can't seem to wrangle iproute to take a remote-point as default gateway, since it doesn't see it as "local"
20:24 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
20:26 < ribasushi> uncomfortable silence
20:27 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Client Quit]
20:27 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
20:30 < EugeneKay> Deafening post-dinner belch
20:32 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 250 seconds]
20:32 < ribasushi> belch is fine as long as someone shares a trick :)
20:33 < EugeneKay> So, you want to be able to access a socket on a server's loopback IP, from a client's lan IP?
20:33 < ribasushi> no
20:33 < EugeneKay> Other way around?
20:33 < ribasushi> no, explaining
20:34 < EugeneKay> Sure.
20:36 < ribasushi> http://paste.scsys.co.uk/92405
20:36 < ribasushi> EugeneKay: ^^
20:37 < ribasushi> what I want is when I do ping -I 192.168.0.2 - to have all the traffic sent out through the vpn and via the Client 2.2.2.2 default gw
20:37 < ribasushi> ping -I 192.168.0.2 10.0.0.6 works, so routing and all is set up correctly
20:38 < ribasushi> so on the server I do: ip rule add from 192.168.0.2 table 42
20:38 < ribasushi> and then ip route replace default via 10.0.0.6 table 42
20:39 < ribasushi> and RTNETLINK answers: No such process
20:39 < ribasushi> and that's where I'm stuck :)
20:42 < ribasushi> EugeneKay: no ideas I take it? :)
20:43 < EugeneKay> Thinking.
20:43 < EugeneKay> It's a challenge, which I like.
20:43 < ribasushi> good, highlight my name if you say something
20:44 < EugeneKay> 1.1.1.1 is eth0, 192.168.0.1 is eth1, and .0.2 is a second IP on eth1?
20:45 < EugeneKay> I don't know that you can really do that with the socket being opened on a eth1 IP.
20:45 < EugeneKay> Maybe if it was on tun0? I dunno. I need more beer.
20:46 < ribasushi> hm... I can arrange a tun0 address I guess
20:46  * ribasushi checks his allocations
20:47 < EugeneKay> What's the end purpose, out of curiousity?
20:49 < ribasushi> EugeneKay: literally use a different exit point
20:49 < EugeneKay> But to what end? :-p
20:50 < ribasushi> working around e.g. regional youtube blocks
20:50 < EugeneKay> Ahhhhh.
20:50 < EugeneKay> But working the gateway redirecting backwards
20:50 < EugeneKay> Manually :-p
20:51 < ribasushi> yes
20:51 < EugeneKay> Gotcha.
20:51 < EugeneKay> Yeah I really don't have much more for ideas
20:51 < ribasushi> instead of rerouting the entire box, just have a process-based iptables mark
20:51 < EugeneKay> Have you tried cursing at it?
20:51 < ribasushi> or (for simplicty) ssource addr
20:51 < EugeneKay> Well, if you can setup firefox to use a tun0 IP as a source addr, you should be able to specify the source route for that
20:52 < ribasushi> it doesn't seem to work either...
20:52 < ribasushi> perhaps I need to widen the mask or something... the tunnel is not a /24
20:52 < EugeneKay> Cursing? Or the tun0 thing?
20:53 < ribasushi> cursing hardly ever works :)
20:54 -!- diffen3 [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Quit: Leaving]
20:59 -!- common- [~common@p5DDA447C.dip0.t-ipconnect.de] has joined #openvpn
21:01 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Ping timeout: 255 seconds]
21:02 -!- common [~common@p5DDA4B46.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
21:02 -!- common- is now known as common
21:07 -!- master_of_master [~master_of@p57B54A1D.dip.t-dialin.net] has quit [Read error: Operation timed out]
21:11 -!- master_of_master [~master_of@p57B57A16.dip.t-dialin.net] has joined #openvpn
21:12 -!- crest [~crest@p4FCBC18B.dip0.t-ipconnect.de] has quit [Quit: crest]
21:34 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has joined #openvpn
21:46 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
22:12 -!- crest [~crest@p579794BF.dip.t-dialin.net] has joined #openvpn
22:21 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:24 -!- [1]rond [~rond@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Ping timeout: 255 seconds]
22:28 -!- luneff [~yury@84.51.212.81] has joined #openvpn
22:28 -!- albech [~thomas@61.7.130.246] has joined #openvpn
22:32 -!- EugeneK [EugeneKay@eugenekay.com] has joined #openvpn
22:35 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
22:36 -!- EugeneK is now known as EugeneKay
22:58 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
22:58 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
23:03 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 276 seconds]
23:08 -!- EugeneKay is now known as EugeneKaway
23:09 -!- EugeneKaway is now known as EugeneKay
23:37 -!- EugeneKay is now known as EugeneKaway
--- Day changed Sat Mar 12 2011
00:17 -!- luneff [~yury@84.51.212.81] has quit [Quit: Leaving]
00:30 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
01:12 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:12 -!- mode/#openvpn [+o mattock] by ChanServ
01:21 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
01:27 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
01:35 -!- albech [~thomas@61.7.130.246] has quit [Ping timeout: 250 seconds]
01:37 <@vpnHelper> RSS Update - forum: I need some help <http://forums.openvpn.net/topic7764.html> || OpenVPN Access Server - Re: Branding <http://forums.openvpn.net/topic7763.html>
01:40 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:43 <@vpnHelper> RSS Update - forum: I need some help <http://forums.openvpn.net/topic7764.html#p10396>
01:48 -!- albech [~thomas@61.7.130.246] has joined #openvpn
01:55 <@vpnHelper> RSS Update - forum: I need some help <http://forums.openvpn.net/topic7764.html#p10397>
02:18 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
02:31 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
02:36 < Fleck> !factoids search samba
02:36 <@vpnHelper> "samba" is (#1) http://openvpn.net/faq#samba-routing for using samba with a routed tun, or use NETBIOS with a bridge, or (#2) http://www.openvpn.net/howto#samba if you run samba on linux and use tun mode
02:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:42 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
02:47 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
03:05 < Fleck> !factoids search files
03:05 <@vpnHelper> No keys matched that query.
03:05 < Fleck> !factoids search transfer
03:05 <@vpnHelper> No keys matched that query.
03:40 -!- mirco [~mirco@p5DD34DE5.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
03:47 -!- BostX [~bost@p5B2F1D3B.dip0.t-ipconnect.de] has joined #openvpn
03:47 -!- mirco [~mirco@p5DD344F0.dip.t-dialin.net] has joined #openvpn
03:59 < ribasushi> EugeneKaway: solved the fucker :)
04:19 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Ping timeout: 260 seconds]
04:25 < ribasushi> EugeneKaway: http://paste.scsys.co.uk/92431
04:26 < ribasushi> EugeneKaway: I suspect it didn't work with pure openvpn because it dicks atround with the routing within itself and screws things up
04:26 < ribasushi> EugeneKaway:  would be interesting if it can be done without a subtunnel
04:27 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
04:27 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
04:27 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:38 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has left #openvpn []
04:38 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
04:47 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
05:02 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Remote host closed the connection]
05:05 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
05:10 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
05:17 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
05:18 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
05:19 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
05:23 < reiffert> if someone wants to say 10^-3 in english, is it micro or milli?
05:25 <@vpnHelper> RSS Update - forum: IP Leaking <http://forums.openvpn.net/topic7730.html#p10398>
05:28 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
05:33 -!- morbidwar [~ovidiu@78.96.23.179] has joined #openvpn
05:47 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 240 seconds]
05:55 -!- tntcoda [~jack@88.97.46.115] has joined #openvpn
05:56 < tntcoda> Hi, if I set up a simple VPN is it possible for the client to still use the Internet locally? (maybe it's standard?) I just dont want Internet routing through the VPN, only remote/local LAN services if that makes sense
06:01 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
06:07 < Bushmills> tntcoda: yes, possible
06:08 -!- morbidwar [~ovidiu@78.96.23.179] has quit [Remote host closed the connection]
06:08 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Read error: Operation timed out]
06:10 < tntcoda> Bushmills, thanks, would it be easier to do with tun than tap/bridge?
06:11 < Bushmills> !tunortap
06:11 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
06:11 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
06:11 < Bushmills> routing only vpn traffic through vpn requires less effort than routing all internet through vpn
06:11 < tntcoda> right ok thanks :)
06:12 < Bushmills> !route
06:12 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
06:12 < Bushmills> that's for non-vpn hosts behind vpn machines
06:13 < tntcoda> ok thanks, shall do some reading on that 
06:13 < hyper_ch> hi Bushmills
06:13 < Bushmills> 'morning hyper_ch
06:13 < hyper_ch> happy weekend to you
06:14 < Bushmills> thanks. you too. 
06:14 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
06:16 < hyper_ch> plans?
06:16 < Bushmills> not an awful amount.  getting outside a bit later on, watching a football match tomorrow. 
06:17 < hyper_ch> outside? Don't you know how dangerous that is?
06:17 < Bushmills> yes, i've been told
06:17  * Bushmills feels reckless today
06:18 < Bushmills> don't forget the moist cloth to cover the face from radioactive fallout 
06:20 < reiffert> think that it will last 1-2 weeks until it will reach europe.
06:20 < hyper_ch> as switzerland is neutral, it will not affect me :)
06:20 < reiffert> hawaii will be first to bring up measured values I guess.
06:21 -!- [1]rond [~rond@pool-71-170-131-187.dllstx.fios.verizon.net] has joined #openvpn
06:24 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
06:36 < Bushmills> hyper_ch: a 2 miles thick layer of rock above you should be effective, indeed
06:39 -!- [1]rond [~rond@pool-71-170-131-187.dllstx.fios.verizon.net] has quit [Read error: Connection reset by peer]
06:51 < Dougy> wot
06:52 < hyper_ch> nah, the radioactive clouds will just respect switzerland's neutrality and manoeuver around it
07:00 -!- BostX [~bost@p5B2F1D3B.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
07:06 -!- mirco [~mirco@p5DD344F0.dip.t-dialin.net] has quit [Quit: mirco]
07:12 <@vpnHelper> RSS Update - forum: Error starting openvpn service <http://forums.openvpn.net/topic7765.html>
07:19 -!- APTX [APTX@phpBB/developer/APTX] has quit [Ping timeout: 250 seconds]
07:22 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
07:33 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
07:56 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
08:00 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Quit: leaving]
08:08 < tntcoda> are there any major performance issues using 4096bit DH with openvpn?
08:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
08:58 -!- EugeneKaway is now known as EugeneKay
09:20 -!- BostX [~bost@p5B2F1D3B.dip0.t-ipconnect.de] has joined #openvpn
10:00 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:20 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:22 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:23 -!- albech [~thomas@61.7.130.246] has quit [Quit: Ex-Chat]
10:25 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
10:30 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:40 < tntcoda> Does openvpn require tcp for the initial tls handshake even if UDP is the configured protocol?
10:48 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10400>
10:49 < EugeneKay> tntcoda - I'm going to say no and no
10:50 < tntcoda> EugeneKay, ok thanks :) problem is elsewhere then
11:28 -!- p3rror [~mezgani@2001:0:53aa:64c:4b1:6982:d607:4257] has quit [Read error: Operation timed out]
11:42 -!- p3rror [~mezgani@2001:0:53aa:64c:3462:6982:d607:40da] has joined #openvpn
11:58 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 246 seconds]
12:06 <@vpnHelper> RSS Update - forum: OpenVPN winxp server android client <http://forums.openvpn.net/topic7766.html>
12:08 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
12:09 -!- MrJK [~jezu@194.199.166.96] has joined #openvpn
12:10 < MrJK> Hello, I know I'm not on the pptp channel, but somebody may help me ? (let's try :) )
12:10 < MrJK> I've a GRE error, and that break my connection
12:47 -!- BostX [~bost@p5B2F1D3B.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
12:54 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
13:08 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 246 seconds]
13:14 < ribasushi> EugeneKay: saw my backlog from earlier?
13:14 < EugeneKay> It didn't ping me, but I'm looking now
13:15 < EugeneKay> You could disable the OpenVPN routing and just do it manually, sans subtunnel
13:15 < ribasushi> EugeneKay: it is already disabled (I think) since cross-client packets hit my firewall
13:15 < EugeneKay> You think :-p
13:16 < ribasushi> EugeneKay: which opt is that then?
13:16 < EugeneKay> No clue. But I remember there being one
13:16 < EugeneKay> It's the sort of thing I said " Oooh, nifty. I'll never use that." to
13:17 < ribasushi> --client-to-client perhaps?
13:17 < ribasushi> this afaics is "enable" routing
13:18 < EugeneKay> That's for skipping the kernel entirely
13:18 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
13:18 < EugeneKay> More for emulating a LAN over VPN than routed tunnels
13:19 < ribasushi> right what it looked to me too
13:19 < ribasushi> don't see anything else relevant in the manpage
13:19 < ribasushi> perhaps will hit the ML later
13:19 < ribasushi> anyway, the kludge works, though it's fugly
13:29 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
13:49 <@vpnHelper> RSS Update - forum: Error starting openvpn service <http://forums.openvpn.net/topic7765.html#p10402>
13:57 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
13:57 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
13:58 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
14:08 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 250 seconds]
14:24 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
14:58 -!- Guest68746 [~noname@noname.rula.net] has joined #openvpn
15:01 -!- loompek [~noname@noname.rula.net] has quit [Ping timeout: 260 seconds]
15:14 -!- mirco [~mirco@p5DD344F0.dip.t-dialin.net] has joined #openvpn
15:21 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
15:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
15:25 <@vpnHelper> RSS Update - forum: Error starting openvpn service <http://forums.openvpn.net/topic7765.html#p10403>
15:25 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Client Quit]
15:32 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 240 seconds]
15:38 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
15:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:21 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
16:24 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
16:32 -!- matwix [b2c79c34@gateway/web/freenode/ip.178.199.156.52] has joined #openvpn
16:32 < matwix> hi guys
16:33 < matwix> I use ccd for my clients. If I change a CCD from a client, I always have to restart the openvpn server that the client get the new settings from the ccd file
16:33 < matwix> Is there a solution for that?
16:48 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
16:48 < matwix> ??
17:34 -!- BostX [~bost@p5B2F1D3B.dip0.t-ipconnect.de] has joined #openvpn
17:46 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
17:53 -!- p3rror [~mezgani@2001:0:53aa:64c:3462:6982:d607:40da] has quit [Read error: Operation timed out]
17:57 -!- p3rror [~mezgani@2001:0:53aa:64c:24c1:40d6:d673:d89a] has joined #openvpn
18:19 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Ping timeout: 250 seconds]
18:19 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
18:23 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Client Quit]
18:42 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Quit: Lost terminal]
18:43 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
19:07 -!- tntcoda [~jack@88.97.46.115] has quit [Quit: Leaving]
19:36 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Quit: Lost terminal]
19:55 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
19:55 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
19:55 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:21 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
20:24 < LowKey> hello, i got problem on openvpn, my openvpn is working fine, i when i connected to openvpn , i can ping IP number, but i cannot ping domain name, such as google.com, seems resolv.conf not work, can someone help?
20:25 < Bushmills> using redirect-gateway?
20:26 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 276 seconds]
20:27 < LowKey> Bushmills, yes, i use it on openvpn.conf | push "redirect-gateway"
20:28 < LowKey> Bushmills, http://pastebin.com/wegNtm2G
20:28 < Bushmills> either add flag bypass-dns to redirect-gateway, or query a free name server. the name server you use allows only access from the ISP network, to which your openvpn server doesn't belong.
20:31 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
20:39 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
21:00 -!- common- [~common@p5DDA4CC8.dip0.t-ipconnect.de] has joined #openvpn
21:02 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
21:02 -!- common [~common@p5DDA447C.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
21:02 -!- common- is now known as common
21:10 -!- master_of_master [~master_of@p57B57A16.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
21:12 -!- master_of_master [~master_of@p57B5550B.dip.t-dialin.net] has joined #openvpn
21:13 -!- BostX [~bost@p5B2F1D3B.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:14 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
21:30 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
21:32 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p10404>
21:33 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
21:50 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic7767.html>
21:50 -!- crest_ [~crest@p57979FB8.dip.t-dialin.net] has joined #openvpn
21:53 -!- crest [~crest@p579794BF.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
21:53 -!- crest_ is now known as crest
21:53 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
22:26 <@vpnHelper> RSS Update - forum: How to create multi-server vpn <http://forums.openvpn.net/topic7748.html#p10406>
22:31 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
22:46 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
22:47 < Splex> i keep getting errors like: "TLS Error: Unroutable control packet received from <ip> (si=3 op=P_CONTROL_V1)" I have synced the clocks on both client and server...what could be the problem?
22:47 < Splex> using OpenVPN 2.1.4
22:49 < Splex> can that occur on a connection with a lot of PL?
23:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
23:23 -!- EugeneKay is now known as EugeneKaway
23:24 -!- EugeneKaway is now known as EugeneKay
--- Day changed Sun Mar 13 2011
00:21 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Remote host closed the connection]
00:28 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
00:28 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
00:28 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
01:36 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 250 seconds]
01:49 -!- EugeneKay is now known as EugeneKaway
03:11 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
03:22 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
03:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:28 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:41 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has left #openvpn []
03:42 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
03:59 -!- EugeneKaway is now known as EugeneKay
04:01 -!- Sea [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
04:01 < Sea> Hi
04:03 < Sea> Can I use openvpn to surf from other countries?
04:03 < Sea> Need to go to china for a few weeks and they block everything ..
04:04 < ambro718> Sea: you can; set up a VPN server at home, and get the forwarding right. I can't tell you how - google it or learn about networking.
04:05 < Sea> yeah already installed it by this tutorial: http://cihan.me/how-to-setup-openvpn-server-on-debian-lenny/
04:05 <@vpnHelper> Title: How to setup OPENVPN Server on Debian Lenny | Cihan DOGAN’s IT Blog (at cihan.me)
04:05 < Sea> but cant get the iptables thingy to work
04:06 < Sea> and cant handle the error as I dont get the error and do not really know anything about iptables
04:06 < ambro718> Sea: what error?
04:08 < ambro718> Sea: it's probably obvious, but /etc/iptables.test.rules shouldn't contain smiley faces, instead it should have :PREROUTING and :POSTROUTING
04:08 < Sea> if I do the cmd "iptables-restore < /etc/iptables.test.rules" i get iptables-restore v1.4.2: no command specified | Error occurred at line: 17
04:08 < Sea> but line 17 is the last COMMIT
04:08 <@vpnHelper> RSS Update - forum: How to create multi-server vpn <http://forums.openvpn.net/topic7748.html#p10407>
04:08 < Sea> Yeah got that by myself ;)
04:08 < Sea> first part works
04:08 < Sea> 2nd wont
04:09 < Sea> the filter one
04:09 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
04:11 < Sea> u got any idea ?
04:11 < ambro718> looking
04:11 < krzee> your question is actually an iptables one
04:12 < Sea> yeah but cant find anyone to help me ;)
04:13 < krzee> i dont see you in #iptables (aka #netfilter because it forwards)
04:13 < Sea> ahhh
04:13 < Sea> nice
04:14 < krzee> im not saying its a bad question for here, it is not
04:14 < krzee> just trying to help by pointing to the experts for the right tool
04:17 -!- ambro7181 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
04:17 -!- Saur0 [~sax@188-223-80-168.zone14.bethere.co.uk] has joined #openvpn
04:18 < Saur0> Hi can I set up a IPsec VPN using Openvpn ? i'm reading conflicting information on the web
04:18 < krzee> no
04:18 < krzee> !notcompat
04:18 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
04:18 < Saur0> ok thats what i though cheers
04:18 < krzee> cheers
04:19 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Ping timeout: 240 seconds]
04:30 -!- Splex [~splex@unaffiliated/splex] has quit [Ping timeout: 252 seconds]
04:33 -!- EugeneKay is now known as EugeneKaway
04:44 -!- ambro7181 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
04:44 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
04:44 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has left #openvpn []
04:45 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
04:45 -!- asdg [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
04:46 -!- mirco_ [~mirco@pD9E5798D.dip.t-dialin.net] has joined #openvpn
04:46 -!- Sea [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 250 seconds]
04:48 -!- mirco [~mirco@p5DD344F0.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
04:48 -!- mirco_ is now known as mirco
04:48 -!- EugeneKaway is now known as EugeneKay
04:53 -!- asdg is now known as Sea
04:57 -!- asdg [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
05:00 -!- Sea [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 276 seconds]
05:00 -!- asdg is now known as Sea
05:04 -!- ribasushi [~ribasushi@arx.rabbit.us] has left #openvpn ["Leaving"]
05:10 < Sea> isnt there a easier way to get this stuff to work :\ 
05:10 < Sea> damn chinese 
05:14 -!- BostX [~bost@p5B2F10A6.dip0.t-ipconnect.de] has joined #openvpn
05:15 -!- Splex [~splex@n220246241116.netvigator.com] has joined #openvpn
05:15 -!- Splex [~splex@n220246241116.netvigator.com] has quit [Changing host]
05:15 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
05:16 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
05:16 <@vpnHelper> RSS Update - forum: I can't able to create a New certificate <http://forums.openvpn.net/topic7768.html>
05:19 < krzee> well in general walkthroughs like that are a very hard way to learn
05:19 < krzee> so when something goes wrong, you dont know how to fix it
05:19 < krzee> if you choose to learn it all:
05:19 < krzee> !howto
05:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:19 < krzee> !sample
05:19 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
05:19 < krzee> !linnat
05:19 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
05:19 < krzee> !linipforward
05:19 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
05:23 < krzee> oh and
05:23 < krzee> !man
05:23 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
05:25 -!- Sea is now known as Sea_Test
05:26 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
05:28 -!- asdg [Sea_Test@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
05:28 -!- asdg is now known as Sea
05:30 -!- SaurO [~sax@188-223-80-168.zone14.bethere.co.uk] has joined #openvpn
05:30 -!- Sea_Test [Sea@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 250 seconds]
05:33 -!- Saur0 [~sax@188-223-80-168.zone14.bethere.co.uk] has quit [Ping timeout: 240 seconds]
05:34 -!- Saur0 [~sax@188-223-80-168.zone14.bethere.co.uk] has joined #openvpn
05:35 < Sea> Ok I think i need to talk here now again ;)
05:35 < Sea> routing now works
05:35 < Sea> but DNS doesnt.
05:35 < Sea> shouldnt push "redirect-gateway" do DNS for the Client ?
05:36 -!- SaurO [~sax@188-223-80-168.zone14.bethere.co.uk] has quit [Ping timeout: 276 seconds]
05:36 < Sea> cant give it a public DNS IP, as the chinese seem do block any other DNS Server but their won
05:36 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
05:38 -!- Sea is now known as sea123
05:40 -!- Sea_Test [Sea_Test@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
05:43 -!- sea123 [Sea_Test@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 260 seconds]
05:43 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
05:45 -!- sea123 [~SeaStorm@vps9656.alfahosting-vps.de] has joined #openvpn
05:46 < sea123> If I add push "dhcp-option DNS 8.8.8.8" to the config, will my W7 Client then "directly" resolve by 8.8 or "through the server" ?
05:47 -!- Sea_Test [Sea_Test@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 264 seconds]
05:50 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
05:55 -!- Sea_Test [Sea_Test@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
05:57 -!- Sea [~SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
05:57 -!- sea123 [~SeaStorm@vps9656.alfahosting-vps.de] has quit [Ping timeout: 240 seconds]
05:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
06:00 -!- Sea_Test [Sea_Test@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 250 seconds]
06:03 <@vpnHelper> RSS Update - forum: OpenVPN 2.1.1 on my N900 <http://forums.openvpn.net/topic7769.html>
06:35 -!- BostX [~bost@p5B2F10A6.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
06:36 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
06:46 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
06:47 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
06:51 < roentgen> Sea: a gateway is not necessarily also a dns server
06:52 < roentgen> push the vnp server also as a dns ip and set up dns on it
07:03 -!- EugeneKay is now known as EugeneKaway
07:32 < Sea> yeah but does the request go through the VPN tunnel or will it go directly to the net ?
07:32 < Sea> so the chinese can block it
07:45 < roentgen> Sea: a request to the vpn server IP address can only go thru ... VPN
07:46 -!- tntcoda [~jack@88.97.46.115] has joined #openvpn
07:47 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
07:52 -!- luneff [~yury@84.51.212.81] has joined #openvpn
07:52 -!- Splex [~splex@unaffiliated/splex] has quit [Ping timeout: 260 seconds]
07:52 < tntcoda> Hi, my server is configured for a single client who uses 192.168.1.x on the internal LAN. This is the relevant config lines http://pastie.org/1666501 this works fine but - Question is, how can I deal with a dynamic client IP range? for example if the client plugs into public wifi and I dont know the range in advance, how can i set the routes dynamically
07:53 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
07:53 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:56 -!- crest [~crest@p57979FB8.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
08:08 -!- EugeneKaway is now known as EugeneKay
08:14 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
08:14 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
08:14 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
08:19 -!- EugeneKay is now known as EugeneKaway
08:48 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
08:51 -!- crest [~crest@p57979FB8.dip.t-dialin.net] has joined #openvpn
08:58 <@vpnHelper> RSS Update - forum: TLS closed <http://forums.openvpn.net/topic7770.html>
08:59 < Sea> roentgen: thought so ;) Wanted to make sure it is like that, as I maybe cant change stuff when im in china :)
09:14 -!- BostX [~bost@p5B2F10A6.dip0.t-ipconnect.de] has joined #openvpn
09:18 -!- luneff [~yury@84.51.212.81] has quit [Quit: Leaving]
09:25 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:37 -!- p3rror [~mezgani@2001:0:53aa:64c:24c1:40d6:d673:d89a] has quit [Read error: Operation timed out]
09:39 -!- Guest35601 is now known as stony
09:52 -!- Sea [~SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit []
09:52 -!- BostX [~bost@p5B2F10A6.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
09:53 -!- p3rror [~mezgani@2001:0:53aa:64c:102f:17f3:d673:d89a] has joined #openvpn
09:58 <@vpnHelper> RSS Update - forum: Configuring for dynamic client IPs <http://forums.openvpn.net/topic7771.html>
10:40 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 248 seconds]
10:46 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:48 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
11:33 -!- luneff [~yury@84.51.212.81] has joined #openvpn
11:49 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:58 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
12:20 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
12:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
12:37 -!- BostX [~bost@p5B2F10A6.dip0.t-ipconnect.de] has joined #openvpn
12:43 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
12:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:57 < pwrcycle> hi all. if someone has the time, can I get some feedback on this config on why the Client isn't routing through the tunnel? http://pastebin.com/dKANSDy3
12:58 -!- luneff [~yury@84.51.212.81] has quit [Read error: Connection reset by peer]
12:58 -!- luneff [~yury@84.51.212.81] has joined #openvpn
13:07 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
13:12 -!- tntcoda [~jack@88.97.46.115] has quit [Remote host closed the connection]
13:16 -!- Torpion [~torpion@ydb.me] has quit [Read error: Operation timed out]
13:19 -!- Torpion [~torpion@ydb.me] has joined #openvpn
13:22 -!- kto [~kto@j101243.upc-j.chello.nl] has joined #openvpn
13:29 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 240 seconds]
13:49 -!- loompek [~noname@noname.rula.net] has joined #openvpn
13:52 -!- Guest68746 [~noname@noname.rula.net] has quit [Ping timeout: 250 seconds]
14:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:57 -!- BostX [~bost@p5B2F10A6.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
15:09 < dvl> OK, I'm saying it again... It's so nice to be accessing my files at home over the VPN
15:09 < dvl> pwrcycle: If it's windows, make sure you're runing the client as adminstrator.
15:09 < dvl> right click, run as admin....
15:09 < Bushmills> pwrcycle: windows client?
15:14 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
15:19 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn ["Leaving"]
15:23 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
15:24 < kto> hello, I have a question
15:25 < Bushmills> here is your answer
15:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:25 < kto> inside a config file, I specify "key mykey.key", and therefore it asks me a password
15:25 < kto> now: question = can I put also the password inside the config file ?
15:33 < krzee> if you are wanting to do that, just remove the key instead
15:33 < krzee> !factoids search pw
15:33 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
15:33 < krzee> !factoids search pass
15:33 <@vpnHelper> 'winpass', '2.1-winpass-script', 'authpass', 'password-only', 'strip-passphrase', 'change-passphrase', and 'enable-passwd-save'
15:33 < krzee> there it is
15:33 < krzee> !strip-passphrase
15:33 <@vpnHelper> "strip-passphrase" is see http://blog.lib.umn.edu/silvi003/codenotes/2008/08/how_to_strip_a_passphrase_from.html to learn how to strip a passphrase from a key file
15:36 -!- webmind [~webmind@yavin.puscii.nl] has joined #openvpn
15:36 < webmind> gday
15:36 < webmind> I was wondering, does 2.2 feature ipv6 transport support (so listening on ipv6 ip's)? or do I need to wait for 2.3?
15:41 < krzee> so you're talking about --listen taking ipv6 as opposed to --server-ipv6, right?
15:44 -!- SaurO [~sax@188-223-80-168.zone14.bethere.co.uk] has joined #openvpn
15:44 < webmind> krzee, yes
15:47 < krzee> nope
15:47 < krzee> does not exist to my knowledge
15:47 < krzee> feal free to toss it on the wishlist either on the forum or trac
15:47 < krzee> !trac
15:47 <@vpnHelper> "trac" is see http://community.openvpn.net for development information and bug tracker.
15:47 < krzee> !forum
15:47 <@vpnHelper> Configuring for dynamic client IPs || TLS closed || OpenVPN 2.1.1 on my N900 || I can't able to create a New certificate || How to create multi-server vpn || Speed || --shaper and --server together || Error starting openvpn service || OpenVPN winxp server android client || No internet access when VPN connected || IP Leaking || I need some help || OpenVPN Access Server - Re:
15:47 <@vpnHelper> Branding || No connect option || Routed and Bridged on the same server? || Wireshark showing no encryption in OpenVPN || iptables for openvpn || one certificate two servers || vmware editon and suddenlink cable || Can't start OpenVPN as a service using init script || Simple configuration for 1 server and 2 clients || redirect port from externt world to my vpn client does not w ||
15:47 <@vpnHelper> Windows 7 x64, routing, DHCP and a unstable VPN || Connection problems - can I pick your brains? || Installation OpenVpn Server on centos 5.5 (Trixbox) problem || Issues with remote connectivity on OpenVPN (Ubuntu). Help! || Automatically mount network drive when openvpn connects || Avoid dropping of connection || Is OPEN VPN right for me? || OpenVPN on Debian doesn't want to route? || (4 more messages)
15:47 < krzee> hah, ouch
15:48 -!- Saur0 [~sax@188-223-80-168.zone14.bethere.co.uk] has quit [Ping timeout: 250 seconds]
15:48 < krzee> well its in the topic ;]
15:48 < krzee> they use the same login/password
15:48 < krzee> so if you are on 1, you are on both
15:49 < krzee> but that might need to wait til openvpn 3
15:50 < webmind> *curse* recaptcha
15:50 < krzee> i know the code related to listening is pretty scary to veteran coders, and that things like binding to multiple ports will need to wait for 3
15:50 < krzee> details avail in a sec, lemme find the roadmap
15:51 < krzee> https://community.openvpn.net/openvpn/wiki/RoadMap
15:51 <@vpnHelper> Title: RoadMap – OpenVPN Community (at community.openvpn.net)
15:51 -!- luneff [~yury@84.51.212.81] has quit [Read error: Connection reset by peer]
15:51 -!- luneff [~yury@84.51.212.81] has joined #openvpn
15:52 < krzee> it would just be a different socket module
15:52 <@vpnHelper> RSS Update - forum: PASSTOS <http://forums.openvpn.net/topic7281.html#p10412>
15:57 < webmind> krzee, thanks. I already found the roadmap but it only mentions 3.0 while 2.2 is a RC, and 2.3 not in sight
15:57 < webmind> so didn't seem relevant to anything in the near future
15:58 < krzee> right, im pretty sure nothing related to socket code will be touched until 3
15:58 < krzee> its kinda a dirty-but-works-so lets not touch it state right now, 3 will be a complete re-write of it
15:58 < krzee> is my understanding of it
16:00 < webmind> added it to the wishlist
16:00 < webmind> hmm
16:00 < webmind> pity
16:00 -!- SaurO [~sax@188-223-80-168.zone14.bethere.co.uk] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
16:00 < webmind> any idea what the timeline for 3.0 is?
16:00 < krzee> its still a sperm
16:01 < krzee> no idea when it will fertilize ;]
16:01 < krzee> but i do see your ticket was submitted =]
16:01 < krzee> #103
16:02 < webmind> I wouldn't mind having to use yet another a config for it if it's difficult to listen on multiple ports
16:02 < krzee> thats not major priority
16:02 < webmind> ah sorry
16:02 < kto> krzee: you mean without the human typing the password, the VPN connection could be attacked by somebody who can have access to the key ?
16:02 < webmind> I defaulted
16:02 < krzee> kto, if they can access the key file, they can access the config file
16:02 <@vpnHelper> RSS Update - forum: passtos working on windws <http://forums.openvpn.net/topic7772.html>
16:03 < krzee> which is why what you asked for does not exist... use a passphrase and know its "something you know" and not "something you have" or do not
16:03 < webmind> already was planning a wrapper which would regenerate configs depending on config diffs in order to have one single configuration for minor differences
16:03 < krzee> you want it to be "something you have", but the key file itself is already that
16:03 < webmind> (like listening on multiple ports:)
16:04 < krzee> the passphrase is for encrypting that key file so it cant be used without the passphrase (adding "something you know" and making it more secure)
16:04 < krzee> oh sure, you can easily run 2 instances of openvpn on 2 ports
16:05 < krzee> and generating configs...
16:05 < krzee> !confgen
16:05 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
16:05 < krzee> i already made it for you
16:05 < kto> krzee: thanks
16:05 < krzee> scripts for making client and server configs (accepts cli options) and a wrapper to walk you through making them
16:05 < krzee> you could make your own wrapper to call my scripts if wanted
16:06 < krzee> kto, np
16:06 < webmind> ah, what I meant is automaticly generating configs before you start your openvpn
16:06 < webmind> like I have some configurations where the only difference is the port number
16:07 < krzee> shouldnt work
16:07 < krzee> will have subnet collision
16:07 < webmind> works fine in topology mode and with --ifconfig-pool-persist
16:08 < krzee> each server should be using the exact same ip
16:08 < krzee> on the tun interfaces
16:08 < webmind> they do
16:08 < krzee> well that cant work!
16:08 < webmind> it does
16:09 < krzee> heh ok
16:09 < webmind> and means users have the same IP independant of the port they connect to
16:09 < krzee> i expect some "hey whats wrong with my vpn!?" coming from you on that one
16:09 < krzee> or are you bridging or something...
16:09 < webmind> if I have routing problems I know where they come from :)
16:09 < webmind> tun mode 
16:10 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:10 < webmind> I also have a tap setup, but that has a different subnet
16:10 < krzee> ild love to see a writeup on that
16:10 < webmind> which? the tun setup?
16:10 < krzee> ya
16:11 < krzee> feel free to use either wiki
16:11 < krzee> !wiki
16:11 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN, or (#2) Official wiki is at https://community.openvpn.net/openvpn/wiki
16:11 < krzee> !forget wiki *
16:11 <@vpnHelper> Joo got it.
16:12 < webmind> I was contemplating it, so perhaps I will :)
16:12 < krzee> !learn wiki as http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki
16:12 <@vpnHelper> Joo got it.
16:13 < krzee> !learn wiki as https://community.openvpn.net/openvpn/wiki for the Official wiki
16:13 <@vpnHelper> Joo got it.
16:14 < webmind> but thanks for the help..
16:37 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
16:41 -!- BostX [~bost@p5B2F10A6.dip0.t-ipconnect.de] has joined #openvpn
16:44 -!- kto [~kto@j101243.upc-j.chello.nl] has quit [Read error: Connection reset by peer]
16:57 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
17:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
17:20 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
17:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
17:34 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
17:43 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 248 seconds]
17:46 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
17:46 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
17:47 -!- luneff [~yury@84.51.212.81] has quit [Quit: Leaving]
17:50 -!- EugeneKaway is now known as EugeneKay
17:50 < pwrcycle> any feedback would be appreciated on this config on why the Ubuntu client isn't routing through the tunnel? http://pastebin.com/WFxP4txT
17:54 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
18:00 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Chicks dig it]
18:54 -!- p3rror [~mezgani@2001:0:53aa:64c:102f:17f3:d673:d89a] has quit [Read error: Operation timed out]
19:00 -!- lucid1231 [lucid1231@69.80.99.75] has joined #openvpn
19:01 < lucid1231> Is it possable to remove a push route from a openvpn server on the client side. Mainly i want to stop the "redirect-gateway def1"
19:01 < lucid1231> I dont have control over the openvpn server.
19:04 < lucid1231> I will offer a reward if it is possable
19:04 < Bushmills> --route-nopull
19:05 < lucid1231> on the client side?
19:05 < Bushmills> "this option effectively bars the server from adding routes to the client's routing table"
19:06 < Bushmills> (When used on the client)
19:07 < lucid1231> verifiying
19:09 -!- ralphte [~lucid1231@198.134.88.185] has joined #openvpn
19:09 < ralphte> verifyed
19:11 -!- lucid1231 [lucid1231@69.80.99.75] has quit [Ping timeout: 246 seconds]
19:13 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
19:24 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
19:27 -!- ralphte [~lucid1231@198.134.88.185] has quit [Ping timeout: 240 seconds]
19:41 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
19:41 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
19:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:13 -!- BostX [~bost@p5B2F10A6.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
20:52 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:11 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 250 seconds]
21:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
21:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
21:46 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has joined #openvpn
22:00 -!- common- [~common@p5DDA4B69.dip0.t-ipconnect.de] has joined #openvpn
22:00 -!- lucid1231 [~lucid1231@96.254.112.73] has joined #openvpn
22:03 -!- common [~common@p5DDA4CC8.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
22:03 -!- common- is now known as common
22:07 -!- master_of_master [~master_of@p57B5550B.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:11 -!- master_of_master [~master_of@p57B53F44.dip.t-dialin.net] has joined #openvpn
22:51 -!- crest [~crest@p57979FB8.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
22:54 <@vpnHelper> RSS Update - forum: Configuring for dynamic client IPs <http://forums.openvpn.net/topic7771.html#p10414>
22:57 -!- crest [~crest@p57917586.dip.t-dialin.net] has joined #openvpn
23:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:08 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:12 <@vpnHelper> RSS Update - forum: I can't able to create a New certificate <http://forums.openvpn.net/topic7768.html#p10416> || Error starting openvpn service <http://forums.openvpn.net/topic7765.html#p10415>
23:42 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Ping timeout: 252 seconds]
23:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
23:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:51 -!- cmur2_ [~quassel@static.63.239.63.178.clients.your-server.de] has joined #openvpn
23:52 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has quit [Ping timeout: 250 seconds]
23:59 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Ping timeout: 252 seconds]
--- Day changed Mon Mar 14 2011
00:00 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
00:28 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:35 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:39 -!- Netsplit *.net <-> *.split quits: hardwire, Rolybrau, rkantos, @vpnHelper, daemon, aef, MrJK, dkr, batrick
01:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:00 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
01:00 -!- MrJK [~jezu@194.199.166.96] has joined #openvpn
01:00 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
01:00 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
01:00 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
01:00 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
01:00 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
01:00 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
01:00 -!- ServerMode/#openvpn [+o vpnHelper] by anthony.freenode.net
01:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
01:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
01:15 -!- jasan [~jasan@ams1.x31.com] has joined #openvpn
01:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:37 <@vpnHelper> RSS Update - forum: problem with unstable channel and client-disconnect <http://forums.openvpn.net/topic7773.html>
01:44 -!- mirco [~mirco@pD9E5798D.dip.t-dialin.net] has quit [Quit: mirco]
01:50 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
01:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
01:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:10 -!- EugeneKay is now known as EugeneKaway
02:17 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:17 -!- lucid1231 [~lucid1231@96.254.112.73] has quit [Ping timeout: 252 seconds]
02:22 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:22 -!- mode/#openvpn [+o mattock] by ChanServ
02:25 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
02:51 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:13 <@vpnHelper> RSS Update - forum: problem with unstable channel and client-disconnect <http://forums.openvpn.net/topic7773.html#p10418>
03:35 -!- renihs_ [~lemming@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Quit: narf]
03:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
03:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:50 -!- dazo_afk is now known as dazo
03:50 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
03:50 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
04:03 -!- EugeneKaway is now known as EugeneKay
04:13 <@vpnHelper> RSS Update - forum: No connect option <http://forums.openvpn.net/topic7512.html#p10420> || Routed and Bridged on the same server? <http://forums.openvpn.net/topic7760.html#p10419>
04:15 -!- cmur2_ is now known as cmur2
04:18 -!- EugeneKay is now known as EugeneKaway
04:19 <@vpnHelper> RSS Update - forum: OpenVPN winxp server android client <http://forums.openvpn.net/topic7766.html#p10422> || No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10421>
04:24 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Read error: Operation timed out]
04:29 -!- EugeneKaway is now known as EugeneKay
04:51 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
05:07 -!- buntfalke_ is now known as buntfalke
05:11 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
05:12 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
05:16 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
05:17 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:17 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:20 <@vpnHelper> RSS Update - forum: PASSTOS <http://forums.openvpn.net/topic7281.html#p10423>
05:24  * Bushmills is going to /ignore vpnHelper again
05:26 <@vpnHelper> RSS Update - forum: I can't able to create a New certificate <http://forums.openvpn.net/topic7768.html#p10425> || Configuring for dynamic client IPs <http://forums.openvpn.net/topic7771.html#p10424>
05:39 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
05:39 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
05:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:40 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
05:44 <@vpnHelper> RSS Update - forum: problem with unstable channel and client-disconnect <http://forums.openvpn.net/topic7773.html#p10426>
06:00 -!- paranoidi [~paranoidi@av41.adsl.tnnet.fi] has joined #openvpn
06:04 -!- EugeneKay is now known as EugeneKaway
06:05 -!- hell [~hell@spb.hellamps.ru] has joined #openvpn
06:06 < hell> hello. i have a strange trouble.
06:06 < hell> openvpn does not start from init.d, but ok from commandline
06:06 < hell> (client).
06:06 < hell> from init.d it writes to log TCP/UDP: Socket bind failed on local address [undef]:1197: Permission denied
06:08 < hell> seems like, trouble with resolving, from init.d
06:12 < hell> from strace:  bind(4, {sa_family=AF_INET, sin_port=htons(1197), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EACCES (Permission denied)
06:14 -!- EugeneKaway is now known as EugeneKay
06:21 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
06:25 -!- evenflow [~david@bzq-79-179-184-95.red.bezeqint.net] has joined #openvpn
06:27 < evenflow> hello, im having problem connecting to my openvpn, the error i get: http://pastebin.com/0Xzrzbgc
06:30 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
06:30 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
06:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
06:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
07:03 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Ping timeout: 264 seconds]
07:12  * ecrist doubts vpnHelper cares that Bushmills is ignoring it
07:21 -!- newUser [79361d35@gateway/web/freenode/ip.121.54.29.53] has joined #openvpn
07:22 < newUser> hellow! how to do a file transfer?? sharing folders are not enough :D
07:23 < newUser>  hellow! how to do a file transfer?? sharing folders are not enough :D
07:25 < LuckyY> Hi!
07:25 < LuckyY> GTFO
07:25 < LuckyY> woops wrong chan
07:36 < Bushmills> newUser: copy to DVD and stick into an envelope
07:39 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
07:39 < crocket> Hi
07:39 < crocket> Why does one need to use tap instead of tun when using a bridge?
07:47 < newUser>  [20:23] <newUser>  hellow! how to do a file transfer?? sharing folders are not enough :D
08:00 < Rienzilla> crocket: because a bridge is level 2 in the osi model
08:00 < Rienzilla> (i.e. messages on mac-level)
08:00 < crocket> Rienzilla, I know that a physical network bridge works on level 2.
08:00 < crocket> Rienzilla, But I don't know how a software bridge works.
08:01 < Rienzilla> it's essentially the same
08:01 < crocket> It has its own IP address while a physical network bridge doesn't have one.
08:01 < crocket> It's not the same on the surface.
08:01 < Rienzilla> a software bridge doesn't need an IP address
08:01 < crocket> ???
08:01 < Rienzilla> (and a physical bridge can have an IP... management IP on the switch for example)
08:02 < crocket> It obviously makes every interface in a bridge lose IP address.
08:02 < Rienzilla> functionally, a bridge in a linux machine does exactly the same as a switch
08:03 < Rienzilla> a packet comes in, it checks its tables to see on what ethernet interface the destination mac is located, and sends it out to that interface
08:08 -!- hell [~hell@spb.hellamps.ru] has left #openvpn []
08:08 < crocket> Rienzilla, What does TUN do, then?
08:09 < crocket> Is TUN the same as any other physical interfaces?
08:09 < crocket> like eth0?
08:11 -!- mXr [mxr@2001:1ad0:1337:1:5cee:1e49:fb64:53e7] has joined #openvpn
08:11 < mXr> hi, i got a question regarding --auth-user-pass from a file on windows. could it be that the no-auth-cache feature doesn't work with that?
08:12 < mXr> i'm using a prebuilt binary with the save-password stuff enabled (as i was not able to rebuild openvpn myself and gave up after hours)
08:12 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
08:12 < mXr> it does work on the first connect, but if the server dies (is restarted) and the client tries to reconnect, it no longer bothers to read from the file, but instead seems to try and read from stdin forcefully
08:12 < mXr> which of course fails because i have it running as a service
08:13 -!- newUser [79361d35@gateway/web/freenode/ip.121.54.29.53] has quit [Ping timeout: 245 seconds]
08:19 < Rienzilla> crocket: no, a tap interface acts the same as a physical ehternet interface
08:19 < crocket> Rienzilla, What's tun, then?
08:19 < Rienzilla> tun is a tunnel interface, which only carries IP
08:19 < crocket> Rienzilla, ???
08:19 < crocket> Rienzilla, Do you know some documents about this?
08:20 < Rienzilla> it's probably in the openvpn manual
08:20 < Rienzilla> !tunortap
08:20 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
08:20 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
08:22 < crocket> Rienzilla, ok I'm about to get it
08:22 < crocket> !tun
08:23 < mXr> could it be that openvpnserv.exe does not automatically restart its launched openvpn.exe processes if they exist for whatever reason?
08:33 < crocket> Rienzilla, Is it a bridge or a switch that responds to broadcast packets?
08:33 < crocket> Broadcast IP address is the highest IP address in a subnet.
08:35 < Rienzilla> your understanding of networking is flawed
08:36 < Rienzilla> a bridge or a switch is functionally the same thing, and it needn't respond to anything
08:36 < Rienzilla> it just passes packets through
08:37 < Rienzilla> be it ipv4 packets, arp requests, ipx/spx or your own awesome protocol
08:39 < crocket> Rienzilla, Does broadcast IP address exist without a switch?
08:40 < Rienzilla> ......does applejuice exist without pear trees? 
08:41 < crocket> Rienzilla, They are unrelated.
08:41 < Rienzilla> exactly
08:42 < crocket> Rienzilla, Do you use tun or tap?
08:42 < Rienzilla> a classic switch knows nothing about IP 
08:42 < Rienzilla> it only knows about mac addresses
08:44 < Rienzilla> if you only need to communicate over IP, just use tun. tap is more flexible, but doing it wrong may cause serious havoc on your network and it's hard to find where the trouble is
08:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
08:48 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 255 seconds]
08:49 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
08:49 < crocket> Rienzilla, Can OpenVPN clients be behind a NAT firewall?
08:50 < pwrcycle> any feedback would be appreciated on this config on why the Ubuntu cli
08:50 < pwrcycle> ent isn't routing through the tunnel? http://pastebin.com/WFxP4txT
08:51 < Rienzilla> crocket: yes, absolutely
08:52 < crocket> That's a comfort.
08:52 < Rienzilla> it is :)
08:56 -!- evenflow [~david@bzq-79-179-184-95.red.bezeqint.net] has left #openvpn []
08:59 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
09:05 -!- jasan [~jasan@ams1.x31.com] has left #openvpn []
09:07 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 255 seconds]
09:12 -!- albech [~thomas@61.7.130.246] has joined #openvpn
09:14 <@vpnHelper> RSS Update - forum: Connection lost when doing rsync over openvpn <http://forums.openvpn.net/topic7774.html>
09:15 -!- colision [logos@189.81.116.147] has joined #openvpn
09:17 -!- albech [~thomas@61.7.130.246] has quit [Client Quit]
09:19 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:20 <@vpnHelper> RSS Update - forum: need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html>
09:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
09:26 <@vpnHelper> RSS Update - forum: OpenVPN as client to Citrix Access Gateway <http://forums.openvpn.net/topic7776.html>
09:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:40 -!- albech [~thomas@110.164.248.17] has joined #openvpn
09:44 <@vpnHelper> RSS Update - forum: Virtual adapter for wireless <http://forums.openvpn.net/topic7777.html>
09:47 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
09:50 -!- mXr [mxr@2001:1ad0:1337:1:5cee:1e49:fb64:53e7] has quit [Remote host closed the connection]
09:56 <@vpnHelper> RSS Update - forum: Virtual adapter for wireless <http://forums.openvpn.net/topic7777.html#p10433> || OpenVPN as client to Citrix Access Gateway <http://forums.openvpn.net/topic7776.html#p10432> || need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html#p10431>
10:04 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
10:05 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Read error: Connection reset by peer]
10:14 <@vpnHelper> RSS Update - forum: need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html#p10434>
10:27 <@vpnHelper> RSS Update - forum: Virtual adapter for wireless <http://forums.openvpn.net/topic7777.html#p10437> || need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html#p10436>
10:37 -!- tf87 is now known as tf87_afk
10:40 -!- mant1s [~mant1s@130.111.162.226] has joined #openvpn
10:40 -!- mant1s [~mant1s@130.111.162.226] has quit [Changing host]
10:40 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:44 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
10:55 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
11:07 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Remote host closed the connection]
11:09 <@vpnHelper> RSS Update - forum: OpenVPN winxp server android client <http://forums.openvpn.net/topic7766.html#p10438>
11:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
11:19 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
11:19 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
11:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
11:21 <@vpnHelper> RSS Update - forum: need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html#p10439>
11:44 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
11:47 -!- Guest68746 [~noname@kista.rula.net] has joined #openvpn
11:50 -!- loompek [~noname@noname.rula.net] has quit [Ping timeout: 276 seconds]
11:50 <@vpnHelper> RSS Update - forum: Virtual adapter for wireless <http://forums.openvpn.net/topic7777.html#p10440>
11:57 <@vpnHelper> RSS Update - forum: Virtual adapter for wireless <http://forums.openvpn.net/topic7777.html#p10441>
12:09 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 260 seconds]
12:17 -!- volga629 [~slava@host7.pythian.com] has joined #openvpn
12:18 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:18 -!- dazo is now known as dazo_afk
12:19 < volga629> how I can call this commonName  = $ENV:LASTNAME from another script ?
12:19 < volga629> thank you
12:23 < crocket> I've got a problem starting OpenVPN.
12:23 < crocket> I typed "openvpn /etc/openvpn/oepnvpn.conf", and nothing is started.
12:24 < crocket> I typed "ps aux | grep -i openvpn" but nothing.
12:24 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
12:26 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Quit: Leaving]
12:30 < pwrcycle> crocket: is this a spelling error or the real file name: oepnvpn.conf
12:30 < crocket> spelling error
12:34 < crocket> This is the content of openvpn.conf #
12:34 < crocket> oops
12:34 < crocket> http://pastebin.com/X8idEr5f
12:34 < crocket> Is there anything wrong?
12:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
12:44 -!- volga629 [~slava@host7.pythian.com] has quit [Quit: Leaving]
12:44 -!- mirco [~mirco@p5DD342F4.dip.t-dialin.net] has joined #openvpn
12:57 -!- kobaz [~kobaz@its.kobaz.net] has joined #openvpn
12:58 < kobaz> I have a udp server set up with like 25 clients with the same config... this one client keeps reconnecting every 45-60 seconds noting ping timeout
12:58 < kobaz> if i run an icmp ping from that server to the vpn ip 10.3.2.1 the pings are solid but they just stop when openvpn decides to reconnect
12:59 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:01 < kobaz> http://pastebin.com/5s9MU26m
13:01 < kobaz> it's a really simple config
13:01 < kobaz> it seems like the only reason that the pings stop is because openvpn decides to reconnect
13:04 -!- kobaz is now known as Kobaz
13:07 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:07 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:07 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:08 < Kobaz> oh, weird
13:08 < Kobaz> there were two openvpn clients going on the same box with the same config
13:09 < Kobaz> i would think the startup scripts would have prevented that
13:09 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 260 seconds]
13:10 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
13:14 < crocket> If I use 2048bit private keys for signing certificates, would network latencies become longer?
13:14 <@vpnHelper> RSS Update - forum: improving speed at which windows client connect <http://forums.openvpn.net/topic7778.html>
13:18 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
13:18 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
13:18 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
13:25 < crocket> I want to use my DHCP server on tun0. Is that possible?
13:26 < crocket> dnsmasq is both a DHCP server and a DNS server.
13:28 < crocket> no?
13:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
13:40 -!- EugeneKay is now known as EugeneKaway
13:40 < gladiatr> crocket, if you can put an IP address on it, you can serve DHCP over it
13:40 -!- EugeneKaway is now known as EugeNapingK
13:40 -!- EugeNapingK is now known as EugeNappingK
13:41 < crocket> gladiatr, ???
13:41 < crocket> gladiatr, Can you express again?
13:41 < gladiatr> crocket, just sayin' that you can indeed bind your tun0 interface to dhcpd
13:41 < gladiatr> or dnsmasq
13:42 < crocket> gladiatr, But IP addresses are given to client tun0 devices even before DHCP client works.
13:42 < gladiatr> the most you would need to do would be to restart your dhcp server.  this might not be necessary for dnsmasq if it knows how to pick up new interfaces automatically
13:43 < crocket> gladiatr, Do I need to disable --server option?
13:43 < gladiatr> Ah.  Well, you'll need to reconfigure your vpn server.  If you look at the openvpn man page, you'll see a breakdown of the various directives that make up the "server" macro.
13:44 < gladiatr> I imagine it's the pool directive that has to be left out... 
13:46 < crocket> gladiatr, Don't I need to use TAP device to enable DHCP?
13:47 < gladiatr> Using TAP would guarantee that it will work, but I don't know that it won't work with the tun device
13:48 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
13:48 < gladiatr> or rather with openvpn using a "routed" connection.
13:48 -!- jwm [jwm@dev.dist.us] has quit [Read error: Operation timed out]
13:48 -!- jwm [jwm@dev.dist.us] has joined #openvpn
13:50 -!- APTX_ [APTX@phpBB/developer/APTX] has joined #openvpn
13:50 -!- APTX [APTX@phpBB/developer/APTX] has quit [Remote host closed the connection]
13:50 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
13:50 -!- Meliorator [m@dunnington.eu] has quit [Quit: changing servers]
13:52 -!- noisebleed_ [~quassel@lula.inescn.pt] has joined #openvpn
13:53 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:56 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
14:02 -!- Netsplit *.net <-> *.split quits: matwix
14:02 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
14:02 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
14:07 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
14:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:08 < krzee> why do you want dhcp over the vpn?
14:08 < krzee> openvpn has its own 'dhcp server' of sorts built in
14:09 < Kobaz> yeah if you run a dhcp server on your vpn subnet, you'll have problems
14:10 < gladiatr> krzee, there you go... asking *those* questions again (sheesh (shakes head))
14:10 < Kobaz> what are you trying to accomplish? static ips?
14:11  * gladiatr intones, "Ours is not to question why.  Ours is but to point at the trigger and confirm that if the end-user is looking for the way to make the crotch-angled shotgun go boom, the trigger goes towards the faux wood end of the gun"
14:12 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:12 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Excess Flood]
14:13 -!- Meliorator [m@dunnington.eu] has joined #openvpn
14:13 -!- Meliorator [m@dunnington.eu] has quit [Excess Flood]
14:13 < webmind> gladiatr, :)
14:17 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
14:21 -!- Meliorator [m@dunnington.eu] has joined #openvpn
14:21 -!- Meliorator [m@dunnington.eu] has quit [Max SendQ exceeded]
14:26 -!- BostX [~bost@p5B2F1848.dip0.t-ipconnect.de] has joined #openvpn
14:33 -!- Meliorator [m@dunnington.eu] has joined #openvpn
14:38 -!- noisebleed_ [~quassel@lula.inescn.pt] has quit [Ping timeout: 250 seconds]
14:42 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:44 -!- crocket [~crocket@183.107.21.138] has joined #openvpn
14:44 < crocket> Can I relay DHCP packets over tun?
14:49 < Kobaz> sure but why would you want to
14:51 < crocket> Kobaz, I want to distribute DHCP IP addresses over tun.
14:51 < crocket> Kobaz, I don't want OpenVPN to determine IP addresses.
14:52 < crocket> Kobaz, Do I need to use tap?
14:55 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
14:59 < krzee> you likely need to learn to understand routing
14:59 < krzee> because you are asking for a way to use more overhead, and slightly less security, in order to accomplish a pointless task
15:00 < krzee> but yes, tap could accomplish said pointless task
15:00 < Kobaz> CrazyFurry: and why don't you want openvpn to determine ip addresses
15:01 < krzee> that almost always comes from a lack of understanding of routing
15:02 < hjohnson> I'm running a bridged network, but mostly for fugly reasons. :P (I want to be able to do time machine backups over the VPN, this was the easiest way to accomplish it)
15:02 < krzee> but they never say "because i dont understand routing"
15:02 < krzee> time machine uses layer2?
15:02 < krzee> ive used time machine over NFS
15:03 < hjohnson> krzee: no, but it uses zeroconf/bonjour to advertise the server
15:03 < krzee> http://rajeev.name/2007/11/03/time-machine-with-smb-and-nfs-shares/
15:03 <@vpnHelper> Title: Time Machine with SMB and NFS Shares · Rajeev Karamchedu (at rajeev.name)
15:03 < hjohnson> krzee: i'm running it over Netatalk so that the server is faking out a time capsule
15:03 < krzee> oh ok, but it doesnt have to ;]
15:04 < hjohnson> krzee: it's more stable if it does, since the current version of AFP supports verifiable flush-to-disk symantics
15:04 < krzee> the link i just gave would allow it on a layer3 tun
15:04 < krzee> AFP is on that link
15:04 < krzee> you just wouldnt use the automated way of finding it
15:04 < krzee> you would mount it the unix way instead
15:04 < hjohnson> though I think I could put a relay on the router to make it happy
15:05 < krzee> or not use a relay!
15:05 < krzee> they dont NEED to be auto-detected to work
15:06 < hjohnson> yeah, but i'm a lazy SOB. :P
15:06 < krzee> if they dont auto-mount, just adjust your fstab
15:06 < krzee> well ok, doesnt matter to me how you do it
15:06 < krzee> just so long as you understand theres options
15:08 < hjohnson> ahh, there's an avahi reflector option
15:10 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Read error: Connection reset by peer]
15:11 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
15:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:24 < krzee> webmind, see your trouble ticket, your feature request in fact DOES exist in the devel snapshots, i just didnt know it =]
15:27 <@vpnHelper> RSS Update - forum: need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html#p10443>
15:30 -!- MarKsaitis_ is now known as marksaitis
15:31 -!- tf1987_ [~tf1987@office.neteasyinc.com] has joined #openvpn
15:33 < crocket> hmm
15:33 -!- crocket [~crocket@183.107.21.138] has quit [Quit: Leaving]
15:34 < webmind> krzee, how do you mean?
15:34 -!- tf87_afk [~tf1987@office.neteasyinc.com] has quit [Ping timeout: 246 seconds]
15:35 < krzee> https://community.openvpn.net/openvpn/ticket/103
15:35 <@vpnHelper> Title: #103 (--listen with ipv6 support) – OpenVPN Community (at community.openvpn.net)
15:36 < webmind> sweet, is there any documentation aswell?
15:37 < webmind> might go testing when I have time again
15:37 < krzee> dunno
15:37 < webmind> can always try the source then aswell
15:37 < krzee> try seeing if it comes in the manual with the install
15:37 < webmind> yeah
15:37 < krzee> also try giving --listen an ipv6 ip, and check for --listen-ipv6
15:40 -!- crocket [~crocket@183.107.21.20] has joined #openvpn
15:40 <@vpnHelper> RSS Update - forum: problem with unstable channel and client-disconnect <http://forums.openvpn.net/topic7773.html#p10444>
15:40 < crocket> Does TAP simply add more processings or increase network latency?
15:40 < webmind> yep
15:41 < crocket> webmind, Then I want TAP instead of TUN.
15:41 < crocket> With TUN, DHCP/DNS servers don't seem to work.
15:41 < krzee> it tunnels layer2 instead of layer3
15:42 < krzee> this means more ip overhead and widening the layer2 broadcast domain (layer2 attacks over the vpn then work)
15:42 < crocket> Are you sure TAP provides the same speed as TUN?
15:42 < krzee> dns servers work fine
15:42 < crocket> yeah
15:42 < krzee> !pushdns
15:42 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
15:42 < crocket> DNS server worked fine with TUN, though.
15:42 < krzee> and dhcp servers are not needed
15:43 < krzee> i know, im talking about they work on tun
15:43 < krzee> and layer2 tunnels may or may not be the same speed as layer3
15:43 < krzee> depends on the traffic going over the tunnel
15:43 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
15:43 < krzee> you will add the layer2 overhead by using tap
15:43 < crocket> krzee, I specifyed push "dhcp-options DNS 10.xx.xx.1", but linux doesn't get it.
15:43 < krzee> this may or may not impact speed
15:44 < krzee> thats because linux needs the update-resolv-conf script like my bot just told you above
15:44 < krzee> "(#4) in unix you'll use the update-resolv-conf script"
15:44 < crocket> krzee, dnsmasq is a DNS/DHCP server.
15:44 < krzee> so?
15:44 < crocket> krzee, How can I have dnsmasq work without its DHCP server?
15:45 < krzee> why does it need to be the dhcp server?
15:45 < krzee> it wont answer dns requests otherwise...?
15:45 < crocket> DHCP hostnames translate into DNS names directly in dnsmasq.
15:45 < webmind> crocket, sorry, I was responding to krzee 
15:45 < crocket> What's what I want.
15:45 < krzee> dhcp doesnt have hostnames
15:45 < webmind> tap0 works fine here, but never did any comparison tests
15:45 < crocket> krzee, yes it does.
15:46 < krzee> umm no, it does not
15:46 < crocket> krzee, I have used it numerous times.
15:46 < webmind> krzee, dhcp can push hostnames
15:46 < krzee> you are saying that dhcp has hostnames...?
15:46 < krzee> no, dhcp gives IPs
15:46 < webmind> krzee, aswell
15:46 < krzee> those IPs have hostnames
15:46 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
15:46 < krzee> as designated in dns
15:47 < crocket> DHCP hostnames are saved in DHCP server.
15:47 < webmind> DHCP can give more than then just an IP
15:47 < webmind> also WINS settings
15:47 < webmind> and routers
15:47 < crocket> DHCP Options.
15:47 < krzee> they are seperate, even if you insist on using a single place to configure them
15:47 < krzee> webmind, yes, but not hostnames
15:47 < crocket> krzee, http://www.networksorcery.com/enp/protocol/bootp/option012.htm
15:47 <@vpnHelper> Title: BOOTP / DHCP option 12, Host Name (at www.networksorcery.com)
15:48 < crocket> It's part of DHCP options.
15:48 < krzee> lol
15:48 < krzee> thats bootp dude
15:48 < crocket> "BOOTP / DHCP option 12"
15:48 < krzee> then again i guess most dhcp software can do bootp as well
15:48 < crocket> Don't judge by the URL.
15:49 < crocket> Read the content as well.
15:49 < krzee> The Dynamic Host Configuration Protocol (DHCP) is a more advanced protocol for the same purpose and has superseded the use of BOOTP. Most DHCP servers also function as BOOTP servers.
15:49 < crocket> anyway
15:49 < crocket> DHCP servers can carry hostnames.
15:50 < hjohnson> I have my DHCP server set to seed my DNS with <dhcpid>.localdomain.com
15:50 < krzee> and you can push the DOMAIN to the client as well
15:50 <@vpnHelper> RSS Update - forum: need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html#p10445>
15:50 < crocket> When any linux machine with a hostname requests an IP address from dnsmasq, it receives DHCP hostname and gives an IP address to the client.
15:50 < krzee> but ok, yes you use tap to allow layer2
15:51 < krzee> have at it :-p
15:51 < crocket> dnsmasq links the hostname with the ip and registers it to DNS table.
15:51 < crocket> meaning dnsmasq automatically generates DNS table from hostnames.
15:52 < crocket> Without it, I have to manually make DNS table.
15:54 < crocket> Does anyone know how to implement automatic hostname/IP address matching with TUN?
15:55 < crocket> Can openvpn replace DHCP/DNS server?
16:01 < Bushmills> dns: no.  dhcp: server can assign addresses to clients, and push dhcp options, similar to what a dhcp server can do. but a replacement it isn't.  
16:03 < Bushmills> hostname matching: use key matching, through common name, and handle clients accordingly, by use of ...
16:03 < Bushmills> !ccd
16:03 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
16:05 < Bushmills> clients could run a connect script, which adds their name and ip address per nsupdate to a remote name server
16:05 < Bushmills> so could server do, with client-connect script
16:14 < crocket> nsupdate?
16:17 < Bushmills> ddns client of bind
16:17 < crocket> I have ddns client, ddclient.
16:18 < Bushmills> i don't know what name server that one can talk to
16:19 < crocket> I have dyndns.org
16:20 < Bushmills> nsupdate talks to the program with the name bind
16:22 < crocket> Bushmills, I don't quite get it now.
16:24 < Bushmills> take machine A, running an authoritative name server, which zone example.com.  machine B wants to edit records on example.com on machine A - that's what machine B can do by using nsupdate 
16:24 < Bushmills> with zone ...
16:27 < Bushmills> so it could say, when vpn client connects to vpn server:   add an A record  machine_b.example.com with ip address <pick.an.ip.address>, and when disconnecting, delete that record again.
16:27 < Bushmills> short TTL would be a good idea
16:27 < hyper_ch> hi Bushmills
16:28 < Bushmills> good evening hyper_ch
16:28 < hyper_ch> how do you setup a lan with ipv6 when nat is missing?
16:28 < Bushmills> i thought ipv6 made NAT unnecessary
16:29 < hyper_ch> I know... but how do you seperate your lan from the evils of the internet with ipv6?
16:29 < Bushmills> firewall?
16:30 < Bushmills> not allowing inbound connections, for example
16:30 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
16:30  * hyper_ch huggles his nat
16:31 < hyper_ch> nat makes laning so much easier
16:31 < Bushmills> how do you protect your NATting machine?
16:31 < hyper_ch> well, with nat, you just have to protect one machine
16:32 < hyper_ch> ipv6 makes it all overly complicated
16:32 < Bushmills> without, you protect the subnet. sounds about the same effort.
16:32 < hyper_ch> but how do you do that?
16:33 < Bushmills> blocking incoming SYN packets for a start?
16:34 < hyper_ch> if I knew what those are
16:34 < Bushmills> run stuff through a proxy?
16:34 < Bushmills> SYN packets open a tcp connection
16:34 < hyper_ch> why get rid of nat when you proxy then everything?
16:34 < Bushmills> because it would answer your question?
16:34 < hyper_ch> hmmmm
16:35 < hyper_ch> well, I gotta get some sleep
16:35 < hyper_ch> had a hard day at work
16:35 < hyper_ch> I sent like 9k emails
16:35 < Bushmills> now you're blacklisted :)
16:35 < hyper_ch> no no
16:35 < hyper_ch> well, I didn't send them, the server sent them
16:35 < Bushmills> ok. then the server is blacklisted.
16:36 < hyper_ch> and I fixed my script parsing the published decisions
16:36 < hyper_ch> no, server's not blacklisted
16:36 < hyper_ch> it's all wanted
16:36 < hyper_ch> bye by
16:36 < hyper_ch> e
16:37 < Bushmills> 'night
16:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
16:38 < hyper_ch> I just hope ipv6 won't arrive here for the next 50-80 years
16:38 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
16:41 < crocket> Bushmills, Do you think push "dhcp-options DNS 10.xx.xx.1" would be good enough?
16:42 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
16:49 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 252 seconds]
16:53 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:58 -!- izibi [~julian@unaffiliated/izibi] has joined #openvpn
17:02 -!- marksaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 250 seconds]
17:06 < Bushmills> good enough for what?
17:08 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
17:10 <@vpnHelper> RSS Update - forum: need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html#p10447> || Configuring for dynamic client IPs <http://forums.openvpn.net/topic7771.html#p10446>
17:22 <@vpnHelper> RSS Update - forum: Virtual adapter for wireless <http://forums.openvpn.net/topic7777.html#p10448>
17:29 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
17:38 < crocket> Bushmills, I want to update DNS entries.
17:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:46 <@vpnHelper> RSS Update - forum: need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html#p10449>
17:57 < Bushmills> not good enough
18:00 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
18:00 -!- majuk [~majuk@cpe-70-112-3-105.austin.res.rr.com] has joined #openvpn
18:02 < majuk> Hey all. I have a client connecting via the service (delayed auto start). For whatever reason, the service ceased to connect, so I had an enduser start the openvpnGUI and connect. That worked. Then I was monkeying with it and disconnected the client before restarting the internal service. Now, on connect, the client complains about a self-signed cert.
18:02 < majuk> Rebooted, redeployed keys and .ovpn config, still nothing.
18:03 < majuk> VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /CN=ca.does.not.exists/C=US/ST=kansas/L=Manhattan/O=Meadowlark/OU=28b10e249ab00f6d/dnQualifier=certificateAuthority
18:05 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
18:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
18:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
18:09 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
18:14 -!- le0 [~le0@unaffiliated/le0] has quit [Client Quit]
18:15 < majuk> Bah, I think I got it. wtf, Win 7 locked the files for some reason. And it won't unlock them. Holy crap that's annoying.
18:19 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
18:21 < Bushmills> oops. sounds like fukushima getting critical now.
18:22 < majuk> Oh, no, I don't get it.
18:23 < majuk> It looks like it's not even reading the certificate in the config directory. I am totally confused.
18:23 < majuk> The cert has all my local info (ST=TX, L=Austin) and the info in the error is totally different.
18:23 < majuk> Help?
18:42 -!- APTX_ [APTX@phpBB/developer/APTX] has quit [Remote host closed the connection]
18:51 < majuk> Yea, reinstalled ovpn (twice), regenned my keys, it's still reporting the bogus certificate information. All suggestions welcome, I am totally lost and Google isn't telling me anything useful.
18:51 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
18:53 < Bushmills> i can't suggest anything but "try with *nix, and compare results"
18:54 < webmind> Bushmills, I'd say let it melt
18:55 < majuk> Bushmills, I have 9 other clients, all connected like gang busters using the same ca.crt and keys genned by the same CA
18:55 < majuk> Both Win 7 and *nix clients.
18:56 < majuk> It's like it's reading some cert somewhere that isn't in the config file. I mean, that CN is totally wrong as well as the location info.
18:56 < majuk> *config folder
18:56 < Bushmills> try absolute path instead
18:59 < colision> I got OpenVPN on OpenBSD 4.8, i can connect to server fine, i can ping the tun0 interface, but i cant ping the em0 interface with is the LAN interface. I have disabled all block rules on the firewall (openbsd pf) but didint worked. Any clue? I got it working on other places.
19:03 < WebDawg> Your server pushing some crazy route rules?
19:04 < colision> Well, the routes seens to be right... i think
19:04 < WebDawg> Does it work with other clients?
19:05 < colision> I got 3 other server running openbsd 4.6
19:05 < colision> this is my first 4.8 ever
19:06 < WebDawg> hmm
19:06 < WebDawg> Sorry.  Cant help.
19:07 < colision> i think is miss something on the NAT part on pf.conf. I just dont know what is
19:08 < WebDawg> Turn the firewall off.  See if it works.
19:11 < colision> i did set it to allow all. i cant turn it off or i will loose connection
19:11 -!- WebDawg is now known as NeoWeb
19:11 -!- NeoWeb is now known as WebDawg
19:13 < majuk> Bushmills, Nothing. Man. this is really getting to me.
19:15 < majuk> Got the same error with absolute path, gen'd _another_ key, reinstalled again, still get bogus CN/ST/L/O/OU info in the error log
19:16 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
19:16 < reiffert> moin
19:21 -!- _00111111 [~id@bl13-175-27.dsl.telepac.pt] has joined #openvpn
19:21 < _00111111> hello
19:21 < reiffert> 32+16+8+4+2+1=?
19:21 < _00111111> ?
19:21 < _00111111> !welcome
19:21 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:21 < _00111111> !goal
19:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:22 < _00111111> !howto
19:22 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:23 < majuk> And I don't even see a place in the forum to post questions. Off topic?
19:25 < _00111111> so I need to port forward UDP port 1194 in router
19:25 < dvl> hah!  bitches!  I just got my network drives in vista working remotely.  :P
19:26 < _00111111> winblowz
19:27 < majuk> dvl, Don't brag too loudly, Windows will punish you.
19:27 -!- _00111111 [~id@bl13-175-27.dsl.telepac.pt] has quit []
19:42 < majuk> So when it first connects, where is it getting those CN/ST/L/O/OU information from? The ca.crt coming from the remote server or the ca.crt on the local host?
19:50 < celthunder> should be remote
19:50 < celthunder> but i could be wrong
19:56 < majuk> celthunder, I think you're right. So then I'm getting a response from the wrong CA.
19:56 < majuk> I guess.
19:56 < majuk> But I can SSH to the server my VPN server is on no problem.
19:56 < majuk> Could still be that they're routing that port for me somewhere it shouldn't be going.
19:59 < majuk> Nothing NetHack won't make better, I suppose.
20:01 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
20:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:09 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
20:22 -!- crocket [~crocket@183.107.21.20] has quit [Remote host closed the connection]
20:23 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
20:24 < crocket> How can I check the speed of VPN network?
20:24 < crocket> VPN network was much slower than I expected.
20:25 < celthunder> shouldn't slow down your network too much
20:25 < celthunder> theres not THAT much overhead
20:25 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
20:26 < webmind> celthunder, depending on your cpu
20:26 < webmind> especially on embedded devices without hardware crypto this can be noticable
20:28 < celthunder> i'm using it on my phone and running voip through it as well as on my netbook and desktop nothin too noticable for me
20:28 < celthunder> and i have terrible internet
20:29 < |Mike|> webmind: what's up mede #bbqér
20:31 < webmind> celthunder, I've had performance issues on linksys boxes
20:31 < webmind> hi |Mike| 
20:31 < |Mike|> ola.
20:32 < webmind> celthunder, the terrible internet might help your stats :)
20:32 < |Mike|> lastlog -word celthunder 
20:33 < crocket> Over sshfs, it's 9~10MB/s, but over OpenVPN and NFS, it's less than 73.5kB/s
20:33 < |Mike|> firewall.
20:33 < crocket> What is going on?
20:33 < crocket> huh?
20:33 < webmind> crappy NFS setup? :)
20:33 < webmind> try sshfs over openvpn
20:33 < crocket> firewall can block traffic but doesn't slow down.
20:34 < |Mike|> pf / ipfw can :)
20:34 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 255 seconds]
20:34 < crocket> |Mike|, It's iptables/netfilter.
20:35 < crocket> sshfs over OpenVPN is as slow as NFS over OpenVPN.
20:35 < crocket> sshfs is a winner.
20:35 < crocket> It's weird.
20:36 < crocket> is it related to signing certs with 2048bit RSA private keys?
20:36 < webmind> I doubt it
20:36 < webmind> I've got 4096bit RSA keys
20:37 < webmind> makes no real difference
20:37 < webmind> traffic over openvpn is comparable to ssh here
20:37 < crocket> all OpenVPN traffic is relayed through UDP 1194port.
20:37 < webmind> hmm
20:37 < webmind> try TCP
20:37 < webmind> maybe the firewall has state issues with udp?
20:38 < crocket> damn
20:38 < crocket> webmind, Is TCP better?
20:39 < crocket> I opened 1194 UDP port.
20:39 -!- BostX [~bost@p5B2F1848.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
20:40 < webmind> crocket, not particullary, but it if works better with tcp, it could be a udp issues
20:40 < webmind> tcp generally works better when crossing firewalls or overcoming NAT issues
20:40 < webmind> at the cost of a little network overhead
20:41 < crocket> webmind, I opened the port.
20:41 < crocket> wide open.
20:41 < webmind> also don't forget to check your dmesg and openvpn log :)
20:41 < webmind> (to check for oddities en instabilities)
20:42 < crocket> webmind, Does openvpn do some kidn of FORWARDING between loopback and ethernet interface?
20:42 < crocket> s/kidn/kind/
20:45 < |Mike|> !tcporudp?
20:45 < |Mike|> webmind: udp works faster than tcp imho.
20:45 < |Mike|> !test
20:45 <@vpnHelper> "test" is testing
20:45 < |Mike|> !tunortap
20:46 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
20:46 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
20:47 < crocket> Well.....
20:47 < crocket> After switching to tcp, the speed decreases from 9~10MB/s to 4~5MB/s.
20:47 < crocket> What the heck was going on?
20:48 < crocket> Is it because of the slowness of firewall?
20:48 < webmind> |Mike|, read what I just typed :)
20:49 < webmind> crocket, increases from 73.5kB/s to 4~5MB/s you mean?
20:49 < webmind> crocket, could  be state/nat issues on the firewall
20:49 < crocket> yeah
20:49 < webmind> udp over nat is kind of a hack
20:49 < webmind> well, nat is hack, but udp especially
20:50 < webmind> since it's stateless the firewall has to guess destinations
20:50 < webmind> s/is hack/is a hack/
20:50 < crocket> webmind, no
20:50 < webmind> what no?
20:51 < crocket> webmind, two machines have public IP addresses, and only one machine has a private IP.
20:51 < webmind> ah ok
20:51 < crocket> webmind, The slow connection was between machines with public IP addresses.
20:52 < webmind> than no nat issues
20:52 < webmind> hmm
20:52 < webmind> *then
20:52 < webmind> any packetloss between the connections?
20:52 < crocket> webmind, I think the speed can still rise.
20:52 < crocket> webmind, i don't know.
20:53 < crocket> How can I know there were losses?
20:53 < webmind> test it, try mtr
20:53 < webmind> network issuesa
20:53 < webmind> -a
20:54 < webmind> packetloss can have loads of issues
20:54 < webmind> any chance for traffic shapers in the middle btw?
20:55 < webmind> try doing udp transfer tests with netcat
20:55 < webmind> good, I've got 3~4 hours of sleep left, I'm off to bed
20:56 < crocket> hmm
20:56 < crocket> webmind, ??
20:56 < crocket> webmind, There must be several routers
20:56 < crocket> that I don't know of.
20:56 < webmind> ok
20:56 < webmind> well, try testing on multiple protocols (udp and tcp) and multiple ports on netcat
20:57 < webmind> on how the performance is
20:57 < crocket> I don't know how to use netcat yet.
20:57 < webmind> it's a simplee tool to through bytes over the network
20:57 < webmind> like cat, see the manual, it's quite trivial
20:58 < webmind> iptraf is nice for measuring traffic incase you wheren't using that yet
20:58 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
20:59 < webmind> dd can also be used, like with 'dd if=/dev/zero of=- bs=1024000 count=20 | netcat <hostname> <port>'
20:59 < webmind> would sent 20mb of nullbytes over de network to hostname on port
20:59 < crocket> Then I need a listener.
20:59 < webmind> nc -l -p 
20:59 < crocket> How can I specify the protocol?
20:59 < webmind> nc -l -p  <portnumber>
21:00 < webmind> nc defaults on udp, -u sets it to udp
21:00 < webmind> same for client
21:00 < webmind> see man netcat
21:00 < webmind> now I'm off
21:00 < crocket> defaults to udp and -u sets it to udp?
21:08 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 240 seconds]
21:10 -!- crest [~crest@p57917586.dip.t-dialin.net] has quit [Quit: crest]
21:13 <@vpnHelper> RSS Update - forum: Here is my own Auto Login script for OpenVPN <http://forums.openvpn.net/topic7779.html>
21:37 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
22:01 -!- common- [~common@p5DDA4B60.dip0.t-ipconnect.de] has joined #openvpn
22:02 -!- common [~common@p5DDA4B69.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
22:02 -!- common- is now known as common
22:09 -!- master_of_master [~master_of@p57B53F44.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
22:11 -!- master_of_master [~master_of@p57B53A2F.dip.t-dialin.net] has joined #openvpn
22:13 -!- EugeNappingK is now known as EugeneKay
22:38 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
22:38 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:43 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 250 seconds]
22:43 <@vpnHelper> RSS Update - forum: VPN Access Restrict & Not Restricting <http://forums.openvpn.net/topic7780.html>
22:50 < crocket> hey guys
23:02 < crocket> OpenVPN is slow through UDP port 1194
23:03 < crocket> "OpenVPN Is Too Slow? Time to Consider IPSEC" http://www.enterprisenetworkingplanet.com/netsecur/article.php/3844861/OpenVPN-Is-Too-Slow-Time-to-Consider-IPSEC.htm
23:03 <@vpnHelper> Title: OpenVPN Is Too Slow? Time to Consider IPSEC - www.enterprisenetworkingplanet.com (at www.enterprisenetworkingplanet.com)
23:08 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has joined #openvpn
23:25 -!- takamichi [~pri@46.11.13.117] has quit [Ping timeout: 250 seconds]
23:32 < hjohnson> ooh, spam
23:35 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
23:58 < crocket> spam?
23:59 < crocket> It's personal spam.
--- Day changed Tue Mar 15 2011
00:01 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Read error: Operation timed out]
00:01 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
00:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
00:40 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 255 seconds]
00:47 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
00:55 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 255 seconds]
00:59 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
01:01 -!- UnterPerro [~UnterPerr@c-174-61-24-39.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:01 <@vpnHelper> RSS Update - forum: Increasing number of config <http://forums.openvpn.net/topic7781.html>
01:03 -!- twister004_ [~chatzilla@117.207.242.195] has joined #openvpn
01:04 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 250 seconds]
01:04 -!- twister004_ is now known as twister004
01:10 < hyper_ch> this sounds sweet  http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c029772125594e31eb1a5ad9e0913724ed9891f2
01:10 <@vpnHelper> Title: git.kernel.org - linux/kernel/git/torvalds/linux-2.6.git/commitdiff (at git.kernel.org)
01:11 < crocket> I tried to use a port, but a UDP port appears to be open|filtered.
01:12 < crocket> Does it always appear like that?
01:13 -!- twister004_ [~chatzilla@mail2.polariswireless.com] has joined #openvpn
01:13 -!- twister004 [~chatzilla@117.207.242.195] has quit [Ping timeout: 252 seconds]
01:14 -!- twister004_ is now known as twister004
01:43 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has joined #openvpn
01:44 < crocket> I keep seeing "TLS key negotiation failed" while connecting to the server with TLS encryption.
01:44 < crocket> It used to work a while ago, but without changing the certificates, this issue started to exist.
01:45 < crocket> I'm likely to know the reason.
01:45 < crocket> The institution probably blocks or fiddles with the port I use for OpenVPN.
01:51 < webmind> crocket, sorry I meant defaults to tcp
01:51 < webmind> as you might have noticed, it was late/early on this side
01:51 < webmind> crocket, interesting ports to use then are 53 and/or 443
01:53 < crocket> webmind, I can't access behind another node's private network.
01:54 < webmind> crocket, excuse me?
01:55 < crocket> I have an openvpn server.
01:55 < webmind> yes
01:55 -!- mirco [~mirco@p5DD342F4.dip.t-dialin.net] has quit [Quit: mirco]
01:55 < crocket> and a client with a public IP.
01:55 < crocket> the other with a private IP.
01:55 < crocket> If I recall correctly, the client with the public IP address should be able to access the private network to which the other client belongs.
01:56 < crocket> But I can't add route.
01:56 < crocket> "ip route add 192.168.100.0/24 dev tun0 via 10.27.35.10" emits an error.
01:56 < crocket> Is it because client-to-client option is turned on?
01:58 < webmind> nope
01:58 < webmind> please specify the error
01:58 < webmind> and note that I'll be off in a matter of minutes :)
01:59 < crocket> Tue Mar 15 15:52:50 2011 ERROR: Linux route add command failed: external program exited with error status: 7
01:59 < crocket> >> ip route add 192.168.100.0/24 dev tun0 via 10.25.37.6
01:59 < crocket> RTNETLINK answers: No such process
02:00 < crocket> webmind, look
02:00 < crocket> It should have worked.
02:00 < crocket> However tun0(10.25.37.10) can only directly talk to 10.25.37.9
02:01 < crocket> inet addr:10.25.37.10  P-t-P:10.25.37.9  Mask:255.255.255.255
02:01 < webmind> the ip after via should be the tun address of the otherside of the link
02:04 < skyion> !welcome
02:04 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:06 < crocket> webmind, If I specify the other side of the link, "ip route" succeeds, but routing is not correct.
02:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:07 < crocket> webmind, For the routing to work, the target of via should be the IP address of the machine in the subnet A I want to connect to.
02:08 < hyper_ch> hi Bushmills
02:08 < crocket> If I set via to the other side of the link, all packets are lost.
02:10 -!- rk1Router [~rk@115.109.178.42] has joined #openvpn
02:11 < webmind> crocket, got ip forwarding turned on the other box?
02:11 < webmind> check if the packets arrive with tcpdump -ni tun0
02:11 < rk1Router> In openvpn, I am getting VERIFY ERROR: depth=1, error=certificate is not yet valid:
02:11 < crocket> webmind, the other box?
02:11 < webmind> other side of the link
02:11 < webmind> and I can recommend reading the openvpn howtos
02:11  * webmind is now off
02:18 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
02:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:18 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:20 -!- unspin [~unspin@S01060024a5b3e354.vn.shawcable.net] has joined #openvpn
02:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:21 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Operation timed out]
02:21 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
02:21 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
02:23 -!- rk1Router [~rk@115.109.178.42] has quit [Ping timeout: 255 seconds]
02:25 -!- aliverius [~george@athedsl-378314.home.otenet.gr] has joined #openvpn
02:26 < crocket> No!!!!
02:37 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 255 seconds]
02:42 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
02:49 -!- SOG [~SOG@183.11.156.52] has joined #openvpn
02:51 < crocket> How can I access subnets behind VPN clients?
02:53 < reiffert> !route
02:53 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
02:55 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
02:58 -!- colision_ [logos@189.81.116.147] has joined #openvpn
02:58 -!- colision [logos@189.81.116.147] has quit [Ping timeout: 240 seconds]
03:09 -!- BostX [~bost@p5B2F0FA2.dip0.t-ipconnect.de] has joined #openvpn
03:09 < crocket> reiffert, Thanks for the heads-up.
03:10 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:12 -!- mirco__ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:16 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
03:16 -!- mirco__ is now known as mirco
03:29 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:31 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:36 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
03:37 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has quit [Ping timeout: 252 seconds]
03:38 -!- BostX [~bost@p5B2F0FA2.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
03:40 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:44 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
03:50 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
03:50 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
03:52 -!- twister004 [~chatzilla@mail2.polariswireless.com] has quit [Ping timeout: 255 seconds]
03:52 -!- twister004_ is now known as twister004
03:53 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has joined #openvpn
03:59 -!- dazo_afk is now known as dazo
04:02 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Ping timeout: 260 seconds]
04:04 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
04:06 <@vpnHelper> RSS Update - forum: need to reduce keepalive / idle openvpn traffic <http://forums.openvpn.net/topic7775.html#p10454> || Increasing number of config <http://forums.openvpn.net/topic7781.html#p10453>
04:11 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has joined #openvpn
04:11 -!- tjz [~pc@bb219-74-220-242.singnet.com.sg] has quit [Changing host]
04:11 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:17 -!- unspin [~unspin@S01060024a5b3e354.vn.shawcable.net] has quit [Read error: Operation timed out]
04:18 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:32 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Operation timed out]
04:35 -!- Splex [~splex@unaffiliated/splex] has quit [Read error: Connection reset by peer]
04:35 <@vpnHelper> RSS Update - forum: TLS key negotiation failed on asymmetric routing <http://forums.openvpn.net/topic7782.html>
04:38 -!- unspin [~unspin@S01060024a5b3e354.vn.shawcable.net] has joined #openvpn
04:43 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 246 seconds]
04:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:57 -!- bauruine_ [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:58 -!- bauruine_ [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
04:58 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
05:01 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:01 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:04 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:04 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:15 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
05:21 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
05:40 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
05:43 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Remote host closed the connection]
05:45 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
05:48 -!- rk1Router [~rk@115.109.178.42] has joined #openvpn
06:01 -!- lupine_85 is now known as lupine_84
06:01 -!- lupine_84 is now known as lupine_85
06:05 -!- rk1Router [~rk@115.109.178.42] has quit [Ping timeout: 240 seconds]
06:12 <@vpnHelper> RSS Update - forum: TLS key negotiation failed on asymmetric routing <http://forums.openvpn.net/topic7782.html#p10457> || VPN Access Restrict & Not Restricting <http://forums.openvpn.net/topic7780.html#p10456>
06:16 -!- rk1Router [~rk@115.109.178.42] has joined #openvpn
06:21 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 255 seconds]
06:24 -!- rk1Router [~rk@115.109.178.42] has quit [Ping timeout: 246 seconds]
06:27 -!- SOG [~SOG@183.11.156.52] has quit [Read error: Connection reset by peer]
06:28 -!- SOG [~SOG@183.11.156.52] has joined #openvpn
06:31 -!- SOG [~SOG@183.11.156.52] has quit [Client Quit]
06:34 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
06:34 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
06:34 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
06:35 -!- rk1Router [~rk@115.109.178.42] has joined #openvpn
06:35 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Remote host closed the connection]
06:41 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
06:42 <@vpnHelper> RSS Update - forum: TLS key negotiation failed on asymmetric routing <http://forums.openvpn.net/topic7782.html#p10458>
06:48 <@vpnHelper> RSS Update - forum: Here is my own Auto Login script for OpenVPN <http://forums.openvpn.net/topic7779.html#p10459>
06:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
06:54 <@vpnHelper> RSS Update - forum: Increasing number of config <http://forums.openvpn.net/topic7781.html#p10460>
07:06 -!- EugeneKay is now known as EugeneKaway
07:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:17 -!- rk1Router [~rk@115.109.178.42] has quit [Quit: Leaving]
07:28 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Read error: Operation timed out]
07:41 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
07:52 -!- rinkadink [~o2@unaffiliated/spice] has joined #openvpn
07:55 < rinkadink> hey guys, i have an issue
07:56 < rinkadink> i have a link setup with my gateway machine. it uses static keys over udp
07:56 < rinkadink> just now i noticed my browser, opera, sending ssdp packets over plaintext
07:56 < rinkadink> over the wlan0 link.
07:57 < rinkadink> everything else is usually udp but now this ssdp goes through without encryption
07:57 < rinkadink> destination is a bogus address (239.255.255.250)
07:57 < rinkadink> but i dont know, should i be worried?
07:58 < rinkadink> i'll continue monitoring the wlan0 link for unecrypted packets
07:59 < rinkadink> ah, i see the opera setting responsible for sending these packets:
07:59 < rinkadink> "discover local opera unite users" was ticked. i unchecked it
07:59 < rinkadink> i thought this udp static link i had setup was acting as a sort of firewall against snoopers
08:00 < rinkadink> anyone can read all these packets and the vpn link is the only thing keeping them from being sent in cleartext
08:00 <@vpnHelper> RSS Update - forum: VPN Access Restrict & Not Restricting <http://forums.openvpn.net/topic7780.html#p10461>
08:01 -!- EugeneKaway is now known as EugeneKay
08:22 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
08:24 -!- zxd_ [~zxd@95.211.21.37] has quit [Read error: Connection reset by peer]
08:24 -!- zxd_ [~zxd@95.211.21.37] has joined #openvpn
08:27 < Bushmills> rinkadink: your client's routing will still have precedence
08:29 < Bushmills> you can block packets going to any other location than openvpn server, or sent through vpn. provided rest has been set up accordingly.
08:33 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
08:33 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
08:34 -!- zxd_ [~zxd@95.211.21.37] has quit [Read error: Connection reset by peer]
08:34 -!- zxd_ [~zxd@95.211.21.37] has joined #openvpn
08:44 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 255 seconds]
08:47 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
08:47 < crocket> OpenVPN is much faster with TCP over the internet.
08:48 < Rienzilla> unless your link is unreliable
08:49 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has joined #openvpn
08:49 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has quit [Changing host]
08:49 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
08:51 < crocket> Rienzilla, I don't know the reliability of the link.
08:51 < crocket> Rienzilla, I'm in a residential building, and the other computer is in an institution.
08:51 < crocket> It may have been firewalls.
08:52 < crocket> Rienzilla, When I scan ports on the institution computer, UDP ports are revealed to be open/filtered.
08:52 -!- colision_ is now known as colision
08:53 < crocket> Is it open or filtered?
09:00 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
09:04 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:06 -!- p3rror [~mezgani@2001:0:53aa:64c:c5d:5508:d673:e742] has joined #openvpn
09:06 < majuk_> Mmmm, Eee Slate is purty.
09:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
09:09 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
09:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:11 <@vpnHelper> RSS Update - forum: improving speed at which windows client connect <http://forums.openvpn.net/topic7778.html#p10462>
09:19 -!- jwm [jwm@dev.dist.us] has quit [Read error: Operation timed out]
09:19 -!- jwm [jwm@dev.dist.us] has joined #openvpn
09:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
09:23 <@vpnHelper> RSS Update - forum: VPN Access Restrict & Not Restricting <http://forums.openvpn.net/topic7780.html#p10463>
09:24 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
09:24 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:25 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
09:25 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
09:25 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:27 -!- Guest68746 is now known as loompek
09:27 -!- JDLSpeedy-work [~Joe@66.0.152.82] has joined #openvpn
09:29 <@vpnHelper> RSS Update - forum: improving speed at which windows client connect <http://forums.openvpn.net/topic7778.html#p10464>
09:30 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Remote host closed the connection]
09:36 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
09:58 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Read error: Operation timed out]
10:02 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
10:05 <@vpnHelper> RSS Update - forum: OpenVPN as client to Citrix Access Gateway <http://forums.openvpn.net/topic7776.html#p10465>
10:07 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
10:08 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 255 seconds]
10:10 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
10:10 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Remote host closed the connection]
10:17 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
10:22 < aliverius> could you suggest a gui for me? Qt is prefered but anything else is good too
10:24 -!- nebular [cef8aade@gateway/web/freenode/ip.206.248.170.222] has joined #openvpn
10:24 < nebular> !welcome
10:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:25 < aliverius> !interface
10:25 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
10:25 < aliverius> !howto
10:25 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:27 < aliverius> hmm this is all for the cli it seems. i have been bothering with ipsec for 4 days (all day) and i need to at least ping the gateway to feel ok.....
10:28 < nebular> !goal
10:28 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:29 < nebular> ok perhaps this isn't exactly the place for help with this as my vpn server is fine however my client no longer sets the default gateway when run. I'm using network manager on Linux Mint 10. Clients on windows and android work fine.
10:30 < aliverius> i need a secure connection between a roadwarrior and a gateway, to access the lan behind the gateway
10:30 < aliverius> network manager is what i have been adviced about in the past. in fact i am using it for my other connections too
10:31 < aliverius> BUT... even thoguh i create a new connection, i cant seem to use it
10:31 < aliverius> it appears nowhere...
10:36 -!- nebular [cef8aade@gateway/web/freenode/ip.206.248.170.222] has quit [Ping timeout: 252 seconds]
10:37 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has quit [Ping timeout: 240 seconds]
10:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:41 < Bushmills> aliverius: openvpn, plus ...
10:41 < Bushmills> !route
10:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:42 < Bushmills> about network manager, people here advise ...
10:42 < Bushmills> !ubuntu
10:42 <@vpnHelper> "ubuntu" is dont use network manager!
10:46 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
10:47 < aliverius> i am not on ubuntu
10:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:57 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:57 <@vpnHelper> RSS Update - forum: Issues with remote connectivity on OpenVPN (Ubuntu). Help! <http://forums.openvpn.net/topic7755.html#p10466>
11:08 < gladiatr> Use it if you want.  It's a very finicky piece of software depending on what version the installed gnome distro uses.  If it works, great.  If not, it's a real pain to debug why.
11:08 -!- Gandelf [~bp@unaffiliated/blackpenguin] has joined #openvpn
11:08 < gladiatr> (Network manager, that is)
11:08 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 248 seconds]
11:10 -!- Gandelf is now known as blackpenguin
11:14 -!- crocket [~crocket@183.107.21.138] has joined #openvpn
11:15 -!- crocket [~crocket@183.107.21.138] has quit [Quit: Leaving]
11:21 <@vpnHelper> RSS Update - forum: Trying to get local traffic to go to local router <http://forums.openvpn.net/topic7783.html>
11:24 < Bushmills> "Linux Mint 10"  - mint is an ubuntu dericate, afaik
11:24 < Bushmills> derivate
11:33 <@vpnHelper> RSS Update - forum: Stunnel vs OpenVPN (OpenVPN MAX concurrent sessions) <http://forums.openvpn.net/topic7784.html>
11:43 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
11:45 < rinkadink> < Bushmills> you can block packets going to any other location than openvpn server, or sent through vpn. provided rest has been set up accordingly.
11:46 < rinkadink> iptables or is there something else
11:46 < rinkadink> something more suited for this
11:46 < Bushmills> for linux 2.4+, it is iptables
11:46 < Bushmills> which is very suited for this
11:46 < Bushmills> 2.2 you have ipchains.
11:47 < Bushmills> for 2.4, there's also an ipchains compatibility module, part of iptables
11:47 < Bushmills> and 2.0, there's fwadmin
11:47 < Bushmills> or fwadm
11:49 < gladiatr> Bushmills, yeah.  Mint is Ubuntu + the not-necessarily-free bits
11:50 < gladiatr> for 1.x, you have the good will of the person that just rooted your box
11:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
11:53 -!- majuk_ [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 260 seconds]
11:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:04 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
12:10 -!- luneff [~yury@84.51.201.89] has joined #openvpn
12:17 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:20 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
12:20 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:23 -!- smerz [~smerz@smerz.demon.nl] has quit [Client Quit]
12:27 -!- tf1987_ is now known as tf1987_afk
12:33 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
12:35 -!- APTX_ [APTX@phpBB/developer/APTX] has joined #openvpn
12:35 -!- APTX [APTX@phpBB/developer/APTX] has quit [Ping timeout: 276 seconds]
12:42 <@dazo> Bushmills: that "don't use network manager" stuff is really related to Ubuntu only ... I'm using it on Fedora, and it works just perfect .... but Ubuntu somehow manages to criple Network Manager in strange ways so it won't work
12:43 < Bushmills> dazo, mint (used by alverius) is derived from ubuntu. 
12:43 <@dazo> but if it's a derivative of Ubuntu ... it might or might not be an issue ... depends if they use Ubuntu packages directly, or if the do something straight from source 
12:43 < Bushmills> fedora isn't. that's redhatty
12:43 <@dazo> yeah
12:43 <@dazo> would be really interesting to figure out why Ubuntu screws up NM
12:43 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:44 < Bushmills> i'm not a ubuntu user
12:44 < Bushmills> i suppose somebody who is is in a better position to figure that out. besides, i'm not even using network manager
12:45 <@dazo> :)
12:45 <@dazo> I didn't mean you should do it .... but if someone is willing to try to dig into it ... it would really be appreciated
12:45 < Bushmills> had it on the machine a while ago, but it always managed to configure my connection for the wrong connection
12:46 < Bushmills> so i call it  network mismanager
12:55 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
12:57 -!- tf1987_afk is now known as tf1987
12:58 < gladiatr> dazo, it seems to have stabilized  in the 10.x branch, but then I've encountered scenarios where a clean, generic ubuntu 10.04 installation doesn't work somewhat randomly
12:58 <@dazo> sounds like Ubuntu :)
13:00 -!- luneff [~yury@84.51.201.89] has joined #openvpn
13:25 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Read error: Connection reset by peer]
13:37 -!- dazo is now known as dazo_afk
13:44 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 260 seconds]
14:12 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
14:14 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
14:14 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
14:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:20 -!- BostX [~bost@p5B2F07A1.dip0.t-ipconnect.de] has joined #openvpn
14:25 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
14:25 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
14:32 -!- aliverius [~george@athedsl-378314.home.otenet.gr] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
14:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:35 -!- aliverius [~george@athedsl-377359.home.otenet.gr] has joined #openvpn
14:36 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has quit [Remote host closed the connection]
14:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:49 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:49 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
14:49 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
14:49 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:50 -!- gladiatr is now known as gladiatr_afk
14:52 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
15:09 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
15:11 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
15:11 -!- luneff [~yury@84.51.201.89] has joined #openvpn
15:13 -!- Guest68746 [~noname@noname.rula.net] has joined #openvpn
15:15 -!- loompek [~noname@kista.rula.net] has quit [Read error: Operation timed out]
15:15 -!- rinkadink is now known as roadsidebob
15:29 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:33 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
15:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:34 -!- MJD [~quassel@174.117.220.9] has quit [Ping timeout: 276 seconds]
15:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:03 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
16:03 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
16:05 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Read error: Connection reset by peer]
16:06 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:08 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 248 seconds]
16:40 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
16:40 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
16:40 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:58 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
17:06 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
17:26 -!- colision [logos@189.81.116.147] has quit []
17:28 -!- grzechu [~grzechu@nissanzone.pl] has joined #openvpn
17:28 < grzechu>  !welcome
17:29 < grzechu> !goal
17:29 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:32 < grzechu> Cant find solution for " Connection reset, restarting [-1]" errors when using openvpn and rdp, it shows just after i login via rdp and keeps restarting my vpn tunnel
17:32 -!- daemon [~daemon@serial.daemonrage.net] has quit [Ping timeout: 255 seconds]
17:34 -!- daemon [~daemon@serial.daemonrage.net] has joined #openvpn
17:35 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
17:39 -!- grzechu [~grzechu@nissanzone.pl] has quit [Quit: ")]
17:43 -!- aliverius [~george@athedsl-377359.home.otenet.gr] has quit [Ping timeout: 255 seconds]
18:14 -!- bitterman [~yury@84.51.201.89] has joined #openvpn
18:17 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 264 seconds]
18:17 -!- aliverius [~george@athedsl-377499.home.otenet.gr] has joined #openvpn
18:21 <@vpnHelper> RSS Update - forum: OpenVPN Server will not Start <http://forums.openvpn.net/topic7785.html>
18:27 <@vpnHelper> RSS Update - forum: OpenVPN Server will not Start <http://forums.openvpn.net/topic7785.html#p10470>
18:29 -!- mete [~metefr@84.200.12.194] has quit [Ping timeout: 240 seconds]
18:37 -!- kala_ [kala@uba.linux.ee] has quit [Ping timeout: 276 seconds]
18:37 -!- ldaguilar [~ldaguilar@186.176.7.194] has joined #openvpn
18:38 -!- kala_ [kala@uba.linux.ee] has joined #openvpn
18:38 -!- mete [~metefr@84.200.12.194] has joined #openvpn
18:39 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:50 -!- kala_ [kala@uba.linux.ee] has quit [Ping timeout: 248 seconds]
18:51 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
18:53 -!- bitterman [~yury@84.51.201.89] has quit [Quit: Leaving]
19:15 <@vpnHelper> RSS Update - forum: Trying to get local traffic to go to local router <http://forums.openvpn.net/topic7783.html#p10471>
19:31 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
19:34 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
19:41 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
20:06 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
20:09 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 250 seconds]
20:15 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
20:17 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 276 seconds]
20:30 -!- BostX [~bost@p5B2F07A1.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
20:39 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10472>
21:08 -!- unix_usr [~nvidican@host-216-118-213-14.msi-it.com] has joined #openvpn
21:09 < unix_usr> hey all - having some difficulty diagnosing openvpn server here... 
21:09 < unix_usr> seems to connect fine, but cannot ping client from server, nor server from client
21:09 < unix_usr> client resides behind NAT - using tcp
21:14 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 250 seconds]
21:27 <@vpnHelper> RSS Update - forum: How to create multi-server vpn <http://forums.openvpn.net/topic7748.html#p10473>
21:35 -!- UdontKnow [~evaldo@freenode/staff/udontknow] has quit [Changing host]
21:35 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
21:38 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
21:47 -!- luneff [~yury@84.51.201.89] has joined #openvpn
21:53 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
21:58 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 240 seconds]
21:58 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
22:01 -!- common- [~common@p5DDA4B94.dip0.t-ipconnect.de] has joined #openvpn
22:04 -!- common [~common@p5DDA4B60.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
22:04 -!- common- is now known as common
22:09 <@vpnHelper> RSS Update - forum: How to create multi-server vpn <http://forums.openvpn.net/topic7748.html#p10474>
22:10 -!- master_of_master [~master_of@p57B53A2F.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
22:12 -!- master_of_master [~master_of@p57B539BE.dip.t-dialin.net] has joined #openvpn
22:26 < krzee> unix_usr, why tcp?
22:27 < krzee> and post your logs from server and client with verb 4
22:29 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Remote host closed the connection]
22:30 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
22:39 <@vpnHelper> RSS Update - forum: How to create multi-server vpn <http://forums.openvpn.net/topic7748.html#p10475>
22:43 < unix_usr> krzee - UDP not seem to connect from client behind NAT
22:46 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:46 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:48 -!- twister004 [~chatzilla@59.90.34.167] has quit [Read error: Connection reset by peer]
22:48 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:50 < unix_usr> the client cannot use UDP it appears :( - seems to be firewalled 
22:54 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 255 seconds]
22:54 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
22:54 -!- twister004_ is now known as twister004
23:06 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 252 seconds]
23:09 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
23:10 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
23:12 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 255 seconds]
23:12 -!- twister004_ is now known as twister004
23:13 -!- unix_usr [~nvidican@host-216-118-213-14.msi-it.com] has quit [Quit: unix_usr]
23:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
23:46 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 250 seconds]
23:47 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
--- Day changed Wed Mar 16 2011
00:23 -!- olisman [3a983984@gateway/web/freenode/ip.58.152.57.132] has joined #openvpn
00:25 < olisman> key guys a quick question, I'm using Tunnelblixk to connect to my openVPN server. The connection status is "connected" but I can still see my old url... ANy ideas?
00:25 < olisman> Sorry I mean IP
00:25 < olisman> !welcome
00:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:26 < olisman> !goal
00:26 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:33 < olisman> I would like to change my ip, I'm using Tunnelblick and connect successfully but the IP is still the old
00:36 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
00:36 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
00:39 < krzee> !redirect
00:39 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
00:41 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 252 seconds]
00:42 < olisman> !redirect
00:42 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
00:49 < olisman> !def1
00:49 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
00:51 < olisman> !ipforward
00:51 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
00:51 < olisman> !osxipforward
00:51 <@vpnHelper> "osxipforward" is (#1) sysctl -w net.inet.ip.forwarding=1 for a temp solution, or (#2) add IPFORWARDING=-YES- in /etc/hostconfig for a permanent solution
00:52 < olisman> !nat
00:52 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
00:58 -!- roadsidebob [~o2@unaffiliated/spice] has quit [Remote host closed the connection]
00:58 -!- roadsidebob [~o2@unaffiliated/spice] has joined #openvpn
00:58 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has joined #openvpn
01:11 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Read error: Operation timed out]
01:16 -!- olisman [3a983984@gateway/web/freenode/ip.58.152.57.132] has quit [Ping timeout: 252 seconds]
01:17 -!- raw [~raw@chipotle118.server4you.de] has joined #openvpn
01:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 255 seconds]
01:19 -!- olisman [3a983984@gateway/web/freenode/ip.58.152.57.132] has joined #openvpn
01:19 < olisman> I configured the openvpn files by adding the google dns servers push "dhcp-option DNS 8.8.8.8" and push "dhcp-option DNS 8.8.4.4" but I still can't access any sites  
01:21 -!- Guest68746 is now known as loompek
01:35 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:52 -!- bagz [~bagz@83-212-32-211.uth.gr] has joined #openvpn
02:02 < krzee> but did you do the rest...
02:02 < krzee> server had ip forwarding enabled, is NATing the vpn subnet, and the clients are redirecting gateway...?
02:10 -!- bagz [~bagz@83-212-32-211.uth.gr] has quit [Quit: BitchX-1.1-final -- just do it.]
02:12 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:17 -!- olisman [3a983984@gateway/web/freenode/ip.58.152.57.132] has quit [Quit: Page closed]
02:28 <@vpnHelper> RSS Update - forum: OpenVPN Server will not Start <http://forums.openvpn.net/topic7785.html#p10476>
02:35 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
02:42 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
02:45 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:47 -!- dazo_afk is now known as dazo
02:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:59 -!- izibi [~julian@unaffiliated/izibi] has quit [Ping timeout: 240 seconds]
03:17 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:26 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:28 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
03:53 -!- roadside1ob [~o2@unaffiliated/spice] has joined #openvpn
03:56 -!- roadsidebob [~o2@unaffiliated/spice] has quit [Ping timeout: 250 seconds]
04:01 -!- unspin [~unspin@S01060024a5b3e354.vn.shawcable.net] has quit [Read error: Operation timed out]
04:14 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
04:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
04:17 -!- p3rror [~mezgani@2001:0:53aa:64c:c5d:5508:d673:e742] has quit [Ping timeout: 260 seconds]
04:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:31 -!- jmm_ [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
04:39 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 255 seconds]
04:41 -!- morbidwar [~ovidiu@82.78.207.254] has joined #openvpn
04:42 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 276 seconds]
04:42 -!- morbidwar [~ovidiu@82.78.207.254] has quit [Remote host closed the connection]
04:51 -!- star314 [~star314@xchg.fiss-oeaw.at] has joined #openvpn
04:52 -!- star314 [~star314@xchg.fiss-oeaw.at] has quit [Client Quit]
04:55 -!- unspin [~unspin@S01060024a5b3e354.vn.shawcable.net] has joined #openvpn
04:56 -!- spiekey [~mario@dslb-084-056-181-252.pools.arcor-ip.net] has joined #openvpn
04:56 < spiekey> Hello!
04:56 < spiekey> will a route that is beeing set with iroute show up with "route -n" on the vpn server?
04:56 < spiekey> or is this some iternal route?
04:58 <@vpnHelper> RSS Update - forum: Stunnel vs OpenVPN (OpenVPN MAX concurrent sessions) <http://forums.openvpn.net/topic7784.html#p10477>
04:59 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
05:00 -!- spiekey [~mario@dslb-084-056-181-252.pools.arcor-ip.net] has quit [Quit: Ex-Chat]
05:05 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
05:08 -!- albech [~thomas@110.164.248.17] has joined #openvpn
05:09 < G> potentially silly question, I currently have openvpn setup as 10.8.0.x 255.255.255.0 as a roadrunner type configuration, I have configuration options such as: 'push "redirect-gateway def1 bypass-dhcp"', now I have a client that I want to essentially have a static connection to the server I've added the following config: http://pastebin.com/Skn3qLky now all I want to know, is how do I disable the push options for this one connection?
05:11 < G> oh hang on, I might have it
05:15 < G> okay, forget the question, for some reason I missed 'push-reset' when doing 'man openvpn' but I didn't when reading the web version of the man page
05:17 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:17 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:21 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:21 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:25 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:25 -!- jmm_ [~jmm@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has left #openvpn []
05:33 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
05:36 < crocket> When I executed openvpn, tun kernel module wasn't loaded automatically.
05:36 < crocket> How can I have tun loaded automatically by openvpn?
05:40 < reiffert> start it as root.
05:40 < reiffert> compile your kernel with "load modules automatically when requested"
05:46 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:48 -!- takamichi [Takamichi@80.71.98.29] has quit [Read error: Connection reset by peer]
05:49 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
05:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
05:50 -!- stryg [~bwtermina@rob92-6-82-231-240-143.fbx.proxad.net] has joined #openvpn
05:51 < stryg> hi everybody
05:53 < stryg> I have a question about OpenVPN and sizing
05:54 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 250 seconds]
05:54 < stryg> Does sbdy know about the limits of OpenVPN clients connected on the same OpenVPN server ?
05:56 < stryg> 200 clients ? 400 ? 1000 ? 2000 ?
05:56 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
05:57 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
05:57 < krzee> many people have problems between 200-300
05:59 < crocket> reiffert, I don't know if that option is in "make menuconfig" at all.
06:01 < reiffert> crocket: but I do.
06:01 < crocket> reiffert, Where is it?
06:01 -!- dazo is now known as dazo_afk
06:02 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 252 seconds]
06:03 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
06:07 < crocket> reiffert, Where is the option in "make menuconfig"?
06:07 < reiffert> crocket: looks like things have changed since linux-2.2 nowadays. I'm sorry.
06:10 -!- dazo_afk is now known as dazo
06:10 < reiffert> hints from Documentation/networking/tuntap.txt
06:10 < reiffert>   Driver module autoloading
06:10 < reiffert>      Make sure that "Kernel module loader" - module auto-loading
06:10 < reiffert>      support is enabled in your kernel.  The kernel should load it on
06:10 < reiffert>      first access.
06:11 < crocket> What the hell?
06:15 < stryg> krzee: thank you for this answer. Do you know what is the limiting factor for 200-300 clients ? The connexion ? The server kernel not supporting as much connexion ?
06:23 < krzee> the single cpu core that the process runs on, and the monolithic nature of openvpn until version 3
06:24 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Quit: Leaving]
06:26 < stryg> krzee: ok so you mean that with a 8 cores with 32 Gb RAM, the openvpn server would support more clients ?
06:28 < krzee> it only runs on 1 core
06:28 < krzee> if you run 8 services, it runs on 8 cores
06:28 < krzee> but openvpn is single threaded, can only run on a single core
06:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
06:30 < stryg> krzee: okayy, I understand. So I can consider, until version 3, to have this unbreakable limit of 200 clients.
06:32 -!- dazo is now known as dazo_afk
06:51 < krzee> 200 you should be just fine
06:51 < krzee> note, you will get more power from a single core 3ghz than a 1000 core 1ghz, because in the end it would be 3ghz vs 1ghz   (currently)
07:03 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has quit [Quit: Leaving.]
07:03 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has joined #openvpn
07:05 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 250 seconds]
07:05 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
07:09 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has quit [Quit: Leaving.]
07:09 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has joined #openvpn
07:11 < ecrist> sup bitches?
07:15 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
07:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:25 -!- EmperorT1m [~EmperorTo@216.17.68.153] has joined #openvpn
07:26 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
07:26 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
07:27 -!- theflyingfool [~xbmc@207.204.237.1] has joined #openvpn
07:28 -!- katoen_ [482392@xs8.xs4all.nl] has joined #openvpn
07:28 -!- oc80 [oc80z@blea.ch] has joined #openvpn
07:29 -!- katoen [e1bdd889cd@xs8.xs4all.nl] has quit [Ping timeout: 240 seconds]
07:29 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 240 seconds]
07:29 -!- EmperorTom [~EmperorTo@216.17.68.153] has quit [Ping timeout: 240 seconds]
07:29 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
07:29 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Ping timeout: 240 seconds]
07:30 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has quit [Read error: Connection reset by peer]
07:33 < theflyingfool> !welcome
07:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:33 < theflyingfool> !route
07:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
07:35 < theflyingfool> !howto
07:35 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:45 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
07:45 < theflyingfool> !goal
07:45 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:47 < theflyingfool> i would like to connect to a vpn on boot, i can connect with openvpn --config ovpnxxx.conf, and start that as a daemon with --daemon at the end, if i add openvpn to my daemon array it does not connect
07:51 < theflyingfool> !sample
07:51 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
07:51 < stryg> krzee: Ok thank you very much for your help krze ! By the way, do you know some means provided by OpenVPN to do loadbalancing, to support more than 200 clients ?
07:52 -!- theflyingfool [~xbmc@207.204.237.1] has quit [Changing host]
07:52 -!- theflyingfool [~xbmc@unaffiliated/theflyingfool] has joined #openvpn
07:56 -!- theflyingfool [~xbmc@unaffiliated/theflyingfool] has quit [Remote host closed the connection]
07:56 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 264 seconds]
07:56 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
08:05 -!- janjust [~janjust@schrepel.nikhef.nl] has joined #openvpn
08:05 -!- janjust [~janjust@schrepel.nikhef.nl] has quit [Changing host]
08:05 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
08:06 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
08:10 -!- theflyingfool [~xbmc@unaffiliated/theflyingfool] has joined #openvpn
08:10 -!- janjust [~janjust@openvpn/community/support/janjust] has left #openvpn ["Leaving"]
08:11 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
08:14 -!- theflyingfool [~xbmc@unaffiliated/theflyingfool] has quit [Ping timeout: 255 seconds]
08:14 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
08:28 < stephan48> when i have options in my config, f.e. a default proxy, and then also specify the http proxy option on cmd line while loading config, which of these takes precendence(overwriting ther other setting)?
08:28 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 255 seconds]
08:31 < janjust> normally an option specified *after* the config file takes precedence
08:31 < janjust> some options can be specified multiple times, in which case the first occurrence "wins"
08:33 -!- gladiatr_afk is now known as gladiatr
08:39 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
08:41 < stephan48> k
08:41 < stephan48> mh
08:42 < stephan48> i thought to simply write a default setting which works in normal cases into config and then via script check if i have f.e. direct inet con and if not also set proxy option via cmdline
08:42 < janjust> you can also specify multiple remote locations, one with tcp, one with http-proxy etc ; openvpn 2.1 will then automatically try them in order
08:44 < stephan48> how you mean that?
08:44 < stephan48> f.e. like i could say different http_proxys and one without and it will be all tried?
08:44 < janjust> read up in the openvpn 2.1 manual page on connection blocks (or buy my book and read chapter 12 ;))
08:44 < stephan48> :)
08:44 < janjust> yep , there are some limitations but that would be the basic idea
08:45 < krzee> !book
08:45 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
08:45 < janjust> yo krzee! grin
08:48 < stephan48> cool
08:49 < pwrcycle> janjust: i have a routing question http://pastebin.com/VeCftp1N
08:49 < janjust> what you're asking also happens to be explained in the openvpn 2.1 manual page (http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html) under '<connection>'
08:49 < stephan48> what would be cool for that: named connection blocks, and then a setting which blocks should be tried automatically and a way to reference a block on openvpn start f.e. --con office-proxy or so
08:49 < stephan48> ye i just read ti :)
08:49 < pwrcycle> janjust: push "redirect-gateway def1" doesn't seem to be taking effect.
08:50 < janjust> pwrcycle, not suprising, as you're not using client/server mode
08:50 < janjust> only if the server is configured using 'server ....' will statements be pushed automatically. Try adding "pull" to the client config
08:51 < pwrcycle> janjust: hmm ok
08:51 < pwrcycle> my tunnel gets stablished, and i can ssh through it. but all local traffic still goes out the default gateway on the client
08:51 < pwrcycle> how do i fix it?
08:56 < gladiatr> !book
08:56 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
08:56 < gladiatr> sweet.  congratulations on your new publication, janjust 
08:58 < gladiatr> !redirect
08:58 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
09:00 < stephan48> !def1
09:00 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
09:02 -!- skyion [~brad@tcs-gw.bulwer.thusa.net] has left #openvpn []
09:03 < janjust> thx gladiatr 
09:03 < janjust> pwrcycle, just add "redirect-gateway def1" to the client config, see if that helps
09:14 < Bushmills> pwrcycle: windows client?
09:16  * Bushmills thinks he asked that before, a few days back, and never got a reply
09:30 < janjust> Bushmills, pastebin log shows ubuntu 10 desktop
09:31 < Bushmills> "doesn't seem to be taking effect." route -n  to check
09:46 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 255 seconds]
09:53 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Ping timeout: 240 seconds]
09:56 -!- genesis2011 [~rommel@amertospromotions.com] has joined #openvpn
09:56 < genesis2011> good day.
09:56 < genesis2011> can I ask assistance?
09:57 < genesis2011> I want to know how I can create a multiple server vpn. i tried creating different server.conf files with different server address but it will say Address already in use. 
09:59 < genesis2011> anybody?
10:00 -!- genesis2011 [~rommel@amertospromotions.com] has quit [Client Quit]
10:02 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
10:05 <@vpnHelper> RSS Update - forum: Connection lost when doing rsync over openvpn <http://forums.openvpn.net/topic7774.html#p10478>
10:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:10 < Bushmills> must be very urgent
10:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:15 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:16 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:19 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:19 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 255 seconds]
10:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:25 -!- EmperorT1m is now known as EmperorTom
10:30 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
10:38 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
10:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:47 <@vpnHelper> RSS Update - forum: encryption <http://forums.openvpn.net/topic7786.html>
11:01 < aliverius> http://pastebin.com/aGY8itjp can someone find what the problem is?
11:02 < aliverius> http://ix.io/1ym client conf
11:15 < Bushmills> oh, thanks, letting us guess your problem by looking for it
11:15  * Bushmills gives the challenge a pass
11:15 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
11:15 < aliverius> i dont know what to do.. is it my certs?
11:16 < aliverius> i dont know where to look at i mean
11:16 < aliverius> my config is rather simple
11:16 < aliverius> i didnt even include encryption
11:16 < aliverius> i just wanted to do that desired ping
11:18 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
11:21 -!- EugeneKay is now known as EugeneKaway
11:28 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Read error: Operation timed out]
11:33 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
11:35 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
11:36 < crocket> How can I make OpenVPN startup script push nameserver entries to /etc/resolv.conf?
11:42 < ecrist> cat "foobeans" > /etc/resolv.conf
11:46 < Essobi> lol
11:49 -!- izibi [~julian@unaffiliated/izibi] has joined #openvpn
11:55 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
12:04 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:09 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 264 seconds]
12:25 -!- EugeneKaway is now known as EugeneKay
12:31 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
12:31 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
12:32 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
12:32 -!- Guest68746 [~noname@kista.rula.net] has joined #openvpn
12:35 -!- stryg [~bwtermina@rob92-6-82-231-240-143.fbx.proxad.net] has quit [Quit: @+++]
12:35 -!- loompek [~noname@noname.rula.net] has quit [Ping timeout: 248 seconds]
12:50 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
12:50 -!- JDLSpeedy-work [~Joe@66.0.152.82] has quit [Quit: Leaving]
12:56 < KaiForce> I'm getting an error trying to run build-key - I end up with a blank CSR.  The error looks like:  19335:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:642:Expecting: CERTIFICATE REQUEST.  What should I look at to determine the cause of this?
13:05 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
13:05 < fahmad> hey can i run openvpn server without dh and ca ?
13:08 < dvl> fahmad: why do you want to?
13:09 < fahmad> well so that client can only auth using secret.key ...
13:09 < KaiForce> i think that can be done, but probably not very secure.
13:10 < fahmad> KaiForce: when i try it i get error that you must define dh 
13:12 < KaiForce> fahmad: sorry no experience doing that.  keys are easy to set up and seems to me to be more secure if done right.
13:13 < fahmad> yes
13:13 < fahmad> i know
13:15 < KaiForce> that being said, you know your needs better than I do... and I'm having a problem generating a user key right now and nobody seems to want to weigh in it.  I don't know if I'm having a simple issue or a difficult one - those are the ones I usually see ignored on IRC
13:17 < Essobi> KaiForce: Paste bin your verbose log, and config somewhere
13:20 < crocket> hoohoo
13:22 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Quit: I quit.]
13:22 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
13:28 < KaiForce> Essobi:  how to enable verbose log?  I use pre-built scripts to generate the keys on Leaf Bering 
13:29 -!- unspin [~unspin@S01060024a5b3e354.vn.shawcable.net] has quit [Ping timeout: 250 seconds]
13:34 < KaiForce> I'll try stepping through the script - thanks for the lead!
13:36 <@vpnHelper> RSS Update - forum: Encrypting traffic from my remote laptop at work <http://forums.openvpn.net/topic7787.html>
13:38 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Read error: Connection timed out]
13:40 < crocket> How can I add vpn clients to DNS record?
13:40 < crocket> client-connect sciprt doesn't receive clients' IP addresses.
13:41 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:42 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:44 < diphthong> i put the hostnames / ip addreses of the vpn clients ahead of time
13:44 < diphthong> into my dns server zone files ahead of time
13:46 < havoc> and now to setup openvpn for an office for of mac users
13:46 < havoc> this'll be fun :(
13:48 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has quit [Quit: leaving]
13:48 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
13:50 < havoc> is tunnelblick the client to use on OSX?
13:51 < Rienzilla> I think so
13:51 < havoc> hmm, it's at least referenced in the howto
13:51 < Rienzilla> I tried that a week or 2 ago
13:51 < Rienzilla> and it works
13:51 < KaiForce> havoc:  I just had a client setup with that not too long ago - it went well
13:52 < gladiatr> havoc, yes
13:52 < havoc> Rienzilla, KaiForce: thanks
13:52 < havoc> I have no macs, and I'm probably gonna have to walk these guys through setting up the client side remotely
13:52 -!- APTX_ [APTX@phpBB/developer/APTX] has quit [Ping timeout: 276 seconds]
13:53 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
13:53 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:53 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:54 < KaiForce> I had a tech on site and we figured it out as we went.  It wasn't too hard.
13:56 < Rienzilla> I did it over the phone. The mac was operated by a clueless user, and I had never touched osx :)
13:56 < Rienzilla> so, it's easy indeed :)
13:56 < KaiForce> heh
13:56 < KaiForce> ok, so I ran this:  openssl req -days 3650 -nodes -new -keyout boob.key -out boob.csr -config $KEY_CONFIG
13:56 < havoc> Rienzilla: that's what I'll be doing
13:57 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
13:57 < Assid> heya
13:57 < KaiForce> boob.key and boob.csr are completely blank.  No error messages.  Is there a way to get more verbose output?
13:57 < Assid> im trying to load openvpn in an openvz container.. however. my internet traffic isnt being routed correctly from the server
13:58 < Assid> i am able to see /ping the server
13:58 < havoc> Rienzilla: how did you have the configs structured?
13:58 < Assid> if i try to NAT it, it gives me an error
13:58 < KaiForce> $KEY_CONFIG points to the right place and that file hasn't changed since 2006.
13:58 < Rienzilla> I let them download a zip with the configs and certificates
13:58 < havoc> I usually have a config file tha raferences the keys/certs in a directory at the same level as the config
13:58 < Rienzilla> yeah, that too
13:58 < havoc> ok, so it should work like it works on win32 or *nix
13:59 < Rienzilla> pretty much, there was one exception
13:59 < havoc> ?
13:59 < Rienzilla> namely the location of the config file
13:59 < Rienzilla> It's somewhere in /Libraries or something like that
13:59 < Rienzilla> and there is a global one, and a per-user one
13:59 < Rienzilla> and it works if you put it in one, but not in the other
13:59 < Rienzilla> but I can't remember which one
13:59 < havoc> ok
14:00 < Rienzilla> http://www.snt.utwente.nl/handleidingen/1/18 <-- might help too
14:00 <@vpnHelper> Title: Studenten Net Twente :: handleidingen (at www.snt.utwente.nl)
14:00 < Rienzilla> although it's dutch
14:00 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
14:00 < Rienzilla> oh it's also available in english
14:00 < havoc> Rienzilla: I see that :)
14:00 < Rienzilla> click the flag top right
14:01 < Rienzilla> it's a walkthorugh for setting up tunnelblick to my old uni's VPN
14:01 < havoc> yup
14:01 < Rienzilla> replace the configs with your own and you're set
14:01 < havoc> cool, thankx
14:01 < Assid> anyone?
14:01 < Rienzilla> what error, config files?
14:02 < havoc> Rienzilla: but all they'll need is tunnelblick, not openvpn too, right?
14:04 < Rienzilla> it's in tunnelblick iirc
14:04 < havoc> ok, cool
14:05 < havoc> I had thought so, but wanted confirmation, thanks :)
14:05 < jpalmer> they'll need tunnelblick, configs, and client certificates.
14:07 < havoc> jpalmer: yeah, I've got it all, but a mac client is new to me
14:07 < jpalmer> no problem
14:07 < havoc> thanks though
14:08 < havoc> I've got a pretty large openvpn setup across 3 interconnected sites right now
14:08 < havoc> all sites listen on udp:1194 and tcp:443 with sharing of 443
14:09 < havoc> but macs are foreign to me still :)
14:09 < jpalmer> I have a pretty insane openvpn environment here as well
14:09 < jpalmer> sadly,  I do have several mac clients 
14:09 < havoc> all my sites have linux boxes as the edge devices, so it's a little easier
14:10 < hjohnson> jpalmer: hmm? tunnleblik works quite well
14:10  * jpalmer can't wait for multithreaded openvpn.  I'm hoping that as each server can take a higher number of clients..  I can remove about half of my openvpn servers.
14:10 < havoc> jpalmer: how many can it support now?
14:10 < jpalmer> hjohnson: yeah,  the tunnelblick portion of mac clients is easy.  it's all the other OSX stuff that becomes painful.
14:11 < hjohnson> hell, tunnelblick makes for easy configuration distribution.
14:11 < hjohnson> ahh
14:11 < jpalmer> havoc: depending on traffic,   an openvpn server instance can handle between 50-200 clients, before it falls over
14:11 < KaiForce> jpalmer:  can you run multiple openvpn servers on the same box?
14:11 < havoc> ok
14:11 < jpalmer> KaiForce: yes
14:12 < jpalmer> (I have in the neighborhood of 8k clients connected right now)
14:12 < havoc> jpalmer: but you can have multiple instances running, just bound to diff ifaces?
14:12 < KaiForce> holy.
14:12 < hjohnson> jpalmer: maybe it's because i've been running mixed OS X/linux environments for the past 13 years (or since whenever 10.0 was released) so it's not that big of a deal to me.
14:12 < havoc> and have client configs spec multiple servers?
14:12 < KaiForce> orders of magnitude :)
14:13 < havoc> I can figure out a mac, if I'm in front of it, it's telling a cluless graphic designer how to do it over the phone that's a problem
14:13 < KaiForce> I think the highest # of clients I have on a server is around 8, and rarely would more than 3 be connected simultaneously!
14:13 < havoc> especially when I'm guessing because I've never used one myself, and odn't have one in front of me
14:14 < jpalmer> KaiForce: I have a TON of openvpn servers,  all in a failover scenario..  using quagga to route between them..  the clients update a DNS entry when they connect..  so all clients have dynamically assigned VPN IP's (based on which server they landed on)  but static VPN hostnames.
14:14 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
14:14 < KaiForce> jpalmer:  is this environment managed easily?
14:15 < jpalmer> KaiForce: easier than the old environment,  yes.  the only "effort" these days,  is the rate at which we add new clients..  (and as a result,  the rate at which we have to add new servers to the quagga mesh.)
14:15 < KaiForce> and do you offload the encryption to specialized hardware?
14:15 < KaiForce> very cool
14:16 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:16 < jpalmer> no.   actually,   we use vps's in different parts of the world,  for redundancy.  (IE,  2 of our servers in japan are down right now..  killing a total of about 25 openvpn server instances)
14:16 < KaiForce> so you have a good idea how many users a processor core can support?
14:17 < KaiForce> or is something else the bottleneck?
14:18 -!- EugeneKay is now known as EugeneKaway
14:19 < jpalmer> KaiForce: the bottleneck as far as I know (I'm no openvpn developer) is that the current openvpn is single threaded.. so when you get a bunch of clients conencted at once,  sending a fair amount of data over the vpn..   you reach a bottleneck there. you'll see the throughput drop drastically, even if the pipe isn't close to maxed.
14:20 -!- gladiatr is now known as gladiatr_afk
14:20 < KaiForce> makes sense.  approximately how many users can you get before you see that happen?  What kind of processors?
14:21 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
14:21 < Assid> can someone help me please
14:21 < Assid> i am tyring to get openvpn working in an openvz container
14:21 < Assid> and i am not able to pass m connectionthrough the vpn gateway
14:21 < Assid> i am aable to connect etrc.. fine
14:24 < jpalmer> KaiForce: in our current scenario,   we get about 50-75 clients per instance.  but even that is painful when the clients go to perform their nightly backups.
14:25 < jpalmer> day to day,  we don't push much traffic.  it's the management, and backups that use the bandwidth..  and where we currently see pain.
14:25 -!- EugeneKaway is now known as EugeneKay
14:30 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
14:38 < roentgen> jpalmer: any hints/tutorial to make a dns entry for a vpn client? I didn't search so far but sounds interesting...
14:38 -!- Guest68746 is now known as loompek
14:39 < hjohnson> jpalmer: I get a bit of the same situation, except in terms of satellite airtime... I can spot when the backups roll out around the time zones I service. :P
14:39 < KaiForce> jpalmer:  thanks for the info.  good stuff.
14:39 < jpalmer> roentgen: I just have a generic DNS entry for the clients,   which points to several A records. I let the OS dns resolver libraries sort out which servers they are going to conenct to.
14:40 < jpalmer> I don't even remove "downed" servers.  openvpn will retry indefinately.  if it times out conencting to a downed server,  it'll connect to a new one shortly.
14:41 < roentgen> jpalmer: I meant for "the clients update a DNS entry when they connect". I understand smth different from it
14:41 < jpalmer> oh, yeah.  thats different.
14:41 < hjohnson> so you're basically using DNS as a load balancer, rather than a specifically designed load balancer.
14:41 < jpalmer> I'm simply using BIND with dynamic updates enabled.
14:42 < roentgen> jpalmer: and anything on the client side?
14:42 < jpalmer> hjohnson: in a sense,  yes. it's a nice side-effect of the current architecture.
14:42 < hjohnson> if it works. :)
14:42 < jpalmer> roentgen: no.  all server side.  when the client connects,  the server executes a script which does the DDNS update to our master BIND server.
14:43 < hjohnson> gah
14:43 -!- Assid [~assid@unaffiliated/assid] has quit [Ping timeout: 255 seconds]
14:43 < roentgen> hmm... sounds good
14:43 < hjohnson> so I have a ship that's flipping between two networks... stupid me put the geographical boundary (where it is supposed to switch) in the wrong spot
14:43 < roentgen> jpalmer: would you mind sharing the script... or the idea behind it?
14:43 < hjohnson> damned thing keeps flipping back and forth
14:43 < Bushmills> roentgen: bind?  let server, with --client-connect script, or client, with --up script, run nsupdate to add A records with their host name and ip address to a zone.  use --client-disconnect or --down to remove A records again. 
14:44 -!- dpetrek [~dpetrek@93-140-160-41.adsl.net.t-com.hr] has joined #openvpn
14:44 < dpetrek> hihos
14:44 -!- luneff [~yury@84.51.201.89] has joined #openvpn
14:45 < dpetrek> i have 2.2-rc installed on xp, it will be running as server
14:45 < roentgen> Bushmills: I guess I could do that if I put my mind to it :)
14:46 < dpetrek> here is my server config file
14:46 < dpetrek> http://pastebin.com/ZEyR1Z1Y
14:46 < Bushmills> "active" part of nsupdate could look like  http://scarydevilmonastery.net/snap/1300304723143677998d.png
14:46 < Bushmills> delete in --down or --client-disconnect.
14:46 < dpetrek> why do I receive unrecognized option or missing parameter(s): ifconfig-pool-persist ?
14:46 < hyper_ch> hi Bushmills
14:46 < hyper_ch> hi krzee
14:46 < Bushmills> hi hyper_ch
14:47 < dpetrek> my hair is falling off because of this problem
14:47 < roentgen> Bushmills: thanks for that. looks promising
14:48 < roentgen> dpetrek: you could've posted a config without comments in it :)
14:48 < dpetrek> :D
14:48 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 255 seconds]
14:49 < dpetrek> sorry
14:49 < roentgen> and btw what is the error?
14:49 < dpetrek> i dont understand this really
14:49 < Bushmills> roentgen: low TTL for A records
14:49 < dpetrek> roentgen: asking whom?
14:49 < roentgen> dpetrek: you ;)
14:49 < dpetrek> :D
14:50 < roentgen> Bushmills: I don't really need that... I just like the name vs ip 
14:50 < dpetrek> when i start the server or "connect" in openvpn gui, it says unrecognized option or missing parameters: ifocnfig-pool-persist
14:51 < Bushmills> you want low TTL, to prevent records cached on resolving name servers after vpn clients have already disconnected 
14:51 < roentgen> dpetrek: uncomment #server 10.8.0.0 255.255.255.0
14:51 < roentgen> and really don't use tap unless you know you need it
14:51 < dpetrek> i need tap
14:52 < roentgen> you knowing little about openvpn I doubt that ;)
14:52 < Bushmills> !tunortap
14:52 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:52 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
14:53 < dpetrek> i need tap :D
14:53 < dpetrek> i need broadcasts
14:54 < dpetrek> i i need true 2 layer osi network
14:54 < roentgen> dpetrek: I'm convinced now ;)
14:54 < dpetrek> when i uncommented server 10.8.0.0 255.255.255.0
14:54 < dpetrek> now theres a new error yeej
14:54 < roentgen> new error more fun
14:55 < dpetrek> unrecognised option or missing parameter(s) in server.ovpn
14:55 < dpetrek> :server
14:55 < dpetrek> now it does not recognise command "server"
14:55 < Bushmills> really ":server"?
14:55 < roentgen> post a clean config and I'll help further
14:55 < dpetrek> ok
14:57 < roentgen> dpetrek: and now I see you want something bridge related. You sure about that too?
14:58 < dpetrek> http://pastebin.com/vp6ExaBX
14:59 < dpetrek> yup i need bridge and tap
14:59 < dpetrek> again same error
14:59 < dpetrek> unrecognised option or missing parameters ... ifconfig-pool-persist
14:59 < roentgen> dpetrek: sorry then... I know little about openvpn bridge
15:00 < dpetrek> i dont unerstand this
15:00 < dpetrek> i followed openvpn help in every possible way
15:02 < dpetrek> and i commecnt ifconfig-pool-persist then i get the same error on server-bridge
15:05 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
15:06 < roentgen> dpetrek: uncomment dev-node if you don't need it and ... have you created the bridge?
15:06 < dpetrek> yup bridge created
15:06 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
15:06 < dpetrek> i'll comment dev-node
15:10 < jpalmer> roentgen: there is already a script out ther efor the server side to do DDNS updates using nsupdate.   google for ipp.txt IIRC.    openvpn ipp.txt
15:12 < dpetrek> error on server-bridge again
15:12 < dpetrek> http://pastebin.com/9Q710Dqg
15:12 < dpetrek> this sucks alot
15:12 < dpetrek> maybe i should use older version
15:14 < roentgen> from the man: server-bridge expand as mode server and tls-server
15:14 < roentgen> so uncomment tls-server for a start :)
15:16 < dpetrek> done
15:16 < dpetrek> again server-brdige thingy
15:16 < dpetrek> i'm gonna vommit from this :D
15:18 < roentgen> do a verb 5 and paste the log content somewhere
15:24 -!- BostX [~bost@p5B2F05EA.dip0.t-ipconnect.de] has joined #openvpn
15:24 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
15:25 -!- luneff [~yury@84.51.201.89] has joined #openvpn
15:34 < dpetrek> works with 2.1.4
15:34 < dpetrek> i'm gonna kill someone
15:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
15:58 < aliverius> aes- cbc, cfb or ofb?
16:06 < aliverius> i will choose cbc, sounds normal
16:09 < aliverius> if i understood well i can use tap instead of tun, and grab an ip address from the remote lan and be like a peer of that lan?
16:09 < aliverius> indistinguishable with dhcp from that lan?
16:11 < hjohnson> yes, but that's not a very efficient way of going about it
16:12 < aliverius> tun is faster for basic services?
16:12 < hjohnson> less overhead, yeah
16:12 < aliverius> like iptv?
16:12 < aliverius> voip and such?
16:13 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
16:16 -!- dpetrek [~dpetrek@93-140-160-41.adsl.net.t-com.hr] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.2 Shiny http://www.kvirc.net]
16:18 < aliverius> ok
16:37 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
16:38 -!- luneff [~yury@84.51.201.89] has joined #openvpn
16:40 -!- bitterman [~yury@84.51.201.89] has joined #openvpn
16:42 -!- izibi [~julian@unaffiliated/izibi] has quit [Ping timeout: 260 seconds]
16:44 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 255 seconds]
16:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
16:55 -!- darth_bitterman [~yury@84.51.201.89] has joined #openvpn
16:55 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
16:57 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html>
16:58 -!- bitterman [~yury@84.51.201.89] has quit [Ping timeout: 255 seconds]
17:15 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
17:15 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
17:16 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Read error: Operation timed out]
17:19 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
17:22 -!- mirco [~mirco@pD9E57ED0.dip.t-dialin.net] has joined #openvpn
17:29 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
17:32 -!- darth_bitterman [~yury@84.51.201.89] has quit [Quit: Leaving]
17:36 -!- luneff [~yury@84.51.201.89] has joined #openvpn
17:39 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html>
17:39 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Quit: Leaving]
17:41 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:53 -!- stephan48 [stephan@opennic/stephan] has quit [Quit: Lost terminal]
17:59 < majuk> Hey guys. I need some schoolin
18:00 < majuk> Once a VPN connection is established (tunnel over UDP), how are subsequent packets addressed?
18:00 < majuk> Are they also sent as UDP on the VPN port or....?
18:02 < majuk> I ask because my perpetual problem client can now connect to the VPN, but cannot contact anything on the VPN. I'm trying to get some ideas for the network admin on site to look for as we're both scratching our heads at this one.
18:04 < reiffert> guess the route didnt get set because permissions werent high enough
18:04 -!- aliverius [~george@athedsl-377499.home.otenet.gr] has quit [Ping timeout: 260 seconds]
18:05 < reiffert> majuk: openvpn sends packets from openvpn to openvpn, on udp/1194 for your case.
18:05 -!- aliverius [~george@athedsl-375084.home.otenet.gr] has joined #openvpn
18:05 < reiffert> majuk: it encapsulates data.
18:05 < reiffert> This data will be layer 2 packets when used in tap mode or
18:05 < reiffert> layer 3 packets (pure routing applies) when using tun mode
18:06 < majuk> Ok, so the next hop would see the layer 3 address assigned to the VPN?
18:06 < majuk> reiffert, ^^
18:07 < reiffert> the client will have an *interface* and it's next hop will be the interface on the openvpn server
18:07 < reiffert> if not otherwise configured.
18:08 < reiffert> the interfaces are named tun0, tun1, tun2 and so on for tun mode
18:08 < reiffert> and tap0,... for tap mode
18:08 < majuk> Hmmm... oooook, think I'm getting it....
18:09 < reiffert> I guess that the client didnt set the host route correctly
18:09 < reiffert> host route towards openvpn server tun interface
18:09 < reiffert> tun mode = point to point
18:10 < majuk> If this tells you anything, I see it connect to the server, then it gets a ping timeout 2-4 minutes later.
18:11 < reiffert> the config files would help.
18:11 < reiffert> the routing table
18:11 < reiffert> interface information
18:12 < reiffert> before connecting to the server and after connecting
18:12 < reiffert> !configs
18:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
18:12 < reiffert> !all
18:12 <@vpnHelper> "all" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#' client.conf`), also include which OS and version of openvpn, include your routing tables, firewall settings and client/server logfiles, or (#2) For more detailed instructions, look to: !logs !configs !interface
18:12 < majuk> Eh, the network admin just changed his setup on me again so I can't even get an initial connection.
18:12 < majuk> *sigh*
18:13 < reiffert> who is who, you are the openvpn server admin?
18:13 < majuk> Yes.
18:13 < majuk> And my ovpn client is sitting on his network
18:13 < majuk> Cold and alone
18:13 < reiffert> ah.
18:14 < reiffert> does your client auto-re-connect?
18:14 < majuk> Yes
18:14 < reiffert> can you get access to the host running the openvpn client?
18:14 < majuk> Yes.
18:14 < reiffert> logon.
18:14 < majuk> Already there
18:14 < reiffert> do as the bot tells you:
18:14 < reiffert> !all
18:14 <@vpnHelper> "all" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#' client.conf`), also include which OS and version of openvpn, include your routing tables, firewall settings and client/server logfiles, or (#2) For more detailed instructions, look to: !logs !configs !interface
18:15 < reiffert> logs of the client and client config will be a good starting point
18:15 < reiffert> where as interface and routing table stuff might be necesseray soon.
18:18 < majuk> Yea, no worries. I know my configs are correct, I have 15 other clients working like gangbusters on it.
18:19 < majuk> It's some routing voodoo his network is preforming that's killing the connect.
18:19 < majuk> He has an Untangle box and a firewall between us and isn't overly familiar with the config of either.
18:19 < reiffert> well then please show me the clients routing table before and after connecting.
18:20 < majuk> I can't connect now.
18:20 < majuk> He closed the port or something.
18:20 < majuk> Wiiish I could. :\
18:20 < reiffert> choose another one then lie udp/53 or tcp/443
18:20 < reiffert> s,lie,eg,
18:20 < majuk> Would I not have to reset my server's listening port?
18:21 < reiffert> you could start a 2ndary openvpn server on your side
18:21 < majuk> Yea, that's what I'm working on.
18:21 < reiffert> change the "--server" line and "--port" line, done.
18:23 < aliverius> i have a strange problem here
18:23 < aliverius> i managed to connect to my remote lan
18:24 < aliverius> i ping, ssh, access services
18:24 < aliverius> but only in real pcs
18:24 < aliverius> there are two routers, one is the wireless
18:24 < aliverius> the other is for some other jobs
18:24 < aliverius> those two dont even ping
18:25 < aliverius> i can access 3 computers but  not those two routers
18:25 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Quit: Ex-Chat]
18:25 < reiffert> aliverius: see here:
18:25 < reiffert> !route
18:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:26 < reiffert> aliverius: it gives you a basic idea of routing and that you will need a route for one direction and have a route back.
18:26 < aliverius> they all belong to one lan
18:26 < reiffert> aliverius: my wild guess is, that your two routers miss the route back.
18:26 < aliverius> i am talking abou;t the lan part of the routers
18:26 < aliverius> like their config webpsges
18:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:26 < aliverius> but i will read what you gave me
18:27 < aliverius> still it is strange
18:27 < aliverius> for example
18:27 < aliverius> i ssh in a server
18:27 < aliverius> the server pings them fine!
18:27 < aliverius> the rou;rs, not the networks beyond them
18:27 < aliverius> sorry about the typos it is too late here
18:28 < reiffert> sorry about repeating without reading what I gave you?
18:28 < aliverius> <aliverius> but i will read what you gave me
18:28 < aliverius> anyway, thanks abou;that, i will read it tomorrow
18:28 < aliverius> goodnight
18:29 < reiffert> no you wont. you are one of those guys repeating the questions as long as someone reads the link for you.
18:29 < aliverius> come on
18:29 < reiffert> :)
18:29 < reiffert> kidding.
18:29 < aliverius> ok  :))
18:29 < reiffert> your first repeation made me think so.
18:30 < aliverius> i repeated because it seems SO strange
18:30 < aliverius> they should act like regular computers
18:30 < aliverius> 3rd repeat!!!!
18:30 < reiffert> they act like routers.
18:30 < reiffert> guess thats because they carry that name.
18:30 < reiffert> ah na, do it vice versa.
18:30 < aliverius> routers are routers when they route
18:31 < aliverius> when they serve a webpage they are ordinary servers
18:31 < reiffert> so ask yourself what openvpn will do.
18:31 < aliverius> connect to the interface?
18:31 < aliverius> anyway i wont bother you more
18:31 < aliverius> maybe tomorrow after i will have made my study :p
18:32 < reiffert> "maybe" :)
18:32 < aliverius> the key word ;)
18:33 < aliverius> thanks and bb
18:33 < reiffert> for me the keyword is "tomorrow", as I'm afk for tomorrow :)
18:33 < aliverius> hahaha ok
18:34 < majuk> Wow, I really don't seem to remember how to set up a CA.
18:34 < majuk> Getting self-signed cert error
18:34 < majuk> On startup
18:34 < reiffert> majuk: for the 2nd openvpn server?
18:34 < majuk> I remember gen'ing another cert with a separate CA and cating it onto the VPN cert...
18:34 < majuk> Yea
18:35 < reiffert> majuk: just use the same certificates you were using for the 1st openvpn server.
18:35 < majuk> .....oh.
18:35 < majuk> Well ok then.
18:35 < majuk> DO IT THE EASY WAY
18:35 < majuk> :P
18:35 < reiffert> thats why you just need to change the "server" and "port" line.
18:36 < reiffert> duplicate the config file, name it "second.conf"
18:37 < reiffert> change server and port line, save, start the service, done.
18:38 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
18:44 < majuk> Route entry looks good
18:44 < majuk>  172.21.0.0      255.255.0.0       172.21.0.5       172.21.0.6     30
18:45 < majuk> I can show you the rest if you like, 2 seconds
18:45 < reiffert> !pb
18:45 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
18:45 < reiffert> connecting your 2ndary openvpn server does work?
18:45 < majuk> http://pastebin.com/avHmvLnG
18:46 < majuk> Well, it works as far as the connect. I need to test RDP and :80 connections to it as well
18:46 < reiffert> that routing table is before or after connecting openvpn?
18:46 < majuk> After
18:47 < majuk> Sorry, you needed both, I'm a little fried this late in the day.
18:47 < reiffert> so your topology is set to net30 and you are using push redirect-gateway def1, right?
18:49 < majuk> Negative
18:49 < majuk> http://pastebin.com/daihNK6W
18:49 < majuk> server conf^
18:50 < reiffert> intresting. I guess the routing table on the client is broken.
18:50 < reiffert> stop the openvpn connecting and paste the routing table and client conf please.
18:50 < majuk> Well this seems to be working 100%
18:50 < majuk> At least I'm able to ping the VPN server now
18:50 < majuk> And wasn't able to on 1194
18:50 < reiffert> ah?
18:50 < majuk> Yea
18:50 < reiffert> intresting.
18:51 < reiffert> should be no difference/
18:51 < majuk> I'm gonna gen myself a cert for this VPN and see if I can RDP and :80 to it
18:51 < reiffert> those lines are looking *strange* on http://pastebin.com/avHmvLnG
18:51 < reiffert> 6, 7, 8, 10, 16, 17, 18
18:52 < reiffert> And I *think* that your client is broken and doesnt loose routes when the openvpn interface goes down after a connection stops.
18:52 < reiffert> which I want to prove, but I need further information I was requesting earlier.
18:55 < majuk> http://pastebin.com/MSFpCdrr
18:55 < majuk> That's disconnected route
18:55 < reiffert> what operating system are we looking at?
18:55 < majuk> Win 7
18:55 < majuk> Pro
18:55 < majuk> x32
18:56 < reiffert> any virtual stuff?
18:56 < majuk> Negative. MySQL and an IIS server
18:56 < reiffert> please explain routing rule 6,7,8,9,10,11,12
18:57 < majuk> On the disco'd pastie?
18:57 < majuk> Or the connected one?
18:57 < reiffert> disco
18:58 < majuk> 6 and 7 are for the Wired and Wireless NICs' loopbacks
18:58 < majuk> 8-12 I have no idea. That 221 address is the network's gateway...
19:00 < majuk> No, sorry, 221 is my local address
19:07 <@vpnHelper> RSS Update - forum: No internet access when VPN connected <http://forums.openvpn.net/topic7688-15.html#p10483>
19:08 < majuk> reiffert, Yea dude, it's the way he's routing 1194. I am connected like gangbusters on the VPNserver running on 2388
19:08 < majuk> So, odd routes aside, there we go.
19:13 < majuk> Or there I go.
19:13 < majuk> Anyhow, thanks for taking some time man. You're a saint.
19:31 <@vpnHelper> RSS Update - forum: Unable to login after configuring Ethernet Bridging <http://forums.openvpn.net/topic7790.html>
19:32 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
19:32 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
19:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:40 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
19:41 -!- paranoidi [~paranoidi@av41.adsl.tnnet.fi] has quit [Ping timeout: 260 seconds]
19:42 -!- paranoidi [~paranoidi@62-248-207-5.elisa-laajakaista.fi] has joined #openvpn
19:45 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Client Quit]
19:45 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
19:49 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 255 seconds]
19:50 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
19:57 <@vpnHelper> RSS Update - forum: Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html>
20:19 -!- mirco [~mirco@pD9E57ED0.dip.t-dialin.net] has quit [Quit: mirco]
20:24 -!- mirco [~mirco@pD9E57ED0.dip.t-dialin.net] has joined #openvpn
20:36 -!- mirco [~mirco@pD9E57ED0.dip.t-dialin.net] has quit [Quit: mirco]
20:39 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
20:42 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
20:49 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
20:53 -!- rolls` [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
20:54 -!- rolls [~rollin@190.120.228.48] has joined #openvpn
20:58 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10487> || VPN Access Restrict & Not Restricting <http://forums.openvpn.net/topic7780.html#p10486>
21:04 <@vpnHelper> RSS Update - forum: Encrypting traffic from my remote laptop at work <http://forums.openvpn.net/topic7787.html#p10488>
21:04 -!- BostX [~bost@p5B2F05EA.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
21:09 -!- JPeterso2 [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
21:09 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10489>
21:10 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
21:11 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
21:12 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
21:12 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Read error: Connection reset by peer]
21:12 -!- JPeterso2 is now known as JPeterson
21:12 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
21:12 < crocket> I was disconnected
21:18 < ecrist> it happens
21:19 < crocket> by tor
21:20 -!- peper [~peper@gentoo/developer/peper] has quit [Remote host closed the connection]
21:20 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
21:29 < ecrist> dvl: plane ticket for BSDCann in-hand. :D
21:30 < ecrist> when I send in my registration this year, I'll have a company name, but I'll make sure to mention OpenVPN, too. ;)
21:31 < ecrist> on another note, sup bitches?
21:48 -!- EugeneKay is now known as EugeneKaway
22:02 -!- common- [~common@p5DDA4B68.dip0.t-ipconnect.de] has joined #openvpn
22:03 -!- common [~common@p5DDA4B94.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
22:03 -!- common- is now known as common
22:10 <@vpnHelper> RSS Update - forum: Trying to get local traffic to go to local router <http://forums.openvpn.net/topic7783.html#p10491> || Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10490>
22:10 -!- master_of_master [~master_of@p57B539BE.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
22:12 -!- master_of_master [~master_of@p57B53833.dip.t-dialin.net] has joined #openvpn
22:22 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:32 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
22:40 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10493> || Trying to get local traffic to go to local router <http://forums.openvpn.net/topic7783.html#p10492>
22:50 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.4]
22:50 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
22:50 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
22:50 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
22:57 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- In tests, 0x09 out of 0x0A l33t h4x0rz prefer it :)]
22:58 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
23:05 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 240 seconds]
23:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
23:12 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has quit [Quit: leaving]
23:12 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
23:13 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
23:16 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:19 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
23:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:49 < krzee> !learn subscription as https://www.tunnelr.com has a slick interface and costs $7/mo , or https://www.openvpn.net/index.php/ for the pay software from openvpn technologies
23:49 <@vpnHelper> Joo got it.
--- Day changed Thu Mar 17 2011
00:10 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Quit: I quit.]
00:12 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
00:16 <@vpnHelper> RSS Update - forum: OpenVpn for android <http://forums.openvpn.net/topic7792.html>
00:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
00:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:16 -!- tf1987 [~tf1987@office.neteasyinc.com] has quit [Ping timeout: 255 seconds]
01:17 -!- tf87 [~tf1987@office.neteasyinc.com] has joined #openvpn
01:29 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 276 seconds]
01:50 -!- jhelwig [~jhelwig@puppetlabs/development/jhelwig] has quit [Ping timeout: 276 seconds]
01:51 -!- jhelwig [~jhelwig@puppetlabs/development/jhelwig] has joined #openvpn
01:55 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:45 < crocket> I added "route 192.168.100.0 255.255.255.0" and push "route 192.168.100.0 255.255.255.0" in openvpn.conf of the OpenVPN server and added "iroute 192.168.100.0 255.255.255.0" in ccd/elisa on the server.
02:46 < crocket> Since elisa was behind the 192.168.100.1 router, I had to apply source MASQUERADE to all traffic coming out of elisa's eth0.
02:46 < crocket> s/coming/going/
02:46 < crocket> I could access 192.168.100.0/24 network yesterday.
02:47 < crocket> But today I can't access it from the other nodes of OpenVPN.
02:47 < crocket> What's the hell?
02:47 < crocket> what the hell?
02:58 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
03:00 < krzee> you used the NAT hack>?
03:00 < krzee> just add 2 routes to the router instead
03:01 < krzee> read this:
03:01 < krzee> !route
03:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
03:01 < krzee> the 2 routes youd need instead of the nathack are:
03:01 < krzee> !route_outside_ovpn
03:01 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
03:02 < crocket> krzee, I don't have any previlege to the router.
03:02 < crocket> The router belongs to my landlord.
03:02 < krzee> how many machines on the lan need access to/from the vpn?
03:02 < crocket> 2
03:02 < crocket> The router and my machine.
03:02 < krzee> then see the section ROUTES TO ADD OUTSIDE OPENVPN as my bot said
03:03 < krzee> erm
03:03 < krzee> you just said the router...
03:03 < krzee> the router needs to communicate over the vpn, but you dont have access to it...?
03:03 < crocket> reverse source NAT takes care of the route.
03:03 < crocket> I don't have previlege
03:03 < crocket> I have access
03:03 < krzee> right, the NAT-hack
03:03 < crocket> The router has a web application which I can't manipulate but can view properties of.
03:04 < krzee> so you want access to that over the vpn?
03:04 < crocket> My VPN client has an IP address of 192.168.100.6]
03:04 < crocket> My VPN client has an IP address of 192.168.100.6
03:04 < crocket> krzee, yes, and it worked yesterday.
03:04 < krzee> umm dude
03:04 < krzee> !configs
03:04 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
03:05 < crocket> All packets going from tun0 through eth0 to 192.168.100.0/24 are modified to have the source IP address of 192.168.100.6
03:05 < krzee> you dont notice that you have clashing subnets!?
03:05 < krzee> !samesubnet
03:05 <@vpnHelper> "samesubnet" is clients can not connect to a server pushing its lan if on the same subnet. you can only reach your subnet on layer2 or through your gateway, when you create a route for it you will try to reach your gateway over the vpn which dies because you cant reach your gateway
03:05 < crocket> I don't have clashing subnets.
03:05 < krzee> umm
03:05 < krzee> your vpn subnet is the same as the lan you are trying to access...
03:06 < crocket> Only one client belongs to the LAN.
03:06 < crocket> The server is elsewhere.
03:06 < krzee> you cant access the 192.168.100/24 lan AND use 192.168.100.X as your vpn subnet
03:06 < krzee> that doesnt matter
03:06 < crocket> Another client is in an institution.
03:06 < krzee> change your vpn subnet
03:06 < crocket> My VPN subnet is 10.25.37.0/24
03:07 < krzee> oh ok, "My VPN client has an IP address of 192.168.100.6"
03:07 < crocket> yeah
03:07 < krzee> didnt know you only meant lan ip
03:07 < crocket> It's eth0 IP
03:07 < krzee> welp
03:07 < crocket> Its tun0 IP address is 10.25.37.x
03:07 < krzee> !nathack
03:07 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
03:09 < krzee> and
03:09 < krzee> !route
03:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
03:09 < krzee> when you've finished double-checking your setup... if it still doesnt work i need !logs and !configs
03:09 < crocket> krzee, I did iptables -t nat -A POSTROUTING -s 10.25.37.0/24 -d 192.168.100.0/24 -o eth0 -j MASQUERADE
03:10 < krzee> i dont think you need -d
03:10 < krzee> or will you be accessing other networks over the vpn and dont want that NAT'ed?
03:11 < crocket> Without -d, it still doesn't work.
03:11 < crocket> There is no other network.
03:11 < krzee> but how sure are you that it is iptables that is your problem...?
03:12 < crocket> krzee, I don't nkow
03:12 < krzee> because i told you what i wanted you to do, and the next piece of info i want if you cant fix it with my doc... and all you do is give me your iptables command
03:12 < crocket> krzee, I need to check if packets destined for 192.168.100.0/24 really arrive 192.168.100.6, the VPN client which has 192.168.100.0/24 subnet.
03:13 < crocket> Is there a way to check it?
03:13 < crocket> I think I checked it, but I forgot how to do it.
03:13 < krzee> really? i thought you needed to read my doc, check your setup, and do what i said above
03:13 < crocket> I already knew that NAT trick.
03:13 < krzee> but go ahead and just spin your wheels, ill be back later
03:21 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10497> || Unable to login after configuring Ethernet Bridging <http://forums.openvpn.net/topic7790.html#p10496> || Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10495>
03:26 < crocket> krzee, OMG!!! I had to execute "echo 1 > /proc/sys/net/ipv4/ip_forward
03:26 < crocket> krzee, OMG!!! I had to execute "echo 1 > /proc/sys/net/ipv4/ip_forward"
03:27 < crocket> But with that turned on, "dhcpcd ra0(a wireless LAN)" on 192.168.100.6 machine immediately stops or rebots the machine.
03:27 < crocket> s/rebots/reboots/
03:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:30 -!- mode/#openvpn [+o mattock] by ChanServ
03:32 -!- roadside1ob is now known as roadsidebob
03:35 < crocket> krzee, ureka!!!
03:35 < crocket> It's a rediscovery.
03:41 < crocket> I discovered it yesterday, but due to sleep deprivation, I forgot it.
03:50 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
03:54 -!- roadside1ob [~o2@unaffiliated/spice] has joined #openvpn
03:54 < krzee> you dont HAVE to do it that way
03:54 < krzee> thats only temp (as you noticed)
03:54 < krzee> !linipforward
03:54 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
03:56 -!- roadsidebob [~o2@unaffiliated/spice] has quit [Ping timeout: 250 seconds]
03:59 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
03:59 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
03:59 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:03 <@vpnHelper> RSS Update - forum: encryption <http://forums.openvpn.net/topic7786.html#p10498>
04:08 <@vpnHelper> RSS Update - forum: Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10499>
04:15 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10500>
04:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
04:33 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10501>
04:43 -!- oc80 [oc80z@blea.ch] has quit [Ping timeout: 276 seconds]
04:43 -!- le0 [~le0@unaffiliated/le0] has quit [Read error: No route to host]
04:44 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has joined #openvpn
04:44 -!- le0 [~le0@cpc8-bele7-2-0-cust12.2-1.cable.virginmedia.com] has quit [Changing host]
04:44 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
04:44 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
05:04 -!- assid [~assid@122.170.9.45] has joined #openvpn
05:04 -!- assid [~assid@122.170.9.45] has quit [Changing host]
05:04 -!- assid [~assid@unaffiliated/assid] has joined #openvpn
05:04 < assid> heya
05:04 < assid> i need some help with something.. i have a dd-wrt router which is loaded with openvpn
05:04 < assid> however, i am unable to get my packets through to the local lan behind the router
05:05 < assid> i am able to ping from the router back to the client... and a traceroute shows the router is pingable.. but when i try and ping it .. it doesnt work
05:05 < reiffert> !route
05:05 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
05:06 < assid> i am also able to ping the vpn client  from the lan behind the router
05:06 < assid> reiffert: gone through them.. been at it since over 1.5 hours..
05:07 < assid> i think its something stupid i,m missing
05:09 < assid> reiffert: would appreciate human interaction on this
05:10 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
05:11 < reiffert> a route back, a firewall, eyes for reading the link I gave you?
05:13 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
05:15 < assid> need help figuring out how to allow it to route back
05:20 < assid> ive adding the iptables of whatever i could figure out
05:20 < assid> but still no joy
05:20 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:20 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:20 <@vpnHelper> RSS Update - forum: Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10502>
05:35 < assid> reiffert: LAN on openvpn side : 172.16.0.0/24 ; openvpn lan: 10.100.0.0/24; connecting from : 192.168.0.0/24
05:36 -!- oc80z [oc80z@blea.ch] has joined #openvpn
05:36 < assid> reiffert: user on 172.16.0.40 is able to ping 10.100.0.2  (vpn client); however. vpn client cant read 172.16.0.0/24
05:55 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:56 -!- EugeneKaway is now known as EugeneKay
05:57 <@vpnHelper> RSS Update - forum: The new windows GUI does not ask for PKCS11 PIN <http://forums.openvpn.net/topic7794.html>
06:05 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:05 -!- mode/#openvpn [+o mattock] by ChanServ
06:10 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
06:22 -!- genesis11 [~genesis11@222.127.246.15] has joined #openvpn
06:23 < genesis11> hello anybody here now ?
06:23 < genesis11> i would like to ask some question please
06:24 < genesis11> !welcome
06:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:24 < genesis11> !goal
06:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:24 < genesis11> !goal: create multiple vpn server
06:25 -!- genesis11 [~genesis11@222.127.246.15] has quit [Client Quit]
06:30 < crocket> krzee, I put echo 1 > /proc/sys/net/ipv4/ip_forward after "dhcpcd ra0" in /etc/rc.d/rc.local since if "dhcpcd ra0" is executed before that, the computer reboots or stops immediately.
06:30 < crocket> krzee, rt3062sta driver is experimental and very unstable.
06:33 <@vpnHelper> RSS Update - forum: Multiple network access <http://forums.openvpn.net/topic7795.html>
06:35 < assid> aargj// stuipid thing needs to work :(
06:35 < assid> EugeneKay: you in a helping mood?
06:36 < assid>  am unable to get my packets through to the local lan behind the router;  i am able to ping from the router back to the client... and a traceroute shows the router is pingable.. but when i try and ping it .. it doesnt work
06:36 < assid> LAN on openvpn side : 172.16.0.0/24 ; openvpn lan: 10.100.0.0/24; connecting from : 192.168.0.0/24
06:36 < assid> !redirect
06:36 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
06:37 < assid> !nat
06:37 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
06:38 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 252 seconds]
06:39 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
06:44 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
06:58 -!- maxJadi [~maxJadi@dhcp-165-58.nomad.chalmers.se] has joined #openvpn
06:58 -!- maxJadi [~maxJadi@dhcp-165-58.nomad.chalmers.se] has quit [Changing host]
06:58 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
07:14 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 250 seconds]
07:22 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
07:24 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
07:33 <@vpnHelper> RSS Update - forum: Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10505>
07:39 <@vpnHelper> RSS Update - forum: Multiple network access <http://forums.openvpn.net/topic7795.html#p10506>
08:04 <@vpnHelper> RSS Update - forum: Multiple network access <http://forums.openvpn.net/topic7795.html#p10508> || Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10507>
08:22 <@vpnHelper> RSS Update - forum: Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10509>
08:22 -!- noisebleed_ [~quassel@piggy.inescn.pt] has joined #openvpn
08:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
08:35 -!- gladiatr_afk is now known as gladiatr
08:36 -!- Synthead [~max@70-90-75-102-BusName-atl.ga.hfc.comcastbusiness.net] has joined #openvpn
08:38 < Synthead> is there a way an OpenVPN server can act as a DNS server for its connected hosts?  As in, if 10 clients are connected to the server, is there a way I can add 10.8.0.1 (the VPN server's IP) to /etc/resolv.conf and connect to clients via their hostname?
08:46 < Bushmills> Synthead: run a recursive name server on openvpn server machine, let client query it by its openvpn ip address
08:46 < crocket> Synthead, You need a separate DNS server.
08:46 < Bushmills> to get host names and ip addresses into the zone, you need extra steps
08:47 < crocket> Synthead, I recommend using "bind"
08:47 < Synthead> ahh, like some type of dnsmasq solution? :)
08:47 < Synthead> binddddddd, yeah
08:47 < Bushmills> (assuming adding them dynamically)
08:47 < crocket> Synthead, With dnsmasq, you need to send the host name and IP address of each client to the server so that the server can add them to /etc/hosts.
08:48 < crocket> It could be done with ssh without password if you use public-key authentication.
08:48 < Synthead> heh, I already wrote a client-connect script that dynamically adds new hosts :)
08:48 < crocket> Synthead, Do you have a way to send information from clients to server?
08:48 < Bushmills> for adding A records of vpn clients statically, you can use something simpler than bind.  for example, maradns.
08:48 < Synthead> crocket: yes, client-to-client is enabled
08:49 < crocket> I never heard of maradns before.
08:49 < Bushmills> you did.
08:49 < Bushmills> i just mentioned it
08:49 < crocket> Synthead, Do you use ssh to send information to server?
08:49 < crocket> Bushmills, before means before this day.
08:49 < Synthead> me neither, I'll look it up.  I'm experienced in dnsmasq and bind, though, so it's good to hear about them in relevance.  
08:49 < Bushmills> http://www.maradns.org/advocacy.html
08:49 <@vpnHelper> Title: MaraDNS - a security-aware DNS server (at www.maradns.org)
08:50 < Synthead> crocket: in order to update the hosts file? no, never
08:50 < crocket> Synthead, How do you send (host name, IP address) pair to the server?
08:50 < Synthead> http://codepad.org/4qnqiLxz
08:50 <@vpnHelper> Title: Plain Text code - 15 lines - codepad (at codepad.org)
08:50 < crocket> I currently use dnsmasq to allocate IP addresses to wireless nodes, but I decided to learn bind.
08:51 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
08:51 < crocket> I like to use nsupdate.
08:51 < gladiatr> hrm... mara looks pretty cool
08:51 < Synthead> this is update-hosts, configured as "client-connect /etc/openvpn/ultratit/update-hosts" in /etc/openvpn/ultratit.conf, my main VPN config
08:51 < Synthead> with script-security 2
08:53 -!- assid [~assid@unaffiliated/assid] has quit [Quit: Leaving.]
08:53 < Synthead> I'll look at external DNS daemons, thanks a ton you guys!
09:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:04 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
09:04 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
09:04 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
09:06 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:06 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:06 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:08 < js_> i get a lot of "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)", can this be due to clients being double-nated or something?
09:09 < js_> or can it be that i've misconfigured?
09:09 < js_> i'm trying to set up tls-server with multiple clients and have the clients set their ip using ifconfig (i need to know which client has which ip)
09:09 < js_> i also get a warning that i don't set ifconfig in the server config
09:14 < hyper_ch> hi krzee and Bushmills
09:15 < krzee> moin
09:15 < Bushmills> 'evening hyper_ch
09:15 < krzee> js_, 
09:16 < krzee> !configs
09:16 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
09:16 < js_>  ah right
09:17 < hyper_ch> Bushmills: krzee: If you're going to get a new notebook which you intend to fully encrypt, would you go for a 4-core i7 1.6Ghz or for a 2-core i5 2.66 Ghz wie AESNI?
09:17 < Bushmills> probably not
09:18 < krzee> ild get a macbook :-p
09:18 < js_> krzee: server: http://pastebin.com/S11rzeDG client: http://pastebin.com/0RarLTew
09:18 < Bushmills> do macbooks not run oni7 cpus?
09:19 < krzee> js_, why are you using dev tap?
09:19 < krzee> js_, and why are you using ifconfig in the server config like that?
09:19 < hyper_ch> krzee: and if you wouldn't get a mac book, which of those two would you get (other specs being the same)
09:19 < js_> krzee: does this imply "remove the ifconfig lines in the server conf and use tun"? :)
09:20 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has joined #openvpn
09:20 < krzee> Bushmills, some do, but not quad core i7 1.6 ghz ;]
09:20 < krzee> MacBookPro6,1 CPU: Intel Core i7 M 620 2.67GHz @ 2.66GHz [/FPU/MMX/SSE/SSE2/SSE3/S.SSE3/SSE4.1/SSE4.2/x86_64/PAE/XD/EM64T/VMX/EST] L2: 512K FSB: 4800MHz Airport:  (802.11 a/b/g/n)  RAM: 3.3GB/8.0GB Vram: 0.00M/128.00M Disk: 451.58GB/465.44GB GPU: Intel HD Graphics [288 MB/Stock] 1920x1200 OS: Mac OS X 10.6.6 (10J567) Kernel: Darwin 10.6.0 Up: 4 days 20:21
09:20 < js_> i don't know enough to know why i use those things, other than i've been trying different things
09:20 < krzee> i got the i7 on this one ;]
09:20 < krzee> js_, oh ok
09:20 < krzee> !sample
09:20 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
09:20 < krzee> those are configs from one of my setups
09:20 < js_> krzee: i want the server to have 10.9.0.1 and the clients to be table to set the ips themselves
09:21 < js_> thanks
09:21 < krzee> clients dont set IPs themselves
09:21 < krzee> but you can give static from the server
09:21 < krzee> server 10.9.0.0 255.255.255.0 will do the other part
09:21 < js_> krzee: how can i set them statically from the server?
09:22 < krzee> !static
09:22 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
09:22 < crocket> kraut, Do you know an easy way to assign DNS names to the server and the clients?
09:23 < crocket> I'm learning BIND to do this.
09:23 < js_> krzee: thanks!
09:23 < krzee> crocket, didnt someone just give you the script...?
09:23 < crocket> krzee, what sciprt?
09:24 < crocket> krzee, I don't watch this channel 24/7.
09:24 < krzee> [09:52]  <Synthead> this is update-hosts, configured as "client-connect /etc/openvpn/ultratit/update-hosts" in /etc/openvpn/ultratit.conf, my main VPN config
09:25 < krzee> [09:52]  <Synthead> with script-security 2
09:25 < krzee> or does that update the hosts file or something...?
09:26 < krzee> http://openvpn.net/archive/openvpn-users/2007-10/msg00163.html
09:26 <@vpnHelper> Title: [Openvpn-users] named clients? (at openvpn.net)
09:26 < krzee> theres the start of a thread on that
09:27 < krzee> but ya, since i dont care to have what you said, i dont know more than what google says (this is not a rare topic..._
09:28 < crocket> meh.
09:28 < crocket> meh~
09:31 < krzee> sounds pretty easy tho honestly
09:31 < krzee> ive made shell scripts to update named.conf before
09:32 < krzee> well actually, i put all the zone stuff in includes for easier safer scripting... and editing the zone files via script was rather simple
09:32 < krzee> if you cant find something ready-made, that shouldnt be too hard to make
09:32 < crocket> krzee, how about nsupdate?
09:33 < krzee> no idea
09:33 < krzee> never hearda it
09:33 < crocket> I was thinking about using ssh to send (host name,IP address) pair from clients to the server.
09:33 < Bushmills> (20:46:12) Bushmills: "active" part of nsupdate could look like  http://scarydevilmonastery.net/snap/1300304723143677998d.png
09:33 < crocket> nsupdate can update named's DNS records.
09:33 < crocket> nsupdate can update named's DNS records on the run.
09:33 < krzee> looks like Bushmills answered
09:34 < crocket> ssh can log into another machine without password.
09:34 < Bushmills> though you want the delete action executed by disconnect script
09:34 < krzee> pretty nice too Bushmills =]
09:34 < krzee> i like the txt entry with the date in it, i wouldnt have thought of that
09:34 < Bushmills> i'm running that on my wlan router
09:34 < crocket> krzee, I'm reading dozens of pages in bind manual.
09:34 < krzee> but now that i see it, it makes total sense
09:35 < Bushmills> that way (TXT record) i can also check from remote when the router reconnected
09:35 < crocket> Is there a way to make named reveal all the registered hosts?
09:36 < crocket> I want to know which clients are connected to my OpenVPN server.
09:36 < krzee> and if you had many users you could trim the outdated entries (in case of crash or reboot not letting client-disconnect remove them)
09:36 < Bushmills> dig tp.scarydevilmonastery.net TXT   :)
09:36 < krzee> by using that timestamp
09:37 < krzee> been connected a lil while ;]
09:37 < krzee> day after xmas
09:39 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:40 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has quit [Ping timeout: 248 seconds]
09:48 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
09:53 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
09:59 -!- le0 [~le0@unaffiliated/le0] has joined #openvpn
10:00 -!- LordDoskias [~nib9@unaffiliated/lorddoskias] has joined #openvpn
10:01 < LordDoskias> is there a guide on most common optimisations one can perform if they want to improve their network throughput ?
10:01 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: reboot]
10:07 < reiffert> get more bandwidth.
10:07 < krzee> well
10:07 < krzee> !tcp
10:07 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
10:07 < krzee> !mtu
10:07 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
10:12 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 252 seconds]
10:13 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
10:14 < LordDoskias> i'm using UDP, yes
10:14 < LordDoskias> reiffert: bandwidth is not the problem, throughput is 
10:15 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
10:17 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 264 seconds]
10:17 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Client Quit]
10:18 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
10:28 -!- SerajewelKS [devnull@wikipedia/Crazycomputers] has joined #openvpn
10:29 < SerajewelKS> i can't seem to get a "route" stanza to work on a windows client config.  the server is tun with "ifconfig 192.168.5.1 192.168.5.2".  from the client i can ping 192.168.5.2.  the client has "route 192.168.3.0 255.255.255.0 192.168.5.2".  the client starts fine, with no errors or warnings in the log, but the route is not added to the table.  if i add the route manually (route add 192.168.3.0 mask 255.255.255.0 192.168.5.2) then i can ping host
10:30 < SerajewelKS> is there a common reason that syntactically and semantically correct route stanzas are ignored?
10:31 -!- LordDoskias [~nib9@unaffiliated/lorddoskias] has quit [Quit: leaving]
10:34 < SerajewelKS> tweaking route-delay does not appear to help
10:35 < SerajewelKS> the client is on windows 7 and i am running openvpn-gui with elevated privileges.  is the gui perhaps not transferring elevation to the client binary?
10:40 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Quit: leaving]
10:42 < dkr> try bumping up the log verbosity
10:43 < SerajewelKS> good idea, i dunno why i didn't do that already... :)
10:46 < SerajewelKS> tcp over tcp-over-tcp is teh bomb
10:47 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
10:48 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
10:48 < SerajewelKS> dkr: ah, i figured it out.  i remembered what the issue was last time i tried this.
10:49 < SerajewelKS> dkr: if you have two <connection> blocks, and the first fails, no routes are ever added
10:49 < SerajewelKS> the first connection attempt MUST succeed in the windows client, or routes are ignored entirely
10:51 -!- Synthead [~max@70-90-75-102-BusName-atl.ga.hfc.comcastbusiness.net] has quit [Quit: Leaving]
10:57 -!- EugeneKay is now known as EugeneKaway
10:57 <@vpnHelper> RSS Update - forum: Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10510>
10:58 < reiffert> SerajewelKS: when able to reproduce it, please file this to the bugtracker, the openvpn-devel mailinglist, #openvpn-devel or otherwise.
10:59 < reiffert> SerajewelKS: please raise the verbosity level to 10 and produce what you claim and provide the log.
11:00 < SerajewelKS> reiffert: it's 100% reproducable with my setup.  i'm going to try more things when i get home and have more freedom to try stuff on the network.
11:00 < SerajewelKS> i'm also going to see if this is windows-specific behavior by trying the same config on a linux box
11:01 < reiffert> great. thanks for your help.
11:01 < SerajewelKS> np
11:02 < SerajewelKS> i unfortunately need multiple connection blocks due to some BS at work, so it's in my best interests to help resolve this bug :)
11:03 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p10511>
11:06 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
11:07 < SerajewelKS> if only my work firewall didn't block all outbound UDP
11:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
11:18 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: reboot]
11:23 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
11:23 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
11:24 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
11:25 < Nowak> are there any docs on the windows tun/tap driver? i want to use it without the rest of openvpn
11:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:29 -!- SOG [~SOG@222.125.196.155] has quit [Quit: I will be back!]
11:31 < reiffert> google http://www.varsanofiev.com/inside/using_tuntap_under_windows.htm
11:31 <@vpnHelper> Title: Using tuntap under Windows (at www.varsanofiev.com)
11:35 -!- roadside1ob is now known as fascism
11:35 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
11:51 -!- fascism is now known as roadsidebob
11:58 < js_> krzee: still here? i managed to get my multiclient thing working better with your sample config, but it keeps reconnecting all the time, dunno why
11:58 < js_> thought it might be due to two clients having the same something, so i added duplicate-cn to the server config without luck
11:58 < js_> tried to add a ccd dir as well but the file doesn't seem to be read?
11:58 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
11:59 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 276 seconds]
12:01 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
12:05 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has joined #openvpn
12:05 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has quit [Changing host]
12:05 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
12:05 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
12:16 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.4]
12:20 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
12:41 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
12:41 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
12:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:48 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
12:49 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
13:08 -!- Kobaz [~kobaz@its.kobaz.net] has left #openvpn ["Leaving"]
13:15 -!- noisebleed_ [~quassel@piggy.inescn.pt] has quit [Remote host closed the connection]
13:17 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
13:17 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
13:17 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
13:37 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
13:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 248 seconds]
13:46 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 250 seconds]
13:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:57 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
14:00 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
14:00 -!- mode/#openvpn [+o patelx] by ChanServ
14:32 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
14:37 -!- gyyrog_ [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:37 < gyyrog_> hello
14:37 < gyyrog_> I am just curious about the syntax of my ifconfig
14:37 < gyyrog_> in the tun adapter after I connect to an openvpn server I get
14:38 < gyyrog_> 10.1.1.23 --> 10.1.1.24
14:38 < gyyrog_> what does that mean?
14:38 < gyyrog_> the arrow I have never seen before
14:38 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
14:38 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
14:43 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 252 seconds]
14:45 -!- darthvader [~darthvade@c-68-34-207-23.hsd1.tn.comcast.net] has joined #openvpn
14:45 < darthvader> hey im trying to use tunnelblick to connect to JanusVM on my OSX...has anyone else tried this?
14:46 < hjohnson> not locally, though that shouldn't be any different than connecting to a remote host
14:47 < darthvader> I am having one hell of a time with it.
14:47 -!- le0 [~le0@unaffiliated/le0] has quit [Quit: olympic ironing for 2012]
14:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:53 -!- darthvader [~darthvade@c-68-34-207-23.hsd1.tn.comcast.net] has quit [Quit: Leaving]
14:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:59 -!- ldaguilar [~ldaguilar@186.176.7.194] has quit [Read error: Operation timed out]
14:59 -!- Guest68746 [~noname@noname.rula.net] has joined #openvpn
14:59 -!- loompek [~noname@kista.rula.net] has quit [Read error: Operation timed out]
15:12 -!- ldaguilar [~ldaguilar@186.176.7.194] has joined #openvpn
15:13 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10512>
15:17 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Connection reset by peer]
15:21 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
15:31 <@vpnHelper> RSS Update - forum: Login Banner? <http://forums.openvpn.net/topic7796.html>
15:43 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10514>
15:44 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:27 -!- p3rror [~mezgani@41.140.30.118] has joined #openvpn
16:49 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10515>
16:51 -!- gyyrog_ [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:54 -!- LordDoskias [~nib9@unaffiliated/lorddoskias] has joined #openvpn
16:54 < LordDoskias> is it normal to be able to achieve only 200kb throughput on a UDP link 
16:54 < LordDoskias> using default cipher 
16:54 < LordDoskias> comp-lzo 
16:55 < LordDoskias> running on a link which without the vpn easily gets around 2mb/s
16:57 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:02 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
17:04 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
17:06 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
17:09 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
17:10 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Read error: Operation timed out]
17:17 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:25 < Bushmills> nope. not normal
17:30 -!- BostX [~bost@p5B2F1A22.dip0.t-ipconnect.de] has joined #openvpn
17:31 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10516>
17:43 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
17:43 -!- LordDoskias [~nib9@unaffiliated/lorddoskias] has quit [Quit: Lost terminal]
17:49 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10517>
17:50 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:52 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
17:56 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:06 -!- EugeneKaway is now known as EugeneKay
18:06 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
18:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
18:10 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
18:12 -!- roadsidebob is now known as Gaddafi
18:12 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10518>
18:20 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:20 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:20 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:22 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
18:23 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
18:24 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
18:24 -!- JPeterso2 is now known as JPeterson
18:44 <@vpnHelper> RSS Update - forum: Login Banner? <http://forums.openvpn.net/topic7796.html#p10519>
19:00 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 250 seconds]
19:05 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
19:08 -!- EugeneKay is now known as EugeneKaway
19:14 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:14 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Read error: Operation timed out]
19:27 < Dougy> hello all
19:40 -!- Dougy [me@tech.qsi.net] has quit [Changing host]
19:40 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
19:43 -!- BostX [~bost@p5B2F1A22.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
19:50 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10520>
19:51 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:08 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:20 -!- SOG [~SOG@222.125.196.155] has quit [Quit: SOG]
20:26 <@vpnHelper> RSS Update - forum: Here is my own Auto Login script for OpenVPN <http://forums.openvpn.net/topic7779.html#p10521>
20:33 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
20:36 -!- SOG [~SOG@58.60.84.212] has joined #openvpn
20:39 -!- SOG [~SOG@58.60.84.212] has quit [Client Quit]
20:57 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:04 -!- common [~common@p5DDA4B68.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
22:07 -!- common [~common@p5DDA4BEE.dip0.t-ipconnect.de] has joined #openvpn
22:09 -!- master_of_master [~master_of@p57B53833.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
22:11 -!- master_of_master [~master_of@p57B53B8B.dip.t-dialin.net] has joined #openvpn
22:18 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
22:20 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10522>
22:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:14 < Varazir> morning ppl 
23:23 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
23:24 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
23:24 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
23:37 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
23:38 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:47 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
--- Day changed Fri Mar 18 2011
00:15 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
00:15 < crocket> Hello openvpn guys.
00:27 <@vpnHelper> RSS Update - forum: OpenVPN Not working <http://forums.openvpn.net/topic7797.html>
00:30 -!- assid [~assid@unaffiliated/assid] has joined #openvpn
00:30 < assid> heya
00:31 < assid> if i want to have by default "redirect-gateway" but certain users i want to disable that.. is there a way to disable it in clients' ovpn config?
00:36 < assid> anyone?
00:41 < assid> anyone
00:41 < assid> hrmm.. is it even possible
00:42 < krzee> well
00:42 < krzee> a) you dont have to push it, you can just put redirect-gateway in the client configs where it belongs
00:42 < krzee> and for b) gimme a minute
00:43 < assid> router unfortunately doesnt let me set up client configs.. im setting all this in dd-wrt 
00:44 < assid> i was hoping it would be something at client level to "ignore" the route
00:44 < krzee> umm
00:44 < krzee> you control the server, so you can tell clients what to have
00:46 < assid> right.. but in linux / ubuntu for example i have the option to ignore that route.. i was hoping to have something in the  client .ovpn file itself like  no-redirect-gateway or something
00:47 < assid> wait.. what if i use route-gateway on the client end  would that work ?
00:49 < assid> k.. might get cut.... brb
00:49 -!- assid [~assid@unaffiliated/assid] has quit [Quit: Leaving.]
00:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
01:25 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 255 seconds]
01:25 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
01:27 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:31 <@vpnHelper> RSS Update - forum: server pushes redirect-gateway <http://forums.openvpn.net/topic7798.html>
01:32 -!- p3rror [~mezgani@41.140.30.118] has quit [Ping timeout: 255 seconds]
01:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:45 -!- p3rror [~mezgani@41.140.102.102] has joined #openvpn
02:05 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:07 <@vpnHelper> RSS Update - forum: OpenVPN Not working <http://forums.openvpn.net/topic7797.html#p10525>
02:10 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
02:14 -!- p3rror [~mezgani@41.140.102.102] has quit [Ping timeout: 255 seconds]
02:19 -!- SOG [~SOG@58.60.84.212] has joined #openvpn
02:23 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
02:28 -!- p3rror [~mezgani@41.140.99.166] has joined #openvpn
02:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
02:53 -!- albech [~thomas@61.7.130.141] has joined #openvpn
02:55 <@vpnHelper> RSS Update - forum: Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10526>
03:01 <@vpnHelper> RSS Update - forum: server pushes redirect-gateway <http://forums.openvpn.net/topic7798.html#p10528> || OpenVPN Not working <http://forums.openvpn.net/topic7797.html#p10527>
03:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:06 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 264 seconds]
03:31 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
03:38 -!- EugeneKaway is now known as EugeneKay
03:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:43 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
03:45 -!- EugeneKay is now known as EugeneKaway
03:45 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
03:45 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
03:45 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
03:52 -!- EugeneKaway is now known as EugeneKay
03:54 -!- Gaddafi_ [~o2@unaffiliated/spice] has joined #openvpn
03:54 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:54 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:54 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:56 -!- Gaddafi [~o2@unaffiliated/spice] has quit [Read error: Operation timed out]
04:07 <@vpnHelper> RSS Update - forum: openvpn 2.2RC can't run as server ? <http://forums.openvpn.net/topic7751.html#p10529>
04:17 -!- EugeneKay is now known as EugeneKaway
04:24 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
04:27 -!- CrazyFurry [xdemon@lex.io] has quit [Quit: Cya!]
04:46 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
04:47 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
05:07 -!- stryg [~bwtermina@rob92-6-82-231-240-143.fbx.proxad.net] has joined #openvpn
05:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:13 < stryg> hi everybody
05:14 < stryg> does anybody know if there are any other developper / contributor on OpenVPN (excepted James Yonan)
05:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:52 <@vpnHelper> RSS Update - forum: server pushes redirect-gateway <http://forums.openvpn.net/topic7798.html#p10531> || Login Banner? <http://forums.openvpn.net/topic7796.html#p10530>
05:56 < reiffert> stryg: #openvpn-devel
06:00 -!- EugeneKaway is now known as EugeneKay
06:14 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 246 seconds]
06:14 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
06:21 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
06:27 -!- SOG [~SOG@58.60.84.212] has quit [Quit: SOG]
06:34 <@vpnHelper> RSS Update - forum: server pushes redirect-gateway <http://forums.openvpn.net/topic7798.html#p10532>
06:49 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 264 seconds]
06:49 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
06:57 < crocket> ok
07:25 < dvl> smashed laptop anyone? http://twitpic.com/4af3ri
07:25 <@vpnHelper> Title: Thanks Apple, for sending me my first ever Mac. Shame on @Fe... on Twitpic (at twitpic.com)
07:38 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
07:42 -!- Gaddafi_ is now known as oracle
07:44 -!- p3rror [~mezgani@41.140.99.166] has quit [Read error: Operation timed out]
07:48 < crocket> i remembered that nouveau can't transfer HDMI audio.
07:49 < crocket> I'm going to return to nvidia binary driver sadly.
07:49 < crocket> hmm
07:50 < crocket> Maybe I just use analog audio output for a year since 1920x1080 screen is more desirable than HDMI audio.
08:00 -!- p3rror [~mezgani@41.140.182.176] has joined #openvpn
08:01 -!- EugeneKay is now known as EugeneKaway
08:06 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
08:09 < KaiForce> Is there a sample config online that shows single client with multiple server connections?  Does that require multiple instances of OpenVPN to run or no?
08:11 < KaiForce> I don't want load balancing, I want multiple tunnels up at once, to different targets,  from a single client machine.
08:12 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 255 seconds]
08:13 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
08:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
08:16 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
08:17 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
08:18 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
08:19 < KaiForce> withdrawn, I believe I've found the answer.
08:22 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Ping timeout: 255 seconds]
08:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:26 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
08:34 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
08:40 <@vpnHelper> RSS Update - forum: OpenVPN and aetpkss1.dll <http://forums.openvpn.net/topic7799.html>
08:55 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
09:02 < gladiatr> KaiForce, you just need to have multiple cilent configs
09:03 < KaiForce> gladiatr: yes, I figured it out.  The interface I was using (on Leaf Bering) limited my brain to "client" and "server" configs.  Once I looked past the Leaf menu it was obvious!
09:04 < gladiatr> gotcha :)
09:05 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:20 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Changing host]
09:20 -!- Nowak [nowak@worldwind/developer/Nowak] has joined #openvpn
09:20 -!- mordy [~mordy@69.195.135.251] has joined #openvpn
09:22 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10535>
09:27 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:27 <@vpnHelper> RSS Update - forum: OpenVPN and aetpkss1.dll <http://forums.openvpn.net/topic7799.html#p10536>
09:28 -!- ldaguilar [~ldaguilar@186.176.7.194] has quit [Remote host closed the connection]
09:31 -!- p3rror [~mezgani@41.140.182.176] has quit [Ping timeout: 255 seconds]
10:01 -!- EugeneKaway is now known as EugeneKay
10:08 -!- APTX [APTX@phpBB/developer/APTX] has quit [Read error: Operation timed out]
10:09 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
10:09 <@vpnHelper> RSS Update - forum: OpenVPN and aetpkss1.dll <http://forums.openvpn.net/topic7799.html#p10537>
10:16 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
10:20 <@vpnHelper> RSS Update - forum: OpenVPN and aetpkss1.dll <http://forums.openvpn.net/topic7799.html#p10538>
10:21 < havoc> and now on to openvpn setup for the mac people
10:22 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
10:22 < gladiatr> havoc, they're good kids.  Simple, but they mean well.  Be gentle
10:22 < gladiatr> :D
10:24 < Assid> anyonehere running openvpn on dualwan.cn or its english counterpart
10:26  * gladiatr 's running openvpn on an old Dell :D
10:27 < havoc> I'm running it on a lot of stuff
10:27 < havoc> and every network I setup I add an iface on my LAN and MASQ it
10:27 < gladiatr> ahh... some sort of little linux router, huh?
10:27 < havoc> yes
10:27 < havoc> more like "routers"
10:28 < Assid> gladiatr: yeah they are always on anywyas.. makes most sense
10:28 < gladiatr> oh, I was referring to the dualwan thing
10:28 < havoc> I already have 5 VPN segments at home, this'll be the 6th
10:28 < Assid> oh yeha.. theres a dualwan router you can use if you have 2 connections..
10:28 < havoc> ah
10:29 < Assid> its got built in openvpn.. but for whateevr reason its writing server-bridge  in the config.. and i cant do anything about it
10:30  * gladiatr grinds his teeth -> wrt derivative gui configurators
10:31 < Assid> actually tomato based..
10:31 < gladiatr> tomato is still based on openwrt
10:31 < Assid> true
10:31 -!- reiffert [~thomas@mail.reifferscheid.org] has left #openvpn []
10:31 < KaiForce> is there a way to limit the address pool, or otherwise reserve addresses, for certain clients?
10:31 < Assid> well, that said.. it does brilliant load balacing
10:31 < gladiatr> !ccd
10:31 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
10:32 < KaiForce> ah ok.  I use that already to set up routes, I'll take a look at assigning IP addresses.
10:36 < Assid> hrmm
10:36 < Assid> okay im tired. ive wasted 2 days on this particular router
10:36 < Assid> i got it working on dd-wrt fine
10:37 < Assid> if anyone can help me.. even take over.. would be appreciated
10:42 < Assid> aargh come on
11:00 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
11:00 <@vpnHelper> RSS Update - forum: OpenVPN and aetpkss1.dll <http://forums.openvpn.net/topic7799.html#p10539>
11:01 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
11:13 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10540>
11:13 -!- jg71 [~edud@unaffiliated/jg71] has joined #openvpn
11:22 < Bushmills> i run openvpn under openwrt 
11:24 < Bushmills> was enough to specify    config 'openvpn' 'custom_config'   in /etc/config/openvpn, and tell with   option 'config' '/etc/openvpn/my.conf' what config to use instead
11:24 < Bushmills> Assid: ^^^
11:31 <@vpnHelper> RSS Update - forum: Encrypting traffic from my remote laptop at work <http://forums.openvpn.net/topic7787.html#p10541>
11:41 -!- albech [~thomas@61.7.130.141] has quit [Quit: Ex-Chat]
11:53 -!- SOG [~SOG@183.15.93.56] has joined #openvpn
11:57 < Assid> Bushmills: brilliant can i pm you?
11:57 < Bushmills> nope - i'm about to leave 
11:57 < Assid> oh
11:57 < Bushmills> try again later
11:58 < Assid> hrmm ok.. what time you back on
11:58 < Bushmills> 2...3 hours
11:58 < Assid> man i wish people use more of gtalk
11:58 < Assid> damn.. thatd be too late.. its 10.30pm already :/
11:58 < Bushmills> jabber, that is
11:58 < Assid> yep
11:58 < Bushmills> google chat is just jabber
11:58 < Assid> you on any?
11:59 < Bushmills> yes
11:59 < Assid> can just buzz you there
11:59 < Assid> pm me your address?
12:00 -!- SOG [~SOG@183.15.93.56] has quit [Quit: I will be back!]
12:09 < Assid> Bushmills: do you happen to use tomato openvpn ?
12:11 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:19 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10542>
12:19 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
12:24 -!- Assid [~assid@unaffiliated/assid] has quit [Ping timeout: 255 seconds]
12:24 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
12:25 -!- EugeneKay is now known as EugeneKaway
12:29 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
12:29 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
12:36 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
12:36 -!- Assid [~assid@unaffiliated/assid] has quit [Client Quit]
12:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:43 <@vpnHelper> RSS Update - forum: Lans behind OpenVPN <http://forums.openvpn.net/topic98.html#p10544> || Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10543>
12:55 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:58 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
13:00 -!- loompek [~noname@kista.rula.net] has joined #openvpn
13:00 <@vpnHelper> RSS Update - forum: virtual interfaces eth0:1 <http://forums.openvpn.net/topic7800.html>
13:03 -!- Guest68746 [~noname@noname.rula.net] has quit [Ping timeout: 250 seconds]
13:06 -!- p3rror [~mezgani@41.140.157.177] has joined #openvpn
13:13 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
13:25 -!- buntfalke_ is now known as buntfalke
13:30 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 260 seconds]
13:36 < havoc> gah, missing crl.pem file
13:36 < havoc> new install; how to I create that file again?
13:36 < havoc> can I just "touch" it?
13:42 < gladiatr> are you using easy-rsa?
13:42 < havoc> yes
13:42 < havoc> but from debian lenny
13:43 < havoc> no make-crl script
13:43 < gladiatr> yeah.  I think you can just use an empty file there.
13:44 < havoc> ok
13:44 < gladiatr> I don't remember exactly.  I didn't implement the crl directive until after I had revoked my first cert
13:44 -!- gladiatr is now known as gladiatr_afk
13:44 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:45 < havoc> nope, didn't work
13:46 < gladiatr_afk> hrm... 
13:46 < gladiatr_afk> just a sec here...
13:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:47 < havoc> I'm googling like crazy
13:47 < havoc> can't seem to remember how I got it on the other installs
13:47 < havoc> and the howto is not helping
13:51 < havoc> gah, all I'm finding references the non-existent make-crl
13:51 < havoc> is it an openssl arg?
13:54 < havoc> gah, maybe it can be empty
13:54 < havoc> keys/ dir wasn't readable to the server
13:55 < havoc> oh wait, it is
13:56 < gladiatr_afk> ok
13:56 < gladiatr_afk> got it.  gonna dpaste it
13:56 < havoc> ok
13:56 < havoc> yeah, file can't be empty
13:56 < havoc> like I said, this is debian lenny
13:57 < havoc> I guess I could get the latest tarball and see if the make-crl script is in it
13:58 < gladiatr_afk> http://dpaste.com/514828/
13:59 < gladiatr_afk> there's a gencrl command in the revoke-full script; however, it requires the CN, NAME and OU keys to be defined
13:59 < gladiatr_afk> then the ca gencrl command works like a champ
14:01 < gladiatr_afk> there isn't anything particular to the latest easy-rsa stuff it would seem.  There just isn't script logic to create an empty crl unless its in the context of revoking an existing cert.  I suppose a super-lazy way to do it would be to generate a dummy script and immediately revoke it.
14:01 < havoc> yeah, I just saw that
14:01 < gladiatr_afk> and on that note, I'm off to play in the sun.  Have a good weekend all :)
14:01 < havoc> thanks, later :)
14:10 -!- EugeneKaway is now known as EugeneKay
14:19 -!- faulkner [4334fe96@gateway/web/freenode/ip.67.52.254.150] has joined #openvpn
14:19 < faulkner> !welcome
14:19 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:19 < faulkner> !route
14:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:22 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
14:27 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
14:43 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10546>
15:01 <@vpnHelper> RSS Update - forum: SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html>
15:09 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
15:09 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
15:09 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:10 -!- p3rror [~mezgani@41.140.157.177] has quit [Read error: Connection reset by peer]
15:21 < faulkner> can't seem to locate a fix for this in the doc - our openvpn config is very stable for 10 users but the 11th attempts to connect are failing and logging the  MULTI: no dynamic or static remote --ifconfig address is available for foo/111.111.111.111:40133.  thanks in advance for any assistance.
15:21 < faulkner> not seeing any "MULTI: new incoming connection would exceed maximum number of clients" which i guess would make more sense
15:23 < Bushmills> faulkner: sounds like the ip address pool for openvpn clients is too small
15:25 < faulkner> Bushmills: thanks for the info, I need to look at how to increase - can't see in our server conf where it's limiting
15:26 < Bushmills> maybe --max-clients has been set? or --ifconfig-pool? 
15:26 < faulkner> ifconfig-pool, yes.
15:26 < faulkner> ifconfig-pool-persist ipp.txt
15:26 < faulkner> my understanding was that ipp.txt was updated by the server itself, but maybe this has stopped working or I misunderstand.
15:27 < Bushmills> pool-start-IP/pool-end-IP?
15:27 < faulkner> no poll* directives exist in our config
15:27 < faulkner> pool*
15:27 < Bushmills> --ifconfig-pool start-IP end-IP [netmask]
15:28 < faulkner> Bushmills: thank you very much, I will try this.
15:37 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10548>
15:39 -!- EugeneKay is now known as EugeneDrinKing
15:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:50 -!- faulkner [4334fe96@gateway/web/freenode/ip.67.52.254.150] has quit [Ping timeout: 252 seconds]
15:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
16:09 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
16:34 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has left #openvpn ["WeeChat 0.3.2"]
16:35 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
16:40 -!- eth00 [~Johnrdp@unaffiliated/eth00] has joined #openvpn
16:55 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:20 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
17:22 -!- arl4223 [~aleefmann@213.39.239.226] has joined #openvpn
17:22 < arl4223> hi all
17:23 < arl4223> I have one server which should serve one openvpn-server for mobile clients (read warriors) but at the same time this server should be a site to site openvpn-server
17:23 < arl4223> I can't find a tutorial which describes this setup
17:24 < arl4223> so is here someone who can help me?
17:33 < Bushmills> !clientlan
17:33 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
17:33 <@vpnHelper> better explanation
17:33 < Bushmills> other site would probably be a client too
17:35 < Bushmills> if there's also a LAN behind the machine which is currently server, also... 
17:35 < Bushmills> !serverlan
17:35 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
17:35 < Bushmills> more into detail in ...
17:35 < Bushmills> !route
17:35 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
17:41 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:56 -!- EugeneDrinKing is now known as EugeneKaway
18:26 -!- stryg [~bwtermina@rob92-6-82-231-240-143.fbx.proxad.net] has quit [Quit: @+++]
18:34 -!- mordy [~mordy@69.195.135.251] has quit [Ping timeout: 276 seconds]
18:38 <@vpnHelper> RSS Update - forum: OpenVPN bridging question <http://forums.openvpn.net/topic7802.html>
18:44 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
18:48 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
18:48 < drewr_> !welcome
18:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:49 < drewr_> !route
18:49 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:50 <@vpnHelper> RSS Update - forum: Expecting client to show host's WAN IP, but it's not <http://forums.openvpn.net/topic7788.html#p10550>
18:54 -!- p3rror [~mezgani@41.140.172.212] has joined #openvpn
19:11 -!- luneff [~yury@84.51.201.89] has joined #openvpn
19:16 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Excess Flood]
19:18 -!- dvl [~dvl@nyi.unixathome.org] has joined #openvpn
19:19 -!- dvl [~dvl@nyi.unixathome.org] has quit [Changing host]
19:19 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
19:19 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Excess Flood]
19:19 -!- dvl [~dvl@nyi.unixathome.org] has joined #openvpn
19:20 -!- dvl [~dvl@nyi.unixathome.org] has quit [Changing host]
19:20 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
19:28 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
19:29 -!- arl4223 [~aleefmann@213.39.239.226] has quit [Quit: leaving]
19:37 -!- EugeneKaway is now known as EugeneKay
19:41 < drewr_> Split tunnel to EC2 for remote access config experience?
20:18 -!- rolls [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
20:20 -!- celthunder [~celthunde@rofltech.net] has quit [Ping timeout: 240 seconds]
20:21 -!- celthunder [~celthunde@rofltech.net] has joined #openvpn
20:30 -!- EugeneKay is now known as EugeneKaway
20:42 -!- rolls [~rollin@190.120.228.48] has joined #openvpn
21:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
21:34 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Remote host closed the connection]
22:03 -!- common- [~common@p5DDA45C8.dip0.t-ipconnect.de] has joined #openvpn
22:07 -!- common [~common@p5DDA4BEE.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
22:07 -!- common- is now known as common
22:10 -!- master_of_master [~master_of@p57B53B8B.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
22:12 -!- master_of_master [~master_of@p57B537D8.dip.t-dialin.net] has joined #openvpn
22:31 -!- albech [~thomas@61.7.130.141] has joined #openvpn
23:34 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
23:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
23:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
--- Day changed Sat Mar 19 2011
00:53 -!- assid [~assid@unaffiliated/assid] has joined #openvpn
00:53 < assid> heya
00:54 < assid> okay i got my openvpn instances running fine on dd-wrt and on tomato derivative..
00:54 < assid> now i need some help getting it working on windows server
00:54 < assid> the client is able to connect to the server
00:55 < assid> however.. i am unable to access the local lan behind it
00:55 < assid> im trying to use tunnelling to keep things simple
00:56 < assid> can anyone help with this
00:56 < assid> !windows
00:56 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
01:11 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
01:19 -!- assid1 [~assid@122.170.9.45] has joined #openvpn
01:19 -!- assid [~assid@unaffiliated/assid] has quit [Read error: Connection reset by peer]
01:22 -!- assid1 [~assid@122.170.9.45] has quit [Client Quit]
01:53 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
01:53 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
01:53 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
02:29 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
02:36 -!- albech_ [~thomas@110.164.248.17] has joined #openvpn
02:39 -!- celthunder [~celthunde@rofltech.net] has quit [Ping timeout: 246 seconds]
02:40 -!- albech [~thomas@61.7.130.141] has quit [Ping timeout: 260 seconds]
02:57 <@vpnHelper> RSS Update - forum: multiple servers one ca <http://forums.openvpn.net/topic7803.html> || Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10551>
02:59 -!- celthunder [~celthunde@rofltech.net] has joined #openvpn
03:09 <@vpnHelper> RSS Update - forum: multiple servers one ca <http://forums.openvpn.net/topic7803.html#p10553>
03:19 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
03:26 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
03:27 <@vpnHelper> RSS Update - forum: virtual interfaces eth0:1 <http://forums.openvpn.net/topic7800.html#p10554>
03:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:33 <@vpnHelper> RSS Update - forum: virtual interfaces eth0:1 <http://forums.openvpn.net/topic7800.html#p10555>
03:34 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
03:45 <@vpnHelper> RSS Update - forum: iptables for openvpn <http://forums.openvpn.net/topic7762.html#p10557> || multiple servers one ca <http://forums.openvpn.net/topic7803.html#p10556>
03:51 <@vpnHelper> RSS Update - forum: iptables for openvpn <http://forums.openvpn.net/topic7762.html#p10558>
03:54 -!- oracle_ [~o2@unaffiliated/spice] has joined #openvpn
03:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:57 -!- oracle [~o2@unaffiliated/spice] has quit [Ping timeout: 252 seconds]
03:57 <@vpnHelper> RSS Update - forum: iptables for openvpn <http://forums.openvpn.net/topic7762.html#p10559>
04:10 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
04:18 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
04:28 <@vpnHelper> RSS Update - forum: multiple clients <http://forums.openvpn.net/topic7803.html#p10556>
04:31 -!- OliJG [~OliJG@125.211.130.28] has joined #openvpn
04:32 < OliJG> Is is possible to configure your operating system to not route all traffic through the vpn?
04:32 < OliJG> Or is this conceptually wrong?
04:36 < krzee> not wrong at all
04:36 < krzee> routing internet over the vpn is an OPTION
04:36 < krzee> personally, none of my VPNs are setup for it
04:36 < krzee> although i do have one where i route *some* things over the vpn...
04:36 < krzee> *some internet things
04:37 < krzee> the rest of them are either point to point or for allowing me to access a LAN over the net
04:37 < krzee> so whats your actual goal...?
04:44 < hyper_ch> hi krzee
04:44 < OliJG> Well, unfortunately I'm talking about windows here, where it seems to be the default option
04:45 < krzee> there is no default
04:45 < OliJG> the goal is to get all traffic incoming in a certain port to go through
04:45 < krzee> well openvpn works based on routes, not ports
04:45 < krzee> so yes, conceptually that is wrong
04:45 < krzee> hey hyper_ch =]
04:46 < OliJG> ok, that's a good start
04:46 < OliJG> So, these routes are configured in a config file for openvpn?
04:46 < hyper_ch> krzee: you use linux, right?
04:46 < krzee> !--
04:46 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
04:46 < krzee> hyper_ch, BSD, but close enough for most questions ;]
04:47 < hyper_ch> krzee: then you won't be interested inthe crypto advanced on linux
04:47 < krzee> ahh
04:47 < krzee> well, try me... i might be
04:47 < krzee> im interested in all sorts of stuff i dont use ;)
04:47 < OliJG> Ok, so I'll go off and educate myself about openvpn routing, thanks
04:47 < krzee> OliJG, 
04:48 < krzee> there may be another option for you...
04:48 < OliJG> yes?
04:48 < krzee> you want all your traffic (from windows machine)  to a certain port on any machine to route over the vpn, right?
04:48 < krzee> so like all FTP traffic (port 21) outbound from the windows machine for example
04:49 < OliJG> actually, I'm trying to get all traffic from other computers on the network to go through the vpn setup on a given computer
04:50 < krzee> then why would you ask "<OliJG> the goal is to get all traffic incoming in a certain port to go through"   ??
04:50 < krzee> what you just said has nothing to do with ports
04:50 < krzee> and is doable
04:50 < OliJG> ok, sorry, I had made an assumption about how it would work
04:50 < krzee> you just want your entire LAN to route all internet traffic over the vpn?
04:51 < OliJG> ok, it's still a little more complicated than that, let me explain better
04:51 < krzee> heh
04:51 < krzee> note, im in bed getting ready to try to sleep, so get to the real goal soomn
04:51 < krzee> soon*
04:51 < OliJG> currently I have a setup on Debian where openvpn connects to the vpn and creates an interface
04:52 < OliJG> then I have a program called dante also on that server, that routes all traffic that comes in on 1080 through the vpn interface
04:52 < hyper_ch> krzee: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c029772125594e31eb1a5ad9e0913724ed9891f2
04:52 < krzee> heh cool, i use dante too
04:52 < OliJG> this allows the computers on the network to set that server as a socks proxy
04:52 < krzee> did you get the dante config from me...?
04:52 < OliJG> and it also allows me to know nothing about openvpn :)
04:52 < krzee> hah
04:52 < OliJG> that was just trial and error :)
04:53 < krzee> "that routes all traffic that comes in on 1080 through the vpn interface"
04:53 < OliJG> anyhow, a friend of mine wants the same setup, but for windows
04:53 < krzee> not exactly how it works... but ok
04:53 < krzee> well its the EXACT same setup then
04:53 < OliJG> right, I guess you understand my situation better than I do now :)
04:53 < krzee> on the client side at least
04:53 < OliJG> the trick is that he doesn't want the traffic for the openvpn host to go through (but apparently it does)
04:54 < krzee> well ya, i use dante for selective 'routing' over the vpn
04:54 < krzee> !routebyapp
04:54 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
04:54 < krzee> he just needs to setup his socksifying app correctly
04:54 < krzee> (i use proxifier)
04:55 < OliJG> The setup I have now runs dante on the same computer as openvpn, and it's just a matter of telling firefox that that's the socks proxy
04:55 < OliJG> no client side programs required
04:55 < krzee> heh
04:56 < krzee> but you could send ANYTHING over the vpn with a good socksifying app
04:56 < krzee> not just apps that support it
04:56 < krzee> plus you can do it by app/ip/subnet/port or any combo
04:56 < OliJG> yeah, my brother uses proxifier for gaming :)
04:56 < krzee> well thats what your friend wants
04:57 < krzee> then he can choose what does and does not go over the socks (and therefore over the vpn)
04:57 < OliJG> You're right, that probably would be the best
04:57 < OliJG> for him
04:57 < krzee> assuming the socks server listens on the VPN internal ip
04:58 < krzee> you are only sending firefox over the vpn... means your chat programs are still going over the normal inet connection, as is everything else
04:58 < OliJG> So, mainly I'm wondering how to make sure that openvpn can connect, and not all traffic can be routed through it. It seems that every time I've used it (linux or windows), whenever you start it, your traffic all gets routed through
04:58 < OliJG> yeah
04:58 < OliJG> that's the idea
04:58 < krzee> in my setup, some apps go over the vpn, some dont, and i have very fine grained control over which is which
04:59 < OliJG> You're saying that it's just a matter of configuring openvpn to make sure that nothing gets routed though?
04:59 < krzee> nope
04:59 < krzee> im saying your openvpn setup is fine
04:59 < krzee> and he just needs to setup his client-side socks stuff right
05:00 < krzee> unless of course you missed another part of your goal...
05:00 < OliJG> my first goal is to stop all the traffic from going through openvpn as soon as it starts up
05:00 -!- Saturn2888 [~Saturn288@74-222-192-238.dyn.everestkc.net] has joined #openvpn
05:00 < krzee> !configs
05:01 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
05:01 < Saturn2888> Does anyone here know about which kernel file is required for Android or if there's another place to go to find out about that?
05:01 < OliJG> I don't have the setup available now, so I'll just take my newfound education and figure out what kind of config I need
05:01 < krzee> Saturn2888, you need a rom with tun in the kernel, like cyanogenmod 6 or 7 for example
05:01 < OliJG> Thanks for your help
05:02 < OliJG> krzee: ^
05:02 < krzee> Saturn2888, then you just download openvpn settings, and you're just about done
05:02 < krzee> OliJG, yw
05:02 < Saturn2888> krzee: I was pretty sure you could do it so long as you got another kernel
05:02 < Saturn2888> or a .ko file
05:02 < krzee> Saturn2888, sure, you need tun kernel module or a kernel with tun in it
05:02 < Saturn2888> krzee: OpenVPN settings is installed and I have installed OpenVPN as well. I just have issues w/ the tun tap thing. If it's set to tun it works I believe. Lemme try, I've forgotten
05:03 < Saturn2888> krzee: how do I get the kernel module?
05:03 < krzee> but the furthest i can help you with that is telling you that cyanogenmod works by default (i use it)
05:03 < krzee> its a giant pain in the ass, unless you just use a rom with that stuff in it
05:03 < krzee> which is why i told you about cyanogenmod (which i happen to love)
05:04 < krzee> theres also a cyanogenmod help channel here, with over 500 people in it
05:04 < Saturn2888> I'd rather do the pain in the butt than have to reconfigure my phone
05:05 < Saturn2888> is there a guide or something? :)
05:05 < krzee> cool, good luck =]
05:05 < krzee> nope
05:05 < krzee> the guide is "good luck"
05:05 < krzee> i have been through it
05:05 < krzee> i went with cyanogenmod
05:05 < krzee> you will likely end up changing roms too if you care about running openvpn
05:06 < krzee> but theres no reason you have to skip right to that, go ahead and give it a try if you like ;]
05:06 < krzee> the module will need to be for your exact kernel
05:06 < krzee> then you can tell openvpn settings how to load it
05:06 < Saturn2888> ooh, where's that? So cyanogenmod is a module or a ROM?
05:06 < krzee> cyanogenmod is a rom
05:07 < krzee> its pretty kickass
05:07 < krzee> it enables all the advanced options that are stripped from normal android
05:07 < Saturn2888> ok. What's kickass about it? How it will force me to reconfigure everything? Lol
05:07 < krzee> its a power-user rom
05:07 < Saturn2888> I'm not saying I wouldn't want that. I'm saying I need my phone. I've got too much custom-configured for me to wanna get rid of all that 
05:07 < krzee> do whatever you gotta do then
05:08 < krzee> im just telling you it was a PITA for me, and i went with cyanogenmod
05:08 < krzee> you do whatever you like =]
05:08 < Saturn2888> :)
05:08 < Saturn2888> thanks though
05:08 < krzee> np
05:08 < Saturn2888> where's the guide you had? Or is that the "good luck"?
05:08 < krzee> theres no guide for finding random kernel modules for your exact kernel
05:09 < krzee> that would be one hell of a weird guide...
05:10 < krzee> heres the guide for you:  1) find your kernel version   2) find the module for your exact kernel version   3) load it
05:10 < krzee> ;]
05:10 < Saturn2888> so like HTC EVO 2.2.blah
05:11 < krzee> ahh you have an evo?
05:11 < Saturn2888> yeah
05:11 < Saturn2888> Hahaha. I have a well-known phone :)
05:11 < krzee> lemme see if i can find the evo files
05:11 < krzee> i rooted / setup openvpn on one of those recently
05:12 < Saturn2888> oh cool! Thank you so much krzee :)
05:12 < krzee> thats a damn good phone you have there
05:12 < Saturn2888> thank you so much. I think so myself. I waited from April to October to get it. It wasn't available for SERO Premium at the time.
05:12 < krzee> i just wish it took a SIM
05:12 < krzee> since i dont live in usa, and sprint isnt an option
05:13 < Saturn2888> oh yeah, that'd be nice. You know what? I was having problems with it trying to write the rsync file there. Maybe I'll try again, but it wasn't working I remember bc I couldn't mount -rw
05:14 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
05:15 < Saturn2888> krzee: I bring up rsync bc if I couldn't get that there, I might have issues w/ the kernel module
05:15 < krzee> well just so you know, even if i find this, it will be a new rom still :-p
05:16 < Saturn2888> you're kidding me
05:16 < krzee> the evo was what i had the bitch of a time with finding the kernel module
05:16 < Saturn2888> I remember talking to someone in #htcevo or something like that, and that person said I wouldn't necessarily have to
05:16 < krzee> thats when i decided to never try that again
05:16 < Saturn2888> lol
05:16 < krzee> hes right, can he give you the right kernel module?
05:16 < krzee> :-p
05:17 < Saturn2888> I dunno, it was a months ago. I asked 'how' and he disappeared
05:17 < krzee> hahaha
05:17 < Saturn2888> as is common with IRC
05:17 < krzee> sounds about right
05:17 < Saturn2888> lol
05:17 < krzee> you said how, he said fuck that
05:18 < Saturn2888> haha. I think he was still around
05:18 < Saturn2888> I cant' remember what happened honestly
05:19 < krzee> ohhh i think they are on a VM
05:19 < krzee> lemme check
05:19 < Saturn2888> Oh?
05:20 < krzee> nope those are from when i put android/openvpn on the diamond2 (which i totally dont recommend)
05:21 < Saturn2888> aw :(
05:21 < Saturn2888> haha
05:22 < Saturn2888> By the way, how do you get into adb from the sdk?
05:22 < Saturn2888> found it
05:22 < krzee> how do you get into adb...?
05:22 < Saturn2888> Well I don't remember how to open up the shell
05:22 < krzee> umm, by running adb
05:23 < Saturn2888> ah, adb shell
05:23 < krzee>   adb shell                    - run remote shell interactively
05:23 < krzee> ;]
05:23 < Saturn2888> yeah, took a while. Huh. I can't run as root from adb but I can from a terminal emulator
05:23 < krzee> ya you can
05:23 < krzee> su
05:24 < krzee> you know there is an EVO help channel, right?
05:24 < krzee> #htc-evo
05:24 < Saturn2888> yeah, I knew that. But I did su and it says permission denied. This is so weird.
05:24 < Saturn2888> ah, that's the channel!
05:24 < krzee> then its not rootified :-p
05:25 < Saturn2888> It is
05:25 < Saturn2888> how did I install OpenVPN? haha
05:25 < Saturn2888> I swear it's rooted. That's why I can root from the terminal emulator
05:27 < krzee> well on all my rooted androids if i type su from adb shell, im root
05:28 < Saturn2888> hmm
05:32 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
05:32 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
05:32 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:32 < krzee> well cool, now you're getting help in the right place
05:32 < krzee> goodnight
05:34 < Saturn2888> night!
05:34 < Saturn2888> thanks
05:34 -!- Saturn2888 [~Saturn288@74-222-192-238.dyn.everestkc.net] has left #openvpn ["Have to go!"]
05:51 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
06:46 -!- luneff [~yury@84.51.201.89] has joined #openvpn
06:58 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
07:02 <@vpnHelper> RSS Update - forum: server pushes redirect-gateway <http://forums.openvpn.net/topic7798.html#p10560>
07:30 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
07:45 -!- EugeneKaway is now known as EugeneKay
07:50 -!- EugeneKay is now known as [o][o]
08:04 -!- [o][o] is now known as EugeneKay
08:11 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
08:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
08:34 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:42 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
08:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:38 <@vpnHelper> RSS Update - forum: virtual interfaces eth0:1 <http://forums.openvpn.net/topic7800.html#p10562> || SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html#p10561>
09:44 -!- OliJG [~OliJG@125.211.130.28] has quit [Remote host closed the connection]
09:50 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:58 < hyper_ch> hi krzee
09:58 -!- EugeneKay is now known as [o][o]
10:02 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
10:11 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
10:19 -!- [o][o] is now known as EugeneKay
10:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:31 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:40 -!- dvl [~dvl@pdpc/supporter/active/dvl] has left #openvpn ["Leaving"]
10:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:05 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:14 -!- venom00 [~wer@unaffiliated/venom00] has joined #openvpn
11:14 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
11:19 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 276 seconds]
11:20 -!- takamichi [~pri@ks357561.kimsufi.com] has joined #openvpn
11:27 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
11:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:34 -!- takamichi [~pri@ks357561.kimsufi.com] has quit [Ping timeout: 246 seconds]
11:35 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
11:41 -!- celthunder [~celthunde@rofltech.net] has quit [Ping timeout: 246 seconds]
12:08 -!- celthunder [~celthunde@rofltech.net] has joined #openvpn
12:32 -!- p3rror [~mezgani@41.140.172.212] has quit [Ping timeout: 255 seconds]
12:36 -!- albech_ [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
12:47 -!- p3rror [~mezgani@41.248.109.151] has joined #openvpn
12:54 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:09 -!- ele_ is now known as ele
13:40 -!- Guest68746 [~noname@noname.rula.net] has joined #openvpn
13:44 -!- loompek [~noname@kista.rula.net] has quit [Ping timeout: 260 seconds]
13:50 -!- dchilton [~dchilton@adsl-99-55-250-206.dsl.pltn13.sbcglobal.net] has joined #openvpn
13:53 < dchilton> Hi.  I'm getting rid of my StaticIP service @ home, hoping to keep my mail server running, and use OpenVPN to a VPS host where I have a StaticIP to connect the mailserver to the 'net over its StaticIP.  IN a situation like that, which should be the OpenVPN client and which the server? Both are possible I guess.
13:57 < jg71> itd be strange to put the client onto the vps. transfer the mailserver to the vps and be done with it.
13:58 < dchilton> jg71: Not enought resources there.  I want to keep the server on my home LAN box.
13:59 < jg71> how about just a ssh tunnel then? openvpn for just that is overkill
14:01 < dchilton> jg71: I've just been told "use OpenVPN for that".  I've got no real good reason to *not* use something else.  Seemed to me that OpenVPN was nicely packaged, had tools for keeping the connection up, etc.  Would I have to do all that myself with 'just' an ssh tunnel?  Eventually, I could images using that connection for other stuff ... but, atm, it's just mail/webmail.
14:03 < jg71> i see.
14:04 < jg71> id use the client on the vps then
14:07 < jg71> if you want to do it vice versa (e.g. when you want to use the vps as vpn gateway, or somesuch) you need to add iptables foo. example on server: iptables -t nat -A PREROUTING -p tcp --dport 25 -i venet0 -j DNAT --to yourhomeip:25 
14:08 < dchilton> jg71: same for a ssh tunnel ? (reading now ...)  I guess the right question is which side pings/monitors the connection to keep it up?
14:08 < dchilton> thanks, hadn't gotten to the iptables stuff yet
14:08 < jg71> you can use the keepalive option in ssh(d) config
14:09 < jg71> but openvpn is more robust, yes
14:09 < jg71> dchilton, for the ssh tunnel you can use remote port forwarding
14:10 < jg71> either way, it's a messy setup. but doable :)
14:11 < dchilton> jg71: Okay, thanks.  Messy is understandable.  More robust is good.  I'm more likely to want to "vpn into" my Home LAN on occassion.  Since it'll be a dynamic IP now, I *think* I can do that with a dynamic IP client somewhere in the mix with OpenVPN.
14:11 < jg71> tbh, id let the mailserver @ home just listen on localhost and the local openvpn ip, not the ip you are assigned frrom your iso
14:11 < jg71> *isp
14:12 < jg71>  ^ wrt  yourhomeip:25
14:17 < dchilton> jg71: Yep that makes sense for the mailserver.
14:19 < dchilton> This UVerse "residential gateway" had no real bridge mode, just some badly documented "DMZ+ zone".  I'm trying to (a) pay them a LOT less, and (b) get UN-stcuk from their net mgmt policies :-)  This OpenVPN (maybe tunnel) approach seems like the best bet.
14:20 < jg71> ok, id settle on openvpn server on vps then, with the iptables foo. should work like a charm. 
14:21 < jg71> oh and to keep things simple, a static key setup. it's the most basic one but if you want to use the CA setup, no prob there.
14:21 < dchilton> jg71: Oh, on the vps ? not "use the client on the vps then" ?
14:21 < dchilton> Yep just read about static key setup.  Seems straighforward.
14:22 < jg71> yes, openvpn server on vps. 
14:22 < jg71> you just need to fiddle with the one iptables rule and you are set
14:26 < dchilton> jg71: Just to be clear, and then to "vpn into" my LAN,  come through the VPS server? NOT the dynamic IP at all?
14:27 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
14:27 < DigitallyStoned> does anyone here have any experience on updating DNS an openvpn script?
14:28 < DigitallyStoned> i keep getting an error that i cant figure out when the script runs
14:28 < jg71> you can do that too, but you need to add an iptables rule for every service you run on your home server on the vps. e.g. ssh you need port 22 to be taken care of. same for web services, port 80. dchilton, if that's what you mean by "vpn into your lan"
14:29 < jg71> you can safely use a dyndns service to point to your home machine and let sshd just listen on that connection. 
14:29 < jg71> the approach of putting the openvpn server on the vps is the most flexible
14:29 < jg71> dchilton, ^
14:32 < DigitallyStoned> seems that the issue is with BIND9 and the way it handles the zones, so im at an impass as this script has worked forever on bind8
14:33 < dchilton> jg71: GOt it.  Thanks a log for the help.
14:33 < dchilton> *lot
14:33 < jg71> yw and good luck
14:36 < dchilton> Thx again & bye!
14:36 -!- dchilton [~dchilton@adsl-99-55-250-206.dsl.pltn13.sbcglobal.net] has left #openvpn []
14:49 <@vpnHelper> RSS Update - forum: connection seems made but ping (and traffic) not working <http://forums.openvpn.net/topic7804.html>
14:55 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
15:01 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html>
15:02 -!- Guest68746 is now known as loompek
15:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:13 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10565>
15:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
15:30 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:33 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:42 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 252 seconds]
15:42 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:04 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
16:04 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
16:05 -!- luneff [~yury@84.51.201.89] has joined #openvpn
16:19 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
16:44 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:56 <@vpnHelper> RSS Update - forum: OpenVPN bridging question <http://forums.openvpn.net/topic7802.html#p10566>
17:02 <@vpnHelper> RSS Update - forum: virtual interfaces eth0:1 <http://forums.openvpn.net/topic7800.html#p10568> || SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html#p10567>
17:08 <@vpnHelper> RSS Update - forum: connection seems made but ping (and traffic) not working <http://forums.openvpn.net/topic7804.html#p10569>
17:12 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Read error: Operation timed out]
17:14 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
17:14 -!- luneff [~yury@84.51.201.89] has joined #openvpn
17:21 < ecrist> sup d00ds?
17:21 < jg71> wat
17:23 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
17:57 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
18:04 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
18:26 <@vpnHelper> RSS Update - forum: SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html#p10570>
18:28 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:38 <@vpnHelper> RSS Update - forum: SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html#p10571>
18:48 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
18:52 -!- venom00 [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
18:52 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
18:55 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
18:56 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:56 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
19:17 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
19:32 -!- Meliorator [m@dunnington.eu] has quit [Quit: changing servers]
19:36 -!- Meliorator [m@dunnington.eu] has joined #openvpn
20:14 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
20:25 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
20:25 < crocket> A few days ago, everything in /media and /home was wiped out.
20:25 < crocket> I guessed it was either a cracker or a badly-written openvpn script.
20:26 < crocket> OpenVPN was run as root.
20:34 < crocket> jg71, you are here, too?
20:34 < jg71> no
20:34 -!- jg71 [~edud@unaffiliated/jg71] has left #openvpn ["*.net *.split"]
20:39 -!- jg71 [~edud@unaffiliated/jg71] has joined #openvpn
20:40 < crocket> jg71, It happned on my computer at work.
20:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
20:53 -!- gladiatr_afk [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 248 seconds]
21:01 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
21:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:02 <@vpnHelper> RSS Update - forum: connection seems made but ping (and traffic) not working <http://forums.openvpn.net/topic7804.html#p10572>
21:12 -!- robotti^ [robotti@kapsi.fi] has quit [Read error: Operation timed out]
21:12 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
21:16 < mete> so what's your question crocket?
21:21 < jg71> someone wiped stuff from his shares. only some shares (i guess, not others). so, crocket, was it porn?
21:26 -!- pmatulis [~peter@64.34.151.178] has joined #openvpn
21:27 < pmatulis> i don't want to use the internal nameserver for internet browsing, just for resolving names of internal machines, how shall i proceed?
21:28 < jg71> any chance you can put the machines to /etc/hosts and use a different nameserver in /etc/resolv.conf? 
21:33 < crocket> hmm
21:34 < crocket> jg71, It could be someone else or me.
21:35 < crocket> Or hard disk failure.
21:35 < jg71> had any strong drinks lately?
21:35 < crocket> OpenVPN "up" or "down" script could have caused it since they were run as root.
21:35 < crocket> jg71, I don't drink.
21:35 < jg71> ok, so you dont remember. ok. .... relax, all is fine. 
21:35 < crocket> jg71, Computer is better than alcohol.
21:36 < crocket> All just happened suddenly.
21:36 < jg71> a momentary laps of reason is not uncommon in your age
21:37 < crocket> jg71, I'm serious. Don't make jokes.
21:37 < jg71> did you see a doc about this?
21:37 < jg71> they surely wont make jokes
21:37 < crocket> about what?
21:37 < jg71> see. it's serious and now you joke.
21:37 < jg71> dont play games
21:38 < crocket> I don't play games.
21:38 < crocket> I lost my data, and I am not in mood to play games.
21:38 -!- jg71 [~edud@unaffiliated/jg71] has left #openvpn ["*.net *.split"]
21:38 < crocket> damn...
21:43 < crocket> pmatulis, you there?
21:44 < crocket> pmatulis, internal nameservers forward queries to other nameservers when they don't know how to resolve a DNS Name.
21:44 < krzie> (if they are setup to do that)
21:44 < crocket> pmatulis, make your internal nameserver forward queries that it can't resolve.
21:54 < oc80z> hi
22:03 -!- krzie [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
22:07 -!- common [~common@p5DDA45C8.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
22:09 -!- common [~common@p5DDA4D55.dip0.t-ipconnect.de] has joined #openvpn
22:10 -!- master_of_master [~master_of@p57B537D8.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
22:12 -!- master_of_master [~master_of@p57B57099.dip.t-dialin.net] has joined #openvpn
22:13 -!- EugeneKay is now known as EugeneKaway
22:20 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
22:20 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
22:20 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:21 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:25 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
22:28 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:37 -!- albech [~thomas@110.164.248.17] has joined #openvpn
22:48 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
22:48 < genesis7> anybody here today present?
23:01 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
23:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
23:11 -!- genesis77 [~rommel@amertospromotions.com] has joined #openvpn
23:11 -!- genesis7 [~rommel@amertospromotions.com] has quit [Read error: Connection reset by peer]
23:18 -!- UnterPerro [~UnterPerr@208.176.73.37.ptr.us.xo.net] has joined #openvpn
23:21 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:23 -!- genesis77 [~rommel@amertospromotions.com] has quit [Read error: Connection reset by peer]
23:23 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
23:52 -!- genesis77 [~rommel@amertospromotions.com] has joined #openvpn
23:52 -!- genesis7 [~rommel@amertospromotions.com] has quit [Read error: Connection reset by peer]
23:52 -!- genesis77 [~rommel@amertospromotions.com] has quit [Client Quit]
--- Day changed Sun Mar 20 2011
00:23 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 250 seconds]
00:39 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
01:12 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 255 seconds]
01:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
01:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
01:27 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
01:29 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 250 seconds]
01:34 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
02:05 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
02:43 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html>
02:49 <@vpnHelper> RSS Update - forum: Cannot browse internet push "redirect-gateway def1" WINDOWS <http://forums.openvpn.net/topic7343.html#p10574>
02:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:00 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
03:11 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 248 seconds]
03:41 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Remote host closed the connection]
03:44 <@vpnHelper> RSS Update - forum: virtual interfaces eth0:1 <http://forums.openvpn.net/topic7800.html#p10575>
03:54 -!- oracle [~o2@unaffiliated/spice] has joined #openvpn
03:57 -!- oracle_ [~o2@unaffiliated/spice] has quit [Ping timeout: 276 seconds]
04:05 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Read error: Operation timed out]
04:06 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
04:36 -!- aliverius [~george@athedsl-375084.home.otenet.gr] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
05:38 -!- oracle [~o2@unaffiliated/spice] has quit [Ping timeout: 248 seconds]
05:41 -!- oracle [~o2@unaffiliated/spice] has joined #openvpn
05:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:50 -!- f1assistance1 [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
06:06 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
06:14 -!- venom00ut [~wer@net-188-218-174-50.cust.dsl.vodafone.it] has joined #openvpn
06:14 -!- venom00ut [~wer@net-188-218-174-50.cust.dsl.vodafone.it] has quit [Changing host]
06:14 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
06:16 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
06:16 < zxd> what does this mean FRAG TTL expired i=
06:17 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 240 seconds]
06:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
06:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:48 < crocket> I know it's not a proper place to ask, but I have nowhere else to ask this: What do you call a cylindrical pencil case? Since my primary language isn't english, I don't know what it is called.
06:56 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 276 seconds]
06:56 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:02 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10576>
07:12 -!- lolwut_ [~myname121@87.238.175.161] has joined #openvpn
07:18 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
07:18 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
07:18 -!- lolwut_ [~myname121@87.238.175.161] has quit [Ping timeout: 240 seconds]
07:30 < Bushmills> crocket: udp tunnel?
07:31 < crocket> Bushmills, That's very inventive.
07:44 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Quit: leaving]
07:45 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
08:04 -!- f1assistance1 [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
08:46 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:18 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:22 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:48 -!- EugeneKaway is now known as EugeneKay
10:16 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
10:17 -!- jwm [jwm@dev.dist.us] has quit [Ping timeout: 240 seconds]
10:17 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
10:19 -!- jwm [jwm@dev.dist.us] has joined #openvpn
10:23 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 264 seconds]
10:29 -!- EugeneKay is now known as EugeneKaway
10:30 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
10:30 -!- UnterPerro [~UnterPerr@208.176.73.37.ptr.us.xo.net] has quit [Quit: UnterPerro lives to save another day]
10:31 -!- G [~njones@parera.jnet.net.nz] has quit [Ping timeout: 260 seconds]
10:31 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
10:36 -!- jwm [jwm@dev.dist.us] has quit [Ping timeout: 255 seconds]
10:41 -!- DigitallyStoned [~blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
10:46 -!- DigitallyStoned [~blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit []
10:47 -!- G [~njones@parera.jnet.net.nz] has quit [Ping timeout: 248 seconds]
10:48 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
10:52 -!- jwm [jwm@dev.dist.us] has joined #openvpn
10:54 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 248 seconds]
10:56 -!- G [~njones@parera.jnet.net.nz] has quit [Ping timeout: 260 seconds]
10:57 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
10:58 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has left #openvpn ["Leaving"]
11:25 -!- G [~njones@parera.jnet.net.nz] has quit [Ping timeout: 264 seconds]
11:28 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
11:34 -!- G [~njones@parera.jnet.net.nz] has quit [Read error: Connection reset by peer]
11:34 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
11:35 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
11:40 -!- G [~njones@parera.jnet.net.nz] has quit [Ping timeout: 260 seconds]
11:41 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
12:00 -!- G [~njones@parera.jnet.net.nz] has quit [Ping timeout: 260 seconds]
12:01 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
12:07 -!- G [~njones@parera.jnet.net.nz] has quit [Remote host closed the connection]
12:07 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
12:28 -!- G [~njones@parera.jnet.net.nz] has quit [Ping timeout: 264 seconds]
12:29 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
12:30 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
12:34 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
12:51 -!- p3rror [~mezgani@41.248.109.151] has quit [Ping timeout: 255 seconds]
12:54 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
13:02 -!- EugeneKaway is now known as EugeneKay
13:04 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
13:10 -!- elly [~elly@atheme/member/elly] has joined #openvpn
13:10 -!- G [~njones@parera.jnet.net.nz] has quit [Ping timeout: 264 seconds]
13:11 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
13:25 -!- zxd [~zxd@95.211.21.37] has quit [Ping timeout: 252 seconds]
13:33 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:39 <@vpnHelper> RSS Update - forum: Unable to login after configuring Ethernet Bridging <http://forums.openvpn.net/topic7790.html#p10577>
13:49 -!- p3rror [~mezgani@41.140.157.246] has joined #openvpn
13:51 <@vpnHelper> RSS Update - forum: Acquiring external internet IP <http://forums.openvpn.net/topic7807.html>
14:34 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 252 seconds]
14:35 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
14:45 -!- EugeneKay is now known as EugenePooping
14:48 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
14:56 -!- Nigel_ [~njones@parera.jnet.net.nz] has joined #openvpn
14:58 -!- G [~njones@parera.jnet.net.nz] has quit [Read error: Connection reset by peer]
15:02 -!- Nigel_ [~njones@parera.jnet.net.nz] has quit [Ping timeout: 248 seconds]
15:02 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
15:06 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Remote host closed the connection]
15:06 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:07 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:10 <@vpnHelper> RSS Update - forum: Change VPN node without having to edit client? <http://forums.openvpn.net/topic7808.html>
15:10 -!- EugenePooping is now known as EugeneKay
15:22 <@vpnHelper> RSS Update - forum: Increasing number of config <http://forums.openvpn.net/topic7781.html#p10580>
15:23 -!- G [~njones@parera.jnet.net.nz] has quit [Remote host closed the connection]
15:24 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
15:32 -!- G [~njones@parera.jnet.net.nz] has quit [Remote host closed the connection]
15:32 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
15:39 -!- G [~njones@parera.jnet.net.nz] has quit [Quit: Reconnecting]
15:40 -!- G [~njones@parera.jnet.net.nz] has joined #openvpn
15:40 -!- G [~njones@parera.jnet.net.nz] has quit [Client Quit]
15:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:50 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
16:05 -!- corretico [~luis@201.201.44.82] has joined #openvpn
16:06 -!- corretico [~luis@201.201.44.82] has quit [Client Quit]
16:06 -!- corretico [~luis@201.201.44.82] has joined #openvpn
16:07 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
16:10 -!- corretico [~luis@201.201.44.82] has quit [Client Quit]
16:12 -!- corretico [~luis@201.201.44.82] has joined #openvpn
16:13 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
16:25 -!- oracle is now known as chiptatum
16:48 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
17:04 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
17:05 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
17:05 -!- corretico [~luis@201.201.44.82] has joined #openvpn
17:05 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
17:13 -!- APTX [APTX@phpBB/developer/APTX] has quit [Ping timeout: 260 seconds]
17:15 -!- EugeneKay is now known as EugeneKaway
17:26 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 248 seconds]
17:34 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
17:35 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 3.6.15/20110303024726]]
17:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
17:45 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:49 -!- EugeneKaway is now known as EugeneKay
17:54 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
18:17 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
18:24 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 252 seconds]
18:24 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
18:25 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
18:26 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
18:40 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10581>
18:56 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Now with extra fish!]
18:59 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
19:00 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 276 seconds]
19:07 -!- EugeneKay is now known as EugeneKaway
19:39 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
19:45 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
19:45 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:53 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
19:58 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:04 <@vpnHelper> RSS Update - forum: Issues with remote connectivity on OpenVPN (Ubuntu). Help! <http://forums.openvpn.net/topic7755.html#p10583> || OpenVPN Access Server - Re: Branding <http://forums.openvpn.net/topic7763.html#p10582>
20:05 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
20:09 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
20:15 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:16 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10585> || virtual interfaces eth0:1 <http://forums.openvpn.net/topic7800.html#p10584>
20:22 <@vpnHelper> RSS Update - forum: How to create multi-server vpn <http://forums.openvpn.net/topic7748.html#p10586>
20:24 -!- EugeneKaway is now known as EugeneKay
20:30 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
20:32 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:42 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
20:42 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:52 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
20:54 -!- EugeneKay is now known as EugeneMovie
21:17 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
21:29 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
21:34 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
21:41 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10587>
21:54 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
22:07 -!- common [~common@p5DDA4D55.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
22:09 -!- common [~common@p5DDA4B89.dip0.t-ipconnect.de] has joined #openvpn
22:09 -!- master_of_master [~master_of@p57B57099.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
22:12 -!- master_of_master [~master_of@p57B53D77.dip.t-dialin.net] has joined #openvpn
22:27 -!- toortog` [~nesm6@c-75-69-211-52.hsd1.nh.comcast.net] has joined #openvpn
22:29 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
22:34 -!- albech [~thomas@110.164.248.17] has joined #openvpn
22:55 -!- EugeneMovie is now known as EugeneKaway
23:04 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:30 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
23:51 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:59 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
--- Day changed Mon Mar 21 2011
00:09 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
00:12 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 250 seconds]
00:13 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:35 <@vpnHelper> RSS Update - forum: restrict openvpn client <http://forums.openvpn.net/topic7809.html>
00:37 -!- chiptatum [~o2@unaffiliated/spice] has quit [Remote host closed the connection]
00:42 -!- chiptatum [~o2@unaffiliated/spice] has joined #openvpn
00:59 <@vpnHelper> RSS Update - forum: restrict openvpn client <http://forums.openvpn.net/topic7809.html#p10589>
01:09 < kraut> moin
01:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
01:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
01:23 <@vpnHelper> RSS Update - forum: OpenVPN - Access Non-OpenVPN PC's on LAN? <http://forums.openvpn.net/topic7810.html>
01:27 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
01:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:05 <@vpnHelper> RSS Update - forum: Acquiring external internet IP <http://forums.openvpn.net/topic7807.html#p10591>
02:11 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:11 <@vpnHelper> RSS Update - forum: Increasing number of config <http://forums.openvpn.net/topic7781.html#p10593> || Unable to login after configuring Ethernet Bridging <http://forums.openvpn.net/topic7790.html#p10592>
02:17 <@vpnHelper> RSS Update - forum: OpenVPN - Access Non-OpenVPN PC's on LAN? <http://forums.openvpn.net/topic7810.html#p10594>
02:20 -!- chiptatum is now known as gaddafi
02:23 <@vpnHelper> RSS Update - forum: connection seems made but ping (and traffic) not working <http://forums.openvpn.net/topic7804.html#p10595>
02:29 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10596>
02:35 <@vpnHelper> RSS Update - forum: OpenVPN - Access Non-OpenVPN PC's on LAN? <http://forums.openvpn.net/topic7810.html#p10597>
02:40 -!- dazo_afk is now known as dazo
02:41 <@vpnHelper> RSS Update - forum: OpenVPN - Access Non-OpenVPN PC's on LAN? <http://forums.openvpn.net/topic7810.html#p10598>
02:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:00 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
03:00 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
03:06 <@vpnHelper> RSS Update - forum: OpenVPN - Access Non-OpenVPN PC's on LAN? <http://forums.openvpn.net/topic7810.html#p10599>
03:09 -!- clyons [~clyons@unaffiliated/clyons] has quit [Quit: Leaving]
03:11 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 252 seconds]
03:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:17 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
03:17 <@vpnHelper> RSS Update - forum: connection seems made but ping (and traffic) not working <http://forums.openvpn.net/topic7804.html#p10600>
03:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:30 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
04:11 -!- kc8pxy [~gecko@99-182-113-98.lightspeed.clmboh.sbcglobal.net] has joined #openvpn
04:14 < kc8pxy> ok, yes, i know the problem is my firewall, but I'm not sure wehre. i just recently had to transfer my openvpn server to a new box, and now i can only access the lan ip of the vpn server itself.  i have a pushed route for the lan subnet in the config..     what firewall/routing/snafu causes this for openvpn?
04:14 < kc8pxy> !goal
04:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:15 < kc8pxy> what i want my vpn/lan to do for me, is to let me access the lan behind the vpn, as it did  before i had to change server boxen.
04:15 < kc8pxy> the old iron fried.
04:16 < kc8pxy> but the openvpn worked fine till the iron died.
04:16 < kc8pxy> :)
04:17 < krzie> !route
04:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:17 < krzie> lan is behind the server?
04:17 < krzie> and thank you for reading the topic and following it!
04:17 < krzie> (such a simple task and so often skipped)
04:18 < kc8pxy> krzie:  i've been a frequent vistor :)
04:19 < krzie> ahh =]
04:19 < krzie> if the lan in fact IS behind the server...
04:19 < krzie> !serverlan
04:19 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
04:22 < krzie> it could very well be !route_outside_openvpn if you either have a new router or your server is on another lan ip than the old server
04:23 < kc8pxy> krzie: i have my openvpn,  before my old server hardware fried, i could connect to the openvpn server,  and roam the lan as though i was there, physically.  we expected the old server to go,  so i coppied the keys and configs  before the crash, and installed them on the new server. now i get most of the old stuff. i can connect, i can ssh to the ip of the server itself,  and daisy-chan my ssh to elsewhere,   but not directly fr
04:24 < kc8pxy> !route_outside_openvpn
04:24 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
04:25 < krzie> if the server is on a different lan ip, thats your problem
04:25 < kc8pxy> "different" lan ip?
04:26 < krzie> what IP is your server on its lan?
04:26 < kc8pxy> .........
04:26 < krzie> is that a hard question? :-p
04:27 < kc8pxy> gateway ip for one subnet is 10.32.64.41, and the ip for the aalias of that interface is 10.32.2.42 :)
04:27 < kc8pxy> yeah..   the lan ip is more than one,  for one physical interface.
04:27 < kc8pxy> ......
04:28 < krzie> which lan are you trying to reach?
04:28 < kc8pxy> 10.32.64.0/24
04:28 < krzie> was the old server ALSO 10.32.64.41 ?
04:28 < kc8pxy> no, it was 10.32.64.42
04:29 < krzie> there we go
04:29 < krzie> is the server the gateway for 10.32.64.0/24 ?
04:29 < kc8pxy> yes
04:29 < krzie> aka, the defaultrouter
04:29 < krzie> the route to the internet
04:29 < kc8pxy> yes
04:29 < krzie> their routing table has 0.0.0.0 going to 10.32.64.41?
04:30 -!- toortog` [~nesm6@c-75-69-211-52.hsd1.nh.comcast.net] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
04:31 < krzie> better yet, pastebin a routing table from one of the LAN machines
04:31 < krzie> netstat -rn
04:31 < kc8pxy> one sec.
04:32 < kc8pxy> http://pastebin.com/qcUWV3fN
04:32 < kc8pxy> that's a lan machine
04:33 < krzie> hrm ok
04:33 < krzie> so its not !route_outside_openvpn
04:34 < krzie> looks like linux, lets see your iptables rulesets
04:34 < kc8pxy> for....??
04:34 < krzie> im guessing you didnt save your firewall config when you saved your ovpn configs and whatnot
04:35 < krzie> because if you are using the same configs (so they are tested and work right), and you dont need a route on the router because the server IS the router, then firewall seems to be whats left
04:35 < kc8pxy> krzie:  yes and no.  i have the old hdd, but we changed from debian to openssuse,  and shorewall doesn't play very nice on opensuse.. 
04:36 < krzie> as you noted as you entered ;]
04:36 < krzie> oh and even more-so now that you say you are managing your firewall differently ;]
04:36 < kc8pxy> krzie: if you read up, my first thought and admission was that i know it's the new firewall.. i just don't know what part :)
04:37 < kc8pxy> hehe
04:37 < krzie> you prolly dont have tun+ allowed in the forward chain or something
04:37 < krzie> yep, thats what i was referring to when i said <krzie> as you noted as you entered ;]
04:37 < kc8pxy> which table??  it's been a long time since i handled iptables manually.
04:37 < krzie> i dont even run linux
04:38 < krzie> see your manual, post all tables
04:38 < krzie> im a bsd user ;]
04:38 < kc8pxy> hehe..  i forgot to look up before i hit enter.
04:40 < kc8pxy> krzie: i've looked at and almost tried bsd a few times,   but from what i've seen, i'd need more time to get it working nice.  definitely common roots with linux, but different like european spanish and mexican spanish,  as a language.
04:42 < krzie> si, pero el 'hierarchy' de freebsd esta mas limpio que el de linux si me preguntas ;]
04:45 < kc8pxy> :) i don't speak either,  but my brother does,  and that's what he says.
04:46 < kc8pxy> http://pastebin.com/iWARrfSn
04:47 < kc8pxy> tha'ts thw basic, non-NAT, non-mangle table
04:47 < krzie> whoa, if you google translate the word freebsd it changes to FreeBSD
04:47 < krzie> and linux stays lower-case, lol
04:47 < kc8pxy> eheh
04:47 < krzie> http://translate.google.com/translate_t?hl=&ie=UTF-8&text=si,+pero+el+'hierarchy'+de+freebsd+esta+mas+limpio+que+el+de+linux+si+me+preguntas&sl=es&tl=en#
04:47 <@vpnHelper> Title: Google Translate (at translate.google.com)
04:49 < krzie> ahh ok ya im guessing the problem is somewhere in there
04:49 < krzie> try changing defaults to accept and see if it works
04:50 < kc8pxy> .........
04:50 < kc8pxy> ........
04:50 < krzie> if it does, then you are getting somewhere, and you can start removing those default accepts until it breaks
04:50 < kc8pxy> i'm not sure changing defaults to accept on my main firewall box for the site is a good idea.
04:51 < krzie> im not sure figuring this stuff out on a live gateway is a good idea either, but it seems to be what you went with ;]
04:52 < kc8pxy> krzie: it's a small hosting site, and all the services went down when the old gateway meelted.  this was in progress and close to workable, that said,  it's aalready been down for a day+.  
04:52 < krzie> but ya, you could always get someone with skills with iptables and diagnose it by hand, i expected an easier ruleset
04:53 < krzie> but ild be happy to take a look at configs and logs if you want confirmation they are fine, but i expect that they are since it was a working setup before the move
04:53 < kc8pxy> krzie:  one ting i've come to learn from suse..   it's tighter and stronger for servers than most of the other distros i've tried in recent years,   but that also makes untangling the ball of yarn by hand a bit trickeier.
04:54 < krzie> which leaves the firewall, which happens to be reconfigured from scratch and far from default ;]  so i believe the problem is in fact in there
04:54 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p10601>
04:55 < krzie> thats interesting, what makes you say its tighter and stronger...?
04:56 < krzie> it runs the exact same kernel, and what processes listen is up to you... i would assume gentoo would be the tighter and stronger since it comes with damn near nothing on it by default (of course you still need to install stuff to make it useful)
04:58 < krzie> but when i say gentoo, i mean comparing all in default state
05:00  * krzie is reminded of openbsd's claim of being the most secure by default, and that they achieved that by having it be basically useless by default... and once you start running stuff to make it useful, its no longer default so you manually caused whatever may be insecure about it
05:03 < kc8pxy> krzie: i've been a gentoo user,  and yes i could mold  a system/network by hand with more control, suse has let me do more in less time, because it stacks liek masonry  blocks, and i can configure it simpler.  most of the time.
05:04 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:04 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:06 <@vpnHelper> RSS Update - forum: Acquiring external internet IP <http://forums.openvpn.net/topic7807.html#p10603> || Change VPN node without having to edit client? <http://forums.openvpn.net/topic7808.html#p10602>
05:08 -!- dazo is now known as dazo_afk
05:13 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
05:18 -!- zxd [~zxd@95.211.21.37] has quit [Ping timeout: 252 seconds]
05:27 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
05:29 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
05:38 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:38 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
05:41 -!- psycodad [~cschnee@2001:4060:4419:b1:202:a5ff:fe84:e21c] has joined #openvpn
05:42 -!- gaddafi_ [~o2@unaffiliated/spice] has joined #openvpn
05:43 < psycodad> hello, I am setting up my own CA for the first time and I am wondering if I can set the real hostname instead of "server" as instructed in the howto when running "build-key-server server" ?
05:43 -!- gaddafi [~o2@unaffiliated/spice] has quit [Read error: Operation timed out]
05:56 -!- mordy [~mordy@69.195.135.251] has joined #openvpn
06:03 < mordy> i'm looking for a way to deal with multiple server connections; e.g. multiple client connections to different servers. specifically, i'd like a way to manage them all programmatically via some language binding e.g. perl, python etc.
06:04 < mordy> there's at least one GUI tool that handles this (tunnelblick?), but i don't want a gui
06:09 < krzie> psycodad, sure
06:09 < krzie> mordy, just run openvpn on each of the configs
06:12 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
06:12 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
06:12 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
06:18 -!- zxd_ is now known as zxd
06:24 < mordy> i'd need something more involved where i'd be able to handle connections being lost, different IP changes etc. - i was thinking about writing a daemon that polled management ports from various processes
06:27 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
06:32 -!- dazo_afk is now known as dazo
06:47 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
06:48 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10604>
06:48 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
06:54 <@vpnHelper> RSS Update - forum: linux bridge eth interface with openvpn and DHCP <http://forums.openvpn.net/topic7811.html>
06:58 < psycodad> krzie: ty
07:00 <@vpnHelper> RSS Update - forum: OpenVPN & ARP <http://forums.openvpn.net/topic7812.html>
07:02 < psycodad> under windows, do i need to manually create a tap adapter for each connection ?
07:03 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has joined #openvpn
07:06 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
07:06 -!- LuckyY_ is now known as LuckyY
07:12 -!- tf87 [~tf1987@office.neteasyinc.com] has quit [Read error: Connection reset by peer]
07:36 <@vpnHelper> RSS Update - forum: OpenVPN & ARP <http://forums.openvpn.net/topic7812.html#p10607>
07:48 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
08:11 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:18 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
08:18 -!- mode/#openvpn [+o mattock] by ChanServ
08:26 < dschuett> what is the command to remove comment lines from config files
08:30 <@vpnHelper> RSS Update - forum: OpenVPN & ARP <http://forums.openvpn.net/topic7812.html#p10608>
08:37 < dschuett> I can ping LAN behind server from client, but cannot ping LAN behind client from server... here is what i'm working with: http://pastebin.com/mvgMu26k
08:40 < ecrist> !config
08:40 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
08:40 < ecrist> !configs
08:40 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
08:40 < ecrist> dschuett: you're looking for the grep command.
08:40 < ecrist> ;)
08:40 < dschuett> ecrist: got it...thanks!
08:41 < dschuett> ecrist: would you mind taking a look at my post above?
08:43 <@vpnHelper> RSS Update - forum: OpenVPN & ARP <http://forums.openvpn.net/topic7812.html#p10609>
08:45 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
08:45 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
08:45 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:49 < ecrist> dschuett: see here
08:49 < ecrist> !route
08:49 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
08:49 < ecrist> !iroute
08:49 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
08:49 < ecrist> see the routing link from the first thing.
08:51 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
08:51 < kc8pxy> ecrist:  !iroute ???   yours mine and ours?
08:52 < ecrist> what?
08:52 < kc8pxy> ecrist:  the only reason i can think of the example making semsnse is when you basically want to bridge 2 networks, joined atthe vpn :)
08:53 < kc8pxy> yours, mine, and ours :)
08:53 < ecrist> kc8pxy: reads dschuett's post above, and you'd see that's what he wants.
08:53 < kc8pxy> ecrist:  i just flipped back here.  i had not read up at all for the last few hours.
08:54 < ecrist> ah, well, generally, it's polite to have context before piping in. ;)
08:55 < kc8pxy> ecrist:  mebbe   you can help me with my firewall issue?  i took a working openvpn from a melted server, and put it in a new server..  now vpn connects fine,  but client can only see the server's lan ip, and nothiing behing the vpn  beyond that..  ideas?
08:55 < dschuett> ecrist: i have followed that post to the T with no avail. - essentially, what i have above is exactly what that link is stating, except i set the routes manually
08:56 < kc8pxy> ecrist:   true,  but i've been up for at least 18 hours,  and i'm borderline slap-happy..  :)
08:56 < dschuett> it is just weird, because as you can see by the routing tables on both the client and the server...that this SHOULD be working both ways :P ... should, haha
08:57 < ecrist> dschuett: do the client-LAN systems know how to route to the VPN?
08:58 < dschuett> ecrist: as of now i am testing from the two openvpn machines only (which are also my gateway/firewalls)
08:58 < ecrist> firewall?
08:58 < dschuett> iptables
08:59 < ecrist> I mean, are you sure it's not blocking the traffic?  I don't know iptables
08:59 < dschuett> positive
09:01 < dschuett> it is weird, because i can't even ping the openvpn client by it's lan ip from the server... and that is the first point of contact
09:06 <@vpnHelper> RSS Update - forum: Problems while connecting to AD <http://forums.openvpn.net/topic7813.html>
09:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
09:41 <@vpnHelper> RSS Update - forum: OpenVPN & ARP <http://forums.openvpn.net/topic7812.html#p10612>
09:48 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 240 seconds]
09:49 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:49 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:49 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:53 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:02 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
10:08 -!- corretico_ [~luis@186.176.7.194] has quit [Quit: Leaving]
10:15 -!- dchilton [~dchilton@adsl-99-55-250-206.dsl.pltn13.sbcglobal.net] has joined #openvpn
10:19 < dchilton> Hi.  I've set up a VPS as an openvpn server.  openvpn connects to clients over a tun interface, with ip = 10.1.1.1.  The VPS has an Apache server.  For access by clients over the vpn, should that web-server listen @ the openvpn interface ip, 10.1.1.1?  Or do i set it up to listen up a ethernet alias, eth0:2 = 10.1.1.3, e.g., and do some sort of routing?
10:20 < dchilton> s/listen up a/listen at an/
10:24 < gladiatr> dchilton, it won't work to have eth0:2 with an IP address on the same subnet as your vpn clients.
10:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:25 < gladiatr> dchilton, you could put the http server on 10.2.1.1 and push a route for 10.2.1.0/24 to the clients, though
10:25 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
10:25 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
10:25 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:26 < dchilton> gladiatr: Hi. So effectively a 10.2.1.0/24 "DMZ"?
10:28 < gladiatr> hrm... I wouldn't call it a DMZ, per se.  That has more to do with how your firewall is set up.  Just think of it as "another network"
10:28 < pmatulis> i don't want to use the internal nameserver for internet browsing, just for resolving names of internal machines, how shall i proceed?
10:29 < gladiatr> pmatulis, what OS on your client?
10:29 < pmatulis> gladiatr: 'buntu
10:30 < gladiatr> pmatulis, the way I do this is to run a local cacheing name server.  I configure it to forward lookups for the VPN networks (forward and reverse) to the remote DNS server while forwarding everything else to my local name server.
10:30 < gladiatr> It's a bit of work if you've never configured a name server before.  I use BIND because I know it and am lazy, but there are several light-weight options that will undoubtedly do the trick.
10:31 < dchilton> gladiatr: Okay, thanks.  I'm not at all "up" on the lingo/usage yet.  Especially around routing :-(  Would there be any up/down side to using IPv6 instead of IPv4 for the VPN link?
10:31 < pmatulis> gladiatr: yeah, i need to do the reverse b/c there are many other people involved (as clients)
10:32 < gladiatr> dchilton, ipv6 is not considered a "stable" feature yet.  I haven't experimented with it yet.  I'd have to look but I think there's beta-ish support for ipv6 in 2.2
10:33 < dchilton> gladiatr: Didn't realize it was still "beta-ish".  I'd read some folks use it, which is the extent of my knowhow about it - so far.
10:34 < gladiatr> dchilton, indeed.  What I've seen seems positive, though.  If it's not in 2.2, you'll definitely find it in the -current/head/whateva branch
10:37 < dchilton> gladiatr: I think then I'd better stick with IPv4 for now, and not complicate my life until I have a better handle on openvpn.  Atm my distro packages openvpn 2.1.4 ... 
10:37 <@vpnHelper> RSS Update - forum: OpenVPN & ARP <http://forums.openvpn.net/topic7812.html#p10613>
10:39 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
10:41 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
10:45 < dchilton> gladiatr: when you said "push a route for 10.2.1.0/24 to the clients", did you mean atcually use 'push' somewhere in the openvpn config? or something more general in my kernel/os config?
10:50 < gladiatr> dchilton, in the openvpn config
10:51 < gladiatr> would be something along the lines of: push "route 10.1.1.0 255.255.255.0"
10:51 < dchilton> gladiatr: thanks, that's what I figured, more or less.  /me trundles off to find a good openvpn book-for-dummies ...
10:51 < gladiatr> :D
10:51 < gladiatr> g'luck 
10:52 < dchilton> gladiatr: :-)  i'm only slighly worried that i'll inadvertenly route my VPN to the State Ministry in China, or some such ...
10:53 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 255 seconds]
10:53 < gladiatr> hahaha
10:54 < dvl> ecrist: wait, do not mail that check yet.  ;)
10:55 < dchilton> gladiatr: thanks a lot.  bye.
10:55 -!- dchilton [~dchilton@adsl-99-55-250-206.dsl.pltn13.sbcglobal.net] has left #openvpn []
10:59 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
11:02 < ecrist> dvl: copy.
11:03 < dvl> ecrist: email sent
11:13 -!- SmokeyD [~SmokeyD@93.125.157.31] has joined #openvpn
11:13 < SmokeyD> hey everyone. Are there any docs on how to create an up script on a linux client which sets dhcp options, pushed by the openvpn server?
11:14 < SmokeyD> the #dhcpcaveats link on http://openvpn.net/index.php/open-source/faq.html doesn't seem to exist anymore
11:14 <@vpnHelper> Title: FAQ Community (at openvpn.net)
11:14 < SmokeyD> and the only link there is to a microsoft KB article
11:15 < SmokeyD> I guess I need to do something with the foreign_option_n environment variables, but other than the manpage telling me I should do something with it, I can't find any docs on it
11:15 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
11:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 248 seconds]
11:28 -!- EugeneKaway is now known as EugeneKay
11:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:34 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
11:36 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
11:40 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 255 seconds]
11:42 -!- celthunder [~celthunde@rofltech.net] has quit [Ping timeout: 240 seconds]
11:43 -!- dchilton [~dchilton@adsl-99-55-250-206.dsl.pltn13.sbcglobal.net] has joined #openvpn
11:44 < dchilton> Hi.  I've got my client and server, wach with lans behind them, connected and routing correctly.  At boot, the server comes up properly.  If I *restart* the server service, it fails with: "Linux ip addr add failed: external program exited with error status:" 
11:44 < dchilton> More here: http://pastebin.com/sJwszGnu
11:45 < dchilton> I have an 'up' script, like I read.  Do I also need a 'down' script to clear some cruft out?
11:45 -!- celthunder [~celthunde@rofltech.net] has joined #openvpn
11:48 < gladiatr> what is your up script doing?
11:49 < gladiatr> dchilton, bah.  sorry.  gotta run for a bit.  I'll look for your response when I get back.
11:49 -!- gladiatr is now known as gladiatr_afk
11:49 < dchilton> gladiatr_afk: thanks.  the 'up' script just does: "/sbin/route add -net 10.1.1.0 netmask 255.255.255.0 gw x.x.x.x"
11:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
11:55 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
11:55 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
11:55 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
11:59 <@vpnHelper> RSS Update - forum: Change VPN node without having to edit client? <http://forums.openvpn.net/topic7808.html#p10614>
12:01 -!- joeyend [~jl@112.205.220.234] has joined #openvpn
12:01 < joeyend> !welcome
12:01 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:01 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
12:01 < joeyend> !goal
12:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:03 -!- joeyend [~jl@112.205.220.234] has quit [Client Quit]
12:16 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
12:17 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
12:18 -!- albech [~thomas@110.164.248.17] has quit [Quit: Ex-Chat]
12:20 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 252 seconds]
12:41 <@vpnHelper> RSS Update - forum: Change VPN node without having to edit client? <http://forums.openvpn.net/topic7808.html#p10615>
12:45 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 240 seconds]
12:46 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
12:52 -!- gaddafi_ is now known as gaddafi
12:55 -!- p3rror [~mezgani@41.140.157.246] has quit [Ping timeout: 255 seconds]
13:05 <@vpnHelper> RSS Update - forum: Change VPN node without having to edit client? <http://forums.openvpn.net/topic7808.html#p10617> || OpenVPN + Remote Desktop speed <http://forums.openvpn.net/topic7814.html>
13:06 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:11 <@vpnHelper> RSS Update - forum: Change VPN node without having to edit client? <http://forums.openvpn.net/topic7808.html#p10618>
13:13 < krzie> mordy, 
13:13 < krzie> [07:24]  <mordy> i'd need something more involved where i'd be able to handle connections being lost, different IP changes etc. - i was thinking about writing a daemon that polled management ports from various processes
13:13 < krzie> i have no idea what you mean
13:13 < krzie> and without understanding your goal, i can in no way help
13:26 -!- EugeneKay is now known as EugeneKaway
13:26 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
13:26 -!- SerajewelKS [devnull@wikipedia/Crazycomputers] has left #openvpn []
13:27 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
13:34 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:21 -!- gladiatr_afk is now known as gladiatr
14:35 -!- dazo is now known as dazo_afk
14:39 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:47 < dchilton> When openvpn complains "RTNETLINK answers: File exists" @ attempt to start, *what* file is it talking about?
14:58 < mordy> it's not reall a file, but you'll usually get that when you add a default route again
14:58 < mordy> probably just a strerr from EEXISTS or whatever
15:00 -!- Guest68746 [~noname@kista.rula.net] has joined #openvpn
15:01 < dchilton> mordy: i'm getting that when I *re*start openvpn.  I thought the init script would do all the route-ing stuff, but maybe no?  Do I need to tear down routes manually?
15:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
15:01 -!- loompek [~noname@noname.rula.net] has quit [Ping timeout: 255 seconds]
15:07 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has quit [Quit: Leaving]
15:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
15:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:18 -!- TACPILOT [~tacpilot@c-76-31-248-181.hsd1.tx.comcast.net] has joined #openvpn
15:19 < TACPILOT> !welcome
15:19 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:19 < TACPILOT> !goal
15:19 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:20 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
15:21 < dchilton> !topology
15:21 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
15:21 < TACPILOT> I am trying to connect multiple clients to server with single shared cert's clients connect fine except server keeps giving all clients the same adress
15:22 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:22 < TACPILOT> does each client need custom cert or cant they use a single cert shared on a group basis ?
15:26 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has left #openvpn []
15:26 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
15:30 < TACPILOT> and the currently assigned address doesn't match what is stored in 1pp.txt
15:30 < TACPILOT> err  ipp.txt
15:32 -!- dazo_afk is now known as dazo
15:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 248 seconds]
15:42 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
15:50 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 240 seconds]
15:59 < krzee> !ipp
15:59 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
15:59 < krzee> [13:22]  <TACPILOT> does each client need custom cert or cant they use a single cert shared on a group basis ?
15:59 < krzee> it *can* be done, but should not be done unless you also use password auth
16:00 < krzee> or some other dual-factor auth
16:06 -!- EugeneKaway is now known as EugeneKay
16:08 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
16:17 < TACPILOT> so are dynamic ip's generated on a per cert basis? and in what file would clients cert/ip relation be kept?
16:18 < TACPILOT> where does server hold currently assigned ip's and who they belong to  ??
16:31 < krzee> !management
16:31 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface, or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
16:31 < krzee> !static
16:31 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
16:31 < krzee> !ccd
16:31 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
16:31 < krzee> management is for knowing who is connected, with what ip
16:31 < krzee> the other 2 are related to using REAL static ips, unlike ipp.txt
16:32 < krzee> and you should use a unique cert for each client
16:37 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:51 -!- SmokeyD [~SmokeyD@93.125.157.31] has quit [Remote host closed the connection]
16:54 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 260 seconds]
17:00 < dchilton> I'm bouncing around between various docs, man pages, examples, etc.  I can bring my vpn server up @ boot, but it fails consistenly if I manually restart.  Are there any known-to-work server-mode configs anyone can point to?
17:08 -!- dchilton [~dchilton@adsl-99-55-250-206.dsl.pltn13.sbcglobal.net] has quit [Remote host closed the connection]
17:12 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10619>
17:14 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
17:15 -!- EugeneKay is now known as EugeneMovie
17:15 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Read error: Operation timed out]
17:15 -!- LuckyY_ is now known as LuckyY
17:24 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:31 -!- luneff [~yury@84.51.201.89] has joined #openvpn
17:54 -!- dazo is now known as dazo_afk
17:58 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
18:01 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
18:03 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
18:04 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
18:05 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
18:05 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
18:13 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
18:28 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
18:41 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Ping timeout: 260 seconds]
18:56 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
19:07 -!- EugeneMovie is now known as EugeneKay
19:18 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has joined #openvpn
19:19 < netrjay45> can some one help me?
19:20 < netrjay45> I set up the config files, and generated the certificate and key files,
19:20 < netrjay45> and was able to connect to my server from another computer, but I am not sure if it working
19:21 < netrjay45> !welcome
19:21 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:24 < netrjay45> !goal
19:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:25 < netrjay45> hello?
19:27 < netrjay45> !logs
19:27 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
19:32 < majuk> netrjay45, Easiest way to test if it's working is to ping the server, usually the .1 host on your VPN's subnet
19:32 < majuk> Assuming it responds to pings.
19:33 < netrjay45> I tried pinging on each computer, and the server is running a webserver and I couldn't connect to that either
19:33 < majuk> Then one would assume it isn't working.
19:34 < netrjay45> Ill post the logs and configs on pastebin
19:34 < majuk> Sounds like a plan
19:36 -!- corretico_ [~luis@186.176.7.194] has quit [Quit: Leaving]
19:37 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
19:40 < netrjay45> configs: http://pastebin.com/mvd5WZnd
19:40 < netrjay45> logs http://pastebin.com/PZuqg4bW
19:43 < netrjay45> the network connection details dialog in windows 7 says that there is no IPv4 default gate way, but there is a DHCP server (10.8.0.0) and it is assigned an address (10.8.0.10)
19:43 < netrjay45> majuk
19:43 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
19:43 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
19:44 -!- ldaguilar [~luis@186.176.7.194] has quit [Read error: Operation timed out]
19:45 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
19:49 < netrjay45> majuk?
19:51 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:53 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
19:55 < netrjay45> hello?
19:56 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
20:01 -!- netrjay45_ [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has joined #openvpn
20:02 -!- netrjay45__ [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has joined #openvpn
20:02 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has quit [Ping timeout: 276 seconds]
20:04 < netrjay45__> ...
20:04 -!- netrjay45__ [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has quit [Client Quit]
20:05 -!- netrjay45_ [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has quit [Ping timeout: 255 seconds]
20:06 -!- oc80z [oc80z@blea.ch] has quit [Read error: Connection reset by peer]
20:07 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has joined #openvpn
20:08 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:08 -!- js_ [~js@213.180.83.163] has quit [Ping timeout: 276 seconds]
20:08 -!- js_ [~js@213.180.83.163] has joined #openvpn
20:09 < netrjay45> I posted the logs and the configs, can some one help me?
20:10 < Bushmills> looks good. seems that client connects to server
20:10 < krzee> common problem in windows 7 methinks
20:10 < krzee> it should be all over google
20:10 < Bushmills> !firewall
20:10 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
20:10 < krzee> i remember when windows 7 came out, everyone had the problem
20:11 < krzee> its that the tap adapter is considered public and not private, or something like that
20:11 < krzee> (i dont use windows, im going from memory)
20:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
20:12 < Bushmills> any reason to have settled for tap?
20:13 < netrjay45> I was planning on having multiple computers connect to the server...
20:13 < Bushmills> that's unrelated to use of tun vs tap
20:13 < netrjay45> im not 100% sure on the difference between tap and tun, what is it exactly?
20:13 < Bushmills> !tunortap
20:13 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
20:13 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
20:14 < Bushmills> in short,  ip address based addressing vs. mac based addressing
20:15 < krzee> oh i didnt even notice it was dev tap, i just meant the windows driver (it does tun, but is called tap)
20:16 < Bushmills> you missed that, as certified tap antagonist?
20:16 < netrjay45> I'll try changing it to tun and try again I guess. all I have to change is the server config, right?
20:17 < Bushmills> on unixoids, on both server and client.  on windoid client, i'm not sure.
20:19 < krzee> Bushmills, i actually didnt look at the links, his description led me to believe its the common windows7 issue
20:21 < netrjay45> ok, so i changed both of the config files and am firing the services back up
20:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:24 < krzee> Bushmills, they must match regardless of OS
20:24 < krzee> in the config
20:24 < krzee> in windows its *called* tap, but it does tun just fine
20:26 < krzee> (not that i expect you'll be installing windows anytime soon, but knowledge for the sake of knowledge is always fun ;)
20:34 < Bushmills> i did an openvpn installation on a windows machine, about half a year ago, actually
20:34 < netrjay45> for some reason it can't connect to the server...
20:34 < Bushmills> wasn't my machine, though
20:35 < netrjay45> my internet is acting up very strangly, I am still connected to this IRC, but I can't load simple websites like google.com or yahoo.com
20:36 < Bushmills> try to reset your router
20:36 < netrjay45> we did that a minute ago, thats why I was joining like 3 times before
20:37 < Bushmills> mtr can be helpful to spot problems with hops
20:48 < krzee> ya i had a BGP problem with google the other night too
20:48 < krzee> it was dying in florida at level3
20:49 < netrjay45> sorry it took so long, I think its working, 10.8.0.1 now brings up the webserver
21:16 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has quit [Quit: Leaving]
21:28 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 250 seconds]
21:30 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
21:43 -!- dchilton [~dchilton@adsl-99-55-250-206.dsl.pltn13.sbcglobal.net] has joined #openvpn
21:46 < dchilton> Not a good day for me with openvpn :-(  I have a laptop on which I want to install openvpn so when @ a remote site I can tunnel through whatever firewall's in place to get to *my* server.  Reading, though, I've come to think that I can't do this without modifying the firewall ... which I don't control.  1st basic question -- can I do this?
21:48 < Bushmills> !redirect-gateway
21:48 < Bushmills> you need to be able to connect to remote openvpn server, though
21:49 -!- mugwort13 [~mugwort13@pool-173-64-81-93.bltmmd.fios.verizon.net] has joined #openvpn
21:52 < mugwort13> Hi all, quick question, hope this is the right place.  If one were to connect to an asterisk server over openvpn, then the voice data should be encrypted as well, yes?  As long as it never travels outside the vpn.
21:53 < dchilton> Bushmills: redirect-gateway on the client side?  I *do* see connection negotiation between the client and server, but have never gotten ping to work yet.
21:54 < Bushmills> either that, or pushed by server. same result.
21:55 < Bushmills> well, you need client connection to server established before redirect-gateway can have3 any effect.
21:55 < Bushmills> don't try it in the hope that it would help you fixing a problem with not being able to connect to server 
21:55 < Bushmills> it won't
21:57 < dchilton> Bushmills: if 'connect to server' here is defined as 'see handshakes on both ends' and e.g. "Initialization Sequence Completed", then I'm connected.  If connected means "can ping", then I'm not connected.
21:58 < Bushmills> does client show a tun0 interface after it supposedly connected to server?
21:59 < dchilton> Bushmills: No it does not. Which has me rather confused, as without it I'm not sure how it's communicating at all.
21:59 -!- EugeneKay is now known as EugeneKaway
22:00 -!- mugwort13 [~mugwort13@pool-173-64-81-93.bltmmd.fios.verizon.net] has quit [Quit: mugwort13]
22:00 < Bushmills> nor tun*, no tap* ?  then you can safely assume that client is not connected
22:00 < dchilton> Bushmills: client is set to use 'tun1', but I do NOT see it in "ifconfig" output
22:01 < Bushmills> well, that needs to be fixed.
22:01 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:01 < dchilton> Bushmills: Happy to learn.  I'm at 13+ hours on this and going crosseyed ..
22:02 < Bushmills> a. determine cause of problem
22:03 < dchilton> Of course.  I've no clue.
22:03 < Bushmills> that's what logs are helpful with
22:03 < dchilton> Bushmills: Not if you don't know what they're telling you I'm afriad.
22:04 < Bushmills> focusing on keywords like "failure to", "error" and such is beneficial when scanning the logs
22:05 -!- common- [~common@p5DDA4A05.dip0.t-ipconnect.de] has joined #openvpn
22:06 -!- common [~common@p5DDA4B89.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
22:06 -!- common- is now known as common
22:06 -!- zErK [~dracon@boxcars.triplecrowncasinos.com] has joined #openvpn
22:06 < zErK> hello,
22:06 < zErK> is there an easy way to repackage openvpn with my own config files?
22:06 -!- zErK is now known as zerk
22:06 < krzee> dchilton, are you starting it as root?
22:06 < krzee> do you have tuntap module loaded?
22:07 < dchilton> Bushmills: I've mute turned off, verb=9, and not a trace of 'fail' or 'error' anywhere in the log output.
22:07 < dchilton> krzee: yes, as root. yes, i can manually setup tun/tap interfaces no problem.
22:08 -!- master_of_master [~master_of@p57B53D77.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:10 < krzee> no verb 9
22:10 < krzee> verb should be at 5 for debug
22:10 < krzee> i dont even think the dev team uses verb 9 ;)
22:10 < dchilton> krzee: from the example files "9 -- verbose, good for troubleshooting"
22:11 < krzee> well, from krzee, "5 -- verbose, good for troubleshooting"
22:11 < dchilton> okay, it's at five.
22:11 < krzee> pastebin both sides at 5 and ill take a look
22:12 < krzee> ive got about 15min before im leaving
22:12 < dchilton> krzee: thanks ... sec
22:12 -!- master_of_master [~master_of@p57B536E6.dip.t-dialin.net] has joined #openvpn
22:13 < krzee> i just saw this:
22:13 < krzee> [20:00]  <dchilton> Bushmills: client is set to use 'tun1', but I do NOT see it in "ifconfig" output
22:13 < krzee> instead of dev tun1, try just dev tun
22:13 < dchilton> okay
22:13 < krzee> dev tun1 would require a pre-setup static interface
22:13 < krzee> dev tun is a dynamic interface, made at startup
22:14 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
22:14 < dchilton> krzee: still no tun interface shows up ... will paste here in a sec
22:15 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 248 seconds]
22:16 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 248 seconds]
22:18 < dchilton> krzee: here's the client side http://pastebin.com/xFpAtuBH
22:19 < krzee> interesting... lets see both configs as well, as directed here:
22:19 < krzee> !configs
22:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
22:20 < Bushmills> http://scarydevilmonastery.net/snap/1300763994805839628d.png 
22:20 < Bushmills> local time :)
22:20 < krzee> nice!
22:20 < krzee> happy fourtwomp!
22:21 < dchilton> krzee: okay, reading ... sec
22:25 < Bushmills> i can't see the client being pushed an ip address anywhere
22:26 < Bushmills> also no route statement, setting the interface for the vpn network
22:27 < dchilton> krzee: server then cleint confs http://pastebin.com/pcHSEm4g
22:27 < krzee> exactly
22:27 < krzee> thats why i know the configs are gunna be wonky ;)
22:27 < krzee> you dont need user root group root
22:28 < krzee> start it as root and it doesnt change unless you specify user someone_who_is_NOT_root etc
22:28 < krzee> dchilton, wheres the ccd entries...
22:29 < krzee> and wheres the server log
22:29 < Bushmills> try   remote 11.22.33.44.5215  in client config
22:29 < krzee> Bushmills, either way works for that
22:29 < krzee> well
22:29 < dchilton> krzee: in the client ccd, there's only one line: "ifconfig-push 10.12.12.7 255.255.255.0"
22:29 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
22:29 < dchilton> i'll get the server log here
22:29 < krzee> remote ip port, without the dot, but also using seperate port option like 2.0 works too
22:30 < krzee> thats a rather important line
22:30 < krzee> which is why !configs has "(#2) dont forget to include any ccd entries"
22:30 < Bushmills> krzee: sure that --port on client specifies server port, not local port through which is connected to server?
22:31 < Bushmills> well, i suppose it does, otherwise client connection attempt would fail completely
22:31 < krzee> Bushmills, in 2.0 you HAD to use --port for that
22:31 < krzee> 2.1 allowed it to be in --remote
22:31 < dchilton> Bushmills: added the remote 11.22.33.44.5215.  no change.
22:31 < krzee> umm, yes change
22:32 < krzee> that would break it
22:32 < krzee> heh
22:32 < dchilton> didn't see any errors/fails, but okay.
22:32 < krzee> --remote host [port] [proto]
22:33 < krzee> it really worked with --remote host.port?
22:33 < dchilton> krzee: well, "worked".  it didn't blow up ....
22:34 < krzee> i expected it to not know what ip 11.22.33.44.5215 is, since its 1 too many octets (with the final one being a little large)
22:34 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:34 < dchilton> krzee: did: "remote 11.22.33.44 5215 udp" and "remote 11.22.33.44 5215".  same, still ...
22:35 < krzee> right, i knew it wasnt that line
22:35 < krzee> although im unsure what it actually is
22:35 < krzee> did you post server log?
22:35 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 260 seconds]
22:36 < krzee> work is over, bbl
22:37 < dchilton> krzee: here's the server log http://pastebin.com/L6jnQBTR
22:38 < krzee> oh and the server log will need the client connecting in it too
22:38 < krzee> (ill look if you're still around later when im free_
22:38 < krzee> ill be on from krzie
22:38 < krzee> adios
22:39 < dchilton> tnhanks
22:39 -!- dchilton [~dchilton@adsl-99-55-250-206.dsl.pltn13.sbcglobal.net] has quit [Remote host closed the connection]
22:41 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
22:43 < Bushmills> looks like server uses the wrong config file
22:43 < Bushmills> port actually bound to is 42013, not 5215
23:02 -!- zerk [~dracon@boxcars.triplecrowncasinos.com] has quit []
23:20 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
23:26 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Read error: Operation timed out]
23:32 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
23:53 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:55 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 250 seconds]
--- Day changed Tue Mar 22 2011
00:02 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
00:40 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
00:40 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
00:57 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
00:59 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
01:13 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
01:13 <@vpnHelper> RSS Update - forum: Windows XP as OpenVPN server with redirtect-gateway <http://forums.openvpn.net/topic7815.html>
01:16 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
01:18 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 240 seconds]
01:25 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:25 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10621>
01:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
01:35 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
01:37 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
01:42 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
01:47 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:20 <@vpnHelper> RSS Update - forum: Change VPN node without having to edit client? <http://forums.openvpn.net/topic7808.html#p10622>
02:28 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
02:29 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has joined #openvpn
02:31 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
02:31 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:38 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
02:53 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
02:56 <@vpnHelper> RSS Update - forum: OpenVPN + Remote Desktop speed <http://forums.openvpn.net/topic7814.html#p10623>
03:16 < netrjay45> you can have multiple machines with the same server config, but if you have client to client, a client connected to one host can't see a client connected to another host, correct?
03:16 < netrjay45> is there a way to connect or sync multiple machines' list of connected clients?
03:25 < netrjay45> also, on the howto page, under the "Implementing a load-balancing/failover configuration" it says for servers "use a different virtual IP address pool for each server" - what exactly does that accomplish?
03:28 < netrjay45> sorry, im still a little new to IRC, but there are 132 people in here, right? does anybody have anything to say?!
03:44 <@vpnHelper> RSS Update - forum: SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html#p10624>
03:47 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:49 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
04:00 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
04:14 <@vpnHelper> RSS Update - forum: two vpn clients gets the same IP? <http://forums.openvpn.net/topic7816.html>
04:15 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
04:15 -!- mode/#openvpn [+o mattock] by ChanServ
04:25 -!- p3rror [~mezgani@2001:470:1f0a:c66:beaf::2] has joined #openvpn
04:32 <@vpnHelper> RSS Update - forum: two vpn clients gets the same IP? <http://forums.openvpn.net/topic7816.html#p10626>
04:46 -!- mordy [~mordy@69.195.135.251] has left #openvpn []
04:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:56 <@vpnHelper> RSS Update - forum: Latensy spikes <http://forums.openvpn.net/topic7817.html>
04:59 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
05:08 <@vpnHelper> RSS Update - forum: Latensy spikes <http://forums.openvpn.net/topic7817.html#p10628>
05:12 -!- dazo_afk is now known as dazo
05:16 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:32 <@vpnHelper> RSS Update - forum: SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html#p10629>
05:38 <@vpnHelper> RSS Update - forum: OpenVPN + Remote Desktop speed <http://forums.openvpn.net/topic7814.html#p10630>
05:41 -!- gaddafi_ [~o2@unaffiliated/spice] has joined #openvpn
05:44 <@vpnHelper> RSS Update - forum: Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10631>
05:44 -!- gaddafi [~o2@unaffiliated/spice] has quit [Ping timeout: 276 seconds]
05:49 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
05:49 -!- mode/#openvpn [+o mattock] by ChanServ
05:50 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10632>
05:56 <@vpnHelper> RSS Update - forum: Latensy spikes <http://forums.openvpn.net/topic7817.html#p10633>
06:02 <@vpnHelper> RSS Update - forum: Latensy spikes <http://forums.openvpn.net/topic7817.html#p10634>
06:04 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
06:13 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
06:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:14 -!- mode/#openvpn [+o mattock] by ChanServ
06:36 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
06:54 -!- mant1s [mant1s@robert-scarano-3.um.maine.edu] has joined #openvpn
06:54 -!- mant1s [mant1s@robert-scarano-3.um.maine.edu] has quit [Changing host]
06:54 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
06:54 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Client Quit]
06:58 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
06:58 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
06:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
07:03 <@vpnHelper> RSS Update - forum: SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html#p10635>
07:07 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
07:27 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
07:31 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
07:33 -!- fahmad [~linux@unaffiliated/fahmad] has quit [Ping timeout: 240 seconds]
07:34 -!- p3rror [~mezgani@2001:470:1f0a:c66:beaf::2] has quit [Read error: Operation timed out]
07:36 -!- celthunder [~celthunde@rofltech.net] has quit [Ping timeout: 276 seconds]
07:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
07:45 -!- maxJadi [~maxJadi@dhcp-166-136.nomad.chalmers.se] has joined #openvpn
07:45 -!- maxJadi [~maxJadi@dhcp-166-136.nomad.chalmers.se] has quit [Changing host]
07:45 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
07:50 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:50 -!- p3rror [~mezgani@41.140.156.153] has joined #openvpn
07:57 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
07:58 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
08:05 -!- pmatulis [~peter@64.34.151.178] has quit [Remote host closed the connection]
08:08 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
08:09 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
08:12 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 260 seconds]
08:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
08:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
08:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:33 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
08:33 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
08:33 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:51 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
09:06 -!- EugeneKaway is now known as EugeneKay
09:25 <@vpnHelper> RSS Update - forum: OpenVPN + Remote Desktop speed <http://forums.openvpn.net/topic7814.html#p10636>
09:33 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has joined #openvpn
09:33 < axwell999> hey
09:33 < axwell999> i installed rpmforge for centos but yum install openvpn says 'no package openvpn avaliable'
09:33 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
09:34 < Bushmills> #centos may know better about this problem than #openvpn
09:34 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
09:35 < Bushmills> usually, #openvpn can tell about problems which arise fromon the moment that openvpn does (or doesn't) start
09:36 < axwell999> ok thx 
09:36 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
09:39 < axwell999> can i just ask if version 2.1.1-2 is good enough 
09:39 < axwell999> i think its older version of openvpn from epel
09:40 < Bushmills> 2.1 sounds ok, it's at least not ancient. i think 2.1.3 is current
09:43 <@vpnHelper> RSS Update - forum: OpenVPN + Remote Desktop speed <http://forums.openvpn.net/topic7814.html#p10637>
09:44 < janjust> 2.1.1-2 is finy for most uses; 2.1.2 was a dud, IIRC; 2.1.3 added mostly windows specific features ; 2.1.4 was a minor bugfix
09:44 < janjust> s/finy/fine
09:45 < ecrist> 2.1.2 didn't have a signed driver, 2.1.3 was the fix for that
09:45 < ecrist> !release-notes
09:45 < ecrist> !learn release-notes as http://openvpn.net/index.php/open-source/documentation/release-notes.html
09:45 <@vpnHelper> Joo got it.
09:45 < janjust> thx for reminding, ecrist 
09:46 < ecrist> 2.1.2, 2.1.3 were both windows fixes, 2.1.4 fixed specific route targets, special case.
09:47 < janjust> my rpmforge.repo file for centos 5.x contains openvpn 2.1.4-2.el5.rf 
09:47 < janjust> which installs just fine
09:47 < ecrist> sorry, 2.1.2 did have a couple minor non-windows-specific fixes, but also special use cases.
09:48 < ecrist> !change-log
09:48 < ecrist> !learn change-log as see http://openvpn.net/index.php/open-source/documentation/change-log/70-20-change-log.html for 2.0 change log
09:48 <@vpnHelper> Joo got it.
09:48 < ecrist> !learn change-log as see http://openvpn.net/index.php/open-source/documentation/change-log/71-21-change-log.html for 2.1 change log
09:48 <@vpnHelper> Joo got it.
09:49 < ecrist> !learn change-log as see http://openvpn.net/index.php/open-source/documentation/change-log/425-changelog-for-openvpn-22.html for 2.2 change log
09:49 <@vpnHelper> Joo got it.
09:49 < ecrist> !change-log
09:49 <@vpnHelper> "change-log" is (#1) see http://openvpn.net/index.php/open-source/documentation/change-log/70-20-change-log.html for 2.0 change log, or (#2) see http://openvpn.net/index.php/open-source/documentation/change-log/71-21-change-log.html for 2.1 change log, or (#3) see http://openvpn.net/index.php/open-source/documentation/change-log/425-changelog-for-openvpn-22.html for 2.2 change log
09:49 < ecrist> !forget change-log 3
09:49 <@vpnHelper> Joo got it.
09:50 < ecrist> !learn change-log as see http://openvpn.net/index.php/open-source/documentation/change-log/425-changelog-for-openvpn-22.html for 2.2 change log
09:50 <@vpnHelper> Joo got it.
09:50 < ecrist> *shrug*
09:50 < ecrist> wraps weird for me, must be my client.
09:52 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
09:55 < axwell999> janjust
09:56 < axwell999> please where did u find that repo?
09:56 < axwell999> i got mine from a swedish website and it has 2.1.1-2
09:57 < janjust> https://rpmrepo.org/RPMforge/Using
09:57 <@vpnHelper> Title: RPMforge/Using - RPMRepo Wiki (at rpmrepo.org)
09:58 < janjust> follow the instructions there 
09:58 < axwell999> thats where i got it exactly
09:58 < axwell999> but it said 'installing version 2.1.1-2.el5'
10:00 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:00 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 240 seconds]
10:00 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
10:00 < gladiatr> huh.  the version on my cent5 box in 2.1.4-1 (via rpmforge)
10:00 < janjust> then you're using an old mirror, axwell999 
10:01 < janjust> for example, the mirror http://archive.cs.uu.nl/mirror/dag.wieers/redhat/el5/en/x86_64/rpmforge/RPMS/ has 2.1.4-2
10:01 <@vpnHelper> Title: Index of /mirror/dag.wieers/redhat/el5/en/x86_64/rpmforge/RPMS (at archive.cs.uu.nl)
10:01 < axwell999> i used at first exactly the mirror that is in your link
10:01 < axwell999> but then when trying 'yum install openvpn' it still says package not found
10:01 < janjust> do a 'yum clean all', then a 'yum update' , then 'yum info openvpn'
10:01 < axwell999> ok
10:04 < axwell999> then try again
10:06 < janjust> yum info should show you 2.1.4
10:06 < janjust> if it does not then there's no need to try 'yum install' ; if it does show 2.1.4, then try 'yum install'
10:06 < janjust> but I've got to go now... good luck!
10:06 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
10:26 -!- EugeneKay is now known as ciwrl|pants
10:29 <@vpnHelper> RSS Update - forum: OpenVPN + Remote Desktop speed <http://forums.openvpn.net/topic7814.html#p10638>
10:30 -!- ciwrl|pants is now known as EugeneKay
10:43 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has quit [Quit: Leaving]
10:45 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:11 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
11:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
11:17 <@vpnHelper> RSS Update - forum: Problem Compiling OpenVPN <http://forums.openvpn.net/topic7818.html>
11:23 <@vpnHelper> RSS Update - forum: To access my lan subnets <http://forums.openvpn.net/topic7819.html>
11:26 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
11:35 <@vpnHelper> RSS Update - forum: TLS closed <http://forums.openvpn.net/topic7770.html#p10643> || OpenVPN + Remote Desktop speed <http://forums.openvpn.net/topic7814.html#p10642> || To access my lan subnets <http://forums.openvpn.net/topic7819.html#p10641>
11:38 < axwell999> so there are no security issues with using an older version of openvpn?
11:40 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
11:41 <@vpnHelper> RSS Update - forum: linux bridge eth interface with openvpn and DHCP <http://forums.openvpn.net/topic7811.html#p10644>
11:42 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has left #openvpn ["Leaving"]
11:42 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:42 < gladiatr> 2.1.4 is fine
11:44 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:47 <@vpnHelper> RSS Update - forum: OpenVPN 2.1.1 on my N900 <http://forums.openvpn.net/topic7769.html#p10647> || linux bridge eth interface with openvpn and DHCP <http://forums.openvpn.net/topic7811.html#p10646> || To access my lan subnets <http://forums.openvpn.net/topic7819.html#p10645>
11:53 <@vpnHelper> RSS Update - forum: To access my lan subnets <http://forums.openvpn.net/topic7819.html#p10648>
11:54 < axwell999> i'm using 2.1.1
11:54 < axwell999> well im install it from epel repo
11:59 <@vpnHelper> RSS Update - forum: Port Forwarding <http://forums.openvpn.net/topic7821.html> || OpenVPN connection going down under traffic <http://forums.openvpn.net/topic7820.html>
12:01 -!- JoeyJoeJo [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
12:02 < JoeyJoeJo> I've set up my VPN and it sucessfully connected, but I can't ping computers on the other network using their private 192.168 addresses. Where should I start looking for the problem? 
12:04 < ecrist> !logs
12:04 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
12:05 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 276 seconds]
12:05 < JoeyJoeJo> !pb
12:05 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
12:05 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
12:10 < JoeyJoeJo> Pastebin.ca seems to be down, but here are the two logs with verb set to 5
12:10 < JoeyJoeJo> http://pastebin.com/vTxNxNWE
12:14 < krzee> WOW you have some serious stuff going on there
12:14 < krzee> you should be able to tell most of your problems
12:14 < gladiatr> http://www.youtube.com/watch?v=hP0kWqJJZa4
12:14 <@vpnHelper> Title: YouTube - Log (at www.youtube.com)
12:14 < krzee> client.log has a ton of consistency errors (client and server should have matching options on those)
12:15 < gladiatr> indeed
12:15 < JoeyJoeJo> Ok, I'll start there. I don't know if it matters, but the server is a DD-WRT router and the client is Windows 7
12:15 < gladiatr> doesn't matter at all.  The options much match.
12:15 <@vpnHelper> RSS Update - forum: Playing Games Over OpenVPN <http://forums.openvpn.net/topic7742.html#p10652> || Why is "--enable-password-save" disabled by default? <http://forums.openvpn.net/topic7724.html#p10651>
12:19 < ecrist> that log is all splodey
12:19 < krzee> looks like your server is running an old version as well
12:22 < JoeyJoeJo> I think I'm in over my head. Do you mind looking at my configs? http://pastebin.com/jmTUZKGq
12:23 < krzee> why are you using tap?
12:24 < JoeyJoeJo> krzee: Because that's what the guide I followed said to do. I really have no idea what I'm doing :(
12:25 < krzee> replace dev tap0 with dev tun
12:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
12:25 < krzee> on both configs
12:25 < krzee> in fact
12:25 < krzee> start over
12:25 < krzee> !sample
12:25 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
12:25 < krzee> whats your goal?
12:26 < JoeyJoeJo> krzee: To connect allow people to connect to my office network when they're at home, traveling, etc
12:26 < JoeyJoeJo> wow, that came out retarded
12:26 < krzee> server is office?
12:27 < JoeyJoeJo> yes
12:27 <@vpnHelper> RSS Update - forum: How to create bash script for management? <http://forums.openvpn.net/topic7738.html#p10653>
12:27 < krzee> and its the router for the entire LAN?
12:27 < JoeyJoeJo> yes
12:27 < krzee> ok so after !sample see this:
12:27 < krzee> !serverlan
12:27 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
12:27 < krzee> !route
12:27 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:27 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
12:27 < krzee> you do not need route_outside_openvpn
12:27 < krzee> and ip forwarding is enabled
12:28 < krzee> so after you use the sample configs and change the key files and stuff, you just push the route to the lan and you're done
12:28 < JoeyJoeJo> Ok, I'll give it a shot. Thanks for the help
12:29 < krzee> (you got to skip 2 steps because you run openvpn on the router)
12:29 < krzee> yw
12:30 < axwell999> hey, just wondering which files need to be copied to /etc/openvpn
12:30 < axwell999> i mean which crt and key files
12:30 < axwell999> i just went through the process of making the ca, server and client keys
12:30 < gladiatr> axwell999, server or client-side?
12:30 < axwell999> server side
12:30 < gladiatr> ca.crt, server.crt, server.key
12:31 < axwell999> thanks, not dh1024.pem? or is that only on client side
12:31 < gladiatr> If you're using that feature, that'll need to go on both ends
12:31 < krzee> only on server side, change the name to whatever yours is
12:31 < krzee> !dh
12:31 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
12:32 <@vpnHelper> RSS Update - forum: openvpn abuse <http://forums.openvpn.net/topic7822.html> || OpenVPN Help, Connects Successfully But Does Not Work <http://forums.openvpn.net/topic7693.html#p10654>
12:32 < axwell999> ok so i'll just put it on server then
12:32 < gladiatr> bah.  krzee is right.  I was thinking of the tls-auth key
12:32 < krzee> ahh ya, that is:
12:32 < krzee> !hmac
12:32 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
12:32 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
12:33 < axwell999> hmm keeps saying filed when trying to start openvpn service
12:33 < axwell999> failed*
12:34 < axwell999> ahh sucess
12:34 < axwell999> after all that i forgot to put dh1024.pem in /etc/openvpn ;)
12:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:38 < gladiatr> doh!
12:39 < axwell999> and only these on client side right? (im on win 7) ca.crt
12:39 < axwell999> client1.csr
12:39 < axwell999> client1.key
12:39 < axwell999> client1.crt
12:40 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 276 seconds]
12:40 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:40 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
12:41 < krzee> not csr
12:41 < axwell999> ok thanks
12:41 < axwell999> gotta restart wincsp wont let me copy files until i do, thanks for help guys!
12:41 < krzee> csr is an unsigned crt
12:42 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has quit []
12:42 < krzee> if you are using tls-auth you need that EXACT file on both sides
12:42 < krzee> heh toolate
12:42 <@vpnHelper> RSS Update - forum: Unable to login after configuring Ethernet Bridging <http://forums.openvpn.net/topic7790.html#p10657> || How do I configure OpenVPN as a Gateway client for Witopia? <http://forums.openvpn.net/topic7684.html#p10656>
12:43 < gladiatr> another happy customer
12:43 < gladiatr> the question regarding the Witopia question is in regards to using a NAS as a vpn gateway.
12:44  * gladiatr sighs
13:00 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 260 seconds]
13:00 <@vpnHelper> RSS Update - forum: SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html#p10658>
13:04 < krzee> " question regarding the Witopia question"
13:04 < krzee> oh nevermind, the forum
13:06 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 252 seconds]
13:07 < gladiatr> indeed.  the forum.
13:08 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has joined #openvpn
13:08 < axwell999> works :)
13:08 < axwell999> managed to ping 10.8.0.1
13:09 < axwell999> now i just add push "redirect-gateway" to client and server.conf right?
13:10 < krzee> erm
13:10 < krzee> you never said you wanted client internet traffic to be forced through the vpn...
13:10 < krzee> so no
13:10 < axwell999> it is what i want lol
13:11 < axwell999> just wanted to see if it is working before that step
13:11 < krzee> oh sorry i got you mixed with someone else
13:11 < krzee> !redirect
13:11 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:11 < axwell999> !def1
13:12 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
13:12 < axwell999> hmm i saw a tut on the internet it didnt mention 'def1' just push redirect gateway
13:14 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has joined #openvpn
13:14 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has quit [Client Quit]
13:14 < krzee> such a good reason to use the manual instead of random 'tut's
13:15 < axwell999> !ipforward
13:15 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
13:15 < axwell999> !linipforward
13:15 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
13:16 < axwell999> !nat
13:16 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:16 < axwell999> !linnat
13:16 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
13:17 < axwell999> ok
13:17 < axwell999> if this works i think i might get disconected
13:17 < axwell999> ;)
13:19 -!- TACPILOT [~tacpilot@c-76-31-248-181.hsd1.tx.comcast.net] has left #openvpn []
13:20 < axwell999> works
13:20 < axwell999> thanks for help
13:21 < krzee> yw'
13:21 < axwell999> about dns queries, if i want them to pass through the tunnel can i just set up my windows wireless adapter to use something like google's free dns?
13:22 < krzee> then dont have a more specific route for the NS
13:22 < krzee> optionally:
13:22 < krzee> !pushdns
13:22 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
13:28 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:49 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has joined #openvpn
14:21 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 276 seconds]
14:21 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
14:24 -!- EugeneKay is now known as [o][o]
14:24 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:26 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
14:31 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Ping timeout: 248 seconds]
14:33 -!- caesay [~caesay@socialshock.net] has joined #openvpn
14:33 -!- caesay is now known as Guest15062
14:34 -!- luneff [~yury@84.51.201.89] has joined #openvpn
14:38 -!- [o][o] is now known as EugeneKaway
14:38 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10660>
14:40 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
14:42 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:44 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
14:52 -!- rolls [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
14:52 -!- rolls [~rollin@190.120.228.48] has joined #openvpn
14:55 < Dougy> rawr
14:55 <@vpnHelper> RSS Update - forum: Port Forwarding <http://forums.openvpn.net/topic7821.html#p10661>
14:59 -!- roentgen [~arthur@2001:4d18:3:1:ffff:ffff:ffff:1] has joined #openvpn
14:59 -!- roentgen [~arthur@2001:4d18:3:1:ffff:ffff:ffff:1] has quit [Changing host]
14:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:00 -!- EugeneKaway is now known as EugeneKay
15:07 -!- loompek [~noname@kista.rula.net] has joined #openvpn
15:08 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has quit []
15:08 -!- Guest68746 [~noname@kista.rula.net] has quit [Read error: Operation timed out]
15:08 -!- axwell999 [~axwell999@vps6794.xlshosting.net] has joined #openvpn
15:13 -!- ChmEarl [~ChmEarl@cpe-66-27-167-237.socal.res.rr.com] has joined #openvpn
15:15 -!- jubei__ [~jubei@burbclave.csh.rit.edu] has joined #openvpn
15:16 < jubei__> has anyone had issues with crl-verify always returning revoked for any cert
15:17 < jubei__> even when the crl in question has no revoked certs
15:18 <@vpnHelper> RSS Update - forum: openvpn abuse <http://forums.openvpn.net/topic7822.html#p10662>
15:19 -!- liseie [~axwell999@82-168-191-228.ip.telfort.nl] has joined #openvpn
15:19 < krzee> never heard of that, although i do remember some sort of issue with making an empty CRL
15:20 < krzee> although it may have been in ssl-admin or in the easy-rsa script or something, i dont remember
15:20 -!- axwell999 [~axwell999@vps6794.xlshosting.net] has quit [Ping timeout: 252 seconds]
15:20 < jubei__> i've got the issue with an empty crl and a crl that has a few revoked certs 
15:22 < gladiatr> jubei__, what's the error?
15:23 < jubei__> first portion i get is CRL CHECK FAILED certinfo is REVOKED, then i get a few ssl based errors
15:24 < gladiatr> that is strange
15:24 < krzee> ive never actually used a crl :-x
15:24 < gladiatr> I take that your crl update procedure is automated or does it point straight into your easy-rsa directory structure?
15:24 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:25 < krzee> i mean, its the right way to do things, but ive never had a compromised key and random stuff leads me to rebuild my pki on occasion anyways
15:25 < gladiatr> krzee, yeah.  I didn't use it til I started deploying it for company-wide access
15:26 < krzee> only 5 people have vpn access into my company
15:26 < krzee> (including myself)
15:26 < gladiatr> Heh.  The last company I worked for had more turnovers than a bakery
15:26 < |Mike|> lol
15:27 < krzee> haha
15:27 < krzee> my place has basically no turnover
15:27 < krzee> ive been here almost 4 years and im the newest person here
15:27 < |Mike|> i love my crypto stick :-)
15:27 < krzee> (well im the newest as of today, i fired the only person who was newer than me yesterday)
15:28 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
15:28 < krzee> |Mike|, put it back in your pants!
15:28 < gladiatr> the FNG is dead!  Long live the FNG!
15:28 < jubei__> krzee: here are the errors and the crl http://pastebin.com/mKEr8gek
15:29 < krzee>         Issuer: /C=US/ST=CA/L=Mountain View/O=example/CN=example CA/emailAddress=ops@example.com
15:29 < krzee> CRL CHECK FAILED: /C=US/ST=CA/L=Mountain_View/O=example/CN=example_CA/emailAddress=ops@example.com is REVOKED
15:29 < krzee> looks like you revoked your CA?
15:30 < gladiatr> oops
15:30 < krzee> unless im reading it wrong... never looked in a crl before
15:30 < krzee> but thats what it looks like to me without looking over any manual or anything
15:30 < liseie> in order to stop dns leaks i had to set the server to push the particular dns to clients and set my windows wireless adapter to use that specific dns... now no leaks shown in wireshark
15:30 < liseie> quite a bit of bother just to stop dns leaks
15:30 < krzee> liseie, then dont do it? :-p
15:31 < liseie> if isp can see what sites i visit then it kind of degrades the point of having a vpn to begin with
15:31 < jubei__> i'm fairly certain i didnt revoke my ca cert
15:31 < krzee> then congrats on getting it accomplished ;)
15:31 < gladiatr> actually, this is just wrong #
15:31 < gladiatr>     Serial Number: 90A474744E7FDEA7
15:31 < gladiatr> I would regen your crl out of your CA directory
15:32 < liseie> thanks
15:32 < liseie> when i just pushed the dns options, my computer was overiding it, i guess because of the router im using is running a dhcp server and i have no control over the router
15:32 < jubei__> weird, that matches the ca cert correctly
15:32 < liseie> and if i just set the dns in my wireless adapter but didnt push it, i couldnt connect to any websites lol
15:33 < jubei__> at least the error is making sense now
15:33 < gladiatr> rut ro
15:36 < krzee> so you had revoked your CA?
15:36 < jubei__> looks like thats what happened
15:36 < krzee> (which actually DOES have a point to it, since it is possible to use intermediate CA's)
15:37 < gladiatr> rude
15:38 < jubei__> gladiatr krzee thanks for being the extra pair of eyes to catch this
15:38 < gladiatr> no worries, mate
15:38 < krzee> np
15:46 -!- stony_ is now known as stony
15:46 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html>
15:47 < krzee> http://www.bbc.co.uk/news/science-environment-12811199
15:47 <@vpnHelper> Title: BBC News - Quantum computing device hints at powerful future (at www.bbc.co.uk)
15:47 < krzee> that is the beginning of the end of encryption as we know it
15:48 < liseie> as i know quantumn computing can only square root encryption
15:48 < liseie> so aes 256 is still aes 128
15:48 < liseie> however aes 128 will be broken by it 
15:49 < krzee> wait til theres 4096 qubits
15:49 < liseie> because imo aes 60 is brute forceable
15:49 < krzee> then kiss rsa byebye
15:49 < liseie> hmm
15:49 < liseie> not sure what it does to rsa
15:49 < liseie> what will openvpn do then lol we need rsa to exchange the encryption keys
15:50 < krzee> with that same technology will come new forms of encryption
15:50 < liseie> i guess
15:50 < liseie> preety much everything will be screwed then like internet banking 
15:50 < krzee> or new strengths of it at least
15:50 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:51 < liseie> im already using 4068 bit rsa with openvpn might need to up it to like 20k bit lol
15:51 < krzee> only those who dont stay with the times will be screwed... its the never-ending game of cat and mouse
15:51 < liseie> in 20 years
15:51 < krzee> you use 4096 methinks
15:51 < liseie> yea i knew it was 40 something
15:51 < krzee> (as do i)
15:52 < liseie> all conesueirs do
15:52 < liseie> doesnt even slow down the hourly handshake
15:52 < liseie> by any noticible amount
15:53 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 250 seconds]
15:53 -!- p3rror [~mezgani@41.140.156.153] has quit [Ping timeout: 255 seconds]
15:54 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
15:54 < liseie> hey do u think its ok to still use openvpn 2.1.1
15:55 < liseie> i haven't bothered upgrading 
15:55 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
15:55 < liseie> its only a couple years old i think
15:55 < krzee> should be fine, but if its not a biggie to upgrade, why not
15:56 < liseie> kind of is a biggie just cuz the repo get openvpn from (epel) doesnt have a newer version
15:56 < liseie> using a repo its as easy as yum install openvpn
15:57 < krzee> eww @ binary installers like yum
15:58 < krzee> (personal preference, not saying for you to not use it)
15:59 < liseie> yes i tried to install it manually from the new tar.gz source but then u have all these dependences to think about like lzo and pk11 bit of a headache lol and above my technical abilities
16:01 -!- tekzilla [~jon@f054061215.adsl.alicedsl.de] has joined #openvpn
16:02 < tekzilla> can a client config contain its own route settings ?
16:03 < jubei__> awesome, just regenerated the crl without my ca.crt in it and keys are able to auth again
16:03 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 3.6.15/20110303024726]]
16:04 < krzee> liseie, http://en.wikipedia.org/wiki/Shors_algorithm
16:04 <@vpnHelper> Title: Shor's algorithm - Wikipedia, the free encyclopedia (at en.wikipedia.org)
16:04 < krzee> tekzilla, sure
16:04 < krzee> tekzilla, youd just use --route, instead of --push "route ..."
16:05 -!- p3rror [~mezgani@41.140.170.177] has joined #openvpn
16:06 < tekzilla> krzee: so a "route 192.168.1.100 255.255.255.255" in the client config would create a host route right ?
16:06 < krzee> yep
16:06 < tekzilla> thanks very much
16:07 < krzee> it would make 192.168.1.100/32 routed over the vpn
16:11 < krzee> liseie, http://www.techrepublic.com/blog/security/quantum-hacking-cracks-quantum-crypto/4371
16:11 <@vpnHelper> Title: Quantum Hacking cracks quantum crypto | TechRepublic (at www.techrepublic.com)
16:11 < krzee> good reading =]
16:11 < liseie> yep rsa will be screwed
16:11 < liseie> http://synaptic-labs.com/resources/expert-opinions/94-quantum-computing/255-quote-gilles-brasssard-takes-no-more-time-to-break-rsa-than-to-run-it.html
16:11 <@vpnHelper> Title: quote: Gilles Brasssard, Takes no more time to break RSA than to run it (at synaptic-labs.com)
16:11 < liseie> says it all preety much
16:14 < liseie> preety amazing
16:15 < liseie> i guess we'll have to transfer the encryption key physically between the two sides of the vpn and not have it change every hour
16:15 < krzee> im pretty sure thats theoretical for now, but ya
16:15 -!- gladiatr is now known as gladiatr_afk
16:15 < krzee> liseie, openvpn already supports that (static keys) in point to point mode
16:16 < krzee> but it does not give forward encryption
16:17 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:20 < liseie> foreward encryp means how the key changes every hour? so even if they get a key its preety much useless except for 1 hour of history
16:20 < krzee> exactly
16:20 < krzee> whereas with static keys, i could capture your traffic for a year, then get the key, and decrypt it all
16:21 < liseie> lol yea, and im using vpn from china to a server in amsterdam, can't exactly take a plane with a usb stick every hour
16:21 < liseie> or even every month
16:22 < liseie> hopefully quantum stuff is like 30 years away, but i bet games etc will be amazing with that tech (am an avid gamer)
16:24 < tekzilla> how can i ignore the routes pushed by the server and only use those in the client config ? when using "route-noexec" he also ignores the clientside routes
16:25 < tekzilla> also tried "push-reset" but he didnt want that in the config
16:26 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
16:30 -!- majuk [~majuk@cpe-70-112-3-105.austin.res.rr.com] has quit [Read error: Operation timed out]
16:32 < liseie> hopeuflly krzee answers he knows everything ;)
16:33 -!- mete [~metefr@84.200.12.194] has quit [Remote host closed the connection]
16:33 < tekzilla> i'm aware of "route-up" but dont want to use scripts with OS specific commands..
16:33 < tekzilla> yes i hope so too :)
16:33 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
16:36 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10664>
16:37 -!- mete [~metefr@212.83.42.243] has joined #openvpn
16:40 < tekzilla> argh sorry, i was reading an old manpage
16:40 < tekzilla> now i found "route-nopull" and it works fine
16:49 -!- p3rror [~mezgani@41.140.170.177] has quit [Ping timeout: 255 seconds]
16:57 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
16:57 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
16:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:10 -!- bowen199 [~opera@74.115.5.48] has joined #openvpn
17:13 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10665>
17:13 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 246 seconds]
17:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
17:28 -!- p3rror [~mezgani@41.140.159.177] has joined #openvpn
17:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:33 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
17:43 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:47 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
17:49 -!- p3rror [~mezgani@41.140.159.177] has quit [Read error: Connection reset by peer]
17:52 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
17:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
18:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:05 -!- loompek [~noname@kista.rula.net] has quit [Ping timeout: 260 seconds]
18:05 -!- bowen199 [~opera@74.115.5.48] has left #openvpn []
18:07 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic7555-15.html#p10666>
18:13 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html>
18:15 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:17 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
18:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:25 -!- dazo is now known as dazo_afk
18:32 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 252 seconds]
18:33 -!- gaddafi_ is now known as gaddafi
18:39 -!- cromega [crome@moronia.hu] has joined #openvpn
18:39 < cromega> hi
18:42 < cromega> I have a fairly simple setup and I seem to be missing the trick to get it to work properly. I want to forward traffic from the vpn server's public interface to a vpn client and it works alright if I use masquerade so the packets seem to be originating from within the vpn
18:42 < cromega> but as it happens, I dont want that to happen
18:42 < |Mike|> topic ^^
18:43 < cromega> I know very well my problem most likely can be solved with proper firewall configuration
18:43 < cromega> and/or a well-placed route
18:44 < cromega> or do you mean the !triggers?
18:46 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
18:47 < krzee> stop thinking of it as a vpn issue
18:47 < krzee> in fact that doesnt even belong here
18:47 < krzee> think of your server as the router for the LAN
18:48 < krzee> you will use the same rules as you would in that situation, the fact that its a vpn really doesnt matter
18:48 < krzee> so i recommend #iptables
18:48 < krzee> or whatever your OS is
18:48 -!- liseie [~axwell999@82-168-191-228.ip.telfort.nl] has quit [Ping timeout: 250 seconds]
18:49 < cromega> why I asked it here is because I couldnt rule out a possible configuration trick I missed
18:50 < cromega> and I never said it was a problem with openvpn, I just hoped to get some directions
18:50 < krzee> oh i know
18:50 < cromega> (which I got, in a way)
18:50 < krzee> i wasnt trying to be rude or anything
18:51 < krzee> just pointing out that its the exact same type of setup as if there was no VPN, which should make it a lot easier to find help on google / irc
18:51 < krzee> but ya, openvpn doesnt do NAT, you gotta do it in the firewall
18:51 < cromega> well, if Im correct 1 iptables DNAT rule should do the trick
18:52 < krzee> cool
18:52 < krzee> (i use bsd)
18:52 < cromega> but I keep getting back connection refused answers when I try to reach the port that is supposed to be forwarded to the client through vpn, it made me think for some reason it doenst let packages reach the client if they dont originate from the vpn
18:52 < cromega> it may be bollocks
18:53 < cromega> so thats how far I got with trying to think of it as a setup with no vpn
18:53 < krzee> well once NAT'ed correctly thats not the problem...
18:53 < krzee> since the client would see the src address as the server
18:54 < krzee> this has been done, and im pretty sure ive seen it on the forum, not sure where tho
18:57 < krzee> (this one is for me)
18:57 < krzee> !book
18:57 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
18:58 -!- netrjay45 [~netrjay45@cpe-65-25-238-28.new.res.rr.com] has quit [Quit: Leaving]
19:00 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:09 -!- corretico [~luis@201.201.44.82] has joined #openvpn
19:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
19:11 <@vpnHelper> RSS Update - forum: Playing Games Over OpenVPN <http://forums.openvpn.net/topic7742.html#p10668>
19:17 <@vpnHelper> RSS Update - forum: Lans behind OpenVPN <http://forums.openvpn.net/topic98.html#p10669>
19:24 -!- loompek [~noname@kista.rula.net] has joined #openvpn
19:27 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
19:29 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 252 seconds]
19:30 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
19:31 -!- kc8pxy [~gecko@99-182-113-98.lightspeed.clmboh.sbcglobal.net] has quit [Ping timeout: 276 seconds]
19:38 -!- gaddafi [~o2@unaffiliated/spice] has left #openvpn []
19:46 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:47 -!- p3rror [~mezgani@41.140.98.88] has joined #openvpn
19:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
19:59 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
20:05 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
20:06 -!- EugeneKay is now known as NotChrisSoyarsOr
20:06 -!- NotChrisSoyarsOr is now known as NotSoyarsOrCiwrl
20:08 -!- NotSoyarsOrCiwrl is now known as EugeneGay
20:11 -!- p3rror [~mezgani@41.140.98.88] has quit [Read error: Operation timed out]
20:17 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
20:28 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:33 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:40 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 250 seconds]
20:43 -!- APTX [APTX@phpBB/developer/APTX] has quit [Ping timeout: 260 seconds]
20:46 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
20:52 -!- APTX [APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
20:52 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
20:56 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
20:58 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 250 seconds]
21:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:13 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:13 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:25 -!- EugeneGay is now known as EugeneStraight
21:29 -!- SlickDVL [~WarezMyGF@pool-96-255-138-222.washdc.fios.verizon.net] has joined #openvpn
21:29 < SlickDVL> !welcome
21:29 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:30 -!- EugeneStraight is now known as EugeneKay
21:30 < SlickDVL> !howto
21:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:30 < SlickDVL> Hey guys, is there a way to increase speeds of OpenVPN?
21:31 < SlickDVL> using a provider that is in NL
21:31 < SlickDVL> and i'm located in US
21:32 < SlickDVL> getting about 8Mbit down, but with PPTP get solid 20Mbit
21:32 < SlickDVL> could it be the encryption?
21:43 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
21:43 < ecrist> SlickDVL: could be
21:44 < ecrist> depends on the host hardware and other use
21:44 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:44 < ecrist> could be there's more people using openvpn than pptp
21:44 < SlickDVL> well owner said the server load was just half
21:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
21:44 < SlickDVL> so I should be getting full speed
21:44 < SlickDVL> to lower encryption, he has to do it on server side too?
21:44 < ecrist> half of shit is still shit. ;)
21:45 < ecrist> no such thing as 'full speed'
21:45 < ecrist> encryption has overhead
21:45 < ecrist> closer to full speed, perhaps
21:45 < SlickDVL> well not full speed.. but was hoping for at least 20Mbit down
21:45 < SlickDVL> my full down is 42Mbit
21:45 < ecrist> also depends on your hardware.
21:46 < SlickDVL> i7 920
21:46 < SlickDVL> Intel Gbit NIC
21:46 < ecrist> on good hardware, I've seen 100Mbit+ without issue.
21:46 < SlickDVL> from USA to NL?
21:46 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
21:46 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
21:46 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:46 < ecrist> but that has to be both ends.
21:46  * ecrist goes back to Jack & Coke and NCIS
21:47 < SlickDVL> hapen to know what speeds USA to NL should get?
21:47 < SlickDVL> roughly
21:50 -!- EugeneKay is now known as EugeneDinner
21:53 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
21:54 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:57 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 250 seconds]
22:05 -!- common- [~common@p5DDA4B9E.dip0.t-ipconnect.de] has joined #openvpn
22:08 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
22:08 -!- common [~common@p5DDA4A05.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
22:08 -!- common- is now known as common
22:09 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:10 -!- master_of_master [~master_of@p57B536E6.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
22:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
22:12 -!- master_of_master [~master_of@p57B535C6.dip.t-dialin.net] has joined #openvpn
22:14 -!- EugeneDinner is now known as EugeneKay
22:16 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:18 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
22:18 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:51 -!- daemon [~daemon@serial.daemonrage.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
23:03 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 255 seconds]
23:06 <@vpnHelper> RSS Update - forum: URGENT: Difficulty in allowing incoming port 22 while run... <http://forums.openvpn.net/topic7825.html>
23:10 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
23:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:13 -!- Essobi is now known as randomWhat
23:13 -!- randomWhat is now known as Essobi
23:31 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
23:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
23:42 -!- albech [~thomas@110.164.238.27] has joined #openvpn
23:42 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
23:42 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
23:48 -!- personaljosh [~personalj@ip184-131-173-82.adsl2.static.versatel.nl] has joined #openvpn
23:48 < personaljosh> hello all, maybe someone could help me with this problem: https://forums.openvpn.net/topic7825.html --- i am happy to pay on paypal or so for some quick help
23:48 <@vpnHelper> Title: OpenVPN Support Forum URGENT: Difficulty in allowing incoming port 22 while run... : Off Topic, Related (at forums.openvpn.net)
23:51 < personaljosh> anybody here guys
--- Day changed Wed Mar 23 2011
00:18 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 264 seconds]
00:20 < kraut> moin
00:26 -!- Cauchy [~Brent@cpe-72-130-54-126.socal.res.rr.com] has joined #openvpn
00:27 < Cauchy> I have a question about OpenVPN - can you possibly select one program to pass through the VPN and not another?
00:36 -!- EugeneKay is now known as EugeneKaway
00:42 < hjohnson> generally no
00:43 < Cauchy> Any way to accomplish what im trying to do? :(
00:43 < hjohnson> I mean, you can pull some stupid routing tricks on something flexible like Linux
00:43 < Cauchy> ohhh - too complicated lol
00:43 < Cauchy> sorry im PC stupid
00:43 < hjohnson> yeah involves multiple routing tables and what not
00:43 < hjohnson> why do you need to do this?
00:43 < hjohnson> generally there's no reason to do this
00:43 < Cauchy> I play a game and it does not like more then 3 active connections from a single ip
00:44 < Cauchy> so im trying to connect via 2 different IP's to play on 6 screens at once
00:44 < hjohnson> yeah, no this probabily won't help you cheat.
00:50 -!- dazo_afk is now known as dazo
01:06 <@vpnHelper> RSS Update - forum: connected to Tap server.. but can't ping or access anything <http://forums.openvpn.net/topic7606.html#p10671>
01:16 -!- ChmEarl [~ChmEarl@cpe-66-27-167-237.socal.res.rr.com] has quit [Quit: Leaving]
01:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
01:16 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 252 seconds]
01:19 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 250 seconds]
01:20 -!- twister004 [~chatzilla@mail2.polariswireless.com] has joined #openvpn
01:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:28 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:42 < SlickDVL> Cauchy, is this for poker?
01:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:58 < Cauchy> No
01:58 < Cauchy> Its for both Eve online specifically
01:58 < Cauchy> and for Perpetuum
01:59 < Cauchy> Me and my GF both play
01:59 < Cauchy> and we like to mine in a LARGE group (12 accounts between the two of us)
01:59 < Cauchy> 12 for eve, 6 for Perpetuum
02:00 < Cauchy> yea we are crazy, but what couple isnt?
02:01 < Cauchy> I should have made it clear, this is not cheating at RL money in any way ^^ (poker or the like, that would be disasertous)
02:12 -!- whomee [~glenna@proxy.se.axis.com] has joined #openvpn
02:13 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:14 < whomee> hi there, i have one kind of fishy problem here. whenever i try to do a host lookup or a nslookup from a openvpn host i get this error: error:configuration file routines:STR_COPY:variable has no value:conf_def.c:
02:14 < whomee> seems when i google it that it has something with the certs to do
02:15 < whomee> and yes thats the ok this is before the error i posted: Auto configuration failed
02:16 < whomee> ops, previous sentence seemed fishy also :)
02:22 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
02:30 -!- Cauchy [~Brent@cpe-72-130-54-126.socal.res.rr.com] has quit [Quit: Leaving]
02:30 <@vpnHelper> RSS Update - forum: openvpn abuse <http://forums.openvpn.net/topic7822.html#p10672>
02:36 <@vpnHelper> RSS Update - forum: connected to Tap server.. but can't ping or access anything <http://forums.openvpn.net/topic7606.html#p10674> || URGENT: Difficulty in allowing incoming port 22 while run... <http://forums.openvpn.net/topic7825.html#p10673>
02:37 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:54 <@vpnHelper> RSS Update - forum: Speed of tap device <http://forums.openvpn.net/topic7826.html> || connected to Tap server.. but can't ping or access anything <http://forums.openvpn.net/topic7606.html#p10675>
02:55 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
02:57 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 240 seconds]
03:00 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
03:06 <@vpnHelper> RSS Update - forum: openvpn abuse <http://forums.openvpn.net/topic7822.html#p10677>
03:09 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 252 seconds]
03:12 -!- ScriptFanix [~vincent@2001:910:100b:1:9880:57ff:fe01:aae6] has joined #openvpn
03:12 -!- personaljosh [~personalj@ip184-131-173-82.adsl2.static.versatel.nl] has quit [Quit: This computer has gone to sleep]
03:15 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
03:19 -!- rolls [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
03:19 -!- rolls [~rollin@190.120.228.48] has joined #openvpn
03:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
03:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:27 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 250 seconds]
03:33 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
03:34 -!- dazo is now known as dazo_afk
03:40 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
03:40 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:43 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10678>
03:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:47 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
03:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:55 -!- albech [~thomas@110.164.238.27] has quit [Ping timeout: 252 seconds]
03:59 -!- albech [~thomas@110.164.238.27] has joined #openvpn
04:08 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has joined #openvpn
04:09 -!- dazo_afk is now known as dazo
04:09 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has quit [Client Quit]
04:19 <@vpnHelper> RSS Update - forum: OpenVPN pre installed ISO <http://forums.openvpn.net/topic7827.html>
04:31 <@vpnHelper> RSS Update - forum: openvpn abuse <http://forums.openvpn.net/topic7822.html#p10680>
04:35 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Ping timeout: 240 seconds]
04:39 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
04:42 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
05:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:03 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has joined #openvpn
05:03 < axwell999> hey
05:04 < axwell999> the same ta.key file (hmac firewall) can be used on all clients right?
05:04 < axwell999> openvpn --genkey --secret ta.key (generated like this)
05:09 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:09 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:32 -!- rolls [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
05:33 -!- rolls [~rollin@190.120.228.48] has joined #openvpn
05:45 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
05:49 <@vpnHelper> RSS Update - forum: SSH over OpenVPN tunnel <http://forums.openvpn.net/topic7801.html#p10681>
05:52 -!- zxd [~zxd@95.211.21.37] has quit [Ping timeout: 250 seconds]
05:54 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
05:55 <@vpnHelper> RSS Update - forum: OpenVPN pre installed ISO <http://forums.openvpn.net/topic7827.html#p10682>
05:58 -!- Damme [~damme@206.216.95.91.static.ter-s.siw.siwnet.net] has joined #openvpn
05:58 -!- zxd [~zxd@95.211.21.37] has joined #openvpn
05:59 < Damme> hey guys, I was just thinking about some openvpn-sollution and I just realized that a  client key should be lockable to a specific machine, I dont know how, but some how calculate a machineID, use the cpu serial (if it exist any?) for example.
06:00 < Damme> i.e. server generates a new set of client keys, the client log on to server and somehow sends machine ID, the server registers that ID with that key, and if config sais so, some other machine with same key tries to logon - aggressive_Action(); :)
06:00 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10684> || Routing to LANs behind server <http://forums.openvpn.net/topic7555-15.html#p10683>
06:22 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:22 -!- mode/#openvpn [+o mattock] by ChanServ
06:22 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
06:25 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10685>
06:36 < Bushmills> Damme: lock it to the person, who uses that machine
06:39 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
06:43 -!- chrispercol [5d61f643@gateway/web/freenode/ip.93.97.246.67] has joined #openvpn
06:43 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10686>
06:44 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
06:46 < chrispercol> hi, I'm running openvpn 2 on centos 5.5...I have two conf files in /etc/openvpn to start two servers.../etc/init.d/openvpn only starts the original openvpn.conf script?
06:47 < chrispercol> have I misunderstood /etc/init.d/openvpn and the fact it loads all conf files in /etc/openvpn? can it start multiple servers?
07:03 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has quit []
07:12 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
07:12 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
07:12 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10687>
07:12 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
07:20 -!- chrispercol [5d61f643@gateway/web/freenode/ip.93.97.246.67] has quit [Quit: Page closed]
07:23 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10688>
07:35 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 248 seconds]
07:38 -!- p3rror [~mezgani@41.140.155.247] has joined #openvpn
07:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
07:40 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
07:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
08:05 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
08:05 -!- ScriptFanix [~vincent@2001:910:100b:1:9880:57ff:fe01:aae6] has quit [Quit: WeeChat 0.3.2]
08:06 -!- ScriptFanix [~vincent@2001:910:100b:1:9880:57ff:fe01:aae6] has joined #openvpn
08:08 -!- ScriptFanix [~vincent@2001:910:100b:1:9880:57ff:fe01:aae6] has quit [Client Quit]
08:11 -!- raw is now known as raw_
08:15 -!- p3rror [~mezgani@41.140.155.247] has quit [Ping timeout: 255 seconds]
08:15 -!- ScriptFanix [~vincent@2001:910:100b:1:1e:6ff:fe7e:e643] has joined #openvpn
08:15 -!- HA1DFO [~HA1DFO@alpha.ftmsystems.hu] has joined #openvpn
08:15 -!- ScriptFanix [~vincent@2001:910:100b:1:1e:6ff:fe7e:e643] has quit [Client Quit]
08:16 -!- ScriptFanix [~vincent@2001:910:100b:1:1e:6ff:fe7e:e643] has joined #openvpn
08:17 < HA1DFO> hi all. I'm not very good at cypher maths, so just a short question: if I have 1024bit RSA keys in openvpn and a 2048bit static TLS key, then what is the authentication encryption and what is the data encryption?
08:20 < HA1DFO> !welcome
08:20 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:20 < HA1DFO> !goal
08:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:22 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
08:22 < genesis7> how much memory is needed to run openvpn in vps
08:31 < genesis7> no one here?
08:36 -!- genesis7 [~rommel@amertospromotions.com] has left #openvpn []
08:37 -!- EugeneKaway is now known as EugeneKay
08:46 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
08:51 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
08:53 -!- genesis7 [~rommel@amertospromotions.com] has left #openvpn []
08:57 -!- gladiatr_afk is now known as gladiatr
09:06 -!- ldaguilar [~luis@186.176.7.194] has quit [Ping timeout: 260 seconds]
09:15 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:22 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
09:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
09:30 <@vpnHelper> RSS Update - forum: New setup with existing LAN <http://forums.openvpn.net/topic7828.html>
09:31 -!- fly23 [~flybyhigh@knorr.darksystem.net] has joined #openvpn
09:32 < fly23> !welcome
09:32 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:38 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
09:41 -!- twister004 [~chatzilla@mail2.polariswireless.com] has quit [Ping timeout: 240 seconds]
09:41 -!- twister004_ is now known as twister004
09:46 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:56 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 276 seconds]
09:57 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
09:58 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Client Quit]
10:09 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
10:09 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 250 seconds]
10:15 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
10:15 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
10:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:15 <@vpnHelper> RSS Update - forum: URGENT: Difficulty in allowing incoming port 22 while run... <http://forums.openvpn.net/topic7825.html#p10690>
10:16 -!- JoeyJoeJo [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Quit: Leaving]
10:19 < krzee> moin
10:19 < Dougy> !configs
10:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
10:19 < Dougy> moin jeff
10:19 < Dougy> !route
10:20 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:21 -!- EugeneKay is now known as EugeneKaway
10:21 <@vpnHelper> RSS Update - forum: To access my lan subnets <http://forums.openvpn.net/topic7819.html#p10693> || New setup with existing LAN <http://forums.openvpn.net/topic7828.html#p10692> || Unable to login after configuring Ethernet Bridging <http://forums.openvpn.net/topic7790.html#p10691>
10:29 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
10:29 < genesis7> gud pm. is anybody around?
10:31 < genesis7> gud pm. is anybody around to ask assistance from?
10:31 < gladiatr> what's up?
10:31 < ecrist> just ask here.
10:34 < krzee> !ask
10:34 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, or (#2) http://www.latinsud.com/answer/, or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
10:36 < Dougy> fuck this cough
10:36 < Dougy> O M G
10:36 < gladiatr> blood?  tar?  kittens?
10:38 < krzee> lol
10:40 <@vpnHelper> RSS Update - forum: frequent disconnection of vpn connection <http://forums.openvpn.net/topic7833.html>
10:40 < genesis7> sir I have this situation. I have a vpn server and client. but after sometime on its connection, the client is disconnected from the server and this frequent.
10:41 < genesis7> I have posted to the openvpn forum and I would like to post it here too so I can get as much help I can get.
10:41 < genesis7> is there a proper configuration for the server and client so that the disconnection issue is minimized?
10:41 < genesis7> please kindly assist me.
10:41 < gladiatr> what is the "verb" directive set to on your client and server side?
10:42 < genesis7> 3
10:43 < gladiatr> what do the logs (server and client) show at the time the client is disconnected?
10:43 < gladiatr> !pastebin
10:43 <@vpnHelper> Unable to download feed.
10:43 < gladiatr> !pastebin
10:43 <@vpnHelper> Unable to download feed.
10:43 < gladiatr> vpnHelper, serve me!
10:44 < gladiatr> please copy your info to pastebin.com
10:44  * gladiatr threatens vpnHelper with the rectal thermometer
10:45 < genesis7> gladiatr > i cant paste a sample now because it is a complaint of some of my users. but it is really a problem.
10:45 <@vpnHelper> RSS Update - forum: New setup with existing LAN <http://forums.openvpn.net/topic7828.html#p10695>
10:45 -!- HA1DFO [~HA1DFO@alpha.ftmsystems.hu] has quit [Quit: Leaving]
10:47 < genesis7> when I will be disconnected on my own sometime now, I will paste it in pastebin
10:47 < gladiatr> genesis7, I believe you, but my psychic abilities are unfortunately still somewhat unreliable :)
10:47 < gladiatr> sounds good!
10:48 < genesis7> but can I ask what could be the possible reason for this?
10:48 < genesis7> but can I ask what could be the possible reason for this frequent disconnection?
10:48 < gladiatr> It is most likely some unsteadiness in the internet path between your clients and server.
10:49 < hjohnson> their nat routers timing out the connection due to inactivity probably
10:49 < gladiatr> but I wouldn't put any money on that without seeing some diagnostic information.
10:49 < hjohnson> it's your firewall, really
10:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:50 < genesis7> what could be the cause of that unsteadiness gladiatr? can something be done? hjohnson, what do you mean firewall? can something be done on firewall.
10:51 < hjohnson> easily be on their end.
10:51 <@vpnHelper> RSS Update - forum: Time Controlled Road Warrior connections <http://forums.openvpn.net/topic7834.html>
10:51 < hjohnson> if they're behind a NAT router, it's a UDP connection, if there's no traffic within a little while the connection will time out and get closed down
10:52 < hjohnson> if they're on say a 3G system, it could be ping-ponging between towers, and always changing IP addresses, which again will cause a disconnection
10:52 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:53 < genesis7> yes we are on 3g system. can we do something about it hjohnson?
10:53 < hjohnson> generally no
10:53 < hjohnson> because every time the IP address of the remote site changes, you need to negotiate a new tunnel
10:54 < genesis7> that is generally. isnt there any server or client configuration to maintain such connection even if the ip address of the remote site change?
10:55 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:57 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:57 -!- genesis7 [~rommel@amertospromotions.com] has quit [Read error: Connection reset by peer]
10:57 -!- genesis7a [~rommel@amertospromotions.com] has joined #openvpn
10:58 < genesis7a> hjohnson, gladiatr this is my disconnection error --> http://pastebin.com/Ny5y5Vmx
10:59 < genesis7a> I just posted that last 3 lines of my log
10:59 -!- gyyrog_ [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
11:00 < gladiatr> oh.  That's pretty self-explanatory
11:00 < gladiatr> your client is restarting w/out the benefit of an interactive shell and can't pause and wait for your user to type their user name in again
11:00 < gladiatr> what platform are your client using?
11:01 < genesis7a> xp
11:01 < genesis7a> windows xp
11:01 < gladiatr> Hrm.  I don't use user/pw authentication.  Are you using the openvpn-gui?
11:02 < genesis7a> and I use a openvpn gui.
11:02 -!- arcsky [ernstan@s83-179-39-174.cust.tele2.se] has joined #openvpn
11:02 < arcsky> hello, i got a little routing issue with my openvpn connection. Here is some information, http://pastebin.com/s0Q5LL7j
11:03 < gladiatr> genesis7a, hrm... I should experiment w/ the user/pass authentication at some point.  It seems many people are using it
11:04 < gladiatr> arcsky, indeed you do :)
11:04 < gladiatr> !goal
11:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:05 < genesis7a> can you give me example. I am a beginner on this matter.
11:05 < genesis7a> is there any other way to authenticate client access to the server?
11:06 < arcsky> gladiatr: camt yeah i can ping to client and server
11:06 < gladiatr> genesis7a, oh, I was just saying that I'm not familiar with how openvpn-gui responds when a client tries to restart and is configured to use usernames and passwords for authentcation.
11:06 -!- gyyrog_ [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Ping timeout: 255 seconds]
11:06 < gladiatr> genesis7a, using certificates
11:06 < arcsky> gladiatr: cant be so big problem
11:07 < genesis7a> can you possibly give me config sample on how to use certificate to authenticate? what I know is by username and password only.
11:07 < gladiatr> !how-to
11:07 < genesis7a> !how-to
11:07 < gladiatr> !howto
11:07 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:07 < gladiatr> Yeah.  that one :)
11:08 < arcsky> gladiatr: was that to me or genesis7a ?
11:08 < gladiatr> That's the document repository I learned from.
11:08 < gladiatr> genesis7a
11:08 < arcsky> ok
11:08 < arcsky> gladiatr: maybe you can help me with my problem aswell ?
11:08 < gladiatr> arcsky, un momento
11:10 < gladiatr> pastebin your client's routing table
11:11 < genesis7a> gladiatr >but if I use only client cert, I need to generate unique client cert for each user right?
11:11 < gladiatr> genesis7a, yes.
11:11 < genesis7a> oh no! how about this "ifconfig-pool-persist"
11:12 < gladiatr> genesis7a, please understand, I'm not suggesting that there isn't a way around the client restart issue you're seeing--only that I use the certificate authentication model which doesn't suffer from the same issue.
11:12 < gladiatr> genesis7a, what about it?
11:12 < genesis7a> will that help about the disconnecting issue?
11:13 < gladiatr> Only if the disconnection is being caused by the IP addresses being given to clients are stepping on one another.  You should be using that option regardless.
11:14 < genesis7a> i see.
11:15 < genesis7a> I know other vpn providers that they have no disconnection issue unlike mine.  That is why I am guessing maybe it is somewhere on my configuration or should I increase my memory hardware.
11:15 < gladiatr> nah.  OpenVPN has a very small memory footprint.
11:16 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
11:17 < genesis7a> what do you mean very small memory footprint? for now I have 1 gb memory.  Dont I need to upgrade it to much higher capacity?
11:17 < gladiatr> genesis7a, paste your client and server configuration.  Perhaps there is something that would be obvious
11:17 < genesis7a> ok
11:17 < gladiatr> genesis7a, on the server or the client?
11:17 < genesis7a> on the server i have 1 gb memory.
11:18 < gladiatr> genesis7a, really, openvpn doesn't take much.  I haven't figured out what its actual footprint is, but I've operated openvpn servers for up to 30 concurrent users on a P3-500 with 256M of memory.
11:18 -!- ldaguilar [~luis@190.34.177.234] has joined #openvpn
11:19 < gladiatr> granted, they weren't all doing remote desktop sessions, but even if they were, that would have put more of a crypto load on the CPU than on the server's memory.
11:19 < gladiatr> arcsky, pastebin your client and server configs
11:20 < arcsky> gladiatr: http://pastebin.com/YZv1g6mM
11:20 < arcsky> ok sec
11:20 < genesis7a> gladiatr this is my pastebin ---> http://pastebin.com/DEDAgXp3
11:21 < arcsky> gladiatr: http://pastebin.com/4FTgmRBS
11:22 < genesis7a> does my configurations for server and client have problem or needs improvement?
11:23 < gladiatr> genesis7a, sec
11:24 < gladiatr> arcsky, ah.  is 1.1.1.1 your LAN internet gateway?
11:24 < arcsky> yes
11:24 <@vpnHelper> RSS Update - forum: Client reply only after clean ARP cache <http://forums.openvpn.net/topic7835.html>
11:24 < gladiatr> arcsky, you need to add a static route on that device for your vpn client network
11:25 < arcsky> gladiatr: hmm u sure?
11:25 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
11:25 < gladiatr> is the openvpn server your internet gateway as well?
11:26 < arcsky> nah
11:26 < gladiatr> Yeah.  That's your issue then.
11:26 < arcsky> but if i want to ping 1.1.1.90 
11:26 < arcsky> i need a static route to that one aswell?
11:26 < gladiatr> If you run a sniffer on the internal interface of your inet gateway system, you'll see the icmp packets from your vpn client.  It just doesn't know how to respond
11:27 < gladiatr> The static route needs to be added to the inet gateway.  This doesn't have anything to do with your vpn configuration.
11:27 < arcsky> but if i login to 1.1.1.1
11:27 < arcsky> it can ping 1.1.1.17 which runs the openvpn server
11:27 < gladiatr> Draw it out.  You'll see what I'm talkin' about.  openvpn can push a route telling your vpn client how to get to the lan, but it can't tell your lan how to get to the vpn network
11:27 < arcsky> ok i draw a pic
11:28 < gladiatr> The static route is already present on your VPN server.  It doesn't have to visit the default/internet gateway to know how to respond
11:28 < genesis7a> gladiatr, let me know if its my turn on you. I will just wait here
11:29 < gladiatr> genesis7a, :)  I'm looking at your configs now
11:29 < gladiatr> genesis7a, hrm.  You have "auth-nocache" in your client configuration
11:30 < gladiatr> genesis7a, that would definitely interfere w/ openvpn's ability to reconnect
11:30 < genesis7a> uhm?
11:31 < genesis7a> i thought auth-nocache is necessary there if I will use the user and password method of authenticating, isnt that right?
11:32 < gladiatr> ideally, you would not use that option; however, the problem you seem to be having is that your client disconnects and cannot reconnect w/out interaction from your user.
11:33 < genesis7a> yes probably. and I want that to be automatically reconnected since I have the password and username on the textfile
11:34 < gladiatr> genesis7a, Yeah.  I mean, since you are storing the user/pass locally, you're not really going to make it less secure by asking the client to store that data in memory.  I would think the user/pass option would just re-read the file...
11:34 < gladiatr> but apprently it doesn't
11:34 < arcsky> gladiatr: http://img191.imageshack.us/i/openvpn.jpg/
11:34 <@vpnHelper> Title: ImageShack - Online Photo and Video Hosting (at img191.imageshack.us)
11:34 < gladiatr> I have to agree w/ hjohnson as to the "why" for the disconnects, though.  Your configuration looks reasonable.  There are dozens of common issues that occur On The Internet that could cause a disconnect.
11:35 < gladiatr> arcsky, the vpn server is the ubuntu system?
11:35 < arcsky> ye
11:36 -!- chrispercol [5d61f643@gateway/web/freenode/ip.93.97.246.67] has joined #openvpn
11:36 < genesis7a> so how would i fix that openvpn should automatically use the username and password 
11:37 < gladiatr> arcsky, yeah.  if you follow the packet from your win7 box to 1.1.1.1 while looking at your routing tables, you'll see routes allowing the packet to flow win7 -> ubuntu box -> 1.1.1.1 but not the other way around.  1.1.1.1 needs to know of the 10.0.0.0/24 network or it will either drop the packet or try to send it to its default gateway (your ISP)
11:37 < chrispercol> hi, my client-config-dir is getting ignored, any thoughts on troubleshooting? 
11:37 < gladiatr> and your ISP will definitely throw it away
11:38 < chrispercol> folder and files with correct cn name in place
11:38 < gladiatr> chrispercol, do you have a DEFAULT file in your ccd?
11:38 < chrispercol> no...did I miss that in the manual?
11:38 < gladiatr> it's not a requirement.  It would just contain fall-back in case a client didn't match a specific filename in your ccd
11:39 < chrispercol> my windows client gets an address, just not the right one
11:39 < gladiatr> um... is  the argument for your client-config-default directive fully qualified or relative?
11:39 < chrispercol> it's ccd, ccd is a ln -s to another folder
11:40 < chrispercol> does this conflict with having a config dir, server 10.90.0.0 255.255.0.0 
11:40 < gladiatr> right, but in the main openvpn server config, is the argment for that directive realtive or or absolute?
11:40 < chrispercol> in my openvpn.conf
11:40 < gladiatr> no.  
11:41 < gladiatr> Assigning static addresses is only one of the things you can do with the ccd
11:41 -!- paranoidi [~paranoidi@62-248-207-5.elisa-laajakaista.fi] has left #openvpn []
11:41 < chrispercol> from my config...client-config-dir ccd
11:41 < gladiatr> make that a fully qualified path
11:41 < chrispercol> lrwxrwxrwx  1 root root   26 Mar 23 15:39 ccd -> /home/test/app/var/ccd 
11:42 < chrispercol> does same thing...tried earlier...but will do again
11:42 < gladiatr> are you running the server as root?
11:42 < chrispercol> yes
11:43 < gladiatr> and the file names are identical to what is in your ipp file?
11:43 < chrispercol> this is in my ipp.txt file at moment
11:43 < chrispercol> 43889,10.90.0.32 
11:44 < gladiatr> @_o
11:44 < gladiatr> righto.  And your ccd file i scalled 43889?
11:44 < gladiatr> *is called
11:44 < chrispercol> yes
11:44 < gladiatr> hrm...
11:45 < chrispercol> ifconfig-push 10.90.0.46 10.90.0.45 
11:45 < gladiatr> set verb 4 on your server, restart and then pastebin your log
11:45 < chrispercol> contents of 43889
11:46 < chrispercol> full path doesn't help, just tried
11:46 < chrispercol> ok
11:47 -!- EugeneKaway is now known as EugeneKay
11:50 -!- genesis7a [~rommel@amertospromotions.com] has quit [Read error: Connection reset by peer]
11:52 < gladiatr> chrispercol, hrm...
11:53 < gladiatr> Yeah.  the log might be of some help here
11:53 < chrispercol> would this be the problem,  push_ifconfig_defined = DISABLED 
11:53 < chrispercol> from the log
11:53 < gladiatr> paste the log
11:55 < gladiatr> going to smoke.  back in a few...
11:58 -!- chrispercol [5d61f643@gateway/web/freenode/ip.93.97.246.67] has quit [Quit: Page closed]
12:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
12:22 -!- tekzilla_ [~jon@e179212008.adsl.alicedsl.de] has joined #openvpn
12:25 -!- tekzilla [~jon@f054061215.adsl.alicedsl.de] has quit [Ping timeout: 246 seconds]
12:28 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:32 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Read error: Operation timed out]
12:32 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:38 -!- albech [~thomas@110.164.238.27] has quit [Quit: Ex-Chat]
12:41 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 255 seconds]
12:49 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
12:55 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Read error: Connection reset by peer]
12:59 < gladiatr> hrm... he must've figured it out
12:59 < gladiatr> or had an exceedingly embarrassing bit of config file butchery
12:59 -!- Guest15062 is now known as caesay
12:59 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
12:59 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
12:59 < gladiatr> mmm... inadvertent alliteration.... fun
13:00 < gladiatr> nested alliteration, no less.
13:02 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 246 seconds]
13:06 <@vpnHelper> RSS Update - forum: frequent disconnection of vpn connection <http://forums.openvpn.net/topic7833.html#p10698>
13:08 < Dougy> ecrist: i have an idea
13:08 < Dougy> can we add custom fields to phpbb for posters to add their configs to and require it (or require them to check a box saying none needed)
13:11 < krzee> meh
13:11  * ecrist orders two of these: http://www.tacticalgear.org/blog/firearms/surprise-cockfag-ar15-dust-cover-by-noveske/
13:11 < ecrist> Dougy: you're welcome to put the work in for that. :)
13:11 < krzee> cockfag? lol
13:11 <@vpnHelper> RSS Update - forum: Time Controlled Road Warrior connections <http://forums.openvpn.net/topic7834.html#p10699>
13:12 < gladiatr> lmao
13:12 < hjohnson> lol
13:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:18 < krzee> ecrist, you have *2* ARs?
13:18 < ecrist> not yet
13:18 < ecrist> just one
13:19 < krzee> did you score the halo-sight? i cant remember if you linked me to yours or one you wanted
13:20 < ecrist> yes, I have it now
13:20 < krzee> sweet!
13:20 < gladiatr> before you get your second AR, you have to complete the training of the spider monkey whose job it will be to keep the ammo flowing
13:20 < krzee> all dialed in with it?
13:20 < krzee> a friend of mine has a spider monkey!!! they rock!
13:20 < ecrist> http://www.eotech-inc.com/product.php?id=31&cat=1
13:21 <@vpnHelper> Title: Product: XPS3-0 | L-3 EOTech Holographic Weapons Systems (at www.eotech-inc.com)
13:21 < gladiatr> indeed!  as long as they have recently pooped... elsewhere
13:21 < ecrist> got it dialed in last weekend.
13:21 < ecrist> I'm nuts-on with the iron sights, too. :)
13:22 < krzee> same here
13:22 < krzee> but that halo-sight is SO lazy
13:23 < gladiatr> krzee, lazy in the sense that you don't necessarily have to be a very good aim to hit something with it?
13:23 <@vpnHelper> RSS Update - forum: Time Controlled Road Warrior connections <http://forums.openvpn.net/topic7834.html#p10700>
13:23 < krzee> yep, and if you are good you put in less effort
13:24 -!- ldaguilar [~luis@190.34.177.234] has quit [Ping timeout: 260 seconds]
13:24 < krzee> if i were in a real-life scenario where its important to pull off the fast shot, i would DEFINITELY want those halo-sights
13:24 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:24 < krzee> if i could take my time the iron sights are just fine
13:24 < gladiatr> well, there you have it.  Two trained spider monkeys and you don't even need to show up
13:24 < krzee> hahaha
13:31 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:32 < ecrist> the forum is starting to piss me off
13:33 < krzee> what pisses me off is vpnHelper's stream always being http://
13:33 < krzee> hehe
13:33 < krzee> s/stream/feed/
13:39 < gladiatr> ecrist, which aprt?
13:39 < gladiatr> *part
13:39 < ecrist> of what?
13:39 < gladiatr> the form?
13:40 < gladiatr> gah
13:40 < gladiatr> fingers
13:40 < gladiatr> forum?
13:40 < ecrist> the authentication/https stuff blows
13:40 < gladiatr> ah.  yes.  indeed it does.  i was just swearing about that not 30 minutes ago
13:40 < krzee> oh we were talking bout the same thing
13:41 < krzee> its not the forum's fault, its the RSS methnks
13:41 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
13:45 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
13:46 < genesis7> how to run openvpn server as service in windows?
13:47 < hyper_ch> s/windows/linux/
13:48 < genesis7> how?
13:48 < krzee> haha
13:48 < krzee> in the installer it asks if you wanna install the service...
13:48 < krzee> then you go enable the service...
13:48 < krzee> i dont really understand what part you didnt get intuitively
13:49 < genesis7> what is I dont enable that service thru installer. I would like it to enable manually
13:49 < krzee> you INSTALL it through the installer
13:49 < krzee> then you enable it manually in administrator tools - services
13:50 < genesis7> are those the only way to install and enable krzee?
13:50 <@vpnHelper> RSS Update - forum: Speed of tap device <http://forums.openvpn.net/topic7826.html#p10701>
13:51 < krzee> are you even serious?
13:51 < genesis7> yes
13:51 < krzee> install it through the installer, enable it like ANY OTHER service in windows
13:51 < genesis7> like portable
13:51 < krzee> no
13:53 < genesis7> like I just create folder of openvpn and just call it in windows command line to enable it as a service something like that. is that possible or no way?
13:54 < genesis7> i guess theres no other way. but thru installer. thanks.
13:55 -!- genesis7 [~rommel@amertospromotions.com] has quit []
13:56 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
13:56 <@vpnHelper> RSS Update - forum: OpenVPN pre installed ISO <http://forums.openvpn.net/topic7827.html#p10702>
13:58 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
14:01 < ecrist> krzee: the RSS causes problems, but the forum auth backend blows balls.
14:02 < ecrist> don't be surprised if I upgrade to vbulletin and integrate an ldap plugin in the future. ;)
14:02 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
14:03 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
14:04 < gladiatr> ecrist, you have no idea how many tears will be shed in bizzaro-land when you do that...
14:06 <@vpnHelper> RSS Update - forum: linux bridge eth interface with openvpn and DHCP <http://forums.openvpn.net/topic7811.html#p10703>
14:07 < ecrist> what do you mean?
14:08  * ecrist not sure if that's good or bad
14:09 < gladiatr> gah.  philistines... the land where superman's dimensional opposite, Bizzaro came from--where everything bad is good and everything good is bad :D
14:09 < ecrist> ah, right
14:10 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
14:11 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
14:11 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
14:11 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
14:32 -!- SlickDVL [~WarezMyGF@pool-96-255-138-222.washdc.fios.verizon.net] has quit [Remote host closed the connection]
14:39 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:40 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:42 -!- gyyrog [~gyyrog@24-231-158-155.static.trcy.mi.charter.com] has joined #openvpn
14:42 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
14:42 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
14:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
14:44 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:47 -!- gyyrog [~gyyrog@24-231-158-155.static.trcy.mi.charter.com] has quit [Ping timeout: 260 seconds]
14:47 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:48 -!- mirco [~mirco@pD9E57492.dip.t-dialin.net] has joined #openvpn
14:50 -!- gladiatr is now known as gladiatr_afk
14:59 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
15:00 -!- TACPILOT [~tacpilot@c-76-31-248-181.hsd1.tx.comcast.net] has joined #openvpn
15:01 < TACPILOT> hello
15:01 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:01 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
15:02 < TACPILOT> I have vpn setup so clients can connect to each other. What setting will allow clients to connect to each other but none allowed to access server resources ?
15:02 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
15:03 < krzee> firewall
15:03 < krzee> not an openvpn config issue
15:03 < krzee> bbl
15:03 < TACPILOT> firewall rules only option ?
15:03 < krzee> correct
15:03 < TACPILOT> k TY
15:04 < krzee> yw
15:04 -!- TACPILOT [~tacpilot@c-76-31-248-181.hsd1.tx.comcast.net] has left #openvpn []
15:04 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
15:14 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
15:14 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
15:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
15:17 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 264 seconds]
15:27 -!- EugeneKay is now known as EugeneKaway
15:30 < Dougy> katy perry sucks
15:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
15:37 -!- EugeneKaway is now known as EugeneKay
15:39 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
15:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:42 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
15:42 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
15:46 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:49 -!- Rajko [~rajkosto@2001:470:1f0b:728:2160:c308:3808:fb5b] has joined #openvpn
15:49 < Rajko> problemme
15:51 < Rajko> huge probleme
15:53 -!- personaljosh [~personalj@ip184-131-173-82.adsl2.static.versatel.nl] has joined #openvpn
15:54 < Rajko> i have a server with openvpn server
15:54 < Rajko> clients connect
15:54 < Rajko> when one client downloads something like 1MB/s
15:54 < Rajko> all other clients will have horrible latencies and bandwidths to anything accessed by openvpn
15:54 < eth00> well is the openvpn server overloading?
15:54 < Rajko> nope
15:55 < eth00> or it may just have a crappy uplink
15:55 < hjohnson> Rajko: makes sense.  Crpto is computationally expensive.
15:55 < Rajko> 0.2% cpu usage
15:55 < Rajko> on server
15:55 < Rajko> its also a dual dual 2.0ghz xeon
15:55 < Rajko> and if i access the server with no openvpn, everything flies
15:56 < Rajko> the latency is minimal, the bandwidth is huge
15:57 < Rajko> so the server has plenty of resources
15:59 < hjohnson> run top when you try the transfer
15:59 < Rajko> the transfer i going in the background
15:59 < Rajko> 1-2MB/s
15:59 < Rajko> top is run during it
15:59 < hjohnson> how much processor time is the openvpn process taking?
16:01 < dvl> Every so often, I think about using a service like dropbox, then I realize, just use my VPN.
16:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
16:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:05 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
16:08 -!- Rajko [~rajkosto@2001:470:1f0b:728:2160:c308:3808:fb5b] has quit [Ping timeout: 264 seconds]
16:16 -!- rajkosto [~rajkosto@2001:470:1f0b:728:2160:c308:3808:fb5b] has joined #openvpn
16:22 -!- SlickDVL [~WarezMyGF@pool-96-255-138-222.washdc.fios.verizon.net] has joined #openvpn
16:22 < SlickDVL> Hello all, is it possible to disable encryption for just a single user?
16:23 < dvl> SlickDVL: why would you want to do that?
16:23 < SlickDVL> you have my nick!
16:23 < SlickDVL> :c)
16:23 < dvl> sure I do...
16:23 < SlickDVL> well I just signed up with a provider
16:23 < SlickDVL> and the speeds are quite a bit slower with OpenVPN
16:24 < SlickDVL> he tried PPTP, and it was much faster however no open ports with PPTP
16:24 < dvl> SlickDVL: are you doing OpenVPN with udp or tcp?
16:24 < SlickDVL> UDP
16:24 < dvl> Good.
16:25 < dvl> Well, define 'quite a bit slower'
16:25 < SlickDVL> well I'm using it for torrents
16:25 < hjohnson> well there's your problem.
16:25 < SlickDVL> and with OpenVPN the speeds keep jumping
16:25 < SlickDVL> from 200kb/s to 500kb/s
16:25 < SlickDVL> down to 40kb/s
16:26 < SlickDVL> with PPTP, it's a steady ~800kb/s
16:26 < SlickDVL> the service I'm using allows torrents since it's in NL
16:26 < dvl> SlickDVL: and why are you doing torrents over OpenVPN?/
16:26 < SlickDVL> for privacy
16:26 < dvl> privacy from what?
16:27 < dvl> This is quite confusing....
16:27 -!- CloneA [Dave@129.21.132.74] has joined #openvpn
16:27 < SlickDVL> from DMCA notices
16:27 < hjohnson> it won't stop them, it just means your VPN provider will forward them on to you.
16:27 < CloneA> Hi guys, is there any reason openvpngui wouldnt work on 64 bit windows 7?
16:28 < SlickDVL> nah, it's legal in NL
16:28 < SlickDVL> at least for non applications
16:29 < SlickDVL> but anyways, back to original question and not this gray area
16:29 < dvl> CloneA: no idea, but : this is two years old: http://www.jpuddy.net/2009/05/06/using-openvpn-in-windows-7-64-bit/
16:29 <@vpnHelper> Title: Using OpenVPN in Windows 7 64-bit (at www.jpuddy.net)
16:29 < SlickDVL> there is no way to disable encryption by just client side?
16:29 < SlickDVL> ah I just fond out by owner that it's using TCP, not UDP
16:29 < hjohnson> that's your problem.
16:30 < dvl> SlickDVL: well, tcp almost always increases latency
16:30 < SlickDVL> ah
16:30 < dvl> SlickDVL: tell him to use UDP
16:30 < SlickDVL> owner says
16:30 < hjohnson> you run into BDP problems
16:30 < SlickDVL> "udp is faster , but tcp is more reliable"
16:30 < CloneA> Ahh, I still get unrouteable control packet.
16:30 < dvl> SlickDVL: he's wrong. 
16:30 < hjohnson> (Bandwidth delay product)
16:31 < dvl> SlickDVL: tell him you want UDP, admire the difference.
16:31 < SlickDVL> oke hes going to try UDP
16:31 < SlickDVL> if UDP doesn't do the trick, is there anything else I can do?
16:31 < SlickDVL> encryption is set at 1024
16:31 < dvl> *crickets*
16:31 < dvl> SlickDVL: it's not encryption that is slowing you down
16:32 < dvl> it is tcp
16:32 < SlickDVL> oh ok
16:32 < hjohnson> well, running 1024 bit crypto is also way overkill
16:32 < dvl> SlickDVL: next time you have a problem, don't guess at a possible solution.  come out and tell us the symptoms.  
16:32 < dvl> SlickDVL: you wasted a whole lot of time by asking about encryption.
16:33 < SlickDVL> same thing is happening with UDP :c/
16:33 < SlickDVL> he just changed it over
16:33 < dvl> SlickDVL: did you restart your OpenVPN client?
16:33 < dvl> SlickDVL: enabling debugging, watch the logs.
16:33 < SlickDVL> hmm let me ask, owner is remote desktopped
16:33 < SlickDVL> in to that box
16:33 < SlickDVL> and doing it
16:34  * hjohnson goes back to satcoms
16:35 < SlickDVL> UDP is giving bit more speeds, but still jumps around
16:36 < dvl> SlickDVL: logging...
16:36 < SlickDVL> think I should just restart the PC when making changes
16:36 < SlickDVL> or just shutting down openvpn client, and restarting is enough?
16:36 < dvl> the latter
16:37 < SlickDVL> thanks
16:39 -!- Rajko [~rajkosto@2001:470:1f0b:728:2160:c308:3808:fb5b] has joined #openvpn
16:40 -!- rajkosto [~rajkosto@2001:470:1f0b:728:2160:c308:3808:fb5b] has quit [Ping timeout: 260 seconds]
16:44 -!- mete [~metefr@212.83.42.243] has quit [Quit: Reconnecting]
16:50 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
16:51 -!- mete [~metefr@mete.shell.la] has joined #openvpn
16:57 -!- CloneA [Dave@129.21.132.74] has quit [Ping timeout: 240 seconds]
16:58 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:59 -!- CloneA [Dave@129.21.132.74] has joined #openvpn
17:05 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:07 -!- CloneA [Dave@129.21.132.74] has quit [Ping timeout: 260 seconds]
17:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:12 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
17:19 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
17:20 -!- dazo is now known as dazo_afk
17:22 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
17:23 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
17:28 -!- Guest68746 [~noname@noname.rula.net] has joined #openvpn
17:29 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
17:31 -!- loompek [~noname@kista.rula.net] has quit [Ping timeout: 248 seconds]
17:33 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
17:33 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:50 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
17:54 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
18:06 -!- krzie [krzee@hemp.ircpimps.org] has joined #openvpn
18:06 -!- krzie [krzee@hemp.ircpimps.org] has quit [Changing host]
18:06 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
18:22 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:37 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 255 seconds]
18:49 <@vpnHelper> RSS Update - forum: Kill The Resources Being Used By OpenVPN Desktop Client <http://forums.openvpn.net/topic7836.html>
18:53 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
18:55 <@vpnHelper> RSS Update - forum: Tunnelblick-Viscosity-Shimo - What's The Best OS X Client? <http://forums.openvpn.net/topic7837.html>
19:13 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
19:33 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:33 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:48 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
20:26 -!- Rajko [~rajkosto@2001:470:1f0b:728:2160:c308:3808:fb5b] has quit [Read error: Connection reset by peer]
20:36 -!- common [~common@p5DDA4B9E.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
20:40 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:47 -!- cromega [crome@moronia.hu] has quit [Read error: Operation timed out]
20:48 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
20:48 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
20:51 -!- cromega [crome@moronia.hu] has joined #openvpn
21:07 -!- personaljosh [~personalj@ip184-131-173-82.adsl2.static.versatel.nl] has quit [Quit: This computer has gone to sleep]
21:07 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
21:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:14 <@vpnHelper> RSS Update - forum: Another no traffic issue <http://forums.openvpn.net/topic7838.html>
21:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:17 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:25 -!- p3rror [~mezgani@41.140.44.198] has joined #openvpn
21:55 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:06 -!- EugeneKay is now known as EugeneKaway
22:09 -!- master_of_master [~master_of@p57B535C6.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:12 -!- master_of_master [~master_of@p57B52F4B.dip.t-dialin.net] has joined #openvpn
22:16 -!- jfang [~jfang@114.81.131.166] has joined #openvpn
22:16 < jfang> hello
22:16 < jfang> is someone online...
22:17 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
22:18 < jfang> some one like to chat?
22:19 -!- ldaguilar [~luis@186.176.7.194] has quit [Quit: Leaving]
22:24 -!- jfang [~jfang@114.81.131.166] has left #openvpn []
22:31 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:38 -!- jfang [~jfang@114.81.131.166] has joined #openvpn
22:39 < jfang> hello, some one there?
22:49 < krzie> !ask
22:49 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, or (#2) http://www.latinsud.com/answer/, or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
22:50 < krzie> if you asked your question back 40 minutes ago when you came, youd prolly already have an answer
23:02 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10707>
23:11 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
23:12 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:14 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
23:16 -!- kaushal [~kaushal@182.72.14.170] has joined #openvpn
23:16 < kaushal> hi
23:17 < kaushal> is there a way to seamlessly retain the openvpn session when i switch from wired to wifi and then back to wired ?
23:17 < kaushal> I have read about keepalive
23:17 < kaushal> but that needs to be set in the server config
23:17 < kaushal> I am using openvpn on Ubuntu 10.10 
23:18 < kaushal> Please suggest
23:18 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:19 < kaushal> Can it be done on Client Config ?
23:23 -!- tekzilla_ [~jon@e179212008.adsl.alicedsl.de] has quit [Quit: Lost terminal]
23:24 <@vpnHelper> RSS Update - forum: encryption <http://forums.openvpn.net/topic7786.html#p10708>
23:26 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:27 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 250 seconds]
23:28 < krzie> no
23:28 < krzie> your computer changes LAN ip
23:29 < krzie> this causes your router to think of you as an entirely new machine
23:29 < krzie> it will not just hand over your existing connection
23:29 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 250 seconds]
23:29 < krzie> maybe you could sort of arp poison yourself, then it should work :-p
23:30 < krzie> but im kidding, the answer is nope
23:30 < kaushal> krzie: ok
23:30 -!- TACPILOT [~tacpilot@c-76-31-248-181.hsd1.tx.comcast.net] has joined #openvpn
23:30 < TACPILOT> hello
23:30 < kaushal> krzie: so what about keepalive on server config ?
23:31 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
23:31 -!- psycodad [~cschnee@2001:4060:4419:b1:202:a5ff:fe84:e21c] has quit [Read error: Operation timed out]
23:31 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
23:31 < kaushal> so when i switch from wired to wifi, eth0 gets deactivated and wlan0 gets activated 
23:31 -!- psycodad [~cschnee@2001:4060:4419:b1:202:a5ff:fe84:e21c] has joined #openvpn
23:32 < kaushal> Any workaround for this specific case ?
23:32 < kaushal> krzie: someone suggested to add it in /etc/network/interfaces
23:32 < kaushal> but will that help ?
23:33 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
23:33 < TACPILOT> I am working with a minimalistic system.  I have source compiled for specific architecture.  Other than the openvpn application itself are there any other support files needed to be copied to the live system ??
23:35 < krzie> kaushal, what are you talking about?
23:36 < krzie> TACPILOT, be more specific, you will be able to actually install openvpn fresh on the new system right?  what type of system are we talking about
23:36 < TACPILOT> other than the obvious server/client configs and initscript
23:36 < krzie> or did you cross-compile and static link things in...?
23:37 < TACPILOT> it is compiled on the system that will be running it and will be cloned for others after final setup
23:37 < krzie> kaushal, keep-alive will sense the connection died, and restart it after you change interfaces
23:38 < kaushal> krzie: but it does not work when i set it in Client Config
23:38 < TACPILOT> the box currently has all the dev resources but will not be included in final boxes
23:38 < kaushal> Does that mean it overrides Client Confog
23:38 < kaushal> Config*
23:38 < krzie> TACPILOT, then make sure you static linked or you need to copy anything dynamicly linked, this is not unique to openvpn
23:39 < TACPILOT> because of this I can just clone this box so an needing to know what required files the make install places where
23:39 < krzie> kaushal, if the server has a keepalive or pushes any other settings that override what keepalive does, it will override
23:39 < krzie> and after that, all you need is the config and any files referenced in the config
23:39 < kaushal> so if there is no keepalive on server ?
23:39 < TACPILOT> k good thought
23:39 < krzie> and some way to start it
23:40 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Read error: Connection reset by peer]
23:40 < krzie> kaushal, if the server has a keepalive or pushes any other settings that override what keepalive does, it will override, otherwise your setting takes precendence
23:40 < TACPILOT> if static linked will the openvpn app be the only requirement beyond the config files ?
23:40 < kaushal> ok
23:40 < krzie> TACPILOT, thats why static linking exists
23:41 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
23:41 < TACPILOT> k just wanted to make sure there were no secondary files
23:41 < krzie> of course you still need things like route and ifconfig
23:41 < krzie> and openssl
23:41 < TACPILOT> k
23:41 < krzie> but as for openvpn, that should be all
23:42 < TACPILOT> thats wonderful news
23:42 < kaushal> krzie: so on server keepalive 10 600
23:42 < kaushal> and on client config i have keepalive 10 22
23:42 < krzie> kaushal, 
23:42 < krzie> !man
23:42 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
23:42 < kaushal> so will keepalive 10 22 gets overriden by keepalive 10 600 ?
23:43 < krzie> read what keepalive actually does
23:43 < krzie> yes
23:43 < kaushal> ok
23:43 < krzie> 600 is HUGE
23:43 < kaushal> yeah
23:43 < kaushal> 600 secs is 10 mins ?
23:43 < krzie> will set ping-restart to 6000
23:43 < krzie> er no
23:43 < krzie> 1200
23:44 < krzie> and pushes ping-restart 600
23:44 < krzie> which means no timeout for 5 minutes
23:44 < krzie> which means client wont know to reconnect for 5 minutes
23:44 < krzie> er 10 minutes
23:44 < kaushal> krzie: confused
23:45 < krzie> yes, because you arent looking at the manual
23:45 < TACPILOT>  krzie: TY have great day
23:45 < krzie> keepalive is a helper config option, it actually means a bunch of other options
23:45 < krzie> EACH of which you need to go read in the manual
23:45 < krzie> TACPILOT, np, you too
23:45 -!- TACPILOT [~tacpilot@c-76-31-248-181.hsd1.tx.comcast.net] has left #openvpn []
23:47 < kaushal> so set ping-restart 600 on client config ?
23:47 < kaushal> krzie: yes i have read the man openvpn
23:47 < kaushal> since ping-restart 600 is not at all set in server config
23:50 < kaushal> krzie: sure and reading the man openvpn again
23:52 < krzie> then dont you see what keepalive 10 600 ACTUALLY does, based on the example under --keepalive??
23:52 < kaushal> yes
23:52 < kaushal> krzie: understood now
23:53 < kaushal> so i need to set it correctly on server
23:53 < kaushal> right ?
23:53 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
23:53 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
23:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:55 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:57 < kaushal> krzie: got it and Thanks a lot
--- Day changed Thu Mar 24 2011
00:00 < kaushal> krzie: apologies for repeated questions
00:01 < krzie> np
00:09 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 250 seconds]
00:25 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
00:39 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Quit: No Ping reply in 180 seconds.]
00:39 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
00:47 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
00:49 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 248 seconds]
00:58 < jfang> have some one use Access Server? the default windows package is not that good ,  how can i tweak the windows installation package in access server?
00:58 < jfang> i mean for the clinet
01:05 < krzie> !AS
01:05 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
01:05 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
01:05 < krzie> see #4 for AS support
01:05 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
01:06 < krzie> we dont support it here
01:06 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
01:08 <@vpnHelper> RSS Update - forum: Help, how to use OVPN to create a mobile hub&spoke network? <http://forums.openvpn.net/topic7839.html>
01:14 -!- dazo_afk is now known as dazo
01:17 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:25 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
01:25 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Client Quit]
01:26 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 260 seconds]
01:51 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p10710>
01:57 -!- jfang [~jfang@114.81.131.166] has quit [Ping timeout: 252 seconds]
02:07 < krzie> !sample
02:07 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
02:10 -!- loompek [~noname@noname.rula.net] has joined #openvpn
02:13 -!- Guest68746 [~noname@noname.rula.net] has quit [Ping timeout: 276 seconds]
02:14 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:14 <@vpnHelper> RSS Update - forum: Help, how to use OVPN to create a mobile hub&spoke network? <http://forums.openvpn.net/topic7839.html#p10711>
02:15 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
02:16 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
02:17 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
02:21 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p10712>
02:26 < s7r> full ipv6 support will be available in next major release?
02:29 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
02:32 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:32 -!- mode/#openvpn [+o mattock] by ChanServ
02:32 <@vpnHelper> RSS Update - forum: How 2 connect a Mailserver over VPN to the public 'net? <http://forums.openvpn.net/topic7840.html>
02:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:39 <@vpnHelper> RSS Update - forum: How 2 connect a Mailserver over VPN to the public 'net? <http://forums.openvpn.net/topic7840.html#p10716> || Another no traffic issue <http://forums.openvpn.net/topic7838.html#p10715> || Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10714>
02:41 -!- mirco [~mirco@pD9E57492.dip.t-dialin.net] has quit [Quit: mirco]
02:45 -!- rjd__ [~rjd@212.112.31.11] has joined #openvpn
02:45 < rjd__> !winroute
02:45 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
02:45 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
02:51 -!- globs [~drahmany@c-24-19-250-170.hsd1.wa.comcast.net] has joined #openvpn
02:51 < globs> can anyone help me figure out how to require an openvpn connection to access a samba share?
03:00 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
03:12 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 260 seconds]
03:19 -!- s7r [~s7r@unaffiliated/s7r] has quit [Remote host closed the connection]
03:19 -!- globs [~drahmany@c-24-19-250-170.hsd1.wa.comcast.net] has quit [Quit: Lost terminal]
03:25 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:33 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p10717>
03:35 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: encryption <http://forums.openvpn.net/topic7786.html#p10718>
03:39 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
03:40 -!- corretico [~luis@201.201.44.82] has joined #openvpn
03:42 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
03:45 -!- mirco_ is now known as mirco
04:03 <@vpnHelper> RSS Update - forum: About openvpn IP <http://forums.openvpn.net/topic7841.html>
04:13 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:13 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:13 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:13 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:13 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:16 -!- maxJadi [~maxJadi@dhcp-164-192.nomad.chalmers.se] has joined #openvpn
04:16 -!- maxJadi [~maxJadi@dhcp-164-192.nomad.chalmers.se] has quit [Changing host]
04:16 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:18 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
04:21 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
04:33 <@vpnHelper> RSS Update - forum: About openvpn IP <http://forums.openvpn.net/topic7841.html#p10720>
04:34 -!- helge- [helge@olsentech.net] has joined #openvpn
04:35 < helge-> !welcome
04:35 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:35 < helge-> !goal
04:35 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:36 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 255 seconds]
04:39 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
04:46 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
04:51 <@vpnHelper> RSS Update - forum: How 2 connect a Mailserver over VPN to the public 'net? <http://forums.openvpn.net/topic7840.html#p10721>
04:51 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
04:53 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
04:54 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
05:03 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
05:04 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 250 seconds]
05:21 <@vpnHelper> RSS Update - forum: linux bridge eth interface with openvpn and DHCP <http://forums.openvpn.net/topic7811.html#p10722>
05:22 -!- LowKey [rhel@unaffiliated/lowkey] has quit [Ping timeout: 260 seconds]
05:25 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Read error: Operation timed out]
05:26 < helge-> ok, I've been googling and trying to understand pkcs#11, but can't understand it. I'd be very thankful for a tutorial on how to set up a server...
05:28 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
05:29 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
05:32 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has joined #openvpn
05:33 < axwell999> how to view the openvpn status log? not sure where to find it on linux server
05:33 < cromega> check your openvpn configuration
05:34 < helge-> should be in /var/log ;)
05:36 < axwell999> thx
05:36 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has quit []
05:39 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
05:42 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has joined #openvpn
05:42 < axwell999> hmm i cant find any logs pertaining to openvpn in sys/log
05:45 < helge-> /var/log/messages may have some entries?
05:50 < axwell999> ah yes
05:51 < axwell999> i see clients trying to connect and it says
05:51 < axwell999> client3/58.41.181.107:1055 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
05:51 < axwell999> Mar 24 10:50:37 vps6794 openvpn[13272]: read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (code=111)
05:53 < axwell999> seemed like it was working fine for the client
05:54 < axwell999> i see the handshake once per hour then suddenly that line about connection refused
05:54 < axwell999> quite baffeling
06:00 -!- rjd__ [~rjd@212.112.31.11] has left #openvpn []
06:05 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
06:19 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
06:20 -!- genesis7 [~rommel@amertospromotions.com] has quit [Client Quit]
06:26 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
06:34 -!- erika_ [~erika@stgt-5f709539.pool.mediaWays.net] has joined #openvpn
06:34 < erika_> is there a way to -client-to-client but having all packets received on the server as well?
06:34 < erika_> like a debug port on a switch
06:35 < axwell999> is it ok to use the same ta.key on each client?
06:35 < axwell999> this is for the hmac firewall thing
06:36 < helge-> ok, so can someone tell me how to set up pkcs#11 or should I shoot myself?
06:36 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
06:38 < Bushmills> erika_: all client-to-client packets go through the server. but openvpn routes them internally
06:39 < erika_> yes and I now want that a copy of the packet is given to the server
06:39 < Bushmills> (means, iptables or alternative routes setup through operating system won't see them)
06:40 < erika_> or wait, if I disable client-to-client is there an equivalent iptables rule?
06:40 < erika_> or will the kernel refuse to send back a packet to the interface where it came from?
06:41 < Bushmills> client-to-client disabled makes operating system responsible for routing vpnnet packets 
06:44 -!- buntfalke_ is now known as buntfalke
06:45  * helge- cries
06:53 < gladiatr> helge-, what exactly are you trying to accomplish?  pkcs11 is just a container
07:01 < helge-> I've been asked to set up an openvpn server to be used for testing smart card authentication
07:02 < helge-> I got a couple of .p12 files plus pass phrases and "Here you go, son. Fix it by friday?"
07:08 < helge-> I can't find _any_ info which explains how to do this
07:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
07:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:24 <@vpnHelper> RSS Update - forum: Windows file shares access through routed VPN <http://forums.openvpn.net/topic7842.html>
07:24 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
07:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:27 < genesis7> can I ask question please. what is the n max value in the inactive n [bytes]?
07:32 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
07:35 < gladiatr> helge-, hrm...
07:37 < gladiatr> genesis7, you might want to pose your question in openvpn-devel
07:37 < gladiatr> (I think that's the channel.  That or openvpn-dev)
07:38 < genesis7> will try but last time no one answers there
07:38 < gladiatr> you have to be patient.  They have day jobs :)
07:38 < helge-> glad: any ideas?
07:38 < helge-> gladiatr*
07:38 < gladiatr> helge-, thinkin'...
07:39 < gladiatr> check this site: http://acksyn.org/docs/smart-cards-openvpn.html
07:39 <@vpnHelper> Title: Michele Baldessari - Homepage (at acksyn.org)
07:41 < helge-> I read that...
07:42 < genesis7> gladiatr no one really answers there now.
07:45 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:46 < gladiatr> genesis7, the only other option I can suggest is to hunt down that variable in the source code to determine its type.  Honestly, I can't imagine that you'd ever run into the limit.  There are only 86400 seconds in a day :)
07:46 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:46 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
07:49 < gladiatr> helge-, what part did his process break down for you?  Just curious.  I haven't had the opportunity to work with smart cards or related tech as it pertains to openvpn yet.
07:49 <@dazo> gladiatr: that's really not a -devel question ... and most developers are also in this channel
07:49 < gladiatr> ah!
07:50 < gladiatr> dazo, it's an internaly-gutsish question, though :P
07:50 < gladiatr> s/ly/lly
07:50 <@dazo> genesis7: --inactive n [bytes] .... that means how many bytes is needed to be sent over the tunnel for it to be considered "alive", within the n-seconds
07:51 <@dazo>               If  the  optional bytes parameter is included, exit after n sec‐
07:51 <@dazo>               onds of activity on tun/tap device produces  a  combined  in/out
07:51 <@dazo>               byte count that is less than bytes.
07:51 <@dazo> (from man page)
07:53 < genesis7> what is the max value of n
07:55 < helge-> gladiatr: before I even got started
07:55 < helge-> the certificate provider had no documentation whatsoever, I can't find anything on the net
07:55 < helge-> I have managed to decrypt the .p12 files I got, installed openvpn server and now I'm stuck
07:56 < helge-> installed opensc on the server as well
07:56 < helge-> I feel like killing myself and everyone around me :/
07:57 < gladiatr> helge-, so these contain commercially issued client certificates?
07:59 < helge-> yes
07:59 < helge-> the issuer is a strategic partner of ours, so we got them free
07:59 < helge-> for internal use
08:00 < gladiatr> that's cool.  And you have the certificate authority certificate from that issuer?
08:01 < helge-> I have: root ca certificate, digital signature certificates and authentication certificates
08:02 < erika_> how can I give one client a fixed ip address and ones from a pool to the others?
08:02 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p10725> || Windows file shares access through routed VPN <http://forums.openvpn.net/topic7842.html#p10724>
08:02 < helge-> signature and auth certs are delivered as .p12 files which I have decrypted
08:04 < gladiatr> helge-, Ok.  just readin' some things here...
08:04 <@dazo> !man
08:04 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
08:04 <@dazo> genesis7: ^^^  look at #2
08:04 <@dazo> --inactive is described there
08:06 < gladiatr> helge-, how far into the acksyn page did you get?
08:11 <@dazo> genesis7: re: max value for 'n' and 'bytes', that's stored as a signed integer (usually 32bit value, so you have 2^31 bit available)
08:11 < helge-> glad: I read the whole thing, but it's more client oriented than I like
08:12 < helge-> once I get the server to run, I'll deal with the client stuff
08:12 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 255 seconds]
08:12 < gladiatr> helge-, that's actually where your configuration changes are going to occur (from what I'm reading).  The only thing the VPN server needs is the ca.crt from the source CA
08:13 < gladiatr> It appears that the business with the plugin and opensc are all client-side related
08:14 < helge-> the source CA being "us", we are supposed to prepare the client cards ourselves
08:15 < gladiatr> ohhhh
08:15 < helge-> point of this is being able to sell services where the customers can manage everything on their own
08:15 < gladiatr> gotcha
08:16 < gladiatr> So the smart cards you have now are uninitialized...
08:19 < helge-> oh cool, I got the server to start!
08:19 < gladiatr> grats!
08:20 < helge-> dunno if it's working as it should tho :p
08:20 < genesis7> @dazo, since N is the number of seconds of inactivity of the device, can I just put 9999999999 of the number of n seconds since I am using keepalive 5 60, therefore I guess there will still be activity using keepalive.
08:21 <@dazo> genesis7: why do you want to use --inactive to start with?
08:21 <@dazo> if you're using --keepalive ... and set a unrealistically high --inactivity timeout ... why bother with the latter at all?
08:22 < gladiatr> helge-, set your verb directive to 4, and you'll be about to see the ca cert data
08:23 <@dazo> genesis7: in OpenVPN use as few options as possible to solve your task ... adding more extras only makes your life more miserable when something stops working
08:23 < genesis7> because I dont want openvpn to exit but rather continue on its usual activity while I keep it alive using keepalive option 
08:23 <@dazo> and the default is to not use --inactivity at all
08:24 < genesis7> yes. but I read it in the manual of its use
08:24 < genesis7> therefore if I set it to 99999999 second of inactivity, it is really long time for openvpn to exit
08:25 < genesis7> if I am thinking it correctly of its use
08:25 <@dazo> but --inactivity is disabled by default (agreed, that could be stated in the docs) ... which makes 999999999999999999999999 a bogus value
08:25 <@dazo> in fact, if you do --inactivity 0 ... you disable it, which is the default anyway
08:26 < genesis7> that I would like to know because it does not state in the manual that zero value is the value to disable
08:29 <@dazo> agree, that can be improved
08:29 < genesis7> and I have not read the the default config for --inactive is disabled
08:29 <@dazo> however, default is disabled
08:29 -!- LowKey [noc@unaffiliated/lowkey] has joined #openvpn
08:30 < genesis7> so there is no need to place in the config
08:30 <@dazo> exactly my point
08:30 <@dazo> in fact most options in the man page state the default value if they are not disabled by default
08:31 < genesis7> alright. it was not really clear to me while reading the manual because there is default value of the option
08:32 < genesis7> alright. it was not really clear to me while reading the manual because there no is default value of the option --inactive. but since you already said it. I guess I should follow.
08:32 < genesis7> thanks for the input
08:32 <@dazo> genesis7: if you start OpenVPN with --verb 4, you'll get in the log all config variables and how they are interpreted
08:32 <@dazo> including all defaults
08:32 < erika_> when my openvpn server restarts the client does not reconnect automatically, why?
08:32 < erika_> I have to manually restart the client
08:32 < genesis7> i did not bother doing. maybe I will sometime.
08:33 <@vpnHelper> RSS Update - forum: About openvpn IP <http://forums.openvpn.net/topic7841.html#p10726>
08:34 < genesis7> My second question is: I can stop the openvpn service but when I restart it, I got error that the address is already in use.
08:34 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
08:36 < gladiatr> erika_, what do you have your keepalive set to on the client?
08:36 < erika_> not set
08:38 <@dazo> genesis7: then the openvpn process isn't really stopped yet ... try adding a little sleep(3) between the stop and start ... or check in between that the openvpn process really has stopped
08:38 <@dazo> pidof openvpn, f.ex
08:39 < genesis7> my recourse to that is to kill pidof openvpn. but my question is, why isnt openvpn really stopped yet while I have already called the service to stop. 
08:39 <@vpnHelper> RSS Update - forum: Two Openvpn Tunnels - Breaks Bridging <http://forums.openvpn.net/topic7843.html>
08:39 < gladiatr> erika_, put "keepalive n x" in your client config.  n denotes how often to send the keepalive ping and x is how long the client will wait before reconnecting.
08:41 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
08:41 < gladiatr> erika_, in seconds
08:42 <@dazo> genesis7: do you use any plug-ins?  if not, it might take some seconds or some time to shutdown ... especially if you use --explicit-exit-notify
08:43 <@dazo> only the log file can tell you why it hasn't quit yet
08:43 < erika_> gladiatr, thank you
08:43 < gladiatr> erika_, np
08:43 < genesis7> @dazo, no I dont use any plugins. 
08:43 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
08:44 < genesis7> @dazo, I dont use --explicit-exit-notify too
08:44 <@dazo> genesis7: then only the log file might give some hints why it doesn't stop
08:45 < genesis7> Ok. thanks @dazo for the input again. Can I now proceed to my third question?
08:46 <@dazo> I'm going into a meeting in 10 minutes, so my time is limited
08:46 <@dazo> but there are others here who can answer
08:46 < genesis7> this will be the last @dazo and it will be fast.
08:47 < genesis7> I am trying to create multiple vpn server but when I try to connect, it says, port already used.
08:47 <@dazo> each openvpn instance *must* be on separate ports ... they cannot share ports
08:47 <@dazo> unless you bind them to different IP addresses
08:48 < genesis7> I follow the example in the server configuration in the forums I have different server Ip but still same prob
08:49 <@dazo> netstat -lnptu | grep openvpn
08:49 < genesis7> what will that show me @dazo?
08:49 < genesis7> not familiar with that cmd
08:49 <@dazo> that should give you an idea what's already captured ... and if you have one 0.0.0.0:<openvpn port>, all IP addresses are caught by that process
08:49 <@vpnHelper> RSS Update - forum: Two Openvpn Tunnels - Breaks Bridging <http://forums.openvpn.net/topic7843.html#p10728>
08:49 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
08:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 276 seconds]
08:51 < genesis7> ok thanks. will try i
08:51 < genesis7> ok thanks. will try it
08:51 < genesis7> thanks again.
08:51 -!- genesis7 [~rommel@amertospromotions.com] has quit []
08:52 <@dazo> sure, no prob!
08:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
08:57 -!- erika_ [~erika@stgt-5f709539.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
08:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:58 -!- erika_ [~erika@stgt-5f709539.pool.mediaWays.net] has joined #openvpn
08:59 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:02 < gladiatr> !bridge
09:02 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc, or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ, or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
09:03 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:06 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:08 <@vpnHelper> RSS Update - forum: Another no traffic issue <http://forums.openvpn.net/topic7838.html#p10729>
09:08 -!- fly23 [~flybyhigh@knorr.darksystem.net] has left #openvpn []
09:10 -!- kaushal [~kaushal@182.72.14.170] has quit [Quit: leaving]
09:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:13 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:14 <@vpnHelper> RSS Update - forum: Two Openvpn Tunnels - Breaks Bridging <http://forums.openvpn.net/topic7843.html#p10731> || How 2 connect a Mailserver over VPN to the public 'net? <http://forums.openvpn.net/topic7840.html#p10730>
09:19 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:19 <@vpnHelper> RSS Update - forum: linux bridge eth interface with openvpn and DHCP <http://forums.openvpn.net/topic7811.html#p10732>
09:25 -!- ldaguilar [~luis@190.34.177.234] has joined #openvpn
09:26 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
09:28 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
09:28 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Read error: Operation timed out]
09:29 < bwallen> !help
09:29 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
09:29 < bwallen> !sample
09:29 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
09:29 < bwallen> !server
09:30 < bwallen> !welcome
09:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:30 < bwallen> !howto
09:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:32 < bwallen> !route
09:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:37 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
09:40 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
09:41 < genesis7> what is the solution for connection reset and inactivity timeout?
09:42 -!- EugeneKaway is now known as EugeneKay
09:53 < ecrist> genesis7: inactivity timeout means the client or server didn't respond within a window of time, so the process assumes the connection is dead
09:54 < ecrist> look on the man page for --inactive and --ping and --ping-restart and --keepalive
09:54 < genesis7> is there a way to eliminate inactivity timeout like option to put in my configuration?
09:54  * ecrist suggests the man page
09:55  * krzee seconds that suggestion
09:55 < genesis7> yes I have keepalive set to keepalive 5 60. I did not use the ping since keepalive simplifies the use of ping.
09:55 < genesis7> with --inactive option, I was advised a while ago not to include that option
09:56 < krzee> and did you read WHAT keepalive is?
09:56 < krzee> and then did you read what each of the options that keepalive expands to does?
09:56 < krzee> (hint: if you did, you wouldnt have your question)
09:58 < genesis7> yes like keepalive 5 60, it simply states ping 5 seconds and ping restart after 60 sec without reception of ping
10:01 <@dazo> genesis7: keepalive behaves differently when used on the server side, it expands slightly differently
10:05 < genesis7> like how?
10:05 < genesis7> kindly explain please. or should I also use the --inactive
10:07 < genesis7> how can I maintain activity between server and client especially when there is no internet activity in the client.
10:10 < genesis7> ...so that I can eliminate the inactivity timeout
10:12 < krzee> genesis7, 
10:12 < krzee> !man
10:12 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
10:13 < krzee> you were told where to read
10:13 < krzee> GO READ IT
10:13 < krzee> [08:01]  <dazo> genesis7: keepalive behaves differently when used on the server side, it expands slightly differently
10:13 < krzee> [08:05]  <genesis7> like how?
10:13 < krzee> [08:05]  <genesis7> kindly explain please. or should I also use the --inactive
10:13 < genesis7> I have been reading though krzee. really..
10:13 < krzee> it fully explains
10:13 < krzee> WITH an example
10:14 < krzee> your asking for him to explain proves you didnt read it
10:14 < krzee> and you also didnt read --inactive since you asked that
10:14 < krzee> and the dev channel is NOT for you to ask for config help in
10:15 < genesis7> yes I did but I just dont know if I am comprehending it right.
10:15 < krzee> paste the part that you dont understand
10:15 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:15 < krzee> ask questions about what you are reading and cant figure out
10:15 -!- genesis7 [~rommel@amertospromotions.com] has quit []
10:16 < krzee> instead of blindly fumbling around proving you didnt read the manual
10:16 < krzee> hahahah or that
10:16 < krzee> its gunna be one of THOSE days isnt it
10:16 <@dazo> probably :)
10:16 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:21 < gladiatr> krzee, lol
10:28 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 240 seconds]
10:31 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
10:39 <@vpnHelper> RSS Update - forum: CentOS - CCD Directory not being found i think..... <http://forums.openvpn.net/topic7844.html>
10:51 <@vpnHelper> RSS Update - forum: How 2 connect a Mailserver over VPN to the public 'net? <http://forums.openvpn.net/topic7840.html#p10734>
10:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
10:56 <@vpnHelper> RSS Update - forum: CentOS - CCD Directory not being found i think..... <http://forums.openvpn.net/topic7844.html#p10735>
10:58 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
10:59 < genesis7> what is write TCPv4_CLIENT: Connection reset by peer (WSAECONNRESET) why do it happen?
10:59 < krzee> its not the real error
11:00 < krzee> theres something else above it most likely
11:00 < krzee> also, if you can avoid using TCP, do
11:00 < krzee> !tcp
11:00 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
11:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:02 <@vpnHelper> RSS Update - forum: CentOS - CCD Directory not being found i think..... <http://forums.openvpn.net/topic7844.html#p10737> || Vista and Seven send wrong credentials over a VPN tunnel <http://forums.openvpn.net/topic7845.html>
11:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:02 < genesis7> it appears when I experiment on my client config trying to push ping and ping restart to server. but when I just use keepalive only connection reset can be seen.
11:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:06 -!- genesis7 [~rommel@amertospromotions.com] has quit []
11:06 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:07 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
11:24 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has joined #openvpn
11:27 < grendal_prime> i got a machine that is experiencing some odd behaviour. its a win7 with tap version 9.  We get a "initialization complete but with errors" message..then the box seems as though its connected but...cannot ping out.
11:28 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Quit: Leaving]
11:29 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
11:29 < grendal_prime> durring the investigation of this we did some sniffs and discovered that there is a metric ton of dhcpnacks from the server on this network.
11:29 < grendal_prime> is that normal?
11:31 < bwallen> Ok, newbie question. 192.168.2.x is my lan. Should clients who connect also be given this type of address, or should I make it something different like 192.168.3.x?
11:31 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
11:34 -!- ScriptFanix [~vincent@2001:910:100b:1:1e:6ff:fe7e:e643] has quit [Quit: bbl]
11:38 -!- albech [~thomas@110.164.238.27] has joined #openvpn
11:38 <@vpnHelper> RSS Update - forum: Port Forwarding <http://forums.openvpn.net/topic7821.html#p10739> || Few random questions <http://forums.openvpn.net/topic7608.html#p10738>
11:40 < erika_> can I receive copies of all packets that are transfered in client-to-client mode at the server interface?
11:40 < erika_> (like a debug port on a switch)
11:44 < krzee> you actually MUST
11:45 < krzee> if you dont use --client-to-client you can sniff it at the interface
11:45 < krzee> but either way it MUST flow through the server
11:45 < krzee> !c2c
11:45 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
11:45 <@vpnHelper> clients
11:47 < erika_> yes, they go through the server but they do not appear as incoming at the tap interface
11:47 < erika_> which means I can not use standard tcpdump tools
11:47 < erika_> when I disable client-to-client however clients can not communicate anymore
11:48 < erika_> adding routes helps, but not for non-ip traffic
11:51 -!- Blues-Man [~bluesman@95.239.124.200] has joined #openvpn
11:55 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
11:56 <@vpnHelper> RSS Update - forum: CentOS - CCD Directory not being found i think..... <http://forums.openvpn.net/topic7844.html#p10740>
11:57 < krzee> why do you need tap?
11:58 < krzee> with tap you in fact NEED c2c for them to communicate, and that forces packets to NOT hit the interface
11:59 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:01 -!- ScriptFanix [~vincent@2001:910:100b:11:215:ff:fe12:11d1] has joined #openvpn
12:09 -!- Guest68746 [~noname@noname.rula.net] has joined #openvpn
12:12 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
12:12 -!- loompek [~noname@noname.rula.net] has quit [Ping timeout: 240 seconds]
12:13 < erika_> krzee, I want broadcast to work
12:13 < erika_> krzee, I think that goes under "lan gaming"
12:13 < krzee> oh, well thats not ip only then ;]
12:13 < erika_> not?
12:13 < krzee> then you have 2 options
12:13 < krzee> !bcrelay
12:13 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:13 < krzee> grr
12:14 < krzee> well there is a tool called bcrelay, i THINK its in the pptp trunk
12:14 < krzee> it relays broadcasts, you would run it on the server
12:14 < krzee> OR
12:14 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:15 < krzee> a bridge, which would increase traffic a bit with 100 clients, since you would have a broadcast domain of 100 machines and would be forwarding a whole lot of arp traffic
12:15 < krzee> and would allow arp poisoning over the entire vpn
12:15 < krzee> i would avoid the bridge and use the bcrelay, but you do whatever you like
12:16 < erika_> but the bridge does only work if every client has its own openvpn instance at the server
12:18 < erika_> what about adding an option to openvpn "--client-to-client-mirror" that posts a copy of every packet to the tap interface?
12:18 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
12:19 < krzee> that is not true
12:19 < erika_> krzee, not?
12:19 < krzee> server-bridge allows multiple clients for 1 interface
12:19 < krzee> like server, but for bridge :-p
12:20 < erika_> but they can't talk to each other
12:21 < erika_> the last time I checked 
12:21 < krzee> umm, yes they can
12:21 < erika_> I will test it again
12:21 < krzee> with --client-to-client
12:21 < erika_> ah but then I can not debug client-to-client traffic
12:21 < krzee> but it flows over the bridge still, so you should be able to sniff the bridge interface
12:21 < krzee> note, i would still NOT do this for security reasons and overhead reasons
12:21 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:21 < krzee> but if you are aware and dont care, go for it
12:23 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:24 < erika_> I have tried again
12:24 < erika_> and I do not see client-to-client traffic 
12:24 < bwallen> Should the IP address that my VPN clients get be the same as what my LAN clients get (ie 192.168.2.x for either VPN or LAN)?
12:24 < erika_> I see the ICMP requests
12:24 < krzee> erika_, on the bridge?
12:24 < erika_> yes
12:24 < krzee> ok, well i dont do bridges so i cant comment on that further
12:25 < krzee> i will very likely never setup a bridge setup
12:29 -!- psha [~psha@213.208.162.69] has joined #openvpn
12:29 < erika_> so I need an option to see the packets
12:29  * psha observes topic
12:29 -!- psha [~psha@213.208.162.69] has left #openvpn []
12:30 < erika_> maybe it would be better to have some kind of debugging unix domain socket or something
12:30 < erika_> where packets can be captured from openvpn
12:33 < erika_>  or wait maybe I can capture the encrypted packets instead
12:33 < erika_> and decrypt them with the key
12:33 < krzee> or you could run a bcrelay :-p
12:34 < krzee> i happen to KNOW that would work, it would also decrease your overhead and make the inside of your vpn more secure
12:34 < krzee> i know a lot less about bridges than i do about using a routed tun setup
12:35 < krzee> i thought bridge would work, especially after dazo said he thought it would (i know 100% he knows more about bridges than me)
12:35 < krzee> (openvpn bridges)
12:35 < krzee> but i KNOW tun with bcrelay would work
12:36 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
12:38 < kraut> wtf?
12:38 < kraut> tls negotiation fails on three clients if i remove the listen param on the server. the server itself is multihomed in the internet with two IPs. the connect ip isn't the primary ip.
12:38 < kraut> so when the server answers to the client without this listen param, it will comunicate with the wrong ip
12:39 < kraut> so far... that's why the tls neg fails
12:39 < kraut> but the fourth client works fine...?!
12:39 < kraut> it hasn't any problem with or without the listen param
12:39 < kraut> do i need to understand this?
12:41 < axwell999> hey, any way of stopping the connection between client and server from timing out due to inactivity?
12:42 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
12:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:44 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
12:45 < bwallen> I can connect to my openvpn server and get an IP, but I can't get any traffic between the client and a server on the network. Any ideas?
12:47 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
12:55 -!- albech [~thomas@110.164.238.27] has quit [Quit: Ex-Chat]
12:55 < kraut> axwell999: have a look on "keepalive"
12:56 -!- ldaguilar [~luis@190.34.177.234] has quit [Remote host closed the connection]
13:00 < axwell999> k
13:07 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Read error: Operation timed out]
13:16 -!- p3rror [~mezgani@41.140.44.198] has quit [Ping timeout: 255 seconds]
13:16 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:16 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
13:16 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
13:16 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:21 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10741>
13:22 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Quit: Leaving]
13:24 -!- aranax [~wences.ar@98.162.216.201.static.intelnet.net.gt] has joined #openvpn
13:25 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:29 -!- cromega [crome@moronia.hu] has quit [Read error: Operation timed out]
13:30 -!- cromega [crome@moronia.hu] has joined #openvpn
13:32 < grendal_prime> having a hell of a time with the windows 7 thang
13:32 -!- p3rror [~mezgani@41.248.186.239] has joined #openvpn
13:33 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:33 < grendal_prime> krzee, you run into this yet?
13:33 < grendal_prime> http://thread.gmane.org/gmane.network.openvpn.user/31936
13:33 <@vpnHelper> Title: Gmane Loom (at thread.gmane.org)
13:34 < grendal_prime> !goal
13:34 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:36 < grendal_prime> I want a windows 7 machine to properly not loose its routing table and assign that funky "non routeable" 169 subnet and then bail out assuming that the vpn is connected and routing is working.
13:36 < grendal_prime> i know thats probably alot and it looks like (from that thread) that its being worked on.
13:37 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
13:38 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:43 < gladiatr> grendal_prime, It sounds like its being looked into from the mailing list thread.  I'm running Win7-64 ultimate and have had 0 problems outside having to shutdown the windows dns client (sometimes) after connecting, so I wouldn't begin to know where to tell you to start.
13:49 < aranax> hi, What do  I need in the config to make it automatically reconnect instead of  having to do it manually? windows server 2003
13:50 < gladiatr> spider monkey
13:53 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
13:54 < gladiatr> man, did everyone with a connectivity problem have a convention last weekend and agree to show up in this channel serially today?
13:54 < gladiatr> :)
13:55 < krzee> grendal_prime, i have very little windows experience in the last 7 years
13:55 < krzee> but i do know where that broken link should point (and i brought that broken link up to openvpn technologies awhile ago)
13:56 -!- xheliox [jeff@pdpc/supporter/student/xheliox] has joined #openvpn
13:57 < hyper_ch> krzee: windows didn't change much in the last 7 years :)
13:57 < krzee> umm, yes it did
13:58 < krzee> XP to windows 7 has a lot of changes
13:58 < krzee> http://openvpn.net/index.php/open-source/faq.html#dhcpclientserv
13:58 <@vpnHelper> Title: FAQ Community (at openvpn.net)
13:58 < krzee> grr
13:58 < krzee> http://openvpn.net/index.php/open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html
13:59 -!- twobrat [~jrlane@161.210.61.91] has joined #openvpn
13:59 < twobrat> !welcome
13:59 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:02 < twobrat> !goal
14:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:02 < twobrat> How goes it?
14:02 < krzee> twobrat, good stuff on reading / following the topic!
14:03 < krzee> state your goal and lets do this ;]
14:03 < twobrat> sweet, im using freebsd, one interface, trying to set it up to allow a client to vpn to it and use its internet connection
14:03 < krzee> !redirect
14:03 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:03 < krzee> !fbsdnat
14:03 <@vpnHelper> "fbsdnat" is see http://cavanantha.wordpress.com/2007/09/16/nat-on-freebsd-using-pf/ for a basic howto for NAT on FreeBSD
14:03 < krzee> !fbsdipforward
14:03 <@vpnHelper> "fbsdipforward" is is set gateway_enable="YES" in /etc/rc.conf to enable ip forwarding in freebsd
14:04 < krzee> !pfnat
14:04 <@vpnHelper> "pfnat" is nat on <inf> from <subnet/ip> to <subnet/ip> -> <nat_ip>
14:04 < krzee> thats what to change from something like this:
14:04 < krzee> !sample
14:04 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:04 < twobrat> i have gateway enabled, i was trying to do it with ipfw? not reccomended?
14:04 < krzee> do it how you like
14:05 < krzee> just do the equivilent
14:05 < krzee> i once used ipf / ipfw / pf seperate times
14:05 < krzee> i prefer pf personally
14:06 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
14:06 < krzee> moin kraut 
14:06 < twobrat> yea i usually work with pf actually
14:07 < twobrat> i just saw some article with ipfw so i went for that
14:07 < gladiatr> twobrat, the only thing you have to deal with firewall-wise is nat
14:07 < gladiatr> so, if you're familiar with pf, it'll work splendidly.
14:07 < kraut> moin krzee 
14:08 < gladiatr> oh, of course, you'll have to enable traffic from the vpn net, etc
14:08 < kraut> still flapping for a while, sorry
14:08 < twobrat> so what on the client i route everthing though the tunnel interface? what about dns?
14:10 < krzee> np kraut =]
14:10 < krzee> twobrat, 
14:10 < krzee> !def1
14:10 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
14:10 < gladiatr> twobrat, the same.  You could always push one of the open dns server sets (I think google has some)
14:10 < krzee> !pushdns
14:10 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
14:11 < gladiatr> you don't want him to try to use his local ISPs name servers from your host.  One would hope it wouldn't work
14:11 < krzee> seriously hope it wouldnt... since that would make them a ddos amplification relay
14:11 < gladiatr> indeed
14:14 < twobrat> cool
14:15 < twobrat> dont suppose anyone knows how to scroll up in irssi with a mac?
14:16 < gladiatr> page-up doesn't work?
14:17  * Blues-Man good blues bye
14:18 -!- Blues-Man [~bluesman@95.239.124.200] has quit [Remote host closed the connection]
14:19 < twobrat> mac keyboard has no page-up
14:19 <@vpnHelper> RSS Update - forum: connected to Tap server.. but can't ping or access anything <http://forums.openvpn.net/topic7606.html#p10743> || CentOS - CCD Directory not being found i think..... <http://forums.openvpn.net/topic7844.html#p10742>
14:20  * gladiatr shakes his head
14:21 < twobrat> hahaha
14:21 < gladiatr> You have evidently not upgraded your brain to OS XI.  It comes with a free 1-year license for eidetic memory :D
14:21 < twobrat> fn shift, up arrow
14:21 < gladiatr> how... intuitive...
14:22 < krzee> twobrat, yes it does
14:22 < krzee> oh nm you found it
14:22 -!- Guest68746 is now known as loompek
14:22 < grendal_prime> krzee, ya i dont use windows myself ither..but this appliance that im having to troubleshoot does..
14:24 -!- mete [~metefr@mete.shell.la] has quit [Remote host closed the connection]
14:24 < krzee> grendal_prime, =/ sry to hear that, did you try the link i gave?
14:25 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
14:28 -!- mete [~metefr@mete.shell.la] has joined #openvpn
14:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
14:29 < axwell999> krzee, does the openvpn connection disconnect the client if he is idle for say several hours? sometimes when i sleep i leave the vpn on, then in the morning it wont work unless i close the openvpn gui and restart it
14:29 -!- erika_ [~erika@stgt-5f709539.pool.mediaWays.net] has quit [Remote host closed the connection]
14:29 < axwell999> im guessing it is because of idleness for too long but wish it would just stay open always 
14:30 < krzee> axwell999, it can if you would like, but not necessarily, unless you did something to tell it to, im guessing it could be the laptop's power saving features 
14:30 < krzee> oh you didnt say laptop
14:30 < krzee> the computer's power saving features*
14:30 < axwell999> nope desktop always powered on
14:31 < axwell999> im using default config files that are in the sample folder
14:31 < krzee> erm, there is no default working configs
14:31 < krzee> theres example files that require editing to work...
14:31 < axwell999> well i changed just the name and location of key files and small things
14:32 < axwell999> i didnt change anything else except push a dns
14:32 < krzee> i dunno what windows ships with
14:32 < krzee> i dont use windows
14:32 < krzee> but if you want:
14:32 < axwell999> the server is linux
14:32 < krzee> !configs
14:32 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
14:32 < krzee> note the WITHOUT comments
14:32 < axwell999> just wondered if there's something i can put in server config so that it wont disconnect idle clients
14:32 -!- mant1s [~mant1s@joseph-fasulo1-4.um.maine.edu] has joined #openvpn
14:32 -!- mant1s [~mant1s@joseph-fasulo1-4.um.maine.edu] has quit [Changing host]
14:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:32 < axwell999> ok i'll give that a shot
14:33 < krzee> yes, a --keepalive and no --inactive
14:33 < axwell999> it has keepalive 10 120 already
14:34 < axwell999> http://pastebin.com/PsxXUyhb
14:37 < axwell999> no --inactive how do i use that
14:37 < axwell999> not sure what to type exactly
14:39 < krzee> there is a manual you know
14:39 < krzee> !man
14:39 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
14:40 < axwell999> it appears that innactive makes openvpn close if idle 
14:40 < axwell999> rather than stay open
14:42 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:43 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
14:45 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:46 < krzee> false
14:46 < krzee> i leave tunnels open for weeks
14:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
14:50 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
14:54 -!- jY [~jy@photoblog.com] has joined #openvpn
14:55 < jY> the dns servers i need to push to clients are on 192.168.1.0/24 which is used by many home routers.. can I get around this by pushing all traffic through the vpn?
14:56 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
14:56 -!- twobrat [~jrlane@161.210.61.91] has quit [Ping timeout: 264 seconds]
14:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
14:59 -!- twobrat [~jrlane@161.210.61.91] has joined #openvpn
15:00 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:00 < twobrat> okay does this sound resonable for a pf rule: nat on tun0 from 10.8.1.0/24 to any -> (re0)
15:02 < twobrat> same situation as earlier btw, tring to get client to use host vpn internet
15:07 < gladiatr> twobrat, one wrong snipit.  nat on (ext interface) from...
15:08 < twobrat> so nat on (re0) from ... to any -> (re0)
15:13 < twobrat> okay testing that, ill be back, its gonna disconnect me
15:15 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
15:17 -!- twobrat [~jrlane@161.210.61.91] has quit [Ping timeout: 250 seconds]
15:24 <@vpnHelper> RSS Update - forum: Odd, new error: Connection refused (WSAECONNREFUSED) <http://forums.openvpn.net/topic7846.html>
15:25 -!- EugeneKay is now known as EugeneKaway
15:26 -!- twobrat [~jrlane@161.210.61.91] has joined #openvpn
15:29 <@vpnHelper> RSS Update - forum: DNS requests on wrong interface... <http://forums.openvpn.net/topic7847.html>
15:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:32 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
15:32 -!- twobrat [~jrlane@161.210.61.91] has quit [Ping timeout: 276 seconds]
15:41 <@vpnHelper> RSS Update - forum: Odd, new error: Connection refused (WSAECONNREFUSED) <http://forums.openvpn.net/topic7846.html#p10747> || DNS requests on wrong interface... <http://forums.openvpn.net/topic7847.html#p10746>
15:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:44 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
15:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
15:46 <@vpnHelper> RSS Update - forum: Client reply only after clean ARP cache <http://forums.openvpn.net/topic7835.html#p10748>
15:48 < axwell999> hmm krzee
15:48 < axwell999> how do u keep it open for weeks
15:48 < axwell999> mine consitantly disconnects overnight due to idleness
15:48 < axwell999> and my desktop is fully powered
15:49 <@dazo> ecrist krzee: vpnHelper banned me on #openvpn-devel ... can you help?
15:51 <@dazo> mattock: ^^ 
15:52 <@mattock> dazo: hmm, maybe after learning what I need to do
15:52 <@mattock> just a sec
15:52 < Bushmills> !keep-alive
15:52 < Bushmills> !factoids search alive
15:52 <@vpnHelper> No keys matched that query.
15:53 < Bushmills> axwell999: check out --keepalive
15:53 <@dazo> mattock: ecrist: krzee:  never mind ... I found the magic spell
15:53 < Bushmills> !keepalive
16:04 -!- twobrat [~jrlane@161.210.61.91] has joined #openvpn
16:10 <@vpnHelper> RSS Update - forum: DNS requests on wrong interface... <http://forums.openvpn.net/topic7847.html#p10749>
16:10 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Read error: Operation timed out]
16:11 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
16:18 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
16:19 -!- luneff [~yury@84.51.201.89] has joined #openvpn
16:21 < twobrat> quuit
16:21 -!- twobrat [~jrlane@161.210.61.91] has quit [Quit: leaving]
16:21 -!- EugeneKaway is now known as EugeneKay
16:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
16:50 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
16:50 -!- grendal_prime [~sgraham@riverbank.fpdomain.com] has quit [Quit: Ex-Chat]
16:50 -!- luneff [~yury@84.51.201.89] has joined #openvpn
16:57 < axwell999> bush mills the server already has keepalive set to 10 120
16:57 < axwell999> still overnight my vpn drops
17:00 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
17:00 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
17:00 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Ping timeout: 240 seconds]
17:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:20 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Read error: Operation timed out]
17:20 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
17:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
17:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:04 <@vpnHelper> RSS Update - forum: Vista and Seven send wrong credentials over a VPN tunnel <http://forums.openvpn.net/topic7845.html#p10751> || DNS requests on wrong interface... <http://forums.openvpn.net/topic7847.html#p10750>
18:07 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
18:10 <@vpnHelper> RSS Update - forum: CentOS - CCD Directory not being found i think..... <http://forums.openvpn.net/topic7844.html#p10752>
18:20 -!- dazo is now known as dazo_afk
18:28 <@vpnHelper> RSS Update - forum: Client reply only after clean ARP cache <http://forums.openvpn.net/topic7835.html#p10753>
18:42 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:50 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
19:02 -!- aranax [~wences.ar@98.162.216.201.static.intelnet.net.gt] has left #openvpn []
19:03 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Ping timeout: 276 seconds]
19:06 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
19:23 -!- UdontKnow is now known as e
19:26 -!- e is now known as root
19:34 < Dougy> ecrist: i'm going to try and be more actie around the forums
19:34 <@vpnHelper> RSS Update - forum: Need help: openvpn is killing Named (linux) <http://forums.openvpn.net/topic7791.html#p10755> || CentOS - CCD Directory not being found i think..... <http://forums.openvpn.net/topic7844.html#p10754>
19:34 < Dougy> sorry for really not doing shit on it
19:39 < ecrist> *shrug*
19:39 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p10757> || Few random questions <http://forums.openvpn.net/topic7608.html#p10756>
19:39 < ecrist> I just stop around once in a while so people know who's boss.
19:39 < ecrist> ;)
19:41 < Dougy> i am going to try to stop by more.. since i dont help in here i want to keep my forum authority :P it's the only actual cool role i have in any organization
19:41 < Dougy> makes me feel good inside
19:45 <@vpnHelper> RSS Update - forum: OpenVPN client for the iPhone and iPad <http://forums.openvpn.net/topic4568.html#p10758>
19:48 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
19:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:59 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Ping timeout: 240 seconds]
20:00 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
20:23 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
20:52 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
21:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:07 -!- CorvetteZR1 [~kvirc@CPE0014d11371a6-CM001ceab56a26.cpe.net.cable.rogers.com] has joined #openvpn
21:08 < CorvetteZR1> hello.  sorry if this has been asked before, but i have a problem with connecting to openvpn from windows 7
21:08 < CorvetteZR1> i launch the client with admin privileges, i can see that the routes have been added and i can ping the openvpn server
21:09 < CorvetteZR1> but i can't ping anything else on the remote network
21:09 < CorvetteZR1> what might i be missing?
21:14 < |Mike|> the topic of this channel sir.
21:15 < Bushmills> !route
21:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:15 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:15 < CorvetteZR1> what do you mean by don't skim it? :)
21:15 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:16 < |Mike|> oc80z: jo
21:16 < CorvetteZR1> i realize it might be my firewall, but i allowed the openvpn vlan acces to the other vlans...
21:16 < |Mike|> CorvetteZR1: you might want to read Bushmills his comment :-)
21:16 < CorvetteZR1> !goal
21:16 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:16 < CorvetteZR1> ate
21:16 < CorvetteZR1> aye*
21:16 < CorvetteZR1> !route
21:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:17 < CorvetteZR1> gotcha :)
21:17 < Bushmills> i think that's what is meant by "don't skim it"
21:17 < |Mike|> indeed!
21:20 -!- eth00 [~Johnrdp@unaffiliated/eth00] has quit [Ping timeout: 250 seconds]
21:25 -!- eth00 [~Johnrdp@colt.eth0.us] has joined #openvpn
21:25 < CorvetteZR1> naw, i'm still stuck
21:25 < CorvetteZR1> added the 2 lines at the bottom of that link, but it's still not getting past the server
21:40 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:54 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
21:54 -!- Netsplit *.net <-> *.split quits: aef_, Peer^, Bushmills, fahadsadah, katoen_, master_of_master, ronnocol, LowKey, sedulous, tjz,  (+19 more, use /NETSPLIT to show all of them)
21:58 -!- Netsplit over, joins: JPeterson, master_of_master, Clete2, whomee, openbsdnoob, elly, tjz, sia^pwnnt, katoen_, Bushmills
22:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:00 -!- mete [~metefr@mete.shell.la] has joined #openvpn
22:00 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
22:00 -!- LowKey [noc@unaffiliated/lowkey] has joined #openvpn
22:00 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:00 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
22:00 -!- Damme [~damme@206.216.95.91.static.ter-s.siw.siwnet.net] has joined #openvpn
22:00 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
22:00 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
22:00 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
22:00 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
22:00 -!- d12fk [~heiko@vpn.astaro.de] has joined #openvpn
22:00 -!- ronnocol [~lance@2001:1868:214::dead:beef] has joined #openvpn
22:00 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
22:00 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
22:00 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
22:00 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
22:00 -!- nb [~nb@fedora/nb] has joined #openvpn
22:00 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has joined #openvpn
22:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:06 -!- CorvetteZR1 [~kvirc@CPE0014d11371a6-CM001ceab56a26.cpe.net.cable.rogers.com] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
22:11 -!- master_of_master [~master_of@p57B52F4B.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
22:13 -!- master_of_master [~master_of@p57B57EDE.dip.t-dialin.net] has joined #openvpn
22:13 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:23 -!- EugeneKay is now known as EugeneKaway
22:27 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:31 -!- CorvetteZR1 [~kvirc@CPE0014d11371a6-CM001ceab56a26.cpe.net.cable.rogers.com] has joined #openvpn
22:31 < CorvetteZR1> i found the problem!
22:31 < CorvetteZR1> the hosts on the lan don't use the openvpn server as the default gw
22:31 < CorvetteZR1> that's why the openvpn client couldn't communicate with them.  i fixed :)
22:32 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
22:35 -!- CorvetteZR1 [~kvirc@CPE0014d11371a6-CM001ceab56a26.cpe.net.cable.rogers.com] has quit [Client Quit]
22:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
22:45 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
22:51 -!- EugeneKaway is now known as EugeneKay
22:51 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:14 -!- axwell999 [~axwell999@82-168-191-228.ip.telfort.nl] has quit [Ping timeout: 248 seconds]
23:33 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
23:35 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:47 -!- AlbertoP [~alberto@pdpc/supporter/active/AlbertoP] has joined #openvpn
23:47 < AlbertoP> !welcome
23:47 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:47 < AlbertoP> !goal
23:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:49 < AlbertoP> anybody with experience of openvpn on opensuse?
23:50 < AlbertoP> I am having a "little fight" with the firewall :)
23:53 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 246 seconds]
23:53 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 248 seconds]
23:58 -!- EugeneKay is now known as EugeneKaway
--- Day changed Fri Mar 25 2011
00:01 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
00:03 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
00:20 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:23 <@vpnHelper> RSS Update - forum: Port Forwarding <http://forums.openvpn.net/topic7821.html#p10759>
00:25 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
00:30 -!- corretico [~luis@201.201.44.82] has joined #openvpn
00:42 < hyper_ch> hi krzee
00:42 < AlbertoP> hello :)
00:44 < hyper_ch> IPv4 addresses are more worth than domain names...
00:44 < hyper_ch> https://www.fis.dowjones.com/article.aspx?ProductIDFromApplication=10&aid=DJFDBR0020110322e73m000dx&r=Rss&s=DJFDBR
00:45 < AlbertoP> right now I think a script to configure a firewall for openvpn on opensuse is more valuable ;-)
00:47 < webmind> hyper_ch, members only
00:47 < hyper_ch> webmind: ?
00:48 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 276 seconds]
00:49 < AlbertoP> hyper_ch: the article 
00:50 < AlbertoP> it requires subscription :)
00:50 < hyper_ch> I don't subscribe and can access it
00:50 < hyper_ch> full access needs subscription
00:51 < webmind> ah
00:51 < webmind> small print
00:51 < hyper_ch> but you just need: 
00:51 < hyper_ch> Daily Bankruptcy Review, March 22, 2011, 661 words English
00:51 < hyper_ch> Nortel Networks Corp. is doing its bit to alleviate the Internet space crunch, selling 666,624 IP addresses to Microsoft Corp. for $7.5 million...
00:51 < hyper_ch> that's $11 per ip
00:57 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
00:59 < webmind> hyper_ch, yeah, didn't notice that print  before
01:08 < hyper_ch> webmind: :)
01:17 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
01:19 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 255 seconds]
01:19 -!- twister004_ is now known as twister004
01:25 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
01:25 < crocket> If the openvpn server has a private subnet, how can clients connect to the subnet?
01:25 < crocket> server never accepts iroute directive.
01:25 < crocket> Please help me.
01:29 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 264 seconds]
01:30 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 252 seconds]
01:36 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10760>
01:39 < AlbertoP> crocket: seems the topic is taken a bit to the letter... not an answer in hours ;-)
01:40 < crocket> No!!!!!!
01:41 -!- dazo_afk is now known as dazo
01:58 -!- dsd31g [~dsd31g@178-82-149-76.dynamic.hispeed.ch] has joined #openvpn
02:00 <@vpnHelper> RSS Update - forum: OpenVPN integration with java application <http://forums.openvpn.net/topic7848.html>
02:11 < dsd31g> hello everybody. i want deploy my own nameserver to a openvpn client (windows xp) with "push option-dhcp DNS x.x.x.x". But it doesn't work, because there is still used the nameserver of the physical interface.
02:14 < dsd31g> How can i do this?
02:23 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:28 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
02:34 -!- whomee [~glenna@proxy.se.axis.com] has quit [Quit: brb]
02:34 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 250 seconds]
02:43 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
02:50 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
02:52 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:58 < crocket> If I give options "user nobody" and "group nogroup" to OpenVPN, when openvpn quits, it generates error messages that it doesn't have permissions to execute "ip addr"
02:58 < crocket> How can I remove this error?
02:59 -!- bitterman [~yury@84.51.201.89] has joined #openvpn
03:00 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
03:01 < crocket> How can I solve this issue?
03:02 -!- AlbertoP [~alberto@pdpc/supporter/active/AlbertoP] has quit [Remote host closed the connection]
03:02 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 255 seconds]
03:06 < krzie> you dont need to
03:07 < krzie> when openvpn exits it destorys the tun interface and the routes and stuff on tun die naturally
03:07 < krzie> is there a side-effect you are noticing...?
03:08 < krzie> are you losing your gateway because of redirect-gateway?
03:11 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 248 seconds]
03:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:28 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
03:29 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
03:39 -!- dsd31g [~dsd31g@178-82-149-76.dynamic.hispeed.ch] has left #openvpn []
04:01 -!- stringent [~imac_alph@218.42.150.50] has joined #openvpn
04:08 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:24 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has joined #openvpn
04:30 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:30 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:30 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:36 -!- bitterman is now known as luneff
04:42 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:42 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:42 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:50 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 248 seconds]
04:51 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
04:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
05:00 -!- magesing [~gesing@svn.titech.com] has joined #openvpn
05:01 < magesing> !welcome
05:01 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:01 < magesing> !goal
05:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:01 < magesing> !howto
05:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:04 < magesing> I am trying to write a script which will write the IP address and cert of each connected client to a file, and remove the cert and ip from the file when they disconnect (basically I want a file which tells me all of the connected users) Anyone have something like this? If not, I can get the cert name fro$common_name in client-connect.sh but how do I get the IPs, thanks.
05:06 <@dazo> magesing: it should be in $trusted_ip, iirc
05:08 < magesing> dazo: Thanks 
05:09 < magesing> where can I find a list of those variables?
05:10 < magesing> ... tracked them down in the manual
05:11 < magesing> http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html
05:11 <@vpnHelper> Title: OpenVPN 2.2 (at openvpn.net)
05:11 < magesing> thanks for your help, bye
05:11 -!- magesing [~gesing@svn.titech.com] has left #openvpn []
05:20 <@vpnHelper> RSS Update - forum: OpenVPN integration with java application <http://forums.openvpn.net/topic7848.html#p10762>
05:35 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
05:35 -!- luneff [~yury@84.51.201.89] has joined #openvpn
05:47 < crocket> hmm
05:47 -!- tkbeat_ [~tkbeat@p548574E8.dip.t-dialin.net] has joined #openvpn
05:47 < crocket> krzee, hey
05:47 < crocket> krzie, hey
05:47 < crocket> krzie, I'm back!!!
05:47 < tkbeat_> hello
05:48 < crocket> krzie, I know that when openvpn exits, it destroys tun0, and the routes die naturally, but I don't like to see errors in the log.
05:49 < crocket> krzie, Help me eradicate the errors.
05:49 < tkbeat_> i got a question: is there a way to verify that the remote openvpn server port (udp) is listen on the port i specified on the remote server? how can i send an udp packet to verify the port is open ?? 
05:49 < crocket> tkbeat_, "nmap server -sU -p $port"
05:51 < tkbeat_> thank u, nmap says : Note: Host seems down. If it is really up, but blocking our ping probes, try -PN
05:51 < crocket> tkbeat_, try -PN
05:51 < tkbeat_> i know that icmp is disabled on the remote host
05:51 < tkbeat_> with -sU thogether ?!
05:51 < crocket> tkbeat_, nmap -sU probes UDP ports.
05:52 < crocket> It doesn't use ICMP
05:53 < tkbeat_> hmm strange. nmap told me that the port is not open, i think its an issue on the routers portforwarding because until last night connection was still open..
05:54 < tkbeat_> thanx crocket anyway
05:54 < crocket> nmap probes TCP ports by default.
05:55 < crocket> tkbeat_, I think it's an iptables issue.
05:55 < tkbeat_> yesterday i removed all rules with iptables -F
05:55 < tkbeat_> i will do it again ...
05:56 < tkbeat_> yeahh
05:56 < tkbeat_> that helps
05:56 < tkbeat_> now the connection is established again
05:56 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 248 seconds]
05:56 < tkbeat_> but why did iptables did setup his rules again ?!
05:57 < tkbeat_> i am not so experienced with iptables
05:58 < tkbeat_> how can i make a permanent rule on the remote host for the openvpn udp port? can u help ?
05:58 -!- stringent [~imac_alph@218.42.150.50] has quit [Quit: can't rollerskate in a buffalo herd]
06:01 < crocket> tkbeat_, yes
06:02 < crocket> tkbeat_, If you want a fast help, you need to call my nickname to generate sound from my speakers.
06:02 < crocket> tkbeat_, What linux distribution do you use?
06:02 < tkbeat_> no worries i am not in stress *g*
06:03 < tkbeat_> thank u, iam using ubuntu server on the remote host
06:04 < crocket> tkbeat_, Ubuntu may have a desginated firewall script or some other means to configure iptables firewall.
06:04 < crocket> tkbeat_, But you want to know the rules.
06:04 < crocket> tkbeat_, What do you want iptables to do?
06:05 < tkbeat_> i just wana insert the rule to allways accept incoming udp connection on the openvpn server port
06:05 < crocket> tkbeat_, ok
06:06 < crocket> tkbeat_, "/path/to/iptables -A INPUT -p udp --dport 1194 -j ACCEPT"
06:06 <@vpnHelper> RSS Update - forum: linux bridge eth interface with openvpn and DHCP <http://forums.openvpn.net/topic7811.html#p10763>
06:06 < tkbeat_> or alternativly disable the whole iptables because the server is behind another firewall
06:06 < crocket> --dport option can't precede but has to follow -p udp or -p tcp.
06:06 < crocket> --dport means --destination-port
06:06 < crocket> 1194 is openvpn port.
06:07 < crocket> -p udp means udp
06:07 < crocket> -A means append
06:07 < crocket> -j ACCEPT means accept the packet.
06:09 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
06:10 < crocket> tkbeat_, What will you do?
06:10 < tkbeat_> crocket: thanx a lot, iptables --list-rules told me now : -P INPUT ACCEPT
06:10 < tkbeat_> -P FORWARD ACCEPT
06:10 < tkbeat_> -P OUTPUT ACCEPT
06:10 < tkbeat_> -A INPUT -p udp -m udp --dport 50833 -j ACCEPT
06:12 < crocket> tkbeat_, What's the policy of INPUT chain?
06:12 < tkbeat_> how can i fure this out ?
06:12 < tkbeat_> figure
06:13 < crocket> tkbeat_, iptables -L
06:14 < tkbeat_> Chain INPUT (policy ACCEPT)
06:14 < tkbeat_> target     prot opt source               destination         
06:14 < tkbeat_> ACCEPT     udp  --  anywhere             anywhere            udp dpt:50833 
06:14 < tkbeat_> looks ok i think ?!
06:14 < crocket> yeah, and that rule is superfluous
06:15 < tkbeat_> yeah cause the other rules i deleted just before with iptables -F i think ?!
06:17 < crocket> tkbeat_, netfilter would behavior the same without "ACCEPT     udp  --  anywhere             anywhere            udp dpt:50833"
06:18 < crocket> s/behavior/behave/
06:18 < tkbeat_> strange, i think when ubuntu will invoke his own firewall script again that rules will gone and it will reinstall the blocking rule again...so i have to find out where is the ubuntu firewall script and put the rule directly in there or ?
06:18 < crocket> tkbeat_, You need to control your system, so find out how ubuntu controls iptables.
06:18 < crocket> tkbeat_, #ubuntu may be the appropriate place.
06:19 < tkbeat_> yeah, will have go cause its actually not an openvpn problem. thank u for the hit in the right direction!
06:30 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
06:52 -!- genesis7 [~rommel@amertospromotions.com] has quit []
07:28 -!- opiate [solarkeith@cable-1146.paragould.net] has joined #openvpn
07:29 < opiate> !welcome
07:29 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:29 < opiate> !route
07:29 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
07:30 < opiate> !goal
07:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:30 < opiate> i am new with vpns, i wish to use one to evade bans for an online video game
07:30 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
07:30 < opiate> if anyone has a free minute help would be apreciated
07:31 < crocket> Ah righT!!!
07:32 < opiate> crocket
07:32 < opiate> you're experienced with vpns?
07:33 < cpm> so, where are you stuck?
07:33 < opiate> well i connect, it says "ip is 10..."
07:33 < opiate> im wondering
07:33 < opiate> can i make it different than the default one?
07:33 < opiate> i would love to have 2 or 3 i can connect to
07:34 < opiate> i tried useing intrnet explorer settings, and changed ie to proxy. but i'm still getting the same ip
07:34 < opiate> do i make sense?
07:36 < opiate> on ubuntu my girlfriend had it set up where i could click and change vpns
07:36 < opiate> unfortinatly i had sex with her friend, so she wont help me now
07:37 < crocket> opiate, yes
07:38 < crocket> opiate, I know that you want help right now, but I want to know if her friend was better than her.
07:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
07:38 < opiate> lol no, and she was fat
07:38 < opiate> so am i useing "manual connection" ?
07:39 < opiate> and if so how do i find an address to use
07:39 < opiate> and she was on her period
07:39 < opiate> help me now?
07:40 < opiate> wget help :(
07:45 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:45 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:47 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
07:48 < genesis7> --win-sys path|'env' <--- how to use this option and should I put that in the client config?
07:51 -!- opiate [solarkeith@cable-1146.paragould.net] has quit []
07:52 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
07:54 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
07:56 -!- kyrix [~ashley@seg75-5-82-234-115-130.fbx.proxad.net] has quit [Quit: Leaving]
08:00 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
08:00 < crocket> hi
08:01 < crocket> I was disconnected.
08:01 < crocket> opiate, you're out.
08:04 < genesis7> any help would really appreciated
08:10 -!- dazo changed the topic of #openvpn to: OpenVPN 2.1.4 Most Current || 2.2-RC Released 04-Mar-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: http://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly.
08:11 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Read error: Operation timed out]
08:12 -!- genesis7 [~rommel@amertospromotions.com] has quit []
08:17 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
08:19 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
08:20 < genesis7> --win-sys path | "e:\windows\system32" does not seem to work
08:25 <@vpnHelper> RSS Update - forum: DNS requests on wrong interface... <http://forums.openvpn.net/topic7847.html#p10764>
08:28 < ecrist> genesis7: you'd need to escape that
08:28 < ecrist> "e:\\windows\\system32"
08:31 < genesis7> should that be --win-sys path | "e:\\windows\\system32" ? why?
08:33 -!- Dmage [~feedme@95.129.160.102] has joined #openvpn
08:38 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:43 < katoen_> i assign static IPs using ccd files, but when a client connects without a corresponding file, it might get one of the CCD addresses. How do i prevent this?
08:45 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
08:49 -!- dazo is now known as dazo_afk
08:57 -!- genesis7 [~rommel@amertospromotions.com] has quit [Ping timeout: 255 seconds]
08:57 -!- Dmage [~feedme@95.129.160.102] has quit [Quit: Hey! Where'd my controlling terminal go?]
08:58 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
09:00 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 252 seconds]
09:00 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
09:01 -!- genesis7 [~rommel@amertospromotions.com] has quit [Read error: Connection reset by peer]
09:06 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
09:07 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Client Quit]
09:09 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
09:17 <@vpnHelper> RSS Update - forum: DNS requests on wrong interface... <http://forums.openvpn.net/topic7847.html#p10765>
09:18 < crocket> woohoo!!!
09:19 -!- eth00 [~Johnrdp@colt.eth0.us] has quit [Excess Flood]
09:19 -!- eth00 [~Johnrdp@colt.eth0.us] has joined #openvpn
09:19 -!- eth00 [~Johnrdp@colt.eth0.us] has quit [Changing host]
09:19 -!- eth00 [~Johnrdp@unaffiliated/eth00] has joined #openvpn
09:19 < Bushmills> katoen_: you can set start- end end addresses of pool, and assign static addresses from outside the pool
09:22 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
09:25 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
09:26 -!- gladiatr_afk is now known as gladiatr
09:27 < gladiatr> katoen_, I think you need to be sure that the server line isn't set to distribute addresses that are covered by your static assignments
09:27 < gladiatr> bah.  exactly what Bushmills said.
09:29 <@vpnHelper> RSS Update - forum: virtual interfaces eth0:1 <http://forums.openvpn.net/topic7800.html#p10766>
09:30 < crocket> openvpn has a weird option
09:35 -!- luneff [~yury@84.51.195.188] has joined #openvpn
09:39 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
09:43 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 246 seconds]
09:44 -!- kuku2 [~kuku@c-24-13-139-34.hsd1.il.comcast.net] has joined #openvpn
09:45 < gladiatr> only one?
09:47 < kuku2> I can't find info on how to add new profiles to the dynamically created list. 
09:47 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:48 -!- root is now known as UdontKnow
09:53 <@vpnHelper> RSS Update - forum: Dictionary Attack; openvpn and openssh no longer work <http://forums.openvpn.net/topic7849.html>
09:56 < gladiatr> ^^ that fellow is in for a fun weekend
10:12 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
10:15 < katoen_> Bushmills, gladiatr: thanks
10:17 <@vpnHelper> RSS Update - forum: DNS requests on wrong interface... <http://forums.openvpn.net/topic7847.html#p10768>
10:19 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 252 seconds]
10:23 <@vpnHelper> RSS Update - forum: DNS requests on wrong interface... <http://forums.openvpn.net/topic7847.html#p10769>
10:24 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
10:25 -!- dazo_afk is now known as dazo
10:29 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Quit: Leaving]
10:29 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
10:31 -!- EugeneKaway is now known as EugeneKay
10:46 -!- newmember [~chatzilla@static-66-11-81-77.ptr.terago.net] has joined #openvpn
10:47 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
10:57 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
10:59 < katoen_> openvpn doesn't accept both 'ifconfig-pool' and 'server' directive to be issued. I can disable 'server' but then it appears i need to assign other directives manually. Is this the only way to set aside a seperate address pool for dynamic ip assignment?
10:59 <@vpnHelper> RSS Update - forum: Failed build TAP - Compile OpenVPN <http://forums.openvpn.net/topic7818.html>
11:01 <@dazo> katoen_: if you read the man page carefully, you'll see that --server is a kind of a macro which expands to a lot of things ... you can do the same stuff without using --server and then you can use --ifconfig-pool
11:01 <@dazo> !man
11:01 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
11:01 <@dazo> #2 is most likely the relevant URL
11:02 < katoen_> ah, that's what i thought. thanks
11:05 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
11:07 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 250 seconds]
11:13 -!- dazo is now known as dazo_afk
11:14 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 246 seconds]
11:14 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
11:22 -!- twister004_ [~chatzilla@mail2.polariswireless.com] has joined #openvpn
11:22 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 255 seconds]
11:23 -!- twister004_ is now known as twister004
11:29 < kuku2> I can't find info on how to add new connection profiles to the dynamically created list of open vpn website. Any hints would be helfpull. 
11:31 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
11:32 < genesis7> what is the purpose of comp-lzo in connection between server and client? 
11:34 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
11:34 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
11:36 -!- genesis7 [~rommel@amertospromotions.com] has quit [Client Quit]
11:38 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 255 seconds]
11:42 <@vpnHelper> RSS Update - forum: The new windows GUI does not ask for PKCS11 PIN <http://forums.openvpn.net/topic7794.html#p10772> || Dictionary Attack; openvpn and openssh no longer work <http://forums.openvpn.net/topic7849.html#p10771> || NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10770>
11:42 -!- dazo_afk is now known as dazo
11:48 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
11:53 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
11:54 < gladiatr> !lzo
11:59 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
12:03 -!- twister004 [~chatzilla@mail2.polariswireless.com] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.15/20110303024726]]
12:04 -!- venom00ut [~wer@net-188-218-174-50.cust.dsl.vodafone.it] has joined #openvpn
12:04 -!- venom00ut [~wer@net-188-218-174-50.cust.dsl.vodafone.it] has quit [Changing host]
12:04 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
12:10 -!- gladiatr is now known as gladiatr_afk
12:13 -!- gratnam11 [~kannnan24@69-165-220-31.dsl.teksavvy.com] has joined #openvpn
12:13 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:13 < gratnam11> hey guys can i install a openvpn server on a windows machine
12:13 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:17 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:17 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10773>
12:22 -!- orkaa [~nace@2001:1470:e802:a000:f2b4:79ff:fe12:f2a5] has joined #openvpn
12:23 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has joined #openvpn
12:23 < orkaa> hello
12:23 < orkaa> what is the most common solution for the "Cannot ioctl TUNSETIFF tun: Operation not permitted" problem
12:23 < orkaa> I know it's only the /dev/net/tun permissions
12:23 < orkaa> but I'm not sure how to solve it corectly
12:24 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
12:25 < gratnam11> can open vpnserver be installed on a  debian machine
12:26 < mindcry> yes
12:30 -!- tkbeat_ [~tkbeat@p548574E8.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
12:47 < ecrist> sounds like a firewall issue
12:47 < ecrist> run as root, maybe?
12:50 < orkaa> ecrist: you're answering my question?
12:50 < orkaa> openvpn is started by root
12:50 < orkaa> but then drops to 'nobody'
12:50 < orkaa> which doesn't have the permissions to restart /dev/net/tun
12:58 < ecrist> yup
12:59 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 246 seconds]
13:01 < dvl> Hmmm, with my iPad, connect to my OpenVPN server?  There is no OpenVPN client for iPad..
13:01 < ecrist> there is no tun/tap, afaik for ipad
13:02 < ecrist> there are projects out there for iphone that may apply, though.
13:02 -!- Blues-Man [~bluesman@95.239.124.200] has joined #openvpn
13:04 -!- genesis7 [~rommel@46.20.114.198] has joined #openvpn
13:04 <@vpnHelper> RSS Update - forum: OpenVPN Intrusion? <http://forums.openvpn.net/topic7850.html>
13:05 -!- gladiatr_afk is now known as gladiatr
13:05 < genesis7> Replay-window backtrack occurred <--what is this error?
13:07 -!- newmember [~chatzilla@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 250 seconds]
13:08 < krzie> check the manual
13:08 < krzie> genesis7, will you ever check the manual before asking a question
13:09 < krzie> search for the word backtrack
13:09 < krzie> !man
13:09 <@vpnHelper> RSS Update - forum: Configure openVPN with 2 lans that have the same IP config <http://forums.openvpn.net/topic7851.html>
13:09 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
13:09 -!- genesis7 [~rommel@46.20.114.198] has quit [Ping timeout: 240 seconds]
13:10 -!- dazo is now known as dazo_afk
13:11 -!- ldaguilar [~luis@186.176.7.194] has quit [Read error: Connection reset by peer]
13:12 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
13:12 < dvl> ecrist: Are you saying there is an iPhone app that will let me connect to my OpenVPN server?
13:13 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
13:20 < jpalmer> dvl: if you are jailbroken, yes.
13:20 < jpalmer> or rather,  there was.  not sure about now.
13:20 < jpalmer> (I don't jailbreak much anymore)
13:21 -!- MeanderingCode [~Adium@70-57-251-181.albq.qwest.net] has joined #openvpn
13:21 <@vpnHelper> RSS Update - forum: Tunnelblick-Viscosity-Shimo - What's The Best OS X Client? <http://forums.openvpn.net/topic7837.html#p10777> || Configure openVPN with 2 lans that have the same IP config <http://forums.openvpn.net/topic7851.html#p10776>
13:21 -!- Guest68746 [~noname@kista.rula.net] has joined #openvpn
13:23 < MeanderingCode> Can anyone point me to a resource to help me configure a VPN client (tunnelblick on OSX) to use the VPN as a subnet and only for resources on that subnet, allowing access from the laptop to the physical LAN it's on and not routing 'net traffic through the VPN, either?
13:24 < gladiatr> !redirect
13:24 -!- loompek [~noname@noname.rula.net] has quit [Ping timeout: 250 seconds]
13:24 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:24 < gladiatr> just don't do ^that
13:26 < MeanderingCode> what if my server config "pushes" dns?
13:26 < gladiatr> what OS?
13:26 < gladiatr> for the client?
13:26 < MeanderingCode> Tunnelblick on OSX
13:27 < gladiatr> doh
13:27 < gladiatr> sorry
13:27 < MeanderingCode> ?
13:27 < MeanderingCode> That means it ain't great?  Is there a better OSX client?
13:28 < gladiatr> nah.  Was apologizing that I asked a question you had already given information about :)
13:28 -!- p3rror [~mezgani@41.248.186.239] has quit [Ping timeout: 255 seconds]
13:28 < MeanderingCode> I set my server up to push dns because i was having trouble with a diff client, namely networkmanager-openvpn on ubuntu
13:28 < MeanderingCode> who's traffic i DO want to route through the VPN when connected
13:28 < gladiatr> I'd check with the TB community to see what mechanism they're using to change the nameserver priorities.  I would imagine there's a way to short-circuit those bits being changed.
13:30 < gladiatr> Ok.  So you want some of your clients to route all traffic through the vpn and some not.  Some you want to have use the DNS server on the vpn server side and others not.  Right?
13:30 < gladiatr> And you have control of the openvpn server
13:30 < arcsky> both/j nagios
13:30 < arcsky> ups
13:30 < gladiatr> lol
13:31 < dvl> jpalmer: Yhea, I'm not planning to jailbreak.
13:32 < gladiatr> dvl, take the plunge!  root that sucker! :D
13:32 < MeanderingCode> gladiatr: right
13:32 < gladiatr> !ccd
13:32 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
13:32 < jpalmer> The only reason I used to jailbreak,  was to share wifi with other devices.   not much need for that anymore,  so I'm not jailbroken now.
13:32 < gladiatr> MeanderingCode, ^^ that's what you're after
13:32 < MeanderingCode> thanks
13:32 < gladiatr> np
13:33 < MeanderingCode> might be tricky, running on a dd-wrt router, but i should be able to create a persistent directory...can't remember if my router supported that...
13:34 < MeanderingCode> otherwise, i just found something about "nameserver priority" in tunnelblick
13:35 < gladiatr> jjfs is your friend: http://tinyurl.com/459azjr
13:35 <@vpnHelper> Title: Journalling Flash File System - DD-WRT Wiki (at tinyurl.com)
13:40 -!- MeanderingCode [~Adium@70-57-251-181.albq.qwest.net] has quit [Ping timeout: 264 seconds]
13:41 -!- Dennis2 [~x@52494E8A.cm-4-2b.dynamic.ziggo.nl] has joined #openvpn
13:41 < Dennis2> hello - i'm having a strange problem. The client (172.16.0.10) is able to ping itself and the server (172.16.0.9) but the server can't ping the client
13:42 < gladiatr> what os are you running (client and server)?
13:43 < Dennis2> http://pastebin.com/r5BfZyGB is my openvpn.conf on the server. I'm running Windows7 x64 on the client and debian 6 on the server 
13:43 < orkaa> if anybody is interested in answering my question, here's the link :)
13:43 < orkaa> http://serverfault.com/questions/251936/openvpn-cannot-allocate-tun-tap-dev-dynamically
13:43 <@vpnHelper> Title: linux - OpenVPN Cannot allocate TUN/TAP dev dynamically - Server Fault (at serverfault.com)
13:45 < Dennis2> gladiatr, clients are also unable to ping eachother
13:45 < gladiatr> Dennis2, are you running a firewall on the client?
13:46 < Dennis2> nope
13:46 < gladiatr> and no firewall on the tap interface on the server-side?
13:46 < Dennis2> nope, they are both turned off
13:47 < gladiatr> k.  Just lookin' at your config here... 
13:48 < Dennis2> never mind - so sorry, i totally forgot windows has its own build-in firewall (i'm not using windows that much)
13:48 < gladiatr> line 13 isn't necessary.  I don't think it's hurting anything, but it's only functional on the server-side
13:48 < gladiatr> ahh
13:48 < Dennis2> sorry! :-)
13:49 -!- luneff [~yury@84.51.201.89] has joined #openvpn
13:49 < gladiatr> s'okay.  I'm glad it was easy :)
13:49 < Dennis2> :)
13:49 < Dennis2> thanks for your time!
13:49 < Dennis2> but.. isnt client-to-client needed to let clients see eachother?
13:49 < gladiatr> have a good weekend!
13:50 < Dennis2> yeah, you too. badly i still have to go to work tomorrow :-)
13:50 < gladiatr> orkaa, are you using a non-root user/group?
13:50 < Dennis2> yes
13:50 < gladiatr> orkaa, actually, pastebin your server config
13:50 < Dennis2> that is my server config
13:51 < orkaa> gladiatr: http://pastebin.com/ru3kBGt7
13:51 < Dennis2> ah, didnt see the orkaa part, lol
13:52 < dvl> gladiatr: no, I won't!.
13:52 < gladiatr> dvl, hehe!
13:52 < dvl> gladiatr: speaking of root, did you see what FedEx did to my MacBook?
13:52 < gladiatr> dvl, no!  is it... dead?
13:53 < dvl> gladiatr: Very.  http://www.flickr.com/photos/20922021@N04/sets/72157626171591915/
13:53 <@vpnHelper> Title: Damaged MacBook Pro - a set on Flickr (at www.flickr.com)
13:53 < gladiatr> dvl, next time, don't check the box marked, "Chew on my package" when selecting fedex :D
13:54 < gladiatr> or at least if you do, put some specifics in the "special instructions" box!
13:54 < gladiatr> orkaa, so you are running as root
13:54 < dvl> gladiatr: I shall keep that in mind
13:54 -!- Blues-Man [~bluesman@95.239.124.200] has quit [Quit: Sto andando via]
13:55 < gladiatr> what's your OS?
13:55 < gladiatr> distro/etc?
13:57 < orkaa> gladiatr: yep, now I added:
13:57 < orkaa> user nobody
13:57 < orkaa> group nogroup
13:57 < orkaa> which was already present in the client config
13:57 < orkaa> but it still doesn't work
13:57 < orkaa> gladiatr: i'm running ubuntu 10.10
13:58 < gladiatr> that isn't reflected in the config you pasted.  Are you specifying a user/group on the command line or something?
13:58 < orkaa> gladiatr: I just changed it a few seconds ago
13:58 < orkaa> http://pastebin.com/x85Tq6CM
13:59 < gladiatr> And you're starting openvpn as root?
13:59 < orkaa> yes, through the init script
13:59 < gladiatr> hrm...
14:01 < gladiatr> /usr/sbin/openvpn --config /etc/openvpn/openvpn.conf --verb 4
14:01 < gladiatr> pastebin the resulting logs
14:01 < orkaa> gladiatr: where should I run this? server/client?
14:01 < gladiatr> this would seem to be a server-side problem
14:02 < gladiatr> or is the server fine and the client is having the problem?
14:02 < orkaa> yep, that's the case
14:02 < gladiatr> doh
14:02 < orkaa> if I restart the server, clients are unable to automatically reconnect
14:02 < orkaa> but they do if I re-run the init script
14:03 < gladiatr> Ok.  So the tun error is on the server-side
14:03 < orkaa> no, client-side
14:04 < orkaa> orkaa: but they do if I re-run the init script <-- on client machine
14:04 < gladiatr> ah
14:04 < gladiatr> pastebin your client config
14:05 < orkaa> http://pastebin.com/Ryu2SG2H
14:06 -!- Dennis2 [~x@52494E8A.cm-4-2b.dynamic.ziggo.nl] has quit []
14:11 < orkaa> any hints?
14:12 < gladiatr> hopefully.  hang on.
14:12 < ecrist> dvl: there is, but you need to have your phone/device rooted
14:15 < orkaa> ok, thanks
14:16 <@vpnHelper> RSS Update - forum: Config runs under XP but same config fails in Win 7 routing <http://forums.openvpn.net/topic7852.html>
14:18 < krzie> i didnt see the android talk, but it sounds like dvl must have said something about it
14:18 < krzie> cyanogenmod 6 or 7 will come with everything needed for openvpn (root / tun)
14:21 < ecrist> krzie: he was actually talking about ipad devices
14:21 < krzie> oh ok
14:21 < krzie> !iphone
14:21 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
14:21 <@vpnHelper> iPhone and iPad.
14:21 < krzie> ild make sure that #3 isnt valid for ipad too
14:23 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:27 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
14:30 < jpalmer> that issue was fixed, i believe.
14:37 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
14:37 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
14:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:44 < krzie> oh good
14:45 < krzie> maybe ill test that and consider actually using ovpn on my ipod touch then
14:45 < krzie> bbl, buying a refridgerator
14:45 < hyper_ch> hi krzie
14:45 < krzie> hi, bye =]
14:46 < hyper_ch> you leave?
14:46 < krzie> [15:46]  <krzie> bbl, buying a refridgerator
14:46 < krzie> got a quick ? ?
14:46 < hyper_ch> :)
14:46 < hyper_ch> no, I only have slow ?
14:46 < krzie> haha
14:46 < krzie> ok, lets hear it
14:46 < hyper_ch> I first have to think of one
14:46 < krzie> lol
14:46 < krzie> ttyl ;]
14:47 < hyper_ch> I really just wanted to say "hi"
14:48 < orkaa> gladiatr: i'll be heading home soon
14:49 < orkaa> gladiatr: if you find anything, can you post it to serverfault
14:49 < orkaa> http://serverfault.com/questions/251936/openvpn-cannot-allocate-tun-tap-dev-dynamically
14:49 <@vpnHelper> Title: linux - OpenVPN Cannot allocate TUN/TAP dev dynamically - Server Fault (at serverfault.com)
14:53 < orkaa> gladiatr: btw, if I run openvpn as root on the client
14:53 < orkaa> it works just fine
14:55 -!- orkaa [~nace@2001:1470:e802:a000:f2b4:79ff:fe12:f2a5] has quit [Quit: orkaa]
15:03 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 252 seconds]
15:04 < gratnam11> what ports do i need to open on my router for openvpn server
15:05 < gratnam11> anyone
15:07 -!- unixSnob [~unixSnob@212.117.169.230] has joined #openvpn
15:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
15:08 < gratnam11> please help me out
15:09 < jpalmer> gratnam11: whatever ports you configure openvpn to listen to.
15:09 < gratnam11> how can i check that
15:10 < jpalmer> look in the openvpn config
15:10 < gratnam11> i think mine is set to 5480
15:10 < gratnam11> where would it be
15:10 < gratnam11> i just downloaded the openvpnserver vm
15:10 < jpalmer> you should probably spend a few minutes reading the docs, then.
15:15 -!- p3rror [~mezgani@41.248.189.36] has joined #openvpn
15:19 < unixSnob> i cannot motivate my vpn server to forward packets to the WAN
15:19 < unixSnob> I know the routing table is setup correctly, and I also have IP forwarding turned on
15:20 < unixSnob> The client can ping the server, but it cannot ping IPs on the wan
15:20 < unixSnob> any clues?
15:20 < gratnam11> i am going to read the book
15:21 < gratnam11> but can't u guys tell me where the config file would be
15:21 < unixSnob> does maquerading need to be turned on?
15:21 < gratnam11> no harm done by telling me lool
15:23 < unixSnob> !linnat
15:23 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
15:24 < unixSnob> !openvzlinnat
15:24 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
15:26 <@vpnHelper> RSS Update - forum: OpenVPN 2.2-RC2 released <http://forums.openvpn.net/topic7853.html>
15:28 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
15:29 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:29 -!- unixSnob [~unixSnob@212.117.169.230] has quit [Read error: Operation timed out]
15:32 <@vpnHelper> RSS Update - forum: OpenVPN pre installed ISO <http://forums.openvpn.net/topic7827.html#p10782> || DNS requests on wrong interface... <http://forums.openvpn.net/topic7847.html#p10781> || Config runs under XP but same config fails in Win 7 routing <http://forums.openvpn.net/topic7852.html#p10780>
15:33 -!- unixSnob [~unixSnob@212.117.169.230] has joined #openvpn
15:33 < unixSnob> *bot
15:33 < unixSnob> this command screws things up => iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
15:33 < unixSnob> it makes it so every packet meant for the wan actually gets answered by the server
15:34 < unixSnob> i think i'm pinging google when i ping google.com, but I'm actually pinging myself
15:39 -!- unixSnob [~unixSnob@212.117.169.230] has quit [Read error: Operation timed out]
15:46 <@mattock> openvpn 2.2-RC2 released: http://openvpn.net/index.php/open-source/downloads.html
15:46 <@vpnHelper> Title: Downloads (at openvpn.net)
15:47 -!- unixSnob [~unixSnob@212.117.169.230] has joined #openvpn
15:47 < unixSnob> !iroute
15:47 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
15:48 < unixSnob> !ccd
15:48 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
15:50 < cromega> !route
15:50 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:58 -!- unixSnob [~unixSnob@212.117.169.230] has quit [Quit: leaving]
16:02 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
16:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:13 -!- ldaguilar [~luis@186.176.7.194] has quit [Ping timeout: 276 seconds]
16:18 -!- js__ [~js@213.180.83.163] has joined #openvpn
16:19 -!- xxtjaxx_ [~andreas@dl360.ein-elch.de] has joined #openvpn
16:19 -!- jwm_ [jwm@dev.dist.us] has joined #openvpn
16:19 -!- krzii [krzee@hemp.ircpimps.org] has joined #openvpn
16:19 -!- js_ [~js@213.180.83.163] has quit [Read error: Operation timed out]
16:19 -!- xxtjaxx [~andreas@kde/developer/marschke] has quit [Read error: Operation timed out]
16:19 -!- SlickDVL [~WarezMyGF@pool-96-255-138-222.washdc.fios.verizon.net] has quit [Ping timeout: 252 seconds]
16:19 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
16:19 -!- jwm [jwm@dev.dist.us] has quit [Read error: Operation timed out]
16:20 -!- js__ is now known as js_
16:20 -!- SlickDVL [~WarezMyGF@pool-96-255-138-222.washdc.fios.verizon.net] has joined #openvpn
16:21 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
16:32 -!- ScriptFanix [~vincent@2001:910:100b:11:215:ff:fe12:11d1] has quit [Read error: Operation timed out]
16:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:42 < roentgen> mattock: thanks for ipv6 on win
17:00 < xheliox> indeed.
17:01 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
17:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:04 < krzie> cron2_ is responsible for a lot of the ipv6 code =]
17:04 < krzie> iirc
17:04 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
17:06 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
17:08 < roentgen> things seems to have changed with ipv6 now
17:08 < roentgen> Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:1: ifconfig-ipv6 (2.2-RC2)
17:08 < roentgen> on the client
17:09 < krzie> !ipv6
17:09 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
17:09 < roentgen> was about to ask for a link :)
17:09 < krzie> see the link for the ipv6 options if that patchset is in fact included in that release
17:09 < krzie> also note the client needs that version
17:10 < roentgen> on the announce mail it says "Implement IPv6 in TUN mode for Windows TAP driver"
17:10 < roentgen> I'm testing now 
17:11 < krzie> ohhh
17:11 < krzie> i think they only included the code into the adapter
17:11 < krzie> to make sure thats good before merging the rest
17:11 < krzie> making a change to the windows tap adapter is a big move
17:12 < roentgen> ahhh... well... the configs are good than
17:12 < krzie> but mattock or dazo would know better
17:12 < roentgen> it doesn't work. I tested both xp and 7
17:12 <@mattock> yeah, there's no IPv6 support yet
17:13 <@mattock> only in the TAP-adapter to make sure IPv6 support in it does not affect existing IPv4 functionality
17:13 <@mattock> full IPv6 support will be in 2.3
17:13 < roentgen> I see... thanks for the info
17:13 <@mattock> probably the first alphas/betas, so not too far ahead
17:13 -!- jY [~jy@photoblog.com] has left #openvpn ["Leaving"]
17:13 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Read error: Operation timed out]
17:14 < roentgen> mattock: if you need testers... :)
17:19 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
17:30 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
17:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:46 -!- gratnam11 [~kannnan24@69-165-220-31.dsl.teksavvy.com] has quit [Ping timeout: 255 seconds]
17:55 <@vpnHelper> RSS Update - forum: OpenVPN Intrusion? <http://forums.openvpn.net/topic7850.html#p10783>
18:05 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
18:06 -!- apwxxsdf [~era1@194.126.108.2] has joined #openvpn
18:08 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
18:08 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
18:31 -!- EugeneKay is now known as EugeneKaway
18:35 -!- EugeneKaway is now known as EugeneKay
18:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
18:43 -!- gratnam11 [~kannnan24@bas2-toronto42-2925234626.dsl.bell.ca] has joined #openvpn
19:01 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
19:08 -!- Diffen [~diffen@c-d27ae555.04-106-73746f11.cust.bredbandsbolaget.se] has quit [Quit: Leaving]
19:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:32 -!- tkbeat_ [~tkbeat@p548574E8.dip.t-dialin.net] has joined #openvpn
19:32 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:51 -!- EugeneKay is now known as EugeneKaway
19:56 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 252 seconds]
19:58 -!- EugeneKaway is now known as EugeneKay
20:08 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
20:14 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Quit: Computer has gone to sleep.]
20:30 -!- tkbeat_ [~tkbeat@p548574E8.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:37 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
20:39 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
20:46 -!- tkbeat_ [~tkbeat@p54855BAE.dip.t-dialin.net] has joined #openvpn
21:04 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
21:09 -!- EugeneKay is now known as EugeneKaway
21:10 -!- EugeneKaway is now known as EugeneKay
21:23 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
21:35 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:35 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:49 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
21:49 < genesis7> The data area passed to a system call is too small. <--- what is this?
21:54 -!- genesis7 [~rommel@amertospromotions.com] has quit []
22:01 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 276 seconds]
22:08 -!- ldaguilar [~luis@186.176.7.194] has quit [Ping timeout: 250 seconds]
22:09 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
22:11 -!- master_of_master [~master_of@p57B57EDE.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
22:12 -!- master_of_master [~master_of@p57B56B54.dip.t-dialin.net] has joined #openvpn
22:21 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
22:33 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
22:48 -!- tkbeat_ [~tkbeat@p54855BAE.dip.t-dialin.net] has quit [Quit: Verlassend]
23:00 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Read error: Connection reset by peer]
23:01 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
23:04 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
23:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
23:15 -!- EugeneKay is now known as [o][o]
23:37 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
23:49 -!- krzie is now known as krzee
--- Day changed Sat Mar 26 2011
00:21 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
00:51 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
01:01 -!- apwxxsdf [~era1@194.126.108.2] has quit []
01:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
01:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:35 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
01:46 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
01:49 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
01:51 -!- [o][o] is now known as EugeneKay
01:56 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
01:59 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
02:13 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
02:17 < genesis7> good day! just this morning I edited my server.conf and I got error. I have attached pastebin --> http://pastebin.com/QdM10bmv
02:18 < krzee> interesting, what were the edits and what version are you running?
02:18 < genesis7> link-mtu error while I have no link-mtu option
02:18 < genesis7> im using 2.1
02:18 < krzee> 2.1 what
02:18 < krzee> 2.1.4?  just 2.1?
02:19 < genesis7> OpenVPN 2.1.1
02:19 < krzee> and the edits that caused it?
02:20 < genesis7> I have it on the paste bin ( the push methods are the ones that I added this morning )
02:20 < krzee> i see you have
02:20 < krzee> push "ping  5"
02:20 < krzee> push "ping-restart 60"
02:20 < krzee> AND keepalive 5 60
02:20 < krzee> did you read what keepalive expands to in the manual?
02:20 < krzee> it already pushes ping / ping-restart options
02:21 < genesis7> ah yeah. I forgot that
02:21 < krzee> remove tun-mtu
02:21 < genesis7> remove tun-mtu in my server config? why ?
02:21 < krzee> route-delay 2 is QUITE small
02:21 < krzee> better question, why is tun-mtu 1500 in your server config?
02:22 < krzee> if you use route-delay without an option, 30 is default iirc
02:22 < krzee> did you read what these options are / do?
02:22 < genesis7> i just put the tun-mtu there because its in the server config example
02:23 < krzee> if you dont know why you are messing with your MTU, dont
02:23 < krzee> in server or client
02:23 < krzee> are you sure all those options can be pushed?
02:24 < krzee> im not saying they cant, but im not sure they can either
02:24 < krzee> This is a partial list of options which can currently be pushed: --route, --route-gateway, --route-delay, --redirect-gateway, --ip-win32, --dhcp-option, --inactive, --ping, --ping-exit, --ping-restart, --setenv, --persist-key, --persist-tun, --echo, --comp-lzo, --socket-flags, --sndbuf, --rcvbuf
02:24 < krzee> im going to file a trac ticket to see about getting that list to be complete
02:25 < genesis7> yes I have read that krzee
02:25 < genesis7> I believe I saw tun-mtu in the server config
02:25 < krzee> i dont care what server config you saw it in
02:25 < krzee> if you dont know why you have it, you shouldnt
02:25 < genesis7> ok 
02:26 < krzee> that goes for the client configs too
02:26 < genesis7> wait let me check that again in the man page
02:26 < krzee> trust me, you dont need it
02:26 < krzee> !mtu
02:26 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
02:26 < krzee> read #2
02:27 < krzee> get your setup working, then if you care to test your MTU and find you actually have a problem, see about fixing the problem by tuning the mtu
02:27 < krzee> you CANT POSSIBLY fix a problem that doesnt exist
02:27 < hyper_ch> krzee: sure you can
02:27 -!- gratnam11 [~kannnan24@bas2-toronto42-2925234626.dsl.bell.ca] has quit [Quit: gratnam11]
02:27 < genesis7> but previously I still have that tun-mtu in the server and client config but I have not encountered that error that I post
02:27 < hyper_ch> well, if you're employed somewhere
02:28 < hyper_ch> and at the end of the day hand in the report on what yuo did
02:28 < krzee> hyper_ch, why do people ask questions then argue about the answers they are given when they dunno?
02:28 < hyper_ch> it's great when you show that you fixed problems
02:28 < hyper_ch> (regardless of whether those problems existed at all)
02:28 < krzee> hyper_ch, or you can BOFH and cause them to fix them!
02:29 < krzee> ;]
02:29 < hyper_ch> BOFH?
02:29 < genesis7> krzee you think that removing the tun-mtu and ping and ping-restart in my current server config will eliminate that problem?
02:29 < krzee> http://bofh.ntk.net/BOFH/index.php
02:30 <@vpnHelper> Title: Bastard Operator From Hell Official Archive (at bofh.ntk.net)
02:30 < krzee> genesis7, not sure, lets start by making it at least look right
02:30 < krzee> your link-mtu problem is related to your tun-mtu setting
02:30 < krzee> not sure about the other problem
02:30 < genesis7> ok. can you give me more insight about tun-mtu aside from the man page as per your personal experience.
02:31 < krzee> yes, my personal experience is that i have never run across a reason to tune the MTU at all, including when i use internet over a satellite connection
02:31 < krzee> i have tested and tried to find a time when i could play with it
02:33 < genesis7> yes I am playing with the configurations of my server and client now krzee just to see what is the best setting. So you dont have tun-mtu in your config krzee?
02:35 < genesis7> since tun-mtu is the max datagram size that can be sent unfragmented over a network path, if dont specify that will openvpn use something like default value for it?
02:35 < krzee> LOL
02:35 < genesis7> openvpn to automatically assign default value?
02:36 < krzee> just remove it dude
02:36 < krzee> openvpn handles it fine
02:36 < krzee> if you find why you actually need it, then play with it from there
02:36 < genesis7> its what Ive read on the man page. im really confuse why they put such option
02:36 < krzee> for when you actually have a problem with your mtu
02:36 < krzee> not for just putting in your config for the hell of it
02:37 < genesis7> ok. let me remove that and try if the problem persist.
02:37 < krzee> theres a TON of config options you should not put in your config unless you have a reason to
02:37 < krzee> thats one of them
02:37 < genesis7> thanks krzee. ill be back after testing. thanks.
02:37 -!- genesis7 [~rommel@amertospromotions.com] has quit []
02:38 < krzee> wow, i cant believe it took 20min to explain why he shouldnt change his mtu without knowing why
02:40 < hyper_ch> why would anyone change the mtu?
02:42 < krzee> cause they read stuff on the web and blindly follow
02:44 < hyper_ch> you say there is stuff on the web that cannot be blindly followed?
02:44 < krzee> heheh
02:45 < hyper_ch> krzee: have you ever setup a cloud service?
02:45 < krzee> nope
02:45 < hyper_ch> I just had a read and it doesn't seem to be that complicated
02:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
02:46 < hyper_ch> and shouldn't you be sleeping?
03:00 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
03:04 -!- genesis7 [~rommel@amertospromotions.com] has joined #openvpn
03:05 < genesis7> krzee, thanks. I guess it worked since no more error message was shown
03:05 < genesis7> I intend to put tcp_nodelay. Can put that in the server config
03:06 < krzee> !tcp
03:06 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
03:07 < genesis7> I am reading it and it says no disadvantage. in the man page using tcp_nodelay says "result in a considerably improvement in latency."
03:08 < krzee> umm
03:08 < genesis7> what is your comment on this krzee
03:08 < krzee> what says no disadvantage
03:08 < krzee> the links i gave you clearly state the disadvantage if you plan on using tcp over your VPN
03:08 < genesis7> on the link that you provided here
03:08 < krzee> umm no
03:08  * hyper_ch heard that TCP over TCP will make the universe implode
03:08 < krzee> "Unfortunately, it doesn't work well. Long delays and frequent connection aborts are to be expected. Here is why."
03:09 < genesis7> disadvantage?
03:09 < krzee> Long delays and frequent connection aborts
03:09 < krzee> and HOW could you rerad that whole doc in 2 minutes?
03:10 < krzee> AND understand it well
03:10 < krzee> you must really already understand tcp, or skim without trying to understand
03:10 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 276 seconds]
03:10 < genesis7> why does it state in the man page "causing packets to be transmitted immediately with low latency, rather than waiting a short period of time in order to aggregate several packets into a larger containing packet. In VPN applications over TCP, TCP_NODELAY is generally a good latency optimization"
03:10 < krzee> because sometimes you have no choice but to use tcp, in those situations TCP_NODELAY is good
03:11 < genesis7> i have little knowledge in all of this but I read alot.
03:11 < krzee> doesnt mean theres no disadvantages
03:11 < genesis7> to understand as much as possible
03:11 < krzee> you ask, then you read
03:11 < krzee> you have it backwards
03:11 < genesis7> no sir. I read, I ask, and reread again.
03:12 < krzee> ok
03:12 < krzee> well keep reading those links i jus  you until you understand why you should use UDP unless you have no choice
03:12 < krzee> links i just gave you*
03:13 < genesis7> I guess I have no choice since i use proto tcp so in that case can use tcp_nodelay. that is my understanding. I am right on that?
03:13 < krzee> im not here to be a teacher, the links are =]
03:13 < krzee> you could use proto udp :-p
03:13 < krzee> no choice = my firewalls that i dont control wont let me
03:14 < genesis7> i have tried and experimenting also udp but I have no signal using udp. I was thinking also udp because it says udp if much faster because it carries only 8bytes of data compare to tcp of 20bytes
03:15 < genesis7> but I really have no signal using udp
03:15 < genesis7> with port 1194
03:15 < krzee> umm nooooo
03:15 < genesis7> I use the same server and client config. I just change the proto type to udp and port 1194. I can connect successfully but no signal
03:16 < krzee> no "signal" ?
03:16 < krzee> lol
03:16 < krzee> you had something else wrong then
03:16 < genesis7> yes. means I cant connect to internet
03:16 < genesis7> yes. means I cant connect to internet
03:17 < genesis7> what could be the problem with my udp that I cant connect to the internet
03:20 < genesis7> can you assist me krzee on what is the problem of my udp port 1194.
03:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:24 < krzee> busy, bbiab
03:25 < krzee> !learn spoonfeeding as http://www.mp3car.com/the-faq-emporium/53368-faq-what-is-spoon-feeding.html
03:25 <@vpnHelper> Joo got it.
03:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:31 -!- genesis7 [~rommel@amertospromotions.com] has quit [Ping timeout: 250 seconds]
03:36 -!- castro [~castro@athedsl-335050.home.otenet.gr] has joined #openvpn
03:37 -!- castro [~castro@athedsl-335050.home.otenet.gr] has quit [Client Quit]
03:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
03:45 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
04:01 <@vpnHelper> RSS Update - forum: The new windows GUI does not ask for PKCS11 PIN <http://forums.openvpn.net/topic7794.html#p10784>
04:06 -!- oc80z [oc80z@blea.ch] has quit [Max SendQ exceeded]
04:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
04:06 -!- oc80z [oc80z@blea.ch] has joined #openvpn
04:08 -!- BX`ZDGWu [steve@bouncer.stephen.marsh.name] has joined #openvpn
04:10 -!- oc80z [oc80z@blea.ch] has quit [Max SendQ exceeded]
04:10 -!- oc80z [oc80z@blea.ch] has joined #openvpn
04:12 -!- oc80z [oc80z@blea.ch] has quit [Max SendQ exceeded]
04:13 -!- oc80z [oc80z@blea.ch] has joined #openvpn
04:14 -!- MarKsaitis [~MarKsaiti@86.31.120.220] has joined #openvpn
04:15 -!- elly [~elly@atheme/member/elly] has quit [Max SendQ exceeded]
04:15 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
04:15 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
04:16 -!- Netsplit *.net <-> *.split quits: SlickDVL, steve
04:17 -!- Netsplit over, joins: SlickDVL
04:20 -!- elly [~elly@atheme/member/elly] has joined #openvpn
04:31 <@vpnHelper> RSS Update - forum: buil openvpn <http://forums.openvpn.net/topic7854.html>
04:39 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
04:41 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:55 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p10786>
05:13 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10787>
05:32 -!- chaomian [~ChocoCook@vps6794.xlshosting.net] has joined #openvpn
05:32 < chaomian> hello
05:33 < chaomian> i'm connecting with openvpn from a hotel to a server i have, it appears to be working fine but when i did wireshark on my ethernet nic there are a ton of ip addresses showing up as sending, receiving udp packets. However when i connect to my openvpn in other places its always just udp between the server ip and my laptops public ip
05:33 < chaomian> so im guessing something might be going wrong
05:34 < chaomian> im using push gateway def1 on the server so i dont think my internet should go anywhere but between me and server
05:35 < Bushmills> unless other routes (other than default) are in place - those have precedence
05:36 < Bushmills> in fact, you need at least one of those other routes - the route to the openvpn server
05:36 < Bushmills> you ethernet nic will still receive traffic as it did before. openvpn, even with default gateway, doesn't turn off those machines which send traffic to your NIC
05:37 < Bushmills> but what you care about is what your machine sends, and what it receives replies for.
05:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:56 < chaomian> ah ok
05:56 < chaomian> thanks
05:57 < chaomian> so your saying its to be expected
06:01 <@vpnHelper> RSS Update - forum: build openvpn <http://forums.openvpn.net/topic7854.html>
06:03 < Bushmills> no. i am saying that external traffic directed to your nic isn't affected by you gateway settings
06:13 < chaomian> oh
06:14 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
06:17 < Bushmills> if you're sufficiently annoyed, firewall all non-openvpn-server and non-openvpn traffic
06:18 < Bushmills> make sure your resolving happens through those routes
06:18 < Bushmills> also make sure that you can connect at all (ppp/dhcp et al)
06:20 -!- chaomian [~ChocoCook@vps6794.xlshosting.net] has quit [Ping timeout: 276 seconds]
06:30 -!- chaomian [~ChocoCook@vps6794.xlshosting.net] has joined #openvpn
06:30 < chaomian> destination for source packets from my openvpn server is 10.5.0.159
06:30 < chaomian> seems like a strange ip 
06:32 -!- EugeneKay is now known as EugeneKaway
06:35 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
06:37 < Bushmills> 4 digits, 3 dots in between, in rfc1918 range ... looks pretty non-strange to me
06:38 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
06:43 < chaomian> i think i must be capturing traffic from other people in the hotel
06:44 < chaomian> can see dns requests for sites i didnt visit etc
06:44 < chaomian> and broadcasts of other peoples computer
06:44 < chaomian> probably the hotel has a special network 
06:45 < helge-> special networks for special people :)
06:46 < chaomian> but i'll relax, i've noticed that messages between my computer only sends and recieves data from the vpn server 
06:46 < chaomian> so i'll just ignore the other stuff
06:46 < chaomian> was worried cuz when i logged onto the internet in this hotel they said 'by using this network u consent to have your activity monitored and logged in a malaysian data center'
06:46 < chaomian> lol
06:51 < Bushmills> be aware that traffic to openvpn which is not explicitely sent to openvpn virtual interface uses the route to public NIC of openvpn server, therefore not traversing openvpn  
06:52 < Bushmills> i.e. if you have a service running on the same machine (other than openvpn), and you connect to that service by host name of that machine, the connection could potentially be monitored 
06:53 < chaomian> well every time i see my ip address as source, it says the servers ip as destination, and likewise everytime i see the openvpn servers ip as source, it says my ip here as destination
06:53 < chaomian> so i think its ok
06:53 < Bushmills> that's not the case if you explicitely give the openvpn server ip address (or host name resolving to it) for connecting to that service 
06:53 < chaomian> hmm
06:54 < chaomian> the service is just an ethernet cable i plugged in in the hotel room, u open up any internet browser and it asks u to accept their pricing and tos.. then i was online and just connected to openvpn in a normal manner
07:01 -!- gratnam11 [~kannnan24@bas2-toronto42-2925234626.dsl.bell.ca] has joined #openvpn
07:12 -!- star314 [~star314@starnet1.sinh.us] has quit [Ping timeout: 240 seconds]
07:13 -!- Guest68746 [~noname@kista.rula.net] has quit [Ping timeout: 260 seconds]
07:14 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
07:19 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
07:45 -!- SOG [~SOG@113.89.208.254] has joined #openvpn
07:45 -!- SOG [~SOG@113.89.208.254] has quit [Remote host closed the connection]
07:49 -!- chaomian [~ChocoCook@vps6794.xlshosting.net] has quit [Ping timeout: 240 seconds]
07:53 <@vpnHelper> RSS Update - forum: moving openvpn from mandrake to debian server <http://forums.openvpn.net/topic7855.html>
08:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:03 -!- tntcoder [~jack@88.97.46.115] has joined #openvpn
08:03 < tntcoder> Hi, does anyone have anyidea what this error could mean that prevents a server from starting: tun0: Disabled Privacy Extensions
08:04 < xheliox> tntcoder: I doubt that's the reason your openvpn isn't starting.
08:05 < tntcoder> thanks, i thought so to. It's the only debugging info avaliable though - server configs and keys are all in place and have been copied from a working old box to a new box. Strange
08:05 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10789>
08:06 < hyper_ch> tntcoder: enable logs and check whats going on
08:15 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
08:18 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
08:24 -!- bitterman [~yury@84.51.201.89] has joined #openvpn
08:26 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 246 seconds]
08:38 -!- tntcoder [~jack@88.97.46.115] has quit [Quit: Leaving]
08:46 -!- Irssi: #openvpn: Total of 130 nicks [3 ops, 0 halfops, 0 voices, 127 normal]
08:52 -!- josh1856 [~skz@173-161-76-129-Illinois.hfc.comcastbusiness.net] has joined #openvpn
08:54 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
08:58 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:07 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:08 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:10 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
09:23 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
09:25 -!- MarKsaitis [~MarKsaiti@86.31.120.220] has quit [Ping timeout: 240 seconds]
09:33 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
09:36 < genesis7> i used tcp_nodelay on my server but it seems that instead of optimizing latency, my throughput is lowered. and page loading is somewhat slow compared to where I did not put the said option in my server.conf
09:39 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
09:46 < genesis7> i guess all are asleep now :)
09:46 < ecrist> I think most people are just ignoring you at this point.
09:46 < genesis7> :(
09:48 < genesis7> ;(
09:48 -!- xheliox [jeff@pdpc/supporter/student/xheliox] has quit [Ping timeout: 252 seconds]
09:49 -!- xheliox [jeff@heliosj.iddings.us] has joined #openvpn
09:50 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:54 -!- genesis7 [~genesis7@amertospromotions.com] has quit []
09:54 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Client Quit]
10:18 -!- [intra]lanman [~lanman@c-71-238-148-210.hsd1.mi.comcast.net] has joined #openvpn
10:18 -!- [intra]lanman [~lanman@c-71-238-148-210.hsd1.mi.comcast.net] has quit [Changing host]
10:18 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:00 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 248 seconds]
11:02 < hyper_ch> ecrist: you know this http://www.whispersys.com/whispercore.html ?
11:02 <@vpnHelper> Title: Whisper Systems (at www.whispersys.com)
11:03 < hyper_ch> krzee: pingpoin
11:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:10 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has joined #openvpn
11:10 -!- mant1s [mant1s@joseph-fasulo1-4.um.maine.edu] has quit [Changing host]
11:10 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
11:17 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 248 seconds]
11:21 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has joined #openvpn
11:23 -!- EugeneKaway is now known as EugeneKay
11:36 <@vpnHelper> RSS Update - forum: Difficulty on Windows XP SP2 OpenVPN Server <http://forums.openvpn.net/topic7856.html>
11:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
11:59 -!- cromega [crome@moronia.hu] has left #openvpn ["chunky bacon!"]
12:03 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
12:18 < ecrist> hyper_ch: cool!
12:18 < hyper_ch> now I just need to get an according phone
12:46 -!- bitterman [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
12:47 -!- luneff [~yury@84.51.201.89] has joined #openvpn
13:01 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
13:08 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:09 -!- jubei__ [~jubei@burbclave.csh.rit.edu] has quit [Read error: Connection reset by peer]
13:09 -!- jubei__ [~jubei@burbclave.csh.rit.edu] has joined #openvpn
13:09 -!- gyyrog [~gyyrog@24-231-158-114.static.trcy.mi.charter.com] has joined #openvpn
13:14 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
13:28 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
13:29 -!- luneff [~yury@84.51.201.89] has joined #openvpn
13:50 < hyper_ch> ecrist: https://www.nytimes.com/2011/03/26/business/media/26privacy.html?_r=1
13:50 <@vpnHelper> Title: Log In - The New York Times (at www.nytimes.com)
13:51 -!- gyyrog_ [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:53 -!- gyyrog [~gyyrog@24-231-158-114.static.trcy.mi.charter.com] has quit [Ping timeout: 276 seconds]
13:54 < hyper_ch> krzee: https://www.nytimes.com/2011/03/26/business/media/26privacy.html?_r=1
13:54 <@vpnHelper> Title: Log In - The New York Times (at www.nytimes.com)
14:02 -!- Gorkhaan_ [5f8c2127@gateway/web/freenode/ip.95.140.33.39] has joined #openvpn
14:05 < Gorkhaan_> Hi!
14:05 < Gorkhaan_> I'm trying to cross compile openvpn on an ubuntu server, however I'm getting this error:
14:05 < Gorkhaan_> configure: checking for LZO Library and Header files... checking lzo/lzo1x.h usability... yes checking lzo/lzo1x.h presence... yes checking for lzo/lzo1x.h... yes checking for lzo1x_1_15_compress in -llzo2... no checking for lzo1x_1_15_compress in -llzo... no configure: error: LZO headers were found but LZO library was not found make: *** No targets specified and no makefile found.  Stop. cp: cannot stat `windest/sbin/openvpn.exe':
14:05 < Gorkhaan_> http://pastebin.com/78AWifTr
14:06 < Gorkhaan_> I've used this prebuilt stuff: http://openvpn.net/prebuilt/
14:06 <@vpnHelper> Title: Index of /prebuilt (at openvpn.net)
14:06 < Gorkhaan_> But LZO cant find the libraries, what should I do?
14:08 -!- xxtjaxx_ [~andreas@dl360.ein-elch.de] has quit [Changing host]
14:08 -!- xxtjaxx_ [~andreas@kde/developer/marschke] has joined #openvpn
14:09 < Gorkhaan_> Please anyone? :)
14:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:23 -!- Gorkhaan_ [5f8c2127@gateway/web/freenode/ip.95.140.33.39] has quit [Quit: Page closed]
14:25 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
14:34 < krzee> hyper_ch, thank you, good link
14:35 < hyper_ch> krzee: you know this http://www.whispersys.com/whispercore.html
14:35 <@vpnHelper> Title: Whisper Systems (at www.whispersys.com)
14:35 < krzee> ooo
14:35 < krzee> no i didnt!
14:35 < hyper_ch> :)
14:36 < krzee> i look forward to them supporting more phones
14:36 < hyper_ch> me too
14:55 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
14:57 < kuku2> I can't find info on how to add new connection profiles to the dynamically created list of open vpn website. Any hints would be helfpull. 
15:03 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
15:05 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
15:07 -!- orkaa_ [~nace@84-255-206-195.static.t-2.net] has joined #openvpn
15:07 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has quit [Read error: Connection reset by peer]
15:07 -!- orkaa_ is now known as orkaa
15:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:15 < krzii> kuku2, sounds like you are talking about access server
15:15 < krzii> since openvpn doesnt come with any web interface
15:16 < krzii> !AS
15:16 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
15:16 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
15:16 < krzii> see #4 for support
15:16 -!- krzii [krzee@hemp.ircpimps.org] has quit [Quit: Leaving]
15:16 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:17 -!- orkaa_ [~nace@84-255-206-195.static.t-2.net] has joined #openvpn
15:17 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has quit [Read error: Connection reset by peer]
15:17 -!- orkaa_ is now known as orkaa
15:19 -!- p3rror [~mezgani@41.248.189.36] has quit [Ping timeout: 255 seconds]
15:21 -!- gyyrog_ [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:30 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:40 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
15:48 -!- p3rror [~mezgani@41.140.152.76] has joined #openvpn
15:49 -!- p3rror [~mezgani@41.140.152.76] has quit [Remote host closed the connection]
15:55 <@vpnHelper> RSS Update - forum: NET-TO-NET example <http://forums.openvpn.net/topic7789.html#p10792> || moving openvpn from mandrake to debian server <http://forums.openvpn.net/topic7855.html#p10791>
16:02 < kuku2> thanks krzie
16:21 -!- TACPILOT [~tacpilot@c-76-31-248-181.hsd1.tx.comcast.net] has joined #openvpn
16:21 < TACPILOT> hello
16:27 < TACPILOT> Is there a way to have build-key not prompts and just use the defaults found in vars?
16:34 < krzie> kuku2, yw
16:34 < krzie> TACPILOT, dunno, read the openssl documentation and edit the scripts to your needs
16:35 < TACPILOT> k .. what hoping a switch was already coded in  :(
16:35 < TACPILOT> tnx
16:36 < krzie> im not sure
16:36 < krzie> there could be
16:36 < TACPILOT> I'll dig into it and see what I can find
16:39 < krzie> if you do need to mod it, once you find the openssl flag it will be easy to add
16:40 < krzie> you can find all the code you would need to steal to make that change in my confgen
16:40 < krzie> !confgen
16:40 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
16:40 < krzie> 2 of those scripts take commandline flags, and the other one sets up flags to use for the other 2
16:42 < TACPILOT> I shoulda looked at the build-key script sooner.  Its just a few lines of code that just calls pkitool adding --interact to the command
16:43 < TACPILOT> removing the --interact from the flag is all needed 
16:43 < TACPILOT> as always TY very much for being here krzie
16:43 < TACPILOT> have a wonderful weekend
16:43 < krzie> you too =]
16:44 -!- TACPILOT [~tacpilot@c-76-31-248-181.hsd1.tx.comcast.net] has left #openvpn []
17:08 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
17:08 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
17:08 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:18 -!- lupine_85 is now known as Omnondom
17:20 -!- Omnondom is now known as Krynnfindor
17:20 -!- dschuett [~dschuett@ip68-99-4-186.om.om.cox.net] has joined #openvpn
17:21 -!- Krynnfindor is now known as lupine_85
17:25 <@vpnHelper> RSS Update - forum: Difficulty on Windows XP SP2 OpenVPN Server <http://forums.openvpn.net/topic7856.html#p10793>
17:50 -!- dschuett [~dschuett@ip68-99-4-186.om.om.cox.net] has left #openvpn []
18:02 < roentgen> lol servers on xp sp2... 
18:04 -!- mete [~metefr@mete.shell.la] has quit [Remote host closed the connection]
18:10 -!- mete [~metefr@mete.shell.la] has joined #openvpn
18:13 -!- xheliox [jeff@heliosj.iddings.us] has quit [Ping timeout: 276 seconds]
18:14 -!- mete [~metefr@mete.shell.la] has quit [Remote host closed the connection]
18:26 -!- mete [~metefr@mete.shell.la] has joined #openvpn
18:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
18:35 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
18:36 -!- luneff [~yury@84.51.201.89] has joined #openvpn
19:10 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
19:23 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
19:28 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
19:49 -!- xheliox [jeff@pdpc/supporter/student/xheliox] has joined #openvpn
19:55 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 240 seconds]
20:12 -!- Votan [~viking@unaffiliated/votan] has joined #openvpn
20:13 < Votan> hey guys, so i tried to get my internet gateway up and running agian, but suddenly it doesnt work anymore. did something change with 2.2 R2 that one should be aware off in regards to routing traffic through ?
20:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
20:15 -!- fipu [~fipufr@212.83.42.243] has joined #openvpn
20:29 < krzie> Votan, what OS?
20:29 < krzie> Votan, was it working right, then you upgraded and it stopped? or had it been down already
20:31 < Votan> krzie server beeing Arch Linux running openvpn 2.1.4, Client is Windows 7 using openvpn 2.2 rc2 - It was working, then i switched from an ubuntu root to an arch root, set thw whole thing up, updated the windows client from 2.2 rc to 2.2 rc2 and now it aint working. connection seems fine, but the client gets no connectino to the internet "Sending request ..." in a browser. iptables on the server are set up
20:36 -!- APTX [APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
20:36 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
20:38 < Votan> 2.2 rc2 should be downwards compatible to 2.1.4 on the serverside, correct ?
20:38 < krzie> sure, but what about your NAT and stuff
20:38 < krzie> !redirect
20:38 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
20:38 < krzie> !linipforward
20:38 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
20:38 < krzie> !linnat
20:38 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
20:39 < krzie> odds are its your setup and not the update, you did switch servers...
20:39 < Votan> kraut i did this: https://wiki.archlinux.org/index.php/OpenVPN#Routing_traffic_through_the_server
20:39 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
20:40 < Votan> that should take care of the NAT/forwarding problem. I did use the same settings on the ubuntu box
20:43 < Votan> omg, wait
20:43 < krzie> so now you want me to go read your walkthrough?
20:43 < Votan> ok ... i failed.
20:43 < Votan> I did set up my iptables
20:43 < Votan> but i did not start the iptables -.-
20:43 < krzie> ip forwarding? ;)
20:43 < krzie> oh, LOL
20:43 < krzie> all better?
20:43 < Votan> yeh ... i added them to my daemons array, but did not reboot since
20:43 < Votan> and did not start them manually
20:43 < Votan> omg, i feel so embarrased ... especially because i am at this for hours lol
20:43 < Votan> yeh, working flawlessly now
20:43 < Votan> -.-
20:46 < krzie> that definitely happens to all of us, sometimes its just a missing " or something and a second pair of eyes is  needed =]
20:47 < Votan> true! well, sorry for stealing your time, I'm off to set the rest of my systems up :)
20:49 < krzie> no worries =]
20:49 -!- Votan [~viking@unaffiliated/votan] has left #openvpn ["Leaving"]
21:21 -!- X31 [d84349bf@gateway/web/freenode/ip.216.67.73.191] has joined #openvpn
21:30 -!- fipu [~fipufr@212.83.42.243] has quit [Remote host closed the connection]
21:34 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
21:34 -!- fipu [~fipufr@212.83.42.243] has joined #openvpn
21:43 < X31> I deployed openvpn via ovf template to esxi, I successfully ran the apt-get update,upgrade so the outgoing connection works, I set the openvpn user password, can't connect to the server via https://listeningip:943/admin or the client url, not that familiar with debian to know where to look next, server replies to ping from internal and external network by ip and host name
21:43 < X31> and yes, I did replace listeningip with the proper ip ;)
21:50 < X31> running /usr/local/openvpn_as/bin/ovpn-init --force fixed it as found at http://openvpn.net/index.php/access-server/section-faq-openvpn-as/69-virtual-appliance/433-why-cant-i-access-the-adminclient-ui.html
21:50 <@vpnHelper> Title: Why can't I access the Admin/Client UI? (at openvpn.net)
21:59 -!- X31 [d84349bf@gateway/web/freenode/ip.216.67.73.191] has quit [Quit: Page closed]
22:10 -!- master_of_master [~master_of@p57B56B54.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
22:12 -!- master_of_master [~master_of@p57B53D04.dip.t-dialin.net] has joined #openvpn
22:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
22:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:31 -!- EugeneKay is now known as EugeneKaway
22:33 -!- EugeneKaway is now known as EugeneKay
22:34 -!- gratnam11 [~kannnan24@bas2-toronto42-2925234626.dsl.bell.ca] has quit [Quit: gratnam11]
22:34 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
22:35 < genesis7> i am stucked in udp ---> http://pastebin.com/aYHf7tVy
22:37 < genesis7> i have been adjusting and adjusting my server conf using proto udp but nothing works out. dont know why.
22:37 < genesis7> since 2 days now
22:37 < genesis7> of adjusting my server conf
22:38 < genesis7> anybody please!
22:38 -!- genesis7 [~genesis7@amertospromotions.com] has quit [Client Quit]
22:41 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:49 -!- gratnam11 [~kannnan24@bas2-toronto42-2925234626.dsl.bell.ca] has joined #openvpn
22:53 -!- gratnam11 [~kannnan24@bas2-toronto42-2925234626.dsl.bell.ca] has quit [Client Quit]
22:58 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:57 -!- EugeneKay is now known as EugeneKaway
--- Day changed Sun Mar 27 2011
00:09 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has quit [Quit: orkaa]
00:41 -!- EugeneKaway is now known as EugeneKay
00:42 -!- EugeneKay is now known as EugeneKaway
00:48 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
01:17 -!- genesis7 [~genlight@amertospromotions.com] has joined #openvpn
01:19 < genesis7> good day to all. I am reading man page and googling. where to put the openvpn.init and firewall.sh in the directory (its default directory)?
01:22 < genesis7> ok. i have found the solution.
01:22 -!- genesis7 [~genlight@amertospromotions.com] has quit [Client Quit]
01:42 -!- elly [~elly@atheme/member/elly] has quit [Ping timeout: 260 seconds]
01:46 < hyper_ch> openvpn.init?
01:58 -!- elly [~elly@atheme/member/elly] has joined #openvpn
02:14 < krzee> if you just ignore him, he'll google his question and figure it out in a few minutes
02:15 < krzee> hehe
02:16 < hyper_ch> krzee: me? now wai!!!
02:16 < hyper_ch> I don't even know what google is
02:16 -!- Torpion [~torpion@ydb.me] has quit [Ping timeout: 240 seconds]
02:19 -!- Torpion [~torpion@ydb.me] has joined #openvpn
02:23 < webmind> googles have to do with numbers, how can it be possibly relevant to openvpn?
02:23 < webmind> moring
02:23 < webmind> morning :)
02:24 < krzee> mornin
02:24 < krzee> hyper_ch, ;]
02:25 < hyper_ch> krzee: so, have you encrypted your nexus yet?
02:26 < krzee> i dont have a nexus
02:26 < krzee> and im not getting one either
02:26 < krzee> but the day they support the aria im playing with it
02:26 < krzee> or the mytouch 3g (htc magic)
02:26 < krzee> or ipod touch =]
02:27 < hyper_ch> :)
02:27 < hyper_ch> can you fake the IMEI number somehow
02:27 < krzee> back in the day you could
02:27 < krzee> not that i know of anymore
02:27 < krzee> i used to be able to on nokias
02:28 < krzee> its called "cloning cell phones"
02:28 < krzee> :-p
02:28 < hyper_ch> I don't like being tracked
02:28 < krzee> and before nokias, you could on the oki 900 with a black crystal
02:28 < krzee> thats oldschool stuff right there
02:29 < hyper_ch> :)
02:29 < krzee> like early-mid 90s
02:29 < krzee> when cells were new
02:29 < krzee> those bricks
02:29 < hyper_ch> did they already have imei numbers?
02:29 < krzee> lil crystal
02:29 < krzee> you could get a black one and scan for them
02:29 < krzee> pull the imei over the air
02:29 < krzee> program it in
02:29 < krzee> booya
02:30 < krzee> wasnt an imei, but same idea
02:32 < krzee> but ya im sure some people still know how to change that stuff
02:39 < hyper_ch> well, a friend of mine can get me an unregistered sim card.... I mean a valid one which was purchased before you had to register with an id
02:40 < hyper_ch> then I would need a second hand cell phone to get a valid imei
02:40 < hyper_ch> and then put them all onto a new one and use the second hand imei
02:40 < hyper_ch> taht should make me anonymous, right?
02:41 < krzee> not for long
02:41 < krzee> you see, everywhere you go is stored automatically, so basically its attached to you by the time you establish your routine with it
02:43 < hyper_ch> I know
02:49 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
03:04 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 250 seconds]
03:11 -!- zxd [~zxd@95.211.21.37] has quit [Quit: Leaving]
03:25 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
03:25 -!- oc80z [oc80z@blea.ch] has joined #openvpn
03:54 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
03:55 -!- oc80z [oc80z@blea.ch] has joined #openvpn
04:03 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:11 <@vpnHelper> RSS Update - forum: VPN Connection successful but no routing to network?! <http://forums.openvpn.net/topic7857.html>
04:25 -!- fipu_ [~fipufr@212.83.42.243] has joined #openvpn
04:26 -!- fipu [~fipufr@212.83.42.243] has quit [Ping timeout: 248 seconds]
04:26 -!- fipu_ [~fipufr@212.83.42.243] has left #openvpn []
04:27 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
04:27 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
04:55 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
05:15 < krzee> hyper_ch, you able to answer any freeswitch questions?
05:15 < hyper_ch> krzee: shoot
05:15 < krzee> im trying to get my freeswitch to allow clients to register over the vpn
05:16 < krzee> so it needs to bind on both IPs
05:17 < hyper_ch> doesn't it by default bind to all interfaces?
05:18 < Bushmills> it does
05:18 < Bushmills> !firewall
05:18 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
05:18 < krzee> interesting, mines not
05:18 < krzee> im using sockstat -l4 and it didnt bind to vpn ip
05:19 < Bushmills> i connect to mine from both vpn and public net, using default config
05:19 < krzee> root     freeswitch 59730 25 udp4   66.11.114.212:5080    *:*
05:19 < krzee> root     freeswitch 59730 26 tcp4   66.11.114.212:5080    *:*
05:19 < krzee> root     freeswitch 59730 33 udp4   66.11.114.212:5060    *:*
05:19 < krzee> root     freeswitch 59730 34 tcp4   66.11.114.212:5060    *:*
05:19 < krzee> root     freeswitch 59730 36 tcp4   127.0.0.1:8021        *:*
05:19 < krzee> although granted this is an old setup
05:19 < krzee> i guess i should update before i expect default behavior
05:19 < hyper_ch> :)
05:19 < hyper_ch> make current
05:21 < Bushmills> ah, amendment.  vpn server is not on the same ip address as freeswitch, and incoming is routed to freeswitch from there. 
05:23 < krzee> Compiling libs/spandsp/src/plc.c ...
05:23 < krzee> In file included from libs/spandsp/src/plc.c:47:
05:23 < krzee> libs/spandsp/src/spandsp/saturated.h: In function `fsaturate':
05:23 < krzee> libs/spandsp/src/spandsp/saturated.h:129: warning: implicit declaration of function `lrintl'
05:23 < krzee> *** Error code 1
05:23 < krzee> Stop in /root/freeswitch-1.0.7.
05:23 < krzee> grr
05:23 < krzee> freeswitch hates freebsd
05:23 < krzee> ecrist, you awake?
05:26 < krzee> oh hey i forgot
05:26 < krzee> he mirrors his freebsd port on one of my servers =]
05:43 < hyper_ch> krzee: http://wiki.freeswitch.org/wiki/Installation_Guide#FreeBSD
05:43 <@vpnHelper> Title: Download & Installation Guide - FreeSWITCH Wiki (at wiki.freeswitch.org)
05:43 < krzee> grr
05:44 < krzee> i saw http://wiki.freeswitch.org/wiki/Installation_Guide#Linux_and_Unix but not the freebsd specific part
05:44 <@vpnHelper> Title: Download & Installation Guide - FreeSWITCH Wiki (at wiki.freeswitch.org)
05:44 < krzee> thanx
05:47 < hyper_ch> in Google we trust
06:10 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
06:29 <@vpnHelper> RSS Update - forum: About UnBlocking <http://forums.openvpn.net/topic7858.html>
06:35 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Connection reset by peer]
06:42 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
06:42 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
06:53 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
07:04 < hyper_ch> krzee: so, does it compile on freebsd or do you need to switch to the better linux?
07:05 < krzee> :-p
07:06 < krzee> same error but im installing some deps
07:06 < hyper_ch> it worked then?
07:06 < hyper_ch> awww :(
07:06  * hyper_ch gives krzee a chocolate coated cookie
07:06 < krzee> gcc34 would help =]
07:06 < krzee> but thats about done
07:07 < hyper_ch> ?
07:07 < krzee> installing gcc34
07:07 < hyper_ch> doesn't fbsd come with it?
07:07 < krzee> as a port
07:08 < krzee> its plenty easy, portinstall gcc34 or cd /usr/ports/lang/gcc34 && make install clean distclean
07:08 < krzee> i just use portinstall tho
07:08 < hyper_ch> that sounds so complicated
07:08 < krzee> lazier
07:08 < krzee> portinstall gcc34
07:09 < krzee> (that was 2 options)
07:10 < hyper_ch> you still don't like lastpass as a mean to safe your passwords, right?
07:10 < krzee> it seemed cool actually
07:10 < krzee> you turned me
07:10 < krzee> but i dont use it
07:10 < hyper_ch> :)
07:10 < krzee> i just remember drawn out multiple word passphrases
07:10 < hyper_ch> what would be great if you could store it on your own server
07:10 < hyper_ch> and not on theirs
07:11 < krzee> oh its on THEIR server?
07:11 < krzee> i was thinking of something else then
07:11 < hyper_ch> yes, it is :(
07:11 < krzee> ya i still dont like that
07:11 < hyper_ch> so, FS compiled now?
07:12 < krzee> take it easy on my poor box
07:12 < hyper_ch> hehehe
07:12 < krzee> its just a lil celeron
07:12 < hyper_ch> took me also a long time to compile
07:12 < krzee> or pentium 4 or something
07:12 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
07:50 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
08:17 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has quit [Ping timeout: 276 seconds]
08:26 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
08:30 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:31 < hyper_ch> krzee: got it compiled?
08:41 < krzee> Compiling libs/spandsp/src/plc.c ...
08:41 < krzee> In file included from libs/spandsp/src/plc.c:47:
08:41 < krzee> libs/spandsp/src/spandsp/saturated.h: In function `fsaturate':
08:41 < krzee> libs/spandsp/src/spandsp/saturated.h:129: warning: implicit declaration of function `lrintl'
08:41 < krzee> gmake[1]: *** [libfreeswitch_la-plc.lo] Error 1
08:41 < krzee> gmake: *** [install] Error 2
08:41 < krzee> oh nm theres a note on that
08:41 < krzee> and i dont even care bout pandsp
08:41 < krzee> spandsp
08:41 < krzee> ive been doing other stuff too
08:44 < hyper_ch> linux is so much simpler
08:44 < xheliox> --without-spandsp ? :)
08:45 < hyper_ch> I just bootstrapped, configured and make install
08:45 < hyper_ch> very simply
08:45 < krzee> you use linux, they use linux
08:46 < krzee> they dont really care much for freebsd... i could go with an older version from ports
08:46 < krzee> i understand their logic tho
08:46 < ecrist> sup krzee ?
08:46 < krzee> playin with freeswitch
08:47 < krzee> you running 1.0.7?
08:47 < ecrist> thought you only messed with cudatel
08:47 < ecrist> there is no 1.0.7
08:47 < krzee> cudatel for work
08:47 < krzee> freeswitch for play
08:47 < ecrist> only git-head
08:47  * krzee loves to git head
08:48 < ecrist> s/t/ve/
08:48 < ecrist> ;)
08:48 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Remote host closed the connection]
08:48 < krzee> * Topic for #freeswitch is: Welcome to FreeSWITCH ~take-a-number || Download FreeSWITCH 1.0.7 http://latest.freeswitch.org/freeswitch-1.0.7.tar.gz
08:48 < ecrist> ooh, must be new
08:48 < hyper_ch> ecrist: you spell out what I think he wanted to say
08:48 < hyper_ch> 1.0.7 is old :)
08:48 < krzee> heh
08:49 < krzee> [09:48]  * Topic for #freeswitch set by bkw_!~bkw_@freeswitch/developer/bkw at Mon Feb 21 11:40:43 2011
08:49 < ecrist> lol, 27-Mar-2011
08:49 < krzee> not *that* old, unless you happen to be the port maintainers ;]
08:49 < ecrist> pretty new. ;)
08:49 < ecrist> it's just a snapshot of head
08:49 -!- albech [~thomas@61.7.136.153] has joined #openvpn
08:50 < ecrist> that they wrap and label as 1.0.7
08:50 < krzee> isnt that what all their releases are?
08:50 < ecrist> 1.0.6 was an actual release
08:50 < ecrist> http://files.freeswitch.org
08:50 <@vpnHelper> Title: Index of / (at files.freeswitch.org)
08:50 < krzee> Registering you for ClueCon http://www.cluecon.com .....
08:50 < krzee> heheheh
08:50 <@vpnHelper> Title: Open Source Telephony Developer Conference | ClueCon 2011 (at www.cluecon.com)
08:51 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Remote host closed the connection]
08:51 < ecrist> krzee: fwiw, I don't even use the freebsd port for freeswitch
08:51 < krzee> niether am i
08:51 < krzee> im using the snapshot from their topic
08:52 < ecrist> my process is:
08:52 < ecrist> 1) git clone git://git.freeswitch.org/freeswitch.git
08:52 < ecrist> 2) cd freeswitch && ./bootstrap.sh
08:52 < ecrist> 3) ./configure --with-libgnutls-prefix=/usr/local --with-ogg=/usr/local --with-ogg-libraries=/usr/local/lib --with-ogg-includes=/usr/local/include --with-libpri
08:52 < ecrist> 4) gmake
08:52 < ecrist> 5) gmake install
08:53 < ecrist> on a fresh install, there's some make target to fetch/install the right sounds.
08:53 < hyper_ch> why all those options?
08:54 < ecrist> pretty self explanitory, hyper_ch 
08:55 < hyper_ch> doesn't that involve some kind of thinking on my side?
08:55 < ecrist> alas, it does.
08:55 < krzee> because his install requires them ;]
08:55 < hyper_ch> thinking on my part is never a good thing
08:55 < ecrist> libpri is the important one for me.
08:55 -!- luneff [~yury@84.51.201.89] has joined #openvpn
08:56 < ecrist> 23 channels on a PRI on a dual-span t1 card
08:57 < krzee> Compiling libs/spandsp/src/plc.c ...
08:57 < krzee> In file included from libs/spandsp/src/plc.c:47:
08:57 < krzee> libs/spandsp/src/spandsp/saturated.h: In function `fsaturate':
08:57 < krzee> libs/spandsp/src/spandsp/saturated.h:129: warning: implicit declaration of function `lrintl'
08:57 < krzee> gmake[1]: *** [libfreeswitch_la-plc.lo] Error 1
08:57 < ecrist> o.O
08:57 < hyper_ch> s/FreeBSD/Debian/
08:57 < hyper_ch> that magically solves all problems
08:57 < krzee> i didnt use any configure args
08:57 -!- mode/#openvpn [+o ecrist] by ChanServ
08:57 < krzee> hyper_ch, im not changing to debian for this
08:57 -!- hyper_ch was kicked from #openvpn by ecrist [s/hyper_ch/bitch/]
08:58 <@ecrist> ;)
08:58 -!- mode/#openvpn [-o ecrist] by ecrist
08:58 < krzee> hah
08:58 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
08:58 < hyper_ch> that wsaas mean :(
08:58 < krzee> he takes his freebsd pretty serios
08:58 < krzee> serious
08:58 < ecrist> hyper_ch: everything on our network at $job is freebsd
08:59 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
08:59 < krzee> except you macbook!
08:59 < ecrist> from our web cluster, to firewalls, to routers, to processing boxes to our phone system
08:59 < hyper_ch> ah... FreeBSD ensures continued employment because it needs to be taken care of?
08:59 < krzee> freebsd is damn stable hyper_ch, at least use valid arguments
08:59 < hyper_ch> I never said it was not stable
09:00 < krzee> it requires no more attention than your debian
09:00 < ecrist> nah, most of my day is spent developing our web tree and things like our fax application
09:00 < ecrist> once in a while I have to poke a box, but we have enough systems that one is on it's way to a swap for new hardware almost weekly
09:01 < hyper_ch> krzee: and you use gmake??
09:01 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
09:01 < ecrist> then there's the matter of security updates, upgrades, package mangement, etc.
09:01 < ecrist> hyper_ch: freeswitch requires gmake
09:01 < ecrist> freebsd uses bsd make in base, and some code doesn't compile properly with it.
09:02 < ecrist> most linux systems package gnu make
09:02 < ecrist> so, software, like freeswitch, written on linux boxes tends to not compile right with bsd make unless the devs test it
09:03 < ecrist> on freebsd, it's trivial enough to use the right make that most of us 'real' admins don't sweat it.
09:03  * ecrist departs
09:03 < ecrist> http://www.donniesmithbikeshow.com/
09:03 <@vpnHelper> Title: 2011 Donnie Smith Bike Show (at www.donniesmithbikeshow.com)
09:03  * ecrist goes there for the day
09:03 < hyper_ch> do they have ebikes?
09:04  * ecrist knocks hyper_ch a dozen rungs down the respect ladder, to the floor.
09:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:07 < hyper_ch> yeah, I made it to the floor
09:09 < krzee> im git'in head
09:09 < krzee> we;ll see if that helps
09:13 < hyper_ch> someone just posted that in FS... actually it was the bot https://xkcd.com/303/
09:13 <@vpnHelper> Title: xkcd: Compiling (at xkcd.com)
09:14 < krzee> i think git's bootstrap method will be the deciding factor here
09:16 < hyper_ch> what is bootstraping actually for?
09:17 < krzee> prolly fixing this stuff for me ;]
09:17 < hyper_ch> I mean what is the purpose of it?
09:18 < krzee> thats my best answer
09:18 < hyper_ch> :)
09:18 < krzee> feal free to read the script and get a better one
09:19 < hyper_ch> there's only a couple of things I had to bootstrab but no clue why it is required
09:25 < krzee> shit
09:25 < krzee> same problem
09:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
09:30 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:32 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:35 -!- jwm_ is now known as jwm
09:36 < hyper_ch> :(
09:36  * hyper_ch gives krzee some of his cheese fondue
09:38 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
09:39 < hyper_ch> bauruine: schaffhausen?
09:43 < bauruine> hyper_ch, sasag.ch is the local cable provider in my region :-( 
09:44 < hyper_ch> ah :)
09:44 < hyper_ch> sh sounded like schaffhausen
09:46 < bauruine> hyper_ch, it is located in schaffhausen. http://neu.sasag.ch/ueber-sasag/versorgungsgebiet.html
09:46 <@vpnHelper> Title: sasag.ch: Versorgungsgebiet (at neu.sasag.ch)
09:46 < hyper_ch> ah ok
09:47 < hyper_ch> 5mbit upload :)
09:48 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
09:48 -!- luneff [~yury@84.51.201.89] has joined #openvpn
09:49 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:55 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has joined #openvpn
10:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:10 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
10:10 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
10:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
10:39 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
10:41 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
10:48 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:49 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
10:49 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
10:53 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
10:55 -!- MattJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
11:00 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
11:01 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
11:02 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
11:06 <@vpnHelper> RSS Update - forum: OpenVPN Intrusion? <http://forums.openvpn.net/topic7850.html#p10796>
11:11 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
11:11 -!- luneff [~yury@84.51.201.89] has joined #openvpn
11:23 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
11:29 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 252 seconds]
11:30 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
11:40 -!- EugeneKaway is now known as EugeneKay
11:51 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 246 seconds]
11:52 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
11:52 < genesis7> good day. sorry if I asked again but none found on the manpage and googling
11:54 < genesis7> what is the proper usage of win-sys path, it is win-sys c:\windows\system32 or win-sys "c:\windows\system32" or win-sys c:/windows/system32 or win-sys "c:/windows/system32"
11:54 <@vpnHelper> RSS Update - forum: OpenVPN 2.1.1 on my N900 <http://forums.openvpn.net/topic7769.html#p10797>
11:54 < genesis7> please advice me
12:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
12:05 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
12:06 < genesis7> hello, anybody home?
12:07 < hyper_ch> maybe
12:07 < hyper_ch> no clue about windows
12:09 < Bushmills> statistically, most likely that somebody is home
12:10 < Bushmills> (given that many people tend to sleep at home, and about 30% of world population may be asleep)
12:11 -!- albech [~thomas@61.7.136.153] has quit [Quit: Ex-Chat]
12:13 -!- genesis7 [~genesis7@amertospromotions.com] has quit [Ping timeout: 248 seconds]
12:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:19 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:24 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10798>
12:27 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:30 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10799>
12:34 -!- Percius [~bgaide@71-33-140-178.hlrn.qwest.net] has joined #openvpn
12:35 < Percius> Hello, I have a question about client configs in the client config directory
12:36 < Percius> I am trying to do site-to-multisite ... I am not sure how to setup the client configs
12:52 -!- josh1856 [~skz@173-161-76-129-Illinois.hfc.comcastbusiness.net] has quit [Ping timeout: 250 seconds]
13:15 < Percius> Ug :OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options 
13:15 < Percius> there is somthing I am missing regaurding this setup 
13:16 < Percius> Anyone out there have a howto or demo config for site to site using certificates and a routed configuration
13:18 < Bushmills> !route
13:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:18 < Bushmills> !clientlan
13:18 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
13:18 <@vpnHelper> better explanation
13:18 < Bushmills> !serverlan
13:18 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
13:23 < Percius> Thanks Bushmills, I will reread that
13:24 < Percius> Bushmills, That is the page I read to get to this point
13:25 < Percius> I try to use the rout option as it lays out and I get an error that I need to use ifconfig or route-gateway
13:25 < Percius> Neither terms occure in that page at all
13:26 < Bushmills> that you need to specify a gateway in --ifconfig, it said. or that you should specify on after --route-gateway. i suppose you did neither, that's why the error suggests to do so.
13:28 < Percius> It is correct that I did neither
13:29 < Percius> I have a default gateway for inet connects (system)... I am not sure what and/or where to specify as a gateway. I do not know if I am using the clients vpn ip, the servers vpn ip or the clients lan ip for the gateway
13:30 < Percius> Sever Lan --> 192.168.18... --> Server VPN 10.0.0.1 ---> Client VPN 10.0.0.2 --> Client Lan 192.168.20....
13:30 < Percius> as of right now when I bring up the TUN adaptor (outside of openvpn) I assign the VPN ips there
13:31 < Bushmills> not knoing your config, i assume you're setting a route to a network of which your system doesn't know how to reach it, as there is no gateway for it, and therefore you are asked to state the gateway
13:31 < Bushmills> knowing
13:33 < Bushmills> !configs
13:33 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
13:33 < Percius> Server: http://pastebin.com/2N7S4hA6
13:34 < Bushmills> !logs
13:34 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
13:41 < Percius> Server Config: http://pastebin.com/DmStVgdb
13:41 < Percius> Client Config: http://pastebin.com/BNJV6LPW
13:41 < Percius> Server Log: http://pastebin.com/n8S0718f
13:46 < Bushmills> nowhere in your server config do i see the subnet you intend to use for openvpn
13:48 < Bushmills> consequently, without the server knowing the subnet it is in, how could it set a route through that subnet, without being told the gateway
13:49 < Percius> Yes, that makes sense... My problem is I do not know the proper way to tell the server that subnet
13:49 < Percius> I intended to use 10.0.0.0 /255.255.255.0 for the VPN subnet
13:49 < Bushmills> --server subnet netmask   would do
13:50 < Percius> When I do so it sets the gateway for all of the route add net to 10.0.0.2
13:51 < Percius> and ifconfig shows up with tun1 looking like: inet addr:10.0.0.1  P-t-P:10.0.0.2  Mask:255.255.255.255 ... Is this correct
13:51 < Bushmills> then the route statements without gateway will refer to gateway to openvpn subnet
13:51 < Percius> is Openvpn using 10.0.0.1 and 10.0.0.2 for the local system?
13:53 < Bushmills> depends on --topology. assuming x.x.x.1 the server address, and x.x.x.2 its p-t-p address should be a reasonable bet
13:55 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
14:00 < Percius> http://pastebin.com/fGkKx9h7 .... Given that topology are the ccd files correct or do I need to add somthing
14:00 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has quit [Remote host closed the connection]
14:01 < Percius> Things seem wrong because the gateway was set at 10.0.0.2 and it is my assumption that that would be the first client and thus the gateway is wrong for the 2nd client or possibly for all of them
14:02 < Bushmills> for increased compatibility with clients which don't support all topologies, i'd maybe go for increments of 4 in ip addresses.  like, 10.0.0.8 for first, 10.0.0.12 for second etc client. that's a precaution you may not need if you have control over your type of clients
14:06 < Bushmills> i'd probably pick a vpn subnet other than 10.0.0.0, to reduce potential of address conflicts on clients
14:06 < Bushmills> pick one:  http://scarydevilmonastery.net/subnet.cgi
14:06 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
14:08 -!- josh1856 [~skz@173-161-76-129-Illinois.hfc.comcastbusiness.net] has joined #openvpn
14:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
14:17 < Percius> what do I add where to set a client to a fixed IP
14:17 < Bushmills> !ccd
14:17 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
14:18 < Bushmills> ifconfig-push ...
14:18 < Percius> and I have the ccd file .... yah that is probably what I needed
14:20 < Percius> Why does Ifconfig push provide 2 IP addresses
14:24 < Bushmills> 2nd address if the clients concept of "remote", the ptp address
14:25 < Bushmills> some drivers require that address to reside in the same /30 net as the actual address
14:28 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
14:30 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
14:37 < Percius> Grr the server appears to read the config file and set the ip for the client correctly, but the client is not configuring the tun device
14:40 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has joined #openvpn
14:40 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
14:41 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
14:41 < Percius> The client opens tun0 as expected but never sets the ip P-t-P ip   ..... http://pastebin.com/RZCX0M25
14:48 -!- josh1856 [~skz@173-161-76-129-Illinois.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
14:53 -!- k1ng [KING@180.211.188.248] has joined #openvpn
14:53 < k1ng> hello
14:53 < k1ng> i need your help
14:55 < k1ng> Administrator: Options error: --server directive network/netmask combination is invalid
14:55 < k1ng> Use --help for more information.
14:56 < Percius> please provide the line in your serverse config that starts with server
14:57 < k1ng> http://pastebin.com/zuhcmsNs
14:59 < Percius> 192.168.1.130 is not a network, it is an individual address. The network containing that address with the provided netmask is 192.168.1.0 
14:59 < Percius> Though I suspect that using that network will not work
15:00 < k1ng> http://pastebin.com/YHkRv63G
15:00 < k1ng> so its will be 192.168.1.0?
15:00 < Percius> It is my understading (though my vpn is not yet working) that you need your vpn server to create a seperate network from the network you are going to use for higher layers and then traffic gets routed though that virtual netowrk
15:01 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:02 < Percius> I hope someone else comes in because (as my network is not working) I may not be providing the correct information... In my case I want to access networks in the 192.168 range, so I setup the server to be in the 10.160.0.0 range
15:03 < k1ng> http://pastebin.com/HfdbQg9m
15:03 < Percius> You cannot have your virtual tunnel be on the same network as the network you are trying to vpn into because then the routing would get all screwed up
15:03 < k1ng> ah
15:03 < Percius> somthing like : server 10.148.153.0 255.255.255.0
15:04 < Percius> That network is obscure enough no matter where your clients are they most likely will not have a routing conflict (ie the same network exists as a real network)
15:05 < Percius> beyond that point I cannot much help right now, because while my system apepars to be creating valid connections I can get no traffic through
15:05 < Percius> Please someone correct me if I provided any wrong information to K1ng
15:06 < k1ng> :)
15:11 < Bushmills> k1ng: http://scarydevilmonastery.net/subnet.cgi
15:11 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
15:12 < k1ng> nice script :)
15:13 < k1ng> so its will be 10.94.245.0/24?
15:13 < Bushmills> k1ng:  http://scarydevilmonastery.net/subnet  that's the whole thing
15:13 < k1ng> its on windows
15:17 < pwrcycle> what would be the advantage of using keepalive if a Client has persist-tun set??
15:18 < Bushmills> pwrcycle: persist-tun doesn't help keeping the connection going
15:19 < pwrcycle> Bushmills: i've commented out keepalive on my client, and waitinf > the server timeout, 
15:19 < pwrcycle> then i send 1 ping and see it establish again
15:21 < Bushmills> keepalive does those pings automatically for oyu
15:21 < Bushmills> you
15:22 < pwrcycle> Bushmills: yeah, i was just wondering how long i could go between keepalives, or what bad thing would happen if i sent none at all
15:24 < k1ng> i am still getting error
15:24 < k1ng> http://pastebin.com/HfdbQg9m
15:24 < k1ng> this one
15:24 < pwrcycle> i see "Peer Connection Initiated with..." in my log when i attempt to ssh out, with keepalives off
15:25 < pwrcycle> so what is the advantage of keepalives at all?
15:27 < Bushmills> no need to reestablish connection. reauthenticate
15:29 < Bushmills> comparable to "what's the advantage of staying connected to internet, rather than connect-on-demand"
15:32 < pwrcycle> Bushmills: ok.
15:34 < Bushmills> may be worth to try out what happens when server tries to reach client (you're using persist-tun on client) after client idled out.
15:34 < k1ng> how long build-dh takes?
15:35 < pwrcycle> Bushmills: ok, i'll try
15:35 < Bushmills> hm. about as long as a string is?
15:36 < k1ng> i am not getting anything
15:38 < Bushmills> not sure whether dhparam building needs (lots of) entropy. if it does, try tapping keys and move mouse
15:39 < k1ng> do i need a dh file?
15:41 < k1ng> Bushmills, i dont think its working
15:43 < k1ng> http://www.enterprisenetworkingplanet.com/img/2009/01/openvpn2_2.jpg
15:43 < k1ng> i am not getting any text like this
15:46 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
15:52 < k1ng> why i am not getting anything from build-dh?
15:57 < k1ng> someone please help me
15:57 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
15:58 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
15:58 < Fleck> hello, is there some gui (web prefered) for openvpn server? where can i add/remove users etc...? :)
15:59 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Connection reset by peer]
16:01 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
16:04 < Bushmills> Fleck: you'd probably look for some openssl administration and management interface 
16:05 < Bushmills> openvpn has no users
16:05 < Fleck> yeah :D sorry :P
16:06 < Bushmills> or are you talking of access server?
16:07 < k1ng> Bushmills, can i use dh.pam in windows that created was created in linux? 
16:08  * Bushmills googles that funny term "windows"
16:09 < Bushmills> ah. "a graphical program loader, popular with gamers"
16:09 < Bushmills> no idea
16:09 < k1ng> lol
16:10 < k1ng> i think build-dh.bat is not working for me
16:16 < Percius> Anyone know why a server would read a ccd file and identify the client ip, but the client would not set a tun interface to that ip?
16:21 < roentgen> Percius: OS of the client and logs?
16:28 -!- drewr_ [~drewr@c-98-216-106-68.hsd1.ma.comcast.net] has joined #openvpn
16:28 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
16:28 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:31 < Percius> roentgen, thanks for asking... The issue was apairently that I had client commented out and just had tls-client, which means that I was not pulling the info with pull Thanks Bushmills
16:31 < k1ng> Options error: Unrecognized option or missing parameter(s) in server.ovpn:8: server10.100.223.0/24 (2.1.4)
16:31 < k1ng> Use --help for more information.
16:31 < Bushmills> my pleasure
16:31 < k1ng> any idea how to fix this error now?
16:31 < krzie> add a space after server, and you cant use CIDR
16:32 < krzie> server10.100.223.0/24 becomes server 10.100.223.0 255.255.255.0
16:34 < pwrcycle> Bushmills: yeah, after the timeout, the Client is "on-demand". If the Server tries first after the timoeout, the Server can't reach the client.
16:34 < Bushmills> pwrcycle: so there's another reason
16:36 < pwrcycle> Bushmills: i think it may be stateful rules on a firewall though, not openvpn for sure.
16:37 < krzie> tell it to not keepstate on UDP, or at least on that port for UDP
16:37 < krzie> keepstate on UDP is somewhat a guessing game
16:38 < krzie> also a keepalive can help keep state
16:43 < k1ng> how do i connect to openVPN server?
16:43 < k1ng> windows
16:45 < Fleck> Bushmills my question actually is - openvpn server management software... :D like config opnvpn server, add/remove crts etc... :D
16:49 < Percius> The openvpn site seems to have a web based config tool
16:49 < Percius> It appears to be part of the licensed access erver
16:49 < Percius> server*
16:51 < Fleck> http://sourceforge.net/projects/openvpncertmgmt/ seems the cutest... but pain to install :D
16:51 <@vpnHelper> RSS Update - forum: Difficulty on Windows XP SP2 OpenVPN Server <http://forums.openvpn.net/topic7856.html#p10800>
16:51 <@vpnHelper> Title: OpenVPN Web Certificate Management | Download OpenVPN Web Certificate Management software for free at SourceForge.net (at sourceforge.net)
16:52 < Percius> Probably no worse then spending an hour to find out you had commented out the client directive in a config file
16:59 -!- Percius1 [~bgaide@184-99-221-166.hlrn.qwest.net] has joined #openvpn
16:59 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:00 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:00 -!- Percius [~bgaide@71-33-140-178.hlrn.qwest.net] has quit [Ping timeout: 260 seconds]
17:04 < k1ng> i need help with this please 
17:04 < k1ng> http://codepad.org/K5f6ZlEu
17:04 <@vpnHelper> Title: C code - 25 lines - codepad (at codepad.org)
17:05 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 248 seconds]
17:06 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
17:07 -!- luneff [~yury@46.41.94.102] has joined #openvpn
17:09 <@vpnHelper> RSS Update - forum: VPN Connection successful but no routing to network?! <http://forums.openvpn.net/topic7857.html#p10801>
17:10 -!- Percius1 [~bgaide@184-99-221-166.hlrn.qwest.net] has quit [Ping timeout: 260 seconds]
17:11 < k1ng> anyone here?
17:11 < pwrcycle> k1ng: hi
17:11 < k1ng> hi
17:11 < k1ng> http://codepad.org/K5f6ZlEu
17:11 <@vpnHelper> Title: C code - 25 lines - codepad (at codepad.org)
17:11 -!- Percius [~bgaide@184-99-195-158.hlrn.qwest.net] has joined #openvpn
17:13 < pwrcycle> k1ng: No server certificate verification method has been enabled. ??
17:13 < k1ng> how do i enable it?
17:17 -!- Percius [~bgaide@184-99-195-158.hlrn.qwest.net] has quit [Ping timeout: 250 seconds]
17:30 < pwrcycle> k1ng: what does your server.conf look like
17:31 < k1ng> new error: http://pastebin.com/9duEkWRm
17:32 < k1ng> http://pastebin.com/wqyEn2MD
17:32 -!- drewr_ [~drewr@c-98-216-106-68.hsd1.ma.comcast.net] has quit [Remote host closed the connection]
17:32 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 240 seconds]
17:33 -!- takamichi [~pri@ks357561.kimsufi.com] has joined #openvpn
17:38 < k1ng> pwrcycle, 
17:38 < k1ng> i am connected to the server but http://vvcap.net/db/gTBgzvxUyhzFSLh3TERb.htp
17:38 <@vpnHelper> Title: VVCap Image (at vvcap.net)
17:40 < k1ng> no data recieve or sent
17:48 < pwrcycle> k1ng: do you control the server? from the log you're not authenticating correctly
17:49 < k1ng> http://codepad.org/ApjGFqAq
17:49 <@vpnHelper> Title: C code - 43 lines - codepad (at codepad.org)
17:49 < k1ng> how about this one?
17:50 < ecrist> sup d00ds?
17:50 -!- takamichi [~pri@ks357561.kimsufi.com] has quit [Ping timeout: 252 seconds]
17:51 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
18:03 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 260 seconds]
18:03 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
18:09 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
18:09 -!- corretico [~luis@201.201.44.82] has joined #openvpn
18:13 -!- Percius [~bgaide@71-208-34-115.hlrn.qwest.net] has joined #openvpn
18:14 < k1ng> Percius, are you there?
18:16 < Percius> I am now
18:16 < k1ng> openvpn is installed on 62.0.84.194
18:16 < k1ng> why i cant use https://62.0.84.194 ?
18:16 < k1ng> what ports needed be forwarded?
18:17 < Percius> what are you trying to do?
18:17 < k1ng> as this video
18:17 < k1ng> http://www.youtube.com/watch?v=GC9D4TAuotY
18:17 <@vpnHelper> Title: YouTube - Connect Client - How to Connect (at www.youtube.com)
18:18 < Percius> https://ip ---> connect to web server using ssl on port 443
18:18 < Percius> Thats openvpn access not openvpn
18:18 < Percius> openvpn access is as far as I am aware a licensed software
18:19 < k1ng> ah
18:19 < Percius> http://openvpn.net/index.php/access-server/pricing.html
18:19 <@vpnHelper> Title: Pricing Guide (at openvpn.net)
18:19 < k1ng> http://vvcap.net/db/EaIPfwZt2zyy2NTf_5w1.htp
18:19 <@vpnHelper> Title: VVCap Image (at vvcap.net)
18:20 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:20 < k1ng> Percius, how do i connect to the server?
18:20 < k1ng> i mean what can i do with it
18:21 < Bushmills> openvpn --config /path/to/your/config
18:21 < k1ng> yes i did that
18:21 < Bushmills> then you are connected to server
18:21 < k1ng> its says no internet access
18:22 < Percius> K1ng, openvpn is used to tunnel communications to/from client(s) to servers via an ssl tunnel... You must setup an openvpn client and server in order to connect
18:22 < Bushmills> have you paid your provider?
18:22 < k1ng> lol
18:22 < k1ng> yes i did 
18:22 < k1ng> Percius, http://vvcap.net/db/EaIPfwZt2zyy2NTf_5w1.htp
18:22 <@vpnHelper> Title: VVCap Image (at vvcap.net)
18:22 < Bushmills> in time?
18:22 < k1ng> its also connected
18:22 < k1ng> my pc to server is connected
18:23 < k1ng> how do i recieve or send file?
18:23 < xheliox> ...
18:24 < Bushmills> put a a netcat listener on server.  pipe to a netcat talker on client 
18:24 < Bushmills> redirect listener output to a file
18:25 < k1ng> i am extremely sorry
18:25 < k1ng> i am new to it
18:25 < Percius> The image you provided is not complete but it appears you have connected to your openvpn server. It also appears you have not setup that server to route traffic to the outside world via that connection... As a result you should be able to communicate with the server (possibly the servers network) but not the outside world... You can either setup the server to allow communication to the outside world via the vpn or set your client up to only r
18:26 < k1ng> how do i setup the server to allow communication to the outside world via the vpn?
18:27 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 248 seconds]
18:27 < Percius> there should be tutorials online, but I have not done that... I use openvpn to access restricted networks (that I have the right to access), not to make myself appear elsewhere
18:28 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
18:30 < Percius> I am sorry but as others here can attest, I am far from an expert
18:31 < krzie> k1ng, i told you before
18:31 < krzie> !AS
18:31 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
18:31 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
18:31 < krzie> #4 is where you go for access-server help
18:31 < krzie> we dont support it here
18:32 < k1ng> thanks :)
18:32 < krzie> yw
18:32 < krzie> it comes with professional support
18:32 < krzie> as opposed to this community based support, for the community version
18:33 < krzie> this is the channel for community to support community version =]
18:33 < k1ng> its has to be installed on server right?
18:34 < krzie> you
18:34 < krzie> are
18:34 < krzie> in
18:34 < krzie> the
18:34 < krzie> wrong
18:34 < krzie> place
18:35 < k1ng> lol sorry
18:35 < krzie> np, but that wont be changing
18:35 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
18:36 < krzie> not only do we not know AS here, but even if we did we would be tainting the professional level of support included in AS by supporting it here
18:36 < krzie> it comes with REAL support
18:36 -!- takamichi [~pri@80.71.98.29] has quit [Read error: Operation timed out]
18:36 < krzie> we are just users helping users around here
18:37 -!- takamichi [~pri@80.71.98.29] has joined #openvpn
18:37 < krzie> !learn no_as as go to http://openvpn.net/index.php/access-server/support-center.html for support with access server (see !AS to know about access server)
18:37 <@vpnHelper> Joo got it.
18:38 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
18:38 < krzie> !learn no_as as not only do we not know AS here, but even if we did we would be tainting the professional level of support included in AS by supporting it here.  it comes with REAL support.  we are just users helping users around here
18:38 <@vpnHelper> Joo got it.
18:39 -!- rolls [~rollin@190.120.228.48] has quit [Ping timeout: 255 seconds]
18:39 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
18:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
18:44 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
18:45 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
18:45 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
18:46 < k1ng> good night people
18:47 < ecrist> boats AND hos
18:50 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
19:08 -!- Percius [~bgaide@71-208-34-115.hlrn.qwest.net] has quit [Ping timeout: 264 seconds]
19:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
19:15 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
19:15 -!- takamichi [~pri@80.71.98.29] has quit [Ping timeout: 260 seconds]
19:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:39 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
19:39 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
19:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:42 -!- luneff [~yury@46.41.94.102] has quit [Quit: Leaving]
20:29 -!- esol`away [~billbill@124-197-50-167.callplus.net.nz] has joined #openvpn
20:29 < esol`away> !welcome
20:29 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:31 < esol`away> ive just copied the key files over to my openvpn directory, and the server seems to be ready to go (installed), how can i start a vpn server using ./openvpn, i am assuming socks option on the windows client means vpn
20:32 < ecrist> no idea what you  mean about sock
20:32 < ecrist> if you're just trying to start openvpn, run 'openvpn --config /path/to/config
20:33 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:34 < esol`away> well i can't figure this out, i will be back in a minute i need to write some things to an external text file. it seems i have 3 folders from compiling and setting this up. one with config, one with executables and one with keys
20:39 < ecrist> !howto
20:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:53 < esol`away> the hell? the windows client comes with a key generator and i can copy the files over that way too
20:54 < esol`away> well okay i guess putty can do that too. why complicate things and have such huge readmes i have no idea
20:57 < esol`away> this is stupid, you can't just give me a simple commandline that uses a password, so i can try get a good config going. unless i spend much longer messing with the config fil
20:58 < esol`away> look, it says # lines are comments, and that some fields are optional and then it has crazy ass ; semi colons what am i supposed to think
20:59 < esol`away> try with them, then try without them and eliminate problems. i can't just get a vpn server running from a standard config. retarded
21:02 < esol`away> oh it does come with sample config files. how about some commandlines that dont smell like shit. fuck you
21:02 < esol`away> disconnecty
21:02 -!- esol`away [~billbill@124-197-50-167.callplus.net.nz] has quit []
21:02 < ecrist> assclown
21:05 -!- stringent [~imac_alph@218.42.150.50] has joined #openvpn
21:24 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
21:30 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
21:31 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Read error: Connection timed out]
21:31 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
21:32 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
21:36 -!- hectorh30 [~hectorh30@190.148.116.132] has joined #openvpn
21:37 -!- rolls [~rollin@190.120.228.48] has joined #openvpn
21:38 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
21:38 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
21:43 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
21:49 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
21:52 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
21:53 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
21:59 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
22:09 -!- master_of_master [~master_of@p57B53D04.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:11 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:13 -!- master_of_master [~master_of@p57B5724A.dip.t-dialin.net] has joined #openvpn
22:24 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
23:04 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has quit [Quit: orkaa]
23:13 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
23:13 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
23:17 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
23:23 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:38 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
23:39 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
23:40 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
23:40 -!- hectorh30 [~hectorh30@190.148.116.132] has quit [Ping timeout: 248 seconds]
23:41 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
23:46 < hyper_ch> krzie: ecrist: http://apenwarr.ca/log/?m=201103#28
23:46 <@vpnHelper> Title: apenwarr - Business is Programming (at apenwarr.ca)
23:50 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
23:53 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
23:54 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
--- Day changed Mon Mar 28 2011
00:02 -!- k1ng [KING@180.211.188.248] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
00:03 -!- stringent_ [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has joined #openvpn
00:04 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
00:04 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
00:07 -!- stringent [~imac_alph@218.42.150.50] has quit [Ping timeout: 250 seconds]
00:07 -!- stringent_ is now known as stringent
00:08 -!- stringent [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has left #openvpn []
00:09 -!- stringent [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has joined #openvpn
00:13 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:15 -!- stringent [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has quit [Ping timeout: 250 seconds]
00:22 -!- stringent [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has joined #openvpn
00:25 -!- stringent_ [~imac_alph@218.42.150.50] has joined #openvpn
00:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
00:28 -!- stringent [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has quit [Ping timeout: 250 seconds]
00:28 -!- stringent_ is now known as stringent
00:30 -!- s7r [~s7r@unaffiliated/s7r] has quit [Read error: Connection reset by peer]
00:31 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:34 -!- stringent [~imac_alph@218.42.150.50] has quit [Ping timeout: 252 seconds]
00:37 -!- stringent [~imac_alph@218.42.150.50] has joined #openvpn
00:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:39 -!- stringent_ [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has joined #openvpn
00:43 -!- stringent [~imac_alph@218.42.150.50] has quit [Ping timeout: 276 seconds]
00:43 -!- stringent_ is now known as stringent
00:45 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 240 seconds]
00:49 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
00:50 -!- Guifort_ [~Guifort@90.84.144.178] has joined #openvpn
00:50 < Guifort_> Hello all
00:50 < Guifort_> Some can help me for openvpn Network Problem ?
00:53 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
00:59 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
01:02 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 276 seconds]
01:02 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
01:02 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Remote host closed the connection]
01:03 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Read error: Operation timed out]
01:06 -!- rkantos [robin@hp1.jaketus.net] has quit [Ping timeout: 255 seconds]
01:06 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
01:16 < hyper_ch> Guifort_: don't ask metaquestions... just state your problem and wait...
01:17 -!- Guifort_ [~Guifort@90.84.144.178] has quit [Ping timeout: 276 seconds]
01:19 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:27 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
01:35 -!- stringent_ [~imac_alph@218.42.150.50] has joined #openvpn
01:37 -!- stringent [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has quit [Ping timeout: 252 seconds]
01:37 -!- stringent_ is now known as stringent
01:54 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
01:54 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
01:54 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:57 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
02:01 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
02:17 -!- psycodad [~cschnee@2001:4060:4419:b1:202:a5ff:fe84:e21c] has quit [Read error: Operation timed out]
02:22 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:23 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
02:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:35 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
02:38 -!- psycodad [~cschnee@2001:4060:4419:b1:202:a5ff:fe84:e21c] has joined #openvpn
02:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
02:49 -!- psycodad [~cschnee@2001:4060:4419:b1:202:a5ff:fe84:e21c] has quit [Ping timeout: 248 seconds]
02:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
02:52  * hjohnson debates using the same certificates for openvpn and ipsec
02:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:00 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
03:11 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 248 seconds]
03:17 -!- xplorer [~genesis7@amertospromotions.com] has joined #openvpn
03:19 < xplorer> Can I push "winsys env" ?
03:20 -!- Haraken [~ryuk@unaffiliated/haraken] has quit [Quit: insert quit message]
03:20  * hyper_ch still fails to see the point of ipsec
03:21 -!- cpf_ [~cpf@91.183.51.181] has joined #openvpn
03:23 -!- Haraken [~ryuk@sigh.haraken.tsu-ji.jp] has joined #openvpn
03:23 -!- Haraken [~ryuk@sigh.haraken.tsu-ji.jp] has quit [Changing host]
03:23 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
03:26 -!- xplorer [~genesis7@amertospromotions.com] has quit []
03:32 -!- psycodad [~cschnee@2001:4060:4419:b1:202:a5ff:fe84:e21c] has joined #openvpn
03:44 -!- EugeneKay is now known as EugeneKaway
03:45 -!- LuckyY__ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
03:45 -!- danci1973 [~kvirc@178.79.70.1] has joined #openvpn
03:45 < danci1973> Hello...
03:46 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Read error: Operation timed out]
03:47 < danci1973> I currently have two ISP's and a router with OpenVPN. I would like to be able to use either ISP for connecting to OpenVPN... But when I connect via the 'secondary' ISP, OpenVPN replies return via the 'primary' ISP (default GW)... Is there a way to make that work?
03:48 < danci1973> I thing routes and ip rules are OK, as PING works as expected (ping ISP1 - replies return via ISP1, ping ISP2 - replies return via ISP2)....
03:53 -!- cpf_ [~cpf@91.183.51.181] has quit [Ping timeout: 252 seconds]
03:57 -!- Haraken [~ryuk@unaffiliated/haraken] has quit [Quit: insert quit message]
04:03 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
04:07 <@vpnHelper> RSS Update - forum: OpenVPN connection going down under traffic <http://forums.openvpn.net/topic7820.html#p10802>
04:15 -!- EugeneKaway is now known as EugeneKay
04:17 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:17 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:17 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:25 -!- Scramblejams [~steve@cpe-72-130-190-173.san.res.rr.com] has joined #openvpn
04:25 < Scramblejams> !welcome
04:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:25 < Scramblejams> !goal
04:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:25 < Scramblejams> !route
04:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:26 < Scramblejams> !iporder
04:26 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
04:29 < helge-> !static
04:29 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
04:30 < helge-> !ccd
04:30 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
04:32 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:32 -!- mode/#openvpn [+o dazo] by ChanServ
04:45 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:45 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:45 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:49 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10803>
04:55 <@vpnHelper> RSS Update - forum: VPN Connection successful but no routing to network?! <http://forums.openvpn.net/topic7857.html#p10804>
04:59 -!- LuckyY__ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Quit: leaving]
05:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:02 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Read error: Connection reset by peer]
05:16 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
05:17 < genesis7> Can I push "win-sys env"
05:22 <@dazo> genesis7: read the man page for --push ... it states there what you can push and not
05:28 < genesis7> @dazo, yes I read it, but it says partial, i was thinking if win-sys is part of those that are not mentioned in the partial.
05:28 <@dazo> then it is just to try it ... use verb 4 on the client, and you will see what gets pushed
05:29 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
05:29 < genesis7> verb 4. alright. will test that. thanks
05:30 < genesis7> anyway, since that is partial list, when will the complete list be available?
05:31 <@dazo> whenever somebody reviews the code and submits a patch to the man page
05:32 < genesis7> I see.
05:34 < genesis7> @dazo I have not encountered what is the use of netsh as part of windows specific options. What I only know is the use of route.exe. May I know in what part does netsh.exe is used in the openvpn activity
05:34 < genesis7> I read --> netsh -- Automatically set the IP address and netmask using the Windows command-line "netsh" command. This method appears to work correctly on Windows XP but not Windows 2000. 
05:35 < genesis7> Dont Route.exe do that?
05:35 -!- danci1973 [~kvirc@178.79.70.1] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.2 Shiny http://www.kvirc.net]
05:35 < janjust> when reading the openvpn source code it does not become obvious what you can or cannot push ; the server will happily push stuff that the client won't accept , as far as I can tell
05:35 < genesis7> In the status log of openvpn-gui I dont see that netsh is used there
05:36 <@dazo> route only sets up routes ... netsh is kind of the ifconfig/iproute2 equivalent, to what I know ... but I've not been using Windows for over 10 years, so I don't know much what happens there
05:36 < janjust> genesis7:  if you use '--ip-win32 netsh' then netsh.exe is used to set the IP address of the tap-win32 i/f
05:36 < genesis7> ok. thanks for the input @dazo.
05:36 <@dazo> most likely the default is to use ipapi on Windows, iirc ... which means it talks directly to some API, instead of calling route.exe and netsh.exe
05:36 < janjust> if you don't specify '--ip-win32' then IPAPI helper functions are used (and netsh.exe is not required)
05:37 < genesis7> I see. You must specify ip-win32 so as to use the netsh otherwise route.exe is used. Is that right JanJust?
05:40 < genesis7> ok thanks for the input.
05:40 -!- genesis7 [~genesis7@amertospromotions.com] has quit []
05:40 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
05:41 < janjust> that guy
05:41 < janjust> that guy's in a hurry
05:41 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
05:42 <@dazo> janjust: basically just an annoying guy who mostly asks before reading ... and expects instant answers
05:42 < genesis7> @dazo I have just tested to push "win-sys env" in my client config.
05:42 < genesis7> OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
05:43 -!- genesis7 [~genesis7@amertospromotions.com] has quit [Client Quit]
05:43 < janjust> hehe dazo
05:44 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
05:44 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
05:44 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:20 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
06:38 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
06:39 < genesis7> I cant run openvpn in windows if I am non-admin. I have already read the article about it. but is there any other way other than what's in the article in openvpn page?
06:39 < genesis7> I am not under admin too
06:46 < ecrist> nope
06:46 < ecrist> you need rights to setup the tunnel.
07:05 -!- genesis7 [~genesis7@amertospromotions.com] has quit []
07:06 < ecrist> hyper_ch: the article you pointed krzie and I to was written by a moron.
07:06 < janjust> lol ecrist 
07:07 < ecrist> one the of authors main beefs with IPv6 is he can't memorize the IP.  I have a ton of them memorized.
07:08 < ecrist> he cites auto-renumbering as one of the reasons it's impossible to memorize an IPv6 IP.  actually, it's one of the things that makes memorizing one so easy.
07:09 < ecrist> also, he thinks NAT is the better alternative
07:10 < janjust> sounds like my anti-ipv6 page :P
07:10 < ecrist> http://apenwarr.ca/log/?m=201103#28
07:10 <@vpnHelper> Title: apenwarr - Business is Programming (at apenwarr.ca)
07:10 < ecrist> if that's you, you're a moron. ;)
07:10 < janjust> I must say that I have problems memoring ipv6 addresses myself - I must be getting old ;-)
07:10 < hyper_ch> janjust: or you're just humane
07:11 < ecrist> I *will* say, in the spirit of full-disclosure, I have an unnatural ability to remember numbers and sequences.
07:11 < janjust> I'm good with numbers, just not with all them colons ;-)
07:11 < ecrist> however, the author used the word _impossible_ which is not the case.
07:12 < ecrist> the colons are easy, and if you know how to simplify an ipv6 address, it's even easier.
07:12 < janjust> hehe just scanned the article: sounds like he invested money in a company that writes NATting software
07:13 < ecrist> heh
07:18 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
07:20 -!- genesis7 [~genesis7@amertospromotions.com] has quit []
07:21 -!- msignor_work [~test@24.115.67.19.res-cmts.sesp.ptd.net] has joined #openvpn
07:22 < msignor_work> !goal
07:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:23 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
07:25 < msignor_work> Hey Guys, I would like to set up a VPN connection (to another office) that changes the default route on the machine it is run on (ie: only that box gets to the internet through the VPN to the colo), however once I connect I am unable to reach the local machine from other VPN (office clients - IE remote users) workstations. Local Lan is OK.. I assume I need an additional route entry
07:34 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
07:44 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
07:44 -!- corretico [~luis@201.201.44.82] has joined #openvpn
07:46 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:53 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has joined #openvpn
07:54 < Bushmills> msignor_work: i think you're right
07:55 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
07:57 < msignor_work> Bushmills: I am just clueless as to what route I need to add - and I have no control over the server config, just client
07:58 < ecrist> !configs
07:58 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
07:58 < Bushmills> i think you need to set up the route to interface of "other VPN"
07:58 < Bushmills> (so that that doesn't rely on default route)
07:59 < Bushmills> how you do that, depends on operating system and/or "other VPN"
08:00 < msignor_work> I think I am SOL - the default route is pushed by the server by default. 
08:01 < msignor_work> I just want a torrent box. honestly. lol - I travel alot and I subscribed to a service to let me surf the net through their IP space. 
08:01 < ecrist> you can do a no-pull
08:01 < msignor_work> just when I VPN to my house, I can't get to the box with the files if its connected.. i need to ssh to the router, etc etc, 
08:01 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
08:01 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
08:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:02 < msignor_work> ecrist: with a no-pull I assume I can change  the routes etc in my client config?
08:02 < ecrist> yup
08:02 < Bushmills> set routes to other networks right, so that only remaining traffic (internet) uses default route
08:02 < ecrist> alternatively, if there's just a few things you don't want routed over the VPN server's LAN, you can just set static routes.
08:03 < ecrist> what Bushmills said
08:05 < msignor_work> I'm with you - yet confused as to how to approach the problem. The torrent / download box is a .31.X IP. Other machines on the .31 network can see the machine just fine when the download box is connected to it's VPN. However when I VPN to home .30.X I can't reach it directly. When I disconnect I can reach it on .31.X just fine. 
08:05 < msignor_work> so do I need do a no-pull and just say everything not local go out the tun0
08:05 < msignor_work> I think if I do that, it would consider .30.X "not local"
08:06 < msignor_work> right?
08:06 < Bushmills> !redirect
08:06 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
08:07 < msignor_work> Bushmills - I am using the redirect gateway currently when I VPN to home so I use my home I-Net to get past hotel firewalls. 
08:09 < msignor_work> so I can do a no-pull, then a --redirect gateway on the client and I should be good?
08:09 < Bushmills> a subnet being local or not sounds more like a matter of using windows. openvpn is not concerned whether windows finds a network local or not.
08:09 < msignor_work> all linux boxes here
08:10 < Bushmills> i suggested what i consider a better way than --no-pull and route workaround. for the no-pull way, you better ask ecrist
08:11 < msignor_work> understood. I will give your method a shot. Additionally - I had posted on the forum which has additional configs and my attempt at an text diagram- https://forums.openvpn.net/topic7843.html
08:11 <@vpnHelper> Title: OpenVPN Support Forum Two Openvpn Tunnels - Breaks Bridging : Configuration (at forums.openvpn.net)
08:17 -!- stringent [~imac_alph@218.42.150.50] has quit [Quit: can't rollerskate in a buffalo herd]
08:30 < msignor_work> Can anyone suggest any good references for creating / editing the routing table?
08:31 < helge-> q: If I want to use a ccd for certain users, but not for all... will other users get the "default" config from openvpn.conf or will they fail?
08:32 < helge-> (when connecting)
08:32 < ecrist> helge-: unless you use the ccd-exclusive option, they'll get the 'default' config
08:32 < helge-> ok, exactly what I wanted, thanks :)
08:32 < ecrist> msignor_work: see !route !iroute
08:33 < msignor_work> !route
08:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
08:36 < msignor_work> ecrist: could the fact that I am 10.13.X and the other server is 10.10.X matter? No right? the wiki article appears daunting, heh
08:37 < ecrist> I'd suggest reading through the entire article.  krzee wrote it, did a good job (imho) of explaining things
08:37 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:37 <@vpnHelper> RSS Update - forum: About UnBlocking <http://forums.openvpn.net/topic7858.html#p10805>
08:44 < msignor_work> ecrist - who would I talk to in order to get some further clarification? 
08:45 < ecrist> people in here.  ask the right questions and you'll get answers.  'how does routing work' isn't going to get an answer, though. :)
08:45 < msignor_work> hah - trust me I know... its coming up with the right question... 
08:47 < msignor_work> from the article I understand that me as a VPN user (10.13.30.6) sends a request to the download machine "voyage" at 10.13.31.2 and since "voyage" had its table overwritten by its own openvpn connection. it is trying to route 10.13.30.X traffic out it's gateway instead of the standard (10.13.31.1 - which is my openvpn router). however since 10.13.31.X is the LAN/Local IP of voyage - it works 
08:47 < msignor_work> just want to make sure I am on the right path here
08:49 < ecrist> !diagram
08:49 <@vpnHelper> "diagram" is You can use a site such as http://gliffy.com to create a network diagram as well as programs such as Visio, Dia, or OmniGraffle
08:49 < msignor_work> knew that was coming - i appreciate the effort . gimme 5 min to whip something up
08:49 < ecrist> I did look at your diagram on the forum, but it sucks.
08:50 < msignor_work> agreed
08:50 < msignor_work> lol
08:51 < hyper_ch> hi ecrist, got a minute?
08:52 < hyper_ch> or krzie
08:54 < ecrist> what do you need, hyper_ch ?
08:54 < hyper_ch> ecrist: you're using bsd?
08:55 < ecrist> I thought we established that yesterday
08:55 < hyper_ch> I just wonder, do I need to set anything special up to make use of the AES-NI capabilities of the cpu?
08:55 < hyper_ch> yesterday... that was a long time ago
08:55 < ecrist> nope
08:55 < hyper_ch> and it was a holiday IIRC
08:55 < hyper_ch> so you can't expect me to remember
09:00 <@vpnHelper> RSS Update - forum: About openvpn IP <http://forums.openvpn.net/topic7841.html#p10806>
09:02 < Bushmills> Avocados
09:03 < Bushmills> (said to improve memory)
09:04 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:06 < helge-> is there a way to run a command when a client disconnects?
09:06 < hyper_ch> helge-: you could monitor the log and upon connection run a script
09:07 < helge-> true, but monitoring the log is hairy. hooking a script to disconnect would be much prettier
09:08 < helge-> I need to implement a "failsafe" auditing mechanism :)
09:09 -!- dollabill [~mike@199.44.8.98] has quit []
09:09 < ecrist> no need for the PM, really, msignor_work
09:10 < ecrist> might want to attach that png to the forum post, too. :)
09:10 < msignor_work> np - sorry, wasn't sure on the policy for those kind of links
09:11 < janjust> helge-:  have you tried a 'client-disconnect' script?
09:11 < Bushmills> helge-: --client-disconnect
09:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 248 seconds]
09:11 < Bushmills> unless you want to monitor on client, then you could use --down
09:12 < ecrist> msignor_work: now that I have a diagram, what do you want to do?
09:13 < msignor_work> ecrist: i want to be able to connect voyage to it's VPN, and still reach it from my laptop on it's .31.X ip
09:14 < msignor_work> ecrist: so voyage can download / browse securely through the other site - and I can access the data locally when I connect to my home
09:16 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
09:20 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
09:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:23 < ecrist> msignor_work: just add a statis route on 'voyage' to the 10.13.30 network pointing it to 10.13.31.1 as next-hop.
09:23 < ecrist> statis routes have a lower cost than default gateway.
09:24 < ecrist> openvpn doesn't clear out your routing table, it just adds different routes, so that should work.
09:26 < msignor_work> so something like : route add 10.13.30.x netmask 255.255.255.255 gw 10.13.31.1
09:27 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:27 < msignor_work> obviously I need the right syntax but  do I need to be worried about the Metric?
09:29 -!- mant1s [mant1s@jared-norwood-1.um.maine.edu] has joined #openvpn
09:29 -!- mant1s [mant1s@jared-norwood-1.um.maine.edu] has quit [Changing host]
09:29 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
09:32 < ecrist> not really
09:32 < ecrist> static, most direct, will have lowest metric, usually.
09:32 < ecrist> if, for some reason, it still doesn't work, then start looking at the metric
09:39 < msignor_work> ecrist - boom. works like a champ -- however I need to specify the source IP specifically.. does not like it when I use 10.13.30.0
09:39 < msignor_work> probably my own syntax thing. 
09:39 < ecrist> what was the command you issued?
09:46 < msignor_work> route add 10.13.30.0 netmask 255.255.255.0 gw 10.13.31.1 eth0
09:48 < ecrist> that looks right to me.
09:49 < msignor_work> yeah, i dunno.. wasn't able to ping.. as soon as I added one explicitly for .30.6 (my vpn IP) it worked 
09:49 < msignor_work> fixed it forgot "-net"
09:50 < msignor_work> route add -net 10.13.30.0 netmask 255.255.255.0 gw 10.13.31.1 eth0 is the correct line
09:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:53 < msignor_work> ecrist: so to make this route happen upon connection, i just need a "push" option in my client config?
09:58 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has quit [Quit: orkaa]
09:59 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
10:09 < msignor_work> ngreg
10:11 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
10:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
10:17 -!- eth00 [~Johnrdp@unaffiliated/eth00] has quit [Excess Flood]
10:17 -!- eth00 [~Johnrdp@colt.eth0.us] has joined #openvpn
10:25 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
10:30 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
10:30 < krzee> !logfile
10:30 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
10:34 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:34 <@vpnHelper> RSS Update - forum: OpenVPN 2.1.1 on my N900 <http://forums.openvpn.net/topic7769.html#p10807>
10:35 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
10:36 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
10:37 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 250 seconds]
10:39 < ecrist> msignor_work: no, just as an --up command
10:40  * dazo just read the IPv6 rant from earlier today  ... that was a waste of time and energy ...
10:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:40 < gladiatr> http://tinyurl.com/2cyla7r
10:40 <@vpnHelper> Title: YouTube - Log (at tinyurl.com)
10:40 < msignor_work> ecrist: cool - any quick word on what kind of route I would need so I can access it from the outside now? (ie, now that im connected - the site with the diagram is not accessible)
10:41 < gladiatr> dazo, On the part of you reading it or the rantors creation?
10:41 <@dazo> gladiatr: both
10:41 < gladiatr> lol
10:42 < krzee> boooya!  now i have free sms in/out and free phone in/out to/from the usa
10:42 <@dazo> This is really the one of the most amazing ideas ... "So here's my proposal to save the Internet from IPv6: let's extend DNS to give out not only addresses, but port numbers."
10:42 < krzee> well and canada, but who cares bout them
10:42 <@dazo> and then he comes with this one: "This proposal has very minor chicken-and-egg problems. Yes, you'll have to update every operating system and every web browser before you can safely use it for *everything*" 
10:43 <@dazo> and I just think ... well, IPv6 is here, supported in most useful apps and OSes already .... 
10:44  * krzee pings dazo's toaster with ping6
10:44  * dazo 's toaster pongs back
10:46 <@dazo> This article reminds me about a just as big weird buy from Norway who claimed in 1996 that Internet was going to be a fiasco and disaster, making companies loose money .... and in 1998 or 1999 follow it up with an "I was right article" ....
10:46  * gladiatr flushes krzee's toilet from a proxy running on a rooted android satellite phone strapped to the pack of a Siberian yak herder
10:46 <@vpnHelper> RSS Update - forum: Dictionary Attack; openvpn and openssh no longer work <http://forums.openvpn.net/topic7849.html#p10808>
10:46 < krzee> gladiatr, not mine, i dont use ipv6
10:46 < gladiatr> lol
10:46 < gladiatr> at least not on your toilet?
10:46 <@dazo> heh
10:47 < krzee> only on XXX
10:47 < krzee> (one of my boxeS)
10:47 < gladiatr> mm hmm...
10:48 < krzee> haha
10:48 < krzee> and its actually a VM
10:48 < krzee> funny thing is it has nothing to do with porn
10:48 < krzee> XXX is the strain of weed i sold for like 2.5 years
10:50 < gladiatr> mm hmm...
10:50 < gladiatr> weed n' porn...
10:50 < krzee> mmm
10:50 < krzee> aka breakfast
10:50 <@dazo> sounds like a honeypot 
10:50 < gladiatr> that's a naming scheme that I haven't seen before--weed varieties
10:50 <@dazo> heh
10:50 < krzee> gladiatr,
10:51 < krzee> i have:
10:51 < krzee> hemp hash xxx
10:51 < gladiatr> excellent
10:51 < krzee> had amix (my australian box, they mix their weed with tobacco and call it a mix)
10:51 < gladiatr> harsh
10:51 < msignor_work> one of my buddies named their boxes weed strains too , heh
10:51 < krzee> mines not strains tho
10:52 < krzee> 1 is
10:52 < msignor_work> word. i stick to space / satellite related names
10:55 -!- hectorh30 [~hectorh30@190.148.120.187] has joined #openvpn
10:55 < krzee> of course then i have joogot
10:55 < krzee> joogot doesnt follow any naming convention
10:56 < krzee> but it goes so well with the domain
10:56 < krzee> (noskills.net)
10:58 < gladiatr> most excellent
11:04 -!- eth00 [~Johnrdp@colt.eth0.us] has quit [Changing host]
11:04 -!- eth00 [~Johnrdp@unaffiliated/eth00] has joined #openvpn
11:07  * dazo disregards mattock note regarding not putting 2.2-RC2 in production, and upgrades his production server from 2.2-beta5
11:08 -!- dazo changed the topic of #openvpn to: OpenVPN 2.1.4 Most Current || 2.2-RC2 Released 25-Mar-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: http://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly.
11:10 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
11:18 -!- ldaguilar [~luis@186.176.7.194] has quit [Ping timeout: 246 seconds]
11:19 < msignor_work> can anyone point me in the right direction as to why a machine becomes unreachable on its public interface after a connection is made with the default-route options enabled?
11:21 < krzee> sure
11:21 < krzee> lemme find the forum post
11:21 < msignor_work> krzee: i saw the recent post about this issue
11:21 < krzee> theres one with a solution
11:22 -!- hectorh30 [~hectorh30@190.148.120.187] has quit [Ping timeout: 250 seconds]
11:22 < msignor_work> krzee: this one - https://forums.openvpn.net/topic7175.html
11:22 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN with redirect-gateway renders public ip inaccessable : Configuration (at forums.openvpn.net)
11:22 < msignor_work> ?
11:22 < krzee> is the solution multiple routing tables...?
11:23 < krzee> yep
11:23 < krzee> thats it
11:23 < msignor_work> didn't work.. i substituted my interface IP too.. -- I'm new to getting my hands dirty with the whole routing table thing.. so please forgive my ignorance
11:24 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
11:24 < msignor_work> in my case I am doing a port forward from my router to the device which has the VPN connection on it. if i disconnect the client I get packets in my tcpdump, when I enable connection, i get no packets - WEIRD! 
11:27 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
11:27 < bwallen> !sample
11:27 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
11:30 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
11:31 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
11:34 -!- hectorh30 [~hectorh30@190.148.16.87] has joined #openvpn
11:34 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.4]
11:39 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
12:00 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
12:02 -!- naquad [~naquad@174.142.224.219] has left #openvpn ["Ухожу я от вас"]
12:03 < msignor_work> krzee - made a typo - the post was right
12:06 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
12:19 < msignor_work> is it possible to store the username and pass in a file so I can run openvpn as the daemon?
12:19 < krzee> !pwfile
12:19 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
12:26 < krzee> but really there is no point to enable passwords if you store them in a file
12:26 < msignor_work> the guys I got the VPN from don't use CA's.. its just a UN / PW to authenticate - its annoying
12:26 < gladiatr> indeed
12:26 < msignor_work> is there an easy way to see if the configure option is enabled in my binary?
12:27 < krzee> oh you dont run the server
12:27 < msignor_work> nope
12:27 < krzee> if it is only login/pass, storing it in a file will make your vpn VERY insecure
12:28 < msignor_work> yah, the issue is that when I logout of SSH, it kills the client 
12:28 < gladiatr> mmm... gnu screen is helpful for that
12:28 < msignor_work> its a headless machine so I only ever SSH to it
12:28 < msignor_work> yah, true
12:28 < msignor_work> good call
12:28 < gladiatr> as much as screen can be a right and proper whore to operate, I've appreciated having learned its ropes hundreds of times for that very reason
12:29 < gladiatr> or at least enough of the ropes that I don't find myself naked in the alley without a cent to my name too often
12:29 < msignor_work> I hear that - yah im going to give it a shot
12:29 -!- mirco [~mirco@pD9E57DC1.dip.t-dialin.net] has joined #openvpn
12:30 < msignor_work> this whole complex setup I came across is a recent addition when my ISP started blocking torrent ports -- so its been a huge learning experience the last week or so
12:31 < gladiatr> hmm... time for a new isp
12:33 <@vpnHelper> RSS Update - forum: Dictionary Attack; openvpn and openssh no longer work <http://forums.openvpn.net/topic7849.html#p10809>
12:33 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 260 seconds]
12:46 < msignor_work> gladiatr - I live in NJ and am forced to use an ISP based out of PA by my cable company.. AND i am capped at 60GB down 60-GB up at 12m/2m speeds. ---- only other option is DSL which is 3/768 -- I would welcome a new ISP any day!
12:48 -!- dazo is now known as dazo_afk
12:52 < msignor_work> !welcome
12:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:06 -!- mirco [~mirco@pD9E57DC1.dip.t-dialin.net] has quit [Quit: mirco]
13:10 < msignor_work> can i use  "--up up.sh" and have the up.sh contain all of my route entries?
13:11 < mete> hi all
13:13 < mete> I've a problem with some UDP tunnels. I've running one openvpn server with topology subnet. three clients are connected. when I test the bandwidth with iperf or wget I get from one client 80mbit what is OK. from the other two clients I get only <1mbit... all servers are connected with 100/100mbit to the internet. when I ping the two slow clients I can see, that the ping doesn't work anymore 
13:13 < mete> when I start the bandwidth test (ping timeout)... what can here be the problem?
13:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:22 < bwallen> I just set up my vpn and I can connect, but I can only ping my vpn server and not anything else on the network. What could cause that?
13:23 < mete> bwallen: you want to access the network behind your openvpn server or behind your openvpn client?
13:23 < bwallen> behind the server
13:23 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
13:23 < bwallen> er, well, not exactly behind
13:24 -!- Scramblejams [~steve@cpe-72-130-190-173.san.res.rr.com] has quit [Ping timeout: 246 seconds]
13:25 < bwallen> maybe that's my problem. where should the openvpn server be on the network? 
13:25 < mete> bwallen: that's up to you
13:25 < mete> so
13:25 < mete> your local network which you want to connect to
13:26 < mete> has another ip range than your openvpn ip range
13:26 < mete> so you need to add a route :)
13:26 < mete> your openvpn client needs a route, that he know that the network A can be reached over the openvpn server
13:27 < bwallen> I added this line    push "route 10.106.1.0 255.255.255.0"
13:27 < bwallen> Did I not use the correct syntax?
13:27 < mete> and your machine which you want to connect to, needs to know that the vpn subnet can be reached throug the openvpn server
13:27 < mete> thats ok I thin bwallen
13:27 < mete> but your machine 
13:27 < mete> in yout local network
13:27 < mete> needs also a route
13:27 < mete> ;)
13:28 < bwallen> Ah, gotcha
13:28 < mete> I think there's the problem :)
13:41 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:41 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:51 < hjohnson> hmm.. does it make sense to use the same CA and certificates for both ipsec and openvpn... 
13:51 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Ping timeout: 248 seconds]
13:55 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
13:55 < hyper_ch> krzee: ecrist: online?
13:55 < krzee> sup
13:56 < hyper_ch> krzee: I'm just benchmarking the difference it takes to write 10GB on an unencrypted filesystem, on an encrypted filesystem and on an encrypted filesystem with aes-ni support... you think that's good as comparison on how aes-ni performs?
13:57 < krzee> without any prior knowledge, sounds good to me
13:57 < krzee> if theres ways to tune them, try different tunings too
13:59 < gladiatr> aes-ni... that the intel aes crypto extension?
13:59 < hyper_ch> no clue about tuning it... as far as I know there's just a kernel mod aes-ni which you can compile or not
13:59 < hyper_ch> gladiatr: yes
14:00 < hyper_ch> one of the partners at work got a HP notebook with aes-ni... he was pondering getting a quad-core 1.8 ghz instead of dualcore 2.3 ghz with aes-ni
14:00 < gladiatr> what file system are you using?
14:00 < hyper_ch> gladiatr: ext4
14:00 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:00 < hyper_ch> (luks/dm-crypt)
14:00 < gladiatr> er... what mechanism are you using to encrypt your file system?
14:00 < gladiatr> ahh
14:01 < mete> I've a problem with some UDP tunnels. I've running one openvpn server with topology subnet. three clients are connected. when I test the bandwidth with iperf or wget I get from one client 80mbit what is OK. from the other two clients I get only <1mbit... all servers are connected with 100/100mbit to the internet. when I ping the two slow clients I can see, that the ping doesn't work anymore 
14:01 < mete> when I start the bandwidth test (ping timeout)... what can here be the problem?
14:02 < hyper_ch> with aes-ni enabled it took 100.208 seconds to write a 10 GB file - dd if=/dev/zero of=test.img bs=1M count=10000
14:02 < hyper_ch> so it wrote 105 MB/s
14:02 < hyper_ch> compiling now kernel without aes-ni
14:03 < krzee> mete, did you do the test using the last client you connected?
14:03 < krzee> mete, are all 3 clients on different certs?
14:03 < hyper_ch> IMHO 105MB/s on a fully encrypted filesystem seems good
14:05 < mete> krzee: all clients connected an then I've tested... all three clients are using the same CA but different keys
14:05 < krzee> ok
14:08 < mete> should I post the client and server config krzee? :)
14:09 < krzee> not for me, i gotta goto work
14:16 -!- Comnenus [~Comnenus@li286-135.members.linode.com] has joined #openvpn
14:17 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:21 -!- gladiatr is now known as gladiatr_afk
14:33 < mete> any ideas?
14:45 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Connection reset by peer]
14:45 -!- mirco_ [~mirco@pD9E57DC1.dip.t-dialin.net] has joined #openvpn
14:54 -!- prodigel [~prodigel@223.47.23.95.dynamic.jazztel.es] has joined #openvpn
14:56 < prodigel> hi all. I have a set of keys to setup an openvpn intance in ubuntu, the problem is that I forgot how to configure/where to put the keys. Theoreticall two keys are mine(crt+key), the other ones (crt+conf) are from the remote station. Any hint?
14:57 < prodigel> !welcome
14:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:57 < prodigel> !howto
14:57 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:01 -!- fipu [~fipufr@212.83.42.243] has joined #openvpn
15:01 < fipu> hi!
15:02 < Bushmills> prodigel: avocados
15:02 < prodigel> :)
15:02 < prodigel> guacamole
15:05 < fipu> I have a strange problem with openvpn server (version 2.1_rc11 i486-pc-linux-gnu). If I change a clients CCD file, I have to restart the openvpn server that it does update it on client.
15:06 < fipu> If I only reconnect the client, it does not apply the changes on the CCD file.
15:07 < ecrist> that doesn't make sense, you shouldn't have to restart the openvpn server since it reads the file upon connection
15:07 -!- hectorh30 [~hectorh30@190.148.16.87] has quit [Quit: Leaving]
15:07 < ecrist> fwiw, update to at least 2.1.4
15:10 -!- prodigel [~prodigel@223.47.23.95.dynamic.jazztel.es] has quit [Quit: Leaving]
15:11 < fipu> ecrist: strange, a friend use the same version and he doesn't need to restart the server, but I'm going to update to 2.1.4 now.
15:12 < fipu> I have an other strange problem, I have connected my windows Client (server 2008 R2, 64 Bit) to the vpn server and one oter linux client (debian 5, 64 bit).
15:13 < fipu> If I ping the windows client from linux client, I alway see a "next hop" with the IP from the windows client
15:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:30 < mete> I've a problem with some UDP tunnels. I've running one openvpn server with topology subnet. three clients are connected. when I test the bandwidth with iperf or wget I get from one client 80mbit what is OK. from the other two clients I get only <1mbit... all servers are connected with 100/100mbit to the internet. when I ping the two slow clients I can see, that the ping doesn't work anymore 
15:30 < mete> when I start the bandwidth test (ping timeout)... what can here be the problem?
15:30 < fipu> mete: same as in my case!
15:30 < fipu> But nobody has an idea!
15:30 < mete> thats shit!
15:30 < mete> it sucks!
15:31 < fipu> right!
15:31 < fipu> it is miöngi!
15:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
15:32 < hjohnson> mete: how much CPU power at the ones that are slow?
15:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:39 < Bushmills> fipu: "I alway see a "next hop" with the IP from the windows client" - what did you expect to see there?
15:43 < Bushmills> mete: try to ping -n
15:43 < mete> hjohnson: maximal cpu load is 5%
15:43 < mete> and then when the ping doesn't work anymore, the cpu load is 0%
15:43 < mete> I've -n used all the time Bushmills
15:44 < mete> :(
15:45 < Bushmills> "doesn't work anymore" - what happened when it stopped working
15:45 < mete> it goes about 5-10 secs
15:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:45 < Bushmills> can you still use any other service?
15:45 < mete> then the ping work
15:45 < mete> and if the transfer continues, then the ping stop working again...
15:45 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
15:46 < mete> Bushmills: over this one tunnel it's not possible in the time to send/receive packets
15:46 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
15:46 < mete> the other two tunnels work on the same time
15:46 < Bushmills> check logs, whether client is reconnecting frequently - maybe because of two openvpn instances runnung at the same time, and competing for interface
15:46 < mete> Bushmills: nothing to see in the log :(
15:46 < mete> no reconnects...
15:47 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
15:47 < Bushmills> well, i'm done speculating then
15:47 < mete> heh ^^
15:47 < mete> one tunnel just works fine
15:47 < mete> the other two doesn't
15:47 < mete> test mtu I've done
15:47 < mete> tried mssfix and fragment
15:47 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Client Quit]
15:48 < mete> client config and ccd is on all clients the same
15:48 < Bushmills> so the clients compete for same ip address?
15:48 < Bushmills> consequence of identical ccd files
15:49 < mete> no, that's the only difference in the ccd
15:49 < mete> ;)
15:49 < mete> sry¨
15:50 < Bushmills> use tcpdump or tshark to see whether those icmp echo requests which aren't replied to reach the server at all
15:51 < Bushmills> find the spot where the problem arises
15:51 < mete> ok, I will do that tommorow :)  I'm just reinstalling the server... don't know if that helps...
15:52 -!- mirco_ is now known as mirco
15:52 < mete> thx for the input Bushmills
15:56 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
15:58 -!- cwesterfield [tinman@ip183-71.mmth.WKU.EDU] has joined #openvpn
15:58 < cwesterfield> !welcome
15:58 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:59 < cwesterfield> !redirect
15:59 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:59 < cwesterfield> !def1
15:59 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
16:00 < cwesterfield> !man
16:00 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
16:02 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:02 < cwesterfield> Can someone check my config to see if it's correct?
16:04 < cwesterfield> http://pastie.org/1728256
16:14 < hyper_ch> krzee: I got the results now of my no encryption, aes and aes-ni test - http://pastebin.com/fxrM9kyw
16:16 < hyper_ch> Bushmills: :)
16:16 < Comnenus> I am running an openVPN client on RHEL6.  I downloaded the correct .ovpn, and am using it to connect.  Everything seems to work, except that it isn't pulling the DNS information.  After I add the search, domain, and nameserver manually to resolv.conf, it works.  Any ideas?
16:25 < cwesterfield> Com, I'm having a similar problem but don't have the expereince to get as far as you
16:25 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
16:27 -!- EugeneKay is now known as EugeneKaway
16:29 < Comnenus> cwesterfield: hmm...   =/
16:29 -!- mirco [~mirco@pD9E57DC1.dip.t-dialin.net] has quit [Quit: mirco]
16:34 -!- mirco [~mirco@pD9E57DC1.dip.t-dialin.net] has joined #openvpn
16:38 -!- mirco [~mirco@pD9E57DC1.dip.t-dialin.net] has quit [Client Quit]
16:40 < Comnenus> cwesterfield: looks like the DNS is returned as a variable so people have written scripts to use the variable to add it to resolv.conf.
16:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:44 < krzie> exactly
16:44 < krzie> !pushdns
16:44 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
16:44 < krzie> #4
16:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
16:46 < krzie> hyper_ch, looks like a testament to AES-NI
16:46 < krzie> hyper_ch, can AES-NI work on something like ZFS?  that would be interesting to test a nice fat raid with/without
16:47 -!- msignor_work [~test@24.115.67.19.res-cmts.sesp.ptd.net] has quit [Remote host closed the connection]
16:52 < Comnenus> krzie: thanks!
16:54 < krzie> yw
17:03 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:13 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
17:24 -!- ldaguilar [~luis@186.176.7.194] has quit [Read error: Connection reset by peer]
17:25 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
17:28 -!- EugeneKaway is now known as EugeneKay
17:29 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
17:44 <@vpnHelper> RSS Update - forum: Possible routing problem <http://forums.openvpn.net/topic7805.html#p10810>
17:49 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
17:49 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
17:49 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
17:58 -!- teddz [~teddz@dtmd-4db2e40a.pool.mediaWays.net] has joined #openvpn
18:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:10 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
18:32 -!- ldaguilar [~luis@186.176.7.194] has quit [Remote host closed the connection]
18:56 <@vpnHelper> RSS Update - forum: Help Install Openvpn on FEDORA 13 server (server version)) <http://forums.openvpn.net/topic7859.html>
19:02 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 250 seconds]
19:02 <@vpnHelper> RSS Update - forum: About openvpn IP <http://forums.openvpn.net/topic7841.html#p10812>
19:03 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
19:07 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:14 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
19:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:40 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
19:44 <@vpnHelper> RSS Update - forum: Failed to connect error <http://forums.openvpn.net/topic7860.html>
19:54 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
19:54 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:58 -!- cpf_ [~cpf@reehorst1.customer.bit.nl] has joined #openvpn
20:06 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Ping timeout: 276 seconds]
20:14 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Quit: Bye]
20:20 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
20:22 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:23 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
20:23 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
20:23 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:23 -!- teddz [~teddz@dtmd-4db2e40a.pool.mediaWays.net] has quit [Quit: Ex-Chat]
20:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Remote host closed the connection]
20:52 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
21:30 -!- dvl [~Dan@nyi.unixathome.org] has joined #openvpn
21:30 -!- dvl [~Dan@nyi.unixathome.org] has quit [Changing host]
21:30 -!- dvl [~Dan@pdpc/supporter/active/dvl] has joined #openvpn
21:37 < dvl> It is not easy to find the license for OpenVPN on the website
21:38 < dvl> there is no link, that I could find, to licence.html, which I found via google
21:40 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
21:44 -!- dvl [~Dan@pdpc/supporter/active/dvl] has quit [Read error: Connection reset by peer]
21:44 -!- dvl [~Dan@nyi.unixathome.org] has joined #openvpn
21:47 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
21:47 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
21:47 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:50 -!- dvl [~Dan@nyi.unixathome.org] has quit [Changing host]
21:50 -!- dvl [~Dan@pdpc/supporter/active/dvl] has joined #openvpn
21:52 -!- wookienz [~chatzilla@220.232.248.214] has joined #openvpn
21:53 < wookienz> hi, setting up openvpn - i have client and server side sorted, it looks like the client side is connecting when i run openvpn client.conf under ubuntu. I am getting the right IP address from the vpn server, however id ont seem to be able to ping anything.
21:57 <@vpnHelper> RSS Update - forum: Some very basic quesitons... <http://forums.openvpn.net/topic7861.html>
22:05 -!- stringent [~imac_alph@218.42.150.50] has joined #openvpn
22:06 -!- Netsplit *.net <-> *.split quits: js_, krzee, elly, UnterPerro, dvl, xheliox, ScriptFanix, Peer^, sia^pwnnt, rkantos,  (+88 more, use /NETSPLIT to show all of them)
22:11 -!- master_of_master [~master_of@p57B5724A.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
22:13 -!- master_of_master [~master_of@p57B56D44.dip.t-dialin.net] has joined #openvpn
22:14 -!- elly_ [~elly@rath.leptoquark.net] has joined #openvpn
22:14 -!- Netsplit over, joins: DarthGandalf, DigitallyStoned, Haraken, bauruine, eth00, krzee, corretico, Fleck, mete, mindcry (+6 more)
22:18 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
22:18 -!- diphthon1 [~diphthong@69.172.135.243] has joined #openvpn
22:18 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:18 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
22:18 -!- rolls [~rollin@190.120.228.48] has joined #openvpn
22:18 -!- xxtjaxx_ [~andreas@kde/developer/marschke] has joined #openvpn
22:18 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
22:18 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
22:18 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
22:18 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
22:18 -!- Champi [Champi@rootshell.fr] has joined #openvpn
22:19 -!- wookienz [~chatzilla@220.232.248.214] has joined #openvpn
22:19 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
22:19 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
22:19 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
22:19 -!- Torpion [~torpion@ydb.me] has joined #openvpn
22:19 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
22:19 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
22:19 -!- webmind [~webmind@yavin.puscii.nl] has joined #openvpn
22:19 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
22:19 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
22:19 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
22:19 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
22:19 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
22:19 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
22:19 -!- js_ [~js@213.180.83.163] has joined #openvpn
22:19 -!- cpf_ [~cpf@reehorst1.customer.bit.nl] has joined #openvpn
22:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:19 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has joined #openvpn
22:19 -!- xheliox [jeff@pdpc/supporter/student/xheliox] has joined #openvpn
22:19 -!- gladiatr_afk [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
22:19 -!- dazol [~dazo@nat/redhat/x-gsuyfdiwtsaqiujg] has joined #openvpn
22:19 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
22:19 -!- BX`ZDGWu [steve@bouncer.stephen.marsh.name] has joined #openvpn
22:19 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
22:19 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
22:19 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
22:19 -!- katoen_ [482392@xs8.xs4all.nl] has joined #openvpn
22:19 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
22:20 -!- dvl [~Dan@pdpc/supporter/active/dvl] has joined #openvpn
22:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:20 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:20 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
22:20 -!- psycodad [~cschnee@2001:4060:4419:b1:202:a5ff:fe84:e21c] has joined #openvpn
22:20 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
22:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:20 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
22:20 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
22:20 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
22:20 -!- LowKey [noc@unaffiliated/lowkey] has joined #openvpn
22:20 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
22:20 -!- Damme [~damme@206.216.95.91.static.ter-s.siw.siwnet.net] has joined #openvpn
22:20 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
22:20 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
22:20 -!- d12fk [~heiko@vpn.astaro.de] has joined #openvpn
22:20 -!- ronnocol [~lance@2001:1868:214::dead:beef] has joined #openvpn
22:20 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
22:20 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
22:20 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
22:20 -!- LeRrA [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
22:20 -!- nb [~nb@fedora/nb] has joined #openvpn
22:20 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has joined #openvpn
22:20 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:20 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:20 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
22:20 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
22:20 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
22:20 -!- _Meliorator [m@dunnington.eu] has joined #openvpn
22:20 -!- fipu [~fipufr@212.83.42.243] has joined #openvpn
22:20 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
22:20 -!- jwm [jwm@dev.dist.us] has joined #openvpn
22:20 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
22:20 -!- helge- [helge@olsentech.net] has joined #openvpn
22:20 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
22:20 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
22:20 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
22:20 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has joined #openvpn
22:20 -!- chantra_1fk [~chantra@ns38827.ovh.net] has joined #openvpn
22:25 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:27 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
22:37 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 248 seconds]
22:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:51 -!- swills [~swills_@unaffiliated/steve/x-520345] has joined #openvpn
23:02 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Read error: Operation timed out]
23:02 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Read error: Operation timed out]
23:02 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Operation timed out]
23:03 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
23:03 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
23:03 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
23:03 -!- stony is now known as Guest97525
23:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:10 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 246 seconds]
23:10 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
23:11 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Ping timeout: 246 seconds]
23:12 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
23:12 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
23:12 -!- WebDawg [~whoami@officialg0d.com] has quit [Ping timeout: 246 seconds]
23:13 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
23:33 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
23:42 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
--- Day changed Tue Mar 29 2011
00:06 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
00:07 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:11 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
00:24 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
00:46 -!- mirco [~mirco@pD9E57DC1.dip.t-dialin.net] has joined #openvpn
00:54 -!- mirco [~mirco@pD9E57DC1.dip.t-dialin.net] has quit [Quit: mirco]
01:00 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:00 -!- mode/#openvpn [+o mattock] by ChanServ
01:03 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: Leaving]
01:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
01:12 < wookienz> hi, setting up openvpn - i have client and server side sorted, it looks like the client side is connecting when i run openvpn client.conf under ubuntu. I am getting the right IP address from the vpn server, however id ont seem to be able to ping anything.
01:17 < krzee> can you ping the vpn server ip?
01:19 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:20 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
01:22 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:23 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
01:23 <@vpnHelper> RSS Update - forum: About openvpn IP <http://forums.openvpn.net/topic7841.html#p10815>
01:29 <@vpnHelper> RSS Update - forum: Some very basic quesitons... <http://forums.openvpn.net/topic7861.html#p10816>
01:35 <@vpnHelper> RSS Update - forum: Help Install Openvpn on FEDORA 13 server (server version)) <http://forums.openvpn.net/topic7859.html#p10818> || Failed to connect error <http://forums.openvpn.net/topic7860.html#p10817>
01:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:40 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 248 seconds]
01:42 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
01:44 -!- ptripath [~ptripath@61.8.134.90] has joined #openvpn
01:52 -!- rajkosto [rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has joined #openvpn
01:52 < rajkosto> problem
01:54 < rajkosto> basically on winxp client
01:54 < rajkosto> all works fine
01:54 < rajkosto> but on router client, DNS stops working after a few minutes
01:54 < rajkosto> i havent changed anything on the server 
01:54 < ptripath> Hello Everybody. we have two openvpn tunnels connecting two debian boxes. One tunnel runs over MPLS and the other runs over the leased internet connection. I am a new to openvpn and wanted to know how to configure failover between two tunnels. 
01:55 < ptripath> I have not been able to find a documentation on it
01:55 < krzee> rajkosto, you use redirect-gateway and pushdns?
01:56 < rajkosto> i use redirect-gateway but not pushdns
01:56 < rajkosto> also, traceroute on the router looks really weird
01:56 < krzee> ptripath, define "failover between 2 tunnels"
01:56 < rajkosto> when openvpn is active
01:56 < krzee> rajkosto, 
01:56 < krzee> !configs
01:56 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
01:56 < rajkosto> here's a traceroute http://codepad.org/1kZethN4
01:57 <@vpnHelper> Title: Plain Text code - 4 lines - codepad (at codepad.org)
01:57 < ptripath> krzee, I mean when the MPLS link is down, the tunnel over the internet connection takes control . 
01:57 < rajkosto> 172.16.0.1 is the PPP server openvpn ip
01:57 < krzee> rajkosto, looks right if you use redirect-gateway
01:57 < rajkosto> thats not what it looks like on windows xp box
01:57 < krzee> the next ip would be hop 1 if you traceroute the same thing from the server
01:58 < krzee> rajkosto, show me it from winxp
01:58 < rajkosto> http://codepad.org/AR7xSgxB
01:58 <@vpnHelper> Title: Plain Text code - 17 lines - codepad (at codepad.org)
01:58 < rajkosto> thats what it should look like
01:59 < rajkosto> with it actually ending up at the destination ip
01:59 < krzee> and tell me if when you go to http://www.secure-computing.net/ip.php from each they both show the same ip
01:59 <@vpnHelper> Title: SCN: SCN (at www.secure-computing.net)
01:59 < rajkosto> yes, everything is working fine
01:59 < rajkosto> except port 53 ipv4 seems to be blocked
01:59 < krzee> ohhh
01:59 < krzee> i just caught that hop 2 and 3 are the same
01:59 < krzee> thats tripped out
02:00 < rajkosto> if i use DNS outside of the vpn
02:00 < rajkosto> like ipv6 dns
02:00 < rajkosto> everything works
02:00 < krzee> try pushing DNS to it
02:00 < rajkosto> i dont want that
02:00 < rajkosto> i want every client to use whatever dns they want
02:00 < krzee> its prolly trying to use its ISPs nameservers over the tunnel
02:00 < rajkosto> nope
02:00 < rajkosto> even things like dig @208.67.222.222 asdadasdasd.com
02:00 < rajkosto> fails
02:00 < krzee> !configs
02:00 < rajkosto> port 53 ipv4 is literally blocked
02:00 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
02:01 -!- rajkosto [rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has left #openvpn ["Leaving"]
02:01 -!- rajkosto [rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has joined #openvpn
02:01 < krzee> but you can go to a website by ip?
02:01 < krzee> like http://74.125.67.106
02:01 <@vpnHelper> Title: Google (at 74.125.67.106)
02:01 < rajkosto> yep
02:01 < ptripath> krzee, just realised that I can do it using quagga which handles the routes on the two machines . 
02:02 < krzee> ahh
02:02 < krzee> !riproute
02:02 < krzee> !rip
02:02 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
02:02 < rajkosto> server http://codepad.org/TtQFTU0D
02:02 <@vpnHelper> Title: Plain Text code - 26 lines - codepad (at codepad.org)
02:02 < rajkosto> server ccd http://codepad.org/5mSHcbjJ
02:02 <@vpnHelper> Title: Plain Text code - 1 line - codepad (at codepad.org)
02:02 < krzee> note, you can also use a routed TAP setup and use quagga just fine
02:03 < krzee> just cant use tun, because iroutes are not dynamic
02:03 < rajkosto> http://codepad.org/O318fBrP client
02:03 <@vpnHelper> Title: Plain Text code - 22 lines - codepad (at codepad.org)
02:03 < krzee> tun in server mode i mean, tun in ptp mode works fine
02:04 < krzee> and is advantageous IF you gain something from the less overhead of tun
02:04 < krzee> server ccd?
02:04 < rajkosto> yes, for that client
02:05 < rajkosto>  or (#2) dont forget to include any ccd entries
02:05 < rajkosto> herp derp
02:05 < krzee> but umm
02:05 < krzee> you cant give it .2
02:05 < krzee> !/30
02:05 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
02:05 < rajkosto> i did this since forever
02:05 < rajkosto> and it worked 
02:05 < rajkosto> but one day i woke up and dns didnt work
02:05 < krzee> you are using tun with server and not using topology subnet
02:06 < krzee> .2 is internal to the openvpn process in the server
02:06 < krzee> you cant give it out
02:06 < rajkosto> you can
02:06 < rajkosto> its a valid pair
02:06 < krzee> heh
02:07 < krzee> sorry i cant help you if you dont listen
02:07 < rajkosto> http://codepad.org/0B8iPeVS
02:07 <@vpnHelper> Title: Plain Text code - 29 lines - codepad (at codepad.org)
02:07 < krzee> THE SERVER IS .1
02:07 < krzee> lol
02:07 < rajkosto> says its a valid pair there
02:07 < krzee> so internally the process is .2
02:07 < krzee> READ THE LINK
02:07 < krzee> !/30
02:07 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
02:07 < rajkosto> IT DOENST BOOKMARK
02:08 < rajkosto> GOES TO THE TO OF THE PAGE
02:08 < krzee> THEN FIND IT
02:08 < krzee> !spoonfeeding
02:08 <@vpnHelper> "spoonfeeding" is http://www.mp3car.com/the-faq-emporium/53368-faq-what-is-spoon-feeding.html
02:09 < krzee> !forget /30 *
02:09 <@vpnHelper> Joo got it.
02:09 < rajkosto> this is on the server http://codepad.org/bpO7JIMU
02:09 <@vpnHelper> Title: Plain Text code - 7 lines - codepad (at codepad.org)
02:09 < krzee> !learn /30 as http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips
02:09 <@vpnHelper> Joo got it.
02:10 < rajkosto> so i cant use the 1,2 pair ?
02:10 < krzee> !learn /30 as you can avoid this behavior by reading !topology
02:10 <@vpnHelper> Joo got it.
02:10 < krzee> !learn /30 as so by default, first client is .6, then .10 .14 .18 etc etc
02:10 <@vpnHelper> Joo got it.
02:10 < rajkosto> i thought it said somewhere that clients are independent of what ips are on server cuz of ptp
02:11 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:12 < krzee> but you arent using ptp
02:12 < krzee> you are using server/client
02:12 < krzee> let me show this to you for the 3rd time tho, just in case you missed the other 2
02:12 < krzee> you can avoid this behavior by reading !topology
02:13 < rajkosto> how did it work before then
02:13 < rajkosto> wtf
02:13 -!- mirco__ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:13 < krzee> you can worry bout that, or fix it now ;]
02:13 < rajkosto> i guess thats why the traceroutes are weird
02:14 < rajkosto> on winxp, it uses the 6,7 pair or whatever
02:14 < rajkosto> 5,6
02:14 < krzee> right, cause you didnt interfere with a bad ccd file
02:15 < krzee> So, you first have a PtP link 192.168.1.1 <-> 192.168.1.2 between your server O/S and OpenVPN on the server.
02:15 < rajkosto> ifconfig-push 172.16.0.6 172.16.0.5
02:15 < rajkosto> is for winxp
02:15 < krzee> !static
02:15 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
02:15 < rajkosto> whats the first ip and whats the 2nd
02:15 < rajkosto> first is client, 2nd is server
02:15 < krzee> backwards
02:15 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
02:15 -!- mirco__ is now known as mirco
02:15 < krzee> As 192.168.1.5 is only a virtual IP address inside the OpenVPN server, used as an endpoint for routes, OpenVPN doesn't bother to answer pings on this address, while the 192.168.1.1 is a real IP address in the servers O/S, so it will reply to pings.
02:16 < krzee> you still didnt even read the link
02:16 < rajkosto> i did
02:16 < rajkosto> but for me its the reverse
02:16 < krzee> umm no
02:16 < krzee> lol
02:16 < rajkosto> yep
02:16 < krzee> haha
02:16 < rajkosto> i guess thats with the config
02:16 < rajkosto> when you have .5 then .6 in ifconfig-push
02:16 < krzee> so you modified the code?
02:16 < krzee> or more possible that your ccd is bad yet again?
02:16 < krzee> hrmmmm which could it be
02:17 < rajkosto> yep
02:17 < rajkosto> for ifconfig-push its ClientIp ServerIp
02:18 < rajkosto> you dont have to use specific ips
02:18 < rajkosto> As an example, the following option would be correct:
02:18 < rajkosto>     --ifconfig 10.7.0.5 10.7.0.6 (on host A)
02:18 < rajkosto>     --ifconfig 10.7.0.6 10.7.0.5 (on host B)
02:18 < rajkosto> because [5,6] is part of the below list.
02:18 < krzee> --ifconfig-push local remote-netmask
02:19 < krzee> if the server is pushing, what do you think local is?
02:19 < rajkosto> for tap
02:19 < krzee> are you trolling...?
02:19 < rajkosto> no, look
02:19 < rajkosto> ifconfig-push 172.16.0.10 172.16.0.9 
02:19 < rajkosto> gives me
02:19 < krzee> just do it how im saying
02:19 < rajkosto> http://i.imgur.com/gb3px.png
02:19 < krzee> i dont care what doing it wrong gives you
02:19 < rajkosto> so it is client, server
02:20 < krzee> your client should be .10 
02:20 < krzee> as my damn bot told you like 5 times now
02:20 < rajkosto> it is
02:20 < rajkosto> Each pair of ifconfig-push addresses represent the virtual client and server IP endpoints. 
02:20 < krzee> dude
02:20 < rajkosto> so it is client, server
02:20 < krzee> good luck
02:21 < krzee> im leaving
02:21 < rajkosto> i dont know what your problem is ?
02:21 < krzee> learn to listen or read
02:21 < rajkosto> I HAVE
02:21 < rajkosto> READ
02:21 < rajkosto> THAT IS ALL FROM THE DOCS
02:21 < krzee> obviously not the manual
02:21 < krzee> or the howto
02:21 < rajkosto> exactly from th howto
02:21 < krzee> [03:20]  <rajkosto> ifconfig-push 172.16.0.10 172.16.0.9 
02:21 < krzee> howto has this
02:21 < krzee> ccd/contractor2
02:21 < krzee> ifconfig-push 10.8.2.5 10.8.2.6
02:22 < krzee> why do you make it backwards
02:22 < rajkosto> yes, because they wanted the client ip to be .5
02:22 < rajkosto> and server to be .6
02:22 < krzee> NO
02:22 < krzee> THE CLIENT CANT BE .5
02:22 < krzee> from the faq entry i gave you:
02:22 < krzee> [03:16]  <krzee> As 192.168.1.5 is only a virtual IP address inside the OpenVPN server, used as an endpoint for routes, OpenVPN doesn't bother to answer pings on this address, while the 192.168.1.1 is a real IP address in the servers O/S, so it will reply to pings.
02:22 < krzee> [03:16]  <krzee> you still didnt even read the link
02:22 < krzee> [03:16]  <rajkosto> i did
02:23 < krzee> and
02:23 < krzee> !spoonfeeding
02:23 <@vpnHelper> "spoonfeeding" is http://www.mp3car.com/the-faq-emporium/53368-faq-what-is-spoon-feeding.html
02:23 < krzee> i know you wont read that, but it explains why im going away now
02:23 < rajkosto> have fun
02:23 < rajkosto> this is all valid
02:23 < rajkosto> you seem to have some wrong idea
02:24 < rajkosto> about the /30 mapping
02:24 < rajkosto> the example in http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html is when you use the AUTO dhcp thing
02:24 < rajkosto> you can reverse the client and server ips 
02:24 < rajkosto> it doesnt matter
02:25 < rajkosto> because all it cares is that the highest address is the broadcast address
02:25 < rajkosto> and the first address to be the network addresss
02:25 < rajkosto> and ifconfig-push sytnax is clientip thn serverip
02:25 < rajkosto> so NOTHING I HAVE SAID IS WRONG
02:26 -!- cpf_ [~cpf@reehorst1.customer.bit.nl] has quit [Ping timeout: 250 seconds]
02:30 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
02:32 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:37 <@vpnHelper> RSS Update - forum: Able to connect tap, but unable to ping or access pls helppp <http://forums.openvpn.net/topic7824.html#p10819>
02:47 < hyper_ch> hi krzee
02:47 -!- elly_ [~elly@rath.leptoquark.net] has quit [Ping timeout: 248 seconds]
02:52 < krzee> hey hyper_ch 
02:52 < hyper_ch> krzee: did you see the pastebin I made yesterday?
02:52 < krzee> funny how people quote syntax while ignoring the manual's definition of its syntax? or sad?
02:52 < krzee> ya man, made a damn fine case for that hardware crypto accelerator
02:53 < hyper_ch> with crypto it was slightly slower writing 10GB with 0s than without crypto
02:53 -!- dazol [~dazo@nat/redhat/x-gsuyfdiwtsaqiujg] has quit [Changing host]
02:53 -!- dazol [~dazo@openvpn/community/developer/dazo] has joined #openvpn
02:53 < krzee> you still have it?  maybe you could toss something on the SCN wiki
02:53 -!- dazol is now known as dazo
02:53 < hyper_ch> and aes-ni should also help for everything else using aes
02:53 < krzee> unless you plan on making a writeup elsewhere
02:53 < hyper_ch> krzee: yeah, gonna make a blog post on my blog (it's in german but you can put it into that scn wiki)
02:54 < krzee> cool
02:54 < krzee> !wiki
02:54 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
02:54 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
02:54 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
02:54 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
02:54 < krzee> hey jjk
02:54 < janjust> Yo krzee
02:54 < krzee> hows it goin
02:55 < janjust> pretty good, how're yourself?
02:55 < hyper_ch> krzee: I'l also get computer specs in a moment
02:55 < janjust> krzee, be aware that I'm chasing after your 535 posts on the forums site ;-)
02:55 < hyper_ch> krzee: you want me some more tests to do?
02:55 < krzee> good, just gave up on process substitution in bash for good, it creates more problems than it solves
02:56 < hyper_ch> but substitution in bash works
02:56 < krzee> hyper_ch, i think theres some sort of test for encryption ciphers, forget if its openssl or openvpn tho
02:56 < hyper_ch> there's a nice little page with a lot of info
02:56 < janjust> you can run either 'openssl speed' or 'openvpn --test-crypto' to test ciphers
02:56 < janjust> use 'openssl speed' to test the AESNI speed 
02:56 < krzee> janjust, yep, you even beat me to a couple i saw from the bot and went to answer, lol
02:57 < hyper_ch> I guess I'll just do that then also
02:57 < krzee> i love it!
02:57 < hyper_ch> obviously this only makes a difference between AES and AES-NI
02:57 < krzee> hyper_ch, awesome
02:57 < janjust> hyper_ch:  buy my book and you can read up on the openssl (and thus openvpn) performance  diffs between an AES-NI capable CPU and a non-AES-NI capable one :)
02:58 < krzee> janjust, he tested encrypted FS vs encrypted with aes-ni vs unencrypted
02:58 < hyper_ch> janjust: can I find a .torrent ?
02:58 < krzee> the aes-ni accel was almost as fast as unencrypted
02:58 < janjust> hyper_ch:  you're kidding , right
02:58 < janjust> sweet!
02:58 < hyper_ch> janjust: you know how heave books are?
02:58 < hyper_ch> janjust: krzee   http://pastebin.com/QSMSBP5Y
02:58 < janjust> then buy the e-book , hyper_ch 
02:58 < krzee> hyper_ch, amazon sells ebooks i believe
02:58 < krzee> :-p
02:58 < krzee> !book
02:58 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
02:59 < krzee> its a tech publisher, of course they do ebooks!
02:59 < krzee> i read it, its badass
02:59 < janjust> and asking somebody who spent 6 months writing a book where you can find an (illegal) torrent is NOT a smart thing to do, IMHO
02:59 < krzee> hahaha
03:00 -!- EugeneKay is now known as EugeneKaway
03:00 < krzee> yep
03:00 -!- DigitallyStoned [~blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
03:00 < janjust> encrypted fs with aes-ni? what FS type? most likely this is on *BSD ,right?
03:01 < hyper_ch> janjust: it took longer to write my master thesis
03:01 < hyper_ch> janjust: had a look at the pastebin?
03:01 < hyper_ch> krzee: amazon is evil
03:02 < janjust> yep hyper_ch ; I'm just a bsd-n00b , so I don't know what 'cryptd' is
03:02 < hyper_ch> janjust: well, you need publicity to sell your book... so pirating it helps getting you publicity
03:02 < hyper_ch> janjust: ??? cryptd? 
03:02 < janjust> line 39 of your pastebin output, hyper_ch 
03:02 < krzee> oh i meant crtpto
03:02 < krzee> oh that
03:02 < krzee> janjust, nah hes a debian guy
03:03 < hyper_ch> janjust: ah :) well, it's just a kernel module ;)
03:03 < janjust> so what type of FS is this test run on? cryptofs?
03:05 -!- talin [~dag@fw.nteb.no] has joined #openvpn
03:05 < hyper_ch> ext4
03:06 < talin> hello. i have a silly question. a friend of mine can't "telnet host.com 3000" from work. since i have a freebsd server, i would like to help him (he's trying to connect to a MUD)
03:06 < talin> i set up an SSH-account for him, so he could tunnel to it... but it turns out that he's behind a proxy, so he can't even ping google.com from his computer
03:06 < talin> someone recommended that i set up openvpn over https for him
03:06 < hyper_ch> he can use the IP instead of the domain name
03:06 < krzee> a MUD!?
03:06 < talin> do you think that would be possible?
03:06 < talin> krzee: hehe, yeah
03:06 < krzee> 1992 called, they want their games back
03:07 < krzee> ;]
03:07 < talin> krzee: haha
03:07 < hyper_ch> poking holes into the work's place firewall?
03:07 < hyper_ch> janjust: so what is your book called and does it come with pretty pictures?
03:07 < talin> hyper_ch: just trying to play a MUD, in an innocent fashion
03:07 < janjust> !book
03:07 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
03:07 < janjust> check the link, hyper_ch , it even comes with a sample chapter
03:08 < janjust> talin:  if he can't connect using SSH then why would HTTPS work? also, try running SSH on port 443 on your PC first to see if he can connect to that
03:08 < janjust> it does not sound like he needs a VPN
03:08 < talin> janjust: i tried, and it doesn't work
03:08 < talin> janjust: he can connect to https: webpages
03:08 < krzee> does he need to connect over a proxy?
03:08 < talin> krzee: yes
03:08 < krzee> it may or may not work
03:09 < krzee> depends on the settings on the proxy
03:09 < janjust> talin:  he can connect to a https webpage but not to an SSH daemon running on port 443? 
03:09 < talin> janjust: yes
03:09 < talin> janjust: he connects through a proxy
03:09 < krzee> janjust, would need to ssh over proxy
03:09 < krzee> actually, you CAN ssh over a proxy
03:09 < krzee> heh
03:09 < janjust> SSH over a HTTP/HTTPS proxy works 
03:09 < janjust> PuTTY even supports it 
03:09 < talin> huh? well, i hosted my SSH server on port 443
03:09 < krzee> hah i didnt know that
03:10 < krzee> my ssh client is 'ssh'
03:10 < krzee> hehe
03:10 < janjust> krzee:  you're a winblows-n00b
03:10 < hyper_ch> janjust: and your book is better than Dirk Becker's OpenVPN book?
03:10 < krzee> nah i ran active directory networks for a long time
03:10 < talin> he has found one way of doing it... and that is by using a service called yourfreedom and sockscap
03:10 < |Mike|> *banhammer*
03:10 < krzee> but i stopped windows 7 yrs ago
03:10 < krzee> |Mike|, tourrets mike?
03:10 < talin> this "yourfreedom" thing, sets up a web proxy and a SOCKS proxy on his computer, and then runs the traffic through "yourfreedoms" servers
03:11 < janjust> hyper_ch:  I've never read Dirk Becker's book; my book is not an introductory book but more a hands-on thing
03:11 < talin> but you have to pay  a lot to use it more than 1 hour per week or something
03:11 < |Mike|> krzee: just sometimes, goddamned :-p
03:11 -!- DigitallyStoned [~blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit [Ping timeout: 250 seconds]
03:11 < janjust> talin:  if he can connect to HTTPS or SOCKS proxies then he can connect to *anything* 
03:11 < janjust> hyper_ch:  how do you do encryption on an ext4 FS?
03:11 < krzee> ohhh good point
03:12 < krzee> just proxy chain to a proxy that you control
03:12 < hyper_ch> janjust: dm-crypt to create the encrypted partition and using ext4 underneath
03:12 < krzee> then it would be less likely to block maybe?
03:12 < janjust> aah ok , hyper_ch 
03:12 < janjust> krzee: my motto always is: if I can reach one host on one TCP or UDP port then I am home free :)
03:12 < hyper_ch> janjust: are there other ways?
03:12 < krzee> =]
03:13 < |Mike|> Haha :)
03:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:13 < janjust> make that TCP/UDP/DNS/ICMP/SCTP port ;-)
03:13 < krzee> janjust, its possible to detect openvpn encryption tho
03:13 < |Mike|> dutchie beeing mangled :-p
03:13 < janjust> yep krzee, stunnel to the rescue
03:13 < krzee> haha nice
03:13 < krzee> tunneling more than a gopher ;]
03:13 < janjust> hyper_ch:  you can also create a 'cryptofs' filesystem
03:14 < janjust> or was it 'cryptfs' :/ ?
03:14 < hyper_ch> that sounds complicated
03:14 < hyper_ch> luks / dm-crypt is quite easy /me thinks
03:14 < hyper_ch> is there luks on BSD?
03:14 < talin> janjust: i'm not sure that he can connect so easily (ssh to port 443 didn't work). he can't even ping my host, so everything must occur through the proxy... i think he can only request things from the proxy. this yourfreedom setup, creates a sock proxy and web proxy on his computer. then these proxies somehow set up some "tunnel" or "channel" or something directly to their servers... such that he can communicate through them
03:16 < hyper_ch> janjust: lol, about the author I just mistakenly read:   janjust is an open source professor from Utrecht
03:16 < janjust> talin: if he can connect to a HTTPS web server (or HTTP) then you'd only need a webserver running mod_proxy ; you can then using the SSH 'connect' plugin to connect via that webserver
03:16 <@vpnHelper> RSS Update - forum: openvpn 2.2RC(now is 2.2RC2) can't run as server ? <http://forums.openvpn.net/topic7751.html#p10820>
03:16 < krzee> freebsd would use gdbe
03:16 < krzee> not luks
03:16 < krzee> http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/disks-encrypting.html
03:16 <@vpnHelper> Title: Encrypting Disk Partitions (at www.freebsd.org)
03:18 < krzee> AND
03:18 < |Mike|> janjust: ah, i just notice that you've written openvpn 2 cookbook, cool :)
03:18 < krzee> gbde(8) encrypts the sector payload using 128-bit AES in CBC mode.
03:18 < janjust> yep |Mike| , and I just noticed that you're a dutchie as well
03:19 < |Mike|> *g*
03:19 < krzee> |Mike|, if you read that book and follow the recipes, you will know openvpn better than me
03:19 < hyper_ch> krzee: IMPOSSIBLE
03:19 < krzee> some of them tripped me out
03:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:19 < krzee> like NO ip setups
03:19 < janjust> hehe krzee, that's a sweet setup, isn't it
03:20 < krzee> some ninja shit in there
03:20 < janjust> does it work on BSD too?
03:20 < krzee> didnt test it... i should
03:20 < |Mike|> krzee: no time for that and I don't want to hit you off your throne :-p
03:20 < krzee> hahah
03:21 < janjust> hehe |Mike| , well spoken
03:21 < hyper_ch> janjust: any more tests that I should employ for the aes / aes-ni comparison?
03:21 < hyper_ch> (the aes-ni notebook will be in my hands until thursday)
03:21 < krzee> hyper_ch, throw in freebsd gdbe?
03:21 < hyper_ch> if I knew how :)
03:22 < janjust> ah , my new laptop's got aes-ni so I'm in no hurry here
03:22 < krzee> its a walkthrough of a manual
03:22 < hyper_ch> janjust: :) what laptop did you get?
03:22 < krzee> http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/disks-encrypting.html
03:22 <@vpnHelper> Title: Encrypting Disk Partitions (at www.freebsd.org)
03:22 < hyper_ch> I tried to run freebsd once and failed miserably
03:22 < janjust> the only thing I can think of is a network performance test (using either socat or openvpn)
03:22 < krzee> it literally gives every command
03:22 < hyper_ch> I returned back to the safe havens of Linux
03:22 < krzee> dont install a gui
03:22 < janjust> I've got a dell latitude e4310 , hyper_ch  
03:23 < hyper_ch> :)
03:23 < janjust> it has good sides (nice cpu, nice disk) and bad sides (keyboard and touchpad suck)
03:23 < krzee> MacBookPro6,1 CPU: Intel Core i7 M 620 2.67GHz @ 2.66GHz [/FPU/MMX/SSE/SSE2/SSE3/S.SSE3/SSE4.1/SSE4.2/x86_64/PAE/XD/EM64T/VMX/EST] L2: 512K FSB: 4800MHz Airport:  (802.11 a/b/g/n)  RAM: 3.5GB/8.0GB Vram: 0.00M/64.00M Disk: 327.03GB/465.44GB GPU: Intel HD Graphics [288 MB/Stock] 1920x1200 OS: Mac OS X 10.6.6 (10J567) Kernel: Darwin 10.6.0 Up: 5 days 16 mins
03:23 < |Mike|>  /set hide_colors 
03:23 < krzee> that had colors?
03:23 < hyper_ch> janjust: I have here a HP ProBook 6550b
03:23 < |Mike|> Just 2 :-)
03:23 < krzee> i have colors hidden too
03:24 < janjust> ah sweet krzee , it's just that I refuse to buy stuff from Comrade #1 Steve Jobs
03:24 < hyper_ch> well, the one I have to give away it is
03:24 < hyper_ch> haven't touched the battery yet - besides that it seems quite fine
03:24 < krzee> i got him back with my hackintosh desktops ;)
03:24 < janjust> hehe krzee 
03:25 < krzee> hyper_ch, jjk brings a good point, how bout some openvpn tests!
03:25 < hyper_ch> krzee: sure - how?
03:25 < krzee> if openssl uses the card, openvpn does
03:25 < hyper_ch> am re-installing the fully encrypted system again
03:25 < hyper_ch> and need to recompile kernel without aes-ni
03:26 < janjust> hmmm for a *real* comparison test you'd need two machines with aes-ni support (client+server)
03:26 < hyper_ch> janjust: you have aes-ni on your notebook :)
03:26 -!- stringent___ [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has joined #openvpn
03:26 < janjust> hehe , true, hyper_ch 
03:27 < krzee> haha
03:27 < hyper_ch> but why do you need two machines with aes-ni support?
03:27 < hyper_ch> and they should be connected with gbit ethernet?
03:27 < janjust> in an openvpn perf test you're testing encryption on one side and decryption on the other
03:28 < janjust> if either end does not support aes-ni it would/could skew the results
03:28 < janjust> and yes, gige would be helpful as well (as it's already possible to max out a 100mbps link without aes-ni)
03:28 < hyper_ch> so, just send me your notebook and I'll test it ;)
03:28 < krzee> lol
03:28 < hyper_ch> I promise to return it ;)
03:29 < janjust> and this from the guy who asked me where to find a torrent :/ ?
03:29 -!- stringent [~imac_alph@218.42.150.50] has quit [Ping timeout: 246 seconds]
03:29 -!- stringent___ is now known as stringent
03:29 -!- EugeneKaway is now known as EugeneKay
03:29 < janjust> if I can find the time I'll test it myself - plenty of hardware here to play with :)
03:30 < hyper_ch> the more popular something is, the more easily you can find torrents and the more downloaders it has.... so if you can't find any torrent of your book, you should be concerned
03:30  * hyper_ch hides
03:30 < janjust> hehe hyper_ch , I checked: there are already multiple torrents to be found on usenet , filestream etc
03:30 < hyper_ch> :)
03:31 < hyper_ch> I assume your ebook doesn't come with an digital restrictions management?
03:31 < janjust> dunno hyper_ch , I haven't seen the ebook version yet
03:31 < hyper_ch> :)
03:32 < janjust> but I'm not aware of any DRM crap being added by Packt Publishing
03:32 < hyper_ch> never heard of Packt Publishing before
03:32 < krzee> over 8000 "GET" requests for openvpn-2.2-RC2* since late friday, and the book is great, so ild say it should be popular
03:32 < janjust> 8000 for 2.2RC2? sweet!
03:32 < hyper_ch> is that many requests?
03:33 < rajkosto> over 9000 ?
03:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:33 < talin> janjust: hmm, remember he needs to telnet. or are you saying he could use it to connect to a shell and then telnet from there?
03:33 < Bushmills> janjust: just checked - it is not in a tech ebook collection i happened to grab some time back
03:34 < hyper_ch> btw, krzee, you know what this doesn't work:   dd if=/dev/zero of=z.img bs=1M count=10000 >> output.txt  ---> it will output to the command line but not append to the output.txt
03:34 < Bushmills> though Feilner - OpenVPN - Building and Integrating VPNs is.
03:35 < Bushmills> hyper_ch: output goes to stderr
03:35 < janjust> hyper_ch:  isn't that what 'of=z.img' does?  or are you talking about the output of the 'dd' command itself?
03:35 < Bushmills> try ... 2>&1 >> foo
03:35 < hyper_ch> the output of the dd command itself
03:36 < janjust> Bushmills:  tech ebook collection? AFAIK you can buy the book and ebook from packt and amazon
03:36 < hyper_ch> Bushmills: will do so
03:36 <@vpnHelper> RSS Update - forum: openvpn 2.2RC(now is 2.2RC2) can't run as server ? <http://forums.openvpn.net/topic7751.html#p10821>
03:37 < krzee> Bushmills, the book is very new
03:37 -!- cpf_ [~cpf@130-16-145-178.mobileinternet.proximus.be] has joined #openvpn
03:37 < Bushmills> janjust: when looking for a specific book, i'd probably purchase it. those collections can come in handy when you're not knowing that you may eventually need a specific book  
03:38 < talin> janjust: i'm not sure where the SSH connect plugin comes in? is that something that the user needs to install
03:38 < krzee> talin, connect to ssh over the proxy
03:38 < krzee> putty for windows supports it
03:39 < krzee> hyper_ch, because your arent seeing stdout
03:39 < krzee> try 2> output.txt
03:39 < krzee> oh damn
03:39 < krzee> bush beat me
03:39 < hyper_ch> bushmills was faster :)
03:39 -!- rajkosto [rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has quit [Ping timeout: 240 seconds]
03:39 < krzee> by a longshot
03:40 < Bushmills> oh,  ... 2>> foo   works too
03:40 < talin> krzee: okay, thanks. i'll give it a try
03:42 < janjust> talin: putty works, as krzee says and otherwise it depends a bit on your client OS
03:43 < Bushmills> hyper_ch: 2>&1 >> foo  was wrong.   >> foo  2>&1   would do,    or 2>>
03:43 < hyper_ch> Bushmills: thx
03:43 -!- rajkosto [rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has joined #openvpn
03:43 < krzee> janjust, actually its still as you said, i was just copying ya =]
03:43 < talin> janjust: okay. thanks a lot, i'll give it a try
03:44 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
03:44 < Bushmills> i think today i'll be hacking a fridge, and eventually install openvpn on it.
03:44 < talin> Bushmills: do you and the fridge have anything private going on?
03:45 < janjust> hehe, do you want to bridge that fridge, Bushmills 
03:45 < Bushmills> actually, no.  p2p would even do.
03:45 < Bushmills> but i think it's going to be a client
03:48 -!- rajkosto [rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has quit [Ping timeout: 276 seconds]
03:50 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
03:50 -!- rajkosto [~rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has joined #openvpn
03:51 < krzee> ipv6 i assume
03:51 < krzee> gotta leave room for the toaster
03:53 < krzee> bushmills is going to have a kegerator running openvpn that he can control to send beer through his tube!
03:53 -!- stringent [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has quit [Ping timeout: 264 seconds]
03:53 -!- EugeneKay is now known as EugeneKaway
03:53 < Bushmills> would actually make sense, for temperature monitoring
03:53  * janjust wonders if you can store more data on disk if you freeze it first
03:53 -!- stringent_ [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has joined #openvpn
03:54 < Bushmills> nobody but the english like luke warm beer anyway
03:54 < krzee> higher density?
03:54 < krzee> hehe
03:54 < janjust> yep krzee, most things tend to shrink when they get cold (try walking into a cold sea and watch your private parts shrivel up :P)
03:54 -!- elly [~elly@atheme/member/elly] has joined #openvpn
03:55 < krzee> im from west coast usa, i know about cold water
03:55 < krzee> (orig)
03:56 < janjust> west coast and cold water? have you ever been to maine (I have) ?
03:56 < krzee> ive also been to florida
03:56 < krzee> hehe
03:56 < krzee> but good point
03:56 -!- stringent__ [~imac_alph@218.42.150.50] has joined #openvpn
03:56 < janjust> hehe, true, florida doesn't count
03:57 < krzee> jump in at san francisco and tell me its warm
03:58 < krzee> after you find your privates
03:58 < krzee> heheh
03:58 < hyper_ch> I can't get that openvpn test to run
03:59 < hyper_ch> http://pastebin.com/FP0QK9dF
04:00 -!- stringent_ [~imac_alph@i60-36-160-30.s30.a048.ap.plala.or.jp] has quit [Ping timeout: 240 seconds]
04:00 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
04:00 < krzee> using a csr as a secret file?
04:01 < hyper_ch> I tried them all
04:01 < hyper_ch> crt key and csr
04:01 < krzee> secret is looking for a tls-auth style file normally
04:01 < hyper_ch> what file?
04:01 < krzee> what static key users uses
04:01 < krzee> use*
04:01 < krzee> a static key =]
04:01 < hyper_ch> openvpn --test-crypto
04:02 < hyper_ch> Options error: You must define key file (--secret)
04:02 < krzee> !hmac
04:02 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
04:02 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
04:02 < krzee> openvpn --genkey --secret ta.key
04:02 < krzee> there ya goes
04:03 < hyper_ch> ah :)
04:03 < rajkosto> changing the 1st client from 1/2 to 5/6 did nothing it behaves the same
04:03 <@vpnHelper> RSS Update - forum: openvpn 2.2RC(now is 2.2RC2) can't run as server ? <http://forums.openvpn.net/topic7751.html#p10822>
04:04 < krzee> rajkosto, your windows client is already .6, lol
04:04 < rajkosto> i upped him
04:04 < rajkosto> upped them all
04:04 < rajkosto> last one is 13/14 now
04:04 < krzee> ok you're in luck, theres others here now
04:04 < krzee> i gave up on ya ;]
04:04 < rajkosto> the non windows client still loses dns after a few minutes
04:04 < hyper_ch> doe 2.2 server work with 2.1 clients?
04:04 < krzee> hyper_ch, yep
04:05 < rajkosto> krzee, again i dont know why you gave up, everything i was doing other than using 1/2 for 1st client was ok
04:05 < rajkosto> and even that didnt make any difference
04:05 < krzee> you wouldnt read any links, or even what the bot said
04:05 < rajkosto> i read the links and what the bot said
04:05 < rajkosto> it was all valid
04:05 < rajkosto> i just didnt know what you were saying
04:06 < rajkosto> and what the problem you had with my config
04:07 < krzee> hyper_ch, the openvpn test maybe would look good on the openvpn wiki
04:07 < krzee> !wiki
04:07 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
04:07 < krzee> in misc
04:07 < krzee> your forum account is valid for that
04:12 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
04:13 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
04:15 -!- Guest97525 is now known as stony
04:15 <@vpnHelper> RSS Update - forum: openvpn 2.2RC(now is 2.2RC2) can't run as server ? <http://forums.openvpn.net/topic7751.html#p10823>
04:19 -!- chrispercol [5d61f643@gateway/web/freenode/ip.93.97.246.67] has joined #openvpn
04:22 <@vpnHelper> RSS Update - forum: Qos over Open VPN <http://forums.openvpn.net/topic7862.html>
04:27 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
04:28 -!- cpf_ [~cpf@130-16-145-178.mobileinternet.proximus.be] has quit [Ping timeout: 240 seconds]
04:33 -!- chrispercol [5d61f643@gateway/web/freenode/ip.93.97.246.67] has left #openvpn []
04:34 -!- Rajko [rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has joined #openvpn
04:35 -!- rajkosto [~rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has quit [Ping timeout: 260 seconds]
04:46 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
04:46 -!- cpf_ [~cpf@reehorst2.customer.bit.nl] has joined #openvpn
04:47 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:47 -!- Rajko [rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
04:48 -!- rajkosto [~rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has joined #openvpn
04:48 -!- Rajko [bitrot@cable-94-189-152-250.dynamic.sbb.rs] has joined #openvpn
04:52 -!- rajkosto [~rajkosto@cable-94-189-144-205.dynamic.sbb.rs] has quit [Ping timeout: 264 seconds]
04:56 <@vpnHelper> RSS Update - forum: This is how I am trying to set it up ... <http://forums.openvpn.net/topic7863.html>
04:57 < Rajko> hmm, even on the winxp client some things are weird
04:57 < Rajko> http://www.pingtest.net/result/37819200.png
04:57 < Rajko> packet loss 97%
04:58 < Rajko> sometimes pages dont load i have to refresh them
04:58 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
04:58 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
05:00 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
05:01 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
05:08 <@vpnHelper> RSS Update - forum: Qos over Open VPN <http://forums.openvpn.net/topic7862.html#p10828> || openvpn 2.2RC(now is 2.2RC2) can't run as server ? <http://forums.openvpn.net/topic7751.html#p10827> || build openvpn <http://forums.openvpn.net/topic7854.html#p10826>
05:09 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:09 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:14 < helge-> hm I have a potential problem: I'm setting up a rather large openvpn system which will be accessed by users who authenticate with smart cards. Common name for users are their realnames, i.e. mine is HELGE_MIKAEL_OLSEN
05:14 -!- _Meliorator is now known as Meliorator
05:14 < helge-> how do I make different ccd files for different instances of HELGE_MIKAEL_OLSEN? :)
05:18 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:19 < janjust> helge-:  you can't
05:20 < janjust> how are users with the same common name distinguished?
05:20 -!- stringent__ [~imac_alph@218.42.150.50] has quit [Quit: can't rollerskate in a buffalo herd]
05:20 < janjust> based on IP address? full certificate DN?
05:20 < helge-> my auth script handles the auth part. CN+serial
05:21 < janjust> then use a 'client-connect' script to write out a customer specific config
05:21 < helge-> good idea
05:21 < janjust> inside the 'client-connect' script you know both the CN and the serial; everything written to "$1" is included as a config file by the server
05:23 < helge-> thanks for the suggestion :)
05:24  * helge- goes back top scriptint
05:24 < helge-> lol nice typing on my part
05:29 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
05:29 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
05:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
06:00 <@vpnHelper> RSS Update - forum: tap driver install failed! Please help! <http://forums.openvpn.net/topic7864.html> || This is how I am trying to set it up ... <http://forums.openvpn.net/topic7863.html#p10829>
06:03 -!- Rajko [bitrot@cable-94-189-152-250.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
06:03 -!- Rajko [bitrot@cable-94-189-152-250.dynamic.sbb.rs] has joined #openvpn
06:07 -!- Rajko [bitrot@cable-94-189-152-250.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
06:07 -!- rajkosto [bitrot@cable-94-189-152-250.dynamic.sbb.rs] has joined #openvpn
06:09 -!- Rajko [~rajkosto@cable-94-189-152-250.dynamic.sbb.rs] has joined #openvpn
06:09 -!- talin [~dag@fw.nteb.no] has left #openvpn []
06:09 -!- rajkosto [bitrot@cable-94-189-152-250.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
06:09 < Rajko> krzee, the howto is actually wrong
06:10 < Rajko> if i do it like it says (ifconfig-push 10.8.2.5 10.8.2.6
06:10 < Rajko> , aka lower ip then higher ip), the client gets the lower ip, which is supposed to be used for the serverside virtual ip
06:11 < Rajko> i cant even ping the server ip (172.16.0.1)
06:12 < Rajko> and nothing works
06:12 < Rajko> so might want someone to check that
06:14 -!- Rajko [~rajkosto@cable-94-189-152-250.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
06:15 -!- Rajko [bitrot@cable-94-189-152-250.dynamic.sbb.rs] has joined #openvpn
06:25 < wookienz> im trying to create a VPN server, the local lan subnet is 2.x. I have the server.conf dishing out 1.x subnets. I can get a ip address from the vpn server, but i cant route anything. i have ip_forwarding set on the vpn server, i have a route for the client to the different subnet behind the vpn subnet - but i cant ping a thing. ideas.
06:27 < Bushmills> can you ping the server?
06:28 < Bushmills> (from client)
06:36 < wookienz> no
06:38 < Rajko> any clue why since friday, openvpn started randomly dropping most of dns packets ?
06:39 < Rajko> i dont even have a firewall anymore (removed everything but the basics needed for openvpn)
06:39 < Rajko> still doing it
06:39 < Rajko> and other general weirdness
06:41 < Bushmills> wookienz: !firewall or !notconnected or !noroute
06:42 < Bushmills> Rajko: well, that "friday" is very suspicious.
06:42 < Rajko> i didnt touch anything on the server
06:42 < Bushmills> i'd reckon, something happened on that friday
06:43 < Rajko> and im now testing with winxp clients
06:43 < Rajko> to leave out openwrt configs
06:43 < Rajko> nothing happened on friday
06:43 < Rajko> im the only one with ssh access to server etc
06:43 < Bushmills> what, exactly, gets dropped?
06:43 < Rajko> port 53
06:43 < Rajko> no clue why
06:43 < Rajko> dns
06:43 < Bushmills> requests? replies?
06:43 < Rajko> how do i find that out ?
06:44 < Bushmills> tshark. tcpdump.
06:44 < Rajko> on the server ?
06:44 < Bushmills> both. unless checking on server gives the answer already
06:45 < Rajko> also, running pingtest.net on the winxp client now gives me 96% packet loss
06:45 < Bushmills> if openvpn server != name server,  on name server, openvpn server and openvpn client
06:45 < Rajko> dns is opendns
06:45 < Rajko> but it doesnt matter
06:46 < Rajko> even things like dig @4.2.2.2 somedomain.com timeout
06:46 < Rajko> replace @4.2.2.2 with any dns ip
06:47 < Rajko> and this is weird http://www.pingtest.net/result/37822616.png
06:47 < Bushmills> that might be a manifestation of exactly the same problem which you described above
06:47 < Rajko> it only happens on pingtest
06:47 < Rajko> i dont get it if i do ping something.com -t
06:48 < Rajko> (if something.com actually resolves)
06:48 < wookienz> !firewall
06:48 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
06:49 < wookienz> !noroute
06:49 < wookienz> !notocnnected
06:51 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
06:51 <@vpnHelper> RSS Update - forum: This is how I am trying to set it up ... <http://forums.openvpn.net/topic7863.html#p10831>
06:54 < Rajko> http://codepad.org/zhHdipX9 minimalistic forwarding and nat rules cant see where they can fail
06:54 <@vpnHelper> Title: Plain Text code - 36 lines - codepad (at codepad.org)
07:00 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
07:01 -!- wookienz [~chatzilla@220.232.248.214] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 3.6.16/20110323143040]]
07:13 < Rajko> WHAT IS UP WITH THE DNS
07:14 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
07:14 < hyper_ch> Rajko: it's in our bodies
07:14 < Rajko> its JUST dns thats being dropped
07:14 < Rajko> and i have no clue why
07:21 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
07:22 < Bushmills> how's tcpdumping or tsharking going?
07:22 <@vpnHelper> RSS Update - forum: This is how I am trying to set it up ... <http://forums.openvpn.net/topic7863.html#p10832>
07:27 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
07:35 < Rajko> how would that tell me anything
07:37 < Rajko> ive no clue what im lookin for
07:40 < Rajko> ok ive set up the exact same openvpn setup on another server on another isp
07:40 < Rajko> no problems
07:46 < Rajko> so must me some problem with the openvz
07:49 -!- bitrot [rajkosto@cable-94-189-156-187.dynamic.sbb.rs] has joined #openvpn
07:50 < ecrist> !openvz
07:50 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
07:51 -!- orkaa_ [~nace@193.2.66.85] has joined #openvpn
07:53 -!- Rajko [bitrot@cable-94-189-152-250.dynamic.sbb.rs] has quit [Ping timeout: 248 seconds]
07:56 -!- bitrot [rajkosto@cable-94-189-156-187.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
07:58 -!- rajkosto [bitrot@cable-94-189-156-187.dynamic.sbb.rs] has joined #openvpn
08:06 < rajkosto> again, it worked perfectly, the vps provider must have changed something on friday
08:07 < cwesterfield> I'm very close to getting my setup how i want it, just need a bit of direction. Anyone help?
08:09 < ecrist> if you ask a question, someone here will help answer it
08:11 < cwesterfield> I'm trying to setup a tunnel for my phone and work computer. On my mac, I can see the home network but dns (or something) is broken, I can't get to any webpages
08:12 < cwesterfield> http://pastie.org/1728256
08:12  * ecrist points to /topic
08:13 < cwesterfield> I've looked through all the settings i can find on the howto, faq, and google
08:13 < cwesterfield> I've created tcp setups, differnt ports, stuff that doesn't even make sense, I think the config is correct
08:13 < cwesterfield> possible that my home connection is too slow
08:15 -!- luneff [~yury@84.51.195.188] has joined #openvpn
08:18 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
08:19 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
08:24 < cwesterfield> it may be silly to ask, but is there a vpn solution out there that is more simple?
08:24 < orkaa_> there is, hamachi
08:24 < ecrist> there are all sorts of for-pay services
08:24 < cwesterfield> for my phone to work , I need one of the more popular
08:24 < ecrist> openvpn simply requires you know how a network works
08:25 < ecrist> cwesterfield: proxPN supports phones and computers
08:25 < ecrist> and actually uses openvpn, to a degree, on the back end.
08:25 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
08:26 < cwesterfield> hmmm
08:26 < cwesterfield> are the forums more likely to result in a responce for my setup?
08:27 < ecrist> you can try there, or here
08:27 < ecrist> to be honest, most of the people who answer forum posts are residents of this channel
08:28 < cwesterfield> well I've tried here twice with no luck, so before I totally give up I want to exhaust all possible venues
08:28 < ecrist> well, you may have more luck if you read /topic
08:30 < cwesterfield> I did the welcome I did the goal, I've turned off my firewalls, I tried multiple setups, I played with vpn helper (who just sends you to the page), and I've googled. What do you suggest before someone takes interest?
08:31 < cwesterfield> I'm completely okay with running through it all again, but I'm looking for someone to be the definitive guide that tells me where I've miscomprehended
08:33 < Bushmills> " but dns (or something) is broken,"  .. use a name server which allows public access
08:33 < Bushmills> or add a host route to the name server you're using, through former default gateway
08:34 < Bushmills> or install a recursive name server somewhere, maybe on openvpn server machine, use that one.
08:34 < cwesterfield> I shall google this nameserver business I was going to try google's (8.8.8.8)
08:35 < cwesterfield> or opendns
08:38 < cwesterfield> for testing, can I use the addresses actual IP address to make sure it's a dns problem? I just thought of this
08:39 < Bushmills> just ping a host by ip address and by host name
08:39 < cwesterfield> can do
08:39 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
08:39 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
08:40 < Bushmills> dig  is also helpful.   dig hostname  vs   dig @8.8.8.8 hostname
08:41 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 248 seconds]
08:43 < cwesterfield> using my router as the dns server for the config (the router points to googles dns) the dig comes back the same as when not connected
08:43 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
08:43 < cwesterfield> but it goes up from 57 msec to 97 msec
08:43 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
08:44 < crocket> Hi
08:44 < Bushmills> makes no sense "same as when not connected" and "57/97 ms"
08:44 <@vpnHelper> RSS Update - forum: The new windows GUI does not ask for PKCS11 PIN <http://forums.openvpn.net/topic7794.html#p10833>
08:44 < cwesterfield> sorry, the dig command
08:44 < crocket> If openvpn was run as a non-root user and openvpn quit, openvpn would leave stale routes.
08:45 < crocket> routes for subnets are deleted somehow, but routes for specific IP addresses are left over.
08:45 < crocket> How can I solve this problem?
08:45 < Bushmills> crocket: running as non-root, those routes shouldn't have been added in first place
08:45 < crocket> Bushmills, How do you suggest I deal with this?
08:46 < Bushmills> by determining the cause of the problem, and acting accordingly
08:46 < crocket> Running as root is dangerous.
08:46 < cwesterfield> Bushmills, this is the dig command both times, the second time is while connected http://pastie.org/1730982
08:46 < crocket> Bushmills, We already know the cause of the problem. it is run as non-root.
08:46 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:47 < crocket> Bushmills, Maybe I should add those routes with "up" script and delete those routes with "sudo" in "down" script.
08:47 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
08:47 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
08:47 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:48 < crocket> If I gave the permission to execute down script without password to the user as which openvpn runs, openvpn would clean up routes without a complaint.
08:48 < crocket> But I haven't done it so far since I believed OpenVPN had an innate mechanism to deal with this.
08:49 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
08:50 < genesis7> can someone give me sample server config under proto udp so I can study and follow? mine is somewhat not working.
08:50 < Bushmills> crocket: http://scarydevilmonastery.net/snap/1301406603739796919d.png  <- resolver of my router
08:50 < crocket> Bushmills, How do I interpret this?
08:51 < Bushmills> i think your router only runs a forwarder.  a dns proxy
08:51 < Bushmills> mine runs a caching recursive name server
08:52 < Bushmills> said differently, mine doesn't need to query another recursive name server, as it can query the authoritative servers
08:53 < cwesterfield> so should i just push dns through the config with push "dhcp-option DNS 208.67.222.222"
08:53 < cwesterfield> would that effectively stop the dns loop?
08:54 < Bushmills> with windows should that work, with unixoids you need to execute a --up script, and introduce the pushed name server to the operating system
08:54 < crocket> Bushmills, My linux router runs dnsmasq which acts as a DNS proxy and a simple DHCP server.
08:54 -!- genesis7 [~genesis7@amertospromotions.com] has left #openvpn []
08:55 < cwesterfield> when you say windows you mean client, correct?
08:55 < Bushmills> sorry, crocket, the link with dig time was meant for cwesterfield
08:55 < crocket> Bushmills, I have --up script to push the name server to dhcpcd on my system.
08:55 < crocket> Bushmills, And it works fine.
08:55 < Bushmills> i'm afraid i mixed you two up
08:55 < crocket> --down script takes that out.
08:56 -!- gladiatr_afk is now known as gladiatr
08:56 < Bushmills> cwesterfield: yes, client
08:57 < crocket> One needs to know how the system's dhcp clinet works to push DNS server.
08:57 < crocket> I know how it works.
08:57 -!- ptripath [~ptripath@61.8.134.90] has quit [Quit: Leaving]
08:57 < crocket> Bushmills, Do you think using --up and --down scripts to add and delete routes with "sudo" is not a cheap hack?
08:58 < crocket> Bushmills, And why does one need to assume that openvpn shouldn't add routes when run as non-root?
08:58 < Bushmills> well, it is a hack, but the hooks are made for purposes where you have to wrap some setup and teardown action around openvpn
08:59 < Bushmills> usually you'd let the operating system tear down the routes, added when an interface comes up
08:59 < Bushmills> "why shouldn't" ... because of lack of permissions
08:59 < crocket> Bushmills, Actually, according to "man openvpn", --route is just a convenient proxy for the route shell command, so it doesn't feel much as if it were a hack.
09:00 < Bushmills> non-root users can't usually modify the routing table
09:00 < crocket> Bushmills, When the down script executes "sudo /etc/openvpn/down.root" and the user as which openvpn runs can run it without password, it should work.
09:00 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
09:00 <@vpnHelper> RSS Update - forum: Open VPN GUI config files refresh issue <http://forums.openvpn.net/topic7865.html>
09:01 < Bushmills> nod
09:01 < crocket> I can add "nobody ALL=(ALL) :NOPASSWD /etc/openvpn/down.root" to /etc/sudoers
09:01 < genesis7> can anyone spare me your few minutes. can I just ask a sample server config proto udp. mine is  not working
09:01 < crocket> Bushmills, Since /etc/openvpn/openvpn.conf has no subsitute for this, I may just do it.
09:01 < Bushmills> genesis7: there should be one coming with your installation
09:02 < crocket> But I hope someday openvpn would obtain a substitute for sudo.
09:02 < genesis7> I have none. if there is I dont know where. Im new to linux.
09:03 < Bushmills> crocket: how would the non-privileged user perform privileged tasks?
09:03 < crocket> Bushmills, with sudo.
09:03 < Bushmills> genesis7:  try  /usr/share/doc/openvpn/examples
09:03 < Bushmills> crocket:  "...would obtain a substitute for sudo."
09:03 < crocket> Bushmills, I am not sure
09:03 < genesis7> thanks. will check it out now.
09:03 -!- genesis7 [~genesis7@amertospromotions.com] has quit []
09:04 < crocket> Bushmills, But I hope openvpn would someday be able to delete routes.
09:04 < crocket> without root previlege.
09:04 < crocket> It has to clean up its own mess.
09:04 < Bushmills> if the operating system doesn't allow, openvpn can do very little about it
09:04 < crocket> meh~~~~
09:04 < crocket> However, openvpn deletes routes for subnets despite delete route errors.
09:05 < Bushmills> by delegation.  operating system does, when shutting the interface down
09:05 < crocket> Bushmills, Why does the OS fail to remove routes for specific IP addresses?
09:06 < Bushmills> because it doesn't know they are related to the interface
09:06 < crocket> You're right.
09:06 < crocket> The specific IP address wasn't tied to tun0.
09:06 < crocket> Those routes going through tun0 was destined to be deleted by operating systems.
09:07 < crocket> s/was/were/
09:08 < hyper_ch> Bushmills: when running openssl speed tests to see how the aes-ni cryptochip speeds up things, I don't need to test other algos but aes, right? hence I can limit it to:   openssl speed aes ?
09:09 < Bushmills> hyper_ch: compare against blowfish
09:09 < hyper_ch> why that?
09:10 < Bushmills> BF should have better performance than AES
09:11 < hyper_ch> but the aes-ni crypto chip will not make a difference for blowfish whether it is being used or not
09:11 < crocket> Bushmills, Thanks for clearing my head up.
09:11 < Bushmills> well, i thought you wanted to compare performance. than you probably want to compare against faster alternatives as well
09:12 < hyper_ch> Bushmills: no, I'd like to see how the crypto chip compares to default aes on given hardware
09:12 < Bushmills> ah. but you did that already
09:13 < Bushmills> "I don't need to test other algos but aes, right?"  then you answered your own question
09:13 < hyper_ch> :)
09:13 < hyper_ch> but aes-ni is faster than blowfish
09:14 < Bushmills> you could have told that aes-ni is faster than aes, without measuring
09:14 < Bushmills> but you were probably interested in knowing how much faster it was
09:14 < crocket> Bushmills, Are there ways to remove errors that happen if openvpn is run as non-root and tries to delete routes when it quits?
09:14 < crocket> It is just not neat.
09:15 < Bushmills> crocket:  rm /path/to/logfile
09:15 < crocket> Bushmills, That is a means to hide my eyes.
09:15 < crocket> Hiding my eyes doesn't remove those errors.
09:15 < crocket> Even destruction of tun0 generates errors.
09:16 < Bushmills> running from command line?     2> /path/to/errors.file
09:16 < crocket> No...
09:16 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
09:16 < crocket> You're still trying to hide my eyes.
09:16 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
09:16 < Bushmills> yes, that's a way too. close them
09:17 < crocket> Bushmills, I'm too obsessive and compulsive to hide them.
09:17 < genesis7> I have check the directory of example but the same in the man page
09:17 < Bushmills> then let them show
09:17 < crocket> Bushmills, Do you try to infer that it's not possible?
09:17 < Bushmills> what else is "don't show errors" than hiding them?
09:17 -!- genesis7 [~genesis7@amertospromotions.com] has quit [Client Quit]
09:18 < cwesterfield> I may have figured something out, is there any reason to have the bypass dhcp is my config?
09:18 < Bushmills> no, i don't intend to infer that it's not possible.  i don't know of a different way, other than editing source code - which is a distinct  possibility
09:18 < crocket> Bushmills, I don't like implications.
09:19 < crocket> Bushmills, Thanks, now that's much clearer.
09:19 < cwesterfield> push "redirect-gateway def1 bypass-dhcp"
09:19 < Bushmills> but that's still just "hiding"
09:19 < Bushmills> so you might just as well hide them in a simpler way
09:20 < crocket> Bushmills, I think openvpn should be modified not to try any previleged actions when its effective UID/GID is dropped.
09:20 < Bushmills> cwesterfield: the reason is that somebody added it
09:20 < crocket> Bushmills, It would fail anyway.
09:20 < crocket> I mean trying previleged actions as non-root would be futile anyway.
09:20 < cwesterfield> it was part on the sample config, but is it useful for my setup?
09:21 < crocket> Bushmills, I think that's the right solution.
09:21 < Bushmills> most likely - unless somebody has, for example, aliased the external commands to allow execution as non-privileged user
09:21 <@vpnHelper> RSS Update - forum: This is how I am trying to set it up ... <http://forums.openvpn.net/topic7863.html#p10835>
09:21 < crocket> Bushmills, how does one alias external commands to allow such?
09:22 < crocket> like "alias ip route="sudo ip route"?
09:22 < Bushmills> cwesterfield: depends. for continuing to use the old name server, that may make sense. for switching to another, it does make less so
09:22 < crocket> Bushmills, How about adding an option that disables trying any previleged actions when it's run as non-root?
09:23 < crocket> It's certainly a way.
09:23 < Bushmills> or  alias route=/usr/local/sbin/mysuidroute
09:23 < crocket> Bushmills, sudo is much better than suid.
09:23 < Bushmills> crocket: i'm the wrong person to talk to for adding options to openvpn
09:26 < crocket> Bushmills, With alias route=/usr/local/sbin/mysuidroute, any fool can run route as root.
09:26 < crocket> I guess.
09:26 < Bushmills> not necessarily.  depends on who has execute permissions of that file 
09:27 < Bushmills> you could give it group ownership openvpn, and set permissions to 750
09:27 < Bushmills> +s
09:27 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
09:27 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
09:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:28 < crocket> If its properties were owner=root, group=root, and filemode=1654, then would users only in root group be able to execute it?
09:28 < crocket> oops
09:28 < crocket> 1754 I mean.
09:29 < Bushmills> the 4 would be unnecessary. no reason to allow world to read the executable
09:29 < crocket> Bushmills, I think your way is simpler than sudo way.
09:29 < crocket> Although I don't know its security implication.
09:30 < crocket> Any fool in root group would be able to do it, then. haha
09:30 < Bushmills> yes, that's why you prompt on login "do you want to become member of group root) (Y/n)"
09:31 < crocket> But then there's another problem.
09:31 < Bushmills> "any fool who is root can execute route anyway"
09:31 <@vpnHelper> RSS Update - forum: Open VPN GUI config files refresh issue <http://forums.openvpn.net/topic7865.html#p10836>
09:32 < crocket> 1) What the owner group of a suid executable should be 2) what user and group openvpn should be run as
09:32 < crocket> If I specify --group=root, it is dangerous.
09:32 < Bushmills> i suggested  openvpn
09:33 < crocket> If I let the suid executable belong in nogroup group, it's dangerous, too.
09:33 < crocket> Bushmills, That's a good idea.
09:33 < crocket> Bushmills, Do you suggest I make openvpn user and openvpn group?
09:34 < Bushmills> i see nothing "good" about that ... just something "obvious"
09:34 < crocket> ???
09:34 < crocket> nothing agood about what?
09:34 < Bushmills> "That's a good idea."
09:34 < crocket> I meant you are a genius.
09:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
09:35 < Bushmills> then everybody who takes half an hour of time to read some manpages is.
09:35 < crocket> Bushmills, What do you exactly mean?
09:36 < cwesterfield> well i give in, openvpn tunneling is above my comprehension. Thanks for your help Bushmills
09:36 < crocket> cwesterfield, Don't give up!!!
09:36 < Bushmills> cwesterfield: running a recursor on openvpn server is not a problem at all
09:36 < Bushmills> i suggest to check out maradns
09:36 < crocket> recursor?
09:36 < Bushmills> recursive name server.  
09:37 < crocket> I suggest "BIND"
09:37 < crocket> You'll use BIND eventually anyway if you use name server long enough.
09:37 < Bushmills> for just recursing, way too heavy
09:37 < cwesterfield> Alright, I'll check it
09:37 < Bushmills> mem footprint of bind is about 10..20 times that of maradns
09:38 < crocket> Bushmills, When you want to register DNS names remotely, BIND is it.
09:38 < Bushmills> crocket: i'm using bind as authoritative servers
09:38 < crocket> Bushmills, How do you register DNS names remotely?
09:38 < Bushmills> nsadmin
09:38 < crocket> ???
09:39 < cwesterfield> my vpn server is my house windows box
09:39 < Bushmills> (updating zone files, i suppose, you mean)
09:39 < crocket> What is it?
09:39 < crocket> Bushmills, Do you mean nsupdate?
09:39 < Bushmills> ehm, yes. sure
09:39 < cwesterfield> so maradns seems to work on win, so I'll check it out
09:39 < crocket> I thought maradns wouldn't support nsupdate.
09:39 < crocket> cwesterfield, Why do you need a DNS server?
09:39 < crocket> cwesterfield, Do you want to give DNS names to OpenVPN clients?
09:40 < Bushmills> cwesterfield: you came across http://www.maradns.org/advocacy.html, i assume?
09:40 -!- cpf_ [~cpf@reehorst2.customer.bit.nl] has quit [Ping timeout: 264 seconds]
09:41 < Bushmills> you essentially want this:  http://www.maradns.org/tutorial/recursive.html#basic
09:41 <@vpnHelper> Title: Recursive DNS serving (at www.maradns.org)
09:42 < Bushmills> with acl allowing your vpn subnet
09:42 < crocket> Bushmills, Does maradns support nsupdate?
09:42 < Bushmills> no
09:42 < crocket> Bushmills, How do you register DNS names with maradns, then?
09:42 < Bushmills> you sed the zone files
09:43 < crocket> huh?
09:43 < crocket> Bushmills, Does maradns use zone files?
09:43 < Bushmills> add records as text operation
09:43 < Bushmills> yes
09:43 < crocket> Bushmills, Does --client-connect script on server side do that?
09:43 -!- d12fk [~heiko@vpn.astaro.de] has quit [Read error: Connection reset by peer]
09:43 < Bushmills> assuming you use it with a authoritative name server configuration
09:44 < crocket> But --client-connect has no information as to the IP addresses of OpenVPN clients.
09:44 -!- d12fk [~heiko@vpn.astaro.de] has joined #openvpn
09:44 < Bushmills> yes, it does
09:44 < crocket> --up scripts on clients however has that information.
09:44 < crocket> huh?
09:44 < Bushmills> check environment variables
09:45 < crocket> $ifconfig_remote passed to --client-connect script is the remote IP address of the server tun0 interface.
09:45 < crocket> That's why I abandoned it.
09:45 < Bushmills> $ifconfig_pool_remote_ip
09:46 -!- en0x [portman@forgottenlabs/admin/en0x] has joined #openvpn
09:46 < en0x> hi
09:46 < crocket> Bushmills, But that destroys my own reasons to learn about BIND.
09:47 < crocket> no
09:47 < en0x> i configured openvpn as but i get somehow auth failed
09:47 < en0x> http://wklej.org/hash/6b40847e432/ here is a log
09:47 <@vpnHelper> Title: Wklejka #502388 | Wklej.org (at wklej.org)
09:47 < crocket> I can keep using dnsmasq, then.
09:47 < crocket> Bushmills, Did you use dnsmasq?
09:47 < Bushmills> i still use it
09:48 < crocket> Bushmills, What do you use dnsmasq and maradns for? They have overlapping functionalities.
09:48 < Bushmills> dnsmasq is not a recursive name server. 
09:48 < Bushmills> maradns can be one
09:48 -!- orkaa_ [~nace@193.2.66.85] has quit [Quit: orkaa_]
09:49 < crocket> Bushmills, Do you have your own DNS domain registered by payment?
09:49 < Bushmills> dozens
09:49 -!- eth00 [~Johnrdp@unaffiliated/eth00] has quit [Excess Flood]
09:49 < crocket> Bushmills, Are you rich?
09:49 < gladiatr> lmao
09:49 < gladiatr> they aren't that expensive anymore
09:49 < Bushmills> not at all
09:49 -!- eth00 [~Johnrdp@colt.eth0.us] has joined #openvpn
09:49 < crocket> You wouldn't pay for dozens of domains with your money.
09:50 < crocket> A domain costs about 20~40 USD a year.
09:50 < Bushmills> i pay about 5$ per year
09:50 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
09:50 < crocket> dozens of them would cost hundreds of us dollars a year.
09:50 < crocket> Bushmills, I bought .com and .kr domains.
09:50 < gladiatr> $12
09:50 -!- orkaa [~nace@212.235.183.57] has joined #openvpn
09:51 -!- orkaa_ [~nace@193.2.66.85] has joined #openvpn
09:51 < gladiatr> for a .com
09:52 < cwesterfield> sorry, went for a coffee
09:52 < Bushmills> gotta hit the road. later.
09:53 < gladiatr> later bm
09:55 -!- orkaa [~nace@212.235.183.57] has quit [Ping timeout: 246 seconds]
09:55 -!- orkaa_ is now known as orkaa
09:55 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:56 -!- johnfg [johnfg@spirit.org] has joined #openvpn
09:57 -!- orkaa [~nace@193.2.66.85] has quit [Quit: orkaa]
09:58 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:00 < johnfg> hi guys
10:01 < johnfg> All's working great with debian and win xp pro and openvpn.
10:01 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:02 < johnfg> However, the ip's I get aren't static, but will go, usually to either 10.8.0.6, 10.8.0.10, or 10.8.0.14.  This is with two win machines.
10:02 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
10:02 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
10:02 <@vpnHelper> RSS Update - forum: Open VPN GUI config files refresh issue <http://forums.openvpn.net/topic7865.html#p10837>
10:02 < johnfg> So, is there a way that I can assign the win machines the ip I want them to have?  To make it easier with RDP and vnc?
10:02 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
10:02 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
10:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:02 < genesis7> Is there an option that will force the server to send signal or data to the client?
10:02 < cwesterfield> what does your ipp file look like?
10:03 < genesis7> ?
10:06 < johnfg> cwesterfield, Were you asking me if I have: "ifconfig-pool-persist ipp.txt"?
10:07 < johnfg> If so, I do have that line.
10:08 < johnfg> Not only would I like the same ip's, (but of course I can work around it) for what I mentioned above, but in addition for mapping drives from the win machines on debian.
10:09 < cwesterfield> in the folder your config is in, there should be an ipp.txt file
10:09 < johnfg> Yeah, there is, and it's empty.
10:09 < cwesterfield> let me copy mine
10:09 < johnfg> Ok, thanks!
10:10 -!- genesis7 [~genesis7@amertospromotions.com] has quit []
10:11 < cwesterfield> http://pastie.org/1731279
10:11 < cwesterfield> the names (Mac,Evo) are the names of the certs
10:11 < cwesterfield> mine were self generated by openvpn, but you could try adding your values
10:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Remote host closed the connection]
10:18 < johnfg> cwesterfield, Are you saying the names or the certs were self-generated?
10:18 -!- eth00 [~Johnrdp@colt.eth0.us] has quit [Remote host closed the connection]
10:18 < cwesterfield> the file and its contents
10:19 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
10:19 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
10:19 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:20 < johnfg> cwesterfield, That's only on the server, right?
10:20 < johnfg> How did you get yours autogenerated?
10:22 < johnfg> OK, I've got my ipp.txt written.  Will map drives and see after latest reconnect if all stays with my ips.
10:23 < cwesterfield> my install just took care of it
10:23 < johnfg> cwesterfield, Thanks for the help!
10:23 < cwesterfield> good luck
10:23 < johnfg> cwesterfield, What did you install server on?
10:23 < cwesterfield> windows 7
10:23 < johnfg> And your vpn is to a Mac?
10:23 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:23 < cwesterfield> from a mac and an Evo phone
10:24 < cwesterfield> if I can get it working
10:24 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
10:25 < cwesterfield> I'm mostly after getting my phone to tunnel, I go to lots of conferences and like to have a tunnel out
10:25 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
10:25 < cwesterfield> I'm using my work Mac to test
10:27 < johnfg> sounds cool.  All the best to you, too!
10:27 < cwesterfield> Thanks!
10:27 < johnfg> ttyl
10:27 -!- johnfg [johnfg@spirit.org] has quit [Quit: Leaving]
10:30 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
10:35 -!- MrJK [~jezu@194.199.166.96] has left #openvpn []
10:39 -!- cpf_ [~cpf@reehorst1.customer.bit.nl] has joined #openvpn
10:44 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:50 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:59 <@vpnHelper> RSS Update - forum: Here is my own Auto Login script for OpenVPN <http://forums.openvpn.net/topic7779.html#p10838>
11:00 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:02 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
11:06 < crocket> Bushmills, help me!!1
11:07 < crocket> I set the mode of client-connect script to 4650 and the UID/GID of it to openvpn:openvpn.
11:07 < crocket> oops
11:07 < crocket> root:openvpn
11:07 < crocket> openvpn is set to drop to UID openvpn GID openvpn.
11:08 < crocket> When openvpn executes client-connect script, it fails to execute it as root.
11:08 < crocket> I want to say. What the hell?
11:10 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:11 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
11:11 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:15 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Leaving]
11:16 < crocket> What the hell?
11:16 <@vpnHelper> RSS Update - forum: Client reply only after clean ARP cache <http://forums.openvpn.net/topic7835.html#p10839>
11:16 < crocket> clinent-connect script has the following file mode -rwSr-x--- 1 root openvpn
11:16 < crocket> And executing it as openvpn, the script fails to obtain root previlege.
11:17 < crocket> Do I need to set it 2650?
11:17 < cwesterfield> I wish i could help you, but all that was waay over my head
11:21 < crocket> damn
11:21 < crocket> Setuid doesn't work!!!!
11:21 <@vpnHelper> RSS Update - forum: Random MAC address generation? <http://forums.openvpn.net/topic7866.html>
11:22 -!- Blues-Man [~bluesman@95.239.124.200] has joined #openvpn
11:27 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
11:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:35 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:36 < dazo> crocket: you might need to have a look at the down-root plug-in, and adapt it to work for OPENVPN_PLUGIN_CLIENT_CONNECT 
11:36 < crocket> dazo, thanks
11:37 < dazo> this plug-in forks out a process with root privileges, and executes a script or executable with root privileges when shutting down ... the modification to make this one work with client-connect should be rather minimal
11:37 -!- en0x [portman@forgottenlabs/admin/en0x] has left #openvpn []
11:38 < cwesterfield> if I run a recursive dns, do i need to change client settings, server settings, or both
11:38 < dazo> crocket: btw, what are you trying to achieve with --client-connect?
11:39 < crocket> dazo, adding route to the server.
11:39 < dazo> ahh
11:41 < dazo> yeah, then it's probably the best way to do it via a plug-in instead ... might be a bit tricky in some cases, but I believe this one should work basing it on down-root
11:41 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Read error: Connection reset by peer]
11:41 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
11:48 -!- orkaa_ [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
11:50 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Ping timeout: 276 seconds]
11:50 -!- orkaa_ is now known as orkaa
11:52 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
11:52 -!- Blues-Man [~bluesman@95.239.124.200] has quit [Quit: Sto andando via]
12:01 < cwesterfield> anyone point me to the location of the faq for adding a recursive dns to the config?
12:13 -!- luneff [~yury@84.51.195.188] has joined #openvpn
12:19 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:21 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:26 < crocket> OK
12:27 < crocket> I found a way to drop the previlege of openvpn and still let it remove routes without root previlege.
12:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
12:30 < dazo> crocket: how?
12:30 < crocket> dazo, On http://openvpn.net/index.php/open-source/documentation/howto.html , find "Unprivileged mode (Linux only)"
12:30 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:30 < dazo> gah ... of course
12:31  * dazo didn't think of sudo
12:35 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
12:40 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
12:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:46 -!- dazo is now known as dazo_afk
12:48 < crocket> hmm
12:48 < crocket> haha
12:56 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:59 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 248 seconds]
13:22 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
13:38 -!- mirco [~mirco@pD9E5772D.dip.t-dialin.net] has joined #openvpn
13:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:41 -!- EugeneKaway is now known as EugeneKay
13:41 -!- xheliox [jeff@pdpc/supporter/student/xheliox] has quit [Ping timeout: 250 seconds]
13:45 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
13:49 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
14:01 < mindcry> Is there a way to add a push route to a specific node? Perhaps in the ccd file?
14:01 < krzee> sure
14:02 < krzee> exactly how you said =]
14:03 < mindcry> Nice haha. Is the syntax the same?
14:03 < krzee> yep
14:03 < krzee> !ccd
14:03 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
14:04 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
14:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:09 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
14:09 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
14:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
14:13 < gladiatr> people make me hurt
14:13 < gladiatr> (general statement not aimed at anyone in particular)
14:16 < orkaa> what's the context :)
14:27 < gladiatr> I'm analyzing the network configuration at a remote location that consists of a simple (/24) subnet behind two F5 load balancers with a layer 2 fabric consisting of two catalyst switches.  I'm trying to envision the spaghetti of physical connections between these devices.  It's making me hurt.  Total amateur hour.  I guess that's why I  have a job 
14:27 < gladiatr> heh
14:29 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:29 -!- luneff [~yury@84.51.201.89] has joined #openvpn
14:33 < krzee> remote figuring out of the screwed cabling
14:33 < krzee> screw that!
14:33 < krzee> get pics!
14:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
14:34 < gladiatr> Yeah.  That's my next step.  I'm hoping the guy I keep getting transferred to at the data center will be willing to use his phone cam.
14:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:36 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 248 seconds]
14:38 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Read error: Operation timed out]
14:43 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
14:49 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
14:58 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
15:10 -!- gladiatr is now known as gladiatr_afk
15:19 -!- mirco [~mirco@pD9E5772D.dip.t-dialin.net] has quit [Quit: mirco]
15:19 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
15:21 < cwesterfield> anyone point me to the location of the faq for adding a recursive dns to the config (server or client)?
15:32 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
15:35 < krzie> !pushdns
15:35 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
15:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 264 seconds]
15:42 -!- bitterman [~yury@84.51.201.89] has joined #openvpn
15:43 -!- ArcticMonkey [~ArcticMon@asgvnpc239.studentby.uit.no] has joined #openvpn
15:43 < ArcticMonkey> !welcome
15:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:44 < ArcticMonkey> !goal
15:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:44 < ArcticMonkey> !howto
15:44 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:45 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 246 seconds]
15:52 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
15:57 -!- Champi [Champi@rootshell.fr] has quit [Read error: Operation timed out]
15:59 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
15:59 -!- Champi [Champi@rootshell.fr] has joined #openvpn
16:12 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
16:14 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
16:14 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
16:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:24 -!- bitterman [~yury@84.51.201.89] has quit [Ping timeout: 252 seconds]
16:30 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
16:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 248 seconds]
16:36 <@vpnHelper> RSS Update - forum: Is this configuration possible? <http://forums.openvpn.net/topic7867.html>
16:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
16:41 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
16:56 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:00 <@vpnHelper> RSS Update - forum: Is this configuration possible? <http://forums.openvpn.net/topic7867.html#p10842>
17:06 <@vpnHelper> RSS Update - forum: Open VPN GUI config files refresh issue <http://forums.openvpn.net/topic7865.html#p10843>
17:13 -!- BX`ZDGWu [steve@bouncer.stephen.marsh.name] has quit [Excess Flood]
17:13 -!- fjhMiQ[G [steve@bouncer.stephen.marsh.name] has joined #openvpn
17:17 -!- teddz [~teddz@dtmd-4db234e3.pool.mediaWays.net] has joined #openvpn
17:22 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 252 seconds]
17:24 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
17:25 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
17:30 -!- ldaguilar [~luis@186.176.7.194] has quit [Ping timeout: 246 seconds]
17:33 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
17:34 < crocket> It seems that a lot of packets are lost in UDP tunnel.
17:34 < crocket> More than 90% are lost.
17:36 < krzie> wow, thats terrible
17:36 < krzie> check your MTU settings
17:36 < krzie> !mtu
17:36 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
17:37 < krzie> also be sure you didnt change mtu settings already without knowing what you were doing... a lot of people see settings on google and just add them without knowing why
17:39 -!- icewaterman [NyPxa@unaffiliated/icewaterman] has joined #openvpn
17:40 < icewaterman> hi
17:40 < icewaterman> when launching openvpn (tls-setup) i get a warning: "WARNING: potential route subnet conflict between local LAN [10.255.255.0/255.255.255.0] and remote VPN [10.255.255.1/255.255.255.255]"
17:40 < icewaterman> my problem is: the first lan does not exist on the client side
17:41 < icewaterman> hence there should be no (potential) conflict and the message would be falsely displayed
17:41 < icewaterman> or i am missing something here
17:42 < krzie> !configs
17:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
17:43 < krzie> and show me ipconfig / ifconfig from both sides
17:43 < krzie> (depending on OS)
17:43 < icewaterman> krzie: both linux :)
17:43 < icewaterman> i'll post em
17:44 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
17:45 < icewaterman> krzie: http://pastebin.com/zzzQhThA 
17:45 < icewaterman> http://pastebin.com/Vgn8Uacq
17:45 < icewaterman> and route ensues in a second
17:46 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:47 < icewaterman> http://pastebin.com/V3hDkK67
17:47 < icewaterman> that should be all
17:49 < icewaterman> the message "WARNING: potential route subnet conflict between local LAN [10.255.255.0/255.255.255.0] and remote VPN [10.255.255.1/255.255.255.255]" is sound, but i think there is no basis for it
17:52 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
17:58 < krzie> tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA
17:58 < krzie> why?
17:58 < icewaterman> krzie: some ciphers are more secure than others, so i chose those
17:58 < krzie> choose *1*
17:59 < krzie> choosing more than 1 doesnt help
17:59 < krzie> or does it?
17:59 < krzie> will the server fall-back to second choice for 1 client, but still use 1st choice for another client?
17:59 -!- ldaguilar [~luis@186.176.7.194] has quit [Ping timeout: 246 seconds]
17:59 < krzie> (ive never seen people do what you're doing there)
17:59 < icewaterman> krzie: according to the manpage it does
18:00 < krzie> 1sec lemme read it
18:00 < krzie> !man
18:00 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
18:00 < icewaterman> krzie: apache has a similar option
18:00 < icewaterman> so i figured it would be the useful to have a list in case the first cipher is not supported by one client
18:01 < crocket> Do I need nf_conntrack_pptp and nf_nat_pptp to use openvpn well?
18:01 < icewaterman> crocket: not at all
18:01 < crocket> When do I need them?
18:02 < icewaterman> crocket: in case you use pptp (some crappy windows-related vpn software)
18:02 < crocket> icewaterman, hmm
18:02 < icewaterman> crocket: essentially pptp is ppp with encryption
18:02 < crocket> icewaterman, A windows-xp virtual machine is running behind the linux router.
18:02 < icewaterman> other than that it has nothing to do with openvpn
18:02 < crocket> icewaterman, I wanted to connect to it via PPTP
18:03 < crocket> I NATed packets with destination port 1723 to the virtual machine, but iPhone couldn't make the VM do the authentication.
18:03 < icewaterman> crocket: havent used pptp in a decade, sorry, cant help you there
18:05 < crocket> iPhone doesn't support OpenVPN.
18:06 < Bushmills> !pptp
18:06 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read
18:06 <@vpnHelper> about why to not use pptp
18:06 -!- Nappy_ [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
18:07 < icewaterman> crocket: dunno much about the iphone, but it sure supports ipsec
18:07 < icewaterman> not that ipsec is easy to setup :)
18:07 < crocket> ok
18:08 < crocket> OpenVPN has been a pain in the ass to set up.
18:08 < crocket> And IPsec!!!
18:08 < Bushmills> !hamachi
18:08 < Bushmills> !factoids search hamachi
18:08 <@vpnHelper> No keys matched that query.
18:08 < icewaterman> Bushmills: he wants that on the iphone, probably not available
18:09 < Bushmills> afaik, iphone can be jailbroken, and tun driver + openvpn can run on those
18:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
18:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:12 < crocket> Like http://www.guizmovpn.com
18:12 <@vpnHelper> Title: GuizmOVPN - OpenVPN GUI for iPhone/iPad (at www.guizmovpn.com)
18:13 -!- Nappy_ [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Quit: Leaving]
18:14 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
18:14 < crocket> Today I established a method to give DNS names to all VPN clients and the server.
18:14 < crocket> It's a pain with tun
18:14 < crocket> It's easy with tap
18:17 < |Mike|> ,,,.
18:19 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
18:37 < crocket> I think UDP packets are dropped.
18:37 < crocket> When I initiate a transfer faster than 3.5MB/s, UDP transfer seems to cease for minutes.
18:39 -!- teddz [~teddz@dtmd-4db234e3.pool.mediaWays.net] has quit [Ping timeout: 246 seconds]
18:42 < krzie> sounds like you should check your MTU
18:43 < crocket> krzie, I connected to my work computer and sent pings to colleague's computer.
18:43 < crocket> The MTU was 1500
18:43 < crocket> So I set link-mtu to 1450.
18:43 < krzie> umm
18:43 < krzie> did you know WHY you did that tho... had you TESTED it?
18:43 < krzie> !mtu
18:43 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
18:43 < krzie> dont just go setting it to random shit, figure out your right setting
18:44 < crocket> krzie, I know why it was set to 1450
18:44 < crocket> 20 bytes for IP header, and 8 bytes for UDP header.
18:44 < crocket> the rest is for safety.
18:44  * hjohnson is sick of fighting with ipsec
18:44 < krzie> so you tested it and found that 1450 was optimal for your situation?
18:44 < hjohnson> I just wish this damned router supported openvpn
18:44 < hjohnson> that'd make life so mch easier
18:44 < crocket> krzie, No, but it was a test value.
18:44 < krzie> or you put a random number that you thought would be cool
18:44 < krzie> heh
18:44 < krzie> read
18:44 < crocket> krzie, 1450 would be a safe number.
18:44 < krzie> !mtu
18:44 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
18:45 < krzie> crocket, how do you assume to know that without checking...?
18:45 < krzie> psycic?
18:45 < crocket> krzie, By the way, a transfer works at 4.5MB/s for seconds and stops for minutes.
18:45 < crocket> krzie, I know what link-mtu means.
18:45 < hjohnson> crocket: that sounds more like windowing
18:45 < crocket> link-mtu means the payload size of UDP packets.
18:45 < krzie> then you should know you cant just guess that stuff
18:45 < Bushmills> hjohnson: isn't it openwrt compatible?
18:46 < hjohnson> Bushmills: alas, no
18:46 < Bushmills> well, toss it out.
18:46 < hjohnson> Bushmills: they've never gotten it to work on the RV042 im stuck with
18:46 < hjohnson> tbh, i'm considering replacing it with a cisco 2811 or so
18:47 < krzie> Bushmills, if you wanted to tune your MTU, would you pick a random value you think "should be good" or would you check what value works best?
18:47 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has joined #openvpn
18:47 < Bushmills> hm  - openvpn has support for determining the optimum MTU - i'd use that one first
18:48 < crocket> However
18:48 < crocket> The network at my work drops all ICMP packets from outside.
18:48 < crocket> I can't ping my computer at work.
18:49 < crocket> mtu-test wouldn't work
18:49 < Bushmills> ah. as vpnhelper, triggered by krzie, disclosed to us
18:49 < crocket> ???
18:50 < Bushmills> (01:44:53) krzie: !mtu
18:50 < crocket> I know
18:50 < crocket> I tested it inside the work network.
18:50 < crocket> MTU was 1500
18:51 < krzie> *inside the work network*
18:51 < krzie> hahahahahahah
18:51 < crocket> 1500 minus IP header + ICMP header was actual MTU for ICMP packets.
18:51 < crocket> krzie, But I can't ping from outside.
18:51 < krzie> mtu-test doesnt use ping
18:51 < krzie> it goes over the tunnel
18:51 < krzie> but im sure you know that
18:51 < crocket> krzie, "man openvpn" wasn't clear about that.
18:51 < krzie> take out all mtu stuff before using it
18:52 < crocket> Should I use mtu-test on the client side?
18:53 < krzie> !mtu
18:53 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
18:53 < krzie> (for the 3rd time)
18:53 < crocket> I want to know what happens if mtu-test is turned on by the client and the server.
18:53 < crocket> ah
18:53 < crocket> client
18:53 < krzie> heh
18:53  * krzie claps
18:57 < krzie> disable your current mtu stuff before testing
18:57 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:57 < crocket> kraut, Do you mean link-mtu?
18:57 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
18:57 < krzie> that as well as any others you are using
18:58  * ecrist punches krzie in the baby-maker
18:58 < crocket> baby maker?
18:58 < krzie> me!?  punch the people that refuse to read vpnHelper's stuff!
18:58 < crocket> His johnson?
18:59 < ecrist> just for good measure, krzie 
18:59 < krzie> nope, he punched my ex girlfriend
18:59 < ecrist> lol
18:59 < ecrist> I haven't gotten too much further with new forum software, going to work on it some now
19:00 < crocket> By the way I never had a girlfriend until this age....
19:00 < crocket> Computers are better than girls.
19:00 < krzie> erm,
19:00  * ecrist punches crocket in the junk
19:00 < krzie> maybe for math they are...
19:00 < ecrist> krzie: women are really good a deductions
19:00 < ecrist> deducting money for their man's bank account
19:00 < ecrist> ;)
19:01 < krzie> but unless your computer came with a usb powered head-giving device, i strongly disagree
19:01 < crocket> NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1541]
19:01 < ecrist> good, then your MTU is fine, crocket 
19:01 < crocket> 1541?
19:02 < crocket> What is that number?
19:02 < krzie> then dont screw up your MTU by putting settings in your config
19:02 < krzie> remove the mtu settings all together
19:02 < crocket> krzie : I don't currently have it, but UDP packets seem to be dropped for minutes.
19:02 < krzie> well its not mt
19:02 < krzie> mtu
19:02 < ecrist> sounds like a throttling issue, to me
19:02 < crocket> TCP packets are damn fast.
19:03 < krzie> maybe a stateful firewall
19:03 < ecrist> right, many ISPs filter UDP in high-bandwidth as it's used for bittorrent
19:03 < crocket> damn
19:03 < krzie> heh i didnt know that eric
19:03 < crocket> I'll call IT department and bug them.
19:04 < krzie> ive never come across that
19:04 < krzie> then again i doubt the morons in this country could figure out how to setup QOS ;]
19:04 < krzie> or any other sort of throttling 
19:05 < crocket> That's why they're called morons.
19:05 < crocket> They just absent-mindedly throttle UDP packets.
19:07 < ecrist> krzie: they especially have for encrypted UDP traffic, as it looks like bittorrent.
19:07 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
19:08 < ecrist> rather, it 'could be' bittorrent.
19:08 < ecrist> usually back-water ISPs, most of the big ones in the US don't do that due to all the flack they got for it.
19:08 < crocket> Allow UDP!!
19:09 < hjohnson> ecrist: friend of mine who runs a small scale WISP has been forced to do it to protect the network
19:10 < hjohnson> though he tends to do things where he doesn't throttle the strict sped, just plays with prioritization
19:12 < ecrist> I don't fuck your wife, I just have sex with her.
19:12 < ecrist> same basic idea.
19:13  * ecrist may be consuming adult beverages this evening...
19:14 < ecrist> though, hjohnson, if I had to choose, I'd choose QOS over bandwidth limiting;
19:14 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has joined #openvpn
19:16 < krzie> definitely
19:17 < hjohnson> ecrist: basic issue is saturation of the uplink to the internet, and adjacent channel interference at the hub antennas
19:17 < ecrist> ah
19:17 < hjohnson> even if you have two systems on opposite ends of the channel list, they will interfere with each other
19:17 < hjohnson> ubiquity is making some sexy stuff that uses GPS synchronization though
19:17 < hjohnson> which is cool
19:17 < hjohnson> eliminates that problem
19:18 < ecrist> that's why I'm an opponent of adjacent frequency systems.
19:18 < hjohnson> ecrist: well, unless everyone's on the same channel then you run into isues
19:18 < ecrist> broad spectrum, you can increase the power, allowing for interference,
19:18 < hjohnson> except when you're interfering with yourself
19:18 < hjohnson> that's the fundamental problem
19:19 < kunago> Could someone give me a hint how to setup my VPN client to expose other LAN clients on my LAN? This is a basic setup : http://img641.imageshack.us/i/lansetup.jpg/
19:19 <@vpnHelper> Title: ImageShack - Online Photo and Video Hosting (at img641.imageshack.us)
19:19 < ecrist> !iroute
19:19 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
19:19 < hjohnson> the fundamental problem is that if you have a transmitter sitting right next to a receiver, the transmitter is going to overwealm the receiver
19:20 < hjohnson> and you won't hear distant stations
19:20 < kunago> ecrist: Yeah, I know that one and I am already using it in other parts of my VPN. The thing is this VPN client which is going to expose other clients is neither a router, nor a gateway.
19:20 < hjohnson> the cure is to synchronize the radios on your hub, so they're either all transmitting or all receiving at a given point in time
19:20 < ecrist> so?
19:21 < ecrist> it needs to become a gateway in order to do what you want.
19:21 < ecrist> not the default, per se, but a gateway nonetheless
19:21 < kunago> ecrist: So simply making the client the LAN's gateway will do the trick, right?
19:21 < hjohnson> grumble
19:22 -!- DigitallyStoned [blowahoe@cpe-69-23-248-60.sw.res.rr.com] has quit []
19:23 < ecrist> you still need iroute
19:24 < kunago> I count with the iroute in my config.
19:28 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
19:28 < crocket> Does mtu-test on client makes the openvpn server launch a dhcp client?
19:36 -!- Torpion [~torpion@ydb.me] has quit [Ping timeout: 241 seconds]
19:36 -!- Torpion [~torpion@ydb.me] has joined #openvpn
19:37 < krzie> iroute cant go in the config
19:37 < krzie> it must be in a ccd entry
19:37 < krzie> much like my writeup says:
19:37 < krzie> !route
19:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
19:39 < kunago> Could someone please verify I have no issues in my configs? I spent quite a lot of time with it but I am still having issues with the speed over VPN so wondering whether I have misconfigured it : http://pastebin.com/cTR9J06z
19:41 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:43 < crocket> kunago, Use TCP instead of UDP.
19:43 < crocket> Your ISP may have throttled UDP packets.
19:43 < kunago> crocket: I read that TCP makes everything even slower, doesn't it?
19:43 < ecrist> !tcp
19:43 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
19:44 < crocket> kunago, If your ISP blocked passing lots of UDP packets, TCP is the only alternative.
19:45 < crocket> OpenVPN over TCP is still 4.5MB/s
19:45 < crocket> fast enoug
19:45 < crocket> h
19:45 < kunago> crocket: And apart from it (will test TCP) do you see probs?
19:45 < crocket> and ping is within 15ms
19:46 < crocket> ???
19:46 < crocket> prob?
19:46 < kunago> problem
19:46 < crocket> I don't see any problem with TCP.
19:47 < kunago> I mean in the configs.
19:47 < crocket> It is not as fast as UDP, but still fast enough in my case.
19:47 < orkaa> hm, how can I execute an "up" script after "Initialization Sequence Completed"?
19:47 < orkaa> it's a nsupdate script
19:47 < crocket> kunago, have you used mtu-test?
19:47 < orkaa> and _needs_ the tunnel to be up
19:48 < orkaa> up-delay also tries to run it too soon
19:48 < orkaa> if I have debugged correctly
19:48 < crocket> orkaa, how about --client-connect?
19:48 < orkaa> crocket: I need the script on client, not server
19:48 < krzie> orkaa, what are you looking to do?
19:48 < kunago> crocket: mtu-test does not finish on my clients for some reason. It never has.
19:49 < crocket> kunago, Then don't set mtu
19:49 < crocket> I'm going to go out now.
19:49 < crocket> See you guys later.
19:49 < Bushmills> orkaa: check out --up-delay
19:49 < orkaa> krzie: i'm trying to push a dns record of the client to some dhcp server 
19:49 < kunago> crocket: Thanks, will try.
19:49 < orkaa> Bushmills: I did that, not delayed enough
19:50 < Bushmills> --route-up then?
19:51 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:51 < orkaa> let's try it
19:53 < Bushmills> nsupdate to dhcp server??
19:53  * Bushmills headscratches
19:54 < orkaa> Bushmills: http://dpaste.com/526879/
19:54 < orkaa> that's the 'up' script
19:54 < krzie> oh god those setups, heh
19:54 < krzie> !scripts
19:54 < krzie> !script
19:54 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
19:54 < Bushmills> i know about nsupdate.  but i use it to edit zone files of bind, which is a name server
19:55 < krzie> --learn-address 
19:55 < krzie> Executed in --mode server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table.
19:55 < krzie> that looks like maybe a winner? not sure
19:55 < krzie> or maybe --ipchange
19:55 < orkaa> Bushmills: *gah*, sorry
19:55 < orkaa> it's late out here
19:56 < orkaa> dns server ofcourse :)
19:57 < orkaa> krzie: Options error: --learn-address requires --mode server
19:57 < orkaa> so, not a good option
19:59 < Bushmills> why don't you take ip address from environment variable?
20:00 < orkaa> Bushmills: would that change anything?
20:00 < Bushmills> yes - it makes parsing the output of ifconfig unnecessary
20:00 < orkaa> I think that script fails when it tries to connect over a not-working-yet tunnel
20:01 < orkaa> or am I wrong?
20:01 < Bushmills> you should ask that somebody who tried that script
20:02 < orkaa> well, it works if it's executed manually after the tunnel start
20:04 < Bushmills> man openvpn, search for  Environmental Variables
20:04 < Bushmills> those you can use in your script
20:05 < Bushmills> pay attention to the  ifconfig_ ones
20:05 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has quit [Ping timeout: 260 seconds]
20:07 -!- newmember [~chatzilla@wsip-70-164-129-114.lv.lv.cox.net] has joined #openvpn
20:07 < Bushmills> also $HOSTNAME, if you don't like $common_name, is better than  $(hostname)
20:08 < Bushmills> echo foo | process     is better written as   process <<< foo
20:09 < Bushmills> and instead of the repetitive  echo lines,  consider to use   cat << EOF, then the lines with literal text, terminated by EOF
20:09 < krzie> orkaa, you dont *need* it on the client
20:09 < krzie> you just need it to know the client's address
20:10 < orkaa> krzie: that's actually true
20:10 < orkaa> krzie: I guess you just solved my problem
20:10 < krzie> glad to help
20:11 < orkaa> Bushmills: thanks for the bash tips, but they don't really affect the main problem
20:11 < Bushmills> orkaa: http://scarydevilmonastery.net/snap/1301447422982497859d.png  as alternative
20:13 < orkaa> krzie: damn, there's a small problem
20:13 < orkaa> I need to know the hostname of the client
20:14 < orkaa> to be able to push it to dns
20:14 < Bushmills> on server, it would look about like this:  http://scarydevilmonastery.net/snap/1301447638734672884d.png 
20:14 < krzie> umm, arent you trying to make a new hostname for their VPN ips?
20:15 < orkaa> krzie: all clients have the same cert or common_name
20:15 < orkaa> so they get random ips
20:15 < orkaa> but hostnames are different on each of them
20:18 < orkaa> I don't know their hostname untill they push it
20:21 <@vpnHelper> RSS Update - forum: openvpn 2.2RC(now is 2.2RC2) can't run as server ? <http://forums.openvpn.net/topic7751.html#p10844>
20:23 < Bushmills> my guess is - your script fails from --up because you are parsing ifconfig output, instead of reading the openvpn-provided variable for client ip address
20:24 < krzie> umm
20:24 < krzie> [18:15]  <orkaa> krzie: all clients have the same cert or common_name
20:24 < krzie> well theres your problem
20:24 < krzie> try doing it right instead
20:24 < krzie> make a cert for each client
20:24 < orkaa> nah, I've got a specific setup that needs duplicate-cn
20:24 < krzie> OR if you use passwords, use the option to make username into common-name
20:24 < krzie> !authpass
20:24 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
20:25 < krzie> like #3
20:25 < orkaa> I'm not using passwords
20:25 < orkaa> I've got some prebuilt ubuntu install cds
20:26 < orkaa> that connect to a central server after installation
20:26 < krzie> haha
20:26 < krzie> welcome to something i like to call "doing it wrong"
20:27 < orkaa> well, I don't think that's actually the case but ok
20:27 < krzie> its not the case that i like to call that "doing it wrong" ?
20:28 < krzie> i believe it is the case, i do call it that!
20:28 < krzie> in fact i just did!
20:28 < Bushmills> you did
20:28 < orkaa> :))
20:28 < orkaa> all other options I had were equally complicated
20:29 < orkaa> so I chose this one
20:29 < krzie> if they were literally equally complicated, you may have chosen bad... if this was in fact far easier then its up for debate and ultimately rests with what you feel like doing
20:33 < orkaa> how would you create client certs on the client of which server is unaware of
20:33 < orkaa> and then connect the two
20:34 < krzie> you wouldnt, you would create passwords for every user
20:35 < krzie> and common cert
20:35 < krzie> dual factor auth
20:35 < krzie> for the win!
20:37 < orkaa> what if I don't control the machines that join the group
20:37 < orkaa> and I just hand the ubuntu install cd to someone
20:37 < orkaa> who does the installation 
20:37 < krzie> everything would remain as-is
20:37 < krzie> except they would need a password to join
20:38 < krzie> which they would get from you when they get the cd
20:38 < orkaa> but that would mean I'd have to work each time they want to setup a machine
20:38 < krzie> by work you mean setup an account?
20:38 < orkaa> yes
20:38 < krzie> sounds reeeeeally hard doesnt it?
20:39 < orkaa> well, it would cost them money
20:39 < krzie> but ya, do whatever you want
20:39 < orkaa> and I'm not always available
20:39 < krzie> it doesnt change my security any ;]
20:39 < krzie> can i get the physical address of someone with a cd?
20:40 < orkaa> I agree with you that it's not the most secure setup 
20:40 < orkaa> but it doesn't matter that much
20:40 < orkaa> because the 'clients' are some machines with touchscreens
20:40 < orkaa> that cannot be removed
20:40 < orkaa> or psihically accessed
20:41 < orkaa> and they're behind nat
20:41 < orkaa> which is also the reason for this vpn
20:41 < orkaa> I can provision them using the vpn
20:49 < orkaa> ok, I'm closer
20:49 < orkaa> now I know that script is actually executing
20:49 < orkaa> I had to add:
20:50 < orkaa> script-security 2 system
20:50 < orkaa> before it was just:
20:50 < orkaa> script-security 2
20:50 < orkaa> now I get
20:50 < orkaa> ; Communication with server failed: operation canceled
20:50 < orkaa> Wed Mar 30 03:48:58 2011 us=229841 Route script failed: external program exited with error status: 2
20:50 < orkaa> Wed Mar 30 03:48:58 2011 us=229952 Initialization Sequence Completed
20:51 < orkaa> this first line is nsupdate error
20:57 < orkaa> yep, if I try to ping from the up script
20:57 < orkaa> Wed Mar 30 03:56:52 2011 us=870217 /sbin/route add -net 10.66.0.0 netmask 255.255.255.0 gw 10.66.0.17
20:57 < orkaa> 10.66.0.1 is unreachable
20:57 < orkaa> Wed Mar 30 03:56:57 2011 us=16522 Route script failed: external program exited with error status: 1
20:57 < orkaa> Wed Mar 30 03:56:57 2011 us=16535 Initialization Sequence Completed
20:57 < orkaa> that's not cool, openvpn should have a hook that runs after _everything_
20:58 < orkaa> when a full connection is established
20:58 < Bushmills> it has
20:58 < krzie> --up scripts are able to communicate over the tunnel
20:58 < orkaa> ok, so I'm failing somewhere
20:58 < krzie> they are used by some people to auto-mount shares and whatnot
20:59 < orkaa> Wed Mar 30 03:59:37 2011 us=276995 /tmp/bla.sh tun1 1500 1543 10.66.0.14 10.66.0.13 init
20:59 < orkaa> 10.66.0.1 is unreachable
21:00 < orkaa> and bla.sh is just a: fping 10.66.0.1
21:00 < orkaa> 10.66.0.1 is server's ip
21:01 < Bushmills> krzie: want to tell him, or let him figure it out?
21:02 < orkaa> please :)
21:06 < orkaa> if I do it the same second the channel is up
21:06 < orkaa> fping 10.66.0.1
21:06 < orkaa> 10.66.0.1 is alive
21:08 < orkaa> http://openvpn.net/archive/openvpn-users/2005-01/msg00039.html
21:09 <@vpnHelper> Title: [Openvpn-users] Tunnel Traffic not passing during route-up script execution (at openvpn.net)
21:09 < orkaa> this is the same problem I'm having
21:12 < orkaa> aha!
21:13 < orkaa> solved!
21:13 < orkaa> my original script also works
21:13 < orkaa> all it needed was a '&' at the end
21:13 < orkaa> to put it in background
21:16 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has joined #openvpn
21:17 < kunago> In general, will tls-auth slow down the communication between clients? Does anyone have experience with this?
21:19 < krzie> not that ive ever heard of
21:19 < krzie> but it *does* add a hmac sig to every packet, so in theory i would think so
21:19 < krzie> however, nobody has ever reported it, and i have never used a vpn without it
21:19 < krzie> nor will i
21:20 < kunago> When I was using it I received quite a lot of those HMAC errors that I could see in the log.
21:20 < krzie> then you had something wrong
21:20 < krzie> !hmac
21:20 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
21:20 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
21:22 < crocket> I'm back!!!
21:22 < orkaa> Bushmills: so what was the 'funny' thing you needlessly hid from me?
21:22 < kunago> You mean something wrong in the config? Because I was using the proper ta.key file; I am sure about that one.
21:22 < crocket> I'm back from the hell!!!
21:25 < krzie> kunago, well theres only 2 things
21:25 < krzie> the # after the file in the config 1/0
21:25 < krzie> and the file being EXACTLY the same on both sides
21:26 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:26 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:26 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:26 < krzie> which you could check after the xfer with md5/sha1
21:26 < kunago> Right, thanks, will try to debug it a little bit.
21:27 < kunago> By the way, is this line "tls-server" also required while using "tls-auth"?
21:29 < kunago> !tls-server
21:39 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has quit [Remote host closed the connection]
21:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:52 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
21:53 < krzie> nope, you use --server right?
21:53 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has joined #openvpn
21:55 < kunago> So anyone any idea about the "tls-server" line in the config please? I also found in other configs on the internet "tls-client" but no one actually explains what it is needed for.
21:55 < ecrist> kunago: check out the man page, I find it useful
22:00 < kunago> ecrist: I did. Sorry for the stupid question but I fail to understand whether it's a substitute for tls-auth in a way or not at all, and whether it's of some use or not because I assume the communication over VPN is encrypted anyways. I can see in the man page what those commands do of course.
22:01 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
22:02 < ecrist> no
22:02 < ecrist> tls-server setups up a TLS-encrypted VPN server daemon
22:03 < kunago> Oh, so by default the communication is not encrypted?
22:03 < ecrist> it's possible to setup a vpn without encryption
22:04 < ecrist> there's no such thing as a 'default' with openvpn
22:04 < ecrist> tls-auth adds an additional layer of HMAC auth.  if there isn't a proper signature, the packets are dropped without further analysis.
22:04 < kunago> Good, thanks for clarifying this to me.
22:05 < ecrist> fwiw, it *is* covered in the man page.
22:05 < ecrist> to quote:
22:05 < ecrist> In a nutshell, --tls-auth enables a kind of "HMAC firewall" on OpenVPN's TCP/UDP port, where TLS control channel packets bearing an incorrect HMAC signature can be dropped immediately without response.
22:07 < ecrist> wowsers, 30,296 'visits' to the forum in March
22:08 < kunago> In a way, these man pages are good and very informative but sometimes I feel one needs to have a degree to figure out everything by himself without someone translating some sentences to a human-like language. No offense.
22:11 -!- master_of_master [~master_of@p57B56D44.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
22:13 -!- master_of_master [~master_of@p57B573DB.dip.t-dialin.net] has joined #openvpn
22:19 < ecrist> not offending me.  I didn't write 'em
22:22 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
22:32 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has quit [Ping timeout: 240 seconds]
22:45 < crocket> kunago is out?
22:46 < crocket> Bushmills, It turned out that openvpn doesn't have to generate errors even behind my back when quitting.
22:46 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
22:46 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Remote host closed the connection]
22:47 < Bushmills> cool.  poor error messages. unwanted and ignored.
22:48 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
22:51 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
22:51 < crocket> Bushmills, It turned out that openvpn doesn't have to generate errors even behind my back when quitting.
22:51 < crocket> Bushmills, I compiled openvpn with iproute2 support and set iproute command to an iproute wrapper script which calls sudo /sbin/ip.
22:51 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
22:52 < crocket> Bushmills, As a result, OpenVPN has previlege to delete routes when it quits.
22:53 < Bushmills> yes. permissions ok -> no errors. plausible.
22:56 < Bushmills> iirc, you were also busy with something name server related - what was that?
22:56 < crocket> Bushmills, yeah
22:57 < crocket> Bushmills, I was hesitating among BIND, dnsmasq, and maradns.
22:57 < Bushmills> what was the goal?
22:57 < crocket> dnsmasq doesn't accept DNS update queries via nsupdate.
22:57 < Bushmills> ah.
22:58 < crocket> I wanted to give DNS names to every machine in my LAN and VPN.
22:58 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 248 seconds]
22:58 < Bushmills> there were a lot of updating bind zones with openvpn client host names + ip addresses coming in today
22:58 < crocket> Bushmills, But I changed my mind. client-connect script was able to retrieve X509_0_CN and trusted_ip.
22:59 < Bushmills> so i polished my update script a bit and put it on the server
22:59 < crocket> Bushmills, I use client-connect script to add DNS entries to /etc/hosts.dnsmasq
22:59 < crocket> It's easy.
22:59 -!- d457k [~heiko@vpn.astaro.de] has joined #openvpn
22:59 < crocket> Now every machine in my LAN and VPN can recognize each other with DNS names.
23:00 -!- d12fk [~heiko@vpn.astaro.de] has quit [Ping timeout: 276 seconds]
23:00 < Bushmills> yes. one would think that it is, that's why i didn't bother as far. but sometimes folks attempt pretty complicated setups to achieve that
23:00 < crocket> Bushmills, Folks attempt complicated setups to use BIND?
23:01 < Bushmills> mostly bind, yes
23:02 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
23:02 < crocket> Bushmills, I'm planning to learn bind soon.
23:02 < Bushmills> well, sometimes the approach is sound, but the scripts are too complex
23:03 < crocket> Bushmills, The problem with dnsmasq is that I can't have more than one zones.
23:03 < crocket> maraDNS may be able to deal with multiple zones with one instance of itself.
23:04 < crocket> Bushmills, I want machines in LAN to have .lan domain and VPN machines to belong to .vpn domain.
23:04 < Bushmills> yes, it does. but the ddns support of maradns is poor
23:04 < crocket> ddns?
23:04 < Bushmills> dynamic zone updates
23:04 < crocket> Do you mean DNS entry registration from DHCP server?
23:05 < crocket> Does it suggest that I should use BIND and DHCPD?
23:06 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
23:06 < Bushmills> for dhcp, i'd probably continue to use dnsmasq, and forward queries to other domains to maradns or bind
23:07 < crocket> Bushmills, Can I forward queries for other zones to other dns servers on the same machine?
23:07 <@vpnHelper> RSS Update - forum: How to setup open vpn server for Win XP <http://forums.openvpn.net/topic7868.html>
23:07 < Bushmills> anyway, here's the openvpn server script to add openvpn clients to bind zones: http://scarydevilmonastery.net/client_connect_nsupdate
23:07 < crocket> Bushmills, I only have one server.
23:08 < Bushmills> no, not really, unless you have multiple ip addresses / nics
23:08 < crocket> Bushmills, I want to run multiple DNS servers on the same machine.
23:08 < crocket> Can it be possible to do it on different ports?
23:08 < crocket> maybe nameserver entry in /etc/resolv.conf can specify a port.
23:08 < Bushmills> possible: yes.  useful: no
23:09 < crocket> Bushmills, How can I have multiple zones without buying machines, then?
23:09 < Bushmills>  multiple ip addresses / nics
23:09 < hjohnson> why would you want to run multiple servers?
23:09 < Bushmills> stop.  that'S for "multiple name servers"
23:09 < hjohnson> there's no reason to
23:10 < Bushmills> multiple zones; a real name server instead of dnsmasq
23:10 < crocket> hjohnson, One dnsmasq server is dedicated to one zone.
23:10 < hjohnson> crocket: so install bind
23:10 < hjohnson> I'm running split horizon 
23:10 < crocket> hjohnson, It's already installed. I just need to learn it for months.
23:10 < hjohnson> it's pretty easy
23:10 < crocket> It's pretty damn extensive.
23:10 < hjohnson> split horizon isn't hard
23:10 < crocket> I also have to learn dhcpd, too.
23:11 < hjohnson> do you know how to create a zone file?
23:11 < crocket> Not yet.
23:11 < crocket> But I saw examples.
23:11 < crocket> maraDNS would be able to do the same thing without nsupdate.
23:12  * hjohnson has dhcpd feeding updates into bind
23:12 < hjohnson> into the local zone
23:12 < Bushmills> maradns is waaaay easier than bind
23:12 < hjohnson> so I get <dhcpid>.internal.ca
23:12 < hjohnson> works a treat
23:12 < hjohnson> wasn't hard to setup
23:12 < Bushmills> but for the cost of reducing complexity to necessities
23:12 < Bushmills> so maradns can't do everything bind can
23:14 < Bushmills> for example. master/slave setups, with automatically updating the slaves when a zone on master changes, is not built-in.
23:14 < Bushmills> also, as mentioned, dynamically updating zones isn't for maradns
23:15 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
23:15 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
23:15 < hjohnson> http://pastebin.com/TZA9gtVJ
23:15 < hjohnson> that's a subset of my named.conf file
23:16 < hjohnson> bind really isn't that hard to setup
23:17 < hjohnson> the top section basically says "use the following section when responding to requests from anything in the match-clients secion.
23:18 < Bushmills> hjohnson: i think crocket has already seen a simple 3-line configuration file setup for maradns :)
23:18 < Bushmills> meaning to say that "not that hard" is relative
23:19 < crocket> It's not that hard if one determins to learn.
23:20 < crocket> It's definitely much easier than calculus.
23:20 < crocket> it's just a big dumb tool.
23:20 < Bushmills> well, with maradns you will earlier or later hit its limits. with bind, you're much less likely to.
23:20 < hjohnson> the only thing that's really a bit of a gotcha is the pickyness about punctuation in the zone files
23:22 < Bushmills> otoh, on a measly wlan router, bind  doesn't make a good choice at all
23:22 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
23:22 < hjohnson> well of course not
23:22 < Bushmills> why "of course"?
23:22 -!- stony is now known as Guest85644
23:23 < hjohnson> dhcpd/bind are running in on my main server which has oodles fo rAM and CPU
23:23 < hjohnson> Bushmills: it's big and heavy
23:23 < Bushmills> maradns, otoh, works beautifully in such environments
23:25 < Bushmills> well, so does dnsmasq - but that one isn't a real name server. it's some kind of partial approximation to one
23:25 < crocket> oodles?
23:25 < crocket> Anyway
23:26 < crocket> I'm satisfied with dnsmasq for now.
23:26 < Bushmills> http://scarydevilmonastery.net/dict.cgi?oodles
23:26 < crocket> I don't really need multiple zones in a network of this size.
23:27 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:28 < crocket> Bushmills, One thing I'm concerned about is that I put nameserver 127.0.0.1 in /etc/resolv.conf and dnsmasq looks up the nameservers in /etc/resolv.conf and dnsmasq is 127.0.0.1.
23:28 < crocket> It's prone to recursion.
23:28 < crocket> It's not beautiful by design.
23:29 < Bushmills> that's on the wlan router,  openwrt or dd-wrt?
23:30 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
23:31 < Bushmills> there's a config option to specify a different file,  resolv-file=alternate.resolv.conf   i think
23:32 < Bushmills> but how that integrates with uci, if that's the router, i'm not sure
23:35 < Bushmills> easiest is probably to not set resolv.conf to 127.0.0.1 on the same machine where dnsmasq runs, but point it to a real resolver, which will then also be used by dnsmasq
23:35 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
23:45 < crocket> Bushmills, If I want to access internal DNS names, I have to specify 127.0.0.1 in /etc/resolv.conf
23:46 < Bushmills> why do you want to do that from the machine which is running dnsmasq?
23:47 < crocket> Bushmills, I often use the server.
23:48 < crocket> Bushmills, I often have to fiddle with the server, so I want to access DNS names on the server.
23:48 < crocket> Also it's not possible to memorize changing IP addresses.
23:49 < Bushmills> i don't understand why "fiddling with server" requires it to know the other machines on the network
23:49 < Bushmills> if it is a server, it serves. 
23:49 < Bushmills> need to know other machines by name is with clients
23:54 < krzee> if you use a good naming scheme for the CN, and use ccd files to give a static ip, then to find the ip you simply cat their ccd file
23:54 < hyper_ch> krzee: got a rl.exe example?
23:55 < krzee> whats rl.exe
23:55 < krzee> i dont use any .exe's
23:55 < krzee> oh, virii
23:55 < crocket> Bushmills, The server needs also to serve me.
23:55 < crocket> Bushmills, I don't want to type IP addresses to ssh into other clients from the server.
23:56 < crocket> Bushmills, the server is connected a big monitor.
23:56 < crocket> s/connected/connected to/
23:56 < crocket> A desktop is connected to the monitor, too.
23:56 < Bushmills> then tell it to use a different file, not resolv.conf, to consult for knowing its upstream recursor
23:58 < krzee> hyper_ch, looks like an instant messenger worm, sound right?
23:59 < crocket> Bushmills, hmm..... dhcpcd fetches upstream DHCP servers to /etc/resolv.conf
23:59 < crocket> I don't want to change that behavior since that looks perfectly sane.
--- Day changed Wed Mar 30 2011
00:00 < crocket> My server fetches a public IP address from DHCP server
00:00 < crocket> A private network behind my server.
00:00 < Bushmills> you see (or create) a problem where there is none.
00:02 < Bushmills> the suggestion merely tells dnsmasq "if there's a query coming in you don't know about, don't ask yourself (recursively, maybe), but ask the server given in the file i told you to use in this case"
00:03 < Bushmills> how that relates to dhcp now is something you alone know about. well, i don't.
00:04 < crocket> Bushmills, My server has eth0 and eth1.
00:04 < crocket> eth0 is connected to the itnernet.
00:04 < crocket> eth1 is connected to the desktop.
00:04 < crocket> The desktop fetches a private IP address from eth1 of the server.
00:04 < crocket> The hostname of the desktop is transferred as DHCP hostname.
00:05 < crocket> And dnsmasq registers the DHCP hostname to DNS database.
00:05 < crocket> If I use OpenVPN to connect to the server, I can access to the desktop by using its name.
00:05 < crocket> I don't have to memorize anything but names.
00:05 < Bushmills> and so? that is unrelated to "if there's a query coming in you don't know about, don't ask yourself (recursively, maybe), but ask the server given in the file i told you to use in this case"
00:06 < crocket> And
00:06 < crocket> I often have to fiddle with the server itself.
00:06 < Bushmills> then just leave it as it is.
00:06 < crocket> typing names on the server is much more convenient.
00:06 < Bushmills> seems there is no solution
00:06 < crocket> ok
00:08 < crocket> Bushmills, how did you configure your DNS servers?
00:08 < Bushmills> "i won't use the option made for this purpose because i need to fiddle with the server - that prevents me from setting it right"
00:09 < crocket> ????
00:10 < crocket> The use of quotes confuses me.
00:10 < Bushmills> that's a one-sentence conclusion of your last 15 lines of reasoning why you can't use that
00:11 < crocket> That's too terse.
00:11 < crocket> too terse to understand.
00:13 < Bushmills> i don't want to push you into a configuration of which you feel it somehow reduces the usefulness of your system, even if i think that it solves the problem you have already identified
00:14 < Bushmills> you may figure it out yourself
00:14 < crocket> Bushmills, Figure what myself?
00:14 < crocket> Not mixing upstream and internal DNS servers?
00:14 < Bushmills> figure out that the mentioned option is what you need
00:15 < crocket> option?
00:15 < crocket> You can mean several different meanings by "option" in this situation.
00:15 < Bushmills> configuration parameter
00:15 < crocket> s/meanings/things/
00:15 < crocket> You must mean /etc/resolv.conf
00:16 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:16 -!- mode/#openvpn [+o mattock] by ChanServ
00:17 < Bushmills> no. i mean the configuration option i gave you in response to you stating the problem of potential recursion you detected with dnsmasq, which is meant to solve that problem
00:19 < crocket> Bushmills, Do you suggest that I give up resolving DNS names on the DNS server itself?
00:20 < Bushmills> why don't you just read the log, from about the point you detected the possible problem with recursion, instead of guessing what i could have meant or suggested?
00:21 < krzee> ild make a script to update a hosts file, sounds laziest
00:21 -!- wookienz [~chatzilla@220.232.248.214] has joined #openvpn
00:21 < wookienz> !noroute
00:21 < krzee> he
00:21 < krzee> heh
00:22 < krzee> !goal
00:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:22 < Bushmills> (06:28:07) crocket: Bushmills, One thing I'm concerned about is that I put nameserver 127.0.0.1 in /etc/resolv.conf and dnsmasq looks up the nameservers in /etc/resolv.conf and dnsmasq is 127.0.0.1.
00:22 < Bushmills> (06:28:15) crocket: It's prone to recursion
00:22 < Bushmills> about there
00:22 < wookienz> I would like to access the internet over my VPN
00:22 < krzee> !redirect
00:22 < Bushmills> !redirect
00:22 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
00:22 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
00:22 < krzee> =]
00:22 < Bushmills> hehe
00:22 < wookienz> ta!
00:23 < wookienz> Bushmills: you gave me noroute yesterday, but it didnt work...
00:23 < wookienz> anyway...
00:23 < Bushmills> that's not a factoid
00:23 < Bushmills> that's saying "maybe there is no route"
00:23 < wookienz> i know!
00:23 < Bushmills> löike  ... noroute
00:23 < krzee> hey that would be pretty cool to build the manual into the bot tho
00:23 < crocket> Bushmills, the last URL you gave me timed out, and there is nothing else.
00:24 < krzee> would just be a matter of parsing the manual and adding to the sqlite db
00:24 < Bushmills> (06:31:26) Bushmills: there's a config option to specify a different file,  resolv-file=alternate.resolv.conf   i think
00:24 < Bushmills> there's no url in there
00:24 < crocket> Bushmills, I thought you referred to a URL.
00:24 < wookienz> do i need NAT if i have a sep router doing the firewall and gateway? can i just pass all traffic (forward) to it directly?
00:25 < Bushmills> you need NAT
00:25 < wookienz> so my vpon server with NAT the traffic which is passed to the friewall which is initself NAT'd?
00:26 < Bushmills> xlerb?
00:26 < wookienz> vpn/will
00:26 < krzee> wookienz, well
00:26 < krzee> you can NAT it on that router also
00:26 < krzee> must also make sure that router has a route to the vpn network
00:26 < krzee> but it must be NAT'ed
00:26 < wookienz> the vpn is on the same subnet as the router...
00:27 < wookienz> ok must be nat'd, understopod.
00:27 < krzee> umm, what?
00:27 < wookienz> ok must be nat'd, understood.
00:27 < Bushmills> http://scarydevilmonastery.net/snap/xlerb.png
00:27 < krzee> you are using the LAN subnet as the vpn subnet?
00:27 < krzee> are you bridging?
00:27 < crocket> Bushmills, 1) dhcpcd doesn't have an option to change the file to which DNS nameservers are recorded. 2) With 1) in mind, making dnsmasq refer to another resolv file is futile.
00:27 < wookienz> i am using thelan sybnet as the real eth ip, the tunnel is created using a diff subnet. Yes im using bridging.
00:27 < krzee> ok stop
00:28 < crocket> You wouldn't suggest me to keep a separate source code repository for dhcpcd just to add an option to change the resolv file of dhcpcd.
00:28 < wookienz> must spell better!
00:28 < krzee> what layer2 protocol do you need over your vpn?
00:28 < Bushmills> crocket: stop it. you explained in so many lines already why you think that dhcp or fiddling is somehow affected by this
00:28 < Bushmills> means, were just back at the beginning of the whole thread
00:29 < Bushmills> which i then tried to conclude with   (07:13:47) Bushmills: i don't want to push you into a configuration of which you feel it somehow reduces the usefulness of your system, even if i think that it solves the problem you have already identified
00:29 < Bushmills> just don't use it.
00:29 < krzee> wookienz, if all you want is:  <wookienz> I would like to access the internet over my VPN 
00:29 < krzee> then do not use a bridge
00:30 < krzee> just use something like this
00:30 < krzee> !sample
00:30 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
00:30 < wookienz> krzee: maybe nfs and smb - they layer 3
00:30 < wookienz> ?
00:30 < krzee> with your redirect-gateway option in there somewhere
00:30 < krzee> nfs is ip, smb is ip, for smb name resolution (NETBIOS)  you would need wins
00:30 < krzee> !wins
00:30 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
00:31 < krzee> its a single config option to enable wins ;)
00:31 < wookienz> no need for wins
00:31 < wookienz> what layer is ip?
00:31 < krzee> 3
00:31 < wookienz> my OSI knowledge is lacking!
00:31 < wookienz> ok so a simple tun is sufficient?
00:31 < krzee> yep
00:32 < wookienz> ok... so far i can connect to the vpn server, looks like a route is in place, i just cant ping anything.
00:32 < krzee> and more efficient / more secure from the inside
00:32 < wookienz> krzee - i will move to non bridging just wanting to know if i can fix what i have so far..
00:33 < krzee> i dont help with bridges
00:33 < wookienz> you hate them that much!!
00:33 < krzee> if you cant ping anything, it may be a problem with that
00:33 < krzee> in fact likely is
00:33 < krzee> heh
00:33 < krzee> switch to a normal tun setup and you will at least ping the vpn server easily
00:34 < krzee> then its just a matter of 2 correct things on the server
00:34 < wookienz> essentially all im trying to do it have a secure interet browsing experience when using non secured hotel wifi when i travel the world!
00:34 < wookienz> and ftp, email etc
00:34 < krzee> that is all IP traffic
00:34 < krzee> tun
00:34 < wookienz> ok tun it is!
00:34 < Bushmills> krzee: does vpnhelper log calls for factoids which it doesn't know about?
00:35 < krzee> prolly
00:35 < wookienz> hmm..will need to unwind some stuff before i can go forward with tun. ie remove bridges.
00:35 < krzee> he does complain when it happens
00:35 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 248 seconds]
00:36 < Bushmills> so running that list through   sort | uniq -c | sort -n   would yield a sorted list of factoids not accounted for (sorted by invocation count)
00:37 < krzee> !learn nsupdate as http://scarydevilmonastery.net/client_connect_nsupdate for a script Bushmills wrote to solve the question "How can my vpn update my nameserver?"
00:37 <@vpnHelper> Joo got it.
00:44 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
00:46 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has joined #openvpn
00:51 < kunago> Could someone give me a hint why I might be receiving "Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:4: topology (2.0.5)"? My VPN server is version 2.1.1 and the client is 2.0.5 as stated in the error message. The configs are the following - http://pastebin.com/Kw7gfyqN
00:52 < Bushmills> because client is too old
00:52 < Bushmills> 2.1.1 server defaults to topology subnet
00:53 < kunago> Is there anything I can change in the config to make it work properly?
00:53 < krzee> Bushmills, you sure?
00:53 < krzee> Bushmills, i dont think it does
00:54 < krzee> that change should be coming soon, but wasnt 2.1.1
00:54 < krzee> (default)
00:54 < krzee> and kunago do you know how old 2.0.5 is!?
00:55 < Bushmills> net30 was default with 2.0 - i thought it implied that the switch to subnet was therefore done with 2,1
00:56 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
00:56 < krzee> nah you still have the enable it
00:56 < kunago> krzee: Yes, I do but have not found yet a newer USB-stick-ready version that I am using with my Asus WL-500gp.
00:56 < Bushmills> hm. why would 2.0.5 client then complain about a topology which it should know about?
00:57 < krzee> because now 2.1.1 SAYS its topology net30 maybe
00:57 < krzee> whereas maybe before it didnt bother
00:57 < krzee> i mean we're talking about verrrrrrrrrry old code here
00:58 < Bushmills> ah .. that  --topology option itself wasn't supported before 2.1?
00:58 < krzee> 2006
00:59 < krzee> Bushmills, he wouldnt get that error with 2.0.9 without topology subnet
00:59 < Bushmills> "... or 2.0.x which has been manually patched with the --topology directive code. "  - right
00:59 < krzee> but that error doesnt say anything bout subnet
00:59 < krzee> the error would be slightly different
01:00 < krzee> it doesnt even know "topology"
01:01 < Bushmills> as in "it's not that the beer is luke warm - it is that there is no beer at all"
01:01 < kunago> If I understand it right, the only thing I can do is switch the client for the 2.1.x version.
01:01 < krzee> oh no, that is the same error
01:02 < krzee> kunago, try putting this in the server config
01:02 < krzee> topology net30
01:02 < krzee> and show me the part that looks like this from your client config:
01:02 < krzee> Thu Apr  2 16:04:55 2009 PUSH: Received control message: 'PUSH_REPLY,route 1.0.0.0 255.0.0.0,dhcp-option DNS 1.254.2.2,dhcp-option DNS 1.254.2.3,dhcp-option DOMAIN vpn,explicit-exit-notify 2,route-gateway 1.2.124.1,topology subnet,ping 10,ping-restart 60,ifconfig 1.2.124.100 255.255.255.0'
01:03  * Bushmills suspiciously eyes "topology subnet"
01:03 < krzee> that was from my google
01:04 < krzee> i saw that the error WAS the same as youd expect from topology subnet
01:04 < kunago> krzee: Complete configs for both, server and client are to be found here - http://pastebin.com/Kw7gfyqN
01:04 < krzee> but his configs didnt have it from his pastebin
01:04 < krzee> i didnt ask for your configs, i asked for that line from the client log
01:04 < krzee> init scripts can pass args to openvpn while its called as well
01:04 < krzee> a config is not necessarily the whole story
01:05 < Bushmills> kunago: asus wl500?   openwrt?
01:06 < kunago> Bushmills: No, slightly different firmware, should be based on this - http://oleg.wl500g.info/. And since VPN is not included I need to start it from a USB stick plugged in the router.
01:06 <@vpnHelper> Title: ASUS WL-500g custom firmware page (at oleg.wl500g.info)
01:07 < Bushmills> openvpn - 2.1.1-1 - Open source VPN solution using SSL   <-  backfire version
01:09 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
01:12 < crocket> Bushmills, I just decided to modify /lib/dhcpcd/dhcpcd-hooks/20-resolv.conf to save upstream server information somewhere else and let dnsmasq extract the information from it.
01:12 < krzee> http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#I_m_getting_the_following_error:_Options_error:_Unrecognized_option_or_missing_parameter(s)_in_[PUSH-OPTIONS]:3:_topology
01:12 <@vpnHelper> Title: OpenVPN/FAQ - Secure Computing Wiki (at www.secure-computing.net)
01:12 < krzee> This error means that you're connecting to an OpenVPN server running 2.1 with the --topology option, from a client, probably 2.0.9 or earlier, which does not support that option.
01:13 < Bushmills> sorry, i'm not interested in learning about your workarounds for "the right thing"
01:14 < kunago> krzee: I saw this, however, as you could see in the config files, there is no topology option.
01:14 < krzee> ya thats pretty special, you wrote the program for him and he still hacked it up weirdly
01:14 < krzee> kunago, show me the line i asked you for from your client log
01:15 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
01:16 < kunago> krzee: I just got it now: "PUSH: Received control message: 'PUSH_REPLY,route 172.17.1.0 255.255.255.0,route 172.17.2.0 255.255.255.0,route 172.17.10.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 172.17.10.6 172.17.10.5'"
01:16 <@vpnHelper> RSS Update - forum: Random MAC address generation? <http://forums.openvpn.net/topic7866.html#p10846>
01:16 < krzee> ok, that does it
01:16 < krzee> you can not connect to a 2.1 server
01:16 < krzee> even topology net30 set you off
01:16 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
01:16 < krzee> maybe you could actually tho, just ignore ALL pushed options and set everything manually
01:17 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
01:17 < krzee> you have the things to add in a nice list right there
01:17 < hyper_ch> hi krzee
01:17 < krzee> use a static ip and add all of those to your client config, along with nopull
01:17 < krzee> !static
01:17 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
01:18 < krzee> hey hyper_ch 
01:18 < krzee> kunago is running 2.0.5 =]
01:18 < hyper_ch> krzee: I got com krzie news :)
01:19 < kunago> krzee: The odd thing is that I can actually connect from that router to any device on VPN.
01:19 < krzee> oh so it doesnt die at the error?
01:20 < krzee> it completes fine and has no problems?
01:20 < krzee> (ie there is no problem?)
01:20 < kunago> Yes, it runs fine actually but there are some performance issues (slow connection) so was wondering whether that might be something I should address.
01:22 < krzee>  
01:22 < krzee> fragment 1300
01:22 < krzee> mssfix 1300
01:22 <@vpnHelper> RSS Update - forum: openvpn 2.2RC(now is 2.2RC2) can't run as server ? <http://forums.openvpn.net/topic7751.html#p10848> || How to setup open vpn server for Win XP <http://forums.openvpn.net/topic7868.html#p10847>
01:22 < krzee> why do you have those?
01:22 < kunago> krzee: Because I was receiving mtu errors.
01:23 < kunago> What I did is based on this advice: http://openvpn.net/index.php/open-source/faq/77-server/271-i-can-ping-through-the-tunnel-but-any-real-work-causes-it-to-lock-up-is-this-an-mtu-problem.html
01:23 <@vpnHelper> Title: I can ping through the tunnel, but any real work causes it to lock up. Is this an MTU problem? (at openvpn.net)
01:26 < krzee> try
01:26 < krzee> !mtu
01:26 < krzee> kudos on giving a faq link to back it up tho
01:26  * krzee kicks vpnHelper 
01:26 < krzee> !factoids search mtu
01:28 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
01:28 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
01:28 -!- mode/#openvpn [+o vpnHelper] by ChanServ
01:28 < kunago> krzee: I also tried mtu-test to find the proper mtu value but it was never able to finish properly. Therefore I did some tests with ping to find the value and incorporated "mtu 1500, tun-mtu-extra 32, mssfix 1400". There was no change in performance.
01:30 < krzee> then i guess you're boned on that part
01:30 < krzee> i dunno much about mtu tuning, never had an opertunity to need to do it
01:31 < krzee> running 2.0.5 im not surprised it didnt finish
01:31 < krzee> hehe
01:32 < kunago> Well if I manage to find a newer version running from a USB stick I will update it of course. But till then I agree on the "boned" part. :-)
01:34 <@vpnHelper> RSS Update - forum: This is how I am trying to set it up ... <http://forums.openvpn.net/topic7863.html#p10850>
01:43 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:52 -!- rajkosto [bitrot@cable-94-189-156-187.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
01:58 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has left #openvpn []
01:59 < wookienz> ok im back. i think i have it set up almost close to correct! I have found myself an unsecured network to connect to and can test the tun through the firewall back to my vpn server. The tunnel is successful in being created but route and pinging not happening.
02:00 < wookienz> error on client side - openvpn needs a gateay aprameter for a --route option and no deault was specified by either --route-gateway or --ifconfig
02:01 < wookienz> also i get NOTE: unable to redirect default gateway --route-gateway or --ifconfig is missing
02:01 < wookienz> sevrer side doesnt seem to report any errors on ocnnection through the log.
02:07 < krzee> !configs
02:07 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
02:07 < krzee> !logs
02:07 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
02:19 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
02:21 -!- rajkosto [~rajkosto@cpc7-live23-2-0-cust180.know.cable.virginmedia.com] has joined #openvpn
02:21 < rajkosto> uhhh
02:22 < wookienz> is there a default log or do i have to tell the client.conf file explicity where to log?
02:24 < wookienz> server.conf - http://pastebin.com/2vCNRmd4
02:26 < krzee> !logfile
02:26 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
02:26 < rajkosto> wtf is up with ths routing problem i have
02:27 < rajkosto> 1st hop is openvpn server ip
02:28 < krzee> wookienz, you are mixing ptp config and server config, remove lines 3,4,26 and add server 10.8.0.0 255.255.255.0
02:28 < rajkosto> and then the next 2 is the hop needed to get to the server ip
02:28 < rajkosto> for any ip i traceroute
02:33 < wookienz> krzee: legend, i can ping vpn server, vpn server LAN nic, but not gateway connected to the VPN server LAn nic. routeing issue on the firewall to get back to the vpn server?
02:33 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
02:33 < Dudinin> !welcome
02:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:33 < krzee> wookienz,
02:33 < krzee> !route_outside_ovpn
02:33 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
02:34 -!- cpf_ [~cpf@reehorst1.customer.bit.nl] has quit [Ping timeout: 252 seconds]
02:34 < Dudinin> !howto
02:34 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
02:36 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:36 < wookienz> krzee: you must use those alot to have so many at your fingertips! thanks for your help, ill go do some more reading.
02:37 < krzee> wookienz, i made them
02:38 < rajkosto> krzee, what about the reverse ips in the howto
02:38 < krzee> np
02:39 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Quit: Leaving]
02:39 -!- dazo_afk is now known as dazo
02:42 < wookienz> O I C
02:42 < wookienz> !
02:44 < wookienz> that graph makes things a lot easier to understand!
02:49 < wookienz> NAt not runing yet so that will be why it is isnt pinging gatewya on vpn server side, reverse route back to vpn server from gateway has been added hwoever.
03:02 -!- Rajko [~rajkosto@cable-94-189-156-187.dynamic.sbb.rs] has joined #openvpn
03:04 < krzee> make sure your server has ip forwarding enabled as well
03:05 -!- rajkosto [~rajkosto@cpc7-live23-2-0-cust180.know.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
03:09 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
03:15 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
03:17 -!- d457k is now known as d303k
03:18 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
03:25 -!- cpf_ [~cpf@reehorst2.customer.bit.nl] has joined #openvpn
03:27 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
03:27 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
03:27 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:38 -!- teddz [~teddz@dtmd-4db22214.pool.mediaWays.net] has joined #openvpn
03:45 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
03:46 < crocket> I'm on top of this world!!!
03:47 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
03:47 < hyper_ch> top, bottom, all the same
03:50 -!- Guifort_ [~Guifort@ks367821.kimsufi.com] has joined #openvpn
03:51 -!- Guifort_ [~Guifort@ks367821.kimsufi.com] has quit [Client Quit]
03:55 -!- Guifort [~Guifort@ks367821.kimsufi.com] has joined #openvpn
03:56 < Guifort> !welcome
03:56 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:56 < Guifort> !goal
03:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:57 < Guifort> Hello All
03:59 < Guifort> I have a little problem with OpenVPN only on a 3G Network, on Wifi It work fine. I start openvpn the connection is etablished quickly (Green Openvpn GUI) but I can't ping the gateway or any other host.
03:59 < Guifort> I must restart the connection one time or more and it work.
04:02 < janjust> Hi Guifort , are you using 'redirect-gateway' at all?
04:04 -!- Guifort_ [~Guifort@ks367821.kimsufi.com] has joined #openvpn
04:04 < Guifort_> Re, Yes  I use the option redirect-gateway
04:05 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:05 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:05 < janjust> that option sometimes causes problems with 3G networks; make sure you're using 'redirect-gateway def1'
04:05 < Guifort_> what mean def1 ?
04:05 < janjust> !def1
04:05 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
04:06 < Guifort_> Ok, thanks
04:06 -!- Guifort [~Guifort@ks367821.kimsufi.com] has quit [Ping timeout: 246 seconds]
04:06 -!- Guifort_ is now known as Guifort
04:09 < Guifort> I disconnect for try, Goodbye
04:10 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
04:15 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
04:16 -!- newmember [~chatzilla@wsip-70-164-129-114.lv.lv.cox.net] has quit [Remote host closed the connection]
04:25 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Read error: Operation timed out]
04:26 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:26 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:26 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:27 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:27 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:36 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 246 seconds]
04:41 -!- Guest85644 is now known as stony
04:42 -!- Guifort [~Guifort@ks367821.kimsufi.com] has quit [Quit: Quitte]
04:43 < crocket> People
04:44 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:54 -!- EugeneKay is now known as EugeneKaway
04:55 < wookienz> wheni add in NAT to my iptables, iptables -L should show the rules should it not? Presently it is blank!
04:57 < janjust> wookienz:  try 'iptables -t nat -L'
05:04 < wookienz> can see postrouting, prerouting etc but no rules under them
05:05 < janjust> then NATting is not enabled; how did you add it ?
05:06 < wookienz> "/sbin/iptables -P FORWARD ACCEPT" and "/sbin/iptables --table nat -A POSTROUTING -o eth1 -j MASQUERADE"
05:06 < wookienz> eth0 actually.
05:07 < janjust> try 'iptables -t nat -L -n -v'
05:10 < wookienz> still blank.
05:11 < Bushmills> did you added the rules as root, or did you reboot since you added them?
05:11 < Bushmills> did you add ...
05:12 < wookienz> root yes, rebooted yes, but re added them and they are in rc.local
05:14 < Bushmills> why did you (try to) re-add them when they are added in rc.local?
05:17 < wookienz> because iptables -L wasnt showing them
05:18 < Bushmills> what is the error message shown when you try to add them?
05:20 < wookienz> ok hold the phone.......too mnay ssh windows open!
05:21 < wookienz> right.. ok iptables, on the correct box, shows what look slike the correct settings... now to see if vpn vlinet can see it and ping outside
05:31 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
05:32 -!- Guifort [~Guifort@ks367821.kimsufi.com] has joined #openvpn
05:33 -!- rajkosto [~rajkosto@cable-94-189-156-187.dynamic.sbb.rs] has joined #openvpn
05:35 -!- Rajko [~rajkosto@cable-94-189-156-187.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
05:37 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
06:11 -!- luneff [~yury@84.51.195.188] has joined #openvpn
06:17 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has joined #openvpn
06:17 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has quit [Changing host]
06:17 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
06:20 -!- Guifort [~Guifort@ks367821.kimsufi.com] has quit [Ping timeout: 252 seconds]
06:29 -!- Netsplit *.net <-> *.split quits: Rolybrau
06:31 -!- Netsplit over, joins: Rolybrau
06:41 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
06:46 -!- lkeijser [~me@fedora/lkeijser] has joined #openvpn
06:47 < lkeijser> hi, i'm having troubles with Mac (OSX) clients. They experience a very slow/instable connection, while Linux and Windows users have no problems
06:47 < lkeijser> anyone has experience with this?
06:53 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
06:57 < jpalmer> !book
06:57 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
07:15 -!- rolls [~rollin@190.120.228.48] has quit [Quit: rolls rolls out]
07:16 -!- rolls [~rollin@190.120.228.48] has joined #openvpn
07:16 -!- rolls [~rollin@190.120.228.48] has left #openvpn []
07:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
07:26 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:26 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:27 -!- lkeijser [~me@fedora/lkeijser] has quit [Read error: Operation timed out]
07:33 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
07:52 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
08:12 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:27 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
08:39 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
08:39 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
08:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:40 < cwesterfield> Bushmills, you around?
08:44 < cwesterfield> I'll ask the room: I'm trying to get a tunnel going to my home server, I have all the certs and such in place, and ethernet bridging is working (I can connect to home smb shares)
08:45 < cwesterfield> my problem is dns, Bushmills suggested using a recursive dns server (maradns (deadwood) ), and I have that setup but I don't know wht to put in my client config to point to the deadwood server
08:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
08:53 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:59 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 248 seconds]
09:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:04 <@vpnHelper> RSS Update - forum: How do I connect to PC while it is running in client mode? <http://forums.openvpn.net/topic7869.html>
09:06 < cwesterfield> !goal
09:06 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:06 < cwesterfield> !wecome
09:06 < cwesterfield> !welcome
09:06 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:07 < cwesterfield> !goal To use Openvpn to tunnel all traffic and to push the client to use a recursive dns server on the server machine
09:08 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
09:13 < Bushmills> cwesterfield: if you can reach the name server even without openvpn, you could think of setting it permanently in /etc/resolv.conf. if you run openvpn with redirection all the time, you can do the same.  otherwise, push dhcp-option dns
09:14 < Bushmills> with unixoid clients, you probably want an --up and --down script, to introduce the pushed name server address into resolv.conf
09:19 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
09:22 -!- cpf_ [~cpf@reehorst2.customer.bit.nl] has quit [Ping timeout: 248 seconds]
09:22 < cwesterfield> is there a dig equiv for windows?
09:22 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
09:22 < dkr> nslookup
09:23 < cwesterfield> Bushmills, isn't the push dhcp-option windows only?
09:23 < cwesterfield> thanks dkr
09:23 < dkr> no
09:23 < Bushmills> not the option. but how the clients respond to it
09:24 < dkr> !redirect
09:24 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
09:24 < cwesterfield> ahh, comprehension for the win
09:25 < Bushmills> that's why you'd use an --up script on non-windows
09:25 < Bushmills> http://scarydevilmonastery.net/snap/1301495090698978863d.png 
09:26 < cwesterfield> I only want to use the dns while connected
09:27 < cwesterfield> I think deadwood is configured incorrectly, is this the correct nslookup command? nslookup yahoo.com 127.0.0.1
09:27 < Bushmills> that means you want to switch between name servers. 
09:28 < Bushmills> use dig instead of nslookup
09:28 < cwesterfield> is there dig for windows?
09:30 < Bushmills> yes
09:31 < Bushmills> http://www.techrepublic.com/article/use-dig-to-administer-windows-dns-servers/5032892
09:31 <@vpnHelper> Title: Use DIG to administer Windows DNS servers | TechRepublic (at www.techrepublic.com)
09:32 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
09:34 <@vpnHelper> RSS Update - forum: How do I connect to PC while it is running in client mode? <http://forums.openvpn.net/topic7869.html#p10852>
09:37 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
09:38 < cwesterfield> it'll take a minute to install
09:39 < genesis7> good day. sorry I not familiar with openvpn in linux. I just would like to ask, I have not create a firewall rule nor edited a firewall rule for openvpn. May i just where to find the default firewall rule used so that I can change/edit it. thanks.
09:41 < Bushmills> there is no default firewall rule
09:41 < dkr> genesis7: there is no firewall rule byd efault
09:41 < Bushmills> there are default policies, which are ACCEPT
09:42 < dkr> hrm, well, I suppose it depends on what linux distro.  but nothing openvpn does creates fw rules
09:44 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
09:46 -!- teddz [~teddz@dtmd-4db22214.pool.mediaWays.net] has quit [Quit: Ex-Chat]
09:46 < genesis7> if I run vps and I have not create a firewall, where can I find that firewall config?
09:46 < genesis7> bushmills, if I run vps and I have not create a firewall, where can I find that firewall config?
09:47 < genesis7> im using centos
09:47 < Bushmills> as long that you haven't created one, there isn't one
09:48 < Bushmills> maybe a package you installed created one. 
09:48 < genesis7> if i have already created one, where to find it bushmills?
09:48 < Bushmills> if that happened, it depends on the package where it is
09:48 < Bushmills> how should i know where you put your configurations?
09:48 < Bushmills> probably there where you have written it to
09:49 < genesis7> what is the name of the firewall rule config? depends on me too?
09:49 < Bushmills> do you know where my firewall configuration is?
09:49 < Bushmills> do you know what name if gave it?
09:49 < Bushmills> ... i gave it?
09:50 < Bushmills> "i have create a file. what is its name, and where is it" 
09:50 < Bushmills> created
09:50 < genesis7> sorry, just asking because I dont know where to find it. I even dont know how to create one yet.
09:51 < genesis7> thanks for the time though. I appreciate it.
09:51 -!- genesis7 [~genesis7@amertospromotions.com] has left #openvpn []
09:51 < Bushmills> "if i have already created one," ... " I even dont know how to create one yet."   ... makes totally sense
09:51 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
09:52 -!- johnfg [johnfg@spirit.org] has joined #openvpn
09:52 < johnfg> hi folks
09:53 < johnfg> Well, I wrote /etc/openvpn/ipp.txt with the name of my win xp pro machines and the ip I wanted them to have: 10.8.0.6; and 10.8.0.10.  But when I checked this morning, the ipp.txt is empty and there numbers are 10.8.0.14 and 10.8.0.18!
09:54 < johnfg> Obviously, there's something else I need to do, but what?
09:54 < Bushmills> you intend to assign static addresses to clients?
09:54 < johnfg> I'd like to have those machines assigned numbers, if possible.
09:54 < johnfg> Bushmills, Yeah, for ease of a few tasks.
09:54 < Bushmills> "number" as in "ip address"?
09:54 < Bushmills> !ccd
09:54 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
09:55 < Bushmills> ifconfig-push the desired address to client from the ccd file
09:55 < johnfg> Bushmills, yes, sorry, ip numbers.  That way, after I've mapped drives on the debian server, I won't have to disconnect them, and redo them with whatever ip's have been assigned.
09:57 < Bushmills> "common-name" in factoid is a variable, and means "the name you specified as CN in the cert"
09:58 < cwesterfield> dig installed, deadwood not working. I'm reading the readme to see what i missed
09:58 < cwesterfield> here's the deadwood config: http://pastie.org/1735409
09:59 < Bushmills> 10.0.1.200 is the address of a vpn virtual interface, like tun0?
10:00 < cwesterfield> its the open vpn interface
10:01 < cwesterfield> the Bridge
10:01 < Bushmills> with that recursive_acl = "10.0.1.0/24", you can query the name server only from other vpn clients, and from vpn server, right?
10:02 < Bushmills> not from localhost, as  address of lo doesn't appear in acl permitting recursive query
10:02 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:02 < cwesterfield> my understanding is any machines with the 10.0.1.X address
10:02 < cwesterfield> with bridging is everyone
10:03 < Bushmills> and 10.0.1.200 can access internet?
10:04 < Bushmills> "any machines with the 10.0.1.X address" .. except 10.0.1.200  - that machine won't talk to itself over vpn
10:04 < Bushmills> instead, it will talk to itself over loopback device, probably 127.0.0.1
10:04 < cwesterfield> 10.0.1.200 has outside access, but it's through the bridge from the actual network card, if that makes sense
10:05 < Bushmills> as long as it can reach outside, it should be fine
10:05 < Bushmills> (and replies returning to that machine, of course)
10:05 < cwesterfield> http://img98.imageshack.us/i/screenhunter02mar301005.jpg/
10:05 <@vpnHelper> Title: ImageShack - Online Photo and Video Hosting (at img98.imageshack.us)
10:06 < Bushmills> but that look ok
10:06 < cwesterfield> well I can get to the internet from that machine and I can connect to the machine from my work computer
10:06 < cwesterfield> so i think that is indicative of a connection
10:07 < Bushmills> you have been returned the ip address of yahoo.com, as requested, that localhost doesn't reply is due to what i told you above
10:08 < Bushmills> ehm. sorry. not seen that first call wasn't replied to
10:08 < Bushmills> firewall, or name server not running
10:09 < Bushmills> i assume you run dig on a different machine than 10.0.1.200 
10:09 < cwesterfield> the service is running, should the recursive_acl also have 127.0.0.1
10:09 < Bushmills> if you want to be able to query name server from 10.0.1.200 too, yes
10:10 < Bushmills> though it shouldn't reply with "no server could be reached"
10:10 < Bushmills> your tcp/udp 53 ports may be firewalled
10:11 < cwesterfield> firewall is off, and I think it defaults to port 4096
10:11 < johnfg> Bushmills, So in my case, I'll create /etc/openvpn/bca-pc; add a line: client-config-dir bca-pc; and have the file bca-pc with the line: iroute 10.8.0.6.
10:11 < johnfg> Add the line to server.conf.
10:12 < johnfg> And add the route line to server.conf: route 10.8.0.6.
10:12 < johnfg> Do I need to have the netmask?
10:13 < cwesterfield> default is 53, just found the documentation
10:13 < cwesterfield> let me run dig on my mac
10:13 < Bushmills> johnfg: no. you create a directory, which you specify in config. into that directory, you put that file
10:13 < Bushmills> what you wanted to put into that file goes into openvpn config instead
10:14 < Bushmills> and instead you ...  (16:55:45) Bushmills: ifconfig-push the desired address to client from the ccd file
10:15 < Bushmills> or, better yet, reread:
10:15 < Bushmills> !ccd
10:15 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
10:15 < Bushmills> and the relevant section in the man page
10:15 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
10:15 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
10:15 < johnfg> OK, I think it was my funky syntax that didn't make sense.  I make a directory: /etc/openvpn/bca-pc.
10:16 < Bushmills> "...and have the file bca-pc with the line..."
10:17 -!- bauruine_ [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Remote host closed the connection]
10:17 < johnfg> I created a file bca-pc with the line iroute 10.8.0.6.
10:17 < Bushmills> frequently folks name that directory simply "ccd" but it's entirely your choice, of course
10:17 < Bushmills> '
10:18 < johnfg> Bushmills, I'm looking at the openvpn HOWTO, also, and that was a little confusing to me, but you're right.
10:18 <@vpnHelper> RSS Update - forum: How do I connect to PC while it is running in client mode? <http://forums.openvpn.net/topic7869.html#p10853>
10:19 < johnfg> So, was the line: 'iroute 10.8.0.6' all that I need in the /etc/openvpn/ccd/bca-pc file for what I want to do?
10:21 < johnfg> Bushmills, Does it matter where, in my server.conf I have the client-config-dir ccd?
10:23 < Bushmills> no, not important
10:23 < johnfg> Do I need the netmask?
10:24 < johnfg> i.e., in the bca-pc file?
10:25 < Bushmills> with routed config, you'd use  clientaddr ptpaddr.   with bridged config, you use clientaddr netmask
10:25 < Bushmills> with subnet topo, you can also use server ip address as second addres in routed config
10:26 < Bushmills> that may fail on windows
10:27 < johnfg> Here's what's in the log now, from when the win machines connected last night:
10:27 < johnfg> 10.8.0.18,bca-pc,75.175.136.170:1314,Tue Mar 29 20:49:33 2011
10:28 < johnfg> That's before I added the ccd stuff.
10:30 < cwesterfield> this is on my work computer, while connected to the openvpn server at home. I don't think this is a good representation though, as my client config could be messed up: http://img508.imageshack.us/i/screenshot20110330at102.png/
10:30 <@vpnHelper> Title: ImageShack - Online Photo and Video Hosting (at img508.imageshack.us)
10:30 < cwesterfield> I think I'll add 127.0.0.1 to the recursive acl for testing
10:31 -!- kuku2 is now known as kuku
10:34 < johnfg> Bushmills, Since I've got, at present, 2 clients, will the separate route lines in server.conf be enough to distinguish them?
10:34 < cwesterfield> okay, I can now test thas Deadwood is working: http://img839.imageshack.us/i/screenhunter03mar301033.jpg/ http://pastie.org/1735409
10:34 <@vpnHelper> Title: ImageShack - Online Photo and Video Hosting (at img839.imageshack.us)
10:34 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Read error: Connection reset by peer]
10:34 < Bushmills> johnfg: you don't need that
10:35 -!- gladiatr_afk is now known as gladiatr
10:35 < Bushmills> clients are distinguished by their CN which is used to determine which file is loaded from ccd directory
10:35 < Bushmills> cwesterfield: voila
10:36 < Bushmills> re-request, and enjoy the benefits of caching
10:36 < Bushmills> ( the "Query time:" line )
10:37 < cwesterfield> so now i add push "dhcp-option DNS 10.0.1.200" to my server config
10:37 < cwesterfield> what do i add to client config?
10:37 < Bushmills> looks good
10:37 < johnfg> Bushmills, How do I tell what is the number for the netmask after 255.255.255.???
10:38 < johnfg> So, for 10.8.0.6 and 10.8.0.10?
10:38 < Bushmills> windows clients: probably nothing.  unixoid clients: an up script which reads pushed name server from environment, and introduces it into resolv.conf
10:38 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
10:39 < Bushmills> johnfg: routed or bridged?
10:39 < crocket> Does OpenVPN use IPsec partly?
10:39 < Bushmills> nope
10:39 < gladiatr> HAHAHAHAHA!  sorry.  no.  no it does not.
10:39 < gladiatr> (lilbabygzuzbepraised)
10:40 < johnfg> Bushmills, routed.
10:40 < Bushmills> no netmask. a p2p address
10:40 < Bushmills> one less than ip address would do
10:40 < johnfg> Would you type an example, please?
10:41 < Bushmills> 10.8.0.5
10:42 < Bushmills> btw,  http://scarydevilmonastery.net/subnet.cgi
10:42 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
10:43 < Bushmills> i guess 50% of world installed openvpn configurations use 10.8.0.0 network now :)
10:43 < gladiatr> Indeed.  the OpenVPN version of the lord's prayer
10:44 < johnfg> Bushmills, I'll keep the subnet in mind that the monastery suggested :-)
10:44 < Bushmills> it randomises
10:44  * dazo dares Bushmills to suggest 127.0.0.0/24 next time
10:45 < gladiatr> April 1 is Friday, after all...
10:45 < dazo> good point!
10:45 < johnfg> Bushmills, So,still not sure about the line in server.conf.  I added client-config-dir ccd, but with I have in my client files, what would be the line for the route?
10:45 < Bushmills> what route?
10:46 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
10:46 < johnfg> Ok: /etc/openvpn/ccd/bca-pc has: iroute 10.8.0.6 10.8.0.5.
10:46 < Bushmills> why is that?
10:47 < johnfg> So don't I need a route line in server.conf?
10:47 < Bushmills> well, you need one, but not an additional one. the route statement you supposedly had there before will still do, ccd changes nothing about that
10:47 < genesis7> can I butt-in? how can i remove firewall rules from the iptables?
10:48 < Bushmills> you set policies to ACCEPT, then flush the tables, and remove the user chains
10:49 < genesis7> how to flush and remove the user chains? whats the command for those!
10:49 < dazo> genesis7: man iptables
10:49 < Bushmills> i am not your man page
10:49 < genesis7> man page. let me see
10:50 < cwesterfield> well for whats it worth, i think i have a great setup for windows tunneling, but I'm scrapping it all because I have no idea how to do up commands on a phone
10:50 < cwesterfield> Thanks Bushmills, I learned a good deal
10:51 < Bushmills> most importantly, you're using dig instead of nslookup now :D
10:51 -!- genesis7 [~genesis7@amertospromotions.com] has quit [Client Quit]
10:52 < johnfg> Bushmills, I think I was saying what I was "going to do",not what I'd done, as far as a route line in server.conf.
10:52 < crocket> When I route OpenVPN packets via UDP, it is really slow.
10:52 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
10:53 < genesis7> is it good to push SYN flodding protecting rules in the iptables?
10:53 < Bushmills> johnfg: you want to ifconfig-push the static ip addresses to clients, rather than assigning them from the ip pool. that's about all what differs
10:53 < crocket> NFS transfer over 1194 UDP peaks at 4MB/s, but it stops for 40sec~1min before it bursts for a few seconds at ~4MB/s again.
10:54 < crocket> If I use 1194 TCP port to estalibhs a tunnel, the speed is steady.
10:54 < Bushmills> genesis7: can be good, if you're target of syn floods
10:54 < johnfg> Bushmills, after a restart of the server, both clients have been assigned, I guess through the ccd file, the addresses I wanted them to have.
10:54 < genesis7> how do you know or detect that you're target of syn floods?
10:55 < johnfg> But to make sure, should I use the ifconfig-push?
10:55 < Bushmills> you could add a stub rule to iptables, as traffic counter 
10:56 < Bushmills> johnfg: if you want changing addresses from the ip pool assigned to clients, you should not use ifconfig-push 
10:57 < crocket> Does linux have UDP flood defense by default?
10:58 < Bushmills> not to my knowledge
10:58 < Bushmills> but massive flooding you probably want to block as close to the sources as possible
10:58 < johnfg> Bushmills, OK, thanks for all the help.  I'll go through a few reboots, restarts, etc., and see if things are working as I'd like.
10:59 < Bushmills> not at your linux box, but some hops before, in the routers, for example
10:59 -!- genesis7 [~genesis7@amertospromotions.com] has quit []
11:00 < johnfg> This may not be an openvpn question, but...is there a way, since I've got my clients a static cn, and a static ip now, to use the cn instead of the ip, e.g., when mapping a drive?
11:00 < Bushmills> yes
11:00 < johnfg> Bushmills, OK, how?
11:00 < Bushmills> easiest is to add host names and ip addresses to /etc/hosts
11:01 < johnfg> OK.
11:01 < Bushmills> for more advanced solutions, you'd need one or more name servers
11:01 < Bushmills> !nsupdate
11:01 <@vpnHelper> "nsupdate" is http://scarydevilmonastery.net/client_connect_nsupdate for a script Bushmills wrote to solve the question How can my vpn update my nameserver?
11:02 < johnfg> I do have a nameserver: dns.spirit.org.
11:02 < Bushmills> "your" as in "you can configure it"
11:02 < Bushmills> not as in "you can update your zone files" only
11:06 < johnfg> Right, that nameserver's mine.
11:07 < johnfg> spirit.org is mine.
11:07 < Bushmills> ok. if that's bind you're running, the script above may apply to you
11:07 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
11:09 < Bushmills> but with static ip addresses of your clients, you can just as well add approprate A records to your zone file
11:09 < bwallen> I've got my vpn set up and I can connect to it, but I'm having a problem pushing the route on my lan (where the server is) so that my VPN clients can ping other servers. I'm 99% sure that this needs to be done on my lan router, but I don't understand how I should program it
11:09 < Bushmills> no need to dynamically update upon connection - that makes only sense when ip addresses change 
11:09 < Bushmills> or when there is a high fluctuation of clients
11:10 < Bushmills> bwallen: other servers in your LAN, or in internet?
11:12 < bwallen> bushmills: Right now if a client connects to the vpn, he can ping the vpn server and nothing else on that lan. Likewise, servers on the lan can't ping vpn clients. All I really need is for VPN clients to be able to access other servers on the lan
11:12 < bwallen> So to answer your question, other servers on my lan
11:12 < Bushmills> !serverlan
11:12 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
11:13 -!- luneff [~yury@84.51.195.188] has quit [Read error: No route to host]
11:13 < bwallen> thanks, I'll check that out
11:14 < bwallen> !route_outside_openvpn
11:14 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
11:14 < bwallen> !route
11:14 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:17 < johnfg> Thanks again for the help!  ttyl
11:17 -!- johnfg [johnfg@spirit.org] has quit [Quit: Leaving]
11:18 <@vpnHelper> RSS Update - forum: openvpn 2.2RC(now is 2.2RC2) can't run as server ? <http://forums.openvpn.net/topic7751.html#p10854>
11:32 < crocket> I think OpenVPN TCP and UDP modes don't show much performance difference.
11:32 < crocket> They are indistinguishable with regard to  NFS transfer speed.
11:33 -!- cwesterfield [tinman@ip183-71.mmth.WKU.EDU] has left #openvpn []
11:34 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
11:35 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
11:35 < dazo> crocket: that's most like correct, until you begin to get TCP timeouts 
11:35 < dazo> and especially if you're running TCP traffic inside the tunnel
11:36 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
11:36 < crocket> dazo, I get UDP timeouts to the point where I have to abandon UDP mode.
11:37 < crocket> dazo, When I begin NFS transfer within UDP mode, the transfer hangs for a minute.
11:37 < dazo> well, in some networks UDP doesn't work due to routers/firewalls killing the connections ... in this case TCP usually works better
11:38 < dazo> !tcp
11:38 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
11:38 -!- luneff [~yury@84.51.195.188] has joined #openvpn
11:38 < dazo> ^^ that's the recommendation ... but if UDP doesn't work, there's no alternatives :)
11:39 < crocket> My machine definitely doesn't drop UDP packets.
11:39 -!- brianw_ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
11:39 < dazo> it's usually routers/firewalls in between who kills UDP streams after a while
11:40 < crocket> After I transmit 8~12MBytes overNFS in UDP packets, UDP packets can never pass
11:40 < dazo> sometimes it's on the ISP level ... other times, it's crappy/malfunctioning or wrong configured routers/firewalls
11:40 < crocket> for a minute.
11:41 < crocket> dazo, How can I track it?
11:42 < dazo> that I don't know ... except of trying same configs in other environments, different ISP's if possible and so on ... trying to eliminate possible errors in the environment you can control
11:43 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Ping timeout: 264 seconds]
11:46 < dazo> !man
11:46 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!
11:46 < dazo> !learn man as http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
11:46 <@vpnHelper> Joo got it.
11:46 < dazo> !man
11:46 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
11:48 -!- gyyrog [~gyyrog@174.124.186.209] has joined #openvpn
11:49 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
11:52 -!- gyyrog [~gyyrog@174.124.186.209] has quit [Remote host closed the connection]
11:57 -!- brianw_ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
11:57 -!- brianw_ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
11:57 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
11:58 -!- brianw_ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Client Quit]
11:59 -!- dazo is now known as dazo_afk
12:10 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:11 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
12:14 < hyper_ch> http://www.h-online.com/open/news/item/Open-source-vendors-turned-down-by-Swiss-Federal-Supreme-Court-1217728.html  :(
12:14 <@vpnHelper> Title: Open source vendors turned down by Swiss Federal Supreme Court - The H Open Source: News and Features (at www.h-online.com)
12:22 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Read error: Operation timed out]
12:32 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
12:34 -!- rajkosto [~rajkosto@cable-94-189-156-187.dynamic.sbb.rs] has quit [Quit: Leaving]
12:45 -!- mirco [~mirco@p5B23FEBD.dip.t-dialin.net] has joined #openvpn
12:49 -!- mirco [~mirco@p5B23FEBD.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
12:59 <@vpnHelper> RSS Update - forum: VPN Auto-Connection using a standard user in Win7 <http://forums.openvpn.net/topic7870.html>
13:03 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
13:03 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
13:03 -!- mode/#openvpn [+o mattock1] by ChanServ
13:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:05 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Ping timeout: 250 seconds]
13:05 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
13:05 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
13:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
13:07 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:07 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:07 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:08 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
13:10 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
13:14 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:14 -!- greeneye [~chatzilla@50.8.65.151] has joined #openvpn
13:15 < greeneye> !welcome
13:15 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:16 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
13:16 < hyper_ch> hi greeneye
13:22 < greeneye> hiya
13:22 < greeneye> Just looking through the !welcome stuff before I start fireing q's
13:26 < greeneye> !howto
13:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:27 < greeneye> !route
13:27 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:30 < greeneye> Where should I start troubleshooting if my vpn connection is established but my client (10.8.0.6) can't ping my server (10.8.0.1) and visa versa?
13:33 < gladiatr> the firewalls on both the client and server side
13:35 < greeneye> off on both ends
13:40 < greeneye> Seems to have been cause by routing and remote access enabled on the server.  Does that not work with OpenVPN?
13:43 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
13:45 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
13:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:49 < greeneye> !redirect
13:50 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:50 < greeneye> !nate
13:50 < greeneye> !nat
13:50 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:53 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
13:53 < greeneye> !winnat
13:53 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows, or (#2) http://www.nanodocumet.com/?p=14 for windows XP
13:55 -!- icewaterman [NyPxa@unaffiliated/icewaterman] has quit [Quit: segmentation fault]
13:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:58 < gladiatr> greeneye, pastebin your client and server configurations
14:01 -!- luneff [~yury@84.51.201.89] has joined #openvpn
14:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:02 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
14:05 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
14:09 -!- EugeneKaway is now known as EugeneKay
14:13 < greeneye> ## server.ovpn ##
14:13 < greeneye> port 22
14:13 < greeneye> proto udp
14:13 < greeneye> dev tun
14:13 < greeneye> ca ca.crt
14:13 < greeneye> cert widget.crt
14:13 < greeneye> key widget.key
14:13 < greeneye> dh dh1024.pem
14:13 < greeneye> server 10.8.0.0 255.255.255.0
14:13 < greeneye> ifconfig-pool-persist ipp.txt
14:13  * krzie waits for vpnHelper 
14:13 < greeneye> push "route 192.168.0.0 255.255.255.0"
14:13 < greeneye> push "dhcp-option WINS 192.168.1.1"
14:13 < greeneye> push "dhcp-option DNS 192.168.1.1"
14:13 < greeneye> push "dhcp-option DOMAIN acme.com.local"
14:13 < greeneye> keepalive 10 120
14:13 < greeneye> comp-lzo
14:13 < gladiatr> nonono
14:13 < greeneye> max-clients 4
14:13 < gladiatr> pastebin.com
14:13 < greeneye> persist-key
14:13 < greeneye> persist-tun
14:13 < greeneye> status openvpn-status.log
14:13 -!- mode/#openvpn [+o krzee] by ChanServ
14:13 < greeneye> verb 3
14:13 < greeneye> ## acme.ovpn ##
14:13 -!- mode/#openvpn [+o krzie] by ChanServ
14:13 < greeneye> client
14:13 -!- mode/#openvpn [+b *!*chatzilla@50.8.65.*] by krzie
14:13 -!- greeneye was kicked from #openvpn by krzie [greeneye]
14:13 <@krzie> byebye
14:14  * gladiatr sighs
14:14 -!- mode/#openvpn [-oo krzee krzie] by krzie
14:14 < gladiatr> he was doing so well... what with reading the motd and asking the bot for common botisms...
14:14 < krzie> i guess vpnHelper doesnt floodkick anymore
14:14 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 240 seconds]
14:14 -!- mode/#openvpn [+o krzie] by ChanServ
14:14 <@krzie> /ban
14:14 <@krzie> erm
14:15 -!- mode/#openvpn [-b *!*chatzilla@50.8.65.*] by krzie
14:15 -!- mode/#openvpn [-o krzie] by krzie
14:15 -!- krzie [krzee@openvpn/community/support/krzee] has left #openvpn []
14:15 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
14:15 < krzie> hrm, chanserv didnt welcome me =/
14:15 -!- krzie [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
14:15 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
14:16 < krzie> maybe its my spoof or something, or that im on the op list
14:17 -!- Damme [~damme@206.216.95.91.static.ter-s.siw.siwnet.net] has quit [Quit: in /dev/null no one can hear you scream]
14:20 -!- greeneye [~chatzilla@50.8.65.151] has joined #openvpn
14:21 < greeneye> It seems whenever I enable routing and remote access that my server and client can no longer ping each other.   But it takes a couple min after enabling it for that to happen.
14:21 < greeneye> did you get to see all of the client config?
14:22 < gladiatr> !pastebin
14:23 <@vpnHelper> Unable to download feed.
14:23 < gladiatr> Please post your server and client configs to pastebin.com
14:23 < gladiatr> *not* the channel
14:23 < gladiatr> !all
14:23 <@vpnHelper> "all" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#' client.conf`), also include which OS and version of openvpn, include your routing tables, firewall settings and client/server logfiles, or (#2) For more detailed instructions, look to: !logs !configs !interface
14:25 < greeneye> http://pastebin.com/m8qVGjNi
14:26 < gladiatr> What exactly are you talkin' about re: when I enable routing and remote access?
14:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:27 -!- mirco [~mirco@p5B23FEBD.dip.t-dialin.net] has joined #openvpn
14:27 < greeneye> Windows 2003 feature.  When I go in there and right click my server and select configure and enable routing and remote access
14:28 < gladiatr> and the 2003 server is the openvpn server?
14:28 < greeneye> yes
14:28 < gladiatr> show me your routing table as it looks before and after you enable this option.
14:31 < greeneye> I did a before and after here http://pastebin.com/Np2Kww2u
14:31 < greeneye> Note that it hadn't "broken" yet as I could still ping.  The before and after had no differences
14:32 < greeneye> Let me try to brake it and see if it changes
14:32 < gladiatr> ok.
14:34 < gladiatr> while you're at it, please make sure your log level is set to "verb 4" on both ends.  When it breaks, please post your cilent and server logs as well
14:40 < greeneye> Still trying to brake it
14:46 -!- Guifort [~Guifort@ns208662.ovh.net] has joined #openvpn
14:47 < krzie> greeneye, that kick was the warning, pastebin for pasting to the channel
14:48 < krzie> i see you already used pastebin, but felt i should still say it ;]
14:49 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
14:52 < greeneye> Thanks Krzie.  @gladiatr Repo'd thist 5 times today now I'm not having much luck.  I'll keep trying
14:53 < gladiatr> righto
14:53 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
14:56 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
14:56 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
15:01 -!- ldaguilar [~luis@186.176.7.194] has quit [Remote host closed the connection]
15:01 -!- gladiatr is now known as gladiatr_afk
15:16 -!- mirco [~mirco@p5B23FEBD.dip.t-dialin.net] has quit [Quit: mirco]
15:23 < mete> I've a problem with some UDP tunnels. I've running one openvpn server with topology subnet. three clients are connected. when I test the bandwidth with iperf or wget I get from one client 80mbit what is OK. from the other two clients I get only <1mbit... all servers are connected with 100/100mbit to the internet. when I ping the two slow clients I can see, that the ping doesn't work anymore 
15:23 < mete> when I start the bandwidth test (ping timeout)... what can here be the problem?
15:23 < mete> [22:30] <fipu> mete: same as in my case!
15:24 < mete> if I modify server and client configs to use tcp instead of udp, I doesn't have the issue!
15:32 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
15:32 < krzie> maybe a mtu issue
15:32 < krzie> maybe a stateful firewall
15:32 < krzie> maybe ISP throttling UDP
15:32 < krzie> heres how you test mtu
15:32 < krzie> !mtu
15:32 < mete> I've tested mtu
15:32 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
15:32 < krzie> was it that?
15:32 < mete> result was >1500
15:32 < mete> and I've configured mtu to 1500
15:32 < krzie> 1542, right?
15:32 < krzie> in all 4 spots
15:32 < mete> and once for 1300
15:32 < krzie> dont configure mtu unless you know why
15:32 < mete> don't know anymore krzie
15:32 -!- krzie was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
15:32 < mete> krzie: default is 1500.. so currently it is defaulkt
15:32 < mete> ;)
15:32 -!- mete was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
15:32 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:32 < krzie> hah
15:32 < krzie> NOW it kicks
15:33 -!- mode/#openvpn [+o krzie] by ChanServ
15:33 -!- vpnHelper was kicked from #openvpn by krzie [hahahah payback baybee]
15:33 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
15:33 -!- mode/#openvpn [+o vpnHelper] by ChanServ
15:33 -!- mete [~metefr@mete.shell.la] has joined #openvpn
15:33 < mete> re
15:33 < mete> -.-
15:33 -!- mode/#openvpn [-o krzie] by krzie
15:33 -!- purpleidea [~james@bas11-montreal02-1128535980.dsl.bell.ca] has joined #openvpn
15:34 < mete> krzie: should I retest mtu?
15:34 < purpleidea> !welcome
15:34 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:34 < purpleidea> !goal
15:34 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:34 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
15:34 < purpleidea> !goal I would like to have my log be less noisy
15:36 < purpleidea> Hi there, I have a two node bridge (tap0) device created by openvpn. I have an ifcfg-tap0 file which adds it to a br0 device on startup which happens too early in boot process. Is there a way to get openvpn to add tap0 to a bridge when it is connected?
15:37 < mete> krzie: I retest MTU, one moment please
15:37 < mete> :)
15:40 < mete> NOTE: Beginning empirical MTU test -- results should be available in 3 to 4 minutes.
15:45 < mete> krzie: local->remote=[1541,1541] remote->local=[1541,1541]
15:46 < mete> my eth0 interface says it has a mtu of 1500; my tun0 says it has a mtu of 1500
15:46 < mete> so, what should I modify? ;)
15:51 < krzie> heh
15:51 < krzie> you should remove all mtu settings
15:52 < krzie> by changing them you will do more damage than good
15:54 -!- Flops [~Flops@pD952AE4B.dip.t-dialin.net] has joined #openvpn
15:54 < Flops> hi
15:54 < Flops> !welcome
15:54 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:54 < Flops> !redirect
15:54 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:55 < Flops> !def1
15:55 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
15:57 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
15:59 < Flops> !ipforward
15:59 -!- Flops [~Flops@pD952AE4B.dip.t-dialin.net] has left #openvpn []
15:59 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:59 -!- Guifort [~Guifort@ns208662.ovh.net] has quit [Quit: Quitte]
16:00 -!- Flops [~Flops@pD952AE4B.dip.t-dialin.net] has joined #openvpn
16:00 < Flops> !ipforward
16:00 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:00 < Flops> !linipforward
16:00 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:00 < Flops> !nat
16:00 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
16:01 < Flops> Do I have to ipforward on the client or on the server?
16:03 < krzie> on t he server
16:03 < krzie> as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
16:04 < Flops> ok
16:04 < krzie> !linnat
16:04 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
16:05 < Flops> hm
16:05 < Flops> when I try iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
16:05 < Flops> I get an error
16:06 < krzie> invalid table NAT?
16:06 < Flops> iptables: No chain/target/match by that name.
16:07 < Flops> But my eth0 is venet0
16:07 < Flops> gotta change that
16:07 < Flops> hm
16:09 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:10 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
16:11 < Flops> the command doesnt work for me :(
16:11 < krzie> you dont have NAT in your kernel
16:11 < krzie> what VM do you use?
16:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
16:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:12 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:13 < Flops> virtuozzo
16:13 < mete> krzie: I've now removed all MTU settings
16:14 < mete> the problem isn't fixed :(
16:14 < Flops> krzie: Is it still possible then?
16:15 < krzie> Flops, see if the guest can have NAT
16:15 < krzie> if not, maybe you can do it like this:
16:15 < krzie> !openvznat
16:15 < Flops> like the client?
16:15 <@vpnHelper> "openvznat" is a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP>
16:15 < krzie> dude, NO
16:15 < krzie> i answered that already, SERVER
16:15 < krzie> heh
16:15 < Flops> the machine isn't hosted by me
16:16 < krzie> you arent root?
16:16 < Flops> the command worked
16:16 < Flops> I am root in the virtual machine
16:16 < krzie> well the virtual machine is who needs to NAT
16:20 -!- Flops [~Flops@pD952AE4B.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
16:29 -!- greeneye [~chatzilla@50.8.65.151] has quit [Ping timeout: 246 seconds]
16:32 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
16:33 < mete> krzie: I've now removed all MTU settings
16:33 < mete> the problem isn't fixed :(
16:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
16:40 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 264 seconds]
16:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
16:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:54 -!- Vansafe [~asdf@c-67-172-232-12.hsd1.ut.comcast.net] has joined #openvpn
16:54 -!- Vansafe is now known as Greeneye
16:55 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:56 < Greeneye> I have a quick question for anyone.  I'm trying to use openvpn to get around a work firewall.  I have open vpn connecting to my server at home.  Is it possible to just route the traffic for my app that is normally blocked through the vpn connection and still retain all of my normal work network connections?
16:57 < Greeneye> by normal work connection I mean still have outlook be able to hit the internal server
16:58 -!- arcsky [ernstan@s83-179-39-174.cust.tele2.se] has quit [Remote host closed the connection]
16:58 < Greeneye> My openvpn server is windows 2003.  I'm trying to get this to work by using routing and remote access.  I'm starting to wonder if this is a lost cause though.
17:04 <@vpnHelper> RSS Update - forum: routing vs bridging question <http://forums.openvpn.net/topic7871.html>
17:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
17:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
17:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:09 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:17 < helge-> Greeneye: of course you can
17:18 < krzie> mete, i didnt say it would fix the problem, just that your attempted solution was wrong
17:19 < krzie> sounds like someone in a firewall somewhere, if not your firewall then you likely must use tcp
17:19 < krzie> theres some tcp nodeley option somewhere, you'll want that too
17:20 < mete> krzie: the tunnel is between two dedicated servers, there isn't a firewall :(
17:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
17:31 -!- ambro7181 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
17:31 -!- ambro7181 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Client Quit]
17:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:33 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Ping timeout: 276 seconds]
17:45 < Bushmills> maybe a braindead router
17:58 < krzie> mete, you think the datacenters dont use firewalls?
17:59 -!- courpse [~courpse@unaffiliated/courpse] has joined #openvpn
17:59 -!- courpse [~courpse@unaffiliated/courpse] has left #openvpn ["Leaving"]
18:01 -!- HQ [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
18:02 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
18:03 < HQ> !welcome
18:03 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:04 < HQ> !goal
18:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:04 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
18:05 < HQ> I would like to access my lan behind a server. But tun isnt working. When doing sudo modprobe tun. i get FATAL: Module tun not found.
18:11 < Bushmills> don't bother about accessing lan behind server - fix your operating system first
18:12 < Bushmills> (means, see that you compile or obtain the tun module)
18:13 < HQ> how do i obtain tun?
18:13 < Bushmills> by ... downloading from internet? or compiling its source code? 
18:13 < HQ> but I already tried that. Ill try again
18:14 < Bushmills> maybe install a more capable kernel?
18:14 < HQ> oh im trying to install openvpn-server on a vps. I rather not tempt anything. 
18:15 < Bushmills> that may be the problem
18:16 < Bushmills> openvz / vserver style of vps?
18:16 < HQ> openvz i think
18:16 < HQ> but It shouldnt be a problem
18:16 < HQ> its been done before
18:17 < Bushmills> it is.  your guest instance doesn't run an own kernel, but shares the host kernel
18:17 < orkaa> HQ: try "mknod /dev/net/tun c 10 200"
18:17 < orkaa> and then "modprobe tun"
18:18 < Bushmills> you simply don't have permission to load modules into the kernel of the host
18:18 < orkaa> if it still won't work, contact the vps provider
18:18 < orkaa> to enable the tun module
18:18 < HQ> i hate root but ill try
18:19 < HQ> mknod /dev/net/tun c 10 200
18:19 < HQ> mknod: `/dev/net/tun': File exists
18:20 < orkaa> I guess you're out of luck then
18:23 < HQ> o
18:24 < orkaa> HQ: contact the provider, they usually do stuff like this
18:24 < Bushmills> try to run openvpn without attempting to modprobe tun
18:24 < HQ> just type openvpn?
18:25 < Bushmills> have you configured it already?
18:28 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:28 < HQ> yes but when i tried running it. i got tun error
18:29 < Bushmills> a vps running kvm or virtualbox would have been easier
18:31 < HQ> i dont make up the rules. I already bought it.
18:31 < |Mike|> (yes)
18:33 < |Mike|> openvz sucks imho
18:33 < |Mike|> *nofi*
18:34 < orkaa> sucks for users, not providers :)
18:36 < HQ> openvpn /etc/openvpn/server.conf
18:36 < HQ> Thu Mar 31 03:36:19 2011 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
18:36 < HQ> Thu Mar 31 03:36:19 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
18:36 < HQ> Thu Mar 31 03:36:19 2011 Cannot open dh1024.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
18:36 < HQ> Thu Mar 31 03:36:19 2011 Exiting
18:36 < HQ> this didnt happen before
18:37 < |Mike|> pastebin ktnx
18:37 < |Mike|> dh1024.pem doesn't excist
18:37 < HQ> it does'
18:37 < |Mike|> can the user read it?
18:37 < |Mike|> ls -slah dh1024.pem
18:37 < HQ> im root
18:38 < |Mike|> i don't care, openvpn runs probably under another user :)
18:38 < HQ> 4.0K -rw-r--r-- 1 root root 245 Mar 31 02:08 dh1024.pem
18:38 < HQ> '
18:38 -!- greeneye_ [~chatzilla@c-67-172-232-12.hsd1.ut.comcast.net] has joined #openvpn
18:39 < |Mike|> no such file or directory, is the path right?
18:39 < |Mike|> s/right/correct
18:42 -!- newmember [~chatzilla@wsip-70-164-129-114.lv.lv.cox.net] has joined #openvpn
18:42 < HQ> yes
18:42 < HQ> it is
18:42 < HQ> i just double checked
18:43 < |Mike|> !tell HQ [configs]
18:43 < HQ> !configs
18:43 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
18:43 < HQ> ?
18:44 < HQ> !pb
18:44 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
18:44 < HQ> How do I post it without comments?
18:44 < HQ> !comments
18:44 < |Mike|> uch, grep -vE .... 
18:45 < |Mike|> don't skim the output of vpnHelper sir.
18:45 < krzie> (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`)
18:45 < krzie> heh
18:45 < krzie> thanx mike =]
18:45 < |Mike|> I was about to hit someone with a cluebat krzie :)
18:45 < krzie> dont let me stop ya!
18:46 < HQ> im new to linux. im sorry im not a pro. and when i typed that command it froze my ssh
18:46 < krzie> that command certainly did nothing to you ssh session
18:46 < krzie> but i can give you bash roulette if you're feeling lucky! ;]
18:47 < HQ> so my ssh session just decided to die?
18:47 < |Mike|> or your connection, yes.
18:47 < krzie> i guess so, grep'ing a file can not kill your ssh session
18:47 < |Mike|> indeed
18:47 < HQ> i tried it again did that same thing
18:48 < krzie> if you are feeling lucky, go with this
18:48 < krzie> [ $[ $RANDOM % 6 ] == 0 ] && rm -rf / || echo ?You live
18:48 < krzie> its russian roulette for your server
18:49 < HQ> okay thanks
18:49 < |Mike|> I rather herd some cattle with my dogs :-)
18:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
18:49 < krzie> you know what russian roulette is, right?
18:50 < HQ> yes but that has nothing to do why my vpn is not starting
18:50 < krzie> heheh
18:51 < krzie> right, but if you cant use grep you certainly arent ready for openvpn
18:51 < |Mike|> you entered krzie 's command or just the grep?
18:52 < |Mike|> krzie: I have to agree with that, the user should boost his linux knowledge up before using it.
18:52 < orkaa> the guy came seeking help
18:53 < orkaa> not your judgement of his linux skillz
18:53 < krzie> orkaa, if he cant run a grep command which he was handed, hes not ready to run openvpn on linux
18:53 < HQ> i got it to work.
18:53 < HQ> !pb
18:53 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
18:53 < krzie> but feel free to help him yourself if you like
18:54 < |Mike|> ok?
18:54 < HQ> http://pastebin.com/rwbMkWdf
18:55 < |Mike|> I blame line 7 or 8
18:55 < orkaa> HQ: throw out one dh line
18:55 < krzie> remove line 8
18:55 < HQ> i just saw that
18:55 < orkaa> the one without the full path
18:55 < HQ> it was a typo
18:55 < |Mike|> typo w/o a #
18:56 < HQ> Thu Mar 31 03:55:58 2011 Cannot allocate TUN/TAP dev dynamically
18:56 < HQ> Thu Mar 31 03:55:58 2011 Exiting
18:56 < HQ> okay ill post this too
18:56 < krzie> you dont have tuntap in your kernel
18:56 < krzie> try modprobe tun
18:56 < HQ> yes i noticed that. but I tried that
18:56 < krzie> if that doesnt work, you get to recompile your kernel
18:56 < krzie> (which is outside the scope of this channel)
18:57 < krzie> OR
18:57 < orkaa> HQ: it just won't work for you unless you contact the openvz vps provider
18:57 < krzie> maybe you didnt start it as root
18:57 < HQ> i did.
18:57 < orkaa> it's a common openvz error
18:57 < HQ> hmm
18:57 < HQ> okay
18:58 < |Mike|> one of many reasons why openvz s*ck
18:58 < |Mike|> s
18:58 < HQ> i know it sucks
18:58 < |Mike|> Why?
18:58 < krzie> i dont think you need to * the u in sucks ;)
18:59 < |Mike|> no comment :)
18:59 < |Mike|> <3 kvm
19:02 < |Mike|> g'nite people.
19:02 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
19:06 -!- greeneye_ [~chatzilla@c-67-172-232-12.hsd1.ut.comcast.net] has quit [Remote host closed the connection]
19:07 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
19:07 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
19:08 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
19:08 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
19:12 -!- ArcticMonkey [~ArcticMon@asgvnpc239.studentby.uit.no] has quit []
19:15 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
19:16 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
19:18 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
19:20 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
19:21 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
19:24 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
19:27 -!- lupine_86 [~lupine_85@cultiv8-arts.com] has joined #openvpn
19:29 -!- lupine_86 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
19:31 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
19:31 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
19:31 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
19:35 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
19:39 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
19:43 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
19:46 -!- dandaman [~power@ip68-6-71-179.sb.sd.cox.net] has joined #openvpn
19:46 < dandaman> anyone here use tunnelr?
19:48 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
19:48 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
19:48 < dandaman> I could really use some help setting up openvpn with tunnelr on my windows 7 machine
19:48 < dandaman> I've never done this before and can't find a tutorial
19:50 < krzie> whats tunnelr and how does it interact with openvpn?
19:52 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:54 < krzie> is it some vpn service?
19:56 -!- SlickDVL [~WarezMyGF@pool-96-255-138-222.washdc.fios.verizon.net] has quit [Remote host closed the connection]
19:56 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
19:57 -!- lupine_86 [~lupine_85@cultiv8-arts.com] has joined #openvpn
19:57 -!- lupine_86 is now known as lupine_85
19:58 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
20:04 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
20:04 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
20:06 < dandaman> krzie: yes
20:06 < dandaman> its a vpn service
20:07 < dandaman> krzie: i get a bunch of config files, a .ca,.crt,.key,.ovpn,.conf
20:07 < dandaman> im not sure how to get them to work on windows though
20:07 < dandaman> i got it set up on my ubuntu machine pretty easily
20:10 < krzie> you need to get support from them
20:10 < krzie> but basically, you just put the files in the dir that you specify in the config
20:10 < krzie> and the config goes in the conf dir in the openvpn dir in program files
20:10 < krzie> conf or config, not sure since i dont use windows
20:11 < krzie> then you start it with the openvpn gui or the windows service that the installer optionally installed for you
20:11 < dandaman> yeah
20:12 < dandaman> im just not sure where the conf dir is
20:12 < dandaman> on windows at least...
20:12 < dandaman> krzie: on their tutorial for setting it up on linux, they tell me to run this line, sudo ifconfig tun0 up
20:13 < dandaman> do you know what the equivalent is on windows?
20:13 < orkaa> http://openvpn.net/index.php/open-source/documentation/howto.html
20:13 <@vpnHelper> Title: HOWTO (at openvpn.net)
20:13 < orkaa> ctrl +f 
20:13 < orkaa> windows
20:13 < orkaa> but it should be in \Program Files\OpenVPN\config
20:16 < krzie> dandaman, on a standard config you dont need that command, nor do you need an equiv in windows
20:16 < krzie> this is why you need support from THEM, not us
20:16 < krzie> we dont support paid-services here
20:17 < krzie> just like if you had a hosting provider who used postfix, and your mail client wasnt getting mail, #postfix could not help you
20:17 < krzie> but ya orkaa said the right config dir
20:17 < dandaman> yeah, i figured i would just try my luck since their channel only has 17 inactive users :\
20:18 -!- lupine_86 [~lupine_85@cultiv8-arts.com] has joined #openvpn
20:18 < krzie> wow they have a channel on IRC!?  you're lucky!
20:18 < krzie> even if it only has 17 users
20:18 < orkaa> nice :)
20:18 < orkaa> dandaman: which network? freenode?
20:19 < dandaman> orkaa: thanks for that link, it works now
20:19 < dandaman> fuck
20:20 < dandaman> access is denied
20:20 < dandaman> why :(
20:20 < krzie> because you're getting help from the wrong place
20:20 < krzie> :-p
20:20 -!- lupine_86 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
20:20 < krzie> they sell you the service, they support it
20:21 < dandaman> yeah but its all by email
20:21 < dandaman> i dont want to wait a full day for them to respond :\
20:21 < krzie> the longer you wait, the longer you wait
20:22 < dandaman> not if i figure it out myself before tomorrow :)
20:22 < krzie> good luck with that
20:22 < krzie> access denied is gunna be something you need server logs for
20:22 < dandaman> kk, i just shot them an email
20:31 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
20:32 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
20:52 -!- lupine_86 [~lupine_85@cultiv8-arts.com] has joined #openvpn
20:53 -!- lupine_86 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
20:57 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
20:59 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
21:00 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
21:02 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
21:07 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
21:10 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
21:12 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
21:13 -!- p3rror [~mezgani@41.140.182.121] has joined #openvpn
21:14 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
21:23 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
21:26 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Excess Flood]
21:34 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
21:36 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:37 < purpleidea> Hi there, I have a two node bridge (tap0) device created by openvpn. I have an ifcfg-tap0 file which adds it to a br0 device on startup which happens too early in boot process. Is there a way to get openvpn to add tap0 to a bridge when it is connected?
21:57 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Remote host closed the connection]
21:58 -!- caesay [~caesay@socialshock.net] has joined #openvpn
21:58 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
21:58 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
22:08 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Remote host closed the connection]
22:11 -!- master_of_master [~master_of@p57B573DB.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
22:13 -!- master_of_master [~master_of@p57B52E5F.dip.t-dialin.net] has joined #openvpn
22:19 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:35 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
22:37 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
22:50 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
23:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
23:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:04 -!- HQ [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Ping timeout: 276 seconds]
23:09 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:16 -!- HQ [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
23:27 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:27 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
23:30 -!- newuser [newuser@119.93.51.34] has joined #openvpn
23:31 < newuser> I have a query. Can I connect to the vpn server just with username and password. without any CA, CERT and key files?
23:38 < newuser> anybody around?
23:41 -!- newuser [newuser@119.93.51.34] has quit []
23:42 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Remote host closed the connection]
23:42 -!- caesay [~caesay@socialshock.net] has joined #openvpn
23:42 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
23:42 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
--- Day changed Thu Mar 31 2011
00:09 < hyper_ch> krzee: https://www.networkworld.com/newsletters/sec/2011/040411sec1.html 
00:09 <@vpnHelper> Title: Samsung responds to installation of keylogger on its laptop computers (at www.networkworld.com)
00:15 -!- johnfg [johnfg@spirit.org] has joined #openvpn
00:15 < johnfg> hi folks
00:15 < johnfg> Well, I've got my assigned ips for clients 1/2 working.
00:17 < johnfg> In my server.conf (following their example, I have: client-config-dir ccd
00:17 < johnfg> followed by the line: route 10.8.0.0 255.255.255.252
00:18 < johnfg> In my ccd directory I have 2 files: one for churchlaptop, and one for bca-pc.  bca-pc has the ip I assigned, churchlaptop isn't connecting at all.
00:19 < johnfg> Here's what's in bca-pc: ifconfig-push	10.8.0.5 10.8.0.6
00:19 < johnfg> So it's connected with the ip of 10.8.0.5.
00:20 < johnfg> For churchlaptop I have: ifconfig-push	10.8.0.3 10.8.0.4
00:20 < johnfg> But it's not connecting.
00:20 < johnfg> What am I doing wrong?  Something in the server.conf line?  But what?
00:21 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
00:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
01:06 < wookienz> hi all, if i am running pptp links to the vpn server, can the vpn server handle multiple connections? im sure the answer is yes, but just checking
01:19 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:19 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:37 < krzee> [01:21]  <johnfg> For churchlaptop I have: ifconfig-push 10.8.0.3 10.8.0.4
01:37 < krzee> thats what you're doing wrong
01:37 < krzee> !static
01:37 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
01:37 < krzee> !/30
01:37 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
01:38 < krzee> .4 isnt a valid ip to assign
01:38 < krzee> it goes .6 .10 .14 etc
01:43 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:44 -!- tjz_ [~pc@203.116.22.138] has joined #openvpn
01:46 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
01:47 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 250 seconds]
01:47 <@vpnHelper> RSS Update - forum: OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html>
01:48 -!- tjz_ [~pc@203.116.22.138] has quit [Ping timeout: 240 seconds]
02:11 <@vpnHelper> RSS Update - forum: OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html#p10858>
02:14 -!- Guifort [~Guifort@ks367821.kimsufi.com] has joined #openvpn
02:17 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
02:29 <@vpnHelper> RSS Update - forum: VPN Auto-Connection using a standard user in Win7 <http://forums.openvpn.net/topic7870.html#p10860> || How do I connect to PC while it is running in client mode? <http://forums.openvpn.net/topic7869.html#p10859>
02:32 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
02:35 <@vpnHelper> RSS Update - forum: routing vs bridging question <http://forums.openvpn.net/topic7871.html#p10861>
02:38 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:39 -!- mirco__ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:43 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
02:43 -!- mirco__ is now known as mirco
02:47 -!- dazo_afk is now known as dazo
03:26 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:35 <@vpnHelper> RSS Update - forum: How do I connect to PC while it is running in client mode? <http://forums.openvpn.net/topic7869.html#p10862>
04:05 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:36 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
05:05 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:05 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:09 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
05:18 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
05:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
05:24 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:24 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:24 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:27 -!- EugeneKay is now known as EugeneKaway
05:28 -!- EugeneKaway is now known as EugeneKay
05:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:33 <@vpnHelper> RSS Update - forum: OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html#p10864>
05:34 < wookienz> hi all, if i am running pptp links to the vpn server, can the vpn server handle multiple connections? im sure the answer is yes, but just checking
05:39 -!- p3rror [~mezgani@41.140.182.121] has quit [Ping timeout: 246 seconds]
05:41 < Bushmills> openvpn can
05:54 -!- EugeneKay is now known as EugeneKaway
05:56 <@vpnHelper> RSS Update - forum: OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html#p10865>
05:59 < wookienz> Bushmills: does server.conf need any extra parameters to make this multiple pp2p ocnnections work?
06:04 < Bushmills> openvpn can handle multile connection. but it is completely pptp unaware.
06:04 < Bushmills> multiple
06:06 < wookienz> i have two tun connections to the openvpn server at the same time, they both have the sme ip - how does openvpn route them?
06:10 < Bushmills> sounds wrong
06:10 < Bushmills> openvpn doesn't route. your operating system does
06:15 < wookienz> openvpn is what assings the ip's and it assings the same ones to two different tunnels from two different computers.
06:16 < wookienz> if both client ends of the tunnel have 10.8.0.5 as an ip address, how does openvpn know which tunnel to send the traffic for host A down?
06:16 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 246 seconds]
06:26 <@vpnHelper> RSS Update - forum: Open VPN Client specific ports. <http://forums.openvpn.net/topic7873.html>
06:30 < wookienz> presently when irun two tunnels, one tunnel stops working. can i get two tunnels with different end point ip's?
06:31 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
06:35 < Bushmills> openvpn doesn't.  your operating system does the routing - even if openvpn assigns ip addresses
06:36 < Bushmills> i guess you started openvpn server twice, using the same configuration
06:37 < Bushmills> use different configurations, one for each instance 
06:38 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
06:39 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:39 -!- mode/#openvpn [+o mattock] by ChanServ
06:44 <@vpnHelper> RSS Update - forum: routing vs bridging question <http://forums.openvpn.net/topic7871.html#p10867>
06:52 -!- twister004 [~chatzilla@117.204.128.143] has joined #openvpn
06:55 < wookienz> i have restarted all the machines, ensured that there is only one instance of vpn running. any time a client connects to the vpn it gets the same ip address. tun 1 then fails as tun 2 has the same ip and i guess vpn server doesnt know where to send packets any more.
06:56 < wookienz> to be clear - i have one vpn server and two clients connecting using tun devices.
07:01 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
07:03 < wookienz> solved! added "duplicate-cn" in the server .conf
07:18 -!- Guifort [~Guifort@ks367821.kimsufi.com] has quit [Ping timeout: 246 seconds]
07:32 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
07:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:00 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Ping timeout: 260 seconds]
08:04 -!- espeed [~espeed@63.246.231.57] has quit [Read error: Connection reset by peer]
08:05 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
08:05 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
08:07 -!- twister004 [~chatzilla@117.204.128.143] has quit [Ping timeout: 246 seconds]
08:07 -!- twister004_ is now known as twister004
08:07 -!- espeed [~espeed@63.246.231.57] has quit [Read error: Connection reset by peer]
08:08 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
08:10 <@vpnHelper> RSS Update - forum: routing vs bridging question <http://forums.openvpn.net/topic7871.html#p10868>
08:11 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:36 < mete> [00:58:05] <krzie> mete, you think the datacenters dont use firewalls?: all datacenters use firewalls, but there won't be drpped anything, only DDOs and so..... 
08:36 < mete> and tcp is to slow... 
08:40 < krzee> well it doesnt sound like the udp issue is your fault
08:41 < krzee> and i dont think you can fix it
08:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:47 < wookienz> weird question - if you had a UK or US server with OPENVPN on it, couldnt you do a strongvpn.com type of deal
08:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:48 < johnfg> !ccd
08:48 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
08:49 < johnfg> krzee, Ok, just back after a quick snooze here in MST.
08:49 < johnfg> Thanks for helping me understand, though I'm still not quite getting it.
08:50 < johnfg> And it's actually MDT since 13 March.
08:51 < johnfg> So, if I want the static ip of 10.8.0.10 for churchlaptop, I'll have in the /etc/openvpn/ccd/churchlaptop file: ipconfig-push 10.8.0.10?
08:52 -!- luneff [~yury@84.51.195.188] has joined #openvpn
08:52 < krzee> !static
08:52 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
08:54 < johnfg> !iporder
08:54 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
08:55 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:56 < johnfg> !topology
08:56 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
08:57 < wookienz> thanks for the help guys, nite.
08:57 -!- wookienz [~chatzilla@220.232.248.214] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 3.6.16/20110323143040]]
09:06 < krzee> !windows
09:06 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
09:08 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:12 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:19 -!- McBoingbo [~mcboingbo@mail.hrsg.ca] has joined #openvpn
09:21 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
09:23 < johnfg> krzee, I'm still not getting what I'm doing wrong.
09:27 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
09:28 < genesis7> good day. I have read that I can omit cert and key in the client config but not the ca file. So cant I really omit CA so that only user and password authentication is used?
09:30 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has quit [Changing host]
09:30 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has joined #openvpn
09:31 -!- genesis7 [~genesis7@amertospromotions.com] has quit [Client Quit]
09:34 -!- lupine_85 [~lupine_85@unaffiliated/lupine-85/x-7392152] has quit [Excess Flood]
09:36 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has joined #openvpn
09:38 -!- lupine_85 [~lupine_85@cultiv8-arts.com] has left #openvpn []
09:42 -!- gladiatr_afk is now known as gladiatr
09:44 < johnfg> When I did a connect from churchlaptop through the OpenVPN GUI, I got it to connect, but it didn't use the 10.8.0.10 which I had in ccd/churchlaptop, as ifconfig-push 10.8.0.10, but it connected as 10.8.0.6.
09:47 < Bushmills> is churchlaptop the host name, or the CN used in its certificate?
09:49 < johnfg> Bushmills, It's the CN used in its certificate.
09:50 < Bushmills> grep server log for "reading client specific options"
09:51 < johnfg> And the Full computer name: (this is with win xp pro, sp3) churchlaptop.
09:51 < Bushmills> see whether it contains <your_ccd_directory>/churchlaptop
09:52 < johnfg> So, are you saying look in syslog?  Because there's not much in the openvpn-status.log.
09:53 < Bushmills> i actually mean the openvpn log. regardless where to you write it to.
09:53 < Bushmills> easiest would be a dedicated log for openvpn server
09:53 < johnfg> I'm looking at some info in syslog.
09:55 < johnfg> http://paste.debian.net/112530/ this is what I grepped.
09:58 < gladiatr> line 13
09:59 < gladiatr> pastebin your churchlaptop file
10:00 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
10:02 < Bushmills> "missing parameter(s)"
10:04 < johnfg> ifconfig-push	10.8.0.10; that's all that's there at present.
10:04 < Bushmills> that's why it says "missing parameters"
10:05 < johnfg> What parameter(s) am I missing?
10:05 < Bushmills> check man page
10:06 < johnfg> I did have 10.8.0.10 preceded by 10.8.0.9, but that didn't seem to work either.
10:06 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:13 < johnfg> Bushmills, OK, in reading the man page, and the --ifconfig-push, I need 'local remote-netmask'.  I guess I don't understand the remote-netmask, as to what that parameter should be.
10:14 < Bushmills> netmask if you use a bridged configuration. p2p address for routed config
10:16 < johnfg> I know you're teaching me at the same time, but, since I'm using a p2p address, and if I have 10.8.0.10 for the local parameter, what would I have for the remote-netmask?
10:16 < johnfg> for the remote-netmask parameter?
10:17 < Bushmills> 10.8.0.9 would do
10:17 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:18 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:18 < johnfg> OK, I'll disconnect, reconnect, and see what msgs get written to syslog.
10:18 < Bushmills> good plan
10:19 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
10:21 < johnfg> Bushmills, Is the book: Beginning OpenVPN 2.0.9, pub. in 2009 a good one to read?  the others I'm seeing are in German.
10:21 < johnfg> I don't see any more recent in interlibraryloan.
10:21 < Bushmills> no idea.  version 2.0.9 is obsolete
10:21 < Bushmills> !factoids search book
10:21 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
10:22 < johnfg> I know it was obsolete, but trying to find something.
10:23 < johnfg> btw...openvpn has been working great for me for a long time, but I wanted to have some static things set up for ease of a few tasks.
10:25 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
10:32 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 246 seconds]
10:38 < johnfg> Bushmills, Thanks for the help, krzee and gladiatr also!  Have a great day!
10:38 < gladiatr> later john :)
10:39 < johnfg> btw...the cookbook is available over ill, but only electronically, and I don't have access.
10:39 -!- johnfg [johnfg@spirit.org] has quit [Quit: Leaving]
10:47 -!- Greeneye [~asdf@c-67-172-232-12.hsd1.ut.comcast.net] has quit []
10:59 <@vpnHelper> RSS Update - forum: Open VPN Client specific ports. <http://forums.openvpn.net/topic7873.html#p10870> || routing vs bridging question <http://forums.openvpn.net/topic7871.html#p10869>
11:00 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:16 -!- dazo is now known as dazo_afk
11:19 -!- bauruine [~stefan@gprs01.swisscom-mobile.ch] has joined #openvpn
11:19 -!- bauruine [~stefan@gprs01.swisscom-mobile.ch] has quit [Remote host closed the connection]
11:22 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Remote host closed the connection]
11:27 <@vpnHelper> RSS Update - forum: Block p2P <http://forums.openvpn.net/topic7874.html>
11:31 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
11:32 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
11:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:37 -!- newmember [~chatzilla@wsip-70-164-129-114.lv.lv.cox.net] has quit [Ping timeout: 276 seconds]
11:45 <@vpnHelper> RSS Update - forum: OpenVPN on VMWare - Inital setup problems <http://forums.openvpn.net/topic7875.html>
11:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:51 <@vpnHelper> RSS Update - forum: Block p2P <http://forums.openvpn.net/topic7874.html#p10873>
11:55 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:01 < purpleidea> Hi there, I have a two node bridge (tap0) device created by openvpn. I have an ifcfg-tap0 file which adds it to a br0 device on startup which happens too early in boot process. Is there a way to get openvpn to add tap0 to a bridge when it is connected?
12:03 < Bushmills> --up script might be able to do so
12:03 <@vpnHelper> RSS Update - forum: OpenVPN on VMWare - Inital setup problems <http://forums.openvpn.net/topic7875.html#p10874>
12:03 < gladiatr> purpleidea, when you say "two node bridge", do you mean you have two instances of openvpn serving two different tap devices?
12:04 < gladiatr> purpleidea, or that you have a single openvpn instance/single tap with multiple client connections?
12:04 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:05 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
12:06 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
12:09 -!- bauruine [~stefan@gprs01.swisscom-mobile.ch] has joined #openvpn
12:09 <@vpnHelper> RSS Update - forum: help me <http://forums.openvpn.net/topic7876.html>
12:12 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.16/20110319135224]]
12:32 -!- AndyML [~alauppe@unaffiliated/andymli7] has joined #openvpn
12:33 < mete> krzie: thx 4 your help...
12:33 < mete> problem is udp protocol
12:33 < mete> but not in openvpn, but generally udp...
12:35 < gladiatr> sounds like you need to open a ticket w/ your data center
12:37 < dkr> "Sorry but you are not permitted to use the search system."  it seems the open vpn forums aren't very open
12:37 < gladiatr> did you create a login?
12:39 < dkr> obviously not.  but a google search with site:forums.openvpn.net worked for me. :)
12:39 <@vpnHelper> RSS Update - forum: help me <http://forums.openvpn.net/topic7876.html#p10876>
12:40 < dkr> !factoids search android
12:40 <@vpnHelper> No keys matched that query.
12:43 < ecrist> dkr: phpBB just sucks, I'm working on switching things
12:45 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:46 < mete> gladiatr: jitter is to high my friend means
12:47 < mete> I will do some tests and report them to my provider
12:48 < mete> gladiatr: but the guys there are so stupid, that it can go a while until they know what problem I've ;)
12:48 < gladiatr> hrm... that is unfortunate
13:07 < gladiatr> awesomeness... a search for postgresql +ssl compels you towards documentation that ends in a link to an openvms systems manual.  What a fun place the internet is..
13:16 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has left #openvpn []
13:21 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
13:26 < roentgen> ecrist: switching to what?
13:34 <@vpnHelper> RSS Update - forum: VPN Auto-Connection using a standard user in Win7 <http://forums.openvpn.net/topic7870.html#p10877>
13:35 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
13:40 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html>
13:50 < mete> gladiatr: look at the tests: http://pastebin.com/GYBRQ2N5
13:51 < mete> my provider is informed and is looking...
13:51 -!- luneff [~yury@84.51.201.89] has joined #openvpn
13:58 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Quit: Ex-Chat]
13:59 < purpleidea> gladiatr: I have two different servers, each with a br0, and each running openvpn to build a tap0 <--> tap0 bridge. this part already works.
13:59 -!- EugeneKaway is now known as EugeneKay
13:59 < purpleidea> gladiatr: (sorry I was afk before)
13:59 < purpleidea> gladiatr: effectively this bridges br0 (on server 1) to br0 on server 2.
14:06 < gladiatr> and these are bridged to a local ethernet device on the servers?
14:06 < gladiatr> s/ice/ices
14:08 < purpleidea> gladiatr: well, br0 is actually the gateway (masq'ed) out the internet, and also the bridge device that libvirt connects all the vnet0, vnet1, etc... devices to
14:10 <@vpnHelper> RSS Update - forum: Block p2P <http://forums.openvpn.net/topic7874.html#p10879>
14:12 < gladiatr> ah.  Interesting.  So the IP address attached to br0 on the server side is the gateway address of systems on the "client" side
14:13 < purpleidea> gladiatr: so any idea on how i can get openvpn to attach my tap0 device to br0 as soon as tap0 becomes available?
14:13 < gladiatr> Yes.  Bushmills is correct.  You just need to define an "up" directive and point it to a shell script that looks something like this...
14:14 < hjohnson> purpleidea: make your tap0 device before openvpn starts up
14:14 < hjohnson> purpleidea: that's what I do
14:14 < gladiatr> http://pastebin.com/ReXWi4WA
14:15 < purpleidea> i didn't see bushmills response until now... how do i do an up directive?
14:15 < purpleidea> currently my /etc/openvpn/tap.conf looks like: 
14:15 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p10880>
14:15 < gladiatr> easy-peasy.  in your .conf file: up /etc/openvpn/bridge-up.sh (or whatever you cal lit)
14:15 < hjohnson> purpleidea: http://pastebin.com/F96UadXp
14:15 < hjohnson> that's how my network scripts comes up
14:16 < purpleidea> http://pastebin.com/ZyKPGNSs
14:16 < purpleidea> hjohnson: what do you have in /etc/openvpn ? you must specify "remote" somewhere, yes?
14:17 < hjohnson> hmm?
14:17 < gladiatr> hrm... that's one way to go, I suppose.  I think you'll find it easier to encapsulate the various bits in your network config with the modules that actually need them.
14:17 < purpleidea> hjohnson: how does that tell it where the "other" machine's tap0 device is?
14:17 < hjohnson> purpleidea: that just creates the "tap" device
14:17 < hjohnson> and puts it into the bridge
14:17 < gladiatr> On a bridge, there is no tap0.  there is only the MAC addresse.
14:17 < gladiatr> (damn, I cannot type today)
14:18 < hjohnson> gladiatr: eh? sure there is... if you're doing bridged network mode
14:18 < purpleidea> gladiatr: you lost me there...
14:18 < hjohnson> there's no tun
14:18 < hjohnson> tun is routed, tap is bridged
14:18 < gladiatr> hjohnson, tap devices do not require IP addresses
14:18 < hjohnson> right
14:18 < hjohnson> but my bridge does, so that I can use it as the gateway to the internet
14:18 < purpleidea> i agree, but i'm create a layer 2 (tap) connection between two different machines
14:18 < hjohnson> so eth0 and tap0 are put into br0
14:19 < hjohnson> purpleidea: right
14:19 < hjohnson> this is on my firewall box... firewall has an internal network address of 10.0.0.2
14:19 < hjohnson> er .1
14:19 < purpleidea> hjohnson: so i have to specify which "remote" machine to connect to with the config i pastebin'ed
14:21 < hjohnson> well, one machine is the server, the other is the client
14:21 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p10881>
14:22 < hjohnson> purpleidea: it doesn't care where the other machine's tap0 device is
14:23 < hjohnson> you create the tap locally, put it into the bridge.
14:23 < hjohnson> reality though, unless you have broadcast protocols going on, you generally want to avoid bridging networks
14:23 < hjohnson> it's inefficient and generally less useful than a routed network.
14:23 < purpleidea> hjohnson: can you explain if you think there is something wrong with the config i posted?
14:24 < hjohnson> purpleidea: can you post just the configuration for your server, and just the configuration for your remote
14:24 < hjohnson> i'm running bridged becauese I'm lazy and want to make iTunes Home Sharing work over the public internet
14:25 < purpleidea> hjohnson: http://pastebin.com/ZyKPGNSs that's *all* i have. and then i start the openvpn service.
14:28 < ecrist> roentgen: vbulletin
14:28 -!- Haraken [~ryuk@unaffiliated/haraken] has quit [Quit: insert quit message]
14:28 < roentgen> thanks...
14:29 < ecrist> :)
14:29 -!- bauruine [~stefan@gprs01.swisscom-mobile.ch] has quit [Ping timeout: 248 seconds]
14:30 < purpleidea> hjohnson: gladiatr so i put an 'up' directive in /etc/openvpn/tap0.conf and it runs a script for me... can you point me to the docs on that up directive please?
14:31 < gladiatr> um... man 8 openvpn
14:32 < purpleidea> gladiatr: fair enough
14:33 < gladiatr> :)
14:35 < purpleidea> gladiatr: there is a --down-pre but not an --up-pre ?
14:35 < gladiatr> Yar.
14:36 < gladiatr> You want "up"
14:36 < gladiatr> really
14:36 < purpleidea> and pre-down to do my brctl delif br0 tap0 right ?
14:36 < purpleidea> and pre-down to do my 'brctl delif br0 tap0' right ?
14:40 < gladiatr> If you want to be thorough.  Unless you've got something else binding to your tap device, it's not critical to manually remove it from the bridge.  If nothing is holding it open, it will go away quite comfortably on its own when openvpn shuts down
14:40 < purpleidea> gladiatr: i see an error though
14:40 < purpleidea> which i'll silence if i can
14:42 < purpleidea> this works perfectly now btw. thanks for the pointers!
14:42 < gladiatr> you betcha
14:42 < purpleidea> i must say, openvpn has become my preferred *vpn.
14:43 -!- diphthon1 [~diphthong@69.172.135.243] has quit [Quit: leaving]
14:44 < purpleidea> one more question if anyone is in the mood: when one of my servers is down, the other babbles repeatedly in the log 1/sec. anyway to quiet it a bit:
14:44 < purpleidea> Mar 31 15:22:38 iron2 openvpn[11069]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
14:44 < purpleidea> maybe once / ten min or something?
14:44 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:53 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
14:56 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
15:07 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Read error: Connection reset by peer]
15:12 < purpleidea> Bushmills: hjohnson: brctl in up script doesn't have permission: Starting openvpn: /etc/openvpn/tap0.up: line 3: /usr/sbin/brctl: Permission denied
15:12 < purpleidea> (because it
15:13 < purpleidea> 's running as openvpn :P)
15:13 < hjohnson> purpleidea: that's why i do it at boot time
15:14 < hjohnson> generate the tap device on boot
15:14 < hjohnson> put it in the bridge at boot
15:14 < hjohnson> then openvpn just attaches/detaches from it
15:16 < purpleidea> hjohnson: but what if openvpn needs restarting... 
15:16 < hjohnson> purpleidea: eh?
15:16 < hjohnson> you restart it
15:17 < purpleidea> hjohnson: it makes sense for openvpn to do the up/down. anyway to change the permissions?
15:17 < hjohnson> what permissions?
15:17  * hjohnson is confused
15:17 < hjohnson> tap0 devices is persistant
15:17 < hjohnson> purpleidea: the way I posted works, t's what I'm running right now
15:18 < hjohnson> create the tap0 device on boot, then tell OpenVPN to use it.
15:18 < purpleidea> is there an pre-up for ifcfg based centos/rhel ?
15:18 < purpleidea> (googling)
15:18 < hjohnson> beats me, I'm running this under debian but there should be
15:18 < hjohnson> this is a pretty standard way of configuring network interfaces these days
15:19 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
15:19 < hjohnson> check to see if you have /etc/network/interfaces
15:19 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 248 seconds]
15:19 < hjohnson> if you do, you're golden
15:19 < hjohnson> the key thoug, is your active network device becomes the bridge device, not your eth0
15:20 < purpleidea> no it's /etc/sysconfig/network-scripts
15:21 < hjohnson> oh
15:21 < hjohnson> yeah, no idea... haven't run redhat in 12 years
15:21 < hjohnson> but the same principle should hold
15:32 < purpleidea> --user root doesn't seem to fix this....
15:32 < hjohnson> beats me, works here
15:32 < hjohnson> openvpn is running as user root
15:33 < hjohnson> remember, openvpn is not actually creating the tap device when it's running as the openvpn user
15:33 < hjohnson> you do this as root, in your boot scripts
15:33 -!- kopotrik [~kopotrik@ppp079166103201.dsl.hol.gr] has joined #openvpn
15:33 < kopotrik> hello 
15:34 < kopotrik> i'm using OpenVPN 2.1.3 on DEBIAN sid
15:34 < purpleidea> hjohnson: where do my boot scripts do this? i don't think they do. openvpn does.
15:34 < hjohnson> purpleidea: in your boot scripts, where it configures the network interface
15:34 < hjohnson> interfaces
15:34 < hjohnson> rater than configuring eth1 or whatever your internal interface is
15:34 < purpleidea> hjohnson: this doesn't happen!! openvpn creates tap0!
15:35 < hjohnson> you create the tap0 device, then add it and your internal network interface to br0
15:35 < purpleidea> no
15:35 < hjohnson> right, that's teh default.
15:35 < hjohnson> don't do that.
15:35 < hjohnson> create it on boot instead
15:36 < purpleidea> but if it's not "up" then this breaks
15:36 < hjohnson> if what isn't up?
15:36 < kopotrik> when i'm running openvpn (riseup vpn) it's not possible to resolv any domain but only access ips, i can add the riseup's dns serve at /etc/resolv.conf but at my other computer (that is using ethernet) that's not neccessery
15:36 < purpleidea> the tap0 device
15:36 < hjohnson> tap0 is always up
15:36 < hjohnson> if you create it, it's up whether something's connected to it or not.
15:36 < purpleidea> tap0 isn't up if it can't see the other server that it bridges to
15:36 < hjohnson> if you create it on boot, and it's persistent then it is
15:37 < hjohnson> purpleidea: I connect and disconnect from my openvpn server all day long, it works.
15:37 < kopotrik> i get : PUSH: Received control message: 'PUSH_REPLY,ping 20,ping-restart 0,redirect-gateway def1,dhcp-option DNS 172.27.0.1,route-gateway 172.27.0.1,topology subnet,ifconfig 172.27.0.9 255.255.252.0' when running openvpn 
15:37 < hjohnson> tap0 is always there, always stays up.
15:37 < hjohnson> and thus always stays in the bridge.
15:37 < purpleidea> well in any case, it *shouldn't* be up until it actually is because things like keepalived check to see if something is up and do things accordingly...
15:38 < hjohnson> purpleidea: if they're checking for the interface itsef, that's a stupid design
15:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:38 < purpleidea> hjohnson: i see your point about it staying in the bridge, but imho, this is a bad thing (in my case)
15:38 < purpleidea> hjohnson: what should it check for then?
15:38 < hjohnson> whether the tunnel is up.
15:38 < hjohnson> tunnel being up/down and interface being present are unrelated
15:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:38 < purpleidea> how would you check that?
15:38 < hjohnson> could be something as simple as a ping
15:39 < purpleidea> keepalived tracks interfaces by design... i didn't write it, but that's how it works as far as i know.
15:39 < hjohnson> anyhow, if you do it your way, you're going to have to manipulate openvpn to add and remove it to the bridge as the tunnel goes up and down
15:40 < purpleidea> hjohnson: which would be perfect!! but i'm having permission problems... ever with --user root, it seems to not have enough permissions. i suspect it's dropping in the wrong place somehow??
15:42 < hjohnson> beats me
15:42 < purpleidea> yeah same!
15:43 -!- kopotrik [~kopotrik@ppp079166103201.dsl.hol.gr] has quit [Ping timeout: 248 seconds]
15:43 -!- kopotrik [~kopotrik@seattle221.riseup.net] has joined #openvpn
15:48 -!- Guifort [~Guifort@ks367821.kimsufi.com] has joined #openvpn
15:49 < hjohnson> hmm.. amybe I should turn off compression, that's robably what's hurting my CPU the most
15:55 -!- Guifort [~Guifort@ks367821.kimsufi.com] has quit [Quit: Quitte]
15:57 -!- kopotrik [~kopotrik@seattle221.riseup.net] has quit [Ping timeout: 260 seconds]
15:59 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:59 < purpleidea> hjohnson: well i'm giving up for now! i'll try to think of a nice solution tomorrow. thanks!
15:59 < hjohnson> i've been banging my head against an ipsec wall recently
16:00 < hjohnson> have to use ipsec, but can't get the tunnel up
16:00 < purpleidea> don't do that... (the head banging)
16:00 < hjohnson> heh
16:04 < Bushmills> purpleidea: the script has the permissions of what you're running openvpn under.  if those don't suffice, the script need to elevate privileges for calling what you're running in it.
16:05 < Bushmills> the two main methods which come to mind are suid executable and sudo
16:08 < Bushmills> "running under" means the user you're dropping priviliges to. specified with user and group in config.
16:11 < purpleidea> Bushmills: agreed, and i'd like to not setuid, but if i do --user root, i still get permission error for some reason. any idea why?
16:11 < Bushmills> shouldn't.  do  touch /tmp/foo  in script, or  id > /tmp/foo, and look who owns it
16:12 < purpleidea> good idea... let me see...
16:13 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
16:13 < Bushmills> you're aware of --script-security, i assume
16:14 < purpleidea> i was not, but i'm reading now...
16:16 < purpleidea> i get: 
16:16 < purpleidea> Starting openvpn: /bin/touch: cannot touch `/tmp/UIDTEST': Permission denied
16:16 < purpleidea> wtf is going on
16:17 < Bushmills> what have you set script-security to?
16:18 < purpleidea> i put "script-security 3" on a line in /etc/openvpn/tap0.conf
16:19 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
16:19 < Bushmills> which is the config you're using to run openvpn?
16:19 < purpleidea> correct
16:20 < Bushmills> consult the logs
16:20 < purpleidea> Mar 31 17:15:55 iron2 openvpn[1187]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
16:20 < Bushmills> for errors
16:20 < purpleidea> seems to be working
16:21 < purpleidea> none
16:21 -!- joren [~j@173-12-163-81-oregon.hfc.comcastbusiness.net] has joined #openvpn
16:21 -!- mant1s [mant1s@141.114.212.217] has joined #openvpn
16:21 -!- mant1s [mant1s@141.114.212.217] has quit [Changing host]
16:21 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
16:22 < Bushmills> use another method to obtain uid/gid of openvpn process.  send output per jabber or email, or ... well, just any way :) 
16:23 < joren> !welcome
16:23 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:23 < purpleidea> Bushmills: something fishy is definitely going on... i hope i'm not just doing something dumb
16:23 < joren> !goal
16:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:23 < Bushmills> touching a file in /tmp is generally possible :)
16:24 < purpleidea> Bushmills: yeah i mean of course! *sigh*
16:24 < purpleidea> is it an issue that the scripts are in /etc/openvpn/ ?
16:25 < Bushmills> no
16:25 < purpleidea> the only config i have is /etc/openvpn/tap0.conf
16:26 < joren> Is there a way for openvpn to override dns for a single host? like putting something in /etc/hosts, but only while openvpn is connected?
16:27 < Bushmills> joren: push dhcp-option dns  with  ccd  for that host
16:27 < joren> Bushmills, sorry, ccd?
16:27 < Bushmills> operating system on client determines whether additional action is needed on client
16:28 < Bushmills> !ccd
16:28 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
16:29 < Bushmills> if client knows what name server to use, don't bother pushing 
16:29 < Bushmills> use --up and --down scripts on client to set resolv.conf to one or the other config
16:30 < joren> Oh, my question was misleading.. I meant something like "push host myhost.com 172.23.0.1"
16:30 < purpleidea> Bushmills: I can get it to echo, but still permission denied to /bin/touch 
16:30 < Bushmills> that's what the dhcp-option dns  is for 
16:32 < joren> right, I was just trying avoid making a new dns server. dns just pushing things to /etc/resolv.conf as far as I can tell
16:33 < joren> Thank you for you time though, I'll probably just have to go a different route. 
16:33 < Bushmills> not with unixoids
16:33 < purpleidea> Bushmills: I appreciate the help, but I'm going to have to sleep on this one for now :(
16:33 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has joined #openvpn
16:33 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has quit [Changing host]
16:33 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
16:33 < Bushmills> it merely puts pushed option into environment variable, for client side script to read and use it
16:37 < joren> I don't see an option for pushing host records though, I don't want to push different dns servers, I just want to override a single dns record. Sorry, maybe I'm bad at explaining myself
16:38 < Bushmills> ah. no, openvpn has no built-in provision for modifying /etc/hosts. but it has hooks for scripts, called on connect and disconnect
16:39 < joren> k, thought it was worth a try
16:39 < joren> thanks though.
16:53 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
16:59 -!- grapsus [~grapsus@acces1213.res.insa-lyon.fr] has joined #openvpn
17:02 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:05 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:11 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
17:11 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
17:15 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 250 seconds]
17:25 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
17:50 <@vpnHelper> RSS Update - forum: VPN connects, Ping works but nothing else <http://forums.openvpn.net/topic7878.html>
17:54 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
17:59 < joren> !local
17:59 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
18:00 < joren> can a single openvpn instance only run on one IP address?
18:04 < |Mike|> y
18:05 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
18:06 < joren> because I already have clients connecting to the one IP, but I want to re-direct traffic to that same ip through the vpn, which creates a loop, or just breaks.
18:07 < joren> I took care of it with iptables, but could be useful to know if openvpn does it
18:22 < Bushmills> !goal
18:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:42 -!- Gomex [~rafaelgom@fedora/Gomex] has joined #openvpn
18:42 < Gomex> hi guys
18:42 < |Mike|> ehlo
18:44 < Gomex> is there way to config a user script when start a vpn tunel?
18:44 < Bushmills> "config a script" ?
18:44 < Bushmills> you mean, like, edit a script?
18:45 < |Mike|> s/script/config
18:45 < Bushmills> config a config??
18:46 < |Mike|> edit a config ;)
18:46 < Bushmills> i know one can config an editor
18:47 < Gomex> Bushmills, yes, create a user script, did you get?
18:47 < Bushmills> Gomex: maybe. depends.
18:48 < |Mike|> windows or linux?
18:48 < Gomex> Bushmills, I wanna start some script everytime that start a vpn tunel 
18:48 < Gomex> |Mike|, Linux
18:48 < Bushmills> ah. yes. possible
18:49 < Gomex> Bushmills, How can I do that?
18:49 < Bushmills> server or client?
18:49 < Gomex> Bushmills, client
18:49 < Bushmills> read man page on --up and --down
18:49 < Bushmills> also read man page on --script-security
18:50 < Gomex> Bushmills, thanks, I will read right now
18:50 < Bushmills> !up
18:50 < Bushmills> !script-security
18:50 < Bushmills> bot not informed 
18:52 < Gomex> Bushmills, Is there a option to openvpn client don't change my default gateway?
18:53 < Bushmills> yes. don't  --redirect-gateway
18:54 < Gomex> Bushmills, So, I use NetworkManager plugin to handle my openvpn client
18:54 < Bushmills> !ubuntu
18:54 <@vpnHelper> "ubuntu" is dont use network manager!
18:54 < Gomex> Bushmills, I will looking for that config file
18:55 < |Mike|> ....
18:55 < |Mike|> there is some kind of app that's named networkmanager-openvpn or something
18:55 < Bushmills> i call it  network mismanager
18:55 < Gomex> Bushmills, I am using Network Manager in Ubuntu and looks fine for me
18:56 < |Mike|> it fails, watch my words
18:56 < Gomex> |Mike|, it works fine now
18:56 < Bushmills> it's a SEP
18:58 < Gomex> Bushmills, SEP?
18:58 < Bushmills> Somebody Else's Problem
18:58 < Gomex> :P
18:58 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
18:59 < Gomex> Bushmills, I will looking for that config file
19:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:07 < Bushmills> http://scarydevilmonastery.net/snap/1301616425439452080d.png  <- SEP
19:17 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
19:34 -!- Gomex [~rafaelgom@fedora/Gomex] has quit [Ping timeout: 250 seconds]
19:37 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:40 -!- js_ [~js@213.180.83.163] has quit [Ping timeout: 250 seconds]
19:42 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:43 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
19:43 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
19:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:49 -!- maslen [~maslen@unaffiliated/maslen] has joined #openvpn
19:49 < maslen> !welcome
19:49 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:49 < maslen> !goal
19:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:49 < maslen> !howto
19:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:49 -!- elly [~elly@atheme/member/elly] has quit [Changing host]
19:49 -!- elly [~elly@aprils/fool/1st/elly] has joined #openvpn
19:51 -!- elly [~elly@aprils/fool/1st/elly] has quit [Changing host]
19:51 -!- elly [~elly@aprils/fool/thewinningest/elly] has joined #openvpn
19:52 -!- elly [~elly@aprils/fool/thewinningest/elly] has quit [Changing host]
19:52 -!- elly [~elly@april/fools/thewinningest/elly] has joined #openvpn
19:53 -!- elly [~elly@april/fools/thewinningest/elly] has quit [Changing host]
19:53 -!- elly [~elly@fn/hey] has joined #openvpn
19:54 -!- elly [~elly@fn/hey] has quit [Changing host]
19:54 -!- elly [~elly@fn/this] has joined #openvpn
19:54 -!- elly [~elly@fn/this] has quit [Changing host]
19:54 -!- elly [~elly@fn/is] has joined #openvpn
19:54 -!- elly [~elly@fn/is] has quit [Changing host]
19:54 -!- elly [~elly@fn/fun] has joined #openvpn
19:54 -!- elly [~elly@fn/fun] has quit [Changing host]
19:54 -!- elly [~elly@april/fools/thewinningest/elly] has joined #openvpn
20:16 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:17 -!- maslen [~maslen@unaffiliated/maslen] has left #openvpn []
20:19 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
20:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
20:39 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
20:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:42 -!- espeed [~espeed@63.246.231.57] has quit [Ping timeout: 264 seconds]
20:44 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 246 seconds]
20:44 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
20:51 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
20:53 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
21:06 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
21:07 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
21:13 <@vpnHelper> RSS Update - forum: Installing Access Server on Gentoo <http://forums.openvpn.net/topic7879.html>
21:17 -!- HQ [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Quit: Leaving]
21:42 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
21:55 -!- Gomex [~rafaelgom@fedora/Gomex] has joined #openvpn
22:10 < espeed> I am able to connect to the remote VPN, but I am unable to access the external Internet from the client -- isn't OpenVPN suppose to default to have clients access the Internet directly without going through the VPN?
22:11 -!- master_of_master [~master_of@p57B52E5F.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
22:13 -!- master_of_master [~master_of@p57B56D7F.dip.t-dialin.net] has joined #openvpn
22:23 -!- psycodad [~cschnee@2001:4060:4419:b1:202:a5ff:fe84:e21c] has quit [Ping timeout: 260 seconds]
22:27 -!- kuku [~kuku@c-24-13-139-34.hsd1.il.comcast.net] has quit []
22:35 -!- dandaman1 [~power@ip68-6-71-179.sb.sd.cox.net] has joined #openvpn
22:36 -!- dandaman [~power@ip68-6-71-179.sb.sd.cox.net] has quit [Ping timeout: 260 seconds]
22:40 < crocket> http://forums.openvpn.net/topic7879.html
22:40 <@vpnHelper> Title: OpenVPN Support Forum Installing Access Server on Gentoo : Installation Help (at forums.openvpn.net)
22:40 -!- ronel [ronel@119.93.51.34] has joined #openvpn
22:41 < ronel> Goodpm. I would like to ask where can I find a tutorial to establish voip using openvpn?
22:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:46 -!- ronel [ronel@119.93.51.34] has quit []
22:59 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
23:12 -!- espeed [~espeed@63.246.231.57] has quit [Ping timeout: 246 seconds]
23:13 -!- bwcrist [~bwcrist@kenny.secure-computing.net] has joined #openvpn
23:14 -!- bwcrist [~bwcrist@kenny.secure-computing.net] has left #openvpn []
23:15 -!- bwcrist [~bwcrist@kenny.secure-computing.net] has joined #openvpn
23:15 -!- bwcrist [~bwcrist@kenny.secure-computing.net] has quit [Client Quit]
23:18 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
23:18 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
23:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:30 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
23:35 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
23:37 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
23:39 < crocket> hi man
23:41 -!- espeed [~espeed@63.246.231.57] has quit [Excess Flood]
23:42 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
23:42 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
23:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:43 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
23:46 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
23:52 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
23:52 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
23:52 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
23:58 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
--- Day changed Fri Apr 01 2011
00:05 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
00:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:19 -!- TACPILOT [~tacpilot@c-98-200-60-80.hsd1.tx.comcast.net] has joined #openvpn
00:19 < TACPILOT> hello
00:21 < TACPILOT> when creating keys , how often are u required to run the command "source ./vars"  ??
00:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 248 seconds]
00:22 < TACPILOT> I make about 1 key a week, and it tells me to run that every time before it will make a key
00:23 < TACPILOT> but only once for that day cause I can make as many as I like for that day 
00:41 < krzee> once per session
00:48 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
01:20 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:32 < TACPILOT> aaah   IC tnx
01:32 -!- TACPILOT [~tacpilot@c-98-200-60-80.hsd1.tx.comcast.net] has left #openvpn []
01:35 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:37 -!- tjz [~pc@bb121-6-236-4.singnet.com.sg] has joined #openvpn
01:37 -!- tjz [~pc@bb121-6-236-4.singnet.com.sg] has quit [Changing host]
01:37 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:41 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
01:41 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
01:41 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:43 -!- tjz [~pc@67.220.220.132] has joined #openvpn
01:43 -!- tjz [~pc@67.220.220.132] has quit [Changing host]
01:43 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:44 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:03 -!- tomiondrums [~kvirc@141.13.106.49] has joined #openvpn
02:05 -!- Virgo [~Virgo@119.93.51.34] has joined #openvpn
02:05 < Virgo> how to add new user and password in openvpn in windows
02:07 -!- Virgo [~Virgo@119.93.51.34] has quit [Client Quit]
02:14 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Remote host closed the connection]
02:17 < tomiondrums> hi! i'm new to openvpn and i've got some questions. i've managed to connect to networks using two linux based routers via openvpn (routed) where one of them has a dynamic ip address (client).
02:17 < tomiondrums> if theres no data transfer for a couple of seconds the connection seems to go down (timeout?) and after this the server cannot initiate any connection to the client-side subnet unless some host from the client side subnet sends data to the server side subnet (this obviously re-establishes the connection automatically). is there any option for the client to have it never time out its connection?
02:30 <@vpnHelper> RSS Update - forum: TLS over UDP <http://forums.openvpn.net/topic7880.html>
02:57 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:01 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
03:01 -!- Haraken [~ryuk@unaffiliated/haraken] has left #openvpn ["Leaving"]
03:10 < Bushmills> !keepalive
03:10 < Bushmills> check out --keepalive
03:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
03:12 <@vpnHelper> RSS Update - forum: Connects to server, but that's it. <http://forums.openvpn.net/topic7881.html>
03:15 < tomiondrums> Bushmills: thank you, i'll give that a try
03:16 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:16 -!- mode/#openvpn [+o mattock] by ChanServ
03:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:25 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
03:27 -!- dazo_afk is now known as dazo
03:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
03:36 <@vpnHelper> RSS Update - forum: How do I connect to PC while it is running in client mode? <http://forums.openvpn.net/topic7869.html#p10887> || OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html#p10886>
04:02 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
04:03 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
04:11 -!- EugeneKay is now known as EugeneKaway
04:33 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has joined #openvpn
04:33 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has quit [Changing host]
04:33 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:35 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
04:43 -!- jason [~jason@acl1-830bts.gw.smartbro.net] has joined #openvpn
04:44 -!- jason is now known as Guest94630
04:46 -!- EugeneKaway is now known as EugeneKay
04:46 < Guest94630> What time in you country now?
04:52 < Guest94630> I created a server in windows but there are so many error on client-cert-not-required, username-as-common-name, and auth-user-pass-verify.
04:56 < Bushmills> read them, understand them, remedy them
04:57 < Guest94630> when I remove those three from my server config, I can successfully initiate my server.
04:58 < Bushmills> congrats
04:58 < Guest94630> But dont I need those options?
04:58 < Bushmills> depends
04:59 < Guest94630> Like the client-cert-not-required. I only need a CA option in my client but putting the option in my server causes username-as-common-name, and auth-user-pass-verify error.
05:00 < Guest94630> when I remove the client-cert and retain the username-as-common-name it also causes error. what could I have done wrong
05:00 <@vpnHelper> RSS Update - forum: OpenVPN on VMWare - Inital setup problems <http://forums.openvpn.net/topic7875.html#p10888>
05:00 < Bushmills> did you study the authentication section of the howto? 
05:03 < Guest94630> what is auth-pam.pl. How will I create that. What's inside it?
05:03 < Bushmills> sample script that performs PAM authentication
05:04 < Bushmills> inside it is perl code
05:04 < Guest94630> Where can I see a sample script sir so that I may study it
05:04 < Guest94630> http://www.koders.com/perl/fid649E21F6C96668A6828B586FE901F722553D6CE0.aspx
05:04 < Bushmills>  subdirectory examples of the docs/openvpn directory
05:04 <@vpnHelper> Title: Koders Code Search: auth-pam.pl - Perl (at www.koders.com)
05:05 < Guest94630> is that a sample?
05:05 < Bushmills> in .../docs/openvpn/examples, it is
05:05 < Guest94630> ok. will check
05:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 246 seconds]
05:06 < Guest94630> I have no /docs/openvpn/examples directory
05:07 < Guest94630> not even /docs
05:07 < Bushmills> neither do i
05:08 < Bushmills> ...  stood for "parent directories of your docs directory"
05:08 < Bushmills> i know where mine is, but i don't know where yours is
05:08 < Guest94630> can you give me yours maybe it is same as mine. i will just check
05:08 < Guest94630> im using centos
05:08 < Bushmills> mine is in /usr/share
05:09 < Guest94630> i have this directory /usr/share/doc/openvpn-2.1.4
05:09 < Guest94630> there are sample folders there
05:10  * Bushmills wonders how someone can use an operating system without knowing where the docs are
05:11 < Guest94630> i have seen it. thanks.
05:13 < Guest94630> auth-user-pass-verify c:\auth-pam.pl via-file <--is this the proper way of setting it up
05:20 -!- Guest94630 [~jason@acl1-830bts.gw.smartbro.net] has quit []
05:29 <@vpnHelper> RSS Update - forum: Open VPN Client specific ports. <http://forums.openvpn.net/topic7873.html#p10889>
05:33 -!- Guest94630 [~jason@acl1-830bts.gw.smartbro.net] has joined #openvpn
05:34 < Guest94630> Fri Apr 01 18:33:03 2011 PLUGIN_INIT: could not load plugin DLL: openvpn-auth-pam.so: %1 is not a valid Win32 application.   (errno=193) <<<<< ------ my error using plugin openvpn-auth-pam.so login
05:35 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:35 < Guest94630> now I opt to use auth-user-pass-verify auth-pam.pl via-file instead
05:36 -!- Guest94630 [~jason@acl1-830bts.gw.smartbro.net] has quit [Client Quit]
05:53 -!- Guest94630 [~jason@acl1-830bts.gw.smartbro.net] has joined #openvpn
05:53 < Guest94630> I have this problem Need IPv6 code in mroute_extract_addr_from_packet
05:53 < Guest94630> what is that problem?
05:54 < Guest94630> but Initialization Sequence Completed
05:54 < Guest94630> Bushmills, do you have any idea. I have no idea about this problem.
05:55 < Guest94630> I googling now for answers but I have found real solution
05:55 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
06:01 -!- Gomex [~rafaelgom@fedora/Gomex] has quit [Ping timeout: 240 seconds]
06:03 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
06:03 < Guest94630> dont you know the solution for the problem bushmills?
06:09 -!- Guest94630 [~jason@acl1-830bts.gw.smartbro.net] has quit []
06:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:32 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
06:51 <@vpnHelper> RSS Update - forum: OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html#p10890>
06:55 -!- EugeneKay is now known as EugeneKaway
07:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
07:03 -!- Gomex [~rafaelgom@187.115.164.226] has joined #openvpn
07:03 -!- Gomex [~rafaelgom@187.115.164.226] has quit [Changing host]
07:03 -!- Gomex [~rafaelgom@fedora/Gomex] has joined #openvpn
07:17 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
07:17 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
07:17 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
07:19 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
07:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:33 -!- Guest94630 [~jason@acl1-830bts.gw.smartbro.net] has joined #openvpn
07:36 < Guest94630> anybody around here?
07:37 < katoen_> i think so
07:37 < Guest94630> so silent but many users around.
07:38 < Guest94630> why do people login here when they do nothing. do they do something on the background?
07:39 < katoen_> yes, they do something in the background. or rather - beinge here is in their background, in case someone asks a question, for instance.
07:39 < Guest94630> but no one answers questions.
07:39 < katoen_> i don't think they here in order to improve a social life
07:40 < Guest94630> yes.
07:40 < katoen_> Guest94630: people do ask questions, just not every 5 minutes.
07:40 < Guest94630> possible.
07:41 < Guest94630> like me im not here to gain social life but rather I ask questions that I cant understand.
07:41 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
07:41 < Guest94630> sometimes I feel this channel is useless as for its purpose.
07:42 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Remote host closed the connection]
07:42 < katoen_> then maybe it is for you. personally, i've had great support for something people are not paid for.
07:42 < Guest94630> that is true if you get such support
07:43 < Guest94630> i guess the presumption here is that you are not a novice user of openvpn or linux for that matter
07:43 < Guest94630> I guess the presumption here is that you are already advance beginner and above
07:45 < katoen_> Guest94630: anyone is welcome to ask any openvpn related question, regardless of level of expertise
07:45 < Guest94630> I dont think so. I have been there.
07:45 < Guest94630> its either you are ignored or humiliated for the ignorance
07:46 < orkaa> katoen_: that isn't really the case
07:46 < orkaa> some users here are quite rough to noobs
07:46 < Guest94630> for once, they also started as noobs, newbies and the like
07:48 < Guest94630> its hard to understand all the concept of openvpn and linux when you have just started reading for roughly one week
07:48 < katoen_> one has to understand that these people aren't paid for being customer friendly. I think sometimes 'noobs' forget this fact and have certain expectations. If those aren't answered in the way they had envisioned, they perceive it as 'rude' or feel humiliated. 
07:50 < Guest94630> ofcourse I myself understand I did not pay them to answer my questions, but I get quotes and remarks.  If you have just seen those remarks, you can say it is humiliating to ask question to these people.
07:50 < Guest94630> gtg
07:50 -!- Guest94630 [~jason@acl1-830bts.gw.smartbro.net] has quit []
07:55 -!- EugeneKaway is now known as EugeneKay
07:57 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
08:01 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html#p10891>
08:01 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
08:13 -!- elly [~elly@april/fools/thewinningest/elly] has quit [Changing host]
08:13 -!- elly [~elly@april-fools/thewinningest/elly] has joined #openvpn
08:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
08:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:48 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
08:49 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
08:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:52 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
08:52 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
08:55 <@vpnHelper> RSS Update - forum: Connects to server, but that's it. <http://forums.openvpn.net/topic7881.html#p10892>
08:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:58 -!- tomiondrums [~kvirc@141.13.106.49] has left #openvpn ["No matter how dark the night, somehow the Sun rises once again"]
09:00 -!- EugeneKay is now known as EugeneKaway
09:00 -!- EugeneKaway is now known as EugeneKay
09:05 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:14 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 248 seconds]
09:14 -!- katoen_ is now known as Katoen
09:27 -!- luneff [~yury@84.51.195.188] has joined #openvpn
09:30 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:37 <@vpnHelper> RSS Update - forum: Load balancing, failover, etc. <http://forums.openvpn.net/topic7882.html>
09:40 -!- grapsus [~grapsus@acces1213.res.insa-lyon.fr] has quit [Remote host closed the connection]
09:46 -!- Blues-Man [~bluesman@95.239.124.200] has joined #openvpn
09:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
09:53 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:55 < crocket> OpenVPN!!!
09:55 < crocket> If I connect to OpenVPN server over UDP port 1194, NFS transfer speed reaches zero often.
09:56 < crocket> People said there was no QoS device installed.
09:56 < crocket> I don't know what's wrong.
09:58 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
09:59 < webmind> crocket, test your udp speeds with netcat
09:59 < crocket> webmind, Does netcat measure speed?
09:59 < webmind> no, but iptraf and dd do
10:00 < crocket> webmind, what a good cat.
10:00 < bwallen> Has anyone here used openvpn on a lan with a Sonicwall router? I can't seem to get the static routes working in SonicOS
10:00 < webmind> dd if=/dev/zeo of=- | netcat -u bla.ip 
10:00 < webmind> and receiving: netcat -u -l | dd if=- of=/dev/null
10:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:05 < bwallen> From my VPN server's lan I can ping TUN0 on my openvpn server. However, I can't ping clients. What could be causing this?
10:06 < crocket> bwallen, iroute
10:06 < crocket> Iroute
10:07 < bwallen> Thanks, I'll check that out
10:13 < dazo> it can also be lacking return route and firewalling as well
10:13 < dazo> bwallen: ^^ 
10:14 < dazo> tcpdump can give you some good hints
10:14 -!- Resno [~bryan@unaffiliated/resno] has joined #openvpn
10:16 < bwallen> dazo: I think you might be right, though this sonicwall router of mine is needlessly complicated to configure
10:16 -!- johnfg [johnfg@spirit.org] has joined #openvpn
10:16 < johnfg> hi folks
10:16 < crocket> bwallen, Is it a linux router?
10:17 < bwallen> crocket: no, it runs sonicos
10:17 < johnfg> Just wanted to say another thanks, and to let you know, after a number of reboots into other os's and such, that all is good with my config.
10:17 < johnfg> Both win xp boxes get the ip's assigned to them.
10:17 < dazo> bwallen: what kind of OS does the sonicwall run?  something which resembles Linux or so?
10:17 < crocket> bwallen, Do you use clinet-to-client?
10:18 < johnfg> So, my mapped drives can stay put, and not have to be unmounted, and reconnected to with another ip.
10:18 < bwallen> dazo: The sonicOS remindes me more of Cisco IOS rather than linux
10:18 < bwallen> crocket: yes
10:18 < dazo> ugh
10:18 < crocket> bwallen, The OpenVPN server doesn't need iroute.
10:18 < gladiatr> johnfg, excellent
10:19 < gladiatr> there are worse interfaces than ios... 
10:19 < dazo> bwallen: so your OpenVPN server is somewhere behind the sonicwall, then
10:19 < crocket> bwallen, If you want access to subnets behind OpenVPN clients, you need iroute.
10:19 < dazo> gladiatr: true
10:19 < bwallen> dazo: yes, that's correct
10:19 < bwallen> crocket: Oh, ok. I'm not worried about that so much as I am clients seeing the server network
10:19 < crocket> Can OpenVPN do NAT traversal?
10:20 < crocket> It doesn't seem to do so.
10:20 < dazo> bwallen: even though crocket is right ... try first to see on the OpenVPN server that it sees the return traffic, using tcpdump ... on the tunnel interface and the physical network interface
10:20 < bwallen> ok, I'll give that a shot
10:20 < crocket> dazo : We need to know his network configuration, first.
10:20  * dazo follows the rule to first figure out what's wrong before trying to fix it
10:22 < dazo> yeah, that comes next ... if traffic hits the VPN server correctly, but not the tunnel ... then it's time to look at OpenVPN config ... if not, then there's something else than openvpn
10:23 < dazo> bwallen: try to both ping the VPN servers physical network device and the VPN device, and then the OpenVPN clients VPN address and then at the end a client behind the OpenVPN client
10:28 < bwallen> dazo: I tried pinging both my openvpn server's physical and tun devices from a computer on the server's lan. It worked. I tried pinging a client's tun device and it didn't work. However, on my openvpn server I can see where the ping attempt was made
10:29 < dazo> okay, so the ping hits the tunnel, but doesn't come back
10:29 < dazo> check the firewall on the openvpn client then
10:29 < bwallen> ok
10:30 < dazo> that is, if you saw ICMP echo request hitting the tunnel device
10:34 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p10894>
10:36 -!- johnfg [johnfg@spirit.org] has left #openvpn ["Leaving"]
10:46 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p10895>
10:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
10:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
10:58 < bwallen> dazo: Sorry about the delay
10:58 < dazo> no worries :)
10:59 -!- Resno [~bryan@unaffiliated/resno] has left #openvpn []
10:59 < bwallen> dazo: When I pinged from a computer on the server's lan to a VPN client's tun0, tcpdump showed no activity on the server's tun0
10:59 < bwallen> So I'm guessing there is something misconfigured in my router
10:59 < bwallen> That is, the router on my server's lan
11:00 < helge-> hmm
11:00 < gladiatr> bwallen, I recommend grabbing it firmly by its mounting brackets and giving it a vigorous shake :)
11:01 < bwallen> I'm to the point where not only would I shake it, but I would go to the roof and through it off
11:01 < helge-> I have directive server 10.20.136.0 255.255.248.0
11:01 < helge-> can I somehow specify that only 10.20.136.4-10.20.142.254 should be used for dynamic clients?
11:02 < helge-> I'd like to set aside 10.20.143.0/24 for static clients
11:02 < dazo> bwallen: yeah, that sounds like a routing issue ... make sure you have on your server LAN box (the one doing ping's) have a route for your VPN network with the gateway set to your OpenVPN server
11:03 < helge-> Options error: --server already defines an ifconfig-pool, so you can't also specify --ifconfig-pool explicitly
11:03 <@vpnHelper> RSS Update - forum: Load balancing, failover, etc. <http://forums.openvpn.net/topic7882.html#p10896>
11:03 < helge-> ;|
11:03 < dazo> helge-: look at the --server statement in the man page ... --server is kind of like a macro which expands to a lot of different things, then you can use --ifconfig-pool manually to set the range yourself
11:03 < bwallen> Should I have two static routes (one for traffic to the VPN client and one for traffic from the clients)?
11:04 < dazo> helge-: --server and --ifconfig-pool cannot be used together, as --server also uses --ifconfig-pool in its "macro" expansion
11:04 < helge-> ah
11:04 < dazo> bwallen: for this particular test, yes
11:04 < helge-> I can see clearly now
11:04 < helge-> thanks :-)
11:04 < dazo> you're welcome!
11:04 < helge-> I sure am :)
11:04 < helge-> thanks for not LARTing me
11:04 < gladiatr> lol
11:04 < dazo> lol
11:05 < gladiatr> You have to really lay down a solid line of routing funk to be subject to banishment to the land of LART
11:09 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
11:09 <@vpnHelper> RSS Update - forum: Block p2P <http://forums.openvpn.net/topic7874.html#p10897>
11:12 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
11:21 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
11:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:29 -!- Gomex [~rafaelgom@fedora/Gomex] has quit [Quit: Saindo]
11:32 -!- Blues-Man [~bluesman@95.239.124.200] has quit [Quit: Sto andando via]
11:42 -!- McBoingbo [~mcboingbo@mail.hrsg.ca] has quit []
11:44 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
11:48 -!- morbidwar [~ovidiu@dyn-89.136.48.167.cj.upcnet.ro] has joined #openvpn
11:51 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
11:59 < bwallen> After some messing around with my VPN, it seems as if when I ping from my server lan to a VPN client, the ping gets to the VPN server, but no further. The request isn't forwarded to the client. Could I have a routing problem in my VPN Server?
12:02 < hjohnson> bwallen: or a firewalling problem.
12:03 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:03 <@vpnHelper> RSS Update - forum: Load balancing, failover, etc. <http://forums.openvpn.net/topic7882.html#p10898>
12:04 < mete> gladiatr: I've done some tests with udp
12:04 < mete> udp proto isn't the prob, only openvpn with upd ;)
12:04 < mete> udp^^  done't know why xD
12:17 < gladiatr> mete, have you checked out...
12:17 < gladiatr> !mtu
12:17 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
12:22 <@vpnHelper> RSS Update - forum: Configure as bridging mode question <http://forums.openvpn.net/topic7884.html>
12:36 < bwallen> Does this look right for the routing table on my openvpn server? http://pastebin.com/3vNr7Rhq
12:38 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
12:39 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p10900>
12:41 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 250 seconds]
12:41 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
12:42 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Read error: Operation timed out]
12:44 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p10901>
12:46 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:46 < mete> jep I've gladiatr ;)
12:47 < mete> 1542 is the result
12:47 < mete> or so
12:50 <@vpnHelper> RSS Update - forum: VPN connects, Ping works but nothing else <http://forums.openvpn.net/topic7878.html#p10903> || Configure as bridging mode question <http://forums.openvpn.net/topic7884.html#p10902>
12:58 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
13:02 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p10905>
13:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:19 -!- newmember [~chatzilla@209.82.97.21] has joined #openvpn
13:19 -!- newmember [~chatzilla@209.82.97.21] has quit [Client Quit]
13:22 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
13:23 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:26 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:26 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:26 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:32 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p10906>
13:38 < dazo> bwallen: have you enabled ip_forwarding on your server?
13:38 < dazo> openvpn server
13:39 < bwallen> dazo: No
13:39 < dazo> you need that
13:39 < bwallen> Is that in my openvpn.conf?
13:39 < dazo> nope, sysctl setting
13:40 < dazo> sysctl net.ipv4.ip_forward 1
13:40 < dazo> iirc
13:40 < bwallen> You are correct, good sir. It's commented out in my sysctl.conf
13:40 < dazo> and if that's not helping, it's most likely the firewall on that server as well
13:41 < dazo> that's a tricky bastard which is easy to forget about
13:41 < bwallen> Do I need to restart a service once I make the change to sysctl?
13:42 < dazo> nope, that's instant ... you can double check the setting by doing: cat /proc/sys/net/ipv4/ip_forward
13:43 < dazo> I presume you did: sysctl -p, to reload /etc/sysctl.conf ... if you modified that file
13:43 < bwallen> dazo, if I could kiss you, I would
13:43 < bwallen> that fixed my entire problem
13:43 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
13:44 < dazo> cool!   and I'm grateful there hopefully a big distance between us right now :-P
13:53 -!- gladiatr is now known as gladiatr_afk
13:56 -!- morbidwar [~ovidiu@dyn-89.136.48.167.cj.upcnet.ro] has quit [Remote host closed the connection]
14:02 <@vpnHelper> RSS Update - forum: Configure as bridging mode question <http://forums.openvpn.net/topic7884.html#p10907>
14:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
14:23 -!- luneff [~yury@84.51.201.89] has joined #openvpn
14:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:32 -!- espeed [~espeed@63.246.231.57] has quit [Ping timeout: 246 seconds]
14:33 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
14:49 -!- dazo is now known as dazo_afk
15:01 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 3.6.16/20110319135224]]
15:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
15:42 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
15:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
15:53 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
15:53 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
15:53 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
15:55 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
15:55 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
15:55 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:00 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
16:11 -!- krzie changed the topic of #openvpn to: openvpn was purchased by microsoft, it will only support PTP soon, have a nice day =]
16:11 -!- krzie is now known as krzee
16:13 < krzee> sorry to be the one to give the bad news
16:18 < hyper_ch> what bad news?
16:19 < havoc> topic
16:19 < havoc> also, note the day/date ;)
16:20 < hyper_ch> topics? Anyone reads them?
16:20 < hyper_ch> I thought those are just ornaments
16:21 < krzee> heheh
16:21 < krzee> ya im not very creative =/
16:21 < hyper_ch> btw, you noticed the catify feature at imgur?
16:27 < krzee> nope
16:28 < hyper_ch> got any pic of something ready?
16:29 < hyper_ch> https://imgur.com/blog/
16:29 < krzee> sure, i can pull any pic for that...
16:30 < hyper_ch> or you can do it yourelf
16:31 < hyper_ch> (1) go to imgur.com (2) click on web/computer (3) add url / select pic (4) click done (5) select the catify option (6) enjoy
16:36 -!- newmember [~chatzilla@209.82.97.21] has joined #openvpn
16:37 < krzee> im gunna catify the bsdpimp
16:37 < hyper_ch> :)
16:38 < krzee> http://i.imgur.com/DRVq3.jpg
16:38 < hyper_ch> cute :)
16:39 < krzee> nah the cat is on his shoes
16:39 < krzee> he should punt the cat for that
16:40 < hyper_ch> random cats at randome positions get inserted :)
16:43 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:56 -!- mete [~metefr@mete.shell.la] has quit [Remote host closed the connection]
16:56 -!- fipu [~fipufr@212.83.42.243] has quit [Remote host closed the connection]
16:59 -!- helge- [helge@olsentech.net] has quit [Ping timeout: 276 seconds]
17:02 -!- dandaman [~power@ip68-6-71-179.sb.sd.cox.net] has joined #openvpn
17:03 -!- mete [~metefr@mete.shell.la] has joined #openvpn
17:04 -!- dandaman1 [~power@ip68-6-71-179.sb.sd.cox.net] has quit [Ping timeout: 246 seconds]
17:07 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
17:12 -!- luneff [~yury@84.51.201.89] has joined #openvpn
17:17 -!- crocket2 [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
17:18 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
17:37 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
17:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:45 -!- newmember [~chatzilla@209.82.97.21] has quit [Ping timeout: 248 seconds]
18:00 < toortog> haha nice topic forgot what day it was, you got me lol!
18:05 < krzee> sweet!
18:05 < krzee> =]
18:06 < toortog> >8)
18:06 -!- krzee changed the topic of #openvpn to: openvpn was purchased by microsoft, it will only support PPTP soon, have a nice day =]
18:06 < krzee> i just saw it said PTP not PPTP
18:06 < krzee> heh
18:07 < toortog> all i saw was microsoft and then i lost it lol
18:07 < krzee> =]
18:11 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
18:35 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
18:35 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
18:42 < dvl> Just setting up the new MacBook. Recommend client is http://www.zeroshell.net/eng/openvpn-client/ ?
18:42 <@vpnHelper> Title: OpenVPN Client (at www.zeroshell.net)
18:42 < dvl> i.e. Tunnelblick
18:43 -!- takamichi [Takamichi@80.71.98.29] has quit [Remote host closed the connection]
18:45 < hjohnson> dvl: yeah I run tunnelblick
18:45 < hjohnson> works fine
18:46 < krzee> !osx
18:46 <@vpnHelper> "osx" is (#1) http://www.viscosityvpn.com/ (PAY), or (#2) http://www.tunnelblick.net/ (FREE)
18:47 < krzee> of course *i* use osx, and dont use ANY gui
18:47 < krzee> i just have a shell script i click from stacks
18:47 < krzee> gui for openvpn (that doesnt hook into management interface / server-only) just never made sense to me
18:48 < krzee> but i seem to be the exception, not the rule
18:49 < hjohnson> eh tunnelblick is easy enough to deal with
18:49 < hjohnson> nice hving it over in the menu ba
18:49 < krzee> well thats my issue with them
18:49 < krzee> for such a simple task, a gui is more work than not (for me)
18:50 < krzee> a gui just to click "start"
18:50 < hjohnson> well, if I didn't have that i'd have to go hunt for wherever the icon is
18:50 < krzee> heh
18:50 < hjohnson> krzee: and show me the status
18:50 < krzee> you click on the top of your screen (menu bar), i click on the bottom (stacks)
18:50 < krzee> same thing, except you run an extra app
18:51 < hjohnson> krzee: so does your thing show ou the tunnel is currently active?
18:51 < krzee> no, the terminal window does
18:51 < krzee> which may not be cool for most people
18:51 < krzee> but for me, thats where all my work gets done
18:51 < krzee> if im on the computer, i have at *least* 6 or so terminal tabs open
18:52 < hjohnson> sure I've got terminal open, but I'd rather not waste all that screen realestate on a single task
18:52 < hjohnson> smal little icon is a lot easier to glance at
18:52 < krzee> and you need to actually look at the status?
18:52 < hjohnson> ocassionally
18:53 < hjohnson> i've usually got a half dozen terminals going, don't need another
18:53 < krzee> i start my vpn's, they run fine, i usually add --daemon and close the terminal window and let it stay in the background
18:53 < krzee> i have my entire menu-bar filled, dont need another thing up there ;]
18:53 < krzee> menumeters
18:54 < krzee> i guess its pretty cool that each of us has an option that we prefer
18:56 < hjohnson> yeah
18:56 < hjohnson> i just wish that my corporate pn router did something more than IPSec or PPtP
19:14 -!- mete [~metefr@mete.shell.la] has quit [Remote host closed the connection]
19:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
19:22 < krzee> yep
19:22 < krzee> i believe that would be very different if it used the BSD license
19:22 < hjohnson> eh? 
19:22 < krzee> GPL basically makes it so that most people will NOT pre-package it (ie: apple / ms / whoever makes your router)
19:23 < hjohnson> this is an old linksys piece of crap that someone hasn't ported DD-WRT to
19:23 < krzee> so ya, cisco too
19:23 < hjohnson> so it is running linux, just that they haven't released a firmware update for it in ages
19:23 < krzee> i think all of them would have a much greater chance of supporting openvpn natively if it was BSD licensed
19:23 < krzee> but i get what you're saying
19:24 < krzee> and my hypothetical *if* means nothing
19:24 < hjohnson> heh
19:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:45 <@vpnHelper> RSS Update - forum: Problems with ethernet bridging Vpn <http://forums.openvpn.net/topic7885.html>
20:05 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has joined #openvpn
20:14 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
21:01 -!- p3rror [~mezgani@41.248.191.184] has joined #openvpn
21:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
21:22 <@vpnHelper> RSS Update - forum: plz help <http://forums.openvpn.net/topic7886.html>
21:25 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
21:33 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
21:50 -!- krzee changed the topic of #openvpn to: OpenVPN 2.1.4 Most Current || 2.2-RC2 Released 25-Mar-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: http://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly.
21:57 < pwrcycle> can anyone point me to a user/pass only howto?
21:59 < krzee> !authpass
21:59 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
21:59 < krzee> =]
22:02 < pwrcycle> krzee: any idea where i could find a full setup example?
22:02 < krzee> nope
22:03 < krzee> !howto
22:03 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:03 < krzee> theres info on configs there, then you remove anything about certs and add some options from my bot above
22:03 < krzee> more or less,
22:03 < krzee> !sample
22:03 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
22:03 < krzee> without cert stuff, with stuff from the bot
22:03 < krzee> and of course you need something to check against
22:04 < krzee> (the passwords)
22:04 < krzee> that can be anything you have a script for, active directory, database, PAM, flat file, whatever
22:04 < krzee> you might like:
22:04 < krzee> !dazo
22:04 <@vpnHelper> "dazo" is "eurephia" is http://www.eurephia.net/
22:05 < krzee> only supports database i *think*
22:05 < pwrcycle> thnx
22:05 < krzee> iirc sqlite with mysql on the way or something
22:05 < krzee> and eurephia is made by dazo, who happens to manage the git for openvpn
22:06 < krzee> he oversees community dev, so his stuff should be pretty good =]
22:08 < pwrcycle> awesome, the user access profile is what i was working toward
22:13 -!- master_of_master [~master_of@p57B56D7F.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
22:14 -!- master_of_master [~master_of@p57B56CE8.dip.t-dialin.net] has joined #openvpn
22:17 < krzee> =]
22:32 <@vpnHelper> RSS Update - forum: No connect option <http://forums.openvpn.net/topic7512.html#p10910>
22:34 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
22:35 -!- EugeneKay is now known as EugeneKaway
22:45 -!- EugeneKaway is now known as EugeneKay
22:50 <@vpnHelper> RSS Update - forum: No Connect Option <http://forums.openvpn.net/topic7887.html>
22:56 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
22:57 -!- crocket2 is now known as crocket
23:01 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
--- Day changed Sat Apr 02 2011
00:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
00:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:50 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:03 -!- p3rror [~mezgani@41.248.191.184] has quit [Ping timeout: 246 seconds]
01:20 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has left #openvpn ["Leaving"]
01:32 <@vpnHelper> RSS Update - forum: VPN connects, Ping works but nothing else <http://forums.openvpn.net/topic7878.html#p10912>
01:34 -!- d303k [~heiko@vpn.astaro.de] has quit [Ping timeout: 248 seconds]
01:38 <@vpnHelper> RSS Update - forum: restrict openvpn client <http://forums.openvpn.net/topic7809.html#p10913>
01:39 -!- d303k [~heiko@vpn.astaro.de] has joined #openvpn
01:52 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has quit [Quit: Verlassend]
02:09 -!- p3rror [~mezgani@41.140.26.153] has joined #openvpn
03:13 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
03:19 -!- luneff [~yury@84.51.201.89] has joined #openvpn
03:29 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
03:45 <@vpnHelper> RSS Update - forum: plz help <http://forums.openvpn.net/topic7886.html#p10915> || No Connect Option <http://forums.openvpn.net/topic7887.html#p10914>
03:51 <@vpnHelper> RSS Update - forum: Problems with ethernet bridging Vpn <http://forums.openvpn.net/topic7885.html#p10916>
04:23 -!- anAngel [~Angel@83.148.80.195] has joined #openvpn
04:24 < anAngel> !welcome
04:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:24 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 246 seconds]
04:25 < anAngel> !goal
04:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:25 < anAngel> !howto
04:25 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:26 < anAngel>  !route
04:26 < anAngel> !route
04:26 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:26 < anAngel> !redirect
04:26 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
04:27 < anAngel> !topology
04:27 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
04:27 < anAngel> !sample 
04:27 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
04:33 -!- EugeneKay is now known as EugeneKaway
04:36 -!- EugeneKaway is now known as EugeneKay
04:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:08 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:11 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
05:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:58 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
06:00 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
06:01 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
06:25 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:37 -!- anAngel [~Angel@83.148.80.195] has left #openvpn []
06:51 <@vpnHelper> RSS Update - forum: Problems with ethernet bridging Vpn <http://forums.openvpn.net/topic7885.html#p10917>
06:54 -!- EugeneKay is now known as EugeneKaway
06:57 <@vpnHelper> RSS Update - forum: Problems with ethernet bridging Vpn <http://forums.openvpn.net/topic7885.html#p10918>
07:14 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
07:39 <@vpnHelper> RSS Update - forum: Problems with ethernet bridging Vpn <http://forums.openvpn.net/topic7885.html#p10919>
07:43 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
07:43 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
07:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
07:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
08:09 <@vpnHelper> RSS Update - forum: Problems with ethernet bridging Vpn <http://forums.openvpn.net/topic7885.html#p10920>
08:18 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
08:20 < roentgen> !ccd
08:20 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
08:25 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
08:32 -!- kuhkatz [~kuhkatz@200-31-142-46.pool.kielnet.net] has joined #openvpn
08:32 -!- kuhkatz [~kuhkatz@200-31-142-46.pool.kielnet.net] has quit [Changing host]
08:32 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
08:33 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: No route to host]
08:34 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
08:34 -!- stony is now known as Guest60258
08:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:49 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
08:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:53 < hyper_ch> krzee: help
08:56 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has joined #openvpn
09:04 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:06 -!- corretico [~luis@201.201.44.82] has joined #openvpn
09:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:14 -!- orkaa [~nace@188-230-149-1.dynamic.t-2.net] has quit [Quit: orkaa]
09:25 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 248 seconds]
09:26 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:33 < krzie> ?
09:34 < krzie> hyper_ch, 
09:34 < hyper_ch> krzie: you're a server guru, right?
09:35 < hyper_ch> we have a little server in our office running web and email and voip
09:35 < hyper_ch> harddisk is on raid1, so one can fail, not a big deal
09:35 < hyper_ch> however if some other hardware fails, we're kinda cut off for a bit
09:35 < hyper_ch> is there some wait to put a "server into a raid"?
09:36 < krzie> CARP
09:36 < krzie> im sure you linux guys have a way too ;)
09:37 < hyper_ch> but how is the data set kept identical?
09:38 < krzie> depends what we're talking bout
09:39 < krzie> if database, replication
09:39 <@vpnHelper> RSS Update - forum: Add product version information to the windows binaries <http://forums.openvpn.net/topic7888.html>
09:39 < hyper_ch> my thoughts this fare have been more towards a "personal" cloud
09:39 < krzie> if firewall, pf has something for that
09:39 < hyper_ch> email is not database
09:39 < krzie> email you just use master / slaves
09:39 -!- Meliorator is now known as MelioratorTestin
09:40 < hyper_ch> hmmm, I have to think about that
09:40 < krzie> lol
09:40 < krzie> how does google do it hyper_ch?
09:40 < hyper_ch> they have an army of much smarter guys than me
09:40 < krzie> EVERYONE does it like that
09:41 < krzie> because there are accepted ways to solve your goal ;)
09:41 < hyper_ch> :)
09:41 < hyper_ch> regarding google, didn't they loose quite some emails a little while back=
09:43 < hyper_ch> well, I was pondering if a vm in a cloud could keep syned images of the same machine on multiple nodes
09:45 < krzie> then why did you say raid'ed servers instead of "backups"
09:46 < krzie> hehe
09:46 < hyper_ch> because I mean that
09:46 < hyper_ch> can't VMs in the cloud be stored on mutliple nodes at the same time
09:47 < hyper_ch> so if one node goes down, the data is still there on others?
09:47 < krzie> lets say there are 3
09:47 < krzie> and you keep data = on all 3
09:47 < krzie> all 3 are doing all the same processing?
09:47 < hyper_ch> yes
09:48 < hyper_ch> each one has a full set
09:48 < krzie> heh
09:48 < hyper_ch> not sure if that works in the cloud
09:48 < krzie> you just made the least efficient cluster ever
09:48 < hyper_ch> it's not about efficiency in that case
09:48 < krzie> obviously :-p
09:50 < hyper_ch> just make fun of me :(
09:50 < krzie> http://www.linux-ha.org/wiki/Main_Page
09:50 <@vpnHelper> Title: Linux-HA (at www.linux-ha.org)
09:50 -!- MelioratorTestin is now known as Meliorator
09:53 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:57 < hyper_ch> if I could just download my own krzie - life would be a lot simpler
10:19 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:21 < mant1s> Anyone in the lab?
10:26 -!- mete [~metefr@mete.shell.la] has joined #openvpn
10:39 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
10:53 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
11:13 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
11:19 < pwrcycle> what is the suggested WindowsXP client?
11:19 < krzee> !download
11:19 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
11:28 -!- muzy [~muzy@shells.chaosdorf.de] has joined #openvpn
11:28 < muzy> Aloha everyone
11:29 < muzy> I have a shot question: howto start a script/execute a command after openvpn has successfully started? (using the standard openvpn on debian squeeze)
11:29 < muzy> *short
11:31 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has joined #openvpn
11:39 -!- ewet [~ewet@unaffiliated/ewet] has joined #openvpn
11:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
11:39 < ewet> !welcome
11:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:40 < ewet> !goal
11:40 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:41 < muzy> ewet: thanks for the hints ;-)
11:41 < ewet> errm was it wrong to do this?
11:42 < muzy> no - it was helpfull - thanks for that
11:42 < muzy> everything is alright and fine
11:44 < ewet> err.. before I spam this channel with the answer bot: is there a more private way to get these infos? (I tried to msg vpnHelper)
11:45 < ewet> !wiki
11:45 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
11:45 < ewet> at least ;-)
11:51 < ewet> !/30
11:51 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
11:51 < ewet> !topology
11:51 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
11:53 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
11:55 < ewet> !route
11:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:56 -!- muzy [~muzy@shells.chaosdorf.de] has left #openvpn []
12:00 < ewet> !sample
12:00 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
12:01 < ewet> !mitm
12:01 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially, or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates, or (#3) then use: ns-cert-type server in the client config
12:01 < ewet> !howto
12:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:02 < ewet> !logs
12:02 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
12:02 < ewet> !configs
12:02 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
12:03 < ewet> !iporder
12:03 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
12:03 < ewet> okay thanks so far bye ;)
12:03 -!- ewet [~ewet@unaffiliated/ewet] has left #openvpn []
12:06 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
12:06 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has quit [Quit: orkaa]
12:12 < krzee> !learn msg as to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key>
12:12 <@vpnHelper> Joo got it.
12:12 < krzee> !learn msg as so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
12:12 <@vpnHelper> Joo got it.
12:22 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:24 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has joined #openvpn
12:43 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
12:45 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Remote host closed the connection]
12:49 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has joined #openvpn
12:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
12:58 <@vpnHelper> RSS Update - forum: Unable to connect to UDP <http://forums.openvpn.net/topic7889.html>
12:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:29 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
14:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:25 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
15:34 -!- mete [~metefr@mete.shell.la] has quit [Remote host closed the connection]
15:44 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
16:11 <@vpnHelper> RSS Update - forum: restrict openvpn client <http://forums.openvpn.net/topic7809.html#p10923>
16:12 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
16:12 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
16:12 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
16:14 -!- fjhMiQ[G [steve@bouncer.stephen.marsh.name] has quit [Excess Flood]
16:15 -!- muNRSdfV [steve@bouncer.stephen.marsh.name] has joined #openvpn
16:18 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
16:23 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
16:27 -!- Guifort [~Administr@48.227.86-79.rev.gaoland.net] has joined #openvpn
16:31 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
16:36 -!- Guifort [~Administr@48.227.86-79.rev.gaoland.net] has quit [Quit: Quitte]
16:41 <@vpnHelper> RSS Update - forum: Connects to server, but that's it. <http://forums.openvpn.net/topic7881.html#p10924>
16:47 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
16:49 < ph1l> how does a side2side vpn is supposed to work with openvpn? can anybody enlight me? 
16:50 < ph1l> i'm asking this question because the client is recieving a ip from the server... and my hosts on the client side are only able to talk to the hosts on the server side if i nat them behind the pool-ip recieved from the server...
16:51 < ph1l> but this results in not being able to talk from a server-side host to a host on the client side (because of the nat)... so its actually not a s2s... 
16:51 < krzee> !route
16:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:52 < krzee> i assume from your details that you mean that ^ when you say side to side vpn
16:52 < krzee> or had you typed !goal ...
16:52 < krzee> !goal
16:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:52 < krzee> I would like to access the lan behind then server and the lan behind the client
16:54 < ph1l> thanks for your explanation... i've thought about routing... but... here is what i've like to archive:
16:55 < krzee> achieve
16:56 < ph1l> transparent connection between two sites over the internet. server has two /24 private networks and static/public IP, openvpn client has one /24 network. any host on the server side (or client side) should be able to talk to each other
16:57 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:57 < ph1l> client has dynip.
16:58 < ph1l> it could be a pfsense problem, actually... and not a openvpn...?
16:59 < ph1l> atm it is working if i hide the client hosts behind the ip recieved from the openvpn server
17:01 < ph1l> !goal
17:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:03 < krzee> i told you the solution
17:03 < krzee> !route
17:03 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
17:04 < krzee> you want your server to see a client's lan, and all clients to see the specific client's lan, as well as the 2 lans behind the server
17:04 < krzee> that is !route
17:05 < ph1l> thanks much for your guidance... i'll skim trough it :-)
17:10 < krzee> HAH
17:10 < krzee> skim it and i will write a small shell script to reach through your monitor!
17:10 < krzee> ;]
17:11 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
17:33 -!- luneff [~yury@84.51.201.89] has joined #openvpn
17:34 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
17:42 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:51 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
18:00 < ph1l> haha: krzee, thank you much for your hints! it was worth to chewing on this problem a little more! 
18:00 < ph1l> btw, it was a pfsense problem... 
18:04 -!- GambitDeclined [~GambitDec@c-67-169-203-90.hsd1.or.comcast.net] has joined #openvpn
18:05 < GambitDeclined> !welcome
18:05 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:05 < GambitDeclined> !goal
18:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:09 -!- EugeneKaway is now known as EugeneKay
18:12 -!- fipu [~fipufr@212.83.42.243] has joined #openvpn
18:12 -!- mete [~metefr@mete.shell.la] has joined #openvpn
18:13 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
18:14 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Client Quit]
18:14 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:14 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:20 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
18:26 -!- bitterman [~yury@84.51.201.89] has joined #openvpn
18:29 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 255 seconds]
18:37 < mete> are these values normal:
18:37 < mete> Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
18:37 < mete> Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
18:37 < mete> ?
18:38 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has quit [Quit: Verlassend]
18:40 < GambitDeclined> Hi All. If my client machine is disconnected from the VPN, I would like to make sure that no net traffic is sent in the open. Is there a way to ensure that I will only send traffic when the VPN is connected?
18:43 < Bushmills> firewall all non-vpn and non-tunnel traffic
18:47 < GambitDeclined> Bushmills, Hmm... that would work. I guess I could write a script that I could startup when I started the VPN.
18:47 < Bushmills> just keep the rules active all the time
18:48 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:49 < GambitDeclined> Bushmills, Will, I really only want to running "most" of the time, not all of the time. :-) Especially, since I'm still trying to figure out how to configure the server. 
18:49 < Bushmills> how else would you block traffic when vpn hasn't been started if you only run script when vpn starts?
18:50 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 250 seconds]
18:50 < GambitDeclined> Bushmills, Er... I think that was part of my question when I started. 
18:51 < Bushmills> " Is there a way to ensure that I will only send traffic when the VPN is connected?" .. no traffic when disconnected -> firewall.  when connected, traffic through von only -> firewall
18:51 < Bushmills> either case, it is firewall
18:53 < GambitDeclined> I can't have all my traffic firewalled all the time, if I want to be connected to the net without the firewall. I was thinking that a script that blocked all traffic except for VPN traffic was the solution you suggested. That would work, but I don't want to manually configure the firewall everytime I need to connect to the net without a VPN. 
18:53 < GambitDeclined> Oops, without the VPN (not the firewall).
18:53 < Bushmills> then rethink your question
18:55 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has joined #openvpn
18:56 < GambitDeclined> Part of my problem is figuring out the terminology that experts like yourself use to be able to restate my question.
18:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:00 -!- gyyrog [~gyyrog@75-129-104-146.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:01 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:03 -!- bitterman [~yury@84.51.201.89] has quit [Quit: Leaving]
19:31 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has joined #openvpn
19:32 < chrome_> I use the openVPN client in my house and in my office. Why connecting through my house connection is so slow?
19:32 < chrome_> and in my office is so fast
19:38 <@vpnHelper> RSS Update - forum: appliance woking : You do not have Administrative permission <http://forums.openvpn.net/topic7661.html#p10925>
19:40 < GambitDeclined> Assume that I am web surfing at Starbucks with my laptop (using their open wifi) and I am protecting the wireless portion of my connection by using OpenVPN from the laptop to my wired server at home. 
19:40 < GambitDeclined> If the laptop is disconnected from the server, but the OpenVPN client is still running on my laptop will all network traffic be stopped by the client until the connection is re-established with the OpenVPN server? Or will the network traffic bypass the OpenVPN client and send packets in the clear until an OpenVPN tunnel is re-established to the server?
19:40 < GambitDeclined> If the later, what is the OpenVPN command or method that will stop all network traffic until the encrypted tunnel is re-established?
19:43 < GambitDeclined> chrome_, Does your office Internet connection have more bandwidth and lower latency than your home Internet connection?
19:43 < chrome_> yes
19:43 < chrome_> but my home connection works fine too
19:47 < GambitDeclined> chrome_, I am a complete novice concerning VPN, but you may want to run several net speed test from your home and office and see if there is a difference. There are a lot of variables that can affect network speed that may be complete unrelated to OpenVPN.
19:49 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 255 seconds]
19:49 < chrome_> ok, I'll check that out
19:59 < GambitDeclined> Hmm... in my enthusiasm to state my last question clearly, I may have over done it. What happens to network traffic from a client, if an OpenVPN client that is still running is disconnected from the OpenVPN server?
20:06 < chrome_> It's a good question, I think packets are sent in clear. But you better ask in the web forum or so
20:08 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
20:09 < GambitDeclined> Yes. You are right. I just found an answer to a question close to mine. Essentially, you have to be able to send packets in the clear, otherwise you can't establish a vpn to begin with. :-)
20:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:41 -!- chrome_ [~chatzilla@unaffiliated/chrome/x-455334] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
21:03 -!- Gambit_Declined [~GambitDec@85.17.141.97] has joined #openvpn
21:06 -!- GambitDeclined [~GambitDec@c-67-169-203-90.hsd1.or.comcast.net] has quit [Ping timeout: 276 seconds]
21:06 -!- Gambit_Declined is now known as GambitDeclined
21:10 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
21:11 < genesis7> good day all, I just would like to ask now many ip address are generated for 10.8.0.0/24 ?
21:13 < toortog> 0/24 is 256 i think or 255
21:14 < toortog> 254 not 256 ha WHOOPS
21:14 < toortog> sorry on caps
21:14 < genesis7> I see what if I want more than 254? how will I do that?
21:14 < genesis7> like for example 400 ip addresses
21:15 < genesis7> can I use 10.8.0.0./48 or something?
21:15 < ph1l> take a 10.0.0.0/23
21:15 < toortog> 0-/23
21:15 < ph1l> thats 10.0.0.0-10.0.1.255
21:16 < toortog> 512 ips
21:16 < genesis7> 10.0.0.0/23 = 512 ips
21:16 < genesis7> 10.0.0.0/23 = 512 ips?
21:17 < genesis7> so I will make an option in my server config lik server 10.0.0.0 255.255.255.0
21:17 < genesis7> is my option correct?
21:18 < toortog> 255.255.254.0
21:18 < genesis7> server 10.0.0.0 255.255.254.0 is that correct torrtog?
21:26 < toortog> idk never tryed more then /24 setup
21:27 < toortog> you can try
21:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
21:28 -!- GambitDeclined [~GambitDec@85.17.141.97] has quit [Ping timeout: 248 seconds]
21:28 < genesis7> thanks @toortoog. how about you @ph1l, can you confirm using server 10.0.0.0 255.255.254.0 give 512 ip address for client
21:33 < toortog> genesis7 yes it will i just tryed
21:33 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
21:34 < toortog> server 10.0.0.8 255.255.254.0 with 10.0.0.8/23 for tunnel network
21:34 -!- nb [~nb@fedora/nb] has joined #openvpn
21:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:43 -!- genesis7 [~genesis7@amertospromotions.com] has quit [Ping timeout: 250 seconds]
21:44 -!- genesis7 [~genesis7@amertospromotions.com] has joined #openvpn
21:44 < genesis7> toortog thanks. how did you test it that you verify that it will really give your 512. Anyway I am presently reading this article http://www.pantz.org/software/tcpip/subnetchart.html
21:44 <@vpnHelper> Title: Internet Protocol (IPv4) Subnet Chart (at www.pantz.org)
21:44 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:57 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:12 -!- master_of_master [~master_of@p57B56CE8.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
22:14 -!- master_of_master [~master_of@p57B5603B.dip.t-dialin.net] has joined #openvpn
22:35 -!- genesis7 [~genesis7@amertospromotions.com] has quit []
23:15 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has quit [Quit: orkaa]
23:22 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has joined #openvpn
23:24 < kunago> Hello guys. My OpenVPN server is connecting and exposing 4 subnets 172.17.1-4.0; my server is using the subnet 172.17.10.0. Can I make the clients connecting to the server use always the same IP address?
23:27 < kunago> Is "ifconfig-push" in the clients ccd file the way to go?
23:37 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
--- Day changed Sun Apr 03 2011
00:16 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has joined #openvpn
00:16 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has quit [Changing host]
00:16 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
00:28 < MJD> hi all, I'm having an issue with push "route ..." and iroute.  I have a network sitting behind an openvpn client I want other openvpn clients to access.  Clients successfully communicate with client-to-client active.
00:29 < MJD> In the server i have the line: push "route 192.168.2.0 255.255.255.0 192.168.3.254"
00:29 < MJD> and in the client's ccd file, I have: ifconfig-push 192.168.3.1 255.255.255.0
00:29 < MJD> iroute 192.168.2.0 255.255.255.0
00:30 < MJD> where 192.168.2.x/24 is the network behind the openvpn client, and 192.168.3.0/24 is the openvpn network.
00:31 < MJD> Everything seems to work except for the fact the client sharing the network gets the route to the network to go through the openvpn server, which breaks the routing system.  According to the docs, iroute should prevent this route from being pushed but does not.  Is there a mistake in my config?  Or is there a bug?
00:31 < MJD> I am able to communicate successfully once I delete that extra route.
00:42 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
00:42 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
00:42 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
00:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:13 < krzie> MJD, 
01:13 < krzie> !route
01:13 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
01:14 < krzie> in route push route
01:14 < krzie> remove 192.168.3.254
01:14 < krzie> dont push .1, that is for the server
01:15 < krzie> basically,
01:15 < krzie> !sample
01:15 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
01:15 < krzie> and !route
01:16 < krzie> if you are using topology subnet you can ifconfig-push 192.168.3.2 255.255.255.0
01:16 < krzie> !static
01:16 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
01:17 < krzie> kunago, yes, see !static above
01:17 < krzie> toortog, openvpn will puke before  it serves up 512 clients at once
01:18 < krzie> and in his example, he would be using a /30 for every client, unless using tap or topology subnet
01:25 <@vpnHelper> RSS Update - forum: VPN works fine, pings both ways; can't map drive letter. <http://forums.openvpn.net/topic7890.html>
01:36 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
01:39 < kunago> krzie: Thanks a lot, will try that.
01:41 < krzie> np
01:41 < MJD> krzie: I read through that wiki link.  However, when I tried only:  push "route 192.168.2.0 255.255.255.0", the server got made and printed:Apr  3 02:38:34 mtab ovpn-personal[14322]: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
01:41 < MJD> Apr  3 02:38:34 mtab ovpn-personal[14322]: OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.
01:41 < MJD> 2.0
01:41 <@vpnHelper> RSS Update - forum: VPN works fine, pings both ways; can't map drive letter. <http://forums.openvpn.net/topic7890.html#p10927>
01:41 < krzie> !configs
01:41 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
01:42 < MJD> !pb
01:42 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
01:48 < MJD> Server config: http://pastebin.com/Ub5RYtwP , CCD: http://pastebin.com/EMWRw6Sa , Client: http://pastebin.com/3aWfQpmG (used on all clients with relevant keys.  CN's are all different).
01:49 < MJD> I'm using a various mixture of Debians for all pieces, Debian Squeeze on Server + Client sharing lan, and Debian Sid on other client.
01:50 < MJD> OpenVPN 2.1_rc11 on Squeeze, OpenVPN 2.1.3 on Sid (default versions that come with Debian).
01:50 < MJD> krzie ^, and thnks for your help!
01:51 < MJD> Also, does openvpn care if I throw the server on to a random different ip?  The openvpn server isn't so much a server as a moderator to let the different pieces talk, thats why its ip is 254 and not1.
02:00 -!- dvl [~Dan@pdpc/supporter/active/dvl] has quit [Excess Flood]
02:03 -!- dvl [~Dan@nyi.unixathome.org] has joined #openvpn
02:12 -!- p3rror [~mezgani@41.140.26.153] has quit [Ping timeout: 246 seconds]
02:26 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
02:29 -!- p3rror [~mezgani@41.140.24.136] has joined #openvpn
02:31 < krzie> you didnt change your ifconfig-push like i said to
02:31 < krzie> you CANT give out .1 to a clieny
02:31 < krzie> client
02:32 < krzie> it is NOT an option
02:32 < krzie> stop re-inventing --server
02:32 < krzie> you are trying to make it more complicated than it needs to be
02:33 < krzie> [02:16]  <krzie> basically,
02:33 < krzie> [02:16]  <krzie> !sample
02:33 < krzie> [02:16]  <vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
02:33 < krzie> [02:16]  <krzie> and !route
02:35 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
03:07 -!- p3rror [~mezgani@41.140.24.136] has quit [Ping timeout: 255 seconds]
03:09 -!- Champi [Champi@rootshell.fr] has quit [Read error: Operation timed out]
03:11 -!- Champi [Champi@rootshell.fr] has joined #openvpn
03:16 -!- p3rror [~mezgani@41.140.34.155] has joined #openvpn
03:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:33 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Read error: Operation timed out]
03:33 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
03:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:46 -!- kunago [~miroslav@213-194-242-126-eth3-gwbar-user.802.cz] has quit [Ping timeout: 276 seconds]
03:48 -!- mete [~metefr@mete.shell.la] has quit [Ping timeout: 246 seconds]
03:51 -!- mete [~metefr@mete.shell.la] has joined #openvpn
03:53 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
04:34 -!- EO_ [debian-tor@gateway/tor-sasl/eo/x-78165100] has quit [Ping timeout: 246 seconds]
04:52 -!- cromega [crome@moronia.hu] has joined #openvpn
04:57 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has quit [Quit: Verlassend]
05:01 < cromega> hi
05:03 < cromega> what are the recommended options turned on/off if the most network throughput with the least stress on the cpu is the priority?
05:03 < cromega> I set cipher to none
05:03 < cromega> right now checking of disabling lzo has an impact
05:08 -!- EugeneKay is now known as EugeneKaway
05:14 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:20 < krzie> consider a GRE tunnel instead
05:21 < krzie> doesnt sound like your goal has anything to do with a vpn
05:21 < krzie> unless you need it for the server/client functionality i guess
05:23 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
05:29 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has quit [Ping timeout: 276 seconds]
05:29 -!- oc80z [oc80z@blea.ch] has joined #openvpn
05:41 -!- kuhkatz [~kuhkatz@174-42-142-46.pool.kielnet.net] has joined #openvpn
05:41 -!- kuhkatz [~kuhkatz@174-42-142-46.pool.kielnet.net] has quit [Changing host]
05:41 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
06:30 <@vpnHelper> RSS Update - forum: restrict openvpn client <http://forums.openvpn.net/topic7809.html#p10929>
06:33 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
06:42 <@vpnHelper> RSS Update - forum: how to restrict? <http://forums.openvpn.net/topic7892.html>
06:43 < echoSMILE> the option  --enable-pthreads for openvpn 2.1.x still valid? or is something configured by default?
06:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Read error: Operation timed out]
06:53 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has quit [Read error: Operation timed out]
06:53 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
06:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Read error: Operation timed out]
07:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:32 -!- EugeneKaway is now known as EugeneKay
07:42 -!- luneff [~yury@84.51.195.188] has joined #openvpn
07:43 -!- luneff [~yury@84.51.195.188] has quit [Read error: Connection reset by peer]
07:43 -!- luneff [~yury@84.51.195.188] has joined #openvpn
07:49 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:06 -!- ewet [~ewet@unaffiliated/ewet] has joined #openvpn
08:08 < ewet> hi, my openvpn config almost works. I just have a question about push "redirect-gateway def1". I commented that line out but my client is still getting a new gw after connecting to the vpn. what should I read?
08:20 < ewet> it's all good -- the network "manager" is a bitch...
08:20 < ewet> cool. openvpn up and running here! thanks for your work :-)
08:24 -!- ewet [~ewet@unaffiliated/ewet] has left #openvpn []
09:10 < |Mike|> I like people like ewet
09:30 < MJD> hi all, I seem to have it working.  Openvpn didn't like the extra parameter attached to the push "route ...".  I originally put that there as I didn't have a push "route-gateway ...", and with thoses changes its all working.  Thanks for your time.
09:44 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:46 -!- EugeneKay is now known as EugeneKaway
09:50 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Quit: leaving]
09:52 <@vpnHelper> RSS Update - forum: VPN works fine, pings both ways; can't map drive letter. <http://forums.openvpn.net/topic7890.html#p10931>
09:55 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
09:55 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
09:55 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:56 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
09:56 -!- Guest60258 is now known as stony
09:57 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
09:58 -!- Blues-Man [~bluesman@95.239.124.200] has joined #openvpn
10:03 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Read error: Operation timed out]
10:04 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has joined #openvpn
10:06 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:09 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has quit [Remote host closed the connection]
10:10 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has joined #openvpn
10:11 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:12 -!- [x_x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:15 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
10:16 -!- Sky[xx] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
10:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:24 -!- _zoom_ [~zero@196.1.219.211] has joined #openvpn
10:24 < _zoom_> hello, OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.0.0 ?
10:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
10:31 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
10:40 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
11:02 -!- Guest_IRC [~O.M.G@14.207.120.89] has joined #openvpn
11:03 < echoSMILE> if I have some vpn using TAP interface, where in one (A) point I have lan: 192.168.1.x tap: 192.168.0.x and in the other side (B) point I have lan: 192.168.3.x tap: 192.168.0.x , with this config I automatically can access from B point to A the 192.168.1.x network? or I need config routes?
11:04 < Guest_IRC> hello
11:05 < Guest_IRC> who r stay here
11:07 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:09 < Guest_IRC> who r stay here
11:10 -!- Guest_IRC [~O.M.G@14.207.120.89] has quit []
11:20 -!- Blues-Man [~bluesman@95.239.124.200] has quit [Ping timeout: 248 seconds]
11:23 -!- Blues-Man [~bluesman@95.239.124.200] has joined #openvpn
11:26 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
11:31 -!- jpalmer is now known as lol
11:31 -!- lol is now known as jpalmer
11:35 -!- _zoom_ [~zero@196.1.219.211] has quit [Quit: Leaving.]
11:35 -!- _zoom_ [~zero@196.1.219.211] has joined #openvpn
11:40 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
11:49 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
11:58 < _zoom_> hello, OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.0.0 , ideas ?
12:00 < Bushmills> yes, just what the message says
12:09 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 250 seconds]
12:17 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has left #openvpn []
12:21 -!- Blues-Man [~bluesman@95.239.124.200] has quit [Read error: Connection reset by peer]
12:24 < _zoom_> Bushmills: same configuration works for other systems 
12:25 < Bushmills> doesn't imply that the error message is wrong
12:28 < _zoom_> my client cannot accept the push route msg came from server
12:32 < Bushmills> i will just sit back and look from time to time. once you have provided sufficient information to make a reasonable diagnosis possible, somebody, possibly even me, will reply. 
12:34 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Read error: Operation timed out]
12:35 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
12:35 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 248 seconds]
12:36 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Quit: No Ping reply in 180 seconds.]
12:36 < _zoom_> please check http://pastebin.com/PLHCzf14
12:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
12:39 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
12:39 -!- _zoom_ [~zero@196.1.219.211] has quit [Quit: Leaving.]
12:40 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:41 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:46 < Bushmills> reading warnings must be an art form not mastered by everybody
13:11 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
13:30 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
13:33 -!- luneff [~yury@84.51.201.89] has joined #openvpn
13:43 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
13:43 -!- mode/#openvpn [+o mattock] by ChanServ
14:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:15 -!- dvl [~Dan@nyi.unixathome.org] has quit [Changing host]
14:15 -!- dvl [~Dan@pdpc/supporter/active/dvl] has joined #openvpn
14:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:50 -!- dandaman [~power@ip68-6-71-179.sb.sd.cox.net] has quit [Read error: Connection reset by peer]
15:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
15:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:31 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:41 <@vpnHelper> RSS Update - forum: Open VPN Client specific ports. <http://forums.openvpn.net/topic7873.html#p10932>
15:47 <@vpnHelper> RSS Update - forum: VPN connects, Ping works but nothing else <http://forums.openvpn.net/topic7878.html#p10934> || Configure as bridging mode question <http://forums.openvpn.net/topic7884.html#p10933>
15:53 <@vpnHelper> RSS Update - forum: Unable to connect to UDP <http://forums.openvpn.net/topic7889.html#p10935>
15:59 <@vpnHelper> RSS Update - forum: VPN works fine, pings both ways; can't map drive letter. <http://forums.openvpn.net/topic7890.html#p10937> || Connects to server, but that's it. <http://forums.openvpn.net/topic7881.html#p10936>
16:00 -!- [x_x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
16:00 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:04 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
16:04 < naquad> hi
16:05 <@vpnHelper> RSS Update - forum: TLS over UDP <http://forums.openvpn.net/topic7880.html#p10939> || Installing Access Server on Gentoo <http://forums.openvpn.net/topic7879.html#p10938>
16:08 < naquad> i've got this in logs: http://pastebin.com/bsZ9YP0w couple of days ago everything was working, but when i've checked todays morning it didn't :( server is accessible, iptables don't block this port, but still client fails. maybe thats caused by different versions of openvpn client and server?
16:11 <@vpnHelper> RSS Update - forum: How do I connect to PC while it is running in client mode? <http://forums.openvpn.net/topic7869.html#p10940>
16:51 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:52 < purpleidea> hey there. i have two identical machines, running openvpn exactly the same way, however my 'up' script generates an error on only one. any helps appreciated
16:55 < purpleidea> error is: Starting openvpn: /etc/openvpn/tap0.up: line 3: /usr/sbin/brctl: Permission denied
16:56 < krzee> i dont troubleshoot bridges, but try running it manually
16:56 < krzee> be sure you are root and that it is +x
16:56 < purpleidea> krzee: it works perfectly when i run it on command line.
16:56 < purpleidea> however the weirder thing is it works perfectly run as a daemon on the other *identitcal* machine...
16:56 < purpleidea> identical*
16:57 < krzee> why are you bridging anyways
16:57 < purpleidea> krzee: why not? (it's for a ha-vm setup)
16:57 < purpleidea> ps shows: /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/tap0.pid --config tap0.conf --cd /etc/openvpn --script-security 2
16:57 < krzee> WELL
16:57 < krzee> why not...
16:59 < purpleidea> listening....
16:59 <@vpnHelper> RSS Update - forum: VPN works fine, pings both ways; can't map drive letter. <http://forums.openvpn.net/topic7890.html#p10941>
17:02 < purpleidea> krzee: do you know of something besides /etc/openvpn/ that would be different between the two machines?
17:03 < krzee> unless you have a specific layer2 protocol you need over the vpn:  A) you are wasting packet space by tunneling an extra layer  B) layer2 has NO security built in so you open your vpn to trust attacks from other nodes, C) it is harder to setup
17:04 < krzee> yes, the stuff required by your script
17:04 < hjohnson> I could probably go to a routed network, now that I've got avahi setup right (in a rebroadcast mode)
17:04 < purpleidea> krzee: yeah, no that's okay... the two machines are directly attached (atm) i _do_ need this at layer 2
17:05 < purpleidea> krzee: the scripts are identical on both machines. i've deployed it all with puppet, and the diffs are identical
17:05 < krzee> so you are bridging machines that are ALREADY on the same lan?
17:05 < krzee> LOL
17:05 < purpleidea> krzee: i know what i'm doing. i
17:05 < krzee> you dont see something wrong with that?
17:05 < purpleidea> i'm just having trouble with openvpn
17:05 < krzee> if you know what you're doing i find it funny you're here ;)
17:06 < purpleidea> krzee: i could explain the intricacies of why it makes sense, i just don't want to waste your time...
17:06 < krzee> but ok, you sound like you know you need a bridge even tho you cant mention a layer2 protocol you need over it, so ill just leave it at "i dont support bridged"
17:07 < purpleidea> the reason i need a layer 2 bridge is because as a vm is passing from one machine to the other, the gateway doesn't have to move (immediately)
17:07 < purpleidea> the layer 2 protocol is arp
17:08 < purpleidea> krzee: and my problem isn't anything with bridging, it works perfectly, it just doesn't run the up script for some reason...
17:10 < krzee> umm
17:10 < krzee> thats not a valid reason for a bridge
17:10 < krzee> IP will flow over the VMs
17:10 < krzee> your up script DOES the bridging, LOL
17:10 < purpleidea> krzee: i just (please) need some help finding why openvpn won't run the up script.
17:10 < krzee> /usr/sbin/brctl: Permission denied
17:10 < |Mike|> l o l.
17:10 < krzee> what did you think brctl was for? :-p
17:10 < purpleidea> krzee: even when i replace it with /bin/touch /tmp/DUDE it gives same error
17:11 < |Mike|> add su or sudo ;)
17:11 < krzee> "and my problem isn't anything with bridging, it works perfectly"   "/usr/sbin/brctl: Permission denied"
17:11 < krzee> heh
17:11 < purpleidea> krzee: once openvpn is running i can (as root) run brctl myself and the bridge works...
17:11 < krzee> |Mike|, up script should run before dropping privs iirc
17:11 < purpleidea> krzee: it's true.
17:11 < krzee> purpleidea, either way, the bridge part is EXACTLY what isnt working
17:12 < purpleidea> and it also works other machine1 so whywouldn't it on machine2?
17:12 < krzee> dunno, as i said i dont troubleshoot bridges
17:12 < krzee> and you havnt said a worthy reason to use a bridge
17:12 < purpleidea> okay can you help me understand why it won't run /bin/touch
17:12 < krzee> im guessing the real reason is:  "the walkthrough i used was for a bridge"
17:13 < purpleidea> Starting openvpn: /bin/touch: cannot touch `/tmp/DUDE': Permission denied
17:13 < purpleidea> krzee: i don't understand about the walkthrough...
17:15 < purpleidea> can anyone tell me why openvpn is having permission errors running an up script?
17:15 < krzee> im guessing an error in permissions? :-p
17:15 < |Mike|> touch /tmp/x ?
17:15 < krzee> maybe its not +x maybe the DIR it is in is not +x
17:15 < |Mike|> ls -slah /
17:15 < |Mike|> or /tmp
17:15 < purpleidea> krzee: what permissions are required for touch on /tmp ?
17:16 < krzee> maybe something else, but i dont troubleshoot bridges
17:16 < |Mike|> 4.0K drwxrwxrwt  5 root root 4.0K Apr  4 00:15 tmp
17:16 < |Mike|> should be writable for *
17:16 < |Mike|> (not the safest way imho)
17:16 < purpleidea> Starting openvpn: /etc/openvpn/tap0.up: line 7: /bin/ls: Permission denied
17:17 < krzee> fine, post tap0.up, post ls -la /etc/openvpn/ 
17:17 < krzee> in pastebin
17:17 < krzee> but really, you're still doing it wrong
17:17 < krzee> [15:13]  <purpleidea> krzee: i don't understand about the walkthrough...
17:17 < krzee> what part didnt you understand?
17:17 < krzee> [15:12]  <krzee> im guessing the real reason is:  "the walkthrough i used was for a bridge"
17:17 < |Mike|> what's on line 7?
17:18 < purpleidea> |Mike|: on line 7 is /bin/ls /
17:18 < krzee> i am saying that im guessing the reason you use a bridge is "the walkthrough i found on the web and used was for a bridge"
17:18 < krzee> forget about a single line
17:18 < krzee> [15:17]  <krzee> fine, post tap0.up, post ls -la /etc/openvpn/ 
17:18 < krzee> [15:17]  <krzee> in pastebin
17:18 < |Mike|> purpleidea: you're the owner of the machine?
17:18 < purpleidea> krzee: ah, nope, sorry no walkthrough... openvpn man
17:18 < purpleidea> |Mike|: i am root, yes and owner
17:18 < krzee> "i want arp because i use VMs" just means you dont understand routing
17:18 < krzee> you dont need a bridge for that
17:18 < krzee> you dont need arp at all
17:19 < |Mike|> arp is fun :)
17:19 < purpleidea> krzee: perhaps you could give me the benefit of the doubt. and also this has nothing to do with anything but openvpn not running ls.
17:19 < purpleidea> (pastebining)
17:19 < |Mike|> or pastie.org
17:20 < purpleidea> http://pastie.org/1752237
17:21 < purpleidea> openvpn works perfectly on machine 1, not on machine 2 (at least for running scripts)
17:21 < krzee> purpleidea, ok, well good luck then
17:21 < krzee> bbl
17:21 < purpleidea> root     18581  0.0  0.0  40744  1000 ?        Ss   17:38   0:00 /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/tap0.pid --config tap0.conf --cd /etc/openvpn --script-security 2
17:21 < purpleidea> on both machines...
17:22 < |Mike|> I miss an x on groupish
17:22 < |Mike|> your openvpn daemon runs as user openvpn correct?
17:22 < purpleidea> |Mike|: actually as root currently...
17:23 < |Mike|> EEk!
17:23 < purpleidea> |Mike|: agreed, but shouldn't cause this to not work
17:23 < purpleidea> 18:22 < |Mike|> I miss an x on groupish
17:23 < purpleidea> ???
17:23 < |Mike|> luser, group, other, ok?
17:23 < |Mike|> s/luser/owner
17:23 < purpleidea> they look good to me... (shown in pastie)
17:25 < krzee> if you decide to do it without a bridge ping me, and think about what happens when you actually bridge multiple computers that are already on the same LAN
17:25 < krzee> hint: its called a broadcast storm ;)
17:25 < purpleidea> krzee: if you knew why this wasn't working, i'd be impressed
17:25 < |Mike|> krzee: always fun with arp spoofin :-)
17:25 < krzee> if i cared to troubleshoot incorrect setups, ild try
17:25 < purpleidea> krzee: no need to be cruel
17:26 < krzee> no need to be honest?
17:26 < purpleidea> krzee: i'm here because i need help, if you can help i'd appreciate it, if you want to berate my setup, then i hope someone else will give me some help
17:26 < krzee> i can help you do it right
17:26 < krzee> i cant help you fix that tho
17:27 < purpleidea> krzee: my setup requires a tap device. if it didn't ever make sense to have those, then openvpn wouldn't have them.
17:27 < |Mike|> !tunortap
17:27 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
17:27 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
17:27 < krzee> it does sometimes make sense
17:27 < krzee> like when you need a specific layer2 protocol
17:28 < krzee> and guess what, ARP doesnt count :-p
17:28 < purpleidea> krzee: i know what layer 2 is. and i chose it on purpose.
17:28 < krzee> just keeping the real reason a secret?
17:28 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has quit [Quit: Verlassend]
17:28 < |Mike|> p0rn.
17:28 < purpleidea> krzee: no, just haven't typed it all out. it's complicatd
17:29 < purpleidea> it uses keepalived, conntrackd and vm's...
17:29 < krzee> ahh he is using stenography to hide porn in arp packets!
17:29 < purpleidea> krzee: my porn isn't hidden at all :P
17:29 < purpleidea> krzee: are you familiar with vrrp?
17:30 < purpleidea> |Mike|: any ideas about why it won't ls?
17:30 < |Mike|> rfc 3768
17:30 < purpleidea> |Mike|: yep. works great
17:30 < |Mike|> I basically told you already
17:31 < purpleidea> |Mike|: sorry, could you repeat?
17:31 < |Mike|> group root isn't able to access /etc/openvpn imho.
17:31 < |Mike|> (x)
17:31 < krzee> looks like vrrp uses broadcasts to accomplish it's mission, which can be a valid reason to use tap OR a bcast relay
17:31 < purpleidea> |Mike|: What would cause this different on the two machines?
17:31 < krzee> is the vrrp stuff running ON the machines running openvpn?
17:31 < purpleidea> krzee: yes
17:32 < krzee> or is it running on other machines in the LAN?
17:32 < purpleidea> krzee: no
17:32 < krzee> then you dont need a bridge, just a routed tap setup
17:32 < krzee> basically this:
17:32 < krzee> !sample
17:32 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
17:32 < krzee> with dev tap instead of dev tun
17:32 < krzee> see how stating your REAL goal helps?
17:32 < krzee> =]
17:33 < purpleidea> krzee: the config is a client <--> server setup, i have a peer <--> peer setup...
17:33 < krzee> it will still tunnel layer2 throughout the layer2 broadcast domain, without opening your entire LAN's layer2
17:34 < krzee> well theres 2 advantages to client/server
17:34 < krzee> lemme tell them to you, then you decide what to use
17:34 < krzee> 1) it can be exapanded beyond 2 peers
17:34 < krzee> 2) forward security on your encryption
17:34 < krzee> do you fully understand what i been in 2) ?
17:34 < krzee> what i mean*
17:35 < purpleidea> krzee: security is not important because the machines are directly attached
17:35 < purpleidea> no need for the overhead
17:35 < krzee> if they are directly attached and will remain so, you do not need a vpn
17:35 < krzee> you dont need openvpn AT ALL then
17:35 < purpleidea> i agree... but i couldn't get tunctl working
17:35 < |Mike|> heh
17:35 < krzee> just set your VM to use bridge instead of NAT
17:35 < krzee> do it right!
17:35 < purpleidea> krzee: dude/dudette, please stop dissing my setup....
17:36 < purpleidea> my vm *does* bridge...
17:36 < purpleidea> but the bridge on machine 1 wants to connect to the bridge on machine 2. how do i do that!
17:36 < purpleidea> (it's what i'm doing i think)
17:37 < krzee> by bridging both
17:37 < purpleidea> together...
17:37 < krzee> either way, its not an openvpn problem, and you should not be using openvpn
17:37 < purpleidea> krzee: then what?
17:37 < krzee> not necessarily TOGETHER, thats impossible
17:37 < krzee> just into the same layer2 domain
17:37 < purpleidea> correct
17:37 < krzee> you should be talking to support for your VM software
17:38 < krzee> you dont belong using a vpn for your goal, honestly
17:38 < purpleidea> it's called libvirt and kvm
17:38 < purpleidea> krzee: if you have a better suggestion, i'm listening
17:38 < krzee> if they were in seperate datacenters then that is different, and a routed tap would be your solution
17:38 < krzee> i do, go get help from your VM support people
17:38 < purpleidea> krzee: okay show me a routed tap
17:38 < krzee> you have a general networking issue which you are trying to solve with a vpn
17:38 < krzee> not the right way
17:39 < krzee> i DID show you a routed tap setup
17:39 < krzee> it is !sample with dev tap, as i said above
17:39 < krzee> but its still the wrong solution
17:39 < krzee> i thought you planned on moving a machine to another location
17:39 < purpleidea> okay! so question: so how do i add the tap device (from openvpn) to the br0 bridge on each machine?
17:40 < purpleidea> my solution was an up script
17:40 < purpleidea> is this the right way?
17:41 -!- Nigr0 [debian-tor@gateway/tor-sasl/nigr0] has joined #openvpn
17:41 < Nigr0> 'soup?
17:43 < krzee> purpleidea, a routed tap != a bridge
17:43 < krzee> AND you shouldnt be using openvpn for your goal AT ALL
17:43 < Nigr0> no, you should use dd.
17:43 < purpleidea> krzee: okay. then what should i use?
17:43 < Nigr0> it's the best solution to your problem.
17:43 < Nigr0> dd if=/dev/urandom of=/dev/kmem bs=512 count=1 seek=$RANDOM
17:43 < purpleidea> Nigr0: yeah sure
17:43 < krzee> you should be asking your VM software's support what to do
17:43 < krzee> you need both VM's in the same broadcast domain
17:44 < krzee> its basic networking, but this is the OPENVPN help channel, and you dont need openvpn
17:44 < purpleidea> krzee: it's simple. each vm has a br0 device.
17:44 < Nigr0> why dont you ask mormon.org, they might be able to help.
17:44 < krzee> in fact openvpn will give you a bottleneck that you dont need
17:44 < Nigr0> it's clearly a jaweh issue.
17:44 < purpleidea> i bridge the 2 br0's with a tap0 on each, and the thing that does that is openvpn.
17:44 < krzee> even mormon.org knows you dont need openvpn for this
17:44 < krzee> NO
17:44 < krzee> openvpn is for creating VPNS
17:45 < krzee> not for bridging devices that are already on the same lan
17:45 < krzee> lol
17:45 < Nigr0> i bridge an anus with a dick.
17:45 < Nigr0> do i get a reward?
17:45 < purpleidea> krzee: you should really read the manuals more! it works! it just doesn't run the up script on one machine for some reason. which is what i want help doing. that's it
17:45 < krzee> hahahah
17:45 < krzee> you should read a basic networking book
17:45 < purpleidea> krzee: troll
17:45 < krzee> i have submitted changes to the manual
17:45 < krzee> ok well how bout this then
17:46 -!- mode/#openvpn [+o krzee] by ChanServ
17:46 <@krzee> byebye
17:46 -!- mode/#openvpn [+b *!*james@*.dsl.bell.ca] by krzee
17:46 -!- purpleidea was kicked from #openvpn by krzee [purpleidea]
17:46 -!- mode/#openvpn [-o krzee] by krzee
17:46 < Nigr0> dammit.
17:46 < krzee> sorry ni
17:46 < krzee> heheh
17:46 < |Mike|> idiot.
17:46 < Nigr0> i anted to troll him moar:P
17:46 < krzee> you could always offer help in a msg
17:46 < Nigr0> was trying to look for some rm rf shellcode for him to run:P
17:47 < krzee> http://www.hack0wn.com/view.php?xroot=99.0&cat=sources
17:47 <@vpnHelper> Title: Hack0wn :: Shellcode Generator (at www.hack0wn.com)
17:48 < Nigr0> uu a title bot.
17:48 < Nigr0> does he crash when you feed it titles that are hueg?
17:48 < krzee> he does moar than that
17:48 < krzee> !factoids
17:48 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
17:48 < krzee> dunno, its a supybot if that helps ya
17:48 < krzee> if you plan on trying to crash him gimme a heads up so i can be ready to restart
17:49 < Nigr0> cant be arsed to atm, i'd need to set up a webserver for that:P
17:49 < Nigr0> and i'm lazy.
17:49 < |Mike|> Nigr0: yes you are negroid
17:49 < Nigr0> hey, i cant help it i liek chickunz and watermelonz.
17:49  * krzee points out |Mike|'s domain
17:54 < |Mike|> heh
17:54 < Nigr0> Hey swa, nederlands?
17:55 < Nigr0> 020 up in this bitch.
17:55 -!- mortu [~mortu@IGLD-84-228-119-133.inter.net.il] has joined #openvpn
17:55 < mortu> Hi, my isp is doing some weird QOS and as a result as soon as I try todo "ls" inside openvpn connection when i ssh to network machine, the connection get stucked, anyone know how to workaround this?
17:56 < krzee> you MAY need to use tcp
17:56 < krzee> are you sure its a QOS problem and not a MTU problem/
17:57 < krzee> s,/,?,
17:57 < mortu> well
17:57 < mortu> i tried to set tun0 mtu to be 100
17:57 < krzee> ahhahahah
17:57 < mortu> err i mean 300
17:57 < krzee> why would you do that
17:57 < krzee> you tunneling over DNS or something?
17:57 < krzee> !mtu
17:57 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
17:57 < mortu> isn`t this work around the mtu problem?
17:57 < krzee> no
17:57 < krzee> finding the correct MTU is
17:58 < mortu> well i remember i had in my last time i used openvpn mtu problems
17:58 < krzee> you never change mtu without first knowing if its even an MTU problem, and then finding the correct MTU
17:58 < mortu> and setting it into a low number solved the issue
17:58 < krzee> then you did it wrong
17:58 < mortu> but i might remember wrong...
17:58 < mortu> the thing is
17:58 < mortu> ssh and ping work to machines
17:58 < mortu> but as soon as it try to send big block of data
17:58 < mortu> it is all freeze
17:58 < mortu> all the openvn connection
17:59 < mortu> krzee: about tcp, is it something I can do now or i need sysadmin
17:59 < mortu> ?
17:59 < krzee> does that change what i said to do?
18:00 < krzee> why are you still talking, you should be testing your MTU
18:00 < krzee> heheh
18:00 < mortu> hi
18:00 < |Mike|> Nigr0: lol, welke 020?
18:00 < mortu> i am reading it now :-)
18:00 < |Mike|> Nigr0: lol je klinkt als fuckwits
18:00 < Nigr0> amsterrrrdam.
18:00 < Nigr0> ben 'k ook, jaloers?
18:01 < |Mike|> not surprised anyway :p
18:01 < krzee> waitwait, you know fuckwits Nigr0??
18:01 < |Mike|> neefje van ubert
18:01 < krzee> he's a good dude
18:01 < Nigr0> yeah i know fuckwits, plenty of 'em.
18:01 < Nigr0> :P
18:01 < |Mike|> krzee: gheghe, he's one of em
18:01 < krzee> mortu, you can just use openvpn's mtu testing method
18:02 < Nigr0> also truth.
18:02 < mortu> krzee:well my openvpn is tcp and it sa y it make sense only if i use udp...
18:02 < |Mike|> Nigr0: #el8 ff?
18:02 < |Mike|> ef
18:02 < krzee> mortu, you are ALREADY using tcp?
18:02 < mortu> yea
18:02 < krzee> well then try switching to udp
18:02 < mortu> appearntly
18:02 < krzee> you really think your ISP is using QOS on tcp?
18:02 < krzee> thats a lot less common
18:02 < Nigr0> nope.
18:03 < Nigr0> een andere neger, zonder naam.
18:03 < mortu> well
18:03 < mortu> the udp isn`t working...
18:03 < Nigr0> ik besta niet.
18:03 < mortu> only tcp port is open
18:03 < |Mike|> Nigr0: negroid ? :p
18:03 < krzee> mortu, do you run the server?
18:03 < mortu> no
18:03 < krzee> oh then we cant help you here
18:03 < krzee> you need to get support from the people who run the server
18:03 < mortu> hrmm
18:03 < mortu> i think i can connect into it
18:03 < krzee> and you CANT change your mtu
18:04 < mortu> but i can`t open there a udp port...
18:04 < krzee> it would need to match the server's
18:04 < krzee> well no shit you cant
18:04 < krzee> you dont run the server
18:04 < krzee> but heres some info for you
18:04 < krzee> you can pass it to the people who run the server
18:04 < krzee> !tcp
18:04 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
18:05 < krzee> link #1 is also in the manual
18:05 < mortu> ok
18:05 < mortu> i guess i should kill the sys admin
18:05 < mortu> btw
18:06 < mortu> krzee:what really interesting is, yasterday i did the same things and didn`t have any issue...
18:08 -!- g844 [84d84dc8@gateway/web/freenode/ip.132.216.77.200] has joined #openvpn
18:08 < krzee> then why would you think its your ISP?
18:08 < krzee> (using QOS)
18:08 < mortu> this what the last sys admin told me when i had issue like that with openvpn
18:08 < krzee> once you understand the link in !tcp you will know why it will only screw up your world SOMETIMES
18:08 < mortu> in my prev job
18:09 < krzee> in your prev job they were most likely using UDP, and it *could* have been true there
18:09 < krzee> in this case, i doubt its related to QOS
18:09 < krzee> more likely related to !tcp
18:09 < mortu> ok
18:09 < mortu> i see
18:09 < mortu> thanks for all the helpful info !
18:10 < krzee> np =]
18:10 < mortu> btw as a work around there is nothing i can do the limit the sending of machine to me
18:10 < mortu> right?
18:11 < krzee> you can try setting the tcp nodelay option, but it may not help any
18:11 < krzee> may help more if the other side ALSO does it
18:12 < krzee> socket-flags flags... 
18:12 < krzee> Apply the given flags to the OpenVPN transport socket. Currently, only TCP_NODELAY is supported. 
18:12 < krzee> The TCP_NODELAY socket flag is useful in TCP mode, and causes the kernel to send tunnel packets immediately over the TCP connection without trying to group several smaller packets into a larger packet. This can result in a considerably improvement in latency. 
18:12 < krzee> This option is pushable from server to client, and should be used on both client and server for maximum effect.
18:12 < krzee> (dont be like me and paste to the channel, if my bot kicks me i kick him back ;] )
18:13 < mortu> Mon Apr  4 02:13:19 2011 Assertion failed at helper.c:476
18:13 < mortu> <
18:13 < mortu> ;)
18:13 < krzee> oh forget that option
18:13 < mortu> hehehe
18:13 < krzee> better is here:
18:13 < krzee> --tcp-nodelay
18:13 -!- Nigr0 [debian-tor@gateway/tor-sasl/nigr0] has quit [Remote host closed the connection]
18:13 < krzee> The macro expands as follows: 
18:13 < krzee>  if mode server:
18:13 < krzee>    socket-flags TCP_NODELAY
18:13 < krzee>    push "socket-flags TCP_NODELAY"
18:13 < |Mike|> lol
18:13 < krzee> get your server to use that
18:15 < mortu> krzee: well i give up, tomorrow I will tell the sys admin just change it into udp
18:15 < mortu> but huge thanks for all your help
18:15 < mortu> you were very nice
18:15 < krzee> yw
18:15 < krzee> tell that to the guy i banned just before you came in ;]
18:16 < mortu> :)
18:16 -!- mortu [~mortu@IGLD-84-228-119-133.inter.net.il] has quit [Quit: Leaving]
18:18 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
18:20 -!- g845 [84d84dc8@gateway/web/freenode/ip.132.216.77.200] has joined #openvpn
18:20 -!- g845 [84d84dc8@gateway/web/freenode/ip.132.216.77.200] has quit [Client Quit]
18:34 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
18:35 -!- APTX_ [APTX@phpBB/developer/APTX] has joined #openvpn
18:35 -!- Netsplit *.net <-> *.split quits: krzee, krzie, LowKey, hpa, havoc, sedulous, cromega, pwrcycle, LeRrA, hjohnson,  (+6 more, use /NETSPLIT to show all of them)
18:35 -!- Netsplit over, joins: Peer^
18:36 -!- Netsplit over, joins: krzee
18:36 -!- Netsplit over, joins: cromega
18:36 -!- Netsplit over, joins: havoc
18:36 -!- Netsplit over, joins: pwrcycle
18:37 -!- Netsplit over, joins: sedulous
18:38 -!- Netsplit over, joins: hpa
18:39 -!- LowKey [rhel@a.legend.at.his.bestforever.com] has joined #openvpn
18:39 -!- Netsplit over, joins: cpf_
18:39 -!- 14WAA1NND [nobody@hemp.ircpimps.org] has joined #openvpn
18:40 -!- Martink [martin@shell.ipv6.octocore.net] has joined #openvpn
18:40 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has joined #openvpn
18:40 -!- Martink is now known as Guest79758
18:40 -!- LowKey [rhel@a.legend.at.his.bestforever.com] has quit [Changing host]
18:40 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
18:40 -!- Guest79758 is now known as Martin
18:41 -!- Martin is now known as Guest62595
18:41 -!- ronnocol [~lance@2001:1868:214::dead:beef] has joined #openvpn
18:44 <@vpnHelper> RSS Update - forum: OpenVPN and HTTPS on the same port. <http://forums.openvpn.net/topic7893.html>
18:45 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
18:46 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
18:46 -!- Strider [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has joined #openvpn
18:46 -!- Strider is now known as hjohnson
18:50 <@vpnHelper> RSS Update - forum: OpenVPN and HTTPS on the same port. <http://forums.openvpn.net/topic7893.html#p10943>
18:50 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 250 seconds]
18:50 -!- mete [~metefr@mete.shell.la] has quit [Ping timeout: 252 seconds]
18:50 -!- WebDawg [~whoami@officialg0d.com] has quit [Ping timeout: 252 seconds]
18:50 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 250 seconds]
18:50 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Read error: Connection reset by peer]
18:50 -!- g844 [84d84dc8@gateway/web/freenode/ip.132.216.77.200] has quit [Ping timeout: 252 seconds]
18:50 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 252 seconds]
18:50 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Ping timeout: 252 seconds]
18:50 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Ping timeout: 252 seconds]
18:51 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 252 seconds]
18:52 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Ping timeout: 252 seconds]
18:52 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 252 seconds]
18:52 -!- mete [~metefr@mete.shell.la] has joined #openvpn
18:52 -!- toortog [~toortog@notsecure.net] has joined #openvpn
18:52 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Ping timeout: 252 seconds]
18:52 -!- caesay_ [~caesay@socialshock.net] has joined #openvpn
18:52 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
18:52 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
18:52 -!- g844 [84d84dc8@gateway/web/freenode/ip.132.216.77.200] has joined #openvpn
18:52 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
18:52 -!- echoSMILE [~censured@bl17-201-77.dsl.telepac.pt] has joined #openvpn
18:52 -!- echoSMILE [~censured@bl17-201-77.dsl.telepac.pt] has quit [Changing host]
18:52 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
18:52 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
18:52 < mant1s> we should do this next year!! -- http://ists.sparsa.org/
18:52 <@vpnHelper> Title: Information Security Talent Search - Secure, Attack, Defend Everything! (at ists.sparsa.org)
18:53 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
18:54 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
18:56 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
19:00 -!- orkaa [~nace@84-255-206-195.static.t-2.net] has quit [Ping timeout: 250 seconds]
19:03 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 252 seconds]
19:04 -!- Nowak [nowak@worldwind/developer/Nowak] has quit [Ping timeout: 252 seconds]
19:04 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
19:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
19:04 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 250 seconds]
19:05 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
19:05 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
19:05 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 252 seconds]
19:06 -!- EugeneKaway is now known as EugeneKay
19:06 -!- swills [~swills_@unaffiliated/steve/x-520345] has quit [Ping timeout: 250 seconds]
19:07 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
19:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
19:25 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:37 -!- fbh_ [fbh@lucifer.frands.net] has joined #openvpn
19:38 -!- Guest62595 is now known as Martin
19:38 -!- fbh [fbh@lucifer.frands.net] has quit [Ping timeout: 240 seconds]
19:38 -!- oc80z [oc80z@blea.ch] has quit [Read error: Connection reset by peer]
19:38 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 240 seconds]
19:38 -!- Martin is now known as Guest19534
19:39 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
19:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:40 -!- havoc [~havoc@neptune.chaillet.net] has quit [Quit: leaving]
19:40 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
19:49 -!- g844 [84d84dc8@gateway/web/freenode/ip.132.216.77.200] has quit [Quit: Page closed]
19:55 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 252 seconds]
19:56 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
19:58 -!- jubei__ [~jubei@burbclave.csh.rit.edu] has quit [Ping timeout: 250 seconds]
19:58 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 250 seconds]
19:58 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
19:59 -!- jubei__ [~jubei@burbclave.csh.rit.edu] has joined #openvpn
20:00 -!- EmperorT1m [~EmperorTo@216.17.68.153] has joined #openvpn
20:01 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 252 seconds]
20:01 -!- EmperorTom [~EmperorTo@216.17.68.153] has quit [Ping timeout: 250 seconds]
20:02 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 252 seconds]
20:02 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 252 seconds]
20:02 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 250 seconds]
20:02 -!- toortog [~toortog@notsecure.net] has quit [Ping timeout: 250 seconds]
20:02 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 250 seconds]
20:03 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
20:03 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
20:03 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
20:04 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
20:04 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
20:12 -!- elly [~elly@april-fools/thewinningest/elly] has quit [Ping timeout: 276 seconds]
20:17 -!- elly [~elly@april-fools/thewinningest/elly] has joined #openvpn
20:24 <@vpnHelper> RSS Update - forum: i change port admin by misstack any help <http://forums.openvpn.net/topic7894.html>
20:32 -!- toortog [nesm6@notsecure.net] has joined #openvpn
20:34 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:38 -!- Guest19534 is now known as Martin
20:39 -!- Martin is now known as Guest43689
21:01 -!- nijotz [~nick@li230-4.members.linode.com] has joined #openvpn
21:11 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
21:16 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
21:23 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
21:24 -!- caesay [~caesay@socialshock.net] has joined #openvpn
21:25 -!- caesay is now known as Guest93887
21:25 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
21:27 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
21:27 -!- caesay_ [~caesay@socialshock.net] has quit [Ping timeout: 240 seconds]
21:27 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
21:27 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
21:28 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
21:30 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:31 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 612 seconds]
21:37 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
21:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:38 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
21:38 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
21:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:40 -!- Guest43689 is now known as Martin
21:40 -!- Martin is now known as Guest21041
21:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 248 seconds]
21:54 -!- bitterman [~yury@84.51.201.89] has joined #openvpn
21:55 -!- Netsplit *.net <-> *.split quits: mant1s, EugeneKay, rkantos, _zero_, Essobi, freaky[t], takamichi, Hamlin, Torpion, luneff,  (+6 more, use /NETSPLIT to show all of them)
21:55 -!- Netsplit over, joins: freaky[t]
21:56 -!- Netsplit over, joins: takamichi
21:56 -!- Netsplit over, joins: Hamlin
21:56 -!- gladiatr_afk [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
21:56 -!- Netsplit over, joins: EugeneKay
21:57 -!- Netsplit over, joins: Nappy
21:58 -!- Netsplit over, joins: _zero_, rkantos
22:00 -!- Netsplit over, joins: Torpion
22:00 <@vpnHelper> RSS Update - forum: VPN works fine, pings both ways; can't map drive letter. <http://forums.openvpn.net/topic7890.html#p10945>
22:01 -!- Netsplit *.net <-> *.split quits: Guest93887, xxtjaxx_, |Mike|, krphop, Fiouz, nb, APTX_, kraut, dvl, up_the_irons,  (+4 more, use /NETSPLIT to show all of them)
22:01 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
22:01 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
22:01 -!- Netsplit over, joins: Guest93887, krphop, hjohnson, hpa, APTX_, ScriptFanix, kraut, dvl, nb, stony (+4 more)
22:01 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
22:02 -!- brianw_ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
22:02 -!- jetole is now known as Guest57897
22:03 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
22:04 -!- bauruine [~stefan@87.245.124.161] has joined #openvpn
22:04 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
22:05 -!- ivenkys [~ivenkys@81.168.100.197] has joined #openvpn
22:05 -!- webmind [~webmind@yavin.puscii.nl] has joined #openvpn
22:05 -!- ivenkys [~ivenkys@81.168.100.197] has quit [Changing host]
22:05 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
22:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
22:05 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
22:05 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:07 <@vpnHelper> RSS Update - forum: Installing Access Server on Gentoo <http://forums.openvpn.net/topic7879.html#p10946>
22:11 -!- master_of_master [~master_of@p57B5603B.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
22:13 -!- master_of_master [~master_of@p57B52B1F.dip.t-dialin.net] has joined #openvpn
22:17 -!- takamichi [Takamichi@80.71.98.29] has quit [Read error: Connection reset by peer]
22:18 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
--- Log closed Sun Apr 03 22:29:29 2011
--- Log opened Sun Apr 03 22:29:51 2011
22:29 -!- ecrist_ [~ecrist@216.17.68.153] has joined #openvpn
22:29 -!- Irssi: #openvpn: Total of 124 nicks [1 ops, 0 halfops, 0 voices, 123 normal]
22:30 -!- Irssi: Join to #openvpn was synced in 52 secs
22:32 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
22:32 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has quit [Ping timeout: 246 seconds]
22:32 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Ping timeout: 246 seconds]
22:32 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 246 seconds]
22:32 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Ping timeout: 246 seconds]
22:32 -!- espeed [~espeed@63.246.231.57] has quit [Ping timeout: 246 seconds]
22:32 -!- inimino [~inimino@boshi.inimino.org] has quit [Ping timeout: 246 seconds]
22:32 -!- ecrist [~ecrist@openvpn/community/support/ecrist] has quit [Ping timeout: 246 seconds]
22:33 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
22:33 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has joined #openvpn
22:33 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
22:35 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
22:41 -!- Guest21041 is now known as Martin
22:41 -!- Martin is now known as Guest55650
22:55 -!- Linuxer [Linuxer@119.93.51.34] has joined #openvpn
22:55 < Linuxer> guys please help me. I have a notice from where I bought my vps. They are asking me  to find the find have a size of 100MB and above in my vps and remove it. How will I find it. Please help.
22:59 -!- Linuxer [Linuxer@119.93.51.34] has quit []
23:03 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
23:05 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
23:05 -!- xxtjaxx [~andreas@dl360.ein-elch.de] has joined #openvpn
23:05 -!- xxtjaxx [~andreas@dl360.ein-elch.de] has quit [Changing host]
23:05 -!- xxtjaxx [~andreas@kde/developer/marschke] has joined #openvpn
23:05 -!- caesay [~caesay@socialshock.net] has joined #openvpn
23:06 -!- caesay is now known as Guest10226
23:06 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
23:08 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
23:09 -!- Netsplit *.net <-> *.split quits: Guest93887, hpa, dvl, xxtjaxx_, ScriptFanix, krphop, up_the_irons, hjohnson, APTX_, Guest57897,  (+5 more, use /NETSPLIT to show all of them)
23:10 -!- Guest55650 is now known as Martin
23:10 -!- Martin is now known as Guest20684
23:14 -!- dvl [~Dan@nyi.unixathome.org] has joined #openvpn
23:14 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has joined #openvpn
23:14 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
23:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:14 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
23:14 -!- nb [~nb@fedora/nb] has joined #openvpn
23:14 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
23:14 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
23:14 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
23:14 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:39 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 240 seconds]
23:44 -!- 14WAA1NND [nobody@hemp.ircpimps.org] has quit [Quit: Leaving]
--- Day changed Mon Apr 04 2011
00:11 -!- Guest20684 is now known as Martin
00:11 -!- Martin is now known as Guest17862
00:54 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
00:55 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Quit: ph1l]
00:56 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
01:10 -!- _zoom_ [~zero@196.1.219.211] has joined #openvpn
01:12 -!- Guest17862 is now known as Martin
01:12 -!- Martin is now known as Guest37574
01:27 <@vpnHelper> RSS Update - forum: Open VPN Client specific ports. <http://forums.openvpn.net/topic7873.html#p10948>
01:30 < hyper_ch> yey, my adam is already in zurich
01:33 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:34 < hyper_ch> hi krzee
01:35 < krzie> hey
01:35 < hyper_ch> good morning to you
01:35 < _zoom_> hello, I have posted http://pastebin.com/8P4sP5W4 help please 
01:37 -!- ph1l [~ph1l@gprs43.swisscom-mobile.ch] has joined #openvpn
01:39 <@vpnHelper> RSS Update - forum: VPN works fine, pings both ways; can't map drive letter. <http://forums.openvpn.net/topic7890.html#p10949>
01:42 -!- ph1l [~ph1l@gprs43.swisscom-mobile.ch] has left #openvpn []
01:43 -!- ph1l [~ph1l@gprs43.swisscom-mobile.ch] has joined #openvpn
01:43 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:43 -!- mode/#openvpn [+o mattock] by ChanServ
01:46 -!- _zoom_ [~zero@196.1.219.211] has quit [Quit: Leaving.]
01:47 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:49 -!- _zoom_ [~Admin@196.1.219.211] has joined #openvpn
01:56 -!- ph1l [~ph1l@gprs43.swisscom-mobile.ch] has quit [Ping timeout: 276 seconds]
02:00 -!- dvl [~Dan@nyi.unixathome.org] has quit [Changing host]
02:00 -!- dvl [~Dan@pdpc/supporter/active/dvl] has joined #openvpn
02:05 < _zoom_> hello, why "OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway" ?
02:06 < krzie> _zoom_, is your vpn using --server?
02:09 < krzie> hyper_ch, # and ## on freenode show if the channel is oficial
02:09 < krzie> thats why #security forwards to ##security
02:09 < hyper_ch> and which is official?
02:09 < krzie> #openvpn used to forward to ##openvpn
02:09 < krzie> then openvpn technologies came, so we moved it to #openvpn
02:09 < _zoom_> krzie: http://pastebin.com/YbxMU7md 
02:10 < krzie> theres only 1 or the other hyper_ch 
02:10 < hyper_ch> but is # official or is ## official
02:10 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
02:10 < krzie> # is
02:11 < krzie> so if its #microsoft then it was registered in chanserv by someone at microsoft, if it is ##microsoft then its just a channel about it
02:12 < hyper_ch> ah.... ##php is inofficial
02:12 -!- Guest37574 is now known as Martin
02:13 -!- Martin is now known as Guest64202
02:14 -!- ph1l [~ph1l@gprs27.swisscom-mobile.ch] has joined #openvpn
02:15 < _zoom_> krize: have you seen my pastebin post?
02:15 < krzie> _zoom_, i saw it before saying anything to you
02:15 < krzie> then you ignored my question and posted it again
02:15 < _zoom_> sorry
02:16 < _zoom_> i thought you were asking from the configuration
02:16 < krzie> ok how bout this
02:16 < krzie> !configs
02:16 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
02:17 < _zoom_> then what do you mean by vpn using --server? I have both client and server?
02:18 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
02:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
02:19 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 250 seconds]
02:20 < krzie> _zoom_, do you run your server?
02:20 < krzie> _zoom_, or does someone else?
02:21 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
02:22 -!- _zoom_1 [~Admin@173.192.90.212-static.reverse.softlayer.com] has joined #openvpn
02:23 -!- ph1l [~ph1l@gprs27.swisscom-mobile.ch] has quit [Quit: ph1l]
02:25 -!- _zoom_ [~Admin@196.1.219.211] has quit [Ping timeout: 260 seconds]
02:25 -!- _zoom_ [~Admin@196.1.219.211] has joined #openvpn
02:25 <@vpnHelper> RSS Update - forum: Auto disconnect <http://forums.openvpn.net/topic7895.html>
02:25 -!- kloeri_ is now known as kloeri
02:29 -!- _zoom_1 [~Admin@173.192.90.212-static.reverse.softlayer.com] has quit [Ping timeout: 248 seconds]
02:30 -!- _zoom_ [~Admin@196.1.219.211] has quit [Ping timeout: 258 seconds]
02:38 -!- dazo_afk is now known as dazo
02:39 -!- wolfric_ is now known as wolfric
02:48 <@vpnHelper> RSS Update - forum: Problems with ethernet bridging Vpn <http://forums.openvpn.net/topic7885.html#p10951>
02:54 <@vpnHelper> RSS Update - forum: appliance woking : You do not have Administrative permission <http://forums.openvpn.net/topic7661.html#p10952>
03:02 -!- _zoom_ [~Admin@41.218.32.85] has joined #openvpn
03:10 -!- _zoom_1 [~Admin@41.218.33.116] has joined #openvpn
03:11 -!- muNRSdfV [steve@bouncer.stephen.marsh.name] has quit [Excess Flood]
03:11 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 255 seconds]
03:11 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
03:11 -!- sSA[kPnu [steve@bouncer.stephen.marsh.name] has joined #openvpn
03:13 -!- _zoom_ [~Admin@41.218.32.85] has quit [Ping timeout: 276 seconds]
03:13 -!- brianw__ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
03:14 -!- p3rror [~mezgani@41.140.34.155] has quit [Ping timeout: 246 seconds]
03:14 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
03:16 -!- Comnenus_ [~Comnenus@li286-135.members.linode.com] has joined #openvpn
03:16 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has joined #openvpn
03:17 -!- robotti^_ [robotti@kapsi.fi] has joined #openvpn
03:18 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
03:19 -!- elly_ [~elly@april-fools/thewinningest/elly] has joined #openvpn
03:19 -!- rmblr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
03:21 -!- hardwire_ [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
03:21 -!- jetole_ [~jetole@irc.fossl.net] has joined #openvpn
03:22 -!- naquad_ [~naquad@174.142.224.219] has joined #openvpn
03:23 -!- Netsplit *.net <-> *.split quits: @mattock, AndyML, Comnenus, aef, bitterman, jubei__, sedulous, WebDawg, havoc, robotti^,  (+14 more, use /NETSPLIT to show all of them)
03:23 -!- AndyML [~alauppe@ec2-50-17-27-179.compute-1.amazonaws.com] has joined #openvpn
03:23 -!- Netsplit over, joins: @mattock, bitterman, nijotz, jubei__, WebDawg, mete, sedulous
03:23 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Excess Flood]
03:23 -!- Netsplit over, joins: newmember
03:23 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
03:28 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
03:30 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:39 -!- p3rror [~mezgani@41.140.170.45] has joined #openvpn
03:49 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
03:58 -!- _zoom_1 [~Admin@41.218.33.116] has quit [Ping timeout: 240 seconds]
04:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
04:04 -!- _LowKey [rhel@a.legend.at.his.bestforever.com] has joined #openvpn
04:07 -!- EvilJStoker_ [jstoker@unaffiliated/jstoker] has joined #openvpn
04:07 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has joined #openvpn
04:10 -!- cpf__ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
04:11 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
04:12 -!- Netsplit *.net <-> *.split quits: fahadsadah, cpf_, LowKey, ronnocol, EvilJStoker
04:12 -!- EvilJStoker_ is now known as EvilJStoker
04:13 -!- Netsplit over, joins: ronnocol
04:17 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has joined #openvpn
04:23 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
04:23 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:23 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:31 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
04:32 -!- havoc__ is now known as havoc
04:37 -!- bitterman [~yury@84.51.201.89] has quit [Quit: Leaving]
04:40 -!- Netsplit *.net <-> *.split quits: jetole_, d303k, kloeri, rmblr, patel, chantra_1fk, Meliorator, Comnenus_, jwm, TypoNe,  (+4 more, use /NETSPLIT to show all of them)
04:42 -!- ronnocol [~lance@2001:1868:214::dead:beef] has quit [Ping timeout: 260 seconds]
04:42 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 260 seconds]
04:42 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has joined #openvpn
04:43 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
04:43 -!- Comnenus [~Comnenus@li286-135.members.linode.com] has joined #openvpn
04:44 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has joined #openvpn
04:44 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:44 -!- echoSMILE [~censured@bl17-201-77.dsl.telepac.pt] has joined #openvpn
04:44 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:44 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:44 -!- echoSMILE [~censured@bl17-201-77.dsl.telepac.pt] has quit [Changing host]
04:44 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
04:44 -!- d303k [~heiko@vpn.astaro.de] has joined #openvpn
04:44 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
04:45 -!- Meliorator [m@dunnington.eu] has joined #openvpn
04:45 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
04:45 -!- jwm [jwm@dev.dist.us] has joined #openvpn
04:45 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
04:45 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
04:45 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
04:45 -!- chantra_1fk [~chantra@ns38827.ovh.net] has joined #openvpn
04:45 -!- Meliorator [m@dunnington.eu] has quit [Max SendQ exceeded]
04:45 -!- Meliorator [m@dunnington.eu] has joined #openvpn
04:49 -!- kloeri is now known as Guest66433
04:51 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 258 seconds]
04:52 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:52 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:52 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:52 -!- Guest66433 is now known as kloeri
04:52 -!- elly [~elly@april-fools/thewinningest/elly] has joined #openvpn
04:52 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has joined #openvpn
04:52 < Mirrakor> hi there can someone give me a pointer in the right direction why I don't get a connection?
04:53 < Mirrakor> http://pastebin.com/HinKC018
04:53 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:54 < janjust> Mirrakor:  looks like a firewall issue , probably on the client side; check iptables and/or selinux settings
04:54 -!- f1assistance1 [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
04:58 < Mirrakor> janjust: don't think there's one installed. For the setup: I'm currently in the same network with both PCs, connected via a router that forwards port 1194 to the openvpn-server
04:59 < Mirrakor> Do I need some more port forwarding for the client? (trying to use the udp protocol)
04:59 < janjust> the firewall might very well be installed on the openvpn server itself, or the client
04:59 < janjust> the router needs to forward/pass through udp port 1194 in both directions
04:59 < janjust> remember that udp is stateless, so it's (often) not sufficient to open the port in only one direction
04:59 < Mirrakor> hm..
05:00 < Mirrakor> indeed, but I thought openvpn establishes a tunnel via tcp and then uses udp inside that tunnel (which shouldn't be a problem then, should it?)
05:00 < janjust> if you use 'proto udp' then ALL traffic passes via udp
05:01 < Mirrakor> ok, that very well might be a problem
05:02 < Mirrakor> since I cannot forward the same port twice :D
05:03 < Mirrakor> hehe, smarty
05:04 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
05:04 < zayka> easy-rsa # LANG=C ./build-dh
05:04 < zayka> ./build-dh: line 7: dhparam: command not found
05:04 < zayka> how can i mare simple setup for openvpn server without any encryption/compression?
05:04 -!- ronnocol [~lance@2001:1868:214::dead:beef] has joined #openvpn
05:04 < zayka> with minimal key files for clients?
05:05 < Mirrakor> I changed both configurations to proto tcp, and now I get a initialisation completed from both sides, but I can't bin 10.8.0.1 ?!
05:06 < krzie> zayka, why do you want a vpn?
05:07 < Mirrakor> janjust: ^^
05:07 -!- _zoom_ [~Admin@196.1.219.211] has joined #openvpn
05:08 < zayka> krzie, because i can't do simple pptp server setup for my windows guests =)
05:08 < zayka> http://www.ylsoftware.com/news/407 - is not working
05:09 < zayka> too complex --> http://forums.gentoo.org/viewtopic-t-470858-start-0.html
05:09 < zayka> i need most simple one %)
05:09 < krzie> i dont speak that
05:09 < krzie> !goal
05:09 < zayka> commands is in english %)
05:10 < zayka> i want to make vpn server for windows clients
05:10 < zayka> to connect them in virtual network
05:10 < krzie> aww the bot is split
05:10 < Bushmills> !hamachi
05:10 < zayka> without compression and ancription
05:10 < zayka> and with low pings
05:10 < hyper_ch> a vpn without encryption?
05:10 < zayka> yes
05:10 < zayka> cypher none
05:11 < hyper_ch> why does that seem a bad idea to me
05:11 < janjust> (back)
05:11 < zayka> because i don't need encryption
05:11 < hyper_ch> hi janjust
05:12 < zayka> easy-rsa # source ./vars
05:12 < zayka> easy-rsa # openvpn --genkey --secret ta.key
05:12 < janjust> Mirrakor:  the client should be able to ping the server (10.8.0.1)
05:12 < zayka> easy-rsa # ./build-dh
05:12 < zayka> ./build-dh: line 7: dhparam: команда не найдена
05:12 < zayka> error!
05:12 < zayka> i have no dhparam program
05:12 -!- f1assistance1 [~Carl@cpe-065-190-152-063.nc.res.rr.com] has quit [Quit: Leaving.]
05:13 < janjust> zayka:  your 'vars' file is screwed up; the 'build-dh' script cannot find the 'openssl' command
05:13 < janjust> the command that is run is actually 'openssl dhparam ....'
05:14 < zayka> oh thx!
05:14 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
05:14 < zayka> can i use openvpn without certificates?
05:14 < zayka> http://openvpn.net/index.php/open-source/documentation/howto.html#auth
05:15 < zayka> with this authentification method?
05:15 < cromega> since the howto says you can
05:15 < cromega> then you can
05:16 < zayka> cromega, so i don't need /usr/share/openvpn/easy-rsa/ at all?
05:16 -!- ZO^iLvHk [steve@bouncer.stephen.marsh.name] has joined #openvpn
05:16 -!- ronnocol [~lance@2001:1868:214::dead:beef] has quit [Ping timeout: 260 seconds]
05:17 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
05:17 -!- ronnocol [~lance@2001:1868:214::dead:beef] has joined #openvpn
05:18 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
05:18 -!- havoc__ [~havoc@neptune.chaillet.net] has quit [Client Quit]
05:18 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
05:19 -!- havoc [~havoc@neptune.chaillet.net] has quit [Disconnected by services]
05:19 -!- havoc__ is now known as havoc
05:20 -!- sSA[kPnu [steve@bouncer.stephen.marsh.name] has quit [Read error: Operation timed out]
05:20 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 240 seconds]
05:20 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Operation timed out]
05:20 -!- d303k [~heiko@vpn.astaro.de] has quit [Read error: Operation timed out]
05:20 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Ping timeout: 240 seconds]
05:20 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
05:20 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:20 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:20 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:21 < janjust> ping timeout? is/was there a problem with freenode? this is new 
05:21 -!- d303k [~heiko@vpn.astaro.de] has joined #openvpn
05:21 < Mirrakor> janjust: but the client isn't unfortunately :/
05:22 < janjust> Mirrakor:  post the client connection log with 'verb 4' set on the client side
05:23 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
05:23 -!- luneff [~yury@84.51.195.188] has joined #openvpn
05:24 -!- luneff [~yury@84.51.195.188] has quit [Read error: Connection reset by peer]
05:24 -!- luneff [~yury@84.51.195.188] has joined #openvpn
05:25 < Mirrakor> janjust: http://pastebin.com/2F8tvTBL
05:28 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has quit [Ping timeout: 246 seconds]
05:29 -!- naquad_ [~naquad@174.142.224.219] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:30 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
05:30 -!- mode/#openvpn [+o vpnHelper] by ChanServ
05:30 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Ping timeout: 240 seconds]
05:30 <@vpnHelper> RSS Update - forum: how to restrict? <http://forums.openvpn.net/topic7892.html#p10955>
05:30 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:30 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:30 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:30 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
05:34 -!- ele_ [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
05:34 -!- inimino [~inimino@boshi.inimino.org] has quit [Ping timeout: 252 seconds]
05:34 -!- ele__ [~maarten@pinky.elexer.com] has joined #openvpn
05:35 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Client Quit]
05:35 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:35 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:35 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:36  * janjust keeps getting ping timeouts & wonders if there's something wrong @ Freenet
05:36 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
05:42 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
05:42 -!- kuhkatz [~kuhkatz@60-43-142-46.pool.kielnet.net] has joined #openvpn
05:42 -!- kuhkatz [~kuhkatz@60-43-142-46.pool.kielnet.net] has quit [Changing host]
05:42 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
05:42 < hyper_ch> janjust: what's freenet?
05:42 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
05:43 < janjust> errr I meant freenode
05:45 < hyper_ch> janjust: that works just fine for me (tm)
05:46 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
05:46 < janjust> normally it works fine for me as well, but today I got kicked off twice due to a ping timeout
05:48 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
05:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:55 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
06:09 -!- MarKsaitis_ [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
06:11 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
06:12 -!- Varazir_ [mircwars@c-94-255-130-33.cust.bredband2.com] has joined #openvpn
06:12 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
06:12 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has quit [Ping timeout: 246 seconds]
06:12 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 246 seconds]
06:12 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Ping timeout: 246 seconds]
06:12 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 246 seconds]
06:12 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has joined #openvpn
06:12 -!- tjz [~pc@bb121-7-118-102.singnet.com.sg] has quit [Changing host]
06:12 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
06:12 -!- twister004_ is now known as twister004
06:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:14 -!- zayka [~zayka@vir1a.toonel.net] has quit [Remote host closed the connection]
06:17 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
06:19 < hyper_ch> krzee: breakin at RSA was because of flash player... http://www.theregister.co.uk/2011/04/04/rsa_hack_howdunnit/
06:19 <@vpnHelper> Title: RSA explains how attackers breached its systems • The Register (at www.theregister.co.uk)
06:19 < hyper_ch> it's really time to get flash removed from computers
06:19 < Mirrakor> janjust: did you get my link with the verb 4 log?
06:21 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
06:34 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
06:34 < janjust> Mirrakor:  yes I did, I responded as well
06:35 < janjust> the client log looks OK, I suggested to run 'tcpdump -nnl -i tap0' on the server while pinging the server from the client (i.e. 'ping 10.8.0.1')
06:35 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
06:37 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 246 seconds]
06:37 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 246 seconds]
06:37 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
06:37 -!- p3rror [~mezgani@41.140.170.45] has quit [Ping timeout: 246 seconds]
06:37 -!- newmember_ is now known as newmember
06:37 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
06:38 -!- p3rror [~mezgani@41.140.170.45] has joined #openvpn
06:42 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
07:03 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Changing host]
07:03 -!- Nowak [nowak@worldwind/developer/Nowak] has joined #openvpn
07:06 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has quit [Quit: Leaving.]
07:15 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 276 seconds]
07:16 -!- takamichi [~pri@174.37.86.108] has joined #openvpn
07:28 -!- takamichi [~pri@174.37.86.108] has quit [Ping timeout: 246 seconds]
07:28 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
07:30 -!- Bartzy [~Bartzy@194.90.113.113] has joined #openvpn
07:30 < Bartzy> Hi
07:30 < Bartzy> How can I make the routes OpenVPN pushes to be with a smaller metric than existing routes ?
07:30 < Bartzy> one of my internal networks that I expose to the VPN clients is 172.16.0.0/16 
07:31 < Bartzy> I want the route that OpenVPN pushes to the clients to be with a metric that is lower than existing 172.16.0.0/16 routes, 
07:31 < Bartzy> To avoid network collisions....
07:31 < ecrist_> that's probably not a good idea.
07:31 < Bartzy> Why ?
07:32 < Bartzy> How do I prevent network collisions then ?
07:32 < Bartzy> Lets say a client is staying at a hotel that has a Wifi network of 172.16.0.0/16.
07:32 < ecrist_> well, if their default gateway is on a subnet you're overriding, then they can't get to your vpn server.
07:32 < ecrist_> Bartzy: you a more specific network blcok.
07:32 < ecrist_> block*
07:32 < ecrist_> you use a*
07:33 < ecrist_> gahh, can't type today
07:33 < Bartzy> ecrist_: That's the only solution ? Changing my 172.16.0.0/16 to some 172.131.243.0/16 network ?
07:33 -!- AndyML [~alauppe@ec2-50-17-27-179.compute-1.amazonaws.com] has left #openvpn []
07:33 < Bartzy> or other weird subnet ?
07:33 < Bartzy> there's no other way around it ?
07:35 < ecrist_> Bartzy: yup
07:35 < ecrist_> no other way around it
07:35 -!- You're now known as ecrist
07:35 < Bartzy> There isn't some weird NAT solution ?
07:36 < Bartzy> I thought of maybe using external public IPs as private IPs :)
07:36 < Bartzy> I have some spares
07:36 < Bartzy> and no hotel is stupid enough to use Public subnets as Wifi networks
07:42 < hyper_ch> ecrist: heard of what's the cause for the RSA break in?
07:46 -!- takamichi [Takamichi@80.71.98.29] has quit [Remote host closed the connection]
07:47 < ecrist> hyper_ch: yes, a cracker
07:47 < hyper_ch> no, Adobe Flash
07:49 < hyper_ch> http://www.theregister.co.uk/2011/04/04/rsa_hack_howdunnit/
07:49 <@vpnHelper> Title: RSA explains how attackers breached its systems • The Register (at www.theregister.co.uk)
07:50 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:50 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:04 -!- _zoom_ [~Admin@196.1.219.211] has quit [Read error: Connection reset by peer]
08:10 -!- Varazir_ is now known as Varazir
08:11 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
08:17 -!- Netsplit *.net <-> *.split quits: krphop, janjust, Torpion, [intra]lanman
08:20 -!- Netsplit over, joins: Torpion
08:24 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
08:24 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
08:24 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
08:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:55 -!- bitterman [~yury@84.51.195.188] has joined #openvpn
08:55 -!- gladiatr_afk is now known as gladiatr
08:55 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
08:55 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:59 -!- luneff [~yury@84.51.195.188] has quit [Ping timeout: 276 seconds]
09:02 -!- Comnenus [~Comnenus@li286-135.members.linode.com] has quit [Quit: leaving]
09:07 -!- Netsplit *.net <-> *.split quits: pa, d303k, dvl, hpa, ZO^iLvHk, hjohnson, p3rror, up_the_irons, naquad, ScriptFanix,  (+9 more, use /NETSPLIT to show all of them)
09:08 -!- Netsplit over, joins: d303k, Bartzy, p3rror, Varazir, naquad, ZO^iLvHk, fahadsadah_, pa, sno_, dvl (+9 more)
09:08 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
09:12 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
09:14 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has quit [Quit: Verlassend]
09:20 -!- Netsplit *.net <-> *.split quits: pa, d303k, hpa, dvl, ZO^iLvHk, hjohnson, p3rror, up_the_irons, naquad, ScriptFanix,  (+9 more, use /NETSPLIT to show all of them)
09:20 -!- Netsplit over, joins: d303k, Bartzy, p3rror, Varazir, naquad, ZO^iLvHk, fahadsadah_, pa, sno_, dvl (+9 more)
09:35 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:35 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:43 -!- zxd_ [~zxd@95.211.21.37] has joined #openvpn
09:43 < zxd_> hello
09:44 < zxd_> I am getting alot of these FRAG TTL expired  , and openvpn is already running with --mtu-disc yes --fragment 1300
09:44 < zxd_> what does FRAG TTL mean
09:48 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
09:49 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
09:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:57 < gladiatr> zxd_, are you using the mssfix option as well?
09:57 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
09:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:05 -!- _LowKey is now known as LowKEy
10:05 -!- LowKEy is now known as LowKey
10:05 -!- LowKey [rhel@a.legend.at.his.bestforever.com] has quit [Changing host]
10:05 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
10:06 -!- MarKsaitis_ [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Ping timeout: 240 seconds]
10:06 -!- LowKey [rhel@unaffiliated/lowkey] has quit [Quit: changing servers]
10:06 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
10:09 -!- Blues-Man [~bluesman@host80-32-dynamic.27-79-r.retail.telecomitalia.it] has joined #openvpn
10:11 < zxd_> gladiatr: would it calculate a mss of 1260 in that case?
10:13 < gladiatr> zxd_, only if you direct it to.  The man page states that without an argument, mssfix will take its default max parameter from the --fragment max option
10:17 < dvl> wow.... installed OpenVPN (tunnel blick) on my Mac Book... copied over a config file from a known good server, altered the file names, and it worked, first try.
10:17 < dvl> \o/
10:17 < krzie> o/
10:17 < gladiatr> dvl, *\o/*
10:17 < gladiatr> dvl, truly a beautiful thing
10:20 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
10:21 < dvl> gladiatr: hell yeah. :)
10:22 < dvl> Next step, try a backup over that link.  I don't think I'll hit the record: 18GB in 34 minutes.
10:34 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html>
10:35 < dvl> Hah!  I spoke too soon. Route conflict. I assigned the wrong remote IP to the laptop and disconnected another server.  ;)
10:36 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
10:36 < ecrist> dvl: oops
10:36 < dvl> no big deal, it's easily fixed (I think)
10:36 < gladiatr> dvl, well, at least that's user error and not some element of the software exploding on you
10:37 < gladiatr> explainable scenarios are least stressful.
10:40 < dvl> I was missing a file at /usr/local/etc/openvpn/ccd 
10:40 < dvl> for the new host...
10:41 < dvl> So I'm not sure why it used one for another host...
10:41 < dvl> OH, I have both of these in my server config:
10:41 < dvl> ifconfig-pool-persist /usr/local/etc/openvpn/ipp.txt
10:41 < dvl> client-config-dir /usr/local/etc/openvpn/ccd
10:41 < dvl> I'm pretty sure I'm using only ccd...
10:42 < dvl> because that's what I just fixed.  I think I can remove ipp entirely now.
10:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
10:42 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:03 -!- Blues-Man [~bluesman@host80-32-dynamic.27-79-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
11:06 -!- Blues-Man [~bluesman@host80-32-dynamic.27-79-r.retail.telecomitalia.it] has joined #openvpn
11:06 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 248 seconds]
11:06 -!- pwrcycle- [~pwrcycle@64.85.168.32] has joined #openvpn
11:07 < krzee> dvl, good idea
11:07 < krzee> !ipp
11:07 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
11:08 < dvl> krzee: what vpnHelper said is slightly different from what I was just reading: http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html
11:08 <@vpnHelper> Title: OpenVPN 2.1 (at openvpn.net)
11:08 < dvl> That says to use --ifconfig-push'
11:09 -!- cpf__ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 240 seconds]
11:09 < krzee> actually, if you read closely...
11:09 < krzee> vpnHelper just told you that ipp does NOT create static ips, and to see !static if you want static ips, !static explains how to use --ifconfig-push ;]
11:09 <@vpnHelper> Error: Spurious "]".  You may want to quote your arguments with double quotes in order to prevent extra brackets from being evaluated as nested commands.
11:09 < Bushmills>   !static is *not* a configuration directive
11:09 -!- Bartzy [~Bartzy@194.90.113.113] has quit [Read error: Connection reset by peer]
11:10 < dvl> !static
11:10 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
11:10 < dvl> Bushmills: Now I understand you.
11:11 < dvl> krzee: Yeah, now I see..
11:11 < krzee> aka you're doing it right =]
11:11 < dvl> and yes, I'm already using ifconfig-push via my ccd entries.
11:11 < dvl> Yeah.. Just need to remove that spurious entry entirely, and update my article: http://www.freebsddiary.org/openvpn-routed.php
11:11 <@vpnHelper> Title: The FreeBSD Diary -- OpenVPN - creating a routed VPN (at www.freebsddiary.org)
11:22 -!- Guest10226 is now known as caesay
11:22 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
11:22 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
11:24 -!- EugeneKay is now known as EugeneKaway
11:25 -!- cpf__ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
11:26 < dvl> hah!  In my original article, I said: If you do this for all clients, I suspect this option is superfluous.
11:29 -!- EugeneKaway is now known as EugeneKay
11:29 < dvl> fixed.  Thanks. :)
11:29 < krzee> you may want to try out topology subnet
11:29 < dvl> krzee: ?
11:29 < krzee> then you dont need to use special ips like .6 .10 .14 .18 etc
11:30 < krzee> you could use .2 .3 .4 etc
11:30 -!- Guifort [~Administr@ks367821.kimsufi.com] has joined #openvpn
11:31 -!- Guifort [~Administr@ks367821.kimsufi.com] has quit [Client Quit]
11:32 -!- dvl [~Dan@pdpc/supporter/active/dvl] has left #openvpn ["Leaving"]
11:32 -!- dvl [~Dan@pdpc/supporter/active/dvl] has joined #openvpn
11:32 < dvl> oops.
11:33 < krzee> not that you need to or anything
11:33 < krzee> just suggesting stuff to play with since you're documenting stuff and all :)
11:34 < dvl> I think that I'd need net30...
11:34 < dvl> or... as you said, subnet.
11:34 -!- Guifort [~Administr@ks367821.kimsufi.com] has joined #openvpn
11:34 < krzee> there IS a good reason to stick with net30 tho
11:34 < dvl> No, not playing with it at present, just fixing what wasn't quite right.
11:35 < krzee> in some situations
11:35 < dvl> and that reason is Windows clients?  I have one of those.
11:35 < krzee> and here it is
11:35 < krzee> no
11:35 < krzee> topology subnet was the fix to the workaround for windows clients (net30)
11:35 < krzee> but net30 still has 1 advantage
11:35 < krzee> if you use topology subnet or dev tap, clients can change their IP with ifconfig
11:35 < krzee> and it will still work
11:36 < krzee> so if you do firewall rules based on static ip and not using the dynamic methods, dev tap or topology subnet gives the user a way around the firewall
11:36 < krzee> in net30, the vpn dies if they change their vpn ip
11:36 < krzee> since they are only in a /30 subnet to the server
11:37 < krzee> in JJK's book you see a good way to do this dynamically and make that a non-issue
11:37 < krzee> !book
11:37 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
11:37  * krzee glares at vpnHelper 
11:40 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
11:40 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
11:40 -!- mode/#openvpn [+o vpnHelper] by ChanServ
11:41 < krzee> !ping
11:41 <@vpnHelper> pong
11:41 < krzee> better
11:44 < dvl> krzee: got it.  I've updated the article, but not gone with topology.  No time just now... doing the two conferences.
11:53 < krzee> cool
11:54 -!- echoSMIL1 [~censured@bl16-211-171.dsl.telepac.pt] has joined #openvpn
11:55 -!- Blues-Man [~bluesman@host80-32-dynamic.27-79-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
11:55 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 240 seconds]
12:05 -!- Blues-Man [~bluesman@host80-32-dynamic.27-79-r.retail.telecomitalia.it] has joined #openvpn
12:08 < dazo> !ping
12:08 <@vpnHelper> pong
12:09 < dazo> pffft
12:12 < krzee> heh
12:21 -!- Blues-Man [~bluesman@host80-32-dynamic.27-79-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
12:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:23 -!- Blues-Man [~bluesman@host80-32-dynamic.27-79-r.retail.telecomitalia.it] has joined #openvpn
12:24 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
12:24 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
12:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:27 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
12:27 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
12:27 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:28 -!- cromega [crome@moronia.hu] has left #openvpn ["chunky bacon!"]
12:42 -!- Blues-Man [~bluesman@host80-32-dynamic.27-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
12:46 -!- hardwire_ is now known as hardwire
13:00 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:05 -!- bitterman [~yury@84.51.195.188] has quit [Quit: Leaving]
13:12 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 252 seconds]
13:15 < krzee> !pptp
13:15 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read about
13:15 <@vpnHelper> why to not use pptp
13:16 < krzee> damn freenode ddos'ers
13:19 -!- Nigr0 [debian-tor@gateway/tor-sasl/nigr0] has joined #openvpn
13:19 < Nigr0> Hi, i've been trying to tunnel my internet traffic trough an openvpn pipe, i've put two computers at each end of the pipe but the internet wont flow, wat do?
13:20 < hjohnson> need more spice
13:21 < Nigr0> i dont have more spice, will more cowbell do?:P
13:21 < hjohnson> figures..heh
13:21 < hjohnson> tbh, it's probably a firewall and/or rp_filter type problem
13:22 -!- brianw__ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has left #openvpn ["Leaving"]
13:22 -!- JoeyJoeJo [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
13:23 < JoeyJoeJo> I've set up openvpn for my office and I've given everyone their own certificate. When someone quits, is fired, etc, can I revoke or invalidate their certificate?
13:23 < gladiatr> hjohnson, perhaps a missing iroute...
13:23 < gladiatr> hrm... we'll never know until krzee masters the art of remote mind reading...
13:24  * krzee force chokes anyone who asks about iroute without reading his openvpn routing document
13:24 < krzee> !route
13:24 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:25 < hjohnson> heh
13:25 -!- ZO^iLvHk is now known as steve
13:26  * hjohnson does tech support for products sold to the Army... I've become pretty good at mind reading, at least when it comes to our gear.
13:26 < hjohnson> "I can't find the satellite" "Is the dish outside?" "uhmmm"
13:26 < Nigr0> "I cant get a radio signal" *Are you inside an APC?*
13:27 < hjohnson> <facepalm>
13:27 < hjohnson> Nigr0: or, conversely, "is your warlock turned on?"
13:28 < krzee> do you have tigerblood?
13:28 < hjohnson> me? no
13:28 < krzee> did you take your sheen medication this morning?
13:29 < Nigr0> I herd charlie sheen has it.
13:29 < hjohnson> lol
13:29 < Nigr0> So i best steal it from him, i already have his bike.
13:29 < gladiatr> JoeyJoeJo, certificate revocation the technical term for certificate invalidation.  You have to make sure that you have some sort of mechanism in place to refresh your CRL periodically for it to do any good, though.
13:30 < gladiatr> Or if you don't get rid of people very often, make it part of the revocation process to update the new crl to your openvpn server.
13:32 < Nigr0> I also figured out my problem with openvpn, you see, the internet is a series of tubes. And the pipes are clogged.
13:34 -!- Nigr0 [debian-tor@gateway/tor-sasl/nigr0] has left #openvpn []
13:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
13:54 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10957>
14:09 -!- serious_ [serious@nutgallery.org] has joined #openvpn
14:10 < serious_> can someone help me out with a route issue?  my supplied config from my provider includes "redirect-gateway def1" which is NOT desired (because I still need to be able to access the public interface on the machine), but I can't seem to get the route specified correctly
14:11 < serious_> the tunnel is up/running but not forwarding any packets back through
14:11 < serious_> help is appreciated
14:12 < gladiatr> serious_, if you need to be able to access specific networks, you can set static routes on your client system for your original gateway.  Even if the vpn is offline, having such routes in place won't hurt anything.  The only annoying thing would be if your normal default gateway should change with any sort of regularity--then you'd have to be sure to update the static routes.
14:13 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:14 < serious_> gladiatr: am i just messing up my syntax?   if im' putting in "route add -net ip/mask gw ip dev tap0" but still not able to get responses from the vpn interface
14:15 < gladiatr> Can you ping other hosts on the bridge?
14:16 < serious_> no
14:16 < krzee> a) why bridge
14:16 < serious_> it works properly w/ the redirect-gateway but i lose the ability to connect to the box internally then
14:16 < krzee> !factoids search --values ip
14:16 <@vpnHelper> 'ifconfig', 'def1', 'tap', 'bridge-dhcp', 'static', 'dynamicfirewall', 'iporder', 'nat', 'winipforward', 'net30', 'iptables', 'nobind', 'iptables', 'mitm', 'linipforward', 'linnat', 'linfw', 'linnat', 'lintrafaccnt', 'crl', 'tunortap', 'ipp', 'ipp', 'interface', 'notcompat', 'iporder', 'iporder', 'iporder', 'fbsdipforward', 'redirect', 'win_ipfail', 'tools', 'pfnat', 'subnet', 'pptp', 'sockd', 'pushdns',
14:16 <@vpnHelper> 'rip', 'mesh', 'linipforward', 'ipv6', 'noenc', 'iphone', 'winscript', 'ssl-admin', 'logs', 'linportforward', 'linportforward', 'linportforward', 'ldap_iptables', 'osxipforward', 'osxipforward', 'ipforward', 'iphone', 'client-connect', 'script', 'ipv6', 'layer2', 'layer2', 'serverlan', 'welcome', 'dupe', 'vpn', 'clientlan', 'static', '1918', 'iphone', '!ipad', 'openvzlinnat', 'strip-passphrase', 'win-dns',
14:16 <@vpnHelper> 'tcpip', 'route', 'openvznat', '/30', and 'nsupdate'
14:17 < krzee> hrmmm
14:17 < serious_> i know i'm overlooking something pretty basic and getting frustrated
14:17 < gladiatr> serious_, what box is "the box"?
14:17 < krzee> !factoids
14:17 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
14:18 < gladiatr> serious_, the vpn server?
14:18 < serious_> client
14:18 < serious_> sorry 
14:18 < krzee> !route_override
14:18 <@vpnHelper> "route_override" is https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet
14:19 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:20 < gladiatr> what is running on your client system that you can't access once the vpn is up?
14:20 < gladiatr> out of curiosity
14:22 < serious_> just ssh.  i have to still be able to access it on the local net
14:23 < krzee> then override redirect-gateway for the local net
14:23 < gladiatr> righto.  The info in that thread will do the trick then
14:23 < krzee> !route_override
14:23 <@vpnHelper> "route_override" is https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet
14:24 < krzee> !learn route_override as https://forums.openvpn.net/topic7175.html to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn
14:24 <@vpnHelper> Joo got it.
14:24 < krzee> if it was a public webserver or something, you would want that second one
14:25 < krzee> but since its LAN ssh traffic, use the first one =]
14:25 < krzee> well, do what you like... but thats my suggestion
14:27 < serious_> ok
14:27 < serious_> thanks very much
14:29 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
14:30 < serious_> works perfectly
14:30 < serious_> :)
14:30 -!- serious_ [serious@nutgallery.org] has quit [Quit: leaving]
14:34 -!- newmember [~chatzilla@209.82.97.21] has joined #openvpn
14:34 < gladiatr> :)
14:47 < oc80z> yo'h
14:47 < oc80z> is there some sort of openssl -1 passwd <blah> for /etc/passwd hashs?
14:47 < oc80z> NBS-DES is /etc/passwd , i bet.
14:47 < oc80z> oops,. not openwrt
14:50 < ecrist> :)
14:50 -!- fbh_ is now known as fbh
14:50 -!- gladiatr is now known as gladiatr_afk
14:50 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
14:50 -!- tjz_ [~pc@bb121-7-118-102.singnet.com.sg] has joined #openvpn
14:50 -!- fbh [fbh@lucifer.frands.net] has quit [Changing host]
14:50 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
14:50 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:51 -!- dazo is now known as dazo_afk
14:54 < oc80z> ;] btw the syntax is openssl passwd -1 oVpN0i*&hd
14:57 < oc80z> grrr
14:58  * krzee logs in with oc80z's pass before he changes it
14:59 < oc80z> chmod -x /bin/ ; chmod -x /usr/bin ; 
14:59 < oc80z> ahh
14:59 < oc80z> heh
14:59  * krzee wonders how that second chmod works for you
15:00 < oc80z> or the first hehe
15:00 < krzee> actually i guess since it wasnt recursive, and you are root so you can still read in the dir, it may still work
15:01 < oc80z> it would
15:01 -!- luneff [~yury@84.51.201.89] has joined #openvpn
15:02 < oc80z> heh
15:02 < oc80z> someone said use mkpasswd..
15:03 < oc80z> ...theres no mkpasswd in the openwrt package system. 
15:03 < oc80z> dumbass. 
15:08 < oc80z> fucking 3rd party this shit
15:11 -!- joren [~j@173-12-163-81-oregon.hfc.comcastbusiness.net] has quit [Ping timeout: 276 seconds]
15:13 -!- mode/#openvpn [+o krzee] by ChanServ
15:14 -!- mode/#openvpn [-b *!*james@*.dsl.bell.ca] by krzee
15:14 -!- mode/#openvpn [-o krzee] by krzee
15:16 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
15:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
15:18 -!- joren [~j@199.223.122.146] has joined #openvpn
15:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:38 < oc80z> there. 
15:38 -!- bauruine [~stefan@87.245.124.161] has quit [Ping timeout: 248 seconds]
15:46 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has quit [Quit: Leaving.]
15:57 -!- p3rror [~mezgani@41.140.170.45] has quit [Remote host closed the connection]
15:58 -!- bitterman [~yury@84.51.201.89] has joined #openvpn
15:59 -!- Netsplit *.net <-> *.split quits: d303k, smerz, fahadsadah_, pa, steve, cpf__, naquad, Varazir
16:00 -!- Netsplit *.net <-> *.split quits: kloeri, krphop_, Rolybrau, |Mike|, luneff, krzie, rkantos, Fiouz, ronnocol, LowKey,  (+27 more, use /NETSPLIT to show all of them)
16:00 -!- Guest64202 is now known as Martin
16:00 -!- Martin is now known as Guest51125
16:02 -!- EmperorTom [~EmperorTo@216.17.68.153] has joined #openvpn
16:02 -!- Netsplit over, joins: krzie, d303k, chantra_1fk, cron2_, patel, krzee, Rolybrau, luneff, smerz, newmember (+34 more)
16:02 -!- luneff [~yury@84.51.201.89] has quit [Ping timeout: 283 seconds]
16:03 -!- espeed [~espeed@63.246.231.57] has quit [Max SendQ exceeded]
16:04 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
16:05 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Quit: Leaving]
16:06 -!- EugeneKay is now known as EugeneKaway
16:15 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 248 seconds]
16:16 -!- Guifort [~Administr@ks367821.kimsufi.com] has quit [Quit: Quitte]
16:17 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 248 seconds]
16:19 -!- Champi [Champi@rootshell.fr] has joined #openvpn
16:21 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
16:28 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
16:38 -!- EugeneKaway is now known as EugeneKay
16:40 -!- rigel [~saxonberg@c-68-34-78-124.hsd1.md.comcast.net] has joined #openvpn
16:57 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
17:01 -!- newmember [~chatzilla@209.82.97.21] has quit [Ping timeout: 276 seconds]
17:02 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
17:09 -!- xorred [~xorred@unaffiliated/xorred] has joined #openvpn
17:09 < xorred> I've got a conf file I load in linux every time with openvpn file.conf and should keep my window open to stay connected
17:10 < xorred> is tehre a way to do that on boot automatically?
17:10 < xorred> like, in ubuntu for example
17:11 < xorred> anyone?
17:12 < krzee> there is, but that is not an openvpn question
17:12 < krzee> nor can i answer it, since i dont use ubuntu
17:12 < xorred> ok, how do I enter the username/pass in the conf
17:12 < krzee> if you wanted to know how to do it in freebsd or osx, i could help ya
17:12 < xorred> as now I have to type them in
17:12 < krzee> you dont
17:12 < krzee> !pwfile
17:12 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
17:12 < krzee> but you REALLY should not do that
17:12 < krzee> just disable password auth and use certs only
17:13 < krzee> it will be more secure than storing your password in a file
17:13 < xorred> ok... then how do I run it in the background without having to keep the console open
17:13 < krzee> --daemon
17:13 < xorred> openvpn conf.conf & fails
17:13 < xorred> as it fails to read the username
17:13 < xorred> I have a pem file too
17:13 < krzee> so?
17:14 < Bushmills> xorred: learn about sysv init scripts on your system.  find them in /etc/init.d
17:14 < Bushmills> there's an openvpn script. which can run openvpn with configs from /etc/openvpn during boot
17:15 < xorred> krzee: how do I use pem instead of user/pass
17:15 < krzee> xorred, do you run the server?
17:16 < xorred> no
17:16 < xorred> I'm just a new user
17:16 < krzee> password auth and cert auth (what your .pem is) are different
17:16 < xorred> who has not used openvpn in 3 years and forgot everything
17:17 < xorred> aha ok
17:17 < xorred> so... there's no way I can automate that whole thing because of the username/pass?
17:17 < xorred> I don't care about security as I am the only one who access this vm / box
17:17 < xorred> if someone gets access to my box it would be game over anyway
17:19 < krzee> does the admin care about the security of your password?
17:19 < krzee> hint: he wouldnt require the password if he wanted you to keep it in a file
17:19 < xorred> no, it's a private network
17:19 < krzee> it would then be less secure than the .pem
17:20 < krzee> yes he does, thats why he requires dual factor auth
17:20 < xorred> if someone gets access to my box it DOES NOT matter if I store the pass on a text file or not
17:20 < krzee> security is: something you have (certs, key cards, etc) | something you know (passwords) | something you are (biometrics)
17:21 < krzee> for good security, you use 2 or 3 of the above
17:21 < xorred> krzee, store your passwords as good as you want, but give me physical access to your box for 10 minutes
17:21 < xorred> we'll talk again ;)
17:21 < krzee> when you take a password (something you know) and turn it into a file (something you have) it then becomes an insecure version of something you have, as compared with certs
17:21 < krzee> xorred, false
17:21 < xorred> nope, true
17:21 < krzee> if i secure them with AES256 using openssl, what do you think you'll do about it?
17:22 < xorred> I'll install a hw keylogger
17:22 < xorred> or a camera above your kb
17:22 < xorred> or whatnot
17:22 < xorred> physical access - game over
17:22 < krzee> you said give you access for 10min, not use it as you return it to me
17:23 < xorred> my idea is that arguing about the password if my laptop is secure is meaningless
17:23 < xorred> and if the laptop is not secure, it's meaningless too
17:23 < xorred> I'm not here to discuss phylosophy
17:24 < krzee> either way
17:25 < krzee> i answered your question 12 minutes ago
17:25 < krzee> then i explained why its bad, and not enabled in openvpn by default
17:25 < krzee> do what you want tho :-p
17:26 < krzee> and your idea that nothing is secure, so why try is a logical fallacy
17:26 < xorred> how do I check if it's built with --enable-password-save
17:26 < krzee> ;]
17:26 < xorred> and if it is, how do I create a pwfile - do I store it in /etc/openvpn?
17:26 < krzee> by rebuilding it yourself, or trying the config option and seeing if it complains
17:26 < krzee> read the manual dude
17:27 < xorred> man openvpn? /pwfile - pattern not found
17:27 < krzee> [15:12]  <vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
17:27 < krzee> the !pwfile was a command to my bot
17:27 < krzee> try searching for the things my bot told you about
17:28 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
17:28 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
17:28 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:30 < xorred> even google doesn't return anything on openvpn --auth-user-pass
17:30 < xorred> and the man doesn't have examples
17:31 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:32 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
17:36 -!- JPeterso2 [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
17:36 < krzee> examples?
17:36 < krzee> really?
17:36 < krzee> fine, lemme get my spoon out
17:37 < xorred> I already fixed it :)
17:37 < xorred> no need to
17:37 < xorred> just editing the init script now ...
17:37 < xorred> so it would start on boot
17:38 < krzee> ahh so you found the text directly above what my bot says in the manual ;]
17:38 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 246 seconds]
17:38 -!- JPeterso2 is now known as JPeterson
17:44 -!- xorred [~xorred@unaffiliated/xorred] has quit [Remote host closed the connection]
18:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:17 -!- jpalmer_ is now known as jpalmer
18:17 -!- jpalmer [~jpalmer@irc.PalmerIT.net] has quit [Changing host]
18:17 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
18:17 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has quit [Quit: Verlassend]
18:18 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Quit: leaving]
18:19 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
18:22 -!- Torpion [~torpion@ydb.me] has quit [Ping timeout: 240 seconds]
18:36 -!- Torpion [~torpion@ydb.me] has joined #openvpn
18:41 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
18:42 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:23 -!- Irssi: No bans in channel #openvpn
19:34 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:34 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
19:38 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
19:38 < zayka> hello!
19:38 < zayka> how can i lower my ping?
19:39 < zayka> "cipher none" and "#comp-lzo" ?
19:41 < zayka> auth none?
19:42 < zayka> if i don't need security
19:51 < krzee> if you dont need security, you likely dont need openvpn
19:51 < krzee> oh wait, i told you that yesterday didnt i
19:51 < krzee> you never looked into GRE tunnels did you...?
20:05 < zayka> i'm using gre...
20:05 < zayka> and forwarding traffic thru it =)
20:06 < zayka> but i need easy setup for windows users
20:06 < zayka> to connect them )
20:06 < zayka> in one virtual network )
20:06 < zayka> pptp is not working for me %(
20:07 < krzee> and why wouldnt you need any security?
20:07 < krzee> it doesnt matter if files get changed in transit?
20:07 < krzee> or commands...
20:09 < zayka> if some packets become corrupted/altered is better than long pings
20:12 < krzee> lan gaming?
20:12 < zayka> and gaming too
20:12 < zayka> and othet things..
20:12 < zayka> other*
20:12 < krzee> well for gaming...
20:13 < krzee> you are using dev tap, right?
20:13 < krzee> most lan games use broadcasts, dev tun wont tunnel those
20:14 < zayka> oh! i'll fix that...
20:14 < zayka> thx!
20:14 < krzee> yw
20:14 < krzee> if you care to expand on your ACTUAL goals, i may be able to help more
20:14 < zayka> that would be nice %)
20:14 < krzee> here is a link that explains why im asking for that
20:14 < krzee> [18:14]  <greybot> http://mywiki.wooledge.org/XyProblem -- "I want to do X, but I'm asking how to do Y..."
20:15 <@vpnHelper> Title: XyProblem - Greg's Wiki (at mywiki.wooledge.org)
20:16 < zayka> good =)
20:20 < zayka> krzee, and proto udp is better than tcp?
20:27 < zayka> krzee, help! %)
20:41 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 246 seconds]
20:42 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:00 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:08 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html>
21:54 -!- polemon [mcp@polemon.org] has joined #openvpn
21:54 < polemon> hi, could someone point me to a good tutorial on how to set up bridged openvpn on OpenBSD 4.8?
21:55 < polemon> I just found older how-to's, but they date back to 2005
22:04 < Dougy> krzee: do you like boxing
22:04 < polemon> there seems to be not even one comprehensable how-to on this one
22:11 -!- master_of_master [~master_of@p57B52B1F.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
22:13 < Dougy> krzee: http://tomaszadamek.com.pl/upload/1299078973mc_bride_miniAdamek3_(2).jpg <-- going front row, again
22:13 -!- master_of_master [~master_of@p57B574FC.dip.t-dialin.net] has joined #openvpn
22:20 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 248 seconds]
22:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 248 seconds]
22:21 -!- Guest51125 [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 248 seconds]
22:27 -!- Martink [martin@shell.ipv6.octocore.net] has joined #openvpn
22:28 -!- Martink is now known as Guest44104
22:30 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
22:34 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:43 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
22:43 <@vpnHelper> RSS Update - forum: Can't connect Clients!!!! <http://forums.openvpn.net/topic7898.html>
23:01 < xxtjaxx> Hi this is part of the initilization sequence in my openvpn http://paste.debian.net/113030/ can somebody explain to me what the code=22 issue means?
23:06 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has quit [Ping timeout: 240 seconds]
23:07 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has joined #openvpn
23:24 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
23:33 -!- zayka [~zayka@vir1a.toonel.net] has quit [Ping timeout: 260 seconds]
23:41 -!- Guest44104 is now known as Martin
23:41 -!- Martin is now known as Guest73134
23:50 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
--- Day changed Tue Apr 05 2011
00:00 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has quit [Remote host closed the connection]
00:01 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
00:02 -!- tjz_ [~pc@bb121-7-118-102.singnet.com.sg] has quit [Quit: bbl.]
00:04 -!- scott0x [~scott@pool-96-231-117-95.washdc.east.verizon.net] has joined #openvpn
00:04 < scott0x> hi
00:04 < scott0x> I'm having some dns forwarding issues with openvpn... anyone around?
00:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
00:22 -!- espeed [~espeed@63.246.231.57] has quit [Ping timeout: 246 seconds]
00:23 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
00:23 -!- scott0x [~scott@pool-96-231-117-95.washdc.east.verizon.net] has quit [Ping timeout: 246 seconds]
00:36 -!- scott0x [~scott@pool-96-231-117-95.washdc.east.verizon.net] has joined #openvpn
00:36 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:40 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
00:41 -!- Guest73134 is now known as Martin
00:42 -!- Martin is now known as Guest62143
00:43 -!- hjohnson [hans@2002:d134:e8ea:f101:1e6f:65ff:fe36:ef61] has left #openvpn []
00:49 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has joined #openvpn
00:49 -!- xxtjaxx_ [~andreas@dl360.ein-elch.de] has joined #openvpn
00:49 < krzie> scott0x, good job on not managing to say anything useful, so that now an hour later when someone sees it, all they can say is "yes" instead of helping
00:50 -!- wolfric_ [~wolfric@pdpc/supporter/student/wolfric] has joined #openvpn
00:52 < scott0x> hmm
00:52 < krzie> xxtjaxx:
00:52 < krzie> !configs
00:52 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
00:52 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
00:52 -!- xxtjaxx [~andreas@kde/developer/marschke] has quit [Ping timeout: 246 seconds]
00:52 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has quit [Ping timeout: 246 seconds]
00:52 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has quit [Ping timeout: 246 seconds]
00:52 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 246 seconds]
00:52 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 246 seconds]
00:52 -!- inimino [~inimino@boshi.inimino.org] has quit [Ping timeout: 246 seconds]
00:53 -!- rigel [~saxonberg@c-68-34-78-124.hsd1.md.comcast.net] has quit [Ping timeout: 246 seconds]
00:53 -!- openbsdnoob_ is now known as openbsdnoob
00:53 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
00:53 < scott0x> I'm still troubleshooting
00:53 < krzie> Dougy, i was 5th row at the anderson silva fight in feb
00:53 -!- rigel [~saxonberg@c-68-34-78-124.hsd1.md.comcast.net] has joined #openvpn
00:53 < krzie> Dougy, im not much into boxing, they dance around too much... i like mma
00:53 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
00:54 < krzie> polemon, the howto is here
00:54 < krzie> !howto
00:54 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:54 < krzie> if you're looking for a walkthrough, then thats different
00:56 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
00:57 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:57 -!- mode/#openvpn [+o mattock] by ChanServ
00:59 < scott0x> I'm running OpenVPN 2.1.1 on a Droid X, and OpenVPN 2.1.0 on Ubuntu.  I'm connecting over a 3G connection from my phone to my home network.  Everything works except for DNS.  I installed dnsmasq on the server and the native /system/xbin/nslookup works, but /system/xbin/busybox nslookup fails.  ping fails unless I have a corresponding entry in /etc/hosts.  I can ping IP addresses on the Internet and my home network.
00:59 < scott0x> I'm using the iptables forwarding rules from this site: http://library.linode.com/networking/openvpn/ubuntu-10.10-maverick#installing_openvpn
00:59 <@vpnHelper> Title: Deploy VPN Services with OpenVPN - Secure Communications with OpenVPN on Ubuntu 10.10 (Maverick) - Linode Library (at library.linode.com)
01:00 < krzie> doesnt sound like an openvpn issue to me
01:00 < krzie> only thing related in openvpn is this:
01:00 < krzie> !pushdns
01:00 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
01:00 < scott0x> yeah
01:00 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
01:00 < krzie> i doubt that script in #4 works on android tho
01:01 < krzie> if you already changed the NS manually (which it sounds like you did), it cant be related to openvpn
01:01 < scott0x> so you believe it's an iptables/routing issue?
01:01 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
01:01 < krzie> i dunno what it is, i know nothing of the android resolver
01:02 < krzie> for all i know its something android specific
01:03 < krzie> and since you can resolve things 1 way and not another...
01:03 < krzie> that is a sign that its something goofy about how your OS does lookups
01:04 < krzie> what IP are you using for the NS?
01:04 < krzie> the vpn-internal IP?
01:06 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
01:08 -!- gim6626 [d4c05e50@gateway/web/freenode/ip.212.192.94.80] has joined #openvpn
01:10 -!- zayka [~zayka@vir1a.toonel.net] has quit [Ping timeout: 246 seconds]
01:10 < scott0x> back
01:11 < scott0x> 10.8.0.1
01:11 < scott0x> I believe
01:11 < scott0x> and the client is 10.8.0.6
01:11 < krzie> you believe?
01:11 < krzie> check@
01:11 < scott0x> I was sniffing traffic on the server...
01:12 < scott0x> it looks like some of the DNS traffic is going to a Verizon DNS server -- 
01:12 < scott0x> tun0 on the client is 10.8.0.6
01:12 < krzie> how did you set the NS?
01:13 < scott0x> let me get the syntax from the configs
01:13 < scott0x> I have 8.8.8.8 in resolv.conf and also in the configs
01:13 < scott0x> I've tried the server IP with dnsmasq as well
01:14 < krzie> try setting the NS in your network settings through the gui
01:14 < krzie> remember, changing your NS has nothing to do with a vpn
01:14 < krzie> and unless you have a special script in linux, it does nothing to push dns to the client
01:14 < scott0x> push "dhcp-option DNS 10.8.0.1"
01:15 < scott0x> gui on the client or the server?
01:15 < krzie> niether
01:15 < krzie> on the phone, network settings
01:15 < krzie> it has nothing to do with a vpn
01:15 < scott0x> phone is the client
01:15 < krzie> forget that there is a vpn involved
01:15 < krzie> just change the NS
01:16 < scott0x> note sure if it'll let me do that
01:16 < krzie> lol of course it will
01:17 < scott0x> it's a 3g connection
01:17 < krzie> oh right, dunno either
01:17 < scott0x> I can do it for wifi, but I don't believe there is a gui option for 3g
01:17 < krzie> but regardless, you dont have an openvpn issue
01:17 < krzie> you have an issue of trying to change your NS
01:17 < scott0x> well
01:17 < scott0x> hmm
01:17 < krzie> openvpn never tries to change any NS info in any unix
01:18 < krzie> a script is required in any of them
01:18 < krzie> !pushdns
01:18 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
01:18 < krzie> the script in #4
01:18 < krzie> but it shouldnt work in android
01:18 < krzie> so unless they came up with some way, i wouldnt expect openvpn to push dns to android clients
01:18 < krzie> unless of course you code the script
01:19 < scott0x> I'm running openvpn on the phone
01:19 < krzie> i understand
01:19 < krzie> so?
01:19 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
01:19 < scott0x> 2.1.0
01:19 < krzie> and...?
01:19 < scott0x> it receives the entry in /etc/resolv.conf
01:19 < krzie> ok...
01:20 < krzie> then what would make you think its something to solve with openvpn?
01:21 < scott0x> like I said, I'm still troubleshooting
01:21 < scott0x> hours ago, I thought the problem could be with busybox
01:21 < scott0x> if I had the solution, I wouldn't be here
01:21 < krzie> gotchya
01:21 < scott0x> I appreciate you taking the time to help though
01:21 < krzie> well ill help ya 1 steo
01:21 < krzie> step
01:21 < krzie> its not openvpn either ;]
01:21 < krzie> np
01:22 -!- d303k [~heiko@vpn.astaro.de] has quit [Read error: Operation timed out]
01:22 < scott0x> haha
01:22 < scott0x> there are supposedly some apps that will let me change the 3g ns
01:22 < krzie> ild be looking for experts on how android works internally
01:24 < scott0x> it'll be a nice set up once I get it working...
01:24 < scott0x> I'm not comfortable with PPTP's encryption limitations
01:24 < krzie> nor am i
01:24 < krzie> !pptp
01:24 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read about
01:24 <@vpnHelper> why to not use pptp
01:25 -!- d303k [~heiko@port-92-198-130-130.static.qsc.de] has joined #openvpn
01:26 < scott0x> I found those DNS settings
01:26 < scott0x> Do you have an Android phone?
01:29 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:31 < scott0x> fixed.
01:32 < scott0x> Here's what I believe happened... Verizon Wireless probably limits access to their own wireless customers
01:32 < scott0x> and since I was coming from another IP block, it wouldn't let me resolve
01:33 < scott0x> unfortunately, using setprop will only work for the current connection (until I reboot the phone)
01:41 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10961> || Can't connect Clients!!!! <http://forums.openvpn.net/topic7898.html#p10960>
01:42 -!- Guest62143 is now known as Martin
01:43 -!- Martin is now known as Guest8158
01:43 < krzie> [02:33]  <scott0x> Here's what I believe happened... Verizon Wireless probably limits access to their own wireless customers
01:43 < krzie> most ISPs do that
01:43 < krzie> having a publicly available openly recursive nameserver is universally dumb
01:43 < scott0x> yeah, but hours ago, I didn't realize that was what happened :)
01:43 < krzie> it makes you a DDOS relay
01:43 < scott0x> true
01:44 < scott0x> if you're interested, there is an interesting project on Google code that might be relevant to this topic...  http://code.google.com/p/android-scripting/
01:44 <@vpnHelper> Title: android-scripting - Scripting Layer for Android brings scripting languages to Android. - Google Project Hosting (at code.google.com)
01:47 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10962>
01:53 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10963>
01:54 -!- Guest8158 is now known as Martin
01:55 -!- Martin is now known as Guest56105
01:55 < scott0x> good night
01:55 < scott0x> thanks again for your help
01:59 <@vpnHelper> RSS Update - forum: SSL Offleading <http://forums.openvpn.net/topic7899.html>
02:05 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 246 seconds]
02:17 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10966>
02:20 -!- zayka [~zayka@vir1a.toonel.net] has quit [Ping timeout: 276 seconds]
02:27 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
02:40 < gim6626> Hi! We've got OpenVPN server which acts like gateway from network INT to private network EXT, it is already set up and works fine. Now we want to create another private network INTPRIV inside INT. The question is - is it possible to make it using existing OpenVPN machine?
02:40 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10967>
02:40 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
02:42 -!- zayka [~zayka@vir1a.toonel.net] has quit [Remote host closed the connection]
--- Log closed Tue Apr 05 02:47:04 2011
--- Log opened Tue Apr 05 02:48:18 2011
02:48 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
02:48 -!- Irssi: #openvpn: Total of 117 nicks [2 ops, 0 halfops, 0 voices, 115 normal]
02:49 -!- Irssi: Join to #openvpn was synced in 47 secs
02:51 -!- gim6626 [d4c05e50@gateway/web/freenode/ip.212.192.94.80] has quit [Ping timeout: 252 seconds]
02:59 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
02:59 -!- scott0x [~scott@pool-96-231-117-95.washdc.east.verizon.net] has quit [Ping timeout: 240 seconds]
03:00 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
03:00 -!- scott0x [~scott@pool-96-231-117-95.washdc.east.verizon.net] has joined #openvpn
03:05 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html>
03:22 -!- oc80z [oc80z@blea.ch] has joined #openvpn
03:23 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p10969>
03:31 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
03:37 -!- Netsplit *.net <-> *.split quits: pa, Guest56105, dvl, cpf__, hpa, ScriptFanix, up_the_irons, naquad, Fiouz, Champi,  (+11 more, use /NETSPLIT to show all of them)
03:38 -!- EugeneKay is now known as EugeneKaway
03:44 -!- Netsplit over, joins: Clete2
03:44 -!- 50UAAH0EM [martin@shell.ipv6.octocore.net] has joined #openvpn
03:45 -!- Netsplit over, joins: EmperorTom, Champi, dvl, cpf__, zxd_, Varazir, naquad, steve, fahadsadah_, pa (+9 more)
03:45 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Excess Flood]
03:45 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
03:47 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p10970>
03:50 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:53 <@vpnHelper> RSS Update - forum: SSL Offleading <http://forums.openvpn.net/topic7899.html#p10973> || Can't connect Clients!!!! <http://forums.openvpn.net/topic7898.html#p10972> || Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p10971>
03:57 -!- Netsplit *.net <-> *.split quits: Rolybrau, belZe, ronnocol
03:59 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p10974>
04:00 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
04:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:00 -!- ronnocol [~lance@2001:1868:214::dead:beef] has joined #openvpn
04:05 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10975>
04:10 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Quit: Leaving]
04:17 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10976>
04:18 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:18 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:18 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:23 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10979>
04:26 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:26 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:29 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p10980>
04:31 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
04:32 -!- zayka [~zayka@vir1a.toonel.net] has quit []
04:35 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
04:37 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
04:37 < zayka> hi! openvpn rules
04:38 < zayka> i have this option `server 10.0.4.0 255.255.255.0`
04:38 < zayka> what to change if i want to use external dhcp server instead of openvpn's?
04:38 < zayka> help!
04:47 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10981>
04:52 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:53 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896.html#p10983> || Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p10982>
04:57 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:59 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p10984>
05:04 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
05:05 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p10986> || Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p10985>
05:11 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
05:11 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p10988>
05:18 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p10989>
05:20 -!- kuhkatz [~kuhkatz@60-43-142-46.pool.kielnet.net] has joined #openvpn
05:20 -!- kuhkatz [~kuhkatz@60-43-142-46.pool.kielnet.net] has quit [Changing host]
05:20 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
05:24 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p10991>
05:26 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has quit [Ping timeout: 260 seconds]
05:34 -!- 50UAAH0EM is now known as Martin
05:34 -!- Martin is now known as Guest9661
05:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:35 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p10992>
05:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:39 -!- kuhkatz [~kuhkatz@169-12-142-46.pool.kielnet.net] has joined #openvpn
05:39 -!- kuhkatz [~kuhkatz@169-12-142-46.pool.kielnet.net] has quit [Changing host]
05:39 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has joined #openvpn
05:41 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p10993>
05:45 -!- dvl [~Dan@pdpc/supporter/active/dvl] has quit [Excess Flood]
05:46 -!- dvl [~Dan@nyi.unixathome.org] has joined #openvpn
05:50 -!- dvl [~Dan@nyi.unixathome.org] has quit [Changing host]
05:50 -!- dvl [~Dan@pdpc/supporter/active/dvl] has joined #openvpn
05:51 -!- Guest9661 is now known as Martink
05:51 -!- Martink is now known as Martin`
06:20 -!- nb [~nb@fedora/nb] has quit [Read error: Operation timed out]
06:20 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Read error: Operation timed out]
06:20 -!- Champi [Champi@rootshell.fr] has quit [Read error: Operation timed out]
06:21 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
06:21 <@vpnHelper> RSS Update - forum: Windows route add command failed <http://forums.openvpn.net/topic7901.html>
06:21 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
06:21 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Read error: Operation timed out]
06:21 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Operation timed out]
06:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Read error: Operation timed out]
06:21 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Read error: Operation timed out]
06:21 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Operation timed out]
06:21 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
06:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:22 -!- Champi [Champi@rootshell.fr] has joined #openvpn
06:22 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has quit [Read error: Operation timed out]
06:23 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
06:23 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 264 seconds]
06:23 -!- nb [~nb@fedora/nb] has joined #openvpn
06:23 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
06:24 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
06:25 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
06:26 <@vpnHelper> RSS Update - forum: Windows route add command failed <http://forums.openvpn.net/topic7901.html#p10995>
06:26 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
06:29 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
06:35 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
06:38 <@vpnHelper> RSS Update - forum: Windows route add command failed <http://forums.openvpn.net/topic7901.html#p10997> || Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p10996>
06:38 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
06:50 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p10999> || Windows route add command failed <http://forums.openvpn.net/topic7901.html#p10998>
06:56 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p11000>
07:00 -!- EugeneKaway is now known as EugeneKay
07:02 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p11001>
07:03 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 248 seconds]
07:09 -!- cpf__ [~cpf@d515306D2.static.telenet.be] has quit [Quit: Ex-Chat]
07:09 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
07:15 -!- bitterman [~yury@84.51.201.89] has quit [Quit: Leaving]
07:35 < Dougy> krzee: http://a2.sphotos.ak.fbcdn.net/hphotos-ak-snc4/35740_707130218274_6317014_38473793_6308604_n.jpg
07:36 < Dougy> lols
07:44 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p11002>
07:49 -!- pa [~pa@host129-21-dynamic.61-82-r.retail.telecomitalia.it] has joined #openvpn
07:49 -!- pa [~pa@host129-21-dynamic.61-82-r.retail.telecomitalia.it] has quit [Changing host]
07:49 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:50 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p11003>
07:50 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
07:52 -!- pa [~pa@unaffiliated/pa] has quit [Client Quit]
07:52 -!- pa [~pa@host129-21-dynamic.61-82-r.retail.telecomitalia.it] has joined #openvpn
07:52 -!- pa [~pa@host129-21-dynamic.61-82-r.retail.telecomitalia.it] has quit [Changing host]
07:52 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:53 -!- pa [~pa@unaffiliated/pa] has quit [Client Quit]
07:55 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:06 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p11004>
08:14 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 246 seconds]
08:26 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
08:26 -!- dammit2006 [~yaaic@60-240-125-40.tpgi.com.au] has joined #openvpn
08:27 -!- dammit2006 [~yaaic@60-240-125-40.tpgi.com.au] has left #openvpn []
08:30 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p11006> || Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p11005>
08:31 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
08:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:36 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900.html#p11007>
08:42 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900-15.html#p11008>
08:54 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900-15.html#p11009>
09:01 < JoeyJoeJo> Is there anything that can be done to speed up my connection to my openvpn server? I have a 20Mb down/5Mb up connection, and I can only transfer files at about 20KB/s - 30KB/s
09:01 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 250 seconds]
09:01 -!- takamichi [~pri@ks357561.kimsufi.com] has joined #openvpn
09:06 -!- NoobSaibot [~NoobSaibo@rover-215-48.rovernet.mtu.edu] has joined #openvpn
09:06 <@vpnHelper> RSS Update - forum: Lost hope using ccd option <http://forums.openvpn.net/topic7896-15.html#p11010>
09:07 < Bushmills> JoeyJoeJo: talking to openvpn server udp or tcp?
09:07 < JoeyJoeJo> I think udp, but let me check my config
09:07 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:08 < JoeyJoeJo> Yup, udp
09:08 < Bushmills> try --mtu-test
09:12 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
09:13 -!- NoobSaibot [~NoobSaibo@rover-215-48.rovernet.mtu.edu] has quit [Quit: Leaving.]
09:14 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
09:14 -!- local|host [~fourat@196.203.53.221] has joined #openvpn
09:14 < local|host> hi
09:15 < local|host> is it possible to get a lan2lan vpn with openvpn on side A and cisco on side B
09:15 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has quit [Ping timeout: 248 seconds]
09:16 < ecrist> no
09:16 < ecrist> openvpn is it's own protocol
09:17 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has joined #openvpn
09:20 -!- zayka [~zayka@vir1a.toonel.net] has quit [Remote host closed the connection]
09:34 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
09:42 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Quit: Ex-Chat]
09:44 -!- scott0x [~scott@pool-96-231-117-95.washdc.east.verizon.net] has quit [Quit: Leaving]
09:46 -!- stony_ is now known as stony
09:46 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has left #openvpn []
09:49 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
09:50 -!- gladiatr_afk is now known as gladiatr
09:54 -!- takamichi [~pri@ks357561.kimsufi.com] has quit [Ping timeout: 260 seconds]
09:55 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
09:56 -!- local|host [~fourat@196.203.53.221] has quit [Quit: Leaving]
10:08 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:10 -!- pwrcycle- is now known as pwrcycle
10:26 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:33 -!- NoobSaibot [~NoobSaibo@24-213-19-74.static.mrqt.mi.charter.com] has joined #openvpn
10:35 -!- NoobSaibot [~NoobSaibo@24-213-19-74.static.mrqt.mi.charter.com] has quit [Client Quit]
10:35 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Ping timeout: 240 seconds]
10:38 -!- AL13N_work [~alien@91.183.52.232] has joined #openvpn
10:39 < AL13N_work> i wanted to use the "route ip netmask" command in the ccd file, but it the logfile says i can't use the route command like that
10:39 < AL13N_work> how can i add route via the ccd file?
10:40 < gladiatr> AL13N_work, you have to push it to the client
10:40 < AL13N_work> nono, i want to have it on the server side
10:40 < gladiatr> ccd = client configuration directory
10:40 < AL13N_work> the pushed routes to the client works
10:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:40 < gladiatr> oh, you want to set certain routes depending on which client connects?
10:40 < AL13N_work> well, the problem is, it's a local network behind the client
10:40 < AL13N_work> so i want to route to it only if the client is up
10:41 < gladiatr> read the man bits about iroute
10:41 < gladiatr> (that didn't come out right)
10:41 < AL13N_work> the iroute is also ok, i checked the vpn status
10:41 < gladiatr> the bits of the openvpn man page re: iroute
10:41 < AL13N_work> but locally on the server a route needs to be set towards the tun device
10:43 < AL13N_work> gladiatr: i want to add a route on the server so the other networks can be routed to the vpn tun2 device, and so forth
10:43 < krzee> AL13N_work, 
10:44 < krzee> [08:40]  <AL13N_work> so i want to route to it only if the client is up
10:44 < AL13N_work> but only if the vpn client is up
10:44 < krzee> where does that subnet go if the client IS NOT up?
10:44 < AL13N_work> somewhere else
10:44 < krzee> so its an internet routable subnet?
10:44 < AL13N_work> through a wireless bridge
10:44 < AL13N_work> no, it's a bit of a complicated setup
10:44 < krzee> well, we cant help you til we understand your goal
10:44 < gladiatr> we're smart.  :)
10:44 < AL13N_work> i've set up the wireless bridge to use higher metrics
10:45 < krzee> draw a chart if you need to, its a requisite that we understand if you want help with it
10:45 -!- NoobSaibot [~NoobSaibo@rover-215-48.rovernet.mtu.edu] has joined #openvpn
10:45 < AL13N_work> so that the routes being added when the vpn comes up makes traffic go through vpn rather than the wireless link
10:45 < AL13N_work> you understand?
10:46 < AL13N_work> ok no
10:46 < krzee> i understand the 1 thing you just said you did, not your overall goal
10:46 < AL13N_work> ok
10:46 < AL13N_work> i have a central location with server A
10:46 < AL13N_work> and 3 nearby locations B, C and D
10:46 < AL13N_work> each have a separate internet link
10:47 < AL13N_work> and server A has one of those big wireless aps
10:47 < krzee> i love when people get to drawing a map in their head, even labeling, but they dont just draw it
10:47 < AL13N_work> i suck at drawing
10:47 < krzee> gliffy.com
10:47 < krzee> also, before you go further
10:48 < krzee> you have read and understand this:
10:48 < krzee> !route
10:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:48 < krzee> right?
10:53 < AL13N_work> krzee: sure, that's the simple solution
10:54 < AL13N_work> krzee: gladiatr: check out the example in this: http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
10:54 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
10:54 < AL13N_work> it's exactly like this
10:54 < krzee> well great
10:54 -!- kuhkatz [~kuhkatz@unaffiliated/kuhkatz] has left #openvpn ["Verlassend"]
10:54 < AL13N_work> except i don't want to do "route network netmask" in the server.conf file
10:54 < krzee> then i already told you everything you need ;]
10:55 < AL13N_work> i want that to be added whenever client1 vpn is established
10:55 < krzee> !client-connect
10:55 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
10:55 < AL13N_work> aha
10:55 < AL13N_work> thanks
10:55 < krzee> yw
10:56 < AL13N_work> oh
10:56 < AL13N_work> a script
10:56 < krzee> note, while ccd is "client config dir" as gladiatr mentioned, it is in fact part of the server config, so if you dont push it should still work
10:56 < krzee> you may even be able to just put it in a ccd
10:57 < krzee> but im not 100% on that
10:57 < AL13N_work> well, anyway, i figured if i put the "route" in the ccd file, it would only work if the client was connected
10:57 < AL13N_work> i guess it depends on the lowering of privileges?
10:57 < krzee> if you cant do it via ccd, you wont be able to write it to $1 in client-connect script
10:57 < krzee> well you CANT lower privs
10:57 < AL13N_work> nobody probably can't add routes
10:57 < krzee> not if you wanna add routes after the fact like you said
10:58 < AL13N_work> ic
10:58 < AL13N_work> so that's why people put route commands always on the server.conf gile
10:58 < AL13N_work> *file
10:58 < krzee> even if you cant do ccd or write to $1 in that script, you could still manually make the route in the script
10:58 < krzee> thats not the only reason why
10:59 <@vpnHelper> RSS Update - forum: client connected to server but can't ping <http://forums.openvpn.net/topic7902.html>
10:59 < krzee> i would think a majority of people with goals similar to yours use routing protocols to accomplish it
10:59 < AL13N_work> myeah, probably
10:59 < AL13N_work> it's a bit overkill imho
11:00 < krzee> well you def dont *need* one
11:00 < krzee> you can do it with the script like i said
11:00 < krzee> you'll also need a client-disconnect script to undo it
11:04 < webmind> hmm, trying to get a tunnel working but keep getting this message: http://p3rl.org/8828AMUL
11:04 <@vpnHelper> Title: p3rl.org shorten your Perl and CPAN URLs (at p3rl.org)
11:05 < webmind> suggestions welcome
11:08 < krzee> !hmac
11:08 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
11:08 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
11:08 < krzee> you seem to have a problem with that
11:09 -!- JPeterso2 [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:11 -!- elly_ [~elly@april-fools/thewinningest/elly] has joined #openvpn
11:11 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 250 seconds]
11:11 -!- elly [~elly@april-fools/thewinningest/elly] has quit [Ping timeout: 250 seconds]
11:11 -!- JPeterso2 is now known as JPeterson
11:11 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:13 -!- Guifort [~Administr@149.238.86-79.rev.gaoland.net] has joined #openvpn
11:14 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 250 seconds]
11:15 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
11:16 -!- webmind [~webmind@yavin.puscii.nl] has quit [Ping timeout: 250 seconds]
11:16 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has quit [Ping timeout: 250 seconds]
11:16 -!- webmind [~webmind@yavin.puscii.nl] has joined #openvpn
11:17 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has joined #openvpn
11:17 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
11:20 -!- EugeneKay is now known as EugeneKaway
11:23 < gladiatr> krzee, re: route in ccd--true.  I get into the habit of considering the privilege context of when a command executes, so I don't tend to think of ccd as a server-related area.  good catch, though.
11:24 < krzee> thx
11:30 -!- polemon_ [mcp@polemon.org] has joined #openvpn
11:31 -!- gladiatr_ [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
11:32 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
11:32 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
11:33 -!- robotti^_ [robotti@kapsi.fi] has quit [Ping timeout: 250 seconds]
11:33 -!- polemon [mcp@polemon.org] has quit [Ping timeout: 250 seconds]
11:33 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 250 seconds]
11:33 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 250 seconds]
11:33 -!- gladiatr_ [~sdspence@160.15.124.24.cm.sunflower.com] has left #openvpn []
11:34 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:37 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 250 seconds]
11:45 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
11:45 -!- ele__ is now known as ele
11:46 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Ping timeout: 276 seconds]
11:47 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
11:48 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:50 -!- joren_ [~j@199.223.122.146] has joined #openvpn
11:50 -!- Netsplit *.net <-> *.split quits: blackpenguin, joren, _zero__
11:50 -!- Netsplit over, joins: blackpenguin
11:58 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Read error: Connection reset by peer]
11:59 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
12:02 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:04 -!- newmember [~chatzilla@209.82.97.21] has joined #openvpn
12:04 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:07 -!- EugeneKaway is now known as EugeneKay
12:08 -!- Guifort_1 [~Administr@ns208662.ovh.net] has joined #openvpn
12:11 -!- Guifort [~Administr@149.238.86-79.rev.gaoland.net] has quit [Ping timeout: 264 seconds]
12:14 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has quit [Ping timeout: 276 seconds]
12:15 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
12:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
12:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:20 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has joined #openvpn
12:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
12:31 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11012>
12:35 -!- gladiatr is now known as gladiatr_afk
12:41 -!- krphop_ is now known as krphop
12:48 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
12:49 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.4]
12:49 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
13:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
13:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 252 seconds]
13:07 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:12 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:23 -!- luneff [~yury@84.51.201.89] has joined #openvpn
13:27 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
13:31 -!- NoobSaibot [~NoobSaibo@rover-215-48.rovernet.mtu.edu] has quit [Quit: Leaving.]
13:33 -!- NoobSaibot [~NoobSaibo@rover-215-48.rovernet.mtu.edu] has joined #openvpn
13:34 -!- NoobSaibot [~NoobSaibo@rover-215-48.rovernet.mtu.edu] has left #openvpn []
13:35 -!- derRichard [~derRichar@ununbium.nod.at] has joined #openvpn
13:35 < derRichard> hi
13:35 < derRichard> !welcome
13:35 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:36 < derRichard> !/30
13:36 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
13:37 < krzee> hi
13:37 < krzee> !goal
13:37 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:37 < derRichard> i can only use 10.1.0.50-99 for my openvpn network. how can i tell openvpn this?
13:37 < derRichard> thus, the server has to be .50, not .1
13:40 < krzee> !learn xy as http://mywiki.wooledge.org/XyProblem -- "I want to do X, but I'm asking how to do Y..."
13:40 <@vpnHelper> Joo got it.
13:40 < krzee> tell your REAL goal please, not just what you think will solve it
13:40 < derRichard> are you talking to me?
13:41 < krzee> i am
13:41 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
13:41 -!- luneff [~yury@84.51.201.89] has joined #openvpn
13:42 < derRichard> i can't use 10.1.0.0/24 because 10.1.0.100-255 is used by the l2tpd, 10.1.0.50.1-49 is also used. so i have to use 10.1.0.50-99. how can i specify this in openvpn?
13:43 < krzee> umm
13:43 < krzee> why do you think it needs to be in the same subnet!?
13:43 < krzee> whats your REAL goal?
13:43 < derRichard> a fuck you
13:43 -!- derRichard [~derRichar@ununbium.nod.at] has left #openvpn []
13:43 < krzee> lol
13:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:44 < gladiatr_afk> kraut, awesome
13:45 < gladiatr_afk> er... krzee 
13:45 < krzee> its like theres been a steady stream of them man
13:45 -!- gladiatr_afk is now known as gladiatr
13:45 < krzee> lol
13:45 < gladiatr> indeed.  I think its the season
13:47 < krzee> welp, got my firewall rules on paper, time to translate them to a pf.conf
13:48 < krzee> (for the machine that acts as a gateway between the voip lan and the data lan)
13:48 < gladiatr> sweet.  I'm not the only one that still uses paper...
13:48 < gladiatr> besides as a posterior mechanical cleansing tool
13:48 < krzee> haha nah, it helps me get the thoughts out of my head so i can focus on the tech part
13:48 < gladiatr> indeed
13:48 < krzee> i sketch out parts of scripts on occasion too
13:49  * gladiatr exclaims, "dear god... and it draws pictures, too..."
13:55 < krzee> im making it so that certain machines will have optional multi-homing
13:56 < krzee> if they go down they will be able to simply change their gateway, and some creative routing games will take over ;]
13:57 < krzee> sure i could make it part of the real setup, automatic, but thats not what i want
13:57 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
13:57 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
13:57 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:04 < krzee> !pfnat
14:04 <@vpnHelper> "pfnat" is nat on <inf> from <subnet/ip> to <subnet/ip> -> <nat_ip>
14:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:05 < krzee> <-- cheater ;]
14:05 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:05 < krzee> oh i found the solution for derrichard
14:05 < krzee> [12:00]  <mercutioviz> step 1 - remove head from anal cavity...
14:05 < krzee> [12:01]  <krzee> step 2 - read this: http://mywiki.wooledge.org/XyProblem
14:05 < krzee> [12:01]  <krzee> step 3 - state the REAL goal
14:05 <@vpnHelper> Title: XyProblem - Greg's Wiki (at mywiki.wooledge.org)
14:17 <@vpnHelper> RSS Update - forum: OpenVPN over IPsec? <http://forums.openvpn.net/topic7903.html>
14:19 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:30 -!- Guifort_1 [~Administr@ns208662.ovh.net] has quit [Quit: Quitte]
14:37 -!- raba_ [~niki@188.134.18.243] has joined #openvpn
14:59 -!- raba_ [~niki@188.134.18.243] has quit [Quit: Ex-Chat]
14:59 -!- raba_ [~niki@188.134.18.243] has joined #openvpn
15:17 -!- EugeneKay is now known as EugeneKaway
15:18 < ecrist> !xy
15:18 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
15:20 < ecrist> the last example on that page is awesome
15:20 < ecrist> two pages of conversation to get to 'emerge -n *'
15:20 -!- EugeneKaway is now known as EugeneKay
15:27 < krzee> yep
15:27 < krzee> i thoroughly enjoyed their examples as well
15:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:46 -!- Guifort [~Administr@ns208662.ovh.net] has joined #openvpn
16:04 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 246 seconds]
16:05 -!- raba_ [~niki@188.134.18.243] has quit [Quit: Ex-Chat]
16:05 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 246 seconds]
16:05 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Ping timeout: 246 seconds]
16:05 <@vpnHelper> RSS Update - forum: error with creating a new vpn key <http://forums.openvpn.net/topic7904.html>
16:05 -!- dazo_afk [~dazo@nat/redhat/x-fcfmqpjttedejuin] has joined #openvpn
16:05 -!- dazo_afk [~dazo@nat/redhat/x-fcfmqpjttedejuin] has quit [Changing host]
16:05 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:05 -!- mode/#openvpn [+o dazo_afk] by ChanServ
16:05 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 246 seconds]
16:05 -!- Katoen [482392@xs8.xs4all.nl] has quit [Ping timeout: 246 seconds]
16:06 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has quit [Ping timeout: 246 seconds]
16:06 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 246 seconds]
16:06 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 246 seconds]
16:06 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Ping timeout: 246 seconds]
16:06 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Ping timeout: 258 seconds]
16:07 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
16:07 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has joined #openvpn
16:07 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
16:07 -!- Katoen [482392@xs8.xs4all.nl] has joined #openvpn
16:07 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
16:07 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
16:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:08 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
16:08 < fipu> hello!
16:08 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
16:09 < fipu> I use CCD and I push a route to a client. That works good on my linux client, but the windows client didn't get the route.
16:09 < fipu> What can be the problem?
16:09 < fipu> it is exactly the same CCD File as that from the working linux client.
16:09 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
16:10 < fipu> Hi Bushmills!
16:10 < fipu> can you help me with my problem please?
16:11 < mete> er isch ebe möngi! xD
16:11 -!- Guifort_1 [~Administr@78.123.161.223] has joined #openvpn
16:11 < fipu> xD
16:12 < fipu> mete: ja das hät öpis!
16:12 -!- Guifort [~Administr@ns208662.ovh.net] has quit [Ping timeout: 240 seconds]
16:15 -!- Guifort_1 [~Administr@78.123.161.223] has quit [Client Quit]
16:22 -!- newmember [~chatzilla@209.82.97.21] has quit [Ping timeout: 248 seconds]
16:32 -!- EugeneKay is now known as EugeneKaway
16:45 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Quit: FIN & ACK]
16:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
17:04 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
17:05 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:06 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
17:15 -!- mant1s [mant1s@141.114.212.208] has joined #openvpn
17:15 -!- mant1s [mant1s@141.114.212.208] has quit [Changing host]
17:15 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
17:18 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:23 < pwrcycle> what does this mean?: username/95.19.188.25:1194 MULTI: bad source address from client [10.9.0.2], packet dropped
17:23 < pwrcycle> using PAM
17:41 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:53 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
17:58 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
17:59 -!- star314 [~star314@starnet1.sinh.us] has quit [Client Quit]
17:59 < krzee> it means your client is sending 10.9.0.2 as its src address, but the openvpn server doesnt know wtf 10.9.0.2 is
18:31 < pwrcycle> krzee: in ifconfig i have: my tun1 has "inet addr:10.9.0.1  P-t-P:10.9.0.2  Mask:255.255.255.255"
18:33 < krzee> yep, on your server
18:33 < krzee> oh wait
18:33 < krzee> !configs
18:33 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
18:34 < pwrcycle> krzee: ok
18:34 < pwrcycle> !pb
18:34 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
18:37 < pwrcycle> fyi openvpn.pastebin.ca is down
18:38 < krzee> ya, i wonder if thats coming back or if i should remove it from the bot
18:40 < pwrcycle> krzee: http://pastebin.com/fWN8kij6
18:41 < pwrcycle> client is WinXP using openvpn client
18:41 < krzee> see how you did that, we should have you teach classes around here!
18:41 < krzee> =]
18:41 < krzee> ahh ok
18:41 < krzee> you had a ptp setup
18:42 < krzee> then you wanted to evolve it to a client/server setup
18:42 < krzee> am i right?
18:42 < pwrcycle> krzee: no, never had ptp
18:42 < krzee> erm
18:42 < pwrcycle> i used the static-key as the first setup
18:42 < krzee> ifconfig how you used it, and secret that you have commented IS ptp
18:42 < pwrcycle> unless that means just ptp
18:42 < krzee> static key only works in ptp ;]
18:43 < pwrcycle> ah, i see
18:43 < krzee> you're almost there =]
18:43 < pwrcycle> ok, so i wanted to go from static-key to just PAM
18:43 < krzee> remove lines 4 7 8 32
18:43 < krzee> and 30
18:43 < krzee> add this to the server
18:43 < krzee> server 10.9.0.0 255.255.255.0
18:44 < krzee> that should fix ya =]
18:46 < pwrcycle> krzee: thank you
18:46 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
18:46 < krzee> np
18:58 < |Mike|> jo krzee
18:59 < krzee> jojojo
18:59 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:59 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:59 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:09 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 260 seconds]
19:09 -!- takamichi [~pri@83.170.109.106] has joined #openvpn
19:15 -!- swills [~swills_@unaffiliated/steve/x-520345] has joined #openvpn
19:18 -!- takamichi [~pri@83.170.109.106] has quit [Ping timeout: 248 seconds]
19:18 -!- takamichi [~pri@ks357561.kimsufi.com] has joined #openvpn
19:19 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
19:20 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
19:23 -!- polemon_ is now known as polemon
19:28 -!- takamichi [~pri@ks357561.kimsufi.com] has quit [Ping timeout: 260 seconds]
19:28 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
19:40 -!- elly [~elly@april-fools/thewinningest/elly] has joined #openvpn
19:40 -!- elly_ [~elly@april-fools/thewinningest/elly] has quit [Ping timeout: 248 seconds]
19:40 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 248 seconds]
19:41 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
19:41 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 248 seconds]
19:44 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
19:48 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
19:48 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
19:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:50 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
20:03 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
20:05 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 258 seconds]
20:05 -!- newmember_ is now known as newmember
20:08 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
20:14 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
20:16 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
20:16 -!- Nowak [nowak@worldwind/developer/Nowak] has quit [Ping timeout: 276 seconds]
20:16 -!- Nowak_ [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
20:17 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 276 seconds]
20:17 -!- wolfric_ [~wolfric@pdpc/supporter/student/wolfric] has quit [Ping timeout: 276 seconds]
20:18 -!- wolfric [~wolfric@84-203-76-11.mysmart.ie] has joined #openvpn
20:18 -!- wolfric [~wolfric@84-203-76-11.mysmart.ie] has quit [Changing host]
20:18 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has joined #openvpn
20:18 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:26 -!- krzii [krzee@hemp.ircpimps.org] has joined #openvpn
20:27 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
20:29 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
20:29 -!- mode/#openvpn [+o vpnHelper] by ChanServ
20:29 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
20:33 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
20:33 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
20:33 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has quit [Ping timeout: 240 seconds]
20:34 -!- swills [~swills_@unaffiliated/steve/x-520345] has quit [Ping timeout: 240 seconds]
20:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
20:34 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:35 -!- wolfric [~wolfric@84-203-76-11.mysmart.ie] has joined #openvpn
20:35 -!- wolfric [~wolfric@84-203-76-11.mysmart.ie] has quit [Changing host]
20:35 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has joined #openvpn
20:48 -!- JoeyJoeJo [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
20:48 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
20:52 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 248 seconds]
20:53 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 248 seconds]
20:54 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
20:56 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
21:08 -!- mansauce [~mant1s@jcon.ums.maine.edu] has joined #openvpn
21:08 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
21:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
21:12 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
21:13 -!- mansauce [~mant1s@jcon.ums.maine.edu] has quit [Client Quit]
21:13 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 248 seconds]
21:20 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
21:20 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
21:20 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:57 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
21:57 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:12 -!- master_of_master [~master_of@p57B574FC.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
22:14 -!- master_of_master [~master_of@p57B57083.dip.t-dialin.net] has joined #openvpn
22:25 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
22:28 -!- polemon [mcp@polemon.org] has quit [Ping timeout: 260 seconds]
22:28 -!- krzii [krzee@hemp.ircpimps.org] has left #openvpn ["Leaving"]
22:29 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
22:29 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
22:29 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
22:29 -!- krzee [krzee@openvpn/community/support/krzee] has left #openvpn []
22:29 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
22:37 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:39 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
22:39 -!- newmember_ is now known as newmember
22:57 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:58 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
23:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:57 -!- echoSMIL1 [~censured@bl16-211-171.dsl.telepac.pt] has quit [Ping timeout: 252 seconds]
23:59 -!- echoSMILE [~censured@bl17-78-51.dsl.telepac.pt] has joined #openvpn
23:59 -!- echoSMILE [~censured@bl17-78-51.dsl.telepac.pt] has quit [Changing host]
23:59 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
--- Day changed Wed Apr 06 2011
00:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
00:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 248 seconds]
00:16 -!- cron2_ [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 276 seconds]
00:16 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
00:34 -!- EugeneKaway is now known as EugeneKay
00:34 <@vpnHelper> RSS Update - forum: VPN connects, Ping works but nothing else <http://forums.openvpn.net/topic7878.html#p11015>
00:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: No route to host]
00:55 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:03 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 259 seconds]
01:06 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:07 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:30 <@vpnHelper> RSS Update - forum: client connected to server but can't ping <http://forums.openvpn.net/topic7902.html#p11016>
01:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:33 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:36 <@vpnHelper> RSS Update - forum: error with creating a new vpn key <http://forums.openvpn.net/topic7904.html#p11017>
01:43 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
02:08 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
02:18 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11018>
02:24 <@vpnHelper> RSS Update - forum: VPN connects, Ping works but nothing else <http://forums.openvpn.net/topic7878.html#p11020> || OpenVPN over IPsec? <http://forums.openvpn.net/topic7903.html#p11019>
02:25 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:43 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
02:56 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
03:07 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
03:10 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:10 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:12 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
03:14 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:25 -!- patelx [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
03:26 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Ping timeout: 276 seconds]
03:29 -!- patelx [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Ping timeout: 276 seconds]
03:36 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
03:46 -!- stephan_ [~stephan@i59F49489.versanet.de] has joined #openvpn
03:46 < stephan_> Good Morning
03:46 < Mirrakor> morniung
03:52 < stephan_> the keep-alive option does not get passed if i use a ccd base config
03:53 < stephan_> if i define ping and ping-restart in ccd conf, the option is pushed
03:55 < stephan_> if i use keepalive in a ccd conf, openvpn says option ignored
03:56 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Quit: ph1l]
03:56 < stephan_> i know keepalive i a macro. but it should work in ccd the same as without ccd based config, should it not?
04:02 -!- Guifort [~Administr@78.123.161.223] has joined #openvpn
04:22 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:31 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: No route to host]
04:35 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:42 <@vpnHelper> RSS Update - forum: How do I connect to PC while it is running in client mode? <http://forums.openvpn.net/topic7869.html#p11021>
04:45 -!- luneff [~yury@84.51.201.89] has joined #openvpn
04:54 <@vpnHelper> RSS Update - forum: client connected to server but can't ping <http://forums.openvpn.net/topic7902.html#p11022>
05:00 <@vpnHelper> RSS Update - forum: OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html#p11023>
05:03 -!- stephan_ [~stephan@i59F49489.versanet.de] has quit [Quit: leaving]
05:03 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
05:20 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
05:20 < gabrielcz> Hello all there...
05:21 < toortog> morning
05:21 < gabrielcz> question... (im pastebin things..) ;)
05:21 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 276 seconds]
05:22 < gabrielcz> https://gist.github.com/f9448b6c9a2120cf325d
05:22 <@vpnHelper> Title: 's gist: f9448b6c9a2120cf325d Gist (at gist.github.com)
05:22 < gabrielcz> I can connect to my recent installed openvpn 
05:22 < gabrielcz> at home: 192.168.1.x subnet
05:22 < gabrielcz> at office: 192.168.1.x subnet
05:23 < gabrielcz> now, Im connecting to openvon server, and I get on client machine, a ip as 10.6.0.x 
05:23 < gabrielcz> My question is, what i need to change? 
05:23 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
05:24 < toortog> nothing, can you ping the other subnets?
05:24 < gabrielcz> I want:  at office: openvon server: 192.168.1.60 and a web server: 192.168.1.107
05:24 < gabrielcz> I want to conect from home to office, and access web server
05:24 < gabrielcz> yes
05:24 < gabrielcz> but the other subnet is 10.6.0.x ????
05:24 < toortog> yes thats your vpn tunnel
05:24 < gabrielcz> and my web server at office is 192.168.1.107
05:25 < gabrielcz> but, if I ping 192.168.1.107 i dont get pong ;)
05:25 < toortog> try [2.0-RC1][admin@vpnx202.dyndns.org]/root(9): uname -imnprs
05:25 < toortog> FreeBSD vpnx202.dyndns.org 8.1-RELEASE-p2 i386 i386 pfSense8
05:25 < toortog> whoops
05:25 < toortog> sorry wrong thing
05:26 < gabrielcz> https://gist.github.com/692499e10c433e146137   <---  ifconfig from my CLIENT 
05:26 <@vpnHelper> Title: 's gist: 692499e10c433e146137 Gist (at gist.github.com)
05:26 < gabrielcz> ;) no prob
05:27 < toortog> push "route 192.168.1.0 255.255.255.0"
05:27 < toortog> add that to the server config
05:27 < gabrielcz> on my server.conf I have: push "route 192.168.0.0 255.255.255.0" 
05:28 < toortog> yes but you are trying 1.0 not 0.0
05:28 < gabrielcz> I need to replace that line? (i have not network 192.168.0 
05:28 < toortog> correct
05:28 < gabrielcz> mine is 1 (like you are telling me now)
05:28 < gabrielcz> ok, undestood
05:28 < gabrielcz> will do it
05:29 < gabrielcz> restart openvpn is needed?
05:29 < gabrielcz> what is mean this line: push "redirect-gateway def1" ?
05:30 < toortog> redirects clients to the vpn server gateway
05:30 -!- gabrielcz [~gabrielcz@190.190.32.110] has quit [Read error: Connection reset by peer]
05:30 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
05:30 < gabrielcz> gabrielcz@YOnet:/etc/openvpn$ ping 192.168.1.107
05:30 < gabrielcz> PING 192.168.1.107 (192.168.1.107) 56(84) bytes of data.
05:30 < gabrielcz> 64 bytes from 192.168.1.107: icmp_seq=1 ttl=64 time=0.357 ms
05:30 < gabrielcz> 64 bytes from 192.168.1.107: icmp_seq=2 ttl=64 time=0.310 ms
05:30 < gabrielcz> DUDE, thanks you
05:30 < gabrielcz> is working :)
05:30 < toortog> :]
05:30 < gabrielcz> but I get a disconnection yet
05:31 < gabrielcz> maybe, that line I tells you...
05:31 < gabrielcz> send my internet traffic from von too?
05:31 < toortog> redirect-gateway is just that it redirects your traffic to vpn tunnel
05:31 < gabrielcz> Mmmmm 
05:32 < gabrielcz> now, at home, im browsing internet using ip from office... 
05:32 < gabrielcz> is that rigth? 
05:32 < toortog> yes
05:32 < gabrielcz> perfect.
05:32 < gabrielcz> Im happy
05:33 < gabrielcz> hosts file: go hell :D jejejejeje  (editing al time if Im on LAN or outside lan) jejejeje
05:33 < gabrielcz> toortog: LAST ONE I promess ! :)
05:33 < gabrielcz> can I?
05:33 < toortog> sure i got 10 min till work
05:34 < gabrielcz> thanks.
05:34 < gabrielcz> this is great, what I need...
05:34 < gabrielcz> but...
05:34 < gabrielcz> are you from us?
05:34 < toortog> yes
05:35 < gabrielcz> well, in my country, i cant not get netflix
05:35 < gabrielcz> I have a box on US
05:35 < gabrielcz> can I put like a VPN without encryptation, to simulate a US ip 
05:35 < gabrielcz> and see movies on netflix?
05:35 < gabrielcz> or is better and faster to use a proxy?
05:36 < toortog> dont see why not, just need the bandwith
05:36 < gabrielcz> do you use neflix?
05:36 < toortog> nope
05:36 < gabrielcz> but... 
05:36 < toortog> im a sirius/xm guy i love music
05:37 < gabrielcz> what is faster, a proxy or a vpn whitout cryph...?
05:37 < toortog> its all about the server it will be hosted on you need cpu space
05:37 < gabrielcz> well, thats rigth
05:38 < gabrielcz> i will take a look.
05:38 < gabrielcz> as I say, thanks you.
05:38 < toortog> good luck
05:39 -!- gabrielcz [~gabrielcz@190.190.32.110] has left #openvpn []
05:48 -!- gabrielc_ [~gabrielcz@190.190.32.110] has joined #openvpn
05:48 < gabrielc_> hi again
05:49 < gabrielc_> I think, having same subnet at office and at home, vpn gets a little crazy pherhaps?
05:54 -!- gabrielcz [~gabrielcz@190.246.212.171] has joined #openvpn
05:54 < gabrielcz> anyone is here?
05:55 -!- gabrielc_ [~gabrielcz@190.190.32.110] has quit [Ping timeout: 240 seconds]
05:56 -!- python [~~udav@111-97-202-46.pool.ukrtel.net] has joined #openvpn
05:57 < python> !goal
05:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:57 < gabrielcz> !vpn
05:57 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
05:57 < gabrielcz> nice ! 
05:57 < gabrielcz> !nat
05:57 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
05:58 < gabrielcz> !subnet
05:58 <@vpnHelper> "subnet" is http://www.subnet-calculator.com/ or http://en.wikipedia.org/wiki/Subnetwork
05:58 < gabrielcz> no no no!!!    
05:58 < gabrielcz> ;) 
05:59 < gabrielcz> I want to know, if having same subnet at office than home is why Im getting problems on connects/disconnects to vpn server! ;)  !iLikeMyStyle 
06:01 < python> U should read the man
06:02 < gabrielcz> of openvpn ?
06:02 < python> yes
06:02 < gabrielcz> hooo
06:02 <@vpnHelper> RSS Update - forum: OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html#p11024>
06:02 < gabrielcz> thanks you.
06:04 -!- batrick [~batrick@nmap/developer/batrick] has quit [Ping timeout: 248 seconds]
06:06 -!- ph1l [~ph1l@gprs07.swisscom-mobile.ch] has joined #openvpn
06:06 -!- python [~~udav@111-97-202-46.pool.ukrtel.net] has quit [Quit: âèðíóñü êàäà óëóòüøûòüñÿ íîñòðîåíèå]
06:08 <@vpnHelper> RSS Update - forum: client connected to server but can't ping <http://forums.openvpn.net/topic7902.html#p11025>
06:16 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 248 seconds]
06:16 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
06:19 -!- ph1l [~ph1l@gprs07.swisscom-mobile.ch] has quit [Quit: ph1l]
06:20 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
06:29 -!- gabrielcz [~gabrielcz@190.246.212.171] has quit [Ping timeout: 276 seconds]
06:29 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
06:31 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
06:31 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
06:31 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
06:32 <@vpnHelper> RSS Update - forum: Windows route add command failed <http://forums.openvpn.net/topic7901.html#p11026>
06:38 <@vpnHelper> RSS Update - forum: Windows route add command failed <http://forums.openvpn.net/topic7901.html#p11027>
06:41 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Ping timeout: 240 seconds]
06:47 -!- ph1l [~ph1l@gprs25.swisscom-mobile.ch] has joined #openvpn
06:50 -!- gabrielcz [~gabrielcz@190.190.32.110] has quit [Ping timeout: 276 seconds]
06:53 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
06:56 <@vpnHelper> RSS Update - forum: Windows route add command failed <http://forums.openvpn.net/topic7901.html#p11028>
07:00 -!- ph1l [~ph1l@gprs25.swisscom-mobile.ch] has quit [Quit: ph1l]
07:02 <@vpnHelper> RSS Update - forum: client connected to server but can't ping <http://forums.openvpn.net/topic7902.html#p11029>
07:08 -!- luneff [~yury@84.51.201.89] has quit [Read error: Connection reset by peer]
07:08 <@vpnHelper> RSS Update - forum: SQL server only visible when firewall rule set to public <http://forums.openvpn.net/topic7905.html#p11032> || Windows route add command failed <http://forums.openvpn.net/topic7901.html#p11031>
07:09 < gabrielcz> Hello... little question, anyone ?
07:09 < janjust> hi gabrielcz 
07:09 < gabrielcz> Hi janjust
07:10 < gabrielcz> thanks for responce.
07:10 < gabrielcz> i have a problem.
07:10 < janjust> little questions often require big answers, but go ahead and ask 
07:10 < gabrielcz> In have a openvpn server on ubuntu 10.
07:10 < gabrielcz> OFFICE: openvpn server.
07:10 < gabrielcz> HOME: vpn Client
07:10 < gabrielcz> OFFICE: subnet: 192.168.1.x
07:11 < gabrielcz> HOME: subnet: 192.168.1.x
07:11 < gabrielcz> I can connect from home to office
07:11 < gabrielcz> I get on client my 10.0.6.x ip from vpn
07:12 < gabrielcz> questions: is there a problem to have SAME subnets on office/home?
07:12 < janjust> in general : YES ; don't try to do this unless you know what you're doing
07:12 < Bushmills> unless you want to access LAN hosts behind vpn, no
07:12 < gabrielcz> https://gist.github.com/66c9f47c19a9a05facd7  <---  there you have server.conf 
07:12 <@vpnHelper> Title: 's gist: 66c9f47c19a9a05facd7 Gist (at gist.github.com)
07:13 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has joined #openvpn
07:13 <@vpnHelper> RSS Update - forum: client connected to server but can't ping <http://forums.openvpn.net/topic7902.html#p11033>
07:13 < gabrielcz> I can connect to server
07:13 < janjust> gabrielcz:  you're doing a push route and a push redirect-gateway ; that is bound to give you problems if you have the same subnet at home as at work
07:13 < gabrielcz> Mmmm 
07:13 < gabrielcz> undestood
07:14 < gabrielcz> solution? change pherhaps subnet at home?
07:14 < Bushmills> !goals
07:14 < Bushmills> !goal
07:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:14 < janjust> it depends on what you want to do , gabrielcz ; if you don't know access to the LAN behind the openvpn server then you don't need to change it
07:15 < janjust> if you want to redirect all traffic via the VPN then I'd advise to change the home network range
07:16 < gabrielcz> I think I need to redirect all traffic from home using vpn....   (so, I will solve my problem changing subnet at home rigth?)
07:16 < janjust> it will solve the subnet mismatch issue, yes
07:16 < janjust> it does not necessarily mean that "redirect-gateway" will work straight away
07:16 < janjust> are you using natting/masquerading on the openvpn server?
07:17 < gabrielcz> janjust: Really, I need to access to web server (other than openvpn server, and on SAME LAN)
07:17 < janjust> then change your home network, don't use 'redirect-gateway' and add an iptables rule to the vpn server 'iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE'
07:17 < gabrielcz> no masquerading... no iptables, just my dsl router doing nat to openvpn udp/tcp port
07:18 < gabrielcz> what is mean "redirect-gateway"? 
07:18 < janjust> this is on the server side - will your office web server know about your 10.0.6/24 network?
07:18 < janjust> !redirect-gateway
07:18 < janjust> !routing
07:18 < Bushmills> !route
07:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
07:18 < gabrielcz> no, office webserver is on 192.168.1.107  and openvpn server: 192.168.1.60
07:19 < Bushmills> !redirect
07:19 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
07:19 < janjust> then either add a static route on your office webserver or use masquerading on the openvpn server, gabrielcz 
07:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
07:20 < gabrielcz> janjust: if: redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway  
07:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
07:20 < gabrielcz> you think i DONT need redirect-gateway?
07:21 < janjust> gabrielcz:  if the only host that you want to access is the company web server @ 192.168.1.107 then yes, you DON'T need redirect-gateway
07:21 < gabrielcz> haaaa
07:21 < gabrielcz> ok ok ok 
07:22 < janjust> but in that case you DO need 'push "route 192.168.1.0 255.255.255.0"'
07:22 < gabrielcz> No, I want to move free on LAN OFFICE so...
07:22 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
07:22 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
07:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
07:22 < gabrielcz> I need to quit that redirect-gateway line
07:22 < gabrielcz> and ADD a rule on iptables like: iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE   <--- CORRECT?
07:23 < janjust> on the openvpn server, yes (provided that 'eth0' is the interface which is connected to your server-side LAN)
07:23 <@vpnHelper> RSS Update - forum: Windows route add command failed <http://forums.openvpn.net/topic7901.html#p11035>
07:24 < gabrielcz> iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE  <-- can I put it on server.conf of openvpn file? 
07:24 < gabrielcz> or I need to run it pherhaps at server startup?
07:24 < janjust> gabrielcz:  nope ; this is a system setting that needs to go into the appropriate place
07:24 < gabrielcz> ok.
07:24 < gabrielcz> undestand... 
07:24 < gabrielcz> pherhaps, on rc.local script? 
07:24 < janjust> don't know what the 'appropriate place' is on ubuntu but it has little to do with openvpn itself
07:25 < gabrielcz> ok ok ok.
07:25 < gabrielcz> I will quit redirect-gateway line
07:25 < janjust> that's an option ; I assume ubuntu has a default location for its firewall/iptables rules
07:25 < gabrielcz> and RUN: iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE  
07:25 < gabrielcz> if it works, I look at "apropiate place" ;)
07:25 < janjust> sounds like a plan
07:26 < gabrielcz> haaa...
07:27 < gabrielcz> and also i need to change home subnet rigth?
07:29 -!- gabrielcz [~gabrielcz@190.190.32.110] has quit [Read error: Connection reset by peer]
07:29 -!- MrCerulean [~Adium@115.78.234.187] has joined #openvpn
07:30 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
07:30 < gabrielcz> well
07:30 < gabrielcz> it is working
07:30 < MrCerulean> I'm having a problem routing an entire network.
07:30 < MrCerulean> I have OpenVPN running on dd-wrt.
07:30 < MrCerulean> The client is connecting to the server.
07:30 < MrCerulean> I can ping the gateway interface on the server.
07:30 < MrCerulean> But I can't go through to the internet on the other side.
07:30 < gabrielcz> janjust: is working, but its start working withOUT iptables line
07:32 < MrCerulean> I've made sure I've added the necessary routes (or I wouldn't be able to ping), and I've added masquerading in iptables.
07:33 < MrCerulean> I can connect with individual client machines, and that works.
07:33 < gabrielcz> janjust: THANKS YOU DUDE, you solve my problem !!!!!!!!!!!!!!!!!  I will do last cheks
07:33 < MrCerulean> But when I connect the router, I can't seem to route the whole network.
07:33 < gabrielcz> back..
07:34 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has joined #openvpn
07:35 -!- gabrielcz [~gabrielcz@190.190.32.110] has quit [Read error: No route to host]
07:37 < janjust> excellent news, gabrielcz_ 
07:38 < janjust> MrCerulean:  the dd-wrt box is the client?
07:38 < MrCerulean> Yes.
07:38 < MrCerulean> The server is running CentOS 5.5
07:38 < MrCerulean> fwiw
07:39 < janjust> so you want to do net-to-net routing, right?
07:39 < janjust> i.e. connect a subnet behind the vpn client to the vpn server
07:39 < janjust> in that case, read the 'expanding the scope` section in the openvpn HOWTO
07:39 < MrCerulean> Thanks.
07:39 < janjust> http://openvpn.net/index.php/open-source/documentation/howto.html#scope
07:39 <@vpnHelper> Title: HOWTO (at openvpn.net)
07:41 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has quit [Ping timeout: 246 seconds]
07:41 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
07:47 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:50 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has joined #openvpn
07:51 -!- gabrielcz [~gabrielcz@190.190.32.110] has quit [Ping timeout: 240 seconds]
07:54 -!- MrCerulean [~Adium@115.78.234.187] has quit [Quit: Leaving.]
07:59 <@vpnHelper> RSS Update - forum: SQL server only visible when firewall rule set to public <http://forums.openvpn.net/topic7905.html#p11036>
08:02 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
08:09 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:09 -!- Guifort [~Administr@78.123.161.223] has quit [Ping timeout: 276 seconds]
08:11 -!- Nowak_ [nowak@warsaw.freeearthfoundation.com] has quit [Changing host]
08:11 -!- Nowak_ [nowak@worldwind/developer/Nowak] has joined #openvpn
08:11 -!- Nowak_ is now known as Nowak
08:23 <@vpnHelper> RSS Update - forum: Can't connect Clients!!!! <http://forums.openvpn.net/topic7898.html#p11037>
08:28 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
08:47 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
08:47 < Cubox> !welcome
08:47 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:48 < Cubox> !howto
08:48 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:49 -!- Galaxor [~rjhughes@zaxxon.gpcc.itd.umich.edu] has joined #openvpn
08:51 < Galaxor> Hi.  So, I've got my home network on 10.2.0.0/24.  My vpn is 10.2.90.0/24.  I want things on the vpn to be able to access things at my house, so I pushed the route 10.2.0.0/24 to my vpn clients.  I'm still unable to access things at my house from the vpn.  I suspect it's because things at my house have no route to 10.2.90.0/24.
08:52 < Galaxor> So on one of my machines at home, I did route add -net 10.2.90.0/24 gw 10.2.0.1 (10.2.0.1 is the house router and also the vpn server).
08:53 < Galaxor> I'm still not able to get out.  Do I need some firewall rules on the router too?  Or what am I doing wrong?
08:53 < Cubox> hello, i have do modprob tun but in ifconfig i don't have a new interface called "tun" ... How to do ?
08:55 < Galaxor> Cubox: openvpn will create the interface when you start it up.
08:55 < Galaxor> Cubox: It should create a tun interface on the server and on the client.
08:55 < Cubox> mmh ...
08:55 < Cubox> Because openvpn fail i i dont find the logs u_u
08:57 < Galaxor> Cubox: Start openvpn server with a higher debugging level, and start it in the foreground.  openvpn --config /path/to/file.conf --verb 9
08:58 < Galaxor> Cubox: Then you'll see the log on stdout.
08:58 < Cubox> installed on deamon mode
09:00 < Galaxor> Cubox: If you start it by hand and don't specify --daemon, then it should start in the foreground.
09:00 < Cubox> How to start it by hand ? ( I have installed with apt-get on ubuntu )
09:01 < Galaxor> Cubox: Stop the daemon with /etc/init.d/openvpn stop
09:01 < Galaxor> Cubox: Then start it with the comand line I gave above.
09:01 < Cubox> Ok
09:01 < Galaxor> Cubox: btw, I'm using it in ubuntu and the logs are in /var/log/daemon.log
09:02 < Cubox> [root@e-noob:/etc/openvpn]# openvpn --verb 9
09:02 < Cubox> Options error: You must define TUN/TAP device (--dev)
09:02 < Cubox> Apr  6 15:44:51 e-noob ovpn-server[7249]: Cannot load certificate file /etc/openvpn/easy-rsa/2.0/keys/server.crt: error:02001002:system library:fopen:No such file or directory: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib
09:02 < Cubox> mmh ...
09:02 < Galaxor> Cubox: Don't forget to load the config with --config /path/to/config
09:02 < Cubox> the last error is on daemon mode
09:03 < Galaxor> Did you create the server cert and key?  Does that server.crt file exist?
09:04 < Cubox> I have fix this
09:04 < Cubox> Now ... it's launch
09:05 < Galaxor> excellent.
09:05 < Cubox> :D
09:07 < Cubox> mmh ... Now ... how to copy the cert file ? I have disabled root ... u_u
09:08 < hyper_ch> Cubox: no sudo?
09:09 < Cubox> hyper_ch: yes but ... have to do 8 cp
09:09 < hyper_ch> sudo -i
09:09 < hyper_ch> that will give you root until you exit
09:09 < Cubox> i know ( i use su )
09:10 < hyper_ch> su is evil
09:10 < hyper_ch> sudo -i is not evil
09:10 < Cubox> :D
09:10 < Galaxor> hyper_ch: ooh, I didn't know about sudo -i.  I've always done sudo su.
09:10 < hyper_ch> :)
09:10 < hyper_ch> Galaxor: one of the first things I learnt in *buntu is sudo -i
09:11 < Galaxor> People have such strong opinions on the topic of sudo.
09:11 < hyper_ch> Galaxor: don't know what difference it makes whether you use sudo su or sudo -i
09:11 < hyper_ch> sudo enables me to use root access with key login only
09:11 < hyper_ch> so I like it
09:11 < Galaxor> Ah, that is nice.
09:12 < hyper_ch> well, for backups I can use keyfiles for login that way
09:12 < hyper_ch> and when I need to do something myself, I just sudo -i
09:13 < hyper_ch> I tend to think it makes it a bit more secure as not only a password has to be guess but also username
09:17 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:19 < Cubox> !redirect
09:19 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
09:20 < Cubox> !def1
09:20 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
09:21 < Galaxor> So, I suspect that I have to do something with my firewall, but I'm not sure what.
09:21 <@vpnHelper> RSS Update - forum: SQL server only visible when firewall rule set to public <http://forums.openvpn.net/topic7905.html#p11038>
09:21 < Galaxor> (I'm not that good at firewalls)
09:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
09:26 < Cubox> Network redirectong is not working u_u The internet traffic go to the server ( This is a screen with the server ) but internet dont ping ...
09:27 < Cubox> i have add the iptables rule
09:29 < Cubox> I have : eth0      Link encap:Ethernet  HWaddr 00:1c:14:01:0c:d7  
09:29 < Cubox>           inet adr:78.47.163.170  Bcast:78.47.163.175  Masque:255.255.255.240
09:29 < Cubox> and : tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
09:29 < Cubox>           inet adr:10.8.0.1  P-t-P:10.8.0.2  Masque:255.255.255.255
09:31 < gladiatr> Cubox, do you currently have an iptables rule set that functions for you w/out the vpn network?
09:32 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
09:32 < Cubox> Now yes but if you give a new rule a can flush the rule for add the new
09:33 < Cubox> And server 10.8.0.0 255.255.255.0
09:33 < gladiatr> cubox, have you tried adding any vpn-related iptables rules yet?
09:34 < Cubox> I have tried but ... don't work
09:34 < Cubox> I have flushed iptables
09:34 < gabrielcz_> Hello all there... 
09:34 < gladiatr> gabrielcz_, hello
09:35 < Cubox> hello gabrielcz_ 
09:35 < gabrielcz_>  tun0: Disabled Privacy Extensions  <-- it means something t anyone? (i cant connect)
09:35 < gabrielcz_> hi Cubox and gladiatr
09:36 < gabrielcz_> that message i get it from /var/log/daemon on ubuntu.
09:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:39 < gladiatr> cubox, make sure the following is in /etc/sysctl.conf:  net.ipv4.ip_forward = 1
09:39 < gladiatr> cubox, what version of linux are you using?
09:42 < gladiatr> you need to attach something like the following line to the postrouting chain of your nat table: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
09:43 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900-15.html#p11040> || OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html#p11039>
09:43 < gladiatr> If you're using centos or some other rhel5 derivative, their default iptables file redirects everything to a RH-Firewall-1-INPUT chain, but the syntax of the rule is the same
09:47 < gabrielcz_> any clue?
09:48 < gabrielcz_> SIGUSR1[soft,connection-reset] received, client-instance restarting   I get this when I try to connect
09:48 < gabrielcz_> and vpn client keep "connecting..." 
09:48 < Cubox> gladiatr: i look
09:48 < gabrielcz_> and never ends
09:49 < Cubox> net.ipv4.ip_forward=1
09:49 < gladiatr> gabrielcz_, what version of ubuntu? (and what version of openvpn?)
09:49 < Cubox> [root@e-noob:/etc/openvpn]# uname -a
09:49 < Cubox> Linux e-noob 2.6.35-22-server #35-Ubuntu SMP Sat Oct 16 22:02:33 UTC 2010 x86_64 GNU/Linux
09:49 < gabrielcz_> Ubuntu 8.04.3 LTS \n \l
09:49 < gabrielcz_> Linux cultura 2.6.24-26-generic #1 SMP Tue Dec 1 18:37:31 UTC 2009 i686 GNU/Linux
09:50 < gabrielcz_> OpenVPN 2.1_rc7 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Dec 15 2010
09:50 < gladiatr> what's the output of: openvpn --version
09:50 < gladiatr> ah
09:50 < gladiatr> ty
09:50 < gabrielcz_> ;)
09:50 < gladiatr> and this is a client system?
09:50 < gabrielcz_> https://gist.github.com/2886b646de0d08fd10a8 <---  my server.conf file
09:50 <@vpnHelper> Title: 's gist: 2886b646de0d08fd10a8 Gist (at gist.github.com)
09:51 < Cubox> gladiatr: can you give me the exact iptables command ?
09:51 < gladiatr> Cubox, I did
09:51 < Cubox> mmh ...
09:51 < Cubox> Ok
09:51 < Cubox> No, google.com don't ping
09:52 < gladiatr> Cubox, you have to NAT your client connection.  If you send packets from the 10.8.0.0/24 network out to your ISP, they'll just throw them away
09:52 < gladiatr> gabrielcz_, are you getting the tun0 error on your client system or on the server?
09:52 < gabrielcz_> on /var/log/daemon log on SERVER 
09:52 < Cubox> gladiatr: i don't understand
09:53 < gabrielcz_> gladiatr: do you want to finish with Cubox...
09:53 < gabrielcz_> if you have time, I can whait for...
09:54 < gabrielcz_> gladiatr: I setup TODAY two openvpn servers. one on 10.4 and this one on 8.04 
09:54 < gabrielcz_> the 10.4 vpnservers works PERFECT
09:55 < gabrielcz_> I did the same on 8.04 
09:55 < Cubox> mmh ... only traffic to the server pass to the vps, internet is not natted
09:55 < gabrielcz_> and I get that error i paste to you
09:55 < Cubox> vpn *
09:55 < gabrielcz_> and WHEN client try to connect, I get the other error y paste to you.
09:57 < gladiatr> gabrielcz_, set "verb 4" in your server config and restart your server process--then pastebin the log from your startup
09:57 < gabrielcz_> ok
09:57 < gladiatr> Not a huge fan of using ubuntu as a server platform, but it is what it is... should still work
09:58 < gladiatr> !nat
09:58 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
09:59 < gladiatr> !linnat
09:59 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
09:59 < gladiatr> ^^ Cubox
09:59 < gabrielcz_> https://gist.github.com/fd04c9552c8c98b42035 <--  DONE: here you have LOG on STARTUP 
09:59 <@vpnHelper> Title: 's gist: fd04c9552c8c98b42035 Gist (at gist.github.com)
10:00 < gabrielcz_> and these lines at very TOP: 
10:00 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900-15.html#p11041>
10:00 < gabrielcz_> Apr  6 16:58:43 cultura ovpn-server[10171]: 190.246.212.171:54553 Connection reset, restarting [0]
10:00 < gabrielcz_> Apr  6 16:58:43 cultura ovpn-server[10171]: 190.246.212.171:54553 SIGUSR1[soft,connection-reset] received, client-instance restarting
10:00 < gabrielcz_> Apr  6 16:58:43 cultura ovpn-server[10171]: TCP/UDP: Closing socket
10:00 < Cubox> i have do all ...
10:00 < gabrielcz_> gladiatr: https://gist.github.com/fd04c9552c8c98b42035 <--  DONE: here you have LOG on STARTUP
10:00 <@vpnHelper> Title: 's gist: fd04c9552c8c98b42035 Gist (at gist.github.com)
10:01 < janjust> gabrielcz_:  a connection reset means that either the client decided to drop the connection (which is logged in the client log file) or some intermediary firewall decided to drop it
10:02 < gladiatr> janjust, you don't think it has anything to do with the log message re: tun0?
10:03 < janjust> the privacy extension thing? nah I've seen that message too many times :)
10:03 < gladiatr> oh, sweet.
10:03 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has left #openvpn ["Leaving"]
10:03 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:03 < gabrielcz_> MMmm  janjust can I do a iptables stop?
10:03 < gladiatr> gabrielcz_, I was just gonna say that your config looks fine and your log files don't show anything anomalous
10:03 < janjust> depends on your current iptables, gabrielcz_ 
10:03 < gabrielcz_> Im pretty sure I have no firewall, and no iptables
10:03 < gabrielcz_> but, to be sure...
10:04 < janjust> yes, but I've done things like 'iptables -F' only to be kicked out of the machine altogether (turned out the default policy was 'DROP' )
10:04 < janjust> what does the client log show when you're trying to connect, gabrielcz_ ?
10:05 < gabrielcz_> janjust: dont know !!  I will see it.. I need to found log first 
10:05 -!- pmatulis_ [~peter@64.34.151.178] has joined #openvpn
10:05 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900-15.html#p11042>
10:05 < gabrielcz_> janjust: how can i stop iptables to be sure?
10:05 < janjust> on ubuntu? no idea :S ... I'd do a '/etc/init.d/iptables stop'  on centos/fedora
10:07 < gabrielcz_> https://gist.github.com/278b036599f3b26cbf2e  <---  my iptables -L ouput i think I have no iptables problem, what you think?
10:07 <@vpnHelper> Title: 's gist: 278b036599f3b26cbf2e Gist (at gist.github.com)
10:07 < gabrielcz_> (will see log on client)
10:08 < janjust> gabrielcz_:  also check 'iptables -t nat -L -n -v'
10:08 < gabrielcz_> https://gist.github.com/a7ce0900bd1ab7900067  <---  iptables -t nat -L -n -v
10:08 <@vpnHelper> Title: 's gist: a7ce0900bd1ab7900067 Gist (at gist.github.com)
10:09 < janjust> aha so you're masquerading all traffic that is leaving 'eth0' which has source address 10.6.0.0/24 : that is your VPN IP range, right?
10:11 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900-15.html#p11044>
10:12 < gabrielcz_> https://gist.github.com/213653d1dc81ce232b84  <---  outout vpn CLIENT (I think can you see someting here...)  handshake and more things...  jejeje
10:12 <@vpnHelper> Title: 's gist: 213653d1dc81ce232b84 Gist (at gist.github.com)
10:12 < gabrielcz_> janjust: there you will found "something" im sure
10:13 < janjust> yep: the server cert is of the wrong type : VERIFY ERROR: depth=0, error=unsupported certificate purpose: 
10:14 < gabrielcz_> yeah...  i see that, but I dont have any idea how to fix it...
10:14 < gabrielcz_> or solve 
10:14 < janjust> try regenerating a server cert using 'build-key-server' or remove any certificate checking options from the client config (remote-cert-tls or ns-cert-type server)
10:15 < gabrielcz_> MMmmm
10:16 < gabrielcz_> emove any certificate checking options from the client config (remote-cert-tls or ns-cert-type server) <--  dont get the idea ...  
10:16 < gabrielcz_> can you try explain please again.?
10:16 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900-15.html#p11045>
10:17 < janjust> simply rebuild the server cert using 'build-key-server'
10:17 < gabrielcz_> on server: I make certificated using:  ./build-key-server  that command 
10:18 < gabrielcz_> what you think: 
10:18 < gabrielcz_> 1) ./clean-all 
10:18 < gabrielcz_> 2) ./build-dh
10:18 < janjust> don't run clean-all 
10:18 < gabrielcz_> ok.
10:18 < gabrielcz_> ./build-dh and ./build-ca dont ?
10:19 < janjust> I 've gotta go now - someone else can take over ; but check your client config files for any lines related to 'ns-cert-type' and 'remote-cert-tls' en comment them out
10:19 < gabrielcz_> just ./build-key-server nameofcert?
10:19 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:20 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
10:21 < crocket> Is CIPE comparable to OpenVPN or IPsec?
10:24 < gladiatr> Man... Olaf has an unfortunate last name... poor guy
10:25 < gladiatr> crocket, on the surface it looks somewhat similar, I suppose.
10:25 < gladiatr> to OpenVPN, that is.  Not at all similar to IPSec
10:27 < crocket> hmm
10:28 < crocket> gladiatr, Is CIPE winning?
10:28 < crocket> I don't know what is winning although I currently use OpenVPN.
10:28 < gladiatr> winning?
10:28 < crocket> gladiatr, Will it be prevalent?
10:29 < gladiatr> Hrm... well, it looks like there hasn't been any mailing list action for CIPE since 2008.  Could mean that their archival mechanism was taken down, but without looking further into it, it looks kinda dead.
10:29 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900-15.html#p11046>
10:29 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 240 seconds]
10:29 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
10:30 < crocket> gladiatr, That leaves PPP over L2TP/IPsec and OpenVPN.
10:31 < gladiatr> huh?
10:31 < gladiatr> not sure where you're going.
10:32 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
10:32 < crocket> gladiatr, L2TP/IPsec itself is useless.
10:32 < crocket> gladiatr, PPP needs to be run over L2TP/IPsec
10:33 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has quit [Quit: ph1l]
10:33 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
10:34 < crocket> gladiatr, IPsec is a way to encrypt and authenticate IP packets.
10:34 < crocket> L2TP is a way to create a tunnel.
10:34 < crocket> PPP creates IP addresses in a tunnel.
10:34 < crocket> L2TP itself has no encryption, so it needs IPsec.
10:35 < crocket> So I guessued PPP over L2TP/IPsec was a common way to set up VPNs.
10:36 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:36 < gladiatr> crocket, dunno, man
10:37 < crocket> gladiatr, As far as I know, there are two common ways to set up VPNs. OpenVPN and IPsec.
10:40 < pmatulis_> when my tunnel is active i'm having trouble contacting a printer/scanner.  is this a known issue?
10:42 < gabrielcz_> YES YES YES
10:43 < gabrielcz_> Solved my problem
10:43 < gladiatr> pmatulis_...
10:43 < gladiatr> !goal
10:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:44 < gladiatr> !welcome
10:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:44 < pmatulis_> gladiatr: just regular internet access for a single machine
10:44 <@vpnHelper> RSS Update - forum: Client configuration incident ? <http://forums.openvpn.net/topic7906.html>
10:46 < gabrielcz_> gladiatr: are you here?
10:47 < gabrielcz_> Im connected, now, if I open my browser and take a look to my external ip, es not the EXTERNAL IP from openvpn server, is MY ip.
10:47 < gabrielcz_> and I want all traffic from client to internet goes to vpn
10:48 < gabrielcz_> I want to navegate internet using ip from opnvpn server
10:48 < gladiatr> !redirect
10:48 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
10:48 < gabrielcz_> to do that, I need to uncomment this line gladiatr?  #push "redirect-gateway def1" ?
10:48 < gladiatr> indeed!
10:50 < Cubox> !nat
10:50 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
10:50 <@vpnHelper> RSS Update - forum: Client configuration incident ? <http://forums.openvpn.net/topic7906.html#p11048>
10:53 < Cubox> i need help ... i have enabled nat, ipforward and openvpn run but ... the web traffic don't go to the vps ( the internet connection cas down when i am connected to my vpn )
10:53 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:55 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has quit [Ping timeout: 246 seconds]
10:55 <@vpnHelper> RSS Update - forum: Some questions about PPTP <http://forums.openvpn.net/topic7900-15.html#p11049>
10:56 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has joined #openvpn
10:56 < gabrielcz> Cubox: Im sure not...  but.. 
10:56 < gabrielcz> you need that?
10:56 < gabrielcz> traffic to internet trought vpn server?
10:56 < Cubox> sorry ?
10:57 < gabrielcz> or just the oposite?
10:57 < Cubox> yes
10:57 < Cubox> home > vpn > internet
10:57 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:57 < gabrielcz> Mmmm 
10:57 < Cubox> !openvm
10:57 < gabrielcz> push "redirect-gateway def1"
10:57 < Cubox> done
10:57 < gabrielcz> you have that line or similar on server.conf?
10:57 < Cubox> push "redirect-gateway def1 bypass-dhcp"
10:58 < gabrielcz> Mmmm 
10:59 < gabrielcz> don`t know dude.. 
10:59 < Cubox> u_u
10:59 < gabrielcz> really first time here setting two openvpn
10:59 < gabrielcz> on the first, no problem
10:59 < gabrielcz> on this, just done
10:59 < gabrielcz> cant help!
10:59 < gabrielcz> sry
11:00 < Cubox> !linnat
11:00 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
11:00 < gabrielcz> Can I help you in some other way?
11:00 < Cubox> !openvzlinnat
11:00 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
11:00 < gabrielcz> paste my settings, or logs, or something?
11:00 < Cubox> mmh ...
11:00 < Cubox> what is container.ip ?
11:00 < gabrielcz> where?
11:00 < Cubox> gabrielcz: no, thanks
11:00 < Cubox> @vpnHelp+| "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
11:01 < gabrielcz> pufffff
11:01 < gabrielcz> dont know
11:01 < Cubox> u_u
11:02 < Cubox> I can test tht
11:02 < Cubox> that *
11:02 < Cubox> I have a vps
11:02 < gabrielcz> https://gist.github.com/adee55dd26de5488fecf <--  that my server.conf file
11:02 <@vpnHelper> Title: 's gist: adee55dd26de5488fecf Gist (at gist.github.com)
11:02 -!- dazo_afk is now known as dazo
11:02 < gabrielcz> I setup all from: http://ubunlog.com/instala-tu-propio-servidor-vpn-con-openvpn-en-ubuntu-10-04-server/#comment-5726  
11:02 <@vpnHelper> Title: Instala Tu Propio Servidor VPN con OpenVPN en Ubuntu 10.04 Server | Ubunlog (at ubunlog.com)
11:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:03 < gabrielcz> and from here: https://help.ubuntu.com/community/IptablesHowTo
11:03 <@vpnHelper> Title: IPTables HowTo - Community Ubuntu Documentation (at help.ubuntu.com)
11:03 < gabrielcz> hehehe stupid bot, it read title from pages :) jejejejeje
11:03 < gabrielcz> the first URL is on spanish
11:03 < gabrielcz> you can see commands
11:03 < gabrielcz> or traqnslate using google
11:04 < gabrielcz> or I can help
11:04 < gabrielcz> that works PERFECT on ubuntu
11:04 < Cubox> i can wait for a user can help about <container.ip> 
11:04 < gabrielcz> yes think is better
11:05 < gabrielcz> well
11:05 < gabrielcz> well, good luck
11:05 < Cubox> Thanks :D
11:05 < gabrielcz> where you from Cubox?
11:06 < Cubox> Francia
11:06 <@vpnHelper> RSS Update - forum: SQL server only visible when firewall rule set to public <http://forums.openvpn.net/topic7905.html#p11050>
11:06 < Cubox> mmh ... I am french *
11:06 < gabrielcz> undestood
11:06 < gabrielcz> Im looking for a US one to use netflix
11:06 < gabrielcz> ;)
11:06 < Cubox> :D
11:07 < gabrielcz> exit
11:07 < gabrielcz> ups
11:07 < gabrielcz> exiting shells :)
11:08 < Cubox> :D
11:13 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
11:14 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
11:32 < gabrielcz> anyone here? 
11:33 < gabrielcz> question about encriptation (i dont know is that word exist in english :)
11:33 -!- Guifort [~Administr@AAmiens-553-1-198-107.w92-142.abo.wanadoo.fr] has joined #openvpn
11:34 < gabrielcz> I use a vpn connection JUST to browse internet
11:34 < gabrielcz> and I DONT care about security there... 
11:34 < gabrielcz> are there any option FASTER without security of course
11:35 < gabrielcz> any clue?
11:36 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
11:41 < gladiatr> gabrielcz, you mean you want to be able to use the remote internet connection but don't care if its encrypted or not?
11:43 < gabrielcz> ecxacly
11:43 < gabrielcz> yes
11:44 < gladiatr> !cipher
11:44 < gladiatr> k.  Well, you would need to use the following option on each end:
11:44 < gladiatr> --cipher none
11:44 < gladiatr> that's in the openvpn man page, by the way
11:45 < gabrielcz> --cipher none where? on server.conf ?
11:45 < gladiatr> Honestly, unless you have an extremely fast connection, I doubt removing the encryption will give you a performance boost
11:46 < gladiatr> on each end--the client and server side.  The cipher definition has to match (which is why most of us don't ever set it manually)
11:47 < Cubox> gladiatr: i know, you can help me. in iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>    what is <container.ip> ?
11:47 < gladiatr> Cubox, what are you trying to accomplish?
11:48 < gladiatr> that's a rule for connection forwarding
11:48 < Cubox> gladiatr: but what is <container.ip> ?
11:48 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
11:50 < gladiatr> I am not familiar with the "container" designation.  What this is that a connection coming in on tun0 will be redirected to <container.ip>
11:50 < Cubox> but what is this ip ? my public ip ?
11:51  * gladiatr sighs
11:51 < gladiatr> these are not the droids you are looking for
11:51 < Cubox> oO
11:52 < gladiatr> http://www.youtube.com/watch?v=vzcWPKAv2Ow :P
11:52 <@vpnHelper> Title: YouTube - These arent the droids youre looking for (at www.youtube.com)
11:52 < gladiatr> Cubox, scroll back in your IRC history.  I gave you the iptables rule you need to use to nat your tun0 network out to the internet.
11:53 < Cubox> gladiatr: this rule don't work
11:53 < Cubox> i try
11:53 < Cubox> !openvzlinnat
11:53 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
11:53 < gladiatr> !linnat
11:53 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
11:53 < gladiatr> don't give up.  I need to go get some food.  I'll be back in a bit.
11:54 < Cubox> ok
11:54 -!- gladiatr is now known as gladiatr_afk
12:06 < gabrielcz> Mmmm 
12:06 < gabrielcz> I dont get any doc....
12:07 < gabrielcz> O need to setup a vpn connection between client and server WITHOUT cipher
12:07 < gabrielcz> The only think I found, that I need to run openvpn --cipher nonw 
12:07 < gabrielcz> I think must setup that os a startup parameter (not sure)
12:08 < gabrielcz> but I don´t know how to set that on viscosity vpn client for mac :( 
12:17 < gabrielcz> !cipher
12:19 < gabrielcz> hello, anyone is arround?
12:22 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11051>
12:32 < Bushmills> you'd add cipher option in client and server config
12:32 < Bushmills> server alone should do, but warnings may result from in in client log
12:34 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html>
12:36 < gabrielcz> Hello Bushmills
12:37 < gabrielcz> I just found this: http://openvpn.net/index.php/access-server/docs/admin-guides/437-how-to-change-the-cipher-in-openvpn-access-server.html
12:37 <@vpnHelper> Title: How to change the Cipher in OpenVPN Access Server (at openvpn.net)
12:37 < gabrielcz> but REALLY dont know
12:37 < gabrielcz> Bushmills: how to enable cipher none on server side?
12:37 < Bushmills> you don't know what - how to add an option to the config file?
12:38 < gabrielcz> I looked how to tells my client to use cipher none
12:38 < gabrielcz> but is a shell command "openvnc --show-cipher"
12:38 < gabrielcz> "openvpn --cipher none
12:39 < Bushmills> commonly, you'd use an advanced interactive openvpn configuration frontend program, called a "text editor"
12:39 < gabrielcz> but i dont know where to put them... in a startup option, or config file
12:39 < Bushmills> "(19:32:21) Bushmills: you'd add cipher option in client and server config" - what does that suggest where to put it?
12:40 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:40 < gabrielcz> on server side...
12:40 < gabrielcz> or in a server.conf file or as a startup parameter 
12:40 < Bushmills> as you wish
12:41 < Bushmills> just be aware that if you specify command line parameters, you need to give --config explicitely, just the name of the config file is not enough
12:41 < gabrielcz> Bushmills: If you know the answer and you want to talk about, cool, if not, no problem i can keep looking.
12:42 < Bushmills> what? i told you already. what else do you need to know?
12:42 < gabrielcz> --config?
12:42 < Bushmills> (19:32:21) Bushmills: you'd add cipher option in client and server config
12:42 < Bushmills> (19:32:59) Bushmills: server alone should do, but warnings may result from in in client log
12:42 < Bushmills> is there anything not clear about what i wrote?
12:42 < gabrielcz> NO
12:42 < gabrielcz> sorry, but no for me...
12:43 < Bushmills> well, of course you can ignore what i say and keep looking, if that suits you better
12:43 < gabrielcz> yes, i think too...
12:44 < Bushmills> good luck then.
12:44 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
12:46 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has joined #openvpn
12:46 < orudie> greetings. I'm creating CA certs for the first time, looking at the guide, for creating certs in Windows, after editing. vars.bat when i type build-ca i get 'openssl' is not recognized as an internal or external command,
12:46 < orudie> here is a paste from CMD window http://pastebin.linode.com/5126
12:48 < Bushmills> in unixoids, in order to have the openssl command available, package openssl needs to be installed
12:48 < Bushmills> i can imagine that that's quite similar on windows
12:49 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has quit [Ping timeout: 246 seconds]
12:50 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has quit [Ping timeout: 246 seconds]
12:52 < orudie> so the OpenVPN installer doesn't install openssl in Windows ?
12:53 -!- gabrielcz [~gabrielcz@190.246.212.171] has joined #openvpn
12:54 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: Leaving]
12:55 < Bushmills> orudie: no idea.
12:55 < Bushmills> do windows installers have something like dependency management?
12:57 < hyper_ch> Bushmills: no
12:58 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:58 < Bushmills> in that case, openssl may have to be installed as extra package manually
12:59 -!- gabrielcz [~gabrielcz@190.246.212.171] has quit [Ping timeout: 240 seconds]
12:59 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has joined #openvpn
12:59 < Bushmills> has somebody filed a bug report about that deficiency?
13:03 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has joined #openvpn
13:06 < orudie> if my windows is 64 bit, I have to install 64 bit version of openssl , even though the OpenVPN  is 32 bit ?
13:06 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has quit [Ping timeout: 246 seconds]
13:09 < orudie> the OpenVPN installer shows Select components to install: OpenSSL DLLs and OpenSSL utilities are included 
13:09 -!- patel is now known as patelx
13:09 < orudie> so I'm really confused, any hinst for me please ?
13:09 -!- patelx [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Changing host]
13:09 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
13:09 -!- patelx [~patel@openvpn/corp/admin/patel] has left #openvpn []
13:09 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
13:09 -!- mode/#openvpn [+o patelx] by ChanServ
13:10 -!- luneff [~yury@84.51.201.89] has joined #openvpn
13:14 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has quit [Ping timeout: 276 seconds]
13:14 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:14 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has joined #openvpn
13:28 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 260 seconds]
13:29 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has joined #openvpn
13:31 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has quit [Ping timeout: 246 seconds]
13:31 < orudie> I installed openssl binary, its giving me the same error when I type build-ca 
13:32 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:32 < orudie> guys, please help 
13:33 < orudie> 'openssl not recognized command'
13:33 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has quit [Ping timeout: 246 seconds]
13:33 < krzie> windows?
13:34 -!- takamichi [Takamichi@80.71.98.29] has joined #openvpn
13:34 -!- gabrielcz [~gabrielcz@190.246.212.171] has joined #openvpn
13:34 < orudie> krzie, yes windows 
13:35 < krzie> http://www.google.com/search?client=opera&rls=en&q='openssl+not+recognized+command'+openvpn+windows&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest
13:35 <@vpnHelper> Title: openssl not recognized command openvpn windows - Google Search (at www.google.com)
13:35 < krzie> In the meantime (and working along the same lines), I've found that there is an openssl.exe program within the bin directory. Rather than edit any standard batch files, I copied the .exe file to the easy-rsa directory and everything works as I had imagined and described within the question.
13:36 < krzie> i had the same problem when i ran build-ca in my user account but it works in admin account.
13:36 < krzie> google is full of info on this ;]
13:36 < orudie> krzie, i installed openssl , can't locate openssl.exe :)
13:37 < krzie> iirc everything you need should be in the easy-rsa dir or somewhere in the package
13:37 < orudie> nvm found it 
13:38 < krzie> virtualDJ automix is awesome!
13:38 -!- gabrielcz [~gabrielcz@190.246.212.171] has quit [Ping timeout: 246 seconds]
13:39 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has joined #openvpn
13:42 < Cubox> gladiatr_afk: ping
13:44 -!- Galaxor [~rjhughes@zaxxon.gpcc.itd.umich.edu] has left #openvpn []
13:45 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has joined #openvpn
13:48 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has quit [Ping timeout: 258 seconds]
13:51 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
13:54 < majuk> Hmm... so, TUN over UDP application, everything working like gangbusters, but I have a client that is behind a bridged wireless router and it can't interact with anything on the VPN
13:54 <@vpnHelper> RSS Update - forum: error with creating a new vpn key <http://forums.openvpn.net/topic7904.html#p11053>
13:55 < majuk> Any thoughts appreciated.
14:10  * ecrist guesses conflicting IP subnets
14:12 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11054>
14:12 -!- Chris___ [goose@well.i.made.ur-mom.go.honk-honk.org] has joined #openvpn
14:13 < Chris___> !welcome
14:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:13 < Chris___> !goal
14:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:14 < Chris___> Goal: I've got an OpenVPN setup on my VPS. It works, because I use it regularly with Linux. I want to use it with Windows too. I seem to remember thinking windows needs some special client to do this. Where should I go/start/look/etc to be able to use my OpenVPN on windows?
14:19 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:26 < krzee> Chris___, try it, come back when you get stuck
14:26 < krzee> the only REAL difference is:
14:26 < krzee> !winpath
14:26 <@vpnHelper> "winpath" is (#1) Remember on Windows to quote pathnames and use double backslashes, e.g.: "C:\\Program Files\\OpenVPN\\config\\foo.key", or (#2) also, you can use forward slashes to avoid needing double backslashes, but you still need quotes, e.g.: C:/Program Files/OpenVPN/config/foo.key (but surrounded by quotes)
14:27 < krzee> however, sometimes you need special settings, depending on issues you encounter
14:29 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has quit [Ping timeout: 246 seconds]
14:30 < Chris___> krzee: right, I just seem to remember the last time I tried to do this, I had to use a specific client program for windows, because the one google gave me was old or something like that. Where can I get the most recent version?
14:30 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has joined #openvpn
14:30 < krzee> !download
14:30 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
14:31 < Chris___> thanks
14:31 < krzee> np
14:41 < Cubox> Hello, i need help about
14:41 < Cubox> !openvzlinnat
14:41 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
14:41 < Cubox> What is container.ip ?
14:41 < Chris___> to be continued, as the only copies of my .crt and .key file are not available to me right now. thanks again krzee :)
14:41 <@vpnHelper> RSS Update - forum: bind or lport not working. windows 7 64bit <http://forums.openvpn.net/topic7908.html>
14:42 < krzee> Chris___, any guesses from context here: "since openvz cant do NAT inside containers" ?
14:42 < krzee> Chris___, np
14:43 < krzee> Cubox, any guesses from context here: "since openvz cant do NAT inside containers" ?
14:43 < Cubox> krzee: sorry ? i am franch and don't understand
14:43 < krzee> openvz has the host computer, and containers
14:43 < krzee> the container is the virtual machine
14:43 < Cubox> mmh ...
14:44 < Cubox> the public ip ( to eth0 ) ?
14:44 < krzee> show me ifconfig
14:44 < krzee> (in pastebin)
14:44 < Cubox> eth0      Link encap:Ethernet  HWaddr 00:1c:14:01:0c:d7  
14:44 < Cubox>           inet adr:78.47.163.170  Bcast:78.47.163.175  Masque:255.255.255.240
14:44 < krzee> yes, 78.47.163.170
14:45 < Cubox> ok ,thanks
14:45 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has joined #openvpn
14:45 < krzee> np
14:47 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has quit [Ping timeout: 246 seconds]
14:51 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has quit [Ping timeout: 246 seconds]
14:52 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has joined #openvpn
14:56 -!- Guifort_1 [~Administr@AAmiens-553-1-198-107.w92-142.abo.wanadoo.fr] has joined #openvpn
14:58 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
14:59 -!- Guifort [~Administr@AAmiens-553-1-198-107.w92-142.abo.wanadoo.fr] has quit [Ping timeout: 258 seconds]
15:00 < orudie> krzee, still around ? quick question for you. 
15:00 < hyper_ch> orudie: he prefers slow questions
15:01 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has joined #openvpn
15:03 -!- gabrielcz [~gabrielcz@60.Red-212-170-63.staticIP.rima-tde.net] has quit [Ping timeout: 246 seconds]
15:04 < orudie> heh. when i try to start vpn client, i get error "clientname.crt" and i did specify it in client.ovpn config file , any ideas ?
15:04 < orudie> cannot open "clientname.crt" 
15:06 < krzee> !path
15:06 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
15:06 < krzee> you're welcome =]
15:09 -!- _slax0r_ [fire@BSN-176-237-6.dial-up.dsl.siol.net] has joined #openvpn
15:10 -!- MarKsaitis [~MarKsaiti@86.31.120.220] has joined #openvpn
15:11 < Cubox> RAH nat don't work ...
15:11 < Cubox> i have set iptables, ipforward and some others
15:12 < Cubox> !nat
15:12 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:13 < orudie> okay i have path figured out 
15:13 < krzee> Cubox, this is a known problem with openvz
15:13 < orudie> now i get the following:
15:13 < krzee> Cubox, talk to your vps provider
15:13 < orudie> OpenVPN TLS error:  TLS key negotiation failed
15:13 < orudie> any ideas ?
15:14 < krzee> orudie, pastebin the entire log from both sides
15:15 < Cubox> krzee: i am not sure if i have openvz
15:15 < _slax0r_> hello, don't know if this is the right chan to ask this, but anyway. I have to copy OpenVPN AS from one server to the other, but the originating server distro was CentOS, the new server is Ubuntu, I have installed OpenVPN AS on the new server and copied the configuration  to the new server, but when I do this, at openvpnas startup I get an error that ~/bin/python does not exist, but it does 
15:15 < _slax0r_> and it is executable. can one even copy AS over to another server like this?
15:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:18 < Cubox> krzee: can you help me to find where is the error ( check with me all of steps ) ?
15:20 < orudie> krzee, second
15:22 -!- gabrielcz_ [~gabrielcz@190.246.212.171] has quit [Ping timeout: 246 seconds]
15:22 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
15:24 < hz0> any known issues with win2k3 and openvpn? had some problems with setting up openvpn on it
15:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:34 < orudie> krzee, i'm using openvpn server in dd-wrt, not sure where the openvpn config file can be found in dd-wrt 
15:35 -!- SOG [~SOG@1-64-219-070.static.netvigator.com] has joined #openvpn
15:36 < krzee> Cubox, then why would you be using !openvznat !?
15:36 < krzee> hz0, works fine on w2k, whats the problem?
15:37 < krzee> orudie, me niether, i support openvpn not dd-wrt
15:37 < hz0> i know it does, but for some reason im getting strange errors, it's on win 2003 serv
15:38 < _slax0r_> like?
15:38 -!- gabrielcz [~gabrielcz@190.190.32.110] has quit [Read error: Connection reset by peer]
15:38 < hz0> route gateway is not reachable on any active network adapters or Route addition via IPAPI failed
15:38 < hz0> not sure where to start looking
15:38 < krzee> the IPAPI error is in the faq
15:39 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
15:39 < hz0> oh, ok ill look into it
15:39 < hz0> was sure i did, but maybe i missed it
15:41 < krzee> http://openvpn.net/index.php/open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html
15:41 < krzee> try those
15:43 < hz0> k thx, gonna try that
15:45 -!- SOG [~SOG@1-64-219-070.static.netvigator.com] has quit [Quit: I will be back!]
15:51 < hz0> hi i tried using the non dhcp methods but no luck, is dhcp a must? i had it on static addr
15:56 -!- Guifort_1 [~Administr@AAmiens-553-1-198-107.w92-142.abo.wanadoo.fr] has quit [Quit: Quitte]
15:57 < krzee> i believe thats how the server gets windows to set the IP
15:59 < orudie> krzee, client side paste: http:/paste.linode.com/5127
15:59 < orudie> krzee, client side paste: http://paste.linode.com/5127
16:00 < krzee> Wed Apr 06 16:53:08 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
16:00 < krzee> standard networking error
16:00 < orudie> krzee, so what can I check ?
16:00 < krzee> either your server is not running, is being blocked by a firewall, is behind a nat without port forwarding...
16:00 < krzee> something like that
16:00 < krzee> your client cant reach your server
16:01 < orudie> okay 
16:01 < orudie> on the server side when i type 'ps | grep openvpn' , sometimes it shows the process, sometimes it doesn't 
16:01 < orudie> does it mean it keeps restarting ?
16:02 < krzee> dunno, you should know better than me if you have something checking and restarting openvpn or not
16:03 < krzee> standard it will either be running or not, it doesnt start itself
16:12 <@vpnHelper> RSS Update - forum: which is the format of a package created by openvpn? <http://forums.openvpn.net/topic7566.html#p11056>
16:16 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 264 seconds]
16:31 < Bushmills> i suppose what you see is not the openvpn process, but the grep process
16:34 -!- EugeneKay is now known as EugeneKaway
16:37 -!- dazo is now known as dazo_afk
16:39 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Ping timeout: 240 seconds]
16:46 < krzee> ahh thats prolly true Bushmills 
16:54 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
16:57 < kunago> Hi. Can I ask for help from someone? This is the setting at one of my LANs - http://img822.imageshack.us/img822/1682/vpnsituation.jpg. My client (NAS) should be able to connect to my VPN server and be able to expose all the clients that connect to my router. How can I make this work? Should I make the client the network gateway for all the machines? That might not, however, be able to work for my router as it is an ADSL modem... Am I right or cou
16:59 < krzee> you could make it the default gateway, or you could add a route to the existing default gateway
16:59 < krzee> its all explained here
16:59 < krzee> !route
16:59 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
17:01 < kunago> I am already using this on my other 3 LANs. This one, however, differs by the client not being the DHCP server on the LAN. This VPN client is inside of the network so that is why I am asking.
17:01 < krzee> thats wonderful, if you read my document you will see a section named ROUTES TO ADD OUTSIDE OPENVPN
17:03 < kunago> Oops, sorry, missed that part.
17:04 < kunago> By the way, it's in general very well written. I used it to set up my previous LANs and was able to make it work the first time I tried.
17:06 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:07 < krzee> thanx, that is nice to hear
17:07 < krzee> overall it is a subject that often takes people a long time
17:07 < krzee> (to understand what iroute is and things like that)
17:11 < kunago> I am fine with route and iroute. As I said, I am happily exposing 3 LANs (over 30 clients) where everyone sees everyone. So far so good. All the VPN clients are routers at the same time which makes thigs fairly easy to setup.
17:14 < krzee> right, i was just saying that it often takes people a long time to understand that stuff
17:15 < kunago> You are correct. Took me some 2 weeks to even launch it between a single server and client. :-)
17:17 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p11057>
17:17 -!- _slax0r_ [fire@BSN-176-237-6.dial-up.dsl.siol.net] has quit []
17:19 -!- zxd_ [~zxd@95.211.21.37] has quit [Ping timeout: 264 seconds]
17:21 -!- MarKsaitis [~MarKsaiti@86.31.120.220] has quit [Quit: Leaving]
17:21 -!- kunago [~Miris@201.239.broadband12.iol.cz] has quit [Read error: Connection reset by peer]
17:29 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
17:46 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Quit: Bye]
17:49 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
17:51 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
17:54 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 260 seconds]
17:56 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
17:56 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
17:56 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
17:56 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:09 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 248 seconds]
18:09 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
18:11 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 258 seconds]
18:19 -!- kunago [~Miris@201.239.broadband12.iol.cz] has left #openvpn []
18:26 -!- MrCerulean [~Adium@115.78.234.187] has joined #openvpn
18:35 < Bushmills> krzee: not sure how that is under bsd, but under linux, ps  without switches doesn't show you a lot
18:38 -!- MrCerulean [~Adium@115.78.234.187] has quit [Ping timeout: 252 seconds]
18:39 -!- MrCerulean [~Adium@ec2-50-18-61-126.us-west-1.compute.amazonaws.com] has joined #openvpn
18:40 < MrCerulean> Bushmills: Same under bsd. :P
18:40 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:52 -!- takamichi [Takamichi@80.71.98.29] has quit [Ping timeout: 260 seconds]
19:00 < krzee> yep, same
19:00 < krzee> and ps auxw| grep [o]penvpn wouldnt match grep
19:01 < krzee> but im sure you knew that before i did ;]
19:01 < toortog> hi everyone
19:01 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 248 seconds]
19:02 < krzee> hi gotroot
19:03 < toortog> that's toorgot!
19:03 < toortog> :]
19:03 < krzee> no its not
19:03 < toortog> haha ya i just saw that hehe
19:03 < toortog> whoops
19:03 < krzee> haha
19:03 -!- Champi [Champi@rootshell.fr] has joined #openvpn
19:06 -!- MrCerulean [~Adium@ec2-50-18-61-126.us-west-1.compute.amazonaws.com] has quit [Ping timeout: 276 seconds]
19:08 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:40 -!- kyrix [~ashley@92.90.17.5] has joined #openvpn
19:53 < ecrist> sup d000ds?
19:53 < krzee> playing angry birds, lol
19:53 < ecrist> krzee: in freebsd 8, best ps args are 'ps auxdwww'
19:53 < krzee> got a HTC aria, cant root it yet tho =/
19:54 < krzee> i always do that without -d
19:54 < ecrist> d is new
19:54 < ecrist> try it out
19:54 < krzee> yep, not on my fbsd6 box
19:54 < krzee> oh cool!
19:54 < krzee> parental hierarchy
19:54 < ecrist> :)
19:54 < ecrist> yp
19:54 < ecrist> yup*
19:55 < krzee> thats pretty damn slick
19:55 < ecrist> I thought so, too.
19:55 < krzee> did linux get that yet?
19:55 < ecrist> no clue
19:55  * ecrist doesn't use linux - ever
19:55 < krzee> hehe i have, but dont in general
19:55 < krzee> once i needed SAS drivers before fbsd current had them, so i went gentoo
19:56 < ecrist> heh
19:56 < ecrist> I just talk to the people that write them and hit them up for udates.
19:56 < krzee> i have a debian vm (as well as opensolaris and many other stuff) at home for testing compatibility in my scripts when appropriate
19:56 < ecrist> update*
19:56 < krzee> they hadnt been written for fbsd at that point tho
19:57 < krzee> linux gets hw support well before fbsd
19:57 < krzee> but i usually dont care, that was the only time
19:57 < krzee> it was a free colo, not like i could say "no i want an older motherboard"
19:58 < ecrist> ah
19:59 < ecrist> _everything_ at $job runs freebsd
19:59 < ecrist> phone system, firewalls, routers, SAN, web cluster, DB server, processing boxes, backup system, VPN server, etc, etc
19:59 < krzee> not your workstation!
19:59  * krzee knows its your laptop, running osx
19:59 < ecrist> no, but it has a BSD userland
19:59 < ecrist> ;)
19:59 < krzee> ;]
20:13 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
20:13 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
20:13 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:39 -!- kyrix [~ashley@92.90.17.5] has quit [Quit: Leaving]
20:45 -!- elly [~elly@april-fools/thewinningest/elly] has quit [Quit: leaving]
20:55 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has joined #openvpn
20:55 < lkthomas> hey guys
20:56 < lkthomas> I want to connect our datacenter infrastructure from other country using openvpn
20:56 -!- EugeneKaway is now known as EugeneKay
20:56 < lkthomas> and our datacenter server is 10.10.0.0/255.255.0.0
20:56 < lkthomas> IP is *
20:56 < lkthomas> and what address pool should I use for openvpn ?
20:57 < lkthomas> can I reuse 10.10.0.0/255.255.0.0 IP ?
21:01 -!- Netsplit *.net <-> *.split quits: fipu, d303k, Chris___, AL13N_work, MJD, espeed, raw_, @dazo_afk, Cubox, EvilJStoker
21:01 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
21:02 -!- Netsplit *.net <-> *.split quits: cron2, JPeterson, cmur2, [intra]lanman
21:02 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
21:03 -!- Netsplit over, joins: cron2, [intra]lanman, cmur2, JPeterson
21:03 -!- Netsplit over, joins: fipu
21:03 -!- Netsplit over, joins: @dazo_afk, d303k, EvilJStoker, Chris___, Cubox, AL13N_work, espeed, raw_, MJD
21:05 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
21:06 < pwrcycle> to use tls-auth do you have to have a client key?
21:09 < krzee> they are %100 unrelated
21:09 < krzee> i believe tls-auth would still work if you were using a static key
21:09 < krzee> or password auth
21:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:11 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has joined #openvpn
21:12 < orudie> I'm Setting up OpnVPN for the first time. I see this in server log when client tries to connect:
21:12 < orudie> TLS Error: TLS handshake failed
21:13 < lkthomas> I want to connect our datacenter infrastructure from other country using openvpn
21:13 < lkthomas> and our datacenter servers IP is 10.10.0.0/255.255.0.0
21:13 < lkthomas> and what address pool should I use for openvpn ?
21:13 < lkthomas> can I reuse 10.10.0.0/255.255.0.0 IP ?
21:17 < orudie> in the client I see this: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
21:17 < orudie> what can I check ?
21:18 < krzee> !certverify
21:18 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
21:18 < krzee> ^ @ orudie
21:18 < krzee> [19:13]  <lkthomas> and our datacenter servers IP is 10.10.0.0/255.255.0.0
21:18 < krzee> thats not an ip
21:19 < krzee> that is a subnet
21:19 < lkthomas> I should say IP range
21:19 < krzee> no, do not re-sure anything
21:19 < lkthomas> anyway
21:19 < krzee> err do not re-use
21:19 < lkthomas> so you suggest to have a new address pool and do static route ?
21:19 < krzee> you'd be fine with 10.8.0.0/24
21:19 < krzee> yes, very much so
21:19 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
21:19 < lkthomas> I see
21:19 < lkthomas> because PPTP could reuse the pool
21:19 < krzee> server 10.8.0.0 255.255.255.0 should be fine
21:20 < krzee> sure, until you screw things up
21:20 < krzee> you COULD give out the same ips with openvpn too
21:20 < krzee> but why do things wrong?
21:20 < krzee> just use different subnets
21:20 < krzee> and btw, pptp sucks
21:20 < krzee> !pptp
21:20 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read about
21:20 <@vpnHelper> why to not use pptp
21:21 < lkthomas> LOL
21:22 < krzee> =]
21:22 < lkthomas> is this channel coming to dead ?
21:22 < krzee> huh?
21:22 < lkthomas> because my working hour still couple hours awau
21:22 < lkthomas> away*
21:22 < krzee> i dont understand the question
21:23 < lkthomas> nevermind
21:23 < lkthomas> I mean, is this channel always active ?
21:23 < lkthomas> usually 2hours later this channel will be dead :P
21:24 < krzee> ahh
21:24 < krzee> in 2 hours from now theres usually some people around
21:24 < krzee> we have a pretty good group of internationals
21:27 < orudie> does '\openssl verify' takes a long time ?
21:28 < orudie> I just ran it and i'm waiting .... 
21:28 < orudie> krzee, ^
21:31 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
21:32 -!- WebDawg [~whoami@officialg0d.com] has quit [Read error: Operation timed out]
21:34 < krzee> dont msg
21:34 < krzee> im at work, i reply when i can
21:34 < krzee> no, it does not
21:35 < krzee> you prolly missed something
21:36 < krzee> jeff-Mac-Pro:vpnserver jeff$ openssl verify -CAfile ca.crt server.crt
21:36 < krzee> server.crt: OK
21:36 < krzee> real	0m0.029s
21:37 < orudie> krzee, i'm missing server.crt on the server side 
21:39 < krzee> !howto
21:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:39 < krzee> follow the section on making keys
21:39 < krzee> !pki
21:39 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
21:39 <@vpnHelper> specially as a server (see !servercert)
21:41 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Read error: Operation timed out]
21:43 -!- EugeneKay [EugeneKay@kashpureff.com] has joined #openvpn
21:48 < lkthomas> guys
21:48 < EugeneKay> Girls
21:48 < lkthomas> krzee, I forget how to generate CA cert, server cert and shared key, any docs around ?
21:49 < EugeneKay> !easyrsa
21:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Operation timed out]
21:49 < lkthomas> blah
21:49 < EugeneKay> Hrm.
21:49 < lkthomas> nothing ?
21:50 < EugeneKay> http://openvpn.net/index.php/open-source/documentation/miscellaneous/77-rsa-key-management.html
21:50 <@vpnHelper> Title: RSA Key Management (at openvpn.net)
21:50 < EugeneKay> Needs a factoid for that.
21:52 < lkthomas> I could do this on any openvpn machine, am I correct ?
21:52 < EugeneKay> Yeah
22:08 < lkthomas> BUILD A CERTIFICATE SIGNING REQUEST 
22:08 < lkthomas> I have done this
22:09 < lkthomas> is it good to go or I need to go next step ?
22:12 -!- master_of_master [~master_of@p57B57083.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
22:14 -!- master_of_master [~master_of@p57B571A3.dip.t-dialin.net] has joined #openvpn
22:16 < orudie> well 
22:17 < orudie> krzee, still working on TLS Error: TLS handshake failed
22:17 < orudie> the openssl veryfy doesn't return anything
22:17 < orudie> or should I also try it on windows/client side ?
22:28 < orudie> \openvpn-keys>openssl verify -CAfile ca.crt
22:28 < orudie> server.crt
22:28 < orudie> server.crt: OK
22:28 < orudie> krzee, thats on the client (windows) side 
22:29 < orudie> \openvpn-keys>openssl verify -CAfile ca.crt server.crt
22:29 < orudie> server.crt: OK
22:29 < orudie> krzee, ^^
22:31 < lkthomas> krzee, you there ?
22:33 < lkthomas> if I got two openvpn session, should I use devtun1 instead of tun0 ?
22:45 < orudie> I'm stuck 
22:45 < orudie> lol
22:52 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
22:54 -!- b4ggi0 [~Patrick@59.151.39.140] has joined #openvpn
22:54 < b4ggi0> How to config more server on one single client ?
23:04 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
23:11 < EugeneKay> Add additional "server" lines to your client config
23:11 < EugeneKay> (for round-robin load balancing)
23:12 < EugeneKay> If you want multiple VPN connections, just make a second client config file
23:13 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has quit [Quit: Leaving]
23:45 -!- EugeneKay is now known as EugeNook
23:55 -!- EugeNook is now known as EugeneKay
--- Day changed Thu Apr 07 2011
00:00 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has quit [Remote host closed the connection]
00:01 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has joined #openvpn
00:12 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
00:25 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has left #openvpn ["Leaving"]
00:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
00:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:56 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
00:56 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
01:05 < lkthomas> shit
01:05 < lkthomas> I am stuck
01:06 < lkthomas> currently site to site vpn connection could connect
01:06 < lkthomas> site A <= 192.168.100.0/24 => site B <=> 10.10.0.0/16
01:06 < lkthomas> when I did traceroute to 192.168.100.5
01:06 < lkthomas> it shows 192.168.100.1 on first hop
01:06 < lkthomas> where is that come from ?!
01:08 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:12 <@vpnHelper> RSS Update - forum: Client configuration incident ? <http://forums.openvpn.net/topic7906.html#p11058>
01:21 < lkthomas> guys
01:22 < lkthomas> anyone still alive ?
01:27 < lkthomas> so complex to setup site to site routing
01:29 -!- raba [~nk@89.255.96.195] has joined #openvpn
01:30 <@vpnHelper> RSS Update - forum: OpenVPN-Windowz>Zerina-Lunix: connection impossible!!!! <http://forums.openvpn.net/topic7872.html#p11059>
01:36 <@vpnHelper> RSS Update - forum: bind or lport not working. windows 7 64bit <http://forums.openvpn.net/topic7908.html#p11060>
01:41 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Ping timeout: 260 seconds]
01:42 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
01:45 -!- dazo_afk is now known as dazo
01:51 -!- tjz [~pc@bb219-74-11-75.singnet.com.sg] has joined #openvpn
01:51 -!- tjz [~pc@bb219-74-11-75.singnet.com.sg] has quit [Changing host]
01:51 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:51 -!- EugeneKay is now known as EugeneKaway
01:53 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Remote host closed the connection]
01:53 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
01:54 -!- EugeneKaway is now known as EugeneKay
01:58 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
01:59 < AndrewX192> How can I set the DNS options for a openvpn client on Windows? (not server-side)
01:59 < AndrewX192> I have to give instructions to the Windows User, so I need it easy as possible
02:00 < AndrewX192> I am hoping for a change to the  openvpn client configuration file or a paramater to the openvpn client.
02:11 < raba> hi,all! Can you help: when i enable on client "cipher BFC-CBC", I have a failed to start (OS Ubuntu 10.10)
02:14 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
02:22 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
02:24 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:55 -!- raba [~nk@89.255.96.195] has quit [Quit: Ex-Chat]
02:55 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:57 -!- gabrielcz [~gabrielcz@190.190.32.110] has quit [Remote host closed the connection]
03:00 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11062> || error with creating a new vpn key <http://forums.openvpn.net/topic7904.html#p11061>
03:02 < Bushmills> enable on both server and client
03:04 < Bushmills> use BF-CBC  (thouigh that's default)
03:06 <@vpnHelper> RSS Update - forum: Addressing and DNS problems <http://forums.openvpn.net/topic7900-15.html#p11063>
03:11 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:11 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has left #openvpn []
03:12 -!- EugeneKay is now known as EugeneKaway
03:12 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11064>
03:24 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11066> || Addressing and DNS problems <http://forums.openvpn.net/topic7900-15.html#p11065>
03:30 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11067>
03:36 <@vpnHelper> RSS Update - forum: Addressing and DNS problems <http://forums.openvpn.net/topic7900-15.html#p11069> || Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11068>
03:38 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
03:43 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
03:43 < Bushmills> AndrewX192: provide the config file.
03:44 < Bushmills> (to the user, not to me)
03:44 < Bushmills> easier to add an option, than to explain how to add it
03:44 < bigon> hi, I'm trying to setup multiple instance of openvpn with one CA (and maybe sub-ca) that would allow different set of client to connect, any idea what's the best way to do this?
03:45 < Bushmills> unless you want to educate your user, in which case "rtfm" might be appropriate
03:45 < lkthomas> guys, if I am not using default gateway, how could I push traffic to run vpn instead ?
03:46 < Bushmills> all traffic? or selected traffic?
03:48 <@vpnHelper> RSS Update - forum: Addressing and DNS problems <http://forums.openvpn.net/topic7900-15.html#p11071> || Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11070>
03:51 < Bushmills> !redirect 
03:51 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
03:52 < lkthomas> selected traffic
03:52 < lkthomas> if I go to 61.93.xxx.7 ip, then go into vpn tunnel
04:01 < Bushmills> route that traffic
04:01 < lkthomas> how ?
04:02 < lkthomas> I know route
04:02 < lkthomas> but how
04:02 < Bushmills> you can push route through vpn from server config, or set route from client config
04:03 < Bushmills> check out the  route  configuration directive of openvpn
04:04 < lkthomas> I don't understand how to do that
04:05 < lkthomas> can you give me some example please
04:05 < Bushmills> similar to the route command of your operating system, which you say you know. 
04:06 < lkthomas> ip route add 61.93.xxx.7 dev tun0 ?
04:06 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11072>
04:07 < Bushmills> destination must be a host, or a CIDR network specification
04:10 < lkthomas> ip route add 61.93.xxx.7/32 dev tun0 ?
04:11 < Bushmills> http://en.wikipedia.org/wiki/CIDR
04:11 <@vpnHelper> Title: Classless Inter-Domain Routing - Wikipedia, the free encyclopedia (at en.wikipedia.org)
04:14 < lkthomas> can you just make a direct suggestion instead ?
04:16 < lkthomas> is it ok if I just use dev tun0 ?
04:17 < lkthomas> when I did traceroute, it ends on openvpn server side
04:20 < lkthomas> it
04:20 < lkthomas> it's ok now
04:20 < lkthomas> I am using static route
04:21 < Bushmills> "it ends on openvpn server side" - you need to set up server to forward traffic between interfaces
04:21 < lkthomas> right, I just discover that
04:22 < lkthomas> now if I don't want to add static route on client side
04:22 < Bushmills> i assumed you knew that - your were after all only asking how to "push traffic to vpn"
04:22 < lkthomas> I should just use push "ip 255.255.255.0 dev tun0"
04:22 < Bushmills> check out this:
04:22 < Bushmills> !route
04:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:23 < lkthomas> route or push ?
04:23 < Bushmills> push was the term you used
04:23 < Bushmills> i quoted it, to use your own terminology
04:24 < Bushmills> !serverlan 
04:24 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
04:24 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11073>
04:24 < Bushmills> is probably what you're adter
04:24 < Bushmills> after
04:24 < lkthomas> I didn't aware that subnet isn't NAT enable
04:24 < lkthomas> so
04:30 <@vpnHelper> RSS Update - forum: Addressing and DNS problems <http://forums.openvpn.net/topic7900-15.html#p11074>
04:38 < lkthomas> how could I push static route from server to client side ?
04:39 < Bushmills> did i mention the route config directive of openvpn?
04:39 < Bushmills> if not, there is a route directive which you can use in openvpn config
04:41 < lkthomas> openvpn client auto added destination IP to gateway which is 192.168.100.5
04:41 < lkthomas> wait
04:41 < lkthomas> I think I know why
04:41 < lkthomas> hang on
04:43 < lkthomas> no, even I enable ipforward on client side it wouldn't work
04:43 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:43 < lkthomas> unless Ido statis route on linux
04:43 < lkthomas> remark the gateway to 192.168.100.1
04:49 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11075>
04:50 < Bushmills> did you read !route?
04:59 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
05:00 < bigon> 10:44 < bigon> hi, I'm trying to setup multiple instance of openvpn with one CA (and maybe sub-ca) that would allow different set of client to connect, any idea what's the best way to do this?
05:03 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
05:07 <@vpnHelper> RSS Update - forum: Addressing and DNS problems <http://forums.openvpn.net/topic7900-30.html#p11076>
05:08 < lkthomas> I am yet to find out how to add static route on openvpn config file 
05:08 < lkthomas> anyone could help please ?
05:13 <@vpnHelper> RSS Update - forum: Addressing and DNS problems <http://forums.openvpn.net/topic7900-30.html#p11077>
05:25 <@vpnHelper> RSS Update - forum: Addressing and DNS problems <http://forums.openvpn.net/topic7900-30.html#p11078>
05:35 < Bushmills> have you tried reading man page, about --route
05:35 < Bushmills> no, i guess you didn't
05:36 < toortog> read blah ya right :)
05:36 < toortog> morning everyone
05:39 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
05:41 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:41 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:43 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
05:46 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Ping timeout: 246 seconds]
05:49 -!- ph1l [~ph1l@147.87.255.14] has joined #openvpn
05:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
05:52 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
06:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:06 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
06:07 < kunago> krzee: Just wanted to thank you again for the tutorial you wrote. It helped me connect another LAN with all the clients to my VPN.
06:10 -!- zxd_ [~zxd@95.211.21.37] has joined #openvpn
06:21 -!- kunago [~Miris@201.239.broadband12.iol.cz] has left #openvpn []
06:22 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
06:22 <@vpnHelper> RSS Update - forum: Addressing and DNS problems <http://forums.openvpn.net/topic7900-30.html#p11079>
06:24 -!- b4ggi0 [~Patrick@59.151.39.140] has quit [Ping timeout: 276 seconds]
06:26 -!- b4ggi0 [~Patrick@59.151.39.140] has joined #openvpn
06:35 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Read error: Connection reset by peer]
06:42 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
07:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:16 -!- ph1l [~ph1l@147.87.255.14] has quit [Quit: ph1l]
07:19 -!- Guifort [~Administr@ks34643.kimsufi.com] has joined #openvpn
07:31 -!- Guifort [~Administr@ks34643.kimsufi.com] has quit [Ping timeout: 276 seconds]
07:33 <@vpnHelper> RSS Update - forum: Speed of tap device <http://forums.openvpn.net/topic7826.html#p11080>
07:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:05 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
08:06 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
08:06 -!- SOG [~SOG@222.125.196.155] has quit [Remote host closed the connection]
08:11 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
08:12 < orudie> greetings. I am setting up OpenVPN for the first time. I have been stuck on the following: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
08:12 < hz0> pff :) i have the same prob
08:12 < orudie> I see this in the log on both server and client side, which doesn't make sense to me 
08:13 < hz0> was about to post it
08:13 < orudie> hz0, you see this in server log too ?
08:13 < hz0> try this m8 http://openvpn.net/index.php/open-source/faq/79-client/253-tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity.html
08:13 <@vpnHelper> Title: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) (at openvpn.net)
08:13 < hz0> i only see it in the client's log
08:13 < hz0> hope this link will help u, seems like a forwarding/firewall issue
08:15 < hz0> ive got a bit different issue, was wondering if i could make it work without forwarding traffic from port 1194 to the vpn server's private ip
08:16 < hz0> i mean enabling connection between client and server
08:16 < orudie> hz0, forward the ip instead of port 
08:16 < orudie> hz0, I dont know if that makes sense or not 
08:18 < hz0> it's ok im a bit not sure about it either
08:19 < orudie> hz0, now i'm getting this on the server side write UDPv4 [ECONNREFUSED]: Connection refused (code=146)
08:20 < hz0> might be ur firewall m8
08:20 < hz0> check this out http://www.linuxquestions.org/questions/linux-networking-3/openvpn-errors-161888/
08:20 <@vpnHelper> Title: openvpn errors (at www.linuxquestions.org)
08:21 < hz0> wish there were more ppl here, not sure how to approach my prob
08:25 < orudie> hz0, what did you want me to check there ?
08:26 < orudie> and for my problem, its not the firewall issue anymore, at least on the client side 
08:26 < orudie> before it was 
08:27 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
08:27 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
08:27 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
08:31 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11082> || Speed of tap device <http://forums.openvpn.net/topic7826.html#p11081>
08:37 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11083>
08:37 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Read error: Connection reset by peer]
08:38 < hz0> oh, what is the problem now m8?
08:38 < hz0> m8 did u need to forward traffic from the external address to the local ip too?
08:43 <@vpnHelper> RSS Update - forum: Speed of tap device <http://forums.openvpn.net/topic7826.html#p11085> || Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11084>
08:44 -!- HHELLD [~HHELLD@92.55.24.144] has joined #openvpn
08:48 < orudie> hz0, still there ?
08:49 < HHELLD> Hi, All.  I seem to have an MTU problem with IPv6 but not IPv4 (from Ubuntu over virtualbox's NAT and a LAN to Debian, with openvpn 2.1.0/2.1.3); it also works fine from other hosts on that LAN.  What would be the proper way to configure it?
08:52 < hz0> yup am here
08:52 -!- takamichi [Takamichi@80.71.100.219] has joined #openvpn
08:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:54 < hz0> orudie, did u get anything workin m8?
09:04 -!- takamichi [Takamichi@80.71.100.219] has quit [Ping timeout: 252 seconds]
09:04 < orudie> hz0, nope trying to create certs in debian instead of windows 
09:05 -!- takamichi [~pri@ks357561.kimsufi.com] has joined #openvpn
09:06 < hz0> u think that might be your problem?
09:09 < hz0> what errors are you getting?
09:11 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11087>
09:12 < orudie> failed to update database
09:12 < orudie> TXT_DB error number 2
09:12 < orudie> I see this at the end of ./build-key client1
09:14 < hz0> ur keys have the same cn i reckon
09:14 < hz0> had that prob too
09:17 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:20 -!- Galaxor [~rjhughes@zaxxon.gpcc.itd.umich.edu] has joined #openvpn
09:21 < Galaxor> I get a "connection reset" on my vpn every minute or so.  This is what it says in the log:  Connection reset, restarting [0]
09:21 < Galaxor> What is up with that?
09:21 < Galaxor> This is a tcp connection on port 1149.
09:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:26 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Read error: Connection reset by peer]
09:27 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
09:28 < orudie> hz0, what do you mean by 'ur keys have the same cn i reckon'
09:28 < orudie> hz0, ??
09:35 <@vpnHelper> RSS Update - forum: Native IPv6 support <http://forums.openvpn.net/topic7909.html>
09:46 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:49 -!- EugeneKaway is now known as EugeneKay
09:58 < hz0> orudie
09:58 < hz0> ur server key and client key probably have the same common name
09:58 < hz0> and there's a conflict
09:59 < hz0> that means duplicate key
09:59 < hz0> the error ur getting
10:00 < orudie> okay that worked 
10:00 < orudie> i am now connected 
10:00 < orudie> hz0, but can't ping other hosts
10:05 < orudie> and I can't ping the ip address assigned to client 
10:05 <@vpnHelper> RSS Update - forum: error with creating a new vpn key <http://forums.openvpn.net/topic7904.html#p11089>
10:06 < hz0> srry m8 im preety much stuck myself too
10:07 < orudie> hz0, what are you stuck on ?
10:08 < hz0> i need to forward traffic from my firewall on port 1194 to the vpn server's internal address
10:09 < hz0> and im not sure if it'll work, looking for a workaround
10:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 248 seconds]
10:11 -!- takamichi [~pri@ks357561.kimsufi.com] has quit [Ping timeout: 260 seconds]
10:12 -!- takamichi [Takamichi@80.71.100.219] has joined #openvpn
10:13 < hz0> i just get TLS key negotiation failed to occur within 60 seconds and preety much stuck
10:16 -!- luneff [~yury@84.51.195.188] has joined #openvpn
10:21 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:28 -!- geez [~IceChat7@208.91.15.170] has joined #openvpn
10:30 -!- gladiatr_afk is now known as gladiatr
10:39 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
10:42 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:48 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Quit: Ex-Chat]
10:56 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
10:56 < MrABC> !welcome
10:56 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:56 < MrABC> !paste
10:56 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
10:57 < MrABC> !config
10:57 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
10:57 < MrABC> !logs
10:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
10:57 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
10:57 < MrABC> !configs
10:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
10:58 < pwrcycle> is there a recommended free openvpn client for Android?
10:58 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
10:59 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
11:01 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
11:05 < orudie> in server config I have push "route 192.168.54.0 255.255.255.0" and server 192.168.66.0 255.255.255.0 , but for some reason when a client connects it gets assigned the ip 192.168.66.x instead of 192.168.54.x
11:07 < Bushmills> how is pushing a route supposed to be related to pushing an ip address? 
11:08 < orudie> Bushmills, i'm reading the documentation and it says that with these lines the clients will be assigned IPs according to what this line says 'push "route 192.168.54.0 255.255.255.0" '
11:08 < orudie> so they will get 192.168.54.x
11:09 < Bushmills> where does documentation say that?
11:10 < pmatulis_> is it a known issue for an active tunnel to screw up access to local printer/scanner?  something to do with avahi/mdns?
11:11 < MrABC> When trying to start my server from Openvpn-as I get this error. http://pastebin.com/cdPD7fjY And I cannot start it from terminal because I get a failed message.
11:12 < MrABC> this is my config file http://pastebin.com/8i708x91
11:13 < Bushmills> are you using redirect-gateway in client config? or pushing redirect-gateway from server?
11:13 < MrABC> i dont have a client config set up. 
11:16 < Bushmills> with server stopped, does  output of route command show a default route?
11:17 < MrABC> after doing route it shows http://pastebin.com/GZbbLMkb
11:18 < Bushmills> is that some  openvz or vserver kind of vps?
11:18 < MrABC> openvs
11:18 < MrABC> openvz
11:18 < Bushmills> !openvz
11:18 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
11:19 < orudie> Bushmills, i'm stuck 
11:19 < MrABC> tun should be already enabled
11:19 < MrABC> I cannot enable it
11:19 < MrABC> My provider did it
11:20 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
11:20 < Bushmills> !goal
11:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:20 < Bushmills> orudie: ^^^
11:21 < orudie> Bushmills, I would like to access the lan behind the server
11:21 < Bushmills> MrABC: no idea how to proceed. i picked up that setting up openvpn on openvz can be tricky, but as i don't run openvz, i can't tell you how to solve those problems.
11:22 < Bushmills> orudie: behind server, or behind client?
11:22 < Bushmills> ah. server ...
11:22 < MrABC> okay thank you anyways
11:22 < Bushmills> !serverlan
11:22 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
11:22 < Bushmills> !route
11:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:22 < orudie> Bushmills, my client connects, but I can't ping anything 
11:22 < orudie> !route_outside_openvpn
11:22 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
11:24 < Cubox> u_u
11:24 < Bushmills> MrABC: running openvpn on kvm type vps seems much easier
11:24 < Cubox> i can't nat ... the 2 iptables rule don't work
11:24 < Bushmills> Cubox: how is that an openvpn problem?
11:25 < Cubox> Bushmills: i don't know ... openvpn can help me because i want to nat for openvpn
11:25 < Bushmills> get your iptables working, then those needed for your openvpn setup might work too
11:26 < Bushmills> we also can't fix broken power supplies of computers meant to run openvpn on
11:26 < orudie> Bushmills, so something like this will go into server config ? route add -net 10.8.0.0/24 gw 10.10.2.10
11:26 < orudie> ?
11:27 < Bushmills> even if those computers are intended to be used with openvpn
11:27 < Bushmills> orudie: server config, or client config, or whereever you want that route to be added
11:27 < Bushmills> but not into openvpn config
11:31 < orudie> Bushmills, does this openvpn.config look okay to you ? http://paste.linode.com/5128
11:33 < orudie> Bushmills, with this when a client connects it gets ip 10.10.6.6 is this normal ?
11:33 < Bushmills> config look, at first glimpse, ok
11:33 < orudie> Bushmills, cause my understanding it should get 10.10.6.*
11:33 < Bushmills> yes, clients in 10.10.6.0/24 network are normal
11:35 < orudie> Bushmills, okay, so i'm good here. moving along... Id like to be able to access my other two vlans , which are 10.10.10.1 and 5.5.5.1
11:35 < orudie> Bushmills, at this point I can't ping anything 
11:35 < Bushmills> you should be able to ping server
11:36 < orudie> Bushmills, nope, can't ping server :(
11:37 < Bushmills> then fix that first
11:38 < orudie> Bushmills, what should I check ?
11:39 -!- dvl [~Dan@pdpc/supporter/active/dvl] has quit [Excess Flood]
11:39 < Bushmills> whether client connects, whether a route is set on client for openvpn subnet, whether firewalls on client and server allow pinging 
11:39 < Bushmills> and, of course, both server and client logs
11:40 < Bushmills> essentially, why you can't ping server
11:40 < orudie> Bushmills, i noticed i can ping client from router 
11:41 < orudie> Bushmills, but can't ping server from router 
11:41 < Bushmills> ping client's vpn address?
11:41 < orudie> Bushmills, yup
11:41 < Bushmills> is router a vpn client too?
11:41 < orudie> Bushmills, router is not, router is the vpn server 
11:42 < Bushmills> if a non-vpn device can ping a vpn address, then there is more wrong
11:42 < Bushmills> better start again with the example configs
11:42 < Bushmills> don't use a subnet for vpn which is in use for non-vpn already
11:43 < Bushmills> suggestion:  http://scarydevilmonastery.net/subnet.cgi
11:43 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
11:44 < Bushmills> ehm. router is vpn server. sorry, missed that bit
11:44 < Bushmills> so router *is* a vpn device
11:44 -!- gabrielcz [~gabrielcz@201-251-5-101.static.luronet.com.ar] has joined #openvpn
11:44 < orudie> Bushmills, yes it is 
11:44 < Bushmills> sounds like firewall
11:45 < orudie> Bushmills, its a dd-wrt with openvpn. I also noticed that my public ip address pull breaks when I start OpnVPN Daemon in the router 
11:46 < Bushmills> still sounds like firewall
11:47 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
11:47 < Bushmills> open a ssh console to router, run    watch -n 1 ifconfig -nvL,  then ping from vpn client to vpn server, look which rule experiences hit count updates
11:48 < Katoen> orudie: try switching off the stateful firewall, i think i had the same problem.
11:49 -!- dvl [~Dan@nyi.unixathome.org] has joined #openvpn
11:49 -!- gabrielcz [~gabrielcz@201-251-5-101.static.luronet.com.ar] has quit [Remote host closed the connection]
11:50 < orudie> Katoen, switch off the stateful firewall ?
11:52 < orudie> no output from watch -n 1 ifconfig -nvL when pinging server from client 
11:54 < Katoen> orudie: yep. Security -> Firewall -> Disable
11:54 < Katoen> that is how i 'fixed' the problem
11:57 -!- echoSMIL1 [~censured@bl17-96-116.dsl.telepac.pt] has joined #openvpn
11:57 < pmatulis_> is it a known issue for an active tunnel to screw up access to local printer/scanner?  something to do with avahi/mdns?
11:59 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 248 seconds]
12:31 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:33 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Read error: Connection reset by peer]
12:33 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
12:35 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Read error: Connection reset by peer]
12:35 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
12:38 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:46 -!- zxd_ [~zxd@95.211.21.37] has quit [Ping timeout: 260 seconds]
13:00 <@vpnHelper> RSS Update - forum: Allow only one IP to see all clients <http://forums.openvpn.net/topic7910.html>
13:02 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
13:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:12 -!- smoak [~smoak@c-71-227-249-63.hsd1.wa.comcast.net] has joined #openvpn
13:12 < smoak> !welcome
13:12 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:13 < smoak> !route
13:13 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:13 < smoak> !redirect
13:13 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:15 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
13:16 < smoak> !goal
13:16 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:17 < orudie> Katoen, still there ? when if I disable the firewall, my ip address pull works, but still can't ping vpn server from vpn client or anything else 
13:20 < orudie> does this output from client log look okay? http://paste.linode.com/5129
13:21 < orudie> i'm trying to figure out why i can't ping anything, can't ping the server from vpn client 
13:21 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:29 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:32 -!- paul__ [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
13:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
13:33 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Ping timeout: 248 seconds]
13:38 -!- paul__ [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Quit: Leaving]
13:40 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
13:40 < orudie> i still cant figure out why I can't ping vpn server from vpn client , even though i'm connected 
13:43 < smoak> im going to through this out there as a guess so i could be way off but to me it looks like youre on two networks 10.10.10.0/?? and 10.10.6.0/29
13:43 < smoak> s/through/throw
13:47 < krzee> orudie, 
13:47 < krzee> !configs
13:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
13:47 < krzee> orudie, can server ping client either?
13:48 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:48 < orudie> krzee, openvpn is in the router, i can ping client from router's CLI 
13:48 < orudie> krzee, i'll pastebin everything for you ? 
13:49 < krzee> yep
13:55 -!- echoSMILE [~censured@bl15-208-85.dsl.telepac.pt] has joined #openvpn
13:55 -!- echoSMILE [~censured@bl15-208-85.dsl.telepac.pt] has quit [Changing host]
13:55 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
13:56 -!- echoSMIL1 [~censured@bl17-96-116.dsl.telepac.pt] has quit [Ping timeout: 252 seconds]
13:57 < orudie> krzee, i pasted everything with explanations here http://www.dd-wrt.com/phpBB2/viewtopic.php?p=556196#556196
13:59 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
14:00 < krzee> so server can ping client, client can not ping server?
14:00 < Cubox> Hello, i have a problem to doing nat to my server
14:01 < krzee> Cubox, same problem you have had for a couple days now?
14:01 < Cubox> when i do iptables [...] in iptables -L i don't view the line
14:01 < Cubox> krzee: yes
14:01 < krzee> you should maybe be in #iptables then ;]
14:01 -!- luneff [~yury@84.51.201.89] has joined #openvpn
14:01 < krzee> !linnat
14:01 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
14:02 < Cubox> mmh ...
14:02 < krzee> theres the info again, feel free to get help from #iptables and/or the netfilter manual
14:02 < krzee> since it really has nothing to do with openvpn
14:02 < Cubox> i have flushed the iptables
14:02 < krzee> orudie, so server can ping client, client can not ping server?
14:04 < Cubox> http://img.susepaste.org/24017483
14:05 < krzee> im sure i may have confused you
14:05 < Bushmills> krzee: he doesn't understand
14:06 < krzee> but i was saying that the info you need is above, and feel free to get help in #iptables or the netfilter manual
14:06 < krzee> heh
14:06 < Bushmills> i tried to let him know that that's not an openvpn problem, but it didn't quite get through to gim
14:06 < Bushmills> him
14:06 < krzee> Bushmills, like mini-me in the scene where dr evil tells everyone to leave, then makes exceptions for everyone
14:06 < krzee> except mini-me
14:06 < Bushmills> i think we need to use easier words
14:07 < krzee> !notovpn
14:07 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
14:07 < Bushmills> let me try...
14:07 < Bushmills> Cubox: problem you have - not openvpn
14:07 < Cubox> I know
14:07 < smoak> if i have a physical eth0 is it possible to use a bridge with a different ip than the eth0 with openvpn?
14:07 < Cubox> i am on  #iptables
14:08 < krzee> impossible!
14:08 < krzee> you are on #netfilter
14:08 < Bushmills> rules not show:  iptables problem. not openvpn problem
14:08 < Cubox> krzee: u_u
14:08 < krzee> smoak, im not sure, but before you go further, why do you want to bridge?
14:09 < Cubox> krzee: it's a redirection
14:09 < smoak> i need to access windows shares from the openvpn
14:09 < krzee> Cubox, im aware of that, which is why i knew you are in #netfilter not #iptables
14:09 < krzee> smoak, that does not require a bridge
14:09 < krzee> !tunortap
14:09 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
14:09 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
14:09 < Bushmills> you fix iptables.  then come to openvpn
14:09 < krzee> see #2
14:10 < smoak> ah ok, for some reason i was under the impression i needed to use bridging for windows shares...ill take a look at #2 thanks
14:10 < smoak> !wins
14:10 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
14:10 < krzee> the only part of SMB that is layer2 is the NETBIOS resolution
14:10 < Bushmills> krzee: do you think "fix" was too difficult?
14:10 < krzee> in fact with no wins OR layer2 you could access it by IP
14:10 < krzee> Bushmills, most likely ;]
14:11 < smoak> ah, that may be the way to go thanks
14:11 < krzee> np
14:11 < krzee> ya if by IP is acceptable you need to do nothing
14:12 < krzee> if you want resolution, adding wins to samba is seriously 1 line
14:12 < smoak> ill explore both ways thanks :)
14:12 < krzee> of course that line varies depending on exactly how you want it to work, so its not on the bot =]
14:12 < krzee> np man
14:12 < krzee> is that your whole goal?
14:13 < krzee> just to use shares from within the VPN...?
14:13 < krzee> or do you want lans using eachothers shares
14:13 < smoak> well, my goal is to be able to use the vpn from internet cafes
14:13 < krzee> ahh, secure your inet AND access your lan?
14:13 < smoak> yep
14:13 < krzee> well here ya goes!
14:14 < krzee> !sample
14:14 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:14 < krzee> !redirect
14:14 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:14 < krzee> !route
14:14 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:14 < krzee> OR
14:14 < krzee> !confgen
14:14 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
14:14 < krzee> =]
14:14 < smoak> awesome thanks
14:17 -!- gabrielcz [~gabrielcz@201-251-5-101.static.luronet.com.ar] has joined #openvpn
14:17 -!- gabrielcz [~gabrielcz@201-251-5-101.static.luronet.com.ar] has quit [Remote host closed the connection]
14:17 < Cubox> !routing
14:18 < Cubox> !welcome
14:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:18 < Cubox> !redirect
14:18 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:18 < Cubox> !nat
14:18 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:18 < Cubox> !linnat
14:18 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
14:18 < krzee> !msg
14:18 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key>, or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
14:19 < Cubox> !route
14:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:19 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:19 < Cubox> mmh ...
14:19 < Cubox> !howto
14:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:19 < krzee> Cubox, 
14:19 < krzee> see this instead
14:19 < krzee> !factoids
14:19 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
14:19 < krzee> thats EVERYTHING the bot knows
14:19 < Cubox> ok
14:21 -!- Guifort [~Administr@78.123.161.223] has joined #openvpn
14:27 < krzee> orudie, so server can ping client, client can not ping server?
14:42 -!- dvl [~Dan@nyi.unixathome.org] has quit [Changing host]
14:42 -!- dvl [~Dan@pdpc/supporter/active/dvl] has joined #openvpn
14:44 < smoak> !def1
14:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
14:46 < fipu> Hello
14:47 < fipu> I push my routes with a CCD file. That works perfect with the linux client, but the same config and ccd file does not work with my windows client
14:47 < fipu> it does not get the route. What can be the problem?
14:51 -!- mant1s [~mant1s@cpe-67-253-101-86.maine.res.rr.com] has joined #openvpn
14:51 -!- mant1s [~mant1s@cpe-67-253-101-86.maine.res.rr.com] has quit [Changing host]
14:51 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
14:54 -!- glengoyne [~glengoyne@p4FC2391B.dip.t-dialin.net] has joined #openvpn
14:56 < krzee> do you see the route in the pushed options in the client config?
14:57 < krzee> (in client log i mean)
14:58 < krzee> meh its time for me to leave work and start getting supplies for my party tomorrow
14:58 < krzee> check if you see the route being pushed in the client log, it lists pushed options
14:58 < krzee> also check if the server log shows it importing ccd config options for the client while it connects
14:59 < krzee> likely that you have a typo in ccd filename or something of that sort
14:59 < krzee> bbl
14:59 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:59 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:02 < Bushmills> !winroute
15:02 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
15:02 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
15:02 < Bushmills> fipu: ^^^
15:05 <@vpnHelper> RSS Update - forum: Dazo's writeup for windows rollup <http://forums.openvpn.net/topic4665.html#p11091>
15:06 -!- Galaxor [~rjhughes@zaxxon.gpcc.itd.umich.edu] has left #openvpn []
15:17 <@vpnHelper> RSS Update - forum: Dazo's writeup for windows rollup <http://forums.openvpn.net/topic4665.html#p11092>
15:22 < orudie> krzee, thats right 
15:29 -!- CrazyGir [~jason@unaffiliated/crazygir] has joined #openvpn
15:29 < CrazyGir> hiya! I have been using openvpn for a while and loving it, particularly that i could set it up and not need to worry about it, it just works :)
15:29 < CrazyGir> I am joining a project which also uses openvpn
15:30 < CrazyGir> my question: are there any real issues with havin more than one VPN up, as long as the subnets don't overlap?
15:32 < orudie> krzee, any hints for me ?
15:38 < orudie> hmm. I just connected with a different computer , and it issued the same vpn ip address as in the other client 
15:39 < orudie> what could be wrong ?
15:46 < dkr> CrazyGir: as long as they don't try to modify your default route
15:49 < fipu> krzee: Thanks for that tipps, a wrong typed command in CCD file is not possible because exact the same file works with the Linux client. But I'm going to check all logs tomorrow and ask you again if I find something special :)
15:49 < fipu> thanks and good night
15:52 < mete> möngiiiii!
15:53 < mete> es isch eifach das ganze openvpn so richtig möngi! ich glaube mir bruchet master ipsec!
15:53 < hyper_ch> mete: please use english in this channel
15:55 < mete> sorry hyper_ch!
15:58 -!- joren_ [~j@199.223.122.146] has quit [Ping timeout: 246 seconds]
15:58 -!- joren_ [~j@173-12-163-81-oregon.hfc.comcastbusiness.net] has joined #openvpn
16:00 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Quit: Leaving]
16:05 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:06 -!- glengoyne [~glengoyne@p4FC2391B.dip.t-dialin.net] has quit [Quit: Verlassend]
16:13 < CrazyGir> dkr: ok, that would be on my side though, no?
16:13 < CrazyGir> as in, I get to say so in the config
16:17 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 248 seconds]
16:25 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
16:38 -!- geez [~IceChat7@208.91.15.170] has quit [Quit: The early bird may get the worm, but the second mouse gets the cheese]
16:41 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has joined #openvpn
16:42 < orudie> going back to my 'can't ping server from client, but can ping client from server' issue. Can anyone give me a hint on where the problem could be ?
16:48 < orudie> I finally figured out certs and keys, got to the point where openvpn client establishes connection with openvpn server, however, I can't ping anything from the client, can't even ping vpn server. Any ideas ?  
17:10 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:19 < orudie> anyone help poor orudie ?
17:33 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has joined #openvpn
17:37 -!- dazo is now known as dazo_afk
17:57 <@vpnHelper> RSS Update - forum: OpenVPN over IPsec? <http://forums.openvpn.net/topic7903.html#p11093>
17:59 < orudie> if my openvpn is installed on the router, and the router's LAN ip is 10.10.10.1, so then push routh should be 'push "route 10.10.10.1 255.255.255.0"' , with the same ip as the router's ip ?
18:01 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
18:04 < smoak> no
18:04 < smoak> you want push route 10.10.10.0 255.255.255.0
18:05 < smoak> thatll push a route for the 10.10.10.0/24 network down to the clients so they can route traffic over the vpn
18:06 < orudie> smoak, and server ip ?
18:07 < smoak> is your server in the LAN behind the vpn?
18:07 < orudie> smoak, the vpn server is in the router 
18:08 < smoak> oh ok, your push route should only be the networks you want clients to have access to, it sounds like behind your router you have a 10.10.10.0/24 network so thats what you want to push down to your clients
18:09 -!- gyyrog_ [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has joined #openvpn
18:09 < smoak> !routing
18:09 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
18:09 < smoak> !route
18:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:09 < smoak> see #1
18:14 < orudie> smoak, apreciate your help, my router's ip is 10.10.10.1 and this is where vpn server is installed, so what would be a good choice for push route and server's ip in this situation ?
18:15 < orudie> smoak, the vpn is installed on the router who's ip is 10.10.10.1 
18:16 < smoak> in your server config, youll have local 10.10.10.1 and then push "route 10.10.10.0 255.255.255.0"
18:19 < orudie> smoak, and server ?
18:21 < smoak> server 10.8.0.0 255.255.255.0
18:22 < smoak> that will assign clients ip addresses from the 10.8.0.0/24 network
18:31 < orudie> smoak, everything looks good on the server side now, but can't connect with a client 
18:32 < smoak> whats the client ip?
18:32 < smoak> can you post the server and client configs?
18:33 < orudie> smoak, sure just a sec, let me paste that 
18:39 < orudie> smoak, pasted everything here http://www.dd-wrt.com/phpBB2/viewtopic.php?p=556196#556196
18:43 < orudie> my understanding this is a firewall issue, though i changed the firewall rule to the new vpn server's ip address with /usr/sbin/iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
18:43 < orudie> /usr/sbin/iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT
18:44 < smoak> the client log shows TLS hanshake failed...i dont see the tls-auth parameter in the server or cleint configs though
18:45 < orudie> smoak, tail of server log is silent when I try to connect 
18:46 < orudie> smoak, this same client config worked before I changed the ip addresses the way you advised 
18:49 < smoak> what is the clients ip when disconnected from the vpn?
18:49 -!- luneff [~yury@84.51.201.89] has quit [Quit: Leaving]
18:50 < orudie> smoak, client's IP ? I don't even get to the point where the client gets the IP 
18:50 < smoak> i dont mean the ip from the vpn
18:51 < orudie> smoak, which ip then ? i'm trying to connect from the outside 
18:51 < orudie> smoak, the server's public ip is different from client's public ip 
18:51 < smoak> ok
18:52 < smoak> is there a firewall on the server and the client?
18:53 < orudie> there is a firewall but i created rules for port 1194 
18:53 < toortog> hello crazy vpn people :]
18:54 < orudie> toortog, sup
18:54 < toortog> not much just got home from work
18:56 < smoak> what is your goal with this setup?
18:59 < orudie> smoak, file and printer sharing of vpn clients with two more existing LANs
19:00 < toortog> orudie you need tap not tun for that
19:00 < toortog> tun does not do broadcast packets
19:01 < smoak> youll have to help him out with that then ;)
19:01 < orudie> smoak, you give up ? :) 
19:01 < toortog> smoak i got this :]
19:01 < orudie> guys please help me, i've been on this entire week 
19:01 < orudie> its beating me up 
19:01 < smoak> if youre going the routed route i could help :P
19:01 < smoak> but i dont do bridging :P
19:02 < orudie> btw, the two existing vlans are not bridged, and interestingly with some magic powers of dd-wrt , both vlans can access each other's files 
19:03 -!- joren_ [~j@173-12-163-81-oregon.hfc.comcastbusiness.net] has quit [Quit: Leaving]
19:04 < smoak> are you forwarding traffic from your public ip port 1194 to 10.10.10.1?
19:09 -!- smoak [~smoak@c-71-227-249-63.hsd1.wa.comcast.net] has quit [Quit: WeeChat 0.3.4]
20:09 -!- xal [~xal@190.194.61.111] has joined #openvpn
20:10 < xal> hi
20:10 < xal> i've been trying to figure out something forever and never managed to do it...
20:11 < xal> how can I prevent openvpn client (or from the server) from setting a default gateway and instead just set a route for the network I'm connecting to (ie 192.168.1.0)
20:12 < xal> can anybody point me in the right direction?
20:13 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
20:19 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
20:43 -!- xal [~xal@190.194.61.111] has quit []
21:30 <@vpnHelper> RSS Update - forum: Seperate Certificate Issuer machine and OpenVPN server <http://forums.openvpn.net/topic7911.html>
22:10 -!- EugeneKay is now known as EugeneKaway
22:12 -!- master_of_master [~master_of@p57B571A3.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
22:14 -!- master_of_master [~master_of@p57B574F0.dip.t-dialin.net] has joined #openvpn
22:24 -!- siplux [~siplux@c-24-5-86-90.hsd1.ca.comcast.net] has joined #openvpn
22:38 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:02 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
23:05 < siplux> Is the correct behavior for openvpn to start one daemon for each .conf (in my case one server and one client) file under /etc/openvpn (this is on debian)?
23:08 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:10 < AndrewX192> Bushmills: I fixed it - added push dns
23:12 <@vpnHelper> RSS Update - forum: trouble with openvpn <http://forums.openvpn.net/topic7912.html>
23:27 -!- takamichi [Takamichi@80.71.100.219] has quit [Ping timeout: 240 seconds]
23:29 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 258 seconds]
23:45 < siplux> ah I guess client configs need to go in /client
--- Day changed Fri Apr 08 2011
00:11 -!- toortog [nesm6@notsecure.net] has quit [Ping timeout: 252 seconds]
00:34 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
00:35 -!- gyyrog_ [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:36 -!- Guifort [~Administr@78.123.161.223] has quit [Ping timeout: 248 seconds]
00:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
00:56 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
00:58 -!- dazo_afk is now known as dazo
01:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
01:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:07 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Remote host closed the connection]
01:20 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:26 < hyper_ch> krzee: http://www.theregister.co.uk/2011/04/08/open_compute_server_comment/
01:26 <@vpnHelper> Title: Facebook's open hardware: Does it compute? • The Register (at www.theregister.co.uk)
01:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
01:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:48 <@vpnHelper> RSS Update - forum: How to increace the data transfer rate in openvpn <http://forums.openvpn.net/topic7913.html>
01:50 -!- siplux [~siplux@c-24-5-86-90.hsd1.ca.comcast.net] has left #openvpn ["WeeChat 0.3.4"]
01:54 <@vpnHelper> RSS Update - forum: error with creating a new vpn key <http://forums.openvpn.net/topic7904.html#p11097>
02:00 <@vpnHelper> RSS Update - forum: Seperate Certificate Issuer machine and OpenVPN server <http://forums.openvpn.net/topic7911.html#p11099> || trouble with openvpn <http://forums.openvpn.net/topic7912.html#p11098>
02:06 <@vpnHelper> RSS Update - forum: Allow only one IP to see all clients <http://forums.openvpn.net/topic7910.html#p11100>
02:09 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
02:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:14 -!- toortog [nesm6@notsecure.net] has joined #openvpn
02:41 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
02:44 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
03:03 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:03 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:07 <@vpnHelper> RSS Update - forum: Windows TAP Interface does not get assigned IP address <http://forums.openvpn.net/topic7914.html>
03:31 -!- HHELLD [~HHELLD@92.55.24.144] has left #openvpn []
03:41 -!- cmur2 [~quassel@static.63.239.63.178.clients.your-server.de] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
03:53 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 240 seconds]
03:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:01 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
04:13 < Bushmills> AndrewX192: i didn't suggest that because you explicitely stated that you wanted to change the client config.
04:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:23 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 252 seconds]
04:25 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
04:29 <@vpnHelper> RSS Update - forum: SQL server only visible when firewall rule set to public <http://forums.openvpn.net/topic7905.html#p11102>
04:36 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
04:38 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 252 seconds]
04:39 -!- twister004_ is now known as twister004
04:53 -!- twister004 [~chatzilla@59.90.34.167] has quit [Read error: Connection reset by peer]
04:53 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:55 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
04:59 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
05:23 <@vpnHelper> RSS Update - forum: OpenVPN over IPsec? <http://forums.openvpn.net/topic7903.html#p11104> || Native IPv6 support <http://forums.openvpn.net/topic7909.html#p11103>
05:23 -!- twister004_ [~chatzilla@117.207.244.51] has joined #openvpn
05:23 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 252 seconds]
05:24 -!- twister004_ is now known as twister004
05:25 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
05:29 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
05:29 <@vpnHelper> RSS Update - forum: Connecting OK, but no network whatsoever after that <http://forums.openvpn.net/topic7907.html#p11105>
05:30 -!- twister004 [~chatzilla@117.207.244.51] has quit [Ping timeout: 240 seconds]
05:30 -!- twister004_ is now known as twister004
05:35 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html>
05:49 -!- twister004_ [~chatzilla@117.207.244.51] has joined #openvpn
05:50 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 246 seconds]
05:50 -!- twister004_ is now known as twister004
05:56 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:56 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:05 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11107>
06:17 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11108>
06:22 -!- twister004_ [~chatzilla@117.207.244.51] has joined #openvpn
06:22 -!- twister004 [~chatzilla@117.207.244.51] has quit [Read error: Connection reset by peer]
06:23 -!- twister004_ is now known as twister004
06:30 -!- b4ggi0 [~Patrick@59.151.39.140] has quit [Quit: Leaving]
06:31 -!- EugeneKaway is now known as EugeneKay
06:33 <@vpnHelper> RSS Update - forum: bind or lport not working. windows 7 64bit <http://forums.openvpn.net/topic7908.html#p11109>
06:40 -!- twister004 [~chatzilla@117.207.244.51] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
06:45 <@vpnHelper> RSS Update - forum: trouble with openvpn <http://forums.openvpn.net/topic7912.html#p11110>
06:58 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
07:03 <@vpnHelper> RSS Update - forum: bind or lport not working. windows 7 64bit <http://forums.openvpn.net/topic7908.html#p11111>
07:09 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11112>
07:13 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
07:32 -!- f1assistance [~Carl@cpe-065-190-152-063.nc.res.rr.com] has left #openvpn []
07:33 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
07:36 -!- raomin [~romain@86.66.22.240] has joined #openvpn
07:37 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:37 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:39 <@vpnHelper> RSS Update - forum: Client configuration incident ? <http://forums.openvpn.net/topic7906.html#p11115> || Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11114> || Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p11113>
07:45 <@vpnHelper> RSS Update - forum: TLS over UDP <http://forums.openvpn.net/topic7880.html#p11116>
07:57 <@vpnHelper> RSS Update - forum: Allow only one IP to see all clients <http://forums.openvpn.net/topic7910.html#p11117>
08:21 -!- MarKsaitis_ [~MarKsaiti@sherborne-adsl.demon.co.uk] has joined #openvpn
08:23 -!- MarKsaitis [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Ping timeout: 246 seconds]
08:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:27 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11118>
08:33 <@vpnHelper> RSS Update - forum: Please help me on vpn server setup on RHEL5 workstation <http://forums.openvpn.net/topic7877.html#p11119>
08:39 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
08:52 -!- skyweb [~skyweb@host90-110-dynamic.7-87-r.retail.telecomitalia.it] has joined #openvpn
08:57 -!- skyweb [~skyweb@host90-110-dynamic.7-87-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
09:03 -!- skyweb [~skyweb@host154-8-dynamic.17-87-r.retail.telecomitalia.it] has joined #openvpn
09:05 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
09:05 < crocket> I want to push --fragment and --mssfix options only to one client
09:05 < crocket> Can I do this?
09:06 < crocket> Can the server fragment packets headed only for one client and send unfragmented packets headed for others?
09:07 < crocket> Or should the server send fragmented packets to all clients if one client needs fragmented packets?
09:12 -!- skyweb [~skyweb@host154-8-dynamic.17-87-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
09:15 < gladiatr> crocket, from what I know, the server and client need to be in sync regarding mtu, fragment sizes, etc.
09:15 < crocket> gladiatr, I know
09:16 < crocket> gladiatr, Can the server use two different sets of settings for two different clients?
09:16 < gladiatr> no
09:16 < crocket> gladiatr, I want the server to exchange unfragmented packets with one client and fragmented packets with another.
09:16 < gladiatr> you need to setup an additional server process then.
09:17 < crocket> gladiatr, That's a hassle.
09:17 < gladiatr> Indeed
09:17 < crocket> gladiatr, I think path MTU discovery is broken.
09:17 < crocket> mtu-test told MTU to be 1541.
09:18 < crocket> It's impossible.
09:18 -!- skyweb [~skyweb@host151-245-dynamic.117-80-r.retail.telecomitalia.it] has joined #openvpn
09:19 < gladiatr> ok
09:23 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
09:36 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:38 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:41 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
09:41 -!- dazo is now known as dazo_afk
09:42 < crocket> Can fragment and mssfix be pushed to clients?
09:44 < gladiatr> Hrm... not sure.  The man page specifies a "partial list" of options that can be pushed, but that's rather vague.  I'd just give it a try on a test system.  Make sure your logging on the client is set to at least verb 4 and you'll be able to see whether or not the option is reaching the client
09:48 < crocket> gladiatr, ok
09:48 < crocket> gladiatr, Are you a developer of OpenVPN?
09:54 -!- skyweb [~skyweb@host151-245-dynamic.117-80-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
09:56 < ecrist> no, he's not
09:57 < ecrist> crocket: what was the output of mtu-test?
09:57 < ecrist> 1541/1541?
09:58 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.5-dev"]
09:58 < crocket> yes
09:58 < ecrist> crocket: http://openvpn.net/archive/openvpn-users/2005-05/msg00241.html
09:58 < crocket> ecrist, That's impossible.
09:58 <@vpnHelper> Title: Re: [Openvpn-users] --mtu-test question (at openvpn.net)
09:58 < ecrist> that may shed some light
09:59 < ecrist> and that was written by the guy who wrote the code.
09:59 < ecrist> ;)
09:59 < ecrist> !mtu
09:59 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
09:59 < ecrist> that was written by EmperorTom and should be of some use to you, as well.
10:00 < ecrist> specifically #2
10:00 -!- skyweb [~skyweb@host205-231-dynamic.2-87-r.retail.telecomitalia.it] has joined #openvpn
10:03 < crocket> ok
10:09 < crocket> ecrist, This traffic congestion problem happens after I transfer 100~200MBytes over NFS at 4~6MBytes/s
10:09 < crocket> in UDP mode.
10:13 < crocket> Should I set --mtu-disc to yes to discover the real MTU?
10:23 < ecrist> you can try that, yes
10:30 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
10:33 -!- raomin [~romain@86.66.22.240] has quit [Quit: leaving...]
10:34 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
10:42 -!- MarKsaitis_ [~MarKsaiti@sherborne-adsl.demon.co.uk] has quit [Ping timeout: 252 seconds]
10:44 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11120>
10:44 -!- skyweb [~skyweb@host205-231-dynamic.2-87-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
10:46 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:51 -!- skyweb [~skyweb@host144-119-dynamic.20-87-r.retail.telecomitalia.it] has joined #openvpn
10:52 -!- teloniusz [goldie@inferno.hell.pl] has joined #openvpn
10:52 < teloniusz> !welcome
10:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:53 < teloniusz> !goal
10:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:53 -!- raomin [~romain@86.66.22.240] has joined #openvpn
10:56 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11121>
10:56 < teloniusz> Hi. Strange problem: I've configured my VPN successfully: tap device on openwrt server (TCP) bridged with physical if, linear IP pool, client-to-client, several clients, some of them bridging their TAPs too.
10:57 < teloniusz> But when I do ssh from one client to the other (linux to linux), TCP connection gets reset after some time
10:57 < teloniusz> sometimes even before session is initiated
11:00 < teloniusz> it hangs too once for a while
11:01 < teloniusz> I tried to use tcpdump/tshark on the server/clients to investigate, but with no results
11:02 < teloniusz> Is there a way to debug communication specifically between two clients?
11:15 -!- EugeneKay is now known as EugeneKaway
11:17 -!- skyweb [~skyweb@host144-119-dynamic.20-87-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
11:17 -!- EugeneKaway is now known as EugeneKay
11:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
11:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
11:23 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
11:24 -!- skyweb [~skyweb@host192-118-dynamic.10-87-r.retail.telecomitalia.it] has joined #openvpn
11:28 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
11:28 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
11:28 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
11:28 -!- skyweb [~skyweb@host192-118-dynamic.10-87-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
11:34 -!- skyweb [~skyweb@host232-14-dynamic.2-79-r.retail.telecomitalia.it] has joined #openvpn
11:42 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
11:53 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
11:56 <@vpnHelper> RSS Update - forum: Client configuration incident ? <http://forums.openvpn.net/topic7906.html#p11122>
11:59 -!- oru_work [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
11:59 < oru_work> greetings. I'm trying to create a new key for client. But I get message The correct version should have a comment that says: easy-rsa version 2.x
12:00 < oru_work> root@debiancrm:/usr/share/doc/openvpn/examples/easy-rsa/2.0# ./build-key clientabeelgo
12:00 < oru_work> pkitool: KEY_CONFIG (set by the ./vars script) is pointing to the wrong
12:00 < oru_work> version of openssl.cnf: /usr/share/doc/openvpn/examples/easy-rsa/1.0/openssl.cnf
12:00 < oru_work> The correct version should have a comment that says: easy-rsa version 2.x
12:08 -!- jake_stone_fl [~jakestone@pool-71-98-208-48.tampfl.dsl-w.verizon.net] has joined #openvpn
12:17 -!- echoSMIL1 [~censured@bl17-75-47.dsl.telepac.pt] has joined #openvpn
12:18 -!- L33 [~lee@li140-167.members.linode.com] has joined #openvpn
12:18 < L33> !welcome
12:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:18 < L33> !goal
12:18 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:19 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 260 seconds]
12:33 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
12:36 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:36 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:39 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:39 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
12:40 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
12:44 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
12:50 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
12:56 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
13:03 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
13:06 < teloniusz> If anyone's interested, it WAS my firewall problem. It seems that linux firewall stops recognizing bridged packets as related/established somehow, thus the general rule '-m state --state RELATED,ESTABLISHED -j ACCEPT' weren't enough.
13:06 < teloniusz> A new rule like '-i bridge-if -o bridge-if -j ACCEPT' helped.
13:13 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
13:20 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
13:22 < ecrist> and /topic strikes again!
13:22 < ecrist> muahahaha
13:26 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
13:28 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
13:29 < teloniusz> ecrist: still, I'd call it a bug, not a misconfiguration :P
13:29 < ecrist> heh
13:29 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
13:31 < krzie> lol
13:32 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
13:43 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
13:43 -!- Sky[x] [~SkyB0x@213.143.82.45] has joined #openvpn
13:44 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
13:44 -!- mirco_ is now known as mirco
13:50 -!- echoSMIL1 [~censured@bl17-75-47.dsl.telepac.pt] has quit [Changing host]
13:50 -!- echoSMIL1 [~censured@unaffiliated/echosmile] has joined #openvpn
13:51 -!- echoSMIL1 is now known as echoSMILE
13:55 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
13:57 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
13:57 -!- mirco_ is now known as mirco
14:02 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
14:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:03 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
14:03 -!- mirco_ is now known as mirco
14:12 -!- jake_stone_fl [~jakestone@pool-71-98-208-48.tampfl.dsl-w.verizon.net] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
14:14 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
14:15 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
14:19 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
14:20 -!- gabrielcz [~gabrielcz@190.190.32.110] has quit [Read error: Connection reset by peer]
14:21 -!- gabrielcz [~gabrielcz@190.190.32.110] has joined #openvpn
14:22 -!- gabrielcz [~gabrielcz@190.190.32.110] has quit [Remote host closed the connection]
14:25 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has quit [Quit: leaving]
14:26 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
14:26 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
14:28 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
14:28 -!- mirco_ is now known as mirco
14:28 -!- ajbelayer [~aaron@24.9.123.167] has joined #openvpn
14:40 < pmatulis_> is a tunnel known to mess up mdns locally (access to printer/scanner)?
14:44 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 252 seconds]
14:53 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
14:56 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
14:57 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
14:58 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
14:58 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
15:01 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
15:02 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
15:07 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
15:09 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
15:12 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
15:12 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
15:13 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
15:23 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
15:28 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
15:28 -!- jake_stone_fl [~jakestone@pool-71-98-208-48.tampfl.dsl-w.verizon.net] has joined #openvpn
15:29 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
15:31 <@vpnHelper> RSS Update - forum: DNS issue: can lookup but not use <http://forums.openvpn.net/topic7916.html>
15:33 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
15:34 -!- havoc [~havoc@neptune.chaillet.net] has quit [Client Quit]
15:35 -!- havoc [~havoc@208.87.120.111] has joined #openvpn
15:38 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
15:38 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
15:38 -!- mirco_ is now known as mirco
15:41 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
15:41 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
15:43 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Remote host closed the connection]
15:46 < fipu> krzee: So, I checked the logfiles. There is nothing written about the route that should be pushed to the windows client
15:47 < fipu> with the linux client it works with the same ccd file...
15:47 < fipu> and route-method exe doe also not work
15:47 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:47 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
15:48 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
15:49 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
15:50 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
15:50 -!- mirco_ is now known as mirco
15:50 < fipu> I use a ccd file to push a route to my client. With the linux client it works perfectly, but the same file does not work with my Windows Client
15:50 < fipu> can someone help me?
15:51 < fipu> The route is not pushed to the windows client
15:51 < Bushmills> !winroute
15:51 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
15:51 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
15:51 < fipu> there is nothing written in the logfiles, and I already tried route-method exe
15:52 -!- jake_stone_fl [~jakestone@pool-71-98-208-48.tampfl.dsl-w.verizon.net] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
15:54 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
15:55 < fipu> Bushmills: mmmhhhh, strange
15:56 < fipu> it does work after I waited about 5 minutes and then I reconnected again...
15:56 < fipu> But I didn't change anything in the config file
15:56 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
15:56 -!- havoc__ [~havoc@neptune.chaillet.net] has quit [Client Quit]
15:56 < fipu> and I already reconnected very often. Is it possible that I have to wait for the UDP timeout?
15:57 -!- Sky[x] [~SkyB0x@213.143.82.45] has quit [Ping timeout: 276 seconds]
15:57 < Bushmills> "is not  pushed" . .. no PUSH_REPLY in server log?
15:58 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
16:00 < majuk> Hey guys. I did a bad, bad thing and I need a hand.
16:00 < majuk> Generated a new ca over my old ca
16:00 -!- oru_work [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Quit: бэм бэм бэм бэм бэм бэм бэм бля !]
16:00 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
16:00 < majuk> I still have the old .crt
16:01 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
16:02 < majuk> Now new client certs I generate don't connect. >.<
16:02 < majuk> self-signed cert
16:03 < majuk> And if I use the old ca.crt for the clients, server complains VERIFY ERROR: depth=0, error=unable to get local issuer certificate
16:03 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
16:03 < majuk> Please help, I'm gonna start crying soon.
16:04 < majuk> D:
16:04 < Bushmills> did you copy new ca.crt file to clients?
16:04 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
16:05 < majuk> Bushmills, No.
16:05 < majuk> Not old client
16:05 < majuk> s
16:05 < Bushmills> but to new clients?
16:05 < majuk> New clients complain about self-signed cert if I use the new ca.crt
16:06 < majuk> OH
16:06 < majuk> Ok, my old files should still be on the other ca I used to generate the old CA
16:06 < majuk> Whew.
16:11 < fipu> Bushmills: Now I get it :)
16:11 < fipu> but not before...
16:11 < fipu> only after waiting about 5 minutes and then I reconnected
16:11 < fipu> and now it works perfectly
16:11 -!- havoc [~havoc@208.87.120.111] has quit [Quit: brb]
16:11 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
16:13 -!- havoc [~havoc@neptune.chaillet.net] has quit [Client Quit]
16:14 -!- havoc [~havoc@208.87.120.111] has joined #openvpn
16:17 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
16:17 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
16:18 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
16:22 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
16:22 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 276 seconds]
16:29 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
16:33 < majuk> zomg fixed. I am having heart palpitations.
16:34 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 246 seconds]
16:36 -!- echoSMILE [~censured@bl17-106-187.dsl.telepac.pt] has joined #openvpn
16:36 -!- echoSMILE [~censured@bl17-106-187.dsl.telepac.pt] has quit [Changing host]
16:36 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
16:37 -!- luneff [~yury@84.51.192.6] has joined #openvpn
16:38 -!- dazo_afk is now known as dazo
16:48 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
16:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:58 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:06 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
17:10 -!- EugeneKay is now known as EugeneKaway
17:11 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11124>
17:11 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
17:17 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 246 seconds]
17:17 <@vpnHelper> RSS Update - forum: DNS issue: can lookup but not use <http://forums.openvpn.net/topic7916.html#p11125>
17:22 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has joined #openvpn
17:23 < wolfric> From the example tun server conf, what makes the server 10.8.0.1 (the 1 part)
17:23 < wolfric> I don't see any reference to it in the conf other than "server 10.8.0.0 255.255.255.0
17:25 < wolfric> and the comments stating the server takes .1 for itself. Is this the default then? the server takes the first address in any range?
17:30 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
17:35 <@vpnHelper> RSS Update - forum: bind or lport not working. windows 7 64bit <http://forums.openvpn.net/topic7908.html#p11126>
17:39 < Bushmills>  net is 10.8.0.0, therefore  10.8.0.1
17:41 < Bushmills> you could try  10.8.0.64 for net, and 255.255.255.192 for netmask, should give server 10.8.0.65.  haven't tested that with openvpn, though.
17:44 -!- EugeneKaway is now known as EugeneKay
17:49 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
17:51 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
17:57 -!- skyweb [~skyweb@host232-14-dynamic.2-79-r.retail.telecomitalia.it] has left #openvpn []
18:12 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
18:17 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
18:25 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
18:26 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
18:26 -!- mirco_ [~mirco@p5B23ADE8.dip.t-dialin.net] has joined #openvpn
18:27 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
18:27 -!- mirco_ is now known as mirco
18:39 -!- dazo is now known as dazo_afk
18:50 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
18:58 -!- EugeneKay is now known as EugeneKaway
18:59 -!- EugeneKaway is now known as EugeneKay
19:19 < crocket> I don't use a self-signed cert.
19:20 < crocket> I create a certificate authority and sign a certiicate with it.
19:20 < crocket> certificate
19:43 -!- ajbelayer [~aaron@24.9.123.167] has quit [Quit: Leaving.]
19:43 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
19:48 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 276 seconds]
20:45 -!- EugeneKay [EugeneKay@kashpureff.com] has quit [Read error: Connection reset by peer]
20:46 -!- EugeneKay [EugeneKay@jedediahsmith.kashpureff.com] has joined #openvpn
20:51 -!- genlight [~genlight@222.127.246.15] has joined #openvpn
20:53 < genlight> my vpn is blocked. tcp 80. how can I make it work again.
21:01 -!- mirco_ [~mirco@p5B23CDFC.dip.t-dialin.net] has joined #openvpn
21:02 -!- mirco [~mirco@p5B23ADE8.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
21:02 -!- mirco_ is now known as mirco
21:03 < genlight> Sir krzee can you please help me here
21:10 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 276 seconds]
21:15 < genlight> Anyone!
21:16 < Bushmills> "unblock" port 80, or use a different port
21:19 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
21:25 < genlight> bushmills what other ports can i use for openvpn communication
21:26 < genlight> aside from port 80? 
21:26 < EugeneKay> Whatever port you like
21:26 < Bushmills> any which isn't in use.  and even those you can, with a bit of extra configuration
21:26 < EugeneKay> A common one for bypassing firewalls is UDP 53, in place of DNS traffic
21:27 < genlight> ok I have taken note of udp 53. whats with udp 53? how about 1194?
21:28 < Bushmills> if it works for you, sure.
21:29 < genlight> So I will just try each port bushmills if what port will work for me?
21:29 < genlight> like if I choose 2000, is that possible too?
21:30 < Bushmills> yes, possible. either udp or tcp
21:30 < genlight> Can I just create many server configurations with each different ports so I if I test that with the client, I can test them one after another.
21:31 < Bushmills> too much effort.
21:33 < Bushmills> check out netcat. put a listener on one side, send to it with a talker on the other side
21:33 < genlight> ah ok. anyway, I have look on google about port 53 and it says that port is for domain name server.  arent we using port that are for http/https/www ?
21:33 < Bushmills> or listen with tcpdump on one side
21:34 < Bushmills> do you run a name server?
21:34 < genlight> no sir. im just creating a vpn.
21:34 < Bushmills> then there's nothing listening on port 53
21:35 < genlight> eugenekay suggested to use port 53. so I looked it up on google what is port 53.  So there are just few ports for vpn is that right?
21:35 < EugeneKay> You can use whatever port you feel like
21:35 < Bushmills> (04:26:18) EugeneKay: Whatever port you like
21:35 < EugeneKay> 53 is one that is commonly open, and people usually won't block it
21:36 < genlight> wont block it? why?
21:37 < EugeneKay> Because it's necessary to proper functioning of the DNS system :-p
21:37 < genlight> i see. but what about port 80. why can they block port 80?
21:37 < EugeneKay> UDP 80 I can see
21:38 < genlight> why can they block port 80? isnt port 80 also necessary?
21:39 < Bushmills> nope
21:40 < genlight> port 80 is not necessary?
21:40 < Bushmills> do you run a service on udp/80?
21:42 < genlight> just tcp 80 sir
21:42 < Bushmills> are you using a service on udp/80? 
21:44 < genlight> no sir. I have none running on udp/80. just openvpn on tcp80
21:44 < Bushmills> if you neither offer nor use a service on udp/80, it is obviously not necessary
21:44 -!- EugeneKay [EugeneKay@jedediahsmith.kashpureff.com] has left #openvpn ["Leaving"]
21:46 < genlight> what I meant sir is that since port 80 can be blocked by the isp then port 80 is not necessary for the isp but port 53 is necessary. I am getting that correctly sir?
21:47 < Bushmills> without your machine using a service on port 53, it can't comfortably resolve host names to ip addresses
21:49 < Bushmills> if provider is evil, it allows your machine to talk only to his service on port 53, and to no other
21:51 < genlight> so my server and client port that I should use it protocol tcp and port 53 so that I can make a vpn connection again?
21:51 < Bushmills> if that works for you
21:52 < genlight> ok. thanks sir.
21:53 < genlight> I have follow up question sir. Can the ISP block the IP Address or just the port used?
21:53 < Bushmills> (04:26:32) EugeneKay: A common one for bypassing firewalls is UDP 53, in place of DNS traffic
21:53 < genlight> I have a follow-up question above your reply sir.
21:53 < Bushmills> ISP can block either.  
21:54 < genlight> really? Is there an easier way to find out if my ip is blocking my ip or port sir?
21:54 < Bushmills> but not many are that fascist
21:56 < genlight> I am having problem with my isp, I guess they are blocking my ip or port sir. That is why I am having all these questions.
21:56 < Bushmills> no. if it is blocked, it is blocked. whether it's by ip address or by port, you can only determine by comparison. probe other systems in the same net/behind the same router.
21:58 < Bushmills> (from the outside)
21:58 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has quit [Quit: Leaving]
21:58 < genlight> how is that done sir. I just know with my colleagues that they are also blocked
21:59 < Bushmills> packet filters
22:00 < genlight> in linux? can you show me how sir. I am not good at it. is that available in google.
22:00 < Bushmills> if you're "blocked" - how come you can use IRC?
22:00 < genlight> im in the net cafe researching for answer sir.
22:01 < Bushmills> if provider blocked you completely, you may have forgotten to pay
22:02 < genlight> what do you mean completely sir? do you mean all the ports available for me is blocked? or my ip is blocked?
22:03 < Bushmills> "find out if my ip is blocking my ip or port" ...
22:03 < Bushmills> if your ip address is blocked, you're cut off
22:04 < genlight> I see. 
22:05 < genlight> so I have have to test if changing and testing the ports are unsuccessfylul then the cause of my blocked connection is due to my ip address.
22:06 < Bushmills> well.. it could also be faulty openvpn configs 
22:08 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
22:09 < genlight> my configs are just fine sir. they are working before this blocking began.
22:11 -!- master_of_master [~master_of@p57B574F0.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
22:13 -!- master_of_master [~master_of@p57B5730B.dip.t-dialin.net] has joined #openvpn
22:17 < genlight> thanks again bushmills, everyone who help me today. thanks. :)
22:17 -!- genlight [~genlight@222.127.246.15] has quit []
22:23 -!- bigon [bigon@ubuntu/member/bigon] has quit [Ping timeout: 248 seconds]
22:35 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
22:35 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
22:35 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
22:38 -!- genlight [~genlight@222.127.246.15] has joined #openvpn
22:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
22:40 < genlight> hello everyone again. bushmills I have follow-up question please. I know this one vpn provider running under tcp80 we are in the same ISP. The connection is established but cannot connect to the internet but beforehand, using their vpn, we can connect to the internet. 
22:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:04 < genlight> anyone please!
23:28 -!- genlight [~genlight@222.127.246.15] has quit []
23:30 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has joined #openvpn
23:58 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
--- Day changed Sat Apr 09 2011
00:25 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:25 -!- mode/#openvpn [+o mattock] by ChanServ
00:29 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
00:30 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Ping timeout: 260 seconds]
01:18 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
01:18 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
01:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
01:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 240 seconds]
01:25 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
01:28 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
01:35 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
01:35 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
01:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
01:41 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
01:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:46 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
02:07 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
02:49 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
03:29 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
04:02 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Remote host closed the connection]
04:03 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
04:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:31 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11127>
05:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:05 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
06:36 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has joined #openvpn
06:42 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
06:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
06:54 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
07:13 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
07:15 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has joined #openvpn
07:33 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 260 seconds]
07:33 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
07:35 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Read error: Operation timed out]
07:38 -!- luneff [~yury@84.51.192.6] has joined #openvpn
07:40 -!- Fleck [~we@unaffiliated/fleck] has joined #openvpn
07:40 < Fleck> help, i am stuck :D
07:40 < Fleck> VERIFY ERROR: depth=1, error=self signed certificate in certificate chain:
07:40 < Fleck> tried to verify my crt - returns OK
07:40 < Fleck> with openssl verify
07:40 < Fleck> i have server-bridge mode ;)
07:41 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has left #openvpn ["Leaving"]
07:48 < Fleck> never mind
07:53 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
07:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
08:04 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
08:08 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
08:54 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
09:00 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
09:02 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
09:09 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
09:12 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
09:13 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:24 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:24 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:29 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
09:29 < crocket> I met a weird man in #linux.
09:30 < crocket> He said OpenVPN authenticated using TLS certificates can be hacked by one luckly ID/password guess.
09:30 < crocket> He also said that since the above reason, changing permissions on files on NFS over OpenVPN was meaningless.
09:30 < crocket> Well
09:31 < crocket> I changed permissions on files to protect files from OpenVPN bugs.
09:31 < crocket> not from some hackers.
09:33 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
09:33 < crocket> How does any of you think of this man?
09:42 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
09:52 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
09:55 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
09:57 -!- tjz [~pc@bb219-74-220-153.singnet.com.sg] has joined #openvpn
09:57 -!- tjz [~pc@bb219-74-220-153.singnet.com.sg] has quit [Changing host]
09:57 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
09:57 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
09:59 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
10:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:14 < Fleck> TLS cert with ID/pass :D /
10:15 < crocket> He knows nothing about it.
10:15 < crocket> He thinks TLS cert requires ID/password.
10:16 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
10:20 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
10:21 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
10:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:27 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 276 seconds]
10:41 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
10:42 -!- luneff [~yury@84.51.192.6] has joined #openvpn
11:11 -!- me345 [~me345@adsl-75-15-186-20.dsl.bkfd14.sbcglobal.net] has joined #openvpn
11:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:33 -!- me345 [~me345@adsl-75-15-186-20.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
11:39 -!- ajbelayer1 [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has quit [Quit: Leaving.]
11:55 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
12:00 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Ping timeout: 252 seconds]
12:11 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
12:11 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has left #openvpn ["Leaving"]
12:11 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has joined #openvpn
12:19 -!- mant1s [~mant1s@130.111.162.226] has joined #openvpn
12:19 -!- mant1s [~mant1s@130.111.162.226] has quit [Changing host]
12:19 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:20 -!- ph1l [~ph1l@5-121.199-178.cust.bluewin.ch] has quit [Ping timeout: 246 seconds]
12:24 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
12:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
12:42 <@vpnHelper> RSS Update - forum: cannot ping VPN server ethernet ip <http://forums.openvpn.net/topic7917.html>
13:05 -!- arosen [~arosen@130.127.39.173] has joined #openvpn
13:06 < arosen> Hello, If I want to allow a nonroot use to create a tap device how would I go about doing that? 
13:06 < arosen> /dev/net/tun crw-rw-rw- 1 root root 10, 200 2011-04-09 17:54 tun
13:06 < arosen> It should be rw for all? 
13:07 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
13:34 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
13:51 < krzie> arosen, you still wouldnt be able to use ifconfig/add routes to the system
13:51 < krzie> so youd still need to start it as root
13:52 < arosen> krzie: Say I don't need to do ifconfig on it is it still possible to make without root? 
14:17 < krzie> you still need system routes
14:17 < krzie> IT IS NOT POSSIBLE
14:18 < krzie> you can drop privs after connection by using --user and --group
14:18 < krzie> but you must start with them
14:23 -!- me345 [~me345@adsl-75-15-186-20.dsl.bkfd14.sbcglobal.net] has joined #openvpn
14:34 <@vpnHelper> RSS Update - forum: Doubt about IP Forwarding <http://forums.openvpn.net/topic7918.html>
14:42 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
15:02 -!- mirco [~mirco@p5B23CDFC.dip.t-dialin.net] has quit [Quit: mirco]
15:15 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
15:15 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
15:15 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:32 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Quit: Leaving]
15:37 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
15:40 -!- me345 [~me345@adsl-75-15-186-20.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
15:53 < fipu> hello!
15:54 < fipu> if I make a ping from a Client to an other Client in my VPN, I get sometimes a next hop like this:
15:54 < fipu> 64 bytes from 10.1.1.10: icmp_seq=7 ttl=127 time=56.0 ms
15:54 < fipu> From 10.1.1.1: icmp_seq=8 Redirect Host(New nexthop: 10.1.1.10)
15:55 < fipu> what can be the problem here?
16:02 < krzee> do you have --client-to-client in your server?
16:03 < krzee> !c2c
16:03 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
16:03 <@vpnHelper> clients
16:19 < fipu> krzee: no, I have no client-to-client active
16:19 < fipu> I use iptables :)
16:20 < krzee> see if it helps
16:20 < krzee> if it does, see about fixing the iptables ;]
16:20 < krzee> or whatever else it is
16:20 < fipu> ou
16:21 < krzee> you have ip-forwarding enabled...?
16:21 < fipu> I think I'm going to live with the nexthop :D
16:21 < fipu> yes, I have
16:21 < fipu> otherwise it wont work :)
16:22 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
16:22 < krzee> does that stay when you enable c2c?
16:25 < rigel> dongs
16:25 < rigel> oops wrong channel
16:26 < fipu> krzee: I didn't checked it with c2c
16:29 < fipu> Thank you for that tipp
16:29 < fipu> I check it with c2c and come back to you with the results :)
16:30 -!- billytwowilly [~chris@S0106485b39e8051f.cg.shawcable.net] has joined #openvpn
16:53 <@vpnHelper> RSS Update - forum: Qos over Open VPN <http://forums.openvpn.net/topic7862.html#p11130>
17:25 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 258 seconds]
17:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:17 -!- rigel [~saxonberg@c-68-34-78-124.hsd1.md.comcast.net] has quit [Read error: Operation timed out]
18:17 -!- rigel [~saxonberg@c-68-34-78-124.hsd1.md.comcast.net] has joined #openvpn
18:18 -!- d303k [~heiko@port-92-198-130-130.static.qsc.de] has quit [Ping timeout: 240 seconds]
18:24 -!- d303k [~heiko@port-92-198-130-130.static.qsc.de] has joined #openvpn
18:29 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has joined #openvpn
18:38 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
19:07 -!- ajbelayer [~aaron@c-24-9-123-167.hsd1.co.comcast.net] has left #openvpn []
19:11 <@vpnHelper> RSS Update - forum: [HELP] OpenVPN <http://forums.openvpn.net/topic7919.html>
19:18 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has joined #openvpn
19:18 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
19:22 -!- mirco [~mirco@p5B23CDFC.dip.t-dialin.net] has joined #openvpn
19:25 -!- mirco [~mirco@p5B23CDFC.dip.t-dialin.net] has quit [Client Quit]
19:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
19:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:59 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
20:38 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
21:01 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
21:07 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 240 seconds]
21:13 -!- nowayjose [18b1c2a2@gateway/web/freenode/ip.24.177.194.162] has joined #openvpn
21:13 < nowayjose> !welcome
21:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:14 < nowayjose> !howto
21:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:14 < nowayjose> #route!
21:14 < nowayjose> !route
21:14 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:15 < nowayjose> I'm having troubles connecting to my remote VPN. It was working before I reinstalled my laptop, and now using the same config file it doesn't connect
21:16 < nowayjose> This is all the further I get:
21:17 < nowayjose> Sat Apr 09 21:15:31 2011 OpenVPN 2.2-RC2 Win32-MSVC++ [SSL] [LZO2] built on Mar 25 2011 Sat Apr 09 21:15:31 2011 LZO compression initialized Sat Apr 09 21:15:31 2011 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{32C8579C-FDFB-41AD-AE17-C0DE09088950}.tap Sat Apr 09 21:15:31 2011 UDPv4 link local (bound): [undef]:1195 Sat Apr 09 21:15:31 2011 UDPv4 link remote: 24.196.147.109:1195
21:17 < nowayjose> remote ****** port 1195 dev tap script-security 2 system secret static.key proto udp comp-lzo route-gateway 192.168.1.1 redirect-gateway def1 float route-method exe route-delay 2
21:21 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:31 -!- nowayjose [18b1c2a2@gateway/web/freenode/ip.24.177.194.162] has quit [Quit: Page closed]
21:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:52 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Quit: Leaving]
21:55 -!- espeed [~espeed@63.246.231.57] has quit [Ping timeout: 240 seconds]
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:05 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:10 -!- master_of_master [~master_of@p57B5730B.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:14 -!- master_of_master [~master_of@p57B55E0E.dip.t-dialin.net] has joined #openvpn
22:22 -!- smirnoffff [~smirnofff@vps6794.xlshosting.net] has joined #openvpn
22:22 < smirnoffff> hi
22:22 -!- smirnoffff [~smirnofff@vps6794.xlshosting.net] has left #openvpn []
22:22 -!- smirnoffff [~smirnofff@vps6794.xlshosting.net] has joined #openvpn
22:23 -!- smirnoffff [~smirnofff@vps6794.xlshosting.net] has quit [Client Quit]
22:24 -!- smirnoffff [~smirnofff@vps6794.xlshosting.net] has joined #openvpn
22:26 -!- smirnoffff [~smirnofff@vps6794.xlshosting.net] has quit [Client Quit]
22:27 -!- smirnoffff [smirnoffff@61.173.116.130] has joined #openvpn
22:28 < smirnoffff> hi
22:29 < smirnoffff> wondering what firewall rules a client would need? I mean outgoing firwall rules... i have my default outgoing set to block all, and just added an allow rule for the openvpn server's ip. I'm using push gateway mode too, and now with the firewall set up like this i can connect the vpn but i can't visit websites etc
22:29 < smirnoffff> any idea?
22:29 < smirnoffff> i even tried adding an allow rule for 10.8.0.1
22:30 -!- espeed [~espeed@63.246.231.57] has joined #openvpn
22:35 -!- genlight [~genlight@amertospromotions.com] has joined #openvpn
22:36 -!- smirnofffffff [smirnoffff@61.173.116.130] has joined #openvpn
22:36 -!- smirnoffff [smirnoffff@61.173.116.130] has quit [Read error: Connection reset by peer]
22:36 < genlight> good day all
22:37 < smirnofffffff> hi glen
22:37 < genlight> I would like to ask how to use setenv
22:37 < genlight> sorry I am not glen sir
22:38 < genlight> anybody please
22:39 < smirnofffffff> i need firewall help
22:40 -!- smirnofffffff [smirnoffff@61.173.116.130] has quit [Client Quit]
22:47 -!- genlight [~genlight@amertospromotions.com] has left #openvpn []
22:48 -!- espeed [~espeed@63.246.231.57] has quit [Remote host closed the connection]
22:52 <@vpnHelper> RSS Update - forum: cannot ping VPN server ethernet ip <http://forums.openvpn.net/topic7917.html#p11132>
23:07 -!- d303k [~heiko@port-92-198-130-130.static.qsc.de] has quit [Ping timeout: 258 seconds]
23:09 -!- d303k [~heiko@port-92-198-130-130.static.qsc.de] has joined #openvpn
23:44 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
23:46 -!- smirnoffff [smirnoffff@61.173.116.130] has joined #openvpn
23:59 < hyper_ch> good morning
--- Day changed Sun Apr 10 2011
00:17 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
00:19 < Bushmills> smirnoffff: did you set up openvpn server as gateway for openvpn traffic?
00:23 < Bushmills> 'morning hyper_ch
00:24 < hyper_ch> Bushmills: how is the day treating you?
00:25 < Bushmills> it hasn't had much opportunities yet
00:25 < hyper_ch> you're not at work, are you?
00:25 < Bushmills> pre-breakfast
00:26 < hyper_ch> then I can post this NSFW pic  http://i.imgur.com/TKAZW.jpg
00:31 < hyper_ch> no comment?
00:31 < hyper_ch> :(
00:36 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:43 < hyper_ch> Bushmills: :(
01:19 -!- AndrewX192 is now known as AndrewX192[]
01:19 < smirnoffff> hi every1
01:20 < smirnoffff> im having difficulty with my windows firewall on my client... i changed the default outgoing policy to block for all protocalls to all ips, but gave an exception for the openvpn server ip. I can start up the vpn but can't visit any websites now (i use push gateway def 1)
01:20 < smirnoffff> :(
01:20 < smirnoffff> i also made a rule to allow 10.8.0.1 but that didnt fix it
01:46 -!- smirnoffff [smirnoffff@61.173.116.130] has quit []
01:47 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:53 < Bushmills> hyper_ch: sorry, was away. 
01:53 < Bushmills> medicine transport.
01:53 < hyper_ch> :)
01:54 < Bushmills> and, btw, i don't click on every link just because it is posted, and doesn't come with a description what it is
01:55 < Bushmills> jut as little as i click on problem description links, saying "can somebody help me with that problem"
01:55 < hyper_ch> :)
01:55 < hyper_ch> did you click the one I posted?
01:55 < Bushmills> no
01:55 < hyper_ch> awww :(
01:55 < Bushmills> i did dict nsfw, though
01:55 < Bushmills> but no match found
01:56 < hyper_ch> nsfw - not safe for work
01:56 < Bushmills> http://scarydevilmonastery.net/dict.cgi?nsfw
01:56 < Bushmills> ah
02:01 < hyper_ch> clicked it yet?
02:16 -!- smirnoffff [smirnoffff@61.173.116.130] has joined #openvpn
02:17 < smirnoffff> could anyone help me please
02:19 < Fleck> if you disable firewall - everything works?
02:21 < smirnoffff> yes
02:22 < smirnoffff> and i changed the incomming firewall policy to open for all, so i know it is outgoing problem
02:26 < Fleck> how to tell
02:26 < Fleck> gw doesn't make connections to appear from one IP
02:26 < Fleck> you connect to all IPs anyway
02:30 < Fleck> anyway - dont know windows firewalls and this chan is not about howto configure firewalls :)
02:32 < smirnoffff> gw?
02:33 < smirnoffff> connect to all ip? nonsense 
02:33 < smirnoffff> a vpn connects to ONE ip, the server
02:33 < smirnoffff> as far as the packet is concerned, it has a single fixed destination
02:38 < Fleck> yeah vpn to one IP
02:38 < Fleck> good, now what?
02:39 < Fleck> now you use vpn for routing all your internet traffic, no?
02:39 < Fleck> then think - what happens if you type ping google.com in your command prompt...
02:40 < Fleck> does your firewall "think" google.com is your VPNs fixed destination IP ?
02:40 < Fleck> no...
02:40 < Fleck> destination is google.com ip!
02:41 < Fleck> EVEN if goes trough VPN...
02:41 < smirnoffff> so your saying firewall is useless
02:41 < smirnoffff> might as well have no firewall running
02:41 < Fleck> never said that...
02:43 < Fleck> you can firewall all outgoing connections if destination port is not 53, 80, 443 etc if you need to
02:43 < Fleck> or you will have to use proxy - then you can have 1 destination IP
02:44 < smirnoffff> ok
02:44 < smirnoffff> so just generic firewall stuff
02:44 < smirnoffff> i thought possible force only traffic between server and client
02:44 < smirnoffff> ignore all other ip's
02:45 < smirnoffff> i often have programs that 'ignore' the vpn if they were opened before i start up the vpn
02:45 < smirnoffff> which is main thing i wanted to stop
02:46 < Fleck> i have to go now
02:47 < smirnoffff> ok
02:47 < smirnoffff> thx
02:51 -!- AndrewX192[] is now known as AndrewX192
02:56 -!- smirnoffff [smirnoffff@61.173.116.130] has quit [Ping timeout: 248 seconds]
03:01 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has joined #openvpn
03:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
04:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:08 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p11133>
04:45 <@vpnHelper> RSS Update - forum: [HELP] Create Premium VPN using OpenVPN <http://forums.openvpn.net/topic7919.html>
05:03 <@vpnHelper> RSS Update - forum: hi newbie here please help <http://forums.openvpn.net/topic7920.html>
05:15 <@vpnHelper> RSS Update - forum: hi newbie here please help (blocked port) <http://forums.openvpn.net/topic7920.html>
05:16 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
05:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:49 < hz0> hello ive been trying to configure an openvpn system with ssl enabled, i keep getting connection problems even though i have the udp port open(i checked), where should i start looking.
05:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:53 < Bushmills> hz0: in the log files
05:54 < hz0> oh srry, ofc
05:55 < hz0> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
05:56 < hz0> then again im not sure it might be a certificate problem.
06:01 < Bushmills> that's client log?
06:02 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
06:03 < Bushmills> you're welcome
06:03 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
06:03 < hz0> yes that's the error on the client side
06:03 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
06:04 < Bushmills> if there's no record of client attempting to connect in server log, client may simply not get through
06:04 < Bushmills> firewall, server listening on different port than client attempts to connect, etc
06:05 < Bushmills> use of udp on one, tcp on the other
06:05 < hz0> that's what seems wierd to me, it's udp, and the same port, i also did udp port check to see if it's open
06:08 < hz0> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)	TLS Error: TLS handshake failed	TCP/UDP: Closing socket
06:08 < hz0> that's the full error
06:09 < hz0> i read in the faq that i might need to redirect traffic from the specific port to the internal server address ive set up
06:09 < hz0> but im not sure how im gonna do that, so i was lookin for a workaround
06:15 -!- LeRrA_ [~lerra@c-4b9372d5.029-136-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
06:32 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Ping timeout: 252 seconds]
06:34 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
07:07 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Operation timed out]
07:10 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
07:13 <@vpnHelper> RSS Update - forum: [HELP] Create Premium VPN using OpenVPN <http://forums.openvpn.net/topic7919.html#p11135>
07:38 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:38 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
07:52 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
08:22 < hz0> also im getting an event alert for the dhcp service on the server: The IP address lease 10.8.0.1 for the Network Card with network address  has been denied by the DHCP server 10.8.0.2. am i supposed to use private ranges? 192.168.*.* etc..
08:24 < Bushmills> how is dhcp server supposed to be related to address assignment on openvpn subnet?
08:35 < hz0> what do u mean
08:36 < hz0> without dhcp, i couldnt assign an ip on the server, even when i used the ip static switch
08:38 < ecrist> sup d00ds?
08:39 < hz0> srry m8, bushmills, am preety new to this
08:40 < Bushmills> hz0: i have no idea what you're trying to do, or to accomplish
08:41 < Bushmills> anyway - you seem to be getting an error from your dhcp server. then you may have to fix your dhcp config,
08:42 < Bushmills> any reason why you ask dhcp server related questions in #openvpn?
08:42  * ecrist points to /topic
08:42 < hz0> srry, it was just that i thought it might have anything to do to my existing prob
08:43 < hz0> im trying to connect using sslvpn to a win2k3 server, so far ive been having probs with dhcp which i figured i fixed and with tls connectability
08:43 < ecrist> sslvpn isn't openvpn
08:44 < ecrist> you can only connect to openvpn with openvpn
08:47 < hz0> i know, but it does let me require the client to have a specific certificate
08:48 < ecrist> what?
08:48 < Bushmills> that may be the problem of modern operating systems, which don't allow users to have unique login passwords
08:49 -!- pyther [~pyther@unaffiliated/pyther] has left #openvpn []
08:52 < hz0> i was talking about dhcp because when i didn't use dhcp, i couldnt get it to get assigned an ip address. while using push "ip-win32 static"
08:52 < hz0> anyway, doesn't seem to work so far
08:52 < ecrist> !howto
08:52 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:52  * ecrist points again to /topic
08:53 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
08:54 < Bushmills> you're welcome
08:55 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
08:58 < hz0> srry, im familiar with the howto but i don't seem to find the reason, except maybe because the machine has only 1 nic. thanks for the help anyway.
09:00 < Bushmills> !goal
09:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:01 < hz0> i just need a secure connection between 2 computers
09:05 < Bushmills> !howto
09:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:05 < Bushmills> check out "quickstart"
09:05 < ecrist> hz0: if you read the damn howto, you'll get a secure connection between two computers.
09:06 < Bushmills> not from reading alone
09:06 < ecrist> well, right, you have to do what the howto recommends
09:07 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:16 < hz0> i did follow it, just have connectability problems
09:16 < hz0> problems connecting to the server
09:21 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
09:22 < crocket> mtu-test revealed that local -> remote MTU to be 1437.
09:22 < crocket> What does 1437 mean?
09:22 < crocket> UDP payload size?
09:22 < crocket> or OpenVPN payload size?
09:25 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Remote host closed the connection]
09:34 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
09:40 -!- billytwowilly [~chris@S0106485b39e8051f.cg.shawcable.net] has left #openvpn ["Konversation terminated!"]
09:58 -!- genesis7 [~genlight@amertospromotions.com] has joined #openvpn
10:01 < genesis7> can i use push "setenv myusername=AA" where AA is a variable string then I call in my client config auth-user-pass AA.  Is that possible?
10:04 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
10:04 < stony> hi
10:05 < stony> is there a way to "communicate" with the openvpn server so that it chooses a different client file based on the "pushed" parameter?
10:06 < Bushmills> stony: you can't push to server. however, you can use a different key on client, thereby causing server to treat you differently, by identifying you with the key you're presenting
10:07 < stony> Bushmills: and blocking pushed options coming from the server is also not possible?
10:07 < genesis7> anyone please
10:08 < Bushmills> actually, you *can* influence the connect script on server
10:08 < Bushmills> (by client)
10:08 < stony> genesis7: ?
10:08 < Bushmills> stony: possible
10:08 < stony> Bushmills: how would i block options?
10:09 < Bushmills> you either avoid directives which imply pull, or use a directive to ignore specific pushes 
10:09 < Bushmills> server can push as long as it wants, when client doesn't pull
10:09 < Bushmills> but some directives, like client, are macros which do, among other, also a pull
10:10 < stony> i c
10:10 < stony> thx
10:11 -!- genesis7 [~genlight@amertospromotions.com] has quit [Read error: Connection reset by peer]
10:13 -!- genesis7 [~genlight@amertospromotions.com] has joined #openvpn
10:17 -!- genesis7 [~genlight@amertospromotions.com] has quit [Read error: Connection reset by peer]
10:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
11:02 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 246 seconds]
11:04 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
11:05 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
11:05 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
11:07 -!- roconnor_ [~roconnor@173.245.80.10] has joined #openvpn
11:07 < roconnor_> is it possible to install an openvpn server under linux without root access?
11:08 -!- Netsplit *.net <-> *.split quits: krzee, mete, krzie, hpa, sedulous, Mirrakor, nijotz, jubei__, toortog, |Mike|
11:10 -!- Netsplit over, joins: krzie, krzee, toortog, hpa, |Mike|, Mirrakor, nijotz, jubei__, mete, sedulous
11:20 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
11:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:23 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
11:24 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
11:25 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
11:26 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Disconnected by services]
11:26 -!- Hamlin_ [~Hamlin@unaffiliated/hamlin] has joined #openvpn
11:26 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 246 seconds]
11:27 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Read error: Connection reset by peer]
11:27 -!- Torpion [~torpion@ydb.me] has quit [Ping timeout: 246 seconds]
11:27 -!- Torpion [~torpion@ydb.me] has joined #openvpn
11:28 -!- roconnor_ is now known as roconnor
11:33 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
11:35 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
11:37 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
11:50 < Bushmills> installing ... probably yes.  running: no. it needs to do things at start only root is allowed to do. like adding routes, to have any effect at all.
11:57 < roconnor> Bushmills: the server needs to add routes?
11:58 < roconnor> hmm
11:58 < Bushmills> how would you send anything through tunnel without a route to the virtual interface?
11:58 < roconnor> I see your point
12:07 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
12:07 -!- tjz [~pc@bb219-74-220-153.singnet.com.sg] has joined #openvpn
12:07 -!- tjz [~pc@bb219-74-220-153.singnet.com.sg] has quit [Changing host]
12:07 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
12:11 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
12:12 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 246 seconds]
12:13 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:14 -!- pa [~pa@unaffiliated/pa] has quit [Read error: Connection reset by peer]
12:14 -!- Torpion [~torpion@ydb.me] has quit [Ping timeout: 246 seconds]
12:15 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
12:15 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:16 -!- pa [~pa@unaffiliated/pa] has quit [Excess Flood]
12:17 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:19 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
12:20 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
12:20 -!- Hamlin_ [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 240 seconds]
12:21 -!- fipu [~fipufr@212.83.42.243] has quit [Ping timeout: 240 seconds]
12:21 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
12:21 -!- JPeterso2 is now known as JPeterson
12:22 -!- fipu [~fipufr@212.83.42.243] has joined #openvpn
12:23 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
12:35 -!- corretico [~luis@201.201.44.82] has quit [Read error: Operation timed out]
12:37 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:48 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
12:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
13:20 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
13:21 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
13:25 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
13:26 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
13:26 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
13:26 -!- hz0 [~hz0@server.nowhere-else.org] has joined #openvpn
13:35 -!- luneff [~yury@84.51.192.6] has joined #openvpn
14:00 -!- hz0 [~hz0@server.nowhere-else.org] has quit [Quit: hz0]
14:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:23 -!- Torpion [~torpion@ydb.me] has joined #openvpn
14:29 -!- sunny [~chatzilla@c-66-41-28-126.hsd1.mn.comcast.net] has joined #openvpn
14:30 < arosen> Hello, I'm tying to ping6 fec0::64 but I want that to go out my lo interface. Any idea how to get that to work? ping6 -i interface address. My lo address is :: ping6 -I :: fec0::64 is telling me  connect: Network is unreachable and stops
14:31 < arosen> I also don't see any traffic generated for that command on my lo 
14:33 < sunny> hi. i'm trying to run openvpn (+gui) on win 7 64 bit. I guess I have some problem with the filenames for the cert files. I.e. I found online that the names should be like c:\\somedir\\somename, i.e. double-backslash. but what if there are spaces in the dir name? it installs bt default in C:\program Files (x64). Should I escape somehow the spaces? like with "\ "? should I put the whole...
14:33 < sunny> ...path+file in quotes? I tried the above w/o any success so far. Most probably I'm not doing something right, but I can't figure this out. The same conf file works ok on linux (of course, the dir names use *nix pat convention)
14:34 < sunny> addition: it uses tun devices.
14:35 < sunny> also, if I have 2 different ovpn files for 2 diff networks, is it same as on linux to have 2 diff device names - i.e. tun0 and tun1? or should I use some other naming
14:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:50 -!- albech [~thomas@1503028701.seas-nve.dbnet.dk] has joined #openvpn
14:50 < albech> im getting this error in my server log. is this a version mismatch issue? http://pastebin.com/AjRxXj1c
14:50 -!- Guifort [~Administr@78.123.161.223] has joined #openvpn
14:59 -!- Guifort [~Administr@78.123.161.223] has quit [Quit: Quitte]
15:08 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:17 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
15:20 < roentgen> albech: check max-clients (IIRC) in server config
15:23 < albech> roentgen, but im the only one connecting so 10 should be more than enough ;)
15:23 -!- sunny [~chatzilla@c-66-41-28-126.hsd1.mn.comcast.net] has quit [Ping timeout: 252 seconds]
15:27 -!- albech [~thomas@1503028701.seas-nve.dbnet.dk] has quit [Quit: Ex-Chat]
15:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
15:46 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has quit [Quit: leaving]
15:46 <@vpnHelper> RSS Update - forum: DNS issue: can lookup but not use <http://forums.openvpn.net/topic7916.html#p11136>
15:46 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has joined #openvpn
15:47 -!- Fleck [~we@unaffiliated/fleck] has quit [Quit: KVIrc Equilibrium 4.1.1, revision: 5222, sources date: 20101102, built on: 2010-12-23 16:54:09 UTC http://www.kvirc.net/]
15:52 <@vpnHelper> RSS Update - forum: Sharing openvpn connection over Ethernet.. <http://forums.openvpn.net/topic7921.html>
15:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:00 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
16:01 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:03 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has joined #openvpn
16:05 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
16:07 -!- Nowak [nowak@worldwind/developer/Nowak] has quit [Ping timeout: 260 seconds]
16:07 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
16:07 -!- roconnor_ [~roconnor@173.245.80.10] has joined #openvpn
16:08 -!- roconnor [~roconnor@173.245.80.10] has quit [Ping timeout: 276 seconds]
16:08 -!- nb [~nb@fedora/nb] has quit [Excess Flood]
16:20 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
16:21 < amir> !welcome
16:21 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:21 < amir> !/30
16:21 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
16:24 < amir> !topology
16:24 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
16:27 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has joined #openvpn
16:52 -!- nb [~nb@fedora/nb] has joined #openvpn
16:59 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
17:01 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
17:04 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
17:08 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has joined #openvpn
17:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:14 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
17:16 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
17:21 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has joined #openvpn
17:38 -!- grapsus [~grapsus@che21-2-82-245-89-120.fbx.proxad.net] has quit [Quit: Quitte]
17:50 < crocket> mtu-test revealed that local -> remote MTU to be 1437. What does 1437 mean?
18:08 < hardwire> crazy wonky messed up stuff
18:16 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has quit [Quit: mirco]
18:16 < krzee> i cant hand you config options, but i can give you the general idea
18:16 < krzee> i havnt played with mtu issues before
18:16 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has joined #openvpn
18:16 < |Mike|> ok
18:20 -!- mirco [~mirco@p5B23C91F.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
18:54 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
18:55 < crocket> Does 1437 mean link-mtu?
18:55 < crocket> or tun-mtu?
18:56 < krzee> thats where i cant help ya
18:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
18:57 < krzee> i do know you can use ping to know exactly whats up, still not 100% sure of which settings to configure once you know tho
18:57 < krzee> !mtu
18:57 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
18:57 < krzee> that wiki entry is the most i can give ya
19:09 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html>
19:35 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:37 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 252 seconds]
19:39 -!- echoSMILE [~censured@bl15-208-186.dsl.telepac.pt] has joined #openvpn
19:39 -!- echoSMILE [~censured@bl15-208-186.dsl.telepac.pt] has quit [Changing host]
19:39 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
19:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
20:35 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
20:41 < crocket> I added mlock in openvpn.conf, and the server refuses to accept client connections with "OpenVPN out of memory" error.
20:41 < crocket> But I still have an ample of memory.
20:41 < crocket> OpenVPN: out of memory
20:45 < krzee> ive never seen that, or heard of it, nor have i seen --mlock used before
20:46 < crocket> It seems that unprivileged users can't use --mlock
20:57 < krzee> unprivileged users cant even start openvpn with the exception of windows with some configuring
20:59 < crocket> krzee, OpenVPN drops to a non-root user after initialization.
21:00 < crocket> It's weird
21:00 < krzee> sure
21:00 < krzee> but mlock allows that still
21:00 < krzee> (though OpenVPN can subsequently downgrade its UID using the --user option).
21:00 < crocket> "ulimit" is unlimited.
21:00 < crocket> "ulimit" is unlimited for openvpn.
21:01 < krzee> if you remove --user and --group do you get the same errors?
21:02 < krzee> and what version openvpn are you using?
21:03 < crocket> hmm
21:03 < crocket> krzee, I check it
21:07 < crocket> krzee, If OpenVPN server is run as root, out of memory error doesn't occur.
21:08 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
21:08 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
21:08 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:08 < crocket> kraut, And both the server and the client use 2.1.4
21:12 < krzee> your error must be in your OS setup then, because many people (myself included) use --user / --group with 2.1.4
21:12 < krzee> unless of course you found some strange combination of issues
21:12 < krzee> if you wanna you can pastebin your server config
21:13 < krzee> doubt i can do much for you tho
21:13 < crocket> krzee, If I log in as openvpn, The result of "ulimit" is unlimited. So it doesn't seem to be ulimit issue.
21:19 < crocket> krzee, My current configuration is http://dpaste.com/530703/
21:19 < crocket> I just commented out user and group.
21:20 < krzee> not your fault since i didnt use the bot
21:20 < krzee> pls remove comments li9ke this
21:20 < krzee> !configs
21:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
21:24 < krzee> a config without all those comments is 100x easier to read
21:25 < crocket> krzee, ok
21:26 < crocket> krzee, like http://dpaste.com/530705/
21:26 < krzee> much better =]
21:27 < krzee> oh ok
21:29 < crocket> krzee, What's ok?
21:29 < krzee> well i get what you're doing now
21:30 < krzee> trying to go through a lot of effort to not need to start as root
21:30 < crocket> What am I doing?
21:30 < crocket> krzee, yeah
21:30 < crocket> Nothing else?
21:31 < krzee> evidently it *can* be done, ecrist just told me that in freebsd it would be done in devfs.conf / devfs.rules
21:31 < krzee> (giving access to manage interfaces / routing tables and whatnot)
21:32 < crocket> Do you notice anything related to mlock?
21:32 < crocket> mlock and UDP congestion issue.
21:32 < krzee> the mlock thing has to do with something on your box
21:32 < krzee> thats all i know bout that
21:37 < krzee> err the memory thing i mean
21:37 < krzee> you said it happens with or without mlock, right?
21:38 < crocket> with mlock
21:38 < crocket> with mlock as a non-root user.
21:38 < krzee> oh, ONLY with mlock?
21:38 < crocket> yes
21:39 < crocket> out of memory wouldn't happen without mlock.
21:39 < krzee> ahhh then im no longer 100% sure of anything ;]
21:39 < krzee> you may wanna make a trac ticket just in case
21:39 < krzee> then one of us can try to duplicate it when we have the time
21:40 < krzee> !trac
21:40 <@vpnHelper> "trac" is see http://community.openvpn.net for development information and bug tracker.
21:40 < krzee> same login/pass as the forum
21:43 < crocket> How can I UDP packet congestin?
21:43 < crocket> How can I UDP packet congestion?
21:44 < crocket> I can't solve it with "fragment 1300" and "mssfix"
21:44 < krzee> thats not even a real sentance
21:44 < crocket> huh?
21:45 < krzee> thats like saying "how can i television?"
21:45 < crocket> TCP NFS transfer over UDP OpenVPN tunnel freezes after transferring 50~70MB at 5MB/s
21:45 < crocket> Forgive me for bad english.
21:46 < crocket> That congestion or freeze disappears after minutes.
21:46 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
21:46 < crocket> If I make a TCP OpenVPN tunnel, the freeze never happens.
21:53 < krzee> ahh
21:53 < krzee> well it could be a messed up firewall somewhere trying to keep-state on UDP
21:54 < krzee> since it is stateless, any attempt any firewall makes at keeping udp state is a hack
21:54 < krzee> it could be filtering by your ISP (some ISPs do that because of torrents)
21:54 < krzee> of course since you DID find a mtu issue, it could be due to not configuring your MTU stuff correctly
21:55 < krzee> im only good for helping you know *if* you have an mtu issue, not fixing them (because ive never actually HAD an mtu issue personally)
21:55 < krzee> i suggest going to the mail list
21:56 < krzee> !mail
21:56 <@vpnHelper> "mail" is (#1) http://sourceforge.net/mail/?group_id=48978, or (#2) http://news.gmane.org/gmane.network.openvpn.user for the openvpn-users archive
21:57 < krzee> there is many skilled people on there, they are likely to know more than me about your problems
21:57 < krzee> there are*
22:02 < crocket> krzee, It must be between my room and my institute.
22:03 < crocket> If a tunnel is between my room and somewhere out of my institute, UDP tunnel never freezes.
22:04 < crocket> It seems I don't have any MTU issue.
22:04 < krzee> [15:50]  <crocket> mtu-test revealed that local -> remote MTU to be 1437. What does 1437 mean?
22:04 < krzee> that means you DO have an mtu issue
22:05 < krzee> i just got off work tho
22:05 < krzee> feel free to keep asking things here, but i highly recommend the mail list for you
22:06 < crocket> ok
22:06 < crocket> It's weird
22:07 < krzee> they will need at least: the server config, the results of that mtu-test, and any changes you made in the OS to allow for running as non-root
22:07 < krzee> bbl =]
22:13 -!- master_of_master [~master_of@p57B55E0E.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
22:14 -!- master_of_master [~master_of@p57B57A26.dip.t-dialin.net] has joined #openvpn
22:34 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Changing host]
22:34 -!- Nowak [nowak@worldwind/developer/Nowak] has joined #openvpn
22:53 -!- iamresearcher [~genlight@amertospromotions.com] has joined #openvpn
22:57 < iamresearcher>  I forgot where I extracted the startup.sh and shutdown.sh, can you please tell me where is the directory location of those two. tnxx
23:03 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has joined #openvpn
23:11 -!- gyyrog [~gyyrog@68-188-152-174.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:18 -!- iamresearcher [~genlight@amertospromotions.com] has quit [Ping timeout: 276 seconds]
23:27 -!- roconnor__ [~roconnor@173.245.80.10] has joined #openvpn
23:27 -!- roconnor_ [~roconnor@173.245.80.10] has quit [Ping timeout: 248 seconds]
--- Day changed Mon Apr 11 2011
00:17 -!- roconnor__ [~roconnor@173.245.80.10] has quit [Ping timeout: 240 seconds]
00:17 -!- roconnor__ [~roconnor@bob75-2-81-56-46-96.fbx.proxad.net] has joined #openvpn
00:20 -!- mirco [~mirco@p5B23A9BD.dip.t-dialin.net] has joined #openvpn
00:27 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
00:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:56 -!- mirco [~mirco@p5B23A9BD.dip.t-dialin.net] has quit [Quit: mirco]
00:57 -!- mirco [~mirco@p5B23A9BD.dip.t-dialin.net] has joined #openvpn
01:01 -!- mirco [~mirco@p5B23A9BD.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
01:01 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:11 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:20 -!- iamresearcher [~genlight@amertospromotions.com] has joined #openvpn
01:21 < iamresearcher> good day all, I want to ask your assistance on how to properly use setenv in server and client configuration. 
01:27 < iamresearcher> anybody please.
01:30 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467.html#p11139>
01:30 -!- iamresearcher [~genlight@amertospromotions.com] has quit []
01:37 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:37 -!- mode/#openvpn [+o mattock] by ChanServ
01:48 -!- roconnor [~roconnor@173.245.80.10] has joined #openvpn
01:48 -!- roconnor__ [~roconnor@bob75-2-81-56-46-96.fbx.proxad.net] has quit [Ping timeout: 276 seconds]
01:52 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:58 -!- roconnor [~roconnor@173.245.80.10] has quit [Ping timeout: 248 seconds]
01:59 -!- roconnor [~roconnor@bob75-2-81-56-46-96.fbx.proxad.net] has joined #openvpn
02:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
02:30 -!- dazo_afk is now known as dazo
02:45 -!- roconnor [~roconnor@bob75-2-81-56-46-96.fbx.proxad.net] has quit [Remote host closed the connection]
02:48 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11140>
02:54 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11142> || Sharing openvpn connection over Ethernet.. <http://forums.openvpn.net/topic7921.html#p11141>
03:10 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:50 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:50 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:58 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
04:01 -!- DL7LN [~dl7ln@dslc-082-083-148-231.pools.arcor-ip.net] has joined #openvpn
04:01 < DL7LN> good morning :)
04:05 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Remote host closed the connection]
04:08 < DL7LN> i set up vpn, with protocol udp, all ports are forwarded. i have several winxp-clients which can connect without any trouble. since yesterday i have a problem with my linux-box. it fails on tls-negotiation... but there's no firewall and i cannot remember i did change something.
04:08 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
04:08 < DL7LN> it worked fine before...
04:11 < DL7LN> should i put some error-log or config-files in a pastebin for you to take a look on?
04:26 < DL7LN> problem solved. i accidentially used a old user-cert which has nothing to do with the actual ca...
04:26 -!- DL7LN [~dl7ln@dslc-082-083-148-231.pools.arcor-ip.net] has left #openvpn ["Leaving"]
04:47 -!- zooz [~zooz@host86-164-225-136.range86-164.btcentralplus.com] has joined #openvpn
04:47 < zooz> hi people
04:49 < zooz> using windows openvpn client I get the following errors: http://p.defau.lt/?y7Yt67U2xUeNtCMOvGT48w
04:49 <@vpnHelper> Title: default paste at 2011-04-11 12:49:23 (at p.defau.lt)
04:49 < zooz> it perfectly works using linux openvpn client
04:52 -!- iamresearcher [~genlight@amertospromotions.com] has joined #openvpn
04:52 < iamresearcher> still needs assistance on setenv. can anybody assist me?
05:01 < Bushmills> there's probably a man page about setenv, or look into man page of your shell
05:05 < iamresearcher> yes bushmills, I read the setenv in the manpage and search more in google, but there is no clear instruction on how to use the setenv name=value.  I was thinking if I can like push "setenv UName=AA" where AA is a string value retrieve by a program from a text file. 
05:07 < Bushmills> openvpn config file doesn't care about environment variables.  you can substitute variable names against contents when specifying options on command line. but you can only push what openvpn documents in its man page 
05:09 < Bushmills> so for example, you could set    port=443     and run    openvpn --port=$port  --config=/file/with/your/remaining/configuration
05:09 < Bushmills> ehm .. no "=" after --port
05:11 < Bushmills> ah. you might mean the openvpn --setenv, not setenv command of your shell?
05:15 < iamresearcher> bushmills, as of now, I have put the username,userpassword,the details of ovpn file in one text file and they are encrypted.  Now when my program starts, it decrypts the content and write to individual file on different windows directory for security purposes.  I want to eliminate that last part of writing to individual file like password.txt for auth-user-pass password.txt.  What I want to 
05:15 < iamresearcher> achieve if I can use setenv paswd=AA and AA is the decrypted string stored in computer memory for future use so that it will look like auth-user-pass paswd.
05:17 < Bushmills> why don't you use key/cert based authentication?
05:18 < iamresearcher> I opt to use what I use now sir.
05:18 < iamresearcher> it is easier for me to set account on kloxo
05:21 -!- zooz [~zooz@host86-164-225-136.range86-164.btcentralplus.com] has quit [Quit: Leaving]
05:24 < iamresearcher> :(
05:26 -!- iamresearcher [~genlight@amertospromotions.com] has quit []
05:57 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
05:58 < kunago> Is someone familiar with iptables and how to set up port forwarding to a VPN client? I used this manual (https://forums.openvpn.net/topic7823.html) to set it up but I am failing somewhere.
05:58 <@vpnHelper> Title: OpenVPN Support Forum IPTABLES - Portforwarding : Routing and Firewall Scripts (at forums.openvpn.net)
06:00 < kunago> On top of iptables I am using ConfigServer Security & Firewall but I allowed external users to access my desired port and also added the iptables rules properly. I can see them listed in the iptables rules list.
06:06 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
06:18 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:18 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
06:18 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
06:18 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:43 -!- zooz [~zooz@host86-164-225-136.range86-164.btcentralplus.com] has joined #openvpn
06:43 < zooz> how can I import a client cert into openvpn?
06:52 < kunago> zooz: You should upload the certificate to the client's machine and then write the path to the certificate in the client's config file.
06:52 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Connection reset by peer]
06:52 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:52 -!- mode/#openvpn [+o mattock1] by ChanServ
06:58 -!- dazo is now known as dazo_afk
07:01 -!- dazo_afk is now known as dazo
07:07 < zooz> kunago, does openvpn need to hold client certs somewhere?
07:07 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11145> || Sharing openvpn connection over Ethernet.. <http://forums.openvpn.net/topic7921.html#p11144> || DNS issue: can lookup but not use <http://forums.openvpn.net/topic7916.html#p11143>
07:07 < zooz> I mean openvpn server to hold client certs
07:08 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:09 < kunago> zooz: No, it does not. Your server has its own certs. They share the same ca.crt file though.
07:11 < zooz> right
07:11 < zooz> what about index.txt and those files?
07:11 < zooz> serial
07:11 < zooz> I am a bit confused
07:12 < kunago> What do you mean? I never used the index.txt for anything.
07:12 <@vpnHelper> RSS Update - forum: How to increace the data transfer rate in openvpn <http://forums.openvpn.net/topic7913.html#p11148> || hi newbie here please help (blocked port) <http://forums.openvpn.net/topic7920.html#p11147> || Doubt about IP Forwarding <http://forums.openvpn.net/topic7918.html#p11146>
07:12 < zooz> kunago, using easy-rsa it creates index.txt and serial
07:13 < kunago> All you need for proper functioning is a set of certificates and a config file. That goes for both, client and server.
07:13 < zooz> right, so for a server side I need ca.crt, server.key and server.crt right?
07:13 < zooz> and a config obviously
07:13 < kunago> zooz: Yes, that and also dh1024.pem and ta.key (in case you use it)
07:14 < zooz> sure
07:14 < zooz> client - ca.crt, client.crt and client.key and a config
07:14 < kunago> For a client you need just its crt and key, then ca.crt and ta.key
07:14 < zooz> thanks, makes sense
07:14 < kunago> zooz: Then all you need is bunch of time to make it work properly. :-)
07:15 < zooz> I seem to have issues with windows clients
07:15 < kunago> such as?
07:15 < zooz> http://p.defau.lt/?y7Yt67U2xUeNtCMOvGT48w
07:15 <@vpnHelper> Title: default paste at 2011-04-11 12:49:23 (at p.defau.lt)
07:16 < zooz> linux/mac clients work perfectly
07:17 < kunago> !route
07:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
07:23 < zooz> what client-to-client means?
07:25 < zooz> I read about it, nm
07:27 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
07:31 < kunago> That means that a client can talk with a client. Useful especially when you have multiple clients on a LAN that is part of your VPN.
07:31 < kunago> I have 4 LANs on my VPN so for me it's a must.
07:38 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:38 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:46 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:46 <@vpnHelper> RSS Update - forum: can't connect to internet <http://forums.openvpn.net/topic7923.html>
07:48 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 253 seconds]
07:49 -!- kunago [~Miris@201.239.broadband12.iol.cz] has quit [Read error: Operation timed out]
07:49 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
07:49 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
08:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 246 seconds]
08:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:10 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Remote host closed the connection]
08:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:25 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
08:52 -!- kunago [~Miris@201.239.broadband12.iol.cz] has left #openvpn []
08:53 -!- Diffen [~diffen@h47n1fls34o283.telia.com] has joined #openvpn
09:10 -!- Diffen [~diffen@h47n1fls34o283.telia.com] has quit [Ping timeout: 260 seconds]
09:10 <@vpnHelper> RSS Update - forum: DNS issue: can lookup but not use <http://forums.openvpn.net/topic7916.html#p11150>
09:14 -!- ZyZ [~joe@188.29.128.161.threembb.co.uk] has joined #openvpn
09:14 < ZyZ> Why THE FUCK does openvpn exit 1 with no output even when I set the verbosity to 11
09:14 < ZyZ> ?
09:15 < ZyZ> I hate programs that don't work
09:19 < ZyZ> !welome
09:19 < ZyZ> !welcome
09:19 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:19 < ZyZ> !goal
09:19 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:21 < ZyZ> well here is my goal anyways: http://joelightning.com/pastie.txt
09:22 < ZyZ> And I thought openvpn might be the solution
09:22 < ZyZ> but openvpn exits 1 with no output even when I set the verbosity to 11
09:22 -!- gyyrog [~gyyrog@71-13-67-85.static.aldl.mi.charter.com] has joined #openvpn
09:22 < ZyZ> I have to go now, I'll be back later
09:22 <@vpnHelper> RSS Update - forum: can't connect to internet <http://forums.openvpn.net/topic7923.html#p11152> || DNS issue: can lookup but not use <http://forums.openvpn.net/topic7916.html#p11151>
09:34 < zooz> is there a way to check what clients are currently connected?
09:40 < gladiatr> if you've defined a status file
09:45 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has joined #openvpn
09:47 < zooz> how can I disconnect certain clients if that's possible?
09:48 -!- gyyrog [~gyyrog@71-13-67-85.static.aldl.mi.charter.com] has quit [Remote host closed the connection]
09:49 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has quit [Ping timeout: 252 seconds]
09:57 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has joined #openvpn
09:57 <@vpnHelper> RSS Update - forum: DNS issue: can lookup but not use <http://forums.openvpn.net/topic7916.html#p11153>
09:59  * ecrist lols at ZyZ
10:01 < ZyZ> ecrist: :'(
10:11 < zooz> how can I configure openvpn server to tell clients not to use it as a default gateway?
10:11 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has quit [Ping timeout: 248 seconds]
10:11 < Bushmills> other way around. don't configure server to tell clients to use it as default gateway
10:12 < Bushmills> (means: server won't unless you explicitely ask it to)
10:13 < ZyZ> I posted on the forums
10:14 < zooz> Bushmills, how is it done?
10:14  * ZyZ afk
10:15 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11155> || Can I do this with OpenVPN? <http://forums.openvpn.net/topic7924.html>
10:16 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has joined #openvpn
10:17 < Bushmills> zooz: one uses an interactive openvpn configuration frontend, known as editor, and adds the appropriate configuration directive to the openvpn configuration file
10:19 < zooz> my server config: http://p.defau.lt/?evoJOH5ch3h_p8uL11jS9g
10:19 <@vpnHelper> Title: default paste at 2011-04-11 18:18:53 (at p.defau.lt)
10:20 < Bushmills> that config won't replace default gateway on clients
10:22 < zooz> I get this error while using windows client: http://p.defau.lt/?DfIJqbj4NXN4w7snIgQu7w
10:22 <@vpnHelper> Title: default paste at 2011-04-11 18:21:44 (at p.defau.lt)
10:22 < zooz> not sure what needs to be done to make it work
10:23 < Bushmills> did you read line 2?  "OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options"
10:25 < zooz> so what is the difference between "route x.x.x.x x.x.x.x" and push "route x.x.x.x x.x.x.x" ?
10:25 < Bushmills> first is done on server, second is pushed to clients and set there
10:26 < zooz> so what do I need to add, so my client does not complain?
10:26 < Bushmills> a gateway so that client knows how to reach destinations in the pushed subnet
10:27 < zooz> and how is it done?
10:28 < Bushmills> read about --route in openvpn manpage, look at the parameters it accepts
10:29 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has quit [Ping timeout: 276 seconds]
10:33 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has joined #openvpn
10:46 < krzie> actually
10:46 < krzie> server 2.2.2.80 255.255.255.240    just change that to 255.255.255.0
10:46 < krzie> the route's gateway issue should just go away
10:47 < krzie> and i really hope you are obfuscating the real ips for some reason
10:47 < krzie> !1918
10:47 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, adn 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html
10:50 < zooz> krzee, yup, I am, but my subnet's mask is not 255.255.255.0 it is 255.255.255.240
10:50 < zooz> I am so confused now
10:56 < krzie> you are making a new VPN-only subnet
10:57 < krzie> !/30
10:57 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
10:57 < krzie> you need to choose a 1918 subnet for the vpn
10:57 < krzie> such as shown by my bot above
10:57 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has quit [Ping timeout: 246 seconds]
10:58 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
10:58 < zooz> I do not want p2p, I want many-clients-to-server
11:00 < pwrcycle> !topology
11:00 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
11:00 -!- mant1s [~mant1s@130.111.162.226] has joined #openvpn
11:00 -!- mant1s [~mant1s@130.111.162.226] has quit [Changing host]
11:00 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
11:00 < krzie> [11:59]  <zooz> I do not want p2p, I want many-clients-to-server
11:00 < krzie> is that in reply to something?
11:01 < krzie> i told you how to fix your server command, obviously im also talking about client/server
11:01 < zooz> yup, just looking at topology subnet
11:01 < krzie> topology subnet only works in client/server
11:01 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11157> || DNS issue: can lookup but not use <http://forums.openvpn.net/topic7916.html#p11156>
11:01 < krzie> otherwise it would have no point
11:02 < zooz> sure, that's what I need
11:02 < krzie> its not all you need
11:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:02 < krzie> you also need to fix your subnet in --server, and likely change the subnet
11:02 < krzie> like server 10.8.0.0 255.255.255.0
11:02 < zooz> I have a number of clients and a server, I need the clients to be able to connect to the server and reach internal networks behind the server
11:02 < krzie> !route
11:02 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:02 < krzie> that doesnt matter
11:03 < zooz> krzee, I cannot change my subnet, I give out clients public IPs
11:03 < zooz> which I cannot resubnet or I do not have that many
11:03 < krzie> ahh ok
11:03 < krzie> thats unrelated to the lan thing by the way
11:03 < krzie> but yes, you definitely want topology subnet
11:04 < zooz> well, the lans my clients need to access are also public subnets
11:04 < krzie> so?
11:04 < zooz> I am just saying
11:06 < zooz> I am still not sure why it does not work
11:06 < zooz> it works on linux now
11:07 < pwrcycle> krzie: any suggestions on this setup?: https://cloakvpn.com/london.cloakvpn.conf
11:08 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has quit [Ping timeout: 246 seconds]
11:10 < krzie> pwrcycle, well im not a fan of dropping client certs, but is there something specific you want to hear?
11:10 < krzie> pwrcycle, also, the client config by itself means very little
11:10 < pwrcycle> krzie: i want to make it as easy as possible.
11:11 < pwrcycle> krzie: i'm not protecting a comapny network, so I don't care who the clients are realy.
11:11 < pwrcycle> krzie: yes, i'm combing over my iptables rules as well
11:13 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has joined #openvpn
11:14 < krzie> im referring to the fact that much of a client's function can be controlled by the server
11:14 < krzie> for example, you dont use keepalive, but even if you did, it would not matter if you did it on a client if it was also used on the server
11:15 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 246 seconds]
11:15 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
11:16 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
11:16 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:17 < pwrcycle> krzie: yes, client keepalives are turned off, and server is raised to 89sec.
11:18 < pwrcycle> krzie: i tried to "push" some diff. settings, but not sure they worked testin win vs linux, so i just declared them.
11:18 < krzie> did you happen to read the example of how keepalive works in the manual?
11:18 -!- Diffen [~diffen@109.58.37.114.bredband.tre.se] has quit [Ping timeout: 246 seconds]
11:18 < krzie> !man
11:18 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
11:18 < pwrcycle> krzie: i guess so, mostly i just sniffed the traffic to set things up
11:22 -!- Diffen [~diffen@109.58.37.114] has joined #openvpn
11:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:24 -!- mirco [~mirco@p5B23A9BD.dip.t-dialin.net] has joined #openvpn
11:34 -!- Diffen [~diffen@109.58.37.114] has quit [Ping timeout: 258 seconds]
11:44 <@vpnHelper> RSS Update - forum: bind or lport not working. windows 7 64bit <http://forums.openvpn.net/topic7908.html#p11158>
11:47 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 258 seconds]
11:51 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:56 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11159>
12:00 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 258 seconds]
12:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
12:01 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
12:01 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
12:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:06 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
12:06 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
12:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:13 < crocket> I gave CAP_IPC_LOCK capability to openvpn, but openvpn quits with "out of error" if it was executed with mlock and a client connects to it.
12:13 < crocket> s/out of error/out of memory/
12:15 -!- Diffen [~diffen@109.58.36.107.bredband.tre.se] has joined #openvpn
12:19 -!- robotti^ [robotti@kapsi.fi] has quit [Ping timeout: 276 seconds]
12:22 < stony> crocket: not enough memory (propably) ?
12:22 < stony> crocket: limit for memory per process to low ?
12:22 < crocket> no
12:22 < crocket> stony,  I still have more than 1GBytes left.
12:22 < crocket> stony, If I execute it as root, it doesn't happen.
12:22 < stony> crocket: which platform?
12:23 < stony> crocket: bsd, linux, windows, ... ?
12:23 < crocket> linux 64bit
12:23 < stony> any per process memory limits?
12:23 < crocket> As far as I know, there is none.
12:24 < stony> crocket: hm, check it - imho there seems to be a limit
12:24 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
12:24 < crocket> stony, how?
12:24 < crocket> stony, With mlock as non-root, when a client connects, OpenVPN server quits with "out of memory"
12:24 < stony> crocket: never really used that feature on linux, but let me google that for you
12:24 < crocket> stony, Without mlock as non-root, when a client connects, OpenVPN server just goes along.
12:25 < stony> what is mlock?
12:25 < stony> crocket: check the ulimit
12:25 < stony> ulimit -a
12:25 < crocket> ulimit is only applied to shells.
12:25 < stony> and how is openvpn started?
12:26 < crocket> Since openvpn is started by init, ulimit is not related.
12:26 < crocket> OpenVPN is started by /etc/rc.d/rc.openvpn
12:26 < stony> crocket: change to the user and to a xmalloc $size_in_bytes
12:27 < stony> crocket: i'm pretty sure there is a memory limit
12:30 < crocket> stony, If CAP_IPC_LOCK is set on a file, there should be no limit
12:31 < stony> crocket: and i'm pretty sure that openvpn is started from a script that runs INSIDE a shell
12:31 < stony> crocket: and that ulimit applies to this process as it applies to the shell and the processes started from this shell
12:31 < crocket> stony, If I execute "/etc/rc.d/rc.open start" in a shell, then maybe.
12:31 < crocket> stony, If /etc/rc.d/rc.openvpn is executed by init, no.
12:32 < crocket> init doesn't need a shell.
12:32 < crocket> But
12:32 < crocket> "man capabilities" says CAP_IPC_LOCK removes limit on mlock.
12:32 < stony> crocket: my /etc/rc has a shebang ...
12:33 < stony> crocket: afaik, shell scripts always run inside a shell as those are the interpreters for the scripts ...
12:33 < crocket> stony, And as root, the limit isn't applied.
12:33 < stony> crocket: yeah, because you're root
12:33 < crocket> stony, I gave CAP_IPC_LOCK to openvpn and /etc/rc.d/rc.openvpn
12:33 < stony> crocket: i don't care about the CAP_IPC_LOCK
12:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
12:33 < crocket> CAP_IPC_LOCK ensures root previleges regarding mlock.
12:34 < stony> crocket: but if you don't want to look into the ulimit thing, go and search on ...
12:34 < crocket> stony, because you don't know about CAP_IPC_LOCK?'
12:34 < crocket> stony, I'm about to test ulimit, though.
12:34 < crocket> hmm.....
12:34 < crocket> weird
12:34  * krzie thinks a channel related to the OS would be the best place for learning OS internals, but only mentions that as an attempt to help... it is very on-topic
12:34 < crocket> If I execute "ulimit -l 1024000", then openvpn doesn't quit.
12:34 < crocket> damn
12:35 < stony> surprise!
12:35 < stony> crocket: all i can say to this is: RTFM
12:35 < stony> scnr
12:35 < crocket> Maybe I should let init execute openvpn.
12:35 < krzie> crocket, why do you care if you start openvpn as root anyways?
12:35 < crocket> stony, Do you know about CAP_IPC_LOCK?
12:35 < stony> maybe you should change the memory limits for this user
12:36 < krzie> ild rather start it as root and then drop permissions than give the openvpn user access to change routes / ips
12:36 < crocket> If OpenVPN has a destructive bug, it better runs as non-root.
12:36 < stony> crocket: i don't go for IPC when i configure openvpn
12:36 < crocket> kraut, That's what I do.
12:36 < crocket> stony, why not?
12:36 < stony> crocket: normally the problem is not in the source if you have memory problems as user and not as root
12:36 < krzie> --user and --group drop permissions once starting openvpn
12:36 < krzie> you are giving the openvpn user more access
12:37 < krzie> so actually you subvert security, not add to it
12:37 < krzie> you are doing the opposite of adding security ;]
12:37 < crocket> krzie, I don't get it.
12:38 < krzie> ok theres 2 choices here,  a) start as root, then drop all permissions and let it run as openvpn, this requires none of the stuff you are doing
12:38 < crocket> krzie, You just did leap in logic.
12:38 < stony> i hate metadiscussions
12:38 < crocket> krzie, I start as root and drop to openvpn.
12:38 < krzie> b) start as openvpn user, use sudo to give the user ability to add routes / ips, etc
12:38 < crocket> krzie, I told you.
12:38 < stony> especially if people are not reading the manuals and then try to discuss things they don't get BECAUSE they don't read the manuals
12:38 < crocket> krzie : anyhow, you need to use "sudo" for down script.
12:38 < krzie> crocket, oh i thought i remembered seeing all sorts of stuff in your config that would not exist if you started as root
12:39 < krzie> you only used sudo in a down script?
12:39 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
12:39 < krzie> i thought i saw a BUNCH of config options that only existed so you wouldnt need to start as root
12:39 < crocket> krzie, It was for consistency's sake.
12:39 -!- Phenox_ [~Bernd@88.215.198.24] has joined #openvpn
12:39 < krzie> stony++
12:40 < crocket> If --down script uses sudo and --up doesn't use sudo, it doesn't look neat.
12:40 < krzie> lol
12:40 < stony> my hardware dealer always adds a set of sweets to the order :)
12:40 < crocket> krzie, However, I always start it as root.
12:40 < stony> hmnmm, tasty
12:40 < stony> not to say: sweet
12:40 < stony> ;)
12:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
12:41 -!- Diffen [~diffen@109.58.36.107.bredband.tre.se] has quit [Ping timeout: 240 seconds]
12:41 < Bushmills> manuals are for weenies who can't figure out the program by simply running it
12:41  * Bushmills ducks
12:42 < hyper_ch> I thought programs are to be figured out by cating the source
12:43 < crocket> stony, Look at http://pastebin.com/NethkajN
12:44 < stony> crocket: thanks, but i'll setup my new bsd box now :)
12:44 < crocket> stony : you just leave?
12:45 < stony> crocket: as i said a few lines above: i hate metadiscussions
12:45 < crocket> stony : It's not a metadiscussion.
12:46 < hyper_ch> but talking about metadiscussions is a metadiscussion, right?
12:46 < stony> right
12:46 < crocket> Does anybody have a word about http://pastebin.com/NethkajN ?
12:50 < Bushmills> hyper_ch: that's hardcore
12:50 -!- brianw_ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
12:51 < hyper_ch> Bushmills: cat * > /dev/brain
12:51 < Bushmills> makes one wonder whether  '"is this question a metaquestion" a metaquestion?" is a metaquestion
12:51 < hyper_ch> ohg, better to us >>
12:51 < stony> cat /boot/kernel > /dev/sound
12:51 < stony> i always do that for meditation
12:52 < Bushmills> cat kernel > /dev/fb0
12:52 -!- bwallen [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
12:52 < Bushmills> for higher information density
12:52 < stony> btw i can really suggest those foxconn barebones for small vpn routers :) 200 ebucks for a dual core atom, harddrive, 4 gig mem, and the size of a 3.5 inch harddrive :)
12:53 < stony> got the 2nd one now :)
12:53 < stony> Bushmills: matrix hypnoses?
12:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:01 -!- luneff [~yury@84.51.192.6] has joined #openvpn
13:03 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 252 seconds]
13:07 -!- zooz [~zooz@host86-164-225-136.range86-164.btcentralplus.com] has quit [Quit: Leaving]
13:14 <@vpnHelper> RSS Update - forum: Sharing openvpn connection over Ethernet.. <http://forums.openvpn.net/topic7921.html#p11160>
13:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:20 <@vpnHelper> RSS Update - forum: Sharing openvpn connection over Ethernet.. <http://forums.openvpn.net/topic7921.html#p11161>
13:21 < Bushmills> <cursor up><Enter>  -->  matrix reloaded
13:23  * Bushmills hits the road again
13:45 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 246 seconds]
13:45 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:47 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
13:48 < crocket> I think CAP_IPC_LOCK capability is ignored by OpenVPN.
13:49 < hyper_ch> hi krzie
13:49 <@vpnHelper> RSS Update - forum: Sharing openvpn connection over Ethernet.. <http://forums.openvpn.net/topic7921.html#p11162>
13:50 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 248 seconds]
13:53 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
13:59 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
14:03 < pwrcycle> are there any know bugs with experimental --fast-io on Linux Centos servers?
14:06 < crocket> Does OpenVPN lose CAP_IPC_LOCK capability when dropping previlege?
14:06 < crocket> Does OpenVPN lose CAP_IPC_LOCK capability when dropping to non-root user?
14:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:17 -!- rob0 [~rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
14:40 < krzee> thats OS stuff, not openvpn stuff
14:50 < crocket> After setuid and setgid, OpenVPN loses CAP_IPC_LOCK capability.
14:54 < crocket> "The business with calling prctl is required because by default, calling setuid will also clear the effective and permitted capability sets completely. "
14:56 <@vpnHelper> RSS Update - forum: All working except RDP - Windows7 <http://forums.openvpn.net/topic7925.html>
14:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Read error: Connection reset by peer]
15:22 -!- dazo is now known as dazo_afk
15:24 < crocket> I recently submitted a prctl patch to openvpn-devel list.
15:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:48 < krzee> i would hope you also put it on trac
15:50 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11164>
15:51 < crocket> hmm
15:51 < crocket> krzee, Unfortunately, I submitted to openvpn-devel list
15:51 < crocket> But it doesn't seem to work.
15:51 < crocket> I added prctl(PR_SET_KEEPCAPS,1) for linux, but that function doesn't seem to keep POSIX capabilities during UID downgrade.
15:52 < krzee> thats great, but it wont be a ticket in the ticket system by just mailing the dev list
15:52 < krzee> unless you dont care
15:53 < crocket> ok
15:56 <@vpnHelper> RSS Update - forum: Simple "roadwarrior" VPN <http://forums.openvpn.net/topic7926.html> || OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11165>
15:58 < krzee> although it still sounds like you need to goto the channel for you OS
15:58 < krzee> i still dont think you really have an openvpn problem
15:59 < krzee> im also not 100% sure of that since i do drop permissions but i dont do half the stuff you do while trying to support it
16:02 -!- jester7 [~JeSTeR7@mail.onpointstaffing.net] has joined #openvpn
16:02 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11169> || Simple "roadwarrior" VPN <http://forums.openvpn.net/topic7926.html#p11168> || All working except RDP - Windows7 <http://forums.openvpn.net/topic7925.html#p11167>
16:04 < crocket> krzee, How do you keep OpenVPN from losing POSIX capabilities during UID downgrade?
16:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:05 < krzee> here is my config
16:05 < krzee> !sample
16:05 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
16:05 < krzee> i do nothing special, except drop permissions, it just works
16:06 < krzee> i dont have any of those tons of scripts you use, because i dont need them
16:06 < krzee> everything just works (tm)
16:07 < crocket> krzee, Because you don't need DNS server for VPN.
16:08 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:08 <@vpnHelper> RSS Update - forum: All working except RDP - Windows7 <http://forums.openvpn.net/topic7925.html#p11170>
16:09 < crocket> krzee, With your settings, OpenVPN will make errors during exit.
16:10 < krzee> so?
16:10 < krzee> its exiting, who cares!?
16:10 < krzee> the errors will be that it cant remove the routes, which get removed when the tun devices closes RIGHT AFTER the error
16:11 < crocket> krzee, Some routes remain.
16:11 < krzee> none that are going over the vpn
16:11 < crocket> Those routes include ones that don't go over tun0.
16:12 < krzee> well then sure they remain, and they arent the vpn
16:12 < crocket> Some routes are created that way.
16:12 < crocket> However, you want them to be cleaned up.
16:12 < krzee> the only point in that would be for bypassing the vpn, which would be the same as your default route, and nothing would change by having the routes there upon exit
16:13 < krzee> and if thats not true, explain to me why your vpn adds routes that are niether for sending traffic over the vpn, or around it
16:14 < crocket> krzee, assume that 15.15.15.16 is a client.
16:14 <@vpnHelper> RSS Update - forum: All working except RDP - Windows7 <http://forums.openvpn.net/topic7925.html#p11171>
16:14 < crocket> 15.15.15.0/24 is a public subnet.
16:14 < crocket> I want to access 15.15.15.0/24 via 15.15.15.16 via tun0
16:14 < krzee> umm ok...
16:15 < crocket> So I have to add 15.15.15.16 as a route that doesn't go through tun0.
16:15 < crocket> I wanted to fake my IP address
16:15 < krzee> so you just have route 15.15.15.0 255.255.255.0 in your server config AND route 15.15.15.16 255.255.255.255 net_gateway
16:15 < crocket> krzee : yes
16:16 < krzee> seems like you're going through tons of effort instead of asking the right questions
16:16 < krzee> those routes would fix upon exit
16:16 < crocket> and 15.15.15.16 can't be deleted as non-root.
16:16 < crocket> I had to delete it manually.
16:16 < krzee> and it doesnt need to be
16:16 < crocket> hmm
16:16 < krzee> it would have the same route as your existing default route
16:16 < krzee> aka NO CHANGE!
16:16 < rob0> crocket, did you ever put together a pastebin with the whole configs and goal described?
16:17 < krzee> rob0, he doesnt understand his real goal methinks
16:17 < crocket> krzee, you're confused
16:17 < krzee> seems like
16:17 < krzee> !xy
16:17 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
16:17 < crocket> kraut, The end result was a leftover route
16:17 < krzee> crocket, no im really not
16:17 < rob0> nice link
16:17 < crocket> oops
16:17 < krzee> rob0, thanx, i took it from #bash =]
16:17 < krzee> crocket, yes, i know
16:17 < krzee> route 15.15.15.16 255.255.255.255 net_gateway
16:17 < krzee> THAT leftover route
16:18 < crocket> yeah
16:18 < crocket> I have to manually delete it
16:18 < krzee> the net_gateway internal variable uses your existing default gateway to the inet
16:18 < krzee> NO YOU DONT
16:18 < crocket> after openvpn exits.
16:18 < krzee> it does NOTHING when the vpn is down
16:18 < crocket> ???
16:18 < crocket> But it is not clean.
16:18 < jester7> OK, OpenVPN server using TAP on an Ubuntu server.  Windows 7 clients work perfectly.  Ubuntu clients connect, and can ping the server, but cannot access anything inside the remote network.  What could be the difference?
16:18 < crocket> It makes me do
16:18 < krzee> it says that single IP needs to go over your default gateway
16:18 < krzee> hahaha
16:18 < krzee> IT DOES NOTHING!
16:18 < crocket> krzee, Functionally it would be same, but it is not clean.
16:19 < krzee> not clean is all the stuff you are going through
16:19 < crocket> I have some obsessions for this.
16:19 < krzee> an extra route that does nothing is much cleaner than your configs
16:19 < krzee> transfer your obsession to your configs/goal instead of the extra route in your routing table ;)
16:20 <@vpnHelper> RSS Update - forum: Simple "roadwarrior" VPN <http://forums.openvpn.net/topic7926.html#p11172>
16:20 < crocket> krzee : It's just who I am.
16:20 < crocket> krzee, And the goal was achieved a long time ago.
16:20 < crocket> Now I have a new set of goals.
16:20 < krzee> you would rather spend days confusing yourself than doing things the easy way?
16:21 < crocket> krzee, I'd just give up than leaving leftovers.
16:21 < krzee> and even then, you have only explained *1* of your things, --down
16:21 < rob0> jester7, first off, why tap? Very rarely is bridging needed, and it does cost a lot more bandwidth.
16:21 < crocket> With my config, no leftover or no error is generated.
16:21 < jester7> rob0: You know, I only did it like that because I followed a HowTo.
16:22 < jester7> the thing is, it works really well with windows clients
16:22 < rob0> ah. Probably not a very clueful one, then.
16:22 < Bushmills> !tunortap
16:22 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:22 < krzee> crocket, thats funny, you've been asking for help here and on the maillist but you have no problems?
16:22 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
16:22 < krzee> im telling you how i accomplish your goal without doing anything NEAR what you are doing
16:22 < crocket> krzee, You referred to my past problems.
16:22 < crocket> I solved them.
16:22 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
16:22 < krzee> sure, an extra route would be left, but then you could just use your --down
16:22 < crocket> krzee, I have new problems now.
16:22 < rob0> Hint: there are a lot of clueless howtos out there. More of them than good ones, probably.
16:22 < rob0> !howto
16:22 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:23 < krzee> crocket, your new problems are quite possibly related to your old problems
16:23 < jester7> rob0: This of course, had me setup a bridge as well (br0)
16:23 < crocket> krzee : not likely.
16:23 < krzee> [14:21]  <jester7> rob0: You know, I only did it like that because I followed a HowTo.    <--- you are a good man for coming out and admitting it
16:23 < crocket> krzee : I don't see any link.
16:23 < krzee> we usually have to beat that out of people ;]
16:24 < rob0> jester7, bridging is covered in the official howto as well, but routing is highly recommended instead.
16:24 < jester7> krzee: Hah, you never learn ANYTHING if you pretend to know EVERYTHING.
16:24 < jester7> that's my motto
16:24 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
16:24 < krzee> =]
16:24 < rob0> jester7++
16:24 < krzee> yep!
16:24 < rob0> (that makes him jester8)
16:24 < krzee> (my bot doesnt do karma =/ )
16:24 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
16:25 < jester7> I'm sure routing makes more sense for my use.  
16:25 <@vpnHelper> RSS Update - forum: Simple "roadwarrior" VPN <http://forums.openvpn.net/topic7926.html#p11175> || error with creating a new vpn key <http://forums.openvpn.net/topic7904.html#p11174> || Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p11173>
16:25 < krzee> haha ya i remember you /nick rob1 when i ++'ed you
16:25 -!- luneff [~yury@84.51.192.6] has joined #openvpn
16:25 < krzee> jester7, heres something to get you started
16:25 < krzee> !sample
16:25 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
16:25 < jester7> I am willing to back out and start over...I'm just confused as to why it worked so well with the Windows client
16:25 < krzee> make sure you do as #2 said
16:25 < krzee> !man
16:25 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
16:26 < rob0> It's impossible for us to guess why it worked on one client and not another. Millions of possibilities. Information would be needed. But ...
16:26 < rob0> ... better to start over and do routing.
16:26  * krzee seconds that
16:26 < crocket> rob0, Can you make openvpn accept CAP_IPC_LOCK?
16:27 < krzee> i bet rob0 can make --user and --group work without ever needing to look at CAP_IPC_LOCK ;)
16:27 < krzee> (kinda like ALL my setups do)
16:27 < rob0> crocket, no idea, but I can say that I have run openvpn for many years, ALWAYS downgrading privs, and NEVER had your ENOMEM.
16:28 < krzee> rob0, you seen his configs?
16:28  * rob0 dates back to openvpn 1.0 days
16:28 < jester7> Does this also remove the need for having a br0 and would go back to a simple eth0?
16:28 < rob0> krzee, no
16:28 < crocket> rob0, It's because of mlock.
16:28 < rob0> jester7, yes, and your VPN would be a tun0
16:28 < krzee> he's going through ALMOST all the effort to start openvpn as non-root, but then he starts it as root and downgrades
16:29 < krzee> jester7, yep, makes things much easier for you too :)
16:29 < jester7> rob0: Hmm, I assume that would also allow me to use the network-manager in ubuntu as well, since using TAP seemed to require root/sudo
16:29 < crocket> http://dpaste.com/531055/
16:29 < Bushmills> !ubuntu
16:29 <@vpnHelper> "ubuntu" is dont use network manager!
16:29 < crocket> krzee, It looks like I want to start openvpn as non-root.
16:29 < rob0> um, tun also requires root
16:30 < jester7> rob0: ahh, OK
16:30 < krzee> jester7, yes, but i recommend getting it running with a normal openvpn config, THEN importing it into network-manager
16:30 < rob0> routes and IP address assignments require root
16:30 < jester7> gotcha
16:30 < krzee> if you *must* use network-manager
16:30 < krzee> although im with bushmills on !ubuntu
16:30 < rob0> a VPN generally has to have root privilege at startup.
16:30 < krzee> in fact i wrote !ubuntu ;]
16:30 < krzee> crocket, but you said you dont
16:31 < crocket> krzee, There is one thing I can never do as non-root.
16:31 < crocket> reading key-file.
16:31 < crocket> krzee ,I made that config so that openvpn never complains.
16:31 < crocket> I didn't intend to start it as non-root.
16:31 < jester7> I'm fine with running in in the cli.  I just like to find ways for it to work for the "regular" user if possible.
16:32 < Bushmills> thanks, krzee, for providing me with the means to talk in cartchwords
16:32 < krzee> my openvpn never complains until i kill it, and then its complaints are superflous and dont matter
16:32 < krzee> [10:39]  <crocket> krzie, It was for consistency's sake.
16:32 < Bushmills> catch...
16:32 < krzee> Bushmills, =]
16:32 < jester7> Well, thanks for the help guys.  I'll be setting this up tomorrow...maybe one of you guys will be around if I run into any snags :)
16:32 < crocket> krzee, You obviously are confused about that sentence.
16:33 < krzee> orly
16:33 < krzee> seems to me you are
16:33 < krzee> and since my VPNs do what you want, i tend to think im right ;]
16:33 -!- jester7 [~JeSTeR7@mail.onpointstaffing.net] has quit [Quit: leaving]
16:33 < crocket> krzee, I often don't elaborate.
16:33 < crocket> krzee, Do you want me to epxlain what consistency means in my sentence?
16:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
16:34  * amir starts to really like openvpn
16:34 < krzee> it means that you added a bunch of config options just because you like how they look
16:34 < crocket> krzee, What I want from OpenVPN is more than what you want.
16:34 < krzee> to make things look right to you
16:34 < crocket> yes
16:34 < crocket> look right and it's the right away
16:34 < crocket> way
16:35 < krzee> its the right way, but doesnt work how you want... interesting!
16:35 < Bushmills> "consistency" -> "aggregation state" :D
16:35 < crocket> because it never leaves garbages and never complains.
16:35 < rob0> openvpn --blowup-doll=female,buxom
16:35 < hyper_ch> hi krzie
16:35 < crocket> krzee, What doesn't work my way?
16:35 < krzee> rob0, that only works with ./configure --with-realdoll
16:36  * rob0 recompiles
16:36 < krzee> crocket, are you here asking for help because everything is working correctly?
16:36 < crocket> There are just few problems left.
16:36 < crocket> Most problems have been solved.
16:36 < krzee> heh ok well im going back to scripting my job away
16:36  * Bushmills wonders how many words can be exchanged about a configuration which works flawlessly
16:36 < rob0> IIUC when crocket's openvpn downgrades privileges, he gets out-of-memory errors.
16:36 < crocket> krzee, Either make fun of me or help me.
16:37 < krzee> ill choose option C, point out that everyone else makes it work with far less effort (all you explained was the "need" for --down)
16:38 < krzee> followed by option D, ignore IRC and go back to work
16:38 < crocket> rob0, When a clienct connects to downgraded OpenVPN server, the server makes out-of-memory error and quits.
16:38 < krzee> rob0, take a look at his server config ;)
16:38 < rob0> just did
16:38 < crocket> krzee, less effort means nothing since I do it for fun.
16:38 < krzee> ahh ok
16:39 < crocket> Controlling means a lot
16:39 < crocket> krzee, Find some efficiency in what you do as hobby.
16:39 < krzee> (^ @ rob0)
16:39 < krzee> i do
16:40 < krzee> efficiency, aka doing things correctly and easily
16:40 <@vpnHelper> RSS Update - forum: All working except RDP - Windows7 <http://forums.openvpn.net/topic7925.html#p11176>
16:41 < krzee> well maybe ild need to learn some more programming languages to accurately say "i do", coding a couple thousand lines of bash is far from efficient, even if they run in 15 seconds
16:41 < crocket> As long as I enjoy, I don't care.
16:41 < krzee> cool, continue enjoying =]
16:41 < krzee> thats what counts ;]
16:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:43 < rob0> I hate to speak up for crocket, but I will say I have seen him make a lot of progress in the last few months. Sometimes kind of annoying, but he's always learning. :)
16:44 < krzee> oh i do agree there, im just saying that his goal is easily achieved without most of what hes focused on
16:44 < krzee> based on the "works for us" factor
16:45 < rob0> yup
16:45 < crocket> If "works for us" mattered, I would just carry a small laptop instead of having a server in my room.
16:46 < krzee> but if his goal is simply an exercise in playing around then its different
16:46 < krzee> i usually expect end result as the goal, rather than simply playing
16:46 < krzee> crocket, i fail to understand that... i have servers in my room, and i bet $ rob0 has a few servers at his house as well
16:49 < krzee> i know Bushmills has a least 1 server at his house, ecrist has racks in his basement, and i would be SHOCKED to find that they didnt also downgrade privileges 
16:49 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
16:49 < Bushmills> nope. not at house
16:50 < krzee> your router is a server :-p
16:50 < krzee> oh no, its a client
16:50 < Bushmills> ok, technically you're correct
16:50 < krzee> oh ok, i got lucky then ;]
16:51 < krzee> and it downgrades privs, right?
16:51 < crocket> krzee, What I'm going for ultimately is the flow obtained by progrssing toward a set of well-defined objectives.
16:51 < Bushmills> my gear at home is pretty lightweight stuff. a netbook, a pda, and a wlan router :)
16:51 < crocket> It isn't what I do for living.
16:51 < Bushmills> and the router drops privileges, yes
16:52 < Bushmills> so does the netbook :)
16:52 < rob0> My dedicated server was stolen, unfortunately, but I run server software (openvpn, hostapd, dnsmasq/named) on a desktop machine.
16:52 < krzee> Bushmills, you and your fast link to your server :(   <--jealous
16:52 < crocket> krzee, do you often stay in the flow?
16:53 < krzee> crocket, i fail to take 1 piece of technical information from what you said, it actually meant nothing
16:53 < crocket> rob0, no way, you run dnsmasq and named at the same time?
16:53 < crocket> krzee, then read the book, "flow"
16:53 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
16:53 < krzee> hah
16:53  * Bushmills does
16:53 < rob0> crocket, indeed; named on an alternate port as the server for dnsmasq's recursion needs.
16:54 < crocket> krzee, When others have sex and watch movies, I research OpenVPN. That's called flow.
16:54 < rob0> heh
16:55 < krzee> that sucks man
16:55 < krzee> go get laid instead dude!
16:55 < krzee> i mean i research openvpn too... but i surely put getting laid in front of it
16:57 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11178> || Simple "roadwarrior" VPN <http://forums.openvpn.net/topic7926.html#p11177>
16:57 < krzee> i promise i will quit being a tech the day i become more interested in openvpn than females
16:57 < krzee> oh and by the way
16:57 < krzee> if research is what you want
16:57 < krzee> !book
16:57 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
16:57 < krzee> i HIGHLY recommend jjk's book there
16:58 < krzee> it is a fantasic resource, full of advanced stuff and good explanations
16:58 < krzee> jjk is a very highly respected member of the community, EXTREMELY smart and very very much an openvpn expert
17:00 < krzee> i learned a lot through proof-reading it, and i had already spent a ton of time in the docs / manuals
17:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
17:02 <@vpnHelper> RSS Update - forum: Simple "roadwarrior" VPN <http://forums.openvpn.net/topic7926.html#p11179>
17:04 < crocket> krzee, I think I've already done 30% of the book.
17:05 < krzee> orly, and what makes you assume that?
17:05 < krzee> i mean maybe you have, maybe you havnt, im just curious what you base that on
17:07 < crocket> just approximation
17:08 < krzee> aka "completely random guess" ?
17:08 <@vpnHelper> RSS Update - forum: Simple "roadwarrior" VPN <http://forums.openvpn.net/topic7926.html#p11180>
17:08 < crocket> I'd like call it approximation.
17:08 < crocket> s/like/like to/
17:08 < krzee> im sure you would, but then i pose the quesiton what you base your approximation on, if anything
17:09 < krzee> since "approximation" != "pulled it from my butt"
17:09 < crocket> krzee, Does that really matter?
17:10 < krzee> nope, you're right, i should really be working on my code
17:15 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11181>
17:17 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:23 -!- Chris___ [goose@well.i.made.ur-mom.go.honk-honk.org] has left #openvpn ["The problem with eating and driving, which I love to do, is not being able to have my hands on the wheel at the 10 and 2 position. It's a matter of public safety."]
17:30 -!- RichiH [~richih@freenode/staff/richih] has joined #openvpn
17:31 < RichiH> i know there's extensive documentatation that running openvpn via tcp is not a good idea, but does someone happen to know pf a scientific paper
17:31 < RichiH> that states the same?
17:32 < krzee> !tcp
17:32 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
17:32 < krzee> #1 would be the scientific one
17:32 < krzee> its also referenced in the openvpn manual
17:33 < krzee> #2 would be more for management types, was made by the lead dev of openvpn
17:37 -!- K1ng [KING@180.211.188.56] has joined #openvpn
17:37 < K1ng> hi
17:37 < K1ng> i am having issue with dns resolving
17:39 < K1ng> any idea how to fix it?
17:41 -!- K1ng\ [KING@180.211.188.59] has joined #openvpn
17:43 < krzee> !pushdns
17:43 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
17:43 < rob0> heh, nope, no idea at all.
17:43 < krzee> odds are you are redirecting gateway over the vpn, but your ISP's dns server only responds to IPs inside the ISP's IP blocks
17:44 < krzee> try changing DNS to 8.8.8.8 and see if it helps
17:44 -!- K1ng [KING@180.211.188.56] has quit [Ping timeout: 252 seconds]
17:45 < rob0> Wow. If that WAG pans out, I will give you a cookie!
17:46 < K1ng\> krzee, how do i fix the server?
17:46 < krzee> (its a FAQ, not sure if its *on* the FAQ list, but definitely a FAQ)
17:47 < K1ng\> Tue Apr 12 04:43:21 2011 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct.   [status=160 if_index=25]
17:47 < krzee> !configs
17:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
17:47 < K1ng\> i cant see any pages
17:47 < K1ng\> sorry
17:47 < rob0> It often is beneficial to get the arguments correct.
17:48 < krzee> !forget configs 3
17:48 <@vpnHelper> Joo got it.
17:53 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has joined #openvpn
17:58 -!- K1ng [KING@180.211.188.109] has joined #openvpn
18:01 < orudie> I am now using OpenVPN , but can only access one vlan, but I have 2 set up. Is there a way to access both vlans from vpn client ?
18:01 -!- K1ng\ [KING@180.211.188.59] has quit [Ping timeout: 276 seconds]
18:02 < krzee> orudie, do you require VLAN tagging to accomplish it?
18:02 < krzee> there is an un-merged patch for that, i believe it needs more real world testing to have a chance at inclusion last i knew
18:02 < orudie> krzee, i'm not sure 
18:03 < krzee> nor am i ;)
18:05 < krzee> but assuming not, it would just be this
18:05 < krzee> !route
18:05 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:06 < krzee> if you find you *do* need vlan tagging in openvpn, report back and ill see bout checking the status of that patch
18:07 < krzee> if it in fact still needs testing to be included, you're using it could be beneficial to the project =]
18:13 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11182>
18:14 < orudie> krzee, one second let me show you 
18:15 < K1ng> who got a freelancer.com account here?
18:16 < orudie> krzee, "route add -net 10.10.10.0/24 dev br0" works for the main LAN, but when I add right below it "route add -net 5.5.5.0/24 dev br0" it breaks lots off stuff in my network 
18:16 < orudie> krzee, and 5.5.5.0/24 is actually vlan2 
18:17 -!- allgood [~chatzilla@187.55.198.17] has joined #openvpn
18:17 < allgood> hi folks
18:17 < K1ng> i badly need help. i can pay 20$ for fixing it
18:17 < allgood> i am looking for a free openvpn server to US, anybody can suggest me one?
18:17 < allgood> ultravpn seems to be down right now
18:18 < orudie> K1ng, whats the problem ?
18:18 < K1ng> wait
18:19 < K1ng> i am not getting dns resolvong issue
18:19 < K1ng> Tue Apr 12 04:43:21 2011 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct.   [status=160 if_index=25]
18:19 < krzee> K1ng, 
18:20 < krzee> [15:47]  <K1ng\> Tue Apr 12 04:43:21 2011 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct.   [status=160 if_index=25]
18:20 < krzee> [15:47]  <krzee> !configs
18:20 < krzee> [15:47]  <vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries, or (#3) see !pb for our preferred pastebin
18:20 < K1ng> i still cant see a page :(
18:20 < K1ng> sorry
18:20 < K1ng> i just used one line
18:20 < K1ng> we are just not getting any dns
18:20 < krzee> either way, nobody can help you without seeing your configs, all the clairvoyant people are busy fighting terrorism ;)
18:25 < K1ng> http://pastebin.com/emRZaysV
18:26 < K1ng> ^ server
18:26 < K1ng> http://pastebin.com/j42iiFqD
18:26 < K1ng> ^ client
18:27 < K1ng> anyone?
18:29 < K1ng> well i will pay 20$ whoever fix this problem
18:30 -!- orudie_ [~Paul@ool-18be3d82.dyn.optonline.net] has joined #openvpn
18:30 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11183>
18:31 < krzee> read this again
18:31 < krzee> !configs
18:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
18:32 < krzee> pay attention to EVERYTHING the bot said
18:32 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
18:32 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
18:32 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
18:32 < K1ng> ok wait
18:32 < krzee> im not looking at a 300 line config file that has like 15 lines of config in it
18:33 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has quit [Ping timeout: 260 seconds]
18:35 -!- Wintereise [Ojou-sama@unafilliated/wintereise] has joined #openvpn
18:35 < K1ng> yo
18:35 < Wintereise> Hello.
18:36 < Wintereise> http://pastebin.com/YhFx2fpT
18:36 < K1ng> krzee, ^ server config
18:36 < K1ng> Wintereise, read this first 
18:36 < K1ng> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
18:37 -!- orudie_ [~Paul@ool-18be3d82.dyn.optonline.net] has quit [Ping timeout: 276 seconds]
18:38 < krzee> do you also want suggestions towards improving the config, or just care about solving the issue?
18:38 < K1ng> both please
18:38 < krzee> i can see a few things that would make it better, but not help the problem
18:38 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has joined #openvpn
18:38 < krzee> ok
18:38 < krzee> you have proto tcp
18:38 < krzee> !tcp
18:38 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
18:38 < krzee> !paths
18:38 < krzee> !path
18:38 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
18:38 < krzee> !ipp
18:38 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
18:38 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
18:39 -!- iyuna [Wintereise@unafilliated/wintereise] has joined #openvpn
18:39 < iyuna> Sorry
18:39 < krzee> !dupe
18:39 < iyuna> Connection dropped
18:39 <@vpnHelper> "dupe" is see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended)
18:39 < iyuna> Anyway, I pushed local dns after nothing external would work
18:39 < iyuna> And had to add a route on the box to the ip
18:39 < iyuna> but, nothing still works
18:39 < krzee> iyuna, np, just waiting on the client config, any CCD issues, and all involved OS / versions
18:40 < krzee> (versions of openvpn)
18:40 < iyuna> I can finally use nslookup to look things up, but nohting else can be resolved
18:40 < iyuna> And sure
18:40 < iyuna> Sec
18:40 < krzee> s/ccd issues/ccd files/
18:40 < K1ng> Wintereise, you here?
18:40 < krzee> K1ng, thats him (iyuna)
18:40 < K1ng> hmm
18:40 < K1ng> can i pm you krzee?
18:40 < krzee> [16:39]  * iyuna (Wintereise@unafilliated/wintereise) has joined #openvpn
18:41 < krzee> [16:39]  <iyuna> Connection dropped
18:41 < K1ng> oh lol
18:41 < krzee> nah i prefer to talk in the channel unless theres a reason not to
18:41 < krzee> is there a reason not to?
18:41 -!- Wintereise [Ojou-sama@unafilliated/wintereise] has quit [Ping timeout: 260 seconds]
18:41 < K1ng> can i notice you?
18:41 < krzee> hehe go ahead and msg 
18:42 < krzee> haha ya i heard you say that a few times ;]
18:42 < krzee> if you like, there is:
18:42 < krzee> !donate
18:42 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel., or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc., or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
18:42 < orudie> krzee, help him out and get him to paypal you $20
18:43 < K1ng> krzee, i will donate too :)
18:43 < krzee> orudie, sure, i help plenty of people for free, and im pretty sure at least this guy wont fight the answers that fix his setup ;)
18:43 < iyuna> krzee, client config is here -> http://pastebin.com/ytGkTy4Q
18:43 < krzee> (that was not in reference to any 1 specific person)
18:43 < iyuna> and openvpn version, sec
18:43 < krzee> oh god
18:44 < iyuna> [root@localhost openvpn]# openvpn --version
18:44 < krzee> iyuna, 
18:44 < iyuna> OpenVPN 2.1.4 i386-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Mar 10 2011
18:44 < iyuna> Originally developed by James Yonan
18:44 < iyuna> Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
18:44 < iyuna> mm
18:44 < iyuna> ?
18:44 < krzee> [16:32]  <krzee> im not looking at a 300 line config file that has like 15 lines of config in it
18:44 < iyuna> ....lol.
18:44 < K1ng> lmao
18:44 < iyuna> Let me strip then, sec
18:44 < krzee> [16:36]  <K1ng> Wintereise, read this first 
18:44 < krzee> [16:36]  <K1ng> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
18:44 < orudie> don't paste the comments 
18:44 < iyuna> No grep on windows, lol. Going to have to hand sort
18:45 < krzee> ahh, what version of windows?
18:45 < iyuna> 7 x64
18:45 < krzee> ok
18:45 < krzee> not sure if it still is true in win7 or not
18:45 < krzee> i havnt used win7 before ;]
18:45 < orudie> whats the problem again ?
18:45 < krzee> but old windows (xp i know for sure) had a weak ass resolver issue
18:45 < krzee> that was fixed by changing a reg entry
18:45 < krzee> !pushdns
18:46 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
18:46 < krzee> info at #2 / #3
18:46 < K1ng> http://pastebin.com/HeskPRgi
18:46 < krzee> where windows would REPORT using the new NS, but wouldnt actually do it
18:46 < krzee> they dug into the problem in that thread, and found a couple solutions
18:47 < krzee> it was a windows issue specificly
18:47 < iyuna> I stopped the cache and restarted
18:47 < iyuna> Persisted :/
18:47 < iyuna> Config is here -> http://pastebin.com/nebriP2s
18:47 < K1ng> iyuna, i am faster than you :
18:48 < iyuna> So it seems.
18:48 < krzee> push "dhcp-option DNS 8.8.8.8"
18:48 < krzee> in your client config
18:48 < krzee> you cant have that ;)
18:48 < iyuna> Tried it once already, will again.
18:48 < krzee> clients dont push ANYTHING
18:48 < K1ng> ah
18:48 < krzee> i know you did, remove it
18:48 -!- allgood [~chatzilla@187.55.198.17] has quit [Quit: ChatZilla 0.9.86.1 [Iceweasel 3.5.16/20110107151845]]
18:48 < iyuna> Okay
18:49 < krzee> it wont fix your problem, but it doesnt belong
18:49 < K1ng> removed
18:49 < krzee> what is 192.168.3.1
18:49 < iyuna> My local dns server
18:49 < K1ng> where?
18:49 < iyuna> One that actually worked
18:49 < krzee> local to what
18:50 < iyuna> To me, the client
18:50 < K1ng> router
18:50 < iyuna> I now can use nslookup to look stuff up
18:50 < iyuna> But windows stillr efuses to resolve anything itself
18:50 < iyuna> =/
18:50 < iyuna> Let me change that to 8.8.8.8 and test again
18:50 < krzee> what happens if you force the inet interface to use 8.8.8.8 manually
18:51 < iyuna> Same thing
18:51 < krzee> and yes, do that as well
18:51 < krzee> try both
18:51 < iyuna> Okay
18:51 < iyuna> Sec
18:51 < krzee> and also
18:51 < krzee> i will want these:
18:51 < krzee> change BOTH sides to verb 4
18:51 < krzee> and:
18:51 < krzee> !logs
18:51 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
18:51 < krzee> i know it says use verb 5, but use verb 4
18:52 < K1ng> lol
18:52 < iyuna> Okay
18:52 < krzee> 5 is for firewall issue hunting ;]
18:52 < krzee> when you get the logs for me, i will want both sides to include a connection being made
18:52 < iyuna> The weird thing is, this exact same config works on a vps I have, but not on this box :/
18:52 < iyuna> And sure
18:52 < K1ng> why ns-cert-type server in client?
18:53 < krzee> it is for checking against MITM attacks
18:53 < krzee> its good for security =]
18:53 < krzee> more info here:
18:53 < krzee> !mitm
18:53 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially, or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates, or (#3) then use: ns-cert-type server in the client config
18:54 < krzee> iyuna, exact same client too?
18:54 < iyuna> krzee, yea
18:55 < krzee> oh and another one of those suggestions that wont fix your problem:
18:55 < krzee> !hmac
18:55 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
18:55 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
18:55 < krzee> that wont matter while using TCP iirc, but another suggestion was to use udp ;)
18:56 < iyuna> I originally do use udp
18:56 < iyuna> But my silly ISP has a gateway it switches to at night that messes with udp packets
18:56 < iyuna> Badly
18:56 < iyuna> Here's a server side log, krzee: http://pastebin.com/SyjYk3WY
18:57 < krzee> ahh ya that sucks
18:57 < krzee> happens, and sucks
18:57 < iyuna> And here's the client side: http://pastebin.com/9f8Lg9nc
18:58 < krzee> show me netstat -rn on client after the connection?
18:58 < iyuna> Sec
18:59 < krzee> and can you ping 8.8.8.8 from the client?
19:00 < iyuna> After connection? Let me check in a sec
19:00 < iyuna> Here's the netstat: http://pastebin.com/ehBUqpxX
19:00 < krzee> ya after, sorry i know im asking a few things at once
19:00 < iyuna> Don't worry
19:00 < iyuna> You're doing me a favour, not the other way around
19:00 < iyuna> :p
19:01 < krzee>           5.0.0.0        255.0.0.0         On-link      5.37.233.238   9256
19:01 < krzee> thats interesting, but beyond the scope
19:01 < iyuna> and yes, I can
19:01 < krzee> hehehe
19:01 < iyuna> That's Hamachi :p
19:01 < krzee> ahh, lol
19:01 < krzee> can you kill hamachi during the testing?
19:01 < iyuna> Sure
19:01 < krzee> would like to know its not playing with DNS
19:01 < krzee> (i dont use hamachi, wanna cut that out as a posibility)
19:02 < iyuna> Killed, but the route stays :S
19:02 < iyuna> Manual deletion time
19:02 < krzee> thats fine
19:02 < krzee> the route wont hurt
19:02 < iyuna> Oh, okay
19:02 < krzee> as long as you can still ping 8.8.8.8
19:03 < krzee> oh right this is windows
19:03 < krzee> if you reboot, will hamachi start on boot?
19:03 < iyuna> Yeah
19:03 < krzee> if not, please reboot, just cause its windows and lets be safe ;]
19:03 < iyuna> Just let me nuke the route, does the job, no?
19:03 < krzee> well i dunno *what* hamachi does
19:04 < krzee> if it only effects dns by routes, then yes
19:04 < iyuna> It's a p2p user to user tunnel
19:04 < krzee> if it does something else to catch dns, then no
19:04 < iyuna> Shouldn't have anything o do with dns
19:04 < iyuna> C:\Users\Tomoyo>nslookup
19:04 < iyuna> DNS request timed out.
19:04 < iyuna> timeout was 2 seconds.
19:04 < iyuna> Default Server: UnKnown
19:04 < iyuna> Address: 8.8.8.8
19:04 < iyuna> Can't resolve using that, but I can resolve using my router's
19:04 < iyuna> :/
19:04 < iyuna> (I use 8.8.8.8 as my normal dns without the vpn, works fine there too)
19:04 < krzee> but you can still ping 8.8.8.8 right?
19:04 < iyuna> Yeha
19:04 < iyuna> Yeah *
19:05 < krzee> turn off the vpn, set your dns to use 8.8.8.8 manually, comment out the push dns from the server, try again
19:05 < iyuna> Okay
19:06 < krzee> oh and before trying again
19:06 < krzee> resolve something =]
19:07 < iyuna> Hm
19:07 < iyuna> Resolves fine without the vpn
19:07 < krzee> ok good
19:08 < iyuna> C:\Users\Tomoyo>nslookup google.com
19:08 < iyuna> DNS request timed out.
19:08 < iyuna> timeout was 2 seconds.
19:08 < iyuna> Server: UnKnown
19:08 < iyuna> Address: 8.8.8.8
19:08 < iyuna> Same issue without it
19:08 < iyuna> (I manually set 8.8.8.8 as the server)
19:08 < krzee> same issue without the vpn?
19:08 < krzee> or without the push dns
19:08 < iyuna> with the vpn*
19:08 < iyuna> Without the vpn, it works fine
19:08 < iyuna> With the vpn and with or without push dns, it's the same
19:08 < krzee> do you require DNS to flow over the vpn/
19:08 < iyuna> No
19:08 < iyuna> Anything is fine
19:09 < iyuna> As long as it resolves
19:09 < krzee> push "route 8.8.8.8 255.255.255.255 net_gateway"
19:09 < krzee> in server config
19:09 < iyuna> okay
19:10 < krzee> then rinse and repeat ;)
19:10 < krzee> if that works, ill tell ya why
19:10 < krzee> if it doesnt, we'll keep trying
19:10 < K1ng> why
19:10 < iyuna> Am I supposed to replace net gateway with my gateway?
19:10 < krzee> nope
19:10 < krzee> leave it as is
19:10 < iyuna> It didn't then
19:10 < krzee> thats an openvpn internal var
19:11 < iyuna> Oh
19:11 < iyuna> It did
19:11 < iyuna> C:\Users\Tomoyo>nslookup google.com
19:11 < iyuna> Server: google-public-dns-a.google.com
19:11 < iyuna> Address: 8.8.8.8
19:11 < iyuna> Non-authoritative answer:
19:11 < iyuna> Name: google.com
19:11 < iyuna> Addresses: 74.125.232.113
19:11 < krzee> it fixed it?
19:11 < krzee> ok
19:11 < iyuna> I can now use nslookup for dns
19:11 < krzee> soooo
19:11 < iyuna> But windows is still broke
19:11 < iyuna> <_<
19:11 < iyuna> It won't lookup anything by itself o-o
19:12 < krzee> it seems the SERVER cant resolve via 8.8.8.8
19:12 < K1ng> lol
19:12 < K1ng> try another dns server then 
19:12 < K1ng> just get it done within 10 hours or i will be dead
19:13 < iyuna> [root@localhost openvpn]# nslookup
19:13 < iyuna> > 8.8.8.8
19:13 < iyuna> Server: 193.109.68.17
19:13 < iyuna> Address: 193.109.68.17#53
19:13 < iyuna> Non-authoritative answer:
19:13 < iyuna> 8.8.8.8.in-addr.arpa name = google-public-dns-a.google.com.
19:13 < iyuna> Authoritative answers can be found from:
19:13 -!- iyuna was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
19:13 -!- iyuna [Wintereise@unafilliated/wintereise] has joined #openvpn
19:13 < K1ng> lol
19:13 < iyuna> orz
19:13 < krzee> hehe
19:13 < iyuna> Pastebinning
19:13 < iyuna> http://pastebin.com/tReGr3kb
19:13 < iyuna> That's on the server
19:14 < iyuna> Some bits got cut off, but it resolved fine
19:14 < iyuna> :/
19:14 < krzee> seems you arent using 8.8.8.8
19:14 < krzee> thought you said you were
19:15 < iyuna> I am o;
19:15 < krzee> [17:13]  <iyuna> Server: 193.109.68.17
19:15 < krzee> [17:13]  <iyuna> Address: 193.109.68.17#53
19:15 < krzee> you are using 192.109.68.17
19:15 < iyuna> Oh, on that
19:15 < krzee> oh different machines
19:15 < krzee> gotchya
19:15 < iyuna> Server side, I don't know, lol.
19:15 < iyuna> Client side, I am.
19:15 < krzee> can the server do this:
19:15 < krzee> host google.com 8.8.8.8
19:16 < iyuna> Yes
19:16 < iyuna> http://pastebin.com/3U7srv3b
19:16 < krzee> server running a firewall?
19:16 < krzee> i cant believe i didnt ask that til now
19:16 < iyuna> iptables, but I added the default rules any howto anywhere said
19:17 < K1ng> lol
19:17 < krzee> lets see 'em =]
19:17 < iyuna> krzee, http://pastebin.com/Tn72M107
19:17 < iyuna> There
19:17 < krzee> (disclaimer, im no iptables expert)
19:17 < krzee> oh my
19:18 < krzee> for testing can you just make it accept EVERYTHING
19:18 < iyuna> <-- No iptables expert either
19:18 < iyuna> Okay
19:18 < krzee> but keep the nat rules
19:18 < iyuna> I totally killed it, lol
19:18 < iyuna> Okay, time to filter some stuff
19:18 < K1ng> you killed iptables?
19:18 < krzee> before filtering
19:18 < krzee> first we test stuff
19:19 < krzee> first make sure you can still ping 8.8.8.8 while connected
19:19 < krzee> gotta make sure you didnt kill the NAT
19:19 < iyuna> Let me test
19:20 < iyuna> Yeah, I can
19:20 < krzee> ok good
19:20 < krzee> *now* can you resolve something?
19:21 < iyuna> Sec
19:21 < krzee> hrm, actually if bypassing the route to the vpn for the host 8.8.8.8 didnt help, i dont think this will now that i think bout it
19:22 < krzee> it seems to be the windows resolver
19:22 < iyuna> I can use nslookup for it, yeah. Resolves fine. But nothing else can resolve automatically
19:22 < iyuna> <_<;
19:22 < iyuna> Server: google-public-dns-a.google.com
19:22 < iyuna> Address: 8.8.8.8
19:22 < iyuna> Non-authoritative answer:
19:22 < iyuna> Name: google.com
19:22 < iyuna> Addresses: 74.125.232.112
19:22 < iyuna> Working nicely
19:22 < iyuna> but
19:22 -!- mode/#openvpn [+b *!Wintereise@*unafilliated/wintereise] by vpnHelper
19:22 -!- iyuna was kicked from #openvpn by vpnHelper [Repeated flooding! You've repeatedly flooded this channel. Please come back later.]
19:22 < krzee> heh
19:23 < K1ng> sh1t
19:23 < krzee> now i get to figure out how to unban in my bot again
19:23 < krzee> i usually just let it expire naturally
19:23 < K1ng> thats your bot?
19:23 < rob0> you can op yourself and unban manually
19:24 < rob0> /mode -b *!Wintereise@*unafilliated/wintereise
19:24 < krzee> sure, but my bot will care i think
19:25 < rob0> oh
19:25 < krzee> but hey, why not try
19:25 -!- iyuna [~root@p205-185-126-190.ftth.kyoto.tsu-ji.jp] has joined #openvpn
19:25 < iyuna> Sorry for actually evading that ban, but
19:25 < iyuna> :/
19:25 < krzee> np, im removing
19:25 < rob0> ah, that works too
19:26 -!- mode/#openvpn [+o krzee] by ChanServ
19:26 < rob0> but, it's a VERY BAD idea to IRC as root. Some channels ban you for that.
19:26 -!- mode/#openvpn [-b *!Wintereise@*unafilliated/wintereise] by krzee
19:26 < iyuna> But yeah, windows can't resolve anything
19:26 -!- mode/#openvpn [-o krzee] by krzee
19:26 < iyuna> rob0: I know, let me fix that, sec
19:26 < iyuna> :p
19:26 -!- Wintereise [Wintereise@unafilliated/wintereise] has joined #openvpn
19:26 -!- iyuna [~root@p205-185-126-190.ftth.kyoto.tsu-ji.jp] has quit [Client Quit]
19:26 -!- ichbinder [8107f9dd@gateway/web/freenode/ip.129.7.249.221] has joined #openvpn
19:27 < Wintereise> But yeah, seems to be windows that's causing all this headache ;/
19:27 < K1ng> fuk microsoft
19:27 < K1ng> its made by gay for gay
19:28 < krzee> specifically the windows resolver
19:28 < krzee> did you check if that reg entry still exists in win7?
19:28 < krzee> !windows
19:28 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
19:28 < Wintereise> which reg entry?
19:28 < Wintereise> o;
19:28 < krzee> !pushdns
19:29 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
19:29 < Wintereise> Let me implement
19:29 < Wintereise> Sec
19:29 < krzee> #3
19:29 < K1ng> lol @ http://secure-computing.net/files/windows_2.jpg
19:29 < krzee> dont blindly impliment, do it manuallyt
19:29 < krzee> it was for XP iirc
19:29 < Wintereise> Yeah, going to check if it exists first
19:29 < krzee> so make sure the keys even exist still
19:30 < krzee> =]
19:30 < ichbinder> !welcome !goal My system: Win7 Prof., latest OpenVPN download. I am trying to use a crt and a conf file from my university. When I'm starting OpenVPN Gui as admin, it appears in the taskbar but I can only right click it. There is option for proxy, about, and exit. Nothing else I can do... Left-clicking doesn't work and it stays red as not connected.... I'm probably missing something simple here...? Do I have to change the crt + co
19:31 < krzee> ichbinder, because you did not put the configs in the right dir with the .ovpn extension
19:31 < Wintereise> Start"=dword:00000002 <-- This one exists
19:31 < Wintereise> And the value is correct
19:31 < ichbinder> krzee: thanks for answering. I put both, uni-server.conf and uni-server.crt into the config dir
19:31 < krzee> so do you see the problem then?
19:32 < Wintereise> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters] <-- None of these exist
19:32 < krzee> hint: by reading what i said carefully, then what you said, you should know it
19:32 < Wintereise> Should I put them in?
19:32 < ichbinder> krzee: not really... I mean, the README says it expects ovpn files... but I don't know where else to put it.
19:32 < ichbinder> krzee: ok, I'll think about it. :)
19:32 < krzee> Wintereise, honestly i know nothing of windows internals
19:32 < ichbinder> krzee: thanks.
19:32 < krzee> ichbinder, 
19:32 < Wintereise> :/
19:32 < Wintereise> Hm
19:32 < krzee> your config is .conf, make it .ovpn
19:33 < krzee> "with the .ovpn extension"
19:33 < ichbinder> krzee: that's what I was about to try... :D thanks
19:33 < krzee> =]
19:33 < ichbinder> krzee: awesome, thanks!
19:33 < krzee> yw
19:33 < ichbinder> krzee: i love irc... :)
19:34 < krzee> if only Wintereise's problem was as easy as yours ;]
19:34 < krzee> he's stuck in windows resolver hell
19:34 < Wintereise> :(
19:35 < ichbinder> oh... :(
19:35 < ichbinder> let me read...
19:36 < krzee> Wintereise, 
19:36 < krzee> http://anotherschwab.wordpress.com/2009/10/27/untangle-openvpn-client-stops-resolving-fqdns-in-windows-7/
19:36 <@vpnHelper> Title: Untangle OpenVPN client stops resolving FQDNs in Windows 7? « There is no box (at anotherschwab.wordpress.com)
19:36 < K1ng> is it fixed?
19:36 < krzee> booya, first hit on my google!
19:36 < K1ng> lol
19:36 < krzee> my google was:  "windows 7 resolver openvpn"
19:36 < krzee> seems to be the exact same problem, and he fixed it
19:37 < Wintereise> hm
19:37 < K1ng> Wintereise, can you just make it username/password enabled login?
19:38 < krzee> K1ng, that a) wont help anything   b) is less secure
19:38 < K1ng> ah
19:38 < krzee> and c) wont offer any forward security iirc
19:38 < K1ng> i am eating corn
19:38 < krzee> of course ADDING l/p to make it dual factor hurts nothing, and does add something
19:38 < K1ng> without frying it
19:41 < K1ng> http://support.microsoft.com/kb/942440
19:41 <@vpnHelper> Title: You may be unable to access the network when name resolution is performed through a VPN connection on a Windows XP-based or on a Windows Server 2003-based client computer (at support.microsoft.com)
19:42 < ichbinder> hm.... seems like wintereise is about to fix it? :)
19:42 < Wintereise> Moved around
19:42 < Wintereise> Did nothing
19:42 < Wintereise> :/
19:42 -!- Champi [Champi@rootshell.fr] has quit [Read error: Operation timed out]
19:44 < krzee> that looks promising too K1ng 
19:45 < K1ng> i am trying but i cant find "Use default gateway on remote network" thing
19:45 < K1ng> check box
19:45 < Wintereise> Doesn't exist for non pptp/chap vpns
19:46 < Wintereise> aka It only works for vpns you can access using the native windows dialer
19:46 < K1ng> ah
19:46 < K1ng> just make it pptp
19:46 < K1ng> i need to deliever this shit asap
19:46 < krzee> However, if the DHCP server does not update the client routing table before the DNS Client service validates the DNS server on the VPN adapter, the DNS Client service assumes that the current DNS server on the VPN adapter cannot be reached. Then, the DNS Client service removes the DNS suffix from the VPN adapter on the DNS Suffix Search List. Therefore, the DNS queries are never sent to the DNS server that is present on the VPN adapter, and 
19:46 < krzee> clients cannot resolve any names on the corporate network.
19:46 < krzee> hehehe
19:46 < Wintereise> `-`
19:49 -!- iyuna [~reise@unafilliated/wintereise] has joined #openvpn
19:50 -!- reise [Wintereise@unafilliated/wintereise] has joined #openvpn
19:50 < reise> :(
19:50 < K1ng> :(
19:50  * K1ng cries
19:51 < reise> This looks like a Windows 7 failure, not openvpn
19:51 -!- Wintereise [Wintereise@unafilliated/wintereise] has quit [Ping timeout: 264 seconds]
19:52 < krzee> yep, it is
19:52 < krzee> odd tho, i remember a similar issue in older windows, hadnt seen it in win7
19:52 < Bushmills> sounds a bit like the story of the fail proof torpedos
19:53 < Bushmills> (you know, the ones which self-destroyed, should their bearing change by 180°)
19:54 -!- iyuna [~reise@unafilliated/wintereise] has quit [Ping timeout: 276 seconds]
19:54 < krzee> hah opera crashed on the MS support page
19:54 < krzee> classic example of irony methinks
19:54 < K1ng> krzee, can you test the server?
19:55 < krzee> K1ng, certainly not from windows
19:55 < krzee> but your problem is on the client
19:55 < K1ng> what are you on?
19:55 < Bushmills> i'd prefer if opera crashed the MS support page 
19:55 < K1ng> linux?
19:55 < krzee> i use freebsd and osx
19:55 < K1ng> well can you test it on those os please?
19:56 < krzee> can already tell you it will work
19:56 < krzee> your server is fine, the problem is your clients resolver
19:57 < krzee> however, you may or may not want to remove the route we pushed to bypass the vpn for 8.8.8.8
19:57 -!- ichbinder [8107f9dd@gateway/web/freenode/ip.129.7.249.221] has quit [Ping timeout: 252 seconds]
19:57 < krzee> that was for testing only
19:59 < reise> krzee
19:59 < krzee> the real question is:
19:59 < reise> Dns works for me through my vps
19:59 < krzee> what OS will the user be on?
19:59  * reise is now dumb
19:59 < reise> BUt not through this guy's dedi
19:59 < reise> lolwat
20:00 < krzee> oh you're the same guy
20:00 < krzee> got enough names? :-p
20:00 < reise> Yeah :p
20:00 -!- reise is now known as Wintereise
20:00 < krzee> reise, same server config?
20:00 < Wintereise> and I'm not even having to push dns here, it just works
20:00 < Wintereise> Gonna dump all logs, give me a second
20:01 < Wintereise> Chain FORWARD (policy ACCEPT)
20:01 < Wintereise> target prot opt source destination
20:01 < Wintereise> ACCEPT all -- anywhere anywhere
20:01 < Wintereise> ACCEPT all -- anywhere anywhere
20:01 < Wintereise> I think those are the reason it's working
20:02 < Wintereise> Might have been iptables after all
20:02 < Wintereise> lol
20:03 < Bushmills> Wintereise: do you --redirect-gateway?
20:03 < Wintereise> Bushmills, nope
20:04 < Wintereise> well, I do have that def1 setting in my config to forward data through it
20:04 < Bushmills> then your dns requests go possibly not through vpn at all
20:04 < K1ng> Tue Apr 12 06:12:25 2011 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 8.8.8.8 255.255.255.255 net_gateway,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
20:04 < krzee> Wintereise, careful dude
20:04 < K1ng> ^ fails too
20:05 < krzee> if you keep triggering the bot, eventually you'll just be banned by it :-p
20:05 < Wintereise> I'm positive it's iptables messing with it again
20:05 < krzee> !ping
20:05 <@vpnHelper> pong
20:05 < K1ng> wait
20:05 < K1ng> Tue Apr 12 06:12:25 2011 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 8.8.8.8 255.255.255.255 net_gateway,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' < i am not getting any error
20:06 < Bushmills> in which case your von setup leaks critical data, like, for what hosts your client queries  dns
20:06 < Bushmills> vpn
20:06 < krzee> K1ng, you werent getting an error before
20:06 < krzee> at least not in the log i looked at
20:06 < Wintereise> There are no errors
20:06 < Wintereise> It works
20:06 < Wintereise> Just no dns
20:06 < K1ng> ah
20:07 < krzee> Bushmills, i dont think they actually care if they leak dns info
20:07 < krzee> they just want it to work, either way
20:07 < Wintereise> DNS is working fine with the other config
20:07 < Wintereise> I seriously am now lost
20:07 < Wintereise> (Manually specified dns works for this one, doesn't for other)
20:07 < krzee> i tried to bypass the vpn manually for it even,  with push "route 8.8.8.8 255.255.255.255 net_gateway"
20:07 < krzee> so we did prove it's on the client
20:08 < K1ng> you want me to try on windows xp?
20:08 < krzee> sure, that would be easier
20:08 < RichiH> krzee: belated thanks
20:08 < krzee> then you can use the regedit fix from !pushdns
20:08 < krzee> RichiH, np =]
20:08 < RichiH> kraut: you here? :)
20:09 < krzee> was that meant for me?
20:09 < RichiH> no, i just noticed kraut was here when tab completing ou
20:09 < RichiH> you*
20:09 < krzee> (it happens from nick completion somewhat often ;] )
20:10 < Wintereise> K1ng, try it once again
20:10 < Wintereise> Ugh
20:10 < RichiH> it's not an actual paper, but i'll add it to my list of potential sources
20:10 < krzee> cool
20:10 < krzee> its the one that was chosen to go in the ovpn manual, so its the one i reference
20:12 < krzee> if you find one you like bettter maybe let me know and ill look it over, see about maybe putting it in the manual too
20:12 < K1ng> wait
20:13 -!- K1ng\ [KING@180.211.188.26] has joined #openvpn
20:14 < RichiH> krzee: i have http://www.ispl.jp/~oosaki/papers/Honda05_ITCom.pdf on my reading list
20:15 < K1ng\> Tue Apr 12 07:14:29 2011 us=327000 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
20:15 < K1ng\> Tue Apr 12 07:14:29 2011 us=374000 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct.   [status=160 if_index=25]
20:15 < RichiH> krzee: if you read it before i do, give feedback  :)
20:15 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11184>
20:15 < K1ng\> yes
20:15 < K1ng\> its working now
20:15 < K1ng\> YAY
20:15 < K1ng\> Wintereise, 
20:16 < K1ng\> what did you do?
20:16 < Wintereise> Pray that he uses xp
20:16 < Wintereise> Oh
20:16 < K1ng\> lol
20:16 < Wintereise> I dropped iptables, all rules
20:16 < K1ng\> fuk yeah :D
20:17 < K1ng\> krzee, mate.
20:17 < K1ng\> you are awesome
20:17 < K1ng\> thank you a lot for helping us :)
20:17 < Wintereise> wait
20:17 < Wintereise> Works on 7?
20:17 < K1ng\> yes
20:17 < Wintereise> I'm still getting the dns o failure
20:17 < krzee> yw
20:17 -!- K1ng [KING@180.211.188.109] has quit [Ping timeout: 260 seconds]
20:17 < Wintereise> Doesn't matter, as long as it does
20:17 < Wintereise> Sigh
20:17 < K1ng\> lol
20:17 < K1ng\> its just working
20:18 < K1ng\> well i had to set dns on my own 
20:18 < K1ng\> :s
20:18 < krzee> RichiH, cool, its somewhere on my to-do list
20:18 < Wintereise> I have it set on my own, still doesn't
20:18 < Wintereise> K1ng\, disconnect and reconnect
20:18 < Wintereise> See if it still does
20:18 < K1ng\> restart your network
20:18 < Wintereise> If it does, it's naptime
20:19 < krzee> and to K1ng\ / Wintereise, good netiquette guys, if only everyone who goes looking for help on irc was like you guys
20:19 < Wintereise> Thanks :)
20:19 < K1ng\> thanks :)
20:21 < K1ng\> krzee, can you verify it for us please
20:21 < K1ng\> its about my rep on freelancer.com :(
20:22 < krzee> verify what?
20:22 < K1ng\> the server
20:22 < K1ng\> if its work
20:22 < krzee> but i dont use windows, your issue was 100% windows
20:23 < krzee> in unix ild be using a script to update my resolv.conf
20:23 < krzee> it would work very differently, and it WOULD work
20:23 < Wintereise> Hell, even dnsmasq is easier than this
20:23 < Wintereise> :/
20:23 < krzee> cause unix doesnt try to tell you that you are wrong, it does what you say
20:24 < K1ng\> brb need to restart network
20:25 -!- K1ng [KING@180.211.188.161] has joined #openvpn
20:25 -!- K1ng\\\ [KING@180.211.188.179] has joined #openvpn
20:27 < K1ng\\\> this is how its working now
20:27 < Wintereise> How do you restart the network anyway?
20:27 < Wintereise> /etc/init.d/networking restart on debian but ?_? on windows?
20:27 < K1ng\\\> connect to vpn. edit vpn's network setting. i mean add 8.8.8.8 in dns server
20:27 < K1ng\\\> restart lan
20:28 < K1ng\\\> i just reconnected the lan cable
20:28 < Wintereise> oh
20:28 < K1ng\\\> connect to vpn. edit vpn's network setting. i mean add 8.8.8.8 in dns server. restart network. check if dns works... now use openVPN
20:28 < K1ng\\\> FUCK YOU WINDOWS
20:29 < Wintereise> Not even that works for me
20:29 < Wintereise> So meh
20:29 < Wintereise> I'm gonna sleep
20:29 < Wintereise> G'night
20:29 -!- K1ng\ [KING@180.211.188.26] has quit [Ping timeout: 260 seconds]
20:29 < RichiH> krzee: kk. please make sure to give feedback if you read it
20:29 < K1ng\\\> solve it
20:30 < crocket> How can I make OpenVPN retain POSIX capabilities during previlege drop?
20:30 -!- K1ng [KING@180.211.188.161] has quit [Ping timeout: 276 seconds]
20:32 < crocket> I put prctl(PR_SET_KEEPCAPS, 1) before setuid is invoked in openvpn, but it doesn't seem to work.
20:32 < krzee> K1ng\\\, at that point, you can try pushing the DNS settings, and remove the push route for 8.8.8.8 net_gateway line
20:32 < krzee> assuming you care
20:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:33 < crocket> I even gave CAP_IPC_LOCK to /usr/sbin/openvpn, but so far no result.
20:34 < K1ng\\\> krzee, how to do that?
20:34 < K1ng\\\> Wintereise, you still here?
20:35 < krzee> the server has a push dns option in it
20:35 < krzee> !pushdns
20:35 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
20:35 < krzee> #1
20:35 < krzee> and then i had you guys add push "route 8.8.8.8 255.255.255.255 net_gateway"
20:35 < krzee> remove the push route, keep the dhcp-option
20:36 < krzee> the push route told the client to bypass the vpn to reach 8.8.8.8
20:37 < K1ng\\\> on client?
20:37 < K1ng\\\> or server?
20:39 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:40 < K1ng\\\> krzee, its already there
20:41 < K1ng\\\> krzee, http://pastebin.com/GrUJ4Tdv
20:43 < krzee> lol why is your client thinking it is .10 when it is clearly .6
20:43 < krzee> you set the IP manually didnt you
20:44 < K1ng\\\> yes
20:44 < krzee> :-p
20:44 < krzee> dont
20:44 < K1ng\\\> http://pastebin.com/GrUJ4Tdv is server log
20:44 < krzee> route 8.8.8.8 255.255.255.255 net_gateway
20:44 < krzee> i told you to remove that
20:44 < krzee> [18:35]  <krzee> and then i had you guys add push "route 8.8.8.8 255.255.255.255 net_gateway"
20:44 < krzee> [18:35]  <krzee> remove the push route, keep the dhcp-option
20:44 < K1ng\\\> ok
20:45 < K1ng\\\> its like push "dhcp-option 8.8.8.8"
20:45 < K1ng\\\> right?
20:45 < krzee> keep that
20:46 < K1ng\\\> its not in server :p
20:46 < krzee> remove this:
20:46 < krzee> "route 8.8.8.8 255.255.255.255 net_gateway"
20:46 < K1ng\\\> adding it
20:46 < krzee> oh then hold on
20:46 < krzee> push "dhcp-option DNS 8.8.8.8"
20:47 < K1ng\\\> its not adding 8.8.8.8
20:48 < K1ng\\\> Tue Apr 12 07:47:15 2011 us=893000 C:\WINDOWS\system32\route.exe ADD 195.162.69.96 MASK 255.255.255.255 180.211.188.179
20:48 < K1ng\\\> Tue Apr 12 07:47:15 2011 us=909000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
20:48 < krzee> dude
20:48 < K1ng\\\> yea?
20:48 < krzee> oh ok, just the 2 lines ;]
20:48 < K1ng\\\> ok sorry
20:49 < krzee> nah 2 lines is fine
20:49 < krzee> i expected a flood
20:49 < krzee> but theres nothing wrong with those 2 lines...
20:49 < K1ng\\\> Tue Apr 12 07:47:16 2011 us=65000 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct.   [status=160 if_index=25]
20:49 < K1ng\\\> isnt that wrong?
20:51 < K1ng\\\> yes
20:51 < K1ng\\\> its working now
20:51 < K1ng\\\> yay
20:51 < K1ng\\\> i made it :D
20:51 < krzee> you keep pasting that error, but when you paste your logs its never there
20:51 < K1ng\\\> lol
20:58 -!- K1ng\\\ [KING@180.211.188.179] has quit [Ping timeout: 240 seconds]
21:02 -!- mirco [~mirco@p5B23A9BD.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
21:09 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
21:09 -!- mirco [~mirco@p5B23A6DA.dip.t-dialin.net] has joined #openvpn
21:15 -!- K1ng [~KING@180.211.188.140] has joined #openvpn
21:15 < K1ng> krzee, you were right
21:15 < K1ng> server is 100% ok 
21:15 < K1ng> its the windows 7
21:17 < krzee> yep
21:18 < K1ng> its running smoothly on windows xp
21:20 < krzee> glad to hear it
21:21 < K1ng> thank you so much
21:21 < K1ng> for helping us out
21:21 < krzee> are you sure the client will be windows?
21:21 < K1ng> i really dont know
21:21 < K1ng> i forgot to ask him
21:21 < krzee> since theres unknowns with the client box, theres some more for you to know
21:21 < krzee> if its windows and cant add routes:
21:21 < krzee> !winroute
21:21 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
21:21 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
21:22 < krzee> if it is unix and you want that push-dns, you need the update-resolvconf script at #4 here:
21:22 < krzee> !pushdns
21:22 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script
21:22 < K1ng> i got push dns :)
21:22 < K1ng> on server
21:22 < krzee> without that script, pushing dns to unix will NOT work
21:22 < K1ng> and route too
21:22 < K1ng> which script?
21:22 < krzee> [19:22]  <krzee> if it is unix and you want that push-dns, you need the update-resolvconf script at #4 here:
21:23 < krzee> (#4) in unix you'll use the update-resolv-conf script
21:23 < K1ng> ah
21:23 < K1ng> where to get update-resolv-conf?
21:23 < krzee> comes with openvpn
21:23 < K1ng> ah ok
21:23 < K1ng> how do i add route-method exe?
21:24 < krzee> you dont need it
21:24 < krzee> it would fix a windows issue that you dont have
21:24 < krzee> you would put it in the config of the windows client that needed it
21:24 < K1ng> ok
21:24 < krzee> basically, if the client has problems, get the logfile and bring it here ;)
21:25 < K1ng> sure sir
21:25 < K1ng> :D
21:25 < krzee> ;]
21:32 < K1ng> hey krzee register-dns solved the problem on windows 7 :D
21:32 < krzee> is that a openvpn config option?
21:32 < K1ng> yea
21:32 < krzee> cool! :)
21:33 < K1ng> http://comments.gmane.org/gmane.network.openvpn.user/31975
21:33 <@vpnHelper> Title: OpenVPN users list (at comments.gmane.org)
21:33 < K1ng> C:\Users\k1ng>nslookup
21:33 < K1ng> Default Server:  google-public-dns-a.google.com
21:33 < K1ng> Address:  8.8.8.8
21:34 < krzee> !learn pushdns as also http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
21:34 <@vpnHelper> Joo got it.
21:34 < K1ng> http://pastebin.com/MX8JrwZ8
21:34 < krzee> thanks for reporting that back =]
21:34 < K1ng> np :D
21:37 <@vpnHelper> RSS Update - forum: [HELP] Create Premium VPN using OpenVPN <http://forums.openvpn.net/topic7927.html>
21:39 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
21:42 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Quit: I quit.]
21:42 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
21:45 < K1ng> i need to reinstall my os
21:45 < K1ng> its full of fucking virus
21:45 < K1ng> html:iframe-inf
21:49 -!- GrecKo_ [~quassel@ks359238.kimsufi.com] has joined #openvpn
21:50 < GrecKo_> !welcome
21:50 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:50 < K1ng> !goal
21:50 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:50 < K1ng> !logs
21:50 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard., or (#3) see !pb for our preferred pastebin
21:50 < K1ng> !interface
21:50 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
21:50 < K1ng> xD
21:51 < krzee> K1ng, feel free to play with the bot, heres 2 things to help ya
21:51 < krzee> !factoids
21:51 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
21:51 < krzee> !botmsg
21:51 < krzee> !msg
21:51 < K1ng> xD
21:51 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key>, or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
21:51 < K1ng> thanks :D
21:51 < krzee> np
21:52 < GrecKo_> !configs
21:52 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
21:52 < K1ng> no one helped us before like you did today :)
21:52 < GrecKo_> !pb
21:52 <@vpnHelper> "pb" is Use our pastebin to post configs and logs at http://openvpn.pastebin.ca rather than posting to the channel.
21:54 < K1ng> heh
21:54 < krzee> !forget logs 3
21:54 <@vpnHelper> Joo got it.
21:54 < krzee> !forget pb
21:54 <@vpnHelper> Joo got it.
21:54 < krzee> use any pastebin you like, that one expired or something
21:54 < K1ng> krzee, are you developer of openvpn?
21:54 < K1ng> or just suport?
21:56 < krzee> support
21:56 < krzee> i attend the dev meetings when i can tho
21:57 < krzee> but im no good with real code =/
21:57 < K1ng> same here
21:57 < K1ng> but i am good enough to make 3000 usd per month :D
21:57 < krzee> ;]
21:58 < krzee> is that a lot?
21:58 < K1ng> its more than a lot for me :)
21:58 < K1ng> $300 per month is enough for me :D
21:59 < K1ng> http://vvcap.net/db/xqPfqkPQ_3odcMJ977bx.htp
21:59 <@vpnHelper> Title: VVCap Image (at vvcap.net)
22:02 < K1ng> http://vvcap.net/db/uD4AaSDJ1Ozo_PpDMhT-.htp
22:02 <@vpnHelper> Title: VVCap Image (at vvcap.net)
22:02 < K1ng> i wish i had an paypal account :(
22:02 < krzee> oh wow
22:02 < krzee> someone really paid $250 for that!?
22:02 < K1ng> 250
22:02 < K1ng> yes
22:02 < K1ng> lol
22:03 < K1ng> i didnt get paid yet. i just got milestone :)
22:03 < krzee> welp
22:03 < krzee> !donate
22:03 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel., or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc., or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
22:03 < krzee> hehehe
22:03 < K1ng> i wish i could
22:03 < K1ng> i dont have paypal
22:03 < K1ng> i will do it soon :)
22:04 < K1ng> i will get paypal at 25th :D
22:04 < krzee> ;]
22:05 < krzee> hey how cute
22:05 < krzee> someone donated on valentines day
22:05 < GrecKo_> !howto
22:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:05 < K1ng> lol
22:05 < K1ng> krzee, how did you see?
22:05 < krzee> link in #3 of !donate
22:06 < K1ng> oh lol
22:06 < K1ng> thats the total list of donation?
22:06 < K1ng> wtf?
22:06 < K1ng> only 300?
22:06 < krzee> expected more?
22:06 < krzee> hehe
22:07 < K1ng> yes
22:07 < krzee> well its only twords the support team, has nothing to do with the real openvpn team
22:07 < K1ng> well i will donate 200 :)
22:07 < K1ng> oh
22:07 < krzee> back when that page started, support and real team were seperate, the channel wasnt official or anything
22:07 < K1ng> is it official now?
22:08 < krzee> the channel
22:08 < krzee> ?
22:08 < krzee> yep, you can tell that on freenode by the channel's name, official channels have a single #, unofficial channels have 2 ##
22:08 < krzee> so we were ##openvpn now we are #openvpn
22:09 < K1ng> what :O
22:09 < K1ng> ##php is unofficial
22:09 < K1ng> wtf?
22:10 < krzee> that doesnt mean they are any less skilled
22:10 -!- master_of_master [~master_of@p57B57A26.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:10 < K1ng> yeah indeed
22:10 < krzee> im the same krzee regardless of this being #openvpn or ##openvpn
22:10 < K1ng> they are php guru :D
22:10 < krzee> it just means the php dev team doesnt run the channel
22:10 < K1ng> without them i am nothing
22:10 < krzee> until openvpn technologies joined IRC, it was unofficial
22:11 < krzee> and more than support, development is what REALLY gained from them coming to irc
22:11 < krzee> they have accomplished so much since doing that
22:11 < K1ng> hmm
22:11 < K1ng> btw i suggest you to get a better bot
22:12 < K1ng> have you seen the bot in #debian?
22:12 < krzee> nope
22:12 < krzee> but i like my supybot
22:13 < krzee> hes been running for years, i dont care to migrate him
22:13 < krzee> !version
22:13 <@vpnHelper> The current (running) version of this Supybot is 0.83.4.1.  The newest version available online is 0.83.4.1.
22:13 < krzee> !tell k1ng i AM a better bot!
22:13 < K1ng> lol :D
22:14 < K1ng> infobot is better than supybot :p
22:14 < K1ng> you have to admit it
22:14 < krzee> never used it
22:14 < K1ng> i have
22:14 < K1ng> its really awesome
22:14 < krzee> i just asked them in #aircrack-ng what they ran, and used that
22:14 -!- master_of_master [~master_of@p57B57FC9.dip.t-dialin.net] has joined #openvpn
22:15 < krzee> since i liked their bot
22:15 < K1ng> http://www.botnix.org/ is better than infobot
22:15 <@vpnHelper> Title: Botnix (at www.botnix.org)
22:16 < K1ng> http://www.botnix.org/ > ALL OTHERS :p
22:16 <@vpnHelper> Title: Botnix (at www.botnix.org)
22:16 < K1ng> its being used in irc.chatspike.net
22:16 < K1ng> a lot of fun :D
22:16 < K1ng> its learn when you talk :D
22:18 < GrecKo_> !redirect
22:18 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
22:22 < GrecKo_> !def1
22:22 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
22:22 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
22:24 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 264 seconds]
22:26 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 276 seconds]
22:29 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has quit [Ping timeout: 258 seconds]
22:40 -!- Wintereise [Wintereise@unafilliated/wintereise] has quit [Ping timeout: 258 seconds]
22:41 < pwrcycle> how do you make "echo 1 > /proc/sys/net/ipv4/ip_forward" persistent after reboot?
22:43 < pwrcycle> !ipforward
22:43 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
22:43 < pwrcycle> !linipforward
22:43 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
22:47 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:53 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Read error: Operation timed out]
22:59 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
22:59 -!- stony is now known as Guest42447
23:03 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has quit [Read error: Operation timed out]
23:03 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has joined #openvpn
23:04 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
23:06 -!- K1ng\ [~KING@204.45.132.6] has joined #openvpn
23:07 < K1ng\> krzee, are you here?
23:08 < krzie> kinda
23:08 -!- K1ng [~KING@180.211.188.140] has quit [Ping timeout: 252 seconds]
23:09 < krzie> smoking, watching eddie murphy, and gunna finish coding that cgi i was working on
23:12 < krzie> pwrcycle, good job on answering your question =]
23:14 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
23:20 -!- darth_bitterman [~yury@84.51.192.6] has joined #openvpn
23:22 -!- bitterman [~yury@84.51.192.6] has quit [Read error: Operation timed out]
23:35 < crocket> pwrcycle, slackware has a solution.
23:57 < krzie> all linux has the same perm solution, slackware has their own specific way in addition
--- Day changed Tue Apr 12 2011
00:00 < krzie> either way its a sysctl setting, just a matter of how you choose to set it
00:08 < hyper_ch> hi krzie
00:14 -!- mirco [~mirco@p5B23A6DA.dip.t-dialin.net] has quit [Quit: mirco]
00:31 < krzie> hey
00:41 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
00:48 -!- tjz [~pc@bb116-14-48-103.singnet.com.sg] has joined #openvpn
00:48 -!- tjz [~pc@bb116-14-48-103.singnet.com.sg] has quit [Changing host]
00:48 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
00:53 -!- iamresearcher [~genlight@174.140.165.129] has joined #openvpn
00:53 < iamresearcher> where should I put the tun-ipv6 option? in server or client conf?
01:00 < iamresearcher> Mo people in the house?
01:04 -!- iamresearcher [~genlight@174.140.165.129] has quit []
01:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:13 < krzie> heh
01:13 < krzie> that guy is the fly-by king
01:21 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 276 seconds]
01:24 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
01:27 -!- Guest42447 is now known as stony
01:29 -!- AndrewX192 is now known as bosshead
01:33 -!- bosshead is now known as AndrewX192
01:37 -!- Champi [Champi@rootshell.fr] has joined #openvpn
01:41 -!- dazo_afk is now known as dazo
01:47 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 260 seconds]
01:51 -!- stony [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
01:51 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:51 -!- stony is now known as Guest23577
01:53 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
01:53 -!- mirco_ is now known as mirco
01:56 -!- Guest23577 [~ol@2a01:198:6f7::dead:beef:0] has quit [Ping timeout: 260 seconds]
01:56 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has joined #openvpn
01:56 -!- stony_ [~ol@2a01:198:6f7::dead:beef:0] has quit [Client Quit]
01:58 -!- ZyZ [~joe@188.29.128.161.threembb.co.uk] has quit [Ping timeout: 240 seconds]
02:02 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11187> || Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11186>
02:08 <@vpnHelper> RSS Update - forum: [HELP] Create Premium VPN using OpenVPN <http://forums.openvpn.net/topic7927.html#p11188>
02:10 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
02:19 < K1ng\> krzee, are you here?
02:26 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html>
02:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:30 < K1ng\> anyone here?
02:34 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
02:38 < krzie> K1ng\, stop waiting for a "yes" and just say whatever you wanna say
02:38 < K1ng\> how do i route all trafic thow vpn?
02:38 < K1ng\> push "redirect-gateway def1"
02:38 < krzie> yep
02:39 < K1ng\> yes doesnt work
02:39 < K1ng\> when i connect to vpn. i dont get disconnected
02:39 < krzie> when you go to www.secure-computing.net/ip.php
02:39 < krzie> which ip shows up
02:40 < K1ng\> server ip
02:40 < krzie> then you're good
02:40 < K1ng\> but i want to get disconnected all trafic when i connect to vpn
02:40 < K1ng\> like i am on irc 
02:40 < K1ng\> when i connect throw the vpn i dont get disconnected
02:41 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
02:41 < crocket> hmm
02:42 < krzie> K1ng\, i used to think that it would too, but it doesnt
02:43 < K1ng\> so i will have to reconnect everything menually?
02:43 < K1ng\> * [K1ng\] (~KING@204.45.132.6): KING < is not my vpn's ip
02:43 < krzie> maybe you could script something to kill all your active connections, but basically yes
02:43 < krzie> reconnect and see which IP gets used
02:43 < krzie> or connect a clone even
02:44 < K1ng\> i am using vpn from a provider
02:44 < krzie> i mean to IRC
02:54 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:10 < K1ng\> krzie, is there any way to do that
03:10 < K1ng\> my client is killing me
03:11 < krzie> take out def1
03:11 < krzie> that may do it
03:11 < K1ng\> on server?
03:11 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Ping timeout: 246 seconds]
03:11 < krzie> just redirect-gateway, no def1 after
03:11 < krzie> depends, do you push it from server or jus thave it in client?
03:12 <@vpnHelper> RSS Update - forum: Packt's new OpenVPN 2 Cookbook <http://forums.openvpn.net/topic7929.html>
03:14 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
03:15 -!- K1ng [~KING@204.45.132.6] has joined #openvpn
03:16 < K1ng> lol
03:16 < K1ng> its worked i guess
03:16 < K1ng> but i could connect to internet
03:17 -!- K1ng\ [~KING@204.45.132.6] has quit [Ping timeout: 260 seconds]
03:17 -!- ods [~ods@static.218.115.47.78.clients.your-server.de] has joined #openvpn
03:17 < ods> hi
03:18 <@vpnHelper> RSS Update - forum: Packt's new OpenVPN 2 Cookbook <http://forums.openvpn.net/topic7929.html#p11191>
03:19 < ods> i have a openvpn server on port 143 over proto tcp-server , everything is fine except that i cant use udp ports...
03:20 < krzie> tried udp/53?
03:21 -!- Wintereise [Wintereise@unafilliated/wintereise] has joined #openvpn
03:21 < krzie> or udp/5060?
03:22 < Wintereise> Hm
03:22 < ods> i tried to connect to one of my servers on port 27001
03:23 < Wintereise> Guys, how do I completely remove the older routes once OpenVPN has connected? (No traffic without the VPN, older connections must be rerouted)
03:24 < ods> i use openvpn on tcp/143, like i said it works fine there for tcp ports, but i can't connect to udp ports..-
03:24 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html#p11192>
03:25 < krzie> Wintereise, lol
03:25 < krzie> i just told K1ng what to do
03:25 < Wintereise> o
03:25 < krzie> you figured out what it was too
03:25 < Wintereise> :p
03:26 < krzie> [04:12]  <krzie> just redirect-gateway, no def1 after
03:26 < krzie> !def1
03:26 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
03:26 < K1ng> yeah but i got disconnected
03:27 < Wintereise> nice
03:27 < krzie> [04:12]  <krzie> take out def1
03:27 < krzie> [04:12]  <krzie> that may do it
03:27 < krzie> [04:12]  <K1ng\> on server?
03:28 < Wintereise> Yes.
03:28 < Bushmills> ods: then your udp traffic is either not routed through openvpn, or there's a firewall on openvpn server or client blocking it
03:28 < krzie> [04:12]  <krzie> depends, do you push it from server or jus thave it in client?
03:28 < Wintereise> K1ng, you modifying? Or should I?
03:28 < Wintereise> `-`
03:28 < Bushmills> 'morning, btw
03:29 < K1ng> you do it
03:29 < Wintereise> Good evening :)
03:29 < ods> what the easiest way wo check if my openvpn traffic is routed  through my tun adapter
03:29 < K1ng> my brain is not working
03:29 < krzie> ods, are you saying you cant connect to openvpn on udp port, or that udp isnt going over the vpn?
03:29 < Bushmills> K1ng: try sugar
03:29 < ods> i am saying that udp is not going over vpn
03:29 < krzie> mornin Bushmills 
03:29 < K1ng> i need to sleep
03:29 < K1ng> :p
03:29 < Bushmills> coffee with sugar, then
03:30 < krzie> ods, then niether is your tcp traffic to the same ip
03:30 < Bushmills> single sugars preferred, i think.   c6h12o6 kind of sugars
03:31 < ods> apparently it is, when i lookup my ip i get the one of my server
03:32 < Wintereise> K1ng, done
03:32 < Wintereise> Check if it works, etc
03:33 < Bushmills> ods, inspect routes
03:33 < ods> on my client?
03:34 -!- DroidAgent [~Niemand@81.30.41.194] has joined #openvpn
03:34 < Bushmills> yes.  and/or use a tool like btr, traceroute or similar
03:34 < Bushmills> sry. mtr
03:34 < ods> are there different routes for tcp and udp?
03:34 < Bushmills> no
03:34 -!- K1ng\ [~KING@204.45.132.6] has joined #openvpn
03:36 < ods>   1    51 ms    51 ms    50 ms  10.30.0.1
03:36 < ods> first hop is my openvpn tun dev
03:36 < Bushmills> tcpdump or tshark kind of packet sniffers, to examine what reaches server, can also be helpful
03:37 -!- K1ng [~KING@204.45.132.6] has quit [Ping timeout: 260 seconds]
03:37 < ods> would it be a  problem when my real gateway block udp packages?
03:37 < Bushmills> ods: did you expect more hops behind server?
03:38 < Wintereise> my internet gateway drops all udp too :C
03:38 < ods> thats only the first hop
03:38 < Bushmills> don't debug internet now. just look at client - server 
03:38 -!- K1ng [~KING@204.45.132.6] has joined #openvpn
03:39 < Bushmills> after all, when udp isn't dropped there, you know that you don't need to look for the problem in openvpn
03:41 -!- K1ng\ [~KING@204.45.132.6] has quit [Ping timeout: 252 seconds]
03:41 -!- ods [~ods@static.218.115.47.78.clients.your-server.de] has quit [Read error: Connection reset by peer]
03:42 -!- ods [~ods@static.218.115.47.78.clients.your-server.de] has joined #openvpn
03:43 < ods> ok, i tried another gateway where no outgoing ports are blocked
03:43 < ods> it works there
03:44 -!- K1ng [~KING@204.45.132.6] has quit [Ping timeout: 260 seconds]
03:44 < ods> the only thing i can image is that my gateway/firewall only accepts tcp packages...
03:46 < ods> is there a way to send all upd packages over one tcp port?..
03:48 < Bushmills> yes: openvpn.
03:49 < ods> problem is that it is not working with my configuration....
03:50 < Bushmills> that sounds like a problem with your config, not necessarily with openvpn
03:51 < ods> port 143
03:51 < ods> proto tcp-server
03:51 < ods> dev tun
03:51 < ods> comp-lzo
03:51 < ods> ca ca.crt
03:51 < ods> cert server.crt
03:51 < ods> key server.key
03:51 -!- ods was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
03:51 -!- ods [~ods@static.218.115.47.78.clients.your-server.de] has joined #openvpn
03:52 < ods> http://openvpn.pastebin.ca/2045385
03:52 < ods> thats my config
03:52 < Bushmills> your config doesn't help, as we don't even know your problem
03:53 < ods> i cant connect to a server using udp ports
03:53 < Bushmills> "udp isn't going over openvpn" is not a good problem description
03:53 < Bushmills> did you configure both server AND client to use tcp?
03:54 < ods> yes
03:54 < ods> tcp-server and tcp-cleint
03:54 < ods> client*
03:55 < Wintereise> krzie, redirect-gateway still retains the older routes :/
03:55 < Wintereise> No route delete commands pushed whatsoever
03:55 < ods> like i said, i am connected and when i lookup my ipadress i get the right one from my openvpn server
03:55 < Bushmills> so you can't connect to that server, regardless of whether you use udp or tcp?
03:56 < Bushmills> ah, ok. "are connected"
03:56 < ods> i am connected to openvpn using tcp
03:56 < Bushmills> ok. and your problem is now what?
03:56 -!- ZyZ [~joe@188.29.216.208.threembb.co.uk] has joined #openvpn
03:56 < ods> i cant connect to any other server using udp
03:57 < Bushmills> "any other" than which one?
03:58 < ods> acutally the same server
03:58 < ods> openvpn runs on tcp/143 and the server i want connect to runs on udp/27001
03:58 < Wintereise> Hm, think I fixed it
03:59 < ods> and i can get only through my firewall on tcp/143
03:59 < Bushmills> sorry, i don't understand your problem. you can but you can't connect on udp?  if you can, just change the port the server listens to and the client talks to
03:59 < Bushmills> "i can get only through my firewall on tcp/143" - then fix your firewall
04:00  * Bushmills strolls off
04:01 -!- ZyZ [~joe@188.29.216.208.threembb.co.uk] has quit [Ping timeout: 260 seconds]
04:07 -!- twister004 [~chatzilla@59.90.34.167] has quit [Read error: Connection reset by peer]
04:07 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:11 -!- norc [~norc@ns203763.ovh.net] has joined #openvpn
04:12 < norc> Hi, I've successfully created a vpn bridge between my local windows box and a remote linux box behind a HTTP firewall through a SSH tunnel (for now that was necessary, in time that will change) - however I cant figure out how to set up my routing on the windows box properly
04:13 < norc> What I'm trying to do is pipe all traffic for the internet through the vpn, through the ssh tunnel, through the http proxy to the remote host, and then into the internet
04:13 < norc> (circumventing a bitchy http proxy effectively)
04:14 < norc> with my remote host acting as a gateway
04:15 < krzie> !redirect
04:15 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
04:15 < norc> !def1
04:15 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
04:17 -!- K1ng [~KING@180.211.188.140] has joined #openvpn
04:17 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
04:17 < norc> ok, iptables.
04:17 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
04:17 < norc> I have the feeling Im gonna break some eggs
04:18 < Wintereise> Same
04:18 < Wintereise> :x
04:18 -!- ods [~ods@static.218.115.47.78.clients.your-server.de] has quit [Ping timeout: 240 seconds]
04:19 < krzie> !linnat
04:19 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
04:19 < krzie> !linipforward
04:19 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
04:20 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
04:20 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
04:20 -!- K1ng\ [~KING@180.211.188.140] has joined #openvpn
04:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:21 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:21 < K1ng\> ITS DOESNT WORK
04:22 -!- K1ng [~KING@180.211.188.140] has quit [Ping timeout: 248 seconds]
04:22 < norc> ok, so first order of business is not using dhcp for the windows box
04:22 < norc> I assumed that mucn
04:22 < norc> (wouldnt want dhcp renewals to mess everything up constantly)
04:23 < K1ng\> are you talking to us?
04:23 < norc> K1ng\: You are not borg, are you?
04:24 < K1ng\> i am brianless
04:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:24 -!- Wintereise [Wintereise@unafilliated/wintereise] has quit [Ping timeout: 260 seconds]
04:29 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11193>
04:32 -!- norc [~norc@ns203763.ovh.net] has quit [Quit: Lost terminal]
04:33 -!- norc [~norc@ns203763.ovh.net] has joined #openvpn
04:33 -!- K1ng\ [~KING@180.211.188.140] has quit [Ping timeout: 248 seconds]
04:33 < norc> ok, I broke something. The VPN connection seems to exist, (both the client and server have reported that initialization sequence has completed), but I cant connect through the tap iface :(
04:34 < norc> oh nvm
04:34 < norc> weird
04:34 <@vpnHelper> RSS Update - forum: Can't connect more than 59 clients <http://forums.openvpn.net/topic7915.html#p11194>
04:34 < norc> Funky openssh server
04:52 -!- K1ng [~KING@180.211.188.140] has joined #openvpn
04:54 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
04:54 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
04:58 < norc> http://pastie.org/1786192  << bleh. Server has `push "redirect-gateway def1"`, shouldnt that do the trick?
05:00 < K1ng> krzie, you here?
05:06 -!- K1ng\ [~KING@180.211.188.140] has joined #openvpn
05:07 < K1ng\> someone please help us to setup default gateway
05:07 < K1ng\> we have been trying this for more than 12 hours
05:08 < |Mike|> !def1
05:08 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
05:08 -!- K1ng [~KING@180.211.188.140] has quit [Ping timeout: 258 seconds]
05:08 < K1ng\> |Mike|, without that
05:08 < K1ng\> just redirect-gateway
05:10 < K1ng\> |Mike|, can i pm you?
05:10 < |Mike|> Nope
05:11 < K1ng\> |Mike|, how do i find out what would be the dns?
05:11 < K1ng\> dhcp-option DNS 10.8.0.1,route 10.8.0.1,
05:11 < K1ng\> ^ invalid
05:12 < |Mike|> !dhcp
05:12 <@vpnHelper> "dhcp" is redirect-gateway bypass-dhcp gets around the problem of DHCP packets to the local DHCP server being incorrectly routed into the tunnel. Available in 2.1
05:12 < hyper_ch> ;push "dhcp-option DNS 208.67.222.222"
05:12 < hyper_ch> ;push "dhcp-option DNS 208.67.220.220"
05:12 < K1ng\> where should i put bypass-dhcp?
05:13 < K1ng\> hyper_ch, with redirect-gateway its doesnt work
05:13 < K1ng\> no def1
05:13 < hyper_ch> it does
05:13 < hyper_ch> why would you have no def1?
05:13 < K1ng\> my client wants that way
05:13 < K1ng\> n00b ass client
05:13 < hyper_ch> why then even have redirect-gateway?
05:14 < K1ng\> he want to replace the gateway when tunneling
05:16 < K1ng\> how do i find out what is the server ip?
05:16 < K1ng\> 10.8.0.1
05:16 < norc> http://pastie.org/1786254  << Ok. This is the contents of the client and server file, how I invoke them, and the resulting routing table. But the routing table doesnt make sense. 192.168.200.1 is still the default gateway
05:16 < norc> Or actually the only gateway
05:17 < norc> (Ignore my disregard for security measures)
05:17 < hyper_ch> you run client and server on same server?
05:17 < norc> nope
05:18 < hyper_ch> remote 127.0.0.1
05:18 < norc> Im using a SSH tunnel for the time being
05:18 < hyper_ch> you tell the server is on the same machine
05:19 < K1ng\> i will pay $30 for fixing my issue 
05:19 < K1ng\> anyone? please
05:19 < norc> You think the problem is that Im using loopback rather than its actual ip address?
05:19 < norc> I mean I could create a phony interface and use that to tunnel it to the remote host - but I dont see if thats relevant
05:20 < hyper_ch> norc: I have no idea what you try to do
05:20 < hyper_ch> but 127.0.0.1 is local loopback interface
05:20 < hyper_ch> so you try to connect the client to the server
05:20 < hyper_ch> both on the same machine
05:20 < K1ng\> hyper_ch, http://pastie.org/1786263
05:21 < norc> hyper_ch: No. I have a SSH client listening on port 1050 locally, so the remote host appears to be 127.0.0.1:1050 - but it gets forwarded to a remote host 
05:21 < K1ng\> we have been trying to resolve this issue for 15+ hours.
05:21 < DroidAgent> I have a number of intranet sites that I would like to tunnel through the VPN, but other web browsing I'd like to go through the "real" connection, what's a good strategy for this?
05:21 < norc> Im having difficulties with my gateway just like K1ng\ ironically
05:21 < K1ng\> i am not using def1
05:21 < hyper_ch> norc: why do you even do such a thing
05:22 < hyper_ch> too complicated for me
05:22 < hyper_ch> DroidAgent: don't set redirect gateway def1...t hen it will just setup a tunnel to the openvpn server but all traffic goes by default through your normal routing table
05:23 < norc> hyper_ch: There's a HTTP proxy in between, so the SSH tunnel is temporary until I can replace it with the VPN. Unfortunately I have only one port which I can spare, so one will have to run on the other.
05:23 < hyper_ch> and then just set what kind of services you want to access through the tunnel
05:23 < norc> (The HTTP proxy allows to CONNECT only to ports 21, 80 and 443, the former two of which the remote host is already listening on for their respective services
05:24 < DroidAgent> hyper_ch: I have the tunnel set up (bridged) but since it's still using the main connection's dns, it'll hit a dead end for the intranet sites.
05:25 < norc> So until the VPN is properly working, I can only keep the SSH service listening on port 443. Ergo the VPN will have to be tunnelled through SSH
05:25 < hyper_ch> DroidAgent: foxyproxy lets you define individual proxy settings depending on the url entered
05:25 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
05:25 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
05:25 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:25 < hyper_ch> so on the openvpn server you could setup a proxy and then tell FF to use for those sites that proxy which should resolv it then correctly
05:26 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
05:26 < hyper_ch> or you edit your hosts file and tell 10.8.0.XX domain.com
05:26 -!- K1ng\\\ [~KING@180.211.188.140] has joined #openvpn
05:26 < DroidAgent> Yeah but that's not something I can ask my clients :)
05:26 < DroidAgent> How'bout pushing dns through dhcp?
05:27 < hyper_ch> you can push your dns servers upon connection establishment
05:27 < K1ng\\\> !setup
05:27 < hyper_ch> but then all dns requests will go through the vpn
05:27 < K1ng\\\> !configure
05:27 < DroidAgent> I... can possibly live with that.
05:28 -!- K1ng\ [~KING@180.211.188.140] has quit [Ping timeout: 260 seconds]
05:28 < hyper_ch> there are probably smarter way
05:29 -!- HQ_ [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
05:32 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:32 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:32 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:32 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Ping timeout: 276 seconds]
06:05 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html#p11195>
06:17 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html#p11196>
06:20 -!- norc_ [~norc@ns203763.ovh.net] has joined #openvpn
06:21 < norc_> Ok, openvpn seems to be working, the routing table locally seems to be fine (even though somewhat bloated ;p) http://pastie.org/1786414  << Can someone help me figure out why connections to foreign networks wouldnt be routed properly?
06:24 -!- norc [~norc@ns203763.ovh.net] has quit [Quit: Lost terminal]
06:32 -!- Forconin_ [~forconin@gore.copyleft.no] has joined #openvpn
06:32 < Forconin_> !welcome
06:32 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:32 < Forconin_> !goal
06:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:32 < norc_> !route
06:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
06:34 < Forconin_> I have a openvpn-server on a 100mbit connection. When i try to do some speedtest against a 1GB-file on a gbit-connection i get 100mbit/s when i wget directly from the vpn-server (without going through openvpn), but i only get ~5mbit/s when i use the connection through openvpn (from another gbit-net). I use openvpn over tcp (the speeds was even slower when i used udp). It's only 1 client on the openvpn-net and close to 0 load on the openvpn-server. Th
06:40 < norc_> omg. retarded.
06:40 < norc_> forgot to enable ip_forward :<
06:40 < Forconin_> Hehe, been there.
06:40 < norc_> Imagine me being Skywalker in a podracer shouting "Its working!"
06:41 < norc_> That's how I feel right now
06:41 < norc_> Not rocket science after all
06:46 < Forconin_> Hehe.
06:46 < Forconin_> Sounds like me the first time.
06:46 < Forconin_> If i only could be able to fix the performance-issues i'd be a happy camper.
06:46 < norc_> Now I need to remove this SSH tunnel in the middle :)
06:46 < Forconin_> 5mbit on a 100mbit is not fun.
06:49 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
06:50 < Forconin_> Heh, nevermind my question.
06:50 < Forconin_> Works like a charm in Linux.
06:52 < norc_> lets hope this works :)
07:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:09 -!- norc_ [~norc@ns203763.ovh.net] has quit [Quit: Lost terminal]
07:09 <@vpnHelper> RSS Update - forum: server address blacklisted ? <http://forums.openvpn.net/topic7930.html>
07:10 -!- iamresearcher [~genlight@amertospromotions.com] has joined #openvpn
07:11 < iamresearcher> it is possible to request that all client option can be Push
07:15 <@vpnHelper> RSS Update - forum: server address blacklisted ? <http://forums.openvpn.net/topic7930.html#p11198>
07:20 -!- iamresearcher [~genlight@amertospromotions.com] has quit []
07:22 < Forconin_> Hm.
07:22 < Forconin_> Crap speed in OS X and Windows-clients. Full speed in Linux-clients.
07:22 < Forconin_> Weird.
07:27 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html#p11199>
07:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:36 -!- echoSMIL1 [~censured@bl17-94-248.dsl.telepac.pt] has joined #openvpn
07:36 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
07:37 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 252 seconds]
07:38 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has quit [Quit: Leaving]
07:39 -!- darth_bitterman [~yury@84.51.192.6] has quit [Quit: Leaving]
07:39 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html#p11200>
07:42 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
07:42 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
07:42 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
07:45 <@vpnHelper> RSS Update - forum: Request configuration <http://forums.openvpn.net/topic7932.html> || my wish - Push Option <http://forums.openvpn.net/topic7931.html>
07:51 <@vpnHelper> RSS Update - forum: Request Firewall configuration <http://forums.openvpn.net/topic7933.html>
07:52 -!- iamresearcher [~genlight@amertospromotions.com] has joined #openvpn
07:56 -!- iamresearcher [~genlight@amertospromotions.com] has quit [Ping timeout: 240 seconds]
07:58 -!- iamresearcher [~genlight@amertospromotions.com] has joined #openvpn
08:00 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
08:02 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
08:04 <@vpnHelper> RSS Update - forum: Assistance please <http://forums.openvpn.net/topic7935.html> || Address already in use error when starting openvpn server <http://forums.openvpn.net/topic7934.html>
08:06 -!- iamresearcher [~genlight@amertospromotions.com] has quit [Ping timeout: 258 seconds]
08:07 -!- iamresearcher [~genlight@amertospromotions.com] has joined #openvpn
08:13 -!- iamresearcher [~genlight@amertospromotions.com] has quit [Ping timeout: 260 seconds]
08:26 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
08:28 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
08:29 < orudie> greetings. for some reason one vpn client can access both vlans, but another vpn client can only access one vlan. What could it be causing that ?
08:33 -!- iamresearcher [~genlight@174.140.165.129] has joined #openvpn
08:33 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has joined #openvpn
08:33 <@vpnHelper> RSS Update - forum: [HELP] Create Premium VPN using OpenVPN <http://forums.openvpn.net/topic7919.html#p11206>
08:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
08:43 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Read error: Connection reset by peer]
08:43 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
08:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
08:51 < iamresearcher> nilalangaw dito ah
08:52 -!- iamresearcher [~genlight@174.140.165.129] has quit []
08:52 -!- Forconin_ [~forconin@gore.copyleft.no] has quit [Quit: leaving]
08:58 -!- mirco [~mirco@ip-95-223-210-128.unitymediagroup.de] has joined #openvpn
08:58 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11207>
08:58 -!- mirco [~mirco@ip-95-223-210-128.unitymediagroup.de] has quit [Client Quit]
08:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:07 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Remote host closed the connection]
09:08 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has quit [Ping timeout: 260 seconds]
09:09 < orudie> greetings. for some reason one vpn client can access both vlans, but another vpn client can only access one vlan. What could be causing that ?
09:09 <@vpnHelper> RSS Update - forum: OpenVPN Server on Windows 7/Vista 64bits in french... bug <http://forums.openvpn.net/topic7936.html>
09:10 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has joined #openvpn
09:16 <@vpnHelper> RSS Update - forum: All working except RDP - Windows7 <http://forums.openvpn.net/topic7925.html#p11209>
09:21 < gladiatr> orudie, check to be sure that the local lan of the client isn't using the same subnet as the vlan that it can't reach
09:24 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
09:24 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
09:24 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
09:25 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Client Quit]
09:32 -!- luneff [~yury@84.51.195.188] has joined #openvpn
09:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 260 seconds]
09:35 -!- mexx [~huy@unaffiliated/mexx] has joined #openvpn
09:35 < mexx> hi
09:37 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:41 < K1ng\\\> krzee, are you here?
09:43 < mexx> I'm using openvpn to get outside my company network but they're changing their policy. We will be soon transitioning from squid to webwasher. The latter is configured to do MITM spying making openvpn complain (Bad encapsulated packet length from peer). I was wondering if I could allow the tunnel to run and then encrypt and do openvpn in openvpn, or ipsec in openvpn
09:43 < K1ng\\\> who ever fix my i will pay $50
09:44 -!- K1ng\\\ is now known as k1ng
09:44 -!- k1ng is now known as Guest80389
09:45 < Guest80389> i need push "defaultg-gateway" fixed
09:46 < orudie> gladiatr, I checked, its completely different 
09:51 < ecrist> Guest80389: I'd suggest fixing it, then.
09:52 -!- Guest80389 [~KING@180.211.188.140] has quit [Ping timeout: 248 seconds]
09:52 < jpalmer> heh
09:55 -!- K1ng [~KING@180.211.188.140] has joined #openvpn
09:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 248 seconds]
09:58 -!- Perun [~perun@chao5.net] has joined #openvpn
09:58 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11210>
09:58 < Perun> hi all
10:01 < Perun> I have a problem with openvpn: site-to-site konfiguration: 192.168.50.10 (ip of server 1 in lan) 10.0.66.1 (vpn ip of server1), 10.0.66.6 (vpn ip of server 2), 10.0.8.60 (ip of server 2 in lan). I can ping the 192.168.50.10 from server2 but I cant ping 10.0.8.60 from server1... what can be the problem? (ther routes are on both servers ok, ip forwarding is on)
10:01 -!- K1ng [~KING@180.211.188.140] has quit [Ping timeout: 259 seconds]
10:10 -!- K1ng [~KING@180.211.188.140] has joined #openvpn
10:11 < K1ng> yay
10:11 < K1ng> i finally got it
10:14 < mexx> actually the fact that webwasher reencrypts communications will probably break openvpn forever
10:17 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
10:18 < hyper_ch> hi Bushmills
10:20 -!- batrick [~batrick@nmap/developer/batrick] has quit [Read error: Connection reset by peer]
10:20 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
10:20 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 248 seconds]
10:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:27 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
10:28 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
10:33 -!- mexx [~huy@unaffiliated/mexx] has left #openvpn []
10:38 <@vpnHelper> RSS Update - forum: webwasher <http://forums.openvpn.net/topic7937.html>
10:39 -!- MarKsaitis_ is now known as marksaitis
10:41 < Perun> no one can help with my problem?
10:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:44 <@vpnHelper> RSS Update - forum: server address blacklisted ? <http://forums.openvpn.net/topic7930.html#p11212>
10:44 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
10:44 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
10:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:45 -!- K1ng\ [~KING@180.211.188.140] has joined #openvpn
10:45 -!- K1ng [~KING@180.211.188.140] has quit [Ping timeout: 246 seconds]
10:55 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has quit [Ping timeout: 620 seconds]
10:56 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html#p11213>
11:04 < Bushmills> hi hyper_ch
11:05 < hyper_ch> why do I see the same people in the same channels
11:05 < Bushmills> Perun: firewall can be the problem
11:11 -!- RichiH [~richih@freenode/staff/richih] has quit [Read error: Operation timed out]
11:11 -!- raomin [~romain@86.66.22.240] has quit [Quit: leaving...]
11:11 -!- RichiH [~richih@freenode/staff/richih] has joined #openvpn
11:15 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
11:26 <@vpnHelper> RSS Update - forum: my wish - Push Option <http://forums.openvpn.net/topic7931.html#p11215> || Help with routing after client connection <http://forums.openvpn.net/topic7938.html>
11:32 <@vpnHelper> RSS Update - forum: webwasher <http://forums.openvpn.net/topic7937.html#p11220> || Windows 7 changes routing <http://forums.openvpn.net/topic7940.html> || Some users work and some get timouts <http://forums.openvpn.net/topic7939.html> || Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11217> || All working except RDP - Windows7 <http://forums.openvpn.net/topic7925.html#p11216>
11:38 <@vpnHelper> RSS Update - forum: Help with routing after client connection <http://forums.openvpn.net/topic7938.html#p11224> || Some users work and some get timouts <http://forums.openvpn.net/topic7939.html#p11223> || server address blacklisted ? <http://forums.openvpn.net/topic7930.html#p11222> || Windows 7 changes routing <http://forums.openvpn.net/topic7940.html#p11221>
11:38 -!- marksaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
11:41 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
11:44 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html#p11225>
12:08 <@vpnHelper> RSS Update - forum: Packt's new OpenVPN 2 Cookbook <http://forums.openvpn.net/topic7929.html#p11226>
12:11 -!- mirco [~mirco@p5B23A6DA.dip.t-dialin.net] has joined #openvpn
12:15 -!- dazo is now known as dazo_afk
12:20 <@vpnHelper> RSS Update - forum: Windows 7 changes routing <http://forums.openvpn.net/topic7940.html#p11227>
12:26 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11228>
12:29 < orudie> greetings. for some reason one vpn client can access both vlans, but another vpn client can only access one vlan. What could be causing that ?
12:29 < ecrist> you have a faulty vlan config...
12:29 < Bushmills> orudie: overlapping subnets, firewall, problems in route, vlan config, etc
12:29 < Bushmills> but, why don't you tell us, instead of letting us guess?=
12:31 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
12:32 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
12:32 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
12:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:35 < orudie> so its vlan config not openvpn client related ?
12:35 < orudie> the subnets do not overlap 
12:35 < Bushmills> openvpn related is talking client to server and vice versa
12:38 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11229>
12:40 -!- dazo_afk is now known as dazo
12:49 < orudie> Bushmills, what do you want me to show you ?
12:50 < Bushmills> your attempts to diagnose the problem
12:51 < orudie> Bushmills, I really don't have a clue where to start. Like I said one client can ping both blans, another client can ping only one vlan 
12:52 < orudie> vlans*
12:52 < Bushmills> use tools like mtr, traceroute, tshark, tcpdump, and do some diagnosis of the problem
12:53 < Bushmills> "there's a problem" without some diagnosis attempts makes it very difficult to find the reason of the problem
12:57 < Bushmills> consider that many people are lazy. they don't want to guide you through the debugging process. but if you present some evidence of the problem, so that they an say "here and there is what seem to be responsable - do this and that", they'll jump in and suggest that.
12:59 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
13:00 < orudie> Bushmills, understood. I'll apply your suggestion once I have access to the computer I'm having trouble with 
13:06 -!- luneff [~yury@84.51.192.6] has joined #openvpn
13:20 -!- noisebleed_ [~quassel@lula.inescn.pt] has joined #openvpn
13:20 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11230>
13:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
13:27 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922.html#p11231>
13:31 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:33 <@vpnHelper> RSS Update - forum: OpenVPN setup and working.... Mostly <http://forums.openvpn.net/topic7922-15.html#p11232>
13:36 -!- K1ng\ [~KING@180.211.188.140] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
13:51 -!- mateobur [~mateo@26.183.21.95.dynamic.jazztel.es] has joined #openvpn
13:52 < mateobur> Hello
13:52 < mateobur> where can I find the openvpn logs?
13:53 < Bushmills> where you have chosen to write them to
13:56 < mateobur> Bushmills, mmm by default?
13:57 < Bushmills> no log files. instead, logging is done through syslog
13:58 < mateobur> oh I see them
13:58 < Bushmills> if you want dedicated openvpn log files, you need to specify it
13:58 < mateobur> ok
13:58 < mateobur> Apr 12 20:56:38 section9 ovpn-server[1033]: Options error: You must define DH file (--dh)
13:58 < mateobur> hehe
14:00 -!- Forconin_ [~forconin@cm-84.215.21.187.getinternet.no] has joined #openvpn
14:01 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
14:08 < norc> Hi, I have a vpn to bypass a restrictive proxy, using tcp as the transport protocol (cant use udp because of a proxy). But latency goes down once the smallest amount of bandwidth is used. Also I can only get a maximum of about 60% of maximum bandwidth. Any tips here?
14:08 < norc> (No cipher used)
14:09 < hyper_ch> Bushmills: any experience with encfs?
14:10 < Bushmills> yes
14:11 < Bushmills> latency going down is good
14:11 < Bushmills> try compression, provided the traffic is nicely compressable
14:12 < norc> err, latency going up :P
14:12 < norc> Well, wouldnt compression make things slower, considering the extra computational overhead?
14:13 < Bushmills> depends on what the bottleneck is, if you max out network, and CPUs are idling, you can shift workload towards CPU, away from network
14:13 < norc> Well, the bandwidth isn't maxed out, this is mostly about gaming I guess
14:13 <@vpnHelper> RSS Update - forum: Help with routing after client connection <http://forums.openvpn.net/topic7938.html#p11233>
14:13 < norc> http://pastie.org/1788171  << this btw is the client config - just in  case
14:14 < norc> but sure, Ill give compression a try
14:14 < norc> it's not like I have anything to lose :)
14:14 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:14 < Bushmills> i don't know your bottleneck. no success garanteed.
14:14 < norc> well, Ive set openvpn priority to realtime in windows (highest priority possible)
14:15 < norc> but without compression I doubt that's an issue
14:15 < norc> (or encryption)
14:17 < norc> I mean I understand that openvpn will at least double the latency, because there's an extra roundtrip to the remote server
14:18  * norc wishes he could use an udp tunnel
14:19 < ecrist> !mac
14:19 <@vpnHelper> "mac" is Use Tunnelblick for the Mac. (http://code.google.com/p/tunnelblick/)
14:21 -!- HQ_ [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Quit: Leaving]
14:32 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
14:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 260 seconds]
14:44 -!- noisebleed_ [~quassel@lula.inescn.pt] has quit [Remote host closed the connection]
14:46 -!- jester7 [~JeSTeR7@wsip-184-183-180-130.dc.dc.cox.net] has joined #openvpn
14:48 < jester7> So, I took the advice of some people here and setup my server using tun instead of tap
14:48 < jester7> and i'm still running into the exact same problem.  on my linux client, I cannot ping resources within the remote network
14:48 -!- mateobur [~mateo@26.183.21.95.dynamic.jazztel.es] has quit [Ping timeout: 246 seconds]
14:48 < jester7> i can only ping the internal address of the vpn server itself
14:49 < norc> jester7: what are your routes?
14:50 < jester7> OK, inside, my lan IP is 192.168.11.0
14:50 < jester7> my openvpn is setup with 192.168.22.0
14:51 < jester7> my route shows my tun device as having both 192.168.11.0 and 192.168.22.0 
14:52 < jester7> 192.168.11.0    192.168.22.5    255.255.255.0   UG    0      0        0 tun0
14:52 < jester7> link-local      *               255.255.0.0     U     1000   0        0 eth0
14:52 < jester7> 192.168.22.5    *               255.255.255.255 UH    0      0        0 tun0
14:52 < jester7> 192.168.22.1    192.168.22.5    255.255.255.255 UGH   0      0        0 tun0
14:53 < norc> Please pastie the entire routing table (including the headers), and the network interfaces on pastie.org or something.
14:54 < jester7> http://pastie.org/1788294
14:55 < Bushmills> "...my lan IP is 192.168.11.0"  that is, the LAN behind server, while you're showing route on client?
14:56 < jester7> yes, 192.168.11.0 is the lan behind the server
14:56 < Bushmills> client routes appear ok.
14:56 < jester7> i'm actually connected directly to a router at the moment, so I don't have an internal LAN atm
14:57 < jester7> the thing is, this seems to work OK on windows clients
14:57 < jester7> they get inside the vpn lan just fine
14:57 < jester7> and I can ping the vpn server on the 192.168.11.29 address
14:57 < jester7> just...nothing else
14:59 < Bushmills> does server have a reason to forward traffic from tun device to NIC with LAN machines?
15:00 < jester7> Not sure what you mean
15:00 < Bushmills> did you configure server to forward packets between interfaces?
15:00 < jester7> Not that I know of...
15:00 < Bushmills> then it won't
15:00 < jester7> Would this be done via openvpn's config?
15:01 < Bushmills> no
15:01 < Bushmills> !serverlan
15:01 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
15:01 < Bushmills> !route
15:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:02 < norc> Ok, wew. No traffic, ping holding steady at 80ms. Starting StarCraft 2, ping spikes to 3000ms and every second ping gets a timeout.
15:02 < norc> This is definitly not normal.
15:03 < jester7> Bushmills: Can you figure why Windows 7 can browse the lan?
15:04 < Bushmills> jester7: no, i'm not on your network. you are the one, so you should be able to
15:04 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
15:04 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
15:04 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
15:05 < jester7> I mean, they are using the exact same server, and the exact same client config.  I boot with Win7, it's all good.  I try with linux, and I cannot.
15:05 < jester7> Just strange if I have to make changes to the server
15:06 < jester7> !ipforward
15:06 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:07 < jester7> !linipforward
15:07 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:07 < Bushmills> only information i have is what i got from you. when you don't set up server to forward between interfaces, as you think you don't have, neither windows nor linux traffic will be able to cross interfaces.
15:12 < jester7> That's all the info there is.  I did not setup forwarding between interfaces.  I can access the lan on Windows and not on Linux, with the exact same certs, keys and config.
15:12 < jester7> I'll see what I can do about setting up the routing...thanks for the help.
15:15 < jester7> Well, here is something interesting.  I notice in the routes that the gateway is set to 192.168.22.5
15:15 < jester7> the server's tun IP is 192.168.22.1 and my client ip is 192.168.22.6
15:15 < jester7> where is this 5?
15:16 < Bushmills> client p-t-p address
15:16 < Bushmills> client's idea of remote address
15:17 < jester7> ok, gotcha
15:17 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 260 seconds]
15:20 -!- K1ng [~KING@180.211.188.140] has joined #openvpn
15:20 < K1ng> new OS ftw :p
15:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:33 < jester7> Bushmills: should I be able to ping that p-t-p address?
15:33 < Bushmills> nope - there's no service bound to it
15:35 < Bushmills> it's just a local representation of the other end of the tunnel. the other end - which might reply to pings - knows nothing about it.
15:47 <@vpnHelper> RSS Update - forum: webwasher <http://forums.openvpn.net/topic7937.html#p11234>
16:02 -!- K1ng [~KING@180.211.188.140] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
16:09 -!- K1ng [~KING@180.211.188.140] has joined #openvpn
16:09 -!- tunnelm3 [182b269c@gateway/web/freenode/ip.24.43.38.156] has joined #openvpn
16:10 < tunnelm3> hi
16:10 < tunnelm3> hi, i have openvpn and am not pulling default gateway, i just want "if i want to connect to a specific ip, it goes out tun0" how can i do it ?
16:11 < Bushmills> tunnelm3: you want to specify that in client or server config?
16:12 < tunnelm3> i have win xp computers, my openvpn client is linux, i want to try to do it from iptables
16:12 < tunnelm3> xp computers connect to linux router, linux router is connected vpn to vpn system
16:12 < Bushmills> tunnelm3: you want to specify that in client or server config?
16:12 < tunnelm3> i do not care
16:13 < tunnelm3> i dont mind.
16:13 < Bushmills> add   route ...   or push "route ..." to config.  read in man page about arguments to route
16:13 < tunnelm3> i have tried that and it does not work properly
16:14 < Bushmills> it does work
16:14 < Bushmills> !winroute
16:14 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
16:14 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
16:14 < tunnelm3> it added it with route  netmask 255.255.255.255 gw 10.10.3.5 ..
16:15 < Bushmills> ah, client is linux.  never mind the !winroute stuff
16:15 < tunnelm3> this has nothing to do with windows
16:15 < tunnelm3> when i try tracerouting ip now, it says operation not permitted
16:16 -!- local|host [~fourat@197.0.138.181] has joined #openvpn
16:16 < local|host> hi
16:16 < local|host> where can i find a doc describing all features of ovpn's management api
16:16 < Bushmills> " "if i want to connect to a specific ip, it goes out tun0" ... and once that traffic has been sent over vpn, what then?
16:17 < Bushmills> what is openvpn server supposed to do with it?
16:17 -!- mirco [~mirco@p5B23A6DA.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
16:17 < tunnelm3> i just want my linux router (openvpn client) if i want to go to 4.4.4.4, to send out tun0 (openvpn connection)
16:18 < Bushmills> is your openvpn server 4.4.4.4?
16:18 < tunnelm3> no, 4.4.4.4 is destination ip, if computers want to go to 4.4.4.4, it should go out to openvpn server ip
16:18 < tunnelm3> through openvpn
16:19 < Bushmills> so the openvpn server receives a packet which is not meant for it.  what should openvpn server do about that packet?
16:19 < jester7> Holy hell this is frustrating. I have read everything you posted, and more, and just cannot get this thing to route through the server to the lan.  
16:19 < tunnelm3> iptables -t nat -A POSTROUTING -d 4.4.4.4/32 -j SNAT --to open.vpn
16:19 < tunnelm3> i have tried that and do not work
16:19 < jester7> Could you take a look at the servers routing table?  anything sticking out? http://pastie.org/1788607
16:19 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Quit: бэм бэм бэм бэм бэм бэм бэм бля !]
16:19 < Bushmills> so the openvpn server receives a packet which is not meant for it.  what should openvpn server do about that packet?
16:20 < tunnelm3> bushmills, vpn server work fine but i simply want my linux system to route data if destination ip = 4.4.4.4 to openvpn
16:20 < Bushmills> ok assume it gets routed.  and server receives it.  and then?
16:21 < tunnelm3> server does it's business and sends back, i just want this data go through openvpn
16:21 < Bushmills> what is "server's business" if it receives a packet which is not meant for it?
16:23 < tunnelm3> bushmills, i am running vpn that work fine. i just want any contact with specific ip of 4.4.4.4 to go through vpn, what u dont get
16:23 < Bushmills> what i don't get is an answer to my question
16:24 < tunnelm3> what does matter what servers business is
16:24 < Bushmills> it matters because that may be your problem
16:24 < jester7> Bushmills: Could you take a look at the servers routing table?  Do you see any reason it would not be working correctly? http://pastie.org/1788607
16:24 < tunnelm3> i do not understand what "server business" means ?
16:24 < Bushmills> "23:21:22) tunnelm3: server does it's business and sends back, i"  that's why i asked what that is
16:25 < Bushmills> if you use terms you don't understand, how can you expect me to uinderstand?
16:25 < tunnelm3> i mean server does transaction, it acts as a vpn!!!
16:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:26 < Bushmills> ok, if you have concluded that "route" doesn't work for you, then don't use it.
16:27 < Bushmills> but i have no alternative for you
16:27 < tunnelm3> i figure out soon thanks for help bye
16:27 < Bushmills> jester7: client routing table looks ok
16:27 -!- tunnelm3 [182b269c@gateway/web/freenode/ip.24.43.38.156] has left #openvpn []
16:27 < jester7> Bushmills: that's the server one
16:27 < Bushmills> ehm
16:29 < jester7> I just can't wrap my head around it.  Client has IP address of 192.168.22.6
16:29 < jester7> I can ping 192.168.11.29 just fine...even SSH to it
16:29 < jester7> (that's the servers internal IP)
16:29 < jester7> but that's it...
16:29 < Bushmills> yes. looks ok too
16:30 < jester7> Hmm, OK
16:31 < jester7> yet...only the server is accessible
16:31 < jester7> it's mind boggling
16:31 < jester7> Now...as a possible hint, I cannot ping the servers tun address from the lan
16:31 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has joined #openvpn
16:32 < jester7> should I be able to if its working correctly?
16:32 < krzee> only if you correctly did:
16:32 < krzee> !route
16:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:32 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
16:32 < jester7> I am literally still on that page
16:32 < Bushmills> what does    cat /proc/sys/net/ipv4/ip_forward    show?
16:32 < krzee> good, when you have it setup right, then yes that will work
16:33 < jester7> Bushmills: I set it to 1
16:33 < Bushmills> what about firewall?
16:33 < jester7> Bushmills: iptables has no rules set
16:33 < AgiZ> hello
16:33 < Bushmills> how do you know?
16:33 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
16:34 < AgiZ> i have searched high and low on google, and perhaps my googlefu is lacking, but i cant find any suggestion that would make the folowing statement a lie.
16:34 < AgiZ> There is no way a windows 7 user (not admin, just user) with UAC enabled can run OpenVPN successfully
16:35 < AgiZ> i sure hope i am wrong
16:35 < AgiZ> am i?
16:35 < jester7> Bushmills: it's a fresh Ubuntu server install, and INPUT FORWARD and OUTPUT are all set to (policy ACCEPT)
16:35 < Bushmills> what about the nat table?
16:35 < jester7> Bushmills: how to check
16:35 < jester7> ?
16:35 < Bushmills> iptables -t nat  -nvL
16:36 < jester7> krzee: I feel like that routing page is pointing to something a little more complicated.  I only have the tun network and the internal network
16:36 < jester7> Bushmills: everything is set to Accept
16:37 < Bushmills> no entries, especially no MASQUERADE entry?
16:37 < krzee> jester7, that is correct, it is there to teach you, not for you to blindly type in stuff it says
16:37 < jester7> Bushmills: no entries at all
16:38 < jester7> krzee: Yeah, I get that.  I've read over the thing twice now.
16:38 < krzee> by fully understanding !route you will understand more about openvpn routing than you need to for your setup
16:38 < krzee> lan is behind server or client?
16:38 < Bushmills> use tcpdump, on openvpn server, and on LAN server. look where your routed client packets go to, and where traffic or return traffic stops
16:38 < jester7> krzee: lan is behind server
16:39 < krzee> Bushmills' advice is great
16:39 < jester7> krzee: I was the one yesterday that you suggested use tun instead of tap
16:39 < krzee> !serverlan
16:39 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
16:39 < jester7> so I switched...and it's got the exact same symptoms
16:39 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 276 seconds]
16:39 < krzee> jester7, i get to suggest that to about 20 people per day it feels like
16:39 < Bushmills> maybe the problem cause is the same
16:39 < krzee> is your server the router for its LAN?
16:40 < jester7> krzee: no
16:40 < Bushmills> such as, LAN server not listening to traffic from subnet of vpn client 
16:40 < krzee> did you add a route for the vpn to your server's router?
16:40 < Bushmills> (that is, not the machine, but the services)
16:40 < Bushmills> hm. though you still should be able to ping it, in that case
16:41 < jester7> krzee: Here is my servers routing table http://pastie.org/1788607
16:41 < Bushmills> what about firewall on LAN server?
16:41 < krzee> i didnt ASK about your servers routing table
16:41 < krzee> [14:40]  <krzee> did you add a route for the vpn to your server's router?
16:43 < jester7> I'm not sure what that means.  I do not have a router in which I configure.
16:43 < jester7> I have my firewall, which does not monitor local traffic, only traffic in and out.
16:44 < krzee> the ROUTER
16:44 < krzee> !route_outside_openvpn
16:44 < krzee> grr freenode is so lagged lately
16:44 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
16:44 -!- EugeneKay [EugeneKay@jedediahsmith.kashpureff.com] has joined #openvpn
16:46 < jester7> Well, hell.  This seems much more complicated than the bridge :|
16:46 < krzee> but its not
16:46 < krzee> it just requires some basic networking knowledge
16:46 < jester7> I didn't need to add extra local networks to my firewalls config for the bridge.
16:47 < jester7> I popped a hole for port 1194 and that was the end of it.
16:47 < krzee> i seriously spell it out completely in that routing document
16:47 < AgiZ> !welcome
16:47 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:47 < krzee> if you READ it instead of skimming, it will help you more
16:47 < krzee> i know you SAY you read it 2x, but if you didnt see that big ass section ROUTES TO ADD OUTSIDE OPENVPN (yes, in caps) then you DEFINITELY skimmed it
16:48 < AgiZ> !goal
16:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:48  * EugeneKay feeds krzee a xanax
16:48 < AgiZ> !howto
16:48 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:48 <@vpnHelper> RSS Update - forum: Very poor preformance <http://forums.openvpn.net/topic7941.html>
16:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:53 < krzee> EugeneKay, i dont do pills, a blunt would be nice tho ;]
16:53 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
16:53 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:55 < EugeneKay> Mortar&Pestle and coffee? 
16:55 < jester7> Well
16:56 < jester7> krzee: despite you're somewhat aggressive tone, you are very helpful.
16:56 < jester7> that did the trick
16:56 < jester7> Bushmills: thanks for your help, too
16:56 < jester7> krzee: I did read it, and even looked at this Graph a few times...but it didn't really click. 
16:57 < jester7> It makes perfect sense now...the pings were getting through just fine...they it was the response that didn't.
16:58 < krzee> jester7, sorry i get aggressive on that subject, but i did make a really good walkthrough so i wouldnt need to support that every day, and then very often people come in and ask questions (while reading my doc) that i could answer by copy/pasting from my doc... i wrote READ IT DONT SKIM IT twice on my bot when it gives you the link
16:58 < krzee> it is aggravating 
17:00 < jester7> Nah, I get it.  Sometimes though it doesn't click, though.
17:00 < krzee> If you are not running openvpn on the router for each lan, you have some more routes to add.
17:00 < krzee> [14:39]  <krzee> is your server the router for its LAN?
17:00 < krzee> [14:40]  <jester7> krzee: no
17:00 < krzee> ;]
17:01 < jester7> I think that's why I preferred the tap route at first
17:01 < jester7> it let me use my LAN's ip's
17:01 < krzee> to stop you from needing to learn how routing works?
17:01 < krzee> you would have still needed to learn how bridging works :-p
17:01 < krzee> which is where you were stuck yesterday
17:01 < krzee> now you have a better setup
17:02 < jester7> well, i got that going.  as I said yesterday, the strange thing was it worked perfectly...and i mean PERFECTLY with windows
17:02 < jester7> but..this exact same situation would happen with linux...only able to ping the server, none of the resources behind it
17:03 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
17:03 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
17:03 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
17:03 < jester7> Either way, I'm glad I did this.  Love learning new things.
17:04 < Bushmills> krzee: seen that head tracker plugin 3d demo on ipad?
17:06 < krzee> no
17:06 < krzee> about time they started implementing that into devices tho
17:06 < krzee> i expected it sooner after the johnny lee wii hack
17:06 < Bushmills> http://www.youtube.com/watch?v=bBQQEcfkHoE
17:06 <@vpnHelper> Title: YouTube - Head Tracking for iPad: Glasses-Free 3D Display (at www.youtube.com)
17:09 < EugeneKay> We can read engadget too
17:13 < Bushmills> we are the Borg, address us in the third person?
17:13 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has quit [Ping timeout: 252 seconds]
17:14 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has joined #openvpn
17:16 < orudie> guys, with the same exact laptop which has vpn client installed, I can access both vlans behind vpn server from one internet connection but not from the other 
17:16 < orudie> this is really frustrating, and I don't see the cause 
17:19 < orudie> is it the router on the client side ?
17:23 < orudie> any ideas for me ?
17:24 -!- K1ng [~KING@180.211.188.140] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
17:32 -!- K1ng [~KING@180.211.188.140] has joined #openvpn
17:34 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has quit [Quit: Leaving]
17:42 < krzee> orudie, any errors in the log when it doesnt work?
17:42 < krzee> oh, it was a fly-by heh
17:43 < toortog> lol
17:47 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has joined #openvpn
17:47 < orudie> back
17:59 -!- dvl [~Dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 258 seconds]
18:04 -!- jester7 [~JeSTeR7@wsip-184-183-180-130.dc.dc.cox.net] has quit [Ping timeout: 248 seconds]
18:05 -!- dazo is now known as dazo_afk
18:08 -!- dazo_afk is now known as dazo
18:13 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
18:16 -!- dazo is now known as dazo_afk
18:16 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
18:19 < krzee> [15:34]  * orudie has quit (Quit: Leaving)
18:19 < krzee> [15:42]  <krzee> orudie, any errors in the log when it doesnt work?
18:19 < krzee> [15:42]  <krzee> oh, it was a fly-by heh
18:22 < |Mike|> lol
18:23 < orudie> krzee, trying to figure it out now 
18:25 < krzee> !logfile
18:25 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
18:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
18:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:37 < krzee> sweet these cgi scripts are coming right along
18:37 < K1ng> krzee, you here?
18:38 < K1ng> oh hey
18:38 < K1ng> our client was really happy :D
18:38 < krzee> i had made a huuuuuuge bash suite for knowing the finances at ANY point in the day/week, now im making a cgi front-end for managing the backend of it
18:38 < K1ng> he game me 10/10 :p
18:38 < krzee> so i dont have to be in the loop anymore =]
18:38 < krzee> K1ng, sweet =]
18:38 < K1ng> gave*
18:38 < K1ng> :D
18:39 < krzee> if you get more of those, lemme know and we can bust the out together if you want
18:39 < krzee> hell, my bash config generator might be able to handle most of them ;]
18:39 < krzee> !confgen
18:39 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
18:40 < krzee> later down the line that thing will even make the certs
18:40 < toortog> nice
18:40 < |Mike|> svn co ?
18:40 < |Mike|> ah okay
18:40 < |Mike|> n/m
18:40 < krzee> co = check out
18:40 < |Mike|> i know
18:40 < krzee> ok
18:41 < |Mike|> i'm an old cvs user hehe
18:41 < krzee> ahh hehe
18:41 < krzee> so you get to skip svn and go straight to git ;]
18:41 < |Mike|> I prefer git above svn
18:41 < krzee> like im one to talk... im writing cgi in bash
18:41 < krzee> lol
18:41 < |Mike|> eek
18:41 < krzee> hey man it works nice! ;]
18:42 < |Mike|> uhuh
18:42 < krzee> (and its very much internal only)
18:42 < |Mike|> i see, no webbased stuff?
18:42 < krzee> cgi = web based
18:42 < |Mike|> depends
18:42 < krzee> but only a couple lan machines can access the webserver, and only my vpn machine can over the vpn
18:43 < krzee> no route to inet
18:43 < |Mike|> safe idea!
18:43 < orudie>  toortog, krzee I pasted logs here https://forums.openvpn.net/topic7942.html
18:43 <@vpnHelper> Title: OpenVPN Support Forum Access 2 vlans from different outside internet connections : Server Administration (at forums.openvpn.net)
18:44 < |Mike|> btw, you're still in contact with chris?
18:44 < krzee> nah havnt talked to him in quite awhile
18:44 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 258 seconds]
18:44 < krzee> he disappeared
18:44 < |Mike|> same here
18:44 < |Mike|> looks like it
18:44 < krzee> hope hes doing well
18:44 < |Mike|> or drugs...
18:45 < krzee> if he didnt OD that is doing well
18:45 < |Mike|> you seen him in 2009 last time?
18:45 < krzee> especially for him ;]
18:45 < krzee> 2009 is when i went out there? 
18:45 < |Mike|> indeed, he's quite a small guy
18:45 < krzee> if so, yes
18:45 < |Mike|> HAR 2009 yeah
18:45 < |Mike|> i'm still in the hacking at random 2009 channel, so yes :P
18:45 < krzee> ya me him and fuck chilled, i spent the weekend with him
18:45 < |Mike|> yah
18:46 < krzee> orudie
18:46 <@vpnHelper> RSS Update - forum: Access 2 vlans from different outside internet connections <http://forums.openvpn.net/topic7942.html>
18:46 < krzee> !configs
18:46 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
18:46 < |Mike|> heh
18:47 < |Mike|> kinda strange that you haven't heard from him anymore krzee 
18:48 < krzee> i agree, we did have some business fall apart, but that was his side so im not sure where he disappeared to
18:48 < |Mike|> i have a visual hehe
18:48 < |Mike|> he could be anywhere imho
18:49 < krzee> sure
18:49 < orudie>  krzee i believe the server is fine, its a firewall issue at this point 
18:49 < krzee> orudie, cool if you know the problem you're almost done fixing it
18:50 < toortog> krzee: ya banging my head here lol
18:50 < krzee> toortog, over what?
18:50 < orudie> over this problem 
18:50 < toortog> im working with orudie on server
18:50 < krzee> oh you guys are together
18:50 < |Mike|> lol
18:50 < krzee> gotchya
18:50 < toortog> :]
18:50 < orudie> heh
18:51 < orudie> its so weired, with the same laptop on different connections it works, but on my home's line it doesn't 
18:51 < krzee> well keep head-banging away, feel free to pastebin configs in the way my bot said, and firewall stuff, if you want
18:51 < |Mike|> !tell orudie configs
18:51 < krzee> ill be cgi-bashing
18:51 < krzee> |Mike|, 
18:51 < krzee> !tell |Mike| configs
18:52 < krzee> !tell |Mike| [configs]
18:52 < |Mike|> i'm ignoring queries on freenode hehe
18:52 < krzee> first one would say "configs"
18:52 < krzee> second one would give what !configs does
18:53 < |Mike|> !tell |Mike| configs
18:53 < |Mike|> indeed
18:57 -!- dvl [~dvl@nyi.unixathome.org] has joined #openvpn
18:57 -!- dvl [~dvl@nyi.unixathome.org] has quit [Changing host]
18:57 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
18:58 < orudie> krzee, toortog updated my post with configs and firewall https://forums.openvpn.net/post11236.html#p11236
18:58 <@vpnHelper> Title: OpenVPN Support Forum Access 2 vlans from different outside internet connections : Server Administration (at forums.openvpn.net)
18:58 < krzee> in your server config
18:58 < krzee> echo "
18:59 < krzee> i suspect that is a typo...
18:59 < krzee> echo "
18:59 < krzee> -----BEGIN DH PARAMETERS-----
18:59 < krzee> -----END DH PARAMETERS-----
18:59 < krzee> " > dh1024.pem
18:59 < krzee> you didnt really do that, right?
18:59 < |Mike|> eh
19:00 < krzee> oh sorry, i didnt realize it was a bridge
19:00 < krzee> i dont help with those
19:07 -!- local|host [~fourat@197.0.138.181] has quit [Ping timeout: 260 seconds]
19:08 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:10 < orudie> great ...
19:12 < krzee> you do realize that by bridging those 2 vlans, they are no longer vlans, right?
19:12 < krzee> if you bridge the layer2 of 2 vlans, what do you gain by keeping them as seperate vlans...?
19:13 < krzee> *cough*switch2tun*cough*
19:15 < orudie> the vlans are not bridged 
19:21 < krzee> you are joining them both to a bridged vpn, no?
19:21 < krzee> if you are simply routing to them, then why use a bridge?
19:21 < orudie> all I need to do is route to them 
19:22 < krzee> then why are you bridging
19:23 < orudie> krzee, can you do windows shares with tun ?
19:23 < krzee> sure, without NETBIOS resolution by IP or with using wins
19:24 < toortog> ahhhh
19:24 < krzee> !tunortap
19:24 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
19:24 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
19:26 < toortog> man im a dumb*** sometimes
19:26 < toortog> over looking easy thikngs
19:27 < orudie> :)
19:27 < krzee> it happens, important thing is what you do once given the info ;]
19:28 < krzee> (or finding it of course)
19:29 < orudie> krzee, toortog and I will work on tun configs now 
19:29 < krzee> !sample
19:29 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
19:29 < krzee> !route
19:29 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
19:29 < krzee> those should be all you need to know
19:30 < krzee> assuming you read the manual on each config option i used in my configs so you know what they do
19:30 < krzee> also assuming you dont skim !route ;]
19:30 < orudie> krzee, it wouldn't make a difference if openvpn server is in dd-wrt router ?
19:30 < krzee> what wouldnt?
19:31 < krzee> "it"
19:31 < orudie> method and samples 
19:31 < krzee> nope, in fact you get to skip a step
19:31 < krzee> assuming the LANs are behind the server i mean
19:32 < krzee> in !route at ROUTES TO ADD OUTSIDE OPENVPN  "If you are not running openvpn on the router for each lan, you have some more routes to add."
19:32 < krzee> since you ARE running it on the router that the lans are behind, you get to skip that
19:32 < krzee> but those VLANs need to know that to reach $vpnsubnet they need to route to $router
19:33 < krzee> im not sure if extra setup is needed for that or not, but you should know
19:33 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
19:34 < krzee> basically, as far as those VLANS are concerned, you are adding another foreign lan behind that router (the vpn subnet)
19:44 -!- WebDawg [~whoami@officialg0d.com] has quit [Ping timeout: 252 seconds]
19:49 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
19:53 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:26 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 248 seconds]
21:13 < pwrcycle> is it necessary to declare a route or ifconfig statement in Win7?
21:17 < krzee> yes
21:18 < krzee> from openvpn's perspective you do it the same
21:18 < krzee> *it* does them different =]
21:21 -!- a2p [~mpalmer@d72-39-47-158.home1.cgocable.net] has joined #openvpn
21:23 -!- HQ_ [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
21:23 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
21:25 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Ping timeout: 276 seconds]
21:25 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 276 seconds]
21:25 -!- JPeterso2 is now known as JPeterson
22:03 < krzee> oh i just re-read the question
22:03 < krzee> "necessary"
22:03 < krzee> no
22:10 -!- master_of_master [~master_of@p57B57FC9.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:14 -!- master_of_master [~master_of@p57B57493.dip.t-dialin.net] has joined #openvpn
22:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has joined #openvpn
22:21 -!- mant1s [~mant1s@jcon.ums.maine.edu] has quit [Changing host]
22:21 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:25 -!- a2p [~mpalmer@d72-39-47-158.home1.cgocable.net] has quit [Quit: Lost terminal]
22:29 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 248 seconds]
22:34 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
22:52 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
22:54 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
23:15 < K1ng> firefox 4 is gay
23:19 < norc> at least it has a new look
23:20 < norc> The current firefox looks the same since.. 1.6 I guess?
23:20 < norc> err 1.5 that is.
23:21 < norc> or more like 1.3
23:22 < K1ng> nope
23:23 < K1ng> with tab?
23:23 < K1ng> idk
23:23 < K1ng> norc, current stable version is 4.0
23:23 < K1ng> :p
23:23 < K1ng> its not beta anymore
23:23 < norc> be careful with the word "stable"
23:26 < norc> It's like with Gentoo. There just isn't such a thing as "stable"
23:26 < norc> There is just testing and experimental ;)
23:27 < norc> Anyway, Im thinking
23:27 < norc> 2.0 had tabs
23:27 < norc> Might be that tabs were the reason for the major release of 2.0
23:28 < norc> *shrugs*
23:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
23:54 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
--- Day changed Wed Apr 13 2011
00:03 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has joined #openvpn
00:09 -!- havoc [~havoc@208.87.120.111] has quit [Ping timeout: 258 seconds]
00:10 -!- havoc [~havoc@208.87.120.111] has joined #openvpn
00:11 -!- EugeneKay is now known as EugeneKaway
00:42 -!- mirco [~mirco@p5B23FE6B.dip.t-dialin.net] has joined #openvpn
00:47 -!- mirco [~mirco@p5B23FE6B.dip.t-dialin.net] has quit [Quit: mirco]
00:48 -!- mirco [~mirco@p5B23FE6B.dip.t-dialin.net] has joined #openvpn
00:48 -!- mirco [~mirco@p5B23FE6B.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
01:10 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
01:14 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:18 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:23 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 252 seconds]
01:27 <@vpnHelper> RSS Update - forum: Address already in use error when starting openvpn server <http://forums.openvpn.net/topic7934.html#p11237>
01:31 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
01:34 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 264 seconds]
01:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:42 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
01:46 -!- z1l0g [jgw@sverige.freeshell.org] has joined #openvpn
01:48 < z1l0g> !welcome
01:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:49 < z1l0g> !goal
01:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:49 < z1l0g> !howto
01:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
01:50 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: Leaving.]
01:50 <@vpnHelper> RSS Update - forum: Address already in use error when starting openvpn server <http://forums.openvpn.net/topic7934.html#p11238>
01:56 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Quit: Ex-Chat]
01:56 <@vpnHelper> RSS Update - forum: Address already in use error when starting openvpn server <http://forums.openvpn.net/topic7934.html#p11239>
02:01 -!- z1l0g [jgw@sverige.freeshell.org] has left #openvpn []
02:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:07 -!- Diffen [~diffen@user8.85-195-0.netatonce.net] has joined #openvpn
02:15 <@vpnHelper> RSS Update - forum: Some users work and some get timouts <http://forums.openvpn.net/topic7939.html#p11240>
02:31 -!- dazo_afk is now known as dazo
02:39 <@vpnHelper> RSS Update - forum: Openvpn - multiple gateway tunnels <http://forums.openvpn.net/topic7943.html>
02:40 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
02:42 -!- twister004_ [~chatzilla@117.204.136.96] has joined #openvpn
02:43 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 246 seconds]
02:43 -!- twister004_ is now known as twister004
02:45 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html#p11242>
03:03 <@vpnHelper> RSS Update - forum: Very poor preformance <http://forums.openvpn.net/topic7941.html#p11245> || webwasher <http://forums.openvpn.net/topic7937.html#p11244>
03:09 <@vpnHelper> RSS Update - forum: Openvpn - multiple gateway tunnels <http://forums.openvpn.net/topic7943.html#p11247> || webwasher <http://forums.openvpn.net/topic7937.html#p11246>
03:12 < AgiZ> hello. i read in the howto about non-admin rights and using openvpn, and i am wondering, is it possible already to use own certificates that are in MS Certificate Store instead of the ones imported in "Local System"?
03:13 < AgiZ> i saw it mentioned that "There is work in progress to allow OpenVPN to access also user account key/cert's"
03:13 < AgiZ> that is when using openvpn as service
03:13 -!- robotti^ [robotti@kapsi.fi] has quit [Ping timeout: 246 seconds]
03:15 <@vpnHelper> RSS Update - forum: Very poor preformance <http://forums.openvpn.net/topic7941.html#p11248>
03:17 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
03:59 -!- local|host [~fourat@197.0.89.120] has joined #openvpn
04:03 -!- Forconin_ [~forconin@cm-84.215.21.187.getinternet.no] has quit [Quit: leaving]
04:15 -!- tomiondrums [~kvirc@pD951A351.dip.t-dialin.net] has joined #openvpn
04:17 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:17 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:17 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
04:33 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:33 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:39 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:39 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:39 -!- mateobur [~mateo@26.183.21.95.dynamic.jazztel.es] has joined #openvpn
04:39 < mateobur> Hello
04:40 < mateobur> I'm trying to configure vpn
04:40 < mateobur> but always get TCP/UDP: Socket bind failed on local address [AF_INET]172.18.100.101:1194
04:40 < mateobur> I don't know why it cannot bind
04:41 < Bushmills> there may have been something bound to that port already
04:42 < mateobur> I mean, the IP can be anything right?
04:42 < mateobur> I also tried with 192.168.160.1
04:42 < Bushmills> any of the interfaces in the machine you're running openvpn
04:42 < mateobur> ahh ok
04:43 < mateobur> I only have one interface
04:43 < mateobur> with my WAN IP adrress
04:43 < Bushmills> you can't bind openvpn to an interface on another machine
04:44 < Bushmills> (well, you can - by running openvpn there, on that machine)
04:44 < mateobur> I though that was the IP for the virtual tap0
04:44 < Bushmills> no. it is the interface and port of the physical interface
04:44 < mateobur> ok
04:45 < Bushmills> 0.0.0.0 for all interfaces
04:45 < mateobur> I only have one interface
04:45 < mateobur> so 0.0.0.0
04:45 < mateobur> will be ok
04:54 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
05:00 -!- mateobur [~mateo@26.183.21.95.dynamic.jazztel.es] has quit [Ping timeout: 246 seconds]
05:04 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 276 seconds]
05:14 < local|host> where can i find a doc describing all features of ovpn's management api
05:17 -!- benni-buero [~chatzilla@p578b114e.dip0.t-ipconnect.de] has joined #openvpn
05:17 < benni-buero> !welcome
05:17 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:18 < benni-buero> !howto
05:18 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
05:20 < benni-buero> hm. just a simple question, cant find the answer in the howto: is the openvpn-installer package for win32 the server, the client or both? thankyou for any help :-)
05:26 < Bushmills> benni-buero: both
05:27 < Bushmills> config file determines the role of openvpn
05:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:35 < benni-buero> Bushmills: thanks :-)
05:37 -!- Diffen [~diffen@user8.85-195-0.netatonce.net] has quit [Quit: This computer has gone to sleep]
05:38 -!- bitterman [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
05:38 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
05:43 -!- Diffen [~diffen@user8.85-195-0.netatonce.net] has joined #openvpn
05:45 -!- Diffen [~diffen@user8.85-195-0.netatonce.net] has quit [Client Quit]
06:11 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 240 seconds]
06:12 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
06:12 -!- benni-buero [~chatzilla@p578b114e.dip0.t-ipconnect.de] has left #openvpn []
06:16 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:23 -!- twister004 [~chatzilla@117.204.136.96] has quit [Ping timeout: 276 seconds]
06:24 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
06:25 -!- darth_bitterman [~yury@84.51.192.6] has joined #openvpn
06:25 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:28 -!- kyrix [~ashley@92.90.21.8] has joined #openvpn
06:28 -!- bitterman [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
06:38 -!- Diffen [~diffen@79.138.155.189.bredband.tre.se] has joined #openvpn
06:45 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:46 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
06:51 -!- kyrix [~ashley@92.90.21.8] has quit [Read error: Connection reset by peer]
06:54 -!- Diffen [~diffen@79.138.155.189.bredband.tre.se] has quit [Ping timeout: 246 seconds]
06:59 -!- coffeeburrito [~joe@pop.nakinasystems.com] has joined #openvpn
07:04 < coffeeburrito> I am trying to set up a basic tun vpn - everything connects just fine without error, but the client never gets an IP address even though the server messages says "Learn: 10.0.0.6 -> client/192.168.1.38:6071"
07:05 < coffeeburrito> and if I use ifconfig in the configuration files to manually set the endpoint IP addresses on the client side, it takes the IP but traffic refuses to pass over the vpn
07:06 < coffeeburrito> RX packets:0 errors:0 dropped:11 overruns:0 frame:0 / TX packets:47 errors:0 dropped:0 overruns:0 carrier:0 -- I think it involves the 11 dropped packets
07:06 < coffeeburrito> both sides say the same thing
07:07 < krzee> !configs
07:07 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
07:09 < coffeeburrito> http://pastebin.com/F61Qweqn
07:10 < coffeeburrito> I apologize for the messiness, I've been trying quite a few different settings and IP addresses
07:11 < coffeeburrito> also iptables is off, and there is no firewall between the devices
07:14 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Operation timed out]
07:19 < Bushmills> don't you need to put something like "client..." or at least "pull" into client config?
07:21 < Bushmills> just do that, write "client" above "remote ..."
07:22 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
07:24 -!- coffeeburrito [~joe@pop.nakinasystems.com] has quit [Ping timeout: 246 seconds]
07:25 -!- darth_bitterman [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
07:30 < Bushmills> you're welcome
07:34 < rob0> mmm, some coffee and a burrito would be good
07:35 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has quit [Quit: Leaving]
07:38 -!- |nuno| [~root@pigmeu.org] has joined #openvpn
07:38 < |nuno|> hi all
07:39 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
07:39 < |nuno|> !welcome
07:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:39 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:39 < |nuno|> !route
07:39 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
07:44 -!- darth_bitterman [~yury@84.51.192.6] has joined #openvpn
07:47 -!- bitterman [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
07:50 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
07:52 -!- |nuno| [~root@pigmeu.org] has quit [Quit: leaving]
07:56 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: No route to host]
07:56 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
07:57 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
07:57 -!- tomiondrums [~kvirc@pD951A351.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
07:57 -!- mateobur [~mateo@26.183.21.95.dynamic.jazztel.es] has joined #openvpn
07:57 < mateobur> Hello
07:58 < hyper_ch> hi
07:58 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
08:03 -!- tomiondrums [~kvirc@pD951A351.dip.t-dialin.net] has joined #openvpn
08:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:20 -!- dazo is now known as dazo_afk
08:26 < pwrcycle> morning all. is there a solution for Win7 not accepting the config route?
08:28 < dvl> BSDCan is about four weeks away
08:33 -!- dazo_afk is now known as dazo
08:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
08:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:55 < dkr> pwrcycle: check security settings? and system logs might give a clue as to what restriction is causing it to not work
08:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
08:56 < dkr> (not that I know anything about win7)
08:57 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
08:57 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
08:57 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
09:05 < pwrcycle> dkr: i've found this bug report: https://community.openvpn.net/openvpn/ticket/97
09:05 <@vpnHelper> Title: #97 (OpenVPN produces DCHP NAK bomb on Win 7 64bit) – OpenVPN Community (at community.openvpn.net)
09:06 < pwrcycle> dkr: the tunnel gets established, you can ping the gateway, but Win7 doesn't set the tun as the new defualt route.
09:08 -!- EugeneKaway is now known as EugeneKay
09:13 < krzee> !win7
09:13 <@vpnHelper> "win7" is http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/8a3e9b05-353b-4250-a023-066a085e9657 for a workaround to the windows 7 unidentified network issue you get when using redirect-gateway
09:13 < krzee> :-p
09:15 < Bushmills> !winroute
09:15 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
09:15 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
09:15 < Bushmills> pwrcycle: ^^^
09:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:20 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
09:20 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
09:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:23 -!- darth_bitterman [~yury@84.51.192.6] has quit [Quit: Leaving]
09:26 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
09:26 < jeev> bam chika wow wow
09:30 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
09:30 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
09:37 < pwrcycle> krzee: Bushmills thnx, i'll test it
09:43 -!- Blues-Man [~bluesman@host231-116-dynamic.53-79-r.retail.telecomitalia.it] has joined #openvpn
09:48 < mateobur> I have configured push "redirect-gateway" in the openvpn server, it seems to work
09:48 < mateobur> but puts the default gw to 10.8.0.5 instead of 10.8.0.1, I don't know where this .5 comes from
09:49 < Bushmills> that's the client's p-t-p address
09:50 < jeev> do you have to be using UDP in order to use tls-client and not client ? i dont want anything pulled from the server
09:50 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
09:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:52 < mateobur> Bushmills, ok, but the traffic through the VPN still doesn't work
09:53 < mateobur> I suppose I have to connect the tun0 to the eth0 in the server
09:53 < Bushmills> nope. check out ...
09:53 < Bushmills> !redirect
09:53 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
09:54 < Bushmills> escpecially the ipforward and NAT bits
09:54 < jeev> i dont think it's possible to connect to something as 'client' and not get it's pushed routes, is it ?
09:55 < mateobur> I see...
09:55 < Bushmills> it is. you can configure client to ignore anything pushed
09:55 < jeev> --ignore push
09:55 < jeev> hmm
09:55 < mateobur> I understand the forwarding to forward between tun0 and eth0
09:55 < mateobur> but don't see why I need a NAT
09:56 < jeev> hmm no
09:56 < jeev> --push-reset heh
09:56 < Bushmills> mateobur: depends on what hosts you want to talk to. if those are in a subnet behind server, look at ...
09:56 < Bushmills> !route
09:56 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:56 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 246 seconds]
09:57 < Bushmills> for the rest, where you can't specify specific routes, you'd use NAT on server
09:57 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
09:57 < Bushmills> jeev:  --route-nopull
09:58 < jeev> sexy
09:58 < jeev> i was gonna do push reset in cd
09:58 < jeev> ccd
10:00 -!- noisebleed_ [~quassel@piggy.inescn.pt] has joined #openvpn
10:01 < jeev> awesome, worked Bushmills. thank you
10:01 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
10:01 < mateobur> Bushmills, no I only want the vpn server to bypass proxies, no LANs behind the server
10:01 < Perun> I have still the problem to reach the networks behind a roadwarrior... I can reach all behind ovpn server from roadwarrior, but not the lan ip of roadwarrior.... can someone help?
10:02 < Perun> lan ip of roadwarrior from ovpn server
10:02 < Perun> ip forward is on
10:02 < Perun> needed routes are there
10:03 -!- rob0 [~rob0@pdpc/valentine/postfixninja/rob0] has quit [Quit: reboot imminent]
10:04 < Perun> I see with tcpdump on ovpn server the packages if I ping -> lan ip of roadwarrior, but tcpdump on roadwarrior shows nothing
10:04 < Perun> do I need to enable it in ovpn config?
10:10 < Bushmills> !route
10:10 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:10 < Bushmills> !serverlan
10:10 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
10:10 < Bushmills> Perun: ^^^
10:11 < Perun> yep, forwarding on, routes there
10:11 -!- mateo__ [~mateo@78.47.122.11] has joined #openvpn
10:12 < mateo__> Bushmills, cool I'm accessing the internet through my openvpn now
10:12 < Perun> I want to ping (!) lan ip of roadwarrior from server
10:13 < Bushmills> !clientlan
10:13 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
10:13 <@vpnHelper> better explanation
10:13 < Bushmills> Perun: ^^^
10:13 -!- mateobur [~mateo@26.183.21.95.dynamic.jazztel.es] has quit [Ping timeout: 276 seconds]
10:13 < Bushmills> but, if that's a single machine, simply ping the client openvpn address
10:15 < Perun> I need to reach the lan ip of rw
10:15 -!- Blues-Man [~bluesman@host231-116-dynamic.53-79-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
10:16 < Perun> !ccd
10:16 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
10:16 < Perun> !iroute
10:16 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
10:18 <@vpnHelper> RSS Update - forum: server address blacklisted ? <http://forums.openvpn.net/topic7930.html#p11249>
10:18 < Perun> Bushmills: Isee, I need iroute
10:19 < Perun> thx
10:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:30 < Perun> works
10:30 < Perun> other question... I cant add routes to clients 'behind' roadwarrior
10:31 < Perun> it is possible to use NAT to reach them?
10:31 -!- mateo__ [~mateo@78.47.122.11] has quit [Ping timeout: 276 seconds]
10:36 < Bushmills> it is, yes. but road warrior need NAT and ip_forward enabled then 
10:37 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 248 seconds]
10:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:41 -!- local|host [~fourat@197.0.89.120] has quit [Ping timeout: 258 seconds]
10:42 < Perun> Bushmills: yep rw is my system, the other are systems in the firm where I work... on my system I can set such things
10:48 -!- arosen [~arosen@130.127.39.173] has quit [Read error: Connection reset by peer]
10:49 -!- K1ng [~KING@180.211.188.140] has quit [Ping timeout: 246 seconds]
10:51 -!- K1ng [~KING@180.211.188.159] has joined #openvpn
10:53 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
11:02 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:10 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
11:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:17 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
11:23 -!- mirco [~mirco@91.35.254.107] has joined #openvpn
11:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:39 -!- ghostmediapro [~ghostmedi@71.23.182.164] has joined #openvpn
11:40 < ghostmediapro> how to configure openvpn on windows to allow cleint to connect to it?
11:43 < Bushmills> ghostmediapro: as server
11:43 < ghostmediapro> yes
11:43 < ghostmediapro> i need to install it as a server on windows
11:44 < Bushmills> you'd use an interactive openvpn configuration frontend program, commonly called a "text editor", and put a configuration file together
11:44 < ghostmediapro> i'm totally new to openvpn and don't know black from white
11:44 < Bushmills> !howto
11:45 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:45 < ghostmediapro> tried reading how to it only looks like a cleint not a server
11:45 < ghostmediapro> thank you
11:45 < Bushmills> it describes both aspects
11:45 < ghostmediapro> i guess openvpn is not for me
11:45 < Bushmills> i tend to agree
11:48 < krzee> [09:44]  <Bushmills> you'd use an interactive openvpn configuration frontend program, commonly called a "text editor", and put a configuration file together
11:48 <@vpnHelper> RSS Update - forum: licensing.openvpn.net not found when activating licenses <http://forums.openvpn.net/topic7944.html>
11:48 < krzee> i lol'ed
11:49 < Bushmills> good morning :)
11:52 < krzee> g'mornin
11:52 < krzee> although its extended evening for me ;]
11:52 < krzee> suuuuure TECHINICALLY its day time
11:53 < krzee> s/I//
11:54 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html>
11:58 -!- noisebleed_ [~quassel@piggy.inescn.pt] has quit [Remote host closed the connection]
12:00 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:00 <@vpnHelper> RSS Update - forum: licensing.openvpn.net not found when activating licenses <http://forums.openvpn.net/topic7944.html#p11252>
12:06 <@vpnHelper> RSS Update - forum: Routing problem - VPN Client not using TAP-Win32 adapter <http://forums.openvpn.net/topic7928.html#p11253>
12:12 < Dougy> moin
12:12 <@vpnHelper> RSS Update - forum: openvpn installation not creating /etc/openvpn on centos 5.5 <http://forums.openvpn.net/topic7946.html>
12:12 < Dougy> ghostmediapro: it's very simple
12:12 < Dougy> follow it step by step
12:12 < Dougy> you'll get it working
12:13 < jeev> ick
12:15 -!- Guifort [~Administr@ns208662.ovh.net] has joined #openvpn
12:15  * Dougy goes to take a dump
12:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
12:18 <@vpnHelper> RSS Update - forum: licensing.openvpn.net not found when activating licenses <http://forums.openvpn.net/topic7944.html#p11256> || openvpn installation not creating /etc/openvpn on centos 5.5 <http://forums.openvpn.net/topic7946.html#p11255>
12:28 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:31 <@vpnHelper> RSS Update - forum: openvpn installation not creating /etc/openvpn on centos 5.5 <http://forums.openvpn.net/topic7946.html#p11257>
12:32 -!- ghostmediapro [~ghostmedi@71.23.182.164] has quit [Ping timeout: 260 seconds]
13:06 -!- Guifort [~Administr@ns208662.ovh.net] has quit [Read error: Connection reset by peer]
13:07 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
13:09 -!- Guifort [~Administr@ns208662.ovh.net] has joined #openvpn
13:14 -!- ghostmediapro [~ghostmedi@71.23.182.164] has joined #openvpn
13:14 < ghostmediapro> http://pastebin.com/mqnpgRed
13:18 <@dazo> ghostmediapro: at a first quick glance, that looks correct
13:18  * dazo presumes the key/cert/dh files have been generated
13:18 < ghostmediapro> now how do i start the service
13:18 < ghostmediapro> yes
13:19 <@dazo> I don't have any particular Windows experience, but now you can for sure start it from a command line (openvpn --config server.conf) or via the OpenVPN GUI, if the config file is located in the config directory
13:19 <@dazo> the disadvantage is that if you log out, it kills openvpn
13:20 <@dazo> there is a service feature as well ... but I don't recall how to set the correct config file ... you might need to do that via the "Manage computer -> Services" GUI in Windows
13:21 < ghostmediapro> i get a error trying to run it from the gui
13:22 <@dazo> I'm not good at reading your mind, and my gambling skills are also bad ... so you'll need to show me the error
13:22 < ghostmediapro> ok
13:25 < ghostmediapro> http://pastebin.com/Y6atvAqn
13:27 <@dazo> ghostmediapro: have a look at --server in the man page
13:27 <@dazo> !man
13:27 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
13:27 -!- Guifort [~Administr@ns208662.ovh.net] has quit [Read error: Connection reset by peer]
13:27 -!- Guifort [~Administr@ns208662.ovh.net] has joined #openvpn
13:29 <@dazo> I also sense you try to use an IP address for the VPN as you have in your LAN ... that won't work so easily with your config
13:29 <@dazo> try to use a separate subnet instead
13:29 <@dazo> !rfc1918
13:29 < krzee> !1918
13:29 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, adn 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html
13:29 < krzee> =]
13:29 <@dazo> krzee: thx!
13:29 < krzee> any time brutha
13:30 <@dazo> I began to wonder if I remembered the wrong rfc number :)
13:30 < Bushmills> http://scarydevilmonastery.net/subnet.cgi
13:30 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
13:30 <@dazo> !learn 1918 as To lazy to find your own subnet?  Try this one: http://scarydevilmonastery.net/subnet.cgi
13:30 <@vpnHelper> Joo got it.
13:31 < Bushmills> thanks :)    script source: http://scarydevilmonastery.net/subnet
13:32 <@dazo> heh :) nice and simple
13:33 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
13:35 < Bushmills> it is "too lazy", btw
13:35 < krzee> theres a such thing as "too" lazy?
13:35 <@dazo> bah
13:35 <@dazo> krzee: does !relearn exist?
13:36 < krzee> nah but there is change / and forget
13:36 <@dazo> !change
13:36 <@vpnHelper> (change [<channel>] <key> <number> <regexp>) -- Changes the factoid #<number> associated with <key> according to <regexp>.
13:37 <@dazo> !change 1918 3 s/^To/Too/
13:37 <@vpnHelper> Joo got it.
13:37 <@dazo> !1918
13:37 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, adn 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
13:37 <@dazo> hah!
13:37 < krzee> !change 1918 1 s/adn/and/
13:37 <@vpnHelper> Joo got it.
13:38 < krzee> !1918
13:38 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
13:38 < krzee> cool =]
13:38 -!- Guifort [~Administr@ns208662.ovh.net] has quit [Ping timeout: 252 seconds]
13:38 < ghostmediapro> http://pastebin.com/4GnvCGJd
13:39 <@dazo> ghostmediapro: Your issue is: Socket bind failed on local address [undef]:1194: Address already in use (WSAEADDRINUSE)
13:39 <@dazo> which means there is already a openvpn process running, using port 1194
13:40 <@dazo> krzee: I got an idea for vpnHelper ... when pastebin URLs comes, it will grep the pastebin for plausible issues and report them here in IRC ...
13:41  * dazo hides before krzee suggests him to write that code
13:41 -!- WebDawg [~whoami@officialg0d.com] has quit [Read error: Operation timed out]
13:41 < ghostmediapro> i restarted the service 
13:41 < ghostmediapro> got the same error
13:42 <@dazo> ghostmediapro: you have another process blocking the port ... restarting the service will not change the fact that there is another process blocking that port right now
13:43 -!- Guifort [~Administr@ns208662.ovh.net] has joined #openvpn
13:48 -!- pmatulis_ [~peter@64.34.151.178] has left #openvpn []
13:49 < ghostmediapro> dazo: i thank i got it working, now on the cleint side all i should need to do is enter hostname and password?
13:50 <@dazo> ghostmediapro: almost ... but it will be a similar config ... look at --client ... and unless the client key is password protected, it will not ask for a password
13:51 <@dazo> but you need to issue a client certificate to your clients as well
13:51 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
13:58 -!- Guifort [~Administr@ns208662.ovh.net] has quit [Read error: Connection reset by peer]
13:58 -!- Guifort [~Administr@ns208662.ovh.net] has joined #openvpn
14:03 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 250 seconds]
14:04 < ghostmediapro> dazo: how to add to this, the ability to see both private lan and lan
14:05 <@dazo> you need to look at routing then
14:05 <@dazo> !tcpip
14:05 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
14:05 <@dazo> ghostmediapro: ^^^  this redbook covers the basics you probably need to know
14:05 <@dazo> esp. ch. 3.1
14:08 < krzee> lol dazo
14:08 < krzee> that would be elite
14:08 -!- Guifort [~Administr@ns208662.ovh.net] has quit [Read error: Connection reset by peer]
14:08 <@dazo> I'm optimistic :)
14:08 <@dazo> but seriously ... if the chapter 3.1 knowledge is lacking ... you don't have the knowledge to really setup VPN properly
14:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:11 -!- Guifort [~Administr@ns208662.ovh.net] has joined #openvpn
14:11 < ghostmediapro> dazo plays on my intellect
14:12 < krzee> hes being honest tho
14:12 < ghostmediapro> dazo: this is a custom software
14:12 < ghostmediapro> i don't have any idea how to use
14:12 < krzee> if you dont know basic networking, trying to setup a vpn is like trying to do the 100m hurdles before learning to walk
14:12 < ghostmediapro> windows networking no problem
14:12 < krzee> what exactly is windows networking?
14:13 < ghostmediapro> i can set up a vpn with in windows not using a third part software
14:13 <@dazo> my thoughts exactly
14:13 < krzee> lol, you mean the least secure vpn possible?
14:13 < krzee> !pptp
14:13 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read about
14:13 <@vpnHelper> why to not use pptp
14:13 < ghostmediapro> l2tp is supported as well
14:13 < ghostmediapro> as ipsec
14:14 < krzee> if its so much easier to setup, why not go with that then?
14:14 < ghostmediapro> so again using this software what do i edit and where to get this to see both privat lan and lan
14:14 <@dazo> OpenVPN is two parts ... a virtual network adapter and the openvpn application .... the virtual network adapter works like normal NIC, except that traffic hitting this device is redirected to OpenVPN, which encrypts/decrypts and sends/receives the data over the Internet to/from another OpenVPN instance
14:14 < krzee> !route
14:14 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:15 < krzee> thats everything someone needs to know about openvpn routing for lans behind openvpn, you MUST have a good grasp of routing before even thinking about trying
14:21 < gladiatr> or at least be on the strong side of pathetic
14:22 < ghostmediapro> http://pastebin.com/GVYTcDC0
14:22 -!- Dennis84 [~dennis@mail.it-moebius.de] has joined #openvpn
14:22 < Dennis84> hey all
14:22 < Dennis84> is it possible to log the internal vpn ip in the status logfile?
14:23 < gladiatr> Dennis84, whatcha mean?
14:28 <@dazo> Dennis84: I don't recall what is logged in the status file ... but read up on --status in the man page ... there are at least 2 versions of the status file, where you indicate the format via --status as well
14:28 <@vpnHelper> RSS Update - forum: Very poor preformance <http://forums.openvpn.net/topic7941.html#p11258>
14:29 <@dazo> ghostmediapro: you must also remember to have proper reverse routing as well ... and IP forwarding must be enabled on the Windows server (which is running OpenVPN)
14:30 <@dazo> and there is also the firewall thing as well ... check that it allows traffic to be passed between the different network devices
14:30 < ghostmediapro> dazo: did or didn't i edit the right file
14:30 <@dazo> ghostmediapro: your lines makes sense to me
14:31 <@dazo> good tools to see if the traffic is routed correctly, are tools like tcpdump or wireshark
14:34 < Dennis84> dazo: i can change the status server log lines?
14:35 < Dennis84> can you give me a hint how i can do this?
14:35 <@dazo> Dennis84: if you're willing to dig into the source code and build openvpn yourself
14:35 < Dennis84> dazo: no, not really :)
14:35 < Dennis84> the only thing is
14:36 < Dennis84> i have few clients with older openvpn versions
14:36 < Dennis84> and i cannot assign static ip's to them in my vpn client network
14:36 < Dennis84> but i want to know, which ip was assigned to which client
14:36 <@dazo> make them upgrade, as it's not just new features which is coming in but also bug and security fixes
14:37 < Dennis84> hmm
14:38 <@dazo> you can write your own scripts, and use --client-connect or --learn-address script hooks ... In the man page, there is a "SCRIPTING AND ENVIRONMENTAL VARIABLES" section which describes what you can expect to get
14:38 <@dazo> that way you can probably hack your own --status log file
14:38 <@dazo> or at least get some info which fills your gaps
14:39 < Dennis84> ok
14:39 < Dennis84> one last question
14:39 < Dennis84> can i see the status-versions in the docu?
14:40 < Dennis84> so, i mean, that i can see the differences between 1,2 and 3
14:40 <@dazo> heh ... I thought that was documented ... but it wasn't :(
14:41 < Dennis84> ok
14:41 < Dennis84> thanks alot :)
14:42 <@dazo> you're welcome 
14:42  * dazo heads away for a while
14:44 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
14:45 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Client Quit]
14:48 < amir> are there kernel version limitations to openvpn?
14:48  * amir just tried to use it on 2.6.22 and failed
14:48 < amir> i get a openvpn[1903]: Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
14:49 < amir> and /dev/net/tun really does not exist even tough the tun module is loaded
14:49 < Bushmills> amir,   lsmod|grep ^tun  ‬ displays anything?
14:50 < amir> yep, sure, loaded
14:50 < amir> tun                    12544  0 
14:50 < ecrist> are you running as root?
14:50 < amir> tun: Universal TUN/TAP device driver, 1.6
14:50 < amir> yes
14:50 < amir> is the tun driver too old?
15:05 -!- glengoyne [~glengoyne@p549461A8.dip.t-dialin.net] has joined #openvpn
15:06 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:08 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
15:09 <@vpnHelper> RSS Update - forum: douglas <http://forums.openvpn.net/topic7948.html> || Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html>
15:12 < |Mike|> localnet?!
15:20 < ghostmediapro> dazo: please tell me is this correct for cleint side http://pastebin.com/KAbV6VA2
15:21 < ghostmediapro> error i get is wait 1 min passes then resolv, 1 min passes, then it repeats
15:25 -!- glengoyne [~glengoyne@p549461A8.dip.t-dialin.net] has quit [Quit: Verlassend]
15:28 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
15:29 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
15:38 -!- ghostmediapro [~ghostmedi@71.23.182.164] has quit [Ping timeout: 246 seconds]
15:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
15:42 < amir> hmmm. how does one configure 2 vpn links which link the same networks? it seems that two times an iroute 172.16.0.0/16 is NOT a good idea :(
15:46 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
15:47 -!- a76389724 [~76389724@28.80-202-82.nextgentel.com] has joined #openvpn
15:47 < a76389724> !welcome
15:47 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:47 < a76389724> !goal
15:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:51 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
15:52 < orudie> if i see message in server log : error=certificate is not yet valid: , will it work in a few hours once time passes ?
16:05 -!- Guifort [~Administr@ns208662.ovh.net] has quit [Read error: Connection reset by peer]
16:05 -!- Guifort [~Administr@ns208662.ovh.net] has joined #openvpn
16:06 -!- Guifort [~Administr@ns208662.ovh.net] has quit [Client Quit]
16:07 -!- EugeneKay is now known as EugeneKaway
16:08 < orudie> any Idea why is it saying that ?
16:11 < krzee> orudie, 
16:11 < krzee> !certverify
16:11 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
16:11 < krzee> one of your clocks is wrong
16:11 < krzee> either on your client, server, or CA machine
16:11 < krzee> if they all SAY the right time, check they are in the right time zone!
16:13 -!- dazo is now known as dazo_afk
16:14 -!- a76389724 [~76389724@28.80-202-82.nextgentel.com] has quit []
16:15 < orudie> krzee, clocks are right 
16:16 < krzee> one of the 3 is not right
16:16 < krzee> ntpdate time.nist.gov on all 3, then re-generate your certs
16:17 < orudie> openssl verify -CAfile ca.crt clientrondeane.crt
16:17 < orudie> clientrondeane.crt: OK
16:19 < krzee> thats one side...
16:23 < orudie> krzee, the time and timezone is right everywhere 
16:25 < orudie> kraut, date
16:25 < orudie> Wed Apr 13 17:25:21 UTC 2011
16:26 < orudie> sorry that was for krzee ^^, thats on the VPN Server 
16:26 < krzee> Wed Apr 13 21:27:56 UTC 2011
16:26 < krzee> how is yours correct?
16:26 < krzee> you are 4 hours off, wrong timezone
16:27 < orudie> krzee, the time is right for me 
16:27 < krzee> (like i mentioned to check 15 mins ago) ;]
16:27 < krzee> no, it is not
16:27 < krzee> UTC is the same for everyone
16:27 < krzee> the time in UTC is what i pasted
16:28 < krzee> set your timezone dude
16:28 < krzee> OR, just do ntpdate time.nist.gov
16:28 < krzee> and then it'll be correct, and you can decide to set your timezone or not
16:28 < amir> goal: i'm trying to link 2 sites with 2 vpn links. both sides are ospfd domains and the border routers exchange ospf routes, so that both sites know all routes troughout the network. my problem is this: for each vpn link i have to specify an "iroute xxx/yy" statement. it seems to be a problem for openvpn if these two iroute statements do OVERLAP or even be the same addresses
16:29 < krzee> amir, use a routed tap setup
16:29 < krzee> EXACT same as routed tun, but dev tap
16:29 < krzee> =]
16:29 < amir> krzee, i would like to stay with tun
16:29 < krzee> then you may not use client/server
16:29 < krzee> you MUST use ptp if you use tun
16:29 < amir> krzee, and routing works find as long as i start only one of the vpn links
16:29 < amir> fine*
16:30 < amir> oh
16:30 < amir> i'm using topology subnet
16:30 < krzee> right, it will work until it fails over, or until the other connects if you've dont iroute wrong (overlapping for example)
16:30 < krzee> you wont need topology subnet in tap either, thats how tap works already
16:30 < amir> the i routes are even identical
16:30 < amir> but i dislike bridging
16:30 < krzee> you have 2 choices, dev tap or ptp NOT client/server
16:30 < amir> i like the routing aproach
16:30 < krzee> you dont need to bridge
16:31 < krzee> ROUTED tap setup
16:31 < amir> uh
16:31 < amir> that sounds like something new to me
16:31 < krzee> dev tap on a normal tun config
16:31 < krzee> although you gotta lose topology subnet (cause you dont need it in dev tap)
16:31 < krzee> dev tap already does it like topology subnet does
16:32 < amir> boah - i really need to do such a fundamental change just to be able to run two vpn links between same address spaces?
16:32 < krzee> fundamental?
16:32 < krzee> its literally a single change to each config
16:32 < krzee> and yes
16:32 < krzee> you either must lose client/server ability, or switch to dev tap
16:32 < krzee> those are your choices
16:32 < amir> yeah, afaik tap will do the same as subnet, except that i do not see the connecting subnet?
16:32 < krzee> period
16:33 < amir> ic
16:33 < krzee> you will still use .2 .3 .4 .5 etc with dev tap
16:33 < krzee> you still use --server like normal
16:33 < amir> will this not result in a bridged approach sending more stuff over the vpn link?
16:33 < krzee> yes and no
16:33 < amir> hmm, intelligent bridges do not need to send that much more
16:34 < krzee> with a bridge the entire lans layer2 goes over the vpn
16:34 < krzee> with a routed tap, only the vpn nodes do layer2
16:34 < krzee> so there can be lots less chatter, but its still layer2
16:34 < krzee> which is WHY it works for your setup
16:34 < amir> ahh
16:34 < amir> now i got it
16:34 < amir> yes, i see
16:34 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:34 < amir> so essentially one side is routed, one bridged
16:34 < krzee> nope
16:35 < krzee> niether is bridged
16:35 < krzee> you just have layer2 between the vpn nodes
16:35 < krzee> the bridge would allow layer2 to pass beyond the vpn nodes
16:35 < amir> ah
16:35 < amir> ok, i meant that
16:35 < krzee> but you'll be communicating to the other vpn node in layer2, so iroute isnt needed
16:35 < krzee> iroute is an internal routing table to openvpn
16:36 < amir> yes
16:36 < amir> one which collides when two nodes tell to have same addresses behind it
16:36  * amir just wants to switch of that iroute-table ;)
16:36 < amir> off *
16:36 < krzee> THATS WHAT IM TELLING YOU HOW TO DO!
16:36 < krzee> lol
16:37 < amir> so essentially i'm doing exactly that by switching to tap
16:37 < amir> yep
16:37 < krzee> yep
16:37 < amir> got it ;)
16:37 < amir> thx krzee 
16:37 < krzee> np
16:37 < amir> makes a lot more sense this way ;)
16:37 < krzee> this guy went through that same stuff
16:37 < krzee> !rip
16:37 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
16:37 < krzee> THEN after dazo told me that you can just use dev tap
16:37 < amir> ic
16:37 < krzee> which is MUCH easier / cleaner
16:37 < amir> heh, ic
16:38 < amir> no other sideeffects?
16:38 < krzee> im the guy who ALWAYS  says "use tun, not tap"
16:38 < krzee> but for you, use tap ;]
16:38 < krzee> you have a rare case where its the right move
16:38 < amir> a working tun config switched to tap which work out of the box?
16:38 < krzee> yep
16:38 < krzee> as long as you remove topology subnet
16:38 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has quit [Ping timeout: 246 seconds]
16:38 < krzee> and the iroutes
16:38 < amir> ah, right - good you mention it ;)
16:38 < amir> +tap -iroute -topology
16:39 < krzee> yep!
16:39 < krzee> and good news
16:39 < amir> great!
16:39 < krzee> static ips are done the same in tap as topology subnet
16:39 < krzee> so if you used those, you can leave them alone
16:39 < krzee> !static
16:39 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
16:39 < krzee> there is a side-effect
16:40 < amir> i used the ipp.txt stuff
16:40 < krzee> oh, what did you think ipp.txt does?
16:40 < amir> this are essentially static ip's after first time use
16:40 < krzee> false
16:40 < krzee> !ipp
16:40 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
16:40 < amir> oh
16:40 < amir> huh, really?
16:41 < krzee> really
16:41 < krzee> (i copied that from the manual)
16:41 < amir> so what for does it store host + ip if it does not assure to use it accordingly?
16:41 < krzee> theres rare cases where its what people wanted
16:41 < krzee> i saw people explain those cases on the mail list
16:41 < krzee> none of them made much sense to me, but seemed to make them happy
16:42 < krzee> but if you want static ips, make static ips =]
16:42 < amir> they seem not to trigger here ;)
16:42 < amir> as i never noticed wrong ip's :)
16:42 < krzee> sure, yet
16:42  * amir grins evilly
16:42 < krzee> you can leave it and maybe one day have it change on you and not know wtf is happening
16:42 < krzee> OR
16:42  * amir nods
16:42 < krzee> you can just make static ips correctly
16:42 < krzee> the choice is yours ;]
16:42 < amir> !static
16:42 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
16:42 < krzee> so...
16:43 < krzee> there are *2* side effects
16:43 < krzee> 1 was the same in topology subnet
16:43 < krzee> that is, if you do specific things based on the clients static ip, like firewall entries that are not dynamic using an openvpn script like --learn-address
16:43 < krzee> then the client can change his IP with ifconfig, and still use the vpn with his new ip
16:44 < krzee> possibly gaining more access
16:44  * amir nods
16:44 < krzee> that can only be avoided by using tun in ptp or topology net30
16:44 < krzee> other side-effect is:
16:44 < amir> -> single subnets
16:44 < krzee> on a tap vpn, if 1 node is hacked it can layer2 attack other nodes (arp poison for example)
16:45 < krzee> (hacked or untrusted)
16:45 < orudie> krzee, http://paste.debian.net/113947/
16:45  * amir nods
16:45 < krzee> orudie, please tell me you fixed your clocks
16:45 < krzee> oh god
16:45 < krzee> SET YOUR TIME ZONE
16:45 < amir> question: i'm able to use ifconfig-push with the same address range that ipp uses? or do i need to use another subnet? 
16:46 < krzee> oh ok you did set it
16:46 < krzee> EDT, sorry
16:46 < krzee> amir, forget ipp, you mean --server
16:46 < amir> ok, i mean that option which allocates ip from the range given to --server
16:47 < amir> eg. currently my hosts get 172.18.255.[2..x]
16:47 < krzee> and yes, standard is to give an ip in the range of --server
16:47 < amir> so i just use an ifconfig-push 172.18.0.2 255.255.255.0 for my first vpn host?
16:48 < amir> grr
16:48 <@vpnHelper> RSS Update - forum: server address blacklisted ? <http://forums.openvpn.net/topic7930.html#p11261>
16:48 < amir> so i just use an ifconfig-push 172.18.255.2 255.255.255.0 for my first vpn host?
16:48 < amir> hmm
16:48 < amir> i probably better just try out the stuff
16:48 < amir> o O ( and i thought i've finished configuring the stuff )
16:49 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
16:49 < amir> LOL!
16:49 < amir> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
16:49 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
16:49 < amir> i already had it open :D
16:49 < krzee> orudie, now go do the same thing on the other 2 machines as well
16:49 < krzee> =]
16:50 < orudie> krzee, EDT is the same as UTC ?
16:50 < krzee> no
16:50 < krzee> EDT = eastern daylight time
16:50 < |Mike|> orly
16:50 < krzee> UTC = GMT
16:51 < krzee> or from the first hit on google:
16:51 < krzee> EDT is 4 hours behind of Coordinated Universal Time (UTC).
16:53 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11262>
16:55 < orudie> but it shows the right time 
16:55 < orudie> i set the time UTC-5 which is EDT on VPN Server
16:55  * amir fetches a bigger hammer and starts smithing his config files
16:56 < krzee> UTC -5 is EST
16:56 < krzee> UTC -4 is EDT
16:56 < krzee> welcome to daylight savings
16:57 < krzee> EDT is used in the summer in these US states (EST during winter)
16:57 < amir> crazy stuff which never saved anything ;)
16:57 < krzee> Time zone offset: UTC - 4 hours
16:57 < krzee> New York will stay on EDT until Sunday, November 6, 2011 at 2:00 AM
16:57 < krzee> when clocks are moved to Sunday, November 6, 2011 at 01:00:00 EST
16:58 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 246 seconds]
16:58 -!- robotti^ [robotti@kapsi.fi] has quit [Ping timeout: 246 seconds]
16:58 -!- freaky[t] [alpha@freakyy.de] has quit [Ping timeout: 246 seconds]
16:58 < amir> btw, question: what for does openvpn use that iroute stuff?
16:58 < orudie> this is so frustrating 
16:58 < krzee> !iroute
16:58 -!- robotti^ [robotti@kapsi.fi] has joined #openvpn
16:58 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
16:58 < amir> that's a second layer of secutity?
16:58 < krzee> no, its the only way foreign lans can exist behind clients
16:59 < krzee> because the kernel can only route to openvpn itself
16:59 < amir> now, ONLY if you have no decent routing
16:59 < krzee> then openvpn needs a way to know what client the foreign subnet is behind
16:59 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
16:59 < amir> if you have some routing daemons exchanging the routes for you, you don't need that
16:59 < orudie> I was creating certificates okay, and now all of a sudden I create another one and its complaining about time 
16:59 < krzee> its not made for RIP / OSPF, you need tap or ptp for that (for the 4th time)
16:59 < orudie> I mean creating client keys 
16:59 < krzee> its made for normal routing setups and whatnot
16:59 < amir> krzee, aehm... ospf works fine with tun
16:59 < krzee> orudie, one of your clocks are wrong, PERIOD
17:00 < amir> krzee, i have it working here
17:00 < amir> krzee, no problems peering and exchanging routes
17:00 < krzee> until you connect 2 machines that have the same subnet in the iroute
17:00 < orudie> krzee, how are they wrong, they are showing the same time 
17:00 < amir> yes
17:00 < krzee> which stops them from handing the subnet over
17:00 < krzee> which means it DOES NOT WORK
17:00 < krzee> ;]
17:00 < amir> krzee, but there the problem is openvpn and not routing or layers
17:00 < orudie> krzee, i set the time zone on each machine and it sets it to the right time, I don't even touch the time, only the timezone 
17:00 < krzee> you are far far from the first to have that problem amir
17:00 < krzee> you now know the solution
17:00 < krzee> argue it all you like, it wont change
17:01 < amir> krzee, essentially other solution would be to disable that feature
17:01 < amir> krzee, and have a "dont use iroute" statement for the configfile
17:01 < amir> krzee, then you could keep tun
17:01 < krzee> orudie, ntpdate time.nist.gov on all 3 machines, then make your certs from the start again, your entire PKI
17:01 < krzee> ca and all
17:01 < amir> krzee, or am i wrong with that?
17:01 < orudie> wow 
17:01 < orudie> are you serious ?
17:01 < krzee> amir, disabling that feature would disable ALL routing to foreign subnets
17:02 < krzee> so yes, you are wrong
17:02 -!- freaky[t] [alpha@freakyy.de] has joined #openvpn
17:02 < krzee> orudie, did i sound like i was joking?
17:02 < amir> krzee, which is ok, in a rip/ospf case, isn't it?
17:02 < amir> krzee, there the routing tables reflect what's behind a link
17:02 < krzee> amir, if you dont want lans behind openvpn, yes
17:02 < krzee> nope, wont work
17:02 < amir> not?
17:02 < krzee> not if you want OPENVPN in the chain
17:03 < amir> ah, but THAT's because openvpn checks exactly that, right?
17:03 < krzee> no
17:03 < orudie> krzee, I have 3 clients set up that work fine, setting up fourth client gives this problem, and now I have to start all over ?
17:03 < amir> ok, then i'm still missing something
17:03 < krzee> its because openvpn needs to know what client to send the traffic to, internally
17:03 < krzee> routing tables dont have an option for vpn client
17:03 < krzee> it just points to the openvpn process
17:03 < krzee> which needs ITS OWN way to know which client to send it to
17:03 < krzee> (while using tun in server mode)
17:04 < amir> ahh
17:04 < orudie> ca machine (where I create certs) Wed Apr 13 18:01:27 EDT 2011
17:04 < krzee> amir, im not making this up as i go, this is straight from the devs
17:04 < amir> as we use ONE interface for lotsa links
17:04 < amir> we HAVE that problem, right
17:04 < amir> tun0 is multilink
17:04 < amir> so openvpn does not know WHICH link to choose
17:04 < krzee> exactly!
17:04 < orudie> vpn server machine Wed Apr 13 18:04:34 UTC 2011
17:04 < krzee> SO
17:04 < amir> got it
17:05 < krzee> you can use ptp, and wont need iroute
17:05 < amir> THAT
17:05 < amir> exactly
17:05 < krzee> still using tun
17:05 < amir> just wanted to say that
17:05 < amir> :)
17:05 < krzee> i said it way earlier
17:05  * amir nods
17:05 < amir> yes
17:05 < amir> but i did not understand WHY ;)
17:05 < amir> now i do
17:05 < krzee> [14:29]  <krzee> amir, use a routed tap setup
17:05 < krzee> [14:29]  <krzee> EXACT same as routed tun, but dev tap
17:05 < krzee> [14:29]  <krzee> =]
17:05 < krzee> [14:29]  <amir> krzee, i would like to stay with tun
17:05 < krzee> [14:29]  <krzee> then you may not use client/server
17:05 < krzee> [14:29]  <krzee> you MUST use ptp if you use tun
17:05 < krzee> ahh ok
17:06 < amir> so essentially as soon as you use multiple interfaces all is fine?
17:07 < orudie> krzee, is this wrong ? ca machine (where I create certs) Wed Apr 13 18:01:27 EDT 2011 vpn server machine Wed Apr 13 18:04:34 UTC 2011
17:07 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
17:07 < amir> as soon as you use only one interface you need iroute to decide which "virtual link" to use
17:07 < amir> kinda makes sense ;)
17:08 < amir> so from a point of security, the ptp solution would be a bit more secure (being a layer higher)
17:08 < amir> krzee, with your experience: would you go for a tap solution or for a ptp/tun solution? 
17:09 < amir> [i somehow dislike layer two :D]
17:09 <@vpnHelper> RSS Update - forum: openvpn installation not creating /etc/openvpn on centos 5.5 <http://forums.openvpn.net/topic7946.html#p11263> || How do I connect to PC while it is running in client mode? <http://forums.openvpn.net/topic7869.html#p11021>
17:10 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
17:11 < Bushmills> amir: krzee would use tun
17:11 -!- tomiondrums [~kvirc@pD951A351.dip.t-dialin.net] has quit [Quit: KVIrc 4.1.1 Equilibrium http://www.kvirc.net/]
17:11 < amir> Bushmills, ic, thx
17:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:12 < Bushmills> violently :)
17:13  * amir tends to go the same way
17:13 < amir> layer 2 is somehow... messy :}
17:13 < amir> so it seems i have to go back to ptp :(
17:13 < amir> sad
17:14 < amir> topology subnet was very nice
17:18 -!- EugeneKaway is now known as EugeneKay
17:20 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:20 < krzee> inet went down
17:21 < krzee> last thing i said was that switching to ptp will result in a loss of forward security
17:21 < krzee> then i asked if you are familiar with that term
17:23 < krzee> !learn forwardsecurity as in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the time since last renegotiation
17:23 <@vpnHelper> Joo got it.
17:24 < krzee> !learn forwardsecurity as in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
17:24 <@vpnHelper> Joo got it.
17:25 < krzee> !change forwardsecurity 1 s/time/timeframe/
17:25 < orudie> krzee,  is this wrong ? ca machine (where I create certs) Wed Apr 13 18:01:27 EDT 2011 vpn server machine Wed Apr 13 18:04:34 UTC 2011
17:25 <@vpnHelper> Joo got it.
17:25 < krzee> yes, wrong
17:25 < krzee> look at the time zones
17:25 < krzee> 1 is 4 hours different than the other
17:25 < krzee> those 3 little letters mean something, really they do
17:26 < krzee> UTC != EDT
17:26  * krzee face-desks
17:27 -!- X-Scale [email@2001:470:1f15:135b:913f:d432:8e98:629] has joined #openvpn
17:29 < krzee> UTC exists in africa / europe
17:29 < krzee> your computer is saying that its the same time in new york as a part of africa
17:30 < krzee> does that sound realistic? 
17:31 < orudie> krzee, no matter what I do to dd-wrt the output of date is UTC :(
17:32 < krzee> does that mean it must continue to be wrong?
17:32 < krzee> time zone doesnt matter, correct time does
17:32 < krzee> my UTC time is the same as anyone else in the world who has their clock set correctly
17:33 < krzee> oh and since you didnt google it
17:33 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Read error: Connection reset by peer]
17:33 < krzee> http://www.google.com/search?q=set+timezone+dd-wrt
17:33 <@vpnHelper> Title: set timezone dd-wrt - Google Search (at www.google.com)
17:33 < krzee> second hit:
17:33 < krzee> http://www.dd-wrt.com/forum/viewtopic.php?t=57562&sid=02da3b928db18e82db6f4fc156d559b4
17:33 < amir> so, krzee now the question that remains is: how efficient is the tap implementation concerning senseless repeating data down tunnels compared to tun
17:34 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
17:34 < amir> and can one live with a layer 2 attack...
17:34 < orudie> krzee, sorry got kicked off 
17:34 < orudie> what were you saying 
17:34 < amir> if i see that right
17:34 < orudie> thats the last thing I saw <krzee> oh and since you didnt google it
17:34 < krzee> [15:33]  <krzee> http://www.google.com/search?q=set+timezone+dd-wrt
17:34 <@vpnHelper> Title: set timezone dd-wrt - Google Search (at www.google.com)
17:34 < krzee> [15:33]  <krzee> second hit:
17:34 < krzee> [15:33]  <krzee> http://www.dd-wrt.com/forum/viewtopic.php?t=57562&sid=02da3b928db18e82db6f4fc156d559b4
17:35  * amir is still unsure if he should go for tap or for tun/ptp (without forward security, if i got that right)
17:35 < orudie> krzee, I read that post 
17:35 < krzee> amir, are you familiar with layer2 spoofing?
17:35 < orudie> krzee, there is no solution there 
17:35  * amir nods
17:35 < krzee> orudie, umm yes there is, it says how to set the timezone
17:35 < amir> arp stuff and all
17:35 < krzee> amir, ok, so thats the layer2 attacjk
17:36 < krzee> it could only be done by a vpn node
17:36 < krzee> (since you dont bridge)
17:36 < amir> so essentially every node can get any traffic
17:36 < orudie> krzee, I set the timezone in dd-wrt web gui , enable ntp server, select my timezone, enter time.nist.gov 
17:36 < krzee> if they arp poison you over the tap, yes
17:36  * amir nods
17:36 < orudie> krzee, but the output of date still shows UTC 
17:36 < amir> but that traffic is ptp encrypted, right?
17:37 < krzee> right, but only to the outside of the tunnel
17:37 < krzee> the vpn nodes are inside
17:37 < amir> ic
17:37 < amir> so he gets it unecrypted
17:38 < amir> so essentially when using layer 2 u must trust all hosts on the vpn
17:38  * amir feared that
17:39 < krzee> the least trusting method is to use ptp with different static keys for each link
17:39 < amir> as i have iDevices as clients (which i inherently don't trust), i would very much like a layer 3 solution 
17:39 < krzee> and hope the key never gets out, since you will have no forward security
17:39 < krzee> those are honestly your 2 choices
17:39 < krzee> pick the one you dislike least, or like most, however you choose to see it
17:39 < amir> now i already have different static keys for each node by using a seperate cert for each client and server, right?
17:39 < krzee> no
17:39 < orudie> brb
17:39 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Quit: бэм бэм бэм бэм бэм бэм бэм бля !]
17:39 < krzee> static key is NOT certs
17:40 < krzee> you dont get to use certs in ptp mode
17:40 < amir> oh
17:40 < krzee> you'll be using --secret
17:40 < amir> ic
17:40 < amir> in a ccd/xx file?
17:40 < krzee> the manual has examples of static key mode
17:40 < krzee> i think the howto does too
17:40 < krzee> no, you dont get ccd in ptp mode either
17:40 < amir> ic, i directly went for certs
17:41 < krzee> ccd is client config dir, prp does not have clients or a server
17:41 < krzee> ptp just has 2 peers
17:41 < krzee> s/prp/ptp/
17:41 < amir> so how do you configure several links?
17:41 < amir> to the SAME server?
17:41 < amir> multiple openvpn processes?
17:42 < amir> [i saw gentoo has options to start several openvpn processes in parallel]
17:42 < krzee> yes
17:42 < amir> anyway, the manual will tell
17:42  * amir will rtfm
17:42 < krzee> multiple processes, and different ports
17:42 < amir> [more]
17:42 < amir> ic
17:42 < amir> uncool :(
17:43 < krzee> like openvpn 1
17:43 < krzee> server/client didnt come til version 2
17:43 < amir> why is there no single server process solution? 
17:43 < amir> that's a simple question of multiplexing, if i understand right?
17:44 < krzee> there is
17:44 < krzee> its called server/client
17:44 < krzee> and in tun mode it doesnt work for your goal
17:44 < krzee> lol
17:44 < krzee> in tap mode it does
17:44 < krzee> and its one of your 2 choices :-p
17:44  * amir grins evilly
17:45 < amir> ok
17:45 < amir> ptp sounds like pita and single connection configurating
17:45 < amir> very static and ptp ;)
17:45 < amir> and tap sounds like "i trust my clients"
17:45 < krzee> yep
17:45 -!- mirco [~mirco@91.35.254.107] has quit [Quit: mirco]
17:45 < amir> humm
17:45 < krzee> for ptp ild make a script to manage them
17:46 < amir> ic
17:46 < krzee> for tap ild firewall the hell out of my layer2
17:46 < amir> now, i already have firewalls at two clients and the server
17:46 < krzee> or simply static arp on the server and not use --client-to-client
17:46 < krzee> (if clients dont need to access eachother)
17:47 < amir> now, that's a nice feature ;)
17:47 < amir> but yes, i see what you mean
17:47 < amir> i think i have to start trusting my clients :D
17:47 < Bushmills> amir, what OS do you run?
17:47 < amir> ptp seems like too much work for my goal atm
17:48 < amir> especially as the link between the two sites WILL break in the future and we will have NO overlapping address space then
17:48 < amir> Bushmills, linux 
17:48 < Bushmills> what distribution, i mean
17:48 < amir> Bushmills, gentoo
17:49 < Bushmills> ok. i thought you were missing the multiple-server startup on another distribution, as that's not unique to gentoo.
17:49 < krzee> amir, with ptp you can build a mesh for your ospf to use
17:49 < amir> krzee, btw, you just explained to my why my first try with ptp and multiple links did fail :) 
17:50 < krzee> =]
17:50 < krzee> ya you're in a somewhat advanced sector of using openvpn
17:50 < krzee> using advanced routing protocols over it
17:50 < krzee> common issues to run into for that goal, very common
17:50 < amir> ;)
17:51 < amir> now, ospf is known to make stuff simpler :D
17:51  * amir chuckles
17:51 < amir> but in my experience that does not really show :)
17:52 < amir> the sad stuff is: i have both: i have 3 ospf routers forming a triangle of openvpn links (in the end - currently it's just 2 links) and i have real clients like iphones and ipads 
17:53 < amir> and two of the 3 routers have a dedicated line in between them as well
17:54 < amir> while all three have a link to the inet
17:54 < amir> and the openvpn links go over that
17:55 < amir> so essentially, in my case the tap solution is probably a lot simpler to archive
17:55 < amir> of that does not work out, i will build single links
17:55 < amir> with --secret and no ccd support
17:56 < amir> as i can do that and still have a second openvpn instance for the "dumb" clients like iphones then...
18:01 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
18:01 < amir> anyway, thx a lot krzee, this helped me a lot
18:01 < orudie> krzee, that link to dd-wrt did not help at all 
18:02  * amir hopes the tap solution works out for him - i like the ccd/certificate solution 
18:02 < krzee> you're welcome amir
18:02 < krzee> orudie, im done helping you try to figure out your clock problems, suffice it that i let you know that IS your problem
18:02 < krzee> *IS*
18:03 < krzee> not might be
18:03 < orudie> krzee, okay lets back up a little 
18:03 <@vpnHelper> RSS Update - forum: OpenVPN client for the iPhone and iPad <http://forums.openvpn.net/topic4568.html#p11264>
18:04 < orudie> krzee, you said that the actually timezone doesn't matter, its the time that needs to be right , correct ?
18:05 < krzee> the time FOR THE TIMEZONE needs to be correct
18:06 < krzee> basically, all clocks need to agree what time in UTC it is
18:06 < krzee> or be correct for their timezone (same thing)
18:06 < krzee> thats the last i will speak on that subject
18:10 < Bushmills> time is always right. clocks aren't :)
18:10 < krzee> hey Bushmills what time is it in germany?
18:10 < Bushmills> ten past one
18:10 < krzee> but its 7:10 here, your clock must be wrong!
18:11 < orudie> yeah , its dd-wrt's fault 
18:11 < orudie> i just noticed a bug 
18:11 < Bushmills> krzee: your 7 looks like a tilted 1
18:11 < krzee> thats always easier for users to go with than the normal true version "user error"
18:12 < krzee> lol Bushmills 
18:12 < orudie> even if you change the timezone in dd-wrt , the time changes, but the timezone is always UTC 
18:12 < krzee> then set timezone to UTC
18:12 < krzee> then update the time
18:12 < orudie> date
18:12 < orudie> Wed Apr 13 23:12:37 UTC 2011
18:12 < krzee> then date -u on the other machine
18:13 < orudie> like this it works 
18:13 < krzee> yep
18:13 < krzee> cause your time is finally right
18:13 < orudie> but its not right in the router 
18:13 < krzee> Wed Apr 13 23:12:37 UTC 2011
18:13 < krzee> that IS the time
18:13 < Bushmills> "if you change the timezone .."  ... "timezone is always UTC"   - isn't that a contradiction?
18:13 < krzee> Wed Apr 13 23:13:37 UTC 2011
18:13 < krzee> thats on my machine using date -u
18:14 < krzee> in fact orudie  for now on you only get to use date -u
18:14 < krzee> no more date for you, only date -u
18:14 < orudie> krzee, :)
18:14 < krzee> =]
18:15 < Bushmills> set system clock to utc. set time zone to region
18:15 < Bushmills> better, use rdate or ntpdate or ntp
18:16 < krzee> i think he is saying that he sets the time zone in the gui, then uses ntp, then his clock syncs to the right time for EDT, but does it in UTC
18:16 < orudie> Bushmills, can't use none of that in dd-wrt 
18:16 < Bushmills> can use any of those in dd-wrt
18:16 < krzee> Bushmills, you use dd-wrt dont ya?
18:16 < Bushmills> i use openwrt
18:17 < krzee> ya im gunna go with Bushmills on this one ;]
18:17 < krzee> (not surprisingly so, i usually do)
18:17 < Bushmills> rdate is built-in of busybox
18:17 < orudie> brb
18:17 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Quit: бэм бэм бэм бэм бэм бэм бэм бля !]
18:18 < Bushmills> (busybox is shell plus tools of *wrt) 
18:20 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
18:21 -!- Yen [Yen@unaffiliated/yen] has quit [Remote host closed the connection]
18:21 < orudie> root@DD-WRT:~# rdate
18:21 < orudie> -sh: rdate: not found
18:21 < orudie> root@DD-WRT:~# ntpdate
18:21 < orudie> crap sorry 
18:22 < Bushmills> lrwxrwxrwx    1 root     root      /usr/sbin/rdate -> ../../bin/busybox
18:23 < Bushmills> ntpdate or ntp need installing from repository
18:24 < orudie> I have to run now, thanks krzee for your help, also Bushmills thanks guys. 
18:24 < orudie> see you in a few hours if you still here 
18:25 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Client Quit]
18:25 < krzee> normally for his problem we can just say
18:25 < krzee> "your clock is wrong"
18:25 < Bushmills> there are ntpclient, ntpd, ntpdate, openntpd, chrony, htpdate, ntp-utils
18:25 < krzee> and like 3 minutes later they say "thank you, that fixed it"
18:26 < krzee> if he cant set his clock right, should he be setting up VPNs?
18:26 < krzee> ;]
18:26 < Bushmills> if setting up vpn teaches him how to set the clock, there's a benefit in it
18:27 < krzee> lol, thats a good way to look at it
18:27 < Bushmills> setting up the CA may be the next hurdle
18:28 < krzee> actually he did that already
18:28 < Bushmills> ehm .. if clock was an issue, that hurdle may have been mastered already
18:28 < krzee> thats how he got to the time error
18:28 < krzee> yep
18:30 < Bushmills> actually, router makes a pretty good ntp server
18:30 < Bushmills> rather low jitter
18:43 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Read error: Connection reset by peer]
18:44 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
18:46 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Quit: No Ping reply in 180 seconds.]
18:50 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
18:57 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
19:03 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:06 < krzee> good for voip too then
19:09 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Read error: Operation timed out]
19:09 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
19:09 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
19:09 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
19:12 -!- TACPILOT [~tacpilot@c-98-200-60-80.hsd1.tx.comcast.net] has joined #openvpn
19:12 < TACPILOT> hello
19:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
19:16 < TACPILOT> VPN running .. client can connect and server give address .. NO firewall installed on box .. can not ping server from client .. server can not ping client ... other clients are fine 
19:16 < TACPILOT> client can ping standard address and its vpn address
19:17 < TACPILOT> client can be pinged with standard address
19:17 < TACPILOT> any suggestions ?
19:22 < Bushmills> check client route
19:22 <@vpnHelper> RSS Update - forum: Browsing problem <http://forums.openvpn.net/topic7949.html>
19:24 < krzee> also check client log
19:25 < krzee> maybe it couldnt add the routes or something
19:25 < krzee> (and i think i kinda just repeated Bushmills now that im done saying it)
19:25 -!- nb [~nb@fedora/nb] has quit [Read error: Operation timed out]
19:25 < Bushmills> same idea. sensible thought.
19:26 < Bushmills> next question will be "win
19:26 < Bushmills> "windows client", and, if affirmative, !winroute :)
19:28 < krzee> and also if affirm, turn off windows firewall for testing
19:29 < krzee> or maybe even a conflicting subnet!
19:29 < krzee> we havnt had that one for awhile... past due!
19:30 < Bushmills> yes, it's a shame
19:30 < Bushmills> now with !1918 in place, no opportunities to play with it
19:31 < TACPILOT> routes appear correct .. 
19:33 < Bushmills> oh well.  what krzee suggested, then
19:34 < Bushmills> !tcpdump
19:34 < Bushmills> !tshark
19:35 < Bushmills> !mtr
19:35 < Bushmills> !traceroute
19:35 < Bushmills> !debug
19:36 < TACPILOT> will try the gambit suggested
19:36 -!- echoSMIL1 [~censured@bl17-94-248.dsl.telepac.pt] has quit [Read error: Operation timed out]
19:37 -!- echoSMILE [~censured@bl17-86-122.dsl.telepac.pt] has joined #openvpn
19:37 -!- echoSMILE [~censured@bl17-86-122.dsl.telepac.pt] has quit [Changing host]
19:37 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
19:43 < pwrcycle> !tcpdump rulez | !tshark TooVerbosShark | !mtr -n pretty numbers in columns | !traceroute the only thing that matters | !debug run the above
19:50 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
19:51 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
19:53 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
19:53 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
19:53 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
20:29 -!- K1ng\ [~KING@180.211.188.159] has joined #openvpn
20:31 -!- K1ng [~KING@180.211.188.159] has quit [Ping timeout: 240 seconds]
20:32 -!- oc80z [oc80z@blea.ch] has quit [Read error: Connection reset by peer]
20:33 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:33 -!- nb_ [~nb@fedora/nb] has joined #openvpn
20:51 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 258 seconds]
20:52 -!- TACPILOT [~tacpilot@c-98-200-60-80.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
21:00 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
21:01 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
21:02 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Client Quit]
21:05 -!- HQ_ [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Ping timeout: 260 seconds]
21:07 -!- TACPILOT [~tacpilot@c-98-200-60-80.hsd1.tx.comcast.net] has joined #openvpn
21:07 -!- TACPILOT [~tacpilot@c-98-200-60-80.hsd1.tx.comcast.net] has left #openvpn []
21:14 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
21:30 -!- jrkotrla [jrkotrla@gateway/shell/devio.us/x-mwhtylreyifldwcz] has joined #openvpn
21:31 < jrkotrla> following the openvpn setup guide found at <http://www.vps-tutorial.info/> and got to the point where it says to use <iptables -A FORWARD -m state .state RELATED,ESTABLISHED -j ACCEPT> but I get an error that says Bad argument `RELATED,ESTABLISHED'
21:31 <@vpnHelper> Title: VPS Tutorial - Powered by PhotonVPS. (at www.vps-tutorial.info)
21:34 -!- X-Scale [email@2001:470:1f15:135b:913f:d432:8e98:629] has quit [Remote host closed the connection]
21:40 -!- jrkotrla [jrkotrla@gateway/shell/devio.us/x-mwhtylreyifldwcz] has quit [Quit: leaving]
21:41 -!- jrkotrla [~jrkotrla@96.44.188.46] has joined #openvpn
21:43 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has joined #openvpn
21:43 -!- mant1s [~mant1s@cpe-76-179-27-79.maine.res.rr.com] has quit [Changing host]
21:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
22:13 -!- master_of_master [~master_of@p57B57493.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
22:15 -!- master_of_master [~master_of@87.181.121.39] has joined #openvpn
22:34 <@vpnHelper> RSS Update - forum: OpenVPN loses ipv4 address almost instantly <http://forums.openvpn.net/topic7950.html>
22:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Ping timeout: 246 seconds]
22:52 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has joined #openvpn
23:02 < arnotixe> hi all I'm wanting to run an openvpn server listening on ipv6, and the faq says something about it being integrated in post-2.0. I run 2.1~rc19-1ubuntu2 on ... ubuntu. Is this possible, or must I build my own server package?
23:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:39 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
23:49 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:49 -!- oc80z [oc80z@blea.ch] has joined #openvpn
--- Day changed Thu Apr 14 2011
00:04 -!- brianw_ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
00:04 -!- brianw_ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has joined #openvpn
00:05 -!- nijotz [~nick@li230-4.members.linode.com] has quit [Read error: Operation timed out]
00:05 -!- nijotz [~nick@nijotz.com] has joined #openvpn
00:17 <@vpnHelper> RSS Update - forum: UDPBroadcastForwarder <http://forums.openvpn.net/topic7319.html#p11267>
00:29 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has joined #openvpn
01:03 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:06 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
01:11 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:15 -!- tjz_ [~pc@bb121-6-236-4.singnet.com.sg] has joined #openvpn
01:15 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
01:25 -!- tjz_ [~pc@bb121-6-236-4.singnet.com.sg] has quit [Ping timeout: 246 seconds]
01:27 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:33 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:37 -!- dazo_afk is now known as dazo
01:51 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
02:09 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
02:10 -!- xxtjaxx_ [~andreas@dl360.ein-elch.de] has quit [Ping timeout: 276 seconds]
02:10 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
02:10 < Bushmills> whether ubuntu compiles ipv6 support into their oipenvpn package is something #ubuntu probalby knows better than #openvpn 
02:10 -!- master_of_master [~master_of@87.181.121.39] has quit [Ping timeout: 260 seconds]
02:11 -!- master_of_master [~master_of@p57B57927.dip.t-dialin.net] has joined #openvpn
02:11 -!- xxtjaxx [~andreas@kde/developer/marschke] has joined #openvpn
02:12 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
02:15 -!- K1ng\ [~KING@180.211.188.159] has quit [Ping timeout: 276 seconds]
02:15 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11268>
02:25 -!- K1ng [~KING@180.211.188.159] has joined #openvpn
02:25 -!- EugeneKay is now known as EugeneKaway
02:35 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
02:36 -!- brianw_ [~brianw@wsip-98-191-212-226.dc.dc.cox.net] has quit [Read error: Connection reset by peer]
02:37 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
02:39 <@vpnHelper> RSS Update - forum: my wish - Push Option <http://forums.openvpn.net/topic7931.html#p11269>
02:40 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
02:43 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
02:47 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
02:57 <@vpnHelper> RSS Update - forum: simple roadwarrior with open-wrt server and Win 7 client <http://forums.openvpn.net/topic7951.html>
02:57 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:13 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:21 <@vpnHelper> RSS Update - forum: OpenVPN loses ipv4 address almost instantly <http://forums.openvpn.net/topic7950.html#p11272> || Browsing problem <http://forums.openvpn.net/topic7949.html#p11271>
03:27 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
03:28 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Remote host closed the connection]
03:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:44 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
03:44 <@vpnHelper> RSS Update - forum: simple roadwarrior with open-wrt server and Win 7 client <http://forums.openvpn.net/topic7951.html#p11273>
03:46 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
04:03 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11274>
04:09 -!- local|host [~fourat@196.203.53.221] has joined #openvpn
04:11 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
04:11 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 246 seconds]
04:17 < local|host> where can i find a doc describing all features of ovpn's management api
04:18 < hyper_ch> openvpn has a management api?
04:20 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
04:20 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
04:22 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
04:24 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:24 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:24 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:27 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Ping timeout: 276 seconds]
04:29 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
04:29 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
04:29 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:29 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
04:31 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
04:31 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
04:33 <@vpnHelper> RSS Update - forum: simple roadwarrior with open-wrt server and Win 7 client <http://forums.openvpn.net/topic7951.html#p11275>
04:40 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
04:40 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
04:43 -!- anAngel [~Angel@83.148.80.195] has joined #openvpn
04:50 < anAngel> Hello, could you tell me in just a few words about TCP vs UDP protocols for the vpn? TCP normally would give more overall latency and packet drop or i am wrong? But on the other side doesnt TCP pass the NATts and some hardware based cheap Routers/ADSLs more easily?
04:50 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Read error: No route to host]
04:50 <@vpnHelper> RSS Update - forum: Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11276>
04:55 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:59 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
05:01 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
05:07 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 248 seconds]
05:08 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
05:15 <@vpnHelper> RSS Update - forum: my wish - Push Option <http://forums.openvpn.net/topic7931.html#p11277>
05:15 <@dazo> !tcp
05:16 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
05:16 <@dazo> anAngel: ^^
05:20 <@dazo> anAngel: basically TCP can work fine if you have no TCP packet loss ... however, if you get packet loss and TCP packets are being re-submitted, it will quickly get messy ... as the same will happen inside the VPN tunnel as well, at the same time
05:39 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Quit: Leaving]
05:46 <@vpnHelper> RSS Update - forum: Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11278>
06:10 < anAngel> dazo: thank you very much i will watch out for packet loss then and i will read the two links now
06:11 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 264 seconds]
06:19 -!- local|host [~fourat@196.203.53.221] has quit [Ping timeout: 260 seconds]
06:21 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:21 -!- mode/#openvpn [+o mattock] by ChanServ
06:31 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
06:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
06:34 -!- iamresearcher [~genlight@amertospromotions.com] has joined #openvpn
06:35 < iamresearcher> just one question guys, is PUSH option for server mode only or also can be done in client config?
06:35 -!- local|host [~fourat@196.203.53.221] has joined #openvpn
06:36 < iamresearcher> just one!
06:41 < iamresearcher> you cant really expect some to help here. 
06:41 -!- iamresearcher [~genlight@amertospromotions.com] has quit []
06:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:47 -!- local|host [~fourat@196.203.53.221] has quit [Ping timeout: 240 seconds]
06:50 < Katoen> impatient much?
07:14 -!- local|host [~fourat@196.203.53.221] has joined #openvpn
07:19 -!- anAngel1 [~Angel@83.148.80.195] has joined #openvpn
07:22 -!- anAngel [~Angel@83.148.80.195] has quit [Ping timeout: 276 seconds]
07:26 < ecrist> naw, not at all
07:26 < ecrist> second time he's done that, drop in, ask a question, bitch 2 minutes later our support is lousy, and leaves
07:26 < ecrist> *shrug*
07:26 < ecrist> I still slept ok last night. ;)
07:28 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:28 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:28 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:33 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
07:33 < norc> Hi, whenever I disconnect from the openvpn server, the server shuts down. Is there a way to prevent that?
07:33 -!- norc__ [~foo@ns203763.ovh.net] has joined #openvpn
07:34 -!- norc__ [~foo@ns203763.ovh.net] has quit [Client Quit]
07:40 < ecrist> !configs
07:40 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
07:43 < norc> http://codepad.org/Hrt8Wwwc  << config and details for both
07:43 <@vpnHelper> Title: Plain Text code - 29 lines - codepad (at codepad.org)
07:44 < norc> And for the server, I'm using the package supplied by the package manage system, with the init.d script.
07:47 < norc> Perhaps noteworthy, my client ip address is dynamic (changes every day)
07:49 <@vpnHelper> RSS Update - forum: DNS issue: can lookup but not use <http://forums.openvpn.net/topic7916.html#p11280> || Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11279>
07:54 <@vpnHelper> RSS Update - forum: Migrating VPN server to new box <http://forums.openvpn.net/topic7952.html>
07:55 -!- anAngel1 [~Angel@83.148.80.195] has left #openvpn []
07:55 < norc> Do I really have to use a cronjob to test whether openvpn is running and (re)start if needed?
07:55 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
07:59 < Bushmills> no
08:00 < Bushmills> check out monit, or  an inittab respawn entry, if you're on unixoids
08:01 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
08:02 < Bushmills> client address may change as it wishes. on interface up hook, reload openvpn (not restart). then it reconnects immediately 
08:02 < Bushmills> tunneled connection will then just continue - it will look like a short period network congestion. 
08:03 < norc> You mean if I get disconnected from the internet, openvpn can handle that transparently?
08:03 < Bushmills> it can, but i prefer to kick it when network reconnect takes place - that way openvpn reconnects quicker
08:04 < norc> heh
08:04 < norc> Well it's certainly neat
08:12 < norc> Bushmills: Anyway, a simple `v1:23:respawn:/etc/init.d/openvpn restart` on server side ought to do the trick
08:12 < norc> right?
08:16 < Bushmills> no
08:17 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 240 seconds]
08:19 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
08:19 -!- KaiForce [~chatzilla@70.228.79.239] has joined #openvpn
08:19 < Bushmills> (15:12:27) norc: right?
08:19 < Bushmills> (15:16:02) Bushmills: no
08:27 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 258 seconds]
08:28 -!- WebDawg [~whoami@officialg0d.com] has quit [Ping timeout: 258 seconds]
08:30 <@vpnHelper> RSS Update - forum: openvpn installation not creating /etc/openvpn on centos 5.5 <http://forums.openvpn.net/topic7946.html#p11282>
08:31 -!- norc___ [~foo@ns203763.ovh.net] has joined #openvpn
08:34 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 240 seconds]
08:35 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
08:35 -!- WebDawg [~whoami@67.223.228.7] has joined #openvpn
08:36 -!- norc___ [~foo@ns203763.ovh.net] has quit [Ping timeout: 252 seconds]
08:36 -!- norc_ [~foo@ns203763.ovh.net] has joined #openvpn
08:45 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
08:48 <@vpnHelper> RSS Update - forum: Real limits for max users is better TUN or TAP <http://forums.openvpn.net/topic7953.html>
09:04 < Bushmills> actually, it should make some difference - though i can't judge how big it is.  64 bit programs are larger than 32 bit programs.  for the same number of instructions, more RAM addresses need to be selected, and read from, which results in an increase of power. 
09:05 < Bushmills> considering that RAM, next to video and hard disk, is one of the power drains in computers, the effect may be noticeable
09:05 < Bushmills> (and CPU, of course)
09:05 <@vpnHelper> RSS Update - forum: Real limits for max users is better TUN or TAP <http://forums.openvpn.net/topic7953.html#p11285>
09:06 < Bushmills> hm. entirely wrong channel ...
09:10 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
09:11 -!- K1ng [~KING@180.211.188.159] has quit [Ping timeout: 248 seconds]
09:11 <@vpnHelper> RSS Update - forum: Real limits for max users is better TUN or TAP <http://forums.openvpn.net/topic7953.html#p11286>
09:29 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 248 seconds]
09:34 <@vpnHelper> RSS Update - forum: Real limits for max users is better TUN or TAP <http://forums.openvpn.net/topic7953.html#p11287>
09:37 -!- K1ng [~KING@180.211.188.54] has joined #openvpn
09:41 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Ping timeout: 276 seconds]
09:41 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
10:00 -!- Yen [Yen@unaffiliated/yen] has quit []
10:01 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
10:03 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:24 -!- otavio [~otavio@debian/developer/otavio] has joined #openvpn
10:24 < otavio> Hello
10:25 < otavio> I am having trouble to use a VPN; when I connect to it I can access the remote machines but it breaks my local network setup denying any non-VPN connection
10:25 < otavio> I am using multi-client one server approuch
10:26 < krzee> "but it breaks my local network setup denying any non-VPN connection"
10:26 < krzee> what do you mean by that
10:27 < krzee> and are you using redirect-gateway
10:27 < krzee> are you using lans behind openvpn?
10:27 < Bushmills> are openvpn virtual interfaces in the same subnet as your physical NICs?
10:28 < krzee> great minds think alike =]
10:28 < otavio> they're in different subnets
10:28 < Bushmills> what causes those "breaks my local network setup"?
10:29 < Bushmills> right to the core of the problem :D
10:29 < krzee> i still dont even know what he means by "breaks my local setup"
10:29 < krzee> it could be that his server is using --redirect-gateway and now the client doesnt respond to requests on its public ip, which would make sense
10:30 < krzee> (and can be fixed, if thats in fact the problem)
10:30 < otavio> krzee: we are not using --redirect-gateway
10:30 < krzee> ok im done guessing your setup
10:30 < krzee> !configs
10:30 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
10:30 < Bushmills> does it make a noise when it breaks?
10:31 < krzee> also include the LAN ips
10:31 < krzee> Bushmills, sort of like a "woosh" sound
10:32 < otavio> http://paste.debian.net/114013/
10:32 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Remote host closed the connection]
10:33 < otavio> krzee: I am using network manager to connect to the VPN
10:33 < krzee> !ubuntu
10:33 <@vpnHelper> "ubuntu" is dont use network manager!
10:33 < krzee> !netman
10:33 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from an openvpn expert on the mail list
10:33 < Bushmills> why is 192,168... route pushed?
10:34 < otavio> I tryed it but didn't change
10:34 < otavio> removed now
10:34 < krzee> !change netman 1 s/an openvpn expert/the author of the openvpn 2 cookbook/
10:34 <@vpnHelper> Joo got it.
10:34 < krzee> !netman
10:34 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
10:35 < krzee> otavio, what is 192.168.0/24?
10:35 < krzee> and what is your goal?
10:35 < krzee> AND
10:35 < otavio> krzee: well; I agree that it has missing stuff but I would love to have it working properly and it seems I am probably doing a mistake somewhere
10:35 < krzee> you didnt pastebin ccd entries or the client config
10:35 < otavio> krzee: the client config is on nm
10:36 < krzee> "working properly" very much depends on your goal
10:36 < otavio> ccd is not used
10:36 < otavio> basically
10:36 < krzee> otavio, great, then remove ccd and go make a client config and stop using netman
10:36 < otavio> access content on vpn and on my local network 
10:36 < krzee> when you are finished using openvpn correctly, then you can import your config to network manager
10:37 < krzee> otavio, where is the content, where is the local network
10:37 < krzee> that was a terrible description of the goal, lol
10:37 < Bushmills> when it "breaks" your local lan - does that mean you can't access local hosts by name anymore, or does the problem, whatever it is, also show when you use ip addresses?
10:38 < krzee> are you just trying to say "i would like my vpn clients to access the lan behind my openvpn server" ?
10:39  * Bushmills gets bored waiting for answers and strolls off
10:39 < otavio> Bushmills: even ip doesn't work
10:41 < otavio> http://paste.debian.net/114018/
10:41 < krzee> as boring as it is to wait for details, im at work so im bored enough
10:41 < otavio> routes before and after connecting to vpn
10:41 < krzee> out of all the things i/bush asked for, that was not on the list
10:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:42 < otavio> krzee: right but I think it makes more or less easier to spot it
10:42 < otavio> krzee: it ought to be routing, no?
10:42 < krzee> heh
10:42 < krzee> go make a real openvpn config for your client
10:42 < krzee> stop playing around
10:42 < krzee> THEN start answering the questions you have been asked
10:43 < krzee> instead of providing details you werent asked for
10:43 < otavio> any place to me to get a basic config to test?
10:43 < krzee> well it will need to match your server config
10:43 < krzee> !sample
10:43 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
10:43 < krzee> but theres mine
10:50 < otavio> http://paste.debian.net/114020/
10:50 < otavio> seems fine?
10:51  * otavio went to have lunch. brb
10:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:04 -!- EugeneKaway is now known as EugeneKay
11:05 < krzee> otavio, client config looks fine, did you try it and check you get the same problem?
11:20 < hyper_ch> so, I loaded my adam with alternative firmware... runs quite nicely
11:22 < gladiatr> coleco?
11:23 < gladiatr> how did you get a new firmware onto the cassette?
11:35 < hyper_ch> gladiatr: you mean me?
11:37 < gladiatr> hehe
11:38 < hyper_ch> changing rom on the adam is so simple
11:38 < hyper_ch> even I managed to do so
11:39 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:41 < gladiatr> heh.  I never had one.  I drooled over a friend's adam when I was 12, but that was before the tape system threw a bearing and started smoking 
11:41 < gladiatr> <- c64 whore
11:41 < hyper_ch> I think we don't talk about the same thing ;)
11:41 < hyper_ch> http://www.notionink.com/
11:41 <@vpnHelper> Title: Notion Ink: Home (at www.notionink.com)
11:44 < gladiatr> oh.  Yes.  Indeed we are.  http://oldcomputers.net/adam.html
11:44 <@vpnHelper> Title: Coleco Adam computer (at oldcomputers.net)
11:44 < gladiatr> hehe
11:51 -!- zombiehoffa1 [~zombiehof@S0106bcaec5b52484.cg.shawcable.net] has joined #openvpn
11:58 < otavio> krzee: it connects but vpn does not work
11:58 < otavio> krzee: local works
11:59 < krzee> *what* doesnt work?
11:59 < krzee> "doesnt work" really tells me nothing
12:00 < krzee> it never connects?
12:00 < krzee> it explodes and kills kenny?
12:01 < otavio> I can't connect to a VPN dest
12:04 < krzee> oh ok, not even connecting
12:04 < krzee> !logs
12:04 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
12:04 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 248 seconds]
12:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
12:10 < otavio> http://paste.debian.net/114025/
12:11 < krzee> and the other side...
12:12 -!- assid [~assid@unaffiliated/assid] has joined #openvpn
12:12 < assid> hey
12:13 < assid> can someone help me set up a windows server with openvpn server
12:13 < assid> which is in a lan.. 
12:14 < otavio> krzee: wants the full log too?
12:15 < gladiatr> !howto
12:15 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:16 < gladiatr> assid, ^
12:16 < krzee> from start til connection failed
12:16 < assid> gladiatr: i tried setting it up.. just face issues :(
12:16 < gladiatr> !welcome
12:16 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:16 < otavio> krzee: it connects; it doesn't fail
12:16 < gladiatr> !goal
12:16 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:16 < krzee> [10:01]  <otavio> I can't connect to a VPN dest
12:16 < krzee> [10:03]  <krzee> oh ok, not even connecting
12:17 < krzee> otavio, if you dont clearly say whats going on, i cant help you
12:17 < otavio> krzee: vpn connects but i can't connect a host on the vpn
12:18 < krzee> what host
12:18 < krzee> a machine on a lan behind the server?
12:18 < otavio> yes
12:18 < krzee> (you never mentioned wanting a lan behind the server, nor does your config have ANYTHING making it look like you wanted it)
12:19 < krzee> you did have this:
12:19 < krzee> push "route 192.168.0.0 255.255.255.0"
12:20 < krzee> [08:33]  <Bushmills> why is 192,168... route pushed?   [08:34]  <otavio> I tryed it but didn't change   [08:34]  <otavio> removed now
12:20 < krzee> !serverlan
12:20 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
12:20 < krzee> !route
12:20 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:20 < krzee> and you CAN NOT have a lan client on the same subnet
12:20 < krzee> so you should probably change the server subnet before proceeding
12:20 < krzee> since its the most common rfc 1918 subnet in the world
12:21 < krzee> [10:20]  <krzee> and you CAN NOT have a lan client on the same subnet    <-- i mean you can not have a vpn client who is on the same lan subnet
12:21 < krzee> so if a client is on 192.168.0.* it can not connect to your vpn
12:21 < krzee> (after you correctly set it up)
12:27 -!- TACPILOT [~tacpilot@c-98-200-60-80.hsd1.tx.comcast.net] has joined #openvpn
12:27 < TACPILOT> hello
12:31 < TACPILOT> I have recently setup a couple new clients and they both get addresses from the server. there is no firewall installed on either of them yet they cant ping the server with vpn address. running wireshark on server proves they never talk with server on vpn address
12:32 < TACPILOT> route looks correct but its acting like its not 
12:33 < TACPILOT> one of the clients had been working for the last month 
12:33 < krzee> can the server ping a client?
12:33 < krzee> are both clients using the same certificate or different ones?
12:33 < TACPILOT> worked on the system including new certs and now no joy
12:33 < TACPILOT> diff certs
12:34 < krzee> only connect 1 client
12:34 < TACPILOT> I ever tried temporaraluy borrowing certs from a good running client
12:34 < krzee> then can either side ping the other?
12:34 < TACPILOT> no side see the other
12:34 < TACPILOT> with just the 2 clients
12:34 < krzee> [10:34]  <krzee> only connect 1 client
12:34 < krzee> [10:34]  <krzee> then can either side ping the other?
12:34 < krzee> [10:34]  <TACPILOT> no side see the other
12:35 < krzee> there should only be 2 sides total, client and server
12:35 < krzee> *1* client
12:35 < krzee> for testing
12:35 < krzee> we'll work our way up
12:36 < TACPILOT> 2 server configs 2 nets multiple clients on both nets all running well
12:36 < TACPILOT> just these 2 with issues
12:37 < TACPILOT> will take one out of equation
12:37 < krzee> thanks
12:37 < krzee> and then if the 1 doesnt work, i will want client log with verb5 and server log of the client connecting
12:38 < TACPILOT> k will take a few mins.. will return with logs
12:38 -!- local|host [~fourat@196.203.53.221] has quit [Ping timeout: 240 seconds]
12:39 -!- assid [~assid@unaffiliated/assid] has left #openvpn []
12:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:41 -!- luneff [~yury@84.51.192.6] has joined #openvpn
12:50 < otavio> krzee: OK
12:50 < otavio> krzee: got it working with the client. 
12:57 < otavio> krzee: the only missing part is to have DNS properly working
12:58 < otavio> when I connect to the VPN it looks up for DNS there (nice) but breaks my local network dns
13:02 < krzee> well ya
13:02 < krzee> you can use dns on the lan or on the vpn
13:02 < krzee> !splitdns
13:02 <@vpnHelper> "splitdns" is see http://www.thekelleys.org.uk/dnsmasq/doc.html for dnsmasq, which will let you do split-dns setups
13:02 < krzee> or that
13:11 -!- mant1s [mant1s@rgupta-laptop.umemat.maine.edu] has joined #openvpn
13:11 -!- mant1s [mant1s@rgupta-laptop.umemat.maine.edu] has quit [Changing host]
13:11 -!- mant1s [mant1s@unaffiliated/mant1s] has joined #openvpn
13:11 -!- mant1s [mant1s@unaffiliated/mant1s] has quit [Read error: Connection reset by peer]
13:11 -!- otavio [~otavio@debian/developer/otavio] has left #openvpn []
13:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:20 < TACPILOT> will log file directive work for client config's ??
13:21 < krzee> yes, clients can log too
13:21 < TACPILOT> k
13:22 -!- mant1s [~mant1s@unaffiliated/mant1s] has joined #openvpn
13:37 < TACPILOT> logs are prepared .. I can make available for download as a tar if u like ???
13:38 < krzee> pastebin
13:38 < TACPILOT> k
13:43 < TACPILOT> http://pastebin.com/ZC2hQ56r
13:43 -!- mant1s [~mant1s@unaffiliated/mant1s] has quit [Quit: Leaving]
13:44 < krzee> pj_06 the client with the problem?
13:45 < TACPILOT> yes
13:46 < krzee> Thu Apr 14 13:28:38 2011 us=595269 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
13:46 < krzee> theres the problem
13:46 < krzee> add comp-lzo to your client config
13:46 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
13:46 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has quit [Changing host]
13:46 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
13:46 -!- mode/#openvpn [+o raidz] by ChanServ
13:46 < TACPILOT> that has been off and was working on client for a month
13:47 < TACPILOT> no comp-lzo available on client at this time
13:48 < krzee> well dude
13:48 < krzee> they must match
13:48 < krzee> turn it off everywhere, turn it on everywhere, makes no difference to me
13:49 < TACPILOT> I can .. but not understanding why has been working with such all this time ??
13:50 < krzee> dunno
13:54 < TACPILOT> I kept looken at that this whole time and have been in denial because it was working before
13:54 < TACPILOT> its all good now
13:54 < TACPILOT> TYTY for your time krzee
13:55 < TACPILOT> u a life saver
13:55 < krzee> yw
13:56 < TACPILOT> its people like you that keep the world spinning
13:56 < TACPILOT> have a wonderful day  :D
13:56 < krzee> bored people at work?
13:56 < krzee> ;]
13:56 < TACPILOT> :D
13:57 -!- TACPILOT [~tacpilot@c-98-200-60-80.hsd1.tx.comcast.net] has left #openvpn []
13:59 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
13:59 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
14:00 < zombiehoffa1> so I'm getting this weird behaviour where when I ping an internal named computer from externally over openvpn it resolves to the vpn server external ip.
14:00 < zombiehoffa1> any pointers on how to fix this behaviour?
14:01 < krzee> resolves?
14:01 < krzee> sounds like a dns issue
14:01 < zombiehoffa1> I agree. any pointers on how to fix it?
14:01 < krzee> well you could use split dns
14:02 < krzee> !splitdns
14:02 <@vpnHelper> "splitdns" is see http://www.thekelleys.org.uk/dnsmasq/doc.html for dnsmasq, which will let you do split-dns setups
14:02 < zombiehoffa1> if I go ping "computer name" inside the lan it resolves to an internal ip, if I go ping "computer name" over openvpn it resolves to name of computername.domain and that resolves to the external ip.
14:04 < krzee> did you push dhcp option DOMAIN?
14:04 < krzee> oh wait, are you bridging...
14:06 < zombiehoffa1> no, routed.
14:06 < zombiehoffa1> pushed domain option.
14:06 < krzee> try *not* pushing domain
14:06 < krzee> since you say the problem is that it appends domain
14:07 < krzee> and @ routed, good =]
14:07 < zombiehoffa1> well, it was auto set up that way... It's a clearos box. Their irc channel just sucks.
14:07 < zombiehoffa1> I will dig into a bit more exactly what pushing domain does
14:10 < krzee> why dont you comment it, and try again
14:45 -!- Guifort [~Administr@78.112.90.5] has joined #openvpn
14:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:10 < zombiehoffa1> krzee, I just commented it out and tried again. Same behaviour
15:18 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
15:42 <@vpnHelper> RSS Update - forum: Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11288>
15:54 -!- local|host [~fourat@197.0.167.199] has joined #openvpn
15:58 -!- Guifort [~Administr@78.112.90.5] has quit [Quit: Quitte]
16:07 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
16:09 -!- KaiForce [~chatzilla@70.228.79.239] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
16:10 -!- dazo is now known as dazo_afk
16:21 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:25 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
16:29 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
16:31 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
16:34 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
16:42 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:44 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 258 seconds]
17:11 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
17:11 -!- mode/#openvpn [+o vpnHelper] by ChanServ
17:11 < ecrist> ping krzee 
17:12 < ecrist> just upgraded my rack power circuts from 15A to 20A and added some battery backup for switch and inet
17:12 < ecrist> servers are still SOL if I have a power outage, but at least my laptop will stay connected to the internet now. ;)
17:16 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Ping timeout: 248 seconds]
17:16 -!- caesay [~caesay@socialshock.net] has joined #openvpn
17:16 -!- LowKey [rhel@unaffiliated/lowkey] has quit [Ping timeout: 276 seconds]
17:17 -!- caesay is now known as Guest17238
17:19 -!- LowKey [rhel@a.legend.at.his.bestforever.com] has joined #openvpn
17:19 -!- LowKey [rhel@a.legend.at.his.bestforever.com] has quit [Changing host]
17:19 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
17:23 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:27 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 276 seconds]
17:36 -!- nb_ [~nb@fedora/nb] has quit [Ping timeout: 248 seconds]
17:38 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has left #openvpn []
17:40 -!- nb_ [~nb@fedora/nb] has joined #openvpn
17:59 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 246 seconds]
18:00 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Quit: leaving]
18:02 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
18:04 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
18:37 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has joined #openvpn
19:15 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:59 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
20:00 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
20:08 -!- K1ng\ [~KING@180.211.188.54] has joined #openvpn
20:09 -!- jrkotrla [~jrkotrla@96.44.188.46] has quit [Ping timeout: 250 seconds]
20:09 -!- K1ng [~KING@180.211.188.54] has quit [Ping timeout: 260 seconds]
20:09 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
20:11 -!- Guest17238 is now known as caesay
20:11 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
20:11 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
20:14 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has quit [Ping timeout: 258 seconds]
20:17 -!- jrkotrla [~jrkotrla@96.44.188.46] has joined #openvpn
20:18 -!- K1ng\ [~KING@180.211.188.54] has quit [Read error: Connection reset by peer]
20:19 -!- K1ng\ [~KING@180.211.188.54] has joined #openvpn
20:55 -!- norc_ [~foo@ns203763.ovh.net] has quit [Ping timeout: 276 seconds]
21:01 -!- UdontKnow is now known as E
21:02 -!- E [~evaldo@freenode/staff-emeritus/udontknow] has quit [Quit: brb]
21:06 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
21:07 -!- norc [~root@ns203763.ovh.net] has joined #openvpn
21:09 -!- jrkotrla [~jrkotrla@96.44.188.46] has quit [Ping timeout: 240 seconds]
21:09 < norc> Hi, I have one last problem with OpenVPN. For some reason my client does not get a route for the gateway. Here are my config files: http://pastie.org/1796037
21:31 -!- norc [~root@ns203763.ovh.net] has quit [Quit: Lost terminal]
22:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:11 -!- master_of_master [~master_of@p57B57927.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:14 -!- master_of_master [~master_of@p57B57E77.dip.t-dialin.net] has joined #openvpn
22:27 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:41 <@vpnHelper> RSS Update - forum: Address already in use error when starting openvpn server <http://forums.openvpn.net/topic7934.html#p11291> || my wish - Push Option <http://forums.openvpn.net/topic7931.html#p11290> || openvpn single LAN <http://forums.openvpn.net/topic7954.html>
22:44 -!- EugeneKay is now known as EugeneKaway
22:46 -!- EugeneKaway is now known as EugeneKay
23:38 -!- orudie [~Paul@ool-18be3d82.dyn.optonline.net] has quit [Read error: Connection reset by peer]
23:53 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
--- Day changed Fri Apr 15 2011
00:11 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
00:15 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
00:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:38 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
00:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
00:45 -!- EugeneKay is now known as GayCarrot
00:47 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has joined #openvpn
00:48 -!- fourat_ [~fourat@197.1.27.1] has joined #openvpn
00:51 -!- local|host [~fourat@197.0.167.199] has quit [Ping timeout: 246 seconds]
00:59 -!- GayCarrot is now known as StraightCucumber
01:02 -!- K1ng\ [~KING@180.211.188.54] has quit [Ping timeout: 252 seconds]
01:06 -!- freshman [~genlight@119.93.51.34] has joined #openvpn
01:08 < freshman> What is the difference between bind and nobind. Previously I can connect using nobind, but now I can connect only with bind option.
01:14 -!- StraightCucumber is now known as EugeneKay
01:22 -!- freshman [~genlight@119.93.51.34] has quit []
01:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
01:40 -!- K1ng [~KING@180.211.188.54] has joined #openvpn
01:42 <@vpnHelper> RSS Update - forum: Browsing problem <http://forums.openvpn.net/topic7949.html#p11292>
01:46 -!- dazo_afk is now known as dazo
01:50 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
01:51 -!- K1ng [~KING@180.211.188.54] has quit [Ping timeout: 250 seconds]
01:58 -!- K1ng [~KING@180.211.188.54] has joined #openvpn
02:16 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Quit: Leaving]
02:25 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
02:27 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
02:27 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
02:27 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
02:34 < Splex> what should the permissions be for the dir /etc/openvpn/keys and the cert files within?
02:48 -!- Sky[x] [~SkyB0x@mail.uprava.nevtron.si] has joined #openvpn
02:55 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: ph1l]
03:00 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
03:15 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has quit [Read error: Operation timed out]
03:16 -!- Varazir [mircwars@c-94-255-130-33.cust.bredband2.com] has joined #openvpn
03:24 <@vpnHelper> RSS Update - forum: Address already in use error when starting openvpn server <http://forums.openvpn.net/topic7934.html#p11294> || Browsing problem <http://forums.openvpn.net/topic7949.html#p11293>
03:36 <@vpnHelper> RSS Update - forum: openvpn single LAN <http://forums.openvpn.net/topic7954.html#p11296> || Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11295>
03:37 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:42 <@vpnHelper> RSS Update - forum: Migrating VPN server to new box <http://forums.openvpn.net/topic7952.html#p11297>
04:00 <@vpnHelper> RSS Update - forum: simple roadwarrior with open-wrt server and Win 7 client <http://forums.openvpn.net/topic7951.html#p11298>
04:00 -!- EugeneKay is now known as EugeneKaway
04:05 -!- fourat_ [~fourat@197.1.27.1] has quit [Ping timeout: 240 seconds]
04:06 -!- ph1l [~ph1l@gprs51.swisscom-mobile.ch] has joined #openvpn
04:06 <@vpnHelper> RSS Update - forum: Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11299>
04:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
04:25 -!- ph1l [~ph1l@gprs51.swisscom-mobile.ch] has quit [Ping timeout: 240 seconds]
04:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:34 -!- ph1l [~ph1l@gprs61.swisscom-mobile.ch] has joined #openvpn
04:34 <@vpnHelper> RSS Update - forum: openvpn & apache issue <http://forums.openvpn.net/topic7955.html>
04:40 <@vpnHelper> RSS Update - forum: openvpn & apache issue <http://forums.openvpn.net/topic7955.html#p11301>
04:44 -!- RichiH [~richih@freenode/staff/richih] has left #openvpn []
04:50 -!- ph1l [~ph1l@gprs61.swisscom-mobile.ch] has quit [Ping timeout: 240 seconds]
04:52 <@vpnHelper> RSS Update - forum: VPN connectino droping on a specific server. <http://forums.openvpn.net/topic7956.html>
04:59 -!- ph1l [~ph1l@gprs07.swisscom-mobile.ch] has joined #openvpn
05:00 -!- ph1l [~ph1l@gprs07.swisscom-mobile.ch] has quit [Client Quit]
05:03 -!- fourat_ [~fourat@196.203.53.221] has joined #openvpn
05:03 <@vpnHelper> RSS Update - forum: VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html>
05:04 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:04 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:11 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has joined #openvpn
05:28 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Read error: Operation timed out]
05:28 <@vpnHelper> RSS Update - forum: Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11303>
05:28 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
05:36 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
05:36 -!- nb_ is now known as nb
05:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
06:07 <@mattock> !winroute
06:07 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
06:07 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
06:33 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has quit [Read error: Connection reset by peer]
06:33 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has joined #openvpn
06:34 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has quit [Read error: Connection reset by peer]
06:34 <@vpnHelper> RSS Update - forum: simple roadwarrior with open-wrt server and Win 7 client <http://forums.openvpn.net/topic7951.html#p11304>
06:34 -!- ph1l_ [~ph1l@84-73-243-204.dclient.hispeed.ch] has joined #openvpn
06:40 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
06:40 < Sk00rche-> !welcome
06:40 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:01 -!- robotti^ [robotti@kapsi.fi] has quit [Ping timeout: 276 seconds]
07:26 -!- zombiehoffa1 [~zombiehof@S0106bcaec5b52484.cg.shawcable.net] has quit [Quit: Leaving]
07:32 -!- Sky[x] [~SkyB0x@mail.uprava.nevtron.si] has quit [Ping timeout: 276 seconds]
07:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:38 -!- echoSMIL1 [~censured@bl17-97-80.dsl.telepac.pt] has joined #openvpn
07:38 <@vpnHelper> RSS Update - forum: client config <http://forums.openvpn.net/topic7957.html>
07:40 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 240 seconds]
07:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
07:50 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
07:51 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
07:51 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
08:12 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 258 seconds]
08:13 -!- Sk00rchen [~Sk00rchen@83.251.230.74] has joined #openvpn
08:20 -!- Sk00rchen [~Sk00rchen@83.251.230.74] has quit [Ping timeout: 246 seconds]
08:20 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has joined #openvpn
08:20 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
08:22 < amir> !/30
08:22 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
08:24  * amir hums the PtP tune and starts smithing new config files for tun PtP tunnels
08:27 <@vpnHelper> RSS Update - forum: Access 2 vlans from different outside internet connections <http://forums.openvpn.net/topic7942.html#p11308> || client config <http://forums.openvpn.net/topic7957.html#p11307> || simple roadwarrior with open-wrt server and Win 7 client <http://forums.openvpn.net/topic7951.html#p11306>
08:33 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
08:34 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
08:45 -!- Dennis84 [~dennis@mail.it-moebius.de] has left #openvpn []
08:45 -!- K1ng [~KING@180.211.188.54] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
08:54 -!- K1ng [~KING@180.211.188.54] has joined #openvpn
09:01 < amir> krzee, if i use tun mode with ptp, then openvpn uses host routes (eg. /32) and i can use following ip pairs .1/.2, .3/.4 ... ? checking the tunX devices popping up they seem to have /32 addresses
09:02 < amir> krzee, do i need to use a /30 scheme? (afaik i should have to, but the interfaces look as if i don't need to
09:02 <@vpnHelper> RSS Update - forum: openvpn & apache issue <http://forums.openvpn.net/topic7955.html#p11309>
09:02 < amir> )
09:05 < amir> i've read in the manual that net30 is the default topology, so i'm a bit astonished to see no /30 anywhere ;)
09:07 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
09:08 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
09:13 <@vpnHelper> RSS Update - forum: VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html#p11311> || openvpn & apache issue <http://forums.openvpn.net/topic7955.html#p11310>
09:19 <@vpnHelper> RSS Update - forum: openvpn & apache issue <http://forums.openvpn.net/topic7955.html#p11312>
09:20 < bigon> hi
09:21 < bigon> is mssfix on by default on 2.0
09:21 < bigon> ?
09:22 <@dazo> bigon: most likely not
09:26 < bigon> I think I've read somebody saying that on some openvpn ml (and that sound wierd)
09:26 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:27 < dkr> what's with programmers sending me tiny snippets of the openvpn log that show a successful connection when they claim to have an issue? ;)
09:28 < dkr> actually this latest snippet only had the lines where it adds the routes
09:37 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
09:38 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:50 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Read error: Operation timed out]
09:51 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
10:01 <@dazo> bigon: ahh, true ... default seems to be 1450, by quickly checking the code
10:01 <@dazo> btw, Jan Just is not just somebody ... he's quite a guru
10:03 <@dazo> https://www.packtpub.com/openvpn-2-cookbook/book  ... written by JJK
10:03 <@vpnHelper> Title: OpenVPN 2 Cookbook Book & eBook | Packt Publishing Technical & IT Book and eBook Store (at www.packtpub.com)
10:13 -!- K1ng [~KING@180.211.188.54] has quit [Ping timeout: 240 seconds]
10:37 <@vpnHelper> RSS Update - forum: There is some example of configuration of passtos? <http://forums.openvpn.net/topic7958.html>
10:42 < MarKsaitis> guys, do I need to do build-dh after creation of every new user or after I did them all?
11:06 -!- K1ng [~KING@180.211.188.54] has joined #openvpn
11:13 <@vpnHelper> RSS Update - forum: client config <http://forums.openvpn.net/topic7957.html#p11314>
11:30 -!- Blues-Man [~bluesman@host39-113-dynamic.56-79-r.retail.telecomitalia.it] has joined #openvpn
11:31 -!- fourat_ [~fourat@196.203.53.221] has quit [Ping timeout: 260 seconds]
11:33 < ecrist> MarKsaitis: no
11:33 < ecrist> dh is only once, and it's only used for the server
11:33 < ecrist> !dh
11:33 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
11:36 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 260 seconds]
11:57 -!- zumbi [~zumbi@77.230.237.25] has joined #openvpn
11:57 < zumbi> !welcome
11:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:58 < zumbi> !goal
11:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:58 < zumbi> !howto
11:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:05 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:05 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
12:16 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Quit: Leaving]
12:20 < zumbi> Hi! I would like to access the lan behind the server. I am using tls-home.conf and tls-office.conf based examples, but it does not seem to work here
12:20 < zumbi> on server side I get:
12:20 < zumbi> Fri Apr 15 18:16:49 2011 UDPv4 link local (bound): [undef]:5007
12:20 < zumbi> Fri Apr 15 18:16:49 2011 UDPv4 link remote: [undef]
12:20 < zumbi> on client side:
12:20 < krzie> yoh
12:20 < zumbi> Fri Apr 15 19:20:02 2011 UDPv4 link local (bound): [undef]
12:20 < zumbi> Fri Apr 15 19:20:02 2011 UDPv4 link remote: [AF_INET]
12:20 < krzie> wtf is tls-home.conf and tls-office.conf
12:21 < krzie> and why are you pasting that useless piece of log to the channel? :-p
12:21 -!- EugeneKaway is now known as EugeneKay
12:22 < zumbi> tls-*.conf are example files provided with openvpn
12:22 < zumbi> I paste those lines, because that is my failing log
12:22 < zumbi> well, not sure if it is becase of it.
12:23 < krzie> provided with openvpn?
12:23 < krzie> really? where?
12:23 < krzie> lemme look
12:23 < krzie> !downloads
12:23  * krzie kicks vpnHelper 
12:24 < krzie> grr
12:24 < zumbi> krzie: in my distribution under /usr/share/doc/openvpn/examples
12:24 < krzie> oh ok, well im not familiar with your distro's sample files
12:24 < zumbi> do you want me to paste them?
12:24 < krzie> 1sec
12:24 < krzie> lemme fix the bot
12:25 < krzie> sure, pastebin please, with comments stripped
12:25 < zumbi> I tested many configs and none worked out :/
12:26 < krzie> ohh
12:26 < krzie> !ping
12:26 <@vpnHelper> pong
12:26 < krzie> !download
12:26 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
12:26 < krzie> heh
12:26 < krzie> ok so
12:26 < krzie> !configs
12:26 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
12:26 < krzie> !route
12:26 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:28 < zumbi> server config: http://pastebin.com/Fs9vfXx7
12:30 < zumbi> client config: http://pastebin.com/CpEGSErQ
12:30 < zumbi> openvpn on server: 2.1~rc11; openvpn on client: 2.1.3
12:31 < zumbi> I know others can connect, but not me :/
12:33 < zumbi> my home net is 192.168.1.0/24 and office net is 192.168.10.0/24
12:35 < zumbi> krzie: do you have any idea or suggestion I could try to connect to the lan behind the server?
12:36 < krzie> first of all
12:36 < krzie> go update
12:36 < krzie> server
12:36 < krzie> !serverlan
12:36 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
12:37 < krzie> do not use verb 9
12:37 < zumbi> ipforwarding is set
12:37 < krzie> verb 5 will be more helpful
12:37 < krzie> you are aware that 15.3.0.0/24 is NOT a rfc 1918 subnet, right?
12:38 < krzie> in your client
12:38 < krzie> remove lines 7 and 8
12:39 < zumbi> done
12:39 < amir> krzee, when i use ptp mode without a topology statement, do i need to use /30 addressing for the ptp links, or can i use all addresses? i wonder, since i only see /32 addresses on the tun interfaces
12:39 < zumbi> I added those line
12:39 < krzie> ptp mode CANT have a topology statement
12:39 < krzie> and there are NO subnets
12:39 < krzie> including /30
12:39 < amir> ic
12:40 < krzie> its a simple point to point link
12:40 < amir> so i can use .1/.2 for the first link, .3/.4 for the second and so on
12:40 < krzie> aka peer to peer link,
12:40 < krzie> sure
12:40 < amir> aka host route 
12:40 < krzie> aka its in the manual under "EXAMPLES"
12:40 < krzie> ;]
12:40 < krzie> you are just using ifconfig on each side
12:40 < amir> aka i have it working here, but i left .3 .4 free to make sure it works
12:41 < amir> i wondered if i can use them
12:41 < amir> ic
12:41 < krzie> like ifconfig 10.8.0.1 10.8.0.2 and the other side is ifconfig 10.8.0.2 10.8.0.1
12:41 < amir> ok, that's what i thought, thanks
12:41 < krzie> yw
12:41 < krzie> go look at the examples in the manual too
12:41 < krzie> it starts with VERY simple, and adds things 1 at a time
12:41 < amir> krzee, will solve the stuff discussed yesterday with 3 ptp links + 1 client/server openvpn
12:42 < krzie> when you look at them:
12:42 < krzie> !--
12:42 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
12:42 < amir> krzee, i read them several times ;)
12:42 < krzie> remember that ^
12:42 < zumbi> krzie: using 15.3.0.0/24 might be a problem?
12:42 < krzie> zumbi,
12:42 < krzie> !1918
12:42 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
12:42 < amir> krzee, i even think i could write them down from memory tbt ;)
12:42 < krzie> =]
12:43 -!- zgr [~null@109.107.162.7] has joined #openvpn
12:43 < amir> btw: docu feedback: for a beginner, digging fast into openvpn, it can be overlooked that there are two specific modes to run it, and that the command set it partitioned in reality, depending on mode
12:44 < amir> s/it/is
12:44 < zgr> hello windows is not accepting my windows config
12:44 < zgr> tls-auth "C:\\Program Files\\OpenVPN\vpnet\\client_keys\\ta.key" 1
12:44 < amir> eventually you would like to add a FAQ on that ;)
12:44 < zgr> it says wrong backslash usage on that line. What's wrong with it?
12:44 < zumbi> krzie: everybody was waiting for you.. :)
12:44 < amir> hrhr ;)
12:45 < amir> now, i'm happy - i think i will leave you to your work/fun ;)
12:45 < zgr> omg I'm blind
12:45 < amir> nice thingy, this openvpn
12:45  * amir likes it more and more
12:46 < zumbi> Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: conf (2.1.3)
12:46 < zumbi> on my client side
12:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Read error: Connection reset by peer]
12:47 < zumbi> amir: I have been trying all day to see if i can get it running, but no luck
12:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:47 < krzie> !winpath
12:47 <@vpnHelper> "winpath" is (#1) Remember on Windows to quote pathnames and use double backslashes, e.g.: "C:\\Program Files\\OpenVPN\\config\\foo.key", or (#2) also, you can use forward slashes to avoid needing double backslashes, but you still need quotes, e.g.: C:/Program Files/OpenVPN/config/foo.key (but surrounded by quotes)
12:47 < amir> zumbi, that's probably a "wrong operating system error" when i see the number of \ you're using ;)
12:47 < krzie> OpenVPN\vpnet\\
12:48 < krzie> but you can just use / and dont need to use doubles
12:48 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:48 < zumbi> oh! no, it was I was passing --conf instead of --config
12:48 < zumbi> I'll try with an IP range with in 10.0.0.0
12:49 < krzie> use something uncommon
12:49 < krzie> like 10.8.0.0/24 or something
12:50 < zumbi> yes, i am using 10.3.3.0/24 now
12:51 < zumbi> but that config file does not bring up tun interface
12:51 < zumbi> on client side
12:52 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:52 < krzie> re-post the config
12:52 < krzie> as it is now
12:54 < zumbi> http://pastebin.com/82NSQRQz
12:57 < amir> ahhh
12:57 < amir> i like ptp links
12:57 < zumbi> what?
12:57 < amir> that's how the world should be ;)
12:57  * amir chuckles
12:59 < krzie> zumbi, ok, and the log of the client trying to connect?
13:03  * Blues-Man good blues bye
13:03 -!- Blues-Man [~bluesman@host39-113-dynamic.56-79-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
13:04 < krzie> zumbi, you gotta pastebin the client log soon, im about to leave
13:05 < zumbi> krzie: http://pastebin.com/kq1BBraF
13:07 < zumbi> krzie: should work now, it was asking me for spam detection code
13:08 < krzie> you didnt think to give the rest of the log?
13:08 < krzie> you showed the very start of attempting to connect
13:09 < krzie> im leaving now, but from the little you did put in that pastebin ill say its your firewall
13:09 < krzie> the very last line is WWWWW
13:09 < krzie> this means its writing, but getting nothing back
13:09 < zumbi> krzie: that is all i see
13:09 < krzie> so either is cant reach the server at all, or the server cant reach it
13:10 < zumbi> I have no firewall..
13:10 < krzie> server log will tell you if it can reach the server
13:10 < zumbi> how can you ping UCP ports?
13:10 < zumbi> *UDP
13:10 < krzie> you cant
13:10 < krzie> but netcat can read/write to them
13:10 < zumbi> last line on server log...Fri Apr 15 19:02:07 2011 us=343529 Initialization Sequence Completed
13:10 < krzie> it doesnt see the client connecting?
13:11 < zumbi> probably not
13:11 < zumbi> that was last line
13:11 < krzie> it would be in the log
13:11 < krzie> then either the client has the wrong IP, or the server is behind a nat or firewall and not configured correctly
13:11 < krzie> its a general networking error
13:11 < krzie> like if you couldnt reach your webserver
13:11 < krzie> nothing vpn related
13:11 < krzie> bbl
13:11 < zumbi> bye
13:11 < zumbi> and thanks
13:12 < krzie> you're welcome
13:12 < zumbi> I'll kepp trying
13:12 < krzie> time for me to shower and go play some dominoes / drink beer
13:14 -!- zgr [~null@109.107.162.7] has quit [Ping timeout: 240 seconds]
13:32 -!- zgr [~null@109.107.162.7] has joined #openvpn
13:33 -!- ph1l_ [~ph1l@84-73-243-204.dclient.hispeed.ch] has quit [Quit: ph1l_]
13:33 -!- zgr [~null@109.107.162.7] has left #openvpn []
13:49 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
13:49 -!- dazo is now known as dazo_afk
13:56 < amir> hmm
13:56 < amir> Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
13:56 < amir> i wonder if 2.6.22 is too old for openvpn?
14:01 -!- ph1l [~ph1l@gprs59.swisscom-mobile.ch] has joined #openvpn
14:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:20 -!- ph1l [~ph1l@gprs59.swisscom-mobile.ch] has quit [Quit: ph1l]
14:34 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
14:38 -!- ph1l [~ph1l@gprs53.swisscom-mobile.ch] has joined #openvpn
14:43 < amir> ok, this tun problem is 2.6.22 related: http://openvpn.net/archive/openvpn-users/2007-10/msg00049.html
14:43 <@vpnHelper> Title: [Openvpn-users] tun device not there after kernel upgrade (at openvpn.net)
14:43 < amir> anyway time for a new kernel there ;)
15:00 <@vpnHelper> RSS Update - forum: Restricting all network traffic while a client is connected <http://forums.openvpn.net/topic7959.html>
15:08 -!- Guifort [~Guifort@78.112.90.5] has joined #openvpn
15:09 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
15:12 -!- ph1l [~ph1l@gprs53.swisscom-mobile.ch] has quit [Ping timeout: 240 seconds]
15:18 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Read error: Connection reset by peer]
15:22 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
15:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:31 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has quit [Ping timeout: 252 seconds]
15:37 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
15:41 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
15:42 <@vpnHelper> RSS Update - forum: Restricting all network traffic while a client is connected <http://forums.openvpn.net/topic7959.html#p11316>
15:43 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has quit [Ping timeout: 240 seconds]
15:43 < farciarz84> Hi, I'm using openvpn from linux. Using /etc/init.d/openvpn start command. It asks me everytime for password. Can I somehow store the password permanetly?
15:43 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has joined #openvpn
15:44 < farciarz84> !welcome
15:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:44 < farciarz84> !goal
15:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:44 < farciarz84> !howto
15:44 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:47 < farciarz84> My goal is to store password to my vpn, that I don't need provite it everytime I start vpn. 
15:47 < farciarz84> provide*
15:53 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:58 < Bushmills> farciarz84: that's what i use keys for
16:05 -!- Guifort [~Guifort@78.112.90.5] has quit [Quit: Quitte]
16:07 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has quit [Ping timeout: 246 seconds]
16:09 < farciarz84> Bushmills: is this the same as ssh-keys?
16:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:09 < Bushmills> not exactly. but similar
16:18 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
16:19 < MrWGW> do any of you use OpenVPN Web Certificate Management?
16:19 < MrWGW> I've hit a slight roadblock in installing it; I'm getting a 403 on openvpn/status/index.php and it appears to be some element in the default apache config they supply with it
16:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:38 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
16:49 <@vpnHelper> RSS Update - forum: This is NOT a firewall issue <http://forums.openvpn.net/topic7960.html>
16:50 < Bushmills> MrWGW: 403: Forbidden.  
17:02 < MrWGW> Bushmills: indeed
17:03 < MrWGW> if you have any idea on what might becauseing it I'd be much obliged
17:03 < Bushmills> wrong permissions, my guess
17:05 < MrWGW> the apache log says its the config that's blocking it
17:05 < MrWGW> and the file and the dir are 0777'd and owned by the apache user
17:05 < MrWGW> I can pastebin my httpd.conf
17:06 < Bushmills> sorry, not knowing your apache config, i am not able to debug it.  besides, i'm not inclined to do so on #openvpn channel.
17:06 < MrWGW> I'll ask in #apache, this is probably an apache issue or an issue with the app as opposed to an openvpn problem per se
17:06 < Bushmills> try #httpd
17:18 < MrWGW> thanks
17:40 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Quit: Ex-Chat]
17:56 < zumbi> krzie: hey! I solved my issues..  :)
17:56 < zumbi> krzie: one of the main ones was remote IP given by sysadmin was wrong
18:01 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897.html#p11318>
18:03 -!- klemax [~klemax@unaffiliated/klemax] has joined #openvpn
18:05 < klemax>  Options error: --server directive network/netmask combination is invalid
18:05 < klemax> I got this while starting openvpn server.
18:06 < klemax> I'm not familiar with networking too much, I know it is very clear error.
18:06 < klemax> Can you help me about that?
18:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
18:10 < klemax> read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
18:11 < klemax> if I get that, whats wrong?
18:16 < Bushmills> klemax: --server directive network/netmask combination is invalid
18:18 < klemax> Bushmills: yes but why is it invalid? :P
18:18 < Bushmills> i can't say, you didn't show
18:18 < klemax> ok I'm going to show it, what do you need?
18:18 < Bushmills> i figure you got to blame the person who made your config
18:19 -!- EugeneKay is now known as GayCarrot
18:20 < klemax> Bushmills: route -n?
18:20 < Bushmills> "what do you need?" ... the --server directive network/netmask 
18:21 < klemax> "server 46.19.137.211 255.255.255.248"
18:21 < klemax> Kernel IP routing table
18:21 < klemax> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
18:21 < klemax> 46.19.137.208   0.0.0.0         255.255.255.248 U     0      0        0 eth0
18:21 < klemax> 169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
18:21 < klemax> 0.0.0.0         46.19.137.209   0.0.0.0         UG    0      0        0 eth0
18:21 < Bushmills> 46.19.137.211 is not a good subnet address for 255.255.255.248 netmask
18:21 < klemax> this is "route -n" output.
18:22 < klemax> Bushmills: so i need to use  46.19.137.208 ?
18:23 < Bushmills> right. but -a /29 subnet is *very* small for clients, connecting to vpn server
18:23 < klemax> this is a test server. I want to see what I can do.
18:23 <@vpnHelper> RSS Update - forum: This is NOT a firewall issue <http://forums.openvpn.net/topic7960.html#p11319>
18:23 < Bushmills> and you most likely want to use a different subnet, to avoid collision with your existing 46.19.137.208  
18:24 < klemax> ok it is starting now.
18:25 < klemax> root@server [/etc/openvpn]# route -n
18:25 < klemax> Kernel IP routing table
18:25 < klemax> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
18:25 < klemax> 46.19.137.210   0.0.0.0         255.255.255.255 UH    0      0        0 tun0
18:25 < klemax> 46.19.137.208   46.19.137.210   255.255.255.248 UG    0      0        0 tun0
18:25 < klemax> 46.19.137.208   0.0.0.0         255.255.255.248 U     0      0        0 eth0
18:25 < klemax> 169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
18:25 < klemax> 0.0.0.0         46.19.137.209   0.0.0.0         UG    0      0        0 eth0
18:25 -!- klemax was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
18:25 -!- klemax [~klemax@unaffiliated/klemax] has joined #openvpn
18:25 < klemax> oh sorry.
18:26 < klemax> Bushmills: http://pastebin.com/a0fsACsL
18:26 < klemax> this is the new output.
18:26 < Bushmills> hm. should you have logged on again, be informed that my irc client auto-ignores flooders
18:27 < klemax> But I can not connect via 46.19.137.211 to my vpn server.
18:28 < klemax> Logs : http://pastebin.com/gpX5pNz3
18:34 < K1ng> who wanna see my huge screen? http://puu.sh/1Aqh
18:39 < zumbi> that's not a huge screen... just small fonts
18:39 < zumbi> :)
18:41 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:51 <@vpnHelper> RSS Update - forum: This is NOT a firewall issue <http://forums.openvpn.net/topic7960.html#p11320>
19:32 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
19:34 -!- GayCarrot is now known as EugeneKay
19:50 < K1ng> http://k1ngdom.net/
19:50 <@vpnHelper> Title: Steven King - The Ultimate Portfolio (at k1ngdom.net)
19:56 < derekv> hmm, my windows does not have build-req
19:56 < derekv> .bat
19:57 < derekv> oh maybe
19:57 < derekv> hmm
19:58 < derekv> shouldn't be hard to do ..
20:01 < derekv> ssl-admin does it
20:01 < derekv> its in perl
20:01 < derekv> need it to run on windows
20:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
20:02 < derekv> perl to exe
20:03 < derekv> the method has a couple advantages
20:03 < derekv> its not going to work strait up though
20:04 < derekv> perl is trippy
20:07 < derekv> It wouldn't shock me to find out I could use certificate facilities built into windows to create a key and csr that could work
20:37 <@vpnHelper> RSS Update - forum: need to use public ip in my local lan <http://forums.openvpn.net/topic7961.html>
20:37 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Quit: Lost terminal]
20:42 < derekv> what happens if my CA has crldistrobutions point like URI:http://certs.myorg.net/crls instead of eg URI:http://certs.myorg.net/crls/myorg.crl
20:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:53 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:25 <@vpnHelper> RSS Update - forum: [1]31999 ???????????? <http://forums.openvpn.net/topic7962.html>
22:13 -!- master_of_master [~master_of@p57B57E77.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
22:14 -!- master_of_master [~master_of@p57B55294.dip.t-dialin.net] has joined #openvpn
22:15 < MrWGW> so can anyone point me in the direction of some simple scripts to setup openvpn connections?
22:16 < MrWGW> I messed with openvpncertmanagement but I'm not getting anywhere with it, I think its some undocumented missing php script or some bug
22:16 < MrWGW> I'm looking for something that would associate a client with a single public IP address
22:16 < MrWGW> so I could give boxes with RFC 1918 addresses at my house or my LAN public IP addresses on my datacenter networks
22:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Remote host closed the connection]
22:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:47 < MrWGW> mhmm?
22:51 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
22:54 -!- jacky_bro [b85f20a8@gateway/web/freenode/ip.184.95.32.168] has joined #openvpn
22:55 < ecrist> MrWGW: what do you need?
22:55 < ecrist> !conf-gen
22:55 < ecrist> !confgen
22:55 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
22:56 < MrWGW> ecrist: I'll take a look at that
22:56 < ecrist> it's a bash script krzee wrote
22:56 < MrWGW> ecrist: specifically what I'm looking for is something that will let me easily setup vpns so individual computers at my house or office can be assigned specific public IP addresses from my datacenter networks
22:57 < ecrist> not sure if it'll do that
22:57 < MrWGW> I was messing with OpenVPN Web Cert Management and I have it installed (which was a huge PITA; there were some undocumented elements to it) but its failing for unknown reasons
22:57 < ecrist> !ssl-admin
22:57 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
22:57 < ecrist> for cert mgmt
22:58 < MrWGW> well OpenVPN Web Cert Management is failing to do pretty much anything
22:58 < MrWGW> the idea of it was apparently it could setup each OpenVPN server instance and provide a link where you could for eample download the Windows GUI client pre-configured with the right settings
22:58 < MrWGW> but it seems to not work
22:58 < MrWGW> btw thanks for your help on this
22:58 < MrWGW> these links might help
22:59 < MrWGW> I'm also considering trying IPCop or perhaps the proprietary Access Server as a last resort
23:05 -!- jacky_bro [b85f20a8@gateway/web/freenode/ip.184.95.32.168] has quit [Ping timeout: 252 seconds]
23:15 < derekv> I want to do that.
23:17 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Ping timeout: 248 seconds]
23:17 < derekv> Except with out the web admin part
23:17 < derekv> I don't think I'll get the chance.
23:19 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:19 < derekv> I'd like a way to deploy to possible unskilled users that is reletively secure.  But, 
23:19 < derekv> I'm hitting this point where i'm fed up with unskilled users
23:19 < derekv> due to other reasons.
23:22 < derekv> I want to "roll up" my experiances with freebsd as a firewall/security appliance for small organizations into a really big howto, and easy but secure vpn provisioning and deployment to windows users is a loose end
--- Day changed Sat Apr 16 2011
00:22 < jetole> Hey guys. I have setup a few openvpn servers and run two for my office now. I am setting up a new one which is on windows which I am not as familiar with setting up ovpn on. Anyways, it seems like it connects and everything seems like it should be working fine from the ovpn level but I am trying to figure out how I can set a IP address on windows that the machines can address from vpn. I originally tried adding a 10.4.0.2 address to the Ethernet ...
00:22 < jetole> ... adapter on the Windows host and I believe I had the proper settings defined on in the configuration files but I couldn't seem to ping that IP nor did I get a reply from a TCP SYN packet sent to the RDP port (3389) so I am just kind of lost on how I communicate with the windows host once ovpn is working 
00:23 < Bushmills> jetole: talking between vpn clients is just the same under windows as it is under unixoids
00:24 < jetole> Bushmills: yeah I am trying to remember, did I have to bridge devices on the Linux ovpn hosts? Did I have to add custom routing? I know the Windows firewall is off
00:24 < Bushmills> no
00:25 < jetole> so then once routed vpn is working (and I see the new routes on the linux client) then, if I assign a IP in that new subnet to the Windows Ethernet adapter, it should just be automatically routed to it from the clients?
00:26 < jetole> I feel like I am missing something big here
00:26 < Bushmills> you either set up server firewall to not block traffic between clients, or tell use client-to-client, to route inter-client  traffic internally
00:26 < jetole> Bushmills: Like I said, the windows firewall is off
00:26 < Bushmills> like i said, "either"
00:27 < jetole> so you're saying though that it should be working now since I did one of the "either"
00:27  * jetole checks the man page for --client-to-client
00:27 < Bushmills> yes, should do
00:28 < jetole> How does Windows know that a packet which comes from the tun/tap should be sent to the which Ethernet adapter?
00:29 < Bushmills> by routing
00:29 < Bushmills> just as windows knows that a packet from anywhere else should be sent to ethernet adapter
00:29 < jetole> right
00:32 < Bushmills> actually, i'm not sure why i thought you wanted to talk between openvpn clients - but that's what i read in your original question
00:33 < jetole> well I am firing up wireshark on the windows machine
00:34 < jetole> Bushmills: well this client in my office is acting as a gateway for all other computers in my office to this remote windows host just how that same computer does now to a rack of a over a dozen other computers at our data center
00:34 < jetole> the data center connection has been working well for 6 months
00:34 < Bushmills> so you have a lan behind your client?
00:35 < jetole> yeah
00:35 < Bushmills> !clientlan
00:35 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
00:35 <@vpnHelper> better explanation
00:35 < Bushmills> sorry for misleading you with the client-to-client thing
00:35 < Bushmills> i'll try a coffee first
00:36 < jetole> ok... currently this host already handles lan to data center vpn to hosts on server rack (without CCD)
00:36 < jetole> I am adding a new connection which does have ccd on the server 
00:36 < jetole> no iroute though (I have never seen that before)
00:36 < jetole> !iroute
00:36 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
00:37 < jetole> Bushmills: though right now I am testing from the linux vpn client / firewall / gateway for our office. I am ssh'd in and testing from there. I see the new device exists and I see the new routing tables for it
00:38 < jetole> I also see the routing table on the windows host 
00:39 < jetole> brb
00:43 < Bushmills> !winroute
00:43 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
00:43 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
00:52 < jetole> thanks
00:59 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
01:03 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
01:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:35 -!- rigel [~saxonberg@c-68-34-78-124.hsd1.md.comcast.net] has quit [Ping timeout: 258 seconds]
01:35 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has quit [Ping timeout: 258 seconds]
01:35 -!- rigel [~saxonberg@c-68-34-78-124.hsd1.md.comcast.net] has joined #openvpn
01:38 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has joined #openvpn
01:42 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
01:45 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has joined #openvpn
01:58 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
02:04 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
02:18 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 240 seconds]
02:46 < jetole> Does anyone by chance know why openvpn would be using the loopback device (Linux) to try to send to a host which is set to route through the tun device?
02:54 < jetole> bah! Ok. for some reason hping was using the lo device and not getting a syn/ack however netcat/nc seems to be able to connect to that port and reports it open
02:55 < jetole> and odd, I can connect to that port when I assign that IP to the tun/tap dev however not when I assign it to Ethernet dev in windows 
03:30 -!- nixjr [~nix@122.58.73.7] has joined #openvpn
03:30 < nixjr> !welcome
03:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:32 < nixjr> !goal
03:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:32 < nixjr> !howto
03:32 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:39 < nixjr> !interface
03:39 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
03:42 < nixjr> ive installed openvpn and it appears to work, i get "Initialization Sequence Completed" when running it from the command line, however id like to use gnome's networkmanager applet and when importing the client.opvn file it leaves several fields empty
03:43 < jetole> nixjr: I've heard tell that the networkmanager app doesn't always work that great
03:44 < jetole> so as I am compiling this document with goal, interfaces, routes, configs and logs... I assume it's ok to replace the first two octets on publically available IP addresses / subnets ?
03:44 < Bushmills> !ubuntu
03:44 <@vpnHelper> "ubuntu" is dont use network manager!
03:45 < Bushmills> get it running nicely without network manager. if you really want to need it, set nm up accordingly after openvpn runs without it
03:45 < jetole> I'll be honest, I have ubuntu 10.04 on my home desktop and ubuntu 10.10 on my laptop and they both have openvpn running to connect to two different VPN's and I haven't found a reason I need the networkmanager applet to use openvpn
03:46 < nixjr> its running without it now, i just dont knwo what to enter into all the fields for the nm app, and importing the .ovpn doesnt fill them all out either
03:47 < jetole> nixjr: my question is why do you want to use it in the first place
03:47 < nixjr> im using gui for evreything else, would be kind of anoying to have to keep a terminal window open 24/7 for vpn
03:49 < Bushmills> why keep it open?
03:49 < jetole> nixjr: there is a openvpn startup script in /etc/init.d
03:49 < Bushmills> start openvpn as root. proceed using as user.  stop as root. proceed as user
03:49 < nixjr> if i close it, it ends the connection
03:49 < jetole> //etc/init.d/openvpn start
03:50 < jetole> test it in the terminal and once it works, use the script to start it. It daemonizes it. Or there is also a daemon option too
03:50 < jetole> check the man page
03:50 < jetole> it runs like a service like a http server or DNS server 
03:50 < nixjr> oh ok, so if its runign as a deamon, i can still start/stop it?
03:51 < Bushmills> sure
03:51 < jetole> //etc/init.d/openvpn start
03:51 < jetole> //etc/init.d/openvpn stop
03:51 < jetole> //etc/init.d/openvpn restart
03:51 < jetole> oops. Ignore the double forward slashes at the start
03:51 < jetole> thats supposed to be one /
03:51 < nixjr> gotcha
03:52 < Bushmills>  or symlink things like start, stop, reload, restart etc to a script which does /etc/init.d/$1 $(basename $0)
03:52 < Bushmills> then it's simply   start openvpn;  stop openvpn
03:54 < nixjr> now thats sorted, i just need to find out how to make it send my internet traffic through, currently i can browser tot he server but nothing outside it, but there seems ot be plenty of documention on that so i wont bother you with qu's on it
04:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:28 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:29 < Bushmills> !redirect
04:29 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
04:30 < Bushmills> name server your client is using may need some attention if you do that 
04:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
04:52 < jetole> Bushmills. I have done enough work here in summarizing what I need done, what I have to compare it to and detailed info about all the details I can think relavent to my problems posted here: http://pastebin.com/1AQVc4cn and I was wondering if you would be willing to help me further?
04:52 < Bushmills> what do you need? a signed contract?
04:52 < jetole> well I don't know if it's "enough work" but I have made a good effort to start
04:53 < jetole> Bushmills: I figured the more data I gave the more likely someone would want to help
04:53 < jetole> so I am asking you, humbly, if you would mind
04:55 < Bushmills> difficult to give advance commitment. if there's something i feel inclined to answer, i do. i don't feel required, though.
04:55 < Bushmills> simply don't direct questions at a specific person, but ask the channel
04:56 < jetole> well it's there if anyone would mind helping me out. All the details I can think of, summary, goal, etc @ http://pastebin.com/1AQVc4cn
04:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:57 < Bushmills> well, there's that :)  i don't tend to open links only to find out what the question was
04:58 < jetole> well in that case. currently I seem to have my vpn running but I can't seem to connect to the desired IP I want. inside the link is interfaces, routes, openvpn config files and openvpn logs from server and client
04:59 < Bushmills> "desired ip" is a LAN ip, or a WAN ip?
05:00 < jetole> It's an IP assigned just for VPN, the IP is 10.3.0.2. The connection is coming from a LAN but I am also testing it on the VPN client first 
05:01 < jetole> the subnet is 10.3.0.0/24 and the subnet for routing in the VPN is 10.100.1.0/24
05:01 < Bushmills> 10.3.0.2 sounds dangerous - it may the server p-t-p address
05:03 < jetole> no. that is the 10.100.1.0/24 subnet. For this client (the only one so far), 10.100.1.1 and the client has 10.100.1.2 (which is defined in the ccd) but...
05:03 < jetole> I seem to have limited connectivity if I assign that IP to the tun interface on the vpn server but not the ethernet address
05:04 < Bushmills> what assigns that ip to the tun interface?
05:04 < Bushmills> other than "I"
05:04 < jetole> no I mean if I manually assign 10.3.0.2 to the tun interface. Also the server is Windows
05:05 < Bushmills> don't
05:05 < Bushmills> let server assign it
05:05 < jetole> so you are saying don't assign 10.3.0.2 to anything. Do I specify this IP in the config file or how does the server know where to assign it to?
05:05 < Bushmills> it's a tunnel. as tunnel it has two ends.
05:05 < Bushmills> !iporder
05:05 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
05:06  * jetole looks
05:06 < jetole> well, before I continue
05:06 < Bushmills> when an openvpn client connects, server pushs it an ifconfig command with ip address
05:07 < Bushmills> that way, server also knows what ip address is assigned to the remote - i.e. client - side
05:07 < jetole> this is the first server at this data center (I currently use openvpn between two linux hosts at another data center) and I want to assign them all on a LAN subnet of 10.3.0.0/24 where they can talk to each other without routing over the VPN on that subnet
05:07 < Bushmills> if you assign an ip address on client manually, server doesn't know about it
05:07 < jetole> should I still follow the iporder rules?
05:08 < jetole> Bushmills: 10.3.0.2 is the server IP address
05:08 < Bushmills> "can talk to each other without routing over the VPN " - why do you use openvpn then?
05:10 < jetole> Let me give you an example from our other data center. There is a LAN on 10.2.0.0/23.All of the server talk to one another on it. In our office, if done from the openvpn client (which is also our primary gateway) or done from any other host. If someone says I want to talk to 10.2.1.4 then it is routed over the VPN to the data center. I want to set up the same thing 
05:11 < jetole> so when we install more servers at the new data center, they are all on the same 10.3.0.0/24 LAN but if someone in the office says I want to talk to a host on 10.3.0.0/24 then it is routed over vpn
05:11 < jetole> does that make sense
05:11 < jetole> ?
05:12 < Bushmills> what is the goal?
05:14 < jetole> to setup the new data center like the old one. To have a private lan inside the data center of 10.3.0.0/24 where all of the servers can talk to one another but anyone in the office would be routed over the VPN. This is also our primary gateway so no new routes need to be added to office hosts. As traffic passes through the primary gateway in the office, if the destination IP is 10.3.0.0/24 then it is routed to the data center. Clearly the data center ...
05:14 < jetole> ... hosts (which is only this one so far) would need a new route on each host for returning data back to the office
05:15 < jetole> I'm trying my best here but I don't think I am describing this too well
05:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
05:16 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
05:16 < Bushmills> have one server in data center, and several clients.   also, have (some) client(s) outside the data center
05:17 < Bushmills> that way, every client packet to vpn subnet will reach server 
05:18 < Bushmills> check out client-to-client for clients talking to each other.  not required, just a routing shortcut on server
05:18 < jetole> right now I am stuck trying to setup the one client. 
05:18  * jetole takes a look
05:20 < Bushmills> client-to-client is of no use with one client only
05:22 < jetole> oh. well it's one client for now. This client is the primary gateway at the office so this one client will handle many other connections but right now, it seems I can't access 10.3.0.2 when I assign it to the Ethernet interface on the Windows OpenVPN server. The only other client after this will be the other data center where we have another OpenVPN host acting as a server and I will set it as a router for data center to data center communications but ...
05:22 <@vpnHelper> RSS Update - forum: Windows File Shares Unreachable via OpenVPN <http://forums.openvpn.net/topic7963.html>
05:22 < jetole> ... not worrying about the other client / data center yet
05:22 < Bushmills> don't set tun address manually. let server set it from its config
05:22 < Bushmills> it will, with a /24 subnet, be .1
05:23 < Bushmills> there are no other host on the vpn subnet, unless clients connect
05:23 < Bushmills> should there be any, you suffer from overlapping subnets, which are considered faulty configuration
05:25 < jetole> 10.3.0.2 is not for the p2p. When we install the next server it will be 10.3.0.3 and the one after that will be 10.3.0.4
05:25 < jetole> 10.100.1.0/24 is the ptp net where the vpn server has 10.100.1.1 and the client has 10.100.1.2 and that hasn't been assigned manually but it exists in a ccd file
05:26 < Bushmills> ok. von subnet is 10.100.1.0/24.
05:26 < Bushmills> vpn
05:26 < jetole> right
05:26 < Bushmills> so 10.3.0.0/24 is the ethernet LAN?
05:27 < jetole> thats the plan. Yes
05:30 < jetole> Is there any way I can sniff the tun/tap adapter on Windows?
05:31 < Bushmills> you're aware that openvpn traffic between clients always traverse openvpn server? 
05:32 < Bushmills> i.e. there is no direct client to client communication, bypassing the server
05:36 -!- twister004_ [~chatzilla@117.204.142.170] has joined #openvpn
05:39 < jetole> right now client to client is the least of my concerns. I'm starting with the basics which is one client and one server
05:39 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 246 seconds]
05:39 -!- twister004_ is now known as twister004
05:39 < jetole> oh and yes I actually was aware of that
05:40 < jetole> I have setup openvpn twice before as well as on all road warrior laptops and it has lasted long and well. This is my first windows server and I can't figure out what I am missing
05:40 < Bushmills> !winroute
05:40 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
05:40 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
05:41 < jetole> I have added the route-method exe and the route-delay and read the faq. let me look #3 and ... oh and it's running as a service / admin
05:43  * Bushmills gone for a few hours
06:09 -!- luneff [~yury@84.51.192.6] has joined #openvpn
06:10 < jetole> How do I stop openvpn and then start it when it is running in the cmd prompt?
06:11 < jetole> doesn't seem to like ^C
06:19 -!- K1ng\ [~KING@180.211.188.54] has joined #openvpn
06:22 -!- K1ng [~KING@180.211.188.54] has quit [Ping timeout: 252 seconds]
06:25 -!- twister004 [~chatzilla@117.204.142.170] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
06:36 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
06:43 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
07:04 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:04 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:40 < jetole> Well I solved all my problems. Their are 3 firewalls internal to windows server 2008 r2 yet the main firewall screen only shows two, the missing one was domain firewall which is now off
07:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:53 < jetole> Hey guys. I am almost done setting up Windows as a ovpn server and I think I am at the last hurdle. I currently have 10.3.0.2 assigned to an Ethernet interface. The server side of the ptp is 10.100.1.1 and the client side of the ptp is 10.100.1.2. If I ping 10.3.0.2 from the client I get a result. Now the client is linux and it's also a gateway for the office LAN. If I use a office computer and ping 10.3.0.2 (which is coming from 192.168.0.0/24) then, ...
07:54 < jetole> ... while sniffing the ptp/tun interface on the client, I see the packet go through. Sniffing the ptp/tun interface on the windows machine, I see the packet go through. sniffing the Ethernet interface on the Windows machine I see the packet go through so essentially if any host on the office LAN sends a packet to 10.3.0.2 then it is routed through the primary gateway which then sends it through openvpn and finally the packet ends where it's supposed to ...
07:54 < jetole> ... be. The last issue I have is that it seems like windows is not returning the packet at all.
07:55 < jetole> Does anyone know what I should look at?
08:12 -!- AndroUser2 [~androirc@76.10.222.65] has joined #openvpn
08:12 < AndroUser2> !welcomw
08:12 < AndroUser2> !welcome
08:12 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:13 < AndroUser2> !goal
08:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:13 < AndroUser2> !goal i want to know why i cant browse even im connected to vpn
08:14 -!- AndroUser2 is now known as itsmeegeekee
08:14 < itsmeegeekee> hello
08:15 < itsmeegeekee> !howto
08:15 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:16 < jetole> itsmeegeekee: I got it. I needed to add the route line for the office LAN into the server config file
08:16 < itsmeegeekee> i dont get it
08:16 < itsmeegeekee> :(
08:17 < jetole> Ah nevermind. I thought you were pasting the welcome message to me
08:17 < itsmeegeekee> can you help me?
08:17 < jetole> I could but I won't. Don't take it too cynically though because I am just too busy with my setup at the moment
08:18 < itsmeegeekee> aaw thats sad
08:18 < jetole> !passthrough
08:19 < itsmeegeekee> im connected to vpn but i cant browse, i changed nobind to bind but the connection is dropping
08:39 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
08:39 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
08:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:18 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
09:21 < jetole> ipconfig
09:21 < jetole> oops. wrong window
09:38 -!- K1ng\\\ [~KING@180.211.188.63] has joined #openvpn
09:39 -!- K1ng\\\ [~KING@180.211.188.63] has quit [Client Quit]
09:41 -!- K1ng\ [~KING@180.211.188.54] has quit [Ping timeout: 260 seconds]
09:43 -!- K1ng [~KING@180.211.188.63] has joined #openvpn
09:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
10:18 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
10:18 -!- Blues-Man [~bluesman@host18-26-dynamic.44-79-r.retail.telecomitalia.it] has joined #openvpn
10:23 -!- Zarion [~as@unaffiliated/zarion] has joined #openvpn
10:24 < Zarion> could someone tell me how I can setup a route to access a ip address at the other end of the tunnel, on a different subnet
10:25 < Zarion> Do I ned to setup something different in openvpn ?
10:26 -!- illsci_ [~illsci@shinobi.ninjatel.com] has joined #openvpn
10:26 < illsci_> hi
10:26 < illsci_> anyone around on a saturday?
10:27 < illsci_> !welcome
10:27 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:27 < illsci_> !goal
10:27 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
10:38 < Zarion> !route
10:38 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:05 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
11:14 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:52 -!- Zarion [~as@unaffiliated/zarion] has quit [Ping timeout: 276 seconds]
11:53 -!- Zarion [~as@174.124.246.99] has joined #openvpn
11:53 -!- Zarion [~as@174.124.246.99] has quit [Changing host]
11:53 -!- Zarion [~as@unaffiliated/zarion] has joined #openvpn
12:11 -!- AgiZ [~totality@cpe-90-157-144-40.dynamic.amis.net] has quit [Quit: World is a round. Or so they say]
12:35 -!- jeiworth [~jeiworth@187.194.13.248] has joined #openvpn
12:37 -!- Zarion [~as@unaffiliated/zarion] has quit [Ping timeout: 240 seconds]
12:39 -!- Zarion [~as@unaffiliated/zarion] has joined #openvpn
12:39 -!- jeiworth [~jeiworth@187.194.13.248] has left #openvpn ["bye"]
13:23 -!- Blues-Man [~bluesman@host18-26-dynamic.44-79-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
13:28 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
13:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:37 -!- Blues-Man [~bluesman@host18-26-dynamic.44-79-r.retail.telecomitalia.it] has joined #openvpn
13:47 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.4]
13:47 -!- Zarion [~as@unaffiliated/zarion] has quit [Read error: Connection reset by peer]
13:47 -!- Zarion [~as@174.124.246.99] has joined #openvpn
13:47 -!- Zarion [~as@174.124.246.99] has quit [Changing host]
13:47 -!- Zarion [~as@unaffiliated/zarion] has joined #openvpn
13:51 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
13:54  * Blues-Man good blues bye
13:54 -!- Blues-Man [~bluesman@host18-26-dynamic.44-79-r.retail.telecomitalia.it] has quit [Read error: Connection reset by peer]
14:00 < itsmeegeekee> hello everyone
14:05 -!- Zarion [~as@unaffiliated/zarion] has quit [Quit: —I-n-v-i-s-i-o-n— 3.1.3 (May '10)]
14:10 <@vpnHelper> RSS Update - forum: need to use public ip in my local lan <http://forums.openvpn.net/topic7961.html#p11324>
14:13 < Bushmills> itsmeegeekee: you can't browse what?
14:13 < Bushmills> and why would you expect to be able to browse what you expect to be able to browse?
14:20 < itsmeegeekee> no inbound traffic
14:20 < Bushmills> you can't browse inbound traffic
14:21 < itsmeegeekee> Bushmills, no inbkund traffic, cant load webpages
14:21 < Bushmills> how are you trying to browse inbound traffic?
14:21 < itsmeegeekee> webpages arent loading
14:22 < itsmeegeekee> the vpn is connected though
14:22 < Bushmills> where are those web pages? on the openvpn server?
14:22 < itsmeegeekee> firefox
14:22 < itsmeegeekee> and ie
14:22 < Bushmills> you try to browse web pages which are on the machine where firefox runs?
14:23 < Bushmills> you don't need openvpn for that
14:23 < itsmeegeekee> nooooo
14:23 < Bushmills> that's what your answers suggest
14:23 < itsmeegeekee> after connecting to openvpn
14:23 < itsmeegeekee> i cant browse websites
14:24 < Bushmills> have you started a web browser?
14:24 < itsmeegeekee> after connecting a vpn, yes
14:25 < Bushmills> then there is probably something wrong in your setup, if your expect to be able to browse web pages and you can't
14:26 < itsmeegeekee> when i change the nobind to bind on the config file, i can browse but the connection is droppin after a while
14:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:27 < Bushmills> then don't change
14:27 < itsmeegeekee> if i dont change,i cany browse
14:27 < itsmeegeekee> cant
14:28 < Bushmills> then setup your server and client to allow browsing
14:28 < itsmeegeekee> im using a free vpn
14:28 < Bushmills> me too
14:29 < Bushmills> openvpn.  that's free vpn software
14:29 < itsmeegeekee> im using proxpn 
14:29 < itsmeegeekee> lolol
14:29 < Bushmills> i don't
14:29 < itsmeegeekee> hey thanks for ur self, u dont get the whole scenario
14:30 < Bushmills> no. but you didn't tell a lot. just that you can't browse web pages.
14:30 < itsmeegeekee> help
14:30 < Bushmills> you even didn't tell where those pages are
14:30 < itsmeegeekee> hey i appreciate.ur help
14:30 < Bushmills> oh, sorry. you did.  on the machine with the web browser
14:30 < itsmeegeekee> gtg for a while
14:39 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
14:42 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
14:50 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
16:20 <@vpnHelper> RSS Update - forum: Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11325>
16:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:26 -!- glengoyne [~glengoyne@p5494611E.dip.t-dialin.net] has joined #openvpn
16:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
16:45 -!- glengoyne [~glengoyne@p5494611E.dip.t-dialin.net] has quit [Quit: Verlassend]
18:44 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
18:55 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 246 seconds]
19:09 < illsci_> !welcome
19:09 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:09 < illsci_> !howto
19:09 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:09 < illsci_> !route
19:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
19:16 -!- bitterman [~yury@84.51.192.6] has quit [Quit: Leaving]
19:39 -!- echoSMIL1 [~censured@bl17-97-80.dsl.telepac.pt] has quit [Read error: Operation timed out]
19:39 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
19:44 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
20:13 -!- itsmeegeekee [~androirc@76.10.222.65] has quit [Ping timeout: 252 seconds]
20:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:35 -!- klemax [~klemax@unaffiliated/klemax] has quit [Ping timeout: 276 seconds]
20:40 -!- klemax [~klemax@unaffiliated/klemax] has joined #openvpn
21:14 -!- Jasonn [~Jasonn@unaffiliated/jasonn] has joined #openvpn
21:14 < Jasonn> !welcome
21:14 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:14 < Jasonn> !howto
21:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:16 < Jasonn> Hi, I get an error message when I try to run the server from the webUI wait a min while I pastebin
21:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
21:19 < Jasonn> http://pastebin.ubuntu.com/595019/
21:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:46 -!- nixjr [~nix@122.58.73.7] has quit [Quit: bye]
21:55 < jetole> Hey guys. I have a windows OpenVPN server and a Linux OpenVPN client. The Linux client is also acting as a gateway for all other machines at the other location. This all works fine. What I want to know is, does anyone know how I can place a bandwidth cap on the VPN tunnel?
21:56 < jetole> say only allow it to use X amout of Mbps
21:58 < Jasonn> If you have the server on windows, you can download a bandwith monotoring program and just stop the server when the amount you would like to set as the limit is exceeded
21:59 < Jasonn> or did you want it more for a specific user?
22:00 < Jasonn> jetole: 
22:02 < krzee> Jasonn, 
22:03 < krzee> you're in the wrong place
22:03 < krzee> you mentioned web UI
22:03 < krzee> !AS
22:03 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
22:03 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
22:04 < Jasonn> Ok, just a question
22:04 < krzee> #4 is where to get support for access-server
22:04 < Jasonn> does AS also need openvpn?
22:04 < jetole> Jasonn: I want to set a rate limit instead of a cap. Sorry, I should have said that
22:04 < krzee> its actually different software
22:04 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
22:04 -!- noogenesis [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
22:04 < jetole> Jasonn: and no, it's not per user
22:05 < krzee> jetole, that sort of stuff is done in your firewall
22:05 < Jasonn> jetole: That can easily be done with external software, wait a min and ill get you the link 
22:05 -!- noogenesis is now known as derekv
22:05 < jetole> Jasonn: thanks. 
22:06 < Jasonn> krzee: Ok, and how would I install iptables_openvpn ??
22:06 < jetole> krzee: yeah I have setup rate limiting before using LARTC and we still use the script I wrote to setup limiting in the office today but was hoping there was an easier way
22:06 < krzee> Jasonn, its unrelated to openvpn
22:07 < krzee> pretend you are rate-limiting your LAN
22:07 < krzee> same stuff
22:07 < jetole> krzee: oh I know
22:07 < jetole> lartc is still a complex setup
22:07 < Jasonn> jetole: http://www.netlimiter.com/
22:07 < krzee> anyways, im off work now
22:07 < krzee> and its sat night
22:07 < krzee> so adios!
22:07 < jetole> ingress filtering is pretty tricky compared to agress filtering through lartc 
22:08 < jetole> krzee: I'm sitting in the office so I hear ya
22:08 < jetole> have fun
22:08 < jetole> Jasonn: thanks. Yeah I am going to use lartc for this 
22:08 < Jasonn> oh 
22:08 < Jasonn> ok 
22:12 < Jasonn> jetole: Have you set up openvpn before?
22:12 < jetole> servers, three times. clients, about 3 dozen
22:13 < Jasonn> You wanna take me through a step-by-step moron-tutorial of how to set it up?
22:13 -!- master_of_master [~master_of@p57B55294.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
22:13 < jetole> of coarse not. what a silly question
22:13 < Jasonn> I tried to do it about 8 times, I failed all 8 times D:
22:14 < jetole> yeah I probably did too but I would look here: http://openvpn.net/index.php/open-source/documentation.html and here: http://www.google.com
22:14 <@vpnHelper> Title: Documentation (at openvpn.net)
22:14 < Jasonn> ook thanks 
22:14 -!- master_of_master [~master_of@p57B54915.dip.t-dialin.net] has joined #openvpn
22:14 < jetole> if you have a question and I know the answer then sure but I'm at work and even if I wasn't I wouldn't be walking you through every little step. I'd optionally install it for you top down if you paid me enough
22:16 < jetole> brb. Going for a smoke and I think to the chinese resturaunt downstairs too. Get me some po'k fryed rithe 
22:16 < jetole> :D
22:16 < Jasonn> D: I want a smoke 
22:16 < Jasonn> lol 
22:23 < Splex> i want to set up a mesh vpn.. what is the current best technique to do this?
22:23 -!- Jasonn [~Jasonn@unaffiliated/jasonn] has left #openvpn ["Leaving"]
22:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:45 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 248 seconds]
22:46 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
23:13 < Splex> how is the progress on the 'adaptive iroute' feature?
23:39 -!- EugeneKay is now known as EugeneKaway
23:40 -!- EugeneKaway is now known as EugeneKay
23:54 -!- K1ng\ [~KING@180.211.188.63] has joined #openvpn
23:55 -!- K1ng [~KING@180.211.188.63] has quit [Ping timeout: 252 seconds]
--- Day changed Sun Apr 17 2011
00:02 -!- K1ng\ [~KING@180.211.188.63] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
00:02 -!- K1ng [~KING@180.211.188.63] has joined #openvpn
00:04 -!- EugeneKay is now known as EugeneKaway
00:34 -!- EugeneKaway is now known as EugeneKay
00:35 < EugeneKay> !factoids
00:35 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
00:45 -!- EugeneKay is now known as EugeneKaway
01:01 -!- diemaco [~freenode@d204-191-182-51.abhsia.telus.net] has joined #openvpn
01:04 -!- diemaco [~freenode@d204-191-182-51.abhsia.telus.net] has quit [Client Quit]
01:05 -!- diemacon [~freenode@d204-191-182-51.abhsia.telus.net] has joined #openvpn
01:13 -!- diemacon is now known as diemaco
01:13 -!- diemaco [~freenode@d204-191-182-51.abhsia.telus.net] has quit [Quit: ZNC - http://znc.in]
01:14 -!- diemaco [~df@d204-191-182-51.abhsia.telus.net] has joined #openvpn
01:44 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:08 -!- luneff [~yury@84.51.192.6] has joined #openvpn
02:08 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
02:09 -!- luneff [~yury@84.51.192.6] has joined #openvpn
02:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
02:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:13 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
03:22 < krzie> Splex, as far as i know it has gone nowhere, since dev tap and mode ptp handle those situations fine, and i think theres possible security issues if adaptive iroute is not done really really well
03:22 < krzie> Splex, for a mesh you prolly want a bunch of ptp vpns, like this:
03:22 < krzie> !rip
03:22 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
03:28 < Splex> krzie: rip + dev tap?
03:28 < krzie> you may use dev tap or dev tun and mode ptp to accomplish that
03:29 < Splex> i have been using tun mode for the past year or so
03:29 < Splex> but it isn't working so well
03:29 < krzie> and on top you can use rip or ospf or bgp, or whatever
03:29 < Splex> i have been using manual routing
03:29 < krzie> i do the same, have no need for more
03:29 < Splex> now, i am expanding my vpn to more than a couple servers..
03:30 < Splex> so, it would be nice to improve
03:32 < krzie> i just realized i wasnt that clear
03:32 < Splex> p2p is default right?
03:32 < krzie> [04:30]  <krzie> you may use (dev tap) or (dev tun and mode ptp) to accomplish that
03:32 < krzie> if not using server yes
03:33 < krzie> look at manual in EXAMPLES
03:33 < krzie> !ptp
03:33 < krzie> !p2p
03:33 < krzie> !ping
03:33 <@vpnHelper> pong
03:33 < krzie> hrm
03:33 < krzie> !factoids search 
03:33 <@vpnHelper> (factoids search [<channel>] [--values] [--{regexp} <value>] [<glob> ...]) -- Searches the keyspace for keys matching <glob>. If --regexp is given, it associated value is taken as a regexp and matched against the keys. If --values is given, search the value space instead of the keyspace.
03:33 < krzie> !factoids search --values static
03:33 <@vpnHelper> 'static', 'iporder', 'hmac', 'ipp', 'ipp', 'iporder', 'tls-auth', 'static_key_details', 'client-connect', 'osxboot', 'dlink_static_route', 'static-key', 'statickey', 'statickey', and 'forwardsecurity'
03:34 < krzie> !static_key_details
03:34 <@vpnHelper> "static_key_details" is http://svn.openvpn.net/projects/openvpn/web/trunk/faq-static-key-explanation.txt for an explanation of how static key files are used
03:34 < krzie> !static-key
03:34 <@vpnHelper> "static-key" is when you use --secret, you are using a static key. this is only valid for point-to-point setups. Static keys are less secure in that they never change. If someone captures your traffic, and then gains your static key a year from now, they can decrypt the captured traffic. Setups that use certs re-key every hour by default
03:34 < krzie> !statickey
03:34 < Splex> are you saying if running dev tun, i need to explicitly set p2p mode on a server config file?
03:34 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key>, or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time.
03:42 < Splex> !factoids search --values p2p
03:42 <@vpnHelper> No keys matched that query.
03:45 < Splex> !factoids search --values subnet
03:45 <@vpnHelper> 'ifconfig', 'topology', 'local', 'pfnat', 'subnet', 'samesubnet', 'routebyapp', 'static', 'route_override', '/30', and '1918'
03:45 < Splex> !topology
03:45 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
03:45 < Splex> !subnet
03:45 <@vpnHelper> "subnet" is http://www.subnet-calculator.com/ or http://en.wikipedia.org/wiki/Subnetwork
03:45 < Splex> !toplogy subnet
03:46 < Splex> !topology subnet
03:46 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
03:47 < Splex> krzie: if i ran 'dev tap', would i want to use toplogy subnet for the mesh setup?
03:50 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
03:50 < crocket> Damn
03:50 < crocket> I found out why OpenVPN over UDP was so unstable.
03:50 < crocket> A lot of UDP packets heaading for my institution are dropped.
03:51 < crocket> I just sent a video file via netcat to my institution computer, and the video file arrived was broken.
03:51 < crocket> Broken!!!
03:52 -!- luneff [~yury@84.51.192.6] has joined #openvpn
03:54 < crocket> I'm going to complain about their clumsy routers.
05:27 <@vpnHelper> RSS Update - forum: Order or arrangement of directives/option <http://forums.openvpn.net/topic7964.html>
05:31 -!- rommel [~rommel@174.140.165.129] has joined #openvpn
05:32 < rommel> guys is there a proper order or arrangement of directives on server and client configuration ?
05:34 < Bushmills> yes. vertically.
05:37 < rommel> Sir what I meant was like if in the client configuration, the first in line MUST BE client, then dev tun, then  proto tcp or udp, then verb, then remote x.x.x.x then comp-lzo, then resolv-retry infinite.  Doesnt it matter what comes first before the other?
05:37 < Bushmills> no
05:38 < Bushmills> connection profiles may require certain sequence, though
05:38 < Bushmills> well, not sequence. rather, arrangement
05:39 < rommel> May I get that proper sequencing/arrangement sir? Where can I read about that sir?
05:39 < Bushmills> you simply cluster all directives which belong to one profile into that profile
05:40 < rommel> ? Can you please expound sir?  My english language is somewhat poor.
05:41 < Bushmills> which part of what i said should i elaborate on?
05:42 < rommel> Actually I have just posted this request about arrangement of directives in the openvpn forums sir.  And I also opted to ask here because maybe I can get realtime answer.  And I was right.  Thank you sir.  Kindly elaborate on what you mean about "you simply cluster all directives which belong to one profile into that profile"
05:43 < rommel> If I will get an answer to this sir I will post the knowledge I will get here to the forum so everybody will benefit.
05:43 < Bushmills> http://scarydevilmonastery.net/snap/1303036939608802563d.png  - take line "http-proxy" as example - it would be misplaced in the first connection profile - unless desired there 
05:46 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
05:47 < rommel> thanks for some input sir. Perhaps I will google more. 
05:47 -!- rommel [~rommel@174.140.165.129] has quit []
05:58 < Splex> Bushmills: I am currently looking to improve my mesh vpn.  I am currently using dev tun + manual routes/iroutes.  I would like to have automatic optimal routing.  Is dev tap/dev tun p2p + RIP/ospf,etc the way to go?  What do you suggest?
06:56 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:56 -!- mode/#openvpn [+o mattock] by ChanServ
06:58 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
06:59 < amir> Splex, yes
07:00 < amir> Splex, i've got it running here ... 2 ptp links + 1 server/client for iDevices plus OSPFD on all routers
07:00 < amir> Splex, works wonderful (asides of all the damn firewalls hindering ospf)
07:04 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:04 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:20 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
07:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
07:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:55 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
08:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:42 -!- naquad [~naquad@174.142.224.219] has quit [Read error: Operation timed out]
08:44 -!- fivetwentysix [cbda14ee@gateway/web/freenode/ip.203.218.20.238] has joined #openvpn
08:47 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
08:52 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
09:09 < illsci_> hey whats up
09:10 < illsci_> I have a fios connection at home and I want to be able to have clients vpn back into my home network.  Does the open vpn server have to have two interfaces?
09:12 < illsci_> I wanted to just do port forwarding to a vm and terminate the vpn there 
09:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:27 < krzie> only 1 physical interface needed
09:28 < krzie> [04:48]  <Splex> krzie: if i ran 'dev tap', would i want to use toplogy subnet for the mesh setup?
09:28 < krzie> topology subnet is not used in dev tap
09:28 < krzie> nor is it needed
09:28 < krzie> dev tap already uses .2 .3 .4 like topology subnet does
09:28 < illsci_> the reason I ask is because the virutal appliance comes with two setup
09:29 < krzie> illsci_, *shrug*
09:29 < krzie> doesnt change my answer
09:29 < illsci_> I didn't expect it would
09:33 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
09:36 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
09:43 -!- fivetwentysix [cbda14ee@gateway/web/freenode/ip.203.218.20.238] has quit [Quit: Page closed]
09:51 -!- leepa [u1000@gateway/web/irccloud.com/x-mwbgikezwlofoexr] has joined #openvpn
09:51 < leepa> Hi, how do I stop an OpenVPN client accepting pushed default routes from the server?
09:51 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
10:03 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Remote host closed the connection]
10:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:26 < Bushmills> --route-nopull
10:30 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Chicks dig it]
10:34 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
10:36 < leepa> thanks!
10:37 -!- bitterman [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
10:38 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
10:42 <@vpnHelper> RSS Update - forum: Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11327>
10:46 -!- darth_bitterman [~yury@84.51.192.6] has joined #openvpn
10:49 -!- bitterman [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
10:51 < Splex> amir, thanks for the info
10:51 < Splex> krzie: thanks for clarifying that
11:03 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
11:03 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
11:06 -!- darth_bitterman [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
11:12 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Remote host closed the connection]
11:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
11:25 < jpalmer> I just brought up a new openvpn server.   clients can connect,  but they can't ping the server IP.   I've completely disabled the firewall.  The server also cannot ping the client over the vpn tunnel.    what am I missing?
11:26 < krzee> jpalmer, you are missing logs for us to look at ;]
11:26 < krzee> how ya doin man
11:26 < jpalmer> good good.  you?
11:26 < krzee> good, just read over a python book, now looking at their web frameworks
11:27 < jpalmer> got my openvpn + quagga + ibgp working.  works really well.  I just need to get better with iptables.
11:27 < jpalmer> nice.  I just bought a python book,  but haven't broke it open yet.
11:27 < krzee> ya i should have taken a free python book
11:27 < amir> krzee, you were right, what i needed was openvpn in 3x ptp mode (triangle of the 3 routers at the 3 sites) + 1x client/server for the iDevices 
11:27 < krzee> i opted for freeswitch book instead
11:27 < jpalmer> diveintopython is a free site ;)
11:28 < krzee> then i realized that my freeswitch install already does everything i want it to do
11:28 < amir> krzee, works wonderful, now that i understand the differences of the two openvpn modes ;)
11:28 < krzee> amir =]
11:28 < jpalmer> krzee: I work with kristian kielhofner,  I need no freeswitch book :P
11:28 < krzee> evidently i didnt need it either
11:28 < krzee> it has yet to be opened
11:28 < krzee> but i had a free packt book coming for doing peer review on jjk's new book
11:28 < jpalmer> when I have an FS question,  I just ask him at the office.  lol
11:29 < krzee> i know most the fs devs, that name isnt familiar
11:29 < krzee> oh hes a astlinux guy
11:29 < krzee> heh
11:30 < jpalmer> he's the guy behind astlinux,  and is pretty well known in the fs and asterisk communities.  presents at cluecon almost every year,  etc
11:30 < krzee> sounds kinda like going to the guy who wrote pptp for fs help ;]
11:30 < jpalmer> he's not really involved in astlinux these days,  as he's much more into fs
11:30 < krzee> err ovpn help i mean
11:30 < krzee> ahh i gotchya
11:31 < illsci_> hmm never heard of freeswitch
11:31 < jpalmer> anywho,  let me get back to this new server,   I've missing something so damned simple..
11:33 < krzee> illsci_, its a wonderful voip softswitch
11:33 < krzee> like asterisk but without the suck
11:33 < illsci_> heheh ok
11:34 < illsci_> im just getting started with openvpn... Ived used quagga before but with real routers
11:34 < illsci_> im excited to play with openvpn and quagga together
11:35 < illsci_> i just setup the openvpn access server.... i feel like I might be missing out on learning some of this stuff given how easy the setup was
11:39 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
11:42 < krzee> !AS
11:42 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
11:42 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
11:42 < krzee> see #4
11:43 < krzee> we dont do access server here, but it IS made to be that easy
11:43 < illsci_> k
11:44 < krzee> the good news it it comes with real support (ie: the people who do the support, it is their job to do it!)
11:44 < illsci_> i dont need support really
11:44 < krzee> cool
11:44 < illsci_> ill probably just setup openvpn and hang out here 
11:44 < krzee> welcome =]
11:45 < illsci_> i have friends that make use of it at their work... they do a bunch of interesting thing with it
11:45 < krzee> yep, its very useful stuff!
11:55 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
11:57 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
12:04 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:23 -!- bitterman [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
12:23 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
12:48 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
12:50 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
12:51 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
12:59 -!- bitterman [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
12:59 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
13:03 -!- illsci_ [~illsci@shinobi.ninjatel.com] has quit [Quit: [BX] I came, I saw, I ran away screaming]
13:03 -!- bitterman [~yury@84.51.192.6] has quit [Client Quit]
13:11 < amir> hmm
13:11 < amir> krzee, any hint why this could happen: openvpn[14343]: write to TUN/TAP : Invalid argument (code=22) ?
13:11 < amir> krzee, to me it seems the tunnel is up and running
13:13 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Remote host closed the connection]
13:13 < krzee> theres more errors somewhere
13:13 < amir> ic, checking
13:14 < amir> hmm, not really
13:14 < amir> this message show up once per minute
13:14 < amir> and nothing else shows in the logs
13:14 < amir> and it's always the same openvpn process id
13:14 < amir> [i have several running on that box]
13:15 < amir> nope, no other errors, looked back 1.5 days
13:16 < amir> at least not in syslog
13:17 < krzee> give it its own logfile and restart it
13:17 < krzee> !logfile
13:17 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
13:18 -!- luneff [~yury@84.51.192.6] has joined #openvpn
13:24 -!- jwtz [d55d4dc9@gateway/web/freenode/ip.213.93.77.201] has joined #openvpn
13:24 < jwtz> !welcome
13:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:25 < jwtz> !route
13:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:25 < krzee> jpalmer, did you post your logs?
13:27 < amir> krzee, you think i will see more that way?
13:27 < amir> krzee, will do
13:31 < krzee> amir, i think *i* might see more that way ;]
13:31 < amir> hrhr, ic
13:31 < amir> will reconfigure and hit you again when i have the logs
13:32 < jpalmer> krzee: there is nothing in the openvpn logs that indicates a problem.   however,  I've copied my openvpn configs from a *working* server and client,  and it's still not working.   I think linode did something funky with the default OS image.
13:32 < krzee> cool
13:32 < krzee> jpalmer, well if you would like me to look, feel free
13:32 < krzee> for yours i would want verb 5
13:33 < krzee> btw your HR dept never sent me any $
13:33 < krzee> methinks they dont like me
13:34 < jpalmer> krzee: bah,  whats the paypal address?  I'll pay it now.
13:34 < krzee> !donate
13:34 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel., or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc., or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
13:34 < jpalmer> how much was it?
13:34 < krzee> no idea ;]
13:35 < jpalmer> hmm.  
13:35 < jpalmer> think $50 will do?  (I'm not at work and am refusing to open my work email!)
13:35 < krzee> i *think* it was around $150, but im only ok with that if its coming from your office
13:35 < jpalmer> $150?  ok
13:35 < krzee> i would not accept $150 unless they are paying it tho
13:36 < jpalmer> I thought it'd been handled.  but if not,  then I'll make the payment, and deal with HR myself.
13:36 < krzee> yanno, company price vs person price ;]
13:36 < krzee> nah if it did it would be on the donations page
13:37 < jpalmer> ok,  sending a payment now.  I'll do $50 each payperiod until it's covered in full.
13:37 < K1ng> hey
13:37 < K1ng> paying for what?
13:38 < K1ng> krzee, is he hiring you?
13:38 < K1ng> :p
13:38 < krzee> telephone consultation for a big / important network he had to design with ovpn
13:38 < krzee> it was a pretty sweet setup
13:38 < jpalmer> krzee helped me a TON a few months ago.  ecrist is always answering questions.   it was a telephone consultation
13:38 < K1ng> ah
13:39 < K1ng> nice :)
13:39 < K1ng> i havent got my lame ass payoneer card yet :(
13:39 < krzee> i was able to spot a few large 'gotchya's
13:39 < jpalmer> krzee: sorry for the payment problem.  I'll get you covered.
13:39 < K1ng> http://puu.sh/1C1N :p
13:39 < krzee> no problem bud
13:39 < K1ng> ^ 15 days :p
13:41 < jwtz> !goal
13:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:41 < jwtz> !goal I would like to access the lan behind the server
13:41 < K1ng> lol
13:41 < krzee> !serverlan
13:41 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
13:42 < jpalmer> krzee:  first of 3 sent.
13:43 < jwtz> !route
13:43 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:46 -!- ChUbB [~IceChat7@cpc2-aztw12-0-0-cust229.aztw.cable.virginmedia.com] has joined #openvpn
13:47 < ChUbB> Hi guys, may seem like a newbie question but, how can i see each connecting to the port of my openvpn server using netstat?
13:50 < jpalmer> ChUbB: what specifically are you looking for?
13:51 < ChUbB> jpalmer: basicly i wanna use tcpkiller to kill off clients, for example i disable their certificate and need to bump their connection, i dont want to use/setup the management interface.
13:51  * jpalmer is in the mood for some sake.
13:52 < jpalmer> ChUbB: so, you want to see what IP a client is connecting from,  so you can kill the tcp session?
13:53 < jwtz> Guys, I'm trying to configure OpenVPN and I've read through quite some documentation and I'm basically set, however I have a question
13:53 < jwtz> Can I ask it here?
13:53 < jpalmer> jwtz: yep
13:53 < jwtz> Alright cool
13:53 < jwtz> So, I'm using a PFsense virtual machine for the VPN server, and a Tomato router for a VPN client
13:54 < ChUbB> jpalmer I can view the status file, just how can i used netstat to see the connection, i find it odd that i cant see the client ip and port i seen in the openvpn status file
13:54 < jpalmer> ChUbB: if you are just trying to get a list of clients,  their routable IP,  and their vpn IP..  you can setup the openvpn server to use a "status" file.
13:54 < jwtz> The PFSense has an IP address of 192.168.16.1, and the Tomato has an IP address of 192.168.15.1
13:54 < jwtz> The Tomato can ping the PFsense on 192.168.16.1, but not the other way around
13:55 < jwtz> And all firewalls are turned off so I'm kind of stumped on this noe
13:55 < jwtz> one*
14:06 < jpalmer> jwtz: are you sure you don't have overlapping subnets?    
14:06 < jpalmer> ie,  are you using /24's on both the 192.168.16.x network,  and the 192.168.15.x subnet?
14:06 < jwtz> yeah i am
14:07 < jpalmer> I'd fire up tcpdump or wireshark,  and watch the traffic flow.
14:08 < jpalmer> krzee: I finally got something I can work with.  MULTI: bad source address from client [10.16.3.4]
14:08 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
14:09  * jpalmer feels like he's finally making progress.
14:11 < krzee> thats definitely progress
14:11 < krzee> what *is* 10.16.3.4?
14:12 < jpalmer> got it.    I had a learn script defined,  but the script didn't exist.
14:13 < jpalmer> so it was a combination of STUPID linode default bastardization of standard OS installs,   and copying 1 too many lines from an existing openvpn server.
14:14 < jpalmer> (the learn script,  is the one that does the ddns updates to BIND)
14:14 < krzee> ahh right
14:15 < jwtz> alright jpalmer subnets aren't overlapping anymore
14:15 < jpalmer> so, cool.  new server is up and running.    now to add the learn script,  and add it to the mesh/add the ibgp peers..  and I'm good.
14:15 < jpalmer> jwtz: nice.   does it work now?
14:16 < jwtz> i used 172.16.1.0/16 for one side
14:16 < jpalmer> jwtz: yeah,  so what was likely happening is:  when you'd ping the "broken" side.   it got the traffic,  but tried to send the response back through the default gateway, rather than over the vpn tunnel.
14:18 < jwtz> hmm yeah I'm trying now
14:18 < jwtz> but it still doesn't work
14:18 < jwtz> do i need to add a route somewhere?
14:18 < krzee> are you running openvpn on the router for the LAN?
14:18 < jwtz> yeah it's a PFsense virtual machine
14:18 < jwtz> which is running openvpn
14:18 < jwtz> it's also the router
14:19 < krzee> and this virtual machine is the default gateway for your entire lan to use the internet?
14:19 < jwtz> that's correct
14:19 < krzee> seriously?  your lan's router is a virtual machine?
14:20 < jwtz> it's for a small business
14:20 < krzee> a confused small business?
14:20 < jwtz> we need to place the server in a reserved datacenter spot
14:20 < jwtz> so we dont have much coice
14:20 < jwtz> choice*
14:21 < krzee> the lan's router is moving to a datacenter, but the lan is not?
14:21 < krzee> <-- confused
14:21 < jwtz> the lan uses thin clients
14:21 < jwtz> well let me explain
14:21 < jwtz> the server is a terminal server which is placed in the datacenter
14:22 < jwtz> clients connect to one router, in this case the tomato to the internet
14:22 -!- newmember [~chatzilla@209.82.97.21] has joined #openvpn
14:22 < jwtz> the tomato has to have vpn connection to the server for printing purposes
14:24 < krzee> ya im not up to understanding your setup today
14:24 < krzee> heh
14:24 < jwtz> okay well anyway that wasn't why i was here hehe
14:33 < krzee> =]
14:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
14:38 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
14:40 < jwtz> wooh got it working!
14:40 < jwtz> thanks jpalmer 
14:41 < ChUbB> how can i kill off just 1 client? can i use tcpkill to kill off udp clients?
14:41 < jpalmer> jwtz: what was the ultimate problem?
14:41 < krzee> through the management interface
14:41 < krzee> !management
14:41 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface, or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
14:42 < jwtz> Oh I was being horribly stupid on this sunday evening :P
14:42 < jwtz> i entered 172.16.1.0/16 as remote LAN
14:42 < jwtz> after that i replaced it with 172.16.0.0/16
14:42 < jwtz> and it worked
14:42 < jpalmer> if you revoke the client key,  when it re-negotiates (ping-restart, or similar)  the key will fail,  and it'll drop the connection..  right?
14:42 < ChUbB> is there an easy way without using management?
14:43 < ChUbB> i am using ccd-exclusive to disable clients, so would like to diable a user and then bump their connection
14:47 < krzee> ping-restart, yes
14:47 < krzee> reneg, no
14:47 < jpalmer> I used the wrong term ;)  I mean,  re-auth,  not re-neg
14:50 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
14:50 -!- mode/#openvpn [+o dazo_afk] by ChanServ
14:50 < ChUbB> ?
14:52 -!- jwtz [d55d4dc9@gateway/web/freenode/ip.213.93.77.201] has quit [Quit: Page closed]
14:52 < jpalmer> ChUbB: basically,  we're saying:   set ping-restart to an appropriate value,  and when you revoke a client cert,   it'll handle things on it's own within a decent timeframe generally.
14:54 < jpalmer> krzee: I'm going to have one of the guys at work draw up a network diagram of our management network for you.  it's insanely brilliant,   simple yet complex,  and it works.
14:56 < ChUbB> jpalmer: ok, is there not a way to manually just specify and kill a connection? on a linux machine 
14:57 < jpalmer> ChUbB: you can do all kinds of things.   management interface,  null routes,  iptables, etc etc.
14:57 < jpalmer> but so far, based on what you've said,  all of those things are overkill.    a decent ping-restart value should suffice.
14:57 < krzee> jpalmer, cool, im definitely interested in seeing it, your setup is sweet
14:58 < jpalmer> krzee: to simplify,  I'll draw it up with 4 openvpn servers.   otherwise,  the diagram would be insane.
14:59 < jeev> are any of you crazy enough to use openvpn as your default gateway *at home* ?
14:59 < jpalmer> jeev:   depends on what I'm doing.   but sometimes,  yes.  I default route all my home traffic through a vps on the other side of the country.
15:00 < jpalmer> (I don't do it often, mind you.)
15:01  * jpalmer just got a notification that my black credit card reader for my iphone just shipped.    I can't wait to get it.
15:02 < krzee> i dont default route over my vpn
15:02 < krzee> instead i *mostly* route over it
15:02 <@vpnHelper> RSS Update - forum: Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11328>
15:02 < krzee> using sockd inside the vpn
15:04 -!- Yen [Yen@unaffiliated/yen] has quit [Ping timeout: 276 seconds]
15:04 < jeev> sorry was on the phone, my friend calls me a hypocrite for being a laker hater and wanting to watch the laker game (so they lose) he doesn't know what these words are, he just uses them :)
15:05 < jeev> jpalmer, latency ?
15:05 < jeev> krzee, sockd? for what
15:05 < jpalmer> jeev:   definately higher than when I don't.  but..  that VPS has some pretty darned good peering.   so it's not usually intolerable.
15:05 < krzee> !routE_by_app
15:05 < krzee> oops
15:05 < jeev> the forum post ?
15:05 < krzee> !route_by_app
15:06 < krzee> !factoids search route
15:06 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
15:06 < jeev> jpalmer, mind sharing where it is ? where are you located
15:06 < krzee> !routebyapp
15:06 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
15:06 < jeev> oh, very cool
15:06 < jpalmer> jeev:  I'm in florida.   they are in los angelas.
15:06 < jeev> i'm getting tired of pfsense, really sick of missing everything in the shell
15:06 < jeev> jpalmer, i'm in LA too :) who is the provider, msg me!
15:06 < jeev> i'm curious what you think good peering is
15:06 < jeev> everyone here has the same peers nowadays, it's sickening
15:06 < jpalmer> jeev: arpnetorks.com,  no sense in messaging.  I love them.
15:07 < jeev> oh
15:07 < jeev> i used to have one at arp
15:07 < krzee> ive never used pfsense, because to me it seems to be freebsd with tons of gui
15:07 < jeev> yea, they're cool
15:07 < krzee> since i <3 freebsd, and dont <3 gui, i just run freebsd
15:07 < jeev> it is krzee but sometimes i wanna do other stuff and it's annoying
15:07 < jeev> jpalmer, wish the owner would help a little more with qemu struggles but i dont think he cares
15:07 < jeev> he has so much experience with it
15:07 < K1ng> windows as server sucks
15:08 < jpalmer> jeev: I like them so much,  that I was helping them with support issues and DNS stuff.  in fact,  they just added a customer self-help portal for PTR and reverse delegation requests..   due to my work  ;)
15:08 < krzee> K1ng, s/as server//
15:08 < krzee> !windows
15:08 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
15:08 < K1ng> lol
15:09 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
15:09 < jeev> cool jpalmer, yea he has a lot of experience with qemu and stuff, i just always asked him to see if he could help me with some performance issues and i'd never get a response (on my own physical servers), now i dont blame him but you know..
15:09 < K1ng> krzee, have you seen my new site? ;p
15:09 < krzee> nope
15:09 < jeev> my biggest thing is why -cdrom installation is horrifically slow
15:09 < K1ng> www.k1ngdom.net
15:09 < K1ng> :p
15:09 < krzee> not sure if i saw your old site either
15:10 < K1ng> no flash but animations are like flash
15:10 < jeev> is that your real name ? heh
15:10 < K1ng> mine?
15:10 < K1ng> nope
15:10 < jpalmer> jeev:  part of the basic premise behind arp is,   if you need support,  you don't need arp.  he has a full time job,  so support issues and requests see a 24 to 48 hour turn around.
15:10 < K1ng> its my internet name :p
15:10 < K1ng> you cant pronunce my name :p
15:10 < jeev> K1ng, i get really excited when i meet foreigners (although i truly am a foreigner from armenia/iran) but i love giving them php work
15:10 < K1ng> my real name
15:10 < amir> krzee, what loglevel do you prefer for my problem? is 4 enough?
15:10 < jeev> yea jpalmer
15:11 < K1ng> amir, yes 4 is enough
15:11 < K1ng> krzee, like it?
15:12 < krzee> hey arent you a famous author?
15:12 < krzee> amir, whats the problem again?  tun errors right?
15:12 < jpalmer> krzee: typically,   openvpn sets the last octet as .1,  which is fine.  but is there any way to tell openvpn to start numbering the clients at say..  .30,   so you can use ccd for some clients but not all?
15:12 < krzee> gimme verb 5 just in care
15:12 < krzee> case*
15:12 < amir> krzee, exactly
15:13 < amir> krzee, directly after Initialization Sequence Completed
15:13 < krzee> jpalmer, yes, by re-inventing --server to your needs
15:13 < amir> krzee, next message is: us=7884 write to TUN/TAP : Invalid argument (code=22)
15:13 < amir> krzee, but the tunnel works
15:13 < krzee> --server is just a bunch of other options, it is a macro to make life easier
15:13 < krzee> amir, verb 5 pls
15:13 < amir> changing
15:13 < jpalmer> oh,  I wasn't aware of that.   good stuff.
15:14 -!- EugeneKaway is now known as EugeneKay
15:14 < jeev> hey, is it normal for example, 10.10.10.1 to be bound on the interface, when dhcp hands out the ip of 10.10.10.3.6 with gateway of 10.10.10.5, you can't ping .5, it's not bound to the interface, if you bring it up as an alias, it will respond
15:14 < amir> now, i hope this tells you something
15:14 < amir> krzee, it doesn't to me :(
15:14 < amir> krzee, rWrWWRrWRwRwrWRwRwrWRwrWRwRwrWrWRwRwrWrWRwRwrWrWRwRwrWrWRwRwRwrWrWRwRwrWrWRwRwrWrWRwRwrWrWRwRwrWrWRwrWRwrWrWRwRwrWrWRwRwrWrWrWrWRwRwRwRwRwRwrWrWrWRwRwrWrWRwrWrWRwRwrWrWRwRwrWRwrWrWRwRwRwRwrWRwRwrWRwrWRwRwRwRwSun Apr 17 22:13:37 2011 us=541986 write to TUN/TAP : Invalid argument (code=22)
15:15 < krzee> amir, pastebin both sides of the log
15:15 < krzee> client and server
15:15 < ChUbB> If I want to route internet traffic through my vpn, i am using tap setup, I have enabled ip forwarding on my server, added the route to my desktop, am i missing anything ?
15:15 < amir> krzee, oh, u need lvl 5 on the client as well?
15:15 < jeev> jpalmer, now i am considering launching ovpn personally at home on my desktop
15:15 < krzee> couldnt hurt
15:15 < amir> ok
15:15 < amir> 2sec
15:15 < jeev> i could do it on pfsense too i guess but i dont neeed to vpn everything
15:16 < krzee> amir, also, what os is on each side, and version of openvpn?
15:16 < amir> krzee, linux, 2.6.36-gentoo-r8 (client), 2.6.34-gentoo-r12 (server), net-misc/openvpn-2.1.4
15:17 < krzee> good stuff
15:18 < amir> ;)
15:19 < amir> ha!
15:19 < amir> strange
15:19 < amir> now i see new messages: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
15:20 < amir> server: http://pastebin.com/fLJg1TCp
15:21 < amir> client: http://pastebin.com/HftcNNv3
15:21 < amir> ah, the refuse comes from the client restart
15:22 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
15:24 -!- K1ng\ [~KING@180.211.188.63] has joined #openvpn
15:27 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
15:27 -!- zayka [~zayka@vir1a.toonel.net] has quit [Ping timeout: 246 seconds]
15:27 -!- K1ng [~KING@180.211.188.63] has quit [Ping timeout: 246 seconds]
15:27 -!- nijotz [~nick@nijotz.com] has quit [Ping timeout: 246 seconds]
15:27 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
15:28 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has quit [Ping timeout: 246 seconds]
15:28 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
15:28 -!- nijotz [~nick@173.255.220.4] has joined #openvpn
15:28 < amir> krzie, nothing special visible, right?
15:32 -!- APTX [APTX@phpBB/developer/APTX] has quit [Ping timeout: 248 seconds]
15:32 < amir> it just goes on and on and on:
15:32 < amir> http://pastebin.com/H9S81NvR
15:41 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
15:43 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:44 < krzee> amir, i got d/c, did you paste the logs yet?
15:44 < amir> yep
15:44 < amir> let me see
15:44 < amir> <amir> server: http://pastebin.com/fLJg1TCp
15:44 < amir> <amir> client: http://pastebin.com/HftcNNv3
15:44 < amir> the refuse u see comes from a client restart
15:45 < amir> afterwards:
15:45 < amir> <amir> it just goes on and on and on:
15:45 < amir> <amir> http://pastebin.com/H9S81NvR
15:45 -!- newmember [~chatzilla@209.82.97.21] has quit [Ping timeout: 260 seconds]
15:48 < krzee> hrm
15:48 < krzee> drop the configs on a pastebin too please
15:48 < krzee> (without comments of course)
15:51 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Remote host closed the connection]
15:56 < amir> krzee, ok
15:57 < amir> krzee, server: http://pastebin.com/y5EpB6RP
15:58 -!- rajkosto [rajkosto@wan.rajkonet.info] has joined #openvpn
15:58 < rajkosto> for ccd files
15:58 < amir> krzee, client: http://pastebin.com/hMnWjLfb
15:58 < rajkosto> is it the same as just including that file after the end of the main config ?
15:58 < amir> rajkosto, essentially yes
15:58 < rajkosto> or will only special configuration directives work
15:59 < amir> rajkosto, there are some directives not working in ccd 
15:59 < amir> rajkosto, but most work
15:59 < rajkosto> hmm, but i cant have them propagate to other clients
15:59 < amir> some of them you can "push" to clients
15:59 < rajkosto> like i cant have a route kick in to other clients when some client connects
15:59 < amir> nope
15:59 < amir> i tried that, but routes need to be done in the main config
16:00 < rajkosto> whats the deal with iroute then
16:00 < amir> that's essentially an "internal routing table"
16:00 < amir> which you fill by yourself
16:00 < amir> and which gets used if a tun device connects to several layer 3 nodes
16:01 < amir> in essence routing can not know, which client you want to reach as it only routes to a device and not to a node on a device
16:01 < amir> THEN that internal routing table built from iroute statements gets used
16:01 < amir> note: overlapping addresses in iroute do NOT work
16:02 < rajkosto> well i just use openvpn for anonymous internet access
16:02 < rajkosto> but now, one client isnt just a single computer, but a home router
16:02 < rajkosto> which behind it has a /24
16:02 < rajkosto> do i need to use iroute then ?
16:03 < krzee> [13:58]  <rajkosto> is it the same as just including that file after the end of the main config ?
16:03 < krzee> not quite
16:03 < amir> yes, if you use topology subnet you need iroute statements
16:03 < krzee> its like that, but ONLY for the client that is named exactly as the file
16:03 < krzee> !ccd
16:03 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
16:04 < krzee> rajkosto, you only need iroute if you intend to share the lan behind that client
16:04 < krzee> !iroute
16:04 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
16:04 < rajkosto> yeah i want everyone to be able to access those computers
16:04 < amir> krzee, you need it as soon as you have two vpn links which two subnets behind them, right?
16:04 < krzee> amir, you have pre-existing tun1 made, right?
16:04 < amir> s/which/with
16:05 < amir> nope
16:05 < krzee> ahh hah!
16:05 < krzee> found the problem then
16:05 < amir> i thought it would create it?
16:05 < rajkosto> so iroute 172.16.1.0 255.255.255.0 in the ccd file for the connecting router
16:05 < amir> and it does!
16:05 < krzee> if you want dynamic devices, you just use dev tun
16:05 -!- luneff [~yury@84.51.192.6] has joined #openvpn
16:05 < krzee> dev tun1 is a static device, you must make it before-hand
16:05 < amir> i don't want dynamic devices.. i want one per config file
16:05 < amir> always the same
16:05 < rajkosto> and route 172.16.1.0 255.255.255.0 in the main confg ?
16:05 < krzee> if dev tun1 is there, its because you have another config using it or something
16:06 < amir> krzee, hmm
16:06 < krzee> trust me, dev tun will work dynamically, dev tun1 you need to make it first
16:06 < amir> really?!
16:06 < amir> ic
16:06 < krzee> openvpn --mkdev or something like that
16:06 < amir> --mkdev?
16:06 < amir> huh, never saw that
16:06 < amir> searching
16:06 < krzee> you make the static device before hand
16:06 < krzee> must do so when using dev tun# instead of dev tun
16:06 < amir> with tunctl ?
16:07 < amir> yeah, but if i use tun and i have several server i can't be sure who's getting which one, right?
16:07 < amir> and my firewall rules looking for incoming devices will fail
16:07 < krzee> --mktun
16:07 < krzee> there it is
16:07 < amir> ic
16:08 < rajkosto> and i ALSO need push "route xxxx"
16:08 < krzee> rajkosto, 
16:08 < krzee> !route
16:08 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:08 < amir> krzee, i can add --mktun to the configfile, right?
16:08 < krzee> amir, no
16:09 < krzee> you do it one time
16:09 < rajkosto> openvpn routing is kinda weird because i dont specify the gateway ip
16:09 < amir> krzee, i have udev
16:09 < krzee> rajkosto, you dont need to as long as you are saying to send it over the vpn
16:09 < amir> krzee, devices won't be persistent over reboots, right?
16:09 < krzee> amir, why dont you test it for yourself
16:09 < rajkosto> amir, just do it in init.d
16:09 < amir> krzee, i'm already routing over the stuff
16:10 < pwrcycle> anyone know of any iPhone apps that work with OpenVPN?
16:10 < amir> rajkosto, ok, so i need to set that up on every reboot
16:11 < krzee> !iphone
16:11 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
16:11 <@vpnHelper> iPhone and iPad.
16:13 < amir> hmm
16:14 < amir> just tested it, stopped the server, run:
16:14 < amir> /usr/sbin/openvpn --config /etc/openvpn/dualcore.conf --mktun
16:14 < amir> then restarted it
16:14 < amir> Sun Apr 17 23:12:52 2011 us=283465 write to TUN/TAP : Invalid argument (code=22)
16:14 < amir> still getting it
16:15 < krzee> lol
16:15 < krzee> [14:08]  <amir> krzee, i can add --mktun to the configfile, right?
16:15 < krzee> [14:08]  <krzee> amir, no
16:15 < krzee> [14:09]  <krzee> you do it one time
16:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
16:15 < krzee> that didnt mean "yes, add it to your cli options"
16:15 < krzee> (which is the same as putting it in the config"
16:15 < krzee> )
16:15 < amir> then i must confess i'm confused
16:16 < rajkosto> in init.d
16:16 < rajkosto> before the final openvpn launch
16:16 < rajkosto> add openvpn --mktun tun0
16:16 < rajkosto> openvpn --mktun tun1
16:16 < amir> ahhh
16:16 < amir> it has an argument
16:16 < amir> that's the problem probably
16:16 < krzee> close
16:16  * amir thought it would look into the config file
16:16 < krzee> openvpn --mktun --dev tun0
16:16 < amir> icic
16:16 < krzee> i thought the manual would be easy enough to read
16:16 < krzee> i guess not =/
16:17  * amir tried to get it to use the config file for the dev statement :(
16:17 < amir> silly me
16:17 < amir> ahh, looks better now
16:18 < amir> krzee, if you would like to get feedback on documentation, i'm happy to describe my experiences
16:18 < krzee> better than describe, if you would like to suggest changes to it, feel free to submit trac tickets
16:18 < krzee> !trac
16:18 <@vpnHelper> "trac" is see http://community.openvpn.net for development information and bug tracker.
16:19 < krzee> same login/pass as the forum
16:19 < amir> it's essentially two simple comments: 1. the two modes ptp & client/server do not stick out as really two different operating modes
16:19 < amir> as a novice one has the feeling that they mix and that one can use tls options in ptp and vice versa
16:20 < rajkosto> also the addresses in ifconfig in the ccd files in the howto seem to be reversed
16:20 < krzee> OpenVPN supports conventional encryption using a pre-shared secret key (Static Key mode) or public key security (SSL/TLS mode) using client & server certificates. OpenVPN also supports non-encrypted TCP/UDP tunnels.
16:20 < amir> 2. i get the feeling that the ptp mode is explained in less detail as the newer stuff 
16:20 < krzee> 3rd paragraph in "Description" in the manual
16:20 < amir> yeah
16:20 < amir> but it never says that they are DISTINCT operating modes
16:20 < krzee> thats what OR means
16:20 < amir> ;)
16:21 < krzee> =]
16:21 < rajkosto> since everything breaks if i put them like that in my ccd files
16:21 < krzee> however, as i said, feel free to submit trac tickets with suggested changes
16:21 < rajkosto> if i put them backwards, they work perfectly
16:21 < amir> krzee, not sure what i should suggest as "change"
16:21 < krzee> amir, it is well understand that some things in the manual need updating, but its a huge undertaking
16:22 < amir> krzee, i think it's something the next docu write would have to keep in mind while rewriting the stuff
16:22 < krzee> amir, i gotchya, maybe just suggest the gist of the change then
16:22 < amir> ok
16:22 < amir> will ponder how to describe that
16:22  * amir is no native english speaker ;)
16:22 < krzee> rajkosto, ive heard someone else say that, it came down to them not understanding
16:22 < krzee> you cant just look at the last 2 octets and blindly think you know what they were doing
16:23 < krzee> the example you are looking at is actually talking about something else, look at the entire subnet they are using
16:23 < krzee> not just the final octet
16:24 < rajkosto> well isnt it +0 = network +1 = server +2 = client +3 = broadcast
16:25 < rajkosto> for each /30 ?
16:26 < amir> hmm, where in /dev do the tun devices get created?
16:26 < amir> mktun seems to work, but starting ovpn afterwards still results in the messages :(
16:27 < amir> at least it says:
16:27 < amir> Sun Apr 17 23:22:49 2011 TUN/TAP device tun2 opened
16:27 < amir> Sun Apr 17 23:22:49 2011 Persist state set to: ON
16:28 < krzee> rajkosto, i have no idea what you tried to say with that math
16:28 < rajkosto> pull up that page that explains /30 layout
16:28 < rajkosto> i dont know the ! trigger for it
16:28 < krzee> !/30
16:28 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
16:29 < amir> very strange
16:29 < amir> now i can not start ovpn anymore
16:29 < krzee> amir, check how many instances are running
16:30 < rajkosto> ok so the openvpn server itself binds to tun0 on the server computer with 172.16.0.0/30 (ptp .1 and .2)
16:30 < rajkosto> the first client after that is .6
16:30 < amir> krzee, just that one
16:30 < krzee> correct...
16:30 < krzee> (@ rajkosto )
16:30 < amir> Sun Apr 17 23:29:39 2011 us=652585 /sbin/ip addr add dev tun1 local 172.18.254.1 peer 172.18.254.2
16:30 < amir> RTNETLINK answers: File exists
16:30 < amir> Sun Apr 17 23:29:39 2011 us=655447 Linux ip addr add failed: external program exited with error status: 254
16:30 < rajkosto> so ccd/client1 would have ifconfig-push 172.16.0.6 172.16.0.5
16:30 < rajkosto> correct ?
16:31 < krzee> !static
16:31 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.5 10.8.0.6 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
16:31 < amir> krzee, where in /dev should the tunX devices show up?
16:31 < krzee> no
16:31 < krzee> --ifconfig-push local remote-netmask 
16:31 < krzee> Push virtual IP endpoints for client tunnel, overriding the --ifconfig-pool dynamic allocation. 
16:31 < krzee> The parameters local and remote-netmask are set according to the --ifconfig directive which you want to execute on the client machine to configure the remote end of the tunnel. Note that the parameters local and remote-netmask are from the perspective of the client, not the server. 
16:31 < krzee> "Note that the parameters local and remote-netmask are from the perspective of the client, not the server."
16:32 < krzee> when in doubt, READ THE MANUAL!
16:32 < rajkosto> ok, well it works this way, the other way the clients cant even ping the server..
16:32 < krzee> i love how people decide that the wrong things work, then come for help cause their stuff doesnt work
16:33 < rajkosto> how do i make the "correct" way work then ?
16:33 < krzee> ifconfig-push 10.8.0.5 10.8.0.6
16:33 < rajkosto> that makes the client get 10.8.0.5 as its own ip
16:33 < rajkosto> whereas in the 10.8.0.4/30 subnet, +1 (.5) is supposed to be the server ip
16:34  * krzee double-takes
16:34 < krzee> wait, that is right
16:34 < krzee> i must have it backwards on my bot
16:34 < krzee> local for client is .6
16:34 < rajkosto> ha-ha !
16:34 < rajkosto> but look at the howto
16:34 < rajkosto> it says the same thing
16:34 < rajkosto> its very confusing
16:35 < krzee> ccd/contractor2
16:35 < krzee> ifconfig-push 10.8.2.5 10.8.2.6
16:35 < krzee> =/ hrm
16:35 < krzee> have you submitted a trac ticket?
16:35 < rajkosto> no
16:35 < krzee> will you?
16:35 < rajkosto> was it ever in the view of the server ? and then the documentation didnt get updated ?
16:35 < krzee> nah it hasnt changed to my knowledge
16:36 < rajkosto> do you have a working config that uses it ?
16:36 < rajkosto> what does it use ?
16:36 < krzee> all my configs use topology subnet
16:36 < rajkosto> (so that my openvpn isnt magic and parses it backwards)
16:36 < krzee> what you said adheres to the manual
16:36 < krzee> cite that as a source in the trac ticket
16:36 < krzee> basically, what i pasted to you
16:37 < krzee> heheh
16:37 < rajkosto> cant you just open it for me ?
16:38 < krzee> !change static 2 s/6/5/
16:38 <@vpnHelper> Joo got it.
16:38 < krzee> !change static 2 s/5/6/
16:38 <@vpnHelper> Joo got it.
16:38 < krzee> !static
16:38 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
16:38 < krzee> better
16:40 < amir> hmm
16:40 < amir> i do a "/usr/sbin/openvpn --mktun --dev tun1" now before starting and a "/usr/sbin/openvpn --rmtun --dev tun1" after stopping
16:40 < amir> strangely i still get that error message :(
16:40 < krzee> why remove it after stopping?
16:40 < rajkosto> why do you even have to have them numbered amir 
16:41 -!- ChUbB [~IceChat7@cpc2-aztw12-0-0-cust229.aztw.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
16:41 < krzee> so you can tell them apart!?
16:41 < amir> rajkosto, so that my firewall rules will always work
16:41 < amir> krzee, now, i though recreating them on next start would fail if i do not remove them
16:41 < rajkosto> you can use tun+ in iptables to signify tunX
16:41 < rajkosto> and apply rules based on subnets
16:41 < krzee> you dont need to keep recreating them
16:42 < rajkosto> amir, even if the first openvpn invocation fails
16:42 < rajkosto> the 2nd openvpn invocation isthe one that starts the server
16:42 < krzee> [14:15]  <krzee> [14:08]  <amir> krzee, i can add --mktun to the configfile, right?
16:42 < krzee> [14:15]  <krzee> [14:08]  <krzee> amir, no
16:42 < krzee> [14:15]  <krzee> [14:09]  <krzee> you do it one time
16:42 < krzee> when i say *1* time
16:42 < amir> krzee, as i implemented --mktun in start() it will get done again on the next init.d start
16:42 < krzee> i dont mean *every* time
16:42 < krzee> i actually really mean *1*
16:43 < amir> now, i restart openvpn with my init.d scripts
16:43 < rajkosto> because it actually makes a device node, that will stick forever
16:43 < amir> so these get started several times
16:43 < amir> rajkosto, persistent over reboots?
16:43 < amir> rajkosto, i thought not
16:43 < rajkosto> depends if your /dev gets recreated on reboots
16:43 < rajkosto> i guess
16:43 < krzee> amir, how hard is it to reboot?
16:44 < rajkosto> you should try it
16:44 < amir> where should i find a created tun1 devices?
16:44 < krzee> ifconfig
16:44 < krzee> lol
16:44 < amir> and in /dev ?
16:44 < amir> i don't see it?
16:44 < krzee> ifconfig!
16:44 < rajkosto> its just an interface
16:44 < krzee> i didnt say /dev
16:44 < amir> ic, no device file
16:44 < krzee> i said ifconfig
16:44 < krzee> its there somewhere, and it depends on your OS
16:44 < amir> now, i have it there
16:44 < krzee> ifconfig!
16:44 < teloniusz> amir: if you want a file, go into /proc
16:44 < krzee> lol
16:44 < amir> but it STILL gives me an error message!
16:45 < teloniusz> or better /sys
16:45 < amir> tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
16:45 < amir>           inet addr:172.18.254.1  P-t-P:172.18.254.2  Mask:255.255.255.255
16:45 < amir> it's there
16:45 < rajkosto> !topology
16:45 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
16:45 < amir> and it was there even without a --mktun
16:45 < krzee> did you feel we needed to see it?
16:46 < amir> had the feeling you don't belive me ;)
16:46 < krzee> you rebooted?
16:46 < amir> i still don't understand why i need to create a device node, when it's already there, up and running
16:46 < amir> yes
16:46 < rajkosto> wow, topology sounds much better
16:46 < amir> and i will reboot another time now
16:46 < amir> let me check ifconfig directly after reboot
16:47 < krzee> amir, if you had a clean system with nothing running, dev tun1 should not work unless you made a static device
16:47 < rajkosto> amir, if you specify tun, it will dynamically allocate tun devices, and they will show up in ifconfig while openvpn is running
16:47 < amir> what happens if i do BOTH?
16:47 < amir> i have a ovpn instance in client/server mode, with dynamic tun
16:47 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:48 < amir> and i have two instances of ovpn with 2 static tun
16:48 -!- K1ng\ [~KING@180.211.188.63] has quit [Read error: Connection reset by peer]
16:48 < krzee> then you were likely trying to use the existing interface twice
16:48 < krzee> and that was what was causing the problem
16:48 < amir> so i need to use a static tun for the client/server instance as well?
16:48 < amir> [that's tun0 atm]
16:48 < krzee> prolly the smartest thing to do
16:48 < amir> ic
16:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:49 < amir> now, let's change that
16:50 < rajkosto> topology makes much more sense to use than /30, thanks krzee 
16:50 < krzee> np
16:51 < krzee> i agree, i like it better
16:51 < krzee> there is a case where you want /30 tho
16:51 < rajkosto> ptp
16:51 < rajkosto> on windows
16:51 < krzee> if you use static firewalls (ie: not --learn-address to generate them)
16:51 < krzee> because if you gimme a static ip and firewall based on it
16:51 < krzee> i can ifconfig myself a new IP
16:51 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
16:51 < amir> i think i have a different problem: if i check ifconfig, and i have no tun devices, then use --mktun, and then check again, i do NOT see a tun device?!
16:51 < krzee> if im in net30, it will break
16:52 < krzee> if im in topology subnet or dev tap, it will not break
16:52 < krzee> ifconfig -a
16:52 < rajkosto> you mean people can set their own ips in topology ?
16:52 < krzee> lol
16:52 < krzee> rajkosto, they can manually override their ip in ANY setup, its their computer
16:52 < amir> ah
16:52 < amir> they are there, but down
16:52 < krzee> in topology subnet, it will not break the vpn
16:52 < krzee> in topology net30 it will
16:53 < amir> so, let's reboot and recheck if they are there
16:53 < rajkosto> add "and it will work" to the end of my last question lol
16:53 < krzee> however, you can make smarter firewall scripts that coordinate the rules with the client, not just the ip
16:53 < rajkosto> usually if you try to do such shenanigans on a isp, you wont get internet
16:54 < krzee> rajkosto, its not that they "can set their own ip"  like in some openvpn way
16:54 < krzee> but it is their machine, they have access to ifconfig to any ip they want
16:54 < krzee> rajkosto, one of my colo's isnt setup very well
16:54 < krzee> i can ifconfig any ip on my /24
16:54 < krzee> in fact sometimes i do steal a few IPs
16:55 < krzee> i have a list of nmap ping sweeps of the /24
16:55 < rajkosto> usually their routers coordinate with their dhcp server
16:55 < krzee> i make sure to steal IPs that are consistently not in use ;)
16:55 < rajkosto> and only allow packets to ips which are in the dhcp table
16:55 < amir> o O ( not persistent accross reboots :( )
16:55 < krzee> thats wonderful
16:56 < krzee> amir, then make sure they get made on boot
16:56 < krzee> they never need to be made again after
16:56 < amir> i just wonder how to guarantee that they get created only ONCE :(
16:56 < amir> adding it to init.d will not make sure that it's started only once
16:56 < rajkosto> on topology, do i need to use "bypass-dhcp" if i already use def1 in "redirect-gateway"
16:57 < krzee> amir, make a new init.d script :-p
16:57 < amir> right
16:57 < krzee> but make sure its run BEFORE the openvpn one
16:57 < amir> good idea
16:57 < amir> :D
16:57  * amir bangs his head against the wall
16:57 < amir> kinda complicated :(
16:57 < rajkosto> usually you can do that with just a "depends-on" line somewhere near the top
16:58 < rajkosto> or simply make it a lower runlevel
16:58 < amir> why doesn't ovpn just check if the device is there and create it if it's not?
16:58 < rajkosto> because you need root for that i guess
16:58 < amir> just because i tell it which number to use, that does not hinder it to check and handle that?
17:00 -!- K1ng [~KING@180.211.188.63] has joined #openvpn
17:00 < amir> and what i wonder also: why does it _work_, even trough i did not create the tun devices but specify a number?!
17:01 < rajkosto> !iroute
17:01 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
17:01 < rajkosto> !route
17:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
17:04 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
17:04 < rajkosto> with topology, i need a gateway parameter to route/iroute, yes /
17:04 -!- luneff [~yury@84.51.192.6] has joined #openvpn
17:11 < krzee> rajkosto, no
17:11 < krzee> and btw, you mean to say topology subnet
17:11 < krzee> net30 is a topology as well
17:12 < rajkosto> # route used with subnet topology
17:12 < rajkosto> route 10.0.55.0 255.255.255.0 10.0.8.1
17:12 < krzee> no
17:12 < krzee> my document in !route is correct
17:12 < krzee> dont start thinking you need to change it
17:12 < rajkosto> OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
17:12 < krzee> if you are getting an error saying something about a missing parameter, you have another issue
17:13 < krzee> yep, you have another issue =]
17:13 < krzee> !configs
17:13 < krzee> and
17:13 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:13 < krzee> !logs
17:13 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:13 < rajkosto> no its just some document i saw 
17:13 < rajkosto> that had it
17:13 < krzee> thats wonderful, you dont need it
17:14 < krzee> 90% of the crap on google re: openvpn is complete crap
17:14 < rajkosto> same as for iptables 
17:14  * amir dislikes this modern device stuff where you do no longer always have a device file in /dev for your stuff
17:14 < rajkosto> amir, deal with it
17:14 < amir> yeah, i have to ;)
17:14 < krzee> amir, its your OS, figure out how it works
17:14 < krzee> its somewhere
17:15 < krzee> its not openvpn related
17:15 < amir> now, it's there ;)
17:15 < amir> it's just not visible in udev
17:15 < krzee> i can tell you where they are in MY systems
17:15 < krzee> not that it matters AT ALL
17:15 < amir> i see them with ifconfig, as you said
17:15 < krzee> right, thats how you should be
17:17 < amir> lol, now i even need to load the tun module by hand
17:17 < amir> that's really back to the roots :)
17:17 -!- Rajko [rajkosto@cable-94-189-153-232.dynamic.sbb.rs] has joined #openvpn
17:17 < krzee> thats really really easy
17:17 < krzee> but again, depends on your OS
17:17 < amir> yeah
17:17 < amir> it is
17:17 < amir> ;)
17:18 < amir> makes me wonder why openvpn loads the tun module sometimes, but not on a --mktun
17:18 -!- Rajko [rajkosto@cable-94-189-153-232.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
17:19 < amir> does that have to do with ptp being the "old style" openvpn?
17:19 < krzee> make a trac ticket with the suggestion if you care
17:19 < amir> seems i have to make a list soon ;)
17:19 -!- rajkosto [rajkosto@wan.rajkonet.info] has quit [Ping timeout: 240 seconds]
17:19 < krzee> or you could just add them as they come up
17:20 < amir> to be true, my fingers are itching .... i once wrote a ppp with encryption, so hacking openvpn would be nice stuff ;)
17:20 < krzee> then you dont need lists, or to remember anything
17:20 < amir> and probably not soo far away from the stuff i know
17:20 < krzee> oh well ya you're certainly welcome to submit patches in the tickets as well
17:21 < amir> ;)
17:21 < amir> yeah, i can imagine ;)
17:21 < krzee> but it is not a requirement for adding the ticket
17:21 < krzee> =]
17:21 < teloniusz> amir: it's not modern in any way - network devices never have been there (in Linux, anyway)
17:21 < amir> how many guys are actively working on openvpn?
17:22 < amir> teloniusz, i pondered that some minutes ago, and i was no longer certain if they showed up or not ... i couldn't remember seeing eth0 for example :}
17:22 < teloniusz> network device in no simple sense can be represented as a character or block device
17:23 < krzee> amir, feel free to check out the git tree, i think you can check that publicly
17:23 < amir> will do
17:23 < amir> have to get more fluid first
17:23 < krzee> as far as actively working on it, im not sure
17:23 < krzee> the weekly meetings are often like 10 people
17:24 < krzee> but 1 of those is me, and i dont contribute code
17:24 < amir> and to be true: i have a big international OSS project going on myself
17:24 < krzee> and theres some people who do contribute but dont really join IRC
17:24 < amir> so i'm not so sure i should did into new ones ;)
17:24 < amir> dig*
17:24 < teloniusz> a general question
17:24  * amir normally plays over there: http://ng.uavp.ch
17:25 < amir> and before that, i did some quagga hacking
17:25 < teloniusz> afaik there is no way to make openvpn in current version distributed in such a way that client-to-client communication doesn't go through the server, right?
17:25 < amir> teloniusz, you could use a 3. link
17:26 < amir> teloniusz, i will do exactly that
17:26 < teloniusz> 3. link?
17:26 < amir> teloniusz, 2 sites connect to a third, and the first two connect to each other
17:26 < amir> teloniusz, all 3 ptp
17:26 < krzee> amir, some devs are .ch too
17:26 < amir> heh, the world is small ;)
17:26 < teloniusz> Ah, I see, obvious if you think about it
17:26 < teloniusz> but not general ;)
17:27 < amir> teloniusz, i do it especially that the two sites can exchange data without going trough the server
17:27 < krzee> all client -> client traffic flows through the server
17:27 < amir> teloniusz, having ospfd on all routers makes it easy to choose the right link
17:27 < krzee> there is a wish in the wishlist for that to not be true
17:27 < krzee> !wishlist
17:27 <@vpnHelper> "wishlist" is https://forums.openvpn.net/viewforum.php?f=10 for the openvpn wishlist
17:27 < krzee> however, it will not happen until openvpn 3
17:27 < teloniusz> still, it needs more than one tun/tap device for a client, doesn't it?
17:28 < krzee> which will be basically a complete re-write
17:28 < amir> teloniusz, yep
17:28 < krzee> teloniusz, amir is talking about making a mesh
17:28 < teloniusz> krzee: and that's an answer to my next question about it ;)
17:28 < krzee> something that openvpn itself doesnt "support" but you can make one using openvpn
17:28 < amir> krzee, which essentially does what teloniusz wants, dosn't it?
17:28 < teloniusz> in fact
17:28 < krzee> amir, depends really
17:29 < krzee> amir, if he has 150 clients, probably not
17:29 < teloniusz> I'd like openvpn to make a real subnet topology
17:29 < krzee> lol
17:29 < amir> krzee, LOL, yes :)
17:29 < teloniusz> yeah ;>
17:30 < teloniusz> even 10 clients would be pretty tough that way
17:30  * amir nods
17:30  * amir agrees
17:30 < krzee> right
17:30 < |Mike|> *barf*
17:30 < krzee> 3 or 4 is do-able, after that you better have programs managing it
17:31 < amir> that gets crazy, if you have a software layer over topology ;)
17:31  * amir once implemented flow-based routing with standard linux components
17:31 < amir> was messy like hell ;)
17:32 < amir> but you can remote controll everything if done right ;)
17:33 < amir> iptable's mangle table ftw ;)
17:33 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
17:33 -!- Nappy [~nappy@123-247.97-97.tampabay.res.rr.com] has quit [Quit: Leaving]
17:34 < teloniusz> krzee: can't find it on the wishlist, do you have a more specific url?
17:35 < amir> calling mktun automatically is definitivly on my wishlist and probably will make it into a ticket soon
17:35 < krzee> sure lemme look at the wishlist for you
17:35 < krzee> why?
17:36 < krzee> if you want it made automatically, dont use static devs
17:36 < krzee> it shouldnt matter if the vpn uses tun0 or tun1 or tun2
17:36 < krzee> when you use static devices, you are saying that you would like that stuff to be YOUR job
17:36 < amir> it does if your firewall checks incoming devices
17:36 < krzee> make your firewall better? :-p
17:36 < amir> better?
17:37 < amir> that's no question of "better"
17:37 < amir> it's less specific
17:37 < amir> which most of the time leads to less secure
17:37 < krzee> well since you are using a routing protocol over it, its safe to say the rules are the same for each
17:37 < krzee> since each may be passing packets from the same networks
17:37 < amir> yeah, i pondered that
17:37 < amir> and decided against
17:37 < krzee> tun+ will count for ALL tun devices in iptables
17:37 < amir> which will probably break stuff, in the failover case
17:37 < krzee> or you can firewall based on subnet
17:37 < amir> but i will live with that
17:38 < amir> now, not all tun are the same
17:38 < krzee> or you can use static devs, and understand that mktun is your job
17:38 < amir> the iDevice tun is handled different from the 2 site-tun's
17:38 < krzee> because when you choose static devices, you are saying you dont want openvpn to do that stuff
17:38 < amir> yeah, makes sense
17:39 < amir> and if there would be config stuff to do, i would understand
17:39 < amir> but it just creates them... without endpoints and stuff
17:39 < amir> and in the end i create them using openvpn ;)
17:39 -!- rajkosto [bitrot@cable-94-189-153-232.dynamic.sbb.rs] has joined #openvpn
17:40 < rajkosto> hmm the server cant contact the network behind the vpn client
17:40 < amir> btw: tunctl would create the same devices?
17:40 < krzee> actually
17:40 < krzee> you can config them manually as well
17:40 < rajkosto> and doing "ip route" on the server doesnt show entry for 172.16.1.0/24
17:40 < amir> krzee, ah, ic
17:40 < rajkosto> even thought ive added both route and push route into server.config
17:40 < amir> krzee, but there's no need, ovpn will do that for me later on
17:40 < krzee> right
17:41 < rajkosto> ah
17:41 < rajkosto> im getting that error krzee 
17:42 < rajkosto> http://codepad.org/SSXvCMVV
17:42 <@vpnHelper> Title: Plain Text code - 2 lines - codepad (at codepad.org)
17:42 < amir> wtf! i'm still getting the damn mesage ?!?
17:42 < krzee> check your ccd file was read
17:42 < amir> openvpn[5982]: write to TUN/TAP : Invalid argument (code=22)
17:42 < krzee> oh that
17:42  * amir starts to cry
17:42 < krzee> rajkosto, you still never did what i said to do before when you gave that error
17:42 < rajkosto> you want my config files
17:43 < krzee> and complete logs
17:43 < krzee> 2 lines doesnt help
17:43 < krzee> no comments in configs, verb 4
17:43 < amir> hmpf
17:43  * amir scratches his head
17:44 < rajkosto> server.conf http://codepad.org/JLMWjMzj
17:44 <@vpnHelper> Title: Plain Text code - 32 lines - codepad (at codepad.org)
17:44 < krzee> amir, wanna test something for me?
17:44 < krzee> try commenting comp-lzo on both sides
17:44 < amir> tell me what you need
17:44 < amir> .k
17:44 < rajkosto> ccd for the client with the /24 behind it http://codepad.org/eBa2jjrH
17:44 <@vpnHelper> Title: Plain Text code - 2 lines - codepad (at codepad.org)
17:44 < amir> i've read about that in a post somewhere
17:45 < krzee> push "172.16.1.0 255.255.255.0"
17:45 < krzee> i think you're missing a word there
17:46 < rajkosto> the error is still there
17:46 < krzee> right
17:46 < rajkosto> http://codepad.org/SH4IR8Ae
17:46 < krzee> but that certainly needed fixing too
17:46 <@vpnHelper> Title: Plain Text code - 22 lines - codepad (at codepad.org)
17:46 < krzee> ok, we're half way there
17:46 < rajkosto> client log ?
17:47 < krzee> and config
17:47 < krzee> lol
17:47 < amir> o O ( can't start openvpn after a restart?! )
17:47 < amir> openvpn[6412]: Linux ip addr add failed: external program exited with error status: 254
17:47 < amir> ever saw that?
17:47 < rajkosto> client confg http://codepad.org/N4GqvEgi
17:47 <@vpnHelper> Title: Plain Text code - 22 lines - codepad (at codepad.org)
17:48 < rajkosto> wait, do i need a push "topology subnet" ?
17:48 < amir> STRANGE, i had to --rmtun, --mktun, to be able to start openvpn again 
17:48 < rajkosto> in the server config ?
17:49 < rajkosto> or "topology subnet" in the client config
17:49 < |Mike|> ....
17:49 < |Mike|> r
17:49 < |Mike|> t
17:49 < rajkosto> i think it knows its a topology subnet, because it set up all the ips properly
17:49 < amir> krzee, ok, back up, without lzo
17:50 < krzee> same thing?
17:50 < amir> yep
17:50 < amir> what's also strange, is that it happens ONLY on one of the ptp links
17:50 < krzee> ya thought so
17:50 < rajkosto> krzee, whatever client confg i have, its not gonna fix the "failed to set up route" error on the server
17:50 < krzee> worth a try tho
17:50 < amir> the second does not issue a message
17:50 < amir> nor does the client/server instance
17:50 < krzee> amir, im still thinking there are 2 links trying to use the same interface
17:51 < krzee> i may be wrong, but it still seems that way to me
17:51 < amir> i specially grepped for "dev tun"
17:51 < amir> let me do that again
17:51 < krzee> you could check if your firewall rules are screwing you up tho
17:52 < rajkosto> should i just add the 3rd option to all the route commands ?
17:53 < amir> krzee, double checked, i'm using 3 times a numbered tunX
17:54 < amir> krzee, you think i could drop the wrong packets resulting in such a message?
17:54  * amir tought that too but could not see any relations between drops and message
17:55 < amir> hmmm, could it come from the client side?
17:55  * amir just sees that he's using numbered (not created) tun interfaces there
17:55 < amir> *changing*
17:56 < krzee> rajkosto, why do you have your MTU changed?
17:57 < krzee> did you test your MTU and find that you needed that?
17:57 < rajkosto> it prevents IP fragmentation
17:57 < krzee> or was it just something in some web config you saw?
17:57 < krzee> i know what it is, im asking why you have it
17:57 < rajkosto> i tested, wireshark and all
17:57 < rajkosto> gives better throughput
17:57 < krzee> ahh cool =]
17:57 < krzee> in that case, good job ;]
17:58 < amir> again: to restart ovpn with a pre-created tun1 i needed to --rmtun and --mktun before being able to start ovpn again
17:59 < amir> ah, AES-256-CBC is fast enough for ovpn?
17:59 < rajkosto> its awesomely fast on devices with crypto accelerators
17:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
18:00 < amir> ok, client side tun creation has nothing to do with the error message on the server, that persists
18:00 < krzee> amir, that is right
18:00 < krzee> the error comes from your OS, not openvpn
18:00 < krzee> openvpn is simply passing it along
18:00 < amir> ic
18:01 < krzee> rajkosto, why auth none?
18:01 < amir> i slowly start to wonder if it's not easier to change the firewall than to switch to static tun's ;)
18:01 < rajkosto> dont need it, dont want it reducing my mtu even further
18:01 < krzee> and why seperate ping / ping-restart?
18:01 < krzee> (keepalive would do both, AND set them on the clients as well)
18:02 < krzee> im at a complete loss of why you're getting that error
18:02 < rajkosto> noted
18:02 < krzee> i guess you can add the third field if it helps
18:02 < krzee> but thats weird to me
18:03 < rajkosto> its probably because of the virtualized network
18:03 < rajkosto> notice the gateway is some 192.168 ip
18:03 < rajkosto> thats how the server accesses the internet
18:07 < rajkosto> so, for the third field, i just add the server's vpn ip ?
18:09 < rajkosto> or i can just add route-gateway
18:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:16 -!- Champi [Champi@rootshell.fr] has quit [Read error: Operation timed out]
18:17 < amir> oook, let's rebuild that firewall :(
18:17  * amir still does not understand why his OS is complaining now that he creates the tun interfaces beforehand
18:19 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
18:20 < |Mike|> .............
18:25 < rajkosto> krzee, a weird thing is happening on the winxp client (otherwise works fine)
18:26 < rajkosto> its showing
18:26 < rajkosto> ROUTE default_gateway=172.16.1.1
18:26 -!- Champi [Champi@rootshell.fr] has joined #openvpn
18:26 < rajkosto> WARNING: potential route subnet conflict between local LAN [172.16.1.0/255.255.255.0] and remote VPN [172.16.1.0/255.255.255.0]
18:28 < K1ng> guess what youtube video has 287,655 likes, 2,163,506 dislikes
18:30 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
18:33 -!- rajkosto [bitrot@cable-94-189-153-232.dynamic.sbb.rs] has quit [Ping timeout: 252 seconds]
18:35 < K1ng> http://www.youtube.com/watch?v=v8AZTd91CPg
18:35 <@vpnHelper> Title: YouTube - Total Black Out - Smelly Ass (at www.youtube.com)
18:35 < Rajko> everything is fine now after i added route-gateway 172.16.0.1 (the vpn server vpn ip)
18:36 < Rajko> except those 2 warnings on the winxp client
18:40 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
18:41 < krzee> K1ng, nice, i like the testimonials section
18:42 < K1ng> thanks :)
18:42 < amir> krzee, LOL, crazy stuff! now i switched back to 'dev tun' everywhere and that error message is STILL there!
18:42  * amir starts to berserk
18:42 < krzee> and your firewall...
18:42 < krzee> ?
18:42 < amir> i rewrote all the rules to use tun+
18:43 < krzee> back it up and set it to allow all
18:43 < amir> it's a easier to read this way, anyway
18:43 < amir> i can shut it down, that way it will not forward, but accept everything
18:43 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 264 seconds]
18:43 < amir> in input/output
18:44 < amir> [drop policy in forward]
18:44 < krzee> do whatever you like, just make sure its not blocking anything
18:44 < amir> .k
18:44 < amir> let's try that
18:44 < amir> ok
18:45 < amir> input/output accept everything
18:45 < amir> forward drops
18:45 < amir> do i need to restart ovpn?
18:46 < amir> still happens
18:46 < amir> [without a restart]
18:46 < amir> iptables shows empty tables
18:47 < amir> that did not solve it eighter :(
18:47 < amir> ok, let's stop the iDev ovpn server
18:48 < amir> running a single ovpn instance in ptp mode with 'dev tun' now
18:48 < amir> and it STILL happens :(
18:49  * amir is confused
18:49 < krzee> me too, but its good you got to this point
18:50 < amir> wait, let's make sure this is really as we think it is
18:50  * amir will remove all init.d scripts
18:50 < krzee> when you have a complex setup with an error, the more you can remove, the better
18:50 < amir> start up a clean system
18:50 < amir> and then bring up only ONE single ptp link with 'dev tun'
18:50 < amir> eg. let's double check
18:51 < krzee> there ya go
18:51 < krzee> those kind of tests are good
18:51 < Rajko> problem is, now that im using routing instead of double nat, i cant delegate port forwarding to the user router
18:51  * amir knows ;)
18:52 < amir> [x] clean system booted, no tun* anywhere
18:53 < amir> [x] single ptp up and running
18:53 < amir> => error happens
18:53  * amir curses his luck
18:54 < amir> this seems to be persistent and reproducable
18:54 < krzee> but only for a single config...
18:54 < krzee> try copying a different config, and changing the --remote
18:54 < krzee> i assume the rest is the same...
18:54 < amir> what's so special about this config?!
18:54 < krzee> no idea!
18:54 < amir> let me diff them
18:55 < krzee> try to find that out =]
18:55 < amir> different port, secret, ifconfig, status
18:55 < amir> that's all :(
18:57 < amir> shutdown of ptp link 1
18:57 < amir> start of ptp link 2
18:57 < amir> and crazy as it is, it does NOT happen there :(
18:57  * amir bangs his head against the wall
18:58 < amir> OH
18:58 < amir> i see a difference!
18:58 < amir> -;client-to-client
18:58 < amir> +client-to-client
18:58 < amir> krzee, could that have an influence?
18:58 < amir> does this have any effect in ptp mode anyway?!
18:59 < amir> ah
18:59 < amir> no
19:00 < amir> crap, that's the iDev client/server config file
19:00  * amir is puzzled
19:05 -!- bitrot [~rajkosto@cable-94-189-153-232.dynamic.sbb.rs] has joined #openvpn
19:07 < amir> funny, iptables rules refering tunnel devices which disappear and reappear no longer work until they get recreated
19:08 < amir> to much mysterium for one day for me, time to relax
19:08 < amir> laters guys! and thx krzee 
19:09 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 264 seconds]
19:12 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
19:13 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
19:30 -!- bitterman [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
19:30 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
19:54  * amir wonders what happens inside openvpn every minute ... i get that "write to TUN/TAP : Invalid argument" error every minute 
20:02 < K1ng> i havent seen an ipv6 for long time :S
20:02 < krzee> likely happens for all traffic amir
20:02 < krzee> every minute would be your pings ;)
20:06 < bitrot> is there some issue with openvpn subnet topology and port forwarding ?
20:06 < bitrot> since it stopped working.
20:07 < krzee> port forwarding as in https port sharing?
20:07 < krzee> or as in, behind a NAT
20:17 < krzee> bitrot, 
20:17 < bitrot> DNAT
20:17 < bitrot> SNAT seems to work
20:17 < krzee> ok, so behind a NAT
20:17 < krzee> no, it is unrelated
20:18 < bitrot> strange
20:18 < krzee> openvpn doesnt know or care that its behind a nat
20:19 < bitrot> im DNAT-ing to vpn clients and ips in subnets behind vpn
20:20 < krzee> say what you are doing in non-linux specific jargon
20:22 < krzee> many of us here, including myself are bsd users
20:22 < bitrot> destination nat changes the destination ip of packets
20:22 < bitrot> before routing happens
20:22 < bitrot> its port forwarding
20:23 < bitrot> snat changes the source ip address, and allows computers behind nat to talk to the internt
20:23 < krzee> i also dont want a lesson in the different linux NATs
20:23 < krzee> if you need to draw a diagram to explain it, feel free
20:24 < krzee> or just keep waiting, there are linux people here too
20:24 < krzee> im sure one will appear at some point =]
20:26 -!- bitrot [~rajkosto@cable-94-189-153-232.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
20:26 < krzee> or that =/
20:27 -!- bitterman [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
20:28 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
20:28 -!- rajkosto [rajkosto@cable-94-189-153-232.dynamic.sbb.rs] has joined #openvpn
20:33 -!- Yen [Yen@unaffiliated/yen] has quit [Read error: Connection reset by peer]
20:37 -!- bitterman [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
20:38 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
20:41 < rajkosto> lol
20:41 < rajkosto> the damn utorrent port tester is down
20:47 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
20:50 -!- rajkosto [rajkosto@cable-94-189-153-232.dynamic.sbb.rs] has quit [Ping timeout: 250 seconds]
20:51 -!- MrABC [~HQ@pool-74-103-205-113.prvdri.fios.verizon.net] has quit [Quit: Leaving]
20:59 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
21:03 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
21:06 -!- bitterman [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
21:06 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
21:08 -!- oc80z [~oc80z@blea.ch] has quit [Excess Flood]
21:09 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:18 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:56 -!- bitterman [~yury@84.51.192.6] has quit [Quit: Leaving]
22:11 -!- master_of_master [~master_of@p57B54915.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:14 -!- master_of_master [~master_of@p57B57DD7.dip.t-dialin.net] has joined #openvpn
22:17 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Read error: Connection reset by peer]
22:20 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
23:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
23:11 -!- rommel11 [~rommel@119.93.51.34] has joined #openvpn
23:13 < rommel11> May I ask what is the real purpose of lport aside from whats in the manual? Because in my status log it will indicate "TCPv4_CLIENT link local (bound): [undef]" if I dont have lport and TCPv4_CLIENT link local (bound): [undef]:8080 if I have lport set to 8080
23:14 < rommel11> What is its relevance in the connection between server and client?
23:29 -!- rommel11 [~rommel@119.93.51.34] has quit []
23:47 < K1ng> http://www.youtube.com/watch?v=v8AZTd91CPg
23:47 <@vpnHelper> Title: YouTube - Total Black Out - Smelly Ass (at www.youtube.com)
23:49 < jeev> hahahahah
--- Day changed Mon Apr 18 2011
00:04 -!- dazo_afk is now known as dazo
00:21 -!- dazo is now known as dazo_afk
00:51 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
00:54 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
00:56 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: ph1l]
01:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:17 -!- cpf_ [~cpf@91.183.51.181] has joined #openvpn
01:28 <@vpnHelper> RSS Update - forum: openvpn & apache issue <http://forums.openvpn.net/topic7955.html#p11329>
01:30 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
01:34 < K1ng> YAY. i got my new payoneer card. I AM RICH
01:39 -!- EugeneKay [EugeneKay@jedediahsmith.kashpureff.com] has left #openvpn ["Leaving"]
01:41 -!- jwtz [d57d1dd2@gateway/web/freenode/ip.213.125.29.210] has joined #openvpn
01:41 < jwtz> !route
01:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
01:43 -!- ph1l [~ph1l@gprs05.swisscom-mobile.ch] has joined #openvpn
01:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
01:55 -!- ph1l [~ph1l@gprs05.swisscom-mobile.ch] has quit [Ping timeout: 276 seconds]
01:56 -!- ph1l [~ph1l@gprs15.swisscom-mobile.ch] has joined #openvpn
02:00 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
02:10 <@vpnHelper> RSS Update - forum: Restricting all network traffic while a client is connected <http://forums.openvpn.net/topic7959.html#p11330>
02:18 < jwtz> Hey guys I have a small question
02:20 -!- ph1l [~ph1l@gprs15.swisscom-mobile.ch] has quit [Ping timeout: 248 seconds]
02:21 < Bushmills> be happy
02:21 < Bushmills> many people aren't that lucky, and are burdening themselves with huge questions
02:21 <@vpnHelper> RSS Update - forum: Windows 7 64bit Client to Windows 2008 64bit server <http://forums.openvpn.net/topic7897-15.html#p11331>
02:22 < Bushmills> my personal opinion is that a zen-like approach is rather helpful
02:26 < Bushmills> i think you're on a good way. sometimes it suffices to simply accept that questions can exist without the necessity of obtaining an answer.
02:26 < jwtz> Guys I have the following situation
02:26 < jwtz> LAN of 172.16.0.0/16 and another lan of 192.168.16.0/24
02:27 < jwtz> I've connected them through OpenVPN and all works well except one thing
02:27 <@vpnHelper> RSS Update - forum: [1]31999 ???????????? <http://forums.openvpn.net/topic7962.html#p11333> || This is NOT a firewall issue <http://forums.openvpn.net/topic7960.html#p11332>
02:27 < jwtz> only the 172.16.0.0/16 can ping to 192.168.16.0/24 and not the other way around
02:30 < Bushmills> have you looked at what stops either the icmp echo request or the reply?
02:32 <@vpnHelper> RSS Update - forum: Order or arrangement of directives/option <http://forums.openvpn.net/topic7964.html#p11335> || Windows File Shares Unreachable via OpenVPN <http://forums.openvpn.net/topic7963.html#p11334>
02:34 < jwtz> hmm yeah let me check
02:36 < jwtz> it stops at the reply
02:36 < jwtz> although all firewalls are off
02:38 <@vpnHelper> RSS Update - forum: openvpn & apache issue <http://forums.openvpn.net/topic7955.html#p11337> || Games don`t see localnet servers <http://forums.openvpn.net/topic7947.html#p11336>
02:42 -!- cpf_ [~cpf@91.183.51.181] has quit [Ping timeout: 252 seconds]
02:45 < jwtz> do i need to add a route somewhere?
02:48 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
02:59 -!- cpf_ [~cpf@91.183.51.181] has joined #openvpn
02:59 < jwtz> hmm no answers? :(
03:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:14 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 276 seconds]
03:14 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
03:17 < Bushmills> i don't know what "it stops at the reply" means 
03:17 < Bushmills> do you have a host with the name "reply"?
03:18 < AL13N_work> looks like a simple issue of backrouting to me
03:18 < AL13N_work> you should check the routing table of both hosts AND also the vpn status routing table
03:19 < AL13N_work> jwtz: ^^
03:20 < jwtz> hmm alright
03:22 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has joined #openvpn
03:22 < jwtz> alright looking at them now, my VPN tunnel is 10.0.8.0/24
03:24 < jwtz> Ok, so one route at one end is 172.16.0.0/16 	10.0.8.2
03:25 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
03:25 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
03:26 < jwtz> and the other side has 192.168.16.0    10.0.8.5        255.255.255.0   UG    0      0        0 tun0
03:31 < jwtz> as you can tell i'm no guru :P
03:34 < jwtz> Bushmills: it just gives me the following PING 172.16.1.1 (172.16.1.1): 56 data bytes and i'm not recieving a reply
03:35 < Bushmills> (09:30:14) Bushmills: have you looked at what stops either the icmp echo request or the reply?
03:36 < Bushmills> without additional information, the only diagnosis i can do is "there is something wrong"
03:36 < jwtz> how can i find out where it stops?
03:36 < Bushmills> tcpdump would be helpful
03:37 < Bushmills> alternatively, tshark.  well, just about any network traffic sniffer should do
03:39 < Bushmills> mtr or traceroute would be only partially useful, as they don't tell you whether the problem are the  requests or the replies  
03:40 < Bushmills> but they can be used to determine on which machine you want to run the network sniffer
03:40 < jwtz> hmm
03:41 < jwtz> i used tcpdump
03:41 < jwtz> but not seeing any icmp replies
03:42 < jwtz> i only see a lot of 10:40:26.283159 IP D57D1DD5.static.ziggozakelijk.nl.1194 > D57D1DD4.static.ziggozakelijk.nl.1038: P 23749:23876(127) ack 2659 win 4096 <nop,nop,timestamp 1943302884 176658>
03:43 < Bushmills> jwtz: so look at the next hop. somewhere there are replies. first machine with replies arriving, and not on next machine, is the one where replies are not routed along properly
03:44 < Bushmills> you *can* filter, btw
03:44 < Bushmills> i.e. just look at icmp traffic, or traffic to a specific host, etc
03:45 < jwtz> working on it now :)
03:45 < Bushmills> it also seems that the interface you're seeing traffic from/to udp/1194 is not the interface your icmp requests and replies are sent through
03:45 < Bushmills> i assume the pings traverse the openvpn tunnel
03:46 < Bushmills> or are at least supposed to do so
03:50 < jwtz> ok i'm only seeing this a few times
03:50 < jwtz>  10:49:49.833064 IP D57D1DD5.static.ziggozakelijk.nl > D57D1DD1.static.ziggozakelijk.nl: ICMP echo request, id 2092, seq 4, length 64
03:51 < jwtz> but no reply
03:52 < Bushmills> lost somewhere. find out where
03:59 < jwtz> alright hang on im starting anew
03:59 < jwtz> im making change after change after change atm
04:05 -!- cpf_ [~cpf@91.183.51.181] has quit [Ping timeout: 240 seconds]
04:17 <@vpnHelper> RSS Update - forum: VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html#p11338>
04:19 -!- cpf_ [~cpf@91.183.51.181] has joined #openvpn
04:26 -!- larie [~fling@83.246.243.61] has joined #openvpn
04:27 < larie> how to disable route pushing in client config?
04:27 < larie> i don't need routes on some of my clients
04:32 -!- cpf_ [~cpf@91.183.51.181] has quit [Ping timeout: 241 seconds]
04:35 < Bushmills> jwtz: why do you make change after change while not even knowing where the problem is?
04:35 < Bushmills> larie: --route-nopull
04:35 < jwtz> i'm kind of new to this Bushmills 
04:35 < jwtz> i had it working yesterday with another device
04:44 < larie> Bushmills: thx
04:45 < larie> Bushmills: "route-nopull" in config?
04:46 -!- cpf_ [~cpf@91.183.51.181] has joined #openvpn
04:47 < jwtz> alright im back up and running
04:48 < jwtz> and im still facing the same problem
04:53 < AL13N_work> jwtz: find out where the problem is
04:53 < AL13N_work> jwtz: check with tcpdump on each interface on each machine were it comes from
04:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
04:54 < AL13N_work> and remember that openvpn blocks traffic it can't route back anyway
04:58 < jwtz> ok, but I still dont understand this one
04:58 < jwtz> how is it possible that 172.16.1.1 can ping to 192.168.16.1, but not the other way around
04:58 <@vpnHelper> RSS Update - forum: Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html>
04:58 < jwtz> it doesnt make sense
05:03 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 248 seconds]
05:03 <@vpnHelper> RSS Update - forum: VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html#p11340>
05:04 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
05:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:13 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
05:14 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
05:16 -!- cpf_ [~cpf@91.183.51.181] has quit [Ping timeout: 260 seconds]
05:17 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:17 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:22 -!- jwtz [d57d1dd2@gateway/web/freenode/ip.213.125.29.210] has quit [Ping timeout: 252 seconds]
05:26  * amir still wonders what happens every minute inside openvpn and results in a "write to TUN/TAP : Invalid argument". pondered pings & stuff, but they should happen all 10s and not all 60s (keepalive 10 120)
05:33 <@vpnHelper> RSS Update - forum: [1]31999 ???????????? <http://forums.openvpn.net/topic7962.html#p11341>
05:41 < larie> Bushmills: it works!
05:54 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
06:03 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
06:08 -!- MarKsaitis_ [~MarKsaiti@81.137.245.117] has joined #openvpn
06:11 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 240 seconds]
06:25 <@vpnHelper> RSS Update - forum: Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11342>
06:31 <@vpnHelper> RSS Update - forum: Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11343>
06:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
06:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:43 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
06:49 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
06:49 <@vpnHelper> RSS Update - forum: need to use public ip in my local lan <http://forums.openvpn.net/topic7961.html#p11344>
07:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:35 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:42 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 246 seconds]
07:46 -!- echoSMILE [~censured@bl15-213-57.dsl.telepac.pt] has joined #openvpn
07:46 -!- echoSMILE [~censured@bl15-213-57.dsl.telepac.pt] has quit [Changing host]
07:46 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
07:48 -!- carstenh_ [~carstenh@i59F49489.versanet.de] has joined #openvpn
07:55 < carstenh_> Hi everybody - I have a working openvpn.config but the problem is that the init script (ubuntu 10.04) fails (daemon() failed: No such device). if i start from commandline (openvpn --config ...) everything is working fine.. 
07:55 <@vpnHelper> RSS Update - forum: error with creating a new vpn key <http://forums.openvpn.net/topic7904.html#p11346> || VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html#p11345>
08:03 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
08:03 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
08:07 < ecrist> http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations
08:07 <@vpnHelper> Title: OpenVPN/Donations - Secure Computing Wiki (at www.secure-computing.net)
08:07 < ecrist> krzee: FYI
08:09 < carstenh_> !welcome
08:09 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:10 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
08:10 < carstenh_> !goal
08:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:10 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
08:11 < carstenh_> Hi everybody - I have a working openvpn.config but the problem is that the init script (ubuntu 10.04) fails (daemon() failed: No such device). if i start from commandline (openvpn --config ...) everything is working fine.. 
08:12 < carstenh_> there is only one config in my openvpn directory...
08:15 < ecrist> are you running it as root?
08:15 < ecrist> !logs
08:15 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:15 < Bushmills> carstenh_: rename the .config to .conf
08:16 < carstenh_> Bushmills: uhm sorry typo - the name is .conf - in fact the syslog shows that openvpn is trying to start the daemon
08:17 < Bushmills> is that the only .conf in your /etc/openvpn directory?
08:17 < carstenh_> yes
08:18 < ecrist> carstenh_: logs, please
08:18 < carstenh_> I guess the problem is that the system is an openvz virtual machine and the daemon has problems with the tun device (daemon() failed: No such device (errno=19))
08:19 < Bushmills> very likely, yes
08:19 <@vpnHelper> RSS Update - forum: VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html#p11347>
08:19 < Bushmills> !openvz
08:19 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
08:19 < carstenh_> http://pastebin.com/rfZmSW7Z - I hope pastebin.com is alright
08:20 < carstenh_> I read this tutorial and it works quiet well if I start from command line - the init script is the only problem
08:22 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
08:22 -!- mode/#openvpn [+o dazo] by ChanServ
08:22 < carstenh_> http://pastebin.com/mUbuyfNQ - These are the logs when I start with "openvpn --config /etc/openvpn/openvpn.conf"
08:22 < ecrist> oh, openvz
08:22 < ecrist> ugh
08:23 < carstenh_> yes :(
08:23 < ecrist> OpenVZ != Linux
08:23 < carstenh_> Hypervisor != Operating System  
08:23 < havoc> KVM > hyperv/vz
08:24 < carstenh_> I'm trying to avoid to run openvpn within screen the whole time
08:26 < carstenh_> ecrist: so the reason that the initscript fails is probably openvz?
08:27 < ecrist> can you increase the verbosity, to 6 and get me a new log?
08:28 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
08:29 < pwrcycle> carstenh_: use the "daemon
08:29 < pwrcycle> option in the server.conf and that will background it
08:30 < pwrcycle> carstenh_:  or put & at the end of the command if it's the client, that'll background it too
08:30 < pwrcycle> "openvpn --config /etc/openvpn/openvpn.conf &"
08:32 < carstenh_> it's the server
08:33 < pwrcycle> carstenh_: putting "daemon" in the server.conf will background it
08:35 < carstenh_> http://pastebin.com/8vr3vyNK
08:35 < carstenh_> pwrcycle: daemon does'nt help
08:36 < pwrcycle> hmm works for me. can you paste your .conf ?
08:36 < carstenh_> somehow the process tries to access a device that isn't available that it doesn't access when I start it via command line
08:36 < carstenh_> sure
08:37 < carstenh_> http://pastebin.com/wqQYVnea
08:40 <@vpnHelper> RSS Update - forum: VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html#p11348>
08:40 < carstenh_> I tried the packages that came with ubuntu and the openvpn.net packages
08:44 <@dazo> pwrcycle: just a little nit-picking ... using & and --daemon rightfully enough detaches the process and runs it in the background, but & and --daemon doesn't do the same thing, code wise ... --daemon will redirect stdout/stderr messages to log files and tell the OS that the process is becoming a daemon running in the background (calling a variant of the daemon(3) function), & doesn't do that at all
08:44 < pwrcycle> carstenh_: try this comment out the "client-config-dir" line, and add "user nobody" & "group nobody"
08:45 < pwrcycle> dazo: k
08:45 <@dazo> From the log file: Apr 18 13:33:59 us-vps-01 ovpn-openvpn[19965]: daemon() failed: No such device (errno=19)
08:46 <@dazo> this is the core error why --daemon doesn't work
08:46 < carstenh_> dazo: yep - but why does daemon() fail?
08:47 < carstenh_> pwrcycle: same error
08:47 <@dazo> The "No such device" issue is odd ... looking at possible scenarios now
08:49 < carstenh_> The tun0 does not exist and is created by openvpn right?
08:49 < Bushmills> it may be that that's not related to tun/tap at all, but to something like, maybe, tty
08:49 <@dazo> carstenh_: if tun0 doesn't exist, that is most likely an issue ... but if it works for you without --daemon, it sounds odd
08:50 <@dazo> could be tty related, yeah
08:50 < carstenh_> dazo: it doesn't and its created when I start from commandline
08:50 <@dazo> in that case, it should be created also with --daemon ... the daemonise code is run after the tun/tap creation, iirc
08:52 < Bushmills> i'd try to add a line like   find /dev > /tmp/foo  to /etc/init.d/openvpn,  and compare that file against such a device list created later, manually
08:53 <@dazo> carstenh_: do you have strace available?
08:53 < Bushmills> that may give an idea what devices didn't exist when init script tried to start openvpn, but do exist later, when boot is complete
08:53 < carstenh_> dazo: yes
08:53 <@dazo> carstenh_: can you strace openvpn with --daemon and pastebin the output?
08:54 < carstenh_> dazo: strace from within the init script?
08:54 <@dazo> yeah, that sounds like a good place
08:54 <@dazo> strace -o, iirc
08:55 <@dazo> strace -o /tmp/openvpn-strace.log openvpn....., that is
08:55 < ecrist> the daemon call is what's failing
08:55 <@dazo> definitely
08:55 < ecrist> no tty is a good guess
08:58 <@dazo> it could also be lack of /dev/null
08:59 < Bushmills> null device full. please replace
08:59 <@dazo> heh
09:00 <@dazo> reminds me of the old DOS days .... "Who the heck is General Failure and why is he reading my hard drive?!?"
09:00 < carstenh_> dazo: http://pastebin.com/P19xpbHP
09:00 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 250 seconds]
09:01 < carstenh_> ecrist: tty tty0-9 exist
09:03 < carstenh_> maybe a broken udev?
09:03 <@dazo> carstenh_: can you do the same with -f as well?  It only captured until daemon() did the fork() 
09:03 <@dazo> we need to see what the fork()ed child does
09:03 <@dazo> maybe even with -ff 
09:04 <@dazo> (should give each process a separate trace file)
09:04 < carstenh_> it's working!
09:04 <@dazo> huh?!
09:04 < carstenh_> I had a faulty null device -_-
09:04 <@dazo> ahh
09:04 <@dazo> yeah, makes sense :)
09:05 < pwrcycle> what is a faulty null device? what did you do to fix it?
09:05 < carstenh_> I only checked if it exists in the past...
09:05 < carstenh_> but the "null device full" joke made me delete and create it - tada!
09:05 <@dazo> from man page for daemon(3): If noclose is zero, daemon() redirects standard input, standard output and standard error to /dev/null; otherwise, no changes are made to these file descriptors.
09:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
09:05 <@dazo> case closed :)
09:06 < carstenh_> thanks for your patience guys!
09:06 < carstenh_> :-)
09:06 <@dazo> no worries :)
09:08 <@vpnHelper> RSS Update - forum: Ping Problem <http://forums.openvpn.net/topic7966.html> || Restricting all network traffic while a client is connected <http://forums.openvpn.net/topic7959.html#p11349>
09:11 < pwrcycle> dazo: Bushmills: is there an iPhone vpn app that doesn't require it to be jailbroken?
09:11 <@dazo> pwrcycle: nope
09:11 <@dazo> !iphone
09:11 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
09:11 <@vpnHelper> iPhone and iPad.
09:11 <@dazo> that's all we know about iPhone/iPad
09:12 < pwrcycle> dazo: what about android?
09:12 <@dazo> same story
09:12 < pwrcycle> k
09:12 <@dazo> pwrcycle: MeeGo and maemo on the other hand ;-)
09:12 <@dazo> (not sure about webOS)
09:12 < gladiatr> rawr
09:24 -!- greencult [~greencult@200.48.85.28] has joined #openvpn
09:25 < greencult> hi all
09:27 < ecrist> hi
09:38 -!- K1ng\ [~KING@180.211.188.218] has joined #openvpn
09:41 -!- K1ng [~KING@180.211.188.63] has quit [Ping timeout: 260 seconds]
09:51 < pwrcycle> is there a wait to put the user & pass in the client.conf for PAM auth?
09:54 -!- carstenh_ [~carstenh@i59F49489.versanet.de] has quit [Quit: Leaving]
10:02 < pwrcycle> time to add a new page for cynogen to the website now :)
10:03 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Read error: Operation timed out]
10:04 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
10:06 -!- greencult [~greencult@200.48.85.28] has left #openvpn []
10:06 -!- greencult [~greencult@200.48.85.28] has joined #openvpn
10:06 < greencult> hi all
10:07 < gladiatr> !welcome
10:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:07 -!- AL13N_work [~alien@91.183.52.232] has quit [Ping timeout: 240 seconds]
10:11 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 252 seconds]
10:12 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
10:12 -!- AL13N_work [~alien@91.183.52.232] has joined #openvpn
10:28 <@dazo> pwrcycle: when you use --auth-user-pass, openvpn will ask for username/password before it connects ... so it's kind of a wait in this regard
10:29 < pwrcycle> dazo: yeah, i was just curious if there was a user: guest; pass: pass1234 option in the client for that...
10:29 < pwrcycle> but, i fixed the problem. in Cyanogen mode, the comp-lzo option was hidden in the adv menu, so no need for that now. all worked.
10:30 <@dazo> well, you can give a filename to --auth-user-pass ... which contains username and password on separate lines
10:31 <@dazo> otherwise, there's an option to use --management, --management-hold and --management-query-passwords ... which will start openvpn and halt further process until a "TCP client" connects to the (client) daemon and provides username/password this way
11:08 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
11:11 -!- openvpnnoob [8a05f136@gateway/web/freenode/ip.138.5.241.54] has joined #openvpn
11:12 < openvpnnoob> hi
11:13 < pwrcycle> !welcome
11:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:15 < openvpnnoob> Could someone help my figure out why when connected to my openvpn never I have no connectivity to anything?  Doing a tracert on anything just says it cant resolve the name
11:16 < pwrcycle> !howto
11:16 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:16 < pwrcycle> !route
11:16 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:16 < openvpnnoob> I read the howto
11:18 < pwrcycle> !configs
11:18 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
11:21 < openvpnnoob> http://pastebin.com/WBBUi3GS they are here
11:22 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
11:25 < gladiatr> can you ping the default gateway IP address of your server?
11:25 < gladiatr> from your client, that is
11:27 < greencult> clear
11:28 < greencult> ops
11:34 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html>
11:36 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
11:42 < pwrcycle> for a jailbroken iPhone, is there any suggested app to use ?
11:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:52 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
11:52 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 264 seconds]
11:57 -!- cpm_ [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
11:57 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has quit [Ping timeout: 246 seconds]
11:57 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 246 seconds]
11:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 246 seconds]
11:58 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has joined #openvpn
11:59 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
12:02 -!- cpm_ is now known as cpm
12:05 -!- rajkosto [rajkosto@wan.rajkonet.info] has joined #openvpn
12:06 -!- openvpnnoob [8a05f136@gateway/web/freenode/ip.138.5.241.54] has quit [Quit: Page closed]
12:07 < pwrcycle> !iphone
12:07 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN
12:07 <@vpnHelper> for iPhone and iPad.
12:15 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
12:22 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
12:27 -!- MarKsaitis_ [~MarKsaiti@81.137.245.117] has quit [Ping timeout: 260 seconds]
12:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
12:32 -!- APTX [APTX@phpBB/developer/APTX] has quit [Ping timeout: 240 seconds]
12:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:36 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
12:36 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has quit [Quit: ph1l]
12:37 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has joined #openvpn
12:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
12:40 < dkr> !android
12:41 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has quit [Client Quit]
12:48 < krzie> !learn android as the easiest way to get openvpn on android is to run cyanogenmod, since it comes with tun / busybox / and i think the new version even includes openvpn!
12:48 <@vpnHelper> Joo got it.
12:49 < krzie> dkr, try again =]
12:49 < dkr> that's kind of a cop out for a factoid, though
12:49 < krzie> how so?
12:49 < krzie> we're not android support
12:49 < dkr> http://www.appbrain.com/app/openvpn-settings/de.schaeuffelhut.android.openvpn  seems a decent solution
12:49 <@vpnHelper> Title: OpenVPN Settings - Android app on AppBrain (at www.appbrain.com)
12:49 < krzie> it is
12:50 < krzie> but you still need tun for your kernel
12:50 < krzie> and busybox
12:50 < krzie> and root
12:50 < dkr> although still need the openvpn  binary.  but I guess i can just cross-compile that myself
12:50 < krzie> your link is the easy-part
12:50 < krzie> openvpn installer package exists too
12:51 < krzie> !learn android if you already have tun/root/busybox you can use android-openvpn-installer and openvpn-settings from the market
12:51 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
12:51 < krzie> !learn android as if you already have tun/root/busybox you can use android-openvpn-installer and openvpn-settings from the market
12:51 <@vpnHelper> Joo got it.
12:51 < krzie> better? ;]
12:52 < dkr> cool. :)
12:52 < krzie> the first part is a cop out because 99% of android questions will be about busybox/root/tun
12:52 < krzie> once you have those 3 things, the rest is simple
12:53 < krzie> but if you use cyanogenmod, openvpn just works
12:53 < dkr> I'd like to try it out, but cyanogen isn't available for my phone yet, unfortunately
12:54 < krzie> what phone?
12:54 < dkr> or maybe it has by now, there was some beta versions for like 7 months
12:54 < dkr> captivate
12:55 < dkr> the funny thing is the cyanogen wiki had a guide for installing specifically on my phone, but only after I finished the rooting part did it say, oh yeah, it's not supported yet.  heh :)
12:56 < krzie> ya, lol
12:56 < krzie> just saw that
12:57 < krzie> [13:57]  <krzie> samsung captivate not supported?
12:57 < krzie> [13:58]  <ray|school> nope krzie
12:57 < krzie> [13:58]  <ray|school> there is an unstable build if you look on xda,but its not official
12:58 -!- rajkosto [rajkosto@wan.rajkonet.info] has quit [Ping timeout: 246 seconds]
12:58 < krzie> http://forum.xda-developers.com/showthread.php?t=978150
13:00 < krzie> looks like a well made rom
13:00 < krzie> updated often, almost daily
13:01 < jeev> BUT IS IT AN IPHONE?
13:01 < krzie> thank god no
13:01 < jeev> <guy> no but it's a billion times better and it'll s*ck your d*ck
13:01 -!- rajkosto [rajkosto@wan.rajkonet.info] has joined #openvpn
13:02 < jeev> BUT ITS NOT AN IPHONE THEN ?
13:02 < jeev> that youtube shit is hilarious
13:02 < jeev> you know what i'm talkini about, right
13:02 < krzie> ya
13:02 < jeev> i do enjoy the iphone though, got tired of android
13:02 < jeev> i think android will be there in a year or two
13:02 < jeev> i love it still but bulky to nonbulky phones.. headache
13:05 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
13:05 < rajkosto> i have a problem
13:05 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
13:06 < rajkosto> once starting the openvpn client on a router (to provide internet to the subnet behind it), the router's wan ip address is no longer pingable from the outside
13:24 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
13:24 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
13:27 < rajkosto> immediately after stopping openvpn
13:27 < rajkosto> its pingable just fine
13:27 < rajkosto> it tries to route the echo reply through openvpn
13:28 < rajkosto> and ive no idea how to set up crazy dynamic routing thjt would make that work
13:33 < rajkosto> connmark would do the job
13:37 -!- dazo is now known as dazo_afk
13:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:39 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
13:39 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
13:48 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 240 seconds]
13:51 -!- scoopex_ [~scoopex@85.214.140.184] has joined #openvpn
13:51 < scoopex_> hi
13:51 -!- scoopex_ is now known as scoopex
13:52 < scoopex> i installed openvpn access server....does openvpn access server support auth by client certificates?
13:54 < scoopex> i discovered that there is a "revoke certificates" menu item...but i do not find the ca-management/client certificate creation menu :-)
13:54 < scoopex> any hints?
13:55 -!- greencult [~greencult@200.48.85.28] has quit [Quit: Lost terminal]
13:55 < gladiatr> scoopex, open a ticket on the openvpn.net site.  This channel and the community forum only support the community edition of openvpn
13:56 < scoopex> gladiatr: oh sorry...
13:56 < gladiatr> no worries, man.  
13:56 < gladiatr> There just isn't alot of AS expertise here
13:58 < ecrist> well, that and it's a commercial product
13:58 < ecrist> comes with commercial support
14:02 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
14:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:03 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Remote host closed the connection]
14:03 < krzie> rajkosto, what did you expect when changing your default route to the internet?
14:04 < krzie> !factoids search redirect
14:04 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:04 < krzie> hrm
14:04 < rajkosto> yeah
14:04 < krzie> !factoids search route
14:04 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
14:04 < krzie> !route_override
14:04 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet, or (#2) https://forums.openvpn.net/topic7175.html to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn
14:04 < krzie> !splitroute
14:04 < rajkosto> oh you have a faqentry for that
14:04 <@vpnHelper> "splitroute" is https://forums.openvpn.net/topic7161.html for how to do something along these lines: route everything EXCEPT something over the tunnel
14:04 < rajkosto> i winged it
14:05 < Essobi> what version of servers did incompatability from 1.XX clients come into play?
14:05 < krzie> 1.x didnt have servers
14:05 < rajkosto> yeah, iptables2 table which only had default via wan gateway, and mark packets to and from wanip to use that table
14:06 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
14:06 < Essobi> krzie: Ah, okay.
14:06 < krzie> !forget splitroute
14:06 <@vpnHelper> Joo got it.
14:07 < krzie> !learn splitroute as https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet
14:07 <@vpnHelper> Joo got it.
14:07 < krzie> rajkosto, sounds like you did the above, kinda
14:07 < rajkosto> i did it even better, it allows dynamic ips and stuff
14:07 < krzie> except he didnt need iptables
14:07 < rajkosto> he did
14:07 < rajkosto> he mentioned rules
14:07 < krzie> READ
14:08 < krzie> dont just skim and assume ;]
14:08 < krzie> he accomplished it with 2 commands
14:08 < krzie> niether being firewall
14:08 < rajkosto> yes you can do it that way too
14:09 < krzie> in fact where does he mention iptable rules other than to say its completely wiped?
14:09 < rajkosto> he doest
14:09 < krzie> ok
14:09 < rajkosto> i do it my way because if the ip changes, i dont have to manually do
14:09 < krzie> bbiaf, headed to work
14:09 < rajkosto> ip rule remove 91.121.199.129
14:09 < rajkosto> ip rule add (whatever the new one is)
14:10 < krzie> feel free to document what you did for the next person
14:10 < krzie> bbiaf
14:10 < rajkosto> be back in a fire
14:13 < ecrist> I'm guessing you meant be back in a flash
14:13 -!- glengoyne [~glengoyne@79.194.57.57] has joined #openvpn
14:20 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
14:20 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
14:21 < rajkosto> in a few
14:25 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 276 seconds]
14:25 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
14:31 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
14:33 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:36 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
14:38 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
14:38 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
14:44 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
14:44 -!- glengoyne [~glengoyne@79.194.57.57] has quit [Quit: Verlassend]
15:07 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
15:07 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
15:09 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
15:10 -!- APTX_ [~APTX@phpBB/developer/APTX] has joined #openvpn
15:16 -!- APTX_ [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
15:16 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
15:16 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:42 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
15:42 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
15:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
15:53 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
15:53 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
16:01 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
16:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
16:01 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
16:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:03 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
16:03 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
16:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:05 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
16:06 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
16:07 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Client Quit]
16:20 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
16:23 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
16:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:42 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
16:47 <@vpnHelper> RSS Update - forum: need to use public ip in my local lan <http://forums.openvpn.net/topic7961.html#p11352>
16:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
17:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:31 -!- Rajko [rajkosto@94.189.153.232] has joined #openvpn
17:33 -!- rajkosto [rajkosto@wan.rajkonet.info] has quit [Read error: Operation timed out]
17:40 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
17:40 -!- Rajko [rajkosto@94.189.153.232] has quit [Read error: Connection reset by peer]
17:40 -!- tjz [~pc@bb219-74-220-153.singnet.com.sg] has joined #openvpn
17:40 -!- tjz [~pc@bb219-74-220-153.singnet.com.sg] has quit [Changing host]
17:40 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
17:41 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
17:46 < krzee> in a few
17:59 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 258 seconds]
17:59 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
17:59 -!- APTX_ [~APTX@phpBB/developer/APTX] has joined #openvpn
18:02 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
18:19 -!- K1ng\\\ [~KING@204.45.132.6] has joined #openvpn
18:22 -!- K1ng\ [~KING@180.211.188.218] has quit [Ping timeout: 264 seconds]
18:31 -!- K1ng\ [~KING@180.211.188.218] has joined #openvpn
18:33 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 250 seconds]
18:34 -!- K1ng\\\ [~KING@204.45.132.6] has quit [Ping timeout: 240 seconds]
18:35 -!- rajkosto [bitrot@cable-94-189-153-232.dynamic.sbb.rs] has joined #openvpn
18:48 -!- rajkosto [bitrot@cable-94-189-153-232.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
18:48 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
18:50 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
18:51 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
19:00 -!- Yen [Yen@unaffiliated/yen] has quit [Remote host closed the connection]
19:15 <@vpnHelper> RSS Update - forum: Order or arrangement of directives/option <http://forums.openvpn.net/topic7964.html#p11353>
19:32 -!- JohnTeddy [unstable@tor/regular/sid] has joined #openvpn
19:32 < JohnTeddy> string is too long, it needs to be less than  2 bytes long
19:33 < JohnTeddy> Why does it need to repeat that infinitely, and why doesn't it identify which variable is too long.. I don't know which one it's talking about.
19:41 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:44 < krzee> with you extremely detailed description i will assume you mean you are generating certs
19:44 < krzee> if this is the case, country can only be 2 characters
19:44 < JohnTeddy> yes
19:44 < JohnTeddy> It was the country code
19:45 < krzee> its openssl's error, not openvpn's
19:45 < JohnTeddy> I see.
19:46 < JohnTeddy> When I do /etc/init.d/openvpn start, where is that log?
19:46 < JohnTeddy> I don't see anything in /var/log
19:46 < krzee> !logfile
19:46 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
19:49 < JohnTeddy> krzee: I'm in Shanghai... and that makes networking difficult. I have been using ssh tunnels with -D, and chrome/pidgin will connect to localhost:port on a socks proxy. I just got a new android phone, most of the apps don't support socks proxy through connectbot, so I'm installing openvpn. Android has some 'vpn' settings where I thinkall traffic through the itnerface goes through the VPN.
19:50 < JohnTeddy> Will openvpn work with the android 'vpn' settings likely? and do I want tap or tun?
19:52 < JohnTeddy> When I started installing openvpn, I thought there was one vpn standard... so the 'VPN settings' under android would work with openvpn.. now I'm not sure.
19:52 < JohnTeddy> There is 'PPTP' 'L2TP' 'L2TP/IPSec PSK' and 'L2TP/IPSec CRT' options on the android settings.
20:00 < krzee> no
20:00 < krzee> !notcompat
20:00 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
20:00 < krzee> !android
20:00 <@vpnHelper> "android" is (#1) the easiest way to get openvpn on android is to run cyanogenmod, since it comes with tun / busybox / and i think the new version even includes openvpn!, or (#2) if you already have tun/root/busybox you can use android-openvpn-installer and openvpn-settings from the market
20:04 < JohnTeddy> I see, damn proprietary protocols
20:04 < JohnTeddy> heh
20:08 < JohnTeddy> krzee: ok, I'm working on rooting mY HTC Desire HD and getting the cyanogenmod... once that is done, do I want tun or tap?
20:08 < krzee> !tunortap
20:08 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
20:08 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
20:09 < krzee> most likely you want tun, but with the complete lack of info you have provided, ill go with "i wouldnt know"
20:10 < krzee> but unless you have a specific layer2 protocol which you want over the vpn, you want tun
20:10 < JohnTeddy> I am in Shanghai, I want my android phone to connect to a server running openvpn in California.
20:10 < krzee> ...?
20:11 < JohnTeddy> I'm not sure what other information to give.
20:11 < krzee> to simply transfer normal internet traffic through the server in cali?
20:11 < JohnTeddy> yes
20:11 < krzee> tun
20:12 < JohnTeddy> thank you krzee, I appreciate the help.
20:12 < krzee> layer2 traffic does not normally go over the internet
20:12 < krzee> so if you want normal inet traffic to just tunnel through the remote server, tun
20:25 < JohnTeddy> $ sudo ls /lib/modules/`uname -r`/kernel/drivers/net/tun.*
20:25 < JohnTeddy> ls: cannot access /lib/modules/2.6.26.2/kernel/drivers/net/tun.*: No such file or directory
20:28 < K1ng\> dont you think ls is something else
20:28 < JohnTeddy> Mon Apr 18 21:14:16 2011 Note: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)
20:29 < JohnTeddy> I googled for thsi error, and someone said to type that ls command, to seeif you have the 'tun' module in your kernel, they say to type 'modprobe tun', but it doesn't exist.
20:30 -!- rommel0979 [~rommel@119.93.51.34] has joined #openvpn
20:32 < rommel0979> Good day all.  Guys can I ask what is the difference between bind and lport.  I read the manual but it seems its description in the manual is not much elaborated much for me that I can easily comprehend. Kindly help me understand the difference between the two. Thank you.
20:39 < krzee> JohnTeddy, you dont have tun module
20:40 < krzee> rommel0979, what functionality are you looking for?
20:41 < rajkosto> ipv6 over tun
20:41 < rajkosto> whats the deal
20:41 < krzee> do you want --server-ipv6 too?
20:43 < krzee> as in, do you just want ipv6 to flow over the vpn, or would you like the vpn itself to use ipv6 for its internal stuff as well?
20:43 < rajkosto> spice must flow
20:43 < rajkosto> yeah id like for the ipv4 people connected to the server to have ipv6
20:44 < rajkosto> no need to be bound to a ipv6 for the server itself
20:44 < krzee> from reading the manual it looks to me like --bind forces the node to bind to an ip/port (whereas my clients use --nobind so they DONt listen for anything)
20:44 < krzee> and --lport would be the src port for outgoing traffic (if you specify it)
20:44 < krzee> im not 100% but thats how it looks to me
20:45 < rajkosto> was that @ me ?
20:45 < krzee> nope, rommel0979 
20:45 < rommel0979> krzee, yes I have read that. lport also bind specific local port. and bind also bond local ip and port
20:45 < rommel0979> brb
20:45 < krzee> rommel0979, right, but maybe my client should NOT bind, but i still need to specify the src port for outgoing because of a nazi firewall
20:46 < krzee> rajkosto,
20:46 < krzee> !ipv6
20:46 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
20:46 < krzee> you can use this build:
20:46 < krzee> !snapshots
20:46 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
20:46 < rajkosto> isnt rc2 ipv6 capable ?
20:46 < rajkosto> on both win and lin
20:46 < krzee> and you see the options in !ipv6 #1
20:46 < krzee> no
20:46 < krzee> the tap adapter is
20:46 < krzee> not the actual openvpn
20:47 < krzee> baby steps... changing the windows tap adapter was a huge move
20:47 < krzee> gotta make sure it goes well before adding other large code changes
20:47 < krzee> plus the ipv6 code needs to be re-based before it can be merged again
20:47 < rajkosto> ah, i use point to multipoint
20:47 < krzee> you mean client/server
20:53 < JohnTeddy> yay, my android is rooted.
20:53 < rommel0979> krzee, im back. what do you mean about nazi firewall. I asked this question because if my client config does not use bind or lport in its configuration I cant connect to internet.
20:53 < rajkosto> well this ipv6 patch seems to add all of th needed things for topology subnet
20:53 < rajkosto> i might try it
20:53 < krzee> rommel0979, show me your client config
20:53 < krzee> like THIS
20:53 < krzee> !configs
20:54 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
20:54 < rommel0979> ok. please kindly wait
20:54 < krzee> rajkosto, what are you talking about?
20:54 < rajkosto> nevermind
20:54 < rajkosto> forget it
20:54 < krzee> im pretty sure you misunderstood something
20:55 < rommel0979> krzee --> http://pastebin.com/KaVjfaCf
20:56 < rajkosto> Don't use --topology subnet togheter with IPv6 (as of today). 
20:56 < rajkosto> still no go :(
20:56 < krzee> correct
20:56 < krzee> and also would be pointless
20:56 < krzee> server-ipv6 already uses a common pool
20:56 < rajkosto> yeah but i need it for my ipv4
20:56 < rommel0979> krzee I have posted to pastebin.
20:56 < krzee> as stated in the page
20:56 < krzee> rajkosto, you can only use one or the other, lol
20:57 < krzee> ipv6 or ipv4
20:57 < krzee> if you go ipv4, keep topology subnet, if you go ipv6, lose it
20:57 < rajkosto> dual stack
20:57 < krzee> you saying you think you can use --server and --server-ipv6?
20:57 < krzee> like TOGETHER
20:57 < krzee> ?
20:57 < rajkosto> that would be nice
20:58 < krzee> either way, you cant ;]
20:58 < rajkosto> caveat: the implementation is currently tied to ``ifconfig-pool'' - that is, IPv6 addresses are always allocated and released together with IPv4, and if the IPv4 pool is full, no IPv6 address can be allocated either. Needs cleanup when IPv4 is finally dead. 
20:58 < rajkosto> wait what
20:58 < krzee> orly?
20:58 < krzee> cron2, you here?
20:58 < rommel0979> krzee sir, I have posted the configuration here --> http://pastebin.com/KaVjfaCf
20:59 < krzee> thanx, im working too
21:00 < krzee> ouch
21:00 < krzee> that config has so many things i disagree with
21:00 < krzee> but instead of caring...
21:00 < rommel0979> can you edit it for me sir!
21:01 < krzee> you could change lport 80 to port 80, and add nobind
21:01 < krzee> actually no i cant, your config must agree with the server
21:01 < krzee> you disabled forward security, you disabled certs all together, your only source of password is a file
21:01 < rommel0979> but if I change to port 80 and use nobind sir, I cant connect to internet now. 
21:01 < krzee> i mean this is the least secure vpn i have ever seen
21:02 < krzee> ok, then leave it as is :)
21:02 < JohnTeddy> I have some system with a custom kernel, I need the 'tun' module to use openvpn. I can see teh linux source directory, is there an easy way to just compile this 'tun' driver in net/tun.c, then I can modprobe that? Or do I have to recompile everything?
21:02 < krzee> that part shouldnt hurt anything
21:02 < rommel0979> but may i know sir what is that purpose of changing it to port instead of lport and add nobind?
21:04 < krzee> i always use nobind, i see no reason for my clients to be listening
21:04 < rommel0979> will using port will bind the local and remote to the specified port sir like lport 
21:05 < krzee> but seriously, you shouldnt care too much bout this part
21:05 -!- zayka [~zayka@vir1a.toonel.net] has quit [Ping timeout: 240 seconds]
21:05 < krzee> if you made it work, you're fine there
21:05 < krzee> its the rest of the vpn that is crap ;]
21:05 < krzee> yanno, the security and stuff ;]
21:05 < rommel0979> ok sir. thanks for the comment. I will look upon it again. thanks for helping me out sir.
21:06 < krzee> np, no need to call me sir either =]
21:06 < rommel0979> ok. thanks again.
21:07 < rajkosto> madam
21:07 < rommel0979> :)
21:07 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
21:08 < krzee> :-p
21:08 < rommel0979> krzee, can you further advice me what config should I add to my server and client config to avoid constant intermittent connection
21:09 < krzee> !tcp
21:09 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
21:10 < rommel0979> is the problem coming from my tcp protocol?
21:12 < rommel0979> I was also trying to make a udp server and client configuration but it seems I cant figure out why it does not work for me. I just change the proto tcp to proto udp but will create error
21:19 < krzee> it could be, intermittent connections is what tcp-over-tcp causes when it melts down
21:19 < krzee> as explained in the link
21:20 < krzee> your server would have to be on udp too
21:26 < rommel0979> yes I am reading it now. thanks for the info.  Could you possible me give me a server and client configuration sample so I can verify what I have done wrong in my configs that I made at home.
21:26 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:26 < rommel0979> Aside from the manual sample.
21:27 < rommel0979> What I did is just change the tcp proto to udp proto. Will that do?
21:27 < rommel0979> I Can show you my current server under tcp.
21:28 < krzee> !sample
21:28 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
21:29 < rommel0979> thank you very much. will compare it to my configs now and study them.
21:32 -!- rommel0979 [~rommel@119.93.51.34] has quit []
21:37 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
22:04 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has quit [Ping timeout: 240 seconds]
22:13 -!- master_of_master [~master_of@p57B57DD7.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
22:15 -!- master_of_master [~master_of@p57B57B5C.dip.t-dialin.net] has joined #openvpn
22:29 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 252 seconds]
22:35 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
22:36 -!- rommel0979 [~rommel@119.93.51.34] has joined #openvpn
22:39 < rommel0979> krzee can I ask your comment about my iptables?
22:43 < rommel0979> anyone?
22:54 -!- rommel0979 [~rommel@119.93.51.34] has quit []
23:03 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has quit [Read error: Operation timed out]
23:03 -!- Mirrakor [~Leya@HSI-KBW-109-193-179-171.hsi7.kabel-badenwuerttemberg.de] has joined #openvpn
23:03 -!- Mirrakor [~Leya@HSI-KBW-109-193-179-171.hsi7.kabel-badenwuerttemberg.de] has quit [Changing host]
23:03 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has joined #openvpn
23:11 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has joined #openvpn
23:17 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 246 seconds]
23:19 < dorp> My client is under windows xp. When my internet (cables) modem is being disconnected for a short while, the openvpn client wouldn't re-connect. Is it optional to set such a behavior automatically?
23:46 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
23:50 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 246 seconds]
23:56 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
23:58 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
--- Day changed Tue Apr 19 2011
00:02 -!- rommel0979 [~rommel@119.93.51.34] has joined #openvpn
00:04 -!- rommel0979 [~rommel@119.93.51.34] has quit [Client Quit]
00:19 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
00:19 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has quit [Read error: Connection reset by peer]
00:19 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has joined #openvpn
00:22 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has quit [Read error: Connection reset by peer]
00:22 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has joined #openvpn
00:27 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
00:57 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
00:58 -!- ph1l [~ph1l@gprs09.swisscom-mobile.ch] has joined #openvpn
01:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:04 -!- blahdeblah [~paulgear@pdpc/supporter/student/blahdeblah] has joined #openvpn
01:05 < blahdeblah> Hi.  Is there a way to get an openvpn client to report the IP address of its currently connected remote server?  The USR2 signal mentioned in the man page seems to only report statistics to syslog, not status information.
01:21 < krzie> its prolly somewhere in the management interface
01:21 < krzie> !management
01:21 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface, or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
01:21 < krzie> or maybe the status file has it
01:21 < krzie> --status
01:22 < blahdeblah> krzie: The man page implies that what is put in the status file is the same as what shows up in syslog on SIGUSR2 - is that not correct?  I'll check out the management interface.
01:22 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:24 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
01:29 -!- K1ng\ [~KING@180.211.188.218] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
01:29 -!- K1ng [~KING@180.211.188.218] has joined #openvpn
01:31 < krzie> not sure
01:32 < krzie> ive never looked for what you're looking for =]
01:32 < krzie> oh wait, you could log it on login, is that enough?
01:32 < blahdeblah> I just tried status file - doesn't have IP in it.
01:32 < krzie> that would be easy
01:32 < krzie> its a var passed to a script
01:32 < blahdeblah> Of course
01:32  * blahdeblah slaps head
01:32 < krzie> make a script that dumps its ENV
01:32 < krzie> !script
01:32 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
01:33 < krzie> run the script in a few spots
01:33 < blahdeblah> I already have a script installed to restart snmpd - i'll add it to there.
01:33 < krzie> see whats best for you =]
01:35 < krzie> trusted_ip 
01:35 < krzie>  Actual IP address of connecting client or peer which has been authenticated. Set prior to execution of --ipchange, --client-connect, and --client-disconnect scripts.
01:35 < krzie> looks like thats it
01:36 < blahdeblah> cool
01:36 < blahdeblah> thanks krzie
01:38 < krzie> np
01:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
01:41 -!- ph1l [~ph1l@gprs09.swisscom-mobile.ch] has quit [Quit: ph1l]
01:45 <@vpnHelper> RSS Update - forum: Ping Problem <http://forums.openvpn.net/topic7966.html#p11355> || Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11354>
01:48 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 246 seconds]
01:58 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
02:03 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
02:17 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has quit [Read error: Connection reset by peer]
02:17 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has joined #openvpn
02:18 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
02:38 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
02:40 -!- Varazir_ [mircwars@c-94-255-130-33.cust.bredband2.com] has joined #openvpn
02:45 -!- Netsplit *.net <-> *.split quits: Varazir, sigius, aef
02:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:50 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has quit [Read error: Connection reset by peer]
02:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:52 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
03:01 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
03:15 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
03:27 <@vpnHelper> RSS Update - forum: simple roadwarrior with open-wrt server and Win 7 client <http://forums.openvpn.net/topic7951.html#p11356>
03:28 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
03:32 -!- dazo_afk is now known as dazo
03:46 -!- blahdeblah [~paulgear@pdpc/supporter/student/blahdeblah] has left #openvpn []
03:54 -!- f1assistance [~Carl@cpe-066-057-005-143.nc.res.rr.com] has joined #openvpn
04:11 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
04:23 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
04:28 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:28 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:55 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
05:27 <@vpnHelper> RSS Update - forum: VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html#p11357>
05:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:33 <@vpnHelper> RSS Update - forum: Ping Problem <http://forums.openvpn.net/topic7966.html#p11359> || Restricting all network traffic while a client is connected <http://forums.openvpn.net/topic7959.html#p11358>
05:35 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
05:36 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 248 seconds]
05:39 <@vpnHelper> RSS Update - forum: VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html#p11361> || Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11360>
05:51 <@vpnHelper> RSS Update - forum: VPN connection dropping on a specific server. <http://forums.openvpn.net/topic7956.html#p11364> || simple roadwarrior with open-wrt server and Win 7 client <http://forums.openvpn.net/topic7951.html#p11362>
05:55 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:19 -!- f1assistance [~Carl@cpe-066-057-005-143.nc.res.rr.com] has left #openvpn []
06:22 -!- style [style@richardt.fi] has joined #openvpn
06:23 < style> Hi, is openVPN able to connect other SSL VPNs? Such as zyxell zywall USG 100 hosted SSL VPN?
06:28 < AL13N_work> most VPNs aren't SSL, but ipsec based
06:29 < AL13N_work> i have not heard of any other VPNs rather than openvpn and ipsec-based ones
06:29 < style> well zywall has ipsec and ssl vpn
06:29 < AL13N_work> well, then perhaps it has both ipsec and openvpn
06:30 < AL13N_work> unless it found some other obscure ssl vpns
06:30 < AL13N_work> afaik
06:30 < AL13N_work> why don't you try?
06:30 < style> well.. maybe I'll try =)
06:31 < style> I'm doing it now =) I just wanted to ask if someone would had an answer
06:31 < AL13N_work> but, you know, you probably need certificates or user/pass combinations
06:31 < AL13N_work> afaik there is only ipsec and openvpn
06:31 < AL13N_work> i imagine that they will have some kind of documentation on how to connect to it
06:32 < style> there is "SSL Application List (Optional)"
06:32 < style> but it's empty :|
06:32 < AL13N_work> SSL Application list?
06:33 < style> in zywall configuration
06:33 < AL13N_work> SSL VPN Application list?
06:33 < AL13N_work> or is it something else?
06:33 < style> It's that what I said... It appears in config in SSL VPN section
06:34 < AL13N_work> heh
06:34 < AL13N_work> optional
06:34 < AL13N_work> perhaps it needs a bought module or something
06:34 < style> that could be, but google doesn't tell anything..
06:36 <@dazo> krzee: Just reading the backlog ... discussion about --server, --server-ipv6 and --topology subnet and not mixing them .... This is from my server config file, running cron2's openwrt version of openvpn : 
06:36 <@dazo> topology subnet
06:36 <@dazo> server 10.0.7.0 255.255.255.0
06:36 <@dazo> server-ipv6 2001:xxxx:xxxx:xxxx::/64
06:36 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has joined #openvpn
06:36 < AL13N_work> i suggest you speak with your zywall provider
06:36 <@dazo> krzee: and that works flawlessly
06:36 < dorp> My client is under windows xp. When my internet (cables) modem is being disconnected for a short while, the openvpn client wouldn't re-connect. Is it optional to set such a behavior automatically?
06:37 <@dazo> dorp: look at --keepalive in the man page
06:37 <@dazo> !man
06:37 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
06:37 < dorp> dazo: thanks
06:37 <@dazo> you're welcome!
06:38 < dorp> heh, openvpn.net is dead? :)
06:38 <@dazo> huh!?
06:39 <@dazo> seems so
06:39 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 252 seconds]
06:39 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
06:39 <@dazo> raidz: mattock: ^^^  
06:39 < dorp> it seems seriously laggy
06:39 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
06:39 <@dazo> yeah, even the community server is lagging as well
06:40 < dorp> dazo: mmm.. if I read it correctly - keepalive is for the server side?
06:42 <@dazo> dorp: nah, not exactly ... its more like a macro, which expands as described below ... notice the "if server then"
06:42 <@dazo> "if server: else: " I meant
06:43 < dorp> dazo: mmm... if I'm reading it accurately... if I have keepalive on the server - then it should've been pushed to the client
06:43 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 248 seconds]
06:43 < dorp> But with my scenario it doesn't seem to "reconnect"? :\
06:44 <@dazo> dorp: how's your client config like?  (pastebin please)
06:45 < dorp> dazo: http://pastebin.com/B4XpLWQJ
06:46 -!- ph1l [~ph1l@gprs53.swisscom-mobile.ch] has joined #openvpn
06:49 <@dazo> dorp: hmmm ... and what's the error you get when it tries to reconnect?
06:49 <@dazo> !logs
06:49 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
06:49 <@dazo> dorp: ^^  both server and client logs when this happens
06:50 <@dazo> (I'm using OpenVPN a lot myself, and it always reconnect ... so this is a bit unclear)
06:50 < dorp> dazo: I'll have to 'create' the situation... as-in, simply shutdown the modem and see what happens
06:50 <@dazo> understood
06:52 < dorp> be back within a few minutes, btw- thanks for your help
06:54 -!- Netsplit *.net <-> *.split quits: cpf_, ph1l
06:54 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has quit [Read error: Connection reset by peer]
06:55 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:57 <@vpnHelper> RSS Update - forum: OpenVPN Install Guides <http://forums.openvpn.net/topic2.html#p11365>
06:58 -!- Netsplit over, joins: cpf_
06:59 -!- ph1l [~ph1l@gprs29.swisscom-mobile.ch] has joined #openvpn
07:08 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Read error: Operation timed out]
07:10 -!- Sk00rchen [~Sk00rchen@83.251.230.74] has joined #openvpn
07:11 -!- ph1l [~ph1l@gprs29.swisscom-mobile.ch] has quit [Ping timeout: 240 seconds]
07:14 -!- Sk00rchen [~Sk00rchen@83.251.230.74] has quit [Ping timeout: 246 seconds]
07:14 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
07:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:46 <@vpnHelper> RSS Update - forum: OpenVPN Install Guides <http://forums.openvpn.net/topic2.html#p11366>
07:46 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
08:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:06 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has joined #openvpn
08:07 < dorp> dazo: Hey mate, any chance you're still here?
08:07 <@dazo> dorp: I'm in phone meetings now for the next 2 hours or so
08:08 < dorp> dazo: That's ok, I have time... I'll wait
08:21 < dorp> (trying one more thing, brb)
08:21 <@vpnHelper> RSS Update - forum: vpn between two routers <http://forums.openvpn.net/topic7968.html>
08:21 -!- dorp [~dorp@IGLD-84-228-132-112.inter.net.il] has quit [Quit: dorp]
08:36 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
08:36 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
08:38 -!- dorp [~dorp@173.212.197.30] has joined #openvpn
08:39 < dorp> Okay... I commented out: persist-key , and persist-tun ... and now it seems to reconnect fine
08:40 < pwrcycle> dorp: what OS?
08:41 < dorp> pwrcycle: Windows XP Pro SP3, OpenVPN GUI v1.0.3 (openvpn.se)
08:48 -!- style [style@richardt.fi] has left #openvpn []
08:52 <@vpnHelper> RSS Update - forum: vpn between two routers <http://forums.openvpn.net/topic7968.html#p11368>
08:58 <@vpnHelper> RSS Update - forum: vpn between two routers <http://forums.openvpn.net/topic7968.html#p11370> || Please Help: "No server certificate verification method" <http://forums.openvpn.net/topic7969.html>
09:03 -!- dorp [~dorp@173.212.197.30] has quit [Ping timeout: 246 seconds]
09:03 <@vpnHelper> RSS Update - forum: Ping Problem <http://forums.openvpn.net/topic7966.html#p11374> || vpn between two routers <http://forums.openvpn.net/topic7968.html#p11373> || Please Help: "No server certificate verification method" <http://forums.openvpn.net/topic7969.html#p11372>
09:04 -!- dorp [~dorp@173.212.197.30] has joined #openvpn
09:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:10 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
09:10 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
09:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:13 -!- dorp [~dorp@173.212.197.30] has quit [Ping timeout: 240 seconds]
09:25 -!- p3rror [~mezgani@41.140.34.126] has joined #openvpn
09:34 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 246 seconds]
09:34 <@vpnHelper> RSS Update - forum: vpn between two routers <http://forums.openvpn.net/topic7968.html#p11375>
09:37 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
09:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:07 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:10 <@vpnHelper> RSS Update - forum: vpn between two routers <http://forums.openvpn.net/topic7968.html#p11376>
10:16 <@vpnHelper> RSS Update - forum: Configuring OpenVPN (Bridged) on Windows XP with Public IPs <http://forums.openvpn.net/topic7970.html>
10:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:28 -!- luneff [~yury@84.51.195.188] has joined #openvpn
10:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:30 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
10:34 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11379> || Please Help: "No server certificate verification method" <http://forums.openvpn.net/topic7969.html#p11378>
10:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:40 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
10:52 <@vpnHelper> RSS Update - forum: vpn between two routers <http://forums.openvpn.net/topic7968.html#p11380>
10:58 <@vpnHelper> RSS Update - forum: Please Help: "No server certificate verification method" <http://forums.openvpn.net/topic7969.html#p11381>
11:10 <@vpnHelper> RSS Update - forum: Please Help: "No server certificate verification method" <http://forums.openvpn.net/topic7969.html#p11382>
11:11 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
11:11 -!- d303k [~heiko@port-92-198-130-130.static.qsc.de] has quit [Ping timeout: 260 seconds]
11:32 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:43 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
11:52 <@raidz> Hey all, just an update onopenvpn.net's intermittent downtime: Our Datacenters are having major routing issues and they are working to fix their Cisco routers as we speak. We are trying our hardest to keep our site online but are at their mercy.
11:52 <@raidz> dazo, mattock: ^^
11:52 <@dazo> raidz: thx!
11:52 <@dazo> ecrist: krzee: ^^^^
11:53 <@raidz> dazo: np, sorry I couldn't make it here sooner, we have been busy trying to help troubleshoot this.
11:53 <@dazo> no worries!  This is still good info :)  Better late than never :)
11:55 -!- p3rror [~mezgani@41.140.34.126] has quit [Quit: Leaving]
12:07 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 246 seconds]
12:08 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
12:10 <@vpnHelper> RSS Update - forum: Please Help: "No server certificate verification method" <http://forums.openvpn.net/topic7969.html#p11383>
12:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
12:21 < krzie> ahh thanx
12:22 < krzie> it happens =]
12:22 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11384>
12:29 < ecrist> interesting
12:30 < krzie> intermittent, i was confused by the bot updating as well
12:30 < krzie> lol
12:30 < krzie> bbiaf
12:34 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 248 seconds]
12:40 <@vpnHelper> RSS Update - forum: need to use public ip in my local lan <http://forums.openvpn.net/topic7961.html#p11385>
12:42 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Quit: reboot]
12:44 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
12:47 -!- rooth [rooth@92.43.35.21] has joined #openvpn
13:03 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 252 seconds]
13:14 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
13:14 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
13:36 -!- dazo is now known as dazo_afk
13:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
13:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:09 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
14:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:17 -!- scoopex [~scoopex@85.214.140.184] has left #openvpn []
14:19 < K1ng> some one please recommend me a handycamwithin $400
14:19 < K1ng> some one please recommend me a handycam within $400
14:23 < Bushmills> does it need to be openvpn compatible?
14:23 < gladiatr> lol
14:24 < K1ng> happy birthday to http://www.expertreviews.co.uk/camcorders/277600/sony-hdr-cx115e/specifications
14:24 <@vpnHelper> Title: Sony HDR-CX115E specifications | Expert Reviews (at www.expertreviews.co.uk)
14:24 < K1ng> lol
14:24 < K1ng> Bushmills, no. lol :p
14:39 < Bushmills> K1ng: for cameras, compatible with other VPN software, please join the respective channel. openvpn compatbile cameras are only compatible with openvpn 
14:39 < K1ng> lol
14:43 -!- corretico [~luis@201.201.44.82] has joined #openvpn
14:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
15:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:01 -!- rigel [~saxonberg@c-68-34-78-124.hsd1.md.comcast.net] has left #openvpn []
15:10 -!- kyrix [~ashley@92.90.21.5] has joined #openvpn
15:11 -!- kyrix [~ashley@92.90.21.5] has quit [Max SendQ exceeded]
15:12 -!- kyrix [~ashley@92.90.21.5] has joined #openvpn
15:12 -!- kyrix [~ashley@92.90.21.5] has quit [Max SendQ exceeded]
15:13 -!- kyrix [~ashley@92.90.21.5] has joined #openvpn
15:14 -!- kyrix [~ashley@92.90.21.5] has quit [Max SendQ exceeded]
15:14 -!- kyrix [~ashley@92.90.21.5] has joined #openvpn
15:15 -!- kyrix [~ashley@92.90.21.5] has quit [Max SendQ exceeded]
15:15 -!- kyrix [~ashley@92.90.21.5] has joined #openvpn
15:16 -!- kyrix [~ashley@92.90.21.5] has quit [Max SendQ exceeded]
15:17 -!- kyrix [~ashley@92.90.21.5] has joined #openvpn
15:17 -!- kyrix [~ashley@92.90.21.5] has quit [Max SendQ exceeded]
15:18 -!- kyrix [~ashley@92.90.21.5] has joined #openvpn
15:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:53 <@vpnHelper> RSS Update - forum: Can't Access Shared Windows Printer over OpenVPN <http://forums.openvpn.net/topic7971.html>
15:54 < krzee> lol Bushmills =]
16:00 < Bushmills> why laugh? openvpn compatible cameras exist.
16:04 < krzee> =]
16:12 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:19 -!- kyrix [~ashley@92.90.21.5] has quit [Quit: Leaving]
16:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:43 < amir> krzee, i slowly get the feeling any ovpn tunnel on tun1 (the second one) will produce that "write to tun" error
16:43  * amir has setup the 3. ptp link
16:43 < amir> the one connecting the two ovpn clients of the first 2 links
16:44 < amir> and voila: the error showed up again
16:44 < amir> precisely with a 1min clock ;)
16:47 < krzee> only ever on tun1?
16:47 -!- Guifort [~Guifort@78.123.162.197] has joined #openvpn
16:47 < Guifort> op
16:48 < krzee> no op
16:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: Leaving]
17:14 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
17:14 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
17:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:17 <@vpnHelper> RSS Update - forum: What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html> || Kill The Resources Being Used By OpenVPN Desktop Client <http://forums.openvpn.net/topic7836.html#p11387>
17:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
17:37 -!- Guifort [~Guifort@78.123.162.197] has quit [Quit: Quitte]
17:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:05 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 260 seconds]
18:24 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
18:24 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
18:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:33 < krzee> !win_rollup
18:33 <@vpnHelper> "win_rollup" is please see http://www.secure-computing.net/wiki/index.php/OpenVPN/HowTo_for_Windows_2 for dazo's writeup on making unattended windows installers for openvpn
18:33 < |Mike|> aloha
18:44 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
18:45 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Client Quit]
19:05 -!- master_of_master [~master_of@p57B57B5C.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
19:07 -!- master_of_master [~master_of@p57B56D9E.dip.t-dialin.net] has joined #openvpn
19:19 -!- diemaco [~df@d204-191-182-51.abhsia.telus.net] has quit [Quit: ZNC - http://znc.in]
19:20 -!- diemaco [~df@d204-191-182-51.abhsia.telus.net] has joined #openvpn
19:27 -!- master_of_master [~master_of@p57B56D9E.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
19:42 -!- echoSMIL1 [~censured@bl17-84-31.dsl.telepac.pt] has joined #openvpn
19:44 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 240 seconds]
19:45 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
19:46 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:04 -!- master_of_master [~master_of@p57B55220.dip.t-dialin.net] has joined #openvpn
20:31 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:05 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 246 seconds]
21:07 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
21:37 -!- colision [logos@187.78.235.88] has joined #openvpn
21:38 < colision> Seting tls-auth ta.key 1, cipher AES-256-CBC and ns-cert-type server can slow down the speed of the connection on OpenVPN?
21:56 < krzee> are you having speed issues?
21:56 < krzee> if so... did you try getting rid of those 1 at a time and see if it helped you any?
21:57 < colision> yes, i did. but didint made much difference
21:57 < krzee> even if the answer to your question is yes, it may be so negligible that you think the answer is no after testing
21:57 < krzee> hahah exactly
21:58 < colision> I changed a Linux box for a OpenBSD box running OpenVPN. now users says that its "slower" than the old box
21:58 < krzee> could be... did you run any tests?
21:58 < colision> ping is the same
21:58 < krzee> they have different tun adapters
21:58 < krzee> ping wouldnt do it
21:58 < colision> traffic test right?
21:58 < krzee> you would wanna test things like iperf over the tun adapter
21:59 < krzee> maybe WHILE pinging
21:59 < colision> i see
21:59 < colision> if i found its really slower then the linux box, what else can i do?
22:00 < krzee> try to see if you can speed it up by tuning the machine
22:00 < krzee> or switch back to linux
22:00 < krzee> its hard to say without knowing whats really going on
22:00 < krzee> "box a is slower, what should i do" doesnt really have an answer
22:01 < colision> yes, i agree
22:01 < colision> i am going to linux as i dont trust it to be a firewall/vpn
22:01 < colision> also i dont know linux
22:02 < colision> ah, i also set the key to 2048
22:02 < colision> but i changed to 1024 and had same result
22:02 < krzee> mine is 4096 ;)
22:02 < krzee> right, thats only for making the connection
22:02 < krzee> once connected cipher would be the constant encryption
22:02 < colision> does the key makes any difference on speed or overheard the tunnel?
22:02 < krzee> the certs are just for the connection phase, like passwords
22:03 < krzee> nope, just on the speed of the orig connection
22:03 < krzee> and the hourly renegotion 
22:04 < colision> i tried with freebsd too
22:04 < colision> thats why i think i did something wrong on the openvpn
22:05 < krzee> did you try testing your MTU?  are you using UDP?
22:05 < krzee> i use openvpn on freebsd, as does ecrist and a few other users here
22:05 < krzee> never had speed issues
22:05 < colision> yes, UDP 
22:05 < krzee> udp = good
22:05 < krzee> !mtu
22:05 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
22:05 < krzee> test your MTU
22:06 < colision> oh, interesting
22:07 < colision> MTU on the tun interface or on the card interface?
22:16 < ecrist> heh
22:16 < ecrist> we push mad speed over openvpn on freebsd
22:20 < jpalmer> freebsd sucks!
22:21  * jpalmer is kidding.  I'm a fbsd guy.
22:25 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:35 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
22:35 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
22:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Client Quit]
22:40 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Connection reset by peer]
22:41 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
22:44 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:03 -!- Netsplit *.net <-> *.split quits: Rolybrau
23:10 -!- Netsplit over, joins: Rolybrau
23:13 -!- Carbon_Monoxide [~cmonxide@061093232225.ctinets.com] has joined #openvpn
23:23 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:26 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 246 seconds]
--- Day changed Wed Apr 20 2011
00:02 -!- Carbon_Monoxide [~cmonxide@061093232225.ctinets.com] has quit [Ping timeout: 252 seconds]
00:05 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 258 seconds]
00:19 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
00:26 -!- twister004 [~chatzilla@117.204.140.80] has joined #openvpn
00:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:50 <@vpnHelper> RSS Update - forum: my other wish <http://forums.openvpn.net/topic7973.html>
00:53 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
00:54 -!- rommel [rommel@119.93.51.34] has joined #openvpn
00:55 -!- twister004 [~chatzilla@117.204.140.80] has quit [Ping timeout: 246 seconds]
00:55 -!- twister004_ is now known as twister004
00:55 < rommel> good day. krzee I would like to thank you for your udp sample yesterday. now I have successfully edited my config and successfully initiated my openvpn server. thank you very much.
00:56 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
00:59 < krzie> you're welcome =]
00:59 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:00 < rommel> Good day all. Can somebody assist me on my iptabales/firewall rules. I have my own firewall rules but I would like to ask your comment on it in relation to my openvpn. 
01:01 < krzie> !notovpn
01:01 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
01:01 < krzie> bbl
01:04 < rommel> what channel could I possibly ask assistance from?
01:04 < jeev> ##netfilter
01:05 < rommel> thanks jeev
01:05 < jeev> or #netfilter i think
01:05 -!- rommel [rommel@119.93.51.34] has left #openvpn []
01:19 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11390>
01:25 <@vpnHelper> RSS Update - forum: Please Help: "No server certificate verification method" <http://forums.openvpn.net/topic7969.html#p11392> || vpn between two routers <http://forums.openvpn.net/topic7968.html#p11391>
01:31 <@vpnHelper> RSS Update - forum: Kill The Resources Being Used By OpenVPN Desktop Client <http://forums.openvpn.net/topic7836.html#p11394> || Can't Access Shared Windows Printer over OpenVPN <http://forums.openvpn.net/topic7971.html#p11393>
01:37 <@vpnHelper> RSS Update - forum: What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11395>
01:54 -!- olijg [~peanut@113.4.155.216] has joined #openvpn
01:54 < olijg> tsocks keeps demanding a username and password where none is needed
01:55 < olijg> firefox connects just fine...
01:55 < olijg> is there some way to force tsocks to use "no authentication"
01:55 < olijg> ?
02:07 <@vpnHelper> RSS Update - forum: What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11396>
02:10 -!- Phenox_ [~Bernd@88.215.198.24] has quit [Remote host closed the connection]
02:15 -!- olijg [~peanut@113.4.155.216] has left #openvpn []
02:24 -!- rommel [~rommel@119.93.51.34] has joined #openvpn
02:31 -!- rommel [~rommel@119.93.51.34] has quit []
02:33 -!- zayka [~zayka@vir1a.toonel.net] has quit [Remote host closed the connection]
02:34 -!- rommel [~rommel@119.93.51.34] has joined #openvpn
02:42 -!- rommel [~rommel@119.93.51.34] has quit []
02:43 < hyper_ch> krzee: help :)
02:55 <@vpnHelper> RSS Update - forum: How to receive a mail on client connection and disconnecti ? <http://forums.openvpn.net/topic7974.html>
03:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:06 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Ping timeout: 248 seconds]
03:06 -!- dazo_afk is now known as dazo
03:08 -!- d12fk [~heiko@port-92-198-130-130.static.qsc.de] has joined #openvpn
03:12 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
03:12 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
03:15 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Ping timeout: 240 seconds]
03:16 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has quit [Ping timeout: 240 seconds]
03:17 -!- rommel [~rommel@119.93.51.34] has joined #openvpn
03:18 < rommel> good day all. I would like to ask about UDP. since connect-retry is not applicable for UDP, is there an instance that UDP will retry on its connection?
03:23 < rommel> guy? anybody around?
03:24 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has joined #openvpn
03:27 -!- rommel [~rommel@119.93.51.34] has quit []
03:29 <@vpnHelper> RSS Update - forum: How to receive a mail on client connection and disconnecti ? <http://forums.openvpn.net/topic7974.html#p11399> || What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11398>
03:32 -!- Carbon_Monoxide [~cmonxide@061093232225.ctinets.com] has joined #openvpn
03:37 -!- MarKsaitis__ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
03:38 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 258 seconds]
03:47 <@vpnHelper> RSS Update - forum: How to receive a mail on client connection and disconnecti ? <http://forums.openvpn.net/topic7974.html#p11400>
03:48 -!- MarKsaitis_ [~MarKsaiti@81.137.245.117] has joined #openvpn
03:49 -!- MarKsaitis__ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 248 seconds]
03:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:59 -!- MarKsaitis_ [~MarKsaiti@81.137.245.117] has quit [Ping timeout: 260 seconds]
04:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:11 <@vpnHelper> RSS Update - forum: How to receive a mail on client connection and disconnecti ? <http://forums.openvpn.net/topic7974.html#p11401>
04:17 <@vpnHelper> RSS Update - forum: How to receive a mail on client connection and disconnecti ? <http://forums.openvpn.net/topic7974.html#p11402>
04:20 -!- lpe [~lpe@mute.nu] has joined #openvpn
04:20 < lpe> !welcome
04:20 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:23 < lpe> I'd like to monitor logins/logouts on my VPN server, right now I see "[REMOTE-ACCESS_user] Peer Connection Initiated with ip:port" when a user logs in, but nothing when disconnecting
04:24 < lpe> any ideas on how to add like "REMOTE-ACCESS_user] Peer Disconnected" or something to the openvpn.log?
04:24 < lpe> verbose 2 right now
04:26 < Bushmills> lpe: --client-connect and --client-disconnect allow you to script any connect/disconnect action
04:27 < lpe> I don't think --client-connect is used to print the Connection Initated part in the openvpn.log, right?
04:28 < lpe> so I guess there should be an easier way just to add "Connection Disconnected" in the log
05:02 -!- rooth [rooth@92.43.35.21] has quit [Ping timeout: 260 seconds]
05:03 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
05:11 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
05:22 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
05:22 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
05:28 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
05:28 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
05:29 <@vpnHelper> RSS Update - forum: Verify openvpn encryption <http://forums.openvpn.net/topic7975.html>
05:39 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
05:41 <@vpnHelper> RSS Update - forum: Verify openvpn encryption <http://forums.openvpn.net/topic7975.html#p11404>
05:45 -!- APTX_ [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
05:47 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
05:53 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html>
05:59 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11406>
06:06 -!- Carbon_Monoxide [~cmonxide@061093232225.ctinets.com] has quit [Quit: Leaving]
06:11 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11408> || Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11407>
06:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: No route to host]
06:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:30 -!- mode/#openvpn [+o mattock] by ChanServ
06:30 -!- takamichi [Takamichi@46.11.14.68] has joined #openvpn
06:33 <@dazo> lpe: have a look at --ipchange ... that script is called right after the "Connection Initiated" statement is logged
06:34 < lpe> hmm
06:34 < lpe> alright
06:34 <@dazo> (if you want to dig into the code, look for link_socket_connection_initiated() in socket.c, line 1657)
06:34 < lpe> not sure I want to go that deep :-)
06:34 <@dazo> :)
06:34 < lpe> I assumed it to be some sorta flag in the config or alike
06:35 <@dazo> nope
06:35 < lpe> alright then
06:35 < lpe> but --ipchange, that's only when initiated right?
06:35 < lpe> but if I disconnect, does the server even notice that?
06:35 <@dazo> To register logouts, you probably want to look at either --client-disconnect or --learn-address 
06:35 < lpe> aha
06:36 < lpe> --client-disconnect cmd : Run script cmd on client disconnection.
06:36 < lpe> that sure seems to be what I'm after
06:36 <@dazo> --learn-address might not be so suitable if running TUN, but with TAP it is also called after --client-disconnect, when the VPN IP address is "released"
06:37 < lpe> alright
06:37 < lpe> I'd really like it just to do exactly what --ipchange does
06:37 < lpe> print something to the log, more or less
06:37 <@dazo> then --client-disconnect probably suits you
06:38 < lpe> yea I guess
06:38 < lpe> how can I found out what --ipchange actually do? do I need to look into the source?
06:39 <@dazo> or look at the man page?
06:39 < lpe> I guess I could just create a script for "$user connected" >> openvpn.log tbh
06:39 <@dazo>       --ipchange cmd
06:39 <@dazo>               Execute shell command cmd when our remote ip-address is initially authenticated or changes.
06:40 < lpe> yea, I understood so far
06:40 <@dazo> heh ... nice little detail I've overlooked:
06:40 <@dazo>               Don't use --ipchange in --mode server mode.  Use a --client-connect script instead.
06:40 < lpe> but apparently it already have some sorta config since I get the 'Initiated' part in the log
06:40 < lpe> oh
06:41 < lpe> but this will probably suffice very well
06:41 <@dazo> the 'Initiated' part is found in socket.c, which I pointed you at ... that's not anything config related at all
06:41 < lpe> ah, alright
06:42 < lpe> but erm .. how do I specificy variables with --client-disconnect?
06:42 < lpe> like $user logged off $remoteip etc
06:45 <@dazo> lpe: look in the man page, it's all described in the "SCRIPTING AND ENVIRONMENTAL VARIABLES" section
06:45 < lpe> thank you
06:51 <@vpnHelper> RSS Update - forum: Ping Problem <http://forums.openvpn.net/topic7966.html#p11409>
06:55 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 258 seconds]
06:56 < lpe> open up openvpn.log in vim was quite stupid without logrotation 
06:56 <@vpnHelper> RSS Update - forum: my other wish <http://forums.openvpn.net/topic7973.html#p11410>
06:56 < lpe> *yawn*
06:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Quit: No Ping reply in 180 seconds.]
07:00 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
07:00 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
07:00 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
07:20 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Remote host closed the connection]
07:22 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
07:23 < lpe> dazo: as far as I can see, openvpn only tries to execute the script if I reconnect, not disconnect
07:24 < lpe> aswell as saying it cannot be executed, but I suspect that's another issue
07:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:24 <@dazo> lpe: it would help if we could see the log files
07:25 < lpe> give me a moment
07:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 248 seconds]
07:30 < lpe> dazo: http://pastebin.mozilla.org/1208401
07:31 <@dazo> please, don't send a crippled log file ... the complete stuff, please
07:31 < lpe> dazo: first row is my connect, but inbetween the first section and the last I disconnected and waited for a while, then I reconnected at 14:16:58 and got the error
07:31 <@dazo> and make sure you use at least --verb 4
07:31 < lpe> that's not really a crippled log file though, everything relevant should be in it
07:31 < lpe> but sure, I verbose
07:32 <@dazo> well, I want to be sure there's not missing some details which might look irrelevant
07:34 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:34 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:34 < Bushmills> details like --script-security :)
07:34 < lpe> that's set to 2
07:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
07:39 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 248 seconds]
07:40 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
07:43 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Remote host closed the connection]
07:46 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
08:00 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11411>
08:02 -!- rommel [~rommel@112.198.78.103] has joined #openvpn
08:03 < rommel> good day all. can I ask what command will I place in linux to check the status of the openvpn server.
08:06 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11412>
08:06 < |Mike|> init.d script?
08:06 < |Mike|> etc/init.d/openvpn status
08:06 < |Mike|> or just ps-aux...
08:07 < rommel> let me try now Mike tnx. I will get back to you after testing. tnx for the reply
08:09 < rommel> for ps-aux -> command not found and for etc/init.d/openvpn status-> error
08:12 < rommel> i guess the command are not working Mike
08:12 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11414> || Ping Problem <http://forums.openvpn.net/topic7966.html#p11413>
08:14 < hyper_ch> hi dazo
08:14 <@dazo> hyper_ch: hey!
08:14 < hyper_ch> dazo: you're any familiar with cryptography and breaking of such?
08:15 <@dazo> hyper_ch: no, not really ... I know a lot of the bare basics concepts behind SSL, but not how cryptography itself works
08:16 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
08:17 < hyper_ch> dazo: you know anyone in here who does?
08:17 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11415>
08:17 < rommel> let me repeat my question please bout command to get the status of openvpn service
08:18 <@dazo> hyper_ch: not really
08:18 < hyper_ch> dazo: ok :) too bad
08:20 <@dazo> rommel: you don't need to repeat questions ... people respond here when they have something to say
08:21 < rommel> pardon me Dazo
08:22 <@dazo> rommel: I believe |Mike| meant:  ps -aux .... or often just 'ps aux' on Linux
08:22 < rommel> let me try again 
08:24 <@dazo> otherwise, /etc/init.d/openvpn status ... might be the proper file
08:25 < rommel> using ps -aux now works. but it presented me USER, PID, %CPU STAT etc. what should I look to see the status of openvpn server if it is still online or already stopped
08:33 <@dazo> rommel: the you might want to have a look at the --management options for OpenVPN .... the man page describes them, as well as this file: http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=blob;f=management/management-notes.txt;h=1f4cbd0193116ed4bc72a4ceb108080da42399ab;hb=6d1d08f6792109a4a4cdd9cd0936fd4338c76fa1  (management-notes.txt)
08:33 <@vpnHelper> Title: SourceForge - openvpn/openvpn-testing.git/blob - management/management-notes.txt (at openvpn.git.sourceforge.net)
08:33 -!- rommel [~rommel@112.198.78.103] has quit [Read error: Connection reset by peer]
08:36 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11416>
08:52 -!- rommel [~rommel@amertospromotions.com] has joined #openvpn
08:53 < rommel> when I tried the command service openvpn status the result is openvpn: service not started but my openvpn server is already running coz I verified it with connecting my client to server successfully.
08:53 < rommel> what can be the problem here?
08:54 < Bushmills> problem is probably that openvpn is already running
08:54 < Bushmills> possibly not started using init.d script
08:55 -!- rommel0979 [~rommel@112.198.78.103] has joined #openvpn
08:57 -!- rommel [~rommel@amertospromotions.com] has quit [Ping timeout: 240 seconds]
08:58 < rommel0979> ?
09:00 -!- rommel0979 [~rommel@112.198.78.103] has quit []
09:13 -!- darkdrgn2k [~darkdrgn@199.243.221.174] has joined #openvpn
09:13 < darkdrgn2k> hey all
09:13 < darkdrgn2k> im using learn-address to register internal ip addresses in a database
09:14 < darkdrgn2k> what cna i use to do the same for external ips?
09:17 <@dazo> darkdrgn2k: I thought you had external IP available as well in --learn-address, as $trusted_ip, or something like that ...
09:18 < darkdrgn2k> dazo,  yeh just reading up on it in the man... 
09:18 < darkdrgn2k> i think $trusted_ip is it
09:19 <@dazo> darkdrgn2k: ahh., no, it's $2 with the IP address in TUN mode ... and the client's TAP MAC address in TAP mode
09:19 < darkdrgn2k> $2 is remote VPN address not wan :-P
09:20 <@dazo> dug
09:20 <@dazo> duh :/
09:20 < darkdrgn2k> $trusted_ip is the remote wan ip thast what i was looking for :-P
09:21 <@dazo> if it is available, then it's perfect match :)  ... but I remember --learn-address is a bit tricky, it has less info than the other script hooks
09:21 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
09:22 < darkdrgn2k> i just tested it and it seems trusted ip exists
09:22 < darkdrgn2k> would make sence.. its after wuth happens 
09:23 < darkdrgn2k> just will make life easier for us if we have a DNS entry for an external ip if the vpn tunnle goes down
09:30 < Bushmills> !nsupdate
09:30 <@vpnHelper> "nsupdate" is http://scarydevilmonastery.net/client_connect_nsupdate for a script Bushmills wrote to solve the question How can my vpn update my nameserver?
09:32 < jpalmer> Bushmills: you wrote that?  I've been using it and didn't realize it.
09:33 < Bushmills> written by somebody else it will probably look very similar
09:38 -!- K1ng\ [~KING@180.211.188.118] has joined #openvpn
09:40 < jpalmer> ahh,   yep.  mine wasn't the same one.   (and has the ability to delete the record when the client disconnects)
09:40 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11417>
09:41 -!- K1ng [~KING@180.211.188.218] has quit [Ping timeout: 276 seconds]
09:58 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11418>
10:00 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
10:00 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
10:04 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11419>
10:05 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 252 seconds]
10:05 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
10:28 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11420>
10:35 < darkdrgn2k> Bushmills, : hmm i wrote my own...
10:35 < darkdrgn2k> hmm
10:36 < darkdrgn2k> baiscally same as mine except i wrote the config to a file and piped it to nsupdate
10:36 -!- takamichi [Takamichi@46.11.14.68] has quit [Ping timeout: 264 seconds]
10:36 -!- takamichi [Takamichi@46.11.14.68] has joined #openvpn
10:37 < Bushmills> darkdrgn2k: small effort, indeed.  there was a phase where "updating name servers" was a FAQ here, that's when that factoid went in 
10:38 < darkdrgn2k> jsut worreid if i did it "right" lol... good to see i have
10:40 -!- rajkosto [~rajkosto@2001:470:1f0b:728:89e2:cc3e:8727:cee7] has joined #openvpn
10:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
10:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:01 -!- rommel [~rommel@amertospromotions.com] has joined #openvpn
11:03 < rommel> I have question quys. I have successfully initiated my server under proto udp port 80 with the help of krzee.  using wired connection I can connect my client to my server but with wireless connection, it is always failure.  I am stuck in this line "TLS Error: TLS key negotiation failed to occur within 60 seconds"
11:03 < rommel> Please kindly assist me how to solve this problem.
11:04 -!- havoc [~havoc@208.87.120.111] has quit [Ping timeout: 276 seconds]
11:04 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
11:05 < krzee> general network error
11:05 < krzee> its being blocked by something
11:05 < krzee> not related to openvpn
11:05 < rommel> but if I use tcp protocol krzee in wireless connection, I can connect to my server but not under udp.
11:06 < rommel> why can be the problem? can it be the port?
11:06 < krzee> sure it *can* be, its a firewall
11:06 < krzee> without knowing how the firewall is configured, i could not possibly know more than you about it
11:07 < rommel> I am not that knowledgeable about firewall.  Can I give you my firewall rules so you can give me your comment and suggestion krzee?
11:08 < krzee> nope
11:08 < krzee> im not in #iptables for a good reason... its not what i support
11:08 < krzee> btw, it might not be *your* firewall
11:08 < krzee> assuming its not your wifi
11:09 < Bushmills> !firewall
11:09 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
11:09 < Bushmills> rommel: ^^^
11:09 < rommel> what do you mean? btw I used the same iptables from my tcp protocol and apply it also in my udp protocol
11:10 < Bushmills> ehm ... as krzee suggested
11:10 < krzee> Bushmills, i see yet another person was helped by !nsupdate =]
11:10 < Bushmills> just attempted. most folks here didn't require any help
11:10 < Bushmills> which is good :)
11:12 < dkr> !android
11:12 <@vpnHelper> "android" is (#1) the easiest way to get openvpn on android is to run cyanogenmod, since it comes with tun / busybox / and i think the new version even includes openvpn!, or (#2) if you already have tun/root/busybox you can use android-openvpn-installer and openvpn-settings from the market
11:14 -!- luneff [~yury@84.51.192.6] has joined #openvpn
11:20 -!- rommel [~rommel@amertospromotions.com] has quit []
11:21 < hyper_ch> awww... I don't like cyanogenmod that much... I prefer beast
11:36 <@raidz> MIUI FTW!
11:36 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
12:05 -!- rommel [~rommel@amertospromotions.com] has joined #openvpn
12:06 < rommel> guys I have already check my firewall but still I cant connect to my server using udp protocol. could it be on mtu and mssfix?
12:09 < rommel> what are your comment guys?
12:09 < jpalmer> it could be a lot of things.  do you have any logs?
12:11 < rommel> I have not downloaded my logs. I used my tcp now so that I can go back and read the manual again.
12:15 -!- rommel [~rommel@amertospromotions.com] has quit [Read error: Connection reset by peer]
12:15 -!- rommel [~rommel@amertospromotions.com] has joined #openvpn
12:15 < rommel> jpalmer, what is you idea? 
12:16 <@dazo> give him logs and he might have some idea
12:16 <@dazo> it just sounds like firewall issues right now
12:16 <@dazo> (which is the case in 95% of all cases)
12:17 < jpalmer> rommel: my idea is:  logs help form actual ideas
12:17 < jpalmer> without logs,   we're just guessing.  and I'm not interested in playing a guessing game.
12:17 < rommel> @dazo, can you please help me with firewall. I have gone probably 10 times over my firewall and testing it but nothing happens. please
12:18 < rommel> jpalmer, what logs do you need? log from the client?
12:18 < krzee> and like i said before, it might not even be YOUR firewall
12:19 <@dazo> rommel: have you disabled your firewall?  try that for a starter while running your test .... and it also depends on if you have any firewall/routers in front of your openvpn server as well
12:19 < krzee> and it certainly could be your ISP
12:19 < krzee> especially given where you live
12:20 < krzee> they arent known for playing nice
12:20  * dazo deletes his lines as krzee is saying the same
12:20 <@vpnHelper> RSS Update - forum: need to use public ip in my local lan <http://forums.openvpn.net/topic7961.html#p11421>
12:20 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
12:20 < rommel> krzee, but why can I use the tcp protocol?
12:20 < krzee> no no keep them there dazo
12:20 < krzee> he needs to hear it a number of times
12:20 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
12:20 < krzee> rommel, cause the firewall allows it
12:20 -!- luneff [~yury@84.51.192.6] has joined #openvpn
12:20 < krzee> lol
12:21 < krzee> udp and tcp are different, just cause a firewall allows 1 doesnt mean it will allow the other
12:21 < rommel> I change the firewall to fit for udp
12:22 <@dazo> rommel: but what about firewalls *in front* of your infrastructure?  What about your *ISP*, do they allow traffic on UDP port 80?
12:22  * dazo wonders how many times we must repeat this information
12:23 < rommel> dazo: that I dont know ! probably I need to play with other ports right?
12:24  * dazo bites his finger not to be too nas^H^H
12:24 <@dazo> Good idea!
12:24 < krzee> lol
12:25 < jpalmer> rommel:  you might also want to test that the port is available from the client using something like netcat or nmap.
12:26 < rommel> krzee please dont laugh on my situation. Please bear with me. I all the assistance that I could probably get.
12:26 < krzee> learn how to use nc (aka netcat)
12:26 < jpalmer> ie,  from the client,   check that you can reach the server on the appropriate port, and appropriate protocol.
12:26 < krzee> you can test if you can reach a port without openvpn
12:26 < krzee> aka:
12:26 < krzee> !notovpn
12:26 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
12:27 < krzee> (for the 3rd time since you started asking about this stuff)
12:27  * jpalmer shoots krzee in the foot
12:27 < jpalmer> it's ok though,  it's only a .22,  you probably didn't even feel it.
12:27 < rommel> jpalmer/krzee: thanks for the advice. Krzee sorry for the repeated questions. Its just I cant figure this thing to work.
12:28 < krzee> right, because you are asking for firewall help (and general networking info) in #openvpn
12:28 < krzee> if you go to a place that deals in what you ask, you get better results
12:28 < rommel> I also asked assistance in netfilter though.
12:28 < krzee> great
12:28 < krzee> that doesnt relate to us ;)
12:28 < krzee> aka if they didnt answer, wait longer
12:29 < krzee> just cause we are here doesnt mean we support everything networking related
12:29 < krzee> we will try to be helpful of course
12:29 < rommel> Yes I also waited longer. actually while waiting I was also googling.
12:29 < krzee> but we cant explain basic networking as often as is requested
12:29 < krzee> you should have googled before asking =]
12:29 < rommel> I understand
12:29  * dazo hopes 'longer' means 8-10 hours or more
12:30 < krzee> shit when i came to #openvpn my first time, you had to wait DAYS to get any answer on ANYTHING
12:30 < krzee> literally, days
12:30 <@dazo> I believe :)  it seems like you now usually get an answer within 12 hours, some how 
12:30 < rommel> wow never thought of that long.
12:31 <@dazo> rommel: irc is instant messaging, but it doesn't mean instant answers
12:31 < krzee> dazo, maybe within 3 hours, the other 9 is often the user refuting the answer, lol
12:31 <@dazo> lol
12:31 <@dazo> krzee++
12:31 < rommel> yes I understand. It was just contrary to the irc I have been chatting here in our country. 
12:31 < krzee> speaking of which, i got proven wrong by a user recently
12:31 < krzee> there is a typo in the howto that i was defending
12:32 < krzee> ifconfig-push syntax is backwards in the howto... which led to it being backwards on my bot in !static
12:32 < krzee> after pasting the user the syntax from the manual, and explaining it, i was like "oh, wtf"
12:32 < krzee> lol
12:33 < rommel> :)
12:35 <@dazo> krzee: neat :)
12:36 <@dazo> we're just humans as well, it happens we do mistakes as well .... not often though, but it happens ;-)
12:36 < krzee> i was mostly surprised that i hadnt heard of that before
12:37 < krzee> the howto has been there for SO long
12:37 < rommel> huhuhuhu.... netcat is not in my centos
12:38 < rommel> command not found. what a life
12:38 < krzee> google
12:38 < krzee> this is #openvpn
12:38 < rommel> googled it
12:38 < rommel> yep trying my best now
12:38 < krzee> great, this is the place for OPENVPN questions
12:38 < krzee> =]
12:39 < rommel> :)
12:39 <@dazo> rommel: try yum install nc
12:39 <@dazo> Name       : nc
12:39 <@dazo> Description: The nc package contains Netcat (the program is actually nc), a
12:41 < rommel> what I did what yum install netcat instead. it was wrong?
12:43 < rommel> yes it was wrong
12:43 < rommel> yum install nc is the right one.
12:45 < rommel> i used nc -vzu x.x.x.x 80 and it succeeded but i made it in the server.
12:46 <@dazo> why did you add -z?
12:47 <@dazo>      -z      Specifies that nc should just scan for listening daemons, without
12:47 <@dazo>              sending any data to them.  It is an error to use this option in
12:47 <@dazo>              conjunction with the -l option.
12:47 < rommel> i dont know dazo, I just followed the example in google?
12:47 <@dazo> you need to make nc *listen* on your server ... and then connect from a client outside ... and if what you type on the client pops up at the server, *then* it is working
12:48 <@dazo> rommel: go read the nc man page please
12:49 <@dazo> hahaha!  At the bottom of the nc man page .... 
12:49 <@dazo> CAVEATS
12:49 <@dazo>      UDP port scans will always succeed (i.e. report the port as open), ren‐
12:49 <@dazo>      dering the -uz combination of flags relatively useless.
12:50  * dazo decides to go for dinner and relax ... to avoid getting more grumpy
12:50 < rommel> nc man page? can you please direct me to the site. im not familiar of the site.
12:50 <@dazo> rommel: you gotta be kidding .... in your shell on your centos box, type:  man nc
12:50 < rommel> sorry. im really a newbie. I have being one.
12:51 <@dazo> otherwise ... if you google the same ... you can most likely hit the "I'm feeling lucky" button immediately 
12:55 < rommel> yes I have googled it now 
12:57 < rommel> how can I scan my server using this tool. my client is in windows platform
12:57 <@dazo> rommel: just an advice ... get familiar with man pages (via the man command).  On any Linux/Unix/POSIX platform, that is one of the most widely used resources.  It really can save your time looking for stuff ... and you really won't annoy other people with useless questions
12:58 < rommel> dazo: ok. thanks. sorry about my useless questions though. 
12:59 <@dazo> rommel: you need to find a netcat client for Windows ... it exists, I've used it some months ago, but don't recall where I found it .... however, you don't want to scan your server or client ... you want to look at the "CLIENT/SERVER MODEL" section in the man page
12:59 <@dazo> and then extend that example to use UDP instead of TCP which is the  default
13:01 < rommel> will check ok it now
13:03 -!- dazo is now known as dazo_afk
13:15 < Bushmills> http://docs.scarydevilmonastery.net/cgi-bin/dwww/usr/share/man/man1/nc.1.gz?type=man  <-  nc man page
13:15 <@vpnHelper> Title: nc.traditional(1) - Man pages (at docs.scarydevilmonastery.net)
13:16 < rommel> now I used the client-server model on my server i run nc -lu 1194 and on my client I run nc x.x.x.x 1194
13:17 < rommel> is this correct?
13:17 < rommel> but i got error " nc: forward host lookup failed: h_errno 11001: host_not_found
13:22 < rommel> am i doing it correctly guys?
13:25 -!- takamichi [Takamichi@46.11.14.68] has quit [Ping timeout: 276 seconds]
13:25 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
13:27 < krzee> well you're asking in #openvpn, so no
13:29 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
13:30 < rommel> where can I ask krzee can you tell me what channel is for netcat? can that be centos?
13:32 < krzee> most likely #networking
13:32 < krzee> or you could start reading manuals instead of asking people, but whichever works fine for me
13:34 < rommel> krzee I read the manual and tested the client-server model that dazo advised but there was error
13:35 -!- rommel is now known as rommel092079
13:38 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
13:42 < Bushmills> and what's your conclusion what cause the error?
13:43 -!- rajkosto [~rajkosto@2001:470:1f0b:728:89e2:cc3e:8727:cee7] has quit [Read error: Operation timed out]
13:44 < rommel092079> I really dont know bushmills. no idea at all
13:44 < Bushmills> consider the possibility of wrong invocation
13:44 < rommel092079> i kept repeating the command but same error.
13:44 < rommel092079> i tried other ports but the same
13:45 < Bushmills> try to *modify* your invocation syntax, instead of simply repeating, for the same error
13:54 < Katoen> :-)
13:55 < rommel092079> :)
13:55 < rommel092079> i tried nc -lu -p 1194 but not working
13:55 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
13:56 -!- takamichi [Takamichi@46.11.14.68] has joined #openvpn
13:56 < Bushmills> incentives for "working" are:  bribing, threatening, whipping
13:58 < rommel092079> error in usage
14:08 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
14:13 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
14:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
14:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:29 -!- dazo_afk is now known as dazo
14:35 <@vpnHelper> RSS Update - forum: problem w/routing over bridged vpn tunnel <http://forums.openvpn.net/topic7977.html>
14:39 < rommel092079> sir dazo, I work out on client-server model but they are on error
14:43 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
14:44 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 260 seconds]
14:45 < krzee> oh god
14:45 < rommel092079> :(
14:45 < krzee> honestly rommel, i dont think you have enough networking background to use openvpn
14:46 < rommel092079> yes i dont have much I admit krzee.
14:47 <@dazo> rommel092079:  figure that out on your own, it will take blood, sweat and tears for you ... but when you have figured it out, you will be much more knowledgeable and we can much more easily help you out ... you simply need to have some basic knowledge before starting with openvpn
14:47 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 246 seconds]
14:47 <@dazo> start learning to walk before trying to run, that's basically what we're saying
14:48 < Bushmills> what? refusing to spoonfeed? what a drag
14:48 <@dazo> Bushmills:  be my guest
14:48 < rommel092079> ok. I guess so. thanks
14:49 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
14:49 < Bushmills> dazo: "be my guest - bring your own cutlery"?
14:50 <@dazo> Bushmills:  something like that ;-)  .... if I had spent time spoonfeeding everyone here, I don't think we would have seen the first 2.2-beta release even ;-)
14:50 <@dazo> and a lot of others on this channel who also need help, and would manage a lot with some guidance would suffer
14:50 < krzee> and my spoon is worn out
14:51 < rommel092079> can i get you another spoon? :)
14:51 < krzee> lol
14:51 < Bushmills> you're wielding a mean chopstick, sir
14:51 < rommel092079> anyway thanks guys.
14:51 < rommel092079> no. really thanks guys.
14:52 < rommel092079> guess I really need to sweat blood here. :)
14:53 <@dazo> rommel092079:  that's the best way how to learn things well .... and yeah, it's gonna be tough, but I'm sure you're able to do it ... just take your time
14:53 <@dazo> rommel092079:  maybe !tcpip can be good resource for you as well, I don't know ... depending on where your real networking level is
14:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:03 -!- rommel092079 [~rommel@amertospromotions.com] has left #openvpn []
15:04  * Bushmills just notices that today is April 20
15:06 < krzee> =]
15:06 < krzee> happy holidays buddy!
15:07 < Bushmills> 13 minutes to go in the middle?
15:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:08 < Bushmills> 2 more hours for you?
15:08 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:09 < Bushmills> http://www.lyrics007.com/Guns%20N%27%20Roses%20Lyrics/Paradise%20City%20Lyrics.html
15:09 <@vpnHelper> Title: Guns N' Roses - Paradise City Lyrics (at www.lyrics007.com)
15:09 < Bushmills> :D
15:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:19 -!- buntfalke [~nobody@openvpn-p0-121.triple-a.uni-kl.de] has joined #openvpn
15:19 -!- buntfalke [~nobody@openvpn-p0-121.triple-a.uni-kl.de] has quit [Changing host]
15:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:27 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:28 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
15:28 < krzee> i prefer their song "welcome to the jungle"
15:29 < krzee> because it reminds me of when i toured the amazon in peru
15:29 < krzee> lol
15:32  * Bushmills listens to "mushroom festival in hell"
15:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:32 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:33 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
15:33 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
15:36 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
15:39 < Bushmills> http://scarydevilmonastery.net/mushroom_festival.mp3
15:39 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 240 seconds]
15:41 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 240 seconds]
15:42 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
15:43 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:43 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:45 -!- rajkosto [~rajkosto@cable-94-189-153-232.dynamic.sbb.rs] has joined #openvpn
15:49 -!- openvpnnoob [8a05f136@gateway/web/freenode/ip.138.5.241.54] has joined #openvpn
15:49 < openvpnnoob> hi
15:50 < openvpnnoob> I am able to ping the openvpn server on its "fake" ip, but I cannot ping anything on the internet - if I try by url, it says it cant find it in the DNS, and if I try to ping outside by IP, it just times out
15:51 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
15:52 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
15:54 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
15:54 < Bushmills> openvpnnoob: have you set up openvpn server to act as gateway to internet?
15:55 < openvpnnoob> I believe so yes.  It pushes the gateway and the dns to the client
15:55 < Bushmills> that has nothing to do with server acting as gateway
15:55 < openvpnnoob> ok, then I guess not
15:56 < Bushmills> that's your problem
15:56 < Bushmills> !redirect
15:56 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:58 < openvpnnoob> !def1
15:58 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
15:59 < openvpnnoob> I do have that in my server config: http://pastebin.com/GmbQPcn0 as well as using IPtables to do the ip forwarding
15:59 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11423>
15:59 < openvpnnoob> I guess i did it wrong
16:00 < Bushmills> you don't use iptables for enabling ip_forward
16:00 < Bushmills> iptables are, among other, for enabling NAT
16:00 < openvpnnoob> ok
16:00 < Bushmills> (needed as well)
16:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:01 < openvpnnoob> !ipforward
16:01 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:01 < openvpnnoob> !linipforward
16:01 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:01 < openvpnnoob> ive actually done that as well actually
16:02 < Bushmills> make sure then that firewalls don't block traffic 
16:03 < Bushmills> after that, try to ping an ip address from client
16:03 < Bushmills> 74.125.79.104  is pingable. that's a google address 
16:04 < openvpnnoob> I tried that, while the vpn connection is up, I can only ping the server on its fake ip, everything else times out
16:04 < openvpnnoob> it could be that the dns im using is stupid
16:05 < Bushmills> no dns involved when pinging ip address (unless rdns is done, which in case of ping merely delays it a bit)
16:05 <@vpnHelper> RSS Update - forum: need to use public ip in my local lan <http://forums.openvpn.net/topic7961.html#p11425> || problem w/routing over bridged vpn tunnel <http://forums.openvpn.net/topic7977.html#p11424>
16:05 < openvpnnoob> when pinging the ip address it just times out
16:05 < openvpnnoob> when pinging say, www.google.com it complains about not finding it
16:06 < krzee> did you setup NAT?
16:06 < Bushmills> fix one problem at a time.
16:06 < krzee> !linnat
16:06 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
16:07 < openvpnnoob> yeah, i did that, although I wont claim to understand what exactly it is doing
16:07 < openvpnnoob> I did #1 of those
16:08 < krzee> the forward chain in iptables is set to allow all?
16:08 < openvpnnoob> how do I check that?
16:08 < krzee> im not an iptables user
16:08 < krzee> its in the openvpn manual under FIREWALL
16:09 < openvpnnoob> im going to really annoyed if its the firewall, because I have 0 control over that
16:09 < krzee> then how did you add the NAT rule?
16:10 < openvpnnoob> On the machine running the openvpn server
16:10 -!- rommel092079 [~rommel@173.193.226.45] has joined #openvpn
16:10 < openvpnnoob> I guess that is not right
16:10 < Bushmills> well, then do it right
16:11 < openvpnnoob> I cant, I dont have access to the firewall
16:11 < rommel092079> @dazo and @all, I have managed to successfully connect my client to server but no internet, I guess its on the firewall, can you assist me what I miss in my firewall.
16:11 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
16:11 < Bushmills> your openvpn server is not the gateway to internet?
16:11 < Bushmills> !redirect
16:11 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
16:12 < Bushmills> rommel092079: ^^^
16:12 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
16:12 < openvpnnoob> no, its a linux box that I have connected on another network
16:12 < rommel092079> yes bushmills!!
16:12 < Bushmills> openvpnnoob:  does openvpn server have access to internet?
16:12 < openvpnnoob> yeah
16:12 < openvpnnoob> im sshed into it right now
16:12 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
16:13 < Bushmills> then setting up NAT on that machine, and enabling ip_forward will give other machines, connected to it, internet 
16:13 < openvpnnoob> ive done that, but I dont have internet accesss
16:13 < Bushmills> you were guessing that you didn't set it up right
16:14 < Bushmills> as the factoids explain how to set it up, set it up right then
16:14 -!- darkdrgn2k [~darkdrgn@199.243.221.174] has quit [Quit: Leaving]
16:14 < openvpnnoob> yeah, because krzee seemed surprised that Its not the machine running the firewall as well
16:14 < openvpnnoob> I put in exactly what the factoids say
16:15 < Bushmills> so you guessing that you didn't set it up right means you're guessing that the factoids aren't right?
16:16 < openvpnnoob> im guessing I didnt do something right because its not working, but i believe the factoids
16:16 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 240 seconds]
16:16 -!- Rajko [~rajkosto@94.189.153.232] has joined #openvpn
16:16 < openvpnnoob> I am fairly sure that I put the ipfowarding and NAT commands in correctly
16:16 -!- rajkosto [~rajkosto@cable-94-189-153-232.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
16:17 < Bushmills> then you can be fairly sure that openvpn server is configured as gateway 
16:17 < openvpnnoob> ok
16:17 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
16:17 < openvpnnoob> so then something else is wrong
16:17 -!- Rajko [~rajkosto@94.189.153.232] has quit [Read error: Connection reset by peer]
16:17 -!- bitrot [~rajkosto@2001:470:1f0b:728:89e2:cc3e:8727:cee7] has joined #openvpn
16:18 < Bushmills> (23:02:47) Bushmills: make sure then that firewalls don't block traffic  <- firewalls on openvpn server and openvpn client
16:18 < openvpnnoob> i dont believe they do, since I can ping the server from the client, and the server can freely access the internet, but is there some other way to check that?
16:19 < Bushmills> believing is a good start. that's next to praying.
16:20 < openvpnnoob> Is there some other way to check?
16:20 < Bushmills> make sure your forward chain on server has policy ACCEPT
16:20 < Bushmills> if that is on DROP or REJECT, neither client-server nor server-internet is affected
16:21 < Bushmills> but client-internet is
16:23 -!- bitrot [~rajkosto@2001:470:1f0b:728:89e2:cc3e:8727:cee7] has quit [Quit: Leaving]
16:24 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 263 seconds]
16:24 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
16:24 < openvpnnoob> yes, it has policy accept
16:25 < Bushmills> then check whether client uses openvpn server for routing of traffic to internet
16:25 < openvpnnoob> I know it does, because when the openvpn connection is up, I have no internet access, but when I disconnect from the openvpn server, I have perfectly normal access
16:27 < Bushmills> that's about all one would check, as this describes the common reasons why there's no internet on clients.
16:27 < Bushmills> use tcpdump to figure out where traffic is stopped
16:31 -!- openvpnnoob_ [8a05f136@gateway/web/freenode/ip.138.5.241.54] has joined #openvpn
16:32 -!- openvpnnoob [8a05f136@gateway/web/freenode/ip.138.5.241.54] has quit [Ping timeout: 252 seconds]
16:32 <@vpnHelper> RSS Update - forum: problem w/routing over bridged vpn tunnel <http://forums.openvpn.net/topic7977.html#p11426>
16:35 -!- [intra]lanman [~lanman@c-71-238-148-210.hsd1.mi.comcast.net] has joined #openvpn
16:35 -!- [intra]lanman [~lanman@c-71-238-148-210.hsd1.mi.comcast.net] has quit [Changing host]
16:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:36 -!- rommel092079 [~rommel@173.193.226.45] has quit []
16:37 -!- dazo [~dazo@openvpn/community/developer/dazo] has left #openvpn ["Leaving"]
16:37 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11427>
16:39 -!- openvpnnoob_ [8a05f136@gateway/web/freenode/ip.138.5.241.54] has quit [Ping timeout: 252 seconds]
16:42 < Bushmills> another satisfied customer runs away screaming
16:46 < krzee> lol
16:46 < krzee> i bet i know his problem
16:46 < krzee> i was away working
16:46 < krzee> he setup the NAT on a different machine, likely the gateway
16:46 < krzee> but then he didnt add the return route to the VPN to that gateway
16:46 < krzee> he could fix by EITHER:
16:47 < krzee> adding the route on the gateway, or NAT on the server itself
16:47 < Bushmills> he said he doesn't have access to gateway.
16:47 < krzee> then that makes the solution easier =]
16:47 < Bushmills> sounds he set it up on openvpn server
16:47 < krzee> [14:14]  <openvpnnoob> yeah, because krzee seemed surprised that Its not the machine running the firewall as well
16:47 < krzee> that makes me think he didnt
16:48 < krzee> cause i *thought* it WAS on the machine running the firewall as well
16:48 < krzee> but i guess we may never know now ;]
16:49 < Bushmills> well, it usually helps if one has some basic knowledge of the tools one uses for setting that stuff up
16:56 <@vpnHelper> RSS Update - forum: problem w/routing over bridged vpn tunnel <http://forums.openvpn.net/topic7977.html#p11428>
17:05 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
17:18 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
17:23 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
17:23 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
17:25 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Remote host closed the connection]
17:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:27 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
17:28 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
17:54 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
18:50 <@vpnHelper> RSS Update - forum: Can I add a new config on a different port to coexist 1194 <http://forums.openvpn.net/topic7978.html>
19:28 -!- luneff [~yury@84.51.192.6] has joined #openvpn
19:50 <@vpnHelper> RSS Update - forum: What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11430>
19:52 -!- K1ng\ [~KING@180.211.188.118] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
19:52 -!- K1ng [~KING@180.211.188.118] has joined #openvpn
20:03 < pwrcycle> anyone know if there's an openvpn client for Nokia phone? N8 specificly.
20:07 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
20:07 -!- master_of_master [~master_of@p57B55220.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:07 -!- luneff [~yury@84.51.192.6] has joined #openvpn
20:08 < K1ng> nokia sucks
20:09 -!- master_of_master [~master_of@p57B55C90.dip.t-dialin.net] has joined #openvpn
20:32 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
20:35 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
20:43 -!- colision [logos@187.78.235.88] has quit [Ping timeout: 264 seconds]
21:44 <@vpnHelper> RSS Update - forum: revoke user with "ERROR:name does not match" <http://forums.openvpn.net/topic7979.html>
21:49 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Read error: Operation timed out]
21:49 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:05 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:13 -!- darth_bitterman [~yury@84.51.192.6] has joined #openvpn
22:16 -!- bitterman [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
22:20 -!- darth_bitterman [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
22:20 -!- darth_bitterman [~yury@84.51.192.6] has joined #openvpn
22:49 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
22:49 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
23:03 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
23:04 < rommel092079> bushmills sir, are you there?
23:04 < rommel092079> krzee, are you there?
23:09 -!- rommel092079 [~rommel@amertospromotions.com] has quit []
23:23 -!- darth_bitterman [~yury@84.51.192.6] has quit [Quit: Leaving]
23:54 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
--- Day changed Thu Apr 21 2011
00:25 -!- GuilhermeCunha [~cunha@unaffiliated/guilhermecunha] has joined #openvpn
00:45 -!- luneff [~yury@84.51.192.6] has joined #openvpn
01:12 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:23 < JohnTeddy> I am trying to have my android phone traffic through openvpn, I setup openvpn with the config. The daemon starts, I can see it in ps aux|grep openvpn, but I can't connect to port 1985 I believe.. my config is here: http://codepad.org/RJBELa8T
01:23 <@vpnHelper> Title: Plain Text code - 294 lines - codepad (at codepad.org)
01:23 < JohnTeddy> What is wrong with that config?
01:30 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 246 seconds]
01:31 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
01:38 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 264 seconds]
01:38 -!- Sk00rche- [~Sk00rchen@83.251.230.74] has joined #openvpn
01:43 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:54 -!- whitelines1986 [whitelines@114.94.16.211] has joined #openvpn
01:54 < whitelines1986> hey
01:54 < whitelines1986> how much ram does openvpn need to run adequately
01:54 < whitelines1986> i will use a vps, just wondering if 256mb ram is enough
02:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
02:22 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
02:22 -!- gorkhaan_ [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
02:23 -!- gorkhaan_ [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Client Quit]
02:24 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:24 -!- mode/#openvpn [+o mattock] by ChanServ
02:25 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
02:28 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
02:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
02:33 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11432>
02:47 -!- IOhannes [~zmoelnig@umlaeute.mur.at] has joined #openvpn
02:47 < IOhannes> !welcome
02:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:49 < IOhannes> is there a simple howto dynamically add my clients (that are assigned persistent IP addresses) to a DNS server?
02:49 < JohnTeddy> What is a simple openvpn client for Ubuntu I can use to test to make sure I have the server setup right?
02:49 < IOhannes> JohnTeddy: "openvpn"?
02:50 < JohnTeddy> o ok, heh
02:50 < JohnTeddy> I thought it was server only
02:50 < IOhannes> nah, there is the "mode server" (or client) line in the config
02:51 < IOhannes> back to my problem: i see that this is probably no big deal if clients are authenticating via certificates (as i suppose the admin has to setup a cert for each client and can handle the DNS entries in parallel)
02:52 < IOhannes> however, i'm using ldap-based user/passwd authentication;
02:52 < IOhannes> basically i'd like to have an ipp.txt -> bind/db.openvpn converter
02:53 < IOhannes> i could do one myself, but if there already was one...
02:54 -!- APTX [APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
02:54 -!- APTX_ [APTX@phpBB/developer/APTX] has joined #openvpn
03:01 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 252 seconds]
03:09 <@vpnHelper> RSS Update - forum: What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11434> || Can I add a new config on a different port to coexist 1194 <http://forums.openvpn.net/topic7978.html#p11433>
03:15 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
03:21 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
03:24 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
03:33 <@vpnHelper> RSS Update - forum: revoke user with "ERROR:name does not match" <http://forums.openvpn.net/topic7979.html#p11435>
03:43 < JohnTeddy> IOhannes: So the server is running, I have network manager openvpn installed... when I click on the vpn, it doesn't do anything.
03:44 < JohnTeddy> hmm, now it says 'THE VPn connection failed because there are no valid vpn secrets.
03:49 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
03:51 < Bushmills> IOhannes:
03:51 < Bushmills> !nsupdate
03:51 <@vpnHelper> "nsupdate" is http://scarydevilmonastery.net/client_connect_nsupdate for a script Bushmills wrote to solve the question How can my vpn update my nameserver?
03:54 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
03:54 < IOhannes> Bushmills: thanks, sounds promising
03:55 < IOhannes> JohnTeddy: so it does work with the cmdline client?
03:57 < JohnTeddy> IOhannes: o, that's probably a better idea to use the command line client.
03:59 < IOhannes> JohnTeddy: at least until you are sure that the server is working as expected
04:00 < JohnTeddy> IOhannes: Where is a simple client config file? or do I need that?
04:01 < Bushmills> JohnTeddy: how do your clients authenticate?  static key? have you set up a CA? or user/password?
04:01 < JohnTeddy> http://wiki.cyanogenmod.com/index.php?title=OpenVPN
04:01 <@vpnHelper> Title: OpenVPN - CyanogenMod Wiki (at wiki.cyanogenmod.com)
04:01 < JohnTeddy> I followed this guide, I have openvpn process running on the server side, I can telnet to the server, on the port.. and it shos in /var/log/openvpn.log;
04:02 < JohnTeddy> I have client.p12 I think is what I need... on the client side.
04:02 < Bushmills> JohnTeddy: how do your clients authenticate?  static key? have you set up a CA? or user/password?
04:02 < JohnTeddy> A CA
04:02 < JohnTeddy> no user/pass
04:03 < Bushmills> what authentication-relevant files did you copy to client? 
04:03 < JohnTeddy> client.p12
04:03 < JohnTeddy> I got ca.crt too, I'm not sure if I need that one.
04:04 < Bushmills> that .p12 is presumably a pkcs12 file
04:05 < JohnTeddy> openssl pkcs12 -export -in client.crt -inkey client.key -certfile ca.crt -out client.p12
04:05 < JohnTeddy> I did that, to get it.
04:05 < JohnTeddy> after doing, clean-all, then build-ca, build-key-server server; build-key client; build-dh;
04:06 < JohnTeddy> I'm using the same config server side from here: http://wiki.cyanogenmod.com/index.php?title=OpenVPN#Server
04:06 <@vpnHelper> Title: OpenVPN - CyanogenMod Wiki (at wiki.cyanogenmod.com)
04:06 < JohnTeddy> Bushmills: Is this client.p12 the only file I need client side?
04:07 < Bushmills> i don't pack my certs and keys into pkcs containers, therefore i can't tell you for sure
04:08 < JohnTeddy> I am not sure how to use the openvpn client. When I do the network manager openvpn plugin, the server side gets nothing in the log. Though it gets something in the log if I telnet to it.
04:08 < JohnTeddy> So I think the server side might not be a problem, the client side is more of a problem now.
04:08 < Bushmills> i presume that it doesn't contain the ca.crt, just the client.key and client.crt
04:08 < JohnTeddy> It isn't even attempting to connect.
04:09 < Bushmills> that means you may need the ca.crt in addition to the .p12 file
04:09 < JohnTeddy> ok, I have the ca.crt
04:09 < JohnTeddy> Though according to the command, it also packed teh ca.crt I believe.
04:10 < Bushmills> possible. as said, i'm on rather thin ice with p12 files
04:11 < Bushmills> don't use network manager. at least not  while debugging the connection
04:11 < Bushmills> openvpn /path/to/configfile  would be preferable
04:12 < JohnTeddy> Is there a simple exampe config somewhere?
04:12 < Bushmills> or   openvpn --config /path/to/configfile -more-options
04:12 < Bushmills> --more-options ...
04:12 < Bushmills> yes.
04:12 < JohnTeddy> All the articles I find are 20 pages with explanations of each option.
04:12 < Bushmills> look in    /usr/share/doc/openvpn/examples/
04:14 < Bushmills> alternatively,  http://docs.scarydevilmonastery.net/cgi-bin/dwww/usr/share/doc/openvpn/examples/sample-config-files/?type=dir
04:14 <@vpnHelper> Title: Files in /usr/share/doc/openvpn/examples/sample-config-files (at docs.scarydevilmonastery.net)
04:17 <@vpnHelper> RSS Update - forum: Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11436>
04:20 < JohnTeddy> Bushmills: http://codepad.org/dq8mRE8X
04:20 <@vpnHelper> Title: Plain Text code - 16 lines - codepad (at codepad.org)
04:21 < Bushmills> seems that client tries to reach server, but fails to contact it.
04:21 < JohnTeddy> remote 72.215.x.x 1985
04:22 < JohnTeddy> This is the only line I changed in the example client.conf
04:22 < JohnTeddy> I can do 'telnet 72.215.x.x 1985' and a bunch of stuff shows up on the server side /var/log/openvpn.log
04:22 < Bushmills> client and server use same protocol?
04:22 < JohnTeddy> o I should note, I'm in Shanghai
04:23 < JohnTeddy> Bushmills: There is nothing in the server log when the client tries to connect. So even if it was the wrong protocol, that should show.
04:23 < Bushmills> if you changed nothing else in sample client config, it probably uses udp.  if you can telnet to server, it used tcp
04:24 < JohnTeddy> o yea, good find
04:26 < JohnTeddy> Bushmills: http://codepad.org/mvmudStZ
04:26 <@vpnHelper> Title: Plain Text code - 35 lines - codepad (at codepad.org)
04:26 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:27 < Bushmills> lines 32 and 33
04:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:28 < Bushmills> john@cs:~/Desktop/keys$  ... try to run as root
04:28 < JohnTeddy> o, the process doesn't have access.
04:28 < JohnTeddy> I see.
04:29 < JohnTeddy> user mm
04:29 < JohnTeddy> group mm
04:29 < JohnTeddy> change that to root?
04:29 < JohnTeddy> Is that unsafe?
04:29 < Bushmills> su before running openvpn
04:30 < Bushmills> letting it downgrading to different user after start is ok 
04:31 < JohnTeddy> root     21768  0.0  0.2   4472  2176 ?        Ss   05:29   0:00 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --daemon ovpn-server --cd /etc/openvpn --config /etc/openvpn/server.conf
04:31 < Bushmills> the client ...
04:32 < JohnTeddy> http://codepad.org/REvIEg7x
04:32 <@vpnHelper> Title: Plain Text code - 4 lines - codepad (at codepad.org)
04:32 < JohnTeddy> o, the client
04:32 < JohnTeddy> I see.
04:32 < Bushmills> john@cs:~/Desktop/keys$ openvpn --config client.conf
04:34 < JohnTeddy> Bushmills: http://codepad.org/UZyZixqX
04:34 <@vpnHelper> Title: Plain Text code - 37 lines - codepad (at codepad.org)
04:34 < JohnTeddy> Does that mean it works?
04:34 < Bushmills> seems ok
04:34 < Bushmills> !tcp
04:34 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
04:36 < Bushmills> from client, you should be able now to ping 10.11.12.1
04:37 < JohnTeddy> holy shit
04:37 < Bushmills> vice versa, server can ping 10.11.12.6
04:37 < JohnTeddy> my android phone is connected
04:37 < JohnTeddy> Let's see if facebook works
04:38 < JohnTeddy> Bushmills: So when I type that openvpn client command, everything goes through the vpn?
04:38 < JohnTeddy> So chrome/pidgin will all go through it by default?
04:38 < Bushmills> not unless you set up server as gateway, and have client set a default route through it
04:38 < JohnTeddy> hmm, android doesn't work yet.
04:39 < Bushmills> !redirect
04:39 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
04:39 < JohnTeddy> I see.
04:40 < JohnTeddy> o in VPN settings on android, under advanced... 'redirect gateway: force all traffic to berouted thru the VPN tunnel'
04:40 < Bushmills> alternative is to install proxies for all services through server on server
04:40 < Bushmills> read the !redirect factoids.  server can push new default gateway
04:41 < Bushmills> but server can also push two routes, effectively replacing default route, without touching it
04:41 < Bushmills> !def1
04:41 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
04:41 < JohnTeddy> Thu Apr 21 05:40:53 2011 client/116.233.x.xy:27317 Bad LZO decompression header byte: 4
04:42 < Bushmills> when redirecting all, you may give resolving name server which client uses some attention
04:42 < JohnTeddy> hmm, I think the android openvpn client doesn't work with lzo?
04:43 < JohnTeddy> ok, I checked the box on android/clietn side that said 'force lzo to be turned on', maybe that will fix all these bad lzo errors
04:44 < JohnTeddy> Thu Apr 21 05:43:50 2011 client/116.233.8.88:28857 MULTI: bad source address from client [192.168.2.107], packet dropped
04:47 < JohnTeddy> Bushmills: Am I supposed to set the source address on the android/client side?
04:48 < Bushmills> no, not needed.  maybe iroute can help with those MULTI packets
04:50 < JohnTeddy> iroute 192.168.2.0 255.255.255.0
04:50 < JohnTeddy> Add that to the client side?
04:50 < JohnTeddy> or server side?
04:52 < Bushmills> server side, specific for client
04:53 < JohnTeddy> $ cat /var/log/openvpn.log
04:53 < JohnTeddy> Options error: option 'iroute' cannot be used in this context
04:57 < JohnTeddy> Bushmills: How do I specify for this client?
04:57 < Bushmills> man page has probably a bit on it. i suppose man page mentions ...
04:57 < Bushmills> !ccd
04:57 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
05:00 < JohnTeddy> Bushmills: So on the server side, I do 'client-config-dir android',  then mkdir /etc/openvpn/android; echo "iroute 192.168.2.0 255.255.255.0" > android/server.conf; Then on the client side, I some how label the client as 'android'. Does that make sense?
05:00 < Bushmills> yes, that's it.  the name of the file in ccd directory is identical to the client common name
05:01 < JohnTeddy> How do I set the client common name?
05:01 < Bushmills> that's specified when you created client key
05:02 < JohnTeddy> hmm
05:03 < JohnTeddy> I just hit enter and typed anything
05:03 < JohnTeddy> heh
05:03 < JohnTeddy> What is the default? 'client'?
05:03 < JohnTeddy> http://wiki.cyanogenmod.com/index.php?title=OpenVPN#Server
05:03 < Bushmills> there is no default.  you can grep client cert for CN
05:03 <@vpnHelper> Title: OpenVPN - CyanogenMod Wiki (at wiki.cyanogenmod.com)
05:04 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
05:05 < Bushmills> or grep server log file for CN
05:05 < JohnTeddy> Bushmills: Issuer: C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, CN=Fort-Funston CA/emailAddress=me@myhost.mydomain
05:05 < JohnTeddy> Fort-Funston is my client ID?
05:05 < JohnTeddy> Subject: C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, CN=client/emailAddress=me@myhost.mydomain
05:05 < Bushmills> commn name. yes
05:05 < JohnTeddy> I also have that
05:05 < JohnTeddy> I see.
05:05 < JohnTeddy> ok
05:06 < Bushmills> ehm, no.  not Issuer
05:07 < Bushmills> you'd look at a line with Subject:  instead of Issuer:
05:07 < JohnTeddy> so 'me' is the client name?
05:08 < Bushmills> no. that's recipient
05:08 < JohnTeddy> So it is Fort-Funston
05:09 < Bushmills> (12:07:35) Bushmills: you'd look at a line with Subject:  instead of Issuer:
05:09 < Bushmills> (12:05:19) JohnTeddy: Bushmills: Issuer: C=US, ST=CA, L=SanFrancisco, ...
05:09 < JohnTeddy> CN=client/emailAddress=me@myhost.mydomain
05:09 < JohnTeddy> That?
05:10 < Bushmills> looks like it
05:11 < JohnTeddy> So 'client' is the client name?
05:11 < JohnTeddy> Or that entire string?
05:11 < Bushmills> just "client"
05:12 <@vpnHelper> RSS Update - forum: What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11437>
05:12 < JohnTeddy> $ grep 'client' server.conf; cat client/server.conf;
05:12 < JohnTeddy> client-config-dir client
05:12 < JohnTeddy> iroute 192.168.2.0 255.255.255.0
05:12 < JohnTeddy> restarting server side, and client side.
05:13 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
05:15 < JohnTeddy> Bushmills: My android phone says 'VPN connected', but when I make a web request or anything.. it hangs, and nothing shows on /var/log/openvpn.log after the initial connection/initiation.
05:16 < Bushmills> try to ping an internet ip address by address, not by name
05:16 < Bushmills> for exampe, 74.125.79.104  for google
05:17 < JohnTeddy> ok
05:17 < JohnTeddy> I will ping 8.8.8.8
05:17 < JohnTeddy> in the terminal app.apk
05:17 < JohnTeddy> It just hangs, the ping command.
05:18 < Bushmills> has your openvpn server been configured as gateway?
05:18 < JohnTeddy> Thu Apr 21 06:16:54 2011 client/116.233.8.88:49033 MULTI: bad source address from client [192.168.2.107], packet dropped
05:18 < JohnTeddy> The server side has that.
05:18 < JohnTeddy> lots of that
05:18 < Bushmills> ip forwarding enabled?
05:18 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
05:18 < Bushmills> NAT set up?
05:19 < JohnTeddy> Bushmills: http://codepad.org/BffyyoYS
05:19 <@vpnHelper> Title: Plain Text code - 23 lines - codepad (at codepad.org)
05:19 < JohnTeddy> That is my server side config.
05:19 < Bushmills> ip forwarding or NAT isn't done in the openvpn config
05:20 < JohnTeddy> I need to NAT on the client side network, or server side network?
05:20 < Bushmills> (11:40:55) Bushmills: read the !redirect factoids.  server can push new default gateway
05:20 < JohnTeddy> !redirect
05:20 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
05:21 < JohnTeddy> !def1
05:21 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
05:21 < JohnTeddy> !ipforward
05:21 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
05:21 < JohnTeddy> heh, I know this is easy for you.. since you probably work with it all day. but damn, this is complicated for me.
05:21 < JohnTeddy> heh
05:22 < JohnTeddy> push "redirect-gateway def1"
05:22 < JohnTeddy> I add that to /etc/openvpn/client/server.conf?
05:23 < Bushmills> that's one thing. yes.  not strictly required but handy
05:23 < JohnTeddy> I need that line in client/server.conf and an ip forward line also?
05:23 < Bushmills> means, client config can set new routes too, rather than server pushing them
05:24 < JohnTeddy> wait, ipforwarding is done with iptables?
05:24 < Bushmills> no
05:24 < Bushmills> *read the damn factoids*
05:24 < JohnTeddy> I did, then I google for more information... and I see iptables stuff.
05:24 < Bushmills> you're asking me things they tell
05:25 < JohnTeddy> http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
05:25 < Bushmills> i feel degraded to a query bot
05:25 <@vpnHelper> Title: HOWTO (at openvpn.net)
05:25 < JohnTeddy> !linipforward
05:25 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
05:25  * Bushmills applauds
05:25 < JohnTeddy> So it is iptables
05:26 < JohnTeddy> Isn't that changing an iptables setting in the kernel or what not?
05:26 < Bushmills> NAT is. ip forwarding isn't.
05:26  * Bushmills stares at the lines showing how to enable ip forwarding 
05:28 < JohnTeddy> Even though I'm reading these factoids, it doesn't mean I'm comprehending their meaning well.
05:28 < JohnTeddy> heh
05:28 < JohnTeddy> ok, I modified the proc/sys kernel file thing... I'll restart both sides and try to ping 8.8.8.8 again.
05:29 < JohnTeddy> holy shit
05:29 < JohnTeddy> 8.8.8.8 works
05:29 < cpm> 8.8.8.8? you are at google? 8.8.8.8 is fully routable, why are you using it?
05:30 < cpm> yeah of course, I can ping 8.8.8.8
05:30 < JohnTeddy> I just picked a random ip
05:30 < cpm> google-public-dns-a.google.com
05:30 < JohnTeddy> dns doesn't seem to work though
05:30 < Bushmills> ping that is a gateway test
05:31 < Bushmills> (11:42:09) Bushmills: when redirecting all, you may give resolving name server which client uses some attention
05:31 < Bushmills> you client is probably using a name server which can't be contacted from outside the provider's own network
05:31 < Bushmills> but your traffic is redirected through openvpn server. including dns queries
05:31 < JohnTeddy> I see.
05:32 < Bushmills> tell client to use a name server - such as 8.8.8.8
05:32 < Bushmills> alternatives: run a recursive name server on server, tell client to use it.  or, run a recursive name server on client. tell client to use itself as resolver
05:33 < JohnTeddy> ok, I changed the 'dns search' feature in android to 8.8.8.8
05:33 < JohnTeddy> I'll reconnect and try again.
05:33 < Bushmills> or bypass dns requests so that they're not going through vpn.  as you're in china, you probably don't want this.
05:35 < whitelines1986> does openvpn work ok on virtuozzo vps
05:37 < Bushmills> whitelines1986: i suppose virtuzzo support channel is better able to tell you.
05:40 <@vpnHelper> RSS Update - forum: What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11439> || Can I add a new config on a different port to coexist 1194 <http://forums.openvpn.net/topic7978.html#p11438>
05:45 < JohnTeddy> Bushmills: hmm, I can't get android to ping 8.8.8.8 anymore, or a url.
05:45 < JohnTeddy> I'm starting to question if it ever did ping 8.8.8.8
05:47 < hyper_ch> 8.8.8.8 sounds like a fun IP
05:47 < JohnTeddy> hmm, damn, I think openvpn clears the log on a restart
05:47 < JohnTeddy> I can't find the older logs
05:52 < Katoen> whitelines1986: yes, it works in openvz (virtuozzo)
05:54 < JohnTeddy> Bushmills: http://pastebin.ca/2048945
05:54 < JohnTeddy> When I ping 8.8.8.8 from the phone, when it's connected over VPN, nothing happens in the log, or in the client terminal./
05:56 < JohnTeddy> Thu Apr 21 06:51:42 2011 client/116.233.8.88:60881 SENT CONTROL [client]: 'PUSH_REPLY,route 10.11.12.1,topology net30,ping 10,ping-restart 120,ifconfig 10.11.12.6 10.11.12.5' (status=1)
05:57 < JohnTeddy> perhaps I typed the ping command when VPN wasn't on.
06:12 < IOhannes> hyper_ch: google will probably log all pings to 8.8.8.8 and 8.8.4.4 to gather info :-)
06:12 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Ping timeout: 246 seconds]
06:12 < JohnTeddy> IOhannes: Google lots the pings?
06:17 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
06:18 < IOhannes> siretart: JohnTeddy: i guess it was a joke on my side
06:25 -!- python [~~udav@93.180.196.43] has joined #openvpn
06:26 -!- APTX_ [APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
06:26 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
06:28 <@vpnHelper> RSS Update - forum: Can I add a new config on a different port to coexist 1194 <http://forums.openvpn.net/topic7978.html#p11440>
06:30 < Bushmills> nothing is supposed to happen in the log
06:31 < Bushmills> (unless verbosity set higher, and additional RW show)
06:31 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
06:32 -!- luneff [~yury@84.51.192.6] has joined #openvpn
06:33 -!- GuilhermeCunha [~cunha@unaffiliated/guilhermecunha] has quit [Quit: This computer has gone to sleep]
06:36 < JohnTeddy> WWWRWWRThu Apr 21 07:35:38 2011 us=943783 client/116.233.8.88:40537 MULTI: bad source address from client [192.168.2.107], packet dropped
06:36 < JohnTeddy> WRRThu Apr 21 07:35:41 2011 us=222064 client/116.233.8.88:40537 MULTI: bad source address from client [192.168.2.107], packet dropped
06:37 < JohnTeddy> $ grep 'client' server.conf; cat client/server.conf 
06:37 < JohnTeddy> client-config-dir client
06:37 < JohnTeddy> iroute 192.168.2.0 255.255.255.0
06:37 < JohnTeddy> push "redirect-gateway def1"
06:38 < JohnTeddy> Bushmills: I am still getting these Multi packet dropped errors.. I thought this client-config-dir and iroute would fix that?
06:38 < Bushmills> there was a chance that it would, but evidently it doesn't
06:48 < JohnTeddy> Bushmills: When I'm connected over VPN on the android phone.. I can ping 192.168.2.1
06:51 -!- APTX [APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
06:51 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11441>
06:51 -!- APTX_ [APTX@phpBB/developer/APTX] has joined #openvpn
06:52 < Bushmills> on server, you should be able to  /proc/net/ip_conntrack   to see the NATted connections
06:52 < Bushmills> ... to cat /proc/net/ip_conntrack
06:54 < Bushmills> or, if you have netstat-nat  installed, its output is easier to read
06:55 -!- APTX_ [APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
06:55 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
06:55 < JohnTeddy> When I try to ping 8.8.8.8 I get this: http://codepad.org/bSb671kB a lot of these TUN write commands.
06:55 <@vpnHelper> Title: Plain Text code - 29 lines - codepad (at codepad.org)
06:56 < JohnTeddy> Is there a way to verify tun module works?
06:56 < Bushmills> if you can ping server, tun works
06:56 < JohnTeddy> I see. ok
06:57 < JohnTeddy> mm@S250-A326:/proc/net$ ls
06:57 < JohnTeddy> arp  dev_mcast  ip_tables_matches  ip_tables_targets  netfilter  netstat  protocols  raw    rt_cache  sockstat      stat  udp      unix
06:57 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11442>
06:57 < JohnTeddy> dev  igmp       ip_tables_names    mcfilter           netlink    packet   ptype      route  snmp      softnet_stat  tcp   udplite  wireless
06:57 < JohnTeddy> Bushmills: There is no 'ip_conntrack' in that directory.
06:57 < Bushmills> well, go for netstat-nat then
07:01 < JohnTeddy> Could not read info about connections from the kernel, make sure netfilter is enabled in kernel or by modules.
07:02 < Bushmills> you are doing that on server, right?
07:07 < JohnTeddy> Bushmills: yes, that is server side.
07:07 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11443>
07:08 -!- python [~~udav@93.180.196.43] has quit [Quit: âèðíóñü êàäà óëóòüøûòüñÿ íîñòðîåíèå]
07:09 < Bushmills> "make sure netfilter is enabled .." i wonder how you could possible have set up NAT on server without netfilter enabled
07:10 < Bushmills> does   iptables -t nat -nvL    show anything?
07:11 -!- APTX [APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
07:12 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
07:14 < JohnTeddy> Bushmills: no, that outputs nothing
07:15 < JohnTeddy> Bushmills: http://codepad.org/sMmmMhB9
07:15 <@vpnHelper> Title: Plain Text code - 10 lines - codepad (at codepad.org)
07:16 < Bushmills> yout server hasn't been set up for NAT
07:17 < JohnTeddy> I didn't know I had to set it up for NAT
07:17 < JohnTeddy> It needs to be setup for NAT for openvpn?
07:18 < Bushmills> afaik, the factoids said, i told you too.
07:19 < JohnTeddy> Which one?
07:19 < JohnTeddy> !nat
07:19 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
07:20 < Bushmills> !redirect
07:20 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
07:26 < JohnTeddy> !linnat
07:26 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
07:30 < JohnTeddy> Bushmills: http://codepad.org/eNEPwpHD that?
07:30 <@vpnHelper> Title: Plain Text code - 24 lines - codepad (at codepad.org)
07:31  * Bushmills wonders why there are factoids if what they suggest is ignore anyway
07:32 < JohnTeddy> I'm not ignoring them, I don't understand them.
07:33 < JohnTeddy> I'm trying to get it to work, the networking knowledge is over my head, and I have little experience with it.
07:34 < Bushmills> !linnat
07:34 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
07:34 < JohnTeddy> So I only need that one command?
07:34 < Bushmills> there's a command
07:35 < Bushmills> you may have to customize source address, according the network addresses you're using in your personal setup
07:36 < Bushmills> there's also a link to further documentation, to increase understanding
07:40 < JohnTeddy> wow, it works now
07:40 < JohnTeddy> I am evading the Chinese firewall
07:40 < Bushmills> obviously
07:41 < JohnTeddy> thanks a lot Bushmills, I appreciate the help.
07:41 < JohnTeddy> You've been very patient and generous with you time, thanks a lot.
07:41 < Bushmills> i was at the point of running out of patience
07:45 -!- echoSMIL1 [~censured@bl17-84-31.dsl.telepac.pt] has quit [Ping timeout: 240 seconds]
07:48 -!- echoSMILE [~censured@bl17-107-199.dsl.telepac.pt] has joined #openvpn
07:48 -!- echoSMILE [~censured@bl17-107-199.dsl.telepac.pt] has quit [Changing host]
07:48 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
07:51 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:51 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:51 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
07:54 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:54 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:59 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
08:12 -!- d12fk [~heiko@port-92-198-130-130.static.qsc.de] has quit [Read error: Operation timed out]
08:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
08:27 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
08:27 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
08:27 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
08:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:39 -!- rommel092079 [~rommel@amertospromotions.com] has quit []
08:42 -!- hid3 [~arnoldas@lan-78-157-71-116.vln.skynet.lt] has joined #openvpn
08:43 < hid3> Hello everyone. I'm running Debian and I need OpenVPN client. Any ideas if that package is in the repository?
08:43 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
08:43 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:48 < hyper_ch> hid3: it is
08:48 < hyper_ch> hid3: at least since lenny
08:48 < hyper_ch> how do I know this? becuase that's what I run
08:48 < hid3> but the description says it's daemon
08:48 < hyper_ch> it's both
08:48 < hid3> oh, that's how it is
08:48 < hid3> thanks!
08:48 < hid3> I thought the daemon was for server only
08:49 < hyper_ch> you require root to run the client
08:49 < hyper_ch> so it can create the tun interface
08:49 < hid3> no problem!
08:49 < hyper_ch> and very likely you want to auto-start the client
08:49 < hyper_ch> it's just client.conf instead of server.conf
08:49 < hyper_ch> IIRC
09:10 -!- Blues-Man [~bluesman@95.239.123.27] has joined #openvpn
09:13 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
09:30 -!- rommel092079 [~rommel@amertospromotions.com] has quit []
09:32 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11444>
09:44 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11445>
09:59 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has joined #openvpn
10:01 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:02 -!- takamichi [Takamichi@46.11.14.68] has quit [Ping timeout: 246 seconds]
10:02 -!- takamichi [Takamichi@46.11.14.68] has joined #openvpn
10:13 -!- whitelines1986 [whitelines@114.94.16.211] has quit [Ping timeout: 248 seconds]
10:17 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:22 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
10:30 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
10:35 -!- colision [logos@187.78.235.88] has joined #openvpn
10:39 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 276 seconds]
10:43 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
10:43 -!- rommel092079 [~rommel@amertospromotions.com] has quit []
10:44 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
10:45 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
10:45 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:48 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has quit [Quit: Ex-Chat]
10:58 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:07 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
11:13 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:41 -!- bauruine [~stefan@tuxli.ch] has joined #openvpn
11:48 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
11:59 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 240 seconds]
12:02 -!- jeev is now known as twitter
12:03 -!- twitter is now known as jeev
12:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:32 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 250 seconds]
12:34 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
12:34 -!- mode/#openvpn [+o dazo] by ChanServ
12:37 -!- K1ng [~KING@180.211.188.118] has quit [Ping timeout: 252 seconds]
12:38 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
12:43 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
12:43 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
12:43  * Blues-Man good blues bye
12:43 -!- Blues-Man [~bluesman@95.239.123.27] has quit [Remote host closed the connection]
12:44 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
12:44 -!- mode/#openvpn [+o mattock] by ChanServ
12:46 < hyper_ch> hi mattock
12:46 <@mattock> hi hyper_ch!
12:47 < hyper_ch> do you have furballs?
12:47 < hyper_ch> the carnivoral meowing kind
12:51 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:53 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
12:55 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
12:55 -!- mode/#openvpn [+o mattock] by ChanServ
12:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:01 -!- KaiForce [~chatzilla@70.228.79.239] has joined #openvpn
13:12 <@vpnHelper> RSS Update - forum: constant traffic to external IP <http://forums.openvpn.net/topic7980.html>
14:13 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
14:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:23 -!- KaiForce [~chatzilla@70.228.79.239] has quit [Remote host closed the connection]
14:24 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Ping timeout: 246 seconds]
14:27 < hyper_ch> WTF:  http://www.theregister.co.uk/2011/04/21/texas_jury_says_google_infringed_linux_patent/  -  Google Linux servers hit with $5m patent infringement verdict
14:27 <@vpnHelper> Title: Google Linux servers hit with $5m patent infringement verdict • The Register (at www.theregister.co.uk)
14:28 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
14:29 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
14:31 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 246 seconds]
14:32 -!- Peer^ [~ttt@ks355877.kimsufi.com] has joined #openvpn
14:34 -!- bitterman [~yury@84.51.192.6] has quit [Quit: Leaving]
14:36 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
14:37 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:39 <@vpnHelper> RSS Update - forum: Configuring OpenVPN (Bridged) on Windows XP with Public IPs <http://forums.openvpn.net/topic7970.html#p11447>
14:46 -!- lampliter [~chatzilla@c-76-19-126-1.hsd1.ma.comcast.net] has joined #openvpn
14:49 < lampliter> window seven running open VPN 2.2-RC2. Trying to run multiple VPN connections from the same client two different hosts. open VPN is complaining about not having enough tun devices. Is there a way to make it create them automatically or do I need to create them manually?
14:50 < colision> lampliter: click on "Add a new TAP virtual ethernet adapter"
14:50 < lampliter> that's somewhere in the Windows networking environment?
14:51 < colision> star menu, openvn, utilities
14:51 < lampliter> got it. So just create as many as I need and I'm good
14:51 < colision> ye
14:52 < lampliter> I did look through the documentation for this but didn't see it. Is it somewhere I missed? If not, should I contribute a paragraph or so
14:52 < colision> no idea
14:52 < lampliter> okay. Maybe I'll ask on the development channel or the forum
14:53 < lampliter> I think I did something wrong because it still says they're all busy let me try this again
14:54 -!- hid3 [~arnoldas@lan-78-157-71-116.vln.skynet.lt] has left #openvpn []
14:55 < lampliter> C:\Program Files (x86)\OpenVPN>"C:\Program Files (x86)\OpenVPN\bin\tapinstall.ex e" install "C:\Program Files (x86)\OpenVPN\driver\OemWin2k.inf" tap0901;; tapinstall.exe failed.
14:55 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
14:55 -!- mode/#openvpn [+o mattock] by ChanServ
14:55 < colision> run as Administrator
14:55 < lampliter> ever see that?
14:55 < lampliter> Oh I hate Windows 7
14:56 -!- Sk00rche- [~Sk00rchen@83.251.230.74] has quit [Ping timeout: 260 seconds]
14:56 < krzee> lampliter, colision gave you the likely correct answer
14:57 < lampliter> yes he did. If I gave the impression I was doubting his answer, I'm sorry.
14:58 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
14:58 < krzee> cool, i was unsure =]
14:58 < lampliter> I was feeling rather frustrated because the error did not lead me in the right direction (i.e. required privilege level mismatch was not detected and reported)
14:59 < lampliter> one of the hats I wear is a usability hat and I hate misleading users especially when the user is me. :-)
14:59 < colision> Sorry, but the error was pretty clear.
14:59 < lampliter> the message said that the install failed. No doubt about it. It was very clear
15:00 < lampliter> if that was the first time you encounter that message however where would you think to look for a solution? Execute permissions, privilege level mismatch, corrupted executable, virus?
15:00 < colision> failed because no previlgies 9not on the msg but obvious)
15:01 < colision> is it working now?
15:01 < lampliter> Yes it is working now
15:01 < colision> great!
15:01 < krzee> maybe maybe not... i just asked in the dev meeting if a better error could be added or not =]
15:02 < lampliter> I will leave you with this thought. What would your grandmother think if she encounter that error and you were not around. I suspect it could be simply expressed as WTF??
15:02 < colision> hehehe
15:02 < colision> true
15:02 < krzee> if your gramma even tried to run tapinstall ild be impressed
15:02 < colision> shes not sysadmin
15:02 < lampliter> I thank you for your help. I'm being beckoned to a meeting where I get to annoy other people with usability challenges. :-)
15:02 < krzee> i suggest all non-techie grammas stay away from administrating openvpn
15:02 < krzee> lol
15:03  * colision says the same
15:03 < krzee> [13:02]  <mattock> actually, the manifest file (embedded or external) determines the required execution level
15:03 < krzee> [13:02]  <mattock> that could probably be fixed by embedding a correct manifest into tapinstall.exe
15:03 < krzee> [13:02]  <mattock> probably a good practice
15:03 < krzee> it may end up a non-issue in the future now =]
15:03 < colision> ye
15:04 < lampliter> think sales guy/gal in hotel trying to fix vpn using docs because they can't reach you on the phone.  really got to go. :-)
15:04 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 252 seconds]
15:05 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
15:05 < krzee> its on the to-do list lampliter =]
15:11 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
15:11 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 252 seconds]
15:17 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 276 seconds]
15:18 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
15:22 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
15:33 -!- Sk00rche- [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 252 seconds]
15:44 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
15:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
16:04 -!- Archibald [Archibald@c-71-224-92-73.hsd1.pa.comcast.net] has joined #openvpn
16:13 -!- dazo is now known as dazo_afk
16:20 -!- greencult [~greencult@200.48.85.28] has joined #openvpn
16:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:25 < greencult> someone speak spanish here??
16:28 < Archibald> I can use google translate does that help
16:32 < greencult> how i can change the bandwith in the tunnel of my vpn ??
16:33 < greencult> i have 10mbps 
16:33 < greencult> i use openvpn server with clients windows with openvpn gui
16:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:51 -!- greencult [~greencult@200.48.85.28] has quit [Quit: Lost terminal]
17:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:02 <@vpnHelper> RSS Update - forum: What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11448>
18:05 < krzie> !as
18:05 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
18:05 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
18:08 <@vpnHelper> RSS Update - forum: Setting up VPN from Site to Laptop <http://forums.openvpn.net/topic7981.html> || What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11449>
18:14 -!- colision [logos@187.78.235.88] has quit [Ping timeout: 252 seconds]
18:14 <@vpnHelper> RSS Update - forum: Setting up VPN from Main Office to Traveling Laptop <http://forums.openvpn.net/topic7982.html>
18:20 <@vpnHelper> RSS Update - forum: What's The Best GUI For Win7? <http://forums.openvpn.net/topic7972.html#p11452>
18:57 -!- thelongmile [~thelongmi@cpc1-ely04-0-0-cust347.5-1.cable.virginmedia.com] has joined #openvpn
18:57 -!- thelongmile [~thelongmi@cpc1-ely04-0-0-cust347.5-1.cable.virginmedia.com] has left #openvpn []
19:17 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:22 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:26 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 246 seconds]
19:43 -!- toortog [nesm6@notsecure.net] has quit [Read error: Operation timed out]
20:05 -!- master_of_master [~master_of@p57B55C90.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:10 -!- master_of_master [~master_of@p57B55B42.dip.t-dialin.net] has joined #openvpn
20:16 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Operation timed out]
20:20 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
20:21 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
20:26 <@vpnHelper> RSS Update - forum: OpenVPN Route gateway is ambiguous <http://forums.openvpn.net/topic7983.html>
20:38 <@vpnHelper> RSS Update - forum: revoke user with "ERROR:name does not match" <http://forums.openvpn.net/topic7979.html#p11454>
20:52 -!- rasengan [~rasengan@unaffiliated/rasengan] has joined #openvpn
20:52 < rasengan> Is it possible to connect to an IPSec VPN through OpenVPN?
20:52 < rasengan> i.e., VPN through VPN
20:54 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
20:56 < rommel092079> good day all. this is the 2nd day of trial and error of my udp server. I can connect but no internet connection.  What could be the problem. 
20:58 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:02 -!- whitelines1986 [whitelines@114.94.30.133] has joined #openvpn
21:02 < whitelines1986> hi
21:02 < whitelines1986> my vps has 2 public ips, how to tell openvpn which one to use? i'm routing all my internet to the openvpn server
21:38 <@vpnHelper> RSS Update - forum: DNS problem when connected to vpn server <http://forums.openvpn.net/topic7984.html>
21:46 -!- whitelines1986 [whitelines@114.94.30.133] has left #openvpn []
22:03 -!- asbestoss [asbestoss@61.173.125.65] has joined #openvpn
22:03 < asbestoss> have vps with 2 public ip's... how do i tell openvpn which one i want to use? Can i just type local public ip in the server.conf?
22:04 < asbestoss> i will use push redirect gateway
22:06 -!- rommel092079 [~rommel@amertospromotions.com] has quit [Ping timeout: 248 seconds]
22:28 -!- lampliter [~chatzilla@c-76-19-126-1.hsd1.ma.comcast.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
22:44 < ecrist> asbestoss: yes,
22:44 < ecrist> !man
22:44 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
22:47 < asbestoss> thanks
22:50 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
22:51 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
23:27 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
23:31 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
23:34 < asbestoss> do i need to also do something special with routing?
23:34 < asbestoss> i have 2 interfaces each with unique public ip
23:34 < asbestoss> venet0:0 and venet 0:1
23:35 < asbestoss> i'd like to route traffic from tun0 to venet 0:1
23:35 < asbestoss> as im using push gateway def 1
23:50 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:59 -!- ttelford [~ttelford@2001:55c:43a6:444b:3c44:87bc:512a:d6ff] has joined #openvpn
--- Day changed Fri Apr 22 2011
00:00 -!- colision [logos@187.78.232.160] has joined #openvpn
00:00 -!- ttelford [~ttelford@2001:55c:43a6:444b:3c44:87bc:512a:d6ff] has quit [Client Quit]
00:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
00:12 -!- asbestoss [asbestoss@61.173.125.65] has left #openvpn []
01:00 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
01:26 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:49 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
02:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection timed out]
02:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:50 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
02:50 < rommel092079> good day all. guys I need you help please. I need to know how I can set or push my own default gateway.
02:51 < rommel092079> I know my question now is about openvpn, I am on the right channel. please guys. just one for today.
02:53 -!- luneff [~yury@84.51.192.6] has joined #openvpn
02:57 <@vpnHelper> RSS Update - forum: TXT_DB error number 2 <http://forums.openvpn.net/topic7985.html>
02:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection timed out]
02:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:01 < rommel092079> guys please come on. really need answer for this one. 
03:08 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:08 -!- mode/#openvpn [+o mattock] by ChanServ
03:10 < rommel092079> when you asked for help no one answers
03:10 < Archibald> hi rommel092079
03:12 < rommel092079> i have read the manual, searched google but still confused. someone kindly assist me
03:13 < rommel092079> Archibald, can you possibly assist me
03:15 < Archibald> I doubt it im a newbie
03:19 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
03:23 < rommel092079> ok. tnx
03:29 -!- rommel092079 [~rommel@amertospromotions.com] has quit [Read error: Connection reset by peer]
03:29 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: Problems with TAP 32 speed? <http://forums.openvpn.net/topic7986.html>
03:44 -!- rommel092079 [~rommel@amertospromotions.com] has quit []
03:56 < krzie> someone tell that guy its spring break
03:56 < krzie> lol
03:57 < Archibald> lolololol
03:57 < krzie> im hammered, just got home
03:58 < Archibald> halp halp someone halp why noone halp i need halp
03:58 < Archibald> nice what you drink
03:58 < krzie> going to the beach in like 4 hours, hoping to sleep a little first
03:58 < Archibald> beach :o where from?
03:58 < krzie> its 5am i been drinking since 8pm
03:58 < krzie> beer
03:58 < Archibald> LOL nice
03:58 < krzie> the islands
03:59 < Archibald> fun fun
03:59 < krzie> if hes trying to redirect his gateway
03:59 < krzie> !redirect
03:59 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
03:59 < krzie> maybe that'll help him
03:59 < krzie> later
03:59 < Archibald> !help
03:59 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
04:00 < Archibald> this is fun i love bots
04:00 < Archibald> later man
04:00 < Archibald> !ipforward
04:00 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
04:00 < Archibald> !winipforward
04:00 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
04:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:01 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
04:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:03 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
04:15 -!- rommel092079 [~rommel@amertospromotions.com] has quit []
04:27 -!- bauruine [~stefan@tuxli.ch] has quit [Ping timeout: 248 seconds]
04:47 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:47 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:47 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
04:50 < rommel092079> good day all. Can I ask your assistance on setting default gateway.  I have been playing with route and redirect-gateway options but with no success.  I would like to set to my client to use the gateway that I will set instead of the default gateway of the isp.
04:54 < rommel092079> anybody please
05:02 < rommel092079> hello !
05:03 -!- K1ng [~KING@180.211.188.23] has joined #openvpn
05:03 < rommel092079> help please
05:05 < rommel092079> huhuhuhuhuhu :(
05:14  * hyper_ch points to topic
05:30 < rommel092079> still no one?
05:31 < Bushmills> !redirect
05:31 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
05:33 -!- K1ng\ [~KING@180.211.188.23] has joined #openvpn
05:33 < rommel092079> !def
05:34 < rommel092079> !ipforward
05:34 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
05:34 < rommel092079> !nat
05:34 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
05:34 < rommel092079> !def
05:37 -!- K1ng [~KING@180.211.188.23] has quit [Ping timeout: 260 seconds]
05:39 < rommel092079> bushmills, currently i have this options and configure: push "redirect-gateway 11.8.0.0", echo "1" > /proc/sys/net/ipv4/ip_forward, iptables -t nat -A POSTROUTING -s 11.8.0.0/20 -j SNAT --to x.x.x.x.   Are those right and enough?
05:42 < Bushmills> !why don't you try what the factoids or the openvpn howto suggest?
05:45 < rommel092079> im on it and try to do more tests now. tnx
05:45 -!- rommel092079 [~rommel@amertospromotions.com] has quit []
05:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
06:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:59 -!- rommel092079 [~rommel@amertospromotions.com] has joined #openvpn
06:59 < rommel092079> bushmills, i tried but no success still
07:01 < rommel092079> anybody around here!
07:02 < hyper_ch> rommel092079: did you read the topic?
07:03 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
07:03 < Bushmills> then you're doing something wrong
07:06 < rommel092079> i guess I followed 
07:09 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
07:10 < rommel092079> ciao
07:10 -!- rommel092079 [~rommel@amertospromotions.com] has left #openvpn []
07:29 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
07:29 -!- mode/#openvpn [+o mattock] by ChanServ
07:34 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
08:23 -!- Archibald [Archibald@c-71-224-92-73.hsd1.pa.comcast.net] has quit [Quit: [18:36:13] <Drant> there are no Champ spawns in Grimm, just where victor Decides to stand]
08:25 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:02 <@vpnHelper> RSS Update - forum: SQL server only visible when firewall rule set to public <http://forums.openvpn.net/topic7905.html#p11458>
09:16 -!- dar__ [~droutin@gw.theralys.com] has joined #openvpn
09:16 < dar__> hi all!
09:16 < dar__> i am just trying to do soemthing very simple but i cannot succeed :(
09:17 < dar__> i want to create 2 instances of openvpn
09:17 < dar__> one using IP range from 192.168.1.0-50
09:17 < dar__> (for UDP connection)
09:18 < pwrcycle> dar__: using 192.168.x.x subnets is not suggested, created routing conflicts
09:19 < dar__> and another one for tcp connections 
09:19 < dar__> from 192.168.1.50-200
09:20 < dar__> but if i play with ifconfig-pool i cannot even start openvpn :(
09:20 < pwrcycle> dar__: you just use 2 config files, using different server ports
09:20 < dar__> it seems that i can't deal with both "server" and ifconfig-pool
09:20 < dar__> pwrcycle: this won't work
09:20 < pwrcycle> !config
09:20 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
09:20 < pwrcycle> dar__: get specific, pastebin your configs
09:21 < dar__> imagine if the tcp vpn give an ip and the udp vpn give the same ip
09:23 -!- Blues-Man [~bluesman@188.11.17.81] has joined #openvpn
09:26 < dar__> http://pastebin.com/dRsufVR9
09:26 < dar__> this conf does not wotrk
09:27 < pwrcycle> dar__: is your tcp config server running on port 1194 also?
09:28 < dar__> nop
09:28 < dar__> at first i just wana make this config work
09:29 < dar__> i mean having all these UDP clients getting Ips from 10.4.4.2 to 10.4.4.25 for sample
09:30 < dar__> pwrcycle: what do you think ?
09:31 < pwrcycle> still thinking
09:32 < pwrcycle> you have to have the server line in there. that's stopping it from starting..
09:35 < colision> dar: is the service already running?
09:35 < colision> ps ax | grep oopenvpn
09:35 < colision> ps ax | grep openvpn
09:38 < pwrcycle> dar__:  you have to decalre server, and your netmast is wrong
09:39 < pwrcycle> should be more like: fconfig-pool 10.4.4.0 255.255.255.128
09:39 < colision> My server.conf is:
09:39 < colision> server 10.10.10.0 255.255.255.0
09:39 < colision> push "route 10.10.10.0 255.255.255.0" # Rede do Tunnel
09:39 < colision> push "route 172.16.1.0 255.255.255.0" # Rede interna que o Cliente pode ver.
09:39 < pwrcycle> ifconfig-pool 10.4.4.0 10.4.4.40  << is not proper 
09:39 < colision> as u can see "server" and "push "route" has same network
09:40 < colision> powercycle: i did ifconfig-pool-persist ipp.txt
09:41 < pwrcycle> colision: he's trying to split the network smaller than 256 also.
09:42 < pwrcycle> dar__: use server 10.4.4.0 255.255.255.0  & ifconfig-pool 10.4.4.0 255.255.255.0 just to bring up the network to begin with, then adjust your netmast to make the pool smaller
09:44 -!- HeXiLeD [~L3D@unaffiliated/hexiled] has joined #openvpn
09:45 < HeXiLeD> hi guys .
09:45 < pwrcycle> hola
09:46 < colision> hi
09:47 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: .]
10:08 < Bushmills> !subnet
10:08 <@vpnHelper> "subnet" is http://www.subnet-calculator.com/ or http://en.wikipedia.org/wiki/Subnetwork
10:09 < Bushmills> !factoids search subnet
10:09 <@vpnHelper> 'subnet' and 'samesubnet'
10:10 < Bushmills> !1918
10:10 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
10:11 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
10:19 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
10:19 -!- mode/#openvpn [+o mattock] by ChanServ
10:34 -!- takamichi [Takamichi@46.11.14.68] has quit [Ping timeout: 260 seconds]
10:34 -!- takamichi [Takamichi@46.11.14.68] has joined #openvpn
10:37 -!- dar__ [~droutin@gw.theralys.com] has quit [Quit: WeeChat 0.3.0]
10:40 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Read error: Operation timed out]
10:40 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
10:57 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Ping timeout: 260 seconds]
10:58 -!- Blues-Man [~bluesman@188.11.17.81] has quit [Quit: Sto andando via]
11:02 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 263 seconds]
11:03 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
11:09 -!- gyyrog [~gyyrog@24.231.158.154] has joined #openvpn
11:16 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
11:16 -!- mode/#openvpn [+o mattock] by ChanServ
11:52 -!- p3rror [~mezgani@41.140.174.162] has joined #openvpn
11:56 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
12:00 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
12:03 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 250 seconds]
12:08 -!- luneff [~yury@84.51.192.6] has joined #openvpn
12:15 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:20 -!- Mirrakor [~Leya@opensuse/member/Mirrakor] has left #openvpn []
12:39 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Quit: Leaving]
12:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:03 <@vpnHelper> RSS Update - forum: Problems with TAP 32 speed? <http://forums.openvpn.net/topic7986.html#p11460> || constant traffic to external IP <http://forums.openvpn.net/topic7980.html#p11459>
13:06 -!- colision [logos@187.78.232.160] has quit [Ping timeout: 240 seconds]
13:09 <@vpnHelper> RSS Update - forum: DNS problem when connected to vpn server <http://forums.openvpn.net/topic7984.html#p11463> || TXT_DB error number 2 <http://forums.openvpn.net/topic7985.html#p11462> || OpenVPN Route gateway is ambiguous <http://forums.openvpn.net/topic7983.html#p11461>
13:23 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
13:27 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 250 seconds]
13:38 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
13:38 -!- mode/#openvpn [+o mattock] by ChanServ
13:46 -!- colision [logos@187.78.232.160] has joined #openvpn
13:46 -!- colision is now known as Guest75288
13:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:36 -!- bitterman [~yury@84.51.192.6] has quit [Quit: Leaving]
14:39 -!- GuilhermeCunha [~cunha@187.53.105.85] has joined #openvpn
14:40 -!- GuilhermeCunha [~cunha@187.53.105.85] has quit [Client Quit]
14:57 -!- Clete2_ [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
15:04 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
15:05 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
15:27 <@vpnHelper> RSS Update - forum: need to use public ip in my local lan <http://forums.openvpn.net/topic7961.html#p11464>
15:39 -!- zayka [~zayka@vir1a.toonel.net] has quit [Remote host closed the connection]
16:08 -!- rhh02 [4b2a0ed0@gateway/web/freenode/ip.75.42.14.208] has joined #openvpn
16:09 < rhh02> how would I go about changing the time between connection attempts, a la Restart pause, 5 second(s) ?
16:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:56 -!- gyyrog [~gyyrog@24.231.158.154] has quit [Remote host closed the connection]
16:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:08 -!- rhh02 [4b2a0ed0@gateway/web/freenode/ip.75.42.14.208] has quit [Ping timeout: 252 seconds]
17:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:12 -!- klemax [~klemax@unaffiliated/klemax] has quit [Ping timeout: 276 seconds]
17:25 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:28 <@vpnHelper> RSS Update - forum: Route on client fails when change server to Windows 7 64bit <http://forums.openvpn.net/topic7987.html>
17:30 -!- Guest75288 [logos@187.78.232.160] has quit [Ping timeout: 240 seconds]
17:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:49 -!- Guest75288 [logos@187.78.232.160] has joined #openvpn
17:56 -!- diemaco [~df@d204-191-182-51.abhsia.telus.net] has quit [Quit: ZNC - http://znc.in]
18:04 <@vpnHelper> RSS Update - forum: Route on client fails when change server to Windows 7 64bit <http://forums.openvpn.net/topic7987.html#p11466>
18:08 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
18:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
19:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
19:20 -!- Katoen is now known as Kateon
19:20 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 276 seconds]
19:42 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
19:43 -!- steve [~muh@bouncer.stephen.marsh.name] has joined #openvpn
19:47 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 260 seconds]
19:49 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
19:53 < jpalmer> is there a way to stop openvpn from pushing routes on clients?  
19:59 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
20:07 -!- master_of_master [~master_of@p57B55B42.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:09 -!- master_of_master [~master_of@p57B55794.dip.t-dialin.net] has joined #openvpn
20:26 < Bushmills> --route-nopull
20:29 < ecrist> or --push-reset
20:29 < ecrist> in a CCD entry
20:29 < Bushmills> "on clients"
20:31 < ecrist> I say his question was minorly ambiguous
20:31 < ecrist> clients don't push, servers do, but the push TO not ON
20:31 < ecrist> *shrug*
20:32 < Bushmills> i'd think, i he wanted to stop server pushing routes, he'd remove the route pushing from server config
20:32 < Bushmills> but well, his choice. he can pick whatever he finds suitable
20:33 < ecrist> well, there are instances in which you don't want to push some routes to a specific client
20:48 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
21:04 <@vpnHelper> RSS Update - forum: Route on client fails when change server to Windows 7 64bit <http://forums.openvpn.net/topic7987.html#p11467>
21:28 <@vpnHelper> RSS Update - forum: assign different dhcp IP range for each client <http://forums.openvpn.net/topic7988.html>
21:38 < jpalmer> ecrist:  got a sec?
21:39 < ecrist> yup
21:40 < jpalmer> is there a way to pass traffic over an openvpn interface,  that openvpn isn't configured for?   openvpn is assigning a /24 to clients.  but for one specific client,  I need a /30 assigned.
21:40 < ecrist> I need to know more.
21:40 < ecrist> there is and isn't
21:40 < jpalmer> so,  I have openvpn doing 10.16.0.0/24,  and trying to manually configure the interface for 192.168.1.1/30
21:40 < ecrist> at some point, you have to configure something
21:41 < ecrist> why do you want to do that?
21:41 < jpalmer> well,  that gets a bit complicated ;)  it has to do with quagga and ibgp
21:41 < ecrist> if you're running on a tap interface, yes, that would work because it's just ethernet that openvpn cares about
21:41 < ecrist> but with tun, that won't work
21:42 < jpalmer> so ultimately,  I probably need a seperate openvpn instance,  and have it use tap?   or just topology net30?
21:42 < ecrist> net30 is fine
21:43 < ecrist> separate instance would be easiest
21:43 < jpalmer> ok.  the client also needs a static IP.   can I combiine ccd and net30?
21:44 < ecrist> sure
21:44  * ecrist would just use tap
21:44 < ecrist> if it's the only client, though, it should always get the same IP.
21:45 < jpalmer> it's not the only client.  ;)
21:45 < up_the_irons> i'm thinking "iroute"
21:46 < ecrist> jpalmer: use tap, assign static IPs to the tap interfaces, call it good.
21:46 < jpalmer> hmm,  so manually configure the interface for the ip/30,  and then iroute to let openvpn know it should handle the traffic?
21:46 < up_the_irons> jpalmer: that's my hypothesis
21:47 < up_the_irons> cuz all we really want is for openvpn to let us put the /30 on tunnel
21:47 < jpalmer> ecrist: I don't know if you recall this whole complicated scenario,  but I need to avoid static IP's for all but a couple clients.. 
21:47  * ecrist sighs
21:48 < jpalmer> oh oh,  you mean a static IP for that specific client.  not all clients.  my bad
21:49 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Operation timed out]
22:07 -!- zayka [~zayka@vir1a.toonel.net] has joined #openvpn
22:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 250 seconds]
22:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:49 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
22:49 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
22:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
23:15 <@vpnHelper> RSS Update - forum: Can't connect Clients!!!! <http://forums.openvpn.net/topic7898.html#p11469>
23:19 -!- freaky[t] is now known as freakyy[t]
23:27 -!- freakyy[t] is now known as freaky[t]
--- Day changed Sat Apr 23 2011
00:22 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
00:22 -!- mode/#openvpn [+o raidz] by ChanServ
00:56 -!- Guest75288 is now known as colision
01:18 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
01:19 < crocket> How can I make openvpn stop connecting to the remote server after trying for a certain number of times or a certain amount of time?
01:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
01:39 < crocket> How can I make openvpn stop connecting to the remote server after trying for a certain number of times or a certain amount of time?
02:12 -!- gallatin [~gallatin@dslb-178-006-222-156.pools.arcor-ip.net] has joined #openvpn
02:17 -!- WebDawg [~whoami@67.223.228.7] has quit [Ping timeout: 260 seconds]
02:18 -!- crocket [debian-tor@gateway/tor-sasl/crocket] has quit [Quit: I quit.]
02:20 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
02:30 -!- crocket2 [debian-tor@gateway/tor-sasl/crocket] has joined #openvpn
02:33 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
02:57 <@vpnHelper> RSS Update - forum: multi-client vlan-pvid setting <http://forums.openvpn.net/topic7989.html>
03:00 -!- gallatin [~gallatin@dslb-178-006-222-156.pools.arcor-ip.net] has quit [Quit: Client exiting]
03:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
03:12 -!- K1ng\ [~KING@180.211.188.23] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
03:13 -!- crocket2 [debian-tor@gateway/tor-sasl/crocket] has quit [Quit: I quit.]
03:15 <@vpnHelper> RSS Update - forum: Gorkhaan's Setup ( Wordpress + OpenVPN fun ) <http://forums.openvpn.net/topic3158.html#p11471>
03:20 -!- K1ng [~KING@180.211.188.23] has joined #openvpn
03:20 -!- K1ng [~KING@180.211.188.23] has quit [Client Quit]
03:21 -!- K1ng [~KING@180.211.188.23] has joined #openvpn
03:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:33 -!- takamichi [Takamichi@46.11.14.68] has quit [Ping timeout: 260 seconds]
03:33 <@vpnHelper> RSS Update - forum: squid proxy without configuring client web browser <http://forums.openvpn.net/topic7990.html>
03:34 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: How to receive a mail on client connection and disconnecti ? <http://forums.openvpn.net/topic7974.html#p11473>
03:51 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:51 -!- mode/#openvpn [+o mattock] by ChanServ
04:14 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
04:14 -!- takamichi [Takamichi@46.11.14.68] has joined #openvpn
04:21 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 250 seconds]
04:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:52 <@vpnHelper> RSS Update - forum: squid proxy without configuring client web browser <http://forums.openvpn.net/topic7990.html#p11474>
04:58 <@vpnHelper> RSS Update - forum: Setting up VPN from Site to Laptop <http://forums.openvpn.net/topic7981.html#p11476> || Setting up VPN from Main Office to Traveling Laptop <http://forums.openvpn.net/topic7982.html#p11475>
04:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:02 -!- luneff [~yury@84.51.192.6] has joined #openvpn
05:04 <@vpnHelper> RSS Update - forum: Gorkhaan's Setup ( Wordpress + OpenVPN fun ) <http://forums.openvpn.net/topic3158.html#p11478> || Help needed to setup my vps with vpn on port 53 <http://forums.openvpn.net/topic7991.html>
05:45 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
05:45 <@vpnHelper> RSS Update - forum: Help needed to setup my vps with vpn on port 53 <http://forums.openvpn.net/topic7991.html#p11479>
06:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
06:04 <@vpnHelper> RSS Update - forum: Gorkhaan's Setup ( Wordpress + OpenVPN fun ) <http://forums.openvpn.net/topic3158.html#p11480>
06:21 -!- K1ng [~KING@180.211.188.23] has quit [Ping timeout: 246 seconds]
06:52 -!- bitterman [~yury@84.51.192.6] has joined #openvpn
06:52 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:56 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 260 seconds]
07:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
07:35 -!- bitterman [~yury@84.51.192.6] has quit [Quit: Leaving]
08:17 -!- xnixan [~xnixan@unaffiliated/xnixan] has joined #openvpn
08:28 -!- JPeterso2 [HydraIRC@213.103.209.64] has joined #openvpn
08:30 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 246 seconds]
08:30 -!- JPeterso2 is now known as JPeterson
08:31 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 248 seconds]
08:36 -!- K1ng [~KING@180.211.188.142] has joined #openvpn
08:38 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
08:42 -!- JPeterson [HydraIRC@213.103.209.64] has quit [Ping timeout: 260 seconds]
08:43 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Read error: Operation timed out]
08:43 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
08:47 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
08:50 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
08:55 -!- takamichi [Takamichi@46.11.14.68] has quit [Ping timeout: 248 seconds]
08:55 -!- takamichi [~pri@46.11.14.68] has joined #openvpn
09:00 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Ping timeout: 246 seconds]
09:04 <@vpnHelper> RSS Update - forum: Can't connect Clients!!!! <http://forums.openvpn.net/topic7898.html#p11481>
09:06 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
09:10 -!- p3rror [~mezgani@41.140.174.162] has quit [Ping timeout: 250 seconds]
09:16 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Read error: Operation timed out]
09:18 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
09:18 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
09:18 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:19 -!- Hamlin [~Hamlin@mountainmorningband.com] has joined #openvpn
09:19 -!- Hamlin [~Hamlin@mountainmorningband.com] has quit [Changing host]
09:19 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
09:25 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
09:26 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
09:28 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
09:30 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
09:30 -!- Meliorator [m@dunnington.eu] has quit [Ping timeout: 276 seconds]
09:46 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
09:50 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
09:52 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 246 seconds]
09:52 -!- JPeterso2 is now known as JPeterson
09:53 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
09:55 -!- Meliorator [m@dunnington.eu] has joined #openvpn
09:55 -!- Meliorator [m@dunnington.eu] has quit [Max SendQ exceeded]
09:56 -!- Meliorator [m@dunnington.eu] has joined #openvpn
09:57 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 248 seconds]
09:57 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
09:59 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
10:08 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
10:09 -!- p3rror [~mezgani@41.248.187.212] has joined #openvpn
10:44 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
10:54 -!- Blues-Man [~bluesman@188.11.17.81] has joined #openvpn
11:11 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:13 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 246 seconds]
11:13 -!- JPeterso2 is now known as JPeterson
11:37 -!- luneff [~yury@84.51.192.6] has joined #openvpn
11:52 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
11:53 < Sk00rchen> !welcome
11:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:53 < Sk00rchen> !route
11:53 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:59 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 250 seconds]
11:59 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
12:01 < Sk00rchen> !sample
12:01 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
12:12 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:19 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:30 -!- Blues-Man [~bluesman@188.11.17.81] has quit [Quit: Sto andando via]
12:43 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
12:44 -!- bauruine [~stefan@213-67-2-225-no88.tbcn.telia.com] has joined #openvpn
12:48 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
13:12 -!- Meliorator [m@dunnington.eu] has quit [Ping timeout: 276 seconds]
13:25 -!- Meliorator [m@dunnington.eu] has joined #openvpn
13:25 -!- Meliorator [m@dunnington.eu] has quit [Max SendQ exceeded]
13:26 -!- Meliorator [m@dunnington.eu] has joined #openvpn
13:29 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
13:30 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
13:41 <@vpnHelper> RSS Update - forum: No ping between openvpn clients <http://forums.openvpn.net/topic7992.html>
13:43 -!- bauruine [~stefan@213-67-2-225-no88.tbcn.telia.com] has quit [Ping timeout: 248 seconds]
13:48 -!- f1assistance1 [~Carl@cpe-066-057-005-143.nc.res.rr.com] has joined #openvpn
13:50 -!- Meliorator [m@dunnington.eu] has quit [Ping timeout: 276 seconds]
14:05 -!- Meliorator [m@dunnington.eu] has joined #openvpn
14:05 -!- Meliorator [m@dunnington.eu] has quit [Max SendQ exceeded]
14:06 -!- Meliorator [m@dunnington.eu] has joined #openvpn
14:12 -!- Meliorator [m@dunnington.eu] has quit [Read error: Connection reset by peer]
14:23 -!- bauruine [~stefan@213-67-2-225-no88.tbcn.telia.com] has joined #openvpn
14:31 -!- bauruine [~stefan@213-67-2-225-no88.tbcn.telia.com] has quit [Ping timeout: 248 seconds]
14:41 <@vpnHelper> RSS Update - forum: Can't connect Clients!!!! <http://forums.openvpn.net/topic7898.html#p11483>
14:46 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
14:55 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 248 seconds]
14:56 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
15:01 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 252 seconds]
15:03 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
15:09 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 250 seconds]
15:11 -!- APTX [APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
15:11 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
15:13 -!- lpe [~lpe@mute.nu] has quit [Ping timeout: 252 seconds]
15:21 -!- lpe [~lpe@mute.nu] has joined #openvpn
15:31 -!- lpe [~lpe@mute.nu] has quit [Ping timeout: 248 seconds]
16:06 -!- Varazir_ [mircwars@c-94-255-130-33.cust.bredband2.com] has quit [Remote host closed the connection]
16:07 -!- steve [~muh@bouncer.stephen.marsh.name] has quit [Ping timeout: 246 seconds]
16:15 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
17:09 -!- p3rror [~mezgani@41.248.187.212] has quit [Remote host closed the connection]
17:43 -!- APTX [APTX@phpBB/developer/APTX] has quit [Read error: Connection reset by peer]
17:47 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
17:47 <@vpnHelper> RSS Update - forum: HEADER_SIZE in source <http://forums.openvpn.net/topic7993.html>
18:10 -!- f1assistance1 [~Carl@cpe-066-057-005-143.nc.res.rr.com] has left #openvpn []
18:42 <@vpnHelper> RSS Update - forum: OpenVPN Route gateway is ambiguous <http://forums.openvpn.net/topic7983.html#p11485>
18:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:48 <@vpnHelper> RSS Update - forum: Running Vista & Win7 As Admin - Right Click The GUI? <http://forums.openvpn.net/topic7994.html>
19:16 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:31 < krzee> |Mike|, how bout ops on efnet pls
20:07 -!- master_of_master [~master_of@p57B55794.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
20:09 -!- master_of_master [~master_of@p57B53E27.dip.t-dialin.net] has joined #openvpn
20:24 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Remote host closed the connection]
20:31 -!- Splex [~splex@unaffiliated/splex] has quit [Quit: leaving]
20:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:06 -!- K1ng [~KING@180.211.188.142] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
21:06 -!- K1ng [~KING@180.211.188.142] has joined #openvpn
21:07 -!- K1ng [~KING@180.211.188.142] has quit [Read error: Connection reset by peer]
21:07 -!- K1ng [~KING@180.211.188.142] has joined #openvpn
21:09 -!- K1ng [~KING@180.211.188.142] has quit [Read error: Connection reset by peer]
21:09 -!- K1ng [~KING@180.211.188.142] has joined #openvpn
21:10 -!- K1ng [~KING@180.211.188.142] has quit [Read error: Connection reset by peer]
21:32 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
21:33 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:48 <@vpnHelper> RSS Update - forum: Server Install on Amazon Linux AMI - Can't Generate Script <http://forums.openvpn.net/topic7995.html>
21:55 -!- Guest67882 [logos@187.78.248.250] has joined #openvpn
21:56 -!- colision [logos@187.78.232.160] has quit [Ping timeout: 258 seconds]
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:05 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:27 -!- gyyrog [~gyyrog@66.227.134.70] has joined #openvpn
23:04 -!- asbestoss [asbestoss@114.94.21.127] has joined #openvpn
23:04 < asbestoss> -bash: ./clean-all: Permission denied
23:04 < asbestoss> please hellp?
23:16 -!- zayka [~zayka@vir1a.toonel.net] has quit [Remote host closed the connection]
23:16 -!- larie [~fling@83.246.243.61] has quit [Read error: Connection reset by peer]
23:53 < asbestoss> !linat
23:53 < asbestoss> !nat
23:53 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
23:53 < asbestoss> !linnat
23:53 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
--- Day changed Sun Apr 24 2011
00:00 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Remote host closed the connection]
00:01 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:06 -!- asbestoss [asbestoss@114.94.21.127] has quit [Ping timeout: 252 seconds]
00:09 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
00:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:07 <@vpnHelper> RSS Update - forum: No ping between openvpn clients <http://forums.openvpn.net/topic7992.html#p11488>
01:25 <@vpnHelper> RSS Update - forum: No ping between openvpn clients <http://forums.openvpn.net/topic7992.html#p11489>
02:03 -!- folivora [~bomshiva@koekaniini.kelju.fi] has joined #openvpn
02:04 < folivora> !welcome
02:04 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:15 -!- mode/#openvpn [+o mattock] by ChanServ
02:15 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
02:19 -!- gyyrog [~gyyrog@66.227.134.70] has quit [Remote host closed the connection]
02:19 -!- daemon_mum [~dima@mrdreamer.com] has joined #openvpn
02:42 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 248 seconds]
02:47 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Read error: Operation timed out]
03:02 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
03:14 -!- WebDawg [~whoami@officialg0d.com] has quit [Ping timeout: 252 seconds]
03:17 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
03:23 -!- orangess [orangess@114.94.7.211] has joined #openvpn
03:23 < orangess> hi
03:23 < orangess> are there any server side config settings that might help with using a vpn over a very slow connection?
03:23 < orangess> im connecting to it from a 1Mb connection
03:23 < orangess> and things like downloads work for a moment then get slower and slower until stopping
03:31 < Bushmills> --comp-lzo should help
03:32 < Bushmills> you also want to push that to client
03:33 -!- orangess [orangess@114.94.7.211] has quit [Ping timeout: 250 seconds]
03:34 < Bushmills> you're welcome
03:46 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
04:36 -!- luneff [~yury@84.51.192.6] has joined #openvpn
05:05 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
05:18 <@vpnHelper> RSS Update - forum: Undefined Offset issue when connecting to VPN <http://forums.openvpn.net/topic7996.html>
05:24 <@vpnHelper> RSS Update - forum: Running Vista & Win7 As Admin - Right Click The GUI? <http://forums.openvpn.net/topic7994.html#p11491>
06:10 -!- f1assistance [~Carl@cpe-066-057-005-143.nc.res.rr.com] has joined #openvpn
06:14 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
06:27 -!- f1assistance [~Carl@cpe-066-057-005-143.nc.res.rr.com] has quit [Ping timeout: 250 seconds]
06:37 -!- f1assistance [~Carl@cpe-066-057-005-143.nc.res.rr.com] has joined #openvpn
06:41 < |Mike|> krzee: where
06:46 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
07:34 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
07:34 -!- luneff [~yury@84.51.192.6] has joined #openvpn
07:44 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Read error: Connection reset by peer]
07:46 -!- echoSMIL1 [~censured@bl17-118-177.dsl.telepac.pt] has joined #openvpn
07:49 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 264 seconds]
07:56 -!- echoSMIL1 [~censured@bl17-118-177.dsl.telepac.pt] has quit [Changing host]
07:56 -!- echoSMIL1 [~censured@unaffiliated/echosmile] has joined #openvpn
07:56 -!- echoSMIL1 is now known as echoSMILE
07:58 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 248 seconds]
07:59 -!- orangess [orangess@61.173.118.9] has joined #openvpn
07:59 < orangess> hi
07:59 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
07:59 < orangess> what file permissions should i use on the dir 'jail' when using chroot jail
08:00 < orangess> i just did mkdir jail but didnt touch permissions yet
08:00 < orangess> ty
08:38 -!- orangess [orangess@61.173.118.9] has quit [Ping timeout: 260 seconds]
08:57 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
08:57 -!- mode/#openvpn [+o mattock] by ChanServ
09:04 -!- orangess [orangess@114.94.7.223] has joined #openvpn
09:17 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:29 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
10:47 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:01 -!- jwm [jwm@dev.dist.us] has left #openvpn []
12:14 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
12:14 -!- luneff [~yury@84.51.192.6] has joined #openvpn
13:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:11 <@vpnHelper> RSS Update - forum: OpenVPN Route gateway is ambiguous <http://forums.openvpn.net/topic7983.html#p11493> || Undefined Offset issue when connecting to VPN <http://forums.openvpn.net/topic7996.html#p11492>
14:02 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
14:03 -!- luneff [~yury@84.51.192.6] has joined #openvpn
14:13 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
14:31 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
14:32 -!- luneff [~yury@84.51.192.6] has joined #openvpn
14:41 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
14:43 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Client Quit]
14:45 -!- IOhannes [~zmoelnig@umlaeute.mur.at] has left #openvpn []
14:48 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
14:50 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
15:05 <@vpnHelper> RSS Update - forum: routed connection mystery - am I actually connected? <http://forums.openvpn.net/topic7997.html>
15:08 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:10 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Client Quit]
15:10 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:10 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Disconnected by services]
15:11 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Client Quit]
15:11 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
15:58 -!- bauruine [~stefan@213-67-2-225-no88.tbcn.telia.com] has joined #openvpn
16:11 < rasengan> Hi, my openvpn build on mac os x keeps suffering from no route to host UDP -- write UDPv4: No route to host (code=65)
16:11 < rasengan> is there something im missing?
16:12 < rasengan> on the other hand replacing the tunnelblick binary - works perfectly fine
16:12 < rasengan> ;o
16:18 < krzee> good job =]
16:23 <@vpnHelper> RSS Update - forum: routed connection mystery - am I actually connected? <http://forums.openvpn.net/topic7997.html#p11495>
16:25 -!- bauruine [~stefan@213-67-2-225-no88.tbcn.telia.com] has quit [Ping timeout: 248 seconds]
16:29 <@vpnHelper> RSS Update - forum: HEADER_SIZE in source <http://forums.openvpn.net/topic7993.html#p11497> || Undefined Offset issue when connecting to VPN <http://forums.openvpn.net/topic7996.html#p11496>
16:31 < rasengan> krzee o_O
16:33 < krzee> you solved the problem, right>?
16:33 < krzee> (by replacing the binary inside tunnelblick)
16:35 <@vpnHelper> RSS Update - forum: Server Install on Amazon Linux AMI - Can't Generate Script <http://forums.openvpn.net/topic7995.html#p11498>
16:36 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:06 < rasengan> krzee im sorry no :| i meant 
17:06 < rasengan> the binary inside tunnelblick worked great
17:06 < rasengan> but when i tried building both 2.1.4 and 2.2-rc2 they built fine, all libraries/etc. included shared etc... but
17:06 < rasengan> when connecting it connects and then produces that udp route error
17:06 < rasengan> the exact cmd, config, crt, etc. with the tunnelblick openvpn binary works fine o_o;
17:12 < krzee> !logs
17:12 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:12 < krzee> honestly, i dont bother using tunnelblick
17:13 < krzee> but ill try to help ya if you post the log =]
17:14 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
17:15 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
17:20 < rasengan> krzee intersting enough i rebuilt the thing yet again
17:20 < rasengan> and the only thing i chagned was i built ./configure --enable-password-save
17:20 < rasengan> and suddenly it WORKS o_o
17:21 < rasengan> wait sometimes it works oemtimes it doesnt
17:21 < rasengan> this is really weird heh
17:23 < rasengan> krzee i dont have really any logs but i figured out the problem but i dont know how to fix it
17:23 < rasengan> basically - if i reconnect and disconnect and reconnectover and over sometimes it gets lucky and 'works' (where no udp errors are spit out)
17:23 < rasengan> so somehow its losing its routing information upon connect :|
17:35 < krzee> well if you cant post me info, i cant help you
17:36 < krzee> without putting something on pastebin for us, you're probably wasting your time
17:37 < rasengan> im going to go on pastebin now
17:37 < rasengan> i found the erorr too
17:37 < rasengan> :D
17:39 < rasengan> krzee - broken pastebin http://pastebin.com/mDcihScS  -- and working pastebin http://pastebin.com/3rMkiSyx
17:39 < rasengan> the one discrepency i noticed between working and broken is... Sun Apr 24 18:37:26 2011 us=218977 ROUTE default_gateway=192.168.1.1
17:39 < rasengan> on the broken one it says 0.0.0.0 on the working one it says 192.168.1.1
17:41 <@vpnHelper> RSS Update - forum: HEADER_SIZE in source <http://forums.openvpn.net/topic7993.html#p11499>
17:47 < rasengan> krzee any suggestions sir
17:47 -!- keeme [~root@68.190.212.76] has joined #openvpn
17:47 < keeme> any1 know how to decode syslog transmission? i am running ngrep and it shows msg: ....
17:48 < rasengan> krzee hrrm i did some searching and it appears it is due to the version of gcc i am using
17:48 < rasengan> There is a bug which leads to wrong detection of the default_gateway (0.0.0.0) when the three following conditions apply: 1) openvpn2-2.0.9 is compiled with gcc-4.2 (the default on Mac OS X 10.6) 2) It is used as a client 3) 'push "redirect-gateway def1"' is used on the server side (e.g. a linux-box)
17:50 -!- keeme [~root@68.190.212.76] has left #openvpn []
17:55 < rasengan> yes that is a real thing cuz i just tried compiling the opevnpn that came w/ tunnelblick incase he had a fix hehe and it didnt work either with this gcc 4.2.1 :(
18:05 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
18:08 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
18:12 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
18:12 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
18:15 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 252 seconds]
18:18 <@vpnHelper> RSS Update - forum: Server Install on Amazon Linux AMI - Can't Generate Script <http://forums.openvpn.net/topic7995.html#p11500>
18:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
18:38 < krzee> rasengan, well you should be using 2.0.9 anyways
18:38 < krzee> thats old as shit
18:46 < krzee> err
18:46 < krzee> should NOT
18:48 <@vpnHelper> RSS Update - forum: Route on client fails when change server to Windows 7 64bit <http://forums.openvpn.net/topic7987.html#p11501>
18:49 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:54 <@vpnHelper> RSS Update - forum: How to receive a mail on client connection and disconnecti ? <http://forums.openvpn.net/topic7974.html#p11504> || Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11503> || OpenVPN over ICMP <http://forums.openvpn.net/topic7998.html>
19:04 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
19:06 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
19:09 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
19:21 -!- luneff [~yury@84.51.192.6] has joined #openvpn
19:35 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 276 seconds]
19:38 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:44 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:08 -!- master_of_master [~master_of@p57B53E27.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
20:10 -!- master_of_master [~master_of@p57B55C16.dip.t-dialin.net] has joined #openvpn
20:20 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
21:11 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:15 -!- Guest67882 is now known as colision
21:18 -!- trist4n [~tristan@60.240.120.192] has joined #openvpn
21:18 < trist4n> !welcome
21:18 < trist4n> !goal
21:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:18 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:19 < trist4n> !route
21:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
22:00 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Read error: Connection reset by peer]
22:01 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:27 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Read error: Operation timed out]
22:35 -!- ph1l [~ph1l@178.196.226.169] has joined #openvpn
22:36 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:58 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:08 -!- orangess [orangess@114.94.7.223] has quit []
23:46 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
23:46 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
--- Day changed Mon Apr 25 2011
00:20 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
00:23 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
00:23 -!- mode/#openvpn [+o raidz] by ChanServ
00:31 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
00:32 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
00:33 -!- twister004_ [~chatzilla@mail2.polariswireless.com] has joined #openvpn
00:34 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 260 seconds]
00:34 -!- twister004_ is now known as twister004
00:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
00:36 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
00:39 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
00:39 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
01:07 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
01:25 <@vpnHelper> RSS Update - forum: routed connection mystery - am I actually connected? <http://forums.openvpn.net/topic7997.html#p11505>
01:30 -!- xnixan [~xnixan@unaffiliated/xnixan] has quit [Quit: Leaving]
01:31 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
01:34 -!- twister004 [~chatzilla@mail2.polariswireless.com] has quit [Ping timeout: 250 seconds]
01:34 -!- twister004_ is now known as twister004
01:53 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:53 -!- mode/#openvpn [+o mattock] by ChanServ
02:19 <@vpnHelper> RSS Update - forum: Adapter Speed <http://forums.openvpn.net/topic7066.html#p11506>
02:34 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
02:34 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
02:34 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:37 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
02:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:02 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:02 -!- mode/#openvpn [+o mattock] by ChanServ
03:04 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
03:18 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
03:49 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
04:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
04:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
04:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:55 <@vpnHelper> RSS Update - forum: HD video over VPN (samba share) lagging <http://forums.openvpn.net/topic7245.html#p11508> || Linux Tap device 10Mbit <http://forums.openvpn.net/topic7535.html#p11507>
05:01 <@vpnHelper> RSS Update - forum: Please fix Win32/64bit Tap Tunnel Adapter!!! <http://forums.openvpn.net/topic7999.html>
05:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:38 -!- RT_FM [rt@unaffiliated/rt-fm/x-8074213] has joined #openvpn
05:38 < RT_FM> hello
05:38 < RT_FM> is there a way to connect with 1.3 client to a 2.0 server ?
05:40 < RT_FM> i have an old box with a 3.2gb hdd, and recompiling everything would be a pain, ofcourse 2.0 can't be compiled there.
05:44 < RT_FM> oh, no tun iface compiled into kernel... nevermind then =]
05:44 -!- RT_FM [rt@unaffiliated/rt-fm/x-8074213] has left #openvpn []
06:06 -!- trist4n [~tristan@60.240.120.192] has left #openvpn []
06:17 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
06:29 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:29 -!- mode/#openvpn [+o mattock] by ChanServ
06:40 -!- f1assistance [~Carl@cpe-066-057-005-143.nc.res.rr.com] has quit [Ping timeout: 276 seconds]
06:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
07:13 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
07:16 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
07:16 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
07:16 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
07:25 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
07:45 -!- f1assistance [~Carl@cpe-066-057-005-143.nc.res.rr.com] has joined #openvpn
07:46 -!- APTX [APTX@phpBB/developer/APTX] has quit [Ping timeout: 248 seconds]
07:50 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
07:50 <@vpnHelper> RSS Update - forum: TXT_DB error number 2 <http://forums.openvpn.net/topic7985.html#p11510>
08:02 <@vpnHelper> RSS Update - forum: User Account Expire <http://forums.openvpn.net/topic8000.html>
08:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:12 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
08:20 -!- colision [logos@187.78.248.250] has quit [Ping timeout: 260 seconds]
08:29 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
08:56 <@vpnHelper> RSS Update - forum: slow between branch oficce and head office <http://forums.openvpn.net/topic8001.html>
08:57 -!- f1assistance [~Carl@cpe-066-057-005-143.nc.res.rr.com] has left #openvpn []
09:10 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:12 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Remote host closed the connection]
09:30 -!- Meliorator [m@dunnington.eu] has joined #openvpn
09:32 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
09:32 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:56 <@vpnHelper> RSS Update - forum: Client cannot connect. Session Expired <http://forums.openvpn.net/topic8002.html>
10:14 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
10:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:01 -!- contempt [~prank@host14-23-dynamic.25-79-r.retail.telecomitalia.it] has joined #openvpn
11:04 -!- luneff [~yury@84.51.192.6] has joined #openvpn
11:12 <@vpnHelper> RSS Update - forum: Changing which Public IP clients access the Internet from <http://forums.openvpn.net/topic8003.html>
11:53 <@vpnHelper> RSS Update - forum: Changing which Public IP clients access the Internet from <http://forums.openvpn.net/topic8003.html#p11515>
12:41 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
13:06 -!- TrendKi|| [~martin@67.69.227.99] has joined #openvpn
13:07 < TrendKi||> !welcome
13:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:07 < TrendKi||> !howto
13:07 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:26 < dkr> I really like this concept of self-help factoids.  on most of the freenode channels we manually trigger them for people asking questions
13:41 < ecrist> we're lazy
13:41 < ecrist> the less we have to do, the happier we are. ;)
13:45 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
13:48 -!- bjh4 [~bjh4@ool-18bbdf6a.static.optonline.net] has joined #openvpn
13:50  * Bushmills thought the same but was too lazy to type that out
13:50 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
13:51 < gladiatr> needs to be its own factiod
13:51 < gladiatr> s/iod/oid
14:00 < ecrist> !ask
14:00 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, or (#2) http://www.latinsud.com/answer/, or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
14:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:04 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
14:05 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Client Quit]
14:07 -!- newmember [~newmember@68.144.191.90] has joined #openvpn
14:14 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:16 < TrendKi||> I am trying to understand the purpose of the second IP address passed to the ifconfig option. I am running OpenVPN in server mode with tun devices, with client-to-client turned on and it seems to work regardless of the IP address I choose.  Is it irrelevant in the server-client mode model?
14:24 -!- TrendKi|| [~martin@67.69.227.99] has quit [Quit: Leaving.]
14:35 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:43 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Operation timed out]
14:44 -!- ShaneN [~ShaneNeue@host-121-159-111-24.midco.net] has joined #openvpn
14:46 < ShaneN> Hello. We recently switched our openvpn box to a different network and external IP address. Ever since, we haven't been able to connect in from outside of the network. Sounds like a firewall issue, but I have port 1194 (TCP, which we use for OpenVPN) set to forward. And we port 80 set to forward as well and that works perfectly fine. Any recommendations on how I can further debug this?
14:48 < dkr> ShaneN: you modified the client openvpn config to use the new ip also, right?  I'd look at logs on both server and client side, psosibly setting "verb 6" to get mroe details in the logs
14:50 < ShaneN> dkr: Yes, the client was updated to use the new IP. System log (ubuntu) wasn't showing the incoming request. The client side is the basic "TLS Error: TLS key negotiation failed to occur within 60 seconds" error
14:50 < ShaneN> I've been banging my head against the keyboard for the past 4 days trying to figure this out :)
14:50 < ShaneN> And, knowing me, it is probably something stupid simple
14:51 < dkr> ShaneN: you could try a tcptraceroute newip 1194 to verify your fw is forwrding it through to your openvpn server
14:51 < ShaneN> From the client?
14:51 < dkr> yeah, or just run wireshark or the like to watch the traffic arriving at firewall/server
14:55 < ShaneN> I'll give both a shot and see if I can figure something out. Thanks for the suggestion
15:18 -!- zeshoem [~mnathani@bas1-toronto46-1177856961.dsl.bell.ca] has joined #openvpn
15:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:40 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
15:55 -!- grendal_prime [~sgraham@71-154-139-57.ded.pacbell.net] has joined #openvpn
15:56 < grendal_prime> hey guys.
15:57 < grendal_prime> im looking at ways to loadbalance across openvpn processes.  Like i start up 20 instances each with a diff port, then run something like pen on 1194 and load ballance to the different ports.
15:57 < grendal_prime> that way i can limit connections to each instance to -200
15:58 < grendal_prime> since openvpn is not multi thread.
15:59 < grendal_prime> also can anyone recommend a connection simulator so i can load test my concoctions?
16:01 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
16:22 < zeshoem> Hello, I am having difficulty getting any traffic through my openvpn tunnel
16:23 < zeshoem> the session gets established, but I cant ping anything through it
16:23 < grendal_prime> you need to push it a route 
16:23 < grendal_prime> or bridge it
16:23 < grendal_prime> i would suggest the route
16:24 < zeshoem> in client conf
16:24 < zeshoem> or server conf?
16:24 < grendal_prime> connect another network to the same box...say 192.168.1.0 then look in the documentation about push route..  it would be on the server..
16:25 < zeshoem> I have a line like : push redirect-gateway def1
16:25 < zeshoem> and it used to work
16:25 < grendal_prime> thats different
16:26 < grendal_prime> you are forceing a new gateway on the client...that makes all there traffic by default go through your vpn server.
16:27 < grendal_prime> read this
16:27 < grendal_prime> http://www.openvpn.net/index.php/open-source/documentation/howto.html#scope
16:27 <@vpnHelper> Title: HOWTO (at www.openvpn.net)
16:27 < grendal_prime> example would be
16:27 < grendal_prime>     push "route 10.66.0.0 255.255.255.0"
16:28 < grendal_prime> lets the client know that to get to that subnet you are going to go through the vpn server.
16:29 < grendal_prime> you also probably need ipforwarding enabled on the machine ...you might want to look into iptables at this point as well so you can better control who gets access to what.
16:29 < grendal_prime> im out...
16:30 < zeshoem> thank you
16:34 -!- grendal_prime [~sgraham@71-154-139-57.ded.pacbell.net] has quit [Quit: Ex-Chat]
16:51 -!- HeXiLeD [~L3D@unaffiliated/hexiled] has quit [Quit: Lost terminal]
16:56 -!- oirad [~cyberspac@sign.io] has joined #openvpn
16:58 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:19 -!- oirad [~cyberspac@sign.io] has quit [Quit: leaving]
17:20 -!- cyberspace [~cyberspac@sign.io] has joined #openvpn
17:27 -!- contempt [~prank@host14-23-dynamic.25-79-r.retail.telecomitalia.it] has quit [Changing host]
17:27 -!- contempt [~prank@unaffiliated/contempt] has joined #openvpn
17:29 -!- cyberspace [~cyberspac@sign.io] has left #openvpn []
17:29 -!- contempt [~prank@unaffiliated/contempt] has quit []
17:31 -!- contempt [~prank@host14-23-dynamic.25-79-r.retail.telecomitalia.it] has joined #openvpn
17:31 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:32 -!- contempt [~prank@host14-23-dynamic.25-79-r.retail.telecomitalia.it] has quit [Changing host]
17:32 -!- contempt [~prank@unaffiliated/contempt] has joined #openvpn
17:33 -!- varta [~varta@unaffiliated/contempt] has joined #openvpn
17:39 <@vpnHelper> RSS Update - forum: Help with Tun Tap? <http://forums.openvpn.net/topic8004.html>
17:42 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
17:46 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:03 <@vpnHelper> RSS Update - forum: Help with Tun Tap? <http://forums.openvpn.net/topic8004.html#p11517>
18:04 -!- varta [~varta@unaffiliated/contempt] has quit [Quit: leaving]
18:05 -!- varta [~varta@unaffiliated/contempt] has joined #openvpn
18:08 -!- contempt [~prank@unaffiliated/contempt] has quit [Ping timeout: 250 seconds]
18:08 -!- contempt [~prank@host151-154-dynamic.21-79-r.retail.telecomitalia.it] has joined #openvpn
18:13 -!- contempt [~prank@host151-154-dynamic.21-79-r.retail.telecomitalia.it] has quit [Ping timeout: 250 seconds]
18:14 -!- contempt [~prank@host70-154-dynamic.21-79-r.retail.telecomitalia.it] has joined #openvpn
18:14 < echoSMILE> hello. I config openvpn before, and now I want add more one user to give access over vpn. So, I execute ./vars and then I try execute ./build-key otheruser, but I get some alert saying to execute ./vars and ./clean-all. But I want the new user use the same server config's (CA,...), ./clean-all will not delete all that stuff?
18:15 <@vpnHelper> RSS Update - forum: Help with Tun Tap? <http://forums.openvpn.net/topic8004.html#p11518>
18:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
18:27 -!- varta is now known as varta_
18:28 -!- varta_ is now known as varta
18:29 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:00 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
19:00 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
19:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:11 -!- varta [~varta@unaffiliated/contempt] has quit [Quit: leaving]
19:12 -!- varta [~varta@unaffiliated/contempt] has joined #openvpn
19:12 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
19:14 < krzee> echoSMILE, you cant just type ./vars
19:14 < krzee> you need to SOURCE it, aka . ./vars
19:14 < krzee> that leading dot does a lot ;)
19:14 < echoSMILE> yeah
19:14 < echoSMILE> i see it after :P
19:14 < krzee> you dont execute vars, you read it into your shell (source it)
19:14 < krzee> ahh ok =]
19:15 < echoSMILE> one question, imagine i want deny acess in the future for some user
19:15 < krzee> !crl
19:15 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
19:15 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
19:15 < echoSMILE> what i do from server side?
19:15 < echoSMILE> ok.
19:16 < krzee> however
19:16 < krzee> lets say you dont want to do it forever
19:16 < krzee> maybe you want to block them sometimes, and remove the block sometimes
19:16 < krzee> (i do this with software support for a program we use)
19:17 < krzee> in THAT situation you would give the user a ccd entry with --disable
19:17 < krzee> if the key is compromised or the person was fired, or something else permanent, you use a CRL
19:17 < echoSMILE> so, i should stay inside easy-rsa/keys all stuff for future management?
19:17 < krzee> yes, do not delete that stuff
19:18 < echoSMILE> ohhh.. my mistake number 1
19:18 < krzee> you will need certain files from there to make a CRL
19:18 < krzee> like the index, the csr
19:18 < krzee> but also, best security practice would say the CA should not be on the server
19:18 < krzee> personally my CA machine doesnt even have a route to the internet
19:19 < krzee> your ca.key is the cornerstone of your PKI
19:19 < echoSMILE> but openvpn dont use it directly right? that is only to generate stuff, and when i want to manage users,etc i copy files and restart server?
19:20 < krzee> you merged a few questions together there
19:20 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
19:20 < krzee> cert generation can happen on any machine, openvpn does not need to run on the CA, and best security practices would dictate that it *should* not
19:21 < echoSMILE> yep i get it.
19:21 < krzee> when you want to add users, you do nothing special on the server (in most setups)
19:21 < krzee> you just give them a key signed by the correct ca.key
19:21 < krzee> err a cert
19:22 < krzee> your server will be able to see it was signed by the right ca, it doesnt need to be told about the user
19:22 < krzee> however, if you want to REVOKE a users cert, you must make a CRL on your CA machine, give it to the server, and make sure you are using it with --crl-verify
19:22 < echoSMILE> sure, but to deny access, some file need to be changed on server, right
19:22 < echoSMILE> hum. ok
19:22 < krzee> this *could* require a restart on the server the very first time
19:22 < krzee> assuming you arent currently using --crl-verify
19:23 < krzee> once you ARE using it, you would just replace the CRL file
19:23 < krzee> because it is read each time a user connects
19:24 < echoSMILE> that parameter --crl-verify is used when I build CA?
19:24 < krzee> !crl
19:24 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
19:24 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
19:24 < krzee> read that again
19:25 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
19:26 < echoSMILE> revoke-full script, ok.
19:27 < echoSMILE> to be honest, all keys management is not perfectly understood, that why this basic question come up
19:27 < echoSMILE> i need test stuff instead only just put vpn working and nothing more.
19:28 < echoSMILE> krzee: tks for your time.
19:28 < krzee> you're welcome
19:28 < krzee> it is called PKI if you wanna google how it works
19:28 < krzee> its similar to how web ssl works, except that you are also the CA
19:28 < echoSMILE> yep.
19:47 -!- echoSMIL1 [~censured@bl17-112-146.dsl.telepac.pt] has joined #openvpn
19:50 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 260 seconds]
19:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
19:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:00 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Quit: Távozom]
20:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:03 -!- contempt [~prank@host70-154-dynamic.21-79-r.retail.telecomitalia.it] has left #openvpn []
20:05 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:06 -!- master_of_master [~master_of@p57B55C16.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:07 -!- yell0 [yello@unaffiliated/contempt] has quit [Quit: leaving]
20:08 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
20:09 -!- master_of_master [~master_of@p57B55F05.dip.t-dialin.net] has joined #openvpn
20:46 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
20:51 < Splex> how do i get packets from one openvpn process to route to another openvpn process (tun0 - tun1)?  I think i have the routing table set up right and i have also enabled ip forwarding..  is there something else i need to do?
21:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:28 < krzee> Splex, are they clients?
21:28 < krzee> or servers
21:28 < krzee> (or one of each...)
21:29 -!- colision [logos@187.78.247.111] has joined #openvpn
21:30 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:35 < Splex> krzee: i have a server (A) which i want to act as a router, it is connected to another openvpn server (B), server A is running two processes of openvpn, one to connect to server B and one to allow clients to connect.  I want clients of A to be able to connect to B
21:35 < Splex> 'A' is able to ping its clients as well as 'B'
21:35 < krzee> i only care about the machine running 2 instances of openvpn
21:35 < Splex> ok
21:35 < Splex> that is 'A'
21:35 < krzee> one is a server, one is a client, right?
21:36 < Splex> correct
21:36 < krzee> remember that ANYTHING behind a client is basically a "lan behind openvpn"
21:36 < krzee> any foreign subnet
21:36 < krzee> then read this:
21:36 < krzee> !route
21:36 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:37 < krzee> you likely didnt do the iroute stuff, and have a lot of MULTI errors on server B's logfile
21:37 < krzee> !iroute
21:37 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
21:37 < Splex> i set up iroute
21:37 < krzee> did you thoroughly read my writeup?
21:37 < krzee> (NOT SKIM)
21:39 < Splex> i will look at it again, i have looked over that page before, it has been working great... but im not sure why server B keeps pushing the subnet for A to server A...  im wondering if openvpn has issues with commonnames containing a hyphen?
21:39 < Splex> my ccd file has a hyphen in the name
21:39 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
21:40 < Splex> i have manually adjusted the routing tables so far.. (removed the route that is pushed to 'A')
21:40 < krzee> you can see if the ccd file is being read or not when the client connects, in the log file
21:40 < krzee> in the servers logfile
21:40 < krzee> you would also see the iroute's get added at that time
21:40 < Splex> it seems like it is not being read..
21:41 < Splex> even though the file matches the commonname of the incoming connection
21:41 < Splex> for other clients it works
21:41 < krzee> you gunna guess or check the log?
21:41 < Splex> i did chekc the log already
21:41 < Splex> s/chekc/check
21:41 -!- rasengan [~rasengan@unaffiliated/rasengan] has left #openvpn []
21:41 < krzee> post the log to pastebin with verb 4
21:42 < Splex> ok, moment
21:44 < Splex> krzee: btw, what should the permissions be for the certs and certs dir?
21:45 < krzee> in my opinion, only readable by root, with persist-tun and persist-key options set
21:46 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
21:46 < krzee> it all depends on if you drop permissions...
21:47 < colision> mine is readable by _openvpn user/group
21:47 < Splex> krzee: the process switches to nobody, just noticed i couldn't SIGHUP the process
21:47 < krzee> if you do drop permissions, make sure the lower level user can read the ccd files and that it has +x on the dir
21:47 < Splex> since it couldn't read the keys
21:47 < krzee> thats what persist-tun and persist-key are for :-p
21:47 < Splex> i have them set.. strange that i got the error then
21:49 < krzee> ok then
21:49 < krzee> i never send sighup
21:49 < krzee> nor any other signals
21:49 < krzee> i just start, and stop
21:49 < krzee> so im not the most familiar with the different signals
21:49 < Splex> i think because it rereads the config (and keys) with HUP
21:50 < Splex> makes sense, guess HUP won't work if the permissions are not there for the running process
21:51 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:51 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:54 < Splex> krzee: thanks for the tip to use verb4, the ccd is working after resolving the permission errors
21:55 < krzee> =] np
21:55 < Splex> also, i noticed when i ping 'B' from a client on 'A', the 'B' verbose 4 logs show packet dropped messages
21:55 < Splex> MULTI: bad source address from client [ip], packet dropped
21:55 < krzee> [19:36]  <krzee> you likely didnt do the iroute stuff, and have a lot of MULTI errors on server B's logfile
21:55 < krzee> ;]
21:56 < Splex> yes, apparently i messed up somewhere.. of course
21:57 < krzee> you did the iroute stuff, but openvpn didnt know, but i did call the MULTI errors!
21:58 < Splex> 'B' does have a route for the subnet on 'A'
22:20 -!- K1ng [~KING@119.30.39.47] has joined #openvpn
22:43 < Splex> krzee: im not sure exactly what option fixed my problem, but it seems to be working now.  i didn't modify my existing iroute/route settings.  I had them configured correctly per your wiki page all along
22:44 < Splex> (very useful page, btw.. used it a while before, thanks!)
22:45 < Splex> would a 'tls-remote' and 'ns-cert-type server' make any difference in this problem?
22:47 < krzee> you're welcome =]
22:47 < krzee> i know what fixed it, you made it read the ccd file
22:47 < krzee> it didnt have the iroute
22:47 < krzee> which is why a) you got the multi errors  b) why it pushed the route to that client
22:48 < Splex> that part, i didn't change at all in the config
22:48 < Splex> the file was there all along
22:48 < krzee> correct
22:48 < Splex> the directive was there all along
22:48 < krzee> but making the file readable was the difference
22:48 < krzee> without reading the file, the iroute actually didnt exist to openvpn
22:48 < krzee> once you fixed the permission and it could read the file, it was fixed
22:48 < krzee> because if it cant read the file, it cant know you have an iroute in there
22:49 < krzee> so it was the same as not having iroute in there
22:49 < krzee> it was the same as not even having the ccd file
22:49 < Splex> the ccd dir/files were 644 all along
22:49 < Splex> the only perms i changed were the key files
22:49 < krzee> you said you fixed a permission issue
22:49 < krzee> well thats weird then
22:49 < krzee> you said you had the MULTI errors
22:50 < krzee> so i know it was the iroute thing
22:50 < krzee> plus you mentioned the route was being pushed
22:50 < Splex> right
22:50 < Splex> i know it wasn't considering the ccd for that client..
22:50 < krzee> well, either way, you fixed something and got it reading ccd
22:50 < Splex> it could have been a client issue?
22:50 < krzee> no
22:50 < Splex> client config wouldn't affect that?
22:54 < jeev> weird question, would it be possible to entirely turn off encryption and turn it into just a tunnel ?
22:55 < Splex> jeev: set cipher to none?
22:55 < Splex> look at --cipher in the man page
22:56 < Splex> 'Set alg=none to disable encryption.'
22:59 < colision> jeev, just for curisity, why would you disable encryption?
22:59 < krzee> jeev, if you want that use GRE tunnels
22:59 < krzee> openvpn will be an unnecessary bottleneck
23:10 < krzee> but yes, it is possible
23:28 <@vpnHelper> RSS Update - forum: static IP for auth-pam or mysql auth <http://forums.openvpn.net/topic8005.html>
23:38 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
23:54 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 252 seconds]
--- Day changed Tue Apr 26 2011
00:02 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 248 seconds]
00:07 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
00:10 < jeev> was just curious
00:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:16 <@vpnHelper> RSS Update - forum: Migrating to new server <http://forums.openvpn.net/topic8006.html>
00:33 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
00:53 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
00:54 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:54 -!- mode/#openvpn [+o mattock] by ChanServ
01:15 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:16 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
01:22 -!- nb [~nb@fedora/nb] has joined #openvpn
01:27 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
01:40 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
01:45 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
01:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:55 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
01:57 <@vpnHelper> RSS Update - forum: slow between branch oficce and head office <http://forums.openvpn.net/topic8001.html#p11522> || Migrating to new server <http://forums.openvpn.net/topic8006.html#p11521>
02:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
02:01 -!- twister004__ [~chatzilla@59.90.34.167] has joined #openvpn
02:03 <@vpnHelper> RSS Update - forum: User Account Expire <http://forums.openvpn.net/topic8000.html#p11523>
02:03 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 260 seconds]
02:03 -!- twister004__ is now known as twister004
02:09 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:16 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Quit: Yippee-kay-yay]
02:19 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
02:56 -!- dazo_afk is now known as dazo
02:59 -!- ph1l [~ph1l@178.196.226.169] has quit [Quit: ph1l]
03:00 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Read error: Operation timed out]
03:10 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
03:10 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
03:10 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:12 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
03:33 -!- ph1l [~ph1l@gprs05.swisscom-mobile.ch] has joined #openvpn
03:34 -!- colision [logos@187.78.247.111] has quit [Ping timeout: 260 seconds]
03:43 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:43 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:43 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:15 <@vpnHelper> RSS Update - forum: Linux Tap device 10Mbit <http://forums.openvpn.net/topic7535.html#p11525> || Adapter Speed <http://forums.openvpn.net/topic7066.html#p11524> || Windows File Shares Unreachable via OpenVPN <http://forums.openvpn.net/topic7963.html#p11334>
04:20 <@vpnHelper> RSS Update - forum: TXT_DB error number 2 <http://forums.openvpn.net/topic7985.html#p11526>
04:21 -!- ph1l [~ph1l@gprs05.swisscom-mobile.ch] has quit [Ping timeout: 240 seconds]
04:25 -!- thm [955c577525@fedora/thm] has joined #openvpn
04:25 < thm> !welcome
04:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:25 <@vpnHelper> RSS Update - forum: static IP for auth-pam or mysql auth <http://forums.openvpn.net/topic8005.html#p11527>
04:27 < thm> so, even after reading these old mailing list entries from 2005, it is unclear for me whether it is possible to send/receive smaller packages wihtout modifying the server's configuration, only the client's
04:29 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:29 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:29 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:32 < thm> cause I see this in the log: "openvpn[1413]: NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1445]"
04:36 < janjust> thm: I just dropped in; what are you testing? looks like you need to tweak some mtu settings
04:36 <@vpnHelper> RSS Update - forum: How to receive a mail on client connection and disconnecti ? <http://forums.openvpn.net/topic7974.html#p11529> || Some ciphers not working with OpenVPN <http://forums.openvpn.net/topic8007.html>
04:38 -!- ph1l [~ph1l@gprs15.swisscom-mobile.ch] has joined #openvpn
04:38 < thm> janjust: I see (or better, I feel, didn't measure) bad performance connecting to our company's openvpn, but only at a certain provider
04:38 < thm> so I enabled mtu-test and got the above message
04:39 < thm> now, what to do with that?
04:39 < janjust> is this in UDP or in TCP mode?
04:39 < thm> udp
04:39 < janjust> for udp mode I'd suggest to add 'fragment 1400' to both client and server configs
04:39 < janjust> or, if you've got non-windows server+clients, use 'tun-mtu 1400'
04:40 < thm> we've got both, win and linux clients
04:40 < janjust> then try 'fragment 1400' (perhaps add 'mssfix' as well; YMMV)
04:40 < thm> is there a way improving something for me now, without changing server's config?
04:41 < thm> because that needs talking to the others, downtime, testing, etc... yada yada
04:45 < thm> and will setting fragment 1400 decrease performance for the other users?
04:46 <@vpnHelper> RSS Update - forum: Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11530>
04:47 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:47 < janjust> it might/will affect performance for the others
04:48 < thm> so, no way doing that unilateraly?
04:51 < janjust> as far as I can tell : no
04:51 < janjust> the 'fragment' parameter does not need to be the same on both ends, but *some* fragment parameter needs to be specified
04:58 -!- Blues-Man [~bluesman@188.11.17.81] has joined #openvpn
04:59 < thm> hm, ok. would it be also good/wise to enable mtu-disc on both ends?
04:59 -!- jpalmer [~jpalmer@about/windows/regular/jpalmer] has quit [Changing host]
04:59 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has joined #openvpn
05:01 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
05:04 -!- ph1l [~ph1l@gprs15.swisscom-mobile.ch] has quit [Quit: ph1l]
05:15 <@vpnHelper> RSS Update - forum: Some ciphers not working with OpenVPN <http://forums.openvpn.net/topic8007.html#p11531>
05:16 < janjust> (back again) 
05:16 < |Mike|> some ciphers?
05:16 < |Mike|> wb janjust 
05:17 < janjust> thm: mtu-disc is enabled by default, is it not?
05:17 < janjust> |Mike|:  yes, see TRAC report 89: most OFB and CFB based ciphers fail 
05:17 < janjust> only CBC based ciphers seem to work reliably in openvpj
05:18 < janjust> vpj->vpn
05:18 < |Mike|> hmm
05:19 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
05:21 -!- K1ng [~KING@119.30.39.47] has quit [Ping timeout: 246 seconds]
05:22 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has joined #openvpn
05:27 <@vpnHelper> RSS Update - forum: Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11532>
05:33 <@vpnHelper> RSS Update - forum: 2 Users Causes disconnects <http://forums.openvpn.net/topic8008.html#p11534>
05:42 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
05:43 -!- rkantos [robin@hp1.jaketus.net] has quit [Remote host closed the connection]
05:44 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
05:45 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Remote host closed the connection]
05:51 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:51 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:51 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:56 <@vpnHelper> RSS Update - forum: 2 Users Causes disconnects <http://forums.openvpn.net/topic8008.html#p11536> || Some ciphers not working with OpenVPN <http://forums.openvpn.net/topic8007.html#p11535>
06:23 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
06:25 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Operation timed out]
06:31 -!- Blues-Man [~bluesman@188.11.17.81] has quit [Quit: Sto andando via]
06:31 -!- K1ng [~KING@180.211.188.69] has joined #openvpn
06:42 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
06:44 <@vpnHelper> RSS Update - forum: Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11537>
07:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:16 -!- luneff [~yury@84.51.192.6] has joined #openvpn
07:55 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
07:55 < MarKsaitis> hi
07:56 < MarKsaitis> I have an openvpn warrior setup here. One day so it happened that when I try to connect with my openvpn client, it started to ask me for a password. What is the password? I never set it up
07:56 < ecrist> how are we supposed to know?
07:58 < MarKsaitis> well, if somebody would tell me what kind of password openvpn could require?
07:59 <@dazo> MarKsaitis: that depends on your config
07:59 <@dazo> (hence ecrist's question)
08:00 < MarKsaitis> dazo, well, my config is simple, no passwords configured just plain simple openssl server and plain simple clients. server has its own certs and clients have their own certs
08:01 <@dazo> MarKsaitis: I'll be explicit ... did you read the greeting message when you joined this channel?
08:01 <@dazo> !welcome
08:01 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:02 < MarKsaitis> ok sorry dazo :)
08:04 <@dazo> no worries :)
08:06 <@vpnHelper> RSS Update - forum: Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11538>
08:09 < MarKsaitis> dazo, do u have any idea why openvpn client would not resolve one subdomain, but the same OS its running on resolves it fine?
08:10 <@dazo> MarKsaitis: nope, not really ... sounds like a misconfiguration somewhere
08:10 < MarKsaitis> hmz
08:12 <@dazo> MarKsaitis: try using the host, nslookup or dig commands to figure out if the DNS is setup correctly ... and that your troublesome client uses the proper DNS
08:12 < MarKsaitis> how do i know what DNS my client uses?
08:12 < MarKsaitis> does he not use the one OS uses?
08:13 < MarKsaitis> nslookup works fine on that subdomain
08:14 < MarKsaitis> On our network with its own DNS, I set these records myself
08:15 < MarKsaitis> so, same subdomain works when used in internet explorer, works when u nslookup it, but openvpn client says that it is not found
08:15 < MarKsaitis> Tue Apr 26 14:15:01 2011 RESOLVE: Cannot resolve host address:
08:16 < MarKsaitis> Question 2: You know when u setup certs for clients, and it asks a challenge password? Is that ever used anywhere?
08:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:22 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Read error: Connection reset by peer]
08:23 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
08:23 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 246 seconds]
08:25 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
08:27 < ecrist> MarKsaitis: yes, every time the key is used
08:33 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
08:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:37 < MarKsaitis> ecrist, dazo, auth-nocache seemed to help me. It seems that computer has been using other software to do with certs too, but I have no idea how could this mixed up
08:43 < ecrist> neither do we
08:48 <@vpnHelper> RSS Update - forum: Migrating to new server <http://forums.openvpn.net/topic8006.html#p11540> || New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html>
09:00 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11541>
09:12 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11542>
09:18 <@vpnHelper> RSS Update - forum: Throttle VPN connection? <http://forums.openvpn.net/topic8010.html>
09:18 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:22 -!- mutilator [muti@2607:fbd0:11:1:b077:ed72:551b:7e58] has joined #openvpn
09:23 < mutilator> hola everyone, got an issue here.. i've got a bridge vpn setup, the itnerfaces are up, the bridge connects, i can see tx/rx on both sides being increments
09:23 < mutilator> but getting no responses
09:23 < mutilator> if i ping from the server side to the ip on the client side tap interface i get nothing
09:23 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11544>
09:23 < mutilator> and likewise when i ping from the client side to the bridge ip address i get nothing
09:25 < mutilator> as the first rule for INPUT & OUTPUT on the client side i have accept anything to/from the tap interface
09:25 < mutilator> and the server side just allows everything
09:25 -!- Meliorator [m@dunnington.eu] has quit [Ping timeout: 276 seconds]
09:27 -!- grendal_prime [~sgraham@71-154-139-57.ded.pacbell.net] has joined #openvpn
09:28 < grendal_prime> ok i have configured pen to rr connections to three instances of openvpn.  seems to work fine..but...if i kill off one of the instances, the client does not reconnect..whats up with that.?
09:29 <@vpnHelper> RSS Update - forum: Throttle VPN connection? <http://forums.openvpn.net/topic8010.html#p11545>
09:34 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11546>
09:40 <@vpnHelper> RSS Update - forum: slow between branch oficce and head office <http://forums.openvpn.net/topic8001.html#p11547>
09:43 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
09:58 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11548>
10:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:04 <@vpnHelper> RSS Update - forum: slow between branch oficce and head office <http://forums.openvpn.net/topic8001.html#p11549>
10:04 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:10 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:10 <@vpnHelper> RSS Update - forum: Working Appliance, need to configure router <http://forums.openvpn.net/topic7671.html#p11550>
10:12 -!- CharlieSu [~CharlieSu@ec2-174-129-218-86.compute-1.amazonaws.com] has joined #openvpn
10:15 < CharlieSu> Qeustion about Routing.  I have a OVPN server that a bunch of computers connect to on 10.8.0.0/24 and I have another computer on the same network as my ovpn server but it isn't on the 10.8.0.0/24 subnet.  How can I have it connect to the ovpn clients?  
10:16 <@vpnHelper> RSS Update - forum: Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11552> || New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11551>
10:18 < gladiatr> CharlieSu, on the default router of your server-side system, you will need to add a route to the 10.8.0.0/24 subnet with the openvpn server IP as the gateway
10:18 < grendal_prime> establish routing between the  two networks...wiith...ya what he just said
10:19 < grendal_prime> set the server to allow routiing then push a route to the clients.
10:19 < CharlieSu> Let me rewrite my situation
10:19 < CharlieSu> Hi.  I have a main Zabbix server and another server that is an OpenVPN server.   The OpenVPN server has a subnet w/ remote clients connected to it.  What is the best way for me to have the ZAbbix server monitor the openvpn clients?  Special routing rules or can I install something special on  the OpenVPN server that checks that hosts and forwards that information off to my master OVPN server?
10:20 < grendal_prime> gladiatr, i have 4 clients connecting to one openvpn box that has 3 openvpn server instcances running on it.  port 1195 is load ballanced to these three servers that are running on 1194 1193 1192
10:20 < CharlieSu> I think I understand what yall said.  Do I need to tell my Zabbix server to route all traffic for the 10.8.0.0/24 requests through the OpenVPN server?  Sounds like it..   One thing I don't understand though is if I need to do anything on my openVPn Server to make it so that the Zabbix server isa ble to do that?
10:21 < gladiatr> CharlieSu, on the default router of your server-side system, you will need to add a route to the 10.8.0.0/24 subnet with the openvpn server IP as the gateway
10:22 < CharlieSu> gladiatr: ok.. does anythign special need to be done on the ovpn server to accomodate that?
10:22 <@vpnHelper> RSS Update - forum: Good Ports to use in Blocked Countries? <http://forums.openvpn.net/topic8011.html>
10:22 < gladiatr> It doesn't matter what the machine's role is.  If any machine on your openvpn-server-side network needs to communicate with the 10.8.0.0/24 network, there has to be a route telling it where to go.  The most common spot to install this route is on the subnet's gateway system.  If you really want to restrict it to one host, you can add a network route on your zabbix server
10:23 < CharlieSu> gladiatr: here is my network info
10:23 < CharlieSu> https://gist.github.com/cec5e812b905b908aa33
10:23 <@vpnHelper> Title: CharlieSu's gist: cec5e812b905b908aa33 Gist (at gist.github.com)
10:25 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Operation timed out]
10:25 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:25 < CharlieSu> gladiatr: would I do something like this on my zabbix server? route add 10.8.0.0/24 gw 10.97.39.177 eth0   
10:25 < gladiatr> Ok.  So the zabbix system is not actually on the same subnet as the openvpn server.
10:25 < gladiatr> no
10:26 < CharlieSu> gladiatr: well i think the zabbix system and openvpn are on the same network.. just not the same subnet.. 
10:26 < gladiatr> You need to add a static route to 10.97.38.1
10:27 < gladiatr> I'm not following you
10:27 < CharlieSu> gladiatr: they're both on Ec2..  
10:27 < gladiatr> Gotcha.  Well, for the sake of this conversation, network = subnet
10:27 < CharlieSu> ok
10:27 < CharlieSu> so how do i do the static route?  Also, thanks for your help
10:29 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
10:29 < gladiatr> Personally I think this calls for an additional openvpn link between the two systems.  I don't play in the clouds myself, so I'm not sure what options you have for manipulating how subnets are assigned and whatnot.
10:29 < CharlieSu> gladiatr: i was wondering the same thing..  so the zabbix server needs to connect to the openvpn server on a different subnet?
10:29 < CharlieSu> then I can link them?
10:30 < gladiatr> Another option would be to just make the zabbix server an openvpn client
10:30 < gladiatr> Actually, unless you have some outstanding reason not to, that would probably be the easiest solution.
10:30 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:30 < gladiatr> Do you have client-to-client communication enabled for your vpn?
10:30 < CharlieSu> gladiatr: yes..  then i'd just need to make the clients able to communicate with one another tho right?
10:30 < CharlieSu> i don't right now..  i'm going to try that tho. 
10:31 < gladiatr> If you need to prevent c2c traffic, I'd go with the additional tunnel.  As you suggested, this would be an additional subnet attached to the vpn server.  
10:34 < grendal_prime> ya if you set up c2c then you could just give the zabbix server a ovpn connection and wham your done.  Problem is..you probably dont want the others to see one another.
10:34 < grendal_prime> so in that case you are going to need to set up another network..(could be another openvpn server actually) and allow routing between the two networks, then push a route to the openvpn clients you want to monitor.
10:37 < CharlieSu> grendal_prime: yeah i may just make my zabbix server a openvpn server as well
10:38 < grendal_prime> hmmm well ok...but you could just run a seperate instance on the original server.
10:39 < grendal_prime> but honestly its pretty common to push the route... i mean eventually you are going to need to connect those vpned connections to something...
10:39 < gladiatr> grendal_prime, that doesn't solve the problem of the zabbix server being able to communicate with the vpn clients individually
10:40 < grendal_prime> they are not just going to connect so they can connect...you have to establish a route for them..to your internal network... at that point, you just put your zabbix box on that same network
10:40 < gladiatr> grendal_prime, on ec2 there is no internal network.  
10:41 < gladiatr> that's the whole insidious glory of cloud computing :P
10:41 < grendal_prime> i must have missed something
10:42 < CharlieSu> hehe
10:42 < grendal_prime> soo the zabbix server needs to connect to the same server as the vpn clients...but its not a physical network..so set up a second vpn (process) on the same vpn server on port 1195
10:42 < gladiatr> If you look at the network configurations CharlieSu posted, you'll see that the openvpn server isn't on the same subnet as the zabbix server.  
10:43 < grendal_prime> then allow routing between the two networks... like 10.8.0.0 and 10.8.1.0 
10:43 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
10:43 < grendal_prime> no c2c needed then
10:43 < grendal_prime> we do that all the time
10:43 < gladiatr> yar
10:44 < CharlieSu> so what are you saying I should do?
10:45 < grendal_prime> push route to 10.8.0.0 network  and  push route to 10.8.1.0 network.
10:46 < CharlieSu> grendal_prime: would you be able to expand on that for me?  I'm a networking newb..  
10:46 < grendal_prime> you could do nat as well with some iptables (wich is probably best anyway when you start figureing in collision and broadcast domains)  
10:47 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:49 <@vpnHelper> RSS Update - forum: Ping Problem <http://forums.openvpn.net/topic7966.html#p11555> || protocol <http://forums.openvpn.net/topic8012.html>
10:49 < grendal_prime> i can give you some server configs
10:49 < CharlieSu> haha yeah that would be helpful 
10:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:50 < grendal_prime> sooo ok to start out with..get a second vpn server going.
10:53 < grendal_prime> you are sure bitting off a lot for someone new to networking.
11:02 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 276 seconds]
11:05 < CharlieSu> i'm not that new..  i've just avoided networking 
11:16 < ecrist> so, new
11:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:36 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
11:38 -!- ShaneN [~ShaneNeue@host-121-159-111-24.midco.net] has quit [Read error: Connection reset by peer]
11:40 < catsup> can i use openvpn to tunnel IP over a TCP connection?
11:41 < catsup> oops, nevermind, i found the answer in the documentation
11:59 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has quit [Quit: ph1l]
12:00 -!- dazo is now known as dazo_afk
12:03 -!- gyyrog [~gyyrog@66-227-128-186.dhcp.trcy.mi.charter.com] has joined #openvpn
12:07 -!- gyyrog [~gyyrog@66-227-128-186.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:09 -!- gyyrog [~gyyrog@66.227.128.186] has joined #openvpn
12:09 -!- gyyrog [~gyyrog@66.227.128.186] has quit [Remote host closed the connection]
12:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:16 -!- newmember [~newmember@68.144.191.90] has quit [Ping timeout: 260 seconds]
12:22 <@vpnHelper> RSS Update - forum: slow between branch oficce and head office <http://forums.openvpn.net/topic8001.html#p11556>
12:27 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
13:04 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
13:05 -!- Netsplit *.net <-> *.split quits: krzee, grendal_prime, Splex, JPeterson, Clete2, UnterPerro
13:05 -!- JPeterso2 is now known as JPeterson
13:05 -!- Netsplit over, joins: UnterPerro
13:07 -!- Netsplit over, joins: krzee
13:08 -!- Splex [~splex@n220246241116.netvigator.com] has joined #openvpn
13:08 -!- Splex [~splex@n220246241116.netvigator.com] has quit [Changing host]
13:08 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
13:10 -!- Netsplit over, joins: Clete2
13:11 -!- grendal_prime [~sgraham@71-154-139-57.ded.pacbell.net] has joined #openvpn
13:11 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
13:12 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:27 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
14:02 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
14:10 -!- grendal_prime [~sgraham@71-154-139-57.ded.pacbell.net] has quit [Quit: Ex-Chat]
14:10 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:23 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
14:32 -!- luneff [~yury@84.51.192.6] has quit [Ping timeout: 250 seconds]
14:42 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
14:51 -!- harlan [~harlan@ntp/programmemanager/harlan] has joined #openvpn
14:53 < harlan> Got a problem with 2.0.9 and 2.1.4 on a windows 7/starter box - the "route add" is failing because of lack of priv.  I have already set openvpn and openvpn-gui to run as administrator, and done the "route-method exe" (or whatever) thing, and in 2.1.4 done the "script-security 2 system" thing.  Still no luck.
14:57 < harlan> It works fine if the user is an admin, but we don't want to have the user run with admin privs...
15:13 -!- K1ng [~KING@180.211.188.69] has quit [Ping timeout: 263 seconds]
15:13 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has quit [Ping timeout: 248 seconds]
15:18 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
15:38 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has joined #openvpn
16:05 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Ping timeout: 240 seconds]
16:15 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:17 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
16:22 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
16:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:55 -!- takamichi [~pri@46.11.14.68] has quit [Ping timeout: 248 seconds]
16:55 -!- takamichi [~pri@83.170.109.106] has joined #openvpn
17:01 -!- takamichi [~pri@83.170.109.106] has quit [Ping timeout: 252 seconds]
17:01 -!- takamichi [Takamichi@46.11.14.68] has joined #openvpn
17:05 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Remote host closed the connection]
17:07 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
17:09 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
17:09 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
17:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:12 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
17:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
17:17 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
17:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:31 < pwrcycle> how do you force dns requests to go through the vpn on linux?
17:40 < krzee> !pushdns
17:40 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
17:40 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
17:40 < krzee> note #4
17:42 < pwrcycle> krzee: i have dhcp-option DNS 4.2.2.1 in my server config but tcpdumping i never see the request
17:42 < pwrcycle> i have manually set my namerserver in my resolve.conf on this linux box.
17:42 < pwrcycle> so i'm guessing the dhcp option isn't being respected.
17:45 < pwrcycle> is there a way to get the client to use the new dns only with client or server config options?
17:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:22 -!- vpnvpn [8a05f136@gateway/web/freenode/ip.138.5.241.54] has joined #openvpn
18:22 < vpnvpn> !portforward
18:24 < krzee> [15:42]  <pwrcycle> so i'm guessing the dhcp option isn't being respected.
18:24 < krzee> well of course
18:24 < krzee> my bot told you why
18:25 < krzee> you need an external script in unix for that
18:28 < krzee> vpnvpn, what are you looking for?
18:29 -!- takamichi [Takamichi@46.11.14.68] has quit [Ping timeout: 276 seconds]
18:29 -!- takamichi [Takamichi@46.11.14.68] has joined #openvpn
18:32 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:36 -!- vpnvpn [8a05f136@gateway/web/freenode/ip.138.5.241.54] has quit [Quit: Page closed]
18:40 < pwrcycle> krzee: what does register-dns do on a windows box?
18:41 < pwrcycle> is there any difference on DNS if you use tap instead of tun?
18:42 < krzee> !man
18:42 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
18:42 < krzee> and no
18:42 < pwrcycle> :)
19:06 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 264 seconds]
19:16 -!- mutilator [muti@2607:fbd0:11:1:b077:ed72:551b:7e58] has quit [Read error: Connection reset by peer]
19:16 -!- mutil [muti@2607:fbd0:11:1:b077:ed72:551b:7e58] has joined #openvpn
19:18 -!- mutil is now known as mutilator
19:56 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
19:57 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:03 -!- varta [~varta@unaffiliated/contempt] has quit [Quit: leaving]
20:05 -!- varta [~varta@unaffiliated/contempt] has joined #openvpn
20:08 -!- master_of_master [~master_of@p57B55F05.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:10 -!- master_of_master [~master_of@p57B55B5D.dip.t-dialin.net] has joined #openvpn
20:10 -!- varta [~varta@unaffiliated/contempt] has quit [Quit: leaving]
20:12 -!- varta [~varta@unaffiliated/contempt] has joined #openvpn
20:14 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
20:51 < ecrist> mew
20:51 <@vpnHelper> RSS Update - forum: How can build Server VPN <http://forums.openvpn.net/topic8013.html>
20:53 -!- luneff [~yury@84.51.192.6] has joined #openvpn
20:55 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:56 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:57 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
21:01 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
21:17 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:17 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:18 -!- theGreatDane [orangess@61.173.122.251] has joined #openvpn
22:18 < theGreatDane> hi
22:19 < theGreatDane> im a little worried about the default file permissions given to openvpn server key and crt files
22:19 < theGreatDane> they seem to be world readable
22:19 < theGreatDane> but all they need to be is readable by owner so like 0400
22:20 < theGreatDane> and they are writable too, even though there is no reason to write to them
22:39 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 246 seconds]
22:40 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
22:40 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html>
22:40 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
22:40 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
22:58 < theGreatDane> im worried about the default file permissions given to openvpn public and private keys
22:58 < theGreatDane> especially server side
22:58 < theGreatDane> they are world readable and for owner writable even though they need not be written to e ver
22:58 < theGreatDane> ever*
23:07 < theGreatDane> it wouldnt a break aything if i just make them all only readable by root would it?
23:16 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
23:20 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:22 < ecrist> um...
23:22 < ecrist> openvpn doesn't generate certificate files...
23:23 < ecrist> the server shouldn't have client keys on it, or certificates, for that matter.
23:24 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:30 < theGreatDane> easy-rsa does
23:30 < theGreatDane> i mean the server keys are global readable by default
23:30 < theGreatDane> and writable locally
23:30 < theGreatDane> neither of which are necessary i would think
23:35 <@vpnHelper> RSS Update - forum: [OpenVPN client] TAP-WIn32 speed <http://forums.openvpn.net/topic7646.html#p11559>
23:35 < ecrist> man umask
23:35 < ecrist> this is an easy-rsa issue, not an openvpn issue
23:35 < ecrist> easy-rsa sucks donkey dick
23:35 < ecrist> !ssl-admin
23:35 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
23:35 < theGreatDane> well
23:35 < ecrist> it sets proper permissions
23:36 < theGreatDane> the openvpn how to doesnt tell us how to use any alternative to easy-rsa, if there even is one
23:36 < theGreatDane> how-to
23:37 -!- K1ng [~KING@180.211.188.46] has joined #openvpn
23:38 < theGreatDane> so you use ssl admin for key creation?
23:38 < ecrist> yes, even for web stuff
23:40 < ecrist> see the link above
23:40 < ecrist> it's in ports for freebsd
23:41 < ecrist> you're running windows, so I'm guessing you can't run ssl-admin
23:41 < ecrist> it's written in perl
23:41  * ecrist heads out for the night.
23:41 -!- echoSMIL1 [~censured@bl17-112-146.dsl.telepac.pt] has quit [Ping timeout: 240 seconds]
23:42 < theGreatDane> i run centos
23:43 -!- echoSMILE [~censured@bl17-112-146.dsl.telepac.pt] has joined #openvpn
23:43 -!- echoSMILE [~censured@bl17-112-146.dsl.telepac.pt] has quit [Changing host]
23:43 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
--- Day changed Wed Apr 27 2011
00:01 < Splex> should a 'node' on a mesh vpn (a server that connects to other servers and accepts connections from other servers) have two separate certs? one a 'client' cert and one a 'server' cert?
00:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:33 -!- theGreatDane [orangess@61.173.122.251] has quit [Ping timeout: 260 seconds]
00:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:38 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
00:54 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 240 seconds]
01:02 -!- Essobi [~Essobi@74.128.53.127] has joined #openvpn
01:06 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
01:17 <@vpnHelper> RSS Update - forum: Good Ports to use in Blocked Countries? <http://forums.openvpn.net/topic8011.html#p11562> || Windows 7 64-Bit tcp mode high latency <http://forums.openvpn.net/topic7965.html#p11561> || New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11560>
01:23 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11564> || protocol <http://forums.openvpn.net/topic8012.html#p11563>
01:27 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
01:29 <@vpnHelper> RSS Update - forum: slow between branch oficce and head office <http://forums.openvpn.net/topic8001.html#p11565>
01:30 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
01:33 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
01:47 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11566>
01:59 <@vpnHelper> RSS Update - forum: Ping Problem <http://forums.openvpn.net/topic7966.html#p11568> || Migrating to new server <http://forums.openvpn.net/topic8006.html#p11567>
02:00 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 250 seconds]
02:02 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
02:02 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 240 seconds]
02:03 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
02:05 <@vpnHelper> RSS Update - forum: protocol <http://forums.openvpn.net/topic8012.html#p11569>
02:41 <@vpnHelper> RSS Update - forum: who's providing area of knowledge and customized d <http://forums.openvpn.net/topic8015.html>
02:47 <@vpnHelper> RSS Update - forum: you undoubtedly undoubtedly nonetheless <http://forums.openvpn.net/topic8018.html> || of Abercrombie Woods in hopes of marketing them for just ab <http://forums.openvpn.net/topic8017.html> || These wristwatches are desired for his <http://forums.openvpn.net/topic8016.html>
02:53 <@vpnHelper> RSS Update - forum: to the original few webpages of Google <http://forums.openvpn.net/topic8019.html>
02:55 -!- K1ng\ [~KING@180.211.188.235] has joined #openvpn
02:56 -!- K1ng [~KING@180.211.188.46] has quit [Ping timeout: 240 seconds]
02:56 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
02:59 <@vpnHelper> RSS Update - forum: Kill The Resources Being Used By OpenVPN Desktop Client <http://forums.openvpn.net/topic7836.html#p11394> || Can't Access Shared Windows Printer over OpenVPN <http://forums.openvpn.net/topic7971.html#p11393> || Please Help: "No server certificate verification method" <http://forums.openvpn.net/topic7969.html#p11392> || vpn between two routers <http://forums.openvpn.net/topic7968.html#p11391> || OpenVPN client behind ISA 
03:03 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
03:11 -!- K1ng\ [~KING@180.211.188.235] has quit [Ping timeout: 260 seconds]
03:27 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 240 seconds]
03:28 < Splex> anyones?
03:28 -!- dazo_afk is now known as dazo
03:28 < Splex> anyone?
03:29 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11575>
03:31 <@dazo> Splex: patience ... somebody who know will answer .... IRC is instant messaging, not instant answers
03:32 < Splex> dazo: lots of patience here, just figure saying 'anyone?' will get people that are now here to scroll up and see my question...  not sure how many people really scroll up to find unanswered questions :)
03:33 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
03:34 <@dazo> Splex: and such behaviour is not appreciated .... people who want to help do read scrollbacks
03:34 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
03:38 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 258 seconds]
03:47 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
03:53 -!- SWAT [~swat@ubuntu/member/swat] has joined #openvpn
03:56 -!- takamichi [Takamichi@46.11.14.68] has quit [Remote host closed the connection]
03:58 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
03:59 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
04:03 < SWAT> I want to use OpenVPN as a IPv6 tunnelbroker and want to run preferbly an unpatched version of OpenVPN. I've read I have to run a 'patched' version of OpenVPN if I want to use TUN, will TAP+radvd work with an unpatched version? Advice is welcome.
04:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
04:08 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 246 seconds]
04:09 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
04:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:10 <@dazo> SWAT: TAP+radvd should in fact work .... however, if you're not too afraid of a development version, the latest updates in the git tree have all IPv6 patches included
04:10 <@dazo> (it will come in OpenVPN 2.3)
04:12 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
04:13 -!- steve [~muh@bouncer.stephen.marsh.name] has joined #openvpn
04:24 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 240 seconds]
04:25 -!- kyrix [~ashley@80.11.52.189] has joined #openvpn
04:28 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 250 seconds]
04:28 < SWAT> dazo: that's great to know, thanks for the info
04:42 -!- bjh4 [~bjh4@ool-18bbdf6a.static.optonline.net] has quit [Ping timeout: 250 seconds]
04:55 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Quit: ?OUT OF DATA]
05:07 -!- K1ng [~KING@180.211.188.137] has joined #openvpn
05:09 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 246 seconds]
05:15 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
05:20 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
05:24 <@vpnHelper> RSS Update - forum: APIPA address when starting openvpn service <http://forums.openvpn.net/topic8020.html>
05:26 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
05:34 -!- bjh4 [~bjh4@ool-18bbdf6a.static.optonline.net] has joined #openvpn
05:39 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
05:41 -!- SWAT [~swat@ubuntu/member/swat] has quit [Remote host closed the connection]
05:45 -!- kyrix [~ashley@80.11.52.189] has quit [Quit: Leaving]
05:48 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11577>
05:48 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
05:54 <@vpnHelper> RSS Update - forum: APIPA address when starting openvpn service <http://forums.openvpn.net/topic8020.html#p11578>
06:00 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
06:12 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
06:12 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
06:12 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:14 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
06:21 -!- contempt [~prank@host163-246-dynamic.37-79-r.retail.telecomitalia.it] has joined #openvpn
06:22 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
06:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:44 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
06:46 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
06:46 -!- mode/#openvpn [+o vpnHelper] by ChanServ
06:47 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
07:12 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
07:24 -!- Frosh [Frosh@unaffiliated/frosh] has joined #openvpn
07:28 <@vpnHelper> RSS Update - forum: APIPA address when starting openvpn service <http://forums.openvpn.net/topic8020.html#p11579>
07:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:38 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 258 seconds]
07:50 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 258 seconds]
07:52 -!- kmw [~kmw@fergie.appstate.edu] has joined #openvpn
07:52 < kmw> !welcome
07:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:53 < kmw> !goal
07:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:53 -!- echoSMILE [~censured@bl17-245-196.dsl.telepac.pt] has joined #openvpn
07:53 -!- echoSMILE [~censured@bl17-245-196.dsl.telepac.pt] has quit [Changing host]
07:53 -!- echoSMILE [~censured@unaffiliated/echosmile] has joined #openvpn
07:56 < kmw> I'm sure this comes up on a regular basis, and that there is probably a more appropriate place to ask, but is there a smaller community looking to port Access Server to FreeBSD/OpenBSD? If so, do they need testers?
07:56 < Bushmills> !as
07:56 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations
07:56 <@vpnHelper> options supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
08:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
08:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:08 < kmw> Bushmills: thanks but I'm asking in part due to information at the support center
08:09 < Bushmills> i suppose nobody here knows whether testers for access servers are needed
08:10 < kmw> "at the moment, current unsupported" and "additional Unix platforms may be supported in the future" make me wonder if more hands are needed to work on the project. I can't really donate code but I can offer time testing/documenting/etc.
08:12 < ecrist> no idea
08:12 < ecrist> access server is commercial, and not supported here. ;)
08:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:30 -!- K1ng\ [~KING@180.211.188.67] has joined #openvpn
08:33 -!- K1ng [~KING@180.211.188.137] has quit [Ping timeout: 276 seconds]
08:45 <@vpnHelper> RSS Update - forum: Good Ports to use in Blocked Countries? <http://forums.openvpn.net/topic8011.html#p11580>
08:46 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
08:46 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
08:46 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:52 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Connection reset by peer]
08:53 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
08:53 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
08:53 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
08:55 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
08:57 <@vpnHelper> RSS Update - forum: Good Ports to use in Blocked Countries? <http://forums.openvpn.net/topic8011.html#p11581>
09:00 < kmw> ecrist: that's kind of what I was afraid of, thought I'd check here before posting to openvpn-users@ in case someone from the AS project was listening in :)
09:01 < ecrist> they are
09:01 < ecrist> you won't get help on openvpn-users with access server, either
09:01 < ecrist> call their support
09:13 -!- newmember [~newmember@68.144.191.90] has joined #openvpn
09:16 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 258 seconds]
09:19 <@vpnHelper> RSS Update - forum: Shorewall & OpenVPN Configuration{Need Help} <http://forums.openvpn.net/topic8021.html>
09:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:26 -!- mindcry [~gerard@dsl081-135-015.nyc1.dsl.speakeasy.net] has quit [Quit: WeeChat 0.3.3]
09:28 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
10:00 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:11 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic8022.html>
10:33 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic8022.html#p11584>
10:43 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:44 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Ping timeout: 248 seconds]
10:48 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:50 < mutilator> hola everyone, got an issue here.. i've got a bridge vpn setup, the itnerfaces are up, the bridge connects, i can see tx/rx on both sides being increments but getting no ping response
10:50 < mutilator> if i ping from the server side to the ip on the client side tap interface i get nothing and likewise when i ping from the client side to the bridge ip address i get nothing as the first rule for INPUT & OUTPUT on the client side i have accept anything to/from the tap interface and the server side just allows everything
11:04 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
11:07 -!- CharlieSu [~CharlieSu@ec2-174-129-218-86.compute-1.amazonaws.com] has left #openvpn []
11:34 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11585>
11:38 -!- mutilator [muti@2607:fbd0:11:1:b077:ed72:551b:7e58] has quit [Read error: Operation timed out]
11:49 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Read error: Operation timed out]
11:50 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
11:50 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
11:50 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
11:53 -!- ronnocol [~lance@2001:1868:214::dead:beef] has quit [Ping timeout: 260 seconds]
11:53 -!- ronnocol [~lance@2001:1868:214::dead:beef] has joined #openvpn
12:16 -!- newmember [~newmember@68.144.191.90] has quit [Ping timeout: 260 seconds]
12:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:34 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 248 seconds]
12:36 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:38 -!- dazo is now known as dazo_afk
12:54 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
13:00 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
13:02 -!- newmember [~newmember@S010624ab81b726aa.cg.shawcable.net] has joined #openvpn
13:11 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
13:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
13:46 <@vpnHelper> RSS Update - forum: OpenVPN 2.2.0 released <http://forums.openvpn.net/topic8023.html>
13:50 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
13:50 < DeathWolf> hi, what would be the minimum overhead possible using openvpn? I do not need secure encryption
13:51 -!- krzie changed the topic of #openvpn to: OpenVPN 2.2.0 most current, release 4-26-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: http://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly.
13:51 < krzie> DeathWolf, if you dont want encryption you dont need openvpn, check out GRE tunnels
13:51 < DeathWolf> cool
13:51 < DeathWolf> thanks
13:52 < krzie> np
13:52 < krzie> but also, you could with alg none / cipher none
13:52 < krzie> and some flag to disable certs
13:52 < krzie> !authpass
13:52 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
13:52 < DeathWolf> how much overhead would that generate? last time I checked openvpn was roughly around 70bytes/packet
13:52 < krzie> --client-cert-not-required
13:52 < DeathWolf> (with dynamic encryption)
13:52 < krzie> i dunno, google it
13:52 < DeathWolf> ok
13:52 < DeathWolf> or I'll try it:)
13:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:58 -!- bjh4 [~bjh4@ool-18bbdf6a.static.optonline.net] has quit [Quit: Leaving]
13:59 -!- krzie changed the topic of #openvpn to: OpenVPN 2.2.0 most current, released 26-Apr-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: http://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly.
13:59 < krzie> grr
13:59 -!- krzie changed the topic of #openvpn to: OpenVPN 2.2.0 most current, released 26-Apr-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: https://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly.
13:59 < krzie> there, done!
14:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:06 -!- kopf [kopf@spoon.netsoc.tcd.ie] has joined #openvpn
14:06 < kopf> After having set up an OpenVPN server on my tomato router, I'm having this problem - http://code.google.com/p/tunnelblick/issues/detail?id=73 - when trying to establish a connection on my mac using either tunnelblick or the straight openvpn console client
14:06 <@vpnHelper> Title: Issue 73 - tunnelblick - DHCP over TAP not working - OpenVPN GUI for Mac OS X - Google Project Hosting (at code.google.com)
14:07 < kopf> the status of this bug report is 'abandoned' which, along with the fact that it's happening even when I just use the normal openvpn client, would lead me to believe it's an openvpn problem, and I'm wondering if there could be a work-around for this
14:09 -!- Frosh [Frosh@unaffiliated/frosh] has left #openvpn []
14:10 -!- Rajko [~rajkosto@2001:470:1f0b:1ce9:25d6:3b89:ffae:a7e3] has joined #openvpn
14:10 < Rajko> !source
14:10 <@vpnHelper> My source is at http://supybot.com/
14:10 < Rajko> !redirect
14:10 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:19 -!- newmember [~newmember@S010624ab81b726aa.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
14:22 -!- WebFooL [~chatzilla@untangle/contributor/WebFooL] has joined #openvpn
14:23 < WebFooL> !welcome
14:23 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:23 < WebFooL> !goal
14:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:24 < WebFooL> Any known problems with the TAP driver in the 2.2.0 rls? i get "UpdateDriverForPlugAndPlayDevices" when i try to install both amd64 and x86 (hidden adapters 0x89)
14:41 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
14:50 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11588> || Problems with TAP0901 and Hidden (Characteristics=0x89) <http://forums.openvpn.net/topic8024.html>
15:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 250 seconds]
15:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:56 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11589>
16:03 -!- HauO [~HauO@p5DDC09B4.dip0.t-ipconnect.de] has joined #openvpn
16:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:08 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 276 seconds]
16:10 -!- Perun [~perun@chao5.net] has quit [Ping timeout: 240 seconds]
16:11 -!- Perun [perun@chao5.net] has joined #openvpn
16:16 -!- K1ng\ [~KING@180.211.188.67] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
16:21 -!- HauO [~HauO@p5DDC09B4.dip0.t-ipconnect.de] has left #openvpn []
16:26 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11590>
16:32 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11591>
16:45 -!- Rajko [~rajkosto@2001:470:1f0b:1ce9:25d6:3b89:ffae:a7e3] has quit [Ping timeout: 264 seconds]
17:00 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:a032:7132:fec1:34e0] has joined #openvpn
17:06 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
17:06 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
17:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:16 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
17:16 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:35 -!- drewr_ [~drewr@72.46.162.114] has joined #openvpn
18:07 < harlan> Any thoughts about the problem with priv escalation for the route add under windows 7?
18:08 -!- contempt [~prank@host163-246-dynamic.37-79-r.retail.telecomitalia.it] has quit [Ping timeout: 240 seconds]
18:11 -!- contempt [~prank@host198-157-dynamic.16-79-r.retail.telecomitalia.it] has joined #openvpn
18:15 -!- contempt [~prank@host198-157-dynamic.16-79-r.retail.telecomitalia.it] has quit [Ping timeout: 250 seconds]
18:16 -!- contempt [~prank@host161-155-dynamic.21-79-r.retail.telecomitalia.it] has joined #openvpn
18:25 -!- contempt [~prank@host161-155-dynamic.21-79-r.retail.telecomitalia.it] has left #openvpn []
18:56 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Quit: Leaving]
19:01 -!- drewr_ [~drewr@72.46.162.114] has quit [Remote host closed the connection]
19:09 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
19:21 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11592>
19:23 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 250 seconds]
19:43 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
20:08 -!- master_of_master [~master_of@p57B55B5D.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:10 -!- master_of_master [~master_of@p57B55F68.dip.t-dialin.net] has joined #openvpn
20:38 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 260 seconds]
20:41 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:50 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
21:09 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11593>
21:17 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 252 seconds]
21:22 -!- K1ng [~KING@180.211.188.67] has joined #openvpn
21:32 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Quit: No Ping reply in 180 seconds.]
21:32 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
21:32 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
21:52 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:53 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
22:37 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:01 -!- zeshoem [~mnathani@bas1-toronto46-1177856961.dsl.bell.ca] has quit [Ping timeout: 248 seconds]
23:03 -!- Squidy_at_Home [~quassel@189-11-246-86.cbace701.dsl.brasiltelecom.net.br] has joined #openvpn
23:10 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
23:11 -!- K1ng\ [~KING@180.211.188.48] has joined #openvpn
23:14 -!- K1ng [~KING@180.211.188.67] has quit [Ping timeout: 240 seconds]
23:27 <@vpnHelper> RSS Update - forum: Limit User to Specific IP Addresses on Server LAN <http://forums.openvpn.net/topic8025.html>
23:36 -!- Squidy_at_Home [~quassel@189-11-246-86.cbace701.dsl.brasiltelecom.net.br] has quit [Remote host closed the connection]
--- Day changed Thu Apr 28 2011
00:11 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
00:11 -!- steve [~muh@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
00:11 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
00:14 -!- scottos [~scott@stthom.org] has joined #openvpn
00:55 -!- arnotixe_ [~arnotixe@cl-205.udi-01.br.sixxs.net] has joined #openvpn
01:00 < arnotixe_> hi all I've set up an openvpn server on ubuntu and "openvpn server.ovpn" works, however "service openvpn start" doesn't start anything (ps aux|grep open = nothing). the server file sits in /etc/openvpn/. What could be wrong? Can't see anything in messages nor dmesg
01:06 < webmind> mv server.ovpn server.conf
01:08 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Read error: Operation timed out]
01:10 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
01:11 -!- scottos [~scott@stthom.org] has quit [Quit: scottos has no reason]
01:14 < arnotixe_> ahaa thanks. Is that ubuntu specific? I think they were named ovpn on that other OS I configured some time ago ("win"dows)
01:18 < Splex> arnotixe_: archlinux init script also reads /etc/openvpn/*.conf files... id guess most (if not all) linux distros work that way
01:18 < Splex> not sure about M$ implementation
01:18 < Splex> i mean, implementation on M$ stuff
01:19 < arnotixe_> hehe wonder when m$ will fork ovpn 
01:20 < arnotixe_> I had to do it on windows on that other machine cause there was another windows-only program sitting there (feel morally obligated to excuse my choice of OS ;)  - but the routers hung on it are running dd-wrt with openvpn clients. Linux :)
01:22 -!- arnotixe_ [~arnotixe@cl-205.udi-01.br.sixxs.net] has quit [Quit: Ex-Chat]
01:35 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
01:44 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
01:49 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:51 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Operation timed out]
01:52 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11595>
01:53 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:04 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html>
02:10 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p11598> || Limit User to Specific IP Addresses on Server LAN <http://forums.openvpn.net/topic8025.html#p11597>
02:16 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11599>
02:21 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
02:22 -!- Vutral [V9lXycexT5@vutral.net] has joined #openvpn
02:23 < Vutral> uhm
02:23 < Vutral> is there a way to remove the speedlimit on windows
02:26 < hyper_ch> speedlimit?
02:27 < Vutral> yeah
02:27 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p11600>
02:28 < Vutral> it looks like it doesnt transfer more than 1,2 mb per second
02:28 < Vutral> or well
02:31 < hyper_ch> well, seems one of your machines is a bottle neck for the encryption then
02:32 < Vutral> nope
02:32 < Vutral> ^^
02:32 < hyper_ch> yes
02:32 < Vutral> i dont think so
02:32 < hyper_ch> or windows just sucks
02:33 < Vutral> well i guess the adapter speed influences QoS
02:33 < Vutral> and so windows will kill bandwidth if there is more
02:33 < hyper_ch> I got between two dedicated server transfers up to 10MB/s
02:33 < hyper_ch> so with encryption overhead
02:34 < hyper_ch> and 100mbit lines, it's pretty much maxed out
02:38 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p11601>
02:42 -!- LowKey [rhel@unaffiliated/lowkey] has left #openvpn ["Leaving"]
02:42 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:47 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:53 < Vutral> hyper_ch, windows != linux
02:53 < Vutral> well
02:53 < hyper_ch> it's true, they are not the same
02:53 < Vutral> i will try getting openvpn to use a colinux tap device
02:56 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p11602>
03:02 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p11603>
03:08 <@vpnHelper> RSS Update - forum: [Solved]no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p11604>
03:12 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: ph1l]
03:15 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Operation timed out]
03:15 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
03:28 -!- dazo_afk is now known as dazo
03:32 < Splex> if a host acts as both a client and server (two separate openvpn processes), should I issue a server cert and client cert--two separate certs?
03:35 <@dazo> arnotixe: *.ovpn is used on Windows only and *.conf on all *nix based OSes
03:36 <@dazo> (basically, because "double click *.conf" on Windows is a bit too vague there)
03:38 <@vpnHelper> RSS Update - forum: Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html>
03:41 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:a032:7132:fec1:34e0] has quit [Read error: Connection reset by peer]
03:41 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:a032:7132:fec1:34e0] has joined #openvpn
03:44 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976.html#p11606>
03:45 -!- maxJadi [~maxJadi@dhcp-166-229.nomad.chalmers.se] has joined #openvpn
03:45 -!- maxJadi [~maxJadi@dhcp-166-229.nomad.chalmers.se] has quit [Changing host]
03:45 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
03:50 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976-15.html#p11607>
03:56 <@vpnHelper> RSS Update - forum: Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11608>
03:57 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
04:08 -!- Vutral [V9lXycexT5@vutral.net] has quit [Ping timeout: 276 seconds]
04:12 -!- Vutral [ss@vutral.net] has joined #openvpn
04:30 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
04:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
04:44 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Quit: Távozom]
04:47 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:47 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:49 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:49 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:49 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:50 <@vpnHelper> RSS Update - forum: Auth reask <http://forums.openvpn.net/topic8028.html>
05:12 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
05:20 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 276 seconds]
05:24 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
05:25 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:30 <@vpnHelper> RSS Update - forum: vpn traffic type <http://forums.openvpn.net/topic8029.html>
05:33 -!- Vutral [ss@vutral.net] has joined #openvpn
05:44 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:48 <@vpnHelper> RSS Update - forum: vpn traffic type <http://forums.openvpn.net/topic8029.html#p11612> || Auth reask <http://forums.openvpn.net/topic8028.html#p11611>
06:01 <@vpnHelper> RSS Update - forum: vpn traffic type <http://forums.openvpn.net/topic8029.html#p11613>
06:07 <@vpnHelper> RSS Update - forum: vpn traffic type <http://forums.openvpn.net/topic8029.html#p11615>
06:08 -!- tjz [~pc@bb219-74-220-153.singnet.com.sg] has joined #openvpn
06:08 -!- tjz [~pc@bb219-74-220-153.singnet.com.sg] has quit [Changing host]
06:08 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
06:12 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
06:31 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
06:55 <@vpnHelper> RSS Update - forum: The OpenVPN Server assign the conflict ip address. <http://forums.openvpn.net/topic8030.html>
07:07 <@vpnHelper> RSS Update - forum: Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11617>
07:13 <@vpnHelper> RSS Update - forum: Auth reask <http://forums.openvpn.net/topic8028.html#p11618>
07:14 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
07:14 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
07:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:27 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 258 seconds]
07:35 -!- Rajko [~rajkosto@2001:470:1f0b:1ce9:a032:7132:fec1:34e0] has joined #openvpn
07:35 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Read error: Operation timed out]
07:35 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Operation timed out]
07:35 -!- Champi [Champi@rootshell.fr] has quit [Read error: Operation timed out]
07:36 -!- Champi [Champi@rootshell.fr] has joined #openvpn
07:37 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
07:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 264 seconds]
07:39 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:a032:7132:fec1:34e0] has quit [Ping timeout: 264 seconds]
07:39 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
07:41 -!- kmw [~kmw@fergie.appstate.edu] has left #openvpn []
07:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:56 -!- master_o1_master [~master_of@p57B55F68.dip.t-dialin.net] has joined #openvpn
07:56 -!- mirco__ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
07:56 -!- raidz_ [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
07:56 -!- udk [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
07:56 -!- rooth_ [rooth@ge.mig.en.redfox.nu] has joined #openvpn
07:57 -!- batrick_ [~batrick@nmap/developer/batrick] has joined #openvpn
07:58 -!- EmperorT1m [~EmperorTo@216.17.68.153] has joined #openvpn
07:59 -!- Netsplit *.net <-> *.split quits: leepa, UdontKnow, EmperorTom, SJr, @raidz, rooth, @mattock, mirco, master_of_master, batrick
07:59 -!- mirco__ is now known as mirco
08:00 -!- Netsplit over, joins: SJr
08:00 -!- Netsplit over, joins: mattock
08:00 -!- mode/#openvpn [+o mattock] by ChanServ
08:04 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
08:05 -!- EmperorT1m is now known as EmperorTom
08:20 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 240 seconds]
08:20 <@vpnHelper> RSS Update - forum: OpenVPN & Vlan <http://forums.openvpn.net/topic8032.html> || Clinet IP fixed IP adress, how to give it with bridge server <http://forums.openvpn.net/topic8031.html>
08:21 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:21 -!- zeshoem [~mnathani@bas1-toronto46-1177856523.dsl.bell.ca] has joined #openvpn
08:22 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
08:39 <@vpnHelper> RSS Update - forum: Auth reask <http://forums.openvpn.net/topic8028.html#p11621>
08:45 <@vpnHelper> RSS Update - forum: Clinet IP fixed IP adress, how to give it with bridge server <http://forums.openvpn.net/topic8031.html#p11622>
08:57 <@vpnHelper> RSS Update - forum: Connects OK, but cannot ping server from client <http://forums.openvpn.net/topic8033.html> || Clinet IP fixed IP adress, how to give it with bridge server <http://forums.openvpn.net/topic8031.html#p11623>
09:12 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Quit: No Ping reply in 180 seconds.]
09:12 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
09:13 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
09:27 <@vpnHelper> RSS Update - forum: Can I do this with OpenVPN? <http://forums.openvpn.net/topic7924.html#p11625>
09:33 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
09:34 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:39 <@vpnHelper> RSS Update - forum: Clinet IP fixed IP adress, how to give it with bridge server <http://forums.openvpn.net/topic8031.html#p11626>
09:43 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
09:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
09:46 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 260 seconds]
09:56 <@vpnHelper> RSS Update - forum: Connects OK, but cannot ping server from client <http://forums.openvpn.net/topic8033.html#p11628> || Can I do this with OpenVPN? <http://forums.openvpn.net/topic7924.html#p11627>
10:06 -!- thm [955c577525@fedora/thm] has left #openvpn []
10:10 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
10:11 -!- Vutral [WyfVONJROj@vutral.net] has joined #openvpn
10:15 <@vpnHelper> RSS Update - forum: OpenVPN routing fails, but only sometimes. (windows client) <http://forums.openvpn.net/topic7600.html#p11629>
10:21 <@vpnHelper> RSS Update - forum: Connects OK, but cannot ping server from client <http://forums.openvpn.net/topic8033.html#p11630>
10:24 < pwrcycle> how can you route an openvpn network out via another openvpn network?
10:25 < pwrcycle> would you change the iptables SNAT entry to another client tunnel IP
10:28 < Bushmills> depends.
10:28 < Bushmills> maybe, maybe not. try to avoid 
10:29 < Bushmills> !route
10:29 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:29 < Bushmills> !serverlan
10:29 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
10:29 < Bushmills> !clientlan
10:29 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
10:29 <@vpnHelper> better explanation
10:33 -!- luneff [~yury@84.51.192.6] has joined #openvpn
10:46 -!- Rajko is now known as rajkosto
10:50 <@dazo> pwrcycle: in general, NAT is an evil hack, it is basically "potential disaster" in disguise as "perfect solution" .... doing proper routing is far far better
10:51  * dazo is so happy there are no IPv4 style NAT in IPv6
10:53 < krzee> thats why i call it the nathack!  (!nathack)
10:54 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:56 <@vpnHelper> RSS Update - forum: openvpn and dhcp options 66 <http://forums.openvpn.net/topic8034.html>
10:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
11:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
11:10 -!- kopf [kopf@spoon.netsoc.tcd.ie] has left #openvpn []
11:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:28 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:32 < krzee> !ping
11:32 <@vpnHelper> pong
11:32 < krzee> !tell Dark-Fx [winroute]
11:32 < krzee> !tell krzee [winroute]
11:34 < ecrist> !winroute
11:34 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
11:34 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
11:36 < krzee> !test
11:36 <@vpnHelper> "test" is testing
11:36 < krzee> !forget test
11:36 <@vpnHelper> Joo got it.
11:36 < krzee> !test
11:42 <@vpnHelper> RSS Update - forum: Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11632>
11:43 < krzee> !openvznat
11:43 <@vpnHelper> "openvznat" is a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP>
11:46 < krzee> !linipforward
11:46 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
11:54 <@vpnHelper> RSS Update - forum: Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11633>
12:13 -!- teddz [~teddz@dtmd-4d0523f1.pool.mediaWays.net] has joined #openvpn
12:16 -!- teddz [~teddz@dtmd-4d0523f1.pool.mediaWays.net] has quit [Client Quit]
12:17 -!- teddz [~teddz@dtmd-4d0523f1.pool.mediaWays.net] has joined #openvpn
12:19 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
12:20 -!- mirco [~mirco@p5B23AF72.dip.t-dialin.net] has joined #openvpn
12:20 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 260 seconds]
12:27 <@vpnHelper> RSS Update - forum: slow between branch oficce and head office <http://forums.openvpn.net/topic8001.html#p11634>
12:37 -!- Vutral [WyfVONJROj@vutral.net] has quit [Ping timeout: 276 seconds]
12:38 -!- mirco [~mirco@p5B23AF72.dip.t-dialin.net] has quit [Quit: mirco]
12:39 -!- mirco [~mirco@p5B23AF72.dip.t-dialin.net] has joined #openvpn
12:42 -!- Vutral [9BmpTjRInv@vutral.net] has joined #openvpn
12:43 -!- mirco [~mirco@p5B23AF72.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
12:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:50 -!- dazo is now known as dazo_afk
13:04 -!- APTX [APTX@phpBB/developer/APTX] has quit [Remote host closed the connection]
13:05 -!- dazo_afk is now known as dazo
13:06 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
13:13 -!- APTX [APTX@phpBB/developer/APTX] has quit [Quit: Farewell]
13:14 -!- APTX [~APTX@phpBB/developer/APTX] has joined #openvpn
13:18 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
13:24 -!- luneff [~yury@84.51.192.6] has quit [Quit: Leaving]
13:28 < rajkosto> when does UP/DOWn scripts start for server ?
13:29 <@dazo> rajkosto: it's described in the man page
13:29 <@dazo> !man
13:29 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
13:29 <@dazo> look at 4)
13:35 -!- Vutral [9BmpTjRInv@vutral.net] has quit [Ping timeout: 250 seconds]
13:40 -!- Vutral [FpP6yt4YwZ@vutral.net] has joined #openvpn
13:41 -!- APTX [~APTX@phpBB/developer/APTX] has quit [Quit: Farewell]
13:41 -!- arnotixe [~arnotixe@cl-205.udi-01.br.sixxs.net] has quit [Remote host closed the connection]
13:41 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
13:48 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
13:57 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Remote host closed the connection]
14:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
14:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:09 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:14 -!- Vutral [FpP6yt4YwZ@vutral.net] has quit [Ping timeout: 260 seconds]
14:14 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
14:17 -!- Vutral [ss@vutral.net] has joined #openvpn
14:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:27 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
14:28 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:a032:7132:fec1:34e0] has quit [Ping timeout: 260 seconds]
14:39 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 246 seconds]
14:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:48 -!- Vutral [ss@vutral.net] has joined #openvpn
14:57 -!- aucahuasi [~aucahuasi@190.233.106.51] has joined #openvpn
14:58 < aucahuasi> hi there, please help me with this issue: No route to host (code=113)
14:59 < aucahuasi> I don't understand why i'm getting this, i don't have any sort of firewall (nor pc and router) and for some reason i can't connect using openvpn ... please give me a hand 
15:01 -!- batrick_ is now known as batrick
15:02 < aucahuasi> ping ... ;)
15:02 -!- dazo is now known as dazo_afk
15:21 < aucahuasi> please !!! somebody?
15:25 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 246 seconds]
15:38 -!- newmember_ [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
15:38 <@vpnHelper> RSS Update - forum: Looking For Feedback: Migrating forums to vBulletin 4 <http://forums.openvpn.net/topic8035.html>
15:42 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 260 seconds]
15:43 -!- SWAT [~swat@ubuntu/member/swat] has joined #openvpn
15:45 <@vpnHelper> RSS Update - forum: openvpn and dhcp options 66 <http://forums.openvpn.net/topic8034.html#p11636> || assign different dhcp IP range for each client <http://forums.openvpn.net/topic7988.html> || need to use public ip in my local lan <http://forums.openvpn.net/topic7961.html#p11464>
15:46 < SWAT> if I use OpenVPN (git version) in combination with ipv6, my clients get an ipv6 address (yay). I do have to add a static ipv6 route towards my VPN server to every host, otherwise packets cannot be returned to the VPN client-segment (they will be sent to the router instead). What's the best way to fix this? (I cannot seem to add static ipv6 routes to my router)
15:51 <@vpnHelper> RSS Update - forum: Sending multicast over a openvpn tunnel <http://forums.openvpn.net/topic8036.html> || slow between branch oficce and head office <http://forums.openvpn.net/topic8001.html#p11637>
15:58 -!- aucahuasi [~aucahuasi@190.233.106.51] has quit [Remote host closed the connection]
16:03 <@vpnHelper> RSS Update - forum: Sending multicast over a openvpn tunnel <http://forums.openvpn.net/topic8036.html#p11640>
16:09 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
16:15 <@vpnHelper> RSS Update - forum: Can I do this with OpenVPN? <http://forums.openvpn.net/topic7924.html#p11641>
16:21 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11642>
16:25 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Quit: Changing server]
16:31 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
16:33 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11643>
16:33 -!- newmember_ [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 240 seconds]
16:42 -!- mirco [~mirco@p5B23AF72.dip.t-dialin.net] has joined #openvpn
17:08 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
17:18 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Quit: Leaving]
17:18 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 248 seconds]
17:21 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976-15.html#p11644>
17:28 -!- Vutral [ss@vutral.net] has joined #openvpn
17:33 <@vpnHelper> RSS Update - forum: OpenVPN crashes <http://forums.openvpn.net/topic7976-15.html#p11645>
17:42 -!- echoSMILE [~censured@unaffiliated/echosmile] has quit [Ping timeout: 246 seconds]
17:50 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 252 seconds]
17:52 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
17:52 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
17:57 <@vpnHelper> RSS Update - forum: New VPN config <http://forums.openvpn.net/topic8037.html> || OpenVPN fails to start at boot : Fedora <http://forums.openvpn.net/topic7976-15.html#p11645>
18:00 -!- Vutral [ss@vutral.net] has joined #openvpn
18:03 <@vpnHelper> RSS Update - forum: Query: New VPN config <http://forums.openvpn.net/topic8037.html>
18:09 <@vpnHelper> RSS Update - forum: Query: New VPN config <http://forums.openvpn.net/topic8037.html#p11647>
18:13 -!- APTX [APTX@phpBB/developer/APTX] has quit [Quit: Farewell]
18:14 -!- APTX [APTX@phpBB/developer/APTX] has joined #openvpn
18:16 < krzie> SWAT, you found the best way to fix it
18:17 < krzie> however your router does not support it
18:17 < krzie> and you also found the work around
18:17 < krzie> unfortunately thats it
18:17 < krzie> SWAT, please provide feedback on how the ipv6 stuff works for you
18:17 < krzie> including what OS's and versions you are using
18:18 < krzie> the ipv6 code needs more of that =]
18:19 < SWAT> will do, atm looking into pushing the static routes towards the network (my IPv6 knowledge is extremely thin) using quagga. Just don't know if it is or should be possible yet.
18:21 < SWAT> radvd expects you to be THE router (uplink to the internet), since it's RA changes the default gateway.
18:48 -!- Splex [~splex@unaffiliated/splex] has quit [Ping timeout: 276 seconds]
18:51 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
18:55 -!- teddz [~teddz@dtmd-4d0523f1.pool.mediaWays.net] has quit [Quit: Ex-Chat]
19:12 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:24 -!- raidzx [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
19:27 -!- raidz_ [~raidz@46-105-63-15.kimsufi.com] has quit [Ping timeout: 240 seconds]
19:51 -!- Rajko is now known as rajkosto
19:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:08 -!- master_o1_master [~master_of@p57B55F68.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:10 -!- master_of_master [~master_of@p57B55C72.dip.t-dialin.net] has joined #openvpn
20:16 < dvl> I want my laptop to have the same IP address over VPN as it has when it it connected locally.  It sounds reasonable.
20:18 -!- WebFooL [~chatzilla@untangle/contributor/WebFooL] has quit [Remote host closed the connection]
20:28 < jpalmer> dvl:  you could probably do that with a bridged VPN (dev tap) and a 'ccd' file pushing a static IP to the client.
20:28 < jpalmer> the concern is:    you'll need to make sure you never connect to the VPN when you are on the local LAN.  otherwise you'll have a routing conflict.
20:29 < jpalmer> well,  IP conflict, which will cause a routing issue.
20:34 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11648>
20:58 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html>
21:02 -!- luneff [~yury@84.51.192.6] has joined #openvpn
21:03 -!- luneff [~yury@84.51.192.6] has quit [Read error: Connection reset by peer]
21:03 -!- mirco [~mirco@p5B23AF72.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
21:09 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has joined #openvpn
21:16 <@vpnHelper> RSS Update - forum: Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11650>
21:17 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
21:34 <@vpnHelper> RSS Update - forum: TCP/UDP: Socket bind failed Permission denied <http://forums.openvpn.net/topic8039.html>
22:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:18 < dvl> jpalmer: I alreay push a ccd... just not my local LAN.
22:18 < dvl> jpalmer: keeping the same IP is useful, when doing backups... 
22:22 <@vpnHelper> RSS Update - forum: What packets of centos base system - to run openvpn? <http://forums.openvpn.net/topic8040.html>
22:37 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Read error: Connection reset by peer]
22:57 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
23:59 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 276 seconds]
--- Day changed Fri Apr 29 2011
00:08 -!- Vutral [zPEWTrCJB2@vutral.net] has joined #openvpn
00:12 -!- twister004_ [~chatzilla@117.204.140.226] has joined #openvpn
00:14 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 250 seconds]
00:14 -!- twister004_ is now known as twister004
00:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:17 -!- K1ng\\\ [~KING@180.211.188.48] has joined #openvpn
00:18 -!- DrkMachine [~machine@host-2-183-230-24.midco.net] has joined #openvpn
00:21 -!- K1ng\ [~KING@180.211.188.48] has quit [Ping timeout: 258 seconds]
00:21 -!- DrkMachine [~machine@host-2-183-230-24.midco.net] has quit [Client Quit]
00:55 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:55 -!- mode/#openvpn [+o mattock] by ChanServ
01:01 -!- rommel092079 [~rommel092@119.93.51.34] has joined #openvpn
01:02 < rommel092079> I want to setup my vpn in my own windows server but my modem is connected to router then router to computer.
01:05 -!- rommel092079 [~rommel092@119.93.51.34] has quit [Client Quit]
01:06 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
01:12 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:12 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:31 -!- twister004_ [~chatzilla@117.204.130.209] has joined #openvpn
01:32 -!- twister004 [~chatzilla@117.204.140.226] has quit [Ping timeout: 260 seconds]
01:32 -!- twister004_ is now known as twister004
01:35 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has quit [Quit: mirco]
01:49 -!- dazo_afk is now known as dazo
02:10 -!- dazo is now known as dazo_afk
02:11 -!- dazo_afk is now known as dazo
02:14 -!- K1ng\\\ is now known as k1ng
02:32 -!- dazo is now known as dazo_afk
02:32 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:40 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
02:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:10 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:10 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:10 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11653>
03:17 <@vpnHelper> RSS Update - forum: Error opening configuration file: <http://forums.openvpn.net/topic8014.html#p11655> || Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11654>
03:37 -!- twister004_ [~chatzilla@117.207.245.117] has joined #openvpn
03:40 -!- twister004 [~chatzilla@117.204.130.209] has quit [Ping timeout: 260 seconds]
03:40 -!- twister004_ is now known as twister004
03:50 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
03:51 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
03:52 -!- twister004 [~chatzilla@117.207.245.117] has quit [Ping timeout: 248 seconds]
03:52 -!- twister004_ is now known as twister004
04:05 <@vpnHelper> RSS Update - forum: openvpn 2.2RC(now is 2.2RC2) can't run as server ? <http://forums.openvpn.net/topic7751.html#p11656>
04:08 -!- dazo_afk is now known as dazo
04:14 -!- Zyclops [~Adium@59.111.18.162] has joined #openvpn
04:14 < Zyclops> hey all i keep getting Cannot open file key file 'ta.key': No such file or directory (errno=2)
04:14 < Zyclops> on my macosx client
04:14 < Zyclops> although my ubuntu client is connecting fine
04:14 < Zyclops> i changed all my cert files etc on the server to use absolute paths like they recommended in some forum
04:14 < Zyclops> but that didn't work
04:24 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
04:29 <@vpnHelper> RSS Update - forum: What packets of centos base system - to run openvpn? <http://forums.openvpn.net/topic8040.html#p11658> || ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11657>
04:30 -!- Zyclops [~Adium@59.111.18.162] has quit [Ping timeout: 264 seconds]
04:30 -!- Zyclops [~Adium@ec2-175-41-195-235.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
04:35 -!- Zyclops [~Adium@ec2-175-41-195-235.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 248 seconds]
04:39 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 258 seconds]
04:41 -!- Zyclops1 [~Adium@59.111.18.162] has joined #openvpn
04:41 <@vpnHelper> RSS Update - forum: Auth reask <http://forums.openvpn.net/topic8028.html#p11659>
04:41 -!- Zyclops1 [~Adium@59.111.18.162] has left #openvpn []
04:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:50 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
04:54 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
04:57 -!- varta [~varta@unaffiliated/contempt] has quit [Remote host closed the connection]
05:00 -!- ScriptFanix [vincent@Hanaman.LAN.riquer.fr] has joined #openvpn
05:17 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:17 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:19 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 276 seconds]
05:33 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
05:37 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
05:52 -!- ScriptFanix [vincent@Hanaman.LAN.riquer.fr] has quit [Quit: WeeChat 0.3.2]
05:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:03 <@vpnHelper> RSS Update - forum: Clinet IP fixed IP adress, how to give it with bridge server <http://forums.openvpn.net/topic8031.html#p11660>
06:15 <@vpnHelper> RSS Update - forum: Openssl ist not recongnized ? <http://forums.openvpn.net/topic8041.html>
06:25 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0/20110318052756]]
07:17 < jpalmer> dvl:  set your backups to use a hostname.   then set openvpn to update a DDNS record when the client connects.    when the client disconnects update the DDNS record with the LAN IP.
07:17 < jpalmer> !nsupdate
07:17 <@vpnHelper> "nsupdate" is http://scarydevilmonastery.net/client_connect_nsupdate for a script Bushmills wrote to solve the question How can my vpn update my nameserver?
07:32 <@vpnHelper> RSS Update - forum: Openssl ist not recongnized ? <http://forums.openvpn.net/topic8041.html#p11663>
07:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
07:54 -!- Rolybrau [~Rolybrau@135-91.79-83.cust.bluewin.ch] has joined #openvpn
07:54 -!- Rolybrau [~Rolybrau@135-91.79-83.cust.bluewin.ch] has quit [Changing host]
07:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
08:04 -!- ScriptFanix [vincent@2001:910:100b:beef::1] has joined #openvpn
08:05 -!- ScriptFanix [vincent@2001:910:100b:beef::1] has quit [Client Quit]
08:05 -!- ScriptFanix [vincent@Hanaman.LAN.riquer.fr] has joined #openvpn
08:13 -!- ScriptFanix [vincent@Hanaman.LAN.riquer.fr] has quit [Read error: Operation timed out]
08:14 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
08:14 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
08:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:16 -!- ScriptFanix [vincent@Hanaman.LAN.riquer.fr] has joined #openvpn
08:16 -!- ScriptFanix [vincent@Hanaman.LAN.riquer.fr] has quit [Client Quit]
08:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:20 <@vpnHelper> RSS Update - forum: network rate <http://forums.openvpn.net/topic8042.html>
08:20 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
08:20 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:32 <@vpnHelper> RSS Update - forum: network rate <http://forums.openvpn.net/topic8042.html#p11665>
08:38 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11666>
08:56 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
08:58 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
08:58 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
08:58 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:02 <@vpnHelper> RSS Update - forum: network rate <http://forums.openvpn.net/topic8042.html#p11667>
09:05 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
09:08 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 250 seconds]
09:10 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
09:10 < dvl> jpalmer: going to try that ccd now
09:11 < dvl> right now, my cdd is: ifconfig-push dent-vpn.unixathome.org dent-vpn-endpoint.unixathome.org
09:12 < dvl> where: both of those hostnames reside within my 'VPN network', e.g. 10.1.8.* instead of my home network, which is 10.1.1*
09:12 < jpalmer> if you're using a routed vpn,  that won't work
09:13 < dvl> jpalmer: to be clear, the stated configuration works now, just fine.  Goal is to make my laptop have a 10.1.1.* IP address when coming in over the VPN.
09:14 < dvl> And also: I'm not sure if I'm using a routed VPN.  Looking at server config now.
09:14 < jpalmer> dvl:  right.    that won't work without a bridged vpn.
09:14 < jpalmer> dev tun is routed,   dev tap is bridged
09:14 < dvl> jpalmer: oh, I see dev tun in my openvpn.conf
09:15 < jpalmer> if you are using a routed vpn,  your openvpn server won't know which interface to pass the traffic across,   since both your LAN nic,  and your vpn interface would be in the 10.1.1.x subnet.
09:15 < jpalmer> you'll have to bridge it
09:15 < dvl> jpalmer: well, perhaps not something I want to configure remotely.... I'm out of town for a month
09:16 < jpalmer> you don't have alternative access to your vpn server?
09:16 < jpalmer> you could always copy your openvpn.conf to openvpn2.conf,   and duplicate it on another port.  using tap instead of tun.
09:16 < dvl> jpalmer: I do have it... given the existing setup, how complex is this to change?  All clients are either FreeBSD or Mac.
09:16 < jpalmer> should it fail,  you could just reconnect your client to the original port
09:17 < dvl> good point.  Aside from changing of firewall rules.
09:17 < jpalmer> *nod*
09:17 < jpalmer> if you have other clients,  it probably IS better to wait until you have local access.
09:17 < dvl> jpalmer: Sorry to do lazy-web, but is this just a change from dev tun to dev tap... surely not THAT simple.
09:18 < dvl> Other clients?  No, this is just me.  Only I am affected.  Other clients (my remote servers) can wait.
09:18 < jpalmer> it really might be as simple as changing tun to tap,  and setting up the ccd to give the laptop a static IP.
09:19 < dvl> testing
09:19 < jpalmer> I think I'd poke another hole in the firewall,  setup a second instance of openvpn,  and see if it works.
09:19 < dvl> I like that approach
09:20 < jpalmer> you can even keep it configured like that until you return.  allows your existing clients to stay conencted,  while giving you the benefit of bacula-ability
09:21 < dvl> let's try 11194
09:22 < jpalmer> afk a sec  let me know how it goes.
09:24 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
09:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 276 seconds]
09:32 < dvl> Apr 29 15:32:30 bast openvpn_bridge[61484]: Cannot allocate TUN/TAP dev dynamically
09:35 < dvl> Hmm, if_tap.ko is loaded (FreeBSD)
09:38 < gladiatr> Are you using a dev-node directive with it?
09:39 < gladiatr> It has been awhile since I've setup a bridge on FreeBSD... I seem to remember something about needing to pre-create the tap device, but that was 4-5 years ago.
09:42 < dvl> gladiatr: cheers.  Thinking
09:42 < dvl> $ grep tap /etc/rc.conf
09:42 < dvl> openvpn_if="tap"
09:42 < dvl> ahh
09:43 < dvl> $ grep tap /etc/rc.conf
09:43 < dvl> openvpn_if="tap"
09:43 < dvl> openvpn_bridge_if="tap"
09:43 < dvl> Well, that change didn't help
09:44 < dvl> getting confused between tap and tun
09:45 < gladiatr> tap into the bridge.  tunnel through to the router.  somethin... somethinsometihn
09:45 < gladiatr> hehe
09:47 < dvl> it's magic
09:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:48 -!- rommel092079 [~rommel092@static.88-198-160-87.clients.your-server.de] has joined #openvpn
09:50 < rommel092079> sir from the default tun-mtu 1500 I have added tun-mtu-extra 32 and mssfix 1450, because with tun-mtu 1500, my connection is slow but with added directive it is much better now. can you advice me further what is the better combination of values for tun-mtu and tun-mtu-extra and mssfix
09:51 < rommel092079> i need your advices people
09:52 < dvl> got it.  It was dev tap, not dev bridge.
09:53 < rommel092079> more over i noticed that I get replay without the added directives
09:54 < gladiatr> dvl, sweet
09:56 < rommel092079> what a useless channel
09:56 -!- rommel092079 [~rommel092@static.88-198-160-87.clients.your-server.de] has quit []
09:57 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:58 < gladiatr> wow.  Waited all of 6 minutes to declare the entire channel useless.
09:58 < dvl> yep.  pillock.
09:59 < gladiatr> indeed
10:02 < ecrist> heh
10:04 <@vpnHelper> RSS Update - forum: Route on client fails when change server to Windows 7 64bit <http://forums.openvpn.net/topic7987.html#p11668>
10:06 < dvl> So... got openvpn running on the server, port 11194, for bridge.
10:06 < dvl> now trying to get TunnelBlk going on Mac
10:06 < dvl> It was using tunnel mode via port 1194, now trying to get it to use a different config file.
10:09 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
10:09 < ecrist> tunnelblick is pretty brain-dead simple
10:10 < ecrist> one nice thing, it will show all your configs in a list, as the file is names, sans the extension
10:10 < dvl> yeah, I got that going.
10:11 < ecrist> http://secure-computing.net/files/tb.png
10:11 < dvl> ecrist: current goal: bridge.  I have tunnel working fine.  Started up a bridge mode openvpn on 11194, but not sure of my config: I copied the original config over from my tunnel mode
10:11 < ecrist> bridges are pretty simple to set up
10:12 < ecrist> the only thing is, you can't use OS X as a server, as there's no bridge support in OS X
10:12 < dvl> http://pastebin.com/9j9Jx3cS
10:12 < dvl> Yep, using OSX as client
10:12 < dvl> I figure I have not read enough and therefore have TOO much in my bridge config versus my tunnel config.
10:13 < dvl> NOTE: tunnel config works fine, I just want to have a LOCAL IP address when working remotely... easier to run backups.
10:13 < dvl> (for my laptop_
10:14 < krzie> [11:14]  <krzie> 2. Set quality service standards: 
10:14 < krzie> [11:15]  <krzie> 2. Set service quality standards: 
10:14 < krzie> [11:15]  <krzie> which sounds more correct?
10:14 < dvl> Oh, I ant server-bridge.
10:14 < ecrist> http://pastebin.com/ZNbihJaw
10:14 < dvl> krzie: : the first one
10:14 <@vpnHelper> RSS Update - forum: Route on client fails when change server to Windows 7 64bit <http://forums.openvpn.net/topic7987.html#p11669>
10:15 < ecrist> second, krzie 
10:15 < krzie> haha damn
10:15 < ecrist> it depends on where you want the inflection
10:15 < dvl> hahd
10:15 < krzie> google has over a million more hits for the first with quotes
10:15 < dvl> krzee: what are you creating?
10:15 < krzie> dvl, im proof reading a report written by a native spanish speaker
10:15 < krzie> its testing my english, lol
10:16 < ecrist> dvl: that paste I posted is our bridge config we use at $job
10:16 < dvl> krzie: OK, but what is the actual goal of the statement?  can you tell us in longer words?
10:16 < dvl> ecrist: thanks.  I had server, not server bridge.
10:16 < ecrist> right
10:16 < krzie> In this stage the service silhouette seen by the customer will be turned into a sharp service image, but first a clear, concise, observable and realistic service standards need to be set.
10:17 < krzie> (i will split that into 2 sentances in a sec, not there yet)
10:17 < ecrist> s/ a //
10:18 < krzie> that would eat the wrong a, but thanks =]
10:21 < krzie> http://www.nccu.edu/formsdocs/proxy.cfm?file_id=906
10:21 < krzie> good enough for me!
10:21 < krzie> meh i thought vpnHelper would say this:
10:21 < krzie> Quality Service Standards A Customer Can Expect at NCCU
10:21 < dvl> ecrist: Oh my... I've had too much caffiene and it's killing my brain with respect to : 'server-bridge 10.0.5.1 255.255.0.0 10.0.3.1 10.0.3.127'
10:22  * krzie sees server-bridge and runs away
10:22 < dvl> Now. 10.0.5.1 is the gateway.... is that the gateway for the openvpn server?  
10:22 < dvl> because I'm confused... my openvpn server IS my gateway, so that's the IP address of the openvpn server?
10:23  * ecrist points dvl to the man page
10:23 < ecrist> "--server-bridge gateway netmask pool-start-IP pool-end-IP"
10:23 < dvl> yeah, that is what I am reading...
10:23 < dvl> http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html
10:23 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
10:23 < ecrist> http://www.openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html
10:23 < ecrist> should be what you're reading
10:23 <@vpnHelper> Title: OpenVPN 2.2 (at www.openvpn.net)
10:23 < krzie> theres newer manuals =]
10:23 < krzie> yepyep
10:23 < ecrist> if you're still using 2.0, you have issues
10:23 < krzie> recent upgrades to that one
10:24 < ecrist> 2.2 was released this week.
10:24 < dvl> I only googled...  hence my brain issues.
10:24 < dvl> oh
10:24 < krzie> just use !man for laziness
10:24 < ecrist> !man
10:24 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
10:24 < dvl> openvpn-2.1.4 here
10:25 -!- Blues-Man [~bluesman@188.11.17.81] has joined #openvpn
10:26 < krzie> ecrist, should we ask for man-beta to goto 2.2 now?
10:27 < dvl> oh wait... this is harder...  "Finally, set aside a IP range in the bridged subnet"...  I want to use ccd...
10:27 < dvl> or rather, assign static IP addresses to each client
10:27 < krzie> i think yes, that way everywhere we linked to man-beta will just silently update
10:27 < ecrist> man should go there now
10:27 < krzie> true, maybe both then
10:27 < ecrist> man-2x should go to 2.0 man and man-21 should go to 2.1 man
10:28 < jpalmer> dvl: did you get that bridge working?
10:28 < dvl> jpalmer: working on it now... 
10:28 < dvl> jpalmer: latest wrinkle, server-bridge seems to indicate a pool of assigned ip addresses is used, but I'm sure I can assign my laptop a static IP address.
10:29 < ecrist> you can
10:30 < dvl> I appear connected...
10:31 < dvl> But still have my old subnet.... I need to specify a different ccd
10:32 < dvl> but I don't want ifconfig-push with bridge...
10:32 < ecrist> why not?
10:33 < dvl> --ifconfig-push local remote-netmask
10:33 < dvl>     Push virtual IP endpoints for client tunnel, overriding the --ifconfig-pool dynamic allocation. 
10:33 < dvl> It says client tunnel... So I assumed, not for bridge.
10:33 < ecrist> no, you still use it for a bridge
10:33 < dvl> So what is the endpoint for a bridge situation?
10:35 < dvl> Now I have an IP address in my local LAN, but not the static IP address I wanted.  progresss
10:37 < ecrist> just put ifconfig in the client config, dvl
10:37 < ecrist> ifconfig IP MASK
10:38 < jpalmer> oh,  you can do that right in the config without a ccd?
10:38 < ecrist> yeah
10:38 < ecrist> right in the client config
10:38 < jpalmer> awesome.
10:39 < dvl> doh...
10:39 < ecrist> it's all in the man page
10:39 < ecrist> ;)
10:39 < dvl> cdd_bridge != ccd_bridge
10:39 < krzie> as long as its not being pushed to the client from the server
10:39 < jpalmer> I've never needed it,  I use ccd (so that IP's are centrally managed on the server)
10:39 < dvl> ecrist: don't you get me that crap!  ;)
10:39 < krzie> because the client cant override something that is pushed to it without extra work
10:39 < ecrist> dvl: I think you owe me a beer in two weeks. ;)
10:40 < jpalmer> bah,  I tried to meet dvl for a beer when he lived in florida.   he moved 2 weeks later :p
10:40 < krzie> and a bridge is still a tunnel
10:40 < krzie> lol jeff
10:40 < jpalmer> maybe he thought I stunk.   I dunno :P
10:40 < ecrist> OR, you can use the LAN DHCP server for your tap device, as well
10:40 < ecrist> and set static IP in your DHCP config
10:40 < dvl> ecrist: Have I not refunded your BSDCan registration?
10:40 < ecrist> ?
10:41 < |Mike|> lol
10:41 < ecrist> why would you refund my registration?
10:41 < krzie> so he doesnt need to buy your beer!
10:41 < ecrist> oh, right
10:41 < dvl> ecrist: exactly...
10:41 < ecrist> that does give me a lot more beer money
10:41 < jpalmer> lol
10:41 < dvl> success!
10:41 < krzie> hah
10:41 < jpalmer> dvl:  nice.    now you can bacula to your hearts desire!
10:42 -!- hacim [~micah@debian/developer/micah] has joined #openvpn
10:42 < dvl> well, so far, my laptop has the same static IP is has when at home, but tesintg ...
10:42 < hacim> does anyone have a good generic update-resolv-conf file?
10:42 < dvl> I think I have routing issues...
10:43 < jpalmer> how so?  what is the problem?
10:43 < krzie> hacim, its in the openvpn tgz
10:43 < dvl> I can't ping the gateway at home via the local lan.
10:43 < krzie> !download
10:43 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
10:44 <@dazo> krzie: "Don't bother with" is way too nicely worded
10:44 < dvl> perhaps my server config
10:44 < krzie> lol true
10:44 < hacim> krzie: i'm using the debian package, but I dont find it there
10:44 < krzie> hacim, wonderful, so go download the tgz
10:44 < krzie> hah
10:44 < hacim> its beautiful
10:45 < hacim> double rainbow wonderful
10:45 < dvl> jpalmer: it may be firewall rules with respect to bridge0
10:51 < Bushmills> hacim: don't update. write to a new, mv the old, then symlink to new. upon disconnect, symlink back to old resolv.conf
10:51 < dvl> now I'm not sure why this doesn't all ping to work... I'm connected, but no comms: http://pastebin.com/fKNYnk1f 
10:54 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 246 seconds]
10:55 < hacim> hrm, the one from the tarball doesn't work either
10:55 < hacim> Bushmills: do you have an example?
10:55 < hacim> i'm guessing you mean dont use resolvconf?
10:56 < Bushmills> i assumed you'r not using resolvconf.
10:56 < ecrist> dvl: I'm guessing it's a firewall issue
10:56 < hacim> Bushmills: i am, but its not working :P
10:57 < dvl> ecrist: So I'm afraid.
11:10 -!- hacim [~micah@debian/developer/micah] has left #openvpn []
11:11 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has joined #openvpn
11:25 -!- hid3 [~arnoldas@lan-78-157-71-116.vln.skynet.lt] has joined #openvpn
11:25 < hid3> Hello everyone. I have 'redirect-gateway' option set in my server config file. Is there any way to reject this setting on the client side?
11:26 < hid3> I mean, leave the client's default GW as-is, not set the VPN server as default one
11:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
11:29 < dvl> There is no traffic over the servers tap0, tap1, or bridge1 interfaces.  nil.
11:29 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has quit [Quit: mirco]
11:29 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has joined #openvpn
11:29 < dvl> But... I do see traffic over fxp0 port 11194, which corresponds to the pings I'm sending from my client.
11:30 < dvl> oh, no, it does not correspond at all.
11:33 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
11:37 < dvl> of course, it could just be a simple routing issue:
11:37 < dvl> Request timeout for icmp_seq 56
11:37 < dvl> Request timeout for icmp_seq 57
11:37 < dvl> ping: sendto: No route to host
11:37 < dvl> Request timeout for icmp_seq 58
11:38 < dvl> tap0 on my laptop has 10.55.0.82
11:38 < dvl> is that all that's required on my laptop?  OpenVPN picks that up and deposits the packets into my home LAN?
11:44 < dvl> OK, back on the tunnel mode.  No backups for now.
12:02 < ecrist> yes, that's all, dvl
12:02 < ecrist> on the server, do you have tap0 and the lan interface bridged?  and is the bridge 'UP'?
12:04 < dvl> ecrist: bridge was not up, now is.
12:05 < dvl> tap0 and the lan?  no, I think it is the wrong way around:
12:05 < dvl> $ ifconfig bridge0
12:05 < dvl> bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
12:05 < dvl> 	ether 4e:e2:8d:b1:a5:43
12:05 < dvl> 	id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
12:05 < dvl> 	maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
12:05 < dvl> 	root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
12:05 < dvl> 	member: fxp0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
12:05 -!- dvl was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
12:05 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
12:05 < dvl> oops, wrong paste.
12:06 < dvl> http://pastebin.com/2dcqDynp
12:08 < ecrist> dvl: ifconfig bridge0 addm tap0
12:08 < ecrist> if you're going to run a bridged VPN, there's a few things I suggest you do
12:09 < ecrist> in /etc/rc.conf:
12:09 < ecrist> cloned_interfaces="bridge0 tap0"
12:09 < ecrist> ifconfig_tap0="up"
12:09 < ecrist> ifconfig_bridge0="inet 10.0.5.5 netmask 255.255.0.0 addm em0 addm tap0 up"
12:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:09 < ecrist> set your LAN IP on the bridge interface in rc.conf, and add the proper interfaces as members
12:10 < ecrist> up the bridge interface and tap interface right away
12:13 < dvl> ecrist: when you say 'LAN IP on the bridge', I don't know what you mean by LAN IP ...
12:13 < ecrist> well, shoot me your entire ifconfig output on the server
12:14 < ecrist> and the pertinent sections of rc.conf of your server
12:14 < dvl> ecrist: http://pastebin.com/Quh8Ecfh
12:15 < ecrist> rc.conf...
12:15 < dvl> yep, trying to decide pertinent.. and deciding on ALL
12:17 < dvl> http://pastebin.com/pvLDZ1u9
12:20 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Connection reset by peer]
12:21 < ecrist> dvl
12:21 < ecrist> http://pastebin.com/diff.php?i=52FEvGzH
12:21 < ecrist> http://pastebin.com/52FEvGzH
12:22 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
12:22 < ecrist> then create /usr/local/etc/openvpn/up.sh with the following lines:
12:22 < ecrist> #!/bin/sh
12:22 < ecrist>  /sbin/ifconfig tap0 up
12:22 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
12:23 < ecrist> then, add "up /usr/local/etc/openvpn/up.sh" to your server.conf
12:26 < jpalmer> dvl:  the LAN that your laptop is connected to right now,  does it happen to be in the same subnet as your home LAN?
12:27  * ecrist doubts it
12:27 < dvl> jpalmer: is it not.
12:27 < dvl> ecrist: why does this line change: ifconfig_fxp1="inet 10.55.0.1  netmask 255.255.255.0" => ifconfig_fxp1="up"
12:27 < ecrist> see the bridge line
12:28 < dvl> Scary.
12:28 < ecrist> I may have entered the wrong subnet mask, fwiw
12:28 < ecrist> what's scary?
12:28 -!- dazo is now known as dazo_afk
12:29 < dvl> I am remotely changing the configuration on my gateway, when I am going to be away for another month.
12:29 < ecrist> heh
12:29 < dvl> I don't even want to reboot it.
12:29 < ecrist> my config is in place to rebuild after you reboot
12:30 < ecrist> everything you need to do can be done without too much risk
12:30 < ecrist> add your tap interface to the bridge
12:30 < ecrist> and you should get your pings working
12:31 < dvl> ecrist: from what I see, the main change to my rc.conf file is adding in the bridge line , the cloned_interfaces, and changing fxp1 to just be UP.  Right?
12:32 < dvl> rebooting... geez
12:35 -!- Blues-Man [~bluesman@188.11.17.81] has quit [Quit: Sto andando via]
12:35 < ecrist> yup
12:37 < ecrist> and tap0 is static now, meaning openvpn doesn't create the interface, it's just always there.
12:37 < dvl> its' not back yet
12:38 < ecrist> doh
12:38 < dvl> I am an 8 hour drive from home
12:39 < dvl> oh well.
12:39 < dvl> no backups until I return
12:40 < dvl> not even a ping reply
12:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:46 -!- Sky[x] [~SkyB0x@213.143.85.148] has joined #openvpn
12:55 < ecrist> blast
13:06 < jpalmer> dvl:  any remote hands you can call?
13:11 <@vpnHelper> RSS Update - forum: Query: New VPN config <http://forums.openvpn.net/topic8037.html#p11670>
13:13 -!- k1ng [~KING@180.211.188.48] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
13:13 -!- K1ng [~KING@180.211.188.48] has joined #openvpn
13:13 < dvl> jpalmer: nobody with a key.  :)
13:14 < dvl> I could contact my landlord, ask them to hand out a key.
13:16 -!- fleish [~tfleisher@c-67-180-179-244.hsd1.ca.comcast.net] has joined #openvpn
13:25 -!- dli [~dli@67.55.46.44] has joined #openvpn
13:27 < dli> I'm making connection out of Beijing, China. seems like that connection lost whenever a larget chunk of data involved. For example, scp a file, VNC, audio, through openVPN
13:28 < dli> suppose I want to scp a 200KB file through VPN, the only way for me to do is to split it into 1KB files, 200 of them, and scp
13:29 < fleish> dli: are you saying your vpn connection drops whenever you try to transfer more than 1KB of data in a connection through it?
13:29 < dli> I am wondering whether this is due to the Great Firewall of China. Do they target openVPN specifically, or something wrong locally
13:29 < dli> fleish, VPN still on, but to scp a 200KB file will hangs until time out
13:30 < fleish> the only thing I can think of is I've seen speed problems sometimes depending on the distance between the ovpn client & server - which can sometimes be solved by switching between tcp & udp protocols
13:30 < fleish> dli: in that case, I'd recommend using tcpdump to see what's happening on either end 
13:30 < fleish> I don't know what the great firewall of china specifically targets
13:31 < dli> fleish, it's not a speed issue to me, it's not scp either. for example, if I login via openVPN, and do "make oldconfig" for linux, it hangs
13:32 < dli> fleish, is there anyway for me to force openVPN to use small packets, like 1KB each, it would be a good test
13:34 < dli> I have tested, I can never scp a 2KB file, but 1KB will go through quickly, like 200 of 1KB files
13:36 < dli> "The block of PPTP and L2TP means that vpn’s on mobile devices are pretty much useless now", I guess they won't leave openVPN alone
13:36 < Bushmills> do an mtu test, limit mtu accordingly
13:37 < dli> Bushmills, how to? please
13:38 < Bushmills> man page tells you how. look for  --mtu-test
13:40 < dli> Bushmills, can I add a line of mtu-test to my openvpn.conf? quick way
13:41 < Bushmills> that's what "add the --mtu-test option to your configuration." from man page means
13:49 < dli> another question, do I still need for the server end: push "route 192.168.2.0 255.255.255.0"
13:50 < Bushmills> maybe. maybe not.
13:51 < dli> ERROR: Linux route add command failed: external program exited with error status: 2
13:52 < ecrist> dli: sounds to me it's an mtu issue
13:52 < ecrist> !mtu
13:52 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
13:52 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has quit [Remote host closed the connection]
13:53 < dli> Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1541]
13:53 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has joined #openvpn
13:54 < Bushmills> try what is written at the end of --mssfix section of man page
13:55 < dli> Bushmills, great, let me try again
14:01 < dli> NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1541]
14:01 < dli> nothing special found :(
14:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:08 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 246 seconds]
14:10 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:20 -!- sj7trunks [~Adium@irt-W88310kqyk0.Stanford.EDU] has joined #openvpn
14:23 < sj7trunks> trying to setup openvpn but I cannot get it to go faster than 150K… the ping time averages around 2ms but then it spikes to 120 ms every 20 seconds… if i use up the bandwidth, the latency average jumps to 80… any suggestions on how to improve performance?
14:24 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
14:26 < dli> whenever I add --fragment, vpn doesn't work any more: Apr 29 15:25:57 gateway openvpn[32156]: Bad LZO decompression header byte: 84
14:27 < sj7trunks> are you using tcp or udp
14:27 < dli> sj7trunks, udp
14:28 < sj7trunks> using complzo on both sides?
14:28 < dli> sj7trunks, yes, comp-lzo
14:28 < dli> sj7trunks, without --fragment, vpn works
14:29 < sj7trunks> try without comp-lzo?
14:29 < dli> sj7trunks, should I try both end, or just client?
14:29 < sj7trunks> both
14:30 < dli> sj7trunks, difficult to try to test, I will lose control over the remote machine :(
14:31 < sj7trunks> ah then nevermind… i have it disabled on mine presently, trying to test various configurations to get a faster connection
14:33 -!- sj7trunks1 [~Adium@171.67.160.194] has joined #openvpn
14:34 -!- sj7trunks1 [~Adium@171.67.160.194] has quit [Read error: Connection reset by peer]
14:35 -!- sj7trunks1 [~Adium@171.67.160.194] has joined #openvpn
14:35 -!- sj7trunks [~Adium@irt-W88310kqyk0.Stanford.EDU] has quit [Ping timeout: 240 seconds]
14:35 -!- K1ng` [~KING@180.211.188.117] has joined #openvpn
14:39 -!- K1ng [~KING@180.211.188.48] has quit [Ping timeout: 276 seconds]
14:46 < dli> looks like I can not use lzo with fragment :(
15:18 < krzie> dli,
15:18 < krzie> !trac
15:18 <@vpnHelper> "trac" is see http://community.openvpn.net for development information and bug tracker.
15:19 < krzie> register or login with your forum l/p if you have one, and submit a ticket in the trac if you'd like to
15:19 < krzie> i've never had to use fragment
15:32 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
15:33 < sj7trunks1> i was stuck getting less than 200K downloads …. turned everything off and nothing worked… changed the cipher and… now i'm getting 800K
15:33 < sj7trunks1> not sure whats up with that
15:33 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
15:37 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
15:38 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
15:49 <@vpnHelper> RSS Update - forum: The OpenVPN Server assign the conflict ip address. <http://forums.openvpn.net/topic8030.html#p11672> || Query: New VPN config <http://forums.openvpn.net/topic8037.html#p11671>
15:50 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
15:55 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11673>
16:05 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
16:08 < dvl> jpalmer: I figured out a way to avoid the bacula backup issue over tunnel.  Just change the IP address for the hostname in question.
16:18 < dli> I got --fragment 1300, mssfix, still couldn't scp files larger than 1KB
16:37 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11674>
16:42 -!- sj7trunks1 [~Adium@171.67.160.194] has quit [Quit: Leaving.]
16:42 < dli> ecrist, thanks, it works now with: --tun-mtu 1450 --fragment 1350 --mssfix
16:43 < ecrist> good to hear
16:43 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has joined #openvpn
16:45 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
16:46 -!- Zarion [~as@unaffiliated/zarion] has joined #openvpn
16:47 < Zarion> On my windows box I have a openvpn tunnel setup to a vpn, tyhe issue is that I'm unable to access that tunnel from any computer on my lan
16:48 < Zarion> !goal
16:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:48 < Zarion> !goal I want to route my vpn tunnel across my lan
16:51 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
16:53 <@vpnHelper> RSS Update - forum: Guidance needed on windows setup please <http://forums.openvpn.net/topic8043.html>
16:59 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
17:00 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
17:00 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
17:02 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
17:02 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
17:23 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has quit [Quit: mirco]
17:23 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has joined #openvpn
17:27 -!- mirco [~mirco@p5B23AE05.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
17:36 -!- fleish [~tfleisher@c-67-180-179-244.hsd1.ca.comcast.net] has left #openvpn []
17:48 -!- Vutral [zPEWTrCJB2@vutral.net] has quit [Ping timeout: 276 seconds]
17:56 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 263 seconds]
18:09 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:11 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
18:30 < Zarion> oh my god openvpn server mode is insane
18:34 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Read error: Operation timed out]
18:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:35 -!- Zarion [~as@unaffiliated/zarion] has quit [Quit: —I-n-v-i-s-i-o-n— 3.1.3 (May '10)]
18:36 -!- krzie [nobody@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
18:44 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
18:48 -!- clyons [~clyons@unaffiliated/clyons] has joined #openvpn
19:00 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
19:06 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
19:35 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
19:40 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Quit: Leaving]
19:58 -!- Vutral [~ss@vutral.net] has joined #openvpn
20:06 -!- master_of_master [~master_of@p57B55C72.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:10 -!- master_of_master [~master_of@p57B544D2.dip.t-dialin.net] has joined #openvpn
20:24 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 260 seconds]
20:27 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
20:43 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
20:44 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
20:46 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
20:47 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
20:49 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
20:51 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
20:54 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
20:55 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
21:03 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 260 seconds]
21:10 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
21:11 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
21:13 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 250 seconds]
21:14 -!- bitrot [~rajkosto@wan.rajkonet.info] has joined #openvpn
21:17 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Ping timeout: 250 seconds]
21:27 -!- batrick [~batrick@nmap/developer/batrick] has quit [Ping timeout: 246 seconds]
21:31 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
21:38 -!- Vutral [~ss@vutral.net] has quit [Ping timeout: 276 seconds]
21:43 -!- Vutral [~ss@vutral.net] has joined #openvpn
22:00 -!- Sky[x] [~SkyB0x@213.143.85.148] has quit [Read error: Connection reset by peer]
22:02 -!- Sky[x] [~SkyB0x@213.143.86.40] has joined #openvpn
22:07 -!- Rajko [~rajkosto@2001:470:1f0b:1ce9:ed3f:f975:85f9:fc13] has joined #openvpn
22:07 -!- bitrot [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
22:08 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
22:23 -!- Sky[x] [~SkyB0x@213.143.86.40] has quit [Ping timeout: 276 seconds]
22:23 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:30 < Rajko> i have a problem
22:30 < Rajko> once openvpn connects, and the server says redirect-gateway, it makes a /32 route via the old default gateway towards the servers ip
22:31 < Rajko> so anything to the servers ip is untunneled
22:31 < Rajko> how do i make things other than the openvpn udp port tunneled as well ?
22:31 < Rajko> its messing with the clients i have behind that router
22:38 -!- Mobojombo [~jam@190.21.184.99] has joined #openvpn
22:38 < Mobojombo> !goal
22:38 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:39 < Mobojombo> !welcome
22:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:40 < Mobojombo> !redirect
22:40 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
22:40 < Mobojombo> !def1
22:40 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
22:44 < EmperorTom> Rajko: are you saying you have other traffic (than the openvpn traffic) going to the IP of the openvpn server, and you want that traffic tunneled?
22:51 < Mobojombo> Goal: Send all internet traffic through VPN with Linux client in order to access samba shares and navigate the web with the server IP
22:52 < Mobojombo> HI there.. the described scenario works with windows, but I can't make it work with linux
22:52 < Mobojombo> the Opevpn doesn't configure the tap0 adaptor
22:53 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:54 < Mobojombo> I get the following error: Fri Apr 29 23:53:12 2011 ERROR: Linux route add command failed: external program exited with error status: 7
22:56 < Mobojombo> I'm trying to configure the adaptor with dhcp
23:10 -!- raidz_ [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
23:11 -!- raidzx [~raidz@46-105-63-15.kimsufi.com] has quit [Ping timeout: 260 seconds]
23:18 -!- K1ng` [~KING@180.211.188.117] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
23:36 < dli> Mobojombo, what's your server config?
23:42 -!- hpa [hpa@terminus.zytor.com] has quit [Excess Flood]
23:44 < Mobojombo> server config http://pastebin.com/HBJasA19
23:45 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
23:47 -!- K1ng [~KING@180.211.188.130] has joined #openvpn
23:52 < dli> Mobojombo, can you ping the server?
23:52 < dli> Mobojombo, through tunnel
23:53 < Mobojombo> I can ping the server if I run dhclient tap0 on the console
23:53 < Mobojombo> but I can't configure openvpn to do it
23:57 < dli> Mobojombo, http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
23:57 <@vpnHelper> Title: HOWTO (at openvpn.net)
23:57 < dli> Mobojombo, do you need route-gateway? 
--- Day changed Sat Apr 30 2011
00:19 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
00:25 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
00:34 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
00:52 -!- dli [~dli@67.55.46.44] has quit [Ping timeout: 276 seconds]
01:18 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
01:25 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
01:30 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 250 seconds]
01:33 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
01:39 -!- mirco [~mirco@p5B23CEDA.dip.t-dialin.net] has joined #openvpn
01:50 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
01:55 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
02:05 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 260 seconds]
02:08 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
02:11 -!- K1ng [~KING@180.211.188.130] has quit [Ping timeout: 240 seconds]
02:16 < hid3> Hello everyone. How do I generate a server certificate?
02:16 < hid3> And also, for my client(s)?
02:17 -!- lambda__ [52f4d9ee@gateway/web/freenode/ip.82.244.217.238] has joined #openvpn
02:19 <@vpnHelper> RSS Update - forum: Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11676>
02:20 -!- lambda__ is now known as lambda
02:22 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
02:26 -!- lambda [52f4d9ee@gateway/web/freenode/ip.82.244.217.238] has quit [Ping timeout: 252 seconds]
02:29 -!- Mobojombo [~jam@190.21.184.99] has quit [Ping timeout: 250 seconds]
02:37 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
02:41 -!- mirco [~mirco@p5B23CEDA.dip.t-dialin.net] has quit [Quit: mirco]
02:44 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
02:51 -!- Mobojombo [~jam@190.21.184.99] has joined #openvpn
03:03 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
03:08 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:14 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
03:30 -!- djc [~djc@gentoo/developer/djc] has joined #openvpn
03:31 < djc> is there a short-form changelog for 2.1.4-2.2.0?
03:31 < djc> i.e. major changes?
03:37 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
03:37 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
03:37 < hid3> Hello everyone
03:37 < hid3> I have problems: http://pastebin.com/uj5CWi7H
03:37 < hid3> any ideas what's wrong?
03:38 < hid3> I'm sure the .crt file is there in place
03:41 < hid3> Please help someone
03:46 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
04:00 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
04:11 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
04:20 -!- Vutral [~ss@vutral.net] has quit [Ping timeout: 246 seconds]
04:21 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
04:24 -!- jam_ [~jam@190.21.188.24] has joined #openvpn
04:28 -!- Mobojombo [~jam@190.21.184.99] has quit [Ping timeout: 250 seconds]
04:31 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
04:36 -!- Vutral [~ss@vutral.net] has joined #openvpn
04:48 -!- GrecKo_ is now known as GrecKo
04:49 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
05:00 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
05:08 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
05:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 263 seconds]
05:20 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
05:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:39 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
05:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:49 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
05:56 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
06:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:07 -!- MJD [~quassel@CPE0015ef4fc6af-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
06:08 -!- jam_ [~jam@190.21.188.24] has quit [Ping timeout: 250 seconds]
07:00 -!- bryce [52f4d9ee@gateway/web/freenode/ip.82.244.217.238] has joined #openvpn
07:00 -!- the2masters [~stefan@2a01:198:6da:0:213:e8ff:feaf:590d] has joined #openvpn
07:18 -!- bryce [52f4d9ee@gateway/web/freenode/ip.82.244.217.238] has quit [Ping timeout: 252 seconds]
07:23 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
07:25 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
08:25 < Rajko> EmperorTom, yes
08:28 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
08:29 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
08:34 < Rajko> i have other traffic (than the openvpn traffic) going to the IP of the openvpn server, and i want that traffic tunneled
08:35 < Rajko> while using redirect-gateway
08:38 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
08:54 -!- Rajko [~rajkosto@2001:470:1f0b:1ce9:ed3f:f975:85f9:fc13] has quit [Read error: Connection reset by peer]
08:54 -!- Rajko [~rajkosto@2001:470:1f0b:1ce9:ed3f:f975:85f9:fc13] has joined #openvpn
08:55 -!- the2masters [~stefan@2a01:198:6da:0:213:e8ff:feaf:590d] has left #openvpn []
09:06 -!- K1ng [~KING@180.211.188.159] has joined #openvpn
09:06 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11677>
09:09 -!- Rajko [~rajkosto@2001:470:1f0b:1ce9:ed3f:f975:85f9:fc13] has quit [Read error: Connection reset by peer]
09:10 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:ed3f:f975:85f9:fc13] has joined #openvpn
09:24 -!- udk is now known as root
09:29 -!- swk [~swk@freeswitch/developer/swk] has joined #openvpn
09:32 -!- corretico [~luis@201.201.44.82] has joined #openvpn
09:34 < swk> does anyone use hardware ssl/tls aceleration?
09:34 < swk> is it even worth it on modern CPUs?
09:39 < hid3> I have a VPN server. The config has redirect-gateway option. How do I make the option to push for all but one client?
09:57 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
10:00 -!- scandic [~scandic@frnk-5f740083.pool.mediaWays.net] has joined #openvpn
10:00 -!- scandic [~scandic@frnk-5f740083.pool.mediaWays.net] has quit [Client Quit]
10:01 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
10:02 -!- tjz [~pc@unaffiliated/tjz] has quit [Client Quit]
10:17 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11678>
10:28 -!- master_of_master [~master_of@p57B544D2.dip.t-dialin.net] has quit [Remote host closed the connection]
10:29 -!- master_of_master [~master_of@p57B544D2.dip.t-dialin.net] has joined #openvpn
10:34 -!- mirco [~mirco@p5B23CEDA.dip.t-dialin.net] has joined #openvpn
10:35 -!- hid3 [~arnoldas@lan-78-157-71-116.vln.skynet.lt] has quit [Read error: Connection reset by peer]
10:40 -!- Blues-Man [~bluesman@188.11.17.81] has joined #openvpn
10:40 -!- mirco [~mirco@p5B23CEDA.dip.t-dialin.net] has quit [Quit: mirco]
10:40 -!- mirco [~mirco@p5B23CEDA.dip.t-dialin.net] has joined #openvpn
10:44 -!- mirco [~mirco@p5B23CEDA.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
11:01 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
11:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:22 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:ed3f:f975:85f9:fc13] has quit [Quit: Leaving]
11:29 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:ed3f:f975:85f9:fc13] has joined #openvpn
11:29 < rajkosto> hello
11:29 < rajkosto> does http://build.openvpn.net/downloads/releases/debian/5/ come with ipv6 ?
11:29 <@vpnHelper> Title: Index of /downloads/releases/debian/5 (at build.openvpn.net)
11:29 -!- ilok [~rommel092@static.88-198-160-86.clients.your-server.de] has joined #openvpn
11:29 < rajkosto> http://pastebin.com/FD4QgUub i dont see ipv6 there
11:30 < krzie> no
11:30 < krzie> !snapshots
11:30 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
11:31 < rajkosto> krzie, but i had 2.1.4 on debian installed, and it had [IPV6] tag in --version
11:31 < rajkosto> and thaat was from debian, not openvpn
11:31 < krzie> i stand by my answer
11:32 < ilok> hello I am new here. I am puzzled now. previously I can connect to internet without lport or port or bind directive in my client config, but now I need to put lport or port and bind in my client config. why do this happen?
11:32 < krzie> ilok, sound slike a change in some firewalls between you and the server
11:34 < ilok> change in my firewall? but I have not changed my firewall yet. it was working before but now, it isnt..
11:38 < rajkosto> krzie, do you think its better if i already have a ipv4 openvpn to just set up a sit tunnel through the vpn, or run another openvpn ipv6 instance that would just do ipv6
11:39 < krzie> turns out openvpn --server-ipv6 CANT do just ipv6
11:40 < krzie> it depends on --server
11:40 < krzie> i asked the dev of the ipv6 patch =]
11:40 < rajkosto> oh so you can do both ipv6 and ipv4 on one server ?
11:40 < krzie> can / must
11:40 < ilok> krzie, any other ideas about my situation?
11:41 < krzie> ilok, why does it matter, you said you found the fix
11:43 < ilok> I think it is just a workaround.  Like awhile ago, on the first try on connecting to the internet, I cant immediately browse. but when I added the tun-mtu,tun-mtu-extra and mssfix, it solved that problem.  Can it be my ISP that they change the setting of the internet connection?
11:45 < ilok> and with the above stated fix, my internet connection is not as fast and stable as before
11:46 < rajkosto> http://www.greenie.net/ipv6/openvpn.html is the 2.2rc2 patch appliable to 2.2 final ?
11:46 <@vpnHelper> Title: Gert Döring - IPv6 Payload Patch for OpenVPN (at www.greenie.net)
11:52 < krzie> no idea
11:52 < krzie> cron2 / dazo_afk, any answer for that one?
11:53 < rajkosto> and apparently openvpn-devel on openwrt has that patch already applied, which is ncie because thats what my clients are
11:56 -!- ilok [~rommel092@static.88-198-160-86.clients.your-server.de] has quit [Ping timeout: 260 seconds]
11:57 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
11:58 -!- ilok [~rommel092@static.88-198-160-86.clients.your-server.de] has joined #openvpn
11:59 < ilok> I know that lport bind for local client port but what is its other purpose for networking
12:00 < ilok> why do this binding is needed?
12:00 < krzie> you're defining what source port the client sends out packets with
12:00 < krzie> as opposed to the destination port, which is all you likely defined before
12:01 < krzie> i, and my isp, have no problems with random udp source ports on my outgoing, so i dont need it
12:01 < krzie> but if one of us did some more firewalling, i would
12:01 < ilok> why? isnt the remote c.c.c.c cc enough to know that cc is the port
12:01 < krzie> cc is the destination port
12:02 < krzie> all your outgoing traffic has a source port too!
12:02 < krzie> thats how you are able to have 2-way communication, the target knows how to reply to you!
12:02 < ilok> ok. but previously I dont need to specify that but I can connect to internet. why is that?
12:02 < krzie> i dont know, or care
12:03 < ilok> so it is really needed to specify the lport !
12:03 < krzie> in your situation it would seem as tho YES
12:03 < krzie> since you said it fixes your problem
12:03 < krzie> lol
12:04 < ilok> I wish that lport directive can be pushed
12:04 < krzie> but that would be bad, it should be set by the client, its a per client setting
12:04 < krzie> just cause 1 needed it does not mean all will
12:05 < ilok> so if ever needed or not, i can just push that
12:05 < krzie> dont you supply the users with their config in the first place!?!?
12:05 < ilok> yes but in my case they should have same config. its only with their user and password that they differ
12:06 < krzie> so then put it in that config you give them if you want
12:06 < krzie> anyways, gunna shower before this girl gets here
12:07 < ilok> that can be done, but if the situation changes again and the lport will now render no internet connection then it will be the case that I will change all their configs. unlike if I just push that directive it will be easier as I am thinking
12:07 < ilok> ok good luck with that girl
12:07 < krzie> lport would not have hurt before
12:08 < ilok> yes
12:08 < krzie> unless you or your client's ISP firewall the lport port
12:08 < krzie> s/you/your client/
12:08 < ilok> I am also thinking that it is the ISP. 
12:08 < krzie> well ya theres 2 people it could be
12:08 < krzie> you said its not you (the client)
12:09 < krzie> so then process of elimination makes that kinda easy
12:11 < ilok> I am now inclined on how I can workaround with the ISP problem towards this lport.  because when the connection terminates and restarts, address already in use is stated in the log
12:20 < krzie> lol then you are running openvpn twice
12:20 < krzie> hahaha
12:20 < ilok> yes that is why i need to eliminate the lport directive because that cause me problem
12:21 < krzie> hahahah
12:21 < krzie> ajust run each config 1 time
12:21 < krzie> lol
12:25 -!- ilok1 [~rommel092@static.88-198-160-87.clients.your-server.de] has joined #openvpn
12:25 < ilok1> do you think prerouting will solve this problem?
12:25 -!- ilok [~rommel092@static.88-198-160-86.clients.your-server.de] has quit [Ping timeout: 248 seconds]
12:25 < krzie> heh
12:25 < krzie> i think you will waste lots of time doing nothing
12:25 < krzie> and i will not
12:25 < krzie> adios!
12:26 < ilok1> harsh
12:26 -!- ilok1 [~rommel092@static.88-198-160-87.clients.your-server.de] has quit [Client Quit]
12:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:49 -!- yell0 [yello@unaffiliated/contempt] has quit [Remote host closed the connection]
13:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
13:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:22 -!- Blues-Man [~bluesman@188.11.17.81] has quit [Quit: Sto andando via]
13:23 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
13:27 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
13:27 < rajkosto> why is the manual so vague about fragment,mssfix and mtu
13:29 -!- jam_ [~jam@190.21.188.24] has joined #openvpn
13:34 -!- jam_ [~jam@190.21.188.24] has quit [Ping timeout: 250 seconds]
13:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
13:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:46 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Quit: Leaving]
13:52 -!- Squidy [~quassel@189.72.179.180] has quit [Ping timeout: 240 seconds]
14:03 -!- boogerking [~sgoodpast@72.49.236.38] has joined #openvpn
14:07 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
14:07 < krzee> !tell swk [management]
14:07 < swk> thanks krz
14:08 < krzee> np
14:08 < krzee> rajkosto, ild improve it if i understood the differences better
14:08 < boogerking> how do you make openvpn FIPS compliant?
14:08 < rajkosto> boogerking, use fips compilant build of openssl ?
14:09 < boogerking> that seems logical
14:09 < krzee> yep
14:09 < krzee> openssl handles the encryption for openvpn
14:10 < boogerking> is it suitable for a financial environment 
14:10 < boogerking> i guess thats the ultimate question i have
14:10 < boogerking> i am used to vendor specific VPNs and not openvpn at all
14:10 < krzee> give me examples of other vpn software that you feel is suitable for a financial environment?
14:11 < krzee> in *my* opinion it is
14:11 < boogerking> sonicwall cisco juniper
14:11 < krzee> yes, if that is then openvpn is
14:11 < krzee> thats just a simple ssl vpn
14:12 < boogerking> hmm
14:13 < boogerking> wonder if its certified
14:17 < swk> you mean as in certified by entity X to meet requirements?
14:17 < swk> if so you might look at the commercial version of OpenVPN
14:18 < boogerking> ty swk
14:18 < boogerking> didn't realize they had a commercial version
14:21 < swk> dont get me wrong f/oss is great but sometimes you cant be a commercially backed platform
14:21 < swk> cant beat even
14:22 < boogerking> sometimes you GOTTA use a commercially backed platform for legal reasons
14:24 < krzee> openvpn has that
14:24 < krzee> its called Access-Server
14:24 < krzee> and it is not supported here on IRC
14:24 < krzee> !AS
14:24 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
14:24 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
14:24 < krzee> #4 for their support
14:29 < rajkosto> they have a dapper young man on their webpage with a laptop supposedly hacking the internets with magic powers
14:40 < pwrcycle> krzee: /clear
14:40 < krzee> ?
14:41 < krzee> [12:21]  <swk> dont get me wrong f/oss is great but sometimes you cant be a commercially backed platform
14:41 < krzee> [12:21]  <swk> cant beat even
14:41 < krzee> so true, thats why i use cudatel at work and freeswitch at home
14:42 < krzee> "when theres a problem, dont call me call cudatel support!"
14:45 < swk> lol
15:00 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
15:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
15:08 -!- me345 [~me345@adsl-75-15-235-152.dsl.bkfd14.sbcglobal.net] has joined #openvpn
15:09 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Connection reset by peer]
15:13 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
15:17 -!- script_junky [54eab6a4@gateway/web/freenode/ip.84.234.182.164] has joined #openvpn
15:18 < script_junky> hello all, interested in openvpn and wanna test it on my esx machine but it seams that I am missing something since Vpn server is not starting. Trying to run this on ubuntu 11.04 server edition
15:19 < script_junky> Was looking through logs but /var/log doesnt seem to have any logs relates to openvpn.
15:20 < rajkosto> run it not as daemon ?
15:20 < rajkosto> openvpn /etc/openvpn/server.conf or whatever your conf is
15:20 < script_junky> as suggested in ubuntu howto
15:23 -!- script_changed_n [54eab6a4@gateway/web/freenode/ip.84.234.182.164] has joined #openvpn
15:23 < script_changed_n> had to change my name (was in use already)
15:23 -!- djc [~djc@gentoo/developer/djc] has left #openvpn []
15:23 < script_changed_n> anyways ... no log to read in order to see whats wrong..where does openvpn keeps it logs?
15:24 < script_changed_n> logs in /var/log show nothing related to openvpn
15:25 -!- script_junky [54eab6a4@gateway/web/freenode/ip.84.234.182.164] has quit [Ping timeout: 252 seconds]
15:25 < script_changed_n> have followed this guide -> https://help.ubuntu.com/10.10/serverguide/C/openvpn.html
15:25 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
15:29 -!- glengoyne [~glengoyne@p54947C39.dip.t-dialin.net] has joined #openvpn
15:31 < Bushmills> logs are where you tell openvpn to put them
15:31 < Bushmills> !howto
15:31 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:32 < krzee> !logfile
15:32 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
15:34 -!- djc [~djc@gentoo/developer/djc] has joined #openvpn
15:34 < djc> !ipv6
15:34 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
15:34 -!- K1ng` [~KING@180.211.188.159] has joined #openvpn
15:34 -!- djc [~djc@gentoo/developer/djc] has left #openvpn []
15:35 -!- K1ng`` [~KING@72.20.9.102] has joined #openvpn
15:37 -!- K1ng [~KING@180.211.188.159] has quit [Ping timeout: 240 seconds]
15:38 -!- K1ng` [~KING@180.211.188.159] has quit [Ping timeout: 240 seconds]
15:46 < rajkosto> the ipv6 payload patch is so messed up on windows :(
15:51 -!- K1ng` [~KING@180.211.188.159] has joined #openvpn
15:51 < oc80z> !engine
15:55 < oc80z> ah thisis what i was looking for http://www.a110wiki.de/wiki/VIA_Padlock
15:55 <@vpnHelper> Title: VIA Padlock - A110 Wiki (at www.a110wiki.de)
15:55 -!- K1ng`` [~KING@72.20.9.102] has quit [Ping timeout: 260 seconds]
15:55 < oc80z> try openvpn --show-engines
15:56 < oc80z> http://pastebin.ca/2052352
15:57 < oc80z> another good one is Intel AES-NI engine [aesni]
15:58 < oc80z> there are some mini PCIe hardware acceleration cards, but is it not limited to the bus?
15:59 < oc80z> looks like aes-256-ecb may be the way to go for higher thoroughput..
16:00 < oc80z> and less cpu usage :D
16:00 -!- glengoyne [~glengoyne@p54947C39.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
16:02 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
16:03 -!- me345 [~me345@adsl-75-15-235-152.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:06 < krzee> rajkosto, windows 7?
16:06 < rajkosto> yes
16:06 < rajkosto> wont compile
16:06 < krzee> the dev mentioned that the other day
16:07 < rajkosto> visual studio 2008
16:07 < krzee> he said patches are coming soon
16:08 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
16:15  * oc80z reading up on VIA Padlock CPU's
16:15 < oc80z> evidently bulldozer (amd's new socket) will support the AES acceleration features 
16:15 < script_changed_n> whats the best windows gui vpn client
16:16 < oc80z> odd, because ive never heard of the acceleration settings. 
16:16 < oc80z> its like discovering all your jeeps have 4x4 drivetrain.
16:17 < boogerking> are there any minipci crypto hardware accelerators?
16:17 < oc80z> yea bK
16:18 < oc80z> http://goo.gl/e3Jmd
16:18 <@vpnHelper> Title: Soekris Engineering, Inc. - vpn14x1 (at goo.gl)
16:19 < oc80z> i didn not mean mini PCI express
16:20 < oc80z> •  Encryption, 128/192/256 AES, DES, 3-DES and RC4 at 210 to 460 Mbps
16:20 -!- script_changed_n [54eab6a4@gateway/web/freenode/ip.84.234.182.164] has quit [Quit: Page closed]
16:20 < oc80z> there seems to be lots of openssl hacks 
16:21 < oc80z> like in the wiki mentioned above (someone should mirror that),. there needs to be some openssl hacklery to keep it persistant.. 
16:22 < oc80z> ...anyways, its a great pitch for anyone in an AMD vs. Intel pissing argument.
16:23 < oc80z> 30% cpu savings? sold.
16:26 < boogerking> ty oc80z this vpn 1411 is very interesting
16:29 < oc80z> hmm
16:29 < oc80z> need to find some ah, case tests on em.
16:29 < oc80z> especially w/ openvpn. 
16:30 < oc80z> i am assuming the CPU's are Armel
16:30 < oc80z> i dont think these are being sold for N450/N550 Atoms.
16:31 < oc80z> (cause they are already AES_ready)
16:31 < oc80z> *shrug* let me knwo if u find anything, bout to git some cafe
16:31 < oc80z> l8rz
16:37 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
16:40 -!- LordDoskias [~nib9@unaffiliated/lorddoskias] has joined #openvpn
16:41 < LordDoskias> hello is there anyone online ?
16:42 < krzee> theres thousands of people online
16:43 < krzee> that would be amazing if there were a period of time with nobody online
16:43 < LordDoskias> i meant in this channel 
16:43 < LordDoskias> anyway, i'm gonna post my configs now and ask my question 
16:43 < krzee> i was joking, based on the fact that its best to just ask your question
16:43 < krzee> aka
16:43 < krzee> !ask
16:43 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, or (#2) http://www.latinsud.com/answer/, or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
16:43 < krzee> =]
16:46 < LordDoskias> http://privatepaste.com/d8e83980f4
16:46 < LordDoskias> so, here are y config files, the thing is when the client tries to connect it succeeds up to the point where it says "arp flush successfull on interface xxxxx"
16:46 -!- diemaco- [~freenode0@d204-191-182-51.abhsia.telus.net] has joined #openvpn
16:46 < LordDoskias> but apparently i cannot get settings from openvpn's dhcp server
16:47 -!- diemaco- is now known as diemaco
16:47 < LordDoskias> the server is debian and the client win 7 x64 if it matters
16:47 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
16:50 < LordDoskias> also, i can see that inside the VPN adapter the client only sends messages, and can't receive
16:50 < LordDoskias> but the firewall is disabled completely
16:51 < krzee> !logs
16:51 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
16:51 < krzee> you might have your problem because of your server line
16:51 < krzee> try using server 10.10.11.0 255.255.255.0
16:52 < LordDoskias> the thing is this configuration worked before o-O 
16:52 -!- diemaco [~freenode0@d204-191-182-51.abhsia.telus.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:52 < krzee> if my suggestions will all receive that answer its pointless for me to look further
16:52 -!- diemaco [~freenode0@d204-191-182-51.abhsia.telus.net] has joined #openvpn
16:54 < krzee> so decide now if you actually want help or not please =]
16:59 < LordDoskias> http://privatepaste.com/8ec54d78ff
16:59 < LordDoskias> here is my server log
17:00 < krzee> these logs are with my suggested change, right?
17:01 < LordDoskias> nope
17:01 < krzee> well...
17:01 < LordDoskias> okay, gonna try it now 
17:01 < krzee> and go update your openvpn
17:02 < krzee> 2.1rc11 is old and has known bugs
17:03 -!- boogerking [~sgoodpast@72.49.236.38] has quit [Quit: Leaving.]
17:03 < LordDoskias> well, i'm using the default one that comes with debian stable
17:04 < LordDoskias> anyway - no luck with your changes
17:06 < krzee> maybe in your repo, but trust me that is NOT the newest
17:06 < krzee> maybe on your CD it is or something
17:07 < krzee> at the worst they will have 2.1.4 as the latest
17:07 < krzee> if they are quick, they have 2.2 like the topic says
17:07 < krzee> !download
17:07 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
17:07 < krzee> i guess if you cant get something up to date through your package manager you get to install from source
17:07 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:07 < krzee> you are using an old buggy version
17:08 < LordDoskias> http://build.openvpn.net/downloads/releases/debian/5/
17:08 < LordDoskias> :D
17:08 <@vpnHelper> Title: Index of /downloads/releases/debian/5 (at build.openvpn.net)
17:08 < LordDoskias> at least it wont be from source 
17:14 < LordDoskias> also, out of curiosity - who develops the TAP driver 
17:14 < LordDoskias> is it the openvpn guys or some 3rd party 
17:15 < krzee> in linux its part of the OS
17:15 < krzee> in windows its developed by openvpn
17:16 < krzee> in freebsd its part of OS
17:16 < krzee> osX it is 3rd party
17:16 < krzee> i forget about opensolaris
17:16 < krzee> i think its part of the OS as well, but dont remember
17:16 < krzee> oh and s/freebsd/bsd/ above
17:17 < LordDoskias> thanks 
17:17 < LordDoskias> anyway, even with the latest version same thing
17:17 < krzee> cool, new logs please
17:21 < LordDoskias> http://privatepaste.com/f9ee8ab917 - server
17:22 < krzee> and client
17:22 < LordDoskias> 1 second
17:23 < LordDoskias> http://privatepaste.com/ac234026be
17:23 < LordDoskias> here you go
17:24 < krzee> ahh ok
17:24 < krzee> there we go
17:24 < krzee> !winroute
17:24 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
17:24 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
17:28 < krzee> try #1
17:28 < krzee> in fact use #1 and #2
17:28 < LordDoskias> #3 doesn't work 
17:28 < LordDoskias> gonna try this now, yes
17:29 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Operation timed out]
17:29 < LordDoskias> the thing is my interface won't come up at all 
17:29 < LordDoskias> it cannot even acquire an ip address
17:29 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
17:32 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
17:33 < LordDoskias> oh well, i will resort to the good old - restart 
17:33 < LordDoskias> :-) 
17:34 -!- LordDoskias [~nib9@unaffiliated/lorddoskias] has quit [Quit: Lost terminal]
17:37 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 276 seconds]
17:43 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
17:58 -!- diemaco is now known as diemaco-
18:01 -!- diemaco- [~freenode0@d204-191-182-51.abhsia.telus.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:01 -!- root is now known as UdontKnow
18:02 -!- boogerking [~sgoodpast@72.49.236.38] has joined #openvpn
18:04 -!- diemaco [~freenode0@d204-191-182-51.abhsia.telus.net] has joined #openvpn
18:07 -!- boogerking [~sgoodpast@72.49.236.38] has quit [Quit: Leaving.]
18:39 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
18:40 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
18:43 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
19:16 -!- Vutral [~ss@vutral.net] has quit [Ping timeout: 276 seconds]
19:25 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
19:26 -!- Vutral [~ss@vutral.net] has joined #openvpn
19:28 < rajkosto> if anyone wants openvpn 2.2 for windows with ipv6 support i've managed to compile it today, http://rajkonet.info/openvpn-ipv6-install.exe
19:34 -!- APTX [APTX@phpBB/developer/APTX] has quit [Changing host]
19:34 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
19:34 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:00 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
20:08 -!- master_of_master [~master_of@p57B544D2.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:10 -!- master_of_master [~master_of@p57B5706C.dip.t-dialin.net] has joined #openvpn
20:24 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 252 seconds]
20:40 -!- K1ng` is now known as k1ng
20:41 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
21:06 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Operation timed out]
21:19 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:ed3f:f975:85f9:fc13] has quit [Quit: Leaving]
21:21 -!- rich0 [~rich0@gentoo/developer/rich0] has joined #openvpn
21:23 < rich0> I have a question about setting up a bridged network - I'd like to use my network's dhcp server.  My first problem is creating a bridged interface at the OS level (Gentoo linux).  I couldn't find any command-line examples to set up the interface - they all leveraged distro configuration scripts.
21:25 < rich0> Right now when I try to set up the interface I end up losing network connectivity from the server to the local LAN.  I end up with both eth2 and br0 on the local network, with both interfaces having a route to the network, and the default pointing to eth2 (my normal adapter), so I'm not sure what is up with that...
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:05 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
23:21 -!- Arrick [~Arrick@unaffiliated/arrick] has joined #openvpn
23:23 < Arrick> hey all, I am trying to configure a windows 7 machine to use the openvpn client version 2.2.* something to run when the computer boots, anyone know how to do this? I have set the service to run automatically, and also tried the regedit with in hklm\software\windows\currentversion\run\ ....
23:23 < Arrick> I have verified that the service is running, but it is not logging in.
23:23 < Arrick> any ideas would be appreciated.
23:30 < pwrcycle> Arrick: if you're using win7 64bit i think there's an unresolved issue
23:30 < Arrick> its 32 bit
23:31 < Arrick> 32 bit professional to be exact
23:32 < pwrcycle> you might check the forums. 32 might be a prob. too. 
23:34 < Arrick> yeah, Im looking... everyone says it is able to do it, but I've not been successful with their manners. is there another client that will connect to openvpn?
23:38 < pwrcycle> Arrick: yes, there are other, like TunnelBlick, but that's for Mac.
23:39 < Arrick> grrr
23:39 < pwrcycle> i only use openvpn
23:39 < pwrcycle> !routing
23:39 < pwrcycle> !route
23:39 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
23:39 < pwrcycle> !ipforward
23:39 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
23:39 < pwrcycle> !linipforward
23:39 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
23:40 < Arrick> this machine is on a domain, and the vpn is openvpn, and this machine cant do the initial login, because I cant get the vpn to connect before login.
23:40 < pwrcycle> that all was for me
23:40 < Arrick> yeah
23:41 < pwrcycle> log files usually tell me what to do. make sure the client and server are append-log ing
23:41 < Arrick> yeah, they are.
23:46 < Arrick> ok, time to reboot and try again. brb
23:46 -!- Arrick [~Arrick@unaffiliated/arrick] has quit [Quit: Leaving]
--- Day changed Sun May 01 2011
00:02 -!- Arrick [~Administr@unaffiliated/arrick] has joined #openvpn
00:03 < Arrick> ok, I got it working, thanks.
00:07 -!- Arrick [~Administr@unaffiliated/arrick] has quit [Quit: Leaving]
00:16 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
00:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
00:55 -!- takamichi [Takamichi@46.11.92.98] has joined #openvpn
01:25 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:46 -!- k1ng [~KING@180.211.188.159] has quit [Ping timeout: 276 seconds]
01:58 -!- K1ng [~KING@119.30.39.38] has joined #openvpn
02:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
02:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:25 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 252 seconds]
02:26 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
02:37 -!- K1ng` [~KING@180.211.188.23] has joined #openvpn
02:38 -!- K1ng [~KING@119.30.39.38] has quit [Remote host closed the connection]
02:41 -!- diemaco [~freenode0@d204-191-182-51.abhsia.telus.net] has quit [Read error: Operation timed out]
02:42 -!- diemaco [~freenode0@hole.b00f.net] has joined #openvpn
02:44 -!- diemaco [~freenode0@hole.b00f.net] has quit [Client Quit]
02:47 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
02:52 <@vpnHelper> RSS Update - forum: Client slow when cpu busy (i.e youtube) <http://forums.openvpn.net/topic8044.html>
03:24 -!- ONEZEROZEROONE01 [loseweight@61.173.117.202] has joined #openvpn
03:24 < ONEZEROZEROONE01> how to add tap/tun to startup?
04:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
04:17 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
04:22 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11680>
04:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
04:29 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
04:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:12 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
05:21 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
05:39 -!- bystander [~rommel092@static.88-198-160-87.clients.your-server.de] has joined #openvpn
05:40 < bystander> does memory greatly affects the network/internet connection of the vpn?
05:40 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11681>
05:47 < Bushmills> bystander: nope. it uses what it needs, and doesn't benefit from more memory than that
05:49 < bystander> why do vps hosting sites offer as high as 4GB memory?
05:50 < Bushmills> because one may run stuff which benefit from memory.
05:51 < bystander> that clarifies it. so I dont need so much memory if i only run vpn, right?
05:51 < Bushmills> how is "vps" related to "vpn"?
05:52 < bystander> internet connection
05:52 < Bushmills> i'm running openvpn on a machine with 32 MiB RAM
05:53 < Bushmills> there it uses about 3 MiB
05:53 < bystander> really? how many users it can handle simultaneously?
05:54 < Bushmills> don't know. usually not more than 2, maybe 3, run though it concurrently
05:55 < bystander> you said with 32 mb ram, it uses only 3 mb for your 3 users. does that mean 1 mb per user?
05:57 < Bushmills> no, it uses about 3 MiB all the time
06:00 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
06:01 < bystander> how did you know that it is only 3 Mb that it use?
06:01 < Bushmills> http://scarydevilmonastery.net/snap/1304247633126807509d.png 
06:02 < bystander> using netstat?
06:02 < Bushmills> htop
06:03 < bystander> can you say that if I put up 512 mb, will that be sufficient for my vpn?
06:04 < Bushmills> i can't say that it will be sufficient for yours.  i can say it would be enough for mine
06:05 < bystander> whats is the purpose your openvpn so I may understand it further why it is enough for you.
06:05 < Bushmills> my previous computer had 512 MiB
06:05 < bystander> and?
06:05 < Bushmills> t'was enough
06:05 < bystander> was your openvpn for vpn purpose?
06:06 < Bushmills> yes. essentially, connecting machines on 4 locations
06:06 < bystander> same as mine.
06:06 < Bushmills> i'm currently about 30 km away from the machine in which i run the htop dump
06:07 < Bushmills> used vpn to log into that box
06:07 < Bushmills> other sites are about 200 km away
06:07 < bystander> can you suggest to me good vps host 
06:07 < Bushmills> how do you mean?
06:07 < bystander> i have seen one myself but maybe you have other vps that you know.
06:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
06:08 < bystander> i have seen one from virpus and elastichost
06:08 < Bushmills> no. can't. i prefer dedicated servers, and, if necessary, run vps on them myself
06:09 < bystander> dedicated server? can you run openvpn to run vpn on dedicated servers?
06:09 < Bushmills> yes, sure.
06:09 < bystander> I thought it is only possible on vps.
06:10 < Bushmills> dedicated server is like a vps without the "vp"
06:10 < Bushmills> or just without the "v"
06:10 < bystander> really? I once chat with one representative of the vps host and they also offer dedi but they said they dont offer vps but only dedi.
06:10 < Bushmills> on the contrary, not on all vps can you run openvpn. but on about all dedis can you
06:11 < Bushmills> "representative of the vps host says they don't offer vps" doesn't make a lot of sense
06:11 < bystander> I have message above yours.
06:11 < bystander> yes one representative told me that
06:12 < bystander> it confused me
06:12 < bystander> so is it the same procedure to setup the openvpn in dedi like with the setting up in vps?
06:12 < Bushmills> dedis are the whole machine.  vps are only a logical partition on it. 
06:13 < Bushmills> some software trying to mimick a real machine
06:13 < bystander> is there a difference in setting up openvpn in dedi over vps?
06:13 < bystander> never tried one myself yet
06:14 < Bushmills> as said, "dedicated server is a whole machine". just, like your desktop computer, but server form factor.
06:15 < Bushmills> restrictions don't apply to dedicated servers. they apply to VPS
06:15 < bystander> I got it. dedi is like vps but vps is only logical partition of the dedi.
06:15 < bystander> what restrictions could those be. can you give me some
06:16 < Bushmills> for example, that you can't run openvpn
06:16 < bystander> why can openvpn run in vps? i thought it can be?
06:16 < Bushmills> on some you can't
06:17 < bystander> oh
06:17 < bystander> why do other vps host need to request tun/tap to be enabled?
06:17 < Bushmills> because of those restrictions.  depends on the virtualisation technology used for the vps 
06:18 < Bushmills> because a VPS is only a pretend-to-be-a-computer
06:18 < ONEZEROZEROONE01> no bushmills
06:18 < ONEZEROZEROONE01> a VPS is also a real computer
06:18 < ONEZEROZEROONE01> with real resources
06:18 < Bushmills> ONEZEROZEROONE01: depends on virtualisation technology
06:18 < bystander> can we just enabled it ourselves if it is not enabled?  i have one vps that tun/tap not enabled and I need to request it first. can I just enable it myself without requesting for it?
06:19 < ONEZEROZEROONE01> im afraid all the big players in that area are 'real'
06:19 < Bushmills> bystander: possible not. depends on virtualisation technology
06:19 < ONEZEROZEROONE01> xen, virtuozzo
06:19 < bystander> can we just enabled it ourselves if it is not enabled?  i have one vps that tun/tap not enabled and I need to request it first. can I just enable it myself without requesting for it?
06:19 < Bushmills> ONEZEROZEROONE01: vserver, openvz, are more like  chroot on steroids.
06:19 < ONEZEROZEROONE01> ok
06:20 < ONEZEROZEROONE01> i can see your outlook on many things is pessimistic and cynical
06:20 < Bushmills> bystander: because your VPS may even not provide the required modules, or a mechanism to load them into the kernel. it may even not run its own private kernel to load those modules into-
06:22 < bystander> can I install myself the required modules and load it.  I once created the directory and loaded the modules but it says permission denied. Why is that?
06:22 < Bushmills> (13:20:54) Bushmills: bystander: because your VPS may even not provide the required modules, or a mechanism to load them into the kernel. it may even not run its own private kernel to load those modules into-
06:25 < Bushmills> or go with ONEZEROZEROONE01's misconception of "a VPS is also a real computer" and try to install a different operating system on it :P
06:26 < bystander> what I install there in centos 5 32bit
06:26 < bystander> openvz virtualization
06:26 < Bushmills> !openvz
06:26 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
06:26 < Bushmills> !openvz
06:26 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
06:27 < Bushmills> sry, had to repeat that as i had the bot on /ignore and couldn't see whether it produced any output
06:27 < bystander> i see the result
06:29 < bystander> thanks mills, I will read your openvz
06:30 -!- bystander [~rommel092@static.88-198-160-87.clients.your-server.de] has quit []
06:54 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 276 seconds]
07:07 <@vpnHelper> RSS Update - forum: windows 7 client bridging. <http://forums.openvpn.net/topic8045.html>
07:08 -!- Hlou [~Hlou@1-1-3-26a.mke.gbg.bostream.se] has joined #openvpn
07:09 < Hlou> Hi, I've setup openvpn and everything works great. My only problem is when I connect from a windows machine my syslog gets spammed with messages like "Need IPv6 code in mroute_extract_addr_from_packet". I don't use ipv6 so is there any way to supress this message or disable ipv6 from the windows machines completely?
07:45 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
07:54 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
08:05 -!- nijotz [~nick@173.255.220.4] has quit [Ping timeout: 260 seconds]
08:08 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Read error: Operation timed out]
08:27 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
08:32 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
08:35 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has left #openvpn []
08:39 -!- samu [s@unaffiliated/samaelszafran] has joined #openvpn
08:39 < samu> how can I make my client not being required for the cert?
08:39 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
08:39 < samu> server's using PAM auth only
08:39 < samu> but clients binary requires certs and keys
08:43 -!- Hlou [~Hlou@1-1-3-26a.mke.gbg.bostream.se] has quit [Ping timeout: 260 seconds]
08:45 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Operation timed out]
08:50 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
09:08 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:79b1:fbeb:ba18:cb95] has joined #openvpn
09:30 -!- samu [s@unaffiliated/samaelszafran] has left #openvpn []
09:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
09:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:43 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11683>
09:55 -!- samu [s@unaffiliated/samaelszafran] has joined #openvpn
09:56 < samu> This time another question - can I somehow bind some IPs into specified users?
09:56 < samu> I'm using pam, and (for instance) I would like user 'samu' to always have 172.0.0.10 
09:56 < samu> and don't allow any other user to use this ip
10:07 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
10:08 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
10:12 -!- nijotz [~nick@nijotz.com] has joined #openvpn
10:15 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
10:20 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
10:50 -!- mirco [~mirco@p5B23E106.dip.t-dialin.net] has joined #openvpn
11:21 -!- mirco [~mirco@p5B23E106.dip.t-dialin.net] has quit [Quit: mirco]
11:21 -!- mirco [~mirco@p5B23E106.dip.t-dialin.net] has joined #openvpn
11:22 -!- mirco [~mirco@p5B23E106.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
11:37 < Bushmills> what happens if there are two users at the same time logged in?
11:37 < Bushmills> (on the same machine)
11:47 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
11:48 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
11:59 < krzie> !authpass
11:59 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
11:59 < krzie> !static
11:59 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
12:02 < rajkosto> for mtu settings, do i need them on both sides of the tunnel ?
12:03 < rajkosto> also, it provides 2 mtu values to the up.sh script
12:19 < dvl> can OpenVPN do two factor authentication?  e.g. a certificate and a password?
12:27 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 246 seconds]
12:39 < krzie> dvl, yes
12:39 < krzie> dvl, see !authpass above
12:41 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
12:54 -!- Squidy [~quassel@189.72.179.180] has quit [Ping timeout: 240 seconds]
12:55 -!- mirco [~mirco@p5B23E106.dip.t-dialin.net] has joined #openvpn
13:03 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
13:09 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
13:10 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
13:10 -!- varta [~varta@unaffiliated/contempt] has joined #openvpn
13:15 < rajkosto> can i push link-mtu option ?
13:32 < krzie> im not ignoring, i just dont know much about mtu changing, never had to
13:32 < krzie> be back from krzee
13:32 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
13:42 < rajkosto> it would just be nice to know which options are pusable
13:46 < rajkosto> because link-mtu isnt
13:50 < krzee> see --push in the manual
13:53 < rajkosto> also mssfix does the same thing as iptables -j TCPMSS  --clamp-mss-to-pmtu
14:00 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
14:05 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Quit: Leaving]
14:25 -!- term_c [~ich@ppp-93-104-119-103.dynamic.mnet-online.de] has joined #openvpn
14:25 < term_c> !welcome
14:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:25 < term_c> !goal
14:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:26 < term_c> !interface
14:26 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
14:26 < term_c> !howto
14:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:28 < samu> I kinda doubnt that howto
14:28 < samu> i couldn't find any info on 'ifconfig-pool-persist' on that site
14:28 < samu> (or sth like this)
14:29 < krzee> !ipp
14:29 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
14:29 < krzee> try the manual when you want info like that
14:29 < krzee> lol
14:34 < term_c> !redirect
14:34 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:34 < term_c> !def1
14:34 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
14:48 -!- term_c [~ich@ppp-93-104-119-103.dynamic.mnet-online.de] has quit [Read error: Operation timed out]
14:49 -!- term_c [~ich@ppp-93-104-57-51.dynamic.mnet-online.de] has joined #openvpn
14:49 <@vpnHelper> RSS Update - forum: Please help with configuration... <http://forums.openvpn.net/topic8046.html>
15:07 < queequeg1> howdy, there seem to be lots of things broken about the openvpn batch scripts.
15:08 < queequeg1> http://paste.pound-python.org/show/5973/
15:08 < queequeg1> There is the error message that I get when I try to run build-ca.bat
15:09 < queequeg1> I was following the readme and edited the vars vile and ran the init script.
15:09 < queequeg1> I'm just not sure what is going wrong.
15:12 < krzee> so because its not working for you... so it must be broken
15:12 < krzee> the hundreds of thousands of people who use it without problem dont matter ;]
15:13 < krzee> !pki
15:13 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
15:13 <@vpnHelper> specially as a server (see !servercert)
15:13 < krzee> follow #1
15:15 < queequeg1> I just installed this windows 2003 server vm just to test this software out.  It is totally fresh.  I'm following the instructions that seem to be the same as the ones that you linked to.
15:15 < queequeg1> vars, clean-all, build-ca.  When I run build-ca I get that error.
15:18 < krzee> WARNING: can't open config file: c:\openssl/ssl/openssl.cnf
15:18 < krzee> NO idea why its looking in there, but seems pretty easy to fix...
15:19 < queequeg1> "error on line 150 of openssl.cnf"
15:19 < queequeg1> It opened the file.
15:19 < queequeg1> strange huh?
15:19 < krzee> no no
15:19 < krzee> your openssl.cnf wasnt found
15:20 < krzee> thats the source of the error you just mentioned
15:20 < krzee> line #2 is what you need to fix
15:20 < krzee> the rest is because of that
15:20 < queequeg1> But that doesn't make sense.  When I check out line 150 it says that it is looking for an OU key.  When I put that key into the vars file it goes on to fail on line 151.
15:21 -!- term_c [~ich@ppp-93-104-57-51.dynamic.mnet-online.de] has left #openvpn ["Verlassend"]
15:21 < krzee> dude
15:21 < queequeg1> So it is ready line 150.  If I fix what it is asking for on line 151 it goes on to the next line.  If put that variable in vars then it jumps to line 188 or something like that.
15:21 < krzee> accept my help or dont, it didnt find your openssl.cnf
15:22 < krzee> i assumed you came here cause you wanted help
15:22 < queequeg1> I understand what you are saying, but I'm proving to you that it was reading that file.
15:22 < queequeg1> Otherwise why would the error output change when I enter the variable it was asking for into vars.bat?
15:23 < queequeg1> I'm not trying to be a pain or a know it all.
15:24 < krzee> no you arent proving anything to me
15:24 < krzee> openssl.cnf wasnt found
15:24 < krzee> sure you can just put everything in your ENV 1 by 1 by adding to vars
15:24 < krzee> but common, better to just do it right, lol
15:25  * ecrist lols
15:25 < krzee> line 2 telling you the config wasnt found DID mean something, it wasnt for decoration
15:25 < krzee> and normally when looking at a series of errors, fixing the first one is the best place to start ;]
15:25 < krzee> since often times (like now) they cascade from the first
15:26 < queequeg1> How can it know where the error is in the file that it can't open?  That is what is driving me buggy.
15:27 < queequeg1> the file is there.
15:27 < krzee> lol
15:27 < krzee> the error isnt from openssl.cnf
15:27 < krzee> its from openssl, BECAUSE it cant read then config
15:27 < krzee> i will go no further with this problem, fix what i said or dont, doesnt matter to me :-p
15:27 < queequeg1> k
15:40 < queequeg1> I installed an earlier version and now that problem isn't happening.
15:43 < krzee> then it found your openssl.cnf this time
15:48 < queequeg1> Yeah, but I had uninstalled and reinstalled several time with the newest package and no dice.  It is just a default install.  I have no clue as to why it would not find it with the new package but does with an older one.
15:51 < krzee> gotchya
15:52 < krzee> i made a note to the devs, in case theres something they need to change there
15:52 < krzee> i would have just put the openssl.cnf in the dir it was looking for
15:53 < queequeg1> I'm just learning how to do this stuff.  I'm a bit intimidated by it.
15:58 < krzee> ahh
15:58 < krzee> sorry for not being more patient then
15:58 < queequeg1> No problem.  :-)
16:00 < queequeg1> I have done the server installation once before on on an xp machine with the installer that I just used that worked.  It is the one from the openvpngui site.
16:00 < queequeg1> I didn't get a connection working, but I completed the initial config and got it up.  I assume that some firewall issue was keeping it from working properly.
16:00 < queequeg1> Now I'm doing an installation on a vmware machine at home.
16:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:05 < queequeg1> so my server config file is set to the default interface (dev tun) but the virtual interface that it created on my system is "TAP-Win32 adapter V8)
16:06 < queequeg1> Does that TAP driver work for the tun setting as well?
16:09 < rajkosto> yes
16:13 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Quit: Lost terminal]
16:14 < dvl> Remember how I locked up my gateway on Friday?  now I know why... syntax error:
16:14 < dvl> See https://fbcdn-sphotos-a.akamaihd.net/hphotos-ak-ash4/222660_213601758659464_100000289239443_853914_1232542_n.jpg for what i did wrong.
16:24 < rajkosto> there's no way to enable lzo on certain clients only ?
16:25 < krzee> no
16:26 < krzee> dvl, oops!
16:26 < krzee> rc.conf typos suck
16:32 -!- mirco [~mirco@p5B23E106.dip.t-dialin.net] has quit [Quit: mirco]
16:32 -!- mirco [~mirco@p5B23E106.dip.t-dialin.net] has joined #openvpn
16:37 -!- mirco [~mirco@p5B23E106.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
16:39 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
16:41 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:43 < ecrist> dvl: oops.
16:43 < ecrist> especially when you're not local
16:44 < krzee> it was remote!?  ohhhh that sucks
16:49 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Quit: Lost terminal]
16:53 < queequeg1> OK, so I have the server running, but I can't connect to it.  I have tried to telnet to localhost 1194 and my nics ip 1194.
16:53 < queequeg1> The windows firewall is not running.
16:54 < queequeg1> I'm using telnet to test.
16:55 < queequeg1> netstat has this line: UDP    0.0.0.0:1194           *:*
16:56 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
16:57 < ecrist> um, you cannot use telnet to connect
16:58 < queequeg1> Oh, I haven't set a client up yet, I was hoping to just see if the port was responding.
16:58 < queequeg1> I guess I will setup the client then :-)
16:58 < queequeg1> I wasn't really trying to connect full on, I just wanted to be sure the port was responding.
17:03 < krzee> telnet is not for UDP
17:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:09 < queequeg1> I know better than that.  I guess I'm just being plain stupid today.
17:15 -!- buddha [~buddha@66.210.116.160] has joined #openvpn
17:16 < buddha> greetings. I am running a new OpenVPN server on a Mac OSX machine. I can connect to the server and internal resources fine, but cannot externally. I am pushing a default route. Do I need to NAT the OpenVPN subnet on the OSX server?
17:17 < buddha> !welcome
17:17 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:17 < buddha> !goal
17:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:18 < buddha> !wiki
17:18 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
17:21 < buddha> I have also enabled IP forwarding as an additional note. Not really finding an answer in the wikis... still looking
17:23 < buddha> !redirect
17:23 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
17:23 < buddha> !nat
17:23 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:23 < buddha> it seems I do need NAT 
17:23 < buddha> thanks :)
17:28 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
17:33 -!- K1ng` is now known as k1ng
17:57 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
18:00 -!- ONEZEROZEROONE01 [loseweight@61.173.117.202] has quit []
18:14 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:29 -!- azizLIGHTS [~azizLIGHT@ec2-50-17-254-25.compute-1.amazonaws.com] has joined #openvpn
19:13 -!- rajkosto [~rajkosto@2001:470:1f0b:1ce9:79b1:fbeb:ba18:cb95] has quit [Quit: Leaving]
19:13 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
19:14 < azizLIGHTS> whats the correct way to deal with "Windows requires a digitally signed driver" on windows7 ultimate 64 bit? i thought the installer includes the 64bit driver. i used openvpn-2.0.9-gui-1.0.3-install.exe
19:14 < ecrist> ping dvl
19:15 < ecrist> FYI, EmperorTom and I arrive 1611 EDT at YOW on Monday, May 9.  I'll be looking for my beer. ;)
19:15 -!- Vutral [~ss@vutral.net] has quit [Ping timeout: 246 seconds]
19:17 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
19:30 -!- Vutral [~ss@vutral.net] has joined #openvpn
19:36 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
19:36 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
19:36 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
20:04 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
20:04 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
20:08 -!- master_of_master [~master_of@p57B5706C.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
20:10 -!- master_of_master [~master_of@p57B55D9C.dip.t-dialin.net] has joined #openvpn
20:21 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
20:41 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:41 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:42 < bystander> does port speed plays a role in internet connection for vpn?
20:42 -!- Squidy [~quassel@189.72.179.180] has quit [Read error: Connection reset by peer]
20:50 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
20:52 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:53 < bystander> is port speed play a factor in internet connection speed?
20:58 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:20  * WebDawg http://abcnews.go.com/Blotter/osama-bin-laden-killed/story?id=13505703&page=2
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 250 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
23:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:33 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
23:39 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:54 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
23:56 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:57 < bystander> is port speed a factor in better internet connection
23:59 < jeev> what 'port' ?
--- Day changed Mon May 02 2011
00:00 < bystander> port speed. like 1000mbps or 100mbps port speed
00:00 < jeev> well obviously the higher the better but is this residential you are talking bout ?
00:00 < bystander> some vps host offer 100mbps and some have 1000mbps
00:01 < jeev> yea you always want the fastest but if your connection at home isn't extremely fast then it's useless in my opinion
00:01 < jeev> if you hvae 6mbit dsl at home, want to vpn to a VPS that has 100, that should be fine, no need to pay extra for 1000mbit
00:01 < bystander> so what do I have to do to get the full potential of the 1000mbps port speed that they offer
00:01 < jeev> are you using the VPS as a VPN?
00:01 < bystander> yes
00:02 < jeev> only?
00:02 < bystander> only
00:02 < jeev> how fast is your home connection
00:02 < bystander> I am using a wireless modem device to which I really dont know the capacity of it
00:03 < jeev> traceroute out, wh o is the isp
00:03 < bystander> how to use traceroute to determine the speed?
00:03 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11685>
00:03 < jeev> no, i just want to know the ISP
00:04 < jeev> go to www.speakeasy.net/speedtest or something
00:04 < jeev> doesn't fully determine the speed, unless if you're connected to a wifi on a verizon fios for example or some crazy gigabit connection
00:04 < jeev> you're probably connected at 802.11g anywya, 54mbit max and youwont see 54mbit
00:04 < jeev> so no need to pay for 1000mbit.
00:04 < jeev> port
00:05 < bystander> ah i see.
00:05 < bystander> so any wireless runs on 802.11g?  
00:06 < bystander> but what if there are numbers of users on the vpn? will 100mbps suffice?
00:08 < jeev> heh
00:09 < jeev> just pay for the gigabit then.
00:10 < bystander> jeev: I need advice because I have not much monetary resource.  So I would like to know if 100mbps would just suffice for it.
00:13 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:14 < jeev> doi a speedtest.
00:14 < jeev> www.speedtest.net
00:15 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
00:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
00:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
01:08 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11687> || Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11686>
01:11 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:14 <@vpnHelper> RSS Update - forum: protocol <http://forums.openvpn.net/topic8012.html#p11688>
01:20 <@vpnHelper> RSS Update - forum: Guidance needed on windows setup please <http://forums.openvpn.net/topic8043.html#p11689>
01:31 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has joined #openvpn
01:41 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has quit [Quit: mirco]
01:56 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11690>
02:01 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
02:01 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Read error: Connection reset by peer]
02:04 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
02:05 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
02:16 -!- mirco__ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:57 < MrWGW> good evening
02:57 < MrWGW> I'm having a slight annoyance
02:57 < MrWGW> I'm using a push "redirect-gateway def1" option on my openvpn system
02:57 < MrWGW> but hosts connected to it can't reach the outside world
02:58 < MrWGW> it is clearly pushing the def1 gateway, but the system isn't routing traffic all the way through
02:58 < MrWGW> I did do a iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
02:58 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
02:58 < MrWGW> and ipv4 forwarding is enabled
02:58 < MrWGW> suggestions?
02:59 -!- queequeg1_ [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
03:01 < MrWGW> seems to be pushing the wrong netmask
03:01 < MrWGW> actually
03:02 < MrWGW> teh server directive is 10.8.0.0 255.255.255.0 but the client got an IP address 10.8.0.6/30
03:02 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Ping timeout: 248 seconds]
03:02 -!- queequeg1_ is now known as queequeg1
03:08 < MrWGW> oh don't you know
03:08 < MrWGW> I needed a push route for 0.0.0.0 haha
03:10 -!- daemon_mum [~dima@mrdreamer.com] has quit [Read error: Operation timed out]
03:12 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
03:12 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
03:12 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:14 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Client Quit]
03:19 -!- dazo_afk is now known as dazo
03:36 -!- daemon_mum [~dima@mrdreamer.com] has joined #openvpn
03:49 -!- DroidAgent [~Niemand@81.30.41.194] has left #openvpn ["Leaving"]
04:10 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:10 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:50 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
05:10 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
05:16 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Ping timeout: 240 seconds]
05:23 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
05:23 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
05:23 -!- k1ng [~KING@180.211.188.23] has quit [Ping timeout: 260 seconds]
05:31 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
06:05 -!- Diffen [~diffen@95.209.54.57.bredband.tre.se] has joined #openvpn
06:07 < samu> any ideas how could I count tarffic per user in my vpn?
06:07 < samu> traffic*
06:09 < Bushmills> per "user"? network traffic doesn't carry such a "this traffic is from/to this user" tag
06:09 < Bushmills> network traffic goes from/to interfaces
06:15 < ele> iirc the post script identifies both the vpn session and the maount of data transferred
06:15 < ele> so if that would be sufficient?
06:15 < ele> and the openvpn management interface also contains this information
06:23 < Bushmills> won't work if one client has several users
06:24 < Bushmills> only thing you get by that is traffic per client
06:24 <@dazo> samu: ^^^ ele is right ... the --client-disconnect (script hook) or OPENVPN_PLUGIN_CLIENT_DISCONNECT hook for C modules will give you this info .... and the management interface is always more up-to-date, where you can poll (using the status command)
06:25 <@dazo> Bushmills: why won't it work with more users?
06:25 < Bushmills> because openvpn server knows nothing about "users" per vpn client
06:26 < Bushmills> it knows the total traffic from and to that client. 
06:26 < Bushmills> but samu asked about "traffic per user"
06:26 <@dazo> true, it only collects info about per openvpn client (which is what I interpreted as 'user')
06:27 <@dazo> but if you have more openvpn clients connecting to openvpn, they will be tracked individually ... but users behind the client, that's impossible to track in OpenVPN
06:28 < Bushmills> which is essentially what i said in my original reply. or meant to say, if the reply wasn't clear.
06:28 < samu> 13:25 < Bushmills> because openvpn server knows nothing about "users" per vpn client
06:28 < samu> 13:26 < Bushmills> it knows the total traffic from and to that client.
06:28 < samu> 13:26 < Bushmills> but samu asked about "traffic per user"
06:28 < samu> in fact - it does
06:28 < samu> I have PAM auth on that server.
06:28 < samu> which gives me some info about who is actually using the vpn
06:28 <@dazo> samu: users might not be the same as clients ... that's needs to be clarified
06:29 < Bushmills> and each user on your system has its own openvpn client instance?
06:29 < samu> No - but I can see that they're treaten individually
06:29 < samu> in openvpn-status.log I can see how many clients are currently connected
06:29 < samu> and some stats about them
06:30 < Bushmills> right. per client is not a problem
06:30 < samu> yeah, per client will be okay
06:30 <@dazo> yeah , that's per session information (where one or more sessions can be initiated by one or more openvpn clients)
06:30 < samu> as long there is some info about the user, as who the client authenticated
06:30 < samu> in this context: local unix username
06:34 -!- K1ng [~KING@180.211.188.211] has joined #openvpn
06:44 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
07:22 < ecrist> morning kids
07:26 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
07:30 -!- raomin [~romain@86.66.22.240] has joined #openvpn
07:39 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Quit: Ex-Chat]
07:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:59 <@vpnHelper> RSS Update - forum: Undefined Offset issue when connecting to VPN <http://forums.openvpn.net/topic7996.html#p11691>
08:08 -!- Blues-Man [~bluesman@188.11.17.81] has joined #openvpn
08:09 -!- help1Please [45f62553@gateway/web/freenode/ip.69.246.37.83] has joined #openvpn
08:09 < help1Please> hey
08:10 < help1Please> i just bought a vps, its debian running 64 bit & the 2.6.26-2 kernel, anyone care to help me setup a openvpn server,?
08:11 < hyper_ch> help1Please: apt-get install openvpn
08:15 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
08:15 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
08:15 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
08:25 < help1Please> hyper_ch was kinda hoping for a actual tutorial
08:27 < hyper_ch> !howto
08:27 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:38 -!- Diffen [~diffen@95.209.54.57.bredband.tre.se] has quit [Quit: Leaving]
09:01 <@vpnHelper> RSS Update - forum: Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11692>
09:18 -!- ONEZEROZEROONE01 [ONEZEROZER@61.173.117.202] has joined #openvpn
09:20 < ONEZEROZEROONE01> how to make tap/tun interfaces load on startup of virtuozzo centos install
09:21 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:24 < ecrist> no clue
09:28 < gladiatr> ONEZEROZEROONE01, centos 5?
09:29 < ONEZEROZEROONE01> yes
09:29 < ONEZEROZEROONE01> my host provider enabled it for me but i dont think they know how to add it to startup
09:29 < ONEZEROZEROONE01> or are unwilling
09:29 < ONEZEROZEROONE01> after restart i can't start the openvpn service 
09:29 < gladiatr> start over.  enabled what?  openvpn?
09:31 < ONEZEROZEROONE01> i have a vps running centos 5.5. The virtualisation used is virtuozzo. The hosting company enabled the tap/tun on it for me so that openvpn would work. However, after i restarted the vps, i lost tap/tun and openvpn won't start. So i'm wondering how to add tap/tun module to startup of the vps so that i am free to restart the vps without losing the ability to use openvpn. I use push gateway 
09:31 < ONEZEROZEROONE01> option and need tap/tun.
09:31 -!- Blues-Man [~bluesman@188.11.17.81] has quit [Quit: Sto andando via]
09:33 < ONEZEROZEROONE01> if i knew the procedure, command to do it then i think i could convery to them better what i need them to do
09:33 < ONEZEROZEROONE01> my last attempt at asking them to do this resulted in them just enabling it again but not setting it to startup with the vps
09:34 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
09:36 -!- jbeez [jbeez@pool-96-245-221-98.phlapa.fios.verizon.net] has joined #openvpn
09:36 < jbeez> Hallo
09:36 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Ping timeout: 264 seconds]
09:48 < gladiatr> ONEZEROZEROONE01, hrm... well, the CLI to load the tun driver is modprobe tun
09:48  * dazo thinks ONEZEROZEROONE01 got a really annoying nick ...
09:49  * gladiatr thinks dazo is correct :P
09:50 < hyper_ch> why is that annoying?
09:51 <@dazo> because BIGLETTERSARESCREAMINGINMYFACE ;-)
09:51 -!- ONEZEROZEROONE01 [ONEZEROZER@61.173.117.202] has quit [Ping timeout: 240 seconds]
09:51 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
09:51 -!- ONEZEROZEROONE01 [ONEZEROZER@61.173.117.202] has joined #openvpn
09:52 < ONEZEROZEROONE01> http://pastebin.com/KsQEXq5e
09:52 < gladiatr> dazo prefers to be beaten by irc nicks no earlier than noon.  Afterwards it requires a $100 donation.
09:52 < ONEZEROZEROONE01> [root@15557 ~]# modprobe tun
09:52 < ONEZEROZEROONE01> FATAL: Could not load /lib/modules/2.6.18-028stab069.6/modules.dep: No such file or directo
09:53 <@dazo> gladiatr: lol
09:53 < ecrist> ONEZEROZEROONE01: your question belongs in the virtuozzo channel, or a linux channel, not here.
09:53 < gladiatr> ok.  So it's not actually a centos 5 install.  You'll need to contact your vps provider.
09:53 < gladiatr> yar
09:54 <@dazo> ONEZEROZEROONE01: I believe this needs to be tackled by your VPS provider .... openvz and virtuozzo is more like containers than real virtualisation solutions
09:54 < ONEZEROZEROONE01> well it is centos 5
09:54 <@dazo> If it had been Xen or KVM, it would be as simple as a modprobe ... otherwise, it's managed by the VPS sys-admin
09:55 < ONEZEROZEROONE01> ok
09:55 < ecrist> wrong channel, sorry
09:55 < ONEZEROZEROONE01> is there a virtuzzo channel
09:55 <@dazo> dunno ... search for it
09:57 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
09:58 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
09:59 < ONEZEROZEROONE01> i dont understand why they chose virtuozzo
09:59 < ONEZEROZEROONE01> xen sounds much better
10:00 < ecrist> and, for the record, your nick is really annoying
10:00 < ONEZEROZEROONE01> ha
10:00 < ONEZEROZEROONE01> its binary
10:00 < ONEZEROZEROONE01> i thought cool...
10:01 < ecrist> onezerozeroone01
10:01 < ecrist> would be better
10:01 <@dazo> +1
10:01 < ecrist> THEN YOU DON'T LOOK LKE YOU'RE SCREAMING AT EVERYONE
10:01 <@dazo> ONEZEROZEROONE01: xen < KVM
10:02 < ecrist> * < FreeBSD Jails
10:02  * gladiatr chuckles
10:02 < gladiatr> ecrist, you whore
10:02 <@dazo> ecrist: those jails can't run other OSes ;-)
10:02 < ecrist> why would you want to run anything than freebsd?
10:02 <@dazo> lol
10:02 < ecrist> you're thinking is backwards, dazo. ;)
10:02  * dazo expected that answer ;-)
10:03 < gladiatr> indeee
10:03 < gladiatr> d
10:03 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
10:03 <@dazo> ecrist: I run something else, because my employer pays me to do my work on something else ;-)
10:04  * ONEZEROZEROONE01 ponders changing nick name
10:04 <@dazo> ONEZEROZEROONE01: stop pondering ... JUST DO IT!
10:04 < ONEZEROZEROONE01> i've seen worse nicknames
10:04 <@dazo> We don't care
10:04 <@dazo> yours are the one being annoying now ;-)
10:05 < ecrist> too bad we can't ban on regex
10:05 -!- ONEZEROZEROONE01 is now known as dazoo
10:05 < dazoo> ok now?
10:05 -!- dazoo was kicked from #openvpn by dazo [dazoo]
10:05 -!- dazoo [ONEZEROZER@61.173.117.202] has joined #openvpn
10:05 < dazoo> why kick?
10:05 < dazoo> it was a joke ok
10:05 < dazoo> i change 
10:05 < ecrist> lol
10:05 -!- dazoo is now known as thisnickiscool
10:05 <@dazo> why kick?  Because I could!
10:06 < ecrist> nice to see someone other than me being as ass for a change.
10:06 < ecrist> :D
10:06 < thisnickiscool> absolute power corrupts absolutely
10:06 <@dazo> lol
10:06 < ecrist>  /ban ^.*[A-Z]+.*
10:06 <@dazo> lol
10:07 <@dazo> that one is intriguing ...
10:09 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:12 -!- K1ng [~KING@180.211.188.211] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
10:17 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has joined #openvpn
10:18 < dkr>  /ban [A-Z]
10:18 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
10:18 < dkr> extraneous use of .* is a common mistake. :)
10:19 < gladiatr> hrm... unless you're looking to match non alpha characters
10:20 < dkr> yeah, I'd actually like to ban [^a-z] :)
10:21 -!- mirco__ [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
10:22 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:22 -!- K1ng [~KING@180.211.188.211] has joined #openvpn
10:26 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:29 -!- queequeg1_ [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
10:29  * dazo will the change his nick to 0xdac0
10:30 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Ping timeout: 248 seconds]
10:30 -!- queequeg1_ is now known as queequeg1
10:30 -!- cpf_ [~cpf@d515306D2.static.telenet.be] has quit [Remote host closed the connection]
10:34 -!- K1ng [~KING@180.211.188.211] has quit [Ping timeout: 264 seconds]
10:35 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
10:35 -!- K1ng [~KING@180.211.188.211] has joined #openvpn
10:37 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
10:40 <@vpnHelper> RSS Update - forum: Connection work without the right OPENPNV KEY !!!!!! <http://forums.openvpn.net/topic8047.html>
10:40 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:46 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:52 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:53 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
11:04 <@vpnHelper> RSS Update - forum: Connection work without the right OPENPNV KEY !!!!!! <http://forums.openvpn.net/topic8047.html#p11694>
11:10 < jbeez> if I setup openvpn on a server that already has an openssl CA setup, do I still need to use the one in the openvpn directory? Or can I use the systemwide CA thats already setup?
11:11 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
11:12 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
11:21 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has joined #openvpn
11:22 -!- jbeez [jbeez@pool-96-245-221-98.phlapa.fios.verizon.net] has left #openvpn []
11:28 < krzie> !learn gigabit as https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
11:28 <@vpnHelper> Joo got it.
11:28 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
11:30 < gladiatr> sweet write-up
11:32 < help1Please> i wish setting openvpn up on linux was easier ^.^
11:32 < krzie> its as easy as any other OS
11:32 < krzie> assuming you know how to use the os
11:32 < help1Please> well, just in general
11:32 < Essobi> It's pretty easy, imo.
11:35 < gladiatr> yar.  When you put it next to ipsec, it's a veritable cake walk
11:35 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has joined #openvpn
11:35 < help1Please> the windows vpn thing was the easiest for me, but im just a nub @ linux ^.^
11:36 < krzie> so you dont wish that "setting up openvpn" on linux was easier
11:36 < krzie> you wish that you knew linux better
11:36 < krzie> ;]
11:37 < hyper_ch> setting up openvpn on linux is difficult?
11:37 < krzie> hyper_ch, nope
11:37 < krzie> ;]
11:37 < help1Please> a little of both : - p
11:37 < hyper_ch> hey mister :)
11:37 < help1Please> gui would be better >:)
11:37 < hyper_ch> gui? what for?
11:38 < krzie> help1Please, learn linux ;]
11:39 < krzie> ive had *1* non-virtual machine install of *nix with a gui, i only installed X so i could use my tv tuner card
11:40 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
11:41 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
11:48 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has joined #openvpn
12:12 -!- Netsplit *.net <-> *.split quits: caesay, cron2, hpa, sedulous, Fiouz, ScriptFanix, dkr, Champi, mirco, takamichi,  (+9 more, use /NETSPLIT to show all of them)
12:12 < help1Please> mmmm
12:12 -!- Netsplit over, joins: mirco, cron2, Fiouz, takamichi, hpa, ScriptFanix, LuckyY, SWAT, Champi, sedulous (+9 more)
12:12 -!- mode/#openvpn [+o cron2] by ChanServ
12:12 < help1Please> well, i almost got it working, its just that its going to the wrong ip? Mon May 02 13:12:34 2011 UDPv4 link remote: 66.129.99.88:1194  <- not my vps ip ^_^
12:13 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:15 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
12:15 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
12:15 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:15 -!- troker [~troker_@pool-72-70-55-143.bstnma.fios.verizon.net] has joined #openvpn
12:17 < krzee> help1Please, look at your config
12:17 < krzee> and dont just copy someone else's config blindly
12:18 < troker> hey all -- Im having an issue with my openvpn-as box Im setting up.  I can connect from the outside but I cant seem to ping an internal server.  I tracert'ed it and I get traffic going into my network, but it never makes it out.  I created a route then, on my vpn network with the gateway set as my ovpn server on, on my router.  But still same issues -- any ideas?
12:18 < krzee> !AS
12:18 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
12:18 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
12:18 < krzee> #4, we dont suppot AS here
12:20 < troker> alright - got it.  Although I dont feel this is an AS issue.  I can connect to the server totally fine.  In you experence with openvpn do you think this looks like a networking issue?
12:21 < krzee> i could tell you what to do in openvpn
12:21 < krzee> but its all a moot point
12:21 < krzee> !route
12:21 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:22 < krzee> you need AS support
12:22 < troker> Ill check that out - thanks krzee 
12:23 < krzee> feel free to check it out for info, but you really want #4 above, i would expect AS to setup things right for you given its configursed correctly
12:26 < troker> Sorry if I sound ignorant here - I dont have much experence with openvpn/openvpn-as -- Im currently testing/setting up an AS server as it seemed a little simpler from a user standpoint and the licencing was afordable.  I was under the impression that it operates identically to a regular openvpn server.  Is there a major difference that I'm missing?
12:27 < krzee> *anything* AS related belongs at #4 above, not in here
12:27 < krzee> yes, the major difference is the rest of !AS
12:27 < krzee> read it above ;]
12:28 < krzee> AS uses a specially patched openvpn in its core, but its definitely not the same as openvpn
12:28 < krzee> and it even comes with professional support!
12:28 < krzee> and live chat which i believe is active right now
12:30 < troker> great thanks!
12:30 < krzee> np =]
12:30 < help1Please> krzee i got it to connect but it looks like it assigned a lan ip instead of my vps's?
12:31 < help1Please> it assigned me 10.8.0.1 
12:31 < krzee> of course, as defined in --server
12:31 < krzee> !redirect
12:31 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:31 < krzee> !linnat
12:31 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
12:31 < krzee> !linipforward
12:31 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
12:31 < krzee> !def1
12:31 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
12:32 < krzee> you must do those 3 things if your goal is to make all inet traffic flow through the vpn
12:35 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:36 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:41 < help1Please> kraut: would i have to restart the vps now, or just /etc/init.d/openvpn restart ,?
12:41 < kraut> i think the last one would fit
12:41 < kraut> but it would be better to ask krzee ;)
12:42 < help1Please> oh sorry, tab fail
12:42 < kraut> ;)
12:44 -!- troker [~troker_@pool-72-70-55-143.bstnma.fios.verizon.net] has quit [Quit: leaving]
12:45 < krzee> heheheh
12:45 < krzee> moinmoin kraut
12:45 < krzee> kraut, actually iirc you are a linux user, he prolly got lucky to tab complete to you ;)
12:46 < kraut> linux, unix, windows... depends ;)
12:46 < help1Please> Mon May 02 13:45:58 2011 CreateFile failed on TAP device: \\.\Global\{5DA5533A-FD9E-4D66-9CF9-78CACE02D39D}.tap Mon May 02 13:45:58 2011 All TAP-Win32 adapters on this system are currently in use. 
12:46 -!- rommel092079 [58c6a057@gateway/web/freenode/ip.88.198.160.87] has joined #openvpn
12:46 < help1Please> ehhh windos ^_^
12:46 < kraut> krzee: howdy, too
12:46 < rommel092079> can I free up my RAM?
12:47 < krzee> help1Please, its already running!
12:47 < krzee> rommel092079, by learning your OS and killing processes eating your ram?  do you have an openvpn related question? :-p
12:47 < help1Please> krzee: the adapter never disconnected from when i restarted it
12:48 < help1Please> ohhh my fail yet again >.<
12:49 < krzee> ;]
12:50 < help1Please> It's still not working though ;<
12:50 <@vpnHelper> RSS Update - forum: Sending multicast over a openvpn tunnel <http://forums.openvpn.net/topic8036.html#p11695>
12:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:59 -!- rommel092079 [58c6a057@gateway/web/freenode/ip.88.198.160.87] has quit [Quit: Page closed]
12:59 < help1Please> well i'm stumped. absolutely no idea what im doing wrong/right, suppose i will reinstall i guess ^.^
12:59 -!- clyons [~clyons@unaffiliated/clyons] has quit [Quit: Leaving]
13:17 -!- sj7trunks [~Adium@171.67.171.43] has joined #openvpn
13:21 -!- dazo is now known as dazo_afk
13:23 -!- help1Please [45f62553@gateway/web/freenode/ip.69.246.37.83] has quit [Ping timeout: 252 seconds]
13:24 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
13:24 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
13:24 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
13:35 -!- p3rror [~mezgani@41.248.111.242] has joined #openvpn
13:40 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
13:40 -!- Vutral [~ss@vutral.net] has quit [Ping timeout: 276 seconds]
13:41 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
13:41 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
13:41 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
13:50 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
13:51 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
13:56 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has joined #openvpn
13:59 -!- Vutral [~ss@vutral.net] has joined #openvpn
14:12 -!- mirco [~mirco@p5B23ACFB.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
14:15 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
14:19 <@vpnHelper> RSS Update - forum: Low throughput <http://forums.openvpn.net/topic8048.html>
14:38 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
14:43 <@vpnHelper> RSS Update - forum: Low throughput <http://forums.openvpn.net/topic8048.html#p11697>
14:43 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
14:48 -!- p3rror [~mezgani@41.248.111.242] has quit [Remote host closed the connection]
14:50 -!- p3rror [~mezgani@41.248.111.242] has joined #openvpn
15:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:43 -!- term_c [~ich@ppp-93-104-118-147.dynamic.mnet-online.de] has joined #openvpn
15:43 < term_c> !goal
15:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:44 < term_c> !welcome
15:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:44 < term_c> !route
15:44 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:51 -!- zeshoem [~mnathani@bas1-toronto46-1177856523.dsl.bell.ca] has quit [Ping timeout: 248 seconds]
15:57 -!- zeshoem [~mnathani@bas1-toronto46-1177856523.dsl.bell.ca] has joined #openvpn
16:00 -!- term_c [~ich@ppp-93-104-118-147.dynamic.mnet-online.de] has quit [Ping timeout: 252 seconds]
16:01 -!- p3rror [~mezgani@41.248.111.242] has quit [Quit: Leaving]
16:05 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:27 -!- freaky[t] [alpha@freakyy.de] has quit [Remote host closed the connection]
16:31 < dvl> ecrist: I got your cheque for BSDCan today.  However, you and Thomas each need to register at http://www.bsdcan.org/2011/registration.php <-- when that is done, I can process the payment, which was deposited today.
16:31 <@vpnHelper> Title: BSDCan 2011 - Registration (at www.bsdcan.org)
16:33 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
16:41 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:42 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Connection reset by peer]
16:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:47 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has joined #openvpn
16:52 -!- sj7trunks [~Adium@171.67.171.43] has quit [Quit: Leaving.]
16:56 -!- freaky[t] [alpha@freakyonline.de] has quit [Remote host closed the connection]
17:00 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
17:13 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
17:16 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
17:19 -!- nightwalk [~null@daimon.vixel.org] has joined #openvpn
17:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
17:20 < nightwalk> Any ideas why an openvpn client would add pushed routes with a gateway of '255.255.255.0'? I'm using 'dev tun', and the server-side directive I think is causing this is 'server 10.8.0.0 255.255.255.0'
17:20 < nightwalk> btw, everything else in this arrangement is known to work. It only breaks when I switch from 'dev tap' to 'dev tun'
17:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
17:40 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
17:42 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:47 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Quit: Távozom]
17:48 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
18:23 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11698>
18:55 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:24 < ecrist> dvl: roger, will do that now.
19:25 < dvl> ecrist: not long now!
19:25 < krzee> nightwalk, what pushed routes exactly... your description said almost nothing
19:25 < ecrist> I'm excited.  Just confirmed UofO has our check for residence, as well, so we're all paid up
19:25 < ecrist> just need to bring beer money. :)
19:31 < ecrist> dvl: both registrations are in now.
19:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
20:09 -!- master_of_master [~master_of@p57B55D9C.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:11 -!- master_of_master [~master_of@p57B55A11.dip.t-dialin.net] has joined #openvpn
20:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:15 < nightwalk> krzee: *any* pushed route. ex from the client-specific config file: push "route 1.1.1.1 255.255.255.255"
20:15 < krzee> pushed route in a client specific config file?
20:15 < nightwalk> indeed
20:15 < krzee> you mean a ccd entry?
20:15 < nightwalk> indeed
20:16 < nightwalk> As I said, it works if I use 'dev tap', but not if I switch to 'dev tun'
20:16 < krzee> thats weird...
20:16 < krzee> !CONFIGS
20:16 <@vpnHelper> "CONFIGS" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
20:17 < krzee> whoa, weird
20:18 < krzee> caps was accident, i thought my bot was case sensitive
20:18 < krzee> guess not =]
20:18 < nightwalk> The gateway for the routes get set to 255.255.255.0 client-side, almost like it's using the netmask for both the gateway and netmask. I've looked, and apparently none of the commands accept a gateway option, so no way to force it
20:20 < krzee> route-gateway
20:20 < krzee> but that shouldnt be needed
20:20 < krzee> since the gateway is the vpn link by default
20:20 < krzee> and you push the route when you want the traffic to flow over the vpn
20:20 < krzee> just post the configs
20:21 < krzee> also include what version of openvpn you are using on each end
20:22 < nightwalk> Normally, I would've pasted the configs first. However, in this case, there are too many IPs to mask
20:24 < krzee> if you're gunna be masking ips with this problem, dont bother posting them
20:24 < krzee> i dont care enough, and you care too much
20:25 < nightwalk> The version is easy enough, though. It's the one included in Fedora 14 (2.1.1) client-side, and the one from Fedora 11 (2.1.3)
20:25 < nightwalk> Well, I think you gave me the answer already, in any case. Just have to leaf through some google results now. Thank you :)
20:26 < krzee> np
20:26 < krzee> out of curiousity, what did you think i said that was an answer?
20:26 < nightwalk> route-gateway
20:27 < krzee> wont fix your problem
20:27 < nightwalk> How so? Shouldn't it override whatever is supplying the 255.255.255.0?
20:28 < krzee> nope
20:28 < krzee> dunno why you think it would
20:28 < krzee> but no
20:28 < krzee> in fact it might simply be a bug in your version
20:29 < krzee> i know some other issues related to setting routes were fixed
20:29 < nightwalk> Might also be a bug fedora introduced with all of their infernal patches, too :/
20:29 < krzee> but since your config is top secret, i wont be seeing that
20:29 < krzee> just install from source, lol
20:29 < krzee> !download
20:29 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
20:30 < nightwalk> No...I don't do that directly. Building directly from source isn't something that results in a reproducible install
20:30 < krzee> hahaha
20:30 < nightwalk> I usually just grab the srpms or deb sources, strip out the cruft, and set 'em to rebuilding
20:31 < krzee> oh the windows of the unix world, so funny
20:31 < nightwalk> Not really. I used to LIKE building from sources, but that was back when I had the time to futz with it
20:32 < krzee> "time" to type ./configure && make install clean
20:32 < krzee> you're right, that would be crazy
20:32 < nightwalk> Better to let the package managers take care of pulling in all of the dependencies for me. There's no value in having to go back and rtfd every time I need to make a minor version bump
20:32 < krzee> totally unreproducable
20:32 < krzee> lol
20:33 < krzee> anyways, best of luck man
20:33 < nightwalk> For most packages, your example installs to /usr/local. It can differ from package to package, though
20:34 < krzee> cool, ttyl
20:34 < nightwalk> If you want to install to specific locations, and reproduce the build across tons of distros, you need a more finely-tuned configure
20:35 < nightwalk> Well...I appreciate the attempt at helping, but the condescending/rude attitude I could do without.
20:35 < nightwalk> Anyway, 'dev tap' works and is functionally equivalent to 'dev tun' in this usage scenario, so I guess I'll stick with that for the time being
20:36 -!- nightwalk [~null@daimon.vixel.org] has left #openvpn []
20:40 < krzee> !learn topsecret as if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
20:40 <@vpnHelper> Joo got it.
21:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:15 -!- K1ng [~KING@180.211.188.211] has quit [Ping timeout: 240 seconds]
21:16 -!- K1ng [~KING@180.211.188.201] has joined #openvpn
21:23 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
21:27 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
21:36 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:15 -!- K1ng [~KING@180.211.188.201] has quit [Ping timeout: 252 seconds]
22:17 -!- K1ng [~KING@180.211.188.251] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:59 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
23:17 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:21 < gyyrog> where is the executable "openvpn" stored in centos
23:21 < gyyrog> ?
23:21 -!- freetown2 [~freetown2@ipvpn098241.netvigator.com] has joined #openvpn
23:22 -!- freetown2 [~freetown2@ipvpn098241.netvigator.com] has left #openvpn ["Leaving"]
23:35 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
23:35 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
23:35 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:38 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
23:44 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
23:47 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Read error: Connection reset by peer]
23:49 -!- dvl [~dvl@nyi.unixathome.org] has joined #openvpn
23:51 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:52 < bystander> good day! what do I need to backup with my openvpn with users and user details on it?
23:54 < krzie> depends on your setup
23:54 < krzie> in mine it would be my config and certs
23:54 < krzie> or for server, my config / certs / and ccd dir
23:55 < bystander> i have backed up my config and certs. how about my user details? where do get those details?
23:56 < krzie> you enabled username / password auth?
23:56 < krzie> if so, it depends how you decided to store usernames and passwords, that is outside of openvpn
23:57 < bystander> ok
23:57 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
23:57 < krzie> if not, you seem to not understand PKI very well
23:57 < krzie> meh i should have let him flyby, i bet he would have only waited 5min
--- Day changed Tue May 03 2011
00:09 -!- Essobi [~Essobi@74.128.53.127] has quit [Quit: Lost terminal]
00:10 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
00:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:26 < Bushmills> rudeness!
00:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:00 -!- K1ng [~KING@180.211.188.251] has quit [Ping timeout: 246 seconds]
01:02 -!- thisnickiscool [ONEZEROZER@61.173.117.202] has quit []
01:10 -!- dayangkun [~dayangkun@114.249.228.174] has joined #openvpn
01:13 -!- p3rror [~mezgani@41.248.111.242] has joined #openvpn
01:16 -!- K1ng [~KING@180.211.188.18] has joined #openvpn
01:21 <@vpnHelper> RSS Update - forum: Low throughput <http://forums.openvpn.net/topic8048.html#p11699>
01:25 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:29 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
01:33 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11701> || Low throughput <http://forums.openvpn.net/topic8048.html#p11700>
01:51 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
01:55 < Bushmills> gyyrog: unixoids have a great facility to find executables in the PATH:  which
01:57 < Bushmills> for things not in PATH, but installed with the distribution specific package manager, they are commonly capable to list files and locations of an installed archive.
02:03 -!- dayangkun_ [~dayangkun@114.249.228.174] has joined #openvpn
02:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:07 -!- dayangkun [~dayangkun@114.249.228.174] has quit [Ping timeout: 276 seconds]
02:09 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Ping timeout: 246 seconds]
02:12 -!- mirco__ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:13 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
02:14 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
02:14 -!- mirco__ is now known as mirco
02:22 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
02:45 <@vpnHelper> RSS Update - forum: Connected to VPN, able to ping but no internet access <http://forums.openvpn.net/topic8027.html#p11702>
02:49 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
02:55 -!- dazo_afk is now known as dazo
03:03 <@vpnHelper> RSS Update - forum: Windows Server 2008 network location/firewall issue <http://forums.openvpn.net/topic8049.html>
03:09 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
03:09 -!- K1ng` [~KING@180.211.188.89] has joined #openvpn
03:10 -!- K1ng [~KING@180.211.188.18] has quit [Ping timeout: 252 seconds]
03:12 -!- Skyx [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
03:12 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
03:26 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:26 <@vpnHelper> RSS Update - forum: Low throughput <http://forums.openvpn.net/topic8048.html#p11705> || Windows Server 2008 network location/firewall issue <http://forums.openvpn.net/topic8049.html#p11704>
03:49 < norc> I have a VPN tunnel over tcp (udp is not an option), but I get constant latency spikes, bandwidth heavily fluctuating. I'm guessing this is due to TCP retransmission in both layers / meltdown. Is there a way to counteract this?
03:51 <@vpnHelper> RSS Update - forum: Low throughput <http://forums.openvpn.net/topic8048.html#p11706>
03:53 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:55 -!- Skyx [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
04:02 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 276 seconds]
04:03 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
04:07 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has joined #openvpn
04:07 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has quit [Changing host]
04:07 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:12 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:12 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:12 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:13 -!- takamichi [Takamichi@46.11.92.98] has quit [Remote host closed the connection]
04:19 -!- dayangkun_ [~dayangkun@114.249.228.174] has quit [Read error: Connection reset by peer]
04:20 -!- dayangkun_ [~dayangkun@114.249.208.24] has joined #openvpn
04:25 -!- lamba [~lamba@www.siology.net] has joined #openvpn
04:29 < lamba> lo all. Has anyone run openvpn on windows as non admin ?
04:29 < lamba> ive added the normal user to the network config operators usergroup, but still cant add routes. permission denied. 
04:30 < lamba> win7. 
04:31 <@vpnHelper> RSS Update - forum: Windows Server 2008 network location/firewall issue <http://forums.openvpn.net/topic8049.html#p11707>
04:37 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11708>
04:42 < lamba> anyone home ? cant all be idle ! :)
04:45 < AL13N_work> lamba: why not?
04:46 < Bushmills> or no windows users around
04:48 < hyper_ch> [11:46] <Bushmills> or no windows users around <-- this
04:50 < lamba> ;( 
04:51 < lamba> read somewhere that this should work so sort of hit a brick wall. was hoping a dev would know for certain. im a linux person so bit out of my depth on the windows openvpn clients. 
04:52 -!- maxJadi [~maxJadi@dhcp-164-80.nomad.chalmers.se] has joined #openvpn
04:52 -!- maxJadi [~maxJadi@dhcp-164-80.nomad.chalmers.se] has quit [Changing host]
04:52 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:57 < Bushmills> maybe there where it says that it should work it also says what must be done to make it work
05:00 -!- zooz [~zooz@host86-164-80-134.range86-164.btcentralplus.com] has joined #openvpn
05:00 < zooz> hi people
05:00 < hyper_ch> hi zooz
05:00 < lamba> hmm, might have fixed it. dont know why though. i googled for the step i had about network operator group and anouther page had a second step to turn on xp compatibility mode on the gui exe. seems to have done the job, but i dunno why.
05:01 < zooz> is there a way to reload openvpn daemon without getting disconnected from the vpn? (linux)
05:08 < janjust> zooz: nope, but automatic reconnect is possible
05:08 < janjust> if it were possible to restart the daemon without the client noticing it would be a security hole
05:08 < zooz> automatic reconnect on the client side you mean?
05:08 < janjust> yep zooz
05:09 < zooz> k, thanks
05:09 < janjust> lamba: only users who are a member of the Network Administrator group can add routes on win7
05:09 < lamba> yea. didnt understand how the compat mode helped?
05:09 < janjust> make the user a member of that group, open a command window and try 'route add <IP> mask <MASK> <GW>
05:10 < janjust> if you can't get the 'route add' to work for a particular user neither kan openvpn 
05:10 < janjust> compat mode? use openvpn 2.1.3+ and run it in 'default' mode
05:10 -!- zooz [~zooz@host86-164-80-134.range86-164.btcentralplus.com] has quit [Quit: Leaving]
05:12 -!- Pechorin [~Vadim@host-109-171-16-255.bbcustomer.zsttk.net] has joined #openvpn
05:23 <@vpnHelper> RSS Update - forum: Client slow when cpu busy (i.e youtube) <http://forums.openvpn.net/topic8044.html#p11709>
05:24 -!- lamba [~lamba@www.siology.net] has quit [Quit: Lost terminal]
05:33 -!- Hlou [~Hlou@1-1-3-26a.mke.gbg.bostream.se] has joined #openvpn
05:35 < Hlou> Hi, I'm running an OpenVPN server on FreeBSD. Everything is working great but when I connect with a windows client (Win Vista or Win7) my syslog on the server gets spammed with messages like "Need IPv6 code in mroute_extract_addr_from_packet". I don't use ipv6 so is there any way to fix or supress these messages?
05:36 -!- K1ng [~KING@180.211.188.21] has joined #openvpn
05:38 < janjust> unbind tcpip v6 from the tap-win32 adapter on vista/7
05:38 -!- K1ng` [~KING@180.211.188.89] has quit [Ping timeout: 264 seconds]
05:44 -!- K1ng` [~KING@180.211.188.175] has joined #openvpn
05:45 -!- K1ng [~KING@180.211.188.21] has quit [Disconnected by services]
05:45 -!- K1ng` is now known as k1ng
05:47 -!- dayangkun__ [~dayangkun@114.249.223.209] has joined #openvpn
05:49 -!- dayangkun_ [~dayangkun@114.249.208.24] has quit [Ping timeout: 240 seconds]
05:59 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
06:10 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
06:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:13 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 240 seconds]
06:23 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
06:26 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
06:33 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
06:34 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
06:36 -!- dayangkun__ [~dayangkun@114.249.223.209] has quit [Quit: Leaving]
06:42 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009.html#p11710>
06:55 <@dazo> Hlou: what version are you running?
06:55 <@dazo> on the windows client
07:03 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
07:16 -!- K1ng` [~KING@180.211.188.175] has joined #openvpn
07:18 -!- k1ng [~KING@180.211.188.175] has quit [Ping timeout: 240 seconds]
07:26 < ecrist> boats and hos
07:45 -!- bystander [48143ae8@gateway/web/freenode/ip.72.20.58.232] has joined #openvpn
07:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:49 < bystander> how to use the openvpn-startup-sh and openvpn-shutdown.sh and openvpn.init? I wanted to use it because I might not be able to know immediately that my vps is being rebooted by the vps host and I wanted that my openvpn will start on reboot of the system. Where will I put those files and how to run those script. I am not much familiary with those scripts.
07:50 -!- Vutral [~ss@vutral.net] has quit [Ping timeout: 246 seconds]
07:51 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
07:54 <@dazo> bystander: which OS / distro are you running?
07:55 < bystander> Im using centos. will that matter what OS I use?
07:56 < bystander> i am reading a sample of those files now.  but dont know where to put them so that when the system restarts, those files will be executed
07:59 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
08:00 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Client Quit]
08:00 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
08:05 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
08:06 < bystander> no help?
08:08 -!- Vutral [~ss@vutral.net] has joined #openvpn
08:18 < bystander> what is my openvpn, tun0 or eth0? How will I know?
08:19 < bystander> or venet0?
08:19 < bystander> I dont know
08:22 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
08:23 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:26 < ecrist> !man
08:26 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
08:26 -!- Belial_ [~quassel@128.210.61.43] has joined #openvpn
08:26 -!- bystander [48143ae8@gateway/web/freenode/ip.72.20.58.232] has quit [Quit: Page closed]
08:28 < Belial_> I am having a problem getting net connected via supervpn service (uses openvpn).  I start the vpn, tun0 comes up, I check my route table and info scrolling in CLI and see that appropriate route --add statements have been made...but when I try to connect to the net, I am unable to get through.  My eth0 traffic is normal, there is some traffic on tun0, but...  Any ideas?  Running on Mandriva 2010.2 linux
08:28 < pwrcycle> Belial_: can you ping their gateway?
08:29 < Belial_> via the tun0/vpn connection or right now?
08:29 < pwrcycle> Belial_: their NAT ip via the tun0
08:30 < pwrcycle> if you can ping their NAT ip, then the tunnel is working and the problem is just routing.
08:30 < Belial_> I don't know.  I can try but will temporarily lose connection here.
08:30 -!- jbroome [~jbroome@unaffiliated/jbroome] has joined #openvpn
08:30 < Belial_> OK...will check
08:30 -!- bystander [48143ae8@gateway/web/freenode/ip.72.20.58.232] has joined #openvpn
08:30 < pwrcycle> what is their gateway IP?
08:31 < bystander> how to know if I am running tun0, eth0 or venet0?
08:31 < pwrcycle> bystander: what OS are you in?
08:31 < Belial_> pwrcycle: I'll have to fire it up again but I believe it is 10.5.99.1 (routing table).
08:32 < pwrcycle> Belial_: if you can pint that IP with the VPN up, then the tunnel is working and routing is your problem.
08:32 < bystander> pwrcycle, i use centos5
08:32 < pwrcycle> !route
08:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
08:32 < pwrcycle> bystander: /sbin/ifconfig
08:32 < bystander> what should I look there?
08:32 < pwrcycle> in a VPS venet0 will be the interface.  on a real dedicated box, eth0 will be the interface
08:32 -!- eth00 [~r00t@unaffiliated/eth00] has joined #openvpn
08:32 < pwrcycle> either way, tun0 will be the tunnel
08:32 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
08:33 < bystander> i see thanks pwrcycle
08:34 -!- Belial_ [~quassel@128.210.61.43] has quit [Read error: Operation timed out]
08:35 < pwrcycle> Belial_: if that service doesn't work out for you, you might check mine: https://cloakVPN.com
08:35 < bystander> another things, I want to know where should I put the openvpn-startup.sh and openvpn-shutdown.sh and openvpn.init and how to executed them?
08:36 -!- eth00 [~r00t@unaffiliated/eth00] has left #openvpn []
08:37 < pwrcycle> bystander: i execute openvpn directly from commandline: "sudo /sbin/service openvpn start" doesn't matter where the scripts are so long as the paths are correct.
08:37 < bystander> paths? where should I setup the paths?
08:39 < pwrcycle> bystander: in centos, probably to "/sbin/service"
08:40 < bystander> let me see thanks
08:41 < jbroome> isn't all that set up whn you install the ovpn rpm ?
08:42 -!- Belial_ [~quassel@128.210.61.43] has joined #openvpn
08:43 < Belial_>  No luck pinging the supervpn gateway when tun0 is up and connected to their network.
08:43 < pwrcycle> jbroome: you still need to bring the vpn up and down at will.
08:43 < pwrcycle> Belial_: what os are you using?
08:43 < Belial_> linux: mandriva 2010.2.  I am on a laptop right now but have this working fine, same distro, on my desktop at home.  No idea what the difference is.
08:44 < pwrcycle> Belial_: if you can't ping their gateway, then the tunnel isn't working properly, regarless of routing.
08:45 < Belial_> How do I go about fixing that or testing it?
08:45 -!- bystander [48143ae8@gateway/web/freenode/ip.72.20.58.232] has quit [Ping timeout: 252 seconds]
08:45 < Belial_> Am on a wired network (eth0) right now.
08:47 < pwrcycle> !configs
08:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
08:47 < Belial_> just a sec...
08:50 -!- SWAT [~swat@ubuntu/member/swat] has quit [Remote host closed the connection]
08:55 < dkr> that regex could be slightly optimized. :) grep -vE '^(#|;|$)' server.conf
08:56 < ecrist> true...
08:57 < ecrist> same number of chars, though...
08:57 < Belial_> vpnHelper,pwrcycle,dkr: I don't have a server setup, am just using client.
08:57 < ecrist> Belial_: we cannot really help users, more server admin support here.
08:57 < ecrist> I would suggest you contact their support.
08:58 < dkr> supervpn is a commerical product?
08:58 < ecrist> no idea
08:58 < ecrist> supervpn != openvpn
08:58 < pwrcycle> Belial_: i run cloakVPN.com and have my clients use the default openvpn client for simplicity. i don't know anything about supervpn
08:59 < dkr> ah,  yeah:  http://www.supervpn.net/prices.html
08:59 <@vpnHelper> Title: SuperVPN Virtual Private Network Prices and Services (at www.supervpn.net)
08:59 < dkr> ecrist: interesting how that triggered vpnHelper
08:59 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: leaving]
09:00 < dkr> oh, that was for the url, not your != comment.  less interesting. :)
09:00 < jbroome> yeah. :)
09:01 < dkr> speed for every plan is "unstricted"
09:02 < Belial_> I just saw someone else post a related question (not supervpn) elsewhere and it was suggested that they change OpenVPN's server.conf file to 'push' the routes out to you when the tunnel comes up.
09:02 -!- jbroome [~jbroome@unaffiliated/jbroome] has left #openvpn []
09:03 < Belial_> If this were something that only happened when I connected to SuperVPN that would be fine....I don't want traffic dorked up when not connected to their vpn.
09:03 < Belial_> How might I do this?
09:03 < ecrist> Belial_: we will not support supervpn here. Sorry
09:04 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:04 < Belial_> I meant getting my openvpn server conf setup to push the routes to me...only when the tunnel is up.  That would be a local openvpn server conf question wouldnt it?
09:05 < ecrist> sure, see the man page for --push
09:17 -!- Belial_ [~quassel@128.210.61.43] has quit [Remote host closed the connection]
09:39 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
09:39 <@vpnHelper> RSS Update - forum: New Setup - Need Assistance <http://forums.openvpn.net/topic8009-15.html#p11711>
09:46 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
09:49 -!- rkantos [robin@hp1.jaketus.net] has quit [Ping timeout: 240 seconds]
09:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:54 -!- swk [~swk@freeswitch/developer/swk] has quit [Read error: Operation timed out]
09:59 -!- teddyb [8fef4beb@gateway/web/freenode/ip.143.239.75.235] has joined #openvpn
09:59 < teddyb> !welcome
09:59 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:00 < teddyb> !goal
10:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:00 < teddyb> !howto
10:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:13 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Ping timeout: 264 seconds]
10:20 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
10:21 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:24 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Ping timeout: 240 seconds]
10:25 < teddyb> hi there, im trying to connect to a vpn through terminal and im getting the error "Unrecognized or missing option or missing parameters in vpnconfig.cfg:16: client
10:25 < teddyb> the command i ran was sudo openvpn --config vpnconfig.cfg
10:26 < pwrcycle> !config
10:26 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
10:26 < pwrcycle> !configs
10:26 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
10:30 < teddyb> http://pastebin.com/EBCfjcjP
10:30 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
10:31 < teddyb> and its mac osx 10.6
10:31 < teddyb> with openvpn 1.6
10:32 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:33 -!- raomin [~romain@86.66.22.240] has quit [Quit: leaving...]
10:35 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
10:36 < teddyb> pwrcycle is that what you wanted?
10:38 < pwrcycle> teddyb: looking
10:38 < teddyb> thanks :)
10:40 < pwrcycle> teddyb: i think you need this in the client.conf: redirect-gateway def1
10:41 < teddyb> does the name of the file matter?
10:41 -!- p3rror [~mezgani@41.248.111.242] has quit [Ping timeout: 260 seconds]
10:41 < teddyb> and it gave the exact same error
10:42 < pwrcycle> no, name doesn't matter, just so long as it ends in .conf
10:42 < teddyb> ok let me rename it
10:42 < pwrcycle> teddyb: and if it's the only conf you odn't even need to specifiy the file
10:42 < pwrcycle> openvpn will try to start all the configs in the diretory
10:43 < pwrcycle> (so if you have conflicting ports in diff .conf files, that could be an issue at some point)
10:43 < teddyb> so i run sudo openvpn --config
10:44 < teddyb> in the dir that contains .conf file
10:45 < pwrcycle> just leave off the --config all together
10:46 < teddyb> then it comes up with all the options that i need to specify
10:47 < pwrcycle> teddyb: are you in centos or ubuntu or what?
10:47 < teddyb> mac osx 10.6 (i said it above) 
10:48 < pwrcycle> on mac you should be using tunnelblick
10:48 < pwrcycle> not sure openvpn will work. i know tunnelblick does
10:49 < teddyb> ok ill give that a try
10:50 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
10:53 <@vpnHelper> RSS Update - forum: Guidance needed on windows setup please <http://forums.openvpn.net/topic8043.html#p11712>
10:53 < teddyb> !verb
10:53 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info, or (#2) verb 5 is good for debugging, verb 3 is good for normal usage
10:57 -!- p3rror [~mezgani@41.140.181.190] has joined #openvpn
11:04 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 248 seconds]
11:04 <@vpnHelper> RSS Update - forum: Guidance needed on windows setup please <http://forums.openvpn.net/topic8043.html#p11713>
11:04  * hyper_ch thought Windows is so easy to setup.. or at least people tell that Windows is so much simpler than Linux
11:09 -!- oskie [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has joined #openvpn
11:10 < oskie> is it possible to set up openvpn to establish VPN automatically and only when the computer is not a certain subnet?
11:11 < oskie> I want to establish VPN to 192.168.2.0/24, but only when my computer is not already in 192.168.2.0/24... or maybe that's not how openvpn works, perhaps I need to read up
11:13 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
11:24 < teddyb> thanks pwrcycle got it working in the end
11:24 -!- teddyb [8fef4beb@gateway/web/freenode/ip.143.239.75.235] has quit [Quit: Page closed]
11:57 < krzie> oskie, it doesnt work that way, however you could make a script that kills itself and openvpn when on that subnet
11:57 < krzie> !scripts
11:57 < krzie> !script
11:57 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
11:58 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
12:00 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:08 < oskie> krzie: thanks. perhaps I can prevent the client from accessing the openvpn server when inside the server's subnet
12:10 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
12:10 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:13 < Bushmills> hyper_ch: "Windows is so easy to setup.." same experience with people in my vicinity. in addition, i frequently experience claims like "windows never crashes here", only do go down burning when i'm around :)
12:14 < Bushmills> oskie: what operating system?
12:18 < oskie> Bushmills: windows client (unfortunately), but linux server
12:18 < Bushmills> hm. can't tell you for windows
12:19 < oskie> well I guess I could use iptables rules to prevent inside clients from accessing the server's openvpn service
12:23 -!- dvl [~dvl@nyi.unixathome.org] has quit [Changing host]
12:23 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
12:24 -!- samu [s@unaffiliated/samaelszafran] has quit [Read error: Connection reset by peer]
12:25 -!- samu [s@e-skurwiel.pl] has joined #openvpn
12:25 <@vpnHelper> RSS Update - forum: Client slow when cpu busy (i.e youtube) <http://forums.openvpn.net/topic8044.html#p11714>
12:26 -!- samu [s@e-skurwiel.pl] has quit [Changing host]
12:26 -!- samu [s@unaffiliated/samaelszafran] has joined #openvpn
12:28 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has joined #openvpn
12:29 -!- sj7trunks [~Adium@171.67.162.57] has joined #openvpn
12:30 < stevieman> I setup openvpn a while back on centos and now I am setting it up at work on debian, I'm using this how-to http://wiki.debian.org/HowTo/openvpn but I don't se anything about ca.crt, client.crt or client1.key. It did have me create a secret.key so I am a bit turned around right now. Should I be using a different how-to?
12:30 <@vpnHelper> Title: HowTo/openvpn - Debian Wiki (at wiki.debian.org)
12:30 < stevieman> !welcome
12:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:30 < stevieman> !goal
12:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:31 < stevieman> !goal to be able to access samba shares on a work computer from home
12:31 < stevieman> !howto
12:31 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:34 < Bushmills> !howto
12:34 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:34 < Bushmills> oh, right. you found it already
12:35 < stevieman> Bushmills: yah, I forgot about that, took a second to remember
12:43 < stevieman> When I try to run ./vars I get a 'permissions error' but when I do a sudo ./vars I get 'command not found'
12:45 < stevieman> Do I need to be root? Even as su I get permission denied
12:46 < stevieman> Bah, even root gets a permission denied on ./vars.... how is that possible?
12:46 < stevieman> nevermind
12:47 < Bushmills> because permissions aren't set for it to be executable, and there's probably no hash-bang
12:47 < Bushmills> look again how it's invoked correctly
12:48 < Bushmills> hint:  spaces matter
12:48 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:55 -!- dazo is now known as dazo_afk
12:56 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
12:57 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
13:17 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
13:17 -!- Peer^ [~ttt@ks355877.kimsufi.com] has quit [Read error: Connection reset by peer]
13:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
13:29 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
13:39 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
13:39 < sdsd> hi
13:40 < sdsd> any openvpn installers around
13:41 -!- Vutral [~ss@vutral.net] has quit [Ping timeout: 240 seconds]
13:41 < dkr> aptitude :)
13:44 < hyper_ch> apt-get > aptitude
13:44 < hyper_ch> + sudo
13:44 < Bushmills> but not   apt-get > /usr/bin/aptitude :P
13:47 < stevieman> can I place my .crt files anywhere on the client machine or do they have to be in /openvpn/config. Right now I have them in openvpn/config/work but the connection fails and says it cannot find /openvpn/config/client1.crt
13:48 < Bushmills> you can place them anywhere, if you tell openvpn at invocation where they are 
13:49 < Bushmills> openvpn won't do a disk search if you placed them anywhere without letting openvpn know
13:49 < stevieman> Does this look right for my .opvn file: cert c:\\Program_Files\\Openvpn\\config\\work\\client1.crt
13:49 < Bushmills> those \\ don't look right to me
13:50 < Bushmills> and funny path, this "Program_Files"
13:50 < Bushmills> what is that "c:" supposed to mean?
13:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:50 < stevieman> um windows client ;)
13:51 < Bushmills> c like cdrom?
13:51 < stevieman> Bushmills: c as in drive C,
13:52 < Bushmills> drive C as in Cdrom drive?
13:52 < stevieman> Bushmills: no the hard drive
13:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
13:52 < Bushmills> windows calls it hard drive "C"?
13:53 < Bushmills> what a funny abbreviation.  why not "harddrive" or "sda" or such?
13:53 < Bushmills> or at least "H" for "hard drive"
13:53 < stevieman> hd:/Program_Files makes sense to me
13:53 -!- Vutral [ss@vutral.net] has joined #openvpn
13:54 < Bushmills> such as.  probably the mnemonic obfuscators were granted some liberties.
13:55 < Bushmills> how does it call a cdrom drive then?
13:55 < stevieman> get this, it could be d: but if there is a second hard drive then that hard drive becomes d: and the cdrom gets moved to e:
13:56 < stevieman> the cdrom just keeps getting bumped down the alphabet like some second class citizen
13:56 < Bushmills> you mean, a hard drive suddenly gets the device id of a cdrom drive?
13:57 < Bushmills> what a confusing convention
13:58 < Bushmills> well, if a hard drive is identified as "C", how are partitions on that drive expressed.  enumerated?  like,  C0, C1, C2?
13:58 < stevieman> No you partition a HD the first partion is c: the second becomes d:
13:59 < Bushmills> oh. partition can also take on cdrom device ids?
13:59 < stevieman> So for some reason openvpn is not reading my config file
13:59 < stevieman> Yep crazy isnt it
13:59 < stevieman> oh and LS does nothing
13:59 < Bushmills> maybe it is confused by this strange device id scheme
13:59 < stevieman> :)
14:00 < Bushmills> you may have to use cdrom drive ids also for directories on that partition
14:00 < Bushmills> hm. wait. what if you run out of those ids?
14:01 < Bushmills> you can have more than 24 directories, right?
14:01 < stevieman> I have no idea
14:02 -!- lolboll [~lolboll@c-907be655.021-327-74686e1.cust.bredbandsbolaget.se] has joined #openvpn
14:02 < lolboll> !welcome
14:02 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:02 < Bushmills> if C is a partition, B would be the master boot record?
14:02 < lolboll> !route
14:03 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:06 < stevieman> B: would be a second floppy
14:06 < lolboll> !tcpip
14:06 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
14:07 -!- ttelford [~ttelford@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
14:10 < stevieman> So not only it is not finding the correct .crt file but it's pulling the wrong IP. However the config.opvn is setup correctly as far as I can see.
14:14 < lolboll> Where to i start to troubleshoot when i got one vpnserver and one client. Both are NAS´es. NAS A is the server. NAS A's routinglist is complete. It can ping NAS B (with vpn ip), but not NAS B´s LAN ip and nothing behind it. NAS B can ping everything, NAS A, whole lan behind NAS A and so on. BUT, when im on my laptop that are in NAS B's lan, i can only ping NAS B´s vpnip, not NAS A. If im 
14:14 < lolboll> on NAS A's LAN i can ping NAS B. Both routinglist are idential, almost. It feels like i have tried everything, played with internal routing, changed configs, played with iroute (ccd) and so on. And yes, I have added two static routes on each LAN.
14:17 < Bushmills> lolboll: what have you configure to the end of reaching the LAN behind NAS B?
14:17 < Bushmills> configured
14:18 < lolboll> static routes on each router
14:18 < Bushmills> that's all?
14:18 < lolboll> both the vpn network (10.8.0.0) and the other ones ip
14:18 < Bushmills> you may be missing enabled ip forwarding
14:19 < lolboll> t0wnz:~# cat /proc/sys/net/ipv4/ip_forward
14:19 < lolboll> 1
14:20 < Bushmills> then use mtr or traceroute,  and tcpdump, to figure out where it stops.
14:20 < Bushmills> !clientlan
14:20 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
14:20 <@vpnHelper> better explanation
14:20 < lolboll> holy crap.. it might actually work now
14:20 < lolboll> forgot that ip_forward changes to 0 after reboot
14:21 < lolboll> didnt change it to 1 after i enabled iroute :'(
14:21 < lolboll>   1   <10 ms   <10 ms   <10 ms  192.168.1.1
14:21 < lolboll>   2   <10 ms   <10 ms   <10 ms  192.168.1.4
14:21 < lolboll>   3    10 ms    10 ms    10 ms  10.8.0.1
14:21 < lolboll>   4    11 ms    11 ms    11 ms  192.168.0.1
14:22 < lolboll> =D!!!!!!!
14:22 < stevieman> well I got it pointing to the right .crt file now but it still will not load it
14:22 < lolboll> Bushmills, thank you.. would never thought of this cuz i forgot that it changes. 
14:22 <@vpnHelper> RSS Update - forum: Help this newbie connect to server <http://forums.openvpn.net/topic8050.html>
14:23 -!- ttelford [~ttelford@c-67-166-68-75.hsd1.ut.comcast.net] has quit [Remote host closed the connection]
14:25 < lolboll> !ccd
14:25 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
14:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
14:36 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
14:36 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:37 < lolboll> When i have my NAS as a vpn gateway, how do i allow tcp/udp from and to other vpn lans?
14:37 < lolboll> on my comp
14:38 < lolboll> only icmp packets work with firewall all. When i turn it of it works like a charm
14:39 < Bushmills> you configure your firewall accordingly
14:41 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
14:41 < lolboll> yes, but how? Do i allow all trafic from my nas, or portbased, or protocol, or program?!
14:42 < stevieman> Does this error mae any sense to anyone here: Cannot load certificate file c:\Program_Files\OpenVPN\config\work\client1.crt: error:02001003:system library:fopen:No such process: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SS: routines:SSL_CTX_use_certificate_file:system lib
14:44 < Bushmills> lolboll: "how do i allow tcp/udp ..."  ... "Do i allow all trafic from my nas, or portbased, or protocol"  
14:45 < Bushmills> are tcp/udp ports?  or NASses?
14:45 < Bushmills> idea is: you deny all. except what you want to allow.
14:46 < Bushmills> what you want to allow is entirely up to you.
14:48 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
14:49 -!- dkr [~dkr@67.132.255.16] has quit [Quit: Leaving]
14:50 < lolboll> yes, they are
14:53 < Bushmills> no. tcp and udp are *protocols*
14:53 <@vpnHelper> RSS Update - forum: OpenVPN server on Windows 7 firewall issue <http://forums.openvpn.net/topic8051.html>
14:54 < lolboll> Yes, But they do handle port's
14:54 < Bushmills> http://en.wikipedia.org/wiki/Transmission_Control_Protocol
14:54 <@vpnHelper> Title: Transmission Control Protocol - Wikipedia, the free encyclopedia (at en.wikipedia.org)
14:54 < Bushmills> http://en.wikipedia.org/wiki/User_Datagram_Protocol
14:54 <@vpnHelper> Title: User Datagram Protocol - Wikipedia, the free encyclopedia (at en.wikipedia.org)
14:55 < Bushmills> well. you didn't ask "how do i enable traffic from/to port xyz"
14:55 < Bushmills> you asked "how do i allow tcp/udp"
14:56 < stevieman> Ok So I figured out my liitle problem, now I have a new one. I'm getting this error "Authenticate/Decrypt packet error: missing authentication info" Is this happening because I copied the .crt and .key files using a usb key and not SSH?
14:56 < Bushmills> most extremely unlikely
14:58 < sdsd> is this room for open vpn as as well?
14:58 < lolboll> Maybe you misunderstod me. I was wondering what i should add in my firewall. Like only 1194, or all tcp/udp, or just a program
14:58 < Bushmills> sdsd: what is difference between "open vpn" and "openvpn"?
14:58 -!- p3rror [~mezgani@41.140.181.190] has quit [Ping timeout: 240 seconds]
14:58 < Bushmills> lolboll: that depends on what you want to allow, and what you want to deny
14:59 < Bushmills> you should add that to your firewall which configures it according your requirements
15:00 < lolboll> haha
15:00 < sdsd> i mean to say openvpn as
15:01 < lolboll> I still dont know how to actually do that. Since i now whats on both networks i can allow all. But how do i do that?
15:01 < Bushmills> !as
15:01 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations
15:01 <@vpnHelper> options supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
15:02 < Bushmills> lolboll: best help about how to configure your firewall can probably be obtained by reading its documention, or asking on the appropriate channel
15:03 < stevieman> are there different .conf files for windows and linux openvpn?
15:03 < stevieman> for the server that is
15:03 < pwrcycle> stevieman: windows .conf files are renamed to .ovpn but contain same text
15:03 < pwrcycle> stevieman: oh, for server, don't know.
15:03 < lolboll> Thought that this was an appropriate channel. 
15:04 < Bushmills> stevieman: i use identical config files for linux and the occasional windows client. but there are no absolute paths in those config files
15:04 < stevieman> thanks
15:04 < Bushmills> lolboll: this is an openvpn channel. not a "the-firewall-software-you-happen-to-use" channel
15:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:05 < Bushmills> asking about firewall is all right. but consider that different people use different kinds of firewall software and may not be familiar which the software you're using or your requirements of firewalling
15:06 < Bushmills> especially as you haven't disclosed what firewall software you're using
15:06 < Bushmills> we know "NAS" but that's all
15:07 < Bushmills> therefore, the channel which knows about the software on your NAS is more appropriate
15:08 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has quit [Ping timeout: 264 seconds]
15:09 < lolboll> Altho i wrote "on my comp".
15:09 < lolboll> But who cares. Probably fixed it. Thanks again.
15:10 -!- K1ng`` [~KING@180.211.188.175] has joined #openvpn
15:10 < stevieman> I am able to connect to my openvpn server now but I cannot ping the client from the server nor can I ping the server from the client...
15:14 -!- lolboll [~lolboll@c-907be655.021-327-74686e1.cust.bredbandsbolaget.se] has quit []
15:14 -!- K1ng` [~KING@180.211.188.175] has quit [Ping timeout: 260 seconds]
15:22 < Bushmills> !firewall
15:22 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
15:22 < Bushmills> stevieman: ^^^
15:22 < Bushmills> alternatively/additionally:
15:23 < Bushmills> !winroute
15:23 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
15:23 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
15:38 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
15:39 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
15:45 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
15:47 < stevieman> Alright, so I verified that I am getting a VPN IP, I've flushed all firewall rules on the server, I turned off the firewall on my windows box but still cannot ping back and forth. I am running openVPN as Admin 
15:47 < stevieman> Is there a URl for the winroute stuff?
15:47 < stevieman> that's the only thing I haven't done yet
15:52 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has quit [Ping timeout: 240 seconds]
15:52 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has quit [Quit: Leaving]
15:54 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
15:56 <@vpnHelper> RSS Update - forum: Help this newbie connect to server <http://forums.openvpn.net/topic8050.html#p11718> || OpenVPN server on Windows 7 firewall issue <http://forums.openvpn.net/topic8051.html#p11717>
15:58 -!- mirco [~mirco@p5B23D6AB.dip.t-dialin.net] has joined #openvpn
15:59 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has quit [Ping timeout: 264 seconds]
16:02 <@vpnHelper> RSS Update - forum: Auto Reconnect after disconnection <http://forums.openvpn.net/topic8052.html>
16:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
16:06 -!- K1ng`` [~KING@180.211.188.175] has quit [Ping timeout: 276 seconds]
16:09 -!- sdsd [sdsds@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
16:09 < sdsd> hey
16:09 < sdsd> Is there a way
16:09 < sdsd> i can monitor my openvpn users?
16:09 < krzee> define "monitor"
16:10 < sdsd> well for example im looking to sell VPN accounts, so i need to be able to monitor their web activatiy
16:10 < sdsd> as in log it
16:10 < sdsd> some where
16:10 < sdsd> what IP does what?
16:10 < sdsd> just incase someone those something illegal i know who it is...
16:10 < krzee> you plan on telling them that you are doing that?
16:10 < krzee> im pretty sure nobody will be ok with that
16:10 < krzee> but yes, you can sniff the tun interface with tcpdump
16:10 < sdsd> am i not under any legal obligation to do that?
16:11 < krzee> not to my knowledge
16:11 < krzee> you arent the service provider
16:11 -!- getxsick [xsx@unaffiliated/getxsick] has joined #openvpn
16:11 < getxsick> hi
16:11 < sdsd> but do i need to provide them with some logs or something
16:11 < krzee> dunno, none of the people i know running services do
16:11 < krzee> in fact they went through lengths so they COULDNT tell who does what
16:12 < krzee> so if they are asked, they say "i dont have access to that"
16:12 < sdsd> ahh ok
16:12 < sdsd> i thought i was under some legal obligation
16:12 < krzee> but i dunno, thats outside the scope of openvpn, should talk to a lawyer
16:12 < sdsd> then that's perfect for me to be honest
16:12 < sdsd> ok  :)
16:12 < getxsick> i need to add something equivalent to this: route delete default; route add default IP, how can i do it through OpenVPN config file?
16:13 < krzee> is IP the vpn gateway?
16:13 < krzee> ^ @ getxsick 
16:13 < getxsick> krzee: no, this is what it's happening now
16:13 < getxsick> krzee: but i want to avoid it as then i'm out of the Internet
16:13 < krzee> you said you wanna add something, not that its happening now
16:13 < Bushmills> getxsick: 
16:13 < Bushmills> !def1
16:13 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
16:14 < krzee> i cant tell if he wants def1, just redirect-gateway, or route-gateway + redirect-gateway
16:14 < Bushmills> i.e. don't delete default, but supercede it
16:14 < getxsick> i don't think it's redirect-gateway
16:14 < krzee> redirect-gateway overrides the default route, so if the vpn goes down you cant connect to the internet (except the vpn server)
16:14 < Bushmills> not my intention to point him to redirect-gateway. merely to using two /1 routes instead of a new 0.0.0.0/0
16:15 < getxsick> well, my VPN set a lot of static routing, so i won't break it by deleting default gatway
16:16 < krzee> def1 overrides default gateway with more specific routes, so you dont lose inet when vpn goes down
16:16 < Bushmills> and, you don't need to delete default route
16:16 < krzee> route-gateway sets a new gateway for the route command, usually should NOT be needed (without this it uses the vpn as the gateway)
16:17 < getxsick> currently my default route is through VPN and i don't need it
16:17 < getxsick> as i get all static routing anyway
16:17 < krzee> getxsick, you run the server?
16:17 < getxsick> no
16:17 < krzee> ahhh
16:17 < krzee> so your real question is this:
16:17 -!- Pechorin [~Vadim@host-109-171-16-255.bbcustomer.zsttk.net] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
16:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:17 < krzee> "how can i ignore redirect-gateway when the server pushes it to me?"
16:18 < getxsick> krzee: indeed!
16:18 < krzee> am i right?
16:18 < krzee> there we go
16:18 <@vpnHelper> RSS Update - forum: OpenVPN server on Windows 7 firewall issue <http://forums.openvpn.net/topic8051.html#p11720>
16:18 < krzee> now it will be easier to help ;]
16:18 < krzee> !factoids search route
16:18 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
16:19 < krzee> !route_override
16:19 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet, or (#2) https://forums.openvpn.net/topic7175.html to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn
16:25 < getxsick> krzee: hmm seems like i have to know my network interface IP which is dynamic :(
16:25 < getxsick> krzee: isn't here an option like 'ignore redirect-gateway' ?
16:27 < krzee> no
16:27 < krzee> did you read the whole post!?
16:27 < getxsick> yes
16:27 < krzee> "note, net_gateway is a variable accepted by openvpn, do not replace it with an IP"
16:27 < krzee> https://forums.openvpn.net/topic7161.html#p7975
16:27 <@vpnHelper> Title: OpenVPN Support Forum Split tunnel tweaks? : Scripting and Customizations (at forums.openvpn.net)
16:28 < Bushmills> --route-nopull
16:28 < krzee> then you have to set ALL routes manually
16:29 < Bushmills> no, just those pushed by openvpn server which you want to admit
16:29 < krzee> including a route to the server itself
16:29 < krzee> which is expanded from --server
16:29 < krzee> important to note that
16:31 < getxsick> c0jest?
16:31 -!- eeble|work [~andy@wsip-70-169-162-125.dc.dc.cox.net] has joined #openvpn
16:31 < krzee> ?
16:31 < getxsick> sorry, wrong channel
16:31 < krzee> ahh
16:31 < eeble|work> Hi, I'm seeing a strange issue where I am getting "bad source address from client" messages, but the IP that's shown is the public IP of the client
16:32 < getxsick> i'm trying that route-nopull however i don't think it will be helpful as i get a lot of not-default route entries from the server :(
16:32 < krzee> eeble|work, a MULTI error, right?
16:32 < eeble|work> yeah
16:32 < krzee> getxsick, you could still set those manually with the route command in your config (after route-nopull)
16:33 < krzee> you would just need to be sure you catch them all ;]
16:33 < krzee> eeble|work, are you trying to use a lan behind the client?
16:33 < krzee> eeble|work, is your client a road warrior?
16:33 < eeble|work> yeah. (this was all working fine before, and I don't recall changing anything)
16:33 < getxsick> krzee: yes, but i don't admin the server, its risky that something can be changed
16:33 < eeble|work> nope, parent's home network connecting to my home network
16:33 < eeble|work> though the IP may have changed
16:33 < krzee> eeble|work, yes to the lan behind the client?
16:33 < eeble|work> it suffered a power outtage
16:34 < Bushmills> california?
16:34 < eeble|work> yeah, there's a LAN behind the client, and the lan is listed in the ccd dir
16:34 < krzee> show me the server log of the client connecting
16:34 < krzee> with verb 4
16:34 < krzee> (pastebin)
16:34 < krzee> from start of connection to finish (more on either end is fine)
16:35 -!- sdsd [sdsds@93-97-41-44.zone5.bethere.co.uk] has quit [Ping timeout: 264 seconds]
16:35 < eeble|work> crap. I'll have to restart openvpn :| ok. let's hope this doesn't break anything
16:35 < Bushmills> power spikes. may bring local power station to its knees
16:35 < krzee> depending on the issue you may get to restart it a time or 2 more ;]
16:36 < krzee> also, what OS on client and on server?
16:37 < eeble|work> krzee, ubuntu 10.04LTS on client, deb5 on server
16:37 < krzee> cool
16:37 < krzee> i will await the log :)
16:39 -!- sj7trunks [~Adium@171.67.162.57] has quit [Quit: Leaving.]
16:39 < krzee> ok i see your ccd is being read
16:39 < krzee> your iroute is being used
16:39 < krzee> ive seen this bug before
16:39 <@vpnHelper> RSS Update - forum: OpenVPN server on Windows 7 firewall issue <http://forums.openvpn.net/topic8051.html#p11721>
16:39 < krzee> dunno WTF causes it, its something in the OS
16:39 < krzee> lemme find the workaround from JJK's book
16:39 < krzee> !book
16:39 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
16:40 < krzee> he had a better workaround for linux clients than my previous "gratuitous iroute" workaround
16:40 < eeble|work> heh
16:40 < eeble|work> thanks
16:40 < krzee> yw
16:41 < getxsick> krzee: i tried to add "route 192.168.100.107 255.255.255.0 net_gateway" to my client config (192.168.100.107 is the address of eth0)
16:41 < getxsick> krzee: no luck :(
16:41 < eeble|work> I just found it odd because it's showing the external IP instead of the internal IP
16:41 < krzee> umm no dude
16:41 < krzee> why would you put 182.168.100.107?
16:41 < krzee> is THAT the subnet you want to bypass the vpn?
16:42 < krzee> btw to make that a subnet it is 192.168.100.0 255.255.255.0
16:42 < getxsick> this is my local network so hmm yes, i want to bypass the vpn for this i think
16:43 < getxsick> c0
16:43 < krzee> it should already bypass the vpn
16:43 < krzee> you have it on your layer2
16:43 < krzee> does the vpn specificly push that subnet to you for it to go over the vpn?
16:44 < krzee> you cant connect to your lan while on the vpn...?
16:47 < getxsick> sorry i lost my connection
16:48 < getxsick> krzee: i want to use my router as a gateway for any connections except those related to the VPN subnet (and for those the server pushes static routing)
16:49 < krzee> try 0.0.0.0 0.0.0.0 as your subnet to bypass then
16:49 < krzee> aka the default route subnet ;]
16:50 < krzee> or
16:50 < krzee> if you want, you can make an up script
16:50 < krzee> which cane do any route commands you wish
16:50 < getxsick> route 0.0.0.0 0.0.0.0 net_gateway ?
16:50 < krzee> right
16:50 < krzee> not sure if it will work tho
16:50 < krzee> cause it matches an existing rotue
16:52 < getxsick> http://paste.pocoo.org/show/382502/
16:52 < getxsick> it's not working as you expected
16:53 < krzee> then try the up script
16:53 < krzee> as i expected? i told you it might not work for that EXACT reason :-p
16:53 < getxsick> yeah
16:53 < getxsick> :)
16:53 < krzee> eeble|work, 
16:53 < krzee> ok i found the work-around
16:54 < krzee> it involved making a second routing table =]
16:54 < eeble|work> ok?
16:54 < eeble|work> lol
16:54 < krzee> in the book he used the following commands:
16:54 < krzee> ip route add to default table 100 dev eth0 via 192.168.4.1
16:55 < getxsick> krzee: should i put "up script" as the last line in the config?
16:55 < krzee> ip rule add from 192.168.2.10 priority 50 table
16:55 < krzee> i mean
16:55 < krzee> ip rule add from 192.168.2.10 priority 50 table 100
16:55 < krzee> ip rule add to 192.168.2.10 priority 50 table 100
16:56 -!- norc [~foo@ns203763.ovh.net] has quit [Read error: Connection reset by peer]
16:56 < krzee> changing those commands to fit your network should help
16:56 < krzee> up /path/to/script
16:56 < krzee> yes
16:57 < krzee> eeble|work, if that helps, i strongly suggest buying JJK's book
16:57 < krzee> it is great!
16:57 < getxsick> krzee: it doesn't work :(
16:58 < eeble|work> cool, I'll do that
16:58 < krzee> getxsick, those ip commands were not for you
16:58 < getxsick> krzee: it looks like the script is never up
16:58 < getxsick> krzee: i know
16:58 < krzee> run the script manually
16:58 < krzee> is it even +x?
16:59 < eeble|work> krzee, now, that's interesting though... is the IP shown in the MULTI error line a public IP or a private one?
16:59 < krzee> eeble|work, huh?
16:59 < krzee> oh
16:59 < eeble|work> sorry, one thing I noticed between my error and the errors I saw on line
16:59 < krzee> is that client the router for its lan?
17:00 < eeble|work> yes
17:00 < krzee> thats why
17:00 < krzee> the errors online were not
17:00 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:00 < eeble|work> Ok. so it seems then that it's ordering of routing tables that's the issue?
17:00 < krzee> for some reason its sending out of tun0 with the ip from eth0
17:01 < getxsick> krzee: it's working manually
17:01 < eeble|work> weird
17:01 < krzee> ive seen it before, no clue why some machines do it and some dont
17:01 < krzee> yes, weird
17:01 < krzee> but a second routing table can force it to be right =]
17:01 < krzee> read up and understand those ip commands (if needed) and modify them to your needs
17:01 < eeble|work> yep
17:01 < eeble|work> thanks
17:02 < krzee> also explained for a different situation here:
17:02 < krzee> !splitroute
17:02 <@vpnHelper> "splitroute" is https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet
17:02 < eeble|work> cool
17:02 < krzee> but you want jjk's i believe
17:02 < krzee> his was more suited to your problem
17:03 < getxsick> krzee: weird,  i have script-security 2; up up.sh
17:03 < krzee> [14:56]  <krzee> up /path/to/script
17:03 < krzee> see something different?
17:03 < eeble|work> yeah.
17:05 < getxsick> krzee: nope, the same
17:05 < krzee> getxsick, post the log with verb 4
17:06 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 248 seconds]
17:08 < getxsick> krzee: http://paste.pocoo.org/show/382517/
17:11 -!- nb [~nb@fedora/nb] has joined #openvpn
17:14 < getxsick> krzee: hmm?
17:15 < krzee> patience, im also at work
17:15 < krzee> i dont use tunnelblick, could you kill that and run openvpn manually and send me THAT log?
17:16 < getxsick> yes
17:16 < krzee> also include your config
17:16 < krzee> (without comments)
17:17 < getxsick> krzee: http://paste.pocoo.org/show/382522/
17:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:20 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
17:20 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
17:22 < getxsick> Wed May  4 00:21:47 2011 /home/xsx/fixroute.sh tun0 1500 1542 172.22.11.154 172.22.11.153 init
17:22 < getxsick> Wed May  4 00:21:47 2011 script failed: could not execute external program
17:22 < getxsick> hehm, cool, not so many information
17:23 < krzee> something wrong with the script
17:23 < krzee> you have a shbang at the top?
17:23 < getxsick> yes
17:23 < krzee> did you drop priviledges with --user / --gorup?
17:24 < getxsick> it's 744
17:24 < getxsick> tried 755 - the same
17:25 < getxsick> should the script exit with status 1 or something?
17:26 < krzee> ahh i see that user and group are commented out
17:26 < krzee> so its not that
17:27 < getxsick> krzee: there is no openvpn user/group
17:27 < getxsick> and i run the client with sudo now
17:28 < getxsick> should i add the openvpn user/group?
17:28 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has quit [Ping timeout: 246 seconds]
17:29 -!- eeble|work [~andy@wsip-70-169-162-125.dc.dc.cox.net] has quit [Ping timeout: 240 seconds]
17:29 < Bushmills> getxsick: put    exit 0   in script, close to start.  if the error disappears, the script gets executed, but has a problem during execution
17:29 < getxsick> ok
17:30 < Bushmills> you read about --script-security,  i suppose
17:30 < getxsick> Bushmills: it's being set to 2
17:30 < getxsick> Bushmills: well i get the same error
17:31 < Bushmills> what are permissions on /home/xsx directory?
17:31 < getxsick> 755
17:35 < Bushmills> what's the first line of the script?
17:35 < getxsick> #!/bin/sh
17:36 < Bushmills> was there anything between first line and the exit 0 you inserted for testing?
17:38 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:39 < getxsick> no
17:40 < Bushmills> put something like     echo "$(date) connected" >> /tmp/openvpnup.log     on line 2,  and   exit 0  on line 3
17:40 < Bushmills> test again and see whether that file in /tmp gets created and written to
17:41 < getxsick> ok
17:42 < getxsick> Bushmills: nope, the issue is outside the file
17:43 < getxsick> ops
17:43 < getxsick> i guess i found the problem
17:45 < getxsick> well
17:45 < getxsick> ok
17:45 < getxsick> it was my fault
17:45 < getxsick> the path to the script was /Users/xsx, not /home/xsx
17:46 < Bushmills> !pathsmite getxsick
17:47 < getxsick> ok, now i have the following problem:/Users/xsx/fixroute.sh: line 2: route: command not found
17:47 < getxsick> is it only about $PATH?
17:49 < Bushmills> easier to find out than to ask, and have us ask you things about your system in return
17:49 -!- K1ng [~KING@180.211.188.175] has joined #openvpn
17:50 < getxsick> Bushmills: yeah, i just ask as i pasted the error before. ok, hmm up is starting BEFORE openvpn set the routing tables with server settings :(
17:51 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:52 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:52 < Bushmills> you know that you can echo $PATH to a file.  and maybe whoami.  given that you can check PATH against location of your route, you should be all set
17:54 < getxsick> Bushmills: yeah, sure. i already fixed it. now i have a problem that the script is run before setting route table from the server settings. i need to run it after that
17:55 < getxsick> s/up/route-up
17:55 < getxsick> yay, it's working now :)
17:55 < Bushmills> you could try to have a look at the man page
17:55 < Bushmills> oh,. you did.
17:56 < getxsick> thanks for the help guys
17:59 < getxsick> good night!
17:59 -!- getxsick [xsx@unaffiliated/getxsick] has left #openvpn []
18:09 -!- vpn_addict [54eab6a4@gateway/web/freenode/ip.84.234.182.164] has joined #openvpn
18:11 < vpn_addict> hi all, having some issues regarding accessing local LAN shares, I cant ping any of local ip adr. Seams gateway that points to local LAN is not added to route..Ideas?
18:11 < vpn_addict> I can access openvpn with out issues but other then that I have no luck with lan
18:13 < vpn_addict> here is my conf file for openvpn http://pastebin.com/SSA55cpU
18:21 -!- Pechorin-M [~Vadim@host-109-171-16-255.bbcustomer.zsttk.net] has joined #openvpn
18:22 < krzee> vpn_addict, 
18:22 < krzee> !route
18:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:23 < krzee> Bushmills, thanx for taking over on that last one
18:23 < krzee> =]
18:24 < Bushmills> yeah ... thought you've been busy quite a while already
18:24 < krzee> yep
18:24 < krzee> just bought a new domain too :)
18:24 < krzee> smartstoner.org!
18:24 < vpn_addict> krzee: sorry I do not understand, can you please explain it for me 
18:25 < Bushmills> botsnack!
18:25 < Bushmills> ehm ... no :)
18:25 < krzee> vpn_addict, no, read it a few times!  you just replied with that after 2 minutes
18:25 < krzee> you CANT understand it in 2 minutes
18:25 < krzee> read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT
18:26 < vpn_addict> krzee: :D true ..will read it couple  of more times
18:26 < Bushmills> pray tell, what exactly didn't you understand?
18:26 < krzee> i didnt write up that page for fun, i wrote it so i wouldnt need to explain it over and over
18:27 < krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
18:27  * Bushmills seeks cover
18:27  * krzee looks for a weapon
18:28 < Bushmills> krzee: maybe you could ... read it aloud to vpn_addict
18:28 < krzee> lol
18:29 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:29 < krzee> i should make a mp3 of it just to be a smartass when they ask me to explain it
18:30 < Bushmills> vpn_addict: failing to tell what exactly you didn't understand ... what makes you believe that you don't understand?
18:30 < Bushmills> or is that more a sort of general feeling that there may be something in that document which you might not understand?
18:31 < vpn_addict> the thing is my openvpn is on the same subnet as all other PC on lan and when If I  add route 172.16.171.0 255.255.255.0 and push with same info --> itdoes not help at all cretes loop that kills access :(
18:31 < Bushmills> some overly technical terms, like "route" or "subnet" or such?
18:31 < vpn_addict> forgive the noob these mistakes just cant understad this part so well
18:32 < Bushmills> !1918
18:32 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
18:32 < krzee> vpn_addict> the thing is my openvpn is on the same subnet as all other PC on lan
18:32 < krzee> well fix that
18:33 < krzee> use a better subnet for your vpn, such as 10.8.0.0 255.255.255.0 for example
18:33 < krzee> also, please tell me you are using dev tun
18:33 < vpn_addict> krzee: can you please look at this http://pastebin.com/SSA55cpU
18:34 < krzee> sure, but i wont be helping much, i wrote a doc for that and i dont believe you have tried to help yourself
18:34 < vpn_addict> machine physically is on the same sub not IP mate ;) 
18:34 < krzee> i quote from the topic: "We won't put more work into your problem than you do, that's just silly."
18:35 < krzee> # non default port to prevent worm attacks!
18:35 < krzee> lol, could you name an openvpn attacking worm please?
18:35 < krzee> !tcp
18:35 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
18:35 < krzee> !ipp
18:35 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
18:35 < krzee> !path
18:35 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
18:36 < krzee> wtf is 255.255.255 doing in your pushdns?
18:36 < krzee> !pushdns
18:36 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
18:36 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
18:37 < vpn_addict> well copy/paste from #gentoo howto ..fixing 
18:39 < krzee> howd i know you blindly copied a config
18:39 < krzee> meh, ill be back later
18:39 < Bushmills> gentoo has openvpn worms?
18:39 < krzee> gunna play angry birds on my cellphone
18:39 < Bushmills> or knows about?
18:40 < vpn_addict> you dont ..just saying what I picked up on the web
18:40 < Bushmills> i'd suggest they put web server on a different port than 80 to protect against exploits
18:41 < vpn_addict> lol yeah..paranoia is no way to live a productive life 
18:41 < Bushmills> running name servers on udp/5353 instead may also be a great step towards securing the system
18:43 < Bushmills> and then, there's the routing table. a host of exploitable information. destinations should be hashed before added to route table.
18:44 <@vpnHelper> RSS Update - forum: data compressing <http://forums.openvpn.net/topic8053.html>
18:44 < Bushmills> great concepts. i reckon i should file an application as network security technician.
18:45 < vpn_addict> thanks guys will "read" and try to understand ..g'night all
18:45 -!- vpn_addict [54eab6a4@gateway/web/freenode/ip.84.234.182.164] has quit [Quit: Page closed]
18:45 < krzee> lol
18:46 < Bushmills> why do they all run away?
18:46 < krzee> better yet, why do they come if they are scared to read
18:48 < Bushmills> invalid
18:49 < krzee> i feel that my writeup is pretty damn good
18:49 < Bushmills> reminds me of a comment i read yesterday:  "if you don't like that movie, don't watch it, but don't tell others they shouldn't watch it"
18:50 < Bushmills> problem is, one only knows that one doesn't like that movie when one has watched it already
18:50 < Bushmills> that is, too late for not watching it.
18:50 < Bushmills> so, why do they come .. 
18:53 < Bushmills> !policy
18:53 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
18:55 < Bushmills> !read
18:57 < Bushmills> !learn read as  krzee: ive been known to overreact when people look for 2 minutes and ask me to explain it to them
18:57 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
18:58 < krzee> !learn read as  krzee: ive been known to overreact when people look for 2 minutes and ask me to explain it to them
18:58 <@vpnHelper> Joo got it.
19:00 < Bushmills> i first thought it was a bot replying, when i only saw the last bit of "dialog":
19:00 < Bushmills> (01:24:44) krzee: smartstoner.org!
19:00 < Bushmills> (01:24:57) vpn_addict: krzee: sorry I do not understand, can you please explain it for me 
19:00 < Bushmills> (
19:01 < krzee> haha
19:19 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:33 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:37 -!- majuk_ [~majuk@108-66-245-146.lightspeed.snantx.sbcglobal.net] has joined #openvpn
19:37 < majuk_> Hey guys. So I mildly screwed the pooch and I can't seem to sort this out.
19:38 < majuk_> I gave 2 clients the same hostname. 1 is now disabled, but the second keeps coming in as "UNDEF" now and won't identify and claim it's IP from ccd
19:38 < majuk_> Any idea how to remedy this?
19:42 < krzee> 1configs
19:42 < krzee> !configs
19:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
19:46 -!- majuk_ [~majuk@108-66-245-146.lightspeed.snantx.sbcglobal.net] has quit [Ping timeout: 276 seconds]
19:47 < krzee> or that
19:47 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
19:58 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:59 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
20:00 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:00 -!- bystander [~rommel092@72.20.58.233] has joined #openvpn
20:01 < bystander> TLS Error: Unroutable control packet received from x.x.x.x:9200 (si=3 op=P_CONTROL_V1)
20:01 < bystander> what is this problem?
20:03 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:08 -!- master_of_master [~master_of@p57B55A11.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:10 -!- master_of_master [~master_of@p57B55B87.dip.t-dialin.net] has joined #openvpn
20:10 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received from x.x.x.x:x <http://forums.openvpn.net/topic8054.html>
20:14 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
20:15 < krzee> http://www.google.com/search?q=Unroutable+control+packet+received+openvpn
20:15 <@vpnHelper> Title: Unroutable control packet received openvpn - Google Search (at www.google.com)
20:15 < krzee> hit #1, http://openvpn.net/archive/openvpn-users/2004-10/msg00027.html
20:15 <@vpnHelper> Title: Re: [Openvpn-users] Unroutable control packet received... (at openvpn.net)
20:20 < bystander> krzee, my computer clock is just correct
20:24 < krzee> check that both sides are correct in UTC (date -u)
20:24 < bystander> how to check the servers computer clock in linux?
20:25 < krzee> date -u LOL
20:25 < krzee> i just told you
20:25 < krzee> that gives the time in UTC
20:25 < krzee> i want to know that both clocks are THE SAME in UTC
20:25 -!- [intra]lanman is now known as ms_cleo
20:25 -!- ms_cleo is now known as [intra]lanman
20:26 < bystander> ok. what if I cant use date -u, i just read how to install. is app-get rdate will install clock?
20:27 < krzee> lol
20:27 < krzee> and why cant you use date -u
20:27 -!- p3rror [~mezgani@41.140.30.171] has joined #openvpn
20:27 < bystander> maybe its not installed?
20:28 < krzee> umm
20:28 < krzee> gentoo?
20:28 < krzee> date is standard in *nix
20:28 < bystander> centos 5
20:28 < bystander> ok
20:28 < krzee> did you really ask that without trying?
20:28 < bystander> if after checking, i found out that the time in my server is not set properly
20:28 < bystander> how will I set the time 
20:29 < krzee> by learning how to use your operating system
20:29 < bystander> i dont know much about linux.
20:29 < krzee> or joining a help channel that supports it
20:29 < krzee> this is #oenvpn
20:29 < krzee> #openvpn
20:29 < krzee> not #i_dont_know_my_os
20:29 < bystander> sorry. I asked the question because the error relates to openvpn i guess
20:29 < krzee> the error you gave did, not how to set your clock in linux
20:30 < bystander> can i just ask you how just this time?
20:30 < krzee> sure, doesnt mean ill answer, i dont even use linux
20:30 < bystander> i am not yet registered so I cant immediately ask in linux
20:30 < krzee> !notovpn
20:30 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
20:32 -!- bystander [~rommel092@72.20.58.233] has quit []
20:32 -!- p3rror [~mezgani@41.140.30.171] has quit [Ping timeout: 240 seconds]
20:45 -!- p3rror [~mezgani@41.140.40.109] has joined #openvpn
20:50 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
21:02 -!- randomandy [~andy@2001:470:1f05:1570:c62c:3ff:fe05:d3f2] has joined #openvpn
21:02 -!- mirco [~mirco@p5B23D6AB.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
21:02 < randomandy> !welcome
21:02 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:03 < randomandy> !route
21:03 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:10 < randomandy> I'm using iroute. VPN and routing work. Sometimes, on next try it, it doesn't work. I look at my ccd file and notice it has changed the iroute statement to an ifconfig-push statement (which it complains about). I change it back and things work again. It does this repeatedly, so it is definitely not me changing the ccd file manually. Why might this be auto-changing on me?
21:10 < randomandy>  fa
21:29 -!- bystander [~rommel092@72.20.58.233] has joined #openvpn
21:30 < bystander> i am getting lots of rwrwrwrwrwrwrw after the initialization
21:32 -!- bystander [~rommel092@72.20.58.233] has quit [Client Quit]
21:32 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received from x.x.x.x:x <http://forums.openvpn.net/topic8054.html#p11724>
21:41 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
21:44 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
21:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
22:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:15 -!- eeble|work [~andy@ip70-174-136-104.dc.dc.cox.net] has joined #openvpn
22:21 -!- eeble|work [~andy@ip70-174-136-104.dc.dc.cox.net] has quit [Read error: Operation timed out]
22:30 -!- eeble|work [~andy@ip70-174-136-104.dc.dc.cox.net] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:40 -!- eeble|work [~andy@ip70-174-136-104.dc.dc.cox.net] has quit [Ping timeout: 276 seconds]
22:45 <@vpnHelper> RSS Update - forum: Hosting an OpenVPN Server <http://forums.openvpn.net/topic8055.html>
23:03 <@vpnHelper> RSS Update - forum: Hosting an OpenVPN Server <http://forums.openvpn.net/topic8055.html#p11726>
23:11 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
23:12 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
23:28 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:34 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has quit [Ping timeout: 252 seconds]
23:34 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:47 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
23:51 <@vpnHelper> RSS Update - forum: ubuntu server 10.10 and Openvpn <http://forums.openvpn.net/topic8038.html#p11727>
23:53 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has quit []
23:56 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
--- Day changed Wed May 04 2011
00:00 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
00:00 -!- p3rror [~mezgani@41.140.40.109] has quit [Ping timeout: 240 seconds]
00:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
00:04 -!- hadees [~hadees@72-48-91-73.dyn.grandenetworks.net] has joined #openvpn
00:05 < hadees> I'm following this guide for my tomato router, http://blog.johnso.org/2009/08/how-to-setup-openvpn-in-tomato.html and I uploaded the config to my iphone for GuizmOVPN but it isn't working.  I am getting "add net 0.0.0.0: gateway 192.168.1.1: Network is unreachable"
00:05 <@vpnHelper> Title: Hacks and Slash: How to Setup Openvpn in Tomato (at blog.johnso.org)
00:06 < hadees> which I guess makes sense since that is internal but I guess I'm not sure exactly whats wrong
00:09 < hadees> here is the full log, http://pastie.org/1863039
00:09 < hadees> from the client
00:24 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
00:24 -!- zumbi [~zumbi@77.230.237.25] has quit [Ping timeout: 248 seconds]
00:25 -!- p3rror [~mezgani@41.140.99.82] has joined #openvpn
00:25 -!- zumbi [~zumbi@77.230.237.25] has joined #openvpn
00:35 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Ping timeout: 252 seconds]
00:38 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
00:44 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:45 < s7r> !changelog
00:45 <@vpnHelper> "changelog" is (#1) http://www.openvpn.net/changelog.html to see the openvpn changelog, or (#2) For OpenVPN 2.2 changelog , see http://www.openvpn.net/index.php/open-source/documentation/change-log/425-changelog-for-openvpn-22.html
00:47 -!- sj7trunks1 [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
00:50 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Read error: Operation timed out]
01:02 -!- CheBuzz [~CheBuzz@76.164.192.124] has joined #openvpn
01:03 < randomandy> !goal
01:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:06 < randomandy> anyone know why openvpn would change a ccd file statement from iroute to ifconfig-push automatically? It keeps doing it and thereby breaking my setup.
01:07 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received from x.x.x.x:x <http://forums.openvpn.net/topic8054.html#p11728>
01:08 < hyper_ch> randomandy: let me fetch my magic crystal ball and start divinging your configs
01:08 < CheBuzz> hyper_ch: Where did you get one of those??  I seriously need one.
01:09 < hyper_ch> CheBuzz: I can tell you but then I'd have to kill you
01:09 < CheBuzz> Ah, but if I had one, I'd see you coming.  So go ahead and tell me.
01:09 < randomandy> well does it even make sense that openvpn would *change* the configs ?
01:11 < randomandy> !configs
01:11 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
01:12 < hyper_ch> CheBuzz: :)
01:13 <@vpnHelper> RSS Update - forum: data compressing <http://forums.openvpn.net/topic8053.html#p11730> || Hosting an OpenVPN Server <http://forums.openvpn.net/topic8055.html#p11729>
01:14 -!- p3rror [~mezgani@41.140.99.82] has quit [Ping timeout: 240 seconds]
01:15 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:18 < randomandy> http://pastie.org/1863165
01:18 -!- CheBuzz [~CheBuzz@76.164.192.124] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.0.5]
01:20 -!- CheBuzz [~CheBuzz@76.164.192.124] has joined #openvpn
01:20 < randomandy> Still looking for reasons for why openvpn would change my ccd file.
01:21 < CheBuzz> Anybody know why I would be getting ping-restarts while my connection is staying up the whole time?   http://pastebin.com/CMpuc0zi
01:21 -!- Killman [~network@unaffiliated/killman] has joined #openvpn
01:34 < s7r> !ipv6
01:34 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
01:35 < s7r> the latest stable release of openvpn has full support for ipv6?
01:50 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:50 -!- mode/#openvpn [+o mattock] by ChanServ
01:54 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
01:55 -!- tjz_ [~pc@bb121-7-196-30.singnet.com.sg] has joined #openvpn
01:59 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
01:59 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
02:00 -!- tjz_ [~pc@bb121-7-196-30.singnet.com.sg] has quit [Ping timeout: 246 seconds]
02:06 -!- Killman [~network@unaffiliated/killman] has quit [Quit: bbl Zzzzzz]
02:16 -!- s7r [~s7r@unaffiliated/s7r] has quit [Read error: Connection reset by peer]
02:17 -!- s7r [~s7r@82.137.9.140] has joined #openvpn
02:17 -!- s7r [~s7r@82.137.9.140] has quit [Changing host]
02:17 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
02:18 < CheBuzz> Anybody know why I would be getting ping-restarts while my connection is staying up the whole time?   http://pastebin.com/CMpuc0zi  Seems to happen regularly around 8 minutes.
02:27 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:29 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
02:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:37 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html>
02:38 < CheBuzz> !vpnHelper
02:39 < CheBuzz> Anybody know what bot software vpnHelper uses?
02:42 -!- dazo_afk is now known as dazo
02:43 <@dazo> CheBuzz: supybot, I believe
02:55 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
02:58 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11732>
03:08 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
03:10 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11733>
03:11 -!- danci1973 [~kvirc@178.79.70.1] has joined #openvpn
03:11 < danci1973> Hello...
03:13 < danci1973> I have configured an OpenVPN server on my Linux router. I'm using multiple routing tables so I would like OpenVPN to add it's route to other-then-default table as well - what can I use to achieve that?
03:13 < danci1973> I was looking at --up, but it doesn't look like that's the right one...
03:14 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
03:15 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:15 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:15 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:16 < danci1973> Never mind - looks like '--up' will be OK...
03:21 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11734>
03:23 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
03:23 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
03:23 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:29 -!- randomandy [~andy@2001:470:1f05:1570:c62c:3ff:fe05:d3f2] has quit [Quit: randomandy]
03:29 -!- randomandy [~randomand@2001:470:1f05:1570:c62c:3ff:fe05:d3f2] has joined #openvpn
03:30 -!- randomandy [~randomand@2001:470:1f05:1570:c62c:3ff:fe05:d3f2] has left #openvpn []
03:31 -!- danci1973 [~kvirc@178.79.70.1] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.2 Shiny http://www.kvirc.net]
03:34 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11735>
03:39 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11736>
03:45 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11737>
03:48 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 240 seconds]
03:50 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11738>
03:59 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
04:02 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11740>
04:03 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
04:07 -!- MarKsaitis_ [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
04:07 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11741>
04:11 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
04:11 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:11 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:11 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:11 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 248 seconds]
04:11 -!- MarKsaitis_ [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Client Quit]
04:20 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
04:28 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:28 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
04:30 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:32 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
04:34 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:40 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:42 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11742>
04:48 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11743>
05:00 <@vpnHelper> RSS Update - forum: why I cant revoke the user certification ? <http://forums.openvpn.net/topic8057.html>
05:03 -!- bystander [48143ae8@gateway/web/freenode/ip.72.20.58.232] has joined #openvpn
05:04 < bystander> i am having this error TLS Error: Unroutable control packet received from x.x.x.x:9200 (si=3 op=P_CONTROL_V1)
05:05 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
05:07 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
05:18 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056.html#p11745>
05:23 < bystander> home alone :(
05:23 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received from x.x.x.x:x <http://forums.openvpn.net/topic8054.html#p11746>
05:30 <@vpnHelper> RSS Update - forum: Low throughput <http://forums.openvpn.net/topic8048.html#p11747>
05:32 -!- bystander [48143ae8@gateway/web/freenode/ip.72.20.58.232] has quit [Quit: Page closed]
05:48 -!- Addemanne [~AddeBC@c193-150-233-51.bredband.comhem.se] has joined #openvpn
05:51 < Addemanne> I had my config working great on Beta5 now i copied all files over to my new serevr and when running server mode log is flooding with: Need IPv6 code in mroute_exctact_addr_from_packet  - ANyone?
05:55 -!- CheBuzz [~CheBuzz@76.164.192.124] has left #openvpn ["Leaving"]
06:00 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:24 -!- Vutral [ss@vutral.net] has joined #openvpn
06:29 -!- Hlou [~Hlou@1-1-3-26a.mke.gbg.bostream.se] has quit [Quit: leaving]
06:35 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
06:38 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 246 seconds]
06:38 -!- JPeterso2 is now known as JPeterson
07:22 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
07:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:41 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
07:41 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
07:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
08:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:04 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
08:04 <@vpnHelper> RSS Update - forum: TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p11748>
08:10 -!- DeeJayTwo [~deejay2@office.abi.ca] has joined #openvpn
08:10 <@vpnHelper> RSS Update - forum: why I cant revoke the user certification ? <http://forums.openvpn.net/topic8057.html#p11749>
08:15 <@vpnHelper> RSS Update - forum: Low throughput <http://forums.openvpn.net/topic8048.html#p11751> || Configuration issue <http://forums.openvpn.net/topic8056.html#p11750>
08:17 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
08:18 < DeeJayTwo> I'm a bit new to PKI stuff and I would like to have some advises about how to manage it...
08:18 < DeeJayTwo> We have ldap based authentication, openvpn services and some other services that could be secured by a PKI
08:18 < DeeJayTwo> What I need to know is how to manage it properly from start to end... Do I create a different PKI for each service? What are the best pratices to keep the CA secured?... etc..
08:21 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received from x.x.x.x:x <http://forums.openvpn.net/topic8054.html#p11752>
08:22 < janjust> hi DeeJayTwo ; I'd use a single PKI using a single (master) CA cert for all services
08:22 < janjust> it depends on how each service is set up; I'd always keep the CA private key on a separate USB stick and use it only on a PC that is not connected to the rest of the network
08:23 < janjust> it also depends on who has to generate and sign client certs for each service
08:24 < DeeJayTwo> I'm also a bit worried about deployment... I'm using OpenVPN under PFSense. It has a revocation list field but I need to paste it on each box runnin an openvpn server. Is there some way in can refer to a world wide available revocation list?
08:25 < DeeJayTwo> Or do I really need to script something to populate all those box?
08:27 <@vpnHelper> RSS Update - forum: OpenVPN & Vlan <http://forums.openvpn.net/topic8032.html#p11753>
08:28 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 260 seconds]
08:29 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
08:33 -!- hadees [~hadees@72-48-91-73.dyn.grandenetworks.net] has quit [Quit: hadees]
08:35 < ecrist> there's about 4M ways to structure internal PKI
08:35 < ecrist> one CA, with sub-CAs for each service/division, or one CA and everything is signed by it?
08:36 < ecrist> OR do you go with a third-party sub-CA cert for internal use and sign keys with your sub-CA?
08:36 < ecrist> or does each division/service have it's own CA, separate from each other?
08:36 < ecrist> OR ...
08:36 < ecrist> it goes on an on
08:45 < janjust> DeeJayTwo:  I wouldn't worry about revocation lists; yes, either you need to push this CRL to all servers, but you can also configure openvpn to use OCSP
08:51 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
09:04 < DeeJayTwo> ok thank you!
09:05 -!- eeble|work [~andy@wsip-70-169-162-125.dc.dc.cox.net] has joined #openvpn
09:07 -!- gyyrog [~gyyrog@24.231.158.154] has joined #openvpn
09:15 -!- sj7trunks1 [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
09:28 -!- hadees [~hadees@72-48-91-73.dyn.grandenetworks.net] has joined #openvpn
09:37 -!- ravidar [~ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
09:59 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
10:03 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
10:03 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:12 < krzie> janjust, ocsp??
10:13 < janjust> krzie: yep
10:14 < krzie> whats that?
10:14 < janjust> read TheBook :P it's the Online Certificate Status Protocol 
10:14 < janjust> do 'man ocsp' on a box with openssl installed
10:15 < janjust> it's a service that you can query to ask if a certificate is valid or not
10:15 < krzie> oh cool
10:15 < janjust> chapter 12, page 325 ;)
10:17 < krzie> for any bystanders:
10:17 < krzie> !book
10:17 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
10:18 < krzie> oh cool!
10:18 < krzie> you even go over running an ocsp server
10:19 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:20 < janjust> yep, it's a fully working recipe ;)
10:21 < krzie> i didnt get to chapter 12 it looks like
10:21 < krzie> i die a little every time i see [ used in bash
10:21 < krzie> instead of [[
10:22 -!- K1ng [~KING@180.211.188.175] has quit [Read error: Connection reset by peer]
10:22 < janjust> lol, why's that? [ works as well
10:23 -!- K1ng [~KING@180.211.188.175] has joined #openvpn
10:23 < krzie> [11:23]  <krzie> ![[
10:23 < krzie> [11:23]  <greybot> [[ is a bash keyword similar to (but more powerful than) the [ command. See <http://mywiki.wooledge.org/BashFAQ/031> and <http://mywiki.wooledge.org/BashGuide/TestsAndConditionals>. Unless you're writing for POSIX sh, we recommend [[.
10:23 <@vpnHelper> Title: BashFAQ/031 - Greg's Wiki (at mywiki.wooledge.org)
10:23 < krzie> in [ you must always remember your quotes, etc
10:23 < krzie> much more bug prone
10:26 < krzie> hey you used $() in chapter 12!
10:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:26 < krzie> i remember before you were using ``
10:27 < krzie> like page 157
10:29 -!- azizLIGHTS [~azizLIGHT@ec2-50-17-254-25.compute-1.amazonaws.com] has left #openvpn []
10:29 < janjust> I normally use `` ; this ocsp sample came from openssl itself, IIRC , and use $()
10:29 < janjust> I don't like $() but didn't want to rewrite existing scripts
10:30 < janjust> <<< out
10:30 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:31 < krzie> [11:32]  <krzie> !`
10:31 < krzie> [11:32]  <greybot> The backquote (`) is used in the old-style command substitution, e.g. foo=`command`. This syntax is deprecated in favor of foo=$(command). Backslash handling inside $() is less surprising, and $() is easier to nest. See http://mywiki.wooledge.org/BashFAQ/082
10:31 <@vpnHelper> Title: BashFAQ/082 - Greg's Wiki (at mywiki.wooledge.org)
10:31 < krzie> aww
10:39 -!- macsppadic [~sonupunno@88.211.55.77] has joined #openvpn
10:46 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has joined #openvpn
10:47 < stevieman> I created a ta.key for my openvpn connection. In the clients config do I put the ta.key file in with the other .crt and .key files?
10:50 -!- K1ng [~KING@180.211.188.175] has quit [Read error: Connection reset by peer]
10:51 -!- K1ng [~KING@180.211.188.175] has joined #openvpn
10:51 -!- K1ng [~KING@180.211.188.175] has quit [Read error: Connection reset by peer]
10:52 -!- K1ng [~KING@180.211.188.175] has joined #openvpn
10:57 -!- K1ng [~KING@180.211.188.175] has quit [Read error: Connection reset by peer]
10:59 < krzie> !hmac
10:59 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
10:59 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
11:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
11:09 -!- Rolybrau [~Rolybrau@217-81.3-85.cust.bluewin.ch] has joined #openvpn
11:09 -!- Rolybrau [~Rolybrau@217-81.3-85.cust.bluewin.ch] has quit [Changing host]
11:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:10 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Client Quit]
11:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:21 -!- macsppadic [~sonupunno@88.211.55.77] has quit [Quit: macsppadic]
11:21 < havoc> oooh, new release
11:36 -!- p3rror [~mezgani@41.140.26.78] has joined #openvpn
11:37 <@vpnHelper> RSS Update - forum: Hosting an OpenVPN Server <http://forums.openvpn.net/topic8055.html#p11754>
11:44 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
11:49 -!- K1ng [~KING@180.211.188.248] has joined #openvpn
11:51 -!- Killman [~network@unaffiliated/killman] has joined #openvpn
11:54 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
12:02 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
12:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
12:28 -!- dazo is now known as dazo_afk
12:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
12:36 <@vpnHelper> RSS Update - forum: windows xp as vpn-server - no route <http://forums.openvpn.net/topic8058.html>
12:51 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Ping timeout: 250 seconds]
12:53 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
12:53 < dirkD> hi, does anyone here have experience with StoneVPN?
12:56 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
13:01 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
13:07 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
13:09 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
13:12 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
13:16 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
13:18 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
13:31 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has joined #openvpn
13:33 < stevieman> Is there any issue with using a URL for the remote sever?
13:36 < dirkD> stevieman: you mean a FQDN?
13:37 < stevieman> dirkD: yes that is what I meant ;)
13:37 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
13:38 < Rajko> anyone know how i can disable timestamp checks on TLS certificates ?
13:38 < dirkD> stevieman: no issue with that normally, but it might cause problems when you are pushing a DNS setting to the VPN client, in case that DNS server resolves the host to another IP than the public-accessible IP 
13:39 < dirkD> Rajko: don't
13:39 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has quit [Ping timeout: 240 seconds]
13:39 < Rajko> dirkD, its on a router with no RTC
13:39 < stevieman> dirkd: not an issue in this case. Just need to connect to an internat server for work files. Be easier with FQDN rather than an IP
13:39 < Rajko> so sometimse it boots without ntp and gets 1970
13:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:41 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 252 seconds]
13:41 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
13:41 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
13:42 < dirkD> Rajko: and it is the server?
13:42 < Rajko> no its the client
13:42 < dirkD> that will be difficult i think
13:43 < Rajko> it tries to verify the server cert and errors out because its not yet valid
13:43 < dirkD> what about syncing with NTP?
13:43 < Rajko> <Rajko> so sometimse it boots without ntp
13:43 < jeev> Rajko, why deos your damn nck change every day
13:43 < jeev> does
13:43 < dirkD> so, make a batch script, which syncs with NTP before you open the VPN?
13:45 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
13:45 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
13:47 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
13:48 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
13:50 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
13:50 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
13:53 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Quit: Távozom]
13:54 -!- Vutral [ss@vutral.net] has joined #openvpn
13:56 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
13:56 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
13:58 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
13:58 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
13:58 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
13:59 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
13:59 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
14:02 -!- bitrot [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
14:02 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
14:04 -!- bitrot is now known as rajkosto
14:06 -!- [4-tea-2] [marc@bong.a42.de] has joined #openvpn
14:06 -!- dirkD1 [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
14:06 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
14:07 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
14:07 < [4-tea-2]> Howdy. I have a working pointopoint setup using tun from a Debian/sid to a Debian/squeeze.
14:07 < [4-tea-2]> It's currently IPv4 only, but I would like to use it for IPv6, too.
14:08 < [4-tea-2]> Is there an easy way to extend the existing setup for IPv6 without too much danger of breaking it? ;)
14:08 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
14:09 < rajkosto> no
14:09 < rajkosto> ipv6 isnt even in stable yet
14:09 < [4-tea-2]> No ipv6 over tun yet?
14:09 < rajkosto> you have to compile testing version and put it on both ends
14:10 < [4-tea-2]> I just had a quick look at the sid package, it seems to come with a jjo-ipv6 patch.
14:10 < [4-tea-2]> ...pre-applied
14:10 < [4-tea-2]> Not good enought?
14:11 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
14:11 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
14:11 < [4-tea-2]> wb
14:14 < [4-tea-2]> "openvpn --dev tun --tun-ipv6" seems to indicate I'm fine.
14:16 < [4-tea-2]> Now that was painless, I restarted both ends with --tun-ipv6 and I'm still here.
14:17 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
14:17 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
14:20 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
14:20 -!- rajkosto [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
14:22 <@vpnHelper> RSS Update - forum: Wanted: a Perl or PHP programmer. Will pay. <http://forums.openvpn.net/topic8059.html>
14:27 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
14:28 -!- Rajko [~rajkosto@188.2.157.120] has joined #openvpn
14:30 -!- Rajko [~rajkosto@188.2.157.120] has quit [Read error: Connection reset by peer]
14:30 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
14:34 < oskie> if you specify a root cert using 'ca', how can there be a MITM risk? doesn't openvpn require server & client certs to be signed by this ca?
14:35 < oskie> ah it is a more sophisticated attack where a client with a certificate impersonates the server
14:44 -!- bitrot [~rajkosto@cable-188-2-156-169.dynamic.sbb.rs] has joined #openvpn
14:44 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
14:46 -!- bitrot [~rajkosto@cable-188-2-156-169.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
14:46 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
14:47 -!- bitrot [~rajkosto@wan.rajkonet.info] has joined #openvpn
14:48 -!- bitrot [~rajkosto@wan.rajkonet.info] has quit [Client Quit]
14:51 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Ping timeout: 252 seconds]
14:54 < [4-tea-2]> .( IPv6 was totally painless. )
15:28 < oskie> when using tap, is it necessary to make the tap & eth interfaces promisc if you only want the client to talk to the server?
15:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
15:34 <@vpnHelper> RSS Update - forum: Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html>
15:36 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
15:36 < rajkosto> anyone here succesfully using the ipv6 payload patch ?
15:38 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
15:40 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
15:40 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
15:40 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
15:41 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
15:42 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:43 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
15:44 < [4-tea-2]> rajkosto: I'm using the Debian packages and I can ping6.
15:44 < rajkosto> openvpn --version
15:44 < [4-tea-2]> 2.1.3, I think
15:44 < [4-tea-2]> lemme check
15:44 < rajkosto> if it doesnt have [ipv6 payload xxx] then no
15:44 < [4-tea-2]> As I said, I'm using the Debian packages.
15:45 < rajkosto> debian is always stable, so no
15:45 < [4-tea-2]> They include a jjo-ipv6-patch, iirc.
15:45 < rajkosto> that might be for ipv6 transport, not payload
15:46 < [4-tea-2]> Ah, right, no, Debian doesn't include Gert Döring's patch.
15:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:46 < rajkosto> i have that
15:46 < [4-tea-2]> I'm using point2point, so as I understand it, I don't need it.
15:48 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
15:52 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 260 seconds]
15:56 <@vpnHelper> RSS Update - forum: where to start.. VPN web browser <http://forums.openvpn.net/topic8061.html>
15:59 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has quit [Quit: Leaving]
16:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:05 -!- bitrot [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
16:05 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
16:05 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
16:07 -!- bitrot [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
16:24 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 276 seconds]
16:31 < dvl> Although I have Time Machine working over my OpenVPN to my Time Capsule at home, it's very slow.  Takes ages.  No idea why.
16:31 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
16:46 -!- [4-tea-2] [marc@bong.a42.de] has left #openvpn []
16:49 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
16:56 -!- gyyrog [~gyyrog@24.231.158.154] has quit [Remote host closed the connection]
17:04 -!- sdsd [~sdsd@93-97-41-44.zone5.bethere.co.uk] has quit []
17:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:12 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
17:12 <@vpnHelper> RSS Update - forum: How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html>
17:12 < rajkosto> no redirect-gateway for ipv6 ?
17:13 < rajkosto> should i jsut push "route-ipv6 2000::/3
17:15 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
17:16 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
17:17 -!- bitrot [~rajkosto@wan.rajkonet.info] has joined #openvpn
17:20 -!- Rajko [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Ping timeout: 240 seconds]
17:35 -!- eeble|work [~andy@wsip-70-169-162-125.dc.dc.cox.net] has quit [Quit: Leaving]
17:50 -!- azonenberg [~azonenber@cpe-67-246-46-200.nycap.res.rr.com] has joined #openvpn
17:50 < azonenberg> Hi guys
17:51 < azonenberg> I'm trying to set up an N+1 redundant multisite VPN (two servers, all clients connect to both, servers connect to each other)
17:51 < azonenberg> having some wierd issues
17:52 < azonenberg> Is it possible to make a cert be both a client and a server cert?
17:56 -!- bitrot [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
17:56 -!- bitrot [~rajkosto@wan.rajkonet.info] has joined #openvpn
17:58 < azonenberg> Fixed it by making two certs for the dual-purpose machines
17:59 < azonenberg> each one has a separate client cert and server cert
17:59 < azonenberg> they share the same CA so all other clients can use one cert to connect to both
18:01 -!- azonenberg [~azonenber@cpe-67-246-46-200.nycap.res.rr.com] has left #openvpn []
18:36 < krzie> any server cert would work as a client cert just fine
18:36 < krzie> unless you actually check against that, which is super rare
18:53 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:08 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
19:11 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
19:29 < bitrot> krzie, ipv6 payload working great
19:35 -!- bitrot is now known as rajkosto
19:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
19:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
19:46 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
19:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
19:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
19:48 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
19:52 -!- STF [~chatzilla@dslb-178-001-031-116.pools.arcor-ip.net] has joined #openvpn
19:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
20:01 <@vpnHelper> RSS Update - forum: TLS Error: Unroutable control packet received from x.x.x.x:x <http://forums.openvpn.net/topic8054.html#p11760>
20:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:08 -!- master_of_master [~master_of@p57B55B87.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:10 -!- master_of_master [~master_of@p57B55DA4.dip.t-dialin.net] has joined #openvpn
20:13 <@vpnHelper> RSS Update - forum: why I cant revoke the user certification ? <http://forums.openvpn.net/topic8057.html#p11761>
20:18 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:18 < bystander> how to user "shaper n"
20:19 < ecrist> sup bitches?
20:19 < ecrist> !shaper
20:19 < ecrist> !man
20:19 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
20:19 < bystander> is it shaper 100 bytes/sec
20:19 < ecrist> I suggest the man page
20:20 < bystander> i am reading it now but I dont see any example. I am confused if the right directive is just shaper or shaper 100 bytes/sec or shaper 100 or what
20:21 < bystander> how ?
20:21 < ecrist> --shaper n
20:21 < ecrist> Limit bandwidth of outgoing tunnel data to n bytes per second on the TCP/UDP port. If you want to limit the bandwidth in both directions, use this option on both peers.
20:21 < ecrist> pretty straight forward to me.
20:21 < ecrist> use 'shaper n' in your config
20:21 < ecrist> replace 'n' with # bytes/s to limit to
20:22 < ecrist> what more do you want? a rub and a tug? ;)
20:23 < bystander> I can see in the manpage that there is OpenVPN allows n to be between 100 bytes/sec and 100 Mbytes/sec. 
20:23 < rajkosto> its all in bytse
20:23 < bystander> so have will it be in mbytes?
20:23 < bystander> shaper 100 mbytes?
20:23 < rajkosto> NO
20:23 < rajkosto> ITS IN BYTES
20:23 < bystander> that is why i am confused because it also stated there in mbytes
20:23 < rajkosto> shaper 104857600
20:23 <@vpnHelper> RSS Update - forum: static IP for auth-pam or mysql auth <http://forums.openvpn.net/topic8005.html#p11762>
20:23 < rajkosto> its not
20:24 < rajkosto> it just gives you the limits
20:24 < ecrist> no, it says "OpenVPN allows n to be between 100 bytes/sec and 100 Mbytes/sec."
20:24 < bystander> so I can set like shaper 104857600 for megabyte?
20:25 < rajkosto> the argument is a number
20:25 < rajkosto> the number is the number of bytes per second
20:25 < rajkosto> figure it out
20:28 < bystander> what is the best sharper byte for wireless connection?
20:28 < ecrist> well, are you talking about a commercial microwave transmitter?
20:28 < bystander> yes
20:29 < bystander> my server network connectivity is limited to 100mbps
20:29 < ecrist> well, at that level, I'd recommend using something like PF's ALTQ and tag individual VPN tunnels and shape the dynamically
20:29 < ecrist> --shaper isn't going to be as dynamic as you'd probably like.
20:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
20:30 < bystander> is that so? what could be my best solution for this
20:31 < ecrist> what sort of services are you providing on your microwave link?
20:31 < bystander> vpn
20:31 < ecrist> on a microwave link?
20:31 < ecrist> that's just odd
20:32 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit []
20:33 < ecrist> aw, shucks
20:41 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Operation timed out]
20:43 -!- K1ng` [~KING@180.211.188.248] has joined #openvpn
20:43 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
20:44 -!- CrazyGir [~jason@unaffiliated/crazygir] has quit [Ping timeout: 246 seconds]
20:45 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 260 seconds]
20:45 -!- CrazyGir [~jason@li14-82.members.linode.com] has joined #openvpn
20:46 -!- CrazyGir is now known as Guest74692
20:47 -!- K1ng [~KING@180.211.188.248] has quit [Ping timeout: 258 seconds]
21:14 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
21:15 -!- nb [~nb@fedora/nb] has joined #openvpn
21:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
21:17 -!- ravidar [~ravidar@ip24-255-127-217.dc.dc.cox.net] has quit [Ping timeout: 276 seconds]
21:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
21:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
21:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
21:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
21:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
21:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
21:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
21:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
21:36 -!- STF [~chatzilla@dslb-178-001-031-116.pools.arcor-ip.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
21:37 -!- ravidar [~ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
21:39 -!- K1ng`` [~KING@180.211.188.248] has joined #openvpn
21:42 -!- K1ng` [~KING@180.211.188.248] has quit [Ping timeout: 240 seconds]
21:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:57 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
21:59 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
22:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
22:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:04 -!- fivetwentysix [~pma@120.136.44.47] has joined #openvpn
22:05 < fivetwentysix> Is OpenVpn the commercial version brand-able and can I sell access to OpenVpn accounts hosted on my server?
22:07 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:08 < rajkosto> you can sell access to anything
22:10 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
22:10 -!- fivetwentysix_ [~pma@132.118.103.218.static.netvigator.com] has joined #openvpn
22:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:13 -!- fivetwentysix [~pma@120.136.44.47] has quit [Ping timeout: 263 seconds]
22:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
22:15 -!- fivetwentysix_ [~pma@132.118.103.218.static.netvigator.com] has quit [Ping timeout: 276 seconds]
22:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:23 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
22:24 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
22:29 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:35 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:39 -!- K1ng`` [~KING@180.211.188.248] has quit [Read error: Connection reset by peer]
22:40 -!- K1ng`` [~KING@180.211.188.248] has joined #openvpn
22:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
22:43 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:43 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
22:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
22:45 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:52 -!- p3rror [~mezgani@41.140.26.78] has quit [Remote host closed the connection]
23:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
23:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
23:10 -!- ravidar [~ravidar@ip24-255-127-217.dc.dc.cox.net] has quit []
23:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 252 seconds]
--- Day changed Thu May 05 2011
00:05 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:09 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
00:10 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:32 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
00:49 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
01:03 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:18 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:34 <@vpnHelper> RSS Update - forum: windows xp as vpn-server - no route <http://forums.openvpn.net/topic8058.html#p11763>
01:36 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
01:36 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
01:41 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
01:41 -!- rajkosto [~rajkosto@2001:5c0:1511:4e02:4043:1432:60:83f1] has joined #openvpn
01:41 -!- daemon_mum [~dima@mrdreamer.com] has quit [Ping timeout: 246 seconds]
02:00 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 258 seconds]
02:00 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
02:02 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:17 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
02:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
02:19 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 246 seconds]
02:23 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
02:31 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
02:35 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
02:44 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
02:57 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
03:01 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
03:17 <@vpnHelper> RSS Update - forum: How to reset the password of openvpn certifications <http://forums.openvpn.net/topic8063.html> || windows xp as vpn-server - no route <http://forums.openvpn.net/topic8058.html#p11764>
03:21 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
03:26 -!- dazo_afk is now known as dazo
03:29 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Quit: leaving]
03:38 -!- Gobbla [Anon@c80-217-143-194.bredband.comhem.se] has joined #openvpn
03:39 < Gobbla> is it possible to exclude traffic on ports on the client side?
03:40 < krzie> huh?
03:40 < krzie> you mean to route over the vpn only based on port?
03:40 < krzie> and you dont control the server?
03:42 < Gobbla> the opposite, to exclude based on port
03:42 < Gobbla> no control of server
03:43 < krzie> nope
03:43 < krzie> impossible
03:44 < krzie> !routebyapp
03:44 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
03:44 < krzie> if you controled the server
03:44 < krzie> you dont, cant be done
03:45 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
03:48 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
03:48 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
03:48 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
03:51 <@vpnHelper> RSS Update - forum: windows xp as vpn-server - no route <http://forums.openvpn.net/topic8058.html#p11766>
03:58 < Bushmills> one could probably use client firewall to reroute traffic to specific ports to a different destination
04:02 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:02 -!- mattock [~samuli@openvpn/corp/admin/mattock] has left #openvpn []
04:04 -!- Gobbla [Anon@c80-217-143-194.bredband.comhem.se] has quit [Changing host]
04:04 -!- Gobbla [Anon@unaffiliated/gobbla] has joined #openvpn
04:06 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
04:06 -!- mode/#openvpn [+o mattock] by ChanServ
04:06 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
04:07 -!- Killman [~network@unaffiliated/killman] has quit [Quit: bbl ZZZzzzzz]
04:07 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
04:24 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
04:37 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
04:52 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
04:55 -!- K1ng [~KING@180.211.188.108] has joined #openvpn
04:57 -!- K1ng`` [~KING@180.211.188.248] has quit [Ping timeout: 240 seconds]
05:02 -!- Rajko [~rajkosto@2001:5c0:1511:4e02:4043:1432:60:83f1] has joined #openvpn
05:05 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 260 seconds]
05:05 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
05:05 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
05:05 -!- Champi [Champi@rootshell.fr] has quit [Read error: Connection reset by peer]
05:05 -!- rajkosto [~rajkosto@2001:5c0:1511:4e02:4043:1432:60:83f1] has quit [Ping timeout: 260 seconds]
05:05 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 260 seconds]
05:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
05:05 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
05:06 -!- Champi_ [Champi@rootshell.fr] has joined #openvpn
05:06 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
05:06 -!- Champi_ is now known as Champi
05:06 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
05:06 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 260 seconds]
05:06 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
05:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:08 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
05:09 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
05:14 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
05:22 -!- raomin [~romain@86.66.22.240] has joined #openvpn
05:43 -!- K1ng` [~KING@180.211.188.108] has joined #openvpn
05:46 -!- K1ng [~KING@180.211.188.108] has quit [Ping timeout: 252 seconds]
05:49 <@vpnHelper> RSS Update - forum: Openssl ist not recongnized ? <http://forums.openvpn.net/topic8041.html#p11767>
06:07 -!- fbh [fbh@unaffiliated/fbh] has left #openvpn []
06:11 < K1ng`> how do i enable openvpn to use mysql database to store users? 
06:16 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
06:40 < ecrist> K1ng`: you need to setup an authentication script
06:40 < K1ng`> how do i do it?
06:40 < ecrist> openvpn itself doesn't use mysql or anything other than SSL certificates
06:41 < ecrist> http://www.imped.net/oss/misc/openvpn-2.0-howto-edit.html#auth
06:41 <@vpnHelper> Title: OpenVPN 2.0 HOWTO (at www.imped.net)
06:45 < K1ng`> http://www.roessner-network-solutions.com/beliebte-seiten-und-artikel/openvpn-radius-mysqlldap-howto/
06:45 <@vpnHelper> Title: OpenVPN RADIUS MySQL/LDAP Howto | Rößner-Network-Solutions (at www.roessner-network-solutions.com)
06:45 < K1ng`> will it work?
06:45 < ecrist> don't know, never done it.  probably?
06:48 < ecrist> I know you can use LDAP pretty easily with euphria
06:48 < ecrist> !euphria
06:48 < ecrist> !factoids search eu
06:48 <@vpnHelper> "eurephia" is http://www.eurephia.net/
06:48 < ecrist> there it is
06:52 <@dazo> ecrist: LDAP is not supported in eurephia yet ... its on the todo list .... however, SQLite3 is supported 
06:54 < ecrist> what? I thought the whole point of eurephia was ldap.
06:57 -!- bitrot [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has joined #openvpn
06:58 -!- Rajko [~rajkosto@2001:5c0:1511:4e02:4043:1432:60:83f1] has quit [Read error: Connection reset by peer]
07:01 -!- bitrot [~rajkosto@cable-188-2-157-120.dynamic.sbb.rs] has quit [Ping timeout: 240 seconds]
07:17 -!- Gobbla [Anon@unaffiliated/gobbla] has quit []
07:18 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has joined #openvpn
07:18 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has quit [Client Quit]
07:29 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
07:46 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:49 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
08:00 -!- bittis [~root@212.50.124.104] has joined #openvpn
08:02 < bittis> hey guys, i am completly new to openvpn, i started looking for an opensource vpn solution and got lost somewhere along the way, firstly is there a free web interface for openvpn ?
08:10 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
08:10 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
08:10 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
08:19 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
08:19 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
08:19 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:19 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:27 < dirkD1> bittis: to do what?
08:29 -!- gyyrog [~gyyrog@66.129.37.189] has joined #openvpn
08:34 -!- gyyrog [~gyyrog@66.129.37.189] has quit [Remote host closed the connection]
08:35 -!- gyyrog [~gyyrog@66.129.37.189] has joined #openvpn
08:39 <@dazo> ecrist: nope ... eurephia is authentication with username/password against a particular certificate - with iptables support for fine grained network access control per username/certificate combination
08:39 <@dazo> But I'm planning on adding LDAP for the password authentication
08:40 <@dazo> (but somehow my openvpn work have taken priority the last year)
08:41 < ecrist> it's OK.  there's and ldap auth script distributed with openvpn
08:42 < bittis> dirkD1: for administration purposes
08:43 < bittis> should i assume that for any sort of fine graining with user access iptables would be needed?
08:50 < bittis> there are some admin guis available but not sure how good they are 
08:51 -!- gyyrog [~gyyrog@66.129.37.189] has quit [Remote host closed the connection]
09:00 -!- gyyrog [~gyyrog@adsl-69-208-77-111.dsl.klmzmi.ameritech.net] has joined #openvpn
09:07 < Bushmills> bittis: "user access" ... user can connect, or can't. what fine graining?
09:08 < bittis> restricting access to specific hosts
09:08 < bittis> or services
09:08 < Bushmills> not an openvpn task
09:08 < bittis> from my understanding this is possible via iptables for example
09:09 < Bushmills> configure services accordingly
09:13 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
09:13 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:16 < dirkD1> bittis: shorewall and Ferm are great configuration interfaces for iptables
09:16 < dirkD1> config-file based by the way
09:17 < dirkD1> but, did you ever see someone configure a cisco router/firewall using a web interface? ;)
09:18 < bittis> hehe no, unfortunately i am suggesting a solution for someone else, i want to set something up for someone else to administrate, so all can be good
09:18 < bittis> i am guessing not possible though hehe :P
09:18 < dirkD1> where will it be used for?
09:19 < dirkD1> *what
09:20 < dirkD1> maybe you could use Vuurmuur
09:20 -!- gyyrog [~gyyrog@adsl-69-208-77-111.dsl.klmzmi.ameritech.net] has quit [Remote host closed the connection]
09:20 < bittis> hmm
09:20 < bittis> thanks for the tip
09:21 < bittis> i could assign groups to different ip pools in a nat configuration, and use it to set restrictions based on those ip ranges
09:42 <@vpnHelper> RSS Update - forum: suggested MSS feature for "proto tcp" operation <http://forums.openvpn.net/topic8064.html>
09:45 -!- kartooon [~kartoon@unaffiliated/kartooon] has joined #openvpn
09:46 < kartooon> hello
09:47 < kartooon> I don't understand, I've an openvpn bridge server on the lan (linux system), clients are windows xp and are trying to browse network (share and so on), ping are working in both directions but it seems that lan nodes answer to the clients on their bad ip (not answering on the vpn ip but on the other ip, lan ip of the clients)
09:49 < kartooon> I think I forget the masquerad rules
09:51 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:06 <@vpnHelper> RSS Update - forum: Routing to LANs behind server <http://forums.openvpn.net/topic8022.html#p11769>
10:12 <@vpnHelper> RSS Update - forum: suggested MSS feature for "proto tcp" operation <http://forums.openvpn.net/topic8064.html#p11770>
10:21 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:41 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:59 -!- bittis [~root@212.50.124.104] has quit [Quit: leaving]
11:06 <@vpnHelper> RSS Update - forum: How to prioritize VoIP packets? <http://forums.openvpn.net/topic8065.html>
11:11 -!- sj7trunks [~Adium@171.67.169.124] has joined #openvpn
11:14 -!- UnterPerro [~UnterPerr@h-67-102-127-70.miatflad.static.covad.net] has joined #openvpn
11:19 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has joined #openvpn
11:22 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has joined #openvpn
11:23 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has quit [Changing host]
11:23 -!- Gobbla [Gobbla@unaffiliated/gobbla] has joined #openvpn
11:37 -!- UnterPerro [~UnterPerr@h-67-102-127-70.miatflad.static.covad.net] has quit [Quit: UnterPerro lives to save another day]
11:42 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
11:54 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
11:57 -!- K1ng [~KING@180.211.188.147] has joined #openvpn
11:58 -!- DeeJayTwo [~deejay2@office.abi.ca] has quit [Ping timeout: 260 seconds]
11:59 -!- K1ng` [~KING@180.211.188.108] has quit [Ping timeout: 246 seconds]
12:00 -!- K1ng` [~KING@180.211.188.88] has joined #openvpn
12:01 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
12:01 -!- mode/#openvpn [+o patelx] by ChanServ
12:02 -!- K1ng [~KING@180.211.188.147] has quit [Ping timeout: 240 seconds]
12:10 -!- Sk00rchen [~Sk00rchen@c83-251-230-74.bredband.comhem.se] has quit [Quit: ZNC - http://znc.sourceforge.net]
12:12 -!- K1ng [~KING@180.211.188.88] has joined #openvpn
12:16 -!- K1ng` [~KING@180.211.188.88] has quit [Ping timeout: 276 seconds]
12:19 -!- phaidros [~phaidros@ghostshell.subsignal.org] has joined #openvpn
12:19 < phaidros> hi
12:20 < phaidros> can I push ipv6 addresses to a client the same way it is done with ipv4 ?
12:25 -!- sj7trunks [~Adium@171.67.169.124] has left #openvpn []
12:27 <@dazo> phaidros: not in openvpn 2.2, that's coming in openvpn 2.3 (available in the development snapshots or git trees)
12:29 < phaidros> dazo: thanx, so it seems I got to go the stoney way :)
12:29 < phaidros> how stable are the recent snapshots?
12:30 <@dazo> phaidros: I'm using the latest master branch daily on my laptop ... no issues with neither ipv4 nor ipv6 traffic
12:30 < phaidros> dazo: and that means trunk for server and client, right?
12:31 <@dazo> nope, master branch .... server and client are based on the same source code ... in fact the binary is "both", unless disabled at compile time
12:31 <@dazo> <vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git, or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git, or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi, or (#4) See !git-doc how to use git
12:32 <@dazo> master branch is the same in both git trees ... so take your favourite pick :)
12:32 -!- Killman [~network@unaffiliated/killman] has joined #openvpn
12:43 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:50 -!- dazo is now known as dazo_afk
12:52 -!- p3rror [~mezgani@41.140.96.121] has joined #openvpn
12:56 -!- StudiousNoodle [~phil@charon.pub.ekahuna.com] has joined #openvpn
12:57 < StudiousNoodle> Hi, I have a cert/CA question if anyone would like to take a stab at it.. OpenVPN newbie.. ;-)
13:02 < dkr> StudiousNoodle: no one is going to pull it of of you, you have to ask.  hrm, well I guess this counts as pulling. :)
13:02 < StudiousNoodle> Never been here before, was waiting to make sure all those usernames weren't bots or something :P
13:03 < StudiousNoodle> inherited an OpenVPN setup configured by someone else, have clients working using previous certs
13:03 < StudiousNoodle> trying to create new certs, they aren't working, error log gives no indication why
13:03 < StudiousNoodle> get TLS negotiation error
13:04 < StudiousNoodle> copied the server key/cert and rest of old files into new easy-rsa directory
13:05 < StudiousNoodle> set the log level up to 5, still no indication what is failing in TLS handshake
13:06 <@vpnHelper> RSS Update - forum: Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html#p11772>
13:06 < StudiousNoodle> that's my post
13:08 < StudiousNoodle> Ahh, Jan just posted that 9 mins ago.. hah
13:11 < StudiousNoodle> I'll go take a look at the server logs.. problem is having trouble connecting to that box right now.. sigh
13:11 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
13:12 <@vpnHelper> RSS Update - forum: Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html#p11773>
13:17 < phaidros> well, mybe stupid, but master seems not to have any ./configure script ?
13:17 -!- StudiousNoodle [~phil@charon.pub.ekahuna.com] has left #openvpn []
13:19 < phaidros> hm ... autoconf :/
13:20 < phaidros> or not ..
13:25 < phaidros> autoupdate && autoconf && automake --add-missing doesnt work either
13:26 < phaidros> any hints please to generate a configure script in master ?
13:26 < phaidros> (git master)
13:28 < phaidros> dazo_afk: ?
13:29 < phaidros> ok: autoreconf -i -v
14:00 -!- Vutral [tffNHUUZnq@vutral.net] has joined #openvpn
14:04 -!- DeeJayTwo [~deejay2@office.abi.ca] has joined #openvpn
14:06 -!- gyyrog [~gyyrog@66.129.37.189] has joined #openvpn
14:22 -!- zeshoem [~mnathani@bas1-toronto46-1177856523.dsl.bell.ca] has quit []
14:34 -!- samu [s@unaffiliated/samaelszafran] has quit [Read error: Connection reset by peer]
14:37 -!- K1ng` [~KING@180.211.188.211] has joined #openvpn
14:39 -!- samu [s@e-skurwiel.pl] has joined #openvpn
14:40 -!- K1ng [~KING@180.211.188.88] has quit [Ping timeout: 276 seconds]
14:41 -!- samu [s@e-skurwiel.pl] has quit [Changing host]
14:41 -!- samu [s@unaffiliated/samaelszafran] has joined #openvpn
14:45 -!- gyyrog [~gyyrog@66.129.37.189] has quit [Remote host closed the connection]
14:47 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
14:50 -!- K1ng` [~KING@180.211.188.211] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
14:51 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11774>
14:56 -!- K1ng [~KING@180.211.188.211] has joined #openvpn
15:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
15:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
15:22 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
15:29 -!- phaidros [~phaidros@ghostshell.subsignal.org] has left #openvpn []
15:35 -!- linuxgecko [~gecko@99-182-113-98.lightspeed.clmboh.sbcglobal.net] has joined #openvpn
15:36 < linuxgecko> if i can ssh into a machine across the an openvpn,  then the vpn is not to blame for my vnc connection to the same machine?
15:37 < krzee> correct
15:37 < krzee> at that point, either your vnc doesnt listen on the VPN ip, or your firewall is to blame
15:39 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 246 seconds]
15:39 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
15:42 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
16:03 < linuxgecko> krzee:  thought so,  but wanted to be sure, before i started asking in my distro channel more pointedly.
16:03 -!- Adde_BC [~AddeBC@c193-150-233-51.bredband.comhem.se] has joined #openvpn
16:03 < krzee> =]
16:03 < krzee> good man
16:04 -!- Addemanne [~AddeBC@c193-150-233-51.bredband.comhem.se] has quit [Ping timeout: 258 seconds]
16:16 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:17 -!- DeeJayTwo [~deejay2@office.abi.ca] has quit [Ping timeout: 240 seconds]
16:20 -!- sashthebash [~sashtheba@196-189-235-201.fibertel.com.ar] has joined #openvpn
16:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
16:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:45 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11775>
16:57 <@vpnHelper> RSS Update - forum: where to start.. VPN web browser <http://forums.openvpn.net/topic8061.html#p11777> || Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html#p11776>
17:03 <@vpnHelper> RSS Update - forum: How to reset the password of openvpn certifications <http://forums.openvpn.net/topic8063.html#p11778>
17:19 -!- ldaguilar [~luis@186.176.7.194] has joined #openvpn
17:19 -!- ldaguilar [~luis@186.176.7.194] has quit [Read error: Connection reset by peer]
17:23 -!- raidz_ [~raidz@46-105-63-15.kimsufi.com] has quit [Ping timeout: 248 seconds]
17:48 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:48 -!- cpm [~Chip@dns1.daviswv.net] has joined #openvpn
17:48 -!- cpm [~Chip@dns1.daviswv.net] has quit [Changing host]
17:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
18:23 -!- DeeJayTwo [~deejay2@office.abi.ca] has joined #openvpn
18:23 -!- sashthebash [~sashtheba@196-189-235-201.fibertel.com.ar] has left #openvpn []
18:57 <@vpnHelper> RSS Update - forum: Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html#p11779>
19:03 <@vpnHelper> RSS Update - forum: Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html#p11780>
19:07 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
19:10 <@vpnHelper> RSS Update - forum: Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html#p11781>
19:17 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Quit: Leaving]
19:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
19:46 <@vpnHelper> RSS Update - forum: Can ping in one direction, but not the other <http://forums.openvpn.net/topic8066.html>
20:09 -!- master_of_master [~master_of@p57B55DA4.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:10 < queequeg1> Yay, I can ping 10.8.0.1 across the vpn.  I can also pint 10.33.44.200 (the nick on the vpn server) but I can't ping any other machine on the 10.33.44.0 network.  I put a rout to the 10.8.0.0 subnet  on the remote router.  What else should I check?
20:10 < queequeg1> Sorry for the typos.
20:11 -!- master_of_master [~master_of@p57B55AA4.dip.t-dialin.net] has joined #openvpn
20:13 < queequeg1> The vpn server I'm connecting to is has the ip of 10.33.44.200, the router on that network is 10.33.44.1.  10.33.44.1 has a route to 10.8.0.0/255.255.255.0 that points to 10.33.44.200.
20:13 < krzee> queequeg1, 
20:13 < krzee> !route_outside_ovpn
20:13 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
20:14 < krzee> oh it DOES have that route
20:14 < krzee> well in that case, you need to start sniffing and find where the packets get to
20:14 < krzee> sniff tun on both sides, and eth0 (or whatever the interface is) on the LAN machine and on the vpn server
20:15 < krzee> of course with some filters to help, like only ICMP
20:15 < queequeg1> I'm not sure I dissabled the firewall on the vpn server.  I can check that tomorrow.
20:15 < krzee> well it could be that, except that packets make it to the vpn server's lan interface
20:15 < krzee> that means ip forwarding (in the kernel and the firewall) is going ok
20:16 < krzee> it COULD be the firewall on the lan machine tho (windows is often guilty of this)
20:16 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has left #openvpn ["Leaving"]
20:16 < krzee> to narrow it down, you wanna sniff packets
20:16 < krzee> that will cut out a ton of guessing
20:16 < queequeg1> I guess it might come to that.  but I have a lot to learn when it comes to packet sniffing.
20:17 < krzee> not much to it
20:17 < krzee> man tcpdump, specify the interface and the packet type
20:17 < krzee> only icmp, only the interface you want
20:17 < krzee> sniff tun for inside the vpn
20:17 < queequeg1> sounds simple enough.
20:18 < krzee> make sure you read and understand !route, but i have a feeling you did that
20:18 < krzee> since you got the route outside openvpn correct
20:18 < krzee> !route
20:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
20:20 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 246 seconds]
20:20 -!- Perun [perun@chao5.net] has quit [Ping timeout: 246 seconds]
20:20 < queequeg1> thanks for the pointers
20:21 -!- Perun [perun@chao5.net] has joined #openvpn
20:22 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
20:22 < krzee> np
20:22 < krzee> but im pretty sure nothing in there can help you
20:22 < queequeg1> I just rdped into a machine on the 10.33.44.0 network and I was able to ping 10.8.0.1, but not my client 10.8.0.6.
20:23 < krzee> if you can reach the server's lan interface, you did that stuff correctly, and what you said about the route on the router is correct
20:23 < queequeg1> So the router 10.33.44.1 must be handing out the route right?
20:23 < krzee> oh interesting
20:23 < krzee> that seems to point to your server's firewall
20:23 < krzee> possibly the forward chain
20:23 < queequeg1> But it is disabled.  (windows).
20:23 < queequeg1> :-(
20:23 < krzee> oh windows
20:24 < krzee> you are using tun tho, right?
20:24 < queequeg1> Yes.  But let me double check to be sure.
20:25 < krzee> did you enable ip forwarding on the server via regedit?
20:25 < queequeg1> no.
20:25 < krzee> ahh there we go
20:25 < krzee> !winipforward
20:25 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
20:25 < queequeg1> also it is windows xp, not a server OS.
20:26 < krzee> in linux you wouldnt reach the lan adapter without ip forwarding so i took it for granted that it was setup right
20:26 < krzee> thats fine, that windows url is for XP iirc
20:26 < krzee> i know ive used it in XP and win2k3
20:26 < queequeg1> I'm thinking of installing an Ubuntu vm to be the server.
20:26 < krzee> (those were the newest windows when i last used windows)
20:26 < krzee> unnecessary
20:26 < krzee> this will work fine
20:27 < krzee> im pretty sure all you need is the regedit entry i just linked you to
20:27 < krzee> and a reboot of course (yay windows)
20:27 < krzee> !windows
20:27 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
20:27 < krzee> ;]
20:27 < queequeg1> I'm doing the regedit now.
20:27 < queequeg1> Was that in the instructions.  I thought I read them carefully.
20:31 < krzee> well kinda
20:31 < krzee> it just mentions you must enable ip forwarding
20:31 < krzee> it never said how
20:31 < krzee> i dont blame ya ;]
20:31 < queequeg1> heh
20:31 < krzee> (and if i felt you didnt read it well, i would not be shy to say so ;] )
20:31 < krzee> !read
20:31 <@vpnHelper> "read" is krzee: ive been known to overreact when people look for 2 minutes and ask me to explain it to them
20:31 < krzee> ;]
20:32 < krzee> !change
20:32 <@vpnHelper> (change [<channel>] <key> <number> <regexp>) -- Changes the factoid #<number> associated with <key> according to <regexp>.
20:32 < queequeg1> Hrm, I made the change, but I suppose I should probably reboot.
20:32 < krzee> !change #openvpn read 1 s/krzee:/<krzee>/
20:32 <@vpnHelper> Joo got it.
20:32 < krzee> yep, windows will need a reboot
20:32 < krzee> in linux or bsd i could give you an easy way to enable it without the reboot
20:33 < krzee> windows i dunno how, you gotta reboot
20:34 < queequeg1> Can different versions of OpenVPN communicate properly?
20:34 < queequeg1> Or will there be unpredictable results?
20:35 < krzee> depends on which versions
20:35 < krzee> 2.0.* is missing a bit of stuff that is in 2.1
20:35 < krzee> 1.x doesnt even have server/client
20:36 < krzee> etc
20:36 < krzee> i recommend updating them all to at least 2.1.4
20:36 < queequeg1> Can they all use the same config files and certs and such?
20:36 < krzee> but 2.2 is even better (brand new and shiny!) ;]
20:37 < krzee> when upgrading?
20:37 < krzee> absolutely
20:37 < krzee> an old version using a new version's config, depends
20:37 < krzee> an old version connecting to a new version's server, depends on the server's config
20:37 < krzee> but a new version using an old versions config, you are good =]
20:38 < queequeg1> ah.  I have some windows 7 machines.  I thought only the release candidate had a signed driver :-(
20:38 < krzee> note, if you use external scripts, 2.1 has a new option that 2.0.x didnt
20:38 < krzee> nope, 2.2 is signed too
20:38 < krzee> 2.1.4 was also signed
20:38 < krzee> i THINK 2.1 had a problem with that, but days later 2.1.1 was released for that exact reason
20:39 < queequeg1> ah.
20:39 < queequeg1> coolbeans.
20:40 < queequeg1> I'm supposed to be doing algebra homework (self study, I'm not in school), I'm actually ancient.  almost 40.
20:40 < queequeg1> But making progress on a work project that is soooo close to completion is great fun.
20:41 < krzee> yep
20:42 < krzee> i get that often, coding scripts to do my job at work
20:42 < krzee> complete a script, celebrate
20:42 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
20:42 < krzee> rinse and repeat
20:42 < queequeg1> I'm a beginning python programmer.  I play with it for fun and use it at work whenever I can.
20:43 < krzee> ahh nice
20:43 < krzee> i just script in bash, im JUST starting to read up on python
20:43 < krzee> read an intro manual, got a couple more i need to crack open
20:43 < queequeg1> WOOHOO!
20:43 < queequeg1> It works!
20:43 < queequeg1> Just pinged the router.
20:43 < krzee> well i guess you dont crack open a pdf, but same idea ;]
20:43 < krzee> cool!
20:44 < queequeg1> Now my only problem is that my sprint usb modem won't allow me to start the vpn.  It kicks off whenever openvpn brings the tap interface up.
20:44 < queequeg1> :-(
20:45 < queequeg1> I saw that an earlier version of the installer allowed one to hide the tap interface.
20:45 < queequeg1> I suppose that was why?
20:50 < queequeg1> Thanks for the help.  
20:50 < krzee> not sure *why*
20:50 < krzee> !factoids search tap
20:50 <@vpnHelper> 'tap', 'mactuntap', 'wintaphide', 'tunortap', and 'obsdtap'
20:51 < krzee> !wintaphide
20:51 <@vpnHelper> "wintaphide" is (#1) in regedit find HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318} then Look through each sub-key for one with a DriverDesc = TAP-Win32Adapter V8 . Set Characteristics = 0x89, or (#2) To show again, set it to 0x81
20:52 < queequeg1> Awesome.
20:52 < queequeg1> One last question and then I'm off to do math.
20:52 < queequeg1> Now that I'm connected I'm getting a fair amount of packet loss.
20:53 < queequeg1> I'm using a crappy usb nic on the server (it is just at test).  
20:53 < krzee> also using that 3g modem thingy"?
20:53 < queequeg1> Nah, I'm at home right now.
20:53 < queequeg1> comcast.
20:53 < krzee> ahh ok
20:53 < krzee> test your MTU
20:53 < krzee> !mtu
20:53 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
20:53 < krzee> you are using UDP, right?
20:54 < queequeg1> yes.
20:55 < krzee> good
20:55 < krzee> so ya, test mtu with #1
20:55 < queequeg1> ah, testing looks simple.
20:57 < queequeg1> So literally I just open my client config and put --mtu-test in it?
20:57 < krzee> well
20:57 < krzee> !--
20:57 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
20:58 < queequeg1> thanks, was going to put the -- in the config file and then be sad.
20:58 < krzee> if you want, you dont even need to edit the config
20:58 < krzee> openvpn --mtu-test --config <config>
21:00 -!- A-KO [as@unaffiliated/a-ko] has joined #openvpn
21:00 < A-KO> !welcome
21:00 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:00 < A-KO> !goal
21:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:02 < queequeg1> The log file says that the test will take 3 or 4 minutes.
21:02  * queequeg1 goes to get a soda.
21:02 < A-KO> !wiki
21:02 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
21:04 < krzee> A-KO, good job on reading the topic
21:04 < krzee> go with !goal =]
21:05 < krzee> you guys are brightening my day here, first someone reads my doc and does things right, then someone comes and follows the topic!
21:06 < A-KO> just seeing if what I'm looking for is already written somewhere :P then got caught up reading some more of the openvpn howto. Question will be forthcoming :P
21:08 < A-KO> bah, gotta login to search the forum..
21:08 < krzee> cool =]
21:08 < krzee> you might like google better for searching the forums (with site:forums.openvpn.net)
21:09 < A-KO> So I've given my vpn 192.168.1.0 and it's not working.....
21:09 < A-KO> jk :P
21:09 < krzee> hahaha
21:10 < A-KO> oh, looks like it was already answered on the forums. THanks for the google tip.
21:11 < A-KO> but, if anyone happens to know, anyone set up ipv6 to work with openvpn? i.e. handing out addresses over the tunnel to the tap adapter on the client? Or is that just not possible without the patch mentioned on the forums? (idea is to give users v4 and v6 addresses through the tunnel)
21:11 < A-KO> any links/docs/whichever if anyone's tried/done it. I don't mind reading.....
21:13 < A-KO> I saw v6 support is looking at 2.3 so perhaps I'll have to wait til then
21:20 < queequeg1> hrm, all the mtus said 1541.
21:20 < queequeg1> My tap was set to 1500.
21:20 < queequeg1> I changed it to 1450.
21:20 < queequeg1> Now there doesn't appear to be a problem.
21:21 < A-KO> tap shouldn't care about mtu? should it?
21:21 < queequeg1> Especially since it was all the same.  It should have matched up.
21:22 < queequeg1> but changing that mtu setting just fixed my packet loss issue.
21:22 < queequeg1> So there was something gong on involving mtu.
21:24 < queequeg1> krzee: fixed all my problems :-)
21:25 < krzie> =]
21:47 < queequeg1> Maybe it wasn't the mtu setting though.  There were tons of useless bindings on my tap interface.
21:47 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has quit [Ping timeout: 240 seconds]
21:47 < queequeg1> I made that change at the same time I fiddled with the mtu.
21:47 < queequeg1> I just switched the mtu back and I'm not getting any packet loss.
21:47 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has joined #openvpn
21:48 < queequeg1> Not to take anything away from the fact that you got me through my troubles :-)
21:50 -!- A-KO [as@unaffiliated/a-ko] has left #openvpn []
21:52 < krzie> i was thinking when you said:
21:52 <@vpnHelper> RSS Update - forum: Sharing a VPN with Squid Proxy <http://forums.openvpn.net/topic8067.html>
21:52 < krzie> [22:21]  <queequeg1> hrm, all the mtus said 1541.
21:52 < krzie> that you shouldnt need to adjust your MTU
21:52 < krzie> but when you said it fixed things, i figured ild just shuttup ;)
21:53 < krzie> especially because im far from an mtu expert, ive never had the reason to play with mtu
21:53 < krzie> even over satelite and crappy dsl, i always seem to have a fine mtu
21:53 < krzie> packet loss, jitter, and latency, im not always so lucky
21:53 < krzie> lol
21:53 < queequeg1> Well, I can't believe all the crap that is bound to a nic by default on windows 7.
21:54 < krzie> i can
21:54 < krzie> you did say windows...
21:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:01 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
22:04 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
22:06 -!- dirkD1 [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 248 seconds]
22:06 < queequeg1> have a good night.
22:06 < queequeg1> thanks again.
22:12 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
22:13 < krzie> you too, yw
22:13 < krzie> its easy to help people who have already helped themselves ;]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:43 -!- sparkymarkd [~mark@187.157.145.215] has joined #openvpn
22:52 -!- sparkymarkd [~mark@187.157.145.215] has quit [Remote host closed the connection]
22:52 -!- sparkymarkd [~mark@187.157.145.215] has joined #openvpn
23:01 -!- sparkymarkd [~mark@187.157.145.215] has quit [Remote host closed the connection]
23:02 -!- sparkymarkd [~mark@187.157.145.215] has joined #openvpn
23:07 -!- sparkymarkd [~mark@187.157.145.215] has quit [Remote host closed the connection]
23:07 -!- sparkymarkd [~mark@187.157.145.215] has joined #openvpn
23:15 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
23:16 -!- dvl [~dvl@nyi.unixathome.org] has joined #openvpn
23:20 -!- sparkymarkd [~mark@187.157.145.215] has quit [Ping timeout: 252 seconds]
23:21 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
23:53 -!- sparkymarkd [~mark@200.32.232.149] has quit [Ping timeout: 252 seconds]
23:58 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
23:59 -!- p3rror [~mezgani@41.140.96.121] has quit [Ping timeout: 240 seconds]
--- Day changed Fri May 06 2011
00:09 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:12 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:15 -!- K1ng` [~KING@180.211.188.211] has joined #openvpn
00:17 -!- p3rror [~mezgani@41.140.100.13] has joined #openvpn
00:19 -!- K1ng [~KING@180.211.188.211] has quit [Ping timeout: 276 seconds]
00:57 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:11 -!- s7r [~s7r@unaffiliated/s7r] has quit [Read error: Connection reset by peer]
01:12 -!- s7r [~s7r@82.137.15.221] has joined #openvpn
01:13 -!- s7r is now known as Guest73556
01:21 -!- Guest73556 [~s7r@82.137.15.221] has left #openvpn []
01:43 -!- buddha [~buddha@66.210.116.160] has quit [Ping timeout: 246 seconds]
01:44 -!- dazo_afk is now known as dazo
01:50 -!- buddha [~buddha@66.210.116.160] has joined #openvpn
01:57 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Po-ta-to, boil em, mash em, stick em in a stew.]
01:59 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:03 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 240 seconds]
02:04 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
02:04 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:05 < rommel092079> what directory to backup for the username and other related records like the lmitations of each user
02:06 < hyper_ch> I don't follow your question
02:07 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
02:08 < rommel092079> what I mean is that I have create user and its related limitations per user with kloxo. if I needed to back those, in what directory should I backup?
02:08 < rommel092079> is there a channel where I can posted question regarding kloxo?
02:08 < hyper_ch> I don't know what kloxo is
02:08 < rommel092079> ok thanks
02:19 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
02:21 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
02:32 <@vpnHelper> RSS Update - forum: windows xp as vpn-server - no route <http://forums.openvpn.net/topic8058.html#p11784>
02:33 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
02:39 <@vpnHelper> RSS Update - forum: Can ping in one direction, but not the other <http://forums.openvpn.net/topic8066.html#p11785>
02:44 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has quit [Ping timeout: 276 seconds]
02:51 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
02:51 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
03:03 <@vpnHelper> RSS Update - forum: Question If Network Connection Can Tell It's From Openvpn <http://forums.openvpn.net/topic8068.html>
03:10 -!- Killman [~network@unaffiliated/killman] has quit [Quit: bbl Zzzzzzzzzzzzzz]
03:45 <@vpnHelper> RSS Update - forum: Low throughput <http://forums.openvpn.net/topic8048.html#p11787>
03:51 <@vpnHelper> RSS Update - forum: Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html#p11788>
04:03 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
04:05 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Client Quit]
04:13 -!- Pechorin-M [~Vadim@host-109-171-16-255.bbcustomer.zsttk.net] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
04:18 -!- maxJadi [~maxJadi@dhcp-074082.eduroam.chalmers.se] has joined #openvpn
04:18 -!- maxJadi [~maxJadi@dhcp-074082.eduroam.chalmers.se] has quit [Changing host]
04:18 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:39 -!- mosasaur [~mosasaur@s5597c535.adsl.wanadoo.nl] has joined #openvpn
04:50 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has joined #openvpn
04:51 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has joined #openvpn
04:54 < mosasaur> "On Windows, install OpenVPN (or, if you already have it, click the start menu shortcut that creates a new TAP-Win32 device)." <== but which one?
04:56  * mosasaur wants to do this: https://code.google.com/p/badvpn/wiki/tun2socks
04:58 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
04:58 <@dazo> mosasaur: there is a "Add TAP adapter" icon in the start menu (somewhere in the OpenVPN group) iirc 
04:59 <@dazo> mosasaur: it's usually ran by default during installation as well ... you might even have it available, if you check the network panel
04:59 < mosasaur> thanks dazo, but I want to know which openvpn I should install
04:59 <@dazo> mosasaur: openvpn 2.2?
04:59 < mosasaur> this one ? http://openvpn.net/index.php/open-source/downloads.html
04:59 <@vpnHelper> Title: Downloads (at openvpn.net)
04:59 <@dazo> the latest and greatest is usually the best
04:59 <@dazo> yeah
04:59 <@dazo> that's the community version, which is supported here
05:01 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
05:01 <@vpnHelper> RSS Update - forum: Access to server local interface from client <http://forums.openvpn.net/topic8069.html>
05:02 -!- nb [~nb@fedora/nb] has quit [Read error: Operation timed out]
05:04 -!- mosasaur [~mosasaur@s5597c535.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
05:04 -!- harlan [~harlan@ntp/programmemanager/harlan] has quit [Ping timeout: 240 seconds]
05:04 -!- Guest74692 [~jason@li14-82.members.linode.com] has quit [Ping timeout: 276 seconds]
05:04 -!- nijotz [~nick@nijotz.com] has quit [Ping timeout: 260 seconds]
05:05 -!- mosasaur [~mosasaur@s5597c535.adsl.wanadoo.nl] has joined #openvpn
05:07 -!- amir is now known as kathrin
05:08 -!- kathrin is now known as amir
05:09 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has left #openvpn []
05:18 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:18 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:19 -!- mosasaur [~mosasaur@s5597c535.adsl.wanadoo.nl] has left #openvpn []
05:21 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
05:46 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
05:51 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
05:56 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11790>
05:59 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
06:06 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
06:17 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
06:31 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
06:41 -!- webmind [~webmind@yavin.puscii.nl] has left #openvpn []
07:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:25 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
07:29 -!- dvl [~dvl@nyi.unixathome.org] has quit [Changing host]
07:29 -!- dvl [~dvl@pdpc/supporter/active/dvl] has joined #openvpn
07:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:44 <@vpnHelper> RSS Update - forum: Access to server local interface from client <http://forums.openvpn.net/topic8069.html#p11791>
07:46 -!- zumbi [~zumbi@77.230.237.25] has quit [Quit: Lost terminal]
07:46 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
07:48 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
07:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 248 seconds]
07:51 -!- kmw [~kmw@fergie.appstate.edu] has joined #openvpn
07:54 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:56 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
08:00 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
08:00 -!- MarKsaitis [~MarKsaiti@86.28.106.135] has joined #openvpn
08:08 <@vpnHelper> RSS Update - forum: [SOLVED] Access to server local interface from client <http://forums.openvpn.net/topic8069.html#p11791>
08:15 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
08:16 < bent_screwdriver> does mtu adjustments have to be set/same on client AND server?
08:16 < bent_screwdriver> having issue with a dsl user.....
08:17 <@dazo> bent_screwdriver: I believe it has to be the same ... but I've been wondering about the same
08:18 <@dazo> --tun-mtu must be the same, that's clear enough (MTU inside the tunnel) ... but --link-mtu, that's more unclear for me
08:21 -!- MarKsaitis [~MarKsaiti@86.28.106.135] has quit [Ping timeout: 258 seconds]
08:21 -!- linuxgecko [~gecko@99-182-113-98.lightspeed.clmboh.sbcglobal.net] has quit [Read error: Operation timed out]
08:29 < ecrist> !mtu
08:29 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
08:47 < bent_screwdriver> i wound up setting fragment 1200 and mssfix and that worked. set it on both the server and the client but not really sure which one HAS to have those settings either...
08:47 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
09:10 -!- kmw [~kmw@fergie.appstate.edu] has left #openvpn []
09:24 < bent_screwdriver> !fragment
09:24 <@vpnHelper> "fragment" is http://openvpn.net/archive/openvpn-users/2005-01/msg00411.html if getting FRAG_IN error
09:26 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
09:28 < bent_screwdriver> anyone know if the fragment and mssfix options can be pushed? there is a limited list of pushable options on the how-to
09:41 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
09:41 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:42 < gladiatr> I would imagine not.  Options are not processed until after a connection is established.  
09:42 < gladiatr> Can always try... if you see them come through on the client's log, that'll indicate that they are indeed pushable.
09:47 < DeeJayTwo> I have a site to site vpn on pfsense 2 using openvpn and I want to make a port redirection from site A WAN to Site B client
09:48 < DeeJayTwo> openvpn server interface is 172.31.0.1 -> 172.31.0.2 and client interface is 172.31.0.6 -> 172.31.0.5 !?  ..  
09:48 < DeeJayTwo> So I tried to make a redirection from site a WAN to 172.31.0.6 
09:48 < DeeJayTwo> then, on site B router I make another port redirection to the final client so the path is completed
09:49 < DeeJayTwo> but it doesn't work
09:49 < DeeJayTwo> firewalling seems properly configured... nmap from site a router to 172.31.0.6 shows the redirected port open
09:49 < DeeJayTwo> same thing for the client..
09:49 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
09:51 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 258 seconds]
09:53 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
09:56 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:59 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
09:59 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
09:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
09:59 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:51 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467-15.html#p11792>
11:00 -!- Killman [~network@unaffiliated/killman] has joined #openvpn
11:00 -!- Killman [~network@unaffiliated/killman] has quit [Client Quit]
11:01 -!- Killman [~network@unaffiliated/killman] has joined #openvpn
11:09 -!- dazo is now known as dazo_afk
11:15 < bent_screwdriver> !mssfix
11:19 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
11:22 -!- sparkymarkd [~mark@200.32.232.84] has joined #openvpn
11:30 -!- sparkymarkd [~mark@200.32.232.84] has quit [Ping timeout: 240 seconds]
11:31 < krzie> !man
11:31 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
11:31 -!- sparkymarkd [~mark@200.32.232.82] has joined #openvpn
11:33 <@vpnHelper> RSS Update - forum: slow between branch oficce and head office <http://forums.openvpn.net/topic8001.html#p11793>
11:34 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
12:04 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
12:19 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
12:27 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
12:28 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
12:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:32 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:38 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
12:38 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has quit [Changing host]
12:38 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:38 -!- mode/#openvpn [+o raidz] by ChanServ
12:55 < ecrist> boats and hos
12:55 < ecrist> BSDCan next week, bitches!
13:22 < gladiatr> I will be sending vaguely maple leaf-shaped thoughts north
13:36 -!- p3rror [~mezgani@41.140.100.13] has quit [Ping timeout: 260 seconds]
13:39 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
13:40 -!- Vutral [tffNHUUZnq@vutral.net] has quit [Ping timeout: 240 seconds]
13:47 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
13:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:49 -!- p3rror [~mezgani@41.140.46.234] has joined #openvpn
13:50 -!- Vutral [ss@vutral.net] has joined #openvpn
14:15 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:29 -!- nijotz [~nick@nijotz.com] has joined #openvpn
14:32 -!- nijotz [~nick@nijotz.com] has quit [Client Quit]
14:33 -!- nijotz [~nick@nijotz.com] has joined #openvpn
14:33 -!- nijotz [~nick@nijotz.com] has quit [Read error: Connection reset by peer]
14:34 -!- nijotz [~nick@nijotz.com] has joined #openvpn
14:39 -!- queequeg1_ [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
14:40 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
14:41 -!- queequeg1_ is now known as queequeg1
14:42 -!- nijotz [~nick@nijotz.com] has quit [Remote host closed the connection]
14:48 -!- Guifort [~Guifort@78.123.162.68] has joined #openvpn
14:49 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
14:50 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Quit: Going offline, see ya! (www.adiirc.com)]
15:16 -!- tekk [~me@77.79.11.25] has joined #openvpn
15:18 < tekk> hi guys, i'm currently using openvpn and its working well.. however presently i'm allocating the range 10.9.0.0/24 to connecting clients (each client receives a static ip that is chosen by openvpn)... the machine itself has several public ip's and i'm using  pf (freebsd) to route all traffic from each public ip to a specific 10.9.0.0/24 connected client.
15:19 < tekk> Is there a way openvpn can give that public ip directly to the client and handle routing?
15:19 < tekk> so that the clients receive the public ip rather than the private 10.9 one ?
15:24 < K1ng`> tekk, there is no way to do that
15:25 -!- K1ng` is now known as k1ng
15:27 < tekk> i'm sure thats not correct...
15:27 < tekk> i have a theory
15:27 < tekk> but i donn't have a rage big enough
15:52 <@vpnHelper> RSS Update - forum: Client OS that crashes won't be allowed to reconnect to serv <http://forums.openvpn.net/topic8070.html>
15:54 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
15:54 -!- mode/#openvpn [+o dazo] by ChanServ
15:54 <@dazo> krzee:  ping ... you around?
16:00  * dazo wonders what this means on openbsd ...
16:00 <@dazo> openvpn: writing to routing socket: Protocol not supported
16:04 -!- darkdrgn2k [~yurko@204.101.63.212] has joined #openvpn
16:04 < darkdrgn2k> hi
16:04 < darkdrgn2k> why would my ipp.txt files have duplicate entries when i dont have duplicate-ns enabled
16:08 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
16:13 -!- Guifort_ [~Guifort@78.123.162.68] has joined #openvpn
16:13 -!- Guifort [~Guifort@78.123.162.68] has quit [Read error: Connection reset by peer]
16:28 < krzee> pong
16:29 < krzee> sup dazo
16:29 <@dazo> krzee:  ahh, there you are :)  I'm trying to get openvpn to run on openbsd ...
16:29 <@dazo> and I get some strange errors related to ifconfig
16:29 <@dazo> openvpn: writing to routing socket: Protocol not supported
16:29 < krzee> ohhh i wonder if thats one of those things i ran across long ago
16:29 <@dazo> and then later on
16:30 <@dazo> Fri May  6 23:29:46 2011 us=11725 Socket Buffers: R=[16384->65536] S=[16384->65536]
16:30 <@dazo> openvpn: writing to routing socket: Protocol not supported
16:30 <@dazo> Fri May  6 23:29:46 2011 us=13766 /sbin/ifconfig tun0 destroy
16:30 <@dazo> Fri May  6 23:29:46 2011 us=26105 /sbin/ifconfig tun0 create
16:30 <@dazo> Fri May  6 23:29:46 2011 us=36010 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
16:30 <@dazo> Fri May  6 23:29:46 2011 us=36939 /sbin/ifconfig tun0 192.168.200.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.200.255 link0
16:30 <@dazo> Fri May  6 23:29:46 2011 us=47476 OpenBSD ifconfig failed: external program fork failed
16:30 < krzee> oh cool vpnHelper must like you
16:30 <@dazo> if I run the ifconfig manually ... it works
16:31 <@dazo> heh
16:31 < krzee> interesting
16:31 < krzee> my openbsd vm is at home
16:32 <@dazo> I was wondering if there were some other strange config settings (OS wise) which I need to twist ... kernel modules to load, or something alike
16:32 < krzee> nope, shouldnt be
16:32 < krzee> should be the same config as linux
16:33 <@dazo> yeah, and this is the only thing it kicks at ... and declines to start
16:33 <@dazo> I'm running openbsd in a vm (kvm in Linux) ... but don't think that matters
16:33 < krzee> nope, doesnt matter
16:33  * dazo is checking that his eurephia project works on openbsd as well
16:34 < krzee> i had obsd woes before tho
16:34 < krzee> dont we have an openbsd dev?  i forget exactly who
16:34 <@dazo> what is this 'link0' at the end of the ifconfig? could that be a suspect?
16:35 <@dazo> (probably not, as it works "outside" openvpn)
16:35 <@dazo> actually, I notice that the tun0 device *is* created
16:35  * dazo probably need to figure out why openvpn believes it fails
16:36 <@dazo> (and I've tried both 2.2 and 2.1.4)
16:38 < krzee> ohh
16:38 < krzee> try loading it manually first
16:38 <@dazo> ifconfig tun0 create?
16:38 < krzee> tun module was loaded manually already?
16:38 <@dazo> I believe so ...
16:38 < krzee> maybe the openvpn way, openvpn --mktun --dev tun0
16:39 <@dazo> ahh
16:39 <@dazo> good idea
16:40 <@dazo> huh?  no --mktun ....
16:40 < krzee> oh right
16:40 < krzee> mkdev
16:40 <@dazo> blah
16:40 < krzee> and then you'll need to use static dev in the config
16:40 < krzee> dev tun0 instead of dev tun
16:40 < krzee> if that works and dynamic tun doesnt, it should give a lead
16:41 <@dazo> yeah, that's already done
16:41 < krzee> that was already done!?
16:41 < krzee> without a static device?
16:41 < krzee> if so, that was the problem
16:41 <@dazo> hmm ... no --mkdev
16:41 < krzee> dev tun0 shouldnt make the device
16:41  * dazo checks man page
16:41 <@dazo> aha ... maybe that's the error
16:42 < krzee> could be... dev tun makes a dynamic device, dev tun0 does not, expects you already made it
16:42 <@dazo> mm
16:42 < krzee> hrm, it *is* mktun
16:42 < krzee>        --mktun
16:42 < krzee>               (Standalone)  Create a persistent tunnel on platforms which support them such as Linux. 
16:43 < krzee> if its not working, openbsd might not support it
16:43 <@dazo> yeah, and it's lacking on openbsd ... so probably the latter
16:43 < krzee> however, first try just making it tun dev
16:43 <@vpnHelper> RSS Update - forum: multiple vpn and AD authentication <http://forums.openvpn.net/topic8071.html>
16:44 <@dazo> it seems openvpn insist on this: Fri May  6 23:44:22 2011 us=899235 /sbin/ifconfig tun0 destroy
16:44 <@dazo> Fri May  6 23:44:22 2011 us=910985 /sbin/ifconfig tun0 create
16:45 <@dazo> Fri May  6 23:44:22 2011 us=920097 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
16:45 <@dazo> Fri May  6 23:44:22 2011 us=920510 /sbin/ifconfig tun0 192.168.200.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.200.255 link0
16:45 <@dazo> Fri May  6 23:44:22 2011 us=930037 OpenBSD ifconfig failed: external program fork failed
16:45  * dazo adds some hooks into the last check
16:46 < krzee> why does tun0 exist prior?
16:46 <@dazo> because I did: ifconfig tun0 create before starting it
16:46 <@dazo> to try to create it in advance
16:47 < krzee> ahh ok
16:47 < krzee> but then you used dev tun0
16:47 < krzee> right?
16:47 < krzee> dev tun should want to destroy
16:47 < krzee> dev tun0 should not
16:48 < krzee> hrm, maybe dev tun shouldnt want to destroy, maybe it would skip and make dev tun1... im not sure not...
16:48 <@dazo> eah, dev tun0
16:48 < krzee> not sure if it makes it own even if you arent using the existing
16:48 < krzee> weird, i would expect it to not destroy a static dev..
16:48 < krzee> people sometimes make those so that they can configure it prior outside ovpn
16:49 <@dazo> yeah
16:51 <@dazo> huh!? 
16:51 <@dazo> 	      if (pid == (pid_t)0) /* child side */
16:51 <@dazo> 		{
16:51 <@dazo> 		  execve (cmd, argv, envp);
16:51 <@dazo> 		  exit (127);
16:51 <@dazo> 		}
16:52 <@dazo> maybe execve() behaves differently, and that exit (127); is reached on openbsd
16:53 < krzee> really interesting this didnt happen before tho
16:53 < krzee> has that code changed since 2.1.1?
16:53  * dazo checks
16:54 <@dazo> nope, not misc.c which does all this execve()
16:57 <@dazo> hmmm ... okay, it's not that code which fails, it seems (unless 127 is converted to -1 along the road)
16:58 <@dazo> waitpid() (/sbin/ifconfig) returned: -1 - Interrupted system call
16:59 <@dazo> (my debug info)
16:59 <@dazo> btw ... this is openbsd 4.8
16:59 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:04 <@vpnHelper> RSS Update - forum: Client OS that crashes won't be allowed to reconnect to serv <http://forums.openvpn.net/topic8070.html#p11796>
17:10 <@vpnHelper> RSS Update - forum: multiple vpn and AD authentication <http://forums.openvpn.net/topic8071.html#p11797>
17:13 <@dazo> krzee:  I found a workaround .... --script-security 1 system   
17:14 < krzee> erm really!?
17:14 < krzee> but that shouldnt even effect that!
17:14 < krzee> its not an external script!
17:14 <@dazo> yeah, it seems the execve() implementation is not working so well on openbsd ... so the last argument ('system') makes it use the less safer system() function instead of execve()
17:15 <@dazo> system() is prone to shell injections ... while execve() is not
17:16 < krzee> ohhh
17:22 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 276 seconds]
17:22 <@vpnHelper> RSS Update - forum: Question If Network Connection Can Tell It's From Openvpn <http://forums.openvpn.net/topic8068.html#p11798>
17:25 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:33 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:34 <@vpnHelper> RSS Update - forum: problem connecting to private network.. <http://forums.openvpn.net/topic8072.html>
17:49 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:53 -!- takamichi [Takamichi@46.11.92.98] has joined #openvpn
18:01 -!- sparkymarkd [~mark@200.32.232.82] has quit [Ping timeout: 258 seconds]
18:01 -!- p3rror [~mezgani@41.140.46.234] has quit [Remote host closed the connection]
18:02 -!- tekk [~me@77.79.11.25] has quit [Quit: tekk]
18:09 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
18:21 -!- JyZyXEL [~lol@a88-112-69-207.elisa-laajakaista.fi] has joined #openvpn
18:21 <@vpnHelper> RSS Update - forum: multiple vpn and AD authentication <http://forums.openvpn.net/topic8071.html#p11800>
18:23 < JyZyXEL> when the build-key script asks for 'extra' attributes "challenge password" and "company name" do they need to be something spesific or can they be anything?
18:23 <@dazo> JyZyXEL:  leave 'extra' and 'challenge password' blank ... company name, as you wish
18:24 < JyZyXEL> so they can be anything?
18:24 <@dazo> company name can be anything .... leave 'extra' and 'challenge password' blank
18:24 < JyZyXEL> company name and challenge password are the extra attributes
18:25 < JyZyXEL> its actually and "optional company name"
18:25 < JyZyXEL> i think i put something in those fields when creating the server cert
18:25 <@dazo> ahh, okay, that's fine ... then don't touch the challenge password, that is the tricky one
18:25 < JyZyXEL> but i have no idea what i used because it was months ago
18:26 <@dazo> challenge password is used in some very special situations, but I've forgotten what/how that was
18:26 <@dazo> the others are not used for other things than information, iirc
18:28 <@vpnHelper> RSS Update - forum: problem connecting to private network.. <http://forums.openvpn.net/topic8072.html#p11801>
18:29 < krzee> ive never seen that special situation before
18:29 -!- p3rror [~mezgani@41.140.46.234] has joined #openvpn
18:29 <@dazo> krzee:  its a kind of "reverse" authentication for CA, iirc ... that the CA needs to enter the challenge password to be able to sign a csr ... or something like that
18:30  * dazo believe he read something about that in jjk's book as well
18:30 < krzee> erm
18:30 < krzee> well you can put challenge pw on your CA
18:31 < krzee> then you must enter it to sign certs
18:31 < krzee> ive done that
18:31 < krzee> but if you meant theres a special situation where you can use it in client certs, ive never seen that
18:32 <@dazo> yeah, you might be right ... the exact details are blurry for me now :)
18:32 -!- nb [~nb@fedora/nb] has joined #openvpn
18:36  * dazo decides to find his bed
18:36 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Quit: Leaving]
18:37 < krzee> i hope he finds it!
18:40 < JyZyXEL> so if you revoke some client certificates from your server, you need to distribute a new root CA certificate to all clients?
18:41 < krzee> !crl
18:41 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
18:41 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
18:42 < JyZyXEL> ok but does this revocation list file need to be distributed to all clients?
18:42 < krzee> server only
18:43 < krzee> since the server checks the CRL
18:43 < krzee> how would it help for the clients to have a list of revoked clients?
18:43 < JyZyXEL> yeah it wouldn't
18:44 < JyZyXEL> i used the revoke-full script on a cert and the last line was "error 23 at 0 depth lookup:certificate revoked" does that mean it worked?
18:44 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:44 < krzee> i highly doubt it
18:44 < krzee> thats an openssl error by the way
18:45 < krzee> in case that helps your googlefu
18:47 < JyZyXEL> meh. ill just assume it worked
18:48 < krzee> lol
18:48 < krzee> then why bother asking
18:48 < krzee> "did it work?"  "no"  "ok ill pretend it did"
18:48 < krzee> LOL
18:48 < JyZyXEL> its the kind of output you don't really know if it worked
18:49 < krzee> no its not
18:49 < krzee> it DIDNT
18:49 < krzee> thats why it gave an error
18:49 < JyZyXEL> it said "certificate revoked"
18:49 < JyZyXEL> and "Revoking Certificate" and "Data Base Updated"
18:49 < krzee> that was the bash script
18:49 < krzee> openssl gave an error
18:49 < krzee> lol
18:50 < krzee> but thats not even what im talking about
18:50 < krzee> you knew it didnt look right, so you asked if it worked
18:50 < krzee> when i said i highly doubt it, you decided you didnt care that it didnt work, and would pretend it did
18:50 < JyZyXEL> something as important as revoking certificates should output: WARNING: THE CERTIFICATE WAS NOT REVOKED
18:50 < krzee> which raises the question:  why bother asking?
18:51 < krzee> feel free to modify the script if you care
18:51 < JyZyXEL> if it failed to revoke a cert
18:52 < krzee> if i even used easy-rsa ild consider caring enough to modify it myself
18:52 < krzee> but i dont, and dont
18:52 < JyZyXEL> there is something better?
18:52 < krzee> imo there is
18:52 < krzee> !ssl-admin
18:52 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
18:54 < JyZyXEL> is it part of openssl?
18:54 < krzee> umm
18:54 < krzee> neither of them are part of openssl
18:55 < krzee> they both USE openssl to do what you want
18:55 < krzee> they are both simply wrappers for openssl
18:59 < JyZyXEL> list-crl lists the revoked cert and theres a crl.pem file in keys/
19:00 < krzee> test it out
19:01 < JyZyXEL> im guessing it needs to go in /etc/openvpn/ and then restart the server first
19:04 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
19:04 <@vpnHelper> RSS Update - forum: Can ping in one direction, but not the other <http://forums.openvpn.net/topic8066.html#p11802>
19:36 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
19:43 -!- Killman [~network@unaffiliated/killman] has quit [Read error: Connection reset by peer]
20:01 -!- Guifort_ [~Guifort@78.123.162.68] has quit [Quit: Quitte]
20:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
20:09 -!- master_of_master [~master_of@p57B55AA4.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:11 -!- master_of_master [~master_of@p57B573E7.dip.t-dialin.net] has joined #openvpn
20:28 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has joined #openvpn
21:10 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
21:11 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
21:28 -!- dirkD1 [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
21:30 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
21:45 -!- Squidy [~quassel@189.72.179.180] has quit [Ping timeout: 248 seconds]
21:50 -!- k1ng [~KING@180.211.188.211] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
21:53 < krzee> JyZyXEL, it goes wherever you said in the config
21:53 < krzee> and you only need to restart the server if it didnt reference the CRL already
21:53 < krzee> if it did, just changing the CRL file does not require a restart
21:54 -!- K1ng [~KING@180.211.188.211] has joined #openvpn
21:58 -!- colision [logos@189.81.115.7] has joined #openvpn
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:41 -!- p3rror [~mezgani@41.140.46.234] has quit [Remote host closed the connection]
23:03 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has left #openvpn []
23:44 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
23:52 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:52 -!- oc80z [oc80z@blea.ch] has joined #openvpn
--- Day changed Sat May 07 2011
01:41 <@vpnHelper> RSS Update - forum: Configuration issue <http://forums.openvpn.net/topic8056-15.html#p11803>
01:50 -!- whtsup [hello@175.110.249.142] has joined #openvpn
01:50 < whtsup> hello 
01:50 < whtsup> my openvpn client is not bypassing internet 
01:50 < whtsup> but i can ping to server and client
01:53 < krzie> !redirect
01:53 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
01:54 < whtsup> !def1
01:54 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
01:55 < Bushmills> "not bypassing"?
01:55 < whtsup> yah
01:55 < whtsup> not bypassing 
01:55 < whtsup> local network is working fyne 
01:55 < Bushmills> how would you bypass internet?
01:56 < krzie> likely some sort of firewall in place he wants to go around
01:56 < Bushmills> try to use different words for what you intend to achieve
01:56 < whtsup> iptables r off on my server 
01:56 < whtsup> push "redirect-gateway def1"
01:56 < whtsup> i have just uncomment this line 
01:56 < krzie> well you need iptables for your NAT
01:57 < krzie> !linnat
01:57 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
01:57 < whtsup> push "dhcp-option DNS 10.10.10.1"
01:57 < whtsup> push "dhcp-option WINS 10.10.10.1"
01:58 < whtsup> my dhcp server is 10.10.10.0
01:58 < whtsup> can u plz tell me these setting are correct ?
01:58 < Bushmills> seems that whtsup knows what he wants or needs. so i can hide again
02:00 < whtsup> ?
02:01 < whtsup> !nat
02:01 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
02:02 -!- K1ng [~KING@180.211.188.211] has quit [Read error: Connection reset by peer]
02:02 -!- K1ng [~KING@180.211.188.211] has joined #openvpn
02:13 -!- whtsup [hello@175.110.249.142] has quit [Ping timeout: 240 seconds]
02:15 -!- whtsup [~hello@14.192.144.21] has joined #openvpn
02:15 -!- whtsup [~hello@14.192.144.21] has quit [Client Quit]
02:34 <@vpnHelper> RSS Update - forum: vpn goes slower and slower <http://forums.openvpn.net/topic8073.html>
02:57 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
02:57 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
02:57 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
03:24 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:45 -!- abstrakt [debian-tor@gateway/tor-sasl/abstrak1] has joined #openvpn
03:50 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has quit [Ping timeout: 248 seconds]
03:52 < abstrakt> how do I know what subnet to use? primarily I'm talking about e.g. 10.8.0.1 in this context http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
03:52 <@vpnHelper> Title: Static Key Mini-HOWTO (at www.openvpn.net)
03:53 < abstrakt> there's 10.0.0.0 176.16.0.0 and 192.168.0.0 right, so if my LAN is on 176.16.0.0 then should I use that for my VPN config? does it matter?
03:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:54 < abstrakt> like, if my LAN is on 176 and I use this config http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
03:55 <@vpnHelper> Title: Static Key Mini-HOWTO (at www.openvpn.net)
03:55 < abstrakt> will there be conflicts?
03:55 < abstrakt> I mean, will I need to set up a bridge on my localhost as well so that i can bridge my 176 network over to 10.0.0.0 ?
03:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
03:59 -!- abstrakt [debian-tor@gateway/tor-sasl/abstrak1] has quit [Quit: Leaving]
04:13 -!- hadees [~hadees@72-48-91-73.dyn.grandenetworks.net] has quit [Quit: hadees]
04:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:23 < Bushmills> !1918
04:23 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
04:44 -!- teloniusz [goldie@inferno.hell.pl] has quit [Ping timeout: 276 seconds]
04:44 -!- teloniusz [goldie@inferno.hell.pl] has joined #openvpn
05:07 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 248 seconds]
05:49 -!- apus [~tux@p5790306A.dip.t-dialin.net] has joined #openvpn
05:50 < apus> hi, i would like to know if ta.key and the server key/certificate should be different for each network (on the same server) i set up? furthermore after i have created all stuff in the easy-rsa dir and cleaned it, how can i generate client keys afterwards?
05:53 -!- Champi [Champi@rootshell.fr] has joined #openvpn
05:55 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Quit: leaving]
05:57 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
05:58 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has joined #openvpn
06:04 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
06:50 -!- apus [~tux@p5790306A.dip.t-dialin.net] has quit [Read error: Operation timed out]
06:51 -!- apus [~tux@p5790306A.dip.t-dialin.net] has joined #openvpn
07:00 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
07:10 <@vpnHelper> RSS Update - forum: Fresh Install client connect warning message <http://forums.openvpn.net/topic8074.html>
07:29 -!- sparkymarkd [~mark@200.32.232.149] has quit [Remote host closed the connection]
07:39 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 250 seconds]
07:55 -!- Clete2 [~Clete2@70.15.66.134.res-cmts.man2.ptd.net] has quit [Read error: Operation timed out]
08:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
08:23 -!- varta [~varta@unaffiliated/contempt] has quit [Remote host closed the connection]
08:42 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
10:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:29 -!- apus [~tux@p5790306A.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
10:34 -!- hadees [~hadees@72-48-91-73.dyn.grandenetworks.net] has joined #openvpn
11:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:21 -!- Fonzie- [torgeir@94-246-17.67.3p.ntebredband.no] has joined #openvpn
11:22 < Fonzie-> !welcome
11:22 < Fonzie-> !goal
11:22 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
11:37 < krzie> ecrist, vpnhelper's server is down
11:39 -!- ziloni [~ziloni@208.70.93.89] has joined #openvpn
11:40 < ziloni> Sat May 07 12:39:02 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
11:40 < ziloni> Sat May 07 12:39:02 2011 TLS Error: TLS handshake failed
11:40 < ziloni> any idea what could cuase this? Im using the wizard in pfsense 2.0 and have tried redoing it multiple times but always get this.
11:43 < krzie> yes
11:43 < krzie> a general network error
11:43 < ziloni> when trying to use TCP I get connection resets instead... so that woudl be consistent
11:43 < krzie> ie: server isnt running, its on the wrong port/ip/protocol, it is blocked by a firewall, it is behind a nat without port forwarding
11:44 < ziloni> if running tCP, I can telnet to 1194 though, so it apeears to be running and available
11:45 < ScriptFanix> ziloni: got this recently, when testing one client… client was on LAN connecting to the WAN IP… servers responds with LAN IP, client rejects server. Server logs timeout
11:45 < ScriptFanix> logs on the client were more specific
11:45 < ziloni> hmm... how to see if that is the case? would that be in the logs?
11:45 < ScriptFanix> check the client's logs
11:45 < ziloni> I dont see that in the client logs
11:45 < ziloni> I just turned of TLS as a test
11:46 < ziloni> but still no connectin
11:47 < ScriptFanix> something like this : Jan  1 01:00:15 jedrik ovpn-roadwarrior[1171]: TCP/UDP: Incoming packet rejected from [AF_INET]192.168.1.254:1194[2], expected peer address: [AF_INET]80.67.176.11:1194 (allow this incoming source address/port by removing --remote or adding --float)
11:47 < ziloni> nothing like that in the logs... just sec..
11:49 < ScriptFanix> that was juste an idea, your problem might be something totally different
11:50 < ScriptFanix> ziloni: using TCP, is it the client or the server that resets the connection ?
11:50 < ziloni> I think server.... im on UDP again.. will send alog just a sec.. then can ttry tcp
11:51 < ScriptFanix> try log level 3 or more
11:51 < ziloni> where do I set the log level?
11:52 < ScriptFanix> using the verb statement in client and server config
11:56 < ziloni> hmm.. do I have to set it on both server and client? Now I get a:
11:56 < ziloni> Sat May 07 12:56:17 2011 Local Options hash (VER=V4): '9e7066d2'
11:56 < ziloni> Sat May 07 12:56:17 2011 Expected Remote Options hash (VER=V4): '162b04de'
11:57 < ziloni> or is that just more errorsshowig becuase more verbosity?
11:57 < ziloni> Sat May 07 12:56:12 2011 OpenVPN 2.2.0 Win32-MSVC++ [SSL] [LZO2] built on Apr 26 2011
11:57 < ziloni> Sat May 07 12:56:17 2011 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
11:57 < ziloni> Sat May 07 12:56:17 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
11:57 < ziloni> Sat May 07 12:56:17 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
11:57 < ziloni> Sat May 07 12:56:17 2011 Control Channel Authentication: using 'pfsense-udp-1194-tls.key' as a OpenVPN static key file
11:57 < ziloni> Sat May 07 12:56:17 2011 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
11:58 < ziloni> Sat May 07 12:56:17 2011 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
11:58 < ziloni> Sat May 07 12:56:17 2011 LZO compression initialized
11:58 < ziloni> Sat May 07 12:56:17 2011 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
11:58 < ziloni> Sat May 07 12:56:17 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
11:58 < ScriptFanix> do *NOT* paste your whole log here!
11:58 < ziloni> Sat May 07 12:56:17 2011 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
11:58 < ziloni> Sat May 07 12:56:17 2011 Local Options hash (VER=V4): '9e7066d2'
11:58 < ziloni> Sat May 07 12:56:17 2011 Expected Remote Options hash (VER=V4): '162b04de'
11:58 < ziloni> Sat May 07 12:56:17 2011 UDPv4 link local (bound): [undef]:1194
11:58 < ScriptFanix> use pastebins!
11:58 < ziloni> Sat May 07 12:56:17 2011 UDPv4 link remote: 82.165.153.111:1194
11:58 < ziloni> Sat May 07 12:57:17 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
11:58 < ziloni> Sat May 07 12:57:17 2011 TLS Error: TLS handshake failed
11:58 < ziloni> Sat May 07 12:57:17 2011 TCP/UDP: Closing socket
11:58 < ziloni> Sat May 07 12:57:17 2011 SIGUSR1[soft,tls-error] received, process restarting
11:58 < ziloni> Sat May 07 12:57:17 2011 Restart pause, 2 second(s)
11:58 < ScriptFanix> or paste relevent extracts
11:58 < ziloni> Sat May 07 12:57:19 2011 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the defau
11:58 < ziloni> ugh.. ditn realize it was such a big paste.. sorry
11:58 < ziloni> sorry.. meant to paste a small amoutn
11:59 < ziloni> http://pastebin.com/13ZGMf33
12:01 < krzie> lucky my bot is down
12:01 < krzie> he would have auto-banned
12:02 < ziloni> I reselected the relevant prts, but it didnit copy and I hit paste and it went straight through from the prevoius copy
12:02 < ziloni> sorry.. eveyrone makes mistakes.. I noticed it as soon as it went out, but theres no way to revoke a message that I can se
12:02 < krzie> all good, like i said my bot is down
12:03 < krzie> you didnt get auto-banned, and i believe you that it wasnt on purpose ;]
12:03 < ScriptFanix> ziloni: that's the server's log or the client's ?
12:03 < ziloni> client
12:05 < ScriptFanix> looks like the server refuses the connection for some reason
12:05 < ScriptFanix> we'll need its log
12:05 < ziloni> hmm.. have to figure out how to get that.. its pfsense... let me get onto the term.. but I just noticedt his in the pfsense status:
12:05 < ecrist> l8r
12:05 < ziloni> Common Name 	Real Address 	Virtual Address 	Connected Since 	Bytes Sent 	Bytes Received
12:05 < ziloni> [error] 	Management Daemon Unreachable 		0 	0 	0 
12:05 < ecrist> krzie: I'll look into it
12:06 < ecrist> looks like I bumped the network cable down there.  Let me go plug it back in
12:07 < ziloni> ok... got to the shell. where would the pfsense logs be found on the server?
12:08 < ScriptFanix> no idea. check /var/log/daemon.log or similar
12:08 < ecrist> krzie: power got unplugged.  I plugged it back in
12:08 < ziloni> found a openvpn.log in var/log.. it has an error.. jsut sec
12:09 < ziloni> serverdiretive network/netmask combination is invalid.. hmm... let me go check them.. Im pretty sure they were fine..
12:11 < ziloni> ew.... I think I know what it is...
12:12 < ziloni> progress... had the netmask specified backwards... had /8 instead of /24
12:12 < ziloni> but still soem issue.. let me reset the system just to eb sure.
12:17 < ziloni> server log is clean now, no errors
12:18 -!- JyZyXEL [~lol@a88-112-69-207.elisa-laajakaista.fi] has left #openvpn ["WeeChat 0.3.5-dev"]
12:19 < ziloni> but client:
12:19 < ziloni> http://pastebin.com/2yNP9DGL
12:19 < ziloni> let me recheck server log after I treid to connect
12:20 < ziloni> last thing in serer log is "initiliazation completed". is there more than oen server log for openvpn
12:20 < krzie> ecrist, thank you
12:23 < ziloni> hmm.. keydirs are mismatching...
12:25 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
12:25 < ziloni> what is a keydir? :)
12:29 < ziloni> I think this is all cuased by the cert bugs in the pfsense RC :(
12:32 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
12:32 -!- mode/#openvpn [+o vpnHelper] by ChanServ
12:35 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
12:52 < ScriptFanix> don't expect openvpn PKI to work if there are bugs in certificate creation/handling…
12:52 < ziloni> thats what appears to be the issue.. it has "ghost" certs...
12:52 < ziloni> pfsense acknowledged theyve seen it before
12:52 < ziloni> I tried to wrok around it by cahnging them, but it seems something is left over
12:52 < ziloni> I just did seomthing difernet again.. maybe it will work this time
12:53 < ScriptFanix> try the easy-rsa scripts
12:54 < hyper_ch> is rsa still save?
12:54 < ScriptFanix> works like a charm, takes less than a minutes (not counting prime numbers generation)
12:55 < ziloni> ugh.. I deleted all.. redid it and this time pfsense used the right certs...
12:55 < ziloni> but I still get this:
12:55 < ziloni> Sat May 07 13:55:11 2011 us=32000 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
12:55 < ziloni> Sat May 07 13:55:11 2011 us=32000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
12:55 < ziloni> (ie mismatch)
12:55 < ziloni> thats not correct rigth?
12:56 < ziloni> (one has keydir 0 and one has keydir 1)
12:58 < krzie> wtf is keydir
12:58 < ziloni> I dunno...
12:58 < krzie> !man
12:58 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
12:59 < krzie> could be key direction, if its using static keys
12:59 < ziloni> didnt find much on keydir in google, not sure anything si in man
12:59 < ziloni> trying TCP now.. someone had this error before when UDP couldnt travel both ways.
12:59 < krzie> interesting
12:59 < krzie> the ONLY time keydir appears in the manual:
12:59 < krzie> "Options that will be compared for compatibility include dev-type, link-mtu, tun-mtu, proto, tun-ipv6, ifconfig, comp-lzo, fragment, keydir, cipher, auth, keysize, secret, no-replay, no-iv, tls-auth, key-method, tls-server, and tls-client."
13:01 < ScriptFanix> looks like there's a documentation bug here :)
13:01 < ziloni> sam prob with TCP :(
13:01 < ziloni> http://pastebin.com/NrZcimAP
13:02 < krzie> i dont even see an error
13:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
13:02 < krzie> thats still a general network error
13:02 < ziloni> yes.... but why? I can telnet to it.. so it seomthign happenign during connect... the firewall is open...
13:02 < krzie> [12:41]  <ziloni> any idea what could cuase this? Im using the wizard in pfsense 2.0 and have tried redoing it multiple times but always get this.
13:02 < krzie> [12:44]  <krzie> yes
13:02 < krzie> [12:44]  <krzie> a general network error
13:02 < krzie> [12:44]  <ziloni> when trying to use TCP I get connection resets instead... so that woudl be consistent
13:02 < krzie> [12:45]  <krzie> ie: server isnt running, its on the wrong port/ip/protocol, it is blocked by a firewall, it is behind a nat without port forwarding
13:03 < krzie> your client doesnt have the right ip/port/proto if you were able to telnet to it manually
13:03 < ziloni> nat is there as is a fw rule. I can telnet to the port. (Im telnetting on 1194)
13:03 < krzie> regardless, thats the problwem
13:03 < ziloni> Im just using telnet ot verify its there
13:03 < krzie> problem*
13:03 < ziloni> what server logs could I look at? Teh server log I found ends wtih "initialization complete"
13:04 < krzie> because its not being contacted
13:04 < krzie> lol
13:04 < krzie> because the problem is what i said it is
13:04 < ziloni> I think it is being contact, look at the full log, it says things abotu remote optinos mismatching.. .arent they coming from the server?
13:04 < krzie> no it doesnt
13:04 < krzie> Sat May 07 14:00:24 2011 us=406000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
13:04 < krzie> it just says what it expects to see
13:05 < krzie> it never ACTUALLY saw anything
13:05 < ziloni> TCP connection established with ....
13:05 < krzie> and your server log saw nothing
13:05 < krzie> its what i said it was
13:05 < ziloni> is there more than one server log?
13:05 < krzie> argue all you like, it wont help you
13:05 < krzie> no
13:05 < krzie> !logfile
13:05 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
13:06 < ziloni> aah wait
13:06 < ziloni> no the server log does have more now..
13:06 < ziloni> this is a new setup again fo it... just sec
13:08 < ziloni> SIGTERM[hard,] received, process exiting
13:24 < ziloni> hmmm maybe Ive found it...
13:41 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 248 seconds]
14:00 -!- Vutral [ss@vutral.net] has joined #openvpn
14:09 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
14:19 < fipu> hello
14:20 < fipu> How can I remove a password from a certificate (generated with build-key-pass)?
14:36 -!- abstrakt [debian-tor@gateway/tor-sasl/abstrak1] has joined #openvpn
14:37 < abstrakt> how do I know what subnet to use? primarily I'm talking about e.g. 10.8.0.1 in this context http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html there's 10.0.0.0 176.16.0.0 and 192.168.0.0 right, so if my LAN is on 176.16.0.0 then should I use that for my VPN config? does it matter?  like, if my LAN is on 176 and I use this config http://www.openvpn.net/index.php/open-source/documentation/m
14:37 < abstrakt> iscellaneous/78-static-key-mini-howto.html will there be conflicts?  I mean, will I need to set up a bridge on my localhost as well so that i can bridge my 176 network over to 10.0.0.0 ?
14:37 <@vpnHelper> Title: Static Key Mini-HOWTO (at www.openvpn.net)
14:37 < abstrakt> i just need to know how to decide what subnet to use for my VPN
14:37 < abstrakt> am I required to use the same subnet as my home LAN?
14:37 < abstrakt> office LAN?
14:38 -!- K1ng` [~KING@180.211.188.21] has joined #openvpn
14:39 < fipu> krzee: arround?
14:39 < abstrakt> i feel that I basically understand bridging, and I basically understand the ideas of what the config files do etc and what the config is meant to do
14:39 < abstrakt> i just don't know how to decide what actual values to use for my IPs
14:42 -!- K1ng [~KING@180.211.188.211] has quit [Ping timeout: 276 seconds]
14:42 < krzee> fipu
14:42 < krzee> !factoids search cert
14:42 <@vpnHelper> 'servercert', 'certs', 'nocert', 'certverify', and 'certinfo'
14:42 < krzee> hrm
14:42 < krzee> !factoids search pass
14:42 <@vpnHelper> 'winpass', '2.1-winpass-script', 'authpass', 'password-only', 'strip-passphrase', 'change-passphrase', and 'enable-passwd-save'
14:42 < krzee> !strip-passphrase
14:42 <@vpnHelper> "strip-passphrase" is see http://blog.lib.umn.edu/silvi003/codenotes/2008/08/how_to_strip_a_passphrase_from.html to learn how to strip a passphrase from a key file
14:44 < abstrakt> krzee, hey... can you help me figure out what info I'm missing? I'll gladly take a link to the relevant documentation on my question :)
14:48 < krzee> im working and the question confused me
14:48 < krzee> ask it again?
14:48 < krzee> (using different words)
14:48 < krzee> maybe even do something like this:
14:48 < krzee> !goal
14:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:54 < abstrakt> krzee, ok my goal: i would like to send mail through my rackspace cloud server, from my home laptop behind my home LAN
14:54 < abstrakt> krzee, i was told that if I set up VPN, then I don't have to worry that port 25 is blocked by my ISP
14:54 < abstrakt> krzee, i'll still be able to connect to port 25 of my server as long as I'm VPNed
14:55 < abstrakt> krzee, so I started reading all the information/manuals/docs/tutorials I could find on OpenVPN, which basically means http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html and http://www.openvpn.net/index.php/open-source/documentation/howto.html and https://help.ubuntu.com/community/OpenVPN#Set
14:55 < abstrakt> ting%20up%20the%20Bridge
14:55 <@vpnHelper> Title: Static Key Mini-HOWTO (at www.openvpn.net)
14:56 < krzee> you need the most basic type of vpn
14:56 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
14:56 < krzee> !sample
14:56 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:56 < krzee> that would do
14:56 < fipu> krzee, thx
14:56 < abstrakt> krzee, specifically, as I already stated, http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html uses 10.8.0.1 in the example
14:56 < krzee> or the static key stuff would be fine too
14:56 <@vpnHelper> Title: Static Key Mini-HOWTO (at www.openvpn.net)
14:56 < abstrakt> krzee, i just want to know WHY they chose the 10.0.0.0 subnet
14:56 < abstrakt> krzee, and I'm wondering if that matters, aka my LAN is on 192.168
14:56 < krzee> because it is uncommon and has a small changce of conflicting with something else
14:56 < abstrakt> krzee, can I still set up the VPN on the 10.0.0.0 subnet?
14:57 < krzee> you want it to be uncommon enough to never conflict
14:57 < abstrakt> krzee, ahh, ok so I actually DO want it to be different than either my home LAN or the LAN that my rackspace server is on
14:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:57 < abstrakt> krzee, like, if my LAN is 176 and my SERVER is 192, then I should put VPN on 10.0.0.0
14:57 < abstrakt> krzee, right?
14:58 < abstrakt> krzee, and the VPN itself will take care of "bridging" those two subnets right? like I won't have to worry about it
15:15 < krzee> bridging?
15:15 < krzee> you dont want bridging
15:15 < krzee> and the first octet doesnt need to be different
15:15 < krzee> it just needs to be a different subnet
15:16 < krzee> 10.0.0.0/24 is not the same subnet as 10.0.1.0/24
15:22 < Bushmills> !1918
15:22 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
15:23 < Bushmills> !tunortap
15:23 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
15:23 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
15:26 -!- arl4223 [~arl4223@213.39.239.226] has joined #openvpn
15:26 < arl4223> hi all
15:26 < arl4223> I have one question regarding a p2p mode tnnel
15:27 < arl4223> my first tunnel is betwwen two linux boxes
15:27 < arl4223> my 2nd tunnel should be between a linux box and a windows box
15:28 < arl4223> betwwen both linux boses 'ifconfig 192.168.0.1 192.168.10.1' is working
15:28 < arl4223> but between the linux and the windows box 'ifconfig 192.168.0.1 and 192.168.1.1' is not working
15:28 < arl4223> why this?
15:28 < arl4223> why need swindows to be in the same subnet?
15:28 < arl4223> !welcome
15:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:28 < Bushmills> arl4223: using tap driver on windows?
15:29 < arl4223> check
15:29 < arl4223> TAP-Win32 Adapter V9
15:29 < Bushmills> afaik, there's a restriction that local address and p-t-p address must be in the same /30 net
15:29 < arl4223> hmm
15:30 < arl4223> is there a possibility to have both of them in a diffrent network
15:30 < Bushmills> problem with the windows tap driver. not really a debian issue 
15:30 < Bushmills> oh
15:30 < Bushmills> we're on #openvpn  :)
15:31 < arl4223> Bushmills: no problem all my linux servers are debian :-)=
15:31 < arl4223> but I need to get a backup from the iwndows box and also monitor it
15:31 < Bushmills> sry, i tabbed down to #openvpn while thinking i was on #debian
15:32 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
15:32 < Bushmills> i suppose you could widen the openvpn netmask to 255.255.254.0, and assign local and p-t-p addresses to windows clients which are both in the same /30 net
15:40 < arl4223> ok I found a solution
15:40 < arl4223> I just nee to set an IP from the linux subnet for the tap device
15:41 < arl4223> and then route all traffic for the windows network over the linux ip as gateway
15:50 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
15:51 -!- dirkD1 [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
15:53 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
15:53 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
15:53 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
16:09 < fipu> I use 2 openVPN connections and want to start it automatically with the service
16:10 < fipu> The problem is now that the VPN that start as 2nd uses the same tun interface as the first one
16:10 < fipu> How can I solve this problem?
16:11 < fipu> krzee: arround? :D
16:12 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:15 < krzee> what OS
16:15 < krzee> windows im guessing...?
16:16 < fipu> server 2008 R2
16:16 < krzee> so ya, windows
16:17 < fipu> ah sorry ;)
16:17 < krzee> theres a bat file somewhere for making another tuntap interface
16:17 < fipu> yes windows :D
16:17 < fipu> I have two interfaces
16:17 < fipu> that works
16:17 < fipu> If I start both VPN's manually it works perfectly
16:17 < krzee> oh interesting, that could be worthy of a ticket in trac
16:17 < krzee> !trac
16:17 <@vpnHelper> "trac" is see http://community.openvpn.net for development information and bug tracker.
16:17 < fipu> but if I start it with the service, only one VPN is working. The second one tries to use the same tap interface as the first one
16:18 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
16:18 < krzee> and for a workaround, you can specify which device to use
16:18 < krzee> --dev 
16:18 < fipu> I think I need to set the tap interface in the client config file
16:18 < fipu> is that possible on windows?
16:18 < krzee> yep, i think its done differently tho
16:18 < fipu> with Linux I can set dev tun0 dev tun1 etc.
16:18 < krzee> i dont use windows
16:19 < krzee> lets see if something about it is here:
16:19 < krzee> http://openvpn.net/INSTALL-win32.html
16:21 < fipu> mhhh
16:21 < fipu> doesn't look like there is something written about that
16:21 < fipu> but I try to use --dev and interface ID
16:21 < fipu> mom
16:23 < krzee> [14:21]  <krzee> it looks live dev tun and dev-node would do it
16:23 < krzee> [14:22]  <krzee> Notes -- Windows and TAP device naming
16:23 < krzee> (i accidently typed those in the wrong channel)
16:24 < Bushmills> *krzee was kicked from wrong channel:  off topic
16:24 < krzee> nah it was the devel chan
16:24 < krzee> cause i had noticed something else
16:24 < krzee> [14:19]  <krzee> http://openvpn.net/INSTALL-win32.html
16:24 < krzee> [14:19]  <krzee> still links to openvpn.se for openvpn gui for windows, lol
16:25 < fipu> lol
16:25 < krzee> (do not use openvpn.se anymore)
16:25 < Fonzie-> Does anyone have a very simple and dumb-safe guide for setting up openVPN on ubuntu?
16:26 < Bushmills> !howto
16:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:26 < Fonzie-> duh, that requires 2 hours of study
16:26 < Fonzie-> :=
16:26 < Bushmills> you can mentally filter the glue words
16:26 < krzee> only 2 hours?
16:27 < krzee> my first vpn took much longer than that
16:28 < Bushmills> maybe o'reilly "become an openvpn expert in 10 seconds" 
16:29 < krzee> if you wanna become an expert, i recommend supplementing the manual and howto with JJK's book
16:29 < krzee> !book
16:29 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
16:30 < Bushmills> but that takes at least 2 minutes, maybe even more
16:30 < Fonzie-> when i do /etc/init.d/openvpn start , it do pick /etc/openvpn/server.conf by default, right?
16:30 < Fonzie-> couse there was no default cnf there in the first place
16:30 < Bushmills> very sensible.  what could a default config possibly have defaulted to?  
16:32 < fipu> krzee: it seems to work now
16:32 < fipu> with dev-node
16:32 < fipu> and renaming of the tap adapter :)
16:32 < fipu> thank you
16:35 < fipu> krzee: Very interesting!
16:35 <@vpnHelper> RSS Update - forum: vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p11807>
16:35 < fipu> if the vpn is started as service you need route-method exec to get it working
16:35 < fipu> normal starting with open VPN gui only requires ip-win32 ipapi
16:36 < fipu> and as service route-method exec is also needed
16:36 < fipu> :D
16:38 < krzee> route-delay may also be needed when starting as a service on boot
16:38 < krzee> in both configs
16:38 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
16:38 < krzee> just route-delay, no number after (defaults to 30)
16:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:41 <@vpnHelper> RSS Update - forum: Fresh Install client connect warning message <http://forums.openvpn.net/topic8074.html#p11808>
16:43 -!- sonicrules1234 [~sonicrule@botters/sonicrules1234] has joined #openvpn
16:44 < sonicrules1234> !welcome
16:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:44 < sonicrules1234> !goal
16:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:45 < fipu> krzee: ok
16:45 < sonicrules1234> My goal is to get IPv6 over an IPv4 tunnel using openvpn :D
16:47 <@vpnHelper> RSS Update - forum: Can ping in one direction, but not the other <http://forums.openvpn.net/topic8066.html#p11810> || Famous TLS error <http://forums.openvpn.net/topic8075.html#p11809>
16:51 < sonicrules1234> Anybody know how to do that?
16:54 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:58 < Fonzie-> should the "local x.x.x.x" be ip to my physical interface, or to br0 ?
16:58 < Fonzie-> in server.conf
16:59 < Bushmills> !tunortap
16:59 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:59 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
17:10 < Fonzie-> well, got it ;)
17:10 < Fonzie-> problem moved on to next step: 
17:10 < Fonzie-> device tap0 is already a member of a bridge; can't enslave it to bridge br0. ...fail!
17:10 < Fonzie-> really not comfortable :p
17:12 -!- arl4223 [~arl4223@213.39.239.226] has quit [Quit: leaving]
17:22 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
17:23 <@vpnHelper> RSS Update - forum: Forwarding Fail [I've searched, read, googled, tried....] <http://forums.openvpn.net/topic8076.html>
17:54 < krzee> why are you bridging?
17:54 < krzee> lan gaming over the vpn...?
17:55 < abstrakt> krzee, do you need to bridge if you want more than a single client to be able to VPN?
17:55 < abstrakt> krzee, the mini-howto mentions that it will only work for a single client and a single server
17:56 < abstrakt> krzee, what about a single server and multiple clients
17:56 < krzee> nope...
17:56 < krzee> that has NOTHING to do with tap
17:56 < abstrakt> krzee, ahh ok great, that makes things a lot simpler :)
17:56 < krzee> dev tun and --server handles multiple clients just fine
17:57 < krzee> this is why bushmills typed !tunortap
17:57 < krzee> but i guess you ignored it
17:57 < abstrakt> ok great
17:57 < abstrakt> uhh, less ignored it, more that i'm an ignoramus
17:57 < abstrakt> i didn't really realize the implications
17:57 < abstrakt> which is why i asked
17:59 < krzee> !sample
17:59 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
17:59 < krzee> heres my configs
18:03 < ziloni> openvpn, client specific overrides.. its says under tunnel settings:
18:03 < ziloni> "This is the virtual network used for private communications between this client and the server expressed using CIDR (eg. 10.0.8.0/24). The first network address is assumed to be the server address and the second network address will be assigned to the client virtual interface. "
18:03 < ziloni> but there is just one field... what is the delimeter? (yes I checked the docs, nothing there)
18:04 < krzee> where are you seeing this?
18:04 < Bushmills> space.  the man page probably indicates it by putting spaces between arguments
18:04 < ziloni> oh sorry.. forgot this is openvpn channel.. its in the pfsense config page for openvpn
18:04 < ziloni> thoguth I was in pfsense channel :)
18:05 < krzee> ya i thought so, openvpn doesnt take CIDR ANYWHERE
18:05 < ziloni> I got openvpn working btw...
18:05 < ziloni> intially tehre are problems (bug in RC 2.0 of pfsense) with certs and the pfsense setup
18:06 < ziloni> but later itw as because anotoher admin had already setup a openvpn server in on of our internal mchiens and had made a NAT mappign to it without telling me
18:06 < ziloni> so I was conencting to HIS intenral openvpn server rather than mine because of his firewall rule overriding mine...
18:07 < ziloni> which is why I was getting connects... but no evidence in my server log...
18:07 < Bushmills> sounds like great communication
18:08 < ziloni> yeah.. lots of fun
18:08 < ziloni> he had a test server up
18:08 < Bushmills> he had no reason to tell you about his openvpn because you didn't tell him about yours?
18:08 < ziloni> and forgot to remove the firewall rule.... I knew he had put up otehr test services, but didnt know he was doing it over openvpn
18:09 < abstrakt> ok, so I'm sure this is a noob question that's answered somewhere, but I can't figure out where... just on the client side of things, I wanna check my thinking: so the idea is that i create a foo.conf file for openvpn on my client, and then if it's at /home/abstrakt/openvpn/blah.conf, i would simply cd /home/abstrakt/openvpn && openvpn
18:09 < abstrakt> just cd to the folder that has the conf file and then run `openvpn` right?
18:09 < Bushmills> abstrakt: --config.  or, if config file is only option, just the name of config file
18:10 < abstrakt> Bushmills, ok great, thanks
18:10 < Bushmills> means, you can have the config files in the same directory
18:16 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 246 seconds]
18:19 < abstrakt> Bushmills, er... i don't quite follow what you mean with that last bit
18:20 < abstrakt> so, i'm sure this is also a retardedly obvious question, but here goes... where do I put the server's config file?
18:20 < Bushmills> in same directory? as opposed to in different directories.
18:21 < Bushmills> it doesn't matter where you put it, as long as openvpn is told where to find it
18:21 < abstrakt> so when you say config files (plural) you're referring to a hypothetical set of files, one for each different VPN that you might use
18:21 < abstrakt> right?
18:21 < abstrakt> Bushmills, yeah ok so it's the same on the server then, i just run openvpn, do I run it as root? cd /root/myconfigs/openvpn/server.conf
18:21 < Bushmills> no. openvpn doesn't run with hypthetical config files. it needs real config files
18:21 < abstrakt> derp, lol
18:22 < abstrakt> cd /root/myconfigs/openvpn/ && openvpn server.conf
18:22 < abstrakt> for example?
18:23 < Bushmills> openvpn /path/to/your/configdirectory/nameofconfigfile
18:23 < abstrakt> cd /root/myconfigs/openvpn/ && sudo openvpn server.conf
18:23 < abstrakt> ok
18:23 < abstrakt> and, on the server, shouldu I run openvpn as root?
18:23 < Bushmills> yes
18:23 < abstrakt> for example, i'm aware that it's not a good idea to IRC as root :)
18:23 < Bushmills> on client too
18:23 < abstrakt> oh, ok
18:23 < abstrakt> good to know, thanks
18:24 < Bushmills> read about dropping privileges
18:24 < abstrakt> great i'm gonna go give it a try
18:29 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 260 seconds]
18:31 < abstrakt> what is the purpose of client-config-dir within the server.conf file? http://www.ircpimps.org/openvpn.configs
18:31 < abstrakt> does that config work for multiple clients? I'm thinking no?
18:32 < abstrakt> oh wait, ok i see the factoid now, it is for multiple clients
18:34 < abstrakt> nice, ok http://www.ircpimps.org/openvpn.configs seems to work well
18:34 < abstrakt> or, well, it seems to work just fine, that is :)
18:35 -!- dirkD1 [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
18:37 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
18:48 < krzee> use the manual for all options in those configs
18:48 < krzee> understand them
18:48 < krzee> !man
18:48 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
18:50 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
18:54 -!- corretico [~luis@201.201.44.82] has joined #openvpn
19:09 -!- Squidy [~quassel@189.72.179.180] has quit [Read error: Connection reset by peer]
19:11 < abstrakt> heh, so I'm sure this is obvious and stupid and simple but
19:12 < abstrakt> what would be the easiset way to test my VPN connection? i mean it's obvious that it works
19:12 < abstrakt> and i know hit is gonna sound retarded, but... like, shouldn't i be able to ping say, the mysql server now?
19:12 < ziloni> do you have client to client traffic enabled?
19:12 < ziloni> if its on your lan
19:12 < ziloni> and if you have ping enabled on that pc
19:12 < ziloni> you could telnet ot the mysql port and see if it answers
19:13 < abstrakt> right
19:19 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
19:20 < ziloni> anyone know of a ENABLE-PASSWORD-SAVE build for 2.2 somewhere yet?
19:22 < ziloni> (windows)
19:33 < Bushmills> is your mysql server an openvpn client as well?
19:40 < abstrakt> hmm
19:40 < abstrakt> this seems backwards
19:40 < abstrakt> http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html says...
19:40 <@vpnHelper> Title: Static Key Mini-HOWTO (at www.openvpn.net)
19:40 < abstrakt> "To verify that the VPN is running, you should be able to ping 10.8.0.2 from the server and 10.8.0.1 from the client."
19:40 < abstrakt> but, that's backwards for me, i can ping 0.2 from the client but not 0.1
19:41 -!- sonicrules1234 [~sonicrule@botters/sonicrules1234] has quit [Quit: Leaving]
19:42 < abstrakt> ping 10.8.0.1\nPING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.\nping: sendmsg: Operation not permitted
19:42 < Bushmills> client is probably x.x.x.2, server is x.x.x.1.  a client or server able to ping itself is hardly surprising 
19:53 < Bushmills> !firewall
19:53 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
19:57 -!- abstrakt [debian-tor@gateway/tor-sasl/abstrak1] has quit [Quit: Leaving]
20:07 -!- master_of_master [~master_of@p57B573E7.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:11 -!- master_of_master [~master_of@p57B54BB3.dip.t-dialin.net] has joined #openvpn
20:28 -!- K1ng` is now known as k1ng
20:28 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:42 -!- ziloni [~ziloni@208.70.93.89] has quit [Ping timeout: 276 seconds]
20:53 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
20:53 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
20:53 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
20:58 -!- colision [logos@189.81.115.7] has quit []
21:02 -!- ziloni2 [~ziloni@208.70.93.89] has joined #openvpn
21:03 < ziloni2> if I change the setting in pfsense/openvpn to "SSL/TLS" instead of "SSL/TLS + User Auth", will that then auth based on the user certs? Will it then require users to hav a cert and still prevent users wtihout certs from connecting?
21:25 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Quit: Leaving]
21:32 -!- toortog [~toortog@notsecure.net] has joined #openvpn
21:45 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
22:00 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:10 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:32 < ziloni2> I need to extract the public and private keys from the p12 file so I can put them in ddwrt client... I did it using openssl, but ddwrt says private key password verification failed.. can I remove the passwrod from it?
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 263 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:40 <@vpnHelper> RSS Update - forum: How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html#p11812>
23:35 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:35 -!- oc80z [oc80z@blea.ch] has joined #openvpn
--- Day changed Sun May 08 2011
00:04 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 276 seconds]
00:09 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
00:19 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:32 -!- k1ng [~KING@180.211.188.21] has quit [Ping timeout: 252 seconds]
00:35 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
00:35 -!- K1ng [~KING@180.211.188.45] has joined #openvpn
00:43 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has quit [Ping timeout: 246 seconds]
00:47 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
01:03 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11813>
01:07 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has quit []
01:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
01:14 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
01:15 -!- dirkD1 [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
01:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
01:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
01:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:43 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:09 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11814>
02:12 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
02:27 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
02:37 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
02:50 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has joined #openvpn
02:57 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 240 seconds]
02:58 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
02:58 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
02:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:59 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
03:09 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11815>
03:12 -!- dkr [~dkr@67.132.255.16] has quit [Read error: Operation timed out]
03:12 -!- DeeJayTwo [~deejay2@office.abi.ca] has quit [Read error: Operation timed out]
03:14 -!- mete__ [~metefr@84.200.12.194] has joined #openvpn
03:15 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
03:33 <@vpnHelper> RSS Update - forum: Newbie question about setting few vpn <http://forums.openvpn.net/topic8077.html>
03:39 <@vpnHelper> RSS Update - forum: How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html#p11817>
03:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
03:51 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 240 seconds]
03:57 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 252 seconds]
03:57 <@vpnHelper> RSS Update - forum: server speed decreasing after kloxo installation <http://forums.openvpn.net/topic8078.html>
03:59 -!- Vutral [xguIlLRPhy@vutral.net] has joined #openvpn
04:22 -!- Vutral [xguIlLRPhy@vutral.net] has quit [Ping timeout: 240 seconds]
04:25 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
04:39 -!- Vutral [ss@vutral.net] has joined #openvpn
04:51 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
04:52 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
05:06 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
05:09 -!- DeeJayTwo [~deejay2@office.abi.ca] has joined #openvpn
05:12 < norc> Hi, I have a OpenVPN tunnel through a TCP connection (no choice here since Im behind a squid proxy) - which sometimes acts very flakey with performance drops every now and then
05:12 < norc> Most of these performance drops occur when I use VoIP software
05:14 < norc> The weird thing is, the software in question (and the others I use) use UDP only, so TCP meltdown could not occur, correct?
05:41 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
06:14 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 248 seconds]
06:16 < Fonzie-> did a successfullt openvpn install in ubuntu, but tunnelblick is halting at "Waiting for server response" - is it required to do something with iptables or so?
06:17 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
06:24 < hyper_ch> what is tunnelblick?
06:24 < norc> hyper_ch: its an osx gui for openvpn
06:25 < hyper_ch> Fonzie-: created configs? got the keys?
06:25 < Fonzie-> yes ofc
06:25 < hyper_ch> enable logging
06:25 < Fonzie-> i do get granted access
06:25 < hyper_ch> and see what's causing it
06:25 < Fonzie-> 2011-05-08 13:25:47 MANAGEMENT: >STATE:1304853947,WAIT,,,
06:26 < Fonzie-> this is where it halts
06:26 < norc> Brr I really dont know how to track down this weird latency issue
06:26 < norc> It only happens when this VoIP client is on, but then wireshark is unusable due to the sheer amount of packages
06:26 < Fonzie-> and the openvpn-status.log on the server has nothing
06:39 < Fonzie-> figured it out
06:39 < Fonzie-> i was trying to use ip of the physical ethernet
06:39 < Fonzie-> it went straight in when i used the bridge interface's ip
06:42 -!- doobeh [~quassel@b33f.net] has joined #openvpn
06:46 < norc> What process priority should openvpn have?
06:53 < Fonzie-> What could be wrong when i can connect to the VPN local, but not from internet? I have forwarded port 1194
06:55 < norc> Fonzie-: goes the server route it properly to the vpn?
06:55 < norc> s/goes/does
06:56 < Fonzie-> obviously not
06:56 < Fonzie-> on local i need to connect to the br0 interface. That means i should forward the port to the same IP, right?
07:06 -!- Fonzie- [torgeir@94-246-17.67.3p.ntebredband.no] has quit [Read error: Connection reset by peer]
07:09 -!- Fonzie- [~torgeir@94-246-17.67.3p.ntebredband.no] has joined #openvpn
07:23 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
07:24 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:25 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:25 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Disconnected by services]
07:25 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
07:26 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:29 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 248 seconds]
07:37 -!- K1ng` [~KING@180.211.188.45] has joined #openvpn
07:39 -!- K1ng [~KING@180.211.188.45] has quit [Ping timeout: 264 seconds]
07:39 <@vpnHelper> RSS Update - forum: Not Connecting to Server <http://forums.openvpn.net/topic8079.html>
07:44 -!- K1ng`` [~KING@180.211.188.45] has joined #openvpn
07:47 -!- K1ng` [~KING@180.211.188.45] has quit [Ping timeout: 264 seconds]
07:51 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
08:13 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
08:14 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
08:15 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
08:15 -!- Cain` is now known as Cain
08:17 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
08:23 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
08:58 <@vpnHelper> RSS Update - forum: windows 7 client bridging. <http://forums.openvpn.net/topic8045.html#p11820>
09:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
09:19 -!- ziloni2 [~ziloni@208.70.93.89] has quit [Read error: Connection reset by peer]
09:19 -!- ziloni2 [~ziloni@208.70.93.89] has joined #openvpn
09:29 -!- Doulby [~doulby@rof76-1-82-233-229-5.fbx.proxad.net] has joined #openvpn
09:29 < Doulby> hi
09:33 < Doulby> I have an issue with the command "sudo openvpn --config /etc/openvpn/proxpn/proxpn.conf" no error message is displayed, nothing happens. Someone would have any idea?
09:34 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:34 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
09:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:42 -!- K1ng [~KING@180.211.188.132] has joined #openvpn
09:43 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
09:45 -!- K1ng`` [~KING@180.211.188.45] has quit [Ping timeout: 246 seconds]
09:46 -!- rich0 [~rich0@gentoo/developer/rich0] has quit [Quit: Leaving]
10:08 -!- K1ng` [~KING@180.211.188.235] has joined #openvpn
10:09 -!- ziloni2 [~ziloni@208.70.93.89] has quit [Quit: Leaving]
10:10 < ecrist> Doulby: try adding some logging to the config
10:10 -!- K1ng [~KING@180.211.188.132] has quit [Ping timeout: 276 seconds]
10:14 < Doulby> ecrist, i don't understand. :/
10:15 -!- derRichard [~derRichar@ununbium.nod.at] has joined #openvpn
10:15 < derRichard> hi
10:16 < Doulby> hi
10:16 < derRichard> i'm confused with --ifconfig-push
10:16 < derRichard> i'm using --dev-tun and have --client-config-dir
10:17 < derRichard> how to set the second parameter of --ifconfig-push?
10:17 < derRichard> e.g, clientX has to get ip 10.0.0.2. i would use --ifconfig-push 10.0.0.2 255.255.255.0
10:17 < derRichard> is this correct?
10:17 < derRichard> --ifconfig-push 10.0.0.2 10.0.0.1 works too?
10:19 < derRichard> is seems that i'm not the only one who is confused ;)
10:19 < derRichard> http://openvpn.net/archive/openvpn-users/2005-07/msg00138.html
10:19 <@vpnHelper> Title: [Openvpn-users] ifconfig-push parameters (at openvpn.net)
10:34 < derRichard> anyone?
10:57 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
10:59 -!- havoc [~havoc@neptune.chaillet.net] has quit [Client Quit]
10:59 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
11:03 <@vpnHelper> RSS Update - forum: Auto disconnect <http://forums.openvpn.net/topic7895.html#p11822>
11:14 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Operation timed out]
11:15 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:20 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
11:20 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 252 seconds]
11:21 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
11:26 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
11:47 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5-dev]
11:50 < Bushmills> http://scarydevilmonastery.net/snap/derrichardk.png  ... nobody anymore, i think
11:54 -!- hadees [~hadees@72-48-91-73.dyn.grandenetworks.net] has quit [Quit: hadees]
12:06 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
12:16 -!- fuho [~fuho@ool-4353ca4c.dyn.optonline.net] has joined #openvpn
12:18 < fuho> Hi, why do I get lines like this "WRRWWWWRWRWRWRWRWRWRWRWRWRW" in openvpn.log?
12:24 < fuho> !welcome
12:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:25 < fuho> !goal
12:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:26 < fuho> !redirect
12:26 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:26 < fuho> !def1
12:26 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
12:28 < fuho> !ipforward
12:28 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
12:28 < fuho> !linipforward
12:28 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
12:28 < Bushmills> fuho: verb 5 in config
12:32 < fuho> Bushmills: Sorry for my thickness, but what do you mean by that?
12:33 < Bushmills> you have  conf 5 or higher in your openvpn config file
12:33 < fuho> Oh I see, let me chack that.
12:33 < Bushmills> ehm ... verb 5 i mean
12:34 < fuho> You were right, I thought it was some sort of error with the connection, not just more verbose log.
12:36 < fuho> I aslo get only these "RSun May  8 16:52:11 2011 us=852440 client1/xx.xx.xx.xx:59008 MULTI: bad source address from client [xx.xx.xx.xx], packet dropped" It seems that I am connected, but can't access inet from the client.
12:39 < Bushmills> !redirect
12:40 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:45 < fuho> What I am trying to achieve is have my home network router connectto my VPS and route all the trafick through the VPS, should I aim for PKI or Static Key?
12:47 <@vpnHelper> RSS Update - forum: Can ping in one direction, but not the other <http://forums.openvpn.net/topic8066.html#p11823>
12:49 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Quit: Leaving]
12:53 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:59 <@vpnHelper> RSS Update - forum: Not Connecting to Server <http://forums.openvpn.net/topic8079.html#p11824>
12:59 < Bushmills> doesn't matter. not relevant for routing through server.
13:00 < Bushmills> static key for single client. pki for multiple clients
13:07 -!- fuho [~fuho@ool-4353ca4c.dyn.optonline.net] has quit [Remote host closed the connection]
13:24 -!- Doulby [~doulby@rof76-1-82-233-229-5.fbx.proxad.net] has quit [Remote host closed the connection]
13:41 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 258 seconds]
13:53 -!- Vutral [ss@vutral.net] has joined #openvpn
14:17 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
14:33 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
14:36 -!- corretico [~luis@201.201.44.82] has joined #openvpn
14:55 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:00 -!- derRichard [~derRichar@ununbium.nod.at] has left #openvpn []
15:03 -!- Vutral [ss@vutral.net] has quit [Read error: Connection reset by peer]
15:19 -!- Vutral [ss@vutral.net] has joined #openvpn
15:23 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
15:23 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 240 seconds]
15:23 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
15:24 < openm> !welcome
15:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:24 < openm> !goal
15:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:26 < openm> !redirect
15:26 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:43 -!- dirkD1 [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
15:45 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
15:57 < openm> I'm having some trouble connecting to a newly created OpenVPN server on my VPS from an OS X computer behind a router; the error is a failure of the TLS handshake.
15:57 < ecrist> !logs
15:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
15:57 < ecrist> !configfs
15:57 < ecrist> !configs
15:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
15:58 < openm> Should I just paste the logs into the general chat?
15:59 < openm> Nevermind; pastebin.
15:59 < openm> Tunnelblick log: http://pastebin.com/ZgZCJqBN
16:01 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
16:03 < openm> Having trouble locating the openvpn-status.log
16:04 < openm> Tunnelblick config: http://pastebin.com/H6wJ4UZh
16:06 < openm> Server status log: http://pastebin.com/P9XzV5Hh
16:08 < openm> Server conf: http://pastebin.com/vFqEyQym
16:09 < openm> I'm using the current version of OpenVPN on Ubuntu, and attempting to connect from an OS X client with the current version of Tunnelblick (From behind a router).
16:14 -!- Squidy_at_Home [~quassel@189.72.179.180] has joined #openvpn
16:15 -!- Squidy [~quassel@189.72.179.180] has quit [Ping timeout: 258 seconds]
16:19 < openm> The router is a Netgear WNR1000v2.
16:28 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11825>
16:33 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has joined #openvpn
16:33 <@vpnHelper> RSS Update - forum: How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html#p11827> || Newbie question about setting few vpn <http://forums.openvpn.net/topic8077.html#p11826>
16:35 -!- dirkD1 [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
16:35 -!- amir is now known as am1r
16:36 -!- am1r is now known as am1r_
16:37 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Read error: Connection reset by peer]
16:38 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
16:39 -!- am1r_ [~amir@unaffiliated/amir] has quit [Quit: Do not meddle in the affairs of dragons, for you are crunchy, and taste good with ketchup!]
16:39 <@vpnHelper> RSS Update - forum: Auto disconnect <http://forums.openvpn.net/topic7895.html#p11828>
16:40 -!- am1r_ [~amir@80-219-10-9.dclient.hispeed.ch] has joined #openvpn
16:41 -!- am1r_ [~amir@80-219-10-9.dclient.hispeed.ch] has quit [Client Quit]
16:42 -!- am1r_ [~am1r@80-219-10-9.dclient.hispeed.ch] has joined #openvpn
16:44 -!- am1r_ is now known as amir
16:45 -!- amir is now known as Guest20504
16:45 -!- Guest20504 [~am1r@80-219-10-9.dclient.hispeed.ch] has quit [Client Quit]
16:45 -!- Guest20504 [~am1r@80-219-10-9.dclient.hispeed.ch] has joined #openvpn
16:46 -!- Guest20504 is now known as amir_
16:46 -!- amir_ [~am1r@80-219-10-9.dclient.hispeed.ch] has quit [Changing host]
16:46 -!- amir_ [~am1r@unaffiliated/amir] has joined #openvpn
17:00 -!- openm_ [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
17:01 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Ping timeout: 240 seconds]
17:01 -!- openm_ is now known as openm
17:08 <@vpnHelper> RSS Update - forum: How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html#p11829>
17:16 < openm> Tried following this tut: http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing but still nothing (Not even entirely sure if the tutorial is relevant)
17:16 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
17:38 <@vpnHelper> RSS Update - forum: How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html#p11830>
17:44 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Read error: Connection reset by peer]
17:46 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
17:46 < openm> I tried switching to TCP, now simply getting a refused connection; not sure if that's diagnostic or not.
17:52 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
17:54 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 252 seconds]
17:56 -!- openm_ [~Kropotkin@c-68-33-252-102.hsd1.dc.comcast.net] has joined #openvpn
17:58 -!- openm__ [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
17:58 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Ping timeout: 240 seconds]
17:58 -!- openm__ is now known as openm
17:58 < openm> Out of curiosity, is anybody even here?
18:00 -!- openm_ [~Kropotkin@c-68-33-252-102.hsd1.dc.comcast.net] has quit [Ping timeout: 240 seconds]
18:04 -!- openm_ [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
18:05 -!- openm__ [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
18:06 -!- openm_ [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Read error: Connection reset by peer]
18:06 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Ping timeout: 240 seconds]
18:06 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
18:06 -!- openm__ [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Read error: Connection reset by peer]
18:07 -!- openm_ [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
18:10 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Ping timeout: 240 seconds]
18:10 -!- openm_ is now known as openm
18:20 -!- openm_ [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
18:20 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Read error: Connection reset by peer]
18:20 -!- openm_ is now known as openm
18:26 <@vpnHelper> RSS Update - forum: vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p11831>
19:03 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11832>
19:12 -!- openm_ [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
19:16 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Ping timeout: 248 seconds]
19:16 -!- openm_ is now known as openm
19:25 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Quit: openm]
19:25 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
19:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:33 -!- MrCerulean [~Adium@115.78.234.187] has joined #openvpn
19:33 < MrCerulean> I have what I'm pretty sure is a routing issue.
19:34 < MrCerulean> I have a router running dd-wrt and OpenVPN in client mode.
19:34 < MrCerulean> I am connecting to a Linux server running OpenVPN in server mode.
19:34 < MrCerulean> From the client, I can ping 10.8.0.1
19:35 < MrCerulean> which is the server's base tun0.
19:35 < MrCerulean> From the server, I can ping 10.8.0.26
19:35 < MrCerulean> which is the client's base tun0.
19:35 < MrCerulean> But I cannot ping from the client *through* the server.
19:36 < MrCerulean> i.e., I cannot ping 8.8.8.8 from the client.
19:36 < MrCerulean> Oops. 10.8.0.26 is tun1 on the client.
19:37 < MrCerulean> On the client, I have a route for 10.8.0.0 that directs to 10.8.0.1 as the gateway.
19:50  * ecrist will be back online from Ottawa
19:52 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Connection reset by peer]
19:52 -!- hpa_ [hpa@terminus.zytor.com] has joined #openvpn
19:53 -!- Splex [~splex@unaffiliated/splex] has quit [Quit: leaving]
20:02 -!- hpa_ is now known as hpa
20:07 -!- master_of_master [~master_of@p57B54BB3.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:11 -!- MrCerulean1 [~Adium@115.78.234.187] has joined #openvpn
20:11 -!- master_of_master [~master_of@p57B55910.dip.t-dialin.net] has joined #openvpn
20:12 -!- MrCerulean [~Adium@115.78.234.187] has quit [Ping timeout: 258 seconds]
20:15 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has quit [Ping timeout: 240 seconds]
20:19 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
20:19 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
20:19 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:23 -!- catsup [d@ps38852.dreamhost.com] has quit [Quit: Lost terminal]
20:23 -!- MrCerulean1 [~Adium@115.78.234.187] has quit [Quit: Leaving.]
20:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:49 -!- K1ng [~KING@180.211.188.235] has joined #openvpn
20:49 -!- K1ng` [~KING@180.211.188.235] has quit [Ping timeout: 246 seconds]
20:51 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
20:53 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Client Quit]
20:57 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
21:16 -!- DeeJayTwo [~deejay2@office.abi.ca] has quit [Ping timeout: 260 seconds]
21:17 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:18 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
21:19 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
21:21 <@vpnHelper> RSS Update - forum: Cannot connect through Connect Client <http://forums.openvpn.net/topic8080.html>
21:26 -!- Squidy_at_Home [~quassel@189.72.179.180] has quit [Remote host closed the connection]
21:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
21:39 <@vpnHelper> RSS Update - forum: Is it a bug openvpn allows two same certification existed? <http://forums.openvpn.net/topic8081.html>
21:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:52 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:00 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Read error: Connection reset by peer]
22:01 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:21 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
22:22 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:24 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has quit []
22:24 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:25 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:27 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
22:45 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Operation timed out]
22:48 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
22:51 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
23:13 -!- DeeJayTwo [~deejay2@office.abi.ca] has joined #openvpn
23:35 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:37 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:51 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
23:51 <@vpnHelper> RSS Update - forum: Auto disconnect <http://forums.openvpn.net/topic7895.html#p11835>
--- Day changed Mon May 09 2011
00:10 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11836>
00:10 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:13 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
00:34 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:52 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
01:01 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
01:04 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has quit [Ping timeout: 260 seconds]
01:10 <@vpnHelper> RSS Update - forum: Cannot connect through Connect Client <http://forums.openvpn.net/topic8080.html#p11838> || vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p11837>
01:13 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:16 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11841> || Auto disconnect <http://forums.openvpn.net/topic7895.html#p11840> || Is it a bug openvpn allows two same certification existed? <http://forums.openvpn.net/topic8081.html#p11839>
01:38 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
01:40 -!- dazo_afk is now known as dazo
02:10 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11842>
02:12 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
02:12 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
02:12 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:12 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
02:21 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 276 seconds]
02:24 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
02:24 < lamba> !welcome
02:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:26 < lamba> does anyone know what might cause a openvpn connection tun device p-t-p to not mirror at either end ? My server is ip 90.1.230.1 p-t-p:90.1.230.2, and my client gets ip 90.1.230.6 p-t-p: 90.1.230.5 ??!
02:26 < lamba> ill post configs, one second.
02:29 < lamba> http://pastebin.com/94BCx0Ad
02:29 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:29 -!- mode/#openvpn [+o mattock] by ChanServ
02:30 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Operation timed out]
02:31 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
02:33 -!- nb [~nb@fedora/nb] has quit [Read error: Operation timed out]
02:33 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
02:38 -!- nb [~nb@fedora/nb] has joined #openvpn
02:40 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11843>
02:41 < lamba> also affects the gateway given on the rotues that are pushed out, so nothing works :(
02:44 < Bushmills> lamba: you're using server mode, which allows multiple clients. 
02:44 < Bushmills> each client in that config gets its own /30 net.  
02:45 < lamba> ok. 
02:45 < lamba> i think thats what i wanted. 
02:46 < Bushmills> !tcp
02:46 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
02:47 < lamba> yea, i cant avoid it afaik. 
02:47 < lamba> ill have a read and take it to the senior admin. iirc there was a  solid reason against udp though
02:48 < Bushmills> !1918
02:48 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
02:48 < lamba> ah, apparently its because were using this behind a xinetd redirector
02:50 -!- troyt [~troyt@2001:55c:43a6:444b::1] has quit [Read error: Operation timed out]
02:51 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
02:51 < lamba> so, are you saying this is impossible, or a bad idea ? cos im pretty sure tcp mode is needed.
02:52 < lamba> and yes, the /30 was as expected. 
02:54 < Bushmills> it's not impossible. udp is just mostly preferable
02:55 < Bushmills> some folks tend to pick tcp for some unclear fear of unreliability feeling associated with udp
02:55 < lamba> no, i use udp on my home vpns, but those are site tos ite links. this is an enterprise road-warrior setup. 
02:56 < lamba> and where it is in the network udp is a pain to redirect to 
03:02 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
03:02 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
03:03 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
03:03 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
03:05 -!- lamba [~lamba@unaffiliated/lamba] has quit [Quit: leaving]
03:11 -!- thm [955c577525@fedora/thm] has joined #openvpn
03:11 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has joined #openvpn
03:11 < thm> is there a way to automatically feed ipp.txt into a nameserver?
03:32 < Bushmills> !nsupdate
03:32 <@vpnHelper> "nsupdate" is http://scarydevilmonastery.net/client_connect_nsupdate for a script Bushmills wrote to solve the question How can my vpn update my nameserver?
03:35 < hyper_ch> Bushmills: you're mentioned in there :)
03:36 < Bushmills> !blame krzee
03:36 < thm> thanks
03:36 < hyper_ch> you can't blame krzee for everything
03:36 < hyper_ch> actually... why not?
03:39 < Bushmills> i dodn't blame him.  i tried to ask the bot to do that
03:39 < Bushmills> didn't
03:39 < hyper_ch> :)
03:40 <@vpnHelper> RSS Update - forum: Newbie question about setting few vpn <http://forums.openvpn.net/topic8077.html#p11844>
03:52 <@vpnHelper> RSS Update - forum: How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html#p11845>
03:56 -!- amir_ is now known as amir
04:07 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:07 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Read error: Operation timed out]
04:19 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:21 < thm> regarding ipp.txt, can I advice openvpn to prune duplicate entries there?
04:28 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
04:28 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
04:28 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:32 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
04:37 -!- evenflow [~david@bzq-79-181-184-75.red.bezeqint.net] has quit [Quit: changing servers]
04:41 <@vpnHelper> RSS Update - forum: How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html#p11846>
04:47 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11847>
04:48 -!- Gobbla [Gobbla@unaffiliated/gobbla] has quit [Read error: Operation timed out]
04:48 -!- Gobbla [Gobbla@178.73.222.230] has joined #openvpn
04:49 <@dazo> !learn blame as "According to Bushmills, it's always krzee's fault"
04:49 <@vpnHelper> Joo got it.
04:50 <@dazo> !blame
04:50 <@vpnHelper> "blame" is According to Bushmills, it's always krzee's fault
04:50 <@dazo> hyper_ch: Bushmills: ^^^
04:50 < hyper_ch> :)
04:59 <@vpnHelper> RSS Update - forum: How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html#p11848>
05:35 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11850> || Newbie question about setting few vpn <http://forums.openvpn.net/topic8077.html#p11849>
05:41 <@vpnHelper> RSS Update - forum: OpenVPN behind a Apache Reverse Proxy <http://forums.openvpn.net/topic8082.html> || How to Auto-reconnect openvpn service <http://forums.openvpn.net/topic8062.html#p11851>
05:42 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:44 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
05:45 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
05:45 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
05:45 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:45 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
05:46 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
05:46 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
05:46 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:47 <@vpnHelper> RSS Update - forum: Redirecting traffic to and from specific IP <http://forums.openvpn.net/topic7967.html#p11853>
05:51 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
05:53 <@vpnHelper> RSS Update - forum: OpenVPN behind a Apache Reverse Proxy <http://forums.openvpn.net/topic8082.html#p11854>
05:56 -!- raomin [~romain@86.66.22.240] has quit [Quit: leaving...]
05:56 -!- K1ng [~KING@180.211.188.235] has quit [Read error: Connection reset by peer]
05:57 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
05:57 -!- K1ng [~KING@180.211.188.235] has joined #openvpn
05:58 -!- raomin [~romain@86.66.22.240] has joined #openvpn
06:04 -!- K1ng [~KING@180.211.188.235] has quit [Read error: Connection reset by peer]
06:04 -!- raomin [~romain@86.66.22.240] has quit [Quit: leaving...]
06:04 -!- K1ng [~KING@180.211.188.235] has joined #openvpn
06:06 -!- K1ng [~KING@180.211.188.235] has quit [Read error: Connection reset by peer]
06:06 -!- K1ng [~KING@180.211.188.235] has joined #openvpn
06:10 -!- K1ng [~KING@180.211.188.235] has quit [Client Quit]
06:10 <@vpnHelper> RSS Update - forum: is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html>
06:34 -!- raomin [~romain@86.66.22.240] has joined #openvpn
06:35 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:35 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
06:45 <@vpnHelper> RSS Update - forum: is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html#p11856>
06:57 <@vpnHelper> RSS Update - forum: is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html#p11857>
07:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: I am off]
07:03 <@vpnHelper> RSS Update - forum: OpenVPN behind a Apache Reverse Proxy <http://forums.openvpn.net/topic8082.html#p11859> || is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html#p11858>
07:03 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
07:08 -!- thm [955c577525@fedora/thm] has left #openvpn []
07:09 <@vpnHelper> RSS Update - forum: is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html#p11861> || OpenVPN behind a Apache Reverse Proxy <http://forums.openvpn.net/topic8082.html#p11860>
07:14 -!- atmosx [~osx@46.12.143.139.dsl.dyn.forthnet.gr] has joined #openvpn
07:15 < atmosx> hello
07:15 <@vpnHelper> RSS Update - forum: OpenVPN behind a Apache Reverse Proxy <http://forums.openvpn.net/topic8082.html#p11862>
07:15 < atmosx> is there any way to use --script-security level  with openvpn2.0.x ?
07:25 -!- erikwt [~erikw@095-097-072-132.static.chello.nl] has joined #openvpn
07:26 < erikwt> is it possible to connect to a openvpn server THROUGH an openvpn server? It would be like   ME ===> server1 ---> server2
07:28 -!- atmosx [~osx@46.12.143.139.dsl.dyn.forthnet.gr] has quit [Quit: Leaving]
07:37 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:52 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 248 seconds]
08:15 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
08:16 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Operation timed out]
08:17 -!- Cain` is now known as Cain
08:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:29 -!- taco_the_paco [~Corey@unaffiliated/taco-the-paco/x-1305449] has joined #openvpn
08:30 < taco_the_paco> theres no easy-rsa /usr/share/doc/openvpn-2.1.1/ folder o-o
08:30 < taco_the_paco> i'm running cent os 5
08:33 < taco_the_paco> nvm found it
08:50 < taco_the_paco> another problem, i can't find server.conf.gz
08:55 < gladiatr> out of curiosity, why would you be looking for server.conf.gz?
08:57 < taco_the_paco> was following a tutorial, could be a bit outdated
08:58 < gladiatr> I'd recommend following the how-to docs on the openvpn.net site
09:00 -!- darkdrgn2k [~yurko@204.101.63.212] has quit [Ping timeout: 240 seconds]
09:09 -!- newmember__ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
09:10 -!- Gobbla [Gobbla@178.73.222.230] has quit [Read error: Operation timed out]
09:12 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
09:20 < taco_the_paco> gladiatr weres the sample server.conf? o_o
09:22 <@dazo> !howto
09:22 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:22 -!- Gobbla [Gobbla@178.73.222.230] has joined #openvpn
09:22 -!- Gobbla [Gobbla@178.73.222.230] has quit [Changing host]
09:22 -!- Gobbla [Gobbla@unaffiliated/gobbla] has joined #openvpn
09:22 <@dazo> taco_the_paco:  ^^^  ... don't just throw in a sample server.conf ... really, you'll have much less troubles if you read through the howto
09:29 -!- ziloni [~ziloni@208.70.93.89] has joined #openvpn
09:30 < ziloni> "private key password verification failed"
09:31 < ziloni> my cert has no password... and Ive read this can be caused by a base paste or bad cert.. but the cert looks fine to me and appears identical to the source...
09:32 -!- amir [~am1r@unaffiliated/amir] has quit [Remote host closed the connection]
09:32 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:33 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:34 < ziloni> I have to get them out of the .p12 file - maybe I exported wrong somehow?
09:34 <@dazo> ziloni: openssl rsa -in <keyfile> -noout ... or openssl pkcs12 -in <keyfile> ... that's usually good ways how to test them
09:35 < ziloni> ok let me use that to test... just sect...
09:35 < ziloni> i used openssl to extract them from the p12
09:36 <@dazo> remember that the cert and the key file are two different things ... p12 is just a bundle ... so when it says "private key password", it's issues with the key file - not necessarily the cert file
09:36 < ziloni> yes, I assume its compaingina botu the private key file
09:36 < ziloni> I assume its talkgina botu client.key and not client.crt
09:37 <@dazo> private key == client key, afair
09:37 < ziloni> hmm.. maybe what I have is not hte private key.. here is hwat I need to do
09:37 <@dazo> when exporting from pkcs12, you will be asked for a password before the key file is extracted ... that sets the password on the keyfile alone, iirc
09:38 < ziloni> Im using pfsense with openvpn for the server... all is there ok.. i can get the ca.crt, btu for the client parts I have to get htem from an openvpn config it gives me.. which includes the ca.crt and the .p12
09:38 < ziloni> but one of my clients is ddwrt
09:38 < ziloni> which wants the certs as text
09:38 < ziloni> I used openssl to extract pem files from the p12.. but maybe I didnt do that right?
09:39 < ziloni> the "private" pem I extracted actually has two certificates in it... 
09:39 < ziloni> I assuemd one was the private and one was public? Is that assumption iwrong?
09:40 <@dazo> openssl pkcs12 -in <p12 file> -nodes -nocerts .... this should give you just the key
09:40 < ziloni> ok let me try that.
09:40 <@dazo> the key is private, and the cert file is public
09:41 < ziloni> aah... thats diff.. It hink thats waht I need...
09:41 <@dazo> the cert file includes the public key and a signature from the CA, which should be able to verify the  public key
09:45 < ziloni> progress.
09:45 < ziloni> now it says cant load client.crt... so evidently I exported that wrong too....
09:46 < ziloni> could you be kind enoug to help me on that as well? :)
09:46 <@dazo> ziloni: it's easy ... openssl pkcs12 -help ;-)
09:46 < ziloni> yeah, Ive been there.. Ive tried all kinds of options to output
09:46 <@dazo> -nokeys -clerts ... will give you client cert
09:46 < ziloni> and I have certs. but evidnetly Ive done soemthing wrong
09:46 < ziloni> thanks iwll tyr that.
09:46 <@dazo> -nokeys -cacerts ... will give you CA certs
09:46 < ziloni> tahts diff thatn waht I used before (and was advised seomthign diff as well)
09:47 <@dazo> this is the "baby step" method ... which is recommended unless you know the tools well
09:47 < ziloni> do I still need -nodes?
09:47 < ziloni> ie this is what I have now:
09:47 < ziloni> openssl pkcs12 -in pfsense-udp-1194.p12 -nokeys -clerts
09:48 < ziloni> should I add the -nodes ?
09:48 <@dazo> -nodes is only relevant when you want to encrypt the private key
09:48 <@dazo> -nokeys says you don't want any keys
09:48 -!- Dracos-Carazza [~dracoscar@a81-14-227-216.net-htp.de] has joined #openvpn
09:49 < Dracos-Carazza> hmm hi guys. I hope someone could help me...
09:49 <@dazo> !welcome
09:49 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:49 <@dazo> Dracos-Carazza: ^^^
09:49 < ziloni> clcerts... typo... had clerts in the IRC.. but got it. .thankx tyring results now
09:49 <@dazo> ahh, sorry
09:49 < Dracos-Carazza> dazo, thx for the info ;)
09:49 < ziloni> np, youve been a huge help
09:50 < ziloni> been banging my head ont his a long time
09:50 < Dracos-Carazza> !route
09:50 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:54 < ziloni> hmm... still some issue with client.crt... 
09:54 < ziloni> aah. stupie me... I swapped the crt and keyt his time.. heopfully thats an eays fix.
09:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:58 < ziloni> hmm.. now gettting tls key negotiation failed.... 
10:00 < ziloni> I think ddwrt might not support tls
10:00 <@dazo> check that your devices have synchronised clocks
10:00 < ziloni> yep, clocks look ok
10:00 < ziloni> but I noticed my windows client has a atls key file
10:00 < ziloni> the ddwrt client doesnt seem to have a place to specify a tls key
10:00 < ziloni> or is that the private key?
10:01 <@dazo> --tls-auth
10:01 <@dazo> that's a separate
10:01 <@dazo> that's a static key, so that needs to be distributed separately
10:01 < ziloni> Im tyring to stay within waht ddwrt clietn supprots.. so could I turn somethign off ont eh openvpn server?
10:02 < ziloni> yes windows client says tls-client, btu ddwrt client does not
10:02 <@dazo> !configs
10:02 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
10:03 <@dazo> I ditched ddwrt some years ago (using openwrt instead, much safer) ... so I don't recall what that supports or not ...
10:03 < ziloni> yes I would liek to as well
10:03 < ziloni> but on the hardware we have it has new broadcom stuff
10:03 < ziloni> and we have openwrt on all of our other stuff
10:04 < ziloni> except this one device
10:04 < ziloni> openwrt has issues with new broadcom chipsets becuase broadcom doesnt open their spec/drivers up
10:04 <@dazo> openwrt supports broadcom ... at least my wrt54gl was a broadcom 
10:04 < ziloni> older broadcom stuff
10:04 <@dazo> that's the same issues ddwrt faces 
10:04 < ziloni> no, ddwrt has some kind of licensing or seomthign with bc
10:04 <@dazo> just that ddwrt are not open about issues in their communication
10:04 < ziloni> unless seomthig major changed inthe last 6 months
10:04 <@dazo> gah ... okay, that's new for me
10:05 < ziloni> it was all voer the openwrt forums
10:05 <@dazo> I believe
10:05 < ziloni> anyways.. I prefer openwrt too. but this one device "works" with ddwrt and I dont want to mess to much with the device as its a core piece of our network
10:05 <@dazo> yeah ... I understand
10:05 <@dazo> anyway, I need to see your config file and a complete log file to be able to see what you struggle with now
10:06 < ziloni> well from what I can see, the windows confic client says tls-client, btu the dd-wrt clietn doesnt allow that. and I cant edit the open vpon config or it can eb overrwritten by ddwrt (yes there are ways aroudn this, its more complicated)
10:07 <@dazo> pastebin the configs and logs, please
10:07 < ziloni> so is the issue tha the server expects tls and ddwrt isnt doing it? if so I can just turn off tls? Im looking at the server now...
10:07 < ziloni> the logs and configs arent easy to get at
10:07 < ziloni> becuase its pfsense on the server.. so i have to rdp to ssh and do a tripel transfwer to get the file out :(
10:07 <@dazo> there are more levels of TLS ... I need to be sure I know what kind of TLS you talk about
10:07 < ziloni> but I can chagne the config easily int eh pfesnse interface.. logging in now
10:08 <@dazo> --tls-client ... that's needed to use --key, --cert and --ca
10:08 <@dazo> then you have --tls-auth, which is something completely different
10:08 < ziloni> right now for the server I have "Remote Access (SSL / TLS)" selected
10:08 < ziloni> windows clicent uses "tls-client" in the config
10:09 < ziloni> let me look at hte ddwrt client (I can view the config, but cant get the whole file easily in a paste)
10:12 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11863>
10:15 < ziloni> ddwrt client: http://pastebin.com/dNS98zGt
10:16 < ziloni> would changing server to shared key only work..? Trying now
10:17 < ziloni> if I can just get it working, I can always increase security optins later (rebooting router now with new optins)
10:18 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
10:18 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:21 < ziloni> hmm still tls errors :( have to go fetch kids... thanks for help and progress so far! Will be back later
10:21 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:21 <@dazo> ziloni: --client expands to --tls-client, plus a few other things  (it's a macro) ... and ddwrt does support this config
10:22 <@dazo> you need to look at the server logs carefully now, to see if you see why it's rejected
10:22 < ziloni> hmm ok thanks.. then its something else.. that will save me from chasing the wrong fish at least... will reset server back to tls and resume this in a few horus
10:22 < ziloni> will check server logs to. tx
10:22 <@dazo> if you send the server config I can verify that it's nothing else you need
10:22 <@dazo> (but I need to go in 5-10 minutes)
10:23 < ziloni> ok will tyr to get it when I get back with the kids.
10:23 < ziloni> ugh. .I rset my config and now it regens the tls key.. more fun :
10:23 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:24 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:25 < Dracos-Carazza> hmm ok, I have a client WLAN on a WRT54gl with a custom openwrt firmware. the wlan is on the "LAN side" of the WRT. the WRT itself is conntected to the internet via DHCP on its WAN interface
10:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:25 < Dracos-Carazza> the wrt is a openvpn client which connects to a openvpn server $somewhere in the internet
10:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:26 < Dracos-Carazza> now i want to put all the "internet traffic" form the client wlan through the vpn tunnel
10:26 <@dazo> !redirect
10:26 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
10:27 < Dracos-Carazza> dazo, I know... 
10:27 <@dazo> ahh
10:27 < Dracos-Carazza> the WRT itself can ping anything through the VPN
10:27 < Dracos-Carazza> but not the clients, which are connected on the "LAN side" of the wrt
10:28 <@dazo> !lan
10:28 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 240 seconds]
10:28 < Dracos-Carazza> !help
10:28 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
10:28 < Dracos-Carazza> ;)
10:28 < Dracos-Carazza> hmm ok ...
10:28 <@dazo> !factoids
10:28 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:29 < Dracos-Carazza> o_O?
10:29 <@dazo> !clientlan
10:29 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
10:29 <@vpnHelper> better explanation
10:29 <@dazo> !serverlan
10:29 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
10:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:29 <@dazo> that might guide you more in the right direction
10:30 < Dracos-Carazza> ok.. the ip forwarding is active
10:30 < Dracos-Carazza> s/active/activated
10:31 < Dracos-Carazza> I think, that I have a problem with a double NAT
10:31 < Dracos-Carazza> there is a NAT on the VPN server, which I think its ok
10:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
10:33 <@vpnHelper> RSS Update - forum: openvpn 2.2 issue <http://forums.openvpn.net/topic8084.html>
10:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:37 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:38 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:47 -!- dazo is now known as dazo_afk
10:51 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
10:55 -!- erikwt [~erikw@095-097-072-132.static.chello.nl] has quit [Quit: Ex-Chat]
11:06 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
11:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:13 <@vpnHelper> RSS Update - forum: vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p11865>
11:29 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 252 seconds]
11:42 < taco_the_paco> is there a speed difference when comp-lzo is enabled and when its not,?
11:44 < ziloni> yes
11:44 < ziloni> but waht speed are you asking about ? CPU or traffic?
11:44 < taco_the_paco> Traffic
11:44 < ziloni> it affects both, but in different ways and for most CPUs the diff is negligible
11:45 -!- Vutral [ss@vutral.net] has joined #openvpn
11:45 < ziloni> traffic is faster because its compressed. but how much depends ont eh type of data etc
11:46 < taco_the_paco> ah ok thank you ^.^
11:47 -!- Dracos-Carazza [~dracoscar@a81-14-227-216.net-htp.de] has quit [Remote host closed the connection]
11:54 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
11:58 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11866>
12:05 < majuk> Hey guys, quick question. If I have multiple clients in a LAN, I can just give them IPs within the VPNs subnet and have a single client with the route, iroute and push route commands outlined in the HowTo?
12:07 < majuk> Sorry, not all those configs are on the client, I hope y'all understand what I'm getting at.
12:07 < majuk> Just looking for a way to get those clients on the VPN without them having to have an OpenVPN client installed on them
12:08 < majuk> The LAN clients.
12:09 < Bushmills> majuk: clients can't connect t clients
12:09 < Bushmills> just you can have machines on a LAN behind a client
12:09 < Bushmills> !clientlan
12:09 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
12:09 <@vpnHelper> better explanation
12:14 < majuk> Right, so those machines on the client LAN, with that setup, should be able to communicate with the VPN without having to exchange credentials and establish a PtP connect, right?
12:14 < majuk> Bushmills, ^^
12:14 < majuk> !route > majuk
12:14 < majuk> !route
12:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:15 < Bushmills> depends what you call "communicate with VPN".  i'd understand better if you refer to machines, to the the VPN, those clients communicate with.
12:15 < Bushmills> hm. my keyboard is doing funny things
12:15 < majuk> lol
12:15 < majuk> Yea, I wasn't getting that last statement.
12:16 < Bushmills> refer to machines, instead of to the VPN ...
12:16 < majuk> ok... so machine A is a client on the VPN. Machines W-Z are on A's LAN. I need W-Z to talk on the VPN, but they don't support any openvpn clients
12:17 < Bushmills> "talking to VPN" sounds a bit like "communicate with the network cable"
12:17 < majuk> lol, sorry, I need them exhcnaging files with client J, which is somewhere in the cloud.
12:18 < Bushmills> !clientlan
12:18 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
12:18 <@vpnHelper> better explanation
12:19 < majuk> Yea, so I was trying to confirm that that is what I am looking for, basically.
12:19 < majuk> Before I put a lot of time into setting it up.
12:19 < majuk> So I suppose it is!
12:19 < majuk> Huzzah
12:19 < Bushmills> but ... isn't there an openvpn server somewhere? maybe between A and J?
12:19 < majuk> Yes
12:20 < majuk> But W-Z can't connect to it because they don't have an ovpn client
12:20 < majuk> So I need A to facilitate.
12:20 < majuk> If possible.
12:21 < majuk> No worries, I'll figure it out or die trying I suppose.
12:22 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has joined #openvpn
12:23 < stevieman> I am trying to generate a new set of keys for our vpn connection and when I do a ./build-key client5 I get the following message: Please edit the vars script to reflect your configuration,
12:23 < stevieman>   then source it with "source ./vars".
12:23 < stevieman>   Next, to start with a fresh PKI configuration and to delete any
12:23 < stevieman>   previous certificates and keys, run "./clean-all".
12:23 < stevieman>   Finally, you can run this tool (pkitool) to build certificates/keys.
12:23 < stevieman> I haven't changes anything since I did this just last week
12:24 < Bushmills> you didn't source vars
12:24 < stevieman> Bushmills: Do I have to do that everytime?
12:25 < Bushmills> the variables won't be chiselled into your RAM
12:25 < Bushmills> no, you don't.  as long as you invoke the scripts from the same command line interpreter where you have sourced vars earlier on
12:26 < stevieman> Bushmills: ah ok thanks
12:26 < Bushmills> same shell means same instance of it
12:35 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
12:35 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has quit [Changing host]
12:35 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:35 -!- mode/#openvpn [+o raidz] by ChanServ
12:37 -!- zilonix [cc100b95@gateway/web/freenode/ip.204.16.11.149] has joined #openvpn
12:44 -!- eliasson [~wizard@91.198.48.20] has joined #openvpn
12:46 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:46 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
12:47 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
12:52 < eliasson> Hi. I've got a really strange problem which I would hope somebody could help me with.
12:52 < eliasson> I'm running OpenVPN-server on 192.168.0.254/24 using UDP port 1194. Clients can connect and reach both 192.168.0.254 WAN traffic is routed thru the tunnel. The strang problem is however that clients cannot reach the rest of the subnet UNLESS the route is being deleted.
12:52 < eliasson> The route (Windows) '192.168.0.0    255.255.255.0         On-link     192.168.0.130    286' is being created, and then it's working as stated above. But If I run 'route delete 192.168.0.0 mask 255.255.255.0', then I can reach the rest of the subnet (e.g 192.168.0.10 etc). Why is that?
12:53 < eliasson> ...reach both 192.168.0.254 AND WAN traffic...
12:56 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has quit [Quit: Leaving]
12:58 < eliasson> Anyone?
13:03 < gladiatr> eliasson, please try again.  The description that you just gave of your network configuration is broken.
13:04 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
13:05 < Bushmills> "rest of the subnet (e.g 192.168.0.10)" ...  "OpenVPN-server on 192.168.0.254/24"  ???   subnets overlapping
13:05 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
13:05 < Bushmills> !1918
13:05 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
13:05 < eliasson> I'll try again.
13:07 -!- Milenco [~notspam@D978089C.cm-3-1a.dynamic.ziggo.nl] has joined #openvpn
13:07 < eliasson> Our VPN-server is running on 192.168.0.254 (/24 subnet). When the clients connects to it, clients get an IP-address from the DHCP-server running on the same machine. The strange part is that clients can only reach the VPN-server (192.168.0.254) and external traffic. Not the rest of the subnet 192.168.0.0/24.
13:07 < Milenco> !welcome
13:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:08 < Milenco> !goal
13:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:08 < Milenco> !redirect
13:08 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:08 < Milenco> !def1
13:08 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
13:08 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has joined #openvpn
13:09 < Bushmills> eliasson: use a different subnet for openvpn
13:10 < eliasson> Bushmills: Why would that be necessary?
13:10 < Bushmills> because of your problem
13:10 < stevieman> Is it possible to allow access to a network printer that is not on the vpn?
13:11 < eliasson> I would rather know why it's working fine then I delete route 192.168.0.0/24 that is created when connected.
13:11 < Bushmills> stevieman: sure. many people use network printers, while not even having a vpn
13:11 < Bushmills> eliasson: well, that's some research you can do. i limit myself to give you a solution.
13:12 -!- takamichi [Takamichi@46.11.92.98] has quit [Read error: Operation timed out]
13:12 < stevieman> Bushmills: what I meant to say can a client while connected to a vpn print to a network printer that is on the office network. the printer is on the 192 ip range and not on the 10 vpn range
13:12 < Bushmills> (20:05:00) Bushmills: "rest of the subnet (e.g 192.168.0.10)" ...  "OpenVPN-server on 192.168.0.254/24"  ???   subnets overlapping
13:12 < Bushmills> subnet overlapping = routing conflict
13:13 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
13:13 < eliasson> It's not overlapping
13:13 < eliasson> 192.168.0.10 is another host on the same network as the VPN server (192.168.0.254)
13:14 < eliasson> 192.168.0.0/24 is the subnet of the office
13:14 < eliasson> 192.168.0.254 is the VPN-server
13:14 < Bushmills> "route 192.168.0.0/24 that is created when connected."  that route added is an indication that subnets overlap.
13:14 < eliasson> When connected, I can only reach 192.168.0.254 and external traffic. Not rest of the subnet, e.g. 192.168.0.10
13:14 < Bushmills> server is suipposed to push a route to vpn for th vpn subnet
13:15 < eliasson> Bushmills: Overlapping from where?
13:15 < Bushmills> your LAN and your openvpn subnet
13:15 < eliasson> No, my LAN has 10.238.11.0/24
13:16 < Bushmills> "rest of the subnet (e.g 192.168.0.10)..."
13:16 < eliasson> Yes. After enstablishing an connection, I can reach 192.168.0.254 but not FOR EXAMPLE 192.168.0.10
13:17 < Bushmills> "192.168.0.0/24 is the subnet of the office" but  "my LAN has 10.238.11.0/24"
13:17 < eliasson> Wow. Are you kidding me? Let me go back.
13:17 < eliasson> 192.168.0.0/24 is the subnet of the office
13:17 < eliasson> 192.168.0.254 is the VPN-server
13:18 < Bushmills> you're all the time talking about your 192.x.x.x nets, and all of a sudden your LAN is 10.x
13:18 < eliasson> 10.238.11.0/24 is what I've got at home, where I'm connecting from.
13:18 < eliasson> I'm enstablishing an connection to the VPN-server, and it's successful.
13:18 < eliasson> I can reach 192.168.0.254 and external traffic (since the traffic is routed thru the VPN)
13:19 < eliasson> I can however not reach the rest of the hosts on the same subnet as the VPN-server
13:19 < eliasson> Example 192.168.0.10
13:19 < eliasson> Now;
13:19 < Bushmills> what is your openvpn subnet?
13:19 < eliasson> 192.168.0.0/24
13:19 < Bushmills> then 192.168.0.10 is an openvpn client?
13:20 < eliasson> No. That's a PC within the office.
13:20 < Bushmills> then you *do* suffer from conflicting subnets
13:20 < Bushmills> because 192.168.0.1 is within the openvpn subnet
13:20 < Bushmills> 0.10
13:21 < eliasson> This is the wierd part:
13:21 < eliasson> When I connect to the VPN, a route is created:
13:22 < eliasson>       192.168.0.0    255.255.255.0         On-link     192.168.0.130    286
13:22 < eliasson> If that route is there, I cannot reach for example 192.168.0.10 (the office PC)
13:22 < eliasson> BUT
13:22 < eliasson> If I delete that route, it works fine.
13:23 < eliasson> (192.168.0.130 is the IP-address of my VPN client I get from the DHCP on the VPN server)
13:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:23 < Bushmills> probably because of conflicting subnets
13:23 < Bushmills> oh well, what do i repeat myself.
13:23 < Bushmills> i suggested a solution, feel free to continue to reject it
13:23 < eliasson> I will try another subnet as you said.
13:24 < eliasson> It's just strange that this setup have been working before, and it's working fine if the route is deleted.
13:25 < Bushmills> i suppose that is because openvpn server pushs a route to openvpn interface for its subnet, which conflicts with your non-openvpn interfaces in the same subnet
13:30 < eliasson> Bushmills: Thanks for your help. I will see if I will change the VPN subnet.
13:38 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has quit [Quit: Leaving]
13:41 -!- samu [s@unaffiliated/samaelszafran] has quit [Read error: Connection reset by peer]
13:42 -!- samu [s@94.23.90.223] has joined #openvpn
13:42 -!- samu [s@94.23.90.223] has quit [Changing host]
13:42 -!- samu [s@unaffiliated/samaelszafran] has joined #openvpn
13:57 < zilonix> the default encryption is blowfish, but pfsense offers me 3 forms of BF for openvpn, BF-CBC, CFB, and OFB. Anyone know which is the default one openvpn uses?
13:57 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
13:58 -!- takamichi [Takamichi@46.11.92.98] has joined #openvpn
14:01 < zilonix> looks like CBC...
14:08 -!- dazo_afk is now known as dazo
14:10 < zilonix> yes.. in case anyone else is wondering it, it is BF-CBC
14:10 <@dazo> ziloni: default is blowfish (BF-something) ... CBC, CFB, OFB is how the encryption is encoded, to say it overly simplified
14:11 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Ping timeout: 240 seconds]
14:11 <@dazo> zilonix: if you start openvpn with --verb 4, you'll see default values for all things which is not set in the config file
14:12 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
14:12 <@dazo> just running openvpn --dev tun --verb 4, might maybe give you all defaults
14:16 -!- ziloniz [cc100b95@gateway/web/freenode/ip.204.16.11.149] has joined #openvpn
14:16 < ziloniz> tahnks about the verb4, will keep that in mind fo future
14:17 < ziloniz> finally got through everyting.. last obstaclle was teh encryption... the server was set for AES, but DDWRT doesnt let you pick, so you have to chagne server to BF-CBC unless you manually override the config file which isnt easy becuase yo have to update the flash etc
14:18 < ziloniz> possibel but not wortht eh work, easier to use the autogenned config.. too bad they didnt add encryption option (maybe its in later builds)
14:18 < ziloniz> but wish openvpn was better about the err msgs too... and could jsut tell us the encryption doesnt match :)
14:18 -!- zilonix [cc100b95@gateway/web/freenode/ip.204.16.11.149] has quit [Ping timeout: 252 seconds]
14:19 <@dazo> Well, I personally would try to rather get openwrt running on that box ... I don't really understand what the issues are (unless it's even newer firmware needed, or something odd) ... broadcom has opened up quite a lot ... and building openwrt yourself isn't a big task (good scripts which does the magic, you just need 2-3 hours of compile time)
14:20 <@dazo> the dd-wrt team in general don't understand security well, imo ... they didn't even see a problem that all default ssh-keys for dd-wrt was collected and saved in a globally accessible database
14:21 <@dazo> (http://www.devttys0.com/2010/12/breaking-ssl-on-embedded-devices/)
14:21 <@vpnHelper> Title: /dev/ttyS0 » Blog Archive » Breaking SSL on Embedded Devices (at www.devttys0.com)
14:23 <@dazo> their argument was something like "users who use ssh should generate their own keys afresh, and https access which is the most likely attack vector isn't setup to answer requests from the Internet, only internally" ... yeah, push the responsibility over to their novice users, that's quite an attitude
14:23 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
14:24 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
14:26 < krzee> ahh i remember that paper
14:27 < krzee> good read, still good months later for the second time
14:27 <@dazo> yeah, it is
14:28 < krzee> oh and offtopic... i love stored procedures!
14:29 -!- Konata [~Tsukasa@unaffiliated/konata] has joined #openvpn
14:29 <@dazo> This quote is just great:  Regarding DD-WRT, they are unlikely to fix it. They have stated that they “can’t imagine any situation where an attacker would be able to capture the encrypted traffic” (http://www.dd-wrt.com/phpBB2/viewtopic.php?p=517170&sid=d9276520a767898e052afd06b44eb9fd).
14:29 < Konata> Yes hi,
14:29 < Konata> I'm running openvpnas and I accidentally borked it today while messing around with the ports
14:29 < krzee> they cant imagine it!?  have they not seen littleblockbox!? lol
14:29 < Konata> I made the udp and tcp ports the same value
14:29 < krzee> !AS
14:29 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
14:29 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
14:29 < krzee> see #4 for access-server support
14:29 < Konata> Ah, thank you
14:29 < krzee> np
14:30 < Konata> I just need to change the ports backk
14:30 < Konata> is all :p
14:30 < krzee> tell them so =]
14:30 < krzee> iirc they even have live chat right now
14:31 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
14:31 -!- havoc__ [~havoc@neptune.chaillet.net] has quit [Client Quit]
14:31 <@dazo> krzee: there's another forum thread on DD-WRT ... where they don't want to tell their users dd-wrt had hard coded IP addresses default in the iptables setup ... and it was two lines in a shell to disable this ... they would rather wait for a newer release to get out .... which had no ETA
14:31 <@dazo> dd-wrt != secure
14:31  * dazo don't trust it
14:32 < Konata> It's not secure as anything else there, but it's got a large userbase and therefore a large support base too
14:32 < Konata> But, if you wanna use shoddy manufacturer's firmware, okay :)
14:33 <@dazo> yeah, unfortunately many users are not aware of these issues ... and magazines pulls up dd-wrt as a cool firmware ... 
14:33 < krzee> its not the only linux-based router software out there
14:33 <@dazo> nope, but the vast majority seems to not beware of that
14:33 < krzee> right, i meant that in response to <Konata> But, if you wanna use shoddy manufacturer's firmware, okay :)
14:34 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
14:36 < ziloniz> ok got everything finally connected.. now on to routing :)
14:37 < ziloniz> I have a openvpn client - and its a router for a LAN. how can I go abotu exposting its LAN to the other OPENVPN clients? I need to somehow enable IP forwarding, then push a route to the other clients telling them teh IP of the router as the gateway for that LAN subnet correct?
14:42 < Konata> The site isn't working
14:42 < Konata> At my end
14:43 < Konata> OH
14:43 < Konata> I got in
14:43 < Konata> Somehow
14:49 -!- Konata [~Tsukasa@unaffiliated/konata] has left #openvpn ["Leaving"]
14:49 < krzee> ziloni
14:49 < krzee> !route
14:50 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:50 < krzee> !clientlan
14:50 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
14:50 <@vpnHelper> better explanation
14:56 < ziloniz> tx. I think I have the routing part ok (but thanks for hte link, lots fo good ifno there), but now trying to figure out how to get ddwrt to ip forward packets from the vpn to the lan
14:57 < krzee> !linipforward
14:57 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
14:57 < krzee> that and configuring your firewall properly
14:57 < krzee> (forward chain accepts and that good stuff)
14:57 < krzee> since its a router it has ip forwarding enabled
14:57 < krzee> just make sure your FW is right
14:59 < ziloniz> thx, will check that too
15:06 < ziloniz> great article on routing krzee! Ive read it and have a ? though... if openvpn is running on the router that also handles the LAN behind it - it apears I dont need to worry about IP forwarding because the opevpn will handle the traffic automatically inboudn to that LAN?
15:14 -!- ziloniz [cc100b95@gateway/web/freenode/ip.204.16.11.149] has quit [Ping timeout: 252 seconds]
15:21 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:24 -!- dazo is now known as dazo_afk
15:27 -!- diemaco [~freenode0@d204-191-182-51.abhsia.telus.net] has joined #openvpn
15:42 < dvl> It is Sooo nice to be able to drag and drop a graphic onto the developement webserver via VPN instead of scp...
15:43 -!- K1ng [~KING@119.30.38.13] has joined #openvpn
15:57 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 276 seconds]
15:57 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:01 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
16:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:11 <@vpnHelper> RSS Update - forum: vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p11867>
16:13 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has joined #openvpn
16:14 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
16:15 -!- MarKsaitis_ [~MarKsaiti@82.144.242.158] has quit [Read error: Connection reset by peer]
16:16 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Remote host closed the connection]
16:16 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has joined #openvpn
16:16 <@vpnHelper> RSS Update - forum: Famous TLS error <http://forums.openvpn.net/topic8075.html#p11869> || OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945.html#p11868>
16:17 < openm> Anybody around?
16:17 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
16:22 -!- openm [~Kropotkin@c-98-218-79-90.hsd1.dc.comcast.net] has quit [Quit: openm]
16:22 <@vpnHelper> RSS Update - forum: OpenVPN before windows login <http://forums.openvpn.net/topic8085.html>
16:27 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
16:30 -!- Vutral [7w9CmBZFyU@vutral.net] has joined #openvpn
16:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:38 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Read error: Operation timed out]
16:54 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:00 -!- K1ng` [~KING@119.30.39.40] has joined #openvpn
17:02 -!- K1ng`` [~KING@119.30.38.67] has joined #openvpn
17:02 -!- Vutral [7w9CmBZFyU@vutral.net] has quit [Ping timeout: 260 seconds]
17:05 -!- K1ng [~KING@119.30.38.13] has quit [Ping timeout: 276 seconds]
17:05 -!- K1ng` [~KING@119.30.39.40] has quit [Ping timeout: 240 seconds]
17:09 -!- K1ng`` [~KING@119.30.38.67] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
17:09 <@vpnHelper> RSS Update - forum: TLS Handshake (w/router) - Connection refused (w/out router) <http://forums.openvpn.net/topic8086.html>
17:11 -!- torpion1 [~torpion@ydb.me] has joined #openvpn
17:11 -!- Torpion [~torpion@ydb.me] has quit [Ping timeout: 246 seconds]
17:11 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
17:11 -!- tjz [~pc@bb219-74-43-190.singnet.com.sg] has joined #openvpn
17:11 -!- tjz [~pc@bb219-74-43-190.singnet.com.sg] has quit [Changing host]
17:11 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
17:13 -!- Vutral [ss@vutral.net] has joined #openvpn
17:25 -!- ziloni [~ziloni@208.70.93.89] has quit [Read error: Connection reset by peer]
17:42 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
18:02 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 252 seconds]
18:05 -!- Vutral [EZMoBF7zMo@vutral.net] has joined #openvpn
18:10 <@vpnHelper> RSS Update - forum: TLS Handshake Failed (w/router) - Conn. refused (w/out) <http://forums.openvpn.net/topic8086.html>
18:15 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
18:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
18:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:31 < ecrist> fuck you, Delta 
18:31 < ecrist> right in the stupid ass
18:32 < |Mike|> ecrist: behave beeeeeatch!
18:32 < ecrist> no
18:32 < ecrist> I'm stuck overnight in detroit, trying to get to BSDCan
18:32 < ecrist> which means I'll miss the first day of the conference
18:32 < ecrist> :\
18:32 < |Mike|> craptitude, you can't find it?
18:32 < ecrist> nope, and we tried HARD
18:33 < |Mike|> no coordinates of the building?
18:33 < ecrist> however, the c-store dude at the best western here took $10 to drive EmperorTom and I to the liquor store
18:33 < ecrist> soon, things will be OK
18:33 < |Mike|> Haha, bought some whiskey?
18:34 < ecrist> Mr Jack Daniels decided to join us
18:34 < ecrist> ;)
18:35 < |Mike|> Yummy!
18:35 < |Mike|> black label? ;)
18:45 < jubei__>  ____  _   _  ___  ____  ___ ____    _ __   __  ___ 
18:45 < jubei__> |  _ \| | | |/ _ \|  _ \|_ _|  _ \  / \\ \ / / |__ \
18:45 < jubei__> | |_) | |_| | | | | |_) || || | | |/ _ \\ V /    / /
18:45 < jubei__> |  __/|  _  | |_| |  _ < | || |_| / ___ \| |    |_| 
18:45 < jubei__> |_|   |_| |_|\___/|_| \_\___|____/_/   \_\_|    (_) 
18:45 < jubei__>                                                     
18:45 -!- jubei__ was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://openvpn.pastebin.ca for posting logs or configs.]
18:47 -!- bulbous [~bulbous@121-74-67-89.telstraclear.net] has joined #openvpn
18:48 < bulbous> !welcome
18:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:49 < bulbous> !goal to redirect a single port through the vpn, so other machines on the client's LAN can hit, e.g., the mysql server on the server side
18:51 < bulbous> I have the vpn working fine, it's just that I can't connect to the VPN IP address from any other machine on my LAN, I'd also like the same thing to work from the server side, be able to route a single port on the server (available from machines other than the server itself) through the VPN to the client machine
18:51 < bulbous> right now I'm using ssh with port forwarding, I'm hoping that openvpn can replace that.
19:03 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:11 < Bushmills> !clientlan
19:11 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
19:11 <@vpnHelper> better explanation
19:38 <@vpnHelper> RSS Update - forum: Forwarding Fail [I've searched, read, googled, tried....] <http://forums.openvpn.net/topic8076.html#p11872>
19:54 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:03 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Read error: Connection reset by peer]
20:07 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
20:09 -!- master_of_master [~master_of@p57B55910.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
20:11 -!- master_of_master [~master_of@p57B559A2.dip.t-dialin.net] has joined #openvpn
20:15 -!- Squidy [~quassel@189.72.179.180] has joined #openvpn
20:29 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
20:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:00 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:08 -!- Squidy [~quassel@189.72.179.180] has quit [Remote host closed the connection]
22:08 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:08 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:20 -!- taco_the_paco [~Corey@unaffiliated/taco-the-paco/x-1305449] has quit [Quit: Leaving]
22:27 <@vpnHelper> RSS Update - forum: Do You Need All These Certs & Keys? <http://forums.openvpn.net/topic8087.html>
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:23 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
23:39 <@vpnHelper> RSS Update - forum: TLS Handshake Failed (w/ and w/out router) <http://forums.openvpn.net/topic8086.html>
--- Day changed Tue May 10 2011
00:19 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
00:23 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
00:24 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Read error: Connection reset by peer]
00:24 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
00:26 -!- newmember__ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 252 seconds]
00:44 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
00:51 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
01:03 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:15 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
01:36 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 258 seconds]
01:36 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
01:45 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
01:45 < reiffert> !ipforward
01:45 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
01:45 < reiffert> !winipforward
01:46 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
01:47 < reiffert> !factoids search service
01:47 <@vpnHelper> No keys matched that query.
01:47 < reiffert> !factoids search --values service
01:47 <@vpnHelper> 'win_ipfail' and 'bcast'
01:47 < reiffert> !win_ipfail
01:47 <@vpnHelper> "win_ipfail" is if the adapter fails to set the IP properly check that DHCP client service, and tap-win32 is enabled.
02:01 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
02:07 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
02:10 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
02:12 -!- tjz_ [~pc@bb121-6-236-4.singnet.com.sg] has joined #openvpn
02:14 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
02:16 -!- dirkD [~dirk@ip4da4cec8.direct-adsl.nl] has quit [Ping timeout: 276 seconds]
02:21 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:44 -!- tjz_ [~pc@bb121-6-236-4.singnet.com.sg] has quit [Ping timeout: 246 seconds]
03:10 <@vpnHelper> RSS Update - forum: Please Help <http://forums.openvpn.net/topic8088.html>
03:17 < reiffert> moin
03:34 <@vpnHelper> RSS Update - forum: OpenVPN before windows login <http://forums.openvpn.net/topic8085.html#p11875>
03:34 < hyper_ch> hi reiffert
03:37 -!- dazo_afk is now known as dazo
03:39 <@vpnHelper> RSS Update - forum: TLS Handshake Failed (w/ and w/out router) <http://forums.openvpn.net/topic8086.html#p11876>
03:45 <@vpnHelper> RSS Update - forum: Please Help <http://forums.openvpn.net/topic8088.html#p11878> || Do You Need All These Certs & Keys? <http://forums.openvpn.net/topic8087.html#p11877>
03:46 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:11 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
04:11 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
04:11 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:12 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
04:34 <@vpnHelper> RSS Update - forum: Forwarding Fail [I've searched, read, googled, tried....] <http://forums.openvpn.net/topic8076.html#p11879>
04:40 <@vpnHelper> RSS Update - forum: Forwarding Fail [I've searched, read, googled, tried....] <http://forums.openvpn.net/topic8076.html#p11880>
04:47 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:47 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:48 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
05:22 -!- hpa [hpa@terminus.zytor.com] has quit [Excess Flood]
05:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:25 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
05:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Read error: Operation timed out]
05:38 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
05:38 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
05:38 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
05:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:47 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
05:52 <@vpnHelper> RSS Update - forum: howto share vpn connection (Linux + OpenVPN)? <http://forums.openvpn.net/topic8089.html>
05:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
05:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:16 <@vpnHelper> RSS Update - forum: TLS Handshake Failed (w/ and w/out router) <http://forums.openvpn.net/topic8086.html#p11882>
06:20 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
06:20 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:20 -!- mode/#openvpn [+o mattock] by ChanServ
06:21 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
06:22 <@vpnHelper> RSS Update - forum: TLS Handshake Failed (w/ and w/out router) <http://forums.openvpn.net/topic8086.html#p11883>
06:52 <@vpnHelper> RSS Update - forum: TLS Handshake Failed (w/ and w/out router) <http://forums.openvpn.net/topic8086.html#p11884>
07:01 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
07:01 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
07:01 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
07:07 < fremo> Hi, I have a complexe setup and bloody windows are able to browse shares: [windows 2003: 10.0.0.5/24] [LinuxA: eth0 bridged to openvpn tap0 (arp_accept=1,arp_proxy=1)] Internet [LinuxB tap0 10.0.0.4/24 bcrelay(tap0,pppN) pptpd:[ppp0,ppp1,...]], I can ping every IP, I can arping from the LAN every IP and packets seem to be broadcasted correctly...
07:08 < fremo> So, do you any clue why it fail? :)
07:09 < fremo> It seems that I should better set IP not in the IP network to the remote ppp
07:09 < fremo> but it half works and this is a pain.
07:24 < Bushmills> "windows are able to browse .." ... "..can ping every IP" ... "packets seem to be broadcasted correctly."
07:24 < Bushmills> "why it fail?"   what fails?
07:24 < Bushmills> you gave a list of all the things which work.  
07:25 < fremo> oups, windows are NOT able to browse shares (sorry :)
07:25 < Bushmills> !wins
07:25 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
07:26 < Bushmills> or ...
07:26 < fremo> hum, ok thanks, lets see that :)
07:26 < Bushmills> !tunortap
07:26 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
07:26 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
07:29 < fremo> but, I wont know if my setup fail somewhere or if is is just windows that is very nasty...
07:30 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
07:31 < Bushmills> neither do we
07:47 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
07:56 <@vpnHelper> RSS Update - forum: howto share vpn connection (Linux + OpenVPN)? <http://forums.openvpn.net/topic8089.html#p11885>
08:05 -!- brian [~brian@unaffiliated/brian] has joined #openvpn
08:05 < brian> !welcome
08:05 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:05 -!- raomin [~romain@86.66.22.240] has quit [Ping timeout: 260 seconds]
08:05 < brian> !redirect
08:05 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
08:05 < brian> !def1
08:05 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
08:06 < brian> !ipforward
08:06 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
08:07 < brian> !linipforward
08:07 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
08:07 < brian> !nat
08:07 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
08:07 < brian> !linnat
08:07 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
08:08 -!- raomin [~romain@86.66.22.240] has joined #openvpn
08:09 -!- Alan[1] [~Alan@217.175.38.109] has joined #openvpn
08:09 < Alan[1]> Âñåì ïðèâåò
08:09 < Alan[1]> Òóò åñòü ðóñêèå
08:09 < Alan[1]> ?
08:10 < Alan[1]> !welcome
08:10 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:10 < Alan[1]> !howto
08:10 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:11 < Alan[1]> !goal
08:11 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:12 < Alan[1]> I would like to access the lan behind the server
08:12 < Alan[1]> !goal I would like to access the lan behind the server
08:13 < Alan[1]> !logs
08:13 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:14 < Alan[1]> !logs http://pastebin.com/698Ls8xY
08:15 < Alan[1]> !configs http://pastebin.com/3z9J23qE
08:15 < Alan[1]> !sample
08:15 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
08:16 < Alan[1]> !topology
08:16 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
08:17 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
08:17 < Alan[1]> !howto
08:17 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
08:19 -!- Cain` is now known as Cain
08:19 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:33 <@vpnHelper> RSS Update - forum: howto share vpn connection (Linux + OpenVPN)? <http://forums.openvpn.net/topic8089.html#p11886>
08:37 < brian> !man --redirect-gateway
08:37 < krzie> lol
08:37 < krzie> !man
08:37 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
08:37 < krzie> click the link, find the section you want
08:37 < krzie> !redirect
08:37 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
08:45 < brian> i guess i am really stupid but I must be missing some config option, cause the traffic isn't going through the VPN....
08:46 < brian> !nat
08:46 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
08:46 < brian> !linnat
08:46 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
08:48 -!- dazo is now known as dazo_afk
08:56 -!- dazo_afk is now known as dazo
08:57 <@vpnHelper> RSS Update - forum: howto share vpn connection (Linux + OpenVPN)? <http://forums.openvpn.net/topic8089.html#p11888>
08:57 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
09:07 < brian> !def1
09:07 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
09:08 < Alan[1]> ky
09:08 <@vpnHelper> RSS Update - forum: vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p11889>
09:09 -!- Alan[1] [~Alan@217.175.38.109] has quit [Quit: The Bersirc are coming! The Bersirc are coming! [ http://www.bersirc.org/ - Open Source IRC ]]
09:12 -!- Belial_ [~quassel@216.18.197.178] has joined #openvpn
09:20 -!- Belial_ [~quassel@216.18.197.178] has quit [Remote host closed the connection]
09:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:23 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
09:23 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
09:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:28 -!- queequeg1_ [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
09:30 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
09:30 -!- queequeg1_ is now known as queequeg1
09:33 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
09:39 <@vpnHelper> RSS Update - forum: Newbie question about setting few vpn <http://forums.openvpn.net/topic8077.html#p11891> || Disable/Enable TAP adapter <http://forums.openvpn.net/topic8090.html>
09:57 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
10:01 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:01 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 240 seconds]
10:09 -!- Gobbla [Gobbla@unaffiliated/gobbla] has quit [Ping timeout: 252 seconds]
10:10 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has joined #openvpn
10:10 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has quit [Changing host]
10:10 -!- Gobbla [Gobbla@unaffiliated/gobbla] has joined #openvpn
10:11 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
10:11 < majuk> Hey all.
10:14 < majuk> Bushmills, Thanks for the hand yesterday, client-LAN worked like gangbusters.
10:14 -!- vverheijen [~vincent@82-169-224-42.ip.telfort.nl] has joined #openvpn
10:15 < vverheijen> is there a way to include other files in the openvpn2 configuration files?
10:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:17 < majuk> I was wondering, is it feasible to use SNAT on the VPN client-gateway in a client-LAN setup to get LAN clients that are not assigned addresses within the VPN's subnet to route properly to it?
10:25 < majuk> I suppose that would only work for outbound connects from the LAN, but that works for my model.
10:26 < majuk> So fluffy puppies.
10:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:36 <@dazo> vverheijen: you can use 'config <file>' inside config files
10:37 <@dazo> vverheijen: and if you want to include certificates and keys ... you can do that by replace 'ca file.crt' with <ca>{contents of file.crt}</ca> ... the same with <key> and <cert>
10:42 -!- Vutral [EZMoBF7zMo@vutral.net] has quit [Ping timeout: 260 seconds]
10:42 < vverheijen> thanks
10:49 -!- Vutral [ss@vutral.net] has joined #openvpn
10:52 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
10:55 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
10:57 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 260 seconds]
11:00 -!- Vutral [9hlmKiS1Kr@vutral.net] has joined #openvpn
11:14 < Bushmills> majuk: no problem. glad it worked for you.
11:15 <@vpnHelper> RSS Update - forum: cant listen udp and tcp port <http://forums.openvpn.net/topic8091.html>
11:17 < brian> I'm trying everything and I can't get OpenVPN to route traffic from tap0 to eth0....
11:18 < brian> I have iptables rules, NAT enabled, Port forwarding enabled.....
11:18 < brian> The packet makes it to tap0 and that's it :(
11:19 -!- Vutral [9hlmKiS1Kr@vutral.net] has quit [Ping timeout: 276 seconds]
11:22 < fremo> tap0 is UP, has an IP in a different subnet than eth0 ?
11:22 < brian> yes
11:22 < fremo> and dos it increment all the corresponding iptables rules ?
11:23 < brian> the src is set to 0/24
11:23 < fremo> tcpdump shows you the packets on tap0 and not on eth0 ?
11:23 < brian> yes
11:23 < fremo> the counter gets incremented ?
11:23 -!- Vutral [ss@vutral.net] has joined #openvpn
11:23 < brian> I've been trying to get this to work for hours
11:23 < fremo> yes I guess ;)
11:23 < brian> fremo hmmm, what counter?
11:23 < fremo> iptables
11:24 < brian> how do I check that?
11:24 < fremo> you know what I mean ?
11:24 < fremo> iptables -vL
11:24 < fremo> iptables -vL -t nat
11:24 < brian> it says Chain POSTROUTING (policy ACCEPT 288 packets, 21020 bytes)
11:24 < fremo> and what does tcpdump says ?
11:24 < fremo> -s\  
11:25 < brian> and where the forwarding is.... Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
11:25 < fremo> and rules ?
11:25 < brian> for forwarding?
11:25 < fremo> policy is the default
11:25 < fremo> it is incremented if no rules matched IIRC
11:25 < fremo> all involved rules and policy
11:25 < brian> I think it's incremented if rules are matched
11:26 < fremo> I dont think so, test it
11:26 < brian> ok
11:26 < fremo> that's it
11:27 < fremo> on my laptop, I finish the input chain with REJECT all and the policy is DROP and counter is 0
11:27 < brian> i have this for NAT:    0     0 SNAT       all  --  any    eth0    10.8.0.0/24          anywhere           to:x.x.x.x
11:28 < fremo> then it's not used
11:28 < fremo> it has not been used
11:29 < brian> really? why not?
11:29 < fremo> because the counters say so
11:29 < brian> but everything matches :(
11:29 < fremo> is it in PREROUTING ?
11:29 < fremo> nop
11:29 < brian> POSTROUTING
11:30 < fremo> yes POSTROUTING if eth0 is the output
11:30 < brian> yes eth0 is where I want it to be forwarded to
11:30 < fremo> you may have to do it in PREROUTING, I am not sure but I guess
11:32 < brian> no, PREROUTING it does not work.
11:32 < brian> iptables: Unknown error 18446744073709551615
11:32 < brian> and also: iptables v1.3.5: Can't use -o with PREROUTING
11:33 < fremo> erf, too bad,
11:33 < fremo> yes , -i tap0
11:34 < brian> -i tap0 where?
11:34 -!- csd-199 [~asdf@189.248.49.243] has joined #openvpn
11:35 < fremo> heh, in you PREROUTING rule, at the stage you can filter by the input interface the output interface has not been chosen
11:36 < brian> so what do i put for PREROUTING?
11:36 < fremo> -i tap0
11:36 < brian> i put: iptables -t nat -A PREROUTING -s 10.8.0.2 -j MASQUERADE -i tap0
11:36 < brian> but i got unknown error
11:36 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 252 seconds]
11:36 < csd-199> Hi to all. I have a VPN server working very well. I have a linux client routing a local network and works fine. Now, I have a windows laptop I want to connect to the server, I configured the OpenVPN GUI for windows... the connection gives me an IP but not a gateway, where can be the error?
11:38 < brian> fremo ok i added the rule, but still no success
11:39 -!- kartooon [~kartoon@unaffiliated/kartooon] has quit [Ping timeout: 260 seconds]
11:39 < fremo> brian: ok, sorry it does not work yet, I have to go, may you find the solution quickly!
11:39 < brian> I give up! 
11:40 < fremo> heh
11:40 < fremo> tomorrow with more patience and clear ideas
11:47 -!- Vutral [ss@vutral.net] has joined #openvpn
11:48 -!- queequeg1_ [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
11:51 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Ping timeout: 276 seconds]
11:51 -!- queequeg1_ is now known as queequeg1
11:54 -!- d-fens_ [~dfs@dslb-088-077-158-235.pools.arcor-ip.net] has joined #openvpn
11:55 < d-fens_> hi, i made a client vert without a pass and deleted it, now i want to recreate  a cert with a pass for the saem client but i get "failed to update database - TXT_DB erro number 2 "
11:55 < csd-199> Hi to all. I have a VPN server working very well. I have a linux client routing a local network and works fine. Now, I have a windows laptop I want to connect to the server, I configured the OpenVPN GUI for windows... the connection gives me an IP but not a gateway, where can be the error?
11:55 < d-fens_> how can i fix this ?
11:56 < krzee> d-fens_, you should not have deleted it
11:56 < krzee> !factoids search pass
11:56 <@vpnHelper> 'winpass', '2.1-winpass-script', 'authpass', 'password-only', 'strip-passphrase', 'change-passphrase', and 'enable-passwd-save'
11:56 < krzee> !change-passphrase
11:56 <@vpnHelper> "change-passphrase" is see http://openvpn.net/archive/openvpn-users/2005-03/msg00230.html for how to change (or add) a key's passphrase
11:56 < d-fens_> ah i see
11:56 < d-fens_> is it somewher cached?
11:57 < krzee> dunno
11:57 < d-fens_> ok removed it from index
11:57 < krzee> i dont use easy-rsa
11:58 < krzee> if you didnt rm the csr you can just sign the same one again
11:59 < d-fens_> ok i understand
11:59 < krzee> csd-199, you did not supply enough information
11:59 < d-fens_> now it worked, just removed the line from the index.txt
11:59 < krzee> csd-199, maybe post your windows log
11:59 < d-fens_> thx
11:59 < krzee> d-fens_, yw
12:01 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
12:06 < csd-199> question: Do I have to put somewhere a routing line to access the server-lan from the outside-windows laptop? I mean, do I have to put a routing line IN my lap configuration or somewhere in the server configuration? 
12:06 < brian> I'm trying to IP forward my tap0 device to eth0, and I'm getting no where, a little help?
12:07 < brian> I tried every tutorial I can find....
12:10 -!- csd-199 [~asdf@189.248.49.243] has left #openvpn []
12:27 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
12:31 -!- dazo is now known as dazo_afk
12:38 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has quit [Read error: Connection reset by peer]
12:44 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 240 seconds]
12:47 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has joined #openvpn
12:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:50 <@vpnHelper> RSS Update - forum: cant listen udp and tcp port <http://forums.openvpn.net/topic8091.html#p11893>
12:53 < brian> I need help!
12:54 < brian> I'm trying everything and I can't get OpenVPN to route traffic from tap0 to eth0....
12:54 < brian> What the heck am I doing wrong?!?
12:56 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
12:58 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
13:01 < Bushmills> brian: you could determine that by elimination. please list everything you did right.
13:03 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
13:10 < brian> Bushmills well, I can ping the VPN server with 10.8.0.1 from the client.
13:10 < brian> Bushmills And I can access services running on 10.8.0.1....
13:11 < brian> But the traffic never goes anywhere but tap0!
13:11 < Bushmills> !ipforward
13:11 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
13:12 < brian> yes, I did that
13:12 < brian> !linipforward
13:12 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
13:12 < brian> yes it's done
13:12 < brian> also i added iptables rule
13:13 < brian> iptables -t nat -A POSTROUTING -s 10.8.0.2 -j MASQUERADE -o eth0
13:13 < Bushmills> why do you NAT traffic if you're bridging?
13:13 < brian> I'm not bridging
13:13 < Bushmills> tap0?
13:13 < brian> I'm supposed to use tun if I'm not bridging?
13:14 < Bushmills> it's suggested to use tun if you have no reason to use tap
13:14 < brian> I want everything to go over the VPN, that's why I'm using tap...
13:14 < brian> I thought to try tun, since tap doesn't seem to work though.
13:14 < Bushmills> "everything"?
13:15 < brian> All traffic
13:15 < Bushmills> layer 2 traffic?
13:15 < Bushmills> !tunortap
13:15 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
13:15 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
13:15 < brian> oh....
13:16 < brian> i guess i don't need tap
13:16 < brian> if I switch to tun, it will work for sure?
13:16 < brian> well...i'll try and see
13:16 < Bushmills> if it doesn't work now, nobody can guarantee that it will work after switching to tun
13:17 < Bushmills> you're probably missing some detail in your setup
13:17 < brian> what can I be missing?
13:17 < Bushmills> !redirect
13:17 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:17 < brian> I have that also
13:18 < brian> Do I need redirect-gateway on the client also?
13:18 < Bushmills> either push by server, or in client config
13:18 < brian> yes, i have push
13:18 < Bushmills> change to tun first, then we'll see what's next
13:18 -!- vverheijen [~vincent@82-169-224-42.ip.telfort.nl] has quit [Ping timeout: 276 seconds]
13:19 < brian> no....i cannot use tun....
13:19 < brian> i must use tap because of how I am setting it up
13:19 < Bushmills> wrong conclusion, me seems
13:20 < brian> Tue May 10 14:20:13 2011 There is a problem in your selection of --ifconfig endpoints [local=10.8.0.2, remote=255.255.255.0].  The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver.  Try 'openvpn --show-valid-subnets' option for more info.
13:22 < Bushmills> assign to client a p-t-p address in the same /30 as its virtual ip address 
13:22 < brian> ok, i fixed that
13:23 < brian> ok i switched to tun and now it doesn't work at all
13:23 < Bushmills> both server and client?
13:23 < brian> wait, it's my fault
13:24 < Bushmills> of course it is
13:25 < Bushmills> means, i can pretty much rule out that it's a bug in openvpn, as i'm using a redirect-gateway myself :P
13:25 < brian> no it's not a bug
13:26 < brian> ok, i also can't access the internet through TUN anyways
13:26 -!- vverheijen [~vincent@82-169-224-42.ip.telfort.nl] has joined #openvpn
13:26 < brian> but I need it to work through TAP
13:28 < Bushmills> !winroute
13:28 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
13:28 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
13:29 < brian> Bushmills how can it be a client problem?
13:29 < brian> Bushmills packets are reaching server fine
13:31 < Bushmills> because packets to server use one route, and as result of redirect-gateway, three or two more will have to be added, depending on whether def1 is used or not
13:33 < brian> the server is running Linux, and the client is Windows
13:35 < brian> I tcpdump'ed eth0, there are no packets being sent out as a result of packet forwarding
13:35 < brian> what information do you need to help me, because this is driving me crazy, i've been trying to get it to work since last night
13:36 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:36 < Bushmills> i can't help you with a tap setup
13:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
13:37 -!- darkdrgn2k [~yurko@204.101.63.212] has joined #openvpn
13:37 < darkdrgn2k> hey guys,
13:37 < brian> surely bridging is not the only way for tap to work?
13:38 < darkdrgn2k> i got a windwos 7 machine that wont connect.. it gets stuck on testing routesr
13:38 < darkdrgn2k> routes
13:38 < darkdrgn2k> finalyl givs up
13:38 < Bushmills> !winroute
13:38 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
13:38 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
13:38 < Bushmills> darkdrgn2k: ^^^
13:38 < darkdrgn2k> already tried #1 lol
13:39 < darkdrgn2k> route-delay seems to be the only thing i can still tr
13:39 < darkdrgn2k> openvpn is running as local service
13:40 < darkdrgn2k> also the interface doesnt seem to get an ip add
13:40 < darkdrgn2k> infact it gets a 169... ip
13:40 < Bushmills> check logs.
13:41 < darkdrgn2k> dont see anythign in server or client
13:41 < darkdrgn2k> last entry on server is 
13:41 < darkdrgn2k> Tue May 10 14:40:29 2011 516/70.55.116.20:60698 SENT CONTROL [516]: 'PUSH_REPLY,route 172.16.21.0 255.255.255.0,route 10.243.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.243.0.110 10.243.0.109' (status=1)
13:46 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
13:50 < brian> does tun only work with SSL?
13:50 < darkdrgn2k> brain: as opposed to?
13:50 < Bushmills> nope. but openvpn needs SSL
13:50 < brian> secret key
13:50 < darkdrgn2k> damit vpn is getting IP = 169.254.195.36/255.255.0.0 
13:57 < brian> ok i give up
13:57 < darkdrgn2k> any idaes?
14:08 < darkdrgn2k> anyone :-S
14:10 < darkdrgn2k> *sniff*
14:10 < darkdrgn2k> any crazy things in windows 7
14:10 < Bushmills> !windows
14:10 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
14:12 < darkdrgn2k> :-S
14:13 < darkdrgn2k> http://pastebin.com/sFiNFgfB <-log from client
14:15 < Bushmills> ifconfig 10.243.0.110  seems fine
14:15 < Bushmills> what happens if you ping 10.243.0.110 on client?
14:16 < darkdrgn2k> timeout
14:16 < darkdrgn2k> ... the adapter has a 169 address not a 10.243
14:18 < Bushmills> DHCP LEASE OBTAINED??
14:18 < darkdrgn2k> yes
14:18 < darkdrgn2k> but no
14:18 < darkdrgn2k>  DHCP SERV = 0.0.0.0/255.255.255.255 
14:18 < darkdrgn2k>   
14:19 < Bushmills> openvpn client should set ip address using ifconfig or ipconfig. 
14:19 < Bushmills>   DHCP LEASE OBTAINED = Tue May 10 15:10:43 2011
14:19 < Bushmills>   DHCP LEASE EXPIRES  = Tue May 10 15:10:43 2011
14:19 < darkdrgn2k> but look at the server
14:19 < darkdrgn2k>  DHCP SERV = 0.0.0.0/255.255.255.255 
14:20 < Bushmills> also note the time difference between lease and expiry 
14:20 < darkdrgn2k> hmm
14:21 < darkdrgn2k> <=500 ms
14:21 < reiffert> gamma rays?
14:22 < reiffert> I knew it would slow down conversation.
14:22 < darkdrgn2k> also 0 byets sent
14:23 < darkdrgn2k> but its receivin
14:24 < darkdrgn2k> soo any idea what this could be?
14:25 < reiffert> 169 sounds like m$
14:26 < darkdrgn2k> 169 i thikn is auto-config private ip range
14:26 < reiffert> auto config m$
14:27 < darkdrgn2k> meaning its not taking the dhcp ip addd
14:28 < reiffert> play with the ifconfig alternatives
14:29 < darkdrgn2k> the wierd pard is the windows adapters status screen shws 0 sent
14:29 < darkdrgn2k> and 25k received
14:29 < brian> I hate networking!
14:30 < Bushmills> brian: please unplug your network cables. disconnect from internet right now
14:30 < brian> It won't work using TUN either!!
14:31 < Bushmills> i can assure you that tun works
14:31 < brian> why does OpenVPN hate me?
14:31 < Bushmills> what reason did you give it to hate you`
14:32 < brian> The OpenVPN GUI never reports that I successfully connected
14:32 < brian> But my Win32-TAP Driver has an IP!
14:33 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Quit: Leaving]
14:33  * Bushmills observes that most problems with openvpn seem to coincide with use of windows
14:34 < reiffert> I was installing openvpn on windows today. twice. no problems.
14:34 < reiffert> 30 times in the last 8 weeks. no probs.
14:40 < brian> Bushmills using TUN the IP traffic does not even make it to the TUN interface
14:40 < brian> Bushmills only traffic from VPN IP
14:41 < Bushmills> you probably want the other traffic routed over vpn then
14:42 < Bushmills> !redirect
14:42 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:43 < brian> Bushmills I have that
14:43 < Bushmills> no, you don't
14:43 < brian> push "redirect-gateway def1 local"
14:43 < Bushmills> "(21:40:46) brian: Bushmills using TUN the IP traffic does not even make it to the TUN interface
14:43 < Bushmills> (21:40:57) brian: Bushmills only traffic from VPN IP"
14:43 < brian> yes, i have redirect-gateway...
14:44 < Bushmills> your openvpn server is in the same network as your client?
14:44 < brian> no, I put local because it wasn't working with just def1
14:45 < Bushmills> then your client won't have a route to the server
14:45 < brian> ok i took away local
14:46 < Bushmills> also disable or remove blocking firewall rules on server 
14:46 < Bushmills> !firewall
14:46 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
14:46 < brian> Bushmills There are no blocking firewall rules
14:47 < Bushmills> !winroute
14:47 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
14:47 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
14:47 < brian> why are you showing me that?
14:48 < brian> the interface is up, I can reach 10.8.0.1 (the server), but i cannot reach the global internet.
14:48 < Bushmills> because something is wrong in your setup, and that could be it, or one of what  is wrong
14:48 < Bushmills> check routes on client
14:48 < brian> i don't know what you mean
14:49 < Bushmills> "make sure that traffic to internet has routes through openvpn"
14:49 < brian>      10.8.0.0  255.255.255.252         10.8.0.2         10.8.0.2     30
14:49 < brian>      10.8.0.2  255.255.255.255        127.0.0.1        127.0.0.1     30
14:49 < brian> that's all
14:49 < Bushmills> none
14:49 < Bushmills> i leave you alone. you are resistent against suggestions
14:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
14:50 < brian> I don't know how to add routes
14:50 < Bushmills> !winroute
14:50 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
14:50 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
14:50 < Bushmills> it's the third or fourth time i show you that
14:51 < brian> add route-method exe to my client config file?
14:51 < Bushmills> no don't
14:51 < brian> no?
14:51 < Bushmills> better ask again why this is shown to you
14:51 < Bushmills> but ask somebody else
14:53 < brian> i don't know how to make OpenVPN add a 0.0.0.0 route
14:53 < Bushmills> !redirect
14:53 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:54 < brian> yes i am trying to tell you, I already have all that done.
14:54 < Bushmills> !winroute
14:54 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
14:54 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
14:54 < brian> I'm not getting errors on intialization sequence, so does #5 apply to me?
14:57 < brian> routing and remote access service is disabled...
14:59 < brian> so i added route-method exe and i added route-delay 30, and i been there the entire list, and it's probably a server side problem, not client side.
15:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:04 < reiffert>        --ip-win32 method
15:04 < reiffert> thats for that 169 guy
15:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
15:05 < darkdrgn2k> me?
15:05 < reiffert> yeah
15:06 < darkdrgn2k> ip-win32 method or ip-win32 netsh
15:06 < reiffert> play with that option
15:06 < reiffert> see manpage for details
15:08 < brian> I want to use TAP, AHHHHHHH!
15:08 < reiffert> brian: so? just do it.
15:08 < reiffert> !tap
15:08 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything where
15:08 < brian> I can't, it won't work!
15:08 <@vpnHelper> the protocol uses MAC addresses instead of IP addresses.
15:08 < reiffert> brian: it works, it's a matter of brain.
15:08 < brian> It won't forward the packets when I use tAP
15:09 < brian> And when I use TUN it doesn't even receive the packets
15:09 < brian> so i'm running out of ideas
15:10 < reiffert> millions of people solved it before you. you will do so at some time from now.
15:10 < brian> I have googled for hours!
15:10 < reiffert> most probably.
15:10 < brian> I cannot find any solution!
15:10 < reiffert> does googling solve problems?
15:10 < reiffert> reading and understanding the docs (howto, manpage, andsoon) will
15:11 < brian> But I don't understand, people write, here's my config and it works, but then I try to use it, and it doesn't work!
15:11 < reiffert> cosmic rays?
15:14 < darkdrgn2k> brian, : depends on os and many other things
15:14 <@vpnHelper> RSS Update - forum: Help: Connected to VPN server but cannot ping other IP's <http://forums.openvpn.net/topic8092.html>
15:14 < brian> Well, I have to use Ethernet bridging for it to work.
15:14 < brian> But if I use Ethernet bridging, it shuts down the network on my VPS
15:15 < brian> Then I cannot configure it anymore, because I lose connection to SSH
15:15 < brian> So I thought I could use iptables routing to get it to work with TAP, but it doesn't work!
15:15 < darkdrgn2k> brian, : first rpbolem - TAP adaptesrs and VPSes dont always mix
15:15 < brian> It's not OpenVZ though
15:15 < darkdrgn2k> brian what kinda vps is it
15:15 < brian> It's Xen, so it should work!
15:16 < brian> Infact, it does work....I just can't get it to access the worldwide internet
15:16 < brian> I don't know how to get the packets from tap0 to eth0
15:17 < darkdrgn2k> could be the routes on the other side
15:17 -!- vverheijen [~vincent@82-169-224-42.ip.telfort.nl] has quit [Ping timeout: 276 seconds]
15:17 < darkdrgn2k> did you try a traceroute see how far packets get
15:17 -!- cpm [~Chip@c-98-235-72-12.hsd1.pa.comcast.net] has joined #openvpn
15:17 -!- cpm [~Chip@c-98-235-72-12.hsd1.pa.comcast.net] has quit [Changing host]
15:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
15:17 < brian> darkdrgn2k the IP traffic gets to the VPN
15:17 -!- vverheijen [~vincent@82-169-224-42.ip.telfort.nl] has joined #openvpn
15:18 < darkdrgn2k> but then what?
15:18 < darkdrgn2k> your trying to send web traffic through the vpn?
15:18 < brian> darkdrgn2k I see my ping to 8.8.8.8, but it needs to forward that to the eth0 device so that it works
15:19 < darkdrgn2k> your trying to send web traffic through the vpn?
15:19 <@vpnHelper> RSS Update - forum: Help: Connected to VPN server but cannot ping other IP's <http://forums.openvpn.net/topic8092.html#p11895>
15:19 < brian> yes darkdrgn2k
15:19 < darkdrgn2k> ok
15:19 < darkdrgn2k> if you do a tracert google.com
15:19 < darkdrgn2k> where does it die/
15:19 < brian> On the DNS resolution
15:20 < darkdrgn2k> fine
15:20 < darkdrgn2k> tracert 70.33.240.50
15:20 < brian> I have to reconfigure everything now
15:20 < brian> Because it's set to use TUN now
15:20 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
15:20 < darkdrgn2k> tun is ine
15:20 < darkdrgn2k> tun is good
15:20 < brian> But it's not working, and I read that it doesn't even work on Windows.
15:20 < darkdrgn2k> is it a windows or a linux box?
15:21 < reiffert> Bushmills: how long is he trying around stuff, days?
15:21 < darkdrgn2k> im using tun :)
15:21 < darkdrgn2k> on 80 windows machines
15:21 < Bushmills> reiffert: not sure.
15:21 < darkdrgn2k> 79 of them successfully
15:21 < brian> Ok, well, it works, but unlike when I use TAP, the ping request to 8.8.8.8 doesn't even reach the VPN network
15:21 < darkdrgn2k> yeh
15:21 < darkdrgn2k> TAP is a pain to route
15:22 < reiffert> !factoids search --values complicated
15:22 <@vpnHelper> No keys matched that query.
15:22 < reiffert> !factoids search --values expert
15:22 <@vpnHelper> No keys matched that query.
15:22 < reiffert> !factoids search --values experts
15:22 <@vpnHelper> No keys matched that query.
15:22 < darkdrgn2k> why do you wnat tap?
15:22 < reiffert> darkdrgn2k: "because tun does not work"
15:22 < Bushmills> reiffert: (18:23:40) brian: I've been trying to get this to work for hours
15:22 < darkdrgn2k> well put it back to work..
15:22 < brian> Because I'm running the VPN client on the host operating system for VMware, and I'm connecting to VPN inside of VMWare macine
15:22 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
15:23 < brian> And if I use TUN, it wants me to define an IP on the host operating system, and I don't want to, i want to define it within the virtual OS.
15:23 < darkdrgn2k> brian, WHY?!?!? why not just setup a NAT ethernet addapter in vmware?
15:23 < reiffert> Bushmills: ah. maybe he is one of those vmware problems
15:23 < reiffert> !factoids search --values vmware
15:23 <@vpnHelper> No keys matched that query.
15:23 < reiffert> !factoids search vmware
15:23 <@vpnHelper> No keys matched that query.
15:23 < reiffert> victims to be precise.
15:23 < brian> No, because I tried it on the host also and it didn't work.
15:23 < darkdrgn2k> brian, : ok you dont understand how TUN works....
15:23 < brian> TAP will work if I could just figure out how to forward the ARP packets
15:24 < darkdrgn2k> brian, : why use openvpn at all in that case.. why now creata  a bridged network adaper?
15:24 < darkdrgn2k> in vmware
15:24 < brian> darkdrgn2k Because the OpenVPN server is running on a remote server.
15:25 < darkdrgn2k> ok
15:25 < darkdrgn2k> you understand that the ip address you need in the virtual OS is not an ip address that anyone else usses.... i
15:25 < darkdrgn2k> its used exclusivly for  openvpn.
15:26 < brian> yes i know
15:26 < darkdrgn2k> anyway for tap.. have you checked the arp table of the server
15:26 < darkdrgn2k> to see if youer mac is registered
15:26 < darkdrgn2k> what is the remote server running? linux or windows?
15:26 < brian> Linux
15:26 < brian> Let me reconfigure to TAP...
15:26 < darkdrgn2k> have you bridged the tun interface and the eth0 interface?
15:27 < brian> i cannot bridge
15:27 < darkdrgn2k> well then you cannot use tap..
15:27 < reiffert> so why use tap then?
15:27 < brian> I don't know how to bridge, actually
15:27 < darkdrgn2k> brctl
15:27 < brian> Because when I try to do it, I guess I'm putting the wrong settings
15:27 < brian> darkdrgn2k what how do I not lose my WAN connection when I bridge?
15:27 < darkdrgn2k> you will also loose network connectivity
15:27 < darkdrgn2k> get a script to bring it up and run it in the background
15:27 < darkdrgn2k> OR dont use TAP
15:28 < reiffert> Bushmills: does he play that ignorant since then?
15:28 < brian> darkdrgn2k can you explain the process to me so that I can understand it
15:28 < darkdrgn2k> brian, : im telling you.. go TAP and setup MASQUARDING on the far end
15:28 < Bushmills> he had this prevalence for using tap all the time
15:28 < brian> do you mean go TUN or go TAP?
15:28 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
15:28 < darkdrgn2k> go tap
15:28 < darkdrgn2k> and masq your remote point
15:28 < brian> ok i did setup masq
15:28 < brian> it didn't work 
15:28 < brian> :(
15:29 < darkdrgn2k> did you set it up for tap or tun
15:29 < brian> TAP
15:29 -!- mirco [~mirco@p5B284EE3.dip.t-dialin.net] has joined #openvpn
15:29 < darkdrgn2k> dont use tap..
15:29 < darkdrgn2k> use tun
15:29 < darkdrgn2k> if you dont know how to bridge... dont.
15:29 < brian> I want to bridge
15:29 < brian> I can figure it out but there is not much info on the internet
15:29 < darkdrgn2k> then go physically to the machine
15:29 < darkdrgn2k> there is tone 
15:29 < brian> It's all about TUN
15:29 < brian> THat is why I am so confused right now!
15:30 < darkdrgn2k> just fyi TUN and TAP are the same device
15:30 < brian> Because I have been trying to use directions to setup on TUN when I'm using TAP!
15:30 < darkdrgn2k> TAP is just a bridge TUN 
15:30 < darkdrgn2k> and you tell openvpn to use TAP  instead of TUN
15:30 < brian> darkdrgn2k after i bridge, how do i regain connectivity?
15:30 < brian> that's all i need to know
15:31 < darkdrgn2k> brain: when you bridge.. you losoe tun0 and eth0 and gain br0
15:31 < darkdrgn2k> br0 becomes your ethernet adapter
15:31 < brian> so I configure br0 like my eth0 was configured?
15:31 < darkdrgn2k> yep
15:31 < brian> ok i will try that
15:31 < darkdrgn2k> but you have to configure it while you loos
15:31 < darkdrgn2k> ok
15:31 < darkdrgn2k> do this
15:32 < brian> CentOS supports bridge....
15:32 < brian> So it should do this all for me...
15:32 < darkdrgn2k> i dont know why you have to use tap
15:32 < darkdrgn2k> why not tun
15:32 < brian> I told you why
15:32 < darkdrgn2k> no you didnt
15:32 < brian> It's because I don't want the traffic to go over anything but the VPN, and it's the simplest way to accomplish it using VMWare.
15:32 < darkdrgn2k> umm no..
15:32 < darkdrgn2k> not relaly..
15:33 < brian> then what is the simplest way?
15:33 < darkdrgn2k> you just specify a default route over the tun :)
15:33 < darkdrgn2k> define a route rto the openvpn server
15:33 < darkdrgn2k> then specify a default route tthrough the tun
15:33 < darkdrgn2k> hey stupid question
15:33 < darkdrgn2k> ony oru linux bo
15:33 < darkdrgn2k> x
15:33 < darkdrgn2k> did you do 
15:33 < darkdrgn2k> adapter
15:33 < darkdrgn2k> echo 1 > /proc/sys/net/ipv4/ip_forward
15:33 < brian> yes of course
15:33 < darkdrgn2k> ok just checking
15:34 < darkdrgn2k> anyway yeh its better the use tun for that then tap
15:34 < darkdrgn2k> cause with tap your not routing..
15:34 < reiffert> !tunortap
15:34 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
15:34 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
15:34 < brian> ok but how do I prevent TUN from accessing the non-VPN network?
15:34 < brian> if i lose VPN connection, it will connect using my real WAN IP.
15:34 < darkdrgn2k> 1) dont route non=vpn network
15:34 < darkdrgn2k> 2) firewalls!
15:35 < brian> I'm trying to prevent that
15:35 < darkdrgn2k> ooo so now you want failover :-P
15:35 < brian> But if I use VMWare NAT how can I prevent it?
15:35 < reiffert> tun
15:35 < reiffert> tun
15:35 < reiffert> tun
15:35 < reiffert> do or die
15:35 < darkdrgn2k> add a secondary default route with a higher cost
15:35 < darkdrgn2k> iptables
15:35 < brian> No I don't want failover
15:35 < darkdrgn2k> if i lose VPN connection, it will connect using my real WAN IP.
15:35 < brian> I want the connections to just stop working if the VPN fails
15:35 < brian> In the VMWare machine
15:35 < darkdrgn2k> WHAT?
15:35 < darkdrgn2k> im so confused
15:35 < darkdrgn2k> ok
15:35 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Quit: Leaving]
15:35 < darkdrgn2k> so you have a VPN server here ****
15:35 < Bushmills> don't use def1
15:36 < darkdrgn2k> then you have the net {    }
15:36 < darkdrgn2k> then you have VMWARE server ***
15:36 < darkdrgn2k> and then a GUEST ****
15:36 < bulbous> !linipforward
15:36 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:36 < darkdrgn2k> ytou want to connect the guest to the vpn.... and make it send all its traffic over thhat
15:36 < brian> yes
15:36 < darkdrgn2k> so you craete a tUN connection between the 2 networks...
15:36 < brian> and if I lose VPN connection, I want it to simulate complete loss of internet connectivity
15:37 < darkdrgn2k> ok good
15:37 < darkdrgn2k> soo
15:37 < Bushmills> don't use def1
15:37 < darkdrgn2k> you create a tun connection
15:37 < darkdrgn2k> create a route to the vpn server ONLY
15:37 < brian> If I don't use def1, how will I access the internet?
15:37 < darkdrgn2k> set the default route THROUGH the vpn server
15:37 < darkdrgn2k> <darkdrgn2k> set the default route THROUGH the vpn server
15:37 < brian> ok, I have no clue how to do that
15:37  * Bushmills headpalms
15:38 < darkdrgn2k> route add -net 0.0.0.0 MASK 0.0.0.0 <<SERVERTUNADDRESS>>
15:38 < Bushmills> consider to read the man page, on things like def1
15:38 < brian> I did read the manpage
15:38  * reiffert helps Bushmills
15:38 < darkdrgn2k> route add -net <<SERVERWANADDRESS> MASK 255.255.255 <<YOURREALGATEWAY>>
15:38 < brian> darkdrgn2k in win32 or Linux?
15:38 < Bushmills> what did you understand about def1?
15:38 < darkdrgn2k> nix
15:39 < brian> Bushmills Not really anything
15:39 < darkdrgn2k> win its same command slightly differnt syntax
15:39 < Bushmills> i got that impression
15:39 < darkdrgn2k> i used to use this all the time to play WOW in collage cause their firewalls would block it
15:39 < brian> I'm not a network admin, I'm sorry!
15:39 < darkdrgn2k> brian, : no  need to be  network admin but you need to learn about routing PERDIOD
15:39 < reiffert> pay us then.
15:39 < brian> I'm just a stupid slowly web developer
15:39 < brian> *lowly
15:40 < darkdrgn2k> so why are you trying to get vpn to work lOl
15:40 < brian> Because I'm using it to play a game like you did in college.
15:40 < darkdrgn2k> oh well then
15:40 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
15:40 < darkdrgn2k> dont use VMWARE
15:40 < darkdrgn2k> =)
15:40 < brian> Don't worry, it's not 3d game.
15:40 < darkdrgn2k> oh..
15:40 < darkdrgn2k> still
15:40 < darkdrgn2k> dont use VMWARE
15:40 < reiffert> he could try the openvpn developer mode tan instead
15:40 < Bushmills> !def1
15:40 < brian> I have to use VMware
15:40 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
15:41 < reiffert> tan is easy to setup
15:41 < brian> darkdrgn2k what you suggest I use besides VMware?
15:41 < darkdrgn2k> a laptop
15:41 < Bushmills> " override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0."
15:41 < reiffert> it combines tun and tap mode
15:41 < Bushmills> "overriding but not wiping out the original default gateway., "
15:41 < brian> so it creates another gateway for that route?
15:41 < Bushmills> i.e.  ... without def1,  original default gateway gets overwritten
15:41 < Bushmills> when vpn breaks, no more default gateway
15:42 < Bushmills> i.e. loss of default route
15:42 < Bushmills> i.e. loss of route to "rest of the world"
15:42 < brian> Ok I see
15:42 < brian> darkdrgn2k why so against VMware?
15:42 < darkdrgn2k> brian, you cannot have more then 1 default gateway...  when you use !def1 the new gateway takes priority but the old gateway is still there so when things go soure it goes back to the way it was
15:42 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 246 seconds]
15:42 < darkdrgn2k> brian, beacuse your trying to convince me you wnana play a game on vmware...and lying to me to gain my sympathy
15:43 < darkdrgn2k> brian, not telling me what your really up to
15:43 < brian> No, it's just a card game...
15:43 < darkdrgn2k> brian, so we can actually help
15:44 < darkdrgn2k> anwya for bridges you do this
15:44 < darkdrgn2k> create a bridge: brctrl addbr br0
15:44 < brian> I would like to use tun if i can get it to work
15:44 < darkdrgn2k> add interfaces to bridge: brctrl addif br0 eth0
15:44 < darkdrgn2k> add interfaces to bridge: brctrl addif br0 tun0
15:44 < darkdrgn2k> bring up the bridge: ifconfig br0 up IP.....
15:44 < darkdrgn2k> but yeh id use tun for routing
15:44 < reiffert> it's a waste of time.
15:44 < brian> What is a waste of time?
15:45 < darkdrgn2k> trying to underesatand what your not telling us
15:45 < reiffert> brian: you are when keeping tap on your wishlist.
15:45 < brian> Now that you explained the routing, I understand i don't need TAP
15:45 < darkdrgn2k> but dont forget you have to route traffic accross the TUN
15:45 < darkdrgn2k> OR masquarade it on the other side
15:46 < brian> I tried to masquerade it
15:46 < brian> But it didn't do anything
15:46 < Bushmills> and the fun thing is:  REDIRECT-GATEWAY DOES ALL THAT ROUTING FOR YOU,  normally.
15:46 < darkdrgn2k> Bushmills, : but then you need to configure the other lan to route.. or setup masq for it to appear to work 
15:46 < brian> Bushmills what argument must I pass to redirect-gateway?
15:46 < darkdrgn2k> Bushmills, openvpn will only do so much
15:46 < darkdrgn2k> brian, : none
15:47 < darkdrgn2k> but your gateway has to know where to find your VPN
15:47 < darkdrgn2k> so it can send traffic gack to it
15:47 < darkdrgn2k> *back to it
15:47 < Bushmills> darkdrgn2k: i don't know about "other lan". there was a mention of "all traffic" before
15:47 < darkdrgn2k> is the VPN server your default gateway?
15:47 < bulbous> !goal to redirect a single port through the vpn, so other machines on the client's LAN can hit, e.g., the mysql server on the server side
15:47 < brian> wait....
15:48 < bulbous> I have the vpn working fine, it's just that I can't connect to the VPN IP address from any other machine on my LAN, I'd also like the same thing to work from the server side, be able to route a single port on the server (available from machines other than the server itself) through the VPN to the client machine
15:48 < Bushmills> darkdrgn2k: but as it happens, the routes from redirect-gateway are not introduced on client
15:48 < brian> I don't want to overwrite the gateway on the host server
15:48 -!- reiffert [~thomas@mail.reifferscheid.org] has left #openvpn []
15:48 < darkdrgn2k> is the VPN server your default gateway?
15:48 < brian> I want the host to work over my regular WAN like normal
15:48 < bulbous> right now I'm using ssh with port forwarding, I'm hoping that openvpn can replace that.
15:48 < Bushmills> as this is a windows client, i tried to bring the idea of  !winroute  closer, but to no avail.
15:48 < darkdrgn2k> is the VPN server your default gateway on your LAN  or is there a LAN?
15:48 < brian> darkdrgn2k no it's not
15:49 < darkdrgn2k> therefore the VPN has a DEFAULT GATEWAY defined right?
15:49 < Bushmills> darkdrgn2k: that's about when i (intended to) step out
15:49 < darkdrgn2k> when i say VPN i mean the VPN SERVER
15:49 < darkdrgn2k> or rather the SERVER that hosts the VPN
15:49 < brian> darkdrgn2k yes
15:49  * Bushmills plays some shoot'm'up
15:49 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945-15.html#p11896>
15:49 < darkdrgn2k> brian, and its on a LAN
15:50 < brian> no, it's VPS, the IP is a WAN IP....
15:50 < darkdrgn2k> OK
15:50 < darkdrgn2k> so you need to masquarade... 
15:50 < brian> i did
15:50 < darkdrgn2k> cause the internet has no knowledge for your vpn
15:50 < brian> MASQUERADE  all  --  10.8.0.2             anywhere
15:50 < brian> there it is...
15:51 < darkdrgn2k> what is 10.8.0.2 ?
15:51 < brian> the client IP 
15:51 < darkdrgn2k> in a TAP solution
15:51 < brian> no, TUN
15:51 < darkdrgn2k> this is gonna change wtih tUN
15:51 < darkdrgn2k> the 10.8.0.2 is NOT THE CLIETN IP
15:51 < brian> yes it is
15:51 < darkdrgn2k> its porobably 10.8.0.4
15:52 < darkdrgn2k> so if you do an ifconfig on the CLIENT you see 10.8.0.2 as the ipaddress?
15:52 < brian> here is ipconfig on windows
15:52 < brian>    IP Address. . . . . . . . . . . . : 10.8.0.2
15:52 < brian>    Subnet Mask . . . . . . . . . . . : 255.255.255.252
15:52 < darkdrgn2k> whats your server defined as
15:52 < brian> in ifconfig?
15:52 < darkdrgn2k> in you configj
15:52 < brian>           inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
15:52 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Remote host closed the connection]
15:52 < darkdrgn2k> in you configj
15:52 < darkdrgn2k> your openvpn config
15:53 < darkdrgn2k> on the server
15:53 < brian> ifconfig 10.8.0.1 10.8.0.2
15:53 < darkdrgn2k> no
15:53 < darkdrgn2k> like
15:53 < darkdrgn2k> server 10.8.0.0 255.255.255.0
15:53 < brian> I don't have that, it's setup as point-to-point
15:53 < darkdrgn2k> ah
15:53 < darkdrgn2k> so cna you ping 10.8.0.
15:53 < darkdrgn2k> so cna you ping 10.8.0.2
15:53 < brian> yes
15:54 < darkdrgn2k> and you can ping 10.8.0.1 
15:54 < brian> yes
15:54 < darkdrgn2k> from both sides
15:54 < brian> yes
15:54 < darkdrgn2k> good
15:54 < brian> oh wait
15:54 < brian> in TAP I could ping both sides, but I tried to ping 10.8.0.2 and it didn't respond 
15:55 < darkdrgn2k> heh...
15:55 < darkdrgn2k> check your ipconfig again
15:55 < darkdrgn2k> on both side
15:55 < darkdrgn2k> s
15:55 < brian> I see that the netmask is different 
15:55 < brian> on server and in windows
15:55 < darkdrgn2k> yep
15:55 < darkdrgn2k> welcoem to TUN
15:55 < darkdrgn2k> cehck the IPs
15:55 < brian> But the problem is that the netmask can't be 255.255.255.255 on windows
15:56 < darkdrgn2k> no
15:56 < brian> what do you mean check the IPs?
15:56 < darkdrgn2k> you dont WANT it to be 255.255.255.255
15:56 < brian> Okay how do I change it then?
15:56 < darkdrgn2k> what ip do you have on the server and the client when vpn connects
15:56 < brian> the client is 10.8.0.2
15:56 < brian> and the server is 10.8.0.1
15:56 < darkdrgn2k> and netmaksa?
15:56 < darkdrgn2k> x
15:57 < brian> server is 255.255.255.255 and client is 255.255.255.242
15:57 < brian> 252 actually
15:57 < darkdrgn2k> hmm
15:57 < darkdrgn2k> you SURE the client is 10.8.0.2 not .5
15:57 < darkdrgn2k> uhh 4
15:57 < brian> yes
15:58 < darkdrgn2k> hmm i thoguth tuns where always blcoks of 4 or something
15:58 < darkdrgn2k> can 10.8.0.2 ping 10.8.0.1
15:58 < brian> yes
15:59 < brian> but 10.8.0.1 can't ping 10.8.0.2
15:59 < darkdrgn2k> forget about that
15:59 < brian> ok forgotten
15:59 < darkdrgn2k> do this:
15:59 < darkdrgn2k> on your server
15:59 < darkdrgn2k> iptables -t nat -I POSTROUTING  -s 10.8.0.2  -d 0.0.0.0 -j MASQUERADE
15:59 < brian> should I clear the other rule I have?
15:59 < darkdrgn2k> naa
15:59 < brian> ok now what?
16:00 < darkdrgn2k> ping 8.8.8.8 or somethign from the client
16:00 <@vpnHelper> RSS Update - forum: TLS Handshake Failed (w/ and w/out router) <http://forums.openvpn.net/topic8086.html#p11897>
16:00 < brian> it's going through my LAN network, not VPN
16:00 < darkdrgn2k> did you do redirect gateway in yor server config?
16:00 < brian> tcpdump shows no traffic on tun0
16:00 < brian> yes
16:01 -!- Vutral [ss@vutral.net] has joined #openvpn
16:01 < darkdrgn2k> client is windows?
16:01 < brian> yes
16:02 < darkdrgn2k> try
16:02 < darkdrgn2k> route remove 0.0.0.0  10.8.0.1
16:02 < darkdrgn2k> on the windows box
16:02 < darkdrgn2k> sorry
16:02 < darkdrgn2k> route add  0.0.0.0  10.8.0.1
16:02 < darkdrgn2k> route add  0.0.0.0  MASK 0.0.0.0 10.8.0.1
16:02 < darkdrgn2k> sorry that one
16:03 < darkdrgn2k> should send all traffic to 10.8.0.1
16:03 < darkdrgn2k> i would also do
16:03 < darkdrgn2k> route add <<VPNSERVERWAN>> MASK 255.255.255.255 <<yourlandefualtgw>>
16:04 < brian> no it just broke my network
16:04 < brian> when i did that
16:04 < darkdrgn2k> how did it break your network
16:04 < brian> i had to delete the route
16:04 < brian> nothing responded at all
16:04 < darkdrgn2k> you couldnt ping any lan addresseS?
16:05 < brian> i couldn't ping 8.8.8.8
16:05 < darkdrgn2k> right
16:05 < darkdrgn2k> cause it was sending it via the VPN now
16:05 <@vpnHelper> RSS Update - forum: Help: Connected to VPN server but cannot ping other IP's <http://forums.openvpn.net/topic8092.html#p11898>
16:05 < brian> no it wasn't
16:05 < brian> because there was no traffic on tun0 on the VPN
16:05 < darkdrgn2k> do this first: route add <<VPNSERVERWAN>> MASK 255.255.255.255 <<yourlandefualtgw>>
16:05 < darkdrgn2k> then do route add  0.0.0.0  MASK 0.0.0.0 10.8.0.1
16:05 < brian> Ok, there was traffic on the tun0
16:05 < brian> I didn't see it until I deleted the route
16:06 < brian> It's UDP traffic
16:06 < darkdrgn2k> assuming your runnign a udp openvpn
16:06 < brian> darkdrgn2k do the first route where?
16:06 < darkdrgn2k> windows
16:07 < darkdrgn2k>  route add <<VPNSERVERWAN>> MASK 255.255.255.255 <<yourlandefualtgw>> 
16:07 < darkdrgn2k> route add  0.0.0.0  MASK 0.0.0.0 10.8.0.1
16:07 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 260 seconds]
16:09 -!- ndgophone [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
16:09 -!- brian [~brian@unaffiliated/brian] has quit [Disconnected by services]
16:09 -!- ndgophone is now known as brian
16:09 < darkdrgn2k> hmm
16:09 < brian> ok it worked
16:09 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has quit [Changing host]
16:09 -!- brian [~brian@unaffiliated/brian] has joined #openvpn
16:09 < brian> now how do I do it from the guest OS?
16:09 < brian> do I just enable NAT, and then add those routes?
16:09 < darkdrgn2k> guest os?
16:09 < brian> In VMware
16:10 < darkdrgn2k> so you setup vmware on the PC right?
16:10 < brian> yes it's all setup
16:10 < darkdrgn2k> soryr
16:10 < darkdrgn2k> you setup openvpn on the  VMWARE host
16:10 < darkdrgn2k> now you want the guest to use the vpn
16:10 < brian> yes
16:10 < brian> i want to do the routing on the guest
16:10 < darkdrgn2k> createa a new network adapter that either NATS or BRIDGES your tun0
16:11 < darkdrgn2k> sorry no
16:11 < darkdrgn2k> NATS your tun0
16:11 < darkdrgn2k> then assign it to the guest
16:11 < brian> how do I automate the adding of these routes?
16:11 < darkdrgn2k> route -p ....
16:11 < darkdrgn2k> that will make the persistant
16:12 < darkdrgn2k> across reboots and stuff
16:12 < brian> if i use bridge, what do I set the IP of the interface on the virtual machine to?
16:12 < darkdrgn2k> dont bridge..
16:12 < darkdrgn2k> use nat
16:13 < brian> yeah i thought so
16:13 < darkdrgn2k> otherwise you would  have to change netmasks and stuff..
16:15 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Quit: Leaving]
16:18 < brian> so how do I route to 10.8.0.1 from the virtual machine?
16:18 < darkdrgn2k> you dont
16:18 < darkdrgn2k> the virtaulmachine looks for a defualt gateway it fines the host
16:18 < darkdrgn2k> the HOST's defualt gateway is 0.1
16:19 < darkdrgn2k> just nat it and your fine
16:19 < brian> I want that to only work on the virtual machine though
16:20 < brian> I can ping 10.8.0.1 from the virtual machine so it must be possible somehow
16:20 < darkdrgn2k> it should be done by default
16:20 < darkdrgn2k> do a traceroute..
16:20 < darkdrgn2k> it should alreayd go through 10.8.0.1
16:21 < brian> I deleted those routing rules from the host
16:21 < brian> I want them on the guest
16:23 -!- bulbous [~bulbous@121-74-67-89.telstraclear.net] has quit [Read error: Connection timed out]
16:24 -!- bulbous [~bulbous@121-74-67-89.telstraclear.net] has joined #openvpn
16:24 < brian> darkdrgn2k is it possible?
16:30 -!- d-fens_ [~dfs@dslb-088-077-158-235.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
16:40 < darkdrgn2k> brian: no thte guest has no knowledge of that network
16:41 < darkdrgn2k> unless you move the VPN into the guest
16:48 -!- bulbous [~bulbous@121-74-67-89.telstraclear.net] has quit [Ping timeout: 258 seconds]
16:53 < brian> darkdrgn2k guess I will reconfigure using TAP
16:54 < brian> if I bridge will I have to do additional routing?
17:01 -!- bulbous [~bulbous@121-73-185-5.dsl.telstraclear.net] has joined #openvpn
17:01 < brian> i guess i will figure out with the new found knowledge you gave me darkdrgn2k
17:01 < brian> thanks for your help
17:05 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: No route to host]
17:05 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
17:17 <@vpnHelper> RSS Update - forum: Is it possible to connect 3 servers to all talk to each oth? <http://forums.openvpn.net/topic8093.html>
17:23 <@vpnHelper> RSS Update - forum: TLS Handshake Failed (w/ and w/out router) <http://forums.openvpn.net/topic8086.html#p11900>
17:37 < havoc> are there newer/better ways to run openvpn as a non-admin on windows, or is this still the best reference?  http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin.html
17:37 <@vpnHelper> Title: HowTo Run OpenVPN as a non-admin user in Windows (at openvpn.se)
17:38 -!- Guz [~guz@dynamic-adsl-84-223-117-144.clienti.tiscali.it] has joined #openvpn
17:38 < Guz> hi
17:42 < Guz> hi, is there any friend? I have two routers connected by openvpn and router A can ping router B, but router B can't ping router A
17:43 < Guz> !welcome
17:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:44 < Guz> !goal
17:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:46 < Guz> I think this is a route problem, cause router B use the default gateway instead the correct one
17:51 < Guz> can I paste the route table?
17:53 <@vpnHelper> RSS Update - forum: Do You Need All These Certs & Keys? <http://forums.openvpn.net/topic8087.html#p11904> || Is it possible to connect 3 servers to all talk to each oth? <http://forums.openvpn.net/topic8093.html#p11903> || TLS Handshake Failed (w/ and w/out router) <http://forums.openvpn.net/topic8086.html#p11901>
17:56 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
17:57 -!- mirco [~mirco@p5B284EE3.dip.t-dialin.net] has quit [Quit: mirco]
17:58 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 240 seconds]
18:02 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
18:04 -!- Mtn_Bkng_Dave [Mtn_Bkng_D@12.235.163.237] has joined #openvpn
18:09 -!- jeremyn [~jeremyn@c-68-54-85-49.hsd1.md.comcast.net] has joined #openvpn
18:17 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
18:17 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
18:18 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Quit: GOSUB w/o RETURN]
18:20 -!- Flecks [~fleck@85.158.73.148] has joined #openvpn
18:27 -!- jeremyn [~jeremyn@c-68-54-85-49.hsd1.md.comcast.net] has left #openvpn ["Leaving."]
18:31 -!- jeremyn [~jeremyn@unaffiliated/jeremyn] has joined #openvpn
18:35 < jeremyn> total newbie trying to get this set up...i have a windows client/ubuntu server. i have the server running and the client seems to connect without error. goal is to have all traffic routing through the vpn. currently what happens is: 1) web traffic times out, and 2) chat and ssh traffic is not affected. disabling the firewall had no effect. i'm sure there some basic config area i'm missing, any ideas?
18:40 < jeremyn> !welcome
18:40 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:40 < jeremyn> !goal
18:40 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:41 < jeremyn> !redirect
18:41 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
18:41 < jeremyn> !ipforward
18:41 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
18:42 < jeremyn> !linipforward
18:42 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
18:42 < jeremyn> !nat
18:42 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
18:49 < jeremyn> !llinnat
18:49 -!- Guz [~guz@dynamic-adsl-84-223-117-144.clienti.tiscali.it] has quit [Read error: Connection reset by peer]
18:49 < jeremyn> !linnat
18:49 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
18:55 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 276 seconds]
18:56 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
18:57 -!- Guz [~guz@dynamic-adsl-84-223-117-144.clienti.tiscali.it] has joined #openvpn
19:00 -!- jeremyn [~jeremyn@unaffiliated/jeremyn] has quit [Quit: Leaving.]
19:01 -!- jeremyn [~jeremyn@unaffiliated/jeremyn] has joined #openvpn
19:01 -!- Guz [~guz@dynamic-adsl-84-223-117-144.clienti.tiscali.it] has quit [Ping timeout: 252 seconds]
19:02 -!- Guz [~guz@dynamic-adsl-84-223-117-144.clienti.tiscali.it] has joined #openvpn
19:03 -!- jeremyn1 [~jeremyn@li322-143.members.linode.com] has joined #openvpn
19:03 -!- jeremyn1 [~jeremyn@li322-143.members.linode.com] has left #openvpn []
19:05 -!- jeremyn [~jeremyn@unaffiliated/jeremyn] has quit [Disconnected by services]
19:05 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
19:09 -!- Guz [~guz@dynamic-adsl-84-223-117-144.clienti.tiscali.it] has quit [Ping timeout: 252 seconds]
19:13 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 240 seconds]
19:17 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
19:20 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Read error: Operation timed out]
19:21 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:22 -!- Guz [~guz@dynamic-adsl-84-223-117-144.clienti.tiscali.it] has joined #openvpn
19:22 -!- Guz [~guz@dynamic-adsl-84-223-117-144.clienti.tiscali.it] has quit [Client Quit]
19:38 -!- Mtn_Bkng_Dave [Mtn_Bkng_D@12.235.163.237] has quit []
19:53 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:55 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
20:01 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 260 seconds]
20:09 -!- master_of_master [~master_of@p57B559A2.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:10 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
20:11 -!- master_of_master [~master_of@p57B55672.dip.t-dialin.net] has joined #openvpn
21:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 240 seconds]
21:25 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:27 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:30 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has joined #openvpn
21:36 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
21:46 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Read error: Connection reset by peer]
21:46 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
21:49 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
21:52 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Client Quit]
21:55 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
21:57 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:15 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Read error: Connection reset by peer]
22:27 -!- brian [~brian@unaffiliated/brian] has quit [Ping timeout: 264 seconds]
22:28 <@vpnHelper> RSS Update - forum: Not Connecting to Server <http://forums.openvpn.net/topic8079.html#p11905>
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:52 <@vpnHelper> RSS Update - forum: Help: Connected to VPN server but cannot ping other IP's <http://forums.openvpn.net/topic8092.html#p11906>
22:59 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
23:14 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
23:25 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
23:38 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
23:43 -!- bulbous [~bulbous@121-73-185-5.dsl.telstraclear.net] has quit [Ping timeout: 258 seconds]
23:43 -!- bulbous_ [~bulbous@121-74-68-65.telstraclear.net] has joined #openvpn
23:58 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
--- Day changed Wed May 11 2011
00:35 -!- bulbous_ [~bulbous@121-74-68-65.telstraclear.net] has quit [Ping timeout: 258 seconds]
00:38 -!- bulbous [~bulbous@121-73-183-39.dsl.telstraclear.net] has joined #openvpn
00:39 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
00:39 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
00:39 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Remote host closed the connection]
00:57 -!- buddha [~buddha@66.210.116.160] has quit [Read error: Operation timed out]
00:59 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:59 -!- mode/#openvpn [+o mattock] by ChanServ
01:10 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:11 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
01:11 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:13 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:18 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
01:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
01:34 -!- buddha [~buddha@66.210.116.160] has joined #openvpn
01:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:13 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
02:14 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:15 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Client Quit]
02:16 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:19 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:20 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
02:20 -!- mirco_ is now known as mirco
02:20 -!- dazo_afk is now known as dazo
02:57 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
03:00 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
03:04 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
03:05 <@vpnHelper> RSS Update - forum: Help: Connected to VPN server but cannot ping other IP's <http://forums.openvpn.net/topic8092.html#p11907>
03:17 <@vpnHelper> RSS Update - forum: Help: Connected to VPN server but cannot ping other IP's <http://forums.openvpn.net/topic8092.html#p11908>
04:13 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:18 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Quit: Leaving]
04:23 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has quit [Ping timeout: 240 seconds]
04:23 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has joined #openvpn
04:50 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
05:23 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
05:23 <@vpnHelper> RSS Update - forum: UDPv4: Connection reset by peer <http://forums.openvpn.net/topic8094.html>
05:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:27 -!- diemaco [~freenode0@d204-191-182-51.abhsia.telus.net] has quit [Read error: Operation timed out]
05:27 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
06:13 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
06:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Read error: Operation timed out]
06:24 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
06:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:43 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
06:43 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has quit [Changing host]
06:43 -!- brian [~brian@unaffiliated/brian] has joined #openvpn
06:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 252 seconds]
07:00 <@vpnHelper> RSS Update - forum: vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p11910>
07:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
07:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:17 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
07:17 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
07:17 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
07:22 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has joined #openvpn
07:23 -!- mirco [~mirco@p5B285D25.dip.t-dialin.net] has joined #openvpn
07:30 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:30 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:30 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945-15.html#p11911>
08:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: Leaving]
08:05 -!- oc80z [oc80z@blea.ch] has quit [Read error: Connection reset by peer]
08:05 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:08 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:08 -!- Uresu [~Wes@5ace7b8e.bb.sky.com] has joined #openvpn
08:10 < Uresu> Hi all, I have googled my ass off and can't get no results : This is my windows ipconfig AFTER I have connected OK to the VPN > http://pastebin.com/raw.php?i=8u68Xsc7
08:10 < Uresu> I can't ping the default gateway, should I be able to?
08:17 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
08:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
08:18 -!- Cain` is now known as Cain
08:21 -!- mirco [~mirco@p5B285D25.dip.t-dialin.net] has quit [Quit: mirco]
08:27 < Uresu> @.........   <- tumbleweed
08:32 < darkdrgn2k> ok this is driving me nutz
08:32 < darkdrgn2k> http://pastebin.com/cFK8cNyR
08:32 < darkdrgn2k> any ideas?
08:32 < darkdrgn2k> cant get an ip address attached to the tun adapter@!
08:39 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has left #openvpn []
08:41 < ecrist> Uresu: we'd need to see output of netstat -rn as well
08:53 < brian> hi darkdrgn2k
08:53 < darkdrgn2k> high
08:53 < brian> I tried to proxy arp using TAP, but all I managed to do was have any arbitrary ICMP ping request answered :(
08:56 < darkdrgn2k> good you !!!STILL NEED TO ROUTE WITH TAP!!!!
08:57 < brian> darkdrgn2k but the packets are making it to tap0 on the remote host
08:57  * dazo finds some popcorn, leans back and wait for the continuation ... this might be a good one
08:57 < brian> darkdrgn2k I just don't know how to forward them
08:58 <@dazo> brian: firewalls and routing are 99.5% of all issues here ....  that includes also thinking about the return route .... and then enabling ip forward comes next
08:58 < brian> I tried so many different iptables rules
08:58 < brian> none of them worked
08:58  * darkdrgn2k remembers getting TUN working for you yesturday
08:59 < brian> yes I can get TUN working easily, but now I want TAP to work.
08:59 <@dazo> brian: first step ... disable firewall while testing ... get rid of possible issues, and then enable things one by one, and when something breaks, then fix that .... but do small steps
08:59 < darkdrgn2k> *WHY*
08:59 < brian> there is no firewall dazo
09:00 < brian> dazo the closest I came to getting it to work is when I pinged any arbitrary IP address and it replied
09:00 < darkdrgn2k> again WHY with the TAP
09:00 < darkdrgn2k> you dont even have anythign to bridge it with on the other side!!!
09:01 < Bushmills> pass me some popcorn please, dazo
09:01 < brian> I should be able to do IP routing with TAP, just like with TUN...
09:01  * dazo passes a big box of popcorn to Bushmills 
09:01 <@dazo> brian: that's correct
09:01 < darkdrgn2k> brian, !!!YOU HAVE NOTHIGN TO BRIDGE THE DAM INTERFACE WITH!!!
09:01 < darkdrgn2k> so NO IT WILL NEVER WORK
09:01 < brian> dazo Do I have to bridge for TAP to work?
09:02  * darkdrgn2k facepalms
09:02 < darkdrgn2k> they do you think tap is called BRIDGED MODE
09:02 <@dazo> darkdrgn2k: wrong ... TUN and TAP can work similarly ... but if you want to bridge you must use TAP
09:02  * dazo has a network setup with TAP, using routing only
09:02 < darkdrgn2k> dazo: fine but problem still remains.. you must specify an IP address on the WAN in this case
09:03 < brian> dazo does your setup access the internet?
09:03 < darkdrgn2k> dazo, but then WHY use TAP at all?
09:03 <@dazo> brian: yes
09:03 < brian> dazo can you please tell me how you did it? I cannot find anything on the internet about this...
09:03 <@dazo> darkdrgn2k: when I setup that network TAP was the only supported mode in Windows ... it was many years ago
09:03  * darkdrgn2k sits and joins Bushmills with the popcorn
09:03 <@dazo> brian: take your working TUN setup ... and replace tun with tap
09:03 < darkdrgn2k> dazo: so diid brian use a time machine to go back in time?
09:03 <@dazo> that's really it
09:04 < Bushmills> brian: documentation of VPS usually has a chapter on bridge configuration
09:04 < brian> dazo I tried that, didn't work
09:04 < brian> the packets just go to tap0
09:04 <@dazo> darkdrgn2k: don't be so narrow minded .... there's nothing wrong with TAP ... it has more overhead, but that's the only thing 
09:04 < darkdrgn2k> dazo: funnt thing is that he had tun working yesturday but was not happy :)
09:04 < brian> and that's it, there is nothing further....
09:05 < brian> I told you darkdrgn2k, TUN requires that I configure the IP for the interface in openvpn....
09:05 < brian> But I am setting the IP somewhere else
09:05 < brian> So TUN does not work for me, okay?
09:05 -!- Uresu [~Wes@5ace7b8e.bb.sky.com] has quit [Remote host closed the connection]
09:05 < darkdrgn2k> dazo: did that comment make any sense to you at all?
09:06 < darkdrgn2k> brian: tun setup sets an ip address for the tunnle ONLY not your lan
09:06 <@dazo> you can actually setup TUN and TAP tunnels with OpenVPN where the tun/tap devices do not have IP addresses ... and with routing, you get connectivity
09:06 < brian> I have the TAP Interface on Windows, and an interface bridged to it in a virtual machine. I want the virtual machine interface to set the IP address, not the host machine running VMware.
09:07 < brian> This would work, but I am really dumb with networking, and I have no clue how to route the traffic to IPs like 8.8.8.8 from tap0 to the internet.
09:07 <@dazo> brian: try your tun config again please ... if you get the routed stuff to work there ... then change only tun->tap ... really ... and make sure you really don't have any firewalls blocking 
09:07 < brian> dazo But if I use tun, it will complain "ifconfig" is needed for TUN
09:07 < darkdrgn2k> brian, i think what oyu need to do is read some network  books
09:08 < brian> I mean, it's not routing problem on the client. It's routing problem on the server.
09:08 < brian> I don't know how to do the routing server side, okay?
09:08 < brian> I didn't have to do server side routing for TUN
09:08 < brian> I just had to add a NAT entry to iptables
09:09 < brian> And what I am saying is, that is not working for TAP, okay?
09:09 <@dazo> brian: to reach the internet via a tunnel, you need NAT, no matter tun or tap
09:09 < ecrist> were the configs posted at any point?
09:09 < brian> dazo yes I know!
09:09 <@dazo> !configs
09:09 < brian> dazo But it's not working like it does with TUN!
09:09 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
09:09 < darkdrgn2k> dazo: unless you TUN the wan ip :-P
09:09 < ecrist> well, dazo, not if he's using public space on the VPN, which, with IPv6, is a possibility.
09:09 < brian> ok, i will paste configs.
09:10 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
09:10 <@dazo> darkdrgn2k: what are you talking about?
09:10 < darkdrgn2k> dazo. if your Tunnle usses WAN ip addresses.. and you route the whole way :) you dont need nat
09:11 < darkdrgn2k> and like ecrist said.. with ipv6 its more plausable then it ever was :)
09:11 < brian> here are the configs, they are very simple... http://pastie.org/1889083
09:11 < ecrist> well, it's just as plausible with IPv4
09:11 < darkdrgn2k> ecrist: but  more plausable in ipv6
09:12 < darkdrgn2k> i seriously dont understand what this fixation on "setting your opwn ip addres" is.. you setup a tun on the VMWARE host.. create a VMWARE network natted or bridged to the TUN network,...... setup the right routs and go set your ip address in VMWARE
09:12 <@dazo> brian: and can you please send over the output of iptables-save too?
09:12 < brian> I deleted everything from iptables, because it wasn't working anyways.
09:12 < darkdrgn2k> dazo: any idea if there has been any progress on PPPOE and Openvpn on widows 7 not working right?
09:13 <@dazo> brian: well, that's your first mistake ... you need to use NAT to reach the Internet from via your tunnel
09:13 < brian> dazo yes but I'm not trying anymore to write the iptables rules myself
09:13 <@dazo> iptables -t nat -I POSTROUTING -i tap+ -j MASQUERADE
09:13  * darkdrgn2k scrolls up
09:13 < darkdrgn2k> <darkdrgn2k> iptables -t nat -I POSTROUTING  -s 10.8.0.2  -d 0.0.0.0 -j MASQUERADE
09:13 < brian> dazo because I can obviously not do it
09:13 < brian> darkdrgn2k that doesn't work for TAP :(
09:13 < darkdrgn2k> or that :)
09:13 < brian> I already tried it....
09:14 < darkdrgn2k> right.. i was doign tun with him yeaturday
09:14 < darkdrgn2k> had it running 100% :-p
09:14 < brian> you cannot use -i with POSTROUTING
09:14 <@dazo> brian: it might not have worked, because of 10.8.0.2
09:14 <@dazo> ahh my fault
09:14 <@dazo> iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
09:15 < brian> dazo The IP is always going to be 10.8.0.2 though
09:15  * dazo always forgets POSTROUTING only accepts -o and not -i
09:15 <@dazo> brian: ifconfig 10.8.0.1 255.255.255.0  ... that means 10.8.0.0/24
09:15 < ecrist> !iptables
09:15 <@vpnHelper> "iptables" is (#1) o test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT;, or (#2) then run iptables -F, iptables -Z after being SURE policies are set to accept, or (#3) please see http://openvpn.net/man#lbBD for more info, or (#4) see http://www.secure-
09:15 <@vpnHelper> computing.net/wiki/index.php/OpenVPN/Firewall
09:15  * ecrist reminds dazo of vpnHelper
09:15 < ecrist> ;)
09:15 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
09:15 < brian> dazo 255.255.255.0 is the broadcast i thought....
09:15 <@dazo> brian: if your tun setup said ifconfig 10.8.0.1 10.8.0.2 ... then yes, 10.8.0.2 would be the appropriate
09:16 <@dazo> brian: no, that's the network mask
09:16 < brian> I mean mask
09:16 < brian> ok
09:16 <@dazo> and /24 == 255.255.255.0
09:16 < brian> so after i add that iptables rule, then what?
09:16 < brian> I should try to see if it works?
09:16 <@dazo> but if it pleases you ... you can use 10.8.0.0/255.255.255.0 with iptables too
09:16 < darkdrgn2k> Bushmills: how come people jumop throguh hoops for a  newbie like that but somethign liek this windows 7 vpn issue i get no help what so over LOL
09:17 < brian> Because I think the issue is that, we are missing a step....
09:17 < brian> And I have been trying to find what step I am missing, but I can't find it despite my best efforts of searching
09:17 <@dazo> brian: then you should make sure you have a proper route on your client ... you don't have --route-gateway and --redirect-gateway in your client config
09:17 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
09:17 < brian> dazo The traffic is already going to tap0, I see it on tcpdump, so that means the routing is correct doesn't it?
09:18 <@dazo> brian: I don't assume anything until I see the output of 'route -n'
09:18 < pwrcycle> vpnHelper's link: computing.net/wiki/index.php/OpenVPN/Firewall has rotted away. "File not found"
09:18 < brian> dazo It's the only interface on the virtual machine, so everything routes over it.
09:18 <@dazo> ecrist: yeah, I'm not here often enough to catch up on all the goodies vpnHelper have saved nowadays :)
09:19 <@dazo> brian: I lost you now 
09:19 < brian> If I do ping 8.8.8.8 on the virtual machine, in tcpdump I see the ICMP echo request to 8.8.8.8.
09:19 <@dazo> brian: that didn't make much sense either 
09:19 < brian> But I do not know how to forward those packets so that they arrive at 8.8.8.8 serverside
09:19 <@dazo> because you don't tell me which interface you see that traffic on
09:20 <@dazo> if you use a VPN tunnel, you should not see the traffic of 8.8.8.8 on any other devices than the tun/tap device
09:20 < darkdrgn2k> brian,  did you ever try iptables -L -v -n 
09:20 < brian> yes, the packet count for the NAT rule says 0
09:20 <@dazo> that's one big bummer
09:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:20 < brian> dazo I do see them on the tap0 device
09:21 <@dazo> exactly
09:21 < brian> dazo But I want the request to 8.8.8.8 to make it to eth0!
09:21 <@dazo> and why do you think this happens?
09:21 <@dazo> brian: I am confused 
09:21 < brian> dazo Because TAP is virtual ethernet device, and all the packets are sent to the VPN.
09:21 <@dazo> if you want 8.8.8.8 to make it to eth0 ... why mess with OpenVPN to start with?
09:21 < brian> dazo 8.8.8.8 is an example
09:22 < brian> dazo I want all the internet traffic to work over the VPN
09:22 <@dazo> !tcpip
09:22 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
09:22 <@dazo> brian: ^^^  go read that one and come back when you have a better overview
09:22 < brian> I think you are confused...
09:22 < darkdrgn2k> brian, : i think you are confused
09:22 <@dazo> yeah, because your descriptions are not making sense
09:23 < brian> The virtual machine is running XP, and the VPN is running on a remote host. eth0 I am referring to is on the remote host side, not local, okay?
09:23 < darkdrgn2k> dazo: he wants the virutal machine to use the WAN ohe openvpn server..
09:23  * dazo goes *puff*
09:23 < brian> i want to proxy the arp packets from tap0 to eth0
09:23 < pwrcycle> brian: have you done this: "echo 1 > /proc/sys/net/ipv4/ip_forward"
09:23 < brian> and vice versa
09:23 < brian> yes it's on
09:24 < darkdrgn2k> brian, why do you want to proxy the arp packets from tap0 to eth0?
09:24 <@dazo> brian: don't even think about proxying arp packets unless you know what you're talking about .... such topics are for experts
09:24 < darkdrgn2k> LOL  i bet he doesnt eve know what that really MEANS
09:24 < brian> I don't care how it works as long as it works
09:25 < darkdrgn2k> brian: yesturday it worked
09:25 < brian> Yes, with tun, but I need it to work with tap
09:25 < darkdrgn2k> brian: fine but WHY must it work with tap
09:25 < brian> I also have proxy_arp on....
09:26 < darkdrgn2k> what does TAP do that TUN cant?
09:26 < brian> I already told you
09:26 < darkdrgn2k> no you didnt
09:26 < darkdrgn2k> what does TAP do that TUN cant?
09:26 < pwrcycle> brian: you'll need 2 lines for sure in iptables
09:26 < pwrcycle> -A POSTROUTING -o venet0 -j SNAT --to-source 78.19.21.14
09:26 < pwrcycle> and: -A INPUT -i tun+ -j ACCEPT
09:26 < pwrcycle> replace 78.19.21.14 with your external IP and you should be up.
09:27 < pwrcycle> set the POSTROUTING to your extenral ip and accept everything form the tun interface, and you're up.
09:27 < brian> pwrcycle shouldn't the first rule be in the NAT table?
09:27 < pwrcycle> brian: yes
09:27 < brian> pwrcycle what about second rule?
09:28 < darkdrgn2k> what does TAP do that TUN cant?
09:28 < darkdrgn2k> (for you anyway)
09:28 <@dazo> brian: what does TAP do that TUN cant?
09:28 < pwrcycle> brian: in my *filter table  
09:28  * dazo wants to hear that as well
09:28 < pwrcycle> brian: you might need there also:  ":FORWARD ACCEPT [0:0]"
09:29 < brian> hmmm, that rule looks dangerous 
09:29 < pwrcycle> it's in the help text somewhere but i can't find it now
09:30 < pwrcycle> brian: mitigating risk comes after getting it working :)
09:30 < darkdrgn2k> what does TAP do for you  that TUN cant?
09:30 < brian> pwrcycle how do I put that last rule?
09:30 < pwrcycle> darkdrgn2k: TAP works like a Bridge. TUN works like an interface.
09:30 <@dazo> iptables -P FORWARD ACCEPT
09:31 < darkdrgn2k> pwrcycle, i know that.. but my question remains
09:31 <@dazo> pwrcycle: now, that's a poor definition
09:31 < darkdrgn2k> WHY does he need tap
09:31 < darkdrgn2k> especially since hes not bridging anything
09:31 < pwrcycle> brian: this is in my *filter ":FORWARD ACCEPT [0:0]"
09:31 < pwrcycle> darkdrgn2k: a Bridge can be a bridge of multiple Interfaces
09:32 <@dazo> pwrcycle: TAP is also an interface ... but TAP works on ethernet frames, TUN works on IP frames
09:32 < pwrcycle> darkdrgn2k: a Bridge is lower in the networking stack. using the TUN as an interface makes it all handled in Routing.
09:32 < brian> i don't understand why people think you need to be bridging to use TAP
09:32 <@dazo> hence why you need TAP to do bridging
09:32 <@dazo> brian: we don't say that ... but we say you need TAP if you want to do bridging ... that's not the same to say you need bridge to use TAP
09:33 < pwrcycle> darkdrgn2k: dazo is right. if you really want your computers to think their on a LAN but really on a Bridge, and NOT use Routing, a Bridge would be your tool.
09:33 < brian> anyways, I have no clue how to add that last rule....
09:33 <@dazo> brian: iptables -P FORWARD ACCEPT
09:33 < brian> That didn't add anything
09:33 <@dazo> no, but it set the policy of your FORWARD chain to ACCEPT
09:34 < brian> it was already set to that
09:34 < pwrcycle> brian: cool, you should be routing via ipatables now.
09:34 < brian> I am afraid not
09:34 <@dazo> good, that line which pwrcycle wanted you to run would just make sure you had that set correctly
09:35 < brian> I'm still only getting the packets on tap0, and no forwarding is occurring
09:35 <@dazo> brian: give pwrcycle a shell login to your boxes  .... I'm sure he'll fix it in a short time
09:36 <@dazo> it must be something which is wrong ... what it is, is impossible to say for us here now
09:36 < brian> I don't disagree with that, obviously there is something missing
09:38 < brian> I am going to modify the kernel, i'll be back...
09:40 <@dazo> "Ouch, my tire is flat.  I should probably change the oil"
09:40 < brian> Okay that didn't change anything
09:41 < brian> The person who runs this VPS said I should downgrade the kernel if I want to do NAT....
09:41 < brian> so I tried it to see if that was the issue
09:41 <@dazo> brian: may I have just one clear answer from one direct question?
09:41 < brian> ok dazo
09:41 <@dazo> brian: What is it TAP gives you which TUN does not solve for you?
09:41 < brian> I have OpenVPN GUI running and VMware running, okay?
09:41 < brian> I don't want OpenVPN to run in the virtual machine
09:42 < brian> And I don't want my normal internet traffic of my main machine to be interrupted
09:42 <@dazo> that doesn't make sense ... you can achieve the same by running OpenVPN outside the VMware 
09:42 <@dazo> with TUN
09:42 < darkdrgn2k> pwrcycle, yes thats alll well and good an i udnerstand the technical ramifications of it... but brain has not told me why HE needs a tap....
09:42 < brian> dazo with TUN I have to use NAT
09:42 < darkdrgn2k> daz: hes confusing openVPN networking with VMWARE networking
09:43 < darkdrgn2k> brain: YOU HAVE TO NAT NO MATTER WHAT!!!
09:43 < darkdrgn2k> there it rymed... memorize it
09:43 < brian> darkdrgn2k no with TAP I can bridge to the VPN Interface, and set the IP within the virtual machine
09:43 < brian> I cannot do that with TAP
09:43 < darkdrgn2k> brain: no you cant!
09:43 < brian> I mean TUN
09:43 < pwrcycle> brian: darkdrgn2k is right. NAT is part of iptables.
09:43 < darkdrgn2k> brain: and yes you can
09:43 -!- mirco [~mirco@p5B285D25.dip.t-dialin.net] has joined #openvpn
09:43 < darkdrgn2k> brain: first of all whast your netmaks in the client?
09:44 < brian> I mean NAT within the VMware...
09:44 < darkdrgn2k> brain: second of all ... no you dont.. 
09:44 < brian> I don't want to use that method of VMware networking, I want to bridge with the VPN interface
09:44 < darkdrgn2k> brian, : bridge it with what?
09:44 < darkdrgn2k> brian, : bridge what with what reather
09:44 < brian> the windows TAP device
09:44 < darkdrgn2k> with?
09:45 < brian> it works, I get connectivity to the VPN, I just need to route the traffic server side now.
09:45 < pwrcycle> brian: i think the consences is you don't need a TAP bridge.
09:45 < darkdrgn2k> you jus tneed to route your traffic right with tun
09:45 < brian> well tell me how I do this with TUN, and I'll do it, because this is driving me as crazy as it is you guys
09:45 < pwrcycle> brian: you're just steps away from getting your routing working, and you want to overly complicate it with a TAP.
09:46 < pwrcycle> brian: make sure you're clients have the route in their conf or are getting it PUSH to them via DHCP.
09:46 < brian> remember, I don't want to modify the routing table of my the host machine that the VM is running on!
09:46 < pwrcycle> brian: manually set it in their client configs for now to check.
09:46 < darkdrgn2k> brian, : you dont have to.
09:46 < darkdrgn2k> brian, : just configure your VMWARE SERVER network correctly
09:46 < brian> I want the routing all done in the VM
09:46 < darkdrgn2k> brian, : just configure your VMWARE SERVER network correctly
09:46 < brian> I'm not using VMware Server, I'm using Workstation...
09:46 < darkdrgn2k> ok then
09:46 < darkdrgn2k> brian, : just configure your VMWARE workstation  correctly
09:46 < darkdrgn2k> and stop pirating..
09:46 < darkdrgn2k> vmware server is free
09:47 < brian> Why do you assume that I pirated it?
09:47 < darkdrgn2k> cause your level of expertiese does not justify spending that kind of money
09:47 < darkdrgn2k> .. just a hunch...
09:47 < pwrcycle> brian: i think he assumes you're a pirate, because you're not a ninja :)
09:48 < brian> I have to be network admin expert to buy VMware?
09:48 < brian> wow, that is amazing
09:48 < darkdrgn2k> brian, dont need to be a network admin expert to even understand simple routing
09:48 < brian> well I'm not a network admin at all okay?
09:48 < darkdrgn2k> or what the diff between tap and tun is :)
09:48 <@dazo> basically, anything which requires more computers to talk together over a network, requires a minimum of networking knowledge .... pity, but that's the real world
09:48 < brian> I'm just trying to setup a VPN for myself to use
09:48 < darkdrgn2k> nor am i:-p im a developer
09:48 < brian> And I've never done it before
09:48 < brian> So I'm sorry
09:49 < brian> So how do I do this with TUN?
09:49 < darkdrgn2k> anyway forget that herring
09:49 < brian> Because I tried, and I couldn't get it to work at all
09:49 < darkdrgn2k> setup your vmware workstation network to use the TUN device ... eitehr NATed stup or local host setup
09:49 < brian> You can only set it to use the TUN device bridged 
09:50 < darkdrgn2k> no.. 
09:50 < darkdrgn2k> go into your network configurator
09:50 < brian> You cannot NAT a specific device
09:50 < darkdrgn2k> YES YOU CAN
09:50 < darkdrgn2k> but you have to configure the network first 
09:50 < darkdrgn2k> hold on
09:50 < darkdrgn2k> let me find my computer
09:50 <@dazo> brian: iptables -t nat -s <internal network> -j MASQUERADE     <<<--- THIS IS A NAT RULE
09:51 < brian> dazo I am talking about VMware, I am not as stupid as you think!
09:51 <@dazo> it tells to iptables to MASQUERADE all traffic coming from <internal network> 
09:52 < darkdrgn2k> brian, in your VMWARE folder under start there is a"virtual network editor application"
09:52 < brian> yes I know, I've used it
09:52 < darkdrgn2k> there you configure the networks available to VMWARE WORKSTATION
09:52 < brian> There is no way to NAT to a specific network interface.
09:52 < darkdrgn2k> in that application you can create a HOST-ONLY, NAT or BRIDGE setup
09:52 < brian> You can only bridge to a specific interface.
09:52 < darkdrgn2k> you dont need to nat a specific interfce together..
09:52 < brian> That's where you're wrong, I do.
09:53 < brian> I need to only use the VPN network for the VMware machine.
09:53 < darkdrgn2k> NO you dont..
09:53 < darkdrgn2k> i think what you need is  source routing thought..
09:53 < darkdrgn2k> what you dont understand is your VMWARE host is a ROUTER
09:54 < darkdrgn2k> bridgeing the connection to yoru TUN will give you the same issue anyway
09:54 < darkdrgn2k> *tap
09:54 < darkdrgn2k> you still need to ROUTE
09:55 < darkdrgn2k> what you need is a "source route" to say all traffic from X goes over Y
09:55 < brian> okay, and it seems really complex to setup to me, versus just bridging the tap 
09:55 < darkdrgn2k> brian, no because if you bridge.. you still have a problem of routing
09:55 < darkdrgn2k> brian, thats what your not udnerstanding
09:55 < brian> ok so how do I do this?
09:55 < darkdrgn2k> you DONT WANT a default route for the router.. you want a defauilt route ONLY FOR THE VMWARE
09:56 < darkdrgn2k> "In computer networking, source routing allows a sender of a packet to partially or completely specify the route the packet takes through the network. In contrast, in non-source routing protocols, routers in the network determine the path based on the packet's destination.
09:56 < darkdrgn2k> "
09:56 < darkdrgn2k> in normal routeing the router doesnt care where the packet comes from just where it wants to go
09:56 < darkdrgn2k> so doenst matter if you bridge, nat or host only.. it follows the routers (in this case your vmware host's) routing table
09:57 < darkdrgn2k> and default routes mean "ANYWHERE" so you either send all you packets over X or over Y regardless of WHERE ITS COMMING FROM
09:57 < darkdrgn2k> with SOURCE ROUTING you can determent WHERE ITS COMMING FROM and create rules based on that
09:57 < brian> Wed May 11 07:36:26 2011 Linux ip addr del failed: could not execute external program
09:58 < brian> ok i'm on TUN now...
09:59 < darkdrgn2k> still have the problem of source routing
09:59 < darkdrgn2k> i dont know if XP can do it
09:59 -!- fred89cu [~ferar@64.254.252.178] has joined #openvpn
10:02 < darkdrgn2k> im lookign but im not finding anything to do with xp and source routing
10:02 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:02 < darkdrgn2k> brian, : the problem is that no matter if you tap or tun.. the VMWARE's gateway is set to your VMWARE host.... the VMWARE host's dfault gateway is going to be out your WAN or your TUNNLE.. not both.. 
10:03 < brian> i have an idea...
10:03 < darkdrgn2k> and the HOST can only route based on DESTINATION.. so your SOL there
10:04 < fred89cu> hi, reading through the openvpn docs, there is this option "--shaper n" which also includes the following note: Also note that for low bandwidth tunnels (under 1000 bytes per second), you should probably use lower MTU values as well, what is the best way to set the latter?
10:04 < darkdrgn2k> !mtu
10:04 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
10:05 <@dazo> fred89cu: you're aware of that --shaper only hits outgoing traffic from the local OpenVPN instance?
10:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:06 < fred89cu> dazo: meaning local client only or could be set on both client/server sides?
10:06 < darkdrgn2k> brian, if you had another device on your network that did the VPN tunnle (even if it was virtual) you can bridge your connetion and inside VMWARE guest point the default gateway to the new device...
10:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:06 < darkdrgn2k> brian, that way yuo ca set that new device's default gateway over the VPN tunnle... so only comptuer with that gateway ip would go through the tunnle
10:06 <@dazo> fred89cu: if you set it on the server, it will only hit traffic going out from the server - and it will limit the traffic of all clients (even the sum of all traffic, iirc)
10:07 <@dazo> fred89cu: on clients, it will only limit the VPN traffic out of the client 
10:07 <@dazo> fred89cu: for proper bandwidth limitations, you'd better use tools which the server OS supports directly
10:08 < darkdrgn2k> i will point out that for badwith limitation you can really onlt limit outgoing traffic effectivly..
10:08 < fred89cu> dazo: both server and lcients are linux
10:08 < darkdrgn2k> sorry never mind
10:08 < darkdrgn2k> im thinkg oif QOS
10:09 < fred89cu> dazo: u mean tc based shaping?
10:09 <@dazo> fred89cu: I'd probably recommend to look at 'tc' and configuring that in your server then
10:09 <@dazo> fred89cu: yeah, exactly
10:09 < ecrist> dazo: !factoids
10:09 < fred89cu> dazo: cheers
10:09 <@dazo> ecrist: details!
10:09 <@dazo> fred89cu: you're welcome!
10:10 < ecrist> !factoids
10:10 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:10 < ecrist> ;)
10:10 <@dazo> ecrist: I know :)  still, details!
10:10 < ecrist> I'm a bastard, I know.
10:10 < darkdrgn2k> !xy
10:10 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
10:10 < darkdrgn2k> Nice... gatta remember that
10:10 < brian> okay
10:11 < brian> if I use a vmware private network
10:11 < brian> is there a way I can route it so the vmware private network is answered by the VPN?
10:11 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Quit: Leaving]
10:11 < darkdrgn2k> yes... but not ONLY the vmware private network
10:11 < brian> why not?
10:11 < darkdrgn2k> you can only do destination routing ( cant find any info on source routing with xp)
10:12 < darkdrgn2k> so you can forward a packet  based on its destination not its source
10:12 < darkdrgn2k> (again problem exists regardless of TUN or TAP)
10:13 < darkdrgn2k> what you need is a nother device running openvpn ... and then point your guyst at that device as the default
10:13 < darkdrgn2k> also i will point out that you may need to turn on IP routing in windows XP
10:13 < brian> darkdrgn2k http://www.windowsnetworking.com/articles_tutorials/w2kprout.html
10:13 <@vpnHelper> Title: Windows 2000 / XP Professional TCP/IP Routing (at www.windowsnetworking.com)
10:13 < darkdrgn2k> iirc
10:13 < brian> darkdrgn2k looks like you can enable it in XP?
10:14 < brian> when it comes to windows networking, i know pretty much nothing :S
10:14 < darkdrgn2k> brian, : yes thats ROUTING (as per my last comment)
10:14 < darkdrgn2k> not SOURCE ROUTING
10:14 < darkdrgn2k> actuialy not even
10:14 < darkdrgn2k> its the same thing as the echo 1 >... in linux
10:14 < darkdrgn2k> still not source routing
10:15 < darkdrgn2k> im telling you
10:15 < darkdrgn2k> go download pfsense....
10:15 < darkdrgn2k> install it in a VMWARE 
10:15 < darkdrgn2k> nice web gui to openvpn and everythign
10:15 < darkdrgn2k> then point your VMWARE guest to that as the gateway
10:16 < darkdrgn2k> once you do that you can even bridge all the conenctions together
10:17 < brian> wow this is getting crazy
10:17 < darkdrgn2k> but as long as the VMWARE guest is pointing at the pfsense as the default gateway it will all work
10:17 < darkdrgn2k> brian, : welcopme to NETWORKING
10:19 < brian> darkdrgn2k I think that solution will work, because the host-only network of VMware is shared by all virtual machines....
10:19 < darkdrgn2k> brian, : wont even matter if tis routerd.. 
10:19 -!- fred89cu [~ferar@64.254.252.178] has quit [Quit: Leaving]
10:25 < darkdrgn2k> brian, : i once had 3 internet providers on the same network... the default when to the DSL and i setuop anotehr computer to go via cable ...
10:25 < darkdrgn2k> so if its bridged you can take ANY comptuer on the network point it at the new gateway and bobs your uncle your good togo
10:27 < brian> darkdrgn2k I don't know what network interfaces to use for pfSense
10:27 < darkdrgn2k> doenst really matter...
10:27 < darkdrgn2k> give the vmware 2 interfaces
10:29 < darkdrgn2k> the lan will be the bridge one
10:29 < darkdrgn2k> you cna do nat for the wan doesnt matter
10:29 < darkdrgn2k> OR if you want
10:30 < darkdrgn2k> HOST ONLY for LAN
10:30 < darkdrgn2k> and BRIDGE for WAN
10:30 < darkdrgn2k> that makes more sence if you want to be secured
10:34 -!- dazo is now known as dazo_afk
10:38 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
10:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:40 <@vpnHelper> RSS Update - forum: Guidance needed on windows setup please <http://forums.openvpn.net/topic8043.html#p11912>
10:47 <@vpnHelper> RSS Update - forum: How can I check that the VPN is secure? <http://forums.openvpn.net/topic8095.html>
10:50 -!- gob_bluth [~chatzilla@office.languagejobsoffice.com] has joined #openvpn
10:51 < gob_bluth> hi, i'm having issues with routing on a OpenVPN server with dual nics, each going to two sepreate networks
10:52 < gob_bluth> eth0: 192.168.1.0/24, eth1: 192.168.2.0/24, the openvpn server is listening on both, it connects from the win client fine, but it can't ping 192.168.1.0 when i have a client machine on 192.168.2.0/24
10:54 < gob_bluth> !goal
10:54 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
10:59 <@vpnHelper> RSS Update - forum: Configuration Question related to WAN address? <http://forums.openvpn.net/topic8096.html>
11:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:20 -!- gob_bluth [~chatzilla@office.languagejobsoffice.com] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
11:21 < brian> darkdrgn2k I can't get pfSense to connect to the VPN properly
11:22 < dvl> wow, I just did a backup, over wireless, via VPN. Rate: 1081.8 KB/s  - 2.562 GB  - 39 mins 29 secs  <== I'm happy with that.
11:22 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic8097.html>
11:22 < darkdrgn2k> brian,  cant help if you i dont know what "properly" means also i would check with #pfsense
11:25 < brian> darkdrgn2k when I use pfSense to connect, I cannot ping 10.8.0.1 or 10.8.0.2
11:26 < darkdrgn2k> from where to where
11:27 < darkdrgn2k> and did you add firewall rules to allow it
11:27 < darkdrgn2k> create fire walls from anywhere to anywhere
11:30 < brian> darkdrgn2k it's already set like that by default
11:35 < darkdrgn2k> is ther traffic on the tunnle
11:37 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 248 seconds]
11:45  * ecrist waves at dvl
11:46 -!- cpm [~Chip@c-98-235-72-12.hsd1.pa.comcast.net] has joined #openvpn
11:46 -!- cpm [~Chip@c-98-235-72-12.hsd1.pa.comcast.net] has quit [Changing host]
11:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
11:49 -!- Vutral [ss@vutral.net] has joined #openvpn
11:56 -!- Carbon_Monoxide [~cmonxide@014198183063.ctinets.com] has quit [Quit: Leaving]
12:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
12:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
12:19 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
12:19 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Client Quit]
12:24 < ecrist> !howto
12:24 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
12:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
13:17 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
13:17 -!- cpm [~Chip@c-98-235-72-12.hsd1.pa.comcast.net] has joined #openvpn
13:17 -!- cpm [~Chip@c-98-235-72-12.hsd1.pa.comcast.net] has quit [Changing host]
13:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
13:20 -!- bulbous [~bulbous@121-73-183-39.dsl.telstraclear.net] has quit [Remote host closed the connection]
13:20 -!- bulbous [~bulbous@121-73-183-39.dsl.telstraclear.net] has joined #openvpn
13:48 -!- richtj99 [ad44839d@gateway/web/freenode/ip.173.68.131.157] has joined #openvpn
13:49 < richtj99> Hi, I am trying to figure out if my VPN is setup properly.  I had thought when I logged into my VPN, that my public Ip address would change from my remote location IP, to the my SOHO where my VPN server is located.  That does not seem to be the case.  
13:55 < Bushmills> richtj99: you get an additional interface with an ip address in the openvpn subnet range
13:56 < Bushmills> two machines having the same ip address (server address, and client having the same address then) wouldn't make a lot of sense 
14:02 < dvl> ecrist:  wtf are you?
14:03 < ecrist> fat dude, in the back, the noisy one. ;)
14:03 < dvl> ecrist:  wave
14:05 < richtj99> Bushmills - Sorry I am pretty new at this.  I followed this guide:  http://www.serverwatch.com/tutorials/article.php/3892906/Setting-Up-OpenVPN-on-a-DD-WRT-Router-Part-1 & I do have it working.  My VPN does work, I do get an ip address within my SOHO lan.  I just expected that when I browse the web it would look to the outside world that my IP is the WAN on the SOHO.
14:05 -!- Yen [~Yen@unaffiliated/yen] has joined #openvpn
14:05 <@vpnHelper> Title: Setting Up OpenVPN on a DD-WRT Router, Part 1 ServerWatch.com (at www.serverwatch.com)
14:06 < Bushmills> !howto
14:06 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:06 < Bushmills> !redirect
14:06 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:07 < Bushmills> or, use a web proxy on openvpn server, tell web browser to use that proxy 
14:11 < brian> If I somehow manage to bridge using tap0, will I have to do any routing?
14:15 < richtj99> Thats whats wierd.
14:16 < richtj99> I added the redirect-gateway def1 & route-gateway 192.168.1.1 & it didnt change
14:16 < richtj99> Added it to the client.conf (using windows)
14:17 < richtj99> !security
14:17 <@vpnHelper> "security" is "secure" is (#1) http://openvpn.net/howto.html#security for hardening, or (#2) http://openvpn.net/index.php/documentation/security-overview.html for security overview
14:19 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 248 seconds]
14:22 <@vpnHelper> RSS Update - forum: dynamic IP <http://forums.openvpn.net/topic8097.html#p11916>
14:27 < Bushmills> richtj99: what do you use route-gateway for?
14:50 -!- bulbous_ [~bulbous@203.97.147.47] has joined #openvpn
14:52 < richtj99> Bushmills - I am not sure, someone said to add that to my client.conf - http://www.dd-wrt.com/phpBB2/viewtopic.php?p=607626#607626
14:52 -!- doobeh [~quassel@b33f.net] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
14:52 < richtj99> I was told its more secure to have all traffic routed through the VPN.  I sometimes use CCTV cameras, or work on spreadsheets via VPN.  
14:53 -!- bulbous [~bulbous@121-73-183-39.dsl.telstraclear.net] has quit [Ping timeout: 258 seconds]
14:53 -!- bulbous_ is now known as bulbous
14:53 < richtj99> I understand it will be slower but I think thats ok if it is more secure.
14:56 < Bushmills> richtj99: for redirect-gateway, you want your openvpn server become the gateway
14:56 < Bushmills> !howto
14:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:56 < Bushmills> the official docs may be preferable
14:57 < Bushmills> !redirect
14:57 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:57 < Bushmills> that tells how
15:00 < Bushmills> more secure is only the connection between openvpn client and openvpn server. if your router is server, and your client connected to it from your LAN, all you do is increase security on your LAN
15:09 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
15:14 < richtj99> Bushmills, so are you saying it is probably just as secure not redirecting as redirecting all traffic on the vpn? 
15:15 < Bushmills> if your router is your gateway to internet, there's no added security towards internet there.
15:16 < Bushmills> whether your client talks to router over openvpn, or over ethernet, doesn't make much difference
15:16 < Bushmills> for securing a WLAN connection between client and router, openvpn makes sense
15:17 -!- Ramblurr is now known as Wadsworth
15:18 < richtj99> So being that my router is my gateway, are you saying that my whole setup with DD-WRT is not secured?  
15:18 < Bushmills> the link between openvpn client and openvpn server is secured
15:19 < Bushmills> (provided traffic actually goes through openvpn)
15:19 < richtj99> Would the redirect of flowing everything through the redirect be more secure?  
15:20 < richtj99> How do I tell if my traffic is going through openVPN?  Is there a method of testing?  
15:20 < Bushmills> traceroute, mtr
15:21 < Bushmills> or look at routing table of client
15:21 < richtj99> Sorry for asking to be spoonfed, but how to i check the routing table in Win7?  
15:21  * Bushmills googles that funny term "win7"
15:22 < richtj99> Lol
15:22 < richtj99> sorry
15:24 < richtj99> OK, I got the how to on that.  What should it look like?  1 external & the rest internal?
15:25 -!- Wadsworth is now known as Ramblurr
15:28 < richtj99> I lost you at win7 :)
15:29 < richtj99> Well the MTR for the network destination shows all internal aside from my external IP of my WAN.  Does that mean its all secured via VPN?
15:29 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:29 -!- bulbous_ [~bulbous@203.97.147.47] has joined #openvpn
15:30 < richtj99> !def1
15:30 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
15:33 -!- bulbous [~bulbous@203.97.147.47] has quit [Ping timeout: 258 seconds]
15:33 -!- bulbous_ is now known as bulbous
15:48 <@vpnHelper> RSS Update - forum: windows 7 client bridging. <http://forums.openvpn.net/topic8045.html#p11917>
15:49 -!- Champi [Champi@rootshell.fr] has joined #openvpn
15:54 <@vpnHelper> RSS Update - forum: Source Code For Access Server? <http://forums.openvpn.net/topic8098.html>
15:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 240 seconds]
16:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:29 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Quit: Leaving]
16:34 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
16:36 <@vpnHelper> RSS Update - forum: Network Busy/Read Only Documents <http://forums.openvpn.net/topic8099.html>
16:38 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
16:38 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Client Quit]
16:39 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
16:53 -!- kiwi_ [~kiwi_@ns204836.ovh.net] has joined #openvpn
16:53 < kiwi_> hello
16:56 < kiwi_> i'd like do redundancy between 2 openvpn clients, from the server point of view, one client being the master until it breaks and the other one becomes the master. anyone has leads on that subject ?
16:59 < kiwi_> they could share the same ip address: the "master" client could have it, until it fails and the other client gets it
17:03 < kiwi_> but when i try to change the ip of a client, the server do not want to receive packets from it anymore (MULTI: bad source address from client [192.168.69.1], packet dropped)
17:04 < kiwi_> i tried things like adding iroutes to the client ccd dir but i did not succeed
17:05 < kiwi_> and anyway i'm not sure that changing the ip address of the client to the address of another old client would get me it's traffic
17:05 < kiwi_> some kind of CARP (http://www.openbsd.org/cgi-bin/man.cgi?query=carp) is my goal
17:05 <@vpnHelper> Title: Manual Pages: carp (at www.openbsd.org)
17:06 < kiwi_> :D
17:07 < kiwi_> vpnHelper: did you manage to get that working over OpenVPN ? like with using a layer 2 vpn ?
17:07 < kiwi_> cause CARP would need arp from what i know
17:21 -!- fhashmi [~fh@63.139.37.2] has joined #openvpn
17:21 < fhashmi> hello room
17:22 < fhashmi> i have been trying out openvpn for about a month now
17:22 < fhashmi> and i must say its pretty damn good
17:23 < fhashmi> i have been stuck on few things
17:23 < fhashmi> and i hope someone here can answer them
17:24 < fhashmi> i have 4 networks attached to openvpn, and is there a way i can specify who can connect to which tunnel ???
17:25 < fhashmi> in cisco asa i can specify different tunnel groups to different users
17:26 < fhashmi> but how do i do something like that in OpenVpn ????
17:29 -!- Milenco [~notspam@D978089C.cm-3-1a.dynamic.ziggo.nl] has quit []
17:29 < krzie> firewall
17:30 < krzie> !dazo
17:30 <@vpnHelper> "dazo" is "eurephia" is http://www.eurephia.net/
17:30 < fhashmi> yes, i have read that
17:30 < fhashmi> but
17:30 < krzie> thats an addon that i think can help in that
17:31 < fhashmi> but how do i tell openvpen, to assign different ip range to user
17:31 < fhashmi> by the way i am using OpenVpn on Vayatta
17:31 < krzie> why would it assign a different ip *range* to a user?
17:31 < krzie> i dunno wtf vayatta is ;]
17:32 < krzie> is it some web based config?
17:32 < fhashmi> www.vayatta.org
17:32 < krzie> or do you have raw access to your configs?
17:33 < krzie> saw it, dont understand why it matters
17:33 < krzie> [18:33]  <krzie> is it some web based config?
17:33 < krzie> [18:33]  <krzie> or do you have raw access to your configs?
17:33 < fhashmi> yes i do
17:33 < fhashmi> http://pastebin.com/K8jcWxpu  <<<< logs
17:33 < fhashmi> http://pastebin.com/K8jcWxpu  <<<< configs
17:34 < fhashmi> 1st one is a mistake
17:34 < krzie> umm
17:34 < krzie> weird config
17:34 < krzie> not an openvpn config
17:35 < fhashmi> no its not
17:35 < fhashmi> its a vayatta config but for openvpn
17:35 < krzie> so is there a #vayatta or something?
17:35 < fhashmi> no
17:36 < fhashmi> are you looking at the config ?
17:36 < krzie> i looked, saw it doesnt use openvpn stuff, and closed it
17:37 < fhashmi> look at the tls section
17:37 < krzie> what about it
17:38 < fhashmi> is that used to identify vtun ??
17:38 < krzie> i cant help you understand your vyatta config
17:38 < krzie> i can tell you those files are used in PKI
17:39 < krzie> !pki
17:39 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
17:39 <@vpnHelper> specially as a server (see !servercert)
17:39 < fhashmi> ok, i understant that part
17:40 < fhashmi> i can have two on one openvpn server ??
17:40 < krzie> i cant answer any vyatta questions
17:40 < krzie> openvpn can do a ton of stuff
17:40 < krzie> i also dont understand what you mean by "two on one openvpn server"
17:40 -!- kiwi_ [~kiwi_@ns204836.ovh.net] has left #openvpn []
17:41 < fhashmi> what i mean vtun0,1,2,3 with different tls files
17:41 < krzie> if listening on a different port or protocol
17:41 < krzie> or ip
17:42 < fhashmi> shit
17:42 -!- Yen [~Yen@unaffiliated/yen] has quit []
17:42 < fhashmi> ok
17:42 < fhashmi> let me explain
17:43 < fhashmi> i have 4 networks attached to my openvpn server.
17:43 < krzie> !serverlan
17:43 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
17:43 < krzie> like that, right?
17:43 < fhashmi> all the clients have OpenVPN Gui software installed
17:44 < krzie> openvpn gui = the windows download from here???
17:44 < krzie> !download
17:44 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
17:45 < fhashmi> i want 1 set of users to connect to vtun0 and 2nd set of users to vtun1
17:45 < fhashmi> is this possible ???
17:46 < Bushmills> !ccd
17:46 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
17:46 < fhashmi> if so how? and do the configuration files change on the client ??
17:46 < krzie> sure, because it is listening on a different ip:port:protocol than vtun1 you just give 1 group 1 ip:port:protocol to connect to and a different one to the other group
17:46 < krzie> you just run openvpn twice
17:46 < krzie> listening on a different socket
17:47 < fhashmi> ok
17:47 < krzie> 1 group connects to 1 socket, other connects to other
17:47 < fhashmi> Bushmills
17:47 < fhashmi> <Bushmills> for ccd do i have to use it with openvpn-option ???
17:48 < krzie> ccd has nothing to do with your question
17:48 < Bushmills> openvpn man page tells you how to use client config directory
17:48 < krzie> ohhh i see
17:49 < krzie> you only want to run 2 servers so you can give different config options to different clients?
17:49 < krzie> if so, hes right about ccd
17:49 < fhashmi> yes
17:49 < krzie> but we cant help you impliment it in your config
17:49 < krzie> since you dont run openvpn
17:49 < krzie> you run some vayatta modified version
17:50 < fhashmi> i do run openvpn, its just managed my vyatta
17:50 < krzie> you need vayatta support for implimenting what anyone here can tell you
17:50 < krzie> then forget about vayatta and manage it yourself if you want
17:50 < krzie> but we cant help you with your config, it is not an openvpn config
17:51 < fhashmi> i understand
17:52 < krzie> their online docs require registering with them, lol
17:53 < Bushmills> good idea. that way, the docs don't suffer from too much wear
17:54 < fhashmi> thanks
17:54 < fhashmi> i will figure out a way
17:54 -!- fhashmi [~fh@63.139.37.2] has quit []
17:55 -!- knarfly [~vlad@c-98-242-233-74.hsd1.fl.comcast.net] has joined #openvpn
17:55 < knarfly> 8-)
17:56 < knarfly> !welcome
17:56 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:01 < knarfly> I just got OpenVPN running on my server inside my LAN. The docs I read said I needed to gateway_enable="YES" on the VPN server. I'm curious if this is really necessary as my router which is in front of the VPN server is running as my gateway?
18:02 < krzie> freebsd i take it
18:02 < knarfly> yes, that's correct, FreeBSD-8.2-STABLE
18:02 < krzie> by setting that in rc.conf on freebsd you turn on ip forwarding
18:02 < knarfly> yes,
18:03 < krzie> you want packets to be allowed to pass from tun0 to your ethernet device, correct?
18:03 < krzie> (lan behind openvpn)
18:04 < knarfly> yes, my setup is COMCAST CABLE MODEM ---- FREEBSD ROUTER ----- LAN (which includes the OpenVPN and several Windows machines)
18:04 < krzie> doesnt matter
18:05 < krzie> if you want packets to pass from 1 interface to another in the freebsd machine, you need ip forwarding
18:05 < krzie> and thats what gateway_enable="YES" does
18:05 < knarfly> my thinking is the docs I read assumed the VPN server is right off the cable modem instead of inside the router which is already acting as my gateway
18:05 < krzie> you can also set it directly in sysctl, its the same thing
18:06 < knarfly> ok, I follow
18:06 < krzie> sysctl net.inet.ip.forwarding=1
18:07 < krzie> thats effectively what gateway_enable="YES" does
18:07 -!- vverheijen [~vincent@82-169-224-42.ip.telfort.nl] has quit [Quit: leaving]
18:07 < knarfly> yes, sometimes I do it manually but now have /etc/r.conf setup for OpenVPN...today I tested it from a remote location (Starbucks) and it worked fine...I was able to do Remote Desktop sessions with the windows machines inside the lan and access Samba shares
18:08 < knarfly> the trouble is that the only places I had to test seem to be blocking UDP port 1194, I had to set tcp and 443 to get it going....will try some more tests with this later
18:09 < knarfly> I also had to route add -net 10.8.0.0/24 10.0.0.254 on the router in order to get things going...is that the most efficient way of setting the needed route?
18:11 < knarfly> my router is 10.0.0.253 (plus it has the public IP) and the VPN server is 10.0.0.254
18:11 < krzie> yep, thats the best way
18:11 < krzie> !route_outside_ovpn
18:11 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
18:11 < krzie> you did that =]
18:13 < knarfly> yes, I have always preferred to keep as much as I can inside my firewall. The FreeBSD router is running IPFW+NATD
18:15 < knarfly> I guess there are mainly Linux users in this channel
18:18 -!- kiwi_ [~kiwi_@ns204836.ovh.net] has joined #openvpn
18:24 < krzie> thats a weird thing to say...
18:24 < krzie> all you said was gateway_enable="YES" and i not only knew you use freebsd but i knew exactly what it does and explained why you need it
18:59 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:01 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
19:05 -!- gyyrog [~gyyrog@66-227-129-89.dhcp.trcy.mi.charter.com] has joined #openvpn
19:09 -!- gyyrog_ [~gyyrog@66-227-129-89.dhcp.trcy.mi.charter.com] has joined #openvpn
19:11 -!- gyyrog [~gyyrog@66-227-129-89.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 240 seconds]
19:14 -!- gyyrog_ [~gyyrog@66-227-129-89.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 248 seconds]
19:28 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 276 seconds]
19:41 -!- kiwi_ [~kiwi_@ns204836.ovh.net] has quit [Ping timeout: 246 seconds]
19:42 -!- kiwi_ [~kiwi_@ns204836.ovh.net] has joined #openvpn
19:42 -!- Vutral [ss@vutral.net] has joined #openvpn
19:47 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:05 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Remote host closed the connection]
20:09 -!- master_of_master [~master_of@p57B55672.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
20:11 -!- master_of_master [~master_of@p57B5555E.dip.t-dialin.net] has joined #openvpn
20:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: Leaving]
20:15 -!- Gobbla [Gobbla@unaffiliated/gobbla] has quit []
20:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:18 -!- takamichi [Takamichi@46.11.92.98] has quit []
20:21 -!- kiwi_ [~kiwi_@ns204836.ovh.net] has quit [Quit: leaving]
20:24 -!- Toba [~eastein@pysoy/developer/EricStein] has joined #openvpn
20:36 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
20:36 < pyther> Hello
20:37 < pyther> I have a ccd directory, but my client isn't getting any of the settings in the ccd file
20:37 < pyther> How can I troubleshoot this?
20:45 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Remote host closed the connection]
21:04 -!- mirco [~mirco@p5B285D25.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
21:16 -!- knarfly [~vlad@c-98-242-233-74.hsd1.fl.comcast.net] has left #openvpn []
21:26 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
21:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 248 seconds]
21:57 -!- pyther [~pyther@unaffiliated/pyther] has quit [Read error: Operation timed out]
21:59 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
22:00 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:08 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Remote host closed the connection]
22:08 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:18 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:35 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:40 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
22:40 < bystander> hello guys, anybody around now?
22:41 < bystander> I just want to ask, that if I have closed my tunnelier after executing openvpn /etc/openvpn/server.conf, how can I check again if the openvpn is still running
22:44 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
22:51 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
22:56 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:14 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 276 seconds]
23:17 < ecrist> sup doods
23:24 -!- Vutral [ss@vutral.net] has joined #openvpn
23:34 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Remote host closed the connection]
23:35 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
23:36 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:38 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
--- Day changed Thu May 12 2011
00:10 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:29 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has joined #openvpn
00:36 <@vpnHelper> RSS Update - forum: UDPv4: Connection reset by peer <http://forums.openvpn.net/topic8094.html#p11920>
00:39 -!- d3cyfer [~d3cyfer@static.238.229.4.46.clients.your-server.de] has quit [Quit: d3cyfer]
00:54 <@vpnHelper> RSS Update - forum: Source Code For Access Server? <http://forums.openvpn.net/topic8098.html#p11922> || UDPv4: Connection reset by peer <http://forums.openvpn.net/topic8094.html#p11921>
00:58 -!- Vutral [ss@vutral.net] has quit [Excess Flood]
01:02 -!- Vutral [AX5HCrEucv@vutral.net] has joined #openvpn
01:11 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:16 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:34 -!- mirco [~mirco@p5B282163.dip.t-dialin.net] has joined #openvpn
01:41 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:41 -!- mode/#openvpn [+o mattock] by ChanServ
01:50 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
01:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
01:51 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:51 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
01:54 -!- mattock [~samuli@188.238.238.206] has joined #openvpn
01:54 -!- mattock [~samuli@188.238.238.206] has quit [Changing host]
01:54 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:54 -!- mode/#openvpn [+o mattock] by ChanServ
02:12 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
02:17 -!- mirco [~mirco@p5B282163.dip.t-dialin.net] has quit [Quit: mirco]
02:21 -!- richtj99 [ad44839d@gateway/web/freenode/ip.173.68.131.157] has quit [Ping timeout: 252 seconds]
02:38 < krzie> ecrist, boats and hos
02:43 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:43 -!- mode/#openvpn [+o mattock1] by ChanServ
02:46 <@vpnHelper> RSS Update - forum: OpenVPN over ICMP <http://forums.openvpn.net/topic7998.html#p11923>
02:46 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
02:56 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:58 <@vpnHelper> RSS Update - forum: Client cannot connect. Session Expired <http://forums.openvpn.net/topic8002.html#p11926> || How to prioritize VoIP packets? <http://forums.openvpn.net/topic8065.html#p11925> || TCP/UDP: Socket bind failed Permission denied <http://forums.openvpn.net/topic8039.html#p11924>
03:10 <@vpnHelper> RSS Update - forum: Disable/Enable TAP adapter <http://forums.openvpn.net/topic8090.html#p11927>
03:11 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 248 seconds]
03:13 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:13 -!- mode/#openvpn [+o mattock] by ChanServ
03:16 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
03:16 <@vpnHelper> RSS Update - forum: openvpn 2.2 issue <http://forums.openvpn.net/topic8084.html#p11930> || Qos over Open VPN <http://forums.openvpn.net/topic7862.html#p11929> || Two or more VPS server using one IP? <http://forums.openvpn.net/topic8101.html>
03:16 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:16 -!- mode/#openvpn [+o mattock1] by ChanServ
03:17 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
03:18 -!- dxtr [ezvbc4@unaffiliated/dxtr] has joined #openvpn
03:18 < dxtr> Can I use IPv6 with 2.1.0? That's what in openbsd ports :)
03:19 < krzie> define "use ipv6"
03:20 < krzie> if you use tap, you can run ipv6 over it (tap tunnels layer2, so you could run whatever layer3 protocol you want over it)
03:20 < krzie> if you want --server-ipv6 you cant even use 2.2.0
03:20 < dxtr> Ah, okay
03:20 < dxtr> I remember I used a dev build with it some time in the past
03:21 < krzie> yep
03:21 < krzie> thats the only place it is available for now
03:21 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945-15.html#p11932> || vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p11931>
03:21 < dxtr> Okay, I was thinking that maybe it was implemented by now :=
03:21 < dxtr> :)
03:21 < krzie> the windoes tap adapter got an upgrade in 2.2.0, so the tap adapter now handles ipv6
03:21 < krzie> but the ipv6 code needs a little polishing before it goes into stable branch
03:22 < krzie> i think it even needs to be ported to the new ovpn version still
03:22 < krzie> but it is coming
03:22 < dxtr> Aight
03:23 < dxtr> It's cool. I can live without it for now :)
03:24 < dxtr> I'm gonna attempt to bridge my two networks. Have never tried it before so it will be fun.:p
03:27 <@vpnHelper> RSS Update - forum: How can I check that the VPN is secure? <http://forums.openvpn.net/topic8095.html#p11934> || Request configuration <http://forums.openvpn.net/topic7932.html#p11933>
03:33 <@vpnHelper> RSS Update - forum: tap driver install failed! Please help! <http://forums.openvpn.net/topic7864.html#p11942> || Configuration Question related to WAN address? <http://forums.openvpn.net/topic8096.html#p11941> || i change port admin by misstack any help <http://forums.openvpn.net/topic7894.html#p11940> || dynamic IP <http://forums.openvpn.net/topic8097.html#p11939> || Windows TAP Interface does not get assigned IP address <http://forums.ope
03:39 <@vpnHelper> RSS Update - forum: Problems while connecting to AD <http://forums.openvpn.net/topic7813.html#p11945> || Request Firewall configuration <http://forums.openvpn.net/topic7933.html#p11944> || Network Busy/Read Only Documents <http://forums.openvpn.net/topic8099.html#p11943>
03:45 <@vpnHelper> RSS Update - forum: OpenVpn for android <http://forums.openvpn.net/topic7792.html#p11946>
03:57 < krzie> !pushdns
03:57 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
03:57 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
03:57 <@vpnHelper> RSS Update - forum: Failed build TAP - Compile OpenVPN <http://forums.openvpn.net/topic7818.html#p11947>
03:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:03 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p11948>
04:04 -!- janjust [~janjust@lena.nikhef.nl] has joined #openvpn
04:04 -!- janjust [~janjust@lena.nikhef.nl] has quit [Changing host]
04:04 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:05 < janjust> mi-oh-mi krzie , what an activity all of a sudden on the forum site - worried that I'm catching up on the top poster counter ;)
04:05 < krzie> heheh ya i just saw that!
04:05 < janjust> lol
04:06 < krzie> you were very very few away!
04:06 < krzie> you will pass me soon
04:06 < janjust> I was wondering, is there an increase in the number of postings on the site over the last few months?
04:06 < janjust> ecrist had a statistics page, right?
04:07 < krzie> without any numbers, i will say that it feels like its been steadily growing since it moved to being official
04:07 < krzie> but i do think ecrist would have the numbers
04:08 < krzie> when it went official it exploded, and it feels like its been growing since
04:08 < janjust> that's good, ain't it?
04:08 <@vpnHelper> RSS Update - forum: Problems while connecting to AD <http://forums.openvpn.net/topic7813.html#p11949>
04:08 < krzie> absolutely
04:08 < janjust> and it's been generating hits on my cookbook page on my home page ever since (> 10 hits per day ;))
04:08 < krzie> except vpnHelper flooding the channel ;]
04:08 < krzie> ahh great!
04:08 < janjust> lol, indeed
04:09 < krzie> it really is a good book, ive been recommending it to people who seem like they want to learn more
04:10 < janjust> thx... I even found a dude who reviewed it on the web, he liked it as well
04:11 < krzie> http://blog.arschkrebs.de/blog/openvpn-2-cookbook/
04:11 <@vpnHelper> Title: OpenVPN 2 Cookbook » Computerbeschimpfung (at blog.arschkrebs.de)
04:12 < krzie> looks like Ralf liked it too ;]
04:13 < janjust> hehe I saw that one... the one I saw was http://www.brichet.be/?p=343
04:13 < janjust> ow kewl: one more : http://zeldor.biz/2011/05/openvpn-2-cookbook/
04:15 < krzie> fresh too
04:15 < krzie> still steaming
04:15 < janjust> hehe I haven't received any numbers yet about how many books have been sold
04:15 < janjust> end of june ... I'm very curious actually
04:16 < krzie> when was it released?
04:16 < janjust> march
04:16 < krzie> im curious too
04:16 < krzie> i would think that this type of book sells more over time than an instant boom
04:16 < krzie> but i wouldnt know anything, thats just a guess
04:17 < janjust> that's what I figure too; I gave a guest lecture yesterday about openvpn to system and network engineering students
04:17 < janjust> perhaps a few of them will buy it as well
04:17 < krzie> cool!
04:17 < janjust> hehe I actually had them test a few things for me in their lab 
04:18 < krzie> is that where your awesome tests on gigabit links came from?
04:18 < janjust> nah I did that beforehand but I had them run some continuation tests
04:19 < krzie> nice, those were some cool tests, i have never had an excuse to play with MTU
04:19 < janjust> 6 student PCs -- plain gigabit -- VPNserver1 -- gigabit tunnel -- VPNserver2 -- plain gigabit -- 6 student PCs
04:19 < janjust> on the gigabit tunnel we played with the mtu size again ; then run iperf tests between PCs on either end
04:19 < krzie> i even have access to high speed sat links, and mtu is fine (openvpn mtu-test reports normal) over them
04:20 < krzie> would you be able to run similar tests with windows too?
04:21 < janjust> difficult - most machines connected to gigabit switches are linux boxen
04:21 < janjust> the windows pcs are usually laptops, connected via wireless or 100 Mbps
04:21 < krzie> ahh
04:21 < janjust> some laptops don't even support gigabit ; I now happen to have a laptop with a gigabit i/f but I need to go into the server room to hook it up
04:21 < janjust> to a gigabit link
04:21 < krzie> your laptop is windows?
04:22 < janjust> dualboot ; 95% of the time I run fedora 14
04:22 < janjust> but I left win7 on it, mostly for openvpn testing
04:22 < krzie> ahh more like i figured ;]
04:22 < janjust> but I am worried about win vista/7 support in openvpn - there are too many issues being reported
04:22 < janjust> the tap driver needs work
04:23 < krzie> seems so
04:23 < krzie> tomorrow i plan on putting 2 win XP boxes on a lan vpn to see what i find
04:23 < krzie> but its only 100mbit
04:24 < janjust> XP is fine, usually, although it'd be fun to run the youtube speed test (http://www.youtube.com/my_speed)
04:24 <@vpnHelper> Title: YouTube - Broadcast Yourself. (at www.youtube.com)
04:24 < krzie> ahh
04:24 < krzie> XP is all i have access to
04:24 < janjust> it's whatever M$ did to vista/7 related to Network Location Awareness and IPv6 that is causing problems
04:25 < janjust> I have a winXP VM under fedora: never seen any problems
04:25 < krzie> they can never leave things alone
04:26 < janjust> yeah - why did they bring out openvpn 2.2.0 instead of 2.1.5 :P
04:27 < krzie> theres already been quite a few issues found/solved since vista/7 came out, and they still havnt stopped
04:27 < krzie> because the tap adapter change was big enough to warrant a full version bump, is that right?
04:28 < janjust> ghe ghe yeah, and because this is the first version that is built by the openvpn community
04:28 < janjust> I was jesting...
04:29 < krzie> ohh true, now windows building is done from git
04:31 < krzie> https://forums.openvpn.net/topic7936.html
04:31 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN Server on Windows 7/Vista 64bits in french... bug : Off Topic, Related (at forums.openvpn.net)
04:31 < krzie> theres an interesting one
04:32 < krzie> does your windows machine have dutch?  if so does it still use "Program Files" ?
04:33 < janjust> nah, english
04:33 < krzie> same
04:33 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:33 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:34 < janjust> and AFAIK M$ did something weird to the "Program Files" dir, didn't they? it's always "Program Files" but it *appears* using a different name , depending on the language
04:34 < krzie> no idea, he said something to that regards but i really wouldnt know
04:34 <@vpnHelper> RSS Update - forum: assign different dhcp IP range for each client <http://forums.openvpn.net/topic7988.html#p11950>
04:35 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:37 < dxtr> Guys
04:38 < dxtr> ONe thing I don't get
04:38 < krzie> !factoids search hide
04:38 <@vpnHelper> "wintaphide" is (#1) in regedit find HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318} then Look through each sub-key for one with a DriverDesc = TAP-Win32Adapter V8 . Set Characteristics = 0x89, or (#2) To show again, set it to 0x81
04:38 < dxtr> Everyone says I should use tun in openbsd when I'm bridgin
04:38 < dxtr> Why=
04:38 < dxtr> can't add tun interfaces to bridges
04:38 < krzie> they are probably saying you dont need a bridge
04:38 < krzie> !tunortap
04:38 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
04:38 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
04:40 <@vpnHelper> RSS Update - forum: Shorewall & OpenVPN Configuration{Need Help} <http://forums.openvpn.net/topic8021.html#p11951>
04:40 < dxtr> dev-type tap
04:40 < dxtr> dev tun0 
04:41 < dxtr> http://blog.innerewut.de/2005/07/04/openvpn-2-0-on-openbsd (Outdated, but still. Using stuff for reference)
04:41 <@vpnHelper> Title: BlogFish: OpenVPN 2.0 on OpenBSD (at blog.innerewut.de)
04:41 < dxtr> http://www.chrisk.de/blog/2010/03/how-to-openvpn-on-openbsd-as-layer2-vpn/
04:43 < janjust> I don't use *bsd, dxtr , so I'm afraid I can't help you
04:43 < dxtr> Darn ;o
04:43 < dxtr> :P
04:43 < janjust> but 'dev tun0' + 'dev-node tap' might be the way to tell *bsd to create and use a TAP device 
04:43 < dxtr> Still, I can't add it to bridges
04:44 < janjust> seems not related to openvpn then - the creation of the device and creation of the bridge all happen outside of openvpn (and beyond the control of openvpn)
04:45 <@vpnHelper> RSS Update - forum: Auto Reconnect after disconnection <http://forums.openvpn.net/topic8052.html#p11953> || Please help with configuration... <http://forums.openvpn.net/topic8046.html#p11952>
04:46 < dxtr> Thing is, even though I specify dev-type tap it creates tun0 as a tun interface :P
04:48 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has joined #openvpn
04:48 < janjust> and what happens if you simply use 'tap0' ?
04:49 < dxtr> Can't create the interface
04:50 < krzie> i didnt think openbsd does tap
04:50 < janjust> http://www.freebsddiary.org/openvpn.php
04:50 <@vpnHelper> RSS Update - forum: Sharing a VPN with Squid Proxy <http://forums.openvpn.net/topic8067.html#p11954>
04:50 <@vpnHelper> Title: The FreeBSD Diary -- OpenVPN - getting it running (at www.freebsddiary.org)
04:50 < janjust> 'kldload if_tap'
04:51 < krzie> freebsd definitely does tap
04:51 < janjust> but that's freebsd - is openbsd that different?
04:51 < krzie> openbsd is quite different
04:52 < krzie> its nothing like linux distros, theres quite a bit different in the bsds
04:52 < janjust> ah Ok
04:52 < janjust> hmmmm how about this: For OpenBSD version 2.9 and higher, the tun driver is included in the default kernel configuration. There is also a kernel patch from http://diehard.n-r-g.com/stuff/openbsd/ which adds a tap device to OpenBSD which should work with tinc, but with recent versions of OpenBSD, a tun device can act as a tap device by setting the link0 option with ifconfig. 
04:52 < krzie> ive ran into some bugs in even simple openvpn setups on openbsd before
04:52 <@vpnHelper> Title: Index of /stuff/openbsd (at diehard.n-r-g.com)
04:52 < janjust> so what happens if you create a tun0 device and set the link0 option?
04:53 < janjust> (whatever that is)
04:53 < krzie> ahh cool, that explains his link0 up command in /etc/hostname.tun0  in that link
04:54 < krzie> dxtr, be sure you're using a recent enough version that supports ifconfig link0
04:55 < janjust> "luke, search your feelings^H^H^H^H^H^H^H^Hweb"
04:57 <@vpnHelper> RSS Update - forum: Is it a bug openvpn allows two same certification existed? <http://forums.openvpn.net/topic8081.html#p11955>
04:59 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
04:59 < Kartagis> hi
05:00 < Kartagis> I am getting TLC handshake failed. what am I missing?
05:00 < Kartagis> !welcome
05:00 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:00 < Kartagis> !hosto
05:00 < janjust> hi Kartagis , normally this means that a firewall is blocking access to either client or server
05:01 < Kartagis> !howto
05:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:01 < Kartagis> janjust: do you need to see config?
05:01 < janjust> that would help, it would also help if you say who is reporting  the TLS handshake failure: client or server; I assume the client, but what is seen in the server logs?
05:01 < Kartagis> TLS*
05:02 < Kartagis> janjust: the server is reporting it
05:02 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467-15.html#p11959> || Problems while connecting to AD <http://forums.openvpn.net/topic7813.html#p11958> || Is it a bug openvpn allows two same certification existed? <http://forums.openvpn.net/topic8081.html#p11957> || Help with collecting must-have features for the Windows GUI <http://forums.openvpn.net/topic8102.html>
05:03 < janjust> and you're using UDP mode? then there's a firewall on the client blocking inbound UDP traffic
05:03 < janjust> switch to 'mode tcp' to see if that helps (for debugging)
05:04 < Kartagis> janjust: http://pastebin.com/2kG8xcYC have my logs and config
05:04 < Kartagis> mode is tcp
05:05 < janjust> I'm not seeing the log file itself, but the status log
05:06 < janjust> use 'status /var/log/openvpn-status.log', restart the server and then reconnect the client
05:06 < janjust> then post the contents of the server log, which is still '/var/log/openvpn.log'
05:06 < Kartagis> status and logs both have the same file
05:07 < janjust> yup , and that causes the real server output to disappear
05:08  * janjust sees that krzie is *really* trying to up his post count ;)
05:09 < Kartagis> do you want the server log or status log?
05:09 < janjust> server log
05:09 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
05:09 -!- mode/#openvpn [+o mattock] by ChanServ
05:10 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
05:10 < Kartagis> http://pastebin.com/dUk6jHae these are the last lines
05:11 < janjust> OK, so that's the server log and it is not seeing any clients connecting
05:11 < janjust> where is the TLS handshake reported?
05:11 < Kartagis> it was in the status log, but nothing is reported now
05:12 < Kartagis> and I am getting Cannot load certificate file client.crt in the client, when it is there
05:14 < janjust> that's an entirely different error
05:15 < janjust> what client OS ? which version of OpenVPN?
05:17 < Kartagis> Mac OS and 2.1
05:19 < janjust> hhmmm open a terminal, go to the place where client.crt is located
05:19 < janjust> try running openvpn from the commandline
05:20 < Kartagis> I don't have CLI openvpn client
05:20 < janjust> yes you do: if openvpn is installed (or tunnelblick, or viscosity) you automatically get the CLI client
05:21 < janjust> but you need to find the client.crt file - perhaps it's a mac permissions problem?
05:21 < Kartagis> it's 755
05:21 < Kartagis> 0755 even
05:24 < Kartagis> what's the CLI client called? because I don't have openvpn
05:26 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
05:30 < janjust> which GUI are you using? tunnelblick?
05:30 < Kartagis> janjust: are you there?
05:30 < Kartagis> yes
05:31 < janjust> is the client.crt file located in the same directory as the openvpn config file?
05:32 < Kartagis> hmm, I thought it was, but apparently it wasn't
05:32 < Kartagis> I copied again
05:35 < janjust> I am not sure where tunnelblick expects the certificates to be
05:35 < janjust> it might be best to specify absolute pathnames for ca.crt, client.crt and client.key
05:38 < Kartagis> hmm, it seems now it's trying to connect
05:38 < Kartagis> or it connected, I'm not sure
05:39 < janjust> check the details in tunnelblick and/or check the server logs
05:42 < Kartagis> http://pastebin.com/USM7sGk8
05:43 < dxtr> Hmm... What else should I do to let it forward DHCP requests to my LAN dhcp server? I've put 'server-bridge' (without parameters) in my config
05:44 < Kartagis> also, waiting for server response
05:44 < dxtr> But I still don't get an IP. Perhaps it doesn't work in OSX? I read in the man page that it only works for OS' that lets me attach a DHCP client to the tun/tap interface
05:48 -!- pyther [~pyther@adsl-99-57-13-157.dsl.bcvloh.sbcglobal.net] has joined #openvpn
05:48 -!- pyther [~pyther@adsl-99-57-13-157.dsl.bcvloh.sbcglobal.net] has quit [Changing host]
05:48 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
05:49 -!- pyther [~pyther@unaffiliated/pyther] has quit [Client Quit]
05:49 < janjust> Kartagis, now you're hitting the TLS handshake error again
05:49 < Kartagis> yes
05:49 < janjust> that's a firewalling issue, most likely on the server itself
05:50 < janjust> what's the OS of the server? linux -> try adding 'iptables -I INPUT -p udp --dport 1194 -j ACCEPT
05:50 < janjust> dxtr, what does wireshark show this time (on the client)? is the DHCP offer sent to the client?
05:50 < Kartagis> there's no firewall
05:51 < Kartagis> no iptables either
05:51 < Kartagis> ubuntu linux
05:52 < janjust> run 'tcpdump -nnl -i eth0 udp port 1194' on the server, then connect the client: are any packets coming in?
05:52 < Kartagis> even if it's tcp?
05:55 < janjust> errr, right... make that tcp
05:56 < Kartagis> 1 packets received by filter
05:56 < janjust> Ok so when the client connects a single packet arrives
05:56 < janjust> but an answer is never returned OR the client never sees the answer
05:56 < janjust> check the firewall on the mac os box
05:57 < Kartagis> hmm, when I change it to tcp nothing is returned
05:57 < Kartagis> only on udp
05:57 < janjust> is the *client* configured to use TCP? or UDP?
05:57 < Kartagis> let me see
05:59 < janjust> dxtr, read http://code.google.com/p/tunnelblick/issues/detail?id=73
05:59 <@vpnHelper> Title: Issue 73 - tunnelblick - DHCP over TAP not working - OpenVPN GUI for Mac OS X - Google Project Hosting (at code.google.com)
05:59 < janjust> seems that it is possible to get mac os to pick up an IP from DHCP but you need an up/down script
06:00 < Kartagis> right, I changed the client mode to tcp too, and I think it connected
06:00 < janjust> from the client, ping the server IP and you will know for sure
06:00 < Kartagis> tun0: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1500
06:00 < Kartagis> 	inet 10.8.0.6 --> 10.8.0.5 netmask 0xffffffff 
06:00 < Kartagis> 	open (pid 15432)
06:01 < janjust> do a 'ping 10.8.0.1' (NOT .5 !)
06:02 < Kartagis> I get answer
06:02 < janjust> congrats: your VPN is working
06:03 < Kartagis> when I query my IP address on whatismyipaddress.com, I still get the other IP
06:04 < janjust> that's something else: if you want all traffic to be redirected via the VPN you need to add 'push "redirect-gateway def"' to the server config and restart the openvpn server
06:04 < janjust> you will also need to add routing (and perhaps masquerading) to the server
06:05 < Kartagis> routing via iptables?
06:08 < janjust> !route
06:08 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
06:08 < janjust> read #1
06:10 < Kartagis> okay thanks
06:10 < Kartagis> one more q: when I make a VPN connection, it takes forever to browse. why is that? because routing is not enabled?
06:37 < janjust> Kartagis, most likely a routing issue... read #1 , make sure routing is done via the VPN , then try to browse to a website; yes, performance may be affected when running over a VPN
06:39 < Bushmills> "redirect-gateway def1" in client config would do too, if you want to avoid restarting openvpn server
06:39 <@vpnHelper> RSS Update - forum: Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html#p11960>
06:40 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
06:44 -!- raomin [~romain@86.66.22.240] has quit [Quit: leaving...]
06:51 <@vpnHelper> RSS Update - forum: Inheriting existing setup, new certs don't work <http://forums.openvpn.net/topic8060.html#p11961>
06:57 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
06:57 <@vpnHelper> RSS Update - forum: Disable/Enable TAP adapter <http://forums.openvpn.net/topic8090.html#p11962>
07:06 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
07:16 < Kartagis> what does bad source address from client [xxx.xxx.xxx.xxx] mean?
07:17 < Kartagis> !tcpip
07:17 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
07:24 -!- samu [s@unaffiliated/samaelszafran] has quit [Quit: Changing server]
07:33 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
07:33 <@vpnHelper> RSS Update - forum: Error by conncting on server <http://forums.openvpn.net/topic8103.html>
07:40 < Kartagis> my connection over VPN is extremely slow. any ideas?
07:43 < fremo> try mtr?
07:44 < Kartagis> I got it, it can't find DNS. so my next question isis it possible to enforce DNS server over VPN?
07:44 < Kartagis>  what's mtr anyway?
07:50 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:50 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:54 < ecrist> Kartagis: yes, you can push DNS
07:55 < Kartagis> yay, it works
07:56 < Kartagis> I've got a fully working VPN
07:56 < Kartagis> thanks to all who helped
08:09 -!- Irssi: #openvpn: Total of 122 nicks [6 ops, 0 halfops, 0 voices, 116 normal]
08:09 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
08:09 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:09 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:11 < Kartagis> how do I know if my connections are going through the VPN server or our school server?
08:12 < ecrist> traceroute
08:14 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:14 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:14 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:14 < Kartagis> oh, the first IP should be the IP VPN server assigns me, no?
08:15 < Kartagis> yes, they are going through the VPN server
08:16 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:16 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:16 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:17 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
08:18 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:18 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:18 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Operation timed out]
08:18 -!- Cain` is now known as Cain
08:20 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:20 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:20 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:22 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:22 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:22 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:24 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:24 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:24 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:26 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:26 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:26 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:28 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:28 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:28 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:28 < ecrist> !AS
08:28 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
08:28 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
08:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
08:30 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:30 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:30 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:32 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:32 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:32 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:33 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
08:34 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:34 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:34 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:36 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:36 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:36 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:38 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:38 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:38 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:40 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:40 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:40 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:42 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:42 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:42 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:44 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:44 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:44 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:46 -!- CrazyGir [~jason@unaffiliated/crazygir] has joined #openvpn
08:46 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:46 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:46 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:47 < CrazyGir> hello! I am trying to setup openvpn for a debian client and am having trouble with the device and routes. in my experience, setting up the config correctly and starting the service will get you the correct tun/tap device and routes. am I missing something with the setup on debian?
08:48 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:48 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:48 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:50 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:50 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:50 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:51 < CrazyGir> while I don't have acces to the server's config, I haveconfrimed with the admin that it as the correct pushdirectives included
08:52 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:52 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:52 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:52 -!- jeev [~jeev@unaffiliated/jeev] has left #openvpn []
08:53 < CrazyGir> s/as/has the correct
08:54 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:54 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:54 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:54 -!- MarKsaitis_ [~MarKsaiti@195.59.185.18] has joined #openvpn
08:56 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:57 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:57 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:57 -!- MarKsaitis [~MarKsaiti@82.144.242.158] has quit [Ping timeout: 248 seconds]
08:58 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
08:58 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:58 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:00 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:00 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:00 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:02 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:02 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:02 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:04 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:04 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:04 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:06 < Kartagis> when I do ifconfig-push xx.xx.xx.xx and restart, I can't connect. any ideas?
09:06 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:06 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:06 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:08 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:08 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:08 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:10 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:10 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:10 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:12 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:12 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:12 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:12 < ecrist> raar
09:13 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
09:13 < ecrist> Kartagis: see the man page
09:14 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:14 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:14 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
09:15 < ecrist> sorry, CrazyGir, your comments were lost in vpnHelper's retardation
09:16 < CrazyGir> hah
09:16 < kunago> Hi. If my clients are able to communicate with each other thanks to "client-to-client" in the config, does it mean all the data are passing through the server anyways? So sending lets say 1 MB od data from a client to a client will go through the server as well?
09:16 < CrazyGir> you don't have scrollback?
09:16 < ecrist> without knowing more, things should just work.
09:16 < Kartagis> hmm, the directive is ifconfig?
09:16 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:16 < ecrist> I read it, just didn't notice someone was saying something with all the crap traffic
09:17 < CrazyGir> oh I see
09:17 < CrazyGir> hm..
09:17 < CrazyGir> how do you manually create a tun device?
09:17 < CrazyGir> I can setup the route by hand for this one client
09:17 < CrazyGir> but not sure about creating a device for the VPN
09:18 < Kartagis> mkdir /dev/net && mknod /dev/net/tun c 10 200
09:19 < ecrist> CrazyGir: what OS?
09:19 < CrazyGir> debian
09:19  * ecrist has no clue, then
09:19 < Kartagis> CrazyGir: the above command worked for me
09:19 < ecrist> I think openvpn does it for you, though.
09:20 < CrazyGir> hmm.. I have the device, but ifconfig doesn't see it when the vpn is "up" (service started ok)
09:20 < ecrist> ifconfig doesn't list it?
09:20 < ecrist> !logs
09:20 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:29 -!- kunago [~Miris@201.239.broadband12.iol.cz] has left #openvpn []
09:29 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 250 seconds]
09:33 < CrazyGir> alright, so my route (from the server) seems to have a problem, and I can fix that. what's confusing me here though is: May 12 10:26:46 web4 ovpn-foo_config[16076]: TUN/TAP device tap0 opened but I see nothing in ifconfig
09:38 < ecrist> you still didn't post your logs. ;)
09:38 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
09:47 -!- dazo_afk is now known as dazo
09:51 < CrazyGir> workin on it :) I don't have the server log, only clietn
09:52 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 240 seconds]
09:56 <@vpnHelper> RSS Update - forum: tunneling <http://forums.openvpn.net/topic8104.html>
09:59 < CrazyGir> here's syslog output when starting openvpn on the clietn: http://dpaste.org/UYWs/
10:04 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:04 < ecrist> CrazyGir: you need to turn up verbosity, as asked for in the post from vpnhelper
10:04 < ecrist> then post the logs again, please
10:15 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:25 <@vpnHelper> RSS Update - forum: $route_vpn_gateway enviro. variable and "route-gateway dhcp" <http://forums.openvpn.net/topic8105.html>
10:32 <@vpnHelper> RSS Update - forum: Can ping in one direction, but not the other <http://forums.openvpn.net/topic8066.html#p11968>
10:45 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:00 -!- espengra [~espengra@2001:700:300:1430:21b:78ff:fe8a:d278] has joined #openvpn
11:01 < espengra> !welcome
11:01 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:02 < espengra> !sample
11:02 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
11:02 < espengra> !man
11:02 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
11:18 -!- MarKsaitis_ [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 241 seconds]
11:19 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
11:19 < mick_laptop> anyone here running openvpn on a dd-wrt?
11:19 < mick_laptop> i can't even get it to start
11:19 < mick_laptop> ps ax | grep openvpn - and nothing comes up
11:19 <@vpnHelper> RSS Update - forum: can ping printer but can't ping computer <http://forums.openvpn.net/topic8106.html>
11:21 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
11:21 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
11:21 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
11:21 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
11:22 < ecrist> ask in their channel
11:32 < Bushmills> mick_laptop: does dd-wrt use uci for converting configuration files?
11:34 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
11:34 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: Leaving]
11:36 -!- Vutral [AX5HCrEucv@vutral.net] has quit [Ping timeout: 240 seconds]
11:48 -!- Ramblurr [~rmblr@amarok/developer/Ramblurr] has left #openvpn []
11:48 < mick_laptop> ecrist: i did - people just say "give up"
11:48 < mick_laptop> Bushmills: no idea
11:49 < ecrist> mick_laptop: the problem we have is that dd-wrt is not a typical OS in that everything is tweaked and customized and shrunk down.
11:49 < mick_laptop> ecrist: i figured that this channel might have more helpful people :)
11:49 < mick_laptop> i am using "big"
11:49 < ecrist> we can help with openvpn specific config issues, but we're going to require access to logs, command line, and text-based configs
11:50 < Bushmills> openvpn runs nicely under openwrt
11:50 < mick_laptop> since the e4200 hadecent specs
11:50 -!- Vutral [ss@vutral.net] has joined #openvpn
11:50 < mick_laptop> has*
11:55 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
11:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:21 < mick_laptop> i ran a find on it to see all thingss like openvpn*
12:21 < mick_laptop> http://www.pastie.org/1893767
12:23 < mick_laptop> looks like it is only a client - or?
12:24 < Kartagis> hi
12:24 < Kartagis> I changed IPs on the server, and I'm getting this now
12:25 < Kartagis> ERROR: Linux route add command failed: external program exited with error status: 7
12:25 < Kartagis> any ideas?
12:27 < Kartagis> yay! wrong route
12:28 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:36 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
12:36 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has quit [Changing host]
12:36 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:36 -!- mode/#openvpn [+o raidz] by ChanServ
12:41 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Leaving]
12:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:13 -!- fhashmi [~fh@63.139.37.2] has joined #openvpn
13:14 < Kartagis> can you recommend a decent OpenVPN GUI for ubuntu?
13:19 < gladiatr> vi
13:22 < Kartagis> I'm sorry, me?
13:28 <@dazo> Kartagis: try gopenvpn
13:30 < Kartagis> oh, I remember now why I removed it, ./configure script had an error
13:31 < Kartagis> dazo: ./configure: line 5709: syntax error near unexpected token `0.23'
13:31 < Kartagis> ./configure: line 5709: `AC_PROG_INTLTOOL(0.23)'
13:32 <@dazo> ahh, yeah ... I believe there's a patch floating around which solves that ... don't recall the details now
13:36 < mick_laptop> i guess i should give up on openvpn on this router? :(
13:37 < mick_laptop> i could try pptp - but that probably isn't a good idea
13:39 < Kartagis> dazo: don't you at least remember some keywords?
13:42 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
13:43 < Kartagis> can you recommend another decent OpenVPN GUI?
13:44 < ecrist> no, there is a gui included with the windows installer, though.
13:44 < Kartagis> I'm on ubuntu
13:44 < ecrist> why do you need a gui?
13:44 < ecrist> openvpn --config client.conf
13:44 < ecrist> done
13:44 < Kartagis> gopenvpn configure script is giving me an error
13:45 < Kartagis> ecrist: how do I stop it? kill?
13:45 < ecrist> yep
13:45 < ecrist> or through the mgmt port
13:46 < Kartagis> where is that?
13:46 < ecrist> read the man pag
13:46 < ecrist> e
13:47 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
13:48 < Kartagis> man doesn't say what mgmt is
13:49 -!- dazo is now known as dazo_afk
13:50 -!- dazo_afk is now known as dazo
13:51 <@dazo> Kartagis: for build issues with gopenvpn ... that's a topic for the gopenvpn community
13:51 <@dazo> Kartagis: Search for management in the man page
13:51 <@dazo> mick_laptop: get a decent router firmware :-P
13:57 < mick_laptop> dd-wrt  -- so, yes
14:01 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
14:05 -!- yurko__ [~yurko@204.101.63.212] has joined #openvpn
14:07 -!- darkdrgn2k [~yurko@204.101.63.212] has quit [Ping timeout: 240 seconds]
14:10 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
14:10 <@dazo> mick_laptop: dd-wrt is not decent, IMHO  (don't ask me for a rant about their security attitude) ... openwrt however, is a decent firmware
14:20 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:33 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
15:12 < mick_laptop> ok, I'll give it a shot later
15:18 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:19 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:23 -!- Fonzie- is now known as Leila
15:24 -!- Leila is now known as Guest4626
15:24 -!- Guest4626 is now known as LeilaK
15:25 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:26 -!- bulbous [~bulbous@203.97.147.47] has quit [Quit: bulbous]
15:28 -!- yurko__ [~yurko@204.101.63.212] has quit [Read error: Connection reset by peer]
15:42 -!- mirco [~mirco@p5B282163.dip.t-dialin.net] has joined #openvpn
15:55 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 258 seconds]
15:57 < fhashmi> hello room
15:57 < fhashmi> has anyone used Radius Server with OpenVPN ???
15:58 < fhashmi> if so.. is the radiusplugin.so the only option ???
15:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
16:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:11 <@dazo> fhashmi: afaik, this is the only RADIUS implementation available: http://www.nongnu.org/radiusplugin/
16:11 <@vpnHelper> Title: Radiusplugin for OpenVPN (at www.nongnu.org)
16:14 -!- dazo is now known as dazo_afk
16:30 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
16:31 < queequeg1> I don't understand why the build-key script is looking in " c:\openssl/ssl/openssl.cnf"
16:32 < queequeg1> when in type "set" at the command prompt I see: HOME=C:\Program Files\OpenVPN\easy-rsa
16:33 < queequeg1> So the script is choking because it can't find openssl.cnf, but my environment knows where easy-rsa is.
16:34 < queequeg1> and the bin directory is in my path.
16:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
16:39 -!- grapsus [~grapsus@acces1229.res.insa-lyon.fr] has joined #openvpn
16:40 < queequeg1> !welcome
16:40 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:40 < queequeg1> !wiki
16:40 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
17:12 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:40 -!- Netsplit *.net <-> *.split quits: buddha, smerz, APTX, dxtr, DeeJayTwo, Cain, Nappy, Champi, openbsdnoob
17:44 -!- Netsplit over, joins: smerz, dxtr, Champi, buddha, openbsdnoob, DeeJayTwo, APTX, Nappy
17:46 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
17:46 -!- Cain [~Geek@41.141.252.98] has joined #openvpn
17:46 -!- Cain [~Geek@41.141.252.98] has quit [Changing host]
17:46 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
17:47 -!- Cain [~Geek@unaffiliated/cain] has quit [Max SendQ exceeded]
17:49 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
17:52 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:16 <@vpnHelper> RSS Update - forum: Do You Need All These Certs & Keys? <http://forums.openvpn.net/topic8087.html#p11970>
19:19 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:28 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Quit: Computer has gone to sleep.]
19:29 -!- CrazyGir [~jason@unaffiliated/crazygir] has quit [Read error: Operation timed out]
19:29 -!- CrazyGir [~jason@li14-82.members.linode.com] has joined #openvpn
19:29 -!- CrazyGir is now known as Guest48839
19:30 -!- nb [~nb@fedora/nb] has joined #openvpn
19:37 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
20:04 <@vpnHelper> RSS Update - forum: openvpn 2.2 issue <http://forums.openvpn.net/topic8084.html#p11971>
20:06 -!- fhashmi [~fh@63.139.37.2] has quit []
20:10 -!- master_of_master [~master_of@p57B5555E.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:10 <@vpnHelper> RSS Update - forum: Server ip addressing <http://forums.openvpn.net/topic8107.html>
20:11 -!- master_of_master [~master_of@p57B55812.dip.t-dialin.net] has joined #openvpn
20:31 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Operation timed out]
20:32 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
20:43 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
20:52 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
21:03 -!- mirco [~mirco@p5B282163.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
21:09 -!- mirco [~mirco@p5B282715.dip.t-dialin.net] has joined #openvpn
21:14 <@vpnHelper> RSS Update - forum: How can I check that the VPN is secure? <http://forums.openvpn.net/topic8095.html#p11973>
21:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:34 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
21:36 -!- knarfly [~vlad@c-98-242-233-74.hsd1.fl.comcast.net] has joined #openvpn
21:36 < knarfly> 8-)
21:59 -!- knarfly [~vlad@c-98-242-233-74.hsd1.fl.comcast.net] has left #openvpn []
22:30 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:41 -!- Carbon_Monoxide [~cmonxide@061093232225.ctinets.com] has joined #openvpn
22:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
23:21 -!- CppIsWeird [~user@unaffiliated/cppisweird] has joined #openvpn
23:24 < CppIsWeird> im on a windows 7 openvpn client attempting to vpn to a network that i've vpn'ed from this location before. nothing about the network configurations has changed, however I can't seem to access any of the services on the remote network. the openvpn client says that the connectionw as successful and nothing seems to suggest any errors. i'm not really sure of how to proceed to debug the problem. I have tried clearing my routing table and rebooting.
23:24 < krzie> can you ping the vpn server?
23:24 < CppIsWeird> no
23:24 < krzie> even by vpn ip?
23:24 < CppIsWeird> wait, the internal ip of the server or the server's face to the internet?
23:25 < krzie> the VPN ip
23:25 < CppIsWeird> yes, i can ping that
23:25 < krzie> !clientlan
23:25 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
23:25 <@vpnHelper> better explanation
23:25 < CppIsWeird> ah, right.
23:25 < krzie> oh wait
23:25 < krzie> lan is behind the server, right?
23:25 < CppIsWeird> yes
23:25 < krzie> i meant:
23:26 < krzie> !serverlan
23:26 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
23:27 < CppIsWeird> ok.
23:48 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:48 -!- CppIsWeird [~user@unaffiliated/cppisweird] has quit []
23:49 -!- oc80z [oc80z@blea.ch] has joined #openvpn
--- Day changed Fri May 13 2011
00:28 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:29 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
00:29 -!- 36DABMXUK [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
00:29 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
00:30 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Client Quit]
00:30 -!- 36DABMXUK [~sigius@93-125-185-45.dsl.alice.nl] has quit [Client Quit]
01:15 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:17 -!- mirco [~mirco@p5B282715.dip.t-dialin.net] has quit [Quit: mirco]
01:31 < Kartagis> if I have given my client an IP address in a subnet with no restrictions, and he is originally in a subnet with samba access restrictions, does the original subnet apply? because I can't access the client's shares
01:45 <@vpnHelper> RSS Update - forum: How to allow only 1 client to "see" all others <http://forums.openvpn.net/topic8108.html>
01:54 -!- aditsu [~aditsu@119247194237.ctinets.com] has joined #openvpn
01:54 < aditsu> !welcome
01:54 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:54 < aditsu> !goal
01:54 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:55 < aditsu> um.. my goal is to get rid of disconnections and reconnections
01:55 < aditsu> every 6 minutes (almost to the second) my computer reconnects to the server
01:56 < aditsu> except when I actively use the connection
01:56 < aditsu> let me pastebin some logs..
02:00 < aditsu> ok this is on the client side: http://dpaste.com/541923/
02:00 < aditsu> (I censored a few parts)
02:05 < aditsu> server side: http://dpaste.com/541924/
02:06 < aditsu> thanks to ntp, you can match the times exactly
02:09 < aditsu> so anyway, I understand that keepalive packets must not be getting through?
02:13 < aditsu> how can I check and fix this? anybody?
02:25 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:36 -!- rooth_ [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 246 seconds]
02:42 -!- dazo_afk is now known as dazo
02:45 -!- Carbon_Monoxide [~cmonxide@061093232225.ctinets.com] has quit [Ping timeout: 252 seconds]
02:51 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
02:55 < Bushmills> !keepalive
02:55 < Bushmills> hm.  check out --keepalive
02:56 -!- queequeg1_ [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
02:56 < aditsu> oh, just realized I was missing keepalive on the client
02:57 < aditsu> (client config)
02:57 < aditsu> I had it only on the server
02:57 < Bushmills> if server is server, as in mode server, client part of keepalive will be pushed
02:58 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:59 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Ping timeout: 246 seconds]
03:00 -!- queequeg1_ is now known as queequeg1
03:00 < Bushmills> (without mode server, technically server is not a server, but only a peer)
03:00 < aditsu> Bushmills: yes the server is "server", but adding keepalive on the client seems to help
03:01 < Bushmills> that's a bit unusual
03:01 < aditsu> let me make sure.. I should close the ssh sessions over vpn
03:03 < aditsu> Bushmills: I'm watching in wireshark; without keepalive on the client, I get some packets from the server every 10 seconds but no packets are going back
03:03 < aditsu> Bushmills: but with keepalive on the client, there are packets going both ways
03:05 -!- mirco__ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:06 < Bushmills> sounds wrong.  keepalive on client doesn't control returnng of packets. it enables proactive server pinging.
03:06 < Bushmills> could it be that you're missing the replies, and look at client pings instead?
03:07 < aditsu> I don't think there are any "replies", this is udp
03:07 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
03:07 -!- mirco__ is now known as mirco
03:08 < aditsu> I think all the packets are pings, but the client doesn't send any ping in the first case
03:08 < Bushmills> yes.  restarting is triggered after some time without reception of a ping from remote. no replies involved, indeed
03:09  * Bushmills shuts up and grabs a cup of coffee
03:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
03:09 < aditsu> oh, protocol replies? apparently there aren't any
03:10 < aditsu> still, you said "client part of keepalive will be pushed"
03:10 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:11 < aditsu> Bushmills: would a custom config in the client-config-dir interfere with that? e.g. if it contains "push-reset"
03:11 < Bushmills> yes, that could cause this behaviour
03:12 < aditsu> I'll check on another client...
03:15 < aditsu> wait, pings stopped on this machine (both ways)
03:15 < aditsu> this is weird
03:16 < aditsu> or maybe wireshark stopped recording them o_O
03:16 < aditsu> I can see them again after restarting the capture
03:17 -!- Carbon_Monoxide [~cmonxide@061093232225.ctinets.com] has joined #openvpn
03:20 < aditsu> looks like the "any" interface doesn't work as well as I thought
03:21 < aditsu> oh, I see the other client receives "ping 10,ping-restart 120" in the PUSH-REPLY
03:26 < aditsu> hm, I wish dns worked more like routes
03:27 < aditsu> "for this domain use this dns server, for that one use that server, for the rest use the default"
03:35 < Bushmills> some dns forwarders can do that.  dnsmasq for example
03:36 < aditsu> can it? that's great, but still, I'd like this to be something that gets pushed from the vpn server
03:37 < aditsu> just like the routes
03:38 < Bushmills> you can push the name server a client uses
03:39 < aditsu> yeah, but then all queries (e.g. for resolving www.google.com) go through that server, and if it's down, bam! client basically "loses internet"
03:39 < Bushmills> that's true for the originally used name server too
03:40 < aditsu> the original one is supposed to be rock solid (e.g. from the isp)
03:40 < aditsu> also, even if it's not down, there can be speed issues
03:41 < aditsu> e.g. if connecting from another continent
03:41 < Bushmills> then you're at a disadvantage, by not locally caching already resolved records, requiring re-consulting isp recursive server. if that fails, you don't have a local cache to resolve from
03:42 < Bushmills> btw, unreliability of provider supplied name server were the initial reason why i started diving into dns at all
03:42 < aditsu> many records expire quickly, e.g. google uses 5 min
03:43 < aditsu> so caching doesn't always help
03:43 < Bushmills> 5 min TTL is more the exception than the rule
03:43 < aditsu> ok, the rule is more like 1 hour
03:44 -!- Carbon_Monoxide [~cmonxide@061093232225.ctinets.com] has quit [Ping timeout: 276 seconds]
03:45 < Bushmills> i'd estimate that a day is more common than one hour
03:47 < aditsu> most of the sites I use seem to have around 1 hour
03:47 < Bushmills> but even with an hour, that should gap temporary isp recursor problems
03:48 < aditsu> I'm not concerned about the isp's server, but about the one I'm pushing through openvpn
03:49 < Bushmills> many home routers seem to run dnsmasq as caching forwarder.
03:49 < Bushmills> mine does too, actually
03:50 < aditsu> that still doesn't make any difference when the openvpn server pushes a different dns server.. unless the client is the router
03:50 < aditsu> my router doesn't do openvpn
03:51 < Bushmills> that's an indication of reliability - was that software not reliable, buyers would return that router as broken
03:52 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
03:53 < aditsu> yeah, dnsmasq is reliable.. but that doesn't really address my concern
03:53 < bystander> hello there. my vpn is blocked by my router. what will I do witl the router setting to unblock my vpn
03:54 < aditsu> bystander: do you have the vpn server behind a router?
03:54 < bystander> vpn client only
03:55 < aditsu> shouldn't be blocked then...
03:55 < Bushmills> bystander: you're sure it's router, and not isp?
03:56 < bystander> yes I can see in the router log, that "Disassociated: Blocked access attempt from"
03:56 < Bushmills> and - how do you know that it's "blocked"?
03:56 < bystander> bushmills: yes I can see in the router log, that "Disassociated: Blocked access attempt from"
03:57 < bystander> that I know that the router is blocking it.
03:57 < bystander> my router is a dlink broadband vpn router.
03:57 < bystander> bushmills: what do you think or what can you advice!
03:57 < Bushmills> is that "from" the server, or the client
03:57 < Bushmills> ?
03:58 < bystander> client
03:58 < Bushmills> are there outgoing blocking rules?
03:59 < bystander> yes there are but I dont know because I am not familiar with router settings. which one should I take a look.\
04:00 < Bushmills> blocking rules of the kind "deny everything except <list of permitted destination ports>"?
04:00 < bystander> where from? firewall settings?
04:00 < Bushmills> your router
04:01 < Bushmills> or firewall, if that applies
04:01 < bystander> hmmmm
04:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:05 < aditsu> Bushmills: is it possible to push the keepalive option from the client-config-dir?
04:05 < Bushmills> i think so
04:05 < aditsu> it didn't seem to work, maybe I should restart the vpn server?
04:06 < Bushmills> for ccd options that shouldn't be necessary
04:07 < aditsu> maybe my syntax is wrong
04:09 < Bushmills> ehm ..  push keepalive option?    use keepalive, alternatively push "ping ..." and push "ping-restart ..."
04:09 < aditsu> ah, got it :)
04:09 < aditsu> yeah, with push "ping 10" and push "ping-restart 120"
04:10 < aditsu> keepalive and push keepalive both failed
04:10 < Bushmills> keepalive is only a macro, conditionally pushing ping and ping-restart
04:11 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
04:13 < aditsu> about the dns routes thing, I guess the "solution" would be to include a forwarding dns server into the client
04:14 < Bushmills> no, it wouldn't be, because of your reliability concerns
04:16 < aditsu> huh? no, I'm only concerned about being able to connect to the server pushed through vpn; the forwarding server would only use that one for specific domains, but other than that it would use the client's default server(s)
04:17 < Bushmills> client would use the forwarding name server, instead of your rock solid isp name server
04:17 < Bushmills> that's were you saw your problems - if that forwarder is down, all internet will seem dead
04:17 < aditsu> the forwarding name server would forward to the isp name server, except for specific domains
04:18 < aditsu> the forwarder runs on localhost, therefore it can't be down
04:19 < aditsu> unless the process gets killed or something
04:22 < aditsu> just to be clear, I'm not concerned about software reliability, but rather about servers being down or disconnected or having not enough bandwidth
04:29 < aditsu> oh, not just bandwidth.. terrible latency can be worse
04:30 < Bushmills> another reason for a local cache
04:31 < aditsu> sure, a local cache should be used in all cases
04:31 < Bushmills> actually, i trust my recursive name server more than i trust providers' recursors
04:34 < Bushmills> some years ago, i was with a provider which was gradually tagged "unreliable" because of apparently frequent net outages. problems were mostly due to using their recursors.
04:34 < Bushmills> internet connectivity itself was pretty stable
04:35 < aditsu> I also trust the bind server I set up in the office, but I don't trust the server machine to be always up and connected (it's not being kept properly)
04:37 < Bushmills> one recursive name server runs on my openvpn server. if that machine is down, openvpn to that box is pointless too.  another recursor runs on my internet router. same goes here, if box down, name server running wouldn't help. 
04:38 < aditsu> well, there are other scenarios, but you're saying the local cache fixes everything
04:38 < Bushmills> when mobile, a recursive name server runs on localhost
04:39 < Bushmills> no, didn't say "everything" - it obviously can't fix connection problems.  but it helps alleviating problems with provider recursive name servers
04:40 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
04:40 < Bushmills> ehm, amendmend "recursive on localhost" - that one uses  recursor on openvpn server as upstream now. 
04:42 < Bushmills> but however the connection scenario is, the last name server i want to let know what hosts i'm contacting are the provider's name servers
04:45 < aditsu> oh, that's quite opposite, I don't want to run my personal dns queries through the company's server, but rather through the isp (or a public dns such as google's)... although I should perhaps think about this more
04:46 < Bushmills> i was with BT before who have quite a reputation of spying on customers, and selling marketeable data
04:47 < aditsu> oh
04:51 < aditsu> then.. maybe I'll set up bind at home too
04:51 -!- grapsus [~grapsus@acces1229.res.insa-lyon.fr] has quit [Ping timeout: 276 seconds]
05:04 -!- louis_cyfer [~louisponc@65-153.104-92.cust.bluewin.ch] has joined #openvpn
05:04 < louis_cyfer> hello
05:04 < louis_cyfer> I need help
05:04 < louis_cyfer> i try to route all my traffic to my openvpn server
05:06 < aditsu> louis_cyfer: push "redirect-gateway"
05:06 < louis_cyfer> and i remove the other push ?
05:07 < aditsu> I guess so
05:07 < Bushmills> !redirect
05:07 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
05:08 <@vpnHelper> RSS Update - forum: Can ping in one direction, but not the other <http://forums.openvpn.net/topic8066.html#p11975>
05:09 < louis_cyfer> !redirect
05:09 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
05:09 < louis_cyfer> +def1
05:09 < louis_cyfer> !def1
05:09 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
05:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
05:15 < louis_cyfer> am i still here
05:15 < louis_cyfer> Ok so the route should be 
05:15 < louis_cyfer> 0/1                10.8.0.5           UGS        0      190     -     8 tun0 
05:15 < louis_cyfer> default            192.168.1.1        UGS        1    21392     -     8 bge0 
05:15 < louis_cyfer> (open bsd)
05:17 < Bushmills> missing a 128.0.0.0/1 route
05:20 <@vpnHelper> RSS Update - forum: Error by conncting on server <http://forums.openvpn.net/topic8103.html#p11977> || Do You Need All These Certs & Keys? <http://forums.openvpn.net/topic8087.html#p11976>
05:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:26 <@vpnHelper> RSS Update - forum: How to allow only 1 client to "see" all others <http://forums.openvpn.net/topic8108.html#p11979> || Server ip addressing <http://forums.openvpn.net/topic8107.html#p11978>
05:28 -!- louis_cyfer [~louisponc@65-153.104-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
05:31 -!- louis_cyfer [~louisponc@65-153.104-92.cust.bluewin.ch] has joined #openvpn
05:31 <@vpnHelper> RSS Update - forum: can ping printer but can't ping computer <http://forums.openvpn.net/topic8106.html#p11980>
05:32 < louis_cyfer> !help
05:32 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
05:34 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:38 <@vpnHelper> RSS Update - forum: $route_vpn_gateway enviro. variable and "route-gateway dhcp" <http://forums.openvpn.net/topic8105.html#p11981>
05:44 -!- louis_cyfer [~louisponc@65-153.104-92.cust.bluewin.ch] has quit [Ping timeout: 264 seconds]
05:44 <@vpnHelper> RSS Update - forum: How to allow only 1 client to "see" all others <http://forums.openvpn.net/topic8108.html#p11985> || UDPv4: Connection reset by peer <http://forums.openvpn.net/topic8094.html#p11983> || Error by conncting on server <http://forums.openvpn.net/topic8103.html#p11982>
05:50 <@vpnHelper> RSS Update - forum: Network Busy/Read Only Documents <http://forums.openvpn.net/topic8099.html#p11986>
05:54 < Kartagis> is it possible to include myself on both the server network and local network pushing both DNS servers?
05:54 < Kartagis> by pushing*
05:55 < Bushmills> "include myself"?  you want to get pushed?
05:56 < Bushmills> depends on how good a name server you are
05:56 <@vpnHelper> RSS Update - forum: How can I check that the VPN is secure? <http://forums.openvpn.net/topic8095.html#p11987>
05:56 < Kartagis> Bushmills: I mean when I VPN to a remote server, I am on that network, right? I want to be on both networks
05:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:56 < Bushmills> when you vpn to a remote server, your client has established a tunnel to that server
05:57 < Bushmills> you're not on any network, unless the operating system there helps a bit
05:58 < Bushmills> my be easier to talk in terms of where packets are routed to, rather than in terms of "being on a network"
05:58 < Kartagis> when I say "I am on a network", I mean "my client acts like it's on that network"
05:59 < Kartagis> sorry, should have been clearer
06:01 < Bushmills> your client acts as being on a network determined by its routing table.
06:01 < Bushmills> by controlling entries to that table, you control what networks it talks to
06:11 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
06:24 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p11989>
06:36 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p11990>
06:45 <@dazo> !tcpip
06:45 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
06:46 <@dazo> Kartagis: ^^^ read through chapter 3.1 ... it's really valuable to understand the networking part ... and you might understand why it's a misnomer to say "being on a network"
06:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:54 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
06:55 < Bushmills> Kartagis: pushing two name server won't do. a second name server will only be queried if the first name server fails to reply.  a reply "i don't know a host with that name" is a valid reply, and won't cause your system to try the next name server 
06:56 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
06:56 < Bushmills> and that doesn't affect what networks you are "on", only what host names are resolved to ip addresses
06:57 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
06:57 -!- Cain` is now known as Cain
07:22 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 248 seconds]
07:22 -!- Vutral [zJrmBLMvlZ@vutral.net] has joined #openvpn
07:23 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:24 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
07:32 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
07:49 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
08:13 <@vpnHelper> RSS Update - forum: Guidance needed on windows setup please <http://forums.openvpn.net/topic8043.html#p11991>
08:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
08:43 <@vpnHelper> RSS Update - forum: Bleck certain websites in openvpn clientside <http://forums.openvpn.net/topic8110.html>
08:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
08:57 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
09:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
09:08 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
09:08 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
09:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:11 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:14 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
09:14 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
09:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:24 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
09:31 <@vpnHelper> RSS Update - forum: Bleck certain websites in openvpn clientside <http://forums.openvpn.net/topic8110.html#p11993>
09:36 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:36 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
09:36 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
09:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:40 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
09:41 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
09:43 <@vpnHelper> RSS Update - forum: $route_vpn_gateway enviro. variable and "route-gateway dhcp" <http://forums.openvpn.net/topic8105.html#p11994>
09:43 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
09:43 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
09:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:45 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
09:45 -!- mode/#openvpn [+o mattock] by ChanServ
09:47 -!- MarKsaitis_ [~MarKsaiti@86.31.120.220] has joined #openvpn
09:49 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
09:54 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
10:01 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html>
10:02 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:10 -!- MarKsaitis_ [~MarKsaiti@86.31.120.220] has quit [Ping timeout: 258 seconds]
10:13 <@vpnHelper> RSS Update - forum: $route_vpn_gateway enviro. variable and "route-gateway dhcp" <http://forums.openvpn.net/topic8105.html#p11996>
10:19 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p11997>
10:20 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Remote host closed the connection]
10:24 -!- Flecks [~fleck@85.158.73.148] has quit [Changing host]
10:24 -!- Flecks [~fleck@unaffiliated/fleck] has joined #openvpn
10:24 <@vpnHelper> RSS Update - forum: $route_vpn_gateway enviro. variable and "route-gateway dhcp" <http://forums.openvpn.net/topic8105.html#p11998>
10:30 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
10:31 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
10:35 <@vpnHelper> RSS Update - forum: $route_vpn_gateway enviro. variable and "route-gateway dhcp" <http://forums.openvpn.net/topic8105.html#p11999>
10:36 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:41 < majuk> Hey guys. I have a WRT54GL with ddwrt, joining the VPN fine, but does not respond to incoming requests from the VPN. It is able to establish outbound connections no problem. Any suggestions would be great. Thanks.
10:41 <@vpnHelper> RSS Update - forum: $route_vpn_gateway enviro. variable and "route-gateway dhcp" <http://forums.openvpn.net/topic8105.html#p12002> || tunneling <http://forums.openvpn.net/topic8104.html#p12001> || Error by conncting on server <http://forums.openvpn.net/topic8103.html#p12000>
10:42 < ecrist> !configs
10:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
10:43 < majuk> Tun setup
10:43 < majuk> I'll get the full logs when I have a chance.
10:43 < majuk> logs = configs
10:46 < ecrist> no, logs != configs
10:46 < ecrist> we need your config to help
10:46 < majuk> :P
10:46 < majuk> I mean I meant to type configs
10:46 < majuk> Not logs
10:47 < ecrist> ah
10:47 < ecrist> s/logs/configs/
10:47 < majuk> Yea
10:47 < ecrist> proper syntax. ;)
10:47 < majuk> lol
10:49 < majuk> http://pastebin.com/z1xm4HdC
10:49 < majuk> ^^ server.conf
10:49 < majuk> Router client has no ccd entry
10:50 < ecrist> client config too, please
10:50 < ecrist> also, will need logs
10:50 < ecrist> !logs
10:50 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
10:50 < majuk> Yeaaaa, been trying to find the config on the router, all it seems to have is the GUI config.
10:50 < majuk> :\
10:51 < majuk> Maybe I can write out the file and point the openvpn config at it.
10:52 < ecrist> you may need to ask someone in #ddwrt
10:52 < majuk> Yea, I did, no response yet
10:53 < majuk> I think it must be something about the way the router is handling the connections. It can reach out to the server or any client no problem, so clearly it can communicate.
10:53 < majuk> So maybe it doesn't recognize the VPN connects as valid. Probably need to dig through its iptables configs.
10:54 < ecrist> I'm guessing it's firewall issue
10:54  * ecrist points to /topic
10:55 < majuk> Yea, iptables is a firewall
10:55 < ecrist> yeah, I know
10:55 < majuk> kk
10:55 < ecrist> !iptables
10:55 <@vpnHelper> "iptables" is (#1) o test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT;, or (#2) then run iptables -F, iptables -Z after being SURE policies are set to accept, or (#3) please see http://openvpn.net/man#lbBD for more info, or (#4) see http://www.secure-
10:55 <@vpnHelper> computing.net/wiki/index.php/OpenVPN/Firewall
10:56 < majuk> OH KAY. Get out my flame retardent suit, dive into the wall of fire.
11:00 < ecrist> :)
11:23 <@vpnHelper> RSS Update - forum: Openvpn ifconfig ip question. <http://forums.openvpn.net/topic8113.html>
11:32 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Leaving]
11:36 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
11:37 -!- Vutral [zJrmBLMvlZ@vutral.net] has quit [Ping timeout: 248 seconds]
11:48 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945-15.html#p12004>
11:48 -!- Vutral [ss@vutral.net] has joined #openvpn
11:57 -!- aditsu [~aditsu@119247194237.ctinets.com] has left #openvpn []
12:00 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p12005>
12:06 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
12:19 -!- fhashmi [~fh@63.139.37.2] has joined #openvpn
12:36 -!- CppIsWeird [~user@unaffiliated/cppisweird] has joined #openvpn
12:36 < CppIsWeird> im on a windows 7 openvpn client attempting to vpn to a network that i've vpn'ed from this location before. nothing about the network configurations has changed, however I can't seem to access any of the services on the remote network. the openvpn client says that the connectionw as successful and nothing seems to suggest any errors. i'm not really sure of how to proceed to debug the problem. I have tried clearing my routing table and rebooting.
12:42 <@vpnHelper> RSS Update - forum: Server selection based upon distance <http://forums.openvpn.net/topic8114.html>
12:54 -!- CppIsWeird [~user@unaffiliated/cppisweird] has quit [Ping timeout: 250 seconds]
12:58 -!- CppIsWeird [~user@unaffiliated/cppisweird] has joined #openvpn
12:58 < krzee> CppIsWeird, didnt you ask that yesterday, and they i asked for your client log?
12:59 < CppIsWeird> nope, you gave me the definition of what a serverlan was then never said a word.
13:00 < krzee> oh right
13:00 < krzee> i told you what needs to be done to route to a lan behind the server
13:01 < krzee> got mixed up for a sec  ;]
13:01 < krzee> did you check those things were done correctly?
13:01 < CppIsWeird> no worries :)
13:01 < CppIsWeird> yes, i checked them.
13:01 < krzee> so now...
13:02 < CppIsWeird> i have noticed this in my log: 1 WARNING: potential TUN/TAP adapter subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.0.0/255.255.0.0]
13:02 < krzee> can you ping the VPN ip of the server?  (i know i asked this last night)
13:02 < CppIsWeird> yes
13:02 < krzee> ohhhhh
13:02 < krzee> what is 192.168.0.0/255.255.0.0
13:02 < CppIsWeird> that is the net of the network in which i am attempting to client into
13:02 < krzee> the vpn subnet? the lan subnet of the client? the server lan?
13:02 < CppIsWeird> yes
13:03 < CppIsWeird> the lan subnet of the server
13:03 < CppIsWeird> the vpn subnet is 255.255.255.0 on 192.168.1.0
13:03 < krzee> ok lets back up
13:03 < CppIsWeird> my local client subnet is 255.255.255.0 on 192.168.0.0
13:03 < krzee> tell me the subnet for each of these 3 things:
13:04 < krzee> vpn subnet, client lan subnet, server lan subnet
13:04 < CppIsWeird> server lan subnet: 192.168.0.0/255.255.0.0
13:05 < CppIsWeird> client lan subnet: 192.168.0.0/255.255.255.0
13:05 < CppIsWeird> vpn subnet: 192.168.1.0/255.255.255.0
13:05 < CppIsWeird> umm
13:05 < CppIsWeird> no
13:05 < CppIsWeird> wait, yes.
13:06 < CppIsWeird> that's correct.
13:06 < krzee> so in the server config, you have server 192.168.1.0 255.255.255.0
13:06 < CppIsWeird> yes
13:06 < CppIsWeird> umm, crap, let me check >_<
13:06 < krzee> ok, you need to change your vpn subnet and one of your lan subnets as well
13:08 < CppIsWeird> ok, that is correct. before we proceed, this all worked perfectly fine as of two days ago for about a month, im curious as to why these changes would be required? as far as i am aware, nothing about the network configurations has changed.
13:12 < krzee> dunno, i also dunno why people always wanna know why doing it wrong used to work but doesnt now
13:12 < CppIsWeird> lol
13:12 < krzee> ive never cared to learn why doing things wrong sometimes gets the right results, i just choose to do them right
13:13 < CppIsWeird> well the reason i ask why is because i understood what i did, and i'd like to know why im making these changes becasue if i dont know why, im doomed to be clueless the next time everything goes kerplunk.
13:13 < majuk> Doin it wrong: you're doin it wrong.
13:13 < krzee> 1 * 1 + 1, regardless of the order you do those operations in, you will get the right answer
13:14 < krzee> doesnt mean that you necessarily chose the right method
13:14 < krzee> !samesubnet
13:14 <@vpnHelper> "samesubnet" is clients can not connect to a server pushing its lan if on the same subnet. you can only reach your subnet on layer2 or through your gateway, when you create a route for it you will try to reach your gateway over the vpn which dies because you cant reach your gateway
13:15 < majuk> Heyyyy found the openvpn configs in ddwrt. Hurrah
13:16 < krzee> CppIsWeird, conflicting subnets is not really something unique to openvpn
13:16 < krzee> its just that you are using openvpn to enable you to have you subnets conflict ;)
13:16 < CppIsWeird> heh
13:16 < krzee> if your server is really on the lan 192.168/16 (then your admin sucks) then you should not connect to it from any client on 192.168.*
13:17 < krzee> because you are pushing that server lan to the client, and could end up screwing up the client
13:17 < krzee> also, is there really more than 254 machines on your LAN?
13:17 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html>
13:18 < krzee> your server lan has 65534 possible ips
13:19 < krzee> is that necessary?
13:20 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
13:22 < CppIsWeird> i assume not, but i'm not the admin, just the user.
13:27  * ecrist waves at krzee
13:28 < CppIsWeird> umm, ok, im going to go test my changes. bbiam
13:28 -!- CppIsWeird [~user@unaffiliated/cppisweird] has quit []
13:34 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
13:42 <@vpnHelper> RSS Update - forum: How can I check that the VPN is secure? <http://forums.openvpn.net/topic8095.html#p12008>
13:45 -!- tflgen2 [4a5df08d@gateway/web/freenode/ip.74.93.240.141] has joined #openvpn
13:48 < tflgen2> is it possible to configure openvpn for site2site tunnel and still have road warriors connect? i.e. Machine A (client) connects to Machine B (server) and then Road Warrior C wants to connect to A. Currently Machines A+B are standalone servers.
13:48 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p12009>
13:50 -!- dazo is now known as dazo_afk
13:52 < Kartagis> what's a road warrior?
13:53 < tflgen2> road warrior aka, standard client
13:53 < tflgen2> sorry for the ambiguity
13:54 < tflgen2> i guess my question could be, Machines A+B are currently each standalone servers, is there a way to create a site2site connection between them without losing the current functionality?
13:56 < ecrist> !road-warrior
13:56 < ecrist> !google road-warrior
13:56 <@vpnHelper> Mad Max 2: The Road Warrior (1981) - IMDb: <http://www.imdb.com/title/tt0082694/>; Road Warriors - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Road_Warriors>; Road Warrior - Yu-Gi-Oh!: <http://yugioh.wikia.com/wiki/Road_Warrior>
13:57 -!- CppIsWeird [~user@unaffiliated/cppisweird] has joined #openvpn
13:59 < CppIsWeird> well i changed everything everywhere to a single subnet, resolved the issue (it no longer displays in the openvpn client log), and the same thing happened. what is interesting is that when i attempt to ping computers on the remote lan, i dont get a "Request timed out.", i get "Reply from 192.168.1.201:  Destination host unreachable"
14:01 < tflgen2> CppIsWeird: are you using tap or tun?
14:01 < CppIsWeird> tap
14:04 < krzee> ohhh
14:04 < krzee> you are bridging?
14:04 < krzee> why?
14:04 < CppIsWeird> yep
14:04 < CppIsWeird> because there is more than one computer on the remote network... ?
14:04 < krzee> that can be done in tun with proper routing
14:04 < krzee> !route
14:04 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:04 < tflgen2> use routing
14:04  * CppIsWeird facepalms
14:05 < CppIsWeird> lets just assume i want to use a bridge.
14:05 < ecrist> lol
14:06 < krzee> welp thats where you leave me behind then
14:06 < krzee> i dont help with bridges
14:06 < krzee> especially when routing should be used
14:06 < krzee> !tunortap
14:06 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
14:06 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
14:07 < krzee> tflgen2, you must use client/server mode for that
14:07  * CppIsWeird sighs
14:07 < krzee> site-to-site i assume you mean ptp, as in you use --secret <keyfile>
14:08 < tflgen2> krzee: i understand using one endpoint as a client, but can that same endpoint function as a server to other clients?
14:08 < krzee> if you run a second instance of openvpn on it as a server
14:08 < krzee> you may run as many instances of openvpn as you like ;]
14:08 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
14:08 < tflgen2> ok, so i would need two confs then :) that hopefully allows me to do it :)
14:09 < krzee> sounds like this to me:
14:09 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
14:09 < krzee> you have 2 offices, and road warriors
14:09 < krzee> your offices link via openvpn in ptp mode
14:09 < tflgen2> currently, they don't link at all
14:10 < krzee> and you want road warriors to connect in as well
14:10 < krzee> ohhh
14:10 < krzee> then you have 2 options
14:10 < CppIsWeird> guess im gonna go play with it. bbl
14:10 -!- CppIsWeird [~user@unaffiliated/cppisweird] has quit []
14:10 < krzee> you CAN setup a ptp link and a seperate road warrior link
14:10 < krzee> OR
14:10 < krzee> you can setup a server instance on 1
14:10 < krzee> let the other connect to it as a client
14:10 < krzee> let the road warriors connect to the same server as well
14:11 < tflgen2> yes, i thought of this, but the server that I am planning on leaving as the server is over in the UK with bad bandwidth. I am here in the US
14:11 < krzee> for routing to the lan behind the server, and the lan behind the client which connects the other office, you will want this:
14:11 < krzee> !route
14:11 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:11 < tflgen2> yes, i'm familliar with routing a private subnet behind a client connection
14:11 < krzee> cool
14:11 < tflgen2> have it working with dd-wrt
14:12 < tflgen2> i think i'm gonna go the 2 instances route
14:12 < krzee> thats a good way toi do it as well
14:12 < tflgen2> great, is there any way to ensure that the tunnel stays up?
14:12 < krzee> in that case there are 2 lans behind the server instance (both lans from the ptp instance)
14:12 < krzee> --keepalive
14:12 < tflgen2> and taht can be applied to both server and client daemons?
14:13 < krzee> read it in the manual, when used on the server instance it pushes to the client instance
14:13 < krzee> when used on the ptp instances, it will need to be specified on both sides
14:13 < krzee> its a helper directive, expands to other directives
14:13 < krzee> !man
14:13 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) the man pages are your friend!, or (#4) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual
14:14 < krzee> !forget man 3
14:14 <@vpnHelper> Joo got it.
14:14 < krzee> !learn man as the man pages are your friend!
14:14 <@vpnHelper> Joo got it.
14:14 < krzee> better =]
14:14 < tflgen2> you keep saying ptp....is this a really different setup? I've been under the impression that i can use PKI generated keys for clients and just specify the lan behind it
14:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:14  * krzee waves at ecrist o/
14:14 < krzee> there are 2 modes for openvpn
14:15 < krzee> ptp and server/client
14:15 < krzee> ptp can only have 2 endpoints, uses a pre-shared key
14:15 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
14:15 < krzee> server/client uses PKI
14:15 < tflgen2> aha!
14:15 < krzee> ptp has no forward security
14:15 < tflgen2> better performance?
14:15 < krzee> !factoids search --invalues secret
14:15 <@vpnHelper> (factoids search [<channel>] [--values] [--{regexp} <value>] [<glob> ...]) -- Searches the keyspace for keys matching <glob>. If --regexp is given, it associated value is taken as a regexp and matched against the keys. If --values is given, search the value space instead of the keyspace.
14:15 < krzee> !factoids search --values secret
14:15 <@vpnHelper> 'hmac', 'tls-auth', 'iphone', 'static-key', 'statickey', 'statickey', and 'topsecret'
14:15 < krzee> !statickey
14:15 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key>, or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time.
14:16 < krzee> not really
14:17 < tflgen2> ah, well both machines are setup in client/server already, I'd just attach the LAN behind one of the machines and use it as a client :)
14:17 < krzee> yep, thats one of the 2 options
14:18 < tflgen2> k, it's a production environment so i don't wanna goof :-D
14:19 < krzee> while i always recommend a dev environment for learning, i never use one myself in openvpn since im good with that stuff.... sounds like you already know that stuff well too tho
14:20 < tflgen2> yea, i've played around with it using my personal gateway as a trial run in connecting another lan.
14:20 <@vpnHelper> RSS Update - forum: Question: Bridging client TAP (linux) <http://forums.openvpn.net/topic8116.html>
14:24 -!- grendal_prime [~sgraham@71-154-139-57.ded.pacbell.net] has joined #openvpn
14:26 < grendal_prime> hey say there is a block of options i want to set for several instances of ovpn on a server.  can i use an include file in the openvpn.conf?
14:26 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html#p12011>
14:26 < krzee> grendal_prime, yes
14:27 < krzee> you can use the config option from the config
14:27 < krzee> --config
14:27 < krzee> !--
14:27 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
14:27 < grendal_prime> so...here is the rundown...we have a server has the potential to have close to 1000 connections.  So im going to run 5 instances of ovpn, 200 connections each.
14:27 < krzee> i hope your server is strong and has over 5 cores
14:27 < grendal_prime> it yas 16 actually
14:28 < krzee> good stuff
14:28 < grendal_prime> pretty cool man
14:28 < grendal_prime> how you been krzee
14:28 < krzee> good man, how about you?
14:28 < krzee> and how is optimus? ;]
14:29 < krzee> (optimus_prime)
14:29 < grendal_prime> keeping busy..
14:30 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 258 seconds]
14:31 < grendal_prime> ok so if i have my typical config file ..say 5 of them ..with the individualized tun, port, etc..configs in them then i want to store routes for all of them in  a second file say... routes.cfg.  what would the syntax to include that in the server.conf look like?
14:31 <@vpnHelper> RSS Update - forum: Official Android App <http://forums.openvpn.net/topic8117.html>
14:32 < krzee> config /path/to/file/to/include
14:32 < grendal_prime> cool..
14:32 < grendal_prime> thanks man
14:35 < krzee> np
14:35 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
14:35 < ecrist> hi patel
14:37 < majuk> ecrist, Firewall it was. Thanks again for the help.
14:38 < ecrist> :)
14:38 < ecrist> np
14:54 <@vpnHelper> RSS Update - forum: What are the proper steps to add additional client keys/cert <http://forums.openvpn.net/topic8118.html>
14:56 -!- klemax [~klemax@unaffiliated/klemax] has joined #openvpn
14:56 < grendal_prime> oh also krzee i was wrong...well forgot wich box i was working on...this one only has 12 procs.
14:57 < klemax> which method should i use for client authentication?
14:57 < grendal_prime> and 8 gigs fo ram
14:57 < krzee> grendal_prime, still plenty
14:58 < tflgen2> krzee: almost ready to try it out, but my existing LAN behind a client 192.168.20.0/24 isn't able to be reached from server LAN 192.168.1.0/24. route 192.168.20.0 255.255.255.0 and the proper iroute in ccd/clientname are all added. am i missing something basic?
14:59 < krzee> !route_outside_ovpn
14:59 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
14:59 < krzee> or maybe ip forwarding
14:59 < krzee> go read my routing document
15:02 < tflgen2> reading it, everything looks right :/
15:02 -!- CppIsWeird [~user@unaffiliated/cppisweird] has joined #openvpn
15:02 < CppIsWeird> no luck
15:04 < tflgen2> krzee: that is the route table of the SERVER. client lan is 192.168.20.0/24
15:05 < krzee> the route is right
15:05 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html#p12014>
15:05 < krzee> you still need ip forwarding on the client, and 2 routes on the client's router
15:06 < krzee> one for the vpn subnet and one for the server subnet, both pointing to the vpn client's LAN ip as the gateway
15:07 < CppIsWeird> im on a windows 7 openvpn client attempting to vpn to a network that i've vpn'ed from this location before. nothing about the network configurations has changed, however I can't seem to access any of the services on the remote network. the openvpn client says that the connectionw as successful and nothing seems to suggest any errors. i'm not really sure of how to proceed to debug the problem. I have tried clearing my routing table and rebooting.
15:08 < klemax> I'm trying to use --auth-user-pass with openvpn to read a plain text username & password.
15:08 < klemax> I got : sorry, 'Auth' password cannot be read from a file 
15:08 < krzee> !pwfile
15:08 < grendal_prime> hehehe..im getting all..."aroused,  and stuff"
15:08 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
15:08 < Bushmills> CppIsWeird: determine why you can't access those services. for example, by looking into their logs
15:09 < krzee> windows version 2.2.0 comes with that enabled
15:09 < klemax> !man --auth-user-pass
15:09 < Bushmills> make sure they're bound to the interface you address them, and that firewalls allow accessing them
15:11 < klemax> krzee: is there a script that will be able to create this file automatically?
15:11 < krzee> no
15:11 < krzee> and the manual is here:
15:11 < krzee> !man
15:11 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
15:12 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
15:12 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
15:17 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
15:23 < CppIsWeird> bushmills, nothing is getting as far as services. something vpn related. the vpn logs on both client and server report no errors. so... im lost.
15:23 < Bushmills> CppIsWeird: connecting client to server is about all openvpn can do, give and take a bit here and there
15:24 < Bushmills> what runs across it, is not openvpn policy
15:24 < CppIsWeird> hmm, i guess thats pretty much true. guess that means it has to be windows 7 client networking doing something different.
15:25 < Bushmills> !winroute
15:25 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
15:25 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
15:25 < Bushmills> what services?
15:26 < CppIsWeird> well for starters, ping. get destination host unreachable, not that its timed out. when i disconnect the vpn i get that it is timed out.
15:26 < Bushmills> route problem, it seems
15:27 < CppIsWeird> yeah, thats what i keep arriving at, but i have limited understanding of the route, to the best of my understanding the route is correct. i've even placed the vpn route to the front of the line where metric is concerned, same error.
15:27 < CppIsWeird> and the response is from my IP on the vpn.
15:27 < Bushmills> "destination host unreachable" means "there is no route to the destination"
15:28 < CppIsWeird> hmm
15:28 < Bushmills> machines way to say "i would like to, but i can't, because i don't know how"
15:28 < krzee> CppIsWeird, pastebin your client config
15:31 -!- tflgen2 [4a5df08d@gateway/web/freenode/ip.74.93.240.141] has quit [Quit: Page closed]
15:31 < Bushmills> CppIsWeird: can openvpn client ping openvpn server?
15:32 < CppIsWeird> yes
15:33 < CppIsWeird> gonna try something really quick. gotta disconnect. brb.
15:33 < Bushmills> are those services which you can't reach on openvpn server, or on different machines?
15:33 < CppIsWeird> same server
15:33 < CppIsWeird> and different machines
15:33 < Bushmills> why did you say that you "can't oing, for starters", then?
15:34 < Bushmills> ping
15:34 < CppIsWeird> oh
15:34 < CppIsWeird> ok
15:34 < CppIsWeird> i can ping the external interface to the server
15:34 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
15:34 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:34 < CppIsWeird> i cant ping it via internal ip to the remote network
15:34 < Bushmills> can you access services on openvpn server?
15:34 < dvl> backing up my Mac, via Bacula, over OpenVPN, via wireless, to my server at home: Files=65 Bytes=32,153,522 Bytes/sec=1,108,742 Errors=0
15:34 < CppIsWeird> over the vpn, no.
15:35 < Bushmills> what services?
15:35 < CppIsWeird> anything, ping, ftp, http.
15:35 < Bushmills> you can ping server, but you can't?
15:35 < CppIsWeird> i can access them all fine when physically being a memeber of the "remote network"
15:36 < CppIsWeird> nvm
15:36  * Bushmills is thoroughly confused now and grabs a beer
15:36 < CppIsWeird> the server in question has two ip's
15:36 < CppIsWeird> its internal ip, the one i want to access over the vpn
15:36 < CppIsWeird> and the ip it has on the internet
15:37 < Bushmills> access server, and services, on the openvpn server ip address
15:37 < Bushmills> other of its addresses are probably not routed through openvpn
15:38 < CppIsWeird> i guess i should be answering no when you say can i ping the server, im thinking of the server has being my internet ip... which its not, thats my router, so im retarded. sorry.
15:38 < krzee> did you post your client log yet?
15:39 < Bushmills> how is "pinging server on internet ip address" and "using openvpn" related to each other?
15:39 < Bushmills> asked differently, why would an echo request to server public address traverse openvpn tunnel?
15:39 < CppIsWeird> no
15:40 < krzee> why is everyone pastebin'ing to me via private message today!?
15:40 < krzee> and thats a CONFIG not a LOG
15:40 -!- Toba [~eastein@pysoy/developer/EricStein] has left #openvpn []
15:40 < krzee> LOL at using tap and tcp
15:41 < CppIsWeird> changing to UDP is on the list.
15:41 < CppIsWeird> i was happy it was working and left it alone until today.
15:41 < CppIsWeird> or yesterday rather, but w/e.
15:43 < ambro718> krzee: what's wrong with TAP/TCP?
15:43 < CppIsWeird> overhead
15:44 < ambro718> krzee: It's perfect if you want to transfer IPTV over a VPN. Avoids all the losses, particularly if you're on wireless.
15:44 <@vpnHelper> RSS Update - forum: Openvpn ifconfig ip question. <http://forums.openvpn.net/topic8113.html#p12015>
15:44 < krzee> !tcp
15:44 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
15:44 < krzee> !tunortap
15:44 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
15:44 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
15:44 < krzee> because for his goal he wants tun
15:44 < krzee> and because tcp over tcp is bad
15:44 < ambro718> but not with OpenVPN, it doesn't support IGMP snooping; my VPN however does :) http://code.google.com/p/badvpn/
15:44 <@vpnHelper> Title: badvpn - Peer-to-peer VPN software - Google Project Hosting (at code.google.com)
15:45 < ambro718> also, in my school UDP is blocked for some reason, so having TCP as a fallback is good
15:45 < CppIsWeird> no, for my goal, i want tap. for your goal you wan me to use tun.
15:46 < krzee> your goal is simply to route lans behind openvpn, right?
15:46 < krzee> no specific layer2 protocol>?
15:46 < krzee> (you stated that as your goal, and for that you should use tun)
15:47 < krzee> just because you decided its too hard for you to change to doing it right doesnt change anything
15:47 < ambro718> tap is much easier to configure, because with tap the VPN doesn't have to care about IP addresses. It is insecure though (e.g. ARP poisoning)
15:48 < krzee> its harder to configure assuming you understand the underlying networking stuff
15:48 < krzee> because you need to do interface configuration through a script
15:48 < krzee> and it doesnt expand as well
15:48 < krzee> and you are correct re: security
15:51 <@vpnHelper> RSS Update - forum: How can I check that the VPN is secure? <http://forums.openvpn.net/topic8095.html#p12017> || Server selection based upon distance <http://forums.openvpn.net/topic8114.html#p12016>
15:52 -!- CppIsWeird [~user@unaffiliated/cppisweird] has quit []
15:53 < krzee> who wants to make a bet
15:53 < krzee> i will bet that he comes back and says this:
15:53 < krzee> [10:36]  <CppIsWeird> im on a windows 7 openvpn client attempting to vpn to a network that i've vpn'ed from this location before. nothing about the network configurations has changed, however I can't seem to access any of the services on the remote network. the openvpn client says that the connectionw as successful and nothing seems to suggest any errors. i'm not really sure of how to proceed to debug the problem. I have tried clearing my ro
15:53 < krzee> uting table and rebooting.
15:54 < krzee> (for the 4th time)
15:56 -!- CppIsWeird [~user@unaffiliated/cppisweird] has joined #openvpn
15:57 < CppIsWeird> ok, i configured everything so that there is only ONE route to 192.168.*, and thats the vpn, and i get the same Destination host unreachable.
15:57 < CppIsWeird> btw krzee,have anything to say about my config? or is that good to go?
15:58 < krzee> i never wanted or cared about your config
15:58 < Bushmills> if that's the only route - how could openvpn possibly reach the server, to establish the tunnel?
15:58 < krzee> [13:40]  <krzee> and thats a CONFIG not a LOG
15:58 < CppIsWeird> oh
15:58 < Bushmills> i mean, you can't establish the openvpn tunnel through itself
15:59 < krzee> but honestly, when i asked for that i forgot you were still bridging
15:59 < krzee> so nevermind, unless Bushmills or someone wants to see it
15:59 < krzee> i dont help with bridges
15:59 < CppIsWeird> no, the 0.0.0.0 route still exists for internet applications (the route that im using to talk to you over irc), i just gave the route for 192.168.* higher priority than everything else
16:00 < Bushmills> i'm not very skilled with bridges.  just using them where i can't avoid it.
16:00 < CppIsWeird> and sent the route through the vpn gateway
16:00 < Bushmills> never done so with openvpn
16:00 < CppIsWeird> well, i'd be all willing to switch and everything, but i feel its not going to solve my problem.
16:00 < CppIsWeird> everything worked two days ago.
16:01 -!- klemax [~klemax@unaffiliated/klemax] has left #openvpn []
16:01 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Ping timeout: 276 seconds]
16:01 < CppIsWeird> i have no idea where the problem is, but randomly switching a huge part of the configuration seems like it would complicated resolving the current problem at hand.
16:01 < Bushmills> that means, it should still work now?
16:01 < krzee> doing it right will solve your problem
16:01 < CppIsWeird> yes bushmill, thats what that means. but since im not in the habit of refuting reality, it currently does not work.
16:01 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p12018>
16:02 < Bushmills> well, evidently something must have changed in those two days
16:02 < CppIsWeird> one would assume
16:05 < CppIsWeird> if i was using a tun and switch to a tap and things went bad, then i could understand your reasoning. it was working on a tap so switching to a tun is an unreasonable solution to fix the current problem at hand.
16:07 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html#p12021> || What are the proper steps to add additional client keys/cert <http://forums.openvpn.net/topic8118.html#p12020> || Question: Bridging client TAP (linux) <http://forums.openvpn.net/topic8116.html#p12019>
16:07 < CppIsWeird> im not here to have a debate with anyone, im here to gain advice on debugging a vpn issue. and i appreciate the help i've gotten so far, but this arguement is senseless.
16:08 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 276 seconds]
16:14 < krzee> i agree, therefor i will remove myself from the conversation
16:15 < CppIsWeird> thank you. :-)
16:17 < ecrist> what's the problem?
16:18 < Bushmills> !blame
16:18 <@vpnHelper> "blame" is According to Bushmills, it's always krzee's fault
16:19 < ecrist> IPv6 smiley.   ::]
16:20 < krzee> lol
16:21 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:25 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p12022>
16:31 -!- shutchie [~SHutchie@65.48.238.228] has joined #openvpn
16:32 < shutchie> hey all, trying to setup openvpn. this is my openvpn.conf in /etc/openvpn. openvps fails to start with this config : http://scrp.at/Zc
16:32 <@vpnHelper> Title: ScrapYrd - Viewing Scrap - http://scrp.at/Zc (at scrp.at)
16:33 < krzee> whats the logfile say?
16:33 < Bushmills> why doesn't it start?
16:35 < krzee> !logfile
16:35 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
16:35 < krzee> or if you run it in the console, it will output right to your screen
16:36 < shutchie> service openvpn start --log is suppose to log to console?
16:36 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p12023>
16:37 < krzee> no
16:37 < krzee> start it manually
16:37 < krzee> openvpn /path/to/config
16:37 < shutchie> ah ok
16:38 < shutchie> ah, getting a permission denied on the key file, gotta start wit sudo, bleh
16:39 < shutchie> unbelievable. sorry and thanks
16:39 < krzee> np
17:18 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:21 -!- grendal_prime [~sgraham@71-154-139-57.ded.pacbell.net] has quit [Quit: Ex-Chat]
17:24 < CppIsWeird> I'm sure that you douchebags will be happy to know that i fixed my problem no thanks to your worthless waste of time. you may go back to buttfucking each other! :D
17:24 -!- CppIsWeird [~user@unaffiliated/cppisweird] has quit []
17:27 < shutchie> krzee:: you afmiliar with the openvpn gui?
17:27 < shutchie> http://scrp.at/Zd
17:27 <@vpnHelper> Title: ScrapYrd - Viewing Scrap - http://scrp.at/Zd (at scrp.at)
17:29 < krzee> what the windows gui for openvpn?
17:29 < shutchie> yea
17:29 < krzee> omg you are using 2.0.9?
17:29 < krzee> go update dude
17:29 < krzee> we're on 2.2.0
17:29 < shutchie> oh that was the latest stable
17:29 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p12024>
17:29 < krzee> umm no
17:29 < krzee> 2.2.0 is the latest stable
17:30 < krzee> 2.0.9 was the latest stable years ago
17:30 < krzee> ohhh i know
17:30 < krzee> you went to openvpn.se didnt you
17:30 < krzee> !download
17:30 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
17:30 < shutchie> ah ok
17:33 < shutchie> same error tho
17:33 < shutchie> Options error: Unrecognized option or missing parameter(s) in EC2.ovpn:1: dev (2.2.0)
17:34 < krzee> is there something else on that line?
17:34 < krzee> cat the file
17:34 < krzee> from the first paste:
17:34 < krzee> ???dev
17:34 < krzee> makes me think theres a cntrl char or something on that line
17:35 < shutchie> nah nothing else on that lien
17:35 < krzee> erase the line and type out dev tun again
17:36 < shutchie> tried that o_O
17:37 < shutchie> found it
17:37 < shutchie> gotta use ansii encoding rather than utf8
17:38 < krzee> ahh there ya go
17:45 < shutchie> krzee:: alrite, seem to be connected, but browsing doesnt seem to be using the vpn
17:45 < shutchie> gave me an error for a windows rotue add command in the log
17:46 < shutchie> connect, but currently have a tcpdump running on the remote server and nothing going through
17:49 < shutchie> ah got it, run as admin necesssary
17:55 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:55 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
18:05 <@vpnHelper> RSS Update - forum: Need help with multi-homed basic setup <http://forums.openvpn.net/topic8119.html>
18:25 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
18:39 < pwrcycle> krzee: what's the best page to read about linking one openvpn server as a client to another server?
18:39 < pwrcycle> !route
18:39 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:40 < krzee> you dont
18:40 < krzee> you run another client
18:41 < pwrcycle> yeah, i mean starting another openvpn process 
18:42 < pwrcycle> before you told me SNAT to the server-client private ip was a bad idea, but will it work at all?
18:43 < krzee> i have no idea what you're talking about
18:44 < pwrcycle> for instance: -A POSTROUTING -o venet0 -j SNAT --to-source 13.28.18.15
18:44 < krzee> what is your goal?
18:44 < pwrcycle> if i connect server2 as client of server1, and have server2's IPtables changed from that to:
18:44 < krzee> you jumped right back into some old conversation we had
18:44 < pwrcycle> for instance: -A POSTROUTING -o venet0 -j SNAT
18:44 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:44 < krzee> but i dont remember any of it
18:45 < pwrcycle> --to-source 10.43.0.10
18:45 < krzee> i dont use linux
18:45 < pwrcycle> k
18:46 -!- Mobojombo [~jam@190.21.133.72] has joined #openvpn
18:46 < krzee> when i said something was a bad idea, we must have been speaking in english as opposed to iptables 
18:47 < pwrcycle> krzee: ok, let me restate my goal..
18:48 < pwrcycle> i have 2 servers, 1 in kansas, one in london.
18:48 < pwrcycle> i want to connect from my home to kansas, but i want that traffic to also be vpn'd to london.
18:48 < pwrcycle> does that make sense?
18:49 < Bushmills> pwrcycle: make london the server. make home and kansas clients
18:49 < pwrcycle> Bushmills: i want the extra hop though
18:49 < Bushmills> that way, everything between home and kansas goes through london
18:49 < Bushmills> but, that's what you were asking right now
18:50 < pwrcycle> kansas needs to be both a server and a client, but how do i set it up so kansas routing isn't totally borked
18:51 < pwrcycle> i don't want all kansas traffic to go to london, only this vpn connection
18:52 < Bushmills> when you talk home to kansas, traffic should go through london?
18:52 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html#p12026>
18:52 < pwrcycle> Bushmills: yes
18:52 < pwrcycle> home > kansas > london > (internet)
18:52 < Bushmills> make kansas server. make london and home clients
18:55 < krzee> exactly!
18:55 < krzee> what Bushmills said
18:56 < pwrcycle> but then london would not be the exit point if it's the client
18:57 < Bushmills> tell home that london is gateway
18:57 < Bushmills> why wouldn't it be the entry point to internet?
18:58 < pwrcycle> if london is a client, then it's not the exit point
18:58 < Bushmills> who says?
18:58 < pwrcycle> i was thinking that Kanas would need to be setup as both a server on 1 port, and as a client that connects to london'er sever port.
18:58 < Bushmills> but i tell you that that's not necessary
19:00 < Bushmills> if there are two ways to achieve the same, go with the simpler possibility
19:01 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
19:01 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
19:01 < Mobojombo> Hi, question:
19:02 < Mobojombo> My client config has a stanza 'up "/script.sh"'.
19:02 < Mobojombo> When I run openvpn, the script is called as "/script.sh tap0 1500 1590 init".
19:02 < Mobojombo> Is there a way to avoid the "tap0 1500 1590 init part"?
19:02 < Bushmills> just ignore them in the script
19:02 < Mobojombo> Ok, actually, is not a script, its a program
19:02 < Bushmills> script is called with those args. they do nothing unless script uses them
19:03 < Mobojombo> netcfg
19:03 < Bushmills> for program, the same is the case.
19:03 < krzee> feel free to make a script which calls the program you need called
19:03 < Bushmills> if program is not yours, call a script. let script call the program
19:04 < krzee> exactly =]
19:04 < Mobojombo> I'm trying tu run openvpn in android, so there is not much space to write scripts
19:04 < Mobojombo> I'm trying to call dhcp
19:04 < Bushmills> a script is how much? 100 bytes?
19:04 < Mobojombo> but there's no dhcpd in android, just something similar, netcfg
19:05 < krzee> i run android, i definitely have space for a 1 line shell script
19:05 < krzee> if you dont, you should probably address that issue
19:06 < Mobojombo> mmm... so openvpn always add those arguments when a script/program is called?
19:06 < krzee> also, are you sure you need tap?  i cant imagine what layer2 protocol you need on the VPN to your phone
19:06 < Mobojombo> yup
19:07 < krzee> so what layer2 protocol do you need to your phone?
19:07 < Mobojombo> there are windows clients who use tap
19:07 < Bushmills> alternatively, call shell as --up action, and execute program
19:08 < Mobojombo> openvpn is run by a android app, and that app doesn't admit that cal
19:08 < Mobojombo> l
19:09 < Bushmills> so how do you execute program if you can't execute shell?  does shell not have something like -c program  option?  if no, isn't there a more compliant shell available?
19:10 < Mobojombo> I was trying to avoid writing a script, even a small one, I thought it would be simplier if there was a way to ommit the "tap0 1500 1590 init" part added by openvpn
19:11 < Bushmills> my last suggestion doesn't involve a script
19:12 < Mobojombo> nop, actually I think there is only one openvpn gui app for android
19:12 < Mobojombo> I think I will look after a busbox version with dhcpd
19:14 -!- shutchie [~SHutchie@65.48.238.228] has quit [Ping timeout: 240 seconds]
19:16 < Bushmills> i that's easier than adding about 10 chars to the --up command line, sure
19:18 < Bushmills> increases config file size by those 10 bytes, which could be prohibitive, of course.
19:20 < Mobojombo> http://www.youtube.com/watch?v=ggXmKPMaHMo
19:20 <@vpnHelper> Title: YouTube - Do I detect a note of sarcasm? (at www.youtube.com)
19:20 -!- shutchie [~SHutchie@65.48.238.228] has joined #openvpn
19:20 < Mobojombo> jajajaja
19:26 < pwrcycle> Bushmills: are you suggesting client-to-client to achieve my goal?
19:27 < Bushmills> that can be used, but is not strictly needed
19:27 < pwrcycle> i don't see how my home gets to london via kansas then
19:28 < Bushmills> because traffic between openvpn clients goes always through openvpn server
19:29 < Bushmills> with or without client-to-client
19:32 -!- dxtr [ezvbc4@unaffiliated/dxtr] has quit [Quit: WeeChat 0.3.4]
19:52 -!- fhashmi [~fh@63.139.37.2] has quit []
19:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:07 -!- master_of_master [~master_of@p57B55812.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:11 -!- master_of_master [~master_of@p57B571EC.dip.t-dialin.net] has joined #openvpn
20:11 <@vpnHelper> RSS Update - forum: What are the proper steps to add additional client keys/cert <http://forums.openvpn.net/topic8118.html#p12027>
20:15 -!- dxtr [kdpobr@unaffiliated/dxtr] has joined #openvpn
20:20 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
20:21 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:41 -!- shutchie [~SHutchie@65.48.238.228] has quit [Ping timeout: 260 seconds]
20:42 -!- shutchie [~SHutchie@65.48.238.228] has joined #openvpn
20:43 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
21:07 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Remote host closed the connection]
21:09 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Read error: Connection reset by peer]
21:27 -!- Mobojombo [~jam@190.21.133.72] has quit [Ping timeout: 246 seconds]
21:32 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:20 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
22:20 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
22:37 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
22:39 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
22:49 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 248 seconds]
22:53 -!- vpnuser [48143ae9@gateway/web/freenode/ip.72.20.58.233] has joined #openvpn
22:54 < vpnuser> How to install tun/tap ?
22:56 -!- Rajko [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has joined #openvpn
22:56 < Rajko> hmm, bandwidth is 4x slower when using openvpn def1
22:58 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:01 -!- Rajko [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has quit [Ping timeout: 240 seconds]
23:02 < vpnuser> How to install tun/tap ?
23:03 -!- vpnuser [48143ae9@gateway/web/freenode/ip.72.20.58.233] has quit [Quit: Page closed]
23:06 -!- rajkosto [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has joined #openvpn
23:12 -!- rajkosto [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has quit [Ping timeout: 276 seconds]
23:13 -!- vpnuser [48143ae9@gateway/web/freenode/ip.72.20.58.233] has joined #openvpn
23:15 -!- vpnuser [48143ae9@gateway/web/freenode/ip.72.20.58.233] has quit [Client Quit]
23:20 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 264 seconds]
23:30 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:35 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 248 seconds]
23:37 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:43 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
23:44 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:45 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
23:49 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
23:51 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:57 -!- rajkosto [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has joined #openvpn
23:59 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
--- Day changed Sat May 14 2011
00:05 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
00:08 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
00:08 -!- rajkosto [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has quit [Ping timeout: 250 seconds]
00:13 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
00:39 -!- bitrot [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has joined #openvpn
00:42 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 260 seconds]
01:07 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
01:10 -!- bitrot [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has quit [Ping timeout: 276 seconds]
01:15 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has quit []
01:22 -!- bitrot [~rajkosto@wan.rajkonet.info] has joined #openvpn
01:22 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
01:23 -!- brian [~brian@unaffiliated/brian] has quit [Ping timeout: 276 seconds]
01:23 -!- Rajko [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has joined #openvpn
01:27 -!- bitrot [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 258 seconds]
01:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
01:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:13 <@vpnHelper> RSS Update - forum: Split Tunnel doesn't seem to be working <http://forums.openvpn.net/topic8120.html>
02:17 -!- unfancy [~unfancy@unaffiliated/unfancy] has joined #openvpn
02:17 < unfancy> hi, anyone around who can explain something about routes to me?
02:18 < unfancy> ..seems my client (cisco anyconnect) adds a crapload of routes when i establish a connection, which just makes no sense at all to me.. 
02:18 <@vpnHelper> RSS Update - forum: Split Tunnel doesn't seem to be working <http://forums.openvpn.net/topic8120.html#p12030>
02:19 < unfancy> ..it adds about 15 new routes and all i wanted was to be able to connect to a certain subnet via the VPN and have the rest go via internet
02:20 < unfancy> what route would i have to add to connect to the say 123.123.0.0 network via the vpn but have the rest run over my normal nat(ed) local network that routes to the internet tubes?
02:31 -!- unfancy [~unfancy@unaffiliated/unfancy] has quit [Ping timeout: 260 seconds]
02:33 -!- Rajko [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
02:34 -!- Rajko [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has joined #openvpn
02:51 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
02:54 -!- Mobojombo [~jam@190.21.133.72] has joined #openvpn
03:07 <@vpnHelper> RSS Update - forum: Configure clients to access all networks <http://forums.openvpn.net/topic8121.html>
03:09 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 264 seconds]
03:12 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
03:23 -!- Rajko [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has quit [Ping timeout: 276 seconds]
03:27 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Remote host closed the connection]
03:28 -!- rajkosto [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has joined #openvpn
03:33 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
03:36 -!- Rajko [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has joined #openvpn
03:36 -!- rajkosto [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
03:39 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 264 seconds]
03:40 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
03:43 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
03:44 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
03:50 -!- |Mike| [~mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
03:56 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
03:59 -!- Rajko [~rajkosto@cable-94-189-245-251.dynamic.sbb.rs] has quit [Ping timeout: 276 seconds]
04:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:27 -!- Mobojombo [~jam@190.21.133.72] has quit [Ping timeout: 246 seconds]
04:42 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
05:08 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
05:13 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Ping timeout: 276 seconds]
05:25 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
05:26 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Client Quit]
05:44 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
06:06 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
06:10 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
06:11 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has joined #openvpn
06:27 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
06:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:58 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:00 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
07:00 -!- Cain` is now known as Cain
07:24 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 276 seconds]
08:00 -!- LeilaK [~torgeir@94-246-17.67.3p.ntebredband.no] has quit [Remote host closed the connection]
08:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:09 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Ping timeout: 250 seconds]
08:14 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
08:14 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has quit [Changing host]
08:14 -!- brian [~brian@unaffiliated/brian] has joined #openvpn
08:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:39 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
08:52 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
08:55 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
09:01 -!- EmperorTom is now known as QU4DDAMMAG3
09:18 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:24 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:30 -!- mordy [~mordy@5acc3a82.bb.sky.com] has joined #openvpn
09:33 < mordy> is there a way to have the route-up script make the client process exit if it fails? or perhaps some other way to craft this?
09:34 < hyper_ch> yes
09:36 < mordy> well, how?
09:37 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
09:38 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:53 < ecrist> use the management interface to disconnect the client.
09:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:28 -!- unfancy [~unfancy@chello080109084214.2.15.vie.surfer.at] has joined #openvpn
10:28 -!- unfancy [~unfancy@chello080109084214.2.15.vie.surfer.at] has quit [Changing host]
10:28 -!- unfancy [~unfancy@unaffiliated/unfancy] has joined #openvpn
10:43 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:44 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Disconnected by services]
10:45 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Client Quit]
10:45 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
10:50 < pwrcycle> what iptables rules would keep one client from reaching another client on the same server's network?
10:57 <@vpnHelper> RSS Update - forum: Required *minimum* HW to run OpenVPN server <http://forums.openvpn.net/topic8122.html>
11:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:12 < pwrcycle> !op bayashi 
11:12 <@vpnHelper> Error: You don't have the #openvpn,op capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
11:12 < pwrcycle> ww.
11:21 <@vpnHelper> RSS Update - forum: Split Tunnel doesn't seem to be working <http://forums.openvpn.net/topic8120.html#p12033>
11:37 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 260 seconds]
11:39 <@vpnHelper> RSS Update - forum: Client cannot access hosts inside vpn <http://forums.openvpn.net/topic8123.html>
11:41 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
11:41 < ecrist> pwrcycle: nice try
11:46 -!- Vutral [ss@vutral.net] has joined #openvpn
11:49 -!- concept [~concept@is.a.hax0r.se] has joined #openvpn
11:53 < concept> Hello all. Does anyone want to help me a bit with some multiple openvpn instances on multiple servers handing out static ips? The connections work. the routing(?) does not. Using dev tap of course. 
11:53 -!- researcher31 [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
11:55 < researcher31> good day. I am running openvpn in centos and I create user using kloxo, i need to backup those users data and related information. what linux directory must I backup? thanks
11:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:58 < concept> researcher31: I dont use centos and not kloxo, but the default dir for openvpn is /etc/openvpn and in the config file it should say where it keeps the data. 
11:58 < concept> that is if its not in /etc/openvpn
12:00 < researcher31> concept: i have seen that directory but it does not contain my users information. only the openvpn files are there.
12:01 < concept> researcher31: the config file in that directory should tell you where it looks for keys and client configs.
12:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
12:19 < concept> !welcome
12:19 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:20 < concept> !goal
12:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:20 -!- TANATHOS [~tanathos@87.119.205.84] has joined #openvpn
12:20 < TANATHOS> !welcome
12:20 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:20 < TANATHOS> !goal
12:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:21 < TANATHOS> !route
12:21 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:22 -!- unfancy [~unfancy@unaffiliated/unfancy] has quit [Read error: Operation timed out]
12:24 < researcher31> help 
12:25 < TANATHOS> Hi, I have a box with real ip xxx.xxx.xxx.xxx assigned from a vpn server, what is it necessary to do to connect to xxx.xxx.xxx.xxx from the internet without having the need to have them join the vpn
12:25 < ecrist> ip xxx.xxx.xxx.xxx isn't a real ip
12:26 -!- researcher31 [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
12:26 <@vpnHelper> RSS Update - forum: How to setup multiple VPS servers using same ca.cert? <http://forums.openvpn.net/topic8124.html>
12:26 < TANATHOS> ecrist sorry , it's 10.8.0.1, you are right not a real one
12:26 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
12:27 < TANATHOS> I just want to be able to connect to a box through a real ip with routing through vpn
12:27 < ecrist> all-caps nick names suck, too, fwiw
12:27 -!- MarKsaitis [~MarKsaiti@client-86-31-252-98.oxfd.adsl.virginmedia.com] has joined #openvpn
12:28 < ecrist> so, you want to assign pulicly routable IPs through your vpn?
12:28 -!- TANATHOS is now known as tanathos
12:28 < tanathos> ecrist I don't know what I need to do
12:28 < tanathos> but probably yes
12:31 < tanathos> may I know how to do that?
12:34 < ecrist> well, the usual way is to get a block of IPs you can hand out at your colo, separate from your server IP space, and have the DC route those to your server IP
12:34 < ecrist> the problem you're going to run in to is that you cannot push a route across the vpn that conflicts with your vpn server address
12:35 < tanathos> ecrist, I am on a vpn now and running a webserver I want to be able to connect to my webserver through my vpn address
12:36 < ecrist> that's easy
12:36 < tanathos> I am listening
12:36 < ecrist> and totally different from what you initially asked
12:36 < ecrist> !howto
12:36 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:36 < ecrist> check that out
12:36 < tanathos> I am really sorry for not being more specific 
12:37 < tanathos> ok, no offence I've been there first and then on google with no luck
12:37 < tanathos> maybe I didn't know how to research the rigth question
12:37 < ecrist> if you go to the howto page, it tells you exactly what to do.
12:38 -!- unfancy [~unfancy@unaffiliated/unfancy] has joined #openvpn
12:38 < tanathos> ok thank you very much
12:38 < ecrist> the line here, though, I'm not going to setup your VPN for you, but I'm happy to help you through the process
12:40 < tanathos> I fully understand that and the only requirement was to point me in the right direction eg. check iptables, check routing traffic, check certificates and so on
12:40 < ecrist> get a base config going, based on the howto, make sure you're pushing the right routes, and when you have that much, if you have problems, ask in here. :)
12:42 < tanathos> ok I might have not explained myself well enough, I have the vpn working, server is linux client is windows, everyting is working, I tried pushing redirect-gateway, doing a nat I saw in the howto,
12:43 -!- unfancy [~unfancy@unaffiliated/unfancy] has left #openvpn []
12:43 < tanathos> but I am unable to redirect traffic from the external ip through the vpn to the client
12:43 < tanathos> I want to run a service (eg webservice) and to be able to connect to it with the vpn adress 
12:44 < tanathos> my isp does not provide a public address and I want to use the public address from a vps I rented through vpn
12:44 < tanathos> it doesn't get much clearer than that :D
13:02 < ecrist> if you're hosting the webserver yourself, you just need to put a route to the VPN on the web server
13:02 < ecrist> no nat needed
13:04 < tanathos> just a route in the server to ip and port?
13:04 < ecrist> just ip.  ports aren't routed
13:05 < tanathos> ok thank you
13:25 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 240 seconds]
13:30 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:33 -!- QU4DDAMMAG3 is now known as quad_damage
13:35 < tanathos> ecrit, I adeed iptables -t nat -A POSTROUTING -s 10.8.0.3 -o eth0:3 -j MASQUERADE, with no luck
13:35 < tanathos> *ecrist, sorry
13:35 < ecrist> !iptables
13:35 <@vpnHelper> "iptables" is (#1) o test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT;, or (#2) then run iptables -F, iptables -Z after being SURE policies are set to accept, or (#3) please see http://openvpn.net/man#lbBD for more info, or (#4) see http://www.secure-
13:35 <@vpnHelper> computing.net/wiki/index.php/OpenVPN/Firewall
13:54 -!- f1assistance [~Carl@cpe-024-162-230-038.nc.res.rr.com] has left #openvpn []
14:18 < takamichi> If I restart OpenVPN server (to change the verb level) wht is the likelihood of connected users being disconnected?
14:22 < Bushmills> about 100 %
14:23 < Bushmills> give and take a few picopercents, quantum effects
14:24 < takamichi> Bushmills: Thats close enough for me :)
14:24 < takamichi> Bushmills: Im surprised though
14:25 < Bushmills> server loses client virtual ip to real ip relationship on restart
14:26 < takamichi> Bushmills: What if I'm using ifconfig-pool-persist?
14:29 < Bushmills> server still needs to rebuild those relationships after restart
14:29 < Bushmills> ifconfig-pool-persist associates common name with virtual ip address
14:30 < Bushmills> but server doesn't know on what ip address is the other end of a tunnel of a not-yet-established client connection on a specific virtual ip address 
14:31 < Bushmills> so, if there's a packet to client on virtual ip address x, where will it go to?
14:31 < Bushmills> doesn't help if server knows the CN of the client which last had that virtual ip address assigned to.
14:33 -!- tanathos [~tanathos@87.119.205.84] has left #openvpn []
14:38 -!- MarKsaitis [~MarKsaiti@client-86-31-252-98.oxfd.adsl.virginmedia.com] has quit [Ping timeout: 258 seconds]
14:42 -!- rly [~rly@unaffiliated/rly] has joined #openvpn
14:42 < rly> !howto
14:42 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:42 -!- lapsusbrutus [~ah@158.254.202.84.customer.cdi.no] has joined #openvpn
14:42 < lapsusbrutus> !howto
14:42 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:44 < dvl> !howto
14:44 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:44 < dvl> Yes, it definitely works.
14:44 -!- simonlnu [simon@unaffiliated/simonrvn] has joined #openvpn
14:45 < simonlnu> !howto
14:45 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:45 < simonlnu> thank you
14:45 -!- simonlnu [simon@unaffiliated/simonrvn] has left #openvpn ["."]
15:00 < takamichi> Bushmills: thank you for the explanation, much appreciated
15:01 < Bushmills> you're welcome
15:01  * krzee doubletakes at the recent scroll
15:01 < krzee> lol
15:02 < Bushmills> because of the !howto flood?
15:02 -!- MarKsaitis [~MarKsaiti@client-86-31-252-98.oxfd.adsl.virginmedia.com] has joined #openvpn
15:36 -!- MarKsaitis [~MarKsaiti@client-86-31-252-98.oxfd.adsl.virginmedia.com] has quit [Quit: Leaving]
16:00 -!- lapsusbrutus [~ah@158.254.202.84.customer.cdi.no] has quit [Ping timeout: 246 seconds]
16:00 -!- lapsusbrutus [~ah@158.254.202.84.customer.cdi.no] has joined #openvpn
16:22 <@vpnHelper> RSS Update - forum: What are the proper steps to add additional client keys/cert <http://forums.openvpn.net/topic8118.html#p12037> || Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p12036>
16:27 < krzee> ya
16:27 <@vpnHelper> RSS Update - forum: Split Tunnel doesn't seem to be working <http://forums.openvpn.net/topic8120.html#p12040> || Required *minimum* HW to run OpenVPN server <http://forums.openvpn.net/topic8122.html#p12039> || Configure clients to access all networks <http://forums.openvpn.net/topic8121.html#p12038>
16:28 < krzee> and a couple of them came from people who didnt see the previous !howto's
16:28 < krzee> heh
16:30 < Bushmills> well, debianers know where to start digging for information :)
16:32 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has joined #openvpn
16:32 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has quit [Changing host]
16:32 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
16:34 <@vpnHelper> RSS Update - forum: How to setup multiple VPS servers using same ca.cert? <http://forums.openvpn.net/topic8124.html#p12042> || Client cannot access hosts inside vpn <http://forums.openvpn.net/topic8123.html#p12041>
16:58 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
17:20 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
17:57 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:22 -!- rly [~rly@unaffiliated/rly] has quit [Quit: WeeChat 0.3.3]
18:31 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
18:31 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:46 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Remote host closed the connection]
18:56 -!- quad_damage is now known as EmperorTom
19:03 < pwrcycle> !ipforward
19:03 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
19:03 < pwrcycle> !linipforward
19:03 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
19:17 < pwrcycle> if i want to use a different gateway on the vpn network than the server i connect to, what would the correct statement be in the config?
19:18 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 252 seconds]
19:20 < krzee> route-gateway, i think it matters what you put this before / after
19:20 < krzee> bbl
19:20 < pwrcycle> k
19:35 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html#p12043>
19:47 <@vpnHelper> RSS Update - forum: Configure clients to access all networks <http://forums.openvpn.net/topic8121.html#p12044>
19:48  * ecrist waves
19:48 -!- lapsusbrutus [~ah@158.254.202.84.customer.cdi.no] has quit [Quit: Lost terminal]
20:05 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
20:07 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Remote host closed the connection]
20:08 -!- master_of_master [~master_of@p57B571EC.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:12 -!- master_of_master [~master_of@p57B530B3.dip.t-dialin.net] has joined #openvpn
20:42 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
21:20 -!- EugeneKay [EugeneKay@jedediahsmith.kashpureff.com] has joined #openvpn
21:21  * EugeneKay blinks
21:21 < EugeneKay> 2.2.0 is out? How's IPv6?
21:23 < ecrist> it's on it's way
21:23 < ecrist> it's still incomplete, but there's basic support now.
21:23 < ecrist> see the man page
21:23 < ecrist> we're planning full support for IPv6 in 2.3
21:29 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html#p12045>
22:06 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 264 seconds]
22:20 -!- Vutral [ss@vutral.net] has joined #openvpn
22:29 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:41 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:41 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Quit: No Ping reply in 180 seconds.]
23:15 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:19 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
23:28 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
23:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
23:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
--- Day changed Sun May 15 2011
00:15 -!- EugeneKay [EugeneKay@jedediahsmith.kashpureff.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
00:17 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
00:20 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Client Quit]
00:20 -!- EugeneKay [EugeneKay@kashpureff.com] has joined #openvpn
00:21 -!- EugeneKay is now known as Guest78523
00:22 -!- Guest78523 is now known as EugeneKaway
00:22 -!- EugeneKaway is now known as EugeneKay
00:29 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
00:29 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
00:29 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
00:58 -!- EugeneKay is now known as EugeneKaway
01:16 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Disconnected by services]
01:16 -!- Hamlin_ [~Hamlin@unaffiliated/hamlin] has joined #openvpn
01:22 -!- Hamlin_ [~Hamlin@unaffiliated/hamlin] has quit [Ping timeout: 276 seconds]
01:22 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
01:32 -!- takamichi [Takamichi@78.133.37.249] has quit [Read error: Operation timed out]
01:32 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
02:24 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
02:55 <@vpnHelper> RSS Update - forum: Required *minimum* HW to run OpenVPN server <http://forums.openvpn.net/topic8122.html#p12046>
03:12 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
03:12 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
03:33 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
03:54 -!- bystander [48143ae9@gateway/web/freenode/ip.72.20.58.233] has joined #openvpn
03:54 < bystander> hello, I would like to ask what is the mean of  (  iptables -A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT  )
04:00 < hyper_ch> what does the iptables man page say about it?
04:01 < bystander> hyper_ch: I guess they are asleep
04:01 < roentgen> with 2.2.0 I don't an IPV6 address anymore
04:01 < roentgen> Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:1: ifconfig-ipv6 (2.2.0)
04:01 < roentgen> did anything change on the client side options
04:02 < roentgen> or maybe on the compile flags for it?
04:02 < roentgen> both client and server are Linux
04:02 < roentgen> and 2.1.4 did work with ipv6
04:15 -!- bystander [48143ae9@gateway/web/freenode/ip.72.20.58.233] has quit [Quit: Page closed]
04:19 <@vpnHelper> RSS Update - forum: Client cannot access hosts inside vpn <http://forums.openvpn.net/topic8123.html#p12047>
04:25 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p12048>
04:31 <@vpnHelper> RSS Update - forum: Security question <http://forums.openvpn.net/topic8126.html> || Push webdomains to clients <http://forums.openvpn.net/topic8125.html>
04:34 -!- EugeneKaway [EugeneKay@kashpureff.com] has quit [Read error: Operation timed out]
04:55 <@vpnHelper> RSS Update - forum: multiple clients <http://forums.openvpn.net/topic7803.html#p12051>
05:07 <@vpnHelper> RSS Update - forum: multiple vps using one ca.crt on client config <http://forums.openvpn.net/topic8127.html>
05:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
05:25 -!- luneff [~yury@84.51.197.177] has joined #openvpn
05:25 <@vpnHelper> RSS Update - forum: vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p12053>
05:29 -!- bitterman [~yury@84.51.197.177] has joined #openvpn
05:30 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
05:31 -!- bitterman [~yury@84.51.197.177] has quit [Client Quit]
05:31 -!- luneff [~yury@84.51.197.177] has joined #openvpn
05:59 <@vpnHelper> RSS Update - forum: Help needed to setup my vps with vpn on port 53 <http://forums.openvpn.net/topic7991.html#p12054>
06:55 -!- EugeneKaway [EugeneKay@kashpureff.com] has joined #openvpn
06:59 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:00 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
07:00 -!- Cain` is now known as Cain
07:03 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
07:44 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
08:21 -!- codebeaker [~codebeake@188-192-24-211-dynip.superkabel.de] has joined #openvpn
08:24 < codebeaker> hi all, I'm following the guides for both Ubuntu, and the OpenVPN example guide, and I must have read-over something, I'm getting "Since you are using --dev tap, the second argument to --ifconfig must be a netmask, for example something like 255.255.255.0." followed by "Linux ifconfig failed: external program exited with error status: 1"
08:24 < codebeaker> there's nothing about netmasking in either my client or server configs, I'm suing the routed setup, and it works for my desktop clients (using Shimo)
08:25 < codebeaker> but not for my linux configured (ubuntu+openvpn) clients
08:37 < Bushmills> !tunortap
08:37 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
08:37 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
08:37 < Bushmills> Since you are using --dev tap, the second argument to --ifconfig must be a netmask.
08:38 < codebeaker> Bushmills: thanks, I don't have an --ifconfig line anywhere in my configuration
08:39 < codebeaker> so, sounds like the problem is that normally client, or serverside at best?
08:39 < codebeaker> I seem, from my reading to get that you can put it on either side, but there's different reasons for each?
08:40 < codebeaker> looks like I want `tun` though, even though I cna't "bridge"
08:40 < codebeaker> as far as I understood, if I "bridge" - then my VPN clients join the server's LAN directly, which my colo host won't allow
08:40 < codebeaker> (because the LAN is shared there)
08:44 < Bushmills> not sure what you call "directly".  through tap, traffic destined to MAC addresses is passed.  through tun, ip traffic, to ip addresses, goes.
08:45 < codebeaker> Bushmills: ok, thanks - (sorry, experiementing with IP/VPN for the first time, not something I come across too often as a programmer)… my VPSs all have addresses like 192.168.154.127/255.255.128.0 … and it's important that VPN clients don't take an address in that range
08:45 < Bushmills> !1918
08:45 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
08:46 < codebeaker> yes, so I planned to put my VPN on `10.77.22.0 255.255.255.0`
08:46 < codebeaker> but if I understood correctly that's a "routed network" not a "bridged"
08:47 < Bushmills> using tun, yes. routed
08:47 < Bushmills> your OS will have/need a routing table entry ("route") with a destination host or network
08:48 < codebeaker> ok using tun not tap all the warnings went away…
08:48 < codebeaker> (so thank you for that tip, I really need to read into that some more)
08:50 < Bushmills> you also happen to use tcp as openvpn protocol?
08:50 < codebeaker> I might have that selected… but I gather udp is better
08:50 < codebeaker> … because tcp over tcp tunnels doesn't make any sense
08:50 < Bushmills> !tcp
08:50 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
08:50 < Bushmills> right
08:51 < codebeaker> :) Bushmills thanks again man, totally helping me out today
08:51 < Bushmills> seems that unneed tap config goes often hand in hand with selection of tcp protocol 
08:51 < Bushmills> unneeded
08:51 < codebeaker> so TAP is more like absolute, raw metal virutal devices, and tap is IP levle
08:51 < codebeaker> level*
08:52 < Bushmills> tun is
08:52 < codebeaker> erm, tun is IP level
08:52 < codebeaker> sorry!
09:01 < codebeaker> Bushmills: is there any 'go-to- book on programming for tun/tap
09:01 < codebeaker> I'd like to understand better how they work
09:16 -!- codebeaker [~codebeake@188-192-24-211-dynip.superkabel.de] has quit [Read error: No route to host]
09:18 -!- codebeaker [~codebeake@188-192-24-211-dynip.superkabel.de] has joined #openvpn
09:38 -!- codebeaker [~codebeake@188-192-24-211-dynip.superkabel.de] has quit [Read error: Connection reset by peer]
10:12 <@vpnHelper> RSS Update - forum: I give up, pls help me. - Firewall/routing problem <http://forums.openvpn.net/topic8128.html>
10:42 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has joined #openvpn
10:42 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has quit [Client Quit]
10:44 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:55 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
10:55 -!- mode/#openvpn [+o mattock] by ChanServ
10:57 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
11:05 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
11:05 < Rajko> any way to increase the throughput ?
11:05 < hyper_ch> ???
11:07 < Rajko> if i download a file from a webserver rnning vpn using its wan ip (so it doesnt go throug the vpn) i get like 3MB/s
11:07 < Rajko> if i download the same file using its vpn ip (so it does go through the vpn) i get 2.2MB/s
11:09 < Rajko> if i dont use a download manager (so just one connection) then the throughput is especially wose
11:10 < hyper_ch> if I do server to server connection I almost hit 10MB/s on a 100mbit connections
11:10 < hyper_ch> so I guess your limiting factor is somewhere else
11:10 < Rajko> the latency between client and server is 46-60ms
11:11 < hyper_ch> how is latency important for throughput?
11:13 < Rajko> whats your config file look like
11:13 < Rajko> do you have anything related to mssfix or mtu
11:13 -!- EugeneKaway is now known as EugeneKay
11:42 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Remote host closed the connection]
12:26 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:26 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:28 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
12:43 <@vpnHelper> RSS Update - forum: server speed decreasing after kloxo installation <http://forums.openvpn.net/topic8078.html#p12056>
12:45 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Read error: Connection reset by peer]
12:46 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
12:48 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
12:49 <@vpnHelper> RSS Update - forum: How to route through a VPN server for a single remote web? <http://forums.openvpn.net/topic7636.html#p12057>
13:10 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
13:13 < AndrewX192> Hey, all, I have a problem with OpenVPN Server on a Linux box, the server and client are able to communicate, and acess each other via the VPN, but the client cannot access the Internet. Where should I start to debug the issue?
13:16 < AndrewX192> I have errors like "MULTI: bad source address from client" in my OpenVPN logs file.
13:18 < Bushmills> !redirect
13:18 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:18 < AndrewX192> !ipforward
13:18 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
13:19 < AndrewX192> !lipforward
13:19 < AndrewX192> !linipforward
13:19 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
13:19 < AndrewX192> !nat
13:19 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:20 < AndrewX192> I have scripts to do all of this, but they quit working after a reboot and I don't know why they quit working.
13:21 < Bushmills> "quit working"?
13:23 <@vpnHelper> RSS Update - forum: Setting up a windows server <http://forums.openvpn.net/topic8129.html>
13:24 < Bushmills> well, fix your scripts then
13:28 < AndrewX192> The IP address changed, so I fixed the scripts to make the change, but it's still not right.
13:29 < Bushmills> then you haven't fixed them
13:29 < AndrewX192> I am on a mobile phone trying to fix the issue.
13:30 -!- codebeaker [~codebeake@188-192-24-211-dynip.superkabel.de] has joined #openvpn
13:30 < codebeaker> !welcome
13:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:30 < codebeaker> !howto
13:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:36 < AndrewX192> So, how can I fix the " MULTI: bad source address from client" error? I'm not seeing anything wrong with the scripts.
13:38 < Bushmills> you possibly route network packets to openvpn with a source address not within the oenvpn subnet
13:39 < Bushmills> openvpn
13:41 < Bushmills> though there can be different reasons for that message. if a problem with your scripts causes these, fix your scripts 
13:41 < codebeaker> I have four servers all with addresses like 192.168.154.127/255.255.255.128.0, I'm trying to use one of the servers to be a VPN to give the aforementioned LAN access to remote clients, lan addresses from openvpn should be something like 10.77.22.x/24
13:41 < AndrewX192> So, an issue on the client (the phone) or the server?
13:41 < Bushmills> the client is the most likely cause
13:42 < codebeaker> I didn't know if it was important for all servers to join the VPN, but I think if I got my understanding right – then I only need VPN to the `utility` server, then I should be able to so push "route 192.168.154.0 255.255.128.0" - to allow my VPN clients to route to the lan ?
13:42 < Bushmills> codebeaker: interesting netmask you're using
13:42 < codebeaker> it's a slightly strange one from Linode's static LAN
13:42 < AndrewX192> Bushmills: shall I pastebin the client config?
13:43 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
13:43 < Bushmills> AndrewX192: possibly helpful, but others will have to look at them - i'm about to hit  the road
13:43 < Bushmills> !serverlan
13:43 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
13:44 < Bushmills> codebeaker: ^^^
13:44 < Bushmills> or,
13:44 < Bushmills> !route
13:44 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:44 < codebeaker> thank you Bushmills more reading :-D
13:44 < AndrewX192> http://pastebin.com/d2euZrJT
13:44 < codebeaker> but, that's the sane way, more sane than having LAN servers (which can already see eachother) use a VPN, too
13:44 < codebeaker> ^ right ?
13:45 < Bushmills> openvpn server can't talk to another openvpn server.  openvpn clients can talk to openvpn server
13:45 < AndrewX192> The client is on OpenVPN 2.1.1
13:46 < Bushmills> s/can't talk/can't establish openvpn connection/
13:47 < Bushmills> they may still be able to talk, but not through openvpn server to openvpn server connection
13:47 < AndrewX192> I am wireless (IPv4) right now.
13:52 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 252 seconds]
13:53 < codebeaker> what does "inet 10.77.22.6 --> 10.77.22.5 netmask 0xffffffff" represent in my client tun0 `ifconfig` output ? Is that to make clear that I'm forwarding?
13:58 < AndrewX192> I don't see anything wrong with the client...
14:02 < codebeaker> !tls
14:03 < codebeaker> ahh, shame - I was hoping it could teach me something about "Sun May 15 19:02:17 2011 us=767264 TLS State Error: No TLS state for client [AF_INET]188.192.24.211:50150, opcode=6"
14:06 < codebeaker> What's wrong with "route 192.168.154.0 255.255.128.0" it causes "route: netmask doesn't match route address" – but that's what my host are giving me?
14:06 < roentgen> !git
14:06 <@vpnHelper> "git" is (#1) OpenVPN testing: git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git, or (#2) Browse Git: http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=summary
14:08 -!- Roelke [~Roelke@95-36-36-169.dsl.alice.nl] has joined #openvpn
14:13 < Roelke> !goal
14:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:13 < Roelke> !welcome
14:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:13 < Roelke> !route
14:14 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:14 < codebeaker> Bushmills: you commented on my unusual netmask earlier… is that likely to be a problem ?
14:23 < Roelke> My hoster has given me more then 1 TUN device, so i can use more than 1 client simultaneously, is it possible to use them all on the same port ? 
14:23 < Roelke> when i add more then 1 TUN device to the config 
14:23 < Roelke> only the first client works
14:24 < Roelke> the log is saying TLS error, restarting
14:27 -!- Vutral [FzvCISOho9@vutral.net] has joined #openvpn
14:28 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:30 < codebeaker> I've narrowed my issue down to "TLS State Error: No TLS state for client [AF_INET]188.192.24.211:60866, opcode=6" – but I don't know why there are TLS problems, I thought I had TLS disabled
14:31 < codebeaker> !tls
14:34 -!- Vutral [FzvCISOho9@vutral.net] has quit [Ping timeout: 260 seconds]
14:42 < Rajko> how do i test mtu and bandwdith between client and TLS server ?
14:43 < hyper_ch> what is mtu even for?
14:43 < Rajko> there are commands in openvpn for it
14:43 < Rajko> i just dont know how to use them
14:43 < Rajko> hyper_ch, so that ip fragmentation doesnt happen
14:44 < hyper_ch> and what is ip fragmentation?
14:45 < Rajko> when an udp packet + its ip header exceed the typically 1500 ethernet mtu
14:45 -!- fuho [~fuho@ool-43548d72.dyn.optonline.net] has joined #openvpn
14:46 < fuho> !goal
14:46 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:46 < fuho> !welcome
14:46 < hyper_ch> so what does 1500 mean?
14:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:46 < hyper_ch> a package is 1500 bits?
14:47 < hyper_ch> hi fuho
14:47 < codebeaker> http://en.wikipedia.org/wiki/Maximum_transmission_unit
14:47 <@vpnHelper> Title: Maximum transmission unit - Wikipedia, the free encyclopedia (at en.wikipedia.org)
14:47 < fuho> hyper_ch: Hi
14:47 < fuho> !redirect
14:47 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:48 < fuho> !def1
14:48 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
14:48 < hyper_ch> thx codebeaker
14:48 < codebeaker> sure
14:48 < fuho> !ipforward
14:48 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:49 < fuho> !linipforward
14:49 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
14:50 < hyper_ch> fuho: anything we can help you with?
14:51 < Roelke> is there anybody who can tell me if i can use more than 1 TUN device on a single port ? 
14:52 < fuho> hyper_ch: Most definitely :) I am trying to setup OpenVPN with access to the internet. I have VPS with OpenVPN setup, I can connect to it, access my subnet on VPN but can'T access internet.
14:52 < codebeaker> Roelke: you should be able to connect multiple clients to one tun device
14:52 < codebeaker> you cannot listen on a port with more than one device, of any kind
14:52 < codebeaker> (at least, as far as I know, but I may need to be corrected there)
14:52 < hyper_ch> fuho: def1 is what is needed and ipforward
14:53 < fuho> hyper_ch: Thanks I looked at that, but I am very VERY new to server administration so it doesn't really make much sense to me.
14:53 < Roelke> codebeaker, my VPS provider said i wasn't.
14:54 < codebeaker> depends on client keys… but you can connect any number of clients to one server (which listens on a device()
14:54 < hyper_ch> with def1 you also need to set nameservers IIRC
14:55 < hyper_ch> fuho: e.g. add this to your server.conf  http://pastebin.com/4z6RGrqa
14:56 < codebeaker> hyper_ch: you could also give me a firm kick in the right direction if you had 5 seconds – https://gist.github.com/6073066fee8f3451db3a – client can ping the VPN server, but nothing in the server's lan, config file for server is there, client config isn't available, as I'm using Shimo on OSX – I've tried screwing around will all sorts of TLS info, but I'm missing out :(
14:56 <@vpnHelper> Title: leehambley's gist: 6073066fee8f3451db3a Gist (at gist.github.com)
14:56 < hyper_ch> fuho: what distro do you run?
14:56 < codebeaker> (also, whole connection isn't using TLS, as far as I know)
14:56 < hyper_ch> codebeaker: why push the routes?
14:56 < hyper_ch> ah... server lan
14:57 < codebeaker> hyper_ch: goal is to allow clients to reach LAN servers at Linode…
14:57 < hyper_ch> never tried that :)
14:57 < codebeaker> so, at least I think that's the right config, but this is my first ever openvpn setup
14:57 < hyper_ch> !tunortap
14:57 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:57 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
14:57 < codebeaker> i'm using tun, right ?
14:57 < hyper_ch> that's not what I was looking for
14:57 < codebeaker> damn, right
14:57 < fuho> hyper_ch: Also what I don't get is that it used to work, I got it to work on my other computer couple months ago, now I have a new one this time I am using Ubuntu as a client. Server is Ubuntu server 10.04 lts
14:58 < hyper_ch> fuho: paste configs
14:59 < hyper_ch> !ptp
14:59 < hyper_ch> !route
14:59 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:59 < hyper_ch> codebeaker: read the above
14:59 < codebeaker> hyper_ch: I read that… but that's not exactly how it needs to work for me, I'm not joining multiple lans
15:00 < fuho> hyper_ch: I already have redirect gateway in conf. >push "redirect-gateway"< http://pastebin.com/sFi9TT0t
15:00 < hyper_ch> codebeaker: it's for one or multiple lans
15:01 < codebeaker> hyper_ch: but my TLS error… I think the routing is right… but I'll re-re-re-read that again
15:01 < hyper_ch> not sure why you get a tls error
15:01 < hyper_ch> didn't you use easyrsa to create keys?
15:01 < codebeaker> yeah hyper_ch, but I didn' tknow what tls key I should have sucked down for the client
15:01 < codebeaker> so I just don't use TLS
15:01 < codebeaker> (I think)
15:01 < hyper_ch> fuho: there's no def1 in the redirect-gateway statement
15:02 < codebeaker> note I commented out tls-server
15:02 < hyper_ch> I tend to think you should use easy-rsa for crets
15:02 < fuho> hyper_ch: Oh, I thought it wasnt needed, I will add it then, restart OpenVPN and try it.
15:02 < codebeaker> I did use easy-rsa
15:02 < codebeaker> but I didn't see documented which key to download for the client & tls
15:02 < hyper_ch> right... well, no clue
15:03 < codebeaker> :) which one do you use ?
15:03 < hyper_ch> !howto
15:03 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:03 < hyper_ch> codebeaker: it says here in the table where you need to put what keys  http://openvpn.net/index.php/open-source/documentation/howto.html#pki
15:03 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:04 < codebeaker> hyper_ch: cheers, read all this lot 5 times over :(
15:04 < hyper_ch> there is a config generator by krzess
15:04 < hyper_ch> !confgen
15:04 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
15:05 < hyper_ch> codebeaker: maybe that helps
15:05 < codebeaker> cheers for the tip hyper_ch 
15:06 < fuho> test
15:06 < fuho> hyper_ch: No luck, still no internet. I can't even ping google, I can ping openvpn server though so I am connected
15:06 < fuho> hyper_ch: Let me check log.
15:06 < hyper_ch> fuho: server and client confs please :)
15:06 < hyper_ch> and log also helps :)
15:06 < hyper_ch> what distro are you using?
15:09 < fuho> hyper_ch: Here is the server.conf http://pastebin.com/YpB7fi8r I don't know where ubuntu stores conf for client I can pastebin ovpn i used to import the settings from.
15:09 < hyper_ch> how do you setup openvpn in your client?
15:09 < fuho> hyper_ch: Client Ubuntu 11.10, server Ubuntu server 10.04 LTS
15:10 < hyper_ch> how do you set it up?
15:10 < fuho> Click on networks, go to VPN, add new VPN, import settings... I will paste the OVPN file contents, thats basically the CONF for client
15:11 < hyper_ch> yeah, turn on logs... I never used openvpn in such a manner... I did a manual setup
15:11 -!- mr_daniel [~daniel@g224044182.adsl.alicedsl.de] has joined #openvpn
15:12 < mr_daniel> !welcome
15:12 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:12 < hyper_ch> fuho: sudo apt-get install openvpn    and then   sudo nano /etc/openvpn/client.conf   --> and paste config in there
15:12 < mr_daniel> !goal
15:12 < hyper_ch> fuho: and finally sudo /etc/init.d/openvpn restart
15:12 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:13 < hyper_ch> never tried to use openvpn with the network manager
15:13 < fuho> hyper_ch: Here is the client OVPN http://pastebin.com/A9tCL2Yd
15:13 < mr_daniel> !logs
15:13 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
15:14 < mr_daniel> !configs
15:14 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
15:14 < buddha> anyone here using OSX as a server? I can connect to the server just fine, I have forwarding enabled which should allow me to reach other local subnets without NAT no?
15:14 < hyper_ch> fuho: and the certs exist
15:14 < mr_daniel> !howto
15:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:14 < hyper_ch> does a connection get established to the server?
15:15 < fuho> hyper_ch: It does. I can connect. Its just the internet that doesnt work.
15:15 < mr_daniel> !route
15:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:15 < hyper_ch> !ipforward
15:15 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:15 < hyper_ch> !linipforward
15:15 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:15 < mr_daniel> !tcpip
15:15 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
15:15 < hyper_ch> fuho: on the server:  cat /proc/sys/net/ipv4/ip_forward
15:16 < hyper_ch> what do you get?
15:17 -!- taco_the_paco [~TACOS@vserver-2y8t8833s.autovps.net] has joined #openvpn
15:17 < buddha> !osxipforward
15:17 <@vpnHelper> "osxipforward" is (#1) sysctl -w net.inet.ip.forwarding=1 for a temp solution, or (#2) add IPFORWARDING=-YES- in /etc/hostconfig for a permanent solution
15:17 < fuho> hyper_ch: 1
15:17 < hyper_ch> fuho: don't really know then... should be all fine
15:18 < fuho> letme find a show you the logs
15:18 < hyper_ch> fuho: remove client-to-client from server config
15:23 -!- fuho [~fuho@ool-43548d72.dyn.optonline.net] has quit [Ping timeout: 250 seconds]
15:24 -!- fuho [~fuho@ool-43548d72.dyn.optonline.net] has joined #openvpn
15:24 < fuho> hyper_ch: I did, still no change , pasting logs
15:25 < fuho> hyper_ch: Here is the server log http://pastebin.com/V15jzzt3
15:25 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
15:25 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
15:25 -!- Vutral [ss@vutral.net] has joined #openvpn
15:29 < fuho> !welcome
15:29 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:30 < hyper_ch> fuho: I use those configs and they work:  http://www.simplylinux.ch/openvpn-einrichten
15:30 <@vpnHelper> Title: Linux für alle » OpenVPN einrichten (at www.simplylinux.ch)
15:31 < hyper_ch> fuho: also I don't use the network manager for establishing the vpn tunnel
15:31 < hyper_ch> but I have the client config in /etc/openvpn/client.conf
15:31 < hyper_ch> and use /etc/init.d/openvpn start/stop to start or stop the link
15:32 < fuho> Well I dont think that is the problem, since i get connected
15:33 < hyper_ch> I don't know what the problem is
15:33 < fuho> The settings doesnt even work from Win box anymore, I ahevnt tried it from Android - difficuilt to set up. Also I just wanted to get this to work beacuse VPN will be just one small part of a big project I plan. I dont get why it doesnt redirect the traffic.
15:33 < hyper_ch> the above works fine for me
15:34 < fuho> well thanks for trying anyways, Ill go beack to google and manual
15:34 < hyper_ch> krzee: ping
15:35 < Bushmills> hyper_ch: http://scarydevilmonastery.net/startstop
15:36 < Bushmills> symlink script to start, stop. reload, restart etc
15:36 < hyper_ch> Bushmills: ?
15:36 < Bushmills> then do   start openvpn,   stop openvpn   etc
15:36 < hyper_ch> well, isn't it meanwhile  service NAME ACTION anyway
15:36 < Bushmills> "nd use /etc/init.d/openvpn start/stop to start or stop the link" ...
15:37 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 252 seconds]
15:37 < hyper_ch> I'm used to run it the other way
15:37 < hyper_ch> but I know you're lazy
15:37 < Bushmills> alternatively. yes.   still, i prefer   "start service"  over   "service service start"
15:38 < hyper_ch> maybe you know why fuho can't connect to the internet?
15:38 -!- Roelke [~Roelke@95-36-36-169.dsl.alice.nl] has quit []
15:38 < Bushmills> no idea. i just came in, not done a lot of reading yet
15:39 -!- fuho [~fuho@ool-43548d72.dyn.optonline.net] has quit [Ping timeout: 246 seconds]
15:40 < Bushmills> then i was musing about a - probably - utility program called "service" which replaces a script of one line, with the result of requiring a more complex invocation than a script of one line :)
15:41 < Bushmills> s/one line/a fifth of a line/
15:42 < krzee> hyper_ch, pong
15:42 < Bushmills> well, if internet doesn't work, maybe Al Gore has a fix for it?
15:42 < hyper_ch> Bushmills: :)
15:42 < hyper_ch> krzee: you're alive :)
15:42  * krzee checks
15:42 < krzee> yep!
15:44 < hyper_ch> great :)
15:44 < Bushmills> hyper_ch:  nl $(which service)
15:45 < takamichi> Is there a list of client log errors with more info anywhere (besides the few in the FAQ)?
15:46 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Remote host closed the connection]
15:46 < krzee> not especially that i know of... what error are you getting?
15:48 < mr_daniel> Is it a smart idea to use a single OpenVPN client which connects to multiple OpenVPN servers at the same time?
15:48 < mr_daniel> I want to 'connect' three computers, but one computer is behind a nat-firewall: http://imageshack.us/m/90/1824/64003225.png
15:50 < mr_daniel> My idea is to establish some sort of Point-to-Points connections between the computer behind the nat-firwall, and the computers in the internet.
15:51 < takamichi> @krzee, no error now, I just want to compile a list for our helpdesk
15:52 -!- codebeaker [~codebeake@188-192-24-211-dynip.superkabel.de] has quit [Quit: codebeaker]
15:53 < Bushmills> mr_daniel: make one of the computer in internet server. the other clients
15:53 < Kartagis> when I config vpn with the username and password option, does the user have to be a system account or can it be virtual ie. in a mysql database?
15:54 < Bushmills> Kartagis: no need for users having system accounts
15:55 < Kartagis> they can be on a database then
15:55 < Kartagis> right?
15:55 < Bushmills> right
15:55 < Kartagis> is there a script you can recommend to me?
15:56 < Kartagis> like the one pam
15:56 < Bushmills> just any script?
15:57 < Kartagis> no no one that gets usernames off the database
15:57 < mr_daniel> Bushmills: Sound like a reasonable architecture. But what if one server is down? Introducing separate connections for each server seems to be more robust.
15:57 < Bushmills> mr_daniel: make two machines in internet servers 
15:57 -!- zu [~zu@ks355000.kimsufi.com] has quit [Read error: Connection reset by peer]
15:57 < hyper_ch> run a private cloud with multiple nodes where the VM runs the openvpn server
15:58 < hyper_ch> if one node goes down, the others are still up and hence also the openvpn instance
15:58 < mr_daniel> Bushmills: What do you mean with 'machines'? Do you mean virtual guests, like with KVM or VirtualBox ?
16:00 <@vpnHelper> RSS Update - forum: Tunnel some traffic through an OpenVPN server <http://forums.openvpn.net/topic8111.html#p12059>
16:00 < Bushmills> mr_daniel: to protect against one openvpn server failing, you set up a second.  cliients have both servers in their configs.  they'll connect to the first server available
16:01 < Bushmills> if first server can't be connected to, don't bother setting it up as client. it is down anyway
16:02 < Kartagis> Bushmills: do you happen to know of a script that gets usernames off database?
16:03 < Bushmills> Kartagis: depends on database.  use a client, pull password for user. compare against client provided password - or use hashes of passwords. 
16:03 < Bushmills> (client for database)
16:04 < Kartagis> Bushmills: so, anything will do?
16:06 < Bushmills> yes .about anything returning "match" or "mismatch".  or "grant access" vs. "deny access"
16:06 <@vpnHelper> RSS Update - forum: Security question <http://forums.openvpn.net/topic8126.html#p12061> || Push webdomains to clients <http://forums.openvpn.net/topic8125.html#p12060>
16:06 < Bushmills> some would put it in simpler terms, along the lines of "welcome" and "piss off"
16:09 < Kartagis> http://christophe.vandeplas.com/2008/02/08/database-authorization-openvpn-eid <--- I got this, but it doesn't talk about verifying the password
16:09 <@vpnHelper> Title: Database authorization for openVPN with eID | White snow (at christophe.vandeplas.com)
16:10 < Bushmills> maybe it assumes that the reader is able to compare two strings?
16:12 <@vpnHelper> RSS Update - forum: How to route through a VPN server for a single remote web? <http://forums.openvpn.net/topic7636.html#p12063> || vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p12062>
16:12 < Bushmills> still, consider to store and compare hashes of passwords, to avoid having to store passwords in a potentially unsecure database
16:12 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
16:21 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Read error: Connection reset by peer]
16:27 -!- Vutral [raMQExZ9nA@vutral.net] has joined #openvpn
16:30 <@vpnHelper> RSS Update - forum: I give up, pls help me. - Firewall/routing problem <http://forums.openvpn.net/topic8128.html#p12064>
16:30 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
16:31 < Xeross> Okay I've disabled iptables for testing this, I've got the VPN connected yet I can't ping the server that should be 10.0.1.203 from the client
16:32 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:32 < Xeross> Port is forwarded on the router I don't know if I need any additional changes on my dd-wrt router?
16:33 < Bushmills> try to ping 10.0.1.1
16:34 -!- Vutral [raMQExZ9nA@vutral.net] has quit [Ping timeout: 248 seconds]
16:35 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
16:35 < Xeross> I'll disable its firewall, this is a 255.255.254.0 netmask btw
16:36 < Bushmills> p-t-p or server config?
16:36 < Xeross> Hmm?
16:37 < Bushmills> 10.0.1.203 is an unusual, if not impossible vpn subnet address of openvpn server. "server" as in config mode server
16:37 < Xeross> Ah sorry, it's setup as bridged
16:39 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
16:39 < Xeross> Hmm my bridge is br0 (Interface on the server) Would I set the dev parameter to that or?
16:40 < Bushmills> --server-bridge?
16:40 < Xeross> Ah nvr mind
16:40 < Xeross> Yeah
16:41 < Bushmills> then 10.0.1.203  is probably the ptp address on client, which won't reply to pings
16:46 -!- taco_the_paco [~TACOS@vserver-2y8t8833s.autovps.net] has quit [Read error: Connection reset by peer]
16:47 < Xeross> Hmm I need to learn to RTFM I think, hold on while I do that, I'll come back when that doesn't work
16:49 < Xeross> And behold, it works
16:50 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 264 seconds]
16:54 -!- Vutral [deMc4ASzVf@vutral.net] has joined #openvpn
17:00 < Xeross> Bushmills: anyway, thanks for your time
17:04 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 260 seconds]
17:04 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
17:04 <@vpnHelper> RSS Update - forum: Push webdomains to clients <http://forums.openvpn.net/topic8125.html#p12065>
17:04 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Remote host closed the connection]
17:04 -!- Vutral [deMc4ASzVf@vutral.net] has quit [Ping timeout: 258 seconds]
17:08 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
17:10 <@vpnHelper> RSS Update - forum: Security question <http://forums.openvpn.net/topic8126.html#p12067> || How to route through a VPN server for a single remote web? <http://forums.openvpn.net/topic7636.html#p12066>
17:15 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
17:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:16 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:23 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
17:30 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
17:39 -!- abstrakt [debian-tor@gateway/tor-sasl/abstrak1] has joined #openvpn
17:42 -!- abstrakt [debian-tor@gateway/tor-sasl/abstrak1] has quit [Remote host closed the connection]
17:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit []
17:53 -!- Vutral [ss@vutral.net] has joined #openvpn
18:04 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Operation timed out]
18:09 -!- Guifort [~Guifort@69.182.124.78.rev.sfr.net] has joined #openvpn
18:10 -!- Guifort [~Guifort@69.182.124.78.rev.sfr.net] has quit [Client Quit]
18:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:18 -!- mordy [~mordy@5acc3a82.bb.sky.com] has quit [Ping timeout: 240 seconds]
18:29 -!- mr_daniel [~daniel@g224044182.adsl.alicedsl.de] has quit [Quit: leaving]
18:35 -!- mordy [~mordy@5acc3a82.bb.sky.com] has joined #openvpn
18:35 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Ping timeout: 260 seconds]
18:35 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Read error: Connection reset by peer]
18:41 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
18:44 -!- mordy [~mordy@5acc3a82.bb.sky.com] has quit [Ping timeout: 240 seconds]
18:45 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Operation timed out]
18:46 -!- taco_the_paco [~TACOS@lolcocks.tk] has joined #openvpn
18:48 < taco_the_paco> i cant get openvpn to work on opensuse-gnome 11.4 32 bit push i have push "redirect-gateway def1 bypass-dhcp"
18:48 < taco_the_paco>  uncommented in my config, but w/e i do, i cant ping anything, it worked fine in windows & ubuntu O-o
18:49 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
18:50 < taco_the_paco> iv'e tried disabling the firewall on opensuse but no luck still
19:01 -!- Squidy_at_Home [~quassel@177.0.3.53] has joined #openvpn
19:03 -!- harlan [~harlan@ntp/programmemanager/harlan] has joined #openvpn
19:26 -!- Squidy_at_Home [~quassel@177.0.3.53] has quit [Remote host closed the connection]
19:32 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:33 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 252 seconds]
19:39 -!- Vutral [ZCKuM8Pb77@vutral.net] has joined #openvpn
19:59 -!- Vutral [ZCKuM8Pb77@vutral.net] has quit [Read error: Connection reset by peer]
20:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
20:07 -!- master_of_master [~master_of@p57B530B3.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:10 -!- Vutral [ZtSkKYv4lW@vutral.net] has joined #openvpn
20:11 -!- master_of_master [~master_of@p57B5564C.dip.t-dialin.net] has joined #openvpn
20:13 < AndrewX192> Hey, all, I have a problem with OpenVPN Server on a Linux box, the server and client are able to communicate, and acess each other via the VPN, but the client cannot access the Internet. Where should I start to debug the issue?
20:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:23 <@vpnHelper> RSS Update - forum: I give up, pls help me. - Firewall/routing problem <http://forums.openvpn.net/topic8128.html#p12068>
20:47 <@vpnHelper> RSS Update - forum: New install unable to ping or see network <http://forums.openvpn.net/topic8130.html>
20:47 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:53 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Ping timeout: 260 seconds]
20:54 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
20:58 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
20:58 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
20:58 -!- Guest48839 is now known as CrazyGir
20:59 -!- CrazyGir [~jason@li14-82.members.linode.com] has quit [Changing host]
20:59 -!- CrazyGir [~jason@unaffiliated/crazygir] has joined #openvpn
21:03 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
21:06 < AndrewX192> Anyone have any ideas about my issue with OpenVPN dropping packets?
21:07 < AndrewX192> I replaced all my configuration files with known to work ones, and still getting that error.
21:09 -!- Vutral [ZtSkKYv4lW@vutral.net] has quit [Ping timeout: 240 seconds]
21:13 -!- Vutral [ss@vutral.net] has joined #openvpn
21:13 < AndrewX192> The client can connect to a Windows Server 2008 Enterprise machine with the same vpn server config w/o issues. The routing has to be wrong on the linux server, but I don't know how.
21:17 < AndrewX192> RDP over 3G on 800x480 is so painful.
21:21 <@vpnHelper> RSS Update - forum: Configure Firefox to use OpenVPN. <http://forums.openvpn.net/topic8131.html>
21:51 <@vpnHelper> RSS Update - forum: Help setting up Windows OpenVPN server, please :) <http://forums.openvpn.net/topic8132.html>
21:57 <@vpnHelper> RSS Update - forum: Configure Firefox to use OpenVPN. <http://forums.openvpn.net/topic8131.html#p12072>
22:03 <@vpnHelper> RSS Update - forum: Required *minimum* HW to run OpenVPN server <http://forums.openvpn.net/topic8122.html#p12075> || server speed decreasing after kloxo installation <http://forums.openvpn.net/topic8078.html#p12074> || Push webdomains to clients <http://forums.openvpn.net/topic8125.html#p12073>
22:04 -!- EugeneKay [EugeneKay@kashpureff.com] has quit [Ping timeout: 248 seconds]
22:06 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 260 seconds]
22:09 <@vpnHelper> RSS Update - forum: Two or more VPS server using one IP? <http://forums.openvpn.net/topic8101.html#p12080> || Source Code For Access Server? <http://forums.openvpn.net/topic8098.html#p12079> || Bleck certain websites in openvpn clientside <http://forums.openvpn.net/topic8110.html#p12078> || Setting up a windows server <http://forums.openvpn.net/topic8129.html#p12077> || vpn goes slower and slower <http://forums.openvpn.net/topic8073.html#p1
22:15 <@vpnHelper> RSS Update - forum: hi newbie here please help (blocked port) <http://forums.openvpn.net/topic7920.html#p12082> || Undefined Offset issue when connecting to VPN <http://forums.openvpn.net/topic7996.html#p12081>
22:16 -!- EugeneKay [EugeneKay@kashpureff.com] has joined #openvpn
22:21 <@vpnHelper> RSS Update - forum: Doubt about IP Forwarding <http://forums.openvpn.net/topic7918.html#p12083>
22:27 <@vpnHelper> RSS Update - forum: Excluding an IP range from redirect gateway <http://forums.openvpn.net/topic7065.html#p12086> || my other wish <http://forums.openvpn.net/topic7973.html#p12085> || Help with collecting must-have features for the Windows GUI <http://forums.openvpn.net/topic8102.html#p12084>
22:30 -!- Vutral [~ss@vutral.net] has joined #openvpn
22:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:35 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:41 -!- EugeneKay [EugeneKay@kashpureff.com] has quit [Ping timeout: 260 seconds]
22:48 -!- EugeneKay [EugeneKay@kashpureff.com] has joined #openvpn
23:18 -!- Vutral [~ss@vutral.net] has quit [Ping timeout: 276 seconds]
23:27 -!- Vutral [ss@vutral.net] has joined #openvpn
23:52 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Read error: Connection reset by peer]
--- Day changed Mon May 16 2011
00:01 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
00:06 < AndrewX192> I still have not been able to resolve my issue with OpenVPN routing. I can see the ping requests from the client on the server with wireshark, but the requests are not being forwarded. Also, OpenVPN logs say it is still dropping packets.
00:15 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
00:15 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8147.html>
00:22 <@vpnHelper> RSS Update - forum: Problem with Routing <http://forums.openvpn.net/topic8148.html>
00:46 < Bushmills> !redirect
00:46 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
00:46 < Bushmills> AndrewX192: ^^^
00:57 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:06 -!- shutchie [~SHutchie@65.48.238.228] has quit [Ping timeout: 240 seconds]
01:06 -!- EugeneKay is now known as EugeneKaway
01:10 <@vpnHelper> RSS Update - forum: Configure Firefox to use OpenVPN. <http://forums.openvpn.net/topic8131.html#p12091> || Problem with Routing <http://forums.openvpn.net/topic8148.html#p12090> || TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8147.html#p12089>
01:16 <@vpnHelper> RSS Update - forum: I give up, pls help me. - Firewall/routing problem <http://forums.openvpn.net/topic8128.html#p12093> || New install unable to ping or see network <http://forums.openvpn.net/topic8130.html#p12092>
01:17 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 258 seconds]
01:22 <@vpnHelper> RSS Update - forum: Help setting up Windows OpenVPN server, please :) <http://forums.openvpn.net/topic8132.html#p12094>
01:43 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
01:45 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:45 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
01:51 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 246 seconds]
01:51 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945-15.html#p12095>
01:53 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:53 -!- mode/#openvpn [+o mattock] by ChanServ
02:03 -!- dazo_afk is now known as dazo
02:06 -!- rooth [rooth@92.43.35.21] has joined #openvpn
02:18 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
02:22 -!- WebDawg [~whoami@officialg0d.com] has quit [Ping timeout: 246 seconds]
02:28 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12096>
02:37 -!- Vutral [EJgMEbZ7O7@vutral.net] has joined #openvpn
02:44 -!- Vutral [EJgMEbZ7O7@vutral.net] has quit [Ping timeout: 250 seconds]
02:52 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8147.html#p12097>
02:58 <@vpnHelper> RSS Update - forum: Need help with multi-homed basic setup <http://forums.openvpn.net/topic8119.html#p12098>
02:59 -!- Vutral [ss@vutral.net] has joined #openvpn
03:07 -!- mordy [~mordy@5acc3a82.bb.sky.com] has joined #openvpn
03:10 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12099>
03:16 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12100>
03:32 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 264 seconds]
03:34 -!- Flecks [~fleck@unaffiliated/fleck] has quit [Read error: Operation timed out]
03:34 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945-15.html#p12101>
03:36 -!- Vutral [HoV52Ph98Q@vutral.net] has joined #openvpn
03:40 -!- brian [~brian@unaffiliated/brian] has quit [Ping timeout: 276 seconds]
03:52 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
03:52 <@vpnHelper> RSS Update - forum: Push webdomains to clients <http://forums.openvpn.net/topic8125.html#p12102>
03:53 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
03:53 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has quit [Changing host]
03:53 -!- brian [~brian@unaffiliated/brian] has joined #openvpn
03:56 -!- Vutral [HoV52Ph98Q@vutral.net] has quit [Ping timeout: 260 seconds]
03:58 <@vpnHelper> RSS Update - forum: Push webdomains to clients <http://forums.openvpn.net/topic8125.html#p12104> || Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12103>
04:16 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12105>
04:31 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
04:38 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Read error: Operation timed out]
04:41 <@vpnHelper> RSS Update - forum: New Installation unable to see network <http://forums.openvpn.net/topic8149.html>
04:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:50 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
04:51 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
04:55 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 250 seconds]
04:57 -!- luneff [~yury@84.51.195.188] has joined #openvpn
04:57 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
05:05 <@vpnHelper> RSS Update - forum: New install unable to ping or see network <http://forums.openvpn.net/topic8130.html#p12108> || Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12107>
05:07 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:07 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:07 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:10 <@vpnHelper> RSS Update - forum: New install unable to ping or see network <http://forums.openvpn.net/topic8130.html#p12111> || New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12110> || Required *minimum* HW to run OpenVPN server <http://forums.openvpn.net/topic8122.html#p12109>
05:14 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:14 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:17 -!- Vutral [ss@vutral.net] has joined #openvpn
05:17 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12112>
05:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
05:21 -!- ras0ir [~ras0ir@unaffiliated/ras0ir] has joined #openvpn
05:23 <@vpnHelper> RSS Update - forum: Required *minimum* HW to run OpenVPN server <http://forums.openvpn.net/topic8122.html#p12113>
05:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:29 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12115> || Need help with Windows client <http://forums.openvpn.net/topic8150.html>
05:32 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
05:35 <@vpnHelper> RSS Update - forum: Required *minimum* HW to run OpenVPN server <http://forums.openvpn.net/topic8122.html#p12117> || Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12116>
05:35 -!- W00d5t0ck [~polesz@business-89-133-219-66.business.broadband.hu] has joined #openvpn
05:35 < W00d5t0ck> hello
05:36 < W00d5t0ck> is it possible that OpenVPN restricts some kind of network traffic?
05:36 < W00d5t0ck> I have a LAN setup with several subnets
05:36 < W00d5t0ck> the OpenVPN server is one of these subnets, the clients can connect to it just right
05:36 < W00d5t0ck> when I try to ping a machine in the OpenVPN server's subnet, it succeeds
05:37 < W00d5t0ck> but when I try to ping something on another subnet, it gets to the VPN interface (tap0), but never gets on eth0 (my LAN interface)
05:37 < janjust> hi W00d5t0ck , if configured correctly then openvpn does not restrict much
05:37 < janjust> is ip forwarding enabled on the server?
05:38 < W00d5t0ck> ipv4 forwarding is turned on on the server for all interfaces
05:38 < W00d5t0ck> and no firewall like iptables is configured on neither end
05:39 < janjust> but you're running in tap mode (why?) - not everything is controlled by iptables in tap mode
05:39 < W00d5t0ck> my machine is 172.16.100.2, the VPN server is 172.16.200.86/172.17.0.254, VPN client is 172.17.0.112
05:39 < ras0ir> is it possible to force openvpn server not to redirect all the traffic over vpn?  (instead of route-nopull in client config) 
05:39 < W00d5t0ck> when I ping the vpn client from my machine, it gets to the vpn client, returns to the server's vpn interface, but never to my machine
05:39 < janjust> ras0ir:  simply don't use 'redirect-gateway def1'
05:40 < W00d5t0ck> I don't redirect all the traffic through the VPN interface
05:40 <@vpnHelper> RSS Update - forum: openvpn 2.2 issue <http://forums.openvpn.net/topic8084.html#p12118>
05:40 < ras0ir> well didnt work for me but i'll check again
05:40 < janjust> W00d5t0ck:  check that proxy_arp is enabled on the tap0 and eth0 interfaces
05:41 < W00d5t0ck> janjust, no, it's disabled on both
05:41 < janjust> enable it and try again; routing in tap mode is trickier than routing in tun mode
05:43 < W00d5t0ck> still nothing
05:43 < W00d5t0ck> I can't see what's the problem with tap mode, however, I can switch to tun without problems yet, I'm just testing now
05:44 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 276 seconds]
05:44 < W00d5t0ck> is it enough to change dev-type from tap to tun, or do I have to change anything else?
05:45 < janjust> try using tun mode ; if you don't need bridging then in 99% of the cases you won't need tap 
05:45 < W00d5t0ck> OK, I reconfigure the machines and check back with the result
05:46 -!- Vutral [9gnol2C0sv@vutral.net] has joined #openvpn
05:50 < W00d5t0ck> erm... maybe I'm a bit lame, but does using tun mean that I will have one 'tunX' interface for all connecting clients?
05:51 < janjust> W00d5t0ck:  you're lame, that is, the answer is no
05:51 < janjust> the server will have one tun0 for all connecting clients
05:53 < Bushmills> that is, "yes"
05:53 < janjust> lol Bushmills , you're right, _I_ am lame
05:54  * janjust needs to go to the trough for feeding time
05:54 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:57 -!- Vutral [9gnol2C0sv@vutral.net] has quit [Ping timeout: 260 seconds]
06:06 -!- Vutral [ss@vutral.net] has joined #openvpn
06:09 -!- brian [~brian@unaffiliated/brian] has quit [Ping timeout: 246 seconds]
06:21 <@vpnHelper> RSS Update - forum: squid proxy without configuring client web browser <http://forums.openvpn.net/topic7990.html#p12119>
06:32 -!- K1ng [~KING@180.211.188.218] has joined #openvpn
06:33 <@vpnHelper> RSS Update - forum: Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12120>
06:38 -!- Vutral [ss@vutral.net] has quit [Excess Flood]
06:40 -!- Vutral [0YLttXc0kd@vutral.net] has joined #openvpn
06:44 < W00d5t0ck> after reconfiguring and having a meal, the issue remains
06:44 < W00d5t0ck> now I use tun devices, but I still can't ping my LAN machines from the VPN client
06:47 < W00d5t0ck> both with proxy_arp on and off
06:49 < Bushmills> !clientlan
06:49 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
06:49 <@vpnHelper> better explanation
06:49 < Bushmills> oh. "from"...
06:49 < Bushmills> !serverlan
06:49 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
06:49 < Bushmills> or ...
06:49 < Bushmills> !route
06:49 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
06:51 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12121>
06:59 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:00 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
07:00 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
07:00 -!- Cain` is now known as Cain
07:18 < W00d5t0ck> as far as I can tell, routing is set up well by openvpn
07:19 < W00d5t0ck> from the vpn client, the packets destined to 172.16.100.0/24 will be sent through the vpn server (172.17.0.254)
07:19 < W00d5t0ck> when I ping my own machine (172.16.100.2) from the VPN client, it arrives on the VPN server's vpn (tun0) interface, but never leaves on eth0 (172.16.200.86)
07:20 < W00d5t0ck> from the VPN server, I can ping my machine without problems, so routing is set well on that machine either
07:26 -!- K1ng [~KING@180.211.188.218] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
07:35 -!- Vutral [0YLttXc0kd@vutral.net] has quit [Ping timeout: 252 seconds]
07:40 -!- W00d5t0ck [~polesz@business-89-133-219-66.business.broadband.hu] has left #openvpn ["Távozom"]
07:45 -!- knarfly [~vlad@nmd.sbx11041.miamifl.wayport.net] has joined #openvpn
07:46 < knarfly> help...I'm suddenly getting WSAECONNREFUSED errors...I'm at the same remote location with the same laptop that worked fine last week.
07:47 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Read error: Operation timed out]
07:48 < knarfly> 8-)
07:55 -!- Vutral [qUsiH4JM44@vutral.net] has joined #openvpn
08:00  * ecrist back in MN, happy to be so
08:02 < krzee> how was canada, eh?
08:04 < ecrist> someone pulled a knife on me Friday night.  When I didn't run away, he put it away and told me to fuck off.
08:04 < ecrist> *shrug*
08:04 < ecrist> BSDCan was awesome.  I really enjoy getting all the inside info on upcoming freebsd devel
08:06 < krzee> lol @ the guy with the knife
08:07 < ecrist> keep in mind, I'm 6'2" and 280lbx
08:07 < ecrist> not an overly 'soft' 280, either.
08:08 < krzee> sure, but maybe he should have thought of that before breaking out the knife on you
08:08 < ecrist> heh, perhaps
08:08 < krzee> where im from, at that point he dedicated himself to using it on you
08:09 < ecrist> had the same thing happened here in mn, he ran the risk of being perferated.
08:09  * ecrist carries
08:10 < krzee> well you have conceal carry permit in your state, right?
08:10 < krzee> (not for everyone, but *you* have it)
08:10 < ecrist> yes
08:10 < ecrist> I have MN and FL permits
08:10 < krzee> werd
08:10 < krzee> brb from krzie
08:11 < ecrist> http://www.handgunlaw.us/states/minnesota.pdf and http://www.handgunlaw.us/states/florida.pdf are where I can legally carry
08:15 -!- K1ng [~KING@180.211.188.218] has joined #openvpn
08:21 -!- Vutral [qUsiH4JM44@vutral.net] has quit [Ping timeout: 252 seconds]
08:26 < pwrcycle> :q
08:27 <@vpnHelper> RSS Update - forum: Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12122>
08:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:32 -!- Vutral [~ss@vutral.net] has joined #openvpn
08:33 < knarfly> help...I'm suddenly getting WSAECONNREFUSED errors...I'm at the same remote location with the same laptop that worked fine last week.
08:39 < knarfly> is there a way to check if the wifi here is blocking 443 other than just trying to connect through it?
08:41 -!- shutchie [~SHutchie@65.48.238.228] has joined #openvpn
08:42 < knarfly> ok last week this place was blocking udp connection...this week they are blocking tcp connection...just got it to work by ssh to my server and reconfig for udp....sheesh!
08:48 -!- Vutral [~ss@vutral.net] has quit [Ping timeout: 250 seconds]
08:48 -!- EmperorTom is now known as QuadDamage
08:48 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
08:48 -!- shutchie [~SHutchie@65.48.238.228] has quit [Quit: Leaving]
08:52 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has left #openvpn []
08:52 < knarfly> live and learn
08:52 -!- knarfly [~vlad@nmd.sbx11041.miamifl.wayport.net] has left #openvpn []
08:52 -!- Vutral [ss@vutral.net] has joined #openvpn
08:53 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
08:57 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
08:57 <@vpnHelper> RSS Update - forum: auth-user-pass-verify causing errors/crashes? <http://forums.openvpn.net/topic8151.html>
08:57 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
08:57 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:01 < ecrist> wb, krzie 
09:01 < krzie> thx
09:01 < ecrist> krzie: http://www.handgunlaw.us/states/minnesota.pdf and http://www.handgunlaw.us/states/florida.pdf are where I can legally carry
09:02 < ecrist> 34 states
09:02 < krzie> oh very cool
09:02 <@vpnHelper> RSS Update - forum: New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12124>
09:09 -!- Vutral [gYtPTLlKnu@vutral.net] has joined #openvpn
09:14 <@vpnHelper> RSS Update - forum: Advice on upgrading Ubuntu on OpenVPN server host? <http://forums.openvpn.net/topic8152.html> || Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12125>
09:15 < gladiatr> what?  no guns in the elementary schools?  ha
09:24 -!- QuadDamage is now known as quadDamage
09:24 -!- K1ng [~KING@180.211.188.218] has quit [Ping timeout: 248 seconds]
09:35 -!- Vutral [gYtPTLlKnu@vutral.net] has quit [Ping timeout: 240 seconds]
09:36 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:37 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
09:38 < bystander> good day to all.  how can I use the username and password in the ovpn command line without auth-user-pass pwd.txt
09:39 < krzie> read auth-user-pass
09:39 < krzie> in the manual
09:39 < krzie> !man
09:39 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
09:39 < bystander> it came to my idea how the openvpn gui use it
09:40 < bystander> krzie I constantly read the manual but can you please give me an example of the command line
09:40 < krzie> just leave out the filename...
09:40 < krzie> auth-user-pass [up] 
09:40 < krzie> Authenticate with server using username/password. up is a file containing username/password on 2 lines (Note: OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in win/settings.in). 
09:40 < krzie> If up is omitted, username/password will be prompted from the console.
09:41 < krzie> pretty easy to understand i thought...
09:44 < bystander> krzie, yes it is easily understood. omitting the up will bring up the console. but is it possible in the command line like - - auth-user-pass myusername mypassword . I dont want the console to prompt either
09:46 < bystander> help please
09:47 < bystander> I need your knowledge about this
09:47 < krzie> oh no
09:47 < krzie> not only no, but no
09:47 < krzie> NEVER put login / pass on commandline
09:47 < krzie> or i will get user level access and grab it from ps
09:47 < krzie> !blame
09:48 <@vpnHelper> "blame" is According to Bushmills, it's always krzee's fault
09:49 < bystander> krzie: ok. but is it possible.  I just need to implement it on my work.
09:50 < bystander> please help me guys
09:50 < krzie> [07:47]  <krzie> not only no, but no
09:51 < krzie> so once again
09:51 < krzie> no
09:51 < bystander> so there is no way to put the username and password in the ovpn command line?
09:51 < Bushmills> i suppose you could do something like   echo "user pass" > /tmp/foo; echo --opt $(cat /tmp/foo)
09:52 < krzie> i need to answer the same question how many times?
09:52 < Bushmills> don't forget to remove /tmp/foo again
09:52 < krzie> Bushmills, you think that would work?
09:53 < Bushmills> ehm ...  no....    not $(cat foo) ... just  --opt /tmp/foo
09:53 < krzie> wouldnt you need expect and some hackery as well?
09:53 -!- Vutral [ss@vutral.net] has joined #openvpn
09:53 < Bushmills> two 180 degree turns make on 360 degree turn
09:54 < Bushmills> omne
09:54 < Bushmills> grrr
09:56 < bystander> what I do is I put the username and password in an encrypted form so that the client wont see it.  my program will decrypt it and write it in text file somewhere in the local disk before the openvpn will use the file.  I would like to eliminated the writing to text file, just decrypt the file and dim the variable in the command line
09:56 < krzie> well
09:57 < krzie> if you store the password on the client, stop using passwords
09:57 < krzie> if you want it stored, use certs
09:57 < krzie> thats what they are for
09:57 -!- oskie [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has quit [Ping timeout: 258 seconds]
09:59 < bystander> if I will use certs, I need unique certs for each users, right?
10:00 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
10:00 < ecrist> bystander: ideally, yes
10:01 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
10:01 < bystander> that would be tedious if I have 300 users.
10:01 < ecrist> it's scriptable.
10:02 < ecrist> so, issue one certificate and use ldap on the back end
10:02 < bystander> scriptable? what do you mean ?
10:02 < ecrist> you can script certificate creation.
10:02 < ecrist> read the man page for opensll
10:02 < ecrist> openssl
10:02 < bystander> I am not familiar with ldap really.  Can you show me please!
10:03 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 250 seconds]
10:04 -!- EugeneKaway is now known as EugeneKay
10:04 -!- oskie [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has joined #openvpn
10:04 < bystander> please show me the way guys
10:04 < krzie> or you can use any database
10:05 < krzie> maybe you would like this:
10:05 < krzie> !dazo
10:05 <@vpnHelper> "dazo" is "eurephia" is http://www.eurephia.net/
10:06 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
10:07 < ecrist> really, ldap is WAY out of the scope of this channel
10:07 < bystander> ecrist: can you please direct me to the right manpage to read. I am kinda lost finding it
10:07 < ecrist> openldap
10:08 < bystander> about that cert/openssl
10:08 < krzie> check out the above link too
10:08 < ecrist> man openssl
10:10 < bystander> krzie: I am reading also the link you provided
10:10 < bystander> thanks
10:12 <@vpnHelper> RSS Update - forum: OpenVPN connection going down under traffic <http://forums.openvpn.net/topic7820.html#p12129> || Advice on upgrading Ubuntu on OpenVPN server host? <http://forums.openvpn.net/topic8152.html#p12128> || Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12127>
10:12 <@dazo> bystander: if you have openvpn 2.2 on your server side, getting eurephia up'n'running on linux should be quite easy now ... for openvpn 2.1, you need a special patch
10:15 < bystander> I guess it is information overload now for me on eurephia aside from what is my question and the suggestion on using just certs. can we focus for now on how to create and just use the cert.
10:15 < bystander> im reading the manpage now, but can find example on how to use certs only.
10:16 -!- Vutral [ss@vutral.net] has joined #openvpn
10:17 < krzie> dazo, sorry that pings you, i can never remember how to spell eurephia ;]
10:17 < krzie> bystander, 
10:17 < krzie> !pki
10:17 <@vpnHelper> RSS Update - forum: Advice on upgrading Ubuntu on OpenVPN server host? <http://forums.openvpn.net/topic8152.html#p12132> || auth-user-pass-verify causing errors/crashes? <http://forums.openvpn.net/topic8151.html#p12131> || OpenVPN connection going down under traffic <http://forums.openvpn.net/topic7820.html#p12130>
10:17 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
10:17 <@vpnHelper> specially as a server (see !servercert)
10:17 <@dazo> krzie: no worries, it's nice to get a good idea who gets this help :)
10:17 < krzie> that link from the howto is step-by-step on creating certs
10:18 < krzie> hey dazo does eurephia MAKE the certs too? (web based CA?)
10:18 <@dazo> krzie: not yet 
10:18 < bystander> thanks to all
10:18 < krzie> gotchya, my confgen will be a CA one day as well, but still is not
10:18 < krzie> bystander, yw
10:19 <@dazo> bystander: good approach to make certs working first ... from there to implement eurephia, is usually an easier path to walk
10:19 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
10:20 <@dazo> krzie: but with a bigger rewrite, which will put the authentication part in a separate process (with support to have it running on a separate server), implementing more CA features is more doable ... you know, I try to not recommend people running openvpn server and having the CA on the same box :)
10:20 < bystander> I will try to understand working with certs because I am just familiar with username/password. hopefully I can grasp it very soon.
10:21 < krzie> that is true, i do that as well
10:21 < krzie> (same recommendation)
10:22 < krzie> (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
10:22 < krzie> ...specially as a server
10:22 -!- EugeneKay [EugeneKay@kashpureff.com] has left #openvpn ["Leaving"]
10:22 <@dazo> bystander: PKI isn't so difficult, even though it looks so in the beginning .... you just need to realise the difference between a server certificate, a client certificate and a CA certificate ... that's #1 to get a grasp of
10:22 <@vpnHelper> RSS Update - forum: Connection times out <http://forums.openvpn.net/topic8153.html> || Connection works for only few seconds <http://forums.openvpn.net/topic8109.html#p12133>
10:24 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
10:24 < bystander> thanks everyone. I am beginning having double vision. hahaha. i guess im sleepy already. good night guys. will read this further tomorrow.
10:24 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
10:25 <@dazo> good plan :)
10:25 -!- tanathos [~tanathos@host23-47-dynamic.35-79-r.retail.telecomitalia.it] has joined #openvpn
10:25 < tanathos> !iptables
10:25 <@vpnHelper> "iptables" is (#1) o test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT;, or (#2) then run iptables -F, iptables -Z after being SURE policies are set to accept, or (#3) please see http://openvpn.net/man#lbBD for more info, or (#4) see http://www.secure-
10:25 <@vpnHelper> computing.net/wiki/index.php/OpenVPN/Firewall
10:29 -!- tanathos [~tanathos@host23-47-dynamic.35-79-r.retail.telecomitalia.it] has quit []
10:30 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Operation timed out]
10:32 -!- Vutral [ss@vutral.net] has joined #openvpn
10:45 -!- dazo is now known as dazo_afk
10:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:02 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 258 seconds]
11:02 <@vpnHelper> RSS Update - forum: auth-user-pass-verify causing errors/crashes? <http://forums.openvpn.net/topic8151.html#p12135>
11:05 -!- Vutral [KQ6MAjVfTN@vutral.net] has joined #openvpn
11:08 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
11:15 -!- Vutral [KQ6MAjVfTN@vutral.net] has quit [Ping timeout: 252 seconds]
11:29 -!- codebeaker [~codebeake@188-192-24-211-dynip.superkabel.de] has joined #openvpn
11:32 -!- Belial_ [~quassel@128.210.61.130] has quit [Remote host closed the connection]
11:33 < codebeaker> my goal is to use a server on my VPS host's LAN to access my other machines with that provider, effectively bridging the LANs… I have 4 servers with the host in 192.168.154.0/255.255.128/0 - and my configured openvpn is at 10.77.22.0/24 - server config is http://pastie.org/private/nhwkssljiatcpmmp9hoyg - client config not available, because I'm using Shimo for OSX
11:35 -!- Vutral [ss@vutral.net] has joined #openvpn
11:35 < codebeaker> I get "ping: sendto: Network is unreachable" - but I think I have things configured correctly?
11:36 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
11:36 < codebeaker> my server-side log is here, http://pastie.org/private/5rkespjz8aztknijdrq
11:50 < codebeaker> also, I can ping the VPN host without problems, but I cannot reach the remote LAN
11:51 < codebeaker> !route
11:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:51 -!- Belial_ [~quassel@128.210.61.130] has quit [Read error: Connection reset by peer]
11:52 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 246 seconds]
11:54 < codebeaker> I'm really lost that a "route 192.168.154.0 255.255.128.0" line, which is my remote LAN, causes an error, when it shells out to /sbin/route "/sbin/route add -net 192.168.154.0 netmask 255.255.128.0 w 10.77.22.2 route: netmask doesn't match route address"
12:02 <@vpnHelper> RSS Update - forum: can ping printer but can't ping computer <http://forums.openvpn.net/topic8106.html#p12136>
12:07 < codebeaker> posted to serverfault in the hope that someone will pick me up there :( http://serverfault.com/questions/270252/openvpn-network-unreachable
12:07 <@vpnHelper> Title: ubuntu - OpenVPN Network Unreachable - Server Fault (at serverfault.com)
12:08 < Bushmills> codebeaker: you are  missing a route to the destination
12:08 < Bushmills> oh. sry. nope.
12:08 < codebeaker> Bushmills: hey (again) - which route am I missing… 
12:09 < Bushmills> i misread your error message
12:09 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
12:09 < codebeaker> I think the problem is that "route 192.168.154.0 255.255.128.0" raises an error
12:09 < codebeaker> … saying netmask doesn't match, shoudl the netmask there match the gateway, or the address
12:10 < codebeaker> also, my IP/netmask at home is 192.168.1.1/255
12:10 < codebeaker> .
12:10 < codebeaker> also, my IP/netmask at home is 192.168.1.1/255.255.255.0 – which shoudn't "overlap" right
12:10 -!- WebDawgII [~webdawg@72.242.51.155] has joined #openvpn
12:10 < Bushmills> try 255,255,127.0
12:11 < Bushmills> ehm. no again
12:11  * Bushmills grabs a coffee
12:11 < codebeaker> ok
12:13 < WebDawgII> Hmm.
12:13 < WebDawgII> Bridge and Route are just the two different layers right;/
12:13 < WebDawgII> ?
12:16 < codebeaker> Bushmills: could it be that `route` on my machine, for some reason takes different args, or something (I doubt it, it's vanilla ubuntu installation)
12:20 -!- K1ng [~KING@180.211.188.218] has joined #openvpn
12:22 -!- luneff [~yury@84.51.195.188] has quit [Quit: This computer has gone to sleep]
12:26 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:39 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
12:41 < Bushmills> codebeaker:  is that "w" instead of "gw" in "/sbin/route add -net 192.168.154.0 netmask 255.255.128.0 w 10.77.22.2" a typo?
12:41 < codebeaker> yeah, think so
12:41 < codebeaker> yeah, sorry - just checked
12:44 < Bushmills> there's probably a route for  192.168.154.0 already, but with different netmask
12:45 < codebeaker> yeah, there's: 192.168.128.0   *               255.255.128.0   U     0      0        0 eth0
12:45 < codebeaker> now that I looked…
12:45 < codebeaker> but the netmask is the same, but it's using an IP lower in the allowed range
12:45 < Bushmills> x.x.154.0 doesn't go with x.x.128.0 netmask 
12:45 < Bushmills> would have to be  x.x.0.0 or x.x.128.0
12:46 < codebeaker> I don't follow, sorry - my db server has the address 192.168.154.17x … w
12:46 < codebeaker> with the netmask 255.255.128.0 – so it *has* to go
12:46 < Bushmills> otherwise, bits of network address bleed through to host address space
12:47 < Bushmills> 255.255.128.0 netmask of a subnet in which host 192.168.154.17 resides, encompasses all addresses 192.168.128.1 ... 192.168.255.255
12:48 < codebeaker> so i might need "route 192.168.0.0 255.255.128.0"
12:48 < Bushmills> therefore 192.168.154.x can't be a valid network address with that submask
12:48 < codebeaker> yeah, that's right - my host puts all user's machines on the same LAN
12:48 < Bushmills> set your netmask narrower
12:49 < Bushmills> 255.255.254.0 would do
12:49 < codebeaker> this is all I know - http://cl.ly/1v1b2g0Z0i063z2o0C0m
12:49 < Bushmills> 255.255.252.0 wouldn't
12:49 < codebeaker> yeah, my other machies are 192.168.164.229/255.255.128.0, and 192.168.157.53/255.255.128.0
12:50 < Bushmills> *machine* yes. but not *network*
12:51 < Bushmills> by network, you specify only bits with are set in subnet mask.  no bits of network which are 0 in subnet mask may be set
12:51 < codebeaker> I'll admit you lost me :( I thougght the netmask was a bitwise `range` of allowed-to-change bits, so if I set it to 255.255.254, I won't be able to reach x.x.154.x or x.x.128.x, will I ?
12:51 < Bushmills> but hosts may have those bits set - they need to be addressed within the subnet, after all
12:51 < Bushmills> write network address and netmask in binary. one below the other.
12:51 < codebeaker> I suck at this, give me a few mins :)
12:53 < Bushmills> either have a cup of coffee, as i just did (it works), or read up on cidr , for example. wikipedia article
12:54 < codebeaker> I think the problem is, that I'm really not grokking what's not working here
12:54 < codebeaker> I would expect that the "push" would be why this isn't working
12:54 < Bushmills> then it's gonna be the cidr article
12:54 < codebeaker> doesn't the push tell my client what routes to add ?
12:54 < Bushmills> that network address and netmask combination are illegal
12:55 < codebeaker> ok
12:55 < Bushmills> you can push as much as you want, they remain illegal in that combination
12:55 < codebeaker> (but… and I will read up on this now, and ping you back) that's what my host is listing
12:55 < codebeaker> my server host, that is
12:56 < Bushmills> yes. *host* .  but you set a *network* route
12:56 < codebeaker> ah, ok
12:56 < codebeaker> so that's the *hosts* netmask, for static routing
12:56 < codebeaker> so the warning from route "blah…" – is actually telling me that my "push" (pushing the same route to the client) is also wrong
12:56 < codebeaker> (but the client doesn't complain, it just doesn't do anything
12:57 < Bushmills> that's the host ip address which is within a network with that netmask
12:57 < Bushmills> and the network address is 192.168.128.0
12:58 < Bushmills> goes all the way up to 192.168.255.255. therefore your host included
12:58 -!- Belial__ [~quassel@216.18.197.178] has joined #openvpn
12:59 -!- Belial_ [~quassel@128.210.61.130] has quit [Ping timeout: 260 seconds]
13:02 -!- luneff [~yury@84.51.197.177] has joined #openvpn
13:06 < codebeaker> ok, thanks - I wish I knew how to work that out…
13:06 < codebeaker> still working on it :)
13:07 < Bushmills> converting to hex?
13:07 < Bushmills> to binary, i mean
13:08 < codebeaker> yeah, and then from that… figuring out which netmask was enough
13:08 < Bushmills> you'll see once you write one below the other
13:08 < codebeaker> yeah, in bin ?
13:09 < Bushmills> yes
13:09 < codebeaker> ok, thanks
13:09 < mordy> hey, if i get a conflicting ip from the server (e.g. a private ip which my machine already has on a different network), how can i request a new IP?
13:09 < mordy> or how would i make openvpn do this for me automatically
13:09 -!- WebDawgII [~webdawg@72.242.51.155] has quit []
13:10 < Bushmills> mordy: depends
13:10 < Bushmills> openvpn won't do that
13:10 < Bushmills> you can configure openvpn, though, to use a different, non-conflicting subnet
13:10 < Bushmills> !1918
13:10 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
13:13 < mordy> i'm a client, not a server; thus i can't really control which subnet i'm assigned.. however, i'm using a few of these 'tunnel services', so i'm given a /32 address, so having 10.12.5.1/32 and 10.12.5.2/32 isn't a big deal
13:14 < Bushmills> codebeaker: bc can be used for converting to binary.   for example,   bc <<< "obase=2; 128"
13:14 < codebeaker> ah, cool
13:14 < codebeaker> nice tip :)
13:15 < Bushmills> codebeaker: to be honest, hadn't you said "ubuntu", i would have assumed that you knew it
13:16 < codebeaker> Bushmills: actually, I'm a web programmer… soeciality is web app deployment and scaling… normally I have network techs who can handle this for me…
13:16 < codebeaker> but I'm in a pinch, and need a VPN, because we have non-tech staff who need staging DB access, and we only listen on LAN addresses for DB connections
13:16 < codebeaker> it's sortof on my "to learn" list… because especially with IPv6 masking is more and more important
13:18 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
13:19 < mordy> i was thinking maybe.. using --ifconfig-noexec and then setting the ip in the --route-up script, and optionally checking for a conflicting address -- if conflicting, then i would send a SIGUSR1 or whatever to the process?
13:20 < mordy> or whatever.. i'm not sure of the exact script which i can run to make the IP assignment
13:21 < codebeaker> ok, I finally have these written out inline of eachother,
13:22 < codebeaker> but it's not jumping out at mew
13:23 -!- Vutral [ss@vutral.net] has joined #openvpn
13:23 < Bushmills> mordy: openvpn has nothing to do with assigning ip addresses to your interfaces, except where the virtual tun or tap devices used by openvpn are concerned
13:24 < Bushmills> the subnet openvpn uses (and server assigns addresses to clients) is set in the server config 
13:24 < codebeaker> Bushmills: thanks for your help… I still don't get it, and it's not much clearer after looking up CIDR#subnet-masking on wikipedia
13:25 < Bushmills> codebeaker: simplified:  the "1" bits in subnet mask are to address a network, the "0" bits to address a host within the network
13:26 < Bushmills> therefore can the "1" bits in the network address only be where the subnet mask has a "1"
13:26 < mordy> if you AND (&) the netmask with any address, you are to get the 'network address' of the IP
13:26 < Bushmills> all "1" in an ip address where subnet mask has "0" are for addressing hosts.
13:27 < mordy> here's partial output from ip addr ls to demonstrate the issue i'm having: http://pastebin.com/EujjtYrx
13:27 < Bushmills> therefore network address must have zeroes where subnet mask has zeroes
13:28 < Bushmills> 255.255.128.0 subnet mask has 17 ones, followed by 15 zeroes.
13:28 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
13:28 < krzie> subnetting 101
13:28 < Bushmills> thus, the last 15 bits in network address with that netmask must be zeroes too
13:29 < krzie> !google cidr cheatsheet
13:29 <@vpnHelper> CIDR SUBNET MASK CHEATSHEET & ICMP TYPE CODES: <http://www.oav.net/mirrors/cidr.html>; CIDR Block Prefix: <http://www.internetsecurityguru.com/cidr.html>; Country IP Blocks™ » CIDR Cheat Sheet: <http://www.countryipblocks.net/networking/cidr-cheat-sheet/>
13:29 < Bushmills> that's not the case with 192.168.154.0 network address
13:29 -!- Belial__ [~quassel@216.18.197.178] has quit [Ping timeout: 260 seconds]
13:33 <@vpnHelper> RSS Update - forum: Advice on upgrading Ubuntu on OpenVPN server host? <http://forums.openvpn.net/topic8152.html#p12137> || Disable/Enable TAP adapter <http://forums.openvpn.net/topic8090.html#p11962>
13:34 < mordy> the last octet of a subnet mask must always be .. and pardon my math, a combination of sequential powers of two subtracted from 254
13:34 < mordy> so 254-2, 254-(2+4), 254-(2+4+8), 254-(2+4+8+16) etc.
13:35 < Bushmills> not just last octed. whole subnet mask, if your concatenate all 4 octets
13:35 < Bushmills> ocet
13:35 < Bushmills> grrrr
13:35 < Bushmills> o c t e t
13:37 < Bushmills> maybe easier in that context to consider whole subnet mask one 32 bit number, rather than 4 8 bit numbers
13:39 < codebeaker> Bushmills: thanks, I'm gonig to read that about 10 times until it makes sense :-D
13:39 < codebeaker> you're a gent
13:41 < Bushmills> codebeaker: same as  "consider number 1234 as  onethousandtwohundredthirtyfour, rather than one two three four"
13:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
13:42 < Bushmills> "one big instead of four small numbers"
13:48 < Bushmills> for a demo, try to   ping 1311642570
13:48 -!- kyrix [~ashley@92.90.17.8] has joined #openvpn
13:49 -!- kyrix [~ashley@92.90.17.8] has quit [Max SendQ exceeded]
13:49 -!- kyrix [~ashley@92.90.17.8] has joined #openvpn
13:53 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
13:53 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has quit [Changing host]
13:53 -!- brian [~brian@unaffiliated/brian] has joined #openvpn
13:57 < mordy> didn't know ping could do that..
13:57 < mordy> but yeah, IPv4 addresses are stored as simple 32 bit unsigned integers
13:57 < mordy> the dot notation just makes it easier to read and remember
13:59 < Bushmills> and may be a remnant of a time when internet address space was still thought of in A, B and C classes 
14:00 < Bushmills> the dots marking the class boundaries
14:04 < Bushmills> or you could   ping $((36#lox1vu))   :)
14:04 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:12 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:33 <@vpnHelper> RSS Update - forum: New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12138>
14:36 < mordy> still not clear on how to handle this IP conflict thing, where i'm literally getting the same IP from different servers
14:38 < codebeaker> Bushmills: thanks, that's interesting, didn't know you could ping the … what is that "ineteger representation" of an IP
14:38 < mordy> i'm using several openvpn client instances in parallel, i already have a route-up script which uses a flock-based synchronization mechanism to make custom routing tables and policies for each connection
14:39 < mordy> http://pastebin.com/Wr4TrAX3
14:41 < Bushmills> mordy: set up servers to assign you ip addresses in different subnets
14:42 < mordy> i don't own the servers, i don't control them :(
14:43 < Bushmills> run VMs on your machine, have them connect to the conflicting openvpn servers
14:44 < mordy> not an option either.. i don't know how many VPNs will conflict (could be a good 5-10). what i *DO* think is viable is figure out a way to ask the client to force a reconnect on the server side
14:45 < Bushmills> i doubt that. if there's a conflict, the whole subnet, and route conflicts - you'd need to patch up all the routes too
14:46 < mordy> Bushmills: i'm only dealing with two IP addresses, both are /32.. for any traffic originating from any of the interfaces, a custom routing policy is looked up in a private routing table.
14:46 < Bushmills> not doing that would leave you with multiple indentical net routes to different interfaces
14:46 < mordy> the first is the local ip address, the second is some kind of gateway which apparently NATs my traffic
14:46 < Bushmills> identical
14:47 < Bushmills> well, i don't have a solution for that. but it appears that there is little openvpn can do to solve that
14:48 < codebeaker> Bushmills, thanks for your advice, I still can't do the bitwize math, I think I should hang my programmer coat
14:49 < codebeaker> or I'm suffering serious mental block
14:49 < codebeaker> is this the topic that a netmask isn't always a netmask ?
14:49 < mordy> http://pastebin.com/g5N58QCK (what i'm using for routing.. i.e. why the same subnet isn't an issue)
14:49 < Bushmills> try coffee
14:49 < mordy> (from ip rule ls)
14:49 < codebeaker> should I AND the addresses that I care about reaching with eachother?
14:50 < mordy> bbl
14:51 < codebeaker> Bushmills: what moving pieces are there here, there's the actual IP, and the netmask… I'm confused where the 2rd mask comes in, the network-netmask… vs the host-netmask?
14:53 < Bushmills> codebeaker: there are articles in the net to help you with that confusion
14:53 < codebeaker> Bushmills: thanks…
14:53 < codebeaker> just out of curiosity, is there a "right" mask that I shoudl be using
14:54 < codebeaker> something that Linode's support could just tell me if I ask ?
14:54 < codebeaker> I've spent 4 days trying to make this work
14:54 < Bushmills> meaning to say, i tried to explain twice already. evidently i failed, so there's no use trying a third time
14:54 < codebeaker> yeah, I appreciate your patience, really I do - but maybe once I get the "right" answer I can see which bit of my working-out isn't working
14:54 < Bushmills> consult documentation of someone more apt at explaining
14:55 < codebeaker> I guess "network address" is the part that's confusing about what you wrote above…
14:55 < Bushmills> have you tried putting binary representation of host address and netmask below each other?
14:55 < codebeaker> I've drawn up the LAN addresses of the servers in binary…
14:55 < codebeaker> I got that far
14:56 < Bushmills> well. i suggested that not to keep you busy but to out netmask and network address in relation,
14:56 < codebeaker> ignoring the last octet, I assume… becuse that will be '0' (or 00000000)
14:56 < codebeaker> for clarification, "network address" you don't mean the host IP address, you mean the "Address of the network" –– or this number that I'm failing to come up with?
14:57 < Bushmills> once you see them, binary digit  for digit below each other, it become evident
14:57 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
14:58 < Bushmills> yes. the network part of an ip address. as characterised be the "1" bits of the netmask
14:58 < codebeaker> ah, so I see it;
14:58 < codebeaker> damn
14:59 < codebeaker> http://pastie.org/1912501 < right ?
15:00 < Bushmills> right. all ip address within the same subnet.
15:00 < codebeaker> so I need … if I'm not mistaken, 10111101 or more
15:00 < codebeaker> (or > 189) whilst still keeping the mask, or - there's something I'm missing, still about masking significant bits
15:00 -!- Guifort [~Guifort@69.182.124.78.rev.sfr.net] has joined #openvpn
15:01 < Bushmills> set all digits above the netmask zeroes to 0, and you have the network address
15:01 < codebeaker> ok…
15:02 < codebeaker> above = left-of, right ?
15:02 < codebeaker> s/right/ok/ ?
15:02 < Bushmills> no. above
15:02 < codebeaker> ah, literally above, ok
15:03 < codebeaker> my result looks like "11111111 11111111 10111101 11111111" - but I have a feeling I've done it wrong
15:04 < Bushmills> last digit of netmask is a zero. so there can't be a 1 as last digit of your result ...
15:05 < Bushmills> because you're supposed to set all digits to zero, where netmask has a zero
15:05 < Bushmills> zeroes are the roundish looking things. not the vertical-bar kind things
15:05 < codebeaker> is this bitwise AND?
15:05 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html>
15:05 < Bushmills> yes
15:06 < codebeaker> an and across all three addresses, and the mask ?
15:06 < Bushmills> netmask with one of them.  once a zero, always a zero, regardless how often and with what you continue to AND it
15:06 < codebeaker> ahh, ok
15:07 -!- ras0ir is now known as ben_ras0ir_degil
15:07 -!- ben_ras0ir_degil is now known as ras0ir
15:08 < codebeaker> …… but not where the IP has a 0, right?
15:08 < Bushmills> what'd you put in place of that 0?
15:09 < codebeaker> well, if I got it right, if I & "11000000 10101000 10100100 11100101" and "11111111 11111111 10000000 00000000" the result is "00111111 10101010 10000000 00000000"
15:10 < codebeaker> no, I just plain got it wrong
15:10 < Bushmills> read about what  bitwise AND does. or just stick to:  "set all digits above the netmask zeroes to 0, and you have the network address"
15:10 < codebeaker> damn, I don't know anywhere near enough to do this
15:10 < codebeaker> ok
15:13 < codebeaker> I don't get it
15:13 < codebeaker> thanks though
15:13 < codebeaker> I see how it's supposed to work
15:13 < codebeaker> if I and thew first two octets, then they become meaningless
15:13 < codebeaker> well, they become 192.168… which can't be right, because it doesn't look like any netmask I've ever seen
15:14 < codebeaker> I get 192.168.219.26 (although I gather the last octet isn't important)
15:14 < Bushmills> you *have* the netmask already.  255.255.128.0.  you are determining the *network address*
15:15 < codebeaker> OK, so is my result valid ?
15:15 < Bushmills> no
15:15 < codebeaker> >_<
15:15 < codebeaker> d'oh
15:15 < codebeaker> back to the drawing board
15:15  * Bushmills wonders how difficult it is to strip the last 15 digits, and replace them against zeroes
15:16 < codebeaker> Bushmills: I'm sure if we were sitting in the same room, I'd have got it by now
15:16 < Bushmills> i'd be throwing things at you by now
15:17 < codebeaker> yeah, probably :)
15:17 < codebeaker> why is it the last 15, that might help me
15:17 < Bushmills> because the netmask ends with 15 zeroes
15:17 < ScriptFanix> because you have 17 ones :)
15:18 < codebeaker> right, gotcha…
15:19  * ScriptFanix whispers ... ipcalc
15:19  * Bushmills considers a career as roofer, rather than IT instructor 
15:20 < ScriptFanix> but you need to know what you're doing so do it and then learn about tools that do it for you
15:20 < codebeaker> yeah, I think I misunderstood what & should do with two zeros
15:22 < ScriptFanix> 0 & <anything> = 0
15:22 < codebeaker> yeah, if I AND any of the IPs with a netmask – then the result is still "11111111 11111111 10000000 00000000" (or equal to my netmask)
15:22 < ScriptFanix> do your IPs begin with 255.255 ?
15:23 < codebeaker> no, but Bush said to only do the last 15 digits
15:23 < ScriptFanix> then you're doing it wrong
15:23 < ScriptFanix> nope i think he said the last 15 digits were supposed to be zeroes
15:24 < codebeaker> then the answer is 11000000 10101000 10000000 00000000
15:24 < ScriptFanix> you got it :)
15:25 < codebeaker> hah, thanks - ok, good - thank you both for your patience, if you're ever in Hamburg, DE - look me up for a beer
15:26 -!- hbeck [~hbeck@38.114.125.114] has joined #openvpn
15:28 < hbeck> !welcome
15:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:28 < hbeck> !route
15:28 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:28 < codebeaker> d'oh - so much for that :( route: bogus netmask 192.168.128.0
15:28 < codebeaker> thanks again though
15:28 < codebeaker> time to ask support to fix it
15:28 < ScriptFanix> codebeaker: ?
15:29 < ScriptFanix> i think you failed at route syntax, 192.168.128.0 is not your netmask
15:29 < codebeaker> so that's my "base' network address, and I use that as the 1st arg to `route` ?
15:30 < Bushmills> (19:57:51) Bushmills: and the network address is 192.168.128.0
15:30 < Bushmills> fyi, i'm in same timezone as you :)
15:30 < codebeaker> ok, I have it starting without errors now
15:30 < codebeaker> really Bushmills - cool, not Germany I assume
15:31 < Bushmills> why do you assume that?
15:31 < codebeaker> because your info lists .net - although it's clearly a bnc
15:31 < codebeaker> … so, all bets are off, actually :)
15:31 < codebeaker> but because most of the time Germans on IRC note my hostname, and offer to speak German
15:31 < codebeaker> but, again, it's not a reliable measure :)
15:32 < Bushmills> i even speak a bastard version of plat
15:33 < codebeaker> :) Actually, I'm not a German native speaker… Engänder who came here to work for XING AG… and got stuck :)
15:34 < Bushmills> watching football sometimes? as hamburg resident, St.Pauli, maybe? 
15:34 < codebeaker> not if I can help it :)
15:34 < codebeaker> but I only live a couple of hundred meters from st. pauli
15:34 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
15:34 < Bushmills> then your team played my team the weekend
15:34 < codebeaker> heh :)
15:35 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Remote host closed the connection]
15:35 < codebeaker> war es Leverkusen ?
15:35 < Bushmills> nope
15:38 < codebeaker> hrm, now everything starts-up, on the server-side OK - but I now get: 'PUSH_REPLY,route 10.77.22.0 255.255.255.0,route 192.168.128.0 255.255.128.0,route 10.77.22.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.77.22.6 10.77.22.5' (status=1) on the log… I Assume that means my client can't accept the route for some reason
15:38 <@vpnHelper> RSS Update - forum: Question: Bridging client TAP (linux) <http://forums.openvpn.net/topic8116.html#p12140>
15:38 -!- leocomerford [~Leo@89.100.17.31] has joined #openvpn
15:39 < Bushmills> what's the error message?
15:40 < codebeaker> I don't see anything on the client, but I'm using the "Shimo" client
15:40 < leocomerford> !welcome
15:40 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:40 < leocomerford> !howto
15:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:40 < Bushmills> i also don't see an error message
15:41 < codebeaker> but ping to the db server (192.168.154.1274) returns "no route to network"
15:41 < codebeaker> ah, no requst timeout… 
15:41 < leocomerford> !goal
15:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:43 < Bushmills> 192.168.154.1274 ... funny ip address
15:43 < codebeaker> was a typo in here, sorry
15:44 < Bushmills> if you get the message "no route to network", then i suppose the reason of the problem is "no route to network"
15:45 < codebeaker> strange thing is that TCPdump shows packets on tun0
15:45 < codebeaker> … but they're not showing up even in the server log
15:45 < codebeaker> although, server is only verb 3
15:45 < codebeaker> and doesn't have ip_forwarding
15:45 < codebeaker> … so that could be an issue to solve next
15:46 -!- hbeck [~hbeck@38.114.125.114] has quit [Quit: Leaving]
15:47 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
15:49 <@vpnHelper> RSS Update - forum: please help client bridging issues <http://forums.openvpn.net/topic8045.html#p12141>
15:50 < codebeaker> I'm seeing a lot of "leehambley/188.192.24.211:50971 GET INST BY VIRT: 192.168.154.127 [failed]" in the logs on the server now with verb9
15:50 < codebeaker> ok, I found out why, I need an iroute, right ?
15:51 < codebeaker> from an FAQ: These errors occur because OpenVPN doesn't have an internal route for 192.168.100.249. Consequently, it doesn't know how to route the packet to this machine, so it drops the packet. Use client-config-dir and create a ccd file for your client containing the iroute option to tell OpenVPN that the 192.168.100.0/24 network is available behind this client. ––– but what when my clients have randomly changing public I
15:51 < codebeaker> and i'm reading !route
15:52 < codebeaker> I'm very lost again… unless my client has a known IP, I can't do this, right ?
15:53 < codebeaker> !route
15:53 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:58 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Quit: GOSUB w/o RETURN]
15:59 -!- Belial_ [~quassel@128.210.61.130] has quit [Read error: Connection reset by peer]
16:01 < leocomerford> Hello all. I'm trying to set up a VPN service from a static IP to a handful of roadw'rr'rs, using certificate authentication. (I'm using the Ubuntu 11.04 openvpn packages, so it's OpenVPN 2.1 .) The thing is that I want to use certificates signed by a commercial CA rather than by a self-signed CA. So clearly I'll need some kind of whitelist of the authorised client certs, yes? (And likewise for clients to identify the server cert.)
16:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
16:03 < leocomerford> The thing is: how do I make sure I can uniquely identify clients? I've read about --tls-verify and the verify-cn script to verify Common Names.
16:05 -!- codebeaker [~codebeake@188-192-24-211-dynip.superkabel.de] has quit [Quit: codebeaker]
16:05 < leocomerford> But are Common Names guaranteed to be unique among all the different individuals issued certs by one given commercial CA? Among all individuals issued certs from all the (mainstream) commercial CAs?
16:06 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
16:06 < leocomerford> I thought that it was the Distingished Name that's supposed to be unique? So, basically: I'm not sure 1) if I need to check for something other than CN, 2) how I'd go about doing that, if I have to.
16:07 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:10 < leocomerford> It happens that the server and client certs I currently have to work with are all issued by the same CA, so if CN is unique for a single CA then I can presumably just rely on verify-cn for now.
16:14 -!- Guifort_ [~Guifort@69.182.124.78.rev.sfr.net] has joined #openvpn
16:15 < leocomerford> (Anyone?)
16:16 -!- Guifort [~Guifort@69.182.124.78.rev.sfr.net] has quit [Read error: Connection reset by peer]
16:17 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
16:19 -!- Guifort_ is now known as Guifort
16:26 -!- kyrixpower [~ashley@92.90.17.1] has joined #openvpn
16:26 -!- kyrix [~ashley@92.90.17.8] has quit [Ping timeout: 240 seconds]
16:30 -!- K1ng` [KING@180.211.188.218] has joined #openvpn
16:34 -!- K1ng [~KING@180.211.188.218] has quit [Ping timeout: 260 seconds]
16:40 -!- Guifort [~Guifort@69.182.124.78.rev.sfr.net] has quit [Quit: Quitte]
16:42 < leocomerford> Feh.
16:43 -!- leocomerford [~Leo@89.100.17.31] has quit [Quit: Leaving]
16:50 -!- RedPhasing [~manel@bl8-84-179.dsl.telepac.pt] has joined #openvpn
16:50 < RedPhasing> hy!
16:50 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
16:51 < RedPhasing> my company uses openvpn
16:52 < RedPhasing> i can connect to my pc that's in the company
16:52 < RedPhasing> using windows
16:52 < RedPhasing> installed openvpn and copied the files
16:52 < RedPhasing> cert, key and another one
16:53 < RedPhasing> but i use linux, and i would like to use it to connect to my pc
16:53 < RedPhasing> but i just cant find the folder to place the files
16:53 < RedPhasing> !welcome
16:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:53 < RedPhasing> !howto
16:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:56 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:57 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:58 < Bushmills>  put them in /etc/openvpn.  reading openvpn's man page could have told you
16:59 < Bushmills> it will tell you how to tell in openvpn config file where openvpn expects them
16:59 < RedPhasing> ty
17:08 <@vpnHelper> RSS Update - forum: New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12143>
17:08 -!- kyrixpower [~ashley@92.90.17.1] has quit [Quit: Leaving]
17:32 <@vpnHelper> RSS Update - forum: Configure clients to access all networks <http://forums.openvpn.net/topic8121.html#p12144>
17:34 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
17:40 -!- tty234 [telex@gateway/shell/anapnea.net/x-ibxmbkoyxnvsotly] has joined #openvpn
17:41 < RedPhasing> now connected to the company network
17:41 < RedPhasing> one question
17:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
17:42 < RedPhasing> in the readme file sent by the company they say to change the dns config in the tap win32 virtual adapter 
17:42 < RedPhasing> but thats in windows
17:44 < RedPhasing> how can i change the dns in linux
17:44 < Bushmills>  not much of a linux user, aren't we?
17:44 < RedPhasing> for the virtual adapter?
17:44 < RedPhasing> well iam
17:44 < Bushmills>  /etc/resolv.conf
17:44 < RedPhasing> humm
17:45 < RedPhasing> ty.. again
17:46 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
17:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
18:00 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:13 < RedPhasing> bye
18:13 < RedPhasing> ty Bushmills 
18:13 -!- RedPhasing [~manel@bl8-84-179.dsl.telepac.pt] has left #openvpn []
18:20 <@vpnHelper> RSS Update - forum: New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12145>
18:32 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
18:34 -!- Squidy_at_Home [~quassel@189.73.209.187] has joined #openvpn
18:34 -!- corretico [~luis@201.201.44.82] has joined #openvpn
18:44 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
18:49 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:49 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
19:38 -!- ravidar [~ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
19:40 -!- QRohlf [~QRohlf@c-71-193-192-19.hsd1.or.comcast.net] has joined #openvpn
19:40 < QRohlf> !welcome
19:40 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:41 < QRohlf> !goal
19:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:42 < QRohlf> I am trying to troubleshoot a machine-specific issue connecting to an OpenVPN server which is not caused by the config.
19:42 < QRohlf> Details here: http://pastebin.com/w2Qjemda
19:49 < QRohlf> Hello?
19:50 <@vpnHelper> RSS Update - forum: Machine-specific issue which is not caused by configs <http://forums.openvpn.net/topic8155.html>
19:56 <@vpnHelper> RSS Update - forum: Is it a bug openvpn allows two same certification existed? <http://forums.openvpn.net/topic8081.html#p12147>
20:08 -!- QRohlf [~QRohlf@c-71-193-192-19.hsd1.or.comcast.net] has left #openvpn ["I need to leave now, if anyone sees my posts and has an answer or idea, it would be wonderful if you could post it on my forum topic (linked above, in the RSS Update)"]
20:10 -!- master_of_master [~master_of@p57B5564C.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
20:12 -!- master_of_master [~master_of@p57B558EB.dip.t-dialin.net] has joined #openvpn
21:03 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
21:31 -!- Squidy_at_Home [~quassel@189.73.209.187] has quit [Remote host closed the connection]
21:33 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12148>
21:46 < Vutral> oh yeah
21:47 < Vutral> you know what annoys me ^^
21:47 < Vutral> the windows tap driver is still slow ^^
21:47 < Vutral> compared to ipsec
21:47 < Vutral> and well colinux got a 100mbit tap
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:34 -!- ravidar [~ravidar@ip24-255-127-217.dc.dc.cox.net] has quit []
23:37 < kraut> moin
23:40 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:43 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
23:45 -!- Vutral [RaX2QRQq2o@vutral.net] has joined #openvpn
--- Day changed Tue May 17 2011
00:33 <@vpnHelper> RSS Update - forum: Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12149>
00:35 -!- takamichi [Takamichi@78.133.37.249] has quit [Remote host closed the connection]
00:59 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:03 -!- K1ng` [KING@180.211.188.218] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
01:14 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
01:18 -!- Vutral [RaX2QRQq2o@vutral.net] has quit [Ping timeout: 276 seconds]
01:18 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:25 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:28 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
01:31 -!- torpion2 [~torpion@ydb.me] has joined #openvpn
01:32 -!- torpion1 [~torpion@ydb.me] has quit [Ping timeout: 240 seconds]
01:52 -!- Vutral [OnpnTsgkdz@vutral.net] has joined #openvpn
01:58 -!- dazo_afk is now known as dazo
02:16 -!- Vutral [OnpnTsgkdz@vutral.net] has quit [Ping timeout: 240 seconds]
02:24 -!- Vutral [3Wi0Vk2lEB@vutral.net] has joined #openvpn
02:29 -!- Vutral [3Wi0Vk2lEB@vutral.net] has quit [Ping timeout: 260 seconds]
02:39 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
02:42 -!- Vutral [ss@vutral.net] has joined #openvpn
02:42 -!- Diffen [~diffen@c-fc73e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:44 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:46 < xsurfer> is there a new update on openvpn over icmp?
02:47 -!- brian [~brian@unaffiliated/brian] has quit [Ping timeout: 246 seconds]
02:54 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
02:55 < xsurfer> is there a new update on openvpn over icmp?  I have seen this site but dont know how to use openvpn over icmp  http://article.gmane.org/gmane.network.openvpn.devel/1983
02:55 <@vpnHelper> Title: Gmane -- Mail To News And Back Again (at article.gmane.org)
03:00 -!- Vutral [Vq7oSWhgsM@vutral.net] has joined #openvpn
03:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
03:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:05 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
03:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 250 seconds]
03:21 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
03:23 < mordy> ok.. still wondering what i can do about conflicting IP addresses
03:24 < mordy> basically i need a way to tell openvpn to restart/reinitiate the connection if i'm given a bad IP
03:24 < mordy> i'm already using the management interface programmatically over a unix socket, but it doesn't seem to afford any big advantages except maybe being able to enter a username/password
03:24 < mordy> (which apparently i can also do via expect)
03:30 <@dazo> mordy: I believe the OpenVPN server will assign the same IP address unless another client pops in and assigns it to another client 
03:31 < mordy> dazo: that's what's happening
03:32 < mordy> could be a race condition for all i know, as i'm having multiple client instances
03:32 < mordy> ahh d'oh
03:32 <@dazo> mordy: there's no away around that, unless you'll patch the server with a "I_DONT_WANT_THIS_IPADDR" response feature
03:32 < mordy> i see what you mean.. hrrm..
03:32 < mordy> nah, i don't own the server, unfortunately :/
03:33 <@dazo> mordy: multiple clients is doable ... unless you IP addresses are static, via --client-config-dir on the server
03:33 <@dazo> if you can't control the server, you're out of luck
03:37 < mordy> i wonder if there's still a way to circumvent this using the linux networking stack
03:41 < mordy> i'm seemingly able to bind to each interface and appear to have distinct connections for each, even though they share the exact same IP addresses.. of course this goes against anything i've ever though about binding to interfaces, but it mgiht be a path somewhere
03:41 -!- Vutral [Vq7oSWhgsM@vutral.net] has quit [Ping timeout: 260 seconds]
03:41 < mordy> to be clear here, i'm using these client connections as exit routes, so i'm mainly just bind()ing to the interface addrs and then connecting to remote hosts
03:48 < mordy> maybe adding a second unique address to the interface, binding to that one, and then snat to the real one?
03:56 -!- Vutral [1wt6Gc2PAE@vutral.net] has joined #openvpn
04:00 -!- Vutral [1wt6Gc2PAE@vutral.net] has quit [Ping timeout: 264 seconds]
04:01 -!- codebeaker [~codebeake@77-23-168-43-dynip.superkabel.de] has joined #openvpn
04:05 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
04:05 < codebeaker> !route
04:05 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:11 -!- Vutral [ss@vutral.net] has joined #openvpn
04:11 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
04:11 < Cubox> Hello, on the howto, i don't have understand what to do for have a password ( and user ) autentification system
04:12 < Cubox> !password
04:12 <@vpnHelper> Error: You don't have the admin capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
04:12 < Cubox> ok
04:12 < Cubox> OH a supybot <3
04:12 < Cubox> !welcome
04:12 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:14 <@dazo> Cubox: you want to have username/password auth in addition or instead of certificates?
04:15 < Cubox> no certificate, only user/password
04:15 <@dazo> Cubox: how would you like to authenticate your users?  PAM, database, LDAP?
04:15 <@dazo> RADIUS?
04:15 < Cubox> text file ?
04:16 <@dazo> okay, nobody has written and published such a thing for OpenVPN ... but it's pretty simple to do
04:16 < Cubox> ?
04:16 <@dazo> you then need to look at --client-cert-not-required in the man page
04:17 < Cubox> i have set this option, but the server do an error
04:17 <@dazo> and then --auth-user-pass-verify 
04:17 < Cubox> May 17 00:27:40 e-noob ovpn-server[23694]: Options error: --client-cert-not-required must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin
04:17 < Cubox> dazo: where i set the user/password file ?
04:17 <@dazo> correct
04:18 <@dazo> you need to write a script which does the authentication based on your file
04:18 < Cubox> mmh
04:18 <@dazo> the script passed to --auth-user-pass-verify  will be a script which is called for each new session, where it will be provided with username/password ... and you need to match that against your text file
04:19 <@dazo> then your script echo's 1 for success, and 0 for failure ... OpenVPN picks that up and allows or rejects the connection
04:19 <@dazo> sorry!
04:19 <@dazo> exit code 1 for error and exit code 0 for failure
04:20 <@dazo> the man page explains it quite decent
04:20 < Cubox> 0 = good, 1= little error 2 = big error
04:20 < Cubox> :)
04:20 < Cubox> mmh
04:20 < Cubox> Ok, i look
04:26 <@dazo> Cubox: looking at the code, only 0 and 1 seems to be valid exit codes .... not sure where you found 2 ...
04:26 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
04:26 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 260 seconds]
04:28 -!- Vutral [FwU3IseKYU@vutral.net] has joined #openvpn
04:32 < codebeaker> I'm reading !route, but I' missing something, I don't want to join two lans, but to give clients access to the VPN server's remote LAN, I have a connection, it works - but when trying to use it, I have lines such as "client/<CLIENT WAN IP>:40390 GET INST BY VIRT: <DB SERVER ON VPN LAN IP> [failed]" - I assume I'm missing a route, but I'm totally lost as to where :S
04:35 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:35 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:35 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:35 < codebeaker> https://gist.github.com/f9867afdc6320c57e4e3 - configs are there, incase that anyone can identify what's up
04:35 <@vpnHelper> Title: leehambley's gist: f9867afdc6320c57e4e3 Gist (at gist.github.com)
04:36 < mordy> ok, so i reached partial success.. my solution with SNATing to an arbitrary IP works
04:36 < mordy> now the question is how can i better convey this to the management interface
04:37 < mordy> thing is that i rely on the management interface for connection parameters etc. etc. -- it would be nice if i could have hook scripts or whatever notify the management interface so i don't have yet another IPC PITA
04:46 < codebeaker> can anyone who understands routing help me with this, I have the problem as described here ( http://www.secure-computing.net/wiki/index.php/Graph ), but I don't understand what I should be routing to where
04:46 <@vpnHelper> Title: Graph - Secure Computing Wiki (at www.secure-computing.net)
04:47 < Cubox> Hello, on SuSE && gnome 3, how to autostart openvpn and do it reconnect if vpn close ?
04:47 < mordy> let me see
04:49 < mordy> codebeaker: first of all, the method you use to connect to openvpn seems to be quite immaterial here, since at the end of the day you just get a tun device, the underlying transport is not important
04:49 < mordy> unless some guru here can tell me otherwise
04:50 < mordy> i'm not sure which network you wish to access from your openvpn client - is it the 10.10.2.0 network?
04:52 < mordy> also, which operating system are you using?
04:53 -!- luneff [~yury@84.51.195.188] has joined #openvpn
04:53 < codebeaker> I'm on Mac… vpn host, and it's lan are Ubuntu, the lan I try to access over the VPN is 192.168.12.0/255.255.128.0 - and my VPN is configured to run on  10.77.22/24
04:54 < Cubox> !routing
04:54 < Cubox> !welcome
04:54 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:54 < Cubox> !redirect
04:54 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
04:54 < Cubox> !nat
04:54 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
04:54 < codebeaker> ya ?
04:54 < Cubox> !linnat
04:54 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
04:54 < mordy> ffs
04:55 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
04:56 < mordy> codebeaker: the basic idea is this; the local address you get on your tun device is a /32, meaning there isn't any implicit route to anything anywhere
04:57 < mordy> you will need to tell your routing table about the networks you wish to reach, and how you want to reach them
04:58 < codebeaker> ok, but I don't know what netowrk I want to reach, since my clients can connect from anywhere
04:59 < mordy> codebeaker: openvpn merely facilitates a kind of physical link between two otherwise isolated networks.. the same rules of normal routing still apply
05:00 < mordy> you want to connect to your real 192. network, of course
05:00 -!- Vutral [FwU3IseKYU@vutral.net] has quit [Ping timeout: 252 seconds]
05:00 < codebeaker> mordy: sorry but I don't understand :(
05:01 < codebeaker> I'm no system admin, I just need this to work
05:01 < codebeaker> so that my front-end engineering guy can reach the staging DB
05:02 < mordy> assuming your openvpn server is 10.77.22.1, and your tun device is tun0, you might want to do something like this:
05:04 < mordy> (for OS X): route add -host 10.77.22.1 -interface tun0; route add -net 10.77.22.1/24 10.77.22.1
05:06 -!- Vutral [V23s23RRYM@vutral.net] has joined #openvpn
05:10 <@vpnHelper> RSS Update - forum: Connection times out <http://forums.openvpn.net/topic8153.html#p12151> || Connection works for only few seconds <http://forums.openvpn.net/topic8109-15.html#p12150>
05:16 <@vpnHelper> RSS Update - forum: Question: Bridging client TAP (linux) <http://forums.openvpn.net/topic8116.html#p12153> || auth-user-pass-verify causing errors/crashes? <http://forums.openvpn.net/topic8151.html#p12152>
05:17 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 252 seconds]
05:21 < codebeaker> thanks mordy 
05:21 < codebeaker> but that's working, my OSX host can reach the VPN, and the packets go over the tun0 device (I guess my server push directives are correct)
05:21 < codebeaker> the problem is on the return trup
05:21 < codebeaker> the server doesn't know how to send data bound for my client back, I thnk
05:22 <@vpnHelper> RSS Update - forum: can ping printer but can't ping computer <http://forums.openvpn.net/topic8106.html#p12155> || squid proxy without configuring client web browser <http://forums.openvpn.net/topic7990.html#p12154>
05:23 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.6-dev"]
05:23 < mordy> for the return you need every host on the 192 network to know about the 10 network
05:23 < codebeaker> ok, … right
05:23 < mordy> you might need to enable ip forwarding on your server, too
05:23 < codebeaker> I did enable IP forwarding, that was one step I did make
05:24 < mordy> if your openvpn server also acts as a default gateway for the other hosts, it shouldn't be an issue either
05:24 < codebeaker> the surprising thing is that I see the "failed" entries in the server log, so I assumed that openvpn was seeing the traffic on the return trip
05:24 < codebeaker> yeah, it's not the default gateway
05:24 < codebeaker> … unfortunately
05:24 < codebeaker> it's just another host
05:25 < mordy> alternatively, you can have the openvpn server do NAT 
05:25 < codebeaker> whats the simplest thing that could work?
05:26 < mordy> probably nat
05:26 < codebeaker> yeah?
05:26 < codebeaker> this is only for one low-rent developer who doesn't need/want to know anything about databases to have access to the staging DB
05:26 < mordy> the easiest would probably be to set up an ad-hoc network where all machines involved have an openvpn connection
05:27 < mordy> in which case the process is relatively straight forward
05:27 < codebeaker> ^ that's not really viable
05:27 < mordy> i'm not familiar with any of the features that openvpn provides natively, i'm sure there are some things i've missed out which might make your life a bit easier and not force you to deal with your OS's routing and packet filter
05:27 < codebeaker> although, it would just be one server, additionally
05:28 < mordy> for OS X, doing nat is a bit more exotic, you need to lookup ipfw and natd, and friends
05:28 < codebeaker> but, I really am convinced the problem is on the server
05:28 < codebeaker> like I said, I see the packatts on tun0 on my workstation, and then I see a failure on the return path in the server logs
05:28 < codebeaker> and, surely it's not the client responsiblity to push a route to the server
05:31 < mordy> so the return packet goes out of the 192 box?
05:31 < mordy> and reaches the openvpn server?
05:34 <@vpnHelper> RSS Update - forum: Is it a bug openvpn allows two same certification existed? <http://forums.openvpn.net/topic8081.html#p12158> || New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12157> || Machine-specific issue which is not caused by configs <http://forums.openvpn.net/topic8155.html#p12156>
05:35 < codebeaker> well, I dunno
05:35 < codebeaker> :(
05:36 < codebeaker> unfortunately tcpdump is kind of useless
05:37 < codebeaker> since all it shows is my packets on tcpdump >_<
05:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:40 < codebeaker> I might just have to conceed, and ask linode support
05:40 <@vpnHelper> RSS Update - forum: Ping works - the rest does not <http://forums.openvpn.net/topic8156.html> || Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12160> || OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12159>
05:40 < codebeaker> I see so, so much noise on tcpdump on the lan from linode
05:43 < codebeaker> ok, it appears the packets never make it to the DB server, so that's easier
05:43 < mordy> use filters, maybe try to access using a protocol like icmp
05:43 < codebeaker> they make it to the vpn server, but no further
05:43 < mordy> and thus tcpdump -ni tun0 icmp
05:43 < codebeaker> (I was able to filter the tcpdump on the IP of my vpn host, I don't see *any* traffic… but I assume packets will come from that serve's LAN IP
05:44 < codebeaker> (ok, confirmed, my tcpdump filtering works)
05:45 < codebeaker> so my vpn host isn't forwarding the packets to the db server
05:45 < codebeaker> I thought that was configured correctly already with push "route 192.168.128.0 255.255.128.0"
05:46 < codebeaker> and/or - route 192.168.128.0 255.255.128.0
05:46 <@vpnHelper> RSS Update - forum: can ping printer but can't ping computer <http://forums.openvpn.net/topic8106.html#p12164> || Ping works - the rest does not <http://forums.openvpn.net/topic8156.html#p12163> || Configure clients to access all networks <http://forums.openvpn.net/topic8121.html#p12162>
05:48 < codebeaker> these changese are being made  - http://pastie.org/1915565
05:48 < codebeaker> when I start the server
05:48 < codebeaker> I guess #17 is the problem?
05:51 < mordy> yeah, that doesn't look right
05:51 <@vpnHelper> RSS Update - forum: can ping printer but can't ping computer <http://forums.openvpn.net/topic8106.html#p12165>
05:52 < codebeaker> ok, so I'm going to hang this issue, and forget about it, for now
05:52 < mordy> * means it's assuming a direct route
05:52 < codebeaker> ahh, ok - I fugured that asumed it was a catch-all
05:52 < mordy> (e.g. physically connected, no router needed)
05:52 < codebeaker> ah, ok - could be strange topology?
05:52 < codebeaker> these are Xen VPS slices
05:53 < mordy> line 17 is totally wrong
05:53 < mordy> unless you actually have such a network on your eth0
05:53 < codebeaker> that's a default from the host's config though
05:53 < codebeaker> it's on eth0:0 - but I don't know how it actually works…
05:53 < mordy> either line 16 or line 17 is wrong
05:54 < codebeaker> the lan is aliased to wth0:0 
05:54 -!- oskie [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has quit [Read error: Operation timed out]
05:54 < codebeaker> well, line 16 is added by openvpn's `route` line, so that's more likely to be wrong, tbh :(
05:54 < mordy> is the paste from a client or from a server?
05:54 < codebeaker> the server
05:54 < codebeaker> (sorry, that wasn't very clear)
05:55 < mordy> ok.. so the server, since it has a direct route to the 192 network, doesn't need line 16
05:55 < codebeaker> oh, ok 
05:56 <@vpnHelper> RSS Update - forum: duplicate-cn and client subnet <http://forums.openvpn.net/topic8157.html#p12168> || please help client bridging issues <http://forums.openvpn.net/topic8045.html#p12167>
05:56 < mordy> now, next step, is to check whether the server can ping a client, e.g. ping -I10.77.22.2 10.77.22.53 or something
05:57 -!- oskie [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has joined #openvpn
05:57 < codebeaker> that is the vpn server
05:57 < mordy> if that works, check on another client box, and see if that client box can ping the server's 10. address
05:58 < codebeaker> ok, appears not to work
05:58 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
05:58 < mordy> can you pastebin a routing table from the client?
05:59 < codebeaker> yeah, sure - not sure how to get it on OSX…
05:59 < codebeaker> but lemme figure it out
05:59 < mordy> netstat -nr
05:59 < codebeaker> http://pastie.org/1915619
05:59 < codebeaker> (thanks)
06:00 < codebeaker> VPN server can ping client, and visa-versa
06:01 < codebeaker> and, interestingly, the vpn server can (of course) ping the DB server on it;s 192.168.128.x lan, *unless* openvpon is running
06:01 < codebeaker> then it can't
06:01 < mordy> did you remove that extraneous line from the server's routing table/
06:01 < codebeaker> it's still there for now, because I wanted to do these tests before I removed it
06:01 < codebeaker> … but which one to remove #16, or #17
06:02 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109-15.html#p12170> || can ping printer but can't ping computer <http://forums.openvpn.net/topic8106.html#p12169>
06:02 < mordy> 16
06:02 < codebeaker> ah, ok
06:02 < codebeaker> ok, easy - so now my vpn server can still ping the db server with openvpn running, but my client can't reach it still
06:02 < codebeaker> (it = the db server)
06:03 < mordy> can i see the db server's routing table?
06:03 < codebeaker> http://pastie.org/1915636 (db routing table) 
06:04 < mordy> ok, simple enough.. now you have two options
06:04 < codebeaker> (tcpdump shows that the packets are reaching it, and being send t on eth0:0, but not getting back over the VPN) - vpn logs show - leehambley/77.23.168.43:42350 GET INST BY VIRT: 192.168.154.127 [failed]
06:04 < mordy> you can, on the db server, do something like: ip route add 10.77.22.0/24 via $openvpn_server_192_addr
06:05 < codebeaker> ok, sounds easy enough
06:06 < codebeaker> vpn server's lan IP is 192.168.164.229
06:06 < mordy> OR, on the openvpn server.. iptables -t nat -A POSTROUTING -s 10.77.22.0/24 -d 192.168.128.0/17 -j SNAT --to-source $ovpn_server_129_addr
06:07 < codebeaker> ok, I prefer the server option, but it doens't make as much sense
06:07 < codebeaker> ah, ok - yeat it does
06:07 < codebeaker> (i suck at IP stuff) but it's adding the NAT header, right ?
06:07 < mordy> that will do SNAT, meaning that the db server will think it's communicating with the server's 192 addr, not the client's 10. addr
06:07 < codebeaker> ok, sounds preferable, is it sane to add this in an "up script" ?
06:08 < mordy> it's a one-off thing
06:08 < codebeaker> ah, ok, nice
06:08 < mordy> won't persist between restarts etc.
06:08 < mordy> well, it will persist between openvpn restarts, just not machine restarts :P
06:09 < codebeaker> right, so I might add it with an upsscript, and tear it down with a downscipt
06:09 < mordy> there is also one last option you can use, which i haven't spoken about
06:09 < codebeaker> openvpn configs are in Git, server configs aren't - so it somehow belongs together
06:09 < mordy> but that is to assign a chunk of the 192 network to openvpn, and then openvpn would be able to hand out 'native' addresses within the same subnet
06:09 < mordy> you would then need to configure the server box to do proxy arp
06:11 < mordy> the nat option is by far the simplest, though
06:12 < codebeaker> mordy: you have the patience of a saint *bow* thank you for your help with this
06:12 < codebeaker> I've gone with the NAT option, because that makes the most sense to me, and the 3rd option isn't viable
06:13 < codebeaker> (as I don't want to make network problems for linode, who share 192.168.128.x/255.255.128.0 with everyone
06:14 < codebeaker> I have to step out, late for a meeting, but I'll be back - thank you again
06:14 < mordy> that's exactly where proxy arp becomes handy
06:14  * codebeaker hands mordy a beer
06:14 < codebeaker> ahh, "proxy arp" - I read over that, assuming I'd need control of the network…
06:14 < codebeaker> but yeah, sounds like way more work than the SNAT option
06:14 < mordy> it is
06:14 -!- codebeaker [~codebeake@77-23-168-43-dynip.superkabel.de] has quit [Quit: codebeaker]
06:16 < mordy> it's handy if for example you have a few public IP addresses and want to 'outsource' them to other machines without actually having them face the internet
06:16 < mordy> or even within the same physical network
06:17 < mordy> now i have a question of my own for anyone.. i'm still trying to get control over assigning IP addresses and setting up routing manually
06:17 < mordy> is there anything i can do besides a hook script (not integrated) or parsing the log output (too sloppy)?
06:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
06:29 <@vpnHelper> RSS Update - forum: please help client bridging issues <http://forums.openvpn.net/topic8045.html#p12171>
06:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:34 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:41 <@vpnHelper> RSS Update - forum: Ping works - the rest does not <http://forums.openvpn.net/topic8156.html#p12172>
06:42 -!- Vutral [V23s23RRYM@vutral.net] has quit [Ping timeout: 248 seconds]
06:43 -!- Diffen [~diffen@c-fc73e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
06:45 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
06:46 < Cubox> hello, now  ih ave openvpn with networkmanager but ... how to autostart openvpn at startup and, if the conenction fail, reconnect to the vpn ?
06:46 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12173>
06:48 -!- K1ng [KING@180.211.188.218] has joined #openvpn
07:00 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:00 -!- Vutral [ss@vutral.net] has joined #openvpn
07:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
07:02 -!- Cain` is now known as Cain
07:11 < ecrist> good morning, peeps
07:13 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 276 seconds]
07:14 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
07:15 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.6-dev"]
07:15 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
07:15 < rajkosto> high performance tunnels
07:18 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
07:26 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 258 seconds]
07:27 -!- codebeaker [~codebeake@77-23-168-43-dynip.superkabel.de] has joined #openvpn
07:27 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
07:27 -!- codebeaker [~codebeake@77-23-168-43-dynip.superkabel.de] has quit [Client Quit]
07:45 -!- codebeaker [~codebeake@77-23-168-43-dynip.superkabel.de] has joined #openvpn
07:45 < codebeaker> mordy: thanks again for help earlier
07:45 < codebeaker> everything is working beautifully
07:46 < mordy> :)
07:48 < rajkosto> how would i increase openvpn throughput on ARM systems ?
07:50 < codebeaker> mordy: can you give me the postrouting line again, if I might ask?
07:50 < codebeaker> I've entered it, ant it works, but with switching users on the ssh session, it's not in my shell history :(
07:50 < mordy> codebeaker: in essence it's iptables -t nat -A POSTROUTING -s $your_vpn_network -j SNAT --to-source $your_routable_ip
07:51 < codebeaker> thanks again :)
07:51 < codebeaker> ahh, ok - makes sense now
07:51 < mordy> you can also further constrain it, like .e.g -s $your_vpn_network -d $your_real_network -J SNAT ...
07:51 < codebeaker> and $your_vpn_network is the `base`, or the `gateway`? 10.77.22.0, or x.x.x.1 ?
07:52 < mordy> 'base', it's helpful to use a subnet suffix too
07:52 < mordy> in your case it would be 192.168.128.0/17
07:52 < codebeaker> ah, ok
07:52 < codebeaker> thanks
08:13 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Read error: Connection reset by peer]
08:21 <@vpnHelper> RSS Update - forum: please help client bridging issues <http://forums.openvpn.net/topic8045.html#p12175> || Connection works for only few seconds <http://forums.openvpn.net/topic8109-15.html#p12174>
08:23 -!- luneff [~yury@84.51.195.188] has quit [Quit: This computer has gone to sleep]
08:24 <@dazo> rajkosto: https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux ... this might give you a little bit more insight on performance issues/challenges
08:24 <@vpnHelper> Title: Gigabit_Networks_Linux – OpenVPN Community (at community.openvpn.net)
08:25 < rajkosto> im having troubles with 100mbit
08:25 < rajkosto> and thats only one way
08:26 < rajkosto> its also going through the internet, like 10 hops, 46ms
08:27 <@vpnHelper> RSS Update - forum: New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12179> || openvpn server connect to another server <http://forums.openvpn.net/topic8158.html> || Ping works - the rest does not <http://forums.openvpn.net/topic8156.html#p12177>
08:27 <@dazo> rajkosto: setup a test using iperf outside your tunnel, to have something to compare against ... if that shows bad performance, openvpn won't help
08:27 < rajkosto> hmm
08:28 <@dazo> that URL I pointed you at, gives you some clues how to test and see how to tweak things to get better performance
08:28 < rajkosto> if ip fragmentation works perfectly between the vpn client and vpn host, i can increase tun-mtu significantly ?
08:28 < rajkosto> wont that mess things up in case of packet loss
08:28 <@dazo> that's what you need to test to figure out how that works out
08:29 <@dazo> it can make some services perform worse (esp. UDP/stream oriented services) while TCP oriented ones will just make the throughput via the tunnel go slower
08:30 <@dazo> in general with most tuning, there's no "success recipe for all use cases" ... if there were, it would be default settings in any apps
08:31 < rajkosto> thing is, the vpn server has gigabit internet connectivity
08:31 < rajkosto> however, the client has 100/2
08:32 < rajkosto> so i turned on comp-lzo2
08:32 <@dazo> first of all, figure out, by tweaking MTU values and running iperf *outside* the tunnel ... if that shows bad performance as well, there's not much you can do in OpenVPN to improve things
08:32 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12181> || New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12180>
08:32 < rajkosto> what are those commands that test bandwidth and crypto speed using openvpn
08:33 <@dazo> iperf tests bandwidth between two nodes
08:33 < rajkosto> there are things like mtu discovery and such
08:33 < rajkosto> in opevpn
08:34 <@dazo> there's no such options/features in openvpn
08:34 < rajkosto> --mtu-test
08:34 <@dazo> you have --test-mtu, but that only tests/evaluates different MTU values
08:34 <@dazo> don't mess with that before you know how your raw connection behaves
08:34 <@dazo> or else, you'll be chasing a ghost
08:35 < rajkosto> raw connection behaves much better than tunneled
08:35 <@dazo> how much better?  have you tried iperf or similar tools between your nodes?
08:35 < rajkosto> ok tell me what to run
08:35 <@dazo> it's all described here: https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
08:35 <@vpnHelper> Title: Gigabit_Networks_Linux – OpenVPN Community (at community.openvpn.net)
08:36 <@dazo> install iperf in addition, read the man page for iperf, and start rocking
08:39 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
08:39 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
08:39 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
08:41 < Rajko> Intel(R) Xeon(R) CPU           E5405  @ 2.00GHz
08:41 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 248 seconds]
08:41 < Rajko> btw, on that page, it says mssfix happens after encryption and before decryption ?
08:41 < Rajko> how is that even possible
08:42 < Rajko> isnt mssfix the equivalent of clamp-mu in iptables
08:42 < Rajko> clamp-mtu
08:42 < Rajko> clamp-mss to-pdu orsomething
08:42 < Rajko> so it would happen to TCP special packets
08:43 <@dazo> There are two levels of MTU ... what happens inside the tunnel (--tun-mtu), that's similar to the MTU you set on any NIC
08:43 < Rajko> yeah i know
08:43 < Rajko> im talking about mssfix
08:44 < Rajko> that modifies a tcp header option
08:44 <@dazo> then you have --link-mtu, which is how big the packets being sent between the nodes ... and mssfix works on this level
08:44 < Rajko> so it cant possibly be done before decryption
08:45 <@dazo> the traffic from the tun device is read by openvpn, it is encrypted and wrapped up before sending it out on the wire for the other side ... and it's here it will modify that
08:45 <@dazo> it will not change anything inside the tunnel, iirc
08:46 < Rajko> sure, but mssfix needs to happen beefore encryption
08:47 <@dazo> no, because it does this between the OpenVPN nodes, where it is "normal" UDP/TCP traffic ... these packets, which contains encrypted date, also contains TCP/IP headers which is modified
08:47 < Rajko> its preferred to run openvpn in uda
08:47 < Rajko> udp
08:47 < Rajko> youre so confusing
08:48 <@dazo> yeah, and the man page states:               The  --mssfix option only makes sense when you are using the UDP
08:48 <@dazo>               protocol for OpenVPN peer-to-peer communication,  i.e.   --proto
08:48 <@dazo>               udp.
08:48 < Rajko> udp has no mss
08:48 < Rajko> i think it just does the same thing as --clamp-mss --to-physical in iptales
08:49 < Rajko> to TCP syn/ack packets
08:49  * dazo don't care any more
08:49  * dazo goes away
08:53 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
08:53 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
08:53 -!- mode/#openvpn [+o mattock1] by ChanServ
08:55 -!- luneff [~yury@84.51.197.177] has joined #openvpn
08:55 -!- codebeaker [~codebeake@77-23-168-43-dynip.superkabel.de] has quit [Quit: codebeaker]
08:57 -!- sparkymarkd [~mark@200.32.230.122] has joined #openvpn
09:06 -!- codebeaker [~codebeake@77-23-168-43-dynip.superkabel.de] has joined #openvpn
09:07 <@vpnHelper> RSS Update - forum: please help client bridging issues <http://forums.openvpn.net/topic8045.html#p12182>
09:10 < Rajko> iperf shows bad result
09:13 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12183>
09:13 < codebeaker> are people still using iperf (e.g. not updated since 2008?)
09:13 < codebeaker> … I'm from Ruby land, and if software is more than a fortnight old, it's basically useless
09:14 < Rajko> well thats ruby land
09:14 < codebeaker> yeah, and Ipv4 (at least) didn't change since 2008
09:14 < codebeaker> and I think IPv6 was final, final since at least then, right ?
09:14 < Rajko> USELESS
09:14 < Rajko> ROLL OUT NEW ONES
09:14 < Rajko> MORE GEMS PLZ
09:15 < codebeaker> exactly :-D
09:15 < ecrist> IPv6 is still being developed.
09:15 < codebeaker> I'm maintaining a gem since 4 years
09:15 < codebeaker> and it's still the best in class (for what it does)
09:15 < codebeaker> but most aren't like that
09:16 < Rajko> ruby is for hipsters
09:16 < ecrist> so, you'er a hipster?
09:16 < ecrist> skinny jeans and all, eh?
09:16 < Rajko> codebeaker probbly is
09:16 < codebeaker> I'm a macbook using, longboard riding, conference-speaking Ruby gem maintainer
09:16 < codebeaker> … so - figure it out :_D
09:16 < ecrist> hipster
09:17 < Rajko> 100%
09:17 < Rajko> no turning back
09:17 < codebeaker> no skinny jeans though
09:18 < ecrist> lies
09:18 <@vpnHelper> RSS Update - forum: please help client bridging issues <http://forums.openvpn.net/topic8045.html#p12184>
09:20 < ecrist> oh, I found a picture of you, codebeaker: http://farm4.static.flickr.com/3261/3238840443_64d86d0a36.jpg
09:20 < codebeaker> haha
09:20 < codebeaker> shit ;)
09:20 < ecrist> must have left the mac at home that day
09:21 < codebeaker> is it a bad sign that the thing that annoys me most about his outfit is that he's wearing house shoes
09:22 < ecrist> I don't even know what house shoes are.
09:23 < codebeaker> slippers* sorry
09:23 < Rajko> in udp mode, iperf does what it should, but in tcp mode i can barely get 15mbps
09:23 < codebeaker> anyway, !topic
09:25 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12185>
09:28 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
09:30 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
09:30 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12186>
09:37 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109-15.html#p12187>
09:38 -!- MarKsaitis_ [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
09:40 -!- MarKsaitis__ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
09:40 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 250 seconds]
09:42 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Quit: Leaving]
09:43 -!- MarKsaitis_ [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 250 seconds]
09:43 -!- xsurfer [48143ae9@gateway/web/freenode/ip.72.20.58.233] has joined #openvpn
09:46 < xsurfer> good day guys, I would like to ask if there is any openvpn over dns or openvpn over icmp
09:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:52 -!- codebeaker [~codebeake@77-23-168-43-dynip.superkabel.de] has quit [Quit: codebeaker]
09:59 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12191> || Connection works for only few seconds <http://forums.openvpn.net/topic8109-15.html#p12190> || OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12189> || my wish <http://forums.openvpn.net/topic8159.html>
10:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:05 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12192>
10:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:11 <@vpnHelper> RSS Update - forum: openvpn connection <http://forums.openvpn.net/topic8160.html>
10:13 -!- Sky[x] [~SkyB0x@88.200.89.244] has joined #openvpn
10:15 -!- newmember [~newmember@209.82.97.21] has joined #openvpn
10:15 -!- Sky[x] [~SkyB0x@88.200.89.244] has quit [Read error: Connection reset by peer]
10:17 -!- Sky[x] [~SkyB0x@88.200.89.244] has joined #openvpn
10:23 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:26 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:27 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
10:27 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12194>
10:37 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109-15.html#p12195>
10:46 < xsurfer> anyone here guys.  its been awhile without activity here.  
10:46 < xsurfer> I want to ask some question please
10:48 -!- newmember [~newmember@209.82.97.21] has quit [Ping timeout: 240 seconds]
10:58 -!- xsurfer [48143ae9@gateway/web/freenode/ip.72.20.58.233] has quit [Quit: Page closed]
10:58 -!- MarKsaitis__ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 240 seconds]
11:00 -!- K1ng [KING@180.211.188.218] has quit [Ping timeout: 252 seconds]
11:03 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
11:03 -!- brian [~brian@99-139-159-4.lightspeed.miamfl.sbcglobal.net] has quit [Changing host]
11:03 -!- brian [~brian@unaffiliated/brian] has joined #openvpn
11:04 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
11:16 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:50 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
11:51 < Cubox> Hello, i have a openvpn who start with the daemon. But ... when i boot the computer, the internet connection are not send to the vpn and go to the "normal" connection. Without the vpn. How to stop this ?
11:52 < Cubox> !goal
11:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:03 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.6-dev"]
12:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
12:15 -!- Diffen [~diffen@user8.85-195-0.netatonce.net] has joined #openvpn
12:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:18 < Bushmills> !redirect
12:18 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:19 < ras0ir> !ipforward
12:19 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
12:19 < ras0ir> !linipforward
12:19 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
12:21 -!- Sky[x] [~SkyB0x@88.200.89.244] has quit [Ping timeout: 276 seconds]
12:23 -!- K1ng [KING@180.211.188.219] has joined #openvpn
12:24 -!- Diffen [~diffen@user8.85-195-0.netatonce.net] has quit [Quit: This computer has gone to sleep]
12:27 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:28 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
12:29 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
12:30 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
12:30 -!- rooth [rooth@92.43.35.21] has quit [Ping timeout: 276 seconds]
12:34 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:36 -!- Diffen [~diffen@user8.85-195-0.netatonce.net] has joined #openvpn
12:38 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
12:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:46 -!- grendal-prime [~sgraham@71-154-139-54.ded.pacbell.net] has joined #openvpn
12:47 < grendal-prime> hey krzee got a werid one for ya
12:47 < grendal-prime> with some wild variable in it..
12:48 < grendal-prime> we got a server tun connection. then we are doing some vodoo and changing the next hop.
12:48 < krzee> see if --float helps
12:49 < grendal-prime> ok...well the return ping gets droped at the vpn side.
12:49 < grendal-prime> was that for me?
12:50 < krzee> yep
12:50 -!- Bubbakush [~root@c-66-30-230-83.hsd1.ma.comcast.net] has joined #openvpn
12:50 < hyper_ch> hi krzee
12:50 < Bubbakush> !welcome
12:50 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:52 < Bubbakush> I have a simple question and was hoping I could get a simple answer from one of you guys. I am looking to start an anonimizing VPN service using openVPN. Do i need as many outward facing IPV4 addresses as I have clients connected? Or is it possible to use one IP address on the server to map multiple clients to the internet?
12:53 < Bubbakush> and the internet back to those clients*
12:53 < krzee> if you dont know the answer to that, i highly doubt you have the networking knowledge needed to run that sort of company
12:53 < krzee> but the answer is 1 ip, and NAT
12:54 < krzee> you will probably want to read this:
12:54 < krzee> !tcpip
12:54 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
12:54 < krzee> just to get a feel for basic networking before you dive into openvpn
12:54 < krzee> especially if your plan is top run a company based on using openvpn
12:54 < krzee> s/top/to/
12:55 < Bubbakush> Thanks for the info
12:55 < krzee> yw
13:04 < grendal-prime> krzee, that doesnt seem like it would help but ill give it a shot.
13:12 -!- Diffen [~diffen@user8.85-195-0.netatonce.net] has quit [Quit: Leaving]
13:12 < krzee> ya maybe not
13:12 < krzee> but ive never had the issue you have
13:12 < krzee> so i say give it a shot ;]
13:15 -!- K1ng [KING@180.211.188.219] has quit [Ping timeout: 258 seconds]
13:17 < grendal-prime> ok that didnt work..but we did sort of figure out what the deal is..
13:19 < krzee> now that i think bout it, i dont see why assymetric routing would effect openvpn
13:19 < krzee> you're still reaching the same IP from the same IP, right?
13:19 -!- Bubbakush [~root@c-66-30-230-83.hsd1.ma.comcast.net] has quit [Quit: Leaving]
13:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
13:24 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:26 -!- grendal-prime [~sgraham@71-154-139-54.ded.pacbell.net] has quit [Ping timeout: 252 seconds]
13:29 -!- newmember [~newmember@209.82.97.117] has joined #openvpn
13:36 -!- luneff [~yury@84.51.197.177] has quit [Ping timeout: 258 seconds]
13:37 -!- luneff [~yury@84.51.197.177] has joined #openvpn
13:38 -!- grendal-prime [~sgraham@71-154-139-57.ded.pacbell.net] has joined #openvpn
13:42  * ecrist goes about blowing up his webserver
13:43 -!- p3rror [~mezgani@41.140.172.99] has joined #openvpn
13:46 < hyper_ch> hi ecrist
13:46 < hyper_ch> what are you gonna use? c4?
13:50 < ecrist> no, trac
13:50 < ecrist> more effective
13:51 < hyper_ch> trac does not understand git
13:56 <@vpnHelper> RSS Update - forum: New to VPNs how to setup? <http://forums.openvpn.net/topic8161.html>
14:03 < grendal-prime> krzee so we think we figured it out
14:04 < grendal-prime> reverse path filter was blocking the return packets, as it thought they were spoofed
14:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:04 < grendal-prime> looks like thats the case anyway
14:07 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
14:21 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:22 < ecrist> hyper_ch: I don't care.  I don't like git
14:22 < ecrist> I use SVN for my stuff
14:23 < hyper_ch> :)
14:32 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
14:35 -!- p3rror [~mezgani@41.140.172.99] has quit [Ping timeout: 246 seconds]
14:36 -!- K1ng [~KING@180.211.188.219] has joined #openvpn
14:38 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8147.html#p12197>
14:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
14:42 -!- K1ng [~KING@180.211.188.219] has quit [Read error: Connection reset by peer]
14:43 -!- K1ng [~KING@180.211.188.219] has joined #openvpn
14:45 -!- K1ng [~KING@180.211.188.219] has quit [Client Quit]
14:52 -!- p3rror [~mezgani@41.140.155.207] has joined #openvpn
14:54 -!- newmember [~newmember@209.82.97.117] has quit [Ping timeout: 252 seconds]
15:08 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
15:27 -!- dazo is now known as dazo_afk
15:37 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
15:45 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8147.html#p12199> || OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12198>
15:46 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
15:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
15:51 <@vpnHelper> RSS Update - forum: openvpn connection <http://forums.openvpn.net/topic8160.html#p12200>
16:00 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Operation timed out]
16:00 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
16:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:06 -!- grendal-prime [~sgraham@71-154-139-57.ded.pacbell.net] has quit [Ping timeout: 252 seconds]
16:12 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:13 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
16:21 -!- grendal-prime [~sgraham@71-154-139-54.ded.pacbell.net] has joined #openvpn
16:27 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12201>
16:27 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
16:39 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12202>
16:54 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:01 -!- michal_ [~michal@85.14.113.11] has joined #openvpn
17:01 < michal_> hello
17:01 < michal_> i'd like to configure per client subnet /30
17:01 < michal_> so far followed the official howto - set aside 10.190.191.0/24 subnet just for that
17:02 < michal_> added 'route' in the server.conf to that network so openvpn does know about it
17:02 < michal_> added ccd/client file
17:02 < michal_> with ifconfig-push for 10.190.191.2 10.190.191.1
17:03 < michal_> connected client, it got the proper ip - 10.190.191.2
17:03 < michal_> route tables are also set, next hop for openvpn'ed networks are correctly set
17:03 < michal_> so, i've started to ping one of the hosts
17:04 < michal_> and i can see icmp echo request on the tun0 interface
17:04 < michal_> but not on the ethernet interface - nothing is leaving the openvpn server
17:04 < michal_> for whatever reason openvpn drops that
17:04 -!- grendal-prime [~sgraham@71-154-139-54.ded.pacbell.net] has quit [Ping timeout: 276 seconds]
17:06 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 258 seconds]
17:17 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
17:18 < krzee> [15:02]  <michal_> with ifconfig-push for 10.190.191.2 10.190.191.1
17:18 < krzee> not valid
17:18 < krzee> .1 is the server
17:18 < krzee> .2 in net30 is virtual, for the server
17:18 < krzee> !/30
17:18 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
17:18 < krzee> !static
17:18 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
17:19 < krzee> the first number you can use is 10.190.191.6 10.190.191.5
17:20 < michal_> thx
17:20 < michal_> did just that + stupid me - enabled ip forwarding
17:20 < michal_> so got used to enabling openvpn on routers, that already had that ;)
17:21 < michal_> thx for that links, reading them now
17:21 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:21 < krzee> from the bit you said you didnt need ip forwarding, but its quite possible you need it for something you didnt say
17:21 < krzee> (ie: lans behind openvpn, redirect inet traffic)
17:21 < michal_> maybe i
17:21 < michal_> ve missed sth
17:21 < michal_> yes, like lan behind openvpn i want to get access to
17:22 < michal_> now everything works well :)
17:22 < krzee> !route
17:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
17:22 < krzee> ahh cool =]
17:22 < michal_> !tcpip
17:22 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
17:22 < michal_> wow
17:22 < michal_> a nice bot
17:22 < krzee> thanx =]
17:35 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 240 seconds]
17:40 -!- durando [~durando@cpe-76-178-221-232.maine.res.rr.com] has joined #openvpn
18:09 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12203>
18:15 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12204>
18:20 -!- sparkymarkd [~mark@200.32.230.122] has quit [Remote host closed the connection]
18:32 < durando> hey guys in order for openvpn to see computers on both sides of the network do you need both client and server running on both sides of network?
19:02 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:02 -!- p3rror [~mezgani@41.140.155.207] has quit [Ping timeout: 258 seconds]
19:03 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12205>
19:12 < ecrist> durando: no
19:40 -!- K1ng [~KING@180.211.188.219] has joined #openvpn
19:41 < krzee> durando, 
19:41 < krzee> !route
19:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
19:51 -!- durando [~durando@cpe-76-178-221-232.maine.res.rr.com] has quit [Remote host closed the connection]
19:52 -!- Squidy_at_Home [~quassel@189.73.209.187] has joined #openvpn
20:09 -!- master_of_master [~master_of@p57B558EB.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:11 -!- master_of_master [~master_of@p57B55505.dip.t-dialin.net] has joined #openvpn
20:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:27 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
20:29 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
20:30 -!- Cain` is now known as Cain
21:15 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
21:28 -!- KWhat4 [~kwhat@76.89.161.124] has joined #openvpn
21:31 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
21:36 -!- joako [~joako@opensuse/member/joak0] has joined #openvpn
21:42 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:44 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:45 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:52 <@vpnHelper> RSS Update - forum: Machine-specific issue which is not caused by configs <http://forums.openvpn.net/topic8155.html#p12206>
22:06 -!- Squidy_at_Home [~quassel@189.73.209.187] has quit [Remote host closed the connection]
22:11 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:23 -!- KWhat4 [~kwhat@76.89.161.124] has left #openvpn []
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:49 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
22:52 -!- K1ng [~KING@180.211.188.219] has quit [Ping timeout: 252 seconds]
23:04 -!- Flecks [~fleck@unaffiliated/fleck] has joined #openvpn
23:09 -!- Netsplit *.net <-> *.split quits: Fleck, @vpnHelper, Perun
23:12 -!- Netsplit over, joins: @vpnHelper, Perun
23:13 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
23:29 -!- K1ng [~KING@180.211.188.102] has joined #openvpn
23:32 -!- brian [~brian@unaffiliated/brian] has left #openvpn []
23:37 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
23:38 -!- K1ng [~KING@180.211.188.102] has quit [Ping timeout: 246 seconds]
23:53 <@vpnHelper> RSS Update - forum: can ping printer but can't ping computer <http://forums.openvpn.net/topic8106.html#p12207>
--- Day changed Wed May 18 2011
00:11 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12208>
00:12 -!- K1ng [~KING@180.211.188.102] has joined #openvpn
00:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:35 -!- luneff [~yury@84.51.197.177] has joined #openvpn
00:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:59 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12209>
01:05 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:05 -!- mode/#openvpn [+o mattock] by ChanServ
01:08 -!- K1ng` [~KING@180.211.188.102] has joined #openvpn
01:10 -!- K1ng [~KING@180.211.188.102] has quit [Ping timeout: 246 seconds]
01:11 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 276 seconds]
01:15 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Read error: Operation timed out]
01:23 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
01:25 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:28 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
01:29 -!- dazo_afk is now known as dazo
01:34 -!- K1ng` [~KING@180.211.188.102] has quit [Read error: Connection reset by peer]
01:34 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12210>
01:35 -!- K1ng` [~KING@180.211.188.102] has joined #openvpn
01:49 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
01:52 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 252 seconds]
01:56 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
01:59 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
01:59 <@vpnHelper> RSS Update - forum: openvpn connection <http://forums.openvpn.net/topic8160.html#p12211>
02:00 < xsurfer> Guys, I really dont know how to create login authentication only by certificate (wihout username and password) . I just need server and client configuration to me to study and follow.  It is easier for me to learn with visuals.
02:01 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
02:02 < Bushmills> well, that had to be said
02:11 <@vpnHelper> RSS Update - forum: openvpn connection <http://forums.openvpn.net/topic8160.html#p12213> || Machine-specific issue which is not caused by configs <http://forums.openvpn.net/topic8155.html#p12212>
02:21 < Bushmills> reminds me of Wowbagger, the Infinitely Prolonged, only that he was insulting every living being in the universe, rather than telling them about his limitations
02:23 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
02:28 -!- Flecks is now known as Fleck
02:31 -!- luneff [~yury@84.51.195.188] has joined #openvpn
02:39 <@vpnHelper> RSS Update - forum: openvpn connection <http://forums.openvpn.net/topic8160.html#p12214>
02:53 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
02:56 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:57 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:59 < xsurfer> I have question: for example I am now using cert authentication and that every user have unique cert.  for example, I create unique cert for user1and my two cousin connects to the server using simultaneously using that cert of user1, can they connect to the server simultaneously?
03:02 -!- K1ng` is now known as k1ng
03:02 < xsurfer> hello
03:02 < xsurfer> guys please answer me
03:03 < xsurfer> hello
03:05 < xsurfer> anybody home :)
03:05 < xsurfer> very silent
03:05 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
03:08 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 240 seconds]
03:12 < joako> No the same certificate can't be used twice. I wish there was a way to turn that off and just user user/password.
03:18 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
03:24 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
03:27 < Bushmills> --duplicate-cn. not recommended but a way exists
03:28 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
03:29 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
03:30 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
03:32 < joako> Bushmills, So if I put that in my config when I connect from the 2nd location they will not fight each other?
03:32 < Bushmills> both clients will be permitted to connect at the same time.  but you can't use things like ifconfig from ccd
03:33 < joako> And it's not recommended meaning it might have problems, or it's not recommended in the sense that turning off PKI is "not recommended" for being "insecure"?
03:33 < Bushmills> not recommend as in losing capability to let server respond to client in individualized manner. be it configuring, or revoking.
03:35 < joako> Well obviously you can only revoke a certificate, not the machine that uses it
03:36 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 260 seconds]
03:42 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
03:52 < AL13N_work> joako: you could do openvpn-ldap-auth and user/password check in addition to the certificate
03:53 < AL13N_work> i think there's also a way to succeed with only one of those
03:53 < AL13N_work> not sure about that though
03:53 < AL13N_work> joako: easier is to just issue 2 new certificates, give them to the parties and revoke the current one
03:58 < joako> can i enable ldap and disable the certificates?
04:05 < AL13N_work> yes
04:27 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:27 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:27 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:41 -!- joako [~joako@opensuse/member/joak0] has quit [Quit: Leaving]
04:56 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154.html#p12215>
05:14 <@vpnHelper> RSS Update - forum: openvpn connection <http://forums.openvpn.net/topic8160.html#p12216>
05:18 -!- stefan-_ [~Ollinger@hiwi0.wi2.uni-trier.de] has joined #openvpn
05:19 -!- dazo is now known as dazo_afk
05:22 < stefan-_> !welcome
05:22 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:22 < stefan-_> !goal
05:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:22 < stefan-_> !howto
05:22 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:38 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12217>
05:43 < stefan-_> hi, any ideas about: Wed May 18 12:41:38 2011 us=856000 Authenticate/Decrypt packet error: packet HMAC authentication failed ?
05:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:49 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
05:51 -!- equinox [~equinox@spaceboyz.net] has joined #openvpn
06:15 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
06:16 < stefan-_> hum seems its because im running openvpn on win7 as administrator
06:21 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 264 seconds]
06:27 -!- dazo_afk is now known as dazo
06:28 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
06:36 < s7r> !ipv6
06:36 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
06:36 < s7r> !snapshots
06:36 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
06:45 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
06:48 -!- dazo is now known as dazo_afk
06:59 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Operation timed out]
07:01 -!- Cain` is now known as Cain
07:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:02 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12218>
07:46 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
07:47 -!- bitrot [~rajkosto@wan.rajkonet.info] has joined #openvpn
07:48 < bitrot> openvpn off http://www.speedtest.net/result/1301487900.png openvpn on http://www.speedtest.net/result/1301489491.png
07:48 < bitrot> how do i fix this performance
07:48 -!- dazo_afk is now known as dazo
07:51 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 264 seconds]
07:52 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
07:55 -!- bitrot [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 276 seconds]
07:56 -!- rajkosto is now known as bitrot
07:58 -!- tanathos [~tanathos@host37-44-dynamic.33-79-r.retail.telecomitalia.it] has joined #openvpn
08:06 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:11 < tanathos> Hi, I want to connect to the real ip OpenVPN is providing me, what modif should I make in the server firewall
08:11 < bitrot> what
08:12 < tanathos> I don't have a real ip and I want to be able to connect to the webserver my pc is running through the real ip I have with vpn
08:13 < tanathos> I've spent a bit of time reading and trying several different configs
08:13 < tanathos> but nothing seemes to work
08:14 < tanathos> I was able to make the setup, and connect to the internet with the server ip
08:14 -!- troker [~troker_@216-20-119-60.client.mecnet.net] has joined #openvpn
08:15 < troker> Im looking to forward all of my traffic through my openVPN  server running on my pfsense box.  Can anyone tell me how to do  this? Ideally I would like this to be able to be determined by  the client (me).
08:16 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
08:16 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
08:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:16 < Bushmills> tanathos: simply contact server on its openvpn address
08:17 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:17 < bitrot> troker, def1
08:17 < Bushmills> !redirect
08:17 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
08:17 < bitrot> forwarding and NAT need to be on pfsense
08:17 < Bushmills> troker: ^^^
08:18 < Bushmills> server needs some setup.  in client config you'll then have redirect-gateway
08:18 < tanathos> Bushmills: my server is giving me the address 87.119.xxx.xxx, on this ip I run a webserver, is it possible to connect to that address 
08:19 < tanathos> ?
08:19 < bitrot> that makes no sense
08:19 < tanathos> sorry I think I am explaining right
08:19 < Bushmills> tanathos: 87.119.xxx.xxx is your openvpn subnet?
08:20 < troker> Bushmills: So if I get the server set up right, I can switch redirecting on/off via --redirect-gateway in my client config?
08:20 <@vpnHelper> RSS Update - forum: Ping works - the rest does not <http://forums.openvpn.net/topic8156.html#p12219>
08:20 < Bushmills> troker: yes
08:20 < troker> Bushmills: great - thanks much
08:20 < tanathos> server has multiple real ip's thourgh openvpn is assign me one of them, is it possible to use that ip to have people from the internet to connect to my webserver?
08:20 < bitrot> set up DNAT rules ?
08:20 < bitrot> !nat
08:20 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
08:21 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:21 < Bushmills> tanathos: yes, possible. as bitrot suggests. but preferable may be to run web server on openvpn, and proxy to your web server on openvpn client.
08:21 < bystander> good day. I know I can google for a result but do you have other reading article for icmp tunneling
08:21 < tanathos> Bushmills, I know but unfortunately that is not an option
08:21 < Bushmills> that way you benefit from caching on openvpn server towards internet, 
08:26 < troker> So Im doing a little bit of reading and it seems as if the redirect-gateway is a server-side option - is there something special I need to to do make it client side?  Or does 'push' refer to pushing a config to the user?
08:26 < troker> http://goo.gl/
08:26 <@vpnHelper> Title: Redirecting (at goo.gl)
08:26 < bitrot> troker, its strictly clientside
08:26 < bitrot> you can push it from the server if you want
08:26 < bitrot> but all it does is add the default route throuh the openvpn server
08:27 < troker> Ah - I see, ok -- so the push in the server config forces the command on the user? - Sorry, openvpn newb
08:31 < Bushmills> no, it isn't
08:31 < Bushmills> server can push it to client.
08:31 < Bushmills> ehm. as bitrot said already
08:31 -!- bitrot [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 240 seconds]
08:35 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Ping timeout: 253 seconds]
08:37 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12220>
08:40 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
08:42 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:42 < bystander> anybody?
08:42 < bystander> dazo: can you give me reading material
08:44 < mordy> under which circumstances can a client exit/disconnect/reconnect (discounting, of course, the actual process being killed externally)? i know of ping exits and SIGHUP/SIGUSR1, but what else is there?
08:45 < bystander> hello !
08:48 -!- troker [~troker_@216-20-119-60.client.mecnet.net] has quit [Read error: Operation timed out]
08:49 -!- troker [~troker_@216-20-119-60.client.mecnet.net] has joined #openvpn
08:50 -!- tanathos [~tanathos@host37-44-dynamic.33-79-r.retail.telecomitalia.it] has quit []
08:51 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:55 <@vpnHelper> RSS Update - forum: Advice on upgrading Ubuntu on OpenVPN server host? <http://forums.openvpn.net/topic8152.html#p12221>
08:57 -!- troker [~troker_@216-20-119-60.client.mecnet.net] has quit [Quit: leaving]
08:58 < mordy> wondering why --single-session isn't working.. i'm trying to make the openvpn process a one-off
08:58 < mordy> meaning there's only a single process per vpn connection, no reconnects.
09:01 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12222>
09:03 -!- bitrot [~rajkosto@wan.rajkonet.info] has joined #openvpn
09:06 < stefan-_> !route
09:06 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:06 < stefan-_> !redirect
09:06 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
09:06 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12224> || Ping works - the rest does not <http://forums.openvpn.net/topic8156.html#p12223>
09:06 < stefan-_> !nat
09:06 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
09:06 < stefan-_> !winnat
09:07 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows, or (#2) http://www.nanodocumet.com/?p=14 for windows XP
09:07 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 276 seconds]
09:09 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:12 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:14 -!- stefan-_ [~Ollinger@hiwi0.wi2.uni-trier.de] has quit [Ping timeout: 248 seconds]
09:15 -!- Sky[x] [~SkyB0x@88.200.89.144] has joined #openvpn
09:23 -!- Sky[x] [~SkyB0x@88.200.89.144] has quit [Read error: Connection reset by peer]
09:23 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12227> || sharing client user name and password <http://forums.openvpn.net/topic8162.html>
09:23 -!- Sky[x] [~SkyB0x@88.200.89.144] has joined #openvpn
09:24 -!- Lenhix [~lenhix@srvmail.servimos.com.co] has joined #openvpn
09:26 -!- troker [~troker_@pool-72-70-55-143.bstnma.fios.verizon.net] has joined #openvpn
09:28 < troker> Hey all - So I've got my redirect working.  I can push all traffic through my openVPN tunnel.  However (i am on a ubuntu client) adding a push DNS rule server does not work on my linux client (i need to edit resolv.conf manually) does anyone have a creative way around this?
09:28 <@vpnHelper> RSS Update - forum: sharing client user name and password <http://forums.openvpn.net/topic8162.html#p12228>
09:33 <@dazo> troker: that doesn't work on Linux out-of-the-box ... see this:
09:33 <@dazo> !pushdns
09:33 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
09:33 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
09:33 <@dazo> it should be a update-resolv-conf script available though, somewhere
09:34 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12230> || Ping works - the rest does not <http://forums.openvpn.net/topic8156.html#p12229>
09:35 < Bushmills> troker: or run a recursive name server on your client
09:35 < Bushmills> works either way, with or without openvon
09:35 < Bushmills> vpn
09:35 <@dazo> good point
09:37 < Bushmills> plus caching benefits :)
09:38 -!- stefan-_ [~null@hiwi0.wi2.uni-trier.de] has joined #openvpn
09:39 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12232> || Ping works - the rest does not <http://forums.openvpn.net/topic8156.html#p12231>
09:40 <@dazo> !forget git
09:40 <@vpnHelper> Error: 2 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
09:40 <@dazo> !forget git *
09:40 <@vpnHelper> Joo got it.
09:40 <@dazo> !learn git as  For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git
09:40 <@vpnHelper> Joo got it.
09:40 <@dazo> !learn git as For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git,
09:40 <@vpnHelper> Joo got it.
09:41 <@dazo> !learn git as Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi
09:41 <@vpnHelper> Joo got it.
09:41 <@dazo> !git
09:41 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git, or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git,, or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi
09:41 <@dazo> !learn git-doc as For a good git documentation, see http://progit.org/book/
09:41 <@vpnHelper> Joo got it.
09:41 <@dazo> !learn git-doc as For a very quick git crash course, see https://community.openvpn.net/openvpn/wiki/GitCrashCourse
09:41 <@vpnHelper> Joo got it.
09:41 -!- troker [~troker_@pool-72-70-55-143.bstnma.fios.verizon.net] has quit [Ping timeout: 250 seconds]
09:41 <@dazo> !learn git as See !git-doc how to use git
09:41 <@vpnHelper> Joo got it.
09:42 < stefan-_> any idea about nat and windows 7?
09:45 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12233>
09:51 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12234>
09:55 < Bushmills> yes. nat has fewer letters than windows7
09:56 -!- dazo is now known as dazo_afk
09:56 < hyper_ch> Bushmills: also the letters are completely different
09:56 < Bushmills> noticed that too, but the question was formulated such that i thought one idea was enough
09:56 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12235>
09:57 < Bushmills> ignoring the n of course
09:57 < hyper_ch> well, "n" doesn't really count
09:57 < Bushmills> i imaged nat being written as NAT and therefore being different from lowercast n in Windows
09:58 < stefan-_> =)
09:58 < stefan-_> does nat work on windows 7?
09:58 < Bushmills> yes. "connection sharing"
09:58 < stefan-_> ok thanks
09:59 < hyper_ch> windows can network nowadays?
10:00 < Bushmills> if you install winsocks, yes
10:00 < Bushmills> winsock, actually
10:00 < hyper_ch> :)
10:00 < hyper_ch> why do you need to install socks? Windows has no legs
10:01 < Bushmills> why did you start widows by entering "win" when all you did was to lose
10:02 < stefan-_> :>
10:03 -!- Sky[x] [~SkyB0x@88.200.89.144] has quit [Ping timeout: 276 seconds]
10:04 < Bushmills> why were prices such that when you bought a PC, you got a windows with it, and nowaday, if you buy a windows, you get a PC with it?
10:04 < hyper_ch> well, you have to add value to windows... so they add a pc
10:05 -!- Sky[x] [~SkyB0x@88.200.89.144] has joined #openvpn
10:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:08 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 248 seconds]
10:11 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:12 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
10:12 -!- dazo_afk is now known as dazo
10:13 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12236>
10:14 -!- Sky[x] [~SkyB0x@88.200.89.144] has quit [Ping timeout: 276 seconds]
10:17 -!- dazo is now known as dazo_afk
10:19 <@vpnHelper> RSS Update - forum: Windows 7 32bits openvpn 2.2.0 certificats problems <http://forums.openvpn.net/topic8163.html>
10:21 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
10:23 -!- dazo_afk is now known as dazo
10:24 -!- bitrot [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 250 seconds]
10:32 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
10:49 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12238>
10:55 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:17 -!- bitrot [~rajkosto@wan.rajkonet.info] has joined #openvpn
11:19 <@vpnHelper> RSS Update - forum: TAP not working in Windows 7 <http://forums.openvpn.net/topic8164.html>
11:19 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 252 seconds]
11:31 -!- bitrot [~rajkosto@wan.rajkonet.info] has quit [Quit: Leaving]
11:31 <@vpnHelper> RSS Update - forum: TAP not working in Windows 7 <http://forums.openvpn.net/topic8164.html#p12240>
11:37 <@vpnHelper> RSS Update - forum: TAP not working in Windows 7 <http://forums.openvpn.net/topic8164.html#p12241>
11:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
11:43 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html>
11:46 -!- luneff [~yury@84.51.195.188] has quit [Quit: This computer has gone to sleep]
11:59 -!- gyyrog_ [~gyyrog@96-36-48-82.static.aldl-nbb.mi.charter.com] has joined #openvpn
12:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Ping timeout: 240 seconds]
12:05 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:08 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:08 -!- gyyrog_ [~gyyrog@96-36-48-82.static.aldl-nbb.mi.charter.com] has quit [Ping timeout: 246 seconds]
12:11 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:20 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12243>
12:21 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
12:21 -!- michal_ [~michal@85.14.113.11] has left #openvpn []
12:22 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:22 -!- luneff [~yury@84.51.197.177] has joined #openvpn
12:27 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:48 -!- darkdrgn2k4 [~darkdrgn2@204.101.63.212] has joined #openvpn
12:48 < darkdrgn2k4> hey guys
12:48 < darkdrgn2k4> are there cheap retail endpoints that support openvpn
12:51 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Ping timeout: 260 seconds]
12:51 -!- p3rror [~mezgani@41.140.181.85] has joined #openvpn
12:58 < darkdrgn2k4> ok another qustion
12:58 < darkdrgn2k4> if  i configure 2 a names for the same vpn host name
12:59 < darkdrgn2k4> will it load balance between them?
13:01 < ecrist> that's called DNS round-robin
13:01 < ecrist> no load-balancing
13:07 <@dazo> darkdrgn2k4: if you have low enough TTL (depending on how long you expect one connection to last at minimum) ... it should do another name lookup and pick the second in line (unless somebody else did a DNS lookup in between)
13:10 < darkdrgn2k4> dazo: i just have 80 warehouses connecting over a dsl conection id rather it somewhat balance over 2 dsl connections
13:10 < darkdrgn2k4> dazo: is it possibl to specify a backup ip address incase dns fails?
13:10 < ecrist> you can have multiple remote lines in your client configs
13:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
13:11 < darkdrgn2k4> oh yeh...  then not randomize is..
13:11 <@dazo> darkdrgn2k4: multiple remote lines + --remote-random
13:11 < darkdrgn2k4> you mean remove --remove-random for a backup
13:11 <@dazo> darkdrgn2k4: nope ... if you want to spread the connections against more servers ... use multiple --remote lines and then --remote-random
13:12 < darkdrgn2k4> if i want to spread connections over more then one server and have a backup ip incase of dns failer i do a hostname with multiple A records and then a second remote line with no --remove-random
13:12 < darkdrgn2k4> does that sound right?
13:12 <@dazo> there is no --remove-random option
13:12 < darkdrgn2k4> sorry
13:12 < darkdrgn2k4> remove --random-remote
13:13 -!- p3rror [~mezgani@41.140.181.85] has quit [Remote host closed the connection]
13:13 < darkdrgn2k4> or rather --remote-random
13:14 <@dazo> yeah, that makes sense ... multiple A records + a backup
13:14 < darkdrgn2k4> what happend with openvpn disconnects
13:14 < darkdrgn2k4> does it go over to the next reord or does it retry the first one
13:15 < darkdrgn2k4> (ie timeout event)
13:15 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
13:19 <@dazo> good question, I dunno
13:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:26 -!- darkdrgn2k3 [~darkdrgn2@204.101.63.212] has joined #openvpn
13:29 -!- darkdrgn2k4 [~darkdrgn2@204.101.63.212] has quit [Ping timeout: 246 seconds]
13:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:34 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:39 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:40 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
13:42 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
13:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
13:55 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
13:56 -!- stefan-_ [~null@hiwi0.wi2.uni-trier.de] has quit [Quit: Verlassend]
14:12 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
14:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:30 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
14:31 -!- mordy [~mordy@5acc3a82.bb.sky.com] has quit [Ping timeout: 250 seconds]
14:34 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 276 seconds]
14:36 -!- dazo is now known as dazo_afk
14:49 -!- Vutral [ss@vutral.net] has joined #openvpn
14:50 -!- mordy [~mordy@5acc3a82.bb.sky.com] has joined #openvpn
14:50 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:51 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
14:54 < darkdrgn2k3> is keep alive also used on client side?
14:55 < Bushmills> if server is mode server, not needed
14:55 < darkdrgn2k3> k
14:55 < darkdrgn2k3> my vpn dies some ties with "no route to host"
14:55 < darkdrgn2k3> there is an ip address
14:55 < Bushmills> server pushes corresponfing actions to client
14:55 < darkdrgn2k3> but it doesnt ping back
14:55 < darkdrgn2k3> so essentially the cklient is disconnected
14:56 < darkdrgn2k3> client cant ping server.. server cand ping client (vpn ips)
14:56 < Bushmills> sounds good
14:56 < darkdrgn2k3> ?
14:57 < Bushmills> or does "cand" mean "can't" instead of "can"?
14:57 < darkdrgn2k3> server cant ping client
14:57 < darkdrgn2k3> everything works fine for the fire few mins then it just dies
14:57 < Bushmills> keepalive can only have an effect once client has connected to server, and they can ping each other
14:58 < darkdrgn2k3> client connects to server fine.......
14:58 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
14:58 < Bushmills> "works fine" while neither can ping the other?
14:58 < darkdrgn2k3> then without warning it stops responding
14:58 < darkdrgn2k3> no.. for the first few mins everythign works including pings
14:58 < darkdrgn2k3> then it jsut drops
14:58 < darkdrgn2k3> log only shows
14:58 < Bushmills> drops even while you keep pinging the other end?
14:58 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:58 < darkdrgn2k3> Wed May 18 13:50:55 2011 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=1
14:58 < darkdrgn2k3> 0065)
14:58 < darkdrgn2k3> yep
14:59 < Bushmills> something interferes with your route. dhcp client, maybe?
14:59 < darkdrgn2k3> connection LOOKS established from both the client and server end
14:59 < Bushmills> network mismanager?
14:59 < ecrist> !ubuntu
14:59 <@vpnHelper> "ubuntu" is dont use network manager!
14:59 < darkdrgn2k3> nope
14:59 < darkdrgn2k3> centos on the server
14:59 < darkdrgn2k3> win xp on the client
14:59 < darkdrgn2k3> client has a dhcp internet connection connected to it directly
14:59 < darkdrgn2k3> no other interfaces
15:00 < Bushmills> do, after connect,  route print   on client.  do that again when the problem shows, and examine the differences
15:00 < darkdrgn2k3> ok
15:00 < darkdrgn2k3> but there shouldnt be ANY route problems
15:00 < darkdrgn2k3> becuase thers are only 2 interfaces at tha machine
15:00 < darkdrgn2k3> the VPN tunne
15:00 < darkdrgn2k3> and the WAN network
15:00 < darkdrgn2k3> (not natted)
15:01 < Bushmills> ok, then the problem should be a different one and i'm out of ideas.
15:01 < darkdrgn2k3> what does the  ping command do?
15:01 < darkdrgn2k3> i just dont understand why the tunnle doesnt re-connect
15:02 < darkdrgn2k3> http://pastebin.com/36gixC4s <-route table
15:02 < Bushmills> i'd have guessed because of maybe a problem with route, but as there shouldn't be such a problem, you must look somewhere else
15:04 < ecrist> lol
15:04 < darkdrgn2k3> think i should uise --ping-restart n 
15:04 < darkdrgn2k3>  ?
15:05 < Bushmills> possibly there's a small error in the man page, where it says: http://scarydevilmonastery.net/snap/1305749067589440094d.png
15:05 < Bushmills> i don't know where the "120" comes from
15:06 < darkdrgn2k3> hnmm
15:06 < krzie> 2x 60
15:06 < krzie> because the server should be willing to wait longer than the client to declare it dead
15:06 < Bushmills> ah
15:06 < krzie> the client can reconnect before the server kills the orig connection, and all is well still
15:06 < darkdrgn2k3> tahst wierd
15:06 < darkdrgn2k3> i have keep-alive
15:06 < darkdrgn2k3> but its not reconnecting
15:06 < Bushmills> makes sense
15:07 < Bushmills> keep-alive is not for aiding reconnection, but to prevent disconnection
15:10 < darkdrgn2k3> really?
15:10 < darkdrgn2k3> --ping-restart n 
15:10 < darkdrgn2k3> Similar to --ping-exit, but trigger a SIGUSR1 restart after n seconds pass without reception of a ping or other packet from remote. 
15:10 < darkdrgn2k3> does that aid in reconnecting
15:11 < krzie> persist options set?
15:12 < krzie> (dont answer to me, answer to others, im leaving) =]
15:15 -!- darkdrgn2k4 [~darkdrgn2@204.101.63.212] has joined #openvpn
15:16 < darkdrgn2k4> what does persist-tun do
15:18 < Bushmills> would you want us to read the man page to you?
15:18 < darkdrgn2k4> no..
15:18 < darkdrgn2k4> i read it
15:18 < darkdrgn2k4> just wnated to make sure i understand
15:18 < darkdrgn2k4> it forces the device offline before reconnecting right
15:18 -!- darkdrgn2k3 [~darkdrgn2@204.101.63.212] has quit [Ping timeout: 246 seconds]
15:18 < Bushmills> actually, rather the opposite
15:20 < darkdrgn2k4> sorry thats what i ment
15:22 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
15:24 < darkdrgn2k4> so keepalive just needs to be put on the server not the client right
15:26 < Bushmills> (21:55:06) Bushmills: if server is mode server, not needed (on client - ed)
15:27 < Bushmills> openvpn doesn't change *that* quickly
15:36 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 276 seconds]
15:50 -!- Vutral [ss@vutral.net] has joined #openvpn
15:50 <@vpnHelper> RSS Update - forum: Openvpn on Linux Vserver <http://forums.openvpn.net/topic8166.html>
16:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:08 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
16:17 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
16:28 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
16:47 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
16:48 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
16:50 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Ping timeout: 260 seconds]
17:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:10 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
17:10 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
17:10 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
17:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:38 -!- Lenhix [~lenhix@srvmail.servimos.com.co] has quit [Ping timeout: 276 seconds]
17:42 -!- k1ng [~KING@180.211.188.102] has quit [Read error: Connection reset by peer]
17:43 -!- k1ng [~KING@180.211.188.102] has joined #openvpn
17:43 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
17:44 -!- k1ng [~KING@180.211.188.102] has quit [Read error: Connection reset by peer]
17:44 -!- k1ng [~KING@180.211.188.102] has joined #openvpn
17:44 <@vpnHelper> RSS Update - forum: Site-to-Site Config Issue. Partly Working. <http://forums.openvpn.net/topic8167.html>
17:46 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
17:47 -!- k1ng [~KING@180.211.188.102] has quit [Read error: Connection reset by peer]
17:48 -!- k1ng [~KING@180.211.188.102] has joined #openvpn
17:49 -!- k1ng [~KING@180.211.188.102] has quit [Read error: Connection reset by peer]
17:51 -!- Vutral [73seXiNyY7@vutral.net] has joined #openvpn
18:06 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:18 -!- K1ng [~KING@180.211.188.102] has joined #openvpn
18:20 -!- K1ng [~KING@180.211.188.102] has quit [Read error: Connection reset by peer]
18:27 -!- CrazyGir_ [~jason@li14-82.members.linode.com] has joined #openvpn
18:28 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:29 -!- K1ng [~KING@180.211.188.187] has joined #openvpn
18:32 -!- Netsplit *.net <-> *.split quits: Hamlin, sigius, CrazyGir
18:32 <@vpnHelper> RSS Update - forum: Site-to-Site Config Issue. Partly Working. <http://forums.openvpn.net/topic8167.html#p12246>
18:34 -!- Netsplit over, joins: Hamlin
18:35 -!- K1ng [~KING@180.211.188.187] has quit [Read error: Connection reset by peer]
18:36 -!- K1ng [~KING@180.211.188.187] has joined #openvpn
18:37 -!- K1ng [~KING@180.211.188.187] has quit [Read error: Connection reset by peer]
18:38 -!- K1ng [~KING@180.211.188.187] has joined #openvpn
18:39 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
18:41 -!- K1ng [~KING@180.211.188.187] has quit [Read error: Connection reset by peer]
18:42 -!- K1ng [~KING@180.211.188.187] has joined #openvpn
18:43 -!- K1ng [~KING@180.211.188.187] has quit [Read error: Connection reset by peer]
18:46 -!- Leo_ [~Leo@86.47.90.182] has joined #openvpn
18:52 -!- Proz01d [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
18:52 < Proz01d> !welcome
18:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:53 < Proz01d> !goal
18:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:53 < Proz01d> !redirect
18:53 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
18:53 < Proz01d> !def1
18:53 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
18:54 < Proz01d> !ipforward
18:54 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
18:55 < Proz01d> !winipforward
18:55 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
18:55 < Proz01d> Qnat
18:55 < Proz01d> !nat
18:55 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
18:58 < Proz01d> !goal route all my requests / inet traffic through my vpn server.  
18:59 < pwrcycle> can anyone tell me what this error means: http://pastebin.com/85NsnjGW
18:59 < pwrcycle> AUTH-PAM: BACKGROUND: received command code: 1
19:21 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:23 < Leo_> Hello all. I am trying to make an OpenVPN setup that uses server and client certificates signed by a commercial CA rather than self-signed certs. Obviously, this means that I need to whitelist authorised certificates rather than accepting all certs signed by the CA. How should I do this? It seems the verify-cn script is unlikely to be good enough because it only checks Common Names. Is there some reasonably standard/out-of-the-box method to check by Distinguishe
19:23 < Leo_> d Name, or SubjectAltName, or something that's (more/less) assured to be unique?
19:29 < Leo_> !welcome
19:29 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:29 < Leo_> !goal
19:29 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:30 < Leo_> !goal Authorise certs signed by a commercial CA, using a whitelist based on something more secure/reliable than Common Name
19:33 < Proz01d> i'm running openvpn and i  finally got a connection to the vpn working. I'm routing all my requests through the vpn however i can't reach any sites. I'm going to open up port 80 on the server but my question is : is this the best way to do this? 
19:35 < Bushmills>  Proz01d, check whether the name server your system uses can be reached
19:35 < Bushmills> i.e. whether you can resolved host names to ip addresses
19:36 < pwrcycle> Bushmills: any clue what this error means: http://pastebin.com/85NsnjGW
19:36 < Bushmills> what error?
19:36 < pwrcycle> Proz01d: make sure you have !ipforward turned on
19:36 < pwrcycle> AUTH-PAM: BACKGROUND: received command code: 1
19:36 < Bushmills> nope
19:36 -!- p3rror [~mezgani@41.248.110.58] has joined #openvpn
19:36 < pwrcycle> had been running fine for >week, today, it won't restart
19:37 < Bushmills> google shows me 27 hits for this error. have you checked whether those apply to you?
19:39 -!- p3rror [~mezgani@41.248.110.58] has quit [Client Quit]
19:39 < pwrcycle> yes, a lot of questions, but no answers
19:39 -!- p3rror [~mezgani@2001:470:1f0a:c66:beaf:1:0:2] has joined #openvpn
19:40 < pwrcycle> Bushmills: it appears before it crashed a user was doing a 100M transfer,
19:40 < pwrcycle> not sure that that caused it, but that was the last action before failing
19:40 < Bushmills> could it be that that's a problem with the pam plugin, and not with openvpn?
19:42 < Bushmills> do you see something like  "external program may not be called due to setting of --script-security level"
19:43 < pwrcycle> no. that pastebin is the only output.
19:44 < Proz01d> !ipforward
19:44 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
19:44 < Proz01d> Bushmills: ipforward on the server side?
19:44 < Proz01d> !linipforward
19:44 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
19:44 < Bushmills> yes
19:46 < pwrcycle> Proz01d: echo 1 > /proc/sys/net/ipv4/ip_forward
19:47 < pwrcycle> Proz01d: make sure you do that as root, sudo don't work on that command in some instances.
19:47 < Proz01d> just tried..sorry i'm a total linux noob
19:54 < Proz01d> i'm running ubuntu
19:54 < Bushmills> figures
19:54 < Proz01d> gotta start somewhere
19:54 < Proz01d> and it has the most support
19:54 < Proz01d> imho
20:07 < Leo_> Hello all. I am trying to make an OpenVPN setup that uses server and client certificates signed by a commercial CA rather than self-signed certs. Obviously, this means that I need to whitelist authorised certificates rather than accepting all certs signed by the CA. How should I do this? It seems the verify-cn script is unlikely to be good enough because it only checks Common Names. Is there some reasonably standard/out-of-the-box method to check by Distinguishe
20:07 < Leo_> d Name, or SubjectAltName, or something that's (more/less) assured to be unique?
20:10 -!- master_of_master [~master_of@p57B55505.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
20:12 <@vpnHelper> RSS Update - forum: these things never work: default gateway, dns, win <http://forums.openvpn.net/topic8168.html>
20:12 -!- master_of_master [~master_of@p57B55754.dip.t-dialin.net] has joined #openvpn
20:12 < pwrcycle> !mtu
20:12 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
20:20 -!- dvl [~dvl@pdpc/supporter/active/dvl] has quit [Ping timeout: 252 seconds]
20:27 -!- troyt [~troyt@2001:55c:43a6:444b::1] has quit [Quit: AAAGH!  IT BURNS!]
20:45 -!- Squidy_at_Home [~quassel@189.73.209.187] has joined #openvpn
20:48 -!- Tiller [0@189.1.56.31] has joined #openvpn
20:48 < Tiller> alguem pode me ajudar com openvpn?
20:49 < Tiller> tem alguem ai?
20:52 < Tiller> alguem pode me ajudar
20:52 < Tiller> ?
20:57 -!- Leo_ [~Leo@86.47.90.182] has quit [Quit: Leaving]
21:01 -!- Tiller [0@189.1.56.31] has quit [Quit: Leaving]
21:08 -!- Diego [0@187.63.7.11] has joined #openvpn
21:08 -!- Diego is now known as Guest63749
21:12 -!- Squidy_at_Home [~quassel@189.73.209.187] has quit [Remote host closed the connection]
21:16 -!- p3rror [~mezgani@2001:470:1f0a:c66:beaf:1:0:2] has quit [Ping timeout: 264 seconds]
21:17 -!- K1ng [~KING@180.211.188.170] has joined #openvpn
21:31 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
21:31 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
21:31 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
21:48 <@vpnHelper> RSS Update - forum: Configure clients to access all networks <http://forums.openvpn.net/topic8121.html#p12248>
21:51 -!- Guest63749 [0@187.63.7.11] has quit [Quit: Leaving]
22:04 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
22:10 < Proz01d> do i need to open up the ports on the server for the forwarding to work?
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:37 < Proz01d> i enabled port forwarding and tried reconnecting but nothing goes through
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:04 -!- harlan [~harlan@ntp/programmemanager/harlan] has left #openvpn []
23:21 -!- luneff [~yury@84.51.197.177] has joined #openvpn
23:24 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
23:28 -!- K1ng [~KING@180.211.188.170] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
23:34 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:34 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:43 -!- GoldeNArX [~nate@S010618a90571c78c.cg.shawcable.net] has joined #openvpn
23:44 < GoldeNArX> anyone available for some emergency assitance? I'd offer a bounty :)
23:44 -!- K1ng [~KING@180.211.188.170] has joined #openvpn
23:48 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12249>
--- Day changed Thu May 19 2011
00:00 <@vpnHelper> RSS Update - forum: New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12250>
00:02 -!- K1ng` [~KING@180.211.188.170] has joined #openvpn
00:03 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:06 -!- K1ng [~KING@180.211.188.170] has quit [Ping timeout: 240 seconds]
00:08 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
00:09 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
00:30 < s7r> guys I am looking for a tutorial how can I setup openvpn server on Windows (7) with a single public IP (with SNAT / DNAT / masquarade, etc.) 
00:30 < s7r> by any chance anyone has a link to some nice easy how to?
00:51 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:07 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12251>
01:08 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
01:52 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 248 seconds]
01:53 -!- superc [~superc@pro1259.server4you.de] has joined #openvpn
01:54 < superc>  I have an openvpn connection established. If I try to transfer a large file with rsync I get a transfer rate of 3.7 Mbit over the last 10 hours... If I transfer the file directly without openvpn I get a transfer rate of about 45 Mbit. Is there any switch for this?
01:54 < superc> the route is exactly the same - same routers/internet connection
01:55 < krzee> with udp?  with lzo?  tested mtu?
01:55 < superc> I have comp-lzo enabled
01:56 < superc> for mtu there is no setting in server.conf file nore for udp
01:57 < krzee> !configs
01:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
01:58 < pwrcycle> krzee: speaking of mtu, will "mssfix 1400" set the tunnel MTU to 1400? any other setting needed in the .conf?
02:00 < superc> http://pastebin.com/cKQT73jg
02:00 < krzee> i honestly dunno much about mtu setting
02:01 < krzee> lines 37 / 31 are repeats
02:01 < krzee> same with 30 / 35
02:02 < krzee> why arent you using --server?
02:02 < pwrcycle> superc: add "log-append /var/log/openvpn.log" and see if you get mtu warnings
02:02 < krzee> pwrcycle, no, you check mtu with this:
02:02 < krzee> !mtu
02:02 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
02:03 < krzee> #1
02:03 < superc> actually this is the automatically generated conf file from untangle... 
02:03 < krzee> superc, well you can remove 35/37
02:03 < krzee> they are duplicated lines
02:03 < superc> yes, but if I open the untangle interface it is going to overwrite it again
02:03 < krzee> then fix stuff in untangle if you need to
02:04 < krzee> and add mtu-test to a client config
02:04 < superc> but this cannot be the problem of the speed problem can it?
02:04 < krzee> then connect
02:04 < krzee> no, but no reason to leave things messy
02:04 < krzee> also
02:04 < krzee> verb 4 for troubleshooting
02:04 < krzee> definitely not verb 1
02:04 < krzee> !logfile
02:04 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
02:05 < krzee> verb 5 will help debug firewalls, thats not your problem
02:05 < krzee> you have max-clients 500
02:05 < krzee> i hope you dont expect 500 clients
02:05 < superc> no :-)
02:05 < krzee> you will be an unhappy panda closer to 200
02:06 < superc> ok, wait, I'll try this verb4
02:06 < krzee> and mtu-test
02:06 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 260 seconds]
02:07 < pwrcycle> does mtu-test give output anywhere? or do it just test for the highest possible mtu?
02:08 < pwrcycle> hmm "NOTE: Beginning empirical MTU test -- results should be available in 3 to 4 minutes."
02:10 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:13 < pwrcycle> NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1541]
02:13 < pwrcycle> odd, even though i have mssfix 1400 in server.conf 
02:17 < superc> http://pastebin.com/HmbK8fiX
02:17 < superc> argh... mtu-test to client not server...
02:29 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
02:54 -!- mordy [~mordy@5acc3a82.bb.sky.com] has quit [Ping timeout: 240 seconds]
02:55 -!- mordy [~mordy@5acc3a82.bb.sky.com] has joined #openvpn
03:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:11 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12252>
03:14 -!- takamichi [Takamichi@78.133.37.249] has quit [Ping timeout: 246 seconds]
03:15 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
03:16 < raomin> Hi guys... I went on something pretty disturbing : my clients and my server has a hmac.key specified with tls-auth. But when I change one byte of the key file, the client still can connect !!
03:16 <@vpnHelper> RSS Update - forum: these things never work: default gateway, dns, win <http://forums.openvpn.net/topic8168.html#p12254> || Site-to-Site Config Issue. Partly Working. <http://forums.openvpn.net/topic8167.html#p12253>
03:17 < raomin> On the server side I have : tls-auth hmac.key 0
03:18 < raomin> and on the client side : tls-auth hmac.key 1
03:19 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
03:20 < raomin> and it still work if hmac.key differs...
03:23 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12257> || New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12256> || Configure clients to access all networks <http://forums.openvpn.net/topic8121.html#p12255>
03:28 < raomin> dazo_afk: could you give me a hand on this when you get back ?
03:28 <@vpnHelper> RSS Update - forum: TUN and TAP : Same time ? <http://forums.openvpn.net/topic8169.html>
03:35 <@vpnHelper> RSS Update - forum: TUN and TAP : Same time ? <http://forums.openvpn.net/topic8169.html#p12259>
03:38 < raomin> In fact, it seems that only part of the static key is used. If I use a complete different hmac key, the authentication is correctly rejected.
03:41 <@vpnHelper> RSS Update - forum: TAP UDP bridge questions for games networking. <http://forums.openvpn.net/topic8170.html>
03:50 -!- mordy [~mordy@5acc3a82.bb.sky.com] has quit [Ping timeout: 250 seconds]
03:51 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 260 seconds]
03:52 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
03:58 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
03:58 -!- mordy [~mordy@5acc3a82.bb.sky.com] has joined #openvpn
03:58 <@vpnHelper> RSS Update - forum: TAP UDP bridge questions for games networking. <http://forums.openvpn.net/topic8170.html#p12262> || TUN and TAP : Same time ? <http://forums.openvpn.net/topic8169.html#p12261>
04:05 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
04:11 -!- dazo_afk is now known as dazo
04:16 < hyper_ch> dazo: help
04:17 <@dazo> raomin: that's kind of expected - you need to change the right place to make it fail ... I'll find the docs about it, it's pretty obvious when you see the whole picture
04:17  * dazo got 15 pings awaiting him
04:18 < hyper_ch> dazo: how to get the openvpn forum pwd resend?
04:19 <@dazo> hyper_ch: I dunno ... ecrist or mattock might know ... it might be related to the pwm management stuff, there's a generic/common page for the forum and trac accounts
04:20 < hyper_ch> dazo: the resend link goes to some account info stuff and then when you want to alter it you get a login box and no reminder or something
04:20 < hyper_ch> https://community.openvpn.net/pwm/private/Login
04:20 <@vpnHelper> Title: OpenVPN user account management service (at community.openvpn.net)
04:20 < hyper_ch> no pwd resend option there
04:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:21 <@dazo> raomin: http://www.openvpn.net/index.php/open-source/faq/77-server/327-changed-hex-bytes-in-the-static-key-the-key-still-connects-to-a-remote-peer-using-the-original-key.html
04:21 <@vpnHelper> Title: Changed hex bytes in the static key, the key still connects to a remote peer using the original key. (at www.openvpn.net)
04:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:25 < raomin> dazo: thanks for the info ! So, just to be sure, if I change the --auth algo the portion of the key used will be bigger.
04:26 <@dazo> raomin: the "largest" supported encryption algorithm in SSL is 256bits, iirc ... so you can use up to 256 bits of this file
04:27 <@dazo> raomin: the other thing you can do, is to also give the extra parameter to --auth, which gives "direction" ... that means you will use different encryption keys on both sides
04:28 <@dazo> so server side might use "key 0" for encryption and "key 1" for decryption ... while the client uses "key 1" for encryption and "key 0" for decryption
04:28 < raomin> The 0 on client and 1 on server option for tls-auth ?
04:29 <@dazo> tls-auth may also use this file ... but also --secret also can use 0 and 1 as a second parameter
04:31 < raomin> Ok. My question was about tls hmac, but I understand it's the same reason.
04:31 < raomin> ... and I already use the direction for tls-auth
04:31 <@dazo> yeah, that's true ... sorry, I confused it
04:31 < raomin> So, it all clear now. Thanks dazo !
04:32 <@dazo> raomin: to change the tls algorithm, also look at --tls-cipher
04:32 <@dazo> but I believe --tls-auth uses just 160bits HMAC anyway
04:34 < superc> again to my problem: http://pastebin.com/HmbK8fiX .... to me it looks like the problem is related to this connects/disconnects at the end. Any idea what causes this?
04:34 < raomin> it's said --auth will decide which hash algorithm will be used for HMAC tls... But I don't think this will influence the amount of key used for the encryption part of the hmac operation
04:34 <@dazo> raomin: that makes sense to me, yeah
04:35 <@dazo> HMAC is already a defined algorithm
04:41 <@vpnHelper> RSS Update - forum: TAP UDP bridge questions for games networking. <http://forums.openvpn.net/topic8170.html#p12264> || How to setup multiple VPS servers using same ca.cert? <http://forums.openvpn.net/topic8124.html#p12263>
04:44  * hyper_ch hits ecrist
04:47 <@vpnHelper> RSS Update - forum: sharing client user name and password <http://forums.openvpn.net/topic8162.html#p12265>
04:54 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Read error: Operation timed out]
04:54 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
04:56 < K1ng`> i cant open my mounth... its jammed
04:56 < hyper_ch> you don't need a mouth to type
04:59 < K1ng`> um what?
04:59 < K1ng`> oh sorry miss spelled it.
04:59 < hyper_ch> :)
05:06 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12266>
05:06 -!- superc [~superc@pro1259.server4you.de] has left #openvpn []
05:12 <@vpnHelper> RSS Update - forum: sharing client user name and password <http://forums.openvpn.net/topic8162.html#p12269> || OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12268> || TAP UDP bridge questions for games networking. <http://forums.openvpn.net/topic8170.html#p12267>
05:18 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12270>
05:20 -!- luneff [~yury@84.51.195.188] has joined #openvpn
05:24 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12272>
05:28 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:30 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12273>
05:33 -!- ph1l [~ph1l@147.87.255.14] has joined #openvpn
05:40 -!- GoldeNArX [~nate@S010618a90571c78c.cg.shawcable.net] has quit [Read error: Connection reset by peer]
05:40 -!- GoldeNArX [~nate@S010618a90571c78c.cg.shawcable.net] has joined #openvpn
05:41 -!- takamichi [Takamichi@78.133.37.249] has quit [Ping timeout: 252 seconds]
05:42 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
05:48 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12274>
05:54 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12275>
05:57 -!- ph1l [~ph1l@147.87.255.14] has quit [Ping timeout: 246 seconds]
06:06 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12276>
06:18 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12279> || OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12278> || OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html>
06:24 <@vpnHelper> RSS Update - forum: How to setup multiple VPS servers using same ca.cert? <http://forums.openvpn.net/topic8124.html#p12280>
06:36 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158.html#p12281>
06:40 < Bushmills> yes ... women and orthography ...
06:42 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158-15.html#p12282>
06:48 -!- ph1l [~ph1l@gprs51.swisscom-mobile.ch] has joined #openvpn
06:56 < ecrist> hyper_ch: what's up?
06:56 < hyper_ch> ecrist: how to reset password on the forum?
06:57 < ecrist> unfortunately, I have to do it for you, currently.
06:57 < ecrist> did you forget yours?
06:58 < hyper_ch> ecrist: yes
06:58 < hyper_ch> or I was deactivated
06:58 < hyper_ch> or maybe god intervened
06:58 < hyper_ch> who really knows what happened
06:58 -!- ph1l [~ph1l@gprs51.swisscom-mobile.ch] has quit [Ping timeout: 276 seconds]
06:58 < ecrist> username?
06:58 < hyper_ch> hyper_ch
06:58 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
07:01 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:02 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
07:02 -!- Cain` is now known as Cain
07:04 -!- ph1l [~ph1l@gprs31.swisscom-mobile.ch] has joined #openvpn
07:12 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158-15.html#p12284>
07:18 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158-15.html#p12285>
07:19 -!- ph1l [~ph1l@gprs31.swisscom-mobile.ch] has quit [Ping timeout: 276 seconds]
07:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:21 -!- ras0ir is now known as ih38
07:24 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12286>
07:26 -!- ih38 is now known as ras0ir
07:26 -!- ras0ir [~ras0ir@unaffiliated/ras0ir] has left #openvpn ["WeeChat 0.3.5"]
07:30 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165.html#p12288> || openvpn server connect to another server <http://forums.openvpn.net/topic8158-15.html#p12287>
07:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:36 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12290>
07:47 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
07:48 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158-15.html#p12291>
07:54 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12292>
07:57 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
08:00 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
08:00 <@vpnHelper> RSS Update - forum: OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12294> || openvpn server connect to another server <http://forums.openvpn.net/topic8158-15.html#p12293>
08:06 <@vpnHelper> RSS Update - forum: New to VPNs how to setup? <http://forums.openvpn.net/topic8161.html#p12296> || openvpn server connect to another server <http://forums.openvpn.net/topic8158-15.html#p12295>
08:12 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158-15.html#p12298> || Openvpn on Linux Vserver <http://forums.openvpn.net/topic8166.html#p12297>
08:14 < AL13N_work> we have a very frequent "TLS: soft reset" at which the connection has to restart and the resulting rdesktop over it, breaks off
08:14 < AL13N_work> sometimes even 5min after
08:14 < AL13N_work> is there something i can do to fix this?
08:18 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12300> || New to VPNs how to setup? <http://forums.openvpn.net/topic8161.html#p12299>
08:20 -!- Vutral [73seXiNyY7@vutral.net] has quit [Ping timeout: 260 seconds]
08:20 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
08:20 -!- mode/#openvpn [+o mattock] by ChanServ
08:24 -!- martinip [~martinip@unaffiliated/martinip] has joined #openvpn
08:30 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12302> || OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12301>
08:30 -!- Vutral [ss@vutral.net] has joined #openvpn
08:36 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12303>
08:38 < martinip> hm, strange
08:38 < martinip> I can connect from my openvpn client to my server
08:38 < martinip> but I can't ping the vpn server IP
08:38 < ecrist> firewall
08:38 < martinip> I don't think there is a firewall
08:38 < martinip> I can ping the server's real IP
08:39 < martinip> I can't ping the virtual IP
08:39 < martinip> you mean internal firewall on the box?
08:39 < ecrist> well, if you're connected to the VPN, and you can't ping the VPN server's VPN ip, there's a firewall issue
08:39 < ecrist> yes
08:39 < martinip> it's a solaris 9 box
08:42 < martinip> does solaris 9 even have a firewall? :)
08:43 < martinip> it is a multihomed host
08:43 < martinip> I set ip_forwarding to 1
08:44 < ecrist> martinip: i have no idea, but what I can help with are openvpn issues.  see /topic for more info
08:44 < martinip> okay... famous last words, but I really don't think this box has a firewall
08:47 < martinip> is there anything else that could cause the issue?
08:47 < martinip> multihome on the server?
08:48 < AL13N_work> the server could be ignoring pings
08:49 < martinip> I can't ping the client either from the server
08:50 < AL13N_work> martinip: are you doing this from the vpn boxes to each other, or behind a network?
08:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:50 < martinip> from a PC running the client
08:50 < martinip> to a server 
08:51 < martinip> client ip is 10.10.0.6
08:51 < AL13N_work> it's not routing or something, right?
08:51 < martinip> I'm trying to ping the "gateway" on the client
08:51 < martinip> 10.10.0.5
08:51 < AL13N_work> you should ping the ip address from the server
08:51 < AL13N_work> 10.10.0.1
08:51 < Bushmills> seems you're trying to ping the p-t-p address. doomed to fail
08:51 < AL13N_work> indeed
08:52 < martinip> on the server, I have 10.10.0.1 plumbed up on the tun device
08:52 < AL13N_work> martinip: this isn't some regular ptp
08:52 < AL13N_work> you need to ping 10.10.0.1 and 10.10.0.6 respectively
08:52 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12304>
08:53 < AL13N_work> and don't discount fw on client too
09:01 < martinip> on the server, I have a tunnel set up   inet 10.10.0.1 --> 10.10.0.2 netmask ffffffff
09:01 < martinip> I can ping 10.10.0.1, but not 10.10.0.2
09:02 < martinip> from the server, I cannot reach either 10.10.0.5 nor 10.10.0.6
09:02 < martinip> but I can ping the client's real IP
09:07 < Bushmills> (15:52:30) AL13N_work: you need to ping 10.10.0.1 and 10.10.0.6 respectively
09:07 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
09:07 < Bushmills> can client ping server?
09:08 < martinip> nope
09:08 < Bushmills> check logs.
09:08 <@vpnHelper> RSS Update - forum: Ping works - the rest does not <http://forums.openvpn.net/topic8156.html#p12305>
09:08 < martinip> ok... I can ping 10.10.0.1 from the client
09:09 < Bushmills> such as, make sure that compression is turned on or off on both sides
09:09 < Bushmills> (16:07:38) Bushmills: can client ping server?  -> *yes*
09:09 < Bushmills> "nope" in that context is rather confusing
09:10 < martinip> sorry - i was trying to ping the 'gateway' on the client
09:10 < martinip> I *can* ping 10.10.0.1 from the client
09:10 < martinip> I cannot ping 10.10.0.5 which is the route gateway according to "route show"
09:11 < Bushmills> that's normal
09:12 < Bushmills> there's no service listening to it - as it is only the client's local idea of "remote"
09:12 < AL13N_work> martinip: (15:52:16) AL13N_work: martinip: this isn't some regular ptp
09:12 < AL13N_work> (15:52:29) AL13N_work: you need to ping 10.10.0.1 and 10.10.0.6 respectively
09:13 < martinip> so my client - should it still be routing via 10.10.0.5?
09:13 < martinip> or 10.10.0.1?
09:13 < AL13N_work> martinip: the routes are put there automagically
09:13 < AL13N_work> you shouldn't touch those
09:13 < martinip> ok
09:13 <@vpnHelper> RSS Update - forum: OpenVPN on AWS EC2 gives Error Code 1232 (Transmit Failed) <http://forums.openvpn.net/topic8172.html>
09:13 < AL13N_work> but if you want to reach your server, you use 10.10.0.1
09:14 < martinip> ok, that does work (10.10.0.1)
09:14 < AL13N_work> martinip: if you want to add routes, you should use "push route" and iroute commands
09:14 < AL13N_work> martinip: there is example on documentation site
09:14 < martinip> okay... I do have my routes from the server config automagically showing up
09:14 < martinip> but the routing isn't working
09:14 < AL13N_work> martinip: how did you config the routes?
09:14 < martinip> I've had this config working on a linux server
09:15 < martinip> trying to port it to an old solaris box
09:15 < AL13N_work> martinip: routes could be missing on windows due to stuff
09:15 < AL13N_work> admin stuff and the likes
09:15 < martinip> I see the route in windows - it does get imported fine
09:15 < martinip> and I do have the client running as administrator
09:15 < martinip> I think I have a routing problem on my solaris host
09:15 -!- darkdrgn2k4 is now known as darkdrgn2k3
09:15 < AL13N_work> martinip: look at it's routing table
09:15 < martinip> as I can't ping the remote network from my client
09:16 < AL13N_work> see if there is something missing
09:16 < martinip> server's routing table?
09:16 < AL13N_work> yes
09:16 < AL13N_work> i have no knowledge of solaris routing
09:16 < martinip> I have dest 10.10.0.2/32 - gw is 10.10.0.1
09:17 < AL13N_work> martinip: you see, there are 3 places that routing should be ok
09:17 < AL13N_work> on client
09:17 < AL13N_work> on server
09:17 < AL13N_work> and in vpn itself
09:17 < AL13N_work> martinip: that's in the same network?
09:17 < martinip> and on the server I also have 10.10.0.0/24 gw is 10.10.0.2
09:18 < AL13N_work> if you have the same network, you should use bridging instead
09:18 < martinip> the real network on the server is 130.x.x.x
09:19 < martinip> and we have a couple of interfaces on the server bonded with ipmp
09:20 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:22 < AL13N_work> martinip: 
09:22 < AL13N_work> so
09:22 < AL13N_work> you have a windows client
09:22 < bystander> just can I ask help just for once outside openvpn, I am making a website.  I have successfully tested my website by www.ipaddress/index.html.  Now I have create a dot.tk account with A Record.  when I tested it like www.mywebsite.tk/index.html, it does not work.  Can you assist me why it does not work guys
09:22 < AL13N_work> and a solaris server, with a local LAN behind it
09:23 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
09:23 < Proz01d> i'm trying desperately to route all my internet traffic on my win7 machine through my server however when i connect i can't get to the outside.  I've enable ipfowarding , updated the iptables with masquerading.  I have posted a copy of my settings on pastebin http://pastebin.com/gAiKpV13 i'm at a loss right now...
09:23 < AL13N_work> martinip: so, in general, in the server conf, the LAN route should be pushed to clients
09:23 < Proz01d> not sure what i'm missing.
09:24 < AL13N_work> Proz01d: redirect-gateway ?
09:24 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12308> || OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-15.html#p12307>
09:24 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:24 < Proz01d> yeah it's in the server conf.
09:24 < AL13N_work> Proz01d: backrouting
09:25 < Proz01d> ??
09:25 < AL13N_work> martinip: you should only specify the network and netmask in the push route
09:25 < AL13N_work> martinip: the gateway will be set by itself
09:25 < bystander> guys need help with my problem just this once. I dont know where to ask
09:25 < AL13N_work> Proz01d: the server should still be able to route you back to the client
09:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:26 < martinip> they look like this in the server config: push "route 120.000.000.000 255.000.000.000"
09:26 < Proz01d> how can i validate this?
09:26 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
09:26 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
09:26 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:26 < AL13N_work> martinip: i thought it was 130.X.X.X ?
09:27 < bystander> maybe you can tell me where in IRC can I ask the question
09:27 < martinip> the solaris server is on multiple networks
09:27 < Proz01d> bystander: what is your question?
09:27 < martinip> one of the networks I need to reach from the client is 120
09:27 < martinip> the solaris server itself is on 130 - but it has the ability to reach 120
09:28 < AL13N_work> Proz01d: you should make sure the server can still find your ip after all your forwarding
09:28 < bystander> Proz01d: just can I ask help just for once outside openvpn, I am making a website.  I have successfully tested my website by www.ipaddress/index.html.  Now I have create a dot.tk account with A Record.  when I tested it like www.mywebsite.tk/index.html, it does not work.  Can you assist me why it does not work guys
09:28 < martinip> so I want to route to 120 via the openvpn server
09:28 < AL13N_work> martinip: so if you ping something in 120/8 it fails?
09:28 < martinip> correct
09:29 < AL13N_work> martinip: does the server forward ips?
09:29 < martinip> looks like the server isn't routing correctly
09:29 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-30.html#p12309>
09:29 < martinip> I have ip_forwarding on 
09:29 < AL13N_work> martinip: usually if a linux server doesn't have firewall, it also have ip_forward off
09:29 < martinip> but it sounds like I need some solaris expertise
09:29 < martinip> rather than openvpn :)
09:29 < AL13N_work> martinip: check with something like tcpdump what happens
09:29 < AL13N_work> looks like it
09:29 < Proz01d> bystander: you would need to find a webhosting chatroom.... my guess is the dns has not propogated through the internet yet if you just did it recently 
09:29 < martinip> hmm
09:30 < martinip> I think I had tried that when I originally tried to get it working last year
09:30 < martinip> let me see what snoop shows
09:30 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
09:30 < AL13N_work> Proz01d: perhaps you have too much firewall rules, usually this stuff is routed and not natted
09:30 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:30 < martinip> if I snoop on the tun0 interface, I see the echo requests come in
09:31 < AL13N_work> do they have the correct source and dest
09:31 < martinip> yes
09:31 < martinip> src is 10.10.0.6
09:31 < Proz01d> AL13N_work: what should i be looking for? how do i test this?
09:31 < martinip> dst is correct
09:31 -!- bba [~bba@mail.3ma-group.com] has joined #openvpn
09:31 < martinip> looking at my server's routing table
09:31 < martinip> packets to 120 should go out via the default route
09:31 < AL13N_work> Proz01d: look with tcpdump or wireshark what is happening
09:32 < AL13N_work> martinip: check
09:32 < AL13N_work> martinip: you never know there is some advanced routing going on due to multihome or something
09:32 < martinip> yes, I think there is
09:32 < martinip> looking at the routing table
09:32 < martinip> looks like it could go out of any of the 2 interfaces
09:32 -!- Lenhix [~lenhix@190.85.51.242] has joined #openvpn
09:33 < martinip> I'll try snooping those for my icmp packets
09:33 < Proz01d> AL13N_work: should i be reunning this from the client?
09:33 < bba> !welcome
09:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:33 < bba> !route
09:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:34 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:35 < martinip> AL13N_work: I see the pings going out, but not coming in on the same interface
09:35 < bba> !goal
09:35 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:36 < AL13N_work> martinip: you mean they are returning in that other interface?
09:36 < bba> Hi, I would like to access the lan behind the server on an other interface, the openvpn server is in DMZ / More infos: http://pastebin.com/CzC8HAcx :)
09:36 < AL13N_work> now you do have to find yourself a solaris expert, because my knowledge stops there
09:36 < AL13N_work> martinip: usually it should be the same, but there is also asynchronic routing
09:36 < AL13N_work> so i have no idea
09:38 < martinip> AL13N_work: can't see which interface they're coming in on yet
09:38 < Proz01d> AL13N_work: should i be running wireshark on the client or server? both?
09:38 < martinip> I see if I ping the box directly from my server, replies come back on the same interface
09:39 < martinip> but if I ping it from my client, I don't see replies coming in at all
09:39 < AL13N_work> martinip: so default route on other machines is different
09:39 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-30.html#p12310>
09:40 < AL13N_work> martinip: they don't know 10.10.0/24 is the solaris' responsibility
09:40 < AL13N_work> you should add routes to the solaris for the vpn network on those other internal machines
09:40 < AL13N_work> or their gateway
09:43 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has quit [Quit: leaving]
09:43 < bba> Someone?
09:44 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has joined #openvpn
09:46 < martinip> it worked without touching those other machines
09:46 < martinip> when I had openvpn on a linux box
09:46 < martinip> after all, those other machines think they are just talking to the openvpn server
09:46 < martinip> the 10.10.0.6 IP is encapsulated
09:46 < martinip> ok... I will chalk this down to an internal routing/forwarding issue on the openvpn server
09:47 < martinip> and go from there
09:47 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:47 < martinip> thanks for the coaching!
09:47 < AL13N_work> martinip: so you were natting the VPN then
09:51 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:51 < martinip> yes, when it was on linux
09:51 < martinip> I guess that's the issue then
09:52 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:52 < bba> I would like to access the lan behind the server on an other interface, the openvpn server is in DMZ / More infos: http://pastebin.com/CzC8HAcx
10:00 < AL13N_work> martinip: you didn't mention that, so yeah, you're going to have to configure firewalling with masquerading or source natting
10:01 < martinip> AL13N_work: I think that nails it
10:01 < martinip> thanks
10:03 <@vpnHelper> RSS Update - forum: these things never work: default gateway, dns, win <http://forums.openvpn.net/topic8168.html#p12311>
10:09 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-30.html#p12312>
10:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:11 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:11 -!- bab [~bab@208.73.74.116] has joined #openvpn
10:12 -!- martinip [~martinip@unaffiliated/martinip] has left #openvpn []
10:14 < bab> whats going on today
10:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:18 -!- mordy [~mordy@5acc3a82.bb.sky.com] has quit [Ping timeout: 240 seconds]
10:20 < Proz01d> AL13N_work: still around?
10:20 <@vpnHelper> RSS Update - forum: OpenVpn Nat/Routing (DMZ with internet access and LAN) <http://forums.openvpn.net/topic8173.html>
10:21 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:22 < AL13N_work> Proz01d: yes?
10:24 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:25 < Proz01d> AL13N_work: i ran wireshark on the client and it looks like the tcp requests are being sent out
10:27 < Proz01d> I noticed that my subnet for the vpn connection is 255.255.255.252 and all other adaptors it's 255.255.255.0
10:27 < Proz01d> also there is no default gateway when i do ipconfig
10:27 < AL13N_work> that's normally not an issue
10:27 < AL13N_work> no default gateway?
10:28 < AL13N_work> hmm
10:28 < AL13N_work> you sure?
10:28 < AL13N_work> that's normally what redirect-gateway does
10:28 < AL13N_work> you should check your vpn logs
10:28 < krzee> thats true tho
10:28 < krzee> gateway isnt in ipconfig
10:28 < krzee> netstat -rn
10:29 < krzee> and as for the .252 netmask
10:29 < AL13N_work> check in vpn logs of the redirect-gateway option is pushed
10:29 < krzee> !/30
10:29 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
10:29 < krzee> AL13N_work, he said default gateway wasnt in ipconfig... it shouldnt be tho
10:29 < krzee> you see routes with netstat, not ipconfig
10:30 -!- buddha [~buddha@66.210.116.160] has quit [Read error: Operation timed out]
10:30 < AL13N_work> krzee: oh, ic; well i never use windows
10:30 < krzee> AL13N_work, you dont use netstat in unix to see your routes?
10:31 < krzee> (same deal, netstat -rn, not ifconfig)
10:31 < AL13N_work> krzee: route -n or ip route list
10:31 < krzee> (i dont use windows either)
10:33 -!- buddha [~buddha@66.210.116.160] has joined #openvpn
10:33 < Proz01d> my default gateway should be the vpn server correct?
10:33 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:34 < krzee> pastebin your routing table
10:36 -!- mordy [~mordy@5acc3a82.bb.sky.com] has joined #openvpn
10:38 -!- bba [~bba@mail.3ma-group.com] has quit [Quit: Linkinus - http://linkinus.com]
10:41 < Proz01d> here is the netstat -rn on the win7 box (client) = http://pastebin.com/Cr1kVCMm
10:43 < Proz01d> the client i am working with is connecting  like this  Laptop wireless > router > internet > vpnserver > no access outside (however existing connections seem to continue to work)
10:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
10:47 < krzee> ok
10:48 < krzee> the vpn is overriding your default gateway correctly
10:48 < krzee> did you setup NAT / ip forwarding on your server?
10:48 < krzee> !linnat
10:48 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
10:48 < krzee> !linipforward
10:48 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
10:51 < Proz01d> krzee:my configs are here  http://pastebin.com/gAiKpV13 .  the two last sections are the configs i made
10:51 < krzee> (assuming linux server)
10:51 < Proz01d> yes ubuntu server
10:51 < krzee> i didnt ask for your configs, and if i did i wouldnt look at it with all those comments
10:51 < krzee> check NAT / ip forwarding on your server (as i told you above)
10:52 < Proz01d> i added the echo 1 ... and the ip masqueradingg
10:53 < krzee> after that, can you ping 10.8.0.1?
10:53 < krzee> and after that, can you ping 4.2.2.1?
10:55 < Proz01d> i can ping 10.8.0.1
10:55 < krzee> brb as krzie
10:55 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 260 seconds]
10:55 < Proz01d> will check the second
10:55 < krzee> answer me if you still gave your problem when i return as krzie
10:55 < krzee> i wont see this terminal
10:57 < Proz01d> ok
10:57 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:02 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 252 seconds]
11:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:04 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
11:15 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
11:17 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:21 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
11:22 < Proz01d> krzie: i couldn't ping 4.2.2.1
11:23 < krzie> ok
11:23 < krzie> then you likely have something wrong in your firewall
11:23 -!- luneff [~yury@84.51.195.188] has quit [Quit: This computer has gone to sleep]
11:23 < krzie> if you can ping 10.8.0.1, and set ip forwarding like you said
11:23 < krzie> then its either your NAT or something blocking it, either way thats your firewall
11:28 < Proz01d> the only things i did were to execute : echo 1 > /proc/sys/net/ipv4/ip_forward and add iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
11:34 < Proz01d> is that all that is needed?
11:46 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
11:46 -!- bab [~bab@208.73.74.116] has quit [Quit: This computer has gone to sleep]
11:51 -!- bab [~bab@208.73.74.116] has joined #openvpn
11:51 <@vpnHelper> RSS Update - forum: OpenVPN Access Server AMI <http://forums.openvpn.net/topic8174.html>
11:51 < krzie> depends on your firewall before you started
11:51 < Bushmills> make sure your firewall doesn't block traffic. be it incoming or forwarded
11:51 < krzie> you need to be allowing tun+ to forward...
11:51 < krzie> etc
11:51 < krzie> ya like Bushmills said =]
11:52 < krzie> moinmoin bush
11:52 < Bushmills> or policy ACCEPT of FORWARD table
11:52 < Bushmills> moinmoin krzie
11:54 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
11:57 <@vpnHelper> RSS Update - forum: openvpn performance <http://forums.openvpn.net/topic8175.html>
12:08 -!- s7r [~Mirela@unaffiliated/s7r] has joined #openvpn
12:11 -!- bba [~bba@3.41.1.93.rev.sfr.net] has joined #openvpn
12:12 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:15 <@vpnHelper> RSS Update - forum: OpenVPN Access Server AMI <http://forums.openvpn.net/topic8174.html#p12316>
12:25 -!- luneff [~yury@84.51.197.177] has joined #openvpn
12:27 < darkdrgn2k3> what has a good gui for openvpn
12:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
12:27 < darkdrgn2k3> luci? o
12:27 < ecrist> darkdrgn2k3: what OS?
12:28 < darkdrgn2k3> oops sorry wrong channel
12:28 < darkdrgn2k3> ment for openwrt lol
12:30 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
12:30 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
12:30 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
12:32 -!- Lenhix [~lenhix@190.85.51.242] has quit [Quit: Mindwall!!]
12:34 < Bushmills> ssh
12:34 < Bushmills> you can lauch ssh from an xterm, then it's graphical
12:39 -!- bba [~bba@3.41.1.93.rev.sfr.net] has quit [Remote host closed the connection]
12:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
12:51 <@vpnHelper> RSS Update - forum: Site-to-Site Config Issue. Partly Working. <http://forums.openvpn.net/topic8167.html#p12317>
12:52 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:53 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:54 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
12:54 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 260 seconds]
12:57 <@dazo> darkdrgn2k3: what is the purpose of the GUI you want? ... if it is configuration GUI, then it is far better to do it yourself in the config files .... if it is for noobs to connect/disconnect to a server, then there are plenty of alternatives
12:57 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
12:57 <@dazo> but for server side, it's not worth the effort to have a GUI ... openvpn is too flexible to really make it worth all the work of combinations
12:58 < krzie> i think he meant a gui in general for openwrt
12:58 < krzie> (since he admitted to talking in the wrong chan)
12:58 -!- bab [~bab@208.73.74.116] has quit [Quit: This computer has gone to sleep]
12:58 <@dazo> openwrt == embedded systems in general for me .... which indicates, no gui :-P
12:59  * Bushmills thinks ssh is pretty general
12:59 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:00 < krzie> heh
13:00 < krzie> im with you guys on that
13:00  * dazo agrees with Bushmills 
13:01  * hyper_ch agrees also with bushmills
13:01 < hyper_ch> what do I agree to?
13:01  * Bushmills also agrees with Bushmills
13:05  * gladiatr chants I will avoid getting written up for speaking to people as if they were idiots--I will avoid getting written up for speaking to people as if they were idiots...
13:06 -!- Vutral [ss@vutral.net] has joined #openvpn
13:17 -!- CrazyGir_ is now known as CrazyGir
13:18 -!- CrazyGir is now known as Guest9127
13:22 -!- Guest9127 [~jason@li14-82.members.linode.com] has quit [Changing host]
13:22 -!- Guest9127 [~jason@unaffiliated/crazygir] has joined #openvpn
13:23 -!- Guest9127 is now known as CrazyGir_
13:24 -!- mordy [~mordy@5acc3a82.bb.sky.com] has left #openvpn []
13:26 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
13:30 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12319> || Setup multiple VPN server to use one central authentication <http://forums.openvpn.net/topic8176.html>
13:35 <@vpnHelper> RSS Update - forum: Setup multiple VPN server to use one central authentication <http://forums.openvpn.net/topic8176.html#p12320>
13:36 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:39 -!- grapsus [~grapsus@acces1236.res.insa-lyon.fr] has joined #openvpn
13:42 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Read error: Operation timed out]
13:46 <@vpnHelper> RSS Update - forum: How to create multi-server vpn <http://forums.openvpn.net/topic7748.html#p12322> || Setup multiple VPN server to use one central authentication <http://forums.openvpn.net/topic8176.html#p12321>
13:52 <@vpnHelper> RSS Update - forum: Setup multiple VPN server to use one central authentication <http://forums.openvpn.net/topic8176.html#p12323>
13:58 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5-dev]
13:58 -!- p3rror [~mezgani@41.140.155.182] has joined #openvpn
14:00 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 276 seconds]
14:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:09 -!- Vutral [ss@vutral.net] has joined #openvpn
14:11 -!- bab [~bab@208.73.74.116] has joined #openvpn
14:12 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has joined #openvpn
14:15 <@vpnHelper> RSS Update - forum: How to manually add a static route for OpenVPN on W7 clients <http://forums.openvpn.net/topic8177.html>
14:16 < s7r> is possible to make openvpn server out of a windows 7 machine ?
14:17 < krzie> sure
14:23 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
14:24 -!- Belial_ [~quassel@128.210.61.130] has quit [Ping timeout: 248 seconds]
14:24 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Client Quit]
14:32 -!- MarKsaitis [~MarKsaiti@client-86-31-252-98.oxfd.adsl.virginmedia.com] has joined #openvpn
14:33 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
14:39 -!- Lenhix [~lenhix@srvmail.servimos.com.co] has joined #openvpn
14:40 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:50 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:52 -!- p3rror [~mezgani@41.140.155.182] has quit [Ping timeout: 246 seconds]
14:58 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
15:03 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
15:05 -!- K1ng` [~KING@180.211.188.170] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
15:06 -!- dazo is now known as dazo_afk
15:09 -!- p3rror [~mezgani@41.248.107.70] has joined #openvpn
15:12 -!- K1ng [~KING@180.211.188.170] has joined #openvpn
15:25 -!- MarKsaitis [~MarKsaiti@client-86-31-252-98.oxfd.adsl.virginmedia.com] has quit [Ping timeout: 246 seconds]
15:31 -!- s7r [~Mirela@unaffiliated/s7r] has left #openvpn []
15:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:36 <@vpnHelper> RSS Update - forum: Windows 7 32bits openvpn 2.2.0 certificats problems <http://forums.openvpn.net/topic8163.html#p12325>
15:36 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:38 -!- Alias_NeO [~chatzilla@92.25.96.249] has joined #openvpn
15:39 < Alias_NeO> could somebody give me a little help with finalizing my openvpn setup please? I have my android phone (client) connected, but i'm not sure if it's "working"
15:41 < Alias_NeO> when i check my ip from the client by visiting a website that reports it in the browser it returns the phones ip, and if I try to access LAN shares I cannot connect.
15:41 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:41 <@vpnHelper> RSS Update - forum: Windows 7 32bits openvpn 2.2.0 certificats problems <http://forums.openvpn.net/topic8163.html#p12326>
15:41 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:42 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:42 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:42 < Bushmills> Alias_NeO: has your server been setup as gateway, and is your client traffic redirected through server?
15:43 < Alias_NeO> Im not sure how to answer either of those, I set up the server as per the hwto on openvpn.net, if you point me in the direction of the relevent information i can provide it.
15:43 < Bushmills> !redirect
15:43 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:44 < Alias_NeO> !def1
15:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
15:44 < Bushmills> without these three configuration steps, your client has no reason to send internet traffic through server, or server won't permit it
15:46 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:46 < Alias_NeO> ok, where do I start?
15:47 < Bushmills> your read the factoid
15:47 < Bushmills> you ...
15:47 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:48 < Alias_NeO> i see it, but i'm not sure where it means for me to use this redirect-gateway
15:51 < Bushmills> then you may also want to read the openvpn documentation. especially on topic of configuration:
15:51 < Bushmills> !howto
15:51 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:53 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
15:54 < bab> push is my favorite option
15:59 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
16:01 -!- darkdrgn2k3 [~darkdrgn2@204.101.63.212] has quit [Read error: Connection reset by peer]
16:01 -!- darkdrgn2k3 [~darkdrgn2@204.101.63.212] has joined #openvpn
16:06 < Alias_NeO> ok, i'v got local network access now
16:06 < Alias_NeO> file shares etc
16:06 < Alias_NeO> but server isnt routing me to the internet
16:10 -!- bab [~bab@208.73.74.116] has quit [Quit: Leaving]
16:10 < Alias_NeO> someone i can pm the log to so they can try help with this please?
16:12 < krzie> nobody
16:12 < krzie> !pastebin
16:12 <@vpnHelper> Someone || end3r || OS X keychain patch
16:12  * krzie doubletakes
16:12 < krzie> !pastebin
16:12 <@vpnHelper> Someone || end3r || OS X keychain patch
16:12 < Alias_NeO> this is the only meaningful line I saw ...
16:13 < Alias_NeO> Thu May 19 22:05:57 2011 hamid/212.183.128.15:48183 write UDPv4 [EMSGSIZE Path-MTU=1432]: Message too long (code=90)
16:13 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
16:13 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
16:13 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:13 < krzie> !logs
16:13 < Bushmills> Alias_NeO: have you done all this:
16:13 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
16:13 < krzie> use pastebin
16:13 < Bushmills> !redirect
16:13 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
16:13 < Alias_NeO> !ipforward
16:13 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:13 < Alias_NeO> !linipforward
16:14 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:14 < Bushmills> Alias_NeO: as said allready, you *must* do all three coig steps
16:14 < Bushmills> config steps
16:14 < Alias_NeO> ok, gimme a moment with the ipforward thing
16:15 < Alias_NeO> ok, ipforwarding is already set to 1 in my sysctl
16:15 < Alias_NeO> !nat
16:15 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
16:15 < Alias_NeO> !linnat
16:15 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
16:16 < Alias_NeO> ok, my server doesn't have "iptables"
16:17 < Alias_NeO> is there a config file i can set this in manually?
16:17 < Bushmills> nope
16:17 < Alias_NeO> so i need to get iptables binary?
16:17 < Bushmills> right
16:18 < Alias_NeO> ok, done.
16:18 < Bushmills> is your server, by any chance, a VPS?
16:18 < Alias_NeO> no, it's an arch box sitting next to me
16:20 < Alias_NeO> i'm connecting via the cell data on my phone as if i was remote
16:23 < Alias_NeO> right, i got the binary, i'm not sure what hte values i'm supposed to set with it are
16:23 < Bushmills> you will setup your server OS to do Network address translation
16:24 < Alias_NeO> yeh, i understand it's purpose, but i see conflicting information on what i should set it as
16:24 < Alias_NeO> i'll use the ones in the linnat info above
16:24 < Bushmills> your OS surely has more documentation about it, if the information above doesn't suffice
16:25 < ecrist> !pastebin
16:25 < Alias_NeO> thanks, i'll take a look.
16:25 <@vpnHelper> Someone || end3r || OS X keychain patch
16:26 < Alias_NeO> iptables v1.4.10: can't initialize iptables table `NAT': Table does not exist (do you need to insmod?)
16:26 < Alias_NeO> Perhaps iptables or your kernel needs to be upgraded.
16:26 < Alias_NeO> am I missing something?
16:27 < krzie> yes, but it is unrelated to openvpn
16:27 < krzie> the help channel related to your distro would likely be more helpful
16:27 -!- images [~image@static.238.229.4.46.clients.your-server.de] has joined #openvpn
16:27 < krzie> (get iptables + NAT working, come back to continue getting help with openvpn)
16:28 < Alias_NeO> will do
16:28 -!- images [~image@static.238.229.4.46.clients.your-server.de] has left #openvpn ["Leaving"]
16:36 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Read error: Connection reset by peer]
16:36 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
16:39 -!- Adde_BC [~AddeBC@c193-150-233-51.bredband.comhem.se] has quit [Ping timeout: 240 seconds]
16:39 -!- Addemanne [~AddeBC@c193-150-233-51.bredband.comhem.se] has joined #openvpn
16:43 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:43 -!- darkdrgn2k3 [~darkdrgn2@204.101.63.212] has quit [Quit: Leaving]
16:43 < Alias_NeO> not getting any help from the arch channel. Maybe someone could give me some general help to fix it myself..
16:44 < Alias_NeO> it seems the "NAT" in the linnat info should be lowercase
16:45 < Alias_NeO> then i get an alternative erro r that it can't find libipt_MASQUERADES.so, i did a modprobe on ipt_MASQUERADE and it's loaded ok, so how to i point it to the mdule?
16:45 < Bushmills> funny, vpnhelper also showed lowercase nat in the command
16:45 < Alias_NeO> not on my screen it didnt
16:45 < Bushmills> !linnat
16:45 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
16:46 < Bushmills>  iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
16:46 < Alias_NeO> yep, it's lowercase there
16:46 < Bushmills> shows lowercase here
16:46 < Bushmills> fix your terminal settings
16:46 < Alias_NeO> one mo
16:47 < Alias_NeO> !linnat
16:47 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
16:47 < Alias_NeO> hmm, looks fine, until i paste it into my windows ssh client
16:47 < Bushmills> !windows
16:47 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
16:48 < Alias_NeO> heh, true.. that.
16:48 < Lenhix> LOL
16:48 < Alias_NeO> the nuke one is the best
16:49 < Alias_NeO> ok, any ideas how i can coerse iptables into finding the module it wants?
16:49 < Alias_NeO> it is loaded, it just seems it's looking for it in the wrong dir
16:50 < Bushmills> seems to be something archlinux specific
16:51 < Bushmills> or you have a kernel running which doesn't match the installed modules#
16:51 < Alias_NeO> hmm, shouldn't be, theyre all coming from the same source
16:52 < Lenhix> Alias_NeO: perhaps a symlimk in /lib/iptables to where the module actually is?
16:52 < Alias_NeO> the module is loyeh, i'm trying to find the module atm
16:52 < Alias_NeO> bah
16:52 < Alias_NeO> trying to find it
16:55 < Alias_NeO> can't find it, it's not there
16:57 < Alias_NeO> I have a module called ipt_MASQUERADE
16:57 < Alias_NeO> but it wants libipt_MASQUERADES
16:58 < Bushmills> i'm sure people on #archlinux can be more helpful than people on #openvpn
16:58 < Lenhix> MASQUERADES? wtf?
16:58 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 250 seconds]
16:58 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
17:00 < Alias_NeO> yeh, that's what i thought, because that lib doesn't exist.
17:02 < Alias_NeO> ok, symlinked it and it went through fine
17:02 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:03 < Alias_NeO> ok, all sorted, i have internet
17:03 < Alias_NeO> thank you guys for your patience and assistance
17:11 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:13 -!- Netsplit *.net <-> *.split quits: buddha, @vpnHelper, Perun
17:18 -!- Netsplit over, joins: @vpnHelper, Perun, buddha
17:18 <@vpnHelper> RSS Update - forum: Site-to-Site Config Issue. Partly Working. <http://forums.openvpn.net/topic8167.html#p12330> || openvpn performance <http://forums.openvpn.net/topic8175.html#p12329>
17:19 -!- Netsplit *.net <-> *.split quits: @vpnHelper, Perun, buddha
17:19 -!- Netsplit over, joins: @vpnHelper, Perun, buddha
17:25 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12331>
17:30 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
17:30 <@vpnHelper> RSS Update - forum: How to manually add a static route for OpenVPN on W7 clients <http://forums.openvpn.net/topic8177.html#p12332>
17:32 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:39 < Alias_NeO> some part of this configuration seems to have killed my webserver that was runnin on the same box .. any ideas?
17:41 -!- Alias_NeO [~chatzilla@92.25.96.249] has left #openvpn []
17:43 <@vpnHelper> RSS Update - forum: OpenVpn Nat/Routing (DMZ with internet access and LAN) <http://forums.openvpn.net/topic8173.html#p12334> || OpenVPN on AWS EC2 gives Error Code 1232 (Transmit Failed) <http://forums.openvpn.net/topic8172.html#p12333>
18:07 <@vpnHelper> RSS Update - forum: How to manually add a static route for OpenVPN on W7 clients <http://forums.openvpn.net/topic8177.html#p12335>
18:13 < krzie> if he didnt leave i knew his answer
18:13 < krzie> !factoids search route
18:13 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
18:13 < krzie> !splitroute
18:13 <@vpnHelper> "splitroute" is https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet
18:13 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
18:13 < krzie> (for when he comes back with the same question)
18:26 -!- Squidy_at_Home [~quassel@189-31-152-56.cbace701.dsl.brasiltelecom.net.br] has joined #openvpn
18:28 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:35 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
18:36 -!- Lenhix [~lenhix@srvmail.servimos.com.co] has quit [Quit: Mindwall!!]
18:36 <@vpnHelper> RSS Update - forum: OpenVPN on AWS EC2 gives Error Code 1232 (Transmit Failed) <http://forums.openvpn.net/topic8172.html#p12336>
18:38 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
18:39 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
18:43 -!- raket [~raket@roker.ganjah.se] has joined #openvpn
18:45 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
18:54 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
18:59 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
19:00 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
19:01 <@vpnHelper> RSS Update - forum: ERROR: route add command failed. help me <http://forums.openvpn.net/topic8178.html>
19:13 <@vpnHelper> RSS Update - forum: Server is picking up my Client connection but timing out... <http://forums.openvpn.net/topic8179.html>
19:22 < ecrist> sup bitches?
19:22 < raket> :/ i get  write UDPv4 []: No buffer space available (code=105)
19:22 < raket> what's this anyway?
19:23 < raket> i googled around and someone said poll() did'nt honour something. should i recompile my kernel and turn of the poll() syscall? :D
19:23 < raket> gonna give it a try, brb
19:23 < ecrist> raket: that usually means you're being blocked by a firewall
19:23 < raket> which firewall?
19:23 < ecrist> usually a local one
19:23 < raket> i dont have any firewall at all
19:24 < raket> it's ppp0 device
19:24 < raket> on wwan connection... afaik there's no firewall. how do i find out?
19:26 < raket> ecrist: my 3g modem gives me a wwan0 and a ppp0, if i go through the wwan device my isp charge me. put on ppp0 they don't. if i use ppp0 and wwan0 over openvpn and bond the interfaces it doubles the rate. :o
19:27 < ecrist> that's just weird
19:28 < ecrist> are you inside a freebsd jail, or a VPS or VM?
19:28 < raket> ecrist: well, the error just limits the throughtput, nothing else really 
19:28 < raket> root@raket:/home/raket# uname -a
19:28 < raket> Linux raket 2.6.39 #1 SMP PREEMPT Fri May 20 00:50:32 CEST 2011 x86_64 Intel(R) Core(TM)2 Duo CPU     L7500  @ 1.60GHz GenuineIntel GNU/Linux
19:29 < raket> OpenVPN 2.1.4 x86_64-slackware-linux-gnu [SSL] [LZO2] [EPOLL] built on Mar 29 2011
19:30 < ecrist> huh
19:30 < ecrist> still think it's a firewall
19:30 < raket> from my isp? iptables is not even running at all.. 
19:35 <@vpnHelper> RSS Update - forum: these things never work: default gateway, dns, win <http://forums.openvpn.net/topic8168.html#p12339>
19:42 < Proz01d> my windows client can connect to the vpn (ubuntu) but i am unable to access any web pages..  I have included the masquerading settings  as well as the echo >1 for ipforwarding.  I can also ping the server from the client but can't ping anything else
19:43 < krzie> you have an issue in your firewall
19:43 < krzie> well, maybe maybe not...
19:43 < krzie> !logs
19:43 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
19:44 < krzie> after i see that i can say for sure
19:44 < krzie> but im 90% that its firewall ;]
19:44 < Proz01d> i'll check the openvpn logs
19:44 < Proz01d> and post
19:45 < krzie> cool, im geting out of work soon tho (fair warning to hurry)
19:45 < krzie> i should have at least 20min tho
19:46 < krzie> once im off work ill be leaving like the building was on fire (except i wont be carrying my servers)
19:46 < raket> ok
19:46 < raket> sec
19:49 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 244 seconds]
19:56 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
19:57 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
19:59 < raket> http://armitage.sytes.net/~raket/openvpn/
19:59 <@vpnHelper> Title: Index of /~raket/openvpn (at armitage.sytes.net)
20:00 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
20:00 < raket> no error at all in serverlog
20:01 < krzie> ]
20:01 < krzie> us=389381 write UDPv4 []: No buffer space available (code=105)
20:01 < krzie> lemme see your configs please
20:01 < Proz01d> just sent the last few lines of the connection i tested
20:02 < raket> krzie: ok
20:02 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Quit: Computer has gone to sleep.]
20:03 < raket> they're thre now
20:04 -!- CrazyGir_ is now known as CrazyGir
20:04 < raket> fixed permission on server.conf
20:04 < raket> http://armitage.sytes.net/~raket/openvpn/server.conf
20:05 < raket> http://armitage.sytes.net/~raket/openvpn/client.conf
20:05 < raket> krzie: actual i think openvpn can't write to the interface at all and it's related to comp-lzo. how do i turn off comp-lzo at all?
20:05 < raket> it doesnt seem to care if write comp-lzo no in server/client.conf
20:06 < krzie> comp-lzo no
20:06 < raket> but the log file still says it's enabled
20:06 < krzie> well i think, lets check
20:06 < krzie> !man
20:06 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
20:06 < krzie> this is 2.2 on both sides, right?
20:06 < raket> no it.s 2.1.4
20:06 < krzie> on both sides?
20:06 < raket> yes
20:07 < raket> same build, but on server side i added so i could read passwords from files :)
20:07 < krzie> comp-lzo no on both sides should work
20:07 < raket> ok
20:07 < raket> brb
20:07 < krzie> in windows, that option is by default in 2.2 (for the record)
20:08 < krzie> hrm
20:08 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
20:08 < krzie> well ive only seen that error when routing loops are caused
20:09 < krzie> 172.16.13.37 172.16.13.38 have nothing to do with existing subnets, right?
20:09 < krzie> im not saying you for sure have a routing loop... just that ive only seen that error in that situation
20:11 -!- master_of_master [~master_of@p57B55754.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:12 < raket> so
20:12 -!- Guest5029 [~Geek@unaffiliated/cain] has joined #openvpn
20:13 -!- master_of_master [~master_of@p57B558F1.dip.t-dialin.net] has joined #openvpn
20:13 < raket> krzie: well there's many servers running, and all of them have 172.16.13.37 as ip, is that wrong?
20:13 < raket> ops, openvpn servers.
20:14 < raket> on the same machine
20:14 < pwrcycle> pwrcycle: !do ./autofollow-wifi-4sq.sh "4sq wifi"
20:14 < pwrcycle> ww
20:15 -!- ManoftheSea [~ManoftheS@ip98-169-145-27.dc.dc.cox.net] has joined #openvpn
20:15 < krzie> on the same machine!
20:15 < krzie> yes, big time problem ;]
20:15 < ManoftheSea> can I find (basic) support here?  Does OpenVPN have a limit to certificate sizes?
20:16 < ManoftheSea> I have a 15kb cert, but I cannot connect
20:16 < ManoftheSea> Complains about the length of the plaintext, or something.
20:16 < Proz01d> krzie: i'm not seeing anything special in the logs do i need to increase verbosity
20:16 < krzie> i have never tried over 4096bit
20:16 < ManoftheSea> Is 15300 too many bits?
20:16 < krzie> 15kb, how big is that!?!?
20:16 < ManoftheSea> kbit
20:17 < ManoftheSea> according to crypto++ wiki, it's equal in strength to 256 bit AES
20:17 < raket> krzie: how should i set it up then? 
20:17 < krzie> ManoftheSea, paste the actual error?
20:17 < krzie> ManoftheSea, this is RSA, not AES
20:17 < raket> should each server running have it's own ip set?
20:17 < krzie> raket, they are on the same machine, absolutely must have different IPs
20:17 < ManoftheSea> I can't currently reproduce.  error's on a work computer.  Just wondered if it's a known "bug"
20:18 < raket> krzie: ok, i thought tun was p-t-p..
20:18 < ManoftheSea> I don't know if being completely ridiculous is really a bug, though.
20:18 < krzie> raket, what would happen if you had 3 network interfaces and put all on the same IP?
20:18 < krzie> (thats what you are doing)
20:18 < ManoftheSea> krzie: right, 15k RSA is equal to 256 AES
20:18 < krzie> ptp or not, you cant
20:19 < ManoftheSea> what's raket doing?  I came in late and missed it.
20:19 < krzie> ManoftheSea, well without the error i have nothing to go on, sorry man
20:19 < raket> krzie: is it possible to configure openvpn so that all users share gateway with preshared key then?
20:19 < ManoftheSea> alright.
20:19 < raket> krzie: just fast yes or no - not how
20:19 -!- Guest5029 [~Geek@unaffiliated/cain] has left #openvpn []
20:19 < krzie> ManoftheSea, he has multiple openvpn processes on the same machine using the same ip
20:19 < ManoftheSea> Side-note... it doesn't mind the CA cert being 15*1024
20:19 < ManoftheSea> and the same port?
20:20 < krzie> raket, why not use client/server mode?
20:20 < ManoftheSea> could bridging help you?
20:20 < krzie> ManoftheSea, i cant even say that your error has anything to do with the size of anything, i havnt seen an error
20:20 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:20 < krzie> bridging is not the answer
20:20 < krzie> ManoftheSea, i didnt mean listening on the same ip, i meant using the same VPN ip
20:21 < ManoftheSea> no, I accept that lack of error text means no help for me.  I'm claiming that it does work with a 15k CA and 4k client
20:21 < krzie> bridging is the answer ONLY when you need layer2 to pass through the vpn nodes
20:21 < raket> krzie: krzie just the tun devices on the server does, all the clients have different ips
20:21 < krzie> raket, doesnt matter
20:21 < ManoftheSea> if anyone else ever tries big certs.
20:21 < krzie> the server can only associate an ip with a single interface, you are trying to assign the same IP to multiple tun devices
20:22 < krzie> you probably want to stop using ptp and start using client/server
20:22 < raket> krzie: yeah.. but it seems to work anyway.. 
20:22 < krzie> like this:
20:22 < krzie> !sample
20:22 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
20:22 < krzie> raket, no, it does not work, thats why you are getting problems and coming here ;]
20:22 < krzie> kill all but 1 and watch it work right
20:22 < raket> ok
20:22 < raket> will do
20:22 < raket> sec
20:22 < krzie> then change to client/server and watch it continue to work right
20:23 < krzie> time for me to leave work
20:23 < Proz01d> :(
20:23 < Proz01d> krzie do you see any issues in my log?
20:23 < krzie> ill be back from krzee most likely... unless my girl gets done with her project early
20:23 < ManoftheSea> thanks krzie
20:23 < krzie> Proz01d, any objection with waiting 15 minutes or so?
20:24 < krzie> ill go home, roll a blunt, and take a better look =]
20:24 < Proz01d> nope
20:24 < ManoftheSea> raket: I'm still confused.  What are you doing?
20:24 < Proz01d> thank mans
20:24 < krzie> ManoftheSea, np =]
20:24 < krzie> Proz01d, np =]
20:24 < krzie> bbiaf
20:24 < raket> krzie: still the same ugly error with udp4v writes
20:24 < krzie> kill the server process and start it fresh after the others are down
20:24 < raket> ok
20:25 < krzie> or better yet, just give server/client a quick try
20:25 < ManoftheSea> with client-to-client?
20:25 < krzie> it shouldnt take long, i think theres even sample certs you can use for a quick test
20:25 < krzie> !c2c
20:25 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
20:25 <@vpnHelper> clients
20:25 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:25 < krzie> ok brb, for real this time ;]
20:26 < ManoftheSea> I believe you
20:26 < raket> it's still the error
20:27 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
20:27 < raket> i guess it has nothing todo with the openvpnserver configuration at all really
20:27 < raket> will test on wwan0 now instead of ppp0
20:27 < raket> brb
20:38 -!- Squidy_at_Home [~quassel@189-31-152-56.cbace701.dsl.brasiltelecom.net.br] has quit [Read error: Connection reset by peer]
20:45 < raket> i actual don't see the point with this
20:45 < raket> openvpn just floods the buffer space thing but throughtput is still maxxed out
20:45 < raket> is that a bogus error or something?
20:46 < raket> an mtu should be 1450, otherwise my isp throttle the traffic.
20:46 < krzee> nope, its an error from your OS, im used to seeing it during a routing loop (also cpu would be 100% at that point)
20:47 < krzee> if you change the mtu, i think you gotta do it on both sides (dont quote me, ive never had a reason to play with mtu)
20:47 < raket> i changed mtu to 1450
20:47 < raket> otherwise the isp throttle the traffic
20:47 < raket> and going through wwan0 is NOT an option as wwan0 is throttled to 30kb/sec
20:47 < raket> but ppp0 is not
20:48 < raket> krzie: the ppp have a p-t-p which is 10.64.64.64
20:48 < raket> and it routes directly through the ppp0 device
20:48 < krzee> if you're stuck, maybe make a nice complete forum post, jjk is very active on the forum lately and is quite the expert, in fact he recently authored an AWESOME book on openvpn
20:48 < krzee> !book
20:48 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
20:48 < raket> can that have anthing todo with anyway?
20:48 < raket> it's stable 550kb/sec now
20:49 < raket> but still writes that ugly error sometimes
20:49 < krzee> raket, if you were using redirect-gateway it could possibly not find your gateway, but that would be a different error
20:49 < krzee> server/client didnt help either?
20:50 < krzee> (since i fail to see why you would run multiple ptp "servers" on the same server machine)
20:50 < krzee> that was openvpn 1.x style
20:50 < raket> i dont want to use ssl
20:50 < raket> that's why
20:50 < krzee> 2.x introduced server mode, and that became unnecessary
20:50 < krzee> !secret
20:50 <@vpnHelper> "secret" is funny that people use free programs, consult free help for them, run a business with them, but are restricted to say what they do.
20:50 < krzee> oh thats not it
20:51 < krzee> !forwardsecurity
20:51 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation, or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
20:51 < krzee> be sure you know that
20:52 < raket> the key is encrypted
20:52 < raket> in a cryptoloop
20:52 < raket> so honsetly i'm not so worried
20:52 < raket> and the server is crypted as well
20:52 < raket> and this error ONLY comes when going through ppp0, if i connect to my wlan this error wont come at all
20:53 < krzee> ahh thats a good piece of info
20:53 < ManoftheSea> mtu = throttle?
20:53 < ManoftheSea> That... sounds wrong.
20:53 < raket> mtu 1500 = traffic get's throttled 
20:53 < raket> mtu 1450 - now throttle at all
20:53 < ManoftheSea> by throttled, you mean dropped?
20:53 < raket> s/now/no/
20:55 < raket> ManoftheSea: i have a prepaid phone, with a dataplan of 100mb/day. if i don't go through openvpn with mtu 1450 i get about 1kb/sec and dropped packets. if don't use openvpn they charge me 0.1eur/mb. if i use wwan0 they just knock me out.
20:55 < raket> http://armitage.sytes.net/~raket/wwanbond/f3507g-bond.html :D
20:56 < krzee> i think he means fragmented which drops his speed ;]
20:56 < raket> the speedtest is compressed data, and that works.
20:57 < raket> actual i think openvpn can't write to the interface
20:57 < krzee> well ya, cause the buffer gets full of stuff its already trying to send
20:58 < krzee> any vital signs on the box looking full?
20:58 < krzee> maybe a single cpu core at 100% or ram being muched on?
20:58 < raket> client is a c2d 1.6ghz with 3gb ram, and server is c2d with 2gb  ram
20:59 < raket> http://www.mail-archive.com/misc@openbsd.org/msg99778.html
20:59 <@vpnHelper> Title: Re: OpenVPN and traceroute: UDPv4: No buffer space available (at www.mail-archive.com)
20:59 < krzee> openvpn doesnt care how many cores you have for 1 thing...
20:59 < raket> can this be the problem?
20:59 < krzee> its monolithic, not threaded
21:00 < krzee> notice how he asked about load on that email as well?
21:01 < raket> yeah 
21:01 < raket> but there's no load on the server or client at all
21:01 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:01 < ManoftheSea> yeah, I totally don't get it.
21:01 < raket> he also points out that the poll() syscall is broken
21:02 < raket> so i can compile a kernel without that syscall and see what's happening..
21:03 < raket> because the server don't get any errors at all
21:03 < raket> Fri May 20 02:55:35 2011 us=741248 Replay-window backtrack occurred [1]
21:04 < raket> that's what happening if i use the ethernet emulation device wwan0
21:04 < krzee> points out?
21:05 < raket> well, i guess my carrier think my computer is mobile device because of using the ppp0 interface instead of the wwan0 device
21:05 < krzee> looks to me like he wasnt sure
21:07 < krzee> Proz01d, wanna give me a refresher on what your problem is while i roll this up?
21:07 < raket> krzee: should i run a strace directly on openvpn instead and post the big lofile somewhere so we can se what's happening?
21:08 < krzee> i would go to the forum
21:08 < raket> ok
21:08 < krzee> or the mail list
21:08 < krzee> if they ask for that, then yes
21:08 < ManoftheSea> It seems it'd be useful also to see the packets through the tun and the packets out the two interfaces.
21:09 < raket> ManoftheSea: honsetly, nothing seems to be wrong on server side at all
21:09 < raket> it just feels as openvpn prints a random error that makes no sense at all, but it still bugs me
21:10 < raket> because when that error comes up, nothing happends
21:10 < raket> it just like some drunkard are babbling for ever 
21:11 < raket> it have NO impact at all on my ping and/or speed
21:12 < raket> even when maxxing out through the tunnel nothing lags, and this is over a wwan-link :D
21:13 < Proz01d> krzee: basically when the  clients connect they can hit the outside but can ping the vpn server
21:15 < Proz01d> ip masquerading added to the iptables and echo 1 on the ipforward was done
21:15 < Proz01d> apart from the his i haven't done anything else on the srver side
21:15 < Proz01d> turned up the log levels
21:15 < ManoftheSea> Proz01d: does the vpn server respond to pings?
21:15 < ManoftheSea> I've done that before...
21:16 < Proz01d> client pings server > [ok]
21:16 < krzee> Proz01d, 
21:17 < krzee> can it ping 4.2.2.1?
21:17 < Proz01d> from the client no
21:17 < Proz01d> from the server yes
21:17 < krzee> (aka, you verified its not just dns)
21:17 < ManoftheSea> ok.
21:17 < raket> krzee and ManoftheSea thank you for the support. it was a really nice pleasure to be here. anyways. i'm glad that i can utilize unlimited traffic on my carrier with your software, and even though it prints buggy errors under some circumstances it gives me 2mbit/s unlimited traffic.
21:17 < raket> for just 9euro/month
21:18 < ManoftheSea> I wasn't much help.  But you're welcome!
21:18 < krzee> please do follow through with the forum post
21:18 < krzee> if there is in fact a bug you could help improve the software
21:18 < krzee> and if not, you could make your setup better
21:18 < krzee> one of the 2 ;]
21:18 -!- ManoftheSea [~ManoftheS@ip98-169-145-27.dc.dc.cox.net] has left #openvpn ["big certificate is big"]
21:18 < krzee> you'll likely catch jjk, and he's intimate with the code ;]
21:18 < krzee> i am not
21:19 < krzee> Proz01d, the forward chain in iptables is set to allow everything from tun+ ?
21:19 < krzee> tun+ covers tun* (tun0 tun1 etc)
21:20 < Proz01d> i have no clue... i'll print out the iptables 
21:20 < raket> krzee: sorry i could'nt find the forum post, could you please post it again
21:20 < krzee> !forum
21:20 <@vpnHelper> these things never work: default gateway, dns, win || Server is picking up my Client connection but timing out... || ERROR: route add command failed. help me || OpenVPN on AWS EC2 gives Error Code 1232 (Transmit Failed) || How to manually add a static route for OpenVPN on W7 clients || OpenVpn Nat/Routing (DMZ with internet access and LAN) || OpenVPN Reconnect Problem || Site-to-Site Config
21:20 <@vpnHelper> Issue. Partly Working. || openvpn performance || Ping works - the rest does not || Windows 7 32bits openvpn 2.2.0 certificats problems || Setup multiple VPN server to use one central authentication || How to create multi-server vpn || OpenVPN Access Server AMI || OpenVPN Client not working after installing - Help || OpenVPN, lost paquets in transmition... || New to VPNs how to setup? ||
21:21 <@vpnHelper> openvpn server connect to another server || Openvpn on Linux Vserver || How to setup multiple VPS servers using same ca.cert? || sharing client user name and password || TAP UDP bridge questions for games networking. || TUN and TAP : Same time ? || New Installation unable to see network || Configure clients to access all networks || TAP not working in Windows 7 || Advice on upgrading (4 more messages)
21:21 < krzee> oh god
21:21 < krzee> ignore that shit, lol
21:21 < krzee> damn rss feed!
21:21 < raket> :D
21:21 < krzee> forms.openvpn.net
21:21 < raket> ok
21:21 < krzee> forums.openvpn.net i mean
21:21 < raket> yeah i knew
21:22 < raket> that was a typo :o
21:29 < Proz01d> krzee: i know you didn't ask for it but the dump of my iptables is here:http://pastebin.com/EkL7yVTu  
21:33 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 250 seconds]
21:36 < krzee> im no linux guy, but ill look
21:37 < krzee> heh
21:37 < krzee> ya while i dont understand that, or want to, it *is* the problem ;]
21:38 < krzee> Proz01d, what was the log you sent earlier
21:38 < krzee> ?
21:38 < krzee> i remember what i wanted to look for in there
21:39 < Proz01d> oihh that was to see if there were any issues with the vpn sending client requests i think
21:39 <@vpnHelper> RSS Update - forum: sharing client user name and password <http://forums.openvpn.net/topic8162.html#p12341> || cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html>
21:40 < krzee> nope
21:40 < krzee> gimme the link again please
21:42 < Proz01d> http://pastebin.com/xVFxFL1L
21:44 < raket> krzee: i don't see whats wrong when having many tun devices with same ipadress on the server actual. i know this wont work with tap at all. but the tun driver really seems to ignore that more interfaces have the same ip. and it works flawless anyway.. the netmask is 255.255.255.255 so it really makes no sense at all. the only thing that's buggy is the fact i have to specifiy the gateway at the client after the dev thing, eg ip r a 0/0 dev tun0 wont work, but
21:46 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
21:46 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
21:46 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:50 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
21:50 <@vpnHelper> RSS Update - forum: Reliable TLS whitelist for use with commercial CA certs? <http://forums.openvpn.net/topic8181.html>
21:51 < krzee> Proz01d, ok cool
21:51 < krzee> its definitely your firewall
21:51 < krzee> likely the forward chain
21:51 < krzee> hope that helps, its as much as i can do for ya
21:51 < krzee> the manual says how to allow tun+ in your forward chain
21:51 < krzee> !man
21:51 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
21:51 < krzee> in the FIREWALL section
21:52 < krzee> not sure where that fits into your iptables, but maybe it will help lead you there
21:53 < Proz01d> Sweet thanks man .  I really appreciate it.. i'll take a look
21:56 -!- jaminja [~jaminja@rijkdijk2.demon.co.uk] has joined #openvpn
22:01 -!- jaminja_ [~jaminja@212.7.195.193] has joined #openvpn
22:01 -!- jaminja [~jaminja@rijkdijk2.demon.co.uk] has quit [Disconnected by services]
22:02 -!- jaminja_ [~jaminja@212.7.195.193] has quit [Changing host]
22:02 -!- jaminja_ [~jaminja@unaffiliated/jaminja] has joined #openvpn
22:02 -!- jaminja_ is now known as jaminja
22:13 < krzee> yw
22:15 < Proz01d> went through the firewall section....now to test .....i hope it works
22:15 < krzee> raket, things route right like that? and why wouldnt you just run client/server?
22:15 < krzee> oh right, dont wanna do ssl
22:17 < krzee> ohh i just saw what you're doing
22:17 < krzee> 2 connections using openvpn, bonding them?
22:18 < krzee> that is rather interesting!
22:20 < krzee> now it kinda makes sense whats happening
22:20 < krzee> one of your interfaces isnt keeping up
22:21 < krzee> some sort of sweet shaping would be needed maybe
22:22 < krzee> dude, you might have just stumbled on something big that i never knew openvpn could do
22:22 < krzee> you're really getting ~500kb/s on a single file download?
22:24 < krzee> upload would still be impossible to speed up like that, but i wonder... maybe download could
22:27 -!- GoldeNArX [~nate@S010618a90571c78c.cg.shawcable.net] has quit []
22:30 < krzee> dunno what tz you're in, but jjk will prolly cruise through in a couple hours (only 5:30am there)
22:30 < krzee> i think he'ld be interested in this, and could offer insight as well
22:32 < rajkosto> why wouldnt upload speed up like that 
22:32 < rajkosto> if you use device eth
22:32 < rajkosto> and bond them on both ends
22:32 < rajkosto> set up routing so that one vpn connection is forced to go through one gateway, the other through another
22:34 < Proz01d> krzee: no dice.  still can't get out to hit the outside 
22:34 < krzee> !iptables
22:34 <@vpnHelper> "iptables" is (#1) o test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT;, or (#2) then run iptables -F, iptables -Z after being SURE policies are set to accept, or (#3) please see http://openvpn.net/man#lbBD for more info, or (#4) see http://www.secure-
22:34 <@vpnHelper> computing.net/wiki/index.php/OpenVPN/Firewall
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:34 < krzee> (keep the NAT rule tho)
22:36 < krzee> http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall
22:36 <@vpnHelper> Title: OpenVPN/Firewall - Secure Computing Wiki (at www.secure-computing.net)
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:39 < Proz01d> the nat rule is the forwarding correct?
22:40 < krzee> its
22:40 < krzee> !linnat
22:40 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
22:40 < Proz01d> yup okay.
22:40 < krzee> !iptables
22:40 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z, or (#2) please see http://openvpn.net/man#lbBD for more info, or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
22:40 < krzee> there, better =]
22:41 < Proz01d> ohh... i think i might have found something...  just saw it now.
22:41 < Proz01d> i am missing this "iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>"
22:42 < krzee> dont need that
22:42 <@vpnHelper> RSS Update - forum: New Installation unable to see network <http://forums.openvpn.net/topic8149.html#p12343>
22:42 < krzee> unless you want to specify which IP to NAT as
22:43 < Proz01d> 10.8.0.6 should be sending requests to 10.8.0.1 which intern should submit them using my  server's ip ...
22:44 < Proz01d> the first command takes care of this?
22:44 < krzee> yep
22:44 < krzee> it goes out eth0
22:44 < Proz01d> hmm..
22:44 < krzee> (-o)
22:44 < Proz01d> let me check to make sure that's the right adaptor
22:44 -!- luneff [~yury@84.51.197.177] has joined #openvpn
22:47 < Proz01d> yup it's right
22:48 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:48 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:51 < krzee> see !iptables #3
22:51 < krzee> remove everything with that, then add the NAT rule
22:51 < krzee> and the forward rule from the manual
22:51 < krzee> if that helps, then start adding back your rules until it breaks, then find what/why it breaks
22:58 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
22:59 < Proz01d> thanks ... will check it out.
23:27 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
23:30 < Proz01d> krzee: it worked!!!!!!!!
23:30 < Proz01d> thank you so much for your help!
23:30 < Proz01d> very much appreciate!
23:32 < krzee> yw
23:36 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
23:44 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:59 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
--- Day changed Fri May 20 2011
00:09 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
00:27 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
00:45 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
00:45 -!- Flops [~Flops@p5B0672E6.dip.t-dialin.net] has joined #openvpn
00:45 < Flops> hey
00:46 < krzee> hey
00:46 < Flops> I am currently trying to set up openvpn to route all traffic, by following the tutorial
00:46 < krzee> !redirect
00:46 < Flops> but when I do:
00:46 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
00:46 < Flops> !nat
00:46 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
00:46 < krzee> #4
00:47 < Flops> !linnat
00:47 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
00:47 < Flops> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
00:47 < Flops> iptables: No chain/target/match by that name.
00:47 < Flops> !openvzlinnat
00:47 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
00:47 < krzee> ;]
00:48 < Flops> I don't have openvz tho
00:48 < Flops> my provider uses the commercial version
00:48 < krzee> what is it
00:48 < krzee> well regardless, you need NAT
00:49 < krzee> its a linux question, or a linux inside your VM question
00:49 < Flops> didnt work
00:49 < krzee> unless your provider will run that command for you
00:49 < Flops> I got it working before
00:49 -!- JohnTeddy [unstable@tor/regular/sid] has left #openvpn []
00:49 < krzee> hrm no, i think its supposed to work from inside
00:49 < krzee> iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
00:50 < krzee> make sure the forward chain has tun+ allowed
00:50 < krzee> is ip forwarding enabled?
00:50 < Flops> ye
00:50 < krzee> make sure nat is compiled in
00:52 < krzee> if you are still getting the no chain by that name error, you might want to go to a linux channel
00:52 < krzee> just to get NAT to work
00:52 < Flops> no, I don't get that error
00:53 < krzee> oh ok, so it took the PREROUTING one?
00:53 < Flops> !def1
00:53 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
00:53 < krzee> can your client ping the server internal vpn ip?
00:53 < Flops> krzee: it did
00:54 < Flops> PING 10.8.0.1 (10.8.0.1): 56 data bytes
00:54 < Flops> 64 bytes from 10.8.0.1: icmp_seq=0 ttl=64 time=73.995 ms
00:54 < Flops> works
00:54 < Flops> but the inet doesnt work
00:54 < krzee> can you ping 4.2.2.1?
00:58 -!- Flops [~Flops@p5B0672E6.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
00:59 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
00:59 -!- Flops [~Flops@p5B0672E6.dip.t-dialin.net] has joined #openvpn
00:59 < Flops> it's weird
01:00 < krzee> can you ping 4.2.2.1?
01:04 < Flops> yes
01:08 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
01:16 < krzee> so its just DNS
01:17 < krzee> you are still using your ISP's DNS, which you cant reach from your vpn server
01:17 < krzee> quick fix, use 8.8.8.8
01:17 < krzee> or
01:17 < krzee> !pushdns
01:17 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
01:17 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
01:21 < Flops> krzee: I will try that later, got school now.
01:21 < Flops> thanks for your help so far
01:21 -!- Flops [~Flops@p5B0672E6.dip.t-dialin.net] has left #openvpn []
01:25 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
01:34 <@vpnHelper> RSS Update - forum: ERROR: route add command failed. help me <http://forums.openvpn.net/topic8178.html#p12344>
01:40 <@vpnHelper> RSS Update - forum: Server is picking up my Client connection but timing out... <http://forums.openvpn.net/topic8179.html#p12345>
01:47 <@vpnHelper> RSS Update - forum: sharing client user name and password <http://forums.openvpn.net/topic8162.html#p12348> || cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12347> || these things never work: default gateway, dns, win <http://forums.openvpn.net/topic8168.html#p12346>
01:53 <@vpnHelper> RSS Update - forum: Reliable TLS whitelist for use with commercial CA certs? <http://forums.openvpn.net/topic8181.html#p12349>
01:59 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
02:04 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
02:07 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
02:16 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:19 -!- luneff [~yury@84.51.195.188] has joined #openvpn
02:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
02:24 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
02:29 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
02:34 < s7r> hello, i have an openvpn server with multiple clients. all clients connect just fine and the traffic is redirected through the vpn server 
02:35 < s7r> but the clients can't see each other as they would be on the same lan
02:35 < s7r> i want all clients to play lan games, etc
02:35 < s7r> any suggestions ?
02:44 -!- takamichi [Takamichi@78.133.37.249] has quit [Read error: Operation timed out]
02:45 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
02:49 < krzee> yes
02:49 < krzee> use dev tap
02:49 < krzee> dont need a bridge, just change dev tun to dev tap
02:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:59 < s7r> krzee: that's all ?
02:59 < s7r> not any settings in conf files?
03:02 < krzee> that is a setting in the configs
03:02 < krzee> but ya, lan gaming needs layer2
03:02 < krzee> dev tap does layer2
03:05 < s7r> thanks
03:05 < s7r> a lot 
03:05 < s7r> i had dev tun0 in my confs
03:05 < s7r> could you also tell me what is the meaning of the number after the device
03:05 < s7r> e.g. tun0 or tap0 ?
03:06 < krzee> in case you have multiple
03:06 < krzee> tap0
03:06 < krzee> tap1
03:06 < krzee> tap2
03:08 < s7r> i thought that was dev node MyTap
03:08 < s7r> in case you have multiple, you rename them as per description
03:08 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 260 seconds]
03:08 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
03:09 < krzee> whatev you like dude
03:17 <@vpnHelper> RSS Update - forum: New to VPNs how to setup? <http://forums.openvpn.net/topic8161.html#p12350>
03:18 -!- dazo_afk is now known as dazo
03:18 < s7r> krzee: in case i want multiple openvpn daemons on my server, each daemon needs to have its own tap? e.g. tap0, tap1, tap2? or they can all use the same tap reffered to as "tap" ?
03:20 < krzee> either actually
03:20 < krzee> because when you just put dev tap its dynamic
03:20 < krzee> will make a new one as needed
03:21 < s7r> thanks a lot
03:21 < s7r> yes you are right it works now
03:21 < krzee> yw
03:21 < s7r> at least the clients can ping each other
03:21 < krzee> for just ping you only needed client-to-client on the server
03:21 < krzee> it was the lan gaming that forced you to use dev tap
03:22 <@vpnHelper> RSS Update - forum: OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12351>
03:24 < s7r> krzee: and what differences are now compared to tun device? it;s the same thing only it's better that clients can do gaming
03:24 < s7r> right ?
03:24 < s7r> it;s not any speed or performance penality
03:24 < s7r> ?
03:24 <@dazo> !tunortap
03:24 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
03:24 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
03:25 <@dazo> notice the layer2 traffic difference
03:25 <@dazo> tun == layer3, tap == layer2 in the OSI stack
03:26 < s7r> I know this, but other than this it's not any difference?
03:26 <@dazo> that is a big difference
03:26 <@dazo> but that's the only difference
03:26 < s7r> :D
03:26 < krzee> lol
03:26 < s7r> not such expert but I do know basics of OSI model
03:27 < krzee> layer3 is tunneling ip
03:27 < krzee> layer2 is tunneling ip inside ethernet
03:28 <@dazo> and the communication with layer2 uses MAC addresses for addressing, which involves ARP for TCP/IP traffic
03:28 <@dazo> while layer3 is pure IP traffic
03:33 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
03:39 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 276 seconds]
03:42 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
03:45 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 258 seconds]
03:52 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
03:57 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12352>
04:03 <@vpnHelper> RSS Update - forum: OpenVPN server not reachable locally <http://forums.openvpn.net/topic8182.html>
04:05 -!- cherva [~cherva@93.152.158.160] has joined #openvpn
04:07 < cherva> I need some help if I tell the openvpn client to connect to an ip it works, but if I give a no-ip.org domain I get [NO_RECOVERY] A non-recoverable name server error occured. BUT I can ping it all is ok with the dynamic dns
04:08 < Bushmills> rephrase your problem description
04:13 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
04:14 < cherva> Bushmills, if I use an ip address openvpn connects, but if I put a domain name I get [NO_RECOVERY] A non-recoverable name server error occured.
04:15 < Bushmills> where do you see that error?
04:18 < cherva> when i run openvpn --config /etc/openvpn/............
04:18 < Bushmills> whose name server is the one you're using for resolving?
04:19 < cherva> the opendns 208.67.222.222
04:19 < cherva> pinging the domain works on the client machine
04:19 < Bushmills> try a different one.  like 8.8.8.8, just for testing
04:21 < Bushmills> note that 208.67.222.222 resolves to ip addresses even of there's no record for the queried host name
04:21 < cherva> it resolves to the right ip
04:21 < cherva> and with 8.8.8.8 stays at UDPv4 link remote [AF_INET] 8.8.8.8:1194
04:22 < Bushmills> 8.8.8.8:1194?? you are supposed to use that as recursive name server, not to connect to it as openvpn server
04:23 < cherva> to use 8.8.8.8 as a nameserver ?
04:23 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12354>
04:23 < Bushmills> instead of the opendns name server
04:24 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:24 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:25 < cherva> not it it [HOST_NOT_FOUND]
04:26 < Bushmills> fix the typo in the hostname of openvpn server in your client config file
04:28 -!- Goof [c1fdea93@gateway/web/freenode/ip.193.253.234.147] has joined #openvpn
04:28 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-30.html#p12355>
04:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:29 < Goof> !welcome
04:29 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:29 < cherva> I ping the hostname, then I copy/paste it in the client config file and still get host_not_found
04:29 < Goof> !goal
04:29 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:30 < Bushmills> what is the hostname? 
04:30 < cherva> optimist.no-ip.org
04:32 < Bushmills> show your client config
04:33 < cherva> http://pastebin.com/eFkkEZMP
04:33 < Bushmills> remove the comma
04:34 < cherva> hmmm strange
04:34 < cherva> it worked. Why is that comma a problem with dns and no problem with ip
04:35 < Bushmills> my guess is that whole string is sent to resolver. in case of ip address, no resolver is involved
04:35 < cherva> thanks man :)
04:36 < Bushmills> your use of opendns masked the real problem
04:37 < Bushmills> as it resolves anything to ip addresses, even if the host has no record
04:37 < cherva> I didn't know that
04:38 < Bushmills> try - with opendns again - to ping sdfsdf.kjsrfhksrfg.gsdf
04:39 < cherva> i tried it :)
04:39 <@vpnHelper> RSS Update - forum: OpenVPN server not reachable locally <http://forums.openvpn.net/topic8182.html#p12359> || OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12358>
04:39 < Bushmills> insane, isn't it?
04:40 < Bushmills> anyway, that makes such problems as you just had them hard to debug
04:41 < cherva> yes
04:45 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-15.html#p12361>
04:51 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12364> || OpenVPN server not reachable locally <http://forums.openvpn.net/topic8182.html#p12363>
04:57 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12365>
05:03 -!- cherva [~cherva@93.152.158.160] has quit [Remote host closed the connection]
05:13 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:13 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:16 < Goof> HiHi 
05:19 < Goof> I've got a small problème on a OpenVPN that work well most of the time on a win32 server
05:19 < Goof> The VPN work perfectly
05:20 < Bushmills> good. next one please.
05:24 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
05:24 < Goof> Except after a Server reboot
05:25 < Goof> the client connect to the VPN, get his Ip and seems to work well
05:26 < Goof> But no ip connexion with the server
05:26 < Goof> i can't ping the server or use my FTP or RDP access
05:27 < Goof> i juste restart  the open VPN service and that solve the problem
05:28 < Goof> is there a command in the OpenVPN configuration to solve that kind of malfunction ?
05:28 < Bushmills> Goof: try keepalive, so that client will notice that it must reconnect after server restart
05:29 < Goof> the problem is not on the client side
05:29 < Goof> i'm connecting the client after the server reboot
05:30 < Bushmills> possibly start order of services and openvpn server is not such that everything can be accessed after reboot
05:31 < Bushmills> services not binding to interfaces which aren't up, or such
05:32 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
05:34 < Goof> I was thinking about that kind of trick si, i've set the service in "delayed start" 
05:45 <@dazo> Goof: try --up ... with a scripts which just does a sleep
05:45 <@dazo> (that's just a loose shot in the dark)
05:45 < Goof> ok
05:45 < Goof> i could try it
05:48 < Goof> i'll have to find a sleep command for Windows (should be the easy part)
05:49 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12366>
05:50 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 260 seconds]
05:56 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
05:57 -!- zooz [~zooz@188-220-41-110.zone11.bethere.co.uk] has joined #openvpn
05:57 < zooz> hi people
06:00 < zooz> my users are complaining about their openvpn connections being dropped and then they are unable to connect
06:00 < zooz> with the error message: 
06:00 < zooz> TLS Error: TLS handshake failed openvpn
06:00 < zooz> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
06:00 < zooz> it looks like this is a known issue
06:03 < Bushmills> try --persist-tun, --persist-key  on client side
06:04 < Bushmills> but that wouldn't explain connection being dropped.
06:04 < Bushmills> --keepalive on server could help with that
06:19 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
06:37 < ecrist> zooz: not sure why you mean as 'this is a known issue'
06:37 < ecrist> it sounds like there's a network connection issue
06:38 < zooz> ecrist, well, I mean lots of people have this issue
06:39 < zooz> not saying this is a known issue with openvpn specifically
06:39 < zooz> it well could be network issu
06:39 < zooz> issue*
06:39 < ecrist> this is a network issue, not really an openvpn bug
06:39 < zooz> I am just trying to figure out if is on the client side of server
06:39 < zooz> sure
06:42 <@vpnHelper> RSS Update - forum: ERROR: --dev tun also requires --ifconfig <http://forums.openvpn.net/topic8183.html>
06:46 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 260 seconds]
06:47 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
06:47 <@vpnHelper> RSS Update - forum: sharing client user name and password <http://forums.openvpn.net/topic8162.html#p12368>
06:47 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
06:54 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12369>
07:01 < raket> haha, that buffer space error is really a routing error. the carrier tries to knock me off, but because of udp they can. this is so lol
07:02 < raket> can't :P
07:04 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 240 seconds]
07:06 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
07:12 <@vpnHelper> RSS Update - forum: OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12371> || ERROR: --dev tun also requires --ifconfig <http://forums.openvpn.net/topic8183.html#p12370>
07:16 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Quit: "shutdown is no fun :( back @ 0945 EDST hopefully"]
07:20 -!- zooz [~zooz@188-220-41-110.zone11.bethere.co.uk] has left #openvpn ["Leaving"]
07:25 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
07:36 <@vpnHelper> RSS Update - forum: yet another ping works - nothing else does <http://forums.openvpn.net/topic8184.html>
07:39 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
07:40 -!- luneff [~yury@84.51.195.188] has joined #openvpn
07:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:45 -!- bauruine_ [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
07:45 -!- bauruine_ [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Client Quit]
07:47 -!- luneff [~yury@84.51.195.188] has quit [Read error: No route to host]
07:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
08:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:12 <@vpnHelper> RSS Update - forum: yet another ping works - nothing else does <http://forums.openvpn.net/topic8184.html#p12374>
08:13 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
08:16 -!- luneff [~yury@84.51.195.188] has joined #openvpn
08:18 <@vpnHelper> RSS Update - forum: yet another ping works - nothing else does <http://forums.openvpn.net/topic8184.html#p12375>
08:31 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
08:40 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Quit: release_upgrade]
08:48 <@vpnHelper> RSS Update - forum: yet another ping works - nothing else does <http://forums.openvpn.net/topic8184.html#p12377> || ERROR: --dev tun also requires --ifconfig <http://forums.openvpn.net/topic8183.html#p12376>
09:00 <@vpnHelper> RSS Update - forum: yet another ping works - nothing else does <http://forums.openvpn.net/topic8184.html#p12378>
09:24 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-30.html#p12379>
09:25 -!- master_of_master [~master_of@p57B558F1.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:29 -!- master_of_master [~master_of@p57B558F1.dip.t-dialin.net] has joined #openvpn
09:30 <@vpnHelper> RSS Update - forum: ROUTE: route addition failed using CreateIpForwardEntry: <http://forums.openvpn.net/topic8185.html> || OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12380>
09:32 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Quit: leaving]
09:32 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
09:41 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
09:42 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
09:42 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
09:46 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
09:54 <@vpnHelper> RSS Update - forum: cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12382>
09:55 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:00 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:03 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 258 seconds]
10:05 -!- Goof [c1fdea93@gateway/web/freenode/ip.193.253.234.147] has quit [Quit: Page closed]
10:05 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
10:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:10 <@vpnHelper> RSS Update - forum: ROUTE: route addition failed using CreateIpForwardEntry: <http://forums.openvpn.net/topic8185.html#p12384> || cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12383>
10:16 <@vpnHelper> RSS Update - forum: ROUTE: route addition failed using CreateIpForwardEntry: <http://forums.openvpn.net/topic8185.html#p12385>
10:23 <@vpnHelper> RSS Update - forum: I will pay someone $100 to help me get my OpenVPN server up <http://forums.openvpn.net/topic8186.html>
10:35 <@vpnHelper> RSS Update - forum: ROUTE: route addition failed using CreateIpForwardEntry: <http://forums.openvpn.net/topic8185.html#p12389> || cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12388>
10:42 -!- luneff [~yury@84.51.195.188] has quit [Quit: This computer has gone to sleep]
10:47 <@vpnHelper> RSS Update - forum: cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12390>
11:13 < dvl> Backup happiness involves the ability to backup your laptop, while out of town, to your server at home.  #bacula #openvpn #backup
11:21 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
11:22 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-30.html#p12391>
11:24  * krzee wonders how long that would take on his weaksauce internet
11:24  * Bushmills likes sd cards for that purpose
11:25 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
11:30 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:38 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:47 < ecrist> dvl: glad things worked out for you.
11:48 -!- Vutral [ss@vutral.net] has quit [Ping timeout: 240 seconds]
11:53 -!- Kartagis [sbnc@unaffiliated/kartagis] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
11:53 -!- espengra [~espengra@2001:700:300:1430:21b:78ff:fe8a:d278] has quit [Remote host closed the connection]
11:53 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Read error: Operation timed out]
11:56 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
11:56 -!- fiacha [d95c8357@gateway/web/freenode/ip.217.92.131.87] has joined #openvpn
11:57 < fiacha> Hi.. i just installed open vpn on my win7 x64 pc. When i try to connect it says that there are no tap-win32 adapters.. but when i look under network adapters i do see a tap-win32 v9 adapter... what is wrong?
11:58 < krzee> prolly renamed it
11:58 < krzee> !google windows install notes txt
11:58 <@vpnHelper> Release Notes for Windows XP Setup Contained in the Pro.txt File: <http://support.microsoft.com/kb/286463>; Release Notes for Windows XP Setup Contained in the Home.txt File: <http://support.microsoft.com/kb/306824>; Installation (Win32) - Page 2: <http://openvpn.net/INSTALL-win32.html>
11:58 < krzee> !google windows install notes txt openvpn
11:58 <@vpnHelper> Installation (Win32) - Page 2 - OpenVPN: <http://openvpn.net/INSTALL-win32.html>; OpenVPN 2.0 HOWTO: <http://openvpn.net/howto.html>; OpenVPN 2.1: <http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html>
11:58 < krzee> go to that first link
11:59 < krzee> Notes -- List available TAP-Win32 adapters
11:59 < krzee> Notes -- Windows and TAP device naming
11:59 < krzee> ;]
12:00 < fiacha> krzee: thanks! but all the links give me a 404
12:00 < fiacha> i mean the openvpn ones
12:01 < krzee> sorry but i just went to it, it works
12:01 < krzee> http://openvpn.net/INSTALL-win32.html
12:01 < krzee> you have to go to the correct URL for it to work
12:01 < krzee> bbiaf, going to work
12:02 < fiacha> krzee: oh now it works, sorry must have messed something up.. thank you!!
12:06 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
12:07 < ecrist> krzee: OT: http://secure-computing.net/files/guns
12:07 <@vpnHelper> Title: Index of /files/guns (at secure-computing.net)
12:07 -!- luneff [~yury@84.51.197.177] has joined #openvpn
12:27 -!- dazo is now known as dazo_afk
12:29 -!- fiacha [d95c8357@gateway/web/freenode/ip.217.92.131.87] has quit [Ping timeout: 252 seconds]
12:51 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
12:54 -!- gyyrog [~gyyrog@174.124.194.46] has joined #openvpn
12:55 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:59 <@vpnHelper> RSS Update - forum: Connectivity Problem with OPEN VPN <http://forums.openvpn.net/topic8187.html>
13:01 < krzie> ooo good stuff ecrist
13:07 -!- gyyrog [~gyyrog@174.124.194.46] has quit [Remote host closed the connection]
13:17 -!- Martin__ [82eac9e8@gateway/web/freenode/ip.130.234.201.232] has joined #openvpn
13:17 < Martin__> hello everybody
13:18 < Martin__> I am trying to crosscompile OpenVPN for my DD-WRT router
13:18 < pwrcycle> Martin__: you'll prob. get better help in a dd-wrt channel
13:18 < Martin__> options.c: In function 'init_options': options.c:781: error: 'struct options' has no member named 'tmp_dir' options.c:782: error: 'struct options' has no member named 'tmp_dir' options.c:783: error: 'struct options' has no member named 'tmp_dir'
13:19 < Martin__> http://pastebin.com/fyA9vFyy
13:19 < Bushmills> Martin__: openvpn is already in openwrt package repository
13:20 < Martin__> but not the latest 2.2.0
13:20 < Martin__> I am now running 2.1.1 and I would like to upgrade
13:20 < Martin__> I found another pastebin entry with the same output http://pastebin.com/ZsEPXMNH
13:21 < Martin__> so I though that somebody had the same problem and managed to solve it somehow
13:22 < pwrcycle> i haven't heard anyone in here talk about dd-wrt
13:23 < pwrcycle> Martin__: why upgrade? is something not working?
13:23 < Martin__> I was hoping that handling of multicast was improved in never versions
13:24 < pwrcycle> sensible question. come back around 8pm eastern usually more people then.
13:25 < Martin__> and I was hoping to link it statically as well
13:26 < pwrcycle> i'm not a fan of dd-wrt anyway, i like openwrt
13:27 < Martin__> thanks anyway, I was just hoping to compile it myself, but I got stuck there
13:30 < raket> is there any dev here, what does the lzo-compression actual do? it seems the entire route goes down when it starts to run. it seems the carrier is using in deep packet inspection to determine what goes through or not
13:31 < krzie> it compresses the data before encrypting
13:31 < krzie> raket, did you start a forum post last night?
13:31 < krzie> i saw jjk was active on the forum a bit after we talked
13:31 < krzie> so if you did, he prolly responded
13:32 < raket> i did not, had to go to sleep it was 06 in the morning :)
13:32 < raket> which forum should i post in? related?
13:32 < pwrcycle> raket: unlikely their blocking lzo. don't even know how they'd detect if an ssl packet was lzo or not.
13:32 < krzie> lemme look
13:33 < raket> pwrcycle: the route goes down when using lzo
13:33 < krzie> im stuck between related and bragging rights
13:34 < raket> does lzo add any overhead to the packets, thats the question?
13:34 < krzie> no
13:34 < pwrcycle> raket: it's more likely one side or the other isn't using lzo properly.
13:34 < krzie> related makes sense, but once you're done this is a good bragging rights post
13:34 < raket> pwrcycle: no, it's not. it's because of my carrier. 
13:34 < raket> im 100% it is
13:35 < raket> if i turn on ethernet emulation on my wwan card that never happens
13:35 < raket> but if go directly through the ppp links it does not happen
13:35 < pwrcycle> raket: i'm a network security engineer, and i've never even heard of a way to detect lzo compression in a pakcet.
13:36 < raket> pwrcycle: what does that have todo with anything at all? i know the team who made the wwan card and the entire implemenation between the basestation and the carrier, besides that i've taken care of an entire isp including bgp etc. 
13:37 < pwrcycle> not saying it's impossible, i'm just saying i've never heard of an lzo option in an IDS or firewall
13:37 < pwrcycle> if you do find this is the case, i'd love to know it.
13:38 < raket> pwrcycle: it's not about lzo packet itself. but the carrier seem to identify the traffic as data when using it those closing the route for some seconds then brining it up again
13:38 < raket> because when using the ppp0 device instead of the wwan0 device it happens, but never on the wwan device
13:38 < raket> but i'm not sure it is. because i get the exactly same error if i close the ppp connection
13:39 < raket> it actual makes no sense, some packets are just dropped and lzo won't work properly, but when bonding over the tap devices the entire bond goes down, with the bonding ping etc goes down and the 3g connection is WAY faster
13:40 < raket> (the wwan0 device actual seems to make it's own connection to the station)
13:41 < ecrist> krzie: glad you like.  I'm a fan.
13:42 < raket> pwrcycle: if in doubt you want to inspect it, i'll gladly give you a root account to play with
13:42 < raket> (the machine have a ethernet port as well, which is independent of the wwan link)
13:43 < pwrcycle> i got enough trouble atm
13:44 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Ping timeout: 260 seconds]
13:44 < raket> pwrcycle: the case is that the carrier want's to knock me off, i can't use my wwan link at all if i don't use openvpn and change link-mtu to 1450.. and the other device (wwan0) which maybe is supposed to be used, it works, but they charge me if i use it. but when using link-mtu 1450 on and they don't.. :D 
13:45 -!- caesay [~caesay@socialshock.net] has joined #openvpn
13:46 < raket> (actual i want to pay for it, but it works really bad with mtu 1500 and normal tcp connections, and besides that i want to tunnel everything through udp so i can make sure my wwan antenna works as it should)
13:46 -!- caesay is now known as Guest35375
13:46 < raket> tcp is not an option for openvpn since i want to bond wwan0 and ppp0
13:47 < raket> :DD
13:47 < pwrcycle> raket: sound more like the bridge routing between your interfaces is the problem.
13:47 < pwrcycle> the openvpn packet headers are going to be the same no matter what, lzo or not
13:47 < raket> but i don't use any bridging at all do i?
13:47 < raket> or is the ppp0 device a bridge to my isp?
13:47 < pwrcycle> raket: if you have multiple interfaces on the device, they are bridged.
13:48 < pwrcycle> this has nothing to do with openvpn though
13:48 < raket> pwrcycle: no way they are. the wwan0 link is a own dedicated 7.2mbit connection and ppp0 are also. the card is announced as a 7.2mbit device?!
13:48 < Bushmills> raket: your carrier won't see the compression. they will see an encrypted data stream, but can't tell whether it's compressed or not 
13:49 < raket> but why doesnt it occour when i disable lzo?
13:49 < Bushmills> have you enabled compression on both client and server side?
13:50 < raket> Bushmills: yes i have. but it only occours on ppp0(--)tun0/tap0, not wwan0(--)tun0/tap0
13:50 < pwrcycle> raket: are you "push"ing lzo or explicityly declaring lzo on both sides?
13:50 -!- gyyrog [~gyyrog@174.124.194.46] has joined #openvpn
13:50 < raket> pwrcycle: explicit declaring it on both sides
13:51 < raket> i use p-t-p topoligy btw, in the tun0 case, in the tap case i don't even set ipadresses at all becaues the bonding driver on both sides just splits the packets and use both of the links
13:51 < raket> then i use tun0 on top of the bond0 interface
13:51 < raket> the tap interfaces is not encrypted at all
13:51 < raket> i really se no point for that, as the main bond0 device is that with a tun device
13:53 < pwrcycle> raket: interfaces are not encrypted, only packet data is encrypted.
13:53 < pwrcycle> interfaces are affected by routes
13:54 < raket> pwrcycle: the tap devices is not using for any routing at all. the bonding driver on both sides of the tunnel just use the tap devices to split the packet's in the middle to gain 2x250kb/sec instead of my current 250kb/sec limit by each interface. on top of the bond0 interface i run a tun0 tunnel
13:54 < raket> (where things are encrypted)
13:55 < raket> http://armitage.sytes.net/~raket/wwanbond/f3507g-bond.html
13:55 < pwrcycle> still though, "things" are no encrypted
13:55 -!- WiK [~wik@unaffiliated/wick2o] has joined #openvpn
13:55 < WiK> afternoon
13:55 < pwrcycle> i'm going to go out on a limb here and say, it's your firewall.
13:55 < Martin__> http://pastebin.com/J9spWkMB this is what I am getting
13:55 < raket> pwrcycle: i dont have ANY firewall AT ALL
13:56 < raket> neither on server or client
13:56 < Martin__> tried different version of crosscompile toolchain but still the same error
13:56 < raket> if you say it's the firewall, then it's the carrier inspecting the lzo packets
13:56 < pwrcycle> raket: where are you setting the routing for the interfaces
13:56 < raket> pwrcycle: check the site i pasted
13:56 < raket> everything is there
13:57 < WiK> I setup a vpn setup...I can connect to it fine and the connection is stable...however I can only ping the address of the remote server...I can't seem to ping or see any of the other interal boxes.  I've enabled portforwarding...any ideas on what I could try next or something to read and kick me in the correct direction?
13:57 < Bushmills> !route
13:57 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:57 < Bushmills> !serverlan
13:57 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
13:57 < raket> pwrcycle: in that case a tun device is not used on top of the bond device anyway
13:57 < WiK> Bushmills: thank you
13:58 < pwrcycle> WiK: !ipforward
13:58 < WiK> !ipforward
13:58 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
13:58 < WiK> !linipforward
13:58 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
13:58 < WiK> welp thats already done
13:59 < pwrcycle> WiK: have you set Masquerade in iptables?
13:59 < WiK> no..that i dont
13:59 < pwrcycle> there you go
13:59 < pwrcycle> !iptables
13:59 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z, or (#2) please see http://openvpn.net/man#lbBD for more info, or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
14:03  * WiK googles masquerade
14:06 < pwrcycle> WiK: alternative to masquerade is SNAT
14:06 < pwrcycle> WiK: http://openvpn.net/index.php/open-source/documentation/howto.html
14:06 < WiK> i think its a combo of iptables vs routing....i have the correct pushes and such (I think) and I just added a masquerade which didnt help
14:06 <@vpnHelper> Title: HOWTO (at openvpn.net)
14:06 < pwrcycle> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
14:07 < WiK> i used  iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
14:08 < WiK> let me try that one
14:08 < WiK> (with my ip range of course
14:08 < WiK> )
14:19 < WiK> added the mas...added an iroute to my ccd/user...nada
14:20 < WiK> o well..ill mess with it later as now i lost connection
14:20 < WiK> thanks for your help!!
14:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:24 < Bushmills> WiK: for hosts in a LAN you'd not enable masqerading
14:24 < Bushmills> you'd do that for using your openvpn server as gateway to internet
14:25 < Bushmills> well, you can do that. but setting appropriate routes, instead of NAT, is the cleaner way
14:26 < WiK> ahh
14:27 < Bushmills> i think the term commonly applied here to those NATting to LANs is "lazy asses" or such :)
14:28 < WiK> well ill admit to being lazy, thats why i learned to program :)
14:29 < WiK> ive spent 20 hours automating something so that i never have to do that 3 min task every again :)
14:29 < Bushmills> i thought the lazy coders were writing scripts instead :)
14:29 < WiK> code is code
14:29 < WiK> only differnce is scripts have less error checking
14:30 < krzie> Bushmills, you just outlined my life
14:30 < krzie> scripts have as much error checking as you decide they should
14:30 < Bushmills> krzie: i forgot the part of "hanging out on the beach to think about the implementation"
14:32 < Bushmills> and "pour some ethanol containing liquid to filter out anything non-essential for the problem at hand"
14:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:37 < krzie> dont forget to roll the favorite plant for the same purpose!
14:38 -!- zooz [~zooz@host86-150-246-219.range86-150.btcentralplus.com] has joined #openvpn
14:38 < zooz> can I specify what level of compression I want?
14:38 < krzie> yesn o and adaptive
14:38 < krzie> err
14:38 < krzie> yes no and adaptive
14:39 < krzie> as the manual says
14:39 < krzie> !man
14:39 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
14:40 < zooz> thanks
14:40 < krzie> mp
14:40 < krzie> np
14:52 -!- p3rror [~mezgani@41.248.107.70] has quit [Ping timeout: 246 seconds]
14:59 < Martin__> bye
14:59 -!- Martin__ [82eac9e8@gateway/web/freenode/ip.130.234.201.232] has quit []
15:09 -!- p3rror [~mezgani@41.140.152.121] has joined #openvpn
15:12 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
15:14 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
15:18 <@vpnHelper> RSS Update - forum: Multi Server VPN's using one login database and certificate <http://forums.openvpn.net/topic8189.html> || Disconnecct Mapped Drives Bat file <http://forums.openvpn.net/topic8188.html>
15:23 -!- gyyrog [~gyyrog@174.124.194.46] has quit [Read error: Connection reset by peer]
15:24 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
15:29 -!- woozly [~woozly@unaffiliated/woozly] has joined #openvpn
15:29 < woozly> how to check vpn worked or not?
15:29 < woozly> I run it in windows
15:29 < woozly> (configured all)
15:30 < woozly> but Can't understand it On or Off
15:31 -!- newmember [~newmember@S0106000d88e35fed.cg.shawcable.net] has joined #openvpn
15:33 -!- eXeC64 [~eXeC64@host86-170-167-189.range86-170.btcentralplus.com] has joined #openvpn
15:34 < Bushmills> look at interfaces, or route
15:35 < Bushmills> alternatively, ping server. or check logs
15:35 < woozly> which port I need to open in my router? 
15:35 < woozly> forwarding
15:36 < woozly> that port which I defined in server config?
15:36 < Bushmills> client side? none, probably
15:36 < Bushmills> unless you're blocking outgoing traffic
15:37 < woozly> My PC is OpenVPN server (Windows7)
15:37 < woozly> and It connected to Internet via my wi-fi router
15:37 < woozly> and I want 1 human to connect to my pc with openvpn
15:37 < woozly> but I can't understand it working or not
15:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 244 seconds]
15:38 < woozly> I've got my Ip 192.168.0.1 (with new virtual-adapter: TAP-Win32 Adapter V9
15:39 < woozly> it is it?
15:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
15:44 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
15:51 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
15:54 -!- cpm [~Chip@64.134.68.167] has joined #openvpn
15:54 -!- cpm [~Chip@64.134.68.167] has quit [Changing host]
15:54 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
15:56 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
15:58 <@vpnHelper> RSS Update - forum: Disconnecct Mapped Drives Bat file <http://forums.openvpn.net/topic8188.html#p12395>
16:03 < eXeC64> I'm inexperienced with VPN's. Could someone do a quick sanity check of my plan and point out any potential pitfalls or problems I may have: I have 2 networks, both have 3-5 computers on them. They are in different locations using different internet connections. I also have a VPS that I'd like to act as the server for the VPN. Would having the VPS run the OpenVPN server and all of the machines on the two networks connect t
16:03 < eXeC64> o it with OpenVPN's client be the best way to handle this? The objective is to get all the machines in the two networks to talk to each other like they are on a single lan.
16:08 -!- phaidros [~phaidros@ghostshell.subsignal.org] has joined #openvpn
16:09 < phaidros> heya, I am having a client-server config on tap devices. my server offers an ipv4 range, but the client doesnt get any address, as well as the tap device is not up. the log looks good.
16:09 < phaidros> I am not explicitely pulling in my client config, as I assumed this is standard behaviour
16:09 < phaidros> what could be wrong?
16:11 < phaidros> is there besides "ifconfig 10.23.8.1 255.255.248.0 ifconfig-pool 10.23.9.1 10.23.15.254" anything I have to set on the server side regarding IPs ?
16:13 < phaidros> paste here: http://pastebin.com/5rqa9ucf
16:13 < phaidros> and: no firewalls involved here
16:15 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
16:20 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
16:22 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
16:34 -!- Lenhix [~lenhix@srvmail.servimos.com.co] has joined #openvpn
16:39 < Bushmills> phaidros: check your logs
16:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:49 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
16:55 -!- woozly [~woozly@unaffiliated/woozly] has quit []
17:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
17:10 -!- zooz [~zooz@host86-150-246-219.range86-150.btcentralplus.com] has quit [Quit: Leaving]
17:26 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
17:31 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
17:34 -!- powerunit2 [~as@119.152.140.60] has joined #openvpn
17:34 < powerunit2> hello all
17:34 < powerunit2> i need some help
17:35 < powerunit2> i ve openvpn server on centos..
17:35 < powerunit2> i want to use openvpn server as gateway..
17:35 < powerunit2> so openvpn client can send there web trafic through openvpn server
17:36 < powerunit2> how can i do that? any help on this plzz
17:38 < krzie> !redirect
17:38 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
17:38 < krzie> !linnat
17:38 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
17:38 < krzie> !linipforward
17:39 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
17:39 < krzie> !def1
17:39 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
17:39 < krzie> there ya go
17:39 < powerunit2> thanks let me try
17:41 < Bushmills> !resolve
17:41 < Bushmills> !dns
17:41 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4
17:42 < Bushmills> !bypass-dns
17:42 < krzie> whatchya looking for?
17:43 < Bushmills> final step in redirecting all traffic through openvpn gateway
17:43 < krzie> possible
17:43 < Bushmills> "help, i can't connect to hosts using host names"
17:44 < krzie> hehe
17:44 < krzie> funny, i was just making a lil flowchart for troubleshooting !redirect, i was just at the DNS portion
17:46 < Bushmills> http://forthfreak.net/misc/problem.jpg
17:47 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
17:48 < powerunit2> krzie: i hve done nearly all the steps.. 
17:48 < powerunit2> please can ve a look on my server.conf
17:48 < powerunit2> http://pastebin.com/hEWsxFjC
17:48 < Bushmills> "nearly"?
17:48 < krzie> lol great Bushmills 
17:48 < powerunit2> :)
17:48 < krzie> if you didnt do all the steps, i have nothing to look at
17:48 < powerunit2> yup i think its nearly
17:48 < Bushmills> and now it "nearly" works?
17:48 < krzie> go do them all
17:51 < powerunit2>  cat /proc/sys/net/ipv4/ip_forward
17:51 < powerunit2> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
17:52 < krzie> umm
17:52 < powerunit2> i ve done all those steps
17:52 < krzie> cat /proc/sys/net/ipv4/ip_forward     outputs what
17:52 < powerunit2> it 1
17:52 < Bushmills> http://forthfreak.net/misc/ola.gif
17:52 < krzie> !configs
17:52 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:54 < powerunit2> http://pastebin.com/MznVEpLD
17:54 < powerunit2> this is server.conf
17:55 < krzie> why is line 11 and 12 the same thing?
17:55 < krzie> why are you using ipp.txt?
17:55 < powerunit2> let me check
17:56 < powerunit2> its only DNS values
17:56 < powerunit2> i can take out one of them
17:56 < krzie> you dont need to repeat the same line 2x
17:56 < krzie> right
17:56 < powerunit2> http://pastebin.com/Pm4Gx8S1            --- this is client.conf
17:56 < krzie> !ipp
17:56 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
17:57 < krzie> hah
17:57 < krzie> they are on the same lan
17:57 < krzie> !local
17:57 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
17:57 < Bushmills> i don't know of a situation where both bypassing dhcp AND pushing a name server makes sense
17:59 < powerunit2> yeh both systems are on same lan...
17:59 < krzie> people seem to throw bypass-dhcp in there without knowing why
17:59 < krzie> i ignore it, since i havnt seen it become a problem
17:59 < krzie> but ya
17:59 < powerunit2> is there any issue having both system on same network?
18:00 < krzie> yes...
18:00 < powerunit2> i m just testing it
18:00 < powerunit2> humm
18:00 < krzie> [15:57]  <krzie> they are on the same lan
18:00 < krzie> [15:57]  <krzie> !local
18:00 < krzie> [15:57]  <vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
18:00 < krzie> THAT
18:00 < krzie> lol
18:00 < powerunit2> rite
18:00 < powerunit2> let me test them on differnt LAN
18:00 < krzie> heh
18:04 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Disconnected by services]
18:05 < krzie> bad services!
18:06 < Bushmills> service disconnect task accomplished
18:06 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
18:06 -!- mode/#openvpn [+o vpnHelper] by ChanServ
18:07 -!- Perun_ [perun@chao5.net] has joined #openvpn
18:07 -!- buddha_ [~buddha@66.210.116.160] has joined #openvpn
18:08 -!- Perun [perun@chao5.net] has quit [Ping timeout: 246 seconds]
18:09 -!- buddha [~buddha@66.210.116.160] has quit [Ping timeout: 246 seconds]
18:11 -!- buddha_ is now known as buddha
18:22 < powerunit2> Dear Krzie. thanks for your help..
18:22 < powerunit2> it is working fine now.
18:22 < powerunit2> :)
18:25 < krzee> yw
18:25 < krzee> looks like soon ill have a lil flowchart so people will help themselves with that =]
18:27 -!- p3rror [~mezgani@41.140.152.121] has quit [Ping timeout: 276 seconds]
18:30 -!- powerunit2 [~as@119.152.140.60] has quit []
18:33 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
18:33 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
18:34 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
18:34 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has quit [Ping timeout: 240 seconds]
18:36 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
18:40 -!- Lenhix [~lenhix@srvmail.servimos.com.co] has quit [Quit: Mindwall!!]
18:53 -!- K1ng` [~KING@180.211.188.16] has joined #openvpn
18:56 -!- K1ng [~KING@180.211.188.170] has quit [Ping timeout: 250 seconds]
19:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
19:05 -!- Squidy_at_Home [~quassel@189.75.77.16] has joined #openvpn
19:13 -!- eXeC64 [~eXeC64@host86-170-167-189.range86-170.btcentralplus.com] has quit [Remote host closed the connection]
19:21 <@vpnHelper> RSS Update - forum: Reliable TLS whitelist for use with commercial CA certs? <http://forums.openvpn.net/topic8181.html#p12396>
19:54 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
19:55 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Operation timed out]
19:55 -!- Cain` is now known as Cain
20:10 -!- master_of_master [~master_of@p57B558F1.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:12 -!- master_of_master [~master_of@p57B57C30.dip.t-dialin.net] has joined #openvpn
20:16 -!- newmember [~newmember@S0106000d88e35fed.cg.shawcable.net] has quit [Ping timeout: 260 seconds]
20:21 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
20:57 -!- Guest35375 is now known as caesay
20:57 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
20:57 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
21:04 -!- Adde_BC [~AddeBC@c193-150-233-51.bredband.comhem.se] has joined #openvpn
21:05 -!- Addemanne [~AddeBC@c193-150-233-51.bredband.comhem.se] has quit [Ping timeout: 258 seconds]
21:21 <@vpnHelper> RSS Update - forum: cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12397>
22:01 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:04 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:24 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
22:24 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
22:24 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:31 -!- manchot [~tux@2001:470:1:41:a800:ff:fe3e:bca8] has joined #openvpn
22:32 < manchot> in the stage of writing new private key to 'server.key'
22:32 < manchot> , do I need to setup a A challenge password []:
22:32 < manchot> ?
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 250 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:49 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
22:49 < ecrist> manchot: what's your question?
22:50 < manchot> ecrist, when I set up a 'server.key'. do I need to specify a password for it?
22:50 < manchot> (I input a password anyway)
22:51 < Proz01d> curious to find out what ppl are using for their dns server.. i'm tunnelling and need to push a dns to clients
22:52 < ecrist> manchot: up to you.  with a password, user needs to enter every time VPN starts, without, they just need the key
22:52 < ecrist> Proz01d: I don't push DNS, myself.
22:53 < Proz01d> when i don't then the clients cannot pull up any sites
22:53 < ecrist> then push a dns server
22:53 < ecrist> !dns
22:53 < manchot> ecrist, I managed to connect to the server. however, I can't connect to any other sites.
22:53 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4
22:55 < manchot> ecrist, did I miss the our kernel routing table?
22:55 < manchot> I can't even ping 8.8.8.8
22:55 < manchot> I forgot to make myself clear:  I use this vpn to tunnel all my internet connections through it.
22:57 -!- luneff [~yury@84.51.197.177] has joined #openvpn
22:57 < ecrist> manchot: you're probably going to need nat or something simliar
22:57 < manchot> ecrist, that's what I need. how to enalbe NAT?
22:58 -!- maxagaz [~maxagaz@114.243.115.156] has joined #openvpn
22:58 < maxagaz> hi
22:59 < maxagaz> I'm in China where many website are banned, but I have a server abroad on which I installed OpenVPN, from this, can you tell me the main lines on how to open some website using this VPN ?
22:59 < ecrist> manchot: not really an openvpn question, that's a networking 101 or 201 question
22:59 < ecrist> !nat
22:59 < ecrist> !linnat
22:59 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
22:59 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
23:01 < Proz01d> manchot: i actually got mine working yesterday
23:02 < Proz01d> it's not that bad 
23:02 < manchot> how, how?
23:02 -!- s2r [~s2r@190.2.0.105] has joined #openvpn
23:02 < Proz01d> are you on ubuntu
23:02 < s2r> !welcome
23:02 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:03 < s2r> !goal
23:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:03 < s2r> !route
23:03 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
23:04 < manchot> Proz01d, debian
23:05 < manchot> Proz01d, pls just tell me how you set up NAT for all traffic
23:06 < ecrist> manchot: read some docs, first
23:07 < manchot> ecrist, reading it. Thank you. 
23:12 -!- s2r [~s2r@190.2.0.105] has quit [Ping timeout: 250 seconds]
23:14 -!- manchot [~tux@2001:470:1:41:a800:ff:fe3e:bca8] has quit [Ping timeout: 260 seconds]
23:16 -!- s2r [~s2r@190.2.0.105] has joined #openvpn
23:19 -!- Squidy_at_Home [~quassel@189.75.77.16] has quit [Read error: Connection reset by peer]
23:21 -!- s2r [~s2r@190.2.0.105] has quit [Ping timeout: 260 seconds]
23:26 -!- s2r [~s2r@190.2.0.105] has joined #openvpn
23:26 -!- s2r [~s2r@190.2.0.105] has quit [Client Quit]
23:28 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
23:31 < Proz01d> manchot:  i backed up my iptables iptables-save > ~/fw-backup.ipt
23:32 < Proz01d> then added the follwoing: sudo iptables -A INPUT -p udp --dport 1194 -j ACCEPT
23:32 < Proz01d> sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
23:32 < Proz01d> sudo iptables -A INPUT -i tun+ -j ACCEPT
23:32 < Proz01d> sudo iptables -A FORWARD -i tun+ -j ACCEPT
23:34 < Proz01d> !redirect
23:34 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
23:35 < Proz01d> !def1
23:35 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
23:35 < Proz01d> you also need to make sure your configs (server.conf) has the #3 entry
23:35 < Proz01d> !ipforward
23:35 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
23:35 < Proz01d>  !linipforward
23:51 < Proz01d> there you go .
--- Day changed Sat May 21 2011
00:08 -!- maxagaz [~maxagaz@114.243.115.156] has quit [Ping timeout: 260 seconds]
00:18 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 276 seconds]
00:21 -!- maxagaz [~maxagaz@114.243.115.156] has joined #openvpn
00:25 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
00:46 -!- takamichi [Takamichi@78.133.37.249] has quit [Ping timeout: 248 seconds]
00:47 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
00:47 -!- maxagaz [~maxagaz@114.243.115.156] has quit [Ping timeout: 276 seconds]
00:50 -!- maxagaz [~maxagaz@114.243.115.156] has joined #openvpn
01:03 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
01:25 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
01:44 -!- K1ng` [~KING@180.211.188.16] has quit [Ping timeout: 260 seconds]
01:46 < krzee> you put a space in there
01:46 <@vpnHelper> RSS Update - forum: How to setup multiple VPS servers using same ca.cert? <http://forums.openvpn.net/topic8124.html#p12398>
01:46 < krzee> !linipforward
01:46 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
02:03 -!- manchot [~tux@2001:470:1:41:a800:ff:fe3e:bca8] has joined #openvpn
02:10 -!- gaelfx [~Matt@118.124.244.174] has joined #openvpn
02:11 < gaelfx> if I set up my router to use a vpn, is it possible to make it only use the vpn for wireless connections and use the standard service for wired connections?
02:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:15 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Ping timeout: 260 seconds]
02:17 -!- manchot [~tux@2001:470:1:41:a800:ff:fe3e:bca8] has quit [Remote host closed the connection]
02:22 -!- manchot [~tux@2001:470:1:41:a800:ff:fe3e:bca8] has joined #openvpn
02:22 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
02:22 < manchot> I set up a vpn, and I did  echo 1 > /proc/sys/net/ipv4/ip_forward
02:22 < manchot> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
02:22 < manchot> still, the NAT does not work for my connection. 
02:22 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Read error: Operation timed out]
02:22 < manchot> I can only access 10.8.0.1, but no other IPs or Urls
02:26 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
02:30 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
02:33 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
02:42 < Bushmills> manchot: did you do that on the machine which should act as gateway to internet?
02:43 < manchot> yes. 
02:43 < Bushmills> added redirect-gateway to client config?
02:43 < manchot> I'll try that. 
02:47 < manchot> Bushmills, the client config says redirect-gateway def1.
02:47 < manchot> shall I add 'def1' to the server config?
02:48 < Bushmills> nope.  what's there on the server config where you could add def1?
02:48 < manchot> push "redirect-gateway def1"
02:48 < manchot>    ?
02:48 < Bushmills> ah.  either the server push, or the client redirect-gateway, will be enough
02:49 < Bushmills> windows client?
02:49 < manchot> yes
02:49 < Bushmills> !winroute
02:49 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
02:49 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
02:50 < Bushmills> confirm that redirect-gateway modifies the client route
02:50 < manchot> how to confirm?
02:50 < Bushmills> with def1. you'll see two now routes with /1 netmask  (128.0.0.0)
02:50 < Bushmills> new
03:00 < manchot> Bushmills, for this stage "writing new private key to 'server.key'
03:00 < manchot> "  can I just press enter to use the default setting?
03:01 < Bushmills> for checking routes. no key writing is involved
03:01 < manchot> and do I need to add a password when I come to this stage? (I am reinstall my Openvpn)
03:01 < manchot> Please enter the following 'extra' attributes
03:01 < manchot> to be sent with your certificate request
03:01 < manchot> A challenge password []:
03:01 < manchot> do I need a password?
03:01 < Bushmills> i don't know whether you can just press enter because i have no idea what you're busy with
03:01 < manchot> I am reinstall my Openvpn
03:02 < manchot> Bushmills, allow me to rehash my question. do I need to set a challenge password ?
03:02 < Bushmills> i also don't know whether you need a password, because i have no idea of the security requirements of your environment
03:04 < Bushmills> if its deemed necessary to protect the keys, enter one. 
03:09 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Operation timed out]
03:10 -!- gallatin [~gallatin@dslb-178-006-217-161.pools.arcor-ip.net] has joined #openvpn
03:16 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
03:16 -!- gaelfx [~Matt@118.124.244.174] has left #openvpn []
03:18 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
03:26 < manchot> Bushmills, thank you. I figured it out
03:26 -!- manchot [~tux@2001:470:1:41:a800:ff:fe3e:bca8] has quit [Remote host closed the connection]
03:34 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Operation timed out]
03:40 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
03:42 -!- K1ng [~KING@180.211.188.16] has joined #openvpn
04:13 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
04:16 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 244 seconds]
04:17 -!- gallatin [~gallatin@dslb-178-006-217-161.pools.arcor-ip.net] has quit [Quit: Client exiting]
04:17 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
04:19 -!- GrecKo [~quassel@ks359238.kimsufi.com] has left #openvpn []
04:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
04:48 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
04:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:06 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
05:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:47 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
05:53 <@vpnHelper> RSS Update - forum: ROUTE: route addition failed using CreateIpForwardEntry: <http://forums.openvpn.net/topic8185.html#p12400> || Connectivity Problem with OPEN VPN <http://forums.openvpn.net/topic8187.html#p12399>
05:55 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
06:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:14 -!- tty234 [telex@gateway/shell/anapnea.net/x-ibxmbkoyxnvsotly] has quit [Ping timeout: 276 seconds]
06:28 -!- cpm [~Chip@64.134.68.167] has joined #openvpn
06:28 -!- cpm [~Chip@64.134.68.167] has quit [Changing host]
06:28 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:28 <@vpnHelper> RSS Update - forum: Force clients to reconnect <http://forums.openvpn.net/topic8190.html>
06:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
06:41 <@vpnHelper> RSS Update - forum: ROUTE: route addition failed using CreateIpForwardEntry: <http://forums.openvpn.net/topic8185.html#p12402>
06:44 -!- bystander [48143ae9@gateway/web/freenode/ip.72.20.58.233] has joined #openvpn
06:45 < bystander> what could be the possible that I cannot open my vps control panel?
06:47 <@vpnHelper> RSS Update - forum: ROUTE: route addition failed using CreateIpForwardEntry: <http://forums.openvpn.net/topic8185.html#p12403>
06:53 <@vpnHelper> RSS Update - forum: ERROR: --dev tun also requires --ifconfig <http://forums.openvpn.net/topic8183.html#p12404>
06:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:58 -!- bystander [48143ae9@gateway/web/freenode/ip.72.20.58.233] has quit [Quit: Page closed]
07:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
07:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
07:27 -!- WiK [~wik@unaffiliated/wick2o] has left #openvpn []
07:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
07:48 -!- luneff [~yury@95.174.117.30] has joined #openvpn
07:48 -!- manchot [~tux@2001:470:1:41:a800:ff:fe3e:bca8] has joined #openvpn
07:49 < manchot> openvpn can't start:  NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
07:49 < manchot>  Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
08:00 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
08:04 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
08:14 -!- luneff [~yury@95.174.117.30] has quit [Quit: This computer has gone to sleep]
08:14 -!- luneff [~yury@95.174.117.30] has joined #openvpn
08:16 -!- luneff [~yury@95.174.117.30] has quit [Remote host closed the connection]
08:16 -!- luneff [~yury@95.174.117.30] has joined #openvpn
08:24 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:28 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
08:33 < buddha> wtf did that guy pm everybody in the chan or what?
08:34 -!- luneff [~yury@95.174.117.30] has quit [Quit: This computer has gone to sleep]
08:47 -!- tty234 [telex@gateway/shell/anapnea.net/x-agbrazovrjzyksnw] has joined #openvpn
08:55 -!- Squidy_at_Home [~quassel@189.75.77.16] has joined #openvpn
08:57 <@vpnHelper> RSS Update - forum: OpenVPN Client not working after installing - Help <http://forums.openvpn.net/topic8154-30.html#p12405>
08:58 < s7r> I have a vpn server which has only 1 external IP address. vpn daemon listens on port 1194 UDP. i want to configure the vpn server to assign the same IP address to a certain client everytime (e.g. 10.8.0.2). i also want to forward port 80 of the public IP of the server to that client, which means when somebody will type in the browser the public IP address of the vpn server will see the website hosted on the client's computer
08:58 < s7r> how can I do this please?
09:03 <@vpnHelper> RSS Update - forum: cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12407> || Reliable TLS whitelist for use with commercial CA certs? <http://forums.openvpn.net/topic8181.html#p12406>
09:05 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:08 -!- K1ng [~KING@180.211.188.16] has quit [Ping timeout: 240 seconds]
09:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
09:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:21 <@vpnHelper> RSS Update - forum: cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12408>
09:24 -!- Squidy_at_Home [~quassel@189.75.77.16] has quit [Ping timeout: 250 seconds]
09:24 -!- manchot [~tux@2001:470:1:41:a800:ff:fe3e:bca8] has quit [Ping timeout: 260 seconds]
09:27 <@vpnHelper> RSS Update - forum: sharing a folder with vpn:not works! <http://forums.openvpn.net/topic8191.html>
09:40 -!- Squidy_at_Home [~quassel@189.75.77.16] has joined #openvpn
09:44 -!- K1ng [~KING@180.211.188.88] has joined #openvpn
09:45 -!- Squidy_at_Home [~quassel@189.75.77.16] has quit [Ping timeout: 250 seconds]
09:45 <@vpnHelper> RSS Update - forum: Force DNS on specific domain name <http://forums.openvpn.net/topic7605.html#p12410>
09:49 -!- K1ng [~KING@180.211.188.88] has quit [Ping timeout: 260 seconds]
09:51 <@vpnHelper> RSS Update - forum: cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12411>
09:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:57 <@vpnHelper> RSS Update - forum: cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12412>
09:58 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
09:58 < rajkosto> hey
09:58 < rajkosto> if you use redirect gateway, openvpn client adds a route rule to the openvpn server ip
09:58 < rajkosto> however there are some other services on that ip that i would like to be tunnelled
09:58 < rajkosto> how do i accomplish that /
10:03 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html>
10:09 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12415> || cant authenticate any user after putting client-connect.sh <http://forums.openvpn.net/topic8180.html#p12414>
10:11 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:11 -!- luneff [~yury@84.51.197.177] has joined #openvpn
10:15 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12416>
10:17 -!- K1ng [~KING@180.211.188.225] has joined #openvpn
10:21 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12417>
10:27 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12418>
10:35 -!- mete__ [~metefr@84.200.12.194] has quit [Ping timeout: 258 seconds]
10:40 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12419>
10:40 -!- Squidy_at_Home [~quassel@187.52.121.150] has joined #openvpn
10:46 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12420>
10:47 -!- Squidy_at_Home [~quassel@187.52.121.150] has quit [Ping timeout: 240 seconds]
10:52 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12422>
10:54 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 240 seconds]
10:56 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
10:56 -!- mode/#openvpn [+o raidz] by ChanServ
10:58 <@vpnHelper> RSS Update - forum: OpenVPN with PAM authorization in Ubuntu 11.04. <http://forums.openvpn.net/topic8193.html>
11:04 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12424>
11:04 -!- Squidy_at_Home [~quassel@187.53.137.55] has joined #openvpn
11:10 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12425>
11:16 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12426>
11:28 <@vpnHelper> RSS Update - forum: need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192.html#p12430> || OpenVPN with PAM authorization in Ubuntu 11.04. <http://forums.openvpn.net/topic8193.html#p12429>
11:28 < rajkosto> fdamn spam
11:34 <@vpnHelper> RSS Update - forum: sharing a folder with vpn:not works! <http://forums.openvpn.net/topic8191.html#p12432> || need to route windows xp traffic through openvpn client <http://forums.openvpn.net/topic8192-15.html#p12431>
11:51 -!- Muty [~amir@unaffiliated/muty] has joined #openvpn
11:53 < Muty> hi guys, one problem: I want to redirect traffic of vpn clients through the server (redirect-gateway def1), problem is, that I can't enable the NAT module (the server is a openvz container that I can't manage)
11:53 < Muty> The server support told me that I just could route the traffic instead of natting it.
11:54 < Muty> How can I do that?
11:56 < Proz01d> muty: what are ypur current config?  (server.conf ,iptables and ipforward)
11:56 < Proz01d> use pastebin
11:57 < Muty> hold on a second.
11:59 < Muty> http://pastebin.com/M10wUDAR
12:00 < Muty> cat /proc/sys/net/ipv4/ip_forward
12:00 < Muty> ups
12:01 < Muty> ip_forward is enabled
12:02 < Proz01d> you are bridging right?
12:03 < Proz01d> i only just started using openvpn but i'm routing
12:03 < Proz01d> not sure how things would work with tap
12:03 < Proz01d> what is your goal?
12:04 < Muty> I use tap (need it for broadcast). Goal is: Clients can connect to VPN in unsecure network and surf the web safely through the VPN (even if it is slower)
12:05 < Proz01d> do you want the  clients to talk to each other?
12:05 < Muty> This already works.
12:05 < Muty> And this is ok (I wanted that)
12:05 < Muty> but the clients can't reach the internet through the server.
12:06 < Muty> In iptables I've allowed all traffic from the VPN network (10.8.0.0/24)
12:09 < s7r> I have a vpn server which has only 1 external IP address. vpn daemon listens on port 1194 UDP. i want to configure the vpn server to assign the same IP address to a certain client everytime (e.g. 10.8.0.2). i also want to forward port 80 of the public IP of the server to that client, which means when somebody will type in the browser the public IP address of the vpn server will see the website hosted on the client's computer.
12:09 < s7r> how can I do this ?
12:11 < rajkosto> s7r, lots of iptables
12:11 < rajkosto> this is besides vpn implementation
12:12 < s7r> the server is a windows :D
12:12 < rajkosto> good luck !
12:12 < s7r> i just wanna know if it's possible
12:12 < s7r> if you can't tell me how to just tell me if technically it's possible on windows server
12:13 < rajkosto> i never use windows for server
12:13 < rajkosto> so
12:13 < rajkosto> i do the exact thing
12:13 < rajkosto> but all servers and routers are linux
12:13 < rajkosto> it involves bunch of iptables rules
12:13 < rajkosto> you can assign the same ip address to a certain client usng CCD
12:14 < rajkosto> i also use a separate ip addres
12:14 < rajkosto> for the VPN internet access 
12:14 < rajkosto> you have to do it
12:14 < rajkosto> because all connections to the ip the vpn is running on will go directly (nontunneled)
12:14 < rajkosto> otherwise you would have infinite tunneling
12:16 < s7r> thanks. i didn't have any doubts that on linux is possible i just wondered if i can on windows...
12:16 < s7r> i will do some more research bot not even google is my friend at this one :p
12:16 < s7r> can't find anything
12:16 < rajkosto> you have the additional trouble that you have only one ip
12:16 < rajkosto> so you would have to do some iptable MARK and policy routing business on the clients themselves
12:17 < rajkosto> so that 1194 udp goes untunneled, the rest toward that ip goes tunneled
12:17 < rajkosto> its just a very inpractical setup
12:17 < rajkosto> get another ip
12:17 < s7r> and if i get an additional ip address it will be easier ?
12:17 < rajkosto> yes ?
12:17 < rajkosto> because then you have an ip for the server, and one ip for the clients to SNAT to and DNAT from
12:18 < rajkosto> it means you dont have to do policy routing and packet marking on the clients 
12:18 < rajkosto> after that, if you can find a way to do SNAT and DNAT on windows, youre good
12:18 < rajkosto> !forward
12:19 < rajkosto> Muty, you need to enable forwarding, push redirect-gateway def1 to the clients you want to tunnel internt through vpn, and set up SNAT on the server
12:22 < s7r> thanks rajkosto you've been very helpful
12:23 < s7r> fortunately windows server distros have routing packet to do SNAT and DNAT
12:23 -!- troyt [~troyt@2001:55c:43a6:444b::1] has quit [Quit: AAAGH!  IT BURNS!]
12:23 < s7r> doing some reading now :D thanks again
12:23 < rajkosto> SNAT is so that the vpn clients can access the interet with their fake ips
12:23 < rajkosto> DNAT is so that the internet can access the fake ips on certain ports 
12:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:05 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:05 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
13:39 -!- Squidy_at_Home_ [~quassel@189.72.232.207] has joined #openvpn
13:40 -!- Squidy_at_Home [~quassel@187.53.137.55] has quit [Ping timeout: 250 seconds]
14:09 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
14:34 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
14:36 <@vpnHelper> RSS Update - forum: OpenVPN with PAM authorization in Ubuntu 11.04. <http://forums.openvpn.net/topic8193.html#p12433>
14:44 -!- Squidy_at_Home [~quassel@189.72.232.207] has joined #openvpn
14:46 -!- Squidy_at_Home_ [~quassel@189.72.232.207] has quit [Ping timeout: 250 seconds]
14:47 -!- WebDawgII [~whoami@officialg0d.com] has joined #openvpn
14:54 -!- Squidy_at_Home [~quassel@189.72.232.207] has quit [Remote host closed the connection]
14:55 -!- WebDawgII is now known as WebDawg
15:12 <@vpnHelper> RSS Update - forum: Help: AUTH_FAILED and remote authentication script issues. <http://forums.openvpn.net/topic8194.html>
15:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:02 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
17:04 -!- Squidy_at_Home [~quassel@189.72.232.207] has joined #openvpn
17:06 -!- Squidy_at_Home [~quassel@189.72.232.207] has quit [Remote host closed the connection]
17:07 -!- Squidy_at_Home [~quassel@189.72.232.207] has joined #openvpn
17:07 -!- Squidy_at_Home [~quassel@189.72.232.207] has quit [Remote host closed the connection]
17:09 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:46 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:49 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
17:53 -!- alan__ [~alan@204.95.39.19] has joined #openvpn
17:53 < alan__> i need help if anyone can do that
17:54 < alan__> !welcome
17:54 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:55 < alan__> !goal
17:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:55 < krzie> you're almost there!
17:55 < alan__> I just want to tether my android to my new Fedora OS
17:56 < krzie> tether, or connect to using openvpn?
17:56 < krzie> very different things, only 1 of which is on topic for here ;]
17:57 < alan__> as per http://code.google.com/p/azilink/
17:57 <@vpnHelper> Title: azilink - usb tethering application for android - Google Project Hosting (at code.google.com)
17:57 < alan__> I just dont know how to do it being a nubster at linux
17:58 < krzie> do you need help with openvpn?
17:58 < krzie> hehe
17:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:58 < alan__> I need help with installing it yes
17:59 < alan__> I'm not sure how to do tha
17:59 < krzie> also, i do wireless tethering for free on my android...
17:59 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:59 < alan__> My incredible 2 isn't and cannot be rooted :-s
17:59 < krzie> not sure why ild care about usb tethering, and especially unsure of why openvpn is used in this
18:00 < krzie> i can help you with the server side only
18:00 < krzie> i use openvpn on my android phones, but i do it correctly
18:00 < alan__> Is there a way to use wifi tether without rooting via linux?
18:00 < krzie> nope
18:01 < krzie> is you incredible 2 an HTC phone?
18:01 < krzie> if it is, i can unlock it ;]
18:01 < alan__> can you tell me how to share my phone's internet with the computer?
18:01 < krzie> as can others who have an XTC clip (~ $160 usd from hong kong)
18:01 < alan__> yes it is an HTC
18:01 < krzie> i know a guy who will unlock it for $20 plus shipping
18:02 < alan__> but that sounds VERY iffy
18:02 < krzie> its a hardware hack
18:02 < krzie> nah hes a trusted member of the XDA forums, very high karma therer
18:02 < krzie> there*
18:02 < krzie> and hes an op in #liberatedaria
18:02 < alan__> no im fine, i just want to be able to get internet through my phone
18:02 < raket> krzie: sounds like the guy that will solder a sim card slot and a second mini-pci-e slot directly on my planar.. :P
18:02 < krzie> he helped me use my new XTC clip to unlock my aria, which was unable to be unlocked through traditional software methods
18:03 < krzie> lol raket 
18:03 < krzie> raket, he has the same device as me
18:03 < krzie> but im not in USA, shipping to/from me would be a bitch
18:03 < krzie> its a hardware device for unlocking HTC phones
18:03 < alan__> ok thats fine, is there anyone here that can help me with sharing my phone's internet via something like PDAnet or Easytether?
18:03 < raket> haha ok nice
18:03 < raket> HTC? That's linux?
18:03 < krzie> HTC makes the phones
18:04 < krzie> android runs on many of them
18:04 < krzie> (windows mobile runs on others)
18:04 < alan__> ...
18:04 < krzie> xtcclip.com  thats the device
18:04 < raket> so, is andorid using the linux kernel?
18:04 < krzie> raket, yep its google's linux for phones
18:04 -!- alan__ [~alan@204.95.39.19] has quit [Remote host closed the connection]
18:05 < raket> krzie: but why is there tethering at all, i don't get it. why don't they just use ethernet on usb and set up routes directly?
18:05 < krzie> hes trying to bypass his phone companies tethering rules
18:05 < krzie> he can tether for a fee currently
18:05 < krzie> if he rooted his device he could do it free
18:06 < krzie> evidently theres some hack using openvpn to obtain free tethering as well
18:06 < krzie> but i REALLY dont get how they bust that without root...
18:06 < raket> krzie: yes, i use that as well
18:06 < raket> with link-mtu 1450 they wont charge me
18:06 < raket> =)))))))))))
18:06 < krzie> since you need root to a) run openvpn   or b) to modify the system to not need root to run openvpn
18:07 < raket> krzie: does the phone have a usb port?
18:07 < krzie> yes
18:07 < raket> if it does, they can probaly hack becaues it give dma access
18:08 < raket> sending bogus packets to the interface, which runs some code on it
18:08 < raket> s/interface/interface\/port/;
18:09 < raket> which is executed on the phone
18:10 < krzie> http://code.google.com/p/azilink/  thats what he was playing with
18:10 <@vpnHelper> Title: azilink - usb tethering application for android - Google Project Hosting (at code.google.com)
18:10 < krzie> after looking over the instructions im dumbfounded that he came here for help
18:11 < krzie> theres basically nothing to do with openvpn
18:11 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 264 seconds]
18:11 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
18:11 < krzie> *shrug*
18:11 < krzie> hows your awesome lil bonding project going?  did you make that forum post?
18:13 < raket> krzie: well, i gave up, i came to the conclusion i can use tc to limit the speed on the bonding interface or the ppp device or the tap device directly which will fix it
18:14 < krzie> thats what i was thinking too
18:14 < krzie> so did you do single file speed tests?
18:15 < krzie> i can make a 50MB.bin on a server for ya if you like...
18:20 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
18:20 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:25 < raket> krzie: well, if the modem actual have 2 cells in it with 7.2mbit on each it would go in 14.4mbit/s but that's most unlikely, i think they throttle traffic either on A) Layer1 B) Layer3. I'm still getting knocked of by the carrier all the time. the only way to around it to use link-mtu 1450 in openvpn, however i get about 300ms when i use that, but the 3g connection won't be knocked of the APN.
18:27 < raket> krzie: but lol
18:27 < raket> AziLink thing should work in windows as well
18:33 < krzie> "It's been tested on MacOS, Windows, and Linux."
18:35 < raket> krzie: the speed was about 500kb/sec
18:36 < raket> sorry, it smells like if there was a fire at the neighbour so i had to out and see for myself if there was a fire
18:36 < krzie> right, but are you sure it wasnt sending many small files as opposed to 1 large file?
18:36 < krzie> no worries, i pop in and out too
18:36 < raket> krzie: i downloaded ftp://ftp.sunet.se/ls-lR.gz 
18:37 < krzie> ahh perfect
18:37 < raket> krzie: but i have speed limits because L2TP is not enabled in the kernel.. =)
18:37 < raket> maybe.. :P
18:38 < raket> CONFIG_NET_SCH_TEQL option in kernel seems very interesting, however i've never played with QoS before
18:41 < raket> that was for REAL interace, i'm going to try eql now
18:41 < raket> documentation in .c file was very nice.
18:41 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
18:43 < krzie> what is the difference in ping to your vpn endpoint over each device?
18:43 < raket> krzie: it's the same on both both of them
18:44 < raket> but the ethernet emulation device never get's buffe errors
18:44 < krzie> thats weird...
18:44 < raket> why?!
18:44 < raket> it's the same link?
18:44 < raket> :P
18:44 < raket> with two public ipaddresses..
18:44 < raket> i don't get that anyway
18:44 < raket> sec
18:44 < raket> gonna proove it =)
18:45 < krzie> isnt 1 over ethernet and 1 over 3g?
18:45 < raket> haha no
18:45 < raket> both are over the same modem
18:45 < krzie> i dont have the link handy
18:45 < krzie> ohh
18:45 < raket> do you have a wwan modem?
18:45 < krzie> whys it even have 2 links to the uplink then?
18:45 < krzie> nope, i assumed it was one of those 3g adapters
18:46 < raket> oh, it's a real 3g modem in my machine
18:46 < raket> a mini-pci-e 
18:46 < krzie> ahh ok, so i was right then
18:46 < raket> brb
18:46 < krzie> ?
18:46 < krzie> k
18:46 < raket> you're gonna laugh of this =)
18:46 < raket> (just gonna set up the link)
18:46 < raket> takes some time because i have to setup many table in iproute etc
18:47 < raket> i'm on wlan0 now
18:47 < raket> gonna bring up wwan0 and ppp0 now
18:47 < krzie> may as well script it!
18:48 < krzie> if you arent handy in bash i could help, but im pretty sure you are since your setup is pretty advanced
18:49 < raket> well i already have a script for ppp0 and wwan0 operational but not for ppp0, wwan0 and wlan0
18:49 < raket> wlan0 sits in in main table now
18:49 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
18:49 < krzie> you're gunna bond all 3?
18:52 < raket> haha no
18:52 < raket> krzie: quick question
18:52 < raket> if i put ppp0 in table ppp and wwan0 in table wwan
18:52 < raket> should they be removed from the main table
18:52 < raket> or does'nt that matter at all?
18:52 < krzie> i have no clue man
18:53 < krzie> a lot of your setup is over my head and definitely interests me
18:53 < krzie> thats why i was pushing you to post on the forum about it, was hoping to see some good conversation on it so i could eavesdrop ;]
18:54 -!- raketwlan0 [~raket@c83-250-152-131.bredband.comhem.se] has joined #openvpn
18:55 -!- raketppp0 [~raket@m83-178-153-121.cust.tele2.no] has joined #openvpn
18:55 < raketwlan0> WTF??????????????
18:55 < raketwlan0> .NO?????????
18:55 < raketwlan0> HAHAH
18:56 < krzie> hah
18:56 < raket> hahahahahahaha
18:56 < raket> awesome
18:56 < krzie> thats crazy
18:56 < raket> IM DEFENTLY SCHIZOPHRENIC FOR REAL!
18:56 < krzie> and cool
18:56 < raket> NOW IM NORWEGIAN AND SWEDISH AT SAME TIME HAHAHA
18:58 < raketwlan0> hahahahaha
18:58 < raketwlan0> ok, the isp spoofs, that's crazy man
18:58 < raketwlan0> to another country. this is the best isp ever
19:00 < krzie> maybe only some addresses in the dynamic range pop out as .no
19:00 < krzie> how far are you actually from .no?
19:01 < krzie> maybe you're actually on a tower in .no?
19:03 < raketwlan0> im in stockholm
19:03 < raketwlan0> i can't find the gateway for wwan0
19:04 < raketwlan0> PING 77.218.39.131 (77.218.39.131) from 77.218.39.133 wwan0: 56(84) bytes of data.
19:04 < raketwlan0> 64 bytes from 77.218.39.131: icmp_req=1 ttl=68 time=571 ms
19:04 < raketwlan0> but it does not wanna route me through
19:06 < raketwlan0> brb
19:08 -!- raketwwan0 [~raket@m77-218-39-133.cust.tele2.se] has joined #openvpn
19:08 < raketwwan0> there it came =)
19:08  * raketwwan0 slaps krzee 
19:08  * raketppp0 slaps krzee 
19:08  * raketwlan0 slaps krzee
19:09 < krzie> heh
19:10  * krzie helps krzee right off agent raket-smith
19:10 < raketwlan0> this is just fucking amazing 
19:10 < raketwlan0> .no adress. that's fucking awesome!
19:10 < raketwlan0> now i don't need to tunnel
19:10 -!- raketwlan0 [~raket@c83-250-152-131.bredband.comhem.se] has quit [Quit: Lost terminal]
19:10 < raketppp0> :PP
19:11 < krzie> im still interested in the fact that you gained single file xfer speed while bonding
19:11 < raketppp0> krzie: haha why?
19:11 < krzie> since its known you cant really do that...
19:11 < raketppp0> why?!
19:11 < krzie> (people dont usually force it to the same external server first by using openvpn)
19:11 < krzie> i had never thought of doing that, pretty damn cool
19:12 < raketppp0> krzie: the server on the other side does the same thing
19:12 < raketppp0> =))
19:13 -!- raketeth0 [1000@c-f296e253.06-229-73746f13.cust.bredbandsbolaget.se] has joined #openvpn
19:13 < krzie> BBB!
19:13 < raketppp0> yeah but look at this =)
19:13 < krzie> <3 that isp
19:14 -!- raketeth1 [1000@c-af99e253.06-229-73746f13.cust.bredbandsbolaget.se] has joined #openvpn
19:14 < raketppp0> :DDDDDDDDDDD
19:14 -!- raketwwan0 [~raket@m77-218-39-133.cust.tele2.se] has quit [Ping timeout: 264 seconds]
19:15 < raketppp0> krzie: the both of those ip adresses have 10mbit upstream
19:15 < raketppp0> so i'm really thinking about to bond all the bbb ips as well to gain 75mbit/s upstream
19:16 -!- raketeth1 [1000@c-af99e253.06-229-73746f13.cust.bredbandsbolaget.se] has quit [Client Quit]
19:16 -!- raketeth0 [1000@c-f296e253.06-229-73746f13.cust.bredbandsbolaget.se] has quit [Client Quit]
19:16 -!- raket [~raket@roker.ganjah.se] has quit [Quit: .no owns everything]
19:17 -!- raketppp0 is now known as raket
19:17 < raket> defently gonna use this spoof =))
19:22 < raket> krzie: could'nt you just include bonding directly in openvpn, that would be awesome
19:22 < raket> so it splits the packet across two tap devices on the client
19:22 < raket> or two = N where N is number of interface the client connects from
19:24 < krzie> that sounds a lot like when people ask if it could do NAT
19:24 < krzie> (already exists in the OS, not openvpn's job)
19:25 < krzie> with that said, if you are a dev you could certainly add that
19:25 < krzie> if that is the case, #openvpn-devel would be a good place to hang
19:26 < raket> krzie: how do you mean?
19:27 < raket> if client have N devices and connect with them all, the server could bring up N devices on the server, and start bonding on both server/client, or teql
19:27 < krzie> oh
19:27 < krzie> you could do that in a script
19:27 < krzie> !scripts
19:27 < krzie> !script
19:27 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
19:29 < raket> krzie: well, routing have to bet setup correctly on the client
19:30 < raket> with multiple tables and nothing at all in the main table
19:31 < krzie> scriptable!
19:33 < raket> well this will probably not work in any other os then linux at all
19:34 < krzie> why wouldnt it work in BSD?
19:34 < raket> krzie: but would script it if you wish, dhcpcd and dhclient must be cut of though, udhcpc is the most scriptable dhcp client out there which can put each device in it's own table by scripting, dhcpcd is not capable of that at all
19:34 < raket> krzie: well it would ofcourse
19:34 < raket> but not in windows though
19:34 < krzie> oh right
19:35 < krzie> it would work in osX as well
19:35 < krzie> so really just windows couldnt
19:35 < krzie> !windows
19:35 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
19:44 < raket> krzie: well it might work in windows
19:44 < raket> because there's actual tap devices there as well
19:44 < raket> if we set same hw addr on all tap devices on the server and same ip on them
19:44 < raket> the windows machine would route through all interfaces probably
19:44 < raket> =))
19:48 -!- raket [~raket@m83-178-153-121.cust.tele2.no] has quit [Quit: Reconnecting]
19:49 -!- raket [raket@m83-178-153-121.cust.tele2.no] has joined #openvpn
19:52 < raket> krzee: the .no link seems very stable, like 65-70ms in ping now
19:54 < raket> if i always get .no adress i gladly pay for it.
19:54 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
19:56 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
19:56 -!- Cain` is now known as Cain
19:57 < krzie> windows has bonding?
19:57 < krzie> (i dont use windowS)
19:59 < raket> no but it will probably nat through all interfaces randomly if all the tap devices on the other side of the link have the same ipadress and hw addr
19:59 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:00 < raket> krzee: otherwise they could MLPPP over N number of tap devices to the openvpn server, but it seems really ugly
20:01 < raket> krzee: haha, they can use RIP routing protocol...
20:10 -!- master_of_master [~master_of@p57B57C30.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:12 -!- master_of_master [~master_of@p57B52FFB.dip.t-dialin.net] has joined #openvpn
20:13 -!- xsurfer [48143ae9@gateway/web/freenode/ip.72.20.58.233] has joined #openvpn
20:16 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:19 < xsurfer> my tun tap device is not available? how can I install it?
20:19 < xsurfer> no device found it says
20:21 < xsurfer> help
20:21 < xsurfer> help
20:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:26 < xsurfer> help help help help help help 
20:28 < krzie> lol
20:28 < krzie> what OS
20:29 < xsurfer> krzie: centos. when I try to install like yum -y install kernel-utils, it will say, cannot install due to repository protection. thus not installed.
20:30 < xsurfer> huhuhuhu :)
20:31 < krzie> !notovpn
20:31 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
20:32 < krzie> yes, tun is used by openvpn, but you need help from #centos
20:33 < xsurfer> ok I thought tun/tap is part of openvpn
20:33 < krzie> only in windows
20:33 < xsurfer> :(
20:33 < krzie> in linux its part of their kernel (or a module)
20:34 < krzie> in fact tun existed in linux before openvpn existed
20:48 -!- xsurfer [48143ae9@gateway/web/freenode/ip.72.20.58.233] has quit [Ping timeout: 252 seconds]
20:54 -!- piyokos [~dave@67-231-249-77.STATIC.turnkeyinternet.net] has joined #openvpn
21:06 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:01 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
22:04 -!- Sky[xx] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 264 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:46 -!- maxagaz [~maxagaz@114.243.115.156] has quit [Ping timeout: 240 seconds]
22:55 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:56 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:35 < Proz01d> krzie!!! buddy... thanks for all your help
23:35 < Proz01d> everything is running nicely
23:44 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
23:45 < B|aster> hey if I setup a linux server with openVPN  can I connect to that server with my iphone and browse as if i'm in the server's location?
23:47 < Proz01d> need some advice.  i want to have a secure authentication architecture but will need to have the new account creation process be automated.  I'm just wondering if i should be using certicates (currently the only form of auth i have) and if it's oaky to have the server generate all the certs
23:47 < Proz01d> for users to download
23:48 < Proz01d> B|aster: yes. i think....not sure if ssl will work 
23:48 < Proz01d> and you will need to use user/pass
--- Day changed Sun May 22 2011
00:15 < krzee> Proz01d, yw
00:16 < krzee> i do not consider having your server having the ca.key on it being very secure
00:16 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
00:31 < Proz01d> yeah i'm planning on removing it
00:31 < Proz01d> and following the steps in the hardening guide
00:32 < Proz01d> where should i put this directive chroot jail
00:32 < Proz01d> should it be in the server.conf?
00:35 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
00:40 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 246 seconds]
00:47 < krzee> !--
00:47 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
00:47 < krzee> !man
00:47 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
00:50 < B|aster> on the iphone i have to sleect either L2PT, PPTP, or IPSec for VPN config.  Which would openVPN be?
00:50 < B|aster> s/sleect/select
01:01 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
01:01 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:03 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has quit [Ping timeout: 248 seconds]
01:04 < krzee> if he comes back
01:04 < krzee> !iphone
01:04 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
01:04 <@vpnHelper> iPhone and iPad.
01:06 < Proz01d> krzee my goal is to have a vpn service so i'm wondering how you typically provision user access?
01:06 < Proz01d> and what you guys use for user repositories
01:07 < krzee> !dazo
01:07 <@vpnHelper> "dazo" is "eurephia" is http://www.eurephia.net/
01:07 < krzee> thats what ild look into using methinks
01:13 -!- B|aster [~Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
01:13 < krzee> B|aster, 
01:13 < krzee> !iphone
01:13 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
01:13 <@vpnHelper> iPhone and iPad.
01:14 < Proz01d> can you prevent simultanous logins with it? (basically want to avoid having 1 account be shared with multiple ppl)
01:15 < Proz01d> from different loCATIONS
01:17 < krzee> just dont allow duplicate cert logins
01:17 < krzee> !duplicate
01:17 <@vpnHelper> "duplicate" is the option duplicate-cn is for allowing the same cert to login more than once. It should not be used in most situations, with main exceptions being if you also use !authpass or if just testing
01:18 < krzee> when #2 logs in he will disconnect #1
01:18 < krzee> if they both are set to keep reconnecting, they will continue bumping eachother off as keepalive catches each
01:19 < Proz01d> nice!
01:21 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Operation timed out]
01:21 < Proz01d> any other user man engines you would recommend?
01:22 < Bushmills> yes, ompi.  
01:22 < Bushmills> organic man page interpreter
01:22 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has joined #openvpn
01:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 244 seconds]
01:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:07 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
02:11 -!- Blaster [Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
02:12 -!- B|aster [~Baster@S0106001b1162347e.ok.shawcable.net] has quit [Ping timeout: 240 seconds]
02:16 -!- Blaster [Baster@S0106001b1162347e.ok.shawcable.net] has quit [Ping timeout: 260 seconds]
02:28 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
02:33 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:56 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
03:00 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 246 seconds]
03:06 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:05 -!- luneff [~yury@84.51.197.177] has joined #openvpn
04:20 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
04:31 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12435>
04:47 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 250 seconds]
04:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
04:58 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
04:58 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
04:58 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
04:58 -!- Rajko [~rajkosto@2001:5c0:1511:4e02:699b:3394:b08e:a55c] has joined #openvpn
05:02 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 260 seconds]
05:13 <@vpnHelper> RSS Update - forum: Please Help me Multi-Server Tutorials here <http://forums.openvpn.net/topic8195.html>
05:19 < phaidros> does openvpn always give the same IP to the same clientcert?
05:19 < phaidros> (testing with 2 clients here seems to support this)
05:24 < phaidros> hm, if I want a shared secret (static.key) I cannot use tun, I cannot use server mode .. so, with --secret is it possible to server dynamic IPs from a range to clients?
05:24 < phaidros> getting: Options error: --ifconfig-pool/--ifconfig-pool-persist requires --mode server
05:43 < phaidros> ok, in the leases file the client name from a cert is associated to a IP. is it possible to assign IPs on macadresses instead of names?
05:44 < raket> that's reall a stupid idea as it would be possible to spoof the ip adress..
05:45 < phaidros> (eg. if I want to hand out an image with openvpn, I will get the same image with the same shared secret on every instance, so I am looking for a way to have a generic conf to which gives each client a unique adress ..)
05:46 < phaidros> otherwise I would have to do generate a random IP, setup a static key bases vpn, connect the server, let the server create a new client cert, config the certbased vpn and start that up ..
05:46 < phaidros> which I feel is not KISS
05:47 < raket> are you using preshared keys or certifacts?
05:47 <@vpnHelper> RSS Update - forum: Low speed with tcp proto <http://forums.openvpn.net/topic8196.html>
05:48 < phaidros> raket: the same cert on all machines does obviously not work, as all machines will  get the same ip (and securiry wise it is not htat clever as well, but is ignoreable in the scenario), thats why I was thinking about static.key, but cant get the dynamic IP serving running with a static.key ..
05:49 < phaidros> is there a way to offer a range of IPs to clients dynamically with a shared secret?
05:52 < phaidros> raket: any ideas?
05:56 < phaidros> ok, I put the question differently: how to clone a client config, but get another IP from a range from the openvpn server, when using that cloned config on another machine?
05:59 < phaidros> only useful option I was thinking about is basing the IP on the tap-devices mac, which is random imho
05:59 < raket> phaidros: i never used the server/client topolgy of openvpn nor am i affilated with openvpn at all, and have no knowledge of that. when i worked at prq.se i used preshared keys, which was encrypted and sent to the customer with GPG. We used p-t-p topolgy and tap devices and gave the customer a static public routeable adress which they set in their configfile. we did not push this public ip adress on every connection to the openvpn at our end. if
06:02 < raket> i'm not sure at all if the server/client topology supports static ipadresses at all
06:02 < raket> consult the man files
06:02 < raket> and the forum
06:04 < phaidros> just reading up on topoloty 'subnet'
06:05 < raket> ah, i meant subnet on tapdevice not p-t-p topology
06:05 < raket> my bad, sorry
06:07 < phaidros> ah k
06:07 < raket> phaidros: are you intended to use tun or tap
06:08 < phaidros> raket: I dont care which of both, I just know, that with any server directive I need SSL/TLS and therefore clientcert, which, being cloned will result with the same IP on every client
06:09 < phaidros> so I intended to look into static keys / secret, which requires tun. but: --server and --secret cannot be used together
06:09 < raket> why do you need the server option at all?
06:10 < raket> because you want TLS/SSL and a preshared key? :)
06:11 < phaidros> I need *any* option (which I am happy to know which it is) to server a subnet of IPs to connecting clients ..
06:11 < phaidros> :)
06:11 < phaidros> s/server/serve)
06:11 < phaidros> client connects with preshared key, gets IP from ovpn server .. all I see in the docs this is usually with certs
06:12 < raket> do you want the client ip's to be static
06:12 < phaidros> at least sticky
06:12 < phaidros> after a timout of days unused they coulb be flushed
06:12 < raket> ok
06:13 < phaidros> hm, I check p2p now
06:14 < raket> p2p is only supported by linux, not windows =)
06:14 < phaidros> how do I config an IP range in p2p mode?
06:14 < phaidros> yeha, just read that, but fortunately my hundreds of virtual machines will all be linux :D
06:16 < phaidros> docs say p2p: This mode allocates a single IP address per connecting client.
06:16 < raket> phaidros: with p2p mode you run one openvpn process per client/server on both ends. however. on the server end the gateway can always be the same. if using tun. this is because it's a real ppp link. 
06:17 < phaidros> allocating one ip per client at the server?
06:17 -!- cpm [~Chip@64.134.240.43] has joined #openvpn
06:17 -!- cpm [~Chip@64.134.240.43] has quit [Changing host]
06:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:18 < raket> phaidros: you don't allocate anything in the server at all
06:18 < phaidros> hm.
06:19 < raket> sec
06:19 < raket> you put 
06:19 < raket> ifconfig 10.0.0.1 10.0.0.2 in the "server" config
06:19 < phaidros> thats static, but what do cloned client configs get?
06:19 < raket> and ifconfig 10.0.0.2 10.0.0.1 
06:19 < raket> in the client
06:20 < phaidros> all with that cloned config will be 10.0.0.2
06:20 < raket> no
06:20 < phaidros> no?
06:20 < raket> each server config file can have ifconfig 10.0.0.1 10.0.0.x
06:20 < raket> and each client config file can have ifconfig 10.0.0.x 10.0.0.1
06:20 < phaidros> *can* have
06:21 < phaidros> thanx alot for trying raket, but I need a generic config :/
06:21 < raket> ok
06:21 < phaidros> as I the complete linux machine will be cloned and should work without any tweaking
06:21 < phaidros> I cant edit > 150 VMs on USB sticks :)
06:22 < raket> you can easly generate 1000000000 config files on "server" and "client"
06:22 < phaidros> raket: hm, okay, but which is used on which client then?
06:23 < raket> honestly, the generic way is better to go. all vms needs a openvpn p2p to be run on top of the server and one on the client
06:23 < raket> it's just to much to play with
06:23 < raket> anyway, gotta go now. be back in an hour or so. i'm interested in this as well. so let's share our experience here =)
06:24 < raket> server.conf: ifconfig 10.0.0.1 10.0.0.2
06:25 < raket> client.conf: ifconfig 10.0.0.2 10.0.0.1
06:25 < phaidros> :)
06:25 < raket> not that you can have server1-9999.conf with ifconfig 10.0.0.1 10.0.0.x  
06:25 < phaidros> sure
06:25 < raket> and client1-9999.conf with ifconfig 10.0.0.x 10.0.0.2
06:25 < phaidros> which is fired up on the client? some random mechanism tho ..
06:26 < raket> you have one openvpn process running on the server for each vm and one in each vm. but the generic way is way better.
06:26 < raket> gotta go
06:26 < raket> bbl 1hour
06:27 < phaidros> thx, cu
06:35 < raket> phaidros: anyway, server.conf: ifconfig local dest 
06:35 < phaidros> do clients using the same certificate always get the same ip from openvpn server?
06:35 < phaidros> or is it just a bug here?
06:36 < phaidros> s/bug/misconfig/
06:36 < raket> phaidros: loacal adress of the tun link on the server really don't matter at all as it's p-t-p and not ethener
06:38 < raket> you can do on the client: ip route add default dev tun0 directly becaues the "local" field in the server.conf is just a p-t-p ip. and the "dest" in the client.conf is just a dest ip. it can be same across all client.conf/server.conf. and you can route directly through the device in the vm and does not need to give an "via ip" as it's ppp and not a gateway
06:38 < raket> for the last time. bye. bbl 1 hour
06:49 < phaidros> anybody: is it common that openvp always gives out the same IP for the same cert ?
07:12 < phaidros> well, duplicate-cn ...
07:12 < phaidros> now it works
07:16 < phaidros> darn
07:17 < phaidros> ok, now the tricky part, how to make IP addresses persistent with duplicate-cn ?
07:26 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
07:43 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:24 < Rajko> how about not using duplicate cn ?
08:24 < Rajko> you can use ip pool persist txt file
08:39 < phaidros> raket: I need duplicate-cn because of a cloned config on vertual machines. the ippool persist file relays to the name in the cert, right?
08:39 < phaidros> cant openvpn relate to the mac address of the generated tap e.g. ?
08:39 < phaidros> that'd be way better :)
08:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
08:57 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Operation timed out]
09:01 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has quit [Ping timeout: 241 seconds]
09:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:14 < raket> is it possible to use static key with server option? i don't want ssl/tls at all. and i want an option which binds N number of tap device directly to a teql device or bonding device.
09:14 < raket> that would be fucking amazing
09:15 < raket> sorry bad language =)
09:15  * raket opens the openvpn book
09:20 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12438>
09:22 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
09:22 -!- mode/#openvpn [+o mattock] by ChanServ
09:26 <@vpnHelper> RSS Update - forum: Low speed with tcp proto <http://forums.openvpn.net/topic8196.html#p12439>
10:31 < Bushmills> raket, yes, with N instances of openvpn, each with one static key to one client
10:32 < Bushmills> though no "server" there. that's N times point to point
10:34 < raket> exactly
10:34 < raket> thanks for clarifaction. server.conf was refered was run on the "server" but that was not explicit defined.
10:41 -!- luneff [~yury@84.51.197.177] has joined #openvpn
10:52 -!- mistergibson [~mistergib@174-25-174-151.ptld.qwest.net] has joined #openvpn
10:55 < mistergibson> I'm looking for a how-to on routing datagrams to a services virtual:interface post-decryption, and then wanting to route the datagram back via the openvpn server.
10:55 < mistergibson> anyone got a url covering the basics of that?
10:55 < mistergibson> probably with iptables
11:01 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit []
11:04 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
11:04 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
11:04 -!- raidz [~raidz@46-105-63-15.kimsufi.com] has quit [Changing host]
11:04 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:04 -!- mode/#openvpn [+o raidz] by ChanServ
11:11 < rkantos> any idea why my openvpn performance is 10% of my internet speed?
11:11 < rkantos> squid proxy on the same server works at 100% speed
11:12 < raket> rkantos: are you utilizing udp or tcp in the openvpn connection
11:13 < rkantos> udp
11:13 < rkantos> though i just tried it with tcp
11:13 < rkantos> http://pastebin.com/kDsCCXvX there's my conf
11:13 < rkantos> i've used the same conf on another virtual server, but when i changed the provider it got slowed down
11:14 < raket> then the new provider probably sucks
11:14 < rkantos> and as squid "says" it should work full speed ^^
11:14 < raket> is it faster when you use tcp?
11:14 < rkantos> i have monitored the speed on the server both with squid and openvpn
11:14 < rkantos> raket: no
11:14 < Bushmills> !tunortap
11:14 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:14 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
11:16 < raket> rkantos: did you speedtest directly from the new provider to the destination server?
11:16 < raket> (without openvpn)
11:17 < rkantos> destination server?
11:17 < rkantos> i can upload and download from this client to the new VPS at 10/10
11:17 < rkantos> which is my maximum internet speed
11:18 < rkantos> but openvpn only gets 0.5/6-8
11:18 < rkantos> upload is quite normal ^^
11:21 < raket> hmm? a tap/tun device in a vps. why would you wanna use that at all. whatif the main vps gets hacked?
11:22 < mistergibson> !iptables
11:22 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z, or (#2) please see http://openvpn.net/man#lbBD for more info, or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
11:24 < rkantos> raket: what you mean by hacked?
11:24 < raket> nvm
11:26 < raket> rkantos: what if the throttled the vpn-traffic? did you check your iptables rules?
11:27 < rkantos> raket: hmm...
11:28 < rkantos> atleast I haven't added any throttling rules to iptables
11:28 < raket> did you try without encryption?
11:29 < rkantos> yup
11:29 < raket> same thing there? :o
11:29 < rkantos> at speedtest.net it seems to take a long time before the test begins... upload test begins much faster
11:30 < raket> did you speedtest with torrent?
11:32 < rkantos> not yet
11:34 < raket> i guess you won't be running speedtest.net all day, if torrenting works at fullspeed will that fullfil your requirements, or do you want speedtest.net to explicit report 10/10 as well?
11:34 < rkantos> well hmm
11:34 < rkantos> raket: well i want flash doing 10/10
11:35 < rkantos> but yeah.. torrent works at fullspeed
11:35 < raket> so.. the conclusion is that udp-traffic won't work at 10/10mbit
11:35 < rkantos> though im not convinced it is going trough openvpn
11:36 < rkantos> resource monitor says so though
11:38 -!- Adde_BC [~AddeBC@c193-150-233-51.bredband.comhem.se] has quit [Read error: Connection reset by peer]
11:39 -!- Addemanne [~AddeBC@c193-150-233-51.bredband.comhem.se] has joined #openvpn
11:41 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
11:44 < rkantos> raket: but with same config it has worked 10/10?
11:44 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:47 < raket> rkantos: on another vps provider or a real machine on acting as the thing you route your traffic through
11:48 < raket> ?
11:48 < rkantos> another vps prov
11:49 < rkantos> only mature difference in that config is the user authentication bit
11:49 < rkantos> where it doesnt use a user cert or whatever
11:49 < rkantos> server key*
11:50 < rkantos> /etc/pam.d/login 
11:52 < raket> rkantos: try using tcp as proto in openvpn, then try to download something through the openvpn route from a fast ftpserver. 
11:52 < raket> and do the same thing with proto udp, and see if it makes any difference
11:53 < rkantos> with which should it be slower?
11:55 < rkantos> http://ftp.funet.fi/pub/linux/mirrors/ubuntu/releases/10.04.2/ubuntu-10.04.2-desktop-i386.iso
11:56 < rkantos> does that qualify as a fast dl?
11:56 < rkantos> hmm.... now i'm getting download speeds that exceed my internet haha
11:57 < rkantos> but 3.8/7.8 i tested when having TCP
11:57 < rkantos> as proto
11:58 < rkantos> 6.5/8
11:58 < raket> rkantos: are you going to utilize fullduplex udp traffic which is 10/10mbit? if you are, you should really talk to the vps provider, if not you should not.
11:59 < rkantos> hmm?
11:59 < rkantos> i dont understand
12:00 < rkantos> if you are talking about limits and quota, 1/1Gb/s port, with 2TB limit
12:01 -!- luneff [~yury@84.51.197.177] has joined #openvpn
12:01 < raket> so you have 1gbit fullduplex at home with 2tb limit?. so you could actual get 1000mbit/s both and upload on speedtest.net?
12:02 < rkantos> at home i have 10/10, on the vps 1000mbit/s
12:02 < rkantos> at home no limit, vps has a 2tb limit
12:04 < raket> so, i rephrase, are you going to use 10/10mbit fullduplex udp data from home over the vpntunnel?
12:05 < raket> nothing else then speedtest.net actual do that. i would be really suprissed if a speedtest site used tcp at all
12:06 < rkantos> hmph... basically I want to stream silverlight video at 5-8Mbit/s
12:09 < raket> rkantos: if you use home <--> vps <--> inet and it's udp all the way it's possible packets drops. and the nature of udp is to not resend and to just continune sending/reciving. with tcp it will resend the packet and you will get more throughput. nothing where data matters besides speedtest.net use udp at all, and silverlight will probably buffer the stream, so that would'nt be a problem. it's maybe so that the silverlight video uses tcp, but tha
12:10 < rkantos> it's a problem, because it will be buffering all the time then
12:10 < raket> not if you change the buffersize
12:10 < rkantos> but then i'd be miles of the live coverage :D
12:11 < raket> are you sure that silverlight use udp at all?
12:12 < raket> rkantos: oh, are you broadcasting udp silverlight when watching another silverlight stream at the same through the tunnel? 
12:12 < raket> in that case it really makes sense
12:12 < rkantos> :D, no i haven't got to broadcasting
12:12 < rkantos> just trying to watch a stream from eurosport
12:13 < rkantos> it only takes like 4mbit/s of bandwidth.. but still wont work
12:15 < rkantos> i'm testing 1080p on youtube.. it dloads at nearly fullspeed
12:16 < rkantos> 8.5mbit/s
12:17 < rkantos> youtube is all TCP isin't it?
12:17 < raket> 18:58 < rkantos> 6.5/8
12:18 < raket> was this on the vps our your machine?
12:18 < raket> and was does it mean? upload/download speed?
12:20 < rkantos> dl/ul
12:20 < raket> on the server? 
12:21 < rkantos> 6.5/8 was home -> server via openvpn -> inet
12:21 < raket> with what protocol?
12:21 < rkantos> but now i think it did not go trough openvpn
12:21 < rkantos> TCP
12:21 < raket> are you sure it was TCP?
12:21 < rkantos> yes
12:22 < raket> full duplex ftp connections or something?
12:22 < rkantos> but the test has no importance
12:22 < rkantos> it was speedtest.net still :P
12:22 < krzee> heh
12:22 < krzee> iperf
12:26 < raket> rkantos: are you using windows or linux?
12:26 -!- B|aster [~Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
12:26 < rkantos> windows
12:27 < rkantos> and linux :P
12:27 < rkantos> server is ubuntu
12:29 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:29 < raket> rkantos: please  be a bit more specific, i don't really understand if that means that you have windows and linux on your machine and ubuntu as server
12:30  * krzee assumes win client, lin server
12:30 < raket> krzee: yeah me2
12:30 < rkantos> krzee is right
12:30 < rkantos> you can't really watch silverlight with ubuntu can ya?
12:31 < rkantos> but yeah.. openvpn is on a ubuntu 10.04 server
12:35 < rkantos> i just dont get this
12:35 < rkantos> with TCP it's 4/1
12:35 < rkantos> with udp its 1/6
12:36 < raket> rkantos: sorry man, there's really nothing you can do then to complain to your vps provider that udp packets gets loss over the internet between you and them. however, that's really out of their control so it makes no sense to complain. however, if you have time, you could bring up a vmware machine in windows and bind your network card directly to the virtual linux machine. in the virtual linux machine you could then setup a huge number of openv
12:37 < rkantos> raket: but if i used tcp succesfully on the other vps provider?
12:37 < rkantos> though can't remember if it was TCP
12:37 < rkantos> atleast the dev was tap
12:37 < raket> rkantos: the old vps has nothing todo with your new vps
12:38 < rkantos> but TCP pakets should not 'get lost'?
12:38 < raket> silverlight is not tcp if it's a livestream
12:38 < rkantos> are you sure?
12:39 < raket> but it makes no sense if it is or not
12:39 < raket> if you have bad speed between your line and your vps, it will suck anyway.
12:39 < rkantos> hmm?
12:39 < rkantos> but still
12:39 < rkantos> my squid proxy works well
12:39 < raket> did you even read what i wrote?
12:39 < rkantos> and it's on the same server
12:39 < rkantos> i did
12:41 < raket> so, what does the squid proxy do? do you use that as a http proxy for your workstation when routing through the vpn?
12:42 < rkantos> i use the squid proxy for the same purpose
12:42 < rkantos> streaming.. But the silverlight site still detects my original IP, so I have to use openvpn
12:42 < rkantos> vpn
12:43 < rkantos> ./vpn*
12:43 < raket> where is this squid proxy running 
12:43 < rkantos> on the same vps beside openvpn
12:44 < rkantos> tap/tcp... now i seemed to get 6.5/2 again hmm
12:44 < rkantos> upload is definitely better with tap/udp
12:45 < rkantos> but now second test it's down to 2.3/0.5 :S
12:45 < raket> rkantos: flash don't use a http proxy at all. it will make a direct connection.  
12:45 < raket> rkantos: and that speedtest.net is between you and the speedtest.net server, not through some proxy
12:46 < raket> if you use the squid.. :o
12:46 < rkantos> well well.. i just want to bypass restrictions :;D
12:46 < rkantos> BBC works fine with squid only.. it works with openvpn too
12:47 < rkantos> the silverlight stream does not work with squid
12:47 < rkantos> ./it detects me in the country A
12:47 < rkantos> while I "want to be" in country B
12:48 < Bushmills> !redirect
12:48 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
12:48 < rkantos> push "redirect-gateway def1" #bypass-dhcp
12:49 < rkantos> that line i have already
12:49 < raket> you are proxying through the squid, if you open a webpage with a proxy and a flash site opens in your browser windows it will bypass the proxy because that's not a tcpconnection. it will connect directly to your real machine. flash is not a http protocol and the flash is a plugin for your browser. you have no idea what you are doing when you are using 3rd part plugins in your browser.
12:49 < rkantos> everything detecting wise works with openvpn.. the speed just ain't right
12:49 < Bushmills> rkantos: there are three steps involved in !redirect, not one
12:50 < Bushmills> possible four in case you need to take care of your resolver
12:50 -!- Rajko [~rajkosto@2001:5c0:1511:4e02:699b:3394:b08e:a55c] has quit [Read error: Operation timed out]
12:50 < rkantos> Bushmills: but how does that relate to the low speed of the vpn tunnel?
12:51 < raket> Bushmills: what does the redirect directive do in windows?, does it add a 128.0.0.0/0 and 0.0.0.0/0 route through it?
12:51 < rkantos> !ipforward
12:51 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
12:51 < krzee> raket, if you use def1, yes
12:51 < krzee> !def1
12:51 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
12:51 < Bushmills> not at all. it relates to " bypass restrictions" and "I "want to be" in country B"
12:51 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
12:51 < krzee> oh no not /0, you meant /1
12:52 < raket> krzee: yes
12:52 < rkantos> Bushmills: but the "being in country B" bit works fine ;)
12:52 < Bushmills> raket: that's what def1 does
12:52 < rkantos> with openvpn I mean.
12:53 < rkantos> Bushmills: IP is the same as with the server in country B
12:54 < rkantos> There just ain't enough speed 
12:54 < Bushmills> !tunortap
12:54 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
12:54 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
12:54 -!- bitrot [~rajkosto@2001:5c0:1511:4e02:699b:3394:b08e:a55c] has joined #openvpn
12:54 < krzee> you're using tap?
12:54 < rkantos> tap/tcp in use atm
12:55 < krzee> lol
12:55 < krzee> well ya
12:55 < raket> rkantos: there's nothing you can do. if you use proto udp on your client/server then speed will be limited if the datatransmission between you and the openvpnserver gets lost. on the other hand, if you use proto tcp on server/client, and putting a udp-stream within that, it will still buffer alot since the tcpstream between workstation<--->vps will be retransmitted really much.
12:55 < rkantos> dev = tap, proto = tcp
12:55 < krzee> udp tun should be better
12:55 < krzee> !tcp
12:55 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
12:56 < rkantos> krzee: but it's slower.. i've tried it :)
12:56 < krzee> and then test your MTU if needed by adding mtu-test to a client
12:56 < rkantos> upload seems to work a lot better with tun/udp
12:56 < rkantos> but i dont really need the upload
12:56 -!- K1ng [~KING@180.211.188.225] has quit [Ping timeout: 240 seconds]
12:57 < rkantos> krzee: MTU MTU? what where? :P
12:57 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 244 seconds]
12:57 < rkantos> i can only join jumbo frames and MTU
12:58 < rkantos> is there a default MTU size in openvpn or something?
12:58 < krzee> !mtu
12:58 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
12:58 < krzee> #1
13:00 -!- K1ng [~KING@180.211.188.225] has joined #openvpn
13:01 < rkantos> so i can use that like:
13:01 < rkantos> comp-lzo
13:01 < rkantos> --mtu-test
13:01 < rkantos> ?
13:02 < krzee> !--
13:02 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
13:03 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:11 < rkantos> should i be tcpdumping venet0:0/eth0 or tap/tun?
13:11 < Bushmills> depends on what you want to see
13:13 < krzee> first is the outside of the tunnel, second is the inside...
13:13 < krzee> encrypted, cleartext
13:13 < krzee> is decapsulated a word?
13:14 < rkantos> never easy this...
13:14 < rkantos> tcpdump: pcap_loop: corrupted frame on kernel ring mac offset 94 + caplen 1042 > frame len 160
13:14 < rkantos> meh?
13:14 < Bushmills> decaffeinated is one
13:14 < krzee> yes but it shouldnt be!
13:16 < rkantos> i must also admit that i'm getting crazy pings
13:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
13:26 -!- bitrot [~rajkosto@2001:5c0:1511:4e02:699b:3394:b08e:a55c] has quit [Ping timeout: 264 seconds]
13:30 < rkantos> enough for today lol
13:52 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
14:19 < raket> !server
14:20 < raket> !help
14:20 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
14:20 < raket> !multiserver
14:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:22 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
14:27 < krzie> !factoids search server
14:27 <@vpnHelper> 'servercert', 'access-server', and 'serverlan'
14:27 < krzie> or
14:28 < krzie> !factiods
14:28 < krzie> !factoids
14:28 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
14:36 < raket> krzee: i'm a bit lost here, if i use server/client mode, will the server actual put up more tap devices for each client when it connects?
14:37 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:44 < s7r> krzie: how can I assign a STATIC & Dedicated IP to one of the clients (vpn servers does SNAT and gives clienst ips from the pool 10.8.0.0/24)
14:44 < s7r> i want everytime a client connects to have the same internal ip , and other cleints not to be able to get that IP under any circumstances
14:47 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:47 < krzie> !static
14:47 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
14:47 < krzie> use topology net30 (default) and ifconfig-push high ips to static users
14:48 < krzie> !/30
14:48 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
15:00 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:28 -!- Martin___ [82eac9e8@gateway/web/freenode/ip.130.234.201.232] has joined #openvpn
15:28 < Martin___> hello everybody
15:29 < Martin___> I am getting this message in my log WARNING: file '/tmp/server.key' is group or others accessible even though my server.key has 0400 permissions 
15:33 < Martin___> I tried to chmod it with script, manually, verified permission and it looks fine
15:33 < Martin___> -r--------    1 root     root         1704 Jan  1  1970 server.key
15:34 < Martin___> even rebooting does not fix the problem
15:34 < Martin___> I am running OpenVPN 2.2.0 built from sources
15:35 < Martin___> everything works, but I want to know why this does not, I tried my binary file on another device and there is no such problem (although certificates are not stored in /tmp/)
15:35 < krzie> maybe submit a trac ticket
15:35 < krzie> !trac
15:35 <@vpnHelper> "trac" is see http://community.openvpn.net for development information and bug tracker.
15:38 < Martin___> I might do that, the funny thing is that the binary I compiled yesterday worked as well and did not show this warning
15:38 < Martin___> I was just trying to reduce the size of the binary and strip anything not necessary for me, because it was huge
15:38 < krzie> on the same system with the same key in the same place with the same permissions?
15:39 < Martin___> different system, different key, same permission
15:39 < krzie> ahh ok, so you must have stripped something related to that error
15:39 < krzie> same location?
15:39 < Martin___> yes
15:39 < krzie> include your build options in the ticket
15:40 < Martin___> but with full version (3.8MB binary, there is no error) with stripped and some option ommitted there is this error
15:40 < krzie> sounds like you did something others havnt (or havnt reported on)
15:41 < krzie> if you make the trac ticket maybe you help the project a little
15:41 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
15:55 < Martin___> yeah, just verified, with build from yesterday it does not show any error, with today build it does
15:56 < Martin___> I did not reboot the machine so the keys weren't changed
15:57 < Martin___> I remember build options from today but I am not sure about the build options from yesterday, but I can still provide binary files if that helps
15:57 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Ping timeout: 260 seconds]
15:58 < krzie> --version doesnt give the build options?
16:00 < Martin___> nope, it does not
16:00 < Martin___> even on unstripped build it does not
16:01 < krzie> hrm
16:01 < krzie> it used to
16:01 < krzie> Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
16:01 < krzie>   $ ./configure --with-lzo-lib=/usr/local/lib --with-lzo-headers=/usr/local/include --disable-depr-random-resolv --disable-pkcs11 --prefix=/usr/local --mandir=/usr/local/man --infodir=/usr/local/info/ --build=i386-portbld-freebsd6.3
16:01 < krzie> Compile time defines:  ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_PF_INET6 USE_SSL
16:01 < Martin___> yes, it did on my first build
16:02 < Martin___> ./openvpn.stripped --version  OpenVPN 2.2.0 mipsel-linux-uclibc [SSL] [EPOLL] built on May 21 2011  Originally developed by James Yonan  Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
16:02 < krzie> the main one that matters is the one that doesnt work
16:02 < Martin___> you mean the one with the warning? (because it work, it' s just a warning in the log)
16:03 < krzie> ya thats what i meant
16:03 < Martin___> because yesterdays build was nothing fancy, just disabled LZO and used static linking
16:05 < krzie> plus everything was fine in it, like a normal build
16:05 < Martin___> yes, it work OK, I am using it right now, it's just that warning
16:05 < Martin___> but the same binary works fine on another router
16:07 < krzie> with no warning?
16:07 < Martin___> yes
16:07 < krzie> same dir?
16:07 < Martin___> the only difference is how the keys are stored
16:07 < krzie> ok, well do you plan on making a ticket or not?
16:07 < krzie> if not talking about this more is a waste of time ;]
16:08 < |Mike|> Martin___: you have to get krzie a beer instead :)
16:08 < hyper_ch> hello mr. krzie
16:08 < krzie> hey wassup guys
16:08 < hyper_ch> enjoying the last hour of the weekend :)
16:08 < |Mike|> not me, my weekends are from sunday till monday :P
16:08 < Martin___> the box with warning stores them in NVRAM, then places them into /tmp/ and then chmod 0400, on the box with no warning is is persistantly stored in FLASH in /jffs/ partition
16:10 < Martin___> openSSL 1.0d was with the default makefile (just used gcc from toolchain, because I was crosscompiling for MIPS32)
16:10 < Martin___> openvpn used this ./configure --host=mipsel-linux-uclibc --disable-lzo --with-ssl-headers=~/Downloads/openssl-1.0.0d/include/ --with-ssl-lib=~/Downloads/openssl-1.0.0d/ and there was a LIBS -static flag added
16:12 < Martin___> today there was no static linking
16:12 < Martin___>   ./Configure linux-generic32  no-bf no-camellia no-seed no-krb5 no-idea no-cast no-asm no-whirlpool no-rc2 no-ripemd no-capieng no-mostasm no-cms no-gms    change GCC path to use GCC from toolchain, add -ldl to LDFLAGS       ./configure --host=mipsel-linux-uclibc --disable-lzo --with-ssl-headers=/home/martin/Downloads/openssl-1.0.0d/include/ --with-ssl-lib=/home/martin/Downloads/openssl-1.0.0d/ --disable-selinux --enable-small 
16:13 < krzie> [14:07]  <krzie> ok, well do you plan on making a ticket or not?
16:13 < krzie> [14:07]  <krzie> if not talking about this more is a waste of time ;]
16:14 < Martin___> I have never created a track ticket, I will try
16:14 < |Mike|> msg chanserv op #OpenVPN 
16:15 < krzie> *access denied*
16:15 < krzie> Martin___, if you are a member on the forum, use your same login/password
16:15 < Martin___> I am not a member
16:15 < krzie> ok well the login you make for trac will work in the forums too
16:17 < Martin___> I will try to register tomorrow
16:17 < krzie> heh
16:17 < Martin___> thank you very much for your time
16:18 < krzie> yw
16:18 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
16:44 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
16:44 < Martin___> OK, I created the ticket https://community.openvpn.net/openvpn/ticket/139, it is my first trac ticket som I am sorry if it it not written very well but I did my best and if there is something that needs to be added, please let me know
17:18 < krzie> they will reply to it if needed, and you'll get an email =]
17:20 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
17:38 -!- raket [raket@m83-178-153-121.cust.tele2.no] has quit [Read error: Connection reset by peer]
17:42 <@vpnHelper> RSS Update - forum: Problem Authorizing with certificates <http://forums.openvpn.net/topic8197.html>
17:43 -!- Martin___ [82eac9e8@gateway/web/freenode/ip.130.234.201.232] has quit [Ping timeout: 252 seconds]
17:54 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
17:56 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
18:40 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
18:42 < mistergibson> when I establish a tapN device on an existing ethN device --> what do I get, or how do I produce, an ip address that I can route in/out to/from unencrypted on the server itself?
18:42 < mistergibson> ... transparently encrypting to vpn clients ... ?
18:43 < mistergibson> !welcom
18:44 < mistergibson> !welcome
18:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:44 < krzie> mistergibson, i have no idea what you just asked
18:44 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Client Quit]
18:44 < mistergibson> I have a vpn working for simple things
18:44 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
18:45 < mistergibson> but I'd like to do something where I more finely control what services are exposed to the vpn
18:45 < krzie> firewall
18:45 < mistergibson> which implies iptables, but in order to do that I'll need an ip that I can transparently bridge-route with
18:46 < mistergibson> when I use the tapN device I get the whole she-bang
18:46 < krzie> bridge?
18:46 < krzie> you need layer2 stuff too?
18:46 < mistergibson> so I'm wondering, if I just could create out of whole cloth another ip address then I could do rather conventional bridge routing with it to a services v-lan
18:46 < krzie> and wtf is "bridge-route" ?
18:46 < krzie> bridge operates on layer2, route operates on layer3
18:47 < mistergibson> I see, then I'd need to use both layers
18:47 < krzie> what layer2 protocol do you need?
18:47 < mistergibson> arp
18:47 < krzie> ok back up to this
18:47 < krzie> !goal
18:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:47 < mistergibson> ah
18:47 < mistergibson> right
18:47 < krzie> state the goal like you are talking to a manager, try to leave out how you *think* it should be done
18:47 < mistergibson> gocha
18:48 < mistergibson> I wish to use a firewall to limit and precisely control what ports are exposed via the vpn on the server.
18:48 < mistergibson> ... to the vpn clients
18:49 < mistergibson> I may be using windows or samba shares
18:49 < krzie> iptables can firewall on layer2
18:49 -!- Busch_ [~name@lvps46-163-78-110.dedicated.hosteurope.de] has joined #openvpn
18:50 < krzie> they used to use ebtables for that, now i think iptables does it
18:50 < mistergibson> do I simply apply those rules to the vpn ip address, or tap device?
18:50 < krzie> and why would you say "arp" as the layer2 protocol?
18:51 < mistergibson> I suppose I'm fuzzy on my osi model
18:52 -!- Busch_ [~name@lvps46-163-78-110.dedicated.hosteurope.de] has quit [Client Quit]
18:52 < mistergibson> so ... do I simply apply those rules to the vpn ip address server side, or its tap device?
18:54 < mistergibson> does that tap device represent an unencrypted point for server-side traffic?
18:56 < mistergibson> !howto
18:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:59 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Quit: Bye!]
19:00 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
19:08 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Quit: Bye!]
19:08 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
19:09 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
19:09 < cali> hello
19:10 < krzie> mistergibson, yes
19:11 < krzie> tun or tap is unencrypted (as you could have answered with tcpdump)
19:11 < krzie> hello cali
19:11 < cali> I am getting extreme slowness when using port 80 behind openvpn though the same manipulation works fine on an other machine
19:11 < mistergibson> actually, the !how lead me to a bountiful reference on the issue and nearly matches my use case precisely :)
19:12 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Client Quit]
19:12 < krzie> cali, so port 80 on the vpn server?
19:13 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
19:13 < cali> krzie, yup, it has to do something with my machine but I don't know what
19:13 -!- Busch_ [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
19:14 < krzie> you are using tun / udp?
19:15 -!- Busch_ [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Client Quit]
19:15 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Client Quit]
19:16 < cali> I just make a simple route like 'route add 72.233.89.198 gw 10.8.0.33" (ip of whatismyip.com) and then it takes age to shows up something
19:16 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
19:16 -!- WireDreyfuss [WireDreyfu@c-24-3-49-177.hsd1.pa.comcast.net] has joined #openvpn
19:16 < cali> krzie, I do
19:16 < krzie> not only was that not the question, it also contradicted your first answer
19:16 < krzie> hehe
19:17 < krzie> you are not talking about port80 of your vpn server
19:17 < krzie> you are talking about port 80 of whatismyip.com when redirecting over your vpn server
19:17 < cali> krzie, well my server queries port 80 though
19:17 < krzie> no, your client does
19:17 < krzie> your server redirects it
19:18 < WireDreyfuss> !welcome  !goal I want to figure out what I need to build/locate an appropriate tap driver.
19:18 < krzie> you cant build your own tap driver (well you can but you cant sign it)
19:18 < cali> krzie, yes but that's not the issue 
19:18 < krzie> i assume this is for windows WireDreyfuss
19:19 < krzie> if thats not correct, disregard my previous answer
19:19 < WireDreyfuss> yeah, it is.
19:19 < krzie> cali, im just helping you know what you're saying so you can properly ask a question
19:19 < cali> krzie, right
19:20 < cali> krzie, I am not myself getting what's causing this issue, so I don't know how to explain it correctly
19:21 < krzie> WireDreyfuss, i can give you the instructions for building openvpn on windows... but you cant modify your own tap adapter or it will not be signed
19:21 < cali> Wireshark also says "TCP Previous segment lost"
19:22 < WireDreyfuss> The OpenVPN docs ("...wiki/BuildingOnWindows") discuss extracting a signed driver from the OpenVPN installer.  Is that straightforward?  And, how chipset-dependent is it?
19:22 < krzie> WireDreyfuss, https://community.openvpn.net/openvpn/wiki/BuildingOnWindows
19:22 <@vpnHelper> Title: BuildingOnWindows – OpenVPN Community (at community.openvpn.net)
19:22 < WireDreyfuss> uh huh.
19:23 < krzie> it is not chipset dependent... it is virtual, its windows dependent
19:26 < WireDreyfuss> I guess I need to back up to a more basic question: what is the tap driver used for?
19:26 < krzie> lemme find ya a nice link for that
19:26 < WireDreyfuss> If it's not providing low-level access to the hardware, where does it coem in?
19:26 < krzie> meh ill just answer
19:27 < krzie> it emulates a device
19:27 < krzie> has nothing to do with real hardware
19:27 < krzie> openvpn routes to / from that device
19:27 < krzie> then traffic gets encrypted and goes out your real device
19:28 < WireDreyfuss> Thanks.
19:28 < krzie> !vpn
19:28 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
19:28 < krzie> there ya go
19:31 < krzie> when you read that, remember that windows tap device does tun mode too
19:31 < cali> could my issue be caused by different version ?
19:31 < krzie> it just happens to be named "tap" but it does both
19:31 -!- manchot [~tux@baivps.xen.prgmr.com] has joined #openvpn
19:32 < krzie> cali, are you using tun or tap?  tcp or udp?
19:32 < cali> krzie, tun, udp
19:32 < manchot> speed-wise, is VPN connection faster than ssh -D for tunneling traffic?
19:32 < krzie> !mtutest
19:33 < krzie> manchot, depends what you tunnel, theoretically it is faster for TCP traffic
19:33 < krzie> for this reason:
19:33 < krzie> !tcp
19:33 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
19:33 < manchot> krzie, web browsing? VPN + NAT
19:34 < krzie> web is tcp
19:34 < K1ng> oh hi krzie :D
19:34 < krzie> so doing it over q udp vpn should be faster, as youd understand if you read the link above yet
19:34 < krzie> hey K1ng =]
19:34 < K1ng> whats up
19:35 -!- luneff [~yury@84.51.197.177] has joined #openvpn
19:36 <@vpnHelper> RSS Update - forum: Problem Authorizing with certificates <http://forums.openvpn.net/topic8197.html#p12441>
19:37 < cali> I see no errors in logs though
19:38 < cali> traceroute and pings go fine
19:39 < cali> I believe in issue between versions, what do you think ?
19:41 < cali> :(
19:43 < krzie> i think you can update both sides to 2.2.0 to rule it out
19:43 < krzie> then test mtu by adding mtu-test to your client
19:44 < krzie> K1ng, not much man, just hanging at work
19:44 < cali> well, I am not sure it is a very good idea, openvpn 2.2.0 is not even in debian unstable repos
19:51 < krzie> so?
19:51 < krzie> that says something about how upto date their repo's are
19:51 < krzie> nothing else
19:52 < cali> http://pastebin.com/DK2PiDPy does it looks ok ?
19:52 < cali> krzie, I'm getting no error, I don't know how I could investigate to be sure to find the issue
19:53 < krzie> [17:43]  <krzie> i think you can update both sides to 2.2.0 to rule it out
19:53 < krzie> [17:43]  <krzie> then test mtu by adding mtu-test to your client
19:55 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
19:56 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
19:56 -!- Cain` is now known as Cain
19:57 < cali> doing
20:01 < cali> ovpn-client[10354]: NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1541]
20:02 < cali> krzie, looks alright does not it ?
20:03 < krzie> yep its fine
20:03 < krzie> !configs
20:03 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
20:04 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
20:06 < cali> http://pastebin.com/pSQfXCDy Debian wheezy openvpn 2.1.3 (client)
20:06 < krzie> you can remove mtu-test now =]
20:09 -!- master_of_master [~master_of@p57B52FFB.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:09 < cali> http://pastebin.com/050ZauP6 Debian etch (4.0r2) Openvpn 2.1_rc11 (server)
20:10 < krzie> oh god
20:10 < krzie> go update that now
20:10 < krzie> before i even look at it
20:10 < cali> so, could the different versions be the problem ?
20:11 < krzie> no, but 2.1rc11 is known to have bugs
20:11 < krzie> you are concerned about your repo not having something... yet you use RC code
20:12 < krzie> and not even current RC code
20:12 < krzie> 2.2 RC ild understand
20:12 -!- tux_ [~tux@59.77.35.37] has joined #openvpn
20:12 -!- master_of_master [~master_of@p57B55820.dip.t-dialin.net] has joined #openvpn
20:16 -!- manchot [~tux@baivps.xen.prgmr.com] has quit [Ping timeout: 258 seconds]
20:19 < cali> krzie, so I guess if I install 2.1.3 on both machines you wont help me ?
20:19 < cali> :)
20:20 < cali> I did though, and it is still a failure :P
20:22 -!- tux_ [~tux@59.77.35.37] has quit [Ping timeout: 276 seconds]
20:24 < cali> the issue is only happening with 80
20:25 < cali> could it be because of failed hostname ?
20:25 < cali> reverse ip
20:26 -!- mistergibson [~mistergib@174-25-174-151.ptld.qwest.net] has quit [Remote host closed the connection]
20:32 < krzie> why would you ask that instead of trying by ip?
20:32 < krzie> think, try, ask (in that order)
20:33 < cali> krzie, failed as well
20:34 < cali> "TCP Previous Segment lost" says wireshark
20:36 < mick_laptop> can anyone recommend a good router that runs openvpn?
20:37 < mick_laptop> i've tried to run dd-wrt (big) - but nobody has ever gotten that to work (so it seems)
20:37 < mick_laptop> bonus points if the router has a FOSS software stack
20:38 < mick_laptop> my budget is under 
20:38 < mick_laptop> $200
20:40 <@vpnHelper> RSS Update - forum: Problem Authorizing with certificates <http://forums.openvpn.net/topic8197.html#p12442>
20:42 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:42 -!- luneff [~yury@84.51.197.177] has quit [Read error: Operation timed out]
20:43 < krzie> mick_laptop, i know Bushmills uses one
20:44 < mick_laptop> Bushmills: which one do you use?
20:44 < krzie> its almost 4am where he is
20:45 < krzie> hes often on in a couple hours
20:45 < krzie> (if he doesnt answer now)
20:45 < mick_laptop> i have linux+osx+win clients that I'd like to be able to remote into a location - and I need a new router there anyways
20:45 < mick_laptop> thanks krzie - I'll probably be awake
20:45 < mick_laptop> :)
20:46 -!- manchot [~tux@59.77.35.37] has joined #openvpn
20:46 < manchot> what is the default listening port for openvpn?
20:48 < mick_laptop> manchot: http://openvpn.net/index.php/open-source/documentation/howto.html - look for the word "port"
20:48 <@vpnHelper> Title: HOWTO (at openvpn.net)
20:48 < manchot> mick_laptop, thanks. how to change the port to 53?
20:48 < manchot> just edit the conf and say port 53?
20:48 < mick_laptop> manchot: you want to change it to be the default port for dns?
20:49 < manchot> yes
20:49 < mick_laptop> if you want to mask as a different service, use the default ntpd port
20:49 < mick_laptop> unless you host a time server
20:50 < manchot> mick_laptop, I want to mask it as a different service. 
20:50 < manchot> no, I am not hosting a ntpd server. 
20:50 < mick_laptop> right, like i said I'd go w/ the port for ntpd
20:50 < manchot> udp        0      0 *:domain                *:*                                 24863/openvpn
20:50 < mick_laptop> instead of dns - since you might want a dns server at some point
20:51 < manchot> I am not sure which port openvpn is currently using. 
20:51 < manchot> netstat -upl
20:51 < ecrist> what's in the config file, manchot ?
20:51 < mick_laptop> what does your confiug look like
20:51 < manchot> mick_laptop, ecrist I just added a line  port 53 in it
20:52 < ecrist> by default, it uses port 1194
20:52 < ecrist> which is the IANA assigned port
20:52 < manchot> I recall there is a command to see which service uses certain port. is it lsof?
20:52 < ecrist> on what OS?
20:53 < mick_laptop> manchot: actually - you might want to glance at /etc/services
20:53 < ecrist> lsof -i TCP -i UDP will do it
20:53 < mick_laptop> manchot: 53 is scanned a lot - fyi
20:54 < mick_laptop> if you are thinking abount masking it for "security reasons"
20:54 < mick_laptop> you'd be safer w/ ntpd
20:54 < mick_laptop> since noone scans time server ports
20:54 < mick_laptop> at least that i know of
20:55 < ecrist> mick_laptop: what do you mean 'scanned a lot'
20:55 < ecrist> nobody in their right mind scans UDP really, anyhow
20:55 < mick_laptop> ecrist: port scans
20:56 < ecrist> most generic port scans are <1024
20:56 < ecrist> which is where privileged services run
20:56 < mick_laptop> esp. 22 :)
20:56 < mick_laptop> 53 just seems like a bad idea
20:57 < mick_laptop> and if it is at a company, I know he'd get a beatdown by an admin if he didn't document that somewhere in bright red letters
20:58 < manchot> guys, if I want to openvpn to use udp 53, I just need to set   in the .conf   'port 53' ? right?
20:58 < manchot> mick_laptop, I know you concern, the less scanned, the more secure? I need to use VPN over DNS. 
20:59 < mick_laptop> are you in china?
21:01 < mick_laptop> manchot: I'd recommend reading the howto
21:01 < mick_laptop> if you have questions about it - come back and ask - we'll be more than happy to answer them
21:01 -!- manchot [~tux@59.77.35.37] has quit [Read error: Connection reset by peer]
21:01 <@vpnHelper> RSS Update - forum: Doubt About multiple instances openvpn <http://forums.openvpn.net/topic8198.html>
21:02 -!- manchot [~tux@59.77.35.37] has joined #openvpn
21:02 < manchot> mick_laptop, which howto?
21:03 < ecrist> 53 should be fine
21:03 < ecrist> manchot: yes
21:03 < mick_laptop> http://openvpn.net/index.php/open-source/documentation/howto.html and http://openvpn.net/index.php/open-source/documentation/manuals.html
21:03 <@vpnHelper> Title: HOWTO (at openvpn.net)
21:03 < ecrist> mick_laptop: he's asking direct questions, just answer them
21:03 < ecrist> :\
21:04 < ecrist> manchot: you can run on any unused port you chose, just use 'port <port>' in your config
21:04 < mick_laptop> ecrist: ok, fine - up to you
21:04 < manchot> ecrist, thank you. that's more like it
21:04 < mick_laptop> what are docs for anyways
21:05 < manchot> mick_laptop, I'd prefer a direct answer. Nobody has time to peruse over the complete manual these days for a simple question
21:05 < manchot> mick_laptop, I thought the manual is related to vpn over DNS
21:06 < mick_laptop> or just ctrl+f over a page... or just google something
21:06 < ecrist> mick_laptop: there's a difference between, 'how do i setup a vpn' and 'if I want to use port 53, use put "port 53" in my config, right?'
21:06 < mick_laptop> yaya I understand your time is precious
21:06 < mick_laptop> i digress
21:06 -!- mode/#openvpn [+o ecrist] by ChanServ
21:07 < manchot> mick_laptop, if you are a newbie asking a simple question, the last thing you want is to be directed to google or a long manual. 
21:08 < manchot> thank you guys. I got to penerate that great firewall. 
21:08 < mick_laptop> manchot: fair enough - I said, I digress. the openvpn guys are great and have a lot of patience.
21:08 < mick_laptop> manchot: are you in china?
21:08 < manchot> yes
21:08 <@ecrist> manchot: your view is also skewed,  docs come first, help second.  had you asked non-direct specific questions, I'd have told you to RTFM, as well
21:09 < mick_laptop> ok, nm any of the crap that I gave you before
21:09 < manchot> I understand that. ecrist 
21:09 < manchot> ecrist, I want to know how to setup a vpn, the first stop would be google blog search
21:09 < manchot> ecrist, *if I want
21:10 < manchot> mick_laptop, why you ask?
21:10 < mick_laptop> actually - behind that fw - you can't even trust what comes back
21:10 < manchot> mick_laptop, even with vpn?
21:11 < mick_laptop> oh no, i mean searching the web
21:11 <@ecrist> if someone sees an entire SSL handshake, they can crack the connection
21:11 <@ecrist> in theory
21:11 <@ecrist> pre-shared keys is a viable option, however, still not ideal.
21:12 < manchot> ecrist, mick_laptop there was my mysterious experience. I changed the DNS record to my blog (new IP), but I can still read my blog on a complete different IP
21:12 <@vpnHelper> RSS Update - forum: AES-NI Support for OpenVPN Windows Server 2008? <http://forums.openvpn.net/topic8199.html>
21:12 < manchot> an Ip I havce never used. 
21:12 < manchot> I didn't know how that came
21:13 < mick_laptop> manchot: what does /sbin/ifconfig -a say?
21:13 < mick_laptop> do you have a few ips to that domain?
21:13 < mick_laptop> i have a vps w/ a few ips linked to it
21:13 < manchot> mick_laptop, no. I only have one IP
21:15 < mick_laptop> manchot: as for another point - you'll find that people on irc have an affinity to help those behind oppressive firewalls - especially those from where you are coming from
21:15 < mick_laptop> manchot: i have no idea why another ip would respond when you try and access your site, maybe something w/ the dns?
21:15 < manchot> mick_laptop, maybe DNS poison. 
21:15 < mick_laptop> yeah
21:16 < mick_laptop> that is what came to mind
21:17 < mick_laptop> ecrist: you can -o now btw - no need to /kick me :)
21:17 <@vpnHelper> RSS Update - forum: "TLS soft reset" issue <http://forums.openvpn.net/topic8200.html>
21:19 < mick_laptop> there was a similar discussion on reddit today about the great fw and using ssh to go over 443
21:20 < manchot> mick_laptop, interesting. can you direct me to the link? why 443?
21:20 < mick_laptop> to mask it (pretending to be https)
21:21 < manchot> mick_laptop, so I just change the port? I see no need. 
21:21 < mick_laptop> https://www.reddit.com/r/netsec/comments/hhkbn/will_i_be_able_to_ssh_tunnel_home_from_china/
21:21 <@vpnHelper> Title: Will I be able to SSH tunnel home from China? : netsec (at www.reddit.com)
21:22 < manchot> thank you. 
21:22 -!- rpj8 [~WillSmith@c-71-61-182-47.hsd1.pa.comcast.net] has joined #openvpn
21:22 < rpj8> !welcome
21:22 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:23 <@vpnHelper> RSS Update - forum: Please Help me Multi-Server Tutorials here <http://forums.openvpn.net/topic8195.html#p12446>
21:26 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
21:29 <@vpnHelper> RSS Update - forum: openvpn server connect to another server <http://forums.openvpn.net/topic8158-15.html#p12447>
21:30 -!- rpj8 [~WillSmith@c-71-61-182-47.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
21:30 -!- manchot [~tux@59.77.35.37] has quit [Ping timeout: 240 seconds]
21:33 -!- WireDreyfuss [WireDreyfu@c-24-3-49-177.hsd1.pa.comcast.net] has left #openvpn []
21:43 -!- taco_the_paco [~TACOS@lolcocks.tk] has quit [Remote host closed the connection]
21:47 -!- manchot [~tux@baivps.xen.prgmr.com] has joined #openvpn
21:48 < manchot> I put port 53 into the config on the server side, but now I can't connect openvpn anymore
21:49 -!- tux_ [~tux@59.77.35.37] has joined #openvpn
21:50 -!- tux_ is now known as manchotN
21:50 < manchotN> do I need to change the  client side  opvn config as well?
21:50 < manchotN> right now I have the error message: read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
21:52 < krzee> of course
21:52 -!- manchot [~tux@baivps.xen.prgmr.com] has quit [Ping timeout: 246 seconds]
21:55 < manchotN> krzee, I just add port 53 on both the server and the client. 
21:55 < manchotN> I still get  Connection reset by peer (WSAECONNRESET) (code=10054)
21:59 <@vpnHelper> RSS Update - forum: OpenVPN over ICMP <http://forums.openvpn.net/topic7998.html#p12448>
22:03 -!- tux_ [~tux@baivps.xen.prgmr.com] has joined #openvpn
22:05 -!- manchotN [~tux@59.77.35.37] has quit [Ping timeout: 240 seconds]
22:08 -!- tux_ [~tux@baivps.xen.prgmr.com] has quit [Ping timeout: 246 seconds]
22:29 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
22:30 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
22:30 -!- mode/#openvpn [+o raidz] by ChanServ
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:45 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:49 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
23:06 -!- newmember__ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
23:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:08 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
23:09 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
23:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
23:14 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
23:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:35 -!- newmember__ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Quit: Leaving]
23:47 -!- luneff [~yury@84.51.195.188] has joined #openvpn
--- Day changed Mon May 23 2011
00:02 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has quit [Ping timeout: 248 seconds]
00:03 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has joined #openvpn
00:08 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 248 seconds]
00:08 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:08 -!- dxtr [kdpobr@unaffiliated/dxtr] has quit [Ping timeout: 260 seconds]
00:28 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
00:29 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
00:34 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:38 -!- luneff [~yury@84.51.195.188] has quit [Ping timeout: 255 seconds]
00:52 < Proz01d> hope someone is here....
00:53 < Proz01d> anyone know where i include the tls-remote and tls-verify directives?
01:00 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:08 < Proz01d> hey krzee... where do i put the tls-remote and tls-verify directives..?
01:09 < krzee> i bet the manual knows
01:10 < Proz01d> yes i read it.
01:11 < Proz01d> but i was wondering if it's just tls-remote in the config file and that's it
01:11 < Proz01d> are are there some params
01:12 < krzee> i bet the manual tells you
01:15 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:15 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12450>
01:18 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:18 -!- mode/#openvpn [+o mattock] by ChanServ
01:31 < Bushmills> mick_laptop: a tp-link wr1043nd
01:33 < Bushmills> reflashed it with openwrt
01:35 < Bushmills> router was around 55$
01:42 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
01:57 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
02:03 -!- Blaster [Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
02:04 -!- B|aster [~Baster@S0106001b1162347e.ok.shawcable.net] has quit [Ping timeout: 244 seconds]
02:04 < Proz01d> arg.....trying to restart openvpn but it can't start and has a status of failed
02:04 < Proz01d> i've checked the openvpn.log and openvpn-status.log
02:05 < Proz01d> don't see anythinig there..  is there somewhere else i can check to narrow down the issue?
02:07 -!- dxtr [7uzm80@unaffiliated/dxtr] has joined #openvpn
02:20 < Bushmills> what happens when stopping, then starting?
02:25 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
02:27 -!- Blaster [Baster@S0106001b1162347e.ok.shawcable.net] has quit [Ping timeout: 264 seconds]
02:27 <@vpnHelper> RSS Update - forum: ERROR: --dev tun also requires --ifconfig <http://forums.openvpn.net/topic8183.html#p12452> || Force DNS on specific domain name <http://forums.openvpn.net/topic7605.html#p12451>
02:39 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
02:52 <@vpnHelper> RSS Update - forum: Doubt About multiple instances openvpn <http://forums.openvpn.net/topic8198.html#p12454> || ROUTE: route addition failed using CreateIpForwardEntry: <http://forums.openvpn.net/topic8185.html#p12453>
02:55 -!- dazo_afk is now known as dazo
02:57 <@vpnHelper> RSS Update - forum: Discussion: MySQL authentication with PAM or Radius <http://forums.openvpn.net/topic8201.html>
03:07 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 248 seconds]
03:16 <@vpnHelper> RSS Update - forum: AES-NI Support for OpenVPN Windows Server 2008? <http://forums.openvpn.net/topic8199.html#p12458> || "TLS soft reset" issue <http://forums.openvpn.net/topic8200.html#p12457> || Problem Authorizing with certificates <http://forums.openvpn.net/topic8197.html#p12456>
03:22 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12459>
03:24 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:24 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:33 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has quit [Ping timeout: 248 seconds]
03:33 <@vpnHelper> RSS Update - forum: FRAG TTL expired i=0 <http://forums.openvpn.net/topic8202.html>
03:33 < s7r> http://openvpn.net
03:49 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html#p12461>
04:07 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
04:09 -!- takamichi [Takamichi@78.133.37.249] has quit [Ping timeout: 248 seconds]
04:10 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
04:17 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has joined #openvpn
04:23 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
04:30 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12462>
04:51 -!- K1ng [~KING@180.211.188.225] has quit [Ping timeout: 240 seconds]
04:54 -!- K1ng [~KING@180.211.188.166] has joined #openvpn
05:02 -!- manitu [~manitu@p578b0cfb.dip0.t-ipconnect.de] has joined #openvpn
05:03 < manitu> hi there.. is there a way to configure a fixed ip for a client? so computer A ever have the same ip in the vpn network
05:04 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 240 seconds]
05:08 <@dazo> !ccd
05:08 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
05:08 <@dazo> manitu: ^^
05:09 < manitu> i will have a look on it, thank you very much dazo :)
05:10 <@dazo> you just set a separate ifconfig-push for that client in such a ccd setup
05:16 -!- cali [~cali@ip-154.net-89-3-66.rev.numericable.fr] has joined #openvpn
05:16 -!- cali [~cali@ip-154.net-89-3-66.rev.numericable.fr] has quit [Changing host]
05:16 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
05:31 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:31 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:31 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:36 -!- DJ_HaMsTa [~werwer@unaffiliated/dj-hamsta/x-2342346] has joined #openvpn
05:36 < DJ_HaMsTa> guys the openvpn site is down
05:42 -!- thorwil [~thorwil@p4FFB7329.dip.t-dialin.net] has joined #openvpn
05:45 < thorwil> hi! if i have internet access via the local network and also have an openvpn connection running, what mechanism is used to determine if an address belongs to the vpn or not?
05:46 < thorwil> i wonder if my browsing behavior could be or become exposed to the operator of the vpn
05:52 < hyper_ch> the routing through according gateways decides where things go through
06:00 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
06:02 < bystander> good day all: I would like to ask this, when the client is connected it shows that the connection is 10mbps.  How can I make it that the connection is 100mbps or higher?
06:03 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:11 < bystander> hello guys
06:11 <@vpnHelper> RSS Update - forum: duplicate-cn and client subnet <http://forums.openvpn.net/topic8157.html#p12168>
06:14 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
06:40 -!- mode/#openvpn [-o ecrist] by ecrist
06:43 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html#p12463>
06:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:55 <@vpnHelper> RSS Update - forum: Connection problems - can I pick your brains? <http://forums.openvpn.net/topic7756.html#p12464>
06:57 <@dazo> mattock: raidz:  Please check up your web site ... 
06:58 <@dazo> DJ_HaMsTa: thx for the heads-up ... in this channel it's mostly community people ... right now raidz and mattock are the only one in the company who are here
07:01 <@dazo> DJ_HaMsTa: something you're looking for particular?  downloads can be found here: http://swupdate.openvpn.net/community/releases/
07:01 <@vpnHelper> Title: Index of /community/releases/ (at swupdate.openvpn.net)
07:05 -!- thorwil [~thorwil@p4FFB7329.dip.t-dialin.net] has left #openvpn ["Leaving"]
07:06 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 248 seconds]
07:08 < mick_laptop> Bushmills: what firmware do you use?
07:09 < hyper_ch> dazo: krzee: Bushmills: http://www.kb.cert.org/vuls/id/536044
07:09 <@vpnHelper> Title: US-CERT Vulnerability Note VU#536044 (at www.kb.cert.org)
07:11 <@dazo> hyper_ch: not much we can do about that attach, we depend solely on OpenSSL ... so OpenVPN is safe when OpenSSL is safe
07:11 -!- DJ_HaMsTa [~werwer@unaffiliated/dj-hamsta/x-2342346] has quit [Ping timeout: 276 seconds]
07:19 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:21 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
07:35 < hyper_ch> dazo: I just thought you might be interested
07:35 <@dazo> hyper_ch: ahh, then thx a lot! :)
07:41 < krzee> thanks hyper_ch 
07:43 < hyper_ch> do I get cookies?
07:43 < krzee> !tell hyper_ch here, have a cookie
07:43 < krzee> compliments of vpnHelper 
07:43 < hyper_ch> thx /me nom nom
07:48 -!- kraut [~kraut@dyndsl-091-096-048-226.ewe-ip-backbone.de] has joined #openvpn
07:52 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
08:10 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 260 seconds]
08:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:46 -!- dazo is now known as dazo_afk
08:52 -!- dazo_afk is now known as dazo
08:53 -!- ph1l [~ph1l@84-73-243-204.dclient.hispeed.ch] has left #openvpn []
09:10 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
09:20 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
09:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
09:37 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
09:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:58 -!- Lenhix [ElChaman@190.146.247.20] has joined #openvpn
10:19 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12465>
10:25 < hyper_ch> krzee: so, in layman terms, what does that security issue on elliptical curves mean?
10:25 < hyper_ch> are we all gonna die?
10:38 < buddha> rapture  2.0
10:38 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:41 -!- hyper_ch is now known as hyper_away
10:43 <@vpnHelper> RSS Update - forum: Problem Authorizing with certificates <http://forums.openvpn.net/topic8197.html#p12466>
10:49 <@vpnHelper> RSS Update - forum: Problem Authorizing with certificates <http://forums.openvpn.net/topic8197.html#p12467>
10:55 <@vpnHelper> RSS Update - forum: Problem Authorizing with certificates <http://forums.openvpn.net/topic8197.html#p12468>
11:20 <@vpnHelper> RSS Update - forum: Problem Authorizing with certificates <http://forums.openvpn.net/topic8197.html#p12469>
11:20 < Proz01d> hey guys trying to restart openvpn but it can't start and has a status of failed
11:20 < Proz01d> i've checked the openvpn.log and openvpn-status.log
11:20 < Proz01d> don't see anythinig there..  is there somewhere else i can check to narrow down the issue?
11:24 <@dazo> Proz01d: increase log level first ... --verb 4 should be able to tell you a lot more
11:25 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:27 < Proz01d> i am on 4
11:35 < Proz01d> dazo: i don't even think it's writing to the logs
11:35 -!- dxtr [7uzm80@unaffiliated/dxtr] has quit [Quit: WeeChat 0.3.4]
11:36 <@dazo> Proz01d: then make sure you're looking at the right log files (have you configured the --log option?  Or do you have some script/wrapper overriding it?)
11:38 <@vpnHelper> RSS Update - forum: Problem Authorizing with certificates <http://forums.openvpn.net/topic8197.html#p12470>
11:39 < Proz01d> i have "log-append  /var/log/openvpn.log" in the server.conf file 
11:40 -!- manitu [~manitu@p578b0cfb.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
11:40 < Proz01d> and i'm starting the vpn daemon with "sudo  /etc/init.d/openvpn restart"
11:52 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:52 -!- hyper_away is now known as hyper_ch
12:17 -!- Lenhix [ElChaman@190.146.247.20] has quit [Quit: Mindwall!!]
12:20 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
12:24 < krzee> hyper_ch, most likely NOTHING
12:24 < krzee> if you were using ecdsa-with-SHA1 it would mean something
12:24 < hyper_ch> :)
12:25 < hyper_ch> !layman terms
12:25 < krzee> or ECDH-ECDSA-AES128-SHA
12:25 < krzee> if you did not change your cipher, it means absolutely nothing
12:25 < krzee> if you used easy-rsa or ssl-admin, it means absolutely nothing
12:25 < hyper_ch> are we all gonna die?
12:25 < krzee> yes
12:25 < hyper_ch> awww :(
12:25 < krzee> i garuntee we all die one day
12:26 < krzee> in addition to above
12:26 < krzee> if you did not change your digest
12:26 -!- dazo is now known as dazo_afk
12:26 < hyper_ch> :) btw, you like tv shows?
12:27 < krzee> http://www.mail-archive.com/openssl-users@openssl.org/msg64384.html
12:27 <@vpnHelper> Title: Re: No shared cipher error using ECDSA (at www.mail-archive.com)
12:27 < krzee> no, i dont watch tv
12:27 < krzee> looks like ECDSA doesnt even work in openvpn
12:27 < hyper_ch> well, you can watch tv shows on your computer also
12:27 < krzee> i have a television
12:27 < krzee> i use it as a computer monitor
12:28 < hyper_ch> isn't that bad quality?
12:28 < krzee> its not the hardware that i dislike
12:28 < krzee> no, its a good LCD
12:28 < krzee> my mac even recognizes the model of the tv
12:28 < hyper_ch> well, I've been busy like a bee and wrote a littel php script to check tvrage
12:29 < krzee> werd
12:29 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Leaving]
12:29 < krzee> i wrote a shell script to flip through channels with my tv tuner
12:29 < hyper_ch> ok, I've been busy finding a php irc bot class and an xml2array function and put it together so that I can query the tvrage api
12:29 < hyper_ch> lol
12:29 < krzee> programmed it to channelsurf until key-press
12:29 < hyper_ch> hehehe :)
12:29 < krzee> then i dropped using X and canceled my cable
12:30 < hyper_ch> I wonder, how do people efficiently run windows computers as they don't have bash.... do they install cygwin?
12:30 < krzee> dunno, i solved that by not using windows
12:30 <@vpnHelper> RSS Update - forum: Low speed with tcp proto <http://forums.openvpn.net/topic8196.html#p12471>
12:30 < hyper_ch> btw, did you know what you can use linux in the browser?
12:31 < krzee> huh?
12:32 < hyper_ch> http://news.cnet.com/8301-30685_3-20063563-264.html
12:32 <@vpnHelper> Title: JavaScript: Now powerful enough to run Linux | Deep Tech - CNET News (at news.cnet.com)
12:33 < hyper_ch> you did not know that?
12:42 <@vpnHelper> RSS Update - forum: Problem with a client running under VirtualBox <http://forums.openvpn.net/topic8203.html>
12:43 -!- gyyrog [~gyyrog@adsl-75-40-252-169.dsl.klmzmi.sbcglobal.net] has joined #openvpn
13:02 -!- knuckleheadTech [~josh@69-20-153-230.static.ida.net] has joined #openvpn
13:03 < knuckleheadTech> !goal
13:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:03 < knuckleheadTech> !welcome
13:03 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:04 < knuckleheadTech> !howto
13:04 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:05 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:05 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:11 -!- luneff [~yury@84.51.197.177] has joined #openvpn
13:11 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
13:17 < knuckleheadTech> so far I haven't found what I am seeing, maybe because it is something I shouldn't be worrying about 
13:18 < knuckleheadTech> when setting up the VM in hyper-v it wants me to "Please enter 'DELETE' to delete existing configuration:"
13:18 < knuckleheadTech> since it is an imported vhd I am assuming the deleting everything and starting from scratch isn't a good thing
13:21 < knuckleheadTech> nevermind, patience is a virtue 
13:21 < knuckleheadTech> restarted the vm and it seems to be all better
13:34 -!- gyyrog [~gyyrog@adsl-75-40-252-169.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
13:39 -!- sj7trunks [~Adium@171.67.175.9] has joined #openvpn
13:40 < sj7trunks> i have an ethernet interface with internet connection sharing turned on… the connection drops once in awhile but resumes fine… is there a way that I can openvpn to see the refreshed connection? it seems that I need to restart openvpn every time the connection drops 
13:43 < fipu> hello @ all
13:44 < fipu> I have a short question, in my server conf there is "server 10.10.10.0 255.255.255.0"
13:46 < fipu> so I have a client with 10.10.10.5 and I want to add a second one with IP 10.20.20.20, so I need to change the server config now or is it enough to push the route to the other VPN subnet to the client?
13:46 < fipu> how can I tell the openvpn Server to also handle the 10.20.20.0/24 subnet, but Server IP should still be 10.10.10.1
13:46 < fipu> that is very important...
13:51 < fipu> krzee: arround?
13:52 < fipu> ah, I can just add "route 10.20.20.0 255.255.255.0" to my server config file, is that right?
14:01 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
14:02 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
14:04 < krzee> why do you want to force that ip?
14:04 < krzee> it likes comes from misunderstanding something about routing
14:05 < krzee> likely*
14:05 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:13 < fipu> krzee: I just want to use a secondary subnet (10.20.20.0/24)
14:13 < krzee> WHY
14:13 < fipu> and I give static IP's to all my clients by a ccd file
14:13 < fipu> for a better overview
14:14 < fipu> because it is a secondary company
14:14 < krzee> see the howto
14:14 < krzee> !howto
14:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:14 < krzee> !policy
14:14 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
14:14 < fipu> And I use much iptables rules, so I have a very better overview with a second subnet
14:16 < fipu> What I've already done: added "push route 10.10.10.0 255.255.255.0" to the client ccd from the new client with the new subnet. And I also added "push route 10.20.20.0 255.255.255.0" to all my clients that are using the 10.10.10.0/24 subnet
14:16 < fipu> and I added the needed iptables rules
14:16 < krzee> i dont do what you're saying
14:17 < krzee> i do it different
14:17 < krzee> i have a higher subnet in the /24 for static
14:17 < krzee> i wont have 254 clients...
14:17 < krzee> and i understand how to tell apart subnets smaller than /24 :-p
14:17 < fipu> Do I need to add something in the server config like "route 10.20.20.0 255.255.255.0" in my case, to tell the server that there are clients with 10.20.20.0/24 subet IP's?
14:18 < fipu> :D
14:18 < krzee> told you, i dunno
14:18 < krzee> also told you where in the howto they talk about it
14:18 < krzee> and told you why its unnecessary
14:18 < fipu> mh, kay... I check this
14:18 < krzee> take those 3 things, mix them to your liking
14:18 < krzee> ;]
14:19 < fipu> :D
14:19 < fipu> Why it is unnecessary? :D
14:19 < krzee> [15:18]  <krzee> i have a higher subnet in the /24 for static
14:19 < krzee> [15:18]  <krzee> i wont have 254 clients...
14:19 < krzee> [15:18]  <krzee> and i understand how to tell apart subnets smaller than /24 :-p
14:20 < krzee> unless one of those does not apply to you
14:20 < krzee> (protip, if its the 254 clients part, your openvpn server will likely die before you get there)
14:21 < krzee> with that said, it is possible, and it is covered in the howto
14:21 < fipu> I use 10.10.10.1-10 for servers, and also 10.10.10.10-100 for servers. So I have 10.10.10.100-254 for my clients. The problem is the other one is a server too, so for a better overview I need the IP 10.20.20.10 for the new server
14:21 < fipu> :)
14:21 < fipu> Do you understand my "problem"? :D
14:22 < krzee> nope, its a problem you made yourself
14:22 < fipu> lol
14:22 < krzee> homemade problems for the lose
14:22 < krzee> bbs as krzie , going to work
14:23 < fipu> krzee: I think it is the best way to use a second /24 subnet for the new company. But I also check your tipps 
14:23 < fipu> Thank you
14:23 < krzee> new company, i agree
14:23 < krzee> ild also use a new server and a new PKI
14:23 < krzee> but thats just me
14:23 < krzee> it would be on the same hardware
14:24 < fipu> ok, thats also a good possiblity
14:24 < krzee> now that you mention multiple companies, do whatever is easiest for you to manage
14:24 < krzee> for me it would be that
14:24 < fipu> then I have a different tun device for it, also good for a nice overview :D
14:24 < krzee> for you, maybe its same server different subnet
14:24 < krzee> yep
14:24 < krzee> thats how *ild* do it
14:25 < krzee> now the "problem" makes more sense
14:25 < krzee> ;]
14:25 < krzee> but ya, bbs as krzie
14:25 < fipu> mhhh, ok. So I think about it and try to use the best solution for my case
14:26 < fipu> I thinkf the idea with a second server (different tun device) is a good one
14:26 < fipu> ok, bb
14:26 < fipu> have fun @ work :D
14:30 <@vpnHelper> RSS Update - forum: Problem with a client running under VirtualBox <http://forums.openvpn.net/topic8203.html#p12473>
14:36 <@vpnHelper> RSS Update - forum: Problem with a client running under VirtualBox <http://forums.openvpn.net/topic8203.html#p12474>
14:39 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
14:41 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
14:46 -!- luneff [~yury@84.51.197.177] has joined #openvpn
15:04 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8147.html#p12475>
15:12 -!- Alias_NeO [~chatzilla@2.98.131.232] has joined #openvpn
15:12 < Alias_NeO> !goal
15:12 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:12 < Alias_NeO> !welcome
15:12 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:12 < Alias_NeO> !logs
15:12 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
15:12 < Alias_NeO> !configs
15:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
15:12 < Alias_NeO> !redirect
15:12 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:13 < Alias_NeO> !nat
15:13 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:13 < Alias_NeO> !linnat
15:13 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
15:13 < Alias_NeO> Hey guys, ca anyone tell me if this NAT part (iptables) needs to be repeated after a reboot?
15:32 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 240 seconds]
15:47 -!- Alias_NeO [~chatzilla@2.98.131.232] has left #openvpn []
15:49 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
15:52 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
15:58 <@vpnHelper> RSS Update - forum: OpenVPN Service crashes appon resuming. <http://forums.openvpn.net/topic8204.html>
16:05 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
16:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:13 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:18 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has quit [Ping timeout: 252 seconds]
16:20 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
16:23 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8147.html#p12477>
16:29 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 240 seconds]
16:55 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
16:59 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:03 -!- K1ng [~KING@180.211.188.166] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
17:06 -!- knuckleheadTech [~josh@69-20-153-230.static.ida.net] has quit [Quit: Leaving.]
17:06 -!- knuckleheadTech [~josh@69-20-153-230.static.ida.net] has joined #openvpn
17:08 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:21 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 260 seconds]
17:32 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:33 -!- sj7trunks [~Adium@171.67.175.9] has quit [Quit: Leaving.]
17:39 -!- knuckleheadTech [~josh@69-20-153-230.static.ida.net] has left #openvpn []
17:59 <@vpnHelper> RSS Update - forum: Do not start OpenVPN client automatically <http://forums.openvpn.net/topic8205.html>
18:02 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:02 -!- K1ng [~KING@180.211.188.166] has joined #openvpn
18:11 <@vpnHelper> RSS Update - forum: OpenVPN works with XP but Win 7 has resolution problem <http://forums.openvpn.net/topic8206.html>
19:19 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
19:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
19:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:56 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
19:57 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Operation timed out]
19:57 -!- Cain` is now known as Cain
20:10 -!- master_of_master [~master_of@p57B55820.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
20:10 <@vpnHelper> RSS Update - forum: AES-NI Support for OpenVPN Windows Server 2008? <http://forums.openvpn.net/topic8199.html#p12480>
20:12 -!- master_of_master [~master_of@p57B5592B.dip.t-dialin.net] has joined #openvpn
20:33 <@vpnHelper> RSS Update - forum: Doubt About multiple instances openvpn <http://forums.openvpn.net/topic8198.html#p12481>
20:33 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
20:35 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
20:43 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:51 <@vpnHelper> RSS Update - forum: "TLS soft reset" issue <http://forums.openvpn.net/topic8200.html#p12482>
21:10 -!- jaminja [~jaminja@212.7.195.193] has quit [Changing host]
21:10 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
21:50 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:33 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:34 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Client Quit]
22:35 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
23:05 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:38 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
23:48 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
23:54 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
--- Day changed Tue May 24 2011
00:11 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
00:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
00:24 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:28 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
00:28 -!- mode/#openvpn [+o mattock] by ChanServ
00:36 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 255 seconds]
01:12 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
01:14 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:28 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 252 seconds]
01:36 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
01:58 <@vpnHelper> RSS Update - forum: Issue with multiple instance (tcp & udp) <http://forums.openvpn.net/topic8207.html>
02:01 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:04 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
02:32 -!- ScreenSilently [screensile@gateway/shell/anapnea.net/x-fkipvggmhdzpygul] has joined #openvpn
02:33 < ScreenSilently> hello, i made an openvpn vpn, i connect but the client can't get an ip
02:33 < ScreenSilently> nothing appears on ifconfig -a
02:33 < ScreenSilently> why?
02:37 < ScreenSilently> anybody here?
02:38 < krzee> connecting as root?
02:39 < ScreenSilently> where? on the client?
02:39 < ScreenSilently> yes
02:39 < krzee> on both really, but ya
02:39 < krzee> !configs
02:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
02:40 < ScreenSilently> what configuration sould i have on openvpn.conf on the server to auto give ips?
02:40 < krzee> !howto
02:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
02:40 < krzee> !sample
02:40 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
02:40 < krzee> !man
02:40 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
02:40 < krzee> there ya go
02:40 < krzee> everything you need to know
02:42 < ScreenSilently> http://paste.pocoo.org/show/394126/
02:42 < ScreenSilently> what i'm forgeting?
02:44 < krzee> the other config
02:44 < ScreenSilently> http://paste.pocoo.org/show/vbF8PlQjfXatA98zWjlM/
02:46 < krzee> !logs
02:46 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
02:47 < ScreenSilently> http://paste.pocoo.org/show/sCNwOagpUrSB9ZxpG3eS/
02:47 < ScreenSilently> http://paste.pocoo.org/show/634TZ3r4p3UUSSzvVL1s/
02:48 < ScreenSilently> actually this
02:50 < krzee> those logs dont show a connection
02:52 < ScreenSilently> and what they show?
02:53 < krzee> nothing
02:53 < ScreenSilently> and what should i do?
02:53 < krzee> gimme logs of the connection you said happens
02:53 < ScreenSilently> that's the only log i have
02:54 < krzee> its not long enough, send it after its tried connecting
02:54 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
02:55 < Bushmills> where dpes server do --auth-user-pass-verify?
02:55 < ScreenSilently> Modem hanguphttp://paste.pocoo.org/show/w32THXkYbhAOX3KcHE6d/
02:56 < krzee> general network error
02:57 < krzee> wrong ip, firewall blocking, wrong port
02:57 < krzee> something like that
02:57 < ScreenSilently> what ports should i open to work?
02:57 < krzee> the one from your configs
02:59 < ScreenSilently> ok got it thanks bye
02:59 -!- ScreenSilently [screensile@gateway/shell/anapnea.net/x-fkipvggmhdzpygul] has quit [Quit: leaving]
03:01 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
03:02 < xsurfer> Hi there! When my client is successfully connected to the server, it will bring up the network adapter with 10mbps speed.  Is there a way to increase that network speed?
03:02 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
03:05 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
03:12 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
03:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:12 < xsurfer> when the client is connected to server, the network speed is on 10mbps.  How can I make it to 100mbps or higher?
03:13 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:20 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
03:25 -!- dazo_afk is now known as dazo
03:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:39 < s7r> what is the best / strongest chiper i can use for encryption 
03:39 < s7r> i want intercepting and decrypting data to be impossible in the real sens of the word]
03:40 -!- takamichi [Takamichi@78.133.37.249] has quit [Remote host closed the connection]
03:43 < Bushmills> probably one-time pad is, but distributing the key securely is an additional challenge
03:49 -!- wangerin1 [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
03:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:55 -!- Philix [522ea104@pdpc/supporter/active/philix] has joined #openvpn
03:57 < Philix> Hi all is there a way to set the tap0 to be the default so all traffic goes through this ?
03:57 < wangerin1> Hi! Is It possible to push an extra IP-adress til clients via ccd (or client-connect-script)?
03:58 < Bushmills> an "extra"?
03:58 < wangerin1> !welcome
03:58 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:58 < s7r> Bushmills: what do you mena distributing the key securely is an additional challenge ?
03:58 < s7r> the diffie hellman key exchange is not enough
03:58 < s7r> for bulletproof security
03:58 < Bushmills> "distributing" as in "getting key from one to another place"
03:58 < s7r> according to wikipedia it is .... 
04:00 < s7r> and you don't find the diffie hellman key exchange enough for this purpose?
04:00 < Bushmills> with otp, your key needs to be as long as the message
04:04 -!- carbon_monoxide [~cm@61.93.232.225] has joined #openvpn
04:08 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
04:10 -!- Philix [522ea104@pdpc/supporter/active/philix] has left #openvpn []
04:11 -!- wk [945384c8@gateway/web/freenode/ip.148.83.132.200] has joined #openvpn
04:12 < wk> Hi there, openvpn won't start, errormsg "Error:  iptables service not started because of error (SVC_RUN_EXCEPT)" However Iptables is up and running. What's wrong?
04:13 < Bushmills> wk: whether iptable
04:13 < wk> I'm running Ubuntu.
04:13 < Bushmills>  iptables is running or not should have no effect on openvpn starting
04:14 < Bushmills> where does that message come from?
04:14 < wk> -bash: whether: command not found
04:14  * wk laughs
04:14 < wk> I'm new to linux.
04:14 < Bushmills> !howto
04:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:14 < wk> I already read the howto.
04:15 < Bushmills> ah. join my first and second message. i hit return accidentally while typing
04:16 < Bushmills> small netbook keyboard and big fingers :)
04:19 < wk> Wait.. what? I'm confused.
04:19 < Bushmills> whether iptables is running or not should have no effect on openvpn starting
04:19 < wk> Ah.
04:20 < wk> Well, why that errormsg then? D:
04:20 < Bushmills> (11:14:03) Bushmills: where does that message come from?
04:20 < wk> The adminpanel, when I try to start the server.
04:20 < Bushmills> what "panel"?
04:20 < Bushmills> openvpn has no "panel"
04:21 < wk> openvpn has a adminpanel..
04:21 < wk> atleast the newer versions
04:21 < wk> This is the openvpn server.
04:21 < wk> http://openvpn.net/index.php/access-server/docs/quick-start-guide.html < read Admin web interface
04:21 <@vpnHelper> Title: Quick Start Guide (at openvpn.net)
04:22 < Bushmills> role of openvpn, server or client, is only determined by its config file
04:22 < Bushmills> you're talking about access server
04:22 < Bushmills> !as
04:22 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations
04:22 <@vpnHelper> options supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
04:23 < Bushmills> "OpenVPN Access Server Quick Start Guide"
04:23 < wk> Now I'm really confused, I got told to use access server because it is easy to set up.
04:24 < Bushmills> ask those who told you for support
04:24 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
04:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:26 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 250 seconds]
04:26 -!- wk [945384c8@gateway/web/freenode/ip.148.83.132.200] has quit [Quit: Page closed]
04:35 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:35 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:35 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:37 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
04:41 <@vpnHelper> RSS Update - forum: Do not start OpenVPN client automatically <http://forums.openvpn.net/topic8205.html#p12484>
04:47 <@vpnHelper> RSS Update - forum: "TLS soft reset" issue <http://forums.openvpn.net/topic8200.html#p12487> || AES-NI Support for OpenVPN Windows Server 2008? <http://forums.openvpn.net/topic8199.html#p12486> || OpenVPN works with XP but Win 7 has resolution problem <http://forums.openvpn.net/topic8206.html#p12485>
04:50 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:50 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:50 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:53 <@vpnHelper> RSS Update - forum: Issue with multiple instance (tcp & udp) <http://forums.openvpn.net/topic8207.html#p12488>
05:02 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
05:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:17 <@vpnHelper> RSS Update - forum: Issue with multiple instance (tcp & udp) <http://forums.openvpn.net/topic8207.html#p12490> || Doubt About multiple instances openvpn <http://forums.openvpn.net/topic8198.html#p12489>
05:26 -!- takamichi [Takamichi@78.133.37.249] has quit [Remote host closed the connection]
05:59 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
05:59 <@vpnHelper> RSS Update - forum: Issue with multiple instance (tcp & udp) <http://forums.openvpn.net/topic8207.html#p12491>
06:00 -!- carbon_monoxide [~cm@61.93.232.225] has quit [Quit: Leaving]
06:12 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
06:18 -!- takamichi [Takamichi@78.133.37.249] has quit [Remote host closed the connection]
06:18 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
06:21 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
06:24 -!- jaminja [~jaminja@rijkdijk2.demon.co.uk] has joined #openvpn
06:26 -!- screensilently [screensile@gateway/shell/anapnea.net/x-umsxzzquidsdoctu] has joined #openvpn
06:27 < screensilently> Hello, so i have setted up an openvpn network but i want, on the client, the user to use his own internet connection to access the internet, and not vpn's
06:28 <@dazo> screensilently: remove --redirect-gateway from the client config
06:29 <@dazo> (or any push statements on the server, which pushes redirect-gateway)
06:30 < screensilently> dazo: thank you. is there any web interface that i could manage the users of openvpn?
06:31 <@dazo> screensilently: I dunno ... what's to manage?  you issue certificates to clients and give them a config file in addition ... for this, you normally don't have to touch the server at all
06:32 < screensilently> dazo: actually i want to set the IP every client will get
06:32 <@dazo> screensilently: why?
06:33 < screensilently> dazo: because i want the clients to have static ips
06:33 <@dazo> duh ... but why do you want static IPs?
06:34 < screensilently> what's the problem with that? :/
06:34 <@dazo> its not a problem, if it has a good use case .... many who setup OpenVPN wants static IPs without knowing why ... and that just complicates things without reason
06:35 < screensilently> dazo: well, i'm making a private network for my computers, that have dynamic ips.
06:35 < screensilently> and i just want static IPs
06:36 <@dazo> There are very few use cases where static IPs are a good solution, in general ... which is when you need to pass several firewalls with special routes ...
06:36 < screensilently> what's the way to do it?
06:36 <@dazo> What is a better approach is to add dynamic DNS ... that way, you don't care about IPs, but you identify them by a host name
06:36 < fbh> Why care for the reason?  Look at http://openvpn.net/index.php/open-source/documentation/howto.html#policy 
06:36 <@vpnHelper> Title: HOWTO (at openvpn.net)
06:37 <@dazo> fbh: because without caring why, people do stupid things, thinking it is clever .... also known as education
06:37 < Bushmills> !ccd
06:37 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
06:37 < Bushmills> !nsupdate
06:37 <@vpnHelper> "nsupdate" is http://scarydevilmonastery.net/client_connect_nsupdate for a script Bushmills wrote to solve the question How can my vpn update my nameserver?
06:38 <@dazo> thx, Bushmills  :)
06:41 <@vpnHelper> RSS Update - forum: Issue with multiple instance (tcp & udp) <http://forums.openvpn.net/topic8207.html#p12492>
06:43 < screensilently> ccd/user1 is the username i created the certificate with, right?
06:44 < Bushmills> it is what you have given as CN or Common Name
06:46 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
06:51 < screensilently> Bushmills: no it doesn't work
06:51 < screensilently> don't*
06:51 < screensilently> it still give what ip it wants
06:57 < screensilently> no it worked
06:57 < screensilently> thanks
07:01 < screensilently>     ifconfig-push 10.8.2.1 10.8.2.2
07:01 < screensilently> what's the second ip means?
07:01 < screensilently> "Each pair of ifconfig-push addresses represent the virtual client and server IP endpoints. "
07:01 < screensilently> but what it does?
07:04 < Bushmills> either p-t-p address, or netmask. depending on whether you use tun or tap
07:08 < screensilently> and what's that exactly?
07:09 < Bushmills> client's local representation of "other end of tunnel"
07:10 < screensilently> whis is my server?
07:10 < Bushmills> client? no, client is not server
07:11 < screensilently> and what's exactly the representation does/mean?
07:11 < Bushmills> just a way for client to deal with concept of "remote machine" without knowing actual addresses
07:11 < screensilently> ok thank
07:12 < Bushmills> consider it a sort of placeholder for the real remote address
07:13 < screensilently> understood that. i'm totally new to VPNs and they seem pretty interesting
07:13 < screensilently> (to play with)
07:26 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
07:35 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:35 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:40 <@dazo> !topology
07:40 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
07:41 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
07:56 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
07:56 -!- screensilently [screensile@gateway/shell/anapnea.net/x-umsxzzquidsdoctu] has left #openvpn []
07:57 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 246 seconds]
08:04 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Quit: Leaving]
08:04 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
08:06 < dvl> OK, I keep saying it, but it's so great being able to backup my laptop from remote locations.  Bacula + OpenVPN.
08:06 < dvl> *skip* *skip* *skip* *skip* 
08:06 < ecrist> dvl: :)
08:20 < mick_laptop> Bushmills: you up?
08:30 -!- zheng [~chatzilla@180.157.8.140] has joined #openvpn
08:31 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
08:32 -!- zheng [~chatzilla@180.157.8.140] has quit [Client Quit]
08:36 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:36 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has joined #openvpn
08:36 -!- maxJadi [~maxJadi@h192n3-g-kt-d1.ias.bredband.telia.com] has quit [Changing host]
08:36 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:39 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
08:39 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:39 < wangerin1> Hi! Is It possible to push an extra IP-adress til clients via ccd (or client-connect-script)?
08:41 < xsurfer> how can I change the speed of my tun0
08:42 < Bushmills> mick_laptop: for a few minutes, yes
08:43 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
08:43 < Bushmills> i'm at the fast food stand atm :)
08:43 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Read error: Operation timed out]
08:44 < Bushmills> ah. missed your prev. message.   openvpn,  backfire
08:45 < Bushmills> ehm .. openwrt, backfire, i mean
08:47 < Bushmills> with config set to "custom config", which means, not the openwrt config support for openvon is used, but instead a plain openvpn config file.
08:48 < Bushmills> http://scarydevilmonastery.net/snap/1306244851170406813d.png 
08:48 < mick_laptop> thanks
08:48 < mick_laptop> what model was it again?
08:49 < mick_laptop> thought it would be in my web history
08:49 < Bushmills> just ordered me another one of those tp-link wr1043nd.  40 EUR incl shipping.  about 56 $
08:49 < mick_laptop> wow
08:50 < Bushmills> comes with 4 gigabit ethernet ports, usb 2.0, atheros wlan controller.
08:50 < Bushmills> 8 MiB flash, 32 MiB RAM
08:51 < Bushmills> reflashing is a snap.  "firmware upgrade" from the original web config
08:51 -!- manitu [~manitu@p578b0cfb.dip0.t-ipconnect.de] has joined #openvpn
08:52 < manitu> hi.. its me again.. thank you again for yesterday dazo, helped me rly much :)
08:52 < Bushmills> 400 MHz MIPS CPU. low power design.
08:52 < mick_laptop> ok, where do i order one of these things?
08:52 < Bushmills> check on amazon
08:54 <@vpnHelper> RSS Update - forum: Rapto Openvpn - Error Message <http://forums.openvpn.net/topic8208.html> || Issue with multiple instance (tcp & udp) <http://forums.openvpn.net/topic8207.html#p12493>
08:54 < manitu> but now i got one more problem.. just one thing is not running.. my openvpn network is 10.0.0.0/24 and my server got a network 192.168.0.0/24 and i want to access it by openvpn.. i can ping the 196.168er ip of the server but not anyone else(already read something about the ipv4_forwarding, but can't get it work.. the server runs on a suse system)
08:55 < Bushmills> !route
08:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
08:55 < Bushmills> !serverlan
08:55 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
08:55 -!- Lenhix [ElChaman@srvmail.servimos.com.co] has joined #openvpn
08:56 < manitu> already did: push "route 192.168.0.0 255.255.255.0" in the server config
08:56 < manitu> !ipforward
08:56 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
08:56 < manitu> !linipforward
08:56 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
08:58 < manitu> tried the first one already.. trying sysctl.conf now
09:00 < Bushmills> but - you intend client to reach 192.168.xxx.xxx net - why do you set the route on server?
09:00 < manitu> the only thing that could be a problem.. do the openvpn masq the packets? .. because the 192.168.0.0/24 network doesn't know the 10.0.0.0/24.. and my openvpn server isn't the default gateway in the network
09:00 < Bushmills> i assume server know already how to reach the net on its 192.168.xxx.xxx interface
09:01 < Bushmills> oh, sorry.  push - i missed that one
09:01 < manitu> yea.. the server knows.. but i think the one i ping don't know where to answer to
09:01 < Bushmills> openvpn doesn't masquerade anything
09:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:02 < manitu> hm.. so i need to configure the routing in the default gateway or at every client
09:02 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
09:03 < Bushmills> if openvpn server is also default gateway of lan machines, 10.x.x.x packets reach server - which has a route to openvpn interface
09:03 < Bushmills> if not, it may make more sense to add a route to the default gateway, rather than to each client
09:04 < manitu> yea.. trying to configure a static route on one of the computers, just to try it.. thank you (:
09:05 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 258 seconds]
09:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
09:19 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Read error: Connection reset by peer]
09:20 -!- rkantos [robin@hp1.jaketus.net] has quit [Read error: Operation timed out]
09:24 <@vpnHelper> RSS Update - forum: Rapto Openvpn - Error Message <http://forums.openvpn.net/topic8208.html#p12495>
09:36 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:41 -!- jaminja [~jaminja@rijkdijk2.demon.co.uk] has quit [Changing host]
09:41 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
09:55 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
09:57 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:05 -!- newmember_ [~chatzilla@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
10:06 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 252 seconds]
10:06 -!- newmember_ is now known as newmember
10:10 -!- newmember [~chatzilla@S010600036d1139bb.cg.shawcable.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
10:24 -!- bent_screwdriver [~UserNick@74.255.249.66] has joined #openvpn
10:25 < bent_screwdriver> can you have multiple instances of openvpn writing to the same status log?
10:28 <@dazo> bent_screwdriver: I doubt it, to be honest
10:28 <@dazo> well, you can do it ... but you can't rely on which process did the last update
10:30 < bent_screwdriver> thats what i figured. I guess they would constantly overwrite each other. i guess i can test....and maybe combine them with a script.
10:39 -!- brabo [brabo@globalshellz/owner/brabo] has joined #openvpn
10:39 < brabo> !welcome
10:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:39 < brabo> !goal
10:39 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:40 < brabo> !/30
10:40 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
10:42 <@vpnHelper> RSS Update - forum: Doubt About multiple instances openvpn <http://forums.openvpn.net/topic8198.html#p12497> || MacOS client conect but can get internet <http://forums.openvpn.net/topic8209.html>
10:47 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
10:47 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
10:50 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 252 seconds]
10:51 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
10:55 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Quit: WeeChat 0.3.4]
10:56 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
10:56 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
11:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:07 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
11:12 <@vpnHelper> RSS Update - forum: MacOS client conect but can get internet <http://forums.openvpn.net/topic8209.html#p12498>
11:13 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
11:15 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
11:19 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
11:23 -!- sj7trunks [~Adium@171.67.167.23] has joined #openvpn
11:32 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has quit [Ping timeout: 276 seconds]
11:34 < mick_laptop> Bushmills: thanks again
11:35 < mick_laptop> i just ordered mine
11:35 < mick_laptop> next day delivery
11:35  * mick_laptop crosses fingers - that it gets here soon
11:36 < Bushmills> how much was it?
11:38 < mick_laptop> $56 - $20 -> shipping
11:39 < mick_laptop> Bushmills: i hope you don't mind if i poke you if i have issues tomorrow :D -- should be straight forward though
11:39 < Bushmills> 20 $ on top of the 56 $?
11:39 < mick_laptop> yup
11:39 < Bushmills> hm
11:39 < mick_laptop> rush delivery charge
11:39 < Bushmills> ah
11:39 < mick_laptop> since i need it soon
11:39 < Bushmills> i'd advise to use openwrt, not dd-wrt
11:40 < mick_laptop> i had a bad experience w/ dd-wrt so far
11:40 < Bushmills> some dd-wrt folks had problems setting up openvpn 
11:40 < mick_laptop> couldn't get openvpn to even start
11:40 < Bushmills> ah. that
11:40 < mick_laptop> some? tell me *one* who got it running
11:40 < Bushmills> i only know of those who failed. those who managed didn't say so
11:40 < mick_laptop> i've looked and searched - noone in #dd-wrt uses openvpn
11:40 < Bushmills> if there are any, that is
11:41 < mick_laptop> i logged in and did a `ps ax | grep vpn` after it was enabled and supposedly running -> nothing showed up
11:42 < Bushmills> well, for the money you staid below the may of 200$ you hoped for, you can afford a nice usb stick to extend the router flash
11:42 < Bushmills> max
11:43 < Bushmills> those micro-sd to usb adapters are very small, and those make a formidable usb stick
11:45 < Bushmills> http://www.dealextreme.com/p/world-s-smallest-microsd-transflash-tf-sd-sdhc-usb-2-0-card-reader-keychain-green-21811  is the one i'm using
11:45 <@vpnHelper> Title: $1.23 - World's Smallest MicroSD TransFlash TF SD/SDHC USB 2.0 Card Reader Keychain (Green) - Card Readers (at www.dealextreme.com)
11:56 < mick_laptop> Bushmills: the flash doesn't need to be that big does it?
11:56 < mick_laptop> i mean for 2-3 people connected to it
11:57 < Bushmills> nope.  mine is 1 GiB.  enough to carry several netboot images, in addition to a lot of non-vital programs
11:58 < mick_laptop> netbooting is something i haven't done in a while :) though tftpd + bootp have served me well over the years
11:58 < Bushmills> vital services and program i keep in on-board flash. optional stuff is on usb stick
11:58 < mick_laptop> esp. w/ sparc hardware
11:59 < Bushmills> that way i the router boots and runs with or without usb flash extension
12:00 < mick_laptop> Bushmills: which one did you use: http://downloads.openwrt.org/backfire/10.03/
12:00 <@vpnHelper> Title: Index of /backfire/10.03/ (at downloads.openwrt.org)
12:00 < Bushmills> ar71xx i think.  look at the supported hardware page on the openwrt wiki, that links the proper image
12:01 < Bushmills> http://downloads.openwrt.org/backfire/10.03/ar71xx/openwrt-ar71xx-tl-wr1043nd-v1-squashfs-factory.bin should be the right one
12:03 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
12:03 < Bushmills> http://wiki.openwrt.org/toh/tp-link/tl-wr1043nd  here you are
12:03 < mick_laptop> ah thanks
12:06 < mick_laptop> i haven't been this excited to order a router before -heh
12:08 < Bushmills> you'll get used to it, once it has been sitting on your desk for a few months
12:08 <@vpnHelper> RSS Update - forum: sharing a folder with vpn:not works! <http://forums.openvpn.net/topic8191.html#p12499>
12:12 < Bushmills> http://stats.scarydevilmonastery.net/lan  here are some router graphs. cpu and ram use may be interesting
12:12 <@vpnHelper> Title: Munin :: lan (at stats.scarydevilmonastery.net)
12:14 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
12:27 -!- Lenhix [ElChaman@srvmail.servimos.com.co] has quit [Quit: Mindwall!!]
12:32 -!- dazo is now known as dazo_afk
12:36 -!- xortham314 [~xortham31@65.87.32.252] has joined #openvpn
12:43 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
12:48 -!- xortham314 [~xortham31@65.87.32.252] has quit [Quit: xortham314]
12:59 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
13:02 -!- hardwire [~spencersr@69-161-26-211.static.acsalaska.net] has left #openvpn []
13:02 <@vpnHelper> RSS Update - forum: Post Auth Script: based on client's computer MAC address <http://forums.openvpn.net/topic8210.html>
13:06 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
13:11 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Operation timed out]
13:23 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:33 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
13:40 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
13:51 -!- culinor [~Freedom@95.169.194.114] has joined #openvpn
13:51 < culinor> hello
13:51 < culinor> could you please tell me how to make my irc client connect using my openvpn?
13:51 < culinor> it now connects with my real IP
13:54 -!- catsup_ [d@ps38852.dreamhost.com] has joined #openvpn
13:55 < Bushmills> culinor: route your traffic through openvpn, or connect to a bouncer through openvpn
13:55 < culinor> how do i route my irc client to openVPN, openVPN is currently installed and connected
13:55 < Bushmills> bouncer on openvpn server would be a suited candidate. something like dircproxy, for example
13:56 < culinor> i have my vpn IP set
13:56 < Bushmills> then your IRC client connects to bouncer on server, which in turn is connected to irc server 
13:57 < Bushmills> alternatively, ...
13:57 < Bushmills> !redirect
13:57 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:57 < culinor> i want to connect directly with my irc client
13:57 < culinor> maybe i have to deal with the irc client network setup?
13:58 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 264 seconds]
13:58 < Bushmills> if you connect "directly" with your irc client, you will connect "directly" using the ip address of your client
13:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Connection reset by peer]
13:58 < Bushmills> either let server NAT your traffic, or proxy it
14:00 < Bushmills> i suggest proxying it, as server can log incoming traffic even when your client is offline 
14:00 < culinor> why does it choose to connect with my external IP address, not via my VPN IP address
14:00 < culinor> proxy what?
14:00 < culinor> my client?
14:00 < Bushmills> traffic
14:01 < Bushmills> your vpn address is probably an rfc1918 address - nothing can be sent back to from internet to such an address
14:02 < culinor> it's 50.2.1.6
14:02 < culinor> i followed the instructions in here - darknet dot me / join dot html
14:03 < culinor> it says nothing about proxy
14:03 < Bushmills> you're with eonix, and use a public ip address for vpn??
14:03 < culinor> eonix?
14:03 < culinor> don't know what eonix means
14:04 < Bushmills> that's the netblock owner of the ip address you gave me
14:04 < Bushmills> pinging that address goes to their network
14:05 < culinor> probably
14:05 < Bushmills> how are you supposed to see irc traffic when replies are sent to them?
14:06 < Bushmills> or did you just pick that address randomly for your vpn?
14:06 < culinor> i don't know, when i use proXPN it does everything for me
14:06 < culinor> no, it's assigned by their DHCP server via VPN
14:07 -!- manitu [~manitu@p578b0cfb.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
14:07 < culinor> the DHCP server's address is 50.2.1.0
14:07 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html>
14:07 < Bushmills> as vpn subnet address, you probably want something from these ranges:  http://en.wikipedia.org/wiki/Private_network
14:07 <@vpnHelper> Title: Private network - Wikipedia, the free encyclopedia (at en.wikipedia.org)
14:07 < Bushmills> preferably from the 10.x.x.x network
14:08 < culinor> but I get my address via their DHCP server
14:09 < Bushmills> and that goes through openvpn?
14:10 < culinor> yes
14:11 < Bushmills> what is the the difference between "real ip" and "openvpn ip"?
14:11  * ecrist coins PinoccioVPN
14:12 < Bushmills> ~Freedom@95.169.194.114
14:12 < Bushmills> that's not 50.2.1.6
14:12 < culinor> I think the problem is it doesn't change my Gateway addres
14:13 < culinor> that's why it's connecting via my ISP's gateway address
14:13 < Bushmills> (20:55:08) Bushmills: culinor: route your traffic through openvpn, or connect to a bouncer through openvpn
14:14 < culinor> how am I supposed to route my traffic, I have to play with my router's settings or change my gateway address?
14:14 < Bushmills> (20:57:09) Bushmills: !redirect
14:14 < Bushmills> !redirect
14:14 < culinor> they say nothing about it on their website
14:14 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:15 < culinor> !def1
14:15 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
14:15 < culinor> !ipforward
14:15 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:16 < culinor> i am not sure it has to be that difficult :/
14:17 < Bushmills> if you send traffic through openvpn, with the idea that server on the other end unleashes that traffic on internet again, the server has to play along.
14:17 < Bushmills> that is not something openvpn has to do, but the server 
14:18 < Bushmills> openvpn merely transports your traffic to the server
14:18 < culinor> I think the problem is OpenVPN doesn't change my gateway address
14:18 < Bushmills> why should it?
14:19 < Bushmills> if it doesn't, maybe you didn't instruct openvpn to tell your client to do so
14:19 < culinor> i will try to figure it out
14:19 < culinor> I did what it says on the page
14:19 < Bushmills> !howto
14:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:19 < culinor> could you see it for me?
14:20 < Bushmills> i don't feel like debugging other people's messed up instructions
14:20 < Bushmills> you do it :)
14:21 < culinor> thanks, i will see HOWTO
14:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:33 -!- culinor [~Freedom@95.169.194.114] has quit [Read error: Connection reset by peer]
14:33 -!- culinor [~Freedom@95.169.194.114] has joined #openvpn
14:36 -!- culinor [~Freedom@95.169.194.114] has quit [Read error: Connection reset by peer]
14:36 -!- culinor [~Freedom@95.169.194.114] has joined #openvpn
14:41 -!- culinor [~Freedom@95.169.194.114] has quit [Read error: Connection reset by peer]
14:43 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:47 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has joined #openvpn
14:47 <@vpnHelper> RSS Update - forum: Configure a specific MAC Address to a designated IP Address <http://forums.openvpn.net/topic8212.html>
14:48 -!- B|aster [Baster@S0106001b1162347e.ok.shawcable.net] has left #openvpn []
14:48 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
15:01 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
15:18 -!- bent_screwdriver [~UserNick@74.255.249.66] has quit [Quit: Going offline, see ya! (www.adiirc.com)]
15:36 -!- bent_screwdriver [~UserNick@74.255.249.66] has joined #openvpn
15:37 -!- bent_screwdriver [~UserNick@74.255.249.66] has quit [Client Quit]
15:38 -!- bent_screwdriver [~UserNick@74.255.249.66] has joined #openvpn
15:39 -!- bent_screwdriver [~UserNick@74.255.249.66] has quit [Client Quit]
15:40 -!- bent_screwdriver [~UserNick@74.255.249.66] has joined #openvpn
16:05 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 260 seconds]
16:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
16:17 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
16:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:18 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:33 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 240 seconds]
16:35 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
16:41 -!- Lenhix [ElChaman@190.146.247.20] has joined #openvpn
16:56 -!- sj7trunks [~Adium@171.67.167.23] has quit [Quit: Leaving.]
17:00 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:12 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html#p12505> || Post Auth Script: based on client's computer MAC address <http://forums.openvpn.net/topic8210.html#p12504> || sharing a folder with vpn:not works! <http://forums.openvpn.net/topic8191.html#p12503>
17:18 <@vpnHelper> RSS Update - forum: Configure a specific MAC Address to a designated IP Address <http://forums.openvpn.net/topic8212.html#p12506>
17:19 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
17:23 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:23 -!- mode/#openvpn [+o raidz] by ChanServ
17:23 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
17:24 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
17:40 -!- josi [~josi@HSI-KBW-085-216-049-243.hsi.kabelbw.de] has joined #openvpn
18:07 -!- Lenhix [ElChaman@190.146.247.20] has quit [Quit: Mindwall!!]
18:10 -!- josi [~josi@HSI-KBW-085-216-049-243.hsi.kabelbw.de] has quit [Remote host closed the connection]
18:22 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Ping timeout: 276 seconds]
18:30 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 240 seconds]
18:38 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
18:57 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
19:12 <@vpnHelper> RSS Update - forum: "TLS soft reset" issue <http://forums.openvpn.net/topic8200.html#p12507>
19:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 244 seconds]
20:00 <@vpnHelper> RSS Update - forum: "TLS soft reset" issue <http://forums.openvpn.net/topic8200.html#p12508>
20:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:02 < oc80z> any dual-wan/vpn admins in the house
20:02 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
20:04 < oc80z> i set up an openvpn-client on wifi and another openvpn-client on ethernet
20:06 < oc80z> ...not going to go in to details about anything else, but i had a question.
20:06 < oc80z> thanks.
20:09 < Rajko> hey, whats svn or git of openvpn-testing with ipv6 and everything enabled ?
20:09 < Rajko> allmerged
20:09 < Rajko> somethin
20:11 -!- master_of_master [~master_of@p57B5592B.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
20:12 -!- master_of_master [~master_of@p57B557D4.dip.t-dialin.net] has joined #openvpn
20:18 <@vpnHelper> RSS Update - forum: New to OpenVPN, how do I tunnel ssh and ftp? <http://forums.openvpn.net/topic8213.html>
20:34 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:44 < ecrist> Rajko: let me grab that
20:44 < ecrist> !git
20:44 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git, or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git,, or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi, or (#4) See !git-doc how to use git
20:44 < ecrist> :)
20:45 < Rajko> but i need to switch to allmerged branch
20:45 < Rajko> something like that
20:45 < Rajko> i forgot
20:45 < Rajko> found a webpage once that said what to od
20:49 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 250 seconds]
20:51 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:52 < bystander> my openvpn and apache server port conflicts. how to resolve this?
20:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:54 < Rajko> why is it conflicting
20:55 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
20:55 < krzie> by changing the vpn to not run on port 80 tcp
20:55 < krzie> lol
21:00 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 246 seconds]
21:00 < bystander> can I change rather the port of the apache server?
21:01 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
21:01 < Rajko> why is openvpn running on 80 tcp
21:01 < Rajko> the preferred protocol is udp
21:01 < Rajko> and the default port isnt 80
21:02 < bystander> rajko: I use tcp on port 80.  what port do you use on your udp?
21:02 < Rajko> the default
21:02 < bystander> when I use udp, I got several replay errors when gaming, but none in tcp
21:03 < bystander> that is why I choose tcp instead.
21:03 < Rajko> so run it under tcp ?
21:03 < Rajko> but choose a port that isnt http ?
21:04 < Rajko> i think you will have much much bigger problems when gaming if you use tcp openvpn
21:04 < Rajko> and the game is udp
21:05 < krzie> if the game is udp it will be fine
21:05 < krzie> its tcp over tcp that gets the issues
21:05 < krzie> well when i say fine, i mean much better than if it was tcp
21:05 < krzie> im not saying its necessarily ideal
21:05 < Rajko> still its not good
21:05 < krzie> i mean there IS likely a reason they chose udp in the first place...
21:06 < krzie> !tcp
21:06 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
21:07 < bystander> i read the issue many times. so I have also tried udp. but just I said it gives me so many replay errors.  if only I can stabilize the udp connection.
21:08 < Rajko> the game should be able to handle packet loss itself
21:08 < Rajko> theres no need to mess up the rest of your network because of it
21:10 < bystander> why do you think I am having so many replay errors? do you have any ideas why such replay occurs?
21:10 < bystander> also when torrenting?
21:11 < Rajko> what are "replay errors"
21:11 < Rajko> krzie, also udp over tcp isnt good, because most udp protocol use packet loss as a determinant of congestion
21:11 < Rajko> when you tunnel it over tcp there wont be any packet loss
21:12 < krzie> the udp stream inside the tcp stream would still be the same
21:12 < krzie> oh no, that is false
21:12  * krzie pulls his foot out of his mouth
21:13 < Rajko> what i said is false ?
21:13 < krzie> no no, what i said was
21:13 < krzie> you are right
21:13 < bystander> rajko: I forgot the whole replay description error.
21:13 < Rajko> a game server, seeing no packet loss, would increase packet sent rate towards client, congesting it
21:13 < Rajko> so latency would just continually keep increasing
21:14 < Rajko> bystander, if your connection has lots of packet loss or reorderng, you might want to increase the reordering queue size if you are using authetnciation
21:16 < bystander> rajko: reordering queu size? can you teach me how. or show me how. I have not done that yet.
21:16 < Rajko> or simply disable packet authentication
21:16 < Rajko> most cases its not a big deal
21:17 < bystander> rajko: can you show me how. I have not done this yet.
21:18 < Rajko> auth noe
21:18 < Rajko> auth none
21:18 < Rajko> in both client and server config
21:18 < bystander> wait let me see
21:19 < bystander> im using auth sha1
21:19 < bystander> so I am going to replace that to auth none to disable packet authentication thereby resolving the replay errors?
21:20 < bystander> rajko: so I am going to replace that to auth none to disable packet authentication thereby resolving the replay errors?
21:21 < Rajko> i still dont know what you mean by replay errors
21:21 < Rajko> where do you see that
21:21 < Rajko> post the exact message
21:24 < bystander> rajko: I cant because im on wired connection right now and it is somewhat stable when wired.
21:25 < bystander> rajko: can you advice me more so I have a stable udp connection aside from using auth none.
21:28 < Rajko> udp doesnt have connections
21:29 < Rajko> by using udp youre closer to the way the packets would have gone when they werent tunneled
21:29 < Rajko> so it cant work worse
21:30 < bystander> oh sorry. what I mean is stabilizing packet
21:30 < bystander> so that I have less packet loss
21:30 < Rajko> you cant have less packet loss than you did before tunnelling
21:31 < bystander> it seems that way when I got several replay errors I guess
21:31 < Rajko> is Replay-window backtrack occurred [ the error youre getting ?
21:32 < bystander> yes that's it
21:32 < Rajko> thats not an error
21:32 < Rajko> just a notice
21:32 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
21:32 < Rajko> if you dont want to see it, change verb to something less than 4
21:32 < bystander> but if I get that error, the connection restarts
21:33 < Rajko> if you get that error, it means your connection has dropped
21:33 < Rajko> and THATS why the connection restarts
21:33 < Rajko> not because of openvpn
21:33 < ecrist> sup bitches?
21:33 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:34 < bystander> so you everytime I got that replay error, the connection has dropped.  Is there a way not to drop the connection?
21:34 < Rajko> its not an error
21:35 < Rajko> but in your case it happens because your connection drops
21:35 < bystander> rajko: i see. any advice to minimize that connection dropping?
21:35 < Rajko> fix your connection ?
21:36 < bystander> but I guess my connection is good because I have no problem under tcp. but I would like to use udp.
21:37 < Rajko> you do have a problem under tcp.
21:37 < ecrist> !tcp
21:37 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
21:37 < Rajko> no packets would arrive while your connection is dropped, and then a ton of them would surge through after it reconnects
21:37 < Rajko> fix the initial connection drops.
21:38 < bystander> no I dont get problem same in udp.  but as I have read, udp is better. so I would like to use udp and configure udp right.
21:38 < Rajko> you do get the problem, its just masked by long tcp timeouts
21:38 < bystander> initial connection drop. but I dont know what is the cause of the connection drop under udp/
21:38 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
21:38 < Rajko> the connection drops in both modes
21:39 < Rajko> connection drops = no packets are able to go out, no packets are received
21:40 < bystander> rajko: how would like know the there have been connection drop? as I can see in my modem that there are activity going on. how to fix it then if there is connection drop.
21:40 < Rajko> you said you were wired atm
21:40 < Rajko> and that its fine then
21:41 < bystander> yes. but most of the time when I am not in the office, I am wireless.
21:41 < Rajko> wireless what
21:41 < Rajko> 3g, NLOS, or just 802.11b/g/n
21:42 < bystander> wireless connection with wireless modem 3g.
21:42 < Rajko> i guess you have to use tcp then
21:43 < bystander> rajko: will that be our last recourse?
21:43 < Rajko> if you have transient connection loss that lasts more than 5 seconds, yes
21:44 < Rajko> 3g connections usually suck hard
21:45 < Rajko> between the huge latency and big lag spikes, how do you expect to play game
21:45 -!- Proz01d [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
21:45 < bystander> I see.  thanks for the advice.  anyway last question, you said I should use auth none.  if I also omit cipher and comp-lzo, will it improve connection?
21:45 < Rajko> dont omit comp-lzo
21:45 < Rajko> dont omit cipher because that will destroy security
21:46 < bystander> ah ok.
21:46 < Rajko> auth none will remove some overhead from the connection
21:46 < Rajko> you should also use mssfix
21:46 < bystander> i have used mssfix at 1400
21:47 < Rajko> actually you dont need mssfix under protocol tcp
21:47 < bystander> tun-mtu-extra 32, tun-mtu 1500. what do you think?
21:47 < Rajko> remove all that
21:47 < ecrist> bystander: did you run the mtu test?
21:47 < Rajko> dont just add random things
21:47 < bystander> ecrist: not yet. I just read the manpage and some advice in google.
21:47 < ecrist> gah!
21:47 < ecrist> !mtu
21:47 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
21:48 < ecrist> read the writeup by quadDamage 
21:48 < Rajko> ecrist, mtu-test doesnt seem to work on openvpn-testing
21:48 < ecrist> Rajko: ?
21:48 < Rajko> says invalid command
21:48 < Rajko> even tho its there in help
21:48 < ecrist> well, help is just sourced in text, it's not auto-generated with soap or anything
21:48 < bystander> before when I did not place the mtu, mtu-extra and mssfix, my connection to the server does not work but having those options make it work.
21:49 < bystander> I guess that depends upon such situation.
21:50 < bystander> when to use and not to use such options.
21:50 < Rajko> if you are tunnelling over tcp you might as well have unlimited mtu
21:50  * ecrist builds from current
21:50 < Rajko> as ip fragmentation isnt used under protocol tcp
21:50 < ecrist> bystander: tcp is a bad idea.  see the paste from vpnHelper above
21:50 < ecrist> Rajko: you're incorrect
21:50 < bystander> rajko: I will check opn that.
21:50 < ecrist> the problem is too much fragmentation
21:50 < Rajko> it is, but he has disconnection periods, during which he wants his udp game to stay connected
21:51 < ecrist> heh, running udp over tcp is just stupid
21:51 < bystander> ecrist: I have read about that earlier.
21:51 < Rajko> ecrist, why would openvpn use ip fragmentation when sending tcp data ?
21:52 -!- Proz01d [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
21:52 < ecrist> Rajko: it's part of the TCP stack
21:53 < ecrist> and basic networking
21:53 < ecrist> read up on MTU and how fragmentation works.
21:53 < ecrist> with TCP and TCP, you can end up with gross over-fragmentation
21:54 < bystander> ecrist: do you have other idea on how to improve the connection dropping on my udp while gaming?
21:55 < Rajko> bystander, thats a problem with your connection not openvpn
21:55 < ecrist> so, you have a link which is good at 1440, and have a TCP packet at 1500, the network stack will get a retransmit with the proper MTU along the way and you'll end up with a 1440 bit packet and a 60 bit packet, the 60 bit packet takes the same time/effort as a 1440 bit packet, but only 60 bits was uses.
21:55 < Rajko> you can try shortening the keepalive interval
21:55 < ecrist> bystander, the problem with udp inside TCP is tcp will try to make sure EVERY packet makes it intact.  the whole point to UDP is it's best-effort
21:56 < Rajko> ecrist, which is why mssfix is useful
21:56 < ecrist> games use it because,  if a packet is bad, by the time you fix it, we don't care
21:56 < ecrist> so just drop it
21:56 < Rajko> also, bit ? you mean byte
21:56 < ecrist> you need a UDP tunnel
21:56 < ecrist> Rajko: you're right, apologies.
21:56 < Rajko> if he uses mssfix, no parameters, it will calculate the mss size based on the remaining mtu for userdata
21:57 < ecrist> mtu-test should work
21:57 < ecrist> if he's using git, it's a crap-shoot
21:57 < ecrist> we recomment 2.2.0 for all users at this point
21:57 < bystander> rajko I have keepalive 5 120
21:58 < Rajko> bystander, keepalive is on the server config only
21:58 < ecrist> Rajko: current snapshot mtu-test seems functional
21:58 < bystander> yes true
21:59 < ecrist> bystander: run mtu-test
22:00 < Rajko> ecrist, do you know how to build openvpn so it uses custom location of openssl lib ?
22:00 < bystander> yes it says 1460
22:02 < bystander> anyway thank you guys. I have another idea learned.
22:02 < ecrist> bystander: read the mtu links above, set appropriate settings
22:02 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
22:03 < ecrist> Rajko: there is info on how to do that, but it's ill-advised, currently.
22:07 < Rajko> ecrist, because openssl 1.0.0 with AES-NI patch has much much better aes crypto perf
22:07 < Rajko> however the rest of my system requires 0.9.8
22:07 < Rajko> so i would like to statically link openvpn with openssl static lib 1.0.0
22:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
22:09 < ecrist> Rajko: search the mail lists and meeting logs.  iirc, there is a bug when compiling against 1.0.0
22:10 < Rajko> meeting logs ?
22:10 < ecrist> yes
22:10 < ecrist> they're on the mailing list
22:15 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:15 < gyyrog> mac os x just asked me if I want to let openvpn to accept incoming network connections. It is a client only. why would it want to do this?
22:15 < ecrist> you wouldn't
22:16 < ecrist> I"ve never heard of mac os x asking about things like that
22:16 < gyyrog> me either
22:16 < Rajko> windows firewall does it on anything that either 1. binds to a specific port on tcp 2. uses udp
22:16 < gyyrog> it wants to change the firewall
22:17 < ecrist> Mac OS X doesn't, I dont' think
22:21 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:21 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
22:27 <@vpnHelper> RSS Update - forum: New to OpenVPN, how do I tunnel ssh and ftp? <http://forums.openvpn.net/topic8213.html#p12510>
22:28 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:28 < Proz01d> hey guys... my openvpn server will not start.  When i execute " sudo /etc/init.d/openvpn restart" the restart fails.  I have check the logs but there are no new entries.  What's going on?  (verb = 9)
22:28 < Proz01d> should mention that the location of the log files in the server.conf was what i checked
22:29 -!- kuszja [~Sidein@cpe-98-27-142-187.neo.res.rr.com] has joined #openvpn
22:30 < kuszja> hello
22:30 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
22:30 < ecrist> Proz01d: try just running 'openvpn --conf /path/to/server.conf
22:30 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:31 < kuszja> I set up openvpn on my server but when my friend connects, he cannot see any of my internal computers. This is my frist time setting up a vpn.
22:33 < kuszja> Here's my server.conf: http://pastebay.com/124255
22:36 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
22:38 < Proz01d> kuszja: you need to setup a bridge'd vpn
22:38 < Proz01d> you have tun selected.
22:38 < kuszja> ethernet-bridging?
22:39 < kuszja> I'll get started on that. I've not worked with vpn's before so idk what I am doing yet.
22:39 < Proz01d> !bridge
22:39 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc, or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ, or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
22:40 < Proz01d> there are the links
22:40 < kuszja> thank you
22:40 < Proz01d> np
22:42 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
22:42 < Proz01d> ecrist: Thanks!
22:45 < Proz01d> 1 single space missing!
22:45 < Proz01d> ecrist you are the man!
22:46 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
22:52 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
22:53 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:55 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Client Quit]
22:56 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
22:56 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:57 < Proz01d> !welcome
22:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:58 < Proz01d> !interface
22:58 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
23:21 <@vpnHelper> RSS Update - forum: Tutorial how to connect server A to server B <http://forums.openvpn.net/topic8214.html>
23:29 -!- flowbee [~flowbee__@c-98-232-28-104.hsd1.wa.comcast.net] has joined #openvpn
23:30 < flowbee> hi folks... is there a way to make openvpn apply for a particular type of internet using?  such as for browsing but not for other types of connections
23:30 < flowbee> i.e. mysql traffic, sending mail etc
23:31 < Rajko> use iptables and mark/fwmark
23:32 < flowbee> might you have an example?
23:32 < flowbee> i'm pretty much a noob
23:35 < Rajko> this is assuming linux client
23:35 < Rajko> its outside the scope of openvpn
23:35 < Rajko> use your OS's firewall
23:37 < flowbee> but it seems like by default openvpn will route all traffic though it
23:37 < flowbee> and i want to selectively pick some traffic that i want to move through openvpn
23:37 < flowbee> such as web browsing
23:37 < flowbee> you're telling me this is an ubuntu issue?
23:38 < hyper_ch> the OS decides what goes through which pipe, not openvpn
23:45 < flowbee> well a simple example would really help me out
23:46 < Proz01d> flowbee: what os are you using?
23:46 < flowbee> Proz01d, ubuntu 10.04
23:46 < Proz01d> flowbee:  kool... get ufw
23:46 < Proz01d> then you can do simple commands like "ufw allow 80"
23:46 < flowbee> ok i just installed it
23:47 < Proz01d> which will unblock port 80
23:47 < Proz01d> (ie. allowing webpages)
23:47 < flowbee> so is this before/after i've connected to an openvpn server?
23:47 < Proz01d> has nothing to do with openvpn
23:48 < Proz01d> openvpn is just software to allow remote computers to connect to your machine as if you were networking with them in a room.
23:48 < flowbee> ok well i understand the basics of a firewall and closing/opening ports
23:48 < Proz01d> the OS which openvpn runs on decides what communication to allow to the server
23:49 < Proz01d> so all these firewall changes are independent of openvpn
23:49 < flowbee> well it seems as though ubuntu 10.04 sends all traffic through the vpnserver
23:49 < flowbee> when i connect to the openvpn server
23:49 < Proz01d> if you configured routing then it will
23:50 < Proz01d> everything will pass through
23:50 < flowbee> i didn't touch the default routing... i was just provided with an openvpn config file
23:50 < flowbee> from the vpn provider
23:50 < Proz01d> are you running the server
23:50 < flowbee> and used that; and when i do; all traffic seems to go through the openvpn server
23:50 < Proz01d> or the client
23:50 < flowbee> no i'm a client
23:51 < Proz01d> you don't have any control as to what the server can do
23:51 < Proz01d> what are you trying to accomplish?
23:51 < flowbee> as the client; it seems that when i run their openvpn connection script that *all* of my incoming/outgoing traffic is immediately routed through their openvpn server
23:52 < flowbee> and i'd prefer that only specific types of traffic would be routed through openvpn
23:53 < flowbee> does that make sense ?
23:53 < Proz01d> i think that is all control at the server
23:53 < Proz01d> yes it does
23:53 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:53 < Proz01d> i specifically configured my server to run that way
23:53 < Proz01d> (directing all traffic to the vpn)
23:53 < flowbee> but as the client; shouldn't i be allowed to determine which traffic i want to send to the openvpn server?
23:54 < hyper_ch> Proz01d: by default nothing is filtered on ubuntu
23:54 < hyper_ch> by first running UFW you actually start blocking ports on ubuntu
23:54 < Proz01d> on ubuntu server everything is blocked (incoming)
23:54 < flowbee> well i'm connecting via an ubuntu box (the client)
23:55 < flowbee> i have no idea what OS the openvpn server is running
23:55 < flowbee> and i can't config the openvpn server anyways
23:55 < hyper_ch> Proz01d: to my experience, ubuntu server doesn't block anything either
23:56 < flowbee> hyper_ch, so is there a way to only send a few types of traffic through the openvpn connection?
23:56 < Proz01d> really..?
23:56 < flowbee> as the client?
23:56 < Proz01d> i thought i read that somewhere.
23:56 < Proz01d> definitely worth investigating :)
23:56 < hyper_ch> Proz01d: well, my home server is ubuntu
23:56 < hyper_ch> and I never bothered changing the firewall settings on it
23:57 < hyper_ch> yet I can use samba, ssh, freeswitch and other stuff on it
23:58 < Proz01d> ahh oaky..
23:58 < Proz01d> well i need to shut those down then
23:58 < Proz01d> i don't want it wide open
23:58 < Proz01d> actually... na... i have to leave them open
23:59 < Proz01d> if clients will be tunnelling 
23:59 < hyper_ch> as long as you don't run services, it doesn't matter if ports are open or closed
23:59 < Proz01d> *question* to anyone out there...i'm trying to connect to my vpn using openvpn windows client however it stays on the "connecting" the client logs don't show anything...
23:59 < flowbee> hyper_ch, so is what i want to do even possible?
23:59 < hyper_ch> flowbee: it is, but it helps if if you can easily bind certain programs to a certain ip
--- Day changed Wed May 25 2011
00:00 < hyper_ch> I don't use windows
00:00 < Proz01d> hmm...
00:00 < flowbee> hyper_ch, sure; i just want to have it apply to a few ports, say 80 
00:01 < flowbee> hyper_ch, i'm just really unsure on how to do that
00:01 < hyper_ch> I don't know
00:01 < hyper_ch> the few things I always want to have run through the vpn allow me to bind it to the vpn address
00:01 < hyper_ch> hence it gets routed through the vpn
00:02 < flowbee> here is the provided openvpn config: http://pastebin.com/8yHTZJ7c
00:03 < hyper_ch> flowbee: if you want to only have websurfing go through the openvpn
00:03 < hyper_ch> then you might want to setup a local proxy
00:03 < hyper_ch> so your browser queries the proxy
00:03 < hyper_ch> and the proxy is bound to the openvpn IP
00:03 < hyper_ch> that would route it through the vpn
00:03 < flowbee> but right now it seems openvpn overrides everything
00:03 < flowbee> all types of traffic
00:06 < flowbee> it appears as though the openvpn server is pushing down routes
00:06 < flowbee> https://gist.github.com/990377
00:06 <@vpnHelper> Title: 's gist: 990377 Gist (at gist.github.com)
00:12 < hyper_ch> if the server pushes down routes then you need to overwrite them
00:12 < flowbee> what would i overwrite them with?  and how i send traffic only through port 80 to the vpn"?
00:15 < hyper_ch> read up on how to overwrite routs
00:15 < hyper_ch> and regarding port 80 traffic, I told you above
00:16 < flowbee> but is there a way via routes that i can do it?
00:16 < flowbee> i can say for instance traffic from port 80 should go here ?  via routing tagbles?
00:23 -!- Assid [~Assid@static-mum-120.63.225.84.mtnl.net.in] has joined #openvpn
00:24 < Assid> i have a tunnel setup between a windows server and windows desktop.. what i notice is when using something like remote desktop + openvpn theres a major lag..
00:24 < Assid> which makes it a not very user friendly experience
00:24 < Assid> i compared it without openvpn, and it seems much better .. to th esame server
00:25 < Assid> can anyone shed some light on this.. and hopefully give ways to clear this up.. i really like to use ovpn
00:25 < Assid> since i can firewall the rest o fthe connections out
00:53 -!- Assid [~Assid@static-mum-120.63.225.84.mtnl.net.in] has quit [Read error: Connection reset by peer]
01:02 < Proz01d> arg.... getting a " Note: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)" error when i try to restart openvpn
01:10 -!- kuszja [~Sidein@cpe-98-27-142-187.neo.res.rr.com] has quit [Remote host closed the connection]
01:18 -!- Adde_BC [~AddeBC@c193-150-233-51.bredband.comhem.se] has joined #openvpn
01:19 -!- Addemanne [~AddeBC@c193-150-233-51.bredband.comhem.se] has quit [Ping timeout: 252 seconds]
01:20 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
01:21 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Ping timeout: 246 seconds]
01:24 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:35 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
01:43 < Proz01d> just ran a quick test... i connected to my vpn no problems using the windows command line (openvpn windows 2.20 installer - http://swupdate.openvpn.net/community/releases/openvpn-2.2.0-install.exe).  When i tried to connect with the Openvpn Desktop client (Win7logo 	OpenVPN Desktop Client Download for Windows) i can't connect.  the "connecting" windows stays up and eventually times out.. anyone 
01:43 < Proz01d> have any ideas why this is notworking?
01:58 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
02:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:06 -!- s7r [~s7r@unaffiliated/s7r] has quit [Remote host closed the connection]
02:20 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:21 < xsurfer> good day! I would like to know how to increase the network speed.  currently when the client is connected to the server it will appear a network adapter with 10mbps network speed.  How can I make it to 100mbps?
02:22 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
02:22 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
02:23 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
02:24 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
02:27 < xsurfer> good day! I would like to know how to increase the network speed.  currently when the client is connected to the server it will appear a network adapter with 10mbps network speed.  How can I make it to 100mbps?
02:29 <@vpnHelper> RSS Update - forum: Tutorial how to connect server A to server B <http://forums.openvpn.net/topic8214.html#p12512>
02:30 < xsurfer> good day! I would like to know how to increase the network speed.  currently when the client is connected to the server it will appear a network adapter with 10mbps network speed.  How can I make it to 100mbps?
02:32 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
02:36 < xsurfer> good day! I would like to know how to increase the network speed.  currently when the client is connected to the server it will appear a network adapter with 10mbps network speed.  How can I make it to 100mbps?
02:36 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
02:39 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
02:46 -!- dazo_afk is now known as dazo
02:54 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
02:58 -!- jaminja [~jaminja@212.7.195.193] has quit [Ping timeout: 260 seconds]
02:58 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
03:13 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
03:23 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 255 seconds]
03:25 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
03:25 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
04:10 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
04:10 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
04:10 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:11 < janjust> ping ecrist
04:11 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
04:11 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:20 <@vpnHelper> RSS Update - forum: static ip for openvpn clients <http://forums.openvpn.net/topic8215.html>
04:26 <@vpnHelper> RSS Update - forum: static ip for openvpn clients <http://forums.openvpn.net/topic8215.html#p12514>
04:38 <@vpnHelper> RSS Update - forum: OpenVpn for android <http://forums.openvpn.net/topic7792.html#p12515>
04:41 -!- jaminja [~jaminja@212.7.195.193] has quit [Ping timeout: 248 seconds]
04:43 -!- jaminja [~jaminja@rijkdijk2.demon.co.uk] has joined #openvpn
04:43 <@vpnHelper> RSS Update - forum: static ip for openvpn clients <http://forums.openvpn.net/topic8215.html#p12516>
04:50 <@vpnHelper> RSS Update - forum: static ip for openvpn clients <http://forums.openvpn.net/topic8215.html#p12517>
04:55 -!- K1ng` [~KING@180.211.188.185] has joined #openvpn
04:58 -!- K1ng [~KING@180.211.188.166] has quit [Ping timeout: 260 seconds]
05:01 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
05:01 < rajkosto> !git
05:01 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git, or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git,, or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi, or (#4) See !git-doc how to use git
05:09 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has joined #openvpn
05:12 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
05:18 <@vpnHelper> RSS Update - forum: client to client visibility <http://forums.openvpn.net/topic8216.html>
05:22 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
05:26 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:26 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:26 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:27 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
05:27 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
05:27 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:29 -!- SOG [~SOG@113.108.118.58] has quit [Quit: SOG]
05:36 <@vpnHelper> RSS Update - forum: client to client visibility <http://forums.openvpn.net/topic8216.html#p12520> || static ip for openvpn clients <http://forums.openvpn.net/topic8215.html#p12519>
05:44 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 248 seconds]
05:48 <@vpnHelper> RSS Update - forum: Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html>
05:54 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html#p12522>
05:59 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:03 -!- flowbee [~flowbee__@c-98-232-28-104.hsd1.wa.comcast.net] has quit [Read error: Operation timed out]
06:06 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163.html#p12523>
06:12 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html#p12525> || Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12524>
06:16 -!- flowbee [~flowbee__@c-98-232-28-104.hsd1.wa.comcast.net] has joined #openvpn
06:21 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
06:21 < zykes-> is there any option to give openvpn a option to track users ? 
06:21 < zykes-> like to have a file of ip + wan ip + cert name etc?
06:24 <@vpnHelper> RSS Update - forum: Server UP/DOWN script based on CCD <http://forums.openvpn.net/topic8218.html>
06:25 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 246 seconds]
06:26 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
06:26 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
06:27 -!- jaminja [~jaminja@rijkdijk2.demon.co.uk] has quit [Changing host]
06:27 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
06:29 <@dazo> zykes-: you can easily do that by writing a little script and execute it via --learn-address
06:30 <@dazo> not sure if cert name is present at that point ... might be --client-connect is a better script hook
06:32 < Bushmills> status files contains that info
06:32 < Bushmills> --status
06:35 <@dazo> duh ... of course!
06:35 <@dazo> !man
06:35 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
06:35 <@dazo> (that's for me only)
06:37 -!- kyrix [~ashley@ks357561.kimsufi.com] has joined #openvpn
06:38 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
06:40 <@vpnHelper> RSS Update - forum: Server UP/DOWN script based on CCD <http://forums.openvpn.net/topic8218.html#p12527>
06:52 <@vpnHelper> RSS Update - forum: Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12528>
06:59 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
07:02 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
07:07 -!- takamichi [Takamichi@78.133.37.249] has quit [Ping timeout: 276 seconds]
07:07 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
07:10 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html#p12529>
07:16 <@vpnHelper> RSS Update - forum: Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12530>
07:22 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html#p12531>
07:28 <@vpnHelper> RSS Update - forum: Doubt About multiple instances openvpn <http://forums.openvpn.net/topic8198.html#p12533> || Server UP/DOWN script based on CCD <http://forums.openvpn.net/topic8218.html#p12532>
07:34 <@vpnHelper> RSS Update - forum: Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12534>
07:40 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:47 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html#p12537> || TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8147.html#p12536> || Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12535>
07:52 <@vpnHelper> RSS Update - forum: Server UP/DOWN script based on CCD <http://forums.openvpn.net/topic8218.html#p12538>
07:53 -!- luneff [~yury@84.51.195.188] has joined #openvpn
07:55 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 276 seconds]
08:02 < Proz01d> just ran a quick test... i connected to my vpn no problems using the windows command line (openvpn windows 2.20 installer - http://swupdate.openvpn.net/community/releases/openvpn-2.2.0-install.exe).  When i tried to connect with the Openvpn Desktop client (Win7logo 	OpenVPN Desktop Client Download for Windows) i can't connect.  the "connecting" windows stays up and eventually times out.. anyone 
08:02 < Proz01d> have any ideas why this is notworking?
08:06 < ecrist> Proz01d: not sure, without logs
08:06 < ecrist> we can't magically see what's going...
08:09 < Proz01d> ohh....
08:11 < Proz01d> :)
08:11 < Proz01d> i just found the logs  copying them to pastebin
08:13 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html#p12539>
08:14 < Proz01d> http://pastebin.com/usHZVh8m
08:16 < Proz01d> the tls handshake isfailing when i use the desktopclient but works on the command line
08:16 < Proz01d> using the same certs
08:16 < Proz01d> and / keys
08:17 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
08:17 < ecrist> Proz01d: you're using the access server client instead of the openvpn community client
08:18 <@vpnHelper> RSS Update - forum: Server UP/DOWN script based on CCD <http://forums.openvpn.net/topic8218.html#p12540>
08:24 < Proz01d> any recommended client i should use?  i'm looking for the easiest one for ppl to use
08:24 < Proz01d> funny thing is that the as client worked before i enabled tls
08:25 < ecrist> Proz01d: use the openvpn installer.  the normal one
08:25 < ecrist> it inculdes a windows gui
08:26 < Proz01d> i've tried starting the gui and all i get is the icon in the task bar.  I'm not sure how to select a new connections as my only options are Proxy settings, about and exit
08:27 < Proz01d> when i right click
08:27 < ecrist> did you put the configs in the config directory?
08:29 < Proz01d> nope...i guess that's why.. is there a guide on openvpn gui?
08:29 < ecrist> no clue
08:29 < ecrist> just put the config and certs/keys in the config directory
08:30 < ecrist> c:\program files\openvpn\config i think
08:30 < Proz01d> sweet thanks again!
08:30 < Proz01d> you are 2 for 2
08:30 < Proz01d> i owe you
08:30 < Proz01d> !
08:30 < ecrist> :)
08:31 < Proz01d> saaaaaaaaawEEEEETTTT!
08:31 < Proz01d> it works!
08:32 < Proz01d> now on to the user management piece
08:32 < ecrist> :D
08:33 < Proz01d> !davo
08:33 < Proz01d> !dago
08:34 < Proz01d> i was going to go with http://www.eurephia.net/..... do you recommend anything better..
08:34 < Proz01d> basically setting up a vpn service
08:34 < ecrist> dazo is the eurephia developer.  he may be biased toward it. ;)
08:34 < ecrist> and latest version of openvpn includes the required patches to use it
08:35  * dazo gives ecrist a cookie
08:35 < ecrist> see, I'm not just a tyrant with a pretty face
08:36 <@dazo> ;-)
08:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:37 < Proz01d> eurephia it is :)
08:37 < Proz01d> thanks guys
08:37 <@dazo> Proz01d: if you have issues with eurephia ... please let me know, I've been helping quite some people to make it work
08:37 <@dazo> and they all seem to be happy afterwards
08:40 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
08:40 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
08:47 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
09:03 -!- Lenhix [~lenhix@adsl201-232-127-1.epm.net.co] has joined #openvpn
09:09 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
09:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:14 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:30 < havoc> dfwe[B[A[Cwerfroiuyyqw
09:36 < ecrist> no
09:36 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12541>
09:40 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:42 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:47 -!- bauruine [~stefan@79-110.4-85.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
09:52 < havoc> screen screwup
10:00 < havoc> did a C-a, and some unknow char, locked it all up :(
10:08 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:14 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:17 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:18 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:20 -!- kyrix [~ashley@ks357561.kimsufi.com] has quit [Quit: Leaving]
10:37 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
10:41 <@vpnHelper> RSS Update - forum: static ip for openvpn clients <http://forums.openvpn.net/topic8215.html#p12542>
10:42 -!- corretico [~luis@201.201.44.82] has joined #openvpn
10:44 -!- teloniusz [goldie@inferno.hell.pl] has quit [Ping timeout: 240 seconds]
11:02 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 255 seconds]
11:11 -!- qman__work [~ryan@173-13-24-174-Michigan.hfc.comcastbusiness.net] has joined #openvpn
11:13 -!- dazo is now known as dazo_afk
11:13 < qman__work> I'm having some trouble with a double bridge VPN configuration. The machines are connecting to each other, and can ping each other, but other hosts on the LAN can't ping through the VPN.
11:14 < qman__work> the firewalls are accept all, and a tcpdump reveals ARP requests that don't get answered
11:14 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
11:17 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html#p12543>
11:23 -!- powerunit2 [~as@119.152.108.92] has joined #openvpn
11:26 < powerunit2> i all i am trying to make bridge on openvpn... i am running this openvpn on VPS server
11:26 < powerunit2> when i enter iptable commmand 
11:27 < powerunit2> i get this error 
11:27 < powerunit2> http://pastebin.com/qnNqT8xn
11:27 < powerunit2> please help
11:29 <@vpnHelper> RSS Update - forum: openvpn client issue (Windows XP) <http://forums.openvpn.net/topic8219.html>
11:32 < powerunit2> ?
11:33 -!- qman__work [~ryan@173-13-24-174-Michigan.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
11:34 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
11:34 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:36 < ecrist> ?
11:36 < ecrist> powerunit2: not an openvpn problem
11:37 < powerunit2> i know i can understanf
11:37 < powerunit2> but any idea? wht should i do now?
11:37 < krzee> use iptables correctly
11:37 < krzee> that would prolly do it
11:37  * krzee wonders if theres an #iptables
11:37 < krzee> oh hey look, there is!
11:37 < krzee> weird
11:38 < krzee> wow im a dick, ill go away for awhile ;]
11:38 < powerunit2> did i make any mistake on iptable?
11:38 < krzee> yes, the error told you exactly what it was
11:55 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:03 -!- raket [~raket@roker.ganjah.se] has joined #openvpn
12:04 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
12:09 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
12:11 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 252 seconds]
12:11 -!- luneff [~yury@84.51.195.188] has quit [Quit: This computer has gone to sleep]
12:19 < powerunit2> Dear team.. openvpn is giving error on starting up
12:19 < powerunit2> http://pastebin.com/sh6DnsYx
12:20 < powerunit2> this openvpn server is on VPS machine
12:28 -!- kusznir [~kusznir@casas-net.ailab.wsu.edu] has joined #openvpn
12:28 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
12:32 < kusznir> Hi all:  I'm having trouble getting an OpenVPN client to work on dd-wrt (server is pfsence)
12:33 < kusznir> log: http://pastebin.com/FuTVzru3
12:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
12:34 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
12:35 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
12:40 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
12:51 -!- luneff [~yury@84.51.197.177] has joined #openvpn
12:57 < powerunit2> guys any help on this plz?
13:02 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
13:05 < powerunit2>  http://pastebin.com/sh6DnsYx
13:06 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:06 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:06 < kusznir> powerunit2: are you running openvpn as root?
13:08 < kusznir> powerunit2, the error you got means it was unable to allocate a tun, which is the "client side" virtual network interface.  Causes of this usually include: 1) not running with sufficient privilages (root, or perhaps selinux blocking it); 2) kernel not having support for tap/tun (need to recompile kernel or install kernel module packages approprate).
13:14 < krzie> the pastebin shows hes root
13:15 < krzie> you dont have tuntap in your kernel
13:15 < kusznir> true.  So most likely he doesn't have tun/tap kernel support.
13:15 < krzie> please seek help recompiling your kernel from your OS help channel
13:16 < kusznir> I'd greatly appreciate it if anyone could give me some pointers/interpretations as to why openvpn isn't liking my certs: http://pastebin.com/sh6DnsYx
13:17 < kusznir>  /join #openssl
13:23 < krzie> kusznir, it says nothing about your certs
13:24 < krzie> oh wait, thats powerunit2's post
13:24 < krzie> lol
13:24 < kusznir> krize: sorry, I pasted the wrong URL:  http://pastebin.com/FuTVzru3
13:24 < kusznir> Yea, that's what I get for helping someone else and not re-reading the pastebin error before re-pasting my URL...
13:24 < krzie> ok ill look at that, you look at this
13:24 < krzie> http://roarmag.org/2011/05/spanish-revolution-protests-spread-europe-videos-democracia-real-ya/
13:24 <@vpnHelper> Title: Spanish protests spread across Europe in videos | Reflections on a Revolution ROAR (at roarmag.org)
13:25 < krzie> since your media wont tell you about it
13:25 < krzie> !certverify
13:25 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
13:25 < krzie> check it manually =]
13:25 < krzie> (both sides)
13:26 < kusznir> Hmm...the cert is generated the same way I have another client running.  My CA is built into pfsense, so I know it doesn't do the server stuff; I have to leave commented the server cert verification thing.
13:31 -!- Marve712 [~Marver712@69.42.210.250] has joined #openvpn
13:32 < Marve712> Is there a huge advantage by using "redirect-gateway def1" instead of "redirect-gateway"?
13:40 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
13:42 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
13:42 -!- Cain` is now known as Cain
13:43 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
13:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
13:53 -!- Marve712 [~Marver712@69.42.210.250] has quit []
13:56 < krzie> kusznir, 
13:56 < krzie> !servercert
13:56 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key, or (#2) this will help with !mitm
14:04 -!- powerunit2 [~as@119.152.108.92] has quit [Ping timeout: 240 seconds]
14:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:05 -!- powerunit2 [~as@119.152.11.62] has joined #openvpn
14:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Client Quit]
14:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:07 < flowbee> i'm connecting to a vpn server that seems to affect my routes.  you can see here:  https://gist.github.com/990377 ... my question is; what should i do after this happens so that *only* traffic from port 80 will be sent through the assigned routes?
14:07 <@vpnHelper> Title: 's gist: 990377 Gist (at gist.github.com)
14:08 < krzie> do you run the server?
14:09 < krzie> from you saying "seems to affect my routes"  i assume you do not
14:10 < krzie> in which case,you cant
14:10 < flowbee> i do not run the server
14:10 < flowbee> it pushes down routes
14:10 < ecrist> flowbee: openvpn does not support policy based routing
14:10 < krzie> routes operate by subnet, not by port
14:10 < ecrist> you need to talk to the server admin
14:10 < flowbee> i doubt they'll change their whole backend for me
14:10 < ecrist> you can stop routes from being applied by adding 'no-pull' to your client config, though.
14:10 < flowbee> its hidemyass.com as a provider
14:10 < krzie> if you can get him to run a socks server internally, it will work
14:10 < krzie> !routebyapp
14:11 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
14:11 < krzie> otherwise, you can only route by subnet
14:11 < krzie> you can override their default route pushing, but you can still only route to them based on subnet
14:11 < ecrist> krzie: pf can do it for you.
14:11 < ecrist> but you have to be on freebsd or openbsd for pf
14:11 < ecrist> I'm sure iptables has something, as well
14:11 < krzie> im sure iptables can do it too
14:11 < flowbee> i'm running ubuntu 10.04
14:11 < krzie> but i wouldnt know how
14:11 < flowbee> yeah i'd prefer to only have specific traffic sent through openvpn
14:12 < flowbee> i.e. by port.  
14:12 < flowbee> so you're saying i need to use pf?  or iptables?
14:13 < ecrist> yes.  on ubuntu it'll be iptables
14:14 < ecrist> you'll need to ask them how to do routing based on firewall rules and tagging
14:15 < flowbee> so will i need to reset iptables each time i connect/disconnect from vpn
14:22 < krzie> openvpn can do that
14:22 < krzie> !script
14:22 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
14:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
14:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:28 <@vpnHelper> RSS Update - forum: Doubt About multiple instances openvpn <http://forums.openvpn.net/topic8198.html#p12545>
14:44 -!- powerunit2 [~as@119.152.11.62] has quit []
14:48 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
14:56 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:00 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
15:15 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
15:33 -!- SWAT [~swat@ubuntu/member/swat] has joined #openvpn
15:34 < SWAT> FYI: ipv6 + openvpn (although ipv4 backend is still required) works
15:49 < krzie> can you supply more info on your setup?
15:50 < krzie> in fact bragging rights section of the forum would be awesome if you are willing
15:50 < krzie> (we need more ipv6 feedback)
15:51 < krzie> i believe the windows portion is almost ready, which means it could make it to release branch sooner than later if it gets good testing
16:04 -!- Lenhix [~lenhix@adsl201-232-127-1.epm.net.co] has quit [Quit: Mindwall!!]
16:11 -!- bent_screwdriver [~UserNick@74.255.249.66] has quit [Quit: Going offline, see ya! (www.adiirc.com)]
16:17 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:31 -!- charlls [ce84e06b@gateway/web/freenode/ip.206.132.224.107] has joined #openvpn
16:31 < charlls> heyo
16:31 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
16:34 -!- charlls [ce84e06b@gateway/web/freenode/ip.206.132.224.107] has quit [Client Quit]
16:34 < SWAT> krzie: I'll be testing/verifying the setup in the next couple of days and create a wiki page with the configs etc.
16:35 < SWAT> I'll spam the link here then :)
16:44 -!- screensilently [screensile@gateway/shell/anapnea.net/x-umsxzzquidsdoctu] has joined #openvpn
16:44 < krzie> thank you
16:44 < screensilently> hello, does internet sharing work with tap?
16:45 < krzie> i will then pass the link to the devs as a piece of testing
16:45 < krzie> screensilently, sure... and why are you using tap?
16:45 < screensilently> krzie: what's the disadvantagies?
16:45 < screensilently> krzie: i can't share internet and i don't know why. i did it 2 days ago
16:46 < krzie> 1 thing at a time
16:46 < krzie> why do you use tap?
16:46 < screensilently> random choise
16:47 < krzie> do you require a specific layer *2* protocol over the vpn?
16:47 < krzie> lan gaming over the vpn maybe...?
16:47 < screensilently> yes i do
16:47 < krzie> !tunortap
16:47 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
16:47 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
16:48 < screensilently> yes i do want tap
16:48 < screensilently> http://paste.pocoo.org/show/v4hEJrhulv4MBibsegUF/
16:48 < screensilently> is this right?
16:48 < krzie> ok then here ya go
16:48 < krzie> !redirect
16:48 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
16:48 < krzie> omg tap and tcp
16:49 < krzie> its like you wanna do everything you can to make sure it will be least efficient it can be
16:49 < screensilently> tap + tcp = no way???
16:49 < krzie> heheh
16:49 < krzie> !tcp
16:49 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer)
16:49 < krzie> !tunortap
16:49 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
16:49 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
16:49 < screensilently> krzie: i can't use udp right now
16:50 < screensilently> is this the reason it is not working?
16:50 < screensilently> ?
16:50 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
16:51 < screensilently> krzie: my router's ip is 10.30.74.1 and the dns server on 10.0.0.1
16:51 < screensilently> so is my config correct to allow forwarding?
16:52 < screensilently> iptables -t nat -A POSTROUTING -s 10.30.74.0/24 -o eth0 -j MASQUERADE
16:52 < screensilently> and that's my iptables rule
16:52 -!- p3rror [~mezgani@41.140.170.151] has joined #openvpn
16:53 < screensilently> krzie: a little bit faster if you could please becayse i don't have much time
16:54 < krzie> lol no
16:54 < krzie> im busy at work
16:54 < krzie> ill help when i have time / feel like it
16:54 < screensilently> but do you think? is it going to work with my settings?
16:55 < krzie> [14:48]  <vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
16:55 < krzie> its only 3 things
16:55 < screensilently> !def1
16:55 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
16:56 < screensilently> !ipforward
16:56 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:56 < screensilently> !linipforward
16:56 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:57 < screensilently> !nat
16:57 < screensilently> !nat
16:57 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
16:57 < screensilently> !linnat
16:57 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
16:59 < screensilently> !openvzlinnat
16:59 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
17:02 < screensilently> no, i can't ping the machines over 10.30.74.X
17:02 < screensilently> except the openvpn server
17:04 < screensilently> !!help
17:10 < screensilently> help? :(
17:13 < krzie> cat /proc/sys/net/ipv4/ip_forward
17:14 < krzie> check your iptables allows the forward chain
17:15 < krzie> server 10.30.74.0 255.255.255.224
17:15 < krzie> why such a small small subnet?
17:18 -!- manager_ [~manager@s70119198.temp.wsu.edu] has joined #openvpn
17:18 -!- manager_ is now known as kusznir_
17:20 < kusznir_> Hi: I've figured out my cert problem, and now I'm *really* close to a fully working config.  Presently, my setup is working as such: My client connects to my server.  two log lines of relevence: /sbin/ifconfig tun0 192.168.13.10 pointopoint 192.168.13.9 mtu 1500
17:20 < kusznir_> ERROR: Linux route add command failed: external program exited with error status: 255
17:21 < kusznir_> It says it successfully completed initialization sequence.  From the server end, I can ping the client's ip (192.168.13.10).  In addition, I have the remote side pushing out routes for its local subnet, and an iroute for this side's subnet.  I can ping the internal (192.168.14.1) ip of the client.  I cannot ping further, though (.14.2, 14.3, both online).
17:22 < kusznir_> I cannot ping anything from the client side (even the remote side of the tun: 13.9), or .3.1).  The client side routing table DOES show enteries for that.
17:22 < kusznir_> also, every couple minutes or so, the client side does: Inactivity timeout (--ping-restart), restarting
17:23 < kusznir_> So I think the client really thinks it is down, but the server side sees some stuff working...any suggestions/ideas?
17:24 < kusznir_> Oh, and the client IS a router (and is actively routing)
17:25 < krzie> !configs
17:25 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:25 -!- kusznir_ [~manager@s70119198.temp.wsu.edu] has quit [Read error: Connection reset by peer]
17:26 -!- kusznir_ [~manager@s70119198.temp.wsu.edu] has joined #openvpn
17:26 < krzie> kusznir
17:26 < krzie> !configs
17:26 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:34 < Proz01d> has anyone been able to install eurephia on ubuntu?
17:36 -!- Lenhix [ElChaman@190.146.247.20] has joined #openvpn
17:36 < Lenhix> !dns
17:36 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4
17:37 < krzie> !learn dns as you might be looking for !pushdns
17:37 <@vpnHelper> Joo got it.
17:37 < krzie> Lenhix, ^^
17:49 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12546>
17:50 < kusznir_> krzie & others: http://pastebin.com/RKxk2GJX
17:51 < kusznir_> Question: from a client, should I be able to ping the "remote side" of the tun?  Eg, if I was assigned .10 and the "remote side" was .9, should I be able to ping .9 from the client?
17:53 < Lenhix> krzee: thx for the intention, but I was looking just for the Level3's DNS addresses. I saw that factoid a couple of days ago and came just for the addresses. Not a OpenVPN Issue. Thx again :)
17:54 < Proz01d> kusznir_: you mean ping the server?
17:54 <@vpnHelper> RSS Update - forum: Speed <http://forums.openvpn.net/topic8211.html#p12548> || static ip for openvpn clients <http://forums.openvpn.net/topic8215.html#p12547>
17:54 < Proz01d> or another client?
17:54 < kusznir_> Proz01d: ping the server, yes.
17:54 < Proz01d> yes you should
17:54 < Bushmills> kusznir_: no
17:54 < kusznir_> Although both the server and the client now have multiple IP addresses, so I specfiically ment the openvpn connection IP for the server side (as opposed to the wan/public IP, etc)
17:55 < Bushmills> kusznir_: that's the p-t-p address, there is no service listening. 
17:55 < Proz01d> sorry i wasn't following above.
17:55 < kusznir_> Bushmills, Ok, that's what I was looking for, thank you.  What IP should I be able to ping through the vpn to test the vpn's up?
17:56 < Bushmills> the server vpn subnet address
17:56 < Bushmills> x.x.x.1 most probably
17:56 < kusznir_> ok, thanks, will-try now.
18:00 < krzie> [15:51]  <kusznir_> Question: from a client, should I be able to ping the "remote side" of the tun?  Eg, if I was assigned .10 and the "remote side" was .9, should I be able to ping .9 from the client?
18:00 < krzie> no
18:00 < krzie> !/30
18:00 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
18:00 < krzie> that explains why
18:01 < kusznir_> Ok, I'm remembering a lot of that now.
18:02 < krzie> "I'm currently running it "by hand" via ssh for debugging"
18:02 < krzie> good man ;]
18:02 < krzie> server: pfsense (and a similar client config on another client running).
18:02 < krzie> config file:
18:02 < krzie> dev ovpns1
18:02 < krzie> dev-type tun
18:02 < krzie> dev-node /dev/tun1
18:02 < krzie> do you mean to say there is a client on that same machine as well?
18:03 < krzie> if so, it is using a different dev... right?
18:03 < krzie> (different dev-node too)
18:03 < kusznir_> So, I added a "route 192.168.14.0 255.255.255.0;" line to my server config (to match this client's local network), and the client-specific config of: iroute 192.168.14.0 255.255.255.0;push "route 192.168.3.0 255.255.255.0"; and now nothing is working (connection says its up, but no traffic passing between this client).  Previously, I left out the global "route 192.168.14.0 255.255.255.0;" statement
18:04 < kusznir_> krzie, no, the pfsense server is only running one openvpn process, and it is the server.  all other opnevpn processes I run connect to this box, and they're all on different hardware.
18:04 < kusznir_> Presently I have one other box (not routing an internal network) that is working fine.
18:05 < krzie> ok so do you still have that route error?
18:05 < krzie> or are you just trying to get the client lan working?
18:05 < kusznir_> krzie, At one point, I had a disabled openvpn config while I built the new config on the pfsense box, that might be why its nailed to /dev/tun1.
18:05 < krzie> and have you read this:
18:05 < krzie> !route
18:05 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:05 < krzie> oh ok i see what you meant now =]
18:06 < kusznir_> I'm actually trying to get *any* traffic passing through the vpn.
18:06 < krzie> push "route 192.168.3.0 255.255.255.0"
18:06 < krzie> whats that?
18:06 < krzie> whats .3.0/24?
18:07 < kusznir_> Previously, (before the route command), I could ping 192.168.13.client_ip, and 192.168.14.1 (client's lan IP), but not beyond (192.168.14.2). 
18:07 < kusznir_> 192.168.3.x is the server LAN.
18:07 < kusznir_> 192.168.13.x is the openvpn network.  192.168.14.x is this client's LAN.
18:07 < krzie> whats 101.0/24?
18:07 < kusznir_> It is a different client's LAN (that's not online presently)
18:08 < krzie> ok...
18:09 < krzie> and whats in /var/etc/openvpn-csc/
18:09 < kusznir_> Its kind of a complated setup.  Sorry.
18:09 < krzie> actually its very not complicated
18:09 < krzie> its EXACTLY what i made a writeup on
18:09 < krzie> go read it!
18:09 < krzie> !route
18:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:10 < kusznir_> actually, that looks like what I read a year ago when I first started this project to set it all up :)
18:10 < kusznir_> (since then, both endpoint hardware has changed)
18:10 < krzie> ;]
18:10 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:11 < krzie> could be time to read it again!
18:11 < kusznir_> I had it all working when both ends were "regular linux boxes"; unfortunately, we've "evolved" to using firewall "appliances with openvpn support"...
18:11 < krzie> after which, if you still have problems, we'll continue
18:11 < kusznir_> ok.
18:11 < krzie> thats no difference...
18:11 < krzie> in fact its 1 less step
18:11 < krzie> you no longer need a route outside openvpn
18:11 < krzie> when you werent using the routers you did
18:12 < krzie> any openvpn endpoint which is NOT the router for its lan, and wants to share its lan, needs either a route on its router or on every machine in the lan which should communicate over the vpn
18:16 < kusznir_> krzie, Yep.  One more reason we went to loading this on the routers...
18:17 -!- Lenhix [ElChaman@190.146.247.20] has quit [Quit: Mindwall!!]
18:17 < kusznir_> Ok, so I reread that, and that's pretty much what I thought I had configured (at least, that's what I told the gui-tools to do, and as best as I can tell, what the client configs are doing).
18:19 < kusznir_> Here's the client-specific config file for my client under invetagation from the server: iroute 192.168.14.0 255.255.255.0 <cr><cr>push "route 192.168.3.0 255.255.255.0"<cr>
18:19 < krzie> alright, lets see logs of it connecting
18:19 < krzie> verb 4 please
18:20 < krzie> you dont need in your ccd:
18:20 < krzie> push "route 192.168.3.0 255.255.255.0"
18:20 < kusznir_> I just found a bunch of these in the server log file: openvpn[36574]: kyoto/134.121.119.198:1038 Bad LZO decompression header byte: 42
18:20 < krzie> ahh i didnt notice that
18:20 < krzie> server has comp-lzo, client does not
18:21 < krzie> add it to the client
18:21 < oc80z> can that be pushed to the client yet?
18:21 < oc80z> if its not in clients config?
18:22 < Bushmills> would it be pushed to client with compressed packets?
18:22 < krzie> i think so
18:22 < oc80z> somthing on the dev list about that
18:23 < Bushmills> and - how does client know it needs to uncompress it ...
18:23 < krzie> Bushmills, does compression start IMMEDIATELY, or does it wait til after options are done pushing...?
18:24 < Bushmills> not sure, but i think that server pushes are simply going through the same tunnel, same parameters, as - later - other vpn payload traffic
18:25 < kusznir_> Ok, so its mostly-working now.  client can ping server (.13.1) and server's Lan (multiple addresses, .3.4).  "random system" on server's LAN can ping client's vpn endpoint (.13.6) and client's LAN IP (.14.1), but cannot ping other hosts on client's LAN (14.2, 14.3).
18:26 < krzie> client is also a router?
18:26 < kusznir_> This smells a little like a firewall issue to me, but I already installed firewall rules to try and mitagate this.
18:26 < kusznir_> yes, client is a router running dd-wrt.
18:26 < kusznir_> And is the router for its lan subnet (14.1)
18:26 < Bushmills> !clientlan
18:27 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
18:27 <@vpnHelper> better explanation
18:27 < kusznir_> Yep, got all that.
18:28 < kusznir_> Here's the client's iptables, just in case I'm missing something here: http://pastebin.com/7zv1neaN
18:28 < Bushmills> true. firewall good candidate then
18:29 < kusznir_> There probably are some redundant stuff in there, as I was hacking away at it trying to make it work.  
18:29 < kusznir_> And I did not write the majority of it; the "router os" does it "automatically" (and with very little input from me, I discovered...not terribly thrilled about that)
18:30 < krzie> i agree, likely firewall
18:30 < krzie> in fact, it basically has to be
18:48 -!- corretico [~luis@201.201.44.82] has joined #openvpn
18:51 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 248 seconds]
19:13 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
19:14 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 244 seconds]
19:15 -!- raw_ [~raw@chipotle118.server4you.de] has joined #openvpn
19:15 -!- SWAT [~swat@ubuntu/member/swat] has quit [Ping timeout: 276 seconds]
19:15 < mick_laptop> Bushmills: how did you enable wifi?
19:16 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 252 seconds]
19:16 -!- JPeterso2 is now known as JPeterson
19:16 < mick_laptop> the gui under: /admin/network/network doesn't start the wifi
19:21 < mick_laptop> err, the wifi just isn't starting
19:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:48 -!- SOG [~SOG@222.125.196.155] has quit [Quit: SOG]
19:48 -!- images [~images@static.238.229.4.46.clients.your-server.de] has joined #openvpn
20:01 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:08 -!- master_of_master [~master_of@p57B557D4.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:12 -!- master_of_master [~master_of@p57B5588C.dip.t-dialin.net] has joined #openvpn
20:13 < flowbee> if anyones still here; i'd love some help to route only a few ports of traffic through the openvpn server that pushes down routes such that *all* of my traffic goes through it https://gist.github.com/990377
20:13 <@vpnHelper> Title: 's gist: 990377 Gist (at gist.github.com)
20:14 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 252 seconds]
20:16 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
20:18 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 250 seconds]
20:20 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:22 -!- bleevo [~bleevo@115-64-110-11.tpgi.com.au] has joined #openvpn
20:22 < bleevo> !welcome
20:22 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:22 < bleevo> !goal
20:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:23 < bleevo> !howto
20:23 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, PLEASE READ IT! http://openvpn.net/howto, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:26 < bleevo> first link in the !howto is broken 
20:27 < bleevo> I would like to have certain applications use the VPN and not my entire connection, is there a way to have the OpenVPn client operate as a proxy server so that i can configure each application.
20:31 < flowbee> yes that is a clear description of my problem
20:31 < flowbee> thank you bleevo 
20:37 <@vpnHelper> RSS Update - forum: Tutorial how to connect server A to server B <http://forums.openvpn.net/topic8214.html#p12549>
20:41 < flowbee> i'm getting: Thu May 26 05:41:03 2011 Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
20:52 < krzie> !forget howto *
20:52 <@vpnHelper> Joo got it.
20:52 < krzie> !learn howto as OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!
20:52 <@vpnHelper> Joo got it.
20:53 < krzie> !learn howto as http://www.secure-computing.net/openvpn/howto.php for a mirror
20:53 <@vpnHelper> Joo got it.
20:53 < krzie> there you go, it is fixed
20:54 < bleevo> Is there a way to have openVPN act as a proxy server.
20:54 < krzie> you mean redirect your internet through the server?
20:54 < bleevo> yes but only for apps that are configured to do so
20:54 < krzie> flowbee, you need tun in your kernel
20:54 < krzie> bleevo, you run your server?
20:54 < ecrist> bleevo: no
20:55 < krzie> ecrist, i do what hes asking for
20:55 < ecrist> fuck you
20:55 < ecrist> ;)
20:55 < krzie> ;]
20:55 < bleevo> krzie: when you say server do you mean the VPN server i am connecting to? if yes then no
20:55 < krzie> ok, then no you cant
20:55 < krzie> if you DID run it, then you could do this:
20:55 < krzie> !routebyapp
20:55 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
20:55 < krzie> i do that ^
20:55 < flowbee> krzie, huh?
20:55 < krzie> flowbee, 
20:56 < krzie> [18:41]  <flowbee> i'm getting: Thu May 26 05:41:03 2011 Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
20:56 < krzie> you dont have tun compiled into your kernel
20:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:56 < bleevo> krzee: can i not setup proxifyer to use the vpn connection?
20:56 < flowbee> oh nasty
20:56 < flowbee> its a vps issue i'm guessing
20:56 < krzie> bleevo, no
20:57 < bleevo> does proxifyer work as a proxy server?
20:57 < bleevo> or just a hack to make apps use a proxy
20:57 < krzie> no
20:57 < krzie> yes
20:57 < bleevo> so if i had a 2nd software that is a proxy server
20:57 < bleevo> and made it use the vpn
20:57 < bleevo> then it would be ok?
20:57 < krzie> you run the proxy on the server listening on the VPN ip address
20:58 < krzie> then you connect to the proxy over the vpn
20:58 < krzie> thats what i said above, thats what !routebyapp is
20:58 < bleevo> app -> proxify -> some 3rd party proxy server on my machine -> open VPN provider
20:58 < bleevo> would that work?
20:58 < krzie> no
20:58 < krzie> proxy must be on the server
20:58 < krzie> like i said 2x
20:58 < bleevo> yes
20:58 < krzie> or 3x if we count my bot
20:58 < bleevo> thanks
20:58 < krzie> yw
20:59 < bleevo> krzee: say i dont believe you do you know of some good windows proxy software?
20:59 < bleevo> :D
20:59 < krzie> lol
21:00 < krzie> theres 2 things wrong with that
21:00 < krzie> a) "good windows"
21:00  * bleevo rolls eyes
21:00 < krzie> b) im right, so thinking im not wont help you
21:01 < krzie> and for the eyeroll:
21:01 < krzie> !windows
21:01 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
21:01 < krzie> :-p
21:01 < bleevo> doesnt bother me :P
21:01 < krzie> me neither ;]
21:01 < bleevo> krzie: if i had a proxy server running in the UK
21:01 < krzie> then you dont need openvpn
21:01 < bleevo> and my vpn was to the UK and i connected to it via the openVPN connection would it work
21:01 < bleevo> (reguardless of needing it would it work?)
21:02 < krzie> well
21:02 < krzie> sure
21:02 < krzie> you could route only the proxy ip over the vpn
21:02 < bleevo> yeah
21:02 < krzie> it would be secured by openvpn to the openvpn server
21:02 < bleevo> so how is that different?
21:02 < bleevo> if the proxy server is running on my pc
21:02 < krzie> then it would only be the proxy traffic without openvpn to the proxy
21:02 < bleevo> and only using the vpn interface
21:02 < krzie> then it would be normal from there
21:02 < krzie> its different because the proxy is not elsewhere on the internet
21:03 < krzie> you dont have much experience with networking i take it
21:03 < bleevo> nope
21:03 < krzie> then just listen to me ;]
21:03 < bleevo> but if it only has access to the vpn interface isnt it like its in the UK anyway?
21:03 < krzie> no
21:03 < krzie> the route would take that traffic to the same place as other traffic
21:04 < bleevo> but it would go via the uk right?
21:04 < krzie> it wouldnt care that your proxy sent it or your app without a proxy did
21:04 < krzie> it would behave EXACTLY the same as no proxy
21:04 < bleevo> yes
21:04 < bleevo> thats what i ant
21:04 < bleevo> want*
21:04 < krzie> umm no
21:04 < krzie> im saying the proxy would change NOTHING
21:04 < bleevo> i just dont want my entire internet connection going throught the vpn
21:04 < bleevo> and i dont want to have to setup static routes
21:04 < krzie> well thats not how it works
21:05 < krzie> you can route by subnet
21:05 < krzie> thats all
21:05 < bleevo> but wouldnt this proxifier force the app to use the server?
21:05 < krzie> not by app, not by port... by subnet
21:05 < krzie> fucking NO
21:05 < bleevo> lol
21:05 < bleevo> just doesnt make sense to me
21:05 < krzie> why ask the same question 10 times?
21:05 < krzie> i can see that
21:05 < krzie> listen
21:05 < krzie> listen close
21:05 < krzie> if the proxy isnt on the server, NO
21:05  * bleevo moves closer
21:06 < bleevo> ok
21:06 < bleevo> i will try anyway and let you know if it works
21:06 < bleevo> thanks for the heads up on Proxifier
21:06 < krzie> dont bother telling me about it
21:06 < krzie> in fact please done
21:06 < krzie> dont*
21:06 < krzie> lol
21:07 < bleevo> i wont tell you if it fails
21:07 < krzie> it cant work
21:07 < krzie> basic understanding of networking would tell you that
21:07 < krzie> in fact, you might wanna read this:
21:07 < krzie> !tcpip
21:07 <@vpnHelper> "tcpip" is (#1) http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf, or (#2) See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
21:07 < bleevo> isnt the itnernet just tubes?
21:07 < krzie> the intertubez dont work like you think
21:08 < krzie> !forget tcpip *
21:08 <@vpnHelper> Joo got it.
21:08 < krzie> !learn tcpip as http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
21:08 <@vpnHelper> Joo got it.
21:08 < bleevo> krzie: how do i tell open vpn not to route all my traffic through it
21:08 < krzie> !splitroute
21:08 <@vpnHelper> "splitroute" is https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet
21:08 < bleevo> thanks
21:09 < krzie> no thats not it
21:09 < krzie> 1sec
21:09 < bleevo> i know how to do it for pptp
21:09 < krzie> !factoids search route
21:09 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
21:09 < krzie> !route_override
21:09 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet, or (#2) https://forums.openvpn.net/topic7175.html to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn
21:09 < krzie> thats it
21:09 < krzie> !forget route_override 2
21:09 <@vpnHelper> Joo got it.
21:10 < krzie> !learn route_override as to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
21:10 <@vpnHelper> Joo got it.
21:11 < bleevo> krzee: is there a way to do the reverse of what this describes. this says  traffic except for a specific IP, i want the inverse
21:12 < krzie> same concept, adapt it to your needs
21:12 < krzie> or play with nopull (see the manual)
21:12 < bleevo> ok thanks
21:12 < krzie> but in that case you need to specify EVERYTHING that would normally be pushed at you
21:12 < krzie> ip, gateway, everything
21:12 < bleevo> this is going to take awhile
21:13 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Operation timed out]
21:13 < krzie> yep, any openvpn setup without networking knowledge will take awhile
21:13 < krzie> but should be a learning experience
21:14 < krzie> grr i always type select unique instead of select distinct... no wonder my db hates me
21:14 < ecrist> lol
21:15 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
21:15 < krzie> like im in oracle or something... =/
21:16 < mick_laptop> Bushmills: ping me if you get a chance
21:16  * ecrist flies to florida in ~12 hours
21:16  * ecrist is excited
21:16 < mick_laptop> ecrist: where to?
21:16 < jpalmer> ecrist: what part?
21:17 < ecrist> tampa bay
21:17 < mick_laptop> i live there
21:17 < jpalmer> ecrist: you'll be less than an hour from me.
21:17 < ecrist> taking the wife to busch gardens for her birthday
21:17 < ecrist> nice!
21:17 < mick_laptop> you guys want to go out for a beer sometime?
21:17 < ecrist> 92' and tunderstorms all weekend.
21:17 < jpalmer> haha.  busch gardens is my wifes fav place.
21:17 < ecrist> should be great.
21:18  * ecrist doesn't even know what to expect there
21:18 < ecrist> fwiw, this will be my first time flying with my sidearm.  should be an experience
21:18 < jpalmer> ecrist: let me give you my number.  it's a holiday weekend though,  so things may not pan out.
21:18 < ecrist> jpalmer: sure!
21:18 < mick_laptop> sidearmm?
21:18 < ecrist> mick_laptop: gun
21:18 < jpalmer> ecrist: on your person,  or as checked baggage?
21:18 < mick_laptop> ah
21:19 < ecrist> checked baggage.  I haven't managed to push the carry on-board law yet. ;)
21:19 < jpalmer> I was gonna say ;)
21:19 < ecrist> personally, I think if I can carry where I take off and where I land, I should be able to carry on board
21:19 < jpalmer> checked isn't an issue.
21:19 < ecrist> jpalmer: no, I'm sure, but I've never done it
21:20 < jpalmer> brush up on your florida carry laws though.  we're a pretty gun-friendly state (I used to carry)
21:20 < ecrist> picked up an ARMLOC II for the flight
21:20 < ecrist> been reading handgunlaw.us and references
21:20 < ecrist> disappointed I can't open carry in FL yet
21:20 < ecrist> :\
21:20 < ecrist> that's all I do in MN
21:20 < jpalmer> we're a concealed carry state,  open carry is illegal here.   and if you conceal,  make sure florida honors your states reciprocity laws.
21:20 < mick_laptop> ecrist: we have crazy ppl here
21:21 < jpalmer> ecrist: what do you carry?
21:21 < mick_laptop> i sell gun safes- and i can tell you most gun enthusiasts in FL are fucking nuts
21:21 < ecrist> I have my florida permit.  I figure it should be valid in florida. ;)
21:21 < ecrist> I carry a Glock 22
21:22 < jpalmer> ahh
21:22 < jpalmer> I used to carry a sig p229  and a sig p226
21:22 < mick_laptop> when i say gun enthusiasts i mean people w/ 60+ guns like ak47s
21:22 < ecrist> you two realize, if I meet up with either/both of you, I'll get no end of shit from the wife.
21:22 < jpalmer> IWB
21:22 < ecrist> I seem to always know people where ever we go
21:22 < mick_laptop> haha
21:22 < ecrist> travel to WI for a bike show?  I'll run into someone
21:22 < jpalmer> ecrist: with it being a holiday weekend,  I probably wouldn't be able to make it.
21:23 < ecrist> travel randomly to tampa bay to see busch gardens?  we'll grab beers with two people I know.
21:23 < ecrist> lol
21:23 < jpalmer> ecrist: where do you live?
21:23 < ecrist> jpalmer: we've been over this. I live in Minneapolis.  you used to work with drue at prometheus...
21:24 < jpalmer> oh oh oh..  dammit :P
21:24 < jpalmer> short memory,  don't make fun of me.
21:24 < ecrist> jpalmer: we fly in tomorrow night.  probably going to bomb around in the rental after we're checked in and such
21:24 < ecrist> heh
21:25 < jpalmer> ecrist: I carried a sig 9mm for a long time,  then started carrying a sig 45
21:25 < jpalmer> err .45
21:25 < krzie> i couldnt figure out where the HELL in this db the IP's are stored
21:26 < ecrist> I'm going to be buying a new pistol when I get back.  it will be a glock.  debating on the 23, 27, or 36
21:26 < krzie> so i wrote a small script to walk through the tables and output any table with an IP, then output the top 5 ips from it
21:26 < krzie> worked well
21:26 < krzie> =]
21:31 < ecrist> nice, krzie 
21:31 < jpalmer> ecrist: I'm a sig guy, mostly
21:32 < jpalmer> I don't care for the way a glock feels
21:32 < ecrist> nobody's perfect. ;)
21:32 < bleevo> is america dangerous that you need to carry a glock?
21:32 < krzie> no, the world is
21:32 < ecrist> what initially sold me on glock was it points for me naturally
21:32 < ecrist> krzie++
21:32 < bleevo> isnt dangerous where i live
21:32 < krzie> i like HK
21:33 < krzie> thats true, australia is very much not dangerous (from humans)
21:33 < ecrist> http://secure-computing.net/files/bulls/
21:33 <@vpnHelper> Title: Index of /files/bulls (at secure-computing.net)
21:33 < krzie> you do have some good poisonous animals tho!
21:33 < bleevo> if you go in the bush, wild life can be dangerous
21:33 < krzie> hehe ya
21:33 < bleevo> wild pigs are real dangerous
21:34 < mick_laptop> bleevo: pretty much - we have a high crime rate
21:34 < bleevo> i want to go to america is it as bad as ppl say?
21:34 < ecrist> I carry because shit happens.  I like to be prepared.
21:34 < bleevo> have you ever had to be prepared
21:34 < bleevo> ?
21:34 < mick_laptop> i've had a gun pulled on me before
21:34 < ecrist> heh, I was in Ottawa Canada two weeks ago and had someone pull a knife on me
21:34 < bleevo> having to worry about people fucking with you isnt something ive ever had to deal with
21:35 < mick_laptop> a few times
21:35 < krzie> im from california, and i live in a 3rd world country... ive had to be prepared
21:35 < ecrist> I have police choppers fly over my house, with search lights in MY yard on a semi-regular basis.
21:35 < ecrist> granted, I live in the hood
21:35 < bleevo> does it depend on were you live?
21:35 < ecrist> bleevo: it's not just america.  we're just legally allowed to defend ourselves.
21:35 < ecrist> yes, it does
21:36 < krzie> ok my db stuffs is done for now, im out for a bit
21:36 < ecrist> l8r krzie 
21:36 < krzie> adios brochachos!
21:36 < mick_laptop> i don't live in the hood - and i've had people point their guns at me before (granted mostly by police)
21:36 < ecrist> mick_laptop: check out the link above.
21:36 < bleevo> i live in the worst state in australia for police violence
21:36 < bleevo> probably not that bad though i guess in comparrison
21:37 < krzie> victoria is really nice tho
21:37 < bleevo> yes
21:37 < krzie> i cant imagine thats the highest for any sort of crime or violence
21:37 < krzie> i was there in feb
21:38 < bleevo> yeah its pretty safe most of the time
21:38 < mick_laptop> bleevo: i think it is a hit or miss place to be
21:38 < krzie> ok im really gone now, later!
21:38 < bleevo> i used to live in queensland
21:38 < bleevo> and its very different to victoria
21:38 < mick_laptop> any of you guys run openvpn on  a router?
21:40 < ecrist> what kind of router?
21:41 < ecrist> openvpn in a way, makes a machine into a router
21:41 < bleevo> krzee: i think i know why you said it wouldnt work, i probably need to install the proxy server in a virtual machine with openvpn
21:42 < bleevo> I cant find any proxy software that will bind to an interface
21:56 < mick_laptop> ecrist: a wifi router
21:57 < mick_laptop> bleevo: why not just have every packet fwd to the proxy (and just do it w/ iptables)
22:00 < bleevo> windows
22:00 < bleevo> a friend told me to setup pfsense 
22:01 < krzee> [22:43]  <bleevo> krzee: i think i know why you said it wouldnt work, i probably need to install the proxy server in a virtual machine with openvpn
22:01 < krzee> that wouldnt help either
22:01 < krzee> you dont understand, the proxy cant be on your client machine and do anything
22:01 < bleevo> im saying put the proxy in a vm
22:01 < bleevo> not on my machine
22:02 < krzee> same computer as client?
22:02 < bleevo> no
22:02 < krzee> (in a vm on that hardware)
22:02 < bleevo> anotehr computer
22:02 < krzee> located on a different network than the client?
22:02 < bleevo> yes
22:02 < bleevo> the openVPN network
22:02 < krzee> then it doesnt need to be a vm
22:03 < bleevo> vm for convience
22:05 < mick_laptop> speaking of vm - i'm thinking of just putting openvpn on a vm (instead of on the router) - since, for whatever reason - it seems to be impossibleto get it to run
22:07 < bleevo> hmm i think spotify is getting my coutnry out of paypal somehow
22:09 -!- pokerface_ [48359d93@gateway/web/freenode/ip.72.53.157.147] has joined #openvpn
22:10 < pokerface_> !welcome
22:10 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:10 < pokerface_> !goal
22:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:11 < pokerface_> I would like to deploy a package for my openvpn at work, I'm curious to know if anyone got a working deploy package for windows 64bit
22:12 < mick_laptop> haven't tried myself
22:13 < pokerface_> is openvpn still free/opensource?
22:13 < mick_laptop> yes
22:13 < pokerface_> it seems like 2.2 > isnt?
22:13 < pokerface_> ok..
22:13 < pokerface_> I see on the openvpn website i could just install the openvpn connect client
22:13 < krzee> yes
22:14 < krzee> !download
22:14 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
22:14 < krzee> from the page you would need to goto "community"
22:14 < krzee> "openvpn client" is for access-server
22:14 < krzee> !AS
22:14 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
22:14 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
22:14 < krzee> AS is not opensource or free
22:15 < krzee> the community version is botjh
22:15 < krzee> both*
22:15 < krzee> and yes, it works on win 64bit
22:15 < pokerface_> any way to create an opensource free access-server?
22:15 < krzee> access-server is not opensource or free
22:15 < mick_laptop> pokerface_: check the pricing
22:15 < krzee> community version is both
22:16 < bleevo> i need to find someone witha UK credit card
22:16 < pokerface_> ok, but how would i deploy without an access-server? I would have to package the exe files with the configs and certs myself?
22:16 < mick_laptop> pokerface_: to be clear,  you can have an openvpn client+server (f/oss) - but the gui (if you want one) is  closed sourse
22:17 < krzee> just give them the exe and the config/certs, tell them where to put the certs / config
22:17 < krzee> or make a .bat which moves them to the right place
22:17 < mick_laptop> AS makes for easy deployment
22:17 < krzee> yes, AS does
22:17 < krzee> and it comes with professional support
22:17 < krzee> but its not free
22:17 < mick_laptop> pokerface_: also, AS pricing is very reasonable
22:17 < pokerface_> but its based on clients connected?
22:18 < krzee> the company might appreciate the professional support
22:18 < krzee> pokerface_, the pricing page answers your questions
22:18 < krzee> we dont support AS here
22:18 < mick_laptop> !AS
22:18 <@vpnHelper> "AS" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations
22:18 <@vpnHelper> options supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
22:18 < pokerface_> ok, no problem
22:18 < pokerface_> Thanks...
22:19 < pokerface_> You guys have been very helpful... Thank you.
22:19 < krzee> no problem
22:19 < pokerface_> Take care all!
22:19 -!- pokerface_ [48359d93@gateway/web/freenode/ip.72.53.157.147] has quit [Quit: Page closed]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:34 -!- newmember [~newmember@209.82.97.21] has joined #openvpn
22:41 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:43 -!- newmember [~newmember@209.82.97.21] has quit [Ping timeout: 252 seconds]
22:45 -!- newmember [~newmember@209.82.97.21] has joined #openvpn
22:58 <@vpnHelper> RSS Update - forum: Installing and running 2 VPNs on same computer <http://forums.openvpn.net/topic8220.html>
23:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
23:08 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has quit [Ping timeout: 252 seconds]
23:08 -!- brabo [brabo@globalshellz/owner/brabo] has quit [Ping timeout: 252 seconds]
23:08 -!- yell0 [~yello@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
23:09 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
23:10 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
23:10 -!- brabo [~brabo@globalshellz/owner/brabo] has joined #openvpn
23:12 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
23:14 -!- Netsplit *.net <-> *.split quits: screensilently, buddha, hyper_ch, Hamlin, @raidz, rooth, mick_laptop, Adde_BC, master_of_master, eliasson
23:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:44 -!- toortog [~toortog@notsecure.net] has quit [Read error: Connection reset by peer]
23:44 -!- toortog [~toortog@notsecure.net] has joined #openvpn
23:45 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
23:45 -!- master_of_master [~master_of@p57B5588C.dip.t-dialin.net] has joined #openvpn
23:45 -!- screensilently [screensile@gateway/shell/anapnea.net/x-umsxzzquidsdoctu] has joined #openvpn
23:45 -!- Adde_BC [~AddeBC@c193-150-233-51.bredband.comhem.se] has joined #openvpn
23:45 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
23:45 -!- buddha [~buddha@66.210.116.160] has joined #openvpn
23:45 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
23:45 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has joined #openvpn
23:45 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
23:45 -!- eliasson [~wizard@91.198.48.20] has joined #openvpn
23:45 -!- ServerMode/#openvpn [+o raidz] by card.freenode.net
--- Day changed Thu May 26 2011
00:29 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
00:30 < jeev> shit man, i had tested this a month ago and decided to not do it yet, i just decided to try it and it's not working. i used to have openvpn gui on every win xp client, connecting to VPN, i decided to shut that off and just use openvpn on the router (slackware) and now when i trace the ip from the xp machine which then connects to the router which has the route for the specific ip to go out 
00:30 < jeev> the vpn gateway, it just times out.
00:30 < jeev> i'm too tired for th is, damnit
00:53 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 276 seconds]
00:57 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
00:58 -!- zeshoem [~mnathani@bas1-toronto46-1177856523.dsl.bell.ca] has joined #openvpn
00:59 < zeshoem> How do I get internet destined traffic to go through the vpn and route through the openvpn server?
01:00 < zeshoem> presently I can only ping 10.8.1.6 from the server to the client, but not the other way around
01:04 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:07 -!- K1ng` [~KING@180.211.188.185] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
01:41 -!- brabo [~brabo@globalshellz/owner/brabo] has quit [Read error: Operation timed out]
01:41 < screensilently> hello, i have push "redirect-gateway def1" on my openvpn.conf, it shares the internet connection, but i want to only share connections for ip 10.X.X.X, and not everything.
01:42 < screensilently> i want to see every other ip via my connection, and not from the server.
01:43 -!- Adde_BC [~AddeBC@c193-150-233-51.bredband.comhem.se] has quit [Remote host closed the connection]
01:43 < krzee> then dont push redirect gateway
01:43 -!- Addemanne [~AddeBC@c193-150-233-51.bredband.comhem.se] has joined #openvpn
01:44 < krzee> use redirect-gateway in the client configs that want it, use route 10.0.0.0 255.0.0.0 for the client that wants that
01:44 < krzee> if you dont wanna redirect-gateway, dont do it! lol
01:45 < krzee> zeshoem, the client cant ping .1?
01:45 -!- brabo [brabo@globalshellz/owner/brabo] has joined #openvpn
01:49 < zeshoem> client can not ping .1
01:50 < raket> krzee: did you have url to that nice android hack again, i wanna look into it again :)
01:51 < screensilently> krzee: yes, but my vpn network is on 192.168.1.X, while the network i want to access is on 10.X.X.X
01:52 < screensilently> i'm forwarding it with an iptables roule
01:53 < zeshoem> The wierd thing is that I have 2 clients that can ping each other via the vpn, but cant get out to the net via the openvpn server.  Basically 10.8.1.6 can ping 10.8.1.10  as well as 10.8.1.1
01:54 < zeshoem> does the open vpn server need to have a NAT iptables rule on it?
02:04 < screensilently> bump?
02:06 < Bushmills> !route
02:06 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
02:06 < Bushmills> !serverlan
02:06 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
02:08 < Bushmills> strange idea to redirect all your traffic if all you care for is traffic to 10.x.x.x
02:08 < Bushmills> also, don't set up NAT on the server
02:09 < screensilently> ok got it thanks. how can i disable routing on the server?
02:09 < screensilently> prevent users routing
02:10 < Bushmills> you don't redirect routing on the server 
02:10 < Bushmills> ehm .. you don't *disable* routing, i mean
02:10 -!- dazo_afk is now known as dazo
02:11 < screensilently> Bushmills: you mean, it's not possible?
02:11 < Bushmills> you don't add routes which you don't want
02:11 < screensilently> Bushmills: yes, but if i add them to the client it gonna work
02:11 < screensilently> something i don't want
02:11 < Bushmills> disabling routing is akin to disabling networking
02:11 < Bushmills> unplugging the network cable will do
02:12 < screensilently> unpluggin is a good idea. i will try it! thanks ;)
02:15 < screensilently> Bushmills: should i turn of the router too?
02:16 < Bushmills> you can't
02:17 < Bushmills> oh. "the router" as in "the machine"
02:17 < Bushmills> not as "the operating system's routing"
02:17 < Bushmills> well, if it's not needed anymore, sure. saves power.
02:17 < screensilently> yes that's what i thought
02:18 < screensilently> saving power is a good idea
02:18 < screensilently> the bill was like 300$ last month
02:18 < screensilently> :/
02:18 < Bushmills> google's bill is worse
02:19 <@dazo> screensilently: if you don't want users to route traffic through your VPN ... that's what you have firewalls for 
02:19 <@dazo> block the traffic you don't want ... users can't use it, gets upset and does something else instead
02:20 <@dazo> that "something else" is usually something not related to your VPN server, unless you did a poor job securing it
02:20 < screensilently> why "dhcp-option DNS 10.0.0.1" don't workg and i have to put it in resolv.conf?
02:20 < screensilently> i use different nameservers so i don't want it to put it in resolv.conf
02:20 <@dazo> !push-dns
02:20 <@dazo> !pushdns
02:20 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
02:20 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
02:20 <@dazo> screensilently: ^^
02:21 < Bushmills> screensilently: unixoid client?
02:21 < screensilently> Bushmills: yeah
02:21 < screensilently> dazo: i'm already using dhcp-option DNS 10.0.0.1 on the client
02:21 < Bushmills> screensilently: man page tells you
02:21 <@dazo> screensilently: read #4 in that one
02:21 < screensilently> Bushmills: man page too long
02:22  * dazo wants to kick screensilently out for saying that
02:22  * dazo starts a poll: Does refusing reading man page classify to be kicked? 
02:22 <@dazo> (if I get 10 votes, screensilently will be kicked)
02:22 < screensilently> dazo: relax, i don't have much time to do it
02:22 < screensilently> relax
02:22 < Bushmills> not reading that section is why you're editing your resolv.conf 
02:23 <@dazo> screensilently: and we don't have time to solve your problems ... we can point you at the solution, but you need to give it some efforts
02:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:23 < screensilently> dazo: if you have the time, don't help me dude
02:23 < screensilently> seriously
02:23 -!- screensilently was kicked from #openvpn by dazo [screensilently]
02:24 -!- screensilently [screensile@gateway/shell/anapnea.net/x-umsxzzquidsdoctu] has joined #openvpn
02:24 < screensilently> why kicked dude?
02:24 < screensilently> jesus!
02:24 <@dazo> screensilently: because you don't respect others time ... go read the man page, it explains all
02:24 <@dazo> screensilently: and don't call names here
02:24 < Bushmills> maybe to create you some time to read the relevant man page section?
02:25 < Bushmills> dazo is known to be very helpful :)
02:25 < hyper_ch> Bushmills: he is?
02:25 <@vpnHelper> RSS Update - forum: Installing and running 2 VPNs on same computer <http://forums.openvpn.net/topic8220.html#p12551>
02:25 < Bushmills> he just demonstrated
02:25 < screensilently> i already have "dhcp-option DNS 10.0.0.1" on the client but it's not working
02:26 <@dazo> !pushdns
02:26 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
02:26 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
02:26 < hyper_ch> Bushmills: :)
02:26 <@dazo> read #4 ... and stop wasting our time
02:26 < Bushmills> screensilently: unixoid client?
02:26 <@dazo> lol
02:26 < screensilently> Bushmills: yes yes. i don't have that script
02:26 < krzee> hyper_ch, yes, he definitely is, search david sommerseth on the mail list :-p
02:26 < Bushmills> screensilently: man page tells you why dhcp-option doesn't do anything on unixoids without additional effort on clients
02:27 < hyper_ch> krzee: mail lists scare me
02:27 < Bushmills> and it also tells you how to remedy that
02:28 < krzee> dazo, im a late vote, yes refusing man pages warrants a kick, in fact its already in the end of the topic
02:28 < krzee> "We won't put more work into your problem than you do, that's just silly."
02:29 < krzee> =]
02:29 <@dazo> that makes me feel even better, because I didn't even feel bad about that kick :)
02:29 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
02:29 < krzee> well im guessing i was the 137'th vote anyways ;]
02:30 <@dazo> lol ... I sure hope so
02:30 < krzee> ok back to sqls
02:30 <@dazo> screensilently: I'll be a bit more helpful ... http://lmgtfy.com/?q=openvpn+push+dns+linux
02:30 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
02:32 < screensilently> i already have the dns setting on my local openvpn.conf
02:32 < screensilently> do i need to use the script?
02:33 <@dazo> google it
02:34 < krzee> ill give you one more chance to read what vpnHelper says
02:34 < krzee> !pushdns
02:34 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
02:34 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
02:34 < krzee> #4
02:35  * Bushmills runs a recursive name server on selected clients
02:35  * dazo does too
02:36  * hyper_ch does not
02:37 < screensilently> i want to use different dns servers for my connection and 10.X.X.X
02:37 < screensilently> not going to work if i put it on resolv.conf
02:38 < screensilently> if i put 10.0.0.1 in resolv.conf google.com will use 10.0.0.1 dns, something i don't want
02:38 < Bushmills> screensilently: check out dnsmasq. that can forward requests to different name server, depending on queried domain
02:40 < screensilently> what if i'm using windows?
02:40 < Bushmills> then i pity you
02:41 < screensilently> another one?
02:42 < Bushmills> i suppose you need a solution, suited for windows, in that case
02:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:50 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
02:50 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
02:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
02:53 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
03:02 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Quit: Leaving]
03:04 -!- K1ng [~KING@180.211.188.185] has joined #openvpn
03:04 < screensilently> king for a day?
03:08 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
03:11 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
03:15 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
03:26 -!- MarKsaitis [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has joined #openvpn
03:34 <@vpnHelper> RSS Update - forum: Doubt About multiple instances openvpn <http://forums.openvpn.net/topic8198.html#p12552>
03:34 -!- screensilently [screensile@gateway/shell/anapnea.net/x-umsxzzquidsdoctu] has left #openvpn []
03:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:12 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
04:12 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
04:23 -!- extor [~extor@c-76-16-36-19.hsd1.il.comcast.net] has joined #openvpn
04:24 -!- MarKsaitis [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has quit [Ping timeout: 255 seconds]
04:34 -!- MarKsaitis [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has joined #openvpn
04:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:42 -!- newmember [~newmember@209.82.97.21] has quit [Ping timeout: 240 seconds]
04:50 -!- MarKsaitis [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has quit [Ping timeout: 255 seconds]
05:01 <@vpnHelper> RSS Update - forum: Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12553>
05:04 -!- MarKsaitis [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has joined #openvpn
05:07 -!- dazo is now known as dazo_afk
05:31 <@vpnHelper> RSS Update - forum: OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12554>
05:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:39 -!- raket [~raket@roker.ganjah.se] has quit [Quit: leaving]
05:45 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:00 -!- flowbee [~flowbee__@c-98-232-28-104.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
06:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:16 -!- flowbee [~flowbee__@c-98-232-28-104.hsd1.wa.comcast.net] has joined #openvpn
06:17 -!- dazo_afk is now known as dazo
06:20 -!- takamichi [Takamichi@78.133.37.249] has quit [Read error: Connection reset by peer]
06:21 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
06:30 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
06:32 -!- MarKsaitis [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has quit [Ping timeout: 244 seconds]
06:33 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
06:35 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:40 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
06:40 -!- MarKsaitis [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has joined #openvpn
06:50 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:51 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
07:11 -!- luneff [~yury@84.51.197.177] has quit [Ping timeout: 276 seconds]
07:22 <@vpnHelper> RSS Update - forum: OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12556> || Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p12555>
07:24 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
07:35 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
07:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:51 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
08:10 -!- bridgethis [~admin@c-66-30-230-83.hsd1.nh.comcast.net] has joined #openvpn
08:15 < bridgethis> Hi guys, I was hoping to get a quick reality check. I am trying to setup a dedicated server to bridge a subnet of external IP's to a series of clients simultaneously connected to my server. I want to use ethernet bridging so that each client has their own unique IP. In order to do this, should I be making a TAPx device for each IP address I have, and then letting openVPN decide which device to give to which client, or am I looking at 
08:15 < bridgethis> wrong and should be using a DHCP server to feed openVPN the IP's? I guess that the whole bridged interface and how it relates when we are bridging more than one IP to more than one client is what is throwing me off. If anyone could toss a little bit of clarification my way I would appreciate it!
08:18 < Bushmills> yoiu don't need bridging to assign unique ip addresses to clients
08:19 < Bushmills> server for multiple clients (each one with its unique ip address) needs one tun device
08:20 < Bushmills> openvpn server assigns those addresses to connecting clients. no dhcp server involved
08:20 < bridgethis> is there any setup needed on the host OS?
08:21 < Bushmills> host os needs support for tun device. and firewall must permit clients.
08:22 < bridgethis> Thanks a lot man, I really appreciate the help!
08:22 -!- Belial__ [~quassel@216.18.197.178] has joined #openvpn
08:23 < Bushmills> no worries
08:23 -!- Belial_ [~quassel@128.210.61.130] has quit [Ping timeout: 276 seconds]
08:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:31 <@vpnHelper> RSS Update - forum: Can't establish route to network behid openvpn server <http://forums.openvpn.net/topic8221.html>
08:33 -!- goshawk [~goshawk@66.113.168.109.host.static.ip.kpnqwest.it] has joined #openvpn
08:33 < goshawk> hi
08:34 < goshawk> after setting the push "route 192.168.0.0 255.255.255.0" which iptables rule should i add so that i can ping a machine in that address range from the vpn ? 
08:36 <@vpnHelper> RSS Update - forum: Squid and OPenVpn is this possible? <http://forums.openvpn.net/topic8222.html>
08:39 -!- MarKsaitis_ [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has joined #openvpn
08:40 -!- MarKsaitis [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has quit [Ping timeout: 250 seconds]
08:42 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
08:43 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Client Quit]
08:52 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
08:53 <@vpnHelper> RSS Update - forum: is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html#p12559>
08:55 -!- goshawk [~goshawk@66.113.168.109.host.static.ip.kpnqwest.it] has quit [Ping timeout: 246 seconds]
08:56 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Read error: Connection reset by peer]
08:56 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
09:02 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Remote host closed the connection]
09:02 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
09:06 <@vpnHelper> RSS Update - forum: OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12560>
09:09 -!- bridgethis [~admin@c-66-30-230-83.hsd1.nh.comcast.net] has quit [Quit: bridgethis]
09:26 -!- bent_screwdriver [~UserNick@74.255.249.66] has joined #openvpn
09:28 -!- MarKsaitis_ [~MarKsaiti@94-195-199-7.zone9.bethere.co.uk] has quit [Ping timeout: 252 seconds]
09:36 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12562> || Tutorial how to connect server A to server B <http://forums.openvpn.net/topic8214.html#p12561>
09:40 -!- bridgethis [~admin@63.127.198.186] has joined #openvpn
09:43 -!- p3rror [~mezgani@41.140.170.151] has quit [Ping timeout: 246 seconds]
09:54 <@vpnHelper> RSS Update - forum: can anyone help me? <http://forums.openvpn.net/topic8223.html>
09:54 -!- darkdrgn2k [~darkdrgn2@204.101.63.212] has joined #openvpn
09:54 < darkdrgn2k> hey guys
09:55 < darkdrgn2k> is there any reason openvpn creates multiple entries in ipp.txt for the same common name
10:00 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:01 -!- bridgethis [~admin@63.127.198.186] has quit [Quit: bridgethis]
10:02 -!- bridgethis [~admin@63.127.198.186] has joined #openvpn
10:07 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
10:08 -!- bridgethis [~admin@63.127.198.186] has quit [Ping timeout: 240 seconds]
10:08 -!- EugenMayer [~eugen@frbg-5d84edae.pool.mediaWays.net] has joined #openvpn
10:09 < EugenMayer> Hello guys. Iam using openVPN for time for an office network, backup network, development network and a maintaince network
10:10 < EugenMayer> currently all have be end-to-side connections basically, but now iam getting pushed to a limit on the maintance network. 
10:11 < EugenMayer> It is used to maintain a software for a our clients. Normally or VM in the customer network simply connects to our VPN GW - so end-to-site. But finally we have to deal with a site-to-site connection and iam not sure how this will work out concerning the IP-ranges
10:12 < EugenMayer> maintain-server -> OUR VPN GW <-> internet <-> THEIR GW + client of our VPN <-> VM with the software
10:13 -!- Synthead [~max@m1c5e36d0.tmodns.net] has joined #openvpn
10:14 < Synthead> I'm trying to get some routing and junk going on a VPN... it's kind of specific, so let me explain the topology :)
10:14 < Synthead> our internal network is 10.0.1.0/24
10:14 < Synthead> just a sec
10:15 -!- goshawk [~goshawk@66.113.168.109.host.static.ip.kpnqwest.it] has joined #openvpn
10:15 < goshawk> hi
10:15 < goshawk> after setting the push "route 192.168.0.0 255.255.255.0" which iptables rule should i add so that i can ping a machine in that address range from the vpn ? 
10:17 < Synthead> heheheh, that's exactly what I was going to ask
10:21 < Synthead> Also, I have "server 10.42.0.1 255.255.255.0" in my conf, and openvpn says "Options error: --server directive network/netmask combination is invalid".  I'm not using this subnet for anything else, so what's the deal?
10:22 < Synthead> ohhhhhhhhh, it should be 10.42.0.0, oops :D
10:28 < Synthead> "Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines)." how would I do this?
10:36 -!- Synthead [~max@m1c5e36d0.tmodns.net] has quit [Ping timeout: 260 seconds]
10:40 -!- Synthead [~max@m1c5e36d0.tmodns.net] has joined #openvpn
10:45 < goshawk> Synthead, exactly the same problem as me
10:45 < goshawk> :D
10:57 -!- oskie [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has quit [Ping timeout: 248 seconds]
11:01 -!- oskie_ [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has joined #openvpn
11:04 -!- Synthead [~max@m1c5e36d0.tmodns.net] has quit [Ping timeout: 260 seconds]
11:14 <@vpnHelper> RSS Update - forum: Squid and OPenVpn is this possible? <http://forums.openvpn.net/topic8222.html#p12565> || is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html#p12564>
11:19 -!- Synthead [~max@70-90-75-102-BusName-atl.ga.hfc.comcastbusiness.net] has joined #openvpn
11:20 <@vpnHelper> RSS Update - forum: Can't establish route to network behid openvpn server <http://forums.openvpn.net/topic8221.html#p12566>
11:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
11:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:42 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
11:51 -!- K1ng` [~KING@180.211.188.185] has joined #openvpn
11:54 -!- bridgethis [~admin@c-66-30-230-83.hsd1.nh.comcast.net] has joined #openvpn
11:54 -!- K1ng [~KING@180.211.188.185] has quit [Ping timeout: 240 seconds]
11:55 < bridgethis> Hi, this may seem like a silly question, but if I want openvpn to forward all my clients their own outward facing, external IP address, do I just change the virtual IP range in the server directive in the configuration file to the IP range of my external IP's?
12:03 -!- EugenMayer [~eugen@frbg-5d84edae.pool.mediaWays.net] has quit [Quit: Leaving.]
12:06 < darkdrgn2k> is there any reason openvpn creates multiple entries in ipp.txt for the same common name
12:15 <@dazo> darkdrgn2k: http://thread.gmane.org/gmane.network.openvpn.user/32232
12:15 <@vpnHelper> Title: Gmane Loom (at thread.gmane.org)
12:23 <@vpnHelper> RSS Update - forum: Squid and OPenVpn is this possible? <http://forums.openvpn.net/topic8222.html#p12567>
12:24 -!- Netsplit *.net <-> *.split quits: Perun_, oskie_, kusznir, noisebleed, oc80z, sigius
12:24 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has joined #openvpn
12:25 -!- Netsplit over, joins: Perun_, oskie_, noisebleed, oc80z, kusznir, sigius
12:38 -!- goshawk [~goshawk@66.113.168.109.host.static.ip.kpnqwest.it] has quit [Ping timeout: 240 seconds]
12:53 -!- dazo is now known as dazo_afk
13:04 < kusznir_> Ok, I think I found one problem on my openvpn routed internal networks issue.  It appears the server is not putting a route in for the remote lan networks.  How can I fix that?  (eg, is there a client config option that when that client connects, the server openvpn will add a route to its OS to the remote network)?
13:08 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn []
13:08 < krzie> sure
13:08 < krzie> the route command can be used in a ccd
13:08 < krzie> but it doesnt really need to
13:09 < krzie> you wont be able to reach that network either way when the client is not connected
13:09 < krzie> so theres not much of a difference if its in the server config
13:10 < kusznir_> krzie, Ok, but the route command does need to be in there somewhere?  I just added it to the ccd for this client, but it doesn't seem to be having any effect (the servers' os routing table does not show a route to the client's internal LAN).
13:10 < krzie> just put it in the server config
13:11 < krzie> make sure the iroute is in the ccd
13:11 < krzie> and the push route goes in the server config too
13:11 < krzie> (this is all explained in !route)
13:11 < krzie> !route
13:11 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:12 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:12 < kusznir_> I think I got push "route..." and just route ... commands confused.  I had route <ip> commands in my server config, and I "corrected" them all to push "route xxx" commands.
13:14 < kusznir_> ok, that appears to have fixed it.  It appears that putting the route in the ccd didn't work, but putting it in the main server config did.  My VPN is now fully working again, thanks!
13:17 < kusznir_> Well, almost...Now I need to figure out how to keep dd-wrt from doing stupid stuff to the firewall and breaking it...
13:17  * kusznir_ goes off to #dd-wrt
13:18 -!- sj7trunks [~Adium@75-149-45-169-SFBA.hfc.comcastbusiness.net] has joined #openvpn
13:22 -!- takamichi [Takamichi@78.133.37.249] has quit [Ping timeout: 264 seconds]
13:22 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
13:26 -!- sj7trunks [~Adium@75-149-45-169-SFBA.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
13:26 -!- sj7trunks [~Adium@75-149-45-169-SFBA.hfc.comcastbusiness.net] has joined #openvpn
13:27 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
13:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
13:37 < darkdrgn2k> where can i find a vrml plugin for winblows
13:40 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
13:48 < Bushmills> have you looked on http://www.openvpn.net?
13:48 <@vpnHelper> Title: OpenVPN - Open Source VPN (at www.openvpn.net)
13:50 -!- luneff [~yury@84.51.197.177] has joined #openvpn
13:54 -!- Yen [~Yen@unaffiliated/yen] has joined #openvpn
14:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:19 < krzie> whats vrml?
14:20 < krzie> and more importantly, how does it relate to openvpn
14:20 < krzie> assuming its "virtual reality modeling language"  im definitely interested to know the relation to openvpn
14:24 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
14:26 < hyper_ch> hi krzie
14:27 < hyper_ch> !beer
14:27 <@vpnHelper> "beer" is its what's for dinner!
14:27 < krzie> !blame
14:27 <@vpnHelper> "blame" is According to Bushmills, it's always krzee's fault
14:27 < hyper_ch> !pizza
14:27 < hyper_ch> bushmills seems to be right:)
14:28 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
14:35 -!- drewr_ [~drewr@oks.bluefinlab.com] has joined #openvpn
14:56 -!- sj7trunks [~Adium@75-149-45-169-SFBA.hfc.comcastbusiness.net] has quit [Quit: Leaving.]
15:04 < amir> does someone have experience with openvpn & snmp?
15:04  * amir had to find out that a tunnel-restart confuses snmpd and it has to be restarted after a tunnel got re-opened... :(
15:05 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 258 seconds]
15:06 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
15:07 -!- Lenhix [~lenhix@adsl201-232-127-1.epm.net.co] has joined #openvpn
15:20 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 246 seconds]
15:20 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
15:23 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12568>
15:28 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:29 < krzee> http://www.youtube.com/watch?v=EAchKt2xjsw
15:29 <@vpnHelper> Title: YouTube - Wish you were here (at www.youtube.com)
15:29 < krzee> such good stuff
15:30 < krzee> nowhere near my preferred genre, but a definite classic
15:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:35 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
15:36 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
15:36 -!- Belial__ [~quassel@216.18.197.178] has quit [Ping timeout: 258 seconds]
15:37 -!- bridgethis [~admin@c-66-30-230-83.hsd1.nh.comcast.net] has quit [Ping timeout: 246 seconds]
15:48 -!- KaiForce [~chatzilla@adsl-70-228-79-239.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
15:58 -!- K1ng` [~KING@180.211.188.185] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
16:05 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
16:09 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
16:10 -!- MarKsaitis__ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
16:11 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
16:12 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
16:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
16:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:17 -!- Belial_ [~quassel@128.210.61.130] has quit [Read error: Connection reset by peer]
16:23 -!- K1ng [~KING@180.211.188.185] has joined #openvpn
16:34 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
16:35 -!- [deXter] [~dexter@125-237-93-131.jetstream.xtra.co.nz] has joined #openvpn
16:39 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
16:48 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
16:48 -!- jaminja [~jaminja@212.7.195.193] has quit [Ping timeout: 255 seconds]
16:49 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
16:50 -!- MarKsaitis__ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
16:50 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
16:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:14 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
17:24 -!- jaminja [~jaminja@212.7.195.193] has quit [Ping timeout: 250 seconds]
17:24 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
17:32 -!- jaminja [~jaminja@212.7.195.193] has quit [Ping timeout: 240 seconds]
17:35 -!- Lenhix [~lenhix@adsl201-232-127-1.epm.net.co] has quit [Quit: Mindwall!!]
17:36 -!- gorkhaan [~gorkhaan@2001:738:7901:729:21b:38ff:fed0:b195] has quit [Read error: Connection reset by peer]
17:38 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
17:41 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Quit: Ex-Chat]
17:42 -!- Yen [~Yen@unaffiliated/yen] has quit []
17:49 -!- jaminja [~jaminja@212.7.195.193] has quit [Ping timeout: 240 seconds]
17:52 <@vpnHelper> RSS Update - forum: OpenVPN Access Server Certificates <http://forums.openvpn.net/topic8224.html>
17:52 -!- [deXter] [~dexter@125-237-93-131.jetstream.xtra.co.nz] has quit [Quit: Leaving]
17:54 -!- Qation [43a3168b@gateway/web/freenode/ip.67.163.22.139] has joined #openvpn
17:58 <@vpnHelper> RSS Update - forum: OpenVPN Access Server Certificates <http://forums.openvpn.net/topic8224.html#p12570>
18:04 < Qation> Can anyone help me connecting to my vpn in linux cli? I have a client.crt host.ovpn ca.crt client.key and ta.key Does anyone know how i can use them to connect?
18:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
18:08 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 255 seconds]
18:08 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
18:11 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
18:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:25 -!- jaminja [~jaminja@212.7.195.193] has quit [Read error: Operation timed out]
18:27 -!- images [~images@static.238.229.4.46.clients.your-server.de] has left #openvpn ["Bye!"]
18:37 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
18:41 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:44 < Bushmills> !howto
18:44 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:58 <@vpnHelper> RSS Update - forum: OpenVPN Access Server Certificates <http://forums.openvpn.net/topic8224.html#p12571>
19:16 -!- jaminja [~jaminja@212.7.195.193] has quit [Changing host]
19:16 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
19:30 -!- Qation [43a3168b@gateway/web/freenode/ip.67.163.22.139] has quit [Quit: Page closed]
19:31 -!- drewr_ [~drewr@oks.bluefinlab.com] has quit [Quit: Computer has gone to sleep.]
19:41 -!- twister004 [~chatzilla@59.90.34.167] has quit [Read error: Connection reset by peer]
20:11 -!- master_of_master [~master_of@p57B5588C.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:13 -!- master_of_master [~master_of@p57B55AC0.dip.t-dialin.net] has joined #openvpn
20:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:22 -!- sj7trunks [~Adium@75-149-45-169-SFBA.hfc.comcastbusiness.net] has joined #openvpn
20:40 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
20:40 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:42 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 240 seconds]
20:42 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
20:46 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
21:04 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:04 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
21:12 -!- Adde_BC [~AddeBC@c193-150-233-51.bredband.comhem.se] has joined #openvpn
21:13 -!- Addemanne [~AddeBC@c193-150-233-51.bredband.comhem.se] has quit [Ping timeout: 276 seconds]
21:15 < ecrist> sup bitches?
21:24 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
21:27 -!- flowbee [~flowbee__@c-98-232-28-104.hsd1.wa.comcast.net] has quit [Read error: Operation timed out]
21:29 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:35 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Remote host closed the connection]
21:40 <@vpnHelper> RSS Update - forum: Tutorial how to connect server A to server B <http://forums.openvpn.net/topic8214.html#p12572>
21:48 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:50 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:52 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:56 -!- flowbee [~flowbee__@c-98-232-13-8.hsd1.wa.comcast.net] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:36 -!- bleevo [~bleevo@115-64-110-11.tpgi.com.au] has quit [Read error: Connection reset by peer]
22:39 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:55 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
23:55 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
--- Day changed Fri May 27 2011
00:03 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
00:04 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
00:04 -!- mode/#openvpn [+o raidz] by ChanServ
00:11 < zeshoem> I have the following NAT rule : iptables -t nat -A POSTROUTING -j SNAT --to 67.A.B.C Q:How do I enable it for all source ips except 127.0.0.1 ?
00:11 -!- p3rror [~mezgani@41.140.98.143] has joined #openvpn
00:21 <@vpnHelper> RSS Update - forum: New to OpenVPN, how do I tunnel ssh and ftp? <http://forums.openvpn.net/topic8213.html#p12573>
00:39 <@vpnHelper> RSS Update - forum: How to tunnel ssh and ftp through OpenVPN. The simple way. <http://forums.openvpn.net/topic8213.html#p12573>
00:39 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has quit [Read error: Operation timed out]
00:39 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
00:59 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:00 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
01:01 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
01:15 -!- K1ng [~KING@180.211.188.185] has quit [Ping timeout: 276 seconds]
01:24 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
01:25 < Kartagis> hi
01:27 < Kartagis> I VPN'd to my server, and I have pushed DNS server too. now I have these in my /etc/resolv.conf. is this normal?
01:27 < Kartagis> domain openvpn
01:27 < Kartagis> search openvpn
01:27 < Kartagis> nameserver 66.96.208.21
01:30 -!- dazo_afk is now known as dazo
01:32 -!- zeshoem [~mnathani@bas1-toronto46-1177856523.dsl.bell.ca] has quit [Read error: Connection reset by peer]
01:35 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
02:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:07 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has joined #openvpn
02:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:10 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:12 < xsurfer> good day all.  I have replied to one question in the forum.  The questions is that he wanted to be able to access many servers on different hosts with only one registration of username and password.  My suggestion was to place those usersname and password on every host.  Any comments?
02:13 <@vpnHelper> RSS Update - forum: Tutorial how to connect server A to server B <http://forums.openvpn.net/topic8214.html#p12574>
02:16 < xsurfer> what do you think guys?
02:17 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:17 -!- mode/#openvpn [+o mattock] by ChanServ
02:19 < xsurfer> guys what to you think?
02:25 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Read error: Connection reset by peer]
02:36 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
02:59 < Kartagis> I forgot, where do we put the post connection iptables option?
02:59 < Kartagis> what file?
03:02 < Bushmills> how should we know where you put them?
03:03 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 258 seconds]
03:03 < Kartagis> where does it go normally?
03:03 < Bushmills> in a file name named according your personal preferences
03:04 < Bushmills> iptables has no provisions, therefore no naming preferences, for iptables stuff, and vice versa
03:04 < Bushmills> openvpn, i mean
03:07 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
03:08 < Kartagis> I'm asking this because after I open the VPN connection, I can't surf
03:08 < Kartagis> and there was a file where we put the post connection stuff
03:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:11 < Kartagis> where we route connection
03:12 < Bushmills>  we don't know where you put your post connection stuff into
03:14 < Bushmills> mine is in, depending on system, scripts in either /etc/openvpn  or  /etc/default 
03:15 < Bushmills> some non-openvpn related post connection scripts are in  /etc/network
03:15 < Bushmills> not that that helps you a lot
03:16 < Kartagis> so, let me ask this. why wouldn't I be able to surf after I establish the VPN connection
03:16 < Kartagis> ?
03:16 < Bushmills> but - had you come up with that reply, had i asked you where i keep my post-connect scripts? 
03:16 < Bushmills> because you didn't configure it correctly?
03:16 < Kartagis> right, post-connect scripts
03:16 < Bushmills> not needed
03:17 < Kartagis> Bushmills: I used to be able to do it
03:17 < Bushmills> not needed for surfing through openvpn
03:17 < Kartagis> Bushmills: can I show you my file?
03:18 < Bushmills> try to determine why you can't surf through openvpn first
03:18 < Bushmills> where does traffic go to?
03:18 < Kartagis> the server?ü
03:18 < Bushmills> why "?"?
03:18 < Bushmills> is that a guess? or are you asking me?
03:19 < Kartagis> guess
03:19 < Bushmills> well, then i guess that the server OS hasn't been set up correctly.
03:19 < Bushmills> openvpn seems to have done all it needs to the client
03:20 < Bushmills> because traffic seems to go to server, as you have guessed. that's all openvpn can do
03:20 < Kartagis> I used to be able to do it, suddenly it stopped
03:20 < Bushmills> therefore i'm not in need to see your openvpn config - everything is ok there
03:20 < Bushmills> !redirect
03:20 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
03:21 < Kartagis> !nat
03:21 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
03:22 -!- luneff [~yury@84.51.197.177] has joined #openvpn
03:33 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
03:34 < xsurfer> !welcome
03:34 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:35 < xsurfer> !goal
03:35 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:36 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:36 < xsurfer> !route
03:36 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
03:38 < xsurfer> anybody around now?
03:40 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
03:43 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
03:43 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
03:43 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:47 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 244 seconds]
03:47 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
03:47 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
03:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
03:49 -!- jaminja [~jaminja@rijkdijk2.demon.co.uk] has joined #openvpn
03:52 < xsurfer> !topology
03:52 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
03:52 -!- xsurfer [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
04:00 < Kartagis> !goal
04:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:46 <@vpnHelper> RSS Update - forum: Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12576>
05:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:21 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
05:28 <@vpnHelper> RSS Update - forum: Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12577>
05:30 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
05:42 <@vpnHelper> RSS Update - forum: Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12578>
05:57 -!- luneff [~yury@84.51.195.188] has joined #openvpn
06:00 -!- flowbee [~flowbee__@c-98-232-13-8.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
06:01 -!- flowbee [~flowbee__@c-98-232-13-8.hsd1.wa.comcast.net] has joined #openvpn
06:05 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
06:08 -!- luneff [~yury@84.51.195.188] has quit [Max SendQ exceeded]
06:08 -!- luneff [~yury@84.51.195.188] has joined #openvpn
06:12 <@vpnHelper> RSS Update - forum: Routing problem from client's LAN <http://forums.openvpn.net/topic8217.html#p12580>
06:18 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
06:42 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
06:44 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 250 seconds]
06:44 -!- twister004_ is now known as twister004
06:46 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
06:46 -!- jaminja [~jaminja@rijkdijk2.demon.co.uk] has quit [Changing host]
06:46 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
06:46 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
06:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
06:53 < xsurfer> good day all.  there is this one member who asked how his clients connect to different servers on different hosts using only one username/password authentication.
06:54 < xsurfer> I told that he should also have those user/passwd in those servers each
06:54 < xsurfer> was I correct?
07:04 -!- tingelt [~tingelt@gw-2s00.inf.fh-bonn-rhein-sieg.de] has joined #openvpn
07:04 < ecrist> xsurfer: yes, or use a central authentication back end, which does the same thing, like LDAP
07:05 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
07:06 -!- genesis_ [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
07:08 < genesis_> i have problem under UDP.  What is causing TLS keys are out of sync error?  How can I solve this error?
07:11 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
07:11 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:18 -!- genesis_ [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
07:20 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
07:20 < defswork> !goal
07:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:22 < defswork> I'm trying to roll out an openvpn solution at my company and IT dept are asking for whitepapers on it's use.  I'm not sure why as they didnt ask for this from the company they paid a fortune to for a solution that doesnt work, but has anyone got anything that might help ?
07:22 < defswork> 400 end users - no figures on concurrent use.
07:22 < defswork> server is all built -I've even written a script for IT to add/revoke certs and do user passwords etc..
07:23 < defswork> planning on it being scaleable by simple round robin dns - add another server when it looks like its starting to sweat
07:32 <@dazo> defswork: http://www.openvpn.net/images/OpenVPNAccessServerDataSheet.pdf  ... this is the commercial version, but under the hood the open source version is used, it's just wrapped in with some management tools and a special Windows client to make it simpler to deploy it
07:33 < defswork> aah -cool
07:33 < defswork> I've written my own deployment stuff - creates per client zip files and an install.bat that does everything
07:33 < defswork> puts in the openvpngui that supports the management interface too
07:34 <@dazo> defswork: http://www.sans.org/rr/whitepapers/vpns/1459.php  this is a more neutral point of view
07:34 < defswork> thank you 
07:35 -!- tingelt [~tingelt@gw-2s00.inf.fh-bonn-rhein-sieg.de] has quit [Remote host closed the connection]
07:35 <@dazo> anyway, we don't support the Access Server product here, neither the OpenVPN Connect product ... so that's kind of the difference on the support side ... those products got commercial support via the company though
07:36 < defswork> supports not an issue really - I've been using openvpn for years - must be at least 8.  I'm totally comfortable with it
07:36 < defswork> my IT dept though are windows clicky clickers
07:37 < defswork> and they currently pay 50quid per user per year for a VPN solution that no one can use
07:37 < defswork> have to create a softtoken and every user has they credentials in a txt file on their desktop because they can't remember them
07:38 < defswork> and when they lose sight of the server they have to create a new token
07:38 < defswork> shit has hit the fan so I was asked it my solution would work (already did openvpn out of this office)
07:39 <@dazo> defswork: sounds like you're going into the right path then
07:40 < defswork> theres a lot of resistance from it
07:40 < defswork> IT*
07:40 < defswork> I'm not IT but ran this office for 10 years and know a lot more than they do
07:40 <@dazo> defswork: for extra security though, you might want to have a look at a plug-in I have written, called eurephia
07:40 <@dazo> !eurephia
07:40 <@vpnHelper> "eurephia" is http://www.eurephia.net/
07:40 < defswork> but I'm totally open source, samba, squid, qmail etc.. etc.. here - they know nothing of such things
07:41 <@dazo> currently it doesn't support external auth mechanisms (LDAP, PAM, etc) ... but I'm looking into that too
07:41 < defswork> I wrote my own auth plugin
07:41 <@dazo> ahh :)
07:41 < defswork> uses htpasswd files
07:42 < defswork> it's amickey mouse c program
07:42 < defswork> works though 
07:42 <@dazo> what makes eurephia a bit different, is that it matches certificates with usernames ... and can update iptables based firewalls with restricted access via the VPN, depending on username/certificate 
07:42 <@dazo> yeah, what works, is usually the best ... and it sounds like you need a GUI ;-)
07:42 < defswork> sounds good - I will look into it
07:43 < defswork> I've written a menu driven shell script (which can also be called from cmd line)
07:43 < defswork> openvpnmanager add clientname etc..
07:43 < defswork> has all the cert management and user management in it
07:44 < defswork> I knew that they would fine reasons to not want it
07:44 < defswork> so tried to cover all possible objections
07:44 < defswork> they probably will object to logging in via ssh 
07:44 <@dazo> from what you describe ... eurephia won't work in your organisation, not currently :)
07:44 < defswork> we have 1500+ staff
07:44 < defswork> and monkeys running IT
07:45 <@dazo> ugh
07:45 < defswork> I'm in a remote office fighting them off changing everything here
07:45 < defswork> we're still on samba dc and qmail/dovecot/davical etc..
07:46 < defswork> I have fixed IP allocation btw so I can do the firewall statically
07:46 <@dazo> however, one thing to be aware of with OpenVPN ... there are some reports that it scales worse when hitting more than 150 simultaneous users .... but that can be solved running multiple OpenVPN servers on the same box, and even better if each process can be pinned to separate CPU cores
07:46 < defswork> my script adds dns entries
07:46 < defswork> and the windows installer installs tightvnc blind so they can do remote administration easy
07:47 < defswork> openvpnmanager add clientname ; xvnc4viewer clientname.vpn.example.com
07:47 <@dazo> you should publish your work with a free (libre) license
07:47 < defswork> I will
07:47 <@dazo> cool!
07:47 <@dazo> When you do, feel free to add it here: https://community.openvpn.net/openvpn/wiki/RelatedProjects
07:47 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
07:48 < defswork> the windows modded version of openvpngui with management interface should be more easy to find - if not the default in the windows installer
07:49 < defswork> I needed that as I wanted user authentication layer but openvpn running as a service as users shouldnt be admins (they currently are but I will work changing that in)
07:49 <@dazo> That version is planned to be a part of the 2.3 release, which adds full IPv6 support as well
07:49 < defswork> cool
07:55 < defswork> so, I have this running on a quad xeon 2.8ghz. using DES-EDE3-CBC and 1024bit keys
07:56 < defswork> how many concurrent connections before I need to add a 2nd server  would you guess ?
08:01 < defswork> hmm multiple servers on same box would require different ports.  I'd have to build that in to my client creation stuff
08:02 < defswork> I'm better off doing that now before roll out then
08:07 <@dazo> defswork: there have been some reports that the performance drops around 150 clients, where all are active
08:08 <@dazo> some notices it around 120, others at 250 ... so it depends on the amount of traffic flowing too
08:08 < defswork> yeah I just read back to that so I will implement 4 instances - one per core on this box
08:08 < defswork> just need to work out how to distribute clients
08:09 < defswork> 4 diff ports is probably simplest
08:09 < defswork> and I can rotate the port numbers in my client create script
08:10 < defswork> vaguely remember a tool to tie processes to cores in linux too
08:11 < defswork> is that something that can be fixed internally with openvpn by making it multithreaded or something ultimately ?
08:12 <@dazo> defswork: you can do that easy with multiple --remote <host>:<port>  statements in the client configs ... and on the server you can add max-clients, which will then reject when it hits the limit ... clients will then jump to another box instead
08:13 <@dazo> you can also put in --remote-random in the client configs, to spread the connections somewhat there as well
08:13 < defswork> and I can add round robin dns on top of that for multiple servers too 
08:13 < defswork> so vpn1.example.com:1194 vpn1.example.com:1195 etc.. 
08:13 < defswork> excellent
08:14 < defswork> I'll test it now
08:15 < defswork> cpu affinity!
08:16 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
08:17 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:18 <@dazo> :)
08:18 <@dazo> cpuset ;-)
08:19 <@dazo> or taskset might be better actually
08:21 < defswork>  taskset -c 1 openvpn --config server.conf --port 1195
08:22 <@dazo> yeah
08:24 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
08:24 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
08:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:29 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:29 -!- K1ng [~KING@119.30.38.76] has joined #openvpn
08:30 < defswork> why does windows sometimes throw traffic with bad source address down the openvpn connection!
08:34 < genesis> sorry defswork. I guess no one is home yet!
08:34 <@dazo> ahh, that sounds familiar ... there's written something about that ...
08:35  * dazo tries to find it again
08:35 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:35 <@dazo> defswork: http://openvpn.net/archive/openvpn-users/2005-01/msg00091.html
08:35 <@vpnHelper> Title: Re: [Openvpn-users] Bad source address from client (at openvpn.net)
08:36 < genesis> dazo: can I ask you question?
08:36 <@dazo> genesis: depends on what it is about ... I might or might not know the answer
08:38 < genesis> the situation is that I have example three vps servers on different hosts.  the client registers one username and password on server one.  How can the client use the same username and password to be able to connect to server 2 and 3.  
08:41 <@dazo> genesis: you need to either have a centralised authentication scheme (PAM, LDAP, Kerberos, etc) or you need to synchronize the user/password database with the other servers
08:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:42 < genesis> how to synchronize that database? can you give me idea further
08:43 <@dazo> rsync, scp, ftp, http/https?
08:44 < Bushmills> alternatively, protect several certified keys with the same passphrase
08:44 < genesis> so you mean I have to have the user/passwd files from server 1 and place that on server2 and server3?
08:47 <@dazo> genesis: that's what I meant, yes .... but using PAM, LDAP or Kerberos is far safer
08:47 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
08:47 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
08:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:47 <@dazo> (PAM+LDAP or PAM+Kerberos)
08:48 <@dazo> or PAM+whatever_network_based_authentication, for that matter
08:48 < genesis> sorry dazo but I dont know how to use them. I am just using bitvise to transfer files. can i google them?
08:49 <@dazo> yes, google knows all this
08:50 <@dazo> genesis: just a friendly advice ... if you are not familiar with different authentication schemas, especially when needing authentication to work on several servers, you should really learn that before implementing something like VPN with such features
08:50 < genesis> ok. so it is not possible that server 2 and server 3 dont have those files for client to connect to them?
08:51 <@dazo> For file based username/password authentication, there are no other options
08:51 < genesis> yes. thanks for the advice. I am googling to learn.
08:51 < genesis> thanks dazo for the clarification.
08:52 <@dazo> For network based authentications, it is possible, via  LDAP and Kerberos
08:53 <@dazo> (LDAP is probably easier to get started with, and moving towards Kerberos afterwards, if needed, is usually a natural step)
08:56 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Ping timeout: 252 seconds]
08:56 < defswork> yeah thats the problem - windows chucks data with source address of the NIC down the openvpn connection - I'm sure it shouldnt - should all be form the tap nic's address
08:59 <@vpnHelper> RSS Update - forum: Configure a specific MAC Address to a designated IP Address <http://forums.openvpn.net/topic8212.html#p12581>
09:05 < defswork> dazo, I've set this up with 4 instances but when testing disconnecting and connection with a different port to a different instance there seems to be an issue in the remote traffic returning via the wrong instance
09:06 < defswork> does each instance need to serve isolated IP addresses ?
09:07 < defswork> seems the first server is clinging on to the first connection - not timed it out
09:07 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 246 seconds]
09:07 -!- K1ng [~KING@119.30.38.76] has quit [Remote host closed the connection]
09:08 -!- dazo is now known as dazo_afk
09:14 -!- dazo_afk is now known as dazo
09:14 < defswork> I think I just need to give each server a different IP in the same subnet also
09:17 -!- luneff [~yury@84.51.195.188] has quit [Quit: Leaving]
09:23 <@dazo> I've never really tried out several OpenVPN servers myself, so I don't know
09:24 <@dazo> I think using the same subnet might work fine, as long as the IP pool for VPN clients don't overlap 
09:24 < defswork> I'm using a specified by me pool
09:24 < defswork> ifconfig-pool-persist /etc/openvpn/ipp.txt 0
09:25 < defswork> my client add scripts populates it
09:25 < defswork> I think this will work - just testing now
09:25 <@dazo> neat!
09:26 <@dazo> defswork: you should hang out here, you seem to have a lot of good experience which you could share :)
09:26 < defswork> yeah I've added it to my autojoins :)
09:26 <@dazo> cool :)
09:27 <@dazo> [OT] http://4.bp.blogspot.com/_VUQ3DQEhjsM/Sw7JwfaSpPI/AAAAAAAAAYc/KaMz4ueHEdE/s1600/developersarebornbrave.jpg
09:37 -!- Synthead [~max@70-90-75-102-BusName-atl.ga.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
09:38 -!- Synthead [~max@70-90-75-102-BusName-atl.ga.hfc.comcastbusiness.net] has joined #openvpn
09:38 < defswork> hmm ok - this fails
09:38 < defswork> need separate subnets for the routing to work
09:38 < defswork> can I execute a post connect command ?  I can update my dns dynamically then and do separate pools per instance
09:44 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:49 -!- Naku [~syana@94.23.115.158] has joined #openvpn
09:52 -!- Belial__ [~quassel@216.18.197.178] has joined #openvpn
09:52 -!- Belial_ [~quassel@128.210.61.130] has quit [Ping timeout: 255 seconds]
09:53 < Naku> Hello
09:54 < defswork> hmm client-connect is no good to me - thats for me to set 
09:54 < defswork> I need a call after openvpn has set client up 
09:55 < defswork> hmm maybe learn-address
09:56 -!- newmember [~newmember@209.82.97.21] has joined #openvpn
10:03 < defswork> ok that works - thats cool
10:05 <@vpnHelper> RSS Update - forum: Configure a specific MAC Address to a designated IP Address <http://forums.openvpn.net/topic8212.html#p12582>
10:09 < Naku> I want to connect two networks with a vpn like this :
10:09 < Naku> http://img546.imageshack.us/img546/3351/netex12.png
10:09 < Naku> What is the best way to do that?
10:10 < defswork> thats pretty standard 
10:10 < defswork> openvpn - one server, one client and server
10:11 < Naku> should i use bridge ou route mode?
10:11 < defswork> route
10:11 < Naku> then I could access to computer6 from computer2 without any problem?
10:11 < defswork> as long as your routes are correct
10:12 < Naku> ok, Did you have a good tutorial from this?
10:12 < defswork> personally no - but thats a pretty standard setup apart from one thing
10:13 < defswork> the vpn server thats also a client will need to run on differernt ports
10:14 < Naku> I have to install several VPN server?
10:14 < defswork> 2 - one on each server
10:14 < defswork> and also setup 2nd server to run a vpn client to connect to other server
10:16 < Naku> So, i have to install a server on "VPN Server10"
10:16 < defswork> you picture shows a laptopp connecting to it over VPN directly so yes
10:17 < Naku> the to "laptop" are "external" computer
10:18 < Naku> I want to merge my two networks and also accept external computer over the internet
10:19 < defswork> merge ?
10:19 < defswork> connect or merge ?
10:19 < defswork> which ?
10:23 < Naku> I want to have a full access to both networks
10:24 < Naku> computer1 -> computer5 and also Mobile1 -> computer6
10:25 <@dazo> !route
10:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:25 <@dazo> Naku: ^^ 
10:25 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:26 <@dazo> !factoids
10:26 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:26 <@dazo> defswork: ^^ 
10:27 < defswork> script to update dns on allocation complete!
10:28 <@dazo> well done :)
10:30 < Naku> thanks dazo, I'll try
10:31 <@dazo> Naku: I don't know how familiar you are with TCP/IP networking ... basic knowledge here is needed when you do VPN, no matter how you do VPN ... look at !tcpip for some good guidance there
10:37 < defswork> dazo - this all works nicely - 4 servers running their own subnet pools and updating dns for each client that connects
10:38 < defswork> however - is there a way to tell the client to bind to the same local port as it is connecting to the server on ?
10:38 < defswork> as if I disconnect and reconnect to a different server the client moans about old traffic from the previous server 
10:38 <@dazo> defswork: there are --lport and --rport which does this kind of stuff
10:39 <@dazo> --port is basically a "wrapper" for --lport and --rport, iirc
10:39 < defswork> yeah but I am specifying multiple remote sameserver port so don't know what port it is
10:39 < defswork> shorter timeouts on server might help
10:40 < defswork> is notify-exit still valid to push to clients ?
10:40 <@dazo> I think you can then use --lport, which will be default for all connections
10:40 <@dazo> I don't recall if notify-exit can be pushed ... but that can also help, esp. on UDP connections
10:42 < defswork> I've only ever used udp
10:42 < defswork> and I missing something ? :)
10:42 < defswork> am*
10:49 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
10:53 -!- Adde_BC [~AddeBC@c193-150-233-51.bredband.comhem.se] has quit [Ping timeout: 264 seconds]
11:02 < defswork> I've added my htpasswd auth program to https://community.openvpn.net/openvpn/wiki/RelatedProjects
11:02 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
11:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
11:08 <@dazo> defswork: UDP is definitely best, so no you're not missing anything .... TCP has an explicit handshake to close TCP sockets between client and servers, while UDP doesn't have that ... which is why exit-notify is very much useful on UDP
11:10 < defswork> well I'm chuffed with this now - deserved long weekend I think
11:11 < defswork> thanks for the help dazo
11:11 <@dazo> defswork: you're welcome!  Have great weekend!
11:24 -!- newmember [~newmember@209.82.97.21] has quit [Ping timeout: 252 seconds]
11:32 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has quit [Quit: Ex-Chat]
11:32 -!- extor [~extor@c-76-16-36-19.hsd1.il.comcast.net] has quit [Ping timeout: 250 seconds]
11:33 -!- extor [~extor@c-76-16-36-19.hsd1.il.comcast.net] has joined #openvpn
11:37 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Quit: Ex-Chat]
12:01 <@vpnHelper> RSS Update - forum: sharing client user name and password <http://forums.openvpn.net/topic8162.html#p12583>
12:11 -!- luneff [~yury@84.51.197.177] has joined #openvpn
12:13 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
12:13 <@vpnHelper> RSS Update - forum: Problem starting Access Server. <http://forums.openvpn.net/topic8225.html>
12:14 < queequeg1> I'm trying to use password authentication under windows.  I wrote a script after reading the docs on auth-user-pass-verify.  But when I connect the client doesn't ask for a username and password.
12:15 < queequeg1> How can I cause the user to be prompted for a password now that the server expects one?
12:15 < queequeg1> I mean a username and password.
12:19 < queequeg1> ah, I think I undestand.  I have to add auth-user-pass to the client config?
12:21 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
12:22 < queequeg1> it works!
12:22 < queequeg1> :-)
12:27 -!- tingelt [~tingelt@dslb-094-221-116-205.pools.arcor-ip.net] has joined #openvpn
12:28 -!- Proz01d [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
12:29 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
12:30 -!- tingelt_ [~tingelt@dslb-088-076-031-212.pools.arcor-ip.net] has joined #openvpn
12:34 -!- tingelt [~tingelt@dslb-094-221-116-205.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
12:40 < queequeg1> actually, it isn't working.  It is accepting any password.
12:40 < queequeg1> I tested my script with a local file and it worked, but I'm not sure that the exit codes are being sent to openvpn properly. 
12:41 < queequeg1> I'm using python.
12:42 < queequeg1> I guess my script is broken.  back to the drawing board.
12:45 -!- tingelt [~tingelt@dslb-178-006-242-150.pools.arcor-ip.net] has joined #openvpn
12:46 < queequeg1> ah, now the script is working properly.  all is well.
12:47  * dazo likes people who figure out stuff on their own :)
12:48 -!- tingelt_ [~tingelt@dslb-088-076-031-212.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
12:58 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:07 -!- tingelt_ [~tingelt@dslb-084-061-105-220.pools.arcor-ip.net] has joined #openvpn
13:10 -!- tingelt [~tingelt@dslb-178-006-242-150.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
13:19 -!- grapsus [~grapsus@acces1236.res.insa-lyon.fr] has quit [Remote host closed the connection]
13:19 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
13:25 < darkdrgn2k> hey guys
13:25 < darkdrgn2k> if i have 10 vpns each one with a sequential subnet on the other side
13:25 < darkdrgn2k> ie VPN------CLIENT----ADDIONTAL SUBNET
13:26 < darkdrgn2k> do i need to ro "route 10.200.0.0 255.255.255.240" for every sub net or is "route 10.200.0.0 255.255.255.0" enough
13:26 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
13:28 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
13:28 -!- dazo is now known as dazo_afk
13:29 -!- tingelt [~tingelt@dslb-088-076-029-159.pools.arcor-ip.net] has joined #openvpn
13:32 -!- tingelt_ [~tingelt@dslb-084-061-105-220.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
13:33 < darkdrgn2k> 10.200.3.176    10.243.0.2      255.255.255.255 ???
13:36 < darkdrgn2k> hmm
13:36 < darkdrgn2k> its doing Fri May 27 14:31:34 2011 /sbin/ip route add 10.200.3.176/32 via 10.243.0.2
13:36 -!- tingelt_ [~tingelt@dslb-088-076-016-251.pools.arcor-ip.net] has joined #openvpn
13:36 -!- Proz0id [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
13:38 -!- tingelt [~tingelt@dslb-088-076-029-159.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
13:41 -!- tingelt [~tingelt@dslb-094-221-099-209.pools.arcor-ip.net] has joined #openvpn
13:44 -!- tingelt_ [~tingelt@dslb-088-076-016-251.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
13:48 -!- tingelt_ [~tingelt@dslb-088-076-029-052.pools.arcor-ip.net] has joined #openvpn
13:50 <@vpnHelper> RSS Update - forum: Site to Site VPN, Client not getting IP from VPN Subnet <http://forums.openvpn.net/topic8226.html>
13:50 -!- tingelt [~tingelt@dslb-094-221-099-209.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
13:57 -!- tingelt_ [~tingelt@dslb-088-076-029-052.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
14:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:10 -!- kraut [~kraut@dyndsl-091-096-048-226.ewe-ip-backbone.de] has quit [Ping timeout: 248 seconds]
14:12 -!- kraut [~kraut@dyndsl-095-033-153-223.ewe-ip-backbone.de] has joined #openvpn
14:32 <@vpnHelper> RSS Update - forum: Site to Site VPN, Client not getting IP from VPN Subnet <http://forums.openvpn.net/topic8226.html#p12587> || Problem starting Access Server. <http://forums.openvpn.net/topic8225.html#p12586>
14:35 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Quit: Leaving]
14:53 -!- bent_screwdriver [~UserNick@74.255.249.66] has quit [Ping timeout: 246 seconds]
14:59 < darkdrgn2k> LOL anyone around?
15:00 < Proz0id> yup
15:11 < darkdrgn2k> from what i underatnd iroute does nothign more them prevent a push of that same subnet.. right?
15:33 -!- rajkosto [~rajkosto@rajkosto.broker.freenet6.net] has joined #openvpn
15:35 -!- zzattack [zzattack@237-89-ftth.onsneteindhoven.nl] has joined #openvpn
15:44 < zzattack> anyone care to take a look at my config, can't get bridged setup to work. connecting is fine, no firewalls involved yet, route gets pushed but can't ping/connect/anything. http://pastebin.com/ccQNxxLK
15:44 -!- Synthead [~max@70-90-75-102-BusName-atl.ga.hfc.comcastbusiness.net] has quit [Remote host closed the connection]
15:50 < zzattack> !goal
15:50 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:51 < zzattack> !welcome
15:51 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:51 < zzattack> !route
15:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:09 -!- Belial__ [~quassel@216.18.197.178] has quit [Read error: Operation timed out]
16:40 < zzattack> for whoever's interested, the problem had to do with link aggregation interfaces not behaving well on a bridge on bsd 8.2
16:41 < zzattack> didnt change my config but decoupled the lagg interface and all seems well
16:41 -!- zzattack [zzattack@237-89-ftth.onsneteindhoven.nl] has quit []
16:47 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
16:53 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 246 seconds]
17:05 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:06 -!- mode/#openvpn [+o raidz] by ChanServ
17:07 -!- rajkosto [~rajkosto@rajkosto.broker.freenet6.net] has quit [Read error: Connection reset by peer]
17:07 -!- rajkosto [~rajkosto@rajkosto.broker.freenet6.net] has joined #openvpn
17:43 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
17:49 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
18:45 <@vpnHelper> RSS Update - forum: OpenVPN very slow - Less then 8KB/s <http://forums.openvpn.net/topic8227.html>
19:03 <@vpnHelper> RSS Update - forum: simple udp sockets and vpn <http://forums.openvpn.net/topic8228.html>
19:11 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
19:18 -!- p3rror [~mezgani@41.140.98.143] has quit [Ping timeout: 246 seconds]
19:21 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
19:21 -!- sj7trunks [~Adium@75-149-45-169-SFBA.hfc.comcastbusiness.net] has quit [Remote host closed the connection]
19:34 -!- K1ng [~KING@180.211.188.8] has joined #openvpn
19:46 -!- ridger1213 [~chatzilla@50.9.168.137] has joined #openvpn
19:46 < ridger1213> hey guys quick openvpn question
19:46 < ridger1213> i want my computer to run off my normal internet connection... in all instances except Chrome (or a designated browser..)
19:46 < ridger1213> is there anyway to setup OpenVPN to only tunnel traffic on that browser?
19:47 < ridger1213> ??
19:50 < rajkosto> what is a browser ?
19:54 < ridger1213> doesnt matter
19:54 < ridger1213> firefox or chrome
19:57 < rajkosto> what do ip stacks know about browsers ?
20:05 < ridger1213> well 
20:05 < ridger1213> that is kind of the question i am having
20:05 < ridger1213> is there a way to do VPN over
20:05 < ridger1213> like a certian port
20:06 < ridger1213> certain port
20:11 -!- master_of_master [~master_of@p57B55AC0.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
20:12 < rajkosto> only if you do packet marking and policy routing
20:12 -!- master_of_master [~master_of@p57B55DF3.dip.t-dialin.net] has joined #openvpn
20:15 <@vpnHelper> RSS Update - forum: Tutorial how to connect server A to server B <http://forums.openvpn.net/topic8214.html#p12590>
20:40 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
20:40 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:41 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
21:17 -!- jpalmer [~jpalmer@about/windows/staff/jpalmer] has quit [Changing host]
21:17 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
21:50 -!- amir_ [~amir@unaffiliated/amir] has joined #openvpn
21:53 -!- amir [~amir@unaffiliated/amir] has quit [Read error: Operation timed out]
22:09 -!- ridger1213 [~chatzilla@50.9.168.137] has quit [Quit: ChatZilla 0.9.86 [Firefox 3.6.16/20110319135224]]
22:29  * ecrist enjoyed beers and dinner with mick_laptop
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:07 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
23:07 < Assid> heya
23:09 < ecrist> howdy
23:09  * ecrist goes to bed
23:13 < Assid> so im trying to configure ipv6 on an openvpn running within an openvz container which has its own /96 pool
23:28 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:36 -!- rajkosto [~rajkosto@rajkosto.broker.freenet6.net] has quit [Ping timeout: 264 seconds]
23:37 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
23:37 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
--- Day changed Sat May 28 2011
00:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
01:13 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
01:22 -!- tingelt [~tingelt@dslb-178-001-231-135.pools.arcor-ip.net] has joined #openvpn
01:41 -!- catsup_ [d@ps38852.dreamhost.com] has quit [Ping timeout: 276 seconds]
01:45 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
01:47 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
01:53 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
01:53 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
01:53 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:58 -!- luneff [~yury@84.51.197.177] has joined #openvpn
02:03 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
02:06 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
02:10 <@vpnHelper> RSS Update - forum: Tutorial how to connect server A to server B <http://forums.openvpn.net/topic8214.html#p12591>
02:32 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
02:35 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:41 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 276 seconds]
02:48 -!- Assid [~assid@unaffiliated/assid] has quit [Ping timeout: 250 seconds]
02:49 -!- zzattack [zzattack@237-89-ftth.onsneteindhoven.nl] has joined #openvpn
02:49 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
02:49 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
02:49 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:55 < zzattack> !goal
02:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:00 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
03:01 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
03:17 -!- sparkymarkd [~mark@200.32.232.149] has quit [Read error: Connection reset by peer]
03:21 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
03:26 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
03:27 -!- Assid [~assid@unaffiliated/assid] has quit [Remote host closed the connection]
03:39 -!- tingelt [~tingelt@dslb-178-001-231-135.pools.arcor-ip.net] has quit [Remote host closed the connection]
03:39 -!- rajkosto [~rajkosto@rajkosto.broker.freenet6.net] has joined #openvpn
03:40 -!- sparkymarkd [~mark@200.32.232.149] has quit [Read error: Connection reset by peer]
03:41 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
03:42 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
03:47 -!- zzattack [zzattack@237-89-ftth.onsneteindhoven.nl] has quit [Ping timeout: 258 seconds]
03:51 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
03:58 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:13 -!- amir_ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
04:15 -!- sparkymarkd [~mark@200.32.232.149] has quit [Read error: Connection reset by peer]
04:15 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
04:21 <@vpnHelper> RSS Update - forum: Can't establish route to network behid openvpn server <http://forums.openvpn.net/topic8221.html#p12592>
04:24 -!- sparkymarkd [~mark@200.32.232.149] has quit [Read error: Connection reset by peer]
04:25 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
04:27 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
04:51 -!- viric [~viric@unaffiliated/viric] has joined #openvpn
04:51 <@vpnHelper> RSS Update - forum: how to split tunnel with OpenVPN <http://forums.openvpn.net/topic8229.html>
04:51 < viric> Hello all
04:51 < viric> I've hit that I'm in a remote location, and the certificate of our openvpn server got expired.
04:51 < viric> How can I tell my client to ignore that, other than changing the local system date?
04:52 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
04:52 < viric> I'm reading the manual without success about that
05:00 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
05:02 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
05:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
05:03 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
05:06 < viric> well...
05:06 < viric> I connected changing for a while my system date, made a new certificate, and succesfully updated all correctly.
05:06 < viric> Bye
05:06 -!- viric [~viric@unaffiliated/viric] has left #openvpn []
05:19 -!- tingelt [~tingelt@dslb-178-001-231-135.pools.arcor-ip.net] has joined #openvpn
05:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
05:25 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
05:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:37 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
05:40 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
05:56 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
06:08 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
06:13 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
06:15 -!- tingelt [~tingelt@dslb-178-001-231-135.pools.arcor-ip.net] has quit [Remote host closed the connection]
06:25 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
06:29 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
06:42 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
06:58 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
07:13 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:14 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
07:14 -!- Cain` is now known as Cain
07:16 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
07:31 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
07:31 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
07:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:48 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
08:02 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
08:21 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
08:33 <@vpnHelper> RSS Update - forum: OpenVPN very slow - Less then 8KB/s <http://forums.openvpn.net/topic8227.html#p12594>
08:39 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
08:44 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
08:45 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 252 seconds]
09:00 -!- K1ng [~KING@180.211.188.8] has quit [Read error: Connection reset by peer]
09:00 -!- K1ng [~KING@180.211.188.8] has joined #openvpn
09:09 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
09:12 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:14 < genesis> guys can I use rsync to backup from one host to another host like this one: rsync -az -e ssh --delete /home/local ip_addr:/home/public 
09:14 < hyper_ch> genesis: you can
09:15 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
09:15 < hyper_ch> but I'd add a few more things
09:15 < genesis> was my rsync command correct?
09:15 < hyper_ch> I like to use.    -XSHavvz --partial --stats --progress
09:15 < genesis> I was just reading this at linuxguide.it
09:16 < hyper_ch> genesis: if your user on the remote server is different, then yuo'll have to use    USER@ip_addr:/path/to/folder
09:16 < genesis> I see. thanks for confirming hyper_ch
09:16 < hyper_ch> and the way you wrote the command it would rsync the "local" folder into  /home/public/local
09:16 < hyper_ch> but yes, that command would work :)
09:17 < genesis> thank you hyper_ch
09:17 < genesis> :)
09:18 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
09:20 <@vpnHelper> RSS Update - forum: Problem with client-disconnect script <http://forums.openvpn.net/topic8230.html>
09:23 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Read error: Operation timed out]
09:41 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
09:59 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
10:04 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
10:11 -!- sparkymarkd [~mark@200.32.232.149] has quit [Ping timeout: 258 seconds]
10:11 -!- sparkymarkd [~mark@200.32.232.149] has joined #openvpn
10:20 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
10:24 < Dudinin> Hi, everybody! Sory for my english.. I have a problem with bandwidth of openvpn chanel: There is a Debian GNU/Linux [10.x.x.x, 172.16.x.x, 172.16.x2.x2] which connected as a client with WinXP1 [10.y.y.y, 172.16.y.y]. WinXP2 [10.z.z.z, 172.16.z.z] connected to Debian. Bandwith Debian&WinXP1 on main interfaces [10.x.x.x] is ~70Mbps, on virtual [172.16.x.x] less than 12Mbps. Bandwidth of both interfaces betwen Debian & WinXP2 is OK (~70Mbps). I measured band
10:24 < Dudinin> width using iperf. How to solve this?
10:24 < Dudinin> There is log of iperf-server: http://pastebin.com/Mdctt6d3
10:27 < Dudinin> I try to connect to Debian similar as WinXP2, but bandwidth on virtual interface despite all state the same.
10:31 -!- sparkymarkd [~mark@200.32.232.149] has quit [Remote host closed the connection]
10:34 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
10:36 -!- mripguru [~mripguru@zeus.mripguru.net] has joined #openvpn
10:36 < mripguru> has anyone here ever integrated OpenVPN Access Server + DD WRT?
10:37 < bystander> guys I have question: I my client config, I have remote <ipaddress> 443 and port 80 and bind directives.  Can you please further explain to me those directives?  Just for confirming whats in my thoughts.
10:41 < bystander> guys I have question: I my client config, I have remote <ipaddress> 443 and port 80 and bind directives.  Can you please further explain to me those directives?  Just for confirming whats in my thoughts.
10:45 < bystander> bushmills 
10:46 -!- mripguru_ [~mripguru@zeus.mripguru.net] has joined #openvpn
10:46 -!- mripguru [~mripguru@zeus.mripguru.net] has quit [Ping timeout: 240 seconds]
10:46 -!- mripguru [~mripguru@109-186-12-206.bb.netvision.net.il] has joined #openvpn
10:47 -!- mripguru [~mripguru@109-186-12-206.bb.netvision.net.il] has quit [Read error: Connection reset by peer]
10:49 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
10:49 -!- mripguru2 [~mripguru@zeus.mripguru.net] has joined #openvpn
10:50 -!- mripguru_ [~mripguru@zeus.mripguru.net] has quit [Ping timeout: 246 seconds]
10:51 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
10:52 < bystander> guys I have question: I my client config, I have remote <ipaddress> 443 and port 80 and bind directives.  Can you please further explain to me those directives?  Just for confirming whats in my thoughts.
10:53 < hyper_ch> bystander: can you repeat that? I have no clue what you meant to say
10:56 < bystander> I my client ovpn config, I have remote <ipaddress> 443 and port 80 and bind directives.  I have already at port 443 and I also added port 80 directive and bind. What does that mean or how does that work. will it use port 443 or port 80?
10:56 -!- mripguru [~mripguru@109-186-12-206.bb.netvision.net.il] has joined #openvpn
10:58 < bystander> hyper_ch: I my client ovpn config, I have remote <ipaddress> 443 and port 80 and bind directives.  I have already at port 443 and I also added port 80 directive and bind. What does that mean or how does that work. will it use port 443 or port 80?
10:58 < hyper_ch> no clue
11:00 -!- mripguru2 [~mripguru@zeus.mripguru.net] has quit [Ping timeout: 260 seconds]
11:00 < bystander> hyper_ch: what do you mean no clue?
11:00 -!- mripguru [~mripguru@109-186-12-206.bb.netvision.net.il] has quit [Ping timeout: 252 seconds]
11:03 -!- mripguru [~mripguru@109-186-12-206.bb.netvision.net.il] has joined #openvpn
11:03 -!- mripguru [~mripguru@109-186-12-206.bb.netvision.net.il] has quit [Read error: Connection reset by peer]
11:04 -!- mripguru [~mripguru@109-186-12-206.bb.netvision.net.il] has joined #openvpn
11:06 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
11:24 -!- mripguru [~mripguru@109-186-12-206.bb.netvision.net.il] has quit [Ping timeout: 258 seconds]
11:24 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
11:31 -!- mripguru [~mripguru@vpn1.hspheredns.com] has joined #openvpn
11:34 -!- mripguru2 [~mripguru@109-186-12-206.bb.netvision.net.il] has joined #openvpn
11:34 -!- mripguru2 [~mripguru@109-186-12-206.bb.netvision.net.il] has quit [Client Quit]
11:37 < Dudinin> Well... In which directions I should search the answer?
11:37 -!- mripguru [~mripguru@vpn1.hspheredns.com] has quit [Ping timeout: 250 seconds]
11:58 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
12:02 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Connection reset by peer]
12:04 -!- hpa_ [hpa@terminus.zytor.com] has joined #openvpn
12:36 <@vpnHelper> RSS Update - forum: Block access to wifi hospot LAN on client <http://forums.openvpn.net/topic8231.html>
12:37 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
12:37 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
13:00 -!- images [~images@static.238.229.4.46.clients.your-server.de] has joined #openvpn
13:00 <@vpnHelper> RSS Update - forum: Help with client-disconnect script <http://forums.openvpn.net/topic8232.html>
13:00 < Kartagis> !route
13:00 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:06 < Kartagis> !iptables
13:06 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z, or (#2) please see http://openvpn.net/man#lbBD for more info, or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
13:18 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
13:18 <@vpnHelper> RSS Update - forum: Help with client-disconnect script <http://forums.openvpn.net/topic8232.html#p12598>
13:18 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
13:35 -!- Proz0id [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
13:36 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
13:37 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
13:44 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
13:47 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
13:58 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Quit: Leaving]
14:01 -!- Proz0id [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
14:37 <@vpnHelper> RSS Update - forum: OpenVPN post disconnect problem <http://forums.openvpn.net/topic8233.html>
15:20 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:33 -!- Proz0id [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit []
15:39 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:46 < Naku> Hello
15:48 < Naku> MULTI: bad source address from client [192.168.xx.xx], packet dropped
15:48 -!- hpa_ is now known as hpa
15:51 < Naku> lol, I search for hours and I find the answer 30seconds after I asked here
16:13 <@vpnHelper> RSS Update - forum: simple udp sockets and vpn <http://forums.openvpn.net/topic8228.html#p12600>
16:19 <@vpnHelper> RSS Update - forum: how to split tunnel with OpenVPN <http://forums.openvpn.net/topic8229.html#p12601>
16:25 <@vpnHelper> RSS Update - forum: OpenVPN very slow - Less then 8KB/s <http://forums.openvpn.net/topic8227.html#p12602>
16:31 <@vpnHelper> RSS Update - forum: Help with client-disconnect script <http://forums.openvpn.net/topic8232.html#p12603>
16:35 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
16:35 -!- pranq [pranq@unaffiliated/contempt] has left #openvpn []
16:37 <@vpnHelper> RSS Update - forum: OpenVPN post disconnect problem <http://forums.openvpn.net/topic8233.html#p12605> || Block access to wifi hospot LAN on client <http://forums.openvpn.net/topic8231.html#p12604>
16:50 < krzee> Naku, 
16:50 < krzee> !route
16:50 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:50 < krzee> i suspect you're trying to get your client lan to share
17:04 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Read error: Operation timed out]
17:06 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
17:19 <@vpnHelper> RSS Update - forum: Block access to wifi hospot LAN on client <http://forums.openvpn.net/topic8231.html#p12606>
17:24 -!- mr_daniel [~daniel@g224122065.adsl.alicedsl.de] has joined #openvpn
17:25 < mr_daniel> Are there any known incompatibility issues between different OpenVPN versions? I have a Ubuntu 10.04 LTS Server with OpenVPN 2.1.0 installed with apt-get.
17:25 < mr_daniel> And I have a Desktop machine with Ubuntu 11.04 with OpenVPN 2.1.3
17:26 < mr_daniel> It seeme like the desktop machine can connect to the server and establish a tun interface, but no data can transmitted correctly
17:27 < mr_daniel> In the console on the server side I can read the following error: write to TUN/TAP : Invalid argument (code=22)
17:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:37 <@vpnHelper> RSS Update - forum: how to split tunnel with OpenVPN <http://forums.openvpn.net/topic8229.html#p12607>
17:43 <@vpnHelper> RSS Update - forum: how to split tunnel with OpenVPN <http://forums.openvpn.net/topic8229.html#p12609> || Block access to wifi hospot LAN on client <http://forums.openvpn.net/topic8231.html#p12608>
17:46 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Connection reset by peer]
18:00 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
18:18 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
18:30 -!- mr_daniel [~daniel@g224122065.adsl.alicedsl.de] has quit [Quit: leaving]
18:32 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Read error: Operation timed out]
18:35 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
18:42 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:49 <@vpnHelper> RSS Update - forum: OpenVPN very slow - Less then 8KB/s <http://forums.openvpn.net/topic8227.html#p12610>
18:53 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
19:33 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
19:40 -!- Proz0id [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
19:41 < Proz0id> how do i create additional certs after the initial install 
19:41 < Proz0id> ?
19:41 < ecrist> the same way you created the initial certs
19:42 < Proz0id> i ran the ./vars then did ./build-key bob  here's what came back:
19:42 < Proz0id>   Please edit the vars script to reflect your configuration,
19:42 < Proz0id>   then source it with "source ./vars".
19:42 < Proz0id>   Next, to start with a fresh PKI configuration and to delete any
19:42 < Proz0id>   previous certificates and keys, run "./clean-all".
19:42 < Proz0id>   Finally, you can run this tool (pkitool) to build certificates/keys.
19:48 < Proz0id> is this normal or am i doing something wrong?
19:51 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
19:57 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
20:03 < krzee> see that . before ./vars in the howto?
20:03 < krzee> . ./vars
20:04 < krzee> the leading . is pretty damned important ;]
20:08 < Proz0id> krzee 3 for 3
20:10 < krzee> ;]
20:10 -!- master_of_master [~master_of@p57B55DF3.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
20:11 < krzee> for your reference, '.' is the same as 'source'
20:11 < krzee> its how you read in a file
20:12 < krzee> i use it in more complex bash scripts for reading in a configuration file
20:12 < krzee> (much like how easy-rsa uses it with the vars file)
20:13 -!- master_of_master [~master_of@p57B55D6F.dip.t-dialin.net] has joined #openvpn
20:15 < Proz0id> kool
20:15 < Proz0id> thansk for the help
20:20 -!- zheng [~zheng@180.158.177.192] has joined #openvpn
20:21 < krzee> yw
20:26 <@vpnHelper> RSS Update - forum: how to split tunnel with OpenVPN <http://forums.openvpn.net/topic8229.html#p12611>
20:40 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
20:40 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:02 <@vpnHelper> RSS Update - forum: how to split tunnel with OpenVPN <http://forums.openvpn.net/topic8229.html#p12612>
21:09 -!- amir_ [~amir@unaffiliated/amir] has joined #openvpn
21:12 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 248 seconds]
21:13 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
21:22 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
21:44 <@vpnHelper> RSS Update - forum: Block access to wifi hospot LAN on client <http://forums.openvpn.net/topic8231.html#p12614> || Connect to OpenVPN on Windows Login <http://forums.openvpn.net/topic8234.html>
21:48 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
22:06 -!- Meteormatt [~Meteor@114.86.26.179] has joined #openvpn
22:07 < Meteormatt> Hello.
22:07 -!- Meteormatt [~Meteor@114.86.26.179] has left #openvpn []
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:43 < SigmaProjects> !goal
22:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:45 < SigmaProjects> !welcome
22:45 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:47 < SigmaProjects> Alright.  I'm trying to setup a VPN connection on two OpenWRT routers.  I'd like the clients behind each router to be able to access network shares between eachother.  The connection works (i think?)  but I can't ping either one.  Here is my configs and the client/server log http://pastie.org/private/m5q27i8qnyny9mw2tzwyw
22:48 < SigmaProjects> Since almost sat 9pm pst, I'll assume not many people are around, thats ok
22:50 < SigmaProjects> Those configs are pretty much a frankenstein of every how-to ive read and tried to understand, from versions and dates all over.. still have yet to actually find a "VPN - It's not as easy as it could be"
23:10 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: Connection reset by peer]
23:10 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
23:15 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:21 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
23:46 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
23:47 < bystander> guys I am running openvpn 2.1 in my centos. how can I upgrade that to 2.2 which disruption operation
23:53 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
23:56 <@vpnHelper> RSS Update - forum: REQ: tutorial openvpn upgrade <http://forums.openvpn.net/topic8235.html>
--- Day changed Sun May 29 2011
00:39 <@vpnHelper> RSS Update - forum: OpenVPN post disconnect problem <http://forums.openvpn.net/topic8233.html#p12616>
00:58 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:12 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
01:13 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 260 seconds]
01:25 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
01:25 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
01:36 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
01:41 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
01:41 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
01:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
01:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:04 < Dudinin> Hi, everybody! Sory for my english.. I have a problem with the bandwidth of openvpn chanel: There is a Debian GNU/Linux [10.x.x.x, 172.16.x.x, 172.16.x2.x2] which is connected as a client to WinXP1 [10.y.y.y, 172.16.y.y]. WinXP2 [10.z.z.z, 172.16.z.z] is connected to Debian. The bandwith between Debian & WinXP1 is ~70Mbps on mother interface [10.x.x.x]. On the virtual interface [172.16.x.x] it is less than 12Mbps. The bandwidth of both interfaces between 
02:04 < Dudinin> Debian & WinXP2 is OK (~70Mbps). I've measured the bandwidth using iperf. I want the bandwidth of the virtual interface to be not much less than the bandwidth of the mother interface. How can I provide this?
02:04 < Dudinin> There is log of iperf-server: http://pastebin.com/Mdctt6d3
02:04 < Dudinin> I tried to connect WinXP1 to Debian the same way as WinXP2, but the bandwidth on the virtual interface despite all stays the same.
02:10 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
02:26 -!- Xdept [~Xdept@ip-58-28-159-224.static-xdsl.xnet.co.nz] has joined #openvpn
02:26 -!- Xdept [~Xdept@ip-58-28-159-224.static-xdsl.xnet.co.nz] has quit [Quit: Leaving]
02:27 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
02:28 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
02:42 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
02:43 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
02:48 < Dudinin> I'm use ovpn 2.1.4
02:54 -!- mr_daniel [~daniel@g224122065.adsl.alicedsl.de] has joined #openvpn
02:55 < mr_daniel> I have problems establishing a pre-shared key connection between client and server. My client outputs the following:
02:55 < mr_daniel> Local Options hash (VER=V4): 'cc1583e3'
02:55 < mr_daniel> and my server:
02:55 < mr_daniel> wait a minute, client says:
02:55 < mr_daniel> Local Options hash (VER=V4): 'cc1583e3'
02:55 < mr_daniel> Expected Remote Options hash (VER=V4): '2b90ef6a'
02:55 < mr_daniel> and server says:
02:55 < mr_daniel> Local Options hash (VER=V4): '473a81be'
02:55 < mr_daniel> Expected Remote Options hash (VER=V4): '21e19081'
02:56 < mr_daniel> Is it possible that client and server assume different option values? And because of this the hashes are different and the connection can't be established?
03:04 -!- zheng [~zheng@180.158.177.192] has quit [Quit: Leaving]
03:14 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
03:22 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
03:38 -!- Guifort [~Guifort@175.201.113.78.rev.sfr.net] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: Can't create a new TAP adapter on Windows 2k8 R2 64bit <http://forums.openvpn.net/topic8236.html>
04:16 -!- luneff [~yury@84.51.197.177] has joined #openvpn
04:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:25 -!- rajkosto [~rajkosto@rajkosto.broker.freenet6.net] has quit [Ping timeout: 264 seconds]
05:01 -!- takamichi [Takamichi@78.133.37.249] has quit [Ping timeout: 260 seconds]
05:01 -!- takamichi [Takamichi@78.133.37.249] has joined #openvpn
05:03 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
05:04 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
05:05 -!- takamichi [Takamichi@78.133.37.249] has quit [Read error: Connection reset by peer]
05:05 -!- Martin` [martin@shell.ipv6.octocore.net] has left #openvpn []
05:05 -!- takamichi [~pri@78.133.37.249] has joined #openvpn
05:09 < Bushmills> mr_daniel: nope. problem is a different one
05:11 < Bushmills> oh, wait.
05:11 -!- takamichi [~pri@78.133.37.249] has quit [Ping timeout: 246 seconds]
05:13 < Bushmills> i amend my replay to "i'm not sure"
05:13 < Bushmills> reply
05:13 -!- takamichi [~pri@78.133.37.249] has joined #openvpn
05:15 -!- amir_ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
05:19 -!- takamichi [~pri@78.133.37.249] has quit [Ping timeout: 250 seconds]
05:19 -!- takamichi [~pri@78.133.37.249] has joined #openvpn
05:20 -!- takamichi [~pri@78.133.37.249] has quit [Remote host closed the connection]
05:27 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Ping timeout: 240 seconds]
05:29 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
05:51 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
05:52 -!- Dudinin [~Dudinin@80.89.192.68] has joined #openvpn
06:04 -!- flowbee [~flowbee__@c-98-232-13-8.hsd1.wa.comcast.net] has quit [Ping timeout: 260 seconds]
06:11 -!- Dudinin_ [~Dudinin@80.89.192.68] has joined #openvpn
06:13 -!- Dudinin [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
06:17 -!- flowbee [~flowbee__@c-98-232-13-8.hsd1.wa.comcast.net] has joined #openvpn
06:22 -!- Dudinin_ [~Dudinin@80.89.192.68] has quit [Ping timeout: 246 seconds]
06:23 -!- Dudinin_ [~Dudinin@80.89.192.68] has joined #openvpn
06:31 -!- Dudinin_ [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
06:32 -!- Dudinin_ [~Dudinin@80.89.192.68] has joined #openvpn
06:44 -!- Dudinin_ [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
06:46 -!- Dudinin_ [~Dudinin@80.89.192.68] has joined #openvpn
07:14 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:14 -!- Dudinin_ [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
07:15 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
07:15 -!- Cain` is now known as Cain
07:16 -!- Dudinin_ [~Dudinin@80.89.192.68] has joined #openvpn
07:39 -!- torpion2 [~torpion@ydb.me] has quit [Quit: WeeChat 0.3.2]
07:41 < Dudinin_> Aaand... Anybody know the reason of bandwidth limitation on virtual interface?!
07:42 < Dudinin_> I can't find this on the internet...
07:52 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
07:53 < xsurfer> guys how can I upgrade from 2.1 to 2.2 without disrupting normal operations?
07:54 -!- Guifort [~Guifort@175.201.113.78.rev.sfr.net] has quit [Quit: Quitte]
07:55 < xsurfer> guys how can I upgrade from 2.1 to 2.2 without disrupting normal operations?
07:56 -!- Dudinin_ [~Dudinin@80.89.192.68] has quit [Remote host closed the connection]
07:57 -!- Dudinin_ [~Dudinin@80.89.192.68] has joined #openvpn
07:58 < xsurfer> guys how can I upgrade from 2.1 to 2.2 without disrupting normal operations?
08:03 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:03 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
08:04 < Bushmills> Dudinin_: the tun/tap drivers are entirely implemented in software and don't have the bandwidth limitations hardware NICs have.
08:04 < xsurfer> guys how can I upgrade from 2.1 to 2.2 without disrupting normal operations?
08:04 < Bushmills> they are limited by performance of CPU for en/decrypting and the physical interface used to tunnel the traffic through
08:05 < Dudinin_> But never the less,  on one  server I had a limitation. It seems not problem of openvpn but why it's happened?
08:09 < Dudinin_> Performance of cpu is enouhg (when I testing the bandwidth cpu mostly free), netcard is 100Mbps Full Duplex...
08:11 < Dudinin_> Nevertheless thank you))
08:19 < xsurfer> guys how can I upgrade from 2.1 to 2.2 without disrupting normal operations?
08:21 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:27 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:31 < xsurfer> http://pastebin.com/3WB6R33A  <---- CAN I IMPROVE THE TUN0 SPEED?
08:34 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
08:39 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
08:40 -!- images [~images@static.238.229.4.46.clients.your-server.de] has quit [Quit: Bye!]
08:41 < xsurfer> whats wrong guys. why dont I get any reply?
08:47 -!- xsurfer [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:57 -!- Dudinin_ [~Dudinin@80.89.192.68] has quit [Quit: Leaving]
09:01 -!- images [~images@static.238.229.4.46.clients.your-server.de] has joined #openvpn
09:20 -!- phaidros [~phaidros@ghostshell.subsignal.org] has left #openvpn []
09:50 <@vpnHelper> RSS Update - forum: how to split tunnel with OpenVPN <http://forums.openvpn.net/topic8229.html#p12618>
10:08 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
10:14 <@vpnHelper> RSS Update - forum: Routing "through" a connected client <http://forums.openvpn.net/topic8237.html>
10:15 -!- Gobbla [Gobbla@c80-217-143-194.bredband.comhem.se] has quit []
10:38 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
11:00 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
11:01 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
11:06 -!- K1ng [~KING@180.211.188.8] has quit [Ping timeout: 258 seconds]
11:09 -!- K1ng [~KING@180.211.188.207] has joined #openvpn
11:37 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
11:38 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
11:42 -!- mr_danie1 [~daniel@g231145244.adsl.alicedsl.de] has joined #openvpn
11:45 -!- mr_daniel [~daniel@g224122065.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
11:53 -!- SOG [~SOG@222.125.196.155] has quit [Quit: I will be back!]
12:13 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
12:18 -!- sidewalk [sidewalk@shell.glassbilen.net] has joined #openvpn
12:19 < sidewalk> if i have a server and a client connected using openvpn, should i be able to setup routing between two networks to reach eachother?
12:20 < Bushmills> yes
12:20 < Bushmills> !route
12:20 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:20 < sidewalk> thanks! :)
12:38 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
12:38 -!- mode/#openvpn [+o mattock] by ChanServ
12:46 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
12:50 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
13:05 -!- Yen [Yen@unaffiliated/yen] has quit []
13:06 -!- Netsplit *.net <-> *.split quits: images, hpa, ScriptFanix, up_the_irons, Xeross, Champi, nb, DeeJayTwo, fahadsadah
13:08 -!- Netsplit over, joins: Champi, nb
13:08 -!- Netsplit over, joins: hpa
13:10 -!- Netsplit over, joins: images
13:11 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
13:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:11 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
13:11 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
13:15 -!- K1ng` [~KING@180.211.188.207] has joined #openvpn
13:18 -!- K1ng [~KING@180.211.188.207] has quit [Ping timeout: 260 seconds]
13:46 -!- corretico [~luis@201.201.44.82] has joined #openvpn
13:53 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
13:54 < EugeneKay> !factoids
13:54 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
13:59 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
14:12 < Proz0id> anyone compiled / installed eurephia before?
14:16 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
14:35 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
14:44 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
14:47 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:03 -!- _hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:03 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Disconnected by services]
15:03 -!- DeeJayTwo [~deejay2@office.abi.ca] has joined #openvpn
15:03 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:05 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn []
15:23 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 244 seconds]
15:24 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:25 < Proz0id> hey guys if 2.2 has already been patch for eurephia do i still need to compuile the plugins?
15:29 -!- _hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Remote host closed the connection]
15:33 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
15:34 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Remote host closed the connection]
15:40 -!- mr_danie1 [~daniel@g231145244.adsl.alicedsl.de] has left #openvpn []
15:41 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
15:51 < Proz0id>  Where can i find the logs to the ./configure? script? (eurephia)
15:56 < |Mike|> configure.log oid?
16:04 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
16:16 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 260 seconds]
16:25 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
16:30 < Proz0id> got it .. thanks mike
16:35 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
16:48 < sidewalk> anyone around who can help me out with some routing issues over openvpn?
16:54 < |Mike|> try reading the topic
17:03 < krzee> and
17:03 < krzee> !ask
17:03 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, or (#2) http://www.latinsud.com/answer/, or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
17:03 < |Mike|> hey krzee 
17:03 < krzee> wassup mike
17:04 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 260 seconds]
17:08 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
17:13 < sidewalk> okey, so i have read http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing and tried lots of different configurations, but cant get the routing between subnets behind client/server working
17:13 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
17:13 < sidewalk> im kind of new to openvpn, but im trying to learn
17:15 < |Mike|> krzee: meh, i'm quite bored atm :P
17:17 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
17:17 < sidewalk> first of all, do i need iptables on both ends, or is it enough with the routing command?
17:23 < |Mike|> ...
17:25 < krzee> huh?
17:25 < krzee> you havnt even asked a real question yet
17:25 < krzee> !goal
17:25 < sidewalk> okey
17:26 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:26 -!- luneff [~yury@84.51.197.177] has joined #openvpn
17:26 < EugeneKay> sidewalk - if both ends of the tunnel are the default gateway for their respective subnets, you only need the rote, masquerading is unneeded
17:26 < EugeneKay> s/rote/route
17:26 < sidewalk> and if they arent the default gateways for their subnets?
17:27 < EugeneKay> Then you need a route on the default GW(or on each host for that subnet) pointing to the openvpn endpoint 
17:28 -!- maxJadi [~maxJadi@cust-95-80-27-28.csbnet.se] has joined #openvpn
17:28 -!- maxJadi [~maxJadi@cust-95-80-27-28.csbnet.se] has quit [Changing host]
17:28 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
17:38 < Proz0id> guys i need help with eurephia install / compile
17:38 < Proz0id> i'm sure it's probably something simple..
17:38 < Proz0id> been working on it for hours 
17:39 < EugeneKay> You are encouraged to post a problem, rather than an anonymous cry for help.
17:39 < |Mike|> (what the heck is eurephia?)
17:40 < EugeneKay> http://lmgtfy.com/?q=eurephia
17:40 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
17:40 < EugeneKay> It's a thing I've never used. tl;dr version is user+pass auth module
17:41 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
17:43 < sidewalk> EugeneKay: thanks, hmms, gotha figure out what to do :)
17:44 < EugeneKay> sidewalk - get a piece of paper, draw your network, figure out what routes need to be statically configured, then implement. :-p
17:46 < sidewalk> EugeneKay: i think my biggest problem is my current setup, openvpn server running on 192.168.1.2 and client on 192.168.0.2
17:47 < sidewalk> subnets cant access eachother, but servers can access eachother
17:48 < EugeneKay> <EugeneKay> Then you need a route on the default GW(or on each host for that subnet) pointing to the openvpn endpoint 
17:48 < EugeneKay> <EugeneKay> sidewalk - get a piece of paper, draw your network, figure out what routes need to be statically configured, then implement. :-p
17:48 < sidewalk> :)
17:48 < krzee> the reason i didnt go over these things...
17:48 < krzee> is because i clearly explain it all in the link you posted
17:52 < sidewalk> ill read it thru again then :)
17:55 < Proz0id> (eurephia) argh.. man... i'm ready to cry .... http://pastebin.com/zfVWDUSY  it just won't make... and gives me "oops. there were errors" 
17:58 < |Mike|> Proz0id: #35
17:59 < |Mike|> which distro are you using?
18:00 < Proz0id> ubuntu-server 10.04
18:00 < Proz0id> 64
18:00 < sidewalk> so iroute isnt applicable in my case, since im not using tun-style
18:04 < EugeneKay> TAP causes cancer.
18:05 < |Mike|> Proz0id: install the pckages wich are mentioned at line #35
18:05 < Proz0id> |Mike|: yes the thing is that when i try and get the necessary files from the repository it automatically removes others so i'm trying to figure out how to manually get each of the libs
18:05 < |Mike|> just install the packages
18:05 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html>
18:08 < Proz0id> the question is how...
18:09 < Proz0id> researching
18:11 < |Mike|> apt
18:12 < krzee> why are you using tap?
18:13 < krzee> if you say "because thats what the walkthrough says" im leaving
18:13 < Proz0id> lol
18:16 < |Mike|> (bantown)
18:16 < |Mike|> or #2,000
18:20 < EugeneKay> There is no valid reason for using TAP
18:20 < krzee> well there is 1
18:20 < EugeneKay> If you think there is, your system is broken. Redesign it.
18:20 < krzee> but we dunno if it applies to him
18:20 < krzee> if you need layer2 over the vpn
18:20 < krzee> no other good reason
18:21 < EugeneKay> And if you need that.... :-p
18:21 < krzee> lan gaming for example
18:21 < |Mike|> !tunortap
18:21 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
18:21 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
18:27 < |Mike|> krzee: when are you visiting NL again?
18:27 < |Mike|> and i was wondering if you hear something from chris
18:27 < |Mike|> heard*
18:29 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 246 seconds]
18:33 < Proz0id> folks.... i think we have progress!
18:53 < |Mike|> in
18:56 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:56 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
18:57 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:58 <@vpnHelper> RSS Update - forum: Can't create a new TAP adapter on Windows 2k8 R2 64bit <http://forums.openvpn.net/topic8236.html#p12622>
19:02 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:58 < Dougy> rawr.
20:10 < EugeneKay> RAWR
20:12 -!- master_of_master [~master_of@p57B55D6F.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:13 -!- master_of_master [~master_of@p57B5580D.dip.t-dialin.net] has joined #openvpn
20:40 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
20:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:56 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Read error: Connection reset by peer]
20:56 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
20:57 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Read error: Connection reset by peer]
20:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 244 seconds]
20:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:02 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
21:03 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
21:56 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
22:04 -!- invisiblek [~invisible@97-88-5-137.dhcp.roch.mn.charter.com] has joined #openvpn
22:06 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
22:10 -!- EugeneKay is now known as EugeneKaway
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:37 < invisiblek> kinda noob-ish question here, but im having problems searching for what i need. i've got openvpn running on my gentoo box, connects fine (port forwarded through my router) i can use all the services that are on this server but nothing on the rest of the lan. what i find interesting is that i can refer to my server as either it's vpn address or its lan address from both on the lan and on the vpn
22:38 < invisiblek> i think i need to route the traffic or something? i'm using tun
22:38 < invisiblek> ive got a push route statement set in my server config
22:42 < Proz0id> can you ping 8.8.8.8?
22:42 < invisiblek> yes, but what is that relevant?
22:43 < Proz0id> thats google's dns
22:43 < invisiblek> im aware of that, i use that as my dns
22:43 < invisiblek> this isnt a dns issue
22:43 < Proz0id> so from the client when you are connect
22:43 < Proz0id> you can ping that ?
22:43 < invisiblek> yes
22:44 < Proz0id> you can use the services that are on the server lan? or the client lan?
22:45 < Proz0id> and i believe you should be able to access the vpn address or it's lan address from the client
22:45 < Proz0id> i don't see an issue there
22:45 < invisiblek> yes, i can (thats the part i found 'interesting')
22:45 < Proz0id> well from what i understand
22:46 < Proz0id> if you can hit any external address 
22:46 < Proz0id> then your vpn ip address would be part of all other external address
22:46 < Proz0id> es
22:46 < Proz0id> so that's expected
22:48 < Proz0id> because you are connected via the vpn you have vpn lan... so again you should be able to ping the vpn's lan ip
22:48 < Proz0id> as expected..
22:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:49 < invisiblek> lan ip: 10.11.11.103
22:49 < invisiblek> vpn ip: 10.11.12.1
22:49 < invisiblek> (on the server)
22:49 < invisiblek> 255.255.255.0
22:49 < invisiblek> from the lan i can ping it on either address
22:49 < invisiblek> same on vpn
22:49 < invisiblek> but i cannot ping a different lan ip address from the vpn, and likewise cannot ping a vpn ip address from the lan
22:50 < invisiblek> (other than the server's addresses)
23:04 -!- images [~images@static.238.229.4.46.clients.your-server.de] has quit [Quit: Bye!]
23:25 < Proz0id> ugh.... eurephia = tap only....!!
23:25 < Proz0id> page chapter 5 of the manual.....
23:25 < Proz0id> this would have been great to know on page 1 :)
23:26 < Proz0id> before i spent the day trying to get this to work
23:26 < Proz0id> guess it's on hold until dazo implements it for tun
23:41 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
23:51 <@vpnHelper> RSS Update - forum: Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12623>
--- Day changed Mon May 30 2011
00:13 < krzie> Proz0id, got a link to that?  im surprised to hear it
00:26 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Ping timeout: 276 seconds]
01:06 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
01:08 -!- flowbee [~flowbee__@c-98-232-13-8.hsd1.wa.comcast.net] has quit [Quit: Leaving]
01:08 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:14 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
01:42 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
02:14 <@vpnHelper> RSS Update - forum: Routing "through" a connected client <http://forums.openvpn.net/topic8237.html#p12624>
02:25 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:25 -!- mode/#openvpn [+o mattock] by ChanServ
02:38 <@vpnHelper> RSS Update - forum: REQ: tutorial openvpn upgrade <http://forums.openvpn.net/topic8235.html#p12625>
02:44 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12626>
02:50 <@vpnHelper> RSS Update - forum: Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12628> || REQ: tutorial openvpn upgrade <http://forums.openvpn.net/topic8235.html#p12627>
02:56 <@vpnHelper> RSS Update - forum: OpenVPN post disconnect problem <http://forums.openvpn.net/topic8233.html#p12630> || Connect to OpenVPN on Windows Login <http://forums.openvpn.net/topic8234.html#p12629>
02:59 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 260 seconds]
03:02 <@vpnHelper> RSS Update - forum: [Closed] how to split tunnel with OpenVPN <http://forums.openvpn.net/topic8229.html#p12618>
03:09 -!- raw_ [~raw@chipotle118.server4you.de] has quit [Ping timeout: 246 seconds]
03:11 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
03:26 <@vpnHelper> RSS Update - forum: Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12631>
03:38 <@vpnHelper> RSS Update - forum: Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12632>
03:38 -!- dazo_afk is now known as dazo
03:56 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12633>
04:02 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12634>
04:14 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:14 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:17 -!- K1ng` [~KING@180.211.188.207] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
04:20 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12635>
04:25 -!- K1ng [~KING@180.211.188.207] has joined #openvpn
04:27 -!- K1ng is now known as k1ng`
04:27 -!- k1ng` is now known as k1ng
05:00 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:00 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:00 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:02 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12636>
05:03 -!- sappel [~sap@HSI-KBW-078-042-105-249.hsi3.kabel-badenwuerttemberg.de] has joined #openvpn
05:05 < sappel> Hello. Am I just too stupid or where can I find an openssl.cnf for windows? I'm trying to generate certificates with the easy-rsa scripts of openvpn-gui
05:05 < sappel> or can I use my linux sample as well?
05:06 < janjust> sappel: you can use the linux version; the openssl.cnf file is missing in the openvpn 2.2 package for windows
05:08 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12637>
05:12 < sappel> thx janjust 
05:56 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
06:08 <@vpnHelper> RSS Update - forum: Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12638>
06:10 -!- Assid [~Assid@122.170.9.45] has joined #openvpn
06:20 < Assid> heya
06:20 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12639>
06:20 < Assid> so im tryin to use openvpn + remote desktop
06:20 < Assid> however, with everything said and done, im gettign a major lag on this
06:32 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
06:32 <@vpnHelper> RSS Update - forum: Need help with Windows client <http://forums.openvpn.net/topic8150.html#p12640>
06:40 -!- Assid_ [~Assid@122.170.9.45] has joined #openvpn
06:41 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
06:43 -!- Assid [~Assid@122.170.9.45] has quit [Ping timeout: 260 seconds]
07:06 -!- luneff [~yury@84.51.197.177] has quit [Ping timeout: 240 seconds]
07:14 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:16 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
07:16 -!- Cain` is now known as Cain
07:16 -!- EugeneKaway is now known as EugeneKay
07:23 -!- corretico_ [~luis@201.201.44.82] has quit [Ping timeout: 240 seconds]
07:35 -!- luneff [~yury@84.51.197.177] has joined #openvpn
07:51 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: Leaving.]
07:53 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 260 seconds]
07:53 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
08:00 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
08:00 -!- Assid_ [~Assid@122.170.9.45] has left #openvpn []
08:05 -!- SOG [~SOG@222.125.196.155] has quit [Remote host closed the connection]
08:06 -!- SOG [~SOG@168.70.16.62] has joined #openvpn
08:06 -!- SOG [~SOG@168.70.16.62] has quit [Client Quit]
08:31 -!- dxtr [~dexter@unaffiliated/dxtr] has joined #openvpn
08:31 < dxtr> I don't have to use tap and bridging to play LAN games over a openvpn tunnel, right?
08:32 < dxtr> (Or, use other LAN stuff for that matter)
08:32 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
08:32 < Cubox> Hello, it's possible to redirect all the web traffic to a proxy ( on the server ) ?
08:33 < Bushmills> yes. tell browser to use proxy. use server's openvpn address
08:33 < Cubox> mmh
08:34 < Cubox> but, i just ask for openvpn to redirect
08:34 < Cubox> Not the browser to use the proxy
08:35 < Bushmills> a web proxy requests on behalf of client.  who requests, and what is requested?
08:35 < Cubox> Ok, so it's impossible
08:35 < Cubox> Thanks
08:36 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.6-dev"]
08:38 <@dazo> dxtr: depends on the game ... if it is proper TCP/IP game which don't need broadcast traffic to work ... then it should work find, just as in any routed network
08:38 <@dazo> but in the moment it's not TCP/IP or that it requires broadcast traffic to see all the participants, then you might need bridging and tap
08:40 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 260 seconds]
08:44 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
08:45 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
09:02 < dxtr> dazo: Aight. I figured.
09:03 < sappel> hm, is it correct, that common names have to be unique within a CA?
09:04 < EugeneKay> No. But they should be.
09:05 < EugeneKay> When renewing a certificate you will have an overlapping CN, from the time the new cert is issued until the time the old one is expired(during which you should make sure to transition)
09:05 < sappel> ok, but the CN of a server does not need to be its hostname / ip address, does it? in a lot of examples its the domain- or hostname
09:06 < EugeneKay> It can be anything you like, but hostname(or username) is the best practice
09:06 < sappel> alright, thanks
09:06 <@vpnHelper> RSS Update - forum: how to forward ports from client network side <http://forums.openvpn.net/topic8239.html>
09:06 < EugeneKay> I issue my certs with a period of 400 days, and then change them once a year.
09:07 < EugeneKay> Thus granting me a month of procrastination
09:11 < sappel> uh, I guess I don't need to think about the life time of my certs yet, since the server isn't running yet...still having quite some problems
09:11 < sappel> but thanks for the hint ;)
09:21 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
09:21 < Cubox> hello, where on the conf i can view the ips who are use for clients ?
09:22 < EugeneKay> Cubox - server 10.8.0.0 255.255.255.0
09:23 < EugeneKay> Your address pool may vary
09:23 < EugeneKay> Actively distributed IPs are listed in...... uh, I forgot. :-p
09:23 < Cubox> mmh
09:23 < Cubox> i can restrict these ips ?
09:24 < Cubox> like 10.8.0.0 10.8.0.255
09:24 < EugeneKay> You mean, firewall them?
09:24 < EugeneKay> 10.8.0.0/24(or 255.255.255.0) means 10.8.0.0-10.8.0.255
09:24 < EugeneKay> Look up CIDR subnetting
09:24 < Cubox> mmh
09:24 < Cubox> ok, so this adrealy done :)
09:25 < EugeneKay> Indeed.
09:25 < Cubox> :)
09:30 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 244 seconds]
09:30 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.6-dev"]
09:34 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:07 -!- AL13N_work [~alien@91.183.52.232] has quit [Ping timeout: 246 seconds]
10:08 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Remote host closed the connection]
10:09 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Ping timeout: 276 seconds]
10:15 -!- ferar [~ferar@64.254.252.178] has joined #openvpn
10:17 < ferar> when using [ push "redirect-gateway def1" ] is there a way to exclude specific ip addresses from being routed through the vpn tunnel?
10:20 < EugeneKay> Yes. Use manual routing for those IP blocks on the client.
10:28 < ferar> EugeneKay: thanks, let me search "manual routing"
10:35 < krzie> !splitroute
10:35 <@vpnHelper> "splitroute" is https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet
10:35 < krzie> grr
10:35 < krzie> thats not it
10:35 < krzie> !factoids search route
10:35 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
10:35 < krzie> !route_override
10:35 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet, or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
10:36 < krzie> !learn splitroute as see !route_override for how to override --redirect-gateway for a certain subnet
10:36 <@vpnHelper> Joo got it.
10:40 < sappel> hm, I'm stuck with the ovpn on my router. Perhabs someone here can help me out, I think I'm missing something general...
10:41 < krzie> ferar, see above, you want #1 of !route_override
10:41 < krzie> sappel, 
10:41 < krzie> !goal
10:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:41 < sappel> I'm using a Mikrotik 750G Routerboard. It can use openvpn, but I have to generate the certificates on another OS. So I used my linux to generate a ca.key + ca.crt, a server.key + server.crt and a client.key + client.crt 
10:42 < sappel> (oh sorry, client vpn using openvpn-gui to ovpn-server on the router)
10:42 < ferar> all many thanks
10:42 < krzie> sappel, openvpn-gui and openvpn-server?  theres just 1 package that is EITHER depending how you use it
10:43 < krzie> you got the community version, here right?
10:43 < krzie> !download
10:43 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
10:43 < sappel> krzie: opnvpn-gui on the client and the server on the router
10:43 < krzie> by openvpn-gui you mean the windows package from !download right?
10:43 < sappel> yes
10:43 < krzie> there are others that are not for the same thing
10:43 < krzie> ok good
10:44 < krzie> keep going with this:
10:44 < krzie> !goal
10:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:44 < sappel> client to site VPN, access the LAN behind the server. 
10:45 < krzie> can you connect and ping the server VPN ip?
10:45 < sappel> no, I can't connect. I get a "connection reset, restart [0]" on the client
10:45 < krzie> !logs
10:45 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
10:45 < krzie> !logfile
10:46 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
10:46 < sappel> Right now I wonder how the server knows about the client certificate? I think it's a authentication issue
10:46 < krzie> !pki
10:46 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
10:46 <@vpnHelper> specially as a server (see !servercert)
10:46 < krzie> see #2
10:47 < EugeneKay> !factoids
10:47 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:47 < krzie> instead of guessing, gimme the logs as i said ;]
10:47 < EugeneKay> Less spammy that way. :-p
10:47 < krzie> EugeneKay, i need to give him the specific factoid
10:47 < krzie> less spamy for people just wanting to look around, but so is !msg
10:47 < EugeneKay> I know,I'm giving you a hard time
10:48 < krzie> ;]
10:48 < krzie> !msg
10:48 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key>, or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
10:48 < jeev> krzie
10:48 < krzie> jeev
10:49 < EugeneKay> EugeneKay 
10:49 < krzie> o_O
10:49 < jeev> man i can't figure out why i'm having issues when i do linux > linux
10:49 < jeev> i tried it once, it worked but i forgot wtf i did
10:49 < EugeneKay> <pedant> Linux is a kernel, not an OS </pedant>
10:49 < jeev> i had openvpn client (that's a gateway for an office) - openvpn server.
10:49 < jeev> so the client connects to the server but cannot reach OUT of the server.
10:49 < sappel> client log: http://pastebin.com/kw0azuJj
10:50 < jeev> now obviously i'm lazy and shit so i dont ever continue but i know it's something in iptables.
10:50 < krzie> jeev, you didnt say whether you're talking about !route or !redirect
10:50 < jeev> route, not interested in redirect.
10:50 < jeev> !route
10:50 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:50 < krzie> good, go read
10:50 < krzie> :-p
10:51 < jeev> it's weird, fbsd works but i can't do linux
10:51 < krzie> sappel, waiting on server log
10:51 < jeev> i'm an iptables noob since i stopped using linux and just started two years ago, i never firewall myself :D
10:51 < krzie> jeev, wonderful, go read !route
10:51 < jeev> krzie, i just skimmed through it... and...
10:51 < jeev> ;)
10:52 < krzie> "and i was hoping youd ban me"
10:52 < krzie> lol
10:52 < jeev> yea right.
10:52 < jeev> have you seen the access list of life ? i'm op.
10:52 < jeev> a.k.a. the grim reaper
10:52 -!- mode/#openvpn [+o krzie] by ChanServ
10:52 <@krzie> you were saying?
10:52 <@krzie> :-p
10:52 < jeev> anyway, the "route" isn't the issue
10:53 < jeev> i said the access list of life, not #openvpn
10:53 < sappel> krzie: the router and it does not give me any helpful logs...at least that what it looks like to me. here you go: http://pastebin.com/AmzV3ZG9
10:53 <@krzie> i dont care, !route covers everything you need
10:53 < jeev> no dood, the ROUTE is in there.
10:53 <@krzie> IT COVERS MORE THAN A ROUTE YOU TOOL
10:53 < jeev> humm
10:53 <@krzie> sappel, thats not your log
10:53 <@krzie> [11:47]  <vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
10:54 -!- mode/#openvpn [-o krzie] by krzie
10:55 < sappel> krzie: I'm afraid it is. As I said, it's on a routerboard with a special OS, no syslog available...that's what gives me a real hard time analyzing what's wrong :(
10:55 < krzie> syslog doesnt matter, specify the logfile like i just pasted you
10:55 < jeev> anyway, that doesn't solve my issue.
10:55 < krzie> --verb 5 --log /path/to/file
10:55 < krzie> from the 1 minute you looked?
10:56 < krzie> !clientlan
10:56 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
10:56 <@vpnHelper> better explanation
10:56 < krzie> my writeup covers all that and more, it is MORE than adding a route
10:56 < jeev> i'm not even talking about the clients yet, let me get it going and i'll show.
10:56 < krzie> fine, then
10:56 < krzie> !serverlan
10:56 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
10:56 < krzie> either way, more than a route, and covered in !route
10:57 < jeev> damn you and your factoids
10:57 < jeev> brb
10:57 < sappel> krzie: sorry, that path does not exist. It's not a linux distro
10:57 < krzie> i will not put in more effort than you do jeev, go read
10:57 < krzie> sappel, LOL that path exists nowhere, change it to your needs, lol
10:57 < krzie> oh god this is not the day for online tech support
10:58 < sappel> krzie: I know what you mean. But I can't start the server from a console manually, since it is RouterOs
10:58  * EugeneKay gets krzie  a beer
10:58 < jeev> hahaha
10:59 -!- STF [~chatzilla@dslb-088-077-102-044.pools.arcor-ip.net] has joined #openvpn
10:59  * jeev poisons his beer
10:59 < sappel> I guess I'll have to try the support of Mikrotik again
11:00 < jeev> ok krzie, i'm going to tell you the thing it's saying, now mind you.. i've read up 30 times, i've even got it working once and last time i tried was last week but i've been busy for i've forgotten *everything*, on the client config, i'm got a route added, when i traceroute, i get "send: Operation not permitted"
11:00 < jeev> now, dont say anything, let me read.
11:02 < krzie> sappel, ya if its not openvpn i cant help much
11:02 < krzie> sappel, i can take you a longer road...
11:02 < krzie> !certverify
11:02 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
11:02 < krzie> verify the certs like that
11:02 < krzie> then make sure your clock on your router is correct and timezone is correct
11:03 < sappel> ok, will do that, thanks
11:03 < krzie> if you get the same problem, it is either the client pointing to the wrong IP/PORT/proto or your server's firewall
11:03 < jeev> iptables -A OUTPUT -o tun+ -j ACCEPT will allow the traceroute out now but will not respond to ICMP, so now.. i've got to look carefully at iptables, i am getting a response from the target ip ultimately
11:03 < sappel> It's something with this damn router...I just didn't figure out yet, what it is :)
11:04 < jeev> damnit eric quailand!
11:06 < jeev> krzie, ok. ready ?
11:06 < krzie> ready for what? i dont troubleshoot iptables
11:07 < krzie> i dont even like linux
11:07 < jeev> ah you're still using win ME eh?
11:07 < jeev> lol just kidding.
11:07 < jeev> yea it's probably iptables.
11:07 < krzie> bsd
11:07 < jeev> i can actually get to my route now
11:07 < jeev> dood i'm tired of bsd, id ont know
11:07 < jeev> dont maintain it for a week and you're screwed.
11:07 < jeev> anyway i need about 20 3tb drives for a file server and am told to use zfs.
11:07 < krzie> weird, i hardly look at 1/2 my servers and they run fine
11:07 < krzie> yes, zfs is the win for that
11:07 < jeev> really, hmm
11:08 < jeev> i dont want to use hardware raid.
11:08 < krzie> ive been using it a couple years
11:08 < jeev> i want to raid 1 it, i guess raidz2 or somethin?
11:08 < krzie> zfs sounds like hardware raid to you?
11:08 < jeev> no.. i mean i could've avoided it probably
11:08 < krzie> zfs is filesystem raid
11:08 < jeev> but should i go z2 or z3
11:08 < krzie> read about them and make your own deciscions!
11:08 < krzie> crazy idea huh
11:08 < jeev> true
11:08 < jeev> i hate it!
11:09 < EugeneKay> BtrFS is nice, until you need fsck
11:09 < jeev> ok but as far as having about 20-30 3tb drives.. i need a pretty powerful CPU and ram, eh?
11:09 < EugeneKay> The choice of RAID-Z vs Z2 Z3 depends entirely upon how many disk failures you're comfortable with.
11:09 < krzie> ive been using zfs since i needed fbsd-7-current just to have it as an option
11:09 < jeev> yea i need to look at some calculators
11:10 < krzie> i recommend an AMD64 cpu and lots of ram for that if you go zfs
11:10 < EugeneKay> If you're using >5 drives you should be using -Z2(or raid 6)
11:10 < krzie> 64bit is important for zfs in freebsd
11:11 < krzie> as its having extra ram, a bit extra
11:11 < EugeneKay> With 20 drives, I would go with Z3, just in case.
11:11 < krzie> but also, you have to learn with zfs
11:11 < EugeneKay> Your usable space on 17x3TB is probably gonna be ~44TB
11:11 < krzie> so you might want hardware raid
11:11 < krzie> hehehe
11:11 < EugeneKay> Hardware RAID is a funn thing.
11:12 < EugeneKay> It's either cheap or it works.
11:12 < krzie> thing is, jeev doesnt like reading / learning
11:12 < krzie> and i doubt #zfs will admin it for him =/
11:13 < krzie> can you think of a card that would come with corporate support?
11:13 < krzie> ;]
11:17 < jeev> huh
11:17 < jeev> i dont like hardware raid.
11:17 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
11:18 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
11:19 < jeev> EugeneKay, z3 will give me 44tb out of 60?
11:19 < EugeneKay> Approximately.
11:19 < EugeneKay> And that's 44TiB out of 60TB
11:19 < EugeneKay> 2^ vs 10^
11:20 < EugeneKay> My rule of thumb is that you lose 10% to formatting, marketing department, and otherwise at the TB level
11:20 < jeev> how many disks can i lose
11:20 < EugeneKay> 3. Hence Z3
11:20 < jeev> 3 out of every..
11:20 < EugeneKay> 3 out of the whole stack
11:20 < jeev> wat.
11:20 < krzie> you never had 60 usable
11:21 < krzie> EugeneKay is factoring that in
11:21 < jeev> i understand
11:21 < jeev> i am looking for more of a 1/2, raid 1
11:21 < krzie> how many disks do you want to be able to lose?
11:21 < jeev> one out of every two
11:21 -!- STF [~chatzilla@dslb-088-077-102-044.pools.arcor-ip.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
11:22 < EugeneKay> Problem with RAID10 is that it sucks
11:22 < krzie> how incredibly inefficient
11:22 < jeev> it's for a very high quality camera system
11:22 < EugeneKay> You get much better data security against failure with RAID-5/6/Z
11:22 < EugeneKay> With RAID-10 you can lose the hole array after two disks
11:22 < EugeneKay> Why? Say you lose a disk and the disk it's mirroring
11:23 < jeev> i want something where i have 20 3tb disks, 60gb, unformatted, whatever. i want to have half usable.
11:23 < EugeneKay> Your whole array is now gone.
11:24 < krzie> just be sure you know how it works before you implimenyt
11:24 < krzie> cause i think you define what you want without understanding
11:24 < jeev> yea i know i'm going to start looking at shit once i determine what kind of hardware i need
11:24 < krzie> wronnnnnng
11:24 < krzie> you look at the hardware after you decide what you need
11:24 < jeev> ok whatever, i'll look at shit first then determine hardware i need
11:24 < EugeneKay> Lolz
11:24 < krzie> yep
11:25  * EugeneKay goes abck to trying Fedora 15
11:25 < jeev> ew
11:25 < jeev> fedora?
11:25 < krzie> i second the eww
11:25 < EugeneKay> I don't use it in production anywhere. 
11:25 < jeev> slackware.
11:25 < krzie> jeev, 1995 called, they want slackware back
11:26 < EugeneKay> People who have deeply-ingrained biases towards a linux distribution are blinded by the reality that is open source
11:26 < jeev> HAR HAR krzie
11:26 < krzie> dont worry, i warned them about 9-11 and the japan earthquake
11:26 < krzie> EugeneKay, i cant handle binary package managers
11:26 < krzie> they make me wanna punch babies =[
11:26 < EugeneKay> I use Red Hat variants because I was raised on them. I've been meaning to try Debian, but I just can't seem to get into it. Does that make me a bad person? Probably.
11:26  * EugeneKay shrugs
11:27 < jeev> krzie, warning about 9/11 wouldn't help if they put a net over afghanistan/saudi arabia, we all know who orchestrated it.
11:27 < EugeneKay> yum generally works for me.
11:27 < jeev> anyway, we wont talk about that
11:27 < jeev> redhat? eww.
11:27 < jeev> EugeneKay, try slackware.
11:27 < EugeneKay> In a word, no. 
11:27 < krzie> yes, take a time machine to 1995 and try it!
11:27 < krzie> ;]
11:27 < jeev> try it now
11:27 < krzie> try openvms too!
11:28 < EugeneKay> I've given Debian a go, I see why it's popular. I just don't use it. 
11:28 < EugeneKay> I have a few Ubuntu boxen fro building Android becasue that's what is easiest for that.
11:28 < EugeneKay> I've been told to try Arch but...... meh. 
11:28 < krzie> ive heard decent things about arch, but i agree... meh
11:29 < krzie> gentoo is really the only linux i almost enjoy
11:29 < EugeneKay> I've tried FreeBSD, but was flat out unable to get it to install
11:29 < jeev> ew debian
11:29 < jeev> gentoo, ew
11:29 < jeev> anyway
11:29 < krzie> but its basically same reason you like redhat, i was brought up on bsd...
11:29 < EugeneKay> Their install wizard seems to mean "I am a wizard" not "I want you to do it for me."
11:30 < jeev> so i've got to find out why tracing from the server will not give me a responce but from clients on the LAN, it will
11:30 < krzie> EugeneKay, how long ago?
11:30 < EugeneKay> 8.2?
11:30 < krzie> oh pretty damn recent
11:30 < EugeneKay> I want a GUI installer. Point, click, partition, enter root password, pick packages, reboot.
11:30 < krzie> ive been using it as my primary unix since 3.x
11:31 < krzie> ohhh ok, ya thats not what i want from an installer
11:31 < krzie> at least not for my server os
11:32 < krzie> i believe in beginner mode the installer is more like you said
11:32 < krzie> but im not sure honestly
11:32 < EugeneKay> I pick the Minimal nstall on CentOS/Scientific Linux installer, and then it reboots me to a shell prompt.
11:32 < krzie> i almost always use minimal install and add each thing i actually want
11:33 < EugeneKay> But I really, really do not want to have to set and mkfs.ext4 just to install a minimal system.
11:33 < EugeneKay> That's why there is a Wizard.
11:33 < EugeneKay> s/set/sit
11:33 < EugeneKay> And I hate Fedora 15.
11:33 < EugeneKay> Just like I hated Fedora 14
11:33 < EugeneKay> And 13
11:33 < EugeneKay> And 12
11:34 < EugeneKay> First thing I'm presented with after logging in? "GNOME has crashed."
12:28 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
12:29 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:30 < SigmaProjects> after a very, very long and frustrating weekend, I think im really close to getting this VPN setup properly, as of now, its running and clients can connect, and the clients can ping the lan behind the vpn server and everything (yay!)  but, the server cant seem to talk to the client's lan.. can anyone help me out?  Here are my configs and routes: http://pastie.org/private/hobczlp49yg5sbaqesjyka
12:31 < SigmaProjects> both the server and client are openwrt routers, which has been a small problem due to a lot of how-to's assume a vpn server is a seperate machine, which made it a little confusing
12:33 < SigmaProjects> I would be greatly appreciative if anyone could help me get the server's lan be able to talk to the clients lan
12:33 <@vpnHelper> RSS Update - forum: Connect to OpenVPN on Windows Login <http://forums.openvpn.net/topic8234.html#p12642>
12:51 < Bushmills> !clientlan
12:51 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
12:51 <@vpnHelper> better explanation
12:52 < Bushmills> !route
12:52 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:11 -!- dazo is now known as dazo_afk
13:27 < SigmaProjects> Thanks Bush, I have read that a few times, but I still don't see what I'm missing/lacking from my configs
13:34 < Bushmills> the server doesn't seem to have a return route to client LAN
13:35 < SigmaProjects> thats exactly the problem, but the route I try to add "ip route add 192.168.6.0/24 via 198.168.1.1" is either invalid/wrong
13:36 < SigmaProjects> or at least, the command returns the error "no such process", which I dont understand
13:39 < Bushmills> what interface has 192.168.1.1 as ip address?
13:39 < hyper_ch> hi Bushmills
13:39 < SigmaProjects> That is the LAN's Gateway IP of the VPN server
13:40 < Bushmills> and, why should when routing via 192.168.1.1, packets be returned through vpn?
13:40 < SigmaProjects> ... I don't know?
13:41 < SigmaProjects> This is all very confusing
13:41 < Bushmills> does machine with 192.168.1.1 interface have a route to through vpn for 192.168.6.0 traffic?
13:42 < Bushmills> hi hyper_ch
13:42 -!- newmember [~newmember@d216-232-100-14.bchsia.telus.net] has joined #openvpn
13:42 < hyper_ch> Bushmills: there are rumors, that your are a php guru
13:43 < Bushmills> me? that's bull. i hardly know how to spell php
13:44 < hyper_ch> Bushmills: it was worth a try :)
13:44 < SigmaProjects> Im thinking it doesnt, since server cant ping through.. but how to add that route on the server is what I dont understand, I thought in the config "route 192.168.6.0 255.255.255.0" would have added it?
13:50 < SigmaProjects> am I wrong?
13:52 < Bushmills> have you checked server logs for errors related to route adding?
13:52 < SigmaProjects> I am sorry for my ignorance, Ive been reading openvpn documentation, how-to-'s and blogposts all weekend (really), but i dont understand all of it
13:53 < Bushmills> logs can be valuable devices for tracing problems
13:55 < SigmaProjects> whenever I try to use the log-append directive, the vpn process either hangs or crashes
13:56 < Bushmills> tried --log ?
13:58 < SigmaProjects> Though, when I'm just reading the output, when I ping from the server to the client, the client has this "us=413736 UDPv4 READ [53] from 72.129.43.2:1194: P_DATA_V1 kid=0 DATA len=52" and the same for WRITE, and the 72.129.43.2 IP is the server's IP
13:59 < SigmaProjects> the firewall does accept icmp packets, and.. everything else for that matter for now, while im testing
13:59 < SigmaProjects> so, guessing.. the server is pinging the client, but the client doesnt know how to respond?
14:00 < Bushmills> that seems to be a different problem - the problem you had before was the server not reaching machines on client LAN
14:01 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
14:02 < SigmaProjects> Yeah, still.. and just to be clear, I think its just the client's LAN, since I can ping the clients tun ip of 10.8.1.2
14:02 < Bushmills> but not 192.168.6.x
14:02 < SigmaProjects> right
14:03 < Bushmills> for 10.8.1.x, server has a route to vpn
14:03 < Bushmills> for 192.168.6.x, it doesn't
14:03 < SigmaProjects> I belive so
14:04 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
14:04 < Bushmills> without route through vpn, server has no reason to send packets with destination 192.168.6.x through vpn
14:05 < Bushmills> instead, they'll go through default gateway which probably drops or misroutes them
14:05 < SigmaProjects> Yes, but I dont know how to add that route.. i really thought the "route 192.168.6.0 255.255.255.0" definition is for that route?
14:05 < Bushmills> (20:52:03) Bushmills: have you checked server logs for errors related to route adding?
14:06 < SigmaProjects> im not sure what logs / how to check on this router
14:06 < Bushmills> (20:56:39) Bushmills: tried --log ?
14:06 < SigmaProjects> so the VPN's log?
14:06 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
14:06 < Bushmills> i'd not expect to find that in your mailer log
14:07 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
14:08 < SigmaProjects> But like I said, the log directives hang/crash the vpn proccess, and to be sure, I just also tried openvpn --config client.conf --log /var/vpn.log
14:09 < Bushmills> a router, you say?  try to log to /tmp
14:13 < SigmaProjects> >.< that seems to work, I was trying /var.. no clue why its different, but in the log.. im seeing "us=351877 UDPv4 WRITE [53] to 72.129.43.2:1194: P_DATA_V1 kid=0 DATA len=52" again
14:13 < SigmaProjects> but yes, the vpn server and client are both running on the routers
14:21 < SigmaProjects> ah!
14:22 < SigmaProjects> i think i see it Bush, http://pastie.org/private/af82iqhey1z8jc1wg5jw0a  line's 9 and 10 are the issue, right?
14:23 < Bushmills> hm. looks like it. though the --server directive should have taken care of that, by expanding to - among other -  ifconfig ...
14:24 < Bushmills> but well, if the log complains about, it's worth to give it a shot
14:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 255 seconds]
14:24 < SigmaProjects> also, I added the script-security 2 like it wanted, so it stopped complaining about that
14:25 < SigmaProjects> what do I need to tell the ifconfig option?
14:26 < Bushmills> you probably want to specify gateway on the --route line. 
14:28 < SigmaProjects> which gateway?  the client's tun?  agian, I have the route line in my config as "route 192.168.6.0 255.255.255.0" 6.0 being the client's lan range.. is that wrong?
14:29 < Bushmills> yes. client is gateway for server packets to 192.168.6.0 network
14:29 < SigmaProjects> im confused what I should change it to?
14:30 < Bushmills> look at --route in man page how to specify a gateway 
14:32 < SigmaProjects> even going back to http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing ... im following what it says, i dont understand
14:32 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
14:33 < Bushmills> think of server wanting to reach a machine on 192.168.6.0 network.  where to does it have to send those packets?
14:34 < SigmaProjects> to 10.8.1.2
14:34 < Bushmills> that's what the server route to 192.168.6.0 network destinations must express
14:35 < SigmaProjects> Right but.. I. I don't understand, Im following what the docs say
14:36 < Bushmills> what is it you don't understand?
14:36 < SigmaProjects> does the order in which I define options in the config matter?
14:36 < Bushmills> for most part it doesn't
14:40 -!- invisiblek [~invisible@97-88-5-137.dhcp.roch.mn.charter.com] has quit [Quit: Leaving]
14:49 < SigmaProjects> I tried adding to the server config "route-gateway 10.8.1.1" as well as "route-gateway 10.8.1.2", though the error went away, the server wasnt able to ping the clients lan
14:49 < SigmaProjects> what am I doing wrong?
14:50 < Bushmills> 10.8.1.1 is your server.  does server know how to reach 192.168.6.0?
14:50 < ferar> krzie: excuse my ignorance, regarding the earlier question "exclude specific ip addresses from being routed through the vpn tunnel?" found the following http://lartc.org/howto/lartc.rpdb.multiple-links.html on how to split traffic but not sure you meant that? 
14:50 <@vpnHelper> Title: Routing for multiple uplinks/providers (at lartc.org)
14:51 < SigmaProjects> Isnt that what its for?  route-gateway 10.8.1.1 ..?  what
14:51 < Bushmills> (21:34:12) SigmaProjects: to 10.8.1.2   - you found that out allmost by yourself that that is the gateway
14:51 < ferar> our case is as following, we are connecting via PPP to ISP with specific gateway, then launch openvpn and connect to our openvpn server using the establised ppp connection, we want to redirect all incoming/outgoing traffic through the vpn tunnel 'tun0' except for the following external IP addresses 66.AAA.AAA.AAA and 38.BBB.BBB.BBB, were we want all traffic to go through ppp0 directly and not through the tun0. How is  (#1) https://forums.openvpn.net/viewtop
14:51 < ferar> ic.php?f=15&t=7161, route_override can help in that matter?
14:52 < Bushmills> doesn't help a lot for packets from server to let server know that itself is the gateway if it doesn't know how to reach the destination
14:52 < Bushmills> the gateway is a machine which does know where to send those packets on
14:53 < SigmaProjects> I understand that problem has been the server doesnt know how to route packets to the client.. but I dont understand how to fix that, i've done everything the docs and how-to's said to, so.. I really dont understand how to fix this
14:54 < Bushmills> no. the problem is not that the server doesn't know how to route to client,  the problem is that the server doesn't know how to reach the LAN behind the client
14:55 < Bushmills> and therefore you'll add a route to server, telling that the machine which *does* know how to reach 192.168.6.0 is the gateway for packets with that destination
14:57 -!- invisiblek [~invisible@97-88-5-137.dhcp.roch.mn.charter.com] has joined #openvpn
15:01 < SigmaProjects> and adding "route-gateway 10.8.1.2" to the server config is not how to fix that?  10.8.1.2 knows how to reach the clients lan, right?  because thats the clients tun IP
15:02 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
15:02 < invisiblek> SigmaProjects, did you enable ip forwarding on your server?
15:02 < Bushmills> SigmaProjects: yes, 10.8.1.2 makes a much better gateway than 10.8.1.1
15:02 < SigmaProjects> yeah, and to be sure i enabled them both
15:04 < Bushmills> though - as suggested - use that gateway in your --route, not with --route-gateway, as the latter that's that gateway default for all --route directives, while you want to use that particular gateway for the 192.168.6.0 route only
15:04 < Bushmills> the latter *sets* that gateway ...
15:04 < SigmaProjects> I tried using route-gateway 10.8.1.2, but it doesnt seem to work yet.. this is the routes on the server, http://pastie.org/private/to70oxywvwe7umqxly6cg
15:04 < SigmaProjects> er
15:05 < Bushmills> (21:26:44) Bushmills: you probably want to specify gateway on the --route line. 
15:08 < SigmaProjects> changing it to "route 192.168.6.0 255.255.255.0 10.8.1.2" doesnt seem to work?
15:08 < SigmaProjects> and i removed the route-gateway
15:08 < Bushmills> define "doesn't work"
15:08 < invisiblek> SigmaProjects, you said are using tap with a bridge right?
15:09 < SigmaProjects> Sorry, I mean, i'm still unable to ping 192.168.6.1 from the server.. though the client is able to ping the servers lan still
15:10 < SigmaProjects> its a tun, i posted my configs a while back.. i'll repost since its changed a little http://pastie.org/private/oqyg5hwcbtgr94xndngadq
15:10 < Bushmills> at least the reason that server didn't know how to reach 192.168.6.0 network is not cause of the problem anymore, with the route to 192.168.6.0 on server now
15:10 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
15:10 < SigmaProjects> Seems true, route shows "192.168.6.0     10.8.1.2        255.255.255.0   UG    0      0        0 tun0" which *should* be correct
15:11 < Bushmills> assuming that packets go to client now, you'd want to check client now.
15:13 -!- images [~images@static.238.229.4.46.clients.your-server.de] has joined #openvpn
15:13 < SigmaProjects> what should I be checking on the client?  the log doesnt seem to have any errors in it
15:14 -!- sappel [~sap@HSI-KBW-078-042-105-249.hsi3.kabel-badenwuerttemberg.de] has quit [Quit: Leaving]
15:14 < SigmaProjects> and the client can still ping the server's lan
15:14 < Bushmills> check whether ip forwarding is on, and look with tcpdump at incoming and forwarded packets
15:15 < Bushmills> also make sure that no firewall blocks passage of those packets
15:17 < SigmaProjects> sorry, had to install tcpdump on the client.. im listening on the clients tun adapter, tun0.. but there's no traffic when I try to ping the client
15:18 < SigmaProjects> though, traffic shows up when I ping the server
15:18 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
15:20 < Bushmills> sorry, have to hit the road. afair, the idea was to diagnose packets send to machines on the LAN behind the client. but if you're diagnosing pings to client now, feel free to fix that first.
15:20 < SigmaProjects> as for the firewalls, both are set to accept all traffic at the momment
15:20 < SigmaProjects> but if i cant ping even the client itself...?
15:21 < Bushmills> you were able to do that earlier on
15:21 < SigmaProjects> but, thanks for your time Bush, I do appriciate it
15:21 < SigmaProjects> no, ive never been able to ping the client from the server
15:21 < Bushmills> i have no idea why you can't ping client any longer now
15:21 < SigmaProjects> that was the whole problem, i cannot ping the client from the server... but the otherway works
15:23 < Bushmills> "...clients can ping the lan behind the vpn server and everything (yay!)  but, the server cant seem to talk to the client's lan.."
15:23 < Bushmills> nothing said of  server can't ping client
15:23 < Bushmills> but /me gone now
15:24 < SigmaProjects> Thanks again Bush
15:24 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
15:26 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
15:26 -!- [1]SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
15:26 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
15:27 -!- Busch_ [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
15:28 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has joined #openvpn
15:28 -!- Nappy_ [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
15:29 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Ping timeout: 260 seconds]
15:29 -!- [1]SigmaProjects is now known as SigmaProjects
15:29 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 260 seconds]
15:29 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
15:29 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 260 seconds]
15:29 -!- ronnocol [~lance@2001:1868:214::dead:beef] has quit [Ping timeout: 260 seconds]
15:29 -!- bigon [bigon@ubuntu/member/bigon] has quit [Ping timeout: 260 seconds]
15:29 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 260 seconds]
15:29 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
15:29 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
15:29 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Ping timeout: 260 seconds]
15:29 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Ping timeout: 260 seconds]
15:29 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Ping timeout: 260 seconds]
15:29 -!- Busch_ is now known as Busch
15:30 -!- corretico [~luis@186.176.7.194] has joined #openvpn
15:30 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
15:30 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
15:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
15:30 -!- mode/#openvpn [+o mattock] by ChanServ
15:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:31 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
15:31 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
15:31 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
15:31 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
15:33 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
15:33 < jeev> !route
15:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:37 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
15:43 < invisiblek> !dns
15:43 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
15:43 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12643>
15:43 < invisiblek> !pushdns
15:43 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
15:43 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
15:44 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
15:44 -!- Hamlin [~Hamlin@unaffiliated/hamlin] has quit [Remote host closed the connection]
15:46 -!- images [~images@static.238.229.4.46.clients.your-server.de] has quit [Quit: Bye!]
15:47 -!- Hamlin [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has joined #openvpn
15:50 -!- APTX_ is now known as APTX
15:50 < jeev> lol krzie
15:50 < jeev> iptables -t nat -A POSTROUTING -o tun+ -j MASQUERADE
15:50 < jeev> fixed it.
16:06 < jeev> i just can't traceroute..
16:06 < jeev> from LAN, hm i'll continue reading later, lazy
16:19 < jeev> MULTI: bad source address from client <- i know what the solution is but in this instance, it's a dynamic WAN ip, is there a way to do it other than dyndns and scripting it to update the ccd file ?
16:25 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
16:45 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:48 -!- Nappy_ [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Quit: Leaving]
16:49 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
16:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
16:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:23 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
17:37 -!- corretico [~luis@186.176.7.194] has quit [Ping timeout: 260 seconds]
17:37 < krzee> !iphone
17:37 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
17:37 <@vpnHelper> iPhone and iPad.
17:42 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
17:42 <@vpnHelper> RSS Update - forum: OpenVPN post disconnect problem <http://forums.openvpn.net/topic8233.html#p12644>
17:46 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:47 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
17:48 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
18:18 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:21 -!- ferar [~ferar@64.254.252.178] has quit [Quit: Leaving]
18:21 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:25 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:27 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
18:29 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
18:43 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 240 seconds]
18:43 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
19:03 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:10 -!- cali [~cali@unaffiliated/cali] has quit [Read error: Operation timed out]
19:22 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
19:22 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:23 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:27 < krzie> [16:51]  <jeev> iptables -t nat -A POSTROUTING -o tun+ -j MASQUERADE
19:27 < krzie> [16:51]  <jeev> fixed it.
19:27 < krzie> funny, you said you were just routing lans
19:27 < krzie> which means your routing was screwed but you used the nathack as a work-around 
19:27 < krzie> !nathack
19:27 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
19:28 < krzie> my writeup at !route would have helped if you bothered
19:28 < krzie> since if you follow !route, and have access to change a route on the router for the lan, you dont need the nathack
19:29 < Proz0id> krzie: thanks for leading me to eurephia
19:29 < krzie> yw
19:29 < Proz0id> it's pretty kool..
19:29 < krzie> but all the real thanx go to dazo =]
19:29 < Proz0id> just needs a front web interface.
19:29 < krzie> oh its not a webui?
19:29 < krzie> i assumed it was
19:30 < Proz0id> none that i know
19:31 < krzie> youd know more than me at this point
19:31 < krzie> ive never had a reason to use it
19:32 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
19:33 <@vpnHelper> RSS Update - forum: Adding a virtual server to vlan <http://forums.openvpn.net/topic8240.html>
19:44 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
19:54 < SigmaProjects> A few hours ago, Bushmills was helping me solve an issue before he had to leave.  I was hoping someone else could lend me a hand.  The VPN is up and running, the Client can ping the server, but the Server cant seem to ping the Client.  This is my server conf http://pastie.org/private/oqyg5hwcbtgr94xndngadq
19:55 < krzie> its your firewall
19:55 < krzie> remove line 2
19:55 < SigmaProjects> Thats what I thought as well, and to be safe I also set the firewall to accept all traffic
19:55 < krzie> in line 20 remove 10.8.1.2
19:56 < krzie> show me cat /etc/openvpn/clients/ajhome
19:56 < SigmaProjects> Bush is the one that had me add it, but since its you saying this (also used your config gen, very cool thank you)
19:56 < krzie> cool!
19:56 < krzie> howd you hear of it?
19:56 < SigmaProjects> gooogle
19:56 < krzie> awesome =]
19:57 < SigmaProjects> this is the ajhome,  iroute "192.168.6.0 255.255.255.0"
19:57 < krzie> good
19:57 < krzie> ok so now set both sides to verb 5
19:57 < krzie> then connect, ping, pastebin logs
19:57 < SigmaProjects> one sec
20:02 < SigmaProjects> http://pastie.org/private/apvkq3bejbfffuyvql8dda  top is server, bottom is client... also, since i removed the gateway from line 20, the error 'OpenVPN needs a gateway parameter for a --route option' came back
20:03 < SigmaProjects> but regardless, the client can ping all of the servers lan.. but the server cant ping the client (192.168.6.1)
20:03 < krzie> weird, it should get that from --server
20:03 < krzie> ok put it back then
20:03 < krzie> when i said that i didnt realize Bushmills had you add it ;]
20:04 < SigmaProjects> alright, started it back.. that msg went to lala land again
20:04 < krzie> did you ping before saving this?
20:05 < SigmaProjects> yep, but nothing showed up in the long when i tried
20:05 < krzie> what did you ping, and from where?
20:05 < SigmaProjects> I tried from the server to the client 192.168.6.1
20:06 < krzie> how bout server to 10.8.1.2?
20:06 < SigmaProjects> yep, that works
20:06 < SigmaProjects> thats the clients tun0 ip
20:06 < krzie> what os is the client?
20:06 < SigmaProjects> both client and server are running on openwrt
20:06 < krzie> linux i assume then
20:06 < krzie> oh its the router for its lan
20:06 < SigmaProjects> basicly the end point routers
20:07 < krzie> forward chain in iptables has tun+ allow?
20:07 < SigmaProjects> Yeah, 6.1 is the LAN ip of the client/router
20:07 < SigmaProjects> both the server and client run iptables -A INPUT -i tun+ -j ACCEPT as well as FORWARD
20:07 < krzie> it being the router tells me you dont need another route on the router, and that ip forwarding is enabled
20:08 < krzie> which means since your config is correct, its your firewall
20:08 < krzie> oh wait no
20:08 < krzie> its not named ajhome
20:08 < krzie> change the ccd file from ajhome to client
20:08 < SigmaProjects> its not?  wait, whats not
20:09 < SigmaProjects> hmmm
20:09 < krzie> you told my confgen you would name it ajhome
20:09 -!- master_of_master [~master_of@p57B5580D.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:09 < krzie> but you didnt do so when you made your certs
20:09 < krzie> (soon my confgen will make the certs, and this wont be able to happen)
20:11 < krzie> !certinfo
20:11 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
20:11 < krzie> look at the CN ;]
20:11 < SigmaProjects> Yep yep, you were right
20:12 < SigmaProjects> changed it, ran it, tried to ping again, here is the result http://pastie.org/private/hc3285dlrp6zmt5u7fu3yq (unfourtantly still cant ping)
20:12 < krzie> MULTI: internal route
20:12 < krzie> thats good stuff =]
20:13 -!- master_of_master [~master_of@p57B55924.dip.t-dialin.net] has joined #openvpn
20:13 < krzie> wtf is 174.36.30.38 ?
20:13 < SigmaProjects> I have no clue
20:14 < SigmaProjects> i noticed that oo
20:14 < SigmaProjects> too*
20:14 < krzie> that doesnt correspond with something you should know...?
20:14 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 276 seconds]
20:15 < SigmaProjects> the client is /just/ the router, there are no clients connected to it yet, only cable to it is just the uplink.. so, really, no clue
20:16 < SigmaProjects> and i just checked my active connections going through my router, and 174.36.30.38 doesnt show up
20:16 < krzie> well your system is seeing it as 174.36.30.38... check your nat rules
20:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
20:18 <@vpnHelper> RSS Update - forum: Adding a virtual server to vlan <http://forums.openvpn.net/topic8240.html#p12646>
20:19 < SigmaProjects> how do i check my nat rules?
20:19 < krzie> by learning your firewall
20:19 < krzie> i think something like iptables -L -t nat
20:19 < krzie> i dont use linux tho
20:20 < SigmaProjects> >.<
20:20 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
20:20 < krzie> o_O
20:20 < SigmaProjects> I see something.. give me a sec
20:22 < SigmaProjects> Okay, I called over and it seems there /is/ a something connected to the client lan, the router gave it 192.168.6.106, and among other things, its connected to 174.36.30.38
20:24 < SigmaProjects> It seems as if the client vpn is trying to route all traffic through me?  or does that "MULTI: bad source address from client " mean something else?
20:28 < SigmaProjects> Is this my client config if it helps http://pastie.org/private/vgcqpufihe0wi4ga9vgxq
20:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:31 < SigmaProjects> what could be causing this
20:39 < SigmaProjects> ... did I scare everyone away?
20:47 < jeev> heeh SigmaProjects
20:47 < jeev> have you read about ccd ?
20:48 < jeev> krzee, i read up about it, it didn't help (your writeup on route) but whatever.
20:48 < jeev> krzie
20:48 < SigmaProjects> as much as i could understand it
20:48 < jeev> what is in your ccd folder
20:49 < SigmaProjects> just a single file 'client' with  iroute "192.168.6.0 255.255.255.0"
20:50 < jeev> is that on your client machine or server
20:51 < SigmaProjects> that 'client' file is on the server (the client is actually called 'client' btw, bad namming i know)
20:51 < jeev> hmm
20:51 < jeev> !ccd
20:51 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
20:52 < jeev> your server config have it ?
20:52 < SigmaProjects> the server is calling ./clients/client, yes
20:52 < jeev> client-config-dir ccd
20:52 < jeev> in tyour server conf
20:52 < jeev> hmm
20:53 < SigmaProjects> yeah, this is the server conf currently http://pastie.org/private/lspmmx7vcgzbp77vvejpmg
20:55 < jeev> not sure man, it's probably something easy, it always is
20:56 < SigmaProjects> 'easy' - something vpn never seems to be to peons like myself
20:56 < jeev> heh
20:56 < SigmaProjects> hey krzie i think I found the problem I was having, and I was hoping you could verify
20:57 < jeev> the server is reporting that MULTI warning, right
20:57 < SigmaProjects> i noticed a firewall option called 'drop invalid packets', disabled it, and now the client can ping the server.. but, i want to make sure the client isnt routing All its traffic through the vpn server
20:57 < SigmaProjects> Yeah, but now thats gone away
20:57 < krzie> SigmaProjects, that ip is sending traffic through the vpn
20:58 < krzie> but the vpn server cant handle it because there is no iroute for it
20:59 < SigmaProjects> I dont quite understand
21:01 < krzie> MULTI: bad source address from client
21:01 < krzie> it means that traffic from that IP was coming over the vpn from your client
21:01 < krzie> but without a matching iroute, it cant happen
21:01 < krzie> basically, its what would happen if you didnt have iroute
21:02 < krzie> now if you WANT that ip to be able to use the vpn, add an iroute
21:02 < krzie> otherwise, you can ignore it (but you should firewall it anyways)
21:02 < SigmaProjects> so the Multi is not really an error?
21:02 < krzie> well it is
21:02 < krzie> you see the openvpn server has its own lil routing table
21:03 < krzie> which you can add to with iroute
21:03 < krzie> but when that foreign IP comes from a client, if the server passes it along, when it gets a response it wont know what client to send the traffic to
21:03 < krzie> because no iroute entry matched it
21:04 < SigmaProjects> And it would drop it, and the client router will be able to pick it up?
21:04 < krzie> the real routing table can only point to the device, which is pointing to openvpn
21:04 < krzie> but openvpn needs to know what client that ip goes to
21:04 < krzie> pick what up?
21:05 < SigmaProjects> Sorry, I guess i don't follow too well.  If the client is sending its lan traffic To the vpn, and the vpn server doesnt know how to route it.. then, the client's traffic is going nowhere?
21:06 < SigmaProjects> I dont want the VPN client to send its random internet traffic through the VPN, is there a way to advoid this?
21:13 < jeev> krzie, if that ip is a dynamic ip, what's the best wya to go about it ?
21:13 < jeev> way
21:15 < krzie> jeev, in your case its different
21:15 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Ping timeout: 240 seconds]
21:15 < krzie> sometimes some peoples OS send it with the wrong source IP
21:16 < krzie> no idea what setting in the OS controls this
21:19 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:33 < krzie> jjk found some other workaround i think
22:32 < jeev> hmm
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:26 <@vpnHelper> RSS Update - forum: remote connection problem <http://forums.openvpn.net/topic8241.html>
23:45 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
23:45 < Xgates> hey guys
23:47 < Xgates> anyone using openvpn, I see it's not in the root's path for /usr/loca/sbin but in the root's .profile the path is in there, but echo $PATH doesn't show it
23:47 < Xgates> any reason why openvpn is not in the root's path? seems odd...
23:48 < jeev> where is openvpn
23:48 < jeev> i dont think .profile is used by all shells
23:48 < Xgates> I just said it /usr/loca/sbin :)
23:48 < jeev> so openvpn is /usr/local/sbin/openvpn ?
23:49 < Xgates> yes
23:49 < jeev> echo $PATH
23:49 < jeev> what do you see
23:52 < Xgates> I'm not on my box here, so here's pastebin for that --> http://pastebin.ca/2072605
23:52 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 258 seconds]
--- Day changed Tue May 31 2011
00:05 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
00:06 < Xgates> I got it loaded now
00:07 < Xgates> my nic seems to have bad support like sometimes it connects and sometimes it doesn't... It's Atheros AR9285 and when it's connected the connection moves really slow
00:07 < Xgates> anyone know how the support is for this?
00:09 < amero> hello. it's my first time setting up openvpn. which setting determines whether or not all my traffic will get routed through the vpn?
00:18 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Ping timeout: 248 seconds]
00:20 < amero> disregard that
01:06 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has joined #openvpn
01:21 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:25 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:59 -!- cron2_ is now known as cron2
01:59 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
01:59 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
02:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
02:02 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
02:50 -!- defswork [~andy@mx1.3gcomms.co.uk] has joined #openvpn
02:50 <@vpnHelper> RSS Update - forum: how to forward ports from client network side <http://forums.openvpn.net/topic8239.html#p12648>
03:01 -!- amero [~amero@unaffiliated/amero] has left #openvpn []
03:05 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 260 seconds]
03:08 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
03:08 -!- mode/#openvpn [+o raidz] by ChanServ
03:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:37 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
03:38 -!- oc80z [oc80z@blea.ch] has joined #openvpn
03:51 <@vpnHelper> RSS Update - forum: OpenVPN post disconnect problem <http://forums.openvpn.net/topic8233.html#p12649>
03:57 <@vpnHelper> RSS Update - forum: how to forward ports from client network side <http://forums.openvpn.net/topic8239.html#p12651> || remote connection problem <http://forums.openvpn.net/topic8241.html#p12650>
03:57 -!- mripguru [~mripguru@vpn1.hspheredns.com] has joined #openvpn
03:58 -!- mripguru [~mripguru@vpn1.hspheredns.com] has left #openvpn []
04:00 -!- wangerin1 [~testing-3@dkpix.brightpoint.dk] has quit [Ping timeout: 246 seconds]
04:01 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
04:03 <@vpnHelper> RSS Update - forum: how to forward ports from client network side <http://forums.openvpn.net/topic8239.html#p12652>
04:04 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 255 seconds]
04:08 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
04:09 -!- wangerin1 [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
04:09 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
04:13 -!- dazo_afk is now known as dazo
04:26 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
04:33 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
04:38 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
04:43 <@vpnHelper> RSS Update - forum: remote connection problem <http://forums.openvpn.net/topic8241.html#p12653>
04:52 -!- ph1l [~ph1l@gprs49.swisscom-mobile.ch] has joined #openvpn
04:54 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
05:06 -!- Blues-Man [~bluesman@host35-29-dynamic.42-79-r.retail.telecomitalia.it] has joined #openvpn
05:11 -!- ph1l [~ph1l@gprs49.swisscom-mobile.ch] has quit [Ping timeout: 244 seconds]
05:15 -!- prod___ [~prod___@host217-42-181-90.range217-42.btcentralplus.com] has joined #openvpn
05:16 < prod___> Hi all, i have a small problem that is mainly because i am unable to word it and find a response on google. I bought a vpn account and was given a vpn-provider.ca.crt. I am trying to automate the vpn connection on startup but as its a "username and password style" vpn connection it requires me to enter details before connecting (not very automated). I think i need to create .key files but am unsure. Can anyone help me? Ju
05:16 < prod___> st a link to a tutorial/docu would be enough. The ubuntu docu only says about creatin new certificates and not what i am looking for. TIA
05:17 < prod___> !welcome
05:17 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:18 < prod___> !howto
05:18 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:25 <@vpnHelper> RSS Update - forum: remote connection problem <http://forums.openvpn.net/topic8241.html#p12654>
05:26 < Bushmills> prod___: you may want to look into manpage.  specifically, the  --auth-user-pass  directive
05:27 < prod___> <3 bushmills :)
05:27 < Bushmills> oh,   manpage, that means:   man openvpn
05:29 < SOG> Høw is e√e®¥ øne ∂øing?
05:32 -!- mode/#openvpn [+o Bushmills] by ChanServ
05:33 -!- mode/#openvpn [-v SOG] by Bushmills
05:33 -!- mode/#openvpn [-o Bushmills] by Bushmills
05:34 < prod___> TY so much bushmills. Just what i needed.
05:43 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12655>
05:52 -!- ph1l [~ph1l@gprs19.swisscom-mobile.ch] has joined #openvpn
05:55 < defswork> where do you buy a vpn account from ? and to what network does it give you access to ?
05:55 <@vpnHelper> RSS Update - forum: how to forward ports from client network side <http://forums.openvpn.net/topic8239.html#p12656>
05:59 < Bushmills> defswork: run your own server, and control yourself what networks you gain access to.   internet is a popular one.
06:00 < defswork> Bushmills, I was askign wrt prod___'s question
06:00 < defswork> " I bought a vpn account"
06:01 -!- ph1l [~ph1l@gprs19.swisscom-mobile.ch] has quit [Ping timeout: 240 seconds]
06:03 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
06:03 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
06:03 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
06:03 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
06:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:08 -!- Blues-Man [~bluesman@host35-29-dynamic.42-79-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
06:18 < prod___> Hi again, I cant seem to find any reference to --enable-password-save and am gettting error as i am obviously using it incorrectly
06:20 < Bushmills> prod___: how do you use it?
06:20 < Bushmills> especially, where do you use that?
06:22 < prod___> I am tryin to use it at terminal. like "sudo openvpn --enable-password-save /etc/openvpn/vpn.conf" sorry if im being a dummy
06:22 < Bushmills> read man page on enable-password-save
06:22 < Bushmills> you know what "has been built with..." refers to?
06:23 < prod___> I cant seem to find it. ill look again. sorry again :S
06:23 < prod___> No im not aware of what that means
06:23 < Bushmills> that's an option given when openvpn was compiled
06:24 < Bushmills> it determines whether the executable has or hasn't support for user/pass in files
06:24 < prod___> I am assuming i will need to check ubuntu docus for that variable?
06:24 < Bushmills> yes. that's distribution/build specific
06:25 < prod___> Thank you so much for time Bushmills, greatly appreciated
06:26 <@dazo> !epel
06:26 <@dazo> !centos
06:26 <@vpnHelper> "centos" is See !epel5
06:26 <@dazo> !epel5
06:26 <@vpnHelper> "epel5" is Please use the EPEL repository when installing OpenVPN on RHEL/CentOS: http://fedoraproject.org/wiki/EPEL/FAQ#How_can_I_install_the_packages_from_the_EPEL_software_repository.3F
06:27 < prod___> Bushmills: I have scrolled up and down this manpage several times now and cant seem to find "--enable-password-save". Could this be an indication that ubuntu does not support this feature as standard?
06:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
07:09 < Bushmills> prod___: more likely it is an indication of your lack of searching skills
07:09 < Bushmills> "have scrolled up and down this manpage several times" is another :)
07:09 < Bushmills> you can *search* in man pages, you know?
07:12 < defswork> search only works if you turn off pretty man pages
07:12 < defswork> which iirc is on by default in ubuntu
07:12 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
07:13 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
07:14 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:15 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
07:16 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
07:16 -!- Cain` is now known as Cain
07:19 -!- Belial_ [~quassel@128.210.61.130] has quit [Ping timeout: 252 seconds]
07:21 -!- bent_screwdriver [~UserNick@74.255.249.66] has joined #openvpn
07:24 <@dazo> prod___: --enable-password-save is a configure option when you compile openvpn ... if openvpn is compiled without it, --auth-user-pass won't accept a filename as the extra argument
07:25 <@dazo> defswork: you're kidding me?  ubuntu removes search feature to make them look pretty?  so usability is less important?
07:29 -!- defswork [~andy@mx1.3gcomms.co.uk] has quit [Read error: Operation timed out]
07:29 -!- defswork [~andy@mx1.3gcomms.co.uk] has joined #openvpn
07:30 <@vpnHelper> RSS Update - forum: Annoying warning <http://forums.openvpn.net/topic8242.html>
07:31 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
07:37 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:38 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Remote host closed the connection]
07:38 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
07:45 -!- bent_screwdriver [~UserNick@74.255.249.66] has quit [Quit: Going offline, see ya! (www.adiirc.com)]
07:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:47 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 258 seconds]
07:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:53 <@vpnHelper> RSS Update - forum: Site to Site VPN, Client not getting IP from VPN Subnet <http://forums.openvpn.net/topic8226.html#p12658>
07:54 -!- Clete2_ [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
07:54 -!- Clete2_ is now known as Clete2
07:55 -!- prod___ [~prod___@host217-42-181-90.range217-42.btcentralplus.com] has quit [Read error: Connection reset by peer]
07:59 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 240 seconds]
08:07 -!- EugenMayer [~eugen@frbg-4d02948a.pool.mediaWays.net] has joined #openvpn
08:08 < EugenMayer> Hello. Iam not sure how a end-to-site setup is different to a site-to-site setup with openvpn?
08:11 -!- Belial_ [~quassel@128.210.61.130] has quit [Ping timeout: 252 seconds]
08:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 252 seconds]
08:12 -!- phaidros [~phaidros@ghostshell.subsignal.org] has joined #openvpn
08:13 < phaidros> hi, I am plainly stoopid imho, how do I simply push a network route to a openvpn client in client-to-client mode ? push "route 10.23.0.0 255.255.0.0" ' doesnt work .. :/
08:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:18 <@dazo> phaidros: does your clients have --pull ?
08:19 < phaidros> dazo: irk, should they?
08:19 < phaidros> I thought "client" will pull automatoivallly ...
08:19 <@dazo> well, if you use --client, it's implicit ... but of no --client or no --pull ... clients won't ask the server to push
08:20 <@dazo> EugenMayer: it's not really different
08:21 < phaidros> dazo, client is set, but not getting routes though ..
08:21 <@dazo> phaidros: use --verb 4 on client and pastebin logs
08:21 <@dazo> !logs
08:21 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:21 <@dazo> !pastebin
08:21 <@vpnHelper> Miscellany || Untitled || Someone || end3r || OS X keychain patch
08:21 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
08:21 <@dazo> !paste
08:21 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
08:24 < phaidros> dazo: http://pastie.org/1998116 it seems the client doesnt get anything offered ..
08:25 <@dazo> Tue May 31 15:23:11 2011 us=737499 PUSH: Received control message: 'PUSH_REPLY,route 10.23.0.0 255.255.0.0 dev tap0,ping 8,ping-restart 30,ifconfig 10.22.9.4 255.255.0.0'
08:25 <@dazo> server pushes
08:26 <@dazo> route 10.23.0.0 255.255.0.0 dev tap0
08:26 <@dazo> that's what you want, right?
08:27 < phaidros> dazo: http://pastie.org/1998126 thats what the sever says regarding it
08:27 < phaidros> dazo: right, thats what I want
08:27 < phaidros> I overlooked it
08:28 <@dazo> so that narrows it down do your client ... is the client running with root privileges?
08:28 <@dazo> (or started with)
08:28 < phaidros> ack
08:28 < phaidros> default debian
08:28 < phaidros> error states something about "dev must be blabla" but tested before without dev ..
08:28 <@dazo> gah!
08:28 < phaidros> so removing that
08:28 <@dazo> Tue May 31 15:23:11 2011 us=737499 Options error: route parameter gateway 'dev' must be a valid address
08:28 <@dazo> yeah, dev cannot be used in --route
08:29 <@dazo> read up in the man page how to do that ... you can use some keywords like vpn_gateway, iirc instead
08:29 < phaidros> dazo: http://pastie.org/1998137 thats the final error on client sde
08:29 < phaidros> side
08:29 < phaidros> ah
08:30 < phaidros> I thought push "route 10.23.0.0 255.255.0.0"
08:30 < phaidros> would set it to the vpn device
08:30 <@dazo> just read up on --route in the man page, and you'll figure it out ... it's almost correct now :)
08:30 -!- dxtr [~dexter@unaffiliated/dxtr] has quit [Quit: WeeChat 0.3.5]
08:30 < phaidros> wrong?
08:30 < phaidros> hm, so it must be a valid route add blabla command?
08:30 <@dazo> nope, 
08:30 <@dazo> read the man page
08:30 <@dazo> !man
08:30 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
08:30 < phaidros> I could push something like "ip r a 10.23.0.0/24 dev tap0" ?
08:31 <@dazo> nope
08:31 < phaidros> hm, would have been to neat :)
08:31 <@dazo> you need to read the --route statement
08:31 < phaidros> will do, thanx dazo !
08:31 <@dazo> no, that would not be neat ... that would be just as clever as doing --push "dd if=/dev/zero of=/dev/sda"
08:32 <@dazo> in other words, a major security issue :)
08:33 <@dazo> phaidros: also look at this error message:
08:33 <@dazo> Tue May 31 15:30:18 2011 us=560174 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
08:34 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:35 < phaidros> hm, just too easy :)
08:35 < EugenMayer> dazo: well "not really different" is kind of not the answer :)
08:35 < phaidros> push "10.23.0.0 255.255.0.0 10.22.8.1" 
08:35 < phaidros> is it possible to push the vpn device as gw ?
08:35 <@dazo> phaidros: yes
08:36 < phaidros> hm, dindt find that one yet :)
08:36 <@dazo> EugenMayer: the only difference is that a road warrior and a site-to-site, is that both openvpn sides acts as routers, while openvpn in roadwarrior-to-size only the server side acts as a router
08:37 <@dazo> phaidros: but!  you're overlooking two things .... --route-gateway and the keywords you can push
08:37 <@dazo> phaidros: sorry, not device ... only IPs
08:37 < phaidros> ok,then I am done and all is fine :)
08:37 < phaidros> thanx a bunch dazo !
08:37 <@dazo> you're welcome!
08:37 < phaidros> though, device would be nice :)
08:38 <@dazo> phaidros: yeah, I believe there is a patch in the works, but not for pushing devices, but adding 'dev' to the route commands when appropriate
08:39 < phaidros> kewl
08:40 < EugenMayer> dazo: wait, not sure what you mean with "routers". Is a "router" in your terms a server?
08:40 < EugenMayer> dazo: so in a site-to-site, siteA can connect to siteB and in case, siteB to siteA?
08:41 <@dazo> EugenMayer: a router is a device/computer/server/openvpn client which routes network traffic
08:41 <@dazo> EugenMayer: yes, in a site-to-site, that's kind of the idea ... to be able to route network traffic across the tunnel
08:42 <@dazo> while typically, in a client-to-site, it's usually just the client which accesses the site network ... but the site may access the client as well, if firewalls and routing allows it 
08:43 < EugenMayer> dazo: in my case, we are doing software maintainance
08:43 < EugenMayer> our appliance is deployed to the customer and usually has an interface to directly connect to our VPN Server
08:44 < EugenMayer> in case, the company does not allow this (firewall), the rather want to setup a NAT.
08:44 <@dazo> well, look at the VPN as a secure network cable between the openvpn client and the openvpn server .... whatever you can do over a normal network, you can do via a VPN
08:44 < EugenMayer> That means, their GW connects to our VPN-Network and is NAT into their network ( esp interesing because of IP conflicts )
08:45 < EugenMayer> thats my idea. So i actually cant see a difference betweer s2s and c2s in this scenario, or?
08:45 < EugenMayer> the customer is _not_ allowed to "be" in our network in that case. But i case, its all about our routes in the VPN router
08:45 <@dazo> routes and firewalls
08:46 < EugeneKay> OpenVPN is a helluva drug
08:49 -!- Belial_ [~quassel@128.210.61.130] has joined #openvpn
08:51 < EugenMayer> dazo: in my case, i dont get why the customer GW should also play the server?
08:51 -!- AL13N_work [~alien@91.183.52.232] has joined #openvpn
08:52 <@dazo> not server, the customer gw would run a openvpn client, but it needs to route the traffic correctly
08:56 < phaidros> hm, how do I utilize the update-resolv.conf script?
08:56 < phaidros> as up and down script, right?
09:01 < phaidros> doesnt work hm
09:02 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
09:02 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
09:02 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:04 < phaidros> I wanna push "dhcp-option DNS 10.23.8.1" .. and the clients config has "up /etc/openvpn/update-resolv-conf" but the /etc/resolv.conf doesnt get the nameserver added
09:06 -!- Lenhix [ElChaman@190.146.247.20] has joined #openvpn
09:08 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 248 seconds]
09:08 <@dazo> !push-dns
09:09 <@dazo> !pushdns
09:09 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
09:09 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
09:09 <@dazo> phaidros: there is some neat wiki/blog articles if you google openvpn update-resolv.conf
09:10 < phaidros> dazo: seen, and had it working yesterday, just cant remember which testing machine (vm) it was and cant get my head around what might be missing there atm :)
09:16 -!- newmember [~newmember@d216-232-100-14.bchsia.telus.net] has quit [Ping timeout: 276 seconds]
09:19 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 260 seconds]
09:20 < phaidros> Bhm, script-security 2 is set, I see the pushed DNS in the 'control message' part of the log, but actually the nameserver doesnt get set
09:28 < phaidros> does /etc/resolv.conf necessarrily need to be a symlink?
09:29 < EugenMayer> dazo: but thats simply "NAT" and can be done with c2s the same way..
09:29 < phaidros> okay, the update-rosolv-conf script should work with the example from inside the script as this: foreign_option_1='dhcp-option DNS 193.43.27.132' ./update-resolv-conf 
09:29 < phaidros> right?
09:29 < EugenMayer> dazo: or ist that kind of "NAT" integrated into Software-Appliance solutions of commercial VPN-GW?
09:30 < phaidros> actually it doesnt update /etc/resolv.conf with that call above .. do I miss something?
09:30 < EugenMayer> phaidros: be sure to know the problematics arrousn "allow scripting"
09:31 < EugenMayer> with *nix system
09:31 < phaidros> EugenMayer: script-security 2 is set
09:31 < phaidros> the update-resolv-conf script itself seems not to do anything o.O
09:31 < EugenMayer> what OS?
09:31 < EugenMayer> yes
09:31 < EugenMayer> because it depends on "resolvconf"
09:31 < phaidros> linux, debian squeeze and ubuntu natty as testing machings
09:31 < EugenMayer> which you most probably did not install...
09:31 < EugenMayer> apt-get install resolvconf
09:31 < phaidros> resolvconf is installed at least in the debian box
09:32 < EugenMayer> its 100% working with those distros
09:32 < EugenMayer> iam using both
09:32 < Bushmills> phaidros: add something like   touch /tmp/foo   too script, see whether it gets executed.  set environment variable manually, execute update resolv script manually, see whether resolv.conf gets updated
09:32 < Bushmills> draw conclusions, and follow lead
09:32 < phaidros> okay, with installing resolvconf on the ubuntu machine it works :)
09:33 < phaidros> but takes the nameserver as the only one, wanted to keep the original as well :/
09:33 < phaidros> now debugging the debian side of things ..
09:33 < EugenMayer> what a supsire
09:33 < EugenMayer> be sure you understand DNS either
09:33 < EugenMayer> DNS is not hierchical on the client. Period
09:34 < EugenMayer> WE all hat this, but it is that way
09:34 < phaidros> grml
09:34 < phaidros> ;)
09:35 < Bushmills> check out dnsmasq
09:35 < phaidros> so, my vpn dns server should kow the rest of the worls as well ..
09:35 < phaidros> running tinydns
09:35 < phaidros> at least its not bind :D
09:35 < EugenMayer> Bushmills: which is basically a DNS-Server on the client :)
09:35 < phaidros> hm, dnsmasq on the clients is a thing I think about since a while ..
09:35 < Bushmills> right. allowing multiple upstream recursive server, selected by domain a queried host is in
09:36 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
09:36 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
09:36 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
09:36 < EugenMayer> But yes, dnsmasq is a cool solution for this, if you have clients which all have installed it :)
09:36 < phaidros> *if* :p
09:36 < EugenMayer> that "IF" is the holy issue in this. 
09:36 < EugenMayer> Thats why dnsmasq is not a real workarround
09:36 < EugenMayer> Rather a partial fix for a very specific scenario
09:37 < phaidros> yeha, my tinydns as lonely nameserver for the clients works, but will get sh**loads of requests .. well then
09:37 < EugenMayer> yes..welcome to the club.
09:38 < EugenMayer> And you finally will end up with "/etc/hosts"
09:38 < EugenMayer> as that one is hierarchical :D
09:38 < phaidros> oh nooooooooooooooooooooooooooo
09:38 < EugenMayer> DNS is a mess.
09:38 < phaidros> broken by design as djb sez
09:38 < EugenMayer> Its never ment to work in the current world, its far to outdated.
09:41 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
09:42 < Bushmills> ping 134744072
09:42 < Bushmills> who needs dns :)
09:43 < EugenMayer> hehe :D
09:43 < Bushmills> or,   ping $((36#28816w))
09:43 < EugenMayer> Bushmills: ipv6 is comming :D
09:43 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
09:43 < phaidros> EugenMayer: not getting better with DNS this ipv6 stuff :D
09:44 < EugenMayer> oh yeah
09:46 < ecrist> what do you mean?
09:46 < EugeneKay> DNSSEC makes me cry
09:46 < ecrist> http://[face:b00c::]
09:46 < ecrist> :D
09:46 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 260 seconds]
09:46 < EugeneKay> .....lol
09:46 < EugenMayer> EugeneKay: yeah a another broken protocol :D
09:46 < EugeneKay> EugenMayer - I know better than most how broken it is. :-p
09:47 < EugenMayer> iam not :D
09:52 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
09:54 -!- images [~images@static.238.229.4.46.clients.your-server.de] has joined #openvpn
10:10 <@vpnHelper> RSS Update - forum: Site to Site VPN, Client not getting IP from VPN Subnet <http://forums.openvpn.net/topic8226.html#p12660> || Annoying warning <http://forums.openvpn.net/topic8242.html#p12659>
10:16 <@vpnHelper> RSS Update - forum: Site to Site VPN, Client not getting IP from VPN Subnet <http://forums.openvpn.net/topic8226.html#p12661>
10:17 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Read error: Connection reset by peer]
10:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:28 -!- morbidwar [~ovidiu@81.196.150.82] has quit [Read error: Connection reset by peer]
10:34 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
10:35 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
10:36 < orudie> how can I add a new client ? haven't done this in a while 
10:37 < orudie> ./vars then ./build-key client ?
10:37 < orudie> or ./vars ./clean-all ./build-key client ?
10:38 < orudie> i'm hesitant to do ./clean-all because i think it will delete everything 
10:38 < orudie> and the client key will not work with an existing ca key 
10:39 -!- ferar [~ferar@64.254.252.178] has joined #openvpn
10:40 < orudie> any help please ?
10:41 < ecrist> orudie: the same way you added the first client...
10:42 < ecrist> don't do clean-all
10:42 < ecrist> that will remove everything, as the name suggests.
10:42 < dvl> orudie: keep backups.  :)
10:45 < orudie> ecrist, well
10:45 < orudie> well 
10:46 < orudie> http://paste.linode.com/5393
10:46 < orudie> I believe all I did was ./build-key clientname 
10:49 < orudie> what am I doing wrong here ?
10:50 < ferar> had the following questions " exclude specific ip addresses from being routed through the vpn tunnel?" and someone suggested split traffic but not sure what he/she meant !
10:50 < ferar> our case is as following, we are connecting via PPP to ISP with specific gateway, then launch openvpn and connect to our openvpn server using the establised ppp connection, we want to redirect all incoming/outgoing traffic through the vpn tunnel 'tun0' except for the following external IP addresses 66.AAA.AAA.AAA and 38.BBB.BBB.BBB, were we want all traffic to go through ppp0 directly and not through the tun0.
10:51 < ferar> is there any docs/references to read?
10:53 -!- DarthGandalf [somebody@shellium/developer/darthgandalf] has joined #openvpn
10:54 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 276 seconds]
10:55 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
10:56 -!- Belial_ [~quassel@128.210.61.130] has quit [Remote host closed the connection]
10:56 <@vpnHelper> RSS Update - forum: Site to Site VPN, Client not getting IP from VPN Subnet <http://forums.openvpn.net/topic8226.html#p12662>
10:57 < orudie> any hints for me please ?
10:58 < Bushmills> ferar: where should traffic to 66.x.x.x and 38.x.x.x go?
10:58 < orudie> I can't find any documentation on how to "./build-key clientname" later after the initial server / client install 
10:58 < orudie> without having to do ./clean-all 
10:59 < Bushmills> orudie:  ./vars is no good
11:00 < orudie> Bushmills, you mean vars file ?
11:00 < ferar> Bushmills: what you mean? all incoming/outgoing traffic from client to those two IPs should be directly through ppp0 not tunneled 
11:01 < Bushmills> ferar:  executing ./vars will result in the environment variables added by vars being discarded immediately on script exit again
11:01 -!- DennisG [~Dennis@52494E8A.cm-4-2b.dynamic.ziggo.nl] has joined #openvpn
11:02 < DennisG> hello - for internetting over my vpn i'm using this on linux: iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -o eth0 -j MASQUERADE. I dont want my traffic to go over eth0, but over eth0:0 (other ip due security) so i tried iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -o eth0:0 -j MASQUERADE but that isnt working. Why?
11:02 < orudie> how can I add a client client key ?
11:03 < ferar> Bushmills: newbie, did not get your last statement
11:04 < Bushmills> ferar: try it.   create a script, which does  foo=bar.   call it maybe "myscript".  execute it with   ./myscript.  then look at contents of $foo 
11:05 < Bushmills> ehm.. i think i mixed you two up
11:06 < Bushmills> ./vars goes to orudie
11:07 < Bushmills> ferar, so create routes for 66.x.x.x and 38.x.x.x to gateway through ppp, and the (non-local) rest through default which redirects through openvpn (except host route to openvpn server)
11:08 < Bushmills> you exclude traffic from getting sent through default gateway by having alternative routes
11:08 < ferar> Bushmills: thanks, let me try that
11:10 < orudie> Bushmills, I understand, but what is it that I'm doing wrong ? Why doesn't ./build-key client doesn't work for me ? please help 
11:10 -!- K1ng` [~KING@180.211.188.19] has joined #openvpn
11:10 < Bushmills> orudie: because the environment variables, needed by build-key and usually provided by vars aren't present  
11:11 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has joined #openvpn
11:11 < orudie> Bushmills, how can I make them present ?
11:12 < Bushmills> by calling vars such that the environment isn't immediately discarded again
11:12 < orudie> Bushmills, is there a documentation available on how to add a new client later ?
11:12 -!- bauruine [~stefan@cable-dynamic-87-245-124-161.shinternet.ch] has quit [Ping timeout: 248 seconds]
11:12 < Bushmills> no idea. i suppose so
11:13 -!- sj7trunks [~Adium@171.67.162.10] has joined #openvpn
11:13 -!- k1ng [~KING@180.211.188.207] has quit [Ping timeout: 260 seconds]
11:15 -!- newmember [~newmember@216.81.49.14.epikip.net] has joined #openvpn
11:17 -!- bauruine [~stefan@217.150.231.206] has joined #openvpn
11:19 <@vpnHelper> RSS Update - forum: Adding a new client key without having to ./cliean-all <http://forums.openvpn.net/topic8243.html>
11:24 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 248 seconds]
11:47 -!- SWAT [~swat@ubuntu/member/swat] has joined #openvpn
11:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:48 < SWAT> is openvpn available for android? I saw a funky looking openvpn app in het market, but the comments are not very positive
11:49 < orudie> this is so frustrating, why is it so difficult to add a new client key ? 
11:50 < orudie> and i cannot find any supporting documentation on how to do this 
11:50 < SWAT> orudie: you mean generating a client cert/key?
11:50 < orudie> SWAT, yes 
11:51 < SWAT> just use the build-key script and you're doine
11:51 < orudie> SWAT, when I ran it here is what I got http://paste.linode.com/5393
11:51 < Bushmills> http://lmgtfy.com/?q=easy%20rsa%20openvpn%20create%20client%20key
11:51 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
11:52 < Bushmills> my earlier comments on missing environment variables is still true
11:52 < SWAT> orudie: read what the script tells you and follow the directions
11:53 < SWAT> Bushmills: hu-ha :)
11:53 < orudie> Bushmills, which variables ?
11:53 < Bushmills> those which you have set in the vars script
11:54 < orudie> I looked at the vars script, I have no idea what I have to change there 
11:55 < orudie> the error message that i'm getting is not saying what exactly wrong with the vars script, it is telling me to do clean-all 
11:55 < Bushmills> it is also telling you how to set those variables 
11:57 < orudie> source ./vars seems to work 
11:58 < Bushmills> really?
11:58  * Bushmills wonders how orudie figured that out
11:58 < orudie> :)
11:59 < orudie> dude I haven't done this in a long time, and I don't remember using "source ./vars"
11:59 < SWAT> now just do not _ever_ forget it
12:00 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has quit [Read error: Operation timed out]
12:00 < Bushmills> right. remembering that makes reading the output of create-key unnecessary
12:01 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
12:05 <@vpnHelper> RSS Update - forum: Adding a new client key without having to ./cliean-all <http://forums.openvpn.net/topic8243.html#p12664>
12:05  * orudie wrote down in his notebook 
12:13 -!- bauruine [~stefan@217.150.231.206] has quit [Ping timeout: 248 seconds]
12:15 -!- bauruine [~stefan@217.150.231.206] has joined #openvpn
12:16 -!- phaidros [~phaidros@ghostshell.subsignal.org] has left #openvpn []
12:21 -!- bauruine [~stefan@217.150.231.206] has quit [Ping timeout: 248 seconds]
12:26 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:30 -!- bauruine [~stefan@217.150.231.206] has joined #openvpn
12:33 -!- darkdrgn2k [~darkdrgn2@204.101.63.212] has quit [Quit: Leaving]
12:37 -!- bauruine [~stefan@217.150.231.206] has quit [Ping timeout: 248 seconds]
12:48 -!- dazo is now known as dazo_afk
12:59 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 248 seconds]
13:01 -!- ferar [~ferar@64.254.252.178] has quit [Ping timeout: 248 seconds]
13:01 -!- nebajoth [~nebajoth@starfighter.org] has joined #openvpn
13:01 < nebajoth> hello
13:01 -!- ferar [~ferar@64.254.252.178] has joined #openvpn
13:01 < nebajoth> I cloned a cloud server (rackspace hosted) and configured the second host for an openvpn setup
13:01 < nebajoth> it keeps stealing the IP address of the host it was cloned from
13:02 < nebajoth> I assume this has to do with the previously generated SSL certs
13:02 < nebajoth> confirmation?
13:02 < ecrist> nope
13:03 < ecrist> ssl certs don't care about IPs and such.
13:03 < nebajoth> hmm
13:03 < nebajoth> what else could it be?
13:03 < nebajoth> it shows the correct IP in ifconfig
13:03 < nebajoth> on both hosts
13:03 < nebajoth> something cached on the openvpn server?
13:07 < nebajoth> the cloned one always steals the IP
13:07 < nebajoth> ssh will land me in the cloned machine, instead of the original
13:07 < nebajoth> when I shut down openvpn on the cloned machine
13:07 < EugeneKay> nebajoth - you need to change the MACs
13:07 < nebajoth> it works fine to the original
13:07 < nebajoth> the MACs are different already
13:07 < nebajoth> on eth0, and on tap0
13:07 < nebajoth> first thing I checked
13:07 < EugeneKay> Have you rebooted since you cloned?
13:08 < nebajoth> I think so
13:08 < nebajoth> but I'll try again to be sure
13:08 < EugeneKay> Usually when cloning a VM you'll get a new MAC, and the next boot eth0 will change into eth1 with the new MAC
13:08 < nebajoth> well, they have completely unique MACs
13:08 < EugeneKay> That's what it claims, but clearly something is buggered. :-p
13:09 < nebajoth> :P
13:09 < nebajoth> sending for reboot now
13:09 < EugeneKay> "Reality has the odd habit of flying directly in the face of theory."
13:09 < nebajoth> who said that?
13:09 < EugeneKay> Stolen from anonymous
13:09 < nebajoth> :P
13:09 < nebajoth> not stolen then
13:12 < nebajoth> so far so good
13:12 < nebajoth> came back up, are on the proper IPs
13:12 < nebajoth> thx :P
13:12 < nebajoth> (have you tried turning it off and on again?)
13:14 -!- bauruine [~stefan@217.150.231.206] has joined #openvpn
13:17 -!- DennisG [~Dennis@52494E8A.cm-4-2b.dynamic.ziggo.nl] has quit []
13:17 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
13:18 -!- ferar [~ferar@64.254.252.178] has quit [Ping timeout: 260 seconds]
13:18 -!- ferar [~ferar@64.254.252.178] has joined #openvpn
13:20 -!- luneff [~yury@84.51.197.177] has joined #openvpn
13:22 -!- EugenMayer [~eugen@frbg-4d02948a.pool.mediaWays.net] has quit [Remote host closed the connection]
13:22 < EugeneKay> The Windows Fix solves more problems than you might think
13:24 < hyper_ch> the fix for windows is to change to *nix
13:25 < dkr> http://xkcd.com/806/
13:25 <@vpnHelper> Title: xkcd: Tech Support (at xkcd.com)
13:25 < dkr> sorry, has to be mentioned when folks told to restart. :)
13:26 < EugeneKay> Ya can't argue with results
13:26 < EugeneKay> Well, you can, but that looks a bit daft.
13:28 < nebajoth> lol
13:28 < nebajoth> shibboleet
13:29 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
13:37 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 276 seconds]
13:45 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
13:49 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Remote host closed the connection]
13:50 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
13:52 -!- ferar [~ferar@64.254.252.178] has quit [Ping timeout: 240 seconds]
13:57 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 276 seconds]
13:59 -!- ferar [~ferar@64.254.252.178] has joined #openvpn
14:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
14:05 -!- ferar [~ferar@64.254.252.178] has quit [Quit: Leaving]
14:05 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
14:07 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
14:10 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Remote host closed the connection]
14:11 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
14:11 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
14:26 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 240 seconds]
14:30 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
14:33 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Remote host closed the connection]
14:34 -!- Kartagis [sbnc@kunduz.org] has joined #openvpn
14:34 -!- Kartagis [sbnc@kunduz.org] has quit [Changing host]
14:34 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
14:48 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has quit [Ping timeout: 276 seconds]
14:52 -!- dazo_afk is now known as dazo
15:07 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12665>
15:16 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
15:19 -!- Flops [~Flops@p5B0653C7.dip.t-dialin.net] has joined #openvpn
15:19 < Flops> hi
15:19 < Flops> !redirect
15:19 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
15:19 < Flops> !nat
15:19 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:20 < Flops> !linnat
15:20 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
15:20 < Flops> !openvzlinnat
15:20 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
15:20 < Flops> what is the container ip?
15:20 < Flops> !ipforward
15:20 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:21 < Flops> ! linipforward
15:21 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:24 < Flops> I can not do nat on my server
15:24 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 250 seconds]
15:25 < Flops> someone here gave me a command to achieve it without nat but I forgot it :(
15:25 < Flops> any ideas?
15:27 < krzee> !linnat
15:27 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
15:28 < Flops> krzee: I know that…
15:29 < Flops> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
15:29 < Flops> iptables: No chain/target/match by that name.
15:29 < krzee> right....
15:32 < krzee> !openvzlinnat
15:32 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
15:34 < krzee> i saw you didnt know what a container is
15:34 < krzee> see if this helps
15:34 < krzee> http://www.google.com/search?q=openvz+container
15:34 <@vpnHelper> Title: openvz container - Google Search (at www.google.com)
15:40 -!- Flops [~Flops@p5B0653C7.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
15:40 -!- Flops [~Flops@p5B0653C7.dip.t-dialin.net] has joined #openvpn
15:40 < Flops> now something with my dns is wrong :)
15:41 < krzee> !pushdns
15:41 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
15:41 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
15:41 < krzee> !dns
15:41 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
15:42 < Flops> !pushdns
15:42 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
15:42 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
15:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:45 -!- ph1l [~ph1l@gprs33.swisscom-mobile.ch] has joined #openvpn
15:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:51 -!- Flops [~Flops@p5B0653C7.dip.t-dialin.net] has quit [Quit: Flops]
15:56 -!- ph1l [~ph1l@gprs33.swisscom-mobile.ch] has quit [Quit: Leaving.]
15:58 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:04 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Quit: бэм бэм бэм бэм бэм бэм бэм бля !]
16:06 -!- bauruine [~stefan@217.150.231.206] has quit [Ping timeout: 248 seconds]
16:08 -!- jaminja [~jaminja@212.7.195.193] has quit [Read error: Operation timed out]
16:10 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
16:19 -!- bauruine [~stefan@217.150.231.206] has joined #openvpn
16:41 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 260 seconds]
16:42 -!- kunago [~Miris@213-194-242-126-eth3-gwbar-user.802.cz] has joined #openvpn
16:45 < kunago> Hi. Does anyone have experience with pushing a VLAN? I have 4 LANs connected together. On one LAN (172.17.2.0/24) I have a router (172.17.2.3) that is an openvpn client at the same time allowing all the clients behind to communicate on my VPN. On this LAN I created a VLAN (172.17.21.0/24). How can I push it to all the other LANs? Here is a picture describing the situation - http://imageshack.us/f/844/schema2e.png/
16:45 <@vpnHelper> Title: ImageShack - Online Photo and Video Hosting (at imageshack.us)
16:50 < krzee> do you need special vlan tagging for it to work?
16:51 < kunago> krzee: No, the vlan works fine on its own if that's what you mean.
16:51 -!- sj7trunks [~Adium@171.67.162.10] has quit [Quit: Leaving.]
16:52 < krzee> !route
16:52 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:55 < kunago> I tried "route" but for some reason it does not do what I expect. I assume I also need to specify the gateway for the route which is a vpn client at the same time. In the picture, 172.17.2.3 is a router and client (route 172.17.2.0 255.255.255.0) and the vlan has the router identical (172.17.21.3). Since I am already routing the 172.17.2.0 LAN, I guess the route should be "route 172.17.21.0 255.255.255.0 172.17.2.3". Is that it?
16:58 < kunago> Also, can I put two "iroute" declarations in one CCD file? I am asking because my VPN client is the same one having, however, 2 IPs (172.17.2.3 and 172.17.21.3)
17:00 < krzee> yes, 2 or more iroutes may exist in a ccd
17:01 < krzee> and no, you shouldnt need a special gateway option to route
17:01 < krzee> and in my writeup there is no 172.17.2.3
17:01 < krzee> so i dunno what you're talking about
17:02 < krzee> ohhh your picture
17:02 < krzee> lemme look
17:02 < krzee> your drawing doesnt make much sense
17:03 < krzee> a bunch of subnets, no explanation of what they are
17:03 < krzee> is the vpn subnet 172.17.21.x?
17:03 < krzee> is it the vlan?
17:03 < kunago> No, vpn is 172.17.10.x; the vlan subnet is 172.17.21.x
17:04 < krzee> the only thing not working is 172.17.21.x?
17:04 < krzee> is 172.17.21.4 a switch or a router?
17:04 -!- images [~images@static.238.229.4.46.clients.your-server.de] has quit [Quit: Bye!]
17:05 < kunago> 172.17.21.4 is a switch behind the vpn client/router
17:05 < krzee> and the cpn client runs on the router?
17:05 < krzee> vpn*
17:05 < kunago> Yes
17:05 < krzee> so do like !route says
17:05 < krzee> give the client another ccd entry
17:06 < krzee> give the server another route / push route
17:06 < krzee> if you dont need some sort of vlan tagging to get in, that will be fine
17:06 < krzee> (assuming your firewall on your router allows it)
17:06 -!- dym [~patrick@netsplit.me] has joined #openvpn
17:07 < krzee> route 172.17.21.0 255.255.255.0
17:07 < krzee> push "route 172.17.21.0 255.255.255.0"
17:07 < krzee> and in the ccd for that router
17:07 < krzee> iroute 172.17.21.0 255.255.255.0
17:07 < dym> I got a question: "Which 'non port-based' protocol is used by PPTP-VPN?"
17:07 -!- Ejan [~Ejan@112.201.195.113] has joined #openvpn
17:07 < krzee> dym, wrong channel
17:07 < krzee> !pptp
17:07 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read about
17:07 <@vpnHelper> why to not use pptp
17:07 < kunago> krzee: Thanks, will post whether it worked.
17:08 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
17:08 < krzee> look somewhere within that page maybe dym
17:08 < Ejan> ` i wanna ask about developing an openvpn gui..
17:08 < krzee> Ejan, you are a dev?
17:08 < Ejan> ` i want to develop an openvpn gui using .net
17:08 < krzee> Ejan, ill help any i can in here, please also join #openvpn-devel
17:09 < krzee> the main help i can give here is:
17:09 < krzee> !management
17:09 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface, or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
17:09 < Ejan> ` ow thanks..
17:09 < krzee> a main thing you'll want is to check out git
17:09 < Ejan> ` ok.. thanks..
17:09 < krzee> that way you can see what exists now, and add/change it as you like, and submit back changes via git
17:09 < dym> krzee: odd. The protocol ought to be IP, right?
17:10 < krzee> dym, wrong channel
17:10 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
17:10 < dym> what channel would that be?
17:10 < krzee> dunno, maybe one related to pptp
17:10 < dym> :D
17:10 < dym> thanks anyways
17:10 -!- dym [~patrick@netsplit.me] has left #openvpn []
17:13 < Ejan> ` do i need to follow the management interface notes?
17:13 < krzee> you definitely wanna read them
17:13 < krzee> management interface is how you control openvpn from a program
17:14 < krzee> (or manually, but was made for programs)
17:14 < Ejan> ` ahhh.. maybe this will help a lot..
17:14 < krzee> yes, it should
17:14 < krzee> anyone wishing to control openvpn from a program will want that
17:15 < krzee> !git
17:15 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git, or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git,, or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi, or (#4) See !git-doc how to use git
17:15 < krzee> note, instead of making your own gui, maybe you wanna work on the existing one
17:15 < krzee> we have dev meetings every thursday as defined at https://community.openvpn.net
17:15 <@vpnHelper> Title: OpenVPN Community (at community.openvpn.net)
17:16 < Ejan> ` actually i already something..
17:16 < Ejan> but i think the links will help me development it further..
17:17 < Ejan> :D
17:17 < krzee> gunna join the dev chan?
17:17 < krzee> they can help a lot
17:17 < Ejan> ` im already there.. maybe i'll try to chat later..
17:17 < Ejan> :D
17:19 < krzee> http://thisguyhasmymacbook.tumblr.com/
17:19 <@vpnHelper> Title: This Guy Has My MacBook (at thisguyhasmymacbook.tumblr.com)
17:19 < krzee> lol
17:23 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
17:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:27 -!- Ejan [~Ejan@112.201.195.113] has left #openvpn []
17:29 -!- Ejan [~Ejan@112.201.195.113] has joined #openvpn
17:31 -!- kunago [~Miris@213-194-242-126-eth3-gwbar-user.802.cz] has quit [Read error: Connection reset by peer]
17:31 -!- kunago [~Miris@213-194-242-126-eth3-gwbar-user.802.cz] has joined #openvpn
17:36 -!- kunago1 [~Miris@213-194-242-126-eth3-gwbar-user.802.cz] has joined #openvpn
17:37 -!- kunago [~Miris@213-194-242-126-eth3-gwbar-user.802.cz] has quit [Ping timeout: 240 seconds]
17:43 -!- kunago1 [~Miris@213-194-242-126-eth3-gwbar-user.802.cz] has quit [Read error: Connection reset by peer]
17:53 -!- jaminja [~jaminja@212.7.195.193] has quit [Changing host]
17:53 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
18:00 -!- dazo is now known as dazo_afk
18:02 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Read error: Connection reset by peer]
18:03 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Ping timeout: 248 seconds]
18:03 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 248 seconds]
18:03 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 248 seconds]
18:03 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 248 seconds]
18:03 -!- equinox [~equinox@spaceboyz.net] has quit [Ping timeout: 248 seconds]
18:04 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
18:04 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
18:04 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
18:04 -!- equinox [~equinox@spaceboyz.net] has joined #openvpn
18:05 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
18:06 -!- Champi [Champi@rootshell.fr] has joined #openvpn
18:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
18:08 < EugeneKay> It's been done. http://www.youtube.com/watch?v=U4oB28ksiIo
18:09 <@vpnHelper> Title: YouTube - Defcon 18 Pwned By the owner What happens when you steal a hackers computer zoz part (at www.youtube.com)
18:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:30 -!- Lenhix [ElChaman@190.146.247.20] has quit [Quit: Mindwall!!]
18:51 -!- master_of_master [~master_of@p57B55924.dip.t-dialin.net] has quit [Read error: Operation timed out]
18:52 -!- raidz_ [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
18:53 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 276 seconds]
18:54 -!- chantra_1fk [~chantra@ns38827.ovh.net] has quit [Ping timeout: 276 seconds]
18:54 -!- chantra_afk [~chantra@unaffiliated/chantra] has joined #openvpn
18:55 -!- master_of_master [~master_of@p57B55924.dip.t-dialin.net] has joined #openvpn
18:56 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 260 seconds]
19:05 -!- Sky[x] [~SkyB0x@tm.213.143.82.45.dc.telemach.net] has quit [Remote host closed the connection]
19:19 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
20:03 -!- newmember [~newmember@216.81.49.14.epikip.net] has quit [Ping timeout: 260 seconds]
20:11 -!- master_of_master [~master_of@p57B55924.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:13 -!- master_of_master [~master_of@p57B55A07.dip.t-dialin.net] has joined #openvpn
20:15 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
20:15 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
20:31 < Proz0id> anyone know how to performance test openvpn??
20:34 -!- harlan [~harlan@ntp/programmemanager/harlan] has joined #openvpn
20:35 -!- Ejan [~Ejan@112.201.195.113] has left #openvpn []
20:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:42 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
20:47 < WebDawg> fuck
20:52 < WebDawg> where is my life.
21:05 < krzee> Proz0id, like youd performance test anything else
21:05 < krzee> WebDawg, thats a tough one for us to answer, got an openvpn question instead?  ;]
21:46 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
21:46 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
21:46 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
21:46 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Client Quit]
21:50 -!- tty234 [telex@gateway/shell/anapnea.net/x-agbrazovrjzyksnw] has quit [Remote host closed the connection]
21:57  * ecrist activates belligerence
22:07 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
22:22  * EugeneKay activates pillow cannon
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:58 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:58 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:07 -!- newmember [~newmember@d216-232-100-14.bchsia.telus.net] has joined #openvpn
23:21 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
23:34 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 276 seconds]
23:34 -!- Clete2_ [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
23:55 -!- harlan [~harlan@ntp/programmemanager/harlan] has left #openvpn []
--- Day changed Wed Jun 01 2011
00:01 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:50 -!- morbidwar [~ovidiu@81.196.150.82] has joined #openvpn
01:11 < SWAT> I wish there would be an official openvpn build voor Android. Is this on the roadmap?
01:15 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
01:21 < krzie> well
01:21 < krzie> we're going to try to contact them soon
01:21 -!- zu [~zu@ks355000.kimsufi.com] has quit [Read error: Operation timed out]
01:21 < krzie> it would be possible for them to support openvpn out of the box
01:21 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
01:22 < krzie> but without them on board, it is impossible to run openvpn without rooting your device
01:22 < krzie> if you happen to use cyanogenmod rom then its built into the interface
01:22 < krzie> in that rom you just add it like any other vpn
01:25 < krzie> !topology
01:25 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1 with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
01:26 < krzie> !forget topology
01:26 <@vpnHelper> Error: 2 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
01:26 < krzie> !forget topology *
01:26 <@vpnHelper> Joo got it.
01:26 < krzie> !learn topology as is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions.
01:26 <@vpnHelper> Joo got it.
01:26 <@vpnHelper> RSS Update - forum: Site to Site VPN, Client not getting IP from VPN Subnet <http://forums.openvpn.net/topic8226.html#p12666>
01:26 < krzie> !learn topology as this results in clients getting addresses .2 .3 .4 .5 etc
01:26 <@vpnHelper> Joo got it.
01:33 < Kartagis> is vpnHelper supybot?
01:33 < krzie> yep
01:34 < krzie> !version
01:34 <@vpnHelper> The current (running) version of this Supybot is 0.83.4.1.  I couldn't fetch the newest version from the Supybot website.
01:35 < Kartagis> did you fiddle with the source? because mine says <factoid> could be <something> while yours says "is"
01:52 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
01:52 -!- mode/#openvpn [+o mattock] by ChanServ
01:56 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
02:01 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 260 seconds]
02:07 -!- Webhostbudd [~Webhostbu@70.15.23.249.res-cmts.sm.ptd.net] has joined #openvpn
02:08 < Webhostbudd> would anyone mind explaining to me the difference between p2p and server/client modes in openvpn. Does p2p actually allow clients to route encrypted traffic between each other?
02:08 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
02:22 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
02:23 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
02:23 -!- Cain` is now known as Cain
02:35 < krzie> p2p has no clients
02:36 < krzie> p2p mode is simply 2 endpoints
02:36 < krzie> server/client has a server, with multiple clients
02:42 <@vpnHelper> RSS Update - forum: Site to Site VPN, Client not getting IP from VPN Subnet <http://forums.openvpn.net/topic8226.html#p12667>
02:42 < defswork> bah
02:43 < defswork> IT dept still asking for examples of existing large scale openvpn deployment to many simultaneous users
02:54 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
02:55 < Webhostbudd> hmm, so there is no way for a mesh style network under openvpn?
02:59 < defswork> Webhostbudd, you can tell openvpn to allow client to client traffic
02:59 <@vpnHelper> RSS Update - forum: new install - unable to obtain session id port=443 <http://forums.openvpn.net/topic8244.html>
03:00 < defswork> Webhostbudd, client-to-client does that
03:01 < Webhostbudd> i understand that, but doesnt that route traffic through the server(gateway) and then to the client?
03:01 < defswork> of course - how else can a client see the other clients ?
03:01 < Webhostbudd> well, thats what im getting at
03:02 < Webhostbudd> which goes back to my original question about a mesh
03:02 < defswork> so all your clients are on public facing IP addresses with traffic allowed back in direct ?
03:02 < Webhostbudd> yes
03:03 < defswork> you are effectively describing many to many vpn - you'd need to run an openvpn instance per client * clients
03:03 < Webhostbudd> uggh
03:10 <@vpnHelper> RSS Update - forum: new install - unable to obtain session id port=443 <http://forums.openvpn.net/topic8244.html#p12669>
03:22 <@vpnHelper> RSS Update - forum: new install - unable to obtain session id port=443 <http://forums.openvpn.net/topic8244.html#p12670>
03:26 -!- Webhostbudd [~Webhostbu@70.15.23.249.res-cmts.sm.ptd.net] has quit [Quit: Bye Bye]
03:37 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
03:37 -!- oc80z [oc80z@blea.ch] has joined #openvpn
03:57 -!- dazo_afk is now known as dazo
03:58 <@vpnHelper> RSS Update - forum: new install - unable to obtain session id port=443 <http://forums.openvpn.net/topic8244.html#p12671>
04:00 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 258 seconds]
04:01 -!- cer_abg [96d60496@gateway/web/freenode/ip.150.214.4.150] has joined #openvpn
04:01 < cer_abg> hi there!
04:02 < cer_abg> i'm having some issues with my openvpn server that I just installed
04:03 <@dazo> !iphone
04:03 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
04:03 <@vpnHelper> iPhone and iPad.
04:04 < cer_abg> server at 192.168.8.188 client at 192.168.4.150, using wireshark I see a lot of packages like this: src192.168.4.150 --> dst192.168.8.188 ICMP Destination unreachable (Port unreachable)
04:04 < cer_abg> any idea?
04:05 < cer_abg> i also see a lot of packages from server to client at UDP 1194, wich is the port i'm using
04:06 < cer_abg> so the comunication it's possible and it isn't a network failure
04:07 < cer_abg> in the server logfile I don't understand at all what's happening: TLS-error: handshake failed, Connection Refused (code=111), and so on
04:08 < cer_abg> but nothing that gives me some light
04:14 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:14 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:14 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:15 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:15 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:23 < Bushmills> cer_abg: you're sure that's not the client log?
04:25 -!- p3rror [~mezgani@41.140.40.83] has joined #openvpn
04:25 < Bushmills> wireshark output suggests that client doesn't have a route to 192.168.8.0 subnet
04:26 <@vpnHelper> RSS Update - forum: Clients with static IP can't reach other clients' subnet <http://forums.openvpn.net/topic8238.html#p12672>
04:26 < cer_abg> Bushmills: the wireshark capture is in the client's side, log is from server
04:27 < cer_abg> I can ping the server from the client
04:28 -!- eliasson is now known as eliasson_
04:28 < cer_abg> !welcome
04:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:29 < eliasson_> !route
04:29 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:30 < cer_abg> i think the tls negotiation is not working as expected
04:31 < cer_abg> !goal
04:31 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:31 < cer_abg> the server I just configured is in a HA cluster, but i think that doesn't matter
04:32 < cer_abg> because atm i'm working with openvpn in vanilla mode, apart from the cluster
04:36 < cer_abg> my server is accepting client certificates signed by 3 differents CA
04:36 < cer_abg> the client is accepting server certificate just signed by 1 CA
04:44 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
04:45 -!- bauruine [~stefan@217.150.231.206] has quit [Ping timeout: 248 seconds]
04:53 -!- bauruine [~stefan@217.150.238.1] has joined #openvpn
05:11 < defswork> cer_abg, connection refused suggests something isnt listening
05:15 < krzie> that or firewall
05:34 -!- bauruine [~stefan@217.150.238.1] has quit [Ping timeout: 248 seconds]
05:43 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has left #openvpn ["leaving..."]
05:45 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
05:48 -!- p3rror [~mezgani@41.140.40.83] has quit [Ping timeout: 250 seconds]
06:00 < cer_abg> i'm getting lines for each new connection in the server log, so it isn't a network-related problem but probably a misconfiguration problem or something
06:00 < cer_abg> defswork: it is listening
06:00 < cer_abg> krzie: the firewall permit that connections, just checked
06:02 < cer_abg> tls negotiation happens in a different tcp/udp port than 1194/udp???
06:02 < defswork> cer_abg, the connetion refused message is in the server's logs ?
06:02 < defswork> cer_abg, so suggests it can't cend data back to the client
06:02 < cer_abg> defswork: yes!
06:03 < cer_abg> it can't send "some" data, but i see in Wireshark that there is comunication throught 1194/udp in both directions
06:03 < defswork> cer_abg, doesnt mean client is accepting it though
06:04 < cer_abg> defswork: excuse me: connection refused is in both logs: client and server
06:05 < defswork> you'll need to paste your client and server configs somewhere
06:05 -!- p3rror [~mezgani@41.248.110.61] has joined #openvpn
06:05 < cer_abg> ok
06:11 < cer_abg> defswork: http://pastebin.com/cLJtvmUm
06:12 -!- p3rror [~mezgani@41.248.110.61] has quit [Ping timeout: 250 seconds]
06:15 < Bushmills> cer_abg: where do you tell server what subnet to use for vpn?
06:19 < cer_abg> Bushmills: i omited all those info in the paste
06:20 < Bushmills> ah. so you're sure the problem is in the lines you pasted, not in the lines you omitted.
06:20 < Bushmills> which lines causes the problem, then?
06:21 < cer_abg> really don't know
06:21 < Bushmills> but you must have a pretty good idea. you needed that idea for the decision which lines to remove, and which lines to keep
06:22 < Bushmills> or did throw a dice for each line ... "may contain error / free of errors"? 
06:22 < cer_abg> http://pastebin.com/HtgtzHvf
06:22 < cer_abg> now full file
06:23 < cer_abg> Bushmills: server/client can't even negotiate TLS, so i thinks we dont get to the private problems yet 
06:23 < cer_abg> private routes*
06:24 -!- p3rror [~mezgani@41.140.168.29] has joined #openvpn
06:27 < Bushmills> seems there is no client route to vpn subnet.  not pushed by server, at least.   the --server macro does that, but as you don't use --server, it is up to you to set up those routes
06:27 < Bushmills> check openvpn manpage for --server
06:30 < defswork> yeah - for starters use the server option and see if it works - if you dont want all the options that server does then pare them down to the specific ones
06:31 < cer_abg> what about this log line: Wed Jun  1 10:35:33 2011 us=786051 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
06:31 < cer_abg> (server log)
06:32 < cer_abg> is related to the --server option?
06:35 < Bushmills> try to comment out  tls-remote server  from client config
06:35 < cer_abg> ok
06:36 < cer_abg> you think that network-manager-vpn-applet uses the /etc/openvpn/client.conf or just the config I write in his own menu?
06:37 < defswork> hopefully they are the same thing
06:38 < cer_abg> still not working
06:38 < Bushmills> ubuntu?
06:39 < cer_abg> yes
06:39 < Bushmills> !ubuntu
06:39 <@vpnHelper> "ubuntu" is dont use network manager!
06:39 < Bushmills> seems to be buggy
06:40 < defswork> shouldnt that be network-manager-openvpn-applet ?
06:40 < cer_abg> ok
06:40 < cer_abg> yes, it is
06:40 < cer_abg> anyway, this is some lines of the server log: http://pastebin.com/KnRhkS1R
06:41 < Bushmills> that's a message more typical for clients. not for server
06:41 < Bushmills> firewalls in place?
06:42 < cer_abg> it is in the server log! 
06:42 < cer_abg> 192.168.4.150 is the client IP
06:42 < Bushmills> "client-instance restarting"
06:42 < Bushmills> server seems to think that it's a client
06:43 < cer_abg> uhm O.o
06:43 < krzie> prolly cause no --server or --mode server
06:43 < krzie> like Bushmills said a bit ago
06:43 < Bushmills> --mode server is present.  --server isn't
06:43 < krzie> oh ok
06:44 < krzie> am i missing more of a log?
06:44 < krzie> i see 3 lines
06:44 < krzie> i should be seeing from start to second connection attempt
06:44 < cer_abg> ok
06:44 < cer_abg> let me paste all the log :)
06:45 < Bushmills> don't know. here's all:  http://scarydevilmonastery.net/openvpn.html
06:45 <@vpnHelper> Title: #openvpn (at scarydevilmonastery.net)
06:46 < krzie> Bushmills, seen any protests around you?
06:46 < Bushmills> starting at at 11:01
06:47 < Bushmills> protests .. hm ..   *thinking*
06:47 < ecrist> protests?
06:47 < krzie> dude europe has been going nuts
06:47 < krzie> lemme grab links
06:47 < Bushmills> yes. there was one protest that the audio level of tv in pub when a soccer match was displayed was too low
06:48 < krzie> https://www.youtube.com/watch?v=nCoF3j_RcHg   heres whats going on in spain
06:48 <@vpnHelper> Title: YouTube - Documental "Indignados" (at www.youtube.com)
06:48 < krzie> its in spanish tho
06:48 < Bushmills> ah, spain.  well, too far to see from here
06:48 < krzie> im grabbing links with a few germany vids
06:48 < krzie> http://roarmag.org/2011/05/spanish-revolution-protests-spread-europe-videos-democracia-real-ya/
06:48 <@vpnHelper> Title: Spanish protests spread across Europe in videos | Reflections on a Revolution ROAR (at roarmag.org)
06:49 < Bushmills> most protests in the streets recently were related to nuclear power stations
06:49 < krzie> hamburg, frankfurt, munich
06:49 < krzie> berlin
06:49 < ecrist> ah
06:49 < krzie> all related the the M15 spain protests
06:50 < krzie> called m15 because they started on may 15th
06:50 < havoc> WTF?
06:50 < krzie> oh if you havnt heard thats cause usa media is basically just blacking it out
06:51 < krzie> (@ havoc / ecrist )
06:51 < Bushmills> nope, none of that. neither on the news nor from the grapevine
06:51 < havoc> krzie: maybe, I wouldn't know anyway, I avoid all but morning local news (weather, traffic)
06:51 < havoc> krzie: I avoid all MSM like the plague
06:51 < krzie> as do i
06:51 < havoc> yet I still hear about more than I really want to know online ;)
06:52 < defswork> it's all made up - spin to further someone's agenda
06:52 < havoc> hahahah, Wisconsin is quoted in their manifesto :)
06:54 < cer_abg> ok
06:54 < havoc> I'm in WI
06:54 < cer_abg> i was avoiding to show my public IPs, but i really don't care, cause all are temporal servers http://pastebin.com/ZLfv4bS7
06:55 < havoc> krzie: anyway, I wish them luck, but don't have high hopes
06:55 < defswork> Wed Jun  1 13:39:28 2011 us=537714 150.214.4.150:56555 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /unstructuredName=http://yo.rediris.es/soy/aborrero@cica.es//CN=Arturo_Borrero_Gonz_xC3_xA1lez/O=cica.es/C=ES  ?
06:55 <@vpnHelper> Title: RedIRIS - PAPOID - OpenID Identity (at yo.rediris.es)
06:55 < krzie> and i hope the people of america wake up one day, but don't have high hopes
06:55 < defswork> your certifcates are bad ?
06:56 < havoc> krzie: same, and same :(
06:56 < defswork> cer_abg, you using self signed certs and your own ca ?
06:57 < krzie> i dont think you should put '/' in your certs
06:58 < cer_abg> ok
06:59 < krzie> !certverify
06:59 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
06:59 < cer_abg> my openvpn server is intended to accept certificates for 3 CA
06:59 < krzie> bbiaf, gunna get breakfast and go to work about 11 hours early... not tired and nothing to do
07:00 < krzie> cer_abg, i gave you that command so you can verify the certs work without using openvpn
07:00 < cer_abg> ok
07:01 < cer_abg> but i'm using a pkcs12 file, shall I convert it to .crt?
07:01 < krzie> doubt it
07:01 < krzie> check the openssl manual if unsure
07:01 < krzie> maybe its a different command, but i know openssl supports pkcs12
07:01 < krzie> (otherwise openvpn wouldnt)
07:01 < cer_abg> yes, openssl can do the conversion
07:02 < cer_abg> i did it in the past
07:02 < defswork> cer_abg, .pem ca.crt can be 3 in one file
07:02 < krzie> i meant verify instead of conversion
07:02 < krzie> but whatever
07:02 < krzie> bbiaf
07:04 < defswork> cer_abg, if you using pkcs12 file you use the --pkcs12 option (I'm readin the man page)
07:04 < cer_abg> ok
07:04 < defswork> instead of ca, key and cert options
07:12 < cer_abg> omg...can't live doing 400 things at the same time D: i'm gonna die or develop extreme multitasking skills
07:13 < cer_abg> they don't let me focus on openvpn sutff  >_<
07:15 <@vpnHelper> RSS Update - forum: auth-user-pass file and encrypted password ? <http://forums.openvpn.net/topic8245.html>
07:21 <@vpnHelper> RSS Update - forum: Annoying warning <http://forums.openvpn.net/topic8242.html#p12675> || auth-user-pass file and encrypted password ? <http://forums.openvpn.net/topic8245.html#p12674>
07:22 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:28 -!- morbidwar [~ovidiu@81.196.150.82] has left #openvpn []
07:29 < cer_abg> ok, lets go
07:29 -!- gokturkgezer [~gokturk@78.187.205.86] has joined #openvpn
07:31 < gokturkgezer> !welcome
07:31 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:31 < gokturkgezer> !howto
07:31 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:31 < gokturkgezer> !goal
07:31 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:33 <@vpnHelper> RSS Update - forum: auth-user-pass file and encrypted password ? <http://forums.openvpn.net/topic8245.html#p12676>
07:34 < gokturkgezer> Hi guys, I would like to access the lan behind the server, but facing some problems. Need help
07:34 < defswork> routing ? ip_forward ?
07:34 < gokturkgezer> routing
07:34 < gokturkgezer> i guess
07:35 < defswork> you need routes on all lan machines that need to be accessed back to the vpn subnet via the vpn server
07:35 < defswork> and echo 1 > /proc/net/sys/ipv4/ip_forward 
07:36 < defswork> (if on linux - in whcih case update /etc/sysctl.conf
07:36 < gokturkgezer> do i need to to that in bridged mode also?
07:37 < defswork> if you are bridging then you arent routing :o
07:38 < gokturkgezer> actually i tried both of them, now trying routing
07:38 < gokturkgezer> my bridge interface seems not to respond from packets outside the network in my bridging experience
07:40 < ecrist> firewall?
07:40 < gokturkgezer> not active
07:41 < defswork> gokturkgezer, so you allocated a subnet of your existing lan to the openvpn bridge ?
07:41 < gokturkgezer> no
07:42 < gokturkgezer> using the same subnet
07:42 < defswork> eh ?
07:42 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
07:42 < defswork> aye - so you lan is 192.168.0.0 and you allocation 192.168.0.128-160 or something to the openvpn clients
07:42 < defswork> hmm great typing skills
07:43 < bystander> guys if I place ( server 10.8.0.0 255.255.240.0 ) directive in the server.conf, as I read in the subnetting, will I get 4,096 local ip addresses?
07:43 < gokturkgezer> yes my lan is 192.168.22.0 and allocating in 192.168.22.80/85
07:43 < defswork> 16 * 256
07:44 < defswork> bystander, but depending on your setup each client connection could take 4
07:44 < bystander> 4?
07:44 < defswork> gokturkgezer, what didnt work then ?
07:44 < bystander> defswork: 4?
07:45 < defswork> bystander,  /30 subnet per connection if net30 mode
07:45 < bystander> I read the article here http://www.pantz.org/software/tcpip/subnetchart.html
07:45 <@vpnHelper> Title: Internet Protocol (IPv4) Subnet Chart (at www.pantz.org)
07:46 < bystander> defswork, I use /20
07:46 < defswork> bystander, in net30 mode each connection has a full subnet - the smallest of which can be /30
07:46 < krzee> there is no net30 in tap
07:46 < gokturkgezer> defswork, i'm most probably making some mistake but don't know anyway, the server is 192.168.22.230, and when i set br0 interface to the same ip, i lost my connectivity
07:46 < defswork> krzee, I missed tap - wheres that ?
07:47 < bystander> defswork, I use /20 so  I assume I will get 4096 ip.  but when I run openvpn server runs, it only states that max is 1024
07:47 < krzee> [05:38]  <gokturkgezer> my bridge interface seems not to respond from packets outside the network in my bridging experience
07:47 < krzee> bridge = tap
07:47 < defswork> krzee, different person
07:47 < krzee> oops
07:47 < defswork> ;)
07:47 < krzee> =]
07:48  * krzee casually wanders off
07:48 < defswork> bystander, each openvpn client is taking a /30 subnet up of your /20 subnet
07:48 < bystander> iptables -t nat -A POSTROUTING -s 10.8.0.0/20 -j SNAT --to x.x.x.x that is my iptable that I supposed 4096 local ip will be created
07:48 < defswork> bystander, thats 4 addresses - 1024 clients for a 4096 range
07:48 < defswork> bystander, you arent listening - I'll shut up
07:48 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
07:49 < bystander> defswork: sorry I did not get that 4 addresses I was stuck to what I understood
07:50 < bystander> can you tell me how I can create that 4096 local ip addresses
07:50 < defswork> bystander, /20 gives you a 4096 address range.  in net30 mode openvpn will use 4 ips per client - so you only have 1024 client support
07:50 < bystander> wait wait. maybe I dont get the part net30 mode
07:51 < krzee> openvpn will shit itself far before 1000 clients
07:51 < bystander> what is that net30 mode. I dont have that on either of my configurations
07:51 < krzee> more like around 200
07:51 < krzee> !/30
07:51 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
07:51 < defswork> your pool is 10.8.0.0 - so openvpn gives 10.8.0.1 to server, 10.8.0.2 to client - either side are broadcast
07:52 < defswork> next client will get 10.8.0.5 and 10.8.0.6 etc..
07:52 < krzee> first client gets .6
07:52 < krzee> .2 is internal to the server
07:52 < defswork> yeah yeah - didnt want to complicate him even more 
07:52 < krzee> you would have been when hes trying to ping .2
07:52 < bystander> krzee: shit itself? what do you mean? so what is the max local ip that the openvpn can handle per public ip address.
07:52 < krzee> bystander, i mean openvpn cant handle nearly that many clients
07:53 < krzee> (1024)
07:53 < krzee> its single threaded
07:53 < krzee> very monolithic
07:53 < defswork> krzee, I've just setup multi-instance server
07:53 < krzee> expect it to die with around 200 clients at once
07:53 < defswork> 4 instances bound to cpu cores
07:53 < krzee> defswork, cool
07:53 < bystander> krzee: sohow many clients can it handle?
07:54 < defswork> bystander, depends on cpu speed - 250 is mentioned as a wall
07:54 < ecrist> we're hoping to fix the single thread issue in 3
07:54 < defswork> bystander, thats Active connections though - moving data
07:55 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
07:55 < bystander> defswork: can you possibly guide me how you setup that multi-instance server so I can also apply that to mine?
07:55 < gokturkgezer> defswork, is that someway you're gonne guide my through? or you forgot me :]
07:56 < defswork> bystander, I will document it on my website eventually
07:56 < bystander> website? may I know your website?
07:57 < defswork> bystander, but you basically run multiple instances listening on different ports.  Use taskset to bind each process to a cpu and in the client specify multiple remotes - for each port
07:57 < bystander> defswork:  I see. ok 
07:58 < bystander> defswork: what about the cpu core that you mentioned?
07:58 < krzee> bystander, thees no exact number
07:59 < bystander> krzee: when you say die, does that mean that the openvpn process will stop?
08:01 < bystander> my next question is that, do I need to have dh4096.pem over dh1024.pem?
08:03 < krzee> bystander, it would go to 100% cpu
08:04 < bystander> krzee: what do you mean by that? would that improve my security having that high dh4096.pem?
08:04 <@vpnHelper> RSS Update - forum: Use the TAP adapter as a virtual network interface driver <http://forums.openvpn.net/topic8246.html>
08:07 < bystander> guys I need confirmation please about using dh4096.pem
08:07 < ecrist> what about it?
08:07 < bystander> will that improve security if I have dh4096.pem over dh1024.pem?
08:08 < ecrist> !dh
08:08 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
08:08 -!- bauruine [~stefan@217.150.233.196] has joined #openvpn
08:09 < bystander> I see. so this is one of the many security but if I have dh4096.pem over dh1024.pem, will the that slow my connection to the server?
08:09 <@dazo> If you use very strong PKI keys (--tls-cipher), you might need more powerful dh params ... but you won't really increase security by only increasing dh params bit length
08:09 <@vpnHelper> RSS Update - forum: Use the TAP adapter as a virtual network interface driver <http://forums.openvpn.net/topic8246.html#p12678>
08:10 <@dazo> bystander: no, it will not slow down anything ... it will just provide a very big unique prime number, which itself is not a bad thing
08:11 <@dazo> naturally, using a bigger prime number in the key exchange algorithms, might theoretically make the key exchange slower ... but on todays hardware, that's most likely not an issue
08:11 <@dazo> unless you're using 16MHz Motorola CPUs ... which I doubt ;-)
08:11 < bystander> so dh4096.pem is better than dh1024.pem right since it has higher algo.
08:12 < ecrist> it's just a prime number
08:12 < ecrist> a big prime number
08:12 < bystander> I see. thanks for confirming and your replies guys. much appreciated.
08:14 <@dazo> let me put it differently, if your connection is cracked, it is most likely not the prime number which would have saved you
08:14 <@vpnHelper> RSS Update - forum: Site to Site VPN, Client not getting IP from VPN Subnet <http://forums.openvpn.net/topic8226.html#p12679>
08:15 < bystander> my third question guys is about this http://pastebin.com/j8GvBAxy
08:15 < bystander> I dont understand that but I have reseached that on google.
08:15 < bystander> ah probably I should ask this on netfilter?
08:16 <@dazo> what is it you don't understand?
08:16 -!- ukaz [~bima@82-169-33-201.ip.telfort.nl] has joined #openvpn
08:16 < bystander> dazo: the comment that it states there about block outgoing netbios
08:16 < ukaz> hi all, my certificate on private server was expired, and now by accident I did a clean-all and init-ca again. did this destroy my openvpn server setup and must I recreate all certificates? or is there a way back?
08:17 < ukaz> now when trying to create a client certificate with the original ca.crt and key, it says private key mismatch
08:17 <@dazo> bystander: netbios/smb/cifs traffic uses tcp and udp ports 135 to 139, in various degrees 
08:17 < ukaz> gives error
08:17 -!- Clete2_ [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:18 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
08:18 <@dazo> bystander: it just blocks those packets from being routed/forwarded (FORWARD) and that the box itself, if it runs any samba stuff will not do the same
08:18 -!- tuxx [~tuxx@s15427526.onlinehome-server.info] has joined #openvpn
08:19 < tuxx> hey guys.. is there some way i can disable pushed commands without modifying my server?
08:19 < tuxx> i wld like to disable redirect-gatway
08:19 < bystander> so there is no advantage if I put that on my iptables for internet connection purposes?
08:19 <@dazo> bystander: OUTPUT covers traffic going from local processes on the box ... while FORWARD covers traffic coming from one interface going out on another interface
08:20 <@dazo> bystander: I'd rather recommend you to drop all the traffic you can drop ... reduces the attack vector ... and make the rules as generic as possible
08:21 < bystander> hmmm. thanks dazo for the recommendation. I will look upon my iptables about this. 
08:21 <@dazo> ukaz: yes, clean-all wipes everything ... you can't sign new certificates as you don't have the keys for your CA any more ... so all certs must be replaced
08:21 < bystander> guys I have last question for today, please kindly accomodate me
08:22 < ukaz> dazo: and if i saved keys in seperate dir?
08:22 <@dazo> tuxx: Look up --route-nopull in the man page
08:22 <@dazo> ukaz: if you have the CA key backed up, then you are in a better shape ... you might need to tweak your serial number file, to avoid serial number conflicts on new certificates, though
08:22 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
08:23 < tuxx> dazo: no such word
08:23 <@dazo> !man
08:23 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
08:23 < ukaz> dazo: exact, i copied the ca key to keys/ but when trying to create new client certificate, it gives error
08:23 < ukaz> though it does create a .key file :S
08:23 < tuxx> also no hits
08:24 < tuxx> perhaps you mean --route-noexec ?
08:24 <@dazo> tuxx: nonsense, I'm looking at --route-nopull
08:24 <@dazo> below -.-route-noexec
08:24 < tuxx> seriously i dont find it :)
08:24 < tuxx> dazo: i have redirect-gateway after route-noexec
08:24 < bystander> my last question is that I have read about dns and icmp tunneling which openvpn does not support yet.  however I have read on one article that if want to tunnel dns, you can run openvpn udp on port 53 (with related iptables configured).  so if that statement is correct, if I have configured in anyway the server and setup an iptable rule accepting icmp, would that tunnel icmp?
08:24 < tuxx> no hits for "nopull"
08:25 <@dazo> ukaz: copy that ca key file back to the place where you had the key before ... and just do ./build-client as before
08:25 <@dazo> tuxx: which version are you using?
08:25 < tuxx> oh.. you maybe are looking at 2.1
08:25 < tuxx> sorry.. i'm on 2.0
08:25 <@dazo> I'm looking at 2.2
08:25 < tuxx> actually im on 1.6.0
08:25 <@dazo> tuxx: no soup for you ... upgrade to 2.2 .... 2.0 is no longer supported, and definitely not 1.6
08:25 < tuxx> this is mac os
08:25 < tuxx> its the standard version in the port system
08:26 <@dazo> yeah, openvpn 2.2 runs there as well
08:26 < tuxx> mmh okay.. surprising that the macports are so outdated 
08:26 < tuxx> i'll build it manually
08:28 < bystander> krzee, ecrist can I ask you about my last question because dazo is somewhat busy.
08:28 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 250 seconds]
08:28 <@dazo> tuxx: if you care about security ... never run such old unsupported software, especially when it includes encryption to make things safe ... 2.0.9 was released in 2006, iirc ... and I don't dare to think of when 1.6 was released ... 2.1 was released a year ago, and 2.2 just some months ago
08:28 < krzee> bystander, you can tunnel dns and icmp over openvpn already, as they are each ip traffic
08:28 < tuxx> dazo: hehe yea i just noticed the meta package "openvpn" is 1.6.0 by default.. but i'm installing "openvpn2" now.
08:29 < krzee> what you read that doesnt exist is using dns or icmp as the protocol to encapsulate in, currently only can use tcp/udp for that
08:29 <@dazo> bystander: it might be that running openvpn on 53/udp will get you through some firewalls ... but I guess that will just make your openvpn server answer a lot of dns cache poisining attempts, making the server busy with other stuff .... unless you add --tls-auth of course, that will help a bit
08:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
08:30 < bystander> dazo I will take note of that --tls-auth
08:30 < krzee> that is:
08:30 < krzee> !hmac
08:30 -!- gokturkgezer [~gokturk@78.187.205.86] has left #openvpn ["Leaving"]
08:30 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
08:30 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
08:31 < bystander> krzee, it was one of my googling result. can you provide me further information on "tunnel dns and icmp over openvpn already"
08:31 < tuxx> dazo: now i'm getting:
08:31 < tuxx> Wed Jun  1 15:30:10 2011 Options error: option 'redirect-gateway' cannot be used in this context
08:31 < tuxx> Wed Jun  1 15:30:10 2011 Options error: option 'route' cannot be used in this context
08:31 < krzee> dns and icmp are just ip traffic, you can ping over openvpn or resolve hostnames over it
08:31 < krzee> you were reading about using icmp/dns for transport
08:31 <@dazo> tuxx: when upgrading from 1.6 to 2.1 or 2.2, it's better to start with clean config files on both sides
08:31 -!- ukaz [~bima@82-169-33-201.ip.telfort.nl] has quit []
08:32 < krzee> he had 1.6!?
08:32 <@dazo> tuxx: the config files are typically ~10-15 lines
08:32 < tuxx> dazo: mmmm my config is reallly simple tho
08:32 < krzee> wow
08:32 <@dazo> yeah :)
08:32 < tuxx> yea mine is like 10 lines too
08:32 < krzee> !sample
08:32 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
08:32 <@dazo> tuxx: read the new man page, for those keywords you have in your old config ... and build a new config
08:33 <@dazo> krzee: nice!
08:33 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
08:34 <@dazo> tuxx: but save yourself some trouble by making sure you run 2.2.0 on both sides of the tunnel ... that will surely lessen your challenges, or at least 2.1.4
08:34 < tuxx> OpenVPN 2.1_rc19 
08:34 < tuxx> is the server side
08:34 < bystander> krzee: do you have reading material for what I am researching? like samples for that?
08:34 < krzee> tuxx, upgrade
08:34 <@dazo> tuxx: gah, that's also outdated
08:35 < krzee> bystander, iodine and nstx can tunnel over dns, icmptx can tunnel over icmp
08:35 <@dazo> tuxx: 2.1_rc candidates was rolling for 3-4 years or so ... even though rc19 is close to 2.1.0, but still there are some fixes since rc19
08:36 < bystander> yes I have read them and tried to setup but I need the terminal to be open for icmptx to properly work
08:36 <@vpnHelper> RSS Update - forum: Use the TAP adapter as a virtual network interface driver <http://forums.openvpn.net/topic8246.html#p12680>
08:36 < tuxx> dazo: its debian.. :/
08:36 < bystander> and that was a problem
08:36 <@dazo> tuxx: doesn't matter ... rc19 is still old and outdated
08:37 < bystander> krzee: while I operate the server thru remote
08:37 < tuxx> im just saying.. debian packages are so outdated
08:38 < krzee> bystander, well i dont support icmptx, i do kinda support iodine, but thats in #iodine on ircnet
08:39 < bystander> iodine ! that would be nice too. can you kindly provide me steps for setting up the server and client please for a start.
08:39 < krzee> for iodine?
08:39 < krzee> no
08:39 < krzee> this is the openvpn help channel
08:40 < krzee> google for the iodine wiki for that
08:40 < bystander> krzee, I just joined in iodine but there no active users there
08:41 < bystander> does the iodine irc still active?
08:41 < tuxx> dazo: http://pastebin.com/Qu1Wc3A5
08:41 < tuxx> dazo: those are my configs...
08:42 < tuxx> nothing amazing.. 
08:42 < tuxx> anyway route-nopull doesnt work
08:42 <@dazo> interesting, as I do use it from time to time .... so this is most likely a pebkac
08:43 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
08:45 < krzee> [06:38]  <krzee> bystander, well i dont support icmptx, i do kinda support iodine, but thats in #iodine on ircnet
08:45 < krzee> i didnt say on freenode
08:46 < bystander> krzee: where please. I dont know other irc channel other then freenode
08:46 < krzee> IRCNET
08:46 < krzee> i only said it twice...
08:46 < bystander> ircnet? how do I type that? /server ircnet
08:47 < krzee> google is your friend
08:47 < tuxx> i dont get it
08:47 < krzee> well, it should be at least
08:47 < tuxx> from what i'm reading route-nopull shld work
08:48 < krzee> i dont see route-nopull in your config...
08:48 < tuxx> well yea when i add it i get
08:48 < tuxx> Wed Jun  1 15:44:23 2011 Options error: option 'redirect-gateway' cannot be used in this context
08:48 < tuxx> Wed Jun  1 15:44:23 2011 Options error: option 'route' cannot be used in this context
08:49 < krzee> are you using 2.2.0 on the client and server now?
08:50 < bystander> thanks krzee
08:50 < tuxx> yea
08:50 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:50 < tuxx> both sides are 2.2
08:51 < krzee> !logs
08:51 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:52 < tuxx> okay. thanks.. one sec
08:58 -!- KaiForce [~chatzilla@70.228.79.239] has joined #openvpn
09:02 < tuxx> krzee: http://pastebin.com/3QeGscWX
09:04 < krzee> weird
09:05 < krzee> what happens if you move redirect gateway to the bottom of the config?
09:05 < tuxx> http://pastebin.com/Qu1Wc3A5 <- line 17?
09:06 < K1ng`> why openvpn is hard to configure ;(
09:06 < K1ng`> :(
09:06 < krzee> yes line 17
09:06 < krzee> K1ng`, easy to me :-p
09:06 < tuxx> krzee: Wed Jun  1 16:06:15 2011 Options error: option 'route' cannot be used in this context
09:06 < tuxx> krzee: i get that error now
09:07 -!- CrazyGir [~jason@unaffiliated/crazygir] has quit [Ping timeout: 240 seconds]
09:07 < krzee> put server at the top
09:07 < krzee> line 19
09:07 < tuxx> krzee: its at the top
09:08 -!- CrazyGir [~jason@li14-82.members.linode.com] has joined #openvpn
09:08 -!- CrazyGir is now known as Guest35640
09:10 < tuxx> krzee: okay.. i have to appologize
09:10 < tuxx> krzee: i was doing something really stupid.. 
09:10 < krzee> ?
09:10 < tuxx> krzee: too stupid to elaborate on :)
09:10 < tuxx> krzee: thanks for your help.. it works now
09:10 < tuxx> dazo: thank you too mate
09:11 < krzee> np
09:12 <@dazo> K1ng`: if you don't read the docs, openvpn is just as hard as any other VPN or network related setup
09:12 < hyper_ch> openvpn is hard?
09:12 < tuxx> brilliant question
09:14  * dazo thinks that people should start setting up a bare network from scratch instead of just doing the "clickety-click-wohoo-it-works-I'm-a-network-master-guru" steps on their wireless routers
09:14 < defswork> indeed
09:15 <@dazo> take an old PC stuff it with 2-3 NICs, install Linux or *BSD ... configure dhcp servers, name servers, network routes and firewalls ... then you're ready for VPN
09:16  * defswork has 40+ oreilly books on almost everything
09:16 < defswork> read the bind book from cover to cover
09:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:16  * dazo got an old oreilly dns book, covering 4.x and 8.x ... hmmm time to get an updated copy probably ...
09:17  * dazo got the sendmail book as well .... still have nightmares from the sendmail days ....
09:17 < defswork> mines old too - as a result I lingered moving to bind9
09:17 < tuxx> btw do you need to control a dns yourself if you want to use iodine?
09:17 <@dazo> I'd like to get started with DNSSEC
09:17 < defswork> hell yeah - I used to know sendmail syntax
09:17 < tuxx> i have the domain bdn.de and arpspoof.org
09:17 < defswork> then I found qmail and slept much better
09:18 < tuxx> but i dont think i can set subdomains like foo.bdn.de to point at arbitrary ip addresses
09:18 <@dazo> yeah :)  I've been playing with postfix lately ... very happy there :)
09:18 <@dazo> tuxx: that's correct
09:18 < tuxx> dazo: mm how can i get a domain which i can control 100% myself?
09:19 <@dazo> tuxx: set up a DNS server for that domain, sub- or top-level ... and update NS records for that domain to point in that direction, basically
09:19 < tuxx> dazo: well i have bind/named running on my server and i tried making subdomains point at arbitary ips
09:19 <@dazo> ahh, sub-domains are dead easy
09:20 < tuxx> but i was told i cant do that in #networking because i dont "control" the domain
09:20 < defswork> tuxx, point the NS for bdn.de to your name server
09:20 <@dazo> create a new zone file for the domain, add it to named.conf as a zone entry
09:20 < tuxx> defswork: how? :)
09:20 < tuxx> dazo: yea i have that
09:21 < tuxx> seems to have no effect
09:21  * defswork has 30+ domains
09:21 < defswork> host -t ns bdn.de
09:21 < defswork> bdn.de name server ns.inwx.de.
09:21 < defswork> bdn.de name server ns2.inwx.de.
09:21 < defswork> bdn.de name server ns3.inwx.de.
09:21 -!- cer_abg [96d60496@gateway/web/freenode/ip.150.214.4.150] has quit [Ping timeout: 252 seconds]
09:21 <@dazo> tuxx: contact your domain registrar to make them update the top level DNS
09:21 < tuxx> i wouldnt even know exactly what to say :)
09:22 < tuxx> defswork: arpspoof.org name server ns66.1und1.de.
09:22 < tuxx> so i contact 1und1 and tell them what exactly? :D
09:22 < defswork> if you registered it with someone they usually have a control panel to alter the nameservers
09:22 <@dazo> "I want to host my own DNS server ... point NS records for bdn.de to IP x.y.z.w
09:22 <@dazo> "
09:22 < tuxx> defswork: mmm i'll check
09:22 < tuxx> dazo: hmm okay
09:22 < tuxx> dazo: i'll try.. they might laugh at me cuz i dont really know what im talking about :D
09:23 < tuxx> but whatever :D
09:23 <@dazo> but be sure you have a valid SOA record for your domains, or else registrars gets grumpy
09:23 < defswork> if you dont know what you are talking about you arent ready to host your own dns
09:23 <@dazo> agreed
09:23 -!- ukaz [~bima@82-169-33-201.ip.telfort.nl] has joined #openvpn
09:23 < ukaz> guys, i get this: TLS Error: Unroutable control packet received from ..
09:23 < defswork> tuxx, most registrars allow you to amend dns that they host for you too - might be a better option
09:23 < ukaz> dazo: i recreated only certs
09:24 <@dazo> it's easy when you know what you do ... but build up knowledge before doing things
09:24 < ukaz> how can configs suddenly turn wrong?
09:24 <@dazo> ukaz: you got gibberish in your encryption ... most like wrong keys, somehow 
09:24 < ukaz> must recreate dh?
09:24 <@dazo> no, that's not needed
09:25 < ukaz> i got clnt->serva->servb 
09:25 < ukaz> must i also recreate certs on servb?
09:25 <@dazo> try to build up a new CA from scratch and try new keys/certs ... and see if that helps
09:25 < ukaz> wouldnt think so
09:25 <@dazo> then you know where to start looking for errors
09:25 <@dazo> if you created a brand new CA certificate, then yes
09:25 < ukaz> but servB CA is unchanged
09:25 < tuxx> dazo: http://pastebin.com/qL19AGqS
09:26 < tuxx> does that look correct? :D
09:26 <@dazo> ukaz: but if you have modified the CA certificate, all certs must be issued again
09:26 < ukaz> servB = CA for servA
09:26 < ukaz> servA = CA for clnt
09:26 <@dazo> tuxx: you got an e-mail address file@arpspoof.org?
09:27 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:27 < tuxx> nope :)
09:27 < tuxx> cld set one up.. 
09:27 <@dazo> N SOA ns.arpspoof.org file.arpspoof.org. 
09:27 <@dazo> the last part there, is e-mail address, but the @ is replaced with a dot
09:28 < tuxx> oh.. can i do soemthing like tuxx@bdn.de ?
09:28 < tuxx> tuxx.bdn.de even
09:28 <@dazo> so if your e-mail is: me@arpspoof.org .... then it will be me.arpspoof.org
09:28 <@dazo> yeah
09:28 < tuxx> ok
09:28 <@dazo> tuxx.bdn.de is correct
09:28 < tuxx> thanks
09:28 <@dazo> tuxx: try running this through named-checkzone
09:28 < tuxx> i think i'll call them now
09:28 < tuxx> i've wanted to try iodine for a while
09:29 < tuxx> the problem is.. in ubuntu my named is starting by default in a chroot
09:29 < tuxx> and i have configs in /etc and in the chroot and never know exactly which one it is parsing
09:30 < tuxx> kinda annoying the bind9 setup
09:30 < krzee> move a dir and see if it starts or not
09:30 < krzee> pretty easy...
09:30 < tuxx> tuxx@arpspoof:/etc$ named-checkzone arpspoof.org bind/zones/arpspoof.org.db 
09:30 < tuxx> zone arpspoof.org/IN: th.arpspoof.org/NS 'arpspoof.org.arpspoof.org' has no address records (A or AAAA)
09:30 < tuxx> zone arpspoof.org/IN: loaded serial 2006032201
09:30 < tuxx> looks ok?
09:30 < tuxx> OK
09:31 < tuxx> sorry if this is off topic.. but you guys seem quite knowledgable
09:31 < tuxx> :)
09:33 < krzee> it is, but nobody is asking for on-topic help, and dazo seems to not mind
09:33 <@dazo> lol
09:33 -!- nb [~nb@fedora/nb] has joined #openvpn
09:33 < tuxx> ^^
09:33 <@dazo> krzee: blaming stuff on me now suddenly ;-)
09:33 < tuxx> i'm going to call 1und1.de
09:33 < EugeneKay> Ugh. Date-based serials.
09:33 < krzee> !blame
09:33 <@vpnHelper> "blame" is According to Bushmills, it's always krzee's fault
09:34 < krzee> !learn blame as According to krzee, it's always dazo's fault
09:34 <@vpnHelper> Joo got it.
09:34 < tuxx> and tell them to "point NS records for arpspoof.org to tuxx@arpspoof:/etc$ named-checkzone arpspoof.org bind/zones/arpspoof.org.db 
09:34 < tuxx> zone arpspoof.org/IN: th.arpspoof.org/NS 'arpspoof.org.arpspoof.org' has no address records (A or AAAA)
09:34 < tuxx> oops!
09:34 < tuxx> zone arpspoof.org/IN: loaded serial 2006032201
09:34 < krzee> you forgot a .
09:34 < tuxx> and tell them to "point the NS to 82.165.197.129"
09:34 < krzee> arpspoof.org. will do what you want
09:35 < hyper_ch> tuxx: apply for your own TLD
09:35 < tuxx> what the hell is a tld?
09:35 <@dazo> top level domain?
09:35 < tuxx> ah..
09:35 < krzee> arpspoof.org while in the arpspoof.org zone will be arpspoof.org.argspoof.org
09:35 < krzee> arpspoof.org. while in the arpspoof.org zone will be arpspoof.org
09:35 < hyper_ch> only when you can manage your own TLD you can completely control a domain
09:35 < krzee> that trailing . means a lot
09:35 < krzee> not true hyper_ch 
09:35 < krzee> tlc is .org
09:35 < tuxx> krzee: i dont understand the difference
09:35 < krzee> tld*
09:36 < krzee> i own a domain named ircpimps.org, the tld is .org
09:36 < krzee> tuxx, the trailing . ends the domain
09:36 < hyper_ch> krzee: I know... but when you reigster a domain at someone's place... then they can cut you off easily
09:36 < krzee> without it, it is assumed to be something INSIDe the zone, so the zone is appended
09:36 < hyper_ch> but if you control your own TLD, then nobody can take the domain.TLD away :)
09:36 < EugeneKay> There are those who would argue that even those who control the TLDs are not in control. ;-)
09:36 < krzee> they could revoke yourright to the tld
09:37 < krzee> the root nameservers have the real control
09:37 <@dazo> .org could go away, so yeah, true! ;-)
09:37 < krzee> if you own one of THOSE, nobody could take your domain ;]
09:37 <@dazo> hehe
09:37 < EugeneKay> Well, there are always the men with guns
09:37 <@dazo> EugeneKay: that's ecrist!
09:37 < defswork> those that control the TLDs are corrupted my money for sure
09:37 < hyper_ch> well, then I'll setup my internet v4
09:37 < defswork> by*
09:37 < krzee> they hafta find me first!
09:37 < EugeneKay> And if you happen to have a buggy nameserver...... hacks can be had. :-p
09:37 < hyper_ch> I heard they're going to charge like $600 per .xxx domain
09:37 -!- images [~images@static.238.229.4.46.clients.your-server.de] has joined #openvpn
09:37 < EugeneKay> Luckily, all of the known ones are plugged.
09:38 < ecrist> muahahaha
09:38 < krzee> hrm, i have xxx.ircpimps.org... maybe i should get org.ircpimps.xxx too
09:38 < krzee> hehe
09:38 <@dazo> hehe
09:38 < hyper_ch> you got a xxx domain :)
09:38 < krzee> i recently registered smartstoner.org :-p
09:38 < hyper_ch> you nasty little crazy one
09:38 < ecrist> lol, krzee
09:39 < krzee> =]
09:39 < EugeneKay> pitofsnakesandbrokenglass.com is one of my favorites
09:39 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Operation timed out]
09:39 < EugeneKay> I also have itvends.com and androids[-]exchange.[com|net|org]
09:40 < tuxx> dazo: i found something in the interface where i can change the A-record to my ip
09:40 < krzee> i also have joogot.noskills.net
09:40 < ecrist> android sex change?
09:40 < tuxx> dazo: is that what i care about?
09:40 < krzee> (well, noskills.net, but joogot is my fav hostname)
09:40 < krzee> lol nice ecrist 
09:40 <@dazo> tuxx: no not really, you want to change the NS record
09:40 < ecrist> I like my southpark naming scheme
09:40 < krzee> tuxx, i told you the problem
09:40 < defswork> tuxx, A records are address records
09:41 < defswork> you need to change the NS records
09:41 < EugeneKay> Isn't there a BIND howto someplace?
09:41 < defswork> and also the glue records
09:41 < krzee> its looking for the address for http://arpspoof.org.arpspoof.org/
09:41 <@vpnHelper> Title: Am Puls der Nacht - www.ampulsdernacht.de - Bilder Der Nacht - Partybilder & Nightlife Community (at arpspoof.org.arpspoof.org)
09:41 < krzee> err
09:41 < tuxx> okay.. i think i found that too :)
09:41 < krzee> its looking for the address for arpspoof.org.arpspoof.org
09:41 < defswork> but your registrar will do that behind the scenes probably
09:41 < krzee> because you dont have a trailing . in the NS entry
09:42 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Remote host closed the connection]
09:42 < krzee> [07:34]  <tuxx> zone arpspoof.org/IN: th.arpspoof.org/NS 'arpspoof.org.arpspoof.org' has no address records (A or AAAA)
09:42 < hyper_ch> I only got one good domain name :(
09:42 < tuxx> dazo: i have a field "primary nameserver" it is set to 1und1 but can also be set to "own nameserver"
09:42 < krzee> arpspoof.org.arpspoof.org is the problem
09:42 < tuxx> what shld i enter in that field? :D
09:42 <@dazo> tuxx: that's the one
09:42 < tuxx> krzee: yea i'll fix that in a sec
09:42 <@dazo> tuxx: but really, don't change anything before you've fixed your errors
09:42 < krzee> seriously
09:42 < krzee> heh
09:42 < tuxx> dazo: the domain is not in use anyway
09:43 <@dazo> doesn't matter, some registrars checks your DNS server before doing the change
09:43 < tuxx> http://tuxx.bdn.de/screen.jpg
09:44 < hyper_ch> bdn - bundesdienst für nachrichten?
09:44 < tuxx> "the name server does not have enough parts or is not permitted. this domain change is currently not offfered"
09:44 < tuxx> hyper_ch: something like that :P
09:44 < krzee> looks like BitchX
09:44 <@dazo> lol ... everyone looks at everything except the DNS setup :-P
09:44 < hyper_ch> so, I think it's time for the weekend and to get a new furball
09:44 < tuxx> dazo: http://tuxx.bdn.de/screen.jpg
09:45 < krzee> i cant read german ;]
09:45 < tuxx> dazo: does that look correct? :D
09:45 < tuxx> "the name server does not have enough parts or is not permitted. this domain change is currently not offfered"
09:45 -!- nb [~nb@fedora/nb] has quit [Read error: Connection reset by peer]
09:45 < hyper_ch> krzee: sure you can read german... maybe not comprehend it but the latin alphabet is easily readable
09:45 < tuxx> is the translation of the red
09:45 < tuxx> primary secondary name server 
09:45 < defswork> my best domain is allcallsrecorded.com
09:45 < defswork> waiting for the day I set the service up
09:45 < EugeneKay> Primary nameservers need to be a name, not an IP.
09:45 <@dazo> tuxx: because you most likely have issues with your DNS server ... you need to have that fixed
09:45 < tuxx> dazo: oh..? :)
09:45 < tuxx> dazo: okay..
09:46 < tuxx> let me try to fix it :/
09:46 < krzee> thats not where you set yourself to run your own NS
09:46 < hyper_ch> why can't youuse an IP as nameserver??? stupid 1&1
09:46 < krzee> thats just where to set what your primary is
09:46 < krzee> in my registrar you do it somewhere else
09:46 <@dazo> Nameserver: Your own name server .... that's the selection above
09:48 < tuxx> yea 
09:49 < tuxx> but it doesnt take my ip
09:49 < tuxx> possibly due to my faulty configuration as you said
09:50 < defswork> tuxx, on godaddy you setup hosts -  name - ip, and then specify the host as the NS.  Ultimately this puts ns.host.com - 1.2.3.4 as glue record into the root name servers - else specify NS my.domain.com will never resolve as it needs to talk to my.domain.com NS to resolve my.domain.com
09:50 <@vpnHelper> RSS Update - forum: number of client <http://forums.openvpn.net/topic8247.html>
09:51 < tuxx> krzee: hey can you tell me where do i need the trailing .?
09:51 < krzee> paste the line from the config
09:52 < tuxx> pastebin is broken :)
09:52 < defswork> pastie.org
09:53 < tuxx> http://pastie.org/2003761
09:53 < defswork> ns.arpspoof.org needs a .
09:53 < defswork> line 2
09:53 < defswork> and line 12
09:54 < defswork> anything that is a textual name needs a . else the current $ORIGIN will be appended
09:54 < tuxx> http://pastie.org/2003766
09:54 -!- nb [~nb@fedora/nb] has joined #openvpn
09:54 < defswork> (which you may want in the case of foobar)
09:54 < tuxx> tuxx@arpspoof:/var/named/run-root/etc/bind/zones$ named-checkzone arpspoof.org *zone arpspoof.org/IN: th.arpspoof.org/NS 'arpspoof.org' has no address records (A or AAAA)
09:54 < tuxx> zone arpspoof.org/IN: loaded serial 2006032201
09:54 < tuxx> errors seem reduced
09:54 < tuxx> OK
09:54 < defswork> yeah you r NS is wrong
09:55 < tuxx> what do you mean?
09:55 < defswork> http://pastie.org/2003772
09:55 < tuxx> the server running bind9 is 82.165.197.129
09:55 < krzee> heres a good example
09:55 < krzee> ns.arpspoof.org.        IN      A       82.165.197.129
09:55 < krzee> foobar                  IN      A       82.165.197.130
09:56 < defswork> I'm not a fan of your serial
09:56 < krzee> foobar is really foobar.arpspoof.org because no trailing .
09:56 < defswork> 2006 ?
09:56 < tuxx> feel free to change anything
09:56 < tuxx> i really dont know what im doing
09:56 < defswork> tuxx, I have
09:56 < tuxx> krzee: thats what i wanted, yea
09:56 < defswork> looks ok to me now
09:56 -!- Gobbla [~Gobbla@c80-217-143-194.bredband.comhem.se] has joined #openvpn
09:56 < defswork> http://pastie.org/2003772
09:57 < tuxx> named-checkzone arpspoof.org *zone arpspoof.org/IN: th.arpspoof.org/NS 'arpspoof.org' has no address records (A or AAAA)
09:57 < tuxx> zone arpspoof.org/IN: loaded serial 2006032201
09:57 < tuxx> OK
09:57 < tuxx> defswork: thats what i get with your config
09:57 < krzee> i know, im showing you a correct example of what i was saying
09:57 < defswork> thats fine
09:57 < defswork> you dont need an A record for arpsoof.org
09:57 < tuxx> krzee: :)
09:58 -!- Gobbla [~Gobbla@c80-217-143-194.bredband.comhem.se] has quit [Client Quit]
09:58 <@dazo> defswork: is the wrong timestamp in the serial, or the format you don't like?
09:58 < defswork> wrong timestamp
09:58 < tuxx> the help says.. if you wld like to use 1&1 as your secondary nameserver you have to have a zonetransfer axfr for the following nameserver slv2.1un1.de [ip= 212.227.123.29]
09:58 < defswork> I'm in 2011 
09:58 <@dazo> agreed
09:58 < defswork> tuxx, means in your named.conf file you needs to allow xfer for that IP
09:59 < defswork> for that zone
09:59 < defswork> tuxx, I can host your secondary if you want
09:59 < tuxx> defswork: sure..
09:59 < tuxx> for testing anyway
09:59 < defswork> a friend on #ircnet #linux secondaries all mine
09:59 < tuxx> defswork: cool ;)
10:00 < EugeneKay> Here's (a simplified version of) what I copypasta for all my new zones. http://pastebin.com/pkUt749T
10:00 < defswork> add NS ns2.arpspoof.org and ns2 IN A 217.118.24.153
10:00 < tuxx> defswork: thanks so much btw :)
10:00 < defswork> and allow transfer from same IP
10:00 < tuxx> defswork: i really dont know how to follow your instructions :/
10:00 < defswork> hang on
10:01 < ecrist> krzee: http://www.dumpaday.com/wp-content/uploads/2011/05/vcgFL.jpg
10:01 -!- Lenhix [~lenhix@adsl201-232-127-1.epm.net.co] has joined #openvpn
10:01 < tuxx> defswork: i can grant ssh if you like
10:01 < defswork> http://pastie.org/2003772
10:01 < defswork> nah no need
10:02 < defswork> make that your zone file
10:02 < tuxx> okay
10:02 < krzee> LOL
10:02 < krzee> classic
10:02 <@dazo> tuxx: if you want to host your own DNS ... you need to learn what that includes, so better to figure out what our instructions means
10:02 < EugeneKay> defswork - +1 lolpoints for using a date-based serial..... with a 2006 timestamp
10:03 < krzee> mine are always date based
10:03 < krzee> just never starting at date that im onm
10:03 < krzee> on*
10:03 < EugeneKay> Nothing wrong with date based, I just don't happen to use them.
10:03 < EugeneKay> But if you're going to do date based, please, please, PLEASE use today's date when you update
10:03 < krzee> 2004042029 ; serial
10:03 < tuxx> dazo: yea well its hard to learn if you cant try it out
10:04 < defswork> and then add this to your named.conf http://pastie.org/2003810
10:04 <@dazo> tuxx: the datestamp stuff being commented is related to 2006032201 in your zone file
10:04 < krzee> always start with 0420
10:04 < krzee> =]
10:04 < tuxx> defswork: okay
10:04 < EugeneKay> Alternately, just use date +%s
10:04 < EugeneKay> That's a time we can all agree on
10:05 <@dazo> tuxx: that should be:  YYYYMMDDxx  ... so f.ex. 2011060101 .... and if you do another update today, it should be changed to 2011060102 ... if you do a change tomorrow, 2011060201, 2011060202, 2011060203, etc
10:05 < krzee> 1306940712
10:05 < krzee> (date +%s)
10:06 < tuxx> defswork: shld i remove this from my zone in named.conf
10:06 < tuxx> allow-transfer {                
10:06 < tuxx>                 82.165.197.129;         
10:06 < tuxx>                 common-allow-transfer;  
10:06 < tuxx>         };
10:06 < tuxx> and just add your 1 line?
10:06 < defswork> nah
10:06 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
10:06 < ecrist> no pasting in the channel please
10:06 < EugeneKay> Oh, I had an actual OpenVPN question. 2.2.x. IPv6. Does it work decently?
10:06 <@dazo> EugeneKay: I don't care that the US haven't understood putting MM/DD/YYYY is awkward, strange, silly and useless .... you may disagree with me, but I'll just call you stupid and ugly!
10:06 < tuxx> defswork: okay
10:06 < defswork> tuxx, just add my ip there
10:07 <@dazo> EugeneKay: IPv6 does not work in 2.2
10:07 < EugeneKay> Oh. I thought it was gonna be included. :-/
10:07 <@dazo> EugeneKay: you need the coming 2.3 for that ... pull the master branch
10:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
10:07  * EugeneKay shelves it for another 6 months
10:07 <@dazo> EugeneKay: 2.2 includes a IPv6 enabled TUN/TAP driver for Windows ... to get that tested for IPv4 traffic
10:08 < ukaz> dazo: i created all new certs, but it says following: 
10:08 < tuxx> defswork: okay.. added
10:08 <@dazo> EugeneKay: if you have a chance to test out the development snapshots, we would appreciate some testing!
10:08 < ukaz> pkcs11_protected_authentication = DISABLED
10:08 < ukaz> pkcs11_id_management = DISABLED
10:08 < ukaz> WARNING: No server certificate verification method has been enabled. 
10:08 < ukaz> TLS Error: Unroutable control packet received from 
10:08 < ukaz> maybe error in vars when creating new certs?
10:08 < ukaz> like it cant find path or something?
10:08 < defswork> Jun  1 16:08:25 srv2 named[28182]: zone arpspoof.org/IN: transferred serial 1303907608
10:08 < EugeneKay> dazo - I could build a VMware lab for it and spend a spare day fiddling, but I was asking more for production
10:08 <@dazo> ukaz: yeah, you need to use ./build-server for servers, iirc
10:08 < EugeneKay> I tend to stick with yum-provided binaries.
10:09 < defswork> tuxx, now trust me as I can obviously poison your dns now ;)
10:09 < tuxx> defswork: let me pastebin
10:09 < ukaz> ./build-server instead of ./pkitool --server?
10:09 < defswork> (I won;t)
10:09 < ukaz> that doesnt matter no?
10:09 <@dazo> spelling mistake.... not sure defswork is honest :-P
10:09 < EugeneKay> Somebody needs to write a (GPL) gui PKI manager.
10:10 <@dazo> ukaz: yes that matters, that sets some flags in the certificate, indicating that the cert is for servers
10:10 < EugeneKay> And I'm too lazy
10:10 <@dazo> EugeneKay: xca
10:10 < defswork> tuxx, I seem to have transferred that from your provider not your ns
10:10 < defswork> which is odd as they shouldnt allow transfers
10:10 < defswork> you have a bunch of other stuff in the zone
10:10 < defswork> serial is 1303907608
10:11 < ukaz> dazo: so in clnt->serva->servb - i create servb.key and ca.crt, then i create a client for serva no?
10:11 < EugeneKay> dazo - ooooh. Is there a Windows build?
10:11 < defswork> 82.165.197.129 is their IP not yours isnt it?
10:11 <@vpnHelper> RSS Update - forum: Use the TAP adapter as a virtual network interface driver <http://forums.openvpn.net/topic8246.html#p12682>
10:11 <@dazo> EugeneKay: I believe so
10:11 < tuxx> defswork: yea thats my ip
10:11 < tuxx> defswork: my named.conf
10:11 < tuxx> defswork: my named.conf: http://pastie.org/2003847
10:11 < EugeneKay> dazo - I just found the sourceforge. There is in fact a .exe
10:12 < defswork> http://pastie.org/2003850  thats the zone I transferred
10:12 <@dazo> ukaz: that's correct
10:12 < ukaz> well that's exactly what i did
10:12 < defswork> err - change your key
10:12 < ecrist> EugeneKay: http://build.openvpn.net
10:12 <@vpnHelper> Title: Index of /downloads (at build.openvpn.net)
10:12 < defswork> you've just told the internet it
10:12 <@dazo> ukaz: client and server flags is depending on the role of the openvpn process using the cert
10:12 < tuxx> defswork: haha.. oh 
10:12 < ukaz> dazo: but i created servb key with ./pkitool --server srvb
10:13 <@dazo> ecrist: we're talking about xca ... EugeneKay wanted a GUI PKI
10:13 < defswork> tuxx you seen the zone I transferred ?
10:13 < tuxx> defswork: yea i'm baffled...
10:13 < ecrist> ok
10:13 < EugeneKay> I want a lot of things
10:13 < EugeneKay> Top of my list is redheaded twins
10:13 < ecrist> I was confused
10:13 < tuxx> defswork: i dont know where u got all that information from :D
10:13 <@dazo> ukaz: use the ./build-* scripts ... they add more arguments
10:13 < ukaz> k
10:13 <@dazo> to pki-tool
10:13 < defswork> 82.165.197.129
10:13 < ukaz> let me try
10:14 < tuxx> defswork: so what must i do now? :D
10:14 < tuxx> defswork: im so confused :D
10:14 < defswork> nothnig - but I'm curious as to where that zone ifno has come from 
10:15 < tuxx> defswork: i use plesk on this servr
10:15 < krzee> [08:06]  <dazo> EugeneKay: I don't care that the US haven't understood putting MM/DD/YYYY is awkward, strange, silly and useless .... you may disagree with me, but I'll just call you stupid and ugly
10:15 < tuxx> it generated my named.conf and stuff
10:15 < defswork> the zone file too ?
10:15 < tuxx> defswork: no not the zone files
10:15 < EugeneKay> krzee - word to your mother
10:15 < krzee> dazo, true, but DD/MM/YYYY is awkward, strange, silly, and useless too
10:15 < krzee> dazo, only system that makes sense is YYYY/MM/DD
10:16 < tuxx> defswork: trust me i'm amazed by all this too :D
10:16 < defswork> krzee, dd/mm/yyyy makes sense spoken
10:16 < tuxx> defswork: i dont even really know whats going on :)
10:16 <@vpnHelper> RSS Update - forum: [SOLVED] Site to Site VPN, Client not getting IP from VPN Su <http://forums.openvpn.net/topic8226.html#p12679>
10:16 < EugeneKay> No, the only system that makes sense is arbitrary-time-divisions-since-an-arbitrary-time
10:16 <@dazo> krzee: well, YYYY/MM/DD > DD/MM/YYYY > MM/DD/YYYY ;-)
10:16 < EugeneKay> So long as everybody agrees to use Seconds and January 1, 1970, we're all good.
10:17 <@dazo> heh
10:17 < ukaz> dazo: but i get the error on servA ok? because servB openvpn service, running without errors
10:17 <@dazo> ukaz: !logs
10:17 <@dazo> !logs
10:17 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
10:18 <@dazo> ukaz: I'm sure you have messed up your certs somehow ... but how isn't easy to figure out with very little info
10:18 < tuxx> im on the phone with 1&1
10:19 < EugeneKay> Okay, XCA is officially nifty.
10:19 < ukaz> read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
10:19 < ukaz> uh?
10:19 < krzee> !certverify
10:19 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
10:21 < ukaz> says OK
10:21 < krzee> both sides
10:21 < krzee> and if you are CA stacking, try each cert with the ca on the other side
10:21 <@vpnHelper> RSS Update - forum: Problems with Windows 7 client from behind router <http://forums.openvpn.net/topic8248.html>
10:22 < ukaz> using the same ca on both sides
10:23 < ukaz> ca.crt copied from servB to servA
10:23 < ukaz> both sides say OK
10:25 < krzee> cool, certs are good
10:25 < ukaz> situation is ClientA -> ServA -> ServB
10:25 < ukaz> I created CA on ServB, then server key for ServB, then client key for ServA.
10:25 < ukaz> Then copied ca.crt and client keys for ServA to ServA.
10:25 < ukaz> Then tried starting openvpn on both, then it gave the errors.
10:25 < krzee> !logs
10:25 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
10:25 < tuxx> defswork: dude you still here?
10:27 < EugeneKay> dazo - do you use XCA yourself, by chance?
10:27 < tuxx> dazo: dude?
10:27 < ukaz> lol
10:28 < ukaz> restarted
10:28 < ukaz> now it works
10:28 < ukaz> :S
10:28 <@dazo> EugeneKay: Yeah, not fully in production ... but yeah, I am using it on some small scale projects
10:28 <@dazo> ukaz: I should have flogged you for that! ;-)
10:29 <@dazo> tuxx: people here might have fulltime jobs ... and are only responsive during idle cycles
10:30 <@dazo> tuxx: I've not paid attention to defswork and your discussion in a while, so I probably can't help much right now ...
10:30  * dazo got some paid work to take care of now too
10:31 -!- ukaz [~bima@82-169-33-201.ip.telfort.nl] has quit []
10:31 < tuxx> dazo: ok...
10:31 < EugeneKay> dazo - How is it treating oyu? I'm considering moving my PKI into it. Only downside seems to be that I won't be able to cron-job CRL generation
10:31 < tuxx> no prob
10:31 <@dazo> EugeneKay: I like it a lot ... I just need to get some decent standard profiles set up, but I'm moving in that direction
10:32 <@dazo> EugeneKay: I believe you can use it via the command line, to do such stuff as well
10:32 < tuxx> dazo: i dont know what to put in the "primary nameserver"
10:32 < tuxx> its obviously expecting an addres not an ip
10:32 < tuxx> something like ns.arpspoof.org
10:32 < tuxx> but that somehow seems redundant
10:32 <@dazo> tuxx: neither do I then .... ask your registrar
10:32 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:32 < tuxx> im on the phone with him
10:32 < tuxx> right now
10:33 <@dazo> might be you need to setup an A pointer in the webUI for ns.arpspoof.org .. and then use ns.arpspoof.org
10:33 < tuxx> mmm
10:34 <@dazo>  $ dig ns google.com | grep "NS"
10:34 <@dazo> google.com.		242473	IN	NS	ns3.google.com.
10:34 <@dazo> which indicates that this makes sense
10:34 <@dazo> ns3.google.com.		237052	IN	A	216.239.36.10
10:35 < ecrist> gah
10:36  * ecrist fires dazo
10:36 < tuxx> dazo: i'll try that
10:36 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:36 <@dazo> ecrist: thx! :)  I'll go back to my real work then ;-)
10:36 < Bushmills> about 410000000000000000 seconds have passed since begin of the universe. that event may make more sense than arbitrary 1970/01/01 to base time stamps on
10:36 < tuxx> dazo: it took the settings
10:37 < tuxx> now to see if they work :D
10:38 <@dazo> tuxx: remember dns got TTLs ... so you probably need to wait until all name servers have been refreshed
10:38 < tuxx> dazo: no worries
10:38 < EugeneKay> dazo - I'm not seeing anything for a crl from CLI
10:38 < tuxx> i'll wait
10:38 < EugeneKay> :-/
10:38 < Bushmills> dazo:  dig +short ns google.com
10:38 < tuxx> dazo: and keep you updated.. thanks so much for your help
10:38 <@dazo> Bushmills: ahh, true!  
10:38  * dazo got too much going on in his head now
10:39 < EugeneKay> I suppose generating a CRL once a month isn't too much work
10:40 <@dazo> well, the CA should in theory (and according to good practice) be offline ... and as the CRL is generated by the CA, and it is offline ... automatic jobs is kind of odd
10:40 < Bushmills> tuxx: http://en.wikipedia.org/wiki/Glue_record#Circular_dependencies_and_glue_records
10:40 <@vpnHelper> Title: Domain Name System - Wikipedia, the free encyclopedia (at en.wikipedia.org)
10:41 < tuxx> Bushmills: mmmmmm... interesting
10:42 < tuxx> Bushmills: i dont quite understand tho
10:44 < tuxx> Bushmills: is it possible to use ns.arpspoof.org as the primary nameserver of arpspoof.org?
10:45 < tuxx> Bushmills: i have bdn.de and arpspoof.org both pointing to the same server
10:45 < tuxx> bdn.de is controlled by a foreign NS..
10:46 < tuxx> i could use bdn.de rather than ns.arpsoof.org
10:50 < Bushmills> tuxx: yes, though "primary nameserver" is an outdated term
10:51 < Bushmills> you'd think in terms of "master" and "slave" nowadays
10:51 < tuxx> Bushmills: well what do you propose? shld i us ns.arpspoof.org or shld i use bdn.de?
10:51 < Bushmills> whatever rocks your boat
10:51 < tuxx> mmh
10:51 < tuxx> so both work?
10:52 < Bushmills> i don't know whether they work - that's up to you to make them work
10:52 < tuxx> i dont understand how ns.arpspoof.org can be used for arpspoof.org
10:52 < tuxx> dns is voodoo
10:52 < Bushmills> but - dazo told you, and I provided related literature
10:53 < Bushmills> in short, you need glue.  or, glue records, as they're also called.
10:54 < tuxx> i have no idea what the hell that is
10:54 < tuxx> or how to set it up
10:55 < tuxx> so ill try skipping it for now
10:55 < Bushmills> you instruct your registrar to add them on your behalf into zone file of parent zone  
10:56 < tuxx> wow i dont know what the hell i am doing :D
10:56  * ecrist looks, notes he's not in #dns
10:57 < Bushmills> oh. indeed.  
10:57 < Bushmills> i am, so i didn't really notice that this was a different channel :)
10:58 < ecrist> no worries
10:58 < tuxx> joined.
10:58 < ecrist> ;)
11:00 < EugeneKay> Assuming I have a relatively-static site-to-site VPN, is there any reason I can't / shouldn't do a manual 6in4 routing so my two /48's can talk to each other?
11:00 < EugeneKay> (staying encrypted over the general internet and not having to open my firewall to the internet)
11:01 < EugeneKay> Both VPN site endpoints are also the endpoint of the 6in4 tunnel that I'm using to get IPv6 connectivity
11:01 < EugeneKay> tunnels*
11:02 -!- Ejan [~Ejan@112.201.195.113] has joined #openvpn
11:02 <@dazo> EugeneKay: for openvpn 2.2, you might need --tun-ipv6 to make OpenVPN pass IPv6 traffic over a tun device ... or use tap devices directly
11:03 <@dazo> but it should be doable with trad routing, you just need to setup the routes and IPv6 addresses manually
11:03 < EugeneKay> 6in4 would present as "Type 41" IPv4 traffic, as far as OpenVPN s concerned
11:03 < EugeneKay> I am *not* using TAP. I know better.
11:05 < EugeneKay> Manual tunnel setup doesn't bother me, only two sites in question and I'm not renumbering them anytime soon.
11:18 <@dazo> duh, of course ... well ... 6in4 wil be tricky on tun setups
11:31 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
11:39 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
11:43 -!- SOG [~SOG@222.125.196.155] has quit [Client Quit]
12:11 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:18 -!- Ejan [~Ejan@112.201.195.113] has quit [Ping timeout: 276 seconds]
12:29 -!- K1ng` [~KING@180.211.188.19] has quit [Ping timeout: 240 seconds]
12:32 -!- Lenhix [~lenhix@adsl201-232-127-1.epm.net.co] has quit [Quit: Mindwall!!]
12:33 -!- bauruine [~stefan@217.150.233.196] has quit [Quit: Leaving]
12:34 -!- kusznir_ [~manager@s70119198.temp.wsu.edu] has quit [Disconnected by services]
12:34 -!- kusznir_ [~manager@s70119198.temp.wsu.edu] has joined #openvpn
12:34 -!- kusznir_ [~manager@s70119198.temp.wsu.edu] has quit [Disconnected by services]
12:35 -!- kusznir_ [~manager@s70119198.temp.wsu.edu] has joined #openvpn
12:36 -!- KaiForce [~chatzilla@70.228.79.239] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 4.0.1/20110413222027]]
12:41 -!- wangerin1 [~testing-3@dkpix.brightpoint.dk] has quit [Ping timeout: 240 seconds]
12:48 -!- bauruine [~stefan@217.150.236.196] has joined #openvpn
12:53 -!- kusznir_ [~manager@s70119198.temp.wsu.edu] has quit [Quit: Leaving]
13:01 -!- dazo is now known as dazo_afk
13:18 -!- bauruine [~stefan@217.150.236.196] has quit [Quit: Leaving]
13:18 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
13:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:38 -!- Ejan [~Ejan@112.201.195.113] has joined #openvpn
13:40 < EugeneKay> Any obvious gotchas I'm missing, though?
13:43 -!- images [~images@static.238.229.4.46.clients.your-server.de] has quit [Quit: Bye!]
13:45 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
13:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:08 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:18 < Proz0id> anyone know how much memory per client is used for openvpn in tun mode?
14:18 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
14:20 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:25 -!- bauruine [~stefan@217.150.236.196] has joined #openvpn
14:38 -!- images [~images@static.238.229.4.46.clients.your-server.de] has joined #openvpn
14:41 -!- Guifort [~Guifort@175.201.113.78.rev.sfr.net] has joined #openvpn
14:45 < ecrist> Proz0id: not enough to matter
14:51 -!- Lenhix [ElChaman@190.146.247.20] has joined #openvpn
14:51 < Proz0id> dazo was saying a few megs per client... I'm running 256mb right now so just want an idea of capacity 
14:52 < ecrist> let me look
14:52 < EugeneKay> Are we talking VPS?
14:53 < ecrist> well, we have 9 clients connected and openvpn is using 11M
14:55 -!- Guifort [~Guifort@175.201.113.78.rev.sfr.net] has quit [Quit: Quitte]
15:04 -!- images [~images@static.238.229.4.46.clients.your-server.de] has left #openvpn ["Bye!"]
15:06 < Proz0id> yup
15:06 < Proz0id> not bad
15:06 < Proz0id> thanks!
15:11 -!- p3rror [~mezgani@41.140.168.29] has quit [Ping timeout: 250 seconds]
15:14 < ecrist> from top:
15:14 < ecrist> 70186 vpn              1  44    0 11096K  7240K select  0 513:09  0.59% openvpn
15:23 -!- p3rror [~mezgani@41.248.191.238] has joined #openvpn
15:24 < krzee> http://www.youtube.com/watch?v=MeSSwKffj9o
15:24 <@vpnHelper> Title: YouTube - George Carlin - Religion is bullshit. (at www.youtube.com)
15:27 -!- rajkosto [~rajkosto@rajkosto.broker.freenet6.net] has joined #openvpn
15:27 < rajkosto> hey guys, found a bug
15:27 < rajkosto> but its related to ipv6 payload
15:28 < krzee> sweet, what is it?
15:28 < rajkosto> if persistent tunnel is enabled
15:28 < rajkosto> i cant start it more than once per reboot
15:28 < rajkosto> http://codepad.org/5vakHiF4
15:28 <@vpnHelper> Title: Plain Text code - 5 lines - codepad (at codepad.org)
15:29 < krzee> !trac
15:29 <@vpnHelper> "trac" is see http://community.openvpn.net for development information and bug tracker.
15:29 < krzee> please be sure openvpn is not running already
15:29 < rajkosto> its not
15:29 < rajkosto> otherwise it would fail to bind ot port
15:30 < krzee> please add a ticket to trac
15:30 < krzee> vpnHelper will announce it in the dev channel
15:31 < rajkosto> where do i put it
15:31 < rajkosto> since its from git allmerged
15:31 < krzee> feel free to talk about it there too, and thank you for testing and reporting back!
15:31 < krzee> hrm, whats the options?
15:32 < rajkosto> the options ?
15:32 < krzee> i assume you mean what version to say in the trac ticket...?
15:33 < rajkosto> http://codepad.org/DIN86cWj
15:33 <@vpnHelper> Title: Plain Text code - 7 lines - codepad (at codepad.org)
15:33 < rajkosto> checked it out today and just built
15:33 < krzee> pls include that info too =]
15:34 < rajkosto> ive been using ipv6 payload good for a month now, but never used persistent tun device
15:34 < rajkosto> 2nd try starting it with persistent tun device and problems
15:35 < krzee> thats great man, your testing is appreciated!
15:35 < krzee> people doing what you're doing is what will help ipv6 get into openvpn sooner
15:36 < krzee> (along with some of the devs' hard work)
15:38 < rajkosto> how do i put paste into trac ticket ?
15:38 < rajkosto> in code block ?
15:38 < krzee> sure
15:38 < krzee> we wont beat ya up on formatting, you're helping ;]
15:39 < rajkosto> it was a bitch to get it compile on windows a month ago
15:40 < rajkosto> this is nothing
15:41 < rajkosto> 141
15:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
15:41 < krzee> thanks
15:44 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 258 seconds]
15:46 < krzee> [13:46]  <vpnHelper> RSS Update - tickets: #141: Cannot restart openvpn more than once per boot if using persistent tunnels and IPv6 payload <https://community.openvpn.net/openvpn/ticket/141>
15:46 <@vpnHelper> Title: #141 (Cannot restart openvpn more than once per boot if using persistent tunnels and IPv6 payload) – OpenVPN Community (at community.openvpn.net)
15:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:55 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
15:57 -!- p3rror [~mezgani@41.248.191.238] has quit [Ping timeout: 240 seconds]
15:58 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
15:59 -!- rajkosto [~rajkosto@rajkosto.broker.freenet6.net] has quit [Ping timeout: 260 seconds]
15:59 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
16:00 < krzee> rajkosto, your ticket is updated
16:01 < krzee> the dev who coded the ipv6 payload stuff is asking for your configs
16:04 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
16:10 -!- p3rror [~mezgani@41.248.185.91] has joined #openvpn
16:13 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
16:13 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
16:31 -!- p3rror [~mezgani@41.248.185.91] has quit [Ping timeout: 276 seconds]
16:43 -!- p3rror [~mezgani@41.248.108.166] has joined #openvpn
16:48 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
16:53 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:01 -!- zooz [~zooz@host86-164-137-169.range86-164.btcentralplus.com] has joined #openvpn
17:01 < zooz> what are the differences between status-versions?
17:02 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
17:03 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Read error: Connection reset by peer]
17:04 < krzee> try each and see
17:08 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:13 -!- p3rror [~mezgani@41.248.108.166] has quit [Ping timeout: 250 seconds]
17:19 <@vpnHelper> RSS Update - forum: auth-user-pass file and encrypted password ? <http://forums.openvpn.net/topic8245.html#p12684>
17:19 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
17:19 < SJr> I assume that I can't push a new route to the servers IP can I?
17:25 -!- p3rror [~mezgani@41.140.30.197] has joined #openvpn
17:28 < Proz0id> how do i randomize the ips that ppl get assigned?
17:28 < zooz> I doubt you can
17:44 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:47 < EugeneKay> dazo_afk - I'm lazy, and making a CRL every month is something I forget to do, so I have it scripted.
17:48 < EugeneKay> Single-purpose SSH key rsyncs it out to my webserver
17:55 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:57 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:24 -!- Lenhix [ElChaman@190.146.247.20] has quit [Quit: Mindwall!!]
18:38 < krzee> forgetting or not, i give a +1 to letting scripts do *
18:38 < krzee> i spend most of my time at work scripting everything people ever ask me to do, so that i can sit here talking on IRC and playing angry birds instead of actually working
18:39 < krzee> its give me an aura of efficiency, and a job of laziness
18:39 < krzee> if i cant script it to run itself, i script it so that others can very easily control it over a web interface
18:39 < EugeneKay> At least until the scripts go pear-shaped.
18:39 < krzee> then i teach the bosses to do stuff themselves, and i go back to being lazy
18:39 < EugeneKay> Then you earn your salary
18:40 < krzee> im gunna automate myself out of a job and then just come back annually to check up on things =]
18:40 < krzee> im too lazy for this every day work stuff
18:40 < EugeneKay> For bonus points put the scripts on github and automate everybody else out of one, too
18:41 < krzee> would if they could possibly apply to others
18:41 < krzee> they are heavily customized around our db and needs
18:41 < krzee> in fact it would be impossible for any other techs here to do upkeep on them even
18:41 < krzee> and therefor, they never will get access to my servers
18:42 < krzee> which is fine, since my secret scripts will require my attention anyways
18:42 < krzee> (overlooking activity in our db, last check against hackers or an in-house thief)
18:43 < EugeneKay> Glorified security guard, eh?
18:43 < krzee> anything fishy happens and i get an email or jabber message
18:43 < krzee> heh, im turning myself into that i guess ;]
18:43 < krzee> once a tech finishes everything technical, and merely needs to glance at output from scripts, is he still being a tech?
18:44 < krzee> at one point those secret scripts might even go direct to the owner, but i gotta make it output more human readable info if im gunna do that
18:45 < krzee> right now it just dumps stuff from the db, cause i know what im looking at
18:47 -!- tty234 [telex@gateway/shell/anapnea.net/x-nfxrumqnrylomfqj] has joined #openvpn
18:47 -!- zooz [~zooz@host86-164-137-169.range86-164.btcentralplus.com] has quit [Quit: Leaving]
19:12 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:19 <@vpnHelper> RSS Update - forum: Losing the will to live - Please help!! <http://forums.openvpn.net/topic8249.html>
19:24 -!- Proz0id [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit []
19:29 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
19:30 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
19:30 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 276 seconds]
19:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
19:31 -!- yell0 [~yello@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
19:31 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
19:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:32 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
19:51 < krzie> !route
19:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
19:51 < EugeneKay> !vend
19:51  * EugeneKay cries
19:51 < EugeneKay> I have exact chaaaaaange!
19:57 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
20:00 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
20:08 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
20:10 -!- master_of_master [~master_of@p57B55A07.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:14 -!- master_of_master [~master_of@p57B55874.dip.t-dialin.net] has joined #openvpn
20:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
20:47 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:48 -!- fdarling [~Forest@adsl-99-35-213-191.dsl.sfldmi.sbcglobal.net] has joined #openvpn
20:50 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
21:05 -!- EugeneKay is now known as sannse_away
21:06 -!- sannse_away is now known as Guest78425
21:06 -!- Guest78425 is now known as EugeneKay
21:28 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has joined #openvpn
21:32 < fdarling> !welcome
21:32 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:32 < fdarling> !goal
21:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:33 < fdarling> !configs
21:33 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
21:35 < EugeneKay> !beer
21:35 <@vpnHelper> "beer" is its what's for dinner!
21:40 -!- DarthGandalf [somebody@shellium/developer/darthgandalf] has quit [Ping timeout: 260 seconds]
21:43 -!- DarthGandalf [somebody@shellium/developer/darthgandalf] has joined #openvpn
22:00 -!- Ejan [~Ejan@112.201.195.113] has quit [Ping timeout: 260 seconds]
22:04 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
22:07 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:07 -!- DarthGandalf [somebody@shellium/developer/darthgandalf] has quit [Ping timeout: 260 seconds]
22:07 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has quit [Ping timeout: 248 seconds]
22:11 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
22:19 -!- DarthGandalf [somebody@shellium/developer/darthgandalf] has joined #openvpn
22:31 -!- fdarling [~Forest@adsl-99-35-213-191.dsl.sfldmi.sbcglobal.net] has quit [Quit: Leaving.]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 244 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:25 -!- p3rror [~mezgani@41.140.30.197] has quit [Ping timeout: 250 seconds]
23:37 -!- p3rror [~mezgani@41.140.35.85] has joined #openvpn
23:47 -!- p3rror [~mezgani@41.140.35.85] has quit [Ping timeout: 276 seconds]
23:59 -!- p3rror [~mezgani@41.140.103.173] has joined #openvpn
--- Day changed Thu Jun 02 2011
00:27 -!- p3rror [~mezgani@41.140.103.173] has quit [Ping timeout: 240 seconds]
00:29 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 252 seconds]
00:30 -!- EugeneKay is now known as EugeneKaway
00:31 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
00:49 -!- Guest35640 [~jason@li14-82.members.linode.com] has quit [Changing host]
00:49 -!- Guest35640 [~jason@unaffiliated/crazygir] has joined #openvpn
00:49 -!- Guest35640 is now known as CrazyGir
00:56 -!- K1ng [~KING@180.211.188.131] has joined #openvpn
01:20 -!- sj7trunks [~Adium@c-24-6-73-170.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
01:24 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
01:30 -!- p3rror [~mezgani@41.140.42.145] has joined #openvpn
01:41 -!- EugeneKaway [eugenekay@pitofsnakesandbrokenglass.com] has quit [Ping timeout: 248 seconds]
01:41 < bystander> krzee, I cant figure out how to setup domain. 
01:53 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
01:56 -!- dazo_afk is now known as dazo
02:16 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:23 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
02:25 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
02:25 -!- Cain` is now known as Cain
02:53 -!- EugeneKaway [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
02:53 -!- EugeneKaway is now known as EugeneKay
02:59 -!- Xgates [4d5c4e32@gateway/web/freenode/ip.77.92.78.50] has joined #openvpn
03:01 < Xgates> hey guys, I'm running OpenBSD and I'm trying to connect to a vpn service I use with just a ca cert and password running the cmd like this -- openvpn --config /etc/openvpn/foo.conf --ca /etc/openvpn/certs/ca.crt I can connect to the VPN but then when I try to ping I get no route to host and I talked with someone before using OpenBSD saying it should just work out the box with no need for any system changes, so not sure...
03:07 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
03:12 < defswork> can you ping the tunnel end point ?
03:17 -!- Xgates [4d5c4e32@gateway/web/freenode/ip.77.92.78.50] has quit [Ping timeout: 252 seconds]
03:21 -!- Xgates [53aa75cb@gateway/web/freenode/ip.83.170.117.203] has joined #openvpn
03:21 < Xgates> lost connection
03:22 < rajkosto> Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/server.conf:34: route-ipv6-gateway (2.x-master)
03:22 < rajkosto> --route-ipv6 network/bits [gateway] [metric] :
03:22 < rajkosto>                   gateway default: taken from --route-ipv6-gateway or --ifconfig
03:22 < Xgates> All I've pinged was my own gateway 192.168.1.1 and that works ok, but I don't know the tunnel or end point to ping 
03:31 < defswork> Xgates, ifconfig should show you
03:32 < rajkosto> anyone know how to fix ROUTE6: default gateway detection ?
03:32 < Xgates> defswork: ok let me connect and see what's there brb
03:35 <@vpnHelper> RSS Update - forum: auth-user-pass file and encrypted password ? <http://forums.openvpn.net/topic8245.html#p12686>
03:36 -!- Xgates [53aa75cb@gateway/web/freenode/ip.83.170.117.203] has quit [Ping timeout: 252 seconds]
03:37 -!- Xgates [4d5c4e32@gateway/web/freenode/ip.77.92.78.50] has joined #openvpn
03:38 < Xgates> ok so just try to ping the inet address I see?
03:39 < Xgates>  inet 10.233.0.6 netmask 0xffff0000 broadcast 10.233.255.255
03:44 -!- Xgates [4d5c4e32@gateway/web/freenode/ip.77.92.78.50] has quit [Disconnected by services]
03:45 -!- Xgates [53aa75cb@gateway/web/freenode/ip.83.170.117.203] has joined #openvpn
03:45 < Xgates> ok well I was able to ping the inet address
03:45 < Xgates> I just can't ping out to the WAN
03:53 < defswork> routes
03:53 < defswork> do you have routes to the WAN via the ptp end ?
03:53 < defswork> and does the WAN know how to get back to 10.233.0.0 ?
03:56 -!- mastercode [~noway@69.195.138.140] has joined #openvpn
03:57 < Xgates> I'm not a big network or vpn geek so I don't know what you are saying, one thing I do know for sure is that this ran just fine in Slackware but then I had to make some firewall rules when I ran the shorewall firewall and I was told in OpenBSD it should just work by default because the firewall isn't dropping/blocking
03:57 < mastercode> small question, i got two ISP at my home, is it posble to sync bouth connetions using openvpn?
03:58 <@dazo> sync connections?
03:58 < mastercode> aka use bouth connetions
03:58 < mastercode> for more speed
03:58 <@dazo> ahh, I see ... that's not something OpenVPN can do for you ... that sounds more like some network bonding type of config
03:59 < mastercode> normaly you need get your ISP to do it for you.
03:59 < mastercode> and its hard to make a system as its two defrent ips on the end
03:59 < defswork> Xgates, I don't do BSD so don't know what it allows by default - on linux you'd need to enable ip forwarding
03:59 < mastercode> but with openvpn it be the same.
04:00 < mastercode> dazo what im asking you sure its no way to be done with openvpn?
04:00 < defswork> Xgates, if you havent got explicit routes somewhere for the 10.233 network then my guess is that your old box was masquerading all the clients
04:01 < Xgates> I never created any route rules in the firewall or for openvpn in Slackware, all I did was add in vpn rules for the firewall
04:01 < defswork> mastercode, bonding internet connections is something that your ISP has to support.  You only other option is to do selective routing via one nic or the other - you won't double speed but you could halve the load
04:01 <@dazo> mastercode: you might be able to set up two tunnels towards a server which can tackle it ... but that server needs twice the capacity of your bundled connection speed, at least
04:02 < mastercode> dazo sure its a 100 mbits server so thats no problem.
04:02 <@dazo> you can then bond the two openvpn tunnels ... but, that makes no real sense to me ... as openvpn will be sensitive for packet loss, which will reduce the speed again
04:02 < mastercode> im looking for dubel speed really as my connetions are so slow
04:03 <@dazo> get a better ISP, that's the easiest approach
04:03 < mastercode> dazo haha you mean move to a other country :)
04:03 < mastercode> dazo they want like 800 usd for a 1 mbits connetion here
04:04  * defswork has 20mb at home
04:04 < mastercode> big wop i got 100 mbits fiber back in norway
04:04 < defswork> could get 50 if I paid more
04:04 < mastercode> can get 400 if i pay more...
04:05 < mastercode> the ting is that im in cambodia
04:05 < mastercode> and hoping to get around 500kb/s stable
04:05 < mastercode> ops kbits
04:06 <@dazo> in that case, you might be able to get some effect out of bonding two openvpn tunnels ... but it needs to be tap devices
04:07 <@dazo> set up two separate OpenVPN servers (on your server with the good connection) and two separate clients and make them work independently
04:07 <@dazo> then use ethernet bonding of those two tunnels and route all your traffic that way
04:07 < mastercode> why the two seprate openvpn servers ?
04:08 <@dazo> or else you can't make bonding work
04:08 < mastercode> i can run two clients to one server cant i ?
04:09 < mastercode> then its kinda lost point agen for it kinda has to have same ip on the end. (internet ip)
04:09 <@dazo> well, you will only have one TAP device on the server ... you need two, to be able to bond that side as well
04:09 <@dazo> use different port numbers on the server
04:09 <@dazo> and each openvpn client needs to go via separate ISPs on your client side
04:10 < defswork> ip rule / ip route
04:10 < mastercode> so i need to gateways to get this working ?
04:10 < mastercode> o no i can do it with ip routing as the server got more then one ip.
04:10 <@dazo> ip rule / ip route
04:11 < defswork> you can specify multiple routing tables and then using rules determine which table is in effect
04:11 <@dazo> mastercode: A guy here tries something similar with 3G modems, connecting via two different 3G interfaces on the same device ... but the bonding stuff is kind of neatly explained here http://armitage.sytes.net/~raket/wwanbond/f3507g-bond.html
04:11 < defswork> I mark packets in the firewall to determine which nic traffic goes out via
04:13 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
04:13 <@dazo> but such setups have many challenges ... you need to ensure that the OpenVPN traffic does not go via the bonded devices ... and that each openvpn client goes via your different ISPs .... not impossible, but many traps to avoid
04:14 < defswork> aye - very complicated and fiddly
04:14 < mastercode> dazo looks like it worked for him do :)
04:14 <@dazo> well, he got some odd messages though ...
04:14 <@dazo> not sure what's causing that
04:15 <@dazo> Thu May 19 03:18:10 2011 write UDPv4 []: No buffer space available (code=105)
04:15 < mastercode> dont care about that if it works :)
04:16 < mastercode> bout one ting i missed.
04:16 <@dazo> well that error might actually cause it not to work ... but that's probably just details for you ;-)
04:16  * defswork used to access the internets on a 14.4kb modem
04:16 < mastercode> why do i have to run openvpn two times on the 100 mbits server ?
04:16 < defswork> kids today - don't know how lucky they are
04:16 <@dazo> mastercode: because you need to have a bonding setup on both sides
04:17 <@dazo> you cannot bond a single interface with traffic from two bonded devices and expect it to work .... actually that's more confusing than div-by-zero errors
04:17 < mastercode> o i was hoping that was not needed.
04:17 <@dazo> told you, it's not going to be that easy ;-)
04:18 <@dazo> in fact, this might not work well at all ... if the quality of your two ISPs are not too good, having nasty latencies and/or plenty of package drops
04:18 <@vpnHelper> RSS Update - forum: Non-Admin usage of OpenVPN on Windows <http://forums.openvpn.net/topic8251.html> || Non-Admin usage of OpenVPN on Windows <http://forums.openvpn.net/topic8250.html>
04:22 < mastercode> dazo not mutch packets lose but 400 ms
04:22 < mastercode> and on other about 300 ms
04:22 <@dazo> well, only trying will prove if it works or not
04:23  * defswork is resurrecting his blog
04:23 <@vpnHelper> RSS Update - forum: Non-Admin usage of OpenVPN on Windows <http://forums.openvpn.net/topic8250.html#p12691> || Non-Admin usage of OpenVPN on Windows <http://forums.openvpn.net/topic8252.html#p12690>
04:25 < mastercode> can i open more then one port on one openvpn server? if yes how ?
04:25 < defswork> multiple instances
04:25 < mastercode> howto/
04:27 <@dazo> openvpn --config server-1.conf & openvpn --config server-2.conf
04:27 < mastercode> really that simple ? :)
04:28 <@dazo> in fact you can simplify it by not including --port  and --ifconfig statements in the configs and then you can do:
04:28 <@dazo> openvpn --config server.conf --port 1234 --ifconfig x.y.z.w & openvpn --config server.conf --port 5678 --ifconfig a.b.c.d
04:28 <@dazo> yes, it's that easy
04:30 < mastercode> nice can i add more ports in a client config ?
04:31 <@dazo> no
04:32 <@dazo> well, you can, but only via the --remote options or inside <connection> blocks ... but it will only connect to one
04:33 < mastercode> just give a option like if port 53 udp is blcoked buy ISP
04:33 < mastercode> go to port tcp 443
04:34 <@dazo> you can't mix tcp/udp iirc ... but you can use different port numbers
04:34 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
04:36 < mastercode> dazo http://pastebin.com/DepL0TZK a client sent me this config file.
04:36 <@dazo> nice!  now I can hack myself into that server!
04:37 <@dazo> private keys exposed in public, nice touch!
04:37 < mastercode> dazo please do hack them :D
04:38 <@dazo> hmm ... it seems protocol is supported in --remote ... my mistake, I remembered wrong
04:38 < mastercode> so i can just do it like that ?
04:38 <@dazo> everything from line 28 to 117 should be a working client config 
04:39 <@dazo> well, if you can connect using that config ... sure you can do it like that
04:40 < mastercode> i test a lite lather and block udp port 53 with iptables
04:40 < mastercode> and see if it connethes to port 80 or what eva
04:40 <@dazo> yeah
04:42 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:42 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:42 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:43 < mastercode> dazo i got a question for you, a ISP in egypt has a speed cap for 3g users on 6kbits but when the use the openvpn (some times) i cant find out when, just normaly reconnethed and connethed to defrent servers a boom. gets 7.2 mbits speed.
04:43 < mastercode> any ide what why?
04:43 < defswork> they dont cap udp very well
04:43 <@dazo> no idea
04:44 < defswork> speed capping you to 6kbits is a bit tight isnt it ?
04:44 < mastercode> ye thats real bad
04:44 < mastercode> ops 64 :)
04:45 <@dazo> GPRS can technically manage 48kbit
04:45 <@dazo> ahh
04:45 <@dazo> 64 makes more sense
04:47 < mastercode> defswork ye that may be it but some times it work and some times it dos not work, like it can work one day and next day it stop working. 
04:47 -!- rkantos [robin@hp1.jaketus.net] has joined #openvpn
04:48 < defswork> thats third world telecoms companies for you
04:48 < mastercode> hehe
04:48 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
04:49 < mastercode> ok thanks for your guys help :)
04:50 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
04:50 -!- Cain` is now known as Cain
04:52 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
04:54 -!- superc [~superc@pro1259.server4you.de] has joined #openvpn
04:54 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
04:56 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
05:02 < superc> still have some problems with my vpn connection - it is terribly slow. I get a transfer rate of about 300kb/s .. if I set cipher none I get about 380kb/s. If I transfer a file directly without openvpn I get about 1200kb/s... I'm using tomato firmware on a linksys router on client side
05:03 < superc> I already changed the mtu... but without luck. This only results in changes of about 20-30 kb/s
05:04 < superc> e.g. if I set the mtu to 1300 I only get a transfer rate of about 280kb
05:12 < mastercode> tru 1400
05:15 <@dazo> superc: you might find some good hints here: https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
05:15 <@vpnHelper> Title: Gigabit_Networks_Linux – OpenVPN Community (at community.openvpn.net)
05:15 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
05:16 <@dazo> superc: also, be careful with which MTU value you modify ... --link-mtu or --tun-mtu
05:17 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
05:18 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
05:20 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
05:26 < defswork> sounds like hardware implemented traffic routing and software vpn - and the cpu isnt very quick.
05:30 < superc> yes, probably... probably I should buy a faster router....
05:31 <@vpnHelper> RSS Update - forum: Non-Admin usage of OpenVPN on Windows <http://forums.openvpn.net/topic8250.html#p12692>
05:34 < superc> is there anything beside cipher that I could switch off that causes high cpu utilization?
05:35 < superc> I tried with fragment 0 mssfix0 tun-mtu 1400 now... again 300kb
05:35 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
05:35 < defswork> ssl ?
05:36 < superc> ssl?
05:36 < superc> is this a switch?
05:42 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
05:43 < superc> ok... but on the other hand... if I look at the tweaked setup from your link, dazo, I see they have a reference configuration with 930 MBps (everything turned off) and only 407 with patches and tweaks... 
05:44 < superc> so this is actually very similar... I have 1200kb without and 300kb with openvpn... so it looks like openvpn always reduces speed by 50%
05:44 <@dazo> that's the encryption layer which causes that
05:45 <@dazo> as if you take that config and do --cipher none, you might bump the speed instantly
05:46 < superc> yes, so this is probably quite normal
05:48 <@dazo> yeah, until we figure out why we loose so much by pushing data via OpenSSL
05:49 <@dazo> we're awaiting patches which adds support for PolarSSL (instead of OpenSSL), and I'm curious how that changes the performance :)
06:02 < Xgates> to start openvpn logging should this work ---> openvpn --log --config /etc/openvpn/foo.conf --ca /etc/openvpn/certs/ca.crt
06:02 < Xgates> I'm not getting a log file in /var/log
06:04 -!- yell0 [yello@unaffiliated/contempt] has quit [Quit: leaving]
06:05 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
06:08 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
06:10 <@dazo> Xgates: --log takes a file name as an argument
06:10 <@dazo> try: openvpn --log /var/log/openvpn.log ....
06:11 -!- Xgates [53aa75cb@gateway/web/freenode/ip.83.170.117.203] has quit [Ping timeout: 252 seconds]
06:13 -!- Ejan [~Ejan@112.201.195.113] has joined #openvpn
06:35 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
06:41 -!- Xgates [4d5c4e32@gateway/web/freenode/ip.77.92.78.50] has joined #openvpn
06:42 < Xgates> hey guys, I'm running openvpn on OpenBSD and wanted to know once you make a connection are you suppose to automatically get a log in /var/log/openvpn?
06:43 < Xgates> I can connect to a vpn service I'm using that is just a ca cert/pass vpn but when I connect I'm not getting any logs and when I try to ping I get no route to the host
06:44 -!- superc [~superc@pro1259.server4you.de] has left #openvpn []
06:52 <@vpnHelper> RSS Update - forum: Connection Question <http://forums.openvpn.net/topic8253.html>
07:04 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 246 seconds]
07:07 -!- Xgates [4d5c4e32@gateway/web/freenode/ip.77.92.78.50] has quit [Ping timeout: 252 seconds]
07:11 -!- mastercode [~noway@69.195.138.140] has quit [Ping timeout: 250 seconds]
07:13 -!- Ejan [~Ejan@112.201.195.113] has left #openvpn []
07:14 -!- mastercode [~noway@114.134.188.210] has joined #openvpn
07:15 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 276 seconds]
07:18 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
07:20 < Bushmills> (13:10:06) dazo: Xgates: --log takes a file name as an argument
07:20 < bystander> krzee, I cant join in ircnet.  I just would like to ask for assistance how to setup A record and NS record.  I have public IP and domain from dot.tk  .  Kindly assist me on that please.
07:20 < bystander> or anybody.  guys maybe someone can assist me setting up the A record and NS record
07:21 < Bushmills> bystander:  /j #dns
07:21 < bystander> thanks bushmills
07:26 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Ping timeout: 252 seconds]
07:39 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
07:57 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
08:00 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
08:24 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:30 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 246 seconds]
08:34 -!- p3rror [~mezgani@41.140.42.145] has quit [Ping timeout: 240 seconds]
08:41 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
08:47 -!- p3rror [~mezgani@41.140.101.208] has joined #openvpn
08:47 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:49 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
09:07 -!- p3rror [~mezgani@41.140.101.208] has quit [Ping timeout: 246 seconds]
09:09 < krzee> that bystander guy is annoying as shit
09:09 < krzee> i gave him the iodine readme, he refused to read it and just keeps asking questions that are clearly spelt out in the readme
09:09 < krzee> he even emailed the author of iodine
09:11 < Bushmills> asked him to put the reply on audio tape? 
09:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:20 < dvl> krzee: Next time he's here, poke me, and I'll gently explain that this is not the forum for asking for DNS help.  
09:22 < Bushmills> oh, he actually went to #dns, but wasn't very successful there:  http://scarydevilmonastery.net/snap/1307024496922826566d.png 
09:27 < krzee> dont worry dvl, he'll be back
09:27 < krzee> i am leaning twords a webirc ban
09:28 < krzee> webirc users are basically useless from what i have observed
09:28 < krzee> any opinions on that?
09:29 < defswork> I've partly documented my recent vpn exploits http://blog.defsdoor.org/
09:29 <@vpnHelper> Title: Standing On The Shoulders Of Ants (at blog.defsdoor.org)
09:30 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 248 seconds]
09:32 <@vpnHelper> RSS Update - forum: Use the TAP adapter as a virtual network interface driver <http://forums.openvpn.net/topic8246.html#p12694>
09:33 < dvl> krzee: No worries there.  :)
09:35 < EugeneKay> krzee - I'm a big fan of +r
09:41 < krzee> EugeneKay, same, we got rid of that awhile ago tho
09:41 < krzee> we used to be +r
09:56 -!- luneff [~yury@84.51.197.177] has joined #openvpn
10:00  * EugeneKay yawns loudly
10:01 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
10:22 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
10:23 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
10:23 < Assid> heya
10:28 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
10:31 -!- buddha [~buddha@66.210.116.160] has quit [Ping timeout: 240 seconds]
10:47 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
11:04 -!- EugeneKay is now known as EugeneKaway
11:06 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
11:06 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:15 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
11:20 -!- newmember [~newmember@d216-232-100-14.bchsia.telus.net] has quit [Ping timeout: 250 seconds]
11:23 -!- pif [~ldm@zenon.apartia.fr] has joined #openvpn
11:24 < pif> hi, I've just subscribed to personal vpn service, what should I add to their default .conf to disable their setting a default gateway?
11:25 < pif> when I start the connection they push new routes to me but I don't want that
11:25 < krzee> !route_override
11:25 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet, or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
11:25 < pif> thx
11:26 -!- zooz [~zooz@188-220-41-110.zone11.bethere.co.uk] has joined #openvpn
11:27 < pif> !splitroute
11:27 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet, or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
11:27 < zooz> I get the following error: ERROR: --dev tun also requires --ifconfig while trying to connect to the openvpn server using openvpn client on windows 7?
11:28 < zooz> does anyone know why this error pops up?
11:30 < krzee> im guessing your server doesnt have --server
11:30 < krzee> but if youd like to do this:  ill have a better idea
11:30 < krzee> !configs
11:30 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
11:31 < pif> ok I read the !route_override but is it possible to _ignore_ any pushed routes?
11:33 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
11:34 < krzee> yes, with route-nopull, but then you must add ALL that you want yourself, including those that make a normal vpn work
11:34 < pif> great
11:36 < pif> I'd like to use the vpn only if binding to its client address
11:36 < zooz> krzee, it seems to be happening on one windows client randomly 
11:36 < pif> so I don't need routes for that, do I?
11:37 < zooz> but all the other clients (linux, mac, windows) work just fine
11:37 < pif> pushed routes I mean
11:38 < krzee> zooz, ok then give !logs too
11:38 < krzee> !logs
11:38 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
11:38 < krzee> client log should be enough
11:38 < krzee> verb 4
11:45 -!- corretico_ [~luis@186.176.7.194] has quit [Remote host closed the connection]
11:50 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
11:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
11:54 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
11:54 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
11:57 -!- sj7trunks [~Adium@171.67.170.39] has joined #openvpn
12:02 < pif> here is what the server is pushing me: http://pastebin.com/SW7SzrCu , I don't really understand what the 76.73.102.67 route is for
12:03 -!- corretico_ [~luis@186.176.7.194] has quit [Ping timeout: 250 seconds]
12:04 < krzee> when you redirect gateway over the vpn, you must have a route to the vpn itself going over your actual uplink (bypassing the vpn)
12:04 < krzee> otherwise you would have a routing loop
12:04 < krzee> in fact, my mistake
12:04 < krzee> not just when you redirect gateway
12:05 < krzee> ALWAYS
12:05 < krzee> you MUST be able to reach the vpn server without using the vpn
12:05 < krzee> this becomes important to remember IF you are redirecting gateway or the subnet that your vpn server sits on
12:05 < pif> ah right
12:05 < krzee> when you dont do either of those, you dont specificly need that route
12:07 < pif> I get it now
12:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:10 -!- zooz [~zooz@188-220-41-110.zone11.bethere.co.uk] has quit [Quit: Leaving]
12:11 < krzee> and based on how i see you're doing it, you're doing it right
12:11 < krzee> looking at that list and figuring out what should be added =]
12:12 < krzee> you may need to also add a route to the vpn subnet
12:12 < krzee> looks like thats the last entry tho, you are using an enormous subnet for --server?
12:15 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
12:16 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
12:26 < pif> actually I'd like to accept all route _except_ the default one, so back to the !route_override solution?
12:26 < pif> er, default gateway
12:28 < krzee> not really
12:28 < krzee> i think to override you need a more specific route, not sure if you can override default the same way
12:29 < krzee> feel free to test tho
12:29 < krzee> i dont have to worry bout those things, i run my servers
12:35 < pif> I'll keep looking :)
12:50 -!- buddha [~buddha@66.210.116.160] has joined #openvpn
12:54 < Assid> so anyone know why remote desktop lags when running through openvpn?
12:54 < Assid> anything that streams for that matter
13:01 < ecrist> slow connection?
13:03 < krzee> tcp as transport protocol?
13:03 < krzee> mtu issues...?
13:12 < pif> in an 'up' command is there a placeholder for the local ip?
13:12 < krzee> !scripts
13:12 < krzee> !script
13:12 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
13:14 < pif> cool
13:17 < krzee> look below at ENV VARS section
13:18 -!- EugeneKaway is now known as EugeneKay
13:23 < Assid> krzee: i tried moving from udp to tcp.. didnt help
13:23 < krzee> no no
13:23 < krzee> you want udp
13:23 < oc80z> whats good.
13:24 < Assid> hmm
13:24 < Assid> ok
13:24 < Assid> i also am trying to make ovpn work ona  windows server which would let me access other devices within the network
13:25 < Assid> but i couldnt get it working..
13:25 < Assid> unfortunately.. not in front of that machine atm..
13:27 -!- Assid [~assid@unaffiliated/assid] has quit [Quit: Ex-Chat]
13:28 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:46 -!- Belial_ [~quassel@216.18.197.178] has joined #openvpn
13:49 -!- exes [~exes@pdpc/supporter/professional/exes] has joined #openvpn
13:50 < exes> so I've noticed that the up/down scripts in my community 2.1 version will execute before the connection is established, and the down scripts will not execute when it simply disconnects
13:51 < krzee> !script
13:51 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
13:55 < exes> yeah, I've already read that
13:56 < exes> I've tried up and route up
13:56 < exes> the script is executing on the client side
13:56 < krzee> whats the script do
13:56 < exes> the script executes before even connecting, per the logs
13:57 < exes> various unrelative things
13:57 < krzee> has no impact on my question
13:57 < exes> eh, nevermind dude
13:58 < krzee> k
13:59 < exes> I realize idiots come in here, wanting to do something stupid... my script re-runs my iptables rules, changes my default gateway, generates an alert, etc
13:59 < exes> it isn't relative.
13:59 < exes> the script is executing even when it can not establish a connection, that is the issue
13:59 < exes> I can see where it's executing in the logs
13:59 < krzee> its running the script when it cant connect?
13:59 < krzee> can i see that log please
14:00 < krzee> i wasnt assuming you were doing something stupid, but to help i needed to know the goal
14:01 < exes> sure
14:01 < krzee> but now that i know it, and from the last thing you said, im wondering if we found a bug
14:01 < exes> I'm working on it
14:01 < krzee> (if you did)
14:01 < exes> the logs that is
14:01 < krzee> np, im in no rush
14:01 < krzee> another hour til i leave work
14:01 < exes> just sanitizing
14:01 < krzee> and we're not doing a meeting today... so im bored
14:01 < exes> heh
14:01 < exes> meetings are more boring
14:02 < krzee> openvpn dev meeting
14:03 < krzee> less boring than most meetings =]
14:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:03 < krzee> and attendance is obviously voluntary, which makes it automatically better than most meetings ;]
14:03 < krzee> we usually have them every thursday
14:06 < krzee> if the problem was just timing on running, you could detach the script and put a sleep in it (lame hack but should work) but the thing is, you say it runs even if the client doesnt connect
14:06 < krzee> if thats true, its a bug
14:11 < pif> regarding environment vars that the client can use in 'up/down' commands, the local tunX address is ifconfig_local ?
14:11 < pif> so I can try 'up "echo $ifconfig_local"' ?
14:13 < exes> http://pastebin.mozilla.org/1241109
14:13 < exes> I've simplified it a bit, instead of calling my script I just call "echo script_up" or "echo script_down" 
14:14 < exes> to indicate where in the process it's being executed
14:14 < krzee> pif, try echoing it out like you said
14:14 < krzee> pif, you said the right way to check, not sure why you didnt try it
14:14 < exes> line 275
14:15 < exes> doesn't seem to start the connection attempt until line 285
14:16 < krzee> exes, not what you're talking about, but this error does matter:
14:16 < krzee> Thu Jun  2 14:03:07 2011 us=958732 WARNING: potential TUN/TAP adapter subnet conflict between local LAN [192.168.249.0/255.255.255.0] and remote VPN [192.168.249.163/255.255.255.255]
14:16 < krzee> when using tun, make sure you dont have conflicting subnets
14:16 < exes> yeah, I don't understand the warning
14:16 < exes> it works in any case
14:17 < exes> I think it doesn't like me using /31s
14:17 < krzee> you are using --server 192.168.249.0 255.255.255.0 ?
14:17 < exes> no, --server 192.168.249.162 192.168.249.163
14:17 < krzee> local lan uses 192.168.249.0/24?
14:17 < exes> nope
14:17 < krzee> erm really?
14:17 < exes> local LAN is 192.168.something_else.X/24
14:17 < exes> X=0
14:18 < exes> 249/24 is dedicated for VPN tunnels only
14:18 < krzee> is 192.168.249.* used anywhere else?
14:18 < krzee> ok cool
14:18 < krzee> you wanted point to point?
14:18 < exes> yep
14:18 < krzee> dont use --server then
14:18 < krzee> or above you meant --ifconfig not --server?
14:19 < exes> actually if you were looking at my configurations on either side, neither even has the word server in it
14:19 < exes> I used ifconfig whatever whatever
14:19 < krzee> oh if you pasted those i missed it
14:19 < exes> using*
14:19 < exes> I didn't
14:19 < krzee> [12:17]  <exes> no, --server 192.168.249.162 192.168.249.163
14:20 < exes> here, I'll just paste those
14:20 < krzee> thats what made me think you used --server ;]
14:20 < exes> yep, my bad on that
14:20 < krzee> but ya, its running where its supposed to run
14:20 < krzee> you said it runs even if the client does not connect, is that true?
14:21 < krzee> see what happens if you have the script spawn another script detached, then exits happy
14:21 < krzee> tell the spawned script to sleep 30sec
14:21 < krzee> see if it in fact runs commands after sleeping
14:21 < krzee> note, you wont get the output in your vpn log, so make another way to know when it executes
14:22 < krzee> make the sleep bigger if needed to show that it actually slept
14:22 < exes> http://pastebin.mozilla.org/1241127
14:22 < krzee> ugly hack, might work
14:22 < exes> krzee: yeah, it does run even when the otherside isn't running it's VPN daemon
14:23 < krzee> perfect, logs of that please
14:23 < exes> alright
14:23 < krzee> may ask you to open a trac ticket once you have that log
14:23 < krzee> sice if that does happen, its a bug
14:23 < krzee> since*
14:23 < krzee> ohhh but before that matters, upgrade to 2.2.0
14:23 < krzee> sry, just noticed you're on an old version
14:24 < krzee> only client side should matter for this
14:24 < exes> ok
14:24 < exes> I might have to build it, since I think only 2.1 is in the Debian repos
14:25 < krzee> !download
14:25 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
14:25 < krzee> its there
14:25 < exes> I should be able to use the Lenny package for Squeeze
14:26 < krzee> whatever gets you to 2.2.0 =]
14:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
14:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:26 < krzee> thanx for going through this, if you just did find a bug it'll help us
14:26 < krzee> and if it cant be reproduced in 2.2.0, it'll help you ;]
14:27 < exes> hellz yeah
14:28 < exes> so configuration I have for 2.1 should work fine for 2.2?
14:28 < krzee> yep
14:28 < krzee> and your server will play nice, even if its 2.1
14:28 -!- Lenhix [ElChaman@190.146.247.20] has joined #openvpn
14:28 < krzee> and updating the server wont effect the test you need
14:29 < exes> yeah, still does it with 2.1
14:29 < krzee> ild still do it, but for the scope of this conversation its irrelevant =]
14:29 < exes> I'll sanitize the logs and submit it
14:29 < krzee> great thanx
14:29 < krzee> include configs
14:29 < krzee> or really, client config
14:29 < krzee> !trac
14:29 <@vpnHelper> "trac" is see http://community.openvpn.net for development information and bug tracker.
14:29 < krzee> !learn trac as if you have a forum login, use that for trac, its the same database
14:29 <@vpnHelper> Joo got it.
14:31 < krzee> i hit most people with !topsecret when they sanitize logs / configs... but in your case it was irrelevant (and i think you knew that, which is why you sanitized)
14:41 < exes> should I attach the logs or paste them in the description
14:46 < jpalmer> !topsecret
14:46 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
14:46 < jpalmer> hah
14:47 < exes> oh well, https://community.openvpn.net/openvpn/ticket/142
14:47 <@vpnHelper> Title: #142 (OpenVPN 2.2 executes user-defined "up" script before connection is attempted) – OpenVPN Community (at community.openvpn.net)
14:47 < krzee> its really not before the connection is attempted in your first log you posted
14:47 < krzee> this time you killed the server first, right?
14:47 < exes> yeah
14:48 < krzee> ahh yes you did
14:48 < krzee> and it does run
14:48 < krzee> good job bughunter =]
14:48 < exes> I FOUND A BUG!
14:50 < krzee> i changed the title slightly
14:50 < krzee> "OpenVPN 2.2 executes user-defined "up" script even when server is down"
14:50 < krzee> that way it grabs a lil more attention
14:51 < krzee> the good news is that openvpn development is much faster now than a couple yrs ago... shouldnt be too long til a solution comes
14:54 < exes> I think it would be worth noting that even when the server-side is up, it still executes the script prior to connection attempt
14:55 < exes> well thats noticeable by the logz
14:55 <@vpnHelper> RSS Update - forum: How to Avoid Routing Loop <http://forums.openvpn.net/topic8255.html> || please delete post. <http://forums.openvpn.net/topic8254.html>
14:58 -!- mastercode [~noway@114.134.188.210] has quit [Ping timeout: 240 seconds]
14:59 -!- mastercode [~noway@122.154.101.36] has joined #openvpn
15:05 -!- mastercode [~noway@122.154.101.36] has quit []
15:07 <@vpnHelper> RSS Update - forum: Yet another Ping ok, but no internet access. <http://forums.openvpn.net/topic8257.html> || Multiple clients with redirect-gateway <http://forums.openvpn.net/topic8256.html>
15:11 -!- corretico_ [~luis@186.176.7.194] has quit [Ping timeout: 250 seconds]
15:12 -!- buddha [~buddha@66.210.116.160] has left #openvpn []
15:15 -!- Proz0id [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
15:25 < pif> where can I find examples of 'up' scripts with embedded variables?
15:27 < pif> ah, found
15:28 -!- newmember [~newmember@198.162.158.20] has joined #openvpn
15:32 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:33 < krzie> pif, just make a script with env
15:33 < krzie> it'll dump the environment =]
15:34 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 250 seconds]
15:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:37 < pif> dump it where? in syslog I see nothing
15:37 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 276 seconds]
15:40 < krzie> !logfile
15:40 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
15:40 < krzie> verb 4
15:40 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
15:41 < krzie> or
15:41 < krzie> env > /path/to/output/file
15:41 < pif> ah
15:41 < krzie> adjusting the path to your output file of course ;]
15:42 < pif> sure
15:42 < krzie> make sure the script has a shbang and is +x
15:43 < pif> works :)
15:44 < EugeneKay> She bangs, she bangs
15:45 < Proz0id> anyone know if there is a way to reset the admin password in eurephia?
15:45 < krzie> find where its stored, overwrite it
15:45 < krzie> hint, ild expect it to be in the database
15:51 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
15:53 <@vpnHelper> RSS Update - forum: Yet another Ping ok, but no internet access. <http://forums.openvpn.net/topic8257.html#p12701> || Help: error=unsupported certificate purpose <http://forums.openvpn.net/topic8258.html> || How to Avoid Routing Loop <http://forums.openvpn.net/topic8255.html#p12699>
15:54 < Proz0id> krzie.....easier said than done.... it's hashed 
15:57 < krzie> remove it after saving it, hash up a new pw
15:57 < krzie> what sort of hash is it
15:58 < Proz0id> SHA512...i think
15:58  * krzie doubts
15:58 < Proz0id> :)
15:58 < krzie> !dazo
15:58 <@vpnHelper> "dazo" is "eurephia" is http://www.eurephia.net/
15:58 < EugeneKay> !vend
15:59 <@vpnHelper> RSS Update - forum: Multiple clients with redirect-gateway <http://forums.openvpn.net/topic8256.html#p12703> || Help: error=unsupported certificate purpose <http://forums.openvpn.net/topic8258.html#p12702> || sharing a folder with vpn:not works! <http://forums.openvpn.net/topic8191.html#p12503>
16:01 < krzie> see eurephia-variables man page
16:01 < krzie> may have useful info
16:02 < krzie> (can google search the code with site:http://eurephia.git.sourceforge.net/git <terms> )
16:02 < krzie> wow actually it does look strong
16:02 < krzie> http://eurephia.git.sourceforge.net/git/gitweb.cgi?p=eurephia/eurephia.git;a=patch;h=3ca97204bfb0e69f6e1a6186c800ef1eff5100b6
16:03 < krzie> he will have code there to generate a hash from a pass, use his tool
16:05 <@dazo> krzie: :)
16:05 < krzie> utils/
16:05 < krzie> Utilities which is not installed during make install. The eurephia_init program resides here together with saltdecode. eurephia_init is used to configure a new eurephia database, while saltdecode is used for debugging and will decode the password salt hashing information.
16:05 <@vpnHelper> RSS Update - forum: Losing the will to live - Please help!! <http://forums.openvpn.net/topic8249.html#p12704>
16:05 < krzie> looks interesting
16:05 < krzie> ahh there ya go
16:05 < krzie> dazo can tell ya ;]
16:05 < krzie> dazo, im impressed
16:05 <@dazo> I've just done on #eurephia :)
16:05 < krzie> rarely do i see good db encryption in use
16:06 < EugeneKay> Where do you work? Sony?
16:06 <@dazo> heh ... well, I got critics for using unsalted SHA512 hashes ... so I wanted to make sure nobody could complain ;-)
16:06 < krzie> lol nice
16:06 <@dazo> EugeneKay: me?  sony?  no way!
16:06 < krzie> EugeneKay, wasnt talking bout mine ;]
16:07 < krzie> dazo, i think he was replying to  <krzie> rarely do i see good db encryption in use
16:07 < EugeneKay> Did you see today's DB dump?
16:07 < krzie> which made it a big win
16:07 <@dazo> ahh :)
16:07 < krzie> neg, got link?
16:07 < EugeneKay> @lulzsec on twitter, basically
16:07 < EugeneKay> Sony Entertainment website, SQL injection. Amateur hour stuff.
16:07 < tuxx> does anyone know if there is an active iodine channel on irc?
16:08 < krzie> yes, ircnet
16:08 < EugeneKay> It's like Sony doesn't even bother to respond to this stuff
16:08 < tuxx> oh okay
16:08 < krzie> not very active
16:08 < krzie> 10users
16:08 < krzie> but if you wait around, yes ;]
16:08 <@dazo> EugeneKay: not again!?!?
16:08 <@dazo> That's something like the 4th time in a month, or so ... isn't it?
16:09 < EugeneKay> I think we're near a dozen
16:09 <@dazo> heh ... probably right, I've only read about the 3 others ... it's my weekly laugh usually ;-)
16:10 < krzie> funniness, i got a friend fired from sony... he was a web log analyzer basically (he'ld automate reporting) so i got him to let me see the structure for the PS3 before release day, and booya'ed us into some ps3's
16:10 <@vpnHelper> RSS Update - forum: Here is my own Auto Login script for OpenVPN <http://forums.openvpn.net/topic7779.html#p12705>
16:10 < krzie> turned out i stumbled into a VIP pool of ps3's
16:10 < krzie> for like shaq and people
16:11 < krzie> it had no built in limit since they werent actually for sale
16:11 < krzie> but the cart took them
16:11 < krzie> someone leaked it and TONS were sold
16:11 < krzie> like slashdot style tons
16:12 < EugeneKay> Lolz
16:12 < krzie> anyways, he now makes over double, which all started cause of the place he went to next
16:12 < krzie> so he was never upset, took a fatty raise when he moved jobs
16:12 -!- Belial_ [~quassel@216.18.197.178] has quit [Remote host closed the connection]
16:12 < krzie> but at that point i knew it wouldnt be TOO long til sony online got completely dominated
16:12 < EugeneKay> I read a piece on how it's a cultural problem for Sony, being a Japanese company. It's "rude" to hack, so they just don't have the mentality to defend against it.
16:13 < krzie> since they house such a monstrously juicy db and all
16:13 < krzie> for reals?
16:13 < krzie> dont they have the yakuza and shit over there?
16:13 < EugeneKay> That's what the story claimed
16:14 < EugeneKay> Yakuza is just glorified drug dealers and thugs. 
16:14 < krzie> they arent oblivious to crime
16:14 -!- [intra]lanman [~lanman@c-71-238-148-210.hsd1.mi.comcast.net] has joined #openvpn
16:14 -!- [intra]lanman [~lanman@c-71-238-148-210.hsd1.mi.comcast.net] has quit [Changing host]
16:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:14 < EugeneKay> But in high-society it's not something they think about - such things are just unthinkable.
16:14 < EugeneKay> They're all hauty-tauty and such
16:15 < krzie> hillarious if true
16:16 <@vpnHelper> RSS Update - forum: Yet another Ping ok, but no internet access. <http://forums.openvpn.net/topic8257.html#p12706>
16:36 -!- luneff [~yury@84.51.197.177] has joined #openvpn
16:57 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:07 -!- sj7trunks [~Adium@171.67.170.39] has quit [Quit: Leaving.]
17:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:09 -!- newmember [~newmember@198.162.158.20] has quit [Ping timeout: 252 seconds]
17:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
17:14 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
17:34 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Read error: Operation timed out]
17:34 <@vpnHelper> RSS Update - forum: Multiple clients with redirect-gateway <http://forums.openvpn.net/topic8256.html#p12707>
17:34 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
17:41 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
17:46 <@vpnHelper> RSS Update - forum: Help: error=unsupported certificate purpose <http://forums.openvpn.net/topic8258.html#p12708>
17:48 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
17:50 -!- dazo is now known as dazo_afk
17:57 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:01 -!- p3rror [~mezgani@41.140.32.194] has joined #openvpn
18:02 < Proz0id> i need guidance.... i want users to be able to connect to my vpn without the client ...what are my options?
18:02 < EugeneKay> Do more cocaine.
18:02 < Proz0id> tried that.... all i get is anal leakage
18:02 < Proz0id> next idea
18:12 -!- p3rror [~mezgani@41.140.32.194] has quit [Ping timeout: 250 seconds]
18:16 <@vpnHelper> RSS Update - forum: Losing the will to live - Please help!! <http://forums.openvpn.net/topic8249.html#p12709>
18:22 <@vpnHelper> RSS Update - forum: OpenVPN client behind ISA ( Forefront TMG ) <http://forums.openvpn.net/topic7945-15.html#p12710>
18:24 -!- Lenhix [ElChaman@190.146.247.20] has quit [Quit: Mindwall!!]
18:25 -!- p3rror [~mezgani@41.140.31.36] has joined #openvpn
18:28 < krzie> Proz0id, you irc using telnet dont you
18:34 <@vpnHelper> RSS Update - forum: Yet another Ping ok, but no internet access. <http://forums.openvpn.net/topic8257.html#p12712> || How to Avoid Routing Loop <http://forums.openvpn.net/topic8255.html#p12711>
18:39 < Proz0id> eugenekay:  read the howto wrong... thought it could support proxy connections
18:39 < Proz0id> 1 pt Eugenekay
18:39 < EugeneKay> I DO COCAIIIIINE
18:40 < Proz0id> "Cocaine is a hell of drug"
18:40 < EugeneKay> I subscribe to the Doctor Rockzo school of cocaine usage
18:49 < K1ng> what is better dd-wrt or tomato?
18:49 < nebajoth> depends
18:49 < nebajoth> tomato is simpler
18:50 < nebajoth> dd-wrt has more features
18:50 < nebajoth> don't think dd-wrt does mlppp yet
18:50 < nebajoth> tomato tends to fall down under heavy load
18:50 < nebajoth> but is fine for small networks
18:50 < nebajoth> with pretty graphs
18:50 < nebajoth> dd-wrt is a workhorse
18:50 < nebajoth> and has every option available under the sun
18:50 < nebajoth> most of which you'll never want or need
18:51 < K1ng> lol indeed
18:51 < nebajoth> real men use openwrt :P
18:51 < K1ng> i want duel wan (load blancing)
18:51 < K1ng> which would be good for asus n16?
18:52 < K1ng> wow no openwrt has no gui :o
18:52 < nebajoth> not sure tomato does dual wan
18:52 < nebajoth> it might
18:53 < nebajoth> oh there is a fork
18:53 < nebajoth> a chinese fork
18:53 < nebajoth> would that make it a chopstick?
18:53 < nebajoth> http://www.dualwan.cn/
18:53 <@vpnHelper> Title: 欢迎访问 Tomato DualWAN 网站 (at www.dualwan.cn)
18:53 < K1ng> wtf
18:53 < nebajoth> I'd stick with dd-wrt
18:53 < nebajoth> you can get GUIs for openwrt
18:53 < nebajoth> xwrt
18:53 < nebajoth> gargoyle
18:53 < nebajoth> but yeah, just go with dd-wrt
18:54 < nebajoth> easy/powerful
18:54 < K1ng> i already have dd-wrt
18:54 < nebajoth> then what the problem is?
18:54 < krzie> EugeneKay, is that the same school as sheen?
18:54 < Proz0id> +1 TOMATO!
18:54 < K1ng> just not sure how to do duel wan
18:54 < Proz0id> bandwidth monitoring
18:54 < K1ng> +1 dd-wrt
18:54 < K1ng> features :D
18:54 < EugeneKay> krzie - no, a lot more cocaine. a LOT more.
18:54 < nebajoth> +1 openwrt
18:54 < nebajoth> badass.
19:17 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:37 < Bushmills> http://scarydevilmonastery.net/rulesuck.png  notice the graph also contains openwrt and dd-wrt
19:38 < krzie> based on google results i assume
19:38 < Bushmills> right.  http://scarydevilmonastery.net/munin-plugins/local/rulesuckratio
19:38 < krzie> nice
19:42 < Bushmills> dd-wrt was only added yesterday, no trend visible yet
19:44 < EugeneKay> I pprove of the downward trend for solaris
19:47 < Bushmills> windows was way down until win7 hit the market, gained a lot then - was temporarily not even last - and has been slowly dropping for a while again now
19:47 < EugeneKay> Do you have a longer history?
19:48 < EugeneKay> Or the raw data, even.
19:50 < Bushmills> http://scarydevilmonastery.net/rulesuck.month.png
19:50 < EugeneKay> On a related note, still my favorite Google Trends listing of all time: https://www.google.com/trends?q=anal+fisting
19:50 <@vpnHelper> Title: Google Trends: anal fisting (at www.google.com)
19:50 < Bushmills> http://scarydevilmonastery.net/rulesuck.year.png  a bit chaotic, this one
19:51 < EugeneKay> Also titled, "What the hell happened in 2006?"
19:51 < krzie> by month has bad markers on the bottom of the graph
19:51 < krzie> still says by week
19:51 < EugeneKay> Or, "What the hell is wrong with the Czech Republic?"
19:51 < krzie> and by year has markers saying month
19:52 < krzie> now i see by week has days on bottom
19:52 < krzie> tags are 1off?
19:52 < Bushmills> by year means over a period of a year
19:52 < krzie> oh ok
19:53 < krzie> by week to me assumes intervals of a week
19:53 < krzie> like for the year, by day
19:54 < Bushmills> day is not off by one. the vertical bolder lines are midnight.  that was about 3 hours ago, local time
19:54 < Bushmills> left of bolder line is still jun02
20:01 < Bushmills> https://www.google.com/trends?q=world+trade+center  is interesting
20:01 <@vpnHelper> Title: Google Trends: world trade center (at www.google.com)
20:11 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
20:12 -!- master_of_master [~master_of@p57B55874.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:13 -!- master_of_master [~master_of@p57B55AF0.dip.t-dialin.net] has joined #openvpn
20:23 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 252 seconds]
20:37 < ecrist> boats and hos
20:47 -!- EugeneKay is now known as EugeneKaway
20:55 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:46 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 244 seconds]
21:49 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
22:03 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Read error: Operation timed out]
22:03 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
22:09 -!- DarthGandalf [somebody@shellium/developer/darthgandalf] has quit [Read error: Operation timed out]
22:11 -!- DarthGandalf [somebody@shellium/developer/darthgandalf] has joined #openvpn
22:13 -!- p3rror [~mezgani@41.140.31.36] has quit [Ping timeout: 250 seconds]
22:17 -!- ronnocol [~lance@2001:1868:214::bad:babe] has quit [Ping timeout: 260 seconds]
22:18 -!- EugeneKaway is now known as EugeneKay
22:27 -!- cch [~user@2001:da8:8001:111:222:68ff:fe14:6de] has joined #openvpn
22:27 < cch> !welcome
22:27 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:28 < cch> !topology
22:28 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
22:29 < cch> is it possible to tunnel openvpn traffic over ssh port forwarding tunnel?
22:31 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
22:31 < bystander> guys please help me setup best rule for ddos attack
22:32 < bystander> can someone explainthis to me how this works:   iptables -A syn-flood -m limit --limit 10/second --limit-burst 50 -j RETURN
22:33 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 250 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:38 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
22:42 -!- ronnocol [~lance@2001:1868:214::bad:babe] has quit [Ping timeout: 260 seconds]
22:42 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
22:52 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
22:52 -!- newmember [~newmember@d216-232-100-14.bchsia.telus.net] has joined #openvpn
22:53 < bystander> please help me setup the best  iptables for ddos attack
22:53 < bystander> what is the explanation for this:   iptables -A syn-flood -m limit --limit 10/second --limit-burst 50 -j RETURN
23:08 < EugeneKay> bystander - in a word, no, we can't.
23:09 < EugeneKay> Actually that's a phrase but GET OFF MY LAWN YOU MEDDLING KIDS
23:11 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
23:17 < jeev> looks like he was ddosed off
23:17 < jeev> haha
23:17 < jeev> or.. you know
23:20 < EugeneKay> I haven't the patience to suffer morons.
23:20 < EugeneKay> Fools, sure, but not morons.
23:26 -!- p3rror [~mezgani@41.140.98.20] has joined #openvpn
23:40 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
23:42 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:46 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has quit [Ping timeout: 258 seconds]
23:47 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has joined #openvpn
23:47 -!- Proz0id [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
23:48 < krzie> aww
23:49 < krzie> i ignored *!*@*webchat* forgot freenode spoofs it
23:49 < krzie> gotta ignore *!*@*/web/* too
23:49 < krzie> there we go!
23:50 < EugeneKay> I quite like running around without a cloak.
23:51 < krzie> i bet you do
--- Day changed Fri Jun 03 2011
00:02 -!- p3rror [~mezgani@41.140.98.20] has quit [Ping timeout: 276 seconds]
00:09 -!- cch [~user@2001:da8:8001:111:222:68ff:fe14:6de] has quit [Ping timeout: 260 seconds]
00:15 -!- p3rror [~mezgani@41.140.153.195] has joined #openvpn
00:32 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has quit [Read error: Connection reset by peer]
00:32 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has joined #openvpn
00:32 <@vpnHelper> RSS Update - forum: VHD problem <http://forums.openvpn.net/topic8259.html>
00:45 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 250 seconds]
00:46 -!- cch [~user@2001:da8:8001:240:222:68ff:fe14:6de] has joined #openvpn
00:50 < EugeneKay> Is that even an OpenVPN question
00:50 < EugeneKay> Or is he just on the drugs
00:59 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has quit [Ping timeout: 258 seconds]
01:03 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has joined #openvpn
01:09 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has quit [Read error: Connection reset by peer]
01:09 -!- newmember [~newmember@d216-232-100-14.bchsia.telus.net] has quit [Quit: Leaving]
01:10 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has joined #openvpn
01:21 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
01:41 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has quit [Ping timeout: 258 seconds]
01:43 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has joined #openvpn
01:43 -!- p3rror [~mezgani@41.140.153.195] has quit [Read error: Operation timed out]
01:52 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has quit [Ping timeout: 258 seconds]
01:52 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has joined #openvpn
01:59 -!- FlaPer87 [~FlaPer87@unaffiliated/flaper87] has joined #openvpn
02:00 -!- p3rror [~mezgani@41.140.101.42] has joined #openvpn
02:04 -!- corretico [~luis@201.201.44.82] has joined #openvpn
02:08 -!- EugeneKay is now known as EugeneKaway
02:12 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:13 < bystander> good day all. can I ask questions about iptables for now here. I guess no one is around yet on netfilter
02:17 -!- dazo_afk is now known as dazo
02:20 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
02:25 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:29 -!- p3rror [~mezgani@41.140.101.42] has quit [Ping timeout: 240 seconds]
02:54 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
02:56 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 244 seconds]
03:09 < defswork> :)
03:10 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 276 seconds]
03:10 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
03:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:34 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
03:42 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
03:47 < defswork> hmm - now I've started reading about ciphers and I'm not convinced I've made the right choice
03:49 < defswork> I'm reading that ssl-vpn-revolution document - it's 7 years old mind so not sure if things have changed much since then
03:49 < defswork> but if I'm looking at high number of users I should use BF-CBC ?
04:20 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:37 < Bushmills> probably.  blowfish is relatively efficient.
04:38 <@dazo> BF is strong on weaker hardware ... it basically performs the same on both low-end and high-end equipment
04:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:39 <@dazo> but AES-256 is stronger, from a cryptologic point of view ... and if you have CPU's which supports AES-NI, OpenVPN can make use of that via OpenSSL (--engine aesni)
04:39 <@dazo> and if you hae AES-NI support, it is very fast
04:39 < defswork> what cpus have that ?
04:40 < Bushmills> though number of users is not really a good criterium.  one single user maxing out the line requires about the same amount of encryption than 100 users
04:41 < Bushmills> as 100 users ..
04:41 <@dazo> defswork: many Intel Core CPUs ... at least i5 and i7
04:41 <@dazo> there are some similar support in some of the AMD CPUs as well
04:42 < Bushmills> projected bandwidth may be a better metric
04:42 <@dazo> agreed
04:49 -!- JPT [~JPT@star-sim.de] has joined #openvpn
04:49 < JPT> !welcome
04:49 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:49 < JPT> !goal
04:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:49 -!- FlaPer87 [~FlaPer87@unaffiliated/flaper87] has left #openvpn []
04:49 < JPT> mh..kay
04:51 < JPT> I've got some problems with the vars-file for creating the certificates. i copied the easy-rsa directory, edited the vars file and saved it. then, i did ./vars and ./clean-all. but when i do "echo $KEY_CITY", i get the default value, not the one i put into vars. I need suggestions to debug that :)
04:52 < JPT> i already checked the vars-file for comments or things that might make it exit before it reaches the export-lines for KEY_CITY and so on... but i did not find anything special
04:55 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
04:56 < JPT> aaah, i just found my mistake...
04:56 < JPT> . ./vars != ./vars >.>
04:56 < JPT> thanks for listening :)
04:56 -!- JPT [~JPT@star-sim.de] has left #openvpn ["Verlassend"]
04:57 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
05:02 < defswork> no one can give me real usage estimates - simultaneous clients or throughput so I'm working on the theory that if I expect the worse and can cope with it I can't go wrong
05:02 <@vpnHelper> RSS Update - forum: problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html>
05:02 < defswork> I dont know why but I was using 3DES
05:12 < defswork> I think I picked one that our IT dept might have heard of just do they could mumble and kick the tyres
05:20 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:20 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:20 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:32 <@vpnHelper> RSS Update - forum: OemWin2k.inf specify network adapter name <http://forums.openvpn.net/topic8261.html>
05:37 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 240 seconds]
05:49 -!- lkthomas [~lkthomas@061093187001.static.ctinets.com] has quit [Quit: Leaving]
05:50 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
05:53 -!- FlaPer87 [~FlaPer87@unaffiliated/flaper87] has joined #openvpn
05:54 < FlaPer87> hey guys, I've a server with bind and openvpn installed. It is happening to me that when I'm using openvpn I can access the domains defined in my bind configuration but not the external ones. For example, I can access myinternaldomail.com but not google.com, is this related to openvpn or bind? When I'm at office using the same dns server I can navigate without problems
05:54 < FlaPer87> any idea?
05:57 < Bushmills> the name server which resolves myinternaldomail.com isn't set up to do recursion
05:57 < FlaPer87> Bushmills ok, i'll check
06:00 -!- FlaPer87 [~FlaPer87@unaffiliated/flaper87] has quit [Remote host closed the connection]
06:01 -!- cch [~user@2001:da8:8001:240:222:68ff:fe14:6de] has quit [Ping timeout: 260 seconds]
06:04 -!- FlaPer87 [~FlaPer87@unaffiliated/flaper87] has joined #openvpn
06:04 < FlaPer87> Bushmills hmm, I set the namserver recursion to yes but I still have the same problem
06:05 < Bushmills> that assumes that the server resolving myinternaldomail.com  is also the one queried by the client.
06:06 < FlaPer87> Bushmills that's correct, I think I'm missunderstanding something
06:06 < FlaPer87> I added the domain/dns push to my openvpn config
06:06 < Bushmills> (as opposed to client querying another server which then queries the one which is authoritative for myinternaldomail.com)
06:07 < FlaPer87> that dns domain is the same that resolves myinternaldomain.com
06:07 < FlaPer87> when I start openvpn I find that dns inside my resolve.conf
06:07 < FlaPer87> which I assume is correct
06:07 < FlaPer87> With that I can access myinternaldomain.com but not google.com
06:08 < Bushmills> that's the bind on your openvpn server which doesn't recurse?
06:08 < FlaPer87> Bushmills yeap
06:08 < Bushmills> then it is misconfigured
06:08 < FlaPer87> but I added recursion yes to the bind configuration
06:08 < Bushmills> so it works?
06:08 < FlaPer87> nope
06:08 < Bushmills> then it is misconfigured
06:09 < FlaPer87> ok, so it is a bind issue
06:09 < FlaPer87> thnx, that's a good start :)
06:09 < Bushmills> evidently, the server receives requests
06:10 < Bushmills> as it resolves your local hosts
06:10 -!- vivas [~vivas@110.159.251.86] has joined #openvpn
06:12 < vivas> hi, i have a question regarding installing/compiling openvpn from source with no encryption. Is there flag to exculde the vpn encryption? If so, how can I do that?
06:15 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
06:16 -!- defswork [~andy@mx1.3gcomms.co.uk] has quit [Quit: Ex-Chat]
06:18 < FlaPer87> Bushmills thanks a lot, i fixed it, it was a recursion problem... After adding recursion yes I had to add 2 other paramters to specify the acl permissions
06:18 < FlaPer87> thnx again
06:29 < cron2> !gigabit
06:29 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
06:30 -!- FlaPer87 [~FlaPer87@unaffiliated/flaper87] has left #openvpn []
06:39 < vivas> !gigabit
06:39 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
06:39 -!- defswork [~andy@hns01-fw.internal.gxn.net] has joined #openvpn
07:00 -!- defswork [~andy@hns01-fw.internal.gxn.net] has quit [Ping timeout: 252 seconds]
07:13 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
07:28 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
07:30 -!- vivas [~vivas@110.159.251.86] has quit [Quit: Leaving]
07:32 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
07:33 < bystander> guys kindly help to block ddos attack using iptables.  I guess no one is there in netfilter
07:39 <@vpnHelper> RSS Update - forum: Multiple VPN connections <http://forums.openvpn.net/topic8262.html>
07:41 < ecrist> bystander: that's out of the scope of this channel
07:49 < bystander> ecrist, yes I know. but I was hoping that someone can give me input anyway.  I am in netfilter but no one is answering. I dont know why. maybe they are not around or something.
07:49 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:49 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:49 < ecrist> not sure, but don't really care. ;)
07:50 < ecrist> bystander: the thing with DDOS is that, if you're uplink is saturated, it's saturated, there's nothing you can do
07:51 < bystander> ecrist, what do you mean?
07:53 < ecrist> I'm not sure how to explain it differently.
07:53 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:54 < ecrist> bystander: if it's raining outside, you can close the doors and windows to stay dry, but outside, it's still raining
07:55 < ecrist> the same applies during a ddos, the solution has to come from up stream of you, to make it stop raining
07:56 < bystander> ecrist I have read some article on google. and I want to confirm it somehow
07:56 < ecrist> gee, that's helpful
08:05 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:06 -!- cch [~user@2001:da8:8001:111:222:68ff:fe14:6de] has joined #openvpn
08:12 <@dazo> ecrist: that's a very good metaphor for ddos!
08:13 -!- Pr0zoid [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
08:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
08:38 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:44 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:45 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:48 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:53 < ecrist> dazo: thanks, only thing I could come up with.
08:54 <@dazo> I'm going to use that one later on :)
08:54 < ecrist> feel free!
09:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:15 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 255 seconds]
09:17 -!- L33 [~lee@li140-167.members.linode.com] has quit [Ping timeout: 276 seconds]
09:23 < oc80z> loo
09:23 < oc80z> morning 
09:27 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
09:27 -!- L33 [~lee@li140-167.members.linode.com] has joined #openvpn
09:28 -!- DarthGandalf [somebody@shellium/developer/darthgandalf] has quit [Quit: Bye]
09:36 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
09:36 -!- gyyrog [~gyyrog@adsl-99-156-28-233.dsl.klmzmi.sbcglobal.net] has joined #openvpn
09:44 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
09:59 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
09:59 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
09:59 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:06 -!- gyyrog [~gyyrog@adsl-99-156-28-233.dsl.klmzmi.sbcglobal.net] has quit [Ping timeout: 240 seconds]
10:09 -!- FP|Maverick-work [~commo@h64-141-120-20.pcccinc.net] has joined #openvpn
10:12 -!- EugeneKaway is now known as EugeneKay
10:17 -!- tsanhwa [~user@2001:da8:8001:111:222:68ff:fe14:6de] has joined #openvpn
10:18 -!- tsanhwa [~user@2001:da8:8001:111:222:68ff:fe14:6de] has quit [Read error: Connection reset by peer]
10:18 -!- cch [~user@2001:da8:8001:111:222:68ff:fe14:6de] has quit [Write error: Connection reset by peer]
10:24 -!- gyyrog [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has joined #openvpn
10:26 -!- gyyrog_ [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has joined #openvpn
10:28 -!- gyyrog__ [~gyyrog@adsl-99-156-28-233.dsl.klmzmi.sbcglobal.net] has joined #openvpn
10:28 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 255 seconds]
10:29 -!- gyyrog [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has quit [Ping timeout: 252 seconds]
10:29 -!- gyyrog___ [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has joined #openvpn
10:29 -!- L33 [~lee@li140-167.members.linode.com] has quit [Ping timeout: 276 seconds]
10:31 -!- gyyrog_ [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has quit [Ping timeout: 240 seconds]
10:31 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
10:31 -!- dazo is now known as dazo_afk
10:31 -!- mode/#openvpn [+o mattock] by ChanServ
10:33 -!- gyyrog__ [~gyyrog@adsl-99-156-28-233.dsl.klmzmi.sbcglobal.net] has quit [Ping timeout: 276 seconds]
10:45 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
10:45 -!- mode/#openvpn [+o mattock1] by ChanServ
10:46 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 244 seconds]
10:48 -!- gyyrog [~gyyrog@adsl-99-156-28-233.dsl.klmzmi.sbcglobal.net] has joined #openvpn
10:49 -!- gyyrog_ [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has joined #openvpn
10:50 -!- gyyrog___ [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has quit [Read error: Connection reset by peer]
10:51 <@vpnHelper> RSS Update - forum: Windows7 not using Interface <http://forums.openvpn.net/topic8263.html>
10:52 -!- L33 [~lee@li140-167.members.linode.com] has joined #openvpn
10:53 -!- gyyrog [~gyyrog@adsl-99-156-28-233.dsl.klmzmi.sbcglobal.net] has quit [Ping timeout: 250 seconds]
10:57 <@vpnHelper> RSS Update - forum: VPN with different VPSes <http://forums.openvpn.net/topic8264.html>
11:00 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
11:01 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
11:01 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
11:06 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
11:13 -!- K1ng [~KING@180.211.188.131] has quit [Ping timeout: 252 seconds]
11:25 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Quit: Bye]
11:27 <@vpnHelper> RSS Update - forum: Yet another Ping ok, but no internet access. <http://forums.openvpn.net/topic8257.html#p12720>
11:29 -!- K1ng [~KING@180.211.188.131] has joined #openvpn
11:33 -!- gyyrog_ [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has quit [Ping timeout: 260 seconds]
11:33 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
11:38 -!- dazo_afk is now known as dazo
11:39 -!- gyyrog [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has joined #openvpn
11:42 < exes> krzee: you there?
11:56 < ecrist> exes: you're better off just asking questions, other people here know a thing or two about openvpn
11:58 < exes> the question actually pertains to him
11:58 < exes> not a help with OpenVPN question
11:58 < exes> thanks though
11:59 < exes> however since people are here, I also have one of those type of questions... why can't I do /31s with ifconfig-pool?
12:01 -!- luneff [~yury@84.51.197.177] has joined #openvpn
12:02 < Bushmills> because that'll leave only two addresses, where at least 4 are needed
12:02 < Bushmills> in essence, /31 breaks RFC
12:03 < Bushmills> well. violates RFC
12:03 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
12:03 < exes> what RFC?
12:04 < exes> for point-to-point, there's isn't any need for 4 addresses... that's just a waste
12:04 < Bushmills> search the relevant ones on CIDR
12:04 < FP|Maverick-work> exes, ipv4 requires a network address and broadcast address for every subnet
12:04 < exes> FP|Maverick-work: requires?
12:04 < FP|Maverick-work> exes, yes
12:04 < exes> you guys don't know what you're talking about :D
12:05 < exes> I run a 600 router network with /31s only
12:05 < exes> 60*
12:05 <@dazo> exes: if you're such a smartass, then you'll figure out the openvpn stuff on your own as well
12:05 < exes> dazo: I wasn't trying to be a smartass
12:06 <@dazo> that's just how it sounds like
12:07 < ecrist> exes: if you don't know about proper CIDR and you route a '600 router network' your boss is a retard.
12:07 < exes> I tell him that all the time
12:08 < FP|Maverick-work> you can do point to point links with a /31 its just not done that often
12:08 < exes> heaven forbid we reserve IPv4 space!
12:09 < FP|Maverick-work> you could do the same with /32 on each end
12:09 < FP|Maverick-work> and explicit routes
12:09 < exes> that's what a /31 tunnel technically is
12:09 < exes> there is still a broadcast domain there, so OSPF works
12:09 < exes> as do packets
12:09  * ecrist doesn't care to help someone with a fucked up network topology
12:09 < ecrist> :)
12:10 < exes> ecrist: "a fucked up network topology" is relative
12:10 < exes> our ISPs do it the same way
12:10 < exes> but thanks any for agreeing with me about my boss
12:11 < exes> anyway*
12:13 -!- K1ng [~KING@180.211.188.131] has quit [Ping timeout: 240 seconds]
12:13 < exes> so before I go putting in a feature request, I just wanted to be sure... there is no hook for when a connection is established and lost, only for up/down/route-up/etc
12:14 < exes> things you have to use ifconfig-pool for
12:14 < exes> yesterday krzee and I thought we found a bug, that's why I pinged him earlier was to tell him to check out the trac ticket
12:15 < exes> we didn't realize that you would have to use ifconfig-pool on the server-side, and pull on the client-side for up/down to work the way we expected it to
12:18 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
12:33 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
12:43 -!- gyyrog [~gyyrog@75-129-81-142.static.aldl.mi.charter.com] has quit [Remote host closed the connection]
12:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:52 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
12:56 <@vpnHelper> RSS Update - forum: Problems with Windows 7 client from behind router <http://forums.openvpn.net/topic8248.html#p12721>
12:59 -!- xerootg [6b0408a7@gateway/web/freenode/ip.107.4.8.167] has joined #openvpn
13:03 < xerootg> I have an openvpn client that looses local network connectivity. ubuntu 10.04, openvpn 2.1.0. the only way i can ssh into the computer is over the vpn. what do i need to do?
13:04 -!- DeeJayTwo [~deejay2@office.abi.ca] has quit [Quit: My damn controlling terminal disappeared!]
13:05 < EugeneKay> !paste
13:05 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
13:05 < EugeneKay> !configs
13:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
13:06 < xerootg> http://pastebin.com/F3XkK5TQ
13:06 < xerootg> thats client. im getting server now
13:07 < xerootg> http://pastebin.com/yi4WvuTu
13:07 < xerootg> theres server
13:08 -!- k4v [~kav@g226094029.adsl.alicedsl.de] has joined #openvpn
13:08 < EugeneKay> Do any of the routes being pushed conflict with the LAN ip of the client?
13:08 < k4v> !welcome
13:08 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:09 < k4v> !goal
13:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:09 < EugeneKay> I avoid 192.168.x.x entirely. I use a coupla randomly-picked /23(not /24) blocks in 10.x.x.x
13:10 < xerootg> well the clients ip is 192.168.67.201, im pushing a route to 192.168.67.0/24
13:10 < EugeneKay> That's why.
13:11 < k4v> !howto
13:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:11 < xerootg> eugenekay its worked in the past, and quite well.
13:11 < xerootg> this is an established network, im just replacing one of the endpoints
13:11  * EugeneKay shrugs
13:12 < xerootg> i usted the EXACT same config
13:12 < xerootg> *used
13:12 < EugeneKay> It's a routing problem.
13:12 < EugeneKay> Plain and simple
13:12 < xerootg> ok, whats the routing problem? maybe i dont understand.
13:12 < EugeneKay> The client is sending traffic destined for it's LAN subnet down the VPN instead
13:13 < EugeneKay> You probably want a ccd/ with an iroute directive for that client
13:13 < EugeneKay> I'm guessing you're doing a site-to-site-to-site VPN?
13:13 < xerootg> ok, i think i remember setting this up now, i needed a memory jog
13:14 < EugeneKay> You probably already have the ccd/, jsut need to move the file to the new endpoint's common ame
13:14 < EugeneKay> name*
13:14 < xerootg> exactly
13:14 < xerootg> the old name was server3 the new is vpn2
13:14 < xerootg> your the shit, thanks!
13:14 < EugeneKay> you're*
13:14 < k4v> hi, i got the error 'TLS handshake failed', i read the faq. my open-vpn-server runs in a vm, i configured port forwarding to udp 1194 . i can see the error in the server logs as well, so the client seems to reach the server, but then fails...
13:15 < EugeneKay> !paste
13:15 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
13:15 < EugeneKay> Logs, configs plz :-p
13:15  * EugeneKay is in a problem-solving mood
13:17 < ecrist> !logs
13:17 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
13:17 < ecrist> !configs
13:17 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
13:17 < ecrist> get it right, EugeneKay 
13:17 < ecrist> :)
13:18  * EugeneKay points up to where he just did that
13:18 < EugeneKay> (or was that after this one joined? I have join/parts hidden, you spammy bastids)
13:18 < ecrist> after, sorry.
13:18  * ecrist goes back to his corner
13:20 < k4v> here is my config & logs: http://pastebin.com/Ciny5CiR
13:21 < k4v> thanks =)
13:22 < EugeneKay> Firewall.
13:24 < k4v> you mean the firewall kills the outgoing udp packets?
13:24 < k4v> the packets are reaching the server..
13:30 < EugeneKay> http://openvpn.net/index.php/open-source/faq/79-client/253-tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity.html
13:30 <@vpnHelper> Title: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) (at openvpn.net)
13:30 < EugeneKay> Something with that. It's the sort of thing you need to "just fiddle with" until you figure out what exactly is causing it to barf
13:31 < k4v> thanks, i will do some iptables logging
13:33 -!- K1ng [~KING@180.211.188.131] has joined #openvpn
13:35 < k4v> eugenekay: hm there are not packets dropped...
13:36 < EugeneKay> Then it's one of the other misconfigurations listed at that link :-p
13:37 < k4v> hm i dont think so..
13:37 < k4v> the remote directive points to the public ip, right?
13:37 < EugeneKay> Correct
13:38 < k4v> and the server gets the incoming connection so the forwarding works
13:38 < k4v> is there some problem with communicating back?
13:39 < k4v> thanks for your time =)
13:44 -!- drmusic [~drmusic@173.236.66.247] has joined #openvpn
13:46 < drmusic> !welcome
13:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:47 -!- drmusic [~drmusic@173.236.66.247] has quit [Client Quit]
13:51 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:53 -!- xerootg [6b0408a7@gateway/web/freenode/ip.107.4.8.167] has quit [Quit: Page closed]
14:02 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
14:02 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
14:02 -!- mode/#openvpn [+o mattock] by ChanServ
14:06 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
14:10 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
14:10 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
14:10 -!- mode/#openvpn [+o mattock] by ChanServ
14:12 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:23 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
14:24 <@vpnHelper> RSS Update - forum: Yet another Ping ok, but no internet access. <http://forums.openvpn.net/topic8257.html#p12722>
14:24 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
14:24 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
14:43 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
14:43 -!- mode/#openvpn [+o mattock] by ChanServ
14:46 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
14:49 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
14:49 -!- mode/#openvpn [+o mattock1] by ChanServ
14:49 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Connection reset by peer]
15:11 -!- mattock1 [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
15:14 -!- mode/#openvpn [+o mattock] by ChanServ
15:21 -!- cmb [~cmb@pfsense/coreteam/cmb] has joined #openvpn
15:22 < cmb> anyone ever seen OpenVPN GUI on Windows 7 64 bit not able to connect, though that config and system works 100% fine run from a command propmt?  connect does nothing, view log does nothing.  it's run as administrator 
15:23 < krzie> nope, in fact quite the contrary ive heard reports that it works fine
15:23 < cmb> yeah i've installed it...at least 100 times and never seen anything like this. 
15:24 < cmb> both 2.2.0 and 2.1.4 do the same.  it's a fresh windows install, hardly anything installed on it 
15:25 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:28 < EugeneKay> Nope. Always worked great for me.
15:28 < EugeneKay> Wht's the logs say ?
15:30 < cmb> can't even view the logs, clicking that doesn't bring up anything like it always has for me.  only menu item there that does anything is exit, connect doesn't even try to launch it 
15:35 < EugeneKay> o.O
15:35 < EugeneKay> It's haunted. 
15:35 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
15:35 -!- mode/#openvpn [+o mattock] by ChanServ
15:38 -!- dazo is now known as dazo_afk
15:40 < krzie> try
15:40 < krzie> !logfile
15:40 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
15:40 < krzie> is the file named with extension .ovpn
15:50 -!- Hobbes` [~calvin@2001:4b98:dc0:47:216:3eff:fe18:5d33] has joined #openvpn
15:51 < Hobbes`> i'm getting "Bad LZO decompression header byte: 0" while trying to use a tunnel that seems to have been established okay
15:53 < krzie> make sure your comp-lzo options agree in your configs
15:54 < Hobbes`> both have "comp-lzo" on a line by itself
15:56 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
15:58 < Hobbes`> ok it was an mssfix/fragment issue
15:59 -!- Hobbes` [~calvin@2001:4b98:dc0:47:216:3eff:fe18:5d33] has left #openvpn []
16:02 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 260 seconds]
16:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:07 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
16:08 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:34 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
16:34 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
16:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:57 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:03 -!- cyberspa1e [~visa@host56-139-dynamic.44-79-r.retail.telecomitalia.it] has joined #openvpn
17:04 -!- luneff [~yury@84.51.197.177] has joined #openvpn
17:13 -!- cmb [~cmb@pfsense/coreteam/cmb] has left #openvpn []
17:23 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
17:25 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
17:39 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: Leaving]
17:39 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Quit: Ex-Chat]
17:45 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:45 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
17:58 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
17:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:58 -!- olli_ [~sYsT3m@84.38.64.117] has joined #openvpn
17:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
18:02 < olli_> hi, I want to use one connection as a connection to another network (tun0), and I want all clients to use this connection as the default gateway. Unfortunately eth0 is used as the default gateway. How can I change this.. Is this a setting in the conf or do I have to change routes / set up nat?
18:03 < EugeneKay> You need to draw us a picture.
18:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:10 -!- cyberspa1e [~visa@host56-139-dynamic.44-79-r.retail.telecomitalia.it] has quit [Ping timeout: 258 seconds]
18:13 -!- cyberspace [~visa@host41-155-dynamic.30-79-r.retail.telecomitalia.it] has joined #openvpn
18:15 -!- olli_ [~sYsT3m@84.38.64.117] has quit [Ping timeout: 276 seconds]
18:17 -!- cyberspace [~visa@host41-155-dynamic.30-79-r.retail.telecomitalia.it] has quit [Ping timeout: 250 seconds]
18:18 < Bushmills> !redirect
18:18 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
18:18 -!- cyberspace [~visa@host101-155-dynamic.30-79-r.retail.telecomitalia.it] has joined #openvpn
18:18 < Bushmills> !route
18:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:18 < Bushmills> !def1
18:18 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
18:20 < Bushmills> ehm.  gone.
18:43 -!- exes [~exes@pdpc/supporter/professional/exes] has left #openvpn []
19:07 -!- olli_ [~sYsT3m@hmbg-5f776f93.pool.mediaWays.net] has joined #openvpn
19:16 -!- k4v_ [~kav@f053147059.adsl.alicedsl.de] has joined #openvpn
19:20 -!- k4v [~kav@g226094029.adsl.alicedsl.de] has quit [Ping timeout: 250 seconds]
19:27 -!- cyberspace [~visa@host101-155-dynamic.30-79-r.retail.telecomitalia.it] has quit [Quit: tiuq\]
19:39 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
19:40 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
20:03 -!- olli_ [~sYsT3m@hmbg-5f776f93.pool.mediaWays.net] has quit [Quit: AnacønÐa · "It is impossible to make anything foolproof because fools are so ingenious"]
20:10 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 258 seconds]
20:11 -!- master_of_master [~master_of@p57B55AF0.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:13 -!- master_of_master [~master_of@p57B54578.dip.t-dialin.net] has joined #openvpn
20:14 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
21:12 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Read error: Connection reset by peer]
21:13 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
22:06 -!- K1ng` [~KING@180.211.188.235] has joined #openvpn
22:10 -!- K1ng [~KING@180.211.188.131] has quit [Ping timeout: 276 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:05 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
23:53 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 276 seconds]
23:53 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
--- Day changed Sat Jun 04 2011
00:17 -!- K1ng` [~KING@180.211.188.235] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
00:47 -!- EugeneKay is now known as HipsterKay
01:05 -!- pif [~ldm@zenon.apartia.fr] has quit [Ping timeout: 255 seconds]
01:05 -!- HipsterKay is now known as EugeneKay
01:10 <@vpnHelper> RSS Update - forum: Clear example <http://forums.openvpn.net/topic8266.html> || firewall for blocking ddos attacks <http://forums.openvpn.net/topic8265.html>
01:23 -!- bauruine [~stefan@217.150.236.196] has quit [Ping timeout: 248 seconds]
01:24 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
01:31 -!- bauruine [~stefan@217.150.236.196] has joined #openvpn
01:31 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
01:38 -!- pif [~ldm@zenon.apartia.fr] has joined #openvpn
01:39 -!- bauruine [~stefan@217.150.236.196] has quit [Ping timeout: 248 seconds]
01:52 -!- bauruine [~stefan@217.150.236.196] has joined #openvpn
01:58 -!- bauruine [~stefan@217.150.236.196] has quit [Ping timeout: 248 seconds]
02:03 -!- EugeneKay is now known as EugeneKaway
02:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:33 -!- EugeneKaway is now known as EugeneKay
03:06 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
03:16 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has quit [Ping timeout: 260 seconds]
03:23 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
03:28 -!- EugeneKay is now known as EugeneKaway
03:36 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:53 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
03:53 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 246 seconds]
04:29 <@vpnHelper> RSS Update - forum: firewall for blocking ddos attacks <http://forums.openvpn.net/topic8265.html#p12725>
04:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
04:35 <@vpnHelper> RSS Update - forum: VHD problem <http://forums.openvpn.net/topic8259.html#p12727> || Clear example <http://forums.openvpn.net/topic8266.html#p12726>
04:41 <@vpnHelper> RSS Update - forum: Multiple VPN connections <http://forums.openvpn.net/topic8262.html#p12729> || problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p12728>
04:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:57 -!- olli_ [~sYsT3m@hmbg-5f77522d.pool.mediaWays.net] has joined #openvpn
04:57 < olli_> !goal
04:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:58 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:00 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
05:00 -!- Cain` is now known as Cain
05:04 < olli_> I would like to use swissvpn on my vserver and share this secure connection with my own ovpn server. When I try to connect to the swissvpn server I get "Cannot read current deafult gateway from system". My routing table shows this: http://nopaste.info/159ffff966.html
05:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:05 < olli_> I'm running CentOS 5.6
05:11 < hyper_ch> why use swiss vpn?
05:11 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
05:12 < olli_> I need swissvpn to watch tv, because the service is area restricted
05:12 < olli_> :)
05:12 < hyper_ch> pretty sure you can watch tv without a vpn
05:13 < hyper_ch> it usually involves a tv :)
05:15 < olli_> :)
05:15 < hyper_ch> tv shows?
05:15 < olli_> I want to watch tv on my pc and save energy
05:38 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
05:54 -!- olli_ [~sYsT3m@hmbg-5f77522d.pool.mediaWays.net] has quit [Quit: AnacønÐa · "When all else fails, follow instructions"]
06:23 -!- galapo [~chompg@138.133.115.78.rev.sfr.net] has joined #openvpn
06:23 < galapo> Hello, does someone know about a free reliable vpn service provider? thanks a lot
06:24 < hyper_ch> galapo: no
06:24 < tuxx> galapo: free and reliable...
06:25 < galapo> really?
06:25 < tuxx> really.
06:25 < galapo> really?
06:25 < galapo> oups sorry
06:25 < galapo> so what about just free?
06:26 < galapo> and what about just reliable?
06:26 < hyper_ch> galapo: nope
06:26 < galapo> there is no free vpn service at all?
06:26 < hyper_ch> galapo: do you know every website on the internet?
06:27 < galapo> no
06:27 < hyper_ch> galapo: why do you expect us to know then?
06:27 < galapo> i'm not expecting you to know every website obviously
06:27 < galapo> i'm just asking to people who might know more than i do
06:27 < galapo> especially about the vpn stuff
06:28 < hyper_ch> openvpn is software that lets you setup your own vpn
06:28 < galapo> right
06:31 < galapo> do you know on which chan i could get more help?
06:32 < hyper_ch> no
06:32 < galapo> k np
06:33 < hyper_ch> just one more tip, stop asking yes/no questions if you do not intend to get a yes/no answer
06:33 < galapo> i think it's fine
06:33 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
06:34 < galapo> someone answering yes might be willing to give more details
06:34 < galapo> it's an implicit question ; "if you do know, tell me about it"
06:34 < galapo> https://www.ultravpn.fr/ this seems good for people who might be interested
06:34 <@vpnHelper> Title: UltraVPN - A Free VPN (at www.ultravpn.fr)
06:36 -!- galapo [~chompg@138.133.115.78.rev.sfr.net] has quit [Quit: chompg]
06:38 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
06:39 -!- tjz [~pc@bb116-14-152-218.singnet.com.sg] has joined #openvpn
06:39 -!- tjz [~pc@bb116-14-152-218.singnet.com.sg] has quit [Changing host]
06:39 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
06:47 -!- K1ng [~KING@180.211.188.235] has joined #openvpn
06:49 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html>
07:21 -!- onats_ [~onats@112.201.162.90] has joined #openvpn
07:21 -!- onats_ [~onats@112.201.162.90] has quit [Changing host]
07:21 -!- onats_ [~onats@unaffiliated/onats] has joined #openvpn
07:21 < onats_> hi guys, yes, my problem is my firewall
07:21 < onats_> when i enable tls authentication, which file generated from easy-rsa buildkey will be the key for the tls shared key?
07:26 -!- k4v_ [~kav@f053147059.adsl.alicedsl.de] has quit [Ping timeout: 250 seconds]
07:27 < onats_> !goal
07:27 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:28 < onats_> !tls-server
08:04 -!- onats_ [~onats@unaffiliated/onats] has quit [Quit: onats_]
08:13 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
08:18 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
08:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:30 -!- luneff [~yury@84.51.197.177] has joined #openvpn
08:42 <@vpnHelper> RSS Update - forum: Clear example <http://forums.openvpn.net/topic8266.html#p12731>
08:48 <@vpnHelper> RSS Update - forum: firewall for blocking ddos attacks <http://forums.openvpn.net/topic8265.html#p12732>
09:21 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:23 -!- K1ng [~KING@180.211.188.235] has quit [Ping timeout: 258 seconds]
09:24 < bystander> good day guys I would like to ask how will my openvpn and iptable service will start automatically after my server rebooted?
09:25 < hyper_ch> bystander: what distro?
09:25 < bystander> hyper_ch: centos 5.5
09:26 < hyper_ch> don't know
09:26 < bystander> cause everytime my server reboot, I also need to restart my openvpn and iptables services
09:26 < hyper_ch> debian and ubuntu do add openvpn to the according runlevels
09:26 < hyper_ch> by default
09:26 < hyper_ch> and same goes for iptables... but iptables is empty by default
09:27 < bystander> hyper_ch, I have configured my iptables already.
09:27 < hyper_ch> :) well, after a reboot you'll not only need to start iptables but also the rules
09:28 < bystander> yes.  I would like to start solving how to restart openvpn and iptable service on server reboot
09:29 < hyper_ch> bystander: I don't know centos... does ituse sysinitv?
09:29 < hyper_ch> I don't think it uses upstart yet
09:29 < bystander> i guess no
09:29 < hyper_ch> ask in the centos channel
09:30 < bystander> ok thanks
09:30 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
09:58 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:05 -!- K1ng [~KING@180.211.188.76] has joined #openvpn
10:14 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 246 seconds]
10:34 <@vpnHelper> RSS Update - forum: VPN for unrestricted internet access to people overseas <http://forums.openvpn.net/topic7633.html#p12733>
10:36 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
10:39 < bystander> guys I have already  check out how to set openvpn restart after boot. but will that start every server.conf file that I have?
10:39 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
10:39 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:43 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:46 -!- Pr0zoid [~awduthree@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit []
10:46 -!- Pr0zoid [~pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
10:47 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
11:22 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
11:23 < bystander> guy what am I going to do with openvpn.init. It says that To Install copy this file to /etc/rc.d/init.d/openvpn.  Am I going to copy the text from openvpn.init inside openvpn file or copy the openvpn.init to /etc/rc.d/init.d/ directory?
11:23 < Bushmills> bystander: ask bystander, he runs the same distribution as you do, and can try it out
11:24 < Bushmills> maybe he tells you after he has tried
11:24 < bystander> bushmills I am bystander and I am figuring this out
11:24 < bystander> I cant get what the article says. I am confused
11:25 < Bushmills> do you also have an openvpn question?
11:25 < bystander> bushmills: this is my openvpn question 
11:26 < Bushmills> no. this is a question related to the distribution you're running 
11:26 < Bushmills> openvpn doesn't know about init scripts.  
11:26 < Bushmills> it knows about openvpn config files. and command line arguments
11:27 < bystander> but in a way this is because the script is towards openvpn process
11:27 < krzie> Bushmills, just do what i did... ignore all webchat
11:27 < krzie> it makes 
11:27 < Bushmills> start it manually, pass configuration parameters on the command line
11:27 < krzie> it makes irc so much better
11:28 < bystander> I am just confused with this line: copy this file to /etc/rc.d/init.d/openvpn
11:28 < Bushmills> moinmoin krzie
11:28 < krzie> moin
11:28 < Bushmills> bystander: then don't copy it.
11:28 < Bushmills> less confusion
11:28 < krzie> but back to bed for me, this hangover is strong
11:30 < Bushmills> krzie: hang on a moment
11:30 < Bushmills> sorry, machine translation: http://scarydevilmonastery.net/snap/submarine.png
11:31 < bystander> bushmills: I see now. the openvpn file found in /etc/rc.d/init.d/openvpn and the openvpn.init is just the same.  No need to copy
11:40 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
11:40 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
11:40 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:03 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 252 seconds]
12:03 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
12:03 -!- EugeneKaway is now known as EugeneKay
12:14 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Ping timeout: 260 seconds]
12:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
12:48 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Ping timeout: 248 seconds]
13:09 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
13:19 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
13:27 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html>
13:30 -!- invisiblek [~invisible@97-88-5-137.dhcp.roch.mn.charter.com] has quit [Remote host closed the connection]
13:34 -!- bauruine [~stefan@217.150.236.196] has joined #openvpn
14:57 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:58 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:00 -!- pif [~ldm@zenon.apartia.fr] has quit [Read error: Connection reset by peer]
15:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:32 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
15:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:33 -!- pif [~ldm@zenon.apartia.fr] has joined #openvpn
15:35 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:43 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
16:15 <@vpnHelper> RSS Update - forum: Losing the will to live - Please help!! <http://forums.openvpn.net/topic8249.html#p12735>
16:26 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
16:32 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
16:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
16:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:34 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:42 -!- orion [orion@unaffiliated/orion] has joined #openvpn
17:42 < orion> Hi.
17:43 < orion> I am on FreeBSD 8.2-RELEASE, and I am trying to use a tap instead of a tun.
17:43 < EugeneKay> !tunortap
17:43 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
17:43 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
17:43 < EugeneKay> TAP causes AIDS
17:43 < orion> haha
17:45 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:45 < orion> Well, generally speaking is there any difference in how you route with tap vs. tun?
17:45 < EugeneKay> Yeah. You don't use tap.
17:45 < orion> heh
17:45 < orion> Why does it even exist?
17:46 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:48 < EugeneKay> Old LAN games that don't do TCP/IP
17:50 < krzee> well theres various reasons to use tap, but most often people seem to do it cause they dont know any better
17:52 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Remote host closed the connection]
17:53 < orion> hmm
17:53 < krzee> tun tunnels layer3, tap tunnels layer2
17:53 < krzee> thats the difference
17:54 < krzee> to over-simplify, tun tunnels ip, tap tunnels ethernet
17:55 < orion> When you use tap, are you bridging together two *different* segments or two of the same segments? In other words, are you bridging a ...::1::/80 and a ...::2::/80 or two ...::1::/80's?
17:55 < krzee> whichever
17:55 < EugeneKay> TAP is a very long Cat5 cable
17:56 < EugeneKay> Which is almost never what you want
17:56 < EugeneKay> If your application speaks IP, you want tun.
17:56 < krzee> exactly
17:56 < orion> Right.
17:56 < krzee> if you can use tun, you should
17:56 < orion> I understand.
17:57 < orion> The problem before was that when I tried to ping6 an IP on the other end, I got a "sendmsg: Operation not permitted" error.
17:57 < orion> I am not sure why it does that.
17:57 < orion> (Firewall is disabled, etc)
17:57 < krzee> you're using the testing branch?
17:58 < krzee> --server-ipv6?
17:58 < orion> yes
17:58 < krzee> sweet!
17:58 < krzee> what OS?
17:58 < orion> FreeBSD
17:58 < krzee> if windows, i think its broken atm
17:58 < krzee> you are also using --server right?
17:58 < krzee> --server-ipv6 needs --server as well currently
17:58 < EugeneKay> Bravo on getting FreeBSD to install.
17:58 < krzee> EugeneKay, ??
17:59 < orion> EugeneKay: ??
17:59 < krzee> i always use freebsd
17:59 < EugeneKay> The FreeBSD installers's definition of wizard mode is "I am a Wizard", not "I want you to do it for me."
17:59 < orion> krzee: Isn't that error produced by the kernel though, not openvpn?
18:00 < EugeneKay> I have never, ever been able to get it to install.
18:00 < orion> I installed it on a Lenovo laptop. ;x
18:00 < krzee> EugeneKay, stop wanting it to do stuff for you
18:00 < krzee> imho unix shouldnt do stuff for you like that
18:00 < krzee> orion, are you using --server?
18:01 < EugeneKay> That's why I use "linux" instead of "unix".
18:01 < krzee> yes, thats why i dont use "linux" ;]
18:01 < krzee> well ok, its not why
18:01 < EugeneKay> And that's the exact same attitude that has lead to linux being 9000% more popular
18:01 < krzee> the ugly ass hierarchy is why
18:01 < krzee> but i digress
18:02 < krzee> orion, you are using --server or not?
18:03 < orion> Yes.
18:03 < krzee> can i see your configs?
18:03 < krzee> maybe ill try it out
18:03 < krzee> im not sure how much fbsd testing its had
18:03 < orion> Not at the moment, I have an appointment.
18:03 < krzee> ok
18:04 < krzee> well feel free to come back, --server-ipv6 needs testing if its ever gunna make it to openvpn
18:04 < krzee> thanx for doing it =]
18:04 < orion> Alright. Thank you for your help guys!
18:04 -!- orion [orion@unaffiliated/orion] has left #openvpn []
18:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
18:08 < krzee> funny thing is if he cant get --server-ipv6 to work, he in fact does want tap ;]
18:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
18:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
18:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
18:29 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:36 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
19:40 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
19:52 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
20:11 -!- master_of_master [~master_of@p57B54578.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
20:13 -!- master_of_master [~master_of@p57B53647.dip.t-dialin.net] has joined #openvpn
20:31 -!- greencult [~greencult@200.48.85.28] has joined #openvpn
20:31 < greencult> hi all
20:34 < greencult> i tun openvpn on centos 5.6 
20:34 < greencult> why i have got this messages --> /etc/init.d/openvpn: line 169: script_security---script-security 2: command not found
20:36 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
20:36 -!- greencult [~greencult@200.48.85.28] has left #openvpn []
20:37 -!- greencult [~greencult@200.48.85.28] has joined #openvpn
20:41 < greencult> !goal
20:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:02 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 248 seconds]
21:11 -!- diytto [~diytto@zebra689.server4you.net] has joined #openvpn
21:29 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
21:37 -!- genesis [775d33d8@gateway/web/freenode/ip.119.93.51.216] has joined #openvpn
21:42 < genesis> Hello.   I am  Genesis from Asia.  I am planning for my vpn servers.  Suppose I have 3 servers on different hosts,  all the username and passwords are located on ServerA.  Servers A,B,C are running openvpn service.   Can  I  authenticate the username and password on   ServerA   and  the client  connection is on Server B o C?
21:56 < genesis> Hello.   I am  Genesis from Asia.  I am planning for my vpn servers.  Suppose I have 3 servers on different hosts,  all the username and passwords are located on ServerA.  Servers A,B,C are running openvpn service.   Can  I  authenticate the username and password on   ServerA   and  the client  connection is on Server B o C?
22:00 -!- linuxviewer [~test@c-174-52-180-201.hsd1.ut.comcast.net] has joined #openvpn
22:01 < linuxviewer> i have an openvpn server i am running in CentOS.  I have it to run the script from rc.local so that when the computer starts it executes the openvpn script.  However, when i'm on that local machine I cannot get to a command line interface.  How do I stop Openvpn from running?
22:03 < linuxviewer> it doesnt ask for username/passwrod login prompt
22:06 < linuxviewer> Anyone know how to force close the openvpn script?
22:11 -!- genesis [775d33d8@gateway/web/freenode/ip.119.93.51.216] has quit [Ping timeout: 252 seconds]
22:15 -!- Konata [~Tsukasa@unaffiliated/konata] has joined #openvpn
22:24 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html>
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:38 -!- linuxviewer [~test@c-174-52-180-201.hsd1.ut.comcast.net] has quit []
22:40 -!- Konata [~Tsukasa@unaffiliated/konata] has left #openvpn ["..."]
22:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:09 -!- rommel092079 [775d33d8@gateway/web/freenode/ip.119.93.51.216] has joined #openvpn
23:13 -!- rommel092079 [775d33d8@gateway/web/freenode/ip.119.93.51.216] has quit [Quit: Page closed]
23:23 -!- genesis [775d33d8@gateway/web/freenode/ip.119.93.51.216] has joined #openvpn
23:23 < genesis> what  is the maximum number of clients that can be handled by  openvpn ?
23:28 < EugeneKay> As many as your server can handle.
23:30 < genesis> EugeneKay, what do you  mean server  can handle?  What do I need to establish in my server? Is that  the specifications of my server?
23:30 < EugeneKay> Max number of users depends upon your server's CPU/memory/network capability.
23:31 < EugeneKay> More than a few thousand simultaneous users will probably cause interesting problems, but that applies for any type of service. 
23:34 < genesis> I am looking just up to 1000 users.  what specs do I need for that?
23:34 < genesis> EugeneKay, I am looking just up to 1000 users.  what specs do I need for that?
23:35 -!- genesis [775d33d8@gateway/web/freenode/ip.119.93.51.216] has quit [Quit: Page closed]
23:36 < EugeneKay> The default max-clients is 1024, I belive
23:37 < EugeneKay> I don't know enough about such big cases to be able to speak authoritatively, but you'll want to run multiple OpenVPN instances on a multi-core machine
23:37 < EugeneKay> (OpenVPN itself is single-threaded)
23:59 < krzie> [00:33]  <EugeneKay> More than a few thousand simultaneous users will probably cause interesting problems, but that applies for any type of service. 
23:59 < krzie> ive heard of issues before 300 before
--- Day changed Sun Jun 05 2011
00:00 < krzie> if you get to a few thousand please report it!
00:33 -!- greencult [~greencult@200.48.85.28] has quit [Quit: Lost terminal]
00:36 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
00:58 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 244 seconds]
01:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:51 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
01:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:14 -!- EugeneKay is now known as EugeneKaway
03:16 -!- rommel092079 [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
03:32 -!- rommel092079 [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
03:50 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
03:51 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
04:01 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
04:14 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
04:16 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
04:27 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
04:29 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Client Quit]
04:42 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12737>
04:59 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:00 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
05:00 -!- Cain` is now known as Cain
05:28 -!- Guifort [~Guifort@175.201.113.78.rev.sfr.net] has joined #openvpn
05:43 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
05:46 < genesis> guys if I updated my (server) openvpn to current latest version, does my client openvpn needs to be updated too? If I opt not to update the client what do I need?
05:50 -!- kryptoknight [~Adium@ip-87-86-154-70.easynet.co.uk] has joined #openvpn
05:51 -!- Guifort_ [~Guifort@ALille-255-1-52-33.w86-208.abo.wanadoo.fr] has joined #openvpn
05:53 -!- Guifort [~Guifort@175.201.113.78.rev.sfr.net] has quit [Ping timeout: 244 seconds]
06:03 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
06:03 < kisom> !gigabit
06:03 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
06:03 < genesis> what is the latest openvpn rpm package?
06:06 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
06:12 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12738>
06:15 -!- kryptoknight [~Adium@ip-87-86-154-70.easynet.co.uk] has quit [Ping timeout: 255 seconds]
06:19 -!- p3rror [~mezgani@41.140.46.140] has joined #openvpn
06:30 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12739>
06:36 < genesis> what is the latest openvpn rpm package?
06:36 < genesis> guys if I updated my (server) openvpn to current latest version, does my client openvpn needs to be updated too? If I opt not to update the client what do I need?
06:41 -!- kryptoknight [~Adium@ip-87-86-154-70.easynet.co.uk] has joined #openvpn
06:42 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
06:56 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:02 -!- kryptoknight [~Adium@ip-87-86-154-70.easynet.co.uk] has quit [Quit: Leaving.]
07:41 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
07:54 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12740>
08:40 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:41 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:41 -!- Guifort__ [~Guifort@175.201.113.78.rev.sfr.net] has joined #openvpn
08:44 -!- Guifort_ [~Guifort@ALille-255-1-52-33.w86-208.abo.wanadoo.fr] has quit [Ping timeout: 240 seconds]
08:47 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
08:47 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Ping timeout: 252 seconds]
08:49 <@vpnHelper> RSS Update - forum: Periodic timeouts <http://forums.openvpn.net/topic8270.html>
09:03 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:03 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:20 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:21 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
09:25 <@vpnHelper> RSS Update - forum: Clear example <http://forums.openvpn.net/topic8266.html#p12742>
09:33 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:55 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12743>
10:07 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
10:08 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:12 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 240 seconds]
10:21 -!- pittstains [~fgomez@173-10-186-206-BusName-washingtonDC.hfc.comcastbusiness.net] has joined #openvpn
10:23 < pittstains> !welcome
10:23 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:23 < pittstains> !goal
10:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:24 < pittstains> !route
10:24 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:37 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
10:38 < genesis> what is the solution for the error while trying to service openvpn start? it will state error on this line ( script_security-"--script-security 2" )
10:41 < Bushmills> sounds like a warning, not like an error
10:42 < Bushmills> as warning, the solution is to ignore it
10:42 < genesis> but it does not continue initializing the openvpn
10:42 < genesis> but it does not continue initializing the openvpn
10:42 < Bushmills> then there's a different problem
10:43 < Bushmills> grep and show the line containing "script-security" from the config file
10:43 < genesis> this is the same problem: http://forums.openvpn.net/topic8269.html
10:43 <@vpnHelper> Title: OpenVPN Support Forum Problem in starting openvpn : Installation Help (at forums.openvpn.net)
10:44 < Bushmills> you read the solution? "The issue is a typo in the /etc/init.d/openvpn file..."
10:44 < genesis> when I try to edit the openvpn file, it was no longer detected by the openvpn command service openvpn start
10:46 < genesis> what can I do about this?
10:46 < Bushmills> the link you pasted gives a solution. which is, correcting the typo
10:46 < Bushmills> how that relates to "not detecting file when i edit it" i have no idea
10:48 < genesis> should I edit it using nano or windows wordpad?
10:49 < Bushmills> do you prefer nano or wordpad?
10:50 < genesis> ok. thanks bushmills
10:50 -!- genesis [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
10:51 < pittstains> i'm having a problem with my openvpn setup... i can connect with a client, but i can't reach (or even ping) any other machines on the network... the server IP is 10.0.0.13, the machines I want to reach are on the 10.0.0.0 network, and I'm using bridging
10:51 < Bushmills> !route
10:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:51 < Bushmills> server is 10.0.0.13? 
10:52 < pittstains> yes it is
10:52 < pittstains> i did read the section on route... i'm not sure how/if it applies to me
10:52 < pittstains> my setup has no subnets
10:52 < Bushmills> is that a point to point configuration?  or actually a server configuration?
10:53 < pittstains> server
10:53 < Bushmills> then server would be 10.0.0.1
10:53 < pittstains> so... the openvpn server *has* to be on its own subnet?
10:53 < Bushmills> ah.  its  ethernet address is? 
10:54 < pittstains> yes, that's what i meant
10:54 < pittstains> i can send you a link to the config, if you like
10:54 < Bushmills> sorry, i thought you meant that that's the server vpn subnet address
10:54 < pittstains> i believe i'm not using a subnet at all
10:55 < Bushmills> what do you mean?
10:55 < pittstains> all the machines i'd like to reach are on 10.0.0.0, and the ethernet IP of the server is 10.0.0.13
10:56 < pittstains> i have a block in 10.0.0.0 that i'm reserving for connecting clients
10:56 < Bushmills> you say that client can connect. then it gets an ip address from the openvpn subnet
10:56 < pittstains> yes, the last one i got was 10.0.0.201
10:56 < Bushmills> you're overlapping ethernet and openvpn addresses?
10:57 < pittstains> i thought it was safe since the router doesn't give out IPs above 10.0.0.200
10:57 < pittstains> is this my first mistake? :-)
10:57 < Bushmills> no. it isn't. it creates a mess in your routing
10:58 < pittstains> so i *should* make up a subnet for the server and connecting clients, is what you're telling me.  correct? 
10:59 < Bushmills> yes. openvpn addresses should be in their own subnet.  a /24 is probably the easiest to use
10:59 < Bushmills> !1918
10:59 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
11:00 < pittstains> hm, so 10.0.1.0 is not safe to use?
11:01 < pittstains> oh wait
11:01 < pittstains> i guess i read that wrong
11:01 < Bushmills> if you're configuring routing to lans behind openvn, 10.0.1.x may not be the best choice
11:02 < Bushmills> there's a higher probability that that subnet is used in the LAN, than for example 10.173.28.0
11:02 < pittstains> i should stick to programming :-)
11:02 < pittstains> ok, i'll try that
11:02 < Bushmills> though still a better choice than using 192.168.1.0 for openvpn 
11:03 < Bushmills> essentially, you want to be certain that openvpn uses unique addresses, not found anywhere else in your LANs
11:04 < pittstains> gotcha... does this mean that my br0 interface should be configured to be 10.173.28.1?
11:04 < Bushmills> why do you need bridging at all?
11:06 < pittstains> i think i read an FAQ that said you wanted to use it for certain services, like Samba
11:06 < Bushmills> !tunortap
11:06 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:06 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
11:08 < pittstains> !wins
11:08 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
11:08 < pittstains> Bushmills: my brain hurts
11:08 < Bushmills> can't be. brain has no nerves
11:08 < pittstains> haha
11:11 < Bushmills> well, i'm not a windows user, therefore i have only gathered half-knowledge on that wins situation, which is that netbios uses for name resolution either a dns like mechanism (wins), or an arp who-has like mechanism (broadcasting to clients, let them identify themselves). latter mechanism isn't routable
11:12 < Bushmills> therefore, without wins, name resolution of windows hosts fails
11:13 < pittstains> ahhh, i think that's why i chose tap for a previous deployment... backuppc identifies windows machines my their hostnames
11:13 < pittstains> in this scenario, i don't think i need that capability
11:13 < Bushmills> unless you provide a wins server
11:13 < pittstains> i guess i just went with what i (thought i) knew
11:14 < pittstains> (i'm not a windows user either, but most offices tend to be)
11:15 < pittstains> ok... so I'm changing my config to "dev tun"... won't need the up/down scripts, then i'd remove my server-bridge line and use "server  10.173.28.0 255.255.255.0" instead....
11:15 < Bushmills> community here is a bit split into tap lazyasses and tun fascists.
11:15 < Bushmills> hope i don't get kicked for that comment
11:16 < pittstains> religious wars :)
11:16 < pittstains> do i need to push a route as well?
11:16 < Bushmills> yes, your scenario sound like one where tun would be preferable
11:17 < Bushmills> you need to push routes, yes.
11:17 < pittstains> route 10.173.28.0 255.255.255.0
11:17 < Bushmills> that's one
11:17 < pittstains> and i like to use this one: push "redirect-gateway def1 bypass-dhcp"
11:18 < Bushmills> why?
11:18 < pittstains> i like to push traffic through the VPN
11:18 < Bushmills> do you intend to use NAT to reach LAN hosts?
11:18 < pittstains> provides a little security if you're browsing from an internet cafe or whathaveyou
11:19 < Bushmills> then you need to setup vpn server to do ...
11:19 < Bushmills> !redirect
11:19 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
11:19 < pittstains> !def1
11:19 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
11:21 < Bushmills> for internet cafe scenario, i'd probably leave away the bypass-dhcp, and provide a recursive name server on the vpn server machine 
11:21 < pittstains> you know... on second thought, the client didn't ask for that :-)
11:22 < Bushmills> much more likely that internet cafe name servers are cache poisoned or redirect you to different ip addresses than your own recursive name server
11:22 < pittstains> i've already spent more time on their project than i'll be compensated for
11:23 < pittstains> dang, i'm going to have to reconfigure all the clients now
11:23 < Bushmills> well, redirecting traffic through vpn, but at the same time using an unsafe name server is a somewhat half-assed approach 
11:23 < pittstains> yeah, i mean they didn't ask for traffic to be redirected at all
11:24 < Bushmills> sell it as extra, and optinal, feature
11:24 < Bushmills> optional
11:24 < pittstains> i might :-)
11:24 < Bushmills> outline the criticality of securing traffic that way
11:25 < Bushmills> transfer a commission of 10 % to me
11:25 < pittstains> seriously!
11:27 < pittstains> although couldn't i just push DNS servers ala push "dhcp-option DNS xx.yy.zz.aa" ?
11:27 < Bushmills> yes, sure.  to windows clients.  for unixoids, an extra step is needed
11:28 < Bushmills> and providing xx.yy.zz.aa yourself may not be a bad idea 
11:31 < Bushmills> t'is just a recursor, after all
11:32 < pittstains> ok, going to test out this connection now, which will probably break my connection here
11:32 <@vpnHelper> RSS Update - forum: VHD problem <http://forums.openvpn.net/topic8259.html#p12744>
11:32 < pittstains> thanks for your help, Bushmills
11:32 < Bushmills> np
11:35 < pittstains> hm... so i changed my client config to "dev tun" and now when I run "sudo openvpn --client client.conf" I get: Options error: You must define TUN/TAP device (--dev)
11:37 <@vpnHelper> RSS Update - forum: Routing problem <http://forums.openvpn.net/topic8271.html>
11:40 < pittstains> ah, crud... i just realized... without the up/down scripts that were in my old config, don't i risk breaking my network config altogether?
11:41 < pittstains> isn't that what hooks up my eth0 and br0 interfaces, Bushmills?
11:42 < pittstains> bah, why was i typing in --client instead of --config on the CLI
11:43 <@vpnHelper> RSS Update - forum: TTL expired using bridging <http://forums.openvpn.net/topic8271.html>
11:44 < Bushmills> pittstains: --client --config client.conf
11:44 < Bushmills> or that
11:46 < pittstains> hmm, i can't ping machines in the 10.0.0.0 network
11:47 < Bushmills> !route
11:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:48 < Bushmills> !serverlan
11:48 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
11:49 < pittstains> hm, so i can't do this without tweaking the router, you say?
11:50 < Bushmills> imagine you were a network packet. then follow the route through gateways. see where you end up
11:50 < Bushmills> also consider returned packets
11:54 < pittstains> right...
11:54 < pittstains> i left out a route in my config
11:55 < pittstains> now i can get to 10.0.0.13 (the ethernet IP of the server)
11:55 < pittstains> but not anything else
11:55 < pittstains> i think the router fix will probably take care of it
11:56 < pittstains> thanks again for your help
11:56 < pittstains> my girlfriend is asking why i'm working on a sunday, so i'll have to come back to this in a little bit
11:57 < pittstains> :-)
11:58 -!- pittstains [~fgomez@173-10-186-206-BusName-washingtonDC.hfc.comcastbusiness.net] has quit [Quit: Leaving.]
12:23 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
12:29 -!- EugeneKaway is now known as EugeneKay
12:36 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:36 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:15 -!- JuJuBee [~mike_knic@24-105-231-111.cm.mhcable.com] has joined #openvpn
13:16 < JuJuBee> Greetings.  I am a vpn virgin in need of some assistance.  I wish to set up vpn server (on ubuntu 10.04) so I can connect from home as though I was on the lan at work.
13:17 -!- luneff [~yury@84.51.197.177] has joined #openvpn
13:18 < JuJuBee> In server.conf what do I set server ip mask to?  the lan interface at work? or the public facing interface?
13:19 < krzie> !confgen
13:19 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
13:25 < JuJuBee> Do I run confgen.sh or senserver.sh?
13:27 < krzie> the header of any of the files answer that
13:27 < krzie> answers that*
13:28 < JuJuBee> those 2 are the same
13:28 < krzie> correct, the header on all is the same
13:28 < krzie> and answers your question if you actually READ it
13:30 < krzie> =]
13:30 < JuJuBee> So run both of them?
13:31 < JuJuBee> nm, I see it now... just run confgen
13:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Remote host closed the connection]
13:33 < JuJuBee> So the server should listen on the public IP since I want to connect from outside?
13:35 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
13:35 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
13:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:36 < krzie> if you cant answer that you arent ready to run ANY server, including vpn
13:36 < krzie> !tcpip
13:36 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
13:55 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
13:57 < Pr0zoid>  hey guys i have a question...  I have an ip address that seems to be blocked but when i do iptables -L i don't see the blocked ip
14:03 -!- JuJuBee [~mike_knic@24-105-231-111.cm.mhcable.com] has left #openvpn []
14:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:45 < Bushmills> "don't see" beats "seems"
14:46 < Bushmills> the question you announced must have gotten lost in transit, btw.
14:53 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:03 -!- Awdu3 [~pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
15:06 -!- Pr0zoid [~pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
15:21 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:32 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
15:36 <@vpnHelper> RSS Update - forum: Accessing an ADSL router from a distant connected client? <http://forums.openvpn.net/topic8272.html>
15:40 -!- Guifort__ [~Guifort@175.201.113.78.rev.sfr.net] has quit [Quit: Quitte]
15:42 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
15:42 < rajkosto> hey guys
15:43 < rajkosto> why is the bandwidth when tunneled so much lower than when untunneled ?
15:47 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 250 seconds]
15:50 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
16:11 -!- Awdu3 [~pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has left #openvpn []
16:20 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
16:26 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
16:29 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 248 seconds]
16:30 <@vpnHelper> RSS Update - forum: OpenVPN very slow - Less then 8KB/s <http://forums.openvpn.net/topic8227.html#p12747>
16:39 < krzee> because you are forcing your route through the server
16:39 < krzee> i once had a vpn that actually sped up my internet connection when i would proxy through it
16:40 < krzee> because i had a abnormally good route to it, and it had a great route to the rest of the net, but my route to the rest of the net was crap
16:41 -!- bauruine_ [~stefan@217.150.236.196] has joined #openvpn
16:42 < Bushmills> long gone
16:42 -!- bauruine [~stefan@217.150.236.196] has quit [Read error: Connection reset by peer]
16:42 < krzee> oh right
16:42 < krzee> meh
16:43 < Rajko> who
16:44 < Rajko> i can download from the server @ 100mbps
16:44 < Rajko> with http etc
16:44 < Rajko> but if i try http over ovpn, it slows down considerably
16:44 < krzee> using udp / tun?
16:45 < Rajko> yes
16:46 < krzee> tested mtu?
16:46 < Rajko> doesnt work in testing
16:46 < krzee> also, your isp may throttle udp
16:46 < Rajko> nope
16:46 < krzee> what do you mean doesnt work in testing...?
16:46 < Rajko> i can blast udp @ max rate from server to client
16:47 < Rajko> --mtu-test unrecognized command
16:47 < krzee> what version openvpn on each side
16:48 < Rajko> IPv6 payload 20110522-1 (2.2.0) on server
16:48 < Rajko> IPv6 payload 20100922-1 on client
16:48 < krzee> !configs
16:48 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
16:48 < Rajko> how would you run a mtu-test anyway ? just put it in both server and client config ?
16:49 < krzee> only client config
16:49 < krzee> !mtu
16:49 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
16:49 < krzee> but without the --
16:49 < krzee> !--
16:49 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
16:49 < Rajko> yes i know
16:49 < Rajko> it prefixes it with -- when it says option not recognized
16:50 < Bushmills> "unrecognized command"
16:50 < Bushmills> ??
16:50 < Bushmills> Options error: Unrecognized option or missing parameter(s)   is what openvpn would say
16:50 < Rajko> yeah, that
16:51 < Bushmills> are you trying to execute  --mtu-test  on your command line?  at the prompt?
16:51 < Rajko> doesnt matter if i put it in config or append to cmdline
16:51 < Bushmills> it does, because that's not an openvpn error message
16:52 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
16:52 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
16:53 < Rajko> <Rajko> Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/client.conf:27: mtu-test (testing-7695ad84e29e)
16:53 < Rajko> <Rajko> Use --help for more information.
16:53 < krzee> [14:48]  <vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
16:55 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
16:55 < Rajko> http://codepad.org/3L1cNkDy
16:55 <@vpnHelper> Title: Plain Text code - 92 lines - codepad (at codepad.org)
16:56 < Bushmills> fix line 2 of client config
16:56 < krzee> yep
16:57 < krzee> auth none and no-iv yes!?
16:57  * krzee doubletakes
16:57 < krzee> fragment 0
16:57 < Rajko> minimal encryption overhead
16:57 < krzee> remove that before mtu-test
16:57 < Rajko> no openvpn 4 byte overhead for fragmentation
16:57 < krzee> and wrong
16:57 < krzee> auth doesnt add the overhead
16:58 < krzee> cipher does
16:58 < Rajko> auth adds additional cryptography power required
16:58 < krzee> and you use a nice big cipher :-p
16:58 < Bushmills> ?   i don't see any mtu-test anywhere in there
16:58 < krzee> yes, during AUTH
16:58 < krzee> during connection
16:58 < krzee> cipher is for the constant encryption (ie: what adds overhead)
16:58 < Rajko> no, checksum hashed on every packet
16:58 < Rajko> for replay detection
16:58 < krzee> no, thats tls-auth
16:59 < krzee> aka:
16:59 < krzee> !hmac
16:59 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
16:59 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
16:59 < Rajko> so thats disabled by default ?
16:59 < krzee> correct
16:59 < Rajko> i thought thats what auth did
17:00 < krzee> interesting, im reading on auth in the manual and its confusing
17:01 < krzee> im asking for clarification in the dev chan
17:01 < krzee> the description for --auth supports what you said, but --tls-auth says very similar stuff
17:02 < krzee> regardless
17:02 < Rajko> where's the description of --auth and --tls-auth
17:02 < krzee> comment the fragment rule
17:02 < krzee> in the manual, lol
17:02 < krzee> then add mtu-test
17:02 < Rajko> http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html ?
17:02 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
17:02 < krzee> then:
17:02 < krzee> !logs
17:02 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:02 < krzee> no dude, you dont run 2.0.x
17:02 < krzee> !man
17:02 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
17:06 < Rajko> but internet is really weird when tunneled now, that openvpn 2.2 page is still loading...
17:06 < Rajko> something definitely up with mtu
17:07 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
17:07 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
17:08 -!- bitrot [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
17:08 < krzee> umm not until you run the mtu-test
17:08 < krzee> klol
17:08 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
17:09 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
17:09 < Rajko> fragment or no fragment, i still get
17:09 < Rajko> Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/client.conf:27: mtu-test (testing-7695ad84e29e)
17:09 < Rajko> Use --help for more information.
17:09 < krzee> was that what i asked for?
17:09 < krzee> crazy
17:09 < krzee> i thought i said
17:09 < krzee> !logas
17:09 < krzee> !logs
17:09 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:10 < Rajko> logs for what ?
17:10 < Rajko> without mtu-test ?
17:10 < krzee> lets see if a second time is easier to understand
17:11 < krzee> [15:02]  <krzee> comment the fragment rule
17:11 < krzee> [15:02]  <krzee> then add mtu-test
17:11 < krzee> [15:02]  <krzee> then:
17:11 < krzee> [15:02]  <krzee> !logs
17:11 < krzee> [15:02]  <vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:11 < Rajko> i did comment fragment
17:11 < Rajko> the client fails to start because mtu-test still unrecognized
17:11 < Rajko> i can give you server logs without fragmnt i guess
17:11 < krzee> omfg
17:11 < krzee> i said to do 3 things
17:12 < krzee> you did 2
17:12 < krzee> is it that hard?
17:12 < Rajko> so you want server logs ?
17:12 < krzee> also comment fragment on the server btw
17:12 < Rajko> its commented.
17:12 < krzee> oh god, i dont have the patience today
17:12  * krzee bbl
17:12 < Rajko> i dont understand the problem
17:12 < krzee> READ
17:12 < krzee> !logs
17:12 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:12 < Rajko> I CANT GIVE YOU LOGFILES FROM CLIENT
17:13 < Rajko> IT DOESNT WORK WITH MTU-TEST IN THE CONFIG
17:13 < krzee> the fuck you cant
17:13 -!- bitrot [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 263 seconds]
17:13 < krzee> it still outputs a logfile
17:13 < krzee> bbl, gl
17:13 < Rajko> all i see on stdout/stderr is what i pasted here 3 times already
17:14 < Rajko> same output even with verb 5
17:16 < Bushmills> what happens if you execute, as root, from command line       openvpn --dev tun --mtu-test   ?
17:17 < Rajko> Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: mtu-test (testing-7695ad84e29e)
17:17 < Rajko> Use --help for more information.
17:18 < Bushmills> where does that version of openvpn come from?
17:18 < Rajko> OpenVPN testing-7695ad84e29e arm-openwrt-linux [SSL] [LZO2] [IPv6 payload 20100922-1] [MH] [PF_INET6] built on Apr 26 2011
17:18 < Bushmills> executable is most likely compiled for size, leaving out several features
17:19 < Rajko> yes like no man page
17:19 < Rajko> i can run it on my winxp client i guess
17:19 < Bushmills> but that's not backfire
17:19 < Rajko> its openvpn-testing from trunk
17:19 < Bushmills> backfire has --mtu-test compiled in
17:20 < Rajko> openvpn-devel
17:20 < krzee> or you can test mtu manually
17:20 < krzee> !mtu
17:20 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
17:20 < krzee> #2
17:23 < Rajko> i have 1500 mtu, but ip fragmentation works slightly above that
17:26 < Bushmills> what is the clock frequency of your ARM controller?
17:27 < Rajko> 1.2GHz
17:27 < Rajko> armv5
17:27 < Rajko> accelerated AES engine
17:27 < Rajko> Mon Jun 06 00:27:27 2011 NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1521,1521] remote->local=[1521,1521]
17:27 < Bushmills> doesn't sound like a reason for a bandwidth bottleneck 
17:28 < Rajko> the windows xp client in the vm running off a separate connection does the same thing
17:28 < Rajko> and even performs worse
17:30 < Bushmills> try commenting out the AES-256-CBC cipher line of both configs
17:30 < Bushmills> (defaulting to BF)
17:30 < Rajko> cipher none does make it better
17:31 < Rajko> but blowfish isnt accelerated on this hardware
17:31 < Bushmills> theorie is, if AES support of controller is used, BF should not be (noticeably) faster
17:31 < krzee> niether is AES unless you have a special openssl engine
17:31 < Rajko> krzee, i do.
17:31 < krzee> just do Bushmills' test
17:32 < Rajko> i see the hardware crypto kernel thread using 10% cpu
17:32 < Rajko> @ 2.0MB/s
17:34 < Bushmills> i get 6 mbit over the line with a meager 400 MHz mips. that's my line limit.
17:34 < Bushmills> i.e. could be faster, but i don't know whether it is
17:34 < Rajko> i know i can get 20mbit with a 850MHz mips
17:34 < Rajko> but now i have a 100mbit line
17:34 < Rajko> and its still going 20mbit on this new hardware
17:39 < Rajko> http://i.imgur.com/HhKOG.png AES256
17:40 < krzee> so how did it compare to BF?
17:40 < krzee> (aka default, as Bushmills asked awhile ago)
17:40 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
17:40 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
17:41 < Rajko> its the same exact speed over blowfish it seems
17:41 < Rajko>  Data Channel Encrypt: Cipher 'BF-CBC'
17:43 < Rajko> cpu usage 41%
17:43 < krzee> ok thats good
17:43 < krzee> so you do save a ton of cpu at that same speed, so the hw crypto is working
17:43 < krzee> tried checking non-special releases?
17:45 < Rajko> i could use 2.1.4 on server and 2.2.0 on client i guess
17:46 < Rajko> using a download manager with 11 http connections increases the speed by 10%
17:46 < krzee> how about with tcp and tcp-nodelay
17:47 < krzee> tcp-nodelay i mean
17:47 < Rajko> no, udp is fine, my isp doesnt do any traffic messing
17:47 < Bushmills> no, not good
17:47 < krzee> Bushmills, not good, he gets 40% cpu usage with bf and 10% with aes
17:47 < Rajko> i can do iptraf from server to client and it will blast out >100mbps with no packet loss
17:47 < krzee> ?
17:47 < Bushmills> " using 10% cpu @ 2.0MB/s"  before
17:47 < krzee> he said he got same speed
17:47 < krzee> with bf
17:47 < Rajko> i said, the hardware crypto is working
17:47 < Bushmills> now 40% at 20 Mbit
17:48 < Rajko> for AES 
17:48 < Rajko> the mv_crypto thread appears on TOP
17:48 < Rajko> when it's used
17:48 < Rajko> otherwise it doesnt
17:48 < krzee> [15:41]  <Rajko> its the same exact speed over blowfish it seems
17:48 < krzee> [15:41]  <Rajko>  Data Channel Encrypt: Cipher 'BF-CBC'
17:48 < krzee> [15:43]  <Rajko> cpu usage 41%
17:48 -!- pittstains [~fgomez@173-10-186-206-BusName-washingtonDC.hfc.comcastbusiness.net] has joined #openvpn
17:48 < Rajko> i can do openssl speed aes and get like 30MB/s on most blocksizes
17:48 < Rajko> encryption isnt the bottleneck
17:49 < Bushmills> yes. resulting speed the same. but cpu load was done at lower speed with AES
17:49 < pittstains> !ipforward
17:49 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
17:50 < pittstains> !linipfoward
17:50 < Rajko> whats weird about this connection is taht some things end up being realy slow, like i cant listen to 96k internet radio without it buffering a lot
17:50 < pittstains> !linipforward
17:50 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
17:51 < Rajko> actually the radio works fine now
17:53 < pittstains> !route_outside_openvpn
17:53 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
17:54 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
17:54 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
17:57 < Rajko> i added my tun-mtu and mssfix options as well as fragment 0, the speed is the same
17:59 < Rajko> http://i.imgur.com/j8gKP.png download manager and mssfix and AES-256
18:00 -!- bitrot [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
18:01 < bitrot> http://i.imgur.com/F717X.png same download, untunneled
18:02 < bitrot> (both were between the box running openvpn and this computer)
18:03 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Ping timeout: 240 seconds]
18:05 < bitrot> im rajko btw, just untunneled
18:11 < bitrot> ill try with 2.1.3 on server 2.1.4 on client now
18:19 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
18:21 < Rajko> same speed using openvpn 2.1.x on both ends
18:22 -!- bitrot [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 240 seconds]
18:22 < Rajko> really dont know what the problem is
18:23 < EugeneKay> It's haunted.
18:23 < Rajko> the server i have is a dedicated one, and has no problem achieving over > 100MB/s aes encryption
18:23 < Rajko> the router can do > 30MB/s
18:24 < Rajko> but results with winxp client on a i7 are the same
18:24 < Rajko> cap @ 20mbps
18:25 < krzee> i dont suppose the server can be tested running something else too...?
18:25 < krzee> since windows tun and linux tun are coded by different people
18:26 < krzee> (im grasping here, dunno whats up)
18:26 < Rajko> server is debian 6
18:26 < Rajko> i can test with my 64bit ubuntu vm, dont think it will make a difference
18:27 < EugeneKay> Are you watching top during this test?
18:27 < EugeneKay> What's CPU usage like?
18:27 < EugeneKay> IE, are any single cores being maxed.
18:27 < Rajko> on the server < 2%
18:27 < Rajko> on the router < 30%
18:30 < Rajko> the winxp is getting maxed at 1MB/s
18:31 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
18:32 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
18:32 < Rajko> but it can do 3.4MB/s untunneled so still
18:33 < krzee> you will never get your max throughput, dont expect it
18:33 < Rajko> but 1/5 ?
18:34 < krzee> nope, but 1mb on a 3mb isnt hard to picture
18:34 < krzee> im not commenting on the 100MB / 20MB
18:34 -!- pr0z [~pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
18:34 < pr0z> !route
18:34 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:34 < Rajko> its winxp anyway
18:34 < Rajko> its just there for testing
18:34 < pr0z> !iptables
18:34 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z, or (#2) please see http://openvpn.net/man#lbBD for more info, or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
18:38 < Rajko> krzee, also those numbers on winxp are in megaBYTES not bits
18:38 < Rajko> so 10mb on 40mb
18:39 < krzee> umm no
18:39 < krzee> 8mb and 27.2 mb 
18:39 < Rajko> big B means bytes
18:39 < krzee> correct
18:40 < krzee> and you *8 to get bits
18:40 < krzee> 1 * 8 != 10
18:40 < krzee> 3.4 * 8 ~= 40
18:40 < krzee> err !=
18:40 < Rajko> so you should invert the b/B on your last 2 sentences before i said <Rajko> krzee, also those numbers on winxp are in megaBYTES not bits
18:40 < Rajko> it doesnt matter
18:40 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
18:41 < Rajko> its still 30% of overall throughput
18:42 < krzee> i get less than that honestly
18:42 < krzee> im on 6mbit, i dont get 1.5mbit over my tunnel
18:42 < Rajko> when im on 6mbit, i get 5mbit
18:43 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:43 < Rajko> i had 12mbit and 20mbit on my 850mhz mips router, both had only like a 10% overhead
18:43 < EugeneKay> THIS IS HOW UDP SPAMMING ACTUALLY WORKS
18:43 < EugeneKay> Try it all again with TCP, see what happens.
18:44 < Rajko> isnt tcp in tcp crazy big no-no
18:44 < krzee> yes, but you can disable nagles algorythm
18:44 < krzee> in fact, i said this a long time ago
18:44 < Rajko> tcp without nagles is still a lot of stuff that shouldnt be there
18:45 < krzee> [15:46]  <krzee> how about with tcp and tcp-nodelay
18:45 < krzee> [15:47]  <krzee> tcp-nodelay i mean
18:45 < krzee> an hour ago
18:49 < Rajko> socket-flags TCP_NODELAY ?
18:49 < krzee> --tcp-nodelay
18:49 < krzee> but ya
18:49 < krzee> The macro expands as follows: 
18:49 < krzee>  if mode server:
18:49 < krzee>    socket-flags TCP_NODELAY
18:49 < krzee>    push "socket-flags TCP_NODELAY"
18:50 < krzee> !learn tcp as if you must use tcp, you likely want --tcp-nodelay
18:50 <@vpnHelper> Joo got it.
18:50 < EugeneKay> Needs !learn vend Sorry, exact change only.
18:51 -!- bitrot [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
18:51 < EugeneKay> <_<
18:51 < krzee> !blame
18:51 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault, or (#2) According to krzee, it's always dazo's fault
18:52 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
18:52 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
18:52 < Rajko> ok, i have worse throughput now.
18:52 < krzee> looks like how you had it is as good as its getting
18:53 < krzee> maybe see if theres something you can tune at the OS level or something
18:53 < krzee> can even try manually tuning mtu and see if it somehow helps
18:53 < Rajko> or use ipsec
18:53 < krzee> sure
18:55 -!- bitrot [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 250 seconds]
19:01 < Rajko> openvpn is much better though
19:05 < krzee> i agree
19:06 < krzee> ecrist has a buddy in here named emporertom or something like that
19:06 < krzee> he is good with mtu issues, but it seems thats not your issue
19:06 < krzee> all i can think of
19:07 -!- bitrot [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
19:08 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
19:08 -!- Rajko [~rajkosto@wan.rajkonet.info] has joined #openvpn
19:11 -!- bitrot [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 240 seconds]
19:12 -!- rajkosto [~rajkosto@wan.rajkonet.info] has joined #openvpn
19:12 -!- Rajko [~rajkosto@wan.rajkonet.info] has quit [Read error: Connection reset by peer]
19:16 < rajkosto> with cipher=none i can get 4.3MB/s on the router
19:16 < rajkosto> so i guess it was cpu bound ?
19:16 < rajkosto> 50% cpu with no encyrpton
19:16 < rajkosto> just passing 4.3MB/s
19:22 -!- pr0z [~pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit []
19:23 -!- pittstains [~fgomez@173-10-186-206-BusName-washingtonDC.hfc.comcastbusiness.net] has quit [Ping timeout: 255 seconds]
19:24 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
19:26 -!- rajkosto [~rajkosto@wan.rajkonet.info] has quit [Read error: Operation timed out]
19:28 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
20:09 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Operation timed out]
20:12 -!- master_of_master [~master_of@p57B53647.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:13 -!- master_of_master [~master_of@p57B55A4F.dip.t-dialin.net] has joined #openvpn
20:14 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
20:18 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
20:26 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 244 seconds]
20:39 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has quit []
20:40 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
20:43 < ecrist> krzie: his name changed to quadDamage 
20:44 < krzie> ahh there he is
20:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:44 < krzie> Rajko, if you're using everything with none like that, maybe just setup GRE tunnels
20:45 < krzie> (unless you were just testing)
20:53 <@vpnHelper> RSS Update - forum: redirect-gateway problem with Linux server & Windows7 client <http://forums.openvpn.net/topic8273.html>
21:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 244 seconds]
21:17 <@vpnHelper> RSS Update - forum: redirect-gateway problem with Linux server & Windows7 client <http://forums.openvpn.net/topic8273.html#p12749>
21:25 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has quit [Ping timeout: 240 seconds]
21:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:47 -!- genesis [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:47 < genesis> I edited the openvpn file on /etc/rc.d/init.d because of the bug but I cant start my openvpn service
21:48 < genesis> starting openvpn: failed
21:49 -!- genesis is now known as genesisnew
21:49 < genesisnew> help
21:53 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12750>
21:58 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Quit: Leaving]
22:02 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Read error: Connection reset by peer]
22:02 -!- genesisnew [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
22:07 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
22:23 <@vpnHelper> RSS Update - forum: remote connection problem <http://forums.openvpn.net/topic8241.html#p12751>
22:25 -!- Hamlin [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has quit [Ping timeout: 260 seconds]
22:32 -!- Hamlin [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
22:34 -!- pittstains [~fgomez@173-10-186-206-BusName-washingtonDC.hfc.comcastbusiness.net] has joined #openvpn
22:34 -!- pittstains [~fgomez@173-10-186-206-BusName-washingtonDC.hfc.comcastbusiness.net] has left #openvpn []
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:42 -!- Hamlin [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has quit [Ping timeout: 248 seconds]
22:47 -!- Hamlin [~Hamlin@mountainmorningband.com] has joined #openvpn
22:51 -!- orion [orion@unaffiliated/orion] has joined #openvpn
22:51 -!- orion [orion@unaffiliated/orion] has left #openvpn []
22:52 -!- Hamlin [~Hamlin@mountainmorningband.com] has quit [Ping timeout: 276 seconds]
23:08 -!- Hamlin [~Hamlin@mountainmorningband.com] has joined #openvpn
23:14 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
23:48 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
--- Day changed Mon Jun 06 2011
00:33 -!- pif [~ldm@zenon.apartia.fr] has quit [Quit: leaving]
00:39 -!- bauruine_ [~stefan@217.150.236.196] has quit [Ping timeout: 248 seconds]
00:52 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
00:56 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
01:10 <@vpnHelper> RSS Update - forum: Periodic timeouts <http://forums.openvpn.net/topic8270.html#p12752>
01:16 <@vpnHelper> RSS Update - forum: Accessing an ADSL router from a distant connected client? <http://forums.openvpn.net/topic8272.html#p12753>
01:22 <@vpnHelper> RSS Update - forum: TTL expired using bridging <http://forums.openvpn.net/topic8271.html#p12756> || OpenVPN very slow - Less then 8KB/s <http://forums.openvpn.net/topic8227.html#p12755> || remote connection problem <http://forums.openvpn.net/topic8241.html#p12754>
01:28 <@vpnHelper> RSS Update - forum: redirect-gateway problem with Linux server & Windows7 client <http://forums.openvpn.net/topic8273.html#p12757>
01:43 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
01:44 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
01:50 -!- p3rror [~mezgani@41.140.46.140] has quit [Read error: Operation timed out]
01:51 -!- testing [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
01:52 <@vpnHelper> RSS Update - forum: Accessing an ADSL router from a distant connected client? <http://forums.openvpn.net/topic8272.html#p12758>
01:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:05 -!- bauruine_ [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
02:07 -!- p3rror [~mezgani@41.140.103.254] has joined #openvpn
02:08 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:19 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:24 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:24 -!- mode/#openvpn [+o mattock] by ChanServ
02:41 -!- rkantos [robin@hp1.jaketus.net] has quit [Ping timeout: 246 seconds]
02:41 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
02:43 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
02:44 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
02:47 -!- genesis_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:48 < genesis_> bushmills even if I edited my the openvpn file from /etc/init.d my openvpn service is still not working
02:48 < Bushmills> but for a different reason
02:49 < genesis_> yes
02:49 < Bushmills> now you got to fix that too
02:49 < genesis_> it says service not found
02:49 < genesis_> how will I fix that?
02:50 < Bushmills> first, you'd observer how the problem manifests. then draw a conclusion what could cause it. then you take steps to undo the error cause-.
02:50 < Bushmills> observe
02:52 < genesis_> ill be back
02:52 -!- genesis_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
02:54 -!- p3rror [~mezgani@41.140.103.254] has quit [Ping timeout: 255 seconds]
03:04 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12759>
03:09 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
03:10 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
03:10 -!- bauruine_ [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
03:17 -!- genesis_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
03:17 < genesis_> bushmills what do I really need to edit in that openvpn file?
03:18 < genesis_> bushmills, what do I really need to edit in that openvpn file? 
03:19 -!- cer_abg [96d60496@gateway/web/freenode/ip.150.214.4.150] has joined #openvpn
03:19 < cer_abg> hi there
03:20 < cer_abg> i'm getting this error when triyng to start openvpn server: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch 
03:20 < genesis_> is changing the - to = sign will solve that?
03:20 < cer_abg> but the server certificate/key is freshly splitted from a pkcs12 file
03:21 < cer_abg> any idea?
03:21 -!- genesis_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
03:24 < cer_abg> I get the same error with two different certificates (different pkcs12 files, signed by two CA) so i'm guessing something is going wrong when getting key/cert from pkcs12 file
03:24 < cer_abg> any idea?
03:27 < Bushmills> "my openvpn service is still not working".. "what do I really need to edit" ...   this wealth of information is overwhelming
03:28 < Bushmills> so is the lack of patience
03:32 < cer_abg> ?
03:33 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
03:34 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
03:35 < Bushmills> (10:20:28) genesis_: is changing the - to = sign will solve that? -  (10:21:22) genesis_ left the room (quit: Client Quit).
03:36 < Bushmills> overwhelming between <sarcasm> tags
03:37 < krzie> oh lol
03:37 < krzie> i ignore webchat
03:37 < krzie> i didnt know what you were talking about
03:52 -!- zheng2 [~zheng@180.158.177.192] has joined #openvpn
03:54 -!- zheng3 [~zheng@180.158.177.192] has joined #openvpn
03:56 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
04:00 -!- zheng2 [~zheng@180.158.177.192] has quit [Ping timeout: 260 seconds]
04:00 -!- zheng3 [~zheng@180.158.177.192] has quit [Ping timeout: 240 seconds]
04:02 -!- cer_abg [96d60496@gateway/web/freenode/ip.150.214.4.150] has quit [Quit: Page closed]
04:07 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:07 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:09 -!- K1ng [~KING@180.211.188.76] has quit [Ping timeout: 258 seconds]
04:16 -!- nutcase [~nutcase@tokerscorner.com] has joined #openvpn
04:17 < nutcase> !welcome
04:17 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:17 < nutcase> !route
04:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:32 < EugeneKay> krzie, if you want true bliss, hide join/parts and nickchanges.
04:37 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:39 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 258 seconds]
04:47 <@vpnHelper> RSS Update - forum: TTL expired using bridging <http://forums.openvpn.net/topic8271.html#p12760>
04:49 < krzie> EugeneKay, that would effectively ignore all of efnet
04:49 < EugeneKay> I'm...... not seeing the problem?
04:51 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
04:53 <@vpnHelper> RSS Update - forum: Accessing an ADSL router from a distant connected client? <http://forums.openvpn.net/topic8272.html#p12762> || Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12761>
04:54 < krzie> ;]
04:59 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12763>
04:59 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
05:01 -!- Cain` is now known as Cain
05:01 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:01 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:05 <@vpnHelper> RSS Update - forum: TTL expired using bridging <http://forums.openvpn.net/topic8271.html#p12764>
05:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:06 -!- genesis_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
05:07 < genesis_> can the bug in 2.2 can be fix or we will have to wait again for the next version to come?
05:11 <@vpnHelper> RSS Update - forum: Clear example <http://forums.openvpn.net/topic8266.html#p12765>
05:11 < Rajko> is there something like a kernel mode openvpn patch ?
05:18 -!- genesis_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
05:21 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:23 < defswork> Rajko, to do anything in particular ?
05:24 < Rajko> so that openvpn doesnt spend all cpu time of this 1.2GHz arm router just passing unencrypted packets @ 4.2MB/s
05:24 < Rajko> on this 100mbit link
05:24 < defswork> what kind of kernel patch will solve that ?
05:25 < defswork> kernel time still uses cpu time
05:29 < EugeneKay> 4.2MB/s is a helluva fast pace for an ARM chip
05:41 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12766>
05:47 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
05:52 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
05:56 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
06:00 < Rajko> EugeneKay, well NAT and such is all done in kernel space, too, right ?
06:00 < Rajko> it can nat and qos and do other things just fine at line speed with <1% cpu utlization
06:02 -!- STF [~chatzilla@dslb-188-101-231-110.pools.arcor-ip.net] has joined #openvpn
06:29 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
06:30 -!- cer_abg [96d60496@gateway/web/freenode/ip.150.214.4.150] has joined #openvpn
06:31 < cer_abg> hi there!
06:31 < cer_abg> do anyone knows what means the error:0B080074 ?
06:36 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
06:37 < cer_abg> exactly this: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
06:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:47 -!- STF [~chatzilla@dslb-188-101-231-110.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
06:47 <@vpnHelper> RSS Update - forum: Accessing an ADSL router from a distant connected client? <http://forums.openvpn.net/topic8272.html#p12767>
06:48 -!- STF [~chatzilla@dslb-188-101-231-110.pools.arcor-ip.net] has joined #openvpn
06:49 -!- STF [~chatzilla@dslb-188-101-231-110.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
06:50 -!- STF [~chatzilla@dslb-188-101-231-110.pools.arcor-ip.net] has joined #openvpn
06:51 -!- genesis_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
06:52 -!- pittstains [~fgomez@173-10-186-206-BusName-washingtonDC.hfc.comcastbusiness.net] has joined #openvpn
06:55 -!- genesis_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
06:58 -!- STF [~chatzilla@dslb-188-101-231-110.pools.arcor-ip.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
07:05 <@vpnHelper> RSS Update - forum: Problem with server certificates. Error 0B080074 <http://forums.openvpn.net/topic8274.html>
07:05 < Rajko> tls-auth is different from auth
07:05 < Rajko> tls-auth is HMAC during the TLS key exchange
07:05 < Rajko> auth is HMAC during normal packet passing
07:06 < Rajko> tls-auth was added so that nobody could even attempt TLS without a proper key
07:06 < Rajko> so there, krzie 
07:06 < Rajko> found the answer
07:16 < cer_abg> Rajko: nothing about my issue? :S
07:16 < Rajko> nope
07:16 < Rajko> check your keys
07:17 < cer_abg> i'm guessing if there are different key formats when extracting from Pkcs12
07:17 < cer_abg> do you know it?
07:23 < Rajko> what
07:24 < cer_abg> if there are different file formats for the keyfile
07:24 < cer_abg> i'm using this to extract the keyfile: openssl pkcs12 -in file.p12 -out file.key -nodes -nocerts
07:25 < cer_abg> and this to extract the certfile: openssl pkcs12 -in file.p12 -out file.crt -nodes -nokeys
07:25 < Rajko> the key should be in PEM format
07:25 < Rajko> .key file starts with -----BEGIN RSA PRIVATE KEY-----
07:25 < cer_abg> yes
07:25 < Rajko> ends with -----END RSA PRIVATE KEY-----
07:26 < cer_abg> well, there are 4 lines with: Bag attributes
07:26 < cer_abg> and key atributes
07:26 < cer_abg>  and then BEGIN RSA PRIVATE KEY
07:26 < Rajko> remove the 4 lines
07:26 < cer_abg> ok
07:27 < cer_abg> but still not working, I tried before...
07:27 < Rajko> is this on tls-server ?
07:28 < cer_abg> you mean the "tls-server" directive in the server.conf file? then yes
07:28 < Rajko> so this is on the server ?
07:28 < cer_abg> yes
07:28 < Rajko> regenerate your dh file ?
07:28 < Rajko> is the cert signed by the CA ?
07:29 < cer_abg> the cert is signed by the CA
07:29 < cer_abg> i haven't regenerate dh file. Have I to do it with every change of the server cert/key?
07:29 < Rajko> no
07:29 < Rajko> but maybe its corrupt
07:30 < cer_abg> it doesn't seem to be
07:33 <@vpnHelper> RSS Update - forum: TTL expired using bridging <http://forums.openvpn.net/topic8271.html#p12769>
07:51 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12773> || assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12772> || redirect-gateway problem with Linux server & Windows7 client <http://forums.openvpn.net/topic8273.html#p12771>
07:51 -!- tuxx [~tuxx@s15427526.onlinehome-server.info] has left #openvpn []
07:57 <@vpnHelper> RSS Update - forum: Problem with server certificates. Error 0B080074 <http://forums.openvpn.net/topic8274.html#p12775> || TTL expired using bridging <http://forums.openvpn.net/topic8271.html#p12774> || [SOLVED] redirect-gateway problem with Linux server & Windo <http://forums.openvpn.net/topic8273.html#p12771>
07:58 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 252 seconds]
08:12 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
08:20 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
08:23 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: Leaving.]
08:25 -!- cer_abg [96d60496@gateway/web/freenode/ip.150.214.4.150] has quit [Ping timeout: 252 seconds]
08:28 -!- EugeneKay is now known as EugeneKaway
08:28 -!- EugeneKaway is now known as EugeneKay
08:32 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
08:33 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12776>
08:39 <@vpnHelper> RSS Update - forum: UDP port issue <http://forums.openvpn.net/topic8275.html>
08:57 <@vpnHelper> RSS Update - forum: Problem with server certificates. Error 0B080074 <http://forums.openvpn.net/topic8274.html#p12778>
08:58 -!- genesisnew [adeaaaf7@gateway/web/freenode/ip.173.234.170.247] has joined #openvpn
09:01 < genesisnew> If I use the directive status file [n], where will the file be written?
09:02 < defswork> genesisnew, current directory or the directory specified in config on on command line
09:02 < defswork> (current directory where server was run)
09:03 < genesisnew> I see. thanks
09:03 < defswork> init.d startup script typically has --cd in it
09:05 < genesisnew> Is the multihome option should be in the clienf config or in the server config?
09:05 < genesisnew> It is not clear to me while reading the manual now
09:11 < genesisnew> please clarify me on this guys
09:11 < genesisnew> just need to know where to put that multihome directive
09:18 < genesisnew> defswork can you clarify me on that?
09:28 <@vpnHelper> RSS Update - forum: [SOLVED] Problem with server certificates. Error 0B080074 <http://forums.openvpn.net/topic8274.html#p12779>
09:28 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 246 seconds]
09:30 -!- cer_abg [96d60496@gateway/web/freenode/ip.150.214.4.150] has joined #openvpn
09:30 < cer_abg> hi there!
09:30 < cer_abg> the problem with x509_check_private_key was solved
09:30 < cer_abg> now I have a VERIFY ERROR: unable to get local issuer certificate :P
09:33 -!- genesisnew [adeaaaf7@gateway/web/freenode/ip.173.234.170.247] has quit [Quit: Page closed]
09:39 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:41 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
09:42 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
09:52 <@vpnHelper> RSS Update - forum: UDP port issue <http://forums.openvpn.net/topic8275.html#p12782> || [SOLVED] Problem with server certificates. Error 0B080074 <http://forums.openvpn.net/topic8274.html#p12781> || Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12780>
09:58 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12783>
10:00 -!- FP|Maverick-work [~commo@h64-141-120-20.pcccinc.net] has quit [Remote host closed the connection]
10:13 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
10:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:22 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12784>
10:39 -!- cer_abg [96d60496@gateway/web/freenode/ip.150.214.4.150] has quit [Quit: Page closed]
10:54 -!- mlopez [~Michael@122.117-14-84.ripe.coltfrance.com] has joined #openvpn
10:55 < mlopez> !welcome
10:55 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:55 < mlopez> !goal
10:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:58 < mlopez> Hi all, just one question : i saw there are OpenVPN App on Cydia on iPhone but are there an Official app to use on iPhone ? or are there a roadmap for official app ?
11:00 -!- corretico_ [~luis@186.176.7.194] has quit [Remote host closed the connection]
11:06 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
11:19 < K1ng> mlopez, throw your iphone away. its a sick phone
11:20 < K1ng> Huwei is a lot better than apple :p 
11:56 < Bushmills> huawei?
12:01 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
12:03 -!- newmember_ [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
12:06 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
12:22 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
12:23 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
12:27 -!- shawkins [~jststeve@209.32.108.100] has joined #openvpn
12:27 < shawkins> !welcome
12:27 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:28 < shawkins> !goal
12:28 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:32 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
12:34 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
12:39 -!- shawkins [~jststeve@209.32.108.100] has quit [Quit: shawkins]
12:44 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:45 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
12:46 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
12:47 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
12:51 -!- linuxviewer [~viewer@c-174-52-163-53.hsd1.ut.comcast.net] has joined #openvpn
12:52 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
12:53 < linuxviewer> Hi have one openvpn server at location 1.  I am at location 2 and have a Windows XP and Windows 7 machine connected to openvpn.  The traffic seems to be intermetiant.  For example, I run the openvpn config on XP and Win7 and they both connect. I constantly ping the openvpn server and the XP machine will time out here and there for a few minutes meanwhile the Win7 machine pings just fine.  
12:53 < linuxviewer> Sometimes it is a the Win7 machine that times out here and there while the XP machine still consistently pings the openvpn server.  Location 2 only has one internet connection and location 1 only has 1.  What could cause this?  IT seems like only one openvpn client can be connected to the server.  
13:08 -!- shawkins [~jststeve@2001:468:1910:3c06:223:6cff:fe90:4c5] has joined #openvpn
13:12 -!- luneff [~yury@84.51.197.177] has joined #openvpn
13:23 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
13:26 <@vpnHelper> RSS Update - forum: HELP in set up. <http://forums.openvpn.net/topic8276.html> || Accessing an ADSL router from a distant connected client? <http://forums.openvpn.net/topic8272.html#p12785>
13:29 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
13:31 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
13:41 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
13:41 -!- EugeneKaway [EK_FreeNod@pitofsnakesandbrokenglass.com] has joined #openvpn
13:41 -!- EugeneKaway is now known as EugeneKay
13:43 -!- EugeneKay [EK_FreeNod@pitofsnakesandbrokenglass.com] has quit [Client Quit]
13:44 -!- EugeneKay [EugeneKay_@pitofsnakesandbrokenglass.com] has joined #openvpn
13:44 -!- EugeneKay is now known as Guest74180
13:45 -!- Guest74180 is now known as EugeneKay
13:49 -!- pittstains [~fgomez@173-10-186-206-BusName-washingtonDC.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
13:49 -!- pittstains [~fgomez@173.10.186.206] has joined #openvpn
13:49 -!- pittstains [~fgomez@173.10.186.206] has left #openvpn []
13:55 -!- shawkins [~jststeve@2001:468:1910:3c06:223:6cff:fe90:4c5] has quit [Quit: shawkins]
13:57 < Bushmills> linuxviewer: are you using the same key for both locations at the same time?
14:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Connection reset by peer]
14:05 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:08 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
14:09 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
14:09 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
14:09 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
14:23 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:27 -!- shawkins [~jststeve@209.32.108.100] has joined #openvpn
14:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:32 -!- EugeneKay [EugeneKay_@pitofsnakesandbrokenglass.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
14:33 -!- EugeneKay [EugeneKay_@pitofsnakesandbrokenglass.com] has joined #openvpn
14:33 -!- EugeneKay is now known as Guest26399
14:33 -!- Guest26399 is now known as EugeneKay
14:42 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
14:47 -!- crooksey [~luke@host86-154-89-181.range86-154.btcentralplus.com] has joined #openvpn
14:48 < crooksey> I have just setup my first openVPN server on a linux box, where would i find my .ovpn configuration file so I can connect to my new server?
14:49 < EugeneKay> You don't. You have to make it yourself.
14:49 < EugeneKay> !howto
14:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:51 < crooksey> EugeneKay, is my openvpn.conf the same thing as my openvpn.ovpn?
14:51 < EugeneKay> .ovpn is the extension recognized by the Windows OpenVPN gui tool thingy, .conf is the generic extension that the linux daemon expects to find.
14:52 < EugeneKay> The contents of the file determine whether it is server or client
14:52 < crooksey> Yea i have configured on a linux server, now im looking to connect from an OSX client which is asking me for .ovpn configuration files
14:52 < EugeneKay> You'll need to build one. ;-)
14:53 < crooksey> Ive read the documentation and i cant see the section that explains it, it reads as if there should be one allready?
14:53 < EugeneKay> See the sample client.conf in the howto. Name it .ovpn instead.
14:54 < crooksey> Yea ive built my client.conf, so building an .ovpn is just renaming it?
14:54 < EugeneKay> Correct.
14:54 < EugeneKay> "A rose by any other name would still prick your hand when you try to pluck it."
14:55 < EugeneKay> (I hate roses)
15:01 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:04 -!- newmember_ [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
15:07 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 240 seconds]
15:11 <@vpnHelper> RSS Update - forum: Accessing an ADSL router from a distant connected client? <http://forums.openvpn.net/topic8272.html#p12787>
15:34 -!- luneff [~yury@84.51.197.177] has quit [Ping timeout: 255 seconds]
15:38 -!- dazo_afk is now known as dazo
15:41 <@vpnHelper> RSS Update - forum: TTL expired using bridging <http://forums.openvpn.net/topic8271.html#p12788>
15:46 -!- crooksey [~luke@host86-154-89-181.range86-154.btcentralplus.com] has quit [Remote host closed the connection]
15:50 -!- Athar [4ee4e25b@gateway/web/freenode/ip.78.228.226.91] has joined #openvpn
15:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:57 <@vpnHelper> RSS Update - forum: is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html#p12789>
16:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:07 -!- dazo is now known as dazo_afk
16:08 -!- Athar [4ee4e25b@gateway/web/freenode/ip.78.228.226.91] has left #openvpn []
16:14 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Excess Flood]
16:14 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
16:15 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Excess Flood]
16:15 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
16:15 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Excess Flood]
16:15 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
16:19 <@vpnHelper> RSS Update - forum: TTL expired using bridging <http://forums.openvpn.net/topic8271.html#p12791> || is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html#p12790>
16:24 -!- guifort [~guifort@g031.h001.peer2me.net] has joined #openvpn
16:25 <@vpnHelper> RSS Update - forum: Accessing an ADSL router from a distant connected client? <http://forums.openvpn.net/topic8272.html#p12792>
16:27 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Excess Flood]
16:27 -!- steve [steve@bouncer.stephen.marsh.name] has joined #openvpn
16:27 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
16:31 <@vpnHelper> RSS Update - forum: Client Key <http://forums.openvpn.net/topic8277.html>
16:34 -!- shawkins [~jststeve@209.32.108.100] has quit [Quit: shawkins]
16:35 -!- shawkins [~jststeve@209.32.108.100] has joined #openvpn
16:35 -!- shawkins [~jststeve@209.32.108.100] has quit [Client Quit]
16:36 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
16:36 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
16:46 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:10 -!- tewecske [~tewe@catv-86-101-250-38.catv.broadband.hu] has joined #openvpn
17:12 -!- newmember_ [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Ping timeout: 240 seconds]
17:13 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
17:28 -!- tewecske [~tewe@catv-86-101-250-38.catv.broadband.hu] has quit [Quit: Leaving.]
17:29 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12794>
17:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:38 -!- bauruine [~stefan@217.150.236.196] has joined #openvpn
17:43 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
17:51 -!- Licenser [~Licenser@82.210.31.96.rev.worldbone.de] has joined #openvpn
17:51 < Licenser> greetings everyone
17:55 < EugeneKay> We come in peace? Take me to your leader?
17:55  * EugeneKay points at dazo, runs
17:55 < krzee> lol
18:00 < Licenser> EugeneKay: you have a leader?
18:00 < EugeneKay> He's wearing the @-hat
18:04 < Licenser> so I must admit just came here to annoy the hell out of you by asking questions - namely why the hack https is slow while ping is fast :(
18:04 < Licenser> I guessed it would be the MTU but I already lowered it to 1400
18:05 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12795>
18:05 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:06 < krzee> ping measures latency not throughput
18:06 < krzee> they are 2 different metrics
18:07 < Licenser> scp goes for 3MB/s
18:07 < krzee> well ping can also measure jitter, but thats outside the scope of the conversation methinks
18:08 < Licenser> hmm seems to be a win issue mainly
18:09 < Licenser> or not
18:11 -!- rich [~rich@216.38.140.199] has joined #openvpn
18:12 < Licenser> this makes me rather confused to be frank :(
18:15 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 255 seconds]
18:16 -!- EugeneKay is now known as EugeneKaway
18:16 -!- EugeneKaway is now known as EugeneKay
18:16 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
18:17 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
18:22 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:22 -!- linuxviewer [~viewer@c-174-52-163-53.hsd1.ut.comcast.net] has quit []
18:26 < Licenser> tricky the problem was the MTU on the second bridge interface :)
18:28 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
18:28 < Licenser> or not
18:31 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
18:31 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
18:31 -!- rich__ is now known as rich
18:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:35 < rich> I have a routing problem in which I can reach my vpn server from outside my firewall, but I can't reach the internal network.
18:36 < rich> I am pretty sure it's routing, as the negotiation goes well, and I flushed the firewall rules on the vpn
18:37 < rich> I don't want to spam this channel with all the details, but the only route I have to my internal network on the vpn server is through the loopback interface 
18:40 < rich> Followed along with the howto and I kind of expected another route from the tun0 interface to my eth0 interface on the vpn server to be set up.
18:42 < rich> I guess my question is whether a route with the destination of the internal lan should be set up, with a gateway other than the looopback?
18:45 -!- nb is now known as nb__
18:45 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
18:47 < rich> The vpn server can hit services on the client outside the firewall as well, which looks good.
18:48 < rich> anyway, I would be happy to compensate someone for a little help on this one.  I have been staring at it for a while.
19:00 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
19:00 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
19:00 -!- rich__ is now known as rich
19:04 -!- genesisnew [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:04 < genesisnew> what is important that should not be put to none/no value? the cipher, auth, or comp-lzo
19:05 < Bushmills> --dev
19:05 < genesisnew> --dev?
19:05 < Bushmills> you'll need it in your config
19:06 < genesisnew> dev tun? like that?
19:06 < Bushmills> such as
19:06 < genesisnew> so I can put the option comp-lzo, cipher and auth to none or no 
19:08 < genesisnew> bushmills, just for security what should not be removed there?
19:08 < rich> can anyone recommend a company who would offer commercial support for the open source version of openvpn running on my own server?
19:09 < Bushmills> genesisnew: none is needed
19:09 < rich> that's the one service openvpn.net doesn't seem to advertise.
19:10 < genesisnew> bushmills what do you mean none is needed? cipher and auth are needed and comp-lzo can be disregarded?
19:10 < Bushmills> i mean that --cipher isn't needed, just as --auth isn't needed, and neither is --comp-lzo 
19:12 < genesisnew> oh. so what is need to establish security? on the --dev tun option?
19:13 < Bushmills> "what is important that should not be put to none/no value?"   ... you need --dev.   openvon --dev tun  makes about the minimal config, albeit not a very useful one
19:15 < genesisnew> ok. will read further more on the manual. tnx
19:16 < krzee> rich, i do not, but that is a good suggestion for openvpn.net
19:16 < krzee> maybe email them and suggest it
19:17 -!- genesisnew [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:17 < rich> I will, but I assume they are trying to focus on their own products, to turn-the-crank so to speak, rather than on services.
19:18 < krzee> well if they have a support team for AS, doesnt seem like too much more for them to support the opensource version as well on a pre-established support contract
19:18 < krzee> after-all, they do already have live support...
19:18 < krzee> im not saying it would happen, im saying it could be worth suggesting
19:21 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 255 seconds]
19:21 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
19:29 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
19:29 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
19:29 -!- rich__ is now known as rich
19:36 -!- corretico [~luis@201.201.44.82] has joined #openvpn
19:39 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:48 -!- [intra]lanman [~lanman@c-71-238-148-210.hsd1.mi.comcast.net] has joined #openvpn
19:48 -!- [intra]lanman [~lanman@c-71-238-148-210.hsd1.mi.comcast.net] has quit [Changing host]
19:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:58 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
19:58 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
19:58 -!- rich__ is now known as rich
20:07 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:10 -!- master_of_master [~master_of@p57B55A4F.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:14 -!- master_of_master [~master_of@p57B55E3F.dip.t-dialin.net] has joined #openvpn
20:20 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:20 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:22 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:27 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
20:27 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
20:27 -!- rich__ is now known as rich
20:39 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:39 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:40 < bystander> bushmills how can I limit the vpn user bandwidth in linux command?
20:40 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
20:40 -!- nb__ is now known as nb2
20:47 < Bushmills> bystander: check out tc
20:48 < bystander> Bushmills, what is tc? I dont know what tc is
20:48 < Bushmills> that's an extra reason to check it out
20:49 < bystander> is that an abbreviation?
20:49 < Bushmills> http://docs.scarydevilmonastery.net/cgi-bin/dwww/usr/share/man/man8/tc.8.gz?type=man
20:49 <@vpnHelper> Title: tc(8) - Man pages (at docs.scarydevilmonastery.net)
20:50 < bystander> thanks for directing me bushmills
20:51 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
20:56 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
20:56 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
20:56 -!- rich__ is now known as rich
21:00 -!- nb2 is now known as nb
21:01 < ecrist> sup bitches?
21:05 < krzee> just boats and hos
21:05 < krzee> you?
21:05 < ecrist> boats and hos
21:05 < krzee> ;]
21:05 < ecrist> I think the misses and I are planning on moving to FL in a couple years
21:05 < krzee> ahh cool
21:05 < krzee> any idea what part?
21:06 < krzee> if you dont have a job lined up i can point you to a guy who runs a dc in orlando
21:07 < ecrist> we're looking at clearwater/tampa area
21:08 < ecrist> I could work at a DC I think, but it's be high-level
21:08 < ecrist> net engineer or somesuch
21:08 < krzee> ya i couldnt see you as a nocmonkey ;]
21:10 < ecrist> heh
21:10 < ecrist> I'd be a friggin' expensive nocmonkey
21:10  * ecrist wonders if nocmonkey ~= trunk monkey http://www.youtube.com/watch?v=Ee3L9BQQ4Gs
21:10 <@vpnHelper> Title: YouTube - Trunk Monkey (at www.youtube.com)
21:11 < krzee> im guessing its talking bout massive bass
21:11 < krzee> 'like a gorilla in the trunk'
21:25 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
21:25 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
21:25 -!- rich__ is now known as rich
21:32 <@vpnHelper> RSS Update - forum: Help Need, keepalive pings not working <http://forums.openvpn.net/topic8267.html#p12796>
21:39 < krzie> back at this client
21:54 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
21:54 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
21:54 -!- rich__ is now known as rich
21:56 <@vpnHelper> RSS Update - forum: connecting just after service -stop -start <http://forums.openvpn.net/topic8278.html>
22:01 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:08 <@vpnHelper> RSS Update - forum: connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html>
22:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
22:23 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
22:23 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
22:23 -!- rich__ is now known as rich
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 244 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:52 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
22:52 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
22:52 -!- rich__ is now known as rich
23:06 -!- guifort [~guifort@g031.h001.peer2me.net] has quit [Quit: Quitte]
23:09 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
23:21 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
23:21 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
23:21 -!- rich__ is now known as rich
23:32 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:41 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Read error: Connection reset by peer]
23:41 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
23:50 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
23:50 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
23:50 -!- rich__ is now known as rich
23:53 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
--- Day changed Tue Jun 07 2011
00:19 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
00:19 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
00:19 -!- rich__ is now known as rich
00:48 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
00:48 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
00:48 -!- rich__ is now known as rich
00:52 -!- genesisnew [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
00:53 < genesisnew> will my security be compromised if my cipher=none, auth=none and comp-lzo=no ?
00:56 < EugeneKay> No, it will be nonexistant.
00:56 <@vpnHelper> RSS Update - forum: UDP port issue <http://forums.openvpn.net/topic8275.html#p12798>
00:57 < genesisnew> Eugenekay, what do you mean nonexistant ?
00:57 < EugeneKay> I mean that disabling all of the security options causes your security to not exist.
00:59 < genesisnew> What are the security risk that we are preventing in using openvpn as tunnel?
01:00 < rich> genesisnew as opposed to what alternative?
01:01 < genesisnew> Rich, ah Im not comparing though. I just want to know what security risk are we preventing in using openvpn as tunnel.
01:02 < rich> this has to be a comparison, if you are trying to evaluate the reduction in risk.
01:02 < rich> compared to having all your local area network services inaccessible, or having them all on the public internet, there are obvious advantages.
01:03 < rich> there is going to be a functionality/security trade off
01:03 -!- genesisnew [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
01:09 -!- bauruine [~stefan@217.150.236.196] has quit [Ping timeout: 248 seconds]
01:13 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
01:14 < bystander> guys I am using an openvpn gui for client use.  When I open it on windows it asked me if I would like to continue to install the driver.  How can I make it so that it will not ask me but rather proceed installing the openvpn drivers anyway?
01:17 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
01:17 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
01:17 -!- EugeneKay is now known as EugeneKaway
01:17 -!- rich__ is now known as rich
01:18 < rich> bystander, what version of windows?
01:18 < bystander> rich, xp, vista and 7
01:18 < rich> bystander, I think the procedure is different on each, but the theory is the same
01:18 < rich> one way to do it is to configure the openvpn-gui client to run as admin
01:19 < rich> right click on the executable, select properties, and somewhere in there is a checkbox to run as admin, on most versions of windows.
01:19 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:20 < bystander> even though the clients are running as admin, still it will ask you if you wish to continue anyway on installing the drivers which I want to eliminate and proceed directly to installing the drivers
01:21 < rich> openvpngui never asks me to install the drivers twice.
01:21 < rich> dunno
01:22 < rich> I install it once, then configure the binary to run as admin, and after that, it stops asking when I run the binary.
01:22 < rich> of course, if I run the installer, it will ask about the drivers.
01:23 < bystander> yes. but even once, I dont want to ask me to install the driver anyway. is there a way to do it?
01:23 < rich> not that I know of.
01:24 < bystander> :( thanks
01:24 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
01:42 -!- bauruine [~stefan@217.150.236.196] has joined #openvpn
01:43 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12799>
01:46 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
01:46 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
01:46 -!- rich__ is now known as rich
02:06 -!- toortog [~toortog@notsecure.net] has quit [Read error: Operation timed out]
02:06 -!- toortog [~toortog@notsecure.net] has joined #openvpn
02:15 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
02:15 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
02:15 -!- rich__ is now known as rich
02:25 <@vpnHelper> RSS Update - forum: is this Client2Network configuration possible? <http://forums.openvpn.net/topic8083.html#p12800>
02:28 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 248 seconds]
02:44 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
02:44 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
02:44 -!- rich__ is now known as rich
02:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:53 -!- mode/#openvpn [+o mattock] by ChanServ
03:00 -!- EugeneKaway is now known as EugeneKay
03:05 -!- pif [~ldm@90.95.90.238] has joined #openvpn
03:06 < pif> hi, can I switch witopia gateway without having to edit my conf file and restart the service?
03:06 < pif> like issue a command to a running ovpn process?
03:06 < pif> instead of stop/start'ing it
03:10 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:10 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:13 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
03:13 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
03:13 -!- rich__ is now known as rich
03:23 <@vpnHelper> RSS Update - forum: UDP port issue <http://forums.openvpn.net/topic8275.html#p12801>
03:27 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Read error: Operation timed out]
03:29 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
03:29 <@vpnHelper> RSS Update - forum: connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html#p12803> || Client Key <http://forums.openvpn.net/topic8277.html#p12802>
03:32 -!- EugeneKay is now known as EugeneKaway
03:39 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
03:40 -!- bauruine [~stefan@217.150.236.196] has quit [Ping timeout: 248 seconds]
03:40 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:40 -!- mode/#openvpn [+o mattock] by ChanServ
03:42 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
03:42 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
03:42 -!- rich__ is now known as rich
03:43 -!- mlopez [~Michael@122.117-14-84.ripe.coltfrance.com] has quit [Quit: Quitte]
03:52 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
03:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 250 seconds]
04:04 -!- diytto [~diytto@zebra689.server4you.net] has quit [Quit: >:o]
04:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:06 -!- mode/#openvpn [+o mattock] by ChanServ
04:11 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
04:11 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
04:11 -!- rich__ is now known as rich
04:33 -!- M4g3 [~M4g3@spellfire.eecs.qmul.ac.uk] has joined #openvpn
04:33 < M4g3> Hi all,
04:34 < M4g3> I'm trying to get ipv6 patched 2.2 release to compile under vs but getting some compilation errors
04:34 < M4g3> wondered if you can give me some pointers
04:34 < M4g3> on the files i need to modify to get it to compile
04:35 <@vpnHelper> RSS Update - forum: connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html#p12804>
04:36 -!- pif [~ldm@90.95.90.238] has quit [Ping timeout: 258 seconds]
04:37 < M4g3> at the moment i get Windows SDK 6.1 complaint about ws2tcpip.h (C2632) int followed by int is illegal
04:40 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
04:40 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
04:40 -!- rich__ is now known as rich
04:43 < M4g3> that points to typdef int socklen_t in the SDK include
04:49 < M4g3> nvm tis sorted
04:59 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
05:01 -!- Cain` is now known as Cain
05:04 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
05:09 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
05:09 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
05:09 -!- rich__ is now known as rich
05:12 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12805>
05:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:18 <@vpnHelper> RSS Update - forum: connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html#p12806>
05:36 <@vpnHelper> RSS Update - forum: connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html#p12807>
05:38 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
05:38 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
05:38 -!- rich__ is now known as rich
05:42 <@vpnHelper> RSS Update - forum: connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html#p12809> || assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12808>
05:48 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12810>
05:57 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
06:00 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12812> || Message too long <http://forums.openvpn.net/topic8279.html>
06:07 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
06:07 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
06:07 -!- rich___ is now known as rich
06:11 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
06:24 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12813>
06:27 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
06:30 <@vpnHelper> RSS Update - forum: connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html#p12814>
06:31 -!- pranq [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
06:32 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
06:32 -!- master_of_master [~master_of@p57B55E3F.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
06:33 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
06:33 -!- master_of_master [~master_of@p57B55E3F.dip.t-dialin.net] has joined #openvpn
06:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:36 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
06:36 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
06:36 -!- rich___ is now known as rich
06:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
06:42 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
06:59 -!- bystander [adeaaaf7@gateway/web/freenode/ip.173.234.170.247] has joined #openvpn
07:00 < bystander> hi guys, how can I improve my throughput on openvpn
07:04 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Ex-Chat]
07:05 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
07:05 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
07:05 -!- rich___ is now known as rich
07:06 < bystander> hi guys, how can I improve my throughput on openvpn
07:11 -!- bystander [adeaaaf7@gateway/web/freenode/ip.173.234.170.247] has quit [Ping timeout: 252 seconds]
07:22 <@vpnHelper> RSS Update - forum: connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html#p12816> || Message too long <http://forums.openvpn.net/topic8279.html#p12815>
07:34 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
07:34 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
07:34 -!- rich___ is now known as rich
07:40 <@vpnHelper> RSS Update - forum: Moving OpenVPN Server onto different IP <http://forums.openvpn.net/topic8280.html>
08:03 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
08:03 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
08:03 -!- rich___ is now known as rich
08:04 <@vpnHelper> RSS Update - forum: Message too long <http://forums.openvpn.net/topic8279.html#p12818>
08:11 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
08:28 -!- grimeton [~stony@2a01:198:6f7::dead:beef] has joined #openvpn
08:28 < grimeton> hi
08:28 < grimeton> if i copy multicast packages over to the openvpn tun device, are they forwarded to the clients ?
08:32 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
08:32 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
08:32 -!- rich___ is now known as rich
08:33 -!- pif [~ldm@90.94.238.53] has joined #openvpn
08:33 < pif> hi, can I dynamically change the remote server without restarting the connection?
08:35 < ecrist> no
08:35 < grimeton> yes, but not with openvpn itself 
08:35 < grimeton> it's packet filter magic
08:36 < grimeton> and i would not recommend doing it
08:36 < nebajoth> it only takes a few seconds to restart anyway
08:36 < nebajoth> what's the dilly?
08:37 < pif> just asking
08:38 < grimeton> pif: if you need failover vpn you should check bsd together with carp and openvpn
08:38 < grimeton> pif: or bsd with ipsec,carp and it's sync mechanismns
08:39 < pif> ok
08:40 <@vpnHelper> RSS Update - forum: UDP port issue <http://forums.openvpn.net/topic8275.html#p12819>
08:49 < ecrist> we have two openvpn servers, and just have multiple 'remote' lines in our client configs
09:01 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
09:01 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
09:01 -!- rich___ is now known as rich
09:04 <@vpnHelper> RSS Update - forum: OpenVPN utf8 for password authentication <http://forums.openvpn.net/topic8281.html>
09:09 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
09:21 -!- diytto [~diytto@zebra689.server4you.net] has joined #openvpn
09:30 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
09:30 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
09:30 -!- rich___ is now known as rich
09:36 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:59 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
09:59 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
09:59 -!- rich__ is now known as rich
10:04 <@vpnHelper> RSS Update - forum: Moving OpenVPN Server onto different IP <http://forums.openvpn.net/topic8280.html#p12822> || assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12821>
10:09 -!- Lenhix [ElChaman@190.146.247.20] has joined #openvpn
10:11 <@vpnHelper> RSS Update - forum: Message too long <http://forums.openvpn.net/topic8279.html#p12825> || UDP port issue <http://forums.openvpn.net/topic8275.html#p12824> || OpenVPN utf8 for password authentication <http://forums.openvpn.net/topic8281.html#p12823>
10:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:27 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
10:28 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
10:28 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
10:28 -!- rich__ is now known as rich
10:28 <@vpnHelper> RSS Update - forum: Moving OpenVPN Server onto different IP <http://forums.openvpn.net/topic8280.html#p12827> || UDP port issue <http://forums.openvpn.net/topic8275.html#p12826>
10:34 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
10:34 -!- [intra]lanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Changing host]
10:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:57 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
10:57 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
10:57 -!- rich__ is now known as rich
10:59 -!- pif [~ldm@90.94.238.53] has quit [Ping timeout: 250 seconds]
11:05 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
11:05 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
11:11 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html>
11:21 -!- linuxviewer [viewer@c-174-52-163-53.hsd1.ut.comcast.net] has joined #openvpn
11:23 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
11:26 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
11:26 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
11:26 -!- rich___ is now known as rich
11:35 <@vpnHelper> RSS Update - forum: [solved] connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html#p12829>
11:55 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
11:55 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
11:55 -!- rich___ is now known as rich
12:09 < linuxviewer> I have setup an openvpn server with Linux and generated the certs.  On an XP machine i've never had a problem using the config file to VPN in.  With a Windows 7 machine it connects and gives appropriate ip but i can't even access the linux server (as if the traffic isnt/tunnel isnt really active).  Sometimes however it does work.  For example, just barely on a Windows 7 machine it would connect 
12:09 < linuxviewer> but it wouldnt work.  I then tried immediately on a XP machine and it works flawlessly.  Any advise on what could be causing this or next steps to diagnose?
12:11 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12830>
12:11 < hyper_ch> linuxviewer: does the same config and key work fine from a linux client?
12:16 < linuxviewer> hyper_ch - never tried a linux client.  
12:16 < hyper_ch> linux is simple
12:24 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
12:24 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
12:24 -!- rich___ is now known as rich
12:29 <@vpnHelper> RSS Update - forum: Client Key <http://forums.openvpn.net/topic8277.html#p12831>
12:29 < linuxviewer> hi hyper_ch - What do you mean?  I'm trying to use openvpn to connect as client a Windows 7 machine to a linux machine running openvpn server.
12:30 < linuxviewer> So that I have access to the openvpn server (linux server).  It works in XP but is flakey at best with Windows 7.  I'm not sure if this i common or if there is a lot of changes that need to be made to have Win7 work.
12:30 < hyper_ch> linuxviewer: I know... but if that config doesn't work on linux then there's something wrong with the config and not with win7
12:30 < linuxviewer> hyper_ch - the config (as a server) worksin linux
12:30 < linuxviewer> but i havent tried connecting using the config on client side as a linux client side
12:30 < hyper_ch> linuxviewer: only the client config is different from the server config
12:30 < linuxviewer> okay, then no, i have only used server config in linux
12:31 < linuxviewer> always used the same server config in linux and it works perfectly with XP, not so much with Win7
12:31 < hyper_ch> you could setup a VM to test it
12:31 < linuxviewer> so i too believe it is a win7 issue
12:31 < hyper_ch> well, all I know is that Windows and networking is for me a no-go :)
12:31 < linuxviewer> but was just wondering if it was something common that Windows 7 client requires more setup or something different
12:31 < hyper_ch> !win7
12:31 <@vpnHelper> "win7" is http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/8a3e9b05-353b-4250-a023-066a085e9657 for a workaround to the windows 7 unidentified network issue you get when using redirect-gateway
12:33 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
12:35 < linuxviewer> i'll read that and see if it is what i'm experiencing
12:35 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
12:36 < hyper_ch> doesn't sound like your problrm
12:38 < ecrist> linuxviewer: no, no additional setup, really.
12:38 < ecrist> the installer installes a tun/tap driver, but it's done that for years.
12:38 < hyper_ch> ecrist: so we can just blame it on windows?
12:39 < ecrist> sure, why not?
12:40 < hyper_ch> well, blaming it on windows is such a cliché
12:42 < ecrist> to be honest, I haven't had any problems running openvpn on windows 7
12:52 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
12:53 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
12:53 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
12:53 -!- rich___ is now known as rich
12:55 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 276 seconds]
13:11 <@vpnHelper> RSS Update - forum: non interactive key generation - windows ver <http://forums.openvpn.net/topic7620.html#p12832>
13:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:22 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
13:22 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
13:22 -!- rich__ is now known as rich
13:23 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:42 -!- EugeneKaway is now known as EugeneKay
13:50 -!- Clete2_ [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
13:51 -!- Clete2_ [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Client Quit]
13:51 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
13:51 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
13:53 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 260 seconds]
13:54 -!- linuxviewer [viewer@c-174-52-163-53.hsd1.ut.comcast.net] has quit []
13:56 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
13:59 < Licenser> greetings everyone
13:59 <@vpnHelper> RSS Update - forum: Leaving for China.. want to set up VPN at home first! <http://forums.openvpn.net/topic8283.html>
14:01 < Licenser> so I still fight with my speed issue, is there any good method of debugging this kind of things?
14:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:06 < krzie> try posting on the forum 
14:06 < krzie> maybe jjk will have an idea
14:08 < krzie> or the mailing list, its pretty active too
14:09 < Licenser> thanks for the advice krzie :) will do
14:09 < krzie> if you find a solution pls do mention it back here
14:09 < krzie> maybe it'll help others
14:18 < krzie> or you can search the mail list archives
14:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
14:18 < krzie> since im pretty sure this topic comes up semi-often
14:20 -!- rich [~rich@216.38.140.199] has joined #openvpn
14:20 -!- rich__ [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
14:22 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 244 seconds]
14:35 < Licenser> krzie: I am about to
14:35 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
14:35 < Licenser> the problem was very strange
14:37 < Licenser> I run the openvpn server in a ESXi VM. I added a second network adapter on the fly this messed up it's network, powering down the VM removing the NIC adding a new one seemed to have fixed thigns
14:45 -!- tewecske [~tewe@catv-86-101-250-38.catv.broadband.hu] has joined #openvpn
14:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
14:49 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
14:49 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
14:49 -!- rich__ is now known as rich
14:51 < tewecske> hi, can someone help me with this "write to TUN/TAP : Invalid argument (code=22)", i looked at every link google gave me, but no solution yet, and i think this why i get "Connection reset, restarting [-1]". i use ubuntu 11.04, openvpn 2.1.3
14:59 -!- Rolybrau [~Rolybrau@151-0.3-85.cust.bluewin.ch] has joined #openvpn
14:59 -!- Rolybrau [~Rolybrau@151-0.3-85.cust.bluewin.ch] has quit [Changing host]
14:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:05 -!- concept [~concept@is.a.hax0r.se] has quit [Quit: leaving]
15:12 -!- guifort [~guifort@ALille-255-1-52-26.w86-208.abo.wanadoo.fr] has joined #openvpn
15:18 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
15:18 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
15:18 -!- rich__ is now known as rich
15:26 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:33 -!- tewecske [~tewe@catv-86-101-250-38.catv.broadband.hu] has quit [Read error: Connection reset by peer]
15:34 -!- tewecske [~tewe@catv-86-101-250-38.catv.broadband.hu] has joined #openvpn
15:47 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
15:47 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
15:47 -!- rich__ is now known as rich
15:49 -!- tewecske [~tewe@catv-86-101-250-38.catv.broadband.hu] has quit [Quit: Leaving.]
15:53 -!- K1ng [~KING@180.211.188.103] has joined #openvpn
16:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: No route to host]
16:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
16:06 -!- mode/#openvpn [+o mattock] by ChanServ
16:08 -!- Dougy [me@openvpn/community/user/dougy] has quit [Read error: Connection reset by peer]
16:09 -!- Dougy [me@tech.qsi.net] has joined #openvpn
16:09 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Client Quit]
16:10 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
16:10 -!- mode/#openvpn [+o mattock] by ChanServ
16:16 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
16:16 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
16:16 -!- rich__ is now known as rich
16:45 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
16:45 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
16:45 -!- rich__ is now known as rich
16:47 -!- K1ng [~KING@180.211.188.103] has quit [Ping timeout: 258 seconds]
16:56 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 244 seconds]
17:01 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has joined #openvpn
17:04 -!- K1ng [~KING@180.211.188.103] has joined #openvpn
17:06 -!- Busch [~Busch@2001:4dd0:fc4f:0:a00:27ff:fed3:19b9] has quit [Ping timeout: 260 seconds]
17:10 <@vpnHelper> RSS Update - forum: New user bridge help <http://forums.openvpn.net/topic8284.html>
17:13 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
17:14 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
17:14 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
17:14 -!- rich__ is now known as rich
17:14 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
17:19 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
17:39 -!- K1ng [~KING@180.211.188.103] has quit [Read error: Connection reset by peer]
17:40 -!- K1ng [~KING@180.211.188.103] has joined #openvpn
17:42 -!- kusznir [~kusznir@casas-net.ailab.wsu.edu] has left #openvpn ["Leaving"]
17:42 -!- K1ng [~KING@180.211.188.103] has quit [Client Quit]
17:43 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
17:43 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
17:43 -!- rich__ is now known as rich
18:02 -!- K1ng [~KING@180.211.188.103] has joined #openvpn
18:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
18:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
18:08 -!- K1ng [~KING@180.211.188.103] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
18:12 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
18:12 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
18:12 -!- rich__ is now known as rich
18:13 -!- K1ng [~KING@180.211.188.103] has joined #openvpn
18:17 -!- Lenhix [ElChaman@190.146.247.20] has quit [Quit: Mindwall!!]
18:41 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
18:41 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
18:41 -!- rich__ is now known as rich
18:46 <@vpnHelper> RSS Update - forum: Restarting OpenVPN Server <http://forums.openvpn.net/topic8285.html>
18:58 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:59 < bystander> guys good day. may I ask what is the openvpn command in client mode to logout or exit from being connected to the server ?
19:01 < EugeneKay> Depends upon your client OS.
19:02 < bystander> the client OS is under windows versions
19:03 < bystander> EugeneKay, will you please tell me whats the command for it.
19:03 < EugeneKay> Generally, open the GUI window and click exit
19:05 < bystander> EugeneKay, I am not using the gui window.  I am using a command line.  I would like to know what is the code behind the exit button/menu of the openvpn gui.
19:05 < EugeneKay> Bugger if I know.
19:05 < EugeneKay> GUI window you should be able to just close.
19:05 < EugeneKay> Er
19:05 < EugeneKay> CLI*
19:06 < krzee> depending on if you started with daemon or not
19:06 < bystander> yes but aside from closing the program, maybe there is the comand to properly logoff from the server
19:07 < bystander> krzee, i have not started as daemon. but can you tell me the code anyway for starting with daemon and not.
19:09 < bystander> sorry guys that I have to ask because I dont see that command on the manual
19:10 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
19:10 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
19:10 -!- rich__ is now known as rich
19:14 < bystander> :(
19:14 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:16 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
19:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
19:18 -!- Cain` is now known as Cain
19:19 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
19:22 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
19:39 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
19:39 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
19:39 -!- rich__ is now known as rich
19:40 -!- Belial_ [~quassel@173-167-183-93-illinois.hfc.comcastbusiness.net] has joined #openvpn
19:40 -!- Belial_ [~quassel@173-167-183-93-illinois.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
19:42 -!- Belial_ [~quassel@216.18.197.178] has joined #openvpn
19:52 -!- EugeneKay [EugeneKay_@pitofsnakesandbrokenglass.com] has quit [Ping timeout: 248 seconds]
19:53 -!- EugeneKaway [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
19:53 -!- EugeneKaway is now known as EugeneKay
20:06 -!- jcordeiro [~jcordeiro@2001:470:d66a:0:20d:b9ff:fe1d:f598] has joined #openvpn
20:07 < jcordeiro> back
20:07 < jcordeiro> lol wrong open
20:07 -!- jcordeiro [~jcordeiro@2001:470:d66a:0:20d:b9ff:fe1d:f598] has left #openvpn []
20:08 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
20:08 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
20:08 -!- rich__ is now known as rich
20:13 -!- master_of_master [~master_of@p57B55E3F.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:14 -!- master_of_master [~master_of@p57B55BB4.dip.t-dialin.net] has joined #openvpn
20:15 -!- guifort [~guifort@ALille-255-1-52-26.w86-208.abo.wanadoo.fr] has quit [Quit: Quitte]
20:33 -!- queequeg1_ [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
20:36 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Ping timeout: 255 seconds]
20:36 -!- queequeg1_ is now known as queequeg1
20:37 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
20:37 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
20:37 -!- rich__ is now known as rich
20:46 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
21:06 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
21:06 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
21:06 -!- rich__ is now known as rich
21:10 -!- bauruine [~stefan@217.150.230.222] has joined #openvpn
21:11 -!- Netsplit *.net <-> *.split quits: EugeneKay, caesay, d12fk, amir, sedulous, pwrcycle, up_the_irons, kraut, belZe, bauruine,  (+4 more, use /NETSPLIT to show all of them)
21:11 -!- caesay [~caesay@socialshock.net] has joined #openvpn
21:11 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
21:11 -!- Netsplit over, joins: pwrcycle
21:11 -!- Netsplit over, joins: APTX
21:11 -!- Netsplit over, joins: belZe
21:11 -!- Netsplit over, joins: mace
21:11 -!- cali [~cali@ip-154.net-89-3-66.rev.numericable.fr] has joined #openvpn
21:11 -!- cali [~cali@ip-154.net-89-3-66.rev.numericable.fr] has quit [Changing host]
21:11 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
21:11 -!- Netsplit over, joins: d12fk
21:11 -!- caesay is now known as Guest13566
21:12 -!- Netsplit over, joins: up_the_irons, amir, sedulous, bauruine
21:12 -!- Netsplit over, joins: EugeneKay
21:15 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
21:16 -!- Muty [~amir@unaffiliated/muty] has joined #openvpn
21:18 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:22 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
21:35 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
21:35 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
21:35 -!- rich__ is now known as rich
21:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:50 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:53 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:54 -!- troyt [~troyt@2001:55c:43a6:444b::1] has quit [Ping timeout: 260 seconds]
21:59 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
22:03 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
22:03 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
22:03 -!- rich__ is now known as rich
22:05 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:05 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:17 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:18 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:23 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
22:32 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
22:32 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
22:32 -!- rich__ is now known as rich
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:44 -!- dxtr [jzwn0z@unaffiliated/dxtr] has joined #openvpn
22:53 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html>
22:59 <@vpnHelper> RSS Update - forum: Leaving for China.. want to set up VPN at home first! <http://forums.openvpn.net/topic8283.html#p12838>
23:01 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
23:01 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
23:02 -!- rich__ is now known as rich
23:03 -!- larie [~fling@83.246.243.61] has joined #openvpn
23:03 < larie> do i need <*>   IP: tunneling
23:03 < larie> to be set?
23:04 < larie> or openvpn will use only <M>   Universal TUN/TAP device driver support ?
23:19 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
23:20 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
23:30 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
23:30 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
23:30 -!- rich__ is now known as rich
23:59 <@vpnHelper> RSS Update - forum: OpenVPN utf8 for password authentication <http://forums.openvpn.net/topic8281.html#p12839>
23:59 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
23:59 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
23:59 -!- rich__ is now known as rich
--- Day changed Wed Jun 08 2011
00:06 -!- larie [~fling@83.246.243.61] has left #openvpn []
00:06 -!- hero911x [ad4fbb71@gateway/web/freenode/ip.173.79.187.113] has joined #openvpn
00:07 < hero911x> !welcome
00:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:07 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:08 < hero911x> howdy
00:08 < hero911x> can't seem to find an answer to this simple question: is it possible to get a server signed by a trusted CA (like GoDaddy) so that a client doesn't need a ca.crt?
00:12 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
00:14 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
00:17 <@vpnHelper> RSS Update - forum: Issue with multiple instance (tcp & udp) <http://forums.openvpn.net/topic8207.html#p12840>
00:26 -!- hero911x [ad4fbb71@gateway/web/freenode/ip.173.79.187.113] has quit [Ping timeout: 252 seconds]
00:28 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
00:28 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
00:28 -!- rich__ is now known as rich
00:34 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
00:47 -!- luneff [~yury@84.51.197.177] has joined #openvpn
00:52 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 250 seconds]
00:52 -!- STF [~chatzilla@dslb-188-101-231-110.pools.arcor-ip.net] has joined #openvpn
00:57 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
00:57 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
00:57 -!- rich__ is now known as rich
01:09 <@vpnHelper> RSS Update - forum: Can a hosted PHP script browse thru a VPN? <http://forums.openvpn.net/topic8287.html>
01:12 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:12 -!- mode/#openvpn [+o mattock] by ChanServ
01:21 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12842>
01:24 -!- STF [~chatzilla@dslb-188-101-231-110.pools.arcor-ip.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
01:26 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
01:26 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
01:26 -!- rich__ is now known as rich
01:27 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
01:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:55 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
01:55 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
01:55 -!- rich__ is now known as rich
01:58 <@vpnHelper> RSS Update - forum: non interactive key generation - windows ver <http://forums.openvpn.net/topic7620.html#p12843>
01:59 -!- K1ng [~KING@180.211.188.103] has quit [Ping timeout: 244 seconds]
02:00 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Quit: Leaving]
02:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:04 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12845> || Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12844>
02:06 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
02:07 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
02:10 <@vpnHelper> RSS Update - forum: New user bridge help <http://forums.openvpn.net/topic8284.html#p12847> || Network scope <http://forums.openvpn.net/topic8282.html#p12846>
02:15 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 260 seconds]
02:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
02:24 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
02:24 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
02:24 -!- rich__ is now known as rich
02:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:36 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Ping timeout: 258 seconds]
02:38 -!- K1ng [~KING@180.211.188.97] has joined #openvpn
02:40 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
02:40 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12849> || Restarting OpenVPN Server <http://forums.openvpn.net/topic8285.html#p12848>
02:46 <@vpnHelper> RSS Update - forum: Client Key <http://forums.openvpn.net/topic8277.html#p12850>
02:48 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
02:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:49 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:50 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
02:51 -!- K1ng`` [~KING@180.211.188.97] has joined #openvpn
02:53 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
02:53 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
02:53 -!- rich__ is now known as rich
02:54 -!- K1ng [~KING@180.211.188.97] has quit [Ping timeout: 240 seconds]
02:55 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
03:04 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12851>
03:06 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 252 seconds]
03:06 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:07 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Ping timeout: 268 seconds]
03:10 <@vpnHelper> RSS Update - forum: Redirecting <http://forums.openvpn.net/topic8288.html>
03:13 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
03:16 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12853>
03:21 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
03:22 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
03:22 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
03:22 -!- rich__ is now known as rich
03:26 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 240 seconds]
03:31 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
03:33 -!- s7r [~s7r@unaffiliated/s7r] has quit [Remote host closed the connection]
03:40 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
03:41 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
03:41 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:41 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:42 -!- K1ng`` [~KING@180.211.188.97] has quit [Ping timeout: 241 seconds]
03:47 -!- K1ng [~KING@180.211.188.97] has joined #openvpn
03:51 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
03:51 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
03:51 -!- rich___ is now known as rich
04:20 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
04:20 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
04:20 -!- rich___ is now known as rich
04:31 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:31 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:31 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:35 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Remote host closed the connection]
04:36 -!- mode/#openvpn [+o Bushmills] by ChanServ
04:36 -!- rich was kicked from #openvpn by Bushmills [fox your connection]
04:36 -!- mode/#openvpn [-o Bushmills] by Bushmills
04:46 -!- AL13N_work [~alien@91.183.52.232] has quit [Remote host closed the connection]
04:49 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
04:49 -!- rich___ is now known as rich
04:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:05 -!- mode/#openvpn [+o krzee] by ChanServ
05:06 -!- mode/#openvpn [+o krzie] by ChanServ
05:06 -!- mode/#openvpn [+b rich___!~rich@216.38.140.199] by krzie
05:06 -!- mode/#openvpn [-o krzee] by krzie
05:13 -!- fips4d [~fips4d@212.98.33.250] has joined #openvpn
05:13 < fips4d> hi
05:15 < fips4d> clients can't connect, i have this error on the server: TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
05:17 < fips4d> 'openssl verify -CAfile openvpn.crt -purpose sslclient client.crt' prints 'client.crt: OK'
05:17 < fips4d> where's the problem?
05:17 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
05:18 <@krzie> !certverify
05:18 <@krzie> !verifycert
05:18 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
05:18 <@krzie> !factoids search cert
05:18 <@vpnHelper> 'servercert', 'certs', 'nocert', 'certverify', and 'certinfo'
05:18  * krzie taps on vpnHelper 
05:18 -!- rich [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
05:21 -!- mode/#openvpn [-b rich___!~rich@216.38.140.199] by krzie
05:22 -!- mode/#openvpn [-o krzie] by krzie
05:22 < krzie> fips4d, pastebin the whole log
05:34 <@vpnHelper> RSS Update - forum: New user bridge help <http://forums.openvpn.net/topic8284.html#p12854>
05:34 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
05:46 <@vpnHelper> RSS Update - forum: New user bridge help <http://forums.openvpn.net/topic8284.html#p12855>
05:52 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p12856>
05:54 -!- p3rror [~mezgani@41.248.186.27] has joined #openvpn
06:03 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["WeeChat 0.3.5"]
06:04 <@vpnHelper> RSS Update - forum: UDP port issue <http://forums.openvpn.net/topic8275.html#p12857>
06:10 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:11 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
06:22 <@vpnHelper> RSS Update - forum: New user bridge help <http://forums.openvpn.net/topic8284.html#p12858>
06:29 -!- m4rcu5 [~root@srv01.m4rcu5.net] has joined #openvpn
06:35 < fips4d> krzie: http://paste.pocoo.org/show/402723/
06:36 < fips4d> krzie: 'openssl verify' works for both client and server cert
06:37 < fips4d> do you know what's the reason for the client not providing its cert?
06:41 <@vpnHelper> RSS Update - forum: bad source address from client <http://forums.openvpn.net/topic8289.html>
06:50 -!- p3rror [~mezgani@41.248.186.27] has quit [Ping timeout: 255 seconds]
06:54 < fips4d> krzie: are you still there?
06:55 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 244 seconds]
06:59 <@vpnHelper> RSS Update - forum: Message too long <http://forums.openvpn.net/topic8279.html#p12860>
07:12 -!- p3rror [~mezgani@41.248.107.149] has joined #openvpn
07:17 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has joined #openvpn
07:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:24 < fips4d> p3rror, Busch, [intra]lanman: are you familiar with x509?
07:29 <@vpnHelper> RSS Update - forum: UDP port issue <http://forums.openvpn.net/topic8275.html#p12861>
07:35 <@vpnHelper> RSS Update - forum: New user bridge help <http://forums.openvpn.net/topic8284.html#p12864> || bad source address from client <http://forums.openvpn.net/topic8289.html#p12863> || Message too long <http://forums.openvpn.net/topic8279.html#p12862>
07:42 < fips4d> around anyone?
07:47 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p12865>
07:52 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:52 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
07:54 < fips4d> MarKsaitis_, Cain, m4rcu5: are you familiar with x509?
07:56 -!- manitu [~manitu@p578b0cfb.dip0.t-ipconnect.de] has joined #openvpn
07:57 < manitu> hi there.. i created a crt, csr and key witheasyrsa, but the client wants a p12 file.. is there a program to "convert" this or something?
07:57 <@vpnHelper> RSS Update - forum: UDP port issue <http://forums.openvpn.net/topic8275.html#p12866>
08:00 < fips4d> manitu: yes, pkcs12
08:00 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
08:02 < manitu> fips4d, got a link for it? my package manager just got pkcs11 packages.. but i will start searching now :)
08:04 < fips4d> manitu: no, i mean 'openssl pkcs12', sorry
08:05 < manitu> fips4d, ahh.. thank you :)
08:08 < fips4d> manitu: do you have a hierarchical CA?
08:10 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
08:30 < fips4d> clients can't connect, i have this error on the server: TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
08:30 < fips4d> 'openssl verify -CAfile openvpn.crt -purpose sslclient client.crt' prints 'client.crt: OK'
08:30 <@vpnHelper> RSS Update - forum: Need IPv6 code in mroute_extract_addr_from_packet <http://forums.openvpn.net/topic8290.html>
08:30 < fips4d> where's the problem?
08:43 <@vpnHelper> RSS Update - forum: OpenVPN GUI do not shutdown on AUTH_FAILED <http://forums.openvpn.net/topic8291.html>
08:46 < manitu> oh sorry.. you wrote something.. sorry.. phoned.. atm i just want that gprs modem to connect to my openvpn server x_x .. i created the certificated like written there: http://wiki.openvpn.eu/index.php/Erzeugen_einer_PKI_mit_EasyRSA (sorry its german, i created a CA-key and cert and a diffie-hellman thing for TLS, then the server and client key-pairs) .. all done on one computer
08:46 <@vpnHelper> Title: Erzeugen einer PKI mit EasyRSA – OpenVPN Wiki (at wiki.openvpn.eu)
08:48 < ecrist> !configs
08:48 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
08:48 < ecrist> !logs
08:48 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:48 < ecrist> manitu: see those above from vpnHelper
08:48 < fips4d> ecrist: i've paste them at: http://paste.pocoo.org/show/402723/
08:51 < ecrist> fips4d: no
08:51 < ecrist> you didn't paste what I asked you to
08:52 < ecrist> please read above and paste as I asked.
08:53 < manitu> ecrist, first i try to make the p12 file.. a friend of mine did it with a x-program before and the client said that http://pastebin.com/xg1Zejb9 .. so i try it with new certs now and then i ask for more help if i still need, thank you :)
08:54 < ecrist> so, do you want help or not?
08:55 < manitu> nah.. not yet.. i think fips4d already helped me with the openssl pkcs12.. i'm looking for the syntax right now.. thank you
09:07 < fips4d> ecrist: http://paste.pocoo.org/show/402790/
09:11 <@vpnHelper> RSS Update - forum: OpenVPN GUI do not shutdown on AUTH_FAILED <http://forums.openvpn.net/topic8291.html#p12869>
09:26 -!- sikker [~sikker@cpe.xe-3-0-0-3332.vbrnqu2.customer.tele.dk] has joined #openvpn
09:29 <@vpnHelper> RSS Update - forum: Installation help <http://forums.openvpn.net/topic8292.html> || OpenVPN GUI do not shutdown on AUTH_FAILED <http://forums.openvpn.net/topic8291.html#p12870>
09:31 < sikker> a consultant set up our openvpn a while back. it's running on Debian. we've since then had to mount the harddrive in another computer, and the vpn connection no longer works. The new machine has the same IP as the former, no longer functioning machine, so the router setup should be good. I suspect the reason it doesn't work is that the interface we plug the ethernet into is now eth2 instead of eth0. we are using "dev tun". Is the
09:33 < fips4d> ecrist: and this is a new log paste: http://paste.pocoo.org/show/402805/
09:35 < ecrist> fips4d: no, it isn't.  I'd like the full log, please, set to verb 5 or 6
09:35 < fips4d> ecrist: can you help?
09:35 < fips4d> ok, wait...
09:57 < defswork> sikker, check your network interfaces and routes and paste your openvpn conifg online somewhere
09:57 < defswork> sikker, unless you bind to listen nic the eth2 thing shouldnt matter to openvpn
09:59 -!- ManDay [~ManDay@p4FE04D0E.dip.t-dialin.net] has joined #openvpn
09:59 < ManDay> Can someone help with openvpn? Is started it with --config, it asked me for my credentials, i entered them and after i pressed enter i was back at the shell and nothing happens
09:59 < ManDay> Even with --verb 9, nothing happens
10:00 < ManDay> routes are the same, no interface appears
10:00 < defswork> ManDay, running in daemon mode ?
10:00 < ManDay> i dont know
10:00 < ManDay> I just ran # openvpn
10:00 < ManDay> ibut it also isnt in pgrep
10:00 < defswork> whats in config file you passed with --config ?
10:01 < ManDay>  /etc/openvpn/rwthvpn
10:01 < ManDay> http://www.rz.rwth-aachen.de/global/show_document.asp?id=aaaaaaaaaabopsw
10:01 < ManDay> (apart from the log, mute, verb)
10:01 < ManDay> (and the cert is another)
10:01 < defswork> its got daemon in the config file
10:02 < defswork> so logs will go to /var/log/openvpn-rwth.log
10:02 < ManDay> oh
10:02 < defswork> cant your read this ?
10:02 < ManDay> no such file
10:02 < ManDay> i removed the log directive
10:02 < defswork> remove the daemon directive too
10:02 < ManDay> but i will try not in deameon monde
10:02 < ManDay> yep
10:03 < sikker> defswork: http://pastie.org/private/hkhwiuroefbkx4hteatvw <-- routes, interfaces and config
10:03 < ManDay> Wed Jun  8 17:03:13 2011 us=192841 Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
10:03 < defswork> sikker, looks fine to me
10:03 < ManDay> Wed Jun  8 17:03:13 2011 us=192855 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
10:03 < ManDay>  need to create that node myself?
10:04 < defswork> what kernel you on ?
10:04 < defswork> you might need to load the module
10:04 < hyper_ch> hi krzie
10:04 < defswork> sikker, port 11194 ?
10:05 < ManDay> defswork: 39.1
10:05 < ManDay> defswork: i ll create the node
10:05 < sikker> defswork: we had trouble with 1194, we suspected our ISP for blocking it. switching to 11194 and TCP instead of 1194 and UDP made it work.
10:05 < ManDay> though, can you tell me whether it makes a difference whether i tunnel on tap or tun?
10:05 < defswork> ManDay, kernel should do that
10:05 < ManDay> defswork: do what? create the node?
10:05 < ManDay> i do have a tunl0 device
10:06 < ManDay> but before i use it i need to know whether it makes a difference whether i tap or tun
10:06 -!- Yen [~Yen@unaffiliated/yen] has joined #openvpn
10:08 < ManDay>  nvm i see
10:09 < ManDay> its dictated by the server
10:09 < ManDay> maybe i need "tap" support in the kernel
10:09 < ManDay> if such a thing exists...
10:09 <@vpnHelper> RSS Update - forum: Need IPv6 code in mroute_extract_addr_from_packet <http://forums.openvpn.net/topic8290.html#p12873> || OpenVPN GUI do not shutdown on AUTH_FAILED <http://forums.openvpn.net/topic8291.html#p12872>
10:10 < ManDay> I can't find anything like tap support, only tunnel support
10:13 < ManDay> I dont even have /dev/net
10:19 < ManDay> help?
10:22 < ManDay> It looks like I need an extra decice support in the kernel
10:23 < ManDay> Why does OpenVPN require that and cannot use the support directly to the kernel?
10:23 < ManDay> Why that device?
10:23 -!- ManDay [~ManDay@p4FE04D0E.dip.t-dialin.net] has quit [Quit: WeeChat 0.3.5]
10:24 < defswork> the device is the kernel interface
10:25 < defswork> thats how userlevel process talks to kernel level driver
10:28 < defswork> http://www.linuxquestions.org/questions/slackware-14/unable-to-install-a-tun-tap-driver-on-a-2-6-18-kernel-slackware-11-a-505831/
10:28 <@vpnHelper> Title: Unable to install a Tun/Tap driver on a 2.6.18 kernel Slackware 11 (at www.linuxquestions.org)
10:30 < sikker> defswork: I solved it. The new machine's system clock was a few years behind
10:30 < ecrist> heh
10:31 < sikker> I can't blame openvpn for crying foul when someone from the future attempts to establish a connection
10:31 < defswork> that was John claude van damne
10:31 < ecrist> sikker: it's not even openvpn that cries about it, it's the openssl library
10:32 < sikker> ecrist: probably. I never got around to see it cry, I just decided to at least get DokuWiki working before calling it a day -- after diagnosing the clock problem everything worked.
10:32 < sikker> (DokuWiki uses time to determine the newest revision, so the revision it used was always the one from 2008)
10:33 < sikker> anyway, this means I can finally go home. Thanks for your time everyone
10:36 -!- sikker [~sikker@cpe.xe-3-0-0-3332.vbrnqu2.customer.tele.dk] has quit [Quit: Lost terminal]
10:49 -!- manitu [~manitu@p578b0cfb.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
10:49 < ecrist> !learn control as http://secure-computing.net/files/control.jpg
10:49 <@vpnHelper> Joo got it.
10:51 <@vpnHelper> RSS Update - forum: OpenVPN GUI do not shutdown on AUTH_FAILED <http://forums.openvpn.net/topic8291.html#p12874>
11:19 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 244 seconds]
11:19 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
11:22 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
11:40 <@vpnHelper> RSS Update - forum: New user bridge help <http://forums.openvpn.net/topic8284.html#p12875>
11:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
11:54 -!- drewr__ [~drewr@oks.bluefinlab.com] has joined #openvpn
11:59 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 276 seconds]
12:00 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
12:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:13 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has left #openvpn []
12:25 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
12:43 -!- straterra [~straterra@fuhell.com] has joined #openvpn
12:43 -!- straterra [~straterra@fuhell.com] has left #openvpn []
12:58 <@vpnHelper> RSS Update - forum: OpenVPN very slow - Less then 8KB/s <http://forums.openvpn.net/topic8227.html#p12876>
13:11 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
13:12 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
13:12 -!- mode/#openvpn [+o mattock] by ChanServ
13:22 <@vpnHelper> RSS Update - forum: problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p12877>
13:29 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
13:31 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
13:31 -!- mode/#openvpn [+o mattock] by ChanServ
13:37 -!- K1ng` [~KING@180.211.188.150] has joined #openvpn
13:37 -!- straterra [~straterra@fuhell.com] has joined #openvpn
13:38 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
13:38 < straterra> I need to add an IP address to an interface after a TAP openvpn interface starts. Is there a config option for this or should I use a postup script?
13:39 -!- K1ng [~KING@180.211.188.97] has quit [Ping timeout: 252 seconds]
13:40 < krzie> --server or --server-bride are the normal solution
13:40 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
13:40 < straterra> I'm using --server-bridge, but it doesn't add an IP to the interface
13:41 < krzie> i would expect it to, but ive never used a bridge, cant help
13:41 < krzie> you have a specific layer2 protocol you need over the vpn, right?
13:41 < straterra> correct
13:42 < krzie> cool, lan gaming?
13:42 < straterra> No
13:42 < krzie> please dont say its samba
13:43 < straterra> No, routing protocols
13:44 < krzie> ahh good stuff
13:44 < krzie> just between the vpn nodes tho, right?
13:44 < straterra> correct
13:44 < krzie> you can just use a normal routed tap setup
13:44 < krzie> instead of an actual bridge
13:44 < krzie> bridge is only needed when that layer2 is needed for the entire lan
13:45 < krzie> --server and tap will do layer2 between nodes
13:45 < krzie> (in case that makes things easier / more secure)
13:46 < straterra> I got it working via a post-up script
13:48 -!- EugeneKay is now known as EugeneKaway
13:56 -!- luneff [~yury@84.51.197.177] has joined #openvpn
14:07 < fips4d> ecrist: still around?
14:07 < fips4d> ecrist: this is the log with verb 6: http://paste.pocoo.org/show/402981/
14:07 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12878>
14:09 < fips4d> krzie: could also be for you...;)
14:10 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:28 < krzie> looks like on the client side something is no good
14:28 < krzie> its ca or crt
14:28 < krzie> !certverify
14:28 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
14:28 < krzie> test the client cert with the server ca
14:29 < krzie> that that passes, try client ca with server cert =]
14:30 < krzie> if that passes*
14:37 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
14:39 < fips4d> krzie: you mean 'openssl verify -CAfile openvpn.crt fips4d@company.ch.crt' and 'openssl verify -CAfile openvpn.crt vpngw.company.ch.crt'?
14:39 < fips4d> prints OK both
14:52 < krzee> umm no
14:52 < krzee> lol
14:52 < krzee> -CAfile means your ca file
14:52 < krzee> lol
14:52 < krzee> oh wait
14:53 < krzee> openvpn.crt is the name of your ca cert?
14:53 < ecrist> lol
14:53 < fips4d> lol? why? ;)
14:53 < fips4d> krzie: no, i'm using a hierarchical CA
14:54 < krzee> and is your hierarchical ca known as openvpn.crt?
14:54 < fips4d> openvpn.crt is the root ca and the vpn subca catted together
14:54 < ecrist> gah
14:54 < ecrist> don't do that
14:55 < fips4d> what else should i do then?
14:55 < ecrist> two separate files
14:55 < ecrist> you never posted your configs as I asked
14:55 < krzee> also, why would the client need more than 1 ca...?
14:57 < fips4d> ecrist: http://paste.pocoo.org/show/402790/
14:59 < fips4d> krzie: the client doesn't, but my company wants, for the ability to separately revoke certs for VPN access
14:59 < krzee> erm
15:00  * ecrist notes fips4d is using an outdated openvpn version
15:00 < krzee> i assume you mean for the ability to revoke entire departments / groups in a single swipe
15:00 < krzee> verb 1 is not good for troubleshooting, change it to verb 4 until you are finished
15:00 < krzee> on both
15:01 < krzee> i see you have all sorts of MTU stuff in server config, did you test that stuff and decide it was needed?
15:01 < krzee> or did you see it on the web and blindly add it?
15:02 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
15:08 < fips4d> krzee: ah, sorry, for debugging i set verb to 6...
15:08 < fips4d> ecrist: on the server?
15:17 < fips4d> ecrist: my apologies, but it is bundled in a fw appliance (endian)! :(
15:18 < fips4d> krzie, krzee: ?
15:18 < fips4d> are you the same?
15:19 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
15:19 < fips4d> MarKsaitis: hi
15:19 < MarKsaitis> hi
15:19 < fips4d> are you using a hierarchical CA?
15:20 < krzee> fips4d, do a whois on each to answer that for yourself
15:20 < krzee> but yes, krzie is me
15:30 -!- EugeneKaway is now known as EugeneKay
15:30 -!- rich__ [~rich@216.38.140.199] has joined #openvpn
15:34 < Pr0zoid> is there a way to view bandwidth by user?
15:37 < Pr0zoid> ie.. usage
15:38 < EugeneKay> Within the structure of OpenVPN itself, I do not believe so. a tool like iftop or SNMP tools of choice should be able to give you detail per-IP
15:38 < fips4d> ecrist: and how would i do it with multiple ca files instead of catting?
15:40 -!- rich___ [~rich@216.38.140.199] has joined #openvpn
15:40 -!- rich__ [~rich@216.38.140.199] has quit [Read error: Connection reset by peer]
15:40 -!- rich___ [~rich@216.38.140.199] has quit [Client Quit]
15:41 -!- mode/#openvpn [+o krzee] by ChanServ
15:42 -!- mode/#openvpn [+b rich__*!~rich@216.38.140.199] by krzee
15:42 -!- mode/#openvpn [-o krzee] by krzee
15:42 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
15:42 < krzee> hey wassup gladiatr 
15:42 < fips4d> gladiatr: hi
15:44 -!- rabbit7__ [~rabbit7@ds1789722.dedicated.solnet.ch] has joined #openvpn
15:44 < gladiatr> heya krzee!
15:44 < gladiatr> and to you, fips!
15:44 < rabbit7__> can anybody explain to me why every firewall vendor thinks SSL VPN means VPN through the browser ?
15:44 < rabbit7__> this is stupid !
15:45 < krzee> rabbit7__, stupidity
15:45 < krzee> yep, as you suspected ;]
15:45 < rabbit7__> its fucking pissing me off
15:45 < krzee> lemme make it easy for ya
15:45 < rabbit7__> we support ssl vpn, ohh yeah cool finally a vendor who stops using IPSEC
15:45 < krzee> router firmwares like openwrt or pfsense
15:46 < rabbit7__> and nooo its just fucking "vpn in the browser* bullshit
15:46 < krzee> or unix that you turn into a firewall
15:46 < rabbit7__> sorry for my troll, just getting annoyed by my evaluation...
15:46 < krzee> meh, its a valid complaint
15:46 < krzee> the thing is, openvpn is gpl
15:47 < krzee> so if someone like cisco were to add openvpn into their routers, they would need to package the source code as well
15:47 < rabbit7__> well microsoft is using ssl vpn as well
15:47 < rabbit7__> and thats not browser based
15:47 < krzee> ??
15:47 < rabbit7__> cisco offers ssl vpn as well as replacement for ipssec tunnels
15:48 < krzee> as in, PKI based?
15:48 < rabbit7__> yeah, i think they do 
15:48 < rabbit7__> SSTP is SSL based as well
15:48 < rabbit7__> and thats a "proper" vpn with a routing interface
15:49 < rabbit7__> just trying to understand wtf juniper thinks is ssl vpn
15:50 -!- rabbit7__ is now known as rabbit7
15:55 < Pr0zoid> eugenekay: thanks 
15:58 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:03 < gladiatr> whee!  just loaded a buffalo ap with the latest openwrt rc.  Almost fun to work with.
16:03 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:05 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
16:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:20 -!- rabbit7 [~rabbit7@ds1789722.dedicated.solnet.ch] has left #openvpn []
16:26 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
16:34 < fips4d> krzee, ecrist: well, i'll continue tomorrow...single CA doesn't work neither...:(
16:34 < fips4d> bye
16:35 < krzee> its either the cert or the ca
16:35 < krzee> its a simple pki problem
16:35 < krzee> later
16:35 < fips4d> bye
16:35 -!- fips4d [~fips4d@212.98.33.250] has left #openvpn []
16:39 -!- Yen [~Yen@unaffiliated/yen] has quit []
16:41 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
16:50 -!- Bearsy [5df5e439@gateway/web/freenode/ip.93.245.228.57] has joined #openvpn
16:50 < Bearsy> !welcome
16:50 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:54 < Bearsy> hi there i have a small problem in here.... i have configured an openvpn server and started it, but it seems the server isnt listening on his port (the result of sudo netstat -tulnp is: udp        0      0 10.182.85.1:1194        0.0.0.0:*                           9264/openvpn )
16:54 < Bearsy> i dont know what to do now
17:05 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 268 seconds]
17:06 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
17:06 -!- Licenser [~Licenser@82.210.31.96.rev.worldbone.de] has left #openvpn []
17:09 -!- Xgates [d475a0dc@gateway/web/freenode/ip.212.117.160.220] has joined #openvpn
17:09 < Xgates> hey guys
17:14 < Xgates> Can you use OpenVPN with ipsec or you need to use an ipsec client if you're going to use it?
17:16 -!- Bearsy [5df5e439@gateway/web/freenode/ip.93.245.228.57] has quit [Ping timeout: 252 seconds]
17:27 -!- drewr__ [~drewr@oks.bluefinlab.com] has quit [Quit: Computer has gone to sleep.]
17:30 -!- Xgates [d475a0dc@gateway/web/freenode/ip.212.117.160.220] has left #openvpn []
17:33 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
17:45 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
17:50 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:50 -!- Cain [~Geek@unaffiliated/cain] has left #openvpn []
17:51 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
17:56 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
18:09 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:11 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Quit: Ex-Chat]
18:30 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
18:34 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has joined #openvpn
18:34 <@vpnHelper> RSS Update - forum: non interactive key generation - windows ver <http://forums.openvpn.net/topic7620.html#p12879>
18:34 < Giggaflop> !welcome
18:34 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:35 < Giggaflop> !goal
18:35 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:35 < Giggaflop> I would like to access the internet over my vpn
18:35 < Giggaflop> !logs
18:35 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
18:37 < Giggaflop> question
18:38 < Giggaflop> Thu Jun  9 01:37:06 2011 us=723865 Giggaflop/82.33.67.68:60283 MULTI: bad source address from client [192.168.2.2], packet dropped
18:38 < Giggaflop> what does that line mean?
18:39 < Giggaflop> !howto
18:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:40 < Giggaflop> also i use a Dedicated OVH box
18:40 < Giggaflop> as far as i know i have no firewall
18:42 < Giggaflop> anyone?
18:43 < Giggaflop> hello?
18:44 < Giggaflop> !/30
18:44 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
18:44 < Giggaflop> !redirect
18:44 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
18:44 < Giggaflop> ohh
18:44 < Giggaflop> !def1
18:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
18:44 < dxtr> <3 topology
18:45 < Giggaflop> dxtr, can you help me?
18:45 < Giggaflop> !ipforward
18:45 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
18:45 < Giggaflop> !linipforward
18:45 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
18:45 < dxtr> Giggaflop: Depends
18:46 < Giggaflop> debian 6 OVH box, no iptables.
18:46 < Giggaflop> need inet routed over VPN
18:46 < Giggaflop> just never used openvpn before
18:46 < Giggaflop> i have the vpn itself set up
18:46 < dxtr> Without iptables? I'd say forget it
18:46 < dxtr> But I might be wrong
18:46 < Giggaflop> i have one error about source address
18:46 < Giggaflop> dxtr, it's designed to be pretty much open
18:47 < Giggaflop> it has users connecting on every port under the sun :P
18:47 < dxtr> So? You can still use iptables
18:47 < Giggaflop> whats the benifit?
18:47 < dxtr> Well, first of all, you can NAT the connections
18:48 < Giggaflop> no.. there is more than one service running here :P
18:48 < dxtr> I still don't get you
18:48 < Giggaflop> the one connectiong on every port is bittorent
18:48 < Giggaflop> connecting*
18:48 < dxtr> I still don't see how iptables is a problem
18:49 < Giggaflop> well i thought iptables was a firewall
18:49 < dxtr> In fact I think a bittorrent client shouldn't listen on port 1024-65535
18:49 < dxtr> Not all of them
18:49 < dxtr> Yes, it is a firewall
18:49 < Giggaflop> ok, so why do i need it?
18:50 < Giggaflop> just for nat?
18:50 < dxtr> Unless you can do some cool stuff with bridging you'll need iptables to forward the traffic from your tun interface to the interweb
18:50 < Giggaflop> oh..
18:50 < Giggaflop> ok then :)
18:51 < Giggaflop> installed
18:51 < Giggaflop> :)
18:51 < dxtr> I basically don't know shit about bridging
18:51 < Giggaflop> lol fair enough
18:51 < Giggaflop> as long as this vpn lets me route to interwebs
18:51 < Giggaflop> its all good
18:52 < krzee> why do you want a bridge?
18:52 < dxtr> krzee: Never said he wanted a bridge
18:52 < nutcase> Starting virtual private network daemon(s)...
18:52 < nutcase>  *   Autostarting VPN 'openvpn'
18:52 < nutcase>    ...fail!
18:52 < krzee> oh ok good
18:52 < krzee> hehehe
18:52 < nutcase> thats what I get when i try and run openvon
18:52 < krzee> whats the goal?
18:52 < nutcase> openvpn
18:52 < nutcase> but I havent setup iptables
18:52 < Giggaflop> inet via vpn
18:52 < krzee> nutcase, start it via commandline
18:52 < krzee> not via your os scripts
18:52 < krzee> (while testing)
18:52 < nutcase>  /etc/init.d/openvpn start
18:52 < nutcase> like that right?
18:53 < Giggaflop> no
18:53 < dxtr> Giggaflop: And what is the problem? Set up nat with iptables
18:53 < krzee> no
18:53 < krzee> thats your os scripts
18:53 < Giggaflop> dxtr, well i have an error
18:53 < krzee> openvpn /path/to/config
18:53 < Giggaflop> and i have to nat it seems
18:53 < Giggaflop> the error is Thu Jun  9 01:37:06 2011 us=723865 Giggaflop/82.33.67.68:60283 MULTI: bad source address from client [192.168.2.2], packet dropped
18:53 < krzee> Giggaflop, trying to share the lan behind the client?
18:54 < dxtr> Did you google, Giggaflop?
18:54 < Giggaflop> no, just route inet
18:54 < Giggaflop> dxtr, yes and i found a nice guide
18:54 < krzee> Giggaflop,
18:54 < nutcase> http://vpsnoc.com/blog/how-to-install-openvpn-on-a-debianubuntu-vps-instantly/
18:54 < Giggaflop> but it didnt work 100%
18:54 <@vpnHelper> Title: How to install OpenVPN on a Debian/Ubuntu VPS instantly | VPS Network Operation Center (at vpsnoc.com)
18:54 < nutcase> Thats what I used to setup
18:54 < krzee> !redirect
18:54 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
18:54 < Giggaflop> krzee, i saw
18:54 < nutcase> yes I know scripts are crappy :O
18:55 < Giggaflop> but idk what to do :s
18:55 < Giggaflop> http://www.ossramblings.com/configuring_openvpn_ubuntu_hardy  << i followed this
18:55 <@vpnHelper> Title: Configuring OpenVPN on Ubuntu 8.04 LTS | OSS Ramblings (at www.ossramblings.com)
18:55 < krzee> Giggaflop, what is 192.168.2.2?
18:55 < nutcase> I am on 10.10 x64
18:55 < Giggaflop> thats the clients internal IP address
18:55 < krzee> Giggaflop, for some reason its sending vpn traffic with its lan ip
18:55 < Giggaflop> like on its lan
18:55 < krzee> wrong source address
18:55 < krzee> something in your OS causes that, not sure what
18:55 < nutcase> you need to bridge the two with iptables
18:55 < Giggaflop> its ubuntu 11.04
18:56 < krzee> nutcase, he doesnt need to bridge anything...
18:57 < Giggaflop> what do you guys need to help me out?
18:57 < Giggaflop> also where i sysctrl.conf stored ?
18:57 < krzee> an understanding of what in your OS needs to be changed to make your machine not send a source address of the wrong interface
18:57 < krzee> sysctl.conf is in /etc/
18:57 < krzee> theres no r
18:58 < krzee> (aka, this isnt openvpn's fault)
18:58 < Giggaflop> ahh ok
18:58 < Giggaflop> ubuntu fail ;)
18:58 < krzee> nutcase, keep conversation in here please
18:58 < Giggaflop> !nat
18:59 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
18:59 < Giggaflop> !linnat
18:59 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
19:02 < Giggaflop> ok
19:02 < krzee> nutcase, now that you are starting it manually, you should be able to look at your logs
19:03 < Giggaflop> i need someone to read this for me and see if it makes sense :P
19:03 < nutcase> Yeah :)
19:03 < krzee> thats how you debug configurations, by looking at the logs ;]
19:03 < nutcase> I just need guide on how and where to look for em
19:03 < krzee> Giggaflop, read what?
19:03 < krzee> nutcase, 
19:03 < Giggaflop> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
19:03 < krzee> !logfile
19:03 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
19:03 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
19:03 < krzee> Giggaflop, well i KNOW that makes sense, i wrote it :-p
19:03 < nutcase> so I have to setup?
19:03 < Giggaflop> ohhh!
19:03 < Giggaflop> then thats my issues
19:04 < Giggaflop> i have no iroute
19:04 < krzee> Giggaflop, but thats for lans behind openvpn
19:04 < krzee> i asked if thats what you were trying, you said no
19:04 < Giggaflop> but thats my error there
19:04 < krzee> right, but not the same reason
19:04 < Giggaflop> oh :(
19:04 < krzee> yes, you can fix it with an iroute (kinda)
19:04 < krzee> if its not a laptop, it will work
19:04 < Giggaflop> damn
19:04 < krzee> (aka, if its always on that subnet, it'll work)
19:04 < krzee> if its roaming, it will only help when on that subnet
19:04 < nutcase> I bet it is
19:05 < krzee> i told you the problem
19:05 < krzee> i just cant tell you the solution, other than its not a openvpn thing
19:05 < krzee> ive seen people have your problem on a fresh install, then they reinstall and dont have it
19:05 < Giggaflop> could it be part of the openvpn client?
19:05 < krzee> i have no clue what causes it, or how to fix
19:05 < krzee> for the third time, its not an openvpn problem
19:05 < krzee> shall i say it a fourth time for ya?
19:05 < Giggaflop> no :P
19:05 < Giggaflop> its just frustrating
19:06 < krzee> iroute will workaround it for you
19:06 < Giggaflop> i finally get the vpn network up
19:06 < Giggaflop> and it might as well be down
19:06 < Giggaflop> no i need roaming too
19:06 < Giggaflop> unfortunately
19:06 < dxtr> krzee: I think it's openvpn! Don't you think?
19:06 < Giggaflop> X3
19:06 < krzee> dxtr, :-p
19:07 < nutcase> krzee so what should I run to see where the issue in it starting up is?
19:07 < Giggaflop> openvpn /etc/openvpn/server.conf
19:07 < krzee> Giggaflop, then i suggest taking it to a linux channel, your problem is that traffic leaving the tun0 interface is using the source ip of the eth0 interface
19:07 < Giggaflop> okai
19:07 < Giggaflop> taking to #ubunu
19:07 < krzee> nutcase, pastebin your logfiles with verb 4
19:07 < nutcase> oaky
19:07 < nutcase> oky
19:07 < nutcase> okay
19:07 < nutcase> damn I cant type
19:08 < nutcase> it seems to have started right up
19:08 < nutcase> waitno
19:09 < krzee> nutcase, 
19:09 < krzee> no msgs
19:09 < nutcase> okay
19:09 < nutcase> sorry
19:09 < nutcase> openvpn /etc/openvpn/openvpn.conf 
19:09 < nutcase> root@vpn:/etc/openvpn# 
19:09 < nutcase> cause there sis no server.conf
19:09 < krzee> doesnt matter what you named it
19:09 < krzee> just pastebin the logfiles
19:10 < dxtr> krzee: Let's say I wanna use that widnows network discovery thing and LAN games (Y'know those broadcast lan games like WC3) with my VPN - and let me do it when I'm on the run with my laptop
19:10 < dxtr> What would be my best choice?
19:10 < dxtr> bridging?
19:11 < krzee> do you need the lan clients to have layer2 over the vpn too?
19:11 < krzee> or just the vpn nodes?
19:11 < nutcase> I have no idea where the log files for it are
19:11 < krzee> !logfile
19:11 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
19:11 < krzee> they just let me out of work... im leaving
19:11 < krzee> dxtr, if only vpn nodes, use a normal setup with dev tap
19:12 < krzee> if you need the lan to have layer2 over the vpn too, you need bridge
19:12 < dxtr> Aight
19:12 < krzee> tap will give layer2 to vpn nodes
19:12 < dxtr> One question
19:12 < krzee> tap bridge will give it to the lan as well
19:12 < dxtr> Nodes?
19:12 < krzee> clients / server
19:12 < krzee> the machiens running the vpn
19:12 < dxtr> Aaaah
19:12 < dxtr> I would have to say no
19:13 < nutcase> yeah but does that mean I need to specify where to save the log files?
19:13 < nutcase> or is there a default location?
19:13 < krzee> nutcase, its pretty clear isnt it!?
19:13 < dxtr> nutcase: Probably /var/log/daemon.log
19:13 < krzee> "You can manually specify a logfile with: log /path/to/logfile"
19:13 < dxtr> if you didn't specify it
19:13 < krzee> just manually specify it for now
19:13 < krzee> if you use --daemon its in syslog, but why go searching, just specify it
19:14 < krzee> dxtr, whats your question before i go?
19:14 < dxtr> krzee: I asked it :D
19:14 < dxtr> "Nodes?"
19:14 < krzee> ohhh ok
19:14 < krzee> good luck guys, ill be back later prolly
19:14 < dxtr> I was smoking, so I typed a little inconsistently
19:14 < dxtr> Awesome!
19:14 < krzee> nice, im gunna go smoke a blunt myself =]
19:14 < krzee> adios!
19:14 < dxtr> Haha
19:15 < nutcase> http://pastie.org/private/zxomsm5pymdtkuf5d7mehg
19:21 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
19:22 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:22 -!- Cain` is now known as Cain
20:00 -!- diytto [~diytto@zebra689.server4you.net] has quit [Quit: >:o]
20:12 -!- master_of_master [~master_of@p57B55BB4.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:24 -!- master_of_master [~master_of@p57B559E8.dip.t-dialin.net] has joined #openvpn
22:13 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has quit [Ping timeout: 246 seconds]
22:20 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:21 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:24 <@vpnHelper> RSS Update - forum: VPN for unrestricted internet access to people overseas <http://forums.openvpn.net/topic7633.html#p12880>
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 250 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:40 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Read error: Connection reset by peer]
22:40 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
22:53 -!- extor [~extor@c-76-16-36-19.hsd1.il.comcast.net] has quit [Read error: No route to host]
23:08 -!- troyt [~troyt@2001:55c:43a6:444b::1] has quit [Ping timeout: 255 seconds]
23:09 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
23:19 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:33 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
23:36 -!- takamichi [~pri@c123-71.i07-31.onvol.net] has joined #openvpn
23:46 -!- takamichi [~pri@c123-71.i07-31.onvol.net] has quit [Remote host closed the connection]
23:49 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
23:52 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
23:54 <@vpnHelper> RSS Update - forum: Authenticate/Decrypt packet error <http://forums.openvpn.net/topic8293.html>
--- Day changed Thu Jun 09 2011
00:02 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:05 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
00:21 -!- s7r1 [~s7r@82.137.10.70] has joined #openvpn
00:22 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: Leaving.]
00:23 -!- s7r1 [~s7r@82.137.10.70] has left #openvpn []
00:24 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
00:28 -!- s7r1 [~s7r@82.137.10.70] has joined #openvpn
00:28 -!- s7r1 [~s7r@82.137.10.70] has left #openvpn []
00:28 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 252 seconds]
00:40 -!- troyt [~troyt@2001:55c:43a6:444b::1] has quit [Quit: AAAGH!  IT BURNS!]
01:04 -!- dazo_afk is now known as dazo
01:14 -!- yell0 [yello@unaffiliated/contempt] has quit [Read error: Operation timed out]
01:22 -!- fips4d [~fips4d@212.98.33.250] has joined #openvpn
01:22 < fips4d> re
01:24 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
01:24 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:24 -!- mode/#openvpn [+o mattock] by ChanServ
01:31 -!- sangi [~sangi@218.248.24.19] has joined #openvpn
01:44 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 255 seconds]
01:51 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
01:55 <@vpnHelper> RSS Update - forum: I will pay someone $100 to help me get my OpenVPN server up <http://forums.openvpn.net/topic8186.html#p12882>
02:07 <@vpnHelper> RSS Update - forum: UDP port issue <http://forums.openvpn.net/topic8275.html#p12883>
02:13 <@vpnHelper> RSS Update - forum: Multi Server VPN's using one login database and certificate <http://forums.openvpn.net/topic8189.html#p12885> || my wish <http://forums.openvpn.net/topic8159.html#p12884>
02:15 -!- sangi [~sangi@218.248.24.19] has quit [Ping timeout: 240 seconds]
02:15 -!- sangi [~sangi@218.248.24.19] has joined #openvpn
02:16 < krzie> nutcase, 
02:16 < krzie> Jun  9 04:08:44 vpn openvpn[11477]: Cannot open dh4096.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
02:16 < krzie> !path
02:16 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
02:17 < nutcase> hi krzee 
02:17 < krzie> hey
02:18 < nutcase> how was your blunt?
02:21 < krzie> decent
02:22 -!- sangi [~sangi@218.248.24.19] has quit [Ping timeout: 240 seconds]
02:22 < krzie> you fixed that error?
02:22 -!- sangi [~sangi@218.248.24.19] has joined #openvpn
02:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 240 seconds]
02:24 -!- pif [~ldm@90.94.0.223] has joined #openvpn
02:25 < pif> hi, what is the best openvpn provider out there? 
02:25 < pif> with the most worldwide locations?
02:26 < krzie> no idea, maybe others do...
02:26 < krzie> we support the software here ;]  (the question is still on topic tho)
02:27 < pif> sure
02:27 < krzie> theres a section about providers on the forum
02:27 < krzie> i dont think it has too much tho
02:30 <@dazo> people seem to prefer to set up their own VPN networks, instead of relying on others ... however, the OpenVPN Technologies company have recently released a new hosted OpenVPN product: https://www.shieldexchange.com/
02:30 <@vpnHelper> RSS Update - forum: problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p12887> || Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12886>
02:30 <@vpnHelper> Title: ShieldExchange - Connect to the Internet Securely (at www.shieldexchange.com)
02:31 < fips4d> krzie: re
02:32 < krzie> oh cool
02:32 < krzie> hey fips
02:33 < hyper_ch> hi krzie
02:34 < pif> dazo: thx for the link
02:37 <@vpnHelper> RSS Update - forum: New user bridge help <http://forums.openvpn.net/topic8284.html#p12888>
02:38 < fips4d> i have to upload a pkcs#12 file to the fw appliance...in this (decrypted) file i have the subca and the server key, but not the root ca...is that normal?
02:44 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has joined #openvpn
02:49 <@vpnHelper> RSS Update - forum: Official Android App <http://forums.openvpn.net/topic8117.html#p12889>
02:57 < hyper_ch> hi Busch
03:29 -!- luneff [~yury@84.51.197.177] has joined #openvpn
03:31 <@vpnHelper> RSS Update - forum: Authenticate/Decrypt packet error <http://forums.openvpn.net/topic8293.html#p12890>
03:44 -!- nebajoth [~nebajoth@starfighter.org] has quit [Ping timeout: 246 seconds]
03:45 -!- nebajoth [~nebajoth@starfighter.org] has joined #openvpn
03:48 < nutcase> no krzie I didnt
03:48 < krzie> it couldnt find your dh files
03:48 < krzie> !dh
03:48 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
03:49 < nutcase> i know where they are
03:49 -!- generalseven [530832e6@gateway/web/freenode/ip.83.8.50.230] has joined #openvpn
03:50 < generalseven> !welcome
03:50 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:50 < generalseven> !goal
03:50 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:51 < generalseven> !wiki
03:51 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
03:52 < generalseven> which are the best vpn services available?
03:54 -!- generalseven [530832e6@gateway/web/freenode/ip.83.8.50.230] has quit [Quit: Page closed]
04:13 -!- Ragnar_ [heimdall@darkstar.acool.net] has joined #openvpn
04:13 < Ragnar_> hey
04:13 < Ragnar_> the openvpn gui, does it run on windows 64bit
04:15 < krzie> !download
04:15 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
04:16 < krzie> the one there, yes
04:39 < Ragnar_> nods
04:39 < Ragnar_> thanks
04:45 < Kartagis> is there a guide for configuring openvpn with database auth?
04:46 < hyper_ch> krzie: :(
04:46 < Kartagis> !database
04:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:50 < krzie> hey hyper_ch 
04:50 < hyper_ch> krzie: :) took a long time :) you're also using freeswitch, right?
04:50 < krzie> Kartagis, not really, you just use a script to query the db
04:50 < krzie> Kartagis, 
04:51 < krzie> !authpw
04:51 < krzie> !pwauth
04:51 < krzie> !authpass
04:51 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
04:51 < krzie> there it is!
04:51 < krzie> hyper_ch, yep
04:51 < krzie> freeswitch for fun (dont do much), and cudatel for office
04:51 < hyper_ch> krzie: did you know that there's a yealink hard phone that has integrated openvpn support'
04:52 < krzie> no, are you reading my mind?
04:52 < hyper_ch> krzie: I still haven't quite mastered the art of mine-reading over the internet :)
04:52 < hyper_ch> but getting better :)
04:52 < krzie> i was about to pre-configure some routers, and ATAs
04:52 < krzie> that would be easier
04:52 < krzie> but then the real question
04:53 < krzie> how much are they?
04:53 < hyper_ch> krzie: http://wiki.freeswitch.org/wiki/Yealink-SIP-T26P#OpenVPN
04:53 <@vpnHelper> Title: Yealink-SIP-T26P - FreeSWITCH Wiki (at wiki.freeswitch.org)
04:53 < krzie> prolly still cheaper to get a cheapo router and ATA
04:53 < hyper_ch> I can get them here for around $ 150
04:53 < hyper_ch> (converted to low us currency)
04:53 < krzie> ya, quite a bit more
04:53 < hyper_ch> but just one device
04:53 < krzie> yep, it is better
04:54 < krzie> it'll be an option
04:54 < hyper_ch> and even has PoE
04:54 < hyper_ch> if you have an according switch
04:54 < krzie> good to know, thanks
04:54 < hyper_ch> krzie: :)
04:54 < krzie> right, its a nice phone
04:54 < krzie> the setup im doing will be lil home stuff spread around
04:54 < krzie> making an internal phone system for me and some friends
04:54 < krzie> bypass international phonebills
04:55 < hyper_ch> :)
04:55 < krzie> some on android phones, some on router + ata, some on softphone + vpn
04:55 < krzie> and maybe some on that hardphone
04:56 < krzie> arg
04:57 < krzie> they use 2.0.x on that hardphone
04:57 < hyper_ch> is that bad?
04:58 < krzie> not really, i can use topology net30 if needed
04:58 < hyper_ch> and now in english?
04:58 < krzie> !/30
04:58 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
04:58 < krzie> !topology
04:58 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
04:58 < hyper_ch> :)
04:59 < hyper_ch> krzie: why not using tinyurl for that long link?
05:00 < krzie> it reminds me to bug them to fix the anchors
05:00 < krzie> ;]
05:00 < hyper_ch> or create an own url shortener 
05:00 < hyper_ch> e.g. short.openvpn.net/XADFSD
05:01 < krzie> [06:01]  <krzie> it reminds me to bug them to fix the anchors
05:01 < hyper_ch> been pondering about setting up an own url shortener service
05:01 < hyper_ch> shouldn't be too hard
05:01 < hyper_ch> as I've already setup a simple image hosting service for me :) basically it's all the same
05:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:30 < fips4d> is there something missing (in the correspondig pkcs12 file)? i'm still getting the 'no certificate returned' error. http://paste.pocoo.org/show/403351/
05:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:44 < EugeneKay> Posting even a portion of your private key is a bad idea.
05:47 < fips4d> EugeneKay: it's only a test key
05:47 < EugeneKay> The point stands.
05:47 < krzie>  city=$(geoiplookup $ip |head -n1|cut -d: -f2|cut -d, -f1,2,3,4|sed 's/,//g')
05:47 < krzie>  asn=$(geoiplookup $ip |tail -n1|cut -d: -f2|cut -f3- -d ' '|sed 's/,//g')
05:47 < krzie> so fresh and so clean
05:50 < fips4d> ?
05:50 < krzie> i take it back, s/-f1,2,3,4/-f1-4/
05:51 < fips4d> krzie: what are you talking about?
05:51 < krzie> nothing even close to on topic, ignore me ;]
05:52 < krzie> was showing hyper_ch how i made a script aware of city / ASN of an ip
05:52 < krzie> it turns him on when i talk scripting
05:53 < fips4d> lol...
05:55 -!- dazo is now known as dazo_afk
05:56 < krzie> did you use ../build-key-pkcs12 mycert
05:56 < krzie> when you made it
05:56 < krzie> http://openvpn.net/index.php/open-source/documentation/miscellaneous/77-rsa-key-management.html
05:56 <@vpnHelper> Title: RSA Key Management (at openvpn.net)
05:59 -!- dazo_afk is now known as dazo
06:06 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
06:14 < hyper_ch> thx krzie
06:18 -!- v0lZy [d5fd653e@gateway/web/freenode/ip.213.253.101.62] has joined #openvpn
06:18 < v0lZy> hi
06:18 < v0lZy> I couldnt find anywhere else to ask...
06:19 < v0lZy> I'm in a situation where ineed toimpelemnt some VPN ... a hardware device
06:19 < v0lZy> I wouldnt like to change any network topology or anything
06:19 -!- klemax [~klemax@unaffiliated/klemax] has joined #openvpn
06:20 < v0lZy> Can anyone giveme some advice? I'm looking for something like a gateway device that i can put into mynetwork, configure a static route to it, and having it go back through the router from which it gets its dhcp
06:20 < v0lZy> to the other end point
06:20 < klemax>  TLS Error: client->client or server->server connection attempted from VPS_IP:1194
06:20 < klemax> How to fix that error?
06:20 < v0lZy> basically a drop in solution... do such things exist?
06:24 < fips4d> krzie: no, my own scripts...
06:34 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html>
06:39 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
06:41 -!- p3rror [~mezgani@41.248.107.149] has quit [Ping timeout: 255 seconds]
06:46 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
06:54 -!- p3rror [~mezgani@41.248.106.67] has joined #openvpn
06:55 -!- v0lZy [d5fd653e@gateway/web/freenode/ip.213.253.101.62] has quit [Quit: Page closed]
07:03 -!- sangi [~sangi@218.248.24.19] has quit [Remote host closed the connection]
07:09 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:15 < klemax> IMPORT_ERROR: profile or its references could not be read: can not process OpenVPN file: cannot read file for OpenVPN 'ca' directive ...
07:16 < klemax> I got that import error in openvpn client. 
07:16 < klemax> OS is windows vista.
07:16 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has joined #openvpn
07:16 < Giggaflop> hey?
07:17 < Giggaflop> can you hear me now? :P
07:17 < hyper_ch> no
07:17 < Giggaflop> yay :P
07:17 < Giggaflop> anyhow
07:17 < Giggaflop> i have a vpn set up, i can ping the other side (1.1.0.1)
07:17 < Giggaflop> now i want to forward that traffic to the net
07:18 < Giggaflop> so my vpn uses 1.1.0.1 as like a gateway to the net
07:19 < ecrist> you'll need to setup nat on the vpn server
07:20 < Giggaflop> so !nat 
07:20 < Giggaflop> right?
07:20 < Giggaflop> !nat
07:20 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
07:20 < Giggaflop> !linnat
07:20 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
07:20 < Giggaflop> umm
07:21 < Giggaflop> in my case.. iptables -t nat -A POSTROUTING -s 1.1.0.1/24 -o eth0 -j MASQUERADE
07:21 < Giggaflop> right?
07:21 < Giggaflop> as i connect to 1.1.0.1
07:21 < fips4d> krzie: this is the script i'm using: http://paste.pocoo.org/show/403400/
07:21 < ecrist> no
07:21 < Giggaflop> oh :(
07:21 < ecrist> Giggaflop: you need to nat traffic to your REAL ip
07:21 < Giggaflop> oh
07:22 < Giggaflop> so 185.195.198.8 
07:22 < Giggaflop> or whatever it is :p
07:23 < Giggaflop> so iptables -t nat -A POSTROUTING -s 185.195.198.8/24 -o eth0 -j MASQUERADE
07:23 < Giggaflop> that right?
07:23 < Giggaflop> will this interfere with any other traffic?
07:25 -!- klemax [~klemax@unaffiliated/klemax] has left #openvpn []
07:25 < ecrist> Giggaflop: also, I'd recommend away from using the 1/8 network as you don't own it
07:25 < ecrist> use a proper 1918 address
07:27 < fips4d> krzie, ecrist: is there something missing (in the correspondig pkcs12 file)? i'm still getting the 'no certificate returned' error. http://paste.pocoo.org/show/403351 :(
07:27 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has quit [Quit: Leaving]
07:30 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has joined #openvpn
07:30 < Giggaflop> nope
07:30 < Giggaflop> didn't work :(
07:30 < Giggaflop> oh look
07:30 < Giggaflop> i typo'd
07:31 < Giggaflop> how do i remove an iptables 
07:31 < fips4d> Giggaflop: rm `which iptables`! ;)
07:32 < Giggaflop> umm
07:32 < fips4d> no
07:32 < Giggaflop> yea
07:32 < Giggaflop> thats what i was thinking
07:32 < fips4d> just try '-D' instead of '-A'
07:32 < Giggaflop> i ran the subshell first :p
07:33 < Giggaflop> thanks
07:33 < Giggaflop> :)
07:34 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Read error: Operation timed out]
07:43 < krzie> fips4d, well try using easy-rsa
07:43 < krzie> it IS a problem with your certs
07:44 < krzie> why dont you try the utilities packaged with openvpn since you're having problems with yours
07:45 < fips4d> i've also used tinyca and xca, with both the same problem
07:45 < ecrist> or ssl-admin
07:46 < ecrist> fips4d: while it *is* on-topic, we don't have an interested in helping you with third-party ssl managers
07:46 < fips4d> krzie: but you're right, easy-rsa i didn't try by now..
07:47 < fips4d> ecrist: i'll give easy-rsa a try! ;)
07:47  * ecrist prefers ssl-admin
07:48 < krzie> ecrist, does ssl-admin do pkcs12?
07:48 < krzie> i do too
07:49 < ecrist> I don't think so.
07:49 < ecrist> it stores the certs and keys separately
07:55  * defswork just looked at what easy-rsa ws doing and called the ssl programs directly
07:57 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
08:06 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: Leaving.]
08:08 < defswork>   /me curses
08:08 < defswork> "We could really use details of large organisations with 300 – 500 remote users who actively use this solution and ideally details of the company"
08:08 < defswork> my h/o IT guy re implementing openvpn for 400 users
08:09 < defswork> I've already pointed to anecdotal evidence of high user numbers and pointed out not many companies advertise what they use for security
08:10 < krzie> you have 400 on now?
08:10 < defswork> no
08:10 < krzie> or have had 400 on?
08:10 < defswork> well
08:10 < defswork> we have 400 users on a bought for vpn that doesnt work very well
08:11 < krzie> dont be so sure you'll get 400 using openvpn
08:11 < krzie> maybe you will, maybe you wont
08:11 < krzie> its monolithic, only runs on 1 core
08:11 < defswork> krzie, quad core - 4 processes, multiple remotes
08:11 < krzie> multiple servers on 1 box?
08:11 < defswork> yes
08:11 < krzie> good stuff =]
08:11 < defswork> http://blog.defsdoor.org/2011/06/02/large-openvpn-server-deployment
08:12 <@vpnHelper> Title: Large Openvpn Server Deployment - Standing On The Shoulders Of Ants (at blog.defsdoor.org)
08:12 -!- M4g3 [~M4g3@spellfire.eecs.qmul.ac.uk] has quit [Quit: Leaving]
08:12 < defswork> it will never be anywhere near 400 simultaneous connections though
08:13 < defswork> and I've setup the config / environment so we can simply add another box
08:13 < defswork> it will scale as far as we need it to and beyond
08:13 < fips4d> krzie, ecrist: how can i build a hierarchical CA with easy-rsa?
08:16 < defswork> krzie, you read that page ? am I on track ?
08:18 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
08:23 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 240 seconds]
08:28 -!- dazo is now known as dazo_afk
08:29 -!- dazo_afk is now known as dazo
08:31 < krzee> fips4d, maybe by reading the link i gave you
08:32 < krzee> [03:56]  <krzie> http://openvpn.net/index.php/open-source/documentation/miscellaneous/77-rsa-key-management.html
08:32 <@vpnHelper> Title: RSA Key Management (at openvpn.net)
08:35 < krzee> defswork, reading
08:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
08:37 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
08:37 < fips4d> krzee: ah, "intermediate" was the word to look for! :)
08:37 < krzee> cat'ing 2 4-8 letter words is not "practically unbreakable"
08:38 < krzee> it could end up being an 8char pass
08:38 < krzee> put an 8char pass in md5 and ill own it VERY fast
08:38 < defswork> krzee, only form of attack is brute force though
08:38 < defswork> unless the passwd db is taken
08:38 < defswork> but if it is it's already too late anyway
08:40 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has joined #openvpn
08:40 < fips4d> krzee: do you know by accident how to create a pkcs#12 file from a server cert and key? or can i use ./build-key-pkcs12 *instead* of ./build-key-*server*?
08:42 < defswork> krzee, user authentication aside ;) does it look ok ?
08:42 -!- Kartagis_ [sbnc@kunduz.org] has joined #openvpn
08:45 < krzee> yep
08:46 < defswork> I honestly cannot see there ever being 100 simultaneous connections let alone 400
08:46 < defswork> but I had to cover all possible objections
08:46 < fips4d> krzee: and with the pkcs#12 file for the *server*? ;)
08:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:48 -!- Kartagis_ is now known as Kartagis
08:48 -!- Kartagis [sbnc@kunduz.org] has quit [Changing host]
08:48 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
08:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:48 -!- dkr [~dkr@67.132.255.16] has quit [Quit: Leaving]
08:48 -!- Rajko [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 268 seconds]
08:49 < krzee> fips4d, i dont use pkcs12, while i could easily look at the differences between the 2 scripts and mod it, i suggest you do it
08:49 < krzee> since i wont be ;]
08:49 < krzee> heres the rundown of whats special about build-key-server
08:49 < krzee> !servercert
08:49 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key, or (#2) this will help with !mitm
08:49 < krzee> -extensions server
08:51 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:59 < ecrist> fips4d: why are you so hell-bent on pkcs#12?
09:09 < fips4d> ecrist: because my[tm] fw appliance needs it! ;)
09:10 < ecrist> I'm sure, given motivation, I could make ssl-admin support it
09:10 < ecrist> send your money via paypal to openvpn@secure-computing.net
09:10 < ecrist> :D
09:11 < fips4d> ah, and now finally i'm getting at least a different error: error=unsupported certificate purpose: ...! :)
09:11 < fips4d> ecrist: lol
09:12 < ecrist> fips4d: I wasn't kidding...
09:13 -!- drewr__ [~drewr@oks.bluefinlab.com] has joined #openvpn
09:14 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p12892>
09:17 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has joined #openvpn
09:24 < fips4d> ecrist: so why did you place a ":D" there? ;)
09:29 < krzee> the prospect of $ makes him smile
09:29 < krzee> :D
09:31 < ecrist> :D
09:32 < thaNatozZ> hey, can i install an openvpn server on my home pc and connect to it with the same home pc to set up a working vpn? or do i need to install the server on a different machine if it's only for me?
09:32 < defswork> you want to vpn to the same pc ?
09:32 < thaNatozZ> :s
09:33 < thaNatozZ> i just want to set up the most simple and basic setup
09:33 < thaNatozZ> for myself
09:33 < thaNatozZ> and i don't own a server anywhere :s
09:33 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
09:34 < thaNatozZ> or how would i be supposed to do this? are there open networks for openvpn?
09:36 < fips4d> thaNatozZ: what os?
09:36 < thaNatozZ> something like this shieldexchange thing but for linux i reckon
09:37 < thaNatozZ> yeah, arch linux and debian linux maybe for my laptop
09:37 < thaNatozZ> but mainly for my arch home pc
09:38 < fips4d> thaNatozZ: you could ask a friend to help you with his home pc?
09:39 < thaNatozZ> okay yeah that's an id
09:39 < thaNatozZ> but the pc would have to be running 24/7 for me to be able to have access
09:39 < thaNatozZ> i guess i'll set up a server version on my pc at my parents home ;(
09:40 < thaNatozZ> if they let me run it all the time <: or wait i could even remote-boot it iirc
09:40 < thaNatozZ> seems like a possible setup, so thx for the help :)
09:41 < fips4d> or buy a small device like the nslu2 was
09:41 < thaNatozZ> i'll check it out
09:56 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p12893>
10:21 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
10:21 < Kendall> !welcome
10:21 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:22 < Kendall> !goal
10:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:22 < Kendall> !route
10:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:31 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has quit [Ping timeout: 250 seconds]
10:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
11:03 -!- K1ng [~KING@180.211.188.161] has joined #openvpn
11:06 -!- K1ng` [~KING@180.211.188.150] has quit [Ping timeout: 276 seconds]
11:19 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has joined #openvpn
11:23 -!- BoomSie [~gideon@77.242.112.238] has joined #openvpn
11:24 -!- BoomSie [~gideon@77.242.112.238] has quit [Read error: Connection reset by peer]
11:30 -!- Giggaflop [~Gigga@cpc2-trow1-0-0-cust835.aztw.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
11:42 < Kendall> Hi..I have a VPN setup between two sites, which is working nicely.  I've added a third site, which is mostly working, but not quite there.  Each site has has one or more LANs behind it that should be accessible over the VPN.  The end goal is to be able to connect to any of the three sites, and access any of the LANs.  Call the sites AH, CDC and IDC.  My problem is:  When connected to the AH openvpn server, I cannot access t
11:43 < krzee> truncated at: "I cannot access t"
11:43 < Kendall> oops, sorry, one second
11:44 < Kendall> I cannot access the LAN (10.4.0.x/16) behind the CDC openvpn server.  No ping, no traceroute, no ssh..no connectivity.  Can someone help me troubleshoot?  I'm a bit out of familiar waters with having all the different networks going on
11:45 < Kendall> The LAN behind the AH openvpn server is 192.168.3.x, and when physically connected to that network, I can at least establish a connection to the 10.4.0.x network.
11:48 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
11:48 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
11:55 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 240 seconds]
11:56 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
12:20 -!- Yen [~Yen@unaffiliated/yen] has joined #openvpn
12:46 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
13:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
13:06 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12894>
13:07 -!- pif [~ldm@90.94.0.223] has quit [Read error: Operation timed out]
13:16 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
13:22 <@vpnHelper> RSS Update - forum: Leaving for China.. want to set up VPN at home first! <http://forums.openvpn.net/topic8283.html#p12895>
13:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:31 < Kendall> Hi..can someone help me troubleshoot a routing issue in a 3 site/server openvpn setup ?  
13:34 < defsdoor> Kendall, linux hosts ?
13:34 < Kendall> defsdoor:  yep
13:35 < defsdoor> which one is the server ?
13:35 < defsdoor> or do you have a-b a-c b-c connectivity ?
13:36 < Kendall> there are actually 3 servers, each doing client/server
13:36 < defsdoor> right is one server and 2 clients ?
13:36 < Kendall> our goal is to be able to connect to any of the 3 vpn servers and have access to the LANs behind them
13:37 < defsdoor> do the clients all have static routes to the other lans via their gateway ?
13:37 < defsdoor> or is the gateway the default route? 
13:37 < defsdoor> bored now
13:38 < Kendall> static routes
13:38 < Kendall> the default gw is just the internet facing router
13:38 < defsdoor> do you have a single server and 2 clients ?
13:39 < Kendall> no, there are 3 servers, and 3 clients
13:39 < defsdoor> if you had  a-b and added c does c connect to a or b or both ?
13:39 < defsdoor> wtf ?
13:40 < Kendall> maybe I'm misunderstand, but each site has an OpenVPN server that accepts VPN connections externally, and also connects to the other VPN servers at the other sites
13:40 < Kendall> so if any one link goes down, there are 2 others that should give us access to all the LANs
13:41 < defsdoor> so you run server on a, b and c and client on a that connects to b and c and client b that connects to a and c and client on c that connects to a and b ?
13:42 < Kendall> yes, that is the goal
13:42 < defsdoor> you cant do that
13:42 < defsdoor> you have 2 connections for each client to other client
13:42 < defsdoor> which one is going to route the traffic ?
13:43 < defsdoor> you need a server on a and b and a client on a connecting to b and 2 clients on c connecting to a and b
13:44 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Quit: Leaving]
13:44 < defsdoor> so sa <-> cc, ca <-> sb and cc <-> sb
13:44 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
13:44 < defsdoor> where s is openvpn server and c is openvpn client
13:45 < defsdoor> and you will have to have different ports for the traffic
13:51 < Kendall> then if sa and sb go down, there is no server running on c, only a client, and I have no access to the LANs behind sites a and b
13:51 < Kendall> hmmm
13:51  * Kendall is just a linux admin that got tossed into this
14:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:19 -!- Pr0z0id [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
14:21 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
14:22 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:25 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:40 -!- buntfalke_ is now known as buntfalke
14:44 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Quit: Leaving]
14:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
14:55 < defsdoor> Kendall, ok - I missed that you also want to vpn on as a client
14:56 < Kendall> defsdoor:  Oh, alright.  I don't think I explained it too well that time either
14:56 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
14:56 < defsdoor> form the point of view of server to server connections though 
14:56 < defsdoor> from*
14:57 < defsdoor> you only connect server to server in the manner above
14:59 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
14:59 < Kendall> and that was
14:59 < Kendall> sa <-> cb; sb <-> cc; sc <-> ca
14:59 < Kendall> correct ?
15:03 -!- dazo is now known as dazo_afk
15:05 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 252 seconds]
15:09 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
15:11 -!- p3rror [~mezgani@41.248.106.67] has quit [Ping timeout: 255 seconds]
15:12 < Kendall> let me try to explain how we have it setup thus far, lets call the sites IDC, CDC, and AH.  IDC is running as a server, with CCD files for both AH and CDC.  AH is running as a server with a CCD file for CDC.  CDC is running as a server and has no CCD file(s)
15:14 -!- krzee [nobody@66.11.114.212] has joined #openvpn
15:14 -!- krzee [nobody@66.11.114.212] has quit [Changing host]
15:14 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:24 -!- p3rror [~mezgani@41.140.183.33] has joined #openvpn
15:37 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
15:38 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
15:47 -!- luneff [~yury@84.51.197.177] has joined #openvpn
15:48 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
16:08 < Bushmills> makes 3 servers
16:08 < Bushmills> any clients as well?
16:16 < EugeneKay> ALPHABET SOUP
16:16 < |Mike|> say wot?
16:27 -!- luckman212 [~do-not-re@rrcs-50-74-138-150.nyc.biz.rr.com] has joined #openvpn
16:28 < luckman212> hello guys anyone know why I can't run "build-ca.bat" on Windows w/ openvpn 2.2.0 ?  I get this error:  http://pastebin.com/Sdkvetz8
16:28 < |Mike|> read the freaking error..
16:29 < luckman212> uhm
16:30 < luckman212> it says can't open config file "c:\openssl/ssl/openssl.cnf" which is a nonsensical path on Windows
16:30 < luckman212> but I don't know where it's getting that path from.
16:31 < luckman212> I've got this in vars.bat:  set HOME="C:\Program Files (x86)\OpenVPN\easy-rsa"
16:31 < luckman212> so it should be using that as a base dir
16:32 < luckman212> It seems someone else ran into this and opened a ticket: https://community.openvpn.net/openvpn/ticket/125
16:32 <@vpnHelper> Title: #125 (Build CA is broken in Windows on version 2.2 release) – OpenVPN Community (at community.openvpn.net)
16:32 < luckman212> but afaict there is no solution
16:33 < luckman212> so to make keys do I need to set up Ubuntu in vmware or something?  no way to do it on a windows machine currently?  or maybe I'm just stupid
16:37 < Bushmills> you may want to refer to openssl instructions for creating key, setting up a CA and signing your keys
16:40 -!- luckman212 [~do-not-re@rrcs-50-74-138-150.nyc.biz.rr.com] has quit [Ping timeout: 255 seconds]
16:45 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 260 seconds]
16:55 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:01 < Kendall> Bushmills:  Sorry for the late reply, I just got back to my computer.  How do you mean by "any clients"?  Clients as in, remote users that connect to one of the VPN servers?  In that case, yes, there are a few clients
17:02 < Kendall> But, what I'm really having trouble with, is communications between the 3rd server and the original two
17:04 < Bushmills> server can't talk to server.  client can talk to server
17:06 < Kendall> so then with the setup I described (poorly), it should be possible, then, to reach CDC from AH (and vice versa), because CDC is a client of AH ?
17:07 < Bushmills> " CDC is running as a server" you said.
17:08 < Kendall> it's running as a server, externally, so that I can VPN to it, but it's also running as a client with a connection to AH
17:08 < Bushmills> does it, as client, connect to AH?
17:08 < Kendall> yes
17:08 < Bushmills> (in the sense of "connecting successfully")
17:09 -!- Giggaflop [~Gigga@host81-135-57-115.range81-135.btcentralplus.com] has joined #openvpn
17:09 < Giggaflop> question, can you limit per user traffic as so to cap their bandwidth?
17:10 < Giggaflop> EG; user 1 is only allowed 10GB up+down
17:10 < Giggaflop> but user 2 is unlimited
17:10 < Giggaflop> and user 3 has a 50GB cap
17:10 < Kendall> I believe it's connecting successfully, yes, as I can ping the LAN behind AH, _from_ CDC.  However, from the LAN behind AH, I _cannot_ ping the LAN behind CDC
17:10 < Bushmills> then, principally, AH should be able to reach CDC. unless routing on AH or CDC is messed up, or firewalls interfere. 
17:11 < Bushmills> Giggaflop: yes, but not by means provided by openvpn.  check out tc
17:11 < Giggaflop> ok thanks
17:11 < Giggaflop> does that need each user to have a static ip?
17:11 < Bushmills> not "need" but it helps
17:12 < Giggaflop> i was hoping it'd work on a per account basis
17:12 < Kendall> Bushmills:  ok, so then it sounds like the setup should work, but there is a routing issue.  If I ask suuuppper nicely, would you help me figure out where my routes are broken at?
17:13 < Kendall> because really, I don't know where (.conf file wise), where I need a "route" or  a "push route" or an iroute
17:13 < Bushmills> if you present useful information, i may. or somebody else may.
17:14 < Kendall> absolutely; I'll pastebin the .conf files
17:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:16 < Kendall> !configs
17:16 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:18 < Kendall> http://pastebin.com/gtfm82pE
17:18 < Kendall> that contains AH: server.conf and the CDC ccd file, as well as the CDC server.conf
17:19 -!- Yen [~Yen@unaffiliated/yen] has quit []
17:20 < Bushmills> from AH, can you ping 10.18.1.1?
17:20 -!- p3rror [~mezgani@41.140.183.33] has quit [Ping timeout: 255 seconds]
17:21 < Kendall> no
17:22 < Kendall> I got:  From 68.87.129.169: icmp_seq=34 Packet filtered
17:23 < Bushmills> no route to 10.18.1.0/24, me seems
17:23 < Bushmills> windows?
17:23 < Kendall> Linux hosts
17:23 < Bushmills> 68.87.129.169 is your default gateway?
17:24 < Kendall> the CDC host has a 10.18.1.106 address, which I also cannot ping from AH.  When I ping it from IDC, I get "time to live exceeded"
17:24 < Kendall> mm, no actually, that's just some random comcast host
17:25 < Kendall> I don't have any machines on that IP range
17:25 < Kendall> would you like to see any routing tables?
17:25 < Bushmills> CDC host has a 10.18.1.106  -  no. it is server of 10.18.1.0/24 subnet, therefire CDC should have 10.18.1.1, not 10.18.1.106
17:26 -!- Giggaflop [~Gigga@host81-135-57-115.range81-135.btcentralplus.com] has quit [Ping timeout: 255 seconds]
17:27 < Kendall> CDC host also has 10.18.1.1 on a different interface (tun0) that is a P-t-P to 10.18.1.2
17:27 < Bushmills> where does the 10.18.1.106 address come from?
17:27 < Kendall> my fault, I mis-spoke
17:27 < Kendall> sorry
17:27 < Kendall> it's actually 10.8.1.106; 10.8 is for AH
17:28 < Bushmills> so CDC can ping 10.8.1.1?
17:28 -!- Giggaflop [~Gigga@host81-135-57-115.range81-135.btcentralplus.com] has joined #openvpn
17:28 < Giggaflop> ok
17:28 < Giggaflop> my vpn is working
17:29 < Kendall> "cdc-> ping 10.8.1.1" gives "Destination Host Unreachable"
17:29 < Giggaflop> i'm connecting to it and i stay connected to the irc server hosted there, but i'm not able to access the outside world
17:30 < Bushmills> make sure that cdc has route for 10.8.1.0/24, and ah has route for 10.18.1.0/24. actually both should have routes for both networks
17:30 < Bushmills> Giggaflop:  
17:30 < Bushmills> !route
17:30 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
17:30 < Giggaflop> thanks
17:30 < Bushmills> or, if "outside world" merely means "LAN behind server", then 
17:31 < Bushmills> ehm .. swap those two ...
17:31 < Bushmills> !redirect
17:31 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
17:32 < Kendall> Does not look like CDC has a route for 10.8.1.0/24; the only entry for 10.8.1.x in the routing table is:  Destination:  10.8.1.105, gateway:  *, Genmask:  255.255.255.255, IFace:  tun2
17:32 < Kendall> and AH has no route at all for 10.18
17:33 < Kendall> AH has a route for 10.8.1.0, though:  10.8.1.0, 10.8.1.2, 255.255.255.0, tun0
17:33 < Giggaflop> Bushmills, laptop -> wifi (in vpn tunnel) -> internet (in vpn tunnel) -> openvpn server -> internet
17:33 < Giggaflop> !def1
17:33 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
17:34 < Giggaflop> !man
17:34 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
17:34 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
17:34 < Giggaflop> so i add (push "redirect-gateway def1") to server config?
17:35 < Giggaflop> as i have ipforward
17:35 < Giggaflop> and iptables doing nat
17:35 < Giggaflop> !nat
17:35 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:35 < Giggaflop> !linnat
17:35 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
17:35 < Giggaflop> using this iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
17:36 < Giggaflop> Bushmills, so i add (push "redirect-gateway def1") to server config?
17:37 < Bushmills> looks good
17:37 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
17:37 < Giggaflop> ok
17:38 < Giggaflop> wait
17:38 < Giggaflop> no
17:38 < Giggaflop> dw..
17:38 < Kendall> Bushmills:  I added "route 10.18.1.0 255.255.255.0" to AH: server.conf, and now have a route for 10.18.1.0, using gateway 10.8.1.2, but AH is unable to ping 10.18.1.1
17:38 < Giggaflop> are routes like routes out of the box?
17:42 < Bushmills> those client routes to server are best pushed in server config
17:43 < Bushmills> what version of openvpn is that?
17:43 < krzee> could be route_behind_ovpn, but i havnt been paying attention long enough to know
17:44 < krzee> err !route_outside_ovpn i mean
17:44 < krzee> Kendall, be sure to read this:
17:44 < krzee> !route
17:44 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
17:44 < Bushmills> haven't missed much. still first attempts to diagnose.
17:45 < Kendall> Bushmills:  Now I am able to ping the LAN behind CDC from AH.  However, pinging 10.8.1.1 and 10.18.1.1 does not work
17:45 < Kendall> Openvpn version:  openvpn-2.1.1-4.1.i586
17:45 < krzee> ahh good ol firewall issue =]
17:45 < krzee> bbl =]
17:49 < Kendall> The LAN address  behind CDC is 10.4.0.x, and the LAN behind AH is 192.168.3.x.  From a machine physically connected to 192.168.3.x, I can ping 10.4.0.1, and from the CDC vpn host I can ping 192.168.3.1.  But, from the AH vpn host, I cannot ping 10.4.0.1
17:49 < Kendall> ah, just saw krzee's response
17:49 < Kendall> firewall hmm, lemme take a look...
17:52 < Kendall> CDC host is not running a firewall.  AH host is, output of "iptables -L" is posted to http://pastebin.com/yQCDT0p7
17:54 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:56 < Giggaflop> i feel so retarded ._.
17:56 < Giggaflop> this shouldn't be this hard should it?
17:57 < Kendall> don't feel bad...
17:57  * Kendall is retarded too
17:58 < Giggaflop> 192.168.1.64(client) -> 1.1.0.2(vpn tunnel) -> 1.1.0.1(vpn tunnel) -> 188.165.195.8 (openvpn server) -> internet
17:58 < Giggaflop> i just read that routing page
17:58 < Giggaflop> and its like french :(
17:59 < Giggaflop> i mean
17:59 < Giggaflop> its obviously helpful
17:59 < Giggaflop> but i don't understand it yet
18:01 < Giggaflop> http://pastebin.com/E8gGzAyE < thats my config atm
18:01 < Kendall> giggaflop:  I feel you.  I build and maintain linux servers, not networks
18:01 < Giggaflop> i did iptables
18:01 < Giggaflop> Kendall, same :P
18:08 < Giggaflop> brb vpn test
18:11 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
18:14 -!- grimeton [~stony@2a01:198:6f7::dead:beef] has quit [Ping timeout: 260 seconds]
18:14 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
18:14 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
18:16 < Kendall> I'm obviously missing an iroute entry somewhere, because I have "MULTI:  bad source address from client [AH-vpn-IP], packet dropped
18:16 < Kendall> but I don't know where I am missing it from
18:16 < Kendall> in /var/log/messages on the IDC server
18:19 < EugeneKay> Something I always do when building networks is to draw it out. Visio works great for this
18:21 < Kendall> EugeneKay:  I agree, diagramming it out is the way to go.  I've got it drawn out (pen and paper) but can't seem to figure out where I've gone wrong
18:24 -!- p3rror [~mezgani@41.140.97.37] has joined #openvpn
18:26 < EugeneKay> My method is to look at each intersection and determine what routes it needs to have, and firewalling it needs to allow
18:26 < EugeneKay> There's probably a way to automate this sort of thing(larger networks), but i can't be arsed.
18:30 <@vpnHelper> RSS Update - forum: cant connect to openvpn <http://forums.openvpn.net/topic8295.html>
18:40 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
18:47  * Kendall has had enough work the day
18:47 < Kendall> bye all
18:47 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has left #openvpn []
18:49 -!- grimeton [~stony@2a01:198:6f7::dead:beef] has joined #openvpn
18:49 -!- grimeton is now known as Guest64797
18:53 -!- luckman212 [~irc@2001:470:1f07:1225:25e0:3907:7c8d:f734] has joined #openvpn
19:11  * ecrist spies an HE v6 tunnel
19:13 < luckman212> arg arg arg
19:20 -!- Belial_ [~quassel@216.18.197.178] has quit [Ping timeout: 250 seconds]
19:22 -!- Belial_ [~quassel@173-167-183-93-illinois.hfc.comcastbusiness.net] has joined #openvpn
19:22 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
19:23 < luckman212> WARNING: can't open config file: c:\openssl/ssl/openssl.cnf
19:23 < luckman212> arg
19:24 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:24 -!- Cain` is now known as Cain
19:24 < luckman212> I just reinstalled openvpn to C:\openvpn thinking maybe this was some kind of UAC or issue with the virtualized "Program Files" directory on x64 windows, but still getting the same error when I run build-ca.bat
19:24 < ecrist> luckman212: you need all backslashes
19:24 < luckman212> yeah but, where is the config file for that?
19:25 < ecrist> no clue, I hate easy-rsa
19:25 < luckman212> I don't know where "c:\openssl/ssl/openssl.cnf" is even coming from
19:25 < luckman212> what's the alternative to easy-rsa?
19:25 < ecrist> and I've never tried generating certs on a windows box
19:25 < luckman212> I didn't know there was a way to generate keys "manually"
19:25 < ecrist> I wrote ssl-admin, but it's *nix dependent
19:25 < luckman212> I'm just following the howto on http://openvpn.net/index.php/open-source/documentation/howto.html#pki
19:25 <@vpnHelper> Title: HOWTO (at openvpn.net)
19:25 < ecrist> all easy-rsa is is a shell script
19:26 < luckman212> alright, I just booted up my Ubuntu VM.   installed openvpn
19:27 -!- Belial__ [~quassel@216.18.197.178] has joined #openvpn
19:27 < luckman212> I'm in /usr/share/doc/openvpn/examples/easy-rsa/2.0  now
19:27 < ecrist> sweet
19:27 -!- Belial_ [~quassel@173-167-183-93-illinois.hfc.comcastbusiness.net] has quit [Ping timeout: 255 seconds]
19:34 -!- Belial_ [~quassel@173-167-183-93-illinois.hfc.comcastbusiness.net] has joined #openvpn
19:35 -!- Belial__ [~quassel@216.18.197.178] has quit [Ping timeout: 255 seconds]
20:11 -!- master_of_master [~master_of@p57B559E8.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:14 -!- master_of_master [~master_of@p57B55780.dip.t-dialin.net] has joined #openvpn
20:18 < luckman212> this is awesome
20:22 -!- Belial_ [~quassel@173-167-183-93-illinois.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
20:24 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8296.html>
20:36 -!- sonto_lau [~cooker@182.151.61.115] has joined #openvpn
20:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
20:42 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12898>
20:44 < sonto_lau> hi guys! there is a question I feel very confused about openvpn ,so I need help! I can't connect the others PCs via openvpn client, the information of tun device for server as follows:
20:44 < sonto_lau> tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
20:44 < sonto_lau>           inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
20:44 < sonto_lau>           UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
20:44 < sonto_lau>           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
20:44 < sonto_lau>           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
20:44 < sonto_lau>           collisions:0 txqueuelen:100 
20:44 -!- sonto_lau was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
20:44 -!- hero911x [ad4fbb71@gateway/web/freenode/ip.173.79.187.113] has joined #openvpn
20:46 -!- sonto_lau [~cooker@182.151.61.115] has joined #openvpn
20:47 < sonto_lau> hi guys,who knows more about openvpn?
20:47 < sonto_lau> I can't connect another PC via my openvpn client
20:50 < sonto_lau> the situation is that I can connect openvpn server and get a IP address allocated by server,But I can't ping another PC,could you do me a favor?
20:50 -!- straterra [~straterra@fuhell.com] has left #openvpn []
21:00 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:00 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
21:09 < hero911x> sonto_lau: so your openvpn session is estabilshed?
21:16 < Pr0z0id> hwo can you delete a certificate?
21:16 < Pr0z0id> from the db
21:17 -!- drewr__ [~drewr@oks.bluefinlab.com] has left #openvpn ["Leaving..."]
21:23 < sonto_lau> hero911x: how to check if the session is established? I'm sorry I'm not familiar with openvpn! 
21:24 < hero911x> is your client on windows?
21:24 < sonto_lau> LINUX
21:24 < hero911x> rock on ;)
21:25 < sonto_lau> my server is linux too
21:25 -!- dxtr [jzwn0z@unaffiliated/dxtr] has quit [Ping timeout: 240 seconds]
21:25 < hero911x> so you have a tun interface with an IP assigned to it by the server?
21:25 < sonto_lau> yes! the interface is tun0
21:26 < hero911x> i'm not sure how the machines are subnetted so you'll have to look into that
21:26 < sonto_lau> "inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255"
21:26 < hero911x> run "ip route" on the client
21:26 < sonto_lau> I try,waiting..
21:27 < hero911x> you can also run a traceroute from the client to the other PC and see where the traffic drops (a lot of devices will not respond so this test may or may not help)
21:28 < sonto_lau> 10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6 
21:28 < hero911x> without taking a lot of time, the best way to troubleshoot this is to go from hop to hop and see if the traffic is reaching that hop
21:29 < hero911x> run tcpdump on that hop wit something like: tcpdump -vvv -nnn host <destination_host_ip>
21:29 < sonto_lau> 10.8.0.1 via 10.8.0.5 dev tun0
21:29 < sonto_lau> 10.8.0.0/24 dev eth0  scope link
21:29 < sonto_lau> 192.168.1.0/24 via 10.8.0.5 dev tun0 
21:29 < sonto_lau> Can you see that?
21:29 < hero911x> yes
21:29 < hero911x> what IP (subnet is enough) is the destination machine?
21:35 < hero911x> try adding this to teh server config: push "redirect-gateway def1 bypass-dhcp"
21:35 < hero911x> this will make all traffic from the client go into the OpenVPN tunnel
21:36 < sonto_lau> thanks, i try
21:36 < Pr0z0id> !certs
21:36 <@vpnHelper> "certs" is (#1) use !easy-rsa-unix for easy-rsa, or (#2) use !ssl-admin for ecrists copy of ssl-admin to make and manage your certs
21:37 < Pr0z0id> !easy-rsa-unix
21:37 <@vpnHelper> "easy-rsa-unix" is http://www.freebsddiary.org/openvpn-easy-rsa.php for a writeup of making certs with easy-rsa in fbsd, only the dir changes for linux
21:39 < hero911x> gotta run...
21:39 -!- hero911x [ad4fbb71@gateway/web/freenode/ip.173.79.187.113] has left #openvpn []
21:41 < pwrcycle> via conf file, is there a way to not route back to normal if the vpn drops?
21:43 -!- sonto_lau [~cooker@182.151.61.115] has quit [Ping timeout: 252 seconds]
21:45 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:46 -!- sonto_lau [~cooker@125.70.92.58] has joined #openvpn
21:49 < bystander> good day. krzee previously told me that beyond 200 users, the openvpn service will die. others told that it depends on the capacity / specs of the server. what if the openvpn is on dedicated server?
21:51 < jpalmer> it doesn't die because of the server specs.  it dies because of openvpn
21:52 -!- sonto_lau [~cooker@125.70.92.58] has quit [Ping timeout: 250 seconds]
21:53 < bystander> jpalmer, so it means that even I have the openvpn on higher specs like dedicated server, it will still die
21:54 < jpalmer> that's correct
21:55 < jpalmer> openvpn is single threaded.  once you start passing a decent amount of traffic through the vpn server,  it can't scale beyond that.   I understand openvpn 3.x will be multithreaded though allowing it to scale better.
21:57 <@vpnHelper> RSS Update - forum: Leaving for China.. want to set up VPN at home first! <http://forums.openvpn.net/topic8283.html#p12899>
21:58 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
22:05 -!- sonto_lau [~cooker@125.70.92.58] has joined #openvpn
22:11 -!- sonto_lau [~cooker@125.70.92.58] has quit [Ping timeout: 240 seconds]
22:19 -!- sonto_lau [~cooker@125.70.92.58] has joined #openvpn
22:20 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:21 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:26 -!- bauruine [~stefan@217.150.230.222] has quit [Ping timeout: 268 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:49 < luckman212> hmm strange, when I connect to the ovpn (tun) I can browse, access LAN resources etc.  but I cannot access Google Maps or YouTube, the pages time out.  any ideas why? (no, these sites are not being blocked by the firewall--- I am the admin of the firewall :)
23:02 -!- sangi [~sangi@218.248.24.19] has joined #openvpn
23:24 -!- sonto_lau [~cooker@125.70.92.58] has left #openvpn []
23:52 -!- luckman212 [~irc@2001:470:1f07:1225:25e0:3907:7c8d:f734] has quit [Remote host closed the connection]
23:58 < Bushmills> !redirect
23:58 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
23:58 < Bushmills> or name server setup
23:59 < Bushmills> try reaching internet sites by ip address, rather than by hostname
--- Day changed Fri Jun 10 2011
00:13 -!- Ragnar_ [heimdall@darkstar.acool.net] has left #openvpn []
00:32 -!- EugeneKay is now known as EugeneKaway
00:32 -!- EugeneKaway is now known as EugeneKay
00:33 -!- EugeneKay is now known as EugeneKaway
00:33 -!- EugeneKaway is now known as EugeneKay
00:40 -!- EugeneKay is now known as EugeneKaway
01:02 <@vpnHelper> RSS Update - forum: problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p12900>
01:42 -!- dazo_afk is now known as dazo
01:44 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Remote host closed the connection]
01:47 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:59 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
02:00 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:01 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 244 seconds]
02:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:10 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has joined #openvpn
02:14 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:26 -!- EugeneKaway is now known as EugeneKay
02:29 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
02:30 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
02:30 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:31 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
02:35 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
02:39 -!- EugeneKay is now known as EugeneKaway
02:39 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:00 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:18 <@vpnHelper> RSS Update - forum: cant connect to openvpn <http://forums.openvpn.net/topic8295.html#p12901>
03:24 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12903> || Error: private key password verification failed <http://forums.openvpn.net/topic8296.html#p12902>
03:36 <@vpnHelper> RSS Update - forum: problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p12904>
03:48 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12905>
03:50 -!- dazo is now known as dazo_afk
04:00 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12906>
04:10 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has quit [Quit: Ex-Chat]
04:12 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12908>
04:18 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269.html#p12909>
04:24 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12910>
04:30 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:36 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8296.html#p12912> || Network scope <http://forums.openvpn.net/topic8282.html#p12911>
04:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
04:48 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p12913>
04:57 -!- larie [~fling@83.246.243.61] has joined #openvpn
04:57 < larie> hello
04:57 < larie> http://dpaste.com/552669/plain/
04:57 < larie> something is wrong and i can't build a client key
04:57 < larie> i already have some keys
04:59 -!- p3rror [~mezgani@41.140.97.37] has quit [Read error: Connection reset by peer]
04:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:03 -!- dazo_afk is now known as dazo
05:05 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
05:07 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:15 -!- p3rror [~mezgani@41.140.25.20] has joined #openvpn
05:20 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
05:44 -!- steve [steve@bouncer.stephen.marsh.name] has quit [Quit: disconnecting from stoned server.]
05:44 -!- steve [~muh@bouncer.stephen.marsh.name] has joined #openvpn
05:47 -!- steve [~muh@bouncer.stephen.marsh.name] has quit [Client Quit]
05:52 < Bushmills> larie: variables in vars are getting exported?
05:54 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8296.html#p12914>
06:01 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Read error: Operation timed out]
06:08 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 255 seconds]
06:11 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
06:12 -!- fips4d [~fips4d@212.98.33.250] has quit [Ping timeout: 260 seconds]
06:18 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
06:21 -!- kyrix [~ashley@ks357561.kimsufi.com] has joined #openvpn
06:23 -!- fips4d [~fips4d@212.98.33.250] has joined #openvpn
06:23 -!- Giggaflop [~Gigga@host81-135-57-115.range81-135.btcentralplus.com] has quit [Read error: Connection reset by peer]
06:28 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 244 seconds]
06:34 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
06:41 -!- kyrix [~ashley@ks357561.kimsufi.com] has quit [Quit: Ex-Chat]
06:44 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:00 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
07:00 -!- takamichi [~pri@c123-71.i07-31.onvol.net] has joined #openvpn
07:12 <@vpnHelper> RSS Update - forum: Message too long <http://forums.openvpn.net/topic8279.html#p12916>
07:23 -!- sangi [~sangi@218.248.24.19] has quit [Read error: Connection reset by peer]
07:51 -!- palotard [84e3510a@gateway/web/freenode/ip.132.227.81.10] has joined #openvpn
07:52 < palotard> hello, i'm having an error: Cannot load certificate file username.crt ; when trying to connect with openvpn to cyberghostvpn ; what is this file username.crt?
07:53 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
07:55 <@vpnHelper> RSS Update - forum: OpenVPN ROUTE: omitted no-op route: 12.5.0.1/255.255.255.255 <http://forums.openvpn.net/topic8297.html>
07:56 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Quit: leaving]
07:56 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
08:00 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
08:01 -!- Guest64797 [~stony@2a01:198:6f7::dead:beef] has quit [Ping timeout: 260 seconds]
08:04 -!- STF [~chatzilla@dslb-178-009-005-101.pools.arcor-ip.net] has joined #openvpn
08:05 < fips4d> palotard: it's your user certificate
08:06 < palotard> fips4d: yes thanks found it :)
08:11 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:12 -!- palotard [84e3510a@gateway/web/freenode/ip.132.227.81.10] has quit [Ping timeout: 252 seconds]
08:13 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
08:13 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:14 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
08:14 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
08:14 -!- maxJadi [~maxJadi@81-232-115-137-no17.business.telia.com] has joined #openvpn
08:14 -!- maxJadi [~maxJadi@81-232-115-137-no17.business.telia.com] has quit [Changing host]
08:14 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:15 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
08:15 -!- maxJadi [~maxJadi@81-232-115-137-no17.business.telia.com] has joined #openvpn
08:15 -!- maxJadi [~maxJadi@81-232-115-137-no17.business.telia.com] has quit [Changing host]
08:15 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:17 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
08:24 -!- grimeton [~stony@2a01:198:6f7::dead:beef] has joined #openvpn
08:24 -!- grimeton is now known as Guest96975
08:25 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:26 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
08:42 -!- oskie_ is now known as oskie
08:42 -!- oskie [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has left #openvpn []
08:53 <@vpnHelper> RSS Update - forum: OpenVPN ROUTE: omitted no-op route: 12.5.0.1/255.255.255.255 <http://forums.openvpn.net/topic8297.html#p12920> || Network scope <http://forums.openvpn.net/topic8282.html#p12918>
09:05 -!- Guest96975 is now known as stony
09:06 -!- stony is now known as grimeton
09:06 -!- grimeton [~stony@2a01:198:6f7::dead:beef] has left #openvpn []
09:10 -!- luckman212 [~irc@2001:470:1f07:1225:25e0:3907:7c8d:f734] has joined #openvpn
09:17 < larie> Bushmills: idk
09:17 < larie> Bushmills: how to check?
09:18 < larie> haha
09:18 < larie> kes -> /etc/openvpn/privnet
09:18 < larie> kes instead of keys lol
09:18 < larie> how can that be :))
09:20 -!- STF [~chatzilla@dslb-178-009-005-101.pools.arcor-ip.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
09:23 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has joined #openvpn
09:29 <@vpnHelper> RSS Update - forum: OpenVPN ROUTE: omitted no-op route: 12.5.0.1/255.255.255.255 <http://forums.openvpn.net/topic8297.html#p12921>
09:32 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
09:43 -!- langerhans [~langerhan@ip-95-222-202-11.unitymediagroup.de] has joined #openvpn
09:44 < langerhans> !welcome
09:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:45 < langerhans> !redirect
09:45 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
09:45 < langerhans> !def1
09:45 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
09:46 < langerhans> !ipforward
09:46 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
09:46 < langerhans> !linipforward
09:46 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
09:47 < langerhans> !nat
09:47 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
09:47 < langerhans> !linnat
09:47 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
09:48 < langerhans> !openvzlinnat
09:48 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
09:50 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
09:51 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p12922>
09:53 < langerhans> Well, I installed openVPN on my virtual server. I can connect to it and I dont see any errors in the log. I see Packages going into the tunnel with wireshark, but I never get a reply. I see the issue is with the firewall, but the problem is, I cant use iptables on my server... I can configure firewall rules via the hosters interface, but everything i try, it doesnt work... My goal is to run open VPN as a gateway for secure webbro
09:53 < langerhans> wifis...
09:54 -!- jmdill [~jmdill@64.184.3.146] has joined #openvpn
09:55 < jmdill> hey guys, quick question...  I've got a user that while trying to connect to our openvpn server just sits at 'connecting...' message. 
09:55 < langerhans> the tun interface on my server has the IPs: 10.0.0.205 and 10.0.0.206
09:56 < jmdill> we've tried his credentials from another machine and it works ok so it pretty well looks like it's restricted to his machine 
09:56 < jmdill> logs show him connecting to WEB_CLIENT but never reaches VPN service
09:59 < ecrist> no idea what WEB_CLIENT is
09:59 < ecrist> sounds like a connectivity issue
10:13 < gladiatr> !tell my office mate his chewing sounds like a cow chewing its cud and that is causing me to fantasize about wiring his jaw shut
10:15 -!- corretico [~luis@201.201.44.82] has joined #openvpn
10:15 < gladiatr> vpnHelper: 98% IRC bot, 2% Jesus
10:15 < ecrist> lol
10:16 < langerhans> So, I cant use ifconfig on my server, is that a problem for openvpn? tun IPs are set by my hoster
10:19 < larie> hello
10:19 < ecrist> shouldn't be, but I don't think you can use routed mode, langerhans 
10:19 < larie> one of windows clients can't connect
10:19 < larie> http://dpaste.com/552751/plain/
10:20 < ecrist> looks like you're not running as an admin
10:20 < ecrist> also, it says the initialization completed, so you're connected, you just have no routes
10:20 < langerhans> i think port 1194 is still cloesd on the server, but i dont see why... ill try another port...
10:21 < larie> yes
10:21 < larie> i see client connected on the server
10:21 < larie> in ipp.txt
10:21 < ecrist> well, run openvpn as an administrator...
10:21 < jmdill> ecrist: it shows up under 'service' column in web admin logs
10:22 < larie> maybe it is microsoft antivirus fail :)
10:22 < jmdill> a uninstall / reinstall fixed it
10:22 < ecrist> no idea what 'web admin logs' are
10:22 < ecrist> if you're talking about access server, we don't support that here
10:22 < jmdill> if you log into the openvpn server web interface
10:22 < ecrist> that's access server, not openvpn
10:22 < jmdill> it's an openvpn server we've installed on a linux box
10:22 < ecrist> access server is a commercial product
10:22 < ecrist> !as
10:22 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
10:22 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
10:23 < ecrist> jmdill: it's not regular openvpn
10:23 < jmdill> ah
10:23 < jmdill> ok sorry, just blindly typed /join #openvpn and assumed it would be same product 
10:23 < jmdill> thanks anyway guys got it figured out =]
10:23 < ecrist> np
10:33 <@vpnHelper> RSS Update - forum: openvpn gui <http://forums.openvpn.net/topic8298.html>
10:41 < langerhans> Okay, for bridging, I would need a tap device, but I just have a tun device... This server is driving me crazy :D
10:42 -!- Blues-Man [~bluesman@188.11.36.193] has joined #openvpn
10:45 -!- Blues-Man is now known as lethalman
10:45 -!- lethalman is now known as Blues-Man
10:46 -!- jmdill [~jmdill@64.184.3.146] has left #openvpn ["Leaving"]
10:50 -!- luckman212_ [luckman212@pool-74-108-1-53.nycmny.fios.verizon.net] has joined #openvpn
10:58 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
11:04 < langerhans> I compiled all my info here: http://pastebin.com/8Uhs3tkY I would really appreciate it, if someone would look at it and tell me whats wrong...
11:06 < Bushmills> dev tun1071-54  is wrong
11:07 < langerhans> why? the interface is called that way, see the ifconfig
11:07 < Bushmills> and why persist-tun if you want tap anyway?
11:08 < Bushmills> ".. I would need a tap device"
11:08 < langerhans> Cause I read everywhere "use tun, its better"
11:08 < Bushmills> well, if the interface is called that way "anyway", then don't bother about it not being a tap device
11:09 -!- luckman212_ [luckman212@pool-74-108-1-53.nycmny.fios.verizon.net] has quit [Ping timeout: 246 seconds]
11:09 < Bushmills> when using tun device, don't bridge
11:09 < langerhans> i have /dev/net/tun, wouldnt i need something like /dev/net/tap :D I cant find that info
11:10 < Bushmills> make up your mind
11:10 < Bushmills> !tunortap
11:10 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:10 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
11:11 < langerhans> okay, I want to use TUN, the whole TAP thing was just a fallback if i cant get TUN to work
11:12 < Bushmills> ok. you got a tun device, problem solved.
11:12 < langerhans> the problem is, I cant ping anything, not the vpn, nor the internet
11:12 -!- Blues-Man [~bluesman@188.11.36.193] has left #openvpn ["Sto andando via"]
11:12 < langerhans> nmap tells me: 1194/udp open|filtered openvpn
11:13 < langerhans> so i guess the firewall is configured to let through the port
11:13 < Bushmills> does client connect?
11:13 < langerhans> yes
11:13 < langerhans> connection is successful
11:13 < Bushmills> its tun interface comes up, giving it an ip address?
11:13 < langerhans> the client gets 10.0.0.2 assigned
11:14 < Bushmills> topology subnet?
11:14 -!- dazo is now known as dazo_afk
11:14 < langerhans> 255.255.255.252
11:15 < langerhans> with wireshark I see traffic going to the servers internet IP on 1194 UDP
11:15 < Bushmills> sounds wrong. seems to be a /30 subnet assigned to client, with that, client shouldn't receive 10.0.0.2 as ip address
11:16 < langerhans> client is Windows, so that /30 should be correct as I read on the FAQ
11:16 < Bushmills> then 10.0.0.2 as client ip address is wrong
11:17 < langerhans> what should it be instead?
11:17 < langerhans> ipp.txt says: client01,10.0.0.0
11:17 < Bushmills> 10.0.0.5 or 6, most likely
11:19 < langerhans> could this be the problem with the tun interface: inet Adresse:10.0.0.205  P-z-P:10.0.0.206 ?
11:19 < langerhans> ist has 205/206 as adresse
11:19 < Bushmills> that looks less a problem than 10.0.0.2 does
11:20 < langerhans> okay, I'll try something
11:21 < langerhans> hm, still getiing 10.0.0.2 as adress...
11:21 < langerhans> SENT CONTROL [client01]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 193.25.114.2,ping 10,ping-restart 120,ifconfig 10.0.0.2 10.0.0.1' (status=1)
11:21 < Bushmills> remove ifconfig 10.0.0.2 10.0.0.1 from client config
11:21 < langerhans> I did that
11:21 < langerhans> still getting this adress
11:21 < Bushmills> allow server to assign address to client
11:22 -!- fips4d [~fips4d@212.98.33.250] has quit [Quit: leaving]
11:22 < langerhans> should I change this? ifconfig-pool 10.0.0.2 10.0.0.50
11:22 < Bushmills> change server config ifconfig-pool 10.0.0.2 10.0.0.50  to something higher than 10.0.0.2
11:23 < langerhans> what would you suggest?
11:23 < Bushmills> in case you want to assign static addresses too, leave some slack.  maybe 10.0.0.128 10.0.0.191
11:24 < langerhans> okay, lets try again
11:24 < Bushmills> effectively divides the /24 into two /25
11:25 < Bushmills> ifconfig-pool-persist /etc/openvpn/ipp.txt  i'd remove from server config
11:26 < Bushmills> if you want persistent addresses, use ccd
11:26 < langerhans> okay
11:28 -!- luckman212_ [~do-not-re@pool-74-108-1-53.nycmny.fios.verizon.net] has joined #openvpn
11:29 < Bushmills> seems you forgot to tell server what subnet to use for vpn
11:29 < Bushmills> check out --server directive
11:29 < langerhans> i get 10.0.0.130 now
11:29 < Bushmills> and consider to start with example configs
11:30 < langerhans> when i use --server directive, openvpn tries ifconfig in the tun device which fails
11:30 < langerhans> i dont have the permission to ifconfig on the device
11:31 < Bushmills> root surely has permissions - or do you try to start server as non-root?
11:31 < langerhans> no, I#m logged in as root
11:31 < langerhans> but this is still a virtual Server
11:31  * Bushmills smells troubles
11:32 < langerhans> haha
11:32 < Bushmills> your server doesn't know that it's a server
11:32 < langerhans> but it accepts client connections?
11:36 < Bushmills> read in man page what --server, which is a macro, does, in addition to setting ip address of server tun device. like, pushing routes to client, telling client what topology is used on the vpn net, etc
11:36 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
11:36 < langerhans> okay, ill read
11:37 < Bushmills> by not using --server, those mostly necessary actions won't be done unless configured manually
11:37 -!- luckman212_ [~do-not-re@pool-74-108-1-53.nycmny.fios.verizon.net] has quit [Quit: luckman212_]
11:38 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
11:41 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269-15.html#p12924>
11:51 -!- jeev [~jeev@unaffiliated/jeev] has quit [Quit: ZNC - http://znc.sourceforge.net]
11:57 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
11:58 < Bushmills> if dev tap OR (dev tun AND topology == subnet)     is equivalent to       if dev tap OR topology == subnet     ( --server )
11:58 -!- EugeneKaway is now known as EugeneKay
11:58 < langerhans> i have that topology now set
11:59 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Quit: Going offline, see ya! (www.adiirc.com)]
12:03 -!- mikeones [~mikeones@pool-72-64-111-102.dllstx.fios.verizon.net] has joined #openvpn
12:07 < mikeones> hello, does any know the syntax to add a local network to the client config file?  I am on a class C network but I don't want to router any of the larger class B network accoss the ovpn tunnel. I though it was somthing like network $net $mask $gw in the client config file.
12:11 < Bushmills> there's --route, and its arguments are described in the man page
12:12 < Bushmills> note that networks are now described by CIDR notation, which is classless 
12:15 < mikeones> thanks
12:34 <@vpnHelper> RSS Update - forum: Yet another Ping ok, but no internet access. <http://forums.openvpn.net/topic8257.html#p12925>
12:35 -!- gabrielcz [~gabrielcz@190.190.39.40] has joined #openvpn
12:35 -!- gabrielcz [~gabrielcz@190.190.39.40] has quit [Remote host closed the connection]
12:35 < langerhans> I'm getting sick with that... how do they suppose me to use openvpn without using route add, ifconfig and iptables???
12:35 -!- gabrielcz [~gabrielcz@190.190.39.40] has joined #openvpn
12:37 < langerhans> I'm really not a noob with linux and networking, but that is just...
12:39 -!- gabrielcz [~gabrielcz@190.190.39.40] has left #openvpn []
12:44 < Kendall> wow awesome, I spent an hour writing a forum post on forums.openvpn.net, and the awesome timeout logged me out and sent my work into the abyss
12:50 < langerhans> At least I can say its not the firewall, so it has to be a routing problem... So now I'll try a linux client...
12:58 < Kendall> ok so I have a VPN setup between two sites, call them AH and CDC.  Both sites accept VPN connections from the outside world.  CDC connects as a client to AH.  There is a 10.4.0.0/24 network behind CDC.  The VPN host @AH cannot access 10.4.0.0/24.  However, machines on the LAN (192.168.3.0/24) _behind_ the AH vpn host can.  This is odd because 192.168.3.1, which belongs to the AH vpn host, is the default gateway for 192.168.
13:04 < ecrist> Kendall: we currently allow 2 hours to submit forms...
13:04 < ecrist> perhaps you should type faster?
13:04 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
13:05 < Kendall> yea, I'll try that next time.  
13:05 < Kendall> I'll blow off the rest of my work responsibilities to submit a web form in time, too :)
13:06 < ecrist> heh, it's what I do. ;)
13:06 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
13:07 < ecrist> I looked, though, and we were expiring sessions after only 1 hour.  I just increased that to 24 hours
13:07 < ecrist> sometime, when it's not perfectly beautiful outside, I'll finish our migration to vbulletin
13:08 < ecrist> a bit more development to do on that, though.
13:08 < Kendall> ecrist:  Got any idea what would cause the connection issue described above?  I've been at it for two days or so, and am rather at the ends of my networking ability
13:09 < Kendall> bah, it was really just mis-directed anger I guess...I wrote 95% of the post, when to the data center to verify some things before I posted, got roped into trying to determine what is wrong with a SAN, and was there longer than I wanted.  Then I broke my phone, came back and my post was gone.
13:10 < Kendall> so, mis-directed anger
13:10 < Kendall> lo siento :(
13:10 < ecrist> gimme a sec, trying to make sense of your example
13:11 < ecrist> I need more information.
13:11 < ecrist> !logs
13:11 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
13:11 < ecrist> !routes
13:12 < ecrist> !netstat
13:12 < ecrist> raar
13:12 < ecrist> !configs
13:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
13:12 < EugeneKay> !vend
13:12 < Kendall> configs: http://pastebin.com/gtfm82pE
13:12 < Kendall> !routes
13:12 < Kendall> whoops
13:13 < ecrist> is 192.168.3.1 the VPN server for AH?
13:16 < Kendall> yes
13:16 < Kendall> ok, routing tables for CDC and AH are at:  http://pastebin.com/VwLUZqyf
13:16 < ecrist> well, that explains why the 192.168 subnet has access to the 10.4/24
13:17 < Kendall> what I don't understand though, is why the VPN server (192.168.3.1) cannnot access 10.4.0.0/24, but my other local machines on 192.168.3.x, can access 10.4.0.x
13:18 < ecrist> traceroute 10.4.0.1
13:18 < Kendall> For netstat, do you want just "netstat" output, or are there certain flags you would like?
13:19 < Kendall> When I "traceroute 10.4.0.1" from the AH-vpn server, I get 30 hops of "  * * * "
13:19 < ecrist> netstat -rn
13:20 < Kendall> from my laptop, the traceroute goes:  1 AH-vpn (192.168.3.112), 2 10.8.1.106, 3 10.4.0.1
13:21 < Kendall> ok, one second
13:21 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
13:21 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
13:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:22 < langerhans> OMG, I can ping my vpn gateway! now just the routing of internet traffic is left
13:22 < langerhans> that config is really strange though
13:23 < Kendall> netstat output is at:  http://pastebin.com/VGNneP2w
13:24 < ecrist> the route is there...
13:24 < ecrist> on all sides
13:24 < ecrist> now it falls down to firewall
13:26 < Kendall> hmmmm, alright.  Well I'm not iptables expert, so I guess I'll need to take that over to #netfilter
13:27 < Kendall> thank you, I appreciate this
13:27 < ecrist> np
13:28 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has quit [Quit: Leaving]
13:29 < langerhans> this is my servers routing table: http://pastebin.com/QeRarekd  is this correct to route vpn traffic to the internet?
13:42 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
13:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:02 < langerhans> the packets reach my server, but i never get an answer when accessing internet IPs... pinging the server is okay
14:06 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
14:08 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Client Quit]
14:09 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
14:12 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
14:19 -!- Kendall is now known as Kendall|AFK
14:19 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
14:20 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
14:21 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Remote host closed the connection]
14:21 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Remote host closed the connection]
14:21 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
14:31 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Remote host closed the connection]
14:35 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
14:36 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
14:37 -!- ecrist changed the topic of #openvpn to: OpenVPN 2.2.0 most current, released 26-Apr-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: https://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly. || Host Cloaks available, just ask for one.
14:42 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
14:44 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
14:45 < krzee> oh cool i didnt know that
14:48 -!- luckman212 [~irc@2001:470:1f07:1225:25e0:3907:7c8d:f734] has quit [Remote host closed the connection]
14:49 < langerhans> Is it normal, that the windows client doesnt show a default gateway in ipconfig?
14:51 < krzee> yes
14:51 < krzee> !redirect
14:51 <@vpnHelper> "redirect" is to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
14:53 < langerhans> Problem is, i dont have iptables
14:53 < langerhans> i have redirect-gateway enabled and ipforward, but NAT seems to be the problem...
14:54 < langerhans> As I can ping server/client but not internet...
15:00 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 255 seconds]
15:00 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
15:04 < ecrist> krzee: what didn't you know?
15:05 < krzee> user cloaks
15:05 < ecrist> um, you have one...
15:06 < ecrist> they've been available all along
15:06 < ecrist> I'm trying to pump the brand
15:06 < krzee> mine is support, i didnt know there were also user ones
15:06 < hyper_ch> ecrist: krzee: lol http://hassonybeenhackedthisweek.com/
15:06 < krzee> LOL
15:07 < ecrist> LOL
15:07 < ecrist> <?php print "YES!" ?>
15:07 < ecrist> I just wrote my own copy of that site.
15:07 < hyper_ch> :)
15:09 < hyper_ch> ecrist: his/her/its site is a bit prettier
15:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
15:16 < ecrist> mine is just as effective.
15:16 < hyper_ch> why do you use print and not echo?
15:17 < ecrist> why do you use echo and not print?
15:18 < ecrist> echo is a PHP function, which requires parsing and processing.  if all you're doing is printing, print() uses fewer resources
15:18 < hyper_ch> because echo rocks
15:19 < ecrist> echo("Yes!"); is more involved than print "Yes!";
15:22 < langerhans> I asked my hoster now about my issue, I hope they can fix it for me. thanks for your help anyway guys. Have a nice day :)
15:23 -!- langerhans [~langerhan@ip-95-222-202-11.unitymediagroup.de] has quit [Quit: langerhans]
15:41 < krzee> !learn redirect as you may need to use a different dns server when redirecting gateway, see !dns
15:41 <@vpnHelper> Joo got it.
15:42 < krzee> !forget redirect 2
15:42 <@vpnHelper> Joo got it.
15:42 < krzee> !learn redirect as you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
15:42 <@vpnHelper> Joo got it.
15:50 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
15:55 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has quit [Quit: Ik ga weg]
16:02 <@vpnHelper> RSS Update - forum: OpenVPN expertise required <http://forums.openvpn.net/topic8299.html>
16:08 -!- MarKsaitis is now known as GREEK
16:09 -!- GREEK is now known as marksaitis
16:26 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
16:26 <@vpnHelper> RSS Update - forum: OpenVPN expertise required <http://forums.openvpn.net/topic8299.html#p12927>
16:30 -!- guifort [~guifort@ALille-255-1-52-26.w86-208.abo.wanadoo.fr] has joined #openvpn
16:39 -!- guifort [~guifort@ALille-255-1-52-26.w86-208.abo.wanadoo.fr] has quit [Quit: Quitte]
16:47 -!- Kendall|AFK is now known as Kendall
16:48 -!- Guifort [~Administr@175.201.113.78.rev.sfr.net] has joined #openvpn
17:02 -!- FP|Maverick-werk [~commo@h64-141-120-20.pcccinc.net] has joined #openvpn
17:03 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has left #openvpn []
17:08 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:10 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:39 -!- Pr0z0id [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit []
17:39 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:14 -!- marksaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
18:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:21 <@vpnHelper> RSS Update - forum: certificate to be certified until !? <http://forums.openvpn.net/topic8300.html>
18:34 -!- p3rror [~mezgani@41.140.25.20] has quit [Ping timeout: 255 seconds]
18:48 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 260 seconds]
18:49 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
19:00 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
19:09 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has joined #openvpn
19:25 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:38 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:59 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
20:12 -!- master_of_master [~master_of@p57B55780.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
20:14 -!- master_of_master [~master_of@p57B53D1A.dip.t-dialin.net] has joined #openvpn
20:33 <@vpnHelper> RSS Update - forum: cant connect to openvpn <http://forums.openvpn.net/topic8295.html#p12930>
21:01 < Pr0zoid> !route
21:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:02 < Pr0zoid> !tun
21:02 < Pr0zoid> !tcpip
21:02 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
21:02 < Pr0zoid> !welcome
21:02 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:02 < Pr0zoid> !route
21:02 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:02 < Pr0zoid> !redirect
21:02 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
21:03 < Pr0zoid> !def1
21:03 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
21:04 < Pr0zoid> i need a little help..  when i connect to my vpn... everything is fine for a few minutes then all of a sudden it can't get access to external sites.. (tun)
21:04 < Pr0zoid> then a few minutes later 
21:04 < Pr0zoid> it starts working again
21:04 < Pr0zoid> !ipforward
21:04 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
21:04 < Pr0zoid> !linipforward
21:04 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
21:07 < Pr0zoid> anyone help?
21:07 -!- Pr0z0id [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
21:07 -!- Pr0z0id [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Client Quit]
21:19 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
21:22 < Pr0zoid> i'm also seeing "Need IPv6 code in mroute_extract_addr_from_packet"
21:22 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has quit [Read error: Operation timed out]
21:40 -!- K1ng [~KING@180.211.188.161] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
21:53 -!- K1ng [~KING@180.211.188.161] has joined #openvpn
22:11 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
22:37 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:37 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:38 -!- oc80z [oc80z@blea.ch] has joined #openvpn
--- Day changed Sat Jun 11 2011
00:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
00:29 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has quit [Quit: Leaving]
00:37 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
01:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:25 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
01:51 -!- Guifort [~Administr@175.201.113.78.rev.sfr.net] has quit [Quit: Quitte]
01:52 <@vpnHelper> RSS Update - forum: IPTABLES Error when attempting to add a forward <http://forums.openvpn.net/topic8301.html>
01:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
02:33 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:57 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
02:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:07 -!- karl__ [~sara@208.46.239.70] has joined #openvpn
03:08 < karl__> hello, I am having a problem with openvpn access server (version 1.8.0). whenever I try to start it, I get this error: ERROR: iptables service not started because of error (SVC_RUN_EXCEPT)
03:19 -!- rajkosto [~rajkosto@cable-94-189-150-102.dynamic.sbb.rs] has quit [Ping timeout: 260 seconds]
03:19 -!- karl__ [~sara@208.46.239.70] has quit [Quit: karl__]
03:32 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
03:49 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
04:06 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
04:11 <@vpnHelper> RSS Update - forum: IPTABLES Error when attempting to add a forward <http://forums.openvpn.net/topic8301.html#p12932>
04:13 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has joined #openvpn
04:14 -!- larie [~fling@83.246.243.61] has quit [Ping timeout: 246 seconds]
04:21 -!- larie [~fling@83.246.243.61] has joined #openvpn
04:28 -!- EugeneKay is now known as EugeneKaway
04:31 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:35 <@vpnHelper> RSS Update - forum: Yet another Ping ok, but no internet access. <http://forums.openvpn.net/topic8257.html#p12933>
04:46 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
04:46 -!- takamichi [~pri@c123-71.i07-31.onvol.net] has quit [Ping timeout: 268 seconds]
04:47 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
04:50 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 268 seconds]
05:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:21 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 255 seconds]
05:22 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
05:30 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 255 seconds]
05:36 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has quit [Ping timeout: 258 seconds]
05:39 -!- larie [~fling@83.246.243.61] has left #openvpn []
06:08 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
06:09 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
06:39 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
06:42 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
07:08 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
07:09 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
07:26 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
07:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
07:47 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
07:52 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Ping timeout: 255 seconds]
08:22 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
08:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:35 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
08:41 -!- L33 [~lee@li140-167.members.linode.com] has left #openvpn []
08:43 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
08:47 -!- gebruikert_ [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
08:50 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has quit [Ping timeout: 276 seconds]
08:55 -!- MarKsaitis_ [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
09:03 -!- luneff [~yury@84.51.197.177] has joined #openvpn
09:15 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
09:33 < Pr0zoid> anyone alive?
10:11 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
10:14 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:28 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
10:28 -!- me345 [~me345@adsl-75-15-226-62.dsl.bkfd14.sbcglobal.net] has joined #openvpn
10:29 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has joined #openvpn
10:30 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:34 -!- me345 [~me345@adsl-75-15-226-62.dsl.bkfd14.sbcglobal.net] has quit [Remote host closed the connection]
10:38 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
10:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
11:04 -!- K1ng` [~KING@180.211.188.116] has joined #openvpn
11:05 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has quit [Ping timeout: 252 seconds]
11:07 -!- K1ng [~KING@180.211.188.161] has quit [Ping timeout: 240 seconds]
11:09 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has joined #openvpn
11:10 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has quit [Read error: Operation timed out]
11:10 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has joined #openvpn
11:18 < dvl> Yet again, because of OpenVPN, I can use Bacula to backup my laptop, when I'm not at home.  :)  Wonderfully nice.
11:19 < dvl> I really should put a passphrase on my certificate though....
11:37 < Pr0zoid> anyone experienced random drops on openvpn.... i'm tunneling and for some reason the user seems to remain connected but cannot ping anything 
11:41 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
11:47 -!- Carbon_Monoxide [~cmonxide@124244205027.ctinets.com] has quit [Quit: Leaving]
11:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
11:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
12:00 < dvl> Pr0zoid:  does the route stay up?
12:06 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:06 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:06 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:10 <@vpnHelper> RSS Update - forum: [SOLVED] TTL expired using bridging <http://forums.openvpn.net/topic8271.html#p12934>
12:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
12:38 < Pr0zoid> dvl: yes it does
12:39 < Pr0zoid> running another test
12:40 -!- gebruikert_ is now known as affix0
12:48 < Pr0zoid> the client is seeing this :Sat Jun 11 13:44:22 2011 [server] Inactivity timeout (--ping-restart), restarting
12:48 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:53 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
12:55 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
12:56 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
13:04 <@vpnHelper> RSS Update - forum: Periodic timeouts <http://forums.openvpn.net/topic8270.html#p12935>
13:10 < Pr0zoid> there's definetly a repeating pattern clients get the inactivity timeout between 4-5 minutes http://pastebin.com/EXFuUC7Z
13:12 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
13:12 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Client Quit]
13:16 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:17 -!- p3rror [~mezgani@41.140.96.120] has joined #openvpn
13:21 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
13:24 -!- Pr0z0id [~Pr0zoid@24-246-5-206.cable.teksavvy.com] has joined #openvpn
13:25 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Ping timeout: 244 seconds]
13:26 -!- newsham [~chat@udp216902uds.hawaiiantel.net] has joined #openvpn
13:26 < newsham> hi.  is there a way for a client cmd line or config to specify commands to run on connect and on disconnect?
13:26 < newsham> it looks like --client-connect and --client-disconnect are used for the server side ?
13:32 < newsham> ahh figured it out
13:32 -!- newsham [~chat@udp216902uds.hawaiiantel.net] has left #openvpn []
13:35 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
13:37 -!- Pr0z0id [~Pr0zoid@24-246-5-206.cable.teksavvy.com] has quit [Ping timeout: 276 seconds]
14:10 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
14:11 -!- Yen [Yen@unaffiliated/yen] has quit []
14:14 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
14:29 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
14:30 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
14:34 < Pr0zoid> i'm seeing tons of "Need IPv6 code in mroute_extract_addr_from_packet"
14:39 -!- EugeneKaway is now known as EugeneKay
14:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:56 -!- Guest13566 is now known as caesayy
14:56 -!- caesayy is now known as caesay
14:56 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
14:56 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
15:04 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has quit [Ping timeout: 250 seconds]
15:06 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
15:18 < EugeneKay> !factoids
15:18 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
15:20 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:21 < Pr0zoid> yaaaa! tha man of the hour
15:24 < Pr0zoid> krzie:  if you are around... i need some help with timeouts and the Need IPv6 code in mroute_extract_addr_from_packet messsages
15:24 < SigmaProjects> hey krzie, i have a suggestion for your config generator, an option for it to ask 'Is the vpn server the same as the gateway'
15:27 < krzie> Pr0zoid, dunno
15:28 < krzie> SigmaProjects, but why?  only thing that changes is you dont need to add an extra route to the gateway
15:28 < krzie> and that only matters when routing the lan behind the server over the vpn
15:28 < SigmaProjects> Yep, but just giving my pov of an idiot, took me a couple days to realize that extra route was breaking stuff
15:28 < krzie> lol
15:29 < krzie> it already did tell you not to iirc
15:29 < krzie> lemme look
15:30 < SigmaProjects> just to note, i looked and its '2010may07 v0.1'  is that super old?
15:31 < krzie> hrm, i guess it mentions nothing about adding a route to the gateway
15:31 < krzie> i thought it did
15:33 < SigmaProjects> Regardless, still <3 the script
15:34 < krzie> thanx =]
15:34 < krzie> i like your suggestion, i thought i was already doing that
15:34 < krzie> or something similar at least
15:35 < krzie> i thought i was giving a note about it
15:35 < krzie> 2010may07 v0.1 
15:35 < krzie> is the newest, you are good =]
15:35 < SigmaProjects> lol
15:36 < krzie> since theres actually people using it, i guess i should make 1.0 soon
15:36 < krzie> it cant be 1.0 until it also makes certificates =]
15:37 < SigmaProjects> that would be great, i used easy-rsa to make mine.. so much easier then doing it manualy
15:38 < krzie> ecrist makes ssl-admin, i believe he re-wrote it a little so i can call it from commandline... which means i can bundle ssl-admin with the confgen and call it for making certs... then the user can use ssl-admin after for cert management when they dont need to use the confgen more
15:38 < krzie> imo ssl-admin > easy-rsa > doing it by hand
15:39 < SigmaProjects> i was just making the certs from the router directly, didnt even cross my mind to do it elsewhere
15:40 < krzie> i dont even have internet access on my main CA box
15:41 < SigmaProjects> though, easy-rsa is idiot-proof as is (im evidence of that), if ssl-admin makes it even easier all the more welcome
15:41 < krzie> what version of bash do you use?
15:41 < krzie> bash --version
15:41 < krzie> ya ssl-admin is menu driven
15:43 < SigmaProjects> BusyBox v1.15.3 built-in shell (ash), is where i did most of the work setting up the vpn.. until i found your script, then moved to GNU bash, version 4.1.5(1)
15:45 < krzie> ahh cool
15:46 < krzie> i just skimmed my script again...
15:46 < krzie> looks like i never mention to add a route to the gateway
15:46 < krzie> which i really thought i did
15:46 < SigmaProjects> dream code doesnt count
15:48 < SigmaProjects> btw, this https://forums.openvpn.net/topic4683.html is how i found your script to begin with
15:48 <@vpnHelper> Title: OpenVPN Support Forum openvpn-confgen : Cert / Config management (at forums.openvpn.net)
15:49 < SigmaProjects> stop that
15:49 < krzie> oh cool!
15:50 < SigmaProjects> its a google hit from "openvpn config gen"
15:50 < SigmaProjects> you should add more keywords like 'openvpn idiot helper'
15:52 < krzie> not sure it would be too nice to add those words into that post!
15:52 < krzie> feel free to comment adding those words tho
15:52 < krzie> it would be a nicer way to add those words to the post ;]
15:52 < Pr0zoid> krzie:  i think i found it...... missing the --duplicate-cn flag
15:52 < krzie> i sure dont wanna call people using my script idiots ;]
15:52 < krzie> !dupe
15:52 <@vpnHelper> "dupe" is see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended)
15:53 < Pr0zoid> !man
15:53 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
15:56 < Pr0zoid> damn...
15:56 <@vpnHelper> RSS Update - forum: openvpn-confgen <http://forums.openvpn.net/topic4683.html#p12936>
16:04 -!- p3rror [~mezgani@41.140.96.120] has quit [Ping timeout: 255 seconds]
16:06 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
16:06 < SigmaProjects> i must live a sheltered internet life, thats the first time ive seen a ipv6 connection on irc
16:07 < Pr0zoid> ip6 is a ugly
16:08  * EugeneKay is using IPv6 for IRC
16:08 <@vpnHelper> RSS Update - forum: certificate to be certified until !? <http://forums.openvpn.net/topic8300.html#p12937>
16:09 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
16:09 < EugeneKay> Unlimited silly hostmasks :-D
16:09 < SigmaProjects> i'll end up writing stuff with 'ppft:xxx' and regexing afterwards, cuz i'll never remember the real addr
16:09 < Pr0zoid> krzie: have you seen the message "Need IPv6 code in mroute_extract_addr_from_packet"
16:10 < krzie> i dont use ipv6
16:10 < krzie> in fact out of all my servers, only 1 even has ipv6
16:10 < Pr0zoid> neither do i
16:10 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
16:10 < krzie> nope havnt seen it
16:11 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has quit [Client Quit]
16:12 < EugeneKay> Only my Linode has it natively, but I have a tunnel for my other boxen and one here at the house.
16:12 < EugeneKay> I'm moving my rack to HE next week, where I get a /48 natively.
16:12 < EugeneKay> It's the FUTURE
16:12 < krzie> hehe werd
16:13 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
16:13 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
16:15 <@vpnHelper> RSS Update - forum: cant connect to openvpn <http://forums.openvpn.net/topic8295.html#p12938>
16:19 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:28 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
16:39 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
16:48 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:28 -!- EugeneKay is now known as EugeneKaway
17:29 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
18:06 -!- EugeneKaway is now known as EugeneKay
18:11 < SigmaProjects> whenever someone has a moment, my on-going problem: server can't ping client or anything behind the client, but client can ping server, but not anything behind server (i double/trippled checked i disabled firewalls) http://pastie.org/private/lvpo29qn9hnm7guvlvan9a
18:13 < SigmaProjects> configs, routes, and log, in the pastie
18:17 < SigmaProjects> and just incase, i'll mention again, the vpn server runs on the internet gateway, as does the vpn client
18:19 < Bushmills> !clientlan
18:19 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
18:19 <@vpnHelper> better explanation
18:20 < Bushmills> but it's pointless to attempt that before you can ping client
18:20 < Bushmills> !firewall
18:20 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
18:21 < krzie> not only pointless, but detrimental for troubleshooting
18:21 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
18:21 < krzie> 1 step at a time ;]
18:21 < krzie> keep it simple
18:23 < Bushmills> !serverlan
18:23 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
18:24 < Bushmills> for "but not anything behind server"
18:25 < Bushmills> " but client can ping server" - make sure client reaches server through openvpn, and not through alternative route. 
18:27 < SigmaProjects> sorry, stepped away for a min
18:28 < SigmaProjects> the server & client can talk to eachother on their tun addresses
18:31 < SigmaProjects> just to make sure im understanding you correctly, 'not through alternative route' means it goes through the vpn, from client, tracerouting the server lan ip completes in 1 hop, and when i ping the server from the client, i see R/W msgs come through the log, so thats correct, right?
18:33 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Quit: Ex-Chat]
18:33 < SigmaProjects> !route
18:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:34 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
18:40 < Bushmills> yes, that's what i meant
18:48 < SigmaProjects> as soon as I added "push "route 192.168.6.0 255.255.255.0" to the server conf, these were in the log "client/76.172.93.7:33090 MULTI: bad source address from client [192.168.6.1], packet dropped"  but, before that it learned 'client' and pushed the routes
18:48 < SigmaProjects> there's an extra " in there while i was typing here
18:51 < SigmaProjects> the docs say to fix that, add the ccd iroute for the client, which i did and it said it found it and used it, but right after the bad source errors started
18:52 < krzie> show the server log of the client connecting
18:53 < SigmaProjects> http://pastie.org/private/7ljprbyz9agusgmmed5ohg
18:54 < SigmaProjects> crap
18:54 < SigmaProjects> copied too much, this is the correct: http://pastie.org/private/hfr1fvuodlotf7xzibranw
18:55 < krzie> verb 4
18:56 < SigmaProjects> http://pastie.org/private/z8g0luxbj9xvdd1ha18mw
18:56 < SigmaProjects> sorry for the fat one
19:06 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Remote host closed the connection]
19:12 < SigmaProjects> the client correctly pulled the routes, correct?
19:13 < krzie> thats the client log
19:13 < krzie> [16:52]  <krzie> show the server log of the client connecting
19:13 < SigmaProjects> shit.
19:14 < SigmaProjects> sorry. http://pastie.org/private/7u6m9teld1hezitcoqhw
19:15 < krzie> i dont see any MULTI errors...
19:16 < krzie> is the client seriously named "client" ?
19:17 < SigmaProjects> sorry, didnt realize you wanted to see those, so i had to try & generate traffic, here's with the multi errors http://pastie.org/private/acme8n8dxqcsw8pt5ealmw
19:17 < SigmaProjects> and yes.. when I was created the certs, i named it 'client' =/
19:18 < krzie> are you using multiple clients named client, with duplicate-cn option?
19:18 < SigmaProjects> there's just 1 client, and 1 server
19:18 < SigmaProjects> er, well duh, i mean its just the two communicating
19:20 < krzie> hrmn
19:20 < krzie> thats really weird
19:20 < SigmaProjects> i was reading somethign else, does (status=1) mean there's an error?
19:21 < krzie> nope
19:21 < krzie> my server log has status=1 as well, without issues
19:22 < krzie> that multi error should be solved by the iroute, which i do see being used
19:22 < krzie> show me the iroute line
19:22 < krzie> in the ccd
19:22 < krzie> so
19:22 < krzie> cat /etc/openvpn/clients/client
19:23 < SigmaProjects> iroute "192.168.6.0 255.255.255.0"
19:23 < SigmaProjects> this is the routing right now, http://pastie.org/private/9rvuc5r3f8dlbu0l4vebg  server at top, client at bottom
19:24 < krzie> dont really need the routing tables
19:24 < SigmaProjects> so, im not just crazy.. something really is wierd right?
19:25 < krzie> remove the quotes from iroute
19:25 < krzie> see if that helps
19:25 < krzie> my script didnt add it with quotes did it!?
19:25 < SigmaProjects> yea, it did
19:26 < SigmaProjects> krzie, c'mere and lemme give you a big ass hug
19:26 < krzie> ;]
19:26 < EugeneKay> big-ass hug or big ass-hug?
19:26 < SigmaProjects> removing the quotes fixed it, everything is back to normal
19:27 < krzie> interesting error too, i think that could be worthy of a trac ticket
19:27 < krzie> since the logs look like everything was fine
19:27 -!- Goribeet [~kvirc@static-66-15-30-111.bdsl.verizon.net] has joined #openvpn
19:28 < SigmaProjects> i should have noticed it too, even on your http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing there are no quotes
19:28 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
19:28 < SigmaProjects> stop that
19:28 < Bushmills> dest 192.168.6.0     gw 10.8.1.2     -    10.8.1.2  is the client, in subnet config.  10.8.1.1 is the server?   shouldn't gateway be the server then?
19:29 < krzie> SigmaProjects, ya i looked at my routing writeup to check if there should be quotes
19:29 < SigmaProjects> Bush, where did you see that
19:29 < krzie> it looked off, so i checked against my routing doc
19:29 < Bushmills> in http://pastie.org/private/9rvuc5r3f8dlbu0l4vebg
19:29 < Bushmills> ah, never mind, that was server routes
19:30 < krzie> its right bush
19:30 < krzie> server at top
19:30 < Bushmills> thought that was client
19:32 < SigmaProjects> and everyone can talk to everyone's lan
19:33 < SigmaProjects> thank you both so much, used up a lot of your guy's time these past couple weeks
19:33 < krzie> you're welcome
19:34 < krzie> thanx for the idea for the confgen
19:34 < krzie> ill get it in there at some point ;]
19:34 < krzie> i still cant find where my script makes ccd entries, lol
19:35 < krzie> ahh there it is!
19:35 < krzie> and shit, i did use quotes
19:35 < krzie> grr, now i need to update it =/
19:36 < SigmaProjects> echo "iroute \"${CSUBNET}\"" > ccd/${CLANCN[$y]}
19:36 < SigmaProjects> ah, yea
19:36 < krzie> yep, just found it
19:37 < krzie> !confgen
19:37 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
19:38 < krzie> (cheating for svn address ;] )
19:39 < SigmaProjects> sweeet
19:39 < SigmaProjects> hmm i think i need to update my link
19:55 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
20:01 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:09 -!- Goribeet [~kvirc@static-66-15-30-111.bdsl.verizon.net] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
20:13 -!- master_of_master [~master_of@p57B53D1A.dip.t-dialin.net] has quit [Ping timeout: 268 seconds]
20:14 -!- master_of_master [~master_of@p57B53DA8.dip.t-dialin.net] has joined #openvpn
21:18 -!- kthakore [~kthakore@li136-101.members.linode.com] has joined #openvpn
21:18 < kthakore> Hello
21:18 < kthakore> I keep getting a weird error with my openvpn config
21:18 < kthakore> Options error: remote: port number associated with host www.remotelinux.com is out of range
21:20 < Bushmills> set port between 1 and 65535
21:24 < EugeneKay> !configs
21:24 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
21:25 < kthakore> here is my config http://paste.scsys.co.uk/112383
21:26 < kthakore> port 1194 
21:27 < kthakore> Bushmills: my port 1194 is in between that range
21:28 < kthakore> EugeneKay: OS is ubuntu and openvers 2.10
21:28 < kthakore> 2.1.0
21:28 < EugeneKay> <>
21:29 < EugeneKay> Why is that stuff there
21:29 < EugeneKay> It's trying to parse "<http://www.remotelinux.com>" as a port
21:29 < kthakore> I dunno
21:29 < kthakore> I copied the default I guess
21:29 < EugeneKay> Take it out :-p
21:30 < kthakore> Thanks
21:31 < kthakore> EugeneKay: I have a WARN
21:31 < kthakore> but I don't see the tun device made now
22:00 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: Connection reset by peer]
22:01 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
22:07 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:12 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 252 seconds]
22:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
22:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:51 < Bushmills> !logs
23:51 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
23:59 < EugeneKay> I hate cygwin
--- Day changed Sun Jun 12 2011
00:01 < Bushmills> yeah, the "win" part of cygwin is utterly suspect
00:16 < EugeneKay> Eh. I'm beating it into submission.
00:16 < EugeneKay> All I wanted was a decent shell
00:17 < Bushmills> command.com no good?
00:17 < EugeneKay> Makes me want to stab myself in the hands
00:21 < hyper_ch> why do you hate cygwin? it enables linux-like power of windows
00:24 < EugeneKay> That's why I'm using it :-p
00:24 < EugeneKay> There's just so much shit that is broken or impossible.
00:25 < hyper_ch> rsync works
01:43 <@vpnHelper> RSS Update - forum: IPTABLES Error when attempting to add a forward <http://forums.openvpn.net/topic8301.html#p12939>
02:05 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
02:06 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
02:06 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
02:15 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
02:17 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
02:33 -!- folivora_ [~bomshiva@koekaniini.kelju.fi] has joined #openvpn
02:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
02:38 -!- Netsplit *.net <-> *.split quits: m4rcu5, krzee, folivora, dvl, ScriptFanix, corretico, sidewalk, sia^pwnnt, fahadsadah, d12fk,  (+79 more, use /NETSPLIT to show all of them)
02:42 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
02:43 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
02:43 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
02:43 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
02:43 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has joined #openvpn
02:43 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
02:43 -!- raidzx [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
02:43 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
02:43 -!- Dougy [me@tech.qsi.net] has joined #openvpn
02:43 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
02:43 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
02:43 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
02:43 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
02:43 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
02:43 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
02:43 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
02:43 -!- dazol [~dazo@nat/redhat/session] has joined #openvpn
02:43 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
02:43 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
02:43 -!- tty234 [telex@gateway/shell/anapnea.net/x-nfxrumqnrylomfqj] has joined #openvpn
02:43 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:43 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
02:43 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
02:43 -!- kthakore [~kthakore@li136-101.members.linode.com] has joined #openvpn
02:43 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
02:43 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
02:43 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
02:43 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
02:43 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
02:43 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
02:43 -!- fipu [~fipufr@212.83.42.243] has joined #openvpn
02:43 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
02:43 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
02:43 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
02:43 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
02:43 -!- freaky[t]_ [alpha@freakyonline.de] has joined #openvpn
02:43 -!- master_of_master [~master_of@p57B53DA8.dip.t-dialin.net] has joined #openvpn
02:43 -!- luneff [~yury@84.51.197.177] has joined #openvpn
02:43 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
02:43 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
02:43 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
02:43 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
02:43 -!- mode/#openvpn [+o cron2] by ChanServ
02:43 -!- dazol [~dazo@nat/redhat/session] has quit [Changing host]
02:43 -!- dazol [~dazo@nat/redhat/x-wyqsfvuvsdqewrkl] has joined #openvpn
02:43 -!- udk [~evaldo@evaldo.gardenali.biz] has joined #openvpn
02:43 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
02:43 -!- m4rcu5 [~root@srv01.m4rcu5.net] has joined #openvpn
02:43 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
02:44 -!- jetole_ [~jetole@irc.fossl.net] has joined #openvpn
02:44 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
02:44 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
02:44 -!- Martin [martin@shell.ipv6.octocore.net] has joined #openvpn
02:44 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
02:44 -!- testing [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
02:44 -!- Hamlin [~Hamlin@mountainmorningband.com] has joined #openvpn
02:44 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
02:44 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
02:44 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
02:44 -!- Netsplit *.net <-> *.split quits: @cron2, Bushmills, hyper_ch, luneff, freaky[t]_, havoc, zu, master_of_master
02:44 -!- Martin is now known as 18WAAFIZG
02:44 -!- oc80z [oc80z@blea.ch] has joined #openvpn
02:44 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
02:44 -!- nebajoth [~nebajoth@starfighter.org] has joined #openvpn
02:44 -!- Muty [~amir@unaffiliated/muty] has joined #openvpn
02:44 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
02:44 -!- chantra_afk [~chantra@unaffiliated/chantra] has joined #openvpn
02:44 -!- SWAT [~swat@ubuntu/member/swat] has joined #openvpn
02:44 -!- Naku [~syana@94.23.115.158] has joined #openvpn
02:44 -!- Perun_ [perun@chao5.net] has joined #openvpn
02:44 -!- Netsplit *.net <-> *.split quits: aef, pa, tty234, Clete2, dazol
02:44 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
02:44 -!- Netsplit *.net <-> *.split quits: Dougy, caesay, Kateon
02:45 -!- tty234 [telex@gateway/shell/anapnea.net/x-ucbiwzugzfloubda] has joined #openvpn
02:45 -!- udk is now known as Guest37253
02:45 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
02:46 -!- Netsplit over, joins: Bushmills
02:49 -!- mace_ [~mace@n01.darksilence.net] has joined #openvpn
02:49 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
02:49 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
02:49 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
02:49 -!- FP|Maverick-werk [~commo@h64-141-120-20.pcccinc.net] has joined #openvpn
02:49 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
02:49 -!- corretico [~luis@201.201.44.82] has joined #openvpn
02:49 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
02:49 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
02:49 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
02:49 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
02:49 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
02:49 -!- nb [~nb@fedora/nb] has joined #openvpn
02:49 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
02:49 -!- Champi [Champi@rootshell.fr] has joined #openvpn
02:49 -!- equinox [~equinox@spaceboyz.net] has joined #openvpn
02:49 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
02:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
02:49 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
02:49 -!- dazol [~dazo@nat/redhat/x-kwrucmnffztdcgul] has joined #openvpn
02:49 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
02:49 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
02:49 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:49 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
02:49 -!- freaky[t]_ [alpha@freakyonline.de] has joined #openvpn
02:49 -!- master_of_master [~master_of@p57B53DA8.dip.t-dialin.net] has joined #openvpn
02:49 -!- luneff [~yury@84.51.197.177] has joined #openvpn
02:49 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
02:49 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
02:49 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
02:49 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
02:49 -!- mode/#openvpn [+o cron2] by ChanServ
02:50 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
02:50 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
02:50 -!- Dougy [me@tech.qsi.net] has joined #openvpn
03:07 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
03:16 -!- K1ng` [~KING@180.211.188.116] has quit [Read error: Connection timed out]
03:17 -!- K1ng` [~KING@180.211.188.116] has joined #openvpn
03:21 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:50 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
03:52 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
04:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:27 -!- sidewalk [sidewalk@shell.glassbilen.net] has joined #openvpn
04:36 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
04:40 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
05:04 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
05:12 -!- Pr0zoid [~Pr0zoid@CPE001c101b3f95-CM001ceaccc39a.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
05:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:18 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
05:23 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
05:31 -!- EugeneKay is now known as EugeneKaway
05:31 -!- EugeneKaway is now known as EugeneKay
05:39 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
05:46 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
05:54 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
06:16 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
06:17 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
06:23 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
06:33 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
06:33 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
06:42 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
07:24 -!- K1ng [~KING@180.211.188.116] has joined #openvpn
07:40 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:54 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
08:00 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
08:03 -!- EugeneK [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
08:03 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has joined #openvpn
08:04 -!- d457k [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
08:05 -!- kisom_ [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
08:05 -!- kisom_ is now known as Guest13692
08:08 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has left #openvpn []
08:10 -!- Netsplit *.net <-> *.split quits: EugeneKay, d12fk, sidewalk, openbsdnoob, up_the_irons, kisom
08:10 -!- EugeneK is now known as EugeneKay
08:11 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
08:13 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
08:15 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:17 -!- pif [~ldm@90.94.152.163] has joined #openvpn
08:18 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
08:21 < pif> hi, when using persist-tun and sending a SIGUSR1 what happens to the application using tunX while ovpn restarts?
08:22 -!- EugeneKay is now known as EugeneKaway
08:26 <@vpnHelper> RSS Update - forum: problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p12940>
08:34 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
08:41 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
08:58 -!- folivora_ is now known as folivora
09:16 -!- EugeneKaway [eugenekay@pitofsnakesandbrokenglass.com] has quit [Ping timeout: 260 seconds]
09:25 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
09:37 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
09:53 -!- Yen [~Yen@unaffiliated/yen] has joined #openvpn
10:00 -!- K1ng` [~KING@180.211.188.116] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
10:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:10 -!- sidewalk [sidewalk@shell.glassbilen.net] has joined #openvpn
10:31 -!- corretico [~luis@201.201.44.82] has joined #openvpn
10:53 -!- Pr0zoid [~Pr0zoid@184.95.44.33] has joined #openvpn
11:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
11:24 -!- EugeneKaway [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
11:24 -!- EugeneKaway is now known as EugeneKay
11:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
11:52 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:09 -!- defsdoor_ [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
12:12 -!- Netsplit *.net <-> *.split quits: ScriptFanix, defsdoor, Guest13692, mace_, d457k, sedulous, p3rror, up_the_irons, dkr, Fiouz,  (+14 more, use /NETSPLIT to show all of them)
12:16 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
12:18 -!- Netsplit over, joins: |Mike|
12:27 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
12:28 < ravidar> Is there a way to extend client valid certificate without having to renew the certificate?
12:29 < krzie> no
12:30 < ravidar> no? :(
12:30 < krzie> it looked like a clear answer to me
12:30 < ravidar> yes sir
12:35 -!- pl4to [~pl4to@184-100-182-181.ptld.qwest.net] has joined #openvpn
12:42 -!- LuckyY_ is now known as LuckyY
12:43 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
12:43 -!- nb [~nb@2001:470:1:18d:0:dead:beef:cafe] has joined #openvpn
12:43 -!- sidewalk [sidewalk@shell.glassbilen.net] has joined #openvpn
12:43 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
12:43 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
12:43 -!- mace_ [~mace@n01.darksilence.net] has joined #openvpn
12:43 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
12:43 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
12:43 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
12:43 -!- FP|Maverick-werk [~commo@h64-141-120-20.pcccinc.net] has joined #openvpn
12:43 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
12:43 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
12:43 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
12:43 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
12:43 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
12:43 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
12:43 -!- equinox [~equinox@spaceboyz.net] has joined #openvpn
12:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:44 -!- nb is now known as Guest21613
12:46 < pl4to> !welcome
12:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:47 < pl4to> !route
12:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:47 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
12:47 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
12:50 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 246 seconds]
12:52 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:52 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
12:58 -!- Guest21613 [~nb@2001:470:1:18d:0:dead:beef:cafe] has quit [Changing host]
12:58 -!- Guest21613 [~nb@fedora/nb] has joined #openvpn
12:58 -!- Guest21613 is now known as nb
13:00 -!- pif [~ldm@90.94.152.163] has quit [Ping timeout: 255 seconds]
13:01 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
13:03 -!- Pr0z0id [~Pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
13:04 -!- Pr0zoid [~Pr0zoid@184.95.44.33] has quit [Ping timeout: 244 seconds]
13:04 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
13:06 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
13:06 -!- K1ng [~KING@180.211.188.116] has quit [Ping timeout: 244 seconds]
13:07 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 255 seconds]
13:08 -!- K1ng [~KING@180.211.188.162] has joined #openvpn
13:09 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
13:13 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
13:15 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
13:18 -!- defsdoor_ [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
13:18 -!- pl4to [~pl4to@184-100-182-181.ptld.qwest.net] has quit [Quit: Leaving]
13:36 -!- K1ng [~KING@180.211.188.162] has quit [Ping timeout: 240 seconds]
13:40 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
13:46 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
13:46 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
13:52 -!- K1ng [~KING@180.211.188.162] has joined #openvpn
13:53 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
13:56 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
14:01 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
14:01 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
14:02 -!- mikeones [~mikeones@pool-72-64-111-102.dllstx.fios.verizon.net] has quit [Ping timeout: 252 seconds]
14:04 -!- mikeones [~mikeones@pool-72-64-111-102.dllstx.fios.verizon.net] has joined #openvpn
14:05 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
14:06 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
14:13 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
14:31 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
14:32 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has joined #openvpn
14:36 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
14:36 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
14:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:45 -!- K1ng [~KING@180.211.188.162] has quit [Read error: Connection reset by peer]
15:03 < kthakore> config
15:03 < kthakore> When I run openvpn I get this WARN. ARN: could not open database for 512 bits. Skipped 
15:03 < kthakore> How do I fix this?
15:24 < kthakore> This is my complete log
15:24 < kthakore> SIOCSIFADDR: Invalid argument
15:24 < kthakore> http://paste.scsys.co.uk/112469
15:35 -!- Yen [~Yen@unaffiliated/yen] has quit []
15:43 -!- 18WAAFIZG is now known as Martin`
15:58 < krzee> gotta update
15:59 < krzee> !configs
15:59 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
16:17 < Pr0z0id> are there any decent pptp vpn server software ?
16:18 < Pr0z0id> yes.. i know i'm in openvpn.. 
16:26 -!- K1ng [~KING@180.211.188.162] has joined #openvpn
16:52 -!- Champi [Champi@rootshell.fr] has joined #openvpn
16:54 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has quit [Quit: g0n3 fgt]
16:58 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:15 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
17:17 < ecrist> bitches
17:17 < ecrist> just sayin'
17:21 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:22 < ecrist> heh
17:23 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:36 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
17:39 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:42 -!- geeker [~geek@c-98-246-11-112.hsd1.or.comcast.net] has joined #openvpn
17:43 < geeker> g'day all
17:43 < geeker> !welcome
17:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:44 < geeker> !/30
17:44 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
17:44 < geeker> I would like to add parity support to OpenVPN to provide some loss-recovery for unstable networks like GSM
17:45 < geeker> The thought is to provide a sort of streaming RAID-5 algorithm, such that n packets  are xored together, and the n+1th packet is the xor packet.
17:47 < geeker> Can someone point me toward OpenVPN's pre-crypto frame format?  
17:49 < geeker>  I would like to stay within the scope of OpenVPN's protocol and extend it in the way it is designed to be extended.
17:51 < EugeneKay> Uh.
17:52 < EugeneKay> The mechanisms built into TCP-over-UDP already handle that.
17:52 < ecrist> geeker: that's built in to TCP
17:52 < EugeneKay> The best you're going to do is introduce more latency(packet calculation time) and overhead.
17:52 < geeker> They handle retry, they do not handle on-the-fly packet loss correction---which is critical to VoIP applications
17:53 < geeker> EugeneKay, a bit of compute overhead and increase bandwidth is acceptable for my use case.  I would even accept doubling every packet to make sure it gets to the receiver, but that seems excessive.
17:53 < ecrist> heh, the problem with VoIP isn't packet loss, per se, it's correction for packet loss.  VoIP is real-time.  by the time youc orrect for it, the next syllable is said over the wire and causes more problems.
17:53 < EugeneKay> That^
17:53 < geeker> ecrist, thats what jitter buffers are for.  
17:54 < EugeneKay> tl;dr: you're solving a problem that doesn't exist
17:54 < ecrist> I'm fully aware of jitter buffers
17:54 < ecrist> EugeneKay: I'm guessing he's solving a problem he has, but I don't know it's a general-use case
17:55 < geeker> EugeneKay, how so?  If a VPN link carries UDP voice traffic and a packet is lost, how is this not a problem?
17:55 < ecrist> geeker: my suggestion is to do your work, provide a patch and commentary to the mailing list.
17:55 < ecrist> until then, nobody's going to be much interested...
17:55 < EugeneKay> IT's the VoIP protocol's job to deal with that, not OpenVPN
17:55 < ecrist> EugeneKay is right...
17:55 < geeker> ecrist, yes I intend to, I'm here looking for pointers into the OpenVPN code and its packet structures.
17:56 < ecrist> none is likely to be offered here.  nobody's going to tell you much, as most here don't know much, and also, there's nothing they can offer you can't read in the code
17:57 < geeker> thanks ecrist, I'll dig into the code.  I thought I would ask in case there's a developer here that knows the code well enough to point a few things out.  
17:58 < geeker> EugeneKay, I tend to agree with you, but current SIP implementations do not include voice redundancy in their packet stream---and rather than attempt to amend the SIP spec, I would prefer to patch OpenVPN to increase link reliability at the transport layer.  
17:58 < ecrist> there are devs here, but my statement above stands...
17:58 -!- mode/#openvpn [+o ecrist] by ChanServ
17:58 -!- mode/#openvpn [-o ecrist] by ecrist
17:58 < ecrist> ;)
17:59 < geeker> ecrist, does that mean you're a developer?
17:59 < EugeneKay> It means this is a user support channel. Developer questions are...... likely to be ignored, and stop wasting your breath, eh?
17:59 < ecrist> I am heavily involved in OpenVPN, yes
18:00 < geeker> EugeneKay, I'm on the openvpn dev list and I see that dev conferences are held on this channel, so I thought it only likely that devs would hang out here and possibly provide some help.  
18:00 < ecrist> geeker: they're held in #openvpn-devel
18:00 < ecrist> not here
18:00  * geeker overlooked that.
18:00 < geeker> thanks ecrist.
18:00  * geeker --> #openvpn-devel
18:00 -!- geeker [~geek@c-98-246-11-112.hsd1.or.comcast.net] has left #openvpn ["Leaving"]
18:02 < K1ng> http://www.youtube.com/watch?v=vjGLVbG6R44&feature=feedu that bitch murdered his her own daughter
18:02 <@vpnHelper> Title: YouTube - Casey Anthony Laughs During Testimony (06.12.11) (at www.youtube.com)
18:02 < K1ng> :(
18:06 < ecrist> K1ng: slightly OT....
18:06 < K1ng> OT?
18:06 < ecrist> Off-Topic
18:06 < K1ng> ah
18:06 < EugeneKay> Trolololitics
18:07 < ecrist> ?
18:07 < EugeneKay> I just try to ignore current events. They're too depressing
18:35 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
18:44 -!- gallaeaho [~Tsukasa@unaffiliated/konata] has joined #openvpn
18:44 < gallaeaho> Hi, what's the channel for the OpenVPN Access Server client ?
18:59 < krzee> !as
18:59 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
18:59 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
18:59 < krzee> #4
19:00 < gallaeaho> krzee: thanks
19:00 < krzee> np
19:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
19:09 -!- gallaeaho [~Tsukasa@unaffiliated/konata] has quit [Ping timeout: 250 seconds]
19:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
19:17 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has quit [Ping timeout: 240 seconds]
19:24 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
19:25 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:25 -!- Cain` is now known as Cain
19:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
19:55 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12941>
20:12 -!- master_of_master [~master_of@p57B53DA8.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
20:14 -!- master_of_master [~master_of@p57B55901.dip.t-dialin.net] has joined #openvpn
20:21 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
20:21 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:15 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
21:17 -!- Guest37253 [~evaldo@evaldo.gardenali.biz] has quit [Quit: leaving]
21:17 -!- UdontKnow [~evaldo@evaldo.gardenali.biz] has joined #openvpn
21:17 -!- UdontKnow [~evaldo@evaldo.gardenali.biz] has quit [Changing host]
21:17 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
21:26 -!- luneff [~yury@84.51.197.177] has joined #openvpn
21:47 -!- K1ng [~KING@180.211.188.162] has quit [Read error: Connection reset by peer]
21:48 -!- K1ng [~KING@180.211.188.162] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:46 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:46 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:47 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
22:59 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:59 -!- carbon_monoxide [~cm@061093232225.ctinets.com] has quit [Client Quit]
23:00 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
23:00 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Client Quit]
23:00 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
23:13 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:13 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:35 -!- luckman212_ [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
23:37 <@vpnHelper> RSS Update - forum: OpenVPN Reconnect Problem <http://forums.openvpn.net/topic8165-30.html#p12942>
23:38 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Ping timeout: 260 seconds]
23:50 -!- ravidar [ravidar@ip24-255-127-217.dc.dc.cox.net] has quit []
--- Day changed Mon Jun 13 2011
00:19 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
00:20 -!- oc80z [oc80z@blea.ch] has joined #openvpn
00:25 <@vpnHelper> RSS Update - forum: openVPN server connecting to proxy <http://forums.openvpn.net/topic8302.html>
00:30 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 276 seconds]
00:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:40 -!- pif [~ldm@90.94.225.253] has joined #openvpn
00:40 < pif> hi, where can I find configuration defaults? (I don't see them in the man page)
00:55 -!- K1ng [~KING@180.211.188.162] has quit [Ping timeout: 250 seconds]
00:56 -!- K1ng [~KING@180.211.188.218] has joined #openvpn
00:58 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
01:21 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
01:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:47 -!- lamba [~x@unaffiliated/lamba] has joined #openvpn
01:50 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p12944>
01:50 < lamba> hello there. has anyone ever had an issue where upon connecting to the vpn a default route to the vpn appears on the client, but no redirect-gateway ro similar is pushed from the server ?
01:50 < lamba> all the routes pushed appear fine, but then 0.0.0.0 is the new last route. I end up with 2 0.0.0.0 routes. 
01:52 < lamba> this is on linux btw. centos5 server, fedora 14 client.
01:53 < Bushmills> yes. when having  redirect-gateway is in client config
01:53 < Bushmills> s/is//
01:53 < lamba> redirect gateway appears nowhere in either config. 
01:54 < Bushmills> one of the 0.0.0.0 routes has netmask 128.0.0.0?
01:54 < Bushmills> and there is another 128.0.0.0 route?
01:56 < lamba> i end up with a "0.0.0.0 <ip of vpn server tun interface> tap0" type route. this comes just before my usual gateway. 
01:56 < lamba> the net result is all traffic goes over the vpn link, even though we only pushed specific routes. its baffling
01:57 < Bushmills> that's be the result of redirect-gateway without def1.   maybe someone removed push "redirect-gateway" from server config, but forgot to reload server
01:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
01:58 < Bushmills> alternatively, you're looking at a different config than the server actually uses.  or different client config than client uses
01:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:59 < lamba> ill reload it now and check. seems unlikely, as the config is held in svn and no revision has ever had it. 
02:00 < Bushmills> it is also unlikely that server invents a push redirect-gateway without it being specified in config
02:00 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has quit [Read error: Operation timed out]
02:02 < lamba> restarted server service. still getting the default gateway set.
02:02 < lamba> ill paste the config up somewhere, one sec.
02:05 < Bushmills> how many  *.conf files are in your /etc/openvpn  directory?
02:05 < lamba> 1
02:06 < Bushmills> on server, as well as on client?
02:06 < lamba> yes
02:07 < lamba> this is on multiple clients. on rhel5 theres a log messages saying cant create route as it already exists and this route isnt made, but on multiple fedora clients it appears
02:11 < lamba> http://pastebin.com/raw.php?i=wn4SFpVW
02:16 < Bushmills> grep client log for "redirect"
02:17 < lamba> client log is var/log/messages ?
02:18 < Bushmills> it is where you instruct client to put it
02:18 < lamba> ok, well, theres nothing in /var/log/messages about redirects. 
02:19 < Bushmills> you haven't instructed client to put it anywhere yet
02:19 < lamba> ok. 
02:20 < Bushmills> is it on purpose that you use your (?) public ip addresses for vpn use, where possibly an rfc1918 subnet would do?
02:23 < lamba> the public ip address of 90.1 isnt public in this context. the lan here is numbered on french public ip addresses. If thats what you mean
02:24 < Bushmills> "public" as in "internet routable"  
02:25 < Bushmills> if i ping 90.1.230.6, i will be routed somewhere to. your system?
02:25 < lamba> public as in some networking company from before i started decided it'd be a good idea to just use any old willy-nilly block of addresses to number thousands of machines. 
02:25 < Bushmills> " any old willy-nilly block of addresses" - yes - why not a rfc1918 address?
02:26 < Bushmills> non-vpn machines can't reach the vpn machines on their vpn subnet addresses anyway
02:28 < lamba> thats expected. if i understand you correctly. we dont want the client machines connectable from the rest of the lan, we just want certain ips on the server network reachable, which we achieve through iptables filtering in the connect scripts mentioned in the server config. #
02:28 < lamba> the whole setup works just great if you a) dont mine it passing all traffic over the link or b) remove the newly created default route over the link. 
02:28 < lamba> mind*
02:28 < Bushmills> that's why it doesn't make sense to use public - internet routed - ip addresses for vpn
02:29 < lamba> the vpn traffic is redirected from a proper public address on anouther machine from xinetd. we dont contact it on any french public ip. 
02:30 < Bushmills> the only situation i currently see where it would make sense is when you want to allow the clients to be reachable on internet addresses, while final hop is going through vpn server, and vpn, to your clients 
02:31 < Bushmills> " we dont contact it on any french public ip" - but you *assing* them ip addresses from french public address pool
02:31 < Bushmills> assign
02:31 < lamba> yes. is that an issue ?
02:31 < Bushmills> are those addresses yours?
02:31 < lamba> nope.
02:32 < Bushmills> you risk not being able to reach those addresses, if they're legally used by other systems.
02:32 < lamba> yes
02:32 < Bushmills> for the purpose of private ip addresses, there are the rfc1918 address ranges
02:32 < Bushmills> they're meant for such use
02:32 < lamba> sadly i dont make the rules, i just play the game :(
02:33 < Bushmills> you don't. you violate the rules
02:34 < lamba> i understand its retarded, but this isnt something i control. theres a project to move machines to the rfc1918 block, but currently it isnt finished. 
02:34 < lamba> i dont think i can move this server to the rfc1918 block as its in a building which is still on the 90 network. 
02:35 < Bushmills> we're talking openvpn addresses, not rest of network. i.e. the internally used addresses
02:36 < lamba> ill see if we can mvoe the vpn addresses to 1918 while leaving the server on 90
02:37 < Bushmills> !tcp
02:37 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer), or (#3) if you must use tcp, you likely want --tcp-nodelay
02:37 < Bushmills> though neither is directly related to your default gateway problem
02:37 < lamba> that also is unavoidable, and im aware of.
02:45 < lamba> ok, on the client with verbosity cranked right up i am getting this line right after the route pushes "forbid default route: no"
02:47 -!- EugeneK [eugenekay@2600:3c01::14:713e] has joined #openvpn
02:49 < Bushmills> are you using network manager?
02:50 < lamba> yes. 
02:50 < lamba> hmmm might be it. one sec.
02:50 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
02:51 -!- EugeneK is now known as EugeneKay
02:51 < lamba> yay ;p yea, network manager alters the behaviour. turns out the rhel5 machine didnt use nm. 
02:51 < Bushmills> that may think that - because the ip address is from a public net - it has to set default route
02:52 < Bushmills> see, your address choice still bites you in the end :) 
02:52 < lamba> yea, got it working as expected now. 
02:52 < lamba> if you think this is a hassle, i wont tell you that we recently expanded into france. 
02:53 < Bushmills> doesn't matter. rfc1918 is of worldwide vailidity
02:53 < lamba> yea, cept those machines are on french public addresses also. same networking company. \o/ 
02:53 < lamba> oh wells. least its working. thansk for the help. 
02:53 < EugeneKay> OH GOD FUCK EVERYTHING ABOUT NETWORK MANAGER
02:53 < Bushmills> does "same networking company" set up your openvpn servers? 
02:54 < lamba> no. thats anouther company, who seem to be competing for the race to the bottom. 
02:54 < Bushmills> then i fail to understand how "same networking company" is related to your address choice in openvpn
02:54 -!- eahmm [44621f07@gateway/web/freenode/ip.68.98.31.7] has joined #openvpn
02:55 < eahmm> hello everyone
02:55 -!- lamba [~x@unaffiliated/lamba] has quit [Quit: leaving]
02:55 < eahmm> I have a quick question
02:55 < eahmm> I did setup openvpn in my router like this quick tutorial shows it
02:55 < eahmm> http://blog.johnso.org/2009/08/how-to-setup-openvpn-in-tomato.html
02:55 <@vpnHelper> Title: Hacks and Slash: How to Setup Openvpn in Tomato (at blog.johnso.org)
02:56 < eahmm> the ip of the client doesn't change into mine, do I miss anything?
03:01 < Bushmills> "into mine"?
03:01 < Bushmills> "change"?
03:01 < Bushmills> change from what into what, and why should it change?
03:03 < eahmm> the client's ip into my ip
03:03 < eahmm> with client I mean a machine in a different Country
03:05 < eahmm> for example, the client in italy connect to my routers'vpn in usa and opens netflix
03:08 -!- EugeneKay [eugenekay@2600:3c01::14:713e] has quit [Remote host closed the connection]
03:08 < Bushmills> that's not how openvpn works
03:08 -!- EugeneKay [eugenekay@2600:3c01::14:713e] has joined #openvpn
03:08 < Bushmills> would your client suddenly have router's ip address - how could your router be reached?
03:09 < Bushmills> or, would packets to that ip address reach router, or your client?
03:11 < eahmm> my bad for thinking something else, I'll come back after I read more guides
03:12 < Bushmills> and - how would client reach the router if it'd have the same ip address - it'd think "that's me, with that ip address"
03:13 < Bushmills> !howto
03:13 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:14 < eahmm> I thought the VPN, configured as a different connection and service was getting between the normal connection and the router (vpn server) and work like a proxy
03:15 < defswork> not a proxy - a natting gateway
03:15 < Bushmills> it works a bit like a pair of network cards with a cable to connect them
03:15 < defswork> (if you set your firewall rules to nat)
03:15 < Bushmills> nat is firewall, not openvpn
03:15 < eahmm> and it encrypts everything, that's what openvpn really does
03:15 < Bushmills> "openvpn reboots your machine, if you use the operating systems reboot command" :)
03:16 < defswork> Bushmills, yeah but in his example it will only work if he's natting somewhere so I was describing his setup
03:17 < defswork> at least - I hope hes natting somewhere
03:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
03:18 <@vpnHelper> RSS Update - forum: openVPN server connecting to proxy <http://forums.openvpn.net/topic8302.html#p12946> || OpenVPN ROUTE: omitted no-op route: 12.5.0.1/255.255.255.255 <http://forums.openvpn.net/topic8297.html#p12945>
03:19 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:20 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
03:23 -!- eahmm [44621f07@gateway/web/freenode/ip.68.98.31.7] has quit [Quit: Page closed]
03:23 <@vpnHelper> RSS Update - forum: Problem in starting openvpn <http://forums.openvpn.net/topic8269-15.html#p12947>
03:40 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
03:54 <@vpnHelper> RSS Update - forum: openVPN server connecting to proxy <http://forums.openvpn.net/topic8302.html#p12948>
04:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
04:11 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:15 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
04:32 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:32 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:36 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Read error: Connection reset by peer]
04:37 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
05:00 <@vpnHelper> RSS Update - forum: openVPN server connecting to proxy <http://forums.openvpn.net/topic8302.html#p12949>
05:02 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
06:14 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:19 <@vpnHelper> RSS Update - forum: openVPN server connecting to proxy <http://forums.openvpn.net/topic8302.html#p12950>
06:19 -!- bauruine [~stefan@217.150.230.222] has joined #openvpn
06:25 -!- chantra_afk [~chantra@unaffiliated/chantra] has quit [Quit: leaving]
06:26 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
06:28 -!- EugeneKay is now known as EugeneBacon
06:33 -!- EugeneBacon is now known as EugeNoBacon
06:41 -!- chantra [~chantra@unaffiliated/chantra] has quit [Quit: leaving]
06:45 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
06:46 -!- K1ng` [~KING@180.211.188.218] has joined #openvpn
06:49 -!- K1ng [~KING@180.211.188.218] has quit [Ping timeout: 276 seconds]
07:04 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
07:21 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
07:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
07:30 -!- EugeNoBacon is now known as EugeneKay
07:39 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
07:39 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
07:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:42 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
07:54 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
07:54 <@vpnHelper> RSS Update - forum: openVPN server connecting to proxy <http://forums.openvpn.net/topic8302.html#p12951>
07:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:00 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
08:00 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
08:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:03 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
08:17 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
08:29 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
08:39 -!- SOG [~SOG@222.125.196.155] has quit [Quit: I will be back!]
08:42 -!- jetole_ is now known as jetole
08:44 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Read error: Connection reset by peer]
08:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:47 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 255 seconds]
08:51 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has joined #openvpn
08:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:16 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
09:19 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
09:25 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
09:31 -!- Blues-Man [~bluesman@host246-18-dynamic.46-79-r.retail.telecomitalia.it] has joined #openvpn
09:39 -!- Blues-Man [~bluesman@host246-18-dynamic.46-79-r.retail.telecomitalia.it] has left #openvpn ["Sto andando via"]
10:13 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
10:35 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:51 -!- Blues-Man [~bluesman@host246-18-dynamic.46-79-r.retail.telecomitalia.it] has joined #openvpn
10:52 -!- Blues-Man [~bluesman@host246-18-dynamic.46-79-r.retail.telecomitalia.it] has left #openvpn []
11:21 -!- pif [~ldm@90.94.225.253] has quit [Ping timeout: 255 seconds]
11:22 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 240 seconds]
11:24 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
11:29 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
11:29 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
11:34 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Remote host closed the connection]
11:34 <@vpnHelper> RSS Update - forum: Dual Ethernet Bridge, spanning tree issue. <http://forums.openvpn.net/topic8303.html>
12:18 -!- Guifort [~Guifort@175.201.113.78.rev.sfr.net] has joined #openvpn
12:30 -!- Guifort [~Guifort@175.201.113.78.rev.sfr.net] has quit [Read error: No route to host]
12:40 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
12:43 -!- agreen [~agreen@warmcat.com] has joined #openvpn
12:45 < agreen> Hey folks... multihome question.  I have a server with two IPs on one  physical interface, eth0 vs eth0:0.  I want to run Openvpn on eth0:0 *and* have its un-vpn'd traffic go out on eth0:0 only... what happens is it all works but vpn traffic connected via eth0:0 actually goes out the default route on eth0's IP
12:45 < agreen> !welcome
12:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:46 < agreen> !iporder
12:46 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
12:47 < krzie> agreen, so you are using redirect-gateway?
12:47 < krzie> and you want the vpn traffic to be leaving the server as eth0:0 ip?
12:47 < agreen> krzie: dunno, will go look
12:47 < agreen> krzie: right
12:47 < krzie> as in:
12:47 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
12:47 < krzie> !goal
12:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:47 < krzie> "I would like to access the internet over my vpn"
12:48 < krzie> and "i want it to connect to the internet using eth0:0's ip"
12:48 < agreen> Right as a proxy issuing stuff out to the world only by eth0:0's ip
12:48 < krzie> ok, not openvpn's job
12:48 < krzie> and not a multihome question
12:48 < krzie> !linnat
12:48 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
12:48 < krzie> see #3
12:48 < krzie> err
12:48 < krzie> #2
12:49 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
12:50 < agreen> Um... I think I have confused you away from the real issue.  I have a working OpenVPN server for some time on a remote server, I VPN through it from my laptop
12:50 < agreen> This remote server decrypts my traffic and proxies it out into the world, sending back the results as I want via an encrypted UDP tunnel
12:50 < agreen> All of that is just fine.
12:50 < krzie> right
12:50 < krzie> but it NATs as your eth0 ip
12:51 < krzie> if you wanna NAT as a different ip on your server, change your NAT
12:51 < krzie> thats not openvpn's job
12:51 < agreen> multihome seems to say it will send traffic down the same interface it came in on
12:51 < krzie> you have 2 different ISPs?
12:52 < agreen> for the two different IPs?  No.  For the laptop vs the server, yes
12:52 < krzie> then you are not multi-homed
12:52 < agreen> I see
12:52 < krzie> multi-homed does NOT mean you have 2 ips
12:52 < krzie> it means you have 2 ISPs
12:52 < krzie> and eth0:0 isnt another interface
12:52 < agreen> I failed to understand that then
12:52 < krzie> it is an alias on the eth0 interface
12:52 < agreen> yeah
12:53 < krzie> so i answered your question
12:53 < agreen> ie, "linnat", right?
12:54 < krzie> linnat #2, yes
12:58 < agreen> Thanks krzie, I will go and meddle with it
12:58 < krzie> yw
13:01 < agreen> Super-cool dude, worked fine.  Thanks again.
13:01 -!- agreen [~agreen@warmcat.com] has left #openvpn []
13:03 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
13:08 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
13:23 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
14:08 -!- p3rror [~mezgani@41.140.32.72] has joined #openvpn
14:14 -!- kthakore [~kthakore@li136-101.members.linode.com] has left #openvpn []
14:16 -!- bauruine [~stefan@217.150.230.222] has quit [Ping timeout: 260 seconds]
14:19 -!- bauruine [~stefan@217.150.230.222] has joined #openvpn
14:20 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:32 -!- p3rror [~mezgani@41.140.32.72] has quit [Ping timeout: 240 seconds]
14:47 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 250 seconds]
14:47 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
14:54 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
14:55 -!- p3rror [~mezgani@41.140.44.63] has joined #openvpn
15:00 -!- danlench [~daniell@pool-71-113-224-19.herntx.dsl-w.verizon.net] has joined #openvpn
15:05 -!- myloveisnick [4451e1bf@gateway/web/freenode/ip.68.81.225.191] has joined #openvpn
15:06 < myloveisnick> Hi guys, does anyone know a noob friendly guide to installing openVPN Access server on Centos 5.5
15:06 < myloveisnick> Ive been googling to to end and either get outdated guides, or just fail in general :(
15:07 < Bushmills> !as
15:07 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations
15:07 <@vpnHelper> options supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
15:08 < danlench> hey all, i have openvpn running on 2.0 RC2 JUN12 build. my user has a win7 desktop and win7 laptop (running on a Mac), the desktop works fine using the client export utility but we cant get the laptop to work. the vpn will connect and i see him in the logs and status but he cannot ping the remote subnet
15:08 < danlench> sorry, running on pfsense RC2
15:09 < Bushmills> why should he be able to see the remote subnet?
15:09 < danlench> i think its a windoze issue
15:09 < danlench> to connect to the server
15:10 < danlench> ping works on the desktop
15:10 < Bushmills> what have you configured to allow him to see the remote subnet?
15:10 < Bushmills> openvpn gives you a connection between two machines. 
15:11 < danlench> 192.168.1.0/24
15:11 < Bushmills> if you want anything beyond that, you set up your operating system
15:11 < danlench> its running in pfsense and works great for the desktop
15:12 < danlench> remote <-> pfsense <-> local
15:12 < Bushmills> yes, openvon can give you a great connection between two machines
15:12 < Bushmills> openvpn
15:12 < danlench> mapped drives and printers
15:13 < Bushmills> is your question related to openvpn or to pfsense?
15:14 < danlench> well i feel it is related to openvpn because it does work on one of theusers machines
15:14 < Bushmills> "works" as in "openvpn client connect to openvpn server"?
15:14 < danlench> the pfsense irc just suggested running the openvpn client as admin
15:15 < danlench> i suer it is running as admin in the desktop, not so sure on the laptop
15:15 < danlench> works, yes
15:15 < danlench> works great
15:15 < Bushmills> that's good. no problem, then
15:16 < danlench> works great on one machine, not the other. so yes problem
15:16 < Bushmills> openvpn client can connect on one machine to server, and doesn't on the other machine? 
15:17 < danlench> 10-4
15:17 < Bushmills> check logs. server logs, and client log on the machine which can't connect
15:17 < Bushmills> logs commonly tell you why connection attempt failed
15:18 < danlench> it connects. cannot browse the remote subnet
15:18 < danlench> cannot ping fileserver
15:19 < Bushmills> (22:10:16) Bushmills: what have you configured to allow him to see the remote subnet?
15:19 < danlench> on the laptop
15:19 < Bushmills> you didn't answer that
15:19 < danlench> (3:10:39 PM) danlench: 192.168.1.0/24
15:19 < Bushmills> !route
15:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:19 < Bushmills> !serverlan
15:19 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
15:20 < danlench> file server is 192.168.1.2
15:20 < Bushmills> instructions how to set up your operating system can be found in the documents above
15:21 < danlench> yes, i will read them
15:21 < danlench> so why is one client working and the other using the same config and username not
15:22 < danlench> and the logs clean?
15:22 < Bushmills> can't tell you. after all, after having asked you what you have configured to allow access to that net, i only got "(22:19:27) danlench: (3:10:39 PM) danlench: 192.168.1.0/24" from you, which renders me unable to do any attempt of problem diagnosis
15:23 < danlench> ok
15:23 < danlench> i will check config and try to run client as admin
15:23 < danlench> i will report back what works
15:23 -!- danlench [~daniell@pool-71-113-224-19.herntx.dsl-w.verizon.net] has left #openvpn []
15:28 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: Connection reset by peer]
15:29 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
15:31 -!- HA1DFO [~ha1dfo@catv-89-133-23-1.catv.broadband.hu] has joined #openvpn
15:31 < HA1DFO> hi all. How can I list my crl.pem to a human readable form?
15:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
15:41 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
15:42 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
15:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:55 -!- myloveisnick [4451e1bf@gateway/web/freenode/ip.68.81.225.191] has left #openvpn []
16:05 -!- luneff [~yury@84.51.197.177] has quit [Ping timeout: 252 seconds]
16:07 -!- luneff [~yury@84.51.197.177] has joined #openvpn
16:08 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 246 seconds]
16:10 -!- HA1DFO [~ha1dfo@catv-89-133-23-1.catv.broadband.hu] has quit [Quit: Leaving]
16:17 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
16:21 < majuk> Hey all. I need some assistance getting openvpn on DD-WRT working. I configured it in the GUI, but I don't see any handshake requests on my server. Does someone know where I can look on the router to see what is going on with the client there?
16:21 < majuk> I can't seem to find a log or anything similar. Crazy dd-wrt.
16:28 -!- K1ng` [~KING@180.211.188.218] has left #openvpn ["WOMEN.EXE: A great program, but it doesn't come with documentation.."]
16:28 -!- Chris___ [goose@staff.ext3.net] has joined #openvpn
16:28 -!- K1ng [~KING@180.211.188.218] has joined #openvpn
16:29 < Chris___> I'm having a tough time getting OpenVPN to work on my Windows Laptop. It's being hosted from a Debian server, followed configuration to the letter. I get a successful connect to VPN server message, I appear to be resolving DNS entries, but I get 404 whenever I try and pull up any web pages.
16:30 < Chris___> I checked the windows firewall already, it was initially enabled, I disabled it and restarted the VPN connection, same results.
16:30 < Chris___> But I can ping the server from my laptop once connected.
16:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
16:35 -!- p3rror [~mezgani@41.140.44.63] has quit [Ping timeout: 255 seconds]
16:42 -!- mlin [4451e1bf@gateway/web/freenode/ip.68.81.225.191] has joined #openvpn
16:43 < mlin> Hi guys, while I understand this would be super tedious is there anyone someone would be willing to help a noob like me install openVPN on a ubuntu VPS server?
16:43 < mlin> Ive been trying to use the online guides but have failed everytime..
16:46 -!- nmpribeiro [~nmpribeir@188.250.21.126] has joined #openvpn
16:47 < nmpribeiro> hi. I have a small issue with openvpn, any one has 5 minutes to point me a direction?
16:47 < nmpribeiro> please
16:49 < Pr0z0id> nmpribeiro: just ask your question.
16:49 -!- luckman212_ [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Remote host closed the connection]
16:49 < Pr0z0id> mlin:
16:49 < Pr0z0id> mlin: what do you mean by help?
16:50 < mlin> just teach me the steps
16:50 < Pr0z0id> !howto
16:50 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:50 < Pr0z0id> there you go
16:50 < Pr0z0id> it's all there
16:50 < mlin> I think the problem is that Im a noob at SSH itsself
16:50 < mlin> So it makes it hard to figure out the process of somethings right from the get go
16:50 < mlin> I guess Ill just try to hire someone isntead
16:51 < nmpribeiro> I can't see my clients. I am not able to configure them with a static ip. is there a good and simple how to or tutorial?
16:53 < Pr0z0id> !howto
16:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:53 < Pr0z0id> mlin: openssh was a tough one.. for me too..
16:54 < Pr0z0id> but it's not that hard.. just google openssh ubuntu server
16:54 < Pr0z0id> i think there was a pretty good guide to get you going
16:54 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Quit: Ex-Chat]
16:54 < mlin> ah
16:54 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Remote host closed the connection]
17:00 < Pr0z0id> mlin: any luck?
17:00 < Pr0z0id> you have vnc access to your server right?
17:01 < krzie> nmpribeiro, your question made no sense
17:01 < krzie> "i cant see my clients"
17:01 < krzie> you mean they connect, and you cant ping them?
17:01 < krzie> as far as static ip:
17:02 < krzie> !static
17:02 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
17:02 < nmpribeiro> krzie: ok, ill try to reformulate. I can ping my server from client, but I can't ping clients from servers...
17:02 < krzie> what client ip are you trying to ping...
17:02 < nmpribeiro> 10.8.0.2... my server is 10.8.0.1
17:03 < krzie> you are using dev tap or topology subnet?
17:03 < nmpribeiro> tap I think (ill check)
17:03 < krzie> just post your server config without commentspls
17:03 < krzie>  like this:
17:03 < krzie> !configs
17:03 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:04 < Pr0z0id> krzie you guys have really streamlined this whole process helping ppl..
17:04 < Pr0z0id> the ! commands are perfect.
17:04 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 260 seconds]
17:05 < krzie> ya after repeating myself about 1000 times i decided we needed that bot
17:05 < krzie> heheh
17:05 < nmpribeiro> i must go. Ill return another day. thank you anyway :]
17:05 < Pr0z0id> genius
17:05 -!- nmpribeiro [~nmpribeir@188.250.21.126] has left #openvpn []
17:05 < krzie> heres all of them
17:05 < krzie> !factoids
17:05 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
17:06 < Pr0z0id> !iphone
17:06 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
17:06 <@vpnHelper> iPhone and iPad.
17:07 < Pr0z0id> wow.. didn't know there was a client for iphones too..
17:07 < krzie> yep, came from a very slick hack
17:07 < krzie> tunemu
17:08 < krzie> making openvpn run on ios was easy, but ios has no tun device
17:08 < krzie> http://labs.itemdb.com/html/2010-04-tunemu-tun-device-emulation-for-darwin.html
17:10 < Pr0z0id> crazy...
17:10 < krzie> yep
17:11 < krzie> i was begging for that for a couple yrs
17:11 < Pr0z0id> i setup a pptpd server 
17:11 < Pr0z0id> for iphone users... but i'm disappointed with the file based db for users..
17:11 < krzie> http://dev.kryo.se/iodine/wiki/TipsAndTricks
17:11 < Pr0z0id> everything is in plain text!
17:11 <@vpnHelper> Title: TipsAndTricks – iodine (at dev.kryo.se)
17:11 < krzie> if you look at my script linked to in that page, it used to beg for iphone tun
17:11 < krzie> now it thanks the author of tunemu =]
17:12 < krzie> ## Please someone get tuntap working on the iphone!
17:12 < krzie> ## UPDATE! Thank you Friedrich Schoeller for your creative solution 
17:12 < krzie> ## for iphone-tun with tunemu
17:13 < Pr0z0id> lol
17:14 < Chris___> I'm SSH'ed to my server through my VPN (ssh 10.8.0.1), so I'm using irssi to talk to y'all, but I can't get any traffic from my laptop to pass through my VPN to the outside world. It all seems to die, once it gets to the server...
17:14 < krzie> !redirect
17:14 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:15 < krzie> you likely forgot to ipforward or nat (or both)
17:15 < Chris___> I'll check, thanks krzie 
17:15 < krzie> np
17:15 < Pr0z0id> i don't know how you do it..
17:16 < Pr0z0id> it's the same questions over and over and over and over again
17:16 < krzie> lol yes it is
17:16 < krzie> ill make a writeup for !redirect like i did for !route at some point
17:16 < Chris___> !ipforward
17:16 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
17:16 < Pr0z0id> is eurephia ever goign to be part of the main openvpn distribution?
17:17 < Chris___> !winipforward
17:17 < krzie> i have the skeleton for a flowchart here at my desk
17:17 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
17:17 < krzie> Pr0z0id, no idea
17:17 < Chris___> !nat
17:17 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:17 < krzie> Chris___, your server is windows?
17:17 < Pr0z0id> seems like it's getting awfully close to Access Server
17:17 < Chris___> krzie: one of my clients is windows
17:17 < Pr0z0id> -minus the ease of use.
17:17 < Chris___> the one I'm on right now, trying to get to work
17:17 < krzie> Chris___, so?
17:17 < krzie> !redirect
17:17 < Chris___> the server is debian squeeze
17:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:18 < krzie> is says enabled on the server
17:18 < krzie> not on every single client
17:18 < krzie> your SERVER needs ip forwarding and nat
17:18 < Pr0z0id> Chris___ you should use !linipforward
17:18 < krzie> your clients do not
17:18 < krzie> knowing what ip forwarding is/does would make that obvious =/
17:18 < Chris___> ah. thanks.
17:19 < Chris___> !linipforward
17:19 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
17:19 < krzie> ip forwarding allows packets to travel from one interface to another
17:19 < Chris___> ah, yes, I did have that turned on. the Linode guide I followed told me to do that.
17:19 < krzie> for example, in via tun0 and out via eth0
17:19 < Chris___> !linnat
17:19 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
17:20 < Chris___> yeah, the Linode guide I followed told me to do that too
17:21 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
17:21 < Chris___> any ideas where to hunt for the problem next?
17:22 < Pr0z0id> i would clean out all your  iptables
17:22 < Pr0z0id> start fressh
17:22 < Pr0z0id> then test.
17:22 < Chris___> well, it works, with my Linux desktop
17:22 < Chris___> which leads me to think it's not the server
17:22 < Chris___> possibly a windows specific setting?
17:24 < Chris___> what's a good verbosity to try and find the hiccup with?
17:25 < Chris___> I tried 9 and spent 2 or 3 minutes just waiting for the handshake
17:25 < Pr0z0id> i use 7
17:25 < Chris___> ok, I'll set it to 7 then and try again..
17:25 < Pr0z0id> that should have generated a log
17:25 < Pr0z0id> entry.
17:26 < Pr0z0id> 2 mins is way more than enough... 
17:26 < Chris___> Connecting has failed. Let's see why...
17:27 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 260 seconds]
17:27 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
17:27 < Chris___> what should I put for 'dev-node'? 'TAP-Win32 Provider V9'?
17:28 < Chris___> I tried uncommenting that and filling it in, and it failed to connect.
17:30 -!- p3rror [~mezgani@41.140.178.204] has joined #openvpn
17:32 < krzie> verb 7 or 9 are both too high
17:33 < krzie> 5 is the highest ild use
17:33 < Chris___> naming 'dev-node' didn't fix it for me, still having the same issue. successful connection, just can't get the VPN outside of my server.
17:33 < krzie> post client log at verb 5
17:34 < Chris___> ok, moment, let me reconnect at v5
17:34 < krzie> (pastebin or something similar pls)
17:35 < krzie> the fact that it works for the linux client was very important
17:35 < Chris___> heh.. didn't think about how I was gonna pastebin this
17:35 < krzie> pastebinit
17:35 < krzie> apt-get install pastebinit
17:35 < Chris___> can I d/c now that I have the log? or do I need to stay connected?
17:36 < krzie> can disconnect if you like
17:36 < krzie> oh right its a windows client, n/m re pastebinit
17:37 < Chris___> I suppose I could have from the SSH window
17:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:37 < Chris___> but I'm d/c'ed now anywyas
17:37 < Chris___> http://pastebin.com/LmcL3eHi
17:37 < krzie> verb 4 is generally good for troubleshooting, verb 5 helps find firewall issues
17:37 < krzie> (fyi)
17:38 < Chris___> thanks :)
17:40 < krzie> lemme see the configs
17:41 < krzie> !configs
17:41 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:41 < krzie> and what version windows is it?
17:41 < krzie> im guessing windows 7
17:41 < Chris___> 7, 64 bit
17:41 -!- mlin [4451e1bf@gateway/web/freenode/ip.68.81.225.191] has quit [Quit: Page closed]
17:41 < Chris___> the server is squeeze, 64 bit
17:41 < Chris___> do you want both configs?
17:41 < krzie> well first
17:41 < krzie> lets test my guess
17:41 < krzie> connect again
17:41 < Chris___> ok, sec
17:41 < krzie> try to ping 8.8.8.8 after connecting
17:41 < Chris___> err, wait
17:42 < Chris___> pertinet information: My Linux desktop now seems to be having the same issue.
17:42 < krzie> then you broke something... did you change your firewall while testing?
17:43 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: No route to host]
17:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Remote host closed the connection]
17:43 < krzie> (ie: nat rules)
17:43 < Chris___> Perhaps I just thought I was connected to the VPN when I tested it earlier, and wasn't, or some idiocy like that..
17:43 < Chris___> Nope, haven't done a thing except turn off the windows firewall
17:43 < krzie> gah ok lets back up then
17:43 < krzie> connect with linux machine
17:43 < krzie> ping 10.8.0.1 from client
17:44 < krzie> ping 10.8.0.6 from server
17:44 < krzie> tell me when this is done, and if each worked
17:44 < Chris___> alright, just a sec.
17:44 < krzie> (this is assuming the client gets .6)
17:44 < Chris___> the desktop gets .14, they ping each other just fine.
17:45 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
17:45 < krzie> ok
17:45 < Chris___> laptop gets .6, which also ping each other just fine
17:45 < krzie> now from client, ping 8.8.8.8
17:45 < Chris___> ok
17:45 < krzie> works?
17:45 < Chris___> No reply
17:45 < Chris___> 100% packet loss
17:45 < krzie> on server
17:45 < krzie> cat /proc/sys/net/ipv4/ip_forward
17:45 < krzie> response?
17:46 < Chris___> but I echo'ed that to 1 when I first set this up..
17:46 < Chris___> it's 0
17:46 < krzie> you rebooted
17:46 < krzie> now its disabled
17:46 < krzie> !linnat
17:46 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
17:46 < krzie> errr no
17:46 < Chris___> I haven't; I also edited my systcl to enable it on reboots
17:46 < krzie> !linipforward
17:46 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
17:46 < krzie> well whatever, it IS disabled
17:46 < Chris___> let's fix that, yeah
17:46 < Chris___> ok
17:46 < Chris___> sec
17:47 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
17:47 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
17:47 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:48 < Chris___> oh, I'm an idiot, I wasn't SSH'ed when I said it was 0. It *is* 1 on the server.
17:48 < krzie> then ping the ip again
17:48 < Chris___> It was 0 on my PC.
17:48 < krzie> lol
17:48 < krzie> you are going to need to pay more attention to detail please
17:48 < Chris___> Yeah, sorry, too many tabs open on terminal. I'm with you now.
17:48 < krzie> iptabled -L -t nat
17:48 < Chris___> on the server?
17:49 < krzie> yes
17:49 < krzie> 1 - 3 lines just paste here
17:49 < krzie> more, use pastebin
17:49 < Chris___> yeah, let me go ahead and get pastebinit
17:52 < Chris___> ok, http://pastebin.com/RbAWdchS
17:53 <@vpnHelper> RSS Update - forum: OpenVPN - bugging the internet, especially google <http://forums.openvpn.net/topic8304.html>
17:54 < Chris___> do you still want to see configs?
17:54 < krzie> yep
17:54 < Chris___> srever, client(s)?
17:55 < krzie> server, linux client, windows client
17:55 < krzie> (windows 7 client)
17:55 < krzie> usually just want one, but i see you're pushing dns
17:55 < krzie> theres something special for widnows 7 with that, and with unix
17:56 < Chris___> ok, server: http://pastebin.com/VCXraaD6
17:56 < krzie> (i pretend linux is a unix in that context)
17:56 < Chris___> getting you the other two
17:56 < krzie> read again
17:56 < krzie> !configs
17:56 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:56 < Chris___> BAH
17:56 < krzie> i wont dig through the comments
17:56 < Chris___> I was just remembering that
17:56 < Chris___> sorry, keeping up, grpping comments out
17:57 < Chris___> http://pastebin.com/infT2BDa <--server
17:59 < krzie> btw, what do you think ipp.txt does?
17:59 < Chris___> tells you what IP is assigned to what client?
18:00 < krzie> kinda
18:00 < krzie> !ipp
18:00 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
18:00 < Chris___> ah
18:00 < krzie> --status might be what you were looking for
18:00 < krzie> !man
18:00 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
18:00 < krzie> !--
18:00 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
18:00 < Chris___> windows client - http://pastebin.com/enr20vPC
18:01 < krzie> just as i was thinking
18:01 < krzie> !pushdns
18:01 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
18:01 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
18:01 < krzie> see #5
18:01 < Chris___> Linux I don't have a config for, I just used the GUI interface on the network-applet
18:02 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
18:02 < pyther> Hello
18:02 < krzie> basically, just add register-dns to the client config
18:02 < krzie> (windows 7 client)
18:02 < Chris___> ok, adding
18:03 < krzie> and if you are using network manager for the libux client, we will test with the windows client
18:03 < krzie> i dont want netman fubaring us up
18:03 < krzie> !netman
18:03 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
18:03 < krzie> !ubuntu
18:03 <@vpnHelper> "ubuntu" is dont use network manager!
18:03 < pyther> some of my traffic from the VPN is really fast (1.6MB) (like a scp transfer), but other traffic such as rdp or a http download is really slow (5KB)
18:03 < pyther> what might cause this?
18:03 < krzie> pyther, *might* is the strong word there... could be mtu issues
18:03 < krzie> !mtu
18:03 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
18:04 < Chris___> just drop it anywhere in the client config?
18:04 < krzie> could be that you are using tcp are your transport protocol and should change to udp
18:04 < krzie> Chris___, yep
18:04 < Chris___> ok, added, connecting...
18:06 < Chris___> well, it connected successfully
18:06 < Chris___> I can pull up whatismyip.com -- but it shows my home IP address, not the IP of the server
18:07 < pyther> krzie: hmm I'll look into the mtu, I  am using udp though
18:07 < krzie> Chris___, well thats interesting... logs of both sides with verb 5
18:08 < krzie> assuming you verified you are connected to the vpn this time
18:08 < Chris___> ok, got them for the windows side already, pasting
18:09 < Chris___> krzie: http://pastebin.com/8LCBH628
18:10 < pyther> Hmm why isn't my connection to the vpn server showing in netstat?
18:10 < Chris___> as for the log from the server's side... do you want me to put verb 5 in it, restart the daemon, and reconnect again? or was the windows log enough?
18:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:12 < Chris___> I'll go ahead and assume that's what you want and do it real quick
18:12 < krzie> that was enough
18:12 < Chris___> ah, ok
18:13 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 276 seconds]
18:14 < krzie> client is using 2.2.0?
18:14 < krzie> oh its using 2.1.4
18:14 < krzie> go update, see if it helps anything
18:15 < krzie> !download
18:15 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
18:15 < krzie> just the windows side
18:15 < Chris___> ok
18:16 < krzie> http://openvpn.net/archive/openvpn-users/2006-05/msg00271.html
18:16 <@vpnHelper> Title: Re: [Openvpn-users] TAP-WIN32 Adapter is getting a bogus address (at openvpn.net)
18:16 < krzie> see if that applies to you
18:17 < Chris___> When I right click and click about, it says v 1.0.3?
18:17 < krzie> thats the gui
18:17 < krzie> you are using 2.1.4
18:18 < krzie> Mon Jun 13 19:04:32 2011 us=156000 OpenVPN 2.1.4 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Nov  8 2010
18:18 < Chris___> ah, ok
18:18 < Chris___> connecting with 2.2.0o
18:18 < krzie> make sure you let it update your tap interface too
18:18 < krzie> since 2.2.0 comes with a new one
18:18 < pyther> Mon Jun 13 19:17:46 2011 NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1541]
18:18 < pyther> Does that mean my mtu is alright?
18:18 < krzie> pyther, then i dunno what the problem is
18:19 < krzie> yes
18:19 < krzie> you can check if adding fragment 1400 helps
18:19 < krzie> im not sure why it would... if mtu is right which it is i think you shouldnt change those... but ive seen jjk say it and i defer to his expertise
18:20 < Chris___> still showing my home IP rather than the server's despite the update
18:20 < pyther> hmm why can't I find the vpn connection in netstat?
18:20 < krzie> Chris___, try this:
18:20 < krzie> !winroute
18:20 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
18:20 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
18:20 < krzie> #1
18:20 < krzie> route-method exe      in the client config
18:21 < krzie> Chris___, im not worried about whatismyip.com im worried about this error:
18:21 < krzie> Mon Jun 13 19:05:33 2011 us=121000 Warning: route gateway is not reachable on any active network adapters: 10.8.0.5
18:21 < krzie> your home ip is showing because your routes are not being added
18:21 < Chris___> ah
18:21 < Chris___> I see
18:22 < Chris___> added that line
18:22 < Chris___> reconnected
18:22 < Chris___> can't connect to pastebin
18:23 < krzie> thats a good thing i think
18:23 < krzie> disconnect, pastebin the new log
18:23 < pyther> krzie: that makes things unusable :(
18:23 < krzie> pyther, ok... i tried
18:23 < Chris___> http://pastebin.com/aBF5x98h
18:24 < krzie> pyther, maybe try the mail list
18:24 < krzie> !mail
18:24 <@vpnHelper> "mail" is (#1) http://sourceforge.net/mail/?group_id=48978, or (#2) http://news.gmane.org/gmane.network.openvpn.user for the openvpn-users archive
18:24 < pyther> hmm thanks
18:24 < krzie> Mon Jun 13 19:21:05 2011 C:\WINDOWS\system32\net.exe stop dnscache
18:24 < krzie> The DNS Client service is stopping.
18:24 < krzie> The DNS Client service could not be stopped.
18:24 < krzie> interesting
18:25 < Chris___> I'll check that link out when I get back home, but I've exhausted all my time for now. thanks for working so vigerously with me, krzie. I won't touch anything and try again later.
18:25 < Chris___> I really appreciate it
18:25 < krzie> no that link wasnt for you
18:25 < krzie> the mail link was for pyther 
18:25 < Chris___> no, the earlier one, that you said "See if that applies to me"
18:25 < krzie> oh no it doesnt
18:25 < krzie> you fixed the previous error
18:25 < krzie> with route-method exe
18:26 < Chris___> ah, alright. well I'll be back soon enough. thanks again mate.
18:26 < krzie> real quick
18:26 < Chris___> hm?
18:26 < krzie> reconnect, tell me if it can ping 8.8.8.8
18:26 < Chris___> ok, sec
18:27 < Chris___> I can, krzie 
18:27 < krzie> ok so the remaining issue is DNS related
18:27 < Chris___> alright. thanks, be back later.
18:27 < krzie> np, later
18:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:34 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
18:52 < pyther> krzie: I got it working it
18:53 < krzie> what did ya do??
18:53 < pyther> seems as if there is some type of bug with the vmxnet3 network module, so I just switched to the e1000 module, the vpn box is a virtual machine on vmware esxi
18:54 -!- Kateon [482392@xs8.xs4all.nl] has quit [Ping timeout: 240 seconds]
18:55 < pyther> something about disabling LRO http://nwsmith.blogspot.com/2010/07/patching-vmxnet-to-disable-lro.html
18:55 <@vpnHelper> Title: Nigel Smith's Blog: Patching vmxnet to disable LRO (at nwsmith.blogspot.com)
18:57 < krzie> thanx
18:57 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
18:58 < krzie> !learn slowesxi as pyther> seems as if there is some type of bug with the vmxnet3 network module, so I just switched to the e1000 module, the vpn box is a virtual machine on vmware esxi. http://nwsmith.blogspot.com/2010/07/patching-vmxnet-to-disable-lro.html  <pyther> something about disabling LRO
18:58 <@vpnHelper> Joo got it.
18:58 < krzie> maybe that'll help someone some day ;]
19:12 < pyther> hopefully :)
19:19  * ecrist only uses the e1000 module anyways
19:19 < ecrist> good to know, though
19:21 < krzie> ive never used esxi
19:25 < ecrist> it's pretty sweet
19:25 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
19:25 < pyther> ecrist: they guys in vmware say that the vmxnet3 one gives better performance
19:26 < pyther> but it isn't like my vpn box is going to be getting slammed :P
19:26 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:26 < ecrist> we only use ESXi in our testing/dev environment
19:26 -!- Cain` is now known as Cain
19:26 < pyther> ahh we are gonna use it in production
19:27 < pyther> we got 800 users but probably only 100 users that actually do thing besides store files and login (school)
19:28 < ecrist> we have 11 staff members and ~800 users
19:34 < pyther> ecrist: what type of place do you work in/at?
19:38 < ecrist> I work for a medical claim clearinghouse
19:39 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
19:50 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
19:55 <@vpnHelper> RSS Update - forum: OpenVPN account just keeps looping <http://forums.openvpn.net/topic8305.html>
20:01 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
20:02 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
20:10 -!- master_of_master [~master_of@p57B55901.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:15 -!- master_of_master [~master_of@p57B55842.dip.t-dialin.net] has joined #openvpn
20:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 260 seconds]
21:16 -!- Chris___ [goose@staff.ext3.net] has quit [Quit: Reconnecting]
21:16 -!- Chris___ [goose@staff.ext3.net] has joined #openvpn
21:44 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:19 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 260 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 244 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:59 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
23:02 -!- p33p33 [~root@c-98-231-135-73.hsd1.md.comcast.net] has joined #openvpn
23:03 < p33p33> openvpn server fails to start
23:03 -!- p33p33 [~root@c-98-231-135-73.hsd1.md.comcast.net] has left #openvpn ["python"]
23:03 -!- luckman212_ [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
23:03 -!- p33p33 [~root@c-98-231-135-73.hsd1.md.comcast.net] has joined #openvpn
23:04 < p33p33> openvpn server fails to start any sugestions
23:06 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Ping timeout: 260 seconds]
23:08 < p33p33> ?
23:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:13 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
23:18 < p33p33> findbot.pl
23:18 < p33p33> ./findbot.pl
23:18 < p33p33> clear
23:19 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:21 -!- p33p33 [~root@c-98-231-135-73.hsd1.md.comcast.net] has quit [Quit: leaving]
--- Day changed Tue Jun 14 2011
00:10 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
00:19 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
00:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
00:35 -!- hindukusch [~Beta@xdsl-89-0-32-16.netcologne.de] has joined #openvpn
00:35 < hindukusch> hi, are there any OpenVPN Windows Clients, that fix the "DNS leak" out of the box?
00:36 < hindukusch> the official OpenVPN Client is leaking dns requests...
00:36 < hindukusch> <-- Windows XP SP2
00:36 < hindukusch> the only solution I found so far is: http://www.dnsleaktest.com/how-to-fix-a-dns-leak.php
00:36 <@vpnHelper> Title: How to fix a DNS leak (at www.dnsleaktest.com)
00:37 < hindukusch> any other solutions?
00:50 <@vpnHelper> RSS Update - forum: Two Tunnels from one Dynamic IP <http://forums.openvpn.net/topic8306.html>
01:10 -!- ph1l [~ph1l@gprs29.swisscom-mobile.ch] has joined #openvpn
01:14 -!- sonto_lau [~cooker@118.112.36.107] has joined #openvpn
01:16 -!- ph1l [~ph1l@gprs29.swisscom-mobile.ch] has left #openvpn []
01:20 -!- EugeneKay is now known as EugeneKaway
01:20 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12957> || problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p12956>
01:23 < sonto_lau> hello guys,I have two network cards P1 and P2 in a computer,the details as follows:
01:23 < sonto_lau>          P1:    ip address: 192.168.1.250/24
01:23 < sonto_lau>                gateway: 192.168.1.1
01:23 < sonto_lau>          P2:    ip address: 192.168.9.250/24
01:23 < sonto_lau>                gateway: 192.168.9.1
01:23 < sonto_lau> now i want to ping P1 via P2,how to configure route?thanks
01:26 -!- EugeneKaway is now known as EugeneKay
01:26 < krzee> 2 cards in the same computer?
01:26 < krzee> you dont configure a route, you turn on ip forwarding... how is this openvpn related?
01:27 < krzee> man ping for how to set source address
01:28 -!- bauruine [~stefan@217.150.230.222] has quit [Remote host closed the connection]
01:30 < sonto_lau> yes
01:32 < sonto_lau> I turned on ip forwarding! 
01:32 < sonto_lau> # ping 192.168.1.250 -I 192.168.9.250
01:32 < krzee> this has nothing to do with openvpn, bbl
01:37 -!- sonto_lau [~cooker@118.112.36.107] has left #openvpn []
01:39 <@vpnHelper> RSS Update - forum: problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p12958>
01:53 < hindukusch> narf
01:53 < hindukusch> http://www.dnsleaktest.com/how-to-fix-a-dns-leak.php does not work
01:53 <@vpnHelper> Title: How to fix a DNS leak (at www.dnsleaktest.com)
02:03 -!- luckman212_ [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Read error: Connection reset by peer]
02:04 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:04 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
02:25 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Read error: Connection reset by peer]
02:27 -!- luckman212 [~irc@pool-74-108-1-53.nycmny.fios.verizon.net] has joined #openvpn
02:38 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
02:48 < defswork> doesnt register-dns sort out dns ?
02:48 < defswork> how is it the client's fault ?  surely it just uses resolver ?
02:50 < Bushmills> is your openvpn server pushing nameservers to windows clients?
02:50 <@vpnHelper> RSS Update - forum: OpenVPN account just keeps looping <http://forums.openvpn.net/topic8305.html#p12960> || Dual Ethernet Bridge, spanning tree issue. <http://forums.openvpn.net/topic8303.html#p12959>
02:51 -!- yell0 [yello@unaffiliated/contempt] has quit [Remote host closed the connection]
02:52 -!- EugeneKay is now known as EugeneKaway
02:55 < amero> could someone explain me a bit what does 'server' mode do
02:55 <@vpnHelper> RSS Update - forum: Two Tunnels from one Dynamic IP <http://forums.openvpn.net/topic8306.html#p12962> || [SOLVED] problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p12961>
02:57 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
02:59 < Bushmills> amero: there's a man page, which has this to say about --mode server:  http://scarydevilmonastery.net/snap/1308038296953541898d.png 
03:01 <@vpnHelper> RSS Update - forum: OpenVPN - bugging the internet, especially google <http://forums.openvpn.net/topic8304.html#p12963>
03:03 < defswork> Bushmills, sorry - I was questioning hindukusch's query "hi, are there any OpenVPN Windows Clients, that fix the "DNS leak" out of the box?
03:03 < defswork>  the official OpenVPN Client is leaking dns requests..."
03:03 < defswork> on my windows clients the list of dns servers is correct after connecting ok - doesn't show anything other than the ones I pushed
03:03 < amero> so basically it listens for incoming connections on a single port and route them through a single tun/tap iface. isnt this what p2p mode has been doing?
03:04 < Bushmills> amero: not for multiple clients
03:07 <@vpnHelper> RSS Update - forum: Max simultaneous client connections <http://forums.openvpn.net/topic7188.html#p12964>
03:07 < Bushmills> amero: you may be thinking of --topology p2p?
03:13 <@vpnHelper> RSS Update - forum: [SOLVED] IPTABLES Error when attempting to add a forward <http://forums.openvpn.net/topic8301.html#p12939>
03:14 < krzee> !pushdns
03:14 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
03:14 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
03:15 < krzee> !dns
03:15 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
03:15 < krzee> there you go defswork 
03:16 < krzee> amero, ptp mode can do a single connection (a peer)
03:16 < krzee> server mode handles multiple peers, aka clients
03:16 -!- Hamlin [~Hamlin@mountainmorningband.com] has quit [Ping timeout: 255 seconds]
03:19 < amero> wait. you're saying that p2p mode could only handle one client at a time?
03:20 < krzee> right, peer to peer
03:20 < krzee> not peer to peers
03:20 < dazol>        --mode m
03:20 < dazol>               Set OpenVPN major mode.  By default,  OpenVPN  runs  in
03:20 < dazol>               point-to-point  mode ("p2p").  OpenVPN 2.0 introduces a
03:20 < dazol>               new mode ("server")  which  implements  a  multi-client
03:20 < dazol>               server capability.
03:20 < dazol> that's what the man page says ...
03:20 < krzee> or point to point, not point to points
03:21 < krzee> amero, really, check out the man page!
03:21 < amero> i did but it wasnt clear enough for me
03:21 < amero> so i came here
03:22 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Remote host closed the connection]
03:22 -!- Hamlin [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has joined #openvpn
03:26 < krzee> hindukusch, !pushdns and !dns
03:27 < krzee> your ns will go over whatever route your system has for it, change your NS
03:29 < krzee> you dont need that link
03:34 < Bushmills> a recursive name server on vpn server and ip address of vpn server into resolv.conf is a popular solution
03:34 < Bushmills> at least when your openvpn connection stays up - which it should if dns leaks are to be worries about
03:35 < Bushmills> allow others to recurse using the same server, and you're also anonymizing your queries towards the authoritative name servers
03:36 < Bushmills> (or would you like to let google know what hosts your're system ask for resolving?)
03:37 < Bushmills> your system
03:37 -!- EugeneKaway is now known as EugeneKay
04:01 -!- dazol is now known as dazo
04:01 -!- dazo [~dazo@nat/redhat/x-kwrucmnffztdcgul] has quit [Changing host]
04:01 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:06 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["WeeChat 0.3.5"]
04:10 < hindukusch> !pushdns
04:10 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
04:10 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
04:12 < hindukusch> !dns
04:12 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
04:25 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
04:27 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:27 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:27 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:29 <@vpnHelper> RSS Update - forum: OpenVPN - bugging the internet, especially google <http://forums.openvpn.net/topic8304.html#p12965>
04:30 < hindukusch> gnah. There is no error in the server configuration. The Client recieves the push "dhcp-option DNS 10.8.0.1".
04:30 < hindukusch> Windows simply leaks the dns requests.
04:30 < hindukusch> The Tool on http://www.dnsleaktest.com/how-to-fix-a-dns-leak.php throws 2 error message boxes when I try to connect to a OpenVPN server.
04:30 < hindukusch> I just bought Viscosity for 9$ and now it works :)
04:30 < hindukusch> Closed-source, but at least it works.
04:30 <@vpnHelper> Title: How to fix a DNS leak (at www.dnsleaktest.com)
04:31 < hindukusch> and no ugly black command shell windows on connect :)
04:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:41 <@vpnHelper> RSS Update - forum: OpenVPN - bugging the internet, especially google <http://forums.openvpn.net/topic8304.html#p12966>
04:42 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:50 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
04:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:52 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
04:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:57 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
04:57 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
05:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:24 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Quit: Leaving]
05:34 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 244 seconds]
05:35 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:35 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:35 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:56 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:07 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
06:22 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
06:22 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
06:22 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
06:55 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:14 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
07:22 <@vpnHelper> RSS Update - forum: Can a hosted PHP script browse thru a VPN? <http://forums.openvpn.net/topic8287.html#p12967>
07:37 -!- maxJadi [~maxJadi@81-232-115-137-no17.business.telia.com] has joined #openvpn
07:37 -!- maxJadi [~maxJadi@81-232-115-137-no17.business.telia.com] has quit [Changing host]
07:37 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
07:40 -!- ph1l [~ph1l@gprs29.swisscom-mobile.ch] has joined #openvpn
07:47 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 250 seconds]
07:50 -!- corretico [~luis@201.201.44.82] has joined #openvpn
07:58 -!- ph1l [~ph1l@gprs29.swisscom-mobile.ch] has quit [Quit: Leaving.]
08:01 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:12 -!- gyyrog [~gyyrog@71-13-67-85.static.aldl.mi.charter.com] has joined #openvpn
08:35 -!- [intra]lanman [~lanman@12.200.95.61] has joined #openvpn
08:35 -!- [intra]lanman [~lanman@12.200.95.61] has quit [Changing host]
08:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:41 -!- p33p33 [~root@184.236.80.216] has joined #openvpn
08:41 < p33p33> hllo
08:41 < p33p33> hello need help with server not starting after install
08:42 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
08:48 < p33p33> !welcome
08:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:48 < p33p33> !goal
08:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:52 -!- gyyrog [~gyyrog@71-13-67-85.static.aldl.mi.charter.com] has quit [Read error: Connection reset by peer]
08:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 250 seconds]
09:02 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 276 seconds]
09:02 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
09:05 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:05 -!- p33p33 [~root@184.236.80.216] has quit [Ping timeout: 250 seconds]
09:10 <@vpnHelper> RSS Update - forum: OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12968>
09:11 -!- p33p33 [~root@184.236.80.216] has joined #openvpn
09:11 < p33p33> !welcome
09:11 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:11 < p33p33> !goal
09:11 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:12 < p33p33> !goal I would like to fix my openvpn server install it fails everytime when starting
09:15 < p33p33> !goal my openvpn server fails to start.
09:15 < p33p33> !howto
09:15 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:16 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
09:17 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
09:18 < ecrist> p33p33: don't PM people
09:18 < p33p33> !goal I would like to acces the lan behind the server and borws the internet through the server and setup a routed vpn service
09:22 < p33p33> !logs
09:22 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:22 < kisom> !goal
09:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:23 < kisom> !goal access facebook at work
09:23 < kisom> :-)
09:25 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
09:26 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has joined #openvpn
09:28 < stevieman> Hey All, I've had openVPN running great for the last month with no problems. I tried to connect today and I am unable to connect. I was able to connect about a week ago with no problems. It appears to be a problem on the server side as other people are unable to connect to the server and I am able to connect to a 2nd openvpn server on a different machine
09:29 < dkr> check server logs?
09:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:29 < stevieman> Where can I find the error logs on the server? The client logs are not giving me too many clues, just "Tue Jun 14 10:29:06 2011 us=149000 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
09:29 < stevieman> Tue Jun 14 10:29:06 2011 us=149000 TLS Error: TLS handshake failed"
09:30 -!- waiguoren [~itai@75.125.151.194] has joined #openvpn
09:30 < waiguoren> !welcome
09:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:31 < dkr> syslog if you didn't configured it to log elsewhere
09:31 < waiguoren> hi there, can anyone tell me where are the config files for openvpn client on ubuntu? 
09:31 < dkr> stevieman: also do some basic network troubleshooting, make sure you can connect to the server port, etc.
09:32 < ecrist> stevieman: your openvpn configuration isn't going to magically change.
09:33 < ecrist> you, or someone, did something to break it
09:33 < ecrist> I would start there.
09:33 < waiguoren> my client keeps disconnecting after 60 minutes, i understand that i need to add this line in the config file "reneg-sec <N>" , but cant locate the config file...
09:33 < ecrist> waiguoren: no clue.  there is no such thing as a 'default' location in terms of openvpn
09:34 -!- p33p33 [~root@184.236.80.216] has quit [Ping timeout: 250 seconds]
09:34 < ecrist> waiguoren: 'ps auxwwww | grep vpn'  while openvpn is running might lend some clues
09:34 < stevieman> ecrist: Well I'm the only one that touches the server, No updates have been done to the server and it worked last weekend. So I know that's not it. I'm betting on the clients having something changed but I was hoping the error logs would give me more clues than the client logs
09:35 -!- p33p33 [~root@184.236.80.216] has joined #openvpn
09:36 -!- p33p33 [~root@184.236.80.216] has quit [Client Quit]
09:36 < waiguoren> ecrist, thanks, but the output didnt help, i suspected it should be in /etc/openvpn but nothing these
09:36 < waiguoren> there
09:36 < stevieman> Is this part of openvpn? It shows up right after the Openvpn entries in syslog. "modem-manager: (net/tun0): could not get port's parent device"
09:36 -!- p33p33 [~root@184.236.80.216] has joined #openvpn
09:38 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
09:38 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
09:38 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
09:38 < waiguoren> is it possible that there is no config file at all and i need to create it ?
09:38 < ecrist> stevieman: it seems to be related to openvpn, yes
09:39 < ecrist> waiguoren: ask the ubuntu folks, I have no clue where their package maintainer put things
09:39 < stevieman> ecrist: That is what I thought, any idea on what it does? Also I cannot telnet to port 1194 on my machine.
09:39 < ecrist> waiguoren: it's possible, a config file is just command line options
09:41 < diytto> !goal I would like to access the internet over my vpn
09:41 < janjust> waiguoren:  if you're using NetworkManager then the config files are stored inside NetworkManager
09:41 < hyper_ch> waiguoren: what's the problem?
09:42 < waiguoren> ecrist, ok, thanks ,last question, can you take a quick look here : http://pastebin.com/scMtRGAw and tell me if this is a config file
09:42 < waiguoren> hyper_ch, the client keeps disconnecting after 60 minutes
09:42 < janjust> waiguoren:  yes it is
09:42 < hyper_ch> waiguoren: ubuntu stores the client config also in /etc/openvpn  -  
09:42 < janjust> a disconnect after 60 min has nothing to do with 'reneg-sec' 
09:43 < hyper_ch> I have setup my system to connect through it directly without the need of the network manager... or ratehr I do not configure the openvpn connection with the knetworkmanager
09:43 < ecrist> waiguoren: yes, that's a config file
09:43 < janjust> check the client and server logs after the 60 mins to see why it wants to reconnect or why it fails
09:43 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
09:43 < ecrist> !ubuntu
09:43 <@vpnHelper> "ubuntu" is dont use network manager!
09:43  * janjust remembers why he dislikes irc so much ;)
09:43 < ecrist> heh
09:43 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
09:43 < hyper_ch> ecrist: the kde network manager is not bad... for ethernet, wifi and 3g.... but I don't use it for openvpn
09:44 < waiguoren> janjust, well it says something about TLS soft reset, i googled this solution from the open vpn forum : https://forums.openvpn.net/topic8200.html
09:44 <@vpnHelper> Title: OpenVPN Support Forum "TLS soft reset" issue : Off Topic, Related (at forums.openvpn.net)
09:44 < hyper_ch> !configs
09:44 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
09:44 < ecrist> hyper_ch: the network manager sucks
09:44 < hyper_ch> ecrist: you just can't handle it
09:44 < ecrist> it's great for idiots, poor for people who actually try to get something done
09:45 < hyper_ch> ecrist: why?
09:45 < hyper_ch> waiguoren: that's my /etc/openvpn/client.conf    http://pastebin.com/pFy68btG
09:46 < ecrist> hyper_ch: it refuses to properly handle multiple DNS search domains, it overwrites changes made to resolv.conf
09:46 < janjust> waiguoren:  and what does the server log show?
09:46 < Kendall> hi...I have two OpenVPN hosts, A and B; B connects as a client to A.  Both have LANs behind them that should be visible over the VPN...On A, I have two POSTROUTING MASQUERADE iptables rules to route traffic between the LANs:  do these same rules need to be on host B?
09:46 < hyper_ch> ecrist: only if you don't properly configure it
09:47 < ecrist> network manager sucks.  that is all
09:47 < hyper_ch> ecrist: you're just too much of a geek to use it
09:47 < waiguoren> hyper_ch, i just realized that my provider gave my config files except it named them differently something.ovpn so i didnt realize. what do you think about the reneg-sec <N> argument, will it help me solve the disconnect problem ?
09:47  * quadDamage agrees with ecrist 
09:48 < hyper_ch> waiguoren: something.ovpn is for windows IIRC... just rename to client.conf
09:49 < hyper_ch> waiguoren: I don't know, about the reneg-sec... I just run my own vpn server - I have no clue what your vpn provider does
09:49 < ecrist> unix doesn't care about file extensions.
09:49 < ecrist> .ovpn works fine
09:49 < waiguoren> hyper_ch, so i think the problem is on my provider side?
09:49 < hyper_ch> ecrist: by default?
09:49 < hyper_ch> waiguoren: I have no clue, listen to ecrist, he knows what he talks about - except if its related to network manager
09:50 < quadDamage> heh
09:50 < ecrist> yes
09:50 < waiguoren> ecrist, my client disconnecting with a TLS soft reset every 60 minutes is cause of my provider and not due to openvpn settings?
09:51 < ecrist> I'd need to see the logs
09:51 < ecrist> !logs
09:51 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:51 < hyper_ch> waiguoren: it could be intention by your isp... having the same vpn connection for days or months would mean you're not really anonymized anymore
09:51 < janjust> waiguoren:  try adding 'reneg-sec 0' to the client config file you posted, reconnect and wait for 60 mins ; but I doubt that it makes a difference
09:52 < hyper_ch> janjust: have you already sold a million copies of the book?
09:52 < janjust> Kendall:  depends on what you want to achieve; do you want lan-to-lan routing?
09:52 < waiguoren> hyper_ch, well i live in china ,my isp is not fond of VPNs...
09:52 < janjust> lol hyper_ch , I'll know early july
09:52 < waiguoren> janjust, i'll try
09:52 < Kendall> janjust:  yes
09:53 < hyper_ch> so. gotta do some shopping and then I need to go home
09:53 < janjust> Kendall:  so host A and host B are point-to-point hosts, i.e. no other clients will ever connect?
09:55 < Kendall> janjust:  there would be other clients connecting to either one
09:55 -!- p33p33 [~root@184.236.80.216] has quit [Quit: leaving]
09:56 -!- waiguoren [~itai@75.125.151.194] has quit [Quit: Leaving]
09:58 < janjust> aha OK Kendall , in that case: did you set up 'client-config-dir' and an 'iroute' file?
09:59 < Kendall> janjust:  on B, no; on A, yes
10:00 < janjust> you'd only need it on the server, Kendall ; can a host on the server side lan ping host B? ping the LAN IP of host B?
10:00 < Kendall> janjust:  The problem I'm trying to solve is that from the LAN behind openVPN host A, I can ping the LAN behind openVPN host B.  But from OpenVPN host A, I cannot ping anything on the LAN behind B
10:01 < janjust> Kendall:  so all hosts on host-A LAN can reach host-B LAN except the VPN host itself?
10:01 < Kendall> janjust:  It seems so, yes
10:02 < Kendall> janjust:  and even host B can ping host A, and the LAN behind
10:02 < janjust> in that case check the masquerading rules on host A: when the VPN host itself tries to reach a host on LAN B side then it uses its VPN IP, NOT its LAN IP
10:03 < janjust> (or: read my book, page 214 :))
10:03 < Kendall> you wrote a book?!  
10:03 < janjust> !book
10:03 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
10:04 < Kendall> Wow you're the man
10:04 < Kendall> I'll check that out
10:04 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
10:04 < Kendall> janjust:  thanks, I'll look over the rules on A again
10:06 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
10:07 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:08 < Kendall> jannjust:  I have "-A POSTROUTING -s 10.8.1.0/24 -o tun0 -j MASQUERADE" and tun0 is the 10.8.1.0/24 interface. I have similar for eth0, tun1, and tun2
10:09 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
10:09 < janjust> that's for traffic leaving the tun0 i/f on host A
10:10 < janjust> how is return traffic set up on host B side? 
10:10 < janjust> that is, how does the default GW on host B side know that traffic from the host A LAN needs to go back to the VPN server?
10:10 < janjust> errr "needs to go back to the VPN client"
10:13 -!- Cain [~Geek@unaffiliated/cain] has quit [Client Quit]
10:15 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:15 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
10:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:23 -!- gladiatr [~gladiatr@openvpn/community/support/gladiatr] has quit [Disconnected by services]
10:23 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:23 -!- gladiatr_ [~gladiatr@24.124.110.35] has joined #openvpn
10:24 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
10:25 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
10:25 < stevieman> Alright I just had a major server issue that turned out to be a USB HD turned on during a server reboot. Now that, that is solved I still have my OPenVPN no connection issue. There are no errors showing up in syslog.
10:26 < stevieman> except "modem-manager: (net/tun0): could not get port's parent device"
10:31 < gladiatr> stevieman, what distro are you running?
10:33 < stevieman> gladiatr: Debian 6
10:34 < gladiatr> are you using network-manager?
10:35 < stevieman> gladiatr: Nope, Actually it looks like it's a router issue. I can 
10:35 < stevieman> gladiatr: Nope, Actually it looks like it's a router issue. I can connect on the internal network
10:39 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has quit [Read error: Connection reset by peer]
10:39 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has joined #openvpn
10:44 -!- dazo is now known as dazo_afk
10:47 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:49 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:05 -!- stevieman [~Longfield@dynamic-66-102-71-5.wtccommunications.ca] has quit [Quit: Leaving]
11:15 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:26 -!- Blues-Man [~bluesman@host238-118-dynamic.33-79-r.retail.telecomitalia.it] has joined #openvpn
11:43 -!- robuster [~a@unaffiliated/robuster] has joined #openvpn
11:43 < robuster> Hello
11:43 < robuster> I run OpenVPN in a openvz container and using push "redirect-gateway"
11:43 < robuster> however I'm unable to forward the traffic it seems, I did this:
11:44 < robuster> iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -j SNAT --to 77.79.11.133
11:44 < Bushmills> !redirect
11:44 < robuster> and: echo "1" > /proc/sys/net/ipv4/ip_forward
11:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
11:45 < Bushmills> why would replies, sent out by vpn server, return to vpn client, if you SNATted request packets with openvpn server ip address?
11:46 < robuster> what else should i do?
11:46 < Bushmills> replies to request packets, sent out by vpn server, i mean to say
11:46 < Kendall> Bushmills:  Hey there...still having a firewall issue, would you mind to take a look with me? 
11:46  * Bushmills looks but sees nothing
11:46 < robuster> I've been googling this for hours and all solutions I've see were doing that
11:47 < Bushmills> !nat
11:47 < robuster> I believe it's the VPS variant of "iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o eth0 -j MASQUERADE" as it doesn't support MASQUERADE
11:47 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
11:47 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
11:48 < Bushmills> well, then you'll have a problem - because client won't see the replies. as the requests are carrying the server address as source
11:48 < Bushmills> maybe you can DNAT the replies --to client
11:49 < robuster> I've had this working before, without specifying any client ip's and whatnot
11:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
11:49 < robuster> And those article only applies to dedicated servers
11:49 -!- Blues-Man [~bluesman@host238-118-dynamic.33-79-r.retail.telecomitalia.it] has left #openvpn ["Sto andando via"]
11:50 < Kendall> I'm (still) having a problem getting my OpenVPN host to access the LAN behind a client.  janjust mentioned earlier that when the openvpn host tries to access the client network, it uses the VPN IP, not local ip, and I should check my masq. rules.  My masq rules are at http://pastebin.com/Q9RDy0es
11:50 < Bushmills> !clientlan
11:50 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
11:50 <@vpnHelper> better explanation
11:51 < Bushmills> i'm not sure whether i understand what you're trying to do. for accessing LAN behind client, you don't need masquerading
11:52 < Bushmills> for getting on WAN behind client (or server), you would
11:52 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
11:53 < Kendall> I'm trying to be able to ping the lan behind the client (10.4.0.0/24) from the openvpn server.  I can ping the LAN behind the client from machines on the network behind the _server_, but the server itself cannot access the client network
11:53 < Bushmills> for network-to-network:
11:53 < Bushmills> !route
11:53 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:54 < Bushmills> for server to network behind client:
11:54 < Bushmills> !clientlan
11:54 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
11:54 <@vpnHelper> better explanation
11:54 < Bushmills> well, remains LAN behind server:
11:54 < Bushmills> !serverlan
11:54 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
11:55 < robuster> !def1
11:55 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
11:55 < robuster> !nat
11:55 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
11:55 -!- bauruine [~stefan@217.150.234.219] has joined #openvpn
11:59 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
12:00 -!- bauruine [~stefan@217.150.234.219] has quit [Client Quit]
12:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:02 < Kendall> !book
12:02 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
12:05 < Doonz> ugg im to stupid to use openvpn
12:05 < Doonz> :(
12:05 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
12:06 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:07 -!- robuster [~a@unaffiliated/robuster] has quit []
12:08 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
12:09 < Bushmills> using is no problem, just ask your admn to set it up, after that you can pretty much ignore that there's a vpn
12:12 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
12:14 -!- Cain [~Geek@unaffiliated/cain] has left #openvpn []
12:14 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:15 < Doonz> Bushmills:  im the admin lol
12:16 < Bushmills> you may need a senior admin, to delegate these setups to
12:20 < Doonz> its only for my company wich im the only employee of
12:20 < Doonz> just need to set up the vpn server on a vps
12:20 < Doonz> just having trouble following the guids sive found
12:21 < Bushmills> !howto
12:21 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:23 < Doonz> thanx ill try that one
12:26 -!- hindukusch1 [~Beta@xdsl-89-0-61-108.netcologne.de] has joined #openvpn
12:29 -!- Salz` [~Salz@e177159038.adsl.alicedsl.de] has joined #openvpn
12:29 -!- hindukusch [~Beta@xdsl-89-0-32-16.netcologne.de] has quit [Ping timeout: 260 seconds]
12:31 < Salz`> hi there. Is there anyway to get some usefull
12:31 < Salz`> debug information on clientside (windows)?
12:32 < Bushmills> writing to a log file is a way
12:32 < Bushmills> increase verbosity of log file as needed
12:35 < Salz`> uhm. need to talk a look then
12:35 < Salz`> the normal "connect dialog" shows sadly nothing usefull
12:35 < Salz`> seems like everything is ok
12:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:43 -!- p33p33 [~piero@184-222-33-211.pools.spcsdns.net] has joined #openvpn
12:43 -!- Salz` [~Salz@e177159038.adsl.alicedsl.de] has quit [Quit: Leaving...]
12:47 -!- p33p33_ [~piero@184.236.120.19] has joined #openvpn
12:50 -!- p33p33 [~piero@184-222-33-211.pools.spcsdns.net] has quit [Ping timeout: 260 seconds]
12:50 < p33p33_> !welcome
12:50 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:51 < p33p33_> !goal vpn server wont start after setup I followed the instractions on the how to.
12:55 < Bushmills> that goal is easy to achieve :)
12:56 < Bushmills> just add "xlerb" to the config
12:58 < p33p33_> what is xlerb?
12:58 < Bushmills> an illegal config directive. doesn't exist. as such, it keeps your openvpn from starting.  which is your goal.
12:59 < EugeneKay> AN illegal config directive? Is it calling the FBI on me?
12:59 < pwrcycle> haha :)
12:59 < p33p33_> nice
12:59 < pwrcycle> !config
12:59 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
13:00 < pwrcycle> !configs
13:00 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
13:00 < pwrcycle> there
13:00 < Bushmills> p33p33_: this is what openvpn does with xlerb config directive:  http://scarydevilmonastery.net/snap/xlerb.png
13:05 < p33p33_> nice Bushmills 
13:06 < p33p33_> !configs
13:06 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
13:12 < p33p33_> !configs #################################################
13:12 < p33p33_> port 1194
13:12 < p33p33_> proto udp
13:12 < p33p33_> dev tun
13:12 < p33p33_> ca /etc/openvpn/ca.crt
13:12 < p33p33_> cert /etc/openvpn/ukvpn.crt
13:12 < p33p33_> key /etc/openvpn/ukvpn.key  # This file should be kept secret
13:12 -!- p33p33_ was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
13:14 -!- p33p33_ [~piero@184.236.120.19] has joined #openvpn
13:14 < p33p33_> sorry guys im a n00b
13:15 < p33p33_> my pastebin link is http://pastebin.com/cvktwy3H
13:16 < p33p33_> !configs http://pastebin.com/cvktwy3H
13:16 -!- luneff [~yury@84.51.197.177] has joined #openvpn
13:17 < Bushmills> add a log directive, and set verb  log verbosity according your needs.
13:18 < Bushmills> server config looks ok, on first glimpse. no reason easily discernible why server wouldn't start
13:20 < p33p33_> i just added the log-append to the config 
13:20 < p33p33_> im trying to route all the traffic thru the vpn 
13:20 < Bushmills> !redirect
13:20 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
13:21 < Bushmills> note that !ipforward and !nat are not openvpn configs, but configs in and of your operating system
13:22 < p33p33_> ok im gonna try to start the srv again and see if it fails agin 
13:22 < p33p33_> kool
13:23 < p33p33_> thank you will try it and get back on later I appreciate all your help
13:23 -!- p33p33_ [~piero@184.236.120.19] has quit [Quit: leaving]
13:31 -!- hindukusch1 [~Beta@xdsl-89-0-61-108.netcologne.de] has left #openvpn ["Leaving."]
13:49 -!- Kendall is now known as Kendall|At_Lunch
13:56 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
13:56 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
13:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:00 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:10 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
14:14 <@vpnHelper> RSS Update - forum: Server Install on Amazon Linux AMI - Can't Generate Script <http://forums.openvpn.net/topic7995.html#p12969>
14:28 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 250 seconds]
14:31 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
14:31 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
14:49 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
14:50 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
14:52 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
14:53 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
14:53 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:55 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
14:55 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 240 seconds]
14:55 -!- Kendall|At_Lunch [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
14:55 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
14:55 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 255 seconds]
14:55 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
14:56 -!- Riz [~riz@syn.theintertubes.ca] has joined #openvpn
14:56 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:58 -!- affffff [~acccccc@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
15:00 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
15:01 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has quit [Ping timeout: 252 seconds]
15:03 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
15:06 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
15:07 -!- luneff [~yury@84.51.197.177] has quit [Quit: Leaving]
15:08 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
15:09 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:35 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has quit [Quit: Leaving.]
15:41 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Remote host closed the connection]
16:02 -!- raidzx [~raidz@46-105-63-15.kimsufi.com] has quit [Read error: Connection reset by peer]
16:03 -!- raidzx [~raidz@46-105-63-15.kimsufi.com] has joined #openvpn
16:06 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:20 -!- p3rror [~mezgani@41.140.178.204] has quit [Ping timeout: 276 seconds]
16:33 -!- p3rror [~mezgani@41.140.182.120] has joined #openvpn
16:47 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
16:48 -!- bauruine_ [~stefan@2001:8e0:100b:dead:a53b:ecfc:4483:7549] has joined #openvpn
16:54 -!- p3rror [~mezgani@41.140.182.120] has quit [Ping timeout: 255 seconds]
17:04 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
17:05 -!- Kalculus [~na@x40343ce2.ip.e-nt.net] has joined #openvpn
17:07 < Kalculus> How much slower is an OpenVPN TCP connection than a UDP connection?  Especially over a network such as 3G wireless service which may have less stable latency and packet loss.
17:16 -!- p3rror [~mezgani@41.140.44.242] has joined #openvpn
17:21 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:35 -!- p3rror [~mezgani@41.140.44.242] has quit [Read error: Connection reset by peer]
17:45 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
17:48 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:49 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
17:53 -!- APTX_ is now known as APTX
17:54 < krzie> Kalculus, even if we had numbers from someones testing, it could very well mean nothing for your network
17:54 < krzie> feel free to test andpost your results if you like
18:03 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:19 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
18:20 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:22 <@vpnHelper> RSS Update - forum: Non-Admin usage of OpenVPN on Windows <http://forums.openvpn.net/topic8250.html#p12970>
18:35 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
19:16 < ecrist> oc80z: ping
19:16 < oc80z> yup
19:16 < ecrist> you wanted a host cloak for openvpn?
19:17 < oc80z> i did
19:18 < ecrist> @openvpn/user/oc80z is what I'd request for you
19:19 < oc80z> okay
19:19 < oc80z> thanks for the followup
19:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:34 -!- myloveisnick [4451e1bf@gateway/web/freenode/ip.68.81.225.191] has joined #openvpn
19:35 < myloveisnick> Hey guys I'm having alot of trouble installing openvpn on ubuntu 10.03 does anyone have a guide that is VERY NOOB friendly?
19:35 < myloveisnick> The ones I have found via google arent so great
19:37 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
19:42 < ecrist> oc80z: I've got the request in, not sure how long it'll take.
19:44 -!- gyyrog [~gyyrog@24-247-226-179.dhcp.trcy.mi.charter.com] has joined #openvpn
19:47 -!- gyyrog [~gyyrog@24-247-226-179.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:47 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
19:47 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
19:47 < ecrist> ping oc80z I have a staffer now, he's sent you a PM to confirm.
19:56 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
19:58 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:58 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:05 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:05 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:12 -!- master_of_master [~master_of@p57B55842.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:14 -!- master_of_master [~master_of@p57B558AD.dip.t-dialin.net] has joined #openvpn
20:32 -!- myloveisnick [4451e1bf@gateway/web/freenode/ip.68.81.225.191] has quit [Ping timeout: 252 seconds]
20:47 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 250 seconds]
20:48 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
20:48 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:51 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
20:51 -!- mode/#openvpn [+o vpnHelper] by ChanServ
20:59 < ecrist> gah.  stupid vlans
20:59 < ecrist> sorry about that
21:04 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
21:04 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
21:05 < ecrist> oc80z: what's up with all your Excess Flood quits?
21:13 -!- EugeneKay is now known as EugeneKaway
21:16 -!- EugeneKaway is now known as EugeneKay
21:40 -!- Netsplit *.net <-> *.split quits: Hamlin, belZe
21:40 -!- Netsplit over, joins: belZe
21:40 -!- Hamlin [~Hamlin@2001:470:7:2b8::2] has joined #openvpn
21:48 -!- EugeneKay is now known as EugeneKaway
21:57 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has quit [Ping timeout: 260 seconds]
22:01 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 276 seconds]
22:23 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:23 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:43 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:44 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:47 -!- p33_p33_ [~p33p33@78.129.251.117] has joined #openvpn
22:53 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:55 -!- dym [~patrick@netsplit.me] has joined #openvpn
22:56 < dym> Hey, im fairly new to vpn. Say I managed to initiate a VPN connection from my workstation to my server and i wanted to tunnel all outgoing traffic from my workstation through this VPN connection, what would I have to do - configuration wise?
22:58 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
22:58 < pwrcycle> !route
22:58 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
23:19 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:20 < p33_p33_> any advice I get this error
23:20 < p33_p33_>  * Stopping virtual private network daemon(s)...
23:20 < p33_p33_>  *   No VPN is running.
23:20 < p33_p33_>  * Starting virtual private network daemon(s)...
23:20 < p33_p33_>  *   Autostarting VPN 'server'
23:20 < p33_p33_>    ...fail!
23:22 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
23:24 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:24 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:25 < dym> p33_p33_: yes, check your logfiles.
23:28 < amero> is there command to see all the currently connected clients?
23:32 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:32 -!- oc80z [oc80z@blea.ch] has joined #openvpn
--- Day changed Wed Jun 15 2011
00:00 -!- hyper_ch is now known as hyper_away
00:03 -!- hyper_away [~hyper_ch@ks357331.kimsufi.com] has left #openvpn []
00:03 -!- hyper_away [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
00:04 -!- hyper_away is now known as hyper_ch
00:05 -!- Dougy_ [me@tech.qsi.net] has joined #openvpn
00:05 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Read error: Operation timed out]
00:05 -!- caesay [~caesay@socialshock.net] has joined #openvpn
00:06 -!- caesay is now known as Guest47506
00:06 -!- Dougy [me@tech.qsi.net] has quit [Ping timeout: 240 seconds]
00:06 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has quit [Read error: Operation timed out]
00:08 -!- Kalculus [~na@x40343ce2.ip.e-nt.net] has quit [Ping timeout: 276 seconds]
00:09 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has joined #openvpn
00:10 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
00:16 -!- luckman212 [~irc@pool-74-108-1-53.nycmny.fios.verizon.net] has quit [Read error: Connection reset by peer]
00:38 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
00:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:57 -!- K1ng` [~KING@180.211.188.171] has joined #openvpn
00:59 -!- K1ng [~KING@180.211.188.218] has quit [Ping timeout: 252 seconds]
01:08 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
01:09 -!- oc80z [oc80z@blea.ch] has joined #openvpn
01:22 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: Connection reset by peer]
01:23 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:23 -!- mode/#openvpn [+o mattock] by ChanServ
01:39 -!- bauruine_ [~stefan@2001:8e0:100b:dead:a53b:ecfc:4483:7549] has quit [Ping timeout: 260 seconds]
01:40 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has joined #openvpn
01:47 < krzee> dym, 
01:48 < krzee> !redirect
01:48 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
01:49 < krzee> amero, a status file can do that (--status)
01:50 < krzee> in which case you just send a signal to openvpn and it updates the status file (which it also does every so often)
01:50 < krzee> !man
01:50 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
01:50 < krzee> amero, or if you are programming something...
01:50 < krzee> !management
01:50 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface, or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
01:50 < dym> !def1
01:50 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
01:51 < dym> !ipforward
01:51 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
01:51 < dym> !linipforward
01:51 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
01:51 < dym> ah
01:51 < dym> ok
01:51 <@vpnHelper> RSS Update - forum: Non-Admin usage of OpenVPN on Windows <http://forums.openvpn.net/topic8250.html#p12971>
01:51 < dym> cheers krzee 
01:52 < krzee> dont forget:
01:52 < krzee> !linnat
01:52 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
01:52 < dym> yeah, using shorewall.
01:52 < dym> got that sorted.
01:52 < krzee> cheers mate
01:53 < dym> I think i had all that so far. Just stopped working for some strange reason
01:53 < dym> as soon as the vpn connection was made and the routes were pushed to the client
01:59 -!- quadDamage [~EmperorTo@216.17.68.153] has quit [Read error: Connection reset by peer]
01:59 -!- quadDamage [~EmperorTo@216.17.68.153] has joined #openvpn
02:24 -!- Pr0z0id [~Pr0zoid@24-246-5-196.cable.teksavvy.com] has quit [Ping timeout: 240 seconds]
02:28 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn []
02:28 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
02:31 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
02:31 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
02:51 -!- dym [~patrick@netsplit.me] has left #openvpn []
02:52 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
02:59 <@vpnHelper> RSS Update - forum: OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12972>
02:59 -!- Dirus [46bea7fa@gateway/web/freenode/ip.70.190.167.250] has joined #openvpn
02:59 < Dirus> !welcome
02:59 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:59 < Dirus> !route
02:59 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
02:59 -!- Dougy_ [me@tech.qsi.net] has quit [Read error: Connection reset by peer]
03:00 -!- Dougy [me@tech.qsi.net] has joined #openvpn
03:01 < Dirus> !goal
03:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:03 < Dirus> my openvpn works fine with windows machines, but linux machines seem to need some tweaking, I know what route I have to add manually to make it work, but am having trouble configuring it to do so
03:04 < Dirus> is there a way to tell which interface openvpn is connecting through?
03:04 < krzee> the windows machine gets the route and not linux machine?
03:04 < krzee> i dont understand the question
03:04 < krzee> instead of asking it in terms of your proposed solution, please explain the problem better
03:06 < Dirus> all machines seem to get the routes, but I get no route to host for the linux machines
03:06 < krzee> route to host?
03:06 -!- dazo_afk is now known as dazo
03:07 < krzee> !logs
03:07 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
03:07 < krzee> just for linux machine pls
03:07 < krzee> and:
03:07 < krzee> !configs
03:07 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
03:08 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:08 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:16 -!- mick_laptop [~mick@clamwin/admin/mickhome] has quit [Ping timeout: 240 seconds]
03:18 -!- mick_laptop [~mick@mickweiss.com] has joined #openvpn
03:20 < Bushmills> !nvidia
03:20 < Bushmills> sry ...
03:23 < Bushmills> Dirus: if linux complains about "no route to host", you'd have to either add the missing route, or not try to reach destinations for which there doesn't exist a route
03:23 < Bushmills> usually the ladder is handled by a default route
03:23 -!- Guest47506 [~caesay@socialshock.net] has quit [Ping timeout: 240 seconds]
03:23 < krzee> (latter)
03:23 -!- caesay [~caesay@socialshock.net] has joined #openvpn
03:24 < krzee> moinmoin
03:24 < Bushmills> latter
03:24 -!- caesay is now known as Guest28992
03:24 < Bushmills> grin
03:24 < Bushmills> thanks
03:24 < hyper_ch> krzee: that was quick
03:25 < Bushmills> one can tell that i haven't had coffee yet
03:26 < krzee> hyper_ch, what was?
03:26 < hyper_ch> [10:23] <krzee> (latter)
03:26 < hyper_ch> [10:24] <krzee> moinmoin
03:26 < hyper_ch> you were gone for a whole minute
03:26 < krzee> latter, not later
03:26 < krzee> was helpin bush
03:27 < krzee> english isnt his first language, even if he does command it better than half the native english speakers on irc
03:28 < Bushmills> that was written because of lack of concentration capability, due to missing brain stimulation substances, not because of lack of language command
03:29 < krzee> gotchya =]
03:29 < krzee> i could go for some of those substances myself
03:29 < krzee> unfortunately i have no access to my favorite one at the moment
03:29 < Bushmills> wasn't really intend to give lessons in climbing instrument construction
03:29 < Bushmills> intending .... :)
03:43 < Dirus> Bushmills: I know which route to add, and I can script a fit, but it's needs the interface I'm using to connect to openvpn and I'm not sure how to get that
03:44 < Dirus> krzee: server log http://pastebin.com/PjZxYwcv client log http://pastebin.com/HDpLnzET server conf http://pastebin.com/RLmt7GEH client conf http://pastebin.com/fRac8Edd
03:46 < Dirus> I can make the client log go on longer if need be but it's all no route to host, and there are some programs that start to shutdown when offline for too long, and it's trouble to bring them back up
03:46 < Dirus> but I can do it if you think something valuable will be there after more time
03:50 -!- p3rror [~mezgani@41.140.29.114] has joined #openvpn
03:50 < Dirus> I have a route I can add to fix the linux clients but it assumes the if is eth0, and I didn't like that, but I see no easy way to decide which interface the one tap0 is using
03:50 -!- gladiatr_ [~gladiatr@24.124.110.35] has quit [Remote host closed the connection]
03:54 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
03:54 -!- niobos [~niobos@hackerspace.be] has joined #openvpn
03:54 < niobos> !welcome
03:55 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:55 < niobos> !goal
03:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:55 < krzee> oh a bridge
03:55 < krzee> ya i cant help you
03:55 < krzee> why do you use a bridge?
03:56 < niobos> Maybe the -dev channel would be more suited for this, but I'll take my chances: I'm trying to find the timeframe for OpenVPN 2.3 to be released; the only thing I could find was "August 2011", but I'm wondering if it's up to date?
03:56 < krzee> dazo:  ^
03:56 < niobos> The reason behind this is: I'd like to have IPv6-support (through the tunnel, that is)
03:57  * dazo looks up
03:58 < dazo> niobos: we're probably going to release an early 2.3 beta around august or so.  If beta/rc candidates runs without issues we might have a full release towards early beginning of 2012, or maybe earlier if lucky
03:59 < krzee> to beta test the early release, be on the -devel mailing list =]
03:59 < niobos> dazo: thx, looks like I'll have to wait for IPv6 tunneling a little longer than...
03:59 < krzee> !ipv6
03:59 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
03:59 < Dirus> krzee: the software expects to be on the lan itself and to talk to everyone else on the lan, and to use openvpn from remote locations all openvpn clients have to think they are on the lan
03:59 < krzee> !snapshots
03:59 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
04:00 < dazo> niobos: please try the master branch (snapshots) ... they are suitable for testing, and quite stable even now
04:00 < dazo> We're awaiting some patches which adds support for PolarSSL as an alternative to OpenSSL, which we want to put into 2.3 ... that's what is holding us back at the moment
04:00 < krzee> Dirus, the lan machines too, or just openvpn nodes need layer2 to eachother?
04:00 < niobos> krzee: I'm looking for something to distribute to normal users, so I'll have to hold off for a stable release anyway (and one that is packaged reasonably well for Win & MacOS)
04:00 < niobos> but I might give it a try myself
04:00 < Dirus> krzee: the land machines too
04:00 < Dirus> err lan
04:00 < dazo> niobos: but the IPv6 stuff is being tested, and I'm using the master branch myself quite often ... it is really stable for me
04:01 < krzee> Dirus, then you do need a bridge, and unfortunately i cant help ya
04:01 < Dirus> wish I had known that before posting everything up
04:01 < niobos> dazo: I'll try the "beta", but I need a packaged version for the end users
04:01 < krzee> i didnt know it was a bridge ;]
04:01 < Dirus> I can fix the route myself, but I either need to pass the value of net_gatweway to my script, or find out which interface the tap is using
04:01 < Splex> in the HOWTO 'man-in-the-middle', it is suggested to sign server and client certs with different CAs.  Does this mean two separate CA root servers?
04:02 < Dirus> do you know of any way to do either of those krzee?
04:02 < krzee> Dirus, check if scripts are passed the var
04:02 < krzee> !scripts
04:02 < dazo> niobos: understood ... we're trying to get a windows snapshot build ready too ... but OSX might be more challenging right now
04:02 < krzee> right under there is the env vars
04:02 < krzee> !script
04:02 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
04:02 < niobos> dazo: I currently use tunnelblick, which is fairly nice
04:03 -!- testing is now known as wangerin1
04:03 < niobos> but it probably lags a few versions, so I'll have to wait even longer
04:03 < niobos> currently is at 2.1.4
04:03 < dazo> niobos: yeah ... we just need tunnelblick guys to also do some snapshot builds for us then ... not very likely at the moment, as we don't have capacity to drive that effort right now
04:03 < krzee> tunnelblick uses an openvpn binary in it
04:03 < krzee> you can replace it with a simple commandline entry
04:04 < krzee> in finder you wont see it, in cmdline you will
04:04 < niobos> it seems like none of the current VPN solutions support IPv6 in a nice way...
04:04 < krzee> well cmdline you might if you right click it and use show contents... i cant check since i dont use tunnelblick
04:04 < niobos> krzee: I know I can, but I can't expect my users to do that
04:05 < krzee> you can, and then distribute them their tunnelblick :-p
04:05 < niobos> I even tried manually setkey-ing IPsec rules
04:05 < niobos> krzee: yes, I probably can... but I have no experience in packaging
04:05 < dazo> niobos: IPv6 is really going to be properly supported first in 2.3 ... however, TAP mode will support IPv6 in earlier versions as well, but you need to do the configuration manually
04:05 < niobos> dazo: that's what I read, but I just can't get it to work on MacOS
04:06 < niobos> it just won't pick up the radv's
04:06 < krzee> in fact dazo, i can write a small bash script to update tunnelblick instead of needing them to have a snapshot build, if you think that would be useful
04:06 < dazo> krzee: that does indeed sound useful!
04:06 < krzee> its literally just a mv command
04:06 < dazo> niobos: you can't use radvd for tap in the current shape ... you need to do it manually ... using --up script on the clients which sets the IPv6 addresses
04:07 < niobos> dazo: and how can I push the prefix to use?
04:07 < krzee> grabbing tunnelblick now so i can get the exact command
04:08 < dazo> niobos: you cannot push it ... I'm telling you, you need to do this *manually* ... as in ip -6 addr add {IPv6 address} dev tap{X} .... and the same with routes as well
04:09 < niobos> dazo: I understand I need to manually *configure* the ip address, but can I communicate what prefix to use from the server to the script?
04:09 < dazo> niobos: then you need to look at --setenv-safe in the man page ... which is push-able
04:10 < niobos> great, that sounds like what I was looking for
04:10 < dazo> but you cannot push just a prefix with this path ... you need a complete IPv6 address
04:10 < dazo> (unless your --up script will generate the some randomness and apply that to the pushed IPv6 prefix)
04:11 < niobos> I was thinking of using SLAAC-style addresses based on the TAP's mac-address
04:11 < krzee> install openvpn as normal, cp $(which openvpn) /Applications/Tunnelblick.app/Contents/Resources/openvpn
04:11 < krzee> done
04:11 < niobos> or can't I assume that the  MAC-address is unique?
04:11 < krzee> (assumes openvpn was installed to path of course)
04:12 < dazo> niobos: you might have conflicts ... the MAC addresses are not guaranteed to be unique across more boxes with TAP devices
04:12 < niobos> dazo: hmmm... doesn't this causes problems with the switching code in p2mp?
04:13 < dazo> (even though, I've never experienced conflicts in real life, but theoretically, there is a possibility)
04:13 < dazo> On Windows, the MAC address is only generated when the interface is created, in a more static fashion ... but on Linux, it will be a new MAC address for each time OpenVPN creates the tap device
04:14 < dazo> how OSX behaves, I don't know, but I'd expect it to be closer to Linux
04:14 < niobos> well, SLAAC says you should check the generated address to be free, so that catches that case
04:14 < krzee> what if you use a static device...?
04:14 < niobos> and anyway, I'm willing to risk a 1/2^48 chance
04:14 < niobos> well, compensate that for the birthday-paradox
04:15 < niobos> but still
04:15 < dazo> static devices is going to be ... ehh ... static, also with the MAC address
04:15 < krzee> but even acrossed reboots?
04:15 < dazo> which is why Windows doesn't really change ... as the TAP devices are static there ... not created on-the-fly when OpenVPN starts
04:15 < krzee> right
04:16 < niobos> but the MAC is still randomly generated when it's created (either once or regularly)?
04:16 < dazo> across reboots ... that will only work on Windows ... but for Linux/OSX, I believe you need to configure a fixed MAC address then ... I know Gentoo gives possibility for that
04:16 < krzee> osx too
04:16 < niobos> for the record: I'm not trying to get a fixed IPv6 address, just a unique one
04:16 < dazo> niobos: yes, MAC addresses are always random, as it is randomised during creation
04:17 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:17 < krzee> ifconfig <dev> ether|lladdr <mac address>
04:17 < dazo> krzee: ahh, well, I'm no OSX person ... so I don't know about those quirks :)
04:17 < krzee> ether is another name for lladdr
04:18 < krzee> like me and linux =]
04:18 < niobos> ok, I'll give --setenv <prefix> a try and have --up add the SLAAC-style MAC address behind it
04:18 < dazo> niobos: please use --setenv-safe
04:18 < niobos> is that new? I don't see it in my man-page
04:18 < krzee> !man
04:18 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
04:19 < niobos> I take it as a yes
04:19 < dazo> niobos: it's in the man page for 2.1 and 2.2
04:19 < krzee> its in 2.1 man
04:19 < niobos> k, got it
04:19 < dazo> niobos: in the future, I expect --setenv to become non-pushable
04:19 < niobos> Ah, right... I was wondering why there was no prefix added...
04:20 < niobos> ok, I have enough info to try out, that will get me through the afternoon
04:20 < niobos> thx a lot!
04:20 < dazo> you're welcome!
04:22 < Bushmills> Dirus: you can't add the route before the interface to it is up.  add the route after the interface was brought up.
04:23 < Bushmills> check out section "environmental variables" in openvpn man page
04:23 < Bushmills> did someone say i was lagging?
04:23 < Dirus> Bushmills: yeah I'm trying to use those now, but the envs all seem to be blank
04:24 < Bushmills> how do you try to read them?
04:24 < krzee> [05:25]  * Ping reply from Bushmills: 0.32 second(s)
04:24 < Dirus> in /bin/sh, just $whatever Bushmills 
04:25 < Bushmills> where from?
04:26 < krzee> try just dumping 'env' and watch the logfile
04:26 < Dirus> well I realized what you said was true, but since I started with an --up script that's where I'm trying to use them
04:26 < Bushmills> those vars are not vars, global to every and any shell. they're set in the environments of --up/--down scripts only
04:27 -!- affffff [~acccccc@042-120-128-083.dynamic.caiway.nl] has quit [Ping timeout: 240 seconds]
04:28 < Dirus> I see, there are few set, just not the ones I was trying to use
04:30 < Bushmills> hm. try to use those which exist
04:30 < Bushmills> coincidentally, those should match the vars described in the environmental vars section of man page
04:39 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
04:40 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 260 seconds]
04:41 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:53 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
04:53 <@vpnHelper> RSS Update - forum: [SOLVED] OpenVPN, lost paquets in transmition... <http://forums.openvpn.net/topic8171.html#p12972>
05:03 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:03 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:11 -!- nutcase [~nutcase@tokerscorner.com] has quit [Ping timeout: 246 seconds]
05:13 -!- nutcase [~nutcase@tokerscorner.com] has joined #openvpn
05:14 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
05:14 -!- oc80z [oc80z@blea.ch] has joined #openvpn
05:14 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
05:34 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 240 seconds]
05:38 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
06:06 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:12 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
06:23 <@vpnHelper> RSS Update - forum: Connection works for only few seconds <http://forums.openvpn.net/topic8109-15.html#p12973>
06:35 -!- Dougy [me@tech.qsi.net] has quit [Read error: Connection reset by peer]
06:36 -!- Dougy [me@tech.qsi.net] has joined #openvpn
06:49 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
06:50 < hyper_ch> the ccd file, it can contain dashes and underscores, right?
06:52 -!- K1ng` [~KING@180.211.188.171] has quit [Read error: Connection reset by peer]
06:59 -!- K1ng [~KING@180.211.188.171] has joined #openvpn
06:59 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:00 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
07:07 < Bushmills> in the  file name? or in the file?
07:12 -!- Splex [~splex@unaffiliated/splex] has quit [Ping timeout: 240 seconds]
07:12 -!- Splex [~splex@n058152164030.netvigator.com] has joined #openvpn
07:12 -!- Splex [~splex@n058152164030.netvigator.com] has quit [Changing host]
07:12 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
07:12 -!- luckman212_ [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
07:27 -!- niobos [~niobos@hackerspace.be] has quit [Quit: leaving]
07:28 < amero> does --port-share only work with --proto tcp?
07:30 -!- luckman212_ [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Remote host closed the connection]
07:37 < Bushmills> "Currently only  designed to work with HTTP/HTTPS" - do you run http with udp?
07:42 < amero> never mind. i misunderstood what it does
07:46 -!- p3rror [~mezgani@41.140.29.114] has quit [Ping timeout: 255 seconds]
07:47 < amero> so if want openvpn to listen on https, i just need to do --port 443 and --port-share host:new-https-port right?
07:47 < amero> if i
07:49 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 260 seconds]
07:49 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
07:55 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
07:57 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Client Quit]
07:57 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
08:01 -!- corretico [~luis@201.201.44.82] has quit [Read error: Operation timed out]
08:03 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:04 < dazo> amero: correct
08:04 < dazo> openvpn will look at all packets, and what is not openvpn packets will be forwarded to the web server
08:05 < dazo> but without trying to decrypt the traffic, it just passes the raw packets further ... so in this way, it's not a real MITM situation
08:19 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:21 < amero> ah okay
08:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:26 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
08:26 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:26 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
08:26 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
08:26 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
08:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:37 -!- EugeneKaway is now known as EugeneKay
08:37 -!- danlench [~daniell@pool-71-113-224-19.herntx.dsl-w.verizon.net] has joined #openvpn
08:37 < danlench> Bushmills: ping
08:38 < dazo> gee ... this can't be true .... http://politics.slashdot.org/story/07/05/31/1629259/Germany-Declares-Hacking-Tools-Illegal
08:38 <@vpnHelper> Title: Germany Declares Hacking Tools Illegal - Slashdot (at politics.slashdot.org)
08:39 < dazo> (old news, but stumbled over it now)
08:39 < EugeneKay> ze crazy germans
08:42 -!- sylock [~sylock@91.179.38.146] has joined #openvpn
08:42 < sylock> hello here. I'm on Debian Lenny with OpenVPN 2.1_rc11 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Sep 18 2008
08:43 < ecrist> you should update
08:43 < ecrist> that's really old
08:43 < sylock> in the config I have a "up" that execute a cmd to add a route in a routing table but it failed
08:43 < ecrist> !logs
08:43 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:43 < sylock> I think this is because the tap0 device is not yet up
08:44 < EugeneKay> TAP causes cancer.
08:44 < ecrist> nothing wrong with TAP
08:44 < EugeneKay> except everything.
08:44 < sylock> lol
08:44 < sylock> I went to the log files
08:44 < sylock> but the error don't help me
08:44 < ecrist> but, it'll help me
08:44 < EugeneKay> it might help us tho
08:45 < sylock> it only says that the external program cannot be executed : http://pastebin.com/rh86tCGT
08:46 < sylock> but if I comment the up statement and then execute manually (from the shell) my external command, it works
08:46 < ecrist> does the openvpn process have rights to execute the script?
08:46 < sylock> here is the content of my external script : /sbin/ip route add to 192.168.140.0/24 dev tap0 table LAN
08:46 < ecrist> do you have --script-security set to 2?
08:47 < sylock> ecrist, mhhm for the rights I suppose since I launch the init script as root
08:47 < ecrist> what isn't that in your client config, or being pushed from the server?
08:47 < sylock> script-secirity is 2
08:47 < ecrist> s/what/why/
08:48 < sylock> this route statement is on the server side and needed because we have here a complicated routing architecture
08:48 < ecrist> there are better ways to get that route into openvpn
08:48 < sylock> one linux box with 4 subnets (2 internet connections, 1 lan, 1 dmz)
08:48 < ecrist> if it's on the server, just add this to the config:
08:48 < ecrist> route 192.168.140.0 255.255.255.0
08:49 < sylock> I don't think it will works because it add then this route in the main table
08:49 < sylock> BUT we also have a second table named LAN
08:49 < ecrist> is your logging verb set to 6?
08:50 < sylock> no it is at 4
08:50 < ecrist> can you set to 6, and re-run, and paste the ENTIRE log, please?
08:50 < ecrist> as I asked above.
08:51 < sylock> ok
08:52 < sylock> http://pastebin.com/zreYXHb1
08:53 < sylock> this config was working fine on etch
08:53 < sylock> but it seems the up statement is different on this "newer" version
08:54 < sylock> of openvpn
08:54 < ecrist> you have an old version that should be updated.
08:54 < ecrist> you're lucking i'm helping you. ;)
08:55 < ecrist> sylock: does your script have execute bits set?
08:55 < ecrist> it appears not
08:56 < sylock> ecrist, mhhm i'll check it
08:56 < sylock> ecrist, yes it does : -rwxr-xr-x 1 root staff   65 jun 15 13:30 vpn_route-140
08:57 < dazo> sylock: OpenVPN 2.1_rc11 .... please go and upgrade
08:58 < ecrist> change your --up to --route-up and add --route-delay 3
08:58 < dazo> there's been several updates to script parts from 2.1_rc11 to 2.2.0
08:58 < sylock> ok I will try. I can update openvpn but I don't like not using packaged application
08:58 < Splex> In the OpenVPN HOWTO, when using two CA to sign client and server certs, does it mean using two root CA or intermediate CA?
08:59 < ecrist> sylock: and we hate supporting very old versions
08:59 < sylock> ecrist, I do understand
08:59 < sylock> ;)
08:59 < dazo> sylock: I understand that argument ... but openvpn is practically *one single* binary file
08:59 < dazo> compile it ... and replace the existing openvpn binary
09:00 < sylock> "Options error: --route-delay cannot be used with --mode server" ;)
09:01 < sylock> So I'll try to update openvpn
09:01 < ecrist> oh, I forgot that was the server
09:02 < ecrist> upgrade, let's see what happens
09:02 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
09:10 -!- danlench1 [~daniell@pool-71-113-224-19.herntx.dsl-w.verizon.net] has joined #openvpn
09:11 -!- danlench1 [~daniell@pool-71-113-224-19.herntx.dsl-w.verizon.net] has left #openvpn []
09:12 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 244 seconds]
09:13 -!- danlench [~daniell@pool-71-113-224-19.herntx.dsl-w.verizon.net] has quit [Ping timeout: 255 seconds]
09:13 < sylock> ecrist, dazo : same problem when upgrading
09:13 < sylock> http://pastebin.com/Xjw2XvS9
09:14 < ecrist> add sleep 5 as the first line of your script and try again
09:15 < dazo> sylock: please also remove the --mute statement
09:17 < Splex> when having two separate CA, one for server certs, one for client certs, should they be two different Intermediate CA with a shared Root CA?
09:17 < ecrist> they must all be in the same chain, iirc
09:18 < Splex> ecrist, having a shared root CA,  would that mean they are in the same chain?
09:18 < ecrist> not necessarily
09:19 < ecrist> Root -> Intermediate -> Client
09:19 < Splex> ecrist, im trying to understand exactly what the howto means on the last point of protecting against 'man in the middle' attack (using two separate CA, one for client, one for server)
09:19 < ecrist> Client/Server need to be at same level, or client certs need to be signed by server
09:19 < ecrist> no idea what you're talking about
09:20 < Splex> ecrist: "Sign server certificates with one CA and client certificates with a different CA. The client configuration ca directive should reference the server-signing CA file, while the server configuration ca directive should reference the client-signing CA file."
09:20 < sylock> dazo, here is the logs without the mute statement : http://pastebin.com/GP5MRQrB
09:20 < sylock> dazo, but I don't think it will help
09:21 < dazo> sylock: you may think so, but this logs answers many of my questions
09:22 < sylock> dazo, ok
09:22 < dazo> sylock: /usr/local/sbin/vpn_route  ... is /usr/local and /usr/local/sbin accessible for the user running OpenVPN?
09:23 < dazo> and I presume you've checked that vpn_route also is executable ... and that when you run this manually, it does execute properly
09:24 < sylock> dazo, when I execute it manually it works
09:24 < sylock> openvpn is executed by root : root     21614  0.1  0.1   4484  2156 ?        Ss   16:21   0:00 /usr/local/sbin/openvpn --writepid /var/run/openvpn.vpn-server.pid --daemon ovpn-vpn-server --cd /etc/openvpn --config /etc/openvpn/vpn-server.conf
09:24 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:25 < dazo> sylock: try su -c /usr/local/sbin/vpn_route  openvpn
09:25 < sylock> and vpn_route is executable : root     21614  0.1  0.1   4484  2156 ?        Ss   16:21   0:00 /usr/local/sbin/openvpn --writepid /var/run/openvpn.vpn-server.pid --daemon ovpn-vpn-server --cd /etc/openvpn --config /etc/openvpn/vpn-server.conf
09:25 < dazo> ahh, okay ... so root is running openvpn?
09:25 < sylock> this is the debian default config it seems (I run it with the init.d script)
09:26 < sylock> only modified the path of the bin openvpn from /usr/sbin/openvpn to /usr/local/sbin/openvpn
09:27 < dazo> sylock: do you have some other security stuff enabled ... like SELinux or things like that?
09:29 < sylock> dazo, I don't think so but I don't know how to verify that
09:29 < dazo> [root@server ~]# getenforce
09:30 < dazo> or if you have a /selinux directory available with files in it
09:30 < sylock> I don't have that bin gentenforce ; I do have /selinux but it is empty
09:30 < dazo> okay, then SELinux is not in your ways
09:30 < dazo> stop openvpn then ... and try:
09:31 < dazo> strace /usr/local/sbin/openvpn --writepid /var/run/openvpn.vpn-server.pid --cd /etc/openvpn --config /etc/openvpn/vpn-server.conf
09:31 < dazo> then try to catch where execve() is called ... you may actually pastebin all this log data
09:36 < sylock> dazo, if you can read it, I admire you ;) http://pastebin.com/Hw9bFqrM
09:37 < dazo> sylock: do you have --daemon inside your config file as well?
09:38 < dazo> if so ... please remove that and do the strace again ... I don't see where it tries to execute your script
09:38 < dazo> (in fact, I see traces of some daemonising of openvpn)
09:39 < sylock> I don't have any daemon statement in my config file
09:39 < sylock> I see like you that there is no other execve that the openvpn bin
09:41 -!- lucidguy [c04b9eb4@gateway/web/freenode/ip.192.75.158.180] has joined #openvpn
09:42 < dazo> sylock: okay try adding -f to the strace command then .... strace -f /usr/local/sbin/openvpn.....
09:42 < sylock> ok
09:43 < lucidguy> Question...  Why are there so many VPN solutions in the market that cost thousands when openVPN exists and is free?
09:43 < dazo> lucidguy: why does microsoft exist when Linux and FreeBSD is so great?
09:43 < ecrist> s/Linux and//
09:43 < ecrist> ;)
09:44 < dazo> pffft
09:44 < lucidguy> dazo: Well, not the greatest example.. Microsoft and Linux are very much different.
09:44 < dazo> lucidguy: trust me, OpenVPN is very much different from other VPN implementations
09:44 < sylock> dazo, here is my strace -f : http://pastebin.com/E1ALSJbc
09:44 < catsup> lucidguy: actually there are many people selling openvpn access for thousands
09:45 < catsup> but man, in some corporations, the people are completely obvlivious to the existence of free software
09:45 < defswork> lucidguy, IT Managers dont look like they are doing their jobs unless they are spending money
09:45 -!- Salz` [~Salz@d007226.adsl.hansenet.de] has joined #openvpn
09:45 < catsup> they'll use the shittiest piece of crap version control systems, vastly inferior to any of the new free software ones
09:45 < lucidguy> I can understand the OpenVPN may require a little more hands on knowledge of Linux in most cases but... come on.
09:45 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
09:46 < catsup> lucidguy: it's not that...
09:46 < defswork> lucidguy, my current employer spend 20000 a year GBP on vpn
09:46 < sylock> dazo, sorry, I juste changed script-security so strace are not the good ones
09:46 < defswork> and it's shite
09:46 < catsup> they won't even CONSIDER it if it doesn't have advertising and a sales dept
09:46 < sylock> dazo, I retry
09:46 < dazo> gee
09:46 < lucidguy> The company I worked for is deciding on CheckPoint ... a $35K upgrade.  I'm preparing to drop the bomb on an OpenVPN NO COST option.
09:46 < dazo> okay, I'll wait for something new
09:47 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
09:47 < lucidguy> defswork: thats nuts.
09:47 < defswork> lucidguy, I'm still waiting for this to go through approval ( http://blog.defsdoor.org/2011/06/02/large-openvpn-server-deployment )
09:47 < dazo> lucidguy: one thing is the initial software/hardware cost ... but also consider that CheckPoint to add support, most likely integrated IPSec support in OSes like Windows and OSX
09:47 <@vpnHelper> Title: Large Openvpn Server Deployment - Standing On The Shoulders Of Ants (at blog.defsdoor.org)
09:47 < sylock> dazo, here is the line where the problem is. If you do prefer the all strace tell me : http://pastebin.com/Uznf8rcq
09:48 < defswork> lucidguy, server all built, tested etc.. and scripts written to make it easy for clicky pointy admins to use
09:48 < defswork> IT want whitepapers proving the numbers 
09:48 < dazo> sylock: if you run ... /usr/local/sbin/vpn_route tap0 1500 1574 192.168.140.1 255.255.255.0 init  .... this works?
09:49 < lucidguy> defswork: good stuff.  I'm also pushing a free solution because initially theyll have like 5 users...  simply going to pull openvpn from Ubuntu repos...  probably going to take me an hour to configure
09:49 < sylock> dazo, shit I think I found the problem : http://www.baanboard.com/programmers_manual_baanerp_help_errors_8_ENOEXEC
09:49 <@vpnHelper> Title: 8 ENOEXEC - Exec format error - Baanboard (at www.baanboard.com)
09:49 < dazo> sylock: because the error you get is basically the Linux kernel saying that /usr/local/sbin/vpn_route is not a proper exeutable file
09:49 < sylock> it miss the sheebang ...
09:49  * dazo guesses #! is missing
09:50 < sylock> just add it and it works!
09:50 < lucidguy> I guess the bottom line is ... how secure is it...  being an "OpenSource" product is it more prone to hacks etc ..
09:50 < defswork> not so
09:50 < sylock> dazo, thanks a lot for your help ... never found it without you
09:50 < catsup> lol what
09:50 < defswork> being opensource the holes are easier to spot and fix
09:50 < catsup> if you care about security you absolutely cannot use ANY proprietary software
09:50 < defswork> closed sourced issued get brushed under the carpet
09:50 < catsup> or anyway, any software you don't have the source to
09:50 < dazo> lucidguy: what you say there is that hiding the code is more secure ... but in fact, that's security through obscurity
09:51 < sylock> dazo, I only want to say that on Etch it was working well without that sheebang
09:51 -!- hyper_ch is now known as hyper__ch
09:51 -!- hyper__ch is now known as hyper_ch
09:51 < catsup> imagine using a cryptographic algorithm when you don't know what it is, holy shit
09:51 < catsup> that's a recipe for disaster
09:51 -!- rastagod [4a3cdb54@gateway/web/freenode/ip.74.60.219.84] has joined #openvpn
09:51 < rastagod> hello folks
09:51 < lucidguy> dazo: I agree with you .. Im preparing myself for the responses regarding my OpenVPN proposal.
09:52 < dazo> sylock: I'm not a Debian user ... so I can't tell what has changed ... but older OpenVPN versions used the system() function to execute scripts and such, while OpenVPN 2.1 and later use execve(), which is safer ... but requires proper #! in scripts
09:52 < lucidguy> Just need some ammo .. like proof of concept .. maybe facts of other companies using it ..etc
09:52 < rastagod> i followd http://www.putdispenserhere.com/openvpn-debianubuntu-setup-script-for-openvz/ script, got openvpn installed.. connected fine getting ip local ip... However when i open browser it shows my isp ip.. not openvpn vps ip.. what can it be?
09:52 <@vpnHelper> Title: OpenVPN Debian/Ubuntu Setup Script for OpenVZ - Put Dispenser Here! (at www.putdispenserhere.com)
09:53 < defswork> lucidguy, because all companies published what security software they use....
09:55 < defswork> my IT manager (hes not my manager Im not in IT) asked for white papers - I asked for copies of the whitepapers he surely must've asked for for the commercial solution we are having to throw away.
09:55 < dazo> lucidguy: this gives good background info ... http://www.sans.org/reading_room/whitepapers/vpns/openvpn-ssl-vpn-revolution_1459
09:55 < defswork> but if you are paying 20k a year you have someone else to blame - typical manager way out
09:56 < defswork> build your own solution and thats where the buck stops
09:56 -!- d457k [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
09:58 < lucidguy> dazo: Will check it out .. thanks guys.
09:59 < rastagod> Anyone have any tips on getting openvpn to use the real vps ip? i connect fine, i get a local ip of 10.x.x.x but when i open browser i still get isp ip, not the vps ip
09:59 < EugeneKay> !redirect-gateway
09:59 < EugeneKay> !def1
09:59 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
10:00 < oc80z> yeah redirect-gateway i sgood
10:00 < oc80z> sometimes route 0.0.0.0 0.0.0.0 works.
10:00 < oc80z> for windows clients
10:01 < rastagod> can anyone see this? or do i need to be identifyied?
10:01 < oc80z> rastagod sup.
10:01 < EugeneKay> <rastagod> can anyone see this? or do i need to be identifyied?
10:01 < rastagod> cool thanks
10:01 < rastagod> i installed openvpn, connected properly with open-gui
10:01 < dazo> lucidguy: if you get questions about OpenVPN security ... you can also point these people here: http://www.veracode.com/content/view/819/38
10:01 <@vpnHelper> Title: OpenVPN Receives Veracode's Highest Possible "A" Security Rating (at www.veracode.com)
10:02 < rastagod> using http://www.putdispenserhere.com/openvpn-debianubuntu-setup-script-for-openvz/  .... however i open browser and go to whatsmyip , i get my real isp ip.. not the vps ip
10:02 <@vpnHelper> Title: OpenVPN Debian/Ubuntu Setup Script for OpenVZ - Put Dispenser Here! (at www.putdispenserhere.com)
10:02 < EugeneKay> rastagod - you need to use redirect-gateway def1
10:02 < rastagod> hrm
10:02 < EugeneKay> See above on !def1
10:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:11 -!- Salz` [~Salz@d007226.adsl.hansenet.de] has quit [Quit: Leaving...]
10:16 < amero> i dont get this. according to man '--server network netmask' is only relevant to server mode
10:17 -!- rastagod [4a3cdb54@gateway/web/freenode/ip.74.60.219.84] has quit [Ping timeout: 252 seconds]
10:17 -!- Dirus [46bea7fa@gateway/web/freenode/ip.70.190.167.250] has quit [Ping timeout: 252 seconds]
10:18 -!- guifort [~guifort@80.10.46.94] has joined #openvpn
10:20 < lucidguy> Are their openvpn clients for all Clients?  Including Windows7 64bit and MACs?
10:20 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 252 seconds]
10:21 -!- WebDawg [~whoami@officialg0d.com] has quit [Ping timeout: 260 seconds]
10:21 < lucidguy> OpenVPN.net looks like very private, and makes little to no comments regarding being free and open..
10:22 -!- affix0 [~acccccc@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
10:23 < dazo> lucidguy: we're discussing this with OpenVPN Tech ... but http://community.openvpn.net/ is the place where the community have their freedom
10:23 <@vpnHelper> Title: OpenVPN Community (at community.openvpn.net)
10:23 < dazo> mattock: ^^^ 
10:23 -!- brabo [brabo@globalshellz/owner/brabo] has quit [Ping timeout: 252 seconds]
10:24 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
10:24 -!- brabo [brabo@globalshellz/owner/brabo] has joined #openvpn
10:24 < lucidguy> dazo: good to know .. I guess a better question would be where does one get the client applications for multiple platforms
10:24 -!- dazo is now known as dazo_afk
10:35 -!- WebDawg [~whoami@officialg0d.com] has joined #openvpn
10:39 -!- chantra [~chantra@unaffiliated/chantra] has quit [Remote host closed the connection]
10:39 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
10:40 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:40 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p12974>
10:40 -!- sylock [~sylock@91.179.38.146] has quit [Quit: Leaving]
10:40 -!- guifort [~guifort@80.10.46.94] has quit [Quit: Quitte]
10:42 -!- nutcase [~nutcase@tokerscorner.com] has quit [Ping timeout: 260 seconds]
10:42 -!- nutcase [~nutcase@tokerscorner.com] has joined #openvpn
10:45 -!- rastagod [4a3cdb54@gateway/web/freenode/ip.74.60.219.84] has joined #openvpn
10:45 < rastagod> hey
10:45 < rastagod> push "redirect-gateway def1" is added on server.conf or on client? i added it to server.conf restarted and still nothing.. orginal server conf looks like this.. http://pastebin.com/k4bBgTwb
10:47 < Bushmills> "nothing" is not what you want
10:47 < Bushmills> did the editor didn't save the config file? because if it did, there'll be the added line in the file, rather than "nothing"
10:48 < rastagod> Bushmills: when i open browser and go to whats my ip.. it shows my isp ip.. not vps ip
10:48 < rastagod> i want it to show my vps server ip
10:48 < Bushmills> !redirect
10:48 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
10:50 < rastagod> I added 1 to ip_forward file
10:50 < rastagod> also iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j SNAT --to-source 66.171.189.129
10:50 < rastagod> iptables-save
10:50 < rastagod> woops
10:50 < rastagod> i see the problem
10:51 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
10:53 < Bushmills> here may be a few more details, albeit in a more technical presentiation:  http://scarydevilmonastery.net/myip.cgi
10:53 -!- mick_laptop [~mick@mickweiss.com] has quit [Changing host]
10:53 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
10:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:59 -!- bauruine [~stefan@217.150.234.219] has joined #openvpn
11:00 -!- mrnice1 [bouncer@ip077244250141.rev.nessus.at] has joined #openvpn
11:08 -!- Salz` [~Salz@d007226.adsl.hansenet.de] has joined #openvpn
11:09 -!- rastagod [4a3cdb54@gateway/web/freenode/ip.74.60.219.84] has quit [Quit: Page closed]
11:13 -!- bauruine [~stefan@217.150.234.219] has quit [Ping timeout: 276 seconds]
11:16 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
11:28 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
11:42 -!- K1ng [~KING@180.211.188.171] has quit [Ping timeout: 276 seconds]
11:42 < ecrist> Bushmills: http://www.secure-computing.net/ip.php is better. :)
11:43 <@vpnHelper> Title: SCN: SCN (at www.secure-computing.net)
11:43 -!- K1ng [~KING@180.211.188.77] has joined #openvpn
11:50 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
11:51 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
11:52 -!- Cain` is now known as Cain
11:54 < amero> taking vpn overhead into account, how much the transfer rate should i be expecting to get?
11:56 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
11:57 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
11:57 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
12:02 -!- Salz` [~Salz@d007226.adsl.hansenet.de] has quit [Quit: Leaving...]
12:03 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:08 -!- Salz` [~Salz@d007226.adsl.hansenet.de] has joined #openvpn
12:11 -!- Salz` [~Salz@d007226.adsl.hansenet.de] has quit [Client Quit]
12:12 -!- Carbon_Monoxide [~cmonxide@014198182222.ctinets.com] has joined #openvpn
12:13 -!- mrnice1 [bouncer@ip077244250141.rev.nessus.at] has quit [Quit: ZNC - http://znc.sourceforge.net]
12:19 -!- Salz` [~Salz@d007226.adsl.hansenet.de] has joined #openvpn
12:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:29 -!- bauruine [~stefan@217.150.234.219] has joined #openvpn
13:01 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:01 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:05 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
13:05 -!- lucidguy [c04b9eb4@gateway/web/freenode/ip.192.75.158.180] has quit [Quit: Page closed]
13:12 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
13:17 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Operation timed out]
13:18 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
13:27 -!- Carbon_Monoxide [~cmonxide@014198182222.ctinets.com] has quit [Quit: Leaving]
13:43 -!- Salz` [~Salz@d007226.adsl.hansenet.de] has quit [Quit: Linkinus - http://linkinus.com]
13:45 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has quit [Ping timeout: 258 seconds]
13:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
14:00 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
14:02 -!- chadi [~chadi@unaffiliated/chadi] has joined #openvpn
14:04 < chadi> Hello world. I installed pptpd, but the client to client packet goes client -> server -> client which takes a while. Can openvpn connect the two clients without having the packet go through the server? I need that because my clients can't connect because they don't have public IPs.
14:05 < chadi> (clients for online gaming, to be specific)
14:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:09 < Bushmills> chadi: no
14:09 < hyper_ch> chadi: it cant
14:09 < hyper_ch> clients don't have public ips?
14:09 < Bushmills> but you can run multiple openvpn instances on each machine
14:10 < hyper_ch> it doesn't matter... you build a virtual private network
14:10 < chadi> no public IPs, ..
14:10 < hyper_ch> I'm not following what you mean
14:10 < chadi> is there a way to do online gaming without public IPs?
14:10 < Bushmills> maybe machine don't have, but router surely does
14:11 < chadi> the hamachi VPN does that, it relays the connection between the clients so that the packets don't go through the server
14:11 < Bushmills> then use hamachi
14:12 -!- Yen [~Yen@unaffiliated/yen] has joined #openvpn
14:12 < hyper_ch> it would be nice if openvpn could do that also... but right now it can't
14:12 < hyper_ch> krzie made some suggestion on how to achieve that IIRC
14:14 < chadi> all right, thank you guys for saving me the time of going through the openvpn install :-P
14:17 < krzie> yep, but it wont be possible to work on until openvpn3
14:17 < krzie> which is still in roadmap mode
14:17 < krzie> (ie: no time soon)
14:17 < hyper_ch> krzie: so, another two weeks waiting
14:17 < krzie> lol
14:17 < hyper_ch> :)
14:18 < krzie> 2.3 will hopefully be fully released in 2011...
14:18 < krzie> 3.0 wont be in beta for a long time
14:19 < hyper_ch> krzie: if you wouldn't hang around here all the time but actually do some coding, ovpn 3 would already have been released
14:21  * hyper_ch hides
14:21 < krzie> im not a real coder :-p
14:21 < krzie> if openvpn was bash ild be all over it
14:21 < hyper_ch> I mean openvpn is client and server at the same time
14:21 < hyper_ch> the only thing it would need to do hand out credentials between clients to setup a tunnel between them
14:22 < hyper_ch> for p2p it would be really great :)
14:23 < Bushmills> not only.  client-server-client can deal nicely with NAT.  two natted clients will have problems
14:23 < krzie> right but it goes plop in the middle of ugly code that nobody wants to touch
14:23 < krzie> nah Bushmills theres a way around that
14:23 < krzie> as mentioned in my post in wishlist
14:23 < krzie> !wishlist
14:23 <@vpnHelper> Clear example || firewall for blocking ddos attacks || Non-Admin usage of OpenVPN on Windows || my wish || suggested MSS feature for "proto tcp" operation || Please fix Win32/64bit Tap Tunnel Adapter!!! || OpenVPN over ICMP || my other wish || my wish - Push Option || Add product version information to the windows binaries || Kill The Resources Being Used By OpenVPN Desktop Client ||
14:23 <@vpnHelper> passtos working on windws || common-name-as-username || --shaper and --server together || Windows auto-connect when starting gui || sctp implementation in openvpn || OpenVPN on a Nokia phone with Symbian^3 || Multicast support in tap-win32 (with patch) || OpenVPN to filter DHCP requests in bridge mode || my wish || cryptoapicert and ca || Root Permission Restart || Reject pushed
14:23 <@vpnHelper> directives (eg. routes) via client config || openvpn and a different ntlm auth || Port Hopping... || FIPS-compliant OpenVPN || Symbian^3 support || Windows Client Source Code + Build Instructions || Define one or more networks on one OpenVPN instance || Compiling OpenVPN v2.1.2 with enable-password-save option || OpenVPN client for the iPhone and iPad || authenticate to socks daemon || (1 more message)
14:23 < krzie> oh god
14:23 < krzie> theres a wishlist rss now so it reports in dev chan, forgot bout that
14:24 < hyper_ch> just imagine, bittorrent where the tracker is able to establish a vpn between the clients
14:24 < ecrist> !factoids wishlist
14:24 < hyper_ch> so the actual bittorrent users can't be traced back anymore
14:24 < krzie> !factoids whatis wishlist
14:24 <@vpnHelper> "wishlist" is https://forums.openvpn.net/viewforum.php?f=10 for the openvpn wishlist
14:24 < ecrist> there ya go
14:29 < krzie> https://forums.openvpn.net/topic141.html
14:29 <@vpnHelper> Title: OpenVPN Support Forum Idea for direct connections : Wishlist (at forums.openvpn.net)
14:32 < krzie> we talked about that a bit in one of the early dev meetings, the devs explained why it wont be thought of until ovpn 3.0
14:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:35 < hyper_ch> krzie: can you somehow cat all files and files in subfolders to grep them for a string?
14:36 < krzie> why bother with cat?
14:36 < hyper_ch> what els?
14:36 < krzie> grep -r "string" *
14:37 < krzie> hehe
14:37 < hyper_ch> oh... I usually do  cat file | grep string
14:37 < Bushmills> well, that's the easy way. but not what he asked :)
14:37 < krzie> kill the cat!
14:37 < hyper_ch> everybody loves cats
14:38 < krzie> KILL THE CAT!
14:38  * krzie kills hyper_ch's cat
14:38 < hyper_ch> which one of them?
14:38 < hyper_ch> and they are all cute
14:38 < krzie> the one you type before |grep
14:38 < hyper_ch> :)
14:38 < hyper_ch> btw, I have a problem with git
14:39 < hyper_ch> shouldn't there be a ~/.git folder or something that contains user data?
14:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 264 seconds]
14:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:40 < krzie> 570 people in #git
14:40 < krzie> :-p
14:45 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
14:48 < EugeneKay> They're a buncha gits
14:48 < EugeneKay> And your data is kept in ~/.gitconfig
14:48 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:49 < hyper_ch> EugeneKay: that folder does not exist for me
14:49 < EugeneKay> It's not a folder, it's a config file
14:49 < hyper_ch> oh
14:49 < EugeneKay> man git-config, I think it is
14:49 < hyper_ch> thx :)
15:03 -!- luneff [~yury@84.51.197.177] has joined #openvpn
15:11 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
15:16 -!- queequeg1_ [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
15:17 < Bushmills> hyper_ch:   cat file | cat
15:18 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Ping timeout: 252 seconds]
15:18 -!- queequeg1_ is now known as queequeg1
15:18 < Bushmills> just for consistency
15:19 < Bushmills> also very cute are constructs like     echo foo | cat
15:20 < Bushmills> earlier i've seen this:  (19:27:00) Mmike: Justin, heh. I've just placed a script to /etc/cron.hourly that does just: echo `date` >> /tmp/mylog.log
15:23 -!- luneff [~yury@84.51.197.177] has quit [Quit: This computer has gone to sleep]
15:37 -!- K1ng [~KING@180.211.188.77] has quit [Read error: Connection reset by peer]
15:38 -!- K1ng [~KING@180.211.188.77] has joined #openvpn
15:43 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
15:48 -!- Yen [~Yen@unaffiliated/yen] has quit []
15:54 -!- pyther [~pyther@cpe-76-189-207-159.neo.res.rr.com] has joined #openvpn
15:54 -!- pyther [~pyther@cpe-76-189-207-159.neo.res.rr.com] has quit [Changing host]
15:54 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
15:56 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
16:04 -!- K1ng` [~KING@180.211.188.72] has joined #openvpn
16:07 -!- K1ng [~KING@180.211.188.77] has quit [Ping timeout: 276 seconds]
16:12 < oc80z> yo
16:13 < krzie> yohhh
16:14 < krzie> nice host ;]
16:14 < krzie> lol Bushmills 
16:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:22 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Read error: Operation timed out]
16:23 < oc80z> heh
16:24 < oc80z> been fuckin with privoxy
16:24 < oc80z> so much shit ported from adbusters , focusing on the struct and pointers to ->csp_* 
16:25 < oc80z> i patched parsers.c to write/read client-headers and continue, but its not working well. 
16:34 -!- Salz` [~Salz@f054107134.adsl.alicedsl.de] has joined #openvpn
16:45 -!- yell0 [yello@unaffiliated/contempt] has quit [Read error: Operation timed out]
16:48 < Dougy> wut
16:49 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
16:51 -!- Salz` [~Salz@f054107134.adsl.alicedsl.de] has left #openvpn ["Linkinus - http://linkinus.com"]
16:54 -!- K1ng` [~KING@180.211.188.72] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
17:14 < oc80z> nada
17:15 < oc80z> just injecting shit.
17:15 < oc80z> (not the white rush)
17:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:21 -!- EugeneKay is now known as EugeneKaway
17:25 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:00 -!- affix0 [~acccccc@042-120-128-083.dynamic.caiway.nl] has quit [Ping timeout: 252 seconds]
18:09 -!- EugeneKaway is now known as EugeneKay
18:28 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Quit: >:o]
18:35 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 260 seconds]
18:41 -!- Kateon_ [482392@xs8.xs4all.nl] has joined #openvpn
18:41 -!- testing-1 [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
18:46 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:49 < bystander> good day. has anyone of you had an experience on trying ping tunnel? I was asking because I would like to know if ping tunnel only accepts eth0 interface .
18:51 -!- pyther24_ [~pyther@cpe-76-189-207-159.neo.res.rr.com] has joined #openvpn
18:53 -!- Netsplit *.net <-> *.split quits: @mattock, fahadsadah, Rolybrau, bigon, krzie, Fiouz, Fleck, amero, pa, [intra]lanman,  (+7 more, use /NETSPLIT to show all of them)
18:53 -!- jetole_ [~jetole@irc.fossl.net] has joined #openvpn
18:53 < bystander> any inputs guys
18:54 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has joined #openvpn
18:55 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit []
18:59 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
18:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:59 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
18:59 -!- Hamlin [~Hamlin@2001:470:7:2b8::2] has joined #openvpn
18:59 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
18:59 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
18:59 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
18:59 -!- 18WAAFIZG [martin@shell.ipv6.octocore.net] has joined #openvpn
18:59 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
18:59 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
18:59 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
19:03 -!- pyther24_ is now known as pyther
19:03 -!- pyther [~pyther@cpe-76-189-207-159.neo.res.rr.com] has quit [Changing host]
19:03 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
19:04 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
19:05 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
19:06 -!- pa [~pa@unaffiliated/pa] has quit [Max SendQ exceeded]
19:07 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
19:08 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
19:13 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:15 < rommel092079> how can I create a tun0 network interface without opening the openvpn service yet?
19:17 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:18 < rommel092079> how can I create a tun0 network interface without opening the openvpn service yet?
19:26 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
19:29 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:40 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:46 -!- cali [~cali@unaffiliated/cali] has quit [Read error: Operation timed out]
19:46 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
19:47 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Ping timeout: 240 seconds]
19:47 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
19:48 -!- SWAT [~swat@ubuntu/member/swat] has quit [Ping timeout: 240 seconds]
19:48 -!- krzii [krzee@hemp.ircpimps.org] has joined #openvpn
19:48 -!- SWAT [~swat@ubuntu/member/swat] has joined #openvpn
19:48 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
19:48 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:13 -!- master_of_master [~master_of@p57B558AD.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:15 -!- master_of_master [~master_of@p57B558C2.dip.t-dialin.net] has joined #openvpn
20:54 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:06 -!- krzii [krzee@hemp.ircpimps.org] has quit [Quit: Leaving]
21:06 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
21:11 -!- Champi [Champi@rootshell.fr] has joined #openvpn
21:16 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:18 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
21:21 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
21:21 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
21:24 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:36 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:37 < bystander> good day guys, I would like to ask how I can implement a username and password authentication when I have a icmp tunnel?
21:37 < bystander> I know this is not an ovpn question but I dont know where to ask assistance for this one.
21:37 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 264 seconds]
21:40 < bystander> how does openvpn authenticates the username/password before connection is fully established?
21:54 < pwrcycle> bystander: it doesn't. connection comes first.
21:55 < bystander> pwrcycle: ok. then after connecting to ther server, what is the next move?
21:55 < pwrcycle> basically, routing is authenticated by user/pass. there's an option to disconnect invalid users/connection types.
21:56 < pwrcycle> if you're using pam, then the server asks for user/pass.  if you're successful, you get the "push"
21:56 < bystander> I would like to know how I can apply the same authentication procedure that openvpn do to icmp tunnel
22:06 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
22:07 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has quit [Ping timeout: 252 seconds]
22:08 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 264 seconds]
22:09 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
22:09 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
22:30 -!- K1ng [~KING@180.211.188.70] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:36 -!- K1ng [~KING@180.211.188.70] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:41 -!- ttelford [~ttelford@2001:55c:43a6:444b:2006:5fbd:4bb1:6a9f] has joined #openvpn
22:41 -!- ttelford [~ttelford@2001:55c:43a6:444b:2006:5fbd:4bb1:6a9f] has quit [Client Quit]
22:46 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:47 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:53 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:58 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
23:17 <@vpnHelper> RSS Update - forum: I can log in to Openvpn using ANY user's credentials <http://forums.openvpn.net/topic8307.html>
23:43 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 240 seconds]
23:44 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
23:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
--- Day changed Thu Jun 16 2011
00:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:33 -!- K1ng [~KING@180.211.188.70] has joined #openvpn
00:58 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
00:59 < bystander> guys how does openvpn reads the username and password for authentication from client to server before finalizing the connection initialization process.
01:05 <@vpnHelper> RSS Update - forum: Multiple authentication method <http://forums.openvpn.net/topic8308.html>
01:13 < bystander> guys how does openvpn reads the username and password for authentication from client to server before finalizing the connection initialization process.
01:15 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Remote host closed the connection]
01:19 < EugeneKay> Magic.
01:20 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:21 -!- mode/#openvpn [+o mattock] by ChanServ
01:21 < bystander> EugeneKay can you show me how that was done?
01:21 < EugeneKay> Nope.
01:21 < bystander> Why not sir?
01:23 < bystander> I want to apply that authentication procedure to other tunneling
01:33 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: Connection reset by peer]
01:35 <@vpnHelper> RSS Update - forum: I can log in to Openvpn using ANY user's credentials <http://forums.openvpn.net/topic8307.html#p12978> || Multiple authentication method <http://forums.openvpn.net/topic8308.html#p12977>
01:38 -!- bauruine [~stefan@217.150.234.219] has quit [Ping timeout: 276 seconds]
01:41 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
01:41 <@vpnHelper> RSS Update - forum: Forum search doesn't really work <http://forums.openvpn.net/topic8309.html>
01:47 <@vpnHelper> RSS Update - forum: PAM Authentication - how to hand user/pass vars to a script <http://forums.openvpn.net/topic8310.html> || Forum search doesn't really work <http://forums.openvpn.net/topic8309.html#p12980>
01:51 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
01:53 -!- dazo_afk is now known as dazo
02:05 <@vpnHelper> RSS Update - forum: OpenVPN between 2 servers. <http://forums.openvpn.net/topic8311.html#p12985> || PAM Authentication - how to hand user/pass vars to a script <http://forums.openvpn.net/topic8310.html#p12984>
02:11 <@vpnHelper> RSS Update - forum: Forum search doesn't really work <http://forums.openvpn.net/topic8309.html#p12987>
02:13 -!- EugeneKay is now known as EugeneKaway
02:15 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:26 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:26 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: Connection reset by peer]
02:29 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
02:40 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has left #openvpn []
02:41 -!- luneff [~yury@84.51.197.177] has joined #openvpn
02:41 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
02:42 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
02:53 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
02:54 <@vpnHelper> RSS Update - forum: I can log in to Openvpn using ANY user's credentials <http://forums.openvpn.net/topic8307.html#p12988>
02:59 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
03:05 -!- luckman212_ [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
03:06 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:06 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:07 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Ping timeout: 260 seconds]
03:16 <@vpnHelper> RSS Update - forum: [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12989>
03:51 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
03:52 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
03:56 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
03:58 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
03:59 -!- mattock_ [~mattock@dyn55-11.yok.fi] has joined #openvpn
04:02 < mattock_> what is the most likely issue preventing packets from being forwarded from external interface to openvpn server's tun interface? according to pflog (freebsd) they don't get blocked by pf, either.
04:03 < mattock_> so, packets arrive to the external server interface just fine, and the client gets an IP and all
04:03 < mattock_> but last step (re0 -> tun1) on server side seems to fail
04:08 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has joined #openvpn
04:08 <@vpnHelper> RSS Update - forum: PAM Authentication - how to hand user/pass vars to a script <http://forums.openvpn.net/topic8310.html#p12990>
04:08 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
04:31 -!- luckman212_ [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Read error: Connection reset by peer]
04:31 < amero> is it possible to find out settings that server pushes to clients?
04:32 < amero> when you are a client
04:33 <@mattock> lemme check
04:34 <@mattock> hmm, interesting... now pings get through
04:34 <@mattock> without making any changes
04:37 -!- mattock_ [~mattock@dyn55-11.yok.fi] has quit [Quit: Leaving]
04:57 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
05:01 -!- luneff [~yury@84.51.197.177] has quit [Ping timeout: 244 seconds]
05:04 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:04 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has joined #openvpn
05:10 < amero> ?
05:20 <@vpnHelper> RSS Update - forum: newb needs help <http://forums.openvpn.net/topic8312.html>
05:24 -!- luneff [~yury@84.51.212.81] has joined #openvpn
05:30 < defswork> amero, logs show them
05:36 -!- th0mi [~anonymous@pd95b7a4a.dip0.t-ipconnect.de] has joined #openvpn
05:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:39 < th0mi> Hi there, i have question regarding a reconnection issue. we have openvpn site 2 site setup and everything is working fine. just every once in a while (serveral days) the client gets disconnected and never comes back up again. issue seems to be "Cannot allocate TUN/TAP dev dynamically" b/c openvpn is downgrading to nobody. is there any other way around this except running openvpn as root all the time? systems are all debian etch and default
05:39 < th0mi> packages.
05:40 < th0mi> any hints would be appreciated! 
05:41 < th0mi> !welcome
05:41 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:42 < th0mi> !goal
05:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:43 -!- th0mi [~anonymous@pd95b7a4a.dip0.t-ipconnect.de] has left #openvpn []
05:44 -!- th0mi [~anonymous@pd95b7a4a.dip0.t-ipconnect.de] has joined #openvpn
05:46 < amero> i really dont understand this. in the sample server config, you use --server directive which is only relevent to server mode but you left --mode unspecified which make it defaults to p2p
05:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
05:46 < amero>  --mode m
05:46 < amero>               Set OpenVPN major mode.  By default, OpenVPN runs  in  point-to-
05:46 < amero>               point   mode   ("p2p").   OpenVPN  2.0  introduces  a  new  mode
05:47 < amero>               ("server") which implements a multi-client server capability.
05:50 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 276 seconds]
05:50 <@vpnHelper> RSS Update - forum: Please Help <http://forums.openvpn.net/topic8088.html#p12992>
05:52 < dazo> amero: if you read --server carefully in the man page, you'll see that --server is kind of like a macro ... it expands to include --mode server
05:53 < dazo> plus a few other things as well
05:54 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
05:56 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:16 -!- th0mi [~anonymous@pd95b7a4a.dip0.t-ipconnect.de] has quit [Quit: th0mi]
06:17 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
06:18 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
06:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
06:29 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
06:29 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
06:29 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:29 -!- lie [~hakon@213.52.48.101] has joined #openvpn
06:30 < Bushmills> though    "if dev tap OR (dev tun AND topology == subnet):"   could be    "if dev tap OR topology == subnet:"
06:32 < lie> Hey, I have been set on a task to fix some configuration on a OpenVPN server without actually be knwoing what I am doing
06:32 < Bushmills> !howto
06:32 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:32 < lie> The problem is that the server gives it's clients IP's like 10.8.0.30 and the next one gets 10.8.0.34
06:33 < Bushmills> !net30
06:33 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
06:33 < lie> Ah, i will atake a look at it and see if that has anything the the problem to to. Thanks :)
06:38 < lie> Yeah, I will hear with those people here who knows OpenVPN before I will test it, but out of my knowledge that's the right thing
06:42 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
06:46 < Bushmills> i suspect you've given a task you know not much about has been done with the purpose of getting you familiar with the subject
06:48 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: Farewell]
06:48 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
06:53 < lie> Bushmills: Talking to me? I lost the chatlog so I can't see what over your last sentence
06:54 < lie> Well, I am here only for some days. At our school we are being placed out to work for some days to get work experience, so I choosed to work at a company here which gave me that task. 
06:55 < lie> They don't have any Windows clients atm, but they can't be sure if the will have it later or not, so we can't use that directive
07:02 -!- 18WAAFIZG is now known as Martin
07:02 -!- Martin is now known as Guest73601
07:02 -!- Guest73601 is now known as Martin
07:03 -!- Martin is now known as Guest23766
07:07 < lie> xit
07:07 -!- lie [~hakon@213.52.48.101] has quit [Quit: Leaving]
07:08 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
07:08 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:13 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has quit [Remote host closed the connection]
07:14 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has joined #openvpn
07:16 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
07:18 <@vpnHelper> RSS Update - forum: [SOLVED] [Newbie]How can i fix this <http://forums.openvpn.net/topic8286.html#p12994> || PAM Authentication - how to hand user/pass vars to a script <http://forums.openvpn.net/topic8310.html#p12993>
07:31 <@vpnHelper> RSS Update - forum: Please Help <http://forums.openvpn.net/topic8088.html#p12995>
07:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
07:37 -!- EugeneKaway is now known as EugeneKay
07:49 <@mattock> does "--topology subnet" somehow affect client configuration directives? On a server that uses my client gets IP address of 10.100.52.2, even though I got a CCD with this in it:
07:49 <@mattock> "ifconfig-push 10.100.52.5 10.100.52.6"
07:49 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:49 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:49 < dazo> mattock: subnet will give a more "normal" subnet instead of individual /30 nets per connection
07:50 < dazo> topology subnet will give the same subnetting as --dev tap normally gives
07:50 <@mattock> dazo: how do I push an IP address to the client, then?
07:50 <@mattock> (I'm integrating the tests to buildbot, with 1 and 2 already working) 
07:51 <@mattock> third is the "topology subnet" test
07:51 < dazo> mattock: try using netmask as the second argument
07:51 < dazo> instead of IP address
07:51 <@mattock> I tried 10.100.52.6 10.100.52.255 already, but I'll retry just in case
07:52 < dazo> 10.100.52.255 that's not a netmask ... try 255.255.255.0 ;-)
07:52 < dazo> 10.100.52.255 smells like broadcast :)
07:52 <@mattock> oh yes, my bad probably :D
07:54 -!- corretico [~luis@201.201.44.82] has quit [Read error: Operation timed out]
07:56 <@mattock> nope, something else
07:56 < dazo> !logs
07:56 < dazo> :-P
07:56 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:00 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:03 <@mattock> from /var/log/messages on server: "MULTI_sva: pool returned IPv4=10.100.52.2"
08:03 <@mattock> it should be 10.100.52.6
08:09 <@mattock> more digging then ...
08:12 -!- dazo is now known as dazo_afk
08:18 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
08:19 -!- dazo_afk is now known as dazo
08:25 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
08:56 -!- Rudolf [~rodolfo@unaffiliated/rudolf] has joined #openvpn
08:57 -!- Rudolf [~rodolfo@unaffiliated/rudolf] has left #openvpn []
09:17 -!- reactor16 [~reactor16@webjethost.org] has joined #openvpn
09:17 < reactor16> hi all
09:19 -!- reactor16 [~reactor16@webjethost.org] has left #openvpn []
09:19 -!- reactor16 [~reactor16@webjethost.org] has joined #openvpn
09:21 < reactor16> any toolz for openvpn configuration ?
09:23 < krzee> !confgen
09:23 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
09:24 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
09:29 < Dougy> meh.
09:29 < Dougy> sup krzee 
09:29 < Dougy> long time no speak
09:30 < krzee> g'mornin bud
09:30 < krzee> how ya doin?
09:31 < ecrist> Dougy: ovpnforum.com expires in Aug, want to renew, or transfer to me?
09:33  * hyper_ch claims dibs on the domain :)
09:34 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:38 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
09:40 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
09:46 -!- Muty [~amir@unaffiliated/muty] has quit [Ping timeout: 240 seconds]
09:49 -!- guifort [~guifort@ns208662.ovh.net] has joined #openvpn
09:58 -!- Lenhix [ElChaman@190.146.247.20] has joined #openvpn
10:04 -!- pablo_ [0fcbe94f@gateway/web/freenode/ip.15.203.233.79] has joined #openvpn
10:05 < amero> what does this mean and how to fix it
10:05 < amero> "Need IPv6 code in mroute_extract_addr_from_packet"
10:05 < dazo> cron2: ^^^ got any clues?
10:06 < pablo_> hi, is openvpn uses tcp over tcp?
10:06 < pablo_> s/is/ /
10:07 < pablo_> ah, it can run over udp?
10:08 < krzee> are you using --server as well as --server-ipv6?
10:08 < krzee> or just --server-ipv6?
10:08 -!- guifort [~guifort@ns208662.ovh.net] has quit [Quit: Quitte]
10:10 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:11 < amero> krzee: you're asking to me?
10:12 < krzee> yes
10:12 < amero> just --server
10:13 < krzee> oh weird
10:13 < krzee> nothing ipv6 in your setup?
10:14 < amero> nothing. and i dont see that --server-ipv6 directive in man
10:14 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
10:15 < krzee> right, its only in snapshots
10:15 < krzee> it'll exist in 2.3
10:16 < hyper_ch> hmmmm, someone is developping code on windows with git and a non-default port for ssh on the git repository?
10:16 -!- pablo_ [0fcbe94f@gateway/web/freenode/ip.15.203.233.79] has quit [Ping timeout: 252 seconds]
10:19 <@vpnHelper> RSS Update - forum: openvpn on fedora 14 <http://forums.openvpn.net/topic8313.html>
10:23 < amero> krzee: do you think --tun-ipv6 will fix it?
10:23 < krzee> are you doing anything with ipv6?
10:26 < amero> yea but it's not really important
10:30 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 255 seconds]
10:30 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
10:31 < krzee> pls explain what you are doing with ipv6 over openvpn
10:31 < krzee> then we can tell you what you may need to change
10:32 < dazo> hyper_ch: isn't it just to use this scheme?   ssh://[user@]{host}[:port]/{path}
10:33 < dazo> hyper_ch: otherwise, you can also add a 'fake' Host entry in the ~/.ssh/config equivalent on Windows ... where Port and User is set .... 
10:34 < dazo> s/'fake'//
10:34 < dazo> krzee: would you be willing to give a new patch I have ready out for a whirl?  ... trac ticket #73
10:35 < EugeneKay> ssh:// is largely optional, and I never use :22. I'm also not sure how ports interact with things like gitolite that don't use a / base.
10:35 < krzee> lemme look
10:37 < EugeneKay> I also have proper search domains setup in /etc/resolv.conf. My shorthand ends up being gitolite@code:Project/repo
10:37 < dazo> krzee: http://www.fpaste.org/rGQL/
10:38 < krzee> i can test this on freebsd and osx
10:39 < krzee> any sort of stress you want me to invent for it?
10:39 < dazo> krzee: well, it basically tries to scream and abort execution if directories/files are wrong/missing/permission issues 
10:40 < dazo> krzee: so if you have something which uses different kind of features ... that'd be good .... maybe even --chroot
10:40 < krzee> permission issues like ccd being root and permissins being dropped?
10:40 < krzee> and key being readonly root, and permissions dropped / no persist options?
10:40 < dazo> yeah, such things as well ... even though, I dont' check for that explicit
10:41 < dazo> ^^  permissions being dropped, that is
10:41 < dazo> key being read-only root, should be checked somewhere else iirc ... if not, that's something we can add on top of this
10:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:48 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
10:48 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
10:48 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:51 < krzee> ohhhh i see
10:51 < krzee> this should improve errors for wrong paths
10:51 < krzee> that will be great!
10:51 -!- EugeneKay is now known as EugeNapping
10:52 < krzee> (ssl's error kinda sucks)
10:56 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
10:57 -!- skx [~skx@unaffiliated/skx] has joined #openvpn
10:57 < skx> !help
10:57 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
10:57 < krzee> !goal
10:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:57 < skx> no, I wanted to talk to the bot, it wasn't just a general call for help :) 
11:01 -!- skx [~skx@unaffiliated/skx] has left #openvpn []
11:01 < EugeNapping> !factoids
11:01 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
11:01 < EugeNapping> Oh, he's buggered off
11:01  * EugeNapping rolls over into pillow
11:02 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 244 seconds]
11:02 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
11:10 < reactor16> !conf
11:10 < reactor16> !config
11:10 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
11:11 < krzee> (with an s)
11:14 < reactor16> what mean this "Do you have a client with a LAN behind it which should be able to access the VPN?"
11:14 < reactor16> mean if client is under router ?
11:14 < krzee> im not sure how to say that more clearly
11:14 < krzee> no
11:15 < reactor16> ?
11:15 < krzee> its asking if your clients lan should be accessible to vpn clients, or maybe access services on the vpn
11:15 < krzee> should the lan be aware of the vpn and visa-versa?
11:15 -!- chantra [~chantra@unaffiliated/chantra] has quit [Quit: leaving]
11:16 < reactor16> client--->router---->vpn
11:16 < krzee> so the clients lan does not need access to the vpn?
11:16 < reactor16> lan of what ?
11:16 < krzee> the lan the client is on!
11:17 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
11:17 < reactor16> there two way to reach vpn , there are who are connected directely to the vpn 'using cable ..ect'
11:17 < krzee> what?
11:18 < krzee> im starting to think you're rather new to networking... is this the case?
11:18 < reactor16> and second via router 'using dsl routers ..ect"
11:18 < reactor16> i know base of networking 
11:18 < krzee> ok well your client is on a lan
11:19 < krzee> should that lan ALSO have access to the vpn, or just the client itself?
11:19 < krzee> the entire lan is capable of routing over the client's vpn connection, if you so choose
11:20 < reactor16> ok
11:20 -!- dazo is now known as dazo_afk
11:20 < reactor16> i think i begin understand
11:20 < reactor16> something like site to site configuration
11:21 < krzee> not really
11:21 < krzee> something like this:
11:21 < krzee> !route
11:21 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:21 < EugeNapping> Im in ur kernel routin ur packets
11:21 < krzee> all up in the kernel, like KFC
11:22 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
11:23 < reactor16> any one tried openvpn on openvz
11:23 < krzee> many people have
11:24 < krzee> is your goal to route your internet traffic over the vpn?
11:25 < reactor16> yes
11:28 < reactor16> Cannot open dh1048.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
11:28 < krzee> you didnt make that file
11:28 < reactor16> file exist it have 250kb
11:28 < krzee> then you dont have it in the right path
11:29 < reactor16> is file corupted or something ?
11:29 < krzee> !dh
11:29 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
11:29 < krzee> you made it like that?
11:29 < hyper_ch> dazo: problem is Windows :)
11:29 < hyper_ch> no ~/.ssh/config there
11:30 < krzee> !windows
11:30 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
11:30 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has joined #openvpn
11:31 < reactor16> :D my brain crupted " mv dh1024.pem dh1048.pem"
11:31 < krzee> it shouldnt be 1048
11:31 < krzee> 1024 or 2048
11:32 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has quit [Client Quit]
11:32 < reactor16> it was 2048 in cfg i was change it
11:33 < krzee> you could always change the filename in the config to match reality
11:33 < krzee> (if you have use 1024
11:33 < krzee> either way, just make them match
11:33 < reactor16> !ta
11:34 < reactor16> how to generate ta.key
11:35 < krzee> !hmac
11:35 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
11:35 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
11:36 < reactor16> can i disable it ?
11:36 < krzee> yes, but its good for security
11:36 < krzee> and super easy to make
11:36 < krzee> openvpn --genkey --secret ta.key
11:36 < krzee> then you use the same file on server and all clients
11:38 -!- dazo_afk is now known as dazo
11:44 < dazo> hyper_ch: but I'm sure there is a equivalent to ~/.ssh/config on Windows  ... it gotta be ... or else that ssh implementation is crippled to the almost useless variant ... I mean, even putty support that, with its profiles ... from cmdline, you just do putty @{profilename} ....
11:44 < Kateon_> I'm trying to DNAT a port to a host inside a openvpn network, but when trying to netcat something over, it keeps silent.
11:45 < hyper_ch> dazo: I was told tortoisgit can do it
11:47 < dazo> yuck! ... windows git gui ... the only thing which is more wrong is CVS ....
11:47 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
11:51 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
11:51 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
11:52 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
11:52 -!- Cain` is now known as Cain
11:53 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
11:53 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
11:53 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
11:53 < krzee> Kateon_, you dnat to the VPN ip?
11:53 < Kateon_> krzee: yes
11:53  * EugeNapping cuddles SmartGit
11:53 < krzee> your service (or nc) listens on the vpn ip?
11:54 < krzee> Kateon_, check firewalls... if you can ping both ways then its not an openvpn issue
11:54 < Kateon_> yes, it does. the host inside openvpn is simply echoing something to a listening netcat
11:54 < krzee> and sniff packets with tcpdump
11:55 < krzee> (you can sniff the tun device)
11:55 < Kateon_> does this look sane? iptables -A PREROUTING -t nat -p tcp --dport 2525 -j DNAT --to 10.7.0.3:2525
11:55 < krzee> honestly i wouldnt know, i dont use linux / iptables
11:55 < Kateon_> ok, i'll see if i can get more out of tcpdump.. i tried earlier, but no packets would be captured when trying to initiate a connection to that port.
11:59 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
12:02 < Kateon_> hmm, perhaps i'm not capturing packets on the machine that is forwarding the port, since it's being prerouted?
12:02 < Kateon_> (bbl)
12:02 < hyper_ch> dazo: you're one of those people who think that git is cvs done right?
12:03 < krzee> linus would fight you for saying that
12:03 -!- reactor16 [~reactor16@webjethost.org] has quit [Remote host closed the connection]
12:04 < hyper_ch> linus really exists? I heard it was jsut one of those internet myths
12:04 < krzee> well he used to
12:04 < krzee> now hes just a script
12:04 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
12:04 < krzee> with really good uptime
12:04 < hyper_ch> isn't Bill Gates truly Linus Torvalds - because he wanted to create a good OS?
12:05 < krzee> linux didnt make bsd
12:05 < krzee> err
12:05 < krzee> linus*
12:05 < krzee> :-p
12:05 < hyper_ch> isn't BSD just a myth as well?
12:05 < dazo> hyper_ch: cvs was right in the last millennium 
12:06 < hyper_ch> and svn in the last decennial?
12:06 < krzee> bsd is dead =[
12:06 < hyper_ch> and for the next X years it's git?
12:06 < dazo> svn!?  what's that?
12:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:06 < dazo> ;-)
12:06 < hyper_ch> svn is cvs reloaded
12:07 < dazo> hyper_ch++
12:07 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html>
12:07 < dazo> svn == cvs over http/https
12:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
12:11 < amero> im not quite happy with the transfer rate im getting through my vpn. are there anymore settings that i could fiddle around with to increase the rate while minimizing the overhead?
12:11 < krzee> possibly:
12:11 < krzee> !mtu
12:11 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
12:11 < amero> here's my config: http://pastebin.com/SkYbzXJz
12:12 < krzee> also using udp as transport protocol is often recommended
12:12 < krzee> s/often//
12:12 <@vpnHelper> RSS Update - forum: Restarting OpenVPN Server <http://forums.openvpn.net/topic8285.html#p12998>
12:12 < amero> yes i am using udp
12:12 < krzee> you already use udp
12:13 < krzee> so test mtu, thats the only thing i can think of...
12:13 < krzee> but do expect your speed to be lower while tunneling your traffic
12:13 < dazo> don't forget !gigabit for even more tweaks
12:13 < amero> what about sndbuf and rcvbuf?
12:14 < amero> !gigabit
12:14 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
12:14 < dazo> amero: but wait until you have the mtu stuff correct ... or else !gigabit stuff is a waste of time
12:16 < amero> ok i am going to try that now
12:18 <@vpnHelper> RSS Update - forum: Bridge Trouble - Server Unreachable <http://forums.openvpn.net/topic8315.html>
12:21 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Read error: Connection reset by peer]
12:24 < amero> i think it's done now. this is what i see in my client log
12:24 < amero> NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1526,1526] remote->local=[1526,1526]
12:25 < amero> so what's the next step?
12:44 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
12:50 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:59 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
12:59 -!- mode/#openvpn [+o patelx] by ChanServ
13:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
13:17 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
13:19 -!- raidzx [~raidz@46-105-63-15.kimsufi.com] has quit [Quit: Leaving]
13:24 -!- EugeNapping is now known as EugeneKay
13:32 < amero> krzee
13:32 < amero> krzee | but do expect your speed to be lower while tunneling your traffic
13:32 < amero> i'm aware of that but how come i was able to get close to my usual transfer speed with another vpn that i paid for?
13:39 < ecrist> amero: how the hell are we supposed to know that?
13:45 < amero> ecrist: not really asking a question but just venting out my frustration
14:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:08 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
14:10 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:12 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 244 seconds]
14:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:15 < krzee> !git
14:15 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git, or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git,, or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi, or (#4) See !git-doc how to use git
14:15 < krzee> (for me)
14:27 <@vpnHelper> RSS Update - forum: Windows Installation Issue <http://forums.openvpn.net/topic8316.html>
14:48 < amero> how do we delete extra tun device?
14:50 < ecrist> depends on the OS
14:50 < amero> ubuntu
14:52 -!- djmed [~djmed@squareroot.divisionbyzero.net] has joined #openvpn
14:52 < djmed> !welcome
14:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:53 < djmed> !howto
14:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:53 < djmed> !goal
14:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:54 -!- djmed [~djmed@squareroot.divisionbyzero.net] has left #openvpn []
14:56 -!- bauruine [~stefan@217.150.234.219] has joined #openvpn
15:12 < Riz> !/30
15:12 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
15:12 < Riz> !topology
15:12 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
15:19 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:31 -!- bauruine [~stefan@217.150.234.219] has quit [Ping timeout: 276 seconds]
15:41 -!- skyweb [~skyweb@host144-231-dynamic.2-87-r.retail.telecomitalia.it] has joined #openvpn
15:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:20 -!- luneff [~yury@84.51.212.81] has quit [Quit: Leaving]
16:23 -!- dazo is now known as dazo_afk
16:34 < amero> !tls-server
16:34 < amero> !dh
16:34 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
16:37 -!- reactor16 [~reactor16@webjethost.org] has joined #openvpn
16:38 -!- reactor16 [~reactor16@webjethost.org] has left #openvpn []
16:47 -!- EugeneKay is now known as EugeneKaway
16:47 -!- bauruine [~stefan@217.150.234.219] has joined #openvpn
16:59 -!- EugeneKaway is now known as EugeneKay
17:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
17:11 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 246 seconds]
17:13 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
17:16 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
17:23 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
17:28 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
17:28 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
17:28 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
17:31 -!- EugeneKay is now known as EugeneKaway
17:32 -!- jetole_ is now known as jetole
17:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:55 -!- grendal_prime [~sgraham@2001:470:822a:200:21e:c9ff:fe07:bb9] has joined #openvpn
17:55 < grendal_prime> where is the list of pushable optionis?
17:55 < grendal_prime> options that is
17:56 < grendal_prime> im trying to figure out if i can push -shape ?
17:59 -!- skyweb [~skyweb@host144-231-dynamic.2-87-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
18:04 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 276 seconds]
18:11 -!- bauruine [~stefan@217.150.234.219] has quit [Ping timeout: 276 seconds]
18:19 -!- Lenhix [ElChaman@190.146.247.20] has quit [Quit: Mindwall!!]
18:26 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
18:31 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
18:32 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
18:35 -!- grendal_prime [~sgraham@2001:470:822a:200:21e:c9ff:fe07:bb9] has quit [Quit: Ex-Chat]
18:35 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Ping timeout: 255 seconds]
18:38 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
18:43 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
19:10 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
19:10 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
19:10 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
19:12 -!- patel is now known as patelx
19:12 -!- patelx [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Changing host]
19:12 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
19:38 -!- Kateon_ [482392@xs8.xs4all.nl] has quit [Ping timeout: 276 seconds]
19:38 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
19:46 -!- EugeneKaway is now known as EugeneKay
19:46 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
19:53 -!- lulzsec [mouse@2001:b18:4059:0:41a7:17d9:41c4:323d] has joined #openvpn
19:57 -!- TobbeTK [TobbeTK@s83-179-15-20.cust.tele2.se] has joined #openvpn
19:58 < TobbeTK> Hi. Can anyone explain to me or point me into the right direction. I'm testing netcat on a port. It all works fine when I check if the port is open and give any response. But when I switch on openvpn it won't work. The port times out.
19:59 < TobbeTK> !welcome
19:59 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:59 < TobbeTK> !howto
19:59 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:03 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has quit [Quit: Yippee-kay-yay]
20:04 < TobbeTK> Ok, so i've read the how-to, searched on google. Can't find any good article related to my problem.
20:04 -!- meepmeep [meepmeep@212.24.104.229] has joined #openvpn
20:06 < TobbeTK> Anyone alive?
20:12 -!- master_of_master [~master_of@p57B558C2.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:14 -!- master_of_master [~master_of@p57B55934.dip.t-dialin.net] has joined #openvpn
20:15 < EugeneKay> Nope. Lots of zombies, though
20:16 < TobbeTK> Are zombies any good at openvpn? ;)
20:19 -!- TobbeTK [TobbeTK@s83-179-15-20.cust.tele2.se] has quit []
20:36 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
20:50 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
20:50 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
20:50 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
20:53 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
20:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Client Quit]
21:13 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:31 -!- SSL^ [~SSL@ks30628.kimsufi.com] has joined #openvpn
21:31 < SSL^> hi all
21:32 < SSL^> i would like to know if when we using VPN we can speed up our bandwith ? Oo i think it's impossible but when i'm not connected with openvpn my bandwith is slower
21:37 -!- pyther [~pyther@unaffiliated/pyther] has quit [Ping timeout: 240 seconds]
21:48 <@vpnHelper> RSS Update - forum: PAM Authentication - how to hand user/pass vars to a script <http://forums.openvpn.net/topic8310.html#p13001>
21:48 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:07 -!- argonauts [argonauts@firewall.su] has joined #openvpn
22:09 -!- argonauts [argonauts@firewall.su] has quit [Client Quit]
22:16 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 246 seconds]
22:29 -!- K1ng [~KING@180.211.188.70] has quit [Ping timeout: 240 seconds]
22:30 -!- p33_p33_ [~p33p33@78.129.251.117] has quit [Quit: leaving]
22:31 -!- p33_p33_ [~p33p33@78.129.251.117] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:46 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:46 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:01 -!- argonauts [argonauts@firewall.su] has joined #openvpn
23:03 -!- p33_p33_ [~p33p33@78.129.251.117] has quit [Quit: Lost terminal]
23:06 -!- argonauts [argonauts@firewall.su] has quit [Quit: leaving]
23:07 -!- p33_p33_ [~p33p33@78.129.251.117] has joined #openvpn
23:36 < hyper_ch> hehehehe https://github.com/MrMEEE/bumblebee/commit/a047be
23:36 <@vpnHelper> Title: Commit a047be85247755cdbe0acce6f1dafc8beb84f2ac to MrMEEE/bumblebee - GitHub (at github.com)
23:37 < jpalmer> that github link is certainly making it's rounds.  I've seen that link posted about a dozen times now
23:40 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:41 < bystander> If tunneling over tcp, udp and dns is not permitted can openvpn still connect to the server?
23:42 < jpalmer> if tunneling over tcp,  it doesn't use udp.   as for dns,  the question isn't clear, so i can't answer.
23:44 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
23:44 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:44 < hyper_ch> jpalmer: well, could have happened to me also :)
23:44 < jpalmer> could've happened to anyone
23:45 < bystander> jpalmer, what I mean is that, if I tunnel over tcp or udp or dns, can openvpn client still connect to openvpn server? 
23:45 < jpalmer> if you configure the server to listen for it,  yes.
23:45 < jpalmer> (you can't tunnel over dns, as far as I know.)
23:46 < jpalmer> you can tunnel ove tcp or udp,  as long as the client and server are both using the same protocol.
23:46 < bystander> jpalmer, even if tunneling over tcp is blocked by the isp, i can still connect client to server?
23:46 < hyper_ch> jpalmer: for that reason I usually put paths into quotes
23:46 < bystander> jpalmer, even if tunneling over tcp is blocked by the isp, i can still connect client to server?
23:46 < jpalmer> bystander: think about the question for a second.    you'll figure the answer out.
23:47 < hyper_ch> tunnel over dns?
23:47 < jpalmer> hint:   openvpn requires standard networking protocols to work the way they are designed to work.    if something interferes with the protocols ability to operate,  then it won't operate.
23:48 < bystander> jpalmer, I ask this question because, I was thinking that since if I cannot use tcp or upd or dns if they are blocked but I can tunnel over icmp using other software, I will be using the username/password authentication using openvpn and when connected status I will initiate connection thru icmp using other software.
23:49 < jpalmer> bystander: no offense,  but based on the question,  it sounds like you should probably work towards a fundamental understanding of tcp/udp,  before attempting the advanced concepts like "vpn"
23:50 < jpalmer> bystander: if the traffic is being blocked,  you should probably contact your ISP and have them create an exception.  Violating the ISP's security measures is likely to do nothing but get your account terminated. 
23:50 < bystander> jpalmer, can you direct me to a reading on that fundamentals?
23:51 < jpalmer> I'd suggest a networking book
23:51 < bystander> like?
23:51 < jpalmer> like,  any of them you find on amazon.   networking is networking.  there isn't really a "super great book that stands head and shoulders above the rest"
23:53 < bystander> ok. thanks for the replies and help. :)
23:53 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
23:53 < jpalmer> no worries.  good lick
23:53 < jpalmer> luck
--- Day changed Fri Jun 17 2011
00:00 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
00:20 < amero> is it perfectly normal if you can't ping the openvpn server ip from client in routing mode?
00:25 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
00:33 -!- hpa [hpa@terminus.zytor.com] has quit [Excess Flood]
00:33 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
00:41 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
00:43 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 276 seconds]
00:52 <@vpnHelper> RSS Update - forum: PAM Authentication - how to hand user/pass vars to a script <http://forums.openvpn.net/topic8310.html#p13002>
00:58 < amero> disregard that. firewall issue
01:05 -!- dazo_afk is now known as dazo
01:32 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 252 seconds]
01:34 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
01:39 -!- EugeneKay [eugenekay@2600:3c01::14:713e] has quit [Quit: OMG WTF BBQ ZNC FTW]
01:40 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
01:52 <@vpnHelper> RSS Update - forum: Windows Installation Issue <http://forums.openvpn.net/topic8316.html#p13003>
02:00 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
02:01 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:01 <@vpnHelper> RSS Update - forum: openvpn on fedora 14 <http://forums.openvpn.net/topic8313.html#p13005> || Bridge Trouble - Server Unreachable <http://forums.openvpn.net/topic8315.html#p13004>
02:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
02:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:39 <@vpnHelper> RSS Update - forum: Restarting OpenVPN Server <http://forums.openvpn.net/topic8285.html#p13006>
02:45 <@vpnHelper> RSS Update - forum: openvpn on fedora 14 <http://forums.openvpn.net/topic8313.html#p13008> || [SOLVED] PAM Authentication - how to hand user/pass vars to <http://forums.openvpn.net/topic8310.html#p13007>
02:51 <@vpnHelper> RSS Update - forum: Windows Installation Issue <http://forums.openvpn.net/topic8316.html#p13009>
03:09 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:09 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:11 -!- EugeneKay is now known as EugeneKaway
03:19 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
03:20 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: Connection reset by peer]
03:22 -!- Netsplit *.net <-> *.split quits: defswork, meepmeep, Chris___, dvl, batrick
03:25 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
03:26 -!- Netsplit over, joins: meepmeep, defswork, Chris___, batrick, dvl
03:27 -!- Guest23766 is now known as Martin
03:27 -!- Martin is now known as Guest91092
03:29 -!- Netsplit *.net <-> *.split quits: dvl, batrick, Chris___, SigmaProjects, meepmeep, defswork
03:34 -!- Netsplit over, joins: SigmaProjects, meepmeep, defswork, Chris___, batrick, dvl
03:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
03:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:54 -!- d457k [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Remote host closed the connection]
04:06 -!- rgouveia [~rgouveia@unaffiliated/rgouveia] has joined #openvpn
04:08 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Read error: Operation timed out]
04:09 < rgouveia> hi all ... if my clients certificates expire, can I renew them or I have to issue new ones? I've read on the forums that if the server expires it would have to be a new one, is the client the same?
04:18 < Splex> rgouveia: have to issue new ones
04:18 < Splex> the date is hardcoded in the cert
04:18 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
04:19 < Splex> rgouveia: http://tldp.org/HOWTO/SSL-Certificates-HOWTO/x195.html#AEN215
04:19 <@vpnHelper> Title: Certificate management (at tldp.org)
04:21 < rgouveia> Splex: I c ... at least I can use the old csr to generate a new one. Thanks :-)
04:21 -!- FP|Maverick-werk [~commo@h64-141-120-20.pcccinc.net] has quit [Remote host closed the connection]
04:23 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
04:24 < Splex> rgouveia: right, np :)
04:27 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
04:31 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
04:32 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
04:36 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 250 seconds]
04:38 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
04:42 -!- skyxx [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
04:44 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
04:49 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
04:55 -!- boswarrior1 [~mrnice@78.142.173.114] has joined #openvpn
04:58 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:58 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:58 -!- Uresu [~wes@5ace7bca.bb.sky.com] has joined #openvpn
04:59 < Uresu> !welcome
04:59 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:59 < Uresu> !goal
04:59 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:00 < Uresu> !route
05:00 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
05:02 -!- pyther [~pyther@unaffiliated/pyther] has joined #openvpn
05:02 -!- pyther [~pyther@unaffiliated/pyther] has quit [Client Quit]
05:03 -!- K1ng [~KING@180.211.188.70] has joined #openvpn
05:09 < Uresu> !howto
05:09 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:09 -!- rgouveia [~rgouveia@unaffiliated/rgouveia] has left #openvpn []
05:23 -!- [1]SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
05:26 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Ping timeout: 252 seconds]
05:28 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 260 seconds]
05:32 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
05:43 -!- EugeneKaway is now known as EugeneKay
05:47 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
05:49 < Uresu> Hi All, I am now stuck.   I am trying to access the internet via the VPN.   I have connected OK, DNS works, I can ping 10.8.0.1 and I have set the NAT rule up.   Any idea where to start?
05:49 < EugeneKay> !def1
05:49 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
05:50 < Uresu> push "redirect-gateway def1" is enabled in the conf.
05:50 < EugeneKay> Firewalling is the next likely step
05:50 < Uresu> In the server of the client, or both?
05:51 < EugeneKay> Server. You probably need to have a rule in iptables for nat
05:51 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has joined #openvpn
05:52 < EugeneKay> Something along the lines of iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
05:52 < Uresu> I have a server rule for nat, set like this : iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
05:52 < EugeneKay> Got a hole poked in your filter table?
05:53 < EugeneKay> The best way to determine if it's iptables filtering mucking you up is to simply try it without the firewall :-p
05:54 -!- skyxx [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Ping timeout: 276 seconds]
05:57 -!- boswarrior1 [~mrnice@78.142.173.114] has quit [Quit: Ex-Chat]
06:11 -!- lulzsec [mouse@2001:b18:4059:0:41a7:17d9:41c4:323d] has quit [Quit: Leaving]
06:15 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:21 <@vpnHelper> RSS Update - forum: UPnP over openVPN, is it possible? <http://forums.openvpn.net/topic7498.html#p13010>
06:22 -!- dazo is now known as dazo_afk
06:40 < Bushmills> Uresu: ip forwarding you havent't mentioned
06:47 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
06:48 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
06:54 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
07:00 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Quit: Ex-Chat]
07:20 -!- dazo_afk is now known as dazo
07:25 < Uresu> Hi all, I have checked all those things.   Is there any way to start actually troubleshooting this by looking at logs etc?
07:27 < Uresu> Using tcpdump on tun0 i can see the requests coming in which suggests to me the server is just not able to respond to the client
07:29 -!- Coffe [~niszsse@sto.alatest.se] has joined #openvpn
07:29 < Coffe> Hi, have today a nice working ipv4 setup. but now i need to start using ipv6 also . are using tun , whats the best way of ding it ?
07:33 < EugeneKay> Wait for 2.3.
07:34 < Coffe> and if i cant wait ?
07:34 < EugeneKay> You can use TAP, but it willl cause cancer, AIDS, and eat your puppy. 
07:34 < Coffe> yes i did notice you did say that  :) but will not --tun-ipv6 work ?
07:35 < EugeneKay> Not in any of the released branches.
07:36 < Coffe> ok. so its a fake :P
07:36 < EugeneKay> Though I Am Not An Expert.
07:37 < EugeneKay> !ipv6
07:37 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
07:41 < Coffe> then i have to set up a test tap tunnel then
07:50 -!- patelx [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
07:51 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Ping timeout: 246 seconds]
07:54 -!- karl_ [~karl@194.48.133.8] has joined #openvpn
07:54 < dazo> Coffe: pull the latest snapshots or use the source code from git ... that has all the IPv6 stuff ready
07:55 < dazo> !snapshots
07:55 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
07:55 < dazo> !git
07:55 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git, or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git,, or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi, or (#4) See !git-doc how to use git
07:55 < karl_> hi, i have a problem with openvpn on my openwrt router: http://pastebin.com/CwZ0FsFk
07:55 < karl_> openvpn works via udp but with the same settings does not work via tcp
07:55 < Coffe> dazo,  tnx, but i need to keep wit whats in ubuntu lts
07:56 < dazo> karl_: that's no OpenVPN config file ... we need something more understandable
07:56 < karl_> any ideas why that is ?
07:56 < dazo> Coffe: then you need to wait a while
07:57 < dazo> karl_: see !configs and !logs
07:57 < dazo> !configs
07:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
07:57 < dazo> !logs
07:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
07:57 < Coffe> dazo,  i will do with tap then for now
07:57 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:57 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:57 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:57 < karl_> well thats the openwrt config file, the weird thing is that the exact same config works via udp but not tcp
07:58 < karl_> however, i seem to get a normal vpn connection also via tcp, but then i can only see my local ip, not the sever
07:59 < karl_> it could be a routing issue, i just dont know where to start
08:02 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:02 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p13011>
08:03 < bystander> I would like to know where to ask how to compile source code to tar ball.
08:04 < bystander> and how to compile the source code for windows binary
08:05 < Coffe> --tun-ipv6 so, even taht i have taht option in openvpn , it will not work ?
08:05 < Coffe> that 
08:06 -!- karl_ [~karl@194.48.133.8] has quit [Ping timeout: 240 seconds]
08:06 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
08:28 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
08:29 < amero> tls-auth doesn't in anyway have impact on transfer throughput, right?
08:32 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
08:34 < EugeneKay> The short answer is no, it doesn't.
08:57 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
08:58 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
09:00 -!- Lenhix [~lenhix@190.146.247.20] has joined #openvpn
09:08 < dazo> amero: I doubt it has much impact ... but it adds HMAC data to the stream which is used for authentication
09:15 -!- kombi [~kombi@port-92-198-15-96.static.qsc.de] has joined #openvpn
09:16 < kombi> I just can't get past UDPv4 link remote:[IP] on the client, tried on different machines. That actually means, the client doesn't even reach out to the server, right?
09:22 -!- Riz [~riz@syn.theintertubes.ca] has quit [Quit: server bounce]
09:27 -!- Riz [~riz@syn.theintertubes.ca] has joined #openvpn
09:38 < amero> if i tunnel my web traffic through socks proxy which listens on localhost at the remote vpn endpoint, is that considered as tcp over tcp?
09:41 < pwrcycle> amero: yes, if the vpn also uses tcp
09:41 < pwrcycle> the vpn could use udp, then it'd be tcp over udp.
09:41 -!- kombi [~kombi@port-92-198-15-96.static.qsc.de] has quit [Quit: ircII EPIC4-2.6 -- Are we there yet?]
09:42 -!- Coffe [~niszsse@sto.alatest.se] has quit [Remote host closed the connection]
09:43 < dazo> amero: SOCKS proxy actually avoids TCP-over-TCP ... as your web client connects to the SOCKS proxy and asks the proxy to fetch the data
09:44 -!- Carbon_Monoxide [~cmonxide@014198182222.ctinets.com] has joined #openvpn
09:44 < dazo> amero: TCP-over-TCP is more that you transport TCP traffic inside an already established TCP connection ... so you get two layers of TCP/IP headers
09:45 < dazo> so SOCKS, and most other proxies are actually just serialising the requests, while VPN will encapsulate the traffic
09:45 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
09:47 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Read error: Connection reset by peer]
09:47 < amero> i think i got the idea
09:58 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
09:59 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
10:02 <@vpnHelper> RSS Update - forum: Bridge Trouble - Server Unreachable <http://forums.openvpn.net/topic8315.html#p13012>
10:32 -!- Uresu [~wes@5ace7bca.bb.sky.com] has left #openvpn ["Konversation terminated!"]
10:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Read error: Connection reset by peer]
10:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:00 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has joined #openvpn
11:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:24 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
11:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
12:07 -!- Netsplit *.net <-> *.split quits: meepmeep, Lenhix, Chris___, dvl, defswork, batrick
12:08 -!- Netsplit over, joins: Lenhix, meepmeep, defswork, Chris___, batrick, dvl
12:08 -!- Carbon_Monoxide [~cmonxide@014198182222.ctinets.com] has quit [Ping timeout: 250 seconds]
12:12 -!- dazo is now known as dazo_afk
12:14 -!- Netsplit *.net <-> *.split quits: meepmeep, Lenhix, Chris___, dvl, defswork, batrick
12:16 -!- Netsplit over, joins: Lenhix, meepmeep, defswork, Chris___, batrick, dvl
12:25 -!- Lenhix [~lenhix@190.146.247.20] has quit [Quit: Mindwall!!]
12:41 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
12:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:07 -!- SSL^ [~SSL@ks30628.kimsufi.com] has quit [Ping timeout: 240 seconds]
13:11 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
13:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
13:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:39 -!- Yen [~Yen@unaffiliated/yen] has joined #openvpn
13:44 < pwrcycle> !goal
13:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:45 < pwrcycle> i'd like Linux to not revert back to normal routing when the vpn drops. suggestions?
13:48 < ecrist> --down shutdown -p now
13:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:28 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 260 seconds]
14:33 -!- kraut [~kraut@dyndsl-095-033-153-223.ewe-ip-backbone.de] has joined #openvpn
14:51 -!- luckman212_ [~irc@2001:470:1f07:1225:c99a:b4c:1414:52e] has joined #openvpn
14:54 -!- luckman212 [~irc@2001:470:1f07:1225:7c23:92b3:7e50:df74] has quit [Ping timeout: 260 seconds]
15:13 -!- patelx [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Changing host]
15:13 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
15:23 -!- luckman212_ [~irc@2001:470:1f07:1225:c99a:b4c:1414:52e] has quit [Remote host closed the connection]
15:26 -!- Sky[x] [~SkyB0x@tm.213.143.85.148.dc.telemach.net] has quit [Remote host closed the connection]
15:37 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 246 seconds]
15:37 -!- dazol [~dazo@nat/redhat/x-njzjmcuksjzgpvxl] has joined #openvpn
15:44 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
15:45 -!- kami [~user@unaffiliated/kami-] has joined #openvpn
15:45 < kami> Hello
15:48 < kami> Is it possible to use 2 openvpn connections (over 2 different DSL connections) for failover (and load balancing) ?
15:49 < Riz> Not sure about openvpn, but PPTP/MPD5 will
15:49 < Riz> erm, correction, you could do LB via 2 openvpn connections, but that will only help with multi-threded downloads
15:51 < kami> That'd be OK.
15:52 < Riz> then I feel most of your work will be in the firewall/router configs and not so much ovpn
15:52 < kami> Would that work with tun devices?
15:52 < Riz> yup, should.
15:53 < Riz> I've never used TAP and have done similar things, so don't forsee any issue
15:55 < Riz> now with ppp/mpd if you so wanted, assuming your remote endpoint is the same for both VPN's, you could bond them together into one large pipe...assuming the remote server can handle the bandwidth
15:55 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
15:55 < Riz> and still have failover
16:00 -!- Mtn_Bkng_Dave [Mtn_Bkng_D@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
16:00 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:02 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
16:02 < Mtn_Bkng_Dave> hello
16:02 -!- Mtn_Bkng_Dave [Mtn_Bkng_D@c-24-99-31-48.hsd1.ga.comcast.net] has left #openvpn []
16:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:16 -!- Mtn_Bkng_Dave [~Mtn_Bkng_@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
16:21 -!- Dave1965 [~Mtn_Bkng_@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
16:22 < kami> Riz: where can I read more about configuring ppp/mpd ?
16:22 -!- Mtn_Bkng_Dave [~Mtn_Bkng_@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Ping timeout: 252 seconds]
16:23 < Riz> kami: sorry I don't have anything specific to point you at.
16:23 < Riz> the big G is your friend
16:24 < Riz> You would be using the ppp/mpd daemons to bond using MLPPP
16:24 < Riz> If you search for mpd and MLPPP you should be able to find what your looking for.
16:24 < kami> thanks
16:30 -!- Dave1965 [~Mtn_Bkng_@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Ping timeout: 240 seconds]
16:31 < kami> Riz: do I misunderstand mlppp? What I find says that I need an ISP who supports mlppp. I have two ISPs who provide me with simple pppoe.
16:32 < Riz> yeah, typically that is correct. but MLPPP can be done with standard PPP tunnels
16:33 < Riz> you establish your PPPoE connection to your ISP
16:33 < Riz> then a PPP vpn to your remote endpoint via each ISP and MLPPP with bond the VPN tunnels
16:35 < Riz> Personally, I think it's more headache then it's worth. Unless you really need the added bandwidth for single streams. otherwise LB with ovpn should be much simpler
16:35 < Riz> really it comes down to if you need bonding or just LB/failover. 
16:37 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:38 < kami> Riz: to be honest, what I need most is a config which works on an openwrt box
16:47 < Riz> likely ovpn, but I'm not a wrt user so can't help there
17:02 < kami> Riz: from what I read so far, mlppp sounds too complicated to me. And I have a single openvpn tunnel working. 
17:07 < openbsdnoob> i'm not sure that the openwrt openvpn-build can handle mlppp
17:08 < openbsdnoob> openwrt in general is build for a single conection i guess
17:12 <@vpnHelper> RSS Update - forum: How to modify the code and build it using msys for Windows <http://forums.openvpn.net/topic8317.html>
17:21 -!- dazol [~dazo@nat/redhat/x-njzjmcuksjzgpvxl] has quit [Ping timeout: 244 seconds]
17:58 -!- kami [~user@unaffiliated/kami-] has quit [Ping timeout: 240 seconds]
18:04 -!- Yen [~Yen@unaffiliated/yen] has quit []
18:12 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
18:12 -!- mode/#openvpn [+o dazo_afk] by ChanServ
18:21 < ecrist> that's not true
18:21 < ecrist> openwrt can handle multiple connections
18:30 -!- jake_stone_fl [~jakestone@2416416hfc26.tampabay.res.rr.com] has joined #openvpn
18:30 -!- jake_stone_fl [~jakestone@2416416hfc26.tampabay.res.rr.com] has left #openvpn []
18:32 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 240 seconds]
18:34 < openbsdnoob> ok ecrist ....i think you have more experience than me this this 
18:34 < openbsdnoob> sry for the terible english  
18:40 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
18:40 -!- mode/#openvpn [+o dazo_afk] by ChanServ
18:41 -!- lulzsec [mouse@2001:b18:4059:0:1031:e534:86b1:ea9] has joined #openvpn
18:41 < lulzsec> good evening!
18:43 < ecrist> hi
18:58 -!- K1ng [~KING@180.211.188.70] has quit [Ping timeout: 240 seconds]
19:03 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 276 seconds]
19:09 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
19:10 -!- Carbon_Monoxide [~cmonxide@014198182222.ctinets.com] has joined #openvpn
19:32 -!- K1ng [~KING@180.211.188.88] has joined #openvpn
19:40 -!- pl0sh [pl0sh@201.164.220.12] has joined #openvpn
19:53 < pl0sh> !goal
19:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:54 < pl0sh> I just need/want to access the lan behind the server.. I am using Freebsd, I almost have it set up, but I can't get connected..
19:54 -!- Guest28992 is now known as caesay
19:54 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
19:54 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
20:09 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:11 -!- master_of_master [~master_of@p57B55934.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:15 -!- master_of_master [~master_of@p57B549FE.dip.t-dialin.net] has joined #openvpn
20:20 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
20:22 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
20:27 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
20:43 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
20:59 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
21:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 260 seconds]
21:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:31 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Excess Flood]
21:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
21:36 -!- bauruine [~stefan@2001:8e0:100b:dead:441c:46df:8ed:eeec] has joined #openvpn
21:39 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Remote host closed the connection]
21:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 258 seconds]
21:47 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
21:48 -!- Carbon_Monoxide [~cmonxide@014198182222.ctinets.com] has quit [Ping timeout: 252 seconds]
22:01 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
22:07 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
22:09 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:11 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
22:11 -!- mode/#openvpn [+o dazo_afk] by ChanServ
22:13 -!- bauruine [~stefan@2001:8e0:100b:dead:441c:46df:8ed:eeec] has quit [Remote host closed the connection]
22:21 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 258 seconds]
22:24 -!- Carbon_Monoxide [~cmonxide@014198182222.ctinets.com] has joined #openvpn
22:34 -!- intralanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 244 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:44 -!- Splex [~splex@unaffiliated/splex] has quit [Quit: leaving]
22:47 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
22:52 -!- Dougy [me@tech.qsi.net] has quit [Ping timeout: 252 seconds]
22:53 -!- Dougy [me@tech.qsi.net] has joined #openvpn
22:55 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:55 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:41 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
23:41 -!- intralanman [~lanman@2001:470:8:e2:21b:63ff:fec2:d835] has quit [Quit: This computer has gone to sleep]
--- Day changed Sat Jun 18 2011
00:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
00:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:51 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
00:52 -!- oc80z [oc80z@blea.ch] has joined #openvpn
01:01 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
01:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
01:06 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
01:06 -!- oc80z [oc80z@blea.ch] has joined #openvpn
01:16 -!- Carbon_Monoxide [~cmonxide@014198182222.ctinets.com] has quit [Quit: Leaving]
02:56 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 260 seconds]
03:02 -!- EugeneKay is now known as EugeneKaway
03:16 -!- kami [~user@unaffiliated/kami-] has joined #openvpn
03:16 -!- kami [~user@unaffiliated/kami-] has left #openvpn []
04:12 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
04:17 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
04:36 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
04:36 < venom00ut> hello
04:37 < venom00ut> is it possible to ignore just the push'd routes and not the other commands?
05:15 -!- Klavier [~Klavier@unaffiliated/klavier] has joined #openvpn
05:35 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:59 -!- djc [~djc@gentoo/developer/djc] has joined #openvpn
06:00 <@vpnHelper> RSS Update - forum: Problem activating Licences on new server <http://forums.openvpn.net/topic8318.html>
06:03 < djc> does anyone know of a solution to do http-over-openvpn on iOS devices?
06:40 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
06:40 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
06:49 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
07:11 -!- kaeptn_fjutscha [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
07:17 -!- kaeptn_fjutscha [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
07:22 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
07:22 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
07:31 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
07:35 < Mtn_Bkng_Dave> !goal
07:35 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:36 < Mtn_Bkng_Dave> !welcome
07:36 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:36 < Mtn_Bkng_Dave> !route
07:36 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
07:41 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
07:41 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
07:49 < Mtn_Bkng_Dave> !help
07:49 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
07:49 < Mtn_Bkng_Dave> !sample
07:49 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
07:51 < Mtn_Bkng_Dave> is there a help file for Buffalo?
07:51 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p13016>
08:01 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
08:01 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
08:22 <@vpnHelper> RSS Update - forum: Tapatalk <http://forums.openvpn.net/topic8319.html>
08:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
08:46 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
08:46 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
08:57 < Mtn_Bkng_Dave> anybody here know the configuration for a buffalo router with dd-wrt?
08:57 < Mtn_Bkng_Dave> got a new firmware update and its a little different
08:59 < Mtn_Bkng_Dave> !dd-wrt
09:13 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
09:14 -!- venom00ut [~venom00@unaffiliated/venom00] has quit []
09:14 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
09:14 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Remote host closed the connection]
09:20 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
09:21 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Remote host closed the connection]
09:30 -!- lulzsec [mouse@2001:b18:4059:0:1031:e534:86b1:ea9] has quit [Quit: Leaving]
09:35 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
09:38 -!- Lenhix [ElChaman@190.146.247.20] has joined #openvpn
09:54 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
09:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:11 -!- kombi [~kombi@port-92-198-15-96.static.qsc.de] has joined #openvpn
10:12 < kombi> the windows client doesn't get out, telnet [host] 1194 from a dos window does. What might be wrong?
10:13 < kombi> (I'm running tcpdump on the other end)
10:14 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Remote host closed the connection]
10:28 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
10:40 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
10:40 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
10:43 < Mtn_Bkng_Dave> does anybody here know anything about open vpn on the new buffalo firmware?
10:45 -!- kombi [~kombi@port-92-198-15-96.static.qsc.de] has quit [Quit: ircII EPIC4-2.6 -- Are we there yet?]
10:47 < Mtn_Bkng_Dave> !welcome
10:47 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:47 < Mtn_Bkng_Dave> !wiki
10:47 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
10:49 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
10:58 -!- Guest91092 is now known as Martin`
11:00 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
11:01 -!- DDave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
11:02 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
11:03 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
11:03 -!- Cain` is now known as Cain
11:04 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
11:04 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Ping timeout: 258 seconds]
11:05 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
11:05 -!- DDave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has left #openvpn []
11:07 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
11:07 < Mtn_Bkng_Dave> can anyone here help me with a setup on a buffalo router build?
11:08 < Mtn_Bkng_Dave> i cant find a wiki for it
11:15 <@vpnHelper> RSS Update - forum: client config files automatically being created in ccd <http://forums.openvpn.net/topic8320.html>
11:27 <@vpnHelper> RSS Update - forum: client config files automatically being created in ccd <http://forums.openvpn.net/topic8320.html#p13019>
11:33 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
11:33 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
12:22 -!- Lenhix [ElChaman@190.146.247.20] has quit [Quit: Mindwall!!]
12:38 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Read error: Connection reset by peer]
12:39 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
12:39 <@vpnHelper> RSS Update - forum: OPENVPN reconnect/resume after Provider initiated disconnect <http://forums.openvpn.net/topic8321.html>
12:40 < Mtn_Bkng_Dave> !firewall
12:40 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
12:43 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
12:45 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Remote host closed the connection]
12:45 <@vpnHelper> RSS Update - forum: Buy 2 get 1 free + free shipping:iPhone 4G/iPad2. <http://forums.openvpn.net/topic8323.html> || wts:Blackberry Bold Torch 9900/iPhone 4G/iPad2/Nokia X7:offe <http://forums.openvpn.net/topic8322.html>
12:45 -!- EugeneKaway is now known as EugeneKay
12:45 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
12:47 -!- pl0sh [pl0sh@201.164.220.12] has quit []
12:54 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
12:54 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
12:56 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
12:57 <@vpnHelper> RSS Update - forum: OpenVPN very slow - Less then 8KB/s <http://forums.openvpn.net/topic8227.html#p12876> || OpenVPN GUI do not shutdown on AUTH_FAILED <http://forums.openvpn.net/topic8291.html#p12874>
12:57 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Read error: Connection reset by peer]
12:58 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
13:04 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
13:19 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Read error: Connection reset by peer]
13:20 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
13:23 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Read error: Connection reset by peer]
13:25 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
13:38 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:43 -!- SOG [~SOG@113.89.214.117] has joined #openvpn
13:45 -!- SOG [~SOG@113.89.214.117] has quit [Remote host closed the connection]
13:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:54 -!- gabrieIcz [gabrielcz@190.246.212.171] has joined #openvpn
13:54 < gabrieIcz> Hi all there...
13:55 < gabrieIcz> I have a problem. I have a openvpn server runing, and I have my mac client working... the problem starts when I try to use the openvpn gui client! I can connect, but server drop me the connection
13:55 < gabrieIcz> any clue?
14:04 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:17 < krzee> what openvpn gui client?
14:27 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
14:32 < krzee> gabrieIcz, ^
14:54 -!- B_H1 [~NM@173.236.108.149] has joined #openvpn
14:55 < B_H1> hi i read wiki pages , and searching google 
14:55 < B_H1> and checkout forum but cuze tons of question posted there dont find right answer 
14:55 < krzee> !welcome
14:55 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:56 < B_H1> !redirect
14:56 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:56 < B_H1> kraut: : tanx
14:56 < B_H1> !def1
14:56 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
14:57 < krzee> np
15:05 < B_H1> !nat
15:05 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:05 < B_H1> !linnat
15:06 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
15:06 < B_H1> !openvzlinnat
15:06 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
15:13 < gabrieIcz> krzee sry, was out...
15:13 -!- luneff [~yury@84.51.212.81] has joined #openvpn
15:13 < gabrieIcz> openvpn 1.0.3 - A
15:14 < gabrieIcz> on windows 7 64
15:14 < krzee> whered you download it from (the link)
15:14 < gabrieIcz> http://ufpr.dl.sourceforge.net/project/openvpn-gui/Snapshot%20Binaries/openvpn-gui-20110301170456.exe
15:14 <@vpnHelper> Title: Download OpenVPN GUI from SourceForge.net (at ufpr.dl.sourceforge.net)
15:14 < krzee> !download
15:14 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
15:18 < gabrieIcz> i download from there ...
15:18 < gabrieIcz> you like a reinstall to be sure?
15:18 < gabrieIcz> i can save my client.ovpn config
15:19 < krzee> if you downloaded from !download, why did you give me a sourceforge link?
15:20 < gabrieIcz> hooo 
15:20 < gabrieIcz> sry, i thought that was a bot link sending me to  http://www.openvpn.net/download
15:20 -!- B_H [~NM@109.162.224.24] has joined #openvpn
15:20 < gabrieIcz> i click link on channel
15:21 < gabrieIcz> i need to download from bot?
15:21 < gabrieIcz> !download
15:21 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
15:21 < krzee> it was, and openvpn.net/download != your sourceforge link
15:21 < gabrieIcz> I see. yes :(
15:21 < gabrieIcz> mistaken
15:21 < krzee> are you using the same certificates for the windows client as the mac client?
15:21 < krzee> (i just realized you're talking about 2 different clients)
15:22 < gabrieIcz> yes same ones
15:22 < krzee> ok thats the problem then
15:23 < gabrieIcz> two different clients (one on mac, and this on win7
15:23 < krzee> you need different certs for each user
15:23 < gabrieIcz> ups
15:23 < krzee> when the second logs in, it disconnects the first
15:23 < EugeneKay> Or the option that enables that, but it's a stupid option.
15:23 < gabrieIcz> but, i can connect..  the it drop me out
15:23 < gabrieIcz> be a key prob?
15:23 < krzee> [13:23]  <krzee> when the second logs in, it disconnects the first
15:23 < EugeneKay> By default you can only have one connection per key at a time
15:23 < krzee> !duplicate
15:23 <@vpnHelper> "duplicate" is the option duplicate-cn is for allowing the same cert to login more than once. It should not be used in most situations, with main exceptions being if you also use !authpass or if just testing
15:24 < gabrieIcz> hoo 
15:24 < krzee> go make more certs
15:24 < krzee> do it right
15:24 < gabrieIcz> i have my mac connected, and trying to connect from here...
15:24 -!- B_H1 [~NM@173.236.108.149] has quit [Ping timeout: 255 seconds]
15:24 < gabrieIcz> :(
15:24 < gabrieIcz> now im reinstalling jejejeje   
15:25 < krzee> and always download openvpn from the openvpn site :-p
15:25 < gabrieIcz> will do
15:25 < gabrieIcz> sry, another ...
15:25 < gabrieIcz> use ipad..
15:25 -!- B_H [~NM@109.162.224.24] has quit [Read error: Connection reset by peer]
15:26 < gabrieIcz> i see that the only way to connect to is jailbrak..  is that right?
15:27 < EugeneKay> Yes, Apple hates their users.
15:27 < krzee> yes, it is right
15:27 < krzee> ~iphone
15:27 < krzee> !iphone
15:27 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
15:27 <@vpnHelper> iPhone and iPad.
15:28 < krzee> definitely requires jailbreak
15:28 < gabrieIcz> thanks
15:29 < krzee> yw
15:34 < gabrieIcz> must restart
15:34 < gabrieIcz> thanks you dude! :)
15:34 -!- gabrieIcz [gabrielcz@190.246.212.171] has quit []
15:36 -!- [1]SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: Connection reset by peer]
15:37 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
15:45 -!- gabrielcz [~gabrielcz@190.246.212.171] has joined #openvpn
15:45 < gabrielcz> hello again.
15:45 < gabrielcz> problem solved !
15:45 < gabrielcz> thanks! 
15:46 < gabrielcz> krzee now i have another question.. :)
15:46 < gabrielcz> how can i generate other cert? 
15:46 < gabrielcz> for other client
15:46 < krzee> heh
15:46 < krzee> !pki
15:46 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
15:46 <@vpnHelper> specially as a server (see !servercert)
15:47 < gabrielcz> question, can i generate the ca.crt or is one crt per server?
15:48 < gabrielcz> i dont undestand question :/
15:48 < gabrielcz> i mean...
15:48 < gabrielcz> i need one ca.crt per client?
15:48 < krzee> no
15:49 < krzee> one ca per PKI setup
15:49 < gabrielcz> different names ?
15:49 < krzee> you must understand pki before you should admin an openvpn setup
15:50 < gabrielcz> where can i take a read for that?
15:50 < gabrielcz> or you have a command to explain me ;)
15:50 < gabrielcz> jejeje
15:51 < krzee> http://www.internet-computer-security.com/VPN-Guide/PKI.html
15:51 <@vpnHelper> Title: PKI Public Key Infrastructure - How PKI and CA's work (at www.internet-computer-security.com)
15:51 -!- K1ng` [~KING@180.211.188.88] has joined #openvpn
15:52 -!- K1ng [~KING@180.211.188.88] has quit [Read error: Connection reset by peer]
15:52 < krzee> http://www.mitre.org/news/the_edge/february_01/steve.html
15:52 <@vpnHelper> Title: MITRE | The Edge | How Does PKI Work? (at www.mitre.org)
15:52 < krzee> basically, google pki
15:52 < krzee> :-p
16:05 < EugeneKay> Im in ur PKI generating ur keys
16:05 < krzee> hah
16:05 < krzee> EugeneKay, you saw that anon and lulzsec seem to be at war?
16:05 < EugeneKay> I did not
16:05 < EugeneKay> I hope the FBI rapes them all
16:05 < krzee> http://gizmodo.com/5812373/lulzsec-hackers-go-to-war-with-4chan
16:05 <@vpnHelper> Title: Lulzsec Hackers Go to War with 4chan (at gizmodo.com)
16:06 < EugeneKay> Lulz
16:06  * EugeneKay is hungry 
16:16 < krzee> !blame
16:16 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault, or (#2) According to krzee, it's always dazo's fault
16:16 < EugeneKay> !beer
16:16 <@vpnHelper> "beer" is its what's for dinner!
16:16 < EugeneKay> !vend
16:16  * EugeneKay kicks the machine
16:17 < EugeneKay> Why doesn't it ever vend? :-(
16:26 <@vpnHelper> RSS Update - forum: client config files automatically being created in ccd <http://forums.openvpn.net/topic8320.html#p13025> || Problem activating Licences on new server <http://forums.openvpn.net/topic8318.html#p13024> || OPENVPN reconnect/resume after Provider initiated disconnect <http://forums.openvpn.net/topic8321.html#p13023>
16:27 -!- luneff [~yury@84.51.212.81] has quit [Quit: Leaving]
16:27 -!- gabrielcz [~gabrielcz@190.246.212.171] has quit []
16:29 -!- EugeneKay [eugenekay@pitofsnakesandbrokenglass.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
16:29 -!- EugeneKaway [~eugenekay@pitofsnakesandbrokenglass.com] has joined #openvpn
16:29 -!- EugeneKaway is now known as EugeneKay
16:29 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:31 -!- Klavier [~Klavier@unaffiliated/klavier] has quit [Ping timeout: 246 seconds]
17:02 -!- EugeneKay is now known as EugeneKaway
17:04 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Read error: Connection reset by peer]
17:05 -!- EugeneKaway is now known as EugeneKay
17:05 -!- gabrielcz [~gabrielcz@190.246.212.171] has joined #openvpn
17:11 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
17:27 -!- EugeneKay is now known as EugeneKaway
17:27 -!- EugeneKaway is now known as EugeneKay
17:38 <@vpnHelper> RSS Update - forum: OpenVPN Site to Site Connection Using DD-WRT Capable Routers <http://forums.openvpn.net/topic7049.html#p13026>
17:40 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:40 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:44 <@vpnHelper> RSS Update - forum: Looking for some I can pay to setup OpenVPN on dd-wrt <http://forums.openvpn.net/topic8324.html>
17:50 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:55 -!- gabrieIcz [~gabrielcz@190.246.212.171] has joined #openvpn
17:56 -!- freaky[t]_ [alpha@freakyonline.de] has quit [Remote host closed the connection]
17:58 -!- gabrielcz [~gabrielcz@190.246.212.171] has quit [Ping timeout: 240 seconds]
18:03 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
18:04 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
18:04 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:10 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
18:10 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:15 < SJr> Hey what is the name of the adapter in Windows for OpenVPN
18:15 < SJr> I have added it, but it doesn't actually seem to be named anyone
18:19 < krzee> openvpn --show-adapters
18:21 <@vpnHelper> RSS Update - forum: Unable to connect to servers hostname <http://forums.openvpn.net/topic8325.html>
18:23 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
18:24 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:33 -!- affix0 [~acccccc@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
18:42 -!- EugeneKay is now known as EugeneKaway
18:46 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
18:47 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has quit [Client Quit]
18:48 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
18:51 -!- K1ng` [~KING@180.211.188.88] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
18:52 -!- EugeneKaway is now known as EugeneKay
18:53 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 258 seconds]
19:14 -!- K1ng [~KING@180.211.188.88] has joined #openvpn
19:43 -!- amero [~amero@unaffiliated/amero] has quit [Quit: Leaving [WeeChat 0.3.5]]
19:59 -!- Klavier [~Klavier@78.186.208.5] has joined #openvpn
20:11 -!- gabrielcz [~gabrielcz@190.246.212.171] has joined #openvpn
20:13 -!- master_of_master [~master_of@p57B549FE.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
20:15 -!- master_of_master [~master_of@p57B5633B.dip.t-dialin.net] has joined #openvpn
20:18 -!- Klavier [~Klavier@78.186.208.5] has quit [Ping timeout: 264 seconds]
20:37 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
20:53 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
21:05 < gabrielcz> anyone is here?
21:06 < gabrielcz> I have a openvpn working using key to auth, NOW, i like to use key AND username/passwd to connect to.  any clue?
21:06 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
21:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
21:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:39 -!- gabrielcz [~gabrielcz@190.246.212.171] has quit []
21:39 -!- gabrielcz [gabrielcz@190.246.212.171] has joined #openvpn
21:40 -!- gabrielcz [gabrielcz@190.246.212.171] has quit [Client Quit]
21:43 -!- gabrieIcz [~gabrielcz@190.246.212.171] has quit [Ping timeout: 264 seconds]
21:54 -!- bystander [475e9251@gateway/web/freenode/ip.71.94.146.81] has joined #openvpn
21:55 < bystander> good day all. I have my first question: in the description of openvpn on its manual it states that "OpenVPN is a robust and highly flexible VPN daemon. OpenVPN supports SSL/TLS security, ethernet bridging, TCP or UDP tunnel transport through proxies or NAT, support for dynamic IP addr esses and DHCP, scalability to hundreds or thousands of users, and portability to most major OS platforms. "
21:56 -!- affix0 [~acccccc@042-120-128-083.dynamic.caiway.nl] has quit [Ping timeout: 252 seconds]
21:56 < bystander> so it can accomodate thousands of users. but some says it can only accomodate up to 200 users. why is this?
21:57 < EugeneKay> Number of clients depends upon the host OS and the hardware.
21:58 < EugeneKay> I don't know where to point you for data on the subject off the top of my head, but, generally speaking, OpenVPN is limited by throughput(1GbE is the most I've seen) more than anything else
21:59 < bystander> Ok. so it depends upon the os and hardware. what os and hardware will support that thousand users?
21:59 < EugeneKay> On most setups you can use additional servers to scale sideways to add more users.
21:59 < EugeneKay> I dunno, I Am Not An Expert :-p
22:00 < EugeneKay> I believe that BSD has the "best" support, and someting with a 4+ cores should be able to handle the SSL up to 1GbE or so
22:00 < bystander> EugeneKay, to whom can I possible ask the question that I can get the answer?
22:01 < EugeneKay> If you want self-supported(build it yourself), just be patient. If you want commercial, bug the OpenVPN support center guys
22:02 < EugeneKay> !gigabit
22:02 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
22:02 < EugeneKay> YOu can read that while you wait
22:02 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:03 < bystander> thanks eugenekay
22:11 -!- p33_p33_ [~p33p33@78.129.251.117] has quit [Quit: leaving]
22:14 < bystander> EugeneKay, what i have understood in that article that you gave me about gigabit is the use of mtu,fragment, mssfix,cipher and auth and including engine aesni
22:16 < bystander> that removing the encyption and decryption routines of the openssl library and improving the mtu will greatly improve the network performance.
22:17 < bystander> what do you think?
22:27 -!- bystander [475e9251@gateway/web/freenode/ip.71.94.146.81] has quit [Quit: Page closed]
22:28 < EugeneKay> I think I want a cheeseburger, but I know I don't have any beef in the fridge.
22:28 < EugeneKay> So, I'm pretty screwed for dinner.
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 250 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:54 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:54 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:03 -!- bystander [475e9251@gateway/web/freenode/ip.71.94.146.81] has joined #openvpn
23:04 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
23:05 < bystander> guys I have question. in my server configuration i have -server 50.8.0.0 255.255.255.0 but why in my client I have my ip at 50.8.1.x?
23:13 < EugeneKay> Oh snap. I found burger patties in the freezer. :-D
23:14 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:16 -!- bystander [475e9251@gateway/web/freenode/ip.71.94.146.81] has quit [Ping timeout: 252 seconds]
--- Day changed Sun Jun 19 2011
01:20  * EugeneKay belches 
01:20 < EugeneKay> Tasty cheezburger ^_^
01:29 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Read error: No route to host]
01:31 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has joined #openvpn
01:31 <@vpnHelper> RSS Update - forum: Unable to connect to servers hostname <http://forums.openvpn.net/topic8325.html#p13029>
02:07 -!- EugeneKay is now known as EugeneKaway
02:09 -!- EugeneKaway is now known as EugeneKay
02:18 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
02:26 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:01 -!- gallatin [~gallatin@dslb-188-109-154-132.pools.arcor-ip.net] has joined #openvpn
03:11 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:11 -!- mode/#openvpn [+o mattock] by ChanServ
03:20 <@vpnHelper> RSS Update - forum: Unable to connect to servers hostname <http://forums.openvpn.net/topic8325.html#p13030>
03:23 -!- EugeneKay is now known as EugeneKaway
03:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:36 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
05:02 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
05:03 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
05:07 -!- gallatin [~gallatin@dslb-188-109-154-132.pools.arcor-ip.net] has quit [Quit: Client exiting]
05:09 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
05:21 -!- EugeneKaway is now known as EugeneKay
05:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:15 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
06:25 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
06:49 -!- luneff [~yury@84.51.212.81] has joined #openvpn
07:13 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
07:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
07:59 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
08:22 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
08:34 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
08:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
08:58 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
09:00 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
09:05 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
09:31 -!- p33_p33_ [~p33p33@78.129.251.117] has joined #openvpn
09:33 -!- djc [~djc@gentoo/developer/djc] has left #openvpn []
09:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
09:51 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
10:20 <@vpnHelper> RSS Update - forum: Bridge Trouble - Server Unreachable <http://forums.openvpn.net/topic8315.html#p13031>
10:26 -!- p33_p33_ [~p33p33@78.129.251.117] has quit [Quit: Lost terminal]
10:32 -!- sidewalk [sidewalk@shell.glassbilen.net] has quit [Ping timeout: 260 seconds]
10:42 -!- luneff [~yury@84.51.212.81] has quit [Ping timeout: 240 seconds]
10:45 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
10:45 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:46 < amero> could we actually set up openvpn to work the same way as hamachi's peer to peer where all clients could communicate directly with each others bypassing the server?
10:48 < Bushmills> no
10:48 < Bushmills> at least not yet
10:49 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
10:55 < amero> alright
10:55 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:58 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
11:02 -!- luneff [~yury@84.51.197.107] has joined #openvpn
11:03 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has joined #openvpn
11:06 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has quit [Client Quit]
11:08 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:32 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
11:33 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
11:38 < Bushmills> you could emulate a similar setup, by running a server on each machine, and multiple clients to every other machine 
11:42 -!- p33_p33_ [~p33p33@78.129.251.117] has joined #openvpn
11:45 < p33_p33_> so i get an error when starting vpn server Sun Jun 19 18:29:47 2011 us=334971 failed to find GID for group nobody
11:46 < p33_p33_> any sugestions
11:46 < ecrist> you don't have a group 'nobody' on your system...
11:46 < ecrist> that's pretty easy to figure out.
11:47 < p33_p33_> ok
11:47 < krzie> spain has been protesting for over a month, are you paying attention now?
11:47 < krzie> http://www.livestream.com/spanishrevolutionsol
11:47 <@vpnHelper> Title: SpanishRevolutionSol - live streaming video powered by Livestream (at www.livestream.com)
11:49 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:51 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
11:51 < Bushmills> in syria, protestors are on the streets too. contrary to spain, the army has been sent in
11:52 < Bushmills> oh, did anyone forget about libya, btw ...
11:53 < Bushmills> though nato forces could intervene in spain before going to syria - much closer to libya ...
11:53 < Bushmills> ehm, not really "much"
11:54 < p33_p33_> I do have a group nobody and aslo a user nobody in that group
11:54 < p33_p33_> any other sugestions
11:55 < Bushmills> p33_p33_:   grep nobody /etc/groups   yields nothing, i suppose. that as what your error message complains about
11:56 < p33_p33_> nobody:x:1002:
11:56 < Bushmills>  /etc/group  i mean.
11:57 < Bushmills> "...and aslo a user nobody in that group" no, you don't. but that's not what your error is about
11:58 < Bushmills> what does     grep nogroup /etc/group     show?
11:59 < p33_p33_> nogroup:x:65534:
11:59 < Bushmills> why do you add such a strange group name as "nobody" if there is a perfectly well suited group "nogroup"?
12:00 < Bushmills> nobody usually refers to low priv user, while nogroup refers to low priv group
12:00 < Bushmills> or said differently, you'd expect  nobody in your passwd file, and nogroup in your group file
12:03 < p33_p33_> Got it running forgot to add the user to the group thank you guys
12:10 -!- fremo [~fremo@noc.toile-libre.net] has quit [Ping timeout: 260 seconds]
12:10 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Ping timeout: 252 seconds]
12:12 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
12:16 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
12:16 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
12:16 < Mtn_Bkng_Dave> !iroute
12:16 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
12:17 < Mtn_Bkng_Dave> !ccd
12:17 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
12:17 < Mtn_Bkng_Dave> !route
12:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:13 -!- EugeneKay is now known as EugeneKaway
13:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
13:25 < Mtn_Bkng_Dave> according to thehelp file the iroute command only exists on the client?
13:25 < Mtn_Bkng_Dave> is this true
13:25 < Mtn_Bkng_Dave> or should it be on the server side as well?
13:34 <@vpnHelper> RSS Update - forum: Unable to connect to servers hostname <http://forums.openvpn.net/topic8325.html#p13032>
13:59 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:08 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 260 seconds]
14:11 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
14:13 -!- DDave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
14:13 -!- DDave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Client Quit]
14:14 -!- Mtn_Bkng_Dave [~Dave1965@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Ping timeout: 255 seconds]
14:24 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
14:32 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
14:33 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:31 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
15:38 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
15:38 -!- XND [XND@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
15:38 < XND> hi
15:39 < XND> any openVPN developers around looking for a very small project?
15:44 < XND> >?<
15:51 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:51 -!- XND [XND@93-97-41-44.zone5.bethere.co.uk] has quit [Ping timeout: 252 seconds]
16:05 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:09 < krzie> wow someone needs to learn how to package his questions
16:09 < krzie> lol
16:30 -!- XND [~XND@93-97-41-44.zone5.bethere.co.uk] has joined #openvpn
16:30 -!- XND [~XND@93-97-41-44.zone5.bethere.co.uk] has quit [Client Quit]
16:49 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
16:59 -!- Klavier [~Klavier@217.131.39.154] has joined #openvpn
17:06 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 276 seconds]
17:15 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
17:28 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
17:28 <@vpnHelper> RSS Update - forum: OpenVPN - bugging the internet, especially google <http://forums.openvpn.net/topic8304.html#p13033>
18:05 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:05 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
18:12 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
18:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
18:42 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 250 seconds]
18:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:51 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
18:52 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:56 -!- K1ng` [~KING@180.211.188.250] has joined #openvpn
18:58 -!- K1ng [~KING@180.211.188.88] has quit [Ping timeout: 240 seconds]
19:05 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
19:06 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
19:07 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
19:07 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:10 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
19:13 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:15  * Dougy punches krzie 
19:26 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
19:38  * krzie donkey punches dougy
19:38 -!- K1ng [~KING@180.211.188.71] has joined #openvpn
19:40 -!- K1ng` [~KING@180.211.188.250] has quit [Ping timeout: 250 seconds]
19:44 < Dougy> ouch
19:52 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 255 seconds]
19:59 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
20:03 -!- luneff [~yury@84.51.197.107] has quit [Quit: This computer has gone to sleep]
20:04 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
20:05 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
20:13 -!- master_of_master [~master_of@p57B5633B.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
20:14 -!- master_of_master [~master_of@p57B55A7B.dip.t-dialin.net] has joined #openvpn
20:15 -!- kisom [~x@c-74dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 246 seconds]
20:24  * Dougy cunt punts krzie 
20:29 -!- EugeneKaway is now known as EugeneKay
20:57  * krzie is in your bitcoin wallet, stealing your coinz
21:02 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
21:03 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
21:06 < EugeneKay> lol bitcoin
21:07 < EugeneKay> Cryptographically guaranteed semi-anonymous  transactions are a "good idea", but bitcoin as a real-world usable currency is stupid.
21:09 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
21:10 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:25 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
21:25 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
21:41 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
21:53 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
22:05 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
22:08 <@vpnHelper> RSS Update - forum: VPN to join two VPCs (Amazon virtual private clouds) <http://forums.openvpn.net/topic8326.html>
22:09 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
22:27 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:44 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has joined #openvpn
22:52 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has quit [Remote host closed the connection]
22:53 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has joined #openvpn
22:58 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
23:01 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:02 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
23:05 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has quit [Remote host closed the connection]
23:08 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
23:17 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
23:17 -!- EugeneKay is now known as iPhone4
23:18 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
23:22 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 244 seconds]
23:37 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
23:43 -!- iPhone4 is now known as EugeneK
23:45 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
--- Day changed Mon Jun 20 2011
00:06 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
00:10 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
00:11 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
00:12 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
00:33 <@vpnHelper> RSS Update - forum: Multiple Networks with OpenVPN <http://forums.openvpn.net/topic8327.html>
00:35 -!- luneff [~yury@84.51.197.107] has joined #openvpn
00:46 -!- Klavier [~Klavier@217.131.39.154] has quit [Remote host closed the connection]
00:56 -!- EugeneK is now known as EugeneKay
01:03 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 258 seconds]
01:10 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
01:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:43 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
01:58 -!- luneff [~yury@84.51.197.107] has quit [Quit: Leaving]
02:01 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.86.1-rdmsoft [XULRunner 1.9.0.17/2009122204]]
02:05 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 264 seconds]
02:06 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
02:19 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:22 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:25 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
02:25 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:25 -!- mode/#openvpn [+o mattock] by ChanServ
02:39 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Ping timeout: 264 seconds]
02:40 -!- EugeneKay [~eugenekay@pitofsnakesandbrokenglass.com] has quit [Remote host closed the connection]
02:40 -!- EugeneKay [~eugenekay@2001:470:1:24f:b047:a429:81cf:65a8] has joined #openvpn
02:42 -!- AL13N_work [~alien@91.183.52.232] has joined #openvpn
02:45 <@vpnHelper> RSS Update - forum: Multiple Networks with OpenVPN <http://forums.openvpn.net/topic8327.html#p13037> || OpenVPN - bugging the internet, especially google <http://forums.openvpn.net/topic8304.html#p13036>
02:50 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
02:50 -!- janjust [~janjust@lena.nikhef.nl] has joined #openvpn
02:50 -!- janjust [~janjust@lena.nikhef.nl] has quit [Changing host]
02:50 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
02:50 <@vpnHelper> RSS Update - forum: VPN to join two VPCs (Amazon virtual private clouds) <http://forums.openvpn.net/topic8326.html#p13038>
03:00 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
03:03 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
03:04 -!- AL13N_work [~alien@91.183.52.232] has left #openvpn []
03:07 < K1ng> anyone from thailand?
03:28 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
03:28 < krzie> about 67 million people
03:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
03:43 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
03:46 -!- dazo_afk is now known as dazo_
03:46 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
03:47 -!- dazo_ is now known as dazo
04:01 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
04:07 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:23 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:23 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:25 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html>
04:27 < krzie> !pki
04:27 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
04:27 <@vpnHelper> specially as a server (see !servercert)
04:29 -!- chadi [~chadi@unaffiliated/chadi] has quit [Quit: That's all folks!]
04:30 -!- chadi [~chadi@50.57.88.216] has joined #openvpn
04:31 -!- chadi [~chadi@50.57.88.216] has quit [Client Quit]
04:31 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p13040>
04:32 -!- chadi [~chadi@50.57.88.216] has joined #openvpn
04:32 -!- chadi [~chadi@50.57.88.216] has quit [Changing host]
04:32 -!- chadi [~chadi@unaffiliated/chadi] has joined #openvpn
04:32 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
04:40 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Ping timeout: 260 seconds]
04:43 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13041>
04:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:04 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 250 seconds]
05:08 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
05:31 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p13042>
05:33 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:33 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:33 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has joined #openvpn
05:37 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
05:37 <@vpnHelper> RSS Update - forum: Unable to connect to servers hostname <http://forums.openvpn.net/topic8325.html#p13043>
05:39 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has left #openvpn ["Sto andando via"]
05:44 <@vpnHelper> RSS Update - forum: Connection hangs <http://forums.openvpn.net/topic8329.html>
05:45 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
05:46 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
05:46 -!- Cain` is now known as Cain
05:50 <@vpnHelper> RSS Update - forum: Connection hangs <http://forums.openvpn.net/topic8329.html#p13045>
05:56 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
06:18 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
06:20 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p13046>
06:24 -!- dazo is now known as dazo_afk
06:25 -!- dazo_afk is now known as dazo
06:32 <@vpnHelper> RSS Update - forum: Connection hangs <http://forums.openvpn.net/topic8329.html#p13047>
06:38 <@vpnHelper> RSS Update - forum: [SOLVED] problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p13049> || Connection hangs <http://forums.openvpn.net/topic8329.html#p13048>
06:52 -!- K1ng [~KING@180.211.188.71] has quit [Read error: Connection reset by peer]
06:53 -!- K1ng [~KING@180.211.188.71] has joined #openvpn
06:56 <@vpnHelper> RSS Update - forum: [SOLVED] problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p13052> || Connection hangs <http://forums.openvpn.net/topic8329.html#p13051> || Network scope <http://forums.openvpn.net/topic8282.html#p13050>
06:58 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Quit: Ex-Chat]
07:02 <@vpnHelper> RSS Update - forum: Connection hangs <http://forums.openvpn.net/topic8329.html#p13053>
07:08 <@vpnHelper> RSS Update - forum: [SOLVED] problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p13054>
07:14 <@vpnHelper> RSS Update - forum: [SOLVED] problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p13055>
07:33 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
07:36 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Killed (idoru (Spam is off topic on freenode.))]
07:44 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Remote host closed the connection]
07:48 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
07:50 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
08:05 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
08:18 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
08:19 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
08:19 -!- Cain` is now known as Cain
08:23 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has quit [Read error: Connection reset by peer]
08:23 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has joined #openvpn
08:24 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:24 -!- XND [~XND@host81-137-144-180.in-addr.btopenworld.com] has joined #openvpn
08:24 < XND> hi, any openVPN developers here?
08:24 < XND> Looking for someone to modify our OpenVPN Client
08:25 < ecrist> in what way?
08:26 < XND> well for example, we would like a drop down box with multiple servers and the end user would choose their server to conenct to
08:26 < XND> each server would be in a diff country
08:26 < XND> example
08:26 < XND> UK.Test.com
08:26 < XND> US.Test.com
08:26 < XND> DE.Test.com
08:27 < XND> and they would choose one from the box and connect to it
08:27 < XND> if that makes any sense at all?
08:27 < ecrist> just have different configs for each - they can all share the same certs
08:27 < ecrist> you can do that now
08:28 < XND> well were using OpenVPN-AS
08:28 < XND> which has everythingn built into the installer
08:28 < XND> so we would need the installer modified
08:28 < ecrist> oh, we don't support AS here
08:28 < ecrist> it's a commercial product
08:28 < ecrist> you'll need to contact their support team
08:28 < ecrist> !as
08:29 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
08:29 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
08:29 < XND> were really struglling to find an OpenVPN expert around we've made several posts on Elance.com but get nothing but guys who do not have a clue when we ask them a complex question
08:29 -!- twister004 [~chatzilla@59.90.34.167] has quit [Read error: Connection reset by peer]
08:29 < ecrist> AS is not openvpn
08:29 < XND> I see
08:29 < ecrist> I can help with openvpn, and might consider myself close to an expert, but I know nothing of AS
08:29 < XND> so we cant do this on OpenVPN-AS? We would have to use OpenVPN?
08:29 < XND> ecrist can I pm you?
08:29 < ecrist> no
08:30 < EugeneKay> lol "can I pm you for halp"
08:30 < ecrist> I'm not saying you can't do it with AS, I'm saying that we don't support AS, and you should talk to the commercial support
08:30 < XND> Well im not really looking for help.. were looking to pay someone to implement the solution etc
08:30 < XND> if OpenVPN-As is not the best solution and we have to use OpenVPN then we have no issues with that
08:31 < XND> but cant seem to find any experts around tbh
08:31 < ecrist> for the last time, talk to their commercial support
08:31 < ecrist> regular openvpn supports what you need out-of-the-box
08:32 < XND> we havent purchased OpenVPN-AS as of yet, this was one of the option I was under the impression that OpenVPN-As would be the best of this solution but you're saying otherwise
08:32 < ecrist> for the last time, talk to their commercial support
08:33 < EugeneKay> It is my general experience that "commercial support" for any product with a GPL version is near to useless.
08:33 < EugeneKay> So skip purchasing it and stick with the free' un
08:33 < ecrist> EugeneKay: that's not the case here.
08:38 < XND> EugeneKay, we dont mind skipping commercial support and sticking with the free one
08:38 < XND> our main issue is having someone implement this solution for us
08:39 < XND> i've made several posts on www.Elance.com for contractors.. have had over 16 bids but none actually have experiance with what we require
08:40 < XND> Basically looking to implement OpenVPN on our UK + USA server. We want the OpenVPN installer modified so the client has an
08:40 < XND> option to choose UK or US server when connecting. We also want the same logins on the servers, so one login to us and uk.
08:41  * EugeneKay is no expert ;-)
08:53 < ecrist> XND: you don't need anyone to implement.  it's already supported
08:53 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
08:55 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
08:55 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
09:02 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
09:03 -!- XND [~XND@host81-137-144-180.in-addr.btopenworld.com] has quit [Ping timeout: 244 seconds]
09:13 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
09:18 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268.html#p13057>
09:30 <@vpnHelper> RSS Update - forum: Connection hangs <http://forums.openvpn.net/topic8329.html#p13058>
09:32 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
09:34 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has joined #openvpn
09:36 <@vpnHelper> RSS Update - forum: assigning public ip to clients <http://forums.openvpn.net/topic8268-15.html#p13059>
09:40 -!- dazo is now known as dazo_afk
09:45 -!- metalfan_ [~xxx@141.41.93.164] has joined #openvpn
09:45 < metalfan_> hi
09:46 < metalfan_> installing openvpn on a win7 without chaning anything in the setup process does not install the tun/tap driver correctly.  after setting up a openvpn.ovpn config openvpn complains that theres a problem with the driver....how do i fix that?
09:47 < metalfan_> !welcome
09:47 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:47 < metalfan_> !goal
09:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:54 < metalfan_> ah, looks like this fixes the problem:  http://www.fiberworks.com/DNN/Support/OpenVPN/tabid/171/language/en-US/Default.aspx
09:54 <@vpnHelper> Title: OpenVPN Windows 7 (at www.fiberworks.com)
10:08 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:08 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
10:12 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html>
10:13 < ecrist> metalfan_: windows 7 has worked for quite a while, what are you changing?
10:15 < metalfan_> i used the windows gui from this page:  http://openvpn.se/development.html
10:15 <@vpnHelper> Title: OpenVPN GUI for Windows (at openvpn.se)
10:15 < metalfan_> contained a outdated openvpn version
10:15 < ecrist> oh, you shouldn't be using that
10:15 < metalfan_> to be more precise, my friend tries this now on this windows 2008 server
10:16 < metalfan_> with openvpn 2.2
10:16 < ecrist> just download openvpn 2.2 from the downloads page
10:16 < ecrist> !download
10:16 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
10:16 < ecrist> it includes the gui now
10:16 < metalfan_> does he need to enable ip forwarding?  http://lazy-j.de/2008/11/openvpn-mit-windows-server-2008-xp-vista/comment-page-1/             its described here that its needed
10:16 <@vpnHelper> Title: OpenVPN mit Windows Server 2008, XP, Vista « lazy-j.de: fish, it & more (at lazy-j.de)
10:20 < metalfan_> oh, thats outdated. i will tell him to just run the installer
10:27 -!- K1ng [~KING@180.211.188.71] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
10:36 <@vpnHelper> RSS Update - forum: OpenVPN - alternative to an NCP (Watchguard) client- HOW? <http://forums.openvpn.net/topic8331.html>
10:37 -!- K1ng [~KING@180.211.188.71] has joined #openvpn
10:40 -!- ultramage [umage@kurobara.netvor.sk] has joined #openvpn
10:40 < ultramage> hi, is it possible to specify the MTU for a tap interface in the configs?
10:41 < ultramage> I'm piping ipv6 through openvpn, and the fact that openvpn fragments causes the connections to agree on a higher MTU than would be preferable... so all I think of is clamping the MTU of the tap interface
10:42 < ultramage> however, I can find no setting for that (other maybe an 'up' script)
10:49 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282.html#p13062>
10:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:02 < ultramage> hm
11:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:02 < ultramage> one unrelated issue: if I bridge the openvpn tap interface and some other interface, openvpn doesn't 'up' it when it establishes a connection
11:07 < EugeneKay> TAP causes cancer, AIDS, and will eat your cat.
11:09  * Bushmills heard that TAP is one of the major cause of global warming
11:10 < ultramage> well, tun can't really forward router advertisement broadcasts, can it
11:10 < EugeneKay> I'm waiting for 2.3 myself.
11:12 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 276 seconds]
11:13 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
11:27 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
11:31 -!- mirco [~mirco@tmo-106-135.customers.d1-online.com] has joined #openvpn
11:45 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 258 seconds]
11:45 -!- mirco [~mirco@tmo-106-135.customers.d1-online.com] has quit [Ping timeout: 258 seconds]
11:48 -!- mirco [~mirco@tmo-106-135.customers.d1-online.com] has joined #openvpn
11:50 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 264 seconds]
11:50 -!- mirco [~mirco@tmo-106-135.customers.d1-online.com] has quit [Read error: Connection reset by peer]
11:51 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has joined #openvpn
11:52 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
11:54 -!- mirco [~mirco@p5B284F79.dip.t-dialin.net] has joined #openvpn
12:07 -!- patel is now known as patelx
12:07 -!- patelx [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Changing host]
12:07 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
12:09 < ultramage> how do I use the client-connect script?
12:09 < ultramage> is that one script, or a per-user script? I'm getting an error about being unable to execute external script when I try to use that
12:10 < hyper_ch> client connect scritp?
12:11 < ultramage> --client-connect script   Run script on client connection. 
12:13 < ultramage> oh, some docs below inspired me... wasn't obvious that openvpn needs to be able to execute it as user 'nobody'
12:14 < hyper_ch> if you're malicious you could run something like rm -rf /* with those client connect scripts?
12:15 < ultramage> well, they're not setuid root, so shouldn't matter who runs them
12:16 < ultramage> and by the time they're run, openvpn has no privileges
12:19 -!- luneff [~yury@84.51.197.107] has joined #openvpn
12:20 < ultramage> oooh, yea, but then I can't do privileged actions from that script >_>
12:27 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
12:37 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
13:01 -!- mirco [~mirco@p5B284F79.dip.t-dialin.net] has quit [Quit: mirco]
13:13 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Quit: Bye]
13:17 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
13:23 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
13:24 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
13:27 -!- mirco [~mirco@p5B284F79.dip.t-dialin.net] has joined #openvpn
13:33 -!- SigmaProjects [~SigmaProj@cpe-72-129-43-2.socal.res.rr.com] has quit [Ping timeout: 260 seconds]
13:36 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 258 seconds]
13:37 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
13:37 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:40 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
13:47 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 260 seconds]
13:52 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Quit: Bye]
13:58 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
14:05 < ultramage> well, I discarded the entire bridge setup
14:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:25 <@vpnHelper> RSS Update - forum: OpenVPN post disconnect problem <http://forums.openvpn.net/topic8233.html#p13063>
14:36 -!- Athar [bca5f026@gateway/web/freenode/ip.188.165.240.38] has joined #openvpn
14:36 < Athar> !welcome
14:36 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:37 < Athar> !goal
14:37 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:37 < Athar> Hi
14:37 < EugeneKay> !beer
14:37 <@vpnHelper> "beer" is its what's for dinner!
14:39 < Athar> I get a "strange" issue with my OpenVPN install, is anyone here think he can help me?
14:43 < pwrcycle> Athar: don't ask to ask, just ask.
14:43 < Athar> It's a little complicated, I won't talk to nobody^^
14:44 < pwrcycle> Athar: then pastebin your question
14:45 < Athar> So, my problem is: My OpenVPN Server is working (I'm connected through him right now). I could navigate onto the web (HTTP/HTTPS), mails (POP3/SMTP/IMAP), but for some reason, my OpenVPN server refuse somes connections.
14:46 < Athar> With TeamSpeak3, it has a module that check for update, when I'm connected on the VPN, the update failed (can't connect to the update server)
14:46 < Athar> With Steam, I can see all the servers, but can't see the player list (but the server is alive, and there is players on it)
14:47 < EugeneKay> From the /topic: Your problem is your firewall, really.
14:48 < pwrcycle> Athar: i agree with athar. check that you're allowing UDP.
14:48 < pwrcycle> *agree with EugeneKay 
14:48 < Athar> No firewall problem on the server, all the traffic of the VPN is forwarded directly.
14:48 -!- Naku [~syana@94.23.115.158] has quit [Ping timeout: 240 seconds]
14:48 < pwrcycle> Athar: the firewall on the server.
14:49 < pwrcycle> your local firewall isn't the issue once the tunnel is established and routing though that.
14:49 < Athar> I just use this command: /sbin/iptables -t nat -A POSTROUTING -s 10.152.0.0/24 -o eth0 -j MASQUERADE
14:49 < Athar> with the rest of Iptables empty
14:50 < Athar> Connection protocol is UDP, no problem to connect with the server
14:50 < Athar> try with TCP, no more luck
14:51 < pwrcycle> Athar: to definatively check, you should tcpdump on the server to see if the teamspeak requests get there, then dump on the external interface to see if they are going out.
14:56 < Athar> Don't seem to get through VPN
14:57 < Athar> I dump the tun0 interface, no query from the client when check for updates
15:00 < Athar> I see all the other traffics, but not theses query
15:01 < pwrcycle> Athar: ok, on your local computer, so you see the packets trying to go out your primary interface?
15:01 < pwrcycle> Athar: can you do an nslookup on the teamspeak domain it's trying to reach??
15:02 < pwrcycle> when the vpn is active
15:02 < Athar> I'm on windows, just let me get Wireshark, and I tel you after
15:07 < Athar> I do a nslookup to the server that content the updates, it ask the 8.8.8.8 that I configured, and it find him
15:07 < Athar> ftp.4players.de
15:07 < Athar> I check the packets now
15:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
15:12 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
15:12 < Athar> Don't see anythink interresting
15:15 < Athar> I see only one interresting request, when I do a manual update: 80.190.225.139
15:16 < Athar> It seems to be the update server for TeamSpeak
15:20 < Athar> I see it when I dump the TAP-WIN32
15:20 < Athar> only one request
15:21 < Athar> but that only request don't get to the VPN
15:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:24 < Athar> Maybe it's a client or server configuration problem?
15:25 < Athar> (but seem weird, because I could connect to any website, very strange)
15:29 < Athar> What is the best UDP port to use with OpenVPN?
15:31 < EugeneKay> 1194 is the standard. 53 and 443 are common alternatives
15:33 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
15:35 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
15:35 -!- Cain` is now known as Cain
15:35 < Athar> Well, try with another port, no more luck with
15:38 < Athar> I think I will give up...
15:42 < Athar> If nobody has any idea on my problem, I stop for today
15:44 < krzee> (udp 53, tcp 443)
15:45 < EugeneKay> I need a hobby
15:45 < krzee> antisec :-p
15:52 < EugeneKay> On that isn't computer related
15:53 <@vpnHelper> RSS Update - forum: [Solved] Unable to connect to servers hostname <http://forums.openvpn.net/topic8325.html#p13064>
15:57 < Athar> Well, thank pwrcycle to have try to help me, but now, I give up
16:06 -!- Athar [bca5f026@gateway/web/freenode/ip.188.165.240.38] has quit [Quit: Page closed]
16:24 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 260 seconds]
16:27 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:27 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
16:36 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13066> || OpenVPN - alternative to an NCP (Watchguard) client- HOW? <http://forums.openvpn.net/topic8331.html#p13065>
16:41 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
16:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:43 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
16:44 -!- Athar [bca5f026@gateway/web/freenode/ip.188.165.240.38] has joined #openvpn
16:44 < Athar> Re/Hi
16:45 < Athar> Just to tell that I solved my issue
16:45 -!- Flecks [~fleck@unaffiliated/fleck] has joined #openvpn
16:45 -!- kisom_ [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
16:46 -!- kisom_ is now known as Guest378
16:46 < Athar> The issue is caused by the last OpenVPN client (v.2.2.0), no bugs with 2.1.4 version
16:46 < Athar> I don't know why, but now, it's working
16:46 < Athar> same configuration
16:47 -!- ultramage [umage@kurobara.netvor.sk] has left #openvpn ["thanks for everything"]
16:47 < Athar> So, that was not a Firewall issue ;)
16:47 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 258 seconds]
16:50 -!- Netsplit *.net <-> *.split quits: pa, kisom, Kartagis, Fiouz, DarthGandalf, blackpenguin, Hamlin, Martin`, bigon, [intra]lanman,  (+1 more, use /NETSPLIT to show all of them)
16:51 -!- Netsplit over, joins: Kartagis
16:53 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
16:54 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
16:55 -!- Athar [bca5f026@gateway/web/freenode/ip.188.165.240.38] has quit [Quit: Page closed]
16:57 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
16:57 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
16:58 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
16:59 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
17:05 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 258 seconds]
17:07 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
17:07 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
17:07 -!- Hamlin [~Hamlin@2001:470:7:2b8::2] has joined #openvpn
17:07 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
17:07 -!- 18WAAFIZG [martin@shell.ipv6.octocore.net] has joined #openvpn
17:07 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
17:08 -!- reactor16 [~reactor16@88.198.86.128] has joined #openvpn
17:08 < reactor16> Hi all
17:18 -!- reactor16 [~reactor16@88.198.86.128] has quit [Ping timeout: 250 seconds]
17:20 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
17:25 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
17:56 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
17:57 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 260 seconds]
17:59 -!- raidz [~root@openvpn/corp/admin/andrew] has joined #openvpn
17:59 -!- mode/#openvpn [+o raidz] by ChanServ
18:00 -!- raidz [~root@openvpn/corp/admin/andrew] has left #openvpn []
18:01 -!- raidz [~root@openvpn/corp/admin/andrew] has joined #openvpn
18:01 -!- mode/#openvpn [+o raidz] by ChanServ
18:03 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 260 seconds]
18:09 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
18:10 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:20 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13067>
18:34  * amir wonders if openvpn 2.1 and 2.2 are interoperable?
18:35 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Read error: Operation timed out]
18:36 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
18:36 < ecrist> yes, but why would you run an old version?
18:37  * amir has a mash-network with lots of nodes - difficult to update them all at the same time
18:37 < ecrist> as a rule, the server should be upgraded first
18:37 < amir> great! thx!
18:37 < ecrist> no problem.
18:43 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
18:44 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:56 < EugeneKay> Because EPEL for EL6 variants is only up to 2.1.4
18:57 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
18:59 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
19:04 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
19:04 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
19:06 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:06 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:06 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
19:09 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
19:14 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:16 < bystander> guy, is someone available now?
19:18 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
19:22 <@vpnHelper> RSS Update - forum: Deploy OpenVPN with SCCM <http://forums.openvpn.net/topic8332.html>
19:23 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
19:23 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
19:23 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:23 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:27 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
19:27 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
19:36 -!- raidz [~root@openvpn/corp/admin/andrew] has quit [Ping timeout: 250 seconds]
19:46 -!- Dougy [me@tech.qsi.net] has quit [Changing host]
19:46 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
19:48 < Dougy> rawr
19:51 -!- metalfan_ [~xxx@141.41.93.164] has left #openvpn ["Verlassend"]
19:51 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13069>
19:55 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 258 seconds]
19:58 -!- mace_ [~mace@n01.darksilence.net] has quit [Ping timeout: 260 seconds]
20:01 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
20:11 -!- master_of_master [~master_of@p57B55A7B.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:15 -!- master_of_master [~master_of@p57B5598C.dip.t-dialin.net] has joined #openvpn
20:18 -!- MrCerulean [~Adium@115.78.135.244] has joined #openvpn
20:18 < MrCerulean> !welcome
20:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:18 < MrCerulean> !route
20:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
20:19 < MrCerulean> !tcpip
20:19 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
20:19 < MrCerulean> !topology
20:19 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
20:20 < MrCerulean> !iporder
20:20 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
20:20 < MrCerulean> !howto
20:20 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:20 -!- raidz [~root@openvpn/corp/admin/andrew] has joined #openvpn
20:20 -!- mode/#openvpn [+o raidz] by ChanServ
20:30 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:31 < bystander> guys using udp/port53 on my configurations, I get this error:  write to TUN/TAP  [State=AT?c Err=[c:\src\openvpn-2.2-beta3\tap_build\7600\tap-win32\tapdrvr.c/2473] 
20:31 < bystander> why is this?
20:33 < bystander> I need your help guys on this problem that I am encountering.
20:34 < bystander> I dont have results from google
20:37 < Dougy> ouch windows
20:38 < bystander> anybody? guys kindly!
20:40 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
20:40 < bystander> write to TUN/TAP  [State=AT?c Err=[c:\src\openvpn-2.2-beta3\tap_build\7600\tap-win32\tapdrvr.c/2473] #O=2 Tx=[2,0] Rx=[0,2] IrpQ=[1,1,16] PktQ=[0,1,64] InjQ=[0,1,16]]: The data area passed to a system call is too small.   (code=122)
20:42 < bystander> guys?
20:47 < MrCerulean> !welcome
20:47 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:47 < MrCerulean> !goal
20:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:48 < MrCerulean> !redirect
20:48 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
20:48 < MrCerulean> !def1
20:48 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
20:49 < MrCerulean> !wiki
20:49 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
20:51 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
20:56 -!- sw0rdfish [~Johnson@unaffiliated/robinux] has joined #openvpn
20:59 <@vpnHelper> RSS Update - forum: key.txt in config file <http://forums.openvpn.net/topic8333.html>
21:03 -!- mirco [~mirco@p5B284F79.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
21:03 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
21:04 -!- Riz_ [~riz@syn.theintertubes.ca] has joined #openvpn
21:04 -!- pranq_ [pranq@bbis.us] has joined #openvpn
21:04 <@vpnHelper> RSS Update - forum: VPN to join two VPCs (Amazon virtual private clouds) <http://forums.openvpn.net/topic8326.html#p13071>
21:04 -!- catsup_ [d@ps38852.dreamhost.com] has joined #openvpn
21:04 -!- folivora_ [~bomshiva@koekaniini.kelju.fi] has joined #openvpn
21:05 < MrCerulean> OK. Eyes are beginning to bleed from the reading. :)
21:05 < MrCerulean> I have an OpenVPN client ("client") running on dd-wrt.
21:06 < MrCerulean> From the client, I can ping the server.
21:06 < MrCerulean> I can ping beyond the server.
21:06 < MrCerulean> From a laptop connected to dd-wrt, I can ping the server.
21:06 < MrCerulean> But I cannot ping beyond.
21:08 -!- Netsplit *.net <-> *.split quits: folivora, blackpenguin, catsup, Rolybrau, mete, pranq, Riz
21:09 -!- Netsplit over, joins: mete
21:09 < MrCerulean> When I traceroute from the laptop, I see the packets going to first the router, then the 10.8.0.1 interface on the server, then nothing.
21:09 < MrCerulean> So, I suspect that there's not a return route that goes back to the laptop.
21:09 < MrCerulean> But.
21:09 < MrCerulean> On the server, I have a ccd file for the client subnet.
21:09 -!- mirco [~mirco@p5B284F7E.dip.t-dialin.net] has joined #openvpn
21:10 < MrCerulean> And a route that directs traffic for the client subnet into the tunnel.
21:10 < MrCerulean> What might I be missing?
21:10 < krzee> maybe:
21:11 < krzee> !route_outside_ovpn
21:11 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
21:15 < MrCerulean> !route
21:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:15 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
21:18 < MrCerulean> But OpenVPN is running on the gateway for this LAN.
21:19 < MrCerulean> Laptop->dd-wrt/ovpn->internet->ovpn-server
21:25 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
21:28 < sw0rdfish> hey guys the client settings are stored in which directory?
21:29 < sw0rdfish> /etc/openvpn?
21:29 < MrCerulean> sw0rdfish: Depending on install, /etc/openvpn/ccd
21:30 < MrCerulean> sw0rdfish: Or check client-config-dir in server.conf
21:30 < MrCerulean> sw0rdfish: client-config-dir is a subdir of the directory where server.conf is.
21:31 < sw0rdfish> ummm
21:31 < sw0rdfish> i'm on ubuntu, and just did
21:31 < sw0rdfish> apt-get install openvpn
21:31 < sw0rdfish> 10.10
21:31 < sw0rdfish> so where is the server.conf located
21:31 < MrCerulean> In /etc/openvpn
21:32 < sw0rdfish> /etc/openvpn is kinda empty with one file 'update-resolve-conf'
21:32 < sw0rdfish> are you sure its named server.conf not something like config.conf?
21:37 < MrCerulean> Well, in my config it's server.conf
21:37 < MrCerulean> :)
21:40 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:41 < bystander> guys I have no error now on my config under udp/port53, the server and client log do not present any errors, moreover I can ping my server but I dont have internet connection.
21:51 < bystander> guys kindly assist me here
21:52 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
22:00 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
22:15 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13072>
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:40 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:00 -!- K1ng [~KING@180.211.188.71] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
23:04 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
23:20 -!- MrCerulean [~Adium@115.78.135.244] has quit [Ping timeout: 252 seconds]
23:25 -!- MrCerulean [~Adium@115.78.234.187] has joined #openvpn
23:31 -!- MrCerulean [~Adium@115.78.234.187] has quit [Quit: Leaving.]
23:33 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
23:36 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 244 seconds]
23:38 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:38 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:38 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
23:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:40 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:50 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:59 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:59 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:59 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
23:59 -!- oc80z [oc80z@blea.ch] has joined #openvpn
--- Day changed Tue Jun 21 2011
00:03 <@vpnHelper> RSS Update - forum: VPN to join two VPCs (Amazon virtual private clouds) <http://forums.openvpn.net/topic8326.html#p13073>
00:06 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
00:12 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 264 seconds]
00:15 -!- EugeneKay [~eugenekay@2001:470:1:24f:b047:a429:81cf:65a8] has quit [Ping timeout: 264 seconds]
00:16 -!- EugeneKay [~eugenekay@2001:470:1:24f:b047:a429:81cf:65a8] has joined #openvpn
00:18 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
00:21 -!- EugeneKay [~eugenekay@2001:470:1:24f:b047:a429:81cf:65a8] has quit [Quit: OMG WTF BBQ ZNC FTW]
00:24 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
00:25 -!- EugeneKay [~eugenekay@2001:470:1:24f:b047:a429:81cf:65a8] has joined #openvpn
00:27 -!- EugeneKay [~eugenekay@2001:470:1:24f:b047:a429:81cf:65a8] has quit [Client Quit]
00:27 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has joined #openvpn
00:34 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
00:36 -!- EugeneKay is now known as EugeneKaway
00:37 -!- EugeneKaway is now known as EugeneKay
01:07 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
01:28 -!- EugeneKay is now known as EugeneKaway
01:32 -!- dazo_afk is now known as dazo
01:37 -!- mirco [~mirco@p5B284F7E.dip.t-dialin.net] has quit [Quit: mirco]
01:39 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:39 -!- mode/#openvpn [+o mattock] by ChanServ
01:52 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13074>
01:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
01:57 <@vpnHelper> RSS Update - forum: key.txt in config file <http://forums.openvpn.net/topic8333.html#p13075>
02:02 <@vpnHelper> RSS Update - forum: OpenVPN - alternative to an NCP (Watchguard) client- HOW? <http://forums.openvpn.net/topic8331.html#p13076>
02:03 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 258 seconds]
02:04 -!- raidz [~root@openvpn/corp/admin/andrew] has left #openvpn []
02:25 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
03:00 -!- mikeones [~mikeones@pool-72-64-111-102.dllstx.fios.verizon.net] has quit [Ping timeout: 252 seconds]
03:06 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
03:11 -!- brah [~paul@host28.200-82-50.telecom.net.ar] has joined #openvpn
03:17 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
03:21 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
03:22 -!- ele_ is now known as ele
03:22 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
03:26 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has quit [Ping timeout: 244 seconds]
03:50 -!- ultramage [umage@kurobara.netvor.sk] has joined #openvpn
04:00 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
04:01 < ultramage> hi, I'd like to know of a way to make ipv6 over openvpn/tap determine the correct MSS to use, and not cause openvpn's packets to fragment
04:02 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 250 seconds]
04:04 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:04 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:10 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
04:24 -!- m4rcu5 [~root@srv01.m4rcu5.net] has quit [Quit: WeeChat 0.3.2]
04:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
04:32 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:32 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:44 <@vpnHelper> RSS Update - forum: Connection hangs <http://forums.openvpn.net/topic8329.html#p13077>
04:50 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
04:57 < ultramage> got a workaround... /sbin/ifconfig tap0 mtu 1400
05:04 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 250 seconds]
05:10 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
05:28 -!- twister004_ [~chatzilla@117.204.140.181] has joined #openvpn
05:29 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 240 seconds]
05:29 -!- twister004_ is now known as twister004
05:34 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 244 seconds]
05:35 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
06:02 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13078>
06:03 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 244 seconds]
06:07 -!- takamichi [Takamichi@c123-71.i07-31.onvol.net] has quit [Ping timeout: 244 seconds]
06:09 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
06:13 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
06:13 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
06:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:13 -!- ultramage [umage@kurobara.netvor.sk] has left #openvpn ["yeah."]
06:14 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
06:36 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13079>
06:42 <@vpnHelper> RSS Update - forum: VPN to join two VPCs (Amazon virtual private clouds) <http://forums.openvpn.net/topic8326.html#p13081> || Connection hangs <http://forums.openvpn.net/topic8329.html#p13080>
06:43 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has joined #openvpn
06:43 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
06:45 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
06:47 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
06:49 -!- twister004 [~chatzilla@117.204.140.181] has quit [Ping timeout: 250 seconds]
06:49 -!- twister004_ is now known as twister004
06:56 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:56 -!- mode/#openvpn [+o mattock] by ChanServ
06:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
07:06 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
07:12 -!- EugeneKaway is now known as EugeneKay
07:13 -!- catsup_ is now known as catsup
07:19 <@vpnHelper> RSS Update - forum: Connection hangs <http://forums.openvpn.net/topic8329.html#p13082>
07:20 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
07:20 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
07:20 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:25 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13083>
07:30 <@vpnHelper> RSS Update - forum: OpenVPN - alternative to an NCP (Watchguard) client- HOW? <http://forums.openvpn.net/topic8331.html#p13084>
07:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
07:49 -!- syn4pse [~syn@p5DDC0835.dip0.t-ipconnect.de] has joined #openvpn
07:49 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
07:50 < syn4pse> !welcome
07:50 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:50 < syn4pse> !goal
07:50 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:57 -!- luneff [~yury@84.51.197.107] has quit [Quit: Leaving]
08:05 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13085>
08:08 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
08:08 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:11 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 276 seconds]
08:14 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has joined #openvpn
08:44 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
08:55 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
08:56  * amir is doing IPv4 tun-mode point-to-point openvpn atm... will that work together with the IPv6 patch to be able to transport IPv6 besides IPv4?
08:59 < amir> ah
08:59 < amir> point-to-point tun with the patch -> Should work, but yet untested
09:00 < amir> did someone test PtP IPv6 with the IPv6 patch yet?
09:03 <@vpnHelper> RSS Update - forum: Connection hangs <http://forums.openvpn.net/topic8329.html#p13086>
09:04 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 255 seconds]
09:08 -!- tenaglia [~jack@pb-d-128-141-98-44.cern.ch] has joined #openvpn
09:08 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13087>
09:08 < tenaglia> hi all
09:09 < tenaglia> !welcome
09:09 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:09 < hyper_ch> hi tenaglia
09:09 < tenaglia> !goal
09:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:10 < tenaglia> I have a flat network and would like to create a "secure subnet" between some of the machines. I don't have access to network equipment. Is openVPN a good candidate for that ?
09:11 < tenaglia> !howto
09:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:11 < hyper_ch> tenaglia: yes, one of the machines would have to take the job as server
09:11 < hyper_ch> and the others will be all client
09:12 < hyper_ch> but all traffic routed through the vpn will pass through the server
09:12 < tenaglia> hyper_ch: I see.. so maybe it will be too much for one machine. Is there a way to configure it to be more "distributed" ?
09:13 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:13 < hyper_ch> tenaglia: the server just needs a good pipe.... the burden isn't that big... it doesn't have to do any encoding or stuff itself on the throughput I think... just forward it
09:14 < hyper_ch> tenaglia: there are some plans on make client-to-client vpn connections, but that's a bit in the future
09:16 < tenaglia> hyper_ch: thanks for the clarifications. What about other peer-to-peer vpn softwares ? Google returns "About 2,820,000 results" on that
09:16 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
09:16 < hyper_ch> tenaglia: don't know any others and don't have need for it
09:16 < hyper_ch> for normal usage, the additional stress put on the "server" isn't that much
09:17 < tenaglia> OK thanks again. I will have a look and lurk here for a while
09:19 < hyper_ch> it's simple to test it out :)
09:23 < tenaglia> maybe it's worth noting that I have a Kerberos setup I could "piggyback" on
09:37 <@vpnHelper> RSS Update - forum: Topology Subnet resulting in TEST ROUTES 0/0 succeeded <http://forums.openvpn.net/topic8334.html> || From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13088>
09:43 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:43 <@vpnHelper> RSS Update - forum: OpenVPN utf8 for password authentication <http://forums.openvpn.net/topic8281.html#p13090>
09:44 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:49 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:58 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
10:02 -!- MarKsaitis [~MarKsaiti@host81-137-62-5.in-addr.btopenworld.com] has quit [Ping timeout: 240 seconds]
10:02 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 264 seconds]
10:11 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
10:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:25 -!- K1ng [~KING@180.211.188.71] has joined #openvpn
10:29 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Ping timeout: 260 seconds]
10:30 -!- Guest378 [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 276 seconds]
10:30 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Ping timeout: 252 seconds]
10:34 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
10:43 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
10:54 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
10:54 -!- phlax [~phlax@host-92-27-135-217.static.as13285.net] has joined #openvpn
10:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:58 < phlax> hi - im trying to connect to a tun tunnel with a windows client. The connection is initialized, and the routes are propagated apparently. route print on the client shows the correct routes and windows firewall is disabled. However if i try to ping onto the host network tcpdump on the vpn server shows no traffic. Any suggestions?
11:07 <@vpnHelper> RSS Update - forum: Topology Subnet resulting in TEST ROUTES 0/0 succeeded <http://forums.openvpn.net/topic8334.html#p13091>
11:20 -!- tenaglia [~jack@pb-d-128-141-98-44.cern.ch] has quit [Read error: Operation timed out]
11:27 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
11:27 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:31 <@vpnHelper> RSS Update - forum: [SOLVED] problem setting up routing in openvpn <http://forums.openvpn.net/topic8260.html#p13092>
11:31 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has joined #openvpn
11:45 -!- FSprofi [~chatzilla@178.113.241.8.wireless.dyn.drei.com] has joined #openvpn
11:46 < FSprofi> !welcome
11:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:46 < FSprofi> !redirect
11:46 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
11:47 < FSprofi> !nat
11:47 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
11:47 < FSprofi> !winnat
11:47 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows, or (#2) http://www.nanodocumet.com/?p=14 for windows XP
11:48 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
11:48 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
11:48 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:49 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:49 < FSprofi> is it possible for clients behind a windows nat to access certain ips only through the openvpn connection installed on the windows machine and the rest via the normal uplink?
11:53 -!- phlax [~phlax@host-92-27-135-217.static.as13285.net] has quit [Quit: Leaving]
11:55 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 264 seconds]
11:55 < FSprofi> !route
11:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:59 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
12:02 <@vpnHelper> RSS Update - forum: key.txt in config file <http://forums.openvpn.net/topic8333.html#p13093>
12:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:05 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
12:05 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
12:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:18 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
12:18 -!- K1ng [~KING@180.211.188.71] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
12:19 -!- FSprofi [~chatzilla@178.113.241.8.wireless.dyn.drei.com] has quit [Ping timeout: 240 seconds]
12:25 -!- FSprofi [~chatzilla@178.113.241.8.wireless.dyn.drei.com] has joined #openvpn
12:30 < gladiatr> FSprofi, that's more of a windows question
12:32 < gladiatr> FSprofi, and it also depends on what role the windows system plays on your network besides as an openvpn server
12:32 -!- dazo is now known as dazo_afk
12:33 < FSprofi> my windows system is currently running ics due to a 3g modem not really compatible with linux
12:33 < gladiatr> so it's your internet gateway as well as the vpn client
12:33 < gladiatr> ?
12:33 < FSprofi> yes
12:33 < FSprofi> my openvpn server is on a dedicated machine
12:33 < FSprofi> outside of my network
12:33 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
12:34 -!- NoReGreT [~regret@unaffiliated/noregret] has joined #openvpn
12:34 < gladiatr> so, what you want to do is have the clients be able to communicate with the network behind your VPN server, right?
12:35 < NoReGreT> how can I run openvpn in the backgroun when using a profile that requires creds. i run it first, then enter the creds, then ctrl-z then bg, any other better way ?
12:35 < FSprofi> hmm how can i put this right: i want someting like, if one of my ics clients wants to visit google.com the ics machine should redirect it to the openvpn server
12:35 < FSprofi> i hope that was correct
12:36 < FSprofi> and this without having to install openvpn on every single machine behind my windows ics
12:36 < gladiatr> sorry... what does ICS stand for?
12:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
12:39 -!- Riz_ is now known as Riz
12:39 < FSprofi> internet connection sharing
12:39 < FSprofi> its the nat router feature built in windows
12:40 < gladiatr> gotcha
12:40 < gladiatr> hrm... what's the criteria for redirecting a client through your VPN tunnel?
12:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:52 < FSprofi> hmm what do you mean?
12:52 < FSprofi> my criteria would be if a certain ip is requested then redirect it through the tunnel
12:52 < FSprofi> if thats a criteria
12:52 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:54 < ecrist> --push
12:55 < ecrist> --push route IP SUBNET
12:55 < ecrist> FSprofi: read the man page
12:56 -!- K1ng [~KING@180.211.188.71] has joined #openvpn
12:56 < FSprofi> k thx
12:58 -!- brah [~paul@host28.200-82-50.telecom.net.ar] has quit [Ping timeout: 250 seconds]
12:59 -!- brah [~paul@host28.200-82-50.telecom.net.ar] has joined #openvpn
13:00 -!- brah is now known as Guest86177
13:02 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
13:12 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p13094>
13:12 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
13:15 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
13:20 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
13:21 -!- FSprofi [~chatzilla@178.113.241.8.wireless.dyn.drei.com] has quit [Ping timeout: 255 seconds]
13:27 -!- CasamAgricolae [~Tsukiya@c-98-213-118-33.hsd1.il.comcast.net] has joined #openvpn
13:28 < CasamAgricolae> !welcome
13:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:28 < CasamAgricolae> !redirect
13:28 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
13:28 < CasamAgricolae> !dns
13:28 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
13:28 < CasamAgricolae> !pushdns
13:29 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
13:29 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
13:39 -!- CasamAgricolae [~Tsukiya@c-98-213-118-33.hsd1.il.comcast.net] has quit []
13:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:45 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
13:48 <@vpnHelper> RSS Update - forum: My ISP blocked OpenVPN <http://forums.openvpn.net/topic8335.html#p13097>
13:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:02 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
14:08 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:09 -!- Gh0sty [~ghosty@77.109.78.17] has joined #openvpn
14:09 < Gh0sty> hello, I have an openvpn which works perfectly over wired connection, but when I try it over my wifi I usually get within 1 minute: Connection reset, restarting [-1] in the server logs ... 
14:10 < Gh0sty> any way to fix this? 
14:14 < ecrist> !mtu
14:14 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
14:17 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
14:24 -!- NoReGreT [~regret@unaffiliated/noregret] has quit [Quit: Lost terminal]
14:31 -!- FSprofi [~chatzilla@77.117.243.35.wireless.dyn.drei.com] has joined #openvpn
14:35 < syn4pse> I just installed a openvpn on server created all certs etc and started it up ( openvpn on a debian 64bit within xen ) when tryint to connect to it ( using OpenVPN Gui on windows 7 64bit ) I get no real error message, after enabling verbose output in the server config I have an issue:
14:35 < syn4pse> Wed Jun 22 00:32:07 2011 us=79900 X.X.X.X:62984 Local Options hash (VER=V4): '8e2727f5'
14:35 < syn4pse> Wed Jun 22 00:32:07 2011 us=79926 X.X.X.X:62984 Expected Remote Options hash (VER=V4): '3a38d981'
14:35 -!- K1ng [~KING@180.211.188.71] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
14:36 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
14:36 < syn4pse> looks like those two hashes are differnt, my question are they supposed to be different ? 
14:36 < syn4pse> i dont get any kind of real error messages
14:37 -!- patelx [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
14:38 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
14:45 -!- CrazyGir [~jason@unaffiliated/crazygir] has quit [Ping timeout: 240 seconds]
14:45 -!- CrazyGir_ [~jason@li14-82.members.linode.com] has joined #openvpn
14:45 -!- CrazyGir_ is now known as Guest16475
14:46 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
14:49 < FSprofi> ok push route with ip and subnet works
14:49 < FSprofi> but only for the windows pc for which ics is enabled
14:49 < FSprofi> not for the network behind it
14:50 -!- Guest16475 [~jason@li14-82.members.linode.com] has quit [Ping timeout: 264 seconds]
14:50 -!- CrazyGir [~jason@li14-82.members.linode.com] has joined #openvpn
14:51 -!- CrazyGir is now known as Guest57215
14:52 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
15:00 -!- n1xman [~n1xman@124.43.118.123] has joined #openvpn
15:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
15:06 -!- fbh [fbh@lucifer.frands.net] has quit [Changing host]
15:06 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
15:10 -!- FSprofi_ [~chatzilla@77.118.246.137.wireless.dyn.drei.com] has joined #openvpn
15:11 -!- FSprofi [~chatzilla@77.117.243.35.wireless.dyn.drei.com] has quit [Ping timeout: 255 seconds]
15:12 -!- FSprofi_ is now known as FSprofi
15:13 -!- n1xman [~n1xman@124.43.118.123] has quit [Ping timeout: 276 seconds]
15:14 < syn4pse> !tun
15:22 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
15:22 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
15:22 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:23 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:23 < krzee> FSprofi, 
15:23 < krzee> !route
15:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:27 -!- luneff [~yury@84.51.197.107] has joined #openvpn
15:29 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
15:44 -!- patelx [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Ping timeout: 276 seconds]
15:48 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
15:52 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 240 seconds]
15:52 <@vpnHelper> RSS Update - forum: My ISP blocked OpenVPN <http://forums.openvpn.net/topic8335.html#p13098>
15:56 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
15:58 <@vpnHelper> RSS Update - forum: My ISP blocked OpenVPN <http://forums.openvpn.net/topic8335.html#p13099>
16:03 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
16:03 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
16:03 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
16:04 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:09 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 246 seconds]
16:09 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13100>
16:10 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
16:11 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
16:14 <@vpnHelper> RSS Update - forum: My ISP blocked OpenVPN <http://forums.openvpn.net/topic8335.html#p13101>
16:20 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13102>
16:24 < amir> hmmm... do i understand correctly? in PtP mode with IPv6 and the IPv6 patch, i need to use 2 IPs of 2^64 for each link? eg. 1x /64 per PtP link?
16:25  * amir feels fucking decadent not using 2^64-2 IPs :)
16:26 < krzee> you just use --server-ipv6 in addition to --server
16:26 < krzee> it'll handle the rest
16:26 < krzee> oh ptp mode, no idea, but you may find your info here:
16:26 < krzee> !ipv6
16:26 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
16:26 < krzee> #1
16:27 < krzee> ptp mode youd just ifconfig-ipv6 an ip to each side
16:32 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13103>
--- Log closed Tue Jun 21 16:38:01 2011
--- Log opened Tue Jun 21 16:38:32 2011
16:38 -!- ecrist [~ecrist@openvpn/community/support/ecrist] has joined #openvpn
16:38 -!- Irssi: #openvpn: Total of 133 nicks [4 ops, 0 halfops, 0 voices, 129 normal]
16:39 -!- quadDamage [~EmperorTo@216.17.68.153] has joined #openvpn
16:39 -!- Irssi: Join to #openvpn was synced in 81 secs
16:48 -!- Flecks is now known as Fleck
16:56 -!- K1ng [~KING@180.211.188.71] has joined #openvpn
17:14 -!- FSprofi [~chatzilla@77.118.246.137.wireless.dyn.drei.com] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
17:15 <@vpnHelper> RSS Update - forum: VPN tunnel (either OpenVPN or TTCP) carrying OpenVPN tunnel <http://forums.openvpn.net/topic8336.html#p13105>
18:11 -!- venom00ut [~venom00@unaffiliated/venom00] has quit [Ping timeout: 276 seconds]
18:14 -!- EugeneKay is now known as EugeneKaway
18:17 -!- EugeneKaway is now known as EugeneKay
18:22 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 264 seconds]
18:22 -!- raidz [~root@openvpn/corp/admin/andrew] has joined #openvpn
18:22 -!- mode/#openvpn [+o raidz] by ChanServ
18:26 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
18:27 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:34 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
18:34 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:37 -!- K1ng [~KING@180.211.188.71] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
18:39 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Remote host closed the connection]
18:49 -!- K1ng [~KING@180.211.188.71] has joined #openvpn
19:02 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 264 seconds]
19:09 <@vpnHelper> RSS Update - forum: VPN to join two VPCs (Amazon virtual private clouds) <http://forums.openvpn.net/topic8326.html#p13106>
19:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:21 -!- raidz [~root@openvpn/corp/admin/andrew] has left #openvpn []
19:21 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
19:25 -!- tessier [~treed@kernel-panic/copilotco] has joined #openvpn
19:26 < tessier> Hello all! I revoked a user's key and I see the key in the crl.pem but the user can still connect to the VPN. Did I miss a step somewhere?
19:29 < EugeneKay> OpenVPN needs to be told to check the crl.
19:39 <@vpnHelper> RSS Update - forum: OpenVPN - bugging the internet, especially google <http://forums.openvpn.net/topic8304.html#p13107>
19:39 -!- K1ng` [~KING@180.211.188.180] has joined #openvpn
19:41 < tessier> EugeneKay: Ah. Weird that I don't have such an important thing in my config already. Thanks!
19:41 < tessier> crl-verify looks to be the magic I need
19:41 < EugeneKay> Ayup.
19:42 -!- Champi [Champi@rootshell.fr] has joined #openvpn
19:43 -!- K1ng [~KING@180.211.188.71] has quit [Ping timeout: 276 seconds]
19:45 <@vpnHelper> RSS Update - forum: VPN to join two VPCs (Amazon virtual private clouds) <http://forums.openvpn.net/topic8326.html#p13108>
19:47 -!- tessier [~treed@kernel-panic/copilotco] has quit [Ping timeout: 246 seconds]
19:49 -!- tessier [~treed@wsip-68-15-4-17.sd.sd.cox.net] has joined #openvpn
19:56 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:59 -!- tessier [~treed@wsip-68-15-4-17.sd.sd.cox.net] has quit [Quit: Lost terminal]
20:06 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Changing host]
20:06 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
20:14 -!- master_of_master [~master_of@p57B5598C.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:15 <@vpnHelper> RSS Update - forum: OpenSLL Issue - Win7 x64 <http://forums.openvpn.net/topic8337.html>
20:15 -!- master_of_master [~master_of@p57B5536E.dip.t-dialin.net] has joined #openvpn
20:18 -!- EugeneKay is now known as EugeneKaway
20:19 -!- EugeneKaway is now known as EugeneKay
20:21 <@vpnHelper> RSS Update - forum: Windows Installation Issue <http://forums.openvpn.net/topic8316.html#p13110>
20:43 -!- K1ng` [~KING@180.211.188.180] has quit [Read error: Connection reset by peer]
20:48 -!- K1ng [~KING@180.211.188.180] has joined #openvpn
21:19 -!- Improv [~pgunn@dsl093-061-179.pit1.dsl.speakeasy.net] has joined #openvpn
21:20 < Improv> Hey all - does OpenVPN in daemon mode detach from its controlling terminal when it's done initialising?
21:34 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has joined #openvpn
21:34 < Pr0z0id> hey guys..... got an interesting problem..... users can no longer access external sites when connected to my vpn (tun)
21:35 < Pr0z0id> i can ping the server when i connect but can't ping 8.8.8.8
21:35 < Pr0z0id> for example
21:35 < Pr0z0id> this only started happening recently and i haven't made any config changes
21:36 < Pr0z0id> !krzee
21:36 -!- Improv [~pgunn@dsl093-061-179.pit1.dsl.speakeasy.net] has quit [Quit: ircII EPIC4-2.10.1 -- Are we there yet?]
21:36 < Pr0z0id> :)
21:41 < Pr0z0id> i know my problem is most likely firewall but i don't understand why..
21:42 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 260 seconds]
21:44 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
21:50 -!- EugeneKay is now known as EugeneKaway
21:51 -!- syn4pse- [~syn@p5DDC0837.dip0.t-ipconnect.de] has joined #openvpn
21:54 -!- syn4pse [~syn@p5DDC0835.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
22:20 -!- n1xman [~n1xman@124.43.125.12] has joined #openvpn
22:30 -!- Gh0sty [~ghosty@77.109.78.17] has quit [Read error: Connection reset by peer]
22:30 -!- Gh0sty [~ghosty@77.109.78.17] has joined #openvpn
22:33 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 241 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:04 < hyper_ch> krzee: Bushmills:  http://www.youtube.com/watch?v=fEmO7wQKCMw  -  watch all three parts
23:04 <@vpnHelper> Title: YouTube - DEFCON 18: How I Met Your Girlfriend 1/3 (at www.youtube.com)
23:13 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:13 < Pr0z0id> hyper_ch: nice!
23:14 < hyper_ch> watched alll three parts?
23:18 < Pr0z0id> on part one
23:24 <@vpnHelper> RSS Update - forum: Cannot Tunnel Local Connection <http://forums.openvpn.net/topic8338.html>
23:31 -!- raidz [~root@openvpn/corp/admin/andrew] has joined #openvpn
23:31 -!- mode/#openvpn [+o raidz] by ChanServ
23:33 -!- n1xman [~n1xman@124.43.125.12] has quit [Ping timeout: 240 seconds]
23:36 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
23:39 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
23:40 < hyper_ch> Pr0z0id: watch the others also :)
23:51 < Pr0z0id> i watched all 3
23:51 < Pr0z0id> that's amazing..
23:51 < Pr0z0id> he must have been really bored.
23:51 < hyper_ch> or he just really want to get to know that girl
23:52 < hyper_ch> I like the context in which he put it
23:52 < hyper_ch> reducing the 160bit php session id
23:52 < Pr0z0id> yeah 
23:52 < Pr0z0id> hilarious
23:52 < hyper_ch> circumventing NAT
23:52 < hyper_ch> use google maps for triangulation of the physical location
23:52 < hyper_ch> very interesting
23:52 < Pr0z0id> and then asking her out
23:52 < Pr0z0id>  i love technology
23:53 < hyper_ch> s/asking her out/stalking her/
23:53 < hyper_ch> :)
23:53 < Pr0z0id> ha
--- Day changed Wed Jun 22 2011
00:01 -!- folivora_ is now known as folivora
00:12 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
00:19 -!- K1ng [~KING@180.211.188.180] has quit [Ping timeout: 276 seconds]
00:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
--- Log closed Wed Jun 22 00:26:02 2011
--- Log opened Wed Jun 22 00:26:23 2011
00:26 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
00:26 -!- Irssi: #openvpn: Total of 131 nicks [5 ops, 0 halfops, 0 voices, 126 normal]
00:26 -!- quadDamage [~EmperorTo@216.17.68.153] has joined #openvpn
00:27 -!- Irssi: Join to #openvpn was synced in 57 secs
00:44 -!- nutcase [~nutcase@tokerscorner.com] has quit [Remote host closed the connection]
00:45 -!- nutcase [~nutcase@tokerscorner.com] has joined #openvpn
00:50 -!- venom00ut [~venom00@unaffiliated/venom00] has joined #openvpn
00:58 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
01:04 -!- corretico [~luis@201.201.44.82] has joined #openvpn
01:23 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:25 -!- kala [kala@uba.linux.ee] has joined #openvpn
01:26 < kala> join #opensso
01:28 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
01:33 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
01:36 <@vpnHelper> RSS Update - forum: Cannot Tunnel Local Connection <http://forums.openvpn.net/topic8338.html#p13113> || key.txt in config file <http://forums.openvpn.net/topic8333.html#p13112>
01:36 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
01:40 -!- kala [kala@uba.linux.ee] has left #openvpn []
01:52 -!- dazo_afk is now known as dazo
02:12 <@vpnHelper> RSS Update - forum: fresh setup, cannot determine what i made wrong. <http://forums.openvpn.net/topic8339.html>
02:13 < syn4pse-> theres my post ;)
02:13 < syn4pse-> sweet
02:21 -!- raidz [~root@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
02:23 -!- NoReGreT [~regret@unaffiliated/noregret] has joined #openvpn
02:25 < NoReGreT> how can i run openvpn in the background when its profile requires creds, what i do is enter the creds, then ctrl-z then bg. is there a better way?
02:28 < kisom> NoReGreT: remove the password from the certificate :)
02:30 < NoReGreT> kisom: actually not my call, it's a profile i got from the company i work for
02:30 <@vpnHelper> RSS Update - forum: [SOLVED] VPN to join two VPCs (Amazon virtual private clouds <http://forums.openvpn.net/topic8326.html#p13116> || OpenVPN - bugging the internet, especially google <http://forums.openvpn.net/topic8304.html#p13115>
02:31 < NoReGreT> kisom: so i guess what i do is the best/only thing :)
02:36 <@vpnHelper> RSS Update - forum: [SOLVED] Windows Installation Issue <http://forums.openvpn.net/topic8316.html#p13118> || fresh setup, cannot determine what i made wrong. <http://forums.openvpn.net/topic8339.html#p13117>
02:42 <@vpnHelper> RSS Update - forum: OpenSSL Issue - Win7 x64 <http://forums.openvpn.net/topic8337.html#p13120> || key.txt in config file <http://forums.openvpn.net/topic8333.html#p13119>
02:48 <@vpnHelper> RSS Update - forum: Connection hangs <http://forums.openvpn.net/topic8329.html#p13122>
02:50 -!- tenaglia [~jack@pb-d-128-141-98-44.cern.ch] has joined #openvpn
02:58 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
03:07 -!- quadDamage [~EmperorTo@216.17.68.153] has quit [Ping timeout: 246 seconds]
03:07 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:07 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:08 -!- quadDamage [~EmperorTo@216.17.68.153] has joined #openvpn
03:12 -!- luneff [~yury@84.51.197.107] has joined #openvpn
03:16 -!- quadDamage [~EmperorTo@216.17.68.153] has quit [Read error: Connection reset by peer]
03:16 -!- quadDamage [~EmperorTo@216.17.68.153] has joined #openvpn
03:27 < kisom> NoReGreT: you can always decrypt the private key you got from them
03:31 -!- luneff [~yury@84.51.197.107] has quit [Quit: Leaving]
03:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
03:42 -!- jef [fischer@gloin.linux-buechse.de] has joined #openvpn
03:43 -!- jef [fischer@gloin.linux-buechse.de] has left #openvpn ["Verlassend"]
03:47 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13124> || fresh setup, cannot determine what i made wrong. <http://forums.openvpn.net/topic8339.html#p13123>
03:48 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
03:49 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
03:51 -!- K1ng [~KING@180.211.188.180] has joined #openvpn
03:53 < syn4pse-> https://forums.openvpn.net/topic8339.html#p13123 <- updated ;)
03:53 <@vpnHelper> Title: OpenVPN Support Forum fresh setup, cannot determine what i made wrong. : Configuration (at forums.openvpn.net)
03:59 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
04:07 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
04:09 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:09 -!- venom00ut [~venom00@unaffiliated/venom00] has left #openvpn []
04:16 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
04:18 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has quit [Read error: Connection reset by peer]
04:18 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
04:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:47 <@vpnHelper> RSS Update - forum: fresh setup, cannot determine what i made wrong. <http://forums.openvpn.net/topic8339.html#p13125>
04:49 -!- snak3b8 [~n1xman@59.163.254.66] has joined #openvpn
04:49 -!- n1xman [~n1xman@59.163.254.66] has quit [Read error: Connection reset by peer]
04:51 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has joined #openvpn
05:01 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
05:02 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
05:20 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:20 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:20 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:29 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13126>
05:53 -!- EugeneKaway is now known as EugeneKay
05:54 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
06:23 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13127>
06:39 -!- K1ng [~KING@180.211.188.180] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
06:50 -!- snak3b8 [~n1xman@59.163.254.66] has quit [Ping timeout: 258 seconds]
06:52 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
06:55 -!- Gh0sty [~ghosty@77.109.78.17] has left #openvpn []
07:01 -!- K1ng [~KING@180.211.188.180] has joined #openvpn
07:05 <@vpnHelper> RSS Update - forum: fresh setup, cannot determine what i made wrong. <http://forums.openvpn.net/topic8339.html#p13128>
07:17 -!- dazo is now known as dazo_afk
07:17 -!- dazo_afk is now known as dazo
07:26 -!- EugeneKay is now known as EugeneKaway
07:29 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13129>
07:31 -!- EugeneKaway is now known as EugeneKay
07:36 -!- NoReGreT [~regret@unaffiliated/noregret] has quit [Ping timeout: 258 seconds]
07:38 < syn4pse-> !route
07:38 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
07:38 -!- NoReGreT [~regret@unaffiliated/noregret] has joined #openvpn
07:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:45 -!- n1xman [~n1xman@59.163.254.66] has joined #openvpn
07:47 <@vpnHelper> RSS Update - forum: [SOLVED] fresh setup, cannot determine what i made wrong. <http://forums.openvpn.net/topic8339.html#p13130>
07:51 < syn4pse-> !tcpip
07:51 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
08:06 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
08:06 -!- Nowak [nowak@worldwind/developer/Nowak] has quit [Ping timeout: 252 seconds]
08:09 -!- chrispercol [5d61f643@gateway/web/freenode/ip.93.97.246.67] has joined #openvpn
08:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
08:13 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
08:15 < chrispercol> hi, does anyone know how programmatically kill their own openvpn client? I want to run up a connection on the linux cli, do some stuff, then kill my connection...anyone any thoughts?
08:17 < hyper_ch> sudo /etc/init.d/openvpn stop
08:29 <@dazo> chrispercol: also look at the management interface ... that can be used as well ... http://openvpn.net/index.php/open-source/documentation/miscellaneous/79-management-interface.html
08:29 <@vpnHelper> Title: Management Interface (at openvpn.net)
08:31 -!- n1xman [~n1xman@59.163.254.66] has quit [Ping timeout: 240 seconds]
08:32 -!- NoReGreT [~regret@unaffiliated/noregret] has quit [Remote host closed the connection]
08:32 -!- NoReGreT [~regret@212.101.242.27] has joined #openvpn
08:32 -!- NoReGreT [~regret@212.101.242.27] has quit [Changing host]
08:32 -!- NoReGreT [~regret@unaffiliated/noregret] has joined #openvpn
08:32 -!- NoReGreT [~regret@unaffiliated/noregret] has quit [Read error: Connection reset by peer]
08:37 -!- NoReGreT [~regret@212.101.242.27] has joined #openvpn
08:37 -!- NoReGreT [~regret@212.101.242.27] has quit [Changing host]
08:37 -!- NoReGreT [~regret@unaffiliated/noregret] has joined #openvpn
08:37 < chrispercol> thanks guys, the answer is so simple I'm thinking I need a break :-)
08:39 < chrispercol> too happy their too quick...I'm not trying to stop openvpn service but openvpn client, /etc/init.d/openvpn doesn't stop local client and I think management interface also refers to server ?
08:42 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13131>
08:46 -!- cpm_ [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Disconnected by services]
08:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Connection reset by peer]
08:48 -!- cpm_ is now known as cpm
08:50 < Doonz> Hey guys, can someone point me to a dummies guide to setting up a openvpn server and 1 client
08:52 -!- hpa [hpa@terminus.zytor.com] has quit [Excess Flood]
08:53 < krzee> !howto
08:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:53 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
08:53 < Doonz> wow
08:53 < krzee> !goal
08:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:54 < Doonz> I would like to access the       catsup
08:54 < Doonz>                    internet over my vpn 
08:55 < Doonz> Options error: --server directive network/netmask combination is invalid
08:55 < Doonz> Use --help for more information.
08:55 < Doonz> so whats that mean
08:56 < Doonz> awe some one krzee isnt there a command you can type to make the bot spit out something generic
08:56 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 246 seconds]
08:57 < krzee> catsup internet?
08:57 < chrispercol> still scrathing my head here...how do I kill openvpn client in the linux commandline from bash...without doing a ctrl+c?
08:57 < krzee> !sample
08:57 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
08:57 < krzee> !redirect
08:57 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
08:58 < Doonz> krzee: thanx i did use the sample configuration and thats what the log is spitting out
08:58 < Doonz> but by all means please keep flexing the bot commands
08:58 < krzee> you didnt use my sample config
08:58 < krzee> not sure what sample you used
08:58 < Doonz> on the site
08:59 < krzee> and whats that have to do with !sample
08:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
08:59 < Doonz> ill give yours a try
09:00 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
09:00 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
09:01 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
09:01 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
09:01 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:01 < syn4pse-> help me please: https://forums.openvpn.net/post13132.html#p13132 :)
09:01 <@vpnHelper> Title: OpenVPN Support Forum [SOLVED] fresh setup, cannot determine what i made wrong. : Configuration (at forums.openvpn.net)
09:01 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
09:02 < syn4pse-> one step closer to my solution
09:03 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
09:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
09:03 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:03 -!- Cain` is now known as Cain
09:03 <@vpnHelper> RSS Update - forum: [SOLVED] fresh setup, cannot determine what i made wrong. <http://forums.openvpn.net/topic8339.html#p13132>
09:04 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has joined #openvpn
09:05 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
09:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:08 < Doonz> krzee: heres the error i get when i run your config 
09:08 < Doonz> Wed Jun 22 09:07:44 2011 us=313458 Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
09:08 < Doonz> Wed Jun 22 09:07:44 2011 us=313468 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
09:08 < Doonz> Wed Jun 22 09:07:44 2011 us=314064 Cannot allocate TUN/TAP dev dynamically
09:08 < Doonz> Wed Jun 22 09:07:44 2011 us=314081 Exiting
09:10 < syn4pse-> your kernel has support for tun/tap ?
09:10 < Doonz> ubuntu 10.04
09:10 < syn4pse-> maybe running with openvz or some virtulization thingy?
09:10 < Doonz> 32bit server...
09:11 -!- syn4pse- is now known as syn4pse
09:14 < syn4pse> Doonz?
09:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:15 < Doonz> got someone else helping me
09:15 < krzee> that just means you dont have tun
09:16 < krzee> go compile it into your kernel, or load the kernel module
09:16 < syn4pse> unless its a vps/rps with openvz or kvm then you might need to do something else ;)
09:18 -!- eth00 [~r00t@unaffiliated/eth00] has joined #openvpn
09:25 -!- NoReGreT [~regret@unaffiliated/noregret] has quit [Remote host closed the connection]
09:25 <@vpnHelper> RSS Update - forum: [open] fresh setup, cannot determine what i made wrong. <http://forums.openvpn.net/topic8339.html#p13132>
09:25 -!- NoReGreT [~regret@212.101.242.27] has joined #openvpn
09:25 -!- NoReGreT [~regret@212.101.242.27] has quit [Changing host]
09:25 -!- NoReGreT [~regret@unaffiliated/noregret] has joined #openvpn
09:26 -!- NoReGreT [~regret@unaffiliated/noregret] has quit [Read error: Connection reset by peer]
09:31 -!- NoReGreT [~regret@212.101.242.27] has joined #openvpn
09:31 -!- NoReGreT [~regret@212.101.242.27] has quit [Changing host]
09:31 -!- NoReGreT [~regret@unaffiliated/noregret] has joined #openvpn
09:32 -!- ba6 [~bag@Pix.producepro.com] has joined #openvpn
09:34 -!- datruth [datruth@gotpot.org] has joined #openvpn
09:35 < datruth> Can openvpn be ran in FreeBSD 8.2-rel jail?
09:36 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Ping timeout: 260 seconds]
09:37 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has quit [Read error: Connection reset by peer]
09:38 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has joined #openvpn
09:39 -!- hamush [~rootjklol@cpe-70-113-87-159.austin.res.rr.com] has joined #openvpn
09:39 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:40 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 252 seconds]
09:40 -!- Flecks [~fleck@unaffiliated/fleck] has joined #openvpn
09:40 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Remote host closed the connection]
09:41 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
09:43 < hamush> !welcome
09:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:43 < syn4pse> !redirect
09:43 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
09:43 < syn4pse> !def1
09:43 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
09:45 < datruth> !jail
09:45 < datruth> !freebsd
09:45 -!- chrispercol [5d61f643@gateway/web/freenode/ip.93.97.246.67] has quit [Quit: Page closed]
09:45 <@vpnHelper> "freebsd" is http://www.secure-computing.net/wiki/index.php/OpenVPN_Server
09:46 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:46 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:46 <@vpnHelper> RSS Update - forum: [open] problem with the routes, connection to openvpn works! <http://forums.openvpn.net/topic8339.html#p13132>
09:47 < datruth> !vps
09:47 < datruth> !chroot
09:47 < datruth> damn
09:48 < syn4pse> datruth what are you trying to accomplish?
09:48 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:48 -!- metalfan_ [~xxx@141.41.93.164] has joined #openvpn
09:48 < metalfan_> hi
09:49 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:49 < metalfan_> ive read "Expanding the scope of the VPN to ..."      but im unsure what my situation is. i would like to integrate a new client that is neither on the server nor on the client side. its a third network, if thats the corret term.  which variant should i use to get it connected?
09:50 < datruth> syn4pse: I'd like to run openvpn under a FreeBSD 8.2 jail.
09:51 < syn4pse> oj never used freebsd ;)
09:51 < datruth> what doe oj mean?
09:51 < syn4pse> http://www.secure-computing.net/wiki/index.php/FreeBSD_OpenVPN_Server/Routed
09:51 <@vpnHelper> Title: FreeBSD OpenVPN Server/Routed - Secure Computing Wiki (at www.secure-computing.net)
09:52 < datruth> syn4pse: yeah already got that from !freebsd
09:52 < datruth> syn4pse: can I use certificates + user/pass?
09:52 < datruth> If so how can I do the user pass?
09:52 < syn4pse> I have no idea tbh ;)
09:53 < syn4pse> just started using openvpn myself and trying to get into it ;)
09:53 < datruth> mm I see
09:54 -!- datruth [datruth@gotpot.org] has quit [Remote host closed the connection]
09:55 < hamush> hi, i currently have openvpn setup with dynamically assigned addresses.  if i want to add some static addresses, do they have to be in a different subnet than my dynamic addresses are?
09:55 -!- NoReGreT [~regret@unaffiliated/noregret] has quit [Quit: leaving]
10:03 -!- EugeneKay is now known as EugeneKaway
10:03 -!- EugeneKaway is now known as EugeneKay
10:07 < hamush> i have just discovered the ifconfig-pool-persist directive.  my openvpn server does not respect its contents for some reason.  nothing appears to be written in the syslog about it.  any recommendations on where to start troubleshooting?
10:09 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
10:15 -!- sbalneav [~sbalneav@mail.legalaid.mb.ca] has joined #openvpn
10:15 < sbalneav> !welcome
10:15 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:15 < sbalneav> !goal
10:15 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:17 < sbalneav> Hello.  I've got a very nicely functioning OpenVPN system, but the segment of ip addresses I'm bridging in the server-bridge statement has "run out of room" i.e. there's other hosts at the next addresses.  Can I specify multiple server-bridge stanzas so that I can use up a gap in my IP addresses elsewhere?  Or do I need to "shuffle my addresses around" to get a bigger block?
10:23 < hamush> hello, i would like to use the ifconfig-pool-persist directive as documented. currently, openvpn creates a blank ipp.txt, but entries are never added.  manually added entries are ignored.  random ips are assigned to my clients on each reconnect.  does anyone have any tips for how to troubleshoot this problem?
10:23 < krzee> sbalneav, if you have that many hosts, a bridge isnt for you
10:24 < krzee> bridges operate on layer2, they dont scale very well
10:24 -!- K1ng [~KING@180.211.188.180] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
10:24 < krzee> hamush, sounds like either a permissions issue or more likely you didnt use a full path, however... be sure you know what ipp.txt is actually for
10:24 < krzee> !ipp
10:24 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
10:25 < krzee> in my experience most people who use ipp do it because they think its a good way to make static ips... it is not
10:26 -!- K1ng [~KING@180.211.188.180] has joined #openvpn
10:26 < sbalneav> krzee: well, I've only got about 32 hosts that I want to bridge, but I started with 16, and that block's full.  So, I've either got to move some hosts out of the way to make the block size a consecutive 32, or have 2 16 addr blocks.
10:26 < hamush> hmm... i tried giving it 666 permission but that didn't help.  you're right, i'm trying to get a static ip, but was having trouble with the ccd methodology.  i'll do more research.
10:26 < krzee> sbalneav, why not use a /24
10:27 < krzee> !static
10:27 < hamush> !static
10:27 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
10:27 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
10:27 < hamush> jinx ;)
10:27 < krzee> ;]
10:28 < hamush> if i use the method listed here, do i need to choose a different subnet than my dynamic range?
10:28 < hamush> !topology
10:28 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
10:28 < krzee> nope
10:29 < krzee> but i wouldnt start by assigning the lowest ips to be static
10:34 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
10:35 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
10:38 < hamush> i've set up a static ip with a cdd, but i keep on getting dynamic addresses.  is there a way that i can verify that my ccd config is actually being read?
10:38 < EugeneKay> Make sure it's named ccd, not cdd
10:39 < ecrist> the name doesn't matter
10:39 < ecrist> as long as it matches your config value
10:39 < EugeneKay> Indicative typo ;-)
10:40 < krzee> hamush, of course there is... by reading the logs
10:40 < krzee> lol
10:40 < hamush> looks like that typo was just in irc, but not in the config or dir name
10:40 < krzee> !path
10:40 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
10:41 < hamush> full paths didn't fix it, unfortunately
10:43 < hamush> i've got verb 9 logs on, but i don't see anything that specifically mentions the ccd config name... is it expected that the logs will mention loading the ccd file?
10:44 < ecrist> I don't think so
10:44 < krzee> yes
10:44 < ba6> is it feasible for a fairly robust linux server to handle 100 different openvpn daemons, each with different client group?
10:44 < krzee> assuming high enough verb
10:44 < krzee> verb 4 surely will
10:45 < krzee> ba6, whats a "client group" ?
10:45 < ba6> sorry, not sure of correct nomenclature
10:45 < krzee> oh actual different daemons?!? LOL why?
10:45 < krzee> there exists --server now :-p
10:45 < ba6> distinctly different client configurations
10:45 < krzee> its not openvpn-1 anymore
10:45 < krzee> how different...?
10:45 < hamush> the only log reference to ccd i can find is: ovpn-server[22437]: 70.113.87.XXX:43466 TEST FILE 'ccd/UNDEF' [0]
10:46 < krzee> hamush, 
10:46 < krzee> !configs
10:46 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
10:46 < krzee> !logs
10:46 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
10:46 < ba6> we have 100 different customers, we'd like to keep their networks/vpn configurations completely isolated from one another
10:46 < ba6> i'm not sure of the best situation to do so
10:47 < ba6> today we use n2n with limited success   http://www.ntop.org/n2n/ 
10:47 <@vpnHelper> Title: ntop - network top (at www.ntop.org)
10:47 < krzee> you dont need 100 different daemons for that
10:47 < krzee> haha
10:47 < ba6> glad to hear that :)
10:47 < krzee> just use --server with default topology, and do not enable client-to-client
10:47 < hamush> :(  i just ran out of time to solve this issue before i have to leave town. i appreciate all the help, though! :)
10:47 < krzee> and allow the server to firewall them from eachother
10:47 < krzee> !c2c
10:47 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
10:47 <@vpnHelper> clients
10:48 < ba6> i saw mention of multiple daemons in some recipe somewhere
10:48 < krzee> ba6, yep, openvpn1 had no --server
10:48 < krzee> that was you only option way back when
10:49 < ba6> in the config you suggested, would it allow for each customer to have unique network & authentication method?
10:49 < krzee> pls explain why they would need a unique network?
10:49 < ba6> or are you suggesting all clients are similar, you just prevent c2c
10:49 < catsup> someone also posted a recipe where one daemon was run per cpu
10:50 < krzee> catsup, sure, thats because each daemon binds to a single core
10:50 < krzee> its a way of getting more clients on a single machine
10:50 < catsup> right
10:50 < krzee> nothing to do with his goal
10:50 < ba6> unique network would only be required for our migration purposes..   we have 200+ nodes monitored/accessed over our current configuration..  moving them ALL to new IP's/new network(s) would be painful
10:50 < krzee> and i doubt he has 100 cores
10:50 < catsup> well of course
10:50 < ba6> close,  8  ;)
10:51 < krzee> ba6, kinda, it would require more work
10:51 < krzee> ie: static ips manually configured for all
10:51 < ba6> that's how we'd like it actually
10:51 < catsup> just another explanation for why a recipe might involve multiple daemons
10:51 < krzee> likely more work than fixing your current setup
10:52 < ba6> brb, thanks for info so far, i'll be back with some more questions.. got a meeting
10:53 < krzee> yw
10:54 < krzee> btw in the howto they configure clients in their own ranges
10:54 < krzee> !policy
10:54 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
10:54 -!- hamush [~rootjklol@cpe-70-113-87-159.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
10:54 < krzee> #1
10:56 -!- n1xman [~n1xman@124.43.118.219] has joined #openvpn
11:00 -!- Blues-Man [~bluesman@host175-26-dynamic.44-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
11:07 -!- tenaglia [~jack@pb-d-128-141-98-44.cern.ch] has quit [Quit: leaving]
11:10 <@vpnHelper> RSS Update - forum: OpenSSL Issue - Win7 x64 [EDITED] <http://forums.openvpn.net/topic8337.html#p13133>
11:13 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:13 -!- n1xman [~n1xman@124.43.118.219] has quit [Read error: Connection reset by peer]
11:13 -!- n1xman [~n1xman@124.43.118.219] has joined #openvpn
11:19 < syn4pse> please assist: https://forums.openvpn.net/topic8339.html
11:19 <@vpnHelper> Title: OpenVPN Support Forum [open] problem with the routes, connection to openvpn works! : Configuration (at forums.openvpn.net)
11:26 -!- dazo is now known as dazo_afk
11:28 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 240 seconds]
11:33 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
11:37 -!- K1ng [~KING@180.211.188.180] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
11:38 -!- K1ng [~KING@180.211.188.180] has joined #openvpn
11:44 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
11:46 -!- havoc [~havoc@neptune.chaillet.net] has quit [Quit: brb]
11:46 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
11:47 -!- n1xman [~n1xman@124.43.118.219] has quit [Ping timeout: 276 seconds]
11:47 -!- EugeneKay is now known as EugeneKaway
11:51 -!- n1xman [~n1xman@124.43.118.219] has joined #openvpn
11:54 < eth00> With a setup using tun0 and ifconfig-pool-persist what is the best way to move IPs between servers? I need to failover a vpn client IP...The best I have come up with is moving the certificate that it uses to connect and I think it will pick up the IP of that certificate
11:54 < eth00> Are there any other better ideas?
11:56 -!- EugeneKaway is now known as EugeneKay
11:56 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:00 -!- Riz [~riz@syn.theintertubes.ca] has quit [Ping timeout: 264 seconds]
12:00 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 264 seconds]
12:00 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
12:00 -!- Riz [~riz@syn.theintertubes.ca] has joined #openvpn
12:09 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
12:09 -!- mode/#openvpn [+o raidz] by ChanServ
12:16 -!- Pr0zoid [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has joined #openvpn
12:16 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Operation timed out]
12:17 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has quit [Ping timeout: 240 seconds]
12:18 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:21 < Doonz> Anyone willing to set up openvpn server on my box for 25 bux?
12:22 < krzee> what are your needs?
12:22 < krzee> !goal
12:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:22 < krzee> and are you sure youd rather pay than learn?
12:23 < krzee> pointing to docs and even sample configs is free ;]
12:23 < krzee> we even prefer that you choose to learn
12:24 < krzee> with that said, we do have !donate, and if you want a somewhat easy setup, i could likely be bribed
12:26 -!- n1xman [~n1xman@124.43.118.219] has quit [Ping timeout: 264 seconds]
12:31 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Ping timeout: 276 seconds]
12:32 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
12:33 -!- luneff [~yury@84.51.197.107] has joined #openvpn
12:50 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
12:51 < Riz> Doonz: I saw your pastbin from the other channel, what shows up in your log files. you likely have something wrong in your server config
12:58 < pwrcycle> is it possible to have diff "remote"'s  that use UDP & TCP in the same client config?
12:59 < pwrcycle> ie, a client.conf with "remote example.com 1194" using udp and remote example.com 443 using tcp, but in the same config?
12:59 < krzee> yep, using connection blocks
12:59 < krzee> !man
12:59 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
12:59 < krzee> <connection>
13:00 < pwrcycle> krzee: ok. i see in the <connection> the "remote" statemnet has protocol at the end...
13:01 < pwrcycle> can a regular "remote" statement have proto specified?
13:02 < krzee> you ask the question, i ive the answer, and instead of taking it you ask if my answer is right or not
13:02 < krzee> lol
13:02 < krzee> s/ive/give/
13:02 < pwrcycle> just trying to find undocumented options if they're there :)
13:03 < krzee> <connection>
13:03 < krzee> :-p
13:28 -!- sbalneav [~sbalneav@mail.legalaid.mb.ca] has quit [Quit: leaving]
13:39 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
13:55 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:08 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has quit [Ping timeout: 260 seconds]
14:13 <@vpnHelper> RSS Update - forum: Cannot Tunnel Local Connection <http://forums.openvpn.net/topic8338.html#p13134>
14:18 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has joined #openvpn
14:31 < amero> i know this is slightly off topic but i'm trying to set up a socks proxy server on my vpn server so i could selectively choose which app to route through the vpn
14:32 < amero> could you recommend me a simple proxy server
14:33 < krzee> sure
14:33 < amero> i need to be able to accept incoming connections, so ssh socks isn't an option for me
14:33 < krzee> !route_by_app
14:33 < amero> hmm krzee ?
14:33  * krzee hits vpnHelper 
14:33 < krzee> !ping
14:33 <@vpnHelper> pong
14:34 < krzee> !factoids search app
14:34 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
14:34 < krzee> !sockd
14:34 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
14:34 < krzee> ssh socks also wouldnt tunnel UDP
14:35 < krzee> which is 1 reason why it was unacceptable for me
14:36 -!- MarKsaitis_ [~MarKsaiti@195.59.185.18] has joined #openvpn
14:37 < amero> dante could forward incoming connections to me?
14:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:38 < amero> krzee: what about ss5? http://ss5.sourceforge.net/
14:38 <@vpnHelper> Title: SS5 Socks Server (at ss5.sourceforge.net)
14:38 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 255 seconds]
14:39 < krzee> use whatever you like
14:39 < krzee> as far as if it can forward incoming to you, i dunno
14:39 < krzee> ild imagine not, but dunno...
14:39 < krzee> well actually...
14:40 < krzee> it could either way
14:40 < krzee> the socks would be for your outbound connection
14:40 -!- raidz1 [~Administr@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
14:40 < krzee> youd still have the vpn link either way
14:40 < krzee> socks replaces snat
14:40 < krzee> dnat would be your incoming, not replaced by socks
14:40 < krzee> so you would nat that traffic as if you didnt have a socks
14:40 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 264 seconds]
14:41 < krzee> hrm but then your return traffic would flow over the socks server
14:41 -!- raidz1 is now known as raidz
14:41 < krzee> im nor sure how that would work...
14:41 -!- raidz [~Administr@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Changing host]
14:41 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
14:41 < krzee> but if it works on 1, it'll work on the others
14:41 < krzee> it wont be specific to your sockd afaik
14:42 < krzee> that could potentially be solved with a second routing table
14:42 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Ping timeout: 258 seconds]
14:42 < krzee> no i dont have experience with that, you'll get to learn that on your own quite possibly
14:42 < krzee> but hints re: second routing table are here:
14:43 < krzee> !factoids search bypass
14:43 <@vpnHelper> No keys matched that query.
14:43 < krzee> !factoids search redirect
14:43 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:43 < krzee> hrmm
14:43 < krzee> !factoids search route
14:43 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
14:43 < krzee> !route_override
14:43 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet, or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
14:43 < krzee> !splitroute
14:43 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet, or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
14:46 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
14:48 < amero> hmm that doesn't sound as easy as i thought
14:48 <@vpnHelper> RSS Update - forum: Connect but "Request Time Out" pinging to the LAN computers <http://forums.openvpn.net/topic8340.html>
14:49 < krzee> the good news, its likely a combo of splitroute and dnat
14:49 < krzee> the bad news, you get to figure out if thats true or not on your own ;]
14:54 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
15:00 < Dougy> krzee: whats poppin moe
15:00 < krzee> just got let out of work early
15:00 < Dougy> what  u doing for work
15:00 < krzee> i showed up a shift early, the boss said i can just work that shift today instead of staying
15:00 < krzee> tech shiz
15:01 < Dougy> that sounds boring
15:01 < Dougy> become a mob boss
15:01 < Dougy> krzee:  seen this? http://www.youtube.com/watch?v=p4ebtj1jR7c
15:01 < krzee> way more boring after you write scripts to do everything
15:01 <@vpnHelper> Title: YouTube - AA-12. Worlds deadliest shotgun! (at www.youtube.com)
15:02 < krzee> nah never fired one of those
15:02 < krzee> looks sweet tho
15:02 < krzee> im not much for fully auto weapons tho
15:02 < krzee> i prefer a 3round burst
15:04 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Quit: Leaving]
15:09 -!- Chris___ [goose@staff.ext3.net] has left #openvpn ["The problem with eating and driving, which I love to do, is not being able to have my hands on the wheel at the 10 and 2 position. It's a matter of public safety."]
15:15 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
15:17 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13136>
15:24 < EugeneKay> Dougy - this is a far better demonstration video. He's a professional Russian! http://youtu.be/WOoUVeyaY_8
15:24 <@vpnHelper> Title: YouTube - AA-12 Fully Automatic Shotgun!!! (at youtu.be)
15:29 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
15:29 -!- havoc__ [~havoc@neptune.chaillet.net] has quit [Client Quit]
15:33 -!- toortog [~toortog@notsecure.net] has quit [Read error: Connection reset by peer]
15:35 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
15:35 -!- toortog [~toortog@notsecure.net] has joined #openvpn
15:55 < Dougy> EugeneKay: lol
15:55 < Dougy> krzee: grenade launcher fully automatic shotgun is boss
15:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
16:02 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:04 -!- EugeneKay is now known as EugeneKaway
16:15 <@vpnHelper> RSS Update - forum: OpenVPN 2.2 Branch and OpenSC with pkcs#11 <http://forums.openvpn.net/topic8341.html>
16:15 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:28 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
16:29 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
16:34 -!- hello90843 [~webchat@205.185.117.21] has joined #openvpn
16:34 -!- hello90843 [~webchat@205.185.117.21] has left #openvpn []
16:37 -!- elfredy [~webchat@205.185.117.21] has joined #openvpn
16:37 -!- elfredy [~webchat@205.185.117.21] has quit [Client Quit]
16:38 -!- MarKsaitis_ [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 258 seconds]
16:45 -!- test__ [~webchat@webchat.openvpn.net] has joined #openvpn
16:45 -!- test__ [~webchat@webchat.openvpn.net] has quit [Client Quit]
17:01 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
17:05 -!- EugeneKaway is now known as EugeneKay
17:10 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
17:12 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
17:21 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
17:28 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:38 -!- luneff [~yury@84.51.197.107] has quit [Quit: This computer has gone to sleep]
17:52 -!- Guest86177 [~paul@host28.200-82-50.telecom.net.ar] has quit [Remote host closed the connection]
18:02 -!- metalfan_ [~xxx@141.41.93.164] has left #openvpn ["Verlassend"]
18:12 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:20 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:34 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has quit [Ping timeout: 250 seconds]
18:40 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:58 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has joined #openvpn
19:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:04 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:17 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
19:27 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
19:29 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 276 seconds]
19:53 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
19:54 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
19:58 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13138>
19:58 -!- n1xman [~n1xman@124.43.126.133] has joined #openvpn
20:03 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
20:03 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 258 seconds]
20:06 < pwrcycle> !man
20:06 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
20:08 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
20:12 < n1xman> hi, is OpenVPN AS support is active on ask something before purchase them..? 
20:13 -!- master_of_master [~master_of@p57B5536E.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:15 < n1xman> And their Live Support is always Offline 
20:15 -!- master_of_master [~master_of@p57B5562D.dip.t-dialin.net] has joined #openvpn
20:18 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:24 < pwrcycle> can anyone tell me why this new <connection> settings are failing on 443? http://pastebin.com/xSpDvrCD
20:50 -!- EugeneKay is now known as EugeneKaway
21:21 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:42 < krzie> Unknown Paste ID!
21:42 < krzie> nope, cant tell ya
21:43 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:50 -!- syn4pse- [~syn@p5DDC0839.dip0.t-ipconnect.de] has joined #openvpn
21:51 -!- syn4pse [~syn@p5DDC0837.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:54 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 258 seconds]
22:39 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:43 -!- ovpn2ac [ca0c5ed3@gateway/web/freenode/ip.202.12.94.211] has joined #openvpn
22:44 < ovpn2ac> !welcome
22:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:44 < ovpn2ac> !goal
22:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:45 < ovpn2ac> !logs
22:45 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
22:46 < ovpn2ac> !configs
22:46 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
22:46 < ovpn2ac> !interface
22:46 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
22:46 < ovpn2ac> !howto
22:46 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:46 < ovpn2ac> !route
22:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
22:47 < ovpn2ac> !tcpip
22:47 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
22:47 < ovpn2ac> !redirect
22:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
22:47 < ovpn2ac> !ipforward
22:47 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
22:48 < ovpn2ac> !linipforward
22:48 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
22:48 < ovpn2ac> !def1
22:48 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
22:49 < ovpn2ac> !nat
22:49 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
22:53 -!- Riz [~riz@syn.theintertubes.ca] has quit [Ping timeout: 260 seconds]
23:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:05 -!- n1xman [~n1xman@124.43.126.133] has quit [Ping timeout: 264 seconds]
23:08 -!- ovpn2ac [ca0c5ed3@gateway/web/freenode/ip.202.12.94.211] has quit [Ping timeout: 252 seconds]
23:11 -!- K1ng [~KING@180.211.188.180] has quit [Ping timeout: 264 seconds]
23:15 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
23:33 <@vpnHelper> RSS Update - forum: Server authentication "hangs" <http://forums.openvpn.net/topic8342.html>
23:35 -!- ovpn2ac [ca0c5ed3@gateway/web/freenode/ip.202.12.94.211] has joined #openvpn
23:37 < ovpn2ac> anyone around?
23:41 < catsup> o ya
23:42 < catsup> where are you getting those triggers?  is that your bot?
23:42 < ovpn2ac> triggers?
23:42 < catsup> words that trigger the bot e.g. '!nat'
23:43 < ovpn2ac> its the channel bot
23:43 < catsup> ok
23:43 < ovpn2ac> ah.. was hoping you could help me with openvpn problem
23:44 < ovpn2ac> with my*
23:44 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has quit [Quit: Bye!]
23:44 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
23:44 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 250 seconds]
23:45 < catsup> what is it
23:45 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has joined #openvpn
23:45 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 264 seconds]
23:45 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
23:46 < catsup> tell me and we will soon find out whether your hope will come to be
23:46 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
23:47 < ovpn2ac> well
23:47 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
23:48 < ovpn2ac> im on the school pc now...and i can connect back to my home pc(openvpn on ubuntu Virtual Machine)
23:48 < ovpn2ac> but
23:49 < ovpn2ac> whenever i use push "redirect-gateway def1"....i have dns lookup failed
23:50 < ovpn2ac> and i have push "dhcp-option DNS 8.8.8.8"
23:50 < ovpn2ac> and i have push "dhcp-option DNS 8.8.4.4"
23:50 < Bushmills> linux or unix client?
23:51 < ovpn2ac> windows xp.. and i tried this http://support.microsoft.com/kb/311218 too
23:51 <@vpnHelper> Title: Cannot Change the Binding Order for Remote Access Connections (at support.microsoft.com)
23:52 < Bushmills> check what name server the client actually uses
23:53 < Bushmills> alternatively, read about  bypass-dns  in man page  
23:54 < ovpn2ac> also.. when i remove redirect-gateway def1.... i can access the internet... but when i go to whatismyip.com....it doesnt show the vpn address
23:55 < Bushmills> without redirect-gateway, you traffic isn't routed through openvpn server
23:55 < ovpn2ac> yea..and i want it to be routed through the server...ill go try bypass-dns now
23:55 < Bushmills> with redirect-gateway, can you access systems on internet by ip address?  for example. ping 8.8.8.8 ?
23:58 -!- n1xman [~n1xman@59.163.254.66] has joined #openvpn
--- Day changed Thu Jun 23 2011
00:00 -!- ovpn2ac [ca0c5ed3@gateway/web/freenode/ip.202.12.94.211] has quit [Ping timeout: 252 seconds]
00:03 -!- ovpn2ac [ca0c5ed3@gateway/web/freenode/ip.202.12.94.211] has joined #openvpn
00:03 < ovpn2ac> tried push "redirect-gateway def1 bypass-dns" Error 118 (net::ERR_CONNECTION_TIMED_OUT): The operation timed out.
00:04 -!- K1ng` [~KING@180.211.188.217] has joined #openvpn
00:04 < ovpn2ac> when i try to visit a website
00:04 < Bushmills> your problem isn't your name server. your problem is that your openvpn server doesn't forward traffic 
00:05 < ovpn2ac> so i need a add a static route on the server?
00:05 < Bushmills> no. you need to enable ip forwarding, and set up nat
00:06 < ovpn2ac> i have ip fowarding enabled
00:06 < ovpn2ac> for nat.. i have...
00:07 < ovpn2ac> iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o br0 -j MASQUERADE
00:07 < ovpn2ac> iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o venet0 -j SNAT --to 192.168.0.192 
00:08 < ovpn2ac> i also have
00:08 < ovpn2ac> iptables -A INPUT -i tap0 -j ACCEPT
00:09 < ovpn2ac> iptables -A INPUT -i br0 -j ACCEPT
00:09 < ovpn2ac> iptables -A FORWARD -i br0 -j ACCEPT
00:09 < ovpn2ac> all in rc.local
00:09 < Bushmills> does server nat incoming traffic?
00:10 < ovpn2ac> how can i test that
00:11 < Bushmills> for example, by running netstat-nat.  or check outgoing traffic using tcpdump.  or traceroute on client, see how far it gets you
00:17 < ovpn2ac> !goal
00:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:26 -!- K1ng` [~KING@180.211.188.217] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
00:31 < ovpn2ac> i did tracert to my remote address...
00:32 < ovpn2ac> http://pastebin.com/8iDY7wyQ
00:33 < ovpn2ac> http://pastebin.com/vjxcXrQb
00:36 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
00:42 -!- ovpn2ac [ca0c5ed3@gateway/web/freenode/ip.202.12.94.211] has quit [Quit: Page closed]
00:42 -!- K1ng [~KING@180.211.188.217] has joined #openvpn
01:03 -!- K1ng [~KING@180.211.188.217] has quit [Ping timeout: 252 seconds]
01:30 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:38 -!- luneff [~yury@84.51.197.107] has joined #openvpn
01:44 -!- K1ng` [~KING@180.211.188.217] has joined #openvpn
01:47 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:47 -!- mode/#openvpn [+o mattock] by ChanServ
01:57 -!- K1ng` [~KING@180.211.188.217] has quit [Ping timeout: 240 seconds]
02:03 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
02:12 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
02:12 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
02:14 -!- dazo_afk is now known as dazo
02:16 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 244 seconds]
02:21 -!- DennisG [~Dennis@vpn.office.onixus.nl] has joined #openvpn
02:21 < DennisG> !~welcom
02:21 < DennisG> !welcome
02:21 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:21 < DennisG> !goal
02:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:23 < DennisG> Hello - I'm having this http://pastebin.com/UBrKkA7W error.. what could be wrong? My configs seem to be correct since it does work on other devices..
02:25 < DennisG> Sorry not to mention, but this is a client, not an openvpns erver
02:26 <@dazo> #
02:26 <@dazo> #
02:26 <@dazo> Thu Jun 23 09:19:24 2011 /sbin/route add -net 172.16.0.0 netmask 255.255.255.0 gw 172.16.0.25
02:26 <@dazo> #
02:26 <@dazo> Thu Jun 23 09:19:24 2011 /sbin/route add -net 172.16.0.0 netmask 255.255.255.0 gw 172.16.0.25
02:27 <@dazo> DennisG: you have two lines doing the same, that's your error
02:27 <@dazo> you need to figure out why the same route is set up twice
02:28 < DennisG> hmm yeah, since i just saw the route is working
02:28 < DennisG> i'll check.. thank you anyway :)
02:29 < amero> ! topology
02:30 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
02:41 -!- zu [~zu@ks355000.kimsufi.com] has quit [Quit: Terence]
02:42 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
02:51 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13141> || Cannot Tunnel Local Connection <http://forums.openvpn.net/topic8338.html#p13140>
02:57 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
02:57 <@vpnHelper> RSS Update - forum: Connect but "Request Time Out" pinging to the LAN computers <http://forums.openvpn.net/topic8340.html#p13143> || Server authentication "hangs" <http://forums.openvpn.net/topic8342.html#p13142>
03:03 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13145> || [open] problem with the routes, connection to openvpn works! <http://forums.openvpn.net/topic8339.html#p13144>
03:04 -!- jeev [~jeev@unaffiliated/jeev] has quit [Quit: ZNC - http://znc.sourceforge.net]
03:12 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
03:43 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:56 -!- pif [~ldm@90.84.144.117] has joined #openvpn
03:56 < pif> hi, how do I include a file in a conf file?
03:57 < pif> ah fount
03:57 < pif> found
04:12 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
04:24 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
04:26 < v0x> hi, I am looking for any recent openvpn client that works with windows mobile 6.5
04:26 < v0x> I have been trying that older windows mobile build from 2007 at http://ovpnppc.ziggurat29.com/ovpnppc-main.htm
04:26 <@vpnHelper> Title: OpenVPN for PocketPC (at ovpnppc.ziggurat29.com)
04:26 < v0x> it is too buggy though
04:28 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13146>
04:37 < v0x> the config i am using does work, just only sometimes
04:37 < v0x> when I use the gui, it shows the log, state et cetera seldomly
04:38 < v0x> in the logfile i see one issue when it tries to add the route to the vpn server via the route of my mobile provider
04:38 < v0x> the routes that follow after that are added without problems
04:38 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13147>
04:39 < v0x> the error is this
04:40 < v0x> route addition failed using CreateIpForwardEntry: the parameter is incorrect. [status=87 if_index=524290]
04:52 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
04:56 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13148>
05:01 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
05:01 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
05:01 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
05:08 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
05:08 < v0x> so, the route command is something like this:
05:09 < v0x> route add 85.214.nn.nn mask 255.255.255.255 178.225.177.231
05:09 -!- K1ng [~KING@180.211.188.55] has joined #openvpn
05:09 < v0x> http://support.microsoft.com/kb/151795/EN-US/ talks about error 87
05:09 <@vpnHelper> Title: Err Msg The Route Addition Failed 87 (at support.microsoft.com)
05:10 < v0x> the added route I just showed is a specific destination, not a network address
05:13 -!- DennisG [~Dennis@vpn.office.onixus.nl] has quit []
05:13 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13149>
05:14 -!- K1ng [~KING@180.211.188.55] has quit [Read error: Connection reset by peer]
05:14 -!- K1ng [~KING@180.211.188.55] has joined #openvpn
05:16 < Bushmills> is "mask" instead of "netmask" valid syntax?
05:18 < v0x> yeah, it's an api call
05:18 < v0x> it's actually not route.exeo
05:18 < v0x> -o
05:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
05:18 < v0x> i'm still searching; looks like the windows mobile api might be broken so it might be their fault
05:18 < v0x> however i have read that in relation to windows vista, not CE
05:19 < v0x> it seems that there has been a fix for that in openvpn-2.1rc2 
05:19 < v0x> but again, this is all not windows CE specific
05:19 -!- K1ng [~KING@180.211.188.55] has quit [Ping timeout: 250 seconds]
05:21 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
05:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:29 < amero> do i need multiple tun ifaces in order to run multiple instances of openvpn?
05:30 < Bushmills> yes
05:30 < amero> roger
05:30 < v0x> yes
05:31 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
05:31 -!- EugeneKaway is now known as EugeneKay
05:31 < v0x> 10-4
05:32 -!- luneff [~yury@84.51.197.107] has quit [Quit: This computer has gone to sleep]
05:33 < EugeneKay> Affirmative
05:34 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
05:34 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
05:34 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:35 -!- hamush [~rootjklol@cpe-70-113-87-159.austin.res.rr.com] has joined #openvpn
05:37 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 250 seconds]
05:41 < hamush> !logs
05:41 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
05:45 < hamush> hi, i'm trying to set up openvpn so that one of my clients has a static ip.  currently, i'm trying to use the ccd method, but i'd settle for anything that works.  my client keeps on being assigned a dynamic address from the server pool.  i suspect that the ccd file isn't being loaded.  can someone recommend a method for troubleshooting this problem?
05:51 < v0x> read your logs
05:52 < v0x> see if there's anything useful
05:52 < v0x> be sure that the ccd file contains the correct name
05:53 < hamush> does the ccd file need to contain the common name? i've only got an ifconfig-push directive in there.  i thought the common name was just read from the file name, am i mistaken?
05:54 < v0x> err, sorry
05:54 < v0x> i meant, be sure that the filename of the ccd file is correct
05:54 < hamush> ah, i see.
05:54 < v0x> pff, been working for 3 hours now to fix this openvpn problem
05:55 < v0x> how windows mobile can suck is beyond me :)
05:59 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
05:59 < hamush> windows mobile? eek! :P
06:00 < EugeneKay> Yes, those are my initials. 
06:01 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
06:05 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
06:06 < K1ng> i am extremely sorry people ;(
06:06 -!- K1ng [~KING@58.97.132.210] has quit [Client Quit]
06:06 < hamush> would anyone be willing to take a peek at my logs and fancy a guess as to why my ccd files aren't being loaded? http://pastebin.com/bUPxkVug
06:07 < hamush> i guess i shoudl pastebin my configs, too... doing that
06:08 < v0x> and the contents of the ccd file
06:15 < hamush> http://pastebin.com/3XC28sHW here's the config
06:15 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
06:16 < hamush> my goal is to someone get calculon to be assigned a static ip instead of a dynamic one... i think it's getting a dynamic ip because the ccd isn't being loaded, but i can't figure out why
06:16 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
06:17 < hamush> i've scoured the logs and am pretty desperate at this point since i can't think of any other troubleshooting avenues
06:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 244 seconds]
06:18 < reiffert> !static
06:18 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
06:18 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Remote host closed the connection]
06:18 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:18 < reiffert> !iporder
06:18 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
06:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:18 < hamush> reiffert: was that for my benefit?
06:19 < v0x> yes, ifconfig-push is not correct
06:19 < v0x> its syntax is not ipaddress gateway
06:19 < v0x> in my case at least
06:19 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13150>
06:20 < hamush> i was aiming for the syntax: ifconfig-push desired-ip netmask... is that not correct?
06:20 < v0x> indeed, it is not correct
06:21 < v0x> i admit that it's a bit vague in the manpage
06:21 < v0x> I used "openvpn --show-valid-subnets" on my client
06:21 < v0x> and what I have in a client file is for example this:
06:22 < v0x> ifconfig-push 192.168.1.138 192.168.1.137
06:22 < v0x> client being windows and server being linux
06:23 < hamush> hmm... my man page says: "--ifconfig-push local remote-netmask"... i'm also using a linux server and linux client... does that change matters?
06:23 < v0x> don't think so
06:25 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13151>
06:25 < v0x> or are you using tap?
06:25 < hamush> so is --show-valid-subnets a config option? i don't quite understand the man page entry for it
06:26 < hamush> no, i'm using tun
06:26 < v0x> ok
06:26 < v0x> well, read the above entry for !static
06:26 < v0x> and also, no, it's not a config option
06:26 -!- Riz [~riz@syn.theintertubes.ca] has joined #openvpn
06:26 < v0x> just run openvpn --show-valid-subnets
06:26 < v0x> oh, sorry, disregard
06:27 < v0x> linux client
06:27 < v0x> this is only for a Tap-Win32 thing
06:27 < hamush> oh, i see
06:27 < v0x> !static
06:27 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
06:27 < v0x> hmm
06:28 < v0x> you have the net30 topology because you didn't set another one and net30 is default
06:28 < hamush> ah, i probably need to read and figure out what net30 is
06:29 < v0x> well, it allocates a /30 subnet per client according to the manpage
06:29 < v0x> that is why the syntax for ifconfig-push is different
06:29 < v0x> so try to find a viable /30 that can be used
06:31 < v0x> if you have the 10.27.44.0/24, split it up in /30's
06:31 < syn4pse-> !reroute-gatway
06:31 < syn4pse-> ;(
06:32 < v0x> for example, it contains 10.27.44.0 (network), 10.27.44.1 (allocatable), 10.27.44.2 (allocatable), 10.27.44.3 (broadcast)
06:32 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
06:32 < v0x> are you familiar with CIDR calculation, hamush?
06:32 < hamush> yes
06:33 < amero> in server cert/key files, are there anything that are specific to that server machine only?
06:33 < v0x> good, at any rate, try to put this in your ccd file: ifconfig-push 10.27.44.6 10.27.44.5
06:33 < v0x> or choose another /30
06:33 < v0x> ambiguous question
06:33 < hamush> do you think i need to change my route directive, too?
06:33 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
06:33 < hamush> the netmask to 255.255.255.252?
06:33 < v0x> no
06:34 < v0x> you still choose /30s from the /24 pool for static ips
06:34 < hamush> gotcha, i will try this out
06:34 -!- luneff [~yury@85.26.184.171] has joined #openvpn
06:35 < v0x> so i think that you can allocate 63 /30's in a /24
06:35 < v0x> i'm no expert yet
06:35 < hamush> you're miles ahead of me :)
06:35 < v0x> :) I guess I OCD a lot on getting OpenVPN to work
06:36  * v0x smashes his phone against the table
06:36 < v0x> trial and error, hamush ;)
06:38 < hamush> hmm... i'm still getting a dynamic address from the server range in 10.27.43.0/24.... i still suspect that the ccd isn't being read for some reason, but don't know how to prove it
06:39 < v0x> client_config_dir = 'ccd'
06:39 < v0x> so the config file is being parsed
06:39 < v0x> so, what filename does the file have?
06:39 < hamush> calculon
06:39 < v0x> but is that the name of the client in the certificate
06:39 -!- luneff [~yury@85.26.184.171] has quit [Ping timeout: 255 seconds]
06:39 < v0x> i think that's where you made a small mistake
06:40 < hamush> yes.  the log shows: VERIFY OK: depth=0, /CN=calculon
06:40 < hamush> so i think that's the right file name
06:40 < v0x> easiest way could be this; when calculon is connecting to the server, the server will log its name
06:40 < v0x> oh
06:41 < hamush> hmm... maybe i should look at atime on the calculon config file
06:41 < hamush> to see if it's actually being read
06:41 < v0x> err hold on
06:41 < v0x> yes ok, indeed, that should be correct
06:42 < v0x> I got a bit confused from your logfiles
06:43 < v0x> for example, the logs talk about 10.27.43.0/24
06:43 < v0x> Jun 23 10:47:41 stop ovpn-server[18260]: 70.113.87.159:40965 SENT CONTROL [UNDEF]: 'PUSH_REPLY,route 10.27.43.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.27.43.6 10.27.43.5' (status=1)
06:44 < hamush> my ideal solution is to have a dynamic pool in 10.27.43.0/24 with calculon being assigned a static address in that pool.  i couldn't figure out how to get that to work, so i started experimenting with adding another range, 10.27.44.0/24, in the hopes that would work. that's where i am now
06:45 < v0x> ok, understood
06:45 < hamush> hmm..i have verified that the calculon file is not being read according to atime as presented by "ls -l --time=u"
06:45 < hamush> so i think that is the underlying issue, client ccd file isn't being read for some reason
06:46 < v0x> as an aside, openvpn should default to stronger security, i.e. cipher AES-256-CBC, auth SHA256
06:47 < v0x> anyway, let me look at my own config again
06:47 < v0x> I do have some static ips working
06:48 < v0x> ok, I have client-config-dir ccd but apparently I use a p2p topology :)
06:48 < v0x> you could try to set that in the server's config
06:48 < v0x> i.e. "topology p2p"
06:48 < v0x> do read the manpage about that btw
06:54 < hamush> adding "topology p2p" doesn't seem to do it :(... calculon file is still unread and calculon is still assigned an address frmo the dynamic pool
06:54  * hamush scratches head
06:56 -!- EvOr [~EvOr@midgard.adyxax.org] has joined #openvpn
06:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:58 < v0x> ok, in the logfile should be something like this: client-foobar/ww.xx.yy.zz:1030 OPTIONS IMPORT: reading client specific options from: ccd/client-foobar
06:58 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:59 < v0x> I have that in my logs for all nodes that have ccd-files
07:00 < hamush> hmm... definitely not present :(
07:01 < v0x> well then
07:01 < v0x> try to set the config option 'ccd-exclusive'
07:02 < hamush> i will try that soon, but for now i must go
07:02 < hamush> thank you so much for your help!
07:02 < v0x> and, also in the manpage: --client-config-dir filename as derived from common name or username
07:02 < v0x> sure thing, gl :)
07:03 < hamush> thanks :)
07:06 -!- haotian [~null@unaffiliated/haotian] has joined #openvpn
07:07 -!- hamush [~rootjklol@cpe-70-113-87-159.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
07:07 < haotian> !welcome
07:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:07 < v0x> !/30
07:07 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
07:07 < v0x> !windowsmobile
07:08 < v0x> anyone got a suggestion about that?
07:08 < haotian> !howto
07:08 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:09 -!- unspin [~unspin@199.7.158.40] has joined #openvpn
07:10 < haotian> I need a vpn/proxy server to conenct, is openvpn what I need ?
07:14 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 264 seconds]
07:20 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
07:20 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
07:20 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:21 -!- n1xman [~n1xman@59.163.254.66] has quit [Ping timeout: 252 seconds]
07:31 < Bushmills> haotian: we don't know what you need
07:32 -!- haotian [~null@unaffiliated/haotian] has left #openvpn ["Leaving"]
07:32 < Bushmills> you could try to describe your requirements, then we could tell you whether openvpn matches those
07:38 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
07:44 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
08:01 -!- haotian [~null@unaffiliated/haotian] has joined #openvpn
08:01 -!- haotian [~null@unaffiliated/haotian] has left #openvpn ["Leaving"]
08:06 -!- unspin [~unspin@199.7.158.40] has quit [Ping timeout: 258 seconds]
08:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
08:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:19 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
08:26 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
08:26 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
08:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:33 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has quit [Ping timeout: 276 seconds]
08:34 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has joined #openvpn
08:35 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
08:35 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
08:41 -!- dazo is now known as dazo_afk
08:41 -!- testing-1 is now known as wangerin
08:45 -!- tjay [~tjay@223.27.171.100] has joined #openvpn
08:48 -!- tjay`` [~tjay@112.198.78.93] has joined #openvpn
08:49 -!- tjay [~tjay@223.27.171.100] has quit [Ping timeout: 252 seconds]
08:53 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13153> || OpenSSL Issue - Win7 x64 [EDITED] <http://forums.openvpn.net/topic8337.html#p13152>
08:55 -!- kollapse [~kollaps@unaffiliated/kollapse] has joined #openvpn
08:59 <@vpnHelper> RSS Update - forum: OpenVPN 2.2 Branch and OpenSC with pkcs#11 <http://forums.openvpn.net/topic8341.html#p13154>
09:05 <@vpnHelper> RSS Update - forum: can ping to lan behind openvpn, but can not use rdp with ip <http://forums.openvpn.net/topic8343.html>
09:05 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
09:05 -!- tjay`` [~tjay@112.198.78.93] has quit [Read error: Connection reset by peer]
09:05 -!- tjay [~tjay@223.27.171.100] has joined #openvpn
09:10 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
09:11 -!- GodInPerson [45465b6e@gateway/web/freenode/ip.69.70.91.110] has joined #openvpn
09:11 < GodInPerson> Hey, I'm trying to install a OpenVPN 2.2.0
09:11 < GodInPerson> there is a bug in version 2.2.0 with build-ca
09:12 < GodInPerson> I found that link about the bug. I was wondering how to open the .patch file: https://community.openvpn.net/openvpn/ticket/125
09:12 <@vpnHelper> Title: #125 (Build CA is broken in Windows on version 2.2 release) – OpenVPN Community (at community.openvpn.net)
09:12 < GodInPerson> at the bottom, there is a patch, how do I apply it in Windows?
09:13 < GodInPerson> I would like to correct it and use 2.2 instead of going back to 1.4
09:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:19 < tjay> vpn ?
09:19 < tjay> hehe
09:21 -!- K1ng [KING@180.211.188.152] has joined #openvpn
09:24 < GodInPerson> no one can help me?
09:24 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has joined #openvpn
09:29 <@vpnHelper> RSS Update - forum: can ping to lan behind openvpn, but can not use rdp with ip <http://forums.openvpn.net/topic8343.html#p13157>
09:35 -!- GodInPerson [45465b6e@gateway/web/freenode/ip.69.70.91.110] has quit [Quit: Page closed]
09:43 < tjay> freevpn
09:43 < tjay> hehe
09:43 < EugeneKay> Help? In my #openvpn? It's less likely than you think
09:45 -!- K1ng [KING@180.211.188.152] has quit [Ping timeout: 258 seconds]
09:55 -!- haotian [~null@unaffiliated/haotian] has joined #openvpn
09:55 < haotian> can I be connected simultaneously to 2 different vpn servers with openvpn ?
09:57 < krzee> yes, with 2 different clients
09:59 <@vpnHelper> RSS Update - forum: can ping to lan behind openvpn, but can not use rdp with ip <http://forums.openvpn.net/topic8343.html#p13158>
09:59 -!- haotian_ [~null@unaffiliated/haotian] has joined #openvpn
10:00 < Doonz> krzee: figured out my problem yesterday. Its because i was trying to install openvpn on a vps that did not have the tun/tap modules enabled in the custom kernel
10:00 < krzee> yep, iirc i told you that was the problem
10:00 < krzee> (not the vps part, the tun in kernel part)
10:00 < Doonz> :)
10:01 -!- haotian [~null@unaffiliated/haotian] has quit [Ping timeout: 240 seconds]
10:03 < haotian_> krzee :: when openvpn connection is established, the applications ran through the old connection stop the data transfer. Anyway to let the old apps remain running ?
10:04 < krzee> sure, dont redirect gateway :-p
10:05 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Ping timeout: 260 seconds]
10:05 < haotian_> umm, how can I do that advice ? Sorry newb
10:06 < syn4pse-> edit server.conf
10:08 < haotian_> server.ovpn -> ";push "redirect-gateway def1 bypass-dhcp""
10:09 < haotian_> could be that ?
10:11 < krzee> well thats commented out
10:11 < krzee> but yes
10:11 < krzee> but i f your goal is to redirect internet over the vpn... you do need it
10:11 < krzee> s/i f/if/
10:11 -!- svenni [~svenreinh@f054083225.adsl.alicedsl.de] has joined #openvpn
10:12 < hyper_ch> hi krzee
10:13 < svenni> hi, i accidently deleted /etc/init.d/openvpn file on my ubuntu. dont got it back with reinstall. how do i get that back? 
10:13 < krzee> hey hyper
10:14 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:14 < krzee> svenni, i bet you can find it on google or something... its a script with your OS not with openvpn
10:14 < haotian_> my goal is to have many instances of a client, using(or acting like it's using) different IP's (could be entire different network / NIC whatever)
10:14 < krzee> haotian_, you can run as many instances of openvpn as you want (until you run out of resources)
10:15 < haotian_> yeah but I want my unique IP (without vpn) remain too, is that possible ? Like 1 Unique + 1/2 vpns 
10:16 < svenni> thx im searching.......
10:16 < krzee> why do you feel you lose your normal IP when joining a vpn?
10:16 < haotian_> the applications using my normal IP terminate the connection once VPN is ran.
10:17 < krzee> haotian_, how are these vpns setup in relation to this:
10:17 < krzee> !goal
10:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:17 < krzee> !splitroute
10:17 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet, or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
10:17 < krzee> maybe you want that... its hard to tell with your [lack of] details
10:18 < reiffert> http://packages.ubuntu.com/oneiric/amd64/openvpn/filelist
10:18 <@vpnHelper> Title: Ubuntu -- Filelist of package openvpn/oneiric/amd64 (at packages.ubuntu.com)
10:18 < reiffert> it says /etc/init.d/openvpn belongs to the ubuntu openvpn package
10:18 < krzee> right
10:18 < krzee> moinmoin reif!
10:18 < reiffert> moin :)
10:19 < hyper_ch> hi reiffert
10:19 < reiffert> svenni: so get the .deb file and extract it.
10:19 < reiffert> ar x file.deb
10:19 < reiffert> tar xzvf data.tar.gz
10:19 < reiffert> then copy etc/init.d/openvpn to /etc/init.d
10:20 -!- tjay [~tjay@223.27.171.100] has left #openvpn []
10:22 < svenni> @reiffert wich deb file do you mean?
10:22 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5]
10:23 < reiffert> svenni: the one that matches your ubuntu release.
10:24 < reiffert> http://packages.ubuntu.com/search?suite=default&section=all&arch=any&searchon=names&keywords=openvpn
10:24 <@vpnHelper> Title: Ubuntu -- Package Search Results -- openvpn (at packages.ubuntu.com)
10:24 < svenni> i see. found it
10:27 < haotian_> krzee :: I have not much clue about that case in "!splitroute" because I don't have knowledge in routing, but sounds like that could be what I need. About details, what should I provide ? I have wLAN NIC and TAP NIC, I want the established connections via wLAN Interface to remain(not broke), when TAP Interface connects. Uhm, could I explain ?
10:28 < krzee> but you also want to redirect your traffic over the vpn?
10:29 < haotian_> Yea but the new connections I make will use vpn
10:29 < haotian_> old will remains same.
10:30 < haotian_> Like I have 1 irc client running now, I will set vpn connection, this irc client wont disconnected, and I will open 1 more client
10:30 < haotian_> the 1st one will use my unique IP, the second will the VPN IP, if possible
10:30 < krzee> try the splitroute
10:31 -!- syn4pse- [~syn@p5DDC0839.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
10:31 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
10:37 -!- svenni [~svenreinh@f054083225.adsl.alicedsl.de] has quit [Ping timeout: 240 seconds]
10:37 < haotian_> I will try, that's my current routes : http://www.ideone.com/oUxhf
10:37 <@vpnHelper> Title: Ideone.com | Online C++ Compiler & Debugging Tool (at www.ideone.com)
10:38 -!- svenni [~svenreinh@77.79.9.32] has joined #openvpn
10:38 <@vpnHelper> RSS Update - forum: OpenSSL Issue - Win7 x64 [EDITED] <http://forums.openvpn.net/topic8337.html#p13159>
10:38 -!- svenni [~svenreinh@77.79.9.32] has quit [Client Quit]
10:41 < haotian_> how should I set the routing (Sorry, it's kinda networking question now)
10:41 < pwrcycle> !route
10:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:43 < reiffert> "i see. found it" most probably means "thank you for saving my day"
10:43 -!- syn4pse- [~syn@p5DDC0839.dip0.t-ipconnect.de] has joined #openvpn
10:43 < krzee> no no its
10:43 < krzee> !splitroute
10:43 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet, or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
10:43 -!- luneff [~yury@85.26.186.16] has joined #openvpn
10:45 -!- luneff [~yury@85.26.186.16] has quit [Max SendQ exceeded]
10:48 < haotian_> Well I dont know how to do the routing properly. Source : wLAN0 IP, Dest: TAP0's IP, source: TAP0's IP, dest: WAN IP ?
10:48 -!- luneff [~yury@85.26.186.16] has joined #openvpn
10:49 < haotian_> I have checked the thread and stuff starting with "ip rule add .." "ip route add.." as I have mentioned before, Im networking dumb.
10:58 -!- luneff [~yury@85.26.186.16] has quit [Ping timeout: 258 seconds]
10:59 < haotian_> There is 2nd option tho, how I can I prevent it redirect to gateway ?   ;push "redirect-gateway def1 bypass-dhcp"
11:00 < krzee> well, nothing redirects over the vpn in that case... isnt your goal for that to happen?
11:01 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 264 seconds]
11:03 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 240 seconds]
11:03 -!- sia_ [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
11:04 < haotian_> if nothing redirects over vpn, would 2 instances of a web application carry the same ip ? being executed in this order: 1st app connects, vpn set, 2nd app connects.
11:04 < haotian_> my goal is simply, have the apps act like they are different machines
11:07 <@vpnHelper> RSS Update - forum: can ping to lan behind openvpn, but can not use rdp with ip <http://forums.openvpn.net/topic8343.html#p13160>
11:10 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
11:16 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
11:19 -!- p3rror [~mezgani@2001:470:9b36:1::2] has joined #openvpn
11:21 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has quit [Ping timeout: 260 seconds]
11:22 -!- EugeneK [~eugenekay@chaoschaoschaos.com] has joined #openvpn
11:23 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
11:23 -!- pif [~ldm@90.84.144.117] has quit [Ping timeout: 260 seconds]
11:23 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:25 -!- EugeneK is now known as EugeneKay
11:38 -!- K1ng [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
11:42 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
11:47 -!- haotian_ [~null@unaffiliated/haotian] has quit [Quit: Leaving]
11:47 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
11:54 -!- Kalavera [~Kalavera@190.43.34.214] has joined #openvpn
11:55 < Kalavera> greetings guys is there a good howto about setting up openvpn over Gentoo in a Road Warrior configuration ¡? 
11:58 < kisom> Kalavera: lots of them
11:58 < kisom> check openvpn.net
11:59 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
11:59 -!- pif [~ldm@90.84.146.179] has joined #openvpn
12:00 < Kalavera> kisom: is there a trouble between dummy0 and ip aliases, have it loaded and my alises wont work
12:00 <@vpnHelper> RSS Update - forum: Trouble setting up Site-to-Site VPN <http://forums.openvpn.net/topic8344.html>
12:01 -!- p3rror [~mezgani@2001:470:9b36:1::2] has quit [Read error: Connection reset by peer]
12:01 < kisom> Kalavera: are you using google translate?
12:01 < Kalavera> no 
12:02 < Kalavera> it is my bad english 
12:02 < Kalavera> flowing out my mouth 
12:02 < kisom> ok well, i dont think i can help you. there are lots of guides online.
12:02 < Kalavera> ok, thnk u 
12:03 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has quit [Read error: Operation timed out]
12:05 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has joined #openvpn
12:05 <@vpnHelper> RSS Update - forum: Server authentication "hangs" <http://forums.openvpn.net/topic8342.html#p13162>
12:09 -!- SOG [~SOG@222.125.196.155] has quit [Quit: I will be back!]
12:09 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
12:11 < ecrist> !howto
12:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:12 < ecrist> Kalavera: see that link, above
12:28 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
12:33 -!- luneff [~yury@84.51.197.107] has joined #openvpn
12:35 -!- syn4pse- [~syn@p5DDC0839.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
12:36 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
12:47 -!- syn4pse- [~syn@rs17058.rapidspeeds.com] has joined #openvpn
12:48 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has quit [Remote host closed the connection]
12:51 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
12:52 -!- kyrix [~ashley@2a01:e35:2e43:cb90:222:fbff:fe72:cf4] has quit [Ping timeout: 255 seconds]
12:52 <@vpnHelper> RSS Update - forum: Cannot Tunnel Local Connection <http://forums.openvpn.net/topic8338.html#p13163>
13:02 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has joined #openvpn
13:04 <@vpnHelper> RSS Update - forum: Cannot Tunnel Local Connection <http://forums.openvpn.net/topic8338.html#p13164>
13:07 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has quit [Remote host closed the connection]
13:09 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has joined #openvpn
13:09 <@vpnHelper> RSS Update - forum: Server authentication "hangs" <http://forums.openvpn.net/topic8342.html#p13165>
13:10 -!- EugeneKay is now known as EugeneKaway
13:13 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
13:13 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 246 seconds]
13:15 -!- Guest57215 [~jason@li14-82.members.linode.com] has quit [Changing host]
13:15 -!- Guest57215 [~jason@unaffiliated/crazygir] has joined #openvpn
13:15 <@vpnHelper> RSS Update - forum: Trouble setting up Site-to-Site VPN <http://forums.openvpn.net/topic8344.html#p13166>
13:15 -!- Guest57215 is now known as CrazyGir
13:22 -!- satonio [~satonio@78.47.161.197] has joined #openvpn
13:22 < satonio> hi
13:22 < satonio> where can i get help with easy-rsa ?
13:28 <@vpnHelper> RSS Update - forum: Cannot Tunnel Local Connection <http://forums.openvpn.net/topic8338.html#p13168>
13:30 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
13:32 -!- EugeneKaway [~eugenekay@chaoschaoschaos.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
13:33 < syn4pse-> satonio what you want to know ?
13:33 < syn4pse-> satonio i followed this guide: http://www.ventanazul.com/webzine/articles/openvpn-ubuntu-and-hulu
13:33 <@vpnHelper> Title: Install OpenVPN on Ubuntu, Hulu Outside the US and Network Security | Ventanazul (at www.ventanazul.com)
13:33 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
13:33 < syn4pse-> worked like a charm vor me
13:33 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
13:34 < syn4pse-> scroll down to: Create Keys and Certificates
13:37 -!- EugeneKaway [~eugenekay@chaoschaoschaos.com] has joined #openvpn
13:37 -!- EugeneKaway is now known as EugeneKay
13:38 < satonio> syn4pse-, i'm trying to use a easy-rsa generated cert with apache but after installing the CA in the browser it says that was issued by a invalid CA certificate if it's in a subdomain but it works on the domain
13:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:44 < krzee> lol
13:44 < krzee> thanx, i needed a good laugh
13:45 < satonio> i asked where to ask about easy-rsa i came here because i know you use it
13:48 -!- K1ng [~KING@180.211.188.63] has joined #openvpn
13:49 < satonio> i think the problem is the CA cert
13:49 < satonio> because with the main domain it works well
13:56 < krzee> its not the ca :-p
13:57 < satonio> how can you be so sure?
13:58 < satonio> the error code i get is sec_error_inadequate_key_usage
13:58 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
13:59 < satonio> the common name of the CA is satonio CA
13:59 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
14:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:06 < satonio> hmmm i have no idea why it is refusing it
14:12 -!- randomuser_ [~webchat@webchat.openvpn.net] has joined #openvpn
14:12 -!- randomuser_ [~webchat@webchat.openvpn.net] has quit [Client Quit]
14:13 -!- randomuser_ [~webchat@webchat.openvpn.net] has joined #openvpn
14:13 -!- randomuser_ [~webchat@webchat.openvpn.net] has quit [Client Quit]
14:13 <@vpnHelper> RSS Update - forum: Trouble setting up Site-to-Site VPN <http://forums.openvpn.net/topic8344.html#p13169>
14:17 -!- jeev [~jeev@unaffiliated/jeev] has quit [Quit: ZNC - http://znc.sourceforge.net]
14:20 -!- syn4pse- [~syn@rs17058.rapidspeeds.com] has quit [Read error: Connection reset by peer]
14:24 -!- luneff [~yury@84.51.197.107] has quit [Quit: Leaving]
14:25 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
14:32 -!- syn4pse [~syn@p5DDC0839.dip0.t-ipconnect.de] has joined #openvpn
14:33 -!- Kalavera [~Kalavera@190.43.34.214] has quit [Quit: Lost terminal]
14:40 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:46 -!- gyyrog [~gyyrog@24.231.158.154] has joined #openvpn
15:02 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
15:08 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:17 -!- testing_ecrist [~webchat@webchat.openvpn.net] has joined #openvpn
15:21 -!- testing_ecrist [~webchat@webchat.openvpn.net] has left #openvpn []
15:37 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
15:43 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Read error: Operation timed out]
15:56 -!- gyyrog [~gyyrog@24.231.158.154] has quit [Remote host closed the connection]
15:57 -!- syn4pse [~syn@p5DDC0839.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
16:05 < raidz> !howto
16:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:08 -!- pif [~ldm@90.84.146.179] has quit [Ping timeout: 276 seconds]
16:10 <@vpnHelper> RSS Update - forum: Decrypting UDP openvpn streams <http://forums.openvpn.net/topic8345.html>
16:12 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
16:46 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
16:46 <@vpnHelper> RSS Update - forum: clean-all.bat errors <http://forums.openvpn.net/topic7568.html#p13171>
16:53 -!- luneff [~yury@84.51.197.107] has joined #openvpn
16:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
17:22 -!- EugeneKay is now known as EugeneKaway
17:22 -!- EugeneKaway is now known as EugeneKay
17:26 -!- unspin [~unspin@199.7.158.40] has joined #openvpn
17:29 -!- patelx [~a@openvpn/corp/admin/patel] has joined #openvpn
17:29 -!- mode/#openvpn [+o patelx] by ChanServ
17:30 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
17:31 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 255 seconds]
17:35 <@vpnHelper> RSS Update - forum: OpenVPN 2.2 Branch and OpenSC with pkcs#11 <http://forums.openvpn.net/topic8341.html#p13172>
17:37 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
17:38 -!- 18WAAFIZG is now known as Martin
17:38 -!- Martin is now known as Guest62135
17:55 -!- chmig [~chmig@84-73-245-194.dclient.hispeed.ch] has joined #openvpn
17:56 -!- satonio [~satonio@78.47.161.197] has quit [Ping timeout: 240 seconds]
17:59 -!- unspin [~unspin@199.7.158.40] has quit [Ping timeout: 246 seconds]
18:01 -!- chmig [~chmig@84-73-245-194.dclient.hispeed.ch] has quit [Quit: chmig]
18:06 -!- kollapse [~kollaps@unaffiliated/kollapse] has quit [Ping timeout: 255 seconds]
18:11 -!- satonio [~satonio@239.Red-83-57-130.dynamicIP.rima-tde.net] has joined #openvpn
18:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:24 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:53 <@vpnHelper> RSS Update - forum: Test <http://forums.openvpn.net/topic8346.html>
18:59 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:00 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
19:00 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:02 -!- SOG [~SOG@222.125.196.155] has quit [Quit: I will be back!]
19:05 <@vpnHelper> RSS Update - forum: testing <http://forums.openvpn.net/topic8347.html>
19:11 -!- raidz1 [~Administr@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
19:12 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 255 seconds]
19:13 -!- raidz1 is now known as raidz
19:13 -!- raidz [~Administr@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Changing host]
19:13 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
19:14 -!- patel [~patel@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Ping timeout: 276 seconds]
19:14 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
19:26 -!- mode/#openvpn [+o raidz] by ChanServ
19:40 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:47 < amero> !cipher
19:47 < amero> ! cipher
19:47 < amero> uh
19:49 < amero> can we enable/disable cipher directive per client?
19:50 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
19:55 -!- raidz is now known as raidz_afk
19:55 -!- _evor_ [~EvOr@midgard.adyxax.org] has joined #openvpn
19:57 -!- EvOr [~EvOr@midgard.adyxax.org] has quit [Remote host closed the connection]
19:58 -!- n1xman [~n1xman@124.43.127.140] has joined #openvpn
19:58 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
19:59 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
20:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:08 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
20:14 -!- master_of_master [~master_of@p57B5562D.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:15 -!- master_of_master [~master_of@p57B55B5C.dip.t-dialin.net] has joined #openvpn
20:18 -!- satonio [~satonio@239.Red-83-57-130.dynamicIP.rima-tde.net] has quit [Quit: Saliendo]
20:27 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has quit [Ping timeout: 250 seconds]
20:28 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
20:29 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
20:43 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
20:45 < pwrcycle>  !mynock http://www.bestvpnservice.com/providers/146/cloak-vpn.html 4
20:45 <@vpnHelper> Title: CloakVPN | CloakVPN Reviews | CloakVPN VPN Offersprovider-detail (at www.bestvpnservice.com)
20:45 < pwrcycle> ww
20:45 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has quit [Ping timeout: 250 seconds]
20:46 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
20:53 -!- snak3b8 [~n1xman@124.43.115.79] has joined #openvpn
20:54 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
20:56 -!- n1xman [~n1xman@124.43.127.140] has quit [Ping timeout: 276 seconds]
21:10 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:10 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:10 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:11 -!- n1xman [~n1xman@124.43.116.164] has joined #openvpn
21:13 -!- snak3b8 [~n1xman@124.43.115.79] has quit [Ping timeout: 258 seconds]
21:20 -!- snak3b8 [~n1xman@124.43.117.94] has joined #openvpn
21:22 -!- n1xman [~n1xman@124.43.116.164] has quit [Ping timeout: 246 seconds]
21:26 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:32 -!- n1xman [~n1xman@124.43.118.245] has joined #openvpn
21:33 -!- snak3b8 [~n1xman@124.43.117.94] has quit [Ping timeout: 264 seconds]
21:38 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
21:41 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
21:41 -!- n1xman [~n1xman@124.43.118.245] has quit [Read error: Connection reset by peer]
21:41 -!- n1xman [~n1xman@124.43.118.245] has joined #openvpn
21:43 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
21:48 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
21:50 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
22:05 <@vpnHelper> RSS Update - forum: Server authentication "hangs" <http://forums.openvpn.net/topic8342.html#p13175>
22:06 -!- n1xman [~n1xman@124.43.118.245] has quit [Ping timeout: 244 seconds]
22:07 -!- EugeneKay is now known as EugeneKaway
22:16 -!- [intra]lanman [~lanman@c-67-167-138-186.hsd1.mi.comcast.net] has joined #openvpn
22:16 -!- [intra]lanman [~lanman@c-67-167-138-186.hsd1.mi.comcast.net] has quit [Changing host]
22:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:17 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13176>
22:19 -!- ovpn2ac [ca0c5edf@gateway/web/freenode/ip.202.12.94.223] has joined #openvpn
22:20 < ovpn2ac> hello, im stuck for days with my config, im kind of desperate for help - relevant info @ https://forums.openvpn.net/topic8330.html#p13176
22:20 <@vpnHelper> Title: OpenVPN Support Forum From School To Home Server (VMs) : Configuration (at forums.openvpn.net)
22:22 < ovpn2ac> my setup is SCHOOL PC----------INTERNET-------------HOME ROUTER-----HOME PC (Ubuntu Virtual Machine)
22:24 < ovpn2ac> so basically...connection is established, IP issued...but cant ping both ways...
22:25 < amero> sorry can't help. i've never done a tap openvpn
22:26 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
22:26 < ovpn2ac> janjust said a tun setup would work
22:26 < ovpn2ac> how would the routing be setup
22:29 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:35 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
22:37 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
22:43 -!- n1xman [~n1xman@59.163.254.66] has joined #openvpn
22:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
22:44 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 258 seconds]
22:47 < ovpn2ac> test
22:47 < ovpn2ac> oops
22:53 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
22:58 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
23:23 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
23:28 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
23:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
23:46 -!- pif [~ldm@90.84.144.173] has joined #openvpn
23:49 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
23:54 -!- yell0 [~yello@unaffiliated/contempt] has quit [Ping timeout: 250 seconds]
--- Day changed Fri Jun 24 2011
00:17 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
00:32 -!- ecrist_test [~webchat@webchat.openvpn.net] has joined #openvpn
00:33 < ecrist> raidz_afk: your hackery does not stop me!
00:33 -!- my_hero1 [~yongcheng@119.113.198.35] has joined #openvpn
00:33 < ecrist_test> muahahaha
00:34 -!- ecrist_test [~webchat@webchat.openvpn.net] has quit [Client Quit]
00:35 -!- my_hero1 [~yongcheng@119.113.198.35] has left #openvpn []
00:37 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
00:40 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html>
00:43 -!- dazo_afk is now known as dazo
00:50 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
00:53 < ovpn2ac>  hello, im stuck for days with my config, im kind of desperate for help - relevant info @ https://forums.openvpn.net/topic8330.html#p13176
00:53 <@vpnHelper> Title: OpenVPN Support Forum From School To Home Server (VMs) : Configuration (at forums.openvpn.net)
01:11 <@dazo> ovpn2ac: then you need to be patient ... people answer when they know or have an idea ... asking over and over and over again is just annoying all others
01:11 <@dazo> ovpn2ac: you also got answer from JJK yesterday, which is the very best support you could ever get ... he's a openvpn guru
01:20 < ovpn2ac> okay
01:24 <@dazo> ovpn2ac: I'm not sure if you know, but JJK wrote the OpenVPN 2 Cookbook
01:24 <@dazo> !book
01:24 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
01:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
01:31 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
01:40 < amero> ovpn2ac: why do you need bridging?
01:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:46 <@vpnHelper> RSS Update - forum: Trouble setting up Site-to-Site VPN <http://forums.openvpn.net/topic8344.html#p13179> || Cannot Tunnel Local Connection <http://forums.openvpn.net/topic8338.html#p13178>
01:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:52 < ovpn2ac> my openvpn server(ubuntu) is running on Vmware workstation which uses a bridged connection 
01:53 < ovpn2ac> i dont think using NAT would work?
01:58 < ovpn2ac> anyone knows where the client.down and client.up files are in ubuntu?...cant seem to find them
02:14 -!- dazo is now known as dazo_afk
02:30 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
02:31 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
02:34 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13180>
02:40 <@vpnHelper> RSS Update - forum: Decrypting UDP openvpn streams <http://forums.openvpn.net/topic8345.html#p13183> || can ping to lan behind openvpn, but can not use rdp with ip <http://forums.openvpn.net/topic8343.html#p13182> || OpenSSL Issue - Win7 x64 [EDITED] <http://forums.openvpn.net/topic8337.html#p13181>
02:46 <@vpnHelper> RSS Update - forum: Server authentication "hangs" <http://forums.openvpn.net/topic8342.html#p13185> || OpenVPN 2.2 Branch and OpenSC with pkcs#11 <http://forums.openvpn.net/topic8341.html#p13184>
02:51 -!- K1ng [~KING@180.211.188.63] has quit [Ping timeout: 276 seconds]
02:52 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13187> || From School To Home Server (VMs) <http://forums.openvpn.net/topic8330.html#p13186>
03:04 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13188>
03:10 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13189>
03:16 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330-15.html#p13190>
03:22 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13192>
03:25 -!- pif [~ldm@90.84.144.173] has quit [Quit: leaving]
03:34 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13193>
03:36 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
03:39 < Bushmills> how do you mean, "where they are" - did you create some?
03:39 -!- ovpn2ac [ca0c5edf@gateway/web/freenode/ip.202.12.94.223] has quit [Ping timeout: 252 seconds]
03:47 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13194>
03:53 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13196>
03:56 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has left #openvpn ["WeeChat 0.3.6-dev"]
03:59 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13197>
04:02 -!- _evor_ is now known as EvOr
04:12 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Remote host closed the connection]
04:13 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
04:27 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
04:40 -!- dazo_afk is now known as dazo
04:41 <@vpnHelper> RSS Update - forum: Vars.bat Help <http://forums.openvpn.net/topic8348.html#p13198>
04:45 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:48 -!- kollapse [~kollaps@79.116.199.215] has joined #openvpn
04:48 -!- kollapse [~kollaps@79.116.199.215] has quit [Changing host]
04:48 -!- kollapse [~kollaps@unaffiliated/kollapse] has joined #openvpn
04:53 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
04:55 -!- n1xman [~n1xman@59.163.254.66] has quit [Ping timeout: 264 seconds]
04:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:59 -!- n1xman [~n1xman@59.163.254.66] has joined #openvpn
05:07 -!- yell0 [~yello@unaffiliated/contempt] has quit [Quit: leaving]
05:07 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
05:09 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:09 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:27 -!- EugeneKaway is now known as EugeneKay
05:45 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Read error: Operation timed out]
05:52 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
06:17 -!- EugeneKay is now known as EugeneKaway
06:18 -!- EugeneKaway is now known as EugeneKay
06:37 -!- luneff [~yury@84.51.197.107] has quit [Quit: This computer has gone to sleep]
06:38 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
06:44 -!- n1xman [~n1xman@59.163.254.66] has quit [Ping timeout: 255 seconds]
06:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
06:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:55 -!- ichilton [~ichilton@zeniv.linux.org.uk] has joined #openvpn
06:55 < ichilton> I always use openvpn for all vpn stuff but I have need to be able to connect from an iPhone
06:56 < ichilton> It seems that PPTP is really insecure and Ipsec is the way forward
06:56 < ichilton> PPTP is easier to setup though - is it insecure only for intercepting and decrypting the contents or insecure because people could connect to it?
06:57 < ichilton> i'm not doing anything sensitive so the first thing isn't really a problem - but obviously the latter is - I wouldn't want it to be a weak entry point to the network....
06:57 < ichilton> Any thoughts?
06:57 < EugeneKay> I think I want pancakes for breakfast.
07:01 < Bushmills> !pptp
07:01 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read
07:01 <@vpnHelper> about why to not use pptp
07:02 < ichilton> Bushmills: thanks - I just read that a few mins ago :)
07:02 < ichilton> but it's not really clear on what I asked above
07:03 < Bushmills> it has the name "microsoft" in it, therefore it's a no go for security-sensitive applications :)
07:03 < ichilton> very true!
07:06 < ichilton> Wish the iPhone supported OpenVPN :(
07:07 < EugeneKay> !iphone
07:07 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN
07:07 <@vpnHelper> for iPhone and iPad.
07:07 < ichilton> EugeneKay: needs jailbreak though
07:08 < EugeneKay> So..... do it?
07:08 < EugeneKay> Or buy an Android phone with CM support.... OpenVPN works nicely on it.
07:08 < ichilton> CM?
07:09 < hyper_ch> CM?
07:09 < EugeneKay> CyanogenMod.
07:09 < EugeneKay> http://www.cyanogenmod.com/devices
07:09 <@vpnHelper> Title: Devices | CyanogenMod (at www.cyanogenmod.com)
07:09 < ichilton> ah, ok
07:12 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
07:13 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
07:14 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
07:28 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
07:44 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 258 seconds]
07:44 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Ex-Chat]
07:54 -!- jrhe [~jrhe@s15433397.onlinehome-server.info] has joined #openvpn
07:55 < jrhe> I am using an openvpn set up by my employer which has a masq set on it so all my traffic goes through there server. There server is in Germany. This poses huge problems as I cannot watch Wimbledon. How can I selectively make iplayer not use the vpn?
07:57 < amero> !routebyapp
07:57 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
07:57 < amero> !sockd
07:57 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
07:58 < jrhe> cool thank you
08:03 -!- jrhe [~jrhe@s15433397.onlinehome-server.info] has quit [Ping timeout: 255 seconds]
08:07 -!- greg_72 [~somebody@catv-89-133-19-22.catv.broadband.hu] has joined #openvpn
08:07 < greg_72> !welcome
08:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:07 < greg_72> !goal
08:07 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:08 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
08:09 < greg_72> hi, my goal is to reach my amazon virtual private cloud. I installed openvpn to my mac box but it does not do anything. What log file should I check to see what the problem is>
08:09 < greg_72> ?
08:20 -!- luneff [~yury@109.165.31.72] has joined #openvpn
08:24 < Dougy> cawks
08:24 < Dougy> greg_72: what does that even mean
08:24 < Dougy> it doesn't do anything
08:27 -!- ichilton [~ichilton@zeniv.linux.org.uk] has quit [Ping timeout: 258 seconds]
08:30 <@vpnHelper> RSS Update - forum: [solved] connection works only after service -stop -start <http://forums.openvpn.net/topic8278.html#p13200> || Can't create a new TAP adapter on Windows 2k8 R2 64bit <http://forums.openvpn.net/topic8236.html#p13199>
08:40 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 258 seconds]
08:42 -!- ichilton [~ichilton@zeniv.linux.org.uk] has joined #openvpn
08:43 -!- K1ng [~KING@180.211.188.217] has joined #openvpn
08:46 -!- ichilton [~ichilton@zeniv.linux.org.uk] has quit [Ping timeout: 246 seconds]
08:55 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
08:57 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
08:57 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
08:57 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
09:07 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
09:10 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:10 -!- K1ng [~KING@180.211.188.217] has quit [Ping timeout: 240 seconds]
09:10 -!- K1ng` [~KING@58.97.132.210] has quit [Client Quit]
09:12 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
09:23 -!- luneff [~yury@109.165.31.72] has quit [Ping timeout: 252 seconds]
09:25 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
09:26 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
09:28 -!- luneff [~yury@109.165.31.72] has joined #openvpn
09:30 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
09:30 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
09:34 -!- K1ng` [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
09:54 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has quit [Read error: Operation timed out]
10:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Operation timed out]
10:06 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
10:10 -!- dazo is now known as dazo_afk
10:15 -!- raidz_afk is now known as raidz
10:16 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
10:16 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
10:16 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:27 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
10:29 -!- n1xman [~n1xman@124.43.125.119] has joined #openvpn
10:30 -!- dazo_afk is now known as dazo
10:31 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Quit: Leaving.]
10:33 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:33 -!- mode/#openvpn [+o raidz] by ChanServ
10:35 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
10:35 -!- K1ng [~KING@180.211.188.113] has joined #openvpn
10:37 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
10:37 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
10:37 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:37 < Doonz> Hi Everyone. Does open vpn offer something similar to the Juniper web launcher for the vpn client?
10:38 <@raidz> Doonz: What specifically?
10:39 < Doonz> basically the new company im contracting through will not open any more ports up in their firewall.
10:39 < Doonz> My old comapny we had a juniper vpn set up wehere i would goto the website and it would ask me for my fob id then it would download that client and voila the vpn tunnel was established
10:39 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
10:40 <@raidz> which ports does their Juniper VPN require to be opened?"
10:40 < Doonz> it goes through port 80
10:40 < Doonz> my open vpn is set up to use port 80 as well but the gateway wont allow anything but http traffic to go through
10:41 < Doonz> like i cant fire up ssh and connect through port 80 
10:41 < Doonz> but i can use a webbased ssh client and it will connect through port 80 to the ssh server
10:41 <@raidz> Which Juniper VPN are they using? Do you have a model #?
10:41 < krzie> using an http proxy would likely work
10:42 <@raidz> ^^
10:42 < krzie> possibly, port tcp 443
10:42 < Doonz> juniper 7.1.0.17675
10:42 < krzie> if you need it to actually look like web traffic upon manual inspection, the server could also use --port-share
10:43 < Doonz> but i cant connect to the server at all
10:45 -!- luneff [~yury@109.165.31.72] has quit [Quit: This computer has gone to sleep]
10:45 < krzie> [11:43]  <krzie> using an http proxy would likely work
10:45 < krzie> [11:43]  <krzie> possibly, port tcp 443
10:46 < Doonz> sorry missed that part
10:46 < Doonz> gimme a sec brb
10:48  * Doonz hugs and loves krzie
10:48 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
10:50 -!- K1ng [~KING@180.211.188.113] has quit [Ping timeout: 252 seconds]
10:52 -!- n1xman [~n1xman@124.43.125.119] has quit [Ping timeout: 276 seconds]
10:53 < Doonz> krzie: thank you again
10:59 < gladiatr> krzie, you're on the evo4g, right?
11:00 -!- sia_ [115kluu@owned.ninjasinpyjamas.biz] has quit [Remote host closed the connection]
11:01 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
11:02 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:03 -!- n1xman [~n1xman@124.43.125.119] has joined #openvpn
11:04 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:06 -!- K1ng` [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
11:06 <@vpnHelper> RSS Update - forum: Max simultaneous client connections <http://forums.openvpn.net/topic7188.html#p12964>
11:10 < krzie> gladiatr, no but i have done everything i wanted to on an evo
11:10 < krzie> Doonz, yw
11:11 <@raidz> I <3 my Evo :-D
11:12 -!- sia^pwnnt [115kluu@server1.bouncer4you.de] has joined #openvpn
11:12 < gladiatr> krzie, cool.  I picked up a used nook to familiarize myself w/ android before signing a contract.  Prob. taking the android phone plunge in the next couple months
11:13 < gladiatr> 2.3 is much less annoying than 2.1
11:13 <@raidz> ^^
11:13 <@raidz> Much faster
11:15 <@raidz> !welcome
11:15 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:15 < amero> !redirect
11:15 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
11:15 < amero> !duplicate-cn
11:16 < amero> actually is it possible to allow duplicate certs connected from the same ip?
11:17 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
11:17 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
11:21 -!- cpm [~Chip@border0.avitecture.net] has joined #openvpn
11:22 -!- cpm [~Chip@border0.avitecture.net] has quit [Changing host]
11:22 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
11:33 <@dazo> amero: yes it is ... but make sure you don't use --client-config-dir stuff which gives static VPN IP addresses, as then both clients would end up with the same VPN IP address ... and things would brake
11:35 < amero> dazo: how to configure that?
11:35 <@dazo> amero: add --duplicate-cn to your server config
11:36 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
11:36 < krzie> !dupe
11:36 <@vpnHelper> "dupe" is see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended)
11:36 < krzie> you said "connected from the same ip"
11:36 < krzie> that is pointless
11:36 < amero> yes
11:37 < krzie> just allow them over the single connection
11:37 < krzie> lol
11:37 < krzie> !route
11:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
11:37 < krzie> !clientlan
11:37 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
11:37 <@vpnHelper> better explanation
11:37 < amero> allow clients to connect from multiple devices from the same ip
11:38 < krzie> they dont need to
11:39 < krzie> you can route the entire lan over a single connection
11:39 <@raidz> !goal
11:39 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:39 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:50 <@dazo> krzie: unless you might have more roadwarriors behind the same NAT .... as in a net café and such stuff ....
11:50 < amero> krzie: i think i could just hook up my router with openvpn server but im not sure if that's gonna work
11:51 < krzie> dazo, tru, but then those devices should be on diff certs
11:51 < krzie> amero, that is the same thing, except then you wont need to add an extra route on your router
11:52 < amero> http://www.dd-wrt.com/wiki/index.php/OpenVPN#Server_Mode_with_Certificates_.28Recommended.29
11:52 <@vpnHelper> Title: OpenVPN - DD-WRT Wiki (at www.dd-wrt.com)
11:52 <@dazo> krzie: true ... even though I can come up with other arguments against that, but I'll skip that for a rainy day :-P
11:52 < krzie> regardless, you only need 1 ovpn client per lan unless like dazo said, its not *your* lan
11:52 <@dazo> that's true ... ^^ 
11:53 < amero> hehe alright
11:54 < amero> another thing, can cipher directive be made per client setting?
11:54 <@dazo> nope
11:55 < amero> hmm
11:57 < amero> looks like im gonna need 2 openvpn servers then, unless i could disable/enable cipher from client
11:59 <@dazo> that's a two-server requirement
12:03 -!- K1ng [KING@180.211.188.60] has joined #openvpn
12:07 -!- corretico_ [~luis@186.176.7.194] has quit [Ping timeout: 250 seconds]
12:10 <@vpnHelper> RSS Update - forum: OpenSSL Issue - Win7 x64 [EDITED] <http://forums.openvpn.net/topic8337.html#p13201>
12:13 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
12:14 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
12:22 <@vpnHelper> RSS Update - forum: OpenSSL Issue - Win7 x64 [EDITED] <http://forums.openvpn.net/topic8337.html#p13202>
12:28 -!- K1ng [KING@180.211.188.60] has quit [Ping timeout: 276 seconds]
12:30 < norc> Mhm, I'm wondering, does openvpn use a custom TCP implementation for TCP streams when you use TCP proto? (To prevent effects such as TCP meltdown)
12:31 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
12:39 < krzie> !tcp
12:39 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer), or (#3) if you must use tcp, you likely want --tcp-nodelay
12:51 < norc> krzie: I know the papers, but that's assuming staple retransmission algorithms in the implementations
12:52 < norc> krzie: If the inner TCP connection would act like UDP regarding re-transmission (which is a safe thing if you consider the outer layer will ensure in-order delivery) that would remove that issue entirely
12:52 < norc> wouldn't it?
12:53 -!- luneff [~yury@84.51.197.107] has joined #openvpn
12:54 <@dazo> norc: to manage that ("the inner TCP connection would act like UDP"), you need to re-implement the TCP/IP protocol
12:55 <@dazo> the server/clients passing data through the VPN don't know anything about that the data passes through a TCP based VPN tunnel
12:55 <@dazo> and that re-implementation, is basically called UDP
12:56 < norc> dazo: Ok perhaps I'm not deeply familiar enough with how VPN operates exactly. Doesn't OpenVPN provide its own TCP/IP implementation?
12:57 <@dazo> norc: nope ... (SSL based) VPN is basically a virtual network interface ... what comes into that interface gets encrypted and sent via a SSL connection to the other side
12:57 <@dazo> that virtual network interface behaves almost like a normal network interface ... it's just not a physical device
12:58 < norc> dazo: so for both the VPN and the application the native sockets (posix/win32) on the operating system are used?
12:59 < norc> (In my case there is not even encryption to reduce any overhead)
12:59 <@dazo> norc: yes, they don't know that the traffic goes through VPN at all ... they connect to an IP address, and the OS kernel takes care of providing a socket for this connection
13:01 < norc> dazo: so basically the client creates a TCP (or UDP) connection, then creates a virtual devices that transparently pipes anything through that TCP socket, and the rest is routed through that virtual device (depending on what my routes are), correct?
13:02 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:02  * norc is beginning to understand
13:03 <@dazo> the virtual device is (usually) already created by the OpenVPN software ... so the application using the VPN, just connects to the IP address, and the kernel takes care of the rest
13:03 -!- krzie [~k@190.166.168.175] has joined #openvpn
13:03 -!- krzie [~k@190.166.168.175] has quit [Changing host]
13:03 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
13:04 < norc> So a TCP segment would travel the following way (forth and back again). Application > Socket API > Virtual Device > Socket API > Physical Device > Network
13:04 <@dazo> norc: basically, yes
13:05 < norc> dazo: thanks. So basically in order to realize what I was thinking of, I would have to hook one of the two API calls (or rather patch OpenVPN to use an alternative implementation)
13:05 < norc> Think this could be a fun way to get more familiar with networking :)
13:06 <@dazo> norc: no, you need to make OpenVPN use UDP instead ... or else you need to rewrite the TCP/IP stack in your OS
13:06 < norc> dazo: No can do, HTTPS proxy in the way.
13:06 <@dazo> then there's no way around this
13:06 < norc> We even have dnsmasq in place, so there's no spot open ;)
13:07  * dazo need to run
13:07 < norc> dazo: alright, thanks for your help in improving my understanding of OpenVPN :)
13:07 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
13:07 -!- dazo is now known as dazo_afk
13:09 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
13:10 -!- krzie [~k@openvpn/community/support/krzee] has quit [Quit: Leaving]
13:11 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
13:14 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
13:22 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
13:24 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
13:24 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:26 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
13:28 -!- luneff [~yury@84.51.197.107] has quit [Quit: This computer has gone to sleep]
13:39 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
14:08 -!- corretico_ [~luis@186.176.7.194] has quit [Read error: Connection reset by peer]
14:11 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
14:12 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
14:24 -!- n1xman [~n1xman@124.43.125.119] has quit [Ping timeout: 258 seconds]
14:28 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
14:31 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
14:56 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:57 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
15:03 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
15:03 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has left #openvpn []
15:08 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
15:09 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
15:10 < abel408> I'm migrating to a new openvpn server. I'm just going to scp my server certs. Will I need to recreate all my client certs or should they still be good?
15:11 -!- zamba [marius@flage.org] has joined #openvpn
15:11 < zamba> i'm having huge problems with one of my openvpn connections.. it goes down all the time.. and then it reconnects and stays up a couple of minutes more, before dying again..
15:11 < zamba> what can i do to debug this?
15:12 < norc> zamba: Do you have any network activity when the connection breaks down?
15:12 < zamba> the problem is that i'm unable to check this, because this is on a remote router
15:12 < zamba> with no connected clients
15:12 < zamba> and i can't reach this router directly
15:12 < zamba> i can only reach it over the vpn tunnel ;)
15:13 < norc> zamba: post the configuration files for both the client and the server on pastie.org (or any other simular site)
15:13 < zamba> something i can turn on in the configuration?
15:14 < zamba> could mssfix do that?
15:14 < zamba> one sec
15:14 < zamba> configuration coming up
15:14 < norc> zamba: (and also the parameters you invoke both your client/server with, should you add any additional arguments)
15:15 < zamba> http://pastie.org/2117742
15:15 < zamba> there it died again
15:15 < zamba> stayed up for 3-4 minutes
15:16 < norc> meh those routes, but anyway
15:16 < zamba> what's wrong with them?
15:16 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has quit [Ping timeout: 252 seconds]
15:16 < zamba> i use them to connect different sites together
15:17 < zamba> has been working brilliantly for me personally
15:17 < norc> yeah well.
15:17 < norc> anyway
15:17 < zamba> what's wrong with it..?
15:17 < zamba> the routes and networks?
15:18 < zamba> i'm wondering if mssfix could be an issue?
15:18 < norc> zamba: I'm by no means an openvpn expert, and I could be wrong about this, but I had the same issue, and adding ping to the client as well seemed to have worked.
15:18 < zamba> i have ping there already
15:18 < zamba> ping 60
15:18 < norc> zamba: you have no argument for mssfix.. is that intentional?
15:18 < zamba> oh, no, not at all
15:19 < norc> zamba: err, on the server then.
15:19 < zamba> maybe disable that line altogether and try rebooting the router
15:19 < zamba> but this is a problem on only one location
15:19 < norc> zamba: it shouldnt accept it withotu an argument, so thats a bit weird. in any case, I have ping on both my client and server ;)
15:19 < zamba> so i'm thinking the problem has to lay on the client side
15:20 < norc> (the client would timeout for me during inactivity without it for some weird reason)
15:20 < zamba> i have > 10 vpn clients
15:20 < zamba> hm, ok
15:20 < norc> zamba: It's just a wild idea, perhaps that wasn't the real fix and it was something else for me, I don't know. 
15:20 < norc> zamba: but trying definitely cant hurt, seeing as it doesnt fuck up my set up ;)
15:21 < zamba> i'm suspecting a nosy firewall on the client side
15:24 -!- cheshire_fox [~cheshire_@99-113-249-167.lightspeed.glptms.sbcglobal.net] has joined #openvpn
15:24 < cheshire_fox> !welcome
15:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:25 < cheshire_fox> !howto
15:25 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:25 < krzie> dont forget:
15:25 < krzie> !goal
15:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:26 -!- sviz [~sviz@c-98-248-120-35.hsd1.ca.comcast.net] has joined #openvpn
15:26 < sviz> !welcome
15:26 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:27 < sviz> !route
15:27 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:27 < sviz> !iporder
15:27 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
15:27 < sviz> meh
15:29 < cheshire_fox> Okay, here is my problem.  I'm setting up a OpenVPN server on Ubuntu 10.10.  I've been following this tut https://help.ubuntu.com/10.10/serverguide/C/openvpn.html   I'm currently at the 'Server Configuration' section.  Before I continue, let me say that my goal is to allow a friend who is stuck in the hospital to be able to have completely unfiltered, system wide web access.  
15:29 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
15:30 < sviz> really my question would be... if I push a route with a metric from the server for it not to tunnel how do I get it to clean out that route when it tears down the session?
15:30 < sviz> cheshire_fox, that should be pretty easy... i got it going in just a few min
15:30 < sviz> my problem is my IT dept has decided they need to log everything
15:30 < cheshire_fox> sviz let me finish before you comment :3
15:31 < sviz> o man
15:31 < sviz> that guide makes my eyes hurt
15:31 < sviz> http://www.annoying.dk/2007/10/14/quick-simple-tutorialhowto-on-openvpn-with-debian/
15:31 <@vpnHelper> Title: Quick simple tutorial/howto on OpenVPN with Debian | www.annoying.dk (at www.annoying.dk)
15:32 < sviz> i know its debian, but it should be close too
15:32 < sviz> seems easier
15:32 < sviz> only a few things you need to do diff
15:33 < sviz> enable ip routing in your kernel...
15:33 < sviz> iptables -t nat -A POSTROUTING -s your.vpn.sub.net/24 -o eth0 -j MASQUERADE
15:33 < cheshire_fox> My current problem is that I don't know what most of the variables that are listed for the server conf file do/are.  I know that local should be the machines ip address.  Thats fine, but when I get to server-bridge, I get lost because my machine's IP address is the same as the  gateway router due to port forwarding.  How do I correctly set up the server-bridge variable with that?  Also, networking is my weak point.  
15:33 < sviz> push "route 0.0.0.0 0.0.0.0"
15:33 < norc> cheshire_fox: there's a pretty sweet howto, give me a sec to find it
15:33 < sviz> push "redirect-gateway local def1"
15:34 < sviz> in your openvpn.conf
15:34 < norc> cheshire_fox: http://openmaniak.com/openvpn_tutorial.php demonstrates what you need to do to setup the VPN connection itself
15:34 < cheshire_fox> also, that howto you gave me sviz has made me even more lost xD
15:35 < sviz> that guide is really good IMO
15:35 < sviz> worked off the bat
15:35 < cheshire_fox> I'm not saying its not
15:35 < sviz> in like 5 minutes
15:35 < sviz> just had to make the routing changes I needed
15:35 < sviz> and enable ip routing in my kernel
15:35 < cheshire_fox> its just that I really don't understand the more detailed stuff.  Like the routing changes.
15:36 < cheshire_fox> I know the whole idea behind it
15:36 < cheshire_fox> I just don't get nitty gritty
15:36 < sviz> http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/
15:36 <@vpnHelper> Title: How to enable IP Forwarding in Linux | MDLog:/sysadmin (at www.ducea.com)
15:37 < sviz> well I think my tips should get you straight... id just switch tutorials and cleanup any certs/config files you made
15:37 < sviz> and then do the couple tweaks i listed
15:38 < sviz> my problem is I dont know my solution... Im pushing RFC1918 routes but by default openvpn sets a metric of 25 by default... where cisco vpn sets a metric of 100
15:38 < cheshire_fox> Which I don't even know how to or where to : /  I know it sounds like I'm trying to get someone to hold my hand while I figure this out, but I'm not.  I'm just lost
15:38 < sviz> so obviously I want the cisco routes to win, but then I also want openvpn routes to come next
15:39 < sviz> however ive got the metric at 300 now which seems to be ok
15:39 < sviz> but when i close my connection it doesnt remove the static routes
15:59 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Ping timeout: 252 seconds]
16:04 -!- K1ng` [~KING@180.211.188.198] has joined #openvpn
16:07 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 250 seconds]
16:08 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
16:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
16:10 -!- K1ng` [~KING@180.211.188.198] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
16:11 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
16:14 <@raidz> Love your quit message K1ng
16:14 < K1ng> :p
16:20 -!- K1ng [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
16:20 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
16:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
16:30 -!- arejay [arejay@i.write.shellcode.eu] has joined #openvpn
16:30 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:32 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
16:37 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:37 < arejay> if anyone can help, ive posted all relevant logs to pastebin http://pastebin.com/6v3wfecJ
16:39 -!- K1ng [~KING@58.97.132.210] has quit [Read error: Connection reset by peer]
16:40 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
16:44 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Ping timeout: 252 seconds]
16:45 < arejay> vpn connected cannot access any sites
16:45 < arejay> dns is being pushed
16:45 < arejay> not sure the issue
16:46 < norc> arejay: enabled ip forwarding and nat?
16:46 < sviz> ^^^
16:47 < sviz> i still want to know how to get openvpn to clean out its static route
16:47 < sviz> +s
16:47 < norc> (check proc whether ip warding is truly enabled, setting something in your sysctl.conf is no proof, and check iptables whether nat/masquerading is truly enabled for the proper subnet)
16:55 < arejay> yes
16:55 < arejay> its enabled
16:55 < arejay> im still trying to figure out where to put
16:55 < arejay> vpn_network="192.168.0.0/24"
16:55 < arejay> vpn_if="tap0"
16:55 < arejay> in pf.conf
16:56 < arejay> no matter where i put it pf kicks a error
16:57 < arejay> etc/pf.conf:78: Rules must be in order: options, normalization, queueing, translation, filtering
16:57 < arejay> :(
16:57 < norc> ergh
16:57 < norc> pf
16:58 < norc> there's some unusable software for you./
16:58 < arejay> :(
17:05 < sviz> meh
17:05 < sviz> ill come back later
17:05 < sviz> no one knows my solution
17:09 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:13 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
17:15 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 260 seconds]
17:17 -!- dym [~patrick@netsplit.me] has joined #openvpn
17:18 < dym> Hey, I have created a VPN Client Server connection and want to tunnel all web-data through this connection. What manual should I look at?
17:20 < EugeneKay> !redirect-def1
17:20 < EugeneKay> !redirect
17:20 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:21 < dym> !def1
17:21 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
17:21 < dym> !nat
17:21 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:22 -!- sviz [~sviz@c-98-248-120-35.hsd1.ca.comcast.net] has left #openvpn ["Leaving"]
17:22 < dym> !pushdnsw
17:22 < dym> !pushdns
17:22 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
17:22 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
17:35 < dym> Mhh, EugeneKay doesnt really work for me. ipv4forwarding is enabled, etc - but once i connect and push the vpn gw-dns, things are borked
17:35 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
17:35 < EugeneKay> urdoinitrong
17:36 < dym> guess so :D
17:36 < dym> care to gimme a hand?
17:40 < EugeneKay> Not really, no. Busy watching Battlestar Galactica.
17:44 < dym> Awesome. cheers.
17:45 < Bushmills> --bypass-dns, alternatively
17:46 < Bushmills> or run a recursive name server on your client, use it for resolving
17:47 < dym> as in push "redirect-gateway def1 --bypass-dns"
17:47 < dym> ?
17:48 < Bushmills> no. as in how the man page suggests to use --bypass-dns
17:51 < reiffert>    \\ mushbills
17:52 < dym> okay, after using bypass-dns i get a connection, but my web-traffic still doesnt redirect through the gateway. still shown with my isp's host.
17:52 < dym> although i pushed def1 
17:53 < dym> traceroute proves the same.
18:01 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
18:14 < Bushmills> then you haven't set up your server properly
18:15 < Bushmills> does traceroute stop at server or go through provider?
18:16 < dym> Bushmills: goes through provider.
18:16 < Bushmills> what host are you tracerouting?
18:26 < dym> in this case - google.de
18:26 < Bushmills> windows client?
18:27 < dym> OS X
18:27 < dym> 10.6.7 to be exact-
18:28 < Bushmills> check client routing table. make sure it is such that general traffic is routed through openvpn server
18:30 < dym> Will do so in a second. Currently coping with stressful collaborationsuite upgrade :|
18:31 < Bushmills> also, check logs.
18:31 < dym> nothing on logs.
18:31 < dym> just the normal auth, etc.
18:31 < Bushmills> that's bad - there must be something in logs
18:31 < dym> well, nothing out of the ordinary.
18:32 < Bushmills> do logs indicate that routes are pushed to client?
18:40 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
18:40 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
18:51 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
18:51 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
18:58 -!- raidz is now known as raidz_afk
19:01 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
19:04 < cheshire_fox> Friend connect to my openvpn server.  Everything is fine except for that he is getting dns error (can't look up).  He's on windows.  Whats a good way to resolve this?
19:06 < dym> Bushmills: Affirmative. http://pastebin.com/AEY85KCv
19:21 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
19:29 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
19:29 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
19:29 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
19:36 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
19:36 -!- kollapse [~kollaps@unaffiliated/kollapse] has quit [Ping timeout: 258 seconds]
19:50 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Read error: Connection reset by peer]
19:50 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
19:58 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:12 < cheshire_fox> Okay, got the dns error resolved.  Now we're having an issue with speed.  I know its not my Internet speed as I have 30mb down 20mb up.  But my friend is getting only half a mb up or down.  Is there a way to increase this.
20:13 -!- master_of_master [~master_of@p57B55B5C.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
20:15 -!- master_of_master [~master_of@p57B537C9.dip.t-dialin.net] has joined #openvpn
20:27 < norc> cheshire_fox: proto udp or tcp?
20:27 < cheshire_fox> tcp
20:27 < norc> cheshire_fox: And I'm guessing you measued this using a TCP based application?
20:27 < cheshire_fox> I don't know what he used
20:28 < norc> cheshire_fox: lets just assume yes, and Im assuming his internet capabilities are larger, TCP over TCP scales really really badly.
20:28 < norc> Especially at higher network usages, and more so over unreliable carriers.
20:28 < norc> cheshire_fox: use proto udp if you can.
20:29 < cheshire_fox> kay, will see if that helps
20:30 < norc> cheshire_fox: apart from that, make sure both the client and server have a high process priority, make sure no encryption is used
20:30 <@vpnHelper> RSS Update - forum: Can't change Network Name or Icon <http://forums.openvpn.net/topic8349.html>
20:30 < norc> and thats as much as you can do really 
20:30 < cheshire_fox> how would encryption effect the download?
20:35 < cheshire_fox> someone had mentioned something about 
20:35 < cheshire_fox> push "redirect-gateway local def1"
20:35 < cheshire_fox> and that it could effect my speed as well.
20:36 < cheshire_fox> not on here
20:36 < cheshire_fox> not entirely sure what that push is for either :o
20:39 < EugeneKay> push means that you want that option pushed to the client
20:39 < cheshire_fox> I know what push is for.  More of I don't know what the redirect-gateway local def1 is for
20:39 < EugeneKay> !redirect
20:39 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
20:40 < EugeneKay> !def1
20:40 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
20:40 < EugeneKay> Exactly what it says on the tin.
20:40 < cheshire_fox> whats the local part for?
20:42 < EugeneKay> That is a very good question to which I have no answer, as I am unfamiliar with it for having never used it
20:46 < norc> cheshire_fox: Encryption can very easily affect the bandwidth as suddenly it requires CPU time to decode each segment
20:48 < norc> cheshire_fox: how much exactly I cannot tell you, because I have it completely disabled to maintain the best latency and thus reduce the timing windows in TCP to reduce meltdown effects
20:54 -!- cheshire_fox [~cheshire_@99-113-249-167.lightspeed.glptms.sbcglobal.net] has quit [Ping timeout: 252 seconds]
21:12 -!- nobodies [~nobodies@190.211.252.141] has joined #openvpn
21:12 < nobodies> anyone doing wan media streaming with openvpn?
21:13 < nobodies> i am curious about performace
21:21 -!- nobodies [~nobodies@190.211.252.141] has quit [Quit: leaving]
21:39 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
21:52 < krzie> not *too* curious it seems
21:52 < krzie> 9 minute wait, lol
21:54 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
22:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
22:10 -!- n1xman [~n1xman@124.43.122.18] has joined #openvpn
22:10 -!- K1ng`` [~KING@180.211.188.198] has joined #openvpn
22:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:13 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 250 seconds]
22:18 -!- EugeneKay is now known as EugeneKaway
22:22 -!- EugeneKaway is now known as EugeneKay
22:29 -!- K1ng` [~KING@180.211.188.198] has joined #openvpn
22:32 -!- K1ng`` [~KING@180.211.188.198] has quit [Ping timeout: 240 seconds]
22:51 -!- n1xman [~n1xman@124.43.122.18] has quit [Ping timeout: 276 seconds]
23:06 -!- EugeneKay is now known as EugeneKaway
23:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
23:17 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:22 -!- K1ng [~KING@180.211.188.198] has joined #openvpn
23:25 -!- K1ng` [~KING@180.211.188.198] has quit [Ping timeout: 276 seconds]
--- Day changed Sat Jun 25 2011
00:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
00:31 -!- luneff [~yury@84.51.197.107] has joined #openvpn
00:36 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 258 seconds]
00:42 -!- norc [~foo@ns203763.ovh.net] has quit [Read error: Connection reset by peer]
00:52 -!- K1ng` [~KING@180.211.188.198] has joined #openvpn
00:52 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
00:54 -!- K1ng [~KING@180.211.188.198] has quit [Ping timeout: 244 seconds]
00:55 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 264 seconds]
00:57 -!- grocerybasket [norkmaaa@66.49.180.254] has joined #openvpn
00:57 < grocerybasket> yo
00:57 < grocerybasket> !welcome
00:57 < grocerybasket> !goal
00:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:58 < grocerybasket> i want to set up openVPN to access one windows 7 computer, behind a tomato router.
00:59 < grocerybasket> to access the SMB shares
00:59 < grocerybasket> from windows 7 clients, and from my phone
00:59 < grocerybasket> ive installed openvpn 2.2 package on my windows machine
01:00 -!- luneff [~yury@84.51.197.107] has quit [Quit: This computer has gone to sleep]
01:07 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
01:08 -!- n1xman [~n1xman@124.43.117.226] has joined #openvpn
01:08 <@vpnHelper> RSS Update - forum: VPN clients cannot ping to each other <http://forums.openvpn.net/topic8350.html>
01:24 -!- n1xman [~n1xman@124.43.117.226] has quit [Ping timeout: 264 seconds]
01:37 -!- K1ng` [~KING@180.211.188.198] has quit [Ping timeout: 240 seconds]
01:40 -!- K1ng [~KING@180.211.188.198] has joined #openvpn
01:51 < amero> krzie: i'm still lost about the socks proxy thing
02:05 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
02:08 -!- K1ng` [~KING@180.211.188.198] has joined #openvpn
02:11 -!- K1ng [~KING@180.211.188.198] has quit [Ping timeout: 240 seconds]
02:40 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
02:40 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
02:40 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:41 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
02:43 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
02:43 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
02:43 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:25 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
03:27 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 246 seconds]
03:28 -!- twister004_ is now known as twister004
03:50 -!- patelx [~a@openvpn/corp/admin/patel] has quit [Quit: ircN 8.00 for mIRC (20080809) - www.ircN.org]
04:17 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:23 -!- luneff [~yury@84.51.197.107] has joined #openvpn
04:30 -!- K1ng` [~KING@180.211.188.198] has quit [Ping timeout: 240 seconds]
04:30 -!- K1ng`` [~KING@180.211.188.29] has joined #openvpn
04:34 -!- K1ng [~KING@180.211.188.29] has joined #openvpn
04:34 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
04:38 -!- K1ng`` [~KING@180.211.188.29] has quit [Ping timeout: 246 seconds]
04:43 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
04:44 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 255 seconds]
04:44 -!- twister004_ is now known as twister004
04:47 -!- twister004 [~chatzilla@59.90.34.167] has quit [Client Quit]
05:01 -!- mirco [~mirco@p5B28587B.dip.t-dialin.net] has joined #openvpn
05:28 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html#p13205>
05:37 -!- nobodies [~nobodies@190.211.252.141] has joined #openvpn
05:38 < nobodies> does anyone use openvpn for media streaming over wan, what is the performance like?
05:38 < grocerybasket> nobodies
05:38 < grocerybasket> depends on your bandwidth obv
05:39 < nobodies> well what i am really wondering is, if it is any faster than sshfs
05:41 < nobodies> i mean i am using udp so thats a faster proto but i would be tunneling tcp, so thats like 2 layers, whereas sshfs is straight tcp transfers no tunneling
05:41 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
05:43 < nobodies> maybe i would be better off jut setting up a share and testing it myself
05:45 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
05:46 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
05:46 -!- mode/#openvpn [+o mattock] by ChanServ
05:50 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html#p13206>
05:55 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
05:56 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
06:50 < nobodies> i am trying to get samba working through open vpn but can seesm to access it, i have ran an nmap and its says the port is closed but ssh and http ports are up so its not blocking everything
06:50 < nobodies> *can't
06:54 < Bushmills> !wins
06:54 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
06:54 < Bushmills> for closed ports, check firewall
06:54 < Bushmills> cifs ports are different from ssh and http
06:57 < nobodies> thank you, i'll have a look
07:26 -!- nobodies [~nobodies@190.211.252.141] has quit [Remote host closed the connection]
07:36 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:57 -!- EugeneKaway is now known as EugeneKay
08:10 -!- K1ng [~KING@180.211.188.29] has quit [Ping timeout: 276 seconds]
08:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
08:14 -!- BlackBerries [c3a696d4@gateway/web/freenode/ip.195.166.150.212] has joined #openvpn
08:14 < BlackBerries> I just installed openvpn on ubuntu 10.10 - I import the config file - and the apply button is grayed out so I can't save the vpn and connect.
08:14 < krzie> amero, whose fault is that do ya think? my bot not only told ya what it was, it told you how (even gave you the configs)
08:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:26 <@vpnHelper> RSS Update - forum: VPN clients cannot ping to each other <http://forums.openvpn.net/topic8350.html#p13207>
08:27 -!- BlackBerries [c3a696d4@gateway/web/freenode/ip.195.166.150.212] has quit [Ping timeout: 252 seconds]
08:33 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
08:35 -!- BlackBerries [c3a696d4@gateway/web/freenode/ip.195.166.150.212] has joined #openvpn
08:35 < BlackBerries> OpenVPN on Ubuntu is requiring i have a key file
08:35 < BlackBerries> Where all my host has provided is the CA certificate
08:35 < BlackBerries> and the config file
08:36 < BlackBerries> I've never needed it befre
08:38 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:42 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has quit [Read error: Connection reset by peer]
08:47 -!- sw0rdfish [~Johnson@unaffiliated/robinux] has quit [Ping timeout: 240 seconds]
08:51 -!- Mandrew [~Mandrew@host-95-193-224-173.mobileonline.telia.com] has joined #openvpn
08:52 < Mandrew> hello
08:52 < Mandrew> is there any difference between the openvpn software and the one that is installed in ubuntu?
08:56 -!- EugeneK [~eugenekay@chaoschaoschaos.com] has joined #openvpn
08:57 -!- EugeneK is now known as EugeneKay
09:05 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
09:05 -!- BlackBerries [c3a696d4@gateway/web/freenode/ip.195.166.150.212] has quit [Ping timeout: 252 seconds]
09:06 -!- K1ng [~KING@180.211.188.29] has joined #openvpn
09:11 -!- sw0rdfish [~Johnson@c7ACEBF51.dhcp.bluecom.no] has joined #openvpn
09:12 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
09:12 -!- sw0rdfish [~Johnson@c7ACEBF51.dhcp.bluecom.no] has quit [Changing host]
09:12 -!- sw0rdfish [~Johnson@unaffiliated/robinux] has joined #openvpn
09:20 < Mandrew> how to install openvpn in xubuntu 11.04
09:20 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:32 -!- aditsu_ [~aditsu@059148208052.ctinets.com] has joined #openvpn
09:34 < aditsu_> hi
09:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
09:35 < aditsu_> I'm having problems using iroute, it doesn't seem to add the route on the server
09:36 < aditsu_> I can see this in the logs: MULTI: internal route 192.168.10.0/24 -> delta/(ip:port)
09:36 < aditsu_> but then the route doesn't appear in route -n
09:36 < krzie> !iroute
09:36 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
09:36 < krzie> check that the ccd file is able to be read by the openvpn user
09:37 < krzie> check in server logs that it is actually loading and the iroute is read
09:38 < aditsu_> ccd is readable by all
09:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:38 < aditsu_> OPTIONS IMPORT: reading client specific options from: ccd/delta
09:41 < Mandrew> !install
09:45 < aditsu_> krzie: I reconnected the client, and these are the logs from the server: http://dpaste.com/558805/
09:45 < aditsu_> krzie: any ideas?
09:47 < krzie> and its not in the servers routing table?
09:47 < aditsu_> cat ccd/delta -> iroute 192.168.10.0 255.255.255.0
09:47 < krzie> right i see that
09:47 < aditsu_> nope, it's not
09:47 < krzie> what routing table is it not in
09:48 < krzie> ok, thats because that is unrelated
09:48 < krzie> put a route entry in the server config and restart server
09:48 < aditsu_> route -n has no entry for 192.168.10.0
09:48 < krzie> !route
09:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:48 < krzie> you did the push route, and the iroute, but not the route itself
09:49 < aditsu_> err.. oh wait
09:49 < aditsu_> I think you're on to something
09:49 < krzie> i wrote the doc i just linked you to :-p
09:50 < aditsu_> oh haha :)
09:51 < aditsu_> if I restart the vpn server, does it drop the current connections? I mean, the vpn connections will be cut and they'll reconnect, but what about the tcp connections over vpn? hopefully they'll live
09:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
09:53 < aditsu_> oh well, I'll just restart it anyway
09:55 < aditsu_> success!
09:55 <@vpnHelper> RSS Update - forum: OpenVPN 2.2 Branch and OpenSC with pkcs#11 <http://forums.openvpn.net/topic8341.html#p13208>
09:56 < aditsu_> krzie: you were right, thanks a lot
09:56 < krzie> yw
09:58 -!- aditsu_ [~aditsu@059148208052.ctinets.com] has quit [Quit: ChatZilla 0.9.87 [SeaMonkey 2.0.14/20110509101318]]
10:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:10 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
10:13 -!- [intra]lanman [~lanman@c-98-250-105-93.hsd1.mi.comcast.net] has joined #openvpn
10:13 -!- [intra]lanman [~lanman@c-98-250-105-93.hsd1.mi.comcast.net] has quit [Changing host]
10:13 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:13 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
10:14 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:19 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
10:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:23 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:43 -!- oCean [ocean@pdpc/supporter/professional/ocean] has joined #openvpn
10:43 -!- oCean [ocean@pdpc/supporter/professional/ocean] has left #openvpn ["Bye"]
10:43 -!- BlackBerries [c3a696d4@gateway/web/freenode/ip.195.166.150.212] has joined #openvpn
10:43 < BlackBerries> Anyone have experience with openvpn and linux?
10:45 < EugeneKay> Tons.
10:46 < BlackBerries> EugeneKay: ok
10:47 < BlackBerries> EugeneKay: I installed all the necessary packages for the networkmanager-openvpn function to function. The openvpn-connection-setting are successfully imported into the networkmanger via the conf file but the apply button is grayed out, so that actually saving and using the connection isn't possible? Does anyone know, where the problem is? It's a fresh install of Ubuntu 10.10 after the upgrade from 10.04 sent the networkmange
10:47 < EugeneKay> NetworkManager has been empirically shown to cause cancer, AIDS, and eat your dog.
10:48 < BlackBerries> I keep being told its a policy issue - and i was sent to this thread: http://ubuntuforums.org/showthread.php?t=1616355
10:48 <@vpnHelper> Title: [SOLVED] NX Server, policykit, remote privileges - Ubuntu Forums (at ubuntuforums.org)
10:48 < EugeneKay> And I refuse to provide Ubuntu support on general principle
10:48 < BlackBerries> I have followed thats threads instructions which has seemed to fix my issue for everyone else just not me :l
10:49 < amero> krzie: i've test a couple of socks proxies today and i haven't found one that could forward incoming connections. i still haven't tried dante though
10:49 < BlackBerries> EugeneKay: Great - You've wasted my time. what the hell - no one not even openvpn or ubuntu seems to know shit about their own products
10:49 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
10:50 < EugeneKay> On the plus side, you've gotten slightly more than you paid for from me.
10:51 < krzie> amero, so you didnt try the VERY FIRST one i mentioned?
10:51 < krzie> amero, also it WOULDNT BE FORWARDED BACK OVER SOCKS
10:51 < krzie> i said this a few times
10:51 < krzie> it would be a normal dnat for that. completly unrelated to socks and really not related to openvpn either
10:59 < amero> krzie: sorry i failed to pay my attention to what you said yesterday. it was very late at night in my place and i was so sleepy
11:00 < krzie> EugeneKay, i thought you were talkin to yourself until i remembered my webchat ignore
11:01 < amero> so you're implying that i just need to dnat the port to openvpn iface?
11:01 < krzie> thats the definition of your goal, lol
11:01 < EugeneKay> Yeah, I tend not to mention people in my replies. If they can't be arsed to follow along without being pinged every line it isn't a conversation I need to continue.
11:01 -!- BlackBerries [c3a696d4@gateway/web/freenode/ip.195.166.150.212] has quit [Ping timeout: 252 seconds]
11:09 -!- mirco [~mirco@p5B28587B.dip.t-dialin.net] has quit [Quit: mirco]
11:19 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 240 seconds]
11:32 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
11:42 -!- Mandrew [~Mandrew@host-95-193-224-173.mobileonline.telia.com] has quit [Ping timeout: 264 seconds]
11:44 -!- sw0rdfish [~Johnson@unaffiliated/robinux] has quit [Ping timeout: 246 seconds]
12:01 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
12:05 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
12:14 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
12:23 <@vpnHelper> RSS Update - forum: Running OpenVPN as HTTP Proxy on Windows 7 - help? <http://forums.openvpn.net/topic8351.html>
12:28 -!- raidz [~root@openvpn/corp/admin/andrew] has joined #openvpn
12:28 -!- mode/#openvpn [+o raidz] by ChanServ
12:29 <@vpnHelper> RSS Update - forum: HTTP Proxy on Windows 7 - Help? <http://forums.openvpn.net/topic8351.html>
12:50 -!- stephanj [stephan@nemesis.stejau.de] has joined #openvpn
12:51 < stephanj> hi, what would be the best way of attaching a public ip(spare one) on the vpn server directly to a client? so that all requests to that ip get routed to the client?
12:53 < krzie> !linnat
12:53 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
12:53 < krzie> bidirectional NAT
12:53 < krzie> thats the term
12:54 < krzie> finding how is now your job =]
12:54 < stephanj> ye :)
12:55 < syn4pse> hello I using easy-rsa to generate the certs for my openvpn clients. I edited the vars accordingly. I was wondering if I can run the script somehow that i don`t have to press enter to confirm my default values anymore ( or confirm the to sign my cert ) 
12:56 < EugeneKay> You can, but it requires a good working knowledsge of OpenSSL's config files. 
12:57 < EugeneKay> If you want easier PKI management, take a look at something called XCA. I like it a lot.
12:57 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
12:57 < syn4pse> too bad ;) there are some programs that have a --confirm-all-yes switch ;)
12:58 < EugeneKay> Far from that simple, sadly.
12:58 < syn4pse> ah i generated them already using openssl commands should have written down the commands somewhere ;)
12:59 < EugeneKay> Like I said, look into XCA. It works pretty good, though you still need a decent understanding of PKI
12:59 < syn4pse> i am right now ;)
12:59 < syn4pse> thansk
13:00 -!- K1ng [~KING@180.211.188.29] has quit [Ping timeout: 240 seconds]
13:00 -!- K1ng`` [~KING@180.211.188.29] has joined #openvpn
13:02 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
13:02 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
13:04 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
13:05 -!- K1ng`` [~KING@180.211.188.29] has quit [Ping timeout: 255 seconds]
13:07 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
13:07 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Ping timeout: 258 seconds]
13:16 -!- mirco [~mirco@p5B28587B.dip.t-dialin.net] has joined #openvpn
13:20 -!- K1ng`` [~KING@180.211.188.59] has joined #openvpn
13:21 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
13:23 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
13:24 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 240 seconds]
13:26 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Ping timeout: 258 seconds]
13:27 -!- raidz_afk [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 258 seconds]
13:30 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
13:33 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Ping timeout: 255 seconds]
13:49 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 255 seconds]
14:04 -!- syn4pse [~syn@p5DDC0146.dip0.t-ipconnect.de] has joined #openvpn
14:09 -!- syn4pse [~syn@p5DDC0146.dip0.t-ipconnect.de] has quit [Quit: Verlassend]
14:20 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
14:32 <@vpnHelper> RSS Update - forum: please help me here <http://forums.openvpn.net/topic8352.html>
14:44 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
14:47 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
14:57 -!- hero911x [401432da@gateway/web/freenode/ip.64.20.50.218] has joined #openvpn
14:58 < hero911x> hello
14:58 < hero911x> i am having problem getting traffic to forward from tun0 to tun1 and i can't figure out why
14:59 < hero911x> the flow is client -> openvpn-server tun0 (the server is also a client to another openvpn server) -> tun1 -> openvpn server
15:00 < hero911x> so just to make sure i'm clear, there are 3 machines... the one in the middle (where my problems are) is a server to a client and is a client to another openvpn server
15:00 < hero911x> ip_forward is enabled
15:01 < hero911x> if i originate traffic from the machine in the middle, the traffic will get to the remote server
15:02 < hero911x> i've tried disabling/clearing iptables rules on both the middle and remote server
15:20 -!- hero911x [401432da@gateway/web/freenode/ip.64.20.50.218] has quit [Ping timeout: 252 seconds]
15:23 -!- hero911x [401432da@gateway/web/freenode/ip.64.20.50.218] has joined #openvpn
15:24 < hero911x> got disconnected... did i miss a reply to my questions?
15:34 < EugeneKay> Nope.
15:38 <@vpnHelper> RSS Update - forum: Can't change Network Name or Icon <http://forums.openvpn.net/topic8349.html#p13212> || HTTP Proxy on Windows 7 - Help? <http://forums.openvpn.net/topic8351.html#p13211>
15:49 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:49 <@vpnHelper> RSS Update - forum: [SOLVED] HTTP Proxy on Windows 7 - Help? <http://forums.openvpn.net/topic8351.html#p13211>
16:07 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
16:35 -!- raidz [~root@openvpn/corp/admin/andrew] has left #openvpn []
16:45 -!- mirco [~mirco@p5B28587B.dip.t-dialin.net] has quit [Remote host closed the connection]
16:47 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
16:48 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
17:54 -!- hero911x [401432da@gateway/web/freenode/ip.64.20.50.218] has quit [Ping timeout: 252 seconds]
18:05 -!- hero911xx [401432da@gateway/web/freenode/ip.64.20.50.218] has joined #openvpn
18:05 < hero911xx> can someone answer a few basic questions to help me understand some things, please?
18:06 < |Mike|> see !help
18:08 -!- mads- [~mads@pdpc/supporter/active/mads-] has joined #openvpn
18:08 < mads-> !welcome
18:08 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:08 < mads-> !howto
18:08 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:19 < |Mike|> :)
18:20 < |Mike|> hero911xx: iptables imho
18:27 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Ping timeout: 252 seconds]
18:44 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
18:46 < krzee> re Grleaf 
18:47 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
18:48 < |Mike|> ohai krzee 
18:48 < krzee> hai2u!
18:49 < |Mike|> How're you doing sir?
18:49 < krzee> bored as shit honestly
18:50 < |Mike|> how comes?
18:50 < krzee> @ work with less than nothing to do
18:50 < EugeneKay> Watch 880s music videos on YouTube
18:50 < EugeneKay> Can't go wrong
18:50 < |Mike|> what's the time over there krzee
18:50 < krzee> thats what happens when you script your job
18:50 -!- mads- [~mads@pdpc/supporter/active/mads-] has left #openvpn ["Leaving"]
18:51 < krzee> 4:20
18:51 < krzee> (always)
18:51 < krzee> ;]
18:51 < |Mike|> ok
18:51 < |Mike|> 2011/06/26 01:51:00 < krzee> 4:20
18:51 < krzee> you guys say 420 over there too dont you?
18:53 < EugeneKay> Yes....
18:53 < EugeneKay> Oh, wherever there is
18:53 < EugeneKay> Right, carry on
18:53 < |Mike|> (nope)
18:53 < EugeneKay> http://lmgtfy.com/?q=420
18:53 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
18:56 < krzee> wow, im surprised mike
18:56 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
18:56 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
18:56 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
19:01 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
19:03 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 255 seconds]
19:08 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
19:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
19:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
19:40 -!- Pr0zoid [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has quit []
19:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:14 -!- master_of_master [~master_of@p57B537C9.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
20:15 -!- master_of_master [~master_of@p57B54A13.dip.t-dialin.net] has joined #openvpn
20:31 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5]
20:35 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
20:36 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:39 -!- blackpenguin [~bp@gnuffy.net] has joined #openvpn
20:39 -!- blackpenguin [~bp@gnuffy.net] has quit [Changing host]
20:39 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
20:44 -!- EugeneKay is now known as EugeneKaway
21:05 -!- EugeneKaway is now known as EugeneKay
21:06 -!- EugeneKay is now known as EugeneKaway
21:19 <@vpnHelper> RSS Update - forum: VPN clients cannot ping to each other <http://forums.openvpn.net/topic8350.html#p13213>
21:26 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:27 -!- EugeneKaway is now known as EugeneKay
21:29 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has joined #openvpn
21:34 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
21:54 < amero> why binding app to openvpn iface doesn't work?
21:56 < amero> i've already snat the openvpn iface on the remote server side
22:00 -!- dave-- [~norkmaaa@66.49.180.254] has joined #openvpn
22:01 -!- grocerybasket [norkmaaa@66.49.180.254] has quit [Read error: Connection reset by peer]
22:01 -!- zamba [marius@flage.org] has quit [Read error: Operation timed out]
22:01 -!- zamba_ [marius@flage.org] has joined #openvpn
22:06 -!- zamba_ [marius@flage.org] has quit [Client Quit]
22:18 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
22:25 -!- EugeneKay is now known as EugeneKaway
22:31 <@vpnHelper> RSS Update - forum: Bind app to openvpn interface <http://forums.openvpn.net/topic8353.html>
22:38 -!- luneff [~yury@84.51.197.107] has quit [Quit: This computer has gone to sleep]
22:47 -!- hero911xx [401432da@gateway/web/freenode/ip.64.20.50.218] has quit [Ping timeout: 252 seconds]
23:20 -!- EugeneKaway is now known as EugeneKay
23:22 -!- EugeneKay is now known as EugeneKaway
23:29 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- *I* use it, so it must be good!]
--- Day changed Sun Jun 26 2011
00:14 <@vpnHelper> RSS Update - forum: Cannot Tunnel Local Connection <http://forums.openvpn.net/topic8338.html#p13215>
00:15 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
00:33 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
00:44 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 252 seconds]
00:48 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
00:53 -!- K1ng`` [~KING@180.211.188.59] has quit [Ping timeout: 255 seconds]
01:00 -!- K1ng [~KING@180.211.188.59] has joined #openvpn
01:05 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
01:25 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
02:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:49 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
03:52 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 252 seconds]
04:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:11 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
04:39 -!- K1ng [~KING@180.211.188.59] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
04:42 -!- K1ng [~KING@180.211.188.59] has joined #openvpn
04:42 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:42 -!- mode/#openvpn [+o mattock] by ChanServ
04:42 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 276 seconds]
04:56 -!- syn4pse [~syn@p5DDC059A.dip0.t-ipconnect.de] has joined #openvpn
05:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:47 -!- Hamlin [~Hamlin@2001:470:7:2b8::2] has quit [Ping timeout: 255 seconds]
05:49 -!- Hamlin [~Hamlin@2001:470:7:2b8::2] has joined #openvpn
06:10 -!- LBo [~LBo@cable-129-137.zeelandnet.nl] has joined #openvpn
06:12 < LBo> Hi all, I'm having some troubles setting up openvpn with a external dhcp server (dnsmasq)
06:12 < LBo> Has anyone got a little time to help me with that?
06:15 -!- syn4pse [~syn@p5DDC059A.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
06:19 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
06:28 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
06:37 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
07:00 < LBo> I've got a router (192.168.1.1) with dhcp running on it. I'm now trying to set up a openvpn in bridge mode on my pandaboard (192.168.1.122). I would like the openvpn clients to get an ip from the dhcp server, not from openvpn
07:00 < LBo> When I connect with a client (gnome networkmanager) the server gives this error message: "no dynamic or static remote --ifconfig address is available for leon/192.168.1.101"
07:00 -!- zamba [marius@flage.org] has joined #openvpn
07:01 < zamba> i have a strange error with one of my vpn tunnels.. i'm able to connect to the server and i get added a network from the server that i can route through.. but then it disconnects 5 seconds afterwards
07:01 < LBo> When I add a server/server-bridge line to my servers' config with a pool I can connect fine. But then openvpn is handing out ip's and I don't want that
07:02 < zamba> http://pastebin.com/mjWRU2w6
07:02 < LBo> I've looked at the logs on the dhcp server (my router) and I don't think the requests are forwarded from the openvpn server
07:03 < LBo> Anyone an idea what the problem could be?
07:07 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
07:31 <@vpnHelper> RSS Update - forum: Windows File Shares Unreachable via OpenVPN <http://forums.openvpn.net/topic7963.html#p13216>
07:32 -!- arejay [arejay@i.write.shellcode.eu] has quit [Ping timeout: 255 seconds]
07:34 -!- arejay [arejay@i.write.shellcode.eu] has joined #openvpn
07:42 -!- EugeneKaway is now known as EugeneKay
07:58 < syn4pse> Iḿ using redirect gateway so clients use the vpn as their default gw i was wondering if i can setup exceptions for a certain client 
08:08 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
08:10 < amero> yes
08:10 < amero> (i think)
08:10 < amero>             The  following  options  are legal in a client-specific context:
08:10 < amero>               --push, --push-reset, --iroute, --ifconfig-push, and --config.
08:12 < EugeneKay> You want ccd and push-reset
08:13 < syn4pse> hmm
08:13 < syn4pse> so connect the client using --push-reset
08:13 < EugeneKay> !ccd
08:13 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
08:14 < EugeneKay> Do it on the server end using ccd to tie it to just the clients in question
08:14 < syn4pse> sweet
08:14 < syn4pse> thanks a lot :)
08:16 < EugeneKay> Sure.
08:16 < LBo> I've also tried it with the openvpn commandline program but it the throws the same error.
08:22 < EugeneKay> "TAP has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
08:30 < amero> EugeneKay: any idea?: http://forums.openvpn.net/topic8353.html
08:30 <@vpnHelper> Title: OpenVPN Support Forum Bind app to openvpn interface : Server Administration (at forums.openvpn.net)
08:31 < EugeneKay> I dont read forums.
08:33 < amero> tl;dr - bind apps to local openvpn interface. openvpn runs in routed mode
08:34 < amero> no redirect-gateway
08:35 < amero> remote openvpn interface snat'ed
08:50 < EugeneKay> Essentially you want to redirect-gateway just for the one app
08:50 < EugeneKay> Do it via DNAT instead of SNAT. Point the local app at an IP on the vpn server instead.
08:51 < EugeneKay> I'm sure there's a way to do it with your method, but mine is lazier and will "just work" :-p
08:52 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Read error: Operation timed out]
08:53 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
09:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
09:25 -!- [intra]lanman [~lanman@c-98-250-105-93.hsd1.mi.comcast.net] has joined #openvpn
09:25 -!- [intra]lanman [~lanman@c-98-250-105-93.hsd1.mi.comcast.net] has quit [Changing host]
09:25 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
09:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:51 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has quit [Read error: Connection reset by peer]
09:52 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has joined #openvpn
09:58 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:13 -!- n1xman [~n1xman@124.43.127.41] has joined #openvpn
10:37 -!- n1xman [~n1xman@124.43.127.41] has quit [Quit: Leaving]
10:57 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
11:00 < LBo> Is it possible to use a external dhcp server with a tun openvpn server? So to not use openvpn pools?
11:04 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
11:06 < EugeneKay> I don't think so.
11:06 < EugeneKay> If you're trying to get DDNS updates, you should be able to do that with a nsupdate wrapper script called by client-connect
11:08 < LBo> No, I'm just trying to get my linux openvpn client a dhcp address from my routers dhcp server
11:08 < EugeneKay> Not gonna happen in TUN
11:09 < LBo> I first tried tap but that didn't work with linux easily I red somewhere
11:09 < EugeneKay> Your client would need to arp on the same LAN as your vpn server, which is what tap does
11:09 < EugeneKay> Is your router the same thing as your vpn server?
11:09 < LBo> No
11:10 < EugeneKay> Put a static route for the vpn network on the router pointing to the vpn server
11:10 < EugeneKay> Done.
11:38 <@vpnHelper> RSS Update - forum: source vars <http://forums.openvpn.net/topic8354.html>
13:28 -!- kirk_ [~kirk@96.44.188.116] has joined #openvpn
13:28 -!- kirk_ is now known as computer13137
13:28 < computer13137> Hey, I have a question...
13:28 < computer13137> I am running a dnsmasq service on my VPN server.  I want to push that DNS server to my clients, which I have found how to do in the config.
13:29 < computer13137> My problem is the clients still remember their old DNS servers. I need those to be wiped out, as without them, it seems like my custom DNS records (for internal VPN use) don't get looked up from my DNS server.
13:35 < EugeneKay> I argued with that same problem for a while. Then I gave up and just made my vpn dns public.
13:36 < computer13137> Well, I could do that... but then I couldn't do like "webserver".
13:37 < computer13137> I'd have to do "webserver.mydomain.com"
13:37 < computer13137> ll
13:37 < computer13137> lol*
13:37 < EugeneKay> DNS search domains are a hell of a thing
13:38 < computer13137> oh really? so if I set search domain to mydomain.com then I can ping webserver?
13:38 < EugeneKay> Yup.
13:38 < computer13137> I did not know this...
13:38 < computer13137> I think I can successfully push that attribute.
13:38 < EugeneKay> That's why it's called a search domain
13:40 < computer13137> Do you do static IPs on your VPN as well EugeneKay?
13:40 < computer13137> I think I get the idea of how to do it but I tried the other day and it didn't work.
13:41 < EugeneKay> Nope
13:44 < computer13137> Well, it says to uncomment two lines.
13:44 < computer13137> ;client-config-dir ccd
13:44 < computer13137> ;route 192.168.40.128 255.255.255.248
13:45 < computer13137> I don't understand why that second one is needed.
13:45 < computer13137> I already have routes setup.
13:45 < computer13137> I think I'll try without it...
13:46 -!- dave-- [~norkmaaa@66.49.180.254] has quit [Ping timeout: 250 seconds]
13:51 -!- spike [~spike@unaffiliated/spike] has joined #openvpn
13:54 < spike> hi there, must be doing something stupid but I'm not getting icmp replies from a host behind a vpn when pinging the other vpn endpoint. I've set ip forwarding and the ping reuqests correctly get to the other end (I can see them with tcpdump), but no replies seem to be ever generated
13:54 < spike> pinging from the vpn gw works
13:54 < spike> both ways
13:55 < spike> ah, nm, I think I figured it out.. power of asking questions
14:04 < krzie> firewall? ;]
14:05 < krzie> or route on the router
14:06 < spike> krzie: subnet conflict with aws network
14:07 < EugeneKay> 4GB flash drives are down to $8 on eBay. 
14:12 < computer13137> Hmm...
14:12 < computer13137> My search domain is not being pushed to client resolv.conf
14:13 < computer13137> 55946 SENT CONTROL [kirk-desktops_apevia]: 'PUSH_REPLY,route 172.16.0.1 255.240.0.0,redirect-gateway def1,dhcp-option DNS 172.16.0.1,dhcp-option DOMAIN excelsior.epecweb.com,dhcp-option SEARCH vpndns.excelsior.epecweb.com,route-gateway 172.16.0.1,ping 10,ping-restart 120,ifconfig 172.16.0.201 255.240.0.0' (status=1)
14:13 < computer13137> However on the client, the search domain still isn't there...
14:13 < computer13137> But on client config I do have a directive to prevent it from pulling the default gateway, as this is not always the behavior I want.
14:13 < computer13137> I think I just used route-nopull.
14:14 < EugeneKay> I was thinking more along the lines ofjust edit the resolv.conf and call it a day
14:14 < computer13137> Ugh. 
14:14 < computer13137> I'm going to have like 8 clients in different geographic locations though.
14:15 < computer13137> I want a way for this to be seamless.
14:15 < computer13137> I'm sure it's possible. There would be no reason to have OpenVPN have a push if it didn't work.
14:15 < EugeneKay> I'm sure it is too, but laziness is a hell of a drug
14:15 < computer13137> Two of my clients are laptops.
14:15 < computer13137> They get a new resolv.conf every time they boot and acquire dhcp.
14:16 < computer13137> Laziness IS a hell of a drug.
14:16 < computer13137> Hence why I want to be able to access my servers on the VPN by hostname without doing anything crazy.
14:17 < krzie> computer13137, you need a script to do that
14:17 < krzie> just like with DNS options
14:17 < krzie> !pushdns
14:17 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
14:17 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
14:17 < krzie> #4 for the DNS stuff
14:17 < krzie> you may need to modify it for what else you need (search, domain)
14:18 < computer13137> Hmm...
14:18 < computer13137> I saw that script in /etc/openvpn on my clients.
14:18 < krzie> but it only handles DNS
14:18 < computer13137> Fortunately I'll only have 1 client that's Windows.
14:18 < krzie> you need to mod it to do the extra stuff you require
14:18 < computer13137> And I don't really give a fuck about the dns on the windows one.
14:18 < computer13137> What extra stuff?
14:18 < computer13137> If it can push the dns shit that's all I wanted in the first place.
14:18 < krzie> [15:19]  <krzie> you may need to modify it for what else you need (search, domain)
14:19 < computer13137> Let me take a look at that script...
14:19 < krzie> you didnt just push dns, you're complaining bout SEARCH and DOMAIN, not DNS
14:19 < krzie> anyways, bbl
14:19 < computer13137> krzie: I only was using those because EugeneKay told me to.
14:19 < computer13137> I originally wanted to force clients to use my dnsmasq server.
14:19 < krzie> nothin wrong with dnsmasq...
14:19 < krzie> !splitdns
14:19 <@vpnHelper> "splitdns" is see http://www.thekelleys.org.uk/dnsmasq/doc.html for dnsmasq, which will let you do split-dns setups
14:19 < EugeneKay> I didn't say push it, I said just put it in, which is how i roll
14:20 < krzie> but ya, bbl
14:20 < krzie> from krzee
14:22 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:23 < spike> for testing, can you setup a bunch of clients with symmetric keys and still use the ccd to assign static ips?
14:24 < spike> all the docs I'm reading refer to the CA+dn directives when it comes to handling >1 client
14:35 < krzee> spike, symmetric keys, like --secret?
14:35 < krzee> aka static keys
14:58 -!- satonio [~satonio@239.Red-83-57-130.dynamicIP.rima-tde.net] has joined #openvpn
14:58 < satonio> hi
14:59 < satonio> i'm using openvpn + masquerade but it seems that dns fowarding stopped working and now i get ;; connection timed out; no servers could be reached if i try to use dig
14:59 < satonio> any ideas?
15:01 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
15:02 < krzee> yes, change your NS
15:03 < krzee> your client has its ISPs NS, but your traffic comes out of your server, your ISP secured their NS against being used as a ddos relay so it will not recurse dns for your server
15:03 < krzee> !dns
15:03 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
15:03 < krzee> optionally, you can choose to only have your DNS changed when connected to the vpn, in which case !pushdns
15:03 < krzee> but ya, just changing the DNS on that client to use 8.8.8.8 will work
15:04 < satonio> !pushdns
15:04 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
15:04 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
15:04 < satonio> i already have push "dhcp-option DNS 10.8.0.1" on the server configuration
15:06 < satonio> it suddenly stopped to work today without chaning configuraiton or something like that
15:06 < pwrcycle> satonio did you reboot? have you checked ip_forwarding ?
15:07 < satonio> i did reboot after it stopped working and it isn't still not working, and also i rebooted the client
15:09 < pwrcycle> !ipforward
15:09 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:09 < pwrcycle> !linipforward
15:09 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:09 < pwrcycle> what does this say: cat /proc/sys/net/ipv4/ip_forward
15:10 < satonio> !linipforward
15:10 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:11 < satonio> hmmm
15:11 < pwrcycle> what does it say? 0 ??
15:11 < satonio> ipv4 traffic forwarding seems to be working fine, except when it have to resolve a name
15:12 < satonio> cat  /proc/sys/net/ipv4/ip_forward says 1
15:12 < satonio> the problem is resolving dns names
15:13 < satonio> i can do wget 74.125.39.99 and it gets it fast
15:14 < satonio> but wget www.google.es hangs resolving
15:14 < krzee> what OS is the client?
15:14 < satonio> ubuntu
15:14 < satonio> 10.04
15:15 < satonio> and the server ubuntu 10.04 server
15:15 < krzee> you using update-resolv-conf script?
15:15 < krzee> aka #4 from !pushdns
15:15 < krzee> (#4) in unix you'll use the update-resolv-conf script
15:15 < satonio> i tried after connecting using just sudo /etc/openvpn/update-resolv-conf
15:15 < krzee> LOL
15:15 < satonio> but i saw no difference
15:15 < krzee> how would that work?
15:15 < krzee> how would that know you pushed a NS?
15:15 < krzee> lol
15:16 < satonio> idk
15:16 < krzee> you can do it manually, sure
15:16 < satonio> how should i use it?
15:16 < krzee> but without the script
15:16 < krzee> just put it in your resolv.conf if you wanna do it manually
15:16 < satonio> hmmm
15:17 < satonio> i would prefer to just use it when i connect the vpn
15:17 < satonio> how can i use that script properly?
15:17 < krzee> http://lmgtfy.com/?q=update-resolv-conf+openvpn
15:17 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
15:18 < satonio> thanks
15:18 < krzee> yw
15:21 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
15:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:32 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:32 < satonio> i can't solve it right now
15:32 < satonio> well i'll come back when not drunk
15:33 < satonio> it's much harder tying to fix things drunk
15:36 < krzee> +1 for not coming here asking questions drunk
15:36 < satonio> anyway thanks i'll try it again before asking
15:36 < satonio> it not very drunk
15:38 < satonio> anyway i think it won't work
15:38 < satonio> i think i did it well
15:39 < satonio> after reading in google like you wrote
15:39 < krzee> lol come back sober
15:39 < satonio> i'm sober almost all time
15:39 < satonio> so it won't be difficult
15:40 < krzee> cool, see ya then
15:41 < satonio> i have never tried to fix things that aren't working drunk
15:41 < satonio> now i realize it's much harder
15:42 < satonio> anyway i want to say i tried to fix it before getting drunk
16:03 -!- stephanj [stephan@nemesis.stejau.de] has left #openvpn []
16:29 < spike> krzee: yeah, as in static keys
16:29 < spike> (sorry was afk)
16:43 -!- maxjezy [~rappareku@unaffiliated/maxjezy] has joined #openvpn
16:43 -!- maxjezy [~rappareku@unaffiliated/maxjezy] has left #openvpn ["Lämnar"]
16:47 -!- Hejsan11___ [d5729125@gateway/web/freenode/ip.213.114.145.37] has joined #openvpn
16:47 < Hejsan11___> Can somebody help me (LINUX)? Swedish someone?
16:49 < Hejsan11___> !welcome
16:49 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:49 -!- Hejsan11___ [d5729125@gateway/web/freenode/ip.213.114.145.37] has quit [Client Quit]
16:49 < EugeneKay> Mmmmm..... Swedish babes......
16:50 -!- SpawN13123 [d5729125@gateway/web/freenode/ip.213.114.145.37] has joined #openvpn
16:50 < SpawN13123> Hello?
16:51 < norc> !welcome
16:51 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:52 < norc> SpawN13123: ^-
16:52 < SpawN13123> Can somebodu help me?
16:52 < SpawN13123> Linux...
16:55 < SpawN13123> ?
17:00 < SpawN13123> Somebody answear?
17:00 < Bushmills> no question asked - no answer possible
17:01 < SpawN13123> How do I setup OpenVPN i Kubuntu? I have already done network manager in consle but I cant connect
17:02 < SpawN13123> in*
17:02 < Bushmills> !ubuntu
17:02 <@vpnHelper> "ubuntu" is dont use network manager!
17:02 < Bushmills> !howto
17:02 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:04 < krzee> spike, you cant have multiple users with static keys
17:04 < krzee> spike, if you want --server you must use RSA
17:04 < krzee> (or --mode server)
17:04 < krzee> with static keys you may only have 2 peers, no client/server
17:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
17:22 < spike> krzee: ok, thanks for your answer, I'll set things up with client certs then.
17:23 < krzee> np
17:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:43 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
17:44 -!- SpawN13123 [d5729125@gateway/web/freenode/ip.213.114.145.37] has quit [Quit: Page closed]
17:46 -!- corretico [~luis@201.201.44.82] has joined #openvpn
17:49 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
18:38 -!- krackpot [~krackpot@S0106000c42a9996c.vc.shawcable.net] has joined #openvpn
18:41 -!- satonio [~satonio@239.Red-83-57-130.dynamicIP.rima-tde.net] has quit [Quit: Saliendo]
20:14 -!- master_of_master [~master_of@p57B54A13.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
20:16 -!- master_of_master [~master_of@p57B55A34.dip.t-dialin.net] has joined #openvpn
20:28 <@vpnHelper> RSS Update - forum: Uninstall <http://forums.openvpn.net/topic8355.html>
20:32 -!- EugeneKay is now known as EugeneKaway
20:32 -!- EugeneKaway is now known as EugeneKay
20:35 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
20:35 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:47 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
20:47 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
20:47 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
21:18 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
21:58 -!- pranq_ [pranq@bbis.us] has quit [K-Lined]
22:40 -!- computer13137 [~kirk@96.44.188.116] has quit [Quit: Lost terminal]
23:08 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:27 -!- toortog [~toortog@notsecure.net] has quit [Read error: Connection reset by peer]
23:28 -!- toortog [~toortog@notsecure.net] has joined #openvpn
23:34 <@vpnHelper> RSS Update - forum: Help Accessing Windows Share Over VPN <http://forums.openvpn.net/topic8356.html>
--- Day changed Mon Jun 27 2011
00:23 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Read error: Connection reset by peer]
00:24 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
00:24 <@vpnHelper> RSS Update - forum: Help Accessing Windows Share Over VPN <http://forums.openvpn.net/topic8356.html#p13220>
00:24 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
00:35 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
00:44 -!- norc [~foo@ns203763.ovh.net] has quit [Read error: Connection reset by peer]
00:45 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
00:47 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
00:51 < krzie> EugeneKay, turns out you dont need to delete the certs from sdcard after, it does that autp
00:51 < EugeneKay> been so long since I've done it
00:55 -!- EugeneKay is now known as EugeneKaway
00:59 < krzie> !learn p12 as openssl pkcs12 -export -out filename.p12 -inkey filename.key -in filename.crt -certfile ca.crt
00:59 <@vpnHelper> Joo got it.
01:07 <@vpnHelper> RSS Update - forum: Help Accessing Windows Share Over VPN <http://forums.openvpn.net/topic8356.html#p13221>
01:11 < krzie> EugeneKaway, do you use tls-auth hmac?
01:13 <@vpnHelper> RSS Update - forum: VPN clients cannot ping to each other <http://forums.openvpn.net/topic8350.html#p13222>
01:15 < krzie> !hmac
01:15 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
01:15 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
01:25 <@vpnHelper> RSS Update - forum: Bind app to openvpn interface <http://forums.openvpn.net/topic8353.html#p13223>
01:31 <@vpnHelper> RSS Update - forum: source vars <http://forums.openvpn.net/topic8354.html#p13225> || Uninstall <http://forums.openvpn.net/topic8355.html#p13224>
01:32 -!- zamba [marius@flage.org] has left #openvpn []
01:37 <@vpnHelper> RSS Update - forum: Windows File Shares Unreachable via OpenVPN <http://forums.openvpn.net/topic7963.html#p13226>
01:38 -!- luneff [~yury@84.51.213.254] has joined #openvpn
02:14 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Ping timeout: 252 seconds]
02:15 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
02:17 -!- kyrix [~ashley@217.25.126.106] has joined #openvpn
02:17 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:21 < Kartagis> good morning
02:22 < Kartagis> do you have any links that I can read regarding database auth?
02:26 < krzie> not really, most of that has nothing to do with openvpn
02:26 < krzie> you just use a script to check *anything*
02:27 < krzie> !authpass
02:27 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
02:27 < krzie> !man
02:27 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
02:31 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Ping timeout: 240 seconds]
02:33 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
02:52 -!- arejay [arejay@i.write.shellcode.eu] has quit [Remote host closed the connection]
02:58 -!- arejay [arejay@i.write.shellcode.eu] has joined #openvpn
03:31 <@vpnHelper> RSS Update - forum: please help me here <http://forums.openvpn.net/topic8352.html#p13227>
03:40 < spike> doesn't the CN for client certs have to match hosts's reverse?
03:41 < spike> looking at http://openvpn.net/index.php/open-source/documentation/howto.html#quick in the "generate certs" section it show the CN matching the name of the key but there's no mention about the host's fqdn/reverse
03:41 <@vpnHelper> Title: HOWTO (at openvpn.net)
03:43 < spike> or is that only necessary for the ccd dir to match the client's config?
03:43 < spike> to use the fqdn that is
03:47 < spike> actually, that doesn't seem to be true either, it seems they have to be named with the CN of the cert and that's it
04:03 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Read error: Operation timed out]
04:13 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
04:37 <@vpnHelper> RSS Update - forum: Mac OPENVPN client <http://forums.openvpn.net/topic8357.html>
04:42 -!- luneff [~yury@84.51.213.254] has quit [Quit: This computer has gone to sleep]
04:50 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
04:51 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Remote host closed the connection]
04:55 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:55 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:55 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:01 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
05:14 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:14 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:23 -!- Ang3 [~Ang@89-158-161-93.rev.dartybox.com] has joined #openvpn
05:23 < Ang3> o/  - i'm trying  to setup a OpenVPN on my ubuntu serv, it"s really pain in the ass. I can't start the process its return a "FAIL"... 
05:26 < Ang3> !welcome
05:26 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:26 -!- kyrix [~ashley@217.25.126.106] has quit [Ping timeout: 258 seconds]
05:28 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
05:28 -!- mode/#openvpn [+o mattock] by ChanServ
05:33 -!- kyrix [~ashley@217.25.126.106] has joined #openvpn
05:34 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
05:37 -!- N0DEH [admin@ns3.cripperz.net] has joined #openvpn
05:38 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Quit: Verlassend]
05:38 -!- shameem [~shameem@115.249.36.125] has joined #openvpn
05:38 < shameem> hi all
05:39 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
05:40 < shameem> I have some problem with openvpn while connecting a user from different pc at same time,
05:40 < krzie> !dupe
05:40 <@vpnHelper> "dupe" is see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended)
05:40 < krzie> !learn dupe as instead, use !pki to make a cert for each user
05:40 <@vpnHelper> Joo got it.
05:51 < shameem> okay
05:52 < shameem> I need to connect same user from different location with same cert,is that posible in openvpn
05:52 < shameem> ?
05:52 < amero> yes
05:52 < amero> !duplicate-cn
05:53 -!- Ang3 [~Ang@89-158-161-93.rev.dartybox.com] has quit [Quit: Ang3]
05:54 < shameem> okay got it 
05:54 < shameem> thank you guys
06:03 -!- luneff [~yury@93.178.91.38] has joined #openvpn
06:21 -!- kyrix [~ashley@217.25.126.106] has quit [Ping timeout: 250 seconds]
06:30 -!- kyrix [~ashley@217.25.126.106] has joined #openvpn
06:32 <@vpnHelper> RSS Update - forum: Remote share folder <http://forums.openvpn.net/topic8358.html>
06:32 -!- luneff [~yury@93.178.91.38] has quit [Ping timeout: 276 seconds]
06:37 -!- luneff [~yury@109.165.92.171] has joined #openvpn
06:37 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
06:38 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
06:45 -!- luneff [~yury@109.165.92.171] has quit [Ping timeout: 240 seconds]
06:49 -!- Ang3 [~Ang@89-158-161-93.rev.dartybox.com] has joined #openvpn
06:51 < Ang3> hello i got some issue to setup the openvpn server, i can't start it with init.d: it returns fail
06:52 < Ang3> and sudo openvpn server.conf just return nothin... 
06:52 < Ang3> any idea?
06:58 -!- luneff [~yury@188.114.45.166] has joined #openvpn
07:02 <@vpnHelper> RSS Update - forum: Remote share folder <http://forums.openvpn.net/topic8358.html#p13230>
07:03 < Bushmills> sure ... you may want to investigate the reason for "fail"
07:03 < Bushmills> knowing the reasons makes it much easier to come up with a solution to the problem
07:04 < Bushmills> or, if you are interested in a more general suggestion,  the proper course of treating condition "fail" is to "fix it".
07:19 < Ang3> ok i'll be a lill more descriptive
07:21 < Ang3> here is the log when i do sudo openvpn server.conf
07:21 < Ang3> http://pastebin.com/vnDdrkBc
07:21 -!- Ang3 [~Ang@89-158-161-93.rev.dartybox.com] has left #openvpn []
07:21 -!- Ang3 [~Ang@89-158-161-93.rev.dartybox.com] has joined #openvpn
07:22 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
07:22 < Ang3> is seems to be an adress pb
07:26 < Bushmills> Ang3: seems that openvpn is either already running, or there's a problem with the specification of address of interface to bind to.
07:27 < Ang3> hum
07:27 < Ang3> sudo /etc/init.d/openvpn stop
07:27 < Ang3>  * Stopping virtual private network daemon(s)...
07:27 < Ang3>  *   No VPN is running.
07:27 < Bushmills> use netstat to check what's running on the port you're trying to bind to
07:28 < Ang3> here is my server.conf
07:28 < Ang3> http://pastebin.com/Mwp09M22
07:29 < Bushmills> stop your web server before starting openvpn
07:30 < Ang3> apache2 is stopped already eys
07:30 < Ang3> yes
07:30 < Ang3> netstat -a ? 
07:30 < Bushmills> no
07:31 < Ang3> chacking the man :p
07:33 < Ang3> returns netstat: no support for `AF INET (tcp)' on this system.
07:33 < Bushmills> 4.4.4.4 is not a functional recursive name server, btw
07:33 < Ang3> :/
07:33 < Ang3> aha ?
07:34 < Bushmills> that's not the reason why server won't start, but may become a problem when clients connect
07:34 < Ang3> ok 
07:34 < Ang3> then first, let's make the serv runiing :)
07:35 < Bushmills> change port to something else, possible protocol as well.  try to start. if it does, you can be rather certain that something has been bound to port 80 already
07:36 < Ang3> ok - do i need to regenerate my certificats ?
07:36 < Bushmills> no.
07:37 < Bushmills> unless there's not yet known problem with them
07:37 < Ang3> trying with port 42
07:39 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
07:39 < Ang3> fail once again :/
07:40 < Bushmills> try to run as root
07:40 < ecrist> or pick a port >1024
07:40 < Ang3> here the log /var/log/openvpn.log 
07:40 < Ang3> http://pastebin.com/XaTYygXG
07:41 < Ang3> ok i'll try with 1030 then
07:43 < Ang3> hum - sudo openvpn server.conf just freeze my server
07:43 < Ang3> got the prompt blinking but nothin more...
07:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:47 < Ang3>  xavier@ks380744:~$ sudo openvpn server.conf
07:47 < Ang3> [sudo] password for xavier: 
07:47 < Ang3> Options error: In [CMD-LINE]:1: Error opening configuration file: server.conf
07:47 < Ang3> Use --help for more information.
07:47 < Ang3> grrr
07:47 < Ang3> don't get it ... 
07:48 < ecrist> what was the command you used?
07:48 < Bushmills> use full path to config
07:48 < Ang3> xavier@ks380744:~$ sudo openvpn /etc/openvpn/server.conf
07:48 < Ang3> xavier@ks380744:~$ 
07:48 < Ang3> :/
07:49 < ecrist> and does root have permission to read the file?
07:50 < Ang3> yep : 
07:50 < Ang3> xavier@ks380744:/etc/openvpn$ ls -l
07:50 < Ang3> -rw-r--r-- 1 root   root  504 2011-06-27 14:42 server.conf
07:51 < ecrist> Ang3: when you used the full path, it appears to have started.
07:51 < ecrist> no error listed
07:51 < Ang3> i was waiting for somethin like that : http://blog.nicolargo.com/wp-content/uploads/2010/10/openvpnstart.png
07:51 < Ang3> no? 
07:52 < ecrist> not if you have a log line defined.
07:52 < Ang3> aaaaaah
07:52 < ecrist> what OS?
07:52 < Ang3> ubuntu 10.04 serv ed
07:52 < ecrist> lsof -i TCP -i UDP | grep vpn
07:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:53  * Bushmills thought ubuntu was a linux distribution, and the OS was linux
07:53 < Ang3> xavier@ks380744:/etc/openvpn$ lsof -i TCP -i UDP | grep vpn
07:53 < Ang3> xavier@ks380744:/etc/openvpn$ 
07:53 < Bushmills> do they come with their own OS nowadays?
07:53 < ecrist> Bushmills: linux is just the kernel
07:53 < ecrist> ubuntu would be the OS
07:54 < Ang3> but lsof don't worx :p
07:56 < Ang3> ok nice 
07:56 < Ang3> xavier@ks380744:/etc/openvpn$ sudo /etc/init.d/openvpn start
07:56 < Ang3>  * Starting virtual private network daemon(s)...
07:56 < Ang3>  *   Autostarting VPN 'server'
07:56 < Ang3>  * Already running (PID file exists)
07:56 < Ang3>    ...done.
07:56 < Ang3> thats a good point :)
08:01 < Ang3> now i try to configure the client :)
08:01 < Ang3> OpenVpn isn't really userfriendly ... Hopefully there is some kool ppl on IRC :p
08:08 < Ang3> ok don't the client don't works too ... 
08:09 < Ang3> i tried with tunnelblicks
08:10 <@vpnHelper> RSS Update - forum: Remote share folder <http://forums.openvpn.net/topic8358.html#p13231>
08:13 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:15 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:16 < Ang3> with tunneblik the .ovpn is enough ? 
08:16 < Ang3> or do i need to paste the .key & .crt ?
08:17 < reiffert> tunnelblick is gui to openvpn
08:17 < reiffert> openvpn requires the ca, the cert and the key file in order to work propoerly.
08:19 < Kartagis> do you have any links that I can read regarding database auth?
08:20 < ecrist> Kartagis: not really
08:20 < ecrist> you have to do so with external scripts
08:20 < reiffert> There sould be a contrib module to openvpn, that works with pam and pam can be told to auth against ldap.
08:20 < ecrist> openvpn comes with one for ldap, use that as a base.
08:20 < bystander> guys how do I check if openvpn has already been down due to the number of users is beyond 200
08:20 < ecrist> bystander: try again.
08:20 < bystander> is there a linux command for that?
08:20 < Kartagis> reiffert: not ldap, database
08:20 < reiffert> Kartagis: then have pam auth against database.
08:21 < ecrist> Ang3: with tunnelblick you need ca, cert, key, config at minimum usually
08:21 < bystander> ecrist: what do you mean try again?
08:21 < ecrist> your question didn't make sense.
08:21 < ecrist> Kartagis: you'll have to either write a script, or use a packaged module.  not much docs on it, though.
08:22 < Ang3> ok ecrist i gotta download the .key then 
08:22 < reiffert> ldap can be configured to have database as backend btw.
08:22 < bystander> My server is online but when I connect to the server for how many hours with other clients, I can no longer connect to the internet.  I suppose my openvpn server is already down.
08:23 < bystander> so I tried to restart the openvpn service and I can connect to the server again. So I was thinking how to check on that.
08:24 < Ang3> ok i put mylaptop.key, ca.crt, mylaptop.crt, client.ovpn, client.conf & ta.key
08:24 < Ang3> but it says it can't connect
08:24 < Ang3> 2011-06-27 15:23:24 *Tunnelblick: Attempting connection with client; Set nameserver = 1; monitoring connection
08:24 < Ang3> 2011-06-27 15:23:24 *Tunnelblick: /Applications/Tunnelblick.app/Contents/Resources/openvpnstart start client.conf 1337 1 0 0 0 49
08:24 < Ang3> 2011-06-27 15:23:24 *Tunnelblick: openvpnstart status #242: Error: OpenVPN returned with status 1. Possible error in configuration file. See "All Messages" in Console for details
08:25 < Ang3> oh maybe it's about the recursive server name ? i put 4.4.4.4
08:25 < Ang3> in my server.conf
08:25 < Ang3> ?
08:27 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit []
08:31 < syn4pse> bystander you can add verb 5 to the config and start it by typing : openvpn --config /path/to/your/config.conf
08:31 < syn4pse> then you will get output 
08:34 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:38 < bystander> guys how will I check that the openvpn service is down due to number of users.
08:39 -!- star314 [~star314@xchg.fiss-oeaw.at] has joined #openvpn
08:42 < Ang3> ok - configuration of Tunnel blick - done :)
08:42 < Ang3> ok - configuration of Tunnel blick - done :)
08:42 < Ang3> but it seems like i got no internet connexion with this VPN :)
08:42 < bystander> guys how will I check that the openvpn service is down due to number of users.
08:43 < Ang3> check the log ,
08:43 < Ang3> ?
08:44 < ecrist> bystander: there's no such thing as 'down due to number of users'
08:44 < Ang3> lol
08:48 < Ang3> when my OpenVPN network will works ALL my app gotta connect to internet throw it rihgt? 
08:48 < Ang3> i mean my IRC client, Pidgin etc rtc ?
08:49 < ecrist> not really
08:49 < ecrist> depends on what you want to do 
08:49 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Ping timeout: 252 seconds]
08:49 < Ang3> use it as a proxy
08:50 < ecrist> then yes
08:50 < Ang3> ok
08:50 < Ang3> well, first i go t some isue with iptables i guess
08:50 < ecrist> !linnat
08:50 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
08:50 < Ang3> i conect to my serv but can't connect to Google throw it :)
08:50 < Ang3> woo thx !
08:52 < Ang3> gotta try the first one 
08:52 < Ang3> xavier@ks380744:~$ iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
08:52 < Ang3> iptables v1.4.4: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
08:52 < Ang3> Perhaps iptables or your kernel needs to be upgraded.
08:53 < Ang3> raaah
08:53 < amero> use SNAT
08:53 < amero> Ang3: openvz?
08:54 < Ang3> whats openvz?
08:54 < amero> are you setting up openvpn in VPS or dedicated server?
08:55 < Ang3> dedicated serv
08:57 < Ang3> why?
08:57 < amero> try the second one then if MASQUERADE doesn't work for you
09:02 < Ang3> hum maybe with a sudo no?
09:07 -!- Ang3 [~Ang@89-158-161-93.rev.dartybox.com] has quit [Ping timeout: 252 seconds]
09:11 -!- Ang3 [~Ang@ks380744.kimsufi.com] has joined #openvpn
09:16 < Ang3> works fine ! 
09:16 < Ang3> it's pretty 'transparent' all my connexion are encrypted and sent to the openvpn server? it's really nice :p
09:16  * Ang3 discover the beauty of a VPN !
09:17 -!- Ang3_ [~Ang@89-158-161-93.rev.dartybox.com] has joined #openvpn
09:21 < N0DEH> wooohoo i see kimsufi domain =P
09:21 -!- Ang3 [~Ang@ks380744.kimsufi.com] has quit [Ping timeout: 252 seconds]
09:21 -!- Ang3_ is now known as Ang3
09:26 < Ang3> N0DEH: ? 
09:26 < N0DEH> yo
09:26 < Ang3> yeah i did it 8)
09:26 < Ang3> ahaha
09:26 < N0DEH> cool =P
09:27 < Ang3> but it was fukin pain in the ass
09:27 < Ang3> :D
09:27 < N0DEH> u will get the hang of it
09:27 < N0DEH> =P
09:27 < Ang3> it's pretty transparent right ? 
09:27 < Ang3> the VPN take ALL your connection crypt it and send it to the serv
09:28 < Ang3> nothin more to do ?
09:29 < N0DEH> are u using redirect ?
09:30 < N0DEH> i mean this - push "redirect-gateway def1"
09:30 < Ang3> nop 
09:30 < N0DEH> this should be in your server conf file
09:30 < Ang3> only tunnelblick on macosX
09:31 < N0DEH> macos is ur client or server ?
09:31 < Ang3> client is tunnelblick
09:32 < Ang3> serv =openvpn
09:33 < N0DEH> ah
09:33 < N0DEH> so u should have that in ur serv
09:33 < N0DEH> nothing to do with the client
09:33 < N0DEH> =p
09:33 < Ang3> k
09:33 < N0DEH> putting that command will push the command to all connected clients
09:33 < N0DEH> to make their traffic routed to the serv
09:33 < N0DEH> but becareful
09:33 < Ang3> yes the redirect gateway is on
09:34 < N0DEH> u need to add routes and add iptables command
09:34 < N0DEH> serv is on openvpn access server ?
09:34 < Ang3> already done too :)
09:34 < Ang3> yes
09:34 < N0DEH> ah
09:34 < N0DEH> then that should be it
09:34 < Ang3> it's awesome :p
09:35 < N0DEH> haha 
09:36 -!- kyrix [~ashley@217.25.126.106] has quit [Ping timeout: 246 seconds]
09:37 -!- Ang3 [~Ang@89-158-161-93.rev.dartybox.com] has quit [Quit: Ang3]
09:45 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 255 seconds]
09:51 -!- kyrix [~ashley@217.25.126.106] has joined #openvpn
09:51 -!- Guest62135 is now known as Martin`
10:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:00 -!- MrNemus [~MrNemus@firewall.drgutah.com] has joined #openvpn
10:01 -!- luneff [~yury@188.114.45.166] has quit [Ping timeout: 240 seconds]
10:03 -!- shameem [~shameem@115.249.36.125] has quit [Ping timeout: 255 seconds]
10:11 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:11 -!- mode/#openvpn [+o raidz] by ChanServ
10:16 <@vpnHelper> RSS Update - forum: Some questions about client-to-client connections. <http://forums.openvpn.net/topic8359.html>
10:24 < MrNemus> so I am having some issues with iroutes
10:24 < MrNemus> and pfsense
10:31 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
10:37 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Quit: Leaving]
10:41 -!- Ang3 [~Ang@lib59-1-82-225-123-72.fbx.proxad.net] has joined #openvpn
10:41 -!- Ang3 [~Ang@lib59-1-82-225-123-72.fbx.proxad.net] has quit [Client Quit]
10:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:48 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
10:49 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Client Quit]
10:55 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
10:58 < MrNemus> what does this mean ?No Management Daemon
11:03 -!- luneff [~yury@188.114.45.166] has joined #openvpn
11:05 < star314> Weird, it seems that openvpn on my openwrt router ignores crl-verify, i.e., I can still establish a openvpn connection with a revoked certificate. :(
11:09 < star314> does openvpn on openwrt not support certificate revocation?
11:09 -!- luneff [~yury@188.114.45.166] has quit [Quit: Leaving]
11:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:19 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
11:26 -!- EugeneKaway is now known as EugeneKay
11:29 < gladiatr> star314, what log level are you running?
11:29 < star314> 9
11:29 < star314> the most annoying one ;)
11:29 < star314> gladiatr: ^^
11:30 < star314> It seems that this version of openwrt does not include support for crl-verify.
11:30 < gladiatr> lol.  I imagine 5 is probably as high as you would ever need to go.  So there's no reference to the crl-verify directive anywhere?  Not even in the config parsing section?
11:30 < gladiatr> what version are you running?
11:30 < gladiatr> I can't imagine someone going to the trouble of disabling a feature like that
11:31 < star314> Because if I add a line "crl-verify <this_file_does_not_exist>.crl " to my openvpn config, no error message in the openvpn log file appears.
11:31 < star314> when starting /etc/init.d/openvpn start
11:31 < star314> even a warning
11:32 < star314> even no warning
11:32 < gladiatr> but you've tried it with a CRL in place, though, right?
11:32 < star314> It seems that while parsing the openvpn config, the option "crl-verify" is ignored.
11:32 < star314> gladiatr: yes
11:32 < star314> right in place, world readable.
11:33 < gladiatr> what version of openwrt are you using?
11:33 < star314> OpenVPN 2.1.0 mips-openwrt-linux [SSL] [LZO2] built on Feb  
11:33 < star314> 9 2010
11:34 < gladiatr> what version of openwrt?
11:34 < gladiatr> should see it in /etc/banner
11:34 <@vpnHelper> RSS Update - forum: My ISP blocked OpenVPN <http://forums.openvpn.net/topic8335.html#p13233>
11:34 < star314> self compiled from svn a while ago around feb 2010.
11:35 < gladiatr> ah
11:35 < star314> hehe, I replaced /etc/banner with a custom one.
11:35  * star314 looks in /rom/etc/banner
11:35 < star314> bleeding edge, r19562
11:36 < star314> not very useful information
11:36 < gladiatr> So you compiled your packages as well?
11:36 < star314> yes, it is pretty easy. 
11:36 < star314> s/is/was on openwrt
11:37 < star314> just checkout from svn and make menuconfig
11:37 < star314> then enable everything you need and fire up make
11:38 < star314> In general, openvpn works very well on this openwrt router.
11:38 < star314> very stable but I haven't tried the stuff with the revocation list, until today.
11:39 < gladiatr> there are no build options for openvpn that would disable crl functionality
11:40 < star314> gladiatr: Even with log level 9 there is no message about parsing crl-verify in the logfile.
11:40 < star314> perhaps it is broken or more likely my abilities to configure it are broken. ;)
11:43 < gladiatr> So if you run: openssl crl -in crl.pem -text -noout |grep -i Serial
11:43 < gladiatr>  on your crl.pem file, you see the serial number of the certificate you're trying to revoke?
11:43 < star314> let me try
11:44 < star314> yes, Serial Number: 02
11:44 < star314> is the output
11:44 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
11:44 < gladiatr> and the file is in pem format?
11:45 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:45 < star314> Also the index file tells me that: "R	160625124501Z	110627125721Z	02	unknown	/C=AT/ST=VIE/O=netdummy/CN=dummy"
11:45 < star314> gladiatr: I guess yes, how can I check it?
11:46 < star314> The "R" in the index file states that this certificate has been revoked.
11:47 < star314> -----BEGIN X509 CRL----- <a lot of symbols> -----END X509 CRL-----
11:47 < star314> I guess that should be fine
11:47 < star314> for my crl file
11:47 < gladiatr> hrm... yup
11:48 < gladiatr> What's the output from: strings /usr/sbin/openvpn
11:49 < gladiatr> er
11:49 < gladiatr> wait
11:49 < gladiatr> What's the output from: strings /usr/sbin/openvpn | grep crl
11:50 < star314> crl_file
11:50 < star314> crl-verify
11:50 < star314> --crl-verify crl: Check peer certificate against a CRL.
11:50 < star314> gladiatr: ^^
11:51 < gladiatr> What's the output from: strings /usr/sbin/openvpn | grep -i crl
11:51 < gladiatr> might want to pastebin the output so you don't get kicked
11:52 < star314> gladiatr: http://pastebin.com/4tpwUpCA
11:52 < star314> shure
11:52 < star314> :)
11:52 < star314> The output is too long for irc :)
11:52 < star314> I don't want to get kicked.
11:53  * star314 looks at /etc/init.d/openvpn
11:55 < gladiatr> dunno, man.  I'd punt you over to #openwrt, but they're just going to tell you to install one of their releases.
11:56 < star314> gladiatr: thanks for the help
11:56 < gladiatr> np.  Sorry I could offer more of it :)
11:56 < gladiatr> gl
11:56 < gladiatr> s/ld/ld not/
11:56 -!- raidz1 [~Administr@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has joined #openvpn
11:57 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 255 seconds]
11:59 -!- raidz1 [~Administr@adsl-71-140-186-190.dsl.pltn13.pacbell.net] has quit [Client Quit]
11:59 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
11:59 -!- mode/#openvpn [+o raidz] by ChanServ
12:05 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
12:05 -!- mode/#openvpn [+o patelx] by ChanServ
12:06 -!- guifort [~guifort@129.116.98.84.rev.sfr.net] has joined #openvpn
12:23 -!- guifort [~guifort@129.116.98.84.rev.sfr.net] has quit [Quit: Quitte]
12:29 < star314> gladiatr: still here?
12:29 < star314> I found the bug
12:29 < gladiatr> what was it?
12:31 < star314> pretty nasty.
12:32 < star314> First, I took a look at the ps output and noted the process number. By means of cat /proc/<process_number>/cmdline I saw the arguments of openvpn.
12:32 < star314> there was no crl-verify option set.
12:33 < star314> Then I took a detailed look into /etc/init.d/openvpn and saw that in openwrt the option is named "crl_verify" and not "crl-verify"!
12:33 < star314> ARGGGHHHHHH
12:34 < gladiatr> wow.  that's really lame
12:34 < gladiatr> I imagine whoever pulled that one had a blazingly good explanation at the time he/she/it/they did it...
12:35 < star314> gladiatr: I don't know why, but in openwrt they replaced the dash by an underscore. :(
12:36 < star314> gladiatr: I guess it would be better for his or her health if I would never met him or her in person. ;)
12:37 < gladiatr> somethin' :)
12:40 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:40 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:43 <@vpnHelper> RSS Update - forum: Server authentication "hangs" <http://forums.openvpn.net/topic8342.html#p13234>
12:46 < star314> gladiatr: ok, time to go home. Thanks again for your support.
12:47 < gladiatr> np.  see ya 
12:48 -!- star314 [~star314@xchg.fiss-oeaw.at] has quit [Quit: Leaving]
13:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 244 seconds]
13:19 -!- K1ng` [~KING@180.211.188.91] has joined #openvpn
13:22 -!- K1ng [~KING@180.211.188.59] has quit [Ping timeout: 252 seconds]
13:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:33 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
13:34 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
13:59 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
14:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:09 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
14:22 -!- EugeneKay [~eugenekay@chaoschaoschaos.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
14:23 -!- EugeneKay [eugenekay@chaoschaoschaos.com] has joined #openvpn
14:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
14:31 -!- luneff [~yury@84.51.213.254] has joined #openvpn
14:36 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Read error: Operation timed out]
14:38 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
14:45 < ecrist> !as
14:45 <@vpnHelper> "as" is "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options
14:45 <@vpnHelper> supported which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
14:45 < ecrist> !forget as *
14:45 <@vpnHelper> Joo got it.
14:45 < ecrist> !as
14:46 < krzee> !AS
14:46 < krzee> !access-server
14:46 <@vpnHelper> "access-server" is (#1) OpenVPN Access Server (OpenVPN-AS) is a set of installation and maintenance tools which allow for simple and rapid deployment of VPN remote access solutions using OpenVPN open source software. The Access Server allows a network administrator to install and configure a VPN server as well as deploy remote clients., or (#2) There are a number of server configurations options supported
14:46 <@vpnHelper> which are a carefully selected subset of a quite large set of possible OpenVPN configurations. Only this subset of configurations is supported by the Access Server., or (#3) http://openvpn.net/index.php/access-server/download-openvpn-as.html to download, or (#4) go to http://openvpn.net/index.php/access-server/support-center.html for support
14:46 < ecrist> !learn as as OpenVPN Access Server (OpenVPN-AS) is a commercial product, support for which may be found at #openvpn-as or on the !forum.
14:46 <@vpnHelper> Joo got it.
14:46 < krzee> !forget access-server
14:46 <@vpnHelper> Error: 4 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
14:46 < krzee> !forget access-server *
14:46 <@vpnHelper> Joo got it.
14:47 < ecrist> :)
14:48 < EugeneKay> Needs more !vend
14:48 < krzee> more cowbell?
14:49 < EugeneKay> !beer
14:49 <@vpnHelper> "beer" is its what's for dinner!
14:49 < EugeneKay> Also the "its" is extraneous
14:49 < krzee> tru
14:49 < krzee> !forget beer
14:49 <@vpnHelper> Joo got it.
14:49 < EugeneKay> And !vend could be "Exact change only"
14:49 < EugeneKay> NOOOO DON'T FORGET THE BEER
14:49 < krzee> lol
14:52 -!- Irssi: #openvpn: Total of 144 nicks [6 ops, 0 halfops, 0 voices, 138 normal]
14:56 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
14:59 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
15:00 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Client Quit]
15:02 < krzee> i ended up not using the cyanogenmod vpn interface
15:02 < krzee> EugeneKay, im guessing on your phone where you used it, you dont use tls-auth...?
15:02 < krzee> i tried adding that via the "extra options" section, but no love
15:02 < krzee> so i just installed openvpn-settings and it was all good
15:03 < EugeneKay> I do not.
15:04 < EugeneKay> Like I said, it could use work :-p
15:05 < krzee> i dont get why it didnt work when i added the option throughj extra options
15:09 < krzee> although i have a guess that the patch for storing certs in the android cert store has to do with it...
15:19 < EugeneKay> Indeed.
15:20 < EugeneKay> Did you try adding the tls-auth key to the cert store?
15:23 < krzee> pointless, no place in the gui to add it to the config
15:24 < krzee> they would have had to specially patch tls-auth to pull it from the store
15:24 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
15:31 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Ping timeout: 260 seconds]
15:33 -!- norc [~foo@ns203763.ovh.net] has quit [Read error: Connection reset by peer]
15:37 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
15:38 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
15:40 < EugeneKay> You might be able to specify the key name in the custom options
15:40 < krzee> thats what i was just talking about
15:40 < EugeneKay> I mean, the key cert-store'd name
15:41 < krzee> ahh i see
15:42 < krzee> worth a shot i guess
15:42 < EugeneKay> I can't be arsed
15:47 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
15:53 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:54 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
16:00 -!- luneff [~yury@84.51.213.254] has quit [Quit: This computer has gone to sleep]
16:10 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
16:10 < s7r> can an openvpn server "listen" on ipv4 address and provide client with ipv6 address for browsing the internet ?
16:10 < krzee> yes
16:11 < krzee> --server and --server-ipv6 with the dev snapshot
16:11 < krzee> !snapshot
16:11 < krzee> !ipv6
16:11 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
16:11 < krzee> !snapshots
16:11 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
16:11 < s7r> krzee: thx
16:12 < krzee> yw
16:12 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
16:13 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 246 seconds]
16:20 <@vpnHelper> RSS Update - forum: Uninstall <http://forums.openvpn.net/topic8355.html#p13236> || Mac OPENVPN client <http://forums.openvpn.net/topic8357.html#p13235>
16:24 -!- kyrix [~ashley@217.25.126.106] has quit [Quit: Ex-Chat]
16:26 -!- dym [~patrick@netsplit.me] has quit [Ping timeout: 276 seconds]
16:27 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
16:31 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
16:50 -!- [intra]lanman [~lanman@c-98-250-105-93.hsd1.mi.comcast.net] has joined #openvpn
16:50 -!- [intra]lanman [~lanman@c-98-250-105-93.hsd1.mi.comcast.net] has quit [Changing host]
16:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:55 -!- N0DEH is now known as CripperZ
16:58 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:00 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 244 seconds]
17:00 -!- CripperZ [admin@ns3.cripperz.net] has quit [Read error: Connection reset by peer]
17:01 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
17:04 -!- greg_72 [~somebody@catv-89-133-19-22.catv.broadband.hu] has quit [Ping timeout: 240 seconds]
17:11 -!- N0DEH [admin@ns3.cripperz.net] has joined #openvpn
17:13 -!- N0DEH is now known as CripperZ
17:13 -!- CripperZ is now known as N0DEH
17:15 < krzee> !bestos
17:15 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
17:15 <@raidz> !debian
17:15 <@vpnHelper> "debian" is Although we are aware the Debian stable package repository has OpenVPN 2.1rc11, to offer support, we require users to run the current version of OpenVPN. See !download for information on where/how to obtain a recent release.
17:16 < krzee> oh nice!
17:16 < krzee> good factoid!
17:16 <@raidz> !centos
17:16 <@vpnHelper> "centos" is See !epel5
17:16 <@raidz> !epel5
17:16 <@vpnHelper> "epel5" is Please use the EPEL repository when installing OpenVPN on RHEL/CentOS: http://fedoraproject.org/wiki/EPEL/FAQ#How_can_I_install_the_packages_from_the_EPEL_software_repository.3F
17:17 < krzee> !windows
17:17 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
17:17 < krzee> ;]
17:17 <@raidz> hahahaha
17:17 < EugeneKay> !factoids
17:17 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
17:17 <@raidz> !backtrack
17:17 <@raidz> !ubuntu
17:17 <@vpnHelper> "ubuntu" is dont use network manager!
17:17 <@raidz> ^^^^
17:18 < krzee> !netman
17:18 <@raidz> Wicd ftw
17:18 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
17:22 -!- arejay [arejay@i.write.shellcode.eu] has quit [Ping timeout: 260 seconds]
17:23 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has quit [Ping timeout: 260 seconds]
17:23 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Quit: >:o]
17:24 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
17:24 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 260 seconds]
17:25 -!- arejay [arejay@i.write.shellcode.eu] has joined #openvpn
17:27 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:28 -!- nb [~nb@fedora/nb] has joined #openvpn
17:43 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Remote host closed the connection]
17:47 -!- zykes- [zykes@2001:470:28:3bc:beaf:da7e:1eaf:5af3] has joined #openvpn
17:50 < krzee> !vpnchains
17:50 < krzee> !vpnchain
17:50 < krzee> !factoids search chain
17:50 <@vpnHelper> No keys matched that query.
17:55 <@raidz> !route
17:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
19:09 -!- Dougy [me@openvpn/community/user/dougy] has quit [Read error: Connection reset by peer]
19:09 -!- Dougy [me@tech.qsi.net] has joined #openvpn
19:09 -!- Netsplit *.net <-> *.split quits: unspin, SJr, corretico, reiffert, blackpenguin, oc80z, sia^pwnnt, ele_
19:13 -!- Netsplit over, joins: unspin, oc80z, corretico, blackpenguin, sia^pwnnt, ele_, reiffert, SJr
19:13 -!- LBo [~LBo@cable-129-137.zeelandnet.nl] has quit [Excess Flood]
19:14 -!- LBo [~LBo@cable-129-137.zeelandnet.nl] has joined #openvpn
19:22 <@vpnHelper> RSS Update - forum: Accessing ALL subnets on LAN and routing outbound traffic <http://forums.openvpn.net/topic8360.html>
19:24 -!- raidz is now known as raidz_afk
19:28 <@vpnHelper> RSS Update - forum: Site to Site VPN with overlapping IP addresses <http://forums.openvpn.net/topic8362.html> || New Openvpn install and DNS is broken but good. <http://forums.openvpn.net/topic8361.html>
20:13 -!- master_of_master [~master_of@p57B55A34.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:15 -!- master_of_master [~master_of@p57B556F5.dip.t-dialin.net] has joined #openvpn
20:16 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
20:36 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
20:36 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Read error: Connection reset by peer]
20:37 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has joined #openvpn
20:47 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330-15.html#p13240>
20:52 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Quit: Going offline, see ya! (www.adiirc.com)]
20:53 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
21:20 -!- toortog [~toortog@notsecure.net] has quit [Quit: changing servers]
21:23 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has joined #openvpn
21:23 <@vpnHelper> RSS Update - forum: OpenVPN very slow - Less then 8KB/s <http://forums.openvpn.net/topic8227.html#p13241>
21:27 -!- toortog [~toortog@notsecure.net] has joined #openvpn
21:44 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has joined #openvpn
21:44 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has quit [Remote host closed the connection]
22:18 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:25 -!- mick_laptop [~mick@clamwin/admin/mickhome] has quit [Ping timeout: 240 seconds]
22:28 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has quit [Ping timeout: 260 seconds]
22:28 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
22:34 -!- mick_laptop [~mick@mickweiss.com] has joined #openvpn
22:43 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has quit [Ping timeout: 276 seconds]
22:47 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
23:24 -!- K1ng`` [~KING@180.211.188.91] has joined #openvpn
23:27 -!- K1ng` [~KING@180.211.188.91] has quit [Ping timeout: 244 seconds]
23:28 -!- Flecks [~fleck@unaffiliated/fleck] has quit [Ping timeout: 244 seconds]
23:29 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
23:39 -!- newmember [~newmember@S010600036d1139bb.cg.shawcable.net] has quit [Quit: Leaving]
--- Day changed Tue Jun 28 2011
00:34 -!- luneff [~yury@84.51.213.254] has joined #openvpn
00:41 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 246 seconds]
00:42 -!- norc [~foo@ns203763.ovh.net] has quit [Read error: Connection reset by peer]
00:42 -!- norc_ [~foo@ns203763.ovh.net] has joined #openvpn
00:44 -!- norc_ [~foo@ns203763.ovh.net] has quit [Read error: Connection reset by peer]
00:47 -!- norc [~foo@ns203763.ovh.net] has joined #openvpn
00:59 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:02 -!- luneff [~yury@84.51.213.254] has quit [Quit: Leaving]
01:17 <@vpnHelper> RSS Update - forum: Client unable to connect to server LAN's problematic host <http://forums.openvpn.net/topic8363.html>
01:21 -!- EugeneKay is now known as EugeneKaway
01:28 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
01:28 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
01:30 < bystander> good day guys. after I initiated the openvpn server service, I close the terminal.  What command will I make to bring back that terminal wherein you can see the activities going on in the openvpn service?
01:30 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:30 -!- K1ng`` [~KING@180.211.188.91] has quit [Ping timeout: 240 seconds]
01:31 -!- greg_72 [~somebody@catv-86-101-32-78.catv.broadband.hu] has joined #openvpn
01:31 < bystander> good day guys. after I initiated the openvpn server service, I close the terminal.  What command will I make to bring back that terminal wherein you can see the activities going on in the openvpn service?
01:34 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
01:50 -!- EugeneKaway is now known as EugeneKay
01:58 -!- norc [~foo@ns203763.ovh.net] has quit [Ping timeout: 250 seconds]
02:03 -!- luneff [~yury@188.114.45.166] has joined #openvpn
02:05 -!- arejay [arejay@i.write.shellcode.eu] has quit [Ping timeout: 255 seconds]
02:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
02:22 <@vpnHelper> RSS Update - forum: CRL Expiry Question <http://forums.openvpn.net/topic8364.html>
02:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:39 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
02:46 <@vpnHelper> RSS Update - forum: Client unable to connect to server LAN's problematic host <http://forums.openvpn.net/topic8363.html#p13244>
02:49 -!- luneff [~yury@188.114.45.166] has quit [Ping timeout: 255 seconds]
02:52 <@vpnHelper> RSS Update - forum: Some questions about client-to-client connections. <http://forums.openvpn.net/topic8359.html#p13245>
02:55 -!- luneff [~yury@188.114.45.166] has joined #openvpn
02:56 -!- kyrix [~ashley@217.25.126.106] has joined #openvpn
02:58 <@vpnHelper> RSS Update - forum: Accessing ALL subnets on LAN and routing outbound traffic <http://forums.openvpn.net/topic8360.html#p13247> || New Openvpn install and DNS is broken but good. <http://forums.openvpn.net/topic8361.html#p13246>
03:08 -!- EugeneKay is now known as EugeneKaway
03:16 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
03:24 -!- dazo_afk is now known as dazo
03:32 -!- dazo is now known as dazo_afk
03:34 <@vpnHelper> RSS Update - forum: OpenVPN slow down after switch change <http://forums.openvpn.net/topic8365.html>
03:46 <@vpnHelper> RSS Update - forum: Site to Site VPN with overlapping IP addresses <http://forums.openvpn.net/topic8362.html#p13249>
03:46 -!- nixbro [~unknown@59.163.254.66] has joined #openvpn
04:00 < nixbro> anyone here uses OpenVPN Access Server. I need some questions to ask before purchase it. their live chat never appeared on-line.
04:01 < nixbro> and i dropped email to sales people and didn't turn up
04:03 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
04:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:04 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:04 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:27 -!- dazo_afk is now known as dazo
04:32 -!- MrNemus [~MrNemus@firewall.drgutah.com] has quit [Read error: Connection reset by peer]
04:34 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13250>
04:36 -!- nixbro [~unknown@59.163.254.66] has quit [Ping timeout: 258 seconds]
04:39 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:47 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
04:47 < Mowee> Morning
04:47 < Mowee> Im trying to make a special configuration. I made it as use all ip traffic through the vpn
04:48 < Mowee> But now, I just want a tunnel, and the user use his own connection
04:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:49 < Mowee> Is it possible ? I know there's the line push "redirect-gateway def1" but I don't know what is needed in exchange
04:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:54 <@dazo> Mowee: from the man page:         --redirect-gateway flags...
04:54 <@dazo>               Automatically execute routing
04:54 <@dazo>               commands to cause all outgoing IP traffic  to
04:54 <@dazo>               be redirected over the VPN.
04:54 <@dazo> Mowee: so by removing --redirect-gateway, you get exactly what you want ... this is not a special config at all ... both routing Internet traffic via VPN or outside the VPN, are both very common configurations
04:55 < Mowee> Mhh
04:55 < Mowee> Weird, I tried to remove that line, but it doesnt work
04:56 < Mowee> dazo, here is my configuration: http://pastebin.com/Ep28LKhC
04:57 < Mowee> I have no internet access with this
04:57 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html>
04:57 <@dazo> Mowee: did you restart your openvpn server?  and make sure you don't have something similar in your client config as well (without the --push)
04:57 < Mowee> yep of course 
04:58 <@dazo> Mowee: pastebin your client config then ... you'll have to do something odd there then
04:59 < Mowee> dazo http://pastebin.com/nFJKN1ex
05:00 <@dazo> Mowee: odd ... can you pastebin client logs with --verb 4?
05:00 <@dazo> client config looks clean
05:02 < Bushmills> !firewall
05:02 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
05:02 < Bushmills> outgoing non-vpn traffic other than to vpn server public interface may be blocked
05:02 <@dazo> Bushmills: Can it be firewall issues if client looses internet connection unless --redirect-gateway def1 is configres?
05:03 < Bushmills> dazo: yes, possible
05:03 <@dazo> Unless I've misunderstood ... it works with --redirect-gateway ... but fails without
05:03 < Mowee> Yep you trully clearly understood
05:03 < Mowee> -trully
05:04 < Mowee> everything works, all the traffic ip goes through the vpn
05:04 <@dazo> yeah, if you have explicit firewall rules denying outgoing non-VPN traffic, true ... sounds rather odd
05:04 < Mowee> but my company asked to remove all the traffic, they just need a tunnel
05:05 <@dazo> Mowee: make sure to double check firewalls on clients then ... and then we'd need to see openvpn client logs (w/ --verb 4)
05:06 < Mowee> where are the log located on the client ?
05:07 < Bushmills> wherever you chose to put them
05:07 < Mowee> is the output ok?
05:08 < Bushmills> "remove all the traffic, they just need a tunnel"  - what's the tunnel without traffic through it good for?
05:09 < Bushmills> i mean, sole purpose of the tunnel can be to have traffic go through it. without traffic, you'd not need a tunnel
05:09 < Mowee> We have some roadwarriors from another countries
05:10 <@dazo> Bushmills: I've understood it as they want only "their own" traffic through the tunnel ... not the all the Internet traffic
05:10 < Mowee> They need to access to some of our local servers
05:10 < Mowee> Before, we were including all the traffic like http...
05:10 < Mowee> Now, we just need an access to our servers, they keep their own connections
05:11 < Bushmills> Mowee: remove  the redirect-gateway stuff,  then use  traceroute or mtr on client to figure out where your traffic goes through and to.
05:11 < Mowee> ok
05:12 < Bushmills> try with an ip adress and with a hostname, to see whether that makes any difference
05:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
05:17 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
05:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:25 < Mowee> Bushmills http://pastebin.com/vuyN9EUF
05:26 <@vpnHelper> RSS Update - forum: Network scope <http://forums.openvpn.net/topic8282-15.html#p13252>
05:26 < Bushmills> your problem doesn't seem to be your openvpn config
05:27 < Bushmills> in fact, i don't see any problem at all
05:28 < Mowee> well I don't know
05:28 < Bushmills> "Mowee: I have no internet access with this"   -  incorrect.      try:    ping 8.8.8.8
05:29 < Mowee> wep it works
05:29 < Mowee> dns problem then?
05:29 < Bushmills> no.
05:29 -!- nixbro [~unknown@59.163.254.66] has joined #openvpn
05:29 < Bushmills> free.fr was resolved, after all
05:30 < Mowee> yes
05:32 <@vpnHelper> RSS Update - forum: OpenVPN slow down after switch change <http://forums.openvpn.net/topic8365.html#p13254> || OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13253>
05:37 -!- luneff [~yury@188.114.45.166] has quit [Ping timeout: 258 seconds]
05:41 < Mowee> Im lost
05:42 < Bushmills> why? enjoy that your internet can be accessed 
05:42 -!- luneff [~yury@109.165.42.100] has joined #openvpn
05:43 < Mowee> so why can't I reach websites with browsers? é_è
05:43 < Bushmills> has nothing to do with openvpn.  maybe your proxy settings
05:43 < Mowee> and I can only ping ips, no hosts, its weird
05:44 < Mowee> I've a proxy on the port 80
05:44 < Mowee> I set the parameters on firefox
05:47 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
06:01 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:04 < amero> how to completely disable logging?
06:08 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
06:12 <@vpnHelper> RSS Update - forum: connection problems <http://forums.openvpn.net/topic8367.html>
06:15 < spike> what's the default format for an openvpn's private key? binary PEM?
06:17 -!- nixbro [~unknown@59.163.254.66] has quit [Quit: Leaving]
06:17 <@vpnHelper> RSS Update - forum: connection problems <http://forums.openvpn.net/topic8367.html#p13256>
06:22 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Quit: Bye]
06:25 -!- luneff [~yury@109.165.42.100] has quit [Ping timeout: 252 seconds]
06:27 < spike> seems like it's PEM base64
06:29 -!- N0DEH is now known as CripperZ
06:30 -!- luneff [~yury@109.165.112.232] has joined #openvpn
06:31 -!- DarthGandalf [~Vetinari@193.124.221.164] has joined #openvpn
06:31 -!- DarthGandalf [~Vetinari@193.124.221.164] has quit [Changing host]
06:31 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
06:35 <@vpnHelper> RSS Update - forum: OpenVPN slow down after switch change <http://forums.openvpn.net/topic8365.html#p13258> || OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13257>
06:39 -!- nixbro [~unknown@59.163.254.66] has joined #openvpn
06:44 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
06:45 -!- rommel092079 [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
06:46 < rommel092079> guys what command to check if openvpn service is still up
06:50 < reiffert> rommel092079: server or client side?
06:51 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
06:52 -!- rommel092079 [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Ping timeout: 252 seconds]
06:53 <@dazo> spike: depends on if you're talking about TLS keys/certs ... or the --secret/--tls-auth options ... the former is PEM, the latter is OpenVPN specific
06:56 < spike> dazo: the one generated by build-key, but looking at it it does seem to be PEM base64 encoded. I'm fighting with a fw that asks for binary or PKCS#7 encoding and I'm not sure how to do the conversion 
06:58 <@dazo> spike: try using 'openssl pkcs7' ....  that should be able to generate PKCS#7 encoded files from PEM
06:58 <@dazo> but yeah, build-key uses openssl to generate standard PEM files
06:59 < spike> yeah, was just looking at the manpage for that, thank you.
07:05 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13259>
07:05 -!- joel [~joel@81.Red-83-50-96.dynamicIP.rima-tde.net] has joined #openvpn
07:06 -!- joel is now known as Guest84177
07:06 -!- Guest84177 is now known as imdea
07:07 < imdea> Hi i have a openvpn server and in my openvpn-server.conf file i have some push route commands in order to add those route to the clients. This is working fine, but what i want right now, is that for a certain user those routes don't be loaded, anyone could help me with this? thanks
07:13 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:13 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:13 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:15 -!- nixbro [~unknown@59.163.254.66] has quit [Quit: Leaving]
07:15 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
07:17 <@vpnHelper> RSS Update - forum: OpenVPN slow down after switch change <http://forums.openvpn.net/topic8365.html#p13260>
07:22 < reiffert> !ccd
07:22 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
07:25 -!- luneff [~yury@109.165.112.232] has quit [Ping timeout: 240 seconds]
07:26 -!- CripperZ is now known as N0DEH
07:29 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13261>
07:31 -!- luneff [~yury@93.178.111.170] has joined #openvpn
07:35 <@vpnHelper> RSS Update - forum: connection problems <http://forums.openvpn.net/topic8367.html#p13263> || OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13262>
07:40 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
07:42 < ecrist> morning, peeps
07:47 <@vpnHelper> RSS Update - forum: connection problems <http://forums.openvpn.net/topic8367.html#p13265> || OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13264>
07:47 < N0DEH> evening
07:47 < N0DEH> =P
07:53 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13268> || OpenVPN slow down after switch change <http://forums.openvpn.net/topic8365.html#p13267>
07:59 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13269>
08:04 -!- luneff [~yury@93.178.111.170] has quit [Ping timeout: 255 seconds]
08:04 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13270>
08:11 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13271>
08:12 -!- luneff [~yury@139.50.117.87.donpac.ru] has joined #openvpn
08:23 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13272>
08:24 < havoc> are there any commodity home/SOHO wifi routers that support OpenVPN?
08:28 < amero> not many, unless you flush their stock firmware and install ddwrt
08:28 < havoc> and not a dd-wrt/open-wrt one
08:28 < havoc> ok
08:29 <@vpnHelper> RSS Update - forum: Client unable to connect to server LAN's problematic host <http://forums.openvpn.net/topic8363.html#p13275> || OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13274> || Allowing internet access via VPN <http://forums.openvpn.net/topic8368.html>
08:41 <@vpnHelper> RSS Update - forum: connection problems <http://forums.openvpn.net/topic8367.html#p13278> || Client unable to connect to server LAN's problematic host <http://forums.openvpn.net/topic8363.html#p13276>
08:44 -!- luneff [~yury@139.50.117.87.donpac.ru] has quit [Ping timeout: 252 seconds]
08:46 < havoc> I just told the guy to get a WRT54GL and put dd-wrt or OpenWRT on it
08:46 <@dazo> havoc: OpenWRT is the way to go ... dd-wrt is useful for those who don't care about security
08:47 <@vpnHelper> RSS Update - forum: Client unable to connect to server LAN's problematic host <http://forums.openvpn.net/topic8363.html#p13280>
08:47 < havoc> dazo: yeah, I tend to lean towards OpenWRT
08:48 < amero> :p
08:50 -!- luneff [~yury@188.114.56.172] has joined #openvpn
08:55 -!- luneff [~yury@188.114.56.172] has quit [Ping timeout: 252 seconds]
08:57 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
09:00 -!- luneff [~yury@109.165.19.3] has joined #openvpn
09:02 < ecrist> or, buy an old computer and throw BSD on there
09:02 < ecrist> or pfSense
09:11 <@vpnHelper> RSS Update - forum: connection problems <http://forums.openvpn.net/topic8367.html#p13281>
09:23 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366.html#p13282>
09:24 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
09:36 <@dazo> ecrist: it's easier to get acceptance from wife/girlfriend of a small slick looking device than "yet another computer box" ;-)
09:40 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 258 seconds]
09:45 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
09:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
09:54 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 276 seconds]
09:56 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
09:58 -!- EugeneKaway is now known as EugeneKay
09:59 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
10:01 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 240 seconds]
10:03 < ecrist> true, I suppose.
10:05 -!- brabo is now known as geekbilly
10:07 -!- geekbilly is now known as brabo
10:08 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:10 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:10 -!- mode/#openvpn [+o raidz] by ChanServ
10:11 -!- raidz_afk [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 255 seconds]
10:12 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 246 seconds]
10:14 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
10:16 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
10:16 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
10:17 -!- patel is now known as patelx
10:17 -!- patelx [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Changing host]
10:17 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
10:17 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
10:20 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:20 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:28 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 240 seconds]
10:30 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
10:35 < Bushmills> havoc:  netgear wndr3700, buffalo wzr g300n, tp-link wr1043nd  with openwrt are probably your best choices, with the buffalo being slightly smaller than the tp-link 
10:36 < havoc> thanks
10:37  * dazo got a tp-link wr1043nd and is very happy with it
10:37 < Bushmills> cpu of  netgear is a bit higher clocked, giving it a bit more perfomance for encryption 
10:38 <@dazo> Bushmills: how's the flash and RAM size=
10:38 <@dazo> ?
10:38 < Bushmills> first two  32/64,  latter  8/32 MiB
10:39 <@dazo> 32/64 is nice too
10:39 < Bushmills> 8 is just enough, for openssl, openwrt, some more.   
10:39 < Bushmills> openssl, openvpn, i mean
10:39 < Bushmills> got confused because of those many "open"
10:40 <@raidz> asus rt-n16 ftw!
10:40 <@dazo> yeah, but with 32MB flash you can really make do more fun stuff ...
10:40 < Bushmills> all have usb2, therefore easy to expand
10:40 <@dazo> mm
10:42 < Bushmills> raidz: rt-n16 isn't well supported
10:43 <@raidz> Bushmills: Well supported by who?
10:43 < Bushmills> openwrt
10:44 <@raidz> ahh, I use dd-wrt ;-)
10:44 < Bushmills> that's your problem :P
10:44 <@raidz> hahaha
10:45 <@dazo> raidz: dd-wrt is really not the safest options ... my experience is that the dd-wrt developers are rather ignorant to security issues
10:46 <@dazo> (they didn't care about alerting their users that it had hard coded IP addresses which opened up the router from the outside ... and they didn't see any problem that there now exists a database of SSH keys used on dd-wrt routers)
10:47 <@raidz> what?!?1
10:47 < Bushmills> makes it a great platform to run security focused software like openwrt on, grin
10:48 < Bushmills> grr... like openvpn, i mean
10:48 < EugeneKay> I'm a big fan of shotgun security. If you fuck with my network, I will chase you down with a shotgun.
10:49 <@raidz> ^^
10:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:51 <@dazo> raidz: yeah, it's a shame, but it really is true ... I can dig up some links if you want
10:52 <@raidz> dazo. if you have them handy please do. This is a let down :-(
10:52 <@raidz> dazo: Have you used Tomato before?
10:53 <@dazo> raidz: just briefly ... but Tomato got a lot of good recommendations 
10:53 <@vpnHelper> RSS Update - forum: connection problems <http://forums.openvpn.net/topic8367.html#p13283>
10:55 <@dazo> raidz: http://www.dd-wrt.com/phpBB2/viewtopic.php?p=517170#517296 ... looking up the iptables discussion
10:56 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 255 seconds]
10:59 <@dazo> raidz: the iptables discussion: http://www.dd-wrt.com/phpBB2/viewtopic.php?p=202590
11:03 <@raidz> thanks dazo.
11:04 <@dazo> yw!
11:08 <@raidz> dazo: is that you commenting on the hardcoded ip's threas?
11:09 <@raidz> *thread
11:09 <@dazo> raidz: yeah, I'm dazono in this thread
11:09 <@raidz> Thats what I suspected :-D
11:10 <@dazo> heh ... but there's another thread about the same issue, where the developers didn't care at all ... this thread got the heat ... 
11:11 -!- syn4pse [~syn@p5DDC08AF.dip0.t-ipconnect.de] has joined #openvpn
11:13 <@dazo> raidz: however, the way of responding to this thread is the same kind of argument the dd-wrt guys use on the "little black box" issue with the ssh key database .... "turn off login from outside, and you're safe", just being said in the forum and not making its users aware of the situation
11:13 <@raidz> I love BrainSlayers response dazo, he still shrugged it off saying the ip's wearn't "acive" anymore
11:13 <@raidz> *active
11:13 <@raidz> dazo: agreed
11:16 <@dazo> raidz: anyhow, I can strongly recommend openwrt ... much more transparent ... I first used X-wrt, which is openwrt + a webUI, before openwrt came with their own webUI ... however, with time I learnt how to do things without the webUI, so I saved some Kb of flash RAM kicking out the webUI
11:18 <@raidz> dazo, I will give that a shot this weekend, Bushmills said the Asus rt-n16 isn't really supported, is it just that there isn't a lot of community support around it or that openwrt just won't work on it?
11:18 -!- syn4pse- [~syn@rs17058.rapidspeeds.com] has joined #openvpn
11:19 <@dazo> hmmm ... I dunno, tbh ... Bushmills is more experienced than me, but this list is usually trustworthy: http://wiki.openwrt.org/toh/start#asus
11:20 <@raidz> thanks dazo
11:20 <@dazo> http://wiki.openwrt.org/inbox/asusrt-n16
11:20 <@raidz> yeah, still a wip
11:20 <@raidz> maybe I will give Tomato a go
11:21 <@dazo> it's due to close source firmware blobs, I see 
11:21 -!- syn4pse [~syn@p5DDC08AF.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
11:21 <@raidz> whoa, whats this debwrt I see?!
11:24 <@dazo> neat!  it even supports your router :)
11:24 <@raidz> yeah!
11:25 <@raidz> I am going to play with that, looks way cool!
11:25 <@dazo> it does indeed :)
11:33 -!- syn4pse- [~syn@rs17058.rapidspeeds.com] has quit [Quit: Verlassend]
11:34 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
11:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:56 < syn4pse> is there a way to trigger scripts on certain events like if some1 is connecting to the vpn ?
12:04 < krzie> !scripts
12:04 < krzie> !script
12:04 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
12:07 < syn4pse> ty
12:15 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 264 seconds]
12:15 -!- K1ng [~KING@180.211.188.41] has joined #openvpn
12:16 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
12:17 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
12:17 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
12:17 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Remote host closed the connection]
12:17 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
12:17 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
12:17 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
12:19 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
12:24 -!- luneff [~yury@109.165.19.3] has quit [Quit: This computer has gone to sleep]
12:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:38 -!- EugeneKay is now known as EugeneKaway
12:39 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:41 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:41 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:48 < syn4pse> !ccd
12:48 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
12:49 -!- dazo is now known as dazo_afk
12:49 -!- EugeneKaway is now known as EugeneKay
12:55 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
13:04 -!- Chubbz [~Will@unaffiliated/chubbz] has joined #openvpn
13:04 -!- Chubbz [~Will@unaffiliated/chubbz] has left #openvpn ["Leaving."]
13:06 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
13:12 <@vpnHelper> RSS Update - forum: OpenVPN on AWS EC2 gives Error Code 1232 (Transmit Failed) <http://forums.openvpn.net/topic8172.html#p13284>
13:34 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
13:35 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
13:35 -!- Cain` is now known as Cain
13:46 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
13:50 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
13:54 <@vpnHelper> RSS Update - forum: OpenVPN on AWS EC2 gives Error Code 1232 (Transmit Failed) <http://forums.openvpn.net/topic8172.html#p13285>
13:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:17 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 258 seconds]
14:19 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
14:21 -!- imdea [~joel@81.Red-83-50-96.dynamicIP.rima-tde.net] has quit [Read error: Connection reset by peer]
14:27 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 250 seconds]
14:32 -!- luneff [~yury@84.51.213.254] has joined #openvpn
14:41 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
14:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
15:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:06 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:12 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:12 <@vpnHelper> RSS Update - forum: Moving an openvpn server <http://forums.openvpn.net/topic8369.html>
15:12 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:30 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
15:33 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
15:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:34 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
15:35 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
15:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:41 -!- StephenS [~diewugf@unaffiliated/stephens] has joined #openvpn
15:41 < StephenS> is it possible to connect openVPN with my private VPS server?
15:53 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
15:57 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
15:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
16:02 -!- SWAT [~swat@ubuntu/member/swat] has quit [Ping timeout: 246 seconds]
16:03 -!- jgz [~jgz@67-134-149-68.dia.static.qwest.net] has joined #openvpn
16:04 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
16:05 < EugeneKay> Sure.
16:05 < EugeneKay> Depending upon the type of virtualization technology, anyway
16:09 < StephenS> openvz?
16:09 < StephenS> I just bought a VPS server :D
16:10 -!- pa [~pa@unaffiliated/pa] has quit [Remote host closed the connection]
16:10 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
16:11 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:13 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 264 seconds]
16:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:14 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Read error: Operation timed out]
16:18 <@raidz> StephenS: You need to make sure they give you access to the TUN adapter
16:18 <@vpnHelper> RSS Update - forum: New Openvpn install and DNS is broken but good. <http://forums.openvpn.net/topic8361.html#p13287>
16:21 -!- raidz [~Administr@openvpn/corp/admin/andrew] has left #openvpn []
16:21 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
16:21 -!- mode/#openvpn [+o raidz] by ChanServ
16:23 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
16:26 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has joined #openvpn
16:28 -!- murad_ [29ea7367@gateway/web/freenode/ip.41.234.115.103] has joined #openvpn
16:29 < murad_> hi all 
16:29 < murad_> can any one here help me in OpenVpn?
16:31 -!- karl370 [~karl@12.139.131.2] has joined #openvpn
16:33 < karl370> !welcome
16:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:39 < Bushmills> unlikely
16:39 < Bushmills> unless ...
16:40 < Bushmills> !firewall
16:40 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
16:40 -!- karl370 [~karl@12.139.131.2] has quit [Quit: Leaving]
16:45 -!- murad_ [29ea7367@gateway/web/freenode/ip.41.234.115.103] has quit [Quit: Page closed]
16:55 <@vpnHelper> RSS Update - forum: OpenVPN - bugging the internet, especially google <http://forums.openvpn.net/topic8304.html#p13288>
16:57 -!- SWAT [~swat@ubuntu/member/swat] has joined #openvpn
16:57 <@raidz> run!
16:58 < N0DEH> lolx
16:59 -!- N0DEH is now known as N00D
16:59 -!- N00D is now known as CripperZ
16:59 -!- kyrix [~ashley@217.25.126.106] has quit [Quit: Ex-Chat]
17:00 -!- CripperZ is now known as N0DEH
17:00 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:16 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
17:25 <@vpnHelper> RSS Update - forum: New Openvpn install and DNS is broken but good. <http://forums.openvpn.net/topic8361.html#p13289>
17:33 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:02 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 255 seconds]
18:10 -!- corretico_ [~luis@186.176.7.194] has quit [Ping timeout: 276 seconds]
18:12 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 244 seconds]
18:13 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:27 -!- StephenS is now known as stehd
18:29 -!- stehd [~diewugf@unaffiliated/stephens] has quit []
18:41 -!- StephenS [~steph@unaffiliated/stephens] has joined #openvpn
18:41 < StephenS> ok how to conect openvpn to my VPS centos server?
18:44 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:44 < StephenS> im following some tut so..
18:50 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
18:54 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
19:06 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
19:09 -!- raidz1 [~Administr@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
19:09 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
19:10 -!- raidz1 [~Administr@50-76-49-94-ip-static.hfc.comcastbusiness.net] has left #openvpn []
19:10 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 255 seconds]
19:10 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
19:11 -!- mode/#openvpn [+o raidz] by ChanServ
19:11 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 276 seconds]
19:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:14 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
19:25 -!- raidz is now known as raidz_afk
19:31 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
19:32 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
19:34 < StephenS> im connected to VPN but it seems lik enon working
19:34 < StephenS> non working.. :S
19:40 -!- StephenS is now known as StephenS|off
19:47 < krzie> define "non working"
19:47 < krzie> !goal
19:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:55 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
19:55 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:55 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:00 -!- corretico_ [~luis@186.176.7.194] has quit [Remote host closed the connection]
20:12 -!- master_of_master [~master_of@p57B556F5.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:16 -!- master_of_master [~master_of@p57B53737.dip.t-dialin.net] has joined #openvpn
20:16 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:22 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:23 -!- EugeneKay is now known as EugeneKaway
20:29 -!- K1ng` [~KING@180.211.188.41] has joined #openvpn
20:30 -!- EugeneKaway is now known as EugeneKay
20:32 -!- K1ng [~KING@180.211.188.41] has quit [Ping timeout: 255 seconds]
20:51 <@vpnHelper> RSS Update - forum: Ubuntu9 I386 64 bit file for OpenVPN <http://forums.openvpn.net/topic8370.html>
21:12 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:16 <@vpnHelper> RSS Update - forum: OpenVPN on AWS EC2 gives Error Code 1232 (Transmit Failed) <http://forums.openvpn.net/topic8172.html#p13291>
21:35 < ecrist> evening, bitches
21:39 -!- You're now known as ecrist_away
21:39 -!- You're now known as ecrist
21:41 -!- piss_ant [~webchat@webchat.openvpn.net] has joined #openvpn
21:43 < ecrist> neato
21:43  * piss_ant slaps ecrist around a bit with a large fishbot
21:50 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:50 < ecrist> sup gyyrog?
21:52 <@vpnHelper> RSS Update - forum: Client unable to connect to server LAN's problematic host <http://forums.openvpn.net/topic8363.html#p13292>
21:54 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 240 seconds]
21:55 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
21:55 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:02 < ecrist> sup mo' fo'
22:03 < gyyrog> oh, not much
22:03 < gyyrog> where do I look to automate the startup of an openvpn service on a centos machine?
22:06 < krzee> whatever scripts your OS uses for service starting
22:07 < EugeneKay>  /etc/init.d/openvpn
22:08 < EugeneKay> Installing openvpn from the epel/rpmforge repos will provide the necessary startup scripts
22:08 < ecrist> generally, yes
22:08 < EugeneKay> If it isn't in /etc/init.d on a Red Hat variant like CentOS, urdoinitrong ;-)
22:09 -!- EugeneKay is now known as iPhone4
22:09 -!- iPhone4 is now known as EugeneKay
22:10 -!- piss_ant [~webchat@webchat.openvpn.net] has quit [Quit: Page closed]
22:19 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 276 seconds]
22:20 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Read error: Connection reset by peer]
22:26 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
22:40 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:44 <@vpnHelper> RSS Update - forum: howtogeek.com OpenVPN / Tomato tutorial <http://forums.openvpn.net/topic8371.html>
22:58 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 246 seconds]
22:59 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:59 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:03 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
23:03 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:08 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
23:13 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
23:21 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:21 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:30 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
23:30 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:34 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
23:47 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
23:53 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 260 seconds]
23:57 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
--- Day changed Wed Jun 29 2011
00:02 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 240 seconds]
00:03 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Read error: Operation timed out]
00:04 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
00:04 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
00:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
00:06 -!- mode/#openvpn [+o mattock] by ChanServ
00:09 -!- Netsplit *.net <-> *.split quits: N0DEH
00:09 -!- Netsplit over, joins: N0DEH
00:36 -!- EugeneKay is now known as EugeneKaway
00:45 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 276 seconds]
01:00 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
01:06 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 250 seconds]
01:12 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
01:19 -!- EugeneKaway is now known as EugeneKay
01:23 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:31 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
01:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
02:12 -!- dazo_afk is now known as dazo
02:13 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 252 seconds]
02:19 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has quit [Ping timeout: 276 seconds]
02:22 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
02:24 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
02:24 <@vpnHelper> RSS Update - forum: Client unable to connect to server LAN's problematic host <http://forums.openvpn.net/topic8363.html#p13294>
02:31 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366-15.html#p13296> || New Openvpn install and DNS is broken but good. <http://forums.openvpn.net/topic8361.html#p13295>
02:37 <@vpnHelper> RSS Update - forum: Moving an openvpn server <http://forums.openvpn.net/topic8369.html#p13299> || Ubuntu9 I386 64 bit file for OpenVPN <http://forums.openvpn.net/topic8370.html#p13298> || connection problems <http://forums.openvpn.net/topic8367.html#p13297>
02:38 -!- kyrix [~ashley@217.25.126.106] has joined #openvpn
02:49 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366-15.html#p13300>
02:49 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 252 seconds]
02:49 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
02:55 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 252 seconds]
02:55 < Mowee> Morning
03:00 < EugeneKay> Is that what time this is? I should sleep.
03:07 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366-15.html#p13301>
03:13 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
03:20 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 244 seconds]
03:22 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 250 seconds]
03:31 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366-15.html#p13302>
03:37 <@vpnHelper> RSS Update - forum: OpenVPN installation and configuration on Centos and Windows <http://forums.openvpn.net/topic8366-15.html#p13303>
03:41 -!- EugeneKay is now known as EugeneKaway
03:58 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
03:58 -!- kyrix [~ashley@217.25.126.106] has quit [Quit: Ex-Chat]
04:05 -!- spike [~spike@unaffiliated/spike] has left #openvpn ["bbl"]
04:06 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 252 seconds]
04:10 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
04:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
04:13 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
04:16 -!- luneff [~yury@84.51.213.254] has quit [Quit: This computer has gone to sleep]
04:30 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
04:30 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:30 -!- mode/#openvpn [+o mattock] by ChanServ
04:38 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
04:38 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
04:42 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Client Quit]
04:42 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
04:45 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:45 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:45 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:52 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 240 seconds]
04:54 -!- luneff [~yury@109.165.19.3] has joined #openvpn
04:57 <@vpnHelper> RSS Update - forum: From School To Home Server (VMs) <http://forums.openvpn.net/topic8330-15.html#p13304>
04:58 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
05:03 <@vpnHelper> RSS Update - forum: Accessing other subnets with bridged connection <http://forums.openvpn.net/topic8372.html>
05:07 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 276 seconds]
05:08 -!- luneff [~yury@109.165.19.3] has quit [Ping timeout: 246 seconds]
05:14 -!- luneff [~yury@109.165.19.3] has joined #openvpn
05:14 <@vpnHelper> RSS Update - forum: Accessing other subnets with bridged connection <http://forums.openvpn.net/topic8372.html#p13306>
05:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
05:26 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
05:30 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:30 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:30 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:55 <@vpnHelper> RSS Update - forum: OpenVPN slow down after switch change <http://forums.openvpn.net/topic8365.html#p13307>
05:58 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
06:06 -!- wangerin [~testing-3@dkpix.brightpoint.dk] has quit [Remote host closed the connection]
06:07 <@vpnHelper> RSS Update - forum: OpenVPN slow down after switch change <http://forums.openvpn.net/topic8365.html#p13308>
06:23 -!- ujjain [~ujjain@unaffiliated/ujjain] has joined #openvpn
06:23 < ujjain> Is it possible to have only windows shares go via VPN?
06:29 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 240 seconds]
06:40 -!- JWM1 [~joseph.ma@static-209-195-165-146.consolidated.net] has joined #openvpn
06:42 < JWM1> !welcome
06:42 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:42 < JWM1> !goal
06:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:44 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
06:46 -!- JWM1 [~joseph.ma@static-209-195-165-146.consolidated.net] has left #openvpn []
06:46 -!- void_pointer [~Smiffy@unaffiliated/void-pointer/x-0665301] has joined #openvpn
06:53 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
06:57 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
06:58 -!- katsuflix [~katsuflix@LRouen-152-81-9-90.w80-13.abo.wanadoo.fr] has joined #openvpn
07:00 -!- K1ng` [~KING@180.211.188.41] has quit [Ping timeout: 264 seconds]
07:00 -!- void_pointer [~Smiffy@unaffiliated/void-pointer/x-0665301] has quit [Quit: Leaving]
07:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:01 <@vpnHelper> RSS Update - forum: error connecting to the second VPN client on the same host <http://forums.openvpn.net/topic8373.html>
07:03 < ujjain> JWM1 thanks!
07:03 < ujjain> I want to use a Windows share that is hosted in the datacenter, without hogging up bandwidth (e.g. torrents)
07:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
07:07 <@vpnHelper> RSS Update - forum: error connecting to the second VPN client on the same host <http://forums.openvpn.net/topic8373.html#p13310>
07:08 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
07:10 < greg_72> hi there, how can I change my openvpn server's hostname?
07:11 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 240 seconds]
07:11 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
07:12 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Read error: Operation timed out]
07:13 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Read error: Operation timed out]
07:13 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has quit [Read error: Connection reset by peer]
07:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:14 -!- jetole [~jetole@irc.fossl.net] has joined #openvpn
07:14 -!- buntfalke [~nobody@openvpn-p0-ipv6-1078.triple-a.uni-kl.de] has joined #openvpn
07:14 -!- buntfalke [~nobody@openvpn-p0-ipv6-1078.triple-a.uni-kl.de] has quit [Changing host]
07:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:14 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
07:15 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 258 seconds]
07:16 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
07:16 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 246 seconds]
07:16 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
07:17 -!- Perun_ [perun@chao5.net] has quit [Ping timeout: 240 seconds]
07:17 -!- Perun [perun@chao5.net] has joined #openvpn
07:19 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
07:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:19 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
07:19 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
07:22 -!- StephenS|off is now known as StephenS
07:22 -!- jetole [~jetole@irc.fossl.net] has quit [Ping timeout: 252 seconds]
07:26 <@vpnHelper> RSS Update - forum: VPN clients cannot ping to each other <http://forums.openvpn.net/topic8350.html#p13311>
07:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
07:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:40 < Bushmills> greg_72: you read and follow the manual of its operating system
07:40 < greg_72> Bushmills: so it is not an openvpn config problem, I see
07:40 < Bushmills> unless you're reverse-dns'ing its name from the ip address
07:41 < Bushmills> well, even then it's not an openvpn issue
07:44 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 246 seconds]
07:44 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
07:48 -!- StephenS [~steph@unaffiliated/stephens] has quit [Ping timeout: 276 seconds]
07:51 -!- katsuflix [~katsuflix@LRouen-152-81-9-90.w80-13.abo.wanadoo.fr] has quit [Quit: leaving]
08:02 <@vpnHelper> RSS Update - forum: New Openvpn install and DNS is broken but good. <http://forums.openvpn.net/topic8361.html#p13312>
08:04 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
08:07 <@vpnHelper> RSS Update - forum: How to backup and restore openvpn config and certificates <http://forums.openvpn.net/topic8374.html>
08:14 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
08:15 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
08:26 <@vpnHelper> RSS Update - forum: How to backup and restore openvpn config and certificates <http://forums.openvpn.net/topic8374.html#p13314>
08:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:48 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
08:50 -!- hermanon [~Earth@31.9.77.81] has joined #openvpn
08:51 < hermanon> Hello, when i start open vpn i get :Autostartins g VPN 'openvpn'  [fail] .how to see whats wrong?
08:57 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
08:57 -!- luneff [~yury@109.165.19.3] has quit [Ping timeout: 240 seconds]
09:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
09:00 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
09:02 -!- luneff [~yury@109.165.8.151] has joined #openvpn
09:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:03 < Bushmills> hermanon: log file.  tell openvpn to write one
09:05 < hermanon> good idea, thanks :)
09:07 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
09:07 -!- mode/#openvpn [+o mattock] by ChanServ
09:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:13 < hermanon> how to enable ipv4 forwording? to use my server as a gateway?
09:14 -!- You're now known as _torch_n_rope_
09:14 -!- You're now known as ecrist
09:19 <@dazo> !howto
09:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:20 <@dazo> hermanon: ^^ 
09:21 -!- beshoo [~linada@184.107.41.100] has joined #openvpn
09:21 < beshoo> hi all
09:22 < beshoo> where can i download openvpn which has no user limit
09:22 < Bushmills> !redirect
09:22 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
09:22 < ecrist> !download
09:22 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
09:22 < Bushmills> beshoo: openvpn doesn't have user limits
09:22 < beshoo> i have to buy licince
09:22 < beshoo> i need tyo free one 
09:22 < Bushmills> access server may have, but that's not supported here
09:22 < Bushmills> !as
09:23 < beshoo> I have installed openvpn with their free 2 users license.
09:23 < Bushmills> read what i just said
09:23 < beshoo> i need more than 2 users
09:23 < beshoo> aha 
09:24 < beshoo> so what is your advice .. i read some thing that there is a GPL version available on the "Community Software"
09:24 < Bushmills> use openvon
09:24 < Bushmills> openvpn
09:24 < Bushmills> or buy access server licenses
09:24 < hermanon> I can't find the confingurations for that, i'am getting to internet access on windows :)
09:25 < Bushmills> !redirect
09:25 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
09:25 < Bushmills> hermanon: ^^^
09:25 < beshoo> may you give me the openvpn download link , it seem i did download the "OpenVPN Access Server"
09:26 < Bushmills> !download
09:26 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
09:28 < hermanon> thanks :)
09:28 < hermanon> !def1
09:28 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
09:28 < hermanon> !ipforward
09:28 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
09:29 < hermanon> !linipforward
09:29 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
09:31 -!- beshoo [~linada@184.107.41.100] has quit [Ping timeout: 260 seconds]
09:49 < hermanon> !ىشف
09:49 < hermanon> !dns
09:49 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
09:49 < hermanon> !nat
09:49 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
09:50 < hermanon> !linnat
09:50 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
09:52 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Read error: Connection reset by peer]
09:57 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:57 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
10:00 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:02 -!- EugeneKaway is now known as EugeneKay
10:05 -!- Nekro [~edino@200.20.109.3] has joined #openvpn
10:18 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
10:19 < s7r> guys anyway to log what vpn clients are doing inside the vpn ?
10:20 < s7r> if i am administrator of the vpn server and the clients route all their internet traffic through the vpn
10:20 < s7r> than can I log / intercept their online passwords, etc. ?
10:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:21 < EugeneKay> Sure. Just tcpdump your end of the tunnel
10:22 < EugeneKay> Or have clients use a proxy to get out to the internet
10:23 < gladiatr> s7r, only if the protocols they're using over the vpn are uncrypted.
10:23 < gladiatr> s/un/unen
10:24 < EugeneKay> I'll allow "uncrypted" as well.
10:24 < ecrist> perl: invalid syntax
10:28 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
10:31 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
10:31 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:37 < greg_72> hi there, I have openvpn-as on my ubuntu server, and want to set up a certificate to enable real https communication on accessing it. I followed  https://help.ubuntu.com/community/OpenVPN#Generating Certificates but upon restarting openvpn it failed. I could not find a log which would tell me more than just failed. Where can I find it?
10:37 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
10:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
10:48 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:50 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 250 seconds]
10:50 < ecrist> !as
10:51 < ecrist> greg_72: go to #openvpn-as
10:51 < EugeneKay> !access
10:51 < ecrist> !learn as as OpenVPN Access Server support is in #openvpn-as
10:51 <@vpnHelper> Joo got it.
10:51 < ecrist> !as
10:51 < EugeneKay> Hrm, I remember seeing it changed, but I miss what too
10:51 < EugeneKay> to*
10:51 < ecrist> !factoid as
10:51 < EugeneKay> Or maybe the bot is just retarded
10:51 < ecrist> !factoid search as
10:51 < ecrist> !factoids search as
10:51 <@vpnHelper> 'ask', 'winpass', 'pastebin', '2.1-winpass-script', 'easy-rsa-unix', 'broadcast-relay', 'authpass', 'paste', 'nopaste', 'password-only', 'bcast', 'basic', 'strip-passphrase', 'change-passphrase', 'enable-passwd-save', 'release-notes', and 'no_as'
10:52 < ecrist> looks like I'll need to man-handle the bot later
10:52 < EugeneKay> !factoids search access
10:52 <@vpnHelper> No keys matched that query.
10:52 < ecrist> !learn access-server as OpenVPN Access Server support is in #openvpn-as
10:52 <@vpnHelper> Joo got it.
10:52 < ecrist> !access-server
10:52 <@vpnHelper> "access-server" is OpenVPN Access Server support is in #openvpn-as
10:53 -!- ChanServ changed the topic of #openvpn to: OpenVPN 2.2.0 most current, released 26-Apr-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: https://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly. || Host Cloaks available, just ask for one. | Access Server support in #openvpn-as
10:53 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 240 seconds]
10:55 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 252 seconds]
10:55 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
10:58 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
11:00 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
11:05 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
11:12 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
11:15 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 259 seconds]
11:19 <@dazo> !as
11:21 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:23 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
11:26 -!- hermanon [~Earth@31.9.77.81] has quit [Quit: Leaving.]
11:26 -!- hermanon [~Earth@31.9.77.81] has joined #openvpn
11:26 -!- hermanon [~Earth@31.9.77.81] has left #openvpn []
11:41 -!- luneff [~yury@109.165.8.151] has quit [Quit: Leaving]
11:43 < s7r> EugeneKay: sorry I wasn't at my desk somebody came by.
11:43 < s7r> so you suggest that if the vpn client is viewing a secure website e.g. gmail com (https)
11:43 < s7r> i can not intercept his password even if i am the administrator of the vpn server?
11:43 < EugeneKay> Correct. That's how SSL works.
11:44 < EugeneKay> You can, with the proper certificate installed in the client's browser, do SSL proxying.
11:44 < EugeneKay> But that takes some serious setting-up
11:44 < s7r> yes and still the browser of client will tell him
11:45 < s7r> HEY smth wrong bla bla
11:45 < EugeneKay> <EugeneKay> You can, with the proper certificate installed in the client's browser, do SSL proxying.
11:45 < s7r> as the certs will be self signed
11:45 < EugeneKay> Custom CA cert in the client + automatic cert re-signing by your server
11:45 < EugeneKay> You'll lose the EV bar unless you recompile the client's browser with your EV cert, though
11:46 < s7r> thanks for all this. i don't wanna waste your time with details. bottom line .. will the client notice anything
11:46 < s7r> i mean will the browser tell him that there's something wrong with cert?
11:46 < EugeneKay> If you install your CA cert in the browser, nope.
11:46 < EugeneKay> But that is a bitch of a thing to setup properly 
11:47 < s7r> in "the browser" you mean client's browser? :D
11:47 < EugeneKay> Yes.
11:47 < s7r> ahh not possible
11:47 < s7r> i thought so
11:47 < EugeneKay> Then you're SOL. 
11:47 < s7r> client is thousands of km away
11:47 < s7r> :))
11:47 < s7r> not even in the same country
11:48 < s7r> not even on the same continent
11:48 < s7r> but thanks for explaining anyway
11:48 < s7r> i always wondered if the SSL connection while you are on vpn is encrypted between the site and vpn server or between site and your computer
11:48 < s7r> looks like SSL encryption goes through the vpn
11:48 < EugeneKay> SSL/TLS is always between your browser and the end-server.
11:49 < EugeneKay> OpenVPN just sees SSL-encrypted packets, same as every router along the way
11:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:53 -!- Karl370 [4caaecac@gateway/web/freenode/ip.76.170.236.172] has joined #openvpn
12:07 < Karl370> Hello All.  I was hoping to get a little help in troubleshooting what's wrong with my site-to-site openvpn setup.  I'm using dd-wrt on both routers and have followed this link: http://www.dd-wrt.com/wiki/index.php/VPN_%28the_easy_way%29_v24%2B but I keep gettting this error on my client router: 06-29-2011	09:56:41	Daemon.Error	192.168.2.1	Jun 29 09:56:40 openvpn[8553]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
12:07 <@vpnHelper> Title: VPN (the easy way) v24+ - DD-WRT Wiki (at www.dd-wrt.com)
12:08 < EugeneKay> Firewall.
12:09 < Karl370> Firewall...could you elaborate just a little? Are you saying the firewall on the server / client is blocking the connection from being established?
12:10 < EugeneKay> No, your logs say that. I'm interpreting. ;-)
12:12 < Karl370> ok, could you dumb it down for me, cuz I'm just not getting it.  That message was being generated on my client side. I don't see any messages at all on the server side. Does that mean that it's being blocked on the way out (from the client)?
12:16 < EugeneKay> It means the server's firewall is preventing the packets from even getting to OpenVPN
12:16 < EugeneKay> (although it could be he client's outbound firewall, or something in between, server's is the most likely)
12:17 < Karl370> This is what I have setup for the server firewall: Firewall  iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT iptables -I FORWARD 1 --source 192.168.1.0/24 -j ACCEPT iptables -I FORWARD -i br0 -o tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
12:18  * EugeneKay is not one to debug that sort of specifics
12:18 -!- dazo is now known as dazo_afk
12:20 < ecrist> we're not a firewall troubleshooting channel
12:20  * ecrist points to /topic
12:29 -!- EugeneKay is now known as EugeneKaway
12:30 -!- krzie [krzee@hemp.ircpimps.org] has joined #openvpn
12:30 -!- krzie [krzee@hemp.ircpimps.org] has quit [Changing host]
12:30 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
12:34 -!- jgz [~jgz@67-134-149-68.dia.static.qwest.net] has quit [Quit: Ex-Chat]
12:35 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
12:42 -!- EugeneKaway is now known as EugeneKay
12:49 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 255 seconds]
12:57 -!- unixnuub [~bryan@217.158.182.108] has joined #openvpn
12:58 < unixnuub> !welcome !goal proxy port 80 on server to port 8080 on client
12:59 < EugeneKay> Iptables.
12:59 < unixnuub> yep been there a couple of 8 hour stints
12:59 < EugeneKay> Urdoinitrong
12:59 < unixnuub> get syn coming down 
12:59 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
13:00 < unixnuub> but packets seem to disapear
13:00 < unixnuub> got wireshark running and iptables -L .. in console 
13:00 < EugeneKay> /topic: || Your problem is your firewall, really. ||
13:00 < unixnuub> set up prerouting and postrouting on server 
13:00 < EugeneKay> Somewhere, somehow, urdoinitrong.
13:01 < unixnuub> I'm sure it is my firewall
13:01 < unixnuub> of that I'm clear 
13:01 < unixnuub> wondering if anyone else has been there 
13:01 < EugeneKay> Nope.
13:01 < unixnuub> got any recipes?
13:01 < EugeneKay> I have a few for homemade TNT....
13:01 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
13:01 < krzie> this isnt the best channel for getting help with iptables... #iptables might be better
13:03 < unixnuub> OK, thought people might have an angle on the iptables/openvpn interaction. 
13:03 < krzie> well theres a section of the manual that has some iptables stuff
13:03 < unixnuub> oh yeah 
13:03 < unixnuub> lemme take a peek there
13:03 < krzie> !man
13:03 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
13:04 < unixnuub> I'm 2.1 gonna peek
13:06 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
13:13 -!- visinix007_ [~anonymous@75-145-179-110-Illinois.hfc.comcastbusiness.net] has joined #openvpn
13:13 < visinix007_> !welcome
13:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:14 < visinix007_> !howto
13:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:14 -!- equinox [~equinox@spaceboyz.net] has quit [Quit: leaving]
13:18 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:20 < visinix007_> Hi all
13:20 < visinix007_> I'm having a bit of a issue with maybe routing on my openvpn server
13:20 < visinix007_> Server is setup and installed and running
13:21 < visinix007_> I'm able to connect to it, and get a IP (10.10.10.30)
13:21 < visinix007_> I want my open vpn server to be able to reach specific hosts only and the rest can go out my normal connecton
13:21 < visinix007_> so I'm able to see via a tcpdump on the open vpn server that packets are going outbound from the openvpn server
13:22 < visinix007_> but I am not seeing anything coming back
13:22 < visinix007_> I think the problem is that I am going from 10.10.10.30 > external gw
13:22 < visinix007_> and on the trip back, it can't make it back due to being a unrouteable range
13:22 < visinix007_> true?
13:23 < krzie> !redirect
13:23 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
13:23 < krzie> all of that remains true, except !def1
13:23 < krzie> since that would be for all traffic
13:24 < krzie> and you are right, you need NAT for that to work
13:24 < visinix007_> ah
13:24 < visinix007_> let me read up on that and see if I can figure this out
13:25 < visinix007_> !def
13:25 < visinix007_> !def1
13:25 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
13:25 < krzie> that is the *1* thing i said you *dont* need
13:26 < krzie> lol
13:26 < visinix007_> see what happens when you talk on the phone and try to read
13:26 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:26 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:32 -!- Karl370 [4caaecac@gateway/web/freenode/ip.76.170.236.172] has quit [Ping timeout: 252 seconds]
13:34 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
13:35 -!- raidz_afk [~Administr@openvpn/corp/admin/andrew] has left #openvpn []
13:35 -!- raidz_afk [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
13:35 -!- mode/#openvpn [+o raidz_afk] by ChanServ
13:35 < unixnuub> zrzie 
13:35 < visinix007_> !nat
13:35 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:36 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
13:36 -!- Cain` is now known as Cain
13:36 < visinix007_> !linnat
13:36 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
13:36 < unixnuub> I just noticed that tun0 is 10.8.0.6  P-t-P:10.8.0.1  Mask:255.255.255.255
13:36 < unixnuub> doesn't that make it only a link, i.e no host can be on a fully masked subnet?
13:37 < unixnuub> i might need to go back to the ip routing book ...
13:51 -!- unixnuub [~bryan@217.158.182.108] has left #openvpn []
13:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
13:56 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
13:58 -!- unixnuub [~bryan@217.158.182.108] has joined #openvpn
13:58 < unixnuub> !welcome !goal expose a port on my local machine to the interwebs 
13:59 < unixnuub> I've decided to go back to drawing board, should I even be using routing or should I just bridge? I've got a spare ip on the server and full control of my desktop (both linux)
14:00 < unixnuub> also data is not confidential, I'm just testing stuff
14:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Connection reset by peer]
14:04 < EugeneKay> "Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
14:04 < unixnuub> I don't have a cat, I used your TNT recipe on a banger which I stuck up the cat's arse. It is no longer.
14:09 -!- beshoo [~linada@91.144.45.126] has joined #openvpn
14:09 < visinix007_> !redirect
14:09 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:09 < beshoo> HI ALL , what is the best GUI/Web base for linux and apache system to add/remove users and maneg the OpenVPN 
14:10 < beshoo> some thing like OpenVPN AC web interface
14:10 < beshoo> AS * sorry
14:12 < hyper_ch> there is no such gui
14:14 < beshoo> i can see in google a lot of it , but i need th ebest on !
14:14 < beshoo> the best one !
14:17 < krzie> they all suck
14:17 < krzie> there is no best
14:18 < krzie> for all intensive purposes, [12:12]  <hyper_ch> there is no such gui
14:18 < krzie> ^
14:18 < hyper_ch> krzie: your system time is off by 9h :)
14:18 < krzie> no, it is not
14:19 < unixnuub> !redirect
14:19 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:19 < krzie> its off by 4 hours, (4:20)
14:19 < krzie> in 1 hour, it will be off by 3 hours
14:19 < krzie> etc
14:21 -!- unixnuub [~bryan@217.158.182.108] has left #openvpn []
14:25 < hyper_ch> [21:18] <krzie> for all intensive purposes, [12:12]  <hyper_ch> there is no such gui
14:25 < hyper_ch> see, 9h off
14:26 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 255 seconds]
14:27 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
14:27 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
14:28 < krzie> ;]
14:28 < krzie> you're actually 7h off
14:32 < hyper_ch> I am not
14:32 < hyper_ch> I'm dead right on time
14:33 -!- N0DEH is now known as CripperZ
14:36 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
14:46 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 250 seconds]
14:47 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
14:56 -!- Nekro [~edino@200.20.109.3] has left #openvpn ["Ex-Chat"]
15:10 < beshoo> well i have a problem using the command line , that is why i need GUI , any way , i did install openvpn , and i did run the add "clicent1"
15:10 < beshoo> and the server as well , now how can i start connection between my PC and the linux remote server ?
15:35 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:36 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:44 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
15:46 -!- beshoo [~linada@91.144.45.126] has quit [Ping timeout: 260 seconds]
15:46 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
15:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
15:52 < visinix007_> !redirect
15:52 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
15:52 < visinix007_> !ipforward
15:52 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:52 < visinix007_> !linipforward
15:52 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:52 < visinix007_> !linnat
15:52 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
15:57 < visinix007_> so for my nat options, is there a preferred way, or should any of the 3 above work?
16:04 < visinix007_> never mind I'm dumb
16:04 < visinix007_> got it
16:04 -!- syn4pse- [~syn@p5DDC04E8.dip0.t-ipconnect.de] has joined #openvpn
16:08 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Read error: Operation timed out]
16:10 -!- syn4pse- [~syn@p5DDC04E8.dip0.t-ipconnect.de] has quit [Quit: Verlassend]
16:14 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
16:17 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 264 seconds]
16:33 -!- beshoo [~linada@31.9.205.158] has joined #openvpn
16:37 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:41 -!- Guifort [~Guifort@190.72.69.86.rev.sfr.net] has joined #openvpn
16:43 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:52 -!- arejay [arejay@i.write.shellcode.eu] has joined #openvpn
17:03 -!- visinix007_ [~anonymous@75-145-179-110-Illinois.hfc.comcastbusiness.net] has quit [Quit: visinix007_]
17:15 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:17 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 255 seconds]
17:17 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
17:31 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
17:40 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:50 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:51 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: Leaving.]
18:08 -!- mcDuck_ [~scrooge@80-219-24-66.dclient.hispeed.ch] has joined #openvpn
18:08 < mcDuck_> hello
18:09 < mcDuck_> how can i limit control for specific users?
18:10 < krzie> huh?
18:13 < mcDuck_> uh sorry
18:13 < mcDuck_> i have openvpn access server and routing subnet defined as 10.0.0.0/24
18:13 < krzie> !as
18:13 < mcDuck_> only for a few users we want to limit this
18:13 < krzie> !AS
18:13 < krzie> grr
18:13 < krzie> !ping
18:13 <@vpnHelper> pong
18:13 < mcDuck_> as far as I understood the help i need to make a user ?
18:14 < mcDuck_> krzie: ??
18:14 < krzie> #openvpn-as
18:14 < mcDuck_> oh
18:14 < mcDuck_> oki :>
18:14 < mcDuck_> thanks
18:15 < mcDuck_> documnation is a bit confusing :)
18:22 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
18:26 -!- mcDuck_ [~scrooge@80-219-24-66.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
18:28 -!- scroogeio [~scrooge@195.134.148.227] has joined #openvpn
18:28 < reiffert> !as
18:29 < reiffert> I'm pretty sure we've had !as some time ago
18:29 < krzie> we did, but it was supposed to be changed
18:29 < krzie> !learn AS as please go to #OpenVPN-AS for help with Access-Server
18:29 <@vpnHelper> Joo got it.
18:29 <@raidz_afk> was that you harassing assbot reiffert? :-p
18:32 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
18:32 <@raidz_afk> !as
18:32 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:37 < scroogeio> :>
18:38 < scroogeio> bunch of smart people here :)
18:44 < reiffert> raidz_afk: yeah, me!
18:45 < reiffert> raidz_afk: I think mainly because the bot told me to..
18:45 -!- raidz_afk [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
18:46 < reiffert> doh
18:46 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
18:46 -!- mode/#openvpn [+o raidz] by ChanServ
18:47 < reiffert> guess raidz didnt get my answers.
18:48 < scroogeio> :)
18:56 -!- scroogeio [~scrooge@195.134.148.227] has quit [Ping timeout: 246 seconds]
18:57 -!- scroogeio [~scrooge@80-219-24-66.dclient.hispeed.ch] has joined #openvpn
18:57 -!- scroogeio [~scrooge@80-219-24-66.dclient.hispeed.ch] has quit [Client Quit]
18:57 -!- scroogeio [~scrooge@80-219-24-66.dclient.hispeed.ch] has joined #openvpn
19:08 < beshoo> how can i use auth-user-pass method and where i have to store users and password
19:10 < beshoo> i did add to server-side config file 
19:10 < beshoo>     plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so login
19:10 < beshoo> then what ?
19:15 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has joined #openvpn
19:27 -!- raidz is now known as raidz_afk
19:31 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
19:31 <@vpnHelper> RSS Update - forum: New Openvpn install and DNS is broken but good. <http://forums.openvpn.net/topic8361.html#p13315>
19:33 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
19:33 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:35 -!- ckipping [~curt@109.169.54.179] has joined #openvpn
19:37 -!- unspin [~unspin@S0106001451226d9c.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
19:39 -!- scroogeio [~scrooge@80-219-24-66.dclient.hispeed.ch] has quit [Quit: Lost terminal]
19:45 < krzie> !confgen
19:45 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
19:49 < beshoo> !confgen
19:49 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
19:49 < beshoo> !openvpn-auth-pam
19:50 < beshoo> !pam_yubico
20:10 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:10 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:12 -!- beshoo [~linada@31.9.205.158] has quit [Ping timeout: 258 seconds]
20:14 -!- master_of_master [~master_of@p57B53737.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:15 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
20:16 -!- master_of_master [~master_of@p57B52913.dip.t-dialin.net] has joined #openvpn
20:45 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
20:47 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
20:49 < krzie> !learn will as Where there's a will, there's /away
20:49 <@vpnHelper> Joo got it.
20:58 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:59 < rommel092079> good day guys. where can I possible ask this help.  I am planning to put up a webpage which will show that my server is online and the number of users online.
21:09 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has joined #openvpn
21:09 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
21:12 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:18 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has quit [Ping timeout: 252 seconds]
21:26 -!- nDuff [~cduffy@rrcs-97-79-207-2.sw.biz.rr.com] has joined #openvpn
21:26 < nDuff> Is there a rough timeline (this year / next year / ...?) on OpenVPN 2.3?
21:53 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:53 < bystander> guys do we have an openvpn monitor ?
21:54 < bystander> I have found this http://freshmeat.net/projects/openvpn-monitor but I can seem to see where is the installation package
21:54 <@vpnHelper> Title: OpenVPN-Monitor | freshmeat.net (at freshmeat.net)
21:59 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
22:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:07 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
22:07 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
22:07 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:20 -!- newmember [~newmember@d50-99-28-232.abhsia.telus.net] has joined #openvpn
22:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 244 seconds]
22:28 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:29 -!- unspin [~unspin@74-115-199-40.eng.wind.ca] has joined #openvpn
22:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
22:33 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
22:34 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
22:38 -!- unspin [~unspin@74-115-199-40.eng.wind.ca] has quit [Ping timeout: 240 seconds]
22:41 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has joined #openvpn
22:41 < adelas> !welcome
22:41 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:43 -!- joako [~joako@opensuse/member/joak0] has joined #openvpn
22:43 < adelas> I'm looking to do a simple vpn bridge with openVPN, right now i have 2x custom DD-WRT routers with openVPN setup, but I want more performance
22:44 < adelas> I'm not a linux expert, but is there possible theres a "pre-built" openVPN linux iso out there?
22:44 < adelas> thats made purly for openVPN, so i can install into a simple p4 machine and test?
22:45 < joako> adelas, How about pfSense? It's BSD, not linux. But I can't say enough good things about it. You can configure all aspects of the firewall with a GUI.
22:47 < adelas> awesome
22:48 < adelas> openVPN is built in?
22:49 < adelas> the idea i have is i need to make teh system have some kind of redundcy
22:49 < adelas> easy to replace kind of hting
22:49 < joako> Yes. Supports client & server.
22:49 < joako> pfSense lets you download the config in XML. In theory you can restore it to the same version and have the same exact config.
22:49 < adelas> okay, so i have this to research, thanks
22:49 < adelas> awesome
22:50 < joako> if you try the 2.0 RC versions it has the web UI for certificate management as well.
22:50 < adelas> this looks more promising than ipCop
22:50 < adelas> well their webpage looks a bit more documented
22:50 < adelas> do you have any opinions on this vs ipcop?
22:50 < adelas> the ipcop docs i'm going around in circles
22:51 < adelas> i'm trying to research before actully shoving my head into one to try
22:52 < joako> I use pfsense and I really like it. I understand all the networking concepts but I don't want to e.g. learn iptables commands to do simple things like block a port.
22:53 < joako> if they sold pfsense for a reasonable price I'd probably buy it.
22:53 < adelas> pfsense isn't free?
22:53 < joako> It is
22:53 < joako> *IF*
22:53 < adelas> :D
22:53 < adelas> awesome
22:53 < adelas> i don't want to learn iptables agai
22:53 < adelas> again*
22:53 < joako> They actually have paid support, and none of this buy the enterprise version first BS.
22:54 < adelas> their websites looks soo much better then ipcop, looks like i'
22:54 < adelas> i'm gonna try pssense first than*
22:54 < adelas> hopefully it will detect all my drivers and nics
22:54 < adelas> thanks for that
22:55 < joako> I've used ipcop, but many years ago.
22:55 < joako> Recently I've tried ClearOS which does firewall and also server roles
22:55 < adelas> i jsut want a simple, secure OpenVPN bridge
22:55 < joako> and unless you know iptables and know intricate details of how the Linux firewall works, it's not a good product.
22:56 < adelas> simple secure openVPN server/client, that is my goal. I know concepts, but i dont' know linux :(
22:56 < adelas> my big worries is the things i don't know that might make this linux box unsecure
22:57 < joako> I think pfSense will work well then. It's supposed to be used without access to the commandline/files
22:57 < adelas> maybe its running some other service that has vulnerabilities in teh long run
22:57 < adelas> i don't want to be in that situation
22:57 < adelas> pfSense sounds perfect
22:59 < adelas> wow it has redundncy settings
22:59 < adelas> damn has alot of freakin awesome features
23:06 -!- Guifort [~Guifort@190.72.69.86.rev.sfr.net] has quit [Quit: Quitte]
23:10 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:10 < bystander> guys where can I download a free openvpn server monitor?
23:12 < bystander> i found this http://freshmeat.net/projects/openvpn-monitor but I cant determine where is the installation package. please help
23:12 <@vpnHelper> Title: OpenVPN-Monitor | freshmeat.net (at freshmeat.net)
23:15 -!- bystander [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit []
23:23 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:27 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
23:29 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
23:43 -!- rothwell [~rothwell@unaffiliated/rothwell] has joined #openvpn
23:43 < rothwell> !welcome
23:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:51 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has joined #openvpn
23:56 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
23:59 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
--- Day changed Thu Jun 30 2011
00:11 -!- ckipping [~curt@109.169.54.179] has quit [Read error: Connection reset by peer]
00:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:18 -!- ckipping [~curt@109.169.54.179] has joined #openvpn
00:23 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has quit [Quit: Linkinus - http://linkinus.com]
00:25 -!- joako [~joako@opensuse/member/joak0] has quit [Remote host closed the connection]
01:33 -!- ovpn2ac [ca0c5ed3@gateway/web/freenode/ip.202.12.94.211] has joined #openvpn
01:41 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
01:45 -!- unspin [~unspin@S01060026f2f3042e.vc.shawcable.net] has quit [Ping timeout: 258 seconds]
01:50 < ovpn2ac> HomePC(win7 64bit) Running (Vmware Ubuntu11.04                                                                                                                       (gateway 192.168.164.254) OpenVPN Server(bridged)----------------Home Router(192.168.0.1)--------------------->I N T E R N E T<-------------------------School Network------------------------School PC (Client)
01:50 < ovpn2ac> Same setup above works 100% with Access Server  Now stuck with Community Edition. Connection to Server OK But I have no web traffic cant ping VPN gateway & Server 
01:50 < ovpn2ac> When i remove push "redirect-gateway def1" 
01:50 < ovpn2ac> i get web traffic (www.whatsmyip.com shows school pc IP instead of VPN) 
01:50 < ovpn2ac> but cant ping VPN gateway & Server 
01:51 < ovpn2ac> (Client Log) http://pastebin.com/w9X20Qyb
01:51 < ovpn2ac> (Server Status) http://pastebin.com/b8SJX4gw (
01:51 < ovpn2ac> (Server Log) http://pastebin.com/CX4PX2yA 
01:51 < ovpn2ac> (Client Config) http://pastebin.com/i1iP3AJu 
01:51 < ovpn2ac> (Server Config) http://pastebin.com/hB9z5aEM 
01:52 < ovpn2ac> 192.168.164.254 is gateway of School *
01:53 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:55 < ovpn2ac> if anyone is able to help pls reply at https://forums.openvpn.net/topic8330-15.html if im no longer here
01:55 <@vpnHelper> Title: OpenVPN Support Forum From School To Home Server (VMs) : Configuration - Page 2 (at forums.openvpn.net)
02:29 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 246 seconds]
02:32 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
02:34 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Quit: Leaving.]
02:35 < Mowee> Morning
02:45 -!- EugeneKay is now known as EugeneKaway
02:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
03:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:24 < Bushmills> ovpn2ac:  "But I have no web traffic cant ping VPN gateway & Server"   - are that two problems?  first, see that you can ping openvpn server. deal with web traffic through openvpn server once you can ping openvpn server
03:27 < Mowee> Bushmills, I resolved my problem, you know, when I would only create a tunnel
03:28 < Mowee> My firewall wasnt accepted dns requests :)
03:28 < Bushmills> ah, that error description "can't ping vpn gateway" totally leads to that cause, of course
03:29 < Bushmills> hang on - that was a different problem ...
03:30 < Bushmills> Mowee: no, i don't know what your problem was. i don't tend to memorize those over days
03:30 < Mowee> flash memory ;)
03:30 < Mowee> thanks for your help anyway
03:34 < Bushmills> ovpn2ac: i wonder whether your lines 642, 643 of server log give any clue to what one of the problems might be 
03:35 < Bushmills> !tunortap
03:35 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
03:35 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
03:38 -!- ph1l [~ph1l@1-232.197-178.cust.bluewin.ch] has joined #openvpn
03:39 < ovpn2ac> hmmmm
03:39 -!- ph1l [~ph1l@1-232.197-178.cust.bluewin.ch] has left #openvpn []
03:41 < ovpn2ac> well..i think my tap is working?
03:41 < ovpn2ac> otherwise linux would have given an error?
03:42 < ovpn2ac> ifconfig shows that tap0 is up
03:42 < Bushmills> sorry, can't help you much with bridged configuration
03:43 < ovpn2ac> and if i switch to tun
03:43 < ovpn2ac> will it work on a virtual machine on bridged connection?
03:43 < Bushmills> for redirecting traffic to internet through openvpn, tun config is entirely adequate 
03:44 < Bushmills> that's for both server and client
03:46 < ovpn2ac> hmm.. ill go try tun now
03:47 < ovpn2ac> well i meant. if it would work with the server running as a virtual machine on a bridged connection
03:48 < Bushmills> if you can have a tun interface on your virtual machine, it should
03:48 < Bushmills> and you need to be able to enable NAT
03:48 < ovpn2ac> how? iptables postrouting nat?
03:49 < Bushmills> that means, virtual machines like  kvm, virtualbox etc would do fine,  vserver, openvz and the like will be difficult 
03:50 < ovpn2ac> im on vm workstation
03:50 < Bushmills> vmware?
03:50 < ovpn2ac> yea
03:50 < Bushmills> should be fine
03:51 < ovpn2ac> sorry i really a new.. when u meant enabling NAT .. do u mean enabling on ubuntu... or on the virtual machine settings
03:51 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
03:51 < Bushmills> vmware probably uses a bridge to the guest interface. the guest can ignore that, as for it just the (emulated) interface matters
03:52 < Bushmills> !redirect
03:52 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
03:52 < Bushmills> note the "or" in the factoid is not an exclusive or
03:53 < ovpn2ac> !nat
03:53 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
03:54 < Bushmills> !linnat
03:54 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
04:02 < ovpn2ac> hmm.. i cant seem to get rid of the br0 interface in ubuntu... i already removed stuff in /etc/network/interfaces  and did /etc/init.d/networking restart
04:04 < Bushmills> brctl delbr br0
04:09 < ovpn2ac> wierd.. it says br0 is still up... openvpn.. is stopped.... 
04:09 < ovpn2ac> cant delete br0 is still up
04:14 < Bushmills> you may have to remove all bridged interfaces first.  brctl delif br0 eth0
04:15 < Bushmills> assuming your tap is already gone
04:24 < ovpn2ac> did /etc/init.d/openvpn/restart  ... fail..
04:24 < ovpn2ac> br0 is gone..
04:24 < ovpn2ac> changed client and server config to tun
04:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
04:26 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Quit: No Ping reply in 180 seconds.]
04:26 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
04:28 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
04:30 < ovpn2ac> i have no idea why did it fail..
04:30 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
04:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:34 < ovpn2ac> any ideas
04:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:39 < ovpn2ac> http://pastebin.com/3PWWVJuv  <- server config
04:39 < ovpn2ac> why fail
05:00 -!- ovpn2ac [ca0c5ed3@gateway/web/freenode/ip.202.12.94.211] has quit [Quit: Page closed]
05:09 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
05:14 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
05:16 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
05:19 -!- raidz_afk [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
05:20 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 276 seconds]
05:26 <@vpnHelper> RSS Update - forum: Routing all of traffic through VPN and SSH <http://forums.openvpn.net/topic8375.html#p13317>
05:29 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
05:32 <@vpnHelper> RSS Update - forum: Routing all of traffic through VPN and SSH <http://forums.openvpn.net/topic8375.html#p13318>
05:35 -!- syn4pse [~syn@p5DDC08DC.dip0.t-ipconnect.de] has joined #openvpn
05:41 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
05:43 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Remote host closed the connection]
05:44 -!- unixnuub [~bryan@217.158.182.108] has joined #openvpn
05:44 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
05:45 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
06:00 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
06:00 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
06:00 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:01 -!- simplechat_ [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
06:01 -!- simplechat_ [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
06:01 -!- simplechat_ [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:02 -!- unixnuub [~bryan@217.158.182.108] has quit [Ping timeout: 255 seconds]
06:11 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
06:13 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
06:15 -!- unixnuub [~bryan@217.158.182.108] has joined #openvpn
06:17 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has joined #openvpn
06:23 < ujjain> How can I have openvpn provide errors on my configuration file?
06:29 -!- unspin [~unspin@S010600900b1a7c77.vc.shawcable.net] has quit [Quit: Leaving]
06:32 -!- unixnuub [~bryan@217.158.182.108] has left #openvpn []
06:35 -!- ph1l [~ph1l@inetgw.dreamlab.net] has joined #openvpn
06:36 -!- ph1l [~ph1l@inetgw.dreamlab.net] has left #openvpn []
06:38 < hyper_ch> ujjain: enable logging
06:42 < ujjain> hyper_ch: thanks :)
06:42 < ujjain> do I need ethernet briding for windows shares?
06:42 < hyper_ch> I haven't used Windows for years
06:42 < ujjain> I am considering setting up Samba for this, but might use Winodws Server.
06:42 < ujjain> :) 
06:43 < ujjain> the openvpn client asks me for a username/password, I tought it was certificate autnetication?
06:43 < hyper_ch> depends all on teh configuration
06:43 < hyper_ch> if you created certificates with passwords, it will ask for passwords
06:43 < ujjain> ah ok, I did not set passwords no.
06:44 < ujjain> it does ask for a password, then it errors because port 443 is unreachable (?)
06:44 < ujjain> my goal is having access to the server lan 192.168. range
06:51 < hyper_ch> don't know... don't use windows.... too complicated for me
06:51 < ujjain> right, but I use openvpn on a linux server
06:54 < hyper_ch> !howto
06:54 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:56 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
06:57 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
06:58 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 264 seconds]
06:58 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
06:58 < ujjain> I have read it hyper_ch 
06:58 < ujjain> but sure, I'll keep trying
06:59 < ujjain> It just at one moment points to example files, which is a hard pill to swallow
06:59 < ujjain> but i'll keep trying
07:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
07:07 -!- luneff [~yury@46.41.69.1] has joined #openvpn
07:14 -!- Rolybrau [~Rolybrau@87-151.78-83.cust.bluewin.ch] has joined #openvpn
07:14 -!- Rolybrau [~Rolybrau@87-151.78-83.cust.bluewin.ch] has quit [Changing host]
07:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:18 <@vpnHelper> RSS Update - forum: Routing all of traffic through VPN and SSH <http://forums.openvpn.net/topic8375.html#p13319>
07:23 -!- beshoo [~linada@31.9.9.218] has joined #openvpn
07:23 <@vpnHelper> RSS Update - forum: Using openVPN to bypass bloking firewall <http://forums.openvpn.net/topic8376.html>
07:24 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
07:30 <@vpnHelper> RSS Update - forum: Routing all of traffic through VPN and SSH <http://forums.openvpn.net/topic8375.html#p13321>
07:31 -!- s7r [~s7r@unaffiliated/s7r] has quit [Read error: Connection reset by peer]
07:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:40 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
07:43 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 246 seconds]
07:48 <@vpnHelper> RSS Update - forum: Using openVPN to bypass bloking firewall <http://forums.openvpn.net/topic8376.html#p13322>
07:54 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
07:54 <@vpnHelper> RSS Update - forum: Routing all of traffic through VPN and SSH <http://forums.openvpn.net/topic8375.html#p13323>
07:55 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 246 seconds]
08:08 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
08:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:10 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 244 seconds]
08:13 <@vpnHelper> RSS Update - forum: Routing all of traffic through VPN and SSH <http://forums.openvpn.net/topic8375.html#p13324>
08:13 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:14 < bystander> guys I need your advice. I need an openvpn server monitor which is web-based. can you possibly give me one.
08:14 < ecrist> server monitor?
08:15 < Bushmills> bystander: what aspects do you want to monitor?
08:16 < bystander> bushmills, I want to monitor if the server is online or offline and I wanted to know how many users are online.
08:17 < Bushmills> bystander: rather than monitoring whether it is on- or offline, consider to take a pro-active approach and use a daemon which restarts it when it's down, or doesn't respond:   monit  can do that.  for users,  consider  munin, there exists a plugin for it which graphs the number of connected clients
08:17 < beshoo> hi , i need a doc to learn how to make auth-user-pass-verify , step by step , cos there is no doc on the web site
08:17 < Bushmills> oh, monit allows you (per web interface) also to shut it down or restart it
08:18 < Bushmills> but normal operation would be:  warn admin, or restart, depending on type of problem. 
08:18 < bystander> bushmills: monit? munin? I dont know them.
08:18 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
08:18 < Bushmills> had you known them, you wouldn't have asked
08:19 < beshoo> please.
08:19 < bystander> I really dont know bushmills. honestly
08:20 < Bushmills> http://scarydevilmonastery.net/snap/1309439987869858689d.png  this is the overview page of monit
08:20 < Bushmills> http://scarydevilmonastery.net/snap/1309440034259778297d.png   here's the openvpn specific page of monit
08:21 < bystander> bushmills can you teach me how to install that for my server.
08:21 < Bushmills> teach? why?  it is rather simple, and has a man page
08:21 < bystander> man page? where
08:22  * Bushmills headscratches
08:22 < Bushmills> are you a ubuntu user?
08:22 < bystander> centos 5.5
08:23 < Bushmills> that doesn't explain it, then.
08:23 < Bushmills> for installing stuff into your operating system, ask the #centos support channel
08:24 < Bushmills> ditto for how to read a manpage
08:24 < bystander> but can you direct me to the man page bushmills.
08:24 < Bushmills> install first. read man page after you have installed
08:25 < bystander> yes but please point me to the man page. I dont know where the man page is.
08:25 < Bushmills> http://docs.verhau.de/cgi-bin/dwww/usr/share/man/man1/monit.1.gz?type=man
08:25 <@vpnHelper> Title: monit(1) - Man pages (at docs.verhau.de)
08:26 < bystander> thanks
08:27 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 255 seconds]
08:29 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:32 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
08:32 -!- simplechat_ [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
08:36 < Bushmills> munin produces graphs like  http://scarydevilmonastery.net/snap/1309440935124413752d.png 
08:37 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
08:38 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
08:38 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:40 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
08:42 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:50 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
08:50 -!- mode/#openvpn [+o mattock] by ChanServ
08:56 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:59 <@vpnHelper> RSS Update - forum: OpenVPN via 3proxy (socks) problem (usermane/login) <http://forums.openvpn.net/topic8377.html>
09:02 < beshoo> hi , i need a doc to learn how to make auth-user-pass-verify , step by step , cos there is no doc on the web site
09:02 < beshoo> any reply please ?
09:05 <@mattock> check out the man-page, it contains all the documentation you should need
09:06 <@mattock> the section on --auth-user-pass-verify is very detailed
09:07 < greg_72> hi there, what can I do if my certification asks for a passphrase when the server starts, but obviously I cannot give it as it happens in the background?
09:10 < beshoo> dear @mattock . i am nwebe on this , what i need a step by step how to make this don on my centos please , has no step by step . login PAM module is what i am looking for , 
09:11 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
09:11 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
09:11 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:12 < beshoo> http://paste.org/pastebin/view/35625 this is what doc sayd
09:13 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:14 < beshoo> and here you can see , http://code.google.com/p/yubico-pam/wiki/YubiKeyAndOpenVPNviaPAM some one is talking about using therdparty plugin !
09:15 <@vpnHelper> Title: YubiKeyAndOpenVPNviaPAM - yubico-pam - Step by Step Guide for Configuration of Yubico PAM module to provide Two-factor legacy Username + password + YubiKey OTP authentication for OpenVPN logons. - Yubico Pluggable Authentication Module (PAM) - Google Project Hosting (at code.google.com)
09:20 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 244 seconds]
09:23 <@vpnHelper> RSS Update - forum: Routing all of traffic through VPN and SSH <http://forums.openvpn.net/topic8375.html#p13326>
09:23 < beshoo> when i connect to the server : it said http://codepad.org/IH5MSk7h
09:23 <@vpnHelper> Title: C code - 14 lines - codepad (at codepad.org)
09:25 < krzie> lol it wanted to compile your "C code"
09:25 < krzie> thats cute
09:25 < krzie> whats up with your packet length...?
09:25 < krzie> if you dunno how to answer that, pastebin your configs
09:25 < krzie> (without comments)
09:27 < beshoo> ok hold :
09:28 < beshoo> http://codepad.org/sMrru3SY
09:28 <@vpnHelper> Title: PHP code - 304 lines - codepad (at codepad.org)
09:28 < beshoo> here is the server.conf
09:29 < krzie> [07:25]  <krzie> (without comments)
09:29 < krzie> go try again
09:30 < beshoo> how can i delete all of comment  :)
09:31 < krzie> !configs
09:31 -!- EugeneKaway is now known as EugeneKay
09:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
09:32 < krzie> like that ;]
09:33 < beshoo> :)
09:34 < beshoo> http://codepad.org/ROJdFarm
09:34 <@vpnHelper> Title: PHP code - 18 lines - codepad (at codepad.org)
09:35 < beshoo> the client : http://codepad.org/kILhSv1F
09:35 <@vpnHelper> Title: C code - 14 lines - codepad (at codepad.org)
09:36 < krzie> 1 is dev tap
09:36 < krzie> other is dev tun
09:36 < krzie> 1 is tcp, other is udp
09:36 < krzie> these things must agree :-p
09:36 < krzie> !howto
09:36 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:37 -!- EugeneKay is now known as EugeneKaway
09:37 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has joined #openvpn
09:38 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
09:38 < beshoo> what should i do , tap or dev
09:38 < beshoo> sorry 
09:38 < krzee> depends on your goal
09:38 < krzee> likely dev tun
09:39 < krzee> !goal
09:39 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:39 < afuentes> i get this http://paste.debian.net/121522/ when i try to ping the server from the machine thru an openvpn. Does anybody knows what could be wrong? its a bridge virtual machine and it has not any kind of firewall
09:39 < krzee> afuentes, no idea, not enough info
09:39 < krzee> that log has nothing useful, you cut everything out
09:39 < beshoo> my goal is to use the "OpenVPN Client.exe" in my windows to connect to the vpn server via username and pasword PAM
09:41 < krzie> "OpenVPN Client.exe"   is not the open source openvpn, we dont support it here
09:41 < krzie> use this:
09:41 < krzie> !download
09:41 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
09:42 < beshoo> i need the client !
09:42 < beshoo> not all OpenVPN !
09:42 < krzee> open source openvpn is both client and server, depending on your config
09:42 < krzee> :-p
09:42 -!- luckman212 [~irc@2001:470:1f07:1225:5e9:a437:13fc:6041] has joined #openvpn
09:43 < afuentes> krzee, thats the part that shows when i try to ping but ok, heres the whole log http://paste.debian.net/121524/ :)
09:45 < beshoo> i did download now "http://swupdate.openvpn.net/community/releases/openvpn-2.2.0-install.exe"
09:45 < krzee> afuentes, 
09:46 < krzee> !configs
09:46 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
09:48 < beshoo> well i  did download the windows , which program i have to use to connect to my server ? 
09:50 < krzee> !howto
09:50 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:50 < krzee> from the topic:  "We won't put more work into your problem than you do, that's just silly."
09:50 < afuentes> krzee, do you mean my tun0.conf's?
09:51 < krzee> afuentes, yes, do you have other openvpn configs...?
09:51 < afuentes> krzee, no that i am aware of ^^
09:54 < afuentes> krzee, ok, here it goes http://paste.debian.net/121526/ altho I think all this info is on the log
09:55 -!- CripperZ is now known as N0DEH
09:56 < krzie> it is, i didnt wanna dig it out piece by piece
09:56 <@vpnHelper> RSS Update - forum: Routing all of traffic through VPN and SSH <http://forums.openvpn.net/topic8375.html#p13327>
09:56 < afuentes> the static.key is only rw for root in both cases... I dont think that is wrong, but i tell it
09:56 < afuentes> krzie, :)
09:57 < krzie> afuentes, paste the log from the other side
09:57 < krzie> that side was making the connection, lets see the side being connected to
09:57 < afuentes> krzie, how do i get that log? i know how to launch the connection in verbose mode but not on the other side :S
09:58 < krzie> !logfile
09:58 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
10:01 < afuentes> krzie... u.U i was not launching the program on the server... I thought that the daemon was running some how already
10:01 < afuentes> I deserve punishment
10:02 < afuentes> U.U
10:04 < beshoo> http://codepad.org/SzCFimmE : why i still got an error .
10:04 <@vpnHelper> Title: C code - 62 lines - codepad (at codepad.org)
10:05 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
10:05 < bystander> guys can I ask how to use php in html?
10:06 < beshoo> bystander .. you have to add mime type in the apache 
10:06 < bystander> beshoo what do you mean
10:07 < krzee> in apache?   i have web users ignored, but openvpn has nothing to do with apache... if he is using access-server he belongs in #openvpn-as
10:07 < beshoo> http://php.about.com/od/advancedphp/p/html_php.htm
10:07 <@vpnHelper> Title: Run PHP from HTML - .html as .php - Execute PHP in .html (at php.about.com)
10:07 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
10:08 < beshoo> <krzee> http://codepad.org/SzCFimmE  kindly may you please have a look 
10:08 <@vpnHelper> Title: C code - 62 lines - codepad (at codepad.org)
10:09 < bystander> beshoo, i have this http://pastebin.com/4Mdt6BLA ------ I intend to use it on my html to use the server status
10:11 < bystander> beshoo: i have this http://pastebin.com/4Mdt6BLA ------ I intend to use it on my html to use the server status
10:11 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:11 -!- mode/#openvpn [+o raidz] by ChanServ
10:12 < beshoo> i do not have any idea !
10:13 < bystander> beshoo: i just need to execute that php and display the status
10:13 < bystander> can you help me
10:15 < beshoo> i dont know , just i did google what you need
10:17 < krzie> beshoo, log from other side?
10:17 -!- newmember_ [~newmember@d50-99-28-232.abhsia.telus.net] has joined #openvpn
10:18 < krzie> beshoo, also delete ipp.txt
10:18 < krzie> in fact just delete that line from server config
10:18 < krzie> it doesnt do what you likely think it does
10:18 < krzie> plus since you just moved from dev tap, its probably not right now
10:19 < krzie> !ipp
10:19 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
10:19 < krzie> and also:
10:20 < krzie> you said:
10:20 < krzie> when i connect to :
10:20 < krzie> 184.107.44.70:3322
10:20 < krzie> but thats not the right ip
10:20 < krzie> remote 184.107.41.100 3322   is in your config
10:20 < krzie> not 184.107.44.70:3322
10:20 < beshoo> hmmmm
10:20 < beshoo> let me check please
10:21 -!- newmember [~newmember@d50-99-28-232.abhsia.telus.net] has quit [Ping timeout: 260 seconds]
10:26 < beshoo> http://codepad.org/ChPhbIbO
10:26 <@vpnHelper> Title: C code - 41 lines - codepad (at codepad.org)
10:27 < beshoo> PS: please note that i am connecting form the windows PC to my remote server Centos .
10:29 <@vpnHelper> RSS Update - forum: Using openVPN to bypass bloking firewall <http://forums.openvpn.net/topic8376.html#p13328>
10:33 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
10:34 -!- dazo_afk is now known as dazo
10:37 -!- ujjain [~ujjain@unaffiliated/ujjain] has quit [Quit: /dev/null]
10:46 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
10:46 <@vpnHelper> RSS Update - forum: Client doesn't disconnect but can't ping <http://forums.openvpn.net/topic8378.html>
10:48 -!- beshoo [~linada@31.9.9.218] has quit []
10:53 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 250 seconds]
11:03 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:03 -!- luneff [~yury@46.41.69.1] has quit [Quit: This computer has gone to sleep]
11:12 < krzie> hah he pasted the same logfile, then left
11:23 -!- Deathvalley122 [~Death@eagleits.net] has joined #openvpn
11:25 -!- grojas [~grojas@201.200.107.2] has joined #openvpn
11:25 < grojas> hello
11:25 < grojas> anyone aruound?
11:26 < grojas> does anyone know how to configure openvpn exactly the same way as hotspotshield?
11:27 < grojas> !welcome
11:27 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:29 < grojas> please help
11:29 < Bushmills> grojas: please tell us "exactly" how hotspotshield is configured
11:30 < grojas> hi there bushmills, thanks for the reply.  I can send a confi file for Hotspotshield but i'm not sure "exactly" how it is configured
11:31 < Bushmills> won't help, as i don't know hotspotdshiled
11:31 < Bushmills> shiled
11:31 < Bushmills> grr....   shield
11:31 < Bushmills> but if you tell "exactly" how it is configured, maybe someone could tell you how to configure openvpn the same
11:32 < grojas> hhmm so, do you know if flash is routed trough openvpn?
11:33 < Bushmills> openvpn doesn't care about specific services or file types
11:33 < grojas> so it routes everything?
11:34 < Bushmills> to route connections through openvpn, you usually add routes to your routing table, describing destinations
11:34 < Bushmills> consider openvpn a kind of network cable, with two NICs on the ends
11:36 -!- newmember_ [~newmember@d50-99-28-232.abhsia.telus.net] has quit [Ping timeout: 240 seconds]
11:36 < grojas>  c
11:36 < grojas> i c
11:36 < grojas> the problem is that when i do a whereismyip it appears to be in the US but when i try to stream hulu it say i'm not in the US
11:37 < grojas> so that confuses me
11:37 < Bushmills> you can use openvpn to route all traffic through it, using the openvpn server as gateway
11:37 < Bushmills> with the server doing NAT, the server public ip address is what will be considered your location
11:38 -!- EugeneKaway is now known as EugeneKay
11:38 < Bushmills> at least if geolocation is done on base of ip address, not on, say, web browser characteristics
11:47 -!- grojas [~grojas@201.200.107.2] has quit [Ping timeout: 252 seconds]
11:48 < Bushmills> actually, you don't need to route "all" traffic through it, but traffic to specific destinations would be possible as well
11:48 -!- grojas [~grojas@ec2-184-73-243-158.compute-1.amazonaws.com] has joined #openvpn
11:50 < grojas> i'm back, sorry disconnected
11:51 < grojas> i'm connected through the openvpn server and configured my gateway to 10.8.0.1
11:52 < Bushmills> http://scarydevilmonastery.net/myip.cgi  gives you some bits on your connection. check the HTTP_X_FORWARDED_FOR line
11:52 < Bushmills> if there is any
11:53 < grojas> nope
11:54 < grojas> the strange thing is the hotpotshield (i think it is an openvpn implementation) manages to do the trick
11:55 < grojas> i guess they know what they are doing lol
12:07 < krzie> !redirect
12:07 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
12:08 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has joined #openvpn
12:09 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
12:20 -!- grojas [~grojas@ec2-184-73-243-158.compute-1.amazonaws.com] has quit [Ping timeout: 258 seconds]
12:20 -!- grojas [~grojas@201.200.107.2] has joined #openvpn
12:22 -!- syn4pse [~syn@p5DDC08DC.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
12:31 -!- luneff [~yury@84.51.213.254] has joined #openvpn
12:32 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:41 -!- grojas [~grojas@201.200.107.2] has quit []
12:45 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:59 -!- EugeneKay is now known as EugeneKaway
13:03 -!- dazo is now known as dazo_afk
13:06 -!- dazo_afk is now known as dazo
13:27 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:32 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
13:34 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
13:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:49 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 264 seconds]
13:50 -!- gyyrog [~gyyrog@66.129.37.186] has joined #openvpn
13:55 -!- gyyrog [~gyyrog@66.129.37.186] has quit [Remote host closed the connection]
13:57 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Read error: No route to host]
13:58 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
14:00 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
14:05 -!- K1ng` [~KING@180.211.188.123] has joined #openvpn
14:05 -!- gyyrog [~gyyrog@66.129.37.186] has joined #openvpn
14:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:07 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
14:08 <@vpnHelper> RSS Update - forum: Whats the source port range for the openvpn client traffic? <http://forums.openvpn.net/topic8379.html>
14:10 -!- gyyrog [~gyyrog@66.129.37.186] has quit [Ping timeout: 252 seconds]
14:26 -!- toe [~toe@static.78.209.40.188.clients.your-server.de] has joined #openvpn
14:27 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has joined #openvpn
14:29 -!- EugeneKaway is now known as EugeneKay
14:32 < toe> hi. i have a problem when trying to use the show-pkcs11-ids option, it says CKR_FUNCTION_FAILED
14:33 < toe> verbose output: http://pastebin.com/b8Tyu9Lz
14:34 < toe> any ideas where the problem might be?
14:49 -!- beshoo [~linada@31.9.205.158] has joined #openvpn
14:50 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
15:01 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
15:19 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:19 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:19 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:24 -!- dazo is now known as dazo_afk
15:25 -!- bjh4 [~bjh4@ool-18bbdf6a.static.optonline.net] has joined #openvpn
15:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:32 -!- bjh4 [~bjh4@ool-18bbdf6a.static.optonline.net] has quit [Quit: Leaving]
15:33 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
15:35 -!- mick_laptop [~mick@mickweiss.com] has quit [Changing host]
15:35 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
15:44 -!- DelphiWorld [~Miranda@41.200.20.214] has joined #openvpn
15:44 < DelphiWorld> hello
15:44 < DelphiWorld> i have a basic openvpn setup
15:44 < DelphiWorld> using tun
15:44 < DelphiWorld> my openvpn tun is 10.10.10.1
15:45 < DelphiWorld> a client is 10.10.10.6
15:45 < DelphiWorld> can't ping etter from client or server
15:45 < DelphiWorld> any idea?
15:46 < reiffert> something went bad.
15:47 < DelphiWorld> reiffert: so how do i know?
15:48 < DelphiWorld> ecrist: pingf
15:48 < DelphiWorld> ecrist: ping
15:49 < Bushmills> !firewall
15:49 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
15:49 < DelphiWorld> Bushmills: there's no firewall in the path at all
15:49 < Bushmills> then it must be your configuration
15:50 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
15:53 < DelphiWorld> can you help me Bushmills please
15:53 < Bushmills> yes, sure. i'd say the problem is between lines 6 and 8 of your config
15:53 < DelphiWorld> Bushmills: let me check
15:54 < DelphiWorld> Bushmills: can you give me the line?
15:54 < Bushmills> in mine it is "verb 3"
15:56 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Read error: No route to host]
15:57 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has joined #openvpn
15:57 < DelphiWorld> Bushmills: me too verb 3
15:59 < Bushmills> ok, i'd wager that's not the problem :)
15:59 < DelphiWorld> Bushmills: :D
16:00 < DelphiWorld> Bushmills: i hate tap... dificult :(
16:00 < Bushmills> that's why you don't use it, right?
16:00 < DelphiWorld> Bushmills: yes.
16:01 < DelphiWorld> Bushmills: i wanted it but i gave up.
16:01 < DelphiWorld> busin adition to my blindness... very dificult to set up
16:01 < Bushmills> what would cause you to want tap?
16:01 < DelphiWorld> Bushmills:  in adition to my blindness... very dificult to set up
16:02 < Bushmills> either put comp-lzo in both server and client config, or remove it from both.
16:03 < DelphiWorld> Bushmills: hmmm
16:03 < DelphiWorld> Bushmills: from where did you get your brain? :D good guess. let see how will goes.
16:04 < Bushmills> that's a common reason for clients connecting, but not able to talk to server and vice versa
16:06 < DelphiWorld> Bushmills: but same shit.
16:06 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:10 -!- DelphiWorld [~Miranda@41.200.20.214] has quit [Read error: Connection reset by peer]
16:11 -!- DelphiWorld [~Miranda@41.200.20.214] has joined #openvpn
16:24 -!- MarKsaitis [~MarKsaiti@cpc7-pool12-2-0-cust219.15-1.cable.virginmedia.com] has quit [Ping timeout: 246 seconds]
16:24 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html>
16:27 < DelphiWorld> any other suggestion Bushmills
16:28 < Bushmills> yes!  check your logs :)
16:28 < DelphiWorld> Bushmills: lol;....
16:28 < DelphiWorld> Bushmills: one yeer maybe if i could read it :(
16:28 -!- fu[h]ry [~dan@24-151-32-112.dhcp.nwtn.ct.charter.com] has joined #openvpn
16:29 < Bushmills> you're the only one who can
16:29 < DelphiWorld> Bushmills: yes, only if you can give me your eyes to read it. smart understanding.
16:30 < Bushmills> you don't expect me to break into your machine to get any clues what might be wrong with your config
16:30 < fu[h]ry> hey, i have an OpenVPN setup for a client that is a completely TAP based offsite virtualization/disaster-recovery tool, wherein we mix virtual machines (bridged via VirtualBox to OVPN's TAP interface) and real clients that connect remotely with OpenVPN.
16:30 < DelphiWorld> Bushmills: i don't need.
16:31 < fu[h]ry> we have client-to-client enabled, but clients can only ping each other if they're connected to the server or the same physical machine
16:31 < Bushmills> fu[h]ry: you don't expect clients to talk to each other through openvpn while they're not connected, right?
16:32 < fu[h]ry> they're all connected properly, as far as i can tell
16:32 < fu[h]ry> (server1 = OpenVPN client, TAP device with client1, client2, client3) <==> (server2 = OpenVPN server, TAP device with client4, client5) <==> (server3 = OpenVPN client, TAP device with client6, client7)
16:32 < Bushmills> "clients can only ping each other if they're connected to the server" - yes, that works
16:32 < fu[h]ry> client1 can ping clients 2, 3, 4 and 5
16:32 < fu[h]ry> but not 6 and 7
16:33 < fu[h]ry> likewise, 6 and 7 can ping 4 and 5, but not 1-3
16:33 < Bushmills> !route
16:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:33 < Bushmills> !serverlan
16:33 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
16:33 < Bushmills> !clientlan
16:33 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
16:33 <@vpnHelper> better explanation
16:33 < DelphiWorld> !route
16:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:34 < krzee> !c2c
16:34 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
16:34 <@vpnHelper> clients
16:34 < Bushmills> those instructions assume a tun based setup. i can't tell how much a bridged config affects those
16:35 < fu[h]ry> correct me if i'm wrong, but since this is all layer 2, isn't routing irrelevant?
16:35 < Bushmills> !tunortap
16:35 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:35 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
16:35 < krzee> you
16:35 < krzee> you're joining 3 lans, you really should go tun if you can
16:36 < fu[h]ry> we can't -- it has to run a windows network
16:36 < krzee> tap fails at scalability
16:36 < krzee> !wins
16:36 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
16:36 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
16:37 < krzee> windows smb is layer3, only the netbios resolution is layer2, but you can use wins to do that in layer3
16:37 < fu[h]ry> we need to run as few services as possible because our clients are basically using the OVPN LAN to run their corporate network complete with AD domain controllers, etc.
16:37 < fu[h]ry> and so unfortunately it has to "just work"
16:37 < krzee> it can set wins on the clients if needed
16:38 < krzee> or a script to enter it into the AD
16:39 < s7r> krzee: i would like your personal opinion on this. on a server with 25 mbps guaranteed speed (100mbps port). usually more but 25 mbps guaranteed at anytime no matter what. how many clients you suggest I could put on that server
16:39 < krzee> i mean feel free to try with tap, i wont be of any help since i dunno tap setups really, but bridging multiple lans together is most often fail i believe
16:39 < s7r> taking in consideration all internet traffic of client routed through the server
16:39 < s7r> and taking in consideration clients will do torrent download etc stuff like this
16:39 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 244 seconds]
16:39 < krzee> s7r, what will each client use concurrently...?
16:40 < s7r> you mean what applications ?
16:40 < s7r> what will the client do on the internet ?
16:40 -!- DelphiWorld [~Miranda@41.200.20.214] has quit [Ping timeout: 240 seconds]
16:40 < krzee> i mean how much throughput each do they require?
16:41 < krzee> i guess its basically the question you're asking me, but i dont know how much your users will need either ;]
16:41 < s7r> 500 - 600 kbps
16:41 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
16:41 < s7r> well, it could be less. it's gonna be free so it doesn't have to be that good
16:42 < s7r> i have to put as many as i can on a single server to have profit
16:42 < s7r> taking in consideration vpn will be provided for free along with other product which is for $
16:43 < Bushmills> "as many as i can" clearly rules out tap
16:46 < beshoo> if i am on windows and i want to connect to my VPN on my remote linux box , what is the program i have to use ?
16:47 < s7r> good one
16:48 < beshoo> cos OpenVPN Client.exe is not working !
16:49 < Bushmills> what is "Client.exe"?
16:49 < Bushmills> try   openvpn --config /your/configfile
16:50 < krzee> s7r, so 50 could use that much at once minimum, you could probably get away with whatever the hardware allows im guessing
16:51 < Bushmills> beshoo: didn't you ask that before, saying you're using access server?
16:51 < beshoo> will , "access server" you have to pay for it or just use 2 user for free
16:51 < Bushmills> and it's also not supported here
16:51 < beshoo> that what i dont want
16:51 < beshoo> i understand that
16:52 < beshoo> and i dont want to use it 
16:52 < beshoo> so i did install openvpn open source
16:52 < Bushmills> community version is openvpn.  that's client or server, only depending on its configuration
16:52 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:52 < beshoo> nice 
16:53 < beshoo> now how can you run the connection between your PC and the remote server ?
16:53 < krzee> or maybe around 50 - 250 actually, 50 being conservative and no overselling (overselling is normal based theory that not EVERY person will use it at once)
16:53 < krzee> 200 users being ~ that bandwidth for getting full 100mbit
16:53 < Bushmills> so you provide a server config on server, and client configs on clients. then you start server, and run clients. if everything is good, clients connect
16:53 -!- s7r [~s7r@unaffiliated/s7r] has quit [Ping timeout: 258 seconds]
16:54 < beshoo> i have to start connection form the CMD ?
16:54 < beshoo> command line ?
16:54 < krzee> could prolly give service to ~500 without problem, they wont all use it at once and hw could handle it im guessing (what is the hw?)
16:54 < krzee> hah he pinged out
16:54 < Bushmills> depends. many like to run server or clients on boot
16:55 < beshoo> is there any thing "LIKE" access server program , to start the connection from my PC "the client" to the server via username password / PAM method ?
16:56 < Bushmills> authentication method is also determined in configs
16:56 <@vpnHelper> RSS Update - forum: Trouble with proxy-arp setup from OpenVPN Cookbook 2 <http://forums.openvpn.net/topic8381.html>
16:57 < Bushmills> windows version comes with some kind of gui giving a panel icon to click on
16:57 < beshoo> now we start ... 
16:57 < beshoo> i did download windows version 
16:57 < Bushmills> yes, that's about how the "connect" item is called
16:58 < beshoo> the only GUI is : openvpn-gui-1.0.3.exe
16:58 < beshoo> and there is nothing to put like my server addres / username password / port to connect to 
16:59 < Bushmills> that's what you config file is for
16:59 < beshoo> is there any step by step doc for this ?
17:00 < Bushmills> !howto
17:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:05 < Bushmills> also, meta packages.  they look like normal packages
17:05 < Bushmills> ehm, sry.  wrong channel
17:09 -!- eliasson_ [~wizard@91.198.48.20] has quit [Ping timeout: 240 seconds]
17:10 -!- luneff [~yury@84.51.213.254] has quit [Quit: Leaving]
17:10 -!- eliasson_ [~wizard@91.198.48.20] has joined #openvpn
17:11 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:26 -!- ckipping_ [~curt@109.169.54.179] has joined #openvpn
17:27 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
17:28 -!- ckipping [~curt@109.169.54.179] has quit [Ping timeout: 250 seconds]
17:31 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:39 -!- beshoo [~linada@31.9.205.158] has quit []
17:41 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has joined #openvpn
17:44 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has quit [Remote host closed the connection]
17:48 -!- beshoo [~linada@31.9.205.158] has joined #openvpn
17:49 < beshoo> i did copy my config file to my windows and did the connection , server respond : http://pastebin.com/mBLSYQQ5
17:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
17:58 < Bushmills> check client log why it disconnects
18:01 -!- beshoo [~linada@31.9.205.158] has quit []
18:05 < Bushmills> you're welcome
18:07 -!- beshoo [~linada@31.9.205.158] has joined #openvpn
18:09 < beshoo> finaly i did connect to the server , but the problem now , how can i start brwosing with the VPN , i mean via IE. to route all my trafic to the vbn ?
18:09 < beshoo> Fri Jul 01 02:02:46 2011 OPTIONS IMPORT: route options modified Fri Jul 01 02:02:46 2011 Preserving previous TUN/TAP instance: Local Area Connection 6 Fri Jul 01 02:02:46 2011 Initialization Sequence Completed
18:12 < Bushmills> !redirect
18:12 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
18:13 -!- newmember [~newmember@static-66-11-81-77.ptr.terago.net] has quit [Quit: Leaving]
18:13 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
18:25 -!- ckipping_ [~curt@109.169.54.179] has quit [Ping timeout: 250 seconds]
18:26 -!- arejay [arejay@i.write.shellcode.eu] has quit [Ping timeout: 260 seconds]
18:27 -!- arejay [arejay@i.write.shellcode.eu] has joined #openvpn
18:28 -!- beshoo [~linada@31.9.205.158] has quit []
18:55 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
18:55 < fu[h]ry> well well. client-to-client did it (i thought i tried it at least twice)
18:58 < rothwell> lo. i'm having a bit of trouble understanding how things are supposed to work regarding the "networking" aspect of openvpn
18:58 < rothwell> we've got three class B networks here, 10.1.*.*, 10.2.*.*, 10.3.*.*
18:59 < rothwell> we thought we'd dedicate a fourth (maybe 10.4.*.*) to openvpn... but i'm not sure if that means setting up another subnet with ifconfig and the like, or if that's something openvpn handles itself
19:00 < rothwell> we just have one freebsd box here that routes between the three subnets
19:00 < rothwell> was going to set up openvpn on that
19:00 < Bushmills> rothwell: fourth network for openvpn would be necessary. no need for ifconfig, as openvpn server assigns addresses to connecting clients 
19:01 < rothwell> i see
19:01 < Bushmills> you'll get virtual interfaces for openvpn on both server and clients, preferably tun interfaces, which you can treat as they were physical NICs
19:02 < Bushmills> i.e. routing and such applies
19:02 < rothwell> right, i noticed the use of tun/tap
19:03 < Bushmills> from network administrator view, openvpn resembles a network cable with two NICs, spanning client and server
19:04 < rothwell> ah, just spotted the documentation for the --server directive
19:04 < rothwell> "This directive will set up an OpenVPN server which will allocate addresses to clients out of the given network/netmask."
19:04 < rothwell> makes sense
19:14 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:15 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
19:15 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:15 < snappy> !welcome
19:15 < snappy> !goal
19:15 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:15 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:19 <@vpnHelper> RSS Update - forum: can receive email but it will not send <http://forums.openvpn.net/topic8382.html>
19:23 < snappy> !/30
19:23 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
19:25 < snappy> Hm the /30 doc is very insightful. How does openvpn server bind the 192.168.1.5 virtual address. My client received a /30 block, but I don't see any of the addresses in the /30 showing on the openvpn server side.
19:25 < snappy> I'm using freebsd.
19:26 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
19:26 < snappy> !topology
19:26 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
19:36 < Bushmills> snappy: it doesn't.  for client, 192.168.1.5 is "other end of tunnel". server is there, so it doesn't need to associate itself with 192.168.1.5
19:40 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
19:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:44 < snappy> Sorry, I don't follow or I'm confused. The client address is 192.168.1.6. The doc says 192.168.1.5 is the virtual IP of the openvpn server (and docs can be incorrect).
19:44 < Bushmills> nope. that's the client's idea of "remote machine"
19:44 < Bushmills> server is unaware of that
19:47 < Bushmills> i try a poor analogy: you have a box in your room, written "outgoing mail" on it. what you drop in, somebody picks up and brings it to the post office.  the post office doesn't need to know that it is associate with "outgoing mail" - it merely has to deal with the actual letters brought there
19:47 < snappy> I'm seeing all routes (def1 and the 192.168.1/24) next-hop is 192.168.1.5. But then 192.168.1.5/32 routes to 192.168.1.6 (which is the client side IP)
19:47 < Bushmills> the "outgoing mail" box is equivalent to 192.168.1.5
19:49 < Bushmills> 192.168.1.x is btw not a good choice of openvpn subnet
19:49 < snappy> ok, that analogy i can comprehend. But for all traffic destined to 192.168.1.5, it then seems to return to the client 192.168.1.6. According to my routing table anyway.
19:49 < snappy> Yep, I'm just going from the documents example, but let me paste my routing table
19:50 < Bushmills> 192.168.1.6 is client's idea of itself. actually, also server's idea.
19:50 < snappy> http://codepad.org/h3Y5dk6c
19:50 <@vpnHelper> Title: Plain Text code - 5 lines - codepad (at codepad.org)
19:50 < snappy> yeah, that's what seems ambiguous
19:51 < snappy> All traffic seems to be going to .5, but then forwarded back to the client assigned address .6.
19:51 < Bushmills> that's because server will have to track several clients.  server != point to point setup
19:51 < Bushmills> in case of point to point, both ends would have a local-only idea of remote 
19:51 < Bushmills> though they may happen to match remotes end of itself
19:53 < Bushmills> to match remote's *idea* of itself
19:55 < snappy> Hm, yeah, this might take a bit to sink in.
19:55 < rothwell> hm, i'm using our private CA to sign certificates, but is it possible to outright reject certificates not known by the server?
19:56 < snappy> On another note, is it possible to have the client side specifiy the remote DNS server in the config, or the server push it -- in routed mode? Not sure if this is delegated to the client or can be controlled by the server.
19:56 < snappy> or not responsibility of server/client in routed mode.
19:56 < Bushmills> yes, possible
20:07 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
20:07 < snappy> I think I understand the /30 now. It appears that the tun0, while appearing as a p-t-p device, the underlying /24 is a directly connected route for the interface.
20:08 < snappy> so an arp exchange for 192.168.1.1 will occur over tun0, even if .5 doesnt exist.
20:10 < Bushmills> arp traffic shouldn't traverse tun tunnels
20:12 < snappy> hm, you're right; this is a little complicated to understand. What I'm reading from querying entries in the routing table (versus displaying the table) seems to be different
20:13 < snappy> route get 10.199.199.5, has a destination of 10.199.199.5 (but the routing table says 10.199.199.5 next hop is 10.199.199.6)
20:13 -!- master_of_master [~master_of@p57B52913.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:15 -!- master_of_master [~master_of@p57B52A76.dip.t-dialin.net] has joined #openvpn
20:26 < rothwell> one of the networks here is private and is not allowed any incoming connections (it is obviously allowed incoming packets in response to outgoing connections)
20:26 < rothwell> am i going to have to allow incoming connections for it to be able to participate meaningfully in the vpn?
20:26 < Bushmills> if there's a client, you should be allright
20:27 < rothwell> how d'you mean?
20:27 < rothwell> there'll only be clients in that private network, if that's what you meant
20:27 < rothwell> no servers
20:27 < Bushmills> client there connects to remote server. then traffic to that network can be tunneled through vpn
20:28 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
20:28 < rothwell> right
20:28 < rothwell> seems fine, then
20:28 < Bushmills> clients can't connect to other clients
20:28 < rothwell> nope
20:56 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has quit [Quit: Linkinus - http://linkinus.com]
20:58 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:01 < rothwell> hm... am i right in thinking that an 'ifconfig-push' in a client-specific config file on the server should cause the given address to be assigned to the tun/tap device on the client?
21:06 < Bushmills> right
21:06 < rothwell> hm... doesn't seem to be happening
21:06 < rothwell> everything works fine if i assign the address manually on the client with ifconfig (the actual ifconfig program)
21:07  * rothwell tries a few things
21:08 < Bushmills> check client log file
21:15 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:16 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:20 < rothwell> i can't see any obvious errors, but a lack of a message might be an error in itself...
21:20 < rothwell> http://paste.lisp.org/display/123064
21:20 < rothwell> Fri Jul  1 03:15:14 2011 us=520873 UDPv4 link local (bound): [undef]:1194
21:20 < rothwell> that looks somewhat suspicious
21:23 < Bushmills> there's no PUSH_REQUEST,  therefore no PUSH_REPLY
21:24 < Bushmills> seems your client config is missing something.  maybe   "client"
21:24 < rothwell> will check
21:26 < rothwell> yep, that was it
21:26 < rothwell> thanks
21:27 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:33 -!- EugeneKay is now known as EugeneKaway
21:43 < rothwell> i'm impressed at how well this has worked
21:44 < rothwell> we've quite a strict network policy here and openvpn's played well with it
21:44 < rothwell> quite painless setup
21:46 < Bushmills> makes one think ... even with that strict policy, a person installing openvpn client on a machine pierces your firewall and potentially enables full access from the outside :)
21:49 < rothwell> hehe
21:50 < rothwell> is always a risk... i'm hoping i've added enough layers of protection to make it infeasible
21:51 < Bushmills> that possibility is not specific to openvpn, but to tunneling software in general. openvpn adds a layer of encryption to it.
21:51 < rothwell> yeah
21:59 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13334>
22:11 -!- EugeneKaway is now known as EugeneKay
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:11 -!- EugeneKay [eugenekay@chaoschaoschaos.com] has quit [Read error: Operation timed out]
23:13 -!- EugeneKay [eugenekay@chaoschaoschaos.com] has joined #openvpn
23:28 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:29 -!- p3rror [~mezgani@41.140.39.248] has joined #openvpn
23:37 -!- arejay [arejay@i.write.shellcode.eu] has quit [Ping timeout: 264 seconds]
23:37 -!- dazo_afk is now known as dazo
23:52 < hyper_ch> !mesh
23:52 <@vpnHelper> "mesh" is (#1) openvpn does not do mesh networking, or (#2) see !rip
23:52 -!- diemos [~root@2600:3c01::f03c:91ff:fe93:dabe] has joined #openvpn
23:52 < diemos> !rip
23:52 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
23:53 < hyper_ch> hi diemos
23:53 < diemos> hiiii
--- Day changed Fri Jul 01 2011
00:05 -!- EugeneKay is now known as EugeneKaway
00:06 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 276 seconds]
00:08 -!- EugeneKaway is now known as EugeneKay
00:09 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
00:16 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 276 seconds]
00:26 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
00:51 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Read error: Connection reset by peer]
01:07 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Read error: Operation timed out]
01:17 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
01:17 <@vpnHelper> RSS Update - forum: --http-proxy or --auto-proxy MUST be used in TCP Client mode <http://forums.openvpn.net/topic8383.html>
01:34 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:34 -!- mode/#openvpn [+o mattock] by ChanServ
01:39 < rothwell> is there a pleasant way to generate csrs on windows?
01:39 < rothwell> perhaps a wizard? the .bat files aren't going to fly with some of my non-technical users...
02:04 -!- p3rror [~mezgani@41.140.39.248] has quit [Quit: Leaving]
02:04 -!- EugeneKay is now known as EugeneKaway
02:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:31 < rothwell> ended up using 'mycert'... http://mycert.sandbox.cz
02:31 <@vpnHelper> Title: My Certificate Wizard (at mycert.sandbox.cz)
02:32 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:48 <@vpnHelper> RSS Update - forum: routing <http://forums.openvpn.net/topic8384.html>
02:54 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
03:06 < Mowee> Morning
03:31 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
03:31 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
03:31 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:34 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Quit: Verlassend]
04:03 -!- vai_ [~vai@168.144.28.208] has joined #openvpn
04:03 < vai_> where does openvpn store log iles?
04:03 < vai_> *files
04:04 < vai_> don't tell me, it's SQL logged... :(**
04:07 < reiffert> syslog, logfile of your coice,
04:07 < reiffert> !factoids search --values log
04:07 <@vpnHelper> 'router', 'pfsense', 'net30', 'all', 'nocert', 'lintrafaccnt', 'wins', 'authpass', 'allinfo', 'all', 'changelog', 'donate', 'logs', 'logs', 'log', 'logfile', 'logfile', 'iphone', 'verb', 'irclogs', 'welcome', 'duplicate', 'bugs', 'ircstats', 'ircstats', 'static', 'multi_process_incoming_tun', 'tcp_nodelay', 'changelog', 'strip-passphrase', 'subscription', 'change-log', 'change-log', 'change-log', '/30',
04:07 <@vpnHelper> 'topsecret', 'topology', 'trac', and 'slowesxi'
04:08 < reiffert> !logs
04:08 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
04:08 < reiffert> !log
04:08 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
04:08 < reiffert> !logfile
04:08 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
04:08 < reiffert> !topsecret
04:08 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
04:08 < reiffert> :)
04:16 < snappy> Anyone have issues with websites going through a routed vpn tunnel instead of your isp? I am trying to login to a web app, and it seems to have issues with session handling when im on the vpn, but works fine when im off it.
04:20 -!- metalfan_ [~julius@p3EE2B385.dip.t-dialin.net] has joined #openvpn
04:20 < metalfan_> hi
04:21 < metalfan_> how can i include another dial up machine into a vpn configuration for 2 machines?
04:21 < metalfan_> the howtos only cover machines in the same subnet
04:22 < snappy> well shit, nevermind, misbehaving web app in the end
04:30 < reiffert> !route
04:30 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
04:31 < vai_> Jul  1 12:31:10 l28 pptpd[19863]: CTRL: Starting call (launching pppd, opening GRE)
04:31 < vai_> Jul  1 12:31:10 l28 pptpd[19863]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
04:31 < vai_> Jul  1 12:31:10 l28 pptpd[19863]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)
04:32 < vai_> any idea for this?
04:32 < vai_> what causes this? I can't log in from Windows XP to the OpenVPN 
04:32 -!- EugeneKaway [eugenekay@chaoschaoschaos.com] has quit [Quit: OMG WTF BBQ ZNC FTW]
04:32 -!- EugeneKaway [eugenekay@chaoschaoschaos.com] has joined #openvpn
04:33 -!- EugeneKaway is now known as EugeneKay
04:33 < reiffert> vai_: pptpd is the point to point tunneling protocol daemon
04:33 < reiffert> vai_: so:
04:33 < reiffert> !notovpn
04:33 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
04:36 < vai_> reiffert: openvpn does not depend on pptpd?
04:36 < reiffert> vai_: no.
04:36 < reiffert> !compat
04:36 < reiffert> !factoids search --values pptp
04:36 <@vpnHelper> 'broadcast-relay', 'notcompat', 'bcast', and 'pptp'
04:36 < reiffert> !notcompat
04:36 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
04:36 <@vpnHelper> RSS Update - forum: --http-proxy or --auto-proxy MUST be used in TCP Client mode <http://forums.openvpn.net/topic8383.html#p13337>
04:36 < reiffert> !pptp
04:36 <@vpnHelper> "pptp" is PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read
04:36 <@vpnHelper> about why to not use pptp
04:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:43 < vai_> there's nobody at pptpd?
04:54 -!- metalfan_ [~julius@p3EE2B385.dip.t-dialin.net] has left #openvpn ["Leaving"]
05:04 <@dazo> vai_: nobody is at pptp ... because it's crap ... nobody concerned about security uses it
05:06 <@dazo> vai_: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
05:06 <@vpnHelper> Title: Point-to-Point Tunneling Protocol - Wikipedia, the free encyclopedia (at en.wikipedia.org)
05:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:06 <@dazo> !learn pptp as Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
05:06 <@vpnHelper> Joo got it.
05:14 -!- p3rror [~mezgani@41.140.39.248] has joined #openvpn
05:16 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:16 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:16 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:22 -!- p3rror [~mezgani@41.140.39.248] has quit [Ping timeout: 255 seconds]
05:24 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
05:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:24 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
06:25 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
06:34 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
06:34 < vai_> Dougy: in China they used something like PPPOE
06:36 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 250 seconds]
06:41 -!- LuckyY_ is now known as LuckyY
06:45 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
06:46 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
06:54 -!- DelphiWorld [~Miranda@41.200.0.137] has joined #openvpn
06:54 < DelphiWorld> hello ecrist
06:55 -!- DelphiWorld [~Miranda@41.200.0.137] has quit [Read error: Connection reset by peer]
06:59 -!- DelphiWorld [~Miranda@41.200.0.137] has joined #openvpn
06:59 < DelphiWorld> ecrist: can you cloac me?
06:59 -!- DelphiWorld [~Miranda@41.200.0.137] has quit [Client Quit]
07:10 -!- DelphiWorld [~Miranda@41.200.0.137] has joined #openvpn
07:10 < DelphiWorld> sory ecr bad ISP
07:10 < DelphiWorld> sory ecrist bad ISP
07:11 < ecrist> welcome back
07:11 < ecrist> what were you pinging me for?
07:11 < DelphiWorld> ecrist: :)
07:11 < DelphiWorld> ecrist: could you cloac me?
07:15 < DelphiWorld> ecrist: can you?
07:27 < DelphiWorld> hmmm
07:34 < ecrist> oh, sure
07:37 -!- Gryllida [user@pdpc/supporter/student/gry] has joined #openvpn
07:37 -!- Gryllida [user@pdpc/supporter/student/gry] has left #openvpn []
07:38 -!- luckman212 [~irc@2001:470:1f07:1225:5e9:a437:13fc:6041] has quit [Read error: Connection reset by peer]
07:48 -!- DelphiWorld [~Miranda@41.200.0.137] has quit [Changing host]
07:48 -!- DelphiWorld [~Miranda@openvpn/user/DelphiWorld] has joined #openvpn
07:49 -!- frando [~gaunab@drupal.org/user/21850/view] has joined #openvpn
07:52 < frando> hello. i want to connect to an openvpn over an existing vpnc connection. so to access the internet in my network, i have to use a vpnc vpn. i want to route all traffic through an openvpn as well, though, for anonymity purposes. if i connect to the openvpn after having connected to the vpnc vpn, a new tunnel is created, however, firefox and everything else seems to keep using the first tunnel (vpnc). how can i change that?
07:52 < frando> i'm on ubuntu 10.10
07:52 < frando> so what I want is wlan0 --> vpnc --> openvpn --> internet
07:52 < frando> here are some details: http://ubuntuforums.org/showthread.php?t=1767863
07:52 <@vpnHelper> Title: [all variants] Double VPN connection: openvpn over vpnc - Ubuntu Forums (at ubuntuforums.org)
07:53 < frando> any ideas?
07:56 < ecrist> DelphiWorld: there you go. :)
07:56 < DelphiWorld> ecrist: :D
07:56 < DelphiWorld> ecrist: thank you too much
08:00 < ecrist> no problem.
08:00 < DelphiWorld> ecrist: :D :D
08:00 < DelphiWorld> ectri may piss you of later a bit with tap issue ;)
08:02 < DelphiWorld> ecrist:  i may piss you of later a bit with tap issue ;)
08:02 < ecrist> I'm used to being pissed off
08:03 < Bushmills> frando: route traffic through the interface you desire it to go
08:04 < frando> Bushmills: how do i do taht?
08:04 < frando> *that*
08:04 < Bushmills> by using the tools of your operating system
08:04 < Bushmills> in case of openvpn, you can put route statements into the configuration
08:04 < frando> Bushmills: yeah, I tried to find out how to do that. I'm on ubuntu 10.10. but I got lost. what is the standard tool to do taht
08:05 < Bushmills> route
08:05 < DelphiWorld> ecrist: lol
08:05 < frando> Bushmills: ah, ok. the configuration that I connect with? or someting in /etc?
08:05 < Bushmills> pardon?
08:06 < frando> Bushmills: you said that i put route statements into the configuration. i read that already elsewhere. but i am confused by the different things i read - which is the right configuration file to put the statements into?
08:07 < frando> the openvpn configuration that i connect with ($ openvpn config.ovpn) or a systemwide configruation?
08:08 < Bushmills> for multiple clients, treated identically, you problem want server to push routes to clients, therefore change openvpn server configuration 
08:10 < frando> Bushmills: i don't have access to the openvpn server that i connect to. or is "openvpn server configuration" some config file on the client as well?
08:10 < Bushmills> no. server config is on server
08:10 < Bushmills> on clients there's the client config
08:12 < Bushmills> actually, it's the server config which makes a server a server, and the client config making a client a client, coincidentally.
08:16 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:20 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
08:22 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Client Quit]
08:22 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
08:22 -!- N0DEH is now known as CripperZ
08:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
08:26 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html>
08:45 -!- frando [~gaunab@drupal.org/user/21850/view] has quit [Ping timeout: 258 seconds]
08:50 -!- nixbro [~unknown@59.163.254.66] has joined #openvpn
09:14 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
09:19 -!- DelphiWorld [~Miranda@openvpn/user/DelphiWorld] has quit [Read error: Connection reset by peer]
09:26 <@vpnHelper> RSS Update - forum: vmware view client over openvpn <http://forums.openvpn.net/topic8386.html>
09:31 -!- nixbro [~unknown@59.163.254.66] has quit [Ping timeout: 240 seconds]
09:33 -!- P4C0 [~paco@unaffiliated/p4c0] has joined #openvpn
09:33 < P4C0> hello, is there any option on the openvpn client side to accept the dns setttings? my client doesn't seems to update my resolv.conf
09:36 < ecrist> you need a script to manage that for you
09:36 < ecrist> it's mentioned in the docs
09:36 < P4C0> ecrist: thanks, I'll check it
09:42 < P4C0> ecrist: can you point me the documentation please?
09:42 < ecrist> !man
09:42 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
09:43 < P4C0> thanks
09:47 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:51 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
09:52 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
10:12 -!- cdehaan [80979611@gateway/web/freenode/ip.128.151.150.17] has joined #openvpn
10:21 -!- cdehaan [80979611@gateway/web/freenode/ip.128.151.150.17] has quit [Quit: Page closed]
10:22 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
10:25 -!- luneff [~yury@109.165.89.173] has joined #openvpn
10:31 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
10:31 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
10:38 < ecrist> krzee: fwiw, I'm upgrading xxx today
10:39 < krzee> ok
10:47 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
10:51 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Client Quit]
10:54 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
11:08 -!- dazo is now known as dazo_afk
11:08 <@vpnHelper> RSS Update - forum: Server and Client use wrong IP configuration <http://forums.openvpn.net/topic8387.html>
11:21 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
11:21 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
11:21 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:22 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:32 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:36 -!- P4C0 [~paco@unaffiliated/p4c0] has left #openvpn []
11:39 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
11:40 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Read error: Operation timed out]
11:43 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
11:44 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
11:44 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 244 seconds]
11:58 -!- nixbro [~unknown@124.43.125.250] has joined #openvpn
12:14 <@vpnHelper> RSS Update - forum: Help with shares folders in WinXP with OpenVPN Server Mode <http://forums.openvpn.net/topic8388.html>
12:20 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 255 seconds]
12:26 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:29 -!- luneff [~yury@109.165.89.173] has quit [Quit: Leaving]
12:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
12:54 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:33 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
13:33 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:35 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:35 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
13:38 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 255 seconds]
13:49 -!- syn4pse [~syn@p5DDC086B.dip0.t-ipconnect.de] has joined #openvpn
14:11 -!- nixbro [~unknown@124.43.125.250] has quit [Ping timeout: 252 seconds]
14:12 -!- luneff [~yury@84.51.213.254] has joined #openvpn
14:30 -!- MarKsaitis [~MarKsaiti@gateway04.m3-connect.de] has joined #openvpn
14:53 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
14:58 -!- stephenh [~stephenh@unaffiliated/stephenh] has joined #openvpn
15:14 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
15:14 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
15:15 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has left #openvpn []
15:19 <@vpnHelper> RSS Update - forum: Help with shares folders in WinXP with OpenVPN Server Mode <http://forums.openvpn.net/topic8388.html#p13342>
15:33 -!- MarKsaitis [~MarKsaiti@gateway04.m3-connect.de] has quit [Ping timeout: 252 seconds]
15:54 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13343>
16:23 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
17:23 -!- ba6 [~bag@Pix.producepro.com] has quit [Read error: Connection reset by peer]
17:33 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
17:36 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:59 -!- cpm [~Chip@dns1.daviswv.net] has joined #openvpn
17:59 -!- cpm [~Chip@dns1.daviswv.net] has quit [Changing host]
17:59 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
18:13 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
18:16 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
18:23 <@vpnHelper> RSS Update - forum: Redirect Web Traffic <http://forums.openvpn.net/topic8389.html>
19:00 <@vpnHelper> RSS Update - forum: Can OpenVPN Staff Please Answer What VPN Is and Isn't? <http://forums.openvpn.net/topic8390.html>
19:03 -!- raidz [~Administr@openvpn/corp/admin/andrew] has left #openvpn []
19:08 < EugeneKay> No, they can't, you silly bot.
19:09 < |Mike|> lol
19:23 < EugeneKay> You can tell the stupid just by the title of the post
19:23 <@vpnHelper> RSS Update - forum: Can OpenVPN Staff Please Answer What VPN Is and Isn't? <http://forums.openvpn.net/topic8390.html#p13346>
19:30 <@vpnHelper> RSS Update - forum: Can OpenVPN Staff Please Answer What VPN Is and Isn't? <http://forums.openvpn.net/topic8390.html#p13347>
19:57 -!- nDuff [~cduffy@rrcs-97-79-207-2.sw.biz.rr.com] has left #openvpn ["Leaving"]
20:14 -!- master_of_master [~master_of@p57B52A76.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:16 -!- master_of_master [~master_of@p57B55F90.dip.t-dialin.net] has joined #openvpn
20:21 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:49 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:01 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:10 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
21:14 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
21:15 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:16 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:18 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:26 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 276 seconds]
21:26 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
21:26 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
21:58 -!- syn4pse- [~syn@p5DDC002B.dip0.t-ipconnect.de] has joined #openvpn
22:00 <@vpnHelper> RSS Update - forum: Ubuntu9 I386 64 bit file for OpenVPN <http://forums.openvpn.net/topic8370.html#p13348>
22:00 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:01 -!- syn4pse [~syn@p5DDC086B.dip0.t-ipconnect.de] has quit [Ping timeout: 258 seconds]
22:01 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:06 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has joined #openvpn
22:12 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
22:15 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
22:34 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
22:35 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has quit [Remote host closed the connection]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:38 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has quit [Ping timeout: 246 seconds]
22:39 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has joined #openvpn
22:51 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
23:08 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:42 -!- nixbro [~unknown@124.43.122.95] has joined #openvpn
--- Day changed Sat Jul 02 2011
00:34 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
00:38 -!- olarva [~olarva@189.73.162.192] has joined #openvpn
00:39 -!- olarva [~olarva@189.73.162.192] has quit [Client Quit]
00:41 -!- olarva [~olarva@189.73.162.192] has joined #openvpn
00:41 < olarva> !welcome
00:41 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:42 < olarva> |forum
00:42 < olarva> !forum
00:42 <@vpnHelper> Ubuntu9 I386 64 bit file for OpenVPN || Can OpenVPN Staff Please Answer What VPN Is and Isn't? || Redirect Web Traffic || Ovpn windows 7 easy-rsa and ssl || Help with shares folders in WinXP with OpenVPN Server Mode || Server and Client use wrong IP configuration || vmware view client over openvpn || Long setup time || --http-proxy or --auto-proxy MUST be used in TCP Client mode ||
00:42 <@vpnHelper> routing || can receive email but it will not send || Trouble with proxy-arp setup from OpenVPN Cookbook 2 || Multiple PC s on server side but not all can ping clients || Whats the source port range for the openvpn client traffic? || Client doesn't disconnect but can't ping || Using openVPN to bypass bloking firewall || Routing all of traffic through VPN and SSH || OpenVPN via 3proxy
00:42 <@vpnHelper> (socks) problem (usermane/login) || New Openvpn install and DNS is broken but good. || How to backup and restore openvpn config and certificates || VPN clients cannot ping to each other || error connecting to the second VPN client on the same host || OpenVPN slow down after switch change || Accessing other subnets with bridged connection || From School To Home Server (VMs) || OpenVPN (4 more messages)
00:43 < olarva> !iporder
00:43 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
00:44 < olarva> !goal
00:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:01 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
01:10 -!- sia^pwnnt [115kluu@server1.bouncer4you.de] has quit [Read error: Operation timed out]
01:35 -!- nixbro [~unknown@124.43.122.95] has quit [Ping timeout: 250 seconds]
01:38 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
01:39 -!- luneff [~yury@84.51.213.254] has quit [Ping timeout: 252 seconds]
01:42 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
01:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
02:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:05 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Connection reset by peer]
02:36 -!- nixbro [~unknown@124.43.127.108] has joined #openvpn
02:43 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:19 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
03:20 -!- CripperZ is now known as N0DEH
03:37 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
03:43 -!- EugeneKay is now known as EugeneKaway
03:43 -!- EugeneKaway is now known as EugeneKay
03:44 -!- luneff [~yury@84.51.195.189] has joined #openvpn
03:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:47 -!- nixbro_ [~unknown@124.43.127.108] has joined #openvpn
03:47 -!- nixbro [~unknown@124.43.127.108] has quit [Read error: Connection reset by peer]
03:51 -!- nixbro_ [~unknown@124.43.127.108] has quit [Ping timeout: 258 seconds]
03:51 -!- nixbro [~unknown@124.43.120.254] has joined #openvpn
03:54 -!- nixbro [~unknown@124.43.120.254] has quit [Read error: Connection reset by peer]
03:54 -!- nixbro [~unknown@124.43.120.254] has joined #openvpn
04:01 -!- EugeneKay is now known as EugeneKaway
04:11 -!- nixbro_ [~unknown@124.43.120.254] has joined #openvpn
04:11 -!- nixbro [~unknown@124.43.120.254] has quit [Read error: Connection reset by peer]
04:16 -!- nixbro_ [~unknown@124.43.120.254] has quit [Ping timeout: 276 seconds]
04:28 -!- luneff [~yury@84.51.195.189] has quit [Quit: This computer has gone to sleep]
04:37 -!- nixbro [~unknown@124.43.120.254] has joined #openvpn
04:39 -!- nixbro [~unknown@124.43.120.254] has quit [Client Quit]
04:44 <@vpnHelper> RSS Update - forum: have some question yet.. <http://forums.openvpn.net/topic8391.html>
04:46 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
05:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:05 -!- luneff [~yury@46.41.89.223] has joined #openvpn
05:38 -!- syn4pse- [~syn@p5DDC002B.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
05:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 276 seconds]
06:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
06:11 < afuentes> !logs
06:11 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
06:12 < afuentes> !configs
06:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
06:18 < hyper_ch> !iphone
06:18 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN
06:18 <@vpnHelper> for iPhone and iPad.
06:24 < afuentes> goal: vnp bridge. Problem: I cant ping the server 10.9.8.1 fron the client 10.9.8.50. server.conf: http://pastebin.com/Lsrg2Jqq .client.conf: http://pastebin.com/j7gYqber .routes on the client: http://pastebin.com/6yJKp9i8 .routes on server: http://pastebin.com/fQtMhuyn .tap0 on client:http://pastebin.com/FshMgH19 ,br0 on server:http://pastebin.com/hpKMBMK0
06:34 -!- syn4pse [~syn@p5DDC002B.dip0.t-ipconnect.de] has joined #openvpn
06:40 < Bushmills> why tap?
06:42 < hyper_ch> hi Bushmills
06:42 < hyper_ch> happy saturday to you
06:42 < Bushmills> grias di hyper_ch
06:43 < hyper_ch> you speak Bavarian?
06:46 < Bushmills> i understand it. but trying to speak it doesn't sound authentic
06:47 < Bushmills> have lived there for several years
06:53 < syn4pse> I do speak bavarian ;)
06:58 < afuentes> Bushmills, are you asking me?
06:58 < Bushmills> yes
06:58 < afuentes> well, Bushmills, i followed this http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html
06:59 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
06:59 < afuentes> and it says it has to be tap for client
06:59 < Bushmills> !tunortap
06:59 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
06:59 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
06:59 < Bushmills> tap in your case just adds problem potential
07:00 < Bushmills> if you don't have a good reason to use tap, don't use it, specifically not when you're still trying to get client-server to talk to each other
07:01 < afuentes> Bushmills, so i should use tun on both ends?
07:01 < Bushmills> first glimpse at your client and server config doesn't show an obvious problem. chances are that your problem comes from your bridge setup
07:01 < Bushmills> if you don't have a good reason for using tap, you my be better off using tun
07:01 < Bushmills> may
07:02 < afuentes> well, if i nmap 10.9.8.- thru the br0 i can see the whole network, the server included, but not the client :/
07:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
07:04 < afuentes> Bushmills,  ok, ill try to set it up with tun... i just tried with bridging because the it was more like what i had in mind... the client with an ip whitin the lan, the server giving ip, etc...
07:04 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
07:04 < Bushmills> of course there's also the possiblity that your problem is...
07:04 < Bushmills> !firewall
07:04 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
07:04 < afuentes> nah, no firewall at all
07:05 < afuentes> i mean, in the log of the server and the client there is nothing when i try to ping, like nothing tries to use the vpn
07:10 < afuentes> just so i know im not trying anything crazy Bushmills. Is it possible to make the client have an ip within the lan and to have the server giving him ip with tun?
07:12 < Bushmills> openvpn server will assign ip address to client 
07:13 < Bushmills> but you don't want to overlap LAN and openvpn subnet addresses
07:14 < afuentes> so the client wont have an within the range of the network?
07:15 < afuentes> checking the ifconfig in server i saw tap0 does not have any ip... is that ok?
07:15 < Bushmills> depends what "within the range" means.  if your openvpn subnet is, say,  10.11.12.0-127, and your LAN 10.11.12.128-255, would that be "within" or "not within" same range?
07:17 < afuentes> well, i had to manually set the routes on the server if thats the case... with the bridge interface it seems simpler :)
07:18 < Bushmills> well, of course you're free to use what you prefer
07:18 < Bushmills> though "bridge is simpler" is your opinion, not mine.
07:19 < afuentes> i wouldnt say its my opinion... i dont know enough about this to have an opinion yet lol
07:19 < afuentes> I saw that bridging everything seems to be set up more transparently, altho i was not able to make either work :/
07:20 < Bushmills> vpn specific routes on server or client are set through vpn config, not manually
07:20 < afuentes> ok, ill try to make it with tun now
07:21 < afuentes> lets see what i mess up now :)
07:21 < afuentes> thanks btw Bushmills 
07:23 < hyper_ch> Bushmills: Ozaapft is :)
07:23 < hyper_ch> (in a couple of months)
07:24 < Bushmills> in zwoa dogn?
07:25 < hyper_ch> doesn't it start some time in september?
07:25 < Bushmills> ah, in zwoa monatn . jo
07:29 < hyper_ch> :)
07:30 < hyper_ch> you can do it quite good :)
07:31 -!- luneff [~yury@46.41.89.223] has quit [Quit: This computer has gone to sleep]
07:46 < ecrist> good morning, fuckers
07:48 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
07:58 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
07:59 < afuentes> Bushmills, i used tun and im now able to ping the server interface of my lan from the client, but im not able to ping other computers in the lan. i have client-to-client. Do i need to do a masquerade in the server to push the traffic to the lan or something?
08:00 < afuentes> i pushed the lan route to the client
08:05 < afuentes> here are the conf files http://paste.debian.net/121673/
08:14 -!- N0DEH is now known as CripperZ
08:14 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:26 -!- CripperZ is now known as N0DEH
08:29 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:30 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
08:33 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
08:33 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:17 -!- K1ng`` [~KING@180.211.188.81] has joined #openvpn
09:19 -!- K1ng` [~KING@180.211.188.123] has quit [Ping timeout: 240 seconds]
09:52 -!- luneff [~yury@84.51.213.254] has joined #openvpn
10:01 < krzee> afuentes, 
10:01 < krzee> !clientlan
10:01 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
10:01 <@vpnHelper> better explanation
10:05 <@vpnHelper> RSS Update - forum: have some question yet.. <http://forums.openvpn.net/topic8391.html#p13351> || can receive email but it will not send <http://forums.openvpn.net/topic8382.html#p13350>
10:11 <@vpnHelper> RSS Update - forum: Free providers? <http://forums.openvpn.net/topic8391.html#p13351>
10:14 < afuentes> !ipforward
10:14 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
10:14 < afuentes> !linipforward
10:14 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
10:15 < afuentes> krzee, i don really need the lan on the client. I just need the client to access the lan on the server
10:15 < afuentes> !route
10:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:24 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:36 < krzee> afuentes, oh ok
10:36 < krzee> !serverlan
10:36 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
10:36 < afuentes> very nice tutorial krzee :) ( the one in ! route)
10:36 < krzee> thanx
10:36 < krzee> =]
10:38 < afuentes> definetly thats my problem :)
10:39 < afuentes> i would solve it by adding the route by hand in clients... just one more question
10:39 < krzee> if you can reach lan ip of server, then your problem is:
10:39 < krzee> !route_outside_ovpn
10:39 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
10:39 < afuentes> would a masquerade in the server would work?
10:39 < krzee> but ya, you could add the route to each machine if you prefer
10:39 < krzee> yes, that is the nathack
10:39 < krzee> !nathack
10:39 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
10:40 < krzee> you shouldnt do tht when you have the choice
10:41 < afuentes> actually its just a machine in the lan... ill put the default gw to the server and remove the interface i was using for testing :)
10:41 < afuentes> ill put the default gw to aim to the server*
10:41 < krzee> doesnt need to be default
10:41 < krzee> could just be the route for the vpn subnet
10:42 < afuentes> its the only interface it is going to have anyway :)
10:42 < krzee> it must be on the lan as well...
10:42 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:42 < krzee> or are you briding or something...?
10:42 < afuentes> no, tuneling
10:43 < krzee> ya your lan machine needs a lan ip
10:45 < afuentes> awesome krzee! i just changed the default gw and everything is working as i wanted it to work
10:45 < afuentes> thanks! definetly the ! route tutorial gave me the hint :DDDDDD
10:46 < afuentes> ive been all day with this
10:47 < krzee> cool, glad it helped =]
10:48 < afuentes> ;D
10:50 < Mowee> Hey
10:55 < Bushmills> afuentes: 
10:55 < Bushmills> !route
10:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:55 < Bushmills> !serverlan
10:55 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
10:55 < Bushmills> !clientlan
10:55 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
10:55 <@vpnHelper> better explanation
10:56 < krzee> he found it Bushmills =]
10:56 < Bushmills> ah
10:57 < Bushmills> yes. i should just have read on
10:57 < krzee> how ya doin
11:08 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
11:10 < afuentes> thanks anyway Bushmills :D
11:21 < Bushmills> ok. not too bad. not very fit today. 
11:36 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
11:36 < Bushmills> afuentes: client-to-client is only for openvpn clients talking to each other
11:37 < afuentes> thanks for the pointer! i sure dont need that then
12:02 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 250 seconds]
12:18 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
12:21 -!- EugeneKaway is now known as EugeneKay
12:22 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
12:29 < krzee> !c2c
12:29 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
12:29 <@vpnHelper> clients
12:38 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:38 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:38 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:22 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
13:33 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
13:36 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
13:37 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
13:38 -!- Cain` is now known as Cain
13:49 -!- openvpn2009 [~a@openvpn/corp/admin/patel] has joined #openvpn
13:49 -!- mode/#openvpn [+o openvpn2009] by ChanServ
13:52 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
14:19 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 244 seconds]
14:19 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
14:24 -!- olarva [~olarva@189.73.162.192] has quit [Quit: WeeChat 0.3.4]
14:31 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:49 -!- N0DEH is now known as CripperZ
15:08 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 258 seconds]
15:08 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
15:36 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:58 -!- CripperZ is now known as N0DEH
16:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
16:10 -!- mids [~user@unaffiliated/mids] has joined #openvpn
16:23 -!- syn4pse [~syn@p5DDC002B.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
16:27 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Ping timeout: 258 seconds]
16:34 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
16:34 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
16:43 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 276 seconds]
16:57 -!- syn4pse [~syn@p5DDC002B.dip0.t-ipconnect.de] has joined #openvpn
17:14 -!- roniez [~roniez@asxen.nl] has joined #openvpn
17:15 < roniez> !welcome
17:15 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:23 < roniez> hey
17:23 < roniez> aum got a question its kinda odd
17:23 < roniez> related to windows xp sp3 and openvpn 
17:23 < roniez> maybe its easier if i just pasteibin the problem 
17:23 < roniez> http://pastebin.com/kCU5yJz2
17:23 < roniez> The same keys works fine in a linux enviorment
17:29 < roniez> !sample
17:29 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
17:33 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
17:52 < krzie> Sun Jul 03 00:14:19 2011 Cannot load private key file windows.crt: error:0906D06C:PEM
17:52 < krzie> wrong path in config file
17:52 < krzie> there is no path you say?? thats the problem
17:53 < roniez> krzie: check the pastebin 
17:53 < roniez> it says all paths correctly no_
17:54 < roniez> or do i need to specify via c:\
18:02 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
18:05 < krzie> !path
18:05 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
18:06 < krzie> !winpath
18:06 <@vpnHelper> "winpath" is (#1) Remember on Windows to quote pathnames and use double backslashes, e.g.: "C:\\Program Files\\OpenVPN\\config\\foo.key", or (#2) also, you can use forward slashes to avoid needing double backslashes, but you still need quotes, e.g.: C:/Program Files/OpenVPN/config/foo.key (but surrounded by quotes)
18:16 -!- riskystep [~demian@nl3.ovpn.to] has joined #openvpn
18:20 < riskystep> Hey, I'm not sure if this is an OpenSUSE question or an OpenVPN one, however, I have a machine set up as NAT on a private network on eth0, routing traffic to wlan0 which has internet access. Then I want to have the gateway machine act as a client to an OpenVPN server, routing all traffic from eth0 to the VPN. Well, I can connect to the VPN fine but as soon as I do my client machines lose any internet access, rather than being routed through the VPN. Can 
18:20 < riskystep> anyone help me with this problem?
18:20 < riskystep> the reason I say Op[enSUSE is because my NAT is all configured via YaST
18:20 < roniez> ah 
18:20 < roniez> krzie: thanks 
18:21 < riskystep> !goal
18:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:24 -!- riskystep [~demian@nl3.ovpn.to] has quit [Remote host closed the connection]
18:25 -!- riskystep [~demian@nl3.ovpn.to] has joined #openvpn
18:25 < roniez> krzie: still no go
18:27 < roniez> krzie: i still get the following now un Jul 03 01:25:28 2011 Cannot load private key file C:\Program Files\OpenVPN\config\windows.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
18:28 < krzie> lets see the line from your config
18:28 < krzie> the line with windows.crt
18:29 < roniez> pastebin coming
18:29 < krzie> and are you starting it as admin?
18:29 < roniez> windows xp machine 
18:29 < roniez> and yes
18:30 < roniez> http://pastebin.com/3GGWwV34
18:30 < Bushmills> riskystep: "as soon as I do my client machines lose any internet access" sounds as if your clients *are* routed through openvpn, but server hasn't been configured as NAT gateway, or its firewall interferes
18:31 < Bushmills> by "server" i mean the openvpn server, not your suse server acting as openvpn client
18:34 < riskystep> hmm, are you saying unless I can configure the actual openvpn server I'm boned? I thought it would work pretty much the same as if I had a machine connected to a vpn with a virtual machine inside
18:35 < riskystep> (the virtual machine routes through the vpn)
18:35 < roniez> krzie: u want the server config aswell?  or have you already looked at it.
18:35 < Bushmills> if the actual openvpn server doesn't route incoming requests to internet, then there's nothing the client can do about it
18:36 < riskystep> er, maybe im misunderstanding you, but I am using that openvpn server at the moment on my gateway pc
18:36 < krzie> key "C:\\Program Files\\OpenVPN\\config\\windows.crt"
18:36 < krzie> cert "C:\\Program Files\\OpenVPN\\config\\windows.crt"
18:36 < riskystep> so it does have internet access
18:36 < krzie> see the problem there roniez ?
18:36 < roniez> oh shit
18:36 < roniez> let me test.
18:37 < krzie> the config option key needs to point to the private key, not the cert
18:37 < roniez> oh krzie 
18:37 < roniez> yea
18:37 < roniez> that solved it 
18:37 < roniez> i feel so noob
18:37 < krzie> you're welcome ;]
18:37 < roniez> looked at this problem for a few hours
18:37 < krzie> meh, it happens
18:37 < roniez> thanks a bunch m8 
18:37 < krzie> ive certainly had my share of typos
18:37 < roniez> :D
18:37 < roniez> wicked it works smooth 
18:37 < roniez> i likeit
18:38 < krzie> Bushmills could vouch for that, lol
18:38 < Bushmills> riskystep: not knowing your configuration, it may still deny packets from a different subnet than the wlan subnet
18:39 < Bushmills> anyway, what happens further up the line is 
18:40 < riskystep> ah I think I see what you mean. So when I'm virtualizing, it works becaause the virtual machine is still on the 192.168.1.* subnet?
18:40 < Bushmills> something i can only speculate about.  clients losing internet access is a sign, however, that they *are* affected by the attempt to reroute their traffic
18:41 < reiffert> mushbills!
18:41 < reiffert> zrkie!
18:41 < Bushmills> that's how i feel, yes
18:41 < riskystep> well, the thing is this
18:42 < reiffert> feeling because of?
18:42 < Bushmills> krzie: vouch for what?
18:42 < riskystep> if I connect to the wlan with my laptop and set my desktop as the gateway, it is on the 10.0.1.* subnet, but gets routed to another wireless network on 192.168.1.* which has internet access
18:42 < Bushmills> reiffert: not sure. maybe the monthly sleep period approaches again
18:43 < riskystep> and that laptop with the 10.0.1.3 IP CAN connect to the VPN if I do it locally
18:43 < roniez> is there anyway to test what dns server a windows box tries to use
18:43 < reiffert> Bushmills: ah, I'm with you, I fell asleep for the last two days
18:43 < Bushmills> 2 days!  that's enough for the next half a year
18:43 < reiffert> Bushmills: after that I decided that I need another coffee maschine for $home, so I got one for 180 EUR only from mannheim
18:44 < Bushmills> that's about the flat service fee with components included for your current one 
18:44 < reiffert> Bushmills: kaffeetom.de, a small and very nice "kaffee maschine reperatur service glitsche"
18:45 < Bushmills> ask him about error #4, please :)
18:45 < reiffert> got a jura impressa E60
18:45 < reiffert> 12 month waranty included
18:45 < Bushmills> i *think* it is temperature sensor related
18:45 < reiffert> thats the guy who needs another online shop system I was messaging to you the other day
18:46 < Bushmills> impressa S9
18:46 < reiffert> he got another S9 for 300 IIRC
18:47 < reiffert> he was quite intrested in someone to work out a new shop system and exchange some used maschines 
18:47 < Bushmills> yeah, i read that. but a shop system is - well - there's the potential of people trying to probe it's shortcomings, and i'd not like to carry the burden of responsibility for that
18:48 < reiffert> install it, hand over the windows shop backend to him, done
18:48 < Bushmills> s/potential/guaranty/
18:48 < Bushmills> then he'll sue me
18:48 < reiffert> he seems pretty familiar with GUI stuff on MS
18:49 < reiffert> I can introduce you to each other, if you like
18:50 < reiffert> it's a one man show, please have a look at kaffeetom.de
18:50 < Bushmills> will he fix my espresso machine, if i promise him not to sue him if it doesn't keep up functioning for another 2 years?
18:51 < reiffert> try him, I cant tell you
18:51 < Bushmills> he could fix it for having declined setting up a shop system for him in his own interest :) 
18:51 < reiffert> mannheim should be close enough to your place, isnt it?
18:51 < Bushmills> yes, not too far
18:52 < Bushmills> within reach
18:52 < Bushmills> could even make a show from hooking up the machine on the scooter
18:52 < reiffert> approx 59km, 40 min
18:54 < riskystep> hmm is there any information I can give that would enable you to help me =D
18:54 < Bushmills> riskystep: try mtr or traceroute
18:56 < riskystep> hmm, well, if I try a traceroute from my laptop to an external IP, it gets to 10.0.1.2 (the gateway machine running the openvpn client) and then dies
18:56 < riskystep> from the gateway the trace goes first though 172.16.32.1 then to the net without a problem
18:56 < reiffert> Bushmills: really, I'd try him
18:57 < riskystep> I thought then I could type on the gateway  /bin/ip route add 10.0.1.2 via 172.16.32.1
18:57 < riskystep> and get it to work, but no dice
18:58 < Bushmills> http://kaffeetom.de////UserFiles/Image/articles/20_1251097152.jpg  that one looks pretty much like mine
18:59 < Bushmills> riskystep: i'd examine that machine
19:00 < Bushmills> firewall, nat, ip forwarding, all those pesky details
19:00 < riskystep> well my thought was that it just doesnt know that eth0 has to now be routed to tap0 since the adap[ter didnt exist when the firewall and stuff was configured
19:01 < riskystep> I guess I'll have to start with the old change stuff until it works lol
19:01 < Bushmills> riskystep: you don't route an interface. you route network packets by destination address
19:01 < Bushmills> and tap probably introduces an additional problem reservoir
19:02 < riskystep> yeah.... maybe I should try a tun connection first before I drive myself crazy>?
19:02 < Bushmills> well, not tap as such, but the bridge which probably goes along with it
19:02 < Bushmills> yes, probably. 
19:03 < riskystep> Got the NAT working through YaST in opensuse, works great but I think that could be a source of my pain as well =\ the firewall configuration tool doesnt show the tap interface
19:03 < riskystep> so I guess I'll try tap, then vanilly ipchains before I come back here lol
19:04 < riskystep> er tun
19:04 < Bushmills> reiffert:  "Zum Festpreis* von 79,50 Euro erwacht Ihre Maschine zu neuem Leben." sounds good
19:06 < reiffert> tell him greetings from the thomas "tom" with long red hair from mainz/wiesbaden  :)
19:07 < reiffert> I met him on friday
19:07 < Bushmills> and he immediately sold you another espresso machine?
19:08 < reiffert> nah, just the one that I wanted to buy
19:08 < Bushmills> one for the office, the other for home?
19:08 < reiffert> asking to wether to buy the E40 or E60 he couldnt answer me, thats what I call "fair"
19:09 < reiffert> the one we were reparing last week, the E10, is at the office atm
19:09 < reiffert> and the "new" one, the E60 is at my kittchen right now
19:09 < Bushmills> you'll give me a demonstration?
19:09 -!- riskystep [~demian@nl3.ovpn.to] has quit [Ping timeout: 244 seconds]
19:10 < reiffert> sure
19:10 < reiffert> the E60 is basically the same than the E10
19:10 -!- riskystep [~demian@99-51-161-119.lightspeed.brfrct.sbcglobal.net] has joined #openvpn
19:10 < reiffert> slight modifications on the logic print
19:13 < Bushmills> renesas controller?
19:13 < reiffert> it got the same bruehgruppe, mahlwerk and heater
19:13 < reiffert> renesas?
19:14 < Bushmills> http://am.renesas.com/index.jsp
19:14 <@vpnHelper> Title: Renesas Electronics America (at am.renesas.com)
19:14 < reiffert> If you like to join us tomorrow try to bring along some coffee 
19:15 < reiffert> renesas: no clue
19:15 < reiffert> think I've got another 10 cups of beans, but thats it ..
19:15 < Bushmills> id have expected me in the vicinity around monday or tuesday
19:16 < reiffert> I should be in Gonsenheim those days ..
19:16 -!- demian [~demian@212.117.162.218] has joined #openvpn
19:16 < Bushmills> ah. the home of the gonsen
19:16 -!- riskystep [~demian@99-51-161-119.lightspeed.brfrct.sbcglobal.net] has quit [Ping timeout: 264 seconds]
19:17 -!- demian is now known as riskystep
19:18 < riskystep> hmm well I tried a totally different vpn, and tun, same results which leads me to believe its indeed related to my NAT configuration rather than the vpn server =\
19:19 < reiffert> !nat
19:19 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
19:19 < Bushmills> riskystep: if your openvpn can talk to openvpn server, that's about most of what you get from openvpn - other things like routing to internet or LANs is your operating system configuration
19:19 < Bushmills> ...openvpn clients can talk to...
19:20 < riskystep> !linnat
19:20 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
19:21 < riskystep> ok so I am going to ditch opensuse's firewall then because I think its only going to cause me headaches and make it nearly impossible to find help
19:21 < SigmaProjects> every house or so, openvpn.. re-negotiates a key?  i would say reconnect, but I dont think so, why does it do this?  (term name for docs?)
19:21 < SigmaProjects> every hour*
19:21 < reiffert> re-negotiate
19:22 < Bushmills> riskystep: most firewall "frontend" interfaces lack the expressive power of using the low level commands directly
19:22 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
19:22 < reiffert>        --reneg-sec n
19:22 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has left #openvpn []
19:23 < Bushmills> reneg:  protection against key reversing. 
19:23 < SigmaProjects> thank you reiffert, that brought me to the right stuff
19:23 < Bushmills> in the extremely unlikely event that a key is derived from analyzing traffic, until then there's already a new key in operation
19:23 < reiffert> got any issues with renegotiation?
19:24 < SigmaProjects> nope, just didnt know what it was exactly
19:24 < SigmaProjects> just saw it in logs
19:25 < Bushmills> and there's less substance to analyse, using the same key
19:26 < SigmaProjects> now that I know it, i dont mind it being the default every hour, would like it stop showing up in the log.. verb 1 maybe?
19:27 < rothwell> lo. is there a means to see what users are currently logged in to the vpn?
19:27 < reiffert> rothwell: --status     see manpage
19:27 < rothwell> reiffert: oh, right, thanks
19:29 < rothwell> don't suppose there's a grammar for the status file formats, is there?
19:29 < reiffert> it's parsable.
19:31 < rothwell> oh, er, i assume the status file path is post-chroot?
19:35 < Bushmills> management interface knows "status" command, same format
19:37 < rothwell> Bushmills: ah, wasn't aware of the management interface... reading the docs now
19:38 < Bushmills> status 3   is nicely parseable
19:41 < diemos> YAY
19:42 < diemos> wrong channel.
19:43 -!- demian [~demian@99-51-161-119.lightspeed.brfrct.sbcglobal.net] has joined #openvpn
19:43 -!- riskystep [~demian@212.117.162.218] has quit [Ping timeout: 264 seconds]
19:47 < EugeneKay> Can we YAY anyway?
19:56 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:14 < Bushmills> grin... "may i ask a metaquestion?"
20:15 -!- master_of_master [~master_of@p57B55F90.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:16 -!- master_of_master [~master_of@p57B55CC1.dip.t-dialin.net] has joined #openvpn
20:16 <@vpnHelper> RSS Update - forum: routing <http://forums.openvpn.net/topic8384.html#p13352>
20:23 <@vpnHelper> RSS Update - forum: Redirect Web Traffic <http://forums.openvpn.net/topic8389.html#p13353>
20:25 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:52 -!- jeev [~jeev@unaffiliated/jeev] has left #openvpn []
21:14 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
21:26 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:56 -!- syn4pse- [~syn@p5DDC0550.dip0.t-ipconnect.de] has joined #openvpn
21:58 -!- syn4pse [~syn@p5DDC002B.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
22:03 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:19 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
22:29 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 250 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:48 < reiffert> moin
22:50 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
23:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:14 -!- syn4pse- [~syn@p5DDC0550.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
23:29 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
23:32 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
23:50 -!- demian [~demian@99-51-161-119.lightspeed.brfrct.sbcglobal.net] has quit [Remote host closed the connection]
23:54 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
--- Day changed Sun Jul 03 2011
00:04 -!- riskystep [~demian@85.17.177.67] has joined #openvpn
00:05 -!- riskystep [~demian@85.17.177.67] has quit [Remote host closed the connection]
01:05 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
03:03 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
03:07 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 260 seconds]
03:19 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
03:23 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:29 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has quit [Ping timeout: 255 seconds]
03:41 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
03:41 <@vpnHelper> RSS Update - forum: Ubuntu9 I386 64 bit file for OpenVPN <http://forums.openvpn.net/topic8370.html#p13355> || Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13354>
03:48 <@vpnHelper> RSS Update - forum: Using openVPN to bypass bloking firewall <http://forums.openvpn.net/topic8376.html#p13356>
03:54 <@vpnHelper> RSS Update - forum: Whats the source port range for the openvpn client traffic? <http://forums.openvpn.net/topic8379.html#p13359> || Client doesn't disconnect but can't ping <http://forums.openvpn.net/topic8378.html#p13358> || Routing all of traffic through VPN and SSH <http://forums.openvpn.net/topic8375.html#p13357>
03:56 -!- mids [~user@unaffiliated/mids] has left #openvpn []
04:00 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13361> || Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13360>
04:06 <@vpnHelper> RSS Update - forum: routing <http://forums.openvpn.net/topic8384.html#p13363> || Server and Client use wrong IP configuration <http://forums.openvpn.net/topic8387.html#p13362>
04:12 <@vpnHelper> RSS Update - forum: can receive email but it will not send <http://forums.openvpn.net/topic8382.html#p13365> || Help with shares folders in WinXP with OpenVPN Server Mode <http://forums.openvpn.net/topic8388.html#p13364>
04:13 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
04:19 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
04:27 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
04:27 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 264 seconds]
04:34 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
04:40 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
05:00 -!- sedulous [~sed@2001:41d0:2:46c1::1] has quit [Ping timeout: 260 seconds]
05:05 -!- sedulous [~sed@2001:41d0:2:46c1::1] has joined #openvpn
05:12 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13366>
06:24 -!- diemos is now known as Alcohol
06:24 -!- Alcohol is now known as Guest19849
06:25 -!- Guest19849 is now known as diemos
06:25 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
06:27 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:52 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has joined #openvpn
07:57 < afuentes> tun vpn. server lan: 10.9.8.0/24 tun ip in server: 10.8.0.1 tun ip in client: 10.8.0.6 .does anybdoy know where this 10.8.0.5 route comes from in the client? http://paste.debian.net/121761/
08:10 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:13 < bystander> good day guys. I have a situation here: I create and setup an openvpn-startup.sh so that if the server will restart without my knowledge it will restart openvpn service and it works as I have tested it.  however after 6 hours, the openvpn service stops. why is this?
08:15 < bystander> what could be the reason for that?
08:25 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Ping timeout: 264 seconds]
08:26 < bystander> guys?
08:26 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
08:36 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:55 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
08:58 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
09:34 < Bushmills> afuentes: client p-t-p address of tun device
09:34 < Bushmills> ifconfig tun0   shows
09:37 <@vpnHelper> RSS Update - forum: Redirect Web Traffic <http://forums.openvpn.net/topic8389.html#p13367>
09:57 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has quit [Quit: bye irc!]
10:04 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
10:27 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
10:27 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has joined #openvpn
10:27 -!- openbsdnoob_ is now known as openbsdnoob
10:27 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Read error: Operation timed out]
10:28 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
10:28 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has joined #openvpn
10:29 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
10:29 -!- folivora [~bomshiva@koekaniini.kelju.fi] has quit [Ping timeout: 258 seconds]
10:29 -!- folivora [~bomshiva@koekaniini.kelju.fi] has joined #openvpn
10:29 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 276 seconds]
10:30 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
10:33 -!- Deathvalley122 [~Death@eagleits.net] has quit [Excess Flood]
10:37 -!- Deathvalley122 [~Death@eagleits.net] has joined #openvpn
10:37 <@vpnHelper> RSS Update - forum: Some problem with simple OpenVPN platform <http://forums.openvpn.net/topic8392.html> || Server and Client use wrong IP configuration <http://forums.openvpn.net/topic8387.html#p13368>
10:45 -!- soa2ii [~quassel@2001:4d88:1ffc:464::1] has joined #openvpn
10:46 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
10:46 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has quit [Ping timeout: 255 seconds]
10:47 < soa2ii> Hi. I just thought of installing openVPN. Now a bridged VPN looks like what you normally want … the only disadvantage is efficiency. Now … how much efficiency do you loose? I would like to run the VPN over the internet between hosts that have about 100kB/s upstream.
10:49 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has joined #openvpn
10:49 < krzee> false
10:49 < krzee> a bridge is what you want when you have no other choice
10:52 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:52 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:53 < soa2ii> krzee: http://openvpn.net/index.php/open-source/faq/75-general/309-what-is-the-difference-between-bridging-and-routing.html
10:53 <@vpnHelper> Title: What is the difference between bridging and routing? (at openvpn.net)
10:53 < soa2ii> I think brideg looks better.
10:53 < krzee> !tunortapo
10:53 < krzee> !tunortap
10:53 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
10:53 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
10:54 < soa2ii> !wins
10:54 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
10:55 < soa2ii> krzee: I thought routed is harder to setup and supports less features (like broadcasts).
10:55 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:57 < krzee> why do you need broadcasts over the vpn?
10:58 < krzee> ...?
10:58 < krzee> and harder to setup... well yes, it is expected that you understand something about networking before setting up vpns
10:58 < krzee> lol
10:59 < krzee> but instead of complaining that you dont understand, just start with this:
10:59 < krzee> !goal
10:59 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:59 <@vpnHelper> RSS Update - forum: Openvpn Site 2 Site <http://forums.openvpn.net/topic8393.html>
11:02 < soa2ii> krzee: Fine. I would like to share Samba/NFS and offer some servies (Databases) over the internet and access the the web over my VPN from clients.
11:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:03 < krzee> you did not mention a single layer2 protocol
11:03 < krzee> !sample
11:03 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
11:03 < krzee> thats just a normal vpn connection
11:04 < soa2ii> krzee: Fine. I'll see how to set up a routed vpn then. On the client side everything is the same, or?
11:04 < krzee> if you click the link my bot sent it gave you the config
11:05 < soa2ii> I'll have a look. Thanks :)
11:10 < Bushmills> !gvpe
11:11 < Bushmills> vpnHelper, learn gvpe http://software.schmorp.de/pkg/gvpe.html
11:11 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
11:12 < krzee> give a little description and ill add it for ya
11:13 < Bushmills> meant for those looking for a vpn with direct peer connections. those who'd be sent to hamachi otherwise.
11:13 < Bushmills> "Unlike other virtual private "network" solutions which merely create a  single tunnel, GVPE creates a real network with multiple endpoints.  "
11:14 < Bushmills> free. opensource. for nixes
11:15 < Bushmills> layer 2
11:19 < krzee> learn gvpe as http://software.schmorp.de/pkg/gvpe.html  <Bushmills> "Unlike other virtual private "network" solutions which merely create a  single tunnel, GVPE creates a real network with multiple endpoints. free, opensource, for nixes, meant for those looking for a vpn with direct peer connections. those who'd be sent to hamachi otherwise.
11:19 <@vpnHelper> Title: gvpe (at software.schmorp.de)
11:19 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
11:19 < krzee> !learn gvpe as http://software.schmorp.de/pkg/gvpe.html  <Bushmills> "Unlike other virtual private "network" solutions which merely create a  single tunnel, GVPE creates a real network with multiple endpoints. free, opensource, for nixes, meant for those looking for a vpn with direct peer connections. those who'd be sent to hamachi otherwise.
11:19 <@vpnHelper> Joo got it.
11:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:23 < Bushmills> thanks
11:23 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
11:24 < Bushmills> !gvpe
11:24 <@vpnHelper> "gvpe" is http://software.schmorp.de/pkg/gvpe.html <Bushmills> Unlike other virtual private  network" solutions which merely create a single tunnel, GVPE creates a real network with multiple endpoints. free, opensource, for nixes, meant for those looking for a vpn with direct peer connections. those who'd be sent to hamachi otherwise.
11:34 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
11:47 -!- krzee [~k@190.166.168.175] has joined #openvpn
11:47 -!- krzee [~k@190.166.168.175] has quit [Changing host]
11:47 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
12:02 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
12:04 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 255 seconds]
12:22 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
12:29 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:29 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Remote host closed the connection]
12:31 < soa2ii> How do you handle certificates for openvpn? on per machine or one per person?
12:39 < soa2ii> Is it possible to connect twice to a vpn with the same cert?
12:40 < soa2ii> Is the common name visible somewhere? I'd substitue the client1 in the example then with the persons or the machines hostname … no idea what's better yet.
13:00 < Bushmills> soa2ii: per client, yes, yes
13:01 < soa2ii> Bushmills: Why then per client?
13:01 < Bushmills> because a client authenticates when connecting
13:01 < soa2ii> Bushmills: I think more of a person is not trustful any more so I could blacklist his cert.
13:01 < Bushmills> openvpn doesn't know about "persons"
13:02 < soa2ii> But I do :)
13:02 < Bushmills> then it will be up to you to police persons' access
13:02 < soa2ii> And I wont have to create multiple certs for a person who has multiple machines
13:02 < soa2ii> Yes … but isn't this more complicated if the same person has multiple certs?
13:03 < Bushmills> one client uses one cert signed key
13:03 < soa2ii> I don't care about the persons client … I can't control the client he's using can I?
13:03 < soa2ii> Yes. But multiple clients could use the same key.
13:03 < Bushmills> if you configure server that way, was.
13:03 < Bushmills> yes
13:04 < Bushmills> default is "no". you have to enable that.
13:04 < soa2ii> Fine. I don't see a disadavantage in this approach there yet. Do you?
13:04 < Bushmills> it'll be more difficult to push client specific settings
13:05 < soa2ii> Bushmills: What could this be?
13:05 < Bushmills> such as a static ip address
13:06 < soa2ii> How could I control this? The person maintaining the client could change everything, couldn't he? I'm not in charge of most of the clients.
13:06 < Bushmills> only if you allow that person to modify the server configuration
13:06 < soa2ii> Bushmills: No, the server is mine.
13:07 < Bushmills> then "person" can't modify "everything"
13:07 < soa2ii> But if I give the cert for client x to person y. Y could now install the cert on a completely different machine too … how could I control that?
13:08 < Bushmills> why do you care what machine it is installed on? 
13:08 < Bushmills> you have cert to person, thereby entitling person to gain access.
13:08 < soa2ii> Bushmills: The machine is normally the client … or?
13:08 < soa2ii> Yep.
13:08 < Bushmills> what machine person uses to connect is irrelevant
13:09 < soa2ii> So where the advantage in handing the same person different certs with different access levels if the person could use always the "best" cert?
13:09 < Bushmills> that you can leave server settings to allowing only one connection per cert
13:10 < Bushmills> the number of certs then corresponds with the number of max concurrent connections
13:10 < soa2ii> Bushmills: Well … who cares? If the person has access with one machine his other machine could use this tunnel.
13:10 < Bushmills> "use tunnel" doesn't have to mean "use services as same user through tunnel" 
13:11 < soa2ii> I'm dealing with very limited people here who I normally trust. They're not going to establish 100 connections.
13:11 < soa2ii> I just want the easiest way to allow/disallow those people if something goes wrong.
13:11 < Bushmills> had you access to my vpn, and use that tunnel, you still couldn't ssh to server or other clients
13:12 < Bushmills> !revoke
13:12 < soa2ii> Hm. I think I really want to grant access to persons. Not to machines.
13:12 < Bushmills> hm . thought there was a factoid on revoking
13:13 < Bushmills> services control user access
13:13 < Bushmills> vpn controls client/machine access
13:14 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
13:14 < soa2ii> Hm. I think you're right of course … but in my special approach I still can't see where I would give one machine from Person X other privileges than another machine.
13:14 < Bushmills> consider vpn as a kind of network cable.  there's no concept of "allow/deny specific user" in that cable. just "allow connected machine, deny not connected machine"
13:15 < soa2ii> Yeah. I think of it more like a VIP-Lounge. I grant persons access to my secure data or not.
13:15 < Bushmills> authentication could be user/password based. that sort of simulated user access, even though it still is the machine/client connecting
13:15 < soa2ii> Of cpurse the machine is connecting.
13:17 < soa2ii> In my world I think there's just: Person X is fine … so give him access. If he's not fine anymore: Revoke all privileges. So one Cert per person should be enough for me.
13:18 < soa2ii> What's the option to allow multiple connections?
13:19 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 250 seconds]
13:19 < Bushmills> duplicate-cn
13:24 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has quit [Read error: No route to host]
13:25 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
13:31 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
13:35 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
13:36 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
13:37 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
13:37 -!- Cain` is now known as Cain
13:49 < soa2ii> !wins
13:49 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
13:54 -!- me345 [~me345@75.15.224.14] has joined #openvpn
14:04 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has joined #openvpn
14:30 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
14:31 < soa2ii> So … I think my routed vpn is set up fine. How do I now configure things like: "resolve everything through the vpn" or "resolve just queries to known services/ips through the vpn"?
14:33 < pwrcycle> is there a way to track how much bandwidth each user uses?
14:35 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
14:36 -!- krzee [~k@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:57 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
15:01 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:22 < EugeneKay> Nifty. Somebody packaged up the stuff to get OpenVPN working on my Transformer.
15:24 < diemos> Transformer?
15:27 < EugeneKay> Android tablet by Asus
15:27 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:28 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:29 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has joined #openvpn
15:30 < s7r> !lists
15:30 < afuentes> is there a way that the client does not need a private .key and just to be able to connect with the .crt?
15:32 < EugeneKay> That's not how PKI works.
15:34 < afuentes> ^ ^ i see
15:34 < afuentes> I thought that maybe i could just handle something signed by me, with no need to transfer them the private keys to the clietns
15:35 < afuentes> but i guess thats not possible
15:35 < EugeneKay> The cert is signed by the CA. This guarantees that the holder of the matching Key is trusted by the CA.
15:36 < EugeneKay> You still need to have the Key :-p
15:36 < afuentes> cant the client cryp with the cert and only me, that owns the private key, can decrypt it?
15:37 < afuentes> mmm..... its too late to think of this lol
15:37 < afuentes> my head aches x)
15:37 < EugeneKay> The client does that with the server cert, and you unlock it with your server key.
15:38 < EugeneKay> AUthentication is a two-way street.
15:38 < EugeneKay> You can run without a client cert/key, but you'll still need a server key/cert. This is how HTTPS works.
15:49 -!- me345 [~me345@75.15.224.14] has quit [Read error: Connection reset by peer]
15:56 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
15:59 < EugeneKay> soa2ii - you want to push DNS options to the client. The docs say that Windows gui handles this decently, but I've never fiddled with it myself.
16:10 < Bushmills> ""resolve just queries to known services/ips through vpn" ??   makes me think you don't refer to name resolution by name server
16:11 < Bushmills> you don't resolve queries. you resolve host names.
16:11 -!- sathia [~quassel@host220-67-dynamic.117-80-r.retail.telecomitalia.it] has joined #openvpn
16:12 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
16:12 < Bushmills> for using a service through vpn. use the vpn address of the machine the service runs on
16:12 < reiffert> use routing otherwise.
16:14 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 255 seconds]
16:53 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:57 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
16:58 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 246 seconds]
16:59 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
17:00 -!- corretico [~luis@201.201.44.82] has quit [Read error: Operation timed out]
17:01 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Excess Flood]
17:01 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
17:04 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
17:09 -!- sathia [~quassel@host220-67-dynamic.117-80-r.retail.telecomitalia.it] has quit [Ping timeout: 240 seconds]
17:11 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
17:12 -!- sathia [~quassel@host200-50-dynamic.40-79-r.retail.telecomitalia.it] has joined #openvpn
18:03 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
18:07 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Remote host closed the connection]
18:09 -!- corretico [~luis@201.201.44.82] has joined #openvpn
18:18 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:21 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:31 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
18:33 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
18:33 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
18:33 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Excess Flood]
18:33 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
18:34 -!- sathia [~quassel@host200-50-dynamic.40-79-r.retail.telecomitalia.it] has quit [Ping timeout: 255 seconds]
18:41 -!- ritztech [412fe012@gateway/web/freenode/ip.65.47.224.18] has joined #openvpn
18:41 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
18:41 < ritztech> holy crank didnt know there was a openvpn chat
18:42 < ritztech> whats a good client for a cent os Non gui just shell
18:50 < EugeneKay> CentOS 5? You can find openvpn in the epel or rpmforge repos.
18:50 < EugeneKay> Same for 6, I believe
18:50 < EugeneKay> I prefer to use epel when possible because it is maintained by Red Hat, same as the RHEL upstream for CentOS.
18:57 < ritztech> which i got it bu                   t Enter Auth Username:johnny     us=464654 ERROR: Auth username is empty
18:57 < ritztech> weird thing is either my stdin isnt working or what
18:57 -!- stephenh [~stephenh@unaffiliated/stephenh] has quit [Ping timeout: 276 seconds]
18:57 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:59 < ecrist> ritztech: if we knew more about your problem, we could help you more...
19:00 < ritztech> Centos 5.6
19:01 < ritztech> x64
19:01 < ecrist> !goal
19:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:01 < ecrist> !configs
19:01 < ecrist> !logs
19:01 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
19:01 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
19:06 -!- stephenh [~stephenh@durbanpoizon.za.net] has joined #openvpn
19:14 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
19:15 < ritztech> goal  im a client connecting to a remote server   using linux centos 5.6  
19:15 < ritztech> http://pastebin.com/WcHiKxe5
19:25 < kisom>  3
19:25 < kisom> nvm
19:26 < ritztech> hmm might of found it
19:26 < ritztech> OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
19:27 < ritztech> Cannot load certificate file keys/serv-con-user-client.crt: error:02001002:system library:fopen:No such file or directory: error:20074002:Bb
19:29 < ritztech> never mind i got it working sorta i had to do openvpn --config in the directory where my .ovpn is stored
19:31 < ritztech> should this Initialization Sequence Completed  be stuck or can i run this as a silent process ??
19:35 -!- ritztech [412fe012@gateway/web/freenode/ip.65.47.224.18] has quit [Quit: Page closed]
19:38 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
19:52 -!- Busch [~Busch@lvps46-163-78-110.dedicated.hosteurope.de] has quit [Ping timeout: 252 seconds]
19:57 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:12 -!- master_of_master [~master_of@p57B55CC1.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:16 -!- master_of_master [~master_of@p57B52E3D.dip.t-dialin.net] has joined #openvpn
20:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
20:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:28 < Doonz> hi guys, I am able to open a tunnel through openvpn from my laptop to the server. I cannot access anything else on that network
22:34 -!- Jeepbeats [jeepbeats@gateway/shell/xzibition.com/x-tvktlmqfufzekzis] has joined #openvpn
22:45 -!- Jeepbeats [jeepbeats@gateway/shell/xzibition.com/x-tvktlmqfufzekzis] has left #openvpn []
23:00 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
23:16 <@vpnHelper> RSS Update - forum: routing <http://forums.openvpn.net/topic8384.html#p13371>
23:37 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
23:37 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
23:37 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:51 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
--- Day changed Mon Jul 04 2011
00:09 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:13 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
00:32 -!- newmember [~newmember@d50-99-28-232.abhsia.telus.net] has joined #openvpn
00:34 -!- fu[h]ry [~dan@24-151-32-112.dhcp.nwtn.ct.charter.com] has left #openvpn []
00:49 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
00:59 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
01:06 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
01:06 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
01:06 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:08 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
01:10 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
01:10 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
01:10 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:14 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
01:14 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
01:24 -!- SWAT [~swat@ubuntu/member/swat] has quit [Remote host closed the connection]
01:24 -!- SWAT [~swat@ubuntu/member/swat] has joined #openvpn
01:29 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
01:29 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
01:29 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:30 < soa2ii> Is there somewhere a recommended way to install VPN for dummies? I had really no problems with my linux box but windows7 looks more difficult. Do you have to install the openvpn service if you just want to use the client?
01:30 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
01:32 < reiffert> soa2ii: just click next on the installer and when starting the GUI, start it as administrator.
01:32 < reiffert> no need for the service.
01:34 < soa2ii> reiffert: ok … this could be the problem. Do you always have to run it as admin?
01:35 < soa2ii> because the gui did show nothing but it did not mention that it needs admin privileges either
01:35 < reiffert> the gui needs to launch the openvpn client prozess, which itself got to do interface actions which require administrator rights.
01:37 < krzee> yes, always as admin
01:37 < soa2ii> fine, thanks then :)
01:37 < soa2ii> hope my girlfriend will get that :)
01:37 < krzee> you can make it so
01:37 < krzee> right click, properties, compat options
01:37 < reiffert> right click -> properties -> [x] start as administrator every time
01:37 < krzee> something like that
01:38 < soa2ii> I know.
01:38 < reiffert> intresting what comes up to mind when reading "girl"
01:38 < soa2ii> reiffert: Hm?
01:39 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
01:39 < reiffert> krzee and I both had the same idea after reading "girl"
01:39 < krzee> ... make it so she doesnt need to know...
01:39 < krzee> hehehe
01:40 < reiffert> run it as system service = get connected everytime
01:40 < soa2ii> omfg
01:41 < reiffert> thats the option I choose for those who dont know what they are doing.
01:41 < krzee> right, service is for auto-starting and always having it on
01:41 < krzee> otherwise, user must start / stop it
01:41 < soa2ii> by the way … how is dns handled with openvpn? Now if I connect some PCs over my vpn I would like name resolution too
01:42 < reiffert> imagine vpn as a network wire. dns is handled like always.
01:42 < krzee> you need to be more specific with your goal
01:42 < krzee> if you want to redirect internet, you can push a dns server to clients to use
01:42 < krzee> !pushdns
01:42 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
01:42 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
01:44 < soa2ii> Would be cool if they could use the push-dns just for not local ips
01:45 -!- dazo_afk is now known as dazo
01:51 < krzee> !splitdns
01:51 <@vpnHelper> "splitdns" is see http://www.thekelleys.org.uk/dnsmasq/doc.html for dnsmasq, which will let you do split-dns setups
01:52 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:54 < krzee> http://twitter.com/#!/foxnewspolitics
01:54 <@vpnHelper> Title: Twitter (at twitter.com)
01:54 < krzee> ^ hacked
02:09 < soa2ii> Hm. Is there a way to configure things like: If I connect to the VPN everything works as before but somehow magically appear new machines on the net? So DNS is just enhanced or something like that?
02:10 -!- sathia [~quassel@host200-50-dynamic.40-79-r.retail.telecomitalia.it] has joined #openvpn
02:13 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
02:13 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
02:13 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:13 < soa2ii> Is the vpn server automatically part of the vpn or do I have to connect it as a client itself?
02:21 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
02:24 < reiffert> it's like firefox and webserver.
02:26 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 264 seconds]
02:26 <@vpnHelper> RSS Update - forum: Message too long <http://forums.openvpn.net/topic8279.html#p13372>
02:27 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
02:55 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has quit [Ping timeout: 263 seconds]
02:56 -!- sathia [~quassel@host200-50-dynamic.40-79-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
03:02 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 252 seconds]
03:03 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
03:17 < Bushmills> soa2ii: "magically appear new machines"  - other clients, or the openvpn server?
03:17 < soa2ii> Bushmills: both
03:18 < Bushmills> sort of, yes.  other clients which weren't accessable before suddenly become accessable.
03:18 < Bushmills> "appear" is a matter of presentation
03:19 < Bushmills> s/become accessable/can become accessable/  - their admins have a say with that too.
03:21 < Bushmills> openvpn server - no.  it must have been accessable before already, otherwise your client couldn't have connected.  openvpn may evade some of its firewall, though
03:30 < Bushmills> for adding connecting clients to a name server, so they can be resolved by name, look at  ...
03:30 < Bushmills> !nsupdate
03:30 <@vpnHelper> "nsupdate" is http://scarydevilmonastery.net/client_connect_nsupdate for a script Bushmills wrote to solve the question How can my vpn update my nameserver?
03:36 -!- eliasson1 [~wizard@91.198.48.20] has joined #openvpn
03:36 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
03:43 -!- Netsplit *.net <-> *.split quits: eliasson_, fbh, @cron2, APTX
03:45 <@vpnHelper> RSS Update - forum: Server Reboot Problem <http://forums.openvpn.net/topic8394.html>
03:51 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
03:58 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Ping timeout: 264 seconds]
04:04 -!- luneff [~yury@84.51.213.254] has quit [Quit: This computer has gone to sleep]
04:04 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
04:05 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
04:08 -!- K1ng`` [~KING@180.211.188.81] has quit [Ping timeout: 252 seconds]
04:08 <@vpnHelper> RSS Update - forum: Site-to-site between three locations <http://forums.openvpn.net/topic8395.html>
04:27 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
04:35 -!- luneff [~yury@46.61.114.175] has joined #openvpn
04:44 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
04:45 < s7r> can i use this client here http://swupdate.openvpn.net/downloads/openvpn-client.msi
04:45 < s7r> to connect to an openvpn server which runs the community project ?
04:52 -!- luneff [~yury@46.61.114.175] has quit [Ping timeout: 246 seconds]
04:58 -!- luneff [~yury@188.114.46.100] has joined #openvpn
05:11 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
05:11 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
05:11 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
05:35 -!- newmember [~newmember@d50-99-28-232.abhsia.telus.net] has quit [Read error: Connection reset by peer]
05:36 -!- newmember [~newmember@d50-99-28-232.abhsia.telus.net] has joined #openvpn
05:36 -!- newmember [~newmember@d50-99-28-232.abhsia.telus.net] has quit [Read error: Connection reset by peer]
05:37 -!- newmember [~newmember@d50-99-28-232.abhsia.telus.net] has joined #openvpn
05:41 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
05:45 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has joined #openvpn
05:46 < Gaglia> !welcome
05:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:47 < Gaglia> Hi all, I'm using OpenVPN 2.1.3 i486-pc-linux-gnu
05:47 < Gaglia> I'm trying to do a setup using elliptoc curves cryptography and I've got some problem
05:48 < Gaglia> I've successfully generated EC certificates with the latest openssl version
05:49 < Gaglia> but now in the many openvpn howtos I've found I read that I should generate dh parameters and specify them in the openvpn conf file with something like "dh dh1024.pem"
05:50 < Gaglia> dh params are generated using something like "openssl dhparam 1024 -out dh1024.pem"
05:51 < Gaglia> I guess that an analogous for ECDH should be "openssl ecparam -out ec.pem -name curvename"
05:52 < Gaglia> but then, what do I write in the openvpn conf file? Should I try "ecdh ec.pem" instead that "dh dh1024.pem" ?
05:52 < Gaglia> thanks for any help :(
05:53 -!- dazo is now known as dazo_afk
05:57 <@vpnHelper> RSS Update - forum: [help]vpn GUI <http://forums.openvpn.net/topic8396.html>
06:06 -!- SOG [~SOG@168.70.16.99] has joined #openvpn
06:15 < s7r> !ipv6
06:15 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
06:19 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
06:33 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
06:33 -!- ServerMode/#openvpn [+o cron2] by pratchett.freenode.net
06:34 -!- SOG [~SOG@168.70.16.99] has quit [Quit: SOG]
06:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:01 < greg_72> hi there, I try to create a tunnel . My server and client configs are at http://pastebin.com/swt3eVbt I cannot ping the machines behind the openvpn server. What did I wrong?
07:03 < EugeneKay> Trying to let a Client access the LAN behind your Server?
07:04 < EugeneKay> The server's local directive should be the same public IP specified in the client's remote directive
07:05 < greg_72> EugeneKay: yes, I try to access the LAN behind
07:05 < greg_72> for the other: I check it in a minute
07:05 < EugeneKay> Is the server also the default gateway for machines on the LAN ?
07:06 < EugeneKay> If not, you will need either a MASQUERADE in iptables for rraffic originating from the VPN, or a route on the default gateway to send traffic destined for the VPN via the vpn server's LAN IP.
07:06 < EugeneKay> Other than that...... everything looks good
07:07 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:07 < EugeneKay> Any particular reason you're using TCP? UDP should be used when possible, it gives better performance overall(TCP-in-TCP is an ugly thing)
07:07 < greg_72> I have read a blog entry where TCP was used
07:07 < greg_72> but I will switch to UDP then
07:08 < EugeneKay> The blog was wrong ;-)
07:08 < greg_72> Yes, I see now :-)
07:08 < EugeneKay> You're familiar with the differences between the two?
07:08 < greg_72> TCP and UDP?
07:08 < EugeneKay> Aye
07:08 < greg_72> in basic terms, yes, not sure about in an openvpn setting
07:09 < EugeneKay> The short version is that tunneling TCP inside of TCP leads to resend-flooding when a packet gets dropped(both OpenVPN and the application running over it try to resend a packet). This worsens the packet-loss problems until the connection drops and it has to be reestablished.
07:10 < greg_72> the server local address should be the public ip address of my openvpn server? now openvpn says itt cannot bind a socket to 1194 of that address
07:10 < EugeneKay> Is your Server the default gateway for the LAN, or is it behind a router?
07:11 < greg_72> this is in an amazon cloud, not sure what the answer is
07:11 < EugeneKay> Ah. ifconfig output
07:12 < EugeneKay> Basically, are the other boxen on the LAN expecting to access the internet through the VPN server, or via another method?
07:12 < greg_72> http://pastebin.com/0hQzYn9j
07:12 < greg_72> the other box I want to ping has no access to the internet at the moment
07:12 < EugeneKay> That's from the Server?
07:13 < greg_72> yes
07:13 < EugeneKay> Yeah, it's definitely not the gateway, then.
07:13 < greg_72> so what can I do?
07:13 < EugeneKay> Bind to that address, and then forward conenctions to <PublicIP>:1194 via UDP to that address, on whatever box IS your gateway.
07:14 < EugeneKay> On that same gateway box you will need to setup a static route to the OpenVPN pool
07:14 < EugeneKay> Oh, other thing - you need to use a IP pool different from your LAN's IPs. 
07:15 < EugeneKay> You can't route the same subnet out two disjoint interfaces at once :-p
07:16 < greg_72> may I ask a question back: when defining server's local address, should i use the LAN address or the public ip that is seen from the internet?
07:16 < EugeneKay> LAN address.
07:16 < EugeneKay> <EugeneKay> Bind to that address, and then forward conenctions to <PublicIP>:1194 via UDP to that address, on whatever box IS your gateway.
07:19 < greg_72> in the amazon cloud I do not have config access to the internet gateway
07:21 < EugeneKay> Then you'll need to get a public IP assigned to your Server
07:21 < greg_72> I do have a public IP
07:22 < greg_72> the connection setup occurs, 
07:22 < greg_72> my openvpn server says that it sees my user
07:22 < EugeneKay> Ok, so it's already forwarding the port to that LAN IP.
07:22 < greg_72> still I cannot ping the machine behind
07:22 -!- rothwell [~rothwell@unaffiliated/rothwell] has quit [Ping timeout: 255 seconds]
07:22 < EugeneKay> (that's good)
07:22 -!- rothwell [~rothwell@unaffiliated/rothwell] has joined #openvpn
07:23 < EugeneKay> You still need to use a different subnet for your OpenVPN clients than the LAN, and without the ability to specify a route to your Server, you will need to use MASQUERADE for traffic originatign from the VPN
07:23 < greg_72> which config command do I use to specify the subnet for the clients?
07:24 < EugeneKay> The server 10.0.0.0 255.255.0.0 line
07:24 < EugeneKay> Change it to something like 10.18.90.0 255.255.255.0
07:24 < greg_72> I do it
07:25 < EugeneKay> Then in iptables, in your NAT table, you need somethign like -A POSTROUTING -s 10.18.90.0/24 -o eth0 -j MASQUERADE
07:27 < greg_72> I did sudo iptables -t nat -A POSTROUTING -s 10.18.90.0/24 -o eth0 -j MASQUERADE    in vain, unfortunately
07:27 < EugeneKay> Restart OpenVPN, etc?
07:28 < greg_72> Yes I did
07:28 < greg_72> both server and client
07:28 < EugeneKay> Hm. And it still won't work. 
07:28 < EugeneKay> GOt anything in your filter table?
07:28 < EugeneKay> I prefer to allow everything until I get my routing working, THEN I worry about filtering, allowing stuff piece-by-piece until it all works again
07:29 < greg_72> I am no iptables expert, should learn I'm afraid
07:29 < EugeneKay> tis a good skill
07:30 < Mowee> Morning
07:32 < greg_72> morning
07:35 < greg_72> EugeneKay: thanks for your support now I jump deep into the docs
07:36 < EugeneKay> And on the morning note, I'm gonna go sleep until it's afternoon
07:39 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 240 seconds]
07:42 -!- EugeneKay is now known as EugeneKaway
07:46 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:47 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
08:01 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
08:10 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Read error: Connection reset by peer]
08:24 -!- afuentes [~kusanagi@140.87.117.91.dynamic.mundo-r.com] has quit [Read error: Connection reset by peer]
08:30 -!- sppadic [~IceChat77@193.130.68.17] has joined #openvpn
08:36 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:41 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:42 < bystander> guys I have create openvpn-startup.sh so that it will restart openvpn service automatically if the server got rebooted. it worked but after hows many hours, the openvpn service stops. why is this?
08:45 < sppadic> hey bystander - anything in the logs? are u sure the service was stopped correctly when it restarted 
08:45 < Bushmills> bystander: your log file might be able to tell you
08:45 < bystander> I have not created a log to be created in my server script
08:45 < Bushmills> or was that meant as a riddle  - "why does my server stop without me telling you anything else"
08:45 < bystander> I have experienced this twice
08:46 < Bushmills> then enable logs and hope it happens again
08:46 < bystander> :)
08:46 < bystander> can you please look on my sh script to check if there are errors please
08:47 < bystander> http://pastebin.com/B7XmBSV1   <--- please check it out
08:47 < Bushmills> don't bother looking at that script - your server started, after all.  your question is why it *stops*
08:49 < bystander> yes that is my question bushmills. maybe the .sh script got something to do with it ?
08:50 < Bushmills> unless you haven't put anything into it to stop openvpn after some time, not very likely
08:50 < Bushmills> unless you *have*, actually
08:50 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
08:50 < Bushmills> even then - i don't like guesswork if you can provide hard evidence with a log file
08:51 < Bushmills> "the reason is" beats "the reason could be"
08:51 < bystander> I place killall -TERM openvpn to stop for any openvpn service that exists and start the service again 
08:51 < bystander> I place killall -TERM openvpn to stop for any openvpn service that exists and start the service again 
08:51 < Bushmills> then uncomment it
08:52 < bystander> but at the end of the script I placed openvpn --cd $dir1 --daemon --config serverudp.conf to load openvpn again.
08:52 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has quit [Read error: Operation timed out]
08:52  * Bushmills wonder why a running openvpn server would have to be killed only to run it again
08:52 < Bushmills> why don't you leave it running, if it runs already?
08:54 < Bushmills> sounds like  "if the machine runs, reboot it to make sure it runs"
08:54 < bystander> what I was presuming there is that when my server got offline by the host and rebooted, the sh script will be called but kill the openvpn service is still running if possible and restart at the last part of the script
08:54 < bystander> hahahahaha  you make me laugh bushmills
08:54 < Bushmills> oh, when your server reboots, your openvpn will continue running?
08:54 < bystander> i presume there
08:54 < sppadic> ?
08:55 < Bushmills> wouildn't it be easiest to just leave the server turned off then?
08:55 < bystander> hahahaha
08:55 < bystander> huhuhuhu
08:56 < Bushmills> openvpn goes on running,  saves energy ...
08:57 < bystander> i guess I have to remove the kill -TERM openvpn there
08:57 < bystander> :)
08:57 < bystander> i really hope that will solve it next time.
08:57 -!- dazo_afk is now known as dazo
08:58 < Bushmills> well, the logs will tell you next time
08:59 < bystander> currently I dont have the logs enable. if I enable the logs, i do need to restart the openvpn service right?
08:59 < Bushmills> any specific reason you don't use the common way to start openvpn through a script in /etc/init.d, rather than using that rc.local workaround?
09:00 < bystander> i dont touch there. i just use the sh script as I have read in the manpage
09:00 < Bushmills> depends. using the management interface, you'd not need to restart openvpn server
09:01 < bystander> :) management interface. hehehehe dont know that
09:01 < Bushmills> ‌init.d scripts are *meant* to control services, as in starting, stopping, reloading them
09:01 -!- dazo is now known as dazo_afk
09:01 < Bushmills> when you "don't touch there", you're missing the correct way to run them
09:01 -!- dazo_afk is now known as dazo
09:02 < bystander> hmmmmm. i guess so. i just really following the man page
09:02 < Bushmills> there is no mention of rc.local  in openvpn man page
09:03 < bystander> yah. anyway, thanks for the time to help bushmills. for the mean time I have changed the kill -term openvpn and maybe I have to follow your logs advice. thanks man.
09:04 < Kartagis> is it better/easier to auth against mysql or ldap?
09:07 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has joined #openvpn
09:08 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Ping timeout: 252 seconds]
09:12 -!- fdeiam [~ident@208.69.57.184] has joined #openvpn
09:13 < fdeiam> i use a openvpn client from terminal and it requires a login and password after selecting the .ovpn file.  can i set the the login and password in a plaintext file somewhere for automatic logins ?  
09:19 < Bushmills> using --auth-user-pass in client config?   follow it with a file name containing user name and password
09:19 < Bushmills> note that your client must have been built to support this
09:21 < Bushmills> but - with non-interactive authentication desired, why not set up key based authentication?
09:23 -!- fdeiam is now known as kierge
09:26 -!- kierge [~ident@208.69.57.184] has quit [Changing host]
09:26 -!- kierge [~ident@unaffiliated/kierge] has joined #openvpn
09:30 < kierge> can i specify login and password from the sudo openvpn launcher itself ?  
09:31 < Bushmills> what is a "sudo openvpn launcher" ?
09:33 < kierge> not a launcher but command line service command
09:33 < kierge> i basically only want to hit enter once without having to reenter my username and password
09:34 < kierge> if i can set that in a config file that would be useful as long as its not complicated or i can specify when i do sudo openvpn mvpn.ovpn with the proper toggles
09:36 -!- SOG [~SOG@222.125.196.155] has joined #openvpn
09:37 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has joined #openvpn
09:37 -!- SOG [~SOG@222.125.196.155] has quit [Client Quit]
09:38 < Bushmills>  redirect user/pass by that launcher to the specified file, if you have to.
09:38 < Bushmills> though i don't think that's a good idea, having logins float around like that
09:39 < Bushmills> why you couldn't put them in that file once yourself is beyond me
09:42 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
09:42 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
09:47 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
09:48 -!- Netsplit *.net <-> *.split quits: @cron2
09:49 < kierge> is it something as simple as sudo openvpn myvpn.ovpn < login.dat 
09:49 -!- newmember [~newmember@d50-99-28-232.abhsia.telus.net] has quit [Quit: Leaving]
09:56 < Bushmills> no it is specifying the file in your client config, and once writing or redirecting something to that file 
09:57 < Bushmills> or specify config file   with  --config myvpn.ovpn  --auth-user-pass passwordfile    if you have to give that on command line
09:58 < Bushmills> though you may want to remove -auth-user-pass from config file, in that case
10:08 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has quit [Quit: Gaglia]
10:09 -!- sppadic [~IceChat77@193.130.68.17] has left #openvpn []
10:12 -!- kierge [~ident@unaffiliated/kierge] has left #openvpn ["Leaving"]
10:12 -!- luneff [~yury@188.114.46.100] has quit [Quit: This computer has gone to sleep]
10:56 -!- luneff [~yury@84.51.213.254] has joined #openvpn
10:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
11:00 <@vpnHelper> RSS Update - forum: routing <http://forums.openvpn.net/topic8384.html#p13376>
11:06 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13378> || Server and Client use wrong IP configuration <http://forums.openvpn.net/topic8387.html#p13377>
11:07 -!- nixbro [~unknown@124.43.122.3] has joined #openvpn
11:12 <@vpnHelper> RSS Update - forum: Openvpn Site 2 Site <http://forums.openvpn.net/topic8393.html#p13380> || Some problem with simple OpenVPN platform <http://forums.openvpn.net/topic8392.html#p13379>
11:18 <@vpnHelper> RSS Update - forum: Site-to-site between three locations <http://forums.openvpn.net/topic8395.html#p13382> || Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13381>
11:19 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:39 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Operation timed out]
11:39 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
11:40 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
11:41 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 240 seconds]
11:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:42 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13383>
11:48 <@vpnHelper> RSS Update - forum: Trouble with proxy-arp setup from OpenVPN Cookbook 2 <http://forums.openvpn.net/topic8381.html#p13384>
11:54 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:54 -!- nixbro [~unknown@124.43.122.3] has quit [Ping timeout: 240 seconds]
12:14 -!- melfy [~jay@ip174-66-13-172.hr.hr.cox.net] has joined #openvpn
12:18 <@vpnHelper> RSS Update - forum: Help with shares folders in WinXP with OpenVPN Server Mode <http://forums.openvpn.net/topic8388.html#p13385>
12:24 -!- dazo is now known as dazo_afk
12:30 <@vpnHelper> RSS Update - forum: Some problem with simple OpenVPN platform <http://forums.openvpn.net/topic8392.html#p13386>
12:32 < melfy> wondering if anyone knows a simple way to give the server running openvpn a name & push to clients, only really want to share that PC but for now I'm just creating a name for it in hosts file & gets annoying switching it off all the time =/
12:32 -!- 30BAAHOWT [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
12:32 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
12:32 -!- ServerMode/#openvpn [+o cron2] by pratchett.freenode.net
12:35 -!- nixbro [~unknown@124.43.115.164] has joined #openvpn
12:47 -!- quadDama1e [~EmperorTo@216.17.68.153] has joined #openvpn
12:48 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has joined #openvpn
12:51 -!- kisom_ [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
12:51 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
12:51 -!- fbh_ [fbh@lucifer.frands.net] has joined #openvpn
12:51 -!- kisom_ is now known as Guest7364
12:51 -!- nebby-jay [~nebajoth@starfighter.org] has joined #openvpn
12:51 -!- DeathWol1 [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
12:51 -!- vai__ [~vai@168.144.28.208] has joined #openvpn
12:52 -!- Xeross_ [~Xeross@unaffiliated/xeross] has joined #openvpn
12:52 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 240 seconds]
12:52 -!- quadDamage [~EmperorTo@216.17.68.153] has quit [Ping timeout: 240 seconds]
12:52 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
12:52 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 240 seconds]
12:52 -!- fbh [fbh@lucifer.frands.net] has quit [Ping timeout: 240 seconds]
12:52 -!- vai_ [~vai@168.144.28.208] has quit [Ping timeout: 240 seconds]
12:52 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
12:52 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has quit [Ping timeout: 240 seconds]
12:52 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Ping timeout: 240 seconds]
12:52 -!- nebajoth [~nebajoth@starfighter.org] has quit [Ping timeout: 240 seconds]
12:52 -!- openbsdnoob_ is now known as openbsdnoob
12:52 -!- nebby-jay is now known as nebajoth
12:52 -!- Xeross_ is now known as Xeross
12:53 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:01 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13387>
13:10 -!- soa2ii [~quassel@2001:4d88:1ffc:464::1] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
13:10 -!- soa2ii [~quassel@2001:4d88:1ffc:464::1] has joined #openvpn
13:10 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:16 -!- nixbro [~unknown@124.43.115.164] has quit [Ping timeout: 246 seconds]
13:19 <@vpnHelper> RSS Update - forum: can receive email but it will not send <http://forums.openvpn.net/topic8382.html#p13388>
13:23 -!- Guest7364 is now known as kisom
13:25 <@vpnHelper> RSS Update - forum: Leaving for China.. want to set up VPN at home first! <http://forums.openvpn.net/topic8283.html#p13389>
13:25 -!- melfy [~jay@ip174-66-13-172.hr.hr.cox.net] has left #openvpn ["Leaving."]
13:37 <@vpnHelper> RSS Update - forum: selective ips from server ip range <http://forums.openvpn.net/topic8397.html>
13:43 <@vpnHelper> RSS Update - forum: Securely access home network via VPN on public wifi? <http://forums.openvpn.net/topic8398.html>
13:46 -!- Martin` is now known as Martin
13:47 -!- Martin is now known as Guest48155
13:49 -!- N0DEH is now known as CripperZ
13:49 -!- CripperZ is now known as N0DEH
14:13 <@vpnHelper> RSS Update - forum: Openvpn Site 2 Site <http://forums.openvpn.net/topic8393.html#p13392>
14:35 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
14:36 < Bushmills> interesting case - a router in internet is either giving up, or is flooded -   latency from public interface of a server behind has been rising for a while now, while latency through openvpn to the same server remains relatively unaffected:  http://scarydevilmonastery.net/snap/1309808182247553834d.png (red vs. green)
14:46 < krzie> i hate when that happens
14:46 < krzie> i actually lost my un-vpn'ed route to google the other week
14:47 -!- Guest48155 is now known as Martin
14:48 -!- Martin is now known as Guest6293
14:48 < Bushmills> i guesstimate that the router is flooded, and prioritizes established connections and, in case of udp, packets with recently seen destination, while new connections are throttled. 
14:50 < Bushmills> lesson:  keep a vpn connection open to the remote machines you want to be able to access (more) reliably even when routers between don't play along well.
15:01 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13393>
15:15 -!- melfy [~jay@ip174-66-13-172.hr.hr.cox.net] has joined #openvpn
15:15 -!- melfy [~jay@ip174-66-13-172.hr.hr.cox.net] has left #openvpn []
15:19 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
15:20 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
15:24 < ecrist> fuckers.
15:25 -!- havoc__ is now known as havoc
15:31 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:37 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has joined #openvpn
15:37 < baccenfutter> I just tried to put my openvpn back up after some weeks and am noticing that it ain't working. my client seems to connect (it receives an IP and route) but I can't seem to get any traffic accross the tunnel. tcpdump is counting 0 while my clients connect and do their dhcp thingy. what the heck is going on and how can I track this down? [gentoo ~amd64]
15:37 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:48 -!- Guest6293 is now known as Martin
15:48 -!- Martin is now known as Guest99530
15:48 <@vpnHelper> RSS Update - forum: Push route - not working <http://forums.openvpn.net/topic8399.html>
15:49 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
16:02 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
16:03 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
16:06 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
16:06 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
16:06 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Excess Flood]
16:06 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
16:09 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
16:09 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
16:09 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Excess Flood]
16:09 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has joined #openvpn
16:10 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
16:15 -!- guifort [~guifort@161.239.86.79.rev.sfr.net] has joined #openvpn
16:18 -!- guifort [~guifort@161.239.86.79.rev.sfr.net] has quit [Client Quit]
16:20 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 252 seconds]
16:26 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 250 seconds]
16:33 -!- rothwell [~rothwell@unaffiliated/rothwell] has quit [Ping timeout: 258 seconds]
16:39 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
16:40 -!- rothwell [~rothwell@dsl78-143-208-61.in-addr.fast.co.uk] has joined #openvpn
16:40 -!- rothwell [~rothwell@dsl78-143-208-61.in-addr.fast.co.uk] has quit [Changing host]
16:40 -!- rothwell [~rothwell@unaffiliated/rothwell] has joined #openvpn
16:43 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Read error: Operation timed out]
16:45 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
16:46 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 264 seconds]
17:09 -!- EugeneKaway is now known as EugeneKay
17:11 -!- sathia [~quassel@host200-50-dynamic.40-79-r.retail.telecomitalia.it] has joined #openvpn
17:16 -!- sathia [~quassel@host200-50-dynamic.40-79-r.retail.telecomitalia.it] has quit [Read error: Connection reset by peer]
17:16 -!- sathia [~quassel@host200-50-dynamic.40-79-r.retail.telecomitalia.it] has joined #openvpn
17:18 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:19 <@vpnHelper> RSS Update - forum: Openvpn basic configuration for full traffic routing <http://forums.openvpn.net/topic8400.html>
17:31 -!- N0DEH is now known as CripperZ
17:31 -!- CripperZ is now known as N0DEH
17:32 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
17:33 -!- sathia [~quassel@host200-50-dynamic.40-79-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
17:37 < Kateon> i'm using the 'route-up' command to manually add routes after openvpn is done setting up its own routes. It works for 1 route, but i can't seem to add more when i seperate the shell command with a semi-colon. Any idea how i could accomplish this without creating a seperate script with routes?
17:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
17:49 < EugeneKay> Create a separate script with your routes.
17:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:55 <@vpnHelper> RSS Update - forum: Setting up VPNs basic questions of a newbie <http://forums.openvpn.net/topic8401.html>
18:05 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:09 -!- K1ng`` [~KING@180.211.188.242] has joined #openvpn
18:12 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 264 seconds]
18:27 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
18:30 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 255 seconds]
18:35 < Kateon> EugeneKay: actually, i just found out that i could pass multiple commands when using together with 'script-security 2 system' 
18:35 < Kateon> so all is fine now
18:49 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has quit [Quit: Gaglia]
18:52 -!- N0DEH is now known as CripperZ
18:52 -!- CripperZ is now known as N0DEH
19:09 -!- rothwell [~rothwell@unaffiliated/rothwell] has quit [Remote host closed the connection]
19:33 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
19:33 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
19:33 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Excess Flood]
19:33 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
19:35 -!- nixbro [~unknown@124.43.126.16] has joined #openvpn
19:38 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
19:38 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
19:47 -!- cpm [~Chip@c-75-75-170-11.hsd1.pa.comcast.net] has joined #openvpn
19:47 -!- cpm [~Chip@c-75-75-170-11.hsd1.pa.comcast.net] has quit [Changing host]
19:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
19:52 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has joined #openvpn
19:56 < Pr0z0id> Hey guys.... i've got a something strange going on.... after a few days of running my openvpn server.... users log on and are unable to hit external sites.  The server can accept connections and from the server box i can ping sites.  I'm running in TUN mode and have eurephia as my authentication engine
19:56 < Pr0z0id> any ideas what the issue is"
19:58 < krzie> could be 1 of 2 things
19:58 < krzie> a) ip forwarding on the server is not enabled
19:58 < krzie> b) problem in your NAT on server
19:58 < krzie> well i guess 3... it could be the servers firewall as well
19:59 < krzie> !linnat
19:59 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
19:59 < krzie> !linipforward
19:59 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
20:04 < Pr0z0id> well the strange thing is that it's all work
20:04 < Pr0z0id> *working right now... then 
20:05 < Pr0z0id> a few days from now..
20:05 < Pr0z0id> bang 
20:05 < Pr0z0id> it stops
20:05 < Pr0z0id> and i have to run a script to flush the iptables
20:06 < krzie> well, then you had it right, and need to see whats no longer right
20:06 < krzie> you know what you did to make it work... go check your shit
20:06 < Pr0z0id> lol
20:06 < Pr0z0id> yes i know how to fix
20:06 < Pr0z0id> it 
20:07 < Pr0z0id> but i'm not sure why it will go from Fixed -> broken
20:08 < krzie> cause your server went from setup right -> setup wrong
20:08 < krzie> i cant tell you what you did...
20:08 < Pr0z0id> i haven't touched it.
20:08 < Pr0z0id> that's the thing..
20:08 < Pr0z0id> i'm not sure if maybe auto updatse 
20:08 < Pr0z0id> are running..
20:08 < Pr0z0id> or if openvpn + eurephia start blacklisting everyone
20:09 < krzie> well i dont know if you think we can just look into a crystal ball or something...
20:09 < Pr0z0id> well i guess it's not the later because users can still connect tot he server
20:09 < krzie> cat /proc/sys/net/ipv4/ip_forward
20:09 < Pr0z0id> you guys are pretty good
20:10 < krzie> ya, but "hey my system stopped working, i did nothing"  leaves us to say "well you know what you did to make it work, check your shit"
20:10 < Pr0z0id> 1
20:10 < EugeneKay> ip_forward is one of those changes I always make to sysctl.conf
20:10 < krzie> EugeneKay, *always* ?
20:10 < Pr0z0id> well that part is obvious..
20:10 < Pr0z0id> (i mean the well you broke it... stop touching it)
20:11 < EugeneKay> krzie - if >1 NIC, yes
20:11 < Pr0z0id> my problem is that i'm not touching configs.
20:11 < EugeneKay> Web-serving VMs don't get it
20:11 < Pr0z0id> the working configs end up blocking outgoing traffic.
20:11 < Pr0z0id> so i'm trying to track down 
20:12 < Pr0z0id> if OVPN or eurephia are making changes..
20:12 < krzie> brb
20:14 -!- master_of_master [~master_of@p57B52E3D.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:16 -!- master_of_master [~master_of@p57B52E43.dip.t-dialin.net] has joined #openvpn
20:20 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
20:22 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 255 seconds]
20:30 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
20:31 -!- Pr0z0id [~Pr0z0id@24-246-5-196.cable.teksavvy.com] has quit []
20:41 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
20:45 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
20:46 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
21:06 -!- Pr0zoid [~Pr0zoid@184.95.44.33] has joined #openvpn
21:07 < Pr0zoid> krzie: here's the script i run to flush the iptables and recreate all the funtionally to get things working again
21:07 < Pr0zoid> http://pastebin.com/TTqADfsm
21:07 < Pr0zoid> i can resolve the issue but i don't see enough detail in the iptables to see a chance.
21:07 < Pr0zoid> change.
21:16 -!- nixbro [~unknown@124.43.126.16] has quit [Quit: Leaving]
21:20 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html>
22:02 -!- Pr0zoid [~Pr0zoid@184.95.44.33] has quit [Ping timeout: 255 seconds]
22:03 -!- Pr0zoid [~Pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
22:03 < Doonz> hi guys, I am able to open a tunnel through openvpn from my laptop. I cannot access anything on the lan
22:03 < Doonz> i can access the internet through the tunnel but nothing on the lan
22:10 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
22:10 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
22:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:23 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Quit: leaving]
23:13 -!- K1ng` [~KING@180.211.188.242] has joined #openvpn
23:16 -!- K1ng`` [~KING@180.211.188.242] has quit [Ping timeout: 252 seconds]
23:36 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:37 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:38 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:39 -!- thanatoz_ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
23:44 < EugeneKay> Could be a number of things. Firewall and routing are the most likely ones.
23:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:53 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:55 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection timed out]
23:56 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
--- Day changed Tue Jul 05 2011
00:07 -!- syn4pse [~syn@p5DDC0836.dip0.t-ipconnect.de] has joined #openvpn
00:15 -!- syn4pse [~syn@p5DDC0836.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
00:28 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
01:11 -!- dazo_afk is now known as dazo
01:18 <@dazo> Pr0zoid: I'm looking at your iptables script ... looks mostly sane ... line 14 is kind of bogus (not needed, as the default policy is ACCEPT)
01:19 <@dazo> Pr0zoid: I don't see anything there which should break things, though
01:20  * dazo guesses Pr0zoid is asleep now, though
01:41 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
01:46 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 260 seconds]
02:09 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13399> || Some problem with simple OpenVPN platform <http://forums.openvpn.net/topic8392.html#p13398>
02:15 <@vpnHelper> RSS Update - forum: can receive email but it will not send <http://forums.openvpn.net/topic8382.html#p13400>
02:24 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
02:25 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has joined #openvpn
02:42 <@vpnHelper> RSS Update - forum: Push route - not working <http://forums.openvpn.net/topic8399.html#p13402> || Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13401>
02:45 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
02:46 < Kartagis> is it better/easier to auth against mysql or ldap?
02:47 <@vpnHelper> RSS Update - forum: Openvpn basic configuration for full traffic routing <http://forums.openvpn.net/topic8400.html#p13404> || selective ips from server ip range <http://forums.openvpn.net/topic8397.html#p13403>
02:52 < krzee> Kartagis, is it better/easier for you to code an app that does one or the other?
02:52 < krzee> !authpass
02:52 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
02:54 < Kartagis> krzee: it's just that I couldn't find manu howtos on mysql auth
02:54 < Kartagis> many*
02:57 < krzee> from openvpn's view its the exact same
02:57 < krzee> openvpn just lets a script decide
02:58 < krzee> whatever the script does to sort that out is upto the script
02:58 < Kartagis> krzee: with SQL, it's just a SELECT statement?
02:59 < krzee> dunno, ild ask that in a sql channel
02:59 < krzee> most likely, yes
03:09 <@vpnHelper> RSS Update - forum: OpenVPN stops for no reason <http://forums.openvpn.net/topic8403.html>
03:18 < Gaglia> can someone please help? I am trying to setup openvpn to use elliptic curve cryptography
03:18 < Gaglia> I recompiled all the stuff and it seems that now EC are supported, but I have some configuration problem
03:18 < EugeneKay> .......why?
03:18 < Gaglia> openssl-new verify -CAfile cacert.pem -purpose sslclient cert.pem
03:19 < Gaglia> ops, sorry, wrong paste
03:19 < Gaglia> TLS_ERROR: BIO read tls_read_plaintext error: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
03:20 < Gaglia> but I specified cipher AES-256-CBC in both server and client conf file, and I'm using DH now for testing purposes (but the certificates were generated using EC cryptography with openssl)
03:22 < Gaglia> EugeneKay, mainly because it's cool :) but also for speed/bandwidth and because I was asked for a particularly secure setup
03:29 -!- rothwell [~rothwell@unaffiliated/rothwell] has joined #openvpn
03:31 < rothwell> 'lo all. i'd like to make a local dns server available in the vpn i have set up in order to be able to assign names to clients (all addresses are "statically" assigned with ifconfig-push anyway)
03:32 < rothwell> what's the recommended way to do this? (the most likely way at this point seems to be to use dhcp-option to push a dns server, although i'm not sure this does what i think it does)
03:33 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13406>
03:39 <@vpnHelper> RSS Update - forum: Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13408> || Openvpn Site 2 Site <http://forums.openvpn.net/topic8393.html#p13407>
03:42 < defswork> rothwell, if ip addresses are statically assigned just update dns when you add new clients
03:42 < rothwell> defswork: it's more the case that i'd like connecting clients to be told where the dns server is
03:42 < rothwell> i'm not sure if that's possible or not
03:42 < defswork> rothwell, push dns settings to them then
03:43 < rothwell> defswork: well... that's what i was asking about... is "dhcp-option dns" what i want?
03:43 < defswork> push "register-dns"
03:43 < defswork> push "dhcp-option DNS 10.4.28.10"
03:43 < rothwell> ah, thank you
03:43 < defswork> replace ip with your ip
03:43 < rothwell> yep
03:43 < defswork> register-dns kicks some windows clients into working properly
03:43 < defswork> rothwell, I dynamically update dns
03:43 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
03:44 < defswork> read about it here - http://blog.defsdoor.org/2011/06/02/large-openvpn-server-deployment
03:44 <@vpnHelper> Title: Large Openvpn Server Deployment - Standing On The Shoulders Of Ants (at blog.defsdoor.org)
03:44  * rothwell reads
03:45 <@vpnHelper> RSS Update - forum: OpenVPN stops for no reason <http://forums.openvpn.net/topic8403.html#p13410> || Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13409>
03:46 -!- soa2ii [~quassel@2001:4d88:1ffc:464::1] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
03:47 < rothwell> looks good
03:48 < rothwell> one small thing... is the dns server pushed by openvpn *added* to the dns servers the client already has, or will it obliterate whatever dns settings they have?
03:49 < rothwell> the ISC dhcp client has a nasty tendency to remove any custom dns settings, replacing them with whatever the dhcp server pushes
03:49 < rothwell> not sure if openvpn is the same in that respect
03:50 < defswork> it will be connection specific
03:50 < defswork> so for that connection it will use the dns pushed
03:50 < defswork> when the connect goes the previous will return
03:50 < defswork> so your dns server needs to be recursive etc..
03:50 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13411>
03:51 < rothwell> hm
03:52 < Mowee> Morning
04:02 -!- stephenh [~stephenh@durbanpoizon.za.net] has quit [Changing host]
04:02 -!- stephenh [~stephenh@unaffiliated/stephenh] has joined #openvpn
04:04 -!- arisg [~arisg@klaymen.physics.upatras.gr] has joined #openvpn
04:04 < arisg> !welcome
04:04 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:05 < arisg> !goal
04:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:05 < arisg> !/30
04:05 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
04:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:06 < arisg> Hello, I would like to ask a question about ticker #53 ( https://community.openvpn.net/openvpn/ticket/53 ) and running openvpn on Solaris 9 
04:06 <@vpnHelper> Title: #53 (tun device was closed when starting daemon) – OpenVPN Community (at community.openvpn.net)
04:15 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13412>
04:26 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13413>
04:31 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13417> || Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13416> || selective ips from server ip range <http://forums.openvpn.net/topic8397.html#p13415>
04:37 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13418>
04:44 -!- fremo [~fremo@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
04:45 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
04:45 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
04:48 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html> || Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13419>
04:48 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: No route to host]
04:49 < Gaglia> this is my post <.<
04:49 < EugeneKay> Nobody loves you.
04:50 < Gaglia> I know çç
04:55 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
04:55 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
04:58 <@vpnHelper> RSS Update - forum: Openvpn Site 2 Site <http://forums.openvpn.net/topic8393.html#p13424> || Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13422> || Push route - not working <http://forums.openvpn.net/topic8399.html#p13421>
04:59 -!- fremo [~fremo@noc.toile-libre.net] has quit [Read error: No route to host]
04:59 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
05:01 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
05:04 <@vpnHelper> RSS Update - forum: Push route - not working <http://forums.openvpn.net/topic8399.html#p13426> || Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13425>
05:10 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13427>
05:12 -!- fremo_ [~fremo@noc.toile-libre.net] has joined #openvpn
05:16 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13430>
05:22 <@vpnHelper> RSS Update - forum: Push route - not working <http://forums.openvpn.net/topic8399.html#p13432> || Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13431>
05:22 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:28 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13434> || Push route - not working <http://forums.openvpn.net/topic8399.html#p13433>
05:40 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13435>
05:46 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13436>
05:52 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13439> || Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13438>
05:54 -!- dazo is now known as dazo_afk
05:58 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402.html#p13440>
06:00 -!- luneff [~yury@84.51.213.254] has quit [Ping timeout: 260 seconds]
06:04 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402-15.html#p13442>
06:10 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402-15.html#p13443>
06:11 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 255 seconds]
06:16 <@vpnHelper> RSS Update - forum: Push route - not working <http://forums.openvpn.net/topic8399.html#p13444>
06:18 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
06:32 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 250 seconds]
06:41 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5]
06:46 <@vpnHelper> RSS Update - forum: basic routing help please <http://forums.openvpn.net/topic8405.html>
06:49 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
06:53 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 240 seconds]
06:54 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
07:10 -!- sppadic [~IceChat77@193.130.68.17] has joined #openvpn
07:10 <@vpnHelper> RSS Update - forum: Server and Client use wrong IP configuration <http://forums.openvpn.net/topic8387.html#p13446>
07:20 -!- ehnde [~noctmilam@unaffiliated/ehnde] has joined #openvpn
07:27 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
07:30 -!- luneff [~yury@188.114.29.249] has joined #openvpn
07:34 -!- dazo_afk is now known as dazo
07:39 <@vpnHelper> RSS Update - forum: Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402-15.html#p13448> || The local and remote VPN endpoints cannot use <http://forums.openvpn.net/topic8406.html>
07:40 -!- cpm [~Chip@c-75-75-170-11.hsd1.pa.comcast.net] has joined #openvpn
07:40 -!- cpm [~Chip@c-75-75-170-11.hsd1.pa.comcast.net] has quit [Changing host]
07:40 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:40 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:42 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:42 -!- Cain` is now known as Cain
07:44 <@vpnHelper> RSS Update - forum: Server and Client use wrong IP configuration <http://forums.openvpn.net/topic8387.html#p13450> || Push route - not working <http://forums.openvpn.net/topic8399.html#p13449>
07:53 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:55 -!- luneff [~yury@188.114.29.249] has quit [Quit: This computer has gone to sleep]
08:00 <@vpnHelper> RSS Update - forum: The local and remote VPN endpoints cannot use <http://forums.openvpn.net/topic8406.html#p13451>
08:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:06 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 250 seconds]
08:10 -!- syn4pse [~syn@p5DDC0836.dip0.t-ipconnect.de] has joined #openvpn
08:14 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
08:18 -!- yell0 [yello@unaffiliated/contempt] has quit [Quit: leaving]
08:19 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
08:24 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13452>
08:37 < Mowee> Hi there
08:38 < sppadic> hello Mowee
08:38 < Mowee> When I test to revoke a client with ./revoke-full
08:38 < Mowee> I get an error 23
08:38 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has quit [Quit: Gaglia]
08:38 < Mowee> I understood that's just the output of the test revoke and the client can still connect to the vpn. Did I miss something?
08:39 < sppadic> i have got the error before 
08:39 < Bushmills> crl-verify in server config?
08:39 < Mowee> No
08:39 < Mowee> Do I need to add it?
08:39 < sppadic> Note the "error 23" in the last line. That is what you want to see, as it indicates that a certificate verification of the revoked certificate failed.
08:39 < sppadic> The revoke-full script will generate a CRL (certificate revocation list) file called crl.pem in the keys subdirectory. The file should be copied to a directory where the OpenVPN server can access it, then CRL verification should be enabled in the server configuration:
08:39 < sppadic> crl-verify crl.pem
08:39 < sppadic> Now all connecting clients will have their client certificates verified against the CRL, and any positive match will result in the connection being dropped.
08:40 < sppadic> oops sorry 
08:40 < sppadic> shud have dpasted it 
08:40 < Mowee> I see
08:40 < sppadic> Mowee u can still connect as that client?
08:40 < Mowee> yes
08:40 < sppadic> hmm
08:41 < sppadic> as Bushmills said - have u got crl-verify in the server config
08:41 < Mowee> Then I have to make a script with the revoke-full command, move the crl.pem in /etc/openvpn and add crl-verify /etc/openvpn/crl.pem right?
08:41 < arisg> is there a way to reduce the number of commands that can be executed from the management interface???
08:41 < Mowee> arisg, a script
08:42 < arisg> for example if i want the only command to be able to be executed by the management interface 
08:42 <@vpnHelper> RSS Update - forum: Moving an openvpn server <http://forums.openvpn.net/topic8369.html#p13453>
08:42 < sppadic> Mowee that sounds right to me 
08:42 < arisg> is the status command and nothing else
08:42 < Mowee> Well, I try it :)
08:42 < sppadic> http://openvpn.net/index.php/open-source/documentation/howto.html
08:42 <@vpnHelper> Title: HOWTO (at openvpn.net)
08:42 < sppadic> check that out Mowee- 
08:42 < arisg> Mowee: if someone connects to the management interface , then he can issue all the commands
08:43 < Mowee> I had red this part but I didn't understand 
08:43 < Mowee> Now you explained it to me, it sounds ok
08:44 < Mowee> I'm trying it
08:44 < sppadic> try try till u succeed :-)
08:44 < sppadic> or if that fails - ask Bushmills :-P
08:44 < sppadic> the docs are pretty good 
08:44 < Mowee> Yeah, I understood that he is an openvpn warrior
08:44 -!- luneff [~yury@46.41.120.177] has joined #openvpn
08:44 < sppadic> indeed 
08:49 <@vpnHelper> RSS Update - forum: Moving an openvpn server <http://forums.openvpn.net/topic8369.html#p13454>
08:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:51 < Mowee> It runs sppadic 
08:51 < Mowee> Thanks to you and Bushmills
08:52 < sppadic> hurrah - well done Mowee
08:52 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Read error: Connection reset by peer]
09:02 -!- [intra]lanman [~lanman@adsl-99-108-177-206.dsl.ipltin.sbcglobal.net] has joined #openvpn
09:02 -!- [intra]lanman [~lanman@adsl-99-108-177-206.dsl.ipltin.sbcglobal.net] has quit [Changing host]
09:02 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:03 -!- luneff [~yury@46.41.120.177] has quit [Quit: Leaving]
09:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
09:12 -!- [intra]lanman [~lanman@229.sub-174-253-17.myvzw.com] has joined #openvpn
09:12 -!- [intra]lanman [~lanman@229.sub-174-253-17.myvzw.com] has quit [Changing host]
09:12 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
09:12 <@vpnHelper> RSS Update - forum: Server and Client use wrong IP configuration <http://forums.openvpn.net/topic8387.html#p13455>
09:27 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
09:28 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:28 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:29 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
09:30 < abel408> I'm having a problem pinging my VPN clients from the server. My server rests on my main office gateway. My clients and their subnets connect fine and can ping everything in the main office, but my server and main office subnet cannot ping any of the clients or their subnets. What can I check to get this working? Thanks!
09:31 < sppadic> abel408 sounds like routes are ok - firewall issues maybe?
09:33 < abel408> sppadic: firewall issue on the client side? I should also mention that I just recently built a new openvpn server. The old openvpn server was working fine, but I wanted to put the server on my gateway instead of behind it. So I know the clients are configured correctly because they worked with the old server.
09:34 < abel408> I think the problem is my route from the main office gateway to the vpn right?
09:34 < sppadic> what r the routes setup?
09:35 < abel408> Well I think that's my problem. How can I configure a route to go from my internal network interface to the vtun interface I setup for openvpn. Is that what I even want to do?
09:36 < Mowee> sppadic, I have a problem
09:36 < sppadic> oh oh 
09:36 < sppadic> whats up Mowee?
09:37 < Mowee> When I activate the crl-verify in the server.conf
09:37 < Mowee> All my clients are dropped "connection refused"
09:37 < sppadic> abel408 i was initially thinking bridge 
09:37 < sppadic> oh dear 
09:37 < Mowee> and I read "Now all connecting clients will have their client certificates verified against the CRL, and any positive match will result in the connection being dropped"
09:37 < sppadic> hmm 
09:39 -!- abel408_ [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
09:39 < abel408_> sppadic: I lost connection so if you said anythign after my reply, I did not get it
09:40 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has quit [Ping timeout: 252 seconds]
09:40 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
09:40 < sppadic> didnt miss anything abel408_ was just musing 
09:40 < sppadic> was thinking of bridge as well when u mentioned that setup 
09:40 < sppadic> for some strange reason 
09:42 < Mowee> any suggestions sppadic? Is the crl-verify supposed to check revokated clients, not active ?
09:43 < sppadic> that was my understanding Mowee yes 
09:43 < Mowee> strange
09:45 < abel408_> sppadic: my outbound interface on my gateway is part of a bridge. Not sure if that has anything to do with it
09:45 < sppadic> sec chaps brb 
09:47 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
09:49 -!- abel408_ [429863d2@gateway/web/freenode/ip.66.152.99.210] has quit [Ping timeout: 252 seconds]
09:50 < sppadic> rite back 
09:51 < sppadic> Mowee can u dpaste ur config pls ?
09:51 < sppadic> also can i ask quickly what permissions have u set on the crl.pem file 
09:52 < sppadic> abel408 sorry forgive me here - can i jsut clarify 
09:52 < abel408> sppadic, don't appologize. No problem at all. I'm just thankful you're helping
09:52 < sppadic> Server to clients - no ping but other way is ok
09:53 < sppadic> just a fellow user abel408 no expert hehe
09:53 < sppadic> will try 
09:53 < sppadic> rite so clients to office - ping and routing ok 
09:53 < sppadic> but office to clients nothing?
09:53 < sppadic> is that right?
09:53 < abel408> Server cannot ping clients or their subnets. Clients can ping server and it's subnet
09:53 < abel408> yup
09:54 < sppadic> n the only thing thats changed from previous working setup is that you have moved the openvpn server onto the gateway?
09:54 < sppadic> just checking that nothing else has changd in the config file
09:54 < sppadic> or routes
09:55 < abel408> The openvpn server is now on a Vyatta gateway so the configurations are a little different, but I'm pretty sure they are identical
09:55 < sppadic> rite can u dpaste ur config abel408 ?
09:55 < sppadic> just want to have a quick look 
09:56 < abel408> sure
09:56 < sppadic> also wud suggest doing a tcpdump to trace the ping from the clients to the server 
09:56 < sppadic> n vice versa just to see what packets are trying to do 
10:05 < abel408> heres the paste bin, like I said. It's a little different cause of vyatta, but it's pretty much identical. The ps ax is probaly the most helpful: http://pastebin.com/4B5jbe7v
10:06 < abel408> let me try the tcpdump
10:06 < sppadic> yeah give that a go 
10:06 < sppadic> shud atleast tell u whats going on...
10:06 < sppadic> let me have a gander at that config in the mean time 
10:06 < sppadic> see if anything jumps 
10:06 < ecrist> are you using irc on a cell phone, sppadic?
10:07 < sppadic> hey ecrist nope?
10:07 < sppadic> why?
10:07 < ecrist> or is it an active decision to spell like a retard?
10:07 < ecrist> ;)
10:07 < sppadic> ahh one of the pedantic spell checkers :-)
10:08 < Mowee> sppadic: http://pastebin.com/a0NiszBr
10:11 < sppadic> abel408 in private message sir 
10:11 < sppadic> Mowee just had a quick look - nothing jumps out whats the error again ur getting in the logs?
10:12 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has quit [Ping timeout: 252 seconds]
10:13 -!- N0DEH [admin@ns3.cripperz.net] has left #openvpn ["Leaving"]
10:14 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
10:14 < sppadic> Mowee u there?
10:14 < sppadic> hey abel408 just wanted to check - theres is a missing quote in that file - or did i miss the beginning of that for the ipp.txt file ?
10:15 < sppadic> Mowee can i ask what permissions set for the crl.pem file ?
10:15 < abel408> I can't get tcpdump to show anything on either side for some reason
10:15 < sppadic> nothing on the vtun0 interface?
10:15 < sppadic> odd
10:15 < Mowee> rw-r-r
10:15 < Mowee> sppadic 
10:16 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
10:16 < abel408> The beginning of the ipp.txt config is on the line before, but there is a bug in vyatta when showing configurations with quotes
10:17 < sppadic> was just thinking if user nobody that openvpn runs as has problems reading that file 
10:17 < sppadic> oh ok abel408 sorry not used vyatta 
10:17 < abel408> I tried a tcpdump dst 10.133.3.10 which is my vpn client and I didn't get a thing
10:17 < abel408> same thing on the client side
10:18 < sppadic> Mowee as a test could you change the user and group in the config file to be root root n restart openvpn 
10:18 < sppadic> just want to see if that d oes anything ?
10:18 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:20 < abel408> I really think it has something to do with my route from the gateway internal interface to the vtun interface because if I do a traceroute to the openvpn client is just gets stuck at my internal interface
10:21 < Mowee> sppadic, the connection is still refused
10:21 < Mowee> I did a chmod 777 on the crl.pem file, put it in my jail directory and it didn"t change anything
10:21 < sppadic> ok Mowee - time to bring in the warrior - i think i am missing something very obvious here 
10:22 < Mowee> Bushmills, I need your help, Im stuck
10:24 < Mowee> "When the crl-verify option is used in OpenVPN, the CRL file will be re-read any time a new client connects or an existing client renegotiates the SSL/TLS connection (by default once per hour)"
10:24 < Mowee> Once per hour
10:24 < Mowee> maybe the problem isn't a problem
10:27 < sppadic> client abel {
10:27 < sppadic>              ip 10.133.0.30
10:27 < sppadic>              subnet 10.133.3.0/24
10:27 < sppadic>          }
10:27 < sppadic>          subnet 10.133.0.0/24
10:29 < sppadic> abel408 dumb question here - but did u say u were using a bridge?
10:29 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has quit [Ping timeout: 252 seconds]
10:31 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
10:32 < abel408> Sorry, lost connection again
10:32 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 255 seconds]
10:32 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
10:50 -!- sppadic [~IceChat77@193.130.68.17] has quit [Quit: Don't push the red button!]
10:53 -!- star314 [~star314@beigelbeck-nb.isas.tuwien.ac.at] has joined #openvpn
10:57 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has quit [Ping timeout: 252 seconds]
11:10 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
11:10 -!- oc80 [oc80z@blea.ch] has joined #openvpn
11:20 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
11:20 -!- nixbro [~unknown@124.43.112.51] has joined #openvpn
11:33 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Read error: Connection reset by peer]
11:34 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
11:38 -!- Pr0zoid [~Pr0zoid@24-246-5-196.cable.teksavvy.com] has quit [Ping timeout: 258 seconds]
11:39 -!- nixbro [~unknown@124.43.112.51] has quit [Ping timeout: 240 seconds]
11:41 -!- star314 [~star314@beigelbeck-nb.isas.tuwien.ac.at] has quit [Quit: Leaving]
11:41 -!- nixbro [~unknown@124.43.112.51] has joined #openvpn
11:45 < arisg> http://3laloynkai2xoreyoyn.wordpress.com/2011/07/05/openvpn-routing-problems-on-solaris/ <-- if someone has the same problem this might be the solution
11:45 <@vpnHelper> Title: OpenVPN routing problems on Solaris � Τρεις λαλούν και δυο χορεύουν (at 3laloynkai2xoreyoyn.wordpress.com)
11:54 -!- luneff [~yury@84.51.213.254] has joined #openvpn
12:00 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
12:00 -!- mode/#openvpn [+o raidz] by ChanServ
12:13 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:15 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13456>
12:21 -!- de22 [~de22@2a01:e35:2eaf:e400:21f:3cff:fe31:c5a0] has joined #openvpn
12:21 -!- Pr0zoid [~Pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
12:23 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:24 < de22> Hello all, i have a question : Is it normal to keep receiving traffic from the vpn server after disconnection ?
12:29 -!- arisg is now known as bofh
12:30 -!- bofh is now known as Guest62015
12:30 -!- Guest62015 is now known as arisg
12:33 <@vpnHelper> RSS Update - forum: VPN Connected - No Traffic on tun0 <http://forums.openvpn.net/topic8407.html>
12:36 -!- Pr0zoid [~Pr0zoid@24-246-5-196.cable.teksavvy.com] has quit [Ping timeout: 244 seconds]
12:43 -!- Pr0zoid [~Pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
12:54 -!- arisg [~arisg@klaymen.physics.upatras.gr] has quit [Quit: Mpe, re malaka! MPE!]
13:13 < krzee> de22, if the server doesnt know the client is gone, i would expect it to keep following directions from --keepalive or similar until it realizes the connection is dead
13:14 < krzee> but those packets would go over the tunnel i would think
13:14 < krzee> so i wouldnt expect them to make it to the client
13:17 -!- dazo is now known as dazo_afk
13:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:27 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
13:27 -!- mode/#openvpn [+o mattock] by ChanServ
13:34 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380.html#p13458>
13:34 -!- quadDama1e is now known as quadDamage
13:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:38 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has joined #openvpn
13:40 <@vpnHelper> RSS Update - forum: Server and Client use wrong IP configuration <http://forums.openvpn.net/topic8387.html#p13461> || Clients cannot connect to my server (config/logs posted) <http://forums.openvpn.net/topic8402-15.html#p13460> || VPN Connected - No Traffic on tun0 <http://forums.openvpn.net/topic8407.html#p13459>
13:49 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has joined #openvpn
13:50 -!- abel408__ [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
13:50 -!- abel408__ is now known as abel408
13:51 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has left #openvpn []
13:51 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
13:55 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
13:57 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
13:59 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
14:00 < de22> krzee, i guess you're right, but i keep receiving them. Of course, the distant servers won't happen to know my real ip address. However, i've noticed several times that when disconnecting from my VPN service provider's server, it would keep sending me bunch of encrypted packet for a certain time. As we don't know the configuration of the server and since i'm using an implemented version of openvpn (Network manager, ubuntu 10.04 lucid), t
14:00 < de22> his issue may end unanswered
14:01 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:07 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has quit [Ping timeout: 252 seconds]
14:10 -!- abel408_ [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
14:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 255 seconds]
14:13 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 264 seconds]
14:14 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
14:15 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
14:15 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
14:19 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:20 -!- syn4pse [~syn@p5DDC0836.dip0.t-ipconnect.de] has quit [Quit: Verlassend]
14:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:27 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
14:32 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
14:33 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
14:38 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:38 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Excess Flood]
14:41 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
14:41 -!- nixbro [~unknown@124.43.112.51] has quit [Ping timeout: 240 seconds]
14:42 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:45 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Ping timeout: 255 seconds]
14:47 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
14:50 -!- abel408_ [429863d2@gateway/web/freenode/ip.66.152.99.210] has quit [Ping timeout: 252 seconds]
14:54 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has quit [Quit: Gaglia]
14:55 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Excess Flood]
14:55 <@vpnHelper> RSS Update - forum: VPN Connected - No Traffic on tun0 <http://forums.openvpn.net/topic8407.html#p13462>
14:59 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
14:59 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
15:37 -!- ehnde [~noctmilam@unaffiliated/ehnde] has quit [Read error: Connection reset by peer]
15:46 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
15:46 -!- ManDay [~ManDay@p4FE0532C.dip.t-dialin.net] has joined #openvpn
15:47 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
15:52 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
15:56 -!- oc80 [oc80z@blea.ch] has quit [Excess Flood]
15:57 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:07 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:17 -!- ManDay [~ManDay@p4FE0532C.dip.t-dialin.net] has quit [Quit: WeeChat 0.3.5]
16:18 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:20 <@vpnHelper> RSS Update - forum: Push route - not working <http://forums.openvpn.net/topic8399.html#p13463>
16:27 -!- guifort [~guifort@161.239.86.79.rev.sfr.net] has joined #openvpn
16:32 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13464>
16:38 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
16:38 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13465>
16:39 -!- guifort [~guifort@161.239.86.79.rev.sfr.net] has quit [Quit: Quitte]
16:44 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13466>
17:00 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:06 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The alternative IRC client]
17:07 -!- oskie [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has joined #openvpn
17:07 < oskie> if I use the 'tap' approach - do I need to enable IP forwarding in the kernel?
17:08 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
17:29 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
17:30 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
17:35 < piyokos> is there any solution to running openvpn in iran?
17:36 < piyokos> it seems to connect and then drop a few seconds later, i am not sure if it is deep packet inspection or some sort of really aggressive firewall
17:37 -!- Akkar1n [~steve@static.188.41.47.78.clients.your-server.de] has joined #openvpn
17:37 < Akkar1n> !welcome
17:37 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:38 < Akkar1n> !goal
17:38 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:39 < Akkar1n> !howto
17:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:42 -!- gyyrog [~gyyrog@174.124.190.154] has joined #openvpn
17:50 <@vpnHelper> RSS Update - forum: Ovpn windows 7 easy-rsa and ssl <http://forums.openvpn.net/topic8328.html#p13467>
17:56 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
18:07 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:08 -!- gyyrog [~gyyrog@174.124.190.154] has quit [Remote host closed the connection]
18:10 -!- corretico_ [~luis@186.176.7.194] has quit [Quit: Leaving]
18:11 -!- Akkar1n [~steve@static.188.41.47.78.clients.your-server.de] has left #openvpn []
18:16 < Doonz> !redirect
18:16 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
18:17 < Doonz> I have my laptop connected to my openvpn server. When i launch the web browser its not going through my tunnel. How do i make it so when i fire up and connect my openvpn client the entire system goes through the tunnel
18:24 -!- de22 [~de22@2a01:e35:2eaf:e400:21f:3cff:fe31:c5a0] has left #openvpn []
18:50 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
19:07 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
19:09 -!- corretico [~luis@201.201.44.82] has joined #openvpn
19:14 -!- Punkbob [~Punkbob@c-76-21-171-135.hsd1.va.comcast.net] has joined #openvpn
19:14 < Punkbob> !goal
19:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:14 < Punkbob> !welcome
19:14 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:16 < Punkbob> Hey, I got a quick question, I am looking to build a custom client for windows users, and the wiki at securecomputing seems to mention openvpn-installer.exe, is that just the regular old gui?
19:16 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
19:17 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has quit [Quit: Linkinus - http://linkinus.com]
19:28 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
20:03 -!- nixbro [~unknown@124.43.112.51] has joined #openvpn
20:15 -!- master_of_master [~master_of@p57B52E43.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
20:17 -!- master_of_master [~master_of@p57B52D8D.dip.t-dialin.net] has joined #openvpn
20:23 -!- batrick [~batrick@nmap/developer/batrick] has quit [Read error: Connection reset by peer]
20:27 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
20:44 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
20:46 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
21:01 -!- nixbro_ [~unknown@124.43.125.169] has joined #openvpn
21:03 -!- nixbro__ [~unknown@124.43.125.169] has joined #openvpn
21:03 -!- nixbro_ [~unknown@124.43.125.169] has quit [Read error: Connection reset by peer]
21:04 -!- nixbro [~unknown@124.43.112.51] has quit [Ping timeout: 260 seconds]
21:20 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:20 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
21:22 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has left #openvpn []
21:26 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:43 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:57 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 258 seconds]
22:09 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:17 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:35 -!- nixbro__ [~unknown@124.43.125.169] has quit [Ping timeout: 255 seconds]
22:44 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:58 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
23:09 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:09 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:42 -!- ravidar [~ravidar@ip24-255-127-217.dc.dc.cox.net] has joined #openvpn
23:45 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
--- Day changed Wed Jul 06 2011
00:08 -!- ravidar [~ravidar@ip24-255-127-217.dc.dc.cox.net] has quit []
00:22 -!- nixbro [~unknown@59.163.254.66] has joined #openvpn
00:25 -!- dazo_afk is now known as dazo
00:41 -!- Pr0zoid [~Pr0zoid@24-246-5-196.cable.teksavvy.com] has quit []
00:47 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
01:03 -!- dazo is now known as dazo_afk
01:05 -!- dazo_afk is now known as dazo
01:08 -!- corretico [~luis@201.201.44.82] has joined #openvpn
01:34 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
01:34 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
01:34 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:38 <@vpnHelper> RSS Update - forum: The local and remote VPN endpoints cannot use <http://forums.openvpn.net/topic8406.html#p13468>
01:39 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
01:44 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13470> || Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13469>
01:50 <@vpnHelper> RSS Update - forum: VPN Connected - No Traffic on tun0 <http://forums.openvpn.net/topic8407.html#p13472> || Push route - not working <http://forums.openvpn.net/topic8399.html#p13471>
01:55 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
02:25 -!- plum [~chatzilla@unaffiliated/plum] has joined #openvpn
02:25 < plum> !welcome
02:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:26 < plum> !goal
02:26 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:27 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:29 < plum> I would like to access my computer's files/remote desktop etc. from my Android phone, from wherever I have Internet access
02:29 < plum> !howto
02:29 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
02:34 -!- apricot [~chatzilla@unaffiliated/plum] has joined #openvpn
02:35 -!- plum [~chatzilla@unaffiliated/plum] has quit [Disconnected by services]
02:35 -!- apricot is now known as plum
02:39 -!- sppadic [~IceChat77@193.130.68.17] has joined #openvpn
02:41 < Mowee> Morning
02:42 < sppadic> hey Mowee morning 
02:43 < sppadic> any luck?
02:43 < Mowee> Hey sppadic
02:43 < sppadic> or is it still fubar?
02:43 < Mowee> I'm going to resume my investigates :(
02:43 < Mowee> I comment the crl-verify in wainting
02:43 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13473>
02:43 < Mowee> waiting*
02:44 < plum> Hi, can someone help me to set up an openVPN server? I just ran the commands to install the tap32 driver, and generate a static key. Not sure what to do now...
02:44 < sppadic> Mowee I will be around - just might take a while to respond as will be running around 
02:44 < plum> I tried copying the sample config to my config, but it did not work (i assumed it wouldn't)... I'm wondering how I should configure it?
02:45 < Mowee> Read the man
02:46 < Mowee> Try to understand what you do
02:46 < plum> Yeah, trying that... it seems really complex. :x
02:48 < plum> On Machine A create a file config.ovpn: remote [IP address of B]
02:48 < plum> ^ On this step, what would I do if I'm not sure of the IP of my phone (as it will be going to different IPs if it connects to different networks)
02:51 < Mowee> Your remote IP is a server, not your phone
02:52 < Bushmills> !howto
02:52 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
02:52 < Bushmills> plum ^^^
02:52 < Bushmills> phone is jailbroken?
02:53 < plum> Hmmm I see Bushmills... I am using an Android phone.
02:53 < Bushmills> you need root on your phone, hence jailbreak
02:53 < plum> It has vpn options in network settings
02:53 < plum> yup, have that :)
02:54 < Bushmills> "vpn options" != "openvpn client"
02:54 < Bushmills> probably installation of some tun/tap driver is necessary too
02:55 < plum> I'm looking at the options right now... I can add PPTP vpn, L2TP, L2TP/IPSec PSK, L2TP/IPSec CRT, and OpenVPN vpn
02:56 < Mowee> You mean the different vpn protocols
02:56 < plum> Ah yeah
02:56 < plum> sorry, all of these terms I am probably using incorrectly. I haven't gotten this to work yet but I would really like to...
02:56 < Mowee> But anyway, you need an openvpn server (or whatever)
02:57 < plum> Hmmm... I installed OpenVPN on this windows box I'm using, and am using the example server config
02:57 < plum> Of course it yields errors, but how do I diagnose these to move on?
02:57 < Mowee> It depends of what you need with a vpn tunnel
02:58 < Bushmills> let server (your phone) write a log file
02:58 < Mowee> Have a subnetwork to your home, relay your network traffic...
02:58 < Bushmills> writing to /tmp which is probably on shm may be a good idea  
02:59 < plum> Mowee: I want to be able to access my computer's files from my phone without being in the nearby area/network... also VNC if possible
02:59 < Bushmills> oh.  "server on windows box",  nm me saying "server your phone" 
02:59 < plum> Yeah I was a bit confused at that, haha
02:59 < Mowee> plum, it will be hard to access to your files with an android phone
03:00 < Mowee> I even don't know if there is a browser that can manage networks directories
03:00 < Mowee> You will have to use the prompt way
03:00 < plum> Ah :( 
03:00 < plum> Well even that sounds good, if I can just raise my IQ to a level that I understand how to do this... lol
03:00 < plum> :)
03:00 < Mowee> I tried Dropbox b4, it can be an easy way to access to some files anywhere you are
03:00 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13474>
03:01 < Bushmills> ain't there smbclient, or a possibility to mount cifs/smb shares, on android? i'd have thought that there is.
03:02 < Bushmills> together with autofs, access becomes even comfortable.
03:03 < Mowee> Why not, but it seems to be pretty hard for him to manage that solution
03:03 < plum> I use dropbox as well, very nice app. I want to see if i can get this working though, I think it would be really cool to, say, SSH into my computer from my phone from anywhere
03:03 < Mowee> That's why my purpose is to use dropbox
03:04 < Mowee> You have to add rules to your firewall
03:04 < plum> Aw :(
03:04 < Mowee> And imho, use a windows to make a server isn't a good solution
03:04 < plum> I don't have access to the firewall's options... my paranoid father doesn't want me messing things up
03:05 < plum> I dual-boot with Ubuntu as well
03:05 < EugeneKay> lol windows
03:05 < EugeneKay> lol dualboot
03:05 < plum> EugeneKay!
03:05 < plum> :D
03:05 < EugeneKay> >_>
03:05 < plum> hehe
03:05 < Mowee> You won't be able to make any ssh/vpn or whatever server without a firewall 
03:06 < EugeneKay> Uh
03:06 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13476> || The local and remote VPN endpoints cannot use <http://forums.openvpn.net/topic8406.html#p13475>
03:06 < Mowee> without an access yo your firewall*
03:06 < Mowee> to
03:06 < EugeneKay> So many things wrong with that statement, but OK.
03:06 < plum> seems like I can't do much then... without that access :/
03:06 < plum> EugeneKay: is there something i can do then?
03:06 < Mowee> What is wrong with that statement EugeneKay ?
03:06 < EugeneKay> plum - stop being a loser and get a job, move out of your parent's house.
03:06 < plum> lmao
03:06 < Mowee> Behind a router/firewall, How can he forward his stuff?
03:07 < EugeneKay> uPNP?
03:07 < Mowee> No
03:07 < EugeneKay> Depends how crappy his wifi router is
03:08 < Mowee> Anyway we don't have any ideas of his configuration
03:08 < EugeneKay> You don't; I do. He's screwed.
03:08 < plum> :(
03:08 < Mowee> :)
03:09 < Mowee> Bushmills, Im still stuck with the crl-verify :( I move automatically the crl.pem in my chroot directory and added the crl-verify /etc/openvpn/jail/crl.pem
03:09 < Mowee> But it still drops my active clients
03:09 < plum> I dunno if this uses the same ports that would need to be allowed, but teamviewer and hamachi work through my firewall...
03:10 < EugeneKay> plum - that's because those use outbound connections to their servaz
03:10 < plum> ah right. now it makes more sense...
03:10 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:10 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:10 < Mowee> Try to host anything, you won't be able to welcome clients
03:10 < plum> yeah... I think without that access I am screwed then. :x
03:10 < Mowee> Backstab your dad
03:11 < plum> xD
03:11 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13477>
03:11 < EugeneKay> Like I said before.
03:11 < plum> he got a virus from having a tunnel open a while ago, so he's been all paranoid
03:11 < EugeneKay> Lolz
03:11 < EugeneKay> THey bypassed his primary encryption and rerouted it into a database with a visual basic GUI
03:12 < plum> dunno about that, but it found its way to my mom's computer as well over the network
03:12 < plum> mine and my brother's were just fine
03:12 < plum> :s
03:13 < plum> well thanks for the help anyway though guys
03:13 < plum> i gotta go sleep
03:13 < plum> cya later
03:13 -!- plum [~chatzilla@unaffiliated/plum] has quit [Quit: mulp]
03:14 < Mowee> 10am here, where is he from?
03:14 < hyper_ch> Mowee: central europe
03:14 < kisom> uPNP may work...
03:15 < kisom> nvm, had not scrolled all the way down :)
03:18 < Mowee> !help
03:18 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
03:30 < Mowee> !howto
03:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:34 -!- JdGordon [~jonno@rockbox/developer/JdGordon] has joined #openvpn
03:34 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13478>
03:35 < JdGordon> hey, apparently my works vpn and my isp both use the 10.x.x.x prefix... how do i get this working so i can connect to works vpn? http://pastebin.com/eDeawGeg is my route output
03:40 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html>
03:42 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
03:46 <@vpnHelper> RSS Update - forum: The local and remote VPN endpoints cannot use <http://forums.openvpn.net/topic8406.html#p13480>
03:52 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html> || The local and remote VPN endpoints cannot use <http://forums.openvpn.net/topic8406.html#p13482> || Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13481>
03:55 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
04:05 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13486> || tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13485>
04:08 < Mowee> sppadic é_è Im still stuck 
04:09 < Mowee> I have to comment the crl-verify line to have succeed connections
04:09 < Mowee> But the revokated clients can still connect
04:09 < Bushmills> use a non-conflicting subnet for openvpn. maybe from 172.16.0.0/12
04:10 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 258 seconds]
04:10 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13487>
04:11 < Bushmills> otoh, it is unlikely that your isp uses all of 10.0.0.0/8 - using a different subnet in 10.x would do.
04:11 -!- kala [kala@uba.linux.ee] has joined #openvpn
04:11 < Mowee> Bushmills, do you have any ideas?
04:11 -!- kala [kala@uba.linux.ee] has left #openvpn []
04:11 < Bushmills> no. maybe you have revoked clients which shouldn't have been?
04:12 < Bushmills> oh. "can still connect" ... again, no
04:12 < Mowee> Do I have to make clients verify the crl.pem?
04:12 < Mowee> (But anyway I don't know how to make them that)
04:13 < Mowee> "While the crl-verify directive can be used on both the OpenVPN server and clients, it is generally unnecessary to distribute a CRL file to clients unless a server certificate has been revoked. Clients don't need to know about other client certificates which have been revoked because clients shouldn't be accepting direct connections from other clients in the first place."
04:16 < Mowee> Ok, I commented the chroot line in the server.conf
04:16 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13488>
04:16 < Mowee> I tried and now I works
04:16 < Mowee> it*
04:17 < Mowee> So there's a problem with the chroot way
04:17 < Mowee> But I copied the crl.pem in the chroot directory as the howto says
04:21 -!- EugeneKay is now known as EugeneKaway
04:23 <@vpnHelper> RSS Update - forum: Multiple PC s on server side but not all can ping clients <http://forums.openvpn.net/topic8380-15.html#p13490> || Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13489>
04:24 -!- nixbro [~unknown@59.163.254.66] has quit [Ping timeout: 258 seconds]
04:27 < oskie> hello, I'm using Linux openvpn server, set up with tap and "server-bridge GW MASK START END" and was hoping that it would push Windows clients IP addresses, but it doesn't work. do I need a DHCP server?
04:28 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:28 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:28 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:29 < Mowee> Ok sppadic Bushmills :) The problem was the chroot \o/
04:30 < Bushmills> ah
04:30 < sppadic> Ahhhhhh
04:30 < sppadic> nice one Mowee
04:30 < sppadic> shall have to remember that for next time 
04:30 < Mowee> It is necessary to copy from the easy-rsa/keys, the crl.pem to /etc/openvpn/ (or whatever), AND the chroot directory
04:30 < sppadic> so twas permissions 
04:30 < sppadic> it was even 
04:30 < Mowee> Yes
04:30 < Bushmills> oskie: no. openvpn server pushs addresses to clients, lest they request one.
04:30 < Mowee> I even chmod 755 the crl.pem file
04:31 < Bushmills> make sure your client config actually contains the directive "client"
04:31 < Mowee> But the primary fact is to copy the crl.pem in the /etc/openvpn and chroot directories
04:32 < sppadic> cool 
04:35 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13491>
04:36 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
04:38 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
04:47 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13493> || Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13492>
04:53 <@vpnHelper> RSS Update - forum: failed to authenticate: User not known to the underlying aut <http://forums.openvpn.net/topic8410.html> || tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13494>
04:59 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13496>
05:00 -!- nixbro [~unknown@59.163.254.66] has joined #openvpn
05:05 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13498> || tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13497>
05:11 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13501> || Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13500>
05:14 -!- EugeneKaway is now known as EugeneKay
05:17 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13502>
05:21 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
05:29 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13503>
05:33 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 260 seconds]
05:39 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
05:43 < defswork> I put my rememberable password generator onto a website - http://sensiblepassword.com
05:43 <@vpnHelper> Title: SensiblePassword.com - a billion passwords you will never forget (at sensiblepassword.com)
05:43 < EugeneKay> "migrantmaterial"
05:44 < EugeneKay> -_-
05:44 < defswork> my last one was moistvaginal - I kid you not
05:44 < EugeneKay> "Light360Bankroll"
05:44 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
05:44 < EugeneKay> "tubslesbian"
05:45 < EugeneKay> "pedagogysashay"
05:45 < EugeneKay> It isn't getting any better
05:45 < defswork> the emphasis is on a password that a user can remember
05:46 < defswork> obviously there are some obtuse ones
05:46 < defswork> but refresh solves that
05:47 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13504>
05:51 < cpm> I think remembering is a distraction, easy for your typing fingers to remember is more key. 
05:51 < defswork> to someone that types perhaps
05:52 < defswork> but to users that type with one finger mostly ?
05:52 < defswork> I almost touch type so have virtually remember the finger rhythm 
05:59 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13505>
05:59 -!- EugeneKay [eugenekay@chaoschaoschaos.com] has quit [Read error: Operation timed out]
06:03 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
06:05 < oskie> Bushmills: Many thanks. That "client" keyword did it.
06:16 -!- rommel092079 [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
06:17 < rommel092079> I know my question is not related with openvpn but I would ask anyway. May I ask who is using ptunnel here? I just would like to ask what port are they using that is working.
06:25 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:29 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
06:33 < oskie> ok, now I'm using tap but I can't ping anything inside the tap tunnel. bridge problem?
06:35 < rommel092079> nothing here?
06:40 -!- rommel092079 [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
06:52 -!- g6e45y [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
06:53 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409.html#p13507>
06:53 < g6e45y> Isn't it possible to use the same certificate for server AND client on a mashine? I hav a number of serveres that I need to inter-connect via ovpn-links, but I can't get the client to accept a server-certificate
07:01 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
07:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:05 <@vpnHelper> RSS Update - forum: The local and remote VPN endpoints cannot use <http://forums.openvpn.net/topic8406.html#p13508>
07:15 <@dazo> g6e45y: it depends on the usage flags in the certificate ... normally, client and server certs are differentiated
07:17 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409-15.html#p13509>
07:18 < g6e45y> Yes, but for my inter-server links, I'd like to be able to share a certificate. Why is that not possible? It makes sense that I can't use a client cert for a server, but the other way around? What's the issue for that?
07:19 <@dazo> g6e45y: because it's encoded into the certificate if it is a client or server certificate
07:20 <@dazo> g6e45y: you need go generate a certificate which have both client and server flags set
07:21 < oskie> any idea why TAP openvpn goes up perfectly and assigns client address, but NO traffic whatsoever (incl. arp) passes in any direction
07:23 <@dazo> oskie: firewall?
07:23 <@vpnHelper> RSS Update - forum: The local and remote VPN endpoints cannot use <http://forums.openvpn.net/topic8406.html#p13510>
07:23 < oskie> dazo: client (win7) firewall inactive, and on the linux box i have only ACCEPT on input/forward/output
07:24  * oskie is perplexed
07:27 -!- JdGordon [~jonno@rockbox/developer/JdGordon] has left #openvpn []
07:38 < oskie> that was SICK! took me 1.5 h to spot. I had "dev tap" rather than "dev tap0"
07:41 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:41 <@vpnHelper> RSS Update - forum: Push route - not working <http://forums.openvpn.net/topic8399.html#p13512>
07:42 < oskie> is it possible to have multiple users (sessions) using the same client certificate & key?
07:43 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:43 -!- Cain` is now known as Cain
07:45 < g6e45y> dazo: Do you have any idea og how I can create such a certificate usable for both server and client?
07:47 <@dazo> g6e45y: if you use easy-rsa ... you need to poke at the build-key and build-key-server scripts, and maybe the pkitool script 
07:47 <@dazo> g6e45y: otherwise, I know you can do that via xca, but that requires you to have your CA in xca as well
07:48 < g6e45y> dazo: I've build my own script based on easy-rsa
07:48 < g6e45y> It looks to me as if openssl can only build to ether client or server. Not both
07:48 <@dazo> then it's just some options given to these scripts .... but I sense you might need to have a close look at the pkitool script
07:49 < g6e45y> I think, that I better go for a two-cert solution ;-)
07:49 <@dazo> that's definitely the safest approach
07:49 <@dazo> also from a security perspective
07:59 <@vpnHelper> RSS Update - forum: Push route - not working <http://forums.openvpn.net/topic8399.html#p13513>
08:17 <@vpnHelper> RSS Update - forum: TAP-Win32 driver at least version 9.8 vs 9.00.00.8 <http://forums.openvpn.net/topic8411.html> || Push route - not working <http://forums.openvpn.net/topic8399.html#p13514>
08:22 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Remote host closed the connection]
08:27 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
08:28 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Client Quit]
08:28 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
08:28 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has joined #openvpn
08:29 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
08:30 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
08:34 -!- Netsplit *.net <-> *.split quits: cpm, @cron2, Nappy, 30BAAHOWT, sppadic, openbsdnoob
08:34 -!- openbsdnoob_ is now known as openbsdnoob
08:42 -!- Netsplit over, joins: Nappy
08:42 -!- Netsplit over, joins: cpm
08:51 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
09:02 -!- gyyrog [~gyyrog@174.124.188.195] has joined #openvpn
09:03 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
09:05 -!- sppadic [~IceChat77@193.130.68.17] has joined #openvpn
09:08 -!- gyyrog [~gyyrog@174.124.188.195] has quit [Remote host closed the connection]
09:10 <@vpnHelper> RSS Update - forum: Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html>
09:16 -!- gyyrog [~gyyrog@174.124.188.195] has joined #openvpn
09:20 -!- gyyrog_ [~gyyrog@174.124.188.195] has joined #openvpn
09:22 -!- gyyrog [~gyyrog@174.124.188.195] has quit [Ping timeout: 246 seconds]
09:24 -!- gyyrog_ [~gyyrog@174.124.188.195] has quit [Ping timeout: 246 seconds]
09:25 -!- oskie [~usel@h23n4-m-fb-gr100.ias.bredband.telia.com] has left #openvpn []
09:29 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 255 seconds]
09:36 -!- dazo is now known as dazo_afk
09:46 <@vpnHelper> RSS Update - forum: Push route - not working <http://forums.openvpn.net/topic8399.html#p13517>
09:46 -!- nixbro [~unknown@59.163.254.66] has quit [Ping timeout: 252 seconds]
09:58 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:59 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:59 -!- ironfroggy [~calvin@python/site-packages/ironfroggy] has joined #openvpn
10:04 -!- zenaan [~justa@180.181.106.97] has joined #openvpn
10:04 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
10:04 < zenaan> !welcome
10:04 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:05 < zenaan> !howto
10:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:06 < zenaan> Anyone seen this error: ERROR:  This version of OpenVPN requires a TAP-Win32 driver that is at least version 9.8
10:07 -!- STF_ [~chatzilla@dslb-178-006-018-246.pools.arcor-ip.net] has joined #openvpn
10:07 < zenaan> ovpn2.2.0 install "9.0.0.8" not 9.8!
10:07 < UdontKnow> zenaan: upgrade your tap driver? :-) 
10:07 < Bushmills> zenaan:  do you?
10:07 -!- STF_ is now known as STF
10:08 < zenaan> I just installed 2.2.0. How to upgrade TAP driver? Is that needed?
10:08 < UdontKnow> hmmm, not a windows user here
10:09 < zenaan> !goal
10:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:10 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:10 -!- mode/#openvpn [+o mattock] by ChanServ
10:10 < zenaan> !goal I'm creating a test VPN between two local workstations, Ubuntu for ovpn server, Windows XP for client, then when it works, set up similar to vps out on web.
10:11 < zenaan> I've disabled firewall on internal network. Also tried disabling firewall altogether (with internet eth disabled).
10:11 < Bushmills> you aren't confusing vpn and vps, are you?
10:11 < UdontKnow> you described your method, not your goal
10:11 < zenaan> No, not confusing them.
10:12 < UdontKnow> what is the vpn for?
10:12 < zenaan> Sorry Goal is to create vpn between my workstation and my vps.
10:12 < zenaan> First step is create vpn between two local computers.
10:12 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:12 < zenaan> vpn hosts web server, and will host other services, for non-profit human rights association.
10:12 < Bushmills> !howto
10:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:13 < UdontKnow> what is your use for the vpn? that is the goal
10:14 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:14 < zenaan> Thanks - vpn is for ftp, email (pop), likely smb fileshares, and more (future, voip etc) - want to be able to use vps as a multi service host, with standard protocols, and secure all communications between clients and vps.
10:15 < zenaan> Also, vpn for voip conferences, and sharing files between clients. Remote offices for the association basically.
10:15 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:15 < zenaan> Remote offices, in multiple locations, all connecting through server.
10:18 < zenaan> Initial goal for vpn: to secure dreamweaver uploads to server (primary client uses Windows XP, dreamweaver, ftp uploads for website). I wish to secure the ftp uploads. There are plans for various other services over the vpn as mentioned before.
10:19 < zenaan> I've used Debian and Ubuntu on my primary laptop workstation for about 10 years, and Windows XP on and off for a few years. Reasonably familiar with networking config on both Linux and XP.
10:21 < zenaan> Should I try to uninstall ovpn and reinstall, on XP perhaps? I installed secure point vpn, then uninstalled it, and added two extra TAP adapters. Removed secure point vpn, removed and re-added TAP devices (to make sure the latest driver was being used). I do have more than one TAP adapter installed, and coLinux which uses TAP driver v8. Perhaps I have to uninstall to a simpler start point?
10:23 < zenaan> The error confuses me though, since the .inf file for the TAP device that came with ovpn has no 9.8, only version 9.0.0.8. So that's why the error does not make sense to me.
10:24 < zenaan> (Above: should be "vps hosts web server" of course, not vpn. Sorry, it's after 1am for me here in Australia.)
10:29 < zenaan> Thu Jul 07 01:28:40 2011 us=314000 TAP-Win32 Driver Version 9.4
10:29 < zenaan> Thu Jul 07 01:28:40 2011 us=314000 ERROR:  This version of OpenVPN requires a TAP-Win32 driver that is at least version 9.8 -- If you recently upgraded your OpenVPN distribution, a reboot is probably required at this point to get Windows to see the new driver.
10:41 -!- K1ng` [~KING@180.211.188.242] has quit [Ping timeout: 276 seconds]
10:43 < zenaan> Signing off for tonight. Will come back tomorrow night. Thanks for feedback so far.
10:44 < defswork> zenaan, I wouldnt use a vpn for that
10:45 < zenaan> vpn not best for joining remote offices?
10:45 < defswork> no - for ftp uploads to a website
10:46 < defswork> I wouldn't use ftp period
10:46 < zenaan> agree normally - securing ftp is just first step. I don't use dreamweaver, so I don't know what other protocols it offers.
10:46 < defswork> fairly certain it can do sftp 
10:46 < zenaan> when i say first step, I mean, to build my experience with configuring vpn to our vps
10:47 -!- K1ng [~KING@180.211.188.242] has joined #openvpn
10:51 -!- Kalavera [~Kalavera@190.232.0.63] has joined #openvpn
10:51 -!- mikeX [~mike@adsl-178.109.242.58.tellas.gr] has joined #openvpn
10:51 < mikeX> hi, is it possible to force openvpn to use expired certificates?
10:52 < Kalavera> Greetings guys, need to do an OpenVPN configuration keeping the server in a Linux OS and the clients will be over Windows, can u please give me an advice about the best way to deal with it? 
10:53 < ecrist> mikeX: change the date of the server.
10:53 < defswork> Kalavera, install and configure openvpn on server and then install and configure clients
10:54 < Bushmills> !howto
10:54 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:54 < mikeX> ecrist: I have no access whatsoever to the server (uni server) that's why I'm asking (btw only using server certificates, no client ones)
10:54 < ecrist> mikeX: is the client or server rejecting the certiifcate?
10:55 < mikeX> let me paste the message, I guessed it was the client
10:55 < Kalavera> defswork: thanks for answering , can  I use the VPN client that comes with windows to connect the OpenVPN server ? 
10:55 < defswork> no
10:55 < Kalavera> defswork: or do I need to download another client for it? 
10:55 < defswork> windows vpn client is a toy
10:55 <@vpnHelper> RSS Update - forum: OpenVPN 2.2.1 released <http://forums.openvpn.net/topic8413.html>
10:55 < defswork> use the openvpn client 
10:56 < Kalavera> defswork: and I don't need to install all the OpenVPn package on the windows desktop , right? only the client
10:56 < defswork> package ?
10:56 < Kalavera> defswork: I mean the server and client side
10:56 < Bushmills> server and client are same program
10:56 < defswork> the client code is the server code and vice versa
10:56 < Bushmills> only the config determines the role of either
10:57 < Kalavera> defswork: Bushmills: Ok thank you guys
10:58 -!- sppadic [~IceChat77@193.130.68.17] has quit [Quit: Clap on! , Clap off! Clap@#&$NO CARRIER]
10:59 < mikeX> ecrist: http://pastebin.com/JR6fXX4t
11:07 < mikeX> ecrist: it keeps retrying after that, ending up with the same message
11:07 < ironfroggy> Can anyone tell me if i need some additional step to get my machine to packet foward over my tun0 device?
11:08 < defswork> echo 1 > /proc/sys/net/ipv4/ip_forward ?
11:08 -!- mattock2 [~samuli@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
11:09 < defswork> ironfroggy, you need to tell openvpn to learn the traffic too
11:10 < ironfroggy> i already have enabled ip_foward, and have been using it successfully for some time. i just cant get it to work over my vpn tunnel now. how do i do that part?
11:10 < defswork> you need the right routing in place for starters
11:11 < defswork> and you need to let openvpn also with the iroute directive
11:11 < defswork> if you want to route remote subnet and not just single client
11:12 -!- mattock2 [~samuli@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Client Quit]
11:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
11:13 < ironfroggy> i just want a single client through the vpn my host is already using
11:14 < ironfroggy> and i dont understand why my current setup doesnt do that
11:14 < ironfroggy> i have machine A routing the subnets on the VPN to machine B, which is running openvpn and ip_forward=1
11:15 <@raidz> http://twitter.com/#!/OpenVPN/status/88642072285941761
11:15 <@vpnHelper> Title: Twitter (at twitter.com)
11:15 -!- mattock_ [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
11:15 -!- mode/#openvpn [+o mattock_] by ChanServ
11:15 < ironfroggy> previously, instead of openvpn, machine B was itself routing those subnets to machine C which was a windows VPN machine, adn that works
11:15 -!- mattock_ changed the topic of #openvpn to: Topic for #openvpn: OpenVPN 2.2.1 most current, released 6-July-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: https://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly. || Host Cloaks available, just ask for one. | Access Server support in #openvpn-as
11:15 -!- mattock_ [~samuli@openvpn/corp/admin/mattock] has quit [Client Quit]
11:15 < ironfroggy> i've taken C out of the picture, and A still routes to B, and no longer can connect to the VPN through it. why does the traffic not continue over the VPN?
11:16 -!- mattock_ [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
11:16 -!- mode/#openvpn [+o mattock_] by ChanServ
11:16 < defswork> you've lost me :)
11:16 < ironfroggy> me too :-|
11:16 < defswork> where is the vpn server ?
11:16 < defswork> in the main subnet ?
11:16 < ironfroggy> its somewhere else entirely, a few states away from me.
11:16 < defswork> and you just want to access on remote machine from that subnet ?
11:17 < defswork> when talking networking the state or country that the equipment is in is know as superfluous information
11:17 < defswork> :)
11:17 < ironfroggy> i know that i am just expressing its not a local subnet to me
11:17 < ironfroggy> if it was local i wouldnt need the VPN
11:18 < defswork> so you are running openvpn client - connecting to vpn server that is a gateway to a subnet that you need access to ?
11:18 < ironfroggy> yes
11:18 < ironfroggy> and that part works. that machine can connect to all the machines on the subnets through the VPN just fine
11:18 < defswork> do you have the right routes pushed to you so your pc knows that to get to the remote subnet it goes via the vpn dev ?
11:19 < ironfroggy> yes
11:19 < defswork> is the remote vpn server natting vpn clients ?
11:19 < ironfroggy> i dont think so, but i'm not positive. how is that relevent?
11:19 < defswork> is the problem that the remote subnet cannot connect to your IP ?
11:20 < ironfroggy> i dont see how that would matter or even why the remote subnet would need to connect me..
11:20 < defswork> what is the problem ?
11:20 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:21 < defswork> you want to route through your vpn client pc to the subnet ?
11:21 < ironfroggy> yes
11:21 < defswork> joining two subnets ?
11:21 < ironfroggy> i have two machine on my local network
11:21 < ironfroggy> one connected to the VPN
11:21 < ironfroggy> and i want the other one to forward through the first
11:21 < defswork> ok - so you either need to NAT your local subnet to the openvpn client IP address
11:22 < defswork> or ensure that the server knows about your local subnet - iroute
11:22 < defswork> and all the remote subnet machines know to route to your subnet via the vpn server (if it's not their default gateway)
11:22 < ironfroggy> why do *they* need to route to *me*?
11:23 < ironfroggy> i thought i was trying to do exactly the opposite..
11:23 -!- nixbro [~unknown@124.43.124.193] has joined #openvpn
11:23 < defswork> then have to reply to you
11:23 < defswork> they*
11:23 < ironfroggy> i'm a moron, apparently..
11:23 < defswork> they will get incoming packets and route them out a comletely different way else
11:24 < ironfroggy> so my packets are getting out (probably) they just cant respond to me
11:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:24 < ironfroggy> so, i dont have any access to change that server. that leaves the NAT option?
11:24 < ironfroggy> i think i should plead for enabling simultanious connections...
11:25 < defswork> if you nat your subnet to your openvpn client IP then it will just work
11:26 < ironfroggy> sounds like i have much more googling and documentationing ahead of me...
11:26 < defswork> at the moment the remote network only see traffic coming  from your openvpn client IP - not your local network IP 
11:27 -!- ironfroggy [~calvin@python/site-packages/ironfroggy] has left #openvpn ["Konversation terminated!"]
11:27 -!- ironfroggy [~calvin@python/site-packages/ironfroggy] has joined #openvpn
11:27 < defswork> so they know nothing about your subnet at all
11:27 < defswork> you running linux ?
11:27 < ironfroggy> yes
11:27 < defswork> single iptables rule then
11:27 < ironfroggy> wouldnt the forwarded packet have the originator IP?
11:28 < ironfroggy> not that it would know how to return that, because its the wrong subnet (for the VPN)
11:28 < defswork> iptables -t nat -A POSTROUTING -j SNAT etc....
11:28 < defswork> thats what SNAT does
11:28 < defswork> source network address translation
11:28 < ironfroggy> which machine do i need to do taht on
11:28 < defswork> changes the from IP and keeps a note so that incoming packets can be reversed
11:28 < defswork> your linux openvpn client pc
11:30 < defswork> iptables -A POSTROUTING -t net -s YOURSUBNET/24 -d REMOTESUBNET/MASK -j SNAT --to-source YOUROPENVPNCONNECTIONIP
11:30 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13519>
11:30 < ironfroggy> how can i determine what REMOTESUBNET is?
11:30 < defswork> duh ?
11:31 < defswork> you access the machines theren dont you ?
11:31 < ironfroggy> there are two remote subnets my VPN routes
11:31 < defswork> two iptables rules then
11:31 < defswork> I gotta go
11:31 < defswork> hometime
11:54 < mikeX> seems to work now, after upgrading to 2.2.0 
11:58 -!- zenaan [~justa@180.181.106.97] has quit [Ping timeout: 276 seconds]
12:03 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Quit: Verlassend]
12:07 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:10 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:22 -!- fireglow [fireglow@irssi.eu] has joined #openvpn
12:23 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Read error: Operation timed out]
12:24 <@vpnHelper> RSS Update - forum: OpenVPN gets stuck at "connecting" state <http://forums.openvpn.net/topic8414.html>
12:27 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
12:33 < ironfroggy> can anyone tell me how to setup iptables as defswork had been suggesting to NAT the traffic forwarded through my vpn client?
12:39 -!- mikeX [~mike@adsl-178.109.242.58.tellas.gr] has left #openvpn []
12:42 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13521>
12:47 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5]
12:48 <@vpnHelper> RSS Update - forum: VPN Connected - No Traffic on tun0 <http://forums.openvpn.net/topic8407.html#p13523> || Push route - not working <http://forums.openvpn.net/topic8399-15.html#p13522>
12:49 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
12:51 -!- mattock_ [~samuli@openvpn/corp/admin/mattock] has quit [Quit: leaving]
12:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:54 <@vpnHelper> RSS Update - forum: Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html#p13525> || OpenVPN gets stuck at "connecting" state <http://forums.openvpn.net/topic8414.html#p13524>
12:56 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has joined #openvpn
13:03 -!- abel408 [429863d2@gateway/web/freenode/ip.66.152.99.210] has quit [Ping timeout: 252 seconds]
13:06 <@vpnHelper> RSS Update - forum: OpenVPN gets stuck at "connecting" state <http://forums.openvpn.net/topic8414.html#p13528> || VPN Connected - No Traffic on tun0 <http://forums.openvpn.net/topic8407.html#p13527>
13:12 <@vpnHelper> RSS Update - forum: VPN Connected - No Traffic on tun0 <http://forums.openvpn.net/topic8407.html#p13531> || OpenVPN gets stuck at "connecting" state <http://forums.openvpn.net/topic8414.html#p13529>
13:18 <@vpnHelper> RSS Update - forum: OpenVPN gets stuck at "connecting" state <http://forums.openvpn.net/topic8414.html#p13533>
13:23 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:24 <@vpnHelper> RSS Update - forum: --http-proxy or --auto-proxy MUST be used in TCP Client mode <http://forums.openvpn.net/topic8383.html#p13534>
13:38 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
13:40 -!- K1ng [~KING@180.211.188.242] has quit [Ping timeout: 252 seconds]
13:41 -!- K1ng`` [~KING@180.211.188.239] has joined #openvpn
13:43 <@vpnHelper> RSS Update - forum: OpenVPN gets stuck at "connecting" state <http://forums.openvpn.net/topic8414.html#p13536> || VPN Connected - No Traffic on tun0 <http://forums.openvpn.net/topic8407.html#p13535>
13:43 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 246 seconds]
13:44 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:09 < Bushmills> !nat
14:09 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:19 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
14:19 < fireglow> !fbsdnat
14:19 <@vpnHelper> "fbsdnat" is see http://cavanantha.wordpress.com/2007/09/16/nat-on-freebsd-using-pf/ for a basic howto for NAT on FreeBSD
14:28 -!- nixbro [~unknown@124.43.124.193] has quit [Quit: Leaving]
14:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
14:29  * ecrist reboots xxx, hopes it comes back up
14:47 -!- Kalavera [~Kalavera@190.232.0.63] has quit [Ping timeout: 276 seconds]
15:13 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13537>
15:30 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
15:37 -!- Kalavera [~Kalavera@190.232.0.63] has joined #openvpn
15:38 -!- ironfroggy [~calvin@python/site-packages/ironfroggy] has quit [Ping timeout: 255 seconds]
15:38 < Kalavera> Greetings guys, I just set up an openvpn server using client and server certificates and can connect the openvpn server through the windows openvpn client. Now I can do a ping to the server at the IP address 10.8.0.1
15:39 < Kalavera> but what I can't do yet is to do a ping to the LAN network , which is at 192.1.0.0/24
15:40 < Bushmills> !route
15:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:40 < Bushmills> !serverlan
15:40 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
15:43 <@vpnHelper> RSS Update - forum: Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html#p13538>
15:46 -!- fireglow [fireglow@irssi.eu] has left #openvpn []
15:55 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:04 -!- luigi_panache [~isaac@68.50.228.136] has joined #openvpn
16:04 < luigi_panache> Hey guys... I'm really struggling with my openvpn set up here... I believe I've configured the server all correctly, but my clients get rejected on auth...
16:06 < Kalavera> ok I am connected to the LAN network also 
16:06 < Kalavera> luigi_panache: I did it using a client cert 
16:06 < Kalavera> if that helps
16:06 < Kalavera> :)
16:07 < luigi_panache> Kalavera: I have a client cert. It gets rejected.
16:07 < luigi_panache> I don't know why. Is there a special way to register it with the server?
16:07 < Kalavera> luigi_panache: did u copy all the certs into the comnfig directory of the client? 
16:07 < Kalavera> luigi_panache: ca.crt, client.crt , client.key 
16:08 < luigi_panache> Yep. And ta.key as well.
16:08 < Kalavera> that's nopt needed
16:08 < Kalavera> can u paste the message
16:08 < Kalavera> in a pastebin 
16:09 < luigi_panache> It's in the GUI, but it says no Valid Secrets were found or similar.
16:09 < luigi_panache> Failed because there were no valid VPN secrets
16:09 < luigi_panache> I used the configuration here:https://help.ubuntu.com/community/OpenVPN
16:09 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
16:10 < Kalavera> can u paste your client and server configuration 
16:10 < luigi_panache> I can't paste client configuration because it's handled by networkmanager
16:10 < luigi_panache> But I can do server
16:10 < luigi_panache> Wait, what file would I paste?
16:10 < luigi_panache> There are several.
16:11 < Kalavera> luigi_panache: try with this : http://forums.gentoo.org/viewtopic.php?t=233080 must get you connected at least
16:12 < Kalavera> review both sides server and client according with that link , that helped me
16:12 < Kalavera> to get me started
16:12 < luigi_panache> I'll do that then, thanks!
16:12 < Kalavera> and the guys here gave me some guides about routing and stuff
16:12 < Kalavera> anytime
16:12 < luigi_panache> Kalavera: My backbone is handled by some apple routers. I can't change much in that respect.
16:13 -!- luigi_panache is now known as luigi_p|away
16:15 < Bushmills> !ubuntu
16:15 <@vpnHelper> "ubuntu" is dont use network manager!
16:16 < luigi_p|away> Bushmills: Arch linux, thanks.
16:17 < Bushmills> !howto
16:17 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:17 < Kalavera> luigi_p|away: route and push directives will goes in the server side 
16:18 < Kalavera> luigi_p|away: I did nothing in my routers
16:18 -!- luigi_p|away is now known as luigi_panache
16:18 < luigi_panache> Oh, I see then.
16:18 < luigi_panache> Well, honestly the only reason I want to use this VPN is as a proxy of sorts.
16:19 < luigi_panache> Because I've found no decent, fast solutions to get around network blocks and I've heard VPN is good for that sort of thing.
16:19 < luigi_panache> Ideally, I want the VPN and LAN networks bridged.
16:19 < Bushmills> !tunortap
16:19 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:19 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
16:20 < luigi_panache> Bushmills: Thanks, you're so helpful yet at the same time not at all helpful.
16:20 < luigi_panache> I don't want to be treated like a little kid because I don't understand.
16:20 < Bushmills> ideally you want to *avoid* bridging lest you can avoid it
16:20 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:21 < luigi_panache> Bushmills: But why?
16:21 < Bushmills> what good would it do to repeat what the factoid said, but typing it myself?
16:21 < luigi_panache> "Don't waste the extra overhead"
16:21 < luigi_panache> Overhead from what?
16:21 < luigi_panache> What is the difference between tunortap and tap?
16:22 < luigi_panache> What do they do?
16:22 < luigi_panache> Oh my...
16:22 < luigi_panache> Why tun over tap?
16:22 < luigi_panache> I don't want layer2, I want layer3, no?
16:22 < Bushmills> broadcast traffic which is irrelevent for your client. also, you add another problem protential while still setting up, namely, the bridge
16:22 < krzie> luigi_panache, then you want tun
16:22 < luigi_panache> Bushmills: I have a bridge nicely set up already.
16:22 < krzie> yes, layer3
16:22 < Bushmills> i don't know what you want. but if you don't want layer 2, why bridge?
16:23 < luigi_panache> Bushmills: Because then I don't have to cross a subnet.
16:23 < krzie> bridge is layer2 tunneling for the whole lan
16:23 < krzie> if you only need layer3, definitely use tun
16:23 < krzie> !route
16:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:23 < Bushmills> what do you hope bridge gives you what routed setup won't?
16:23 < luigi_panache> Bushmills: Internet access?
16:24 < luigi_panache> I have one client, and one server.
16:24 < Bushmills> no bridge needed
16:24 < luigi_panache> Even for one client and one server?
16:24 < Bushmills> especially then not
16:24 < luigi_panache> Isn't it silly to have my one client on a different subnet than the rest of the lan?
16:24 < Bushmills> no, it isn't
16:25 < luigi_panache> Alright, I've removed a bridge device. So, I'm assuming I want an OpenVPN setup with tun and password-based auth?
16:25 < luigi_panache> I'll go look up how to do that
16:26 < Bushmills> symmetric key will probably do
16:26 < Bushmills> that is, static keys
16:26 < luigi_panache> Bushmills: I had a set up that involved client certs and whatnot, and that was awful to set up.
16:26 < luigi_panache> Is static keys any simpler?
16:26 < Bushmills> "quick start" section in ...
16:26 < Bushmills> !howto
16:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:27 < Bushmills> well, if *that* is already awful, i'm afraid that the whole openvpn experience will not be a very pleasing one for you.
16:27 < luigi_panache> Bushmills: It seemed like such a kludge to create my own CA
16:28 < Bushmills> ah. yes, static keys are much simpler
16:28 < luigi_panache> Well then, awesome!
16:28 < Bushmills> but why don't you just look at the howto?
16:28 < Bushmills> i didn't post that merely for decorative purposes
16:29 < luigi_panache> I am looking at it. I'm also watching my little brother as well, so I'm just being slow.
16:29 < luigi_panache> Bushmills: I've decided on a routed VPN?
16:29 < luigi_panache> Routing *via* tun?
16:30 < Bushmills> i don't know what you have decided. i know what has been suggested to you
16:30 < luigi_panache> Then I am choosing routed.
16:30 < Bushmills> internet through openvpn is ...
16:30 < Bushmills> !redirect
16:30 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
16:31 -!- STF [~chatzilla@dslb-178-006-018-246.pools.arcor-ip.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
16:31 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
16:31 < luigi_panache> ... Do I need all that with a bridged VPN?
16:32 < Bushmills> at least two thirds of it
16:32 < luigi_panache> I have NAT handled by my router... Do I need NAT on the server to have a double-NAT?
16:33 < Bushmills> you need NAT on the server so that it relays your requests to internet hosts
16:33 < luigi_panache> Bushmills: Why can't the server simply passthrough internet traffic it gets from a VPN client to the LAN gateway?
16:33 < Bushmills> (and returns replies to you)
16:34 < Bushmills> because your client won't have a proper public ip address to send back replies to
16:34 < luigi_panache> Bushmills: Yes it will, my NAT on the router will handle that, no?
16:34 < luigi_panache> If the VPN client has a LAN ip, can't it use the other LAN devices for internet?
16:34 < Bushmills> do you want returned packets to go through vpn?
16:35 < luigi_panache> All the server would need to do is listen for packets sent on the VPN client's LAN address, take them, and send them back through the VPN tunnel.
16:35 < luigi_panache> How is that handled?
16:35 < Bushmills> but they' ll have to get to server first
16:35 < luigi_panache> Ohhhhhhh
16:35 < Bushmills> won't happen if your router ip address is the origin
16:35 < luigi_panache> But on a bridge passthrough...?
16:36 < luigi_panache> I have a bridge on my network that's a Repeater Bridge.
16:36 < Bushmills> still not.  server must be originator of requests
16:36 < luigi_panache> Why?
16:36 < Bushmills> because  that's where replies will be sent back to
16:36 < luigi_panache> Then how does a repeater bridge work?
16:37 < luigi_panache> I have a linksys RPB that has an ip of 10.0.0.16
16:37 -!- rothwell [~rothwell@unaffiliated/rothwell] has quit [Ping timeout: 276 seconds]
16:37 < luigi_panache> My laptop is 10.0.0.77
16:37 < Bushmills> why don't you check up on fundamental networking on wikipedia, for example?
16:38 < Bushmills> your 10.x.x.x addresses can't be used to send back to replies from internet
16:38 < luigi_panache> Bushmills: Because I don't understand why when the server is a bridge that any address contained in the bridge can't be passed through without an address change.
16:38 < Bushmills> read about  rfc1918
16:38 < luigi_panache> How is my server any different than the repeater bridge on my network?
16:38 -!- patel is now known as patelx
16:38 < Bushmills> it has a non-rfc1918 ip address
16:38 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
16:38 -!- patelx [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Changing host]
16:38 -!- patelx [~patel@openvpn/corp/admin/patel] has joined #openvpn
16:39 < luigi_panache> Bushmills: Yes it does. It's accessable at 10.0.0.86
16:39 < luigi_panache> At least, on my lan. :)
16:39 < Bushmills> i couldn't ping your server on that address
16:40 < luigi_panache> Of course. But you can access it at pingas.org.
16:40 < luigi_panache> I have NAT on my airport router that forwards all traffic to 10.0.0.86 on the lan if the port hasn't been reserved for another address via NAT.
16:40 < Bushmills> that's where replies from internet hosts will have to go to
16:41 < luigi_panache> Bushmills: Yep. But my router should be able to say "Oh, 10.0.0.15 (the VPN device) was talking to google.com on port 80, and the incoming port was specified as 6000, so I'll send this incoming data to port 6000 on 10.0.0.15"
16:42 < luigi_panache> The server would see the traffic for 10.0.0.15, take it, and pass it to the VPN client on its bridge
16:42 < Bushmills> not quite, but about that, is what NAT is all about
16:42 < luigi_panache> Bushmills: I know how NAT works. I can't put it in words so well, but I know how it works.
16:42 < Bushmills> it is the acronym for "network address translation"
16:42 < luigi_panache> I know.
16:43 < luigi_panache> I know that NAT is a kludge to make one public address map to many private addresses.
16:43 < Bushmills> fine then.  so you understand that you need NAT
16:43 < luigi_panache> And that it works based on a lookup table.
16:43 < luigi_panache> And that individual addresses can get outgoing traffic to come back in to them.
16:44 < luigi_panache> And that for incoming connections, one needs to make a lookup table work.
16:44 < luigi_panache> Or have a default host.
16:44 < luigi_panache> My default host is 10.0.0.86.
16:44 < luigi_panache> Which is the LAN address of my server.
16:44 < luigi_panache> Ta-da, that's NAT no?
16:44 -!- rothwell [~rothwell@dsl78-143-208-61.in-addr.fast.co.uk] has joined #openvpn
16:44 -!- rothwell [~rothwell@dsl78-143-208-61.in-addr.fast.co.uk] has quit [Changing host]
16:44 -!- rothwell [~rothwell@unaffiliated/rothwell] has joined #openvpn
16:45 < Bushmills> if server doesn't translate source address of your sent client packets, replies won't be sent back to server 
16:45 < Bushmills> that's why you need NAT
16:46 < luigi_panache> Bushmills: Does my repeater bridge have NAT?
16:46 < Bushmills> NAT is *not* having two interfaces with addresses in different subnets
16:46 < Bushmills> i don't think so. after all, it is a bridge.
16:46 < luigi_panache> Bushmills: Why can't the server be a bridge then?
16:47 < Bushmills> do you have any more openvpn questions?
16:47 < luigi_panache> Is open VPN not able to be a bridge?
16:48 < luigi_panache> I thought the whole point of VPN was to connect to a LAN network at one place when you were at a different LAN somewhere else?
16:48 < Bushmills> you bridge interfaces. openvpn is not an interface
16:48 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p13539>
16:48 < luigi_panache> Bushmills: Sigh...
16:49 < luigi_panache> I want to bridge the VPN clients with the LAN that my server is on.
16:49 < Bushmills> !route
16:49 < luigi_panache> pptpd is able to do this. I just can't get pptpd to connect.
16:49 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:49 < luigi_panache> What are lans behind openvpn?
16:49 < luigi_panache> That wording confuses me.
16:50 < luigi_panache> Because the opening line talks about multiple LANs.
16:50 < luigi_panache> And I only want one effective LAN.
16:50 < Bushmills> http://scarydevilmonastery.net/dict.cgi?behind
16:51 < luigi_panache> What is the front of the network?
16:52 < Kalavera> guys sorry for asking so much , but now I have the vpn working but I did use the following directive to assign a fixed address to certain user : lets say 10.8.0.4 but it is assigning me 10.8.0.9 or any other one
16:52 < luigi_panache> You're treating me like a little kid again.
16:52 < Kalavera> luigi_panache: did it work out for u? 
16:53 < luigi_panache> Kalavera: Nope. This guy here thinks I'm an idiot.
16:53 < Kalavera> smiles, we all pass by that 
16:53 < Kalavera> :)
16:53 < Bushmills> "the following directive:" ...  "lets say 10.8.0.4"    - "lets say" is not a valid openvpn directive
16:54 < Bushmills> actually, i haven't thought so as far, but your giving me an idea :)
16:54 < Kalavera> oh well 
16:54 < Kalavera> sorry 
16:54 < Kalavera> will pu the right one
16:55 < Kalavera> ifconfig-pool-persist ipp.txt
16:55 < Kalavera> that's the right one
16:55 < Bushmills> !ccd
16:55 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
16:55 < Kalavera> and inside ipp.txt : user,10.8.0.4
16:55 < Bushmills> you can ifconfig-push an ip address specific for clients with that
16:56 < Kalavera> ok so let me try to understand irt well : ccd/user1
16:56 < luigi_panache> !config
16:56 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
16:57 < luigi_panache> Do I put configuration directives in /etc/default/vpn, or elsewhere?
16:57 < luigi_panache> *openvpn
16:57 < Kalavera> Bushmills: can I use cleint certificates and user name at the same time? 
16:58 < Bushmills> if "user1" is supposed to be a user name, then think in terms of "common names", abbrev. CNs
16:58 < Bushmills> those are in client certs, and used to select the file in ccd directory
16:59 < Kalavera> ok thank u 
17:06 < Kalavera> Bushmills: question is this directive good? ifconfig-push 10.8.0.5 10.8.0.2
17:06 < Kalavera> or it is ifconfig-push 10.8.0.5 10.8.0.2
17:06 < Kalavera> sorry 
17:06 < Kalavera> ifconfig-push 10.8.0.5 10.8.0.2
17:07 < Kalavera> ifconfig-push  10.8.0.2 10.8.0.5 ? 
17:08 < luigi_panache> Wed Jul  6 18:05:34 2011 Note: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)
17:08 < luigi_panache> Wed Jul  6 18:05:34 2011 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
17:08 < luigi_panache> Wed Jul  6 18:05:34 2011 Cannot allocate TUN/TAP dev dynamically
17:08 < luigi_panache> Well, that sure worked.
17:08 < luigi_panache> Wed Jul  6 18:05:34 2011 Exiting
17:08 < luigi_panache> Do I need to patch TU support into my kernel?
17:08 < luigi_panache> *TUN
17:09 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:11 < luigi_panache> Looks like the answer is yes.
17:11 < Kalavera> ok worked out
17:11 < Kalavera> ifconfig-push local-address remote-address
17:12 < Kalavera> luigi_panache: is that message on your server ? 
17:12 < Kalavera> Wed Jul  6 18:05:34 2011 Note: Cannot open TUN/TAP dev /dev/net/tun
17:12 < luigi_panache> Kalavera: Client.
17:12 < Kalavera> is that client Linux? 
17:12 < luigi_panache> Yep. I'm on Archlinux, with a custom patched and compiled kernel.
17:12 < luigi_panache> I'm compiling in TUN support now, as a modules.
17:12 < luigi_panache> *module
17:12 < Kalavera> is that kernel supporting tun/tap driver ? 
17:13 < Kalavera> oh 
17:13 < Kalavera> that's why 
17:13 < Kalavera> :)
17:13 < luigi_panache> Haha, I know. :)
17:13 < luigi_panache> And it works, but only as root.
17:14 < luigi_panache> And I can ping both endpoints.
17:14 < luigi_panache> Finally, progress!
17:14 < Kalavera> nice
17:14 < Kalavera> now maybe you will want to add fixed address to each client
17:19 < luigi_panache> I'm having trouble setting this up via the GUI. Hmm.
17:19 < luigi_panache> It still fails because there are no valid VPN secrets.
17:20 < Kalavera> are u using the configuration I gave you in the link ? 
17:20 < Kalavera> just accomodate some paths 
17:20 < Kalavera> and that would be enough 
17:20 < Kalavera> there are two ways to use openvpn as I know
17:20 < Kalavera> with a shared secret 
17:20 < Kalavera> and with certificates
17:20 < Kalavera> just use certificates for now
17:20 < luigi_panache> Oh, I restarted the networkmanager daemon and it worked.
17:21 < luigi_panache> Whew.
17:21 < luigi_panache> Now... Now what?
17:21 < luigi_panache> My ultimate goal is to get internet through this VPN connections.
17:21 < luigi_panache> connection
17:21 < Kalavera> try to add fixed address 
17:22 < Kalavera> easier to handle through firewalls
17:22 < Kalavera> so u will know who is who 
17:22 < luigi_panache> I think it is fixed address?
17:22 < luigi_panache> Client is always 10.8.0.2 and server is 10.8.0.1 ?
17:22 < luigi_panache> Yes, my tun0 device has an ip of 10.8.0.2
17:26 < luigi_panache> Hmm
17:27 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
17:27 < Kalavera> good
17:28 < luigi_panache> Ip forwarding is on...
17:28 < Kalavera> yeah fixed address usually means an static IP always being assigned to the same user or machine
17:28 < luigi_panache> Yes, everything I care about is static here.
17:28 < Kalavera> now I am adding rules in my fireawall 
17:28 < Kalavera> if u have a firewall in the middle u might want to add some 
17:28 < Kalavera> thank you Bushmills 
17:28 < Kalavera> :)
17:28 < luigi_panache>  I don't have a firewall. I don't need or want one.
17:28 < Kalavera> is not one in your router ? 
17:29 < Kalavera> some of them comes witgh filtering 
17:29 < luigi_panache> Kalavera: My router puts my server in a DMZ, pretty much.
17:29 < luigi_panache> So any traffic sent to my public IP at pingas.org goes to my server on my lan, 10.0.0.86
17:30 < luigi_panache> But NAT will still do port forwarding for other services and hosts that request it.
17:30 < luigi_panache> Like my Xbox 360 gets the ports it needs for Xbox live, but it does that on its own.
17:30 < luigi_panache> Everyone on my network is very happy.
17:30 < luigi_panache> It's automagic, yay!
17:31 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:34 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
17:34 < luigi_panache> I don't understand this line. "Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines)."
17:34 < luigi_panache> How do I set up the route?
17:38 < krzie> !route_outside_ovpn
17:38 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
17:38 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Read error: Connection reset by peer]
17:42 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
17:45 < luigi_panache> sudo ip -f inet route add 10.8.0.0/24 via 10.0.0.1
17:45 < luigi_panache> That's what I figured, at least.
17:47 < Kalavera> pinga? 
17:48 < Kalavera> lol 
17:49 < Kalavera> if u have LANs behind the vpn server 
17:49 < Kalavera> u might add the following lines to ur server.conf or openvpn.conf file
17:50 < Kalavera> first route your LAN : route "192.1.1.0 255.255.255.0"
17:50 < Kalavera> assuming 192.1.1.0 is a LAN behind the openvpn server 
17:51 < Kalavera> then push it : push "route 10.8.0.0 255.255.255.0" -> for the VPN network 
17:51 < Kalavera> then push it for the other one : 
17:51 < Kalavera> push "route 192.1.1.0 255.255.255.0"
17:51 < Kalavera> then restart openvpn 
17:51 < Kalavera> and try your client again 
17:52 < luigi_panache> Kalavera: Okay, my LAN (like, the real one where all my other computers are on) is 10.0.0.0/24
17:53 < luigi_panache> So I route "10.0.0.0 255.255.255.0" ?
17:54 < Kalavera> yep 
17:55 < Kalavera> and the push both the server network and the lan 
17:55 < Kalavera> restart 
17:55 < Kalavera> then ping and try any service
17:56 < luigi_panache> What do I ping?
17:56 < luigi_panache> I can't seem to ping external ips
17:57 < luigi_panache> I can ping on my LAN (10.0.0.0/24) though
17:58 < luigi_panache> Yeah, no dice. This hasn't helped
17:58 < luigi_panache> route "10.0.0.0 255.255.255.0"
17:58 < luigi_panache> push "route 10.8.0.0 255.255.255.0"
17:58 < luigi_panache> push "route 10.0.0.0 255.255.255.0"
17:59 < luigi_panache> Bushmills: Any input?
18:07 -!- luigi_panache is now known as luigi_p|away
18:07 < Kalavera> are u conencting from outside your network to the vpn? 
18:07 < Kalavera> I can ping the remote LAN
18:07 <@raidz> krzie
18:07 < Kalavera> and also internet sites like google
18:16 < krzie> raidz
18:24 -!- luigi_p|away [~isaac@68.50.228.136] has quit [Read error: Connection reset by peer]
18:29 -!- luneff [~yury@84.51.213.254] has quit [Quit: Leaving]
18:29 -!- luigi_p|away [~isaac@68.50.228.136] has joined #openvpn
18:32 -!- luigi_p|away [~isaac@68.50.228.136] has quit [Read error: Connection reset by peer]
18:32 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has joined #openvpn
18:33 < wolfric> Is openvpn supposed to install a tap device on install if run by administrator on windows?
18:34 < wolfric> "mytap". i don't see any tap interface in my network config (windows xp)
18:34 < wolfric> and i installed it with the admin user
18:34 -!- zenaan [~justa@180.181.106.97] has joined #openvpn
18:34 -!- K1ng`` [~KING@180.211.188.239] has quit [Ping timeout: 264 seconds]
18:35 < wolfric> woops nvm
18:36 -!- K1ng [~KING@180.211.188.30] has joined #openvpn
18:40 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:44 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has left #openvpn []
18:51 -!- luigi_panache [~isaac@68.50.228.136] has joined #openvpn
18:51 < luigi_panache> Well, I got it working.
18:51 < luigi_panache> With a bridge, too.
18:52 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
19:13 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:16 < luigi_panache> Yep. It works with network manager too.
19:16 < luigi_panache> Well, looks like I'm done here.
19:16 < luigi_panache> Thanks for all the help, Kalavera!
19:17 < luigi_panache> Fuck you, Bushmills!
19:17 < luigi_panache> Bye.
19:17 -!- luigi_panache [~isaac@68.50.228.136] has left #openvpn []
19:17 <@raidz> wow
19:17 <@mattock> that thing escalated... :)
19:19 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
19:22 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
19:51 -!- ironfroggy [~calvin@python/site-packages/ironfroggy] has joined #openvpn
20:04 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:10 -!- ironfroggy__ [~calvin@python/site-packages/ironfroggy] has joined #openvpn
20:10 -!- ironfroggy [~calvin@python/site-packages/ironfroggy] has quit [Ping timeout: 250 seconds]
20:15 -!- master_of_master [~master_of@p57B52D8D.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:16 -!- master_of_master [~master_of@p57B52F0D.dip.t-dialin.net] has joined #openvpn
20:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
20:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:50 -!- K1ng [~KING@180.211.188.30] has quit [Ping timeout: 258 seconds]
20:56 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
20:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
21:06 -!- K1ng` [~KING@180.211.188.113] has joined #openvpn
21:08 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
21:09 -!- Rolybrau [~Rolybrau@130-129.3-85.cust.bluewin.ch] has joined #openvpn
21:09 -!- Rolybrau [~Rolybrau@130-129.3-85.cust.bluewin.ch] has quit [Changing host]
21:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:16 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:35 < Kalavera> back 
21:36 -!- zenaan [~justa@180.181.106.97] has left #openvpn []
21:36 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
21:36 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
21:36 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:37 < Kalavera> can I configure openvpn client to connect more than one tunnel 
21:37 < Kalavera> or more than one place at a time
21:46 -!- Kalavera [~Kalavera@190.232.0.63] has quit [Quit: Lost terminal]
21:46 < Dougy> moo
21:54 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Read error: Operation timed out]
21:55 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
21:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
22:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:40 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:44 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:12 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
--- Day changed Thu Jul 07 2011
01:15 -!- dazo_afk is now known as dazo
01:31 <@vpnHelper> RSS Update - forum: VPN Connected - No Traffic on tun0 <http://forums.openvpn.net/topic8407.html#p13540>
01:43 <@vpnHelper> RSS Update - forum: Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html#p13541>
01:43 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:05 <@vpnHelper> RSS Update - forum: OpenVPN gets stuck at "connecting" state <http://forums.openvpn.net/topic8414.html#p13542>
02:26 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:27 -!- mode/#openvpn [+o mattock] by ChanServ
02:32 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
02:32 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
02:44 < Mowee> Morning
02:53 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has quit [Read error: No route to host]
02:53 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has joined #openvpn
03:01 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13543>
03:12 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13544>
03:17 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p13545>
03:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:26 -!- raidz1 [~Administr@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
03:26 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 240 seconds]
03:33 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
03:53 <@vpnHelper> RSS Update - forum: Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html#p13546>
03:53 -!- dazo is now known as dazo_afk
04:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
04:03 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:03 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:09 -!- suraj [~suraj@116.72.253.22] has joined #openvpn
04:09 < suraj> hi guys
04:09 < suraj> need little help
04:10 < suraj> anyone knows how to add remote printer via vpn?
04:10 < suraj> I am using openvpn
04:17 <@vpnHelper> RSS Update - forum: Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html#p13547>
04:23 <@vpnHelper> RSS Update - forum: The local and remote VPN endpoints cannot use <http://forums.openvpn.net/topic8406.html#p13549>
04:28 -!- suraj [~suraj@116.72.253.22] has quit [Quit: Leaving]
04:32 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
04:35 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Quit: Verlassend]
04:36 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
04:38 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 255 seconds]
04:54 <@vpnHelper> RSS Update - forum: failed to authenticate: User not known to the underlying aut <http://forums.openvpn.net/topic8410.html#p13550>
05:08 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
05:11 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
05:12 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
05:20 -!- dazo_afk is now known as dazo
05:20 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:29 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
05:43 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Remote host closed the connection]
05:45 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
05:52 -!- sppadic [~IceChat77@193.130.68.17] has joined #openvpn
05:54 -!- p33_p33_ [~p33p33@78.129.251.117] has quit [Remote host closed the connection]
06:00 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13551>
06:12 <@vpnHelper> RSS Update - forum: Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html#p13553> || tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13552>
06:24 <@vpnHelper> RSS Update - forum: Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html#p13554>
06:27 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
06:30 -!- Jhong [6d4ac524@gateway/web/freenode/ip.109.74.197.36] has joined #openvpn
06:31 -!- n1djz88 [5e8fe8f0@gateway/web/freenode/ip.94.143.232.240] has joined #openvpn
06:33 < n1djz88> Hello there, I have a question. Is possible to setup default openVPN as a client-server mode(client view between them is off) and setup X clients which can communicate with all clients? Thx :)
06:34 < Jhong> Hello, I can successfully establish an openvpn connection from my android handset to my Ubuntu openvpn server. However, the only way I can route Internet traffic via the server is with the redirect-gateway directive, which kills off access to external-facing servers such as Apache. 
06:34 < Jhong> I've tried all methods I can think of to manually add routes, but nothing seems to work.... can anyone help?
06:46 < Jhong> Hello, I can successfully establish an openvpn connection from my android handset to my Ubuntu openvpn server. However, the only way I can route Internet traffic via the server is with the redirect-gateway directive, which kills off access to external-facing servers such as Apache. Can anyone help?
06:48 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
06:49 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
07:01 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:05 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
07:09 < kisom> Jhong: enable routing on the server then
07:11 < kisom> echo 1 > /proc/sys/net/ipv4/ip_forward
07:13 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
07:13 -!- Punkbob [~Punkbob@c-76-21-171-135.hsd1.va.comcast.net] has quit []
07:15 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
07:18 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
07:30 -!- Jhong [6d4ac524@gateway/web/freenode/ip.109.74.197.36] has quit [Quit: Page closed]
07:36 <@vpnHelper> RSS Update - forum: openVPN with ShrewSoft client <http://forums.openvpn.net/topic8415.html>
07:57 < reiffert> weired questions.
08:06 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13557> || Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html#p13556>
08:12 <@vpnHelper> RSS Update - forum: openVPN with ShrewSoft client <http://forums.openvpn.net/topic8415.html#p13558>
08:17 -!- dazo is now known as dazo_afk
08:30 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
08:32 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
08:32 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
08:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
08:33 -!- dazo_afk is now known as dazo
08:42 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13559>
08:48 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408.html#p13560>
08:49 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:56 -!- dazo is now known as dazo_afk
08:58 < n1djz88> Hello there, I have a question. Is possible to setup default openVPN as a client-server mode(client view between them is off) and setup X clients which can communicate with all clients? Thx :)
09:00 <@vpnHelper> RSS Update - forum: Bridging problems RHEL - packets not forwarded by bridge? <http://forums.openvpn.net/topic8412.html#p13561>
09:04 < ecrist> n1djz88: that is covered in the howto
09:04 < ecrist> !howto
09:04 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:08 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 255 seconds]
09:08 < n1djz88> ecrist: hi, thx... going to have a look
09:13 < n1djz88> ecrist: there is sth bout access rights for subnets.... but I have just one subnet (VPN subnet) and I need something like add to client conf dir "client-to-client. :/ or cut traffic between clients on the SERVER fw ... 
09:15 -!- ironfroggy__ [~calvin@python/site-packages/ironfroggy] has left #openvpn ["Konversation terminated!"]
09:15 < Dougy> meow
09:15 < Dougy> hi ecrist 
09:15 < Dougy> how are you
09:17 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
09:17 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Client Quit]
09:27 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:33 < ecrist> n1djz88: you'll need to do it in a firewall, then.
09:33 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
09:33 < ecrist> hi Dougy, how goes?
09:34 -!- greg_72 [~somebody@catv-86-101-32-78.catv.broadband.hu] has quit [Remote host closed the connection]
09:35 < n1djz88> ecrist: I m trying ... but first I need to find some information bout how vpn handles communication... I mean is every packet flows through sever or server sends "routing" info to clients?
09:39 < Bushmills> !gvpe
09:39 <@vpnHelper> "gvpe" is http://software.schmorp.de/pkg/gvpe.html <Bushmills> Unlike other virtual private  network" solutions which merely create a single tunnel, GVPE creates a real network with multiple endpoints. free, opensource, for nixes, meant for those looking for a vpn with direct peer connections. those who'd be sent to hamachi otherwise.
09:40 < ecrist> everything flows through server, n1djz88 
09:41 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
09:44 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
09:48 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
09:51 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
09:51 < n1djz88> ecrist: oh.. thx... I made some tests but I wasn t able to find communication between clients on the server... thx for a hint
10:10 < ecrist> np
10:18 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
10:18 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Read error: Operation timed out]
10:18 -!- diemos [~root@2600:3c01::f03c:91ff:fe93:dabe] has quit [Read error: Operation timed out]
10:19 -!- snappy [~nipnop@wbml.net] has joined #openvpn
10:19 -!- snappy [~nipnop@wbml.net] has quit [Changing host]
10:19 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
10:19 -!- diemos [~root@2600:3c01::f03c:91ff:fe93:dabe] has joined #openvpn
10:25 < n1djz88> ecrist: hmm... I found out communication between clients.. but it contains only WAN IPs :|
10:36 -!- Kalavera [~Kalavera@190.232.0.63] has joined #openvpn
10:36 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:37 -!- mode/#openvpn [+o mattock] by ChanServ
10:57 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:00 -!- corretico_ [~luis@186.176.7.194] has joined #openvpn
11:09 < Kalavera> greetings guys
11:10 < Kalavera> yesterday night I did configure an openvpn server succesfully 
11:10 < Kalavera> today I am trying to deploy the same configuration from the previous one to a new server in another place 
11:10 < Kalavera> but for some reasin the socket closes
11:10 < Kalavera> http://pastebin.com/1w9ZtRLD
11:11 < Kalavera> there is a copy of what I see in logs
11:11 < hyper_ch> !config
11:11 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
11:11 < hyper_ch> !configs
11:11 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
11:12 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
11:17 -!- raidz1 is now known as raidz
11:17 -!- raidz [~Administr@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Changing host]
11:17 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
11:17 < snappy> connection reset, hm.
11:17 -!- sppadic [~IceChat77@193.130.68.17] has quit [Quit: Copywight 2007 Elmer Fudd. All wights wesewved.]
11:17 < Kalavera> http://pastebin.com/h0E7WMcg
11:18 < Kalavera> there is the pastebin updated
11:18 < Kalavera> with the server and cleint side configuration
11:20 < Kalavera> seems like something with the server certificate will try to create it again 
11:25 < Kalavera> ok fixed 
11:25 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
11:25 < Kalavera> stupid error of mine smiles :)
11:25 < Kalavera> thank you anyways
11:32 < Kalavera> question : is there a way to allow a specific client to be routed to a specific network and not to the rest of them 
11:32 < ecrist> yeah, CCD and a proper push option
11:50 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
11:55 <@vpnHelper> RSS Update - forum: HELP ... Running OpenVPN on Windows XP VM Guest <http://forums.openvpn.net/topic8416.html>
11:55 < Kalavera> ecrist: I am using CCD 
11:56 -!- n1djz88 [5e8fe8f0@gateway/web/freenode/ip.94.143.232.240] has quit [Ping timeout: 252 seconds]
11:56 < Kalavera> and it works fine but the push part I am doing in the main config file
11:57 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
11:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:58 -!- mode/#openvpn [+o mattock] by ChanServ
12:02 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Client Quit]
12:04 < Kalavera> is it needed to include the ca.key in the client config directory ? 
12:04 < Kalavera> or just the ca.crt 
12:07 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408-15.html#p13563>
12:09 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
12:09 < Bushmills> be aware that clients could potentially add routes themselves - you can't prevent them from using certain routes by pushing them to clients which may. 
12:13 < Doonz> hey guys. im at a customers site. and they olny have port 443 open. i have tried setting the openvpn server to both udp and tcp but i cannot connect to it. when i teather my laptop to my phone and then connect to the openvpn server over port 443 it works. any ideas?
12:19 < snappy> there might be a corporate firewall intercepting the traffic
12:20 < snappy> ensuring that it's HTTPS traffic
12:20 < snappy> i think the pix/asa does this by oding a "fixup"
12:20 < Doonz> i can connect to my ssh servers through the 443 ports tho
12:20 < snappy> ok, then that rules that out.
12:21 < snappy> so when you try to connect, what does your logs say?
12:22 < Doonz> just times out
12:23 < Doonz> let me get a fresh log
12:23 < snappy> does a socket even open?
12:23 < snappy> try telnetting the port
12:23 < Doonz> ok
12:24 < Doonz> Thu Jul 07 11:24:00 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
12:24 < Doonz> Thu Jul 07 11:24:00 2011 TLS Error: TLS handshake failed
12:24 < Doonz> Thu Jul 07 11:24:00 2011 SIGTERM[soft,tls-error] received, process exiting
12:24 < Doonz> but the second i tether and try to connect its all good
12:26 < Doonz> let me keep digging bbl
12:27 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 246 seconds]
12:27 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:29 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:29 -!- rothwell [~rothwell@unaffiliated/rothwell] has quit [Ping timeout: 240 seconds]
12:32 < Kalavera> guys I need the client1 2 and 3 to have access to the corporate network and the client4 to have access to a remote office network 
12:33 < Kalavera> that remote office is behind a router that is behind the corporate firewall that allows vpn connections to the LAN for client1 2 and 3
12:33 < Kalavera> but how do I push that only for the client4
12:33 < Kalavera> I have files for each one in CCD 
12:38 -!- mirco [~mirco@p5B2825D1.dip.t-dialin.net] has joined #openvpn
12:44 -!- rothwell [~rothwell@unaffiliated/rothwell] has joined #openvpn
12:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
12:45 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
12:49 <@vpnHelper> RSS Update - forum: OpenVPN gets stuck at "connecting" state <http://forums.openvpn.net/topic8414.html#p13564>
12:58 -!- dazo_afk is now known as dazo
12:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
12:58 -!- mode/#openvpn [+o mattock] by ChanServ
13:01 < Kalavera> how can I allow a specific client to be routed to a specicif lan 
13:02 < reiffert> !ccd
13:02 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
13:03 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:08 -!- corretico_ [~luis@186.176.7.194] has quit [Ping timeout: 276 seconds]
13:19 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:25 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
13:25 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:26 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
13:29 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p13565>
13:29 < Kendall> hi..I have to revoke multiple keys based on a user list, and so wrote a script to do it.  my question is two-fold:  first, do you have to run ' . ./vars ' before revoking each key, or can you do it once and mass revoke?
13:30 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
13:31 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:36 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
13:36 < Kalavera> I did it once and then create a lot of certificates so I think if u do it once u must do the opposite operation as well 
13:37 < Kalavera> Kendall: anyways you can run it once and simulate your script revokating two keys and see if it works
13:38 < Kendall> alright thanks
13:42 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Quit: Leaving.]
13:43 < Kalavera> anytime
13:43 < Kalavera> I am not getting something here, I am trying to expand the scope of the vpn 
13:43 < Kalavera> to fit Employees , Sys Admins and Contractors 
13:43 < Kalavera> did read the manual published at OpenVPN 
13:44 < Kalavera> but still can't ping to the pushed networks when I connect with the contractor certificate
13:44 < ecrist> !goal
13:44 < ecrist> !configs
13:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:44 < ecrist> !logs
13:44 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
13:44 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
13:47 -!- mirco [~mirco@p5B2825D1.dip.t-dialin.net] has quit [Quit: mirco]
13:47 < Kalavera> I got that :)
13:50 -!- mirco [~mirco@p5B2825D1.dip.t-dialin.net] has joined #openvpn
13:53 < Kalavera> ecrist: http://pastebin.com/9gGLGjTz
13:54 < Kalavera> ecrist: this is updated http://pastebin.com/Cxmunsc1
13:56 -!- mrt2k11 [~tmr@user-109-149.vpn.univie.ac.at] has joined #openvpn
13:59 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:59 < mrt2k11> hi, I'd like to know if openvpn is able to connect multiple firewall or NATed networks by being installed on a host that is not firewalled nor NaTed but directly reachable?
14:00 <@vpnHelper> RSS Update - forum: external connection <http://forums.openvpn.net/topic8417.html>
14:00 < mrt2k11> basically by having one openvpn client in each of those natted networks and the server at a root/vserver?
14:06 -!- mrt2k11 [~tmr@user-109-149.vpn.univie.ac.at] has quit [Ping timeout: 258 seconds]
14:13 -!- rothwell [~rothwell@unaffiliated/rothwell] has quit [Remote host closed the connection]
14:17 -!- CrunchyChewie [~mike@r74-195-236-116.stl1cmta01.stwrok.ok.dh.suddenlink.net] has joined #openvpn
14:17 < CrunchyChewie> I am getting the TLS handshake neg. error when trying to connect to my Pfsense box
14:19 < Bushmills> mrt2k11: yes
14:19 < Bushmills> serve on not firewalled server, clients behind firewalls
14:19 < Bushmills> server ...
14:19 < Bushmills> !clientlan
14:19 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
14:19 <@vpnHelper> better explanation
14:20 < reiffert> Bushmills: he left already
14:20 < reiffert> 21:06 -!- mrt2k11 [~tmr@user-109-149.vpn.univie.ac.at] has quit [Ping timeout: 258 seconds]
14:20 < CrunchyChewie> if on a domain, does the Pfsense box need any kind of dhcp/dns forwarding?
14:21 < Bushmills> reiffert: i have join/part messages turned off, but users in channels are shown non-cursive. and he still shows non-cursive here. hm
14:22 < Bushmills> strange. bug, probably
14:22 < Kalavera> Bushmills: can u please review this : 
14:22 < Kalavera> http://pastebin.com/Cxmunsc1
14:23 < Bushmills> huh?
14:23 < Kalavera> I am trying to add an IP address to a contarctor user like 10.7.1.1
14:23 < Kalavera> the users range declared in server is 10.7.0.0/24 
14:23 < Kalavera> and the tun0 IP is 10.7.0.1
14:24 < reiffert> Kalavera: openvpn-access-server?
14:24 < Bushmills> "users range declared in server is 10.7.0.0/24" means what?
14:24 < Kalavera> I am using ccd/ to ifconfig-push and IP to the clients
14:24 < Kalavera> so when I push an IP 10.7.0.2 for example I can reach the network 
14:24 < Kalavera> burt not when I use an IP 10.7.1.1
14:25 < Kalavera> reiffert: yes 
14:26 < Kalavera> means server 10.7.0.0 255.255.255.0 
14:26 < reiffert> !as
14:26 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
14:26 < Kalavera> in the main config file
14:27 < Kalavera> in my case it is openvpn.conf
14:27 < Bushmills> sorry, i don't uinderstand what the problem is
14:28 < reiffert> he was renaming openvpn.conf into main.conf
14:28 < Kalavera> ok , when I log as client1 who has a fixed address in the range 10.7.0.0 I can reach the networks that I am pushing in the main config file
14:28 < Kalavera> but when I use opineda who will use an IP address 10.7.1.1 
14:28 < Kalavera> I can not reach the networks
14:29 < Kalavera> either make a ping to the own server 
14:29 < Bushmills> why would you use a different ip address than the one which gives you access to the server?
14:29 < Kalavera> the server assign me an IP as I did configure in the ccd/opineda file 
14:30 < Kalavera> I want to segment an IP range for Employees, other for Providers or Contractors
14:30 < Kalavera> Employees 10.7.0.0, Contractors 10.7.1.0 
14:30 < Bushmills> traceroute or mtr are useful tools to determine where packets get stuck
14:31 < Bushmills> and what route they take
14:33 < Bushmills> windows clients?
14:33 -!- luneff [~yury@84.51.213.254] has joined #openvpn
14:35 < Kalavera> yes
14:35 < Kalavera> windows clients
14:35 < Bushmills> !winroute
14:35 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
14:35 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
14:36 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
14:37 < CrunchyChewie> is there anything I am missing in the config for my pfsense box in the roadwarrior setup?
14:37 < Bushmills> my guess would be: comments
14:38 < CrunchyChewie> getting the TLS handshake error
14:38 < CrunchyChewie> pfsense box IS the openvpn server
14:38 < Bushmills> !firewall
14:38 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
14:38 < Kalavera> that doesn't happens when I go back to the range 10.7.0.0
14:39 < CrunchyChewie> does the pfsense box need to forward dns or dhcp from the DC?
14:40 < Bushmills> depends on your definition of "need" and on your current name server setup
14:40 < CrunchyChewie> Bushmills: internal 2008 server is PDC, serves local DNS and forwards requests to OpenDNS otherwise
14:40 < Bushmills> actually, also on your openvpn setup
14:41 < CrunchyChewie> trying to setup Roadwarrior for 1 laptop
14:41 < Bushmills> do hosts resolve?
14:41 < CrunchyChewie> well I cant even connect to VPN, getting the TLS handshake error
14:41 < CrunchyChewie> I just didnt know if those factored into that
14:41 < Bushmills> then it's not a dns problem
14:42 < CrunchyChewie> does the pfsense box need a NAT rule to itself?
14:42 < Bushmills> irrelevant for your error
14:42 < Bushmills> !firewall
14:42 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
14:42 < Kalavera> Bushmills: about  fixed address , do I need to respect the limitation for the TUN - TAP driver over windows
14:43 < Bushmills> what are those limitations?
14:43 < CrunchyChewie> Bushmills: are you saying I should disable firewall?
14:43 < Bushmills> CrunchyChewie: you should at least verify that firewall is not the problem.  disabling is one method to do so
14:44 < ecrist> !ask
14:44 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, or (#2) http://www.latinsud.com/answer/, or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
14:46 < Kalavera> [  1,  2] [  5,  6] [  9, 10] [ 13, 14] [ 17, 18]
14:46 < Kalavera> [ 21, 22] [ 25, 26]
14:46 < Kalavera> these ones? about the last octect ? 
14:46 < CrunchyChewie> Bushmills: not firewall, disabled it, still no joy
14:47 < Kalavera> each pair is suppoused to be local - server sides IPs
14:47 < Bushmills> that's the requirements of interface and p-t-p addresses having to be in the same /30 subnet? 
14:48 < Bushmills> or interface and gateway
14:48 < Kalavera> the first one
14:48 < Bushmills> well, if that limitations applies, you better respect it.
14:49 < Kalavera> is not a way to have continous IPs being assigned to the clients ? 10.7.0.1, 2, 3, 4, 5, and so on ? 
14:49 < Kalavera> for fixed addresses I mean 
14:50 < ecrist> !/30
14:50 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
14:51 < ecrist> use tap
14:51 < ecrist> !topology
14:51 < CrunchyChewie> I thought in the 30 subnet there was only 2 available hosts per subnet
14:51 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
14:51 < ecrist> Kalavera: see that, abovue
14:51 < Bushmills> i have split the /24 subnet into several /26 subnets. one of those is for windows clients, being assigned fixed addresses in increments of 4, with p-t-p address in the same subnet.   another is  for non-windows, with the p-t-p address made the same as the vpn subnet address of server.  
14:51 < Bushmills> with those, i can increment addresses by 1
14:52 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
14:52 < CrunchyChewie> Bushmills: any thoughts beyond the firewall?
14:52 < Bushmills> it introduces a client dependency on operating system, though
14:52 < Bushmills> CrunchyChewie: yes
14:54 < Bushmills> "with p-t-p address in the same subnet" was meant to say "with p-t-p address in the same /30 subnet"
14:57 < CrunchyChewie> Bushmills: ok, firewall is back on
14:57 -!- ehnde [~noctmilam@unaffiliated/ehnde] has joined #openvpn
14:59 < ehnde> could i connect to a server using openvpn using the vpn client in windows xp/win7?
14:59 < Bushmills> no
14:59 < ehnde> i see there is an openvpn client, but i can't install software at work
14:59 < Bushmills> tough luck
15:00 < ehnde> eh...i'll just stick to logmein
15:02 < Kalavera> ecrist: so if I include topology subnet in my main config file I might be able to assign continous Ips to my clients
15:04 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:04 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
15:11 < CrunchyChewie> Bushmills: what should I try next after firewall?
15:11 < Bushmills> log file reading
15:13 < Bushmills> and config file checking, for things like using same protocol on both sides, specifying proper server address and port, and such.
15:15 < CrunchyChewie> Bushmills: thanks!
15:21 < CrunchyChewie> Bushmills: checked OpenVPN logs, there appears to be some issue with the server certificate
15:21 < Bushmills> praise the logs!
15:22 < CrunchyChewie> lol
15:22 < CrunchyChewie> I don't know what the fudge the entry means though
15:25 -!- ehnde [~noctmilam@unaffiliated/ehnde] has quit [Read error: Connection reset by peer]
15:28 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:28 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:28 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:34 -!- dazo is now known as dazo_afk
15:54 <@vpnHelper> RSS Update - forum: Administrator Pirvileges <http://forums.openvpn.net/topic8418.html>
15:54 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
15:57 -!- CrunchyChewie [~mike@r74-195-236-116.stl1cmta01.stwrok.ok.dh.suddenlink.net] has quit [Ping timeout: 246 seconds]
16:00 <@vpnHelper> RSS Update - forum: Radius plugin: authentication failure on reconnect <http://forums.openvpn.net/topic8419.html>
16:07 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
16:07 -!- bab [~bab@208.73.74.116] has joined #openvpn
16:09 -!- CrunchyChewie [~mike@r74-195-236-116.stl1cmta01.stwrok.ok.dh.suddenlink.net] has joined #openvpn
16:09 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:13 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Ping timeout: 250 seconds]
16:16 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
16:40 -!- bab [~bab@208.73.74.116] has quit [Quit: This computer has gone to sleep]
16:44 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has left #openvpn []
16:50 -!- mirco [~mirco@p5B2825D1.dip.t-dialin.net] has quit [Quit: mirco]
16:51 -!- mirco [~mirco@p5B2825D1.dip.t-dialin.net] has joined #openvpn
17:02 -!- mirco [~mirco@p5B2825D1.dip.t-dialin.net] has quit [Quit: mirco]
17:02 < CrunchyChewie> Bushmills: would having a challenge key for the certs cause that error to be thrown?
17:14 -!- CrunchyChewie [~mike@r74-195-236-116.stl1cmta01.stwrok.ok.dh.suddenlink.net] has left #openvpn ["Leaving"]
17:18 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
17:41 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
17:42 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
17:50 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
17:53 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
18:06 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:10 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Read error: Operation timed out]
18:25 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
18:25 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
18:28 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
18:31 < pr0zoid> are you guys the same developers who do Access Server?
18:31 < pr0zoid> i'm trying to understand the business model
18:31 < pr0zoid> and the opensource side..
18:37 < krzee> #as
18:37 < krzee> err
18:37 < krzee> !as
18:37 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:38 < krzee> yes, same devs
18:38 < krzee> well
18:38 < krzee> same company
18:38 < krzee> the community devs are not directly involved with AS, but both as and opensource are managed by openvpn technologies
18:39 < pr0zoid> k
18:39 < pr0zoid> so the road map for the 2 are different?
18:39 < raidz> yes
18:39 < pr0zoid> with eurephia in the mix... aren't you getting close to AS
18:39 < pr0zoid> (relatively speaking)
18:39 < krzee> there ya go, you wanted raidz
18:39 < raidz> ;-)
18:40 < krzee> =]
18:44 -!- raidz [~Administr@openvpn/corp/admin/andrew] has left #openvpn []
18:44 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
18:44 -!- mode/#openvpn [+o raidz] by ChanServ
19:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
19:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:09 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Quit: Leaving.]
19:12 -!- luneff [~yury@84.51.213.254] has quit [Quit: Leaving]
19:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:15 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
19:15 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
19:15 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
19:16 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
19:19 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:28 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
19:30 <@vpnHelper> RSS Update - forum: Can I securely access my home PC over VPN from public Wifi? <http://forums.openvpn.net/topic8420.html>
19:43 < reiffert> !rss yes
19:43 <@vpnHelper> Error: 'yes' is not a valid url.
19:43 < reiffert> !rss
19:43 <@vpnHelper> (rss <url> [<number of headlines>]) -- Gets the title components of the given RSS feed. If <number of headlines> is given, return only that many headlines.
19:43 < reiffert> !rss topic8420
19:43 <@vpnHelper> Error: 'topic8420' is not a valid url.
19:44 < reiffert> !rss http://forums.openvpn.net/topic8420.html
19:44 <@vpnHelper> Error: Couldn't get RSS feed.
19:44 < reiffert> !rss ttopic8420.html
19:44 <@vpnHelper> Error: 'ttopic8420.html' is not a valid url.
19:44 < reiffert> !rss http://forums.openvpn.net/
19:44 <@vpnHelper> Error: Couldn't get RSS feed.
19:54 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 260 seconds]
20:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
20:03 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
20:14 -!- master_of_master [~master_of@p57B52F0D.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
20:24 -!- master_of_master [~master_of@p57B530C8.dip.t-dialin.net] has joined #openvpn
20:25 < reiffert> !help rss
20:25 <@vpnHelper> (rss <url> [<number of headlines>]) -- Gets the title components of the given RSS feed. If <number of headlines> is given, return only that many headlines.
20:25 < reiffert> !sucks rss
20:49 <@vpnHelper> RSS Update - forum: HELP ... Running OpenVPN on Windows XP VM Guest <http://forums.openvpn.net/topic8416.html#p13570>
20:55 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:06 -!- CrunchyChewie [~IceChat77@r74-195-245-47.stl1cmta01.stwrok.ok.dh.suddenlink.net] has joined #openvpn
21:10 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
21:55 < CrunchyChewie> Bushmills: the saga continues, OpenVPN will work within the server LAN, but if I try from a true remote network, I get this error in the pfsense logs: write UDPv4: Operation not permitted (code=1)
21:58 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:26 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:32 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has quit [Ping timeout: 260 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 246 seconds]
22:36 -!- UdontKnow [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
22:41 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:01 <@vpnHelper> RSS Update - forum: Unable to connect on Win 7 <http://forums.openvpn.net/topic8421.html>
23:27 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Quit: Leaving]
23:28 < ecrist> bitches
23:28 -!- krphop [~krphop@74.82.160.100] has joined #openvpn
23:32 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
23:38 -!- K1ng` [~KING@180.211.188.113] has quit [Ping timeout: 240 seconds]
23:49 < ecrist> votes on removing +s from channel modes?
--- Day changed Fri Jul 08 2011
00:09 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
00:46 -!- Kalavera [~Kalavera@190.232.0.63] has quit [Quit: Lost terminal]
00:57 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
00:59 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
00:59 -!- mode/#openvpn [+o raidz] by ChanServ
01:21 -!- CrunchyChewie [~IceChat77@r74-195-245-47.stl1cmta01.stwrok.ok.dh.suddenlink.net] has quit [Quit: If you can't laugh at yourself, make fun of other people.]
01:27 < reiffert> ecrist: why did we get +s?
01:28 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:29 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:32 <@vpnHelper> RSS Update - forum: txqueuelen value <http://forums.openvpn.net/topic8422.html> || OpenVPN gets stuck at "connecting" state <http://forums.openvpn.net/topic8414.html#p13572>
01:33 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
01:33 -!- mirco_ is now known as mirco
01:33 < ecrist> reiffert: it was set by default when I created the channel years ago
01:34 < ecrist> noticed it doesn't show up in channel lists.
01:37 < reiffert> and the removal is just for the channel list?
01:37 <@vpnHelper> RSS Update - forum: Administrator Pirvileges <http://forums.openvpn.net/topic8418.html#p13575> || external connection <http://forums.openvpn.net/topic8417.html#p13574>
01:43 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
01:43 <@vpnHelper> RSS Update - forum: Unable to connect on Win 7 <http://forums.openvpn.net/topic8421.html#p13577> || Can I securely access my home PC over VPN from public Wifi? <http://forums.openvpn.net/topic8420.html#p13576>
01:46 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
01:50 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408-15.html#p13578>
01:51 -!- K1ng [~KING@180.211.188.113] has joined #openvpn
01:58 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:02 <@vpnHelper> RSS Update - forum: HELP ... Running OpenVPN on Windows XP VM Guest <http://forums.openvpn.net/topic8416.html#p13579>
02:29 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 276 seconds]
02:31 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
02:31 <@vpnHelper> RSS Update - forum: Radius plugin: authentication failure on reconnect <http://forums.openvpn.net/topic8419.html#p13580>
02:35 -!- soa2ii [~quassel@2001:4d88:1ffc:464::1] has joined #openvpn
02:37 < soa2ii> Hi. Right now I try to set up openVPN as a server (debian), and two clients (gentoo and win7). I started openvpn. My gentoo seem to have a connection. My windows ... not sure. The gui does not show anything but proxy settings. If I start it from command line it says it needs more privileges. I'll try to start it as root on windows once. Other suggestions why there's no connection? It's a routed vpn and maybe I got this setup messed up (just
02:37 < soa2ii>  beginning ...)
02:41 < soa2ii> (I think) I set up my vpn to 10.11.52.0/24. During login (which seems with admin right on win7 now fine too) it looks like my gentoo is becoming 10.11.52.5 and my win7 10.11.52.10. If I ping gentoo from win7 I get timeouts.
02:44 <@vpnHelper> RSS Update - forum: SSH disconnect issue <http://forums.openvpn.net/topic8423.html>
02:46 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
02:47 < Bushmills> soa2ii: try to ping 10.11.52.1
02:48 < soa2ii> Bushmills: works fine on both
02:48 < soa2ii> So how do I connect them them?
02:48 < soa2ii> then*
02:48 < Bushmills> refer to server as 10.11.52.1, as destination through openvpn
02:49 < Bushmills> ping, from server, 10.11.52.10. if that fails, review windows firewall
02:50 < soa2ii> Bushmills: refer to server? What do you mean?
02:51 < soa2ii> Bushmills: From the server I can ping neither.
02:51 < Bushmills> "ping server as 10.11.52.1 if you want echo request and replies go through openvpn"
02:51 < Bushmills> ditto with traffic to other server network services
02:52 < soa2ii> Sorry, I don't get that. Basically the first thing I'd like to work is access to my samba server (gentoo) from my windows pc
02:52 < soa2ii> over the openvpn server (debian) in my hosting center
02:53 < Bushmills> so the zeroest thing to do (that is, before the first thing), is to allow incoming traffic from openvpn to your windows box
02:53 < Bushmills> ehm, nm that,
02:54 < Bushmills> io thought smb server is windows box.    with being able to ping gentoo machine, which hosts samba, that should be fine already
02:54 < Bushmills> !wins
02:54 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
02:54 < adelas> It it possible to have a 1 to many vpn bridge with openVPN?
02:55 < Bushmills> you want WINS for rsolving samba server host name, as it won't resolve by broadcasts.  assuming you have a tun based config
02:55 < soa2ii> Bushmills: Windows cannot ping gentoo. It can just ping debian.
02:55 < soa2ii> Bushmills: I have tun, yes.
02:55 -!- dazo_afk is now known as dazo
02:55 < Bushmills> "soa2ii: try to ping 10.11.52.1" -> Bushmills: works fine on both
02:56 < soa2ii> Bushmills: 10.11.52.1 is debian, isn't it?
02:56 < Bushmills> how should i know?
02:56 < soa2ii> 10.11.52.5 should be gentoo ... since the log
02:56 < soa2ii> Bushmills: I told it
02:56 < soa2ii> [09:41:14] <soa2ii> (I think) I set up my vpn to 10.11.52.0/24. During login (which seems with admin right on win7 now fine too) it looks like my gentoo is becoming 10.11.52.5 and my win7 10.11.52.10. If I ping gentoo from win7 I get timeouts.
02:56 < Bushmills> ah. misread
02:57 < soa2ii> no prob
02:57 < reiffert> client-to-client
02:57 < Bushmills> i was under the inpression that gentoo was server
02:57 < reiffert> !client-to-client
02:57 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
02:57 <@vpnHelper> clients
02:57 < reiffert> adelas: yes.
02:58 < reiffert> soa2ii: add "client-to-client" to the server config.
02:58 < Bushmills> two misreads in one single case shouts for a coffee :)  
02:59 < soa2ii> reiffert: thanks, I'll do that
02:59 -!- sppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:00 < reiffert> :)
03:00 <@vpnHelper> RSS Update - forum: SSH disconnect issue <http://forums.openvpn.net/topic8423.html#p13582>
03:01 < Bushmills> my processing was "10.11.52.5" - he's surely trying to ping the p-t-p address :)
03:08 < soa2ii> Bushmills: It's the p-t-p address
03:08 < soa2ii> 10.11.52.6 seem to be correct
03:09 < soa2ii> The server can ping .6, windows can ping neither .5 nor .6 even with client-to-client enabled.
03:18 <@vpnHelper> RSS Update - forum: SSH disconnect issue <http://forums.openvpn.net/topic8423.html#p13583>
03:27 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 260 seconds]
03:27 < reiffert> soa2ii: windows can ping debian?
03:27 < soa2ii> reiffert: It can
03:27 < reiffert> get rid of the gentoo firewall then.
03:28 < soa2ii> reiffert: Gentoo has none.
03:29 < reiffert> on debian do: tcpdump -n -i tun0 host 10.11.52.10
03:29 < soa2ii> It's just running behind a router (which should be bypassed by the vpn, shouln't it?)
03:29 < soa2ii> ok
03:29 < reiffert> then start the ping on the windows maschine. do the packets arrive on debian?
03:30 < soa2ii> one mom
03:32 < Mowee> Morning
03:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
03:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
03:36 < soa2ii> fucking windows is such a pain in the ass ... you ARE root and you're still not allowed to save a damn text file at Progrom Files\
03:36 < soa2ii> wtf
03:38 < soa2ii> even if you're looged in as admin user you still have to start the cmd as admin to be allowed to do admin tasks ... such a messed up design.
03:38 < reiffert> I guess that's a "no"
03:39 < soa2ii> reiffert: 
03:40 < soa2ii> So, there's nothing in tcpdump
03:40 < soa2ii> but ping works now ...
03:40 < soa2ii> I'm confused.
03:40 < soa2ii> Samba doesn't answer though. I try to connect to \\10.11.52.6
03:40 <@vpnHelper> RSS Update - forum: SSH disconnect issue <http://forums.openvpn.net/topic8423.html#p13584>
03:41 < soa2ii> reiffert: looks like tcpdump shows just ping requests directly to the server
03:46 -!- patelx [~patel@openvpn/corp/admin/patel] has quit [Ping timeout: 246 seconds]
03:46 < soa2ii> Do you still have to expand your vpn scope if you use client-to-client? http://openvpn.net/index.php/open-source/documentation/howto.html#samba
03:46 <@vpnHelper> Title: HOWTO (at openvpn.net)
03:48 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 255 seconds]
03:49 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
03:49 -!- mode/#openvpn [+o raidz] by ChanServ
03:49 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
03:52 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
03:56 -!- luneff [~yury@46.41.64.158] has joined #openvpn
04:08 < soa2ii> finally it's working
04:08 < soa2ii> Any recommendation how you could wrap the vpn startup so that non admin users with little knowledge about computers can start it? :-)
04:10 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:10 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:16 < soa2ii> !wins
04:16 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
04:39 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
04:46 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:52 <@vpnHelper> RSS Update - forum: OpenVPN over ICMP <http://forums.openvpn.net/topic7998.html#p13585>
04:52 -!- luneff [~yury@46.41.64.158] has quit [Ping timeout: 258 seconds]
04:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:57 -!- luneff [~yury@46.41.93.115] has joined #openvpn
04:57 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409-15.html#p13586>
05:05 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
05:05 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
05:10 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409-15.html#p13587>
05:11 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:37 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
05:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:00 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 240 seconds]
06:08 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
06:13 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
06:17 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 260 seconds]
06:25 -!- twister004 [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
06:35 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408-15.html#p13588>
07:02 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
07:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:11 <@vpnHelper> RSS Update - forum: Proxy Authentication? <http://forums.openvpn.net/topic8424.html>
07:21 -!- UdontKnow is now known as root
07:43 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:44 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:44 -!- Cain` is now known as Cain
07:53 <@vpnHelper> RSS Update - forum: Not able to ping Remote lan . <http://forums.openvpn.net/topic8409-15.html#p13591>
08:00 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
08:01 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
08:26 < soa2ii> Do you have to start openVPN always as admin? Is there no nice way to wrap this so that normal users could start it on windows? Or: How would you start openVPN as admin if you click on a config file as normal user?
08:28 -!- Bluemer [Ask@h68.176.89.75.dynamic.ip.windstream.net] has joined #openvpn
08:32 -!- Bluemer [Ask@h68.176.89.75.dynamic.ip.windstream.net] has quit []
08:34 < defswork> soa2ii, run it as a service
08:35 < soa2ii> defswork: This would mean it is always connect, won't it?
08:35 < defswork> soa2ii, google will assist
08:35 < defswork> no
08:35 < soa2ii> defswork: great
08:35 < soa2ii> I'll look that up then
08:35 < defswork> soa2ii, grant privilege to normal user to start/stop the service
08:35 < defswork> and set the openvpngui to run in service control mode
08:36 -!- mrt2k11 [~quassel@dhcp-13-246.lip.ens-lyon.fr] has joined #openvpn
08:37 < mrt2k11> hey, I'd be glad if someone could me in the right direction regarding a setup question
08:37 < defswork> hmm too polite to be french
08:38 < mrt2k11> I'm wondering if openvpn can be used to connect multiple NATted/firewalled networks by having a client in each of those network that connects to a common openvpn server
08:38 < defswork> sure
08:38 < mrt2k11> with the result that nodes within all networks can communicate with each other in *both* directions
08:38 < defswork> you just need the routing setup and tell openvpn to route the subnets with the iroute directive
08:38 < mrt2k11> defswork: i'm not french, just working here ;)
08:39 < mrt2k11> so for each "site" (network), I have a subnet and I "just" need to set up routes?
08:39 < defswork> and the vpn connections :)
08:39 < mrt2k11> course ;)
08:40 < mrt2k11> i'm currently using openvpn to connect from home to my testing environment at university, and its a quite crude setup
08:40 < defswork> you tell openvpn to learn subnet traffic with iroute
08:41 < mrt2k11> now I have a second test site (in france ;)) and I think it would be easiest to use a root/vserver a already have as openvpn server
08:41 < mrt2k11> kk, thanks a lot
08:42 < mrt2k11> with iroute, I do the routing between the openvpn clients?
08:42 < mrt2k11> and the nodes behind the clients just use their local openvpn client as gateway?
08:43 < defswork> mrt2k11, you'd put the iroute directive into a per-client ccd file
08:43 < defswork> so if client a is subnet 10.0.0.1/24 you'd add iroute 10.0.0.1/24 to ccd/a
08:44 < defswork> you also still need to push or statically add your subnet routes
08:44 < mrt2k11> "Including multiple machines on the client side when using a routed VPN (dev tun)" in the HOWTO?
08:45 <@vpnHelper> RSS Update - forum: Hello <http://forums.openvpn.net/topic8425.html>
08:45 < mrt2k11> seems like a first start
08:45 < mrt2k11> only that I'd have multiple client LANs
08:47 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Remote host closed the connection]
08:47 < defswork> the only additional complication for multiple client lans is telling them all about the other subnets put you can just push all the subnet's routes out from the server
08:47 < defswork> openvpn will skip the route that it sees is for that client anyway 
08:48 < soa2ii> defswork: Do you mena the GUI shipped with the official installer? This GUI just offers proxy settings
08:48 < defswork> soa2ii, you can change some registry settings to make it control service instead
08:49 < mrt2k11> defswork: merci! ;)
08:49 < soa2ii> defswork: I'll see.
08:49 < defswork> http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin.html
08:49 <@vpnHelper> Title: HowTo Run OpenVPN as a non-admin user in Windows (at openvpn.se)
08:49 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
08:53 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
09:07 -!- sppadic_ [~IceChat77@193.130.68.17] has joined #openvpn
09:10 -!- sppadic [~IceChat77@193.130.68.17] has quit [Ping timeout: 276 seconds]
09:11 -!- mrt2k11 [~quassel@dhcp-13-246.lip.ens-lyon.fr] has quit [Remote host closed the connection]
09:36 < soa2ii> I installed openVPN as Service and gave permissions to a normal user to start the service. Now I configured the UI to run just in service mode. My connection works but I cannot access my samba server (which I could before with manual startup as root and openvpn.exe). This my status: http://pastebin.com/GGfHgN5p
09:37 < soa2ii> Fri Jul 08 16:29:42 2011 NOTE: FlushIpNetTable failed on interface [18] {05E3F8C5-C5FF-4BEA-B2EB-79BD8EC3C148} (status=5) : Zugriff verweigert  seem to be the first thing to fail
09:37 < soa2ii> the second: Fri Jul 08 16:29:47 2011 ROUTE: route addition failed using CreateIpForwardEntry: Zugriff verweigert [status=5 if_index=18]
09:38 < soa2ii> Both seem to fail because the user has not enough privileges ... but I cannot find a solution for that.
09:40 < Bushmills> !wins
09:40 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
09:40 < Bushmills> though that's not related to privileges - just to not resolving names by broadcast
09:40 < soa2ii> Bushmills: Mysamba was working before when I started openvpn as root user
09:41 < soa2ii> http://www.surfbouncer.com/remote_routing.htm I
09:41 <@vpnHelper> Title: FlushIpNetTable failed on interface (at www.surfbouncer.com)
09:41 < Bushmills> maybe a problem not able to  add routes as non-admin
09:42 < soa2ii> I'm not sure if this is relevant if I try to open \\myVPNSambaIP\share
09:42 < soa2ii> Bushmills: maybe. Any idea how to fix that?
09:42 < Bushmills> yes - run openvpn as admin :)
09:43 < Bushmills> is that on windows, or on *ix?
09:43 < soa2ii> Bushmills: windows
09:43 < soa2ii> And it should really work as a normal user
09:43 < Bushmills> ah. was confused because of "root" vs "admin" :)
09:44 < soa2ii> Bushmills: yeah ... :/
09:44 < soa2ii> My admin user is called root
09:44 < Bushmills> "should work as normal user"  - as in "normal user should be allowed to add/change routes"?
09:44 < soa2ii> no
09:44 < soa2ii> it should just connec
09:44 < Bushmills> and then?
09:44 < soa2ii> tif I could add this route once as admin this would be no problem
09:45 < soa2ii> I mean the route would basically be vpn/24 serverIP wouldn't it?
09:45 < Bushmills> i doubt that you can add a routes using non-existing (not-yet-existing) interfaces 
09:46 < soa2ii> Bushmills: Hm. I'm not sure if the interface does not exist. Isn't this the tap-dev thing in windows?
09:46 < soa2ii> Bushmills: Otherwise all those "start openvpn as user" howtos would be pointless, wouldn't they?
09:46 < Bushmills> yes, that interface - tun/tap - coming up when client connects
09:47 < Bushmills> probably, yes.  
09:47 < soa2ii> Hm. Let me see
09:48 < Bushmills> i don't know what the limitations with running openvpn as non-admin are. never intended to, tried to or even look at those docs
09:48 < soa2ii> Just tell me if got this right: 10.48.52.0/24 my vpn so the route is 10.48.52.0/24 10.48.52.1, or?
09:49 < Bushmills> looks ok
10:06 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Remote host closed the connection]
10:09 -!- d12fk [~heiko@port-92-198-130-130.static.qsc.de] has joined #openvpn
10:14 -!- Bluemer [Ask@h68.176.89.75.dynamic.ip.windstream.net] has joined #openvpn
10:14 < Bluemer> !welcome
10:14 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:14 < Bluemer> !goal
10:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:14 < Bluemer> Anyone here? I'm trying to install openvpn on centos 5...
10:15 < Bluemer> I'm getting this error when running source ./vars
10:15 < Bluemer> -bash: /etc/openvpn/easy-rsa/2.0/whichopensslcnf: Permission denied
10:16 -!- Bluemer [Ask@h68.176.89.75.dynamic.ip.windstream.net] has left #openvpn []
10:25 <@vpnHelper> RSS Update - forum: OpenVPN with Windows Clients <http://forums.openvpn.net/topic8426.html>
10:34 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:37 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:38 -!- mode/#openvpn [+o mattock] by ChanServ
10:59 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 240 seconds]
11:00 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
11:05 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:13 <@vpnHelper> RSS Update - forum: Problems with TAP adapter on Windows Server 2003 ! <http://forums.openvpn.net/topic8427.html>
11:23 -!- sppadic_ [~IceChat77@193.130.68.17] has quit [Quit: Take my advice. I don't use it anyway]
11:27 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
11:27 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has left #openvpn []
11:43 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Read error: Operation timed out]
11:43 -!- snappy [~nipnop@wbml.net] has joined #openvpn
11:43 -!- snappy [~nipnop@wbml.net] has quit [Changing host]
11:43 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
11:50 -!- kusznir__ [~kusznir@casas-net.ailab.wsu.edu] has joined #openvpn
11:51 < kusznir__> Hi all: quick question:  Is there an add-on PCI card that will work under linux to handle / dramatically impove the encryption speed thereby improving openvpn's throughput?
11:51 < kusznir__> (right now, I'm CPU-limited on throughput to 100Mb/s on a P4-2.6Ghz system.)
11:53 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
12:00 -!- luneff [~yury@46.41.93.115] has quit [Quit: This computer has gone to sleep]
12:02 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has joined #openvpn
12:05 -!- dmcdaniel12 [~dmcdaniel@69.61.200.105] has joined #openvpn
12:06 < dmcdaniel12> Howdy everyone. I am using network-manager-openvpn to connect to my vpn. Does anyone know the ppp options to define gateway and dns?
12:10 < reiffert> !nm
12:10 < reiffert> !ubuntu
12:10 <@vpnHelper> "ubuntu" is dont use network manager!
12:11 < hyper_ch> I use a network manager on kubuntu - but not for the vpn
12:14 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:14 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:19 < dmcdaniel12> I have one installed :/
12:21 < Bushmills> dmcdaniel12: for gateway, you can server let push routes and optionally gateways.  for name server, you can server push those too to client. 
12:21 < Bushmills> no ppp involved
12:21 -!- mirco [~mirco@p5B2829DA.dip.t-dialin.net] has joined #openvpn
12:23 < dmcdaniel12> hmm... didn't know that. I will look into that
12:31 < reiffert>  guess he chose the ms-chap/pap pptp/poptop protocol
12:37 < dmcdaniel12> Yes. Someone else set it up and I am coming in. I would prefer ipsec but don't fix what isn't broken. 
12:37 < dmcdaniel12> But maybe I will break it :/
12:38 < reiffert> openvpn is incompatible with ipsec and poptop
12:38 < reiffert> !compat
12:39 < reiffert> !factoids search compat
12:39 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
12:40 < dmcdaniel12> reiffert, are you trying to tell me openvpn doesn't support pptp? Because That is how I am connecting now, it just isn't routing my gateway properly
12:40 -!- mirco [~mirco@p5B2829DA.dip.t-dialin.net] has quit [Quit: mirco]
12:41 -!- mirco [~mirco@p5B2829DA.dip.t-dialin.net] has joined #openvpn
12:41 -!- mirco [~mirco@p5B2829DA.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
12:41 < reiffert> dmcdaniel12: thats is correct. openvpn connects to openvpn and to nothing else.
12:42 < dmcdaniel12> Its connected to my pptp server :/
12:42 < dmcdaniel12> I'm looking at the connection in my log
12:43 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:44 < reiffert> dmcdaniel12: "Its" does not refer to an openvpn client.
12:44 < dmcdaniel12> How can I tell what program I am using? When I open it, it shows in the top bar "VPN Connections". Isn't that the gui for openvpn?
12:45 <@raidz> Anyone want Google + Invites? :-D
12:45 < reiffert> http://openvpn.net/index.php/open-source/333-what-is-openvpn.html
12:45 <@vpnHelper> Title: What is OpenVPN? (at openvpn.net)
12:45 < reiffert> dmcdaniel12: http://openvpn.net/index.php/open-source/downloads.html
12:45 <@vpnHelper> Title: Downloads (at openvpn.net)
12:45 < reiffert> http://openvpn.net/index.php/open-source/documentation/howto.html
12:45 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:46 < dmcdaniel12> reiffert, I know I have it installed. I have 4 total vpn programms and was fairly sure I am using openvpn
12:48 < Bushmills> ah, using 4 vpns increases the level of security, compared to one single vpn alone?
12:48 < Bushmills> good thinking
12:49 < dmcdaniel12> No, I have 4 vpn clients
12:49 < dmcdaniel12> Trying to find which one is easiest and does what I need it too
12:49 < Bushmills> how could you know which one is, when you don't know which one you're using?
12:50 < dmcdaniel12> I know I am using network-manager-openvpn because its attached to the network manager
12:50 < dmcdaniel12> It just doesn't say so on the bar
12:51 < Bushmills> oh well. have fun.
12:53 < dmcdaniel12> I lied, I am using ppp generic
12:53 < Bushmills> we know you did.  only you didn't know. well, you could have, by simply believing reiffert.
12:54 < dmcdaniel12> Well, I didn't. But now I do. Truely believe I was using openvpn. Not great with this stuff but learning. Any chance you know how to set the default gateway in ppp?
12:55 < Bushmills> openvpn doesn't use ppp. nothing you set there will have an effect
12:55 < dmcdaniel12> I know. I am setting it in /etc/ppp/peers
12:56 < Bushmills> if that makes your day more enjoyable, sure.
12:57 < dmcdaniel12> what is that supposed to mean? We wonder why no one uses linux, its because help is damn hard to find
12:57 < Bushmills> though sticking a banana into an alarm clock has about the same affect on gateways used by openvpn clients
12:57 < dmcdaniel12> I don't care about openvpn anymore. I was asking about pptp and if you knew how to do it or not
12:58 < Bushmills> not that i want to imply that sticking bananas into alarm clock has the potential to raise you happiness 
12:58 -!- dazo is now known as dazo_afk
12:58 < Bushmills> do you also happen to have any openvpn related question? mind you that this is the openvpn support channel, not the pptp channel 
12:59 < Bushmills> !pptp
12:59 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
12:59 <@vpnHelper> read about why to not use pptp, or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
13:00 < dmcdaniel12> Bushmills, I don't need to read on why I shouldn't use it, I understand the risks. Unfortunately, this is higher than me so i can't change it. Is there a pptp room because doesn't look like I am going to get any help
13:00 < Bushmills> no idea.  try #windows  or #microsoft
13:01 -!- dmcdaniel12 [~dmcdaniel@69.61.200.105] has left #openvpn []
13:05 < reiffert> #poptop
13:19 -!- mirco [~mirco@p5B2829DA.dip.t-dialin.net] has joined #openvpn
13:35 < Bushmills> too late
13:39 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
13:42 -!- mirco [~mirco@p5B2829DA.dip.t-dialin.net] has quit [Quit: mirco]
13:50 <@raidz> lol at bananas and alarm clocks Bushmills
13:51 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:53 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:08 -!- dws6045 [~dws@c-76-102-54-104.hsd1.ca.comcast.net] has joined #openvpn
14:22 <@vpnHelper> RSS Update - forum: Server without tun/tap interface - only client2client? <http://forums.openvpn.net/topic7211.html#p13595>
14:28 <@vpnHelper> RSS Update - forum: external connection <http://forums.openvpn.net/topic8417.html#p13596>
14:46 <@vpnHelper> RSS Update - forum: Administrator Pirvileges <http://forums.openvpn.net/topic8418.html#p13597>
14:49 < Bushmills> raidz, i toyed with the idea of sticking bananas into ears, but found that image too provocative
15:04 -!- bab [~bab@208.73.74.116] has joined #openvpn
15:05 -!- edu_ [~edu@phoenix.cativa.com.br] has joined #openvpn
15:05 < edu_> hey guys
15:05 < bab> is it necessary to put a ip on the client machine that is acting as a bridge?
15:05 < bab> I figured you only had to put ip on the devices behind the lan
15:06 < edu_> in win7, sometimes vpn network not responding - ping blablabla - wtf?
15:07 < Bushmills> !windows
15:07 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
15:07 < edu_> in my corporation
15:08 < edu_> the computational park
15:14 -!- Guest99530 is now known as Martin`
15:14 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
15:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
15:26 -!- yell0 [~yello@unaffiliated/contempt] has quit [Quit: leaving]
15:27 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
15:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:35 -!- luneff [~yury@93.178.118.184] has joined #openvpn
15:46 -!- computer13137 [~kirk@96.44.188.116] has joined #openvpn
15:47 < computer13137> Does anyone know of a good tutorial for ccd configuration in openvpn?
15:47 < computer13137> I'm trying to get started with it, and I'm not sure how to do the syntax. From some of the stuff I've seen online, it looks like slightly different syntax than used in the server configs.
15:48 < computer13137> I want to do things like static IP for client, and decide whether or not to push the default gateway depending on the client connecting.
15:48 < Bushmills> ifconfig-push  you'd use for that, which is described in the man page
15:49 < computer13137> I am somewhat familiar with ifconfig-push... how about the default gateway?
15:49 < computer13137> Would that be something I would simply put the same syntax into client configs, if it's supposed to be pushed?
15:49 < computer13137> I do not want it pushed by default, I want to decide for a few clients to push it.
15:49 < Bushmills> default gateway? you want all traffic through openvpn?
15:50 < Bushmills> (all traffic not explicitely routed elsewhere)
15:50 < computer13137> Yes, and I know how to set that up, but it's a global variable. I want it to be set client-specifically, but using a server configuration.
15:50 < Bushmills> !redirect
15:50 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
15:50 < Bushmills> can be pushed too
15:50 < computer13137> Using ifconfig-push?
15:50 < Bushmills> what you can push, you can put in client specific ccd files
15:50 < Bushmills> no. you can push redirect-gateway
15:50 < computer13137> Alright, but how is the syntax different?
15:51 < Bushmills> not different at all
15:51 < computer13137> Hmm, will have to give it a try...
15:51 < computer13137> And it's based on the certificate used to connect right?
15:51 < computer13137> So if computer13137_desktop1.crt, then I just make /etc/openvpn/ccd/computer13137_desktop1
15:51 < Bushmills> yes, on the Common Name used in it
15:51 < computer13137> And I can then put configuration stuff in there.
15:51 < Bushmills> no.
15:51 < Bushmills> not the file name.  the CN
15:52 < computer13137> Isn't that the same?
15:52 < Bushmills> no
15:52 < computer13137> Where do I look for the CN?
15:52 < computer13137> That might be what I'm doing wrong...
15:52 < computer13137> but I setup the keys with easy-rsa, so I assumed the filename and common name were the same.
15:52 < Bushmills> you specify it when you create the cert.  open with viewer, and you can read it
15:53 < Bushmills> easy-rsa prompted you for the CN
15:53 < computer13137> Subject: C=US, ST=TX, L=Dallas, O=The EPEC Network, CN=kirk-servers_scimitar/emailAddress=security@epecweb.com
15:53 < computer13137> So the CN is kirk-servers_scimitar.
15:53 < computer13137> Which is the same as the filename for my crt.
15:54 < computer13137> And as I recall it didn't.
15:54 < Bushmills> right.  you can also look into openvpn status file on server, or server log, when connecting
15:54 < computer13137> I did "pkitool hostname" to make my certs.
15:54 < computer13137> It didn't prompt me for anything.
15:54 < computer13137> It took the info out of my vars file, and made a cert for the client.
15:56 < Bushmills> as you said "easy-rsa", i assumed you used its build-key
15:56 < computer13137> I did to make the server cert I think.
15:57 < Bushmills> you use build-key to create the files needed for clients to authenticate
16:22 -!- luneff [~yury@93.178.118.184] has quit [Ping timeout: 260 seconds]
16:33 -!- luneff [~yury@93.178.118.184] has joined #openvpn
16:36 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Quit: Verlassend]
16:48 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has quit [Quit: Gaglia]
16:51 -!- Dropje [~yge@5ED095E6.cm-7-1c.dynamic.ziggo.nl] has joined #openvpn
16:54 < Dropje> Hello. I've set up two VPN servers, one at our datacentre, one at our office.. The 'main' one clients will connect to will be the datacentre, which is by turn connecten to our office vpn. Im able to connect to all host etc from the server in the datacentre where openvpn is running on but our clients are not able to connect to the office.. is this due to limitations in connecting from one tun adapter to the other? what are the recommendations
17:05 -!- bab [~bab@208.73.74.116] has quit [Quit: This computer has gone to sleep]
17:09 -!- computer13137 [~kirk@96.44.188.116] has quit [Ping timeout: 276 seconds]
17:10 -!- zamba [marius@flage.org] has joined #openvpn
17:10 < zamba> what's the bandwidth limitations of openvpn running through a central hub?
17:10 < zamba> meaning.. i want to connect from one network connected to the hub to another connected on the other side
17:11 < zamba> i'm not really seeing any cpu load on the server
17:24 -!- LBo [~LBo@cable-129-137.zeelandnet.nl] has quit [Remote host closed the connection]
17:39 <@vpnHelper> RSS Update - forum: tap0 bridged vpn unable to reach clients behind server <http://forums.openvpn.net/topic8408-15.html#p13598>
17:39 -!- luneff [~yury@93.178.118.184] has quit [Ping timeout: 246 seconds]
18:02 -!- pr0zoid [~pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
18:03 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
18:07 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
18:17 -!- luneff [~yury@93.178.118.184] has joined #openvpn
18:20 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 264 seconds]
18:23 -!- rain [~rain@customers.jarratt.uob.ask4.co.uk] has joined #openvpn
18:26 < rain> hello, i'm experiencing a problem with openvpn... i can connect fine to the openvpn server on the other side which gives me a public IP, however if i try to ping or connect to a port (for example 22) that IP from another external server, the client doesn't answer doesn't come out of the right interface
18:28 < K1ng> rain, i think you want the openvpn as your default gateway
18:28 < rain> nope, i do not want to route all the traffic through the gateway
18:28 -!- queequeg1_ [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
18:28 < rain> erm, vpn i mean
18:30 -!- queequeg1_ is now known as queequeg1
18:30 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has left #openvpn []
18:39 < rain> thanks, i just used iproute2
18:39 -!- rain [~rain@customers.jarratt.uob.ask4.co.uk] has quit [Quit: Leaving]
18:47 -!- luneff [~yury@93.178.118.184] has quit [Ping timeout: 240 seconds]
18:51 < Bushmills> Dropje,
18:51 < Bushmills> !route
18:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:53 < Bushmills> zamba: limitation is hit when things get too slow
18:53 < Bushmills> when not seeing any cpu load, limits aren't reached.
18:53 < zamba> define "too slow"?
18:53 < zamba> ok
18:54 < Bushmills> "too slow" is when service can't be used with toleratable levels anymore 
18:55 < Bushmills> rain: sounds like a routing problem
18:55 -!- ryansch [~ryansch@S01060024017478fc.cc.shawcable.net] has joined #openvpn
18:59 -!- Justice [~Justice@c-68-34-107-252.hsd1.md.comcast.net] has joined #openvpn
19:02 < Justice> goal: set up many hosts (quantity, names, ip's not known in advance) in an untrusted network, with each host connecting to each other host over a host-to-host tunnel providing encryption and authentication with a pre-shared key ... anyone know any pointers/hints/docs on this topic?
19:03 < Bushmills> !gvpe
19:03 <@vpnHelper> "gvpe" is http://software.schmorp.de/pkg/gvpe.html <Bushmills> Unlike other virtual private  network" solutions which merely create a single tunnel, GVPE creates a real network with multiple endpoints. free, opensource, for nixes, meant for those looking for a vpn with direct peer connections. those who'd be sent to hamachi otherwise.
19:23 -!- ryansch [~ryansch@S01060024017478fc.cc.shawcable.net] has quit [Quit: Leaving...]
19:29 -!- benr [~benr@cuddletech-1-pt.tunnel.tserv3.fmt2.ipv6.he.net] has joined #openvpn
19:32 < benr> any pointers on doing user auth via LDAP?  I've tried openvpn-auth-ldap but it crashed the OpenVPN server.
19:33 -!- submesa [~mesa@unaffiliated/submesa] has joined #openvpn
19:36 < submesa> Hello guys; anyone around to assist me with a routing problem? Basically, my VPN works but i cannot set a default gateway to the server. I believe that is because the tunnel is said to be 10.8.0.5 (server) to 10.8.0.6 (client) but the server is actually 10.8.0.1 and not 10.8.0.5; that's where things fail.
19:36 < submesa> I got all stuff posted at: http://pastebin.com/rd0U0uhg
19:36 < submesa> If anyone could have a look, you have my thanks!
19:44 < benr> have you tried adding a route push in the server config? ie: push "route 10.8.0.1 255.255.255.0"
20:01 -!- benr [~benr@cuddletech-1-pt.tunnel.tserv3.fmt2.ipv6.he.net] has quit [Quit: Leaving]
20:14 -!- master_of_master [~master_of@p57B530C8.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:16 -!- master_of_master [~master_of@p57B5212D.dip.t-dialin.net] has joined #openvpn
20:42 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has joined #openvpn
20:45 < eltrkbrd> I want to share a quickbooks file over a VPN between two Windows 7 computers over the Internet (no dedicated file server).  I know I can setup my Windows 7 PC to accept incoming VPN connection but is it easier and better to use OpenVPN instead?
20:46 < eltrkbrd> I mean in a purely Windows environment for a simple VPN, does it make sense to use OpenVPN instead of the built in Windows VPN Server and Client that comes with Windows 7?
20:46 < root> well, both yes and no
20:47 < root> 1. OpenVPN is open-source, so you actually know (or can get to know) what the code does exactly, and that makes room for the community at large to review and fix issues : 
20:47 < eltrkbrd> I would like to use LT2P instead of PPTP as I heard it's more secure
20:48 < eltrkbrd> L2TP*
20:49 < eltrkbrd> root thanks
20:49 < root> 2. I find using text files way more manageable than widgets that are not easy to restore or fix if broken
20:50 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
20:50 < root> 3. OpenVPN on Windows uses the tap driver, so it behaves like you actually had an ethernet wire between the two machines. This means you can bridge your remote networks together easily
20:51 < root> eltrkbrd: OpenVPN doesnt use L2TP nor PPTP, it uses the OpenVPN protocol
20:51 < eltrkbrd> root, are you saying the quickbooks file in my scenario would be like a widget therefore more prone to corruption over a vpn vs a text file? I'm not sure I understand your analogy.
20:52 < eltrkbrd> the other thing is that I would like the VPN client to use the built in Windows VPN client if possible 
20:53 < eltrkbrd> I would like to minimize configuration on the connectings VPN clients, as many of the people connecting have limited techinical ability or time to invest in setting up a more complicated network configuration.
20:53 < root> well, if you need the built in windows vpn client, then you need to do it the windows way
20:53 < root> OpenVPN uses a different protocol, and then both OpenVPN and the TAP driver need to be installed on the hosts
20:54 < eltrkbrd> ok, so I can't install the OpenVPN server on my Windows host and have the VPN client connect from the Windows client using the built-in Windows VPN software?
20:54 < root> no. they are incompatible
20:55 < eltrkbrd> in other words to connect to the OpenVPN Windows Server, they have to download, install and use the OpenVPN client software on their Windows host to connect to the VPN?
20:55 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p13599>
20:55 < eltrkbrd> ok, thanks root
20:56 < eltrkbrd> I thought maybe there were standards for the VPN protocols and that the client software would be interchangable
20:56 < eltrkbrd> I guess not...
20:56 < root> eltrkbrd: openvpn server and client are the same, you just set the operation mode in the configuration file or argument
20:56 < eltrkbrd> I see
20:57 < root> in fact, there are several operation modes, very nice piece of code
20:57 < eltrkbrd> it appears hamachi was a simple VPN solution but is no longer free
20:58 < root> no idea, as I only use OpenVPN and IPSec implementations, and not on windows
20:58 < eltrkbrd> root, does the OpenVPN software (for both server and client modes) support NAT traversal and uPnP?
21:00 < root> eltrkbrd: it is a bit different from what you are used to. OpenVPN uses a TCP connection or a bidirectional UDP stream for transport
21:00 < root> eltrkbrd: so you should be able to reach the server via TCP or UDP someway. thats roughly the only requirement
21:00 < eltrkbrd> or do I have to setup my router to do port forwarding to a static LAN IP for my incoming OpenVPN server connection and then have the OpenVPN client open a port on their firewall for the outgoing connection?
21:01 < root> usually, that means the client doesnt need much network configuration
21:01 < eltrkbrd> ok
21:01 < eltrkbrd> seems simple enough
21:01 < eltrkbrd> I'll read through the documentation on the website
21:02 < root> for example, one of my VPNs runs on port 443, so any client that can possibly reach myserver.example.com:443 can establish a VPN session
21:02 < root> tcp, that is
21:02 < eltrkbrd> is that SSL
21:02 < eltrkbrd> ?
21:02 < root> yeah
21:02 < eltrkbrd> so IPSec, not PPTP or L2TP?
21:02 < root> but port number is cosmetic, you can choose any, 1194 is the default iirc
21:02 < eltrkbrd> ok
21:03 < root> eltrkbrd: exactly, as I told you before
21:03 < eltrkbrd> oh, that's right
21:03 < eltrkbrd> is there an advantage of IPSec over L2TP?
21:04 < eltrkbrd> how is Tinc?
21:04 < root> advantages and disadvantages are case-specific
21:04 < eltrkbrd> honestly, I'm very new to setting up a VPN
21:05 < eltrkbrd> and I'm just looking to share a single file between two or three computers securely over the Internet
21:05 < eltrkbrd> all Windows computers
21:05 < eltrkbrd> a single Windows file share (SMB?)
21:06 < eltrkbrd> all connections are > 5Mbit/sec
21:06 < root> there are many ways to skin a cat :) ask 10 experts, and you will get 15 best sollutions of all time :)
21:06 < eltrkbrd> :)
21:07 < eltrkbrd> any free alternatives to hamachi?
21:08 < root> sorry, I am not a windows user, never heard of this hamachi tool :)
21:08 < eltrkbrd> I see there is comodo vpn
21:08 < eltrkbrd> oh
21:50 -!- Justice [~Justice@c-68-34-107-252.hsd1.md.comcast.net] has quit [Ping timeout: 250 seconds]
22:23 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has joined #openvpn
22:32 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 258 seconds]
22:39 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:54 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has quit [Ping timeout: 250 seconds]
22:55 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
23:26 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has quit []
23:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
23:48 <@vpnHelper> RSS Update - forum: Connection to VPN Server failure <http://forums.openvpn.net/topic8428.html>
23:51 -!- Deathvalley122 [~Death@eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
23:54 -!- Deathvalley122 [~Death@eagleits.net] has joined #openvpn
23:55 -!- computer13137 [~kirk@96.44.188.116] has joined #openvpn
23:56 -!- K1ng [~KING@180.211.188.113] has quit [Ping timeout: 246 seconds]
23:57 -!- computer13137 [~kirk@96.44.188.116] has left #openvpn []
23:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
--- Day changed Sat Jul 09 2011
00:04 -!- Deathvalley122 [~Death@eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
00:08 -!- Deathvalley122 [~Death@eagleits.net] has joined #openvpn
00:10 -!- Deathvalley122 [~Death@eagleits.net] has quit [Client Quit]
00:15 -!- submesa [~mesa@unaffiliated/submesa] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
00:18 -!- Deathvalley122 [~Death@eagleits.net] has joined #openvpn
00:25 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
00:41 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
01:12 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
01:27 -!- mirco [~mirco@p5B2838EA.dip.t-dialin.net] has joined #openvpn
01:33 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
01:38 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Read error: Connection reset by peer]
01:38 -!- snappy [~nipnop@wbml.net] has joined #openvpn
01:38 -!- snappy [~nipnop@wbml.net] has quit [Changing host]
01:38 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
01:44 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
01:47 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 258 seconds]
01:48 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Now with extra fish!]
01:50 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
01:50 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
02:00 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has joined #openvpn
02:00 -!- luneff [~yury@93.178.118.184] has joined #openvpn
02:08 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:15 -!- eahm [~irc@ip24-255-55-170.tc.ph.cox.net] has quit [Remote host closed the connection]
02:16 -!- luneff [~yury@93.178.118.184] has quit [Quit: This computer has gone to sleep]
02:45 -!- K1ng [~KING@180.211.188.113] has joined #openvpn
03:03 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
03:18 < hyper_ch> krzee: halp
03:18 < hyper_ch> Bushmills: halp :)
03:33 -!- K1ng [~KING@180.211.188.113] has quit [Ping timeout: 252 seconds]
03:40 -!- luneff [~yury@84.51.213.254] has joined #openvpn
04:05 < zamba> embedded systems have poor performance with openvpn?
04:12 -!- K1ng [~KING@180.211.188.113] has joined #openvpn
04:16 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
04:21 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
04:32 -!- Enti0c [~Enti0c@oki-27-0-19-40.jpns.spearpt.com] has joined #openvpn
04:34 < Enti0c> Hello, was curious if some one could point me in the right direction.  I've gotten openVPN to work and it connects yet for some reason when I connect in mIRC my host is still shown as my origonal host and not the vpn that i am connected to.  Does anyone know why this is? Thanks in advance.
04:36 < syn4pse> did you redirect gateway ?
04:36 < Enti0c> hrmm not really sure to be honest.  I used the config files from the vpn host
04:37 < syn4pse> k
04:37 < syn4pse> push "redirect-gateway def1"
04:37 < syn4pse> you need to add that line in order to tell that the vpn should be used as default client
04:37 < syn4pse> !redirect-gateway
04:38 -!- Deathvalley122 [~Death@eagleits.net] has quit [Excess Flood]
04:38 -!- Deathvalley122 [~Death@eagleits.net] has joined #openvpn
04:39 < syn4pse> !welcome
04:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:39 < syn4pse> !configs
04:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
04:39 < syn4pse> !howto
04:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:39 < Enti0c> thanks.
04:39 < syn4pse> hmm there was a command that should show you some info but i don`t remember it ;)
04:40 < syn4pse> just try it if it won`t work i ll take a look at my server.conf ;)
04:43 -!- Enti0c [~Enti0c@oki-27-0-19-40.jpns.spearpt.com] has quit [Quit: Ninja Vanish]
04:43 <@vpnHelper> RSS Update - forum: Administrator Pirvileges <http://forums.openvpn.net/topic8418.html#p13601>
04:43 -!- Enti0c [~Enti0c@oki-27-0-19-40.jpns.spearpt.com] has joined #openvpn
04:49 <@vpnHelper> RSS Update - forum: external connection <http://forums.openvpn.net/topic8417.html#p13602>
04:53 -!- Enti0c [~Enti0c@oki-27-0-19-40.jpns.spearpt.com] has quit [Quit: Ninja Vanish]
04:54 -!- Enti0c [~Enti0c@oki-27-0-19-40.jpns.spearpt.com] has joined #openvpn
04:54 <@vpnHelper> RSS Update - forum: OpenVPN with Windows Clients <http://forums.openvpn.net/topic8426.html#p13605> || Radius plugin: authentication failure on reconnect <http://forums.openvpn.net/topic8419.html#p13604> || Connection to VPN Server failure <http://forums.openvpn.net/topic8428.html#p13603>
04:56 -!- Enti0c [~Enti0c@oki-27-0-19-40.jpns.spearpt.com] has quit [Client Quit]
04:57 -!- Enti0c [~Enti0c@oki-27-0-19-40.jpns.spearpt.com] has joined #openvpn
04:58 -!- Enti0c [~Enti0c@oki-27-0-19-40.jpns.spearpt.com] has left #openvpn []
05:15 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:54 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:57 < krzee> hyper_ch, hey
05:57 < krzee> wassup?
06:04 < hyper_ch> krzee: how do you judge that http://pastebin.com/fJadSYg9
06:05 < hyper_ch> krzee: and why are you up at this unholy hour?
06:10 < krzee> question 1 im checking, #2 is a damn good question
06:12 < krzee> you use goofy paths
06:12 < krzee> !path
06:12 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
06:12 < krzee> are you sure ipp.txt is what you want?
06:12 < krzee> !ipp
06:12 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
06:12 < hyper_ch> goofy paths? how so?
06:13 < krzee> relative as opposed to full path
06:13 < krzee> people will get fucked up thinking thats a good idea ;)
06:13 < hyper_ch> :)
06:14 < hyper_ch> I see
06:14 < hyper_ch> and what about question #2?
06:14 < krzee> ild make ccd full path as well
06:14 < krzee> im still on line 43, doubt im done with question #1 yet
06:15 < hyper_ch> you're not very optimistic :(
06:17 < krzee> or im overly picky
06:17 < krzee> ;]
06:17 < hyper_ch> :)
06:17 < krzee> you also are not using tls-auth
06:17 < hyper_ch> should it be used?
06:17 < krzee> !hmac
06:17 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
06:17 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
06:20 < hyper_ch> more?
06:20 < krzee> The [i]iconfig-push[/i] directive assigns the IP 10.8.0.4 to this client. There are two addresses needed next to each other. I still don't understand why, but that's just the case.
06:20 < hyper_ch> :)
06:20 < hyper_ch> it's true :)
06:21 < krzee> a) thats only done that style in mode net30
06:21 < hyper_ch> !net30
06:21 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
06:21 < krzee> !topology
06:21 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
06:21 < krzee> !static
06:21 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
06:22 < krzee> b) .4 is not a valid ip to hand out in net30
06:22 < krzee> c) it goes ifconfig-push local_ip remote_ip
06:23 < krzee> d) the bigger # goes first =]
06:24 < hyper_ch> keep it coming :)
06:25 < krzee> line 96 says DNS-Server 1, but its really #2
06:25 < krzee> unless you index at 0
06:25 < hyper_ch> that I odn't understand
06:25 < krzee> push "dhcp-option DNS 10.8.0.1"
06:25 < krzee> push "dhcp-option DNS 208.67.222.222" # DNS-Server 1
06:25 < krzee> push "dhcp-option DNS 208.67.220.220" # DNS-Server 2
06:25 < krzee> which one comes first?
06:26 < hyper_ch> :)
06:26 < hyper_ch> it's just a comment
06:26 < krzee> yes
06:26 < hyper_ch> but you're right
06:28 < krzee> yanno, what i thought you were doing
06:28 < krzee> when i seen the ALLTRAFFIC file
06:28 < krzee> i thought you were going to include from a ccd
06:28 < krzee> so like 1 ALLTRAFFIC file, but no corresponding client
06:29 < krzee> then in the real client ccd files, --ifconfig-push for static, and --config to include ALLTRAFFIC file
06:29 < hyper_ch> I'm not following
06:29 < krzee> (configs may be nested)
06:30 < krzee> ok ill start over
06:30 < krzee> if you wanted, this would be an option:
06:30 < krzee> you have .../ccd/ALLTRAFFIC with this:
06:30 < krzee> push "redirect-gateway def1"
06:30 < krzee> push "dhcp-option DNS 10.8.0.1"
06:30 < krzee> push "dhcp-option DNS 208.67.222.222" # DNS-Server 1
06:30 < krzee> push "dhcp-option DNS 208.67.220.220" # DNS-Server 2[/quote]
06:30 < krzee> but no client actually named ALLTRAFFIC
06:31 < krzee> then you have .../ccd/client1
06:31 < krzee> which really is a client
06:31 < krzee> that file contains
06:31 < krzee> ifconfig-push 10.8.0.6 10.8.0.5
06:31 < krzee> config .../ccd/ALLTRAFFIC
06:32 < hyper_ch> ah, so with many clients you need to actually do less configuration for each client
06:32 < krzee> and you can change * in 1 edit
06:32 < krzee> instead of needing to script something if you change a NS for example
06:33 < hyper_ch> nice
06:33 < krzee> ya nested configs is handy
06:33 < krzee> same deal if you had 4 servers on 1 machine to spread the load acrossed cores
06:33 < hyper_ch> yeah, I see the benefits of that
06:34 < hyper_ch> one more thing, is there a way to safe .2 - .99 for static ips and hand out .100 - .255 for dynamic ones where the configs do not provide static ips?
06:34 < krzee> do that in reverse :-p
06:35 < hyper_ch> ?
06:35 < krzee> higher #'s for static ips
06:35 < krzee> then it just works that way naturally
06:35 < krzee> dont fight the flow
06:35 < hyper_ch> so reserving part of the pool isn't possible?
06:35 < krzee> sure, if you rebuild --server
06:36 < krzee> which really isnt worth it just to fight the flow without reason
06:36 < hyper_ch> :)
06:36 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
06:36 < krzee> --server is just a helper directive
06:36 < hyper_ch> on all the small networks I setup somewhere
06:36 < krzee> it calls a bunch of other config options
06:36 < hyper_ch> I just like to have until .100 reserved for static
06:36 < krzee> well
06:36 < hyper_ch> and above usable for dhcp
06:36 < krzee> for your vpn you get until 100 as dynamic
06:38 < krzee> http://www.youtube.com/watch?v=BQfBXvUuw2g
06:38 <@vpnHelper> Title: YouTube - Too $hort ft. Ice Cube - Big Thangs (at www.youtube.com)
06:40 < hyper_ch> ???
06:40 < krzee> thought ild share with ya =]
06:40 < hyper_ch> you want me to buy that domain?
06:41 < hyper_ch> sharing is caring :)
06:41 < hyper_ch> thx
06:41 < krzee> http://www.youtube.com/watch?v=kzi0TEZOeHQ
06:44 < hyper_ch> seems you like ice cubes?
06:45 < krzee> line 157 ip typo
06:45 < hyper_ch> that was on purpose to see if you'll notice
06:45 < krzee> riiiight
06:46  * hyper_ch looks towards the sky and starts whistling
06:46 < krzee> looks good man
06:46 < hyper_ch> thx
06:46 < hyper_ch> do your furballs keep you up this late?
06:46 < krzee> line 12
06:46 < krzee> apt-get install openvpn
06:47 < krzee> since you chose debian
06:47 < krzee> make a note that if they arent up to date, install from source
06:47 < krzee> debian people keep saying their repo gives them rc11
06:47 < hyper_ch> even debian oldstable has 2.1
06:47 < krzee> 2.1rc11
06:47 < krzee> lol
06:47 < hyper_ch> debian stable should have a newer version
06:47 < krzee> i agree, it should
06:47 < krzee> as i dont use debian, i go based on what people ask
06:48 < krzee> and the common problems associated
06:48 < hyper_ch> how could one not use debian?
06:48 < hyper_ch> that's like people chosing to not breath oxygen
06:48 < krzee> if i use linux, and thats a nice big if, ild use gentoo
06:48 < hyper_ch> why gentoo?
06:49 < krzee> control
06:49 < hyper_ch> what control?
06:50 < krzee> control over everything installed and how it was compiled
06:50 < krzee> binary package managers make me wanna hurt people
06:50 < hyper_ch> then you'd rather should use linuxfromscratch and not gentoo
06:51 < krzee> or just keep using freebsd
06:51 < krzee> ya that one sounds good
06:51 < krzee> and no, i dont keep furballs
06:51  * hyper_ch heard bsd if for people with no friends and too much spare time
06:51 < krzee> i have no idea why im awake so early, i went to bed drunk a couple hours ago
06:52 < hyper_ch> you don't have furballs? I'm so sorry
06:52  * krzee heard comments like that usually come from gentlemen with fantastic neckbeards
06:52 < hyper_ch> which of the two comments?
06:54 < krzee> the one related to bsd
06:54 < hyper_ch> what's a better way to start the day than getting jumped on by furballs while you're sweet dreaming because they think they must be feeded now
06:54 < krzee> that would be the day they learn to fly
06:54 < hyper_ch> why fly?
06:55 < hyper_ch> hmmm, flying furballs
06:55 < krzee> why fly...?  why wakeup krzee?
06:58 < hyper_ch> it sounds like you'd be mean to the furballs
06:59 < hyper_ch> furballs don't deserve to be treated meanly
06:59 < hyper_ch> furballs have very good uses
06:59 < hyper_ch> the try to catch annoying flies
06:59 < hyper_ch> (emphasis on "try"
07:00 < hyper_ch> they relentlessly hunt down the occasional bug that dares to entery my den
07:01 < hyper_ch> they also make sure I won't get bored so they make a mess in my den.... making things fall over, pushing books out of the book shelf
07:01 < hyper_ch> sometimes breaking glassy things
07:02 < hyper_ch> occupy your cushion when you want to go sleeping
07:02 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
07:03 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:03 < krzee> ya they sound just great
07:04 < hyper_ch> :)
07:04 < hyper_ch> and chicks also like furballs
07:04 < krzee> thats why they get to go home and play with their own
07:04 < hyper_ch> :)
07:05 < hyper_ch> now, if I just could walk my furballs
07:31 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:43 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:45 -!- luneff [~yury@84.51.213.254] has quit [Quit: This computer has gone to sleep]
07:45 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:45 -!- Cain` is now known as Cain
07:47 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Quit: Leaving.]
07:49 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
07:52 < bystander> good day guys. I have a question.  I am using one username to access the internet and it gives me ip like 51.8.0.6 and I can connect to the internet stable.  but when I use another account and gives me ip 51.8.0.70, I can connect to the internet but only for few minutes say 10 minutes and then I can no longer connect to the internet and I need to reconnect my vpn connection.
07:52 < bystander> May I know what is the cause and how it may be solved?
07:57 < bystander> guys?
07:58 < bystander> help me
08:00 -!- K1ng [~KING@180.211.188.113] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
08:03 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Ping timeout: 260 seconds]
08:04 -!- snappy [~nipnop@wbml.net] has joined #openvpn
08:04 -!- snappy [~nipnop@wbml.net] has quit [Changing host]
08:04 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
08:08 < Bushmills> sue your provider?
08:08 < bystander> bushmills: huh?
08:09 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has joined #openvpn
08:09 < Bushmills> UK Government Department for Work and Pensions - the owner of that address range
08:09 < Bushmills> sue them, for failing to provide you consistent and proper services
08:09 -!- K1ng [~KING@180.211.188.113] has joined #openvpn
08:12 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:22 -!- K1ng [~KING@180.211.188.113] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
08:23 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
08:24 -!- K1ng [~KING@180.211.188.113] has joined #openvpn
08:25 < s7r> can i use the client here http://swupdate.openvpn.net/downloads/openvpn-client.msi
08:26 < s7r> to connect to an openvpn server running the community project 2.2.
08:48 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
08:49 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 246 seconds]
09:07 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has quit [Ping timeout: 250 seconds]
09:35 < pr0zoid> my iptables seem to revert back after only a few hours of me making changes... not sure what is modifying them to default.  here is what i need them to stay as http://pastebin.com/09PavYP8 here is what i woke up to this morning http://pastebin.com/jEBMFXL0
09:36 < Bushmills> pr0zoid: find out what changes them, and take actions for that not to happen again
09:41 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:41 < pr0zoid> that's my question...
09:41 < bystander> good day. I would like to ask how I can block dns and icmp traffic?
09:41 < pr0zoid> is there an audit log.
09:41 < pr0zoid> where i can see what program is making a change to the iptables
09:42 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Operation timed out]
09:43 < Bushmills> something you have installed
09:43 < Bushmills> if you haven't, your sysadmin has. ask him.
09:44 < bystander> good day. I would like to ask how I can block dns and icmp traffic? no ones is around in netfilter
09:44 < Bushmills> bystander: the instruments to do that are firewall rules 
09:44 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
09:44 < Bushmills> you operating system mostly provides one. use it.
09:44 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
09:44 < Bushmills> your operating system ... most likely ...
09:44 < bystander> yes. but no one is answering in netfilter. so I ask here instead maybe someone could assist me.
09:45 < bystander> i will state one, I hope you can confirm bushmills.
09:45 < Bushmills> there's no way you can do that with openvpn. you need firewall.
09:45 < bystander> I mean you can confirm my firewall rule that I will show you.
09:46 < Bushmills> as said, that's nothing you can use openvpn for
09:46 < bystander> iptables -A OUTPUT -p icmp -j drop; iptables -A INPUT -p icmp -j drop; iptables -A FORWARD -p icmp -j drop.  is that correct?
09:46 < greenmang0> guys, i want to access lan behind openvpn server ... the lan is in range 192.168.x.x while i am using default address pool 10.8.x.x ... though i am able to ping openvpn server ... i don't seem to be able to access machines behind it .. what am i missing?
09:47 < Bushmills> !route
09:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:47 < Bushmills> !serverlan
09:47 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
09:47 < Bushmills> greenmang0: ^^^
09:47 < bystander> and also drop also all in dns iptable rules
09:48 < pr0zoid> bushmills: sysadmin = me or some unknown hacker who just likes to turn all firewalls rules off. i actually haven't installed anything  except an uninstall of ufw and that was before this change was made.
09:48 < Bushmills> bystander: if it doesn't give you a syntax error, it is formally correct. whether it does what you intend it to is another matter, and depends what you want it to do.  try a linux or netfilter channel, where they deal with questions about firewalls
09:49 < bystander> ok
09:49 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
09:49 < Bushmills> pr0zoid: openvpn doesn't turn off your firewall. something else does. 
09:50 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
09:50 < greenmang0> Bushmills, the link you gave seems to deal with "lan behind the openvpn _client_" ... but in my case I have just "one client with _no_ lan behind it" and I want to access "lan behind openvpn _server_"
09:50 < Bushmills> what that "something else" could be, is something determined by what you have installed into your OS, and how you have set it up.
09:51 < Bushmills> (16:47:06) Bushmills: !serverlan
09:51 < Bushmills> (16:47:08) vpnHelper: "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
09:51 < Bushmills> (16:47:13) Bushmills: greenmang0: ^^^
09:51 < Bushmills> carefully take note of "for a lan behind a server"
09:52 < greenmang0> Bushmills, oops, thanks
09:53 < greenmang0> Bushmills, well, I have ipforward enabled ... how exactly should i do this -> "server needs to push a route for its lan to clients," ? using "route" directive in server.conf?
09:53 -!- K1ng [~KING@180.211.188.113] has quit [Ping timeout: 258 seconds]
09:53 < Bushmills> !route
09:53 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:55 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
09:57 < pr0zoid> bushmills: yes.. i was just curious if anyone had experienced something similar
09:57 < pr0zoid> will do more investigation
09:58 < greenmang0> Bushmills, http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing --- the case mentioned here says clients have lans behind it ... but in my case i simply have no lan behind my client ... so there's no way i can use "route" directive
09:58 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
09:59 < Bushmills> "how exactly should i do this -> "server needs to push a route for its lan to clients," ? using "route" directive in server.conf?"  maybe you have noticed the  'push "route..."' statement in  the !route document? that should answer your question
09:59 < zamba> best embedded router to use with openvpn? suggestions?
10:00 < greenmang0> Bushmills, yes.... i am using that
10:00 < greenmang0> Bushmills, but it doesn't seem to work
10:00 < Bushmills> zamba: openwrt.   netgear wndr3700, buffalo wzr-hp-g300n,  tp-link wr1043nd
10:00 < zamba> cool.. i've been trying two of them
10:00 < zamba> but not getting the best performance
10:00 < zamba> only getting 4-5 mbps through the vpn tunnel
10:01 < Bushmills> the wndr3700 has a higher clocked cpu than the others tow.  but 4-5 mbps below what they're capable
10:01 < Bushmills> is below ...
10:02 < zamba> huh?
10:02 < Bushmills> last two have 400 MHz clocks, the first one 680 MHz
10:02 < zamba> i'm only getting 4-5 mbps through the wndr3700
10:02 < Bushmills> that's less than it can do.  i get more on a 400 MHz clocked tp-link
10:03 < zamba> oh, nevermind.. did a new test now.. 7 mbps
10:04 < zamba> it's bad routing that's causing it
10:05 < Bushmills> there's a plethora of possibilities what can cause it. for example the used encryption cipher
10:08 < greenmang0> hey Bushmills, any more pointers? 
10:13 < greenmang0> http://www.secure-computing.net/wiki/index.php/Graph -. this is exactly what i want to do
10:13 <@vpnHelper> Title: Graph - Secure Computing Wiki (at www.secure-computing.net)
10:13 < greenmang0> awesome
10:20 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
10:31 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Ping timeout: 240 seconds]
10:31 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has joined #openvpn
10:31 < eltrkbrd> !welcome
10:31 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:31 < eltrkbrd> !howto
10:31 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:36 < eltrkbrd> is there an OpenVPN server installer with GUI for Windows 7?  I'm looking to create an L2TP or IPSec incoming VPN connection on my Windows 7 PC.
10:37 < eltrkbrd> I've been all through the documentation on the website
10:37 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has left #openvpn []
10:38 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has joined #openvpn
10:41 < pr0zoid> bushmills: i think the issue is how i am fixing it when it stops working... i'm using a fw.stop script -> http://pastebin.com/JkMTJHSE
10:41 < pr0zoid> is that iptables -F command temporary
10:41 < pr0zoid> ?
10:41 < eltrkbrd> to install OpenVPN server on Windows 7, is there a management GUI available for Windows or does everything have to be configured from the command line?
10:53 -!- eltrkbrd2 [~eltrkbrd@70.114.194.245] has joined #openvpn
10:54 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has quit [Ping timeout: 264 seconds]
10:56 -!- mode/#openvpn [+o ecrist] by ChanServ
10:56 -!- mode/#openvpn [-s] by ecrist
10:56 -!- mode/#openvpn [-o ecrist] by ecrist
10:56 < zamba> Bushmills: what's the encryption cipher with less overhead and cpu intensive?
10:57 < zamba> comp-lzo
10:57 < zamba> i'm using that.. if that's the cipher?
11:00 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
11:01 < eltrkbrd2> Is there any current guides or tutorial for deploying OpenVPN server on a Windows 7 host?
11:03 < Mowee> plop
11:15 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 246 seconds]
11:22 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has joined #openvpn
11:23 < Gaglia> Howdy, elliptic curves with openvpn anyone?
11:27 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Quit: Verlassend]
11:29 -!- luneff [~yury@84.51.213.254] has joined #openvpn
11:31 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has joined #openvpn
11:34 -!- eltrkbrd2 [~eltrkbrd@70.114.194.245] has quit [Ping timeout: 264 seconds]
11:34 -!- eltrkbrd2 [~eltrkbrd@70.114.194.245] has joined #openvpn
11:37 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has quit [Ping timeout: 246 seconds]
11:39 -!- eltrkbrd2 [~eltrkbrd@70.114.194.245] has quit [Client Quit]
11:39 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has joined #openvpn
11:48 -!- corretico [~luis@201.201.44.82] has joined #openvpn
11:49 -!- eltrkbrd [~eltrkbrd@70.114.194.245] has quit []
11:54 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
11:54 -!- Justice [~Justice@c-68-34-107-252.hsd1.md.comcast.net] has joined #openvpn
12:10 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
12:13 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
12:25 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p13606>
12:26 -!- jaminja [~jaminja@host86-176-139-184.range86-176.btcentralplus.com] has joined #openvpn
12:28 -!- K1ng [~KING@180.211.188.24] has joined #openvpn
12:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
12:36 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
12:40 < Dropje> Bushmills: sorry for the late reply :) when i use "route" i get two different routes for the same network forwarded to 2 different tun adapters.
12:43 < K1ng> any idea where can i get 5.1 music videos?
12:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:52 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
13:12 < ecrist> K1ng: not here.
13:40 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:42 -!- jaminja [~jaminja@host86-176-139-184.range86-176.btcentralplus.com] has quit [Changing host]
13:42 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
14:11 < s7r> can i use the client here http://swupdate.openvpn.net/downloads/openvpn-client.msi   to connect to an openvpn server running the community project 2.2.
14:15 < s7r> anyone?
14:47 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
14:47 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Ping timeout: 260 seconds]
14:48 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
15:08 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
15:19 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8429.html>
15:23 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
15:24 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:24 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:24 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
15:31 <@vpnHelper> RSS Update - forum: Administrator Pirvileges <http://forums.openvpn.net/topic8418.html#p13608>
15:41 < Gaglia> does anybody know where the netowrk-manager-openvpn config files are stored in ubuntu?
15:41 -!- randomandy [~randomand@2001:470:1f05:1570:c62c:3ff:fe05:d3f2] has joined #openvpn
15:41 < Gaglia> I need to manually edit them
15:43 -!- randomandy [~randomand@2001:470:1f05:1570:c62c:3ff:fe05:d3f2] has quit [Client Quit]
15:44 -!- randomandy [~randomand@2001:470:1f05:1570:c62c:3ff:fe05:d3f2] has joined #openvpn
15:45 < randomandy> !welcome
15:45 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:46 < randomandy> !goal
15:46 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:48 < randomandy> !route
15:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:51 < randomandy> !iporder
15:51 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
15:51 < randomandy> !ipp
15:51 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
15:52 < randomandy> !static
15:52 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
15:55 < randomandy> Can someone tell me where I could learn about why openvpn would be inclined to keep *changing* my ccd files from an iroute command into an ifconfig-push command? It seems to occur after a non graceful connection tear down or something and then the lan routing breaks until I change the ccd file back. I haven't seen anywhere that explains why openvpn would *change* a config file dynamically. Hints anyone? Thanks.
15:56 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
15:57 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
15:58 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 250 seconds]
15:59 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
16:14 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
16:21 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Quit: Verlassend]
16:21 -!- syn4pse [~syn@p5DDC027B.dip0.t-ipconnect.de] has joined #openvpn
16:23 -!- syn4pse [~syn@p5DDC027B.dip0.t-ipconnect.de] has quit [Client Quit]
16:23 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
16:59 -!- Gaglia [~gaglia@host28-186-dynamic.55-82-r.retail.telecomitalia.it] has quit [Quit: Gaglia]
17:10 -!- bobdole [~bobdole@208.76.54.181] has joined #openvpn
17:16 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Quit: Verlassend]
17:56 -!- s7r [~s7r@unaffiliated/s7r] has left #openvpn []
17:58 -!- K1ng` [~KING@180.211.188.24] has joined #openvpn
18:00 -!- K1ng [~KING@180.211.188.24] has quit [Ping timeout: 250 seconds]
18:02 -!- bobdole [~bobdole@208.76.54.181] has quit [Quit: Lost terminal]
18:08 < randomandy> Can someone tell me where I could learn about why openvpn would be inclined to keep *changing* my ccd files from an iroute command into an ifconfig-push command? It seems to occur after a non graceful connection tear down or something and then the lan routing breaks until I change the ccd file back. I haven't seen anywhere that explains why openvpn would *change* a config file dynamically. Hints anyone? Thanks.
18:32 -!- fbh_ is now known as fbh
18:32 -!- fbh [fbh@lucifer.frands.net] has quit [Changing host]
18:32 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
18:33 -!- nmpribeiro [~wraz____@bl23-19-78.dsl.telepac.pt] has joined #openvpn
18:53 -!- nmpribeiro [~wraz____@bl23-19-78.dsl.telepac.pt] has quit [Quit: Leaving]
18:58 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
19:03 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
19:15 < krzie> lol
19:15 < krzie> oops wrong chan
19:16 < krzie> randomandy, its you or something else you are running
19:16 < krzie> openvpn will never change a config
19:16 < krzie> or you arent running normal openvpn
19:16 < randomandy> hmm
19:16 < krzie> you using access-server or something...?
19:16 < randomandy> yah, it seemed awfully weird to me, but ..
19:16 < randomandy> I don't even know what that is.
19:17 < randomandy> I *am* using radius plugin.
19:17 < krzie> is the a web based anything?
19:17 < randomandy> perhaps that..
19:17 < krzie> there*
19:17 < randomandy> ok.. I'll look down that trail and see where it leads.
19:18 < randomandy> Thanks.
19:20 -!- mirco [~mirco@p5B2838EA.dip.t-dialin.net] has quit [Quit: mirco]
19:21 < krzie> np
19:22 < krzie> but really
19:22 < krzie> is there a web based anything?
19:22 -!- germy [~xeroxman@71.21.164.84] has joined #openvpn
19:22 < krzie> because if so, you are in fact not using openvpn
19:22 < krzie> they have a version called access-server, which is a different product, with a different help channel
19:22 < krzie> and since it attempts to do everything for you, i wouldnt be surprised if it does edit configs
19:23 < krzie> so if you answer my question, i may have help for you after all...
19:25 < randomandy> Sorry. Thought the conversation was over. No, it's not at all web based. All text configs. 
19:30 < krzie> ok cool, you arent using access-server then
19:30 < krzie> now its over then ;)
19:31 < randomandy> :)
19:31 < randomandy> tnx
19:31 -!- randomandy [~randomand@2001:470:1f05:1570:c62c:3ff:fe05:d3f2] has quit [Quit: randomandy]
19:40 -!- K1ng [~KING@180.211.188.24] has joined #openvpn
19:41 -!- daveosx [~daveosx@70.90.63.189] has joined #openvpn
19:43 -!- K1ng` [~KING@180.211.188.24] has quit [Ping timeout: 276 seconds]
19:45 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Ping timeout: 252 seconds]
19:52 < daveosx> Hi All does anyone know if MTU path settings can be pushed from the CCD client files?
20:07 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:14 -!- daveosx [~daveosx@70.90.63.189] has quit [Quit: daveosx]
20:15 -!- master_of_master [~master_of@p57B5212D.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:16 -!- master_of_master [~master_of@p57B5338B.dip.t-dialin.net] has joined #openvpn
20:27 -!- germy [~xeroxman@71.21.164.84] has quit [Ping timeout: 258 seconds]
20:31 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:40 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
21:34 <@vpnHelper> RSS Update - forum: external connection <http://forums.openvpn.net/topic8417.html#p13609>
21:57 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 260 seconds]
22:08 -!- syn4pse [~syn@p5DDC06B5.dip0.t-ipconnect.de] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:39 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:12 -!- Justice [~Justice@c-68-34-107-252.hsd1.md.comcast.net] has quit [Ping timeout: 250 seconds]
23:31 -!- jaminja [~jaminja@host86-176-139-184.range86-176.btcentralplus.com] has joined #openvpn
23:31 -!- jaminja [~jaminja@host86-176-139-184.range86-176.btcentralplus.com] has quit [Changing host]
23:31 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
23:46 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has joined #openvpn
23:56 -!- pjr107 [~wircer@184.77.191.41] has joined #openvpn
23:56 -!- pjr107 [~wircer@184.77.191.41] has left #openvpn ["wIRC"]
--- Day changed Sun Jul 10 2011
00:02 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has quit [Ping timeout: 255 seconds]
00:19 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Ping timeout: 264 seconds]
00:29 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
00:31 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 255 seconds]
00:45 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Quit:  I love my HydraIRC -> http://www.hydrairc.com <-]
02:02 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
02:32 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
02:42 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Read error: Connection reset by peer]
02:43 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
02:54 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Ping timeout: 252 seconds]
02:54 -!- takamichi [~pri@83.170.109.106] has joined #openvpn
02:56 -!- syn4pse [~syn@p5DDC06B5.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
03:01 -!- takamichi [~pri@83.170.109.106] has quit [Ping timeout: 276 seconds]
03:02 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
03:06 -!- mirco [~mirco@p5B2850BC.dip.t-dialin.net] has joined #openvpn
03:08 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
03:24 < pr0zoid> i'm getting TLS handshake errors after connecting for a few hours.... http://pastebin.com/JPmzUVgR  seems to work fine with i reconnect but anyone know why this is happening?
03:35 < Mowee> Morning
03:43 < K1ng> can anyone invite me to google+?
03:46 -!- K1ng [~KING@180.211.188.24] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
03:48 -!- K1ng [~KING@180.211.188.24] has joined #openvpn
03:50 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:16 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Ping timeout: 276 seconds]
04:16 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
04:46 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
04:50 -!- powerengineer311 [~aleksei@84-52-51-192.saturn.infonet.ee] has joined #openvpn
04:52 -!- powerengineer311 [~aleksei@84-52-51-192.saturn.infonet.ee] has left #openvpn []
05:01 -!- Guifort [~Guifort@52.55.67.86.rev.sfr.net] has joined #openvpn
05:05 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 258 seconds]
05:05 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
05:17 -!- rothwell [~rothwell@unaffiliated/rothwell] has joined #openvpn
05:18 < rothwell> 'lo all. is there some way to get windows xp to use one dns server for requests for one domain and another for others? os x has /etc/resolver/*, i believe linux has something similar
05:18 < rothwell> i'm trying to avoid having vpn clients do *ALL* requests through my internal dns server
05:19 < s7r> rothwell why not push the open dns servers to vpn clients
05:20 < rothwell> s7r: how d'you mean?
05:21 < s7r> in the server config file
05:21 < s7r> push "dhcp-option DNS 208.67.222.222"
05:22 < s7r> push "dhcp-option DNS 208.67.220.220"
05:22 < s7r> and you will be sure your internal dns server is not being overkill
05:25 -!- Guifort_ [~Guifort@52.55.67.86.rev.sfr.net] has joined #openvpn
05:25 < rothwell> but then, presumably, when people look up internal dns names on those servers, they'll get NXDOMAIN
05:25 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Quit:  Want to be different? Try HydraIRC -> http://www.hydrairc.com <-]
05:25 -!- Guifort [~Guifort@52.55.67.86.rev.sfr.net] has quit [Read error: Connection reset by peer]
05:26 < s7r> of yeah
05:26 < s7r> those servers are public dns servers
05:26 < s7r> for internet requests, not for lookup local names
05:26 < s7r> the local names on your network have nothing to do with those dns servers
05:26 < rothwell> well... that's my problem. i'm trying to have people use my internal server for requests on the internal domain, and everything else through whatever servers they normally use
05:27 < s7r> in this case you should use your internal dns servers
05:27 < rothwell> we have it working fine on OS X and linux, just not XP
05:27 < s7r> I am windows user also and I don't think windows has this option for lookups
05:27 < s7r> try google
05:28 < rothwell> i have, but it's a difficult one to search for
05:28 < rothwell> wondered if there was some 3rd party software that someone here used
05:28 < rothwell> can't imagine it's an uncommon problem
05:28 < s7r> how did you do it under linux
05:29 < s7r> ?
05:29 < rothwell> i believe the linux clients are using 'dnsmasq'
05:29 < rothwell> i've not used it
05:29 < rothwell> http://www.thekelleys.org.uk/dnsmasq/doc.html
05:29 <@vpnHelper> Title: Dnsmasq - a DNS forwarder for NAT firewalls. (at www.thekelleys.org.uk)
05:29 < rothwell> "Dnsmasq can be configured to send queries for certain domains to upstream servers handling only those domains. This makes integration with private DNS systems easy."
05:30 < s7r> try searching if there is a dnsmasq or something similar for windows
05:30 < s7r> it could exist
05:30 < rothwell> again, i have
05:30 < rothwell> no luck so far
05:32 < rothwell> ah, looks like windows server 2003 has something built in
05:33 < rothwell> obviously not much good for people on XP desktops
05:33 < diemos> dnsmasq for windows is basically dd-wrt
05:33 < rothwell> router firmware?
05:33 < diemos> yup.
05:34 < diemos> one of the better web interfaces to dnsmasq
05:35 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
05:38 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: quit]
05:48 -!- Guifort_ [~Guifort@52.55.67.86.rev.sfr.net] has quit [Quit: Quitte]
06:06 -!- vai__ [~vai@168.144.28.208] has quit [Remote host closed the connection]
06:09 < rothwell> hm... is 'register-dns' still a valid command in 2.2?
06:09 < rothwell> i'm getting "Unrecognized option or missing parameter(s) in /client-configs/xyz: register-dns (2.2.0)" in server logs, but it appears to work anyway
06:20 < rothwell> my fault... wasn't using "push"
07:02 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
07:02 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
07:07 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
07:16 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: quit]
07:18 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
07:34 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
07:44 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:45 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:45 -!- Cain` is now known as Cain
07:55 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
07:57 -!- bystander [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
08:00 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
08:01 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 264 seconds]
08:02 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
08:11 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
08:12 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
08:24 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
08:48 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
08:55 -!- luneff [~yury@84.51.213.254] has quit [Ping timeout: 255 seconds]
08:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:04 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
09:04 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
09:04 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:05 -!- share [share@unaffiliated/share] has joined #openvpn
09:05 -!- share [share@unaffiliated/share] has left #openvpn []
09:19 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
09:21 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
09:35 -!- EugeneYardWork [~EugeneKay@eugenekay.com] has joined #openvpn
09:35 < EugeneYardWork> I knew I was missing a channel.
09:35 -!- EugeneYardWork is now known as EugeneKay
09:47 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: quit]
10:06 < pr0zoid> i'm getting TLS handshake errors after connecting for a few hours.... http://pastebin.com/JPmzUVgR  seems to work fine with i reconnect but anyone know why this is happening?
10:08 < |Mike|> You know how TLS works right?
10:08 < reiffert> Sun Jul 10 02:47:12 2011 [server] Inactivity timeout (--ping-restart), restarting
10:09 < reiffert> Sun Jul 10 02:48:14 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
10:09 < reiffert> I'd do the "check your network connectivity" part.
10:19 -!- EugeneKay is now known as EugeneYardWork
10:43 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has joined #openvpn
10:47 -!- venom00 [~wer@unaffiliated/venom00] has joined #openvpn
10:51 -!- EugeneYardWork is now known as EugeneKay
10:51 < pr0zoid> |Mike|: nope.
10:51 < pr0zoid> ahh okay.
10:52 < pr0zoid> reiffert: thanks..  my provider has been experiencing DDOS
10:52 < pr0zoid> attacks.
10:52 < EugeneKay> pr0zoid - TLS is a combination of dark voodoo, witchcraft, and Mayan/Pagan hybrid rituals
10:52 < EugeneKay> The SNI ritual is particularly troubling to newcomers
10:57 < pr0zoid> i guess i need a witchdoctor.
11:01 < pr0zoid> thanks for the protip
11:16 -!- melfy [~jay@ip174-66-13-172.hr.hr.cox.net] has joined #openvpn
11:26 -!- knarfly [~vlad@66.184.211.226] has joined #openvpn
11:27 < knarfly> anyone know how to resolve being at a hotel which is probably blocking OpenVPN but they don't have a clue about their firewall?
11:33 -!- venom00 [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
11:33 -!- venom00 [~wer@unaffiliated/venom00] has joined #openvpn
11:35 < reiffert> http://www.google.de/search?q=tcp+over+dns
11:35 <@vpnHelper> Title: tcp over dns - Google-Suche (at www.google.de)
11:40 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has quit [Ping timeout: 255 seconds]
11:44 -!- knarfly [~vlad@66.184.211.226] has left #openvpn []
12:13 -!- mdalby [~mdalby@67.205.112.103] has joined #openvpn
12:13 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has joined #openvpn
12:16 -!- melfy [~jay@ip174-66-13-172.hr.hr.cox.net] has left #openvpn ["Leaving."]
12:18 < Dougy> hey ecrist 
12:21 <@vpnHelper> RSS Update - forum: Test <http://forums.openvpn.net/topic8346.html#p13610>
12:55 -!- Kateon [482392@xs8.xs4all.nl] has quit [Ping timeout: 260 seconds]
12:55 -!- Kateon [~user@xs8.xs4all.nl] has joined #openvpn
13:04 -!- venom00 [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
13:04 -!- venom00 [~wer@unaffiliated/venom00] has joined #openvpn
13:06 -!- venom00 [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
13:06 -!- venom00 [~wer@unaffiliated/venom00] has joined #openvpn
13:15 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
13:20 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has quit [Ping timeout: 240 seconds]
13:26 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
13:33 -!- syn4pse [~syn@p5DDC06B5.dip0.t-ipconnect.de] has joined #openvpn
13:36 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Read error: Connection reset by peer]
13:54 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
13:54 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 240 seconds]
13:56 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has joined #openvpn
13:59 < kisom> anyone with experience on running openvpn on the iphone? I'm having trouble with redirect-gateway, all the routes seems to be added but no traffic is really forwarded, connections just time out.
14:12 -!- beshoo [~linada@31.9.84.133] has joined #openvpn
14:12 < beshoo> !redirect
14:12 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:13 < beshoo> !def1
14:13 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
14:13 < beshoo>  !ipforward
14:14 < kisom> beshoo: thanks, but the VPN is working fine on linux and windows clients, its just the iPhone that is having problems
14:14 < beshoo> !ipforward
14:14 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:19 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
14:57 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Ping timeout: 264 seconds]
14:57 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
14:59 -!- mdalby [~mdalby@67.205.112.103] has left #openvpn ["Leaving"]
15:06 -!- venom00 [~wer@unaffiliated/venom00] has quit [Remote host closed the connection]
15:22 <@vpnHelper> RSS Update - forum: Long setup time <http://forums.openvpn.net/topic8385.html#p13612>
15:24 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:34 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
15:42 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:42 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:42 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:58 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
15:58 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
16:01 -!- mirco [~mirco@p5B2850BC.dip.t-dialin.net] has quit [Quit: mirco]
16:01 -!- mirco [~mirco@p5B2850BC.dip.t-dialin.net] has joined #openvpn
16:05 -!- mirco [~mirco@p5B2850BC.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
16:22 -!- luneff [~yury@84.51.213.254] has joined #openvpn
16:23 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
16:29 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
17:00 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: quit]
17:01 -!- Bogus8_ [~Nunya@ip184-190-202-56.lf.br.cox.net] has joined #openvpn
17:05 < Bogus8_> What is the best way to setup a vpn where my host is linux (headless) and I'd like to use "set up a new connection or network" wizard and they just put in the IP address and use a user/pass on a windows machine. 
17:14 < kisom> Bogus8_: you cannot use openvpn for that purpose. you can use pptpd (i think its called?) but it offers much lower security than openvpn
17:15 < Bogus8_> kisom: hmmm... What is the simplest way to set up a VPN where I can have users "create" their own tunnels when needed.  and I mean REGULAR non-tech savy users.
17:16 < kisom> i dont know, never used pptpd but for windows users i've heard its pretty easy. or buy some openvpn-AS licenses, i think its pretty easy to use for end users
17:17 < Bogus8_> kisom: ok, thanks for the direction.  Just looking for something cheap (read: free) :) and simple.
17:20 < krzee> #openvpn-as exists too =]
17:21 -!- krzee changed the topic of #openvpn to: OpenVPN 2.2.1 most current, released 6-July-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: https://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly. || Host Cloaks available, just ask for one. | Access Server support in #openvpn-as
17:22 < kisom> Bogus8_: Hamachi might suit you...?
17:23 < Bogus8_> kisom: interesting... not sure it will work for this but certainly will keep it in mind for other projects.,
17:39 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
17:45 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
17:56 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:01 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
18:02 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
18:13 -!- EugeneKay is now known as EugeneKaway
18:47 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
19:23 -!- Justice [~Justice@c-98-218-47-80.hsd1.md.comcast.net] has quit [Ping timeout: 255 seconds]
19:25 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:27 -!- EugeneKaway is now known as EugeneKay
19:58 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:15 -!- master_of_master [~master_of@p57B5338B.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:17 -!- master_of_master [~master_of@p57B52DB3.dip.t-dialin.net] has joined #openvpn
20:58 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
21:14 -!- durando [~durando@cpe-76-178-221-232.maine.res.rr.com] has joined #openvpn
21:16 < durando> hey guys i have openvpn up and running on my routers using tomatousb firmware and i can get the computers to on both sides of the network to see both of the routers but can't get them to see the computers behind the other router (IE: computer a on network 1 can see network 2's router but can't see computer a on network 2 for shared folders etc)
21:33 -!- Sazpaimon [wat@c-68-32-58-174.hsd1.nj.comcast.net] has joined #openvpn
21:33 < Sazpaimon> so, here's an interesting problem
21:34 < Sazpaimon> when I connect to my VPN through openvpn, on my computer, every single computer on my network loses internet connection
21:34 < Sazpaimon> bearing in mind that all the other computers, mine included, is connected to the router
21:37 -!- Essobi [~Essobi@74-128-53-127.dhcp.insightbb.com] has quit [Ping timeout: 252 seconds]
21:38 -!- durando [~durando@cpe-76-178-221-232.maine.res.rr.com] has left #openvpn []
21:39 -!- Sazpaimon_ [wat@138.199.65.213] has joined #openvpn
21:40 < Sazpaimon_> PPTP seems to work fine
21:42 -!- Sazpaimon [wat@c-68-32-58-174.hsd1.nj.comcast.net] has quit [Ping timeout: 240 seconds]
21:52 -!- syn4pse- [~syn@p5DDC0972.dip0.t-ipconnect.de] has joined #openvpn
21:55 -!- syn4pse [~syn@p5DDC06B5.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
22:06 < krzee> Sazpaimon_, you gave no details about your setup, since we have no telepaths here, you'll need to supply more info if you want help
22:32 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
22:39 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:00 -!- Sazpaimon [wat@c-68-32-58-174.hsd1.nj.comcast.net] has joined #openvpn
23:03 -!- Sazpaimon_ [wat@138.199.65.213] has quit [Ping timeout: 240 seconds]
--- Day changed Mon Jul 11 2011
00:32 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
00:33 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
00:44 -!- beshoo [~linada@31.9.84.133] has quit [Ping timeout: 246 seconds]
00:58 -!- krphop [~krphop@74.82.160.100] has quit [Ping timeout: 240 seconds]
01:00 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:01 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
01:08 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
01:19 -!- mirco [~mirco@p5B282E27.dip.t-dialin.net] has joined #openvpn
01:32 -!- dazo_afk is now known as dazo
01:33 -!- mirco [~mirco@p5B282E27.dip.t-dialin.net] has quit [Quit: mirco]
01:34 -!- mirco [~mirco@p5B282E27.dip.t-dialin.net] has joined #openvpn
01:34 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
01:38 -!- mirco [~mirco@p5B282E27.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
01:40 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
01:45 -!- SWAT [~swat@ubuntu/member/swat] has quit [Ping timeout: 240 seconds]
02:00 -!- SWAT [~swat@ubuntu/member/swat] has joined #openvpn
02:25 -!- ele_ is now known as ele
02:27 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
02:37 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
02:40 <@vpnHelper> RSS Update - forum: Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13614>
02:57 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
03:00 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
03:05 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
03:10 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:17 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
03:25 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
03:25 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Ping timeout: 252 seconds]
03:31 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
03:42 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
03:53 -!- luneff [~yury@84.51.213.254] has quit [Quit: Leaving]
03:59 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
04:18 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
04:33 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
04:33 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
04:35 -!- baccenfu1ter [~backenfut@shell.c-base.org] has joined #openvpn
04:36 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
04:40 -!- Netsplit *.net <-> *.split quits: aef, pa, jpalmer, naquad, baccenfutter, Hamlin, Martin`, bigon, Rolybrau
04:40 -!- Hamlin_ [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has joined #openvpn
04:40 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
04:40 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
04:40 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
04:44 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
04:46 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
04:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:47 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:48 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:51 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:51 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:51 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:57 -!- syn4pse- [~syn@p5DDC0972.dip0.t-ipconnect.de] has quit [Quit: Verlassend]
04:57 -!- syn4pse [~syn@rs17058.rapidspeeds.com] has joined #openvpn
05:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
05:18 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:31 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
05:36 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
05:57 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
05:59 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
06:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:14 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
06:17 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Ping timeout: 258 seconds]
06:24 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: quit]
06:27 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 252 seconds]
06:28 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
06:35 -!- greenmang0 [~greenmang@121.243.225.226] has joined #openvpn
06:35 -!- greenmang0 [~greenmang@121.243.225.226] has quit [Changing host]
06:35 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
06:45 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
06:59 -!- beshoo [~linada@31.9.84.133] has joined #openvpn
07:01 -!- beshoo [~linada@31.9.84.133] has quit [Read error: No route to host]
07:04 -!- brabo [brabo@globalshellz/owner/brabo] has quit [Remote host closed the connection]
07:14 < Mowee> Hi
07:44 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
07:45 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:45 -!- Cain` is now known as Cain
07:59 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:59 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:59 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:01 -!- K1ng [~KING@180.211.188.24] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
08:02 -!- K1ng [~KING@180.211.188.24] has joined #openvpn
08:03 -!- K1ng [~KING@180.211.188.24] has quit [Client Quit]
08:07 -!- Justice [~Justice@pool-71-246-92-229.bltmmd.east.verizon.net] has joined #openvpn
08:43 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
08:44 < cherwin> *cough*
08:46 < Dropje> !static
08:46 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
08:54 < cherwin> !help
08:54 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
08:54 < cherwin> !list
08:54 <@vpnHelper> Admin, BadWords, Channel, ChannelLogger, Config, Factoids, FloodPrevent, Google, Misc, Owner, Relay, Seen, Services, User, and Web
08:55 < cherwin> !plugins
08:55 < cherwin> !welcome
08:55 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:56 < cherwin> !/30
08:56 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
09:00 -!- lucidyguy [c04b9eb4@gateway/web/freenode/ip.192.75.158.180] has joined #openvpn
09:01 -!- K1ng [~KING@180.211.188.24] has joined #openvpn
09:02 < lucidyguy> Firewall recommendations.  Employer wants to implement a Checkpoint applicance which is quite costly.  I want to recommend a more cost effective solution.  Ideally an appliance with firewall, IDS, and vpn capabilities.... recomendations?
09:10 < Riz> Looked at junipers lineup?
09:10 < Riz> Something in the SSG series, likely come in less or around the same price as checkpoint (certainly less then crisco).
09:12 < Riz> http://www.juniper.net/us/en/products-services/security/ssg-series/
09:12 <@vpnHelper> Title: SSG Series Secure Services Gateway - Enterprise Firewall VPN - Juniper Networks (at www.juniper.net)
09:12 < cherwin> lucidguy: OpenBSD, Snort, OpenVPN in that order.
09:15 < Dougy> good stuff
09:16 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Read error: Connection reset by peer]
09:17 -!- greenmang0 [~greenmang@121.243.225.226] has joined #openvpn
09:17 -!- greenmang0 [~greenmang@121.243.225.226] has quit [Changing host]
09:17 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
09:27 -!- Essobi [~Essobi@74.128.237.214] has joined #openvpn
09:31 -!- Irssi: #openvpn: Total of 152 nicks [4 ops, 0 halfops, 0 voices, 148 normal]
09:41 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:41 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has joined #openvpn
09:41 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has quit [Remote host closed the connection]
09:44 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has joined #openvpn
09:45 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
09:51 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
09:51 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
09:51 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:53 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
09:54 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
09:54 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
09:54 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:54 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
09:57 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
09:59 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
09:59 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
09:59 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:01 -!- brah [be88d16c@gateway/web/freenode/ip.190.136.209.108] has joined #openvpn
10:02 < brah> Hi.
10:02 < brah> I can't get CUPS sharing to work through my VPN, even though both endpoints can see eachother without problems.
10:03 < brah> I'm guessing the issue is because of using TUN, but I can't change that. What do?
10:04 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 258 seconds]
10:04 -!- Axeman [~axeman3@198.105.46.46] has joined #openvpn
10:05 -!- darkdrgn2k3 [~darkdrgn2@199.243.221.14] has joined #openvpn
10:05 < darkdrgn2k3> hey
10:06 < darkdrgn2k3> is there anyway i can get openvpn to update the time when it connects?
10:06 < darkdrgn2k3> openvpn client (sorry)
10:08 < Axeman> zomg i just got this installed as esxi app server - and spent a load of time figuring out the eth0 not getting an IP bit. i think you guys should set it to DHCP by default and let the savvy edit otherwise
10:17 -!- Justice [~Justice@pool-71-246-92-229.bltmmd.east.verizon.net] has quit [Ping timeout: 255 seconds]
10:18 < darkdrgn2k3> ummm you really dont want a server having dynamic ips :-P
10:18 < Axeman> i know - but atl east to get at the web ui
10:19 < Axeman> for the non lenny users
10:19 < Axeman> like me
10:21 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Remote host closed the connection]
10:22 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
10:24 < krzee> darkdrgn2k3, 
10:24 < krzee> !scripts
10:24 < krzee> !script
10:24 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
10:25 < darkdrgn2k3> krzee: what point is the certificate NOT checked yet for validity?
10:25 < darkdrgn2k3> "--tls-verify Executed when we have a still untrusted remote peer.  ?"
10:29 < Axeman> the ip/host that's given by default.... is that a free service that openvpn provides? something similar to a dyndns ? 
10:30 < krzee> Axeman, huh??
10:30 < Axeman> when i go to the webui ... there's a hostname (an ip address) already entered there. 
10:34 < Axeman> a 50.23.x.x. range. 
10:41 -!- wg0d [~the@89.137.62.70] has joined #openvpn
10:42 < wg0d> !welcome
10:42 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:42 < wg0d> !goal
10:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:42 < Axeman> !howto
10:42 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:42 < wg0d> !goal vpn service provider
10:43 < wg0d> any helper online ?
10:50 -!- Sazpaimon_ [wat@c-68-32-58-174.hsd1.nj.comcast.net] has joined #openvpn
10:53 -!- Sazpaimon [wat@c-68-32-58-174.hsd1.nj.comcast.net] has quit [Ping timeout: 250 seconds]
11:00 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
11:02 < Riz> wg0d what is it your looking for?
11:04 <@vpnHelper> RSS Update - forum: Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13615>
11:04 < darkdrgn2k3> ok any one know what the ntp client man page is at
11:04 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
11:04 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
11:04 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:04 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
11:05 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:05 -!- mode/#openvpn [+o mattock] by ChanServ
11:07 < reiffert> darkdrgn2k3: there isnt really a ntp client software.
11:07 < darkdrgn2k3> what about "ntpclient" 
11:07 < reiffert> darkdrgn2k3: there is ntpd, which can be configured to set the local time according to a time server, or an external time source
11:08 < darkdrgn2k3> grrr wrong channel
11:08 < reiffert> darkdrgn2k3: and there is ntpdate, which only sets time according to a time service given.
11:08 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
11:08 < darkdrgn2k3> openwrt usees "ntpclient" do it
11:08 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:08 < darkdrgn2k3> "Usage: ntpclient [-c count] [-d] [-f frequency] [-g goodness] -h hostname
11:08 < darkdrgn2k3> "
11:08 -!- mode/#openvpn [+o mattock] by ChanServ
11:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:08 < reiffert> darkdrgn2k3: so then it's up to you getting the ntpclient docs at the openwrt place.
11:09 < darkdrgn2k3> yeh like i said wrong chennl
11:09 < darkdrgn2k3> :)
11:09 < darkdrgn2k3> 3 litle letters.. openVPN vs openWRT
11:09 < darkdrgn2k3> once i get time set the certificates will no longer expire :)0
11:09 < reiffert> darkdrgn2k3: adding "ntpclient openwrt" into google brings up
11:09 < reiffert> http://wiki.openwrt.org/doc/uci/ntpclient
11:09 < reiffert> it's at the very start of the google results, shouldnt be that hard.
11:09 < darkdrgn2k3> reiffert: yes uits all setup but the date was novembver 2010.. so thast not right
11:10 < reiffert> darkdrgn2k3: I really dont care.
11:10 < reiffert> darkdrgn2k3: searching for the docs -> answer.
11:10 < darkdrgn2k3> i know
11:10 < darkdrgn2k3> i dont really care eitehr
11:10 < darkdrgn2k3> but with a "cert not yet valid" error.. i started to :(
11:10 < darkdrgn2k3> but thanx. this might give me a hint why is breaking
11:10 < darkdrgn2k3> anyway off to the openwrt ppl to bug them
11:10 < darkdrgn2k3> thaxn agian
11:15 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Remote host closed the connection]
11:15 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
11:17 < wg0d> hello
11:17 < wg0d> what anonymouse vpn services do you recommend ?
11:19 < cherwin> wg0d: www.tunnelr.com
11:20 < wg0d> they don`t support illegal activities
11:20 < wg0d> :P
11:21 < Axeman> VipreVPN
11:28 -!- wg0d [~the@89.137.62.70] has quit []
11:32 < reiffert> shooting into the own leg = anonymous illegal vpn service.
11:35 < Axeman> lol what do you mean reiffert  ? 
11:39 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Read error: No route to host]
11:39 -!- mirco [~mirco@p5B282E27.dip.t-dialin.net] has joined #openvpn
11:39 < reiffert> Axeman: take a gun, load it, point it at your own leg and press the trigger.
11:41 < Axeman> haha i know how that's done. didn't understand your statement. 
11:42 < Axeman> did the openvpn site change the documents page? 
11:42 < Axeman> i printed out a rather lengthy startup guide a couple of weeks back - can't seem to find that anymore
11:42 < reiffert> !howto
11:42 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:42 < Axeman> it wasn't the pdf/admin guide.
11:43 < reiffert> ah, the apple Axeman, arent you?
11:43 < Axeman> see when i click HowTo on the site, that's not what i get... following the link from the helper - that's the doc i was looking for. 
11:43 <@dazo> Axeman: http://www.openvpn.net/index.php/open-source/documentation.html 
11:43 <@vpnHelper> Title: Documentation (at www.openvpn.net)
11:43 < Axeman> ahh community
11:44 < Axeman> i love the vpnhelper!
11:46 <@dazo> yeah, we don't touch the commercial stuff
11:47 < reiffert> Once in a while I'm trying #macosx on asking some stupid mac related questions. Always a good place to get good answers.
11:47 < Axeman> i'm not a maccy
11:47 < Axeman> lol
11:47 < reiffert> so you arent the guy from #macosx then?
11:48 < Axeman> no sir. 
11:48 < reiffert> hrmn :)
11:49 < Axeman> i would like to run a VM of a mac-os  - but that's far far down the future
11:49 < Axeman> openVPN is my first goal
11:55 < Dropje> i'm looking for a way to add a metric in server.conf for push "route x.x.x.x 255.255.255.0"
11:56 < Dropje> anyone knows if this is possible?
11:56 < Dropje> i tried adding "route-metric 80" but that doesnt seem to work
12:00 -!- dazo is now known as dazo_afk
12:09 -!- mirco [~mirco@p5B282E27.dip.t-dialin.net] has quit [Quit: mirco]
12:10 -!- mirco [~mirco@p5B282E27.dip.t-dialin.net] has joined #openvpn
12:13 -!- mirco [~mirco@p5B282E27.dip.t-dialin.net] has quit [Client Quit]
12:19 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
12:20 -!- Axeman [~axeman3@198.105.46.46] has quit [Read error: Connection reset by peer]
12:24 < Dropje> found it if anyone ever interested: push "route x.x.x.x 255.255.255.0 vpn_gateway n" where 'n' is metric
12:25 < reiffert> thx
12:54 <@vpnHelper> RSS Update - forum: Help configuring firewall with OpenVPN support <http://forums.openvpn.net/topic8436.html>
13:13 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has quit [Quit: leaving]
13:14 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
13:14 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has quit [Client Quit]
13:15 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
13:28 -!- luneff [~yury@84.51.213.254] has joined #openvpn
13:48 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 264 seconds]
13:49 -!- edu_ [~edu@phoenix.cativa.com.br] has quit []
13:51 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
13:55 -!- Axeman [~axeman3@198.105.46.46] has joined #openvpn
13:56 < Axeman> is there a difference between the ESXi image of OpenVPN and the versions that are on DD-WRT/Tomato ? 
13:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:14 < darkdrgn2k3> Axeman: how could there be a image of openvpn for esxi? its not an os
14:15 < ecrist> Axeman: I'm guessing you're talking about OpenVPN-AS
14:15 < Axeman> yes the AS
14:15 < Axeman> sorry
14:15 < ecrist> !as
14:15 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
14:16 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 246 seconds]
14:16 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
14:16 < Axeman> ty. i'll do that. 
14:17 < darkdrgn2k3> Axeman: as for differences the only diffs you could experiance is compiled in options, that are turned of.. like in win32 they turned of auth-pass at one point
14:18 <@raidz> Axeman: If you are talking about the OpenVPN-AS image and the OpenVPN on ddwrt/tomato,  yes they are two different types of software
14:18 <@raidz> ddwrt and tomato run OpenVPN 2.1.0-2.1.4 I think
14:18 < Axeman> i'm just getting started here - and *just* got the -AS version up today. 
14:18 < Axeman> i've toyed w. the idea of OpenVpn for years now. never grew the balls to do it. 
14:18 < darkdrgn2k3> Axeman: screw as.. install centos
14:19 < Axeman> i have a freshly minted ESXi machine and saw the -AS and just well... bit the bullet. 
14:19 <@raidz> centos, eww
14:19 < darkdrgn2k3> in finally got my ASTARO talking wiht openwrt installations :)
14:19 < Axeman> i know nothing of linux, nor of ESXi - and very little networking knowledge. so what can go wrong, right? 
14:19 < darkdrgn2k3> but i HATE dd-wrt because it NATS the vpn!
14:19 < Axeman> i like getting it on ddwrt so that if there's a power condition at the house, etc, there's nothing to "turn on"
14:20 < Axeman> except for hte wife perhaps but i digress. 
14:20 < Axeman> what do you mean darkdrgn2k3 ? 
14:20 < darkdrgn2k3> dd-wrt automaticlaly nats incomming communication through the VPN
14:20 < Axeman> ALL ? 
14:20 < darkdrgn2k3> yep, so routing gets all screwed up...
14:21 < Axeman> oh. 
14:21 < Axeman> so if i'm at work, and need to access a work-intranet site, i can't ? 
14:21 < darkdrgn2k3> its alirighrt for simpletons :-P but if you wanna route between two subnets your sol
14:21 < darkdrgn2k3> you know what nat is?
14:21 < Axeman> address translation right? 
14:21 < darkdrgn2k3> yes
14:21 < darkdrgn2k3> do you know what it does
14:21 < darkdrgn2k3> (network address translations ftw)
14:22 < Axeman> my machine that is natted, can access the internet, because nat knows that machine a is accessing content a, while machine b is access content b ?
14:22 < darkdrgn2k3> yeh so what it does is essential re-writes the return to address on all packest
14:22 < Axeman> if not - i'm here for edification. got back on IRC after i realized that the techies never left. 
14:23 < darkdrgn2k3> so if your on the LAN side of the dd-wrt... your communication gets trhoguh the vpn as the router itself...
14:23 < darkdrgn2k3> but from the other side of the tunnel you cant do much becauyse you can ONLY see the dd-wrt router
14:23 < darkdrgn2k3> so depends what needs to access what
14:24 < darkdrgn2k3> but i toyed with dd-wrt for about 2 hours,,... realized the closest thing to disabling route was to make a cronjob that deletes the rules... and i went back to openwrt
14:24 < darkdrgn2k3> sorry disabling nat
14:25 < darkdrgn2k3> (basically its not so much that NAT knows what machine is accessing what.. thast part of it, the more important part thoght is allowign the desitnation computer to know where you are... its like giving a girl at a club a fake phone number....  (or i guess more acuratly an extension)) she cant call you back!
14:26 < Axeman> okay darkdrgn2k3 i need that to be dumbed down just a bit - so are you saying if i was at an internet cafe and connect into a dd-wrt based openvpn implementation, i would only be able to access Lan, but not anything outside of that?
14:26 < darkdrgn2k3> no worst
14:26 < darkdrgn2k3> hold on roll back
14:27 < darkdrgn2k3> YOU-----------DD-wRT------INTERNET---------OPENVPN-AS-------- Your Lan
14:27 < darkdrgn2k3> is tha your setup
14:27 < darkdrgn2k3> or is it
14:27 < ecrist> doubt it
14:27 < darkdrgn2k3> YOU-----INTERNET------DD-WRT-----???
14:27 < Axeman> remove DD-wrt and yes. 
14:27 < darkdrgn2k3> ooo
14:27 < darkdrgn2k3> so you dont HAVE dd-wrt
14:27 < darkdrgn2k3> problem solved :)
14:27 < Axeman> ME ----MY ROUTER ---OPENVPN-AS
14:27 < Axeman> --MYLAN
14:28 < darkdrgn2k3> then 2 things....
14:28 < Axeman> well - i was considering dropping the -AS and going to the dd-wrt version of openvpn.
14:28 < Axeman> but don't know if there's anything that it doesn't have that the -as does have
14:28 < darkdrgn2k3> dd-wrt will work well for you for small installations
14:28 < Axeman> i've got two machines + a smartphone
14:28 < darkdrgn2k3> what do you want to do?
14:28 < ecrist> Axeman: AS is a commercial package
14:29 < ecrist> dd-wrt uses the open-source version
14:29 < Axeman> the commercial one is free for two devices, right? 
14:29 < darkdrgn2k3> im deploying 80 vpns across canada and currently using OPENWrt routers :-P
14:29 < Axeman> i got up and running up to the webui and didn't aks for anything
14:29 < Axeman> hmm i didn' tthink openwrt was as popular or had as much support. 
14:30 < darkdrgn2k3> they dont a really nice job
14:30 < darkdrgn2k3> our astaro supports 3 vpns.
14:30 < darkdrgn2k3> PPTP, IPSEC and SSL
14:30 < darkdrgn2k3> of the 3 i like SSL the best
14:30 < darkdrgn2k3> (which happesn to be OPENVPN)
14:30 < Axeman> me too
14:30 < darkdrgn2k3> it ALWAUYS works and if it doesnt you can see why
14:30 < darkdrgn2k3> unlike pptp and ipsec
14:30 < Axeman> i was just reading the admin manual and love the client install bit. right off the web
14:30 < darkdrgn2k3> on AE?
14:31 < darkdrgn2k3> pft... downaldo the install package... and run it..
14:31 < Axeman> but that you dont' need to even install, per se. 
14:31 < darkdrgn2k3> yeh
14:31 < darkdrgn2k3> just ACTIVEX in ie probably
14:31 < darkdrgn2k3> only bad thing is you gatta configure it manually
14:31 < Axeman> yea. not bad. 
14:32 < darkdrgn2k3> but once you know WHAT you want to do... its prity easy
14:32 < Axeman> yeah i prefer to install but - still love that the option is there. 
14:32 < darkdrgn2k3> most people dont undersatnd WHAT they want to do with the vpn, thats what there problem lays
14:32 < Axeman> i iknow what i want - just don't know how to get there. 
14:32 < darkdrgn2k3> ok what do you want?
14:33 < Axeman> to be able to connect to my empire at home (all machines, all services provided by said machines) while i'm away, w.o. anybody in the middle "watchin" me. 
14:33 < ecrist> Axeman: AS is nice
14:33 < darkdrgn2k3> ok easy enough
14:33 < Axeman> i have that right now
14:33 < Axeman> ghetto-ass hamachi
14:33 < Axeman> i want the middle man out. 
14:33 < darkdrgn2k3> ok
14:33 < Axeman> i want OpenVPN
14:33 < Axeman> that much I know. 
14:33 < darkdrgn2k3> install openvpn (linux, windows whatever)
14:34 < darkdrgn2k3> build your keys
14:34 < Axeman> check.
14:34 < darkdrgn2k3> isntall openvpn on another computer
14:34 < darkdrgn2k3> copy the keys
14:34 < darkdrgn2k3> config sever, config client setup routes and your donw
14:34 < darkdrgn2k3> done
14:34 < Axeman> not check (keys) haven't done that yet. that's where i figured should i do this (AS) or just get a router and do it that way. 
14:34 < Axeman> OR do both
14:34 < darkdrgn2k3> i donno as i do it from openvpn 
14:34 < Axeman> failover from VM to router. 
14:34 -!- Ghazanfar_ [4a5fb741@gateway/web/freenode/ip.74.95.183.65] has joined #openvpn
14:34 < darkdrgn2k3> ooor
14:34 < Ghazanfar_> Hi this is Ghazanfar from MTBC
14:35 < Axeman> ooor ? ?? do tell
14:35 < darkdrgn2k3> setup VPN on your windows machine and pptp in
14:35 < Axeman> lol
14:35 < darkdrgn2k3> OOOR liek i do... ssh home  and u se ssh tunnels  
14:35 < Axeman> pptp blows, right? 
14:35 < darkdrgn2k3> pptp worls alright
14:35 < Axeman> i though that's the least safe way to do this. 
14:35 < darkdrgn2k3> it easy to install (most pc have support for it nativly)
14:36 < darkdrgn2k3> well least safest would be a GRE tunnel :-P no security
14:36 < darkdrgn2k3> ok heres another question
14:36 < darkdrgn2k3> BRIDGE or ROUTE
14:36 < Axeman> that's something i need help with. 
14:36 < Ghazanfar_> We have a setup at Amazon EC2 where we deployed our MTBC Applications ad provide the access to clients 
14:36 < darkdrgn2k3> ok
14:37 < Ghazanfar_> new we want to make it more secure 
14:37 < Ghazanfar_> for that we want to use OpenVPN 
14:37 < Ghazanfar_> can you help me that how can we do it 
14:37 < Ghazanfar_> ?
14:37 < Axeman> i need to be able to access my network shares, and a couple of sites...
14:37 < darkdrgn2k3> bridge your remote computer  actually becomes PART of your network...  
14:37 < darkdrgn2k3> router your comptuer is routed into that network
14:37 < Ghazanfar_> we have Windows based Server at Amazon..
14:38 < Ghazanfar_> hello can you help me out here ?
14:39 < Axeman> hmm darkdrgn2k3 ... right now i think i'm bridged
14:39 < darkdrgn2k3> Axeman: its harder and easier to setup :)
14:39 < Axeman> meaning if i go to network places -- the other machines appear 
14:39 < darkdrgn2k3> then you want bridged
14:39 < darkdrgn2k3> cause thats broadcast pings iirc w/o a server
14:40 < Axeman> i have a WHS - and when i'm on hamachi - it sees me
14:40 < darkdrgn2k3> i alwyas type my computers in manually :) that way i dont have to wiat
14:40 < Axeman> i do to \\machinename\server
14:40 < Axeman> *share
14:40 < darkdrgn2k3> yeh ..
14:40 < Axeman> is that bridged or routed? 
14:40 < darkdrgn2k3> both 
14:40 < darkdrgn2k3> bridge allows for broadcasts
14:40 -!- lucidyguy [c04b9eb4@gateway/web/freenode/ip.192.75.158.180] has quit [Quit: Page closed]
14:40 < darkdrgn2k3> thast really about it
14:41 < Ghazanfar_> @darkdrgn2k3 can you help me ??
14:41 < darkdrgn2k3> Ghazanfar_: what do you want to do
14:41 < darkdrgn2k3> Axeman: see.. always the first question, what do you want.. 99% of the ppl get it worng
14:41 < darkdrgn2k3> Axeman: honestly best solution is to install openvpn on your gateway (like dd-wrt) because then you dont have to worry about routing/.. and go routed
14:41 < Axeman> i'm still going to get it wrong between bridge and routed; i saw that on the getting started doc (printed out, so couldn't follow link)
14:42 < Ghazanfar_> actaully we want to setup the OpenVPN at our Amazon EC2 Server to allow access to our cleints more secure 
14:42 < Ghazanfar_> so how can we make it possible ? :S
14:42 < darkdrgn2k3> Ghazanfar_: so you want to install a openvpn server and deploy clients to all your pps?
14:42 < darkdrgn2k3> Axeman: ooor instlal openvpn in brdiged mode on a desktop.. and run it as a service
14:43 < darkdrgn2k3> Axeman: i wouldnt dedicate an esxi box for vpn.. overkill
14:43 < Axeman> lol it's not dedicated to esxi. 
14:43 < Axeman> there's a WHS VM in there as well as UnRaid, Ubuntu and a windows 7 
14:43 < Ghazanfar_> yes actually we want to allow MS SQL and Share Documents Prots for our some clients but in a secure way for that we want to use open VPN 
14:43 < Ghazanfar_> so is it possible in OpenVPN ?
14:44 < darkdrgn2k3> Ghazanfar_: yes, 
14:44 < Ghazanfar_> how can we do it ?
14:44 < darkdrgn2k3> Ghazanfar_, : install openvpn on the server, configure it as such, then install openvpn on all the clients, and configure them as such
14:44 < Ghazanfar_> great....
14:45 < Ghazanfar_> what we need to allow only two ports for our clients by open VPN ?
14:45 < darkdrgn2k3> you need to firewall that off on the machine then
14:45 < darkdrgn2k3> thast NOT a vpn issues at all
14:46 < Ghazanfar_> actaully when we create a VPN connection between our servers  and cleint systems, it allows all the traffice 
14:47 < Ghazanfar_> but we dont want to allow all the traffic 
14:47 < darkdrgn2k3> again. firewlal
14:47 < darkdrgn2k3> vpn wont help you there...  you need a firewall
14:47 < Ghazanfar_> you are talking about windows Firewall ?
14:47 < Axeman> isn't there an amazon based service for openvpn ? 
14:47 < darkdrgn2k3> windows or other
14:47 < Axeman> why not use that? 
14:47 -!- baccenfu1ter is now known as baccenfutter
14:47 < darkdrgn2k3> *shrug* donno amazon's vpn service sorry
14:48 < Axeman> http://www.openvpn.net/index.php/access-server/cloudmachines.html
14:48 <@vpnHelper> Title: Access Server Cloud Machines (at www.openvpn.net)
14:49 < Ghazanfar_> hey Axeman the link is great 
14:49 < Ghazanfar_> we are using Amazon EC2 instances already 
14:51 < Ghazanfar_> how can use it there ? :S
14:52 < darkdrgn2k3> Axeman: so i still say for now install openvpn on your pc and see what happens
14:53 < Axeman> i thought the pre-deployed AS is the easiest way to go. well you know what? i will install it on my PC either way i need to for the "client" piece. 
14:53 < Axeman> i'll try the default routed mode first.
14:53 < darkdrgn2k3> do you know how to create keys on windows?
14:53 < Axeman> if that doesn't work for say RDP or streaming videos or what not (don't know what i need for broadcasts for, except say WOL)... 
14:53 < Axeman> easy-rsa ? 
14:53 < EugeneKay> XCA is a nice bit of software for managing a SSL PKI.
14:53 < darkdrgn2k3> yeh
14:54 < darkdrgn2k3> do you know how?
14:54 < Axeman> i think the guide had it somewhere. 
14:54 < Axeman> how2geek also did a write up.
14:54 < darkdrgn2k3> if you want i did a dirty write up a while back to
14:54 < ecrist> !ssl-admin
14:54 < EugeneKay> *two
14:54 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
14:54 < Axeman> i'm trying to determine if my laptop (travels ALOT) should be the CA or if i should use my VM that'll never be used by anyone but me to be the CA
14:55 < EugeneKay> You seem to have misunderstood what CA means.
14:55 < darkdrgn2k3> *srhgu* ca shouldnt move  but
14:55 < EugeneKay> Both of you.
14:55 < darkdrgn2k3> remember ca has to be on the server side of things too
14:55 -!- s7r [~s7r@unaffiliated/s7r] has quit [Quit: quit]
14:55 < darkdrgn2k3> EugeneKay, : i am aware what CA is and means
14:55 < Axeman> it's the authority that generates the keys, right? 
14:55 < darkdrgn2k3> no
14:55 < darkdrgn2k3> its the authority that AUTHENTICATES your keys
14:55 < Axeman> so you want it to be a secure, machine that can't be compromised?
14:55 < EugeneKay> Your PKI creation should be done on a trusted box.
14:55 < Axeman> i thought the guide said it can be a machine that's not even online. 
14:56 < darkdrgn2k3> Axeman: secret keys should be secret... 
14:56 < EugeneKay> The CA is simply a key/cert combo that designates clientk ey/certs as being trusted.
14:56 < Axeman> sorry if sounnd like a dumbass but this is very new to me. and my mind is a blank slate for you people to graffiti as you see fit.
14:56 < darkdrgn2k3> naa you got a good grasp of things.. just needs to fit all together
14:56 < Axeman> right eugene - so once the keys are created, the CA doesn't need to exist again until a new key pair is needed?
14:57 < EugeneKay> Axeman - CA is the "root"  key that signs your client & server keys. 
14:57 < EugeneKay> The CA key is only needed when signing new key pairs. The CA cert is needed all the time to check client & server keys against.
14:57 < EugeneKay> Keep your CA Key safe someplace.
14:57 < darkdrgn2k3> Axeman: rule of thumb, only copy the files you NEED to the openvpn server..
14:57 < Axeman> ookay - so that's kinda what i thought... 
14:58 < darkdrgn2k3> Axeman: otherwise encrupt the restup in a safe place
14:58 < darkdrgn2k3> *encrypt
14:58 < EugeneKay> (like, on a VM that lives on a thumb drive in a safety deposit box)
14:58 < Axeman> ding
14:58 < darkdrgn2k3> encased in cement..
14:58 < Axeman> that's what i was saying EugeneKay - once i create the pair, i can power off the VPN. 
14:58 < darkdrgn2k3> you can power off the vpn?
14:58 < Axeman> shush - ppl tell me i have a tinfoil hat - pls dont make it a cast iron one. 
14:58 < EugeneKay> No..... OpenVPN must stay up :-p
14:58 < Axeman> no no 
14:58 < Axeman> lol the VM
14:58 < Axeman> the VM
14:59 < EugeneKay> If you want a simple way to manage your PKI, look at XCA. It makes all this openssl crap into a GUI.
14:59 < darkdrgn2k3> Axeman: Juist buidl a trucrupt drive.. and put all the keys here :)
14:59 < EugeneKay> Everything gets saved into a .xdb file that you can encrypt and keep somewhere, no VM required.
15:00 < darkdrgn2k3> EugeneKay: i still say eveyr one should use easy-rsa at last once in their lives to learn wtf they are doign
15:00 < EugeneKay> I personally store my .xdb inside of a TrueCrypt volume which is mirrored between several locations.
15:00 < darkdrgn2k3> not a bad ida..
15:00 < Axeman> so what's the "bad" if you lose the keyset?
15:00 < Axeman> you just have to create new pairs right? 
15:00 < darkdrgn2k3> 2 things
15:00 < EugeneKay> You have to change your keys.
15:00 < darkdrgn2k3> 1) you have to beuild ne pairs
15:00 < Axeman> i'm only talking about having 3 clients max
15:00 < darkdrgn2k3> 2) your existing pairs can be compromized
15:00 < darkdrgn2k3> untill you build new pairs
15:00 < Axeman> not have to deploy out to 80 like darkdrgn2k3 
15:00 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
15:01 < EugeneKay> The idea behind keeping your keys safe is to keep somebody else from getting them and sniffing your VPN(or SSL websites, or such)
15:01 < orudie> how can I go about creating a new OpnVPN client key in Debian? I haven't done this in a while, can someone please refresh my memory ?
15:01 < darkdrgn2k3> orudie: easy-rsa or XCA
15:01 < EugeneKay> orudie - however oyu created them the first time. Probably in easy-rsa
15:02 < EugeneKay> Look around for the folder named as such
15:02 < orudie> darkdrgn2k3, easy-rsa yup 
15:02 < Axeman> EugeneKay, but say i lose my laptop (god forbid!!) i can revoke it's cert - and disable the user name right? 
15:02 < EugeneKay> Axeman - if you have CRL checking enabled, yes.
15:02 < Axeman> do you guys do that? 
15:02 < darkdrgn2k3> Axeman: you can re-create the ca and your golden
15:02 < EugeneKay> The CA maintains a Certificate Revocation List, you simply mark your laptop's Client Key as revoked, gen up a fresh .crl, and openvpn will no longer accept that client key
15:02 < Axeman> first thing i would do if the lappy goes missing is kill openvpn until i can do that. 
15:03 < darkdrgn2k3> Axeman: i woudlnt... id find the ip add of the a...hole that stole it!
15:03 < EugeneKay> If my lappy goes missing, well, good fucking luck getting it booted. 
15:03 < EugeneKay> I'm one of those paranoids with full-disk TrueCrypt
15:03 < darkdrgn2k3> thast not paranio..
15:03 < darkdrgn2k3> We used hardware encrypted drives...
15:03 < Axeman> if someone "finds" the key - they still need a login to get to openvpn, but would they be able to sniff traffic otherwise? *this part is really foggy to me
15:03 < darkdrgn2k3> we tell our empoyees to  BACKUP THEIR FILES cuase if something happnes to oit.
15:04 < EugeneKay> I'm considering setting it up such that no-password gets you a vanilla WIndows environment to discourage people from wiping it before I have a chance of recovery
15:04 < darkdrgn2k3> Axeman: you need the secret keys to decrypt traffic iirc
15:04 < Axeman> how much of a penalty is that on your machine EugeneKay ?
15:04 < EugeneKay> (and a notice that says $100 if you return it)
15:04 < Axeman> i have CompuTrace on this one. 
15:04 < EugeneKay> TrueCrypt? It seems to about a minute to boot time. CPU usage has gone up a bit
15:04 < EugeneKay> Since enabling it I've gone from 8 hours of battery to 6
15:04 < orudie> so all I do is "build-key clientname" ?
15:04 < Axeman> but still don't want anyone messing with data though
15:05 < EugeneKay> Not bad for a 3-year old laptop that I got for free
15:05 < darkdrgn2k3> you need to run vars rfirst
15:05 < darkdrgn2k3> orudie: ./vars the buildkey
15:05 < darkdrgn2k3> Axeman: if you loose a client cert you  jsut blow it out of the server and your golden
15:05 < darkdrgn2k3> Axeman: if you loose the CA you need to re-build the ca
15:06 < darkdrgn2k3> Axeman: you can ALSO require a login/password to connect to openvpn too
15:06 < darkdrgn2k3> on top of certs
15:06 < darkdrgn2k3> personlay i keep my openvpns as services most of the time :) and firewall the other side
15:07 < Axeman> yes that's a definite for me. 
15:07 < EugeneKay> The "securest" way to do it is to require a smartcard for your client key, a shared secret file on the computer, and a user/password that you have to enter in the GUI.
15:07 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
15:07 < Axeman> i want the user/password + key; not sure about using a smartcard
15:07 < EugeneKay> Oh, and make the password a time-key auth thingy that you need to have.
15:07 < Axeman> don't have one, don't want to get one
15:07 < EugeneKay> But that is bloody overkill
15:07 < EugeneKay> ;-)
15:07 < Axeman> it is
15:07 < darkdrgn2k3> EugeneKay: RSA anyone ?
15:07 < Axeman> for home
15:07 < darkdrgn2k3> EugeneKay: or hell, use the WOW authenticator!!! hahaha
15:07 < Axeman> didn't that get hacked about 3 weeks ago ? 
15:08 < darkdrgn2k3> probably..
15:08 < EugeneKay> darkdrgn2k3 - so long as you have enough different bands of authentication, it should be fine if one is compromised
15:08 < EugeneKay> You still need 2 or 3 more peices of the puzzle to get anywhere
15:08 < darkdrgn2k3> EugeneKay: true..
15:08 < darkdrgn2k3> EugeneKay: my laptop will require DNA authentication too :)
15:08 < EugeneKay> The least-secure piece of my chain is my phone's SSH key, and you still need to enter a password to get anywhere.
15:09 < EugeneKay> I cna revoke that key in about 30 seconds, if I'm at one of my other terminals.
15:09 < darkdrgn2k3> lol
15:09 < darkdrgn2k3> nice
15:09 < darkdrgn2k3> what kinda phone u got
15:09 < darkdrgn2k3> driod?
15:09 < EugeneKay> G2
15:09 < darkdrgn2k3> u use any encryption for the fs of it
15:09 < EugeneKay> Nope. 
15:09 < darkdrgn2k3> i been looking foudn nothign worhtlie so far.
15:10 < EugeneKay> That's because there isn't anything
15:10 < darkdrgn2k3> yeh
15:10 < EugeneKay> BEst you can do is sign up for a Premium Google Apps Domain and use remote wipe
15:10 < darkdrgn2k3> you'd think nix would have it
15:10 < darkdrgn2k3> actualy i got exchagne for remote wipes :)
15:10 < EugeneKay> That works too
15:10 < darkdrgn2k3> there was a cool app at oin point that did that too
15:10 < EugeneKay> I refuse to setup Exchange, even ifI have the damn license.
15:10 < darkdrgn2k3> kernel module for the phone
15:10 < darkdrgn2k3> yeh i have little choice
15:11 < darkdrgn2k3> that and exchagne doesnt work with droid 2.2 stock had to get a 3rds party app
15:11 < EugeneKay> I'm my boss. :-p
15:11 < darkdrgn2k3> i used to be
15:12 < darkdrgn2k3> remindes me.. i need to add keys to my phone since the wipe
15:13 < orudie> I got it. Had to do the following: su root, ./vars, source ./vars, ./build-key clientname
15:14 < darkdrgn2k3> hey any one know if they fixed openvpn as a client with windwios 7 pppoe
15:15 <@vpnHelper> RSS Update - forum: Windows File Shares Unreachable via OpenVPN <http://forums.openvpn.net/topic7963.html#p13617>
15:16 < darkdrgn2k3> hey is it possible to import easy-rsa into xca
15:16 < EugeneKay> Yup.
15:16 < darkdrgn2k3> one by one
15:17 < EugeneKay> Just import your keys + certs, marking the CA as trusted.
15:17 < darkdrgn2k3> what are pems
15:17 < EugeneKay> It's you, learning about openssl :-p
15:17 < darkdrgn2k3> yeh ui know
15:17 < darkdrgn2k3> i only 1/2 know my stuff
15:19 < darkdrgn2k3> cool
15:19 < darkdrgn2k3> easier then rsa
15:19 < EugeneKay> Yup. Point + click.
15:20 < darkdrgn2k3> now how do i upload only the needed files to openvpn :-P
15:20 < EugeneKay> Export the key+certs as needed
15:20 <@vpnHelper> RSS Update - forum: Radius plugin: authentication failure on reconnect <http://forums.openvpn.net/topic8419.html#p13618>
15:21 < EugeneKay> I believe OpenVPN will also work with a PKCS12 pack
15:21 -!- dvl [~dan@pdpc/supporter/active/dvl] has left #openvpn ["Leaving"]
15:22 < darkdrgn2k3> so client gets ca.crt client.crt and client.key
15:23 < darkdrgn2k3> what does server get
15:23 < darkdrgn2k3> ca.crt dh.pem server.crt server.key
15:23 < darkdrgn2k3> anythign else/
15:23 < EugeneKay> crl, if it exists.
15:23 < darkdrgn2k3> so th eserver does not need client.??? 
15:24 < EugeneKay> Nope. It's signed by the CA.
15:24 < darkdrgn2k3> oh wow..
15:24 < darkdrgn2k3> i always thoguth it was needed.. LOL
15:24 < darkdrgn2k3> learn somethign new every day
15:24 < EugeneKay> You really ought to use a separate CA cert for your clients & server
15:24 < EugeneKay> the Server will check against the client's CA, and vice-versa
15:25 < darkdrgn2k3> interesting..
15:25 < darkdrgn2k3> but what are *.pem files (asside from dh) for
15:26 < EugeneKay> PEM is a format. It can be a key, a cert, DH, or fried eggs. I use .crt, .key, .crl, .dh, p12, etc because the file extension tells me what's inside.
15:26 < darkdrgn2k3> ok but i have liek 17 files each ending in pem
15:27 < darkdrgn2k3> im assuming they are related to the certs
15:27 < EugeneKay> If you're importing to XCA, it will figure it out
15:29 < darkdrgn2k3> what algorithm do you use for sig
15:29 < EugeneKay> sha512
15:29 < EugeneKay> "It's the biggest number, so it must be the best" logic
15:31 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:31 < darkdrgn2k3> where isd the DH stored in xca
15:32 < Ghazanfar_> Hi, one question 
15:33 < Ghazanfar_> where can I donwload a OpenVPN Server Software for windows ?
15:33 < darkdrgn2k3> Ghazanfar_: its the same as the client
15:33 <@raidz> Ghazanfar_: http://openvpn.net/index.php/open-source/downloads.html
15:33 <@vpnHelper> Title: Downloads (at openvpn.net)
15:33 < darkdrgn2k3> <darkdrgn2k3> what are pems
15:33 < darkdrgn2k3> http://www.openvpn.net/index.php/open-source/downloads.html
15:33 < darkdrgn2k3> doh
15:33 <@vpnHelper> Title: Downloads (at www.openvpn.net)
15:34 < Ghazanfar_> ok thanks let me try it for testing :)
15:38 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 258 seconds]
15:39 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
15:55 <@vpnHelper> RSS Update - forum: Help configuring firewall with OpenVPN support <http://forums.openvpn.net/topic8436.html#p13619>
15:55 -!- Dropje [~yge@5ED095E6.cm-7-1c.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
15:55 -!- Dropje [~yge@5ED095E6.cm-7-1c.dynamic.ziggo.nl] has joined #openvpn
16:00 -!- Axeman [~axeman3@198.105.46.46] has quit [Read error: Operation timed out]
16:04 -!- Dropje [~yge@5ED095E6.cm-7-1c.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
16:09 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Quit: бэм бэм бэм бэм бэм бэм бэм бля !]
16:20 < Ghazanfar_> Hi I am back after watching tutorial about OpenVPN on your you tube 
16:20 < Ghazanfar_> I have a few more questions to get  their anwers
16:20 < Ghazanfar_> I understand the whole concept of OpenVPN...
16:21 < Ghazanfar_>  but required some more help :)
16:21 < darkdrgn2k3> if you dont ask no one will answer..
16:22 < Ghazanfar_> Is there any option that we can allow specific ports to clinets in OpenVPN Admin UI
16:22 < Ghazanfar_> ?
16:22 < darkdrgn2k3> Ghazanfar_: i dont knwo about AS but YOU NEED TO USE A FIREWALL TO BLOCK CONNETIONS
16:22 < darkdrgn2k3> openvpn does NOT do that (nativly)
16:22 < Ghazanfar_> ok thanks :)
16:23 < darkdrgn2k3> openvpn itself does NOT provide any filtering mechanism
16:23 < darkdrgn2k3> you cna have openvpn execute commands upon successfull connection to process firewall commands
16:23 < darkdrgn2k3> (such as windows firewalls or iptables (linux)) but again thats an outside app
16:28 -!- Dropje [~yge@5ED095E6.cm-7-1c.dynamic.ziggo.nl] has joined #openvpn
16:28 < darkdrgn2k3> windows firewall can be used to profore these tasks efficiently
16:49 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
16:50 -!- smoak1 [~smoak@64.134.128.86] has joined #openvpn
16:53 < smoak1> !welcome
16:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:53 < smoak1> !goal
16:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:54 < smoak1> !redirect
16:54 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
16:54 < smoak1> !ipforward
16:54 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:54 < smoak1> !linipforward
16:54 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:56 -!- brah [be88d16c@gateway/web/freenode/ip.190.136.209.108] has quit [Ping timeout: 252 seconds]
16:58 < smoak1> !nat
16:58 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
16:58 < smoak1> !linnat
16:58 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
17:12 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:14 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
17:15 -!- smoak1 [~smoak@64.134.128.86] has left #openvpn ["WeeChat 0.3.5"]
17:37 < Ghazanfar_> Hi I have created an Amazon instance of your OpenVPN AMI
17:37 < Ghazanfar_> now I am try to connect with your linux Instance by using putty 
17:38 < Ghazanfar_> so I can create some users to test OpenVPN Client
17:38 < Ghazanfar_> but it is not allowing to connect with Server due to Privite key 
17:39 < Ghazanfar_> please tell me which key I use and by which user name I can connect ?
17:39 < Ghazanfar_> Hey Any one there ??
17:44 < Axeman> Ghazanfar_, you just asked the same thing in both channels?
17:44 < Axeman> copy paste mmuch ?
17:45 < Ghazanfar_> yes I actually I am not getting the answer from this channel :(
17:45 < Ghazanfar_> Axeman Can please help me :)
17:46 < Axeman> i don't know anything ghazanfar
17:46 < Axeman> i can't even get to my own client install from within my own lan. 
17:46 < Ghazanfar_> oh your not from OpenVPN ?
17:47 < Axeman> i'm a just a guy - asking for help - just like you
17:48 < Ghazanfar_> hehhehe great 
18:12 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
18:17 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has joined #openvpn
18:18 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has left #openvpn []
18:30 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:32 -!- smoak [~smoak@c-71-227-249-63.hsd1.wa.comcast.net] has joined #openvpn
18:32 < smoak> !nat
18:32 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
18:32 < smoak> !linipforward
18:32 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
18:45 -!- Ghazanfar_ [4a5fb741@gateway/web/freenode/ip.74.95.183.65] has quit [Ping timeout: 252 seconds]
18:49 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 258 seconds]
19:02 < smoak>  do you need to use NAT or ip forwarding if the server is in bridging mode?
19:03 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
19:05 -!- cron2_ [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 240 seconds]
19:05 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
19:08 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:13 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 258 seconds]
19:17 -!- smoak [~smoak@c-71-227-249-63.hsd1.wa.comcast.net] has quit [Quit: WeeChat 0.3.4]
19:19 < EugeneKay> "Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
19:21 < reiffert> I hate cats.
19:22 < EugeneKay> Then feel free to Bridge.
19:26 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 252 seconds]
19:27 < reiffert> been there, done that.
19:37 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 276 seconds]
19:46 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:46 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has joined #openvpn
19:50 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
19:58 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Read error: Operation timed out]
19:58 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
19:59 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
20:04 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:06 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
20:13 -!- queequeg1 [~chatzilla@c-71-202-152-148.hsd1.ca.comcast.net] has left #openvpn []
20:16 -!- master_of_master [~master_of@p57B52DB3.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
20:17 -!- master_of_master [~master_of@p57B52C1B.dip.t-dialin.net] has joined #openvpn
20:28 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:39 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 264 seconds]
20:49 < Axeman> EugeneKay, are you around?
20:58 < EugeneKay> No.
20:59 < Axeman> lol ok
21:00 < EugeneKay> (if you don't ask, I'll never answer)
21:01 < Axeman> okay - trying to figure out that XCA tip you gave me
21:01 < Axeman> no clue what to do with it
21:03 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
21:03 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:08 -!- Carbon_Monoxide [~cmonxide@124244205016.ctinets.com] has joined #openvpn
21:10 < EugeneKay> Magic :-p
21:11 < Axeman> is that needed when running in -AS? 
21:11 < Axeman> i noticed the client install didn't have easy rsa 
21:12 < EugeneKay> I dunno anything at all about AS
21:13 < Axeman> ohwell back to rtfm then
21:13 < Axeman> i see that's something in the doc/fag
21:13 < Axeman> *gaq!
21:13 < Axeman> *faq!
21:14 < EugeneKay> gag?
21:14 < Axeman> typo x2
21:15 < Axeman> "Give the contents of the "new.csr" file to your CA "
21:16 < Axeman> hmm so sounds lik ei have some work to do 
21:16 < EugeneKay> Well, if you're building your own CA(like in XCA), you sign the cert request yourself :-p
21:17 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:19 < Axeman> okay - so that's a Certificate Signing Request.... i take that .csr file (if i can figure out how to transfer the file in putty). .. and feed that into xca
21:20 < Axeman> that'll spit out a client/server key that i give back to openvpn
21:20 < EugeneKay> XCA can be used for managing your whole PKI - all key generation and cert-signing can be done within the app, exporting only the bits that you need when you need them
21:21 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
21:24 < Axeman> and i like that
21:24 < Axeman> the "when you need them"
21:25 < Axeman> after doing all that, i can power off the machine - never having to use it until i add a new client, or someting like that. 
21:32 < Axeman> gonna go sleep on it EugeneKay - will pick ur brain mor tomorow
21:33 < EugeneKay> Sleep is for the weak and materialistic
21:37 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 258 seconds]
21:45 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:45 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has quit [Quit: Ping timeout: 180 seconds by FBI]
23:45 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
23:56 -!- EugeneKay is now known as EugeneKaway
--- Day changed Tue Jul 12 2011
00:40 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
00:54 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
--- Log closed Tue Jul 12 01:15:52 2011
--- Log opened Tue Jul 12 01:15:59 2011
01:15 -!- ecrist [~ecrist@openvpn/community/support/ecrist] has joined #openvpn
01:16 -!- Irssi: #openvpn: Total of 148 nicks [4 ops, 0 halfops, 0 voices, 144 normal]
01:16 -!- Irssi: Join to #openvpn was synced in 44 secs
01:20 -!- dazo_afk is now known as dazo
01:33 <@vpnHelper> RSS Update - forum: Can't access/ping Windows 7 x64 client's LAN. <http://forums.openvpn.net/topic8437.html>
01:34 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
01:35 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:37 -!- luneff [~yury@84.51.213.254] has quit [Quit: Leaving]
01:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
01:51 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:53 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
01:53 -!- mirco_ is now known as mirco
01:58 -!- darkdrgn2k3 [~darkdrgn2@199.243.221.14] has quit [Read error: Connection reset by peer]
02:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:04 -!- darkdrgn2k [~darkdrgn2@199.243.221.14] has joined #openvpn
02:16 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Ping timeout: 276 seconds]
02:21 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 276 seconds]
02:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:23 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
02:24 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
02:25 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
02:31 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
02:40 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 258 seconds]
02:55 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
03:16 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has joined #openvpn
03:21 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
03:23 -!- Patrick [~Death@eagleits.net] has joined #openvpn
03:24 -!- Patrick is now known as Guest77937
03:25 -!- sno__ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
03:29 -!- Netsplit *.net <-> *.split quits: blackpenguin, ele, dvl, sno_, Deathvalley122
03:33 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Ping timeout: 260 seconds]
03:36 -!- Netsplit over, joins: blackpenguin
03:37 -!- ugly_duck [~ugly@122-60-54-108.jetstream.xtra.co.nz] has joined #openvpn
03:41 < ugly_duck> can someone please help me understand the process, i setup a openvpn in server mode on server, then set my computer in to client mode, do i need to use a client or does it all go through openvpn.conf?
03:43 < diemos> !setup
03:43 < diemos> :(
03:43 < diemos> I don't know cool commands :(
03:47 < ugly_duck> !setup
03:50 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
03:53 < hyper_ch> !howto
03:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:58 < ugly_duck> hyper_ch: cheers, i've read that and done that... following the example how to, its seem to be up, but is that a tunnel between two connections, or it is something ihave to use a client to connect with?
03:58 < hyper_ch> !configs
03:58 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
03:58 < hyper_ch> and do you use windows?
03:58 < hyper_ch> I don't know anything about windows except that it causes headache :)
03:58 < ugly_duck> Eww... on linux
03:59 < hyper_ch> "do i need to use a client or does it all go through openvpn.conf?"
03:59 < ugly_duck> never done the whole vpn connection before
03:59 < hyper_ch> looks like windows
03:59 < ugly_duck> i created a client file, /etc/openvpc/openvpn.conf
04:00 < hyper_ch> you don't :)
04:00 < hyper_ch> name it client.conf
04:00 < hyper_ch> !log
04:00 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
04:00 < hyper_ch> !loggin
04:00 < hyper_ch> !logging
04:00 < hyper_ch> !configs
04:00 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
04:02 < ugly_duck> but the client.conf goes on my desktop correct, the server.conf goes on my server
04:02 < hyper_ch> I do have both in /etc/openvpn
04:02 < ugly_duck> on your server?
04:02 < hyper_ch> I don't use network manager to manage vpn connections
04:02 < hyper_ch> server.conf on server in /etc/openvpn
04:02 < hyper_ch> client.conf on client in /etc/openvpn/
04:03 < ugly_duck> ok..
04:09 <@vpnHelper> RSS Update - forum: Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13621>
04:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:15 < ugly_duck> hyper_ch: how do you connect to your vpn? 
04:15 <@vpnHelper> RSS Update - forum: Can't access/ping Windows 7 x64 client's LAN. <http://forums.openvpn.net/topic8437.html#p13622>
04:16 -!- sppadic [~IceChat77@193.130.68.17] has joined #openvpn
04:20 < ugly_duck> i tried using connection manager, but it when i goto vpn connections, keeps asking me to configure one
04:20 < ugly_duck> weird
04:23 < hyper_ch> I don't use connection manager
04:23 < hyper_ch> vpn gets autostarted at bootup
04:24 < ugly_duck> ok, so with the client configured according to those examples, as soon as i /etc/init.d/openvpn start/restart its on auto connect
04:25 < hyper_ch> ugly_duck: I don't know what your configs look like and what you did
04:26 < ugly_duck> hyper_ch: i was just going by the examples on that website
04:26 < hyper_ch> !configs
04:26 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
04:26 < hyper_ch> enable logging
04:26 < hyper_ch> check what's not working and why
04:29 < ugly_duck> well, i know the server is Listening for incoming TCP connection on [undef]:1194
04:29 < ugly_duck> hell, i'm meant to go home
04:40 -!- ugly_duck [~ugly@122-60-54-108.jetstream.xtra.co.nz] has quit [Read error: Operation timed out]
04:40 -!- tktiddle [~tim@cpc1-hari12-2-0-cust76.hari.cable.virginmedia.com] has joined #openvpn
04:42 < tktiddle> I dont need a vpn router to use open vpn then? I can setup a server as a vpn entry point?
04:42 -!- cherwin [~cherwin@84-53-64-50.adsl.unet.nl] has quit [Quit: leaving]
04:46 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:46 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:47 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:47 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:03 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
05:04 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
05:15 -!- luneff [~yury@93.178.112.44] has joined #openvpn
05:22 -!- K1ng` [~KING@180.211.188.24] has joined #openvpn
05:25 -!- K1ng [~KING@180.211.188.24] has quit [Ping timeout: 276 seconds]
05:29 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
05:30 -!- EugeneKaway is now known as EugeneKay
05:34 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 255 seconds]
05:45 <@vpnHelper> RSS Update - forum: OpenVPN config on VU+ Duo Enigma2 receiver <http://forums.openvpn.net/topic8438.html>
05:46 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
05:46 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
05:47 < EugeneKay> tktiddle - you can do anything you feel like
05:48 < reiffert> ?
05:49 < reiffert> meaning: yes, you can
05:51 < EugeneKay> Anything is possible at zombocom
05:54 -!- dazo is now known as dazo_afk
06:00 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
06:03 -!- ugly_duck [~ugly@203.160.120.105] has joined #openvpn
06:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
06:09 -!- sppadic is now known as nuttersppadic
06:11 -!- nuttersppadic is now known as sppadic[A]
06:11  * sppadic[A] is now away - Reason : nuttersppadic 
06:12 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
06:14 -!- pa_ [~pa@host1-68-dynamic.6-87-r.retail.telecomitalia.it] has joined #openvpn
06:14 -!- pa_ [~pa@host1-68-dynamic.6-87-r.retail.telecomitalia.it] has quit [Client Quit]
06:28 -!- dazo_afk is now known as dazo
06:31 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
06:51 -!- Carbon_Monoxide [~cmonxide@124244205016.ctinets.com] has quit [Quit: Leaving]
06:53 -!- tktiddle [~tim@cpc1-hari12-2-0-cust76.hari.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
07:00 -!- louiscyfer [~louisponc@62.192.24.130] has joined #openvpn
07:08 < louiscyfer> Hi everybody I try under openbsd to set an openvpn server that redirect all my traffic trough the VPN, i have set the openvpn server.conf file and the pf NAT statement to NAT my traffic from ppp0 to my public interface
07:09 -!- sppadic[A] is now known as nuttersppadic
07:09  * nuttersppadic is no longer away : Gone for 58 minutes 36 seconds
07:10 < amero> louiscyfer: then?
07:11 < defswork> louiscyfer, when you say 'all my traffic' what traffic do you mean ? all lan traffic ?
07:27 -!- louiscyfer [~louisponc@62.192.24.130] has quit [Quit: louiscyfer]
07:28 -!- louiscyfer [~louisponc@62.192.24.130] has joined #openvpn
07:37 < louiscyfer> all my traffic 
07:37 < louiscyfer> i want to change my ip
07:37 <@vpnHelper> RSS Update - forum: Can't access/ping Windows 7 x64 client's LAN. <http://forums.openvpn.net/topic8437.html#p13624>
07:37 < louiscyfer> when i connect on the this VPN
07:43 < EugeneKay> "The enter key is not a punctuation mark."
07:45 < kisom> louiscyfer: I suggest you read the tutorials on the openvpn site. you probably wont get any help here.
07:47 < louiscyfer> I did it already
07:47 < louiscyfer> does not matter
07:52 -!- JWM-Nexstara [~Joseph.Ma@static-209-195-165-146.consolidated.net] has joined #openvpn
07:53 < JWM-Nexstara> Good morning!
07:53 < JWM-Nexstara> \!welcome
07:53 < JWM-Nexstara> Er...
07:53 < JWM-Nexstara> !welcome
07:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:53 < JWM-Nexstara> !goal
07:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:55 < JWM-Nexstara> I've got a Win2008R2 server that I installed the 1.8.0 OpenVPN client onto.  It connects just fine with the Auto-login option enabled.  I've done this on a few servers.  Unlike my other servers, when I log off of this one, it drops the VPN connection.  Is there a way that I can tell it to stay running when I sign off?
07:56 < EugeneKay> You want to install it as a system service
07:57 -!- Axeman [~axeman3@198.105.46.46] has joined #openvpn
07:57 < JWM-Nexstara> Check.  System Service, Start Automatically, Currently 'running
07:57 < hyper_ch> why using 1.8? why not a newer openvpn?
07:58 < JWM-Nexstara> 1.8.0 is what the server automatically sends out.
07:58 < JWM-Nexstara> Should I be over in #OpenVPN-as?
07:59 < hyper_ch> do you use AS?
08:00 < JWM-Nexstara> Yup.
08:00 < hyper_ch> JWM-Nexstara: read the topic title?
08:00 < hyper_ch> s/topic title/channel topic/
08:01 < Axeman> ooh - how do you get a host cloak ?
08:01 < JWM-Nexstara> I did, but I came here since this was on the client.  I'll go over there.
08:01 < JWM-Nexstara> Thank you for your assistance.
08:01 -!- JWM-Nexstara [~Joseph.Ma@static-209-195-165-146.consolidated.net] has left #openvpn []
08:21 < ecrist> Axeman: I can get you one
08:22 < Axeman> wow - i'd really appreciate that ecrist. i personally didn't like freenode because of that. 
08:23 < ecrist> it will be openvpn/user/axeman
08:23 < Axeman> oh that would be great. 
08:24 < ecrist> gimme a few, I'll work on it
08:24 < Axeman> ty ty!
08:24  * Axeman forever a thousand tys!
08:37 -!- ugly_duck [~ugly@203.160.120.105] has quit [Ping timeout: 276 seconds]
08:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:42 -!- dazo is now known as dazo_afk
08:46 -!- ugly_duck [~ugly@203.160.120.105] has joined #openvpn
08:47 -!- ugly_duck [~ugly@203.160.120.105] has quit [Max SendQ exceeded]
08:51 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Ping timeout: 260 seconds]
08:52 -!- dazo_afk is now known as dazo
09:02 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
09:08 -!- luneff [~yury@93.178.112.44] has quit [Quit: This computer has gone to sleep]
09:13 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
09:17 -!- louiscyfer [~louisponc@62.192.24.130] has quit [Quit: louiscyfer]
09:25 < Dougy> host cloaks are cool
09:25 < Dougy> right Axeman 
09:25 -!- Dougy [me@tech.qsi.net] has quit [Changing host]
09:25 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
09:25 < Axeman> what do you mean Dougy ?
09:26 < Axeman> you like it? 
09:26 < Axeman> who doesnt
09:26 < Dougy>  openvpn/community/user/dougy 
09:26 < Dougy> that's what i have
09:26 < Axeman> lo
09:26 < Dougy> but i would have liked /admin/ or /staff/
09:26 < Dougy> since i was the forum founder :P
09:26 < Axeman> lol
09:26 < Axeman> you are? 
09:39 <@dazo> yes, he is
09:39 <@dazo> Dougy: to get /staff/ or /admin/, you probably need to manage to get hired by OpenVPN Tech ;-)
09:39 < Axeman> oh that's cool so staff him up :-)
09:40 < Axeman> so how many ppl are behind openvpn ? 
09:41 <@dazo> Axeman: difficult to say, but James Yonan is the only developer (which I'm aware of) who is paid for it ... and then there's probably some 30-40 different community contributors over the years
09:41 < Axeman> impressive. 
09:41 <@dazo> of course, there are more paid people behind the OpenVPN AS product ... but, that's about it
09:41 <@dazo> for the community
09:42 < Axeman> impressive piece of work. i'm still getting to know the ropes around here - but am liking what i see. 
09:47 -!- luneff [~yury@84.51.213.254] has joined #openvpn
10:07 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
10:27 < ecrist> Dougy: even *I* don't have /admin/ or /staff/
10:27 < ecrist> heh, and I'm the one that sets the cloaks
10:29 < Axeman> lol
10:29 -!- s7r [~s7r@AC817583.ipt.aol.com] has joined #openvpn
10:29 -!- s7r [~s7r@AC817583.ipt.aol.com] has quit [Changing host]
10:29 -!- s7r [~s7r@unaffiliated/s7r] has joined #openvpn
10:30 < ecrist> Dougy: you're welcome to the same cloak krzee and I have, openvpn/community/support/dougy
10:31 < s7r> ecrist i would like that too
10:31 < s7r> :))
10:32 < ecrist> what's that
10:32 < Axeman> woot got an im from mrmist about my cloak
10:32 < s7r> a cloak
10:33 < ecrist> I can give you openvpn/user/s7r
10:33 < Axeman> well thanks to you folks - i will be a regular lurker in here :-)
10:33 < s7r> ecrist that would be good too
10:33 < s7r> don't i have to do anything for it
10:33 < ecrist> nope
10:33 < s7r> other than staying on this channel and helping other user with my very few experience
10:33 < ecrist> not for a user cloak
10:34 < ecrist> for a support/community cloak you need to be a contributor
10:34 < ecrist> for an admin/staff cloak you need to work for OpenVPN Technologies
10:34 < ecrist> for the God cloak, you need to be me. ;)
10:34  * ecrist poofs for meeting at datacenter
10:34 < s7r> :D
10:34 < s7r> give me a user ecrist
10:35 < s7r> if yo ucan
10:36 -!- Axeman [~axeman3@198.105.46.46] has quit [Changing host]
10:36 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
10:37 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
10:38 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
10:38 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:39 -!- s7r [~s7r@unaffiliated/s7r] has quit [Changing host]
10:39 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:41 < Axeman> aaa yeah -i'm all set now
10:42 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
10:43 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:43 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
10:44 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
10:46 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:46 -!- mode/#openvpn [+o mattock] by ChanServ
10:48 -!- ugly_duck [~ugly@203.160.120.105] has joined #openvpn
10:49 -!- ugly_duck [~ugly@203.160.120.105] has quit [Max SendQ exceeded]
10:54 -!- ugly_duck [~ugly@203.160.120.105] has joined #openvpn
10:56 -!- dazo is now known as dazo_afk
11:03 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
11:15 <@vpnHelper> RSS Update - forum: TAP-Win32 driver at least version 9.8 vs 9.00.00.8 <http://forums.openvpn.net/topic8411.html#p13625>
11:16 -!- K1ng` [~KING@180.211.188.24] has quit [Ping timeout: 264 seconds]
11:17 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:19 -!- K1ng [~KING@180.211.188.148] has joined #openvpn
11:20 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:21 < gladiatr> heya
11:24 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 258 seconds]
11:27 <@vpnHelper> RSS Update - forum: smartcards & windows xp <http://forums.openvpn.net/topic8439.html>
11:29 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Relax, its only ONES and ZEROS!]
11:39 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
11:58 -!- Sazpaimon_ [wat@c-68-32-58-174.hsd1.nj.comcast.net] has quit [Quit: Leaving]
11:59 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
12:05 -!- gyyrog [~gyyrog@174.124.210.63] has joined #openvpn
12:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:27 -!- Axeman [~axeman3@198.105.46.46] has joined #openvpn
12:36 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:46 -!- K1ng [~KING@180.211.188.148] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
12:51 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
12:51 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has quit [Quit: Leaving...]
13:20 -!- quiccker [~quiccker@212.174.109.55] has joined #openvpn
13:26 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
13:26 <@vpnHelper> RSS Update - forum: OpenVPN with Windows Clients <http://forums.openvpn.net/topic8426.html#p13627>
13:31 -!- montechristo [~montechri@85.17.236.195] has joined #openvpn
13:47 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 260 seconds]
13:47 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
14:00 -!- Dropje [~yge@5ED095E6.cm-7-1c.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
14:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:04 -!- gyyrog [~gyyrog@174.124.210.63] has quit [Remote host closed the connection]
14:06 -!- pa [~pa@unaffiliated/pa] has quit [Remote host closed the connection]
14:16 < Axeman> hey darkdrgn2k you around ? 
14:16 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:21 <@vpnHelper> RSS Update - forum: command line pkcs11 options not recognized under windows <http://forums.openvpn.net/topic8439.html>
14:31 -!- K1ng [~KING@180.211.188.148] has joined #openvpn
14:35 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 252 seconds]
14:37 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
14:37 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Read error: Connection reset by peer]
14:39 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
14:41 -!- openvpn2009 [~a@openvpn/corp/admin/patel] has quit [Ping timeout: 276 seconds]
14:43 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
14:47 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:49 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
14:53 -!- ryansch [~ryansch@74.198.151.120] has joined #openvpn
15:02 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
15:03 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Read error: Operation timed out]
15:14 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
15:27 -!- montechristo [~montechri@85.17.236.195] has quit [Ping timeout: 260 seconds]
15:30 -!- ryansch [~ryansch@74.198.151.120] has quit [Quit: Leaving...]
15:36 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 258 seconds]
15:36 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
15:52 -!- Axeman [~axeman3@198.105.46.46] has quit [Ping timeout: 258 seconds]
16:14 -!- ryansch [~ryansch@216.251.156.90] has joined #openvpn
16:27 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
16:32 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
16:32 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
16:32 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
16:46 <@vpnHelper> RSS Update - forum: Windows 7 64 bit Installation Fails OpenVPN 2.2.1 <http://forums.openvpn.net/topic8440.html>
16:48 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 240 seconds]
16:49 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
16:51 -!- sia^pwnnt is now known as sia
17:02 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
17:19 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has quit [Ping timeout: 260 seconds]
17:21 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
17:27 -!- rschlesi [~ryansch@staging.aceofsales.com] has joined #openvpn
17:30 -!- ryansch [~ryansch@216.251.156.90] has quit [Ping timeout: 258 seconds]
17:33 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:47 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 258 seconds]
17:50 <@vpnHelper> RSS Update - forum: openvpn connects but TAP-WIN32 adapter doesn't <http://forums.openvpn.net/topic8441.html>
17:56 -!- rschlesi [~ryansch@staging.aceofsales.com] has quit [Ping timeout: 276 seconds]
18:03 -!- testing-1 [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
18:05 -!- g6e45y [~testing-3@dkpix.brightpoint.dk] has quit [Ping timeout: 240 seconds]
18:17 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has joined #openvpn
18:18 -!- ugly_duck [~ugly@203.160.120.105] has quit [Ping timeout: 252 seconds]
18:43 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Read error: Connection reset by peer]
18:44 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
18:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:49 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 264 seconds]
18:56 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
19:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
19:06 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
19:11 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Read error: Operation timed out]
19:26 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Ping timeout: 258 seconds]
19:49 -!- [intra]lanman [~lanman@c-98-250-105-93.hsd1.mi.comcast.net] has joined #openvpn
19:49 -!- [intra]lanman [~lanman@c-98-250-105-93.hsd1.mi.comcast.net] has quit [Changing host]
19:49 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
19:52 -!- smoak [~smoak@c-71-227-249-63.hsd1.wa.comcast.net] has joined #openvpn
19:52 < smoak> !ipforward
19:52 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
19:52 < smoak> !linipforward
19:52 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
19:56 -!- smoak [~smoak@c-71-227-249-63.hsd1.wa.comcast.net] has quit [Client Quit]
20:03 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
20:04 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
20:05 -!- Cain` is now known as Cain
20:15 -!- master_of_master [~master_of@p57B52C1B.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
20:17 -!- master_of_master [~master_of@p57B55EB2.dip.t-dialin.net] has joined #openvpn
20:26 < ecrist> heya gladiatr 
20:29 < EugeneKay> PuTTY released a new version today.
20:29 < EugeneKay> World ends at 10
20:31 < ecrist> w00t
20:32 < ecrist> any good?
20:32 < EugeneKay> It has the integration for the Windows 7 jump list thing
20:33 < ecrist> blast.  I was hoping for better printing support
20:34 < EugeneKay> That's about it for UI improvements
20:34 < EugeneKay> Lots of ssh stuff
20:35  * ecrist further procrastinates vB enhancements
20:41  * ecrist gets back at it, unimpressed with 4-year release cycle of putty
20:41 < EugeneKay> It's one of those pieces of software which can safely be called "finished"
20:41 -!- ugly_duck [~ugly@122-60-54-108.jetstream.xtra.co.nz] has joined #openvpn
20:41 < ecrist> EugeneKay: I disagree
20:41 < ecrist> printing is a HUGE missing component
20:42 < EugeneKay> Yeah, because copy+paste to notepad is so hard
20:42 < ecrist> ahem, just becuase that's OK for you and perhaps me, it's not ok for every user
20:42 < EugeneKay> If you're using PuTTy, you should be able to figure that out
20:42 < ecrist> negative
20:43 < ecrist> at $work, we provide shell access to a remote IBM 3270 service via SSH (thus a secure connection) for medical billing staff
20:43 < ecrist> there are 1000+ reasons to print in their work flow, and they can't do it in putty with out copy/paste
20:43 < EugeneKay> ohgodmedicalbillingstaffkillthemwithfire
20:43 < ecrist> how fucking retarded is that.
20:44 < EugeneKay> Patches welcome? :-p
20:44 < ecrist> excusing a missing feature with "use this other ghetto method instead n00b" is short-sighted.
20:45 < ecrist> of course they are, but, it was easier to use shellinabox coupled with a web browser and CSS to get printing support for those uses.
20:45 < ecrist> users*
20:45 < ecrist> it's slower, but it's functional, and gets our ~100ish users the printing support they need
20:48 < EugeneKay> Sounds like a valid solution, and what I would have recommended anyway, given the target users
20:49 < ecrist> rather elitest...
20:49 < EugeneKay> This is news somehow?
20:50 < ecrist> that, no.  I'm not a fan of elitests, however.
20:51 < EugeneKay> It's not that I view myself as better than $USER, it's that I don't suffer foolish questions such as "how do I right click?"
20:53 < ecrist> I don't consider, 'How do I print' within an application that doesn't support it foolish...
20:55 < EugeneKay> It's a shell app. Kinda by definition, the functionality is for the other end.
20:56 < EugeneKay> Also,  quick look at gnome-terminal shows no Print buttoon there either. Doesn't seem like the functionality people are really after, or it'd be there, eh? :-p
21:03 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:04 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:05 < ecrist> EugeneKay: not really
21:06 < ecrist> I've used *nix for ~15 years, and can probably count the times I've printing things from a shell on one hand.
21:06 < ecrist> I'm not the only user out there,
21:22  * EugeneKay burps
21:22 < EugeneKay> Tastes like oranges.
21:28  * ecrist contemplates rolling out vb without import of old forums...
21:28 < EugeneKay> vBulletin?
21:29 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
21:31 < ecrist> yes
21:31 < ecrist> Axeman: you need to roll your irc client to auto-authenticate your nick
21:31 < Axeman> i did budd.. but i htink my password was wrong. 
21:32 < ecrist>  /msg nickserv identify <nick> <password>
21:32 < EugeneKay> I'm torn between offering my sympathies at your pain and pointing+laughig.
21:32 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
21:32 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
21:32 < ecrist> EugeneKay: I'm a fan of vB
21:32 < ecrist> aside from it's lack of ldap support
21:32 < ecrist> but I think I have that licked
21:33 < Axeman> ecrist, yup - the password i had entered for auto was wrong. 
21:33 < ecrist> ah
21:34 < Axeman> i wasn't planning on staying on freenode, honestly.
21:34 < Axeman> until you guys got me this cloak
21:34 < Axeman> now, i'll be a regular
21:41 < ecrist> anyone can have a cloak on freenode, you just have to ask for one. :)
21:43 < Axeman> yeah well been here for about a month and no one was nice enough to offer except you folks
21:43 < Axeman> then again i was only idle in #openfiler and semi-active in #vmware
21:47 -!- jaminja [~jaminja@212.7.195.193] has quit [Changing host]
21:47 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
21:49 < ecrist> Axeman: anyone can go to #freenode and ask for one.  by default, you get unaffiliated/username 
21:49 < ecrist> I'm actually the only person that can give out openvpn cloaks...
21:49 < Axeman> i thought you had to be a donater or something
21:49 < Axeman> either way - gladd to be 'affiliated' with ya'll
21:50 < ecrist> :)
21:51 < Axeman> though i hate to say it i'll be more interested in -AS since that's the flavor that intrigues me.
21:51 < ecrist>  /j #openvpn-as
21:53 < Axeman> yeah in there lol
21:53 < Axeman> been there since i got referred there ye'sser day
22:04 < ecrist> that channel is new
22:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
22:04 < ecrist> this channel is not. ;)
22:05 -!- AXEMan2 [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
22:07 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:08 -!- AXEMan2 [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Client Quit]
22:11 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
22:14 -!- EugeneKay is now known as EugeneKaway
22:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:25 <@vpnHelper> RSS Update - forum: Management console only accessible by one user <http://forums.openvpn.net/topic8442.html>
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
22:35 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:44 -!- Andrew-Home [~Administr@twisted.505.ru] has joined #openvpn
22:44 -!- Andrew-Home [~Administr@twisted.505.ru] has quit [Client Quit]
23:08 < pr0zoid> hey guys ... .need help removing a bad certificate.
23:08 < pr0zoid> how do i delete it from the easy-rsa database?
23:11 -!- aarcane [~aarcane@c-98-238-138-177.hsd1.ca.comcast.net] has joined #openvpn
23:12 < aarcane> hai, I've got openvpn setup and running, not sure which version, however, I'm exhibiting some odd behaviour..  when I create a connection, I get assigned the ip endpoints .5 and .6, however, when I look at my ifconfig -a, I see ONLY a tun0 with endpoints .1 and .2.  the remote endpoint seems to get the correct information, but can never connect.
23:15 < aarcane> !welcome
23:15 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:15 < aarcane> !goal
23:15 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:16 < pr0zoid> i tried revoke but get the following : Using configuration from /etc/openvpn/easy-rsa/openssl.cnf unable to load certificate 6370:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
23:16 < pr0zoid> unable to load certificate 6373:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE
23:16 < aarcane> I want to be able to access the lan (and maybe the internet) over my server.
23:16 < aarcane> *over my vpn
23:16 < aarcane> !logs
23:16 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
23:16 < aarcane> !interface
23:16 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
23:18 < aarcane> !iporder
23:18 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
23:19 < aarcane> !faw
23:19 < aarcane> !faq
23:19 <@vpnHelper> "faq" is (#1) http://openvpn.net/index.php/documentation/faq.html, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ
23:19 < aarcane> !howto
23:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:26 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 252 seconds]
23:26 -!- patelx [~a@openvpn/corp/admin/patel] has joined #openvpn
23:27 -!- mode/#openvpn [+o patelx] by ChanServ
23:36 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
23:43 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p13631>
--- Day changed Wed Jul 13 2011
00:14 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
00:56 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:08 -!- SOG [~SOG@113.108.118.58] has left #openvpn []
01:12 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
01:30 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
01:58 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has joined #openvpn
01:58 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
02:05 -!- venom00ut [~wer@unaffiliated/venom00] has joined #openvpn
02:10 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
02:11 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
02:11 -!- Cain` is now known as Cain
02:19 -!- darkdrgn2k [~darkdrgn2@199.243.221.14] has quit [Read error: Connection reset by peer]
02:20 -!- pr0zoid [~pr0zoid@24-246-5-196.cable.teksavvy.com] has quit [Ping timeout: 276 seconds]
02:21 -!- dazo_afk is now known as dazo
02:32 <@vpnHelper> RSS Update - forum: What is the definition of the "bytes" reported in the status <http://forums.openvpn.net/topic8443.html>
02:46 -!- Bried [~chatzilla@S01060018f8d6f6a7.ok.shawcable.net] has joined #openvpn
02:47 < Bried> hi
02:48 < Bried> I JUST downloaded & tried to install the windows installer version of openvpn & the tap0901 driver failed to install.... I tried using the shortcut to remove ALL tap drivers & it said none were found... what could be going wrong?
02:49 < Bried> windows 7 x64
02:52 < hyper_ch> !tunortap
02:52 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
02:52 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
02:53 < Bried> #4
02:53 < Bried> for wippien actually
02:53 < Bried> but it fails with its installer too
02:54 < Bried> so thought I'd try openvpn since it's more mature
02:54 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 255 seconds]
02:54 < Bried> same tap driver far as I can tell actually
02:54 < Bried> so far best I can find: http://forums.openvpn.net/topic8164.html
02:54 <@vpnHelper> Title: OpenVPN Support Forum TAP not working in Windows 7 : Off Topic, Related (at forums.openvpn.net)
02:55 < Bried> but he doesn't say where he found it to rename it?
02:57 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
02:59 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:02 -!- ycat [~Yann@chello080109049190.2.14.univie.teleweb.at] has joined #openvpn
03:04 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
03:05 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
03:08 <@vpnHelper> RSS Update - forum: OpenVPN with Windows Clients <http://forums.openvpn.net/topic8426.html#p13634> || Configuration OpenVPN Client <http://forums.openvpn.net/topic8444.html>
03:14 <@vpnHelper> RSS Update - forum: Configuration OpenVPN Client <http://forums.openvpn.net/topic8444.html#p13636> || Can't access/ping Windows 7 x64 client's LAN. <http://forums.openvpn.net/topic8437.html#p13635>
03:14 -!- ugly_duck [~ugly@122-60-54-108.jetstream.xtra.co.nz] has quit [Ping timeout: 255 seconds]
03:17 -!- venom00ut [~wer@unaffiliated/venom00] has quit [Remote host closed the connection]
03:17 -!- ycat [~Yann@chello080109049190.2.14.univie.teleweb.at] has quit [Read error: Operation timed out]
03:17 -!- ycat_ [~Yann@chello080109049190.2.14.univie.teleweb.at] has joined #openvpn
03:22 -!- ugly_duck [~ugly@122-60-54-108.jetstream.xtra.co.nz] has joined #openvpn
03:24 -!- gen [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
03:25 -!- gen is now known as genlime
03:25 < genlime> Is someone using ping tunnel here?
03:26 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:28 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
03:32 <@vpnHelper> RSS Update - forum: openvpn connects but TAP-WIN32 adapter doesn't <http://forums.openvpn.net/topic8441.html#p13637>
03:32 -!- superc_ [~superc@tmo-096-177.customers.d1-online.com] has joined #openvpn
03:38 -!- Bried [~chatzilla@S01060018f8d6f6a7.ok.shawcable.net] has quit [Quit: ChatZilla 0.9.86.1 [Firefox 3.6.16/20110319135224]]
03:44 <@vpnHelper> RSS Update - forum: Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13638>
03:51 -!- superc_ [~superc@tmo-096-177.customers.d1-online.com] has left #openvpn []
03:51 -!- superc_ [~superc@tmo-096-177.customers.d1-online.com] has joined #openvpn
03:52 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 252 seconds]
03:52 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
03:58 -!- beedee_ [~bram@124.43.20.30] has joined #openvpn
03:58 < beedee_> hi all
03:59 < beedee_> is there a way to run bridge-server with static key? I need to quickly configure something and no easy way of using TLS/certs
03:59 < beedee_> if not why is that restriction in place?
04:00 < beedee_> so many people here and nobody active??
04:01 < ycat_> well, you shouldn't expect an answer within 3 minutes on IRC...
04:01 < beedee_> lol
04:01 < beedee_> since when is that :)
04:02 < beedee_> I've been on IRC for 15 years so sorryfor my ignorance :)
04:02 < ycat_> it depends on the channels, but some ppl don't have big notifications. 
04:02 < ycat_> :D
04:02 < beedee_> ... in the old days ... lala
04:02 < beedee_> yeah I guess people got more busy and less chatty ;)
04:02 < ycat_> http://wiki.openwrt.org/doc/howto/openvpn_bridging maybe this helps; unfortunately i never tried your setup
04:03 < ycat_> yea, the bad economical context enforces more workload
04:03 < beedee_> yep
04:04 < ycat_> I have a setup which has been running for quite a while, and now I have a problem on adding a route to a client's side LAN. I followed the instructions in the HowTo (ccd, iroute in clientCN, route on server, push etc.) but it didn't work.
04:04 < beedee_> well the link you gave me doesn't seem to say anything about the error msg I get from openvpn itself saying it doesn't want to do bridge mode with a --secret option instead
04:05 < beedee_> I noticed route push doesn't always do the right thing.
04:06 < Mowee> Morning
04:06 < beedee_> try to manually add them on the client and see if that works
04:06 < beedee_> hey Mowee
04:07 < beedee_> brb BF
04:16 -!- beedee_ [~bram@124.43.20.30] has quit [Ping timeout: 252 seconds]
04:17 -!- luneff [~yury@84.51.213.254] has quit [Quit: This computer has gone to sleep]
04:19 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
04:21 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
04:25 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 246 seconds]
04:25 <@vpnHelper> RSS Update - forum: Configuration OpenVPN Client <http://forums.openvpn.net/topic8444.html#p13639>
04:26 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
04:44 -!- superc [~superc@tmo-096-177.customers.d1-online.com] has joined #openvpn
04:44 -!- testing-2 [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
04:47 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
04:47 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:47 -!- superc_ [~superc@tmo-096-177.customers.d1-online.com] has quit [Ping timeout: 255 seconds]
04:47 -!- testing-1 [~testing-3@dkpix.brightpoint.dk] has quit [Ping timeout: 255 seconds]
04:47 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 255 seconds]
04:48 -!- naquad_ [~naquad@174.142.224.219] has joined #openvpn
04:52 -!- ugly_duck [~ugly@122-60-54-108.jetstream.xtra.co.nz] has quit [Ping timeout: 258 seconds]
04:56 -!- mrt2k11 [~quassel@dhcp-13-172.lip.ens-lyon.fr] has joined #openvpn
04:58 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 264 seconds]
04:58 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
04:58 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
05:03 -!- K1ng` [~KING@180.211.188.148] has joined #openvpn
05:05 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 255 seconds]
05:05 -!- sno__ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 255 seconds]
05:05 -!- K1ng [~KING@180.211.188.148] has quit [Read error: Connection reset by peer]
05:05 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:11 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:14 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 255 seconds]
05:15 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:17 -!- dws6045 [~dws@c-76-102-54-104.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
05:21 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
05:22 -!- luneff [~yury@46.61.29.24] has joined #openvpn
05:24 -!- ycat [~Yann@chello080109049190.2.14.univie.teleweb.at] has joined #openvpn
05:24 -!- superc [~superc@tmo-096-177.customers.d1-online.com] has quit [Ping timeout: 260 seconds]
05:26 -!- luneff [~yury@46.61.29.24] has quit [Read error: Operation timed out]
05:26 -!- superc [~superc@tmo-097-54.customers.d1-online.com] has joined #openvpn
05:27 -!- ycat_ [~Yann@chello080109049190.2.14.univie.teleweb.at] has quit [Ping timeout: 260 seconds]
05:31 -!- luneff [~yury@46.61.29.24] has joined #openvpn
05:35 -!- pa [~pa@unaffiliated/pa] has quit [Remote host closed the connection]
05:38 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:41 -!- superc [~superc@tmo-097-54.customers.d1-online.com] has left #openvpn []
05:44 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
05:46 -!- EugeneKaway [~EugeneKay@eugenekay.com] has quit [Quit: ZNC - http://znc.in]
05:47 -!- EugeneKaway [~EugeneKay@eugenekay.com] has joined #openvpn
05:47 -!- EugeneKaway is now known as EugeneKay
05:51 < ycat> Is there a way to ignore a single pushed route on the client side? Or is there only push-reset and adding all routes manually in the ccd/file?
05:52 < ycat> !goal
05:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:52 < ycat> !welcome
05:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:52 < ycat> !route
05:52 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
06:05 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
06:08 < genlime> I am using ping tunnel now with squid web proxy. does anybody now how to improve the speed of this tunnel?
06:18 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:22 -!- baccenfutter [~backenfut@shell.c-base.org] has quit [Changing host]
06:22 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has joined #openvpn
06:25  * s7r whoami
06:29 -!- boswarrior1 [~mrnice@78.142.173.114] has joined #openvpn
06:36 <@dazo> ycat: no, you can only add --route-nopull, which ignores all pushed routes
06:37 <@dazo> ycat: for server side, there is only the --push-reset, as you've discovered
06:37 <@dazo> genlime: ping tunnel?
06:37 <@dazo> genlime: squid web proxy?
06:37 <@dazo> genlime: how is this related to OpenVPN?
06:38 < genlime> its not related but just posting maybe someone knows
06:39 < ycat> dazo: thanks. 
06:39 <@dazo> ycat: you're welcome!
06:41 < ycat> !ccd
06:41 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
06:43 <@dazo> genlime: your question is like going to a music shop which specialises on classical music, asking if they have the latest record from Iron Maiden ...
06:43 <@dazo> of course, you might be lucky ....
06:44 < genlime> maybe. but somehow openvpn and ptunnel is the same because they tunnel internet traffic
06:44 <@dazo> openvpn is not the same as ptunnel
06:44 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
06:45 <@dazo> a motor cycle isn't the same as a car, as both of them have wheels and an engine
06:47 -!- boswarrior1 [~mrnice@78.142.173.114] has quit [Quit: Ex-Chat]
06:54 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Ping timeout: 240 seconds]
06:55 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 255 seconds]
06:56 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
07:00 -!- greenmang0 [~greenmang@121.243.225.226] has joined #openvpn
07:00 -!- greenmang0 [~greenmang@121.243.225.226] has quit [Changing host]
07:00 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
07:06 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Read error: Operation timed out]
07:06 -!- takamichi [~pri@83.170.109.106] has joined #openvpn
07:08 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
07:09 < Bushmills> openvpn --mtu-test could be helpful.  i'm sure ptunnel, being "somwhow" the same, may have the same option
07:09 < Bushmills> it determines best mtu size for the connection
07:12 < Bushmills> and you'd probalby want to select an efficient cipher. BF-CBC 128, for example
07:13 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
07:14 -!- takamichi [~pri@83.170.109.106] has quit [Ping timeout: 250 seconds]
07:14 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
07:20 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
07:22 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:26 -!- maxagaz [~maxagaz@89.108.151.226] has joined #openvpn
07:26 < maxagaz> hi
07:27 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
07:35 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:36 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
07:44 -!- pa [~pa@unaffiliated/pa] has quit [Read error: Connection reset by peer]
07:46 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Ping timeout: 264 seconds]
07:47 -!- mrt2k11 [~quassel@dhcp-13-172.lip.ens-lyon.fr] has quit [Remote host closed the connection]
07:47 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
08:01 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
08:02 -!- gyyrog_ [~gyyrog@96-36-48-82.static.aldl-nbb.mi.charter.com] has joined #openvpn
08:04 -!- ycat_ [~Yann@chello080109049190.2.14.univie.teleweb.at] has joined #openvpn
08:05 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has joined #openvpn
08:06 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Ping timeout: 276 seconds]
08:07 -!- ycat [~Yann@chello080109049190.2.14.univie.teleweb.at] has quit [Ping timeout: 250 seconds]
08:09 -!- bauruine [~stefan@217.150.234.219] has joined #openvpn
08:15 -!- bauruine [~stefan@217.150.234.219] has quit [Ping timeout: 260 seconds]
08:22 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
08:36 -!- bauruine [~stefan@217.150.229.73] has joined #openvpn
08:43 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:44 -!- bauruine [~stefan@217.150.229.73] has quit [Quit: Leaving]
08:46 -!- gyyrog_ [~gyyrog@96-36-48-82.static.aldl-nbb.mi.charter.com] has quit [Ping timeout: 276 seconds]
09:03 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Read error: Connection reset by peer]
09:09 -!- snappy [~nipnop@wbml.net] has joined #openvpn
09:09 -!- snappy [~nipnop@wbml.net] has quit [Changing host]
09:09 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
09:16 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
09:17 <@vpnHelper> RSS Update - forum: Help configuring firewall with OpenVPN support <http://forums.openvpn.net/topic8436.html#p13640>
09:30 -!- ycat_ [~Yann@chello080109049190.2.14.univie.teleweb.at] has quit [Quit: leaving]
09:46 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:49 -!- bauruine [~stefan@217.150.229.73] has joined #openvpn
09:55 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
09:55 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
09:55 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:06 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
10:08 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
10:14 -!- luneff [~yury@46.61.29.24] has quit [Ping timeout: 258 seconds]
10:18 -!- luneff [~yury@46.41.113.150] has joined #openvpn
10:19 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
10:30 < Axeman> !goal
10:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:34 -!- mattock [~mattock@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
10:34 -!- mattock [~mattock@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Changing host]
10:34 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:34 -!- mode/#openvpn [+o mattock] by ChanServ
10:37 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:37 -!- mode/#openvpn [+o raidz] by ChanServ
10:43 -!- luneff [~yury@46.41.113.150] has quit [Quit: This computer has gone to sleep]
10:52 < ecrist> 10:52:49 -ChanServ(ChanServ@services.)- Flags +V were set on *!*@openvpn/user/* in #openvpn.
10:57 -!- mode/#openvpn [+o ecrist] by ChanServ
10:57 -!- mode/#openvpn [+v Axeman] by ecrist
10:57 -!- mode/#openvpn [-o ecrist] by ecrist
10:57 -!- Irssi: #openvpn: Total of 151 nicks [5 ops, 0 halfops, 1 voices, 145 normal]
10:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:04 -!- nuttersppadic [~IceChat77@193.130.68.17] has left #openvpn []
11:04 -!- yell0 [yello@unaffiliated/contempt] has quit [Quit: leaving]
11:04 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
11:10 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:12 -!- tiphares [~what@ks29912.kimsufi.com] has joined #openvpn
11:13 < K1ng`> http://i56.tinypic.com/2e6hs45.jpg
11:14 < tiphares> using this guide, i don't understand what to use as "server-bridge" etc, can someone guide me a little
11:14 < tiphares> https://help.ubuntu.com/10.10/serverguide/C/openvpn.html
11:14 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
11:21 <+Axeman> wow on the monitor
11:24 -!- twister004_ [~chatzilla@117.204.129.56] has joined #openvpn
11:26 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 252 seconds]
11:26 -!- twister004_ is now known as twister004
11:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 246 seconds]
11:52 -!- tiphares [~what@ks29912.kimsufi.com] has quit [Quit: bye]
11:52 -!- twister004 [~chatzilla@117.204.129.56] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
11:53 -!- tiphares [~what@onomatopoeia.no-ip.org] has joined #openvpn
12:03 -!- mrt2k11 [~quassel@dhcp-13-172.lip.ens-lyon.fr] has joined #openvpn
12:04 -!- dazo is now known as dazo_afk
12:31 -!- mrt2k11 [~quassel@dhcp-13-172.lip.ens-lyon.fr] has quit [Remote host closed the connection]
12:33 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
12:35 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
12:43 -!- AXEMan2 [~axeman3@198.105.46.46] has joined #openvpn
12:46 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
12:47 -!- bab [~bab@208.73.74.116] has joined #openvpn
12:50 -!- swente [~swente@unaffiliated/swente] has joined #openvpn
12:54 -!- naquad_ [~naquad@174.142.224.219] has quit [Quit: ZNC - http://znc.sourceforge.net]
12:54 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:57 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
12:59 -!- AXEManiac [~axeman3@198.105.46.46] has joined #openvpn
13:02 -!- AXEMan2 [~axeman3@198.105.46.46] has quit [Ping timeout: 258 seconds]
13:02 < swente> 'lo. having a central server with 3+ vpns (separate), in the past some clients connected to every vpn they had to work with. currenly setting up everything from scratch, i want to avoid multi-vpn-connections [just one connection per client], and do access-control [primarily for subnets behind some clients] on the server-side by ip-filtering. problem is: pushing routes works so far that clients get routes to other client's subnetz, even pushing subnet
13:02 < swente> s from vpn-A-client to vpn-X-clients works as expected. question: as routing between vpns now has to be done by server itself .. i don't get the client-subnet's route added to the server's routing-table. [sorry if i'm just a bit slow today.. :)]
13:11 < swente> sorry, in short: one client of a vpn has a subnet. problem is: how to add entry to *server/systems* routing table when that client connects. [ccd-file?]
13:23  * ecrist reads
13:23 < swente> ecrist: skip to last line :)
13:26 < ecrist> !iroute
13:26 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
13:28 < swente> ecrist: "is does not bypass or alter the kernel's routing table". but having client's subnet added to kernel's routing-table is what i want.
13:29 < swente> ecrist: if i would use '--route', then it would added for every client connecting? tried to add 'route' in ccd-file, but that was not allowed.
13:30 -!- luckman212 [~irc@2001:470:1f07:1225:8048:3812:9d88:a161] has joined #openvpn
13:30 < ecrist> swente: no, you don't.  iroute is what you want, trust me
13:31 -!- AXEMan2 [~axeman3@198.105.46.46] has joined #openvpn
13:32 < EugeneKay> iRoute
13:33 < swente> ecrist: the iroute would be added to the ccd-file for the client having the subnet. that file and the iroute is still present. (that way other clients connecting to the same vpn-instance can reach that subnet)
13:35 < ecrist> swente: I'm aware of how iroute works.  please just trust me...
13:35 -!- AXEManiac [~axeman3@198.105.46.46] has quit [Ping timeout: 258 seconds]
13:35 < swente> ecrist: i do trust you, perhaps i simply do not express myself as clearly as i should :-|
13:35 < ecrist> you can add a route to the kernel table using a client-connect script
13:35 < ecrist> !man
13:35 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
13:48 < swente> ecrist: ok, so to get  an entry in kernel's routing-table i'll try to setup a client-connect-script which cares for cname to decide when to add the route. thank you.
13:49 < ecrist> no problem.
13:49 < swente> ecrist: [again, i really trust you about iroute & stuff. but when connections not originating from a(nother) vpn-client have to access one client's subnet, then i *indeed* require an entry in kernel's routing-table?]
13:50 < ecrist> yup
13:50 < swente> and there is no "simpler" way than creating such a script?
13:50 < ecrist> i misunderstood what you were looking for
13:50 < ecrist> static route in the kernel table
13:51 < swente> no problem, english is foreign to me and i tend to confuse anyone around :-]
13:51 < swente> point is creating static routes when "the subnet-having" client not *necessarily* always has the same ip..
13:51 < ecrist> assign a static IP. 
13:52 < ecrist> or run BGP/RIP
13:52 < ecrist> !rip
13:52 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
13:53 < swente> yes, in practise they even "usually" should stay static, and|or a connect-script might do the job. i just wondered  .. isn't this common enough that openvpn which cares about pushing routes [and having iroutes] does not feel responsible for creating system-routing-entries? this seems a bit .. odd :)
13:54 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:57 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:01 -!- AXEMan2 is now known as AxeMAN
14:01 -!- AxeMAN [~axeman3@198.105.46.46] has quit [Changing host]
14:01 -!- AxeMAN [~axeman3@openvpn/user/axeman] has joined #openvpn
14:09 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:09 -!- mode/#openvpn [+v s7r] by ChanServ
14:23 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:34 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Ping timeout: 252 seconds]
14:55 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:02 -!- luneff [~yury@84.51.213.254] has joined #openvpn
15:07 -!- tiphares [~what@onomatopoeia.no-ip.org] has quit [Ping timeout: 246 seconds]
15:08 -!- bauruine_ [~stefan@217.150.234.195] has joined #openvpn
15:08 -!- bauruine [~stefan@217.150.229.73] has quit [Ping timeout: 260 seconds]
15:20 -!- EugeneKay is now known as Eugenerer
15:23 -!- Eugenerer is now known as EugeneKay
15:26 <@vpnHelper> RSS Update - forum: Windows 7 Installation Fails - OpenVPN 2.2.1 <http://forums.openvpn.net/topic8445.html>
15:44 <@vpnHelper> RSS Update - forum: Mac 1.8.0 OpenVPN Connect <http://forums.openvpn.net/topic8446.html>
15:51 -!- obiyoda [~jared@63-253-61-106.ip.mcleodusa.net] has joined #openvpn
15:54 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:01 -!- AxeMAN [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
16:03 -!- bab [~bab@208.73.74.116] has quit [Quit: This computer has gone to sleep]
16:07 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
16:29 -!- bab [~bab@208.73.74.116] has joined #openvpn
16:30 -!- freaky[t] [alpha@freakyonline.de] has quit [Remote host closed the connection]
16:37 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
16:37 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
16:37 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
16:37 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
16:37 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:38 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
16:39 -!- bab [~bab@208.73.74.116] has quit [Quit: This computer has gone to sleep]
16:46 -!- alex88 [~alex88@unaffiliated/alex88] has joined #openvpn
16:47 < alex88> hi guys, is possible using same config to make openvpn listen on multiple ports?
16:48 < snappy> no, you need multiple instances.
16:48 < alex88> ok thank you sna
16:48 < alex88> ok thank you snappy 
17:12 -!- K1ng` [~KING@180.211.188.148] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
17:24 -!- K1ng [~KING@180.211.188.148] has joined #openvpn
17:29 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
17:59 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
18:06 -!- AxeMAN [~axeman3@openvpn/user/axeman] has joined #openvpn
18:06 -!- mode/#openvpn [+v AxeMAN] by ChanServ
18:12 -!- bab [~bab@108.sub-174-252-41.myvzw.com] has joined #openvpn
18:13 -!- obiyoda [~jared@63-253-61-106.ip.mcleodusa.net] has quit [Quit: Ex-Chat]
18:17 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:18 -!- bab [~bab@108.sub-174-252-41.myvzw.com] has quit [Ping timeout: 240 seconds]
18:18 -!- freaky[t] [alpha@freakyonline.de] has quit [Remote host closed the connection]
18:18 -!- bab [~bab@208.73.74.116] has joined #openvpn
18:27 <@vpnHelper> RSS Update - forum: OpenVPN routing to remote network <http://forums.openvpn.net/topic8447.html>
18:27 -!- alex88 [~alex88@unaffiliated/alex88] has left #openvpn []
18:28 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
18:40 -!- bab [~bab@208.73.74.116] has quit [Quit: Leaving]
18:59 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:04 -!- AxeMAN [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
19:17 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
19:22 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Read error: Connection reset by peer]
19:25 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
19:26 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Read error: Connection reset by peer]
19:27 -!- swente [~swente@unaffiliated/swente] has left #openvpn []
19:29 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
19:31 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Read error: Connection reset by peer]
19:33 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
19:34 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Read error: Connection reset by peer]
19:39 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
19:41 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has quit [Ping timeout: 252 seconds]
19:43 -!- BlakHawk [blackhawk@69.42.219.141] has joined #openvpn
19:54 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
19:55 < BlakHawk> hey everyone 
19:55 < BlakHawk> i was hoping that someone in here could  clarify a few things for me because i am very interested in openvpn 
19:55 < snappy> ask.
19:56 < BlakHawk> so if i install openvpn on my fedora box and i set it at address 10.0.0.1 on interface tun0 and i can ping that address and the install looks fine
19:56 < BlakHawk> if i am at a coffee shop how would i go about tunneling back into my linux box running openvpn
19:56 < BlakHawk> i know i would need the client to access the openvpn server i am just not sure about how to do that...
19:57 < BlakHawk> and my laptop on the coffee wifi free internet would be linux also 
19:57 < snappy> so the openvpn client has a configuration file, you tell it the address/port of the public address on the vpn server 
19:58 < snappy> you proceed to connect, openvpn negotiates your end of the tunnel (addresses, routes, etc.), a tun/tap device is established and addressed, adn you should be on the tunnel.
20:00 < BlakHawk> okay i enabled on my router to forward my public ip address back to my fedora linux box at home which has openvpn running on it and so i would then take the openvpn client.conf edit it and put in my public ip address and port 1194 and it would connect to the openvpn server at my home ?
20:01 < BlakHawk> would i need the client to use the cert and keys i created for the openvpn server ?
20:02 < snappy> you'll need to create a separate key and cert (signed by the CA), I used a program: ssl-admin that handles this automatically.
20:03 < BlakHawk> okay that is where i am a bit confused...
20:04 < BlakHawk> so the laptop running linux would need a serpate key and cert signed by ca, how do i do that when i generated the key cert and ca on my fedora linux box 
20:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:10 < snappy> everything can be done with openssl directly, but you're best using a script like ssl-admin or openvpn supplied easyrsa (which didn't seem too easy to me)
20:12 < reiffert> BlakHawk: about your questions at the very beginning, please feel free to try the howto
20:12 < reiffert> !howto
20:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:13 < BlakHawk> okay so when i install openvpn on my laptop running linux i would generate all the keys and certs like i did when i installed it on my home linux box and then instead of running the server on my laptop i would just be using the client to tunnel back to my home box ?
20:13 < reiffert> BlakHawk: and for the latter: there is easy rsa, a bunch of scripts helping you during the key creation process, and yes, every client needs its own certificate signed by the ca.
20:14 < BlakHawk> reiffert: i got that part i just haven't used the client yet and i am confused 
20:14 < reiffert> BlakHawk: right. server on your linux box, client on your laptop aka roadwarrior
20:15 < reiffert> BlakHawk: infact client and server are the same piece of software. just different configs.
20:15 < reiffert> BlakHawk: one config says : "mode server"
20:15 < reiffert> BlakHawk: the other config says "mode client"
20:15 < BlakHawk> just different settings 
20:15 -!- master_of_master [~master_of@p57B55EB2.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
20:15 < reiffert> BlakHawk: right.
20:16 < BlakHawk> when you connect to the server from the client (laptop -> home linux box) are you prompted for a password at all?
20:16 < BlakHawk> does it ask you for the password that you signed your keys/certs with ?
20:16 < reiffert> BlakHawk: you can have your client cert sealed with a password, if you like to
20:17 < reiffert> there are other authentication plugins available, e.g PAM
20:17 -!- master_of_master [~master_of@p57B529DF.dip.t-dialin.net] has joined #openvpn
20:18 < BlakHawk> oh so when you make a sucessful connection from client to server, basically it will be like i am browsing from my home linux box on my laptop at the coffee shop on a secure tunnel connection right?
20:18 < reiffert> BlakHawk: imagine openvpn as a network cable between your laptop and your server
20:19 < BlakHawk> got it =-P
20:19 < BlakHawk> thank you all so much for the assistance 
20:19 < reiffert> (yes, to answer your question)
20:19 < reiffert> the "normal" and "beginners" mode is to have openvpn act on layer 3, routing applies to make use of that "network cable"
20:20 < reiffert> the advanced and "dont use that!" mode is layer 2, it's really really like a real network cable then.
20:20 < reiffert> (ethernet frames instead of ip packets)
20:21 < BlakHawk> got it 
20:21 < reiffert> the howto is a very good start, it even got some sample configs
20:22 < reiffert> next step, after "connecting laptop -> server is working" is have your laptop getting some routing information, like e.g. "send all packets over the tunnel that want to go to whereever" or "send everything over the tunnel"
20:23 < reiffert> try our irc/chat helper bot for some tricks n tips
20:23 < reiffert> !welcome
20:23 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:24 < reiffert> everything unclear now? ;)
20:25 < BlakHawk> ya 
20:25 < BlakHawk> i like that idea of sending everything over the tunnel 
20:26 < reiffert> just type !redirect 
20:26 < BlakHawk> !redirect
20:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
20:26 < BlakHawk> ahh with iptables 
20:27 < reiffert> see !nat
20:27 < BlakHawk> its not possible to make eth0 go through tun0 is it?
20:27 < BlakHawk> thats not what openvpn does right...
20:27 < reiffert> like I said, openvpn is a network cable, the rest is pure routing.
20:28 < BlakHawk> so it is possible?
20:28 < reiffert> of course.
20:28 < reiffert> it is.
20:29 < BlakHawk> like at my linux box at home i which is  on a wired connection running on interface eth0 its possibl to make all traffic go through tun0 ?
20:29 < BlakHawk> what would be the benefits of such a setup ?
20:30 < reiffert> encryption.
20:30 < reiffert> nobody inbetween your laptop and your server can see your communication
20:30 -!- missttea [~miss@71.21.164.84] has joined #openvpn
20:31 -!- toortog [~toortog@notsecure.net] has quit [Read error: Connection reset by peer]
20:31 < missttea> openvpn and android ? 
20:31 < missttea> Anyone ?
20:31 -!- toortog [~toortog@notsecure.net] has joined #openvpn
20:31 < BlakHawk> okay so i need to have iptables route eth0 through tun0 so when i connect from my laptop to my  linux server at home everything is encrypted?
20:32 < reiffert> e.g. think of a public open wifi
20:32 < snappy> BlakHawk: I work for a company that has a lot of government contracts, tight corporate proxies, etc.
20:32 < snappy> I use openvpn to tunnel out, route all traffic, and bypass any and all filters, etc. that's sort of the privacy/filter bypass type deal.
20:33 < reiffert> BlakHawk: the server tells the client: send everything through the tunnel from now on
20:33 < reiffert> BlakHawk: your server has to do some network address translation in order to make it work, it's just a simple and single iptables rule, see !nat
20:34 < BlakHawk> iptables -t nat -A POSTROUTING -o em1 -j MASQUERADE
20:34 < BlakHawk> iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j MASQUERADE
20:34 < BlakHawk> iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o tun0 -j MASQUERADE
20:34 < reiffert> just type: !nat and hit return
20:34 < BlakHawk> iptables -A FORWARD -i tun0 -j ACCEPT
20:34 < BlakHawk> iptables -I FORWARD -i em1 -o tun0 -j ACCEPT
20:34 < BlakHawk> iptables -I FORWARD -i tun0 -o em1 -j ACCEPT
20:34 < BlakHawk> would that work ?
20:34 < BlakHawk> !nat
20:34 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
20:35 < BlakHawk> i think it will...
20:35 < reiffert> now read everything up, then type: !linnat
20:35 < BlakHawk> got it.... you guys are great 
20:35 < BlakHawk> thank you all
20:36 < reiffert> welcome
20:36 < BlakHawk> what do you guys think of using openvpn with networkmanager ?
20:36 < reiffert> type: !ubuntu
20:36 < BlakHawk> or do you just prefer to use openvpn without networkmanager 
20:37 < BlakHawk> i'm just curious
20:37 < BlakHawk> !ubuntu
20:37 <@vpnHelper> "ubuntu" is dont use network manager!
20:37 < BlakHawk> haha
20:37 < BlakHawk> well i guess that answers it 
20:37 < reiffert> !factoids search network manager
20:37 <@vpnHelper> No keys matched that query.
20:37 < reiffert> !factoids search --values network manager
20:37 <@vpnHelper> 'ubuntu', 'netman', and 'win2k8'
20:37 < reiffert> !netman
20:37 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
20:42 < BlakHawk> i know you guys have helped me so much and i appreciate it, could anyone here give me an example of what the command line would look like for a client to connect to server 
20:42 < BlakHawk> i am looking at the howto and i am not seeing it 
20:43 < reiffert> --it --is-going --to-get --a-real-long --and-complicated --cmd-line --better-use --a --config --file
20:43 < BlakHawk> lol, i understand that 
20:44 < BlakHawk> so is it as simple as "openvpn client.conf" ?
20:44 < reiffert> see here:
20:44 < reiffert> !man
20:44 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
20:45 < reiffert> and at the very beginning, you will find
20:45 < reiffert> --config file
20:45 < BlakHawk> i'll figure it out 
20:46 < reiffert> openvpn --config file
20:47 < reiffert> see sample config on !howot
20:47 < BlakHawk> ya i just looking at the man 
20:47 < BlakHawk> i can't wait to try this out tomorrow 
20:47 < BlakHawk> reiffert: you are great man, thanks again
20:47 < reiffert> howto and manpage are different concepts
20:47 < BlakHawk> i need to run, reifferet thanks again
20:48 < BlakHawk> later =-P
20:48 < reiffert> welcome
20:48 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 240 seconds]
20:53 -!- AxeMAN [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:53 -!- AxeMAN [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
20:53 -!- AxeMAN [~axeman3@openvpn/user/axeman] has joined #openvpn
20:53 -!- mode/#openvpn [+v AxeMAN] by ChanServ
20:53 -!- missttea [~miss@71.21.164.84] has quit [Ping timeout: 258 seconds]
20:54 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
20:56 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
21:03 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:04 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:07 -!- missttea [~miss@71.21.164.84] has joined #openvpn
21:08 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has joined #openvpn
21:09 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Read error: Connection reset by peer]
21:09 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
21:11 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 260 seconds]
21:13 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
21:22 < missttea> !welcome
21:22 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:23 < missttea> !goal
21:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:25 < missttea> Hope I'm asking in the right manner , have a basic question .
21:27 < EugeneKay> Spit it out already
21:28 < missttea> When I connect to my openvpn server from a wireless (i/e starbucks) is the data from my laptop to the openvpn server encrypted ?
21:28 < EugeneKay> That's the definition of a VPN, yes.
21:29 < EugeneKay> OpenVPN uses SSL to secure the link, though you can do stupid things like disable it.
21:29 < missttea> I know, its a basic question...
21:29 < missttea> But sometimes I get a brain fart and ...
21:30 < missttea> Then once the data leaves the server and hits the internet , no encryption ?
21:31 < EugeneKay> I presume you're using OpenVPN to gateway all your traffic?
21:32 < missttea> Yes, and everything up to this point works great..  Just need to iron out my thinking process. 
21:32 < EugeneKay> Yup. That's how it works.
21:34 < missttea> But any client on the lan that connects between nodes using the openvpn server is encrypted.. 
21:35 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
21:36 < missttea> cool,  thanks ...  
21:39 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
21:57 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
21:57 <@vpnHelper> RSS Update - forum: TAP-Win32 driver at least version 9.8 vs 9.00.00.8 <http://forums.openvpn.net/topic8411.html#p13645>
21:59 -!- missttea [~miss@71.21.164.84] has quit [Quit: Leaving]
22:19 -!- EugeneKay is now known as EugeneKaway
22:22 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Read error: Operation timed out]
22:24 -!- AxeMAN [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:25 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
22:27 -!- EugeneKaway is now known as EugeneKay
22:28 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 258 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:48 -!- lawnchair [zdonkf@dopecheck.com] has joined #openvpn
22:49 -!- lawnchair [zdonkf@dopecheck.com] has left #openvpn []
23:16 <@vpnHelper> RSS Update - forum: Server not pushing correct routing information <http://forums.openvpn.net/topic8448.html>
23:23 -!- EugeneKay is now known as EugeneKaway
23:32 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
23:34 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 252 seconds]
23:37 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has quit []
23:46 <@vpnHelper> RSS Update - forum: Server not pushing correct routing information <http://forums.openvpn.net/topic8448.html#p13647>
--- Day changed Thu Jul 14 2011
00:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:58 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
00:58 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
00:58 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
01:00 -!- aarcane_ [~aarcane@c-98-238-138-177.hsd1.ca.comcast.net] has joined #openvpn
01:02 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
01:03 -!- aarcane [~aarcane@c-98-238-138-177.hsd1.ca.comcast.net] has quit [Ping timeout: 250 seconds]
01:04 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
01:04 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
01:07 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
01:08 -!- mode/#openvpn [+o vpnHelper] by ChanServ
01:22 -!- aarcane_ [~aarcane@c-98-238-138-177.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
01:22 -!- aarcane_ [~aarcane@c-98-238-138-177.hsd1.ca.comcast.net] has joined #openvpn
01:24 -!- havoc [~havoc@neptune.chaillet.net] has quit [Read error: Operation timed out]
01:24 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
01:31 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:33 -!- dazo_afk is now known as dazo
01:36 < adelas> anybody know some free netowkring diagraming tools?
01:38 <@vpnHelper> RSS Update - forum: Traffic not routing to the internet after arriving on tun0 <http://forums.openvpn.net/topic8449.html>
01:49 -!- K1ng [~KING@180.211.188.148] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
01:52 -!- K1ng [~KING@180.211.188.148] has joined #openvpn
02:02 <@vpnHelper> RSS Update - forum: Traffic not routing to the internet after arriving on tun0 <http://forums.openvpn.net/topic8449.html#p13649>
02:18 -!- himbeere [~jwk@213.252.153.197] has joined #openvpn
02:34 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
02:35 -!- bauruine_ [~stefan@217.150.234.195] has quit [Read error: Operation timed out]
03:07 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
03:09 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
03:09 -!- Cain` is now known as Cain
03:11 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
03:12 -!- troyt [~troyt@2001:55c:43a6:444b::1] has quit [Ping timeout: 260 seconds]
03:14 -!- troyt [~troyt@2001:55c:43a6:444b::1] has joined #openvpn
03:17 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
03:17 -!- mode/#openvpn [+o vpnHelper] by ChanServ
03:37 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Read error: Connection reset by peer]
03:44 -!- snappy [~nipnop@wbml.net] has joined #openvpn
03:44 -!- snappy [~nipnop@wbml.net] has quit [Changing host]
03:44 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
03:54 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:00 < himbeere> Install required virtueal network drivers for OpenVPNPortable?
04:02 < himbeere> Error by installing virtual network drivers. 
04:02 < himbeere> What can I do have no admin rights
04:03 < reiffert> get some
04:03 -!- kempo [~worker@p57A65D36.dip.t-dialin.net] has joined #openvpn
04:03 < kempo> hello
04:04 < himbeere> i cant get
04:05 < kempo> i  have to setup a openvpn connection on windows, but only received the .key and .pem
04:05 < kempo> dont i also have to get a .crt?
04:06 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
04:21 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
04:21 -!- mode/#openvpn [+v s7r] by ChanServ
04:22 < himbeere> can i use a linux.iso to get admin rights with cmd.exe?
04:24 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
04:25 < reiffert> there are several linux boot/rescue images that will get the 3des md4 crypted password out of a windows box and there are several rainbow table services to crack it.
04:25 < reiffert> an alternative approach will be resetting the admin password with a boot/rescue linux image (e.g. with one that was made for that job)
04:26 <+s7r> there is an .iso which you burn on a cd, boot from it and you can change / delete the password to any account in win XP, vista, 7
04:27 <+s7r> they say it works for server 2003 and 2008 also but i didn't test it with these OS. I tested it with visa and 7 and it worked just fine
04:27 <+s7r> took 2 minutes the entire process
04:29 < reiffert> if dont want to loose the original password, take a rainbow cracking service. it will last 3-4 days if you refuse to pay their service. else it's done in 10-20 minutes
04:29 < reiffert> if +you
04:30 <+s7r> yeah there are many services like reiffert says ... they decrypt the password and you will get the original admin passwd
04:31 <+s7r> what I suggested takes 1 - 2 minutes but it can: 1) remove your admin password permanently and leave blak or 2) change the password to the one you want - but you won't know the old password
04:33 < reiffert> and the company admin might punish you afterwards.
04:37 < himbeere> it is to dangerous for me ??? is the admin password lost if i create a new password?
04:37 < himbeere> i use vista 64bit
04:40 <@dazo> not sure what happens if you have encrypted volumes and wipe/change the password with non-Microsoft tools
04:40 < himbeere> i have to pay for that service??? which service is it ? do you have an url?
04:43 < himbeere> i have to translat punish do you speak german?
04:43 <@dazo> google rainbow cracking service?
04:43 -!- luneff [~yury@84.51.213.254] has quit [Quit: This computer has gone to sleep]
04:43 < reiffert> http://dict.leo.org/?punish
04:43 <+s7r> heil Hitler
04:43 <+s7r> :)
04:43 < reiffert> sauerkraut
04:43 <@dazo> s7r: hey!  that's not funny!
04:43 <+s7r> just joking
04:43 <@dazo> It's still not funny
04:44 < reiffert> dazo: of course it is funny.
04:44  * dazo disagrees
04:44 < reiffert> dazo: take a look at harry
04:44 <+s7r> himbeere crack the admin password with a bootable cracker ... and put a new one
04:44 < reiffert> http://seanssabbatical.com/wp-content/uploads/2010/10/prince_harry_naziCrop2.jpg
04:45 <@dazo> reiffert: it's tasteless stupidity in my eyes
04:45 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
04:46 < himbeere> i use dict.cc
04:51 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
04:51 -!- mode/#openvpn [+o vpnHelper] by ChanServ
05:02 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
05:15 -!- luneff [~yury@46.41.113.150] has joined #openvpn
05:21 <@vpnHelper> RSS Update - forum: Traffic not routing to the internet after arriving on tun0 <http://forums.openvpn.net/topic8449.html#p13652> || Server not pushing correct routing information <http://forums.openvpn.net/topic8448.html#p13651>
05:25 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:27 <@vpnHelper> RSS Update - forum: Can't access/ping Windows 7 x64 client's LAN. <http://forums.openvpn.net/topic8437.html#p13655> || OpenVPN routing to remote network <http://forums.openvpn.net/topic8447.html#p13654>
05:36 -!- luneff [~yury@46.41.113.150] has quit [Ping timeout: 255 seconds]
05:37 <@vpnHelper> RSS Update - forum: Help configuring firewall with OpenVPN support <http://forums.openvpn.net/topic8436.html#p13656>
05:41 -!- luneff [~yury@46.41.113.150] has joined #openvpn
05:52 -!- harry [d5fc99c5@gateway/web/freenode/ip.213.252.153.197] has joined #openvpn
05:52 -!- harry is now known as Guest13217
05:53 < Guest13217> An expression of contempt.
06:00 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has quit [Ping timeout: 258 seconds]
06:03 -!- kempo_ [~worker@p57A642A9.dip.t-dialin.net] has joined #openvpn
06:06 -!- kempo [~worker@p57A65D36.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
06:09 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
06:10 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has joined #openvpn
06:11 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Ping timeout: 258 seconds]
06:13 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has joined #openvpn
06:14 -!- AxeMAN [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:14 -!- AxeMAN [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:14 -!- AxeMAN [~axeman3@openvpn/user/axeman] has joined #openvpn
06:14 -!- mode/#openvpn [+v AxeMAN] by ChanServ
06:18 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has quit [Ping timeout: 252 seconds]
06:22 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
06:22 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
06:22 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
06:22 <@vpnHelper> RSS Update - forum: Client to client behind iptables <http://forums.openvpn.net/topic8450.html>
06:34 -!- AxeMAN [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
06:35 -!- AxeMAN [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:35 -!- AxeMAN [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:35 -!- AxeMAN [~axeman3@openvpn/user/axeman] has joined #openvpn
06:35 -!- mode/#openvpn [+v AxeMAN] by ChanServ
06:38 -!- himbeere [~jwk@213.252.153.197] has left #openvpn ["Leaving."]
06:40 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has joined #openvpn
06:42 -!- AxeMAN [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:44 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has quit [Ping timeout: 250 seconds]
06:45 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
07:10 -!- mtbf [~in9836@89-76-9-252.dynamic.chello.pl] has joined #openvpn
07:13 < mtbf> Hello. I have a connection between two linux hosts, with 2.1 on server and 2.2 on client, which worked fine to some time and then broken 'itself',
07:13 < mtbf> iptables is flushed, policies are set to accept, client gets ip from the ccd
07:13 < mtbf> but there is no connectivity between them.
07:14 < mtbf> When i run wireshark on the tun0 interface on the server i see only sent packets, but no responses at all, from both sides,
07:15 < mtbf> nothing interesting in openvpn.log, client is visible in openvpn-status.log, nothing related in dmesg.
07:15 < mtbf> How can i debug it further?
07:16 < mtbf> And routing tables are also fine, i forgot to mention.
07:18 -!- BlakHawk [blackhawk@69.42.219.141] has quit [Read error: Connection reset by peer]
07:23 < mtbf> http://pastie.org/2212156 here is my server config, by the way, i have another three linux clients connected to it, from which two work fine, and one has the same issue.
07:23 < ecrist> mtbf: openvpn doesn't "break itself"
07:24 < mtbf> That's why i written it in quotes.
07:24 <@dazo> it doesn't even happen, even if it's in quotes ;-)
07:25 < mtbf> I just described, how it looked, cause i don't have any idea, what caused the change in the system/openvpn installation, i don't even remember the exact date.
07:26 <@dazo> mtbf: check that the clocks are in sync and that the certificates have not expired
07:26 <@dazo> and please, pastebin logs with --verb 4
07:26 < mtbf> Ok.
07:26 <@dazo> with --verb 1, the logs never shows much interesting when debugging issues
07:27 < mtbf> Right, i switched it yesterday, previously was 4 or 5, previously ten, i was looking for good tune to see the problem.
07:28 < mtbf> Just give me a moment.
07:28 -!- greenmang0 [~greenmang@unaffiliated/greenmang0] has quit [Read error: Connection reset by peer]
07:41 -!- luneff [~yury@46.41.113.150] has quit [Quit: This computer has gone to sleep]
07:42 -!- luneff [~yury@46.41.113.150] has joined #openvpn
07:43 -!- luneff [~yury@46.41.113.150] has quit [Remote host closed the connection]
07:46 < mtbf> Shit, i've made a typo in the ccd about two weeks ago, i noticed it while obfuscating ips in the public version of log, lol
07:46 < mtbf> thanks for your input.
07:52 -!- luneff [~yury@46.41.113.150] has joined #openvpn
08:03 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
08:03 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Ping timeout: 260 seconds]
08:04 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:05 -!- AxeMAN [~axeman3@openvpn/user/axeman] has joined #openvpn
08:05 -!- mode/#openvpn [+v AxeMAN] by ChanServ
08:05 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
08:08 -!- EugeneKaway is now known as EugeneKay
08:15 <@vpnHelper> RSS Update - forum: Windows 7 Installation Fails - OpenVPN 2.2.1 <http://forums.openvpn.net/topic8445.html#p13658>
08:21 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:22 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Ping timeout: 260 seconds]
08:23 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
08:28 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
08:32 -!- dazo is now known as dazo_afk
08:32 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
08:34 -!- dazo_afk is now known as dazo
08:35 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
08:38 < ecrist> mtbf: :) told you it doesn't break 'itself'
08:47 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
08:49 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 240 seconds]
08:49 <@vpnHelper> RSS Update - forum: Information about the client connection on the server <http://forums.openvpn.net/topic8451.html>
08:51 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Client Quit]
08:53 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:58 -!- luneff [~yury@46.41.113.150] has quit [Quit: This computer has gone to sleep]
09:04 -!- EugeneKay is now known as EugeneKaway
09:08 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
09:10 -!- AxeMAN [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
09:11 -!- axeman [~dru@openvpn/user/axeman] has joined #openvpn
09:11 -!- mode/#openvpn [+v axeman] by ChanServ
09:15 -!- axeman [~dru@openvpn/user/axeman] has quit [Quit: leaving]
09:16 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
09:16 -!- mode/#openvpn [+v Axeman] by ChanServ
09:16 -!- EugeneKaway is now known as EugeneKay
09:20 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
09:20 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
09:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:22 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
09:25 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
09:25 -!- K1ng [~KING@180.211.188.148] has quit [Ping timeout: 276 seconds]
09:27 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 252 seconds]
09:28 -!- maxagaz [~maxagaz@89.108.151.226] has quit [Ping timeout: 240 seconds]
09:28 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
09:37 <@vpnHelper> RSS Update - forum: OpenVPN Setup Problems <http://forums.openvpn.net/topic8452.html>
09:42 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has quit [Quit: Linkinus - http://linkinus.com]
09:42 -!- maxagaz [~maxagaz@89.108.151.226] has joined #openvpn
09:43 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has joined #openvpn
09:49 -!- Guest13217 [d5fc99c5@gateway/web/freenode/ip.213.252.153.197] has quit [Quit: Page closed]
09:49 <@vpnHelper> RSS Update - forum: Daily slow downs <http://forums.openvpn.net/topic8453.html>
09:53 -!- WilcoRogers_ [8368992a@gateway/web/freenode/ip.131.104.153.42] has joined #openvpn
09:53 < WilcoRogers_> I've got some VPN setup problems - anyone willing to help?
09:54 < Riz> Post your problem, if someone feels they can help, they will.
09:54 < Riz> !welcome
09:54 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:54 < Riz> !goal
09:54 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:56 < WilcoRogers_> I am trying to set up a small office VPN, containing several workstations and a server with multiple VMs. I'm having trouble wrapping my head around all the routing/bridging.
09:57 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
09:57 < Riz> Well you would eather be routing or bridging. So you have to pick one method
09:58 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has joined #openvpn
09:58 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 240 seconds]
09:58 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
09:59 <+Axeman> me too WilcoRogers_  best bet try the routing first; if that doesn't do it for you try bridging
09:59 < WilcoRogers_> Well I would like all the computers to be able to talk to each other, and to all the VMs. All the web traffic can go through the VPN server. I figured routing would be the best option.
10:00 < WilcoRogers_> I'm stuck on the routing, though. My client can connect, gets an IP, but is being assigned a random default gateway. It can ping the VPN server, but the server cannot ping back.
10:00 < Riz> the VPN server can not ping the client?
10:01 < WilcoRogers_> No. The client gets assigned 10.8.0.6, and the server is unable to ping that.
10:01 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 250 seconds]
10:01 -!- WilcoRogers [836809dc@gateway/web/freenode/ip.131.104.9.220] has joined #openvpn
10:02 < WilcoRogers> Sorry. I had to switch computers
10:02 < Riz> Checked your firewall? 
10:02 -!- WilcoRogers_ [8368992a@gateway/web/freenode/ip.131.104.153.42] has quit [Quit: Page closed]
10:02 < WilcoRogers> On the server?
10:02 < Riz> On both sides.
10:02 < WilcoRogers> ufw is open - it would have to be for me to be able to ping the server - I'll check the windows one
10:03 < Riz> if it's vista or higher, by default they will not reply to icmp
10:03 < WilcoRogers> it's XP
10:03 < Riz> can the XP ping the vpn server and get a reply?
10:04 < WilcoRogers> yes - the XP pings 10.8.0.1 (the gate, I imagine) and gets a reply. However, XP thinks the "default gateway" setting is 10.8.0.5
10:04 < Riz> yeah, that's correct
10:04 < Riz> your tunnel is working fine, just xp is dropping incoming icmp
10:04 < Riz> !/30
10:04 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
10:06 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
10:06 < WilcoRogers> ah, so the .5 IP comes from the virtual IP setting
10:07 < WilcoRogers> I opened up the port (udp?) and I am still unable to ping the client from the server
10:08 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has quit [Ping timeout: 252 seconds]
10:08 < Riz> still your firewall....
10:08 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 250 seconds]
10:09 < WilcoRogers> Ah - I turned the firewall off, and It's good now
10:09 < WilcoRogers> why didn't adding an exception work?
10:09 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has joined #openvpn
10:10 < WilcoRogers> okay, so I have ping traffic both ways between server and client
10:10 < WilcoRogers> but no actual internet traffic
10:13 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:13 < WilcoRogers> do a push a route from 10.8.0.1 to 10.8.0.5?
10:14 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 260 seconds]
10:14 -!- MarKsaitis__ [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
10:15 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has quit [Quit: Linkinus - http://linkinus.com]
10:16 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 258 seconds]
10:18 < Riz> you would need todo 2 things
10:19 < Riz> 1, push the router for the LAN to your client via the vpn server config. 2. configure the server to route OR nat the packets from vpn clients to the rest of the lan. 3. IF routing the packets from the vpn server, ensure they LAN systems know how to reach the 10.8.0.x network 
10:20 < Riz> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
10:20 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
10:24 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html>
10:24 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
10:26 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
10:26 -!- MarKsaitis__ [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 264 seconds]
10:28 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
10:30 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
10:33 -!- luneff [~yury@93.178.87.165] has joined #openvpn
10:33 < WilcoRogers> Riz, I'm not using a router at all - perhaps this is all complicated because this is all happening inside a campus network.
10:39 < WilcoRogers> Shouldn't matter, however - I just treat them as an ISP
10:39 -!- mattock [~mattock@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
10:39 -!- mattock [~mattock@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Changing host]
10:39 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:39 -!- mode/#openvpn [+o mattock] by ChanServ
10:41 -!- gyyrog [~gyyrog@71-13-67-85.static.aldl.mi.charter.com] has joined #openvpn
10:42 <+Axeman> WilcoRogers, could it be that your ITS has control on the network preventing this? 
10:42 -!- baccenfutter [~backenfut@c-base/crew/baccenfutter] has left #openvpn []
10:43 < WilcoRogers> I'm not sure - they don't prevent much of anything, though. If I can set up a connection between the VPN client and the server, I should be able to get other machines to do the same
10:45 < WilcoRogers> and, once the client is connected, I should be able to route ALL traffic over the VPN. I want it so that if the client is connected to the VPN, the traffic from the computer goes through the VPN server, and out to the www if neccesary
10:45 < Bushmills> !redirect
10:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
10:46 < WilcoRogers> !def1
10:46 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
10:46 <@vpnHelper> RSS Update - forum: Information about the client connection on the server <http://forums.openvpn.net/topic8451.html#p13663>
10:47 < WilcoRogers> !nat
10:47 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
10:52 < WilcoRogers> I tried the tutorial, but I am still unable to get the traffic from the client to reach the internet
10:53 < Bushmills> windows client?
10:53 < WilcoRogers> Yes
10:53 < Bushmills> !winroute
10:53 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
10:53 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
10:56 < WilcoRogers> what does (#1) even mean? Just add "route-method exe" to my server config file? or the client config file?
10:58 < Bushmills> for the client - that's after all the machine where adding routes may have failed.  you can confirm whether that's the problem by looking at client's routes
10:59 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
11:01 < WilcoRogers> okay so adding that into the config didn't work
11:01 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 252 seconds]
11:01 < WilcoRogers> my "active routes" table is huge
11:01 < WilcoRogers> and I'm not quite sure how to interpret it
11:02 < Bushmills> just the routes through the vpn interface, and one to the vpn server, are of interest
11:03 <+Axeman> mine too WilcoRogers i want to cleare it out and start over! 
11:04 < WilcoRogers> agreed - I think it's all the iptable adding i've done
11:04 < WilcoRogers> And I have to go for lunch...
11:04 < WilcoRogers> !lunch
11:05 <+Axeman> lol 
11:05 < WilcoRogers> I'll be back in the hour Axeman if you want to keep hacking away
11:05 < Bushmills> !beer
11:05 < WilcoRogers> prolly
11:05 <+Axeman> i'm on the AS side WilcoRogers don't know much about either tho :(
11:08 -!- MarKsaitis__ [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
11:10 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 250 seconds]
11:14 -!- gyyrog [~gyyrog@71-13-67-85.static.aldl.mi.charter.com] has quit [Remote host closed the connection]
11:22 <@vpnHelper> RSS Update - forum: Help configuring firewall with OpenVPN support <http://forums.openvpn.net/topic8436.html#p13664>
11:24 -!- twister004_ [~chatzilla@117.204.135.114] has joined #openvpn
11:24 < WilcoRogers> Okay, I'm back
11:26 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 258 seconds]
11:26 -!- twister004_ is now known as twister004
11:26 -!- luneff [~yury@93.178.87.165] has quit [Quit: This computer has gone to sleep]
11:27 < WilcoRogers> This shouldn't be so difficult. There should be something simple to "Route all incoming internet-bound traffic to the internet"
11:32 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
11:34 -!- MarKsaitis__ [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 263 seconds]
11:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:38 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:51 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 264 seconds]
11:53 -!- twister004 [~chatzilla@117.204.135.114] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
11:56 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
11:57 < WilcoRogers> okay - I've changed things.
11:57 < WilcoRogers> !goal
11:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:58 < Bushmills> but there is. which is ...
11:58 < Bushmills> !redirect
11:58 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
11:58 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 264 seconds]
11:58 < Bushmills> routing and masquerading is an OS thing, not an openvpn thing.
11:58 < WilcoRogers> Would it be simpler to have VPN traffic handled by the VPN, and internet traffic handled separate?
11:59 < Bushmills> well, that's as it comes default, without setting up routing all through vpn
11:59 < Bushmills> i.e. no redirect-gateway
12:00 < WilcoRogers> okay - but if I pull out the redirect gateway, is there still something I need to do with my client to make sure it does internet talk through the original connection?
12:00 < Bushmills> if you pull out redirect-gateway, your client won't send non-vpn traffic through vpn
12:01 < WilcoRogers> okay, so I got rid of the redirect gateway, and reloaded the VPN connection. I am still unable to ping google (for example)
12:02 < WilcoRogers> from the client
12:02 < WilcoRogers> are there more config options I might be missing?
12:03 < Bushmills> unless your client suffers from conflicting ip addresses, for example by your gateway having an ip address in the same subnet as your vpn, that problem doesn't seem to be related to openvpn.
12:04 < Bushmills> only other thing i could think of is that you're pushing a name server to client which can't be reached, and resulting in client not able to resolve host names 
12:06 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Remote host closed the connection]
12:06 < WilcoRogers> I think the latter is the problem
12:07 < WilcoRogers> when I disconnect the VPN there's no problems
12:08 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
12:08 < Bushmills> that's easy to confirm, by trying to contact remote host by ip address rather than by host name
12:09 < WilcoRogers> No dice. I pinged google by ip (74.125.226.48) and get no response
12:10 < WilcoRogers> I disconnected the VPN and pinged that IP again, and it responds fine
12:11 < WilcoRogers> So somehow the VPN is sucking up the request and losing it
12:11 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
12:11 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Quit: Leaving]
12:12 < Bushmills> check with tracert 74.125.226.48  where the packets go
12:12 <@vpnHelper> RSS Update - forum: Windows 7 Installation Fails - OpenVPN 2.2.1 <http://forums.openvpn.net/topic8445.html#p13665>
12:13 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 260 seconds]
12:13 <+Axeman> WilcoRogers,  i wasn't fully paying attention - but doesn' the UI have an option to route all traffic thru vpn or not ?
12:13 < WilcoRogers> 1 1 ms 1 ms 1 ms 10.8.0.1
12:13 < WilcoRogers> 2 * * * Request timed out
12:13 < WilcoRogers> the rest is the same, of course
12:13 < Bushmills> that's your vpn server?
12:14 < WilcoRogers> Yep
12:14 < Bushmills> so you still have a route, sending your stuff through vpn 
12:14 < WilcoRogers> Do I have to restart the VPN server?
12:15 < Bushmills> after removing --redirect-gateway?
12:15 < WilcoRogers> yes
12:15 < Bushmills> naturally
12:16 < WilcoRogers> Man I feel like an idiot - I can ping both google (DNS) and the VPN now
12:17 < WilcoRogers> So now If I throw another computer up there with the same settings, I should be able to talk all over the place?
12:18 < Bushmills> Axeman: routing traffic through openvpn alone won't do - the server needs to be setup to forward the traffic to internet, which WilcoRogers neglected to do.
12:19 < WilcoRogers> Yes - though after some though I realize that that's a service I don't really need, especially given the performance drop I'll experience if I get all the traffic to go though the VPN
12:20 -!- WilcoRogers_ [8368992a@gateway/web/freenode/ip.131.104.153.42] has joined #openvpn
12:20 < WilcoRogers_> Swapping computers again
12:21 <+Axeman> i think the AS does that ...
12:21 < Bushmills> but this is not the access server support channel. it is openvpn channel.
12:22 <+Axeman> ya - just saying... if he really wants to do that, maybe look at AS. 
12:22 < Bushmills> that's a two line configuration
12:22 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:22 < WilcoRogers> Okay - thanks for your help so far :)
12:23 <+Axeman> sorry - don't know much just graspin at straws on your behalf
12:24 <+s7r> !fbsdnat
12:24 <@vpnHelper> "fbsdnat" is see http://cavanantha.wordpress.com/2007/09/16/nat-on-freebsd-using-pf/ for a basic howto for NAT on FreeBSD
12:24 <+s7r> someone with access to vpnHelper , this link needs to be modified it's not working
12:24 <+s7r> Error 404 - Not Found
12:24 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
12:25 < Bushmills> talk to krzie when he's around
12:26 -!- WilcoRogers [836809dc@gateway/web/freenode/ip.131.104.9.220] has quit [Quit: Page closed]
12:32 -!- luneff [~yury@84.51.213.254] has joined #openvpn
12:35 -!- EugeneKay is now known as EugeneKaway
12:41 < Riz> s7r, if you couldn't find that article, it's here: http://saviordecav.wordpress.com/2007/09/16/nat-on-freebsd-using-pf/
12:41 <@vpnHelper> Title: NAT on FreeBSD using PF « Savior de Cav (at saviordecav.wordpress.com)
12:43 -!- petan [~peter@ip-85-160-209-66.eurotel.cz] has joined #openvpn
12:45 < petan> hi I have a box which has been running for few month with working server and now I can't get it working again
12:45 < petan> I can connect and ping router and server
12:45 < petan> but not other machines on net
12:45 < petan> forwarding is enabled and routing is set up on router
12:45 < hyper_ch> !configs
12:45 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
12:46 < petan> it's ubuntu
12:47 < petan> hyper_ch was it to me? :)
12:48 < petan> if so, server is here http://pasteit.com/2551
12:49 < petan> keys were removed so it's not that long but problem is not in that
12:49 < hyper_ch> !tunortap
12:49 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
12:49 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
12:50 < petan> well, could you tell me if this was to me and why do you think it has anything to do with this problem it was working ok
12:51 < petan> it just stopped today when I changed router
12:51 < petan> and rebooted
12:51 < petan> I don't know if problem is in router or system
12:51 < petan> there was power outage which destroyed router I've been using
12:52 < petan> but configuration of routing is same
12:52 < petan> also I can ping remote router and server when I connect over vpn
12:53 < petan> with no problems
12:53 < petan> but I can't ping any other machine running there
12:57 -!- missttea [~miss@71.21.164.84] has joined #openvpn
12:58 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:59 < petan> anyone
12:59 < missttea> anyone using openvpn on android ?
12:59 <@vpnHelper> RSS Update - forum: Client to client behind iptables <http://forums.openvpn.net/topic8450.html#p13667> || Information about the client connection on the server <http://forums.openvpn.net/topic8451.html#p13666> || Server not pushing correct routing information <http://forums.openvpn.net/topic8448.html>
13:02 -!- missttea [~miss@71.21.164.84] has quit [Quit: Leaving]
13:02 -!- grendal_prime [~sgraham@2001:470:822a:200:21e:c9ff:fe07:bb9] has joined #openvpn
13:02 < grendal_prime> oi brothers!
13:03 < grendal_prime> ecrist, question for ya.
13:03 < grendal_prime> remember some time back i was talking to you about  a crazy 500+ node network that was all done with tap interfaces...
13:03 < grendal_prime> well things have slowed down and now im back goofing around with that thing.
13:04 < petan> !welcome
13:04 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:04 < petan> !goal
13:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:05 < grendal_prime> anyway.  I have a better understanding of how and what they are doing with this thing...(not toatal disclosure but you know more info)  And im running into an issue with identifying....oh ok
13:05 < petan> !route
13:05 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
13:05 < grendal_prime> i have 300 machines taped and brided to a network behind the vpn server.  I need to identify the ip address that was assigend to a specify box.
13:06 < grendal_prime> they all use the same key
13:06 < hyper_ch> grendal_prime: ipp.txt
13:06 < hyper_ch> !ipp
13:06 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
13:08 -!- petan [~peter@ip-85-160-209-66.eurotel.cz] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- IRC with a difference]
13:09 < grendal_prime> its empty.  I need to enable it in the config im assuming.
13:09 < grendal_prime> !iporder
13:09 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
13:09 <@vpnHelper> RSS Update - forum: Server not pushing correct routing information <http://forums.openvpn.net/topic8448.html#p13668>
13:17 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:18 < ecrist> grendal_prime: answer for you.
13:19 < grendal_prime> thanks
13:19 < ecrist> you need a status log
13:21 < ecrist> or, create a client-connect script to log it
13:31 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
13:33 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
13:38 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
13:41 <@vpnHelper> RSS Update - forum: DD-WRT OpenVPN setup troubles <http://forums.openvpn.net/topic8455.html>
13:41 -!- grendal_prime [~sgraham@2001:470:822a:200:21e:c9ff:fe07:bb9] has quit [Ping timeout: 260 seconds]
13:50 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
13:51 <@vpnHelper> RSS Update - forum: DD-WRT OpenVPN setup troubles <http://forums.openvpn.net/topic8455.html#p13670>
13:52 -!- EugeneKaway is now known as EugeneKay
14:18 <@vpnHelper> RSS Update - forum: OpenVPN Behind a Cable Modem <http://forums.openvpn.net/topic8456.html>
14:20 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
14:23 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:36 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
14:40 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:27 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:33 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:33 -!- mode/#openvpn [+v s7r] by ChanServ
15:50 -!- bauruine [~stefan@217.150.231.196] has joined #openvpn
15:50 -!- dazo is now known as dazo_afk
15:59 < grendal_prime>  ecrist, ya i have a status log.  but..i dont think that has the info i need in it..can i specify what goes into that thing?
16:33 < Bushmills> "I need to identify the ip address that was assigend..."  that can be found in status file
16:34 < Bushmills> use status-version 3 for better parseability
16:37 < Bushmills> ah. you only "think" is hasn't got the info. looking beats thinking, in this case
16:45 -!- BlakHawk [blackhawk@udp.packetlabs.net] has joined #openvpn
16:56 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
16:57 <+s7r> wtfffffffffffff
16:57 <+s7r> guys look here http://www.protv.ro/video/happy-hour_busty-a-mai-spart-niste-pepeni-de-dabuleni_15533.html
16:57 <@vpnHelper> Title: Busty a mai spart niste pepeni de Dabuleni | Happy Hour (at www.protv.ro)
16:57 <+s7r> this woman should be shot
16:59 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 250 seconds]
16:59 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
17:01 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
17:03 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
17:05 -!- testing-2 [~testing-3@dkpix.brightpoint.dk] has quit [Read error: Operation timed out]
17:14 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:14 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:14 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:14 -!- mode/#openvpn [+v Axeman] by ChanServ
17:14 -!- testing [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
17:16 -!- maxagaz [~maxagaz@89.108.151.226] has quit [Ping timeout: 250 seconds]
17:17 -!- maxagaz [~maxagaz@89.108.151.226] has joined #openvpn
17:21 -!- testing [~testing-3@dkpix.brightpoint.dk] has quit [Ping timeout: 258 seconds]
17:21 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:21 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
17:22 -!- testing [~testing-3@dkpix.brightpoint.dk] has joined #openvpn
17:25 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:25 -!- mode/#openvpn [+v Axeman] by ChanServ
17:28 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
17:32 -!- Asem [~a1@xymon.spirulasystems.com] has joined #openvpn
17:35 -!- maxagaz [~maxagaz@89.108.151.226] has quit [Ping timeout: 240 seconds]
17:40 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
17:50 -!- maxagaz [~maxagaz@89.108.151.226] has joined #openvpn
17:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
18:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:13 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
18:14 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
18:24 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
18:24 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
18:35 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:39 -!- moamahi [~moamahi@host29-50-static.12-87-b.business.telecomitalia.it] has joined #openvpn
18:43 < moamahi> hi all, I'm trying to compile openvpn 2.2.1 on a 7 64bit system. I used https://community.openvpn.net/openvpn/wiki/BuildingOnWindows this. Now I'm stopped at this point. Lounch win/config_ti.py and I get: IOError: [Errno 13] Permission denied: 'C:\\Users\\ptavant-ovpn\\Desktop\\tools\
18:43 < moamahi> \compile-root\\tapinstall\\7600\\sources'
18:43 <@vpnHelper> Title: BuildingOnWindows – OpenVPN Community (at community.openvpn.net)
18:44 < moamahi> I found this http://sourceforge.net/mailarchive/forum.php?thread_name=4DA80295.9070305%40topphemmelig.net&forum_name=openvpn-devel
18:44 <@vpnHelper> Title: SourceForge.net: OpenVPN: openvpn-devel (at sourceforge.net)
18:44 < moamahi> but now I'm going to read community.openvpn.net ...
18:45 < reiffert> sounds like something is trying to test/installing something that requires admin rights
18:45 < reiffert> try with #openvpn-devel btw
18:46 < reiffert> feel free to stay at this place, but #openvpn-devel might be a place to find some devs
18:47 < moamahi> reiffert, the directory is everyone access, write and read, it looks like a problem in something it can't open becouse it is not there, btw going to openvpn-devel Thank you
18:55 -!- K1ng` [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
19:03 -!- K1ng [~KING@180.211.188.148] has joined #openvpn
19:18 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
19:20 -!- maxagaz [~maxagaz@89.108.151.226] has quit [Read error: Operation timed out]
19:21 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
19:23 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
19:23 -!- mode/#openvpn [+o raidz] by ChanServ
19:30 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
19:35 -!- maxagaz [~maxagaz@89.108.151.226] has joined #openvpn
19:42 -!- Asem [~a1@xymon.spirulasystems.com] has quit [Ping timeout: 258 seconds]
19:59 -!- kempo_ [~worker@p57A642A9.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
20:06 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 252 seconds]
20:06 -!- kempo [~worker@p57A642A9.dip.t-dialin.net] has joined #openvpn
20:07 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
20:14 -!- master_of_master [~master_of@p57B529DF.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:17 -!- master_of_master [~master_of@p57B52AF0.dip.t-dialin.net] has joined #openvpn
20:57 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
20:57 -!- mode/#openvpn [+v Axeman] by ChanServ
21:00 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
21:03 -!- EugeneKay is now known as EugeneKaway
21:03 -!- EugeneKaway is now known as EugeneKay
21:24 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
21:28 -!- EugeneKay is now known as EugeneKaway
21:28 -!- EugeneKaway is now known as EugeneKay
21:40 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 276 seconds]
21:48 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
22:02 -!- aarcane_ [~aarcane@c-98-238-138-177.hsd1.ca.comcast.net] has quit [Quit: Leaving]
22:42 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
22:44 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:44 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:46 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:46 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:46 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:47 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:49 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:00 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
23:00 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
23:00 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:51 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Ping timeout: 260 seconds]
23:58 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has quit [Read error: Connection reset by peer]
23:58 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
--- Day changed Fri Jul 15 2011
00:06 -!- root [~evaldo@freenode/staff-emeritus/udontknow] has quit [Ping timeout: 240 seconds]
00:07 -!- root [~evaldo@freenode/staff-emeritus/udontknow] has joined #openvpn
00:19 -!- EugeneKay is now known as EugeneKaway
00:43 -!- wizzr [~wizzr@pluto.curedebtnow.com] has joined #openvpn
00:43 < wizzr> openvpn isn't working
00:43 < wizzr> and i'm sure nobody is around in here to help
00:47 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Quit:  I love my HydraIRC -> http://www.hydrairc.com <-]
01:18 -!- mtbf [~in9836@89-76-9-252.dynamic.chello.pl] has quit [Quit: Lost terminal]
01:27 -!- moamahi [~moamahi@host29-50-static.12-87-b.business.telecomitalia.it] has quit [Quit: Sto andando via]
01:42 -!- luneff [~yury@84.51.213.254] has quit [Quit: This computer has gone to sleep]
01:45 < jaminja> wizzr: I am around... am in EU so I'm a little bit sleepy. What's the problem? Maybe I can help ;)
01:49 <@vpnHelper> RSS Update - forum: Connect ok but I get a lot of econnrefused and ehostunreach <http://forums.openvpn.net/topic7703.html#p13672>
01:53 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
01:55 <@vpnHelper> RSS Update - forum: [Solved] Client to client behind iptables <http://forums.openvpn.net/topic8450.html#p13673>
01:58 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
02:02 -!- pr0z0id [~pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
02:05 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 246 seconds]
02:07 -!- bauruine [~stefan@217.150.231.196] has quit [Read error: Connection reset by peer]
02:08 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:39 < Mowee> Morning
02:42 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
02:42 -!- maxagaz [~maxagaz@89.108.151.226] has quit [Ping timeout: 260 seconds]
02:53 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:54 -!- maxagaz [~maxagaz@213.175.164.194] has joined #openvpn
03:06 -!- dazo_afk is now known as dazo
03:07 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
03:09 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
03:09 -!- Cain` is now known as Cain
03:15 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
03:16 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
03:17 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
03:46 -!- moamahi [~moamahi@posta.amt.it] has joined #openvpn
03:50 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 252 seconds]
03:50 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
03:55 -!- jaminja [~jaminja@212.7.195.193] has quit [Remote host closed the connection]
04:09 -!- luneff [~yury@93.178.87.165] has joined #openvpn
04:10 -!- greenmang0 [~abhishek@unaffiliated/greenmang0] has joined #openvpn
04:13 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:13 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:13 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:17 -!- luneff [~yury@93.178.87.165] has quit [Ping timeout: 255 seconds]
04:19 -!- greenmang0 [~abhishek@unaffiliated/greenmang0] has quit [Ping timeout: 264 seconds]
04:21 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 250 seconds]
04:22 -!- luneff [~yury@93.178.87.165] has joined #openvpn
04:45 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
05:14 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:14 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:14 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:27 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
05:28 -!- luneff [~yury@93.178.87.165] has quit [Ping timeout: 276 seconds]
05:33 -!- luneff [~yury@109.165.106.198] has joined #openvpn
05:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:43 -!- mode/#openvpn [+v s7r] by ChanServ
05:50 <@vpnHelper> RSS Update - forum: Information about the client connection on the server <http://forums.openvpn.net/topic8451.html#p13674>
05:57 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:03 -!- kempo_ [~worker@p57A62608.dip.t-dialin.net] has joined #openvpn
06:06 -!- kempo [~worker@p57A642A9.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
06:29 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Read error: Operation timed out]
06:29 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
06:31 -!- pancake [~pancake@211.112.21.95.dynamic.jazztel.es] has joined #openvpn
06:31 < pancake> it is possible to share the same certificate for all clients?
06:36 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 260 seconds]
06:45 -!- nb [~nb@fedora/nb] has joined #openvpn
06:46 -!- CrazyGir [~jason@unaffiliated/crazygir] has quit [Ping timeout: 240 seconds]
06:46 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 252 seconds]
06:47 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
06:56 -!- CrazyGir [~jason@li14-82.members.linode.com] has joined #openvpn
06:57 -!- CrazyGir is now known as Guest8015
07:14 <@vpnHelper> RSS Update - forum: Connect ok but I get a lot of econnrefused and ehostunreach <http://forums.openvpn.net/topic7703.html#p13676> || Information about the client connection on the server <http://forums.openvpn.net/topic8451.html#p13675>
07:20 <@vpnHelper> RSS Update - forum: DD-WRT OpenVPN setup troubles <http://forums.openvpn.net/topic8455.html#p13678> || OpenVPN Behind a Cable Modem <http://forums.openvpn.net/topic8456.html#p13677>
07:21 -!- pancake [~pancake@211.112.21.95.dynamic.jazztel.es] has left #openvpn []
07:23 -!- ph1l1 [~ph1l@gprs23.swisscom-mobile.ch] has joined #openvpn
07:26 <@vpnHelper> RSS Update - forum: Please help me :( <http://forums.openvpn.net/topic8457.html>
07:27 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 265 seconds]
07:29 -!- luneff [~yury@109.165.106.198] has quit [Quit: Leaving]
07:29 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 264 seconds]
07:30 -!- takamichi [~pri@194.126.175.219] has joined #openvpn
07:32 -!- ph1l1 [~ph1l@gprs23.swisscom-mobile.ch] has quit [Read error: Connection reset by peer]
07:33 -!- [intra]lanman [~lanman@12.200.95.45] has joined #openvpn
07:33 -!- [intra]lanman [~lanman@12.200.95.45] has quit [Changing host]
07:33 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
07:41 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
08:02 -!- mete [~metefr@mete.shell.la] has quit [Ping timeout: 264 seconds]
08:06 -!- mete [~metefr@mete.shell.la] has joined #openvpn
08:08 <@vpnHelper> RSS Update - forum: Connect ok but I get a lot of econnrefused and ehostunreach <http://forums.openvpn.net/topic7703.html#p13680>
08:09 -!- testing [~testing-3@dkpix.brightpoint.dk] has quit [Ping timeout: 240 seconds]
08:16 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
08:38 -!- EugeneKaway is now known as EugeneKay
08:42 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
08:44 -!- Axeman [~axeman3@knox.pace.edu] has joined #openvpn
08:44 -!- Axeman [~axeman3@knox.pace.edu] has quit [Changing host]
08:44 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
08:44 -!- mode/#openvpn [+v Axeman] by ChanServ
08:44 <@vpnHelper> RSS Update - forum: Windows 7 Installation Fails - OpenVPN 2.2.1 <http://forums.openvpn.net/topic8445.html#p13681>
08:46 -!- gardar [~gardar@gardar.net] has joined #openvpn
08:47 < gardar> Hey guys, wondering if I can forward a openvpn to a openvpn
08:47 < gardar> I'm currently renting a openvpn vpn, and the provider only allows one connection to the vpn at a time.
08:48 < gardar> So I'm wondering if I can create a openvpn server at home, that connects to the vpn provider
08:48 < gardar> so I can connect multiple machines at once
08:48 < Riz> You could...
08:49 < Riz> but any clients connecting to your server at home would then be limited by the speed of your connections upstream
08:49 < Riz> unless they are all local within your home network, in witch case there are better options.
08:49 < Bushmills> gardar: yes.  on operating system level, an openvpn server or client looks just like a network interface
08:49 < Bushmills> so what you can do by routing through network cables, you can do with routing through openvpn too
08:49 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p13682>
08:50 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
08:50 < gardar> Riz: the machines are local... I'm thinking about connecting my desktop and laptop locally to a server, that is connected to the vpn
08:50 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
08:50 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Read error: Operation timed out]
08:51 < Riz> You can do that with some routing work
08:51 < Riz> have a system log into your vpn, then direct your LAN clients at it as their default gateway, then on the server have it NAT your clients down the tunnel
08:51 < gardar> yeah that sounds about right
08:52 < gardar> been doing that with a ssh tunnel until now
08:52 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
08:52 < Riz> I've been doing that exact thing at home for a while now for devices that need to appear as being in the USA
08:52 < Riz> My router logs into a vpn server and has rules that say from IPs in this list, route out the tunnel interface
08:53 < gardar> so it's basically just a regular openvpn server setup, and some routing tricks
08:54 < Riz> pretty much
08:54 -!- jaminja [~jaminja@212.7.195.193] has quit [Changing host]
08:54 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
08:55 < gardar> sounds simple enough, I'll give it a try tonight :)
08:57 < Riz> gl
08:58 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:58 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
09:02 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
09:10 -!- takamichi [~pri@194.126.175.219] has quit [Ping timeout: 240 seconds]
09:11 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:11 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
09:11 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
09:12 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 250 seconds]
09:13 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
09:13 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
09:20 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
09:22 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
09:22 -!- oc80 [oc80z@blea.ch] has joined #openvpn
09:25 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
09:25 -!- mode/#openvpn [+v Axeman] by ChanServ
09:29 -!- dazo is now known as dazo_afk
09:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:34 -!- WilcoRogers [83689938@gateway/web/freenode/ip.131.104.153.56] has joined #openvpn
09:35 < WilcoRogers> !welcome
09:35 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:35 < WilcoRogers> !goal I'm unable to get computers on my VPN to talk to each other. I'm connected to the VPN server, but there is no computer to computer communications
09:38 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Quit: Lost terminal]
09:38 -!- dazo_afk is now known as dazo
09:41 < Bushmills> client-to-client, or make sure server firewall doesn't block inter-client traffic, and make sure clients don't block incoming traffic from other clients
09:42 < WilcoRogers> I have the firewall off on both machines. Oddly, I am "connected to the VPN server" on machine 2, but I am unable to ping both ways
09:43 < Bushmills> if machine 2 can't ping server and vice versa, machine 1 probably can't ping machine 2
09:43 < WilcoRogers> I have an IP on machine 2 as well
09:43 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
09:43 < Bushmills> start by setting things up such that both machines can ping server, and server can ping both machines
09:44 < WilcoRogers> Yes, that's a good plan - however I've set it up the same way as machine 1, but machine 2 has no ping... the only other difference is that I'm on Win7 on Machine 2
09:44 < WilcoRogers> Hold on, I might be an idiot
09:45 -!- jaminja [~jaminja@212.7.195.193] has quit [Changing host]
09:45 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
09:46 -!- oc80 [oc80z@blea.ch] has quit [Excess Flood]
09:47 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:48 < WilcoRogers> no, after a restart (i hadn't after adding the second client) I still get no ping from machine 2
09:48 -!- dazo is now known as dazo_afk
09:54 < WilcoRogers> I can't figure out why machine 2 won't even get ping connection.
09:57 < WilcoRogers_> the only difference in the ipconfig that I can tell is that machine2 sees the DHCP server as 10.8.0.13 and machine 1 sees it as 10.8.0.5
09:58 < Bushmills> what dhcp server?
09:58 < WilcoRogers_> sorry not DHCP server
09:58 < WilcoRogers_> no yah, that's what I meant
09:58 < WilcoRogers_> in the ipconfig all that's different is the entry under "DHCP Server"
09:59 < Bushmills> what addresses are you pinging?
09:59 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
09:59 < WilcoRogers_> machine 1 (working) pings 10.8.0.1 and gets a reply
10:00 < WilcoRogers_> Should I be pinging something else?
10:01 < Bushmills> no, 0.1 is fine.
10:01 < Bushmills> well. fix machine 2
10:01 < WilcoRogers_> yes. That's the idea - I am just so limited in troubleshooting
10:03 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
10:03 < Bushmills> only information we have is that you can't ping, which doesn't allow much troubleshooting,
10:04 -!- moamahi [~moamahi@posta.amt.it] has quit [Quit: Sto andando via]
10:06 < WilcoRogers> Yeah - but what other information can I get? Pardon any of my ignorance, this is all somewhat new to me.
10:06 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:20 -!- luckman212 [~irc@2001:470:1f07:1225:8048:3812:9d88:a161] has quit [Read error: Connection reset by peer]
10:22 -!- luckman212 [~irc@2001:470:1f07:1225:8048:3812:9d88:a161] has joined #openvpn
10:24 < Bushmills> you could have examine what happens to your echo requests. are they routed to the correct interface? does server see them?
10:24 < Bushmills> examined
10:24 < Bushmills> "it doesn't work" doesn't allow for much more than "fix it"
10:27 < WilcoRogers_> I understand
10:28 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has joined #openvpn
10:28 < WilcoRogers_> The echo requests just time out
10:29 < WilcoRogers_> how can I tell what interface they're going through
10:29 < Bushmills> route,  or one of  traceroute/tracert/mtr
10:31 < WilcoRogers_> it's going through the external internet connection
10:31 < Bushmills> seems there's your problem
10:31 < WilcoRogers_> Indeed. I'm learning ;)
10:39 < WilcoRogers> Is that a config file problem? It not using the proper adapter? Or is that a system settings thign?
10:39 < WilcoRogers> *thing
10:41 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:41 -!- mode/#openvpn [+o mattock] by ChanServ
10:47 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
10:47 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:09 -!- balkee [~quassel@lan01.netmon.ADSL.mnsi.net] has joined #openvpn
11:10 < balkee> I'm trying to use openvpn to forward a port. I have my public interface eth0 with ip 1.1.1.1 and I'm forwarding port 8080 to openvpn internal IP 2.2.2.2 on tun0, but I don't see the traffic hitting the other side of the tunnel. Where am I going wrong?
11:19 < balkee> I get a successful audit on the forwarding machine, but I never see the traffic on the other side of the vpn tunnel.
11:23 < balkee> root@proxee:/var/log# tcpdump -n -vvv -i tun0
11:23 < balkee> tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
11:23 < balkee> 08:21:51.394164 IP (tos 0x0, ttl 51, id 34503, offset 0, flags [DF], proto TCP (6), length 60)
11:23 < balkee>     216.8.158.153.50751 > 10.254.254.1.22: Flags [S], cksum 0x1346 (correct), seq 1429984005, win 14600, options [mss 1300,sackOK,TS val 27233402 ecr 0,nop,wscale 7], length 0
11:23 < balkee> 08:21:54.398587 IP (tos 0x0, ttl 51, id 34504, offset 0, flags [DF], proto TCP (6), length 60)
11:23 < balkee>     216.8.158.153.50751 > 10.254.254.1.22: Flags [S], cksum 0x1219 (correct), seq 1429984005, win 14600, options [mss 1300,sackOK,TS val 27233703 ecr 0,nop,wscale 7], length 0
11:23 < balkee> i see the traffic trying to get through
11:23 < balkee> must be rejecting because it's not from 10.254.254/0
11:26 < reiffert> !winnat
11:26 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows, or (#2) http://www.nanodocumet.com/?p=14 for windows XP
11:30 < reiffert> the former url rules
11:30 < reiffert> those ones suck
11:30 < balkee> I'm not using Windows, and I don't think it's a problem with NAT. My packets are sent over the tun0 interface, but not received on the other side. Is masquerading supported?
11:31 < reiffert> !factoids search route
11:31 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
11:31 < reiffert> !winroute
11:31 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
11:31 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
11:31 < reiffert> !factoids search fwsd
11:31 <@vpnHelper> No keys matched that query.
11:31 < reiffert> !factoids search fwd
11:31 <@vpnHelper> No keys matched that query.
11:32 < reiffert> !factoids search forward
11:32 <@vpnHelper> 'winipforward', 'linipforward', 'fbsdipforward', 'linportforward', 'osxipforward', 'ipforward', and 'forwardsecurity'
11:32 < reiffert> !winipforward
11:32 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
11:32 < reiffert> ah thats the URL I was looking for
11:32 < balkee> ?
11:32 < balkee> lol
11:32 < balkee> !linportforward
11:32 <@vpnHelper> "linportforward" is (#1) to forward port 80 tcp to a vpn client, use this (replacing <SERVERIP> with the real ip of the server, and <VPNIP> with the clients VPN ip), or (#2) iptables -t nat -A PREROUTING -i eth0 -d <SERVERIP> -p tcp --dport 80 -j DNAT --to <VPNIP>, or (#3) iptables -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -i eth0 -p tcp --dport 80 -j ACCEPT
11:36 < balkee> i have these exact rules, no go
11:39 < balkee> !ipforward
11:39 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
11:43 < balkee> here is my real issue i guess
11:43 < balkee> MULTI: bad source address from client [216.8.158.153], packet dropped
11:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:58 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:01 < balkee> !snat
12:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
12:14 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:14 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:17 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
12:18 -!- Guest8015 [~jason@li14-82.members.linode.com] has quit [Changing host]
12:18 -!- Guest8015 [~jason@unaffiliated/crazygir] has joined #openvpn
12:18 -!- Guest8015 is now known as CrazyGir
12:22 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
12:23 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
12:33 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:45 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p13683>
12:58 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Ping timeout: 260 seconds]
13:00 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:01 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:03 <@vpnHelper> RSS Update - forum: OpenVPN Behind a Cable Modem <http://forums.openvpn.net/topic8456.html#p13684>
13:11 -!- luneff [~yury@84.51.213.254] has joined #openvpn
13:25 -!- maxagaz [~maxagaz@213.175.164.194] has quit [Quit: Quitte]
13:26 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:33 <@vpnHelper> RSS Update - forum: OpenVPN Setup Problems <http://forums.openvpn.net/topic8452.html#p13685>
13:39 <@vpnHelper> RSS Update - forum: Help with shares folders in WinXP with OpenVPN Server Mode <http://forums.openvpn.net/topic8388.html#p13686>
13:51 <@vpnHelper> RSS Update - forum: I will pay someone $100 to help me get my OpenVPN server up <http://forums.openvpn.net/topic8186.html#p13687>
13:55 -!- luneff [~yury@84.51.213.254] has quit [Quit: Leaving]
13:57 <@vpnHelper> RSS Update - forum: Multiple VPN connections <http://forums.openvpn.net/topic8262.html#p13688>
14:03 <@vpnHelper> RSS Update - forum: Connect to OpenVPN on Windows Login <http://forums.openvpn.net/topic8234.html#p13689>
14:05 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
14:27 <@vpnHelper> RSS Update - forum: OpenVPN, Kerio Winroute, Windows APIPA. <http://forums.openvpn.net/topic8458.html>
14:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:13 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
15:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
15:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:44 -!- snappy [~nipnop@wbml.net] has joined #openvpn
15:44 -!- snappy [~nipnop@wbml.net] has quit [Changing host]
15:44 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
15:48 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has quit [Quit: Leaving...]
15:56 -!- balkee [~quassel@lan01.netmon.ADSL.mnsi.net] has quit [Remote host closed the connection]
16:00 -!- maire [~dave@67-231-249-77.STATIC.turnkeyinternet.net] has joined #openvpn
16:07 -!- Netsplit *.net <-> *.split quits: tjz, piyokos
16:08 -!- tjz [~pc@220.255.198.23] has joined #openvpn
16:41 -!- raidz [~Administr@openvpn/corp/admin/andrew] has left #openvpn []
16:42 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
16:42 -!- mode/#openvpn [+o raidz] by ChanServ
16:51 -!- bauruine [~stefan@217.150.231.196] has joined #openvpn
17:07 -!- luneff [~yury@84.51.213.254] has joined #openvpn
17:14 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:15 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:16 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
17:23 -!- ryansch [~ryansch@S0106687f74aff9cf.cc.shawcable.net] has joined #openvpn
17:27 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:29 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
18:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:04 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
19:04 <@vpnHelper> RSS Update - forum: "Standalone" VPN server for VPS to "secure itself" <http://forums.openvpn.net/topic8459.html>
19:06 < ecrist> this channel is almost to the point where I ignore all joins parts quits
19:07  * ecrist pulls trigger
19:07 < ecrist> 19:07:41   30 #openvpn: JOINS PARTS QUITS  
19:07 < ecrist> 19:07:41   31 *!*@openvpn/*: ALL -except
19:13 < reiffert> :)
19:15 < ecrist> a lot more meta traffic in here with ~150 users than there was when we had 6~
19:15 < reiffert> 150 > 6?
19:16 < ecrist> well, right.  just saying
19:16 < ecrist> it's a good thing, really, we've grown since we all started putting work in to the community.
19:16 < ecrist> :)
19:16 < ecrist> even your grumpiness hasn't kept the users away! :-P
19:17 < reiffert> go away.
19:17 < reiffert> :D
19:17 < ecrist> you fucked that up, the phrase is, 'get off my lawn.'
19:18 < reiffert> isnt it supposed to be "way" rather than lawn?
19:18 < ecrist> no
19:19 < reiffert> get out of my lawn? ;P
19:19 < ecrist> germans.
19:19 < ecrist> sheesh
19:21 < reiffert> last time you spoke to one in real life?
19:21 < ecrist> one of our devs, and a friend of mine, is german (born/raised there)
19:22 < reiffert> ah closer than I thought :)
19:22 < ecrist> he and I took our carry class together, actually.  he used my Glock to qualify. ;)
19:23 < reiffert> I really dislike Glock. The last time trying it hit me real bad at my thumb
19:24 < reiffert> I forgot where to put my left hand after changing the magazine under timing pressure
19:24 < EugeneKay> I like my S&W 459. It's older than I am, but damn, it can shoot
19:24 < reiffert> the sled hit
19:24 < reiffert> is it "sled"?
19:24 < EugeneKay> Slide
19:25 < ecrist> I bought my glock because for me, it points right, naturally
19:25 < reiffert> And on top of that I only got 20% with that platic piece of sh*t.
19:25 < ecrist> compared to beretta, S&W, Sig, Kimber
19:25 < ecrist> http://secure-computing.net/files/guns
19:25 <@vpnHelper> Title: Index of /files/guns (at secure-computing.net)
19:25 < reiffert> I really like the M9, it's heavy enough for me. Got 95% with my first attempt on 25m
19:26 < ecrist> http://secure-computing.net/files/guns/04142009_bullseye_small.jpeg
19:26 < reiffert> whats the distance unit in the US, is it feet?
19:26 < ecrist> that was from 20 yards, first shot (cold barrel)
19:27 < reiffert> ah, yards.
19:27 < ecrist> 1 yard ~ 1 meter
19:27 < ecrist> for small distances, it's close enough.
19:27 < ecrist> 1000 yards = 914.4 meters
19:28 < reiffert> At the shooting range they've had 25 meters, approx 27.3 yards 
19:28 < reiffert> so I really dislike Glock, it hurt me and it's not weighing enough
19:29 < ecrist> heh, I'm looking to buy a Glock 27 as my Glock 22 weighs too much for every-day carry
19:29 < reiffert> M4 was fun, HK SL-8 was fun and M16 was fun.
19:30 < ecrist> I don't have an M16, but I have a S&W M&P15, which is a single-shot version of the M16
19:30 < ecrist> (see link above)
19:30 < reiffert> MP-5 was just like "a big M9". Point, click, hit the 10
19:31 < ecrist> http://secure-computing.net/files/guns/IMAG0108.jpg is a pic of my wife, with my new scope.
19:31 < ecrist> ;)
19:32 < ecrist> quadDamage's dad is teaching me how to reload ammo, too.
19:32 < EugeneKay> There are more differences than the trigger / fire control between a M16 and an AR-15. Namely, most AR barrels aren't rated as high as M-16, as well as different ammo tolerances
19:32 < reiffert> How often are you practising?
19:33 < ecrist> EugeneKay: you are incorrect.
19:33 < ecrist> reiffert: not as often as I'd like.
19:33 < EugeneKay> ecrist - it depends upon WHICH AR-15 you're talking about, but generally, they are not 100% compatible
19:33 < reiffert> ecrist: for me it's once every two years ...
19:33 < ecrist> EugeneKay: you are, in part, correct.  You're generalizing AR-15 weapons with a .223 calibre, as opposed to AR-15's in a 5.56mm calibre
19:34 < ecrist> mine, for example, is chambered for 5.56mm, which is full mil-spec
19:34 < EugeneKay> Indeed I am, because that's what most AR-15s are spec'ed for.
19:34 < EugeneKay> Including my mother's
19:34 < ecrist> at RRA .223 is not spec'd for 5.56 ammo, despite the cartridge fitting, and a 90% probability it'll work OK.
19:34 < ecrist> EugeneKay: not all, no.
19:35 < ecrist> reiffert: for me is once or twice a month
19:35 < EugeneKay> ecrist - hence, I said "most"
19:35 < ecrist> I'd have a range membership now, but the owner of a range I'd like to go to doesn't pro-rate memberships, and I wasn't going to pay full price for half a year.
19:35 < EugeneKay> I'm not familair with the S&W model in particular, but if it's spec'ed for 5.56, that's a definite plus
19:36 < reiffert> ecrist: I've got a license saying that I'm a member of the german shooting federation, so I'm allowed to take part on reservist training sessions
19:36 < EugeneKay> I have personally seen issues with running 5.56 through .223 barrels & chamberings(unwittingly). The barrels held, but there was a lot of jammed brass until they figured it out
19:36 < reiffert> note that I got that license from bow achery ;)
19:36 < ecrist> EugeneKay: the ONLY difference on the M&P15 as opposed to the mil-spec M16, in regards to fire control, is single shot versus burst/single shot selector.
19:37 < EugeneKay> Well that's a plus
19:37 < ecrist> and the M&P15 has a nickle-plated chamber and barrel
19:37 < ecrist> s/barrel/bore/
19:37 < EugeneKay> I keep AK-47s in my closet, tolerances comparable to a brick.
19:37 < ecrist> reiffert: nice.
19:37 < ecrist> reiffert: I live in the US, so generally, we're all license to have weapons. ;)
19:38 < ecrist> except the People's Republik of Kalifornia
19:38 < ecrist> EugeneKay: isn't that what makes the AK-47 the AK-47?
19:38 < EugeneKay> Indeedy do. 
19:39 < EugeneKay> Bolt rusted shut? Hit it with a hammer, feed a fresh mag, shoot.
19:40 < ecrist> exactly.
19:40 < ecrist> I'd love to find a pre-'86 manufactured AK
19:40 < ecrist> for cheap
19:40 < ecrist> brb
19:40 < reiffert> ecrist: for germany the government was boosting the requirements at a high level for owning weapons after some school rampages
19:42 < reiffert> forest rangers and shooting professionals may own, and if you owe, you have to keep it in a strongbox nowadays
19:42 < reiffert> it's own, not owe :)
19:42 < EugeneKay> Zose zilly germans
19:51 < ecrist> reiffert: I have to keep mine away from kids.  I carry my Glock 90% of time time.  As people as not carry a firearm at work now.
20:01 < ecrist> So, back in May, i was at BSDCan.  No kidding, at one dinner with some other BSD folks, there was a sort of show-and-tell for everyone with a carry permit, from the states.  I thought the situation interesting.
20:04 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
20:05 -!- nb_ is now known as nb
20:56  * ecrist thinks he needs a nagios check for channel population.
20:56 < ecrist> just because.
20:56  * ecrist poofs
21:14 -!- EugeneKay is now known as THUNDERQUEER
21:17 -!- THUNDERQUEER is now known as EugeneKay
21:49 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
21:49 -!- mode/#openvpn [+v Axeman] by ChanServ
21:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
23:18 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
23:37 <@vpnHelper> RSS Update - forum: iptables specific ip routing via tun <http://forums.openvpn.net/topic8460.html>
--- Day changed Sat Jul 16 2011
00:47 -!- EugeneKay is now known as EugeneKaway
00:49 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p13693>
00:55 <@vpnHelper> RSS Update - forum: Please help me :( <http://forums.openvpn.net/topic8457.html#p13694>
01:25 < genlime> is the a tweak or way to speed up openvpn traffic?
01:25 < oc80z> Padlock VIA
01:25 < oc80z> hardware encryption.
01:25  * oc80z out
03:09 -!- Cain` is now known as Cain
03:56 <@vpnHelper> RSS Update - forum: OpenVPN on OpenWrt <http://forums.openvpn.net/topic8461.html>
04:11 < Mowee> Morning
04:48 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
05:08 <@vpnHelper> RSS Update - forum: Configuration OpenVPN Client <http://forums.openvpn.net/topic8444.html#p13696>
05:41 < haotian> Though I don't know if this is the right place to ask but,
05:41 < haotian> I have followed the instructions under the "Sending VPN traffic through the SSH tunnel" headline @ http://torvpn.com/sshtunnel.html , first Im launching putty, establishing the connection, then Im launching openvpn, establishing the connection, openvpn indicates that I succesfully established the vpn connection, however I can't access to internet and after 15 seconds putty gives following error and terminates : "network error: software caused connect
05:41 < haotian> ion abort."
05:41 <@vpnHelper> Title: SSH tunnel setup guide - TorVPN (at torvpn.com)
05:42 < haotian> (scroll down to the bottom of the page in the given link)
06:35 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:35 -!- mode/#openvpn [+v s7r] by ChanServ
06:36 <+s7r> krzie a link is brokein in vpnHelper needs to be changed. 
06:36 <+s7r> this one
06:36 <+s7r> !fbsdnat
06:36 <@vpnHelper> "fbsdnat" is see http://cavanantha.wordpress.com/2007/09/16/nat-on-freebsd-using-pf/ for a basic howto for NAT on FreeBSD
06:36 <+s7r> 404 - Page does not exist.
06:41 < genlime> is there a way to speed up openvpn traffic
08:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:02 < haotian> I have followed the instructions under the "Sending VPN traffic through the SSH tunnel" headline @ http://torvpn.com/sshtunnel.html , first Im launching putty, establishing the connection, then Im launching openvpn, establishing the connection, openvpn indicates that I succesfully established the vpn connection, however I can't access to internet and after 15 seconds putty gives following error and terminates : "network error: software caused connect
09:02 < haotian> ion abort."
09:02 <@vpnHelper> Title: SSH tunnel setup guide - TorVPN (at torvpn.com)
09:02 < haotian> (scroll down to the bottom of the page in the given link)
09:06 < root> routing screwup probably
09:07 < root> have you or your exotic setup added a static route for the putty remote endpoint?
09:12 < haotian> Nope, I'm not very familiar about routing.
09:13 < root> unless there is a route for your putty remote endpoint, when you set your default route to the vpn, putty will try to send packets through the vpn ;-) 
09:14 < haotian> but there will be moments I will be using the vpn, and there will be times I won't be using vpn.
09:14 < root> now why you are using such an exotic setup?
09:15 < haotian> Sometimes the websites I do visit dont like my country
09:15 < haotian> If I feel necessary, I can turn that vpn on and bingo
09:16 < root> yeah, but why over ssh?
09:18 < haotian> Im not sure exactly what's role of ssh, too; I was just geeking around but fail. I was expecting being more un-....able (mm, I was expecting being more secure against proxy check/vpn check whatever)
09:18 < haotian> In case that I'm participating in US special offers etc, they might claim I cheat.
09:20 < root> why not just follow an openvpn howto?
09:22 < haotian> mm I don't have very wide selection of options, since I didn't know why I was failing, being kinda under absolutely cluelessness
09:23 < haotian> but sure if I had know the problem and my possible options, I would handle it more wisely, although I did a quick look at http://openvpn.net/index.php/open-source/documentation/howto.html#security
09:23 <@vpnHelper> Title: HOWTO (at openvpn.net)
09:26 < haotian> here is also something I might need, but I cant predict what would happen if I do this
09:27 < haotian> http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
09:27 <@vpnHelper> Title: HOWTO (at openvpn.net)
10:00 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 264 seconds]
11:09 <@vpnHelper> RSS Update - forum: Configuration OpenVPN Client <http://forums.openvpn.net/topic8444.html#p13697>
11:15 <@vpnHelper> RSS Update - forum: OpenVPN, Kerio Winroute, Windows APIPA. <http://forums.openvpn.net/topic8458.html#p13698>
11:23 < haotian> Attempting to establish TCP connection with 127.0.0.1:65503
11:23 < haotian> TCP connection established with 127.0.0.1:65503
11:23 < haotian> TCPv4_CLIENT link local: [undef]
11:23 < haotian> TCPv4_CLIENT link remote: 127.0.0.1:65503
11:23 < haotian> Connection reset, restarting [-1]
11:24 < haotian> :/ what's the problem here ?
11:29 < Mowee> The problem is, why do you want to create a connection with yourself
11:29 < Mowee> The remote IP is your openvpn server
11:29 < Mowee> !howto
11:29 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:36 < haotian> Mowee :: Im trying to tunnel vpn traffic over ssh
11:36 < haotian> and I'm using putty, in order to bind localhost:65503 to my vpn:22
11:37 < haotian> well Im not sure if it's vpn:22 , might be vpn:443 aswell
11:37 < Mowee> Why the hell would you create an openvpn tunnel over ssh
11:37 < haotian> doesn't it look right what I did with openvpn client ?
11:38 < Mowee> openvpn is also powered by ssl
11:38 < Mowee> It's juste useless
11:38 < Mowee> -e
11:38 < haotian> oh okay
11:38 < haotian> though I still wondering why I failed, might I can learn something about that
11:38 <@vpnHelper> RSS Update - forum: Site to Site Setup questions <http://forums.openvpn.net/topic8462.html>
11:39 < Mowee> That's why root said: <root> why not just follow an openvpn howto?
11:39 < Mowee> (sry about the hl)
11:45 <@vpnHelper> RSS Update - forum: OpenVPN, Kerio Winroute, Windows APIPA. <http://forums.openvpn.net/topic8458.html#p13700>
11:46 < haotian> " if your OpenVPN server will be running on a single-NIC machine behind a firewall/NAT-gateway, use the public IP address of the gateway, and a port number which you have configured the gateway to forward to the OpenVPN server "
11:47 < haotian> "public IP address of the gateway" , uh ?
11:47 < haotian> what is that IP address supposed to be ?
12:01 -!- EugeneKaway is now known as EugeneKay
12:14 < cron2> !route
12:14 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:16 < cron2> !tcpip
12:16 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
13:02 < eorwly> when vpn-server is pushing routes, it does "ADD 127.0.0.1 MASK 255.255.255.255 192.168.1.1" , instead of "ADD <WAN_IP> MASK 255.255.255.255 <PRIV_LAN_IP>" , that's the problem, how can I solve it ?
13:04 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:04 -!- mode/#openvpn [+v s7r] by ChanServ
13:22 <@vpnHelper> RSS Update - forum: "Standalone" VPN server for VPS to "secure itself" <http://forums.openvpn.net/topic8459.html#p13701>
13:58 <@vpnHelper> RSS Update - forum: build-ca not working <http://forums.openvpn.net/topic8463.html>
14:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:16 <@vpnHelper> RSS Update - forum: "Standalone" VPN server for VPS to "secure itself" <http://forums.openvpn.net/topic8459.html#p13703>
14:23 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:33 -!- patelx [~a@openvpn/corp/admin/patel] has quit [Ping timeout: 246 seconds]
14:34 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 252 seconds]
15:06 -!- sia is now known as sia^pwnnt
15:41 < appledoranges> when i import my .ovpn into my windows client and hover over the profile, it says "This is a static profile that will connect to %S@%S" - i cannot connect with that profile. Does anyone know why it's giving me %S variables instead of identifying the IP?
16:10 < appledoranges> good to know
16:15 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:16 -!- mode/#openvpn [+v s7r] by ChanServ
16:53 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
17:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
18:03 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html>
19:05 < genlime> I wanna ask if how to optimize or tweak openvpn traffic
19:08 < Luciferi> !welcome
19:08 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:08 < Luciferi> !goals
19:08 < Luciferi> !goal
19:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:13 < genlime> I wanna ask if how to optimize or tweak openvpn traffic
19:14 < genlime> I would like to speed up my access to the internet over vpn
19:59 < ashes> hi
20:00 < ashes> what do i need to do special when both my server and client are on the same subnet?
20:00 < ashes> with routing based openvpn
20:09 < EugeneKay> Trying to route the local LAN over openvpn generally does not work
20:11 < ashes> iirc, it does work. it was fixed recently with a configure option
20:11 < ashes> i did it before
20:11 < ashes> i'm using openvpn for wifi
20:12 < ashes> i don't see how not to use the same subnet
20:12 < ashes> unless i use a router in between
20:12 < ashes> but that would be silly
21:54 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
22:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
22:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
22:31 -!- EugeneKay is now known as EugeneKaway
22:31 -!- EugeneKaway is now known as EugeneKay
--- Day changed Sun Jul 17 2011
00:09 < Bushmills> ashes: no problem, if all you want is those machine to talk to each other
00:10 < Bushmills> that assumes that the openvpn subnet is not within your LAN, or within server's LAN
00:12 < Bushmills> a problem you will have if machines either LAN are supposed to be able to talk to machines on the other end's LAN
00:14 < Bushmills> but as client and server are on the same subnet anyway, the machines on the LAN behind either are too -  on the same subnet. right?
00:29 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
00:42 < ashes> its a wifi network
00:43 < ashes> i can't be the only person with this issue
00:43 < ashes> or they use bridges
00:48 <@vpnHelper> RSS Update - forum: "Standalone" VPN server for VPS to "secure itself" <http://forums.openvpn.net/topic8459.html#p13705>
00:57 < genlime> I wanna ask how to speed traffic with openvpn?
01:19 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:37 < Bushmills> ashes: can't help. i don't even know what issue
03:00 < hyper_ch> hmmm, why won't it work :(
03:11 -!- Cain` is now known as Cain
03:37 < hyper_ch> krzee: online?
04:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:14 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:14 -!- mode/#openvpn [+v s7r] by ChanServ
05:18 <+s7r> !ipv6
05:18 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
05:20 <+s7r> !snapshots
05:20 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
05:55 <@vpnHelper> RSS Update - forum: my isp has blocked my openvpn ports <http://forums.openvpn.net/topic8465.html>
06:24 < ManDay> Can anyone tell me what "route" configuration option I have to put into my config to route to host A.B.C.D ?
06:24 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13707>
06:31 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p13708>
06:37 < hyper_ch> krzee: online?
06:37 < dav1d> Hello, I just setup openvpn on my archlinux computer, it seems to work so far. So I got a config (windows computer) and the cert and key files, but when I try to launch openvpn I get the error: "Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/LU1.ovpn.to.conf:26: win-sys (2.2.0)". Is it enough, when I just remove the line from the config? (When I do this, I cant connect => 
06:37 < dav1d> Connection refuesed)
06:47 < dav1d1> ok
06:48 < dav1d1> removing the line seems to work, server was down
07:01 <@vpnHelper> RSS Update - forum: "Standalone" VPN server for VPS to "secure itself" <http://forums.openvpn.net/topic8459.html#p13709>
07:03 < genlime> I wanna know how to make traffic really fast with openvpn
07:04 < Bushmills> fast network. fast processors. efficient cipher.  udp.  optimum mtr.  
07:05 < Bushmills> mtu
07:06 < genlime> is 1gbps port network is a fast network? is 4 cpu cores a fast processor? what cipher would be the best? what is optimum mtr? is mtu 1450 enough?
07:06 < Bushmills> 4 cores says something about number of cores, not about their speed 
07:07 < Bushmills> blowfish, probably
07:07 < Bushmills> optimum is the max the hops in your route from client to server will handle
07:07 < genlime> how about optimum mtr? and is 1450 mtu enough?
07:08 < Bushmills> 1450 may be too much, too little, or optimum.
07:08 < genlime> ok. so how will I check if I have that optimum mtr?
07:09 < Bushmills> you test it
07:09 < genlime> may I know the command to test for it ?
07:09 < Bushmills> --mtu-test
07:10 < genlime> oh thats the way. ok
07:11 < genlime> can I employ cipher none?
07:11 < Bushmills> yes
07:11 < Bushmills> depending on type of data, your many want to enable or disable compression
07:12 < genlime> what is the main purpose of compression anyway?
07:12 < Bushmills> to compress
07:13 < Bushmills> try to send a file, containing hundred million zeroes with and without compression
07:14 < Bushmills> as counter example, try the same with, say, an mpeg encoded movie
07:14 < genlime> do you suggest that it is more efficient if I use compression enabled?
07:15 < Bushmills> no, i don't
07:15 < Bushmills> i suggest "depending on type of data, your many want to enable or disable compression"
07:15 < Bushmills> funny, i thought i said so already
07:16 < genlime> :0
07:16 < genlime> :)
07:16 < Bushmills> meaning to say "you may want"
07:17 < Bushmills> failed attempt of finger-autonomous typing
07:18 < genlime> currently I have enabled compression on my vpn and blowfish cipher. 
07:20 < genlime> how will I know the speed of the cpu by the way ?
07:21 < Bushmills> you could assume that with openvpn traffic at maximum, if the cpu load doesn't rise appreciatively, the cp is fast enough
07:21 < Bushmills> cpu
07:22 < genlime> how will I know that the cpu load doesnt rise appreciately?
07:22 < genlime> :) 
07:23 < Bushmills> you look at cpu load
07:23 < genlime> any commands  for that?
07:23 < Bushmills> maybe doing a "before-after" comparison
07:24 < genlime> ok. any commands to check the cpu load 
07:24 < Bushmills> depends on effort your want to put into.  top, htop, munin ...
07:24 < genlime> ok man. real thanks for you. will google for those
07:48 < barf> Is it possible to spread the services announcing themselves across the VPN?
07:48 < barf> bonjour/zeroconf stuff, i e
07:51 < reiffert> openvpn support layer 2 bridging
07:52 < barf> Is it advisable?
07:52 < reiffert> if you dont want that, have a bonjour proxy, e.g. dns-sd -P or avahi and for the windows stuff try wins remote announce
07:53 < reiffert> bridging is easy in the first place, then the dhcp problem raises and after that keep an eye on slow connections
08:01 < barf> I run 10.0.0.0/8
08:02 < genlime> bushmills, is 2.53 ghz good enough for processor speed.....
08:03 < hyper_ch> hmmm, why isn't my setup working :(
08:04 < genlime> bushmills man, is 2.53 ghz ok?
08:17 <@vpnHelper> RSS Update - forum: "Standalone" VPN server for VPS to "secure itself" <http://forums.openvpn.net/topic8459.html#p13710>
08:32 < genlime> does cpu memory affects openvpn or the processor?
08:35 < genlime> does cpu memory affects openvpn or the processor?
08:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
09:43 < genlime> what the problem with Replay-window backtrack occurred [1]
09:43 < genlime> how can I resolve that?
09:48 <@vpnHelper> RSS Update - forum: "Standalone" VPN server for VPS to "secure itself" <http://forums.openvpn.net/topic8459.html#p13711>
10:06 <@vpnHelper> RSS Update - forum: "Standalone" VPN server for VPS to "secure itself" <http://forums.openvpn.net/topic8459.html#p13712>
10:39 <+s7r> openvpn simulates http packets?
10:39 < krzie> no, but it can forward non-openvpn traffic to a https server
10:40 < krzie> --port-share i think it is
10:40 < krzie> oh and it can go over a http-proxy, if thats what you meant...
10:41 <+s7r> i know it can .. because i tried
10:41 <+s7r> but i was courious
10:41 <+s7r> the sys admin what packets he sees ?
10:41 <+s7r> while i am connected to the vpn
10:41 < krzie> sniff your traffic and see what he sees
10:41 < krzie> o_O
10:41 <+s7r> krzie, i reminded you weren't online when i discovered
10:41 <+s7r> !fbsdnat
10:41 <@vpnHelper> "fbsdnat" is see http://cavanantha.wordpress.com/2007/09/16/nat-on-freebsd-using-pf/ for a basic howto for NAT on FreeBSD
10:41 <+s7r> this link is borken
10:42 <+s7r> i am trying to google another tutorial so we can replace it
10:42 < krzie> cool, have another link to replace it?
10:42 < krzie> =]
10:42 < hyper_ch> krzie: hi
10:42 < krzie> hey hyper_ch 
10:42 < hyper_ch> krzie: query?
10:43 <+s7r> krzie : so basically what kind of packets uses openvpn ? i thought http
10:43 < krzie> s7r, encrypted... openvpn packets
10:44 <+s7r> and how come it works via a http proxy
10:44 <+s7r> configured to work only with http protocol?
10:44 <+s7r> :D
10:44 <+s7r> here i found a link but to replace !fbsdnat
10:44 <+s7r> http://freebsd.rogness.net/redirect.cgi?basic/nat.html
10:44 <@vpnHelper> Title: FreeBSD Network Tutorial/How-To Guide (at freebsd.rogness.net)
10:45 < krzie> i assume it gets encapsulated in http for the purpose opf flowing over the http proxy, but i never cared to inspect the packets to check... which is something you should do since you are interested
10:45 <+s7r> yep downloadign wireshark now
10:46 < krzie> haha that link is on ipfw
10:46 < krzie> ill find a pf one
10:50 < krzie> !forget fbsdnat
10:50 <@vpnHelper> Joo got it.
10:50 < krzie> !learn fbsdnat as nat on $ext_if from $vpn_network to any -> ($ext_if)   (this is for PF)
10:50 <@vpnHelper> Joo got it.
10:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:02 < ChUbB> Hi guys and girls, is there a way I can get a a linux client running from the command line to auto reconnect ?
11:11 < ecrist> --retry-infinite
11:11 < ecrist> krzie: that only works reliably if you have a single IP on $ext_if
11:38 < krzie> ecrist, feel free to change it if you like
11:40 < krzie> !route_by_app
11:40 < krzie> !routebyapp
11:40 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
11:40 < krzie> ^ hyper_ch 
11:46 <@vpnHelper> RSS Update - forum: OpenVPN stopped working - willing to pay for support <http://forums.openvpn.net/topic8466.html#p13714>
11:52 <@vpnHelper> RSS Update - forum: OpenVPN stopped working - willing to pay for support <http://forums.openvpn.net/topic8466.html#p13717>
11:57 <+s7r> local parameter in config can contain v6 address?
11:57 <+s7r> e.g. local 2002::
13:49 < ashes> hello
13:50 < ashes> openvpn is working half way for me. my default route gets reset to use the openvpn server, and it works, but it's not using tun0
13:50 < ashes> packets are bypassing openvpn
14:00 <+s7r> is tun0 entered into configs?
14:00 < ashes> both are using tap
14:02 <+s7r> well modify the configs 
14:02 <+s7r> ?
14:02 < ashes> i have to use tun0?
14:03 <+s7r> i don't understand you. if in the configs is entered "tap" and you want to use "tun0"
14:03 <+s7r> wouldn't be normal to have "tun0" in your configs ?
14:04 < ashes> i suppose
14:04 < ashes> :-)
14:04 < ashes> but
14:04 < ashes> would this explain why the tunnel is being bypassed?
14:05 <+s7r> you shouldn't use tap - it's for bridging
14:05 <+s7r> i never used tap so i couldn't say
14:05 <+s7r> you should use tun for IP tunneling
14:05 <+s7r> it's all documented on openvpn.net :D
14:05 <+s7r> !tun
14:06 < ashes> if i pass everything, the server acts as a gateway. when i block all buy port 1194 on the wifi device ut doesn't work. packets are dropped by the filter
14:06 < ashes> sorry for the typos
14:06 <+s7r> what do you mean pass everything ?
14:06 <+s7r> your problem is not clear
14:06 < ashes> no blocking
14:07 < ashes> openvpn is supposed to tunnel all traffic through port 1194, yes?
14:07 <+s7r> if you configured it this way - yes
14:07 < ashes> so i can block all but that port, on the external device
14:08 < ashes> the other devices don't have any block rules right now
14:09 <+s7r> yes
14:09 <+s7r> if you configured openvpn to listen on port 1194 
14:09 < ashes> i'll restate my problem. nat works if my firewall isn't blocking any ports. nat doesn't work if i block all but port 1194 on the wifi device (while the other devices don't have any firewall blocking)
14:10 < ashes> openvpn is doing redirect gateway. it works, i see it in the logs and routing table
14:10 < ashes> so, to me it looks like openvpn isn't routing traffic to port 1194
14:11 <+s7r> look, as long as you managed to connect to the vpn
14:11 <+s7r> it's ok
14:11 <+s7r> if it was the firewall fault not allowing
14:11 <+s7r> then you wouldn't be able to connect and see the vpn ip in your routing table
14:12 < ashes> ill try using the tun device. brb
14:15 -!- EugeneK is now known as EugeneKay
14:17 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
14:20 < ashes> didn't help
14:20 < ashes> on both client and server, tcpdump doesn't show anything on the tun0 device
14:32 < ashes> here are my configs: http://pastebin.com/ajr7WQ7a
14:32 < ashes> openbsd server, gentoo client
15:07 < rothwell> is it possible to force a re-read of the config file for a specific user?
15:08 < rothwell> i have a user that's connecting and for some reason, the server's not re-reading his client-specific config file
15:08 < rothwell> i don't want to restart the server and cut everyone else off
15:15 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:15 -!- mode/#openvpn [+v s7r] by ChanServ
15:27 < EugeneKay> No.
15:27 < EugeneKay> (I think)
16:09 < rawsted> so the TAP adapter that OpenVPN GUI installed on my Win7 box has an exclamation beside it in device manager and I receive the following error when trying to connect to the server: CreateFile failed on TAP device // All TAP-Win32 adapters on this system are currently in use.
16:10 < rawsted> i tried all the usual stuff, install as administrator / compatibility mode, disabled signed driver enforcement, deleted/uninstalled other VPN clients, all to no avail
16:10 < rawsted> any ideas?
16:43 <@vpnHelper> RSS Update - forum: OpenVPN routing to remote network <http://forums.openvpn.net/topic8447.html#p13718>
16:55 < pegger> my openvpn connection renembers my ip address it is possible to make it so that openvpn forgets my prevtios connetion information
16:58 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
16:58 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
17:29 < pegger> why does openvpn assign you the same ip each time you connect?
17:38 < _zero_> there is a line for this (ipp-persist or something like that which store each ip assigned to reassign the same next times)
17:51 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
18:02 < krzie> !ipp
18:02 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
18:02 < krzie> however, it will happen either way
18:02 < krzie> something to do with some stuff staying in memory
18:02 < krzie> seen it on the mail list before
18:09 < rawsted> so the TAP adapter that OpenVPN GUI installed on my Win7 box has an exclamation beside it in device manager and I receive the following error when trying to connect to the server: CreateFile failed on TAP device // All TAP-Win32 adapters on this system are currently in use.
18:09 < rawsted> i tried all the usual stuff, install as administrator / compatibility mode, disabled signed driver enforcement, deleted/uninstalled other VPN clients, all to no avail
18:09 < rawsted> any ideas?
18:25 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p13719>
18:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
18:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
18:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
18:42 < pegger> _zero_ why do I not see ipp-persist is the man page?
18:43 < EugeneKay> pegger - because it's called ifconfig-pool-persist
18:51 < _zero_> :)
18:51 < _zero_> :)
19:04 < pegger> EugeneKay but I dont have ifconfig-pool-persist set anywhere
19:06 < genlime_> is 2.53 ghz speed ok?
19:26 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13720>
19:45 < Dougy> anyone here proficient at fixing blackberries
19:49 < EugeneKay> Sure, it's easy. Buy an Android.
20:02 <@vpnHelper> RSS Update - forum: Redirect-gateway Reroutes Everything to the Server's IP <http://forums.openvpn.net/topic8467.html>
20:22 < pegger> blackberries are silly and useless
20:43 < ecrist> bitches
20:44  * ecrist uses tap...
20:44  * ecrist misreads pegger's name, sees 'pregger' and panics
20:52 < EugeneKay> I'd be more worred about pegging than preggering
21:00 < fluter> hi, is tcp or udp better for vpn connections?
21:01 < EugeneKay> UDP.
21:01 < fluter> EugeneKay, why?
21:01 < EugeneKay> Because.
21:02 < fluter> EugeneKay, Because ?
21:02 < fluter> what?
21:02 < ecrist> !tcp
21:02 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer), or (#3) if you must use tcp, you likely want --tcp-nodelay
21:02 < EugeneKay> Because that's how TCP transports work
21:04 < fluter> for a around 100 users vpn server, what need the hardware be?
21:04 < ecrist> sufficient
21:04 < EugeneKay> Generally speaking, you will max out your internet connection before the CPU
21:04 < fluter> I mean typical the cpu, memory, disk, bandwidth requirement
21:04 < EugeneKay> Depends what your users are doing
21:05 < fluter> EugeneKay, will 10M enough?
21:05 < EugeneKay> <EugeneKay> Depends what your users are doing
21:05 < fluter> EugeneKay,  do normal internet access,
21:05 < fluter> websits, vedios, etc
21:05 < EugeneKay> I'd say 1mbit per user is reasonable.
21:06 < fluter> EugeneKay, hmm, that means 100users needs 100M ...
21:06 < fluter> too expensive
21:06 < EugeneKay> A vanilla dual-core server with a few GB of ram can max a 100mbit of OpenVPN
21:06 < EugeneKay> I pay $1/mbit/mo :-p
21:06 < ecrist> you can get a server in Miami for ~$35/mo with 100M internet
21:06 < ecrist> colopronto.com
21:06 < EugeneKay> Note that 1mbit per user is a worst case, assuming everybody is browsing at once. 
21:07 < EugeneKay> Generally speaking, 100 people won't all be signed in at once
21:07 < fluter> ecrist, is it vps or real server?
21:08 < ecrist> that's you sending them a server to colocate
21:08 < ecrist> read the site, I linked it...
21:08 < EugeneKay> "500GB Data transfer"
21:09 < EugeneKay> har har har
21:09 < fluter> ecrist, hmm, I dont have server, I need a hosted server ;-(
21:09 < EugeneKay> I can blow that in about two hours
21:09 < fluter> EugeneKay, is 500GB many or few?
21:09 < ecrist> EugeneKay: do you do anything but troll here?
21:09  * jpalmer was wondering the same thing.
21:10 < EugeneKay> fluter - depends upon your scale. 100 people,browsing over a month? Few.
21:10 < EugeneKay> ecrist - sure. I also beleive in reasonable expectations. 100mbit is nice to bat about, but if the proposed use case is 100 people doing redirect-gateway, well, it's a laugh
21:11 < ecrist> I was asking, in general, not specific to that one statement.
21:11 < jpalmer> so rather than ask him the requirements, and needs..  you assume and throw out nonsensicle datapoints.
21:11 < ecrist> I recall a conversation between us the other day that seemed similarly troll-ish
21:11 < EugeneKay> Except i did establis hthe requirements - 100 people doing web-browsing.
21:12 < jpalmer> and according to you,  web browsing requires 1mbit per user,   without asking if he was using a local proxy,  redirect-gateway,  and other *actual* datapoints you'd need to achieve a reasonable answer
21:12 < EugeneKay> "worst case reasonable guesstimate"
21:13 < jpalmer> you say reasonable,  I say assinine.
21:13 < EugeneKay> fluter - if you're just after a VPN, you're probably gonna be best served by a purely hosted solution, not something rolled together on a VPS yourself.
21:13 < jpalmer> but,  meh.  /me shushes.
21:13 < EugeneKay> jpalmer - feel free to provide a better estimate
21:14 < genlime> can I tunnel on tcp 53 instead of udp 53?
21:14 < jpalmer> genlime: you can tunnel on anything you'd like, assuming your ISP isn't firewalling it.
21:14 < ecrist> genlime: sure
21:14 < fluter> EugeneKay, I need vpn server, together with ssh and httpd running
21:14 < EugeneKay> You can, but if you're behind a firewall that would force you to use UDP 53, chances are TCP 53 is blocked
21:14 < EugeneKay> fluter - for....? :-p
21:14 < genlime> if my isp blocks port 53, does it mean tcp and udp are affected?
21:15 < fluter> EugeneKay, ?
21:15 < jpalmer> genlime: that would depend on the ISP's firewalling policies.
21:15 < EugeneKay> genlime - I don't have a clue. Ask your ISP.
21:15 < genlime> I have read that if I am getting replay-windows backtrack occured, one solution is to shift from udp to tcp.
21:15 < EugeneKay> fluter - what's the point of investigating VPN? 
21:16 < genlime> jpalmer: so ISP is also using firewall like iptables?
21:16 < fluter> EugeneKay, ? we need vpn,
21:16 < jpalmer> genlime: depends on the ISP.
21:16 < genlime> so mostly tcp 53 is blocked than udp 53?
21:16 < EugeneKay> fluter - that's akin to saying that "we need money". The question is, WHY do you need this thing? What's the problem you're trying to solve?
21:17 < jpalmer> genlime: we can't really give a generic answer to that question.  We simply don't know what your ISP allows and blocks.  but in answer to your question,   DNS can query over both tcp and udp.
21:17 < fluter> EugeneKay, we want vpn to browse the internet,
21:17 < EugeneKay> .....because?
21:17 < fluter> at the same time, we might sell vpn accounts if the server is bare good,
21:18 < EugeneKay> Selling VPN accounts is a tough thing to make money on
21:18 < fluter> EugeneKay, hmm, why?
21:18 < EugeneKay> Because that's how math works
21:19 < fluter> EugeneKay, what do you mean?
21:19 < EugeneKay> Internet access, server ownership, support costs, marketing, administration....
21:19 < EugeneKay> Also the prevalence of competing services leads to customer scarcity
21:21 < genlime> so tcp 53 is mostly blocked than udp 53?
21:21 < EugeneKay> <EugeneKay> You can, but if you're behind a firewall that would force you to use UDP 53, chances are TCP 53 is blocked
21:21 < EugeneKay> To put it another way, somebody trying to firewall you in would block TCP 53 as a routine matter of business
21:22 < fluter> udp 53 cannot be blocked for real
21:22 < jpalmer> DNS uses both tcp and udp.   more likely,  they'd block all of port 53,  except to/from specific ip's or subnets.
21:23 < fluter> coz dns is using that,
21:23 < jpalmer> (ie, designated DNS servers)
21:23 < EugeneKay> Yes it can, quite easily. I do it at home, and redirect all requests for TCP/UDP :53 to my local resolver.
21:23 < genlime> my problem with udp 53 is that is gives me replay-windows backtrack occured
21:24 < jpalmer> what does?   
21:24 < genlime> eugenekay: how do you redirect all requests for TCP/UDP :53 to your local resolver
21:24 < jpalmer> are you talking about some intrusion detection/prevention software or something?
21:25 < genlime> eugenekay: can you show us how?
21:25 < EugeneKay> genlime - iptables -t nat -A PREROUTING -i eth0 -m udp -p udp --dport 53 -j DNAT --to-destination 10.68.0.1
21:25 < genlime> 10.68.0.1 is you ip?
21:26 < EugeneKay> Yup.
21:26 < EugeneKay> I block TCP :53 entirely from my local LAN
21:27 < EugeneKay> There is no reason a box on this LAN should be trying to do a TCP DNS request
21:27 -!- mode/#openvpn [+o ecrist] by ChanServ
21:27 -!- mode/#openvpn [-b rich__*!~rich@216.38.140.199] by ecrist
21:27 -!- mode/#openvpn [-o ecrist] by ecrist
21:27 < genlime> what about this one: iptables -t nat -A PREROUTING -i tun0 -p udp --dport 53 -j DNAT --to :5353
21:27 < jpalmer> EugeneKay: DNS uses tcp, though.  and there are several practical reasons for it
21:27 < jpalmer> large DNS zones,  DNSSEC,  etc
21:27 < genlime> eugenekay: what about this one: iptables -t nat -A PREROUTING -i tun0 -p udp --dport 53 -j DNAT --to :5353
21:28 < EugeneKay> jpalmer - sure, it does. But nothing on my local home LAN should be doing any of that.
21:28 < genlime> can you tell me what does that do, I have searched that from google
21:28 < EugeneKay> genlime - I'd have to know more about your network setup to know what that would do. And, well, it's beyond what I'm comfortable thinking about at this hour
21:29 < genlime> Eugenekay: I was searching about if port 53 is block, it would redirect the traffic to port 5353 instead.  was that the correct iptable rule?
21:30 < genlime> anyway, since my problem is basically replay-windows and I have set it to replay-windows 64 15 and still the error occurs, what should I do now?
21:30 < EugeneKay> Really unsure as to what it is you mean by "redirecting to 5353".
21:30 < genlime> anyway, since my problem is basically replay-windows and I have set it to replay-windows 64 15 and still the error occurs, what should I do now?
21:31 < EugeneKay> If the point is to bypass a restrictive firewall, you can try TCP 443.
21:31 < EugeneKay> I've never seen any of the replay problems, sorry.
21:31 < genlime> wont tcp 443 be blocked?
21:31 < EugeneKay> Unlikely. TCP 443 is used for HTTPS
21:32 < genlime> ok
21:44 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p13722>
22:20 <@vpnHelper> RSS Update - forum: OpenVPN post disconnect problem <http://forums.openvpn.net/topic8233.html#p13723>
23:12 < FredMorris> hello
23:12 < FredMorris> i am new to openvpn
23:12 < FredMorris> im using openvpn connect now
23:19 < K1ng> anyone here used western union?
23:23 < FredMorris> no
23:24 < fluter> K1ng, what do you wanna do?
23:24 < K1ng> i just want to know much does it cost?
23:25 < fluter> K1ng, no cost,
23:25 < K1ng> its free?
23:25 < K1ng> its cant be
23:43 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:43 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
--- Day changed Mon Jul 18 2011
00:22  * FredMorris bills k1ng 100 from western union
00:22 < FredMorris> better?
00:35 < EugeneKay> Pffft. Western Union is full of scammers. Better to send a PayPal cash request
00:37 <@vpnHelper> RSS Update - forum: OpenVPN stopped working - willing to pay for support <http://forums.openvpn.net/topic8466.html#p13725>
00:43 <@vpnHelper> RSS Update - forum: OpenVPN stopped working - willing to pay for support <http://forums.openvpn.net/topic8466.html#p13726>
01:15 < enki> hey
01:16 < enki> is openvpn reasonable to use if i have a bunch of servers that need to speak to each other in various pairs, but i don't trust the underlying wires?
01:16 < enki> basically i'd make a whole bunch of p2p links
01:16 < enki> (webservers, databases, other kinds of servers)
01:20 < EugeneKay> OpenVPN is more of a hub-and-spoke architecture. Mesh networking, not so much.
01:21 < EugeneKay> If you can sort your topology out to be based around 2 or 3 specific hubs, you should be able to build something using OpenVPN that will give decent performance
01:24 < Bushmills> !gvpe
01:24 <@vpnHelper> "gvpe" is http://software.schmorp.de/pkg/gvpe.html <Bushmills> Unlike other virtual private  network" solutions which merely create a single tunnel, GVPE creates a real network with multiple endpoints. free, opensource, for nixes, meant for those looking for a vpn with direct peer connections. those who'd be sent to hamachi otherwise.
01:34 < enki> thanks
01:34 < enki> looking at gvpe. having many openvpn tunnels is not gonna give me satisfactory performance?
01:43 < EugeneKay> The problem is networking
01:44 < EugeneKay> OpenVPN is very routing-centric
02:21 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
02:21 -!- mode/#openvpn [+v s7r] by ChanServ
02:56 < benner_> hi
03:01 <@vpnHelper> RSS Update - forum: Windows 7 Openvpn Connection freeze / UMTS <http://forums.openvpn.net/topic8468.html>
03:11 -!- Cain` is now known as Cain
03:19 -!- dazo_afk is now known as dazo
03:40 < Bushmills> enki: many openvpn tunnels on each node will give you many running instances of openvpn on each node
03:43 < genlime> Is  2.53 ghz cpu speed good enough?
03:45 < reiffert> depends on the requirements.
04:47 < Mowee> Morning
05:06 -!- dazo is now known as dazo_afk
05:59 -!- dazo_afk is now known as dazo
06:21 -!- nuttersppadic is now known as sppadic[A]
06:21  * sppadic[A] is now away - Reason : lunchtime
06:24 <@vpnHelper> RSS Update - forum: inestable connection <http://forums.openvpn.net/topic8469.html>
07:42 <@vpnHelper> RSS Update - forum: Windows 7 Openvpn Connection freeze / UMTS <http://forums.openvpn.net/topic8468.html#p13730> || inestable connection <http://forums.openvpn.net/topic8469.html#p13729>
07:47 <@vpnHelper> RSS Update - forum: Redirect-gateway Reroutes Everything to the Server's IP <http://forums.openvpn.net/topic8467.html#p13731>
07:52 <@vpnHelper> RSS Update - forum: Configuration OpenVPN Client <http://forums.openvpn.net/topic8444.html#p13732>
07:57 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13733>
08:02 <@vpnHelper> RSS Update - forum: Configuration OpenVPN Client <http://forums.openvpn.net/topic8444.html#p13734>
08:08 < xxtjaxx> Hello! Where can I get ready made bundles for  my openstack cloud?
08:08  * ecrist thinks you're in the wrong place.
08:08 < xxtjaxx> woops wrong channel (damn tabbing)
08:18 < rawsted> what do i need to look into if i'm receiving dns lookup failures when trying to browse while connected to vpn?
08:26 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13735>
08:30 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
08:31 < ecrist> rawsted: make sure you can get to your DNS server when connected to the VPN.  if not, you need a DNS available over the VPN, or need a static route to your DNS server.
08:31 < rawsted> ecrist: im routing all traffic through vpn, according to http://library.linode.com/networking/openvpn/debian-6-squeeze#sph_tunnel-all-connections-through-the-vpn
08:32 <@vpnHelper> Title: Secure Communications with OpenVPN on Debian 6 (Squeeze) – Linode Library (at library.linode.com)
08:32 < rawsted> er, trying to
08:39 < Riz> rawsted, can you ping your dns server, or any other remote IP via the vpn?
08:40 < rawsted> Riz: 1 moment
08:40 < ecrist> rawsted: I figured, but apparently you can't get to your DNS server through the VPN.
08:41 < rawsted> Riz: nope, ecrist: right
08:41 < Riz> Can you ping your vpn server?
08:42 < Riz> if no, your vpn conf is broken. If yes, likely your firewall is broken.
08:42 < rawsted> Riz: while connected you mean?
08:46 < rawsted> Riz: can ping vpn, all other remote IPs time out
08:46 < rawsted> Riz: firewall on client or server?
08:46 < Riz> Server.
08:46 < Riz> Any output from the command iptables -nL
08:47 < rawsted> all columns are empty 
08:48 < rawsted> i didn't touch iptables on this box, it's completely vanilla 
08:49 < rawsted> that is, i ignored the steps in that tut related to iptables, because i configured no prior policies 
08:51 < Riz> Well that's why it doesn't work
08:51 < Riz> You need iptables todo the NAT/forwarding for the VPN traffic to make it to the rest of the world and back again.
08:52 < Bushmills> iptables -nL -t nat 
08:52 < rawsted> all empty Bushmills 
08:52 < Bushmills> !nat
08:52 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
08:53 < rawsted> thanks Riz, Bushmills, i'll try it now
08:53 < Bushmills> that is needed to reach any other name server, if it's not running on your openvpn server
09:00 < rawsted> hey, it works
09:01 < rawsted> now if i could just get the virtual TAP adapter working on my windows client, all would be well
09:01 < rawsted> thanks again guys
09:02 < Dougy> cant believe i snapped my blackberry
09:21 < WilcoRogers_> rawsted: what are the problems you're having with the TAP driver?
09:22 < rawsted> has an exclamation beside it in device manager and I receive the  following error when trying to connect to the server: CreateFile failed on TAP device // All TAP-Win32 adapters on this system are  currently in use.
09:22 < WilcoRogers_> Are you on Win7?
09:22 < rawsted> yes, 64b
09:22 < WilcoRogers_> Yeah, I'm in the same boat (32 bit)
09:23 < rawsted> interesting 
09:23 < WilcoRogers_> which GUI version did you get?
09:23 < rawsted> latest stable
09:23 < WilcoRogers_> I had no trouble installing/connecting with the "stable" version
09:23 < rawsted> really ?
09:23 < rawsted> hrm
09:24 < WilcoRogers_> yeah - BUT all my traffic was going through the external IP, and I was getting nothing to and from the servwer
09:24 < WilcoRogers_> *server
09:24 < WilcoRogers_> so I installed the "dev" version
09:24 < WilcoRogers_> and then got the same problems
09:24 < WilcoRogers_> Did you install with compatibility mode?
09:24 < rawsted> yes, as well as disabling signed driver enforcement 
09:24 < WilcoRogers_> where can you do that?
09:25 < rawsted> gpedit.msc
09:25 < WilcoRogers_> So I installed the stable without compatibility mode
09:25 < WilcoRogers_> apparently
09:25 < WilcoRogers_> let me give it another shot
09:26 < WilcoRogers_> There was an issue with the --topography commands and the stable version
09:27 < rawsted> user config -> admin templates -> system -> driver installation -> code signing
09:28 < WilcoRogers_> well I don't get a signing issue when I install stable under "Vista"
09:28 < WilcoRogers_> and it connects and gets an IP
09:28 < rawsted> yeah it seems to be unique to win7 according to the googling ive done
09:28 < WilcoRogers_> but from there there's nothing.
09:28 < rawsted> well i can't even pull an IP
09:28 < WilcoRogers_> you get the "driver in use" error?
09:29 < rawsted> yep
09:29 < WilcoRogers_> I assume you did the "remove ALL tap drivers" bit
09:29 < rawsted> yep
09:30 < WilcoRogers_> that's odd - cause I got that same problem, but with the dev version
09:31 < WilcoRogers_> but when I run the stable i get a "option not available: PUSH" warning
09:32 < WilcoRogers_> which has to do with a topography option
09:32 < rawsted> yeah it sounds like your issues are partly related to configuration 
09:32 < WilcoRogers_> yeah - I'm not sure how to either get rid of the topography option
09:32 < rawsted> everything works fine for me from an osx client, it just seems that the windows client is busted for 7
09:32 < WilcoRogers_> or get the beta working
09:33 < WilcoRogers_> yah I have connection fine with an XP client
09:33 < WilcoRogers_> there are other clients out there
09:35 < WilcoRogers_> http://openvpn.net/index.php?option=com_content&id=357
09:35 <@vpnHelper> Title: Client Packages (at openvpn.net)
09:35 < rawsted> hrm
09:35 < WilcoRogers_> I'm gonna give one of these a try
09:36 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:36 < rawsted> does 'access' have some implication in the server name?
09:37 < WilcoRogers_> yeah - I'm not sure about that - is there a difference between "Access Server" and "Server?"
09:37 < rawsted> denno
09:37 < WilcoRogers_> well I'll give it a shot
09:39 < rawsted> let me know how it goes
09:39 < WilcoRogers_> so far no good
09:40 < WilcoRogers_> it accepts the openVPN config file
09:40 < WilcoRogers_> but seems to time out on the server...
09:40 < rawsted> hrm
09:40 < WilcoRogers_> there was a Wiki page somewhere with a list of clients
09:40 < rawsted> ill try it on one of my windows clients, 1 minute
09:43 < WilcoRogers_> Yeah it just sits there
09:43 < WilcoRogers_> no connection
09:45 < ecrist> !as
09:45 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:48 < rawsted> ecrist: what is access-server and how does it differ?
09:54 < WilcoRogers_> I'm also using the dev version on XP without any problems\
09:54 < rawsted> didn't work for me, same problems
09:54 < WilcoRogers_> hrm ok so let's throw that out the window
09:55 < WilcoRogers_> I've done a bit more research into other options
09:55 <@dazo> WilcoRogers_: which dev version? self-compiled?
09:55 < WilcoRogers_> none of them look any better
09:55 < WilcoRogers_> Umm - just the exe version from the .se website
09:55 < WilcoRogers_> http://openvpn.se/development.html
09:55 <@vpnHelper> Title: OpenVPN GUI for Windows (at openvpn.se)
09:55 <@dazo> the .exe version from .se website is dead, outdated, useless, poisoned, rotten, should not never ever be used
09:56 <@dazo> http://sourceforge.net/projects/openvpn-gui/
09:56 <@vpnHelper> Title: OpenVPN GUI | Download OpenVPN GUI software for free at SourceForge.net (at sourceforge.net)
09:56 <@dazo> This is the latest stuff, which d12fk here on this channel is taking more care of
09:57 < WilcoRogers_> Fantastic
09:58 < WilcoRogers_> I assume the newest one is the most stable?
09:58 <@dazo> d12fk: ^^^
09:58 <@dazo> I would presume so, without having had the need to test the Windows stuff
09:59 < WilcoRogers_> Mmkay
09:59 < WilcoRogers_> That's just the GUI - I need the actuall drivers and stuff too
10:00 <@dazo> yeah ... I believe the latest GUI is included in the latest development snapshot for  Windows ....
10:00  * dazo looks up the mail
10:00 <@dazo> WilcoRogers_: http://thread.gmane.org/gmane.network.openvpn.devel/4852/focus=4854
10:00 <@vpnHelper> Title: Gmane Loom (at thread.gmane.org)
10:03 < WilcoRogers_> rawsted: were you using the .se installers?
10:04 <@vpnHelper> RSS Update - forum: inestable connection <http://forums.openvpn.net/topic8469.html#p13736>
10:05 < WilcoRogers_> Great - I'm connected and have ping!
10:05 < WilcoRogers_> thanks a mission for that dazo
10:05 < WilcoRogers_> *million
10:05 < WilcoRogers_> now do I have connectivity between computers on the VPN... *shifty eyes*
10:08 < WilcoRogers_> nope
10:09 < d12fk> WilcoRogers_: well haven't had much time in the past quarters, but this will pick up pace  towards the end of year starting _now_ =)
10:09 < rawsted> WilcoRogers_: i was, i'll try the more maintained stuff now
10:10 < rawsted> thanks dazo, d12fk 
10:10 < WilcoRogers_> rawsted: I'ts much cleaner now
10:10 < rawsted> WilcoRogers_: which package do i want?
10:11 < WilcoRogers_> Use this: http://thread.gmane.org/gmane.network.openvpn.devel/4852/focus=4854
10:11 <@vpnHelper> Title: Gmane Loom (at thread.gmane.org)
10:11 < WilcoRogers_> First link in the thread
10:11 < rawsted> thanks
10:11 < WilcoRogers_> np
10:11 < WilcoRogers_> Hey, random question: How do I change my nick?
10:12 <@dazo> WilcoRogers_: /nick <new nick>
10:13 < WilcoRogers_> mmkay thanks
10:16 <@vpnHelper> RSS Update - forum: inestable connection <http://forums.openvpn.net/topic8469.html#p13738> || Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13737>
10:19 < WilcoRogers_> So now the question is: If I want all the machines on the VPN to be able to talk to all the other machines on the VPN
10:19 < WilcoRogers_> Do I follow this? http://openvpn.net/index.php/open-source/documentation/howto.html#scope
10:19 <@vpnHelper> Title: HOWTO (at openvpn.net)
10:32 < WilcoRogers_> rawsted: any luck?
10:33 < Dougy> WilcoRogers_: 
10:33 < Dougy> client-to-client in the config
10:33 < Dougy> !client-to-client
10:33 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other clients
10:34 < WilcoRogers_> so I enable that in the server config?
10:34 < WilcoRogers_> Ah I see it
10:35 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:35 -!- mode/#openvpn [+v s7r] by ChanServ
10:35 < WilcoRogers_> You sir are fantastic
10:36 < WilcoRogers_> Now, if I DID per chance want to use selective firewall rules, I assume I should follow the HOWTO
10:46 <@vpnHelper> RSS Update - forum: inestable connection <http://forums.openvpn.net/topic8469.html#p13739>
10:53 <@vpnHelper> RSS Update - forum: SSL Certificate and the Vmware appliance <http://forums.openvpn.net/topic8470.html>
10:59 <@vpnHelper> RSS Update - forum: Configuration OpenVPN Client <http://forums.openvpn.net/topic8444.html#p13741>
11:05 <@vpnHelper> RSS Update - forum: Redirect-gateway Reroutes Everything to the Server's IP <http://forums.openvpn.net/topic8467.html#p13742>
11:25 < Dougy> WilcoRogers_:  did you figure it out
11:36 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
11:36 -!- mode/#openvpn [+v Axeman] by ChanServ
11:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:43 < WilcoRogers_> Dougy: no luck yet
11:43 < WilcoRogers_> Just got back from lunch
11:44 < WilcoRogers_> Now I'm trying to reinstall OpenVPN GUI, and it's crashing on install :( worked perfectly fine before
11:48 < WilcoRogers_> Can anyone point me to a valid OpenVPN GUI installer for WinXP?
11:48 < pr0zoid> get the one off the website.
11:48 < pr0zoid> there's no other.
11:50 < WilcoRogers_> which website? I get brought to this wiki
11:50 < WilcoRogers_> https://community.openvpn.net/openvpn/wiki/RelatedProjects
11:50 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
11:50 < WilcoRogers_> But those snapshot binaries don't include the network driver
11:52 < WilcoRogers_> The installer errors out: "Error opening file tapsinstall.exe"
12:02 < WilcoRogers_> Alright, back up and running
12:05 < WilcoRogers_> Now I just need to get a dataserver to connect to the VPN
12:05 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13743>
12:05 < fonestar> hello all, can anyone give me some advice?
12:10 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
12:10 < Bushmills> depends on whether you're willing or capable to take it.  try your parents.
12:11 < Bushmills> definitely cheaper than a therapist.
12:11 < Bushmills> for legal advice, a lawyer may be preferable
12:15 < fonestar> no more like advice on OpenVPN running on Windows Server x64 R2
12:16 < fonestar> no matter what I try (tcp, udp on tap or tun) port 1194 does not show as listening even though the interface is up
12:21 < WilcoRogers_> fonestar: Have you a firewall up?
12:21 < fonestar> I added exceptions for domain, private and public
12:21 < fonestar> all
12:22 < fonestar> advfirewall
12:22 < WilcoRogers_> it sounds like a firewall problem. Though Bushmills probably has a better opinion
12:23 < fonestar> and regardless of firewall I should still see see LISTENING on interface
12:23 < WilcoRogers_> True say
12:23 < fonestar> think its something with 64bit tap-win32 drivers maybe
12:24 < WilcoRogers_> There's no signed driver issues?
12:25 < fonestar> no it installed okay
12:26 < fonestar> says no updates are available
12:26 < rawsted> WilcoRogers_: i installed the new client and got it to work/connect after disabling signed driver enforcement during boot (f8), but my traffic isn't getting forwarded through the VPN as it should according to my server config. everything works as expected using the osx client tunnelblick, i honestly think it must be windows
12:27 < WilcoRogers_> rawsted: when you ping the vpn server it routes through the outside?
12:27 < rawsted> im not sure about ping but when i browse its not using the vpn connection
12:28 < WilcoRogers_> do a tracert
12:28 < WilcoRogers_> tracert 10.8.0.1
12:28 < rawsted> ah WilcoRogers_ 
12:28 < WilcoRogers_> then you'll know for sure
12:28 < rawsted> i just got it to work
12:28 < rawsted> by running as admin
12:28 < WilcoRogers_> oh good
12:29 < WilcoRogers_> Ah yes
12:29 < rawsted> that was the problem, some of the network config it was trying to make during connect wasn't allowed due to perms
12:29 < WilcoRogers_> that's important
12:29 < rawsted> are you still having issues?
12:29 < WilcoRogers_> I'm trying to get another server to connect
12:29 < WilcoRogers_> which is giving me problems
12:30 < WilcoRogers_> but so far I've got a three-way chatter going between 2 windows clients and the server
12:30 < rawsted> what platform is the server?
12:30 < rawsted> the additional server
12:30 < WilcoRogers_> Ubuntu 10.04
12:31 < rawsted> but you're using it as a client on the vpn network in this capacity right?
12:31 < WilcoRogers_> yes
12:31 < WilcoRogers_> the config file is set to client
12:31 < rawsted> weird
12:31 < WilcoRogers_> shouldn't be any different than my other confgs, should it??
12:32 < rawsted> not as far as i know, no
12:32 < rawsted> just set the correct certificate/key options
12:32 < WilcoRogers_> Yeah, they're connected
12:32 < WilcoRogers_> when I start it up it gives [OK] messages
12:32 < WilcoRogers_> but there's no ping
12:33 < WilcoRogers_> do I have to do anything special with my interfaces file?
12:33 < rawsted> i'm not sure about that, but did you look into firewall rules?
12:33 < WilcoRogers_> hrm I'm not sure I did on the client server...
12:34 < WilcoRogers_> hold on
12:34 < WilcoRogers_> added a rule
12:35 < WilcoRogers_> but no difference
12:35 < WilcoRogers_> a quick look at ifconfig shows no sign of the VPN ip addresses
12:35 < Bushmills> WilcoRogers_: concerning windows, i'm not in a position to have a qualified opinion
12:35 < WilcoRogers_> Bushmills: okay. I shall not refer you anymore
12:36 < WilcoRogers_> am I supposed to have another device in there?
12:37 < rawsted> in network settings, yes
12:37 < rawsted> the tap device should appear as an adapter
12:38 < rawsted> or you're talking about ifconfig on ubuntu?
12:38 < WilcoRogers_> ifconfig on ubuntu
12:38 < WilcoRogers_> I would assume it should also add a "device", no?
12:38 < rawsted> i would assume as well
12:38 < rawsted> but this is day 2 for me so im probably not the best person to ask
12:40 < WilcoRogers_> That's alright, I've been at it for almost a week now
12:40 < rawsted> well, good luck WilcoRogers_, i'm off
12:40 < WilcoRogers_> thanks rawsted
12:42 < WilcoRogers_> So can anyone give me a heads up on what the /etc/network/interfaces should look like?
12:42 < WilcoRogers_> right now I just have an eth0 and the loop
12:42 < WilcoRogers_> Just as a client trying to connect to the server
12:49 < WilcoRogers_> !goal Thats' my goal, at the moment
12:58 < Bushmills> for openvpn tun devices? no changes to interfaces needed
12:58 < Bushmills> and no ifconfig to set their ip addresses.
12:58 < Bushmills> leave that to the openvpn server, to assign addresses to openvpn clients
13:02 < WilcoRogers_> Right - I did that, I didn't touch a thing. But there's no ping between the server and client
13:03 < WilcoRogers_> From what I see, it doesn't seem to grab an IP at all. Shouldn't it have 2? One external one to route to the internet, and one to route to the VPN? (That's the way it is in the windows one, anyways)
13:08 < atum> !welcome
13:08 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:08 < atum> !goal
13:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:11 < Bushmills> WilcoRogers_: if you don't get a new interface and ip address on client, editing interfaces or using ifconfig won't fix that.  better fix the openvpn config
13:11 < WilcoRogers_> and that's the client side config file correct?
13:11 < WilcoRogers_> or the actual program config file
13:12 < Bushmills> can be either. both are needed
13:12 < WilcoRogers_> where is the openvpn config file found?
13:12 < Bushmills> where have you put it?
13:12 < WilcoRogers_> all I have in /etc/openvpn is the key files and client conf file
13:12 < WilcoRogers_> (and the crt file)
13:12 < Bushmills> "... and client conf file"  - there it is
13:13 < WilcoRogers_> okay - but that is currently identical to my windows config files
13:13 < WilcoRogers_> and I'm not sure what might be wrong with it
13:13 < Bushmills> check logs
13:13 < WilcoRogers_> where are the logs stored?
13:14 < Bushmills> where you told openvpn to put them
13:15 < WilcoRogers_> I didn't get the option: I would assume it would be where the program installed
13:16 < Bushmills> if you don't tell openvpn to log to a specific file, it will go through syslog, and therefore depend on your system where it's written to 
13:17 < WilcoRogers_> is there an option when starting up openvpn to log to a specific place?
13:17 < Bushmills> yes
13:17 < WilcoRogers_> And what might that argument be?
13:17 <@vpnHelper> RSS Update - forum: inestable connection <http://forums.openvpn.net/topic8469.html#p13744>
13:18 < Bushmills> the argument will be directory and name of log file
13:19 < WilcoRogers_> so /etc/init.d/openvpn start /etc/openvpn/log.file will write a log to that file?
13:19 < Bushmills> no. the argument alone won't do - you also need the directive
13:19 < WilcoRogers_> no, that looks for the conf file in there
13:19 < Bushmills> but you only asked for the argument
13:20 < WilcoRogers_> I see. So would you be able to provide me with both the directive and the argument?
13:20 < Bushmills> log
13:20 < Bushmills> (that was a no-brainer, wasn't it :) )
13:20 < WilcoRogers_> Mayhaps, but there are so many different directives out there
13:21 < Bushmills> then you're happy to learn that the configuration directive for logs is "log", and not "remove_appendix" :D
13:22 < WilcoRogers_> Very happy. However I'm still not getting the syntax. Would you perhaps be able to provide me with a sample command to start openvpn and write the log to log.file?
13:22 < Bushmills> !--
13:22 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
13:28 < WilcoRogers_> Still not getting it. Really?
13:29 < Bushmills> take a look at the other configuration directives in your config file. apply the same pattern to the log directive
13:29 < Bushmills> when specifying it on command line, you need to to that with the openvpn program, not with the /etc/init.d script your operating system provides
13:30 < Bushmills> that's just a script, starting the openvpn program, and has otherwise not relationship to it
13:30 < Bushmills> no relationship
13:30 < WilcoRogers_> Right. Well I threw it in the config file, and it worked
13:31 < WilcoRogers_> so what kind of errors should I be looking for?
13:31 < WilcoRogers_> I have a TLS handshake failure
13:31 < Bushmills> errors like those, for example
13:32 < Bushmills> in general, errors are what's prevents success
13:32 < WilcoRogers_> so that might indicate a problem with the tls auth key
13:32 < Bushmills> well, it at least indicated a problem with TLS handshake 
13:32 < WilcoRogers_> How does the handshake work?
13:33 < Bushmills> #openssl will be a more authoritative resource for that
13:34 < Bushmills> http://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_handshake_in_detail
13:34 <@vpnHelper> Title: Transport Layer Security - Wikipedia, the free encyclopedia (at en.wikipedia.org)
13:42 -!- dazo is now known as dazo_afk
13:51 < WilcoRogers_> Found it. Bad ca.crt file.
13:51 < WilcoRogers_> Thanks for your persistance that I figure this out myself Bushmills
13:52 < Bushmills> can't do anything else if you don't provide more information
13:52 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
13:52 < Bushmills> i'm not playing the "20 questions" game to found out what ails your system
13:52 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
13:52 -!- mode/#openvpn [+o raidz] by ChanServ
13:53 < Bushmills> find out
13:58 < WilcoRogers_> Bushmills: I'm saying that in all honesty.
14:00 < Bushmills> as a rule, people who manage to help themselves earn a higher esteem here. ditto on other channels, surely.
14:01 < WilcoRogers_> Can openVPN allow users to set a static VPN ip?
14:01 < ecrist> too bad we can't dole out gold stars as some sort of currency
14:01 < ecrist> yes
14:02 < WilcoRogers_> is there a tutorial around?
14:05 < EugeneKay> Several tutorials are available. I picked it up from the HOWTO included in the documentation.
14:06 < WilcoRogers_> Yeah going through that how
14:06 < WilcoRogers_> *now
14:30 < orudie> greetings. what is the process of preventing an existing client connecting to my vpn ?
14:37 < reiffert> orudie: "revoking the certificate"
14:40 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:40 -!- mode/#openvpn [+v s7r] by ChanServ
14:41 < reiffert> !crl
14:41 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
14:41 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
14:41 < reiffert> !factois search --values revoke
14:41 < reiffert> !factoids search --values revoke
14:41 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
14:41 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
15:14 < kwikness> is there an openvpn option that will allow me to pass both username and password on the command line?
15:17 < EugeneKay> kwikness - CLI? Unknown, likely not, for ps -ef |grep openvpn worries. However, --auth-user-pass passfile.txt should do the trick
15:18 < kwikness> EugeneKay, i tried that, but i get "Options error: You must define TUN/TAP device (--dev)"
15:19 < kwikness> EugeneKay, the txt file is just supposed to be a 2 line file with the first line as my username and the second as my password right?
15:19 < EugeneKay> Correct. THe error in question does not sound like it has anything at all to do with your user/pass :-p
15:21 < kwikness> but when i connect otherwise i don't ever have to pass any other options?
15:21 < kwikness> i just do 'openvpn myfile.ovpn' and get prompted for username/pass
15:22 < EugeneKay> My guess is that adding CLI options after the .ovpn file definition is causing it to throw out the ovpn file.
15:22 < EugeneKay> Try putting the auth-user-pass filename.txt in the .ovpn config instead
15:25 < kwikness> "Mon Jul 18 16:24:31 2011 Sorry, 'Auth' password cannot be read from a file"
15:25 < kwikness>  /facepalm
15:27 < EugeneKay> If the man page is to be believed, you need the --enable-password-save option built in at compile time.
15:28 < EugeneKay> Hrm.
15:36 < reiffert> EugeneKay: there should be ENVIRONMENT Variables for doing that.\
15:36 < EugeneKay> Tell it to the maintainer
15:36 < reiffert> dazo_afk: see above
15:37 < reiffert>               If method is set to "via-env", OpenVPN will call script with the environmental variables username and password set to the username/password
15:37 < reiffert>               strings  provided  by the client.  Be aware that this method is insecure on some platforms which make the environment of a process publicly
15:37 < reiffert>               visible to other unprivileged processes.
15:37 < reiffert> !factoids search env
15:37 <@vpnHelper> 'notopenvpn', 'openvz', 'route_outside_openvpn', 'openvzlinnat', and 'openvznat'
15:38 < rich_> I have a weird issue with my openvpn server - until I ping a machine from the vpn server, it does not respond to pings from other machines.  After I ping another machine, it allows the response.
15:38 < rich_> anyone seen this?
15:38 < rich_> I would think it's an iptables issue, but itpables is super simple.
15:39 < reiffert> hm it wont help.
15:50 < kisom> rich_: temporarily allow all traffic to pass thru iptables and see if that helps.
15:51 < EugeneKay> That sounds like a classic iptables stateful rule funkiness
15:53 < reiffert> EugeneKay: it might be arp related stuff.
15:57 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
16:03 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
16:03 -!- mode/#openvpn [+v Axeman] by ChanServ
16:12 < rich_> kisom I did that, and it doesn't
16:13 < rich_> rather, I temporarily flushed iptables.  it was weird.
16:13 < rich_> it still requires an outbound connection.
16:14 < kisom> funky. any other firewalls on your lan?
16:14 < reiffert> proxy arp?
16:14 < Sur3> hi, i've clients connected to a server but they dont see each other but just the server, so 10.0.0.14 can ping 10.0.0.1 but not 10.0.0.6 do you know what could be wrong?
16:15 < kisom> rich_: like reiffert is saying, check the arp table on another machine and see if it matches your server
16:15 < kisom> Sur3: openvpn blocks client-to-client traffic by default
16:16 < reiffert> !client-to-client
16:16 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
16:16 <@vpnHelper> clients
16:16 < Sur3> ah ok thought something like that :/
16:17 < Sur3> is that an option in the openvpn-conf or do i need to configure iptables?
16:17 < reiffert> !man
16:17 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
16:17 < kisom> Sur3: add "client-to-client" to the conf, thats it.
16:17 < Sur3> ah thx
16:17 < Sur3> only on the server or also on the clients-configs?
16:17 < kisom> server only
16:17 < reiffert> former
16:17 < Sur3> thx alot
16:21 < rich_> kisom, reiffert, there are no other firewalls on my lan
16:21 < rich_> and the arp table on my vpn server is strangely empty
16:21 < rich_> almost empty
16:21 < rich_> so that could be an issue
16:21 < reiffert> anything to layer 2 bridging?
16:22 < reiffert> tap?
16:25 < Sur3> yay works great, i'm off^^
16:38 < reiffert> rich_: any answers?
16:48 < reiffert> meep meep
17:13 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
17:19 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
17:29 < Xgates> hey guys
17:29 < Xgates> when using OpenVPN do you need to allow dns requests from the server? Cause my latest firewall rules that I have show dns being blocked and I can't get online so I'm not sure if this is the problem or not?
17:31 < Xgates> Shorewall:fw2net:DROP: IN= OUT=eth0 MAC= SRC=192.168.1.8 DST=192.168.1.1 LEN=59 TOS=00 PREC=0x00 TTL=64 ID=47906 CE DF PROTO=UDP SPT=47720 DPT=53 LEN=39
17:32 < fonestar> has anyone managed to get OpenVPN working on Windows Server 2008 64bit?
17:36 < EugeneKay> As a server or client?
17:39 < Xgates> does anyone know if on the client side it's normal for a server to request a DNS reply? I wasn't aware that as a client I needed to accept dns requests from the server....
17:40 < Xgates> I'm not running my own server I'm using a VPN service from some company...
17:41 < reiffert> fonestar: /me
17:41 <@vpnHelper> RSS Update - forum: On The Client Side Do You Need To Allow DNS Requests? <http://forums.openvpn.net/topic8471.html>
17:42 < Xgates> what's the post have to do with getting an answer on irc?
17:43 < reiffert> guess someone got your problem, try to help each other.
17:43 < Xgates> that's my post :)
17:43 < EugeneKay> Xgates - no, the client should not be answering any DNS requests from the server. Something is misconfigured.
17:44 < Xgates> ok it's their server then because I didn't have problems with this before thanks
17:44 < EugeneKay> Xgates - the bot posts forum notifications in here because it keeps people up-to-date on what is going on in the forum.
17:44 < Xgates> I thought so...
17:44 < Xgates> thanks
17:51 < fonestar> server
17:51 < EugeneKay> fonestar - nope, can't say I have. Works fine as a Client, tho.
17:52 < fonestar> yeah, I think it's the 64 bit Win-TAP driver
17:52 < fonestar> doesn't seem to identify it properly
18:00 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
18:00 -!- mode/#openvpn [+v Axeman] by ChanServ
18:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
18:46 < genlime> Can I do this iptables -t nat -A PREROUTING -i ipaddress -p tcp --dport 53 -j DNAT --to :5353 instead of iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 53 -j DNAT --to :5353
18:52 < snappy> no.
18:53 < snappy> use -s instead
20:04 < tSlefh> hi all
20:05 < EugeneKay> !beer
20:05 < EugeneKay> Oh. :-(
20:05 < tSlefh> ... is that a real command?
20:05 < tSlefh> lol
20:05 < EugeneKay> Used to be.
20:05 < tSlefh> ahahaha
20:05  * EugeneKay gets up, walks to fridge
21:19 < AEnertia> Hi all, I have a question regarding udpv4 mtu fragmentation
21:19 < AEnertia> I have an annoying need to be able to transport large udp snmp frames (upto 9126) over a wan link to some remote network elements.
21:20 < genlime> Hello. I have  a problem. I have create a tunnel on udp 53 and the client can connect to the server but there in no internet
21:20 < AEnertia> genlime, routing issue, modify the routing and/or nat tables on the server and client
21:21 < AEnertia> also on port 53 you may be having issues with dns queries being blocked etc... so make sure you test with ip's rather than fqdns
21:23 < genlime_> Hello. I have  a problem. I have create a tunnel on udp 53 and the client can connect to the server but there in no internet
21:24 < genlime_> What could I miss?
21:30 < AEnertia> routing and nat
21:30 < AEnertia> have you checked the route on the client has been added
21:31  * ecrist waves
21:41  * EugeneKay pets ecrist 
21:43 < ecrist> :)
21:54 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
22:11 <@vpnHelper> RSS Update - forum: Just for fun - brief stats <http://forums.openvpn.net/topic8472.html>
22:15 < tj416> !welcome
22:15 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:16 < tj416> !goal
22:16 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:24 < tj416> Hey everyone, I have sucessfully setup a VPN which tunnels my internet traffic through another server..My question is though..when I creat client certificates..how do I prevent the sharing of crt files? so that only one crt can be connected with the server at one time
22:24 < tj416> Much like StrongVPN does for their users
22:24 < tj416> I hope my question makes sense :)
22:27 < EugeneKay> The default is single-connection-per-common-name(ie, crt/key pair)
22:33 < tj416> but if I recall correctly while my computer is connected to the server using a set of crt and key
22:34 < tj416> I can connect another computer as well using that same pair of crt and key file
22:34 < tj416> I want to prevent that
22:34 < tj416> where simultaneous connections are not possible
22:40 < tj416> If there is something about this posted anywhere would appreciate if you could link me to it
22:59 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html>
23:06 < tj416> anyone got any idea how I can accomplish this?
--- Day changed Tue Jul 19 2011
00:24 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
00:30 < EugeneKay> You want to lock a client's key/crt pair to only your server?
02:17 < NoReGreT> is there something to do on the client so i can use the DNS pushed by the server ?
02:21 -!- dazo_afk is now known as dazo
02:50 <@vpnHelper> RSS Update - forum: Client Cert expiry date when creating key <http://forums.openvpn.net/topic8474.html>
02:51 < wjwoodward> I'm running debian 6. In the process of setting up openvpn. Get towards the end, run "/etc/init.d/openvpn start" and get "Options error: In [CMD-LINE]:1: Error opening configuration file"
02:52 < wjwoodward> There is only one .conf in /etc/openvpn and it is the standard one from /usr/share/doc/openvpn/examples/sample-config-files that I haven't touched
03:12 -!- Cain` is now known as Cain
03:29 < wjwoodward> when running - openvpn --config /etc/openvpn/server.conf
03:29 < wjwoodward> I get - NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
03:29 < wjwoodward> Tue Jul 19 18:27:27 2011 Diffie-Hellman initialized with 1024 bit key
03:29 < wjwoodward> Tue Jul 19 18:27:27 2011 Cannot load certificate file server.crt: error:02001002:system library:fopen:No such file or directory: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib
03:32 <@vpnHelper> RSS Update - forum: Client Cert expiry date when creating key <http://forums.openvpn.net/topic8474.html#p13749>
03:45 < Mowee> Morning
03:47 < wjwoodward> morning
03:47 < reiffert> three people do share #openvpn and #rsync ;)
03:48 < wjwoodward> trying to get openvpn running on debian 6. get to the stage of "openvpn start" and get the message "Error opening configuration file"
03:48 < wjwoodward> there is only one .conf in /etc/openvpn
03:49 < wjwoodward> I just copied in theref from usr/share/doc/openvpn/examples/sample-config-files
03:58 < jdoe> I'm having a problem with openvpn 2.2.1 and the current tunnelblick beta... strange mtu errors I've never seen before. Whenever I try to connect I get messages saying that one side things link-mtu should be 1585 and the other thinking it should be 1586. (when no mtu options are set at all)
03:58 < jdoe> why?
04:35 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p13750>
04:54 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p13751>
05:11 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates without unexpected <http://forums.openvpn.net/topic8475.html>
05:54 < txxt> hi. sometimes when i use internet connection from a library, i cannot connect to my regular OpenVPN server. do you know how can i trace it (mean check what ports the firewall i am under allows to acces) ? also any possible workaround to be able to connect to my openvpn ? tks
05:55 <@dazo> txxt: do you use TCP or UDP?
05:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:55 -!- mode/#openvpn [+v s7r] by ChanServ
05:56 <@dazo> one "trick" is to have a separate openvpn config running on TCP port 443 in such cases ... unless there's a proxy along the way which does deep packet inspection
05:56 <@dazo> (or firewall, for that matter)
05:57 < txxt> dazo: think it is  UDP 
05:57 < txxt> dazo: yes, that was the trick that occured to me
05:57 < txxt> but really wanted to keep the 443 for other things :|
05:57 < txxt> that is why i wanted to know what other ports i could connect from thie network 
05:57 < txxt> this*
05:57 <@dazo> txxt: well, if your openvpn server is on Linux or *BSD ... you have --port-share
05:58 < txxt> yes it is on linux 
05:58 <@dazo> then openvpn parses packets which is openvpn packets, and forwards all other traffic to the server defined via --port-share
05:58 < txxt> ok that might be a good option, to change the listening port
05:59 <@dazo> but don't use TCP unless that's the last way out .... TCP got performance issues as well, esp. on unreliable links (like packet drops, etc)
05:59 < txxt> true
06:00 < txxt> ok i really must check what UDP ports i am allowed to connect from this network to the exterior
06:00 < txxt> and find a suitable (differente from 80, 443) to connect to my vpn server
06:01 < txxt> thanks for the tips dazo ;9
06:02 < txxt> ;)
06:03 <@dazo> sure, no prob :)
06:15 -!- ele_ is now known as ele
06:16 -!- nuttersppadic is now known as sppadic[A]
06:16  * sppadic[A] is now away - Reason : lunchtime
06:35 < NoReGreT> is there something to do on the client so i can use the DNS pushed by the server ?
06:40 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates without unexpected <http://forums.openvpn.net/topic8475.html#p13753>
06:48 < Bushmills> NoReGreT: with unixoids, yes
06:49 < Bushmills> pushed name server is put into environment variable for client event script.  no change to resolver configuration is actually done. the event script must do that.
06:59 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p13754>
07:11 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13755>
07:17 <@vpnHelper> RSS Update - forum: New Global Moderator: george <http://forums.openvpn.net/topic8476.html>
07:19 -!- sppadic[A] is now known as nuttersppadic
07:19  * nuttersppadic is no longer away : Gone for 1 hour 3 minutes 35 seconds
07:23 < rollkeyboard> I'm trying to find an router implementations of OpenVPN, specifically for SMB site-to-site and out-of-band access . Like Vyatta and Astaro. Anyone know any?
07:26 < ecrist> dd-wrt
07:41 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13757>
08:00 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
08:00 -!- mode/#openvpn [+v Axeman] by ChanServ
08:04 < Optic> do I need to do anything special to set up vpn to handle lots of clients?
08:05 < Optic> right now it seems to be failing after a while, and all clients become unreachable
08:05 < Optic> perhaps linux is running out of some resource
08:06 < Optic> Jul 19 09:05:56 vpn openvpn[3432]: 74.198.9.74:34889 MULTI: new incoming connection would exceed maximum number of clients (1024)
08:06 < Optic> OH :)
08:10 < Optic> assertion (!sk->sk_forward_alloc) failed at net/ipv4/af_inet.c (152)
08:14 < ecrist> Optic: that might be a question for #openvpn-devel, later today
08:15 < Optic> we're trying to run about 2000 clients right now
08:15 < Optic> maybe I need more than one server :)
08:16 < Optic> so I'd like to figure out the most efficient setup for that, I guess
08:16 < Optic> the docs don't have much on tuning
08:21 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p13758>
08:28 < ecrist> Optic: openvpn is single-threaded
08:29 < ecrist> you're probably better off running multiple instances
08:29 < ecrist> even on the same box, as most boxes have multiple cores
08:35 < ecrist> !tuning
09:03 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p13753>
09:16 < Bushmills> rollkeyboard: openwrt has openvpn in its package repository
09:16 < Bushmills> i.e. reflash router with openwrt, install openvpn by command 
09:18 < Optic> hmm!
09:18 < Optic> right now we're depending on static vpn ips from the -ipp.txt files, we'll have to fix our shit to not require that :)
09:19 < Optic> we have it running on a fire-breathing 8-core xeon box, so running multiple instances would be good
09:30 < Optic> !tuning
09:30 < Optic> hmm
09:31 -!- dazo is now known as dazo_afk
09:44 -!- dazo_afk is now known as dazo
10:03 < ecrist> Optic: ironically, 7 of the 8 aren't doing anything for your VPN at the moment. ;)
10:03 <@vpnHelper> RSS Update - forum: Non-Admin usage of OpenVPN on Windows <http://forums.openvpn.net/topic8250.html#p13759>
10:03 < ecrist> OpenVPN 3.0 should have multi-threading, though.
10:03 < ecrist> however, you're looking at 1+ years before that comes out.
10:03 < Optic> ecrist: actually, 8 of the 8.  the 15-min load average on the box is about 0.03 :)
10:04 < Optic> our vpns are very low traffic, we use them for monitoring and the occasional push notification
10:04 < Optic> so mostly it's just a way to have all of our clients easily reachable through a large variety of nats and firewalls and lans and all that bullshit :)
10:04 < Optic> which openvpn is *excellent* at
10:09 < Optic> if we're hitting process limits, etc, running multiple instances of openvpns should help too
10:46 < JyZyXEL> what file changes when you revoke a cert?
10:47 < darkdrgn2k3> hey guys
10:47 < darkdrgn2k3> i have a setup PC1 -> Openwrt ->openvpn-> Openvpn server->PC2
10:47 < darkdrgn2k3> pc1 cant see pc2  "  reports: Destination protocol unreachable.
10:47 < darkdrgn2k3> "
10:47 < darkdrgn2k3> but openwrt CAN see pc2
10:48 < darkdrgn2k3> and pc2 can see pc 1
10:52 < Bushmills> darkdrgn2k3: firewall
10:55 < darkdrgn2k3> Bushmills: dam thats what i thought
11:07 < Optic> mmm bushmills
11:07 < Optic> black bush on the rocks
11:07 < Optic> yes pls
11:19 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13760>
11:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
11:24 < rob0> mattock not here, hmm. I just had a comment regarding his list post.
11:25 < rob0> "People who do not understand basic routing concepts (and basic community ethics, for that matter) should not be writing HOWTO documentation for OpenVPN."
11:33 < snappy> basic community ethics?
11:33 < snappy> never read a howto that seemed unpleasant
11:37 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p13761>
11:43 < rob0> snappy, are you reading openvpn-users list?
11:44 < snappy> heh no
11:52 < ecrist> which message, rob0?
11:55 <@dazo> rob0: please do me a favour ... post that comment to the mailing list ... if mattock had read the whole thread, I think he wouldn't have answered what he did
11:55 < rob0> hehe
11:56 < ecrist> which message?
11:56  * ecrist doesn't see it
11:56 < rob0> mattock's post today
11:56 <@dazo> ecrist: http://thread.gmane.org/gmane.network.openvpn.user/32406/focus=32415
11:56 < rob0> Date: Tue, 19 Jul 2011 09:38:14 +0300
11:57 < rob0> I was considering a reply to the twerp, but he kept getting more obnoxious.
11:58 < rob0> (and that top-posting, yikes!)
11:58 <@dazo> lol ... my thoughts *exactly* ;-)
11:58 < ecrist> I didn't see where he said what rob0 quoted
11:59 -!- Netsplit *.net <-> *.split quits: oc80z
11:59 -!- louiscyfer_ is now known as louiscyfer
11:59 <@dazo> he didn't ... which is why rob0 should reply with that ;-)
12:00 < ecrist> who runs the mailing list?
12:00 < ecrist> ohhh, I get it now.
12:01 <@dazo> ecrist: it's hosted on sf.net .... but james and mattock got admin access to it
12:01 < ecrist> ok
12:01 < ecrist> so long as we know who the admins are.
12:02 < ecrist> will be a feather I'll seek at some point. ;)
12:02 <@dazo> hehe :)
12:02 < ecrist> got my paws in everything else. :)
12:03 <@dazo> ecrist: seeking world domination? ;-)
12:05 < jdoe> !welcome
12:05 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:05 < jdoe> !goal
12:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:05 < ecrist> dazo: no, just openvpn domination
12:06 <@dazo> :)
12:06  * ecrist not likely to let go of things he works hard for.
12:06 < WilcoRogers> Hey - I'm wondering if it's possible to have a DNS server on the VPN to point people to the right machines on the VPN. Can anyone point me in the right direction?
12:08 < ecrist> yes.  start a dns server, create some zones, push dns options to vpn clients
12:08 < ecrist> :)
12:09 < WilcoRogers> Okay - and the DNS server option I push - would that just be the VPN server's IP? (Since they're installed on the same machine)
12:10 < ecrist> sure
12:12 < WilcoRogers> I suppose this counts as "non-internet use"
12:13 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
12:15 < rob0> dazo, done.
12:16 <@dazo> rob0: thx, I suppose :)
12:16 < rob0> we'll see :)
12:16 <@dazo> hehe
12:25 < rob0> I got my copy of it.
12:27 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:27 -!- mode/#openvpn [+v s7r] by ChanServ
12:31 <@dazo> rob0: excellent :)
12:33 < snL20> when I want to use --auth-user-pass on the client side what do I need on the server side where do I define the username/password combinations ?
12:36 < snL20> nm
12:36 <@dazo> snL20: you need to either write a script and use --auth-user-pass-verify ... or use a C plug-in, and --plugin
12:40 < snL20> dazo: yeah my distro has an pam so file.. thanks should have just googled :D
12:40 < jdoe> I asked last night but had to sleep, I'm having a problem with ovpn 2.2.1 and the current beta of tunnelblick... I'm getting a mismatch on local/remote options, client and server don't agree on link-mtu, server says 1586, client says 1585. Neither specifies any mtu/frag/mss options in its config. Any suggestions on why that might be?
12:41 <@dazo> snL20: yeah, that's usually shipped by default ... that should work fine
12:42 <@dazo> jdoe: try using --tun-mtu in both client and server config, with a coherent value
12:44 <@dazo> jdoe: sorry, I mean --link-mtu ...
12:44 <@dazo> !mtu
12:44 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
12:46 < jdoe> dazo: I tried that last night, iirc it then had the same issue with tun-mtu (again, off-by-one) but I don't have the client in front of me right now.
12:46 < jdoe> I'm also not getting far enough to have the problems described. It just doesn't connect at all.
12:46 <@vpnHelper> RSS Update - forum: Configuration OpenVPN Client <http://forums.openvpn.net/topic8444.html#p13762>
12:47 <@dazo> jdoe: I would first try --mtu-test on the client ... just to see what it says ... and then you'll need to use the lowest MTU value reported on both sides for --link-mtu .... but I believe the troubleshooting guide over will go deeper in detail
12:47 <@dazo> if the --link-mtu differs, connectivity problems are expected
12:47 < jdoe> does mtu-test work if it won't connect? I tried pinging arbitrary hosts last night, ping -s 1472 works, so I expect the default 1500 should as well.
12:48 < jdoe> I guess I'll have to experiment some more later. I've never had this issue before :/
12:49 <@dazo> jdoe: it should try to connect several times, using different MTU values, so I believe it also checks the --link-mtu values ... but you're right, it might be it is only useful for --tun-mtu ... I don't recall the details here
12:49 <@dazo> anyway ... away me goes ... *puff*
12:49 < jdoe> thanks, I'll give it a shot later.
12:50 < WilcoRogers> ercist: So if I have it set up that the client handles internet requests itself (i.e. no redirect-gateway), and routes VPN  traffic to the VPN, how can I make it check the DNS server on the VPN first?
12:50 -!- dazo is now known as dazo_afk
12:51 < gr4y5ky> Hi there ;-) I have question: Is it possible to run a shell script as root after openvpn connected succesfully while the system is booting?
12:52 < gr4y5ky> !welcome
12:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:52 < gr4y5ky> !goal
12:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:53 < WilcoRogers> ecrist (sorry got the name wrong): So if I have it set up that the client handles internet requests itself (i.e. no redirect-gateway), and routes VPN  traffic to the VPN, how can I make it check the DNS server on the VPN first?
12:54 < snL20> if I want a setup that just uses a CA and username/pass what would I need to specify of configuration options on the server ? (just the cert specific part and the user/pass i've already figured) ??
12:54 < snL20> its currently complaining of not having a cert file
12:55 < ecrist> by passing DNS requests to a VPN IP.
13:01 < WilcoRogers> so I can pass the DNS requests from the client through the VPN IP, and if it doesn't find it, what will it do?
13:09 < ecrist> try the next one?
13:10 < pons> Hello guys, is there any way a client connection is forcefully made through a determined interface? I need to raise 2 different VPN connections to a server using 2 different interfaces.
13:11 < WilcoRogers> Okay. But right now, as far as I can tell, the DNS lookup from the client is not being pushed through the VPN
13:12 < WilcoRogers> Would I not include this: push "dhcp-option DNS 10.8.0.1"
13:14 < WilcoRogers> Okay it's returning a "cant find server name for address 10.8.0.1"
13:16 < WilcoRogers> But it can find other DNS entries for other machines
13:17 < orudie> greetings. how can I one of the clients from OpenVPN ?
13:21 < orudie> ban a client 
13:25 < WilcoRogers> Remove them from the VPN list
13:28 < orudie> WilcoRogers, a bit more specifics for me please ?
13:29 < snL20> serial and index.txt dont seem to be part of my distro's package of openvpn ... do I just create them myself ?
13:32 < WilcoRogers> Well I do most of my administration via Webmin, but if you look under /etc/openvpn/clients
13:32 < WilcoRogers> there should be a list there
13:32 < WilcoRogers> (or wherever you have yours)
13:43 < Kendall> after revoking clients key using "revoke-full" should the .crt and .key file(s) be deleted, or is there a reason to leave them hang around?
13:50 < ecrist> Kendall: you can safely delete.
14:01 < Kendall> ecrist:  thanks
14:01 <@vpnHelper> RSS Update - forum: Windows File Shares Unreachable via OpenVPN <http://forums.openvpn.net/topic7963.html#p13763>
14:08 <@vpnHelper> RSS Update - forum: openvpn & apache issue <http://forums.openvpn.net/topic7955.html#p13764>
14:23 < pons> Guys, is there any way of forcing a client connection to connect on an specific interface or source IP?
14:25 < EugeneKay> --local 
14:28 < rob0> From the server side, not really. --local must be in the client config. And it must be able to route on that address to the server, of course.
14:30 < albech> i can establish my VPN connection, but not ping hosts on the remote network: http://pastebin.com/PmSyrELX
14:31 < EugeneKay> albech - firewalling.
14:32 < albech> here is my server.conf - http://pastebin.com/yMdUPDfE
14:32 < albech> EugeneKay, no IP tables running on the openvpn server
14:33 < EugeneKay> Oy. You're bridging.
14:33  * EugeneKay recuses himself
14:34 < albech> EugeneKay, yes, I know its not what most people recommend :)
14:34 < rob0> so why are you bridging?
14:35 < albech> requirements for other protocols :(
14:36 < albech> rob0, I have had great success with bridging in the past
14:37 < rob0> Most protocols can be routed.
14:37 < WilcoRogers> Does anyone have the link to the newest downloader for the OpenVPN GUI driver/client for Windows?
14:38 < rob0> SMB/CIFS ancestors required broadcasts, but that has not been the case for more than a decade.
14:54 < ecrist> !download
14:54 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
14:54 < ecrist> WilcoRogers: ^^^^^^^^^^
15:00 <@vpnHelper> RSS Update - forum: An OpenVPN GUI that requires UAC elevation <http://forums.openvpn.net/topic8477.html>
15:02 < EugeneKay> Well, that .exe looks trustworthy.
15:06 <@vpnHelper> RSS Update - forum: Non-Admin usage of OpenVPN on Windows <http://forums.openvpn.net/topic8250.html#p13766>
15:23 < eels12> !goal
15:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:25 < eels12> hi i have problems with generating certs with easy RSA i always get a database update error 2 while generating client certs it only goes away if i set unique_subject = yes to no in index.txt.attr    
15:44 < oc80z> any webpage/link to Max throughput on tap vs tun 
15:48 < eels12> ok i think something in the easy-rsa pkitool is broken i do everythink like in the manual but th instant i want to generate client certs i get  failed to update database TXT_DB error number 2
15:49 < eels12> it only goes away after i change unique_subject = yes to no in index.txt.attr    
15:52 < oc80z> oh
15:58 < eels12> well i maybe found the culprit
15:58 < eels12> if you generate client certs and use --interact option
15:59 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
15:59 < eels12> it writes the client certs name in commonName
15:59 < eels12> in batch mode it writes the names from the vars file into it
16:11 < oc80z> ok
16:11 < oc80z> the script is pkitool
16:11 < oc80z> sorry, easy-rsa
16:13 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
16:13 <@vpnHelper> RSS Update - forum: broken easy rsa <http://forums.openvpn.net/topic8478.html>
16:17 < oc80z> i dont think --interact does anything with the BATCH variable.
16:18 < eels12> --batch is default mode
16:20 < eels12> and even its not the batch mode pkitool is still writing commonName from vars file and not the clients cert name
16:20 < oc80z> then --interact is --batch
16:20 < oc80z> i do not have trunk/latest-rev
16:21 < oc80z> i have 2.0
16:21 < oc80z> of pkitool.
16:21 < oc80z> sorry
16:21 < eels12> no --interact lets you change things like common name or emailadress in the cert file info
16:21 < oc80z> --interact unset's BATCH, making in NULL
16:22 < eels12> and in the new build it always sets commonName to commonName from var config
16:22 < eels12> so you get all the time duplicate client cert
16:25 < oc80z> !svn
16:25 < oc80z> whats the repo uri
16:25 < eels12> i dont know
16:26 < eels12> newest dl version from website
16:30 < eels12> oc80z: yea ist pkitools version 2.0
16:30 < eels12> its
16:44 < oc80z> hmm
16:46 < eels12> hmm what?
16:46 < eels12> i need solutions
16:52 < oc80z> oh
16:52 < oc80z> let me pull source and see.
16:56 < oc80z> well. my pkitool is 20 lines less than trunk.
16:58 < oc80z> its much cleaned up.
16:59 < oc80z> do you also need to use --inter and --initca
16:59 < oc80z> with --interact
16:59 < eels12> initca is working fine
17:00 < eels12> its only the process when i create client certs
17:01 < oc80z> can you give me commands you use so i can reproduce it on this side?
17:01 < eels12> source ./vars   ./clean-all   ./build-dh     -> takes a long time, consider backgrounding   ./pkitool --initca   ./pkitool --server myserver   ./pkitool client1   ./pkitool --pass client2
17:02 < eels12> eh
17:02 < eels12> without the last one
17:02 < eels12> no passwd 
17:03 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:03 -!- mode/#openvpn [+v Axeman] by ChanServ
17:05 < oc80z> okay hang loose
17:12 < oc80z> ill give a shot
17:12 < oc80z> wtf
17:13 < oc80z> i think i have to be rot
17:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:14 < oc80z> real	0m9.872s
17:14 < oc80z> fast eh?
17:15 < eels12> ?
17:16 < oc80z> i got a db error
17:16 < eels12> yay!
17:16 < oc80z> TXT_DB error number 2
17:16 < oc80z> this?
17:16 < eels12> yes
17:17 < eels12> now try client cert generartion with --interact
17:17 < eels12> just press return button all the time
17:18 < oc80z> that is OK
17:18 < eels12> looks broken
17:19 < eels12> or im too dumb to use it
17:21 < oc80z> i have only looked at the few commands we spoke about
17:23 < eels12> thats the fastest way to build a simple ca
17:23 < eels12> and its not working
17:27 < oc80z> i am hacking up kernel drivers and shit i'd rather not be doing.
17:28 < oc80z> in pkitool, can you change the variable DEBUG to 1, and retry.. may be try it with /bin/sh -x pkitool commands..
17:59 < oc80z> when i do it manually with the openssl commands
17:59 < oc80z> it seems like being in easyrsa/keys/ hits the database.
18:07 < oc80z> $key_cn changed to $fn
18:09 < oc80z> these new variables $key_cn/fn  should be added to debug func.
18:10 < oc80z> #  Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
18:10 < oc80z> #  Copyright (C) 2002-2008 Telethra, Inc. <sales@openvpn.net>
18:10 < oc80z> oh.
18:10 < oc80z> ;]
18:17 < oc80z> do you think eels edited the sourced stuff
18:25 < oc80z> the error->  KEY_CN  is "changeme" in batch |  KEY_CN is "client1" in --interactive
18:30 < oc80z> ...id like to clean this script up.
18:51 < oc80z> so, svn.openvpn.net doesnt host openvpn-2-2 now?
18:52 < oc80z> theres still .svn files in the git repo
18:54 < Xgates> Hi guys
18:54 < Xgates> There wouldn't happen to be any Linux geeks in the house that also just so happen to use Shorewall? I probably can't get that lucky hehe
18:56 < oc80z> dunno
18:57 < oc80z> im sure there is.
18:58 < oc80z> quick, whats the question.
18:58 < Xgates>  I'm using vpn service and for the life of me I can't figure out, once I'm connected to the VPN to just route the connectivity over the VPN in case of a drop to protect the connection, would you know how I can do this?
18:59 < Xgates> I can do it for ipsec and I thought it would be the same, just replace the ipsec stuff for vpn but it doesn't work
19:00 < oc80z> for timeouts?
19:00 < oc80z> and to persist the tun/tap device open?
19:01 < oc80z> this can be done in ipsec, eh?
19:13  * oc80z out 
19:14 < Xgates> I mean in shorewall I can route the connection over ipsec is all
19:14 < Xgates> anyhow I guess maybe for OpenVPN I'm going about this the wrong way
19:14 < Xgates> maybe this is the idea?
19:14 < Xgates> --> route delete & route add?
19:15 < Xgates> What I'm asking, to protect against a VPN drop we should take care of this with route cmds in the conf file instead?
19:21 < krzee> Xgates, so you want no inet when the vpn goes down?
19:22 < Xgates> yes protect against VPN drop so when vpn goes down you're off line
19:22 < krzee> !def1
19:22 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
19:22 < krzee> dont use def1, you get what you wanted
19:23 < krzee> what you said is how it normally works
19:23 < krzee> people add def1 to change that behavior for usability
19:24 < Xgates> ok I read, but don't understand I see like 3 cmds here, so is there a typical way you use this and always write this?
19:24 < mete> are there somewhere docs how much cpu AES-256bit uses?
19:26 < EugeneKay> !gb
19:26 < EugeneKay> !gigabit
19:26 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
19:29 < mete> thx EugeneKay
19:29 < mete> then I will try to implement aes-ni for my i7 2600K
19:29 < Xgates> krzee: sorry I'm lost can you explain simpler? you showed def1 then you said don't use def1, also I looked at man and don't really understand the cmds is --redirect-gateway the cmd to use?      
19:29 < Xgates> but then I don't understand how to use it
19:31 < Xgates> dont use def1, you get what you wanted? but you said is (#1) used....
19:31 < Xgates> hmm :(
19:33 < Xgates> make this? ---> redirect-gateway def1
19:38 < Xgates> From what I'm reading  redirect-gateway is something that needs to be setup on the server side in order for the client to handle this
19:39 < Xgates> http://pastebin.com/xJzW71mT
19:40 < Xgates> brb
19:48 < Xgates> I don't see how it's possible to protect from a VPN drop on the client side without either a 3rd party app that stands in between the VPN and Net to protect or using a firewall rule
20:03 < ecrist> EugeneKay: hi. :)
20:06 < EugeneKay> ecrist - ur mom lol
20:46 < jdoe> so I asked earlier, I'm having a problem with openvpn 2.2.1 and the current tunnelblick beta. Config settings match on both sides of the tunnel, but it fails to actually connect because link-mtu is off-by-one. If I explicitly set link-mtu on both ends, then it fails because tun-mtu is off-by-one.
20:46 < jdoe> any suggestions on why that might be?
20:47 < Xgates> anyone here use Shorewall that can help me do this? ---> http://pastebin.com/w8krGxhv
21:20 < Xgates> ok forget shorewall firewall my bad it's not how to do what I want...
21:20 < Xgates> Anyone know how to configure the conf file on a client to protect against a VPN drop?
21:24 < rob0> Doesn't Shorewall have a channel? Seems like I have seen Tom on freenode before.
21:30 < Xgates> hey rob0 the developer told me this has nothing to do with Shorewall, that it's basic IP routing...  So I'm trying to take OpenVPN and apply this; http://pastebin.com/ACnQ49bP to the rc.inet1.conf to protect against a VPN drop
21:30 < Xgates> and if my memory for what little of it I have left, LOL, I just plugin a static IP of the VPN to rc.inet1.conf or gateway and when the VPN drops so does my connection :)
21:32 < snL20> Xgates: I have multipath routing running on my main desktop to just tunnel what I want
21:33 < snL20> Xgates: iptables is set to drop any connections to those services should the tunnel drop
21:36 < snL20> Xgates: the client conf for my openvpn connection is set to persist
21:39 < Xgates> my problem is this, there seems to be more then one way to skin this cat, or not? I just want the simplest method that is something, well anyone can use that protects when the VPN drops and what I mean is, your actually internet connectivity isn't dead, it's just that nothing can get back online until you change the rules back for the Net connection(without the vpn) or you reconnect to the vpn
21:40 < snL20> Xgates: you want the client to be able to connect to the net without the tunnel if the tunnel goes down ?
21:40 < Xgates> my understand is this just called 'Protecting Against A VPN Drop
21:40 < Xgates> which I did not think required any explaination as to why or what that this is a common term with a common understanding 
21:40 < Xgates> hehe
21:41 < snL20> persis-remote-ip
21:41 < snL20> uhm
21:41 < snL20> persist-remote-ip
21:41 < snL20> maybe ?
21:42 < Xgates> For the past year I've been messing with VPN services, SORRY I didn't mention this, that I'm talking about using a VPN service for security and if it drops you don't want to go back on with your IP exposing yourself or any leaks
21:42 < Xgates> make sense now?
21:44 < snL20> Xgates: yeah... I'd just filter outgoing connections to anything other than your vpn server using iptables
21:44 < Xgates> well I thought I had this accomplished but now it's not working
21:46 < Xgates> the shorewall developer keeps saying ---  OpenVPN requires no firewall
21:46 < Xgates> I understand it requires no firewall but I thought through iptables you can control the connection
21:46 < snL20> :P
21:47 < snL20> Xgates: you have to filter it on the client of course
21:47 < snL20> Xgates: you get a tun0 on the client
21:48 < Xgates> so I can understand this, are we saying that to protect against a VPN drop this is something that should be defined in the conf file?
21:48 < snL20> Xgates: the thing with vpn's is they sort of destroy the purpose of having a firewall
21:48 < Xgates> also if the server is not setup for this can it be done just on the client side?
21:49 < Xgates> yeah I noticed this dopey thing, I don't even have to open/forward any ports on 1194 for it to work, I can have them all closed on my hardware/router firewall and on the iptables firewall and I'm still connected 
21:49 < Xgates> and when I first saw that I was real lost...
21:51 < snL20> Xgates: if your firewall is blocking udp 1194 you wont be able to make the connection to the vpn server but as long as it cant make the vpn server connection to that port after it is made your tun0 internet available ip address can be used to reach any service you have listening on the client unless you filter them on the client with windows firewall or linux iptables/netfilter yourself
21:51 < Xgates> I didn't think this was such a complicated issue hehe, I just thought you mention the word 'VPN Drop' and it's common knowledge and pretty much one method that takes care of this issue, which at first I thought was with route add or route delete cmds
21:52 < snL20> s/cant make/can make/
21:52 < Xgates> I can block udp 1194 and OpenVPN can connect
21:52 < snL20> Xgates: well not really
21:53 < Xgates> I can show it all to you and it's working
21:53 < Xgates> For starters I'm running a firewall and like any iptables firewall udp 1194 is nothing something even remotely there for a rule
21:53 < snL20> Xgates: you have internet access via the tun device after connecting while its blocked ? then you are doing something wrong
21:53 < Xgates> then I have a router, so I'd have to forward the ports
21:54 < Xgates> ahhhh wait I think I got it
21:54 < Xgates> one sec....
21:54 < snL20> udp just doesnt keep state
21:57 < Xgates> am I still here?
21:58 < snL20> yeah
21:58 < Xgates> ok
21:58 < Xgates> one sec
22:00 < MadTBone> I just changed my server's openvpn.conf file to from a tun to tap configuration, but when I restart openvpn, the tun device is still coming up...
22:08 < rob0> Xgates, I have never tried to configure openvpn IP addresses in rc.inet1
22:08 < rob0> it would not work
22:08 < rob0> I start openvpn from rc.local and add any necessary routes after that (after the tun interface is up.)
22:18 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
23:25 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:39 < cjs226> I'm wanting to utilize OpenVPN running in an Amazon Virtual Private Cloud to provide access to remote users.  I have OpenVPN running and can connect without issue.  However, once VPN'd in, I can't ssh the OpenVPN server nor a test host behind it.  I don't see any errors in the logs and Googling isn't providing much help.  Can someone help me?
--- Day changed Wed Jul 20 2011
00:19 < Xgates> hey guys
00:20 < Xgates> say I can ping and connect to my vpn but then I can't surf using the firewall rules I have which is want I want keeping everything through the VPN tunnel but i don't get why I can't surf and I can ping
00:20 < Xgates> Do I need some sort of routing rule in the client conf?
01:47 < jdoe> wtf. downgraded osx. downgraded tunnelblick. still no luck. Explicitly setting link-mtu just causes tun-mtu to be calculated wrong. How are those determined?
01:53 <@vpnHelper> RSS Update - forum: Windows File Shares Unreachable via OpenVPN <http://forums.openvpn.net/topic7963.html#p13768>
01:59 < Xgates> hey guys
02:00 < Xgates> if I use like 'route add' and 'route delete' can this work so when the VPN connection dies the route delete will kill my connection and I'm offline until I connect again to the VPN?
02:04 < Xgates> That topic ---  Your problem is your firewall, really. LOL, my problem really is OpenVPN hehe
02:05 < Xgates> this app should have unless it does already and I've over looked it a built in fail safe against VPN drops
02:10 <@vpnHelper> RSS Update - forum: On The Client Side Do You Need To Allow DNS Requests? <http://forums.openvpn.net/topic8471.html#p13769>
02:16 <@vpnHelper> RSS Update - forum: How Do Your Protect Against A VPN Drop? <http://forums.openvpn.net/topic8479.html>
02:29 < Bushmills> Xgates, " can't surf using the firewall rules "  - if firewall if the reason why you can't, you need to change the firewall ruiles
02:30 < Bushmills> if not, it depends on the reason why you can't surf. do a bit of diagnostics, please.
02:30 < Xgates> I'm asking about I can protect against a VPN drop
02:30 < Xgates> my connectivity is just fine :)
02:31 < Xgates> about how I....
02:31 < Bushmills> you protect against by undoing the reason why it drops at all
02:32 < Xgates> I know these things, but that isn't what I'm trying to accomplish
02:33 < Bushmills> not explaining a bit about your "vpn drops" is like me asking how i can protect against green banana jelly
02:33 < Xgates> I'm just using a VPN as a client through a service so there is only so much control I have, so I want to know if the VPN drops how can I protect against that, meaning my connectivity is down, no online activity until bring the vpn backup?
02:34 < Xgates> how's that?
02:34 < Bushmills> better
02:34 < Xgates> ok
02:34 < Bushmills> why does it drop?
02:35 < Xgates> ahhh you know for Windows also has a Linux app too but the Windows app more popular called VPNCheck Pro, you know it?
02:35 < Bushmills> no. i have no use for windows apps
02:36 < Xgates> I said I'm using a VPN service, sorry if you didn't understand, to me that's like asking why does your ISP connectivity get bad sometimes from the ISP, hey as they say SHIT happens, who knows hehe
02:36 < Xgates> :)
02:36 < Xgates> sorry not trying to be rude, just saying... ;p
02:37 < Xgates> but even if it never drops I want to have this safety net in place of user error like accidently disconnecting yourself and thinking your on the VPN and getting online by accident
02:37 < Bushmills> i'd thought of an answer like "because there's an idle timeout" or "because it couldn't reach the server for x seconds" or such  
02:37 < Xgates> I see this a more a reality happening -- user error
02:37 < Xgates> killing your gui or cmd line by mistake
02:38 < Bushmills> "ISP connectivity gets bad" is nothing you can fix in your vpn configuration
02:38 < Xgates> no nothing like that, I mean your using the VPN for like 1-2 hours then for some reason hour 3 rolls around the server takes a crap, who knows and the connection dies
02:38 < Bushmills> if user kills GUI by mistake - why give him a GUI at all?
02:39 < Xgates> servers and people aren't perfect things happen, this is all I'm talking about, general....
02:39 < Xgates> ok ok ok
02:39 < Xgates> sheesh LOL
02:39 < Xgates> do you know how I can do this?
02:39 < Bushmills> "for some reason" is something you can't fix.  "for a specific reason" you may be able to.
02:40 < Bushmills> start client and connect to openvpn server during boot 
02:40 < Xgates> you're thinking way beyond the scope of this, let's just keep it small if you can help please :)
02:40 < Bushmills> that's not beyond scope if i tell you which questions i can't answer for what reason
02:42 < Xgates> I said I'm using a VPN service, the server and that VPN service I have no control over it or it's quality, up time down, time etc... so regardless, I mean who cares to be honest all the reasons why, to me what's important when using a VPN service is just to be prepared in case of a system fail that's all so if there's ever a drop I'm protected against going back online by mistake exposing myself
02:42 < Xgates> so if run Linux do you know how I can have the route killed if I'm not on the VPN?
02:42 < Bushmills> you have some control over it, by chosing a reliable provider
02:43 < Bushmills> you can't protect against vpn service interruption if the cause is the provider
02:43 < Xgates> do you understand what I'm trying to do and you could help me with that?
02:44 < Bushmills> i think so - you want to protect against "vpn drop" in a sitation where you have no control over qualitiy of connection
02:45 < Xgates> well quality of connection I think isn't part of the issue, but if you choose to look at it like that
02:45 < Xgates> anyhow all I want to do is have myself not be able to get back to any online activities if I'm off the VPN for any reason....
02:46 < Bushmills> how would the results of  "drop protect"  manifest?  reconnect?  traffic across alternative route?
02:46 < Bushmills> automatically sending an SMS to your provider?
02:46 < Xgates> I'm using the VPN for security reasons so it's important to have that connection so if it goes out, user error, etc... I just to be dead in the water, not saying the eth0/wlan0 is offline just the route is dead
02:47 < Bushmills> ah.  firewall all outbound traffic on client unless it goes to vpn server.
02:48 < Bushmills> (other than traffic to you LAN, of course)
02:48 < Xgates> well, you know Shorewall?
02:48 < Bushmills> by its name.
02:48 < Xgates> Omache the developer as he goes by that name on Freenode, told me today a Firewall has nothing to do with OpenVPN controlling it like this
02:49 < Bushmills> more a configuration frontend for netfilter
02:49 < Xgates> in fact you don't even need to have actual vpn specific rules like you would as an example IPsec to make it work
02:50 < Bushmills> you goal is not openvpn specific. your goal is to prevent traffic to go anywhere else.
02:50 < Xgates> You can have the ports and protocols blocked and just connect using a policy, a zone and using an interface called vpn and it works and even have your router hardware blocking too
02:50 < Bushmills> that's clearly something a filewall is for
02:51 < Xgates> The developer told me the firewall doesn't work that way with OpenVPN and that it's a Basic IP issue with routing not the firewall
02:51 < Bushmills> that's fine if you can do all what you're listing now. in fact, you just want to block all traffic except traffic to your vpn server
02:51 < Bushmills> (and its return traffic, of course)
02:52 < Bushmills> that's funny that he tells you that it doesn't work that way because i use a firewall that way
02:52 < Xgates> anyhow, I thought in the openvpn.conf you can do this with 'route add
02:52 < Xgates>  errr
02:52 < Xgates> and route delete
02:53 < Xgates> I'm sure I'm not telling it as good as he can but he says it has to do with the way in which OpenVPN works on the routing level when compared to like IPsec as an example
02:53 < Bushmills> yes, you can use routes to direct traffic. but routes don't protect you against traffic being sent to wrong places because of wrong routes, especially if they are changed because of interfaces coming up and going down, as it is the case with failing connections.
02:54 < Bushmills> where against, a firewall protects you against misrouted traffic regardless of dynamically changing routes.
02:55 < Xgates> yeah, and what he said didn't make sense to me either, I thought no matter what with a firewall you can control it like this
02:55 < Bushmills> say, you have a route for max_privacy_traffic through interface A, and that route disappears, then your max_privacy_traffic will go through the next matching route which usually is your default route
02:56 < Bushmills> where against, firewall rules saying "block outgoing traffic unless it goes to the vpn server" doesn't care what routes are up or down
02:58 < Bushmills> for openvpn to repace the default route when connecting, so that traffic can't go through the former default route when disconnected,  don't use the  "def1" flag with the "redirect-gateway" directive
02:58 < Bushmills> !def1
02:58 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
02:59 < Bushmills> i.e. that def1 behaviour is what you *don't* want
03:03 < Xgates> well here's my problem I'm seeing with OpenVPN and iptables, you need to have the way Shorewall defines it, maybe it's the same in iptables, your interface,  policy and zones, with just these 3 and no rules I can connect to the vpn and I can show you what I mean and this is the problem the net interface eth0/wlan0 always seems to need being there even though I'm going through the vpn interface and I can't figure out how to control it the iptables sid
03:03 < Xgates> e of things...
03:03 < Xgates> here; http://pastebin.com/EL6evBFY
03:04 < Xgates> before on line 23 I would comment that # out and uncomment line 20 and this worked and still leaving line 26 uncommented
03:04 < Bushmills> that's a common side effect of using frontends to configure things, that problem of figuring out how to do things 
03:05 < Xgates> yeah I know it can be, shorewall is pretty simple 
03:05 < Xgates> I'm not good with iptables at all to write all this up that I need
03:06 < Xgates> so what's with the  def1 stuff I tried this before,  not sure I did it right but couldn't figure it out
03:06 < Bushmills> you'd probably set policy of OUTPUT chain to DROP or REJECT, and add a rules ACCEPTing traffic with destination openvpn server  
03:06 < Bushmills> you also ACCEPT traffic to the openvpn tun interface
03:06 < Xgates> that's what I thought these did
03:06 < Xgates> $FW             vpn             ACCEPT
03:07 < Bushmills> how to translate that to shorewall is beyond me
03:07 < Xgates> $FW             net             DROP
03:07 < Xgates> it's about like this...
03:07 < Bushmills> ok then. does it work?
03:08 < Xgates> well this is the odd thing last week I had it working a few times and then it's not anymore
03:09 -!- dazo_afk is now known as dazo
03:09 < Xgates> so I don't get how you just comment and uncomment something like this and sometimes it works and then doesn't
03:09 < FredMorris> hello
03:09 < Xgates> unless this thing has a bug 
03:09 < FredMorris> hi xgates
03:09 < Xgates> hey
03:10 < Xgates> Bushmills: you write your own iptables, or do you know a firewall that works really good and easy?
03:10 < FredMorris> i am using a vpn now that has an openvpn based client
03:10 < FredMorris> however my firewall had incoming connections being attempted by system
03:10 < Bushmills> Xgates, i'm using iptables directly
03:10 < FredMorris> so the question is this:
03:11 < FredMorris> does vpn work on 2 different ips, incoming and outgoing
03:11 < FredMorris> and how do i effectively firewall so im not hit with someone who attempts a hack of the vpn port which is my current ip
03:11 < FredMorris> vpns usually have open ports on the IP side
03:13 < Bushmills> FredMorris: do you refer to tunneled traffic, or the vpn tunnel itself?
03:13 -!- Cain` is now known as Cain
03:13 < Xgates> Well all I need are just the basic rules that any laptop box would want generally speaking, block everything by default
03:14 < FredMorris> thru the vpn i got loads of attempted connections
03:14 < FredMorris> from out of the country
03:14 < FredMorris> my firewall blocked them
03:14 < Bushmills> Xgates iptables -P DROP INPUT       drops all input for which there is no ACCEPT rule
03:14 < FredMorris> bushmills:  i know how the vpn tunnel works, i mean when traffic comes out of the tunnel to my computer
03:15 < Bushmills> -P is for setting a chain's policy
03:15 < FredMorris> bushmills thru the firewall im getting lots of attempts on my machine through tcp
03:15 < Xgates> well that's pretty simple from a starting point but I've already looked at all this in the past, as they say about some things, this is just not my cup of tea
03:16 < FredMorris> im blocking all incoming, i only allowed the one outgoing so my firewall will connect
03:16 < FredMorris> just one port
03:16 < Xgates> I just need the rules all made up and ready to go then when I see it all in place it sorta clicks for me to just work with then with what I have
03:16 < jdoe> dazo: fwiw, setting link-mtu explicitly results in tun-mtu being off by one, setting tun-mtu explicitly gives link-mtu off by one. Unfortunately I can't see how it determines one from the other, so I have no idea where it's falling down. :/
03:16 <@dazo> jdoe: did you try to use both?
03:16 <@vpnHelper> RSS Update - forum: Windows 7 Openvpn Connection freeze / UMTS <http://forums.openvpn.net/topic8468.html#p13771>
03:17 < Xgates> Bushmills: how did you make your iptables for what purpose like a single home box, server, etc...?
03:17 < Bushmills> Xgates, i used an interactive configuration frontend for iptables, called an "editor"
03:18 < Bushmills> using that, i typed out the rules for that system
03:18 < jdoe> dazo: it won't let me specify both.
03:18 < jdoe> "ovpn-server[6538]: Options error: only one of --tun-mtu or --link-mtu may be defined (note that --ifconfig implies --link-mtu 1500)"
03:18 <@dazo> interesting
03:18 <@dazo> I had forgotten about that
03:18 < Xgates> sorry an actual front end for making the rules?
03:19 < jdoe> (apparently tunnelblick uses 2.2.1 internally, so it's 2.2.1 -> 2.2.1)
03:19 < FredMorris> bushmills u there?
03:19 < FredMorris> i just allowed the outgoing ip from the vpnclient
03:19 < Bushmills> the particular editor i'm using for that purpose is "joe"
03:19 < FredMorris> not any incoming
03:20 < Xgates> oh you mean by hand hehe
03:20 < Xgates> Bushmills: http://www.fwbuilder.org/
03:20 <@vpnHelper> Title: Firewall Builder 4 | Simplifying Firewall Management (at www.fwbuilder.org)
03:20 < Xgates> maybe I should check that out
03:21 <@dazo> jdoe: may I suggest posting this to the openvpn-users mailing list?  Or the forum ... I think we need a broader view on this, I can't say I understand exactly what's happening .... and I've never looked at the mtu parts in the source code, so that I can't easily say how it is expected to work
03:22 < jdoe> yeah, guess I should. Darn, hate dealing with forums and mailing lists. Haha.
03:22 <@dazo> jdoe: you also have --mtu-disc ... maybe that might be worth testing
03:22 < jdoe> lessee if that helps.
03:22 <@dazo> jdoe: well, there's a big chance to get a better answer ... those channels are not so impacted by time zones ;-)
03:23 <@dazo> --mtu-disc needs 'yes','no' or 'maybe'
03:24 < FredMorris> im confused on openvpn and how it works
03:24 < EugeneKay> A wizard does it.
03:24 < FredMorris> not the tunneling but why im getting incoming connections 
03:24 < FredMorris> attempts 
03:24 < jdoe> dazo: yeah no dice, looks like mtu-disc isn't a supported option with osx clients.
03:24 <@dazo> interesting
03:25 < EugeneKay> Attempted crackers? :-p
03:26 < FredMorris> hello?
03:26 < FredMorris> bye
03:26 < Bushmills> "thru the vpn i got loads..."    tap based vpn?
03:30 < Xgates> well I'm going to look at fwbuilder I know it's been around and maybe it's just a nice front for helping make iptable rules and manage them in this front end to make it easy, like using a firewall I hate to say it in Windows, but I'll be honest it sure would be nice to have an easy tool to do all this with and hopefully this is iut
03:30 < Xgates> it...
03:32 < Bushmills> there's a saying which is "make a program which can be used by an idiot, and only an idiot will want to use it"
03:33 < Bushmills> the more GUI us between you and what you want to control, the more control you lose
03:36 < Xgates> yeah I understand your point but if it's a good app then I look at it this way, as a user sometimes you don't want to always spend your life learning how to do things as in this situation you just wanted done so you can get on  with life
03:37 < Xgates> the computer is suppose to be a tool to do things with, not always about sitting around trying to learn how to use the tool too
03:37 < Xgates> I'm a Slackware geek I've learned enough already and iptables and messing with them isn't my thing
03:38 < Xgates> I need something far to complex for me to know how to deal with that needs to be a professional level of Firewall security, not some geek dabbling in rules making what he thinks is seucre
03:38 < Xgates> hehe
03:39 < Bushmills> otoh, you learn things once, but not doing so requires you to find workaround your whole life.
03:39 < Xgates> to me I want to leave it more to the pros for a firewall but boy in Linux that does seems like next to impossible
03:40 < Bushmills> consider that you instead investing time in figuring out shorewall, trying to get things to work the way you wanted, consequently trying out another frontend software, having to figure that out again etc
03:40 < Xgates> but this is the problem I see which I think is a reality you create your rules thinking you have it perfected only to find out you don't I mean security is always an ever changing thing, or maybe I'm not seeing this correct that maybe there isn't anything to securing a box
03:41 < EugeneKay> Learning to write your own iptables firewalls is something that takes a long time.
03:42 < Xgates> Well the guy that made shorewall has been into security for over 20 years and I look at it like if this guy can't make a good firewall then I'm not going to do any better that's for sure
03:42 < EugeneKay> The general methodology is to block nown uglies, allow stuff you want, and then block everything else.
03:42 < EugeneKay> My issue with one-size-fits-all firewalls is that they fit everybody. One I put together myself is going to be more restrictive, and thus, more secured.
03:42 < Xgates> I don't think shorewall is the problem it's just me understanding how to use it which isn't really to bad 
03:43 < Xgates> Shorewall isn't a fit for anyone that's the nice thing about it, it's not setup to do anything you have to add in the basic rules you want
03:44 < Xgates> there are samples to follow but when you install there's nothing in any of the files you have to build it
03:44 < Xgates> but the thing is, as a front end writing the rules are simpler in more in plain english I guess you could say
03:45 < Xgates> here you go for all the torrent junkies in the house a simple torrent rule LOL
03:46 < Xgates> ACCEPT  net              fw              tcp     52119
03:46 < Xgates> ACCEPT  fw               net             tcp     52119
03:46 < Xgates> it starts out from the SOURCE to the DESTINATION
03:46 < Xgates> from left to right and there you go a simple iptables rule :)
03:47 < EugeneKay> Except that is totally flawed, useless, and meaningless.
03:47 < EugeneKay> BitTorrent is not exclusively a :52119 protocol.
03:47 < Xgates> that's all this is, just writing the rules I guess you could say in a simpler format
03:47 < Xgates> LOL
03:47 < Xgates> that's an example use any port or protocol you want
03:48 < Xgates> ACCEPT  net              fw              udp     53500
03:48 < Xgates> make it whatever you want, this is just simplied iptables writing a firewall is all
03:48 < Bushmills> then why use another software?
03:49 < Xgates> well I have to admit it's the easiest I've used but I'm hitting a wall here so maybe I should stick it out and try to figure it out rather then run LOL
03:49 < Bushmills> if it's even simplified, i suppose there's no need to try another because what you intend to do you didn't manage
03:50 < Xgates> well it's not quite so simple you do have to do what interface, rule, policy, and zones to create
03:51 < Xgates> for just a connection on the internet to me that is easy, tunnel a VPN that's a bit harder
03:51 < Bushmills> a vpn tunnel is just traffic to one port of one destination, using one protocol. 
03:52 < Xgates> I can actually route an IPsec tunnel over the connection so if it drops I have accomplished what I wanted but can't get that to work on OpenVPN
03:52 < Xgates> not according to the developer of Shorewall they IPsec and OpenVPN do not work the same way
03:53 < Bushmills> as we're on #openvpn, my use of "vpn" implies "openvpn"
03:53 < Xgates> vpn=? hehe
03:53 < Xgates> openvpn is not the all vpn it's just a implementation of...
03:54 < Xgates> you should check out #shorewall later his name is Omache that guy seems to really know his stuff
03:54 < Bushmills> #openvpn talks about openvpn. therefore the context of "openvpn" should be clear
03:54 < Bushmills> if i refer to other software, i'll name them explicitely
03:55 < Xgates> you said a vpn tunnel, sorry that is what I was pointing out thinking you were talking about vpn tunnels in general
03:56 < Bushmills> yes. a vpn tunnel, in the context of using openvpn
03:56 < Xgates> so here's what I thought just like any vpn tunnel make the connection to it, route the connection over it and block all other traffic like any other and I'm not getting it like I think it can be done 
03:57 < Xgates> actually even though you are not using shorewall I'm sure you'll get what I'm pointing out and maybe in iptables wording you can tell me what I'm missing here....
03:57 < Xgates> So Bushmills if you wouldn't mind looking at this ---> http://pastebin.com/EL6evBFY
03:58 < Xgates> I can explain it but it's pretty simple to see what's going on
03:58 < Bushmills> (10:06:17) Bushmills: you'd probably set policy of OUTPUT chain to DROP or REJECT, and add a rules ACCEPTing traffic with destination openvpn server  
03:58 < Bushmills> (10:06:42) Bushmills: you also ACCEPT traffic to the openvpn tun interface
03:59 < Xgates> ahh well in that pastebin I thought I had all this, that's why I wanted to show it to you
03:59 < Xgates> don't worry about it being a front end for Shorewall like I said it's easy to see what's going on
04:00 < Bushmills> where do you specify the ip address of vpn server, to allow traffic to it?
04:01 < Bushmills> it seems to me that you are policing the *tunneled* traffic. which is not what you want
04:01 < Xgates> rules but that's the thing just like iptables I'm assuming here, I don't need a rule for that
04:01 < Bushmills> you want to police the outgoing *rest of it*
04:01 < Xgates> but but I can make a rule, one sec
04:01 < reiffert> http://www.youtube.com/watch?v=iXR-b9-ntcc
04:01 <@vpnHelper> Title: Die Kassierer - Besoffen sein - YouTube (at www.youtube.com)
04:02 < Bushmills> http://www.youtube.com/watch?v=CEJ7NxHpkS0
04:02 <@vpnHelper> Title: Kassierer- Meine Freiheit, deine Freiheit (lyrik) - YouTube (at www.youtube.com)
04:02 < Bushmills> moin moin reiffert
04:02 < reiffert> moin
04:02 < reiffert> :)
04:03 < Bushmills> georg kreisler cover
04:04 < reiffert> http://www.youtube.com/watch?v=evIhyiEv7Rw
04:04 <@vpnHelper> Title: Georg Kreisler - Schützen wir die Polizei! - YouTube (at www.youtube.com)
04:06 < Xgates> Bushmills: here it is now with rules; http://pastebin.com/pSbNZa2S (But look at line 26) I commented out the VPN and with those rules it works, and I have to also have the ping, dns and http and now it seems like I'm routed over the vpn cause I need to allow, dns and htp and ping to do something but it seems odd to comment out the #vpn, I thought doing that is making a tunnel
04:06 < Bushmills> hehe
04:07 < Xgates> allow, dns and http....
04:07 < Xgates> I think I'm just not going about this the right way is all...
04:08 < Xgates> but I thought if I allowed connectivity to happen over the tun0/vpn once I'm connected I can drop on the net and still be online with the vpn but if it dies the net is down
04:08 < Xgates> hmm
04:08 -!- LuckyY_ is now known as LuckyY
04:09 < Bushmills> i don't know why you would have to allow http ping and dns in addition to allowing traffic to your tun when redirecting your traffic through it.  something seems coneptually wrong.
04:09 < Bushmills> conceptually
04:09 < Xgates> I'm saying that is if I comment out line #26
04:09 < Xgates> uncomment line 26 I don't need the rules
04:09 < Bushmills> also, where to you say, in your ACCEPT fw, that you're referring to you OUTPUT chain?
04:10 < Xgates> The policy ---> FW     vpn     ACCEPT seems to be the all controlling thing here
04:10 < Bushmills> it's not that you want to protect your system from incoming - it is that you want to prevent bleeding stuff out
04:10 < Xgates> from the source the FW(firewall) to the VPN accept and that means I dont need any rules don't need to open ports or anything an OpenVPN works
04:11 < Xgates> yeah right no leaks
04:11 < Xgates> but get this did you see everything there minus the rules?
04:12 < Bushmills> well i looked at it and found that it seems to have not a lot in common with blocking all outgoing except traffic to vpn server and tun interface
04:12 < Bushmills> therefore, i have no idea what you're doing
04:13 < Xgates> just like anyone have everything only on the vpn
04:13 < Bushmills> no. that's what you *intend* to do
04:13 < Xgates> yes
04:14 < Bushmills> "therefore, i have no idea what you're *actually* doing"
04:14 < Xgates> I mean I figure that's the point all traffic over the vpn
04:15 < Xgates> the pastebin example didn't make sense?
04:16 < Xgates> I mean when you looked at it couldn't see what it was doing?
04:16 < Bushmills> "and found that *what you're actually doing* seems to have not a lot in common with blocking all outgoing except traffic to vpn server and tun interface"  -  besides, you said you wanted to protect against vpn drop, preventing traffic to reach other routes
04:16 < Bushmills> "point all traffic over the vpn" was not in your original problem description
04:17 < Bushmills> that's assumed done already
04:17 < Xgates> right, sorry forgot how that was brought up so yes, just protecting when it drops
04:18 < Xgates> I mean, yeah if I'm connected it must be just the vpn tunnel, anyhow, yea no worries on that
04:18 < Xgates> so getting back to the drop
04:18 < Bushmills> (09:58:59) Bushmills: i.e. that def1 behaviour is what you *don't* want   <- and that's also what you considered, right?
04:19 < Xgates> ahh shoot I did something with that before, trying to remember what it was in the conf
04:19 < Xgates> ahhh I put this in the openvpn.conf --- redirect-gateway def1
04:20 < Xgates> so no good?
04:20 < Bushmills> drop def1,  set policy of OUTPUT to DROP, ACCEPT all traffic to vpn server, vpn port, and all traffic to tun interface. 
04:20 < Bushmills> that's about all
04:20 < Bushmills> and of course allow vpn server return traffic. but that's through INPUT, doesn't affect OUTPUT
04:21 < Xgates> oh we're making a rule to drop def1?
04:21 < Xgates> would this be hard or long for you to write this so I can see what this looks like?
04:21 < Xgates> I sort of understand
04:21 < Bushmills> no.  *facepalm*   you drop def1 from openvpn configuration
04:21 < Bushmills> as in "remove"
04:22 < Xgates> remove def1 from conf correct?
04:22 < Xgates> well if that's so I don't even have this in the conf to begin with so that takes care of that as the problem
04:23 < Bushmills> if you dont have a config for openvpn, you will have to create one first
04:24 < Bushmills> ah. never mind that
04:24 < Xgates> no I'm saying there is no def1 in it
04:24 < Bushmills> misread
04:24 < Xgates> and I have my rules as you've explained I already accept all traffic to vpn server vpn port and tun interface
04:25 < Bushmills> fine. if that does what was suggested, you should be all set
04:25 < Xgates> no if I disconnect from the vpn I can still get online and just surf with my ISP
04:26 < Xgates> there's nothing there I can understand in those rules that stops me from getting back online
04:26 < Xgates> except I guess what you said the  set policy of OUTPUT to DROP which is the $FW net drop I have
04:27 < Xgates> but see if you remember what I showed you, here's the problem, the net is tied to the interface/adapter = eth0/wlan0
04:27 < Bushmills> then there's something wrong in your firewall settings. as suggested, you don't seem to specify chain for outgoing traffic. but i remember you saying something like "it's doing everything itself" or such
04:27 < Xgates> so how can you really kill your adpaters after all the tun has to go over your adapters
04:27 < Bushmills> you may want to ask on #shorewall channel how to create such rules
04:28 < Xgates> ok did what I just say make any sense? 
04:28 < Bushmills> i don't know for sure, but as it doesn't seem to have the desired effect, i'm tempted to say "no"
04:28 < Xgates> or now, if the VPN is up, then you route like over this virtual adapter if it's virtual and the net=eth0/wlan0 don't come into play?
04:29 < Xgates> I'm talking about how OpenVPN works not the firewall
04:30 < Xgates> tun0 is like what a virtual adapter or it's an actual physical adapter that stands on it's own like eth0 and wlan0?
04:30 < Xgates> I haven't read much about this...
04:31 < EugeneKay> Virtual adapter. 
04:31 < Bushmills> right
04:32 < Xgates> here's something I just read; The tun interface is a software loopback mechanism
04:32 < Xgates> ok
04:32 < EugeneKay> The other end of the tun adapter is OpenVPN
04:33 < Xgates> so that's the problem I'm trying to get my head around, I don't see how I drop the network adapter this is the only other thing I see I have to work with
04:34 < Xgates> so here is just the adapters and the policies for those adapters
04:34 < Xgates> http://pastebin.com/dpaihVUY
04:35 < Bushmills> you don't.  you ACCEPT all tun traffic
04:35 < Xgates> and I thought when the tun0 is up I can comment out the net on line 23 and drop it on 20 because I'm on the vpn tun0 on line 26
04:35 < Bushmills> you set policy of OUTPUT to DROP. regardless of interface
04:35 < Xgates> ok see I thought the ACCEPT all tun traffic was just line 26
04:36 < Bushmills> you're aware that there's a difference between INPUT and OUTPUT chains?
04:36 < Xgates> but again cause this is virtual we still have to allow the net=eth0/wlan0 kill the net and it still kills the tun0 correct?
04:36 < Xgates> see that?
04:37 < Xgates> input meaning destination and output the source?
04:37 < Bushmills> as your goal is to prevent any traffic to bleed to other interfaces, you probably want to DROP traffic to eth0 and wlan0 too
04:37 < Bushmills> after all, all your traffic is meant to be redirected through openvpn
04:38 < Bushmills> by conclusion, nothing else goes anywhere else
04:38 < Xgates> hmm yeah would be nice that is creating more a tunnel
04:38 < Xgates> well the --> $FW             net             DROP          ULOG
04:39 < Xgates> that drops everything on eth0 and wlan0 but doing it like this seems to kill vpn too
04:39 < Xgates> I feel like I'm just about there LOL
04:39 < Xgates> but this linking going on between virutal and physical adapters and making the seperation LOL
04:40 < Bushmills>  well, i have suggested at least twice what you could do. if you choose to follow different routes it's up to you
04:40 < Bushmills> good luck
04:40 < Xgates> on IPsec you don't have any of this if it was IPsec what I showed you would work and that's kinda my problem getting past IPsec too and trying to understand what is going on here with this
04:41 < Bushmills> how would that help you now?
04:41 < Xgates> hey I'll follow what you say I'm up for anything and doing it, I just don't know how to do what you said and what I think you said I thought I already did it in the rules I showed you
04:41 < Xgates> I'm just saying I thought the concept is the same....
04:41 < Bushmills> i also don't know how to do that with shorewall. 
04:42 < Bushmills> though setting a chain policy should be possible with it. 
04:42 < Xgates> is there anywhere I can see this online for openvpn as iptables?
04:42 < Bushmills> and allowing traffic to a specific destination
04:43 < Xgates> to see it exactly as you're saying to do?
04:45 < Xgates> but again, the more I think about it, protecting against a VPN drop is not what iptables can accomplish this is a routing issue
04:45 < Xgates> and I don't mean routing your connection over a tunnel :)
04:45 < Xgates> ip route ls
04:46 < Bushmills> http://scarydevilmonastery.net/snap/1311155167417058569d.png   that should be about it
04:47 < Xgates> in fact the shorewall developer told me this I remember, trying to protect a vpn drop that kills the connectivity is not an iptables/firewall issue its IP routing
04:47 < Bushmills> mind you that you input must still accept vpn traffic, both from server and from virtual interface
04:47 < Xgates> let me look thanks
04:48 < Bushmills> that's what i told you too. you don't want to protect against vpn drop.  you want to protect against packets bleeding to other routes/interfaces
04:48 < Xgates> png hehe
04:48 < Xgates> can you put it on pastebin please :)
04:48 < Bushmills> no. that way i prevent people from copy and paste execution
04:49 < Xgates> how will that do anything on pastebin?
04:49 < Xgates> sorry you lost me
04:49 < Bushmills> i referred to the readers
04:49 < Xgates> I'm saying if you put that on pastebin this causes a problem somehow?
04:50 < Bushmills> it cause extra effort. posting the link as png here was a three click operation 
04:51 < Bushmills> start the screen grabber, mark the paste region, paste link into irc client
04:52 < Xgates> I just don't understand what you think is so dangerous about posting, actually incomplete iptable rules on pastebin
04:52 < Xgates> no one can do anything with that
04:52 < Bushmills> what's your problem with the .png?
04:52 < Xgates> anyhow....
04:53 < Xgates> geeks use pastebin :)
04:53 < Bushmills> if that's your problem, then use pastebin if it makes you feel more geeky
04:53 < Xgates> I'm saying why didn't you just pastebin it?
04:54 < Bushmills> because i like the simplicity of posting links to stuff that way
04:55 < Bushmills> if that makes me less a geek, i can live with it
04:55 < Xgates> I'm just trying to learn if there's something here to learn is all that's why I asked
04:55 < Xgates> that way i prevent people from copy and paste execution\
04:55 < Xgates> what the heck is copy paste execution>
04:55 < Xgates> ?
04:56 < Xgates> I'm think you are trying to prevent some exploit? hehe
04:56 < Bushmills> mark, copy to command line, execute
04:56 < Xgates> and?
04:56 < Xgates> execute that as some exploit?
04:56 < Bushmills> some people tend to do that, without thinking about what they execute 
04:57 < Xgates> oh you're saying to stop some newbie from running that as a cmd by accident or something like that to prevent a problem happening on their box?
04:58 < Xgates> ok well not sure you can really run any of that
04:58 < Xgates> ok I see this iptables and this is what I'm doing already to me all this does is allow the vpn connection
04:58 < Bushmills> right.  you can see that if you, for example, pastebin something like     :(){ :|:& };:    and people drop off the channel shortly after
04:59 < Bushmills> i suppose this was warning enough to keep them from trying :)
05:00 < Xgates> all though the iptables -p output drop might do more then shorewall is setup as but I'm sure it's about the same already
05:00 < Xgates> anyhow what I see in that iptables rules can't do anything to drop your route 
05:00 < Bushmills> -P?  just simple chain policy setting
05:01 < Bushmills> saying "packets which don't match any rule are treated like this"
05:02 < Bushmills> no. it can't drop routes. but it prevents traffic getting sent to destinations you don't want
05:02 < Xgates> we've been talking for the past hour and sorry if I wasn't clear enough but about ROUTES/ROUTING
05:02 < Bushmills> as result of a route dropping, for example
05:02 < Xgates> ----> man ip route ls
05:03 < Bushmills> no, we were talking about "how to protect against vpn drop" in the context of stuff sent somewhere else
05:03 < Xgates> well I don't know why I firewall developer is telling me you don't do this in a firewall then....
05:03 < Xgates> no we weren't hehe
05:03 < Xgates> you misunderstood me I guess
05:03 < Xgates> and I'm thinking damm this can't be that hard
05:04 < Xgates> VPN= connection dies, no internet surfing :)
05:04 < Xgates> how's that?
05:04 < Bushmills> (09:30:51) Xgates: I'm asking about I can protect against a VPN drop
05:04 < Xgates> that's right
05:04 < Bushmills> what you consider "protect" was established then
05:05 < Bushmills> anyway, i think i have said what i was able to say about the issue.
05:05 < Xgates> well I see the problem now, in fact if you surf the internet there's a big part of probably more to do with Windows users for OpenVPN that use this term and so I use it too and it's very common amongst Windows VPN users
05:06 < Xgates> all you say in those circles is how can I protect against a VPN drop and everyone knows what you're talking about and I thought the same for Linux or any other OS too
05:07 < Xgates> so let me back this up, and don't think why or how LOL it happens, just that my VPN connection went off line, hell the guy sitting at the server got up and tripped over the power cord pulling it out the wall and the sever craps
05:07 < Xgates> LOL
05:08 < Xgates> ok VPN dead, now I don't want to surf through my own IP either. :)
05:08 < Xgates> ok now?
05:09 < Xgates> I don't want to by mistake surf the internet thinking I'm on the vpn when I'm not that's what I mean by protection
05:09 < Xgates> protecting my actual IP connection :)
05:10 < Xgates> wheeew this has been long LOL
05:10 < Xgates> my understanding with openvpn is I need a route cmd in the conf well at least I think I do
05:10 < Xgates> add route
05:10 < Xgates> delete route
05:12 < Xgates> well all I can say is if I go back to the shorewall developer he's going to yell at me and tell me you don't do this in the firewall
05:13 < Xgates> and if you don't believe me join #shorewall and ask Omache besides you seem like a firewall geek and you might enjoy his company :)
05:14 < Xgates> thanks for the effort Bushmills 
05:14 < Xgates> later
05:43 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Read error: Operation timed out]
06:21 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
06:21 -!- mode/#openvpn [+v Axeman] by ChanServ
06:39 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:45 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
06:45 -!- mode/#openvpn [+v Axeman] by ChanServ
06:46 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
07:30 <@vpnHelper> RSS Update - forum: build-ca not working <http://forums.openvpn.net/topic8463.html#p13772>
07:39 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
07:39 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
07:40 -!- mode/#openvpn [+o raidz] by ChanServ
07:46 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
07:57 < Miau> !welcome
07:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:57 < Miau> !goal
07:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:24 <@vpnHelper> RSS Update - forum: Windows 7 Openvpn Connection freeze / UMTS <http://forums.openvpn.net/topic8468.html#p13773>
08:30 <@vpnHelper> RSS Update - forum: How Do Your Protect Against A VPN Drop? <http://forums.openvpn.net/topic8479.html#p13774>
08:31 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:36 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p13776> || Windows 7 64 bit Installation Fails OpenVPN 2.2.1 <http://forums.openvpn.net/topic8440.html#p13775>
08:42 <@vpnHelper> RSS Update - forum: my isp has blocked my openvpn ports <http://forums.openvpn.net/topic8465.html#p13777>
08:54 <@vpnHelper> RSS Update - forum: Daily slow downs <http://forums.openvpn.net/topic8453.html#p13778>
09:04 < Wes> I'm trying to add a second client to my openvpn tun setup, and am having trouble with routing.
09:04 < Wes> Am I supposed to have one client-config-dir per client?  If not, how does the OpenVPN server know which client to route which subnet to?  
09:04 < Wes> Does it ... maybe look in ccd for a file matching cn and process that routing statement?
09:05 < WilcoRogers> yes
09:05 < WilcoRogers> Wes: it does
09:06 < Wes> wilcorogers - Thanks -- I just realized that maybe previous hand-editing of the cn in the cert is biting me.  *regenerating*
09:08 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
09:20 < WilcoRogers> I'm having trouble adding a second subnet (10.8.1.0, the pool is 10.8.0.0) - the client connects and gets and IP, and can talk to the server (and the server to it), but it cannot talk to other clients. Any thoughts?
09:21 < WilcoRogers> Every machine on the 10.8.0.0 one can talk to the others
09:24 < WilcoRogers> I followed the howto exactly, with the exception of the iptables line, where instead of forwarding to the other server-side network, I just forwarded it to the 10.8.0.0 subnet.
09:47 < d12fk> hi, I'm looking for translaters for the Windows GUI
09:47 < d12fk> won't be too much work, you'd just have to squeeze out a sentence or two every now and then
09:48 < d12fk> looking for guys with mother tounge in es, nl, no,pt and se
09:51 < d12fk> oh, and i'm talking about the "official" one at https://sourceforge.net/projects/openvpn-gui
09:51 <@vpnHelper> Title: OpenVPN GUI | Download OpenVPN GUI software for free at SourceForge.net (at sourceforge.net)
09:51 < WilcoRogers> dl2fk: I can speak dutch, but it's not my mother tongue
09:51 < d12fk> WilcoRogers: do you run a dutch windows?
09:52 < WilcoRogers> No.
09:52 < d12fk> sometimes it comes in handy to know how Microsoft calles something in a localized version, that's why i ask
09:53 < WilcoRogers> Yeah, I understand. I'm just offering in case there's noone else
09:53 < d12fk> WilcoRogers: so, how would you translate "Use System Proxy Settings"
09:54 < d12fk> do you run the gui yourself?
09:54 < WilcoRogers> I am at this very minute doing so
09:55 < WilcoRogers> Well Proxy might not have a direct t ranslation
09:55 < WilcoRogers> *translation
09:55 < d12fk> good, i think the language tab isn't localized yet
09:55 < WilcoRogers> Apparntely "Volmacht" is appropriate..
09:56 < d12fk> I'd stick with Proxy as it's a tech term
09:56 < WilcoRogers> Yeah - "Volmacht" is a proxy in the non-technical sense
09:56 < d12fk> but, if dutch internet settings use volmacht i'd be better... you see my point from above =)
09:57 < WilcoRogers> A quick google shows no signs of volmacht as a tech term
09:58 < d12fk> currently: "Gebruik Internet Explorer Instellingen"
09:59 < d12fk> "Gebruik Windows Proxy Instellingen" ?
09:59 < d12fk> is system a dutch word?
09:59 < WilcoRogers> so "Gebruik Proxy Systeem Instellingen"
09:59 < d12fk> good one
09:59 < WilcoRogers> Systeem
10:00 < d12fk> how about the general tab? where you can select the language
10:01  * d12fk thinks this talk should happen in -devel... anyone annoyed yet? =)
10:04 < WilcoRogers> Shall I move to -devel? I am still having some issues with openvpn anyways
10:05 < d12fk> yeah
10:07 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:07 -!- mode/#openvpn [+v s7r] by ChanServ
10:24 < MariaKeys> hello all.
10:25 < MariaKeys> does anyone know a GUI that would build on windows with Visual Studio 2010?
10:25 < Optic> s
10:45 <@vpnHelper> RSS Update - forum: Server moved to new location - Do I need a new pkcs12 cert <http://forums.openvpn.net/topic8480.html>
10:55 <@vpnHelper> RSS Update - forum: New User - Proposal <http://forums.openvpn.net/topic8481.html>
11:07 <@vpnHelper> RSS Update - forum: remapping of special characters <http://forums.openvpn.net/topic8482.html>
11:30 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 260 seconds]
11:33 < thedoc> !nat
11:33 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
11:33 < thedoc> !linnat
11:33 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
12:06 < WilcoRogers> Question: What's the highest I can set the verbosity to?
12:09 < grendal_prime> hey guys..We are slowly replacing allot of our cisco vpn's with openvpn boxes running on antiquated servers.  One of the concerns that keeps comming up is the latentcy on these openvpn servers is higher than that of the cisco equipment.  Is this to be expected?
12:10 < grendal_prime> Seems to work fine,...dont get me wrong.  Its just that the monitoring system for the network claims it has higher latentcy than the ciscos  had.
12:17 < rob0> Cisco is ipsec, right? Because ipsec does crypto in kernel space, whereas SSL VPNs do crypto in userspace, we do get a little more latency. In general it is hard to notice/measure, however.
12:17 < rob0> And we have numerous advantages from that design decision, so it was a worthy tradeoff.
12:30 < WilcoRogers> So this may be a stupid question, but where can I get the driver and the GUI for windows as a nice installer package?
12:32 < MariaKeys> http://swupdate.openvpn.net/community/releases/openvpn-2.2.1-install.exe
12:35 < WilcoRogers> MariaKeys: thanks!
12:35 < Optic> moo moo
12:39 < Wes> grendal_prime: you might also want to consider just what an "openvpn box" is
12:40 < Wes> for example, I'm doing openvpn on mikrotik boxes with little arm chips
12:40 < Wes> my ipsec stuff is all done with cisco crypto-accelerated routers
12:41 -!- dazo is now known as dazo_afk
12:41 < Wes> And aside from the user/kernel space questions you have to consider the underlying transport; if you are tunnelling on top of TCP it is bound to be slower than tunnelling on IP
12:42 < MariaKeys> tunnelling tcp is very very slow.
12:43 < MariaKeys> tcp-queue-limit 512
12:43 < MariaKeys> tcp-nodelay 
12:43 < MariaKeys> this is very important.
13:13 < Wes> MariaKeys: what does tcp-queue-limit do? Does tcp-nodelay disable the Nagle algorithm on the socket?  (SO_NDELAY sockopt)
13:23 < Wes> If I have two clients tunnelling to the same server from the same NAT masquerading LAN, and the tunnel runs over TCP, I shouldn't have any problems, should I?
13:23 < Wes> I can't figure out why one keeps dropping as the other one pops up
13:25 < Wes> no, they are just both seeing huge packet loss... WTF?
14:02 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
14:04 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Client Quit]
14:10 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:10 -!- mode/#openvpn [+v s7r] by ChanServ
14:11 <+s7r> local paramter works if i put ipv6 there ?
14:17 < albech> from my ovpn server i can ping other networks in the organization, but from clients connecting to my ovpn server i cannot. No firewall running on the ovpn server and I have tried pushing route to the other networks to the vpn clients without any luck
14:17 -!- OpenVPN is now known as OpenVAP
14:18 < OpenVAP> hi
14:18 < OpenVAP> anyone here?
14:19 < krzee> <3
14:19 < OpenVAP> hi
14:19 < krzee> !route
14:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:19 < OpenVAP> krzee maybe you can help me
14:19 < krzee> without having details of your setup, ild say check this:
14:19 < OpenVAP> i have openvpn running now
14:19 < krzee> !route_outside_ovpn
14:19 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
14:20 < OpenVAP> krzee:  with openvpn, do u get assigned a different ip for outgoing and incoming?
14:20 < OpenVAP> when i connect i get a totally different ip
14:20 < OpenVAP> for outgoing
14:20 < OpenVAP> from the vpn client
14:21 < OpenVAP> it wont connect till i add the firewall rule
14:21 < OpenVAP> but then i get incoming back to my ip from ips i dont recognize
14:21 < OpenVAP> which i block
14:21 < OpenVAP> can you explain this?
14:22 < OpenVAP> guess not
14:25 < Wes> anybody ever have problems with huge amount of packet loss on the VPN?
14:28 <+s7r> krzee will the parameter "local" work if i put ipv6 address?
14:51 < krzee> s7r, did you try it...?
14:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:53 < mtbf> Hi there, if anyone has any hints,  how can i troubleshoot it further/what can cause the issue, please look http://pastie.org/2244591 
15:23 -!- [1]SigmaProjects is now known as SigmaProjects
15:25 < krzee> mtbf, looks like you're on the right track
15:26 < krzee> its a general networking issue, not related to openvpn
15:26 < krzee> firewall, nat, something of that sort
15:40 < mtbf> Now i'm almost sure it's not the firewall, windows client problem is a different issue, i tested it again with linux client
15:41 < mtbf> and passed packets appeared in the pfSense firewall log, so i assume there's no problem with firewall.
15:42 < mtbf> I also doubt it's because the times on the machines differ, they're just in another timezones, but for both of them certificate should be valid, expiration date is long further.
15:43 < mtbf> If i could only grab more debugging information about the TLS handshake process...
15:51 < mtbf> I'll try later with increased verb value on the client side.
15:51 < krzee> thing is
15:52 < krzee> the server shows nothing
15:52 < krzee> it should see connection attempts
15:52 < krzee> until it does, its a general networking issue
15:52 < krzee> if you want info on the handshake
15:52 < krzee> !tlsverify
15:52 < krzee> check it without openvpn ;)
15:52 < krzee> !certverify
15:52 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
15:52 < mtbf> Thnx.
15:56 < grendal_prime> cool thanks guys
15:56 < grendal_prime> next thing on the list.  proxy-arp
15:57 < grendal_prime> not exactly sure that this is what we need yet..but is this something that is being brought up. and asked about.
15:57 < grendal_prime> i didnt find anything on openvpn.net that specifically said...here is how this is done.
16:52 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
17:13 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Read error: Connection reset by peer]
17:36 <@vpnHelper> RSS Update - forum: How to configure private subnets from command line? <http://forums.openvpn.net/topic8483.html>
17:48 <@vpnHelper> RSS Update - forum: broken easy rsa <http://forums.openvpn.net/topic8478.html#p13783>
17:58 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:58 -!- mode/#openvpn [+v Axeman] by ChanServ
17:59 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Client Quit]
18:02 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
18:02 -!- mode/#openvpn [+v Axeman] by ChanServ
18:24 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
18:37 < barf> I have an openvpn capable hardware bought from the netherlands running m0n0wall, how can I set it up as an OpenVPN client?
18:37 < barf> 19"
18:43 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
18:43 -!- mode/#openvpn [+v Axeman] by ChanServ
18:51 < FredMorris> hello
18:54 < FredMorris> anyone here?
19:34 -!- aenertia is now known as AEnertia
19:35 < AEnertia> question
19:35 < AEnertia> !goal sucessfully have large datagrams fragment accross a udp bridged openvpn session
19:36 < AEnertia> currently if I do a ping -s 1600 <vpn-endpoint> I do not get a response. Correct behaviour is to have the icmp datagrams fragment and get a response. 
19:36 < AEnertia> I have tried fragment 1300 and mssfix 1300 options. Link mtu is 1500 on the WAN links. 
20:05 < root> AEnertia: is that tun or tap?
20:05 <@vpnHelper> RSS Update - forum: build-ca not working <http://forums.openvpn.net/topic8463.html#p13785>
20:19 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 258 seconds]
20:23 < FredMorris> hello
20:28 < AEnertia> tap 
20:29 < AEnertia> basically I need to be able to send large udp frames ( upto 9216 ) for snmpv3 operations accross the link. But even pings larger than the link-mtu are not being fragmented (even with the want fragment hint set)
20:32 < FredMorris> hi
20:32 < FredMorris> aenertia maybe u can help me
20:33 < AEnertia> maybe
20:33 < FredMorris> im using openvpn and i get attempts at my firewall for svchost incoming connections from other IPs in the subnet
20:33 < FredMorris> is this just used for networking reasons?
20:33 < FredMorris> if i disable all these
20:33 < FredMorris> am i still encrypted in the vpn just whats blocked?  network services?
20:34 < AEnertia> windows... sorry your on your own
20:37 < root> AEnertia: are you using tun or tap for the vpn?
20:38 < root> AEnertia: but fragmentation should not depend on the interface, rather on the host or router stack
20:38 < root> AEnertia: do your packets have df set? :-) 
20:39 < AEnertia> root, no have played with df settings. 
20:40 < AEnertia> Fragmentation is happening when I say ping -S 1600 <vpn endpoint> from the terminating openvpn server... but from other hosts in the lan fails
20:40 < AEnertia> I've gone back to just having the link-mtu 1500 option, after playing around with various combinations of tun-mtu fragment and mssfix ... 
20:43 < FredMorris> aenertia lets say linux
20:43 < FredMorris> doesnt matter the os
20:43 < FredMorris> aenertia:  im not concerned about the OS side but rather the openvpn server side
20:43 < FredMorris> does vpn get multiple ips
20:44 < FredMorris> lets say my assigned IP is 555.1212
20:44 < FredMorris> and i connect via that outgoing and it works fine
20:44 < AEnertia> root, setting mtu size on another host to be say 1458 ( the tunnel mtu ) also does not make ping -S 1600 etc work...
20:44 < FredMorris> then the vpn server gets an incoming request from 555.1212.12.12
20:44 < FredMorris> its on the same subnet
20:45 < FredMorris> what is the 2nd server requesting?
20:45 < FredMorris> since outgoing and incoming are working fine from the ONE connected port
20:45 < FredMorris> aenertia any clue?
20:46 < FredMorris> os is irrelevant, its understanding how openvpn works
20:46 < FredMorris> i can use any os, i just happened to be using windows at the time
20:47 < FredMorris> is this like a dirty openvpn trade secret?
20:47 < FredMorris> noone seems to know :P
20:47 < AEnertia> FredMorris, how your firewall is setup is beyond the scope of openvpn server config, and is very much on the OS side. By default in linux the new tun/tap interface that is created when you bring up openvpn will have whatever your iptables default policy's are... if you have a firewall where OUTPUT/INPUT/FORWARD are set to DROP then that will apply to the new tun/tap device by default until added otherwise. If you have no firewall then those chains defau
20:47 < AEnertia> lts are normally set to ACCEPT to traffic will pass through the tap/tun device unhindered. What windows does in this case is beyond my knowledge. 
20:48 < FredMorris> aenertia yeah take out the firewall
20:48 < FredMorris> and the OS
20:48 < FredMorris> ive used linux so :P
20:49 < FredMorris> aenertia so your saying though that its just default routing tables, but its just on one specific IP?
20:49 < AEnertia> If you are running openvpn in point to point mode rather than server, then each instance will indeed get a new IP for each point to point client instance that is brought up. 
20:50 < FredMorris> aenertia:  Reason i ask is cause i saw different ips, one for the initial connecting from the TAP
20:50 < FredMorris> then their servers kept trying to get other information FROM ME 
20:50 < FredMorris> just happened to be using windows
20:51 < FredMorris> on the config end tho, is it coming through just one ip and the other ip thats requesting info from the same subnet, thats not standard config?
20:52 < FredMorris> yeah every os is different
20:52 < FredMorris> hmm ill try it on a linux box
20:52 < FredMorris> i guess ill narrow it down
20:53 < FredMorris> :O
20:53 < FredMorris> yeah i know all ports are open 
20:53 < FredMorris> i had it to vpn passthru so my computers firewall was doing all the protection
20:54 < FredMorris> anyways ok
20:54 < FredMorris> i guess one doesnt need to open it unless a featureset got blocked that i need
20:54 < FredMorris> if u dont need it keep the door closed :)
20:55 < FredMorris> k
20:59 < FredMorris> ill read thru the openvpn docs
20:59 < FredMorris> could be a vpn specific thing too
20:59 < FredMorris> this one uses a client based on openvpn but its not native openvpn
21:00 < FredMorris> it says openvpn in the client tho :P
21:00 < FredMorris> confusing i know
21:06 < AEnertia> interestingly when I send a large icmp packet (1600) from somewhere I see these in the server logs: LZO compression buffer overflow
21:07 < FredMorris> do you have large packets enabled on your router?
21:07 < FredMorris> lzo compression, are you using this on openvpn?
21:07 < FredMorris> its optional
21:07 < FredMorris> lzo prolly doesnt work with large packets or you dont have large packet support
21:15 <+Axeman> aenertia, are you trying to hack openvpn ?
21:21 < aenertia> turning off compression turns up the expected : tun packet too large on write
21:24 < aenertia> tun packet too large on write (tried=1459,max=1455)
21:24 < aenertia> hrm, why is there a 4 byte pad which isn't being accounted for by the ip stack... 
21:26 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
21:32 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:19 < aenertia> for whatever reasons with tcp icmp or udp. If I send a ip packet which is oversize... instead of fragmenting gracefully and sending to the remote I get: packet too large on write (tried=1459,max=1455) with various values of tried= from 1 byte over the max to 4 bytes over... it's like there is an additional header being added which the tunnel does not account for.... I have tried various combinations of fragment with the same results regardless of value.
23:19 < aenertia> ..
23:21 <@vpnHelper> RSS Update - forum: Redirect-gateway Reroutes Everything to the Server's IP <http://forums.openvpn.net/topic8467.html#p13786>
--- Day changed Thu Jul 21 2011
00:09 <@vpnHelper> RSS Update - forum: OpenVPN stopped working - willing to pay for support <http://forums.openvpn.net/topic8466.html#p13787>
00:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:39 <@vpnHelper> RSS Update - forum: New User - Proposal <http://forums.openvpn.net/topic8481.html#p13788>
01:10 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
01:10 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
02:13 -!- dazo_afk is now known as dazo
02:15 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html>
02:46 <@vpnHelper> RSS Update - forum: Windows 7 Openvpn Connection freeze / UMTS <http://forums.openvpn.net/topic8468.html#p13790>
03:12 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:12 -!- mode/#openvpn [+o mattock] by ChanServ
03:12 -!- Cain` is now known as Cain
03:44 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
03:44 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
04:34 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13791>
04:40 <@vpnHelper> RSS Update - forum: Server moved to new location - Do I need a new pkcs12 cert <http://forums.openvpn.net/topic8480.html#p13793> || Windows 7 Openvpn Connection freeze / UMTS <http://forums.openvpn.net/topic8468.html#p13792>
05:02 <@vpnHelper> RSS Update - forum: Tap driver install fail on Windows XP SP3 <http://forums.openvpn.net/topic8485.html>
05:38 <@vpnHelper> RSS Update - forum: Need Help unable to connect my openvpn with my home DHCP <http://forums.openvpn.net/topic8486.html>
05:50 <@vpnHelper> RSS Update - forum: Need Help unable to connect my openvpn with my home DHCP <http://forums.openvpn.net/topic8487.html>
06:12 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
06:12 -!- mode/#openvpn [+v Axeman] by ChanServ
06:36 -!- syn4pse- is now known as syn4pse
06:56 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:56 <@vpnHelper> RSS Update - forum: OpenVPN stopped working - willing to pay for support <http://forums.openvpn.net/topic8466.html#p13797>
07:07 <@vpnHelper> RSS Update - forum: Server moved to new location - Do I need a new pkcs12 cert <http://forums.openvpn.net/topic8480.html#p13799> || Need Help unable to connect my openvpn with my home DHCP <http://forums.openvpn.net/topic8487.html#p13798>
07:12 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13800>
07:18 <@vpnHelper> RSS Update - forum: New User - Proposal <http://forums.openvpn.net/topic8481.html#p13801>
07:32 < ecrist> good morning.
07:37 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p13802>
07:43 <@vpnHelper> RSS Update - forum: New Global Moderator: Bebop <http://forums.openvpn.net/topic8488.html> || Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p13803>
07:49 <@vpnHelper> RSS Update - forum: LAN-to-LAN router via OpenVPN - Not routing external hosts <http://forums.openvpn.net/topic8489.html>
08:03 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
08:03 -!- mode/#openvpn [+v Axeman] by ChanServ
08:18 <+Axeman> !howto
08:18 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:19 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:44 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
09:16 < WilcoRogers_> Hey folks - just a quick question: What's the highest setting I can set the "logging verbosity" to
09:16 < WilcoRogers_> 15?
09:19 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:25 < WilcoRogers_> Okay - so I have one client that cannot seem to properly connect to the VPN. It's a Win7 machine. I have had no trouble connecting from other win7 boxes. He gets and IP, but is unable to ping the server. I had him connect with logging Verbosity 10, which spits out a stupid amount of information, and the only "error" in the entire file is this:
09:25 < WilcoRogers_> WIN32 I/O: Socket Receive error [1542]: Invalid argument (WSAEINVAL)
09:35 < WilcoRogers_> !version
09:35 <@vpnHelper> The current (running) version of this Supybot is 0.83.4.1.  The newest version available online is 0.83.4.1.
09:38 < WilcoRogers_> Also, how can you tell what version of openVPN you're running
10:11 <@vpnHelper> RSS Update - forum: windows 7 x64 install, connects but cannot get nay further <http://forums.openvpn.net/topic8490.html>
10:19 < WilcoRogers_> So yah - the wireless seems to kill it.
10:19 < WilcoRogers_> Not sure if anyone's even listening :)
10:23 <@vpnHelper> RSS Update - forum: how to block P2P traffic <http://forums.openvpn.net/topic8491.html>
10:28 -!- WilcoRogers_ is now known as WilcoRogers9
10:35 <@vpnHelper> RSS Update - forum: windows 7 x64 install, connects but cannot get nay further <http://forums.openvpn.net/topic8490.html#p13808>
10:41 <@vpnHelper> RSS Update - forum: LAN-to-LAN router via OpenVPN - Not routing external hosts <http://forums.openvpn.net/topic8489.html#p13810> || how to block P2P traffic <http://forums.openvpn.net/topic8491.html#p13809>
10:56 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:56 -!- mode/#openvpn [+v s7r] by ChanServ
11:00 < grendal_prime> im living in hell with this
11:00 < grendal_prime> grrr
11:04 < grendal_prime> ok  here is the layout.  3 vpn servers (tap).  the clients number roughly between 600-800 so they are loadbalanced across the 3 vpnservers via an appliance.  They are bridged to say 10.8.0.0 255.255.0.0 network(yes its a huge domain space i am awair of that)
11:07 < grendal_prime> lots of arp lots of broadcast in general.  sometimes we have machines that are unreacable...(via another vpn connection).  Unless we add a static arp table entry that points from vpn connected machine-A to vpn connected machine-B
11:08 < grendal_prime> At first i thought it had to do with say machine-a and machine-b being connected via two differnt openvpn servers.  But that does not appear to be the case as we have located wich server machine-a is connected to and then forced machine-b to connect to the same server by bypassing the load ballancing appliance and we still have the same problem.
11:08 < krzee> why you bridging?
11:09 < grendal_prime> because the person that developed this mess used a bridge.  I think it was just that they did not understand the backend of this project.  
11:10 < grendal_prime> would that many connections start causing problems with arp?  Im assuming it would.  Im also assuming that a routed enviroment would resolve this issue.
11:10 < krzee> sounds like the easy fix
11:11 < krzee> well arp doesnt exist over a tun vpn
11:11 < grendal_prime> ya unfortunatly dev hates that idea of changing the type of connection...
11:11 < krzee> well dev should have done it right then
11:11 < krzee> if you dont need layer2, use tun
11:11 < grendal_prime> its literally 2 characters in the config..but getting that pushed to these devices is nightmare because nobody knows how to adjust it on the devices.
11:12 < grendal_prime> in the mean time these things keep increasing in numbers...(remember startreck tribbles/)
11:12 < krzee> it will only get harder to fix
11:13 < krzee> +1 for doing it right in the first place... but still, the longer you keep it this way the harder to fix it becomes
11:13 < krzee> tap doesnt scale well
11:13 < krzee> that is well known
11:13 < krzee> you could likely make a script and pass it out to people
11:13 < krzee> to auto-update their configs
11:14 < grendal_prime> 6000 boxes
11:14 < grendal_prime> it will have to be automated
11:14 < grendal_prime> ive built the new vpn servers to do the routed enviroment..
11:14 < grendal_prime> im just trying to get some info together so that i can push the change through.
11:21 < grendal_prime> would using proxy arp on the servers themselfs reduce the ammount of arp between the connected clients
11:22 < rob0> Sometimes a little short term pain is worthwhile. I think that is what you are looking at. Put in the effort now to do it right.
11:22 < grendal_prime> and if so can anyone suggest a link with some proxy arp examples..i cant seem to find the actual "script" just ref's to configs that point to proxy-arp.sh
11:24 < grendal_prime> rob0, understood..thats why i have already built the new openvpn servers to start migrating two...thing is..all i have is people who are not interested in doing that untell qa has worked it out and half of the project team on this has quite, been fired or just left.
11:26 < grendal_prime> if i can get a definate. "We cannot connect to that machine because the amount of arp on the network is so great" I can file the ticket with dev.. stick my fingers in my ears and type with my feet to finish the new config to the backend of this.
11:27 < rob0> If you were more flexible you could stick toes in ears.
11:27 < grendal_prime> i have kids..i could use them...hell for now ill use headphones..
11:28 < grendal_prime> i have a machine that i can replicate the problem with if i get a sniff  I guess ill start there.
11:30 < grendal_prime> apparently they had this problem with the cisco vpn concentrators at one point and the enabled proxy arp on those and that fixed it (all be it temporarily)  There is crying that we need to do the same on the openvpn servers.
11:30 < rob0> With a lot of work and study, the bridging could be made better. Not as good as routing, but improved. You'd set up ARP tables/filters on each VPN node.
11:31 < rob0> I think that would be more daunting than building a routed network, frankly.
11:39 < grendal_prime> im certain of that..but unfortunatly the only thing i have any control over is the server.
11:52 < grendal_prime> i dont suppose there is a way to just connect a tap ...nevermind thats stupid idea.
12:07 -!- dazo is now known as dazo_afk
12:14 < Wilco_Rogers> Okay so I'm having an issue with wireless
12:14 < Wilco_Rogers> I have a routed VPN setup, where all hard-wired clients can connect and chatter without issue.
12:15 < Wilco_Rogers> However, clients trying to access the server through a wireless connection (I'm on a campus, so the wireless network assigns completely different IPs) are unable to do so. Furthermore, any attempt to ping (via external IP) the servers in question is unresponsive
12:15 < Wilco_Rogers> The client picks up an IP without issue, but there is not connectivity.
12:16 < Wilco_Rogers> The clients are able to ping external servers (such as Google) but nothing internal
12:21 < Bushmills> you may have to fix your routes
12:21 < Bushmills> or your name server
12:22 < Wilco_Rogers> If it was a nameserver issue wouldn't I be fine with IP addresses?
12:22 < Bushmills> you would, yes.  but you didn't say whether you are
12:23 < grendal_prime> Wilco_Rogers, ya sounds like you need to set up some routes.  
12:23 < Wilco_Rogers> Okay. Let me see if I can sum it up better. When on wireless, I'm assigned an IP in the 10.11 group, and I am unable to ping servers in the 131.104 group, but I am able to ping completely external servers
12:24 < Wilco_Rogers> How do I go about that?
12:24 < Bushmills> you may have to fix your routes
12:24 < Wilco_Rogers> grendal_prime, do I route from the 10.11 pool that I am assigned on the wireless to the subnet?
12:24 <+s7r> i have a server with multiple ip addresses on interface eth0. can i give one public IP to a client ?
12:24 < grendal_prime> fist list which routes you want to the vpn to route to.....well actually first make sure your vpn server has a connection to those networks.
12:25 < Wilco_Rogers> my VPN server has a connection to 131.104 pool
12:25 < grendal_prime> pool? you mean network?
12:25 < Wilco_Rogers> yeah sorry
12:25 < Wilco_Rogers> I'm bad with terminology
12:25 < Wilco_Rogers> I'm here to learn :)
12:26 < grendal_prime> in your server config you will need to add a route statment for those networks.
12:26 < grendal_prime> ill get you example
12:26 < Wilco_Rogers> I already have push "route 131.104.153.0 255.255.255.0"
12:26 < Wilco_Rogers> do I just need to add another for the wireless network?
12:27 < Bushmills> why server config?  woudn't it make more sense to set those in the machines network configuration?
12:27 < Bushmills> after all, those networks openvpn has nothing to do with
12:27 < grendal_prime> ?
12:28 < Wilco_Rogers> Bushmills: isn't it easier to route from the server? That way any wireless connection can be directed properly without messing with individual clients
12:28 < Wilco_Rogers> (and by wireless I mean clients connecting on the school's wireless network)
12:28 < Bushmills> you want routes to them, regardless of whether openvpn is up or not, and not necessarily leave it to default route to target them
12:28 < grendal_prime> if you dont tell the server to route information to that network i dont think the server will allow info to go to that network..even if the client is pushed the route
12:28 < grendal_prime> example would be...    route 192.168.4.0 255.255.255.0
12:28 < grendal_prime> means..vpn server can route vpn traffic to the 4.0 network
12:29 < Wilco_Rogers> right. Where 192.168.4.0 is the IP of the overall network
12:31 < Wilco_Rogers> okay so in theory
12:32 < Wilco_Rogers> if I'm connecting from the wireless at 10.11.15.whatever
12:32 < Wilco_Rogers> then I should route 10.11.15.0 to 255.255.255.0
12:33 < grendal_prime> client-a connects to the vpnserver 
12:33 < grendal_prime> do you want client a to see the network on the otherside of the vpn server?
12:33 < grendal_prime> your internal network?
12:35 < Wilco_Rogers> I want client-a, when connected, to have VPN access to all the servers and machines on the VPN
12:35 < grendal_prime> and is that network a class c network..?  im assuming it is.. then you would use a class c mask of 255.255.255.0 for your internal network.. if you have slit that up then you will probably want to make those appropriate changes in your route statement. but umm more than liekly you are using a class c.
12:36 < grendal_prime> so client A needs to see Client B ?
12:36 < grendal_prime> sorry vpncleint-A  needs to seen vpnclient-B
12:36 < Wilco_Rogers> client A needs Yes. Thought I've enabled client-to-client
12:37 < Wilco_Rogers> *Though
12:37 < Wilco_Rogers> sorry bad sentence. Yes. vpnclient-A needs to see vpnclient-B
12:37 < grendal_prime> but vpnclient-A and vpnclient-B do not need to see internal-network-192.168.1.0 ?
12:37 < Wilco_Rogers> no.
12:38 < grendal_prime> so nither one needs access to the internal-network
12:38 < Wilco_Rogers> Well here's where you're getting me
12:38 < grendal_prime> answer "correct"  if they do NOT need to get to internal-network.
12:39 < Wilco_Rogers> The clients need to be able to connect to the internet, and they do it through the Campus' network
12:39 < grendal_prime> so they will need to get to a gateway on the internal network
12:39 < Wilco_Rogers> Yes, somehow
12:39 < grendal_prime> first get the machines seeing one another
12:39 < Wilco_Rogers> BUT I don't want to route all the traffic through the VPN
12:40 < grendal_prime> good luck on that
12:40 < grendal_prime> the client can fig itself to do that.
12:41 < grendal_prime> you could use iptables on the server to filter specific protoclols
12:43 < Wilco_Rogers> Here's what confuses me. So the campus assigns wired boxes IPs in the 131.104 network, and wireless connections 10.11 IPs
12:43 < Wilco_Rogers> all the boxes plugged into the 131.104 network can connect and handle my VPN just fine
12:44 < Wilco_Rogers> no problems, they can see each other, the server, everything is hunky dory
12:44 < Wilco_Rogers> but as soon as I try and VPN in from the Wireless connection
12:44 < Wilco_Rogers> it all dies
12:45 < grendal_prime> this sounds like somthing that is not vpn related
12:45 < Wilco_Rogers> I am very afraid of that.
12:45 < grendal_prime> start by portscannning the server from a wifi connection
12:46 < grendal_prime> i guess...well give more info on ...what is your server connected to?
12:46 < Wilco_Rogers> The server is connected to the same 131.104 network
12:46 < grendal_prime> ok
12:47 < Wilco_Rogers> when no VPNs are invoolved, I can ping the server from home, from the wireless, no problem
12:47 < grendal_prime> and when you connect via the wireless what ip address are you given?
12:47 < Wilco_Rogers> 10.11.15.X
12:47 < grendal_prime> whos wireless?
12:47 < Wilco_Rogers> Campus
12:48 < grendal_prime> and from the wireless network you can ssh into your server?
12:48 < grendal_prime> correct me if im wrong but cant he tellnet to the 1194 to see if its even accesible?
12:49 < Wilco_Rogers> yes on the SHH from the wireless to the server (just checked)
12:49 < Wilco_Rogers> *SSH
12:50 < Wilco_Rogers> How do I portscan? (Forgive my ignorance)
12:50 < grendal_prime> from a linux box or windows box?
12:51 < Wilco_Rogers> Well the choices are Mac and WinXP
12:51 < Wilco_Rogers> That are currently on the wireless
12:51 < Wilco_Rogers> I assume I just need to UDP scan
12:53 < grendal_prime> nmap serveripgoeshere
12:53 < grendal_prime> no nmap ..install it
12:53 < grendal_prime> however the hell you do that on a mac
12:53 < Wilco_Rogers> from the windows box?
12:53 < grendal_prime> no the mac..its closer to a real computer than the legos machine...sorry windows
12:54 < Wilco_Rogers> Haha - I'm with you bro. But unfortunately I work in an environment where people write their own programs, and only for windows.
12:55 < Wilco_Rogers> Anyways. I'll see if I can scan it
12:55 < Wilco_Rogers> But, just as an aside, if the port is closed, would I even be able to get an IP from the VPN server?
12:55 < grendal_prime> right...tell them to write their apps as web apps that anyone can use.  thats what the rest of the world is doing.
12:56 < grendal_prime> probably not
12:56 < Wilco_Rogers> :) That's what I'm trying to do... but Profs are very stubborn individuals
12:56 < grendal_prime> didnt realize you actually were connecting.
12:57 < grendal_prime> were is this "campus"?
12:57 < Wilco_Rogers> University of Guelph, Ontario, Canada
12:58 < grendal_prime> hows the weather?
12:58 < Wilco_Rogers> Fucking hot
12:58 < Wilco_Rogers> Pardon my fruench
12:58 < Wilco_Rogers> *French
12:59 < Wilco_Rogers> 46 (115) with humidity
12:59 < grendal_prime> oh come on...its canada.  you guys are hording all the snow...(thats what the taught us in school here in california)
12:59 < Wilco_Rogers> My lord I would love some snow right about now
13:00 < Wilco_Rogers> So what I can't wrap my head around, is why the 131.104. network has NO problems
13:00 < Wilco_Rogers> but the wireless
13:00 < Wilco_Rogers> is just angry
13:00 < grendal_prime> you get the snow..kansas gets tornados, Louisanna gets hurricans and texes and arizona get mexicans...we know how it works..we have tellivision.
13:00 < Wilco_Rogers> Ha ha
13:01 < grendal_prime> Also you guys have to club and eat baby seals and eat them to survive...(that might be alaska)
13:02 < Wilco_Rogers> I'm like a 1 hour drive from the US. You're thinking too far north :)
13:02 < Wilco_Rogers> Don't get me started on US stereotypes, there's plenty of those
13:04 < grendal_prime> us?  im not in US...im on California....
13:04 < Wilco_Rogers> is there a way to trace some sort of fireweall issue? Or would I just not get a connection if that was the case
13:04 < Wilco_Rogers> Haha well played :)
13:04 < Kalavera> Greetings guys I am having troubles when  I connect to the VPN server using Windows XP 
13:04 < grendal_prime> home of the Girls land of the beach
13:04 < Kalavera> it connect to the VPN succesfully and got the ip address 
13:05 < Kalavera> but when I try do a ping to the server let's say 10.8.0.1 it doesn't
13:05 < grendal_prime> i dont think you would connect.  I mean there could be a firewall issue..but would think you would never connect if that were the case
13:06 < Wilco_Rogers> Kalavera: go to your program files/openVPN/log and check your log file
13:06 < grendal_prime> need food...
13:06 < grendal_prime> tacos
13:06 < Wilco_Rogers> Sammich
13:06 < Kalavera> I am looking into the openvpn log file 
13:06 < Wilco_Rogers> Anything with a TLS handshake problems?
13:07 < Wilco_Rogers> (wow bad English tehre)
13:07 < Wilco_Rogers> and there
13:07 < grendal_prime> na dont like bread...i feel like im getting ripped off...
13:07 < grendal_prime> brb in 35.55 min.
13:07 < Wilco_Rogers> Kalavera: Step 2, turn off your firewall and try again
13:08 < Wilco_Rogers> grendal_prime HURRY
13:08 < grendal_prime> have to p to
13:08 < Wilco_Rogers> Me 2 brb
13:09 -!- Wilco_Rogers is now known as Wilco_Rogers_brb
13:09 < Kalavera> Wilco_Rogers_brb: firewall was and have been off all the time during tests
13:10 < Kalavera> Wilco_Rogers_brb: btw, it's the machine of a provider that is not giving me so much information about what is going on in his machine
13:10 -!- Wilco_Rogers_brb is now known as Wilco_Rogers
13:11 < Kalavera> Wilco_Rogers: it feels like a problem when u don't push routes in the openvpn.conf file so you can connect to the VPN, you can get the IP but you can't reach the networks behind
13:12 < Kalavera> Wilco_Rogers: in this case those networks behind the VPN server are being routed and pushed in the VPN side 
13:12 < Wilco_Rogers> Kalavera: but can you ping the client from the server?
13:12 < Wilco_Rogers> Or visa versa?
13:12 < Kalavera> Wilco_Rogers: I can ping my IP from the server but I can't ping his IP 
13:13 < Kalavera> Wilco_Rogers: and the IP is being assigned to his TUN adapter as I see in his screenshot
13:13 < Wilco_Rogers> Yeah - that makes me think it's not a routing option
13:13 < Kalavera> Wilco_Rogers: we both are affected for the same rules in the firewall configuration 
13:13 < Wilco_Rogers> What about the client's firewall?
13:14 < Kalavera> Wilco_Rogers: client firewall is off as they told me 
13:14 < Wilco_Rogers> Anything in the logfile?
13:14 < Kalavera> Wilco_Rogers: and no filtering in the network adapter either
13:14 < Wilco_Rogers> What set up are you using? Something routed?
13:14 < Kalavera> they sent me 5 lines from the log file so I asked them to connect back and paste me the log file content being connected
13:14 < Kalavera> stuill waiting
13:15 < Wilco_Rogers> Okay
13:15 < Kalavera> I can post the setup in pastebin 
13:15 < Kalavera> both side and client
13:15 < Kalavera> server 
13:16 < Wilco_Rogers> Well can the client still access the internet?
13:18 < Kalavera> Wilco_Rogers: http://pastebin.com/7kzDRUHN
13:19 < Wilco_Rogers> I assume you mean to have a port other than the default? port 11194?
13:19 < Kalavera> Wilco_Rogers: the user at the provider office is using a softphone to talk to me but when he connect to the vpn he loses the softphone communication , not really sure about the internet 
13:19 < Kalavera> yes
13:20 < Kalavera> as I said , the one thing that changes in the setup between my configuraton and theirs 
13:20 < Kalavera> is the certificate
13:20 < Kalavera> we both have the same config file
13:20 < Kalavera> I can connect and ping and do all what I need and tghey need 
13:20 < Kalavera> but they can't
13:20 < Wilco_Rogers> I also use a UDP protocol, but that shouldn't change the connection.
13:21 < Kalavera> the other difference between me and them is that I am using Windows 7 and they XP 
13:21 < Wilco_Rogers> Oh, you're also not using TLS authentication
13:22 < Wilco_Rogers> !float
13:23 < Wilco_Rogers> sorry just thinking out loud
13:23 < Kalavera> ok that is something to considerate later , but that will not change connectivity between the client and the networks behind
13:24 < Kalavera> it's ok , it is good to read some other opinnions about our setups
13:24 -!- hpa_ is now known as hpa
13:25 < Wilco_Rogers_> Sorry - somehow dropped there
13:25 < Kalavera> np
13:25 < Kalavera> wb
13:26 < Wilco_Rogers_> It seems to me seeing the networks behind is the least of your problems, if he can't even ping 10.7.0.1
13:27 < Wilco_Rogers_> First get him talking to the server
13:29 -!- Wilco_Rogers_ is now known as Wilco_Rogers
13:29 < Kalavera> Wilco_Rogers_: I did review routes with him and he has the sames routes I have
13:29 < Wilco_Rogers> Howabout that log file? anything in there
13:29 < Kalavera> I am not sure why I can talk to the server and he can't
13:29 < Wilco_Rogers> Well that's what you're trying to troubleshoot, no? If you knew, you'd have it fixed ;)
13:31 < Kalavera> that's right
13:31 < Wilco_Rogers> I think you might find what you're looking for in his log file
13:31 < Wilco_Rogers> *might*
13:36 < Wilco_Rogers> Bushmills - do you have any idea why a Wireless connection would pull an IP but have no connectivity, while the same machine on a wired connection has no problems?
13:37 < rob0> heh, about 1.5 gazillion possibilities there ...
13:37 < Wilco_Rogers> Ok but I've been trying to troubleshoot this, and it's getting tough to narrow down. Any pointers?
13:38 < Kalavera> Wilco_Rogers: 
13:38 < Kalavera> http://pastebin.com/3NHAqh1N
13:38 < rob0> be methodical, check each aspect. Layer 2: access point association?
13:39 < rob0> Layer 3: IP addresses, routes
13:39 < rob0> Layer 4: DNS?
13:40 < rob0> What OS is it?
13:40 < Wilco_Rogers> Both and XP and a 7  machine
13:41 < Wilco_Rogers> *an
13:41 < Wilco_Rogers> I'm troubleshooting from the XP machine
13:41 < Wilco_Rogers> Access point association - explain?
13:43 < Wilco_Rogers> Kalavera: It's odd your client log file doesn't show a "initialization completed". Does yours? Other than that though it looks like there's some restarting going on in the server logs. Beyond that though you're over my head.
13:44 < Kalavera> let me see
13:45 < rob0> In GNU/Linux the iwconfig(8) utility shows and controls the layer 2 (802.11) settings for a wireless interface. I do not know what the equivalent is on Windows, and I'd have to charge money to help you with that. :)
13:47 < Wilco_Rogers> The thing is there is also another bridged VPN done seperately from this one with openVPN and there's no wireless issue there.
13:47 < Wilco_Rogers> (all on the same Campus network)
13:47 < Kalavera> Wilco_Rogers: http://pastebin.com/ZiYrcdPM
13:47 < Wilco_Rogers> With the one client. So I would think if there was a wireless interface problem (adapter wise) it would affect both
13:49 < Wilco_Rogers> Kalavera: Instead of throwing me log files, compare them yourself :) I notice yours initializes, while there's no indication theirs does.
13:58 < Kalavera> smiles ok 
13:58 < Kalavera> thank you for the advices Wilco_Rogers 
14:05 < grendal_prime> rob0, dude... "1.5 gazillion possibilities there" thats exactly what my calculater came up with too~!
14:05 < Wilco_Rogers> That also isn't very encouraging
14:05 < Wilco_Rogers> It's such a battle to add one more thing to the setup
14:06 < Wilco_Rogers> "Get it working. Add feature, spend 2 days getting it working. Repeat"
14:06 < grendal_prime> sorry but i refuse to lie to people...(alot of people consider this an affliction and or character flaw)
14:06 < Wilco_Rogers> Haha no that's fine by me
14:06 < Wilco_Rogers> I'd rather know how hopeless it is
14:07 < Wilco_Rogers> I don't see how this is any different then connecting from some random external network
14:07 < grendal_prime> it would only be a billion possibilities with the wired setup but as soon as you add a wireless device it is required to jump to at lease a bazilion, then with a windows machine...it has to go to gazillion.
14:07 < Wilco_Rogers> Since people need to be able to get into the network from anywhere regardless
14:08 < rob0> well, I rounded up. I got 1.49822375 gazillion. Sorry.
14:09 < Wilco_Rogers> That's okay. There's a counting error inherent in there anyways
14:09 < grendal_prime> well i understand i figured the .498 was for good measure anyway.
14:09 <+Axeman> wired - does it get a gateway ? 
14:10 < grendal_prime> pleasant supreise if we get it working "we really beat the odds"
14:10 < Wilco_Rogers> +Axeman: Well yes, it gets a gateway wired, as it can connect to the internet
14:10 < Wilco_Rogers> It's not being pushed a new one, if that's what you mean
14:11 <+Axeman> lol normally ppl have it the other way around works wired doesn't wireless
14:11 < Wilco_Rogers> +Axeman: I cannot get wireless working
14:11 < grendal_prime> you sure its actually getting connected to the server on the wired side?  you can ping it through you vpn interface?
14:12 < Wilco_Rogers> I can. I can ping the local VPN IPs for the server, and other machines connected to it
14:12 < grendal_prime> whats traceroute on windows?
14:12 <+Axeman> tracert
14:12 < Wilco_Rogers> What would you like me to traceroute? from where to where over what connection ;)
14:13 < grendal_prime> the server from the client
14:13 < Wilco_Rogers> Over wireless?
14:14 < grendal_prime> lets try both...
14:14 < grendal_prime> ill roshambo you for the wireless
14:14 < grendal_prime> 3-2-1
14:14 < grendal_prime> Paper
14:14 < Wilco_Rogers> Ok. Currently I am tracerouting the VPN server (which I just pulled an IP from) from the wireless connection
14:14 < Wilco_Rogers> and I get a whopping nothing
14:15 < Wilco_Rogers> no hops
14:15 < grendal_prime> ok so you can see the server now?
14:15 < Wilco_Rogers> Nope
14:15 < grendal_prime> oo sorry
14:15 < Wilco_Rogers> A tracert of 10.8.0.1
14:15 < Wilco_Rogers> gives me zilch
14:15 < Wilco_Rogers> times out first one
14:15 < grendal_prime> not a very good tunnel
14:15 < Wilco_Rogers> it doesn't even hit a gateway.
14:15 < Wilco_Rogers> No.
14:15 < Wilco_Rogers> I'm amazed it can even pull an IP from the server
14:16 < Wilco_Rogers> but then again
14:16 < Wilco_Rogers> it pulls an IP before the VPN virtual adapter fucks with the whole thing
14:16 < grendal_prime> ok well that seems strange.
14:16 < Wilco_Rogers> Indeeeeeed
14:16 < Wilco_Rogers> Als
14:17 < Wilco_Rogers> Also - connected to the VPN, I'll try and tracert the external server IP
14:17 < grendal_prime> what does you clients log say?
14:17 < Wilco_Rogers> also nothing.
14:17 < Wilco_Rogers> Nothing suspicious, as far as I can tell
14:17 < grendal_prime> crank up the verb?
14:18 < Wilco_Rogers> it initializes fine
14:18 < grendal_prime> whats your cypher?
14:18 < Wilco_Rogers> Yah I set it to 10 once and it cranked our a 7MB text file
14:18 < Wilco_Rogers> DES-CBC
14:18 < Wilco_Rogers> but wouldn't ALL of that cause me to not even pull an IP?
14:18 < Wilco_Rogers> if it was an authentication problem?
14:19 < grendal_prime> no..
14:19 < grendal_prime> you will connect..it will just be bitchy not work
14:19 < mtbf> I encounter 'tls handshake failed' error with windows xp client, no antivirus software is present and no windows firewall enabled, other machines work fine with this installation, any suggestions?
14:19 < grendal_prime> install ubnuti
14:19 < grendal_prime> sorry did i actually type that?
14:19 < Wilco_Rogers> mtbf: Copy in a fresh version of the ta.key and try again
14:20 < mtbf> If you'll give me vsphere client for ubuntu, i'll do it.
14:20 < grendal_prime> anyway...cypher is same on server and client.  client thinks its connected.
14:20 < Wilco_Rogers> yes.
14:20 < mtbf> Wilco_Rogers: ta.key is fresh.
14:20 < grendal_prime> mtbf new vmware server has all web based admin console...
14:21 < grendal_prime> they got tired of hearing us bitch i think
14:21 < mtbf> Great, i'll keep it in mind.
14:21 < mtbf> But really, any ideas? Maybe some of the services.msc is not enabled when it should...
14:22 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
14:22 < Wilco_Rogers> Wait: WTF Is this?  131.104.10.177:2804 [wklumpen] Peer Connection Initiated with [AF_INET]131.104.10.177:2804
14:22 < mtbf> It worked well until i installed kaspersky, but then i removed it again while trying to troubleshoot this, of course there was made a reboot.
14:22 < Wilco_Rogers> The wireless assigns me an IP in teh 10.11 network!
14:22 < Wilco_Rogers> LIES!
14:22 < Wilco_Rogers> ALL LIES!
14:23 < Wilco_Rogers> A quick look at what's my IP shows that is indeed my IP addy
14:23 < grendal_prime> umm what is the netmask for that connection?
14:23 < Wilco_Rogers> BUT
14:23 < grendal_prime> the wireless that is
14:23 < Wilco_Rogers> that's not what my ifconfig gives me
14:24 < Wilco_Rogers> urm. 255.255.248.0
14:24 < grendal_prime> ok..sooo something you might try..
14:24 < grendal_prime> change your ip address pool on your openvpn server..to something...nowhere near the 10 network
14:24 < grendal_prime> just for giggles
14:24 < Wilco_Rogers> I tried that
14:24 < grendal_prime> 192.168.10.0
14:25 < Wilco_Rogers> Didn't work
14:25 < Wilco_Rogers> I did 192.168.11.0
14:25 < grendal_prime> and restarted the vpn server?
14:25 < Wilco_Rogers> yerp. I can try again.. gimme 2 seconds
14:25 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:26 < grendal_prime> 2 seconds to my new needy knook friend...and a margarita with lime and salt for the pretty girl at the end of the bar
14:26 < Wilco_Rogers> :) We're friends?
14:27 < Wilco_Rogers> Alright. Got an IP (like before) but now we're in the 192.168.11 world
14:27 < grendal_prime> You want more..you need to wear a higher skirt
14:27 < Wilco_Rogers> and still cannot ping 192.168.0.1
14:27 < grendal_prime> damn Canadia has some demanding inhabitants these days
14:28 < Wilco_Rogers> I'm not from Candia. I don't live in Candia
14:28 < Wilco_Rogers> it sounds very nice though
14:28 < Wilco_Rogers> I wonder if it's at all like Canada
14:29 <+Axeman> canadia is to the north of usia. 
14:29 < grendal_prime> we make words up allot here....well I do anyway
14:29 <+Axeman> they are dumb twats there also - so no no tmuch difference
14:30 < grendal_prime> wow
14:30 < Wilco_Rogers> Vicious
14:30 < grendal_prime> Wilco_Rogers,  see ...i actually am your friend
14:30 <+Axeman> lol sorry it's something one of my candian friends says all the time
14:30 <+Axeman> she's from dildo
14:30 <+Axeman> a newffy
14:30 < grendal_prime> does she live in candia?
14:31 < grendal_prime> sorry i missspelled that canadia..
14:31 < grendal_prime> anyway
14:31 < grendal_prime> so dude...i dont know
14:31 < Wilco_Rogers> AAAUGH.
14:31 < grendal_prime> if you can get to that port at that address and get an ip from it.
14:31 < Wilco_Rogers> Which I can
14:32 < grendal_prime> i would make sure your basic network stuff looks right..you know vpn ip netmask, 
14:32 < Wilco_Rogers> Right but would that not also affect the wired boxes?
14:33 < grendal_prime> both clients should get an ipaddress from the dhcp pool that your server is issuing,  the server should occupy the .1 address.
14:33 <+Axeman> lol no - moved here now. but still make fun of 'the dumb twats' in canada
14:33 < Wilco_Rogers> I mean the minute I plug this guy into the wired network, and fire up the VPN client, it works fine
14:33 < Riz> Hey now .... :P only about 50% are dumb twats up here
14:33 < Wilco_Rogers> I can ping the other wired machines, and other servers
14:33 < Wilco_Rogers> Yah I'd like to imagine I'm not a dumb twat
14:33 < Wilco_Rogers> not ALL the time, anways
14:34 < Wilco_Rogers> *anyways
14:35 < Wilco_Rogers> I think the issue stems from the fact that the wireless seems to be behind some sort of "router" while the wired does not.
14:35 <@vpnHelper> RSS Update - forum: LAN-to-LAN router via OpenVPN - Not routing external hosts <http://forums.openvpn.net/topic8489.html#p13811>
14:35 < Wilco_Rogers> As in, the IP address for the wired boxes/server is accessible from anywhere
14:36 < Wilco_Rogers> but the IP the wireless assigns me and the IP they claim I have is different
14:36 < Wilco_Rogers> (the IP whatsmyip claims I have, that is)
14:36 < grendal_prime> i got an idea
14:37 < Wilco_Rogers> And I think the traffic that gets sent back gets dropped before it gets to my computs
14:37 < Wilco_Rogers> grendal_prime, what's that?
14:37 < grendal_prime> no body scream im sure this one will not envolve a dead chicken....
14:37 < grendal_prime> yet
14:40 <@vpnHelper> RSS Update - forum: LAN-to-LAN router via OpenVPN - Not routing external hosts <http://forums.openvpn.net/topic8489.html#p13812>
15:12 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:15 < Dougy> do
15:15 < Dougy> so
15:15 < Dougy> oracle bought ksplice
15:15 < Dougy> lame
15:17 < ecrist> gah
15:18 < Dougy> ecrist: ?
15:19 < ecrist> cyanogenmod doesn't seem to support tap, only tun
15:19 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
15:21 < Dougy> oh
15:26 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:29 < ecrist> wb
15:29 < ecrist> I wonder how much work it is to compile cyanogen
15:30 < krzie> what would you change?
15:31 < grendal_prime> Wilco_Rogers, 
15:31 < Wilco_Rogers> Yeh
15:31 < grendal_prime> now you have to marry my ugly sister
15:31 < Wilco_Rogers> I know.
15:31 < Wilco_Rogers> Does she have Google+?
15:31 < ecrist> krzie: 2 things.  tap driver, and a config importer for openvpn.
15:31 < krzie> config importer++
15:32 < grendal_prime> well...she doesnt time since the "accident"
15:32 < krzie> that would be the mfW
15:32 < grendal_prime> type that is
15:33 < ecrist> krzie: agreed.
15:34 < krzie> im thinking it shouldnt be too much effort to compile
15:35 < ecrist> http://wiki.cyanogenmod.com/wiki/HTC_Evo_4G:_Compile_CyanogenMod_(OS_X)
15:35 < ecrist> not really, aside from getting my machine setup for it.
15:35 < krzie> you have a evo?
15:35 < ecrist> no, I have a myTouch 4G
15:35 < krzie> that phone is badass
15:35 < ecrist> the page with all the instructions for the 4g is missing. 
15:36 < ecrist> yeah, I love it
15:36 < ecrist> HSPA+ in Mpls gets me 7-12Mbps down and ~3Mbps up
15:36 < krzie> ahh
15:36 < krzie> i had a mytouch 3g until recently
15:36 < krzie> traded it for an air conditioner
15:36 < krzie> i use an aria
15:36 < krzie> basically a small evo
15:45 < grendal_prime> ok boys were done with the guy from canadia.  His vpn is up and working and im rid of antother ugly sister!  
15:45 < grendal_prime> pretty good day...its all comming up grendal_prime   today!
15:46 < grendal_prime> Oh crap i forgot about my proxy arp isssue..
15:49 < Wilco_Rogers> We canadians are lying cheating basterds. Ferget the deal with your sister
15:49 < Wilco_Rogers> I"ll be back tomorrow tho the struggle never ends
16:04 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
16:08 <@vpnHelper> RSS Update - forum: Replace openvpn server logo <http://forums.openvpn.net/topic8492.html>
16:17 < tls-auth> Hello there! I've a problem with ths-auth. My server demands a "tls-auth keyfile 1". But my windows mobile device does'nt find an external find, so I have to use the "<tls-auth>...</tls-auth>" methode. But I have not found any possibility to set the "1" as the direction parameter. I always results in "packet HMAC authentication failed". Unfortunately there isn't any complete documentation but always just insider tipps. May you help m
16:18 < tls-auth> Sry, I meant it doesn't an external _file_.
16:25 < tls-auth> Hm, supid client. Now I found a light-gray on white hint: Type !welcome and !goal before asking your questions.  Sorry!
16:25 < tls-auth> !welcome
16:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:25 < tls-auth> !goal
16:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:26 < tls-auth> !goal I would like to get access to my VPN with a windows mobile device, using tls-auth _inline_
16:26 < tls-auth> !logs Authenticate/Decrypt packet error: packet HMAC authentication failed
16:27 < tls-auth> !configs [...]<tls-auth>-----BEGIN OpenVPN Static key V1-----[...]-----END OpenVPN Static key V1-----</tls-auth>
16:38 < Bushmills> looks like an awk script :)
16:40 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:40 -!- mode/#openvpn [+v s7r] by ChanServ
16:41 < tls-auth> !howto
16:41 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:41 < ecrist> 16:31:58 < EugeneKay> I FIST AT FULL POWER ONLY
16:41 <+s7r> if i want to assign to clients public IP addresses, do they have to be added in the network interface of the server
16:42 < EugeneKay> You know, like in the Disturbed song. Ten Thousand Fists.
16:42 <+s7r> or just in the config 
16:42 < ecrist> s7r: no.  you just need to hand them out.
16:42 < ecrist> generally, though, they need to be in a different IP subnet than the public IP of the VPN server
16:43 < ecrist> either that, or you need to do IP aliases at the firewall
16:44 < EugeneKay> Did you ever get that phone sorted?
16:44 <+s7r> i have a /29 from my isp
16:44 <+s7r> so they are in the same subnet...
16:44 <+s7r> just last 2 digits changed :D
16:46 < tls-auth> Thanks a lot ;)
16:54 < ecrist> s7r: that won't work without firewall aliases
16:54 < ecrist> 1-to-1 nat
16:54 < ecrist> or binat, as it's called in pf
16:55 <+s7r> ecrist sorry but i do not understand what is a firewall alias
16:55 <+s7r> let me google it
17:03 < ecrist> no, google one-to-one nat
17:03 < ecrist> nor binat
17:03 < ecrist> that means you put all the IPs on the VPN server interface, and use the firewall to translate
17:05 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html>
17:05 <+s7r> i understand .. but can't the first ip in the subnet act as a gateway for the other 5?
17:05 < ecrist> no
17:05 <+s7r> and basically the IP for clients will not be up anywhere or reachable on the internet unless a client connects and gets assigned with that IP address
17:05 < ecrist> no
17:17 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:17 -!- mode/#openvpn [+v Axeman] by ChanServ
17:30 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
17:40 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
17:59 <@vpnHelper> RSS Update - forum: SSL Certificate and the Vmware appliance <http://forums.openvpn.net/topic8470.html#p13815>
18:05 <@vpnHelper> RSS Update - forum: LAN-to-LAN router via OpenVPN - Not routing external hosts <http://forums.openvpn.net/topic8489.html#p13816>
18:42 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
18:42 -!- mode/#openvpn [+v Axeman] by ChanServ
19:17 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p13784>
19:32 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
19:35 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p13817>
19:41 <@vpnHelper> RSS Update - forum: Logging OpenVPN-AS logs to remote syslog server? <http://forums.openvpn.net/topic8494.html>
20:30 < rommel092079> setting up kloxo 6.1.6 is very hustle
20:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 258 seconds]
22:02 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p13819>
22:32 < Samkov> hey everyone, I have been doing some big time searching, and I cannot find a thing. Basically I want to wildcard block all google search domains, ie: google.com, .de, .co.uk, etc.
22:33 < Samkov> does anyone know if there is a simple way to block something like google.*
--- Day changed Fri Jul 22 2011
00:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:45 < stev0> is there a difference between openvpn client and openvpn gui?
00:45 < stev0> or do they both provide the same encryption?
00:47 < EugeneKay> The level of encryption is dependent upon your server configuration. The various clients(CLI or GUI) differ in how they let you control the client's conenction to the server.
00:50 <@vpnHelper> RSS Update - forum: LAN-to-LAN router via OpenVPN - Not routing external hosts <http://forums.openvpn.net/topic8489.html#p13820>
00:54 < stev0> ah okay, thanks EugeneKay
01:15 < evasion> Hey, new to open VPN. got a dumb question, how do i make irc use it? sifting through google but all im getting is how to jois this channel -_- lol
01:17 < evasion> hmm nvm. seems to be working by itself  lol. prob why i couldnt find info
01:26 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13821>
03:10 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
03:13 -!- Cain` is now known as Cain
03:24 < Mowee> Morning
03:26 < hyper_ch> hi Mowee
03:33 <@vpnHelper> RSS Update - forum: Tap driver install fail on Windows XP SP3 <http://forums.openvpn.net/topic8485.html#p13822>
03:34 < Xgates> hey guys
03:35 < Xgates> Some keeps telling people this;
03:35 < Xgates> When the word provider is used it's not a VPN. A VPN is site to site. Expanding your private network over the internet in a secure manner. 
03:35 < Xgates> OpenVPN as example provides a online VPN service and this person seems to think this is not a VPN anyone care to expand on this?
03:38 < EugeneKay> VPN is a very inclusive term. In it's most basic form, it is a link between two computers providing a Virtual(not publically routed) Private(secured+encrypted) Network(it handles IP traffic) between those two machines.
03:38 <@vpnHelper> RSS Update - forum: Security Question: Changing TAP Device IP Manually <http://forums.openvpn.net/topic8495.html>
03:39 < EugeneKay> OpenVPN is more of a tool on which you can build your desired VPN topology, whether it be site-to-site, roaming clients getting gateway redirection, or secured transports between two servers over the internet(or other untrusted link)
03:41 < EugeneKay> A "VPN service provider", the sort you can pay $5/mo for, is usually providing the second example.
03:45 < EugeneKay> Does that answer your question, Xgates ? :-p
03:46 < Xgates> well I was looking more for some reasoning here as to why someone might think it's not
03:47 < Xgates> plus my understanding is no matter what form you use it, it uses NET protocols so regardless of not through the internet part into it, it relys anyways on internet protocols so I personally don't get how someone could say such a thing
03:47 < EugeneKay> It really boils down to how you define "VPN".
03:47 < Xgates> he seems to think a VPN provider is just a proxy
03:48 < EugeneKay> That's what most VPN providers are, yes. It's more advanced than simple SOCKS or HTTP proxying because it can route /all/ traffic through the link, and that link is secured by more than just toilet paper.
03:48 < Xgates> this person seems to have it stuck in his head that this is not VPN and of course it is
03:49 < EugeneKay> Like I said, OpenVPN is a tool whcih you use to assemble your VPN. How you design it is up to you.
03:49 < Xgates> OpenVPN can be used in many ways and it's still a VPN, even if you pay someone for a service they provide
03:49 < EugeneKay> Bingo.
03:50 < Xgates> right, I know, but you can't say if someone offers a VPN service on the internet you pay for this is not a VPN
03:50 < Xgates> that's all I'm getting at, that's incorrect information, don't you think so?
03:50 < EugeneKay> Yeah, sounds like he has a flawed bit of reasoning.
03:51 < Xgates> oh most VPN provders are a proxy?
03:51 < Xgates> I mean it's a proxy you are using?
03:51 < EugeneKay> That's usually what the point of "VPN Providers" is, yes.
03:52 < EugeneKay> If it helps to explain, a Crown Victoria is not necessarily a cop car or a taxi cab by virtue of it being a Crown Vic. Those just happen to be the top two uses of it.
03:52 < Xgates> ok I'm not all great at this, I thought there is a proxy server for doing this and that is using a proxy and here we are talking about a OpenVPN server and that's a vpn we are using...?
03:53 < Xgates> proxy server= using a proxy OpenVPN server= using vpn
03:53 < EugeneKay> "Proxy" within the context of a VPN Provider means that your web browsing traffic appears(to the websites you are accessing) to originate from the VPN Provider's servers. This is done using a VPN link between your computer and the VPN Provider's servers.
03:53 < Xgates> I thought there's a difference here?
03:55 < Xgates> so anytime you use a VPN service there is a proxy part of it being used?
03:55 < EugeneKay> That would depend upon the specific service, but yes, generally the point is to proxy your traffic.
03:56 < Xgates> ok how's this, all those so called public proxy lists you can find online and use in your browser to surf with
03:56 < EugeneKay> Those are open proxies, using SOCKS or HTTP proxying. Totally different animal, but the effect is (roughly) the same.
03:56 < EugeneKay> (also essentially unsecured)
03:57 < Xgates> to me that's a proxy and there are differences in I placed that IP into my browser on the OpenVPN I do not, the proxy IP in the browser also leaks more the OpenVPN do not, ok getting this now the type of proxy I'm talking about?
03:57 < Xgates> that's the proxy I'm talking about, to me that is a true proxy, if you can say this and OpenVPN is not this type of animal
03:58 < Xgates> yeah socks htto
03:58 < Xgates> http
03:59 < EugeneKay> OpenVPN proxying is fundamentally different from HTTP/SOCKS proxying in that it routes the actual TCP/UDP traffic over the OpenVPN link, which is completely transparent to your applications. No "enter the IP address" needed.
03:59 < Xgates> so if someone was to ask, when using a VPN service, what type of proxy is this, what is the reply to that?
03:59 < Xgates> ok
03:59 < EugeneKay> You would tell them that it is a "routed proxy over OpenVPN"
04:00 < Xgates> ok it's also an encapsulated tunnel through Networking Protocols that a socks and http are not too, right?
04:00 < EugeneKay> Yup.
04:00 < Xgates> ok thanks
04:00 < EugeneKay> It's a lower-level thing than SOCKS/HTTP
04:07 <@vpnHelper> RSS Update - forum: Tap driver install fail on Windows XP SP3 <http://forums.openvpn.net/topic8485.html#p13825> || Windows 7 Openvpn Connection freeze / UMTS <http://forums.openvpn.net/topic8468.html#p13824>
04:12 < Xgates> You know what this clown said? I asked somone who was asking a question what OS are you using and this guys asks what does this have to do with OpenVPN
04:13 < Xgates> Well Windows has broken routing if you want to call it that and Unix/Linux doesn't have routing issues
04:13 < Xgates> so to me there's a difference in what you're using
04:19 <@vpnHelper> RSS Update - forum: Security Question: Changing TAP Device IP Manually <http://forums.openvpn.net/topic8495.html#p13826>
04:31 <@vpnHelper> RSS Update - forum: Openvpn Site 2 Site :: Cant connect to LAN hosts. <http://forums.openvpn.net/topic8496.html> || Windows 7 Openvpn Connection freeze / UMTS <http://forums.openvpn.net/topic8468.html#p13827>
04:37 <@vpnHelper> RSS Update - forum: Openvpn Site 2 Site :: Cant connect to LAN hosts. <http://forums.openvpn.net/topic8496.html#p13829>
04:49 <@vpnHelper> RSS Update - forum: Security Question: Changing TAP Device IP Manually <http://forums.openvpn.net/topic8495.html#p13830>
05:07 <@vpnHelper> RSS Update - forum: Security Question: Changing TAP Device IP Manually <http://forums.openvpn.net/topic8495.html#p13831>
05:17 < EugeneKay> !factoids
05:17 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
05:20 < FlashDeluxe> hi! i got an segmentation fault if i want to start openvpn with one of my configs and i figured out, that this problem doesn`t appear if i replace the "remote blib.domain.de" with an resolved ip adress. What can i do in order to let openvpn resolve the hostnames? where is it adjusted?
05:22 < FlashDeluxe> i am using openvpn on dd-wrt
05:25 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13832>
05:31 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13833>
05:49 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13834>
05:54 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:54 -!- mode/#openvpn [+v s7r] by ChanServ
06:07 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13835>
06:13 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13836>
06:25 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13837>
06:37 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13840> || Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13839>
06:49 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13841>
07:19 < ecrist> FlashDeluxe: openvpn can usually resolve hostnames without issue.  seems like a problem with dd-wrt
07:19 < ecrist> talk to those folks.
07:19 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
07:25 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13842>
07:34 < Bushmills> FlashDeluxe: openvpn doesn't do any resolving. you'd use a name server which permits you to query it.
07:34 < Bushmills> !dns
07:34 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
07:43 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13844> || Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13843>
07:49 < sedulous> does anyone have a client-side up script that sets a DNS server and handles platform differences? (such as systems using the resolvconf program etc...)
07:58 < kisom> sedulous: i use iptables at the server side to redirect UDP/53 to my local DNS server. then it does not matter what is in resolv.conf.
07:59 < sedulous> kisom: that's a good idea but only if the clients have the default route through the vpn
07:59 < sedulous> otherwise great
08:01 < kisom> sedulous: to be honest i dont know if there's any good solution. i think (not 100% sure) that dhcpcd overwrites resolv.conf every time it renews the lease.
08:02 < Bushmills> unless told not to
08:03 < Bushmills> running a recursive name server on th client, setting resolv.conf to 127.0.0.1 and not letting resolv.conf touch by anything works well 
08:04 < kisom> best-practice solution :)
08:06 < Bushmills> may fail when a mobile device connecting to a network with an auth name server which resolves host names on that network.
08:06 < Bushmills> but that's more the exception, that you come in somewhere, fire up your box and immediately gain access to the local resources
08:08 < Bushmills> and if that's the case - introducing a tunnel from outside to their LAN will probably not be well received :)
08:09 < Bushmills> you box not querying their local name server is then maybe only small protection, but it is some, at least
08:19 < jpalmer> ecrist or krzee ping?
08:24 <@vpnHelper> RSS Update - forum: Strange Connection Issue <http://forums.openvpn.net/topic8497.html>
08:42 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13846>
08:48 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13848> || Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13847>
09:24 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13849>
09:41 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
09:48 <@vpnHelper> RSS Update - forum: Windows 7 Openvpn Connection freeze / UMTS <http://forums.openvpn.net/topic8468.html#p13850>
09:54 <@vpnHelper> RSS Update - forum: LAN-to-LAN router via OpenVPN - Not routing external hosts <http://forums.openvpn.net/topic8489.html#p13851>
10:23 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:30 <@vpnHelper> RSS Update - forum: LAN-to-LAN router via OpenVPN - Not routing external hosts <http://forums.openvpn.net/topic8489.html#p13852>
10:41 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13853>
11:04 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13854>
11:07 -!- dazo_afk is now known as dazo
11:14 < EvilGuru> Can OpenVPN use ssh public/private keys for authentication as opposed to the usual scheme?
11:15 < krzie> ...no
11:16 < krzie> well
11:16 < krzie> if you can script it, yes
11:16 < krzie> !pwauth
11:16 < krzie> !authpw
11:16 < krzie> !authpass
11:16 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
11:17 < krzie> !tls-verify
11:17 <@vpnHelper> "tls-verify" is seems to be broken in 2.1rc9 and working in 2.1rc8 https://bugzilla.redhat.com/show_bug.cgi?id=458600
11:17 < krzie> authpass is a script on each side of the connection
11:17 < krzie> all the matters in the end is the server side gives happy exit code
11:18 < EvilGuru> I saw the password auth stuff, was just wondering if a similar thing existed to allow ssh pub/priv key auth to be used
11:18 < krzie> !forget tls-verify
11:18 <@vpnHelper> Joo got it.
11:18 < krzie> your script could force them to verify those
11:19 < krzie> instead of a standard pass script
11:19 < krzie> but no
11:19 < krzie> doesnt exist that i know of
11:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
11:22 < krzie> http://openvpn.net/archive/openvpn-users/2005-09/threads.html#00130
11:22 <@vpnHelper> Title: openvpn-users by thread (2005-09) (at openvpn.net)
11:28 < rob0> dazo, I got a reply offlist. :)
11:33  * cpm replies to rob0 offlist
11:37  * rob0 blocks spam from cpm
11:38  * cpm pouts
11:39 < krzie> lol
11:40 -!- dazo is now known as dazo_afk
11:52 < sedulous> i'm using gert dörung's layer 3 IPv6 patches and it's working very well but i'm missing one thing. my server pushes static IPv6 addresses to certain clients with a script in client-config-dir. unfortunately this address is not exposed in the environment of openvpn hook script (client-connect, learn-address, ...)
11:53 < sedulous> at the moment i'm reading the "status" log to find the real IPv6 address of the client. however that log isn't updated frequently, so I'm sending SIGUSR2 to OpenVPN, sleep and hope that it's updated
11:54 < sedulous> is there a better way to get the current addresses of a client than parsing the status file?
11:54 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
11:54 -!- mode/#openvpn [+v Axeman] by ChanServ
11:55 < Bushmills> status-version 3  makes it easy to parse statusfile
11:56 < sedulous> Bushmills: thanks. i'll check it out, although my problem is that i need the address in the "client-connect" or "learn-address" hook and it's not guaranteed to be in the status file at that point
11:56 < Bushmills> in the script, read it from environment variable
11:56 < sedulous> even though it's already assigned to the client (via ifconfig-ipv6-push)
11:57 < sedulous> the environment only contains the address from server-ipv6 (which sets ifconfig-ipv6-pool), not the address that's pushed from a client-config-dir file
11:58 < sedulous> personally i think that's still a bug in the IPv6 patches
11:58 < sedulous> the hook script is clearly called after the push
12:00 < Bushmills> "ifconfig_remot     The remote VPN endpoint IP address specified in  the  --ifconfig  option..."   i suppose your ccd script pushes the ip addr per ifconfig  
12:00 < Bushmills> remote ...
12:00 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
12:01 < sedulous> Bushmills: it pushes it with ifconfig-ipv6-push
12:03 < Bushmills> does $ifconfig_remote  not apply to that?
12:04 < sedulous> ifconfig_ipv6_remote and that only contains the address that was assigned by the pool before the push
12:05 < Bushmills> ah. well, than i can only assume that the ipv6 patch is not complete
12:05 < Bushmills> ifconfig_remote_ipv6 isn't assigned anything to? that'd be in line with the other ipv6 vars
12:06 < sedulous> yes, that's my suspicion as well. my workaround is okay until it's fixed. i'll look at status-version 3 now though
12:06 < sedulous> aye, that one's missing!
12:06 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:06 -!- mode/#openvpn [+v s7r] by ChanServ
12:06 < sedulous> no wait, ifconfig_ipv6_remote is there of course
12:06 < sedulous> with the wrong address
12:07 < Bushmills> well, then you're all set
12:07 < Bushmills> oh. you aren't :)
12:07 < sedulous> i dumped the entire environment just to be sure. it's not there
12:08 < Bushmills> alternative is to read the CN from environment, then grep the pushed address from the corresponding ccd file
12:08 < sedulous> that's a good idea 
12:08 < sedulous> thanks
12:11 < sedulous> the new ipv6 mode is very sweet in all other aspects though!
12:11 < sedulous> it couldn't be easier to setup an ipv6 vpn
12:12 < sedulous> ok, well it probably could be easier but it's good enough ,)
12:22 < |TheWolf|> hi
12:24 < |TheWolf|> I've just downloaded the openVPN windows client and am now trying to connect. Everything seems to be ok, I receive three VERIFY OK logs, but the icon stays yellow and says "Connecting to: ..."
12:26 < |TheWolf|> http://pastebin.com/Sy142XTh
12:28 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
12:28 < |TheWolf|> !welcome
12:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:29 < |TheWolf|> !goal
12:29 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:30 < |TheWolf|> just read the tutorials, so: I want to access the lan behind the server
12:30 < |TheWolf|> ;)
12:30 < |TheWolf|> !configs
12:30 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
12:31 < Bushmills> !route
12:31 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:31 < Bushmills> !serverlan
12:31 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
12:33 < |TheWolf|> server  configuration is probably not a problem, there are several other people using openVPN to connect to the server
12:33 < |TheWolf|> I'll have a look at the rest
12:40 < |TheWolf|> is there a way to check where the connection fails? whether on my laptop (firewall?) or in my WLAN (router settings?) ?
12:40 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
12:43 < Bushmills> the log files are a good place to start
12:45 < |TheWolf|> Fri Jul 22 19:48:11 2011 TLS: Initial packet from xxx:1194, sid=0086c389 362f902a
12:45 < |TheWolf|> does that mean the connection in general *is* working?
12:45 < |TheWolf|> sorry for my stupid questions, I'm quite a noob when it's about networks
12:45 < Bushmills> if that's all you have in your logs, you may have to increase verbosity 
12:46 < |TheWolf|> I posted my log above
12:47 < |TheWolf|> http://pastebin.com/Sy142XTh
12:48 < Bushmills> that's server log, i assume
12:48 < Bushmills> client has connect problems? check client log
12:49 < |TheWolf|> that's the log I get to see when clicking "View log" in the GUI
12:49 < Bushmills> well, that's not a lot
12:50 < Bushmills> no info about the actual connection process, for example
12:50 < |TheWolf|> mom
12:50 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
12:50 -!- mode/#openvpn [+v Axeman] by ChanServ
12:50 < |TheWolf|> http://pastebin.com/urZUQyBC is that better?
12:51 < Bushmills> yes.   TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
12:52 < |TheWolf|> does that mean my key is wrong or just that the client could not send/receive keys?
12:53 < Bushmills> it didn't even get to the point of authenticating, but failed trying to even start  
12:54 < Bushmills> check server logs
12:58 < |TheWolf|> I can't access the logs right now
13:01 < |TheWolf|> Might this error be caused by a firewall on my laptop/of my router?
13:01 < krzie> yes, its a general networking error
13:02 < krzie> like you would get if its being blocked, or you have no internet
13:02 < |TheWolf|> hmm ok
13:03 < |TheWolf|> doesn't Fri Jul 22 20:00:25 2011 TLS: Initial packet from 81.14.224.41:1194, sid=bc0551f4 6958c003 mean there is a connection established?
13:03 < krzie> i cant look anymore
13:03 < krzie> Unknown Paste ID!
13:04 < |TheWolf|> http://pastebin.com/AXWjscrQ
13:06 < krzie> !configs
13:06 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
13:06 < krzie> both sides
13:06 < krzie> looks like 1 side is playing with mtu
13:06 < krzie> curious if both sides are
13:07 < |TheWolf|> how do I get my  configs in the windows client?
13:07 < |TheWolf|> in my network connection properties, mtu is set to 1500
13:08 < krzie> Program Files/OpenVPN/configs
13:08 < krzie> or some shit like that
13:08 < krzie> and im talking about in openvpn, not network connection properties
13:09 < krzie> you are using opensource openvpn, not Access-Server, right?
13:10 < |TheWolf|> tun-mtu 1400 <-- is it that?
13:10 < |TheWolf|> yes, open source
13:10 < krzie> yes its that
13:10 < krzie> comment that out
13:10 < krzie> then try again
13:10 < krzie> but there might be more
13:11 < |TheWolf|> http://pastebin.com/gG9Y0ht9
13:11 < krzie> you can remove first line
13:11 < krzie> tls-client
13:11 < krzie> its implied by client
13:11 < krzie> comment tun-mtu 1400
13:12 < krzie> line 9 isnt needed either
13:12 < krzie> thats the default
13:12 < krzie> but 1/9 dont matter, line 6 does
13:12 < krzie> then try again
13:12 < |TheWolf|> mom
13:14 < |TheWolf|> it's connecting
13:15 < |TheWolf|> but actually I don't think there's a malconfiguration of the server, because other users are able to connect
13:15 < |TheWolf|> same error es before
13:15 < krzie> disable windows firewall for a moment to test
13:16 < |TheWolf|> I've already added openvpn to the allowed programs, but I'll try
13:19 < |TheWolf|> no ca
13:19 < |TheWolf|> change*
13:24 < |TheWolf|> will have to leave for a while
13:24 < |TheWolf|> thanks for your help!!
13:25 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
13:25  * rob0 sighs
13:31 < krzie> its his norton or something similar
13:31 < krzie> hows it goin /dev/rob0
13:33 < rob0> busy, moving everything to a new server. Got mail moved finally, whew.
14:00 < |TheWolf|> hi
14:00 < |TheWolf|> here I am again ;)
14:01 < |TheWolf|> is there anything I need to change in the router setup to get the connection running? I always get VERIFY OK: ... and then TLS key negotiation failed to occur within 60 seconds
14:04 < |TheWolf|> any ports maybe?
14:06 < |TheWolf|> http://pastebin.com/AXWjscrQ thats a sample log
14:27 < Kalavera> greetings guys, wanted to ask if anyone have had connectivity troubles with openvpn over Windows XP SP2
14:35 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493.html#p13855>
14:58 < krzie> =]
15:01 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
15:03 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:10 -!- dazo_afk is now known as dazo
15:11 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13856>
15:16 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
15:23 < ecrist> jpalmer: pong
15:31 < rawsted> could someone link me to the more recently maintained builds of openvpn gui for windows?
15:32 < reiffert> rawsted: it comes with the openvpn installer
15:32 < reiffert> !factoids search gui
15:32 <@vpnHelper> 'webgui' and 'new_win_gui'
15:32 < reiffert> !new_win_gui
15:32 <@vpnHelper> "new_win_gui" is http://sourceforge.net/projects/openvpn-gui/ is the upstream project for the new windows gui
15:34 < rawsted> ty
15:34 < rawsted> ty reiffert 
15:49 -!- LuckyY_ is now known as LuckyY
15:59 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13857>
16:05 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
16:05 -!- mode/#openvpn [+v Axeman] by ChanServ
16:10 < roentgen> I could never understand why when using the windows service reconnecting fails
16:10 < roentgen> but always works when using the GUI
16:10 < roentgen> that is when resuming from hibernation in Vista/Win7
16:16 < reiffert> try the log next time.
16:16 < hyper_ch> hi reiffert
16:21 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13858>
16:27 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13859>
16:51 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13860>
16:54 -!- dazo is now known as dazo_afk
17:03 <@vpnHelper> RSS Update - forum: Tap driver install fail on Windows XP SP3 <http://forums.openvpn.net/topic8485.html#p13861>
17:06 < EugeneKay> !ipv6
17:06 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
17:21 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
17:38 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
18:09 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
18:37 < steve___> Say three firewalls, A, B, C, where A is the server and B & C are clients.  Will computers on B's network be able to see computers on C's network?
18:45 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:45 -!- mode/#openvpn [+v s7r] by ChanServ
18:52 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
19:14 < grmrgecko> So, this is the stupid question ever. I want to setup a VPN on a server to basically make the whole network available to anyone who has ether a key or password/username and can connect to other computers within the network the server is on.
19:14 < grmrgecko> Example, I have a SQL server and a WebServer
19:15 < grmrgecko> the WebServer is the VPN Server
19:15 < grmrgecko> and the SQL Server is only accessible in the same network
19:15 < grmrgecko> So, I would connect to the VPN to access the SQL server and run queries securly.
19:15 < grmrgecko> hopefully that explains it
19:22 < grmrgecko> I know this must be possible
19:28 < grmrgecko> even just allowing a few servers withs static IP addresses to be in the network only would be fine
19:30 < grmrgecko> I know there has to be a guide somewhere on how to configure this. Basically, access internal network via VPN client
19:32 < grmrgecko> http://www.monkeybrains.net/~rudy/example/openvpn-setup.html
19:32 <@vpnHelper> Title: HOW-TO configure OpenVPN (at www.monkeybrains.net)
19:36 < grmrgecko> would the key and stuff be a ssl certificate?
20:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 255 seconds]
21:09 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:11 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
21:11 -!- mode/#openvpn [+v Axeman] by ChanServ
21:11 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
21:25 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:56 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
21:56 -!- mode/#openvpn [+v Axeman] by ChanServ
22:02 <@vpnHelper> RSS Update - forum: Ubuntu9 I386 64 bit file for OpenVPN <http://forums.openvpn.net/topic8370.html#p13863> || Problem starting Access Server. <http://forums.openvpn.net/topic8225.html#p13862>
22:26 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
23:05 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
23:23 < lou1234> !welcome
23:23 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:23 < lou1234> !howto
23:23 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:23 < lou1234> !goal
23:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:25 < lou1234> I have been given a cacert, 2  other .pem files, and an .opvn file from my sysadmin and I would like to connect to my office network. I tried reading the howto but I got really lost on how I need to connect. Can anyone point me in the right direction?
23:25 < EugeneKay> Windows?
23:26 < lou1234> Yes, I placed all the files in the config folder in Openvpn
23:26 < EugeneKay> The .ovpn file should be associated with the GUI client. Double-click it to launch.
23:26 < lou1234> when I run it I get an error that says: Error: private key password verification failed
23:26 < lou1234> I can't figure out where to enter a password
23:27 < EugeneKay> One of the .pem files is protected with a password. Interesting that it isn't prompting you for it.
23:27 < lou1234> (Thank you for helping me) actually I skipped one of the errors.
23:27 < steve___> Say three firewalls, A, B, C, where A is the server and B & C are clients.  Will computers on B's network be able to see computers on C's network?
23:27 < lou1234> The previous one is stating that it can't load my private key file. Should that go in the config file as well?
23:28 < EugeneKay> steve___ - depends upon A's firewall or the client-to-client directive's presence on the server
23:28 < EugeneKay> lou1234 - you may need to edit the .ovpn file to correct the paths to the .pem / cacert files
23:28 < EugeneKay> Notepad is fine
23:28 < steve___> EugeneKay: ok cool, so it is possible?
23:29 < EugeneKay> steve___ - completely.
23:29 < steve___> EugeneKay: awesome thank you
23:29 < EugeneKay> (IF you're running in Bridged mode, which has been experimentally proven to cause cancer, AIDS, and rape your cat)
23:30 < EugeneKay> Note that bridged mode with broadcasts being transported WILL eat your bandwidth.
23:30 < lou1234> I will take a look in that file. Thank you
23:30 < steve___> yeah I was going to do routed
23:31 < EugeneKay> Then you'll need to use something that isn't broadcast-based. You'll want to set A as the WINS server.
23:31 < steve___> all three fw's are running openwrt
23:31 < EugeneKay> On your own there :-p
23:32 < steve___> No fear for the ignorant  ;)
23:33 < lou1234> EugeneKay where should the pathway be listed? I see the section for SSL/TLS paramters and it is ca "cacert.pem" cert "(numbers).pem" key "(username).pem" Should the path be listed there?
23:33 < EugeneKay> Then it ought to be relative to the .ovpn file.
23:33 < EugeneKay> Hrm.
23:34 < EugeneKay> Whine to your sysadmin? :-p
23:35 < EugeneKay> (or pastebin the log output)
23:35 < dijital1> is there a way to specify a hostname in the client config file instead of an IP address?
23:35 < EugeneKay> Sure. SPecify a hostname instead of the IP address.
23:36 < dijital1> mmm when I do that it doesn't connect
23:36 < dijital1> name resolution is working correctly
23:41 < dijital1> I'll keep playing with it
23:41 < dijital1> thanks
--- Day changed Sat Jul 23 2011
01:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:15 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: No route to host]
01:43 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13864>
01:45 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:55 <@vpnHelper> RSS Update - forum: my tap adapter gets random ip 169.254.40.124 <http://forums.openvpn.net/topic8521.html>
01:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
02:19 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13866>
02:35 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13867>
02:53 <@vpnHelper> RSS Update - forum: Use OpenVPN both on local network & remote <http://forums.openvpn.net/topic8522.html> || Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13868>
03:05 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13870>
03:08 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:08 -!- mode/#openvpn [+o mattock] by ChanServ
03:11 <@vpnHelper> RSS Update - forum: my tap adapter gets random ip 169.254.40.124 <http://forums.openvpn.net/topic8521.html#p13872> || Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13871>
03:42 < reiffert> ecrist: you've heared about the 84 death teenagers from sweden?
03:54 < EugeneKay> Norway*
04:04 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
04:05 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13873>
04:11 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13874>
04:24 <@vpnHelper> RSS Update - forum: Use OpenVPN both on local network & remote <http://forums.openvpn.net/topic8522.html#p13875>
04:30 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p13876>
04:36 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13877>
04:42 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13878>
04:48 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13879>
05:06 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-15.html#p13880>
05:15 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:15 -!- mode/#openvpn [+v s7r] by ChanServ
05:18 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-30.html#p13881>
05:32 < disaster37> hi all
05:32 < disaster37> I have little problem with OpenVPN 2.1.3 and debian squeeze
05:33 < disaster37> my config works fine from 2 month
05:33 < disaster37> and now openvpn refused to start
05:33 < disaster37> it display
05:33 < disaster37> Sat Jul 23 12:29:26 2011 Linux ip addr del failed: external program exited with error status: 255
05:34 < disaster37> and in config file, if i remove group nogroup and user nobody it seems to work 
05:34 < disaster37> Have you any idea to help me ?
05:35 < Bushmills> seems that the command  ip  is executed with insufficient privileges of nobody user 
05:36 < disaster37> so I must chmod the command ip ?
05:37 < Bushmills> doesn't sound like a good idea, though it would work (you're thinking of setting the suid bit, i assume)
05:38 < disaster37> what is suid bit ?
05:39 < Bushmills> oh - if you don't know, i better don't tell you
05:41 < Bushmills> well, i can tell you what it is for, without telling you how to set it :)   it marks an executable to run as process owner identical to file owner, rather than process owner identical to who started it,
05:42 < disaster37> i have set chmod +x /sbin/ip
05:42 < disaster37> and now it seems work fine
05:42 < Bushmills> that's because you still have nobody and nogroup taken out of config
05:44 < disaster37> In config file I have set against nobody and nogroup and it's work ..
05:45 < disaster37> ho no it doesn't work
05:45 < disaster37> sorry
05:47 -!- LuckyY_ is now known as LuckyY
05:49 < disaster37> to delete the route, openvpn sue also ip command ?
05:49 < disaster37> use
05:55 < disaster37> I have created user openvpn and I have set his on openvpn conf
05:55 < disaster37> when I log me with this account I can exec the ip command
05:55 < disaster37> but when I relauch openvpn
05:55 < disaster37> I have now this
05:55 < disaster37> ERROR: Linux route delete command failed: could not execute external program
05:56 < disaster37> but nothink about add route
07:32 < zwamkat> I have a LAN-LAN VPN connection (IPsec) dropping every 15 seconds. This might not the right to room to discuss it in. Can someone point me in the right direction?
07:59 < Bushmills> log files
09:10 <@vpnHelper> RSS Update - forum: problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html>
09:14 < zwamkat> Bushmills: please take a look at: http://pastebin.com/s9tiz6Mu
09:15 < Bushmills> "Can someone point me in the right direction?"  -> you.
09:15 < Bushmills> log files *are* right direction
09:19 < reiffert> zwamkat: 
09:19 < reiffert> !notcompat
09:19 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
09:21 < zwamkat> Bushmills: Would you be able to help me to interpret them?
09:22 < zwamkat> reiffert: I'm not trying to use openVPN, I was hoping to find a community to ask my questions.
09:22 < Bushmills> i think you're better off on the #ipsec channel
09:23 < zwamkat> Ok. Cheers.
09:24 < Bushmills> openvpn logs just look different.#
09:45 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
09:45 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
09:45 -!- mode/#openvpn [+o mattock] by ChanServ
10:04 < sassan> is it possible to connect two openvpn instances to the same tun device? (and have traffic routed between them) or do I need to create two tuns and route between them?
10:04 < lartza> openvpn ./build-ca gives this: error:0E065068:configuration file routines:STR_COPY:variable has no value:conf_def.c:618:line 151
10:04 < lartza> Arch Linux
10:07 < Bushmills> you'll need two tun interfaces 
10:07 < sassan> Bushmills, thanks :)
10:23 <@vpnHelper> RSS Update - forum: SOLVED: Tap driver install fail on Windows XP SP3 <http://forums.openvpn.net/topic8485.html#p13883>
10:28 < sassan> how about tap? same story?
10:28 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13884>
10:35 <@vpnHelper> RSS Update - forum: problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html#p13885>
10:58 < sassan> if the server dev is a tap, must the client dev be tap too? I'm getting errors (to follow) when they don't match
10:58 < sassan> Sun Jul 24 02:03:31 2011 /sbin/ifconfig tun0 10.8.0.4 pointopoint 255.255.255.0 mtu 1500
10:58 < sassan> SIOCSIFDSTADDR: Invalid argument
10:58 < sassan> Sun Jul 24 02:03:31 2011 Linux ifconfig failed: external program exited with error status: 1
11:00 < sassan> actually nevermind, tap for both is probably better for me anyway
11:03 < grmrgecko> So, just so I understand. OpenVPN is not a server that can host L2TP VPN access
11:04 <+s7r> grmrgecko no, OpenVPN is a server that can host OpenVPN VPN access
11:04 < grmrgecko> ok, just figured that out.
11:05 < Bushmills> !tunortap
11:05 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:05 <+s7r> if you need any vpn use OpenVPN instead of L2tp
11:05 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
11:05 <+s7r> i preffer it ...
11:05 < grmrgecko> I need L2TP as the operating systems I'm using VPN on works with it already.
11:05 <+s7r> but if you require l2tp specially then it's nothing you can do with ovpn
11:15 < sassan> !wins
11:15 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
11:24 < loongson> :-*
11:26 < loongson> away
11:33 < loongson> hello
11:33 < loongson> test "say" command
12:33 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13886>
13:03 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484.html#p13887>
13:23 < Hejsan123> Im getting this error when I¨m connecting to my VPN
13:23 < Hejsan123> http://paste.ubuntu.com/650757/
13:27 < Bushmills> Cannot load CA certificate file ca.crt path -  seems like something your should verify
13:27 <@vpnHelper> RSS Update - forum: my tap adapter gets random ip 169.254.40.124 <http://forums.openvpn.net/topic8521.html#p13888>
13:30 < Hejsan123> Bushmills: Trying with
13:30 < Hejsan123> ca "/etc/openvpn/ca.cert"
13:32 < Hejsan123> same message
13:34 < Bushmills> ca.cert != ca.crt
13:37 <@vpnHelper> RSS Update - forum: UDPv4: Connection reset by peer (WSAECONNRESET) <http://forums.openvpn.net/topic8524.html>
13:38 < Hejsan123> opps!
13:45 < Hejsan123> Bushmillis: Same problem....
13:45 < Hejsan123> http://paste.ubuntu.com/650771/
13:46 < Bushmills> try to drop the quotes
13:47 < Hejsan123> you mean = "ASDASDAS"
13:47 < Hejsan123> ?
13:47 < Hejsan123> ""
13:48 < Hejsan123> I do not have the best english m8
13:48 < Bushmills> yes,  those " .... " 
13:49 < Hejsan123> Bushmills: Just done that = ca /etc/openvpn/ca.crt/
13:49 <@vpnHelper> RSS Update - forum: my tap adapter gets random ip 169.254.40.124 <http://forums.openvpn.net/topic8521.html#p13890>
13:49 < Hejsan123> but same problem!! -__-
13:49 < Bushmills> no idea then. 
13:50 < Hejsan123> fuck me...
14:32 <@vpnHelper> RSS Update - forum: SOLVED: Tap driver install fail on Windows XP SP3 <http://forums.openvpn.net/topic8485.html#p13892> || Error svc_run_except <http://forums.openvpn.net/topic8473.html#p13891>
14:42 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:44 <@vpnHelper> RSS Update - forum: UDPv4: Connection reset by peer (WSAECONNRESET) <http://forums.openvpn.net/topic8524.html#p13893>
15:06 < Kartagis> what file does post-connection iptables command go to by default?
15:13 < oc80z> was pkitool -batch broken or was the vars file unedited
15:15 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
15:22 < Kartagis> are you asking me oc80z ?
15:33 < Kartagis> !setup
15:37 < gr4y5ky> Hi there ;-) Is it possible to route traffic throug the vpn without using the push "redirect gateway" in ther server config file? I tried to use the sam ip route table without the push "redirect gateway" option an it didn't work... What exactly does this option on the client side, besides editing the ip route table?
16:35 < EugeneKay> !redirect-gateway
16:35 < EugeneKay> !def1
16:35 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
16:56 <@vpnHelper> RSS Update - forum: Use OpenVPN both on local network & remote <http://forums.openvpn.net/topic8522.html#p13894>
18:14 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-30.html#p13895>
19:02 < bragon> Morning !
19:02 < bragon> I have a issues with a openvpn client
19:02 < bragon> i want to had my "cloud box" in my vpn
19:02 < bragon> but i'm using KVM so eth0 is map in a br0
19:03 < bragon> and when i start openvpn on the server, the tap0 iface always automagicly attach to the br0 iface
19:03 < bragon> so i never manage to had my tap0 iface up with the good ip.
19:03 < bragon> if i tcpdump on my tap0 iface after that i could see all the br0 trafic o_o
19:05 < Bushmills> !tunortap
19:05 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
19:05 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
19:05 < Bushmills> why bridge?
19:10 < bragon> http://paste.geeknode.org/8d536519
19:15 < bragon> any idea :o
19:27 < reiffert> Du willst mich fisten, mitten ins Gedärm, doch ob das erlaubt ist, das wüwuesst ich gern
19:30 < reiffert> http://www.youtube.com/watch?v=U95_opnIHg0
19:30 <@vpnHelper> Title: Die Kassierer - Du willst mich fisten - YouTube (at www.youtube.com)
19:34 < reiffert> amy winehouse is dead
19:37 < EugeneKay> Ima let you finish Amy, but David Carradine had one of the best death scenes of all time
19:40 < reiffert> local news paper telling bout club 27
19:41 < reiffert> Brian Jones, Jimi Hendrix, und Janis  Joplin, Jim Morrison und Kurt Cobain people who passed away in the age of 27
20:45 <@vpnHelper> RSS Update - forum: OpenVPN Server not Starting? <http://forums.openvpn.net/topic8525.html>
20:47 < adubz> can someone help me setup a pptp connection
20:48 < adubz> i have tried and to no avail not working
20:48 < krzee> !notovpn
20:48 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
20:52 < adubz> krzee my probably is i can not establish a pptp connection im a complete noob to this and was hoping someone could walk me through the steps
20:54 < krzee> this channel has nothing to do with pptp
20:54 < krzee> you wont get help with pptp here
20:54 < krzee> in fact:
20:54 < krzee> !pptp
20:54 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read
20:54 <@vpnHelper> about why to not use pptp, or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
20:54 < krzee> and
20:54 < krzee> !notcompat
20:54 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible, or (#2) openvpn only connects to openvpn
21:31 <@vpnHelper> RSS Update - forum: OpenVPN Server not Starting? <http://forums.openvpn.net/topic8525.html#p13897>
21:55 <@vpnHelper> RSS Update - forum: Proxy Authentication? <http://forums.openvpn.net/topic8424.html#p13898>
22:16 < UnterPerro> apssword
22:23 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
22:23 -!- mode/#openvpn [+v Axeman] by ChanServ
22:36 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:05 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 257 seconds]
--- Day changed Sun Jul 24 2011
00:30 < Deesl> !welcome
00:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:30 < Deesl> !goal
00:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:30 < Deesl> I am trying to connect to my VPN from TunnelBrick. Apparently it does not work and tells me that it can't read my ca certificate file. Although the file is properly put in the configuration directory
00:30 < Deesl> I am on MacOS Lion
00:51 < lulzplzkthx> Hey, I have a friend who recently tried setting up an OpenVPN server. I was able to connect just fine, and from that connection, I could access local domains and websites. However, when I tried to ping google.com, or access any website not local to that server, they wouldn't load.
00:51 < lulzplzkthx> The firewall is not the issue, as he has turned it off temporarily to check if it was. Any ideas as to what the problem could be?
00:53 < lulzplzkthx> It's not a DNS issue either, as trying to ping 8.8.8.8 didn't work either.
01:24 <@vpnHelper> RSS Update - forum: Use OpenVPN both on local network & remote <http://forums.openvpn.net/topic8522.html#p13899>
01:36 <@vpnHelper> RSS Update - forum: Multiple clients behind same nat adsl router <http://forums.openvpn.net/topic8526.html>
01:42 <@vpnHelper> RSS Update - forum: Need some configuration help. <http://forums.openvpn.net/topic8493-30.html#p13901>
02:00 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13902>
02:18 <@vpnHelper> RSS Update - forum: Multiple clients behind same nat adsl router <http://forums.openvpn.net/topic8526.html#p13903>
02:24 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13904>
02:30 <@vpnHelper> RSS Update - forum: Multiple clients behind same nat adsl router <http://forums.openvpn.net/topic8526.html#p13905>
02:36 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p13906>
03:14 -!- Cain` is now known as Cain
06:01 <@vpnHelper> RSS Update - forum: my tap adapter gets random ip 169.254.40.124 <http://forums.openvpn.net/topic8521.html#p13907>
06:07 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13908>
06:44 -!- JPeterso2 is now known as JPeterson
07:29 < n00b1> I want to make a script that will allow me to autologon to my vpn if my computer is online
07:31  * Bushmills wonders what is there to script
07:32 < Bushmills> !redirect
07:32 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
07:32 < Bushmills> lulzplzkthx: ^^^
07:37 < n00b1> oh thanks bushmills
07:39 < n00b1> !def1
07:39 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
07:45 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
07:45 -!- mode/#openvpn [+v Axeman] by ChanServ
07:58 < ecrist> reiffert: no, I'll be back later.  Need to un-fuck a box (including the one I IRC from)
08:01 <@vpnHelper> RSS Update - forum: OpenVPN Server not Starting? <http://forums.openvpn.net/topic8525.html#p13909>
--- Log opened Sun Jul 24 08:09:11 2011
08:09 -!- Irssi: #openvpn: Total of 147 nicks [4 ops, 0 halfops, 1 voices, 142 normal]
08:09 -!- Irssi: Join to #openvpn was synced in 37 secs
08:26 < n00b1> is there a way to specify username and password on connect at the command line
08:26 < n00b1> for openvpn
08:29 -!- EmperorT1m is now known as quadDamage
08:37 <@vpnHelper> RSS Update - forum: OpenVPN Server not Starting? <http://forums.openvpn.net/topic8525.html#p13910>
08:42 <@vpnHelper> RSS Update - forum: OpenVPN Server not Starting? <http://forums.openvpn.net/topic8525.html#p13912>
08:49 < Bushmills> n00b1: no. use keys, not user name/password, for non-interactive login, or put user/pass into a file
08:50 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
08:50 < n00b1> bushmills is there a tutorial on how to set what you mention up I am trying to avoid having to type in a username and password for each session
08:51 < Bushmills> man page on --auth-user-pass,  or - for keys - ...
08:51 < Bushmills> !howto
08:51 < n00b1> my opvn config file i want to specify username and pass so i dont have to manually type in everytime
08:51 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:59 < n00b1> auth-user-pass-verify ./validate.sh via-pasfile      what is the layout of the user/pass file?
09:00 < Bushmills> it says so in the man page
09:00 < Bushmills> do you want me to read it for you?
09:00 < n00b1> please i can not find it
09:01 < n00b1> this is the only piece of the puzzle im missing and im done with the setup
09:01 < Bushmills>  Authenticate  with server using username/password.  up is a file containing username/password on 2 lines 
09:01 < Bushmills> i wonder how you could miss that
09:07 <@vpnHelper> RSS Update - forum: OpenVPN Server not Starting? <http://forums.openvpn.net/topic8525.html#p13913>
09:23 < n00b1> Options error: --auth-user-pass-verify requires --mode server   i get this line when trying to run
09:25 < Bushmills> indeed. that's a server option, not a client option
09:30 < n00b1> bushmills oh i want to do user:pass in my client config
09:30 < Bushmills> why do you then try to add  -auth-user-pass-verify ?
09:31 < Bushmills> (15:51:23) Bushmills: man page on --auth-user-pass,  ...
09:34 < n00b1> bushmills right i have to type in user and pass via when prompted i have auth-user-pass in my config file
09:35 < n00b1> im trying to avoid having to type in user and pass though on the client side
09:36 < Bushmills> did you actually read the manual page about --auth-user-pass ?
09:37 < Bushmills> after not having found the file format on the first lline, i actually doubt that
09:38 < n00b1> oh but i did bushmills
09:38 < n00b1> im even rereading it again
09:39 < Bushmills> so what did it say about "if up is omitted..."?
09:39 < n00b1> Using alternative authentication methods
09:41 <@vpnHelper> RSS Update - forum: VPN with different VPSes <http://forums.openvpn.net/topic8264.html#p13914>
09:45 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
09:46 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
09:46 -!- mode/#openvpn [+v Axeman] by ChanServ
09:46 < n00b1> Pattern not found if up is omitted
09:47 < n00b1> please kindly tell me what to do
09:48 < Bushmills> paste me the bit of documentation from your man page where --auth-user-pass is explained
09:49 < n00b1> found it on google i was looking in the man page
09:49 < n00b1> searchablity of man openvpn is not user friendly
09:49 < n00b1> when i do /some search string
09:49 < n00b1> i have to keep typing /some searchitng or / up arrow enter
09:49 < n00b1> its annoying and it doesnt search well
09:50 < Bushmills> or compare your man page against http://docs.scarydevilmonastery.net/cgi-bin/dwww/usr/share/man/man8/openvpn.8.gz?type=man
09:50 <@vpnHelper> Title: openvpn(8) - Man pages (at docs.scarydevilmonastery.net)
09:51 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
09:51 < n00b1> ok thanks for the insight though you have been helpful 
09:52 < n00b1> i am using another vpn so i can only do client side stuff on what you mentioned earlier can i still do if inet is detect router traffic through open vpn i wouldnt think so since i dont control server side things
09:52 < ecrist> reiffert: that shooting sounds horrible.
09:52 < ecrist> :\
09:53 < Bushmills> i'd say it is possible to do.  whether you can, i don't know - it depends on finding the bit in the man page about  --auth-user-pass
09:57 < sassan> if I bridge two tap interfaces (brctl addbr br0; brctl addif br0 tap0; brctl addif br0 tap1), the two ends of the tap device should be able to communicate without any additional config, right?
09:57 < sassan> (in this case it's a virtual machine and an openvpn instance, but two openvpn instances would probably behave the same)
09:58 < Bushmills> sassan: sounds about right
09:58 < sassan> hmmmm, think I tried that yesterday and it didn't work, but I'll give it another bash now
09:58 < n00b1> enable password save may not have been enabled by default on my openvpn  i did not build from source
09:59 < n00b1> i can see where this could be a problem with this
09:59 < n00b1> i dont control server side so that is out of my realm too
10:00 < Bushmills> sassan:  it may - or may not, i'm not sure - depend on bringing the tap interfaces on with  0.0.0.0 promisc
10:01 < sassan> ok, I'll give it a try :)
10:03 < sassan> works :) thanks :)
10:06 < n00b1> bushmills at least my stumbling around gives me a better understand of things
10:07 < Bushmills> careful to remain able to tell apart better understanding and the illusion of better understanding
10:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
10:14 < n00b1> i think my only option at this point is try to script.....i hate typping in user and pass each time it gets annoying
10:15 < n00b1> i read something where dd-wrt was easy to configure but again i wonder if it is server side configuration stuff only
10:16 < Bushmills> generally, openwrt seems to be less problematic for setting up openvpn on routers than dd-wrt  
10:16 < n00b1> i will keep that in mind
10:16 < Bushmills> you want 8 MiB Flash - the ssl libs are sizy
10:17 < n00b1> can you do client side setup to user remote vpn access with openwrt
10:17 < n00b1> bushmills any router recommendations
10:17 < Bushmills> how much do you want to spend?
10:17 < n00b1> ehh 100 ish or a little more
10:18 < Bushmills> buffalo wzr-hp-g300nh or tp-link wr1043nd
10:18 < Bushmills> for "a bit more", the netgear wndr3700 looks good too
10:20 < Bushmills> i'm not sure what " client side setup to user remote vpn access" means
10:31 < orion> Hi. How can you prevent ARP spoofing on an OpenVPN network in some type of automated fashion?
10:32 < orion> Assuming that the users of the VPN are not computer literate.
10:36 < n00b1> orion i think you always have to assume that
10:36 < n00b1> :)
10:37 < orion> n00b1: Any ideas?
10:37 < n00b1> orion im no expert here bushmills is though
10:37 < orion> I see.
10:38 < Bushmills> !tunortap
10:38 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
10:38 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
10:42 < orion> heh ok
10:44 < n00b1> bushmills where is the up file usually placed
10:44 < Bushmills> n00b1: on your hard disk
10:44 < n00b1> just curious im going to not give up and try a few more things
10:45 < n00b1> right but where
10:45 < Bushmills> it is not until you put it somewhere
10:45 < n00b1> i put it where my .opvn config is
10:45 < n00b1> said cant find file up etc
10:46 < Bushmills> that's a possibility,  you may want to set permissions such that it's not readable by others
10:46 < Bushmills> specify full path
10:46 < n00b1> WARNING: cannot stat file '[up]': No such file or directory (errno=2)
10:48 < n00b1> openvpn --client --config /home/user/openvpn/my.ovpn --ca /home/user/openvpn/my.ca.cr
10:48 < n00b1> this is how i launch my openvpn client  do i pass a param telling where the up file is
10:49 < n00b1> --up /home/user/openvpn/up
10:50 < Bushmills> what's not clear about the description in the man page?
10:51 < Bushmills> does the man page tell you to specify the user/password file by using --up? 
10:52 < n00b1> bushmills it does not say where to put the up file
10:52 < n00b1> i do that and i have the up file that i created where the .opvn   it does not tell you were to store the up file
10:53 < n00b1> or if you need to specify on command line and option to call up
10:53 < Bushmills> it doesn't say because it doesn't care.  you specifiy where it is, and you put it there
10:53 < Bushmills> does the man page tell you were to put the openvpn config file?
10:56 < n00b1> how do you call the up file on the command line
10:58 < Bushmills> just as the man page shows
11:01 < n00b1> --auth-user-pass /home/user/openvpn/up            
11:01 < n00b1> un Jul 24 10:59:31 2011 AUTH: Received AUTH_FAILED control message
11:01 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:01 -!- mode/#openvpn [+v s7r] by ChanServ
11:02 < n00b1> my up file has username and password stored in file named up in the path given but does not authenticate the up file is just a file that has  name up with user on the first line and password on the second line
11:02 < n00b1> hopefully im not missing anything here but if you could let me know id be grateful
11:03 < Bushmills> you're probably missing to specify the location of the file - its path - if you get the message that the file wasn't found
11:04 < Bushmills> ah, different message now
11:04 < Bushmills> seems the file was finally found now
11:04 < sassan> doesn't the file have to be generated by openvpn?
11:04 < sassan> --enable-password-save
11:06 < n00b1> i read that in the configure so i am assuming if building openvpn from source
11:07 < sassan> ah, yes, my mistake
11:10 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
11:10 -!- mode/#openvpn [+v Axeman] by ChanServ
11:11 < n00b1> i see some files have extension of up so i tried again renamed home.up still a no go but it acts as if it is doing things
11:13 < Bushmills> "up" ist just a place holder for any file name.  it could also be "mouldy.banana"
11:29 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
11:37 < n00b1> --auth-user-pass /home/user/openvpn/home.up    so one would have to assume that  if I am not authenticating and it is finding the file then the server was not configured with --enable-password-save
11:42 <@vpnHelper> RSS Update - forum: "The route addition failed: The object already exists" 7 x64 <http://forums.openvpn.net/topic8527.html>
11:58 < n00b1> bushmills dont really understand the hiccups and why it wasnt originally working when trying "up" but now all is well thanks man
12:24 <@vpnHelper> RSS Update - forum: problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html#p13916>
12:31 <+s7r> how do i connect a client who only has ipv6 connectivity to openvpn server?
12:31 <+s7r> openvpn server has also ipv6 ... but openvpn listens on ipv4/tcp/443
12:36 <@vpnHelper> RSS Update - forum: "The route addition failed: The object already exists" 7 x64 <http://forums.openvpn.net/topic8527.html#p13917>
12:39 < blue112> Hi everyone.
12:40 < blue112> Does someone know why I can't connect to my openvpn using UDP ? With TCP, it's working perfectly, but I'd like to use UDP now. It blocks at UDPv4 link remote: [AF_INET]myserverip:5190, and then say TLS Error: TLS key negotiation failed to occur within 60 seconds
12:40 < blue112> + ?
12:41 < sassan> what's between the client and server? any firewalls, etc?
12:42 < sassan> I've been unable to use UDP in certain strict networks
12:43 < blue112> sassan, nothing between them, as far as I know. Iptable is nice (ACCEPT as default policy)
12:44 < sassan> try seeing if you can send/receive UDP traffic with netcat. eg: on one side "nc -lup 4444" and on the other "nc -u <ip of first machine>"
12:44 < sassan> then type some stuff on the second one and see if the first sees it
12:44 < sassan> and visa-versa
12:45 < blue112> sassan, ok, I'm trying.
12:46 < blue112> sassan, where should I put the port on the client command :/ ?
12:46 < blue112> Ok, space separated, sorry
12:46 < sassan> oh, after the IP. sorry, I missed that
12:48 < blue112> sassan, to the server, it works
12:48 < blue112> From the server, it doesn't
12:48 < sassan> hmmm
12:49 < sassan> oh, when you try it the other way, I think you need to run the commands on the opposite sides
12:49 < sassan> I think netcat's udp mode is uni-directional
12:49 < blue112> I've done that.
12:50 < blue112> When I run nc -l on the server, and connect to it, it works
12:50 < blue112> When I run nc -l on my second server, and connect to it from the server where openvpn is installed, it doesn't work.
12:50 < sassan> ah, so there's your problem
12:50 < blue112> It still don't know how to fix it :p
12:51 < sassan> aye, but we have a starting point :)
12:51 < blue112> Yep.
12:51 < sassan> so is there anything at all between the two servers? or are they on the same lan?
12:52 < blue112> They aren't on the same lan.
12:52 < blue112> So there could be many thing between them...
12:52 < sassan> yes
12:52 < blue112> They are on two different point on the wan
12:53 < sassan> so something in the middle is probably preventing UDP packets getting from the first server to the second
12:53 < sassan> but it's fine the other way
12:54 < blue112> Could be :/
12:56 < blue112> sassan, is there something I could try / do to now where the problem is ?
13:03  * krzie points @ the second part of the topic
13:04 < blue112> Crap connection
13:05 < blue112> I got disconnected , did you say something sassan ?
13:05 < krzie> [14:05]  * krzie points @ the second part of the topic
13:06 < blue112> The firewall thing ?
13:06 < krzie> yep
13:06 < blue112> krzie, my firewall is at ACCEPT for every table.
13:06 < krzie> and if it isnt your firewall, its your providers
13:07 < krzie> but theres obviously a firewall
13:07 < blue112> The server is hosted in a datacenter, I don't think there's a problem with that
13:07 < krzie> well its one of those, or you messed up when testing with netcat
13:07 < blue112> Maybe it's my firewall, but I can't figure out what in iptables fails.
13:07 < krzie> well theres a iptables section in the openvpn manual... have you read it?
13:07 < blue112> Netcat just shows what I'm experimenting for few month.
13:09 < krzie> !man
13:09 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
13:13 < blue112> krzie, this configuration makes not interest since my iptables have default policy "ACCEPT"
13:13 <@vpnHelper> RSS Update - forum: "The route addition failed: The object already exists" 7 x64 <http://forums.openvpn.net/topic8527.html#p13918>
13:13 < krzie> you enjoy this endless loop?
13:14 < krzie> there are 2 facts
13:14 < krzie> a) there is a firewall blocking, or you messed up your netcat test
13:14 < krzie> b) this wont change no matter how much you talk about it
13:15 < blue112> Can someone provide me a netcat listening somewhere to confirm that my second server isn't making the problem ?
13:16 < krzie> run the server on port 53 udp
13:16 < krzie> then if your client can resolve dns from a nameserver unrelated to its network
13:17 < krzie> then its outbound udp 53 is fine
13:17 < krzie> (this assumes you dont run a nameserver on your vpn server)
13:17 < krzie> ((or that you have an ip on that server which doesnt listen for dns...))
13:18 < blue112> krzie, name resolving is working.
13:18 < krzie> is that what i said...?
13:18 < krzie> "then if your client can resolve dns from a nameserver unrelated to its network"
13:18 < krzie> not "if you resolve dns, everything is fine"
13:19 < krzie> also, this only proves udp 53 works
13:19 < krzie> not whatever port you're trying
13:19 < blue112> krzie, it resolve correctly from 8.8.8.8 (google's DNS)
13:19 < krzie> then udp 53 outbound is fine
13:19 < krzie> to try running your server on udp 53
13:19 < krzie> i feel like im repeating myself...
13:20 < blue112> Ok.
13:23 < blue112> TLS Error: client->client or server->server connection attempted from [AF_INET]myip:53
13:23 < blue112> What does that mean :/ ?
13:23 < krzie> means you're doing something goofy as shit
13:23 < krzie> !configs
13:23 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
13:24 -!- dazo_afk is now known as dazo
13:24 < krzie> moinmoin dazo
13:25 <@dazo> krzie: hey!
13:28 < blue112> krzee, http://pastie.org/2264634, openvpn 2.1, Linux (Debian).
13:30 < krzie> put both sides on verb 4, then paste the full log
13:30 < krzie> note, if you must hide your info, you should go pay for help
13:30 < krzie> !topsecret
13:30 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
13:30 < krzie> if we knew some way to hack your setup just because it runs openvpn, we wouldnt use openvpn
13:31 < krzie> (or we'ld fix it)
13:35 < blue112> krzie, sounds fair.
13:35 < blue112> http://pastie.org/2264673
13:35 < blue112> Here are logs
13:35 < krzie> wtf
13:35 < krzie> 2.1_rc11
13:36 < krzie> !download
13:36 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
13:36 < krzie> go update
13:36 < blue112> krzie, do you REALLY think my UDP setup isn't working just because I'm few version late ?
13:37 < krzie> i really think you shouldnt be using known buggy versions of software
13:37 < krzie> almost 3 years old
13:37 < krzie> heh
13:38 < krzie> you running it on the 2.4 linux kernel too?
13:38 < blue112> I'm running on the version that is maintain by debian. Let me run an apt-get upgrade.
13:38 < blue112> But I won't spend my evening compiling an openvpn.
13:38 < krzie> its not hard to build from source
13:38 < krzie> it will make you feel like you belong running linux!
13:39 < blue112> I didn't say it was hard.
13:39 < krzie> evening, lol
13:39 < krzie> will take 1minute
13:39 < krzie> ./configure
13:39 < krzie> make
13:39 < krzie> make install
13:39 < blue112> make install
13:39 < krzie> omg sooo long!
13:39 < blue112> I know all that stuff, and I know a have a poor server, and a bad connection. I'll be disconnected in the meanwhile, and it will just be painful.
13:40 < krzie> ok well this has wasted more time from my life than it should
13:40 < krzie> so good luck, later
13:41 < krzie> im convinced you arent looking for a fix, you just want some conversation ;]
13:41 <@vpnHelper> RSS Update - forum: OpenVPN Server not Starting? <http://forums.openvpn.net/topic8525.html#p13919>
14:04 <@vpnHelper> RSS Update - forum: problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html#p13920>
14:22 <+s7r> how do i connect a client who only has ipv6 connectivity to openvpn server? ; openvpn server has also ipv6 ... but openvpn listens on ipv4/tcp/443
14:23 < reiffert> when it doesnt listen on ipv6, you dont.
14:23 <+s7r> and how can it listen ?
14:24 <+s7r> can i pun ipv6 in server.conf at local ?
14:24 <+s7r> where i currently have the ipv4 address?
14:24 < krzie> you've been asking that for a long time, i must assume you have tried it by now
14:25 < krzie> bbiam from krzee
14:25 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:25 <+s7r> no i didin't because i have to manyy v6 
14:25 <+s7r> scope local link scope global
14:25 <+s7r> a /48
14:25 <+s7r> don't know how to put it and can't find instructions on google
14:26 <+s7r> not much of an openvpn hacker
14:27 < reiffert> s7r: get a openvpn snapshot release, listening on ipv6 is planned for openvpn-2.3 IIRC
14:31 <+s7r> !snapshot
14:31 <+s7r> !snapshots
14:31 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
16:15 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
16:15 -!- mode/#openvpn [+v Axeman] by ChanServ
16:53 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
16:57 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
17:10 <@dazo> krzee: reiffert: if s7r asks the same again ... tell him to use --proto tcp6 or --proto udp6 ... and it *must* be the development version ... 2.2.x and earlier don't support this (well, I believe Debian and/or Gentoo does, but they add this patch additionally)
17:10 < krzee> ahh cool
17:10 < krzee> thanx (on his behalf)
17:10 <@dazo> no worries :)
17:11  * dazo just completed 10 hours merge conflict solving from james' SVN tree against the git tree .... wonder how much he broke along the way
17:12 < krzee> so hes changing to git now!?
17:12  * krzee hands dazo a trophy
17:12 <@dazo> yeah, he is on the way (finally!) ... but I don't know how far he has come yet
17:12 <@dazo> but the job is started according to him
17:13  * dazo hopes the credits on the trophy goes to the active people in the community :)
17:15 < krzee> =]
17:19 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:19 -!- mode/#openvpn [+v Axeman] by ChanServ
17:42 < reiffert> !factoids search --values tcp6
17:42 <@vpnHelper> No keys matched that query.
17:43 < reiffert> !factoids search --values udp6
17:43 <@vpnHelper> No keys matched that query.
17:43 < krzee> !learn listen-ipv6 as use --proto tcp6 or --proto udp6 ... and it *must* be the development version (!snapshots) ... 2.2.x and earlier don't support this
17:43 <@vpnHelper> Joo got it.
17:43 < krzee> !snapshots
17:43 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
17:43 < krzee> cool
17:44 < krzee> and good idea reif =]
17:45 < reiffert> !factoids search --values udp6
17:45 <@vpnHelper> "listen-ipv6" is use --proto tcp6 or --proto udp6 ... and it *must* be the development version (!snapshots) ... 2.2.x and earlier don't support this
17:49 < reiffert> !factoids search --values 6
17:49 <@vpnHelper> 'netman', 'tls-cipher', 'winipforward', 'servercert', 'wintaphide', 'firestarter', 'dns', 'vista', 'qnx', 'win_tcplimit', 'ipv6', 'iphone', 'ldap_iptables', 'script', 'ipv6', 'welcome', 'dlink_static_route', 'static', '1918', 'route_override', 'win7', 'bcast', 'spoonfeeding', '/30', 'tcpip', and 'listen-ipv6'
17:50 < reiffert> !ipv6
17:50 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
17:50 < reiffert> !tcpip
17:50 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
17:50 < reiffert> !/30
17:50 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
17:50 < krzee> not that i care at all, but in case you wanted to know:
17:50 < krzee> !msg
17:50 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key>, or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
17:51 < reiffert> I really like to show others how to use !factoids.
17:52 < reiffert> !iphone
17:52 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries, or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion, or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone, or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN
17:52 <@vpnHelper> for iPhone and iPad.
18:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
19:05 -!- dazo is now known as dazo_afk
19:57 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
20:31 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
20:31 -!- mode/#openvpn [+v Axeman] by ChanServ
22:13 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:20 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:44 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
23:16 < genlime> I need your suggestion.  I have made an executable program under windows that will show the status of my server if online or offline.  What I would like now to achieve to incorporate a free sms to send me an sms about the status of my server.  Any ideas?
23:44 < EugeneKay> Buy an Android.
--- Day changed Mon Jul 25 2011
00:57 < hyper_ch> !howto
00:57 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
01:13 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
02:04 <@vpnHelper> RSS Update - forum: crt zero file size while creating client files on windows <http://forums.openvpn.net/topic8528.html>
03:05 <@vpnHelper> RSS Update - forum: crt zero file size while creating client files on windows <http://forums.openvpn.net/topic8528.html#p13922>
03:15 -!- Cain` is now known as Cain
03:30 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:30 -!- mode/#openvpn [+v s7r] by ChanServ
04:53 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13923>
05:05 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13924>
05:07 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
05:10 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
05:17 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
05:17 -!- mode/#openvpn [+o dazo_afk] by ChanServ
05:26 -!- dazo_afk is now known as dazo
05:48 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
05:48 -!- mode/#openvpn [+v Axeman] by ChanServ
06:16 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:22 <@vpnHelper> RSS Update - forum: Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13925>
06:27 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13926>
06:28 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
06:45 <@vpnHelper> RSS Update - forum: How to prevent warnings --script-security and cache password <http://forums.openvpn.net/topic8529.html> || Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13927>
06:49 -!- dazo is now known as dazo_afk
07:01 -!- dazo_afk is now known as dazo
07:28 <@vpnHelper> RSS Update - forum: How to prevent warnings --script-security and cache password <http://forums.openvpn.net/topic8529.html#p13929>
07:34 <@vpnHelper> RSS Update - forum: RDP "dies" after starting OPVN Service <http://forums.openvpn.net/topic8530.html>
07:40 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13931>
07:40 < genlime> do you have idea on free sms service
07:44 < ecrist> free sms service?
07:44 < ecrist> not really the right place to ask for that.
07:45 < genlime> ecrist: just asking for input, maybe someone may know
07:45 <@vpnHelper> RSS Update - forum: RDP "dies" after starting OPVN Service <http://forums.openvpn.net/topic8530.html#p13932>
07:56 <@dazo> ecrist: if I don't remember very much wrong ... genlime pops in here and asks more unrelated questions than related ones, with the same answer he gave to you if someone comments it
08:01 < ecrist> dazo: that's what I recall, as well.
08:02 -!- Irssi: #openvpn: Total of 154 nicks [4 ops, 0 halfops, 1 voices, 149 normal]
08:02 < ecrist> yeah, my logs seem to indicate the same
08:10 <@vpnHelper> RSS Update - forum: RDP "dies" after starting OPVN Service <http://forums.openvpn.net/topic8530.html#p13933>
08:17 -!- dazo is now known as dazo_afk
08:29 < hyper_ch> krzee: http://www.informationweek.com/news/government/security/231002431
08:29 <@vpnHelper> Title: Not Your Average Linux Distribution: DOD's Flavor -- InformationWeekNot Your Average Linux Distribution: DOD's Flavor - government Blog (at www.informationweek.com)
08:29 < hyper_ch> reiffert: http://www.informationweek.com/news/government/security/231002431
08:40 <@vpnHelper> RSS Update - forum: How to prevent warnings --script-security and cache password <http://forums.openvpn.net/topic8529.html#p13934>
08:46 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13935>
08:47 < amero> uh
08:49 < amero> im trying to connect to a service on my local computer through my local vpn ip, from the public ip of my vpn server
08:50 < ecrist> ok...
08:50 < amero> ive dnat the port to my local vpn ip but it still doesnt work
08:50 < amero> http://pastebin.com/pw3Dan8g
08:52 < amero> any idea?
08:52 <@vpnHelper> RSS Update - forum: RDP "dies" after starting OPVN Service <http://forums.openvpn.net/topic8530.html#p13937> || UDPv4: Connection reset by peer (WSAECONNRESET) <http://forums.openvpn.net/topic8524.html#p13936>
08:53 < amero> i could ping my local vpn ip from the server though
08:57 < ecrist> firewall?
08:58 < amero> it's off
09:02 <@vpnHelper> RSS Update - forum: How to prevent warnings --script-security and cache password <http://forums.openvpn.net/topic8529.html#p13939> || Server Reboot Problem <http://forums.openvpn.net/topic8394.html#p13938>
09:02 < ecrist> is the service listening on the VPN IP?
09:03 < edwin_quijada> Hi!
09:05 < edwin_quijada> ll
09:05 < edwin_quijada> I am trying to connect my Xp client with Linux server but I am getting this error read UDPv4: Connection reset by peer (WSAECONNRESET) 
09:08 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13940>
09:09 < ecrist> sounds like a firewall
09:11 < edwin_quijada> but i dont have firewall in my windows client
09:17 < Dougy> mornin
09:17 < amero> edwin_quijada: try check if openvpn is running on that server
09:18 < edwin_quijada> with ps
09:19 < amero> i had exactly the same error few days ago. when i checked, turned out that my vpn server crashed soon as i connected to it and later i was flooded with that error
09:19 <@vpnHelper> RSS Update - forum: Issue in openvpn client in windows 7 <http://forums.openvpn.net/topic8484-15.html#p13943> || New Global Moderator: george <http://forums.openvpn.net/topic8476.html#p13942> || New Global Moderator: Bebop <http://forums.openvpn.net/topic8488.html#p13941>
09:19 < edwin_quijada> nobody   10136  0.0  0.2   4500  1108 ?        Ss   09:31   0:00 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --daemon ovpn-server --cd /etc/open
09:19 < edwin_quijada> r
09:20 < edwin_quijada> seems it running
09:20 < edwin_quijada> but if I use nmap localhost
09:20 < ecrist> edwin_quijada: most modern versions of windows have a built in firewall
09:20 < edwin_quijada> I dindnt see the 1194 port open
09:21 < edwin_quijada> I turn off the builting fW in windows
09:31 < edwin_quijada> how can I can be sure to openvpn is running ?
09:31 < amero> ecrist: yes, it's listening on vpn ip
09:31 <@vpnHelper> RSS Update - forum: How to prevent warnings --script-security and cache password <http://forums.openvpn.net/topic8529.html#p13945>
09:50 <@vpnHelper> RSS Update - forum: OpenVPN Bridge or OpenVPN in Tunnelling mode <http://forums.openvpn.net/topic8531.html> || How to prevent warnings --script-security and cache password <http://forums.openvpn.net/topic8529.html#p13946>
09:54 < edwin_quijada> My Xp tell me that I connected to my VPN but I dont know how to access resources into my network
09:55 < edwin_quijada> How can I connect to my server in my other network
09:55 < edwin_quijada> I get an IP in my client from my server
09:55 < Bushmills> !route
09:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:55 < Bushmills> !serverlan
09:55 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
10:05 < edwin_quijada> !route
10:05 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:08 < edwin_quijada> How to control the conexion using password. I mean if any person use this machine can connect to my openvpn server ?
10:08 < edwin_quijada> it can be use only with password for comunication?
10:49 -!- AXEMan2 is now known as axeman
11:20 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p13948>
11:26 <@vpnHelper> RSS Update - forum: problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html#p13949>
11:38 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p13950>
12:39 <@vpnHelper> RSS Update - forum: problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html#p13951>
12:46 < Bushmills> edwin_quijada: no.  certified keys, or static keys are possible too
13:21 <@vpnHelper> RSS Update - forum: OpenVPN Bridge or OpenVPN in Tunnelling mode <http://forums.openvpn.net/topic8531.html#p13952>
13:27 < sassan> is it possible to have the server assign clients IP addresses without taking one itself?
13:47 < Bushmills> sassan_: the server doesn't take a client address
13:53 < davidfetter_vmw> !welcome
13:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:54 < davidfetter_vmw> !howto
13:54 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:07 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:33 <@vpnHelper> RSS Update - forum: How to prevent warnings --script-security and cache password <http://forums.openvpn.net/topic8529.html#p13953>
14:57 < bjh4> I have 2 instances of openvpn server running.  Is there a way to get a client from one instance to see a client from the second?
14:57 < Bushmills> yes. route between the two servers
14:58 < Bushmills> !route
14:58 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:58 < bjh4> !route
14:58 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:58 < Bushmills> you essentially want routed a net-to-net setup
14:58 < bjh4> thx Bushmills 
15:02 < bjh4> Bushmills: ha... it was working.  Didn't have a route back on the router of one of the client networks. sweet
15:03 < Bushmills> thanks to krzie, he authored the document
15:07 < krzee> =]
15:07 < Bushmills> he has chosen to call himself krzee today
15:07 < krzee> !blame
15:07 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault, or (#2) According to krzee, it's always dazo's fault
15:08 < Kartagis> what file usually contains post-connection iptables stuff?
15:08 < Bushmills> "usually"?  none
15:09 < krzee> post-connection iptables stuff is the same as pre-connection unless you did something to make it otherwise
15:09 < krzee> unless you're using AS or maybe euphoria
15:09 < krzee> (if you are, please say so)
15:10 < Kartagis> AS?
15:11 < Kartagis> I'm sure I saw some file's name somewhere
15:11 < krzee> access-server, if you have a web interface for something, you're using AS
15:12 < Kartagis> no I'm not
15:13 < Kartagis> could it be the up statement?
15:13 < krzee> sure could be
15:13 < krzee> post your server config
15:17 < Kartagis> http://pastebin.com/178f6ymr
15:17 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
15:29 < Kartagis> krzee: ^^
15:36 -!- davidfetter_vmw is now known as kgrttnr_wscnsnst
15:36 -!- kgrttnr_wscnsnst is now known as davidfetter_vmwa
15:36 -!- davidfetter_vmwa is now known as davidfetter_vmw
15:37 < krzee> you dont have a up statement
15:37 < krzee> or any scripts for that matter
15:37 < krzee> openvpn does not change your firewall by itself, and you have nothing telling it to
15:38 < krzee> so your firewall remains unchanged when running openvpn
15:43 <@vpnHelper> RSS Update - forum: OpenVPN Bridge or OpenVPN in Tunnelling mode <http://forums.openvpn.net/topic8531.html#p13954>
15:45 < Dougy> hi krzee 
15:46 < grendal_prime> hey guys..so if i have a box that is set up to bridge clients to a network, does openvpn act as a switch of sorts?
15:50 < grendal_prime> I've got a situation where some times clients connect and they cannot be reached..even by the server itself.  Eventhough the client is able to get to a machine that is also on the same network and perform its function from another machine we are unable to connect to it untell it pings the second machine
15:50 < grendal_prime> if that makes any sence
15:50 < grendal_prime> soo like this
15:51 < grendal_prime> client-a and client-b both connecte to vpn-1 (that is configured to bridge connections to say 10.10.1.0.)
15:51 < krzee> hey dougy
15:52 < krzee> grendal_prime, sorry to interrupt... you have a layer2 protocol you need to use over the vpn, right?
15:52 < grendal_prime> both connect and both get an ip, i try and ping client-b from client-a and get nothing...then i ping client-a from client-b and wham..everything starts working.
15:52 < krzee> you've been around awhile, so i assume you know the usual rant and do ;]
15:54 < grendal_prime> krzee, ya ya i know i dont like it any more than you do and  i have the fix sitting in a box basically..but this is a thing with these guys.  They have half a dozen other projects so they keep haveing me chase down werid network prolems like this one.
15:54 < grendal_prime> I cant touch the clients...all i can do is mess with the sever for now...but this problem...werid..its like an arp cach is filling up somewhere.
15:55 < krzee> so you're running around sticking gum on the holes in the dam
15:55 < grendal_prime> basically...ya, and they keep giving me more and more gum
15:56 < krzee> well ya, if i remember right now (you jogged my memory)  you have a small broadcast storm going on because your setup is an expanding bridge, and tap doesnt scale well
15:56 < krzee> its only going to get worse really
15:56 < grendal_prime> thing is..if i can prove with this problem that the problem is literally..."two many nodes to deal with"  it might get dev back on the job.
15:57 < krzee> but if you need to, you could force that thing to send a ping upon connecting i guess
15:57 < grendal_prime> ya i know been telling them for how many n=months now?
15:57 < krzee> i mean dont expect clean ways to fix unclean setups :-p
15:57 < krzee> well
15:57 < grendal_prime> im just trying to figer out why this is happening..
15:57 < krzee> its not just the nodes
15:57 < krzee> its a bridge, so its the lans behind the nodes too
15:57 < krzee> every machine in each lan
15:58 < krzee> try hooking them all to a single switch, see what happens
15:58 < krzee> ;]
15:58 < grendal_prime> ya
15:58 < krzee> google broadcast storm, print it out, give to them
15:59 < grendal_prime> basically the arp is never making it to the client-b.  but when client-b arps for client-a it starts working for client-a as well.
15:59 < krzee> or show them where it says on openvpn.net that tap does not scale well
15:59 < krzee> can you give it static arp?
16:00 <@vpnHelper> RSS Update - forum: OpenVPN Bridge or OpenVPN in Tunnelling mode <http://forums.openvpn.net/topic8531.html#p13955>
16:01 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:03 < grendal_prime> they have already seen that...ummm so krzee if we give client-a a static arp entry to client-b  then it does work
16:05 < grendal_prime> the problem is there are 6000+ of these things out there..all using the same key.  So sometimes its a bit tough to find the assigned ip.
16:06 < grendal_prime> we could enable the learning script on the servers if that would help.  But basically what im wondering is....is there a mac/table somewhere on the openvpn server that could be gettting flled or poisened.  The arp table has only 5 entries in it...so im assuming thats not the issue.
16:07 < krzee> well, i wont spend much time figuring out how to fix things the wrong way
16:07 < krzee> its just not how i do things
16:08 < krzee> i understand if your job wont let you do it right... but all i can say to that is:  "that sucks"
16:08 < krzee> and: "better you than me"  ;]
16:09 < grendal_prime> ya i know..and i hate bothering you guys with these issues..but..well just thought different set of eyes. you know
16:09 < krzee> yep
16:09 < krzee> did you say 6000+ devices?
16:09 < krzee> on 1 fucking broadcast domain!?!?
16:09 < grendal_prime> i  wish there was some way of just connecting the tap device to a tunnel on this end..hehehe
16:10 < grendal_prime> ya...they are not all on at one time..they come up..down...
16:10 < krzee> cause if so, i dont understand how its operational
16:10 < krzee> ahh
16:10 < krzee> well ya, you officially have the worst setup ive ever heard of
16:10 < krzee> lol
16:10 < grendal_prime> mostly because 3 vpn servers..load ballanced
16:10 < krzee> sorry ;]
16:10 < grendal_prime> hehehe
16:10 < grendal_prime> ya i know
16:11 < krzee> please tell your boss that hes lucky i dont work there, ild choke him out over that
16:11 < krzee> lol
16:11 < krzee> <-- the local tun_vs_tap nazi
16:17 < davidfetter_vmw> so, i was just in a country with silly internet restrictions, and i got to thinking. bad idea, i know.
16:17 < davidfetter_vmw> is there some way to use openvpn just to have untrammeled internet access, assuming i can actually connect to the box?
16:18 < davidfetter_vmw> the box lives in a country with less-restrictive internets
16:18 < Riz> !def1
16:18 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
16:19 < Riz> just have a vpn server in a non-nazi country and redirect all traffic from your clitn
16:19 < Riz> client*
16:19 < davidfetter_vmw> that's *just* what i want :)
16:19 < Riz> !redirect-gateway
16:20 < krzee> nah just !def1
16:20 < Riz> :(
16:20 < Riz> I thought there was more
16:20 < Riz> meh
16:20 < davidfetter_vmw> is there a step-by-step cookbook for n00bs like myself?
16:21 < krzee> !howto
16:21 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:21 < krzee> or
16:21 < krzee> do you use linux/bsd/unix of some sort?
16:21 < krzee> (osx counts...)
16:21 < davidfetter_vmw> box is fedora (15 atm)
16:21 < davidfetter_vmw> remote is probably osx
16:21 < krzee> Riz, mah you were right
16:21 < krzee> !redirect
16:21 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
16:21 < krzee> lol
16:22 < krzee> ahh ok, you can use my config generator if you like
16:22 < krzee> !confgen
16:22 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
16:22  * davidfetter_vmw takes this all down for later pondering
16:23 < krzee> the config gen will ask you questions
16:23 < krzee> you answer them, it pops out your config files
16:26 < davidfetter_vmw> thanks, krzee :)
16:29 < Riz> theres a config gen......i find this out now.....
16:29 < davidfetter_vmw> hey, i accidentally helped somebody :)
16:29 < davidfetter_vmw> almost as good as doing it on purpose, i suppose...
16:30 < grendal_prime> hey david hows it going?
16:30 < Riz> yeah...but by the time I go to reinstall one of my servers or build a new one, i'll forget about it :P
16:30 < davidfetter_vmw> so, um, given the utility, would this be worth pushing upstream?
16:30 < davidfetter_vmw> can't complain, grendal_prime 
16:31 < grendal_prime> ive built a few of those by the way
16:31 < grendal_prime> i could help ya out with one..although right now im trying to figure out how to deal with a mess ive been handed.
16:32 < grendal_prime> you still doing the database thang?
16:32 < grendal_prime> and when you going to need a personal pilot?
16:36 < krzee> [14:30]  <davidfetter_vmw> so, um, given the utility, would this be worth pushing upstream?  <-- huh?
16:37 < davidfetter_vmw> krzee, i was thinking the configuration generator might want to be part of the upstream package
16:37 < krzee> upstream package...?
16:37 < davidfetter_vmw> the openvpn source
16:37 < krzee> like the openvpn tarball?
16:37 < krzee> ahh ok
16:37 < davidfetter_vmw> yes
16:38 < krzee> not as it stands
16:38 < krzee> maybe they would like to after i rebuild it
16:38 < krzee> i am going to make it also generate certs and all
16:38 < krzee> then it would be a nice optional replacement for easy-rsa
16:38 < davidfetter_vmw> even with heaps of caveats, it'd be handy in its current form
16:38 < krzee> but the devs do know about it, and i released it as public domain
16:39 < krzee> so feel free to do anything you want with/to it
17:24 -!- axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:24 -!- mode/#openvpn [+v axeman] by ChanServ
17:31 < grendal_prime> hey krzee i think we may have figured out our trouble...i have a question about the openvpn-status.log file though
17:32 < grendal_prime> ive got a couple of servers that have only two boxes connected..but each one of those boxes has several entries in the routing table..same ip, different mac address for each entry though.
17:38 <@vpnHelper> RSS Update - forum: "The route addition failed: The object already exists" 7 x64 <http://forums.openvpn.net/topic8527.html#p13956>
17:45 -!- axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:48 < davidfetter_vmw> krzee, do you have a TODO list for this config generator?
17:49 < krzee> ya, its in the comments at the top of it
17:49 < davidfetter_vmw> k
18:04 -!- axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
18:04 -!- mode/#openvpn [+v axeman] by ChanServ
18:20 <@vpnHelper> RSS Update - forum: UDPv4: Connection reset by peer (WSAECONNRESET) <http://forums.openvpn.net/topic8524.html#p13957>
18:30 -!- davidfetter_vmw is now known as guys
18:30 -!- guys is now known as davidfetter_vmw
18:32 <@vpnHelper> RSS Update - forum: VPN with different VPSes <http://forums.openvpn.net/topic8264.html#p13958>
18:42 -!- axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
18:59 -!- [1]SigmaProjects is now known as SigmaProjects
19:00 -!- axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
19:00 -!- mode/#openvpn [+v axeman] by ChanServ
19:12 < rommel092079> what is the name of the php channel guys?
19:13 < jpalmer> rommel092079: I'm going to guess..  #php?
19:14 < rommel092079> jpalmer: it says I must be invited
19:15 < ecrist> rommel092079: try ##php
19:16 < rommel092079> i got it now. my nick must be registered first. thanks guys
19:19 < krzee> from those 2 answers, im once again glad i /ignore webchat users
19:56 < K1ng> freelancer.com stole my $1000 USD. 
20:01 < krzee> sucks for you
20:14 <@vpnHelper> RSS Update - forum: New Global Moderator: Bebop <http://forums.openvpn.net/topic8488.html#p13959>
20:14 < K1ng> its really really sucks
20:14 < K1ng> :(
20:15 < K1ng> its 1k 
20:15 < K1ng> a lot of money
20:26 <@vpnHelper> RSS Update - forum: Strange Connection Issue <http://forums.openvpn.net/topic8497.html#p13961> || Redirect-gateway Reroutes Everything to the Server's IP <http://forums.openvpn.net/topic8467.html#p13960>
20:31 -!- root is now known as e
21:04 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 255 seconds]
21:27 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
21:47 < kerute> hi
21:50 < kerute> my openvpn server is establishing a tunnel with ip 192.168.1.0 and the network i access is 192.168.100.0
21:50 < kerute> do i have to publish a route using dhcp to the 192.168.100.0 network to the route pass by the openvpn server ?
21:51 < kerute> or is there another way ?
21:51 < Bushmills> !route
21:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
21:52 < Bushmills> !serverlan
21:52 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
21:53 < kerute> thanks
22:00 < kerute> !route
22:00 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
22:10 -!- axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:11 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
22:18 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
22:57 <@vpnHelper> RSS Update - forum: Restarted OpenVPN and now no clients can be found <http://forums.openvpn.net/topic8532.html>
22:58 -!- UnterPerro_ is now known as UnterPerro
23:18 -!- patelhome is now known as patelx
23:18 -!- patelx [~a@openvpn/corp/admin/patel] has joined #openvpn
--- Day changed Tue Jul 26 2011
00:04 < riffraff> !goal
00:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:14 <@vpnHelper> RSS Update - forum: Restarted OpenVPN and now no clients can be found <http://forums.openvpn.net/topic8532.html#p13963>
00:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:28 < riffraff> !welcome
00:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:29 < riffraff> !route
00:29 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
01:31 <@vpnHelper> RSS Update - forum: OpenVPN Bridge or OpenVPN in Tunnelling mode <http://forums.openvpn.net/topic8531.html#p13964>
01:31 < K1ng> what is better than freelancer.com
01:32 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
02:01 <@vpnHelper> RSS Update - forum: "The route addition failed: The object already exists" 7 x64 <http://forums.openvpn.net/topic8527.html#p13966>
02:19 <@vpnHelper> RSS Update - forum: Restarted OpenVPN and now no clients can be found <http://forums.openvpn.net/topic8532.html#p13968> || OpenVPN Bridge or OpenVPN in Tunnelling mode <http://forums.openvpn.net/topic8531.html#p13967>
03:09 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:09 -!- mode/#openvpn [+o mattock] by ChanServ
03:16 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
03:16 -!- Cain` is now known as Cain
03:59 -!- d457k is now known as d12fk
05:51 -!- axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
05:51 -!- mode/#openvpn [+v axeman] by ChanServ
06:39 -!- axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
07:15 < genlime> I have a question: I have set my client ip address to 50.8.0.0/20  I got 50.8.0.6 and I can experience that I have excellent network speed.  I tried an account that gave me ip 50.8.4.6 and the connection was bad.  does ip address affects performance?
07:19 < Bushmills> !rfc1918
07:19 <@vpnHelper> RSS Update - forum: OpenVPN Bridge or OpenVPN in Tunnelling mode <http://forums.openvpn.net/topic8531.html#p13969>
07:20 < Bushmills> !1918
07:20 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
07:22 < genlime> bushmills, what do you mean about your reply?
07:22 < ecrist> !/30
07:22 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
07:22 < Bushmills> your subnet choice may cause conflicts with the real owners of those addresses
07:22  * ecrist doubts genlime owns that address space. :D
07:24 < ecrist> it's owned by ClearWire, and they own a /13, not a /20
07:24 < ecrist> American Registry for Internet Numbers NET50 (NET-50-0-0-0-0) 50.0.0.0 - 50.255.255.255
07:24 < ecrist> Clearwire US LLC CLEARWIRE-DNS-NET (NET-50-8-0-0-1) 50.8.0.0 - 50.15.255.255
07:25 < genlime> !topology
07:25 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
07:25 < genlime> no, i dont own such address, i just set it up there
07:25 < Bushmills> that's what the rfc1918 addresses are meant for
07:27 < genlime> how can I make it so that each client will only use one ip and not 4 ips, that clients will have .6 .7 .8 .9 .10 etc
07:27 < Bushmills> !topology
07:27 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
07:27 < ecrist> you just looked at topology...
07:27 < Bushmills> oh. he did.  well, he called up the factoid. whether he read it, one can't say :)
07:29 < genlime> will it not affect my internet connection if I use topology?
07:30 < Bushmills> depends on what you call "affect"
07:31 < Bushmills> generally speaking, openvpn has nothing to do with your internet connection
07:31 < genlime> by "affect", I mean that I will not loose internet connection or slow my internet connection.  Will it not?
07:32 < Bushmills> no, topology by itself will neither do the one nor the other
07:33 < genlime> ok. so I will just add topology subnet on my server config right?
07:36 < genlime> may I ask how may ips will be generated with topology subnet server 10.8.0.0 255.255.255.0 ?
07:37 < ecrist> heh
07:37 < genlime> reply please
07:37 < ecrist> 254
07:38 < ecrist> you're pretty demanding.
07:39 < genlime> ecrist: sorry, its just I have no knowledge about it and this forum is my only source of info aside from googling.
07:40 < genlime> ecrist: one more question please. what if I want to have around 500 ip, what should I use?
07:41 < ecrist> a bigger subnet
07:43 < ecrist> genlime - you need to have a slightly better understanding of networking than you do.
07:43 < ecrist> we're not interested in explaining RFCs to you, especially really basic networking theory
07:43 < ecrist> go do some reading, find out what those numbers mean, specifically subnet masks, etc.
07:44 < ecrist> you really have no business running a 500+ node VPN if you can't decipher our factoids
07:44 < genlime> ok. thanks for assisting me from my questions.
07:52 <@vpnHelper> RSS Update - forum: Restarted OpenVPN and now no clients can be found <http://forums.openvpn.net/topic8532.html#p13970>
07:52 < genlime> ecrist, bushmills, is topology subnet for server option only or should both should have it?
07:54 < genlime> just this last question for today please
07:54 < Bushmills> you'd tell both client and server about topology, but server can push it to client
07:54 < Bushmills> with  mode server,   server does so already automatically
07:54 < genlime> bushmills, thanks
07:55 < genlime> got it
07:56 < ecrist> genlime: just a server option.
08:04 <@vpnHelper> RSS Update - forum: OpenVPN Bridge or OpenVPN in Tunnelling mode <http://forums.openvpn.net/topic8531.html#p13971>
08:11 <@vpnHelper> RSS Update - forum: Restarted OpenVPN and now no clients can be found <http://forums.openvpn.net/topic8532.html#p13972>
08:20 -!- axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
08:20 -!- mode/#openvpn [+v axeman] by ChanServ
08:23 <@vpnHelper> RSS Update - forum: openvpn using http proxy fails to work <http://forums.openvpn.net/topic8533.html>
08:39 < mexx> hi
08:42 < mexx> I was using openvpn to access my company lan from outside but now I need direct access from the same lan to the machine hosting my openvpn server, how can I still access the lan from outside? 
08:44 < ecrist> what?
08:46 <+axeman> if a wood chuck could chuck wood, how much wood would a wood chuck chuck?
08:46 < Kartagis> 25kg
08:46 < ecrist> popsicle
08:46 <+axeman>  banana
08:46 <+axeman> i think these are all valid answers to mexx's question
08:47 < mexx> oh well :) sorry let me rephrase
08:48 < mexx> I use openvpn with routing to access the company lan
08:49 < mexx> so i set up routes from the openvpn host to the lan through another box that does nat
08:50 < mexx> however i now need to ssh from the lan to the openvpn box using another route
08:50 < mexx> oh actually the other box is also an openvpn client
08:51 < Bushmills> your openvpn box has at least 2 ip addresses.  the ethernet and the openvpn subnet address
08:51 < mexx> Bushmills: yes
08:51 < Bushmills> you can use the one or the other addresss
08:51 < mexx> Bushmills: yes
08:51 < mexx> and whenever I come from eth1, packets are directed to tun0
08:52 < mexx> sorry if I'm not clear enough, english is not my mothertongue
08:52 < Bushmills> ehm - you need two different routes to the same machine, depending on the destination port?
08:53 < mexx> hm actually I could use ssh from anywhere
08:53 < Bushmills> it may may be easier to assign an additional ip address to that machine, and route to that address differently 
08:54 < mexx> hm
08:55 < mexx> what were you thinking about otherwise when you mentioned different routes depending on dest port?
08:56 < Bushmills> !factoids search port
08:56 <@vpnHelper> "linportforward" is (#1) to forward port 80 tcp to a vpn client, use this (replacing <SERVERIP> with the real ip of the server, and <VPNIP> with the clients VPN ip), or (#2) iptables -t nat -A PREROUTING -i eth0 -d <SERVERIP> -p tcp --dport 80 -j DNAT --to <VPNIP>, or (#3) iptables -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -i eth0 -p tcp --dport 80 -j ACCEPT
08:56 < Bushmills> not that
08:56 < Bushmills> !factoids search routing
08:56 <@vpnHelper> No keys matched that query.
08:56 < Bushmills> nor that
08:58 < ecrist> !snapshot
08:58 < ecrist> !snapshots
08:58 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
09:25 <@vpnHelper> RSS Update - forum: Restarted OpenVPN and now no clients can be found <http://forums.openvpn.net/topic8532.html#p13974>
09:37 <@vpnHelper> RSS Update - forum: Restarted OpenVPN and now no clients can be found <http://forums.openvpn.net/topic8532.html#p13975>
10:03 < mexx> thanks, bye
10:04 < ecrist> !win7
10:05 <@vpnHelper> "win7" is http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/8a3e9b05-353b-4250-a023-066a085e9657 for a workaround to the windows 7 unidentified network issue you get when using redirect-gateway
10:14 < riffraff> morning
10:16 < riffraff> i have 3 lan networks and vpn server is not on any of the gateways. where must i add the routes?  i can actually ping each gateway from the vpn server.  but i can not ping them from connected vpn client.  I am using tunnel device (tun0), maybe i should be bridging? Or is routing best from my scenerio 
10:21 < riffraff> i'm confised becuase openvpn pushes routes on both sides and i believe this to be configured properly
10:21 < riffraff> cconfised/confused
10:21 < riffraff> !route
10:21 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:24 < riffraff> also I am getting a shitton of  Authenticate/Decrypt packet error: bad packet ID (may be a replay): 
10:24 < riffraff> and my cipher is set coreect on both sides
10:25 < riffraff> cipher AES-256-CBC 
10:38 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:38 -!- mode/#openvpn [+o mattock] by ChanServ
10:56 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:56 -!- mode/#openvpn [+v s7r] by ChanServ
10:59 -!- axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
11:07 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
11:07 -!- mode/#openvpn [+v Axeman] by ChanServ
11:18 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
12:00 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
12:00 -!- mode/#openvpn [+v Axeman] by ChanServ
12:00 <@vpnHelper> RSS Update - forum: openvpn using http proxy fails to work <http://forums.openvpn.net/topic8533.html#p13976>
12:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
13:00 <@vpnHelper> RSS Update - forum: Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html>
13:18 < Bushmills> !serverlan
13:18 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
13:19 < Bushmills> riffraff: ^^^
13:30 <@vpnHelper> RSS Update - forum: Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html#p13978>
13:36 <@vpnHelper> RSS Update - forum: Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html#p13979>
13:38 -!- patelx [~a@openvpn/corp/admin/patel] has quit [Ping timeout: 255 seconds]
13:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:54 <@vpnHelper> RSS Update - forum: Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html#p13980>
13:59 <@vpnHelper> RSS Update - forum: Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html#p13981>
14:00 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
14:06 <@vpnHelper> RSS Update - forum: Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html#p13982>
14:22 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
14:30 <@vpnHelper> RSS Update - forum: Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html#p13983>
14:42 <@vpnHelper> RSS Update - forum: Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html#p13984>
14:47 <@vpnHelper> RSS Update - forum: Losing Static Routes After Restarting OpenVPN - CENTOS <http://forums.openvpn.net/topic8535.html> || Hello <http://forums.openvpn.net/topic8425.html#p13987> || problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html#p13986> || Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html#p13985>
14:51 -!- CrazyGir is now known as Guest40059
15:00 <@vpnHelper> RSS Update - forum: Windows Server 2003 + VirtualBox + OpenVPN = No RDP <http://forums.openvpn.net/topic8534.html#p13989>
15:06 <@vpnHelper> RSS Update - forum: Losing Static Routes After Restarting OpenVPN - CENTOS <http://forums.openvpn.net/topic8535.html#p13991> || problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html#p13990>
15:17 <@vpnHelper> RSS Update - forum: Need Help unable to connect my openvpn with my home DHCP <http://forums.openvpn.net/topic8486.html#p13993> || remapping of special characters <http://forums.openvpn.net/topic8482.html#p13992>
15:18 < GNUtoo|irssi> hi,
15:18 < GNUtoo|irssi> I launch openvpn on both sides
15:18 < GNUtoo|irssi> I can ping each sides
15:18 < GNUtoo|irssi> so it works
15:19 < GNUtoo|irssi> but when I start using firefox on the client
15:19 < GNUtoo|irssi> it breaks the connection
15:19 < GNUtoo|irssi> the client then ctrl+c openvpn and restart the connection and the server can be pinged again
15:19 < snappy> so initiating firefox kills the vpn?
15:19 < GNUtoo|irssi> and when I use firefox again it breaks
15:20 < GNUtoo|irssi> yes
15:20 < GNUtoo|irssi> not exactly starting it
15:20 < GNUtoo|irssi> but trying to load a page with it
15:21 < GNUtoo|irssi> the vpn is a tap+tcp connection
15:21 < snappy> so, if you have a continuous ping to other openvpn endpoint running in the backround; open up firefox, laod a page, the continuous ping breaks, the vpn is torn down?
15:21 < GNUtoo|irssi> yes
15:22 < GNUtoo|irssi> and when I stop the page loading the ping still doesn't work
15:22 < GNUtoo|irssi> so it breaks it permanently
15:22 < GNUtoo|irssi> until when I restart the client's vpn
15:22 < snappy> no idea.
15:22 < GNUtoo|irssi> that renders the vpn unusable
15:23 < GNUtoo|irssi> I've dev tap,tcp,server bridge
15:23 < GNUtoo|irssi> usually the mtu is for udp right?
15:23 < GNUtoo|irssi> I've tried mtu 1492
15:23 < GNUtoo|irssi> and mtu 500
15:24 < GNUtoo|irssi> with that param:
15:24 < GNUtoo|irssi> --link-mtu
15:24 < GNUtoo|irssi> it didn't change a thing
15:24 < GNUtoo|irssi> also since all the UDP ports are blocked
15:24 < GNUtoo|irssi> on the client side
15:25 < GNUtoo|irssi> I cannot use UDP
15:25 < GNUtoo|irssi> I guess I cannot use tun either because of the fact that I cannot use UDP
15:25 < GNUtoo|irssi> even port 53 is blocked in UDP!
15:25 -!- CrazyGir_ is now known as Guest62894
15:26 < reiffert> GNUtoo|irssi: 
15:26 < reiffert> !tunortap
15:26 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
15:26 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
15:26 < reiffert> !mtu
15:26 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
15:26 < reiffert> !tcp
15:26 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer), or (#3) if you must use tcp, you likely want --tcp-nodelay
15:27 < GNUtoo|irssi> yes I want tun
15:27 < GNUtoo|irssi> I didn't succeed with tun tough
15:27 < GNUtoo|irssi> I'll read all theses advises
15:27 < reiffert> !route
15:27 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:27 < reiffert> !def1
15:27 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
15:29 < GNUtoo|irssi> ok,thanks a lot
15:31 < reiffert> welcome
15:32 < krajo1> konstatocání
15:32 -!- Guest62894 is now known as CrazyGir
15:32 < krajo1> srry
15:38 < krajo1> hello, i have a little problem.
15:38 < krajo1> openvpn starts, i received corect IP, DNS, route table, create tap0. But i cant ping anywhere
15:38 < krajo1> logs http://pastebin.blesmrt.net/index.php/view/56143290
15:38 < krajo1> config http://wifigw.cis.vutbr.cz/vpn/sw/config/
15:38 <@vpnHelper> Title: Index of /vpn/sw/config (at wifigw.cis.vutbr.cz)
15:42 < GNUtoo|irssi> I added that to the server config: tcp-nodelay
15:42 < GNUtoo|irssi> and the problem still persists
15:42 < GNUtoo|irssi> I'll try again to get tun working
15:43 < GNUtoo|irssi> and mtu-test is useless without UDP
15:43 < reiffert> crap
15:43 < GNUtoo|irssi> since I seem to fail at finding an open UDP port...
15:44 < GNUtoo|irssi> how can I have TUN without UDP?
15:45 < |Mike|> !tunortap
15:45 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
15:45 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
15:46 < GNUtoo|irssi> I'll stop using ping
15:46 < GNUtoo|irssi> maybe it's the ping that is the problem
15:52 < reiffert> crap
16:13 < GNUtoo|irssi> I cannot ping each other with tun+tcp now
16:15 < |Mike|> *sigh*
16:20 < GNUtoo|irssi> I have TUN
16:20 < GNUtoo|irssi> but I cannot ping each other
16:21 < GNUtoo|irssi> I'm trying to configure the tun interface
16:21 < GNUtoo|irssi> but I fail
16:23 < |Mike|> but you can ssh to it? ;)
16:25 < snappy> GNUtoo|irssi: paste your configs of both client and server somewhere.
16:27 < GNUtoo|irssi> I've simplified my configs
16:27 < GNUtoo|irssi> and I can now ping
16:27 < GNUtoo|irssi> I'll do the routing etc...by hand
16:28 < GNUtoo|irssi> and then trough openvpn when it will work
16:30 < GNUtoo|irssi> it's not that I don't want to paste the config,but the problem is that I'm on console trough ssh
16:31 < GNUtoo|irssi> that's how I connect to irc
16:34 < GNUtoo|irssi> now it works...and does exactly the same
16:34 < GNUtoo|irssi> firefox makes the connection break
16:34 < GNUtoo|irssi> how can I pastebin trough shell only?
16:38 < GNUtoo|irssi> I've an idea, I'll host the configs
16:41 < GNUtoo|irssi> http://gnutoo.homelinux.org/downloads/openvpn/
16:41 <@vpnHelper> Title: Index of /downloads/openvpn (at gnutoo.homelinux.org)
16:41 < GNUtoo|irssi> here are the client and server configs
16:48 < GNUtoo|irssi> maybe I should look at tcp fragmentation settings?
16:53 < snappy> are you looking at your logs?
16:53 < snappy> you should setup some logging 
16:53 < GNUtoo|irssi> is verb 4 sufficent?
16:53 < GNUtoo|irssi> I'm trying verb 10 right now
16:53 < GNUtoo|irssi> because verb 4 says nothing more when the connection break happens
16:57 < reiffert> crap
16:57 -!- patelx [~a@openvpn/corp/admin/patel] has joined #openvpn
16:57 < reiffert> !factoids search verb
16:57 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info, or (#2) verb 5 is good for debugging, verb 3 is good for normal usage
17:07 < GNUtoo|irssi> Wed Jul 27 00:01:20 2011 us=721946 I/O WAIT TR|Tw|SR|Sw [15/75187]
17:07 < GNUtoo|irssi> it's blocked on that
17:07 < GNUtoo|irssi> (the server)
17:08 < GNUtoo|irssi> sometimes it advance
17:08 < GNUtoo|irssi> but it doesn't seem to have a lot of activity
17:08 < GNUtoo|irssi> but the client do have a lot of activity
17:09 < riffraff> hey i'm trying to assign a network to each client per ccd, how does the openvpn know which cert goes with which iroute statement file.  It says in the doc by 'common name'.  is this the name of the cert when generated or is this one of the cert lines.
17:10 < GNUtoo|irssi> tough killing the server makes a lot of noise and the client notify that
17:19 < GNUtoo|irssi> I'll try with another wireless card
17:20 <@vpnHelper> RSS Update - forum: OpenVPN Install Guides <http://forums.openvpn.net/topic2.html#p13994>
17:22 < grendal_prime_> oI!!
17:23 < grendal_prime_> so...i have two tap's set up on one machine.  is it possible to take just one of them down?
17:23 < grendal_prime_> i though --rmtun ..but that looks more like something that will keep the tunnel down over a reboot.
17:30 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
17:33 < reiffert> riffraff: 
17:33 < reiffert> !ccd
17:33 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
17:33 < reiffert> !static
17:33 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
17:34 < riffraff> what is common-name
17:35 < riffraff> is that one of the names in the cert? or the cert name
17:35 < grendal_prime_> the generated cert name
17:35 < riffraff> i'm guessing thats how it matches the cleint with the file in ccd
17:35 < riffraff> ok thanks
17:36 < grendal_prime_> like if you make a cert bobs-vpn-cert  and thats what it connects with..you will need a file in the ccd file called bobs-vpn-cert
17:37 < grendal_prime_> even if you rename the file..of course the contents of the will still connect as bobs-vpn-cert
17:37 < grendal_prime_> goty?
17:52 < GNUtoo|irssi> so what should I do now?
17:52 < GNUtoo|irssi> I changed wireless card
17:52 < GNUtoo|irssi> and still the same issue
17:52 < GNUtoo|irssi> so it's not the wireless card
17:53 < reiffert> !configs
17:53 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:53 < reiffert> !logs
17:53 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:53 < GNUtoo|irssi> I already pasted a link to the configs
17:53 < GNUtoo|irssi> what loglevel should I pastebin?
17:54 < GNUtoo|irssi> 5?
17:54 < GNUtoo|irssi> 10?
17:54 < reiffert> !logs
17:54 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:54 < GNUtoo|irssi> ah set to 5
17:54 < GNUtoo|irssi> sorry it's because it's very late here
17:55 < reiffert> same time here.
18:05 < reiffert> cant be that hard putting logs somewhere. bbl.
18:41 < genesis_> openvpn 891/10953Segmentation Fault when I yum install openvpn.  how can we solve this?
18:45 <@vpnHelper> RSS Update - forum: Error on installing openvpn package <http://forums.openvpn.net/topic8536.html>
18:59 < genesis_> I need help please
19:00 < genesis_> segmentation fault when install openvpn
19:00 < genesis_> please please please 
19:02 < genesis_> I need help please
19:03 < pwrcycle> !dns
19:03 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
19:03 < genesis_> I need help please
19:03 < pwrcycle> !pushdns
19:03 < genesis_> segmentation fault when install openvpn
19:03 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
19:03 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
19:03 < genesis_> please please please 
19:04 < genesis_> help please
19:05 < pwrcycle> genesis_: what OS?
19:05 < genesis_> centos 5
19:06 < EugeneKay> Are you nstalling from source?
19:06 < EugeneKay> EPEL has prebuilt packages.
19:06 < genesis_> I use yum install openvpn
19:06 < EugeneKay> If there's a segfault during the yum install, that's a yum issue, not openvpn.
19:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
19:07 < genesis_> yum issue? ok. what can I do? where should I ask this problem properly?
19:07 < EugeneKay> #centos would be the right place, but they are...... mental.
19:08 < genesis_> mental?
19:08 < pwrcycle> genesis_: are you on 64bit processor?
19:08 < genesis_> 32bit
19:09 < genesis_> Is there other way to install openvpn on centos aside from using yum install openvpn?
19:11 < pwrcycle> i use the epel repo when i install.
19:12 < pwrcycle> !goal i want to specify the DNS server in the client config
19:13 < genesis_> pwrcycle: what is epel repo and how to use it to install openvpn?
19:15 < genesis_> pwrcycle: is it fedora os?
19:16 < pwrcycle> genesis_: for instance: http://techspotting.org/install-epel-repo-centos-rhel/
19:16 <@vpnHelper> Title: Install EPEL Repo CentOS RHEL | TechSpotting (at techspotting.org)
19:16 < pwrcycle> genesis_: 
19:16 < pwrcycle> genesis_: http://fedoraproject.org/wiki/EPEL
19:16 <@vpnHelper> Title: EPEL - FedoraProject (at fedoraproject.org)
20:01 < riffraff> centOS is a good choice, dag repo also has openvpn
20:02 < riffraff> so you can just 'yum install openvpn'
20:02 < riffraff> oh i guess he left
20:07 -!- [stack]dump is now known as ShadowN1ggerShru
20:07 -!- ShadowN1ggerShru is now known as [stack]dump
20:11 < [stack]dump> wtf.. #c #c++ are all invite only all of a sudden.
20:25 < ecrist> try registering...
20:52 < teaforthecat> hi I have my openvnc client connection established to a openvnc server, how can I pipe all traffic through it? how can If everything already is?  
20:53 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
20:53 -!- mode/#openvpn [+v Axeman] by ChanServ
20:54 < teaforthecat> sorry- how can I tell if everything is going through an established connection?
21:00 < teaforthecat> there is an ip address that I can only connect to from the 'mothership'. I have an established connection at home, I am the "working" sysadmin.  what is the server.conf setting to allow a connection to an ip that is firewalled to the outside world? - thanks
21:00 < teaforthecat> should I show my conf files?
21:08 < teaforthecat> here is my server conf: https://gist.github.com/1108512 and client conf: https://gist.github.com/1108515
21:08 <@vpnHelper> Title: teaforthecat's gist: 1108512 Gist (at gist.github.com)
21:11 < teaforthecat> My only goal is to connect to a firewalled ip instead of an ssh-tunnel
21:18 < teaforthecat> the company sysadmin offered cisco licences, but that is lame. am i right?
21:25 < jpalmer> cisco vpn works pretty well, actually.  why is it "lame"?
21:30 < teaforthecat> because it is in the browser only,
21:30 < teaforthecat> I would prefer to use native apps
21:31 < jpalmer> so in the cisco client,  configure it to route all traffic
21:32 < jpalmer> if that isn't possible,  mention it to your sysadmin,  because they would have had to specifically disable that functionality.  which tells me they wouldn't want you doing it with or without the cisco vpn
21:33 < teaforthecat> hmmm, well I understand that the cisco service only publishes specific apps or a vnc, am I wrong?
21:34 < jpalmer> depends on the product.  but you said cisco vpn.
21:35 < teaforthecat> oh, I am sorry. I will follow up with the sysadmin about that.
21:35 < jpalmer> probably wise.   the cisco vpn can definately support redirecting the gateway.
21:42 < teaforthecat> otherwise openvpn seams like great software, but it is over my head as a developer
21:42 < teaforthecat> thanks for the help
22:05 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:05 <@vpnHelper> RSS Update - forum: Restarted OpenVPN and now no clients can be found <http://forums.openvpn.net/topic8532.html#p13996>
22:21 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
22:42 <@vpnHelper> RSS Update - forum: OpenVPN Install Guides <http://forums.openvpn.net/topic2.html#p13997>
23:17 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
23:17 -!- mode/#openvpn [+v Axeman] by ChanServ
23:33 < okok> anyone care to help? http://pastebin.com/hXsVUrjg
23:33 < okok> oh
23:33 < okok> i fail \:
23:34 < okok> did not see the port lol
23:45 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
--- Day changed Wed Jul 27 2011
00:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:57 < sonto_lau> hi all: can the openvpn client connect the server without certificate and key?
01:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
02:18 <@vpnHelper> RSS Update - forum: Error on installing openvpn package <http://forums.openvpn.net/topic8536.html#p13999> || OpenVPN Bridge or OpenVPN in Tunnelling mode <http://forums.openvpn.net/topic8531.html#p13998>
02:24 <@vpnHelper> RSS Update - forum: Error on installing openvpn package <http://forums.openvpn.net/topic8536.html#p14000>
02:25 < genesis_> help please on my error on installing openvpn. http://forums.openvpn.net/topic8536.html#p14000
02:25 <@vpnHelper> Title: OpenVPN Support Forum Error on installing openvpn package : Installation Help (at forums.openvpn.net)
02:25 < genesis_> I am using centos
02:25 < genesis_> please help me
02:35 < antminds> hello
02:35 < antminds> i need help to install openvpn with webmin on CentOS Xen
02:35 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14001>
02:54 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14002>
03:00 < antminds> i need help to install openvpn with webmin on CentOS Xen
03:00 < reiffert> antminds: try to repeat your question more often.
03:00 < antminds> huh
03:00 < reiffert> huh
03:04 < antminds> who can help me?
03:04 < reiffert> The CentOS Xen and webmin guys?
03:08 < Bushmills> a consultant?
03:08 < Bushmills> they'll get paid for figuring out what the kind of help you need might be
03:10 < style> Hi, any ideas why authentication to openVPN "server" works, but i.e. ping doesn't? (It worked yesterday just fine -.-)
03:11 < Bushmills> firewall, or route
03:11 < style> it's not firewall thats im sure
03:11 < style> route mayb in server end
03:11 < style> but I don't know how to start debugging it :|
03:12 < Bushmills> well.. you look at them
03:12 < reiffert> network packet dumper. Wireshark on Windows, tcpdump on Unix
03:12 < amero> style: ping from where to where?
03:13 < reiffert> from source to destination
03:13 < reiffert> (normally)
03:13 < style> amero: from client->server (internal address on server) or server->client (internal also)
03:13 < Mowee> Morning
03:14 < Bushmills> style: make also sure that option comp-lzo  is en- or disabled on both server and client
03:15 < reiffert> style: try to ping the openvpn servers address from your openvpn client. works?
03:15 < style> Bushmills: wierdest thing is that it worked yesterday and no changes to any configs has been made
03:15 < Bushmills> though the logs would have said something about that - you *did* look at the logs, right?
03:15 < style> Bushmills: yes, I can see that authentication works
03:15 < style> and client gets an IP
03:15 < reiffert> style: try to ping the openvpn servers address from your openvpn client. works?
03:15 < style> reiffert: if I ping public address it works
03:16 < style> internal not
03:16 < reiffert> what's internal to your terms?
03:16 < style> our LAN network
03:16 -!- Cain` is now known as Cain
03:16 < reiffert> then start reading the next line:
03:16 < reiffert> style: try to ping the openvpn servers openvpn openvpn openvpn address from your openvpn client.
03:17 < style> If I understand that correctly it doesn't work
03:17 < style> it says host unreachable
03:17 < reiffert> !logs
03:17 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
03:18 < Bushmills> windows client?
03:18 < style> yes
03:18 < Bushmills> !winroute
03:18 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
03:18 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
03:18 < reiffert> Bushmills: pinging the openvpn server's internal address doesnt require anything
03:19 < Bushmills> it needs a route on client to the vpn interface
03:19 < reiffert> thats correct, I am asuming his openvpn connection to work properly, but let's wait for the logs
03:20 < reiffert> guess he didnt start the GUI as admin.
03:22 < style> server log is http://paste.servut.us/plain/ohha
03:22 < style> (dunno what thar RW shit is in the log)
03:25 < Bushmills> those are directional indicators,  for "right" and "wleft"
03:26 < style> client http://paste.servut.us/plain/0jpi and routes http://paste.servut.us/plain/ic0a
03:26 < reiffert> Wed Jul 27 11:19:45 2011 ERROR: Windows route add command failed [adaptive]: returned error code 1
03:26 < reiffert> Wed Jul 27 11:19:45 2011 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied.   [status=5 if_index=13]
03:27 < reiffert> style: close the connection, close the GUI and start the GUI with admin rights and you are done.
03:27 < style> reiffert: but it is still creates those routes :<
03:27 < reiffert> do as I say.
03:28 < style> had no effect
03:28 <@vpnHelper> RSS Update - forum: Error on installing openvpn package <http://forums.openvpn.net/topic8536.html#p14004> || Strange Connection Issue <http://forums.openvpn.net/topic8497.html#p14003>
03:29 < style> except that those errors dissapeared from log
03:29 < reiffert> send send recent client logs
03:29 < reiffert> then fix:
03:29 < reiffert> WARNING: potential TUN/TAP adapter subnet conflict between local LAN [10.0.0.0/255.255.255.0] and remote VPN [10.0.0.0/255.255.255.0]
03:30 < style> yes I know
03:30 < reiffert> "it worked yesterday and we didnt change anything"
03:30  * reiffert gets lost
03:30 < style> thats true!
03:31 < defswork> tcp packets can get moody and go different ways on their own back
03:31 < style> http://paste.servut.us/plain/du87
03:31 < style> lates log
03:32 < reiffert> change the server line in the server config
03:33 < reiffert> from 10.0.0.0 to 10.8.0.0
03:33 < reiffert> then restart server, client, put the client log online afterwards
03:36 < style> I've server-bridge, should I change it instead?
03:36 < reiffert> no.
03:36 < style> remove it?
03:37 < reiffert> no.
03:37 < reiffert> try
03:37 < style> because this says Options error: --server and --server-bridge cannot be used together
03:37 < reiffert> ping 10.0.0.200
03:37 < reiffert> dont change anything about your setup then please.
03:39 < style> ok well should I ping 10.0.0.200 on my client?
03:40 < reiffert> right
03:41 < style> it says "Request timed out."
03:44 < reiffert> is 10.0.0.200 a maschine from your local network or a maschine on the remote network?
03:44 < reiffert> sorry, I got to go, customer's callig
03:45 < style> it's machine in remote network 
03:51 <@vpnHelper> RSS Update - forum: OpenVPN newbie question <http://forums.openvpn.net/topic8537.html>
04:03 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html>
04:09 <@vpnHelper> RSS Update - forum: OpenVPN newbie question <http://forums.openvpn.net/topic8537.html#p14007>
04:33 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14008>
04:33 < snappy> Trying to configure openvpn on a centos machine; user/group nobody, listening on an ip, and port 8080. For some reason I'm getting socket bind failes on local address <IP>:23: Permission denied
04:34 < snappy> my understanding is it binds to the socket first before dropping down to the user
04:34 < snappy> but that doesnt even matter since 8080 > 1024.
04:34 < snappy> hm, might be an selinux thing
04:35 < snappy> hah, of course, selinux, completly forgot about that.
04:39 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 258 seconds]
05:15 <@vpnHelper> RSS Update - forum: OpenVPN newbie question <http://forums.openvpn.net/topic8537.html#p14009>
05:42 < bmflavio> !welcome
05:42 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:43 < bmflavio> !goal
05:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:43 < bmflavio> !goal setup a vpn bridge
05:44 < bmflavio> !interface
05:44 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
05:44 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:48 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
05:48 -!- mode/#openvpn [+v Axeman] by ChanServ
05:54 < bmflavio> hello, i've configured a bridge mode vpnserver. clients connect successfully and devices seem to be correctly created. but only ARP packets are being able to pass (arping to any host on the server network), TCP and ICMP packets have no reply.
05:55 < bmflavio> perhaps some of you could help me finding out what the problem might be? i see no errors both in server or client logs
05:55 < bmflavio> routes (ip, mask and interface) are correctly listed on server and client.
05:57 < bmflavio> !interface
05:57 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
06:00 < krzee> bmflavio, why bridge?
06:00 < bmflavio> wanted seamless integration with samba services..
06:00 < krzee> !wins
06:00 < bmflavio> its a small network, with 4 windows pcs and a linux server
06:00 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
06:01 < bmflavio> you suggest routed vpn with a wins server?
06:09 <@vpnHelper> RSS Update - forum: OpenVPN newbie question <http://forums.openvpn.net/topic8537.html#p14010>
06:21 < krzee> bmflavio, i do
06:21 < krzee> in fact:
06:21 < krzee> !tunortap
06:21 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
06:21 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
06:22 < krzee> #2 -[
06:22 < krzee> i mean, #2 =]
06:22 -!- nuttersppadic is now known as sppadic[A]
06:22  * sppadic[A] is now away - Reason : lunchtime
06:23 < bmflavio> krzee, i'm chaning the configuration files to connect with routed-vpn. thank you!
06:23 < krzee> np
06:25 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:29 < bmflavio> !firewall
06:29 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
06:51 -!- dazo_afk is now known as dazo
07:46 -!- sppadic[A] is now known as nuttersppadic
07:46  * nuttersppadic is no longer away : Gone for 1 hour 23 minutes 35 seconds
07:57 < Dougy> hello
08:03 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14011>
08:16 < reiffert> style: any update?
08:17 < amero> after you generated keys for clients, does server have or keep the record of clients it has generated keys for
08:17 < style> reiffert: still not working :/ I've no idea what's wrong
08:17 < ecrist> amero: the openvpn process doesn't really care
08:18 < ecrist> if you want to revoke a certificate, you need the crt around, though
08:18 < ecrist> that's all handled outside openvpn
08:18 < ecrist> !ssl-admin
08:18 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
08:18 < amero> ca's crt?
08:18 < ecrist> no, the certificate you'd want to revoke.
08:22 < amero> that needs me to keep a copy of client's crt. so what if i don't have their crt?
08:22 < ecrist> you can't revoke it, then.
08:23 < ecrist> you don't need their key, just the crt
08:23 < amero> yup
08:23 < ecrist> ssl-admin handles saving and storing, and even packaging zip files for openvpn
08:27 < amero> i'm taking a look at it
08:40 <@dazo> ecrist: how's your rewrite of ssl-admin going?
08:41 < ecrist> it's not
08:41 < ecrist> it's summer time
08:41 < ecrist> heh, I've been 'working' on rolling the forum to vB for months now
08:44 < Kartagis> even though I have openvpn authenticate against LDAP, are certificates still a must?
08:47 < reiffert> !factoids search user
08:47 <@vpnHelper> No keys matched that query.
08:47 < reiffert> !factoids search auth
08:47 <@vpnHelper> 'authpass' and 'tls-auth'
08:47 < reiffert> !authpass
08:47 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs, or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required, or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
08:48 < Kartagis> !ldap
08:48 < reiffert> !factoids search ldap
08:48 <@vpnHelper> "ldap_iptables" is see http://planetjoel.com/viewarticle/638/OpenVPN%3A+Dynamically+create+IPtables+rules+based+on+LDAP+group+membership for a cool script for setting iptables rules based on LDAP membership (currently only handles TCP rules, but an easy fix to support UDP)
08:48 <@dazo> ecrist: :)  okay, I was just curious
08:48 < reiffert> !factoids search --values ldap
08:48 <@vpnHelper> "ldap_iptables" is see http://planetjoel.com/viewarticle/638/OpenVPN%3A+Dynamically+create+IPtables+rules+based+on+LDAP+group+membership for a cool script for setting iptables rules based on LDAP membership (currently only handles TCP rules, but an easy fix to support UDP)
08:49 <@dazo> Kartagis: Try this one: https://community.openvpn.net/openvpn/wiki/RelatedProjects#Authentication
08:49 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
08:51 < Kartagis> wha? there's also a mysql auth?
08:51 < Kartagis> yay!
08:51 <@dazo> Kartagis: its a while since I looked at that one ... but I'm not sure how stable it is
08:52  * dazo would probably say LDAP > mysql currently
08:52 < Kartagis> dazo: I already have a mysql server. do you think it's worth to try and setup an ldap server or should I use mysql?
08:53 <@dazo> Kartagis: Let me just have a quick look at the code ... I think I thought of another mysql project which was horrid ... this one seems better, but just want to be sure
08:54 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
08:54 -!- mode/#openvpn [+v Axeman] by ChanServ
08:55 <@dazo> Kartagis: this version (on redmine.debuntu.org) is much better ... if you already have MySQL but not LDAP, go for this module 
08:56 <@dazo> Kartagis: however, you might need to kick out quite some dump_env() calls from mysql-auth.c ... to not flood the log files too much
08:57 < reiffert> why not pam -> ldap -> mysql?
08:57 < reiffert> there is -> pam
08:57 <@dazo> reiffert++
08:57 < Kartagis> reiffert: I don't want system user accounts
08:57 < reiffert> Kartagis: there is no need to.
08:57 < Kartagis> I want them only for web hosting
08:58 < Kartagis> really?
08:58 < reiffert> pam can be configured to auth against everything.
08:58 < reiffert> so is pam -> ldap, and so is ldap -> myql
08:58 < reiffert> what you might want is a key:value table somewhere, key might be usernames, values might be passwords.
09:00 <@dazo> Kartagis: if you don't want a centralised database for authentication (which I presumed when you said LDAP and/or mysql) ... you can also checkout my own project, eurephia ... it uses sqlite3 under the hood now (but working on support PostgreSQL in addition, MySQL is in the pipe too)
09:00 <@dazo> !eurephia
09:00 <@vpnHelper> "eurephia" is http://www.eurephia.net/
09:00 < reiffert> I'd go with dazo (when pam fails)
09:29 < Vix-ACIS> Hello room
09:30 < Vix-ACIS> Are there any OpenVPN employees here?
09:32 < reiffert> Vix-ACIS: yes.
09:34 < ecrist> Vix-ACIS: if you're looking for access-server...
09:34 < ecrist> !as
09:34 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:34 < Vix-ACIS> Hi. Its for assistance in the ordering of licences. We have placed orders via sales@openvpn.net and have not recieved them....
09:35 < ecrist> join access-server channel, please
09:35 < Vix-ACIS> Cool ok. Thanks
09:48 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
09:48 < hyper_ch> krzee: Bushmills: dazo: http://www.theregister.co.uk/2011/07/27/chip_crypto_cracked/
09:48 <@vpnHelper> Title: Military chip crypto cracked with power-analysis probe • The Register (at www.theregister.co.uk)
09:50 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
09:50 -!- mode/#openvpn [+v Axeman] by ChanServ
09:50 <@dazo> once again a proof that encryption will never be safe forever ... sooner or later somebody shows up with a strong enough computer to decrypt your secrets
09:50 < hyper_ch> dazo: you already read it?
09:51 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:51 <@dazo> hyper_ch: just now
09:51 < hyper_ch> dazo: you're a fast reader :)
09:51 < hyper_ch> one comment is interesting
09:51 < hyper_ch> "...this attack could be defeated by telling the crypto chip to do random math while it works? Maybe have a second, very small slice of silicon in the package, attached to the same power pins, continually producing pseudorandom numbers seeded from a leaky diode/reverse biased transistor?"
09:53 <@dazo> that's an interesting concept ... but it will just prolong the cracking time ... not make you get rid of the potential crack in the future
09:53 < hyper_ch> :)
09:55 <@dazo> encryption is just to make you protect the data *while* it is sensitive ... so if the data is irrelevant in a day or two ... weaker encryptions is just as safe as strong ones ... while if you need years of security, you need to stay top-notch constantly, and most likely need to re-encrypt sensitive stored data
09:56 <@dazo> which makes VPN an interesting thing ... as you never knows if somebody stores your communication ...
10:00 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
10:13 -!- Bushman [bushman@91.146.248.112.ip.abpl.pl] has joined #openvpn
10:13 < Bushman> hi
10:14 < Bushman> !welcome
10:14 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:14 < Bushman> !howto
10:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:21 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 246 seconds]
10:23 <@dazo> hyper_ch: another security story ... http://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants ;-)
10:23 <@vpnHelper> Title: Our security auditor is an idiot, how do I give him the information he wants? - Server Fault (at serverfault.com)
10:26 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
10:51 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:51 -!- STF [~chatzilla@dslb-188-101-249-120.pools.arcor-ip.net] has joined #openvpn
10:52 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
11:03 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:11 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has joined #openvpn
11:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:15 -!- sppadic_ [~IceChat77@193.130.68.17] has quit [Quit: IceChat - Keeping PC's cool since 2000]
11:24 < hyper_ch> dazo: the guy posting there should just have asked that this security auditor provides him a (bash) script to get the required info. I mean the auditor says it's "incredibly easy to get that info" so it should be incredibly easy to write an according script to pull that info
11:25 <@dazo> hehe ... yeah
11:28 -!- Qutza [~user@78-86-11-213.zone2.bethere.co.uk] has joined #openvpn
11:28 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:28 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 258 seconds]
11:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
11:34 < hyper_ch> dazo: http://www.wtfnoway.com/
11:34 <@vpnHelper> Title: A visualization of US debt (credit card bill) stacked in 100 dollar bills (at www.wtfnoway.com)
11:35 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
11:35 <@dazo> heh
11:35 <@dazo> that's f*cked up
11:35 < hyper_ch> must have the WTC tower money pile
11:36 <@dazo> :)
11:40 -!- bmflavio [~bmflavio@bl16-158-52.dsl.telepac.pt] has joined #openvpn
11:40 <@dazo> hyper_ch: tbh ... I wouldn't complain even if all I got was a ISO / Military standard sized pallet ... 
11:40 < bmflavio> !firewall
11:40 < hyper_ch> :)
11:40 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
11:42 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
11:45 < bmflavio> hello, i was here before today searching help with the fact that my bridged vpn only let arp packages through, and you've shown me that a routed vpn was a better solution. i've changed the configuration for such, but i'm not being able to ping the other peer (10.8.0.5) or the server (10.8.0.1)
11:46 < krzee> other peer is .6
11:46 < bmflavio> i believe that this part comes before the routing, right? i mean, its before i need to change my iptables
11:46 < krzee> well your iptables needs to allow it
11:47 < bmflavio> i get this in routing table
11:47 < bmflavio> Kernel IP routing table
11:47 < bmflavio> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
11:47 < bmflavio> 10.8.0.5        *               255.255.255.255 UH    0      0        0 tun0
11:47 < bmflavio> 192.168.3.0     *               255.255.255.0   U     2      0        0 wlan0
11:47 < bmflavio> 10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
11:47 < krzee> your routing table is fine
11:47 < bmflavio> default         discus.home     0.0.0.0         UG    0      0        0 wlan0
11:47 < krzee> its your firewall
11:47 -!- Qutza [~user@78-86-11-213.zone2.bethere.co.uk] has quit [Quit: Leaving.]
11:47 < krzee> iptables -A INPUT -i tun+ -j ACCEPT
11:48 < bmflavio> on both the client and server?
11:48 < krzee> which one cant ping the other?  the server should try to ping 10.8.0.6 not .5
11:48 < krzee> !/30
11:48 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
11:49 < bmflavio> sorry, i've explained wrong. so, in the server, i can ping 10.8.0.1 and 10.8.0.6
11:49 < bmflavio> on the client i can ping 10.8.0.6
11:49 < bmflavio> 10.8.0.5 is impossible to ping on both ends.
11:50 < krzee> your client *is* .6
11:50 < krzee> if you follow the link my bot just gave you, it explains why .5 exists
11:50 < krzee> its openvpn internal in the default topology (net30)
11:51 < bmflavio> and i believe that 10.8.0.2 is also internal?
11:51 < krzee> your server needs that in the firewall
11:51 < krzee> correct
11:51 < bmflavio> i'm noticing that the server routing table points to 10.8.0.2, not to 10.8.0.1 as a gateway to 10.8.0.0
11:51 < krzee> !/30
11:51 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
11:52 < krzee> the links are there to be read
11:52 < krzee> so we dont need to type the same thing to 1,000,000 people
11:52 < bmflavio> ok, sry. reading.
11:52 < krzee> np
11:56 < bmflavio> thankz krzee. i understand it better now.
11:56 < bmflavio> so the server is indeed able to ping the client. i just need to figure out why not in the reverse direction
11:57 < krzee> i told you
11:58 < krzee> i got to go
11:58 < krzee> but here:
11:58 < krzee> http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html#lbBD
11:58 <@vpnHelper> Title: OpenVPN 2.2 (at openvpn.net)
11:58 < bmflavio> ok, thank you.
11:58 < bmflavio> thanks for the help, really :-)
11:59 < krzee> np =]
11:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:01 -!- dazo is now known as dazo_afk
12:07 -!- bmflavio [~bmflavio@bl16-158-52.dsl.telepac.pt] has quit [Remote host closed the connection]
12:08 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html>
12:11 -!- kusznir__ [~kusznir@casas-net.ailab.wsu.edu] has quit [Ping timeout: 240 seconds]
12:18 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:19 -!- bitterman [~yury@109.165.54.167] has quit [Quit: This computer has gone to sleep]
12:23 -!- kusznir__ [~kusznir@casas-net.ailab.wsu.edu] has joined #openvpn
12:24 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
12:35 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:35 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:35 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:38 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:38 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:43 < snappy> !windows
12:43 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
12:43 < snappy> !tap
12:43 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything where the
12:43 <@vpnHelper> protocol uses MAC addresses instead of IP addresses.
12:57 -!- luneff [~yury@84.51.199.95] has joined #openvpn
13:08 -!- bitterman [~yury@84.51.199.95] has joined #openvpn
13:12 -!- luneff [~yury@84.51.199.95] has quit [Ping timeout: 255 seconds]
13:14 -!- bjh4 [~bjh4@ool-18bbdf6a.static.optonline.net] has quit [Ping timeout: 252 seconds]
13:18 -!- K1ng [~KING@180.211.188.135] has quit [Ping timeout: 252 seconds]
13:19 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
13:24 <@vpnHelper> RSS Update - forum: OpenVPN newbie question <http://forums.openvpn.net/topic8537.html#p14013>
13:26 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
13:29 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Ping timeout: 260 seconds]
13:35 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
13:36 -!- mode/#openvpn [+v Axeman] by ChanServ
13:39 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
13:42 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
13:49 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14015>
13:59 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:01 <@vpnHelper> RSS Update - forum: OpenVPN Install Guides <http://forums.openvpn.net/topic2.html#p14016>
14:09 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
14:10 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
14:13 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14017>
14:22 -!- K1ng [~KING@180.211.188.12] has joined #openvpn
14:31 <@vpnHelper> RSS Update - forum: Losing Static Routes After Restarting OpenVPN - CENTOS <http://forums.openvpn.net/topic8535.html#p14018>
14:32 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
14:34 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:42 -!- fsntation [~fsntation@212.174.109.55] has quit [K-Lined]
14:43 -!- kusznir__ [~kusznir@casas-net.ailab.wsu.edu] has left #openvpn ["Leaving"]
14:53 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
14:54 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
14:54 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
14:56 < K1ng> anyone got barcode reader?
15:00 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:00 <@vpnHelper> RSS Update - forum: Losing Static Routes After Restarting OpenVPN - CENTOS <http://forums.openvpn.net/topic8535.html#p14019>
15:01 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has quit [Ping timeout: 252 seconds]
15:07 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has joined #openvpn
15:13 -!- K1ng [~KING@180.211.188.12] has quit [Read error: Connection reset by peer]
15:15 -!- K1ng [~KING@180.211.188.12] has joined #openvpn
15:26 -!- dazo_afk is now known as dazo
15:31 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14020>
15:36 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:49 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14021>
15:52 -!- benner_ [~benner@193.200.124.63] has left #openvpn []
15:58 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:59 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
16:00 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has quit [Ping timeout: 264 seconds]
16:01 -!- Guifort [~Guifort@156.78.80.79.rev.sfr.net] has joined #openvpn
16:01 -!- GNUtoo|irssi [~gnutoo@host186-56-dynamic.180-80-r.retail.telecomitalia.it] has quit [Quit: leaving]
16:07 -!- Guifort [~Guifort@156.78.80.79.rev.sfr.net] has quit [Quit: Quitte]
16:07 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
16:10 -!- ph1l [~ph1l@178-83-28-230.dynamic.hispeed.ch] has quit [Quit: Leaving.]
16:13 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14021> || Losing Static Routes After Restarting OpenVPN - CENTOS <http://forums.openvpn.net/topic8535.html#p14019> || OpenVPN Install Guides <http://forums.openvpn.net/topic2.html#p14016> || OpenVPN newbie question <http://forums.openvpn.net/topic8537.html#p14013> || OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#
16:14 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:34 < Bushman> man... this openVPN is so easy that i have resolved the windows XP VPN issues faster than installing ovpn server. congratulations for accidentally helping me by not helping me :P
16:34 < Bushman> bye ;]
16:34 -!- Bushman [bushman@91.146.248.112.ip.abpl.pl] has left #openvpn []
16:38 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:39 -!- mode/#openvpn [+v s7r] by ChanServ
16:39 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:50 < ecrist> K1ng: what are you talking about?
16:51 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
16:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
16:53 -!- yell0 [~yello@unaffiliated/contempt] has quit [Quit: leaving]
16:54 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
17:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:09 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
17:09 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
17:09 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
17:09 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:13 <@vpnHelper> RSS Update - forum: OpenVPN newbie question <http://forums.openvpn.net/topic8537.html#p14022>
17:20 < pwrcycle> !goal i want to specify the DNS server in the client config. any suggestions?
17:21 < Bushmills> yes.  doing beats wanting.
17:21 < Bushmills> nm - thought this was the #dns channel  :)
17:22 < pwrcycle> Bushmills: hi. always with the color commentary on grammar.
17:23 < pwrcycle> Bushmills: but i degrassi
17:23 < pwrcycle> is there a way to specifiy the DNS server in the client config?
17:24 < Bushmills> i'd use either an --up script, or change resolver in the vpn start script, if manually invoked.
17:24 < pwrcycle> i'm pushing my server, and windows respects, but linux doesn't.
17:24 < Bushmills> ah, if server pushed, read the man page on dhcp option and linux
17:25 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14023>
17:29 < pwrcycle> Bushmills: like this: dhcp-option type DNS 10.8.0.1 ??
17:30 < Bushmills> no, like "linux needs to run a script which introduces the pushed nameserver to the system"
17:31 < krzee> !pushdns
17:31 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
17:31 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
17:31 < krzee> just remove the push
17:31 < krzee> to put it in client config
17:31 < krzee> and use the script
17:32 < krzee> or, just make the script have the settings in it
17:33 < pwrcycle> k, thnx guys, i'll finish this after i eat.
17:47 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:50 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 258 seconds]
18:01 -!- dazo is now known as dazo_afk
18:06 -!- fremo_ [~fremo@noc.toile-libre.net] has quit [Ping timeout: 240 seconds]
18:06 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
18:11 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14024>
18:32 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
18:33 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
18:34 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
18:36 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:39 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
18:40 -!- Denial [~Denial@drgi.co.uk] has quit []
18:45 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:54 <@vpnHelper> RSS Update - forum: Auto-connect client at windows start <http://forums.openvpn.net/topic8541.html>
18:59 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
19:15 -!- snappy [~nipnop@wbml.net] has joined #openvpn
19:15 -!- snappy [~nipnop@wbml.net] has quit [Changing host]
19:15 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
19:17 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
19:44 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
20:01 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:05 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:14 -!- master_of_master [~master_of@p57B52D2A.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:18 -!- master_of_master [~master_of@p57B52F8E.dip.t-dialin.net] has joined #openvpn
20:38 -!- STF [~chatzilla@dslb-188-101-249-120.pools.arcor-ip.net] has quit [Remote host closed the connection]
20:39 < riffraff> whats up
20:44 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:44 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
20:44 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
20:44 -!- mode/#openvpn [+v Axeman] by ChanServ
20:47 < Bushmills> ceiling. clouds. moon. spirit.
20:48 < riffraff> got my openvpn working, 3 vlans on a dedicated non gateway vm. 
20:49 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Client Quit]
20:57 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
20:57 -!- mode/#openvpn [+v Axeman] by ChanServ
20:57 -!- stephenh [~stephenh@durbanpoizon.za.net] has quit [Ping timeout: 246 seconds]
20:58 -!- stephenh [~stephenh@durbanpoizon.za.net] has joined #openvpn
21:00 < riffraff> should i use a PKI key? i dont feel its really necessary with AES-256 cipher is it?
21:04 < snappy> don't think it's necessary; you can do authenticated DH-exchange with a symmetric key.
21:04 < snappy> and a hmac.
21:06 < riffraff> yeah, thats not needed in this scenerio
21:06 < riffraff> but yeah okay
21:09 < riffraff> that looks cool, the key exchange ability of it. i'll have to try that some day
21:10 < riffraff> i understood the key is just a hash
21:11 < snappy> you're talking site to site w/ a shared key right?
21:12 < snappy> i dont know how openvpn protocol works, but i assume an authenticated dh-exchange will establish a new key, and then pfs (perfect forward secrecy) will change keys etc.
21:13 < riffraff> yeah
21:13 < snappy> similar to how ipsec works anyway
21:18 < riffraff> yeah md5 or sha1 hash
21:19 < riffraff> not sure which openvpn --secret defualts to, problably md5
21:23 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:25 < genlime> do we have icmp on openvpn
21:26 -!- e is now known as udk
21:30 < genlime> where can I download ovpn_icmp.tar.gz
21:30 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
21:31 -!- antminds [~antminds@202.147.54.179] has joined #openvpn
21:31 < antminds> help needed
21:31 < Bushmills> ambulance?
21:32 < Bushmills> "spare-a-dime"?
21:33 < Bushmills> ah, got it. you're hiring.
21:34 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:34 < genlime> hello there. do we have icmp on openvpn or where can I see ovpn_icmp.tar.gz
21:36 < Bushmills> we don't know what you have, and i see "ovpn_icmp.tar.gz" on the previous line, where you typed it.
21:40 < genlime> bushmills, do we have icmp protocol in openvpn?
21:40 < Bushmills> in what sense?
21:50 -!- cjs226_ [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
21:50 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 250 seconds]
21:51 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:52 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
22:05 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
22:06 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:06 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:06 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:07 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:07 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 252 seconds]
22:10 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Ping timeout: 252 seconds]
22:10 -!- freaky[t] [alpha@freakyonline.de] has quit [Ping timeout: 255 seconds]
22:12 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
22:13 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
22:15 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has quit [Read error: Connection reset by peer]
22:15 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
22:15 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:16 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
22:16 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:18 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
22:19 -!- cjs226_ [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
22:20 -!- troyt [~troyt@cl-166.phx-01.us.sixxs.net] has joined #openvpn
22:25 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
22:25 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:45 -!- troyt [~troyt@cl-166.phx-01.us.sixxs.net] has quit [Ping timeout: 264 seconds]
22:46 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:38 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has joined #openvpn
23:42 <@vpnHelper> RSS Update - forum: [help]how Enable OpenVPN management console <http://forums.openvpn.net/topic8542.html>
23:51 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has quit [Ping timeout: 252 seconds]
23:58 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
--- Day changed Thu Jul 28 2011
00:02 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
00:07 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
00:15 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:22 -!- antmindz [~antminds@202.147.54.179] has joined #openvpn
00:23 -!- antminds [~antminds@202.147.54.179] has quit [Ping timeout: 276 seconds]
00:29 < amero> slightly off-topic question. i have 2 public ips on my server where my openvpn is running. do you think it's a bad idea to open all the ports on one of the ip's to allow unrestrictive use of the vpn?
00:29 -!- antminds [~antminds@203.117.64.67] has joined #openvpn
00:30 < amero> i have all other services on the server listening on the other ip
00:31 -!- antmindz [~antminds@202.147.54.179] has quit [Ping timeout: 240 seconds]
00:49 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14027>
00:52 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
01:00 < reiffert> amero: yes, it's a bad idea.
01:02 < reiffert> (slight off-topic answer)
01:03 < krzee> unrestricted use of the vpn would be opening up the outbound, not the inbound
01:03 < krzee> inbound all you need is the openvpn port
01:11 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Quit: This computer has gone to sleep]
01:17 -!- bitterman [~yury@84.51.199.95] has quit [Ping timeout: 276 seconds]
01:27 < antminds> h
01:32 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: No route to host]
01:34 < Bushmills> still hiring?
01:39 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
01:40 < style> reiffert: OpenVPN started working again when we rebooted our server :/ (once again no configs were touched)
01:40 < antminds> hire what
01:40 < style> before we tried just to boot openvpn service but that didn't affect anything
01:43 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:43 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
01:48 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
01:49 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Remote host closed the connection]
01:50 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
01:55 -!- luneff [~yury@188.114.48.195] has joined #openvpn
02:08 -!- bitterman [~yury@188.114.48.195] has joined #openvpn
02:10 -!- luneff [~yury@188.114.48.195] has quit [Read error: Operation timed out]
02:12 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:12 < genlime> any tweak known for openvpn?
02:13 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:19 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Read error: Operation timed out]
02:20 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
02:21 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
02:22 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
02:27 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
02:31 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:48 -!- antminds [~antminds@203.117.64.67] has quit [Ping timeout: 264 seconds]
02:48 <@vpnHelper> RSS Update - forum: [help]how Enable OpenVPN management console <http://forums.openvpn.net/topic8542.html#p14028>
02:49 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
02:51 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
03:04 -!- cameronmalek [~cameronma@66-216-241-209.dhcp.stcd.mn.charter.com] has joined #openvpn
03:05 -!- cameronmalek [~cameronma@66-216-241-209.dhcp.stcd.mn.charter.com] has left #openvpn []
03:07 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
03:12 -!- bitterman [~yury@188.114.48.195] has quit [Quit: Leaving]
03:17 -!- gardar [~gardar@gardar.net] has joined #openvpn
03:19 -!- luneff [~yury@188.114.48.195] has joined #openvpn
03:22 -!- dazo_afk is now known as dazo
03:23 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:47 -!- ph1l [~ph1l@178-83-28-230.dynamic.hispeed.ch] has joined #openvpn
04:01 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14029>
04:10 -!- mexx [~huy@unaffiliated/mexx] has joined #openvpn
04:11 < mexx> hi
04:23 -!- mexx [~huy@unaffiliated/mexx] has left #openvpn []
04:26 -!- rkantos [robin@hp1.jaketus.net] has quit [Ping timeout: 258 seconds]
04:29 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
04:42 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
04:47 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
04:48 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
04:53 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14030>
04:59 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14031>
05:02 < riffraff> http://www.youtube.com/watch?v=FIWb8HJ5gLo
05:02 <@vpnHelper> Title: Military Tribute: Hank Jr.; Country Boy Can Survive - YouTube (at www.youtube.com)
05:36 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:38 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
05:42 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
05:54 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
05:57 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:04 -!- Veryevil [~Veryevil@83.166.186.218] has joined #openvpn
06:05 < Veryevil> !welcome
06:05 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:06 < Veryevil> OpenVPN windows ipv6?
06:13 < Veryevil> !goal
06:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:48 < Veryevil> !goal forward all traffic for aaaa::\64 to TAP-win32 adapter in TUN mode with IP aaaa::1 address
06:52 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:52 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:52 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
06:52 -!- mode/#openvpn [+v Axeman] by ChanServ
07:01 < Bushmills> genlime, i suppose you could call optimising the MTU a tweak
07:02 < Bushmills> therefore,  "any tweak known" -> "yes"
07:05 -!- Deesl [~bsdboy@unaffiliated/deesl] has joined #openvpn
07:09 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:12 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14032>
07:18 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14034> || linux-vserver <http://forums.openvpn.net/topic8538.html#p14033>
07:19 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
07:19 -!- Deesl [~bsdboy@unaffiliated/deesl] has quit [Quit: Bye!]
07:20 -!- Deesl [~bsdboy@unaffiliated/deesl] has joined #openvpn
07:28 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
07:41 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14035>
07:42 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
07:48 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14036>
07:50 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
07:50 -!- trapni [~trapni@gentoo/developer/trapni] has joined #openvpn
07:50  * trapni waves
08:07 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [K-Lined]
08:14 -!- AXEMan2 [~axeman3@knox.pace.edu] has joined #openvpn
08:16 -!- luneff [~yury@188.114.48.195] has quit [Read error: Connection reset by peer]
08:17 -!- luneff [~yury@188.114.48.195] has joined #openvpn
08:17 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
08:17 <@vpnHelper> RSS Update - forum: How Do Your Protect Against A VPN Drop? <http://forums.openvpn.net/topic8479.html#p14037>
08:21 -!- porusfrigyes [~vajasteny@flix.hu] has joined #openvpn
08:22 < porusfrigyes> hello, can anyone tell me why the --show-pkcs11-ids command won't work with openvpn 2.2.1?
08:23 -!- User643 [~User@port-83-236-180-106.static.qsc.de] has joined #openvpn
08:23 <@vpnHelper> RSS Update - forum: Need Help unable to connect my openvpn with my home DHCP <http://forums.openvpn.net/topic8486.html#p14038>
08:26 < User643> Hi! I wanted to set up OpenVPN on my server and client, but every time my client tries to connect, the server exits with last error: "CRL: cannot read CRL from file /etc/ssl/crl.pem". I don't have and never had a crl.pem file :( What should i do? Googling for crl.pem didn't help much...
08:30 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
08:30 < gladiatr> User643, remove the crl directive from your configuration file (or comment it out)
08:35 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:36 -!- User643 [~User@port-83-236-180-106.static.qsc.de] has quit [Ping timeout: 260 seconds]
08:36 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14041> || linux-vserver <http://forums.openvpn.net/topic8538.html#p14039>
08:36 -!- porusfrigyes [~vajasteny@flix.hu] has left #openvpn []
08:41 -!- luneff [~yury@188.114.48.195] has quit [Ping timeout: 250 seconds]
08:45 -!- antmindz [~antminds@182.55.128.134] has joined #openvpn
08:45 -!- gyyrog [~gyyrog@71-13-67-85.static.aldl.mi.charter.com] has joined #openvpn
08:46 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14042>
08:48 -!- gyyrog [~gyyrog@71-13-67-85.static.aldl.mi.charter.com] has quit [Remote host closed the connection]
08:51 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has joined #openvpn
08:52 <@vpnHelper> RSS Update - forum: Redirect-gateway Reroutes Everything to the Server's IP <http://forums.openvpn.net/topic8467.html#p14043>
08:58 -!- luneff [~yury@188.114.48.195] has joined #openvpn
09:07 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:17 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
09:22 -!- luneff [~yury@188.114.48.195] has quit [Ping timeout: 240 seconds]
09:22 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14044>
09:28 -!- antmindz [~antminds@182.55.128.134] has quit [Ping timeout: 264 seconds]
09:32 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Some folks are wise, and some otherwise.]
09:34 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14046> || linux-vserver <http://forums.openvpn.net/topic8538.html#p14045>
09:35 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:40 <@vpnHelper> RSS Update - forum: remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14047>
09:43 < genlime> what is the use of yum install dnsmasq on openvpn?
09:45 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14048>
10:03 <@vpnHelper> RSS Update - forum: [help]how Enable OpenVPN management console <http://forums.openvpn.net/topic8542.html#p14050>
10:04 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
10:04 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:04 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has left #openvpn []
10:13 -!- bmflavio [~bmflavio@bl16-158-52.dsl.telepac.pt] has joined #openvpn
10:15 < bmflavio> !firewall
10:15 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
10:20 < bmflavio> good afternoon, i've setup a openvpn in routed mode, client was signed the 10.8.0.6 ip. server can ping the client but not otherwise even after aplying the iptable -A INPUT  -i tun+ -j ACCEPT rule on the server
10:21 < bmflavio> are there other firewall related issues that could cause this?
10:22 -!- Veryevil [~Veryevil@83.166.186.218] has quit []
10:24 < bmflavio> when i tcpdump on the server for the tun0 interface no packages arrive while the client pings the server, whereas on if i tcpdump the eth0 interface (the one the openvpn connection is established through) i see the packets arriving.
10:31 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
10:38 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14052> || Server setup confusion <http://forums.openvpn.net/topic8545.html>
10:39 -!- bmflavio [~bmflavio@bl16-158-52.dsl.telepac.pt] has quit [Quit: Konversation terminated!]
10:39 -!- bmflavio [~bmflavio@bl16-158-52.dsl.telepac.pt] has joined #openvpn
10:40 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
10:46 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
10:47 -!- luneff [~yury@84.51.213.189] has joined #openvpn
10:47 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
10:55 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14053>
11:00 -!- bmflavio [~bmflavio@bl16-158-52.dsl.telepac.pt] has quit [Remote host closed the connection]
11:01 <@vpnHelper> RSS Update - forum: Redirect-gateway Reroutes Everything to the Server's IP <http://forums.openvpn.net/topic8467.html#p14054>
11:09 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 260 seconds]
11:18 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
11:30 -!- ph1l [~ph1l@178-83-28-230.dynamic.hispeed.ch] has quit [Quit: Leaving.]
11:36 -!- WebDawgII [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has joined #openvpn
11:39 < WebDawgII> I have my vpn server and client file setup.  All I want to do is route a samba server through the VPN.  No internet etc.  The ip of the server is on the openvpn server network and is a different subnet of the client.  I am using tun connections.
11:40 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
11:50 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:50 -!- mode/#openvpn [+o mattock] by ChanServ
11:51 -!- AndreiM [18a2f234@gateway/web/freenode/ip.24.162.242.52] has joined #openvpn
11:53 -!- AndreiM [18a2f234@gateway/web/freenode/ip.24.162.242.52] has quit [Client Quit]
11:54 -!- AndreiM [18a2f234@gateway/web/freenode/ip.24.162.242.52] has joined #openvpn
11:58 < WebDawgII> Heh.
11:58 < WebDawgII> I think I may have it.
12:02 < WebDawgII> MUST TEST.
12:02 < WebDawgII> Thanks for the Help.
12:02 < WebDawgII> ;)
12:02 -!- WebDawgII [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has quit []
12:05 < AndreiM> hey
12:05 < AndreiM> anybody know how I can join #PHP ?
12:06 <@dazo> AndreiM: /join #PHP ?
12:06 < AndreiM> it says I have to be invited
12:06 < AndreiM> yeah
12:06 < AndreiM> though
12:08 < AndreiM> anybody?
12:10 -!- dazo is now known as dazo_afk
12:14 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:15 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:31 -!- AXEManiac [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
12:34 -!- AXEMan2 [~axeman3@knox.pace.edu] has quit [Ping timeout: 257 seconds]
12:35 -!- AXEMan2 [~axeman3@knox.pace.edu] has joined #openvpn
12:37 -!- AXEManiac [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 258 seconds]
13:04 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:21 -!- Deesl [~bsdboy@unaffiliated/deesl] has quit [Quit: Bye!]
13:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
13:51 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:51 -!- mode/#openvpn [+v s7r] by ChanServ
13:53 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:01 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
14:26 -!- AXEMan2 [~axeman3@knox.pace.edu] has quit [Quit: Sorry Gotta Run!]
14:29 -!- Rolybrau [~Rolybrau@24-152.78-83.cust.bluewin.ch] has joined #openvpn
14:29 -!- Rolybrau [~Rolybrau@24-152.78-83.cust.bluewin.ch] has quit [Changing host]
14:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:34 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
14:38 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has joined #openvpn
14:42 -!- EugeneKay is now known as EugeneKaway
14:50 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
14:52 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
14:59 -!- EugeneKaway is now known as EugeneKay
15:05 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:20 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Read error: Connection reset by peer]
15:23 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
15:27 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
15:31 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 246 seconds]
15:33 -!- pa [~pa@unaffiliated/pa] has quit [Remote host closed the connection]
15:41 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
15:58 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Remote host closed the connection]
16:08 -!- antminds [~antminds@182.55.128.134] has joined #openvpn
16:12 -!- luneff [~yury@84.51.213.189] has quit [Quit: This computer has gone to sleep]
16:16 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has quit [Quit: leaving]
16:17 -!- albech [~thomas@1508886244.seas-nve.dbnet.dk] has joined #openvpn
16:19 < albech> hi all. I am successfully connecting to my VPN server and can ping the server itself. I can however not connect to other machines on the remote network. The ip_forward flag is set and I am pushing the correct routes.
16:20 < albech> ohh and no iptables are running on the server
16:21 < EugeneKay> The other machines on the network need to know to route traffic for the VPN's subnet via the VPN server. This is usually done by making the VPN server the same machine as the default gateway.
16:21 < antminds> i have problem 
16:22 < antminds> i m trying to configure openvpn with problem 
16:22 < albech> EugeneKay, so I have to make manual return routes i guess
16:22 < EugeneKay> Three ways to fix it
16:22 < EugeneKay> 1) enable MASQUERADE for the vpn subnet
16:22 < albech> or NAT
16:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:22 < EugeneKay> 2) setup a static route on the default gw
16:22 < EugeneKay> or 3) setup a static route on each box on the network
16:23 < albech> guess ill try 2 first
16:24 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has joined #openvpn
16:27 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:32 < antminds> EugeneKay: can u help my problem
16:37 < Kartagis> hmm, iptables rules weren't restored on network up
16:40 -!- albech [~thomas@1508886244.seas-nve.dbnet.dk] has quit [Quit: Ex-Chat]
16:42 -!- AndreiM [18a2f234@gateway/web/freenode/ip.24.162.242.52] has quit [Quit: Page closed]
16:51 -!- antminds [~antminds@182.55.128.134] has quit [Ping timeout: 240 seconds]
16:56 -!- antminds [~antminds@182.55.128.134] has joined #openvpn
17:01 -!- troyt [~troyt@cl-166.phx-01.us.sixxs.net] has joined #openvpn
17:02 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
17:03 < antminds> ??
17:03 < antminds> HELP NEEDE
17:04 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 240 seconds]
17:05 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
17:08 < troyt> OK; antminds - Please repeat the question.  I joined the room after you asked it.
17:11 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:13 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 252 seconds]
17:18 -!- antminds [~antminds@182.55.128.134] has quit [Ping timeout: 250 seconds]
17:19 -!- antminds [~antminds@182.55.128.134] has joined #openvpn
17:34 < antminds> i m trying to configure openvpn with problem 
17:34 < antminds> the server wont start
17:38 < troyt> There are a number of things that can cause that.  What distro are you running?
17:39 < troyt> More to the point, what do your logfiles say?
17:41 < troyt> If you're running Debian/Ubuntu, it'll be in /var/log/auth.log (grep for pluto)
17:41 -!- d12fk [~heiko@port-92-198-130-130.static.qsc.de] has quit [Ping timeout: 252 seconds]
17:41 <@vpnHelper> RSS Update - forum: Reserve an IP address from the DHCP server <http://forums.openvpn.net/topic8546.html>
17:42 -!- d12fk [~heiko@port-92-198-130-130.static.qsc.de] has joined #openvpn
17:43 -!- antminds [~antminds@182.55.128.134] has quit [Ping timeout: 240 seconds]
17:43 -!- antminds [~antminds@182.55.128.134] has joined #openvpn
17:48 -!- [nig]ger [~nig]ger@gateway/tor-sasl/devsorandom] has joined #openvpn
17:48 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
17:49 < [nig]ger> Hi, how do i set up openvpn on my VAX?
17:49 < troyt> On a vax?  I'd use a shotgun.
17:50 < antminds> i running centos on xen
17:53 < troyt> OK.  And I have to apologize a bit, antminds; I had thought I was in the openswan channel.  Different VPN system.
17:53 < [nig]ger> Well, this channel is not proving very ENTERPRISE QUALITY.
17:54 < antminds> hahaa
17:54 < antminds> no problem
17:54 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 240 seconds]
17:54 < antminds> so u are not sure about VPN?
17:54 < troyt> Well, I'm running openVPN right now.
17:54 < troyt> So... not a problem.
17:54 < troyt> Just had to have my bearings straight.
17:54 < antminds> okok
17:54 < antminds> i m a noob
17:55 < antminds> so i really need yr help 
17:56 < troyt> First off: Have you done your x.509 key generation?  That's an important part.
17:57 < troyt> Or even better:  What have you done so far? (I assume you've installed the package)
18:03 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:03 < troyt> Oh, and I figure it's important: Are you running as a client, or trying to set up a server?
18:06 < antminds> ok
18:06 < antminds> i have installed the openvpn 
18:06 < antminds> alsowebmin 
18:07 < antminds> *also webmin 
18:07 < troyt> OK - are you trying to run a client, or a server?
18:08 < antminds> i m trying to configure a server 
18:08 < antminds> then install client on my machine to test
18:10 < troyt> OK.  I assume you're doing something like a VPN for home?
18:10 < antminds> yes
18:11 < antminds> and if possible for business
18:11 < troyt> Well, first one, then the other.
18:11 < troyt> That is, fortunately for you, pretty much exactly what my config is, so I hope to be able to help.
18:12 < antminds> ok
18:13 < troyt> Have you done the X.509 certificates (ie. openssl)
18:14 < antminds> i m not sure what is it
18:14 < troyt> For that (if you haven't done it already):  http://www.openvpn.net/index.php/open-source/documentation/howto.html#pki
18:14 <@vpnHelper> Title: HOWTO (at www.openvpn.net)
18:14 < troyt> Bingo.  The howto is *very* good.
18:14 < antminds> ermm
18:15 < antminds> i have configured webmin too
18:15 < troyt> Yeah... Webmin is OK, but honestly, you're probably better off doing it by hand.
18:17 < antminds> ok
18:19 < troyt> But, straight from the openVPN HOWTO (the link I sent):
18:20 < troyt>  If you installed OpenVPN from an RPM file, the easy-rsa directory can usually be found in /usr/share/doc/packages/openvpn or /usr/share/doc/openvpn-2.
18:20 < troyt> There are a few scripts there that make it pretty painless to generate your certificate authority, and then generate keys.
18:20 < troyt> . ./vars
18:20 < troyt> ./clean-all
18:20 < troyt> ./build-ca
18:21 < antminds> i think VPN part already done 
18:21 < antminds> CAL also done
18:21 < antminds> Keys also generated
18:21 < troyt> OK.
18:21 < antminds> then to create the VPN server on OPENVPN Failed
18:22 < troyt> As in when you run /etc/init.d/openvpn, right?
18:23 < antminds> no
18:23 < antminds> this is ok
18:23 < troyt> so "/etc/init.d/openvpn start" runs successfully?
18:26 < antminds> [root@vpn ~]# /etc/init.d/openvpn start
18:26 < antminds> Starting openvpn:                                          [  OK  ]
18:26 < troyt> OK; so that tells me that the OpenVPN daemon is running correctly.  So what is saying 'openvpn failed'?
18:26 < antminds> troyt: will u be here for long?
18:27 < antminds> Fri Jul 29 01:27:09 2011 event_wait : Interrupted system call (code=4)
18:27 < antminds> Fri Jul 29 01:27:09 2011 TCP/UDP: Closing socket
18:27 < antminds> RTNETLINK answers: Operation not permitted
18:27 < antminds> Fri Jul 29 01:27:09 2011 ERROR: Linux route delete command failed: external program exited with error status: 2
18:27 < antminds> RTNETLINK answers: Operation not permitted
18:27 < antminds> Fri Jul 29 01:27:09 2011 ERROR: Linux route delete command failed: external program exited with error status: 2
18:27 < antminds> RTNETLINK answers: Operation not permitted
18:27 -!- antminds was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
18:29 -!- antminds [~antminds@182.55.128.134] has joined #openvpn
18:29 < antminds> ps 
18:29 < antminds> http://pastebin.com/download.php?i=NhN3ZYCW
18:30 < krzee> you starting it as root?
18:30 < antminds> yes
18:30 < krzee> !configs
18:30 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
18:30 < antminds> !configs
18:30 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
18:30 < troyt> Well, I've seen some things that seem to indicate that CentOS may try to start openVPN as a non-priviliged user.
18:31 < krzee> you can drop privs after, but must start as root
18:31 < antminds> how shld i do that
18:31 < antminds> i run as nobody 
18:31 < krzee> !man
18:31 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
18:31 < krzee> --user and --group
18:32 < troyt> Though that's usually configured in the server.conf file - there are two line:
18:32 < troyt> user nobody
18:32 < troyt> group nobody
18:32 < troyt> So that's not entirely inconsistent.
18:34 < antminds> ok
18:34 < antminds> so what shld i do now 
18:35 < antminds> i be back shortly
18:35 < antminds> cya guys 
18:35 < troyt> I'm doing a bit of research to see what centos is doing.
18:39 -!- antminds [~antminds@182.55.128.134] has quit [Ping timeout: 240 seconds]
18:43 -!- troyt [~troyt@cl-166.phx-01.us.sixxs.net] has left #openvpn ["Linkinus - http://linkinus.com"]
18:44 -!- [intra]lanman [~lanman@freeswitch/developer/intralanman] has quit [Ping timeout: 252 seconds]
18:45 -!- Denial [~Denial@drgi.co.uk] has quit []
18:48 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
18:58 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
19:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
19:10 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Quit: Leaving]
19:22 -!- Drizzt321 [~drizzt@li51-131.members.linode.com] has joined #openvpn
19:25 < Drizzt321> So, I'm setting up openvpn on my laptop with my home server (behind a Firewall/NAT box with port-forward) as the server. I can make the connection from outside my home (I'm at a coffee shop right now) and I can ping/SMB browse over the VPN, but I then can't get out to the internet at all. My goal is to have 100% of all internet traffic going over my VPN through my home so when I'm out at a coffee shop with unencrypted wifi, I'm protected.
19:25 < Drizzt321> My client log is at http://pastebin.com/XyNy8yud
19:25 < Drizzt321> and I can post screenshots of my windows routing table
19:26 < Drizzt321> client is Win7, server is FreeBSD 8.2-release
19:33 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14056>
19:34 -!- Drizzt321 [~drizzt@li51-131.members.linode.com] has left #openvpn []
19:46 -!- [nig]ger [~nig]ger@gateway/tor-sasl/devsorandom] has quit [Ping timeout: 250 seconds]
19:49 -!- [nig]ger [~nig]ger@gateway/tor-sasl/devsorandom] has joined #openvpn
19:55 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
20:00 -!- Squidy [~quassel@187.7.244.122] has joined #openvpn
20:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:15 <@vpnHelper> RSS Update - forum: Reserve an IP address from the DHCP server <http://forums.openvpn.net/topic8546.html#p14057>
20:17 -!- master_of_master [~master_of@p57B52F8E.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:19 -!- master_of_master [~master_of@p57B52F63.dip.t-dialin.net] has joined #openvpn
20:21 <@vpnHelper> RSS Update - forum: OpenVPN Server not Starting? <http://forums.openvpn.net/topic8525.html#p14058>
20:22 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:26 -!- Squidy [~quassel@187.7.244.122] has quit [Changing host]
20:26 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
20:32 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:34 < [nig]ger> wb nigga.
20:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:40 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:43 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
20:49 -!- antminds [~antminds@203.117.64.67] has joined #openvpn
20:49 < antminds> hi guys 
20:49 < antminds> i m back
20:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:53 < antminds> anyone can help
20:57 -!- Jedicus [~user@adsl-76-214-202-129.dsl.emhril.sbcglobal.net] has joined #openvpn
20:58 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:02 -!- [nig]ger changed the topic of #openvpn to: YOU ARE ALL NIGGERS
21:03 -!- [nig]ger changed the topic of #openvpn to: KRZEE LIKES TO SUCK THIS: 8=============D
21:04 < [nig]ger> umad?
21:07 -!- [nig]ger changed the topic of #openvpn to: KRZEE LIKES TO SUCK THIS: 8=============D | Openvpn tutorials: http://tutorials.openvpn.on.nimp.org/
21:07 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
21:15 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:15 -!- [nig]ger changed the topic of #openvpn to: KRZEE LIKES TO SUCK THIS: 8=============D | Openvpn tutorials: http://tutorials.openvpn.on.nimp.org/
21:15 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:15 -!- [nig]ger changed the topic of #openvpn to: KRZEE LIKES TO SUCK THIS: 8=============D | Openvpn tutorials: http://tutorials.openvpn.on.nimp.org/
21:15 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:15 -!- [nig]ger changed the topic of #openvpn to: KRZEE LIKES TO SUCK THIS: 8=============D | Openvpn tutorials: http://tutorials.openvpn.on.nimp.org/
21:15 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:16 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:16 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 < Jedicus> Can I use openVPN to block certain text strings in my tunnel?
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:17 < EugeneKay> openvpn won't do that by itself.
21:17 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 < EugeneKay> I should script this.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 < Jedicus> Let's say my VPN has a lot of traffic that repeats the same pattern over and over. Will compression make that not take up as much bandiwdth?
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:18 < EugeneKay> as well as lzo can, yes
21:18 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:19 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: EugeneKay is mad gay
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:20 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:21 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:22 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:22 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:22 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:22 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:22 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:22 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:22 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:22 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:22 -!- [nig]ger changed the topic of #openvpn to: The new #autism, discussions on autism go here.
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:22 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- EugeneKay changed the topic of #openvpn to: Welcome to OpenVPN community support channel. Please be patient, we're all volunteers.
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:23 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 -!- Jedicus [~user@adsl-76-214-202-129.dsl.emhril.sbcglobal.net] has left #openvpn ["Leaving"]
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 < havoc> OMFG, what a luser
21:24 < havoc> OMFG, what a luser
21:24 < havoc> OMFG, what a luser
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:24 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:24 < havoc> OMFG, what a luser
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 < havoc> OMFG, what a luser
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:25 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- Spunkmaster [needle@ultra30.tptp.cc] has joined #openvpn
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 < [nig]ger> lol
21:26 < [nig]ger> i sense the mad.
21:26 < [nig]ger> Sorry brah, its scripted.
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 < Spunkmaster> gnaa operative here
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 < Spunkmaster> identify yourself
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:26 -!- Corey [~KB1JWQ@freenode/staff/birthday-spankings/KB1JWQ] has joined #openvpn
21:26 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 < Spunkmaster> gnaa operative here
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 < Spunkmaster> identify yourself
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- vragnaroda [~vragnarod@unaffiliated/vragnaroda] has joined #openvpn
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:27 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:28 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 < vragnaroda> is there a point to this channel?
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:29 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:30 -!- tute [aum@bbis.us] has joined #openvpn
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- gry [user@pdpc/supporter/student/gry] has joined #openvpn
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 < Spunkmaster> gry!
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:31 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- tute [aum@bbis.us] has left #openvpn ["this flood is unbarable !!!"]
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:32 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 <@vpnHelper> RSS Update - forum: [Solved] remove routes when tunnel is down <http://forums.openvpn.net/topic8539.html#p14047> || [Solved] Restarted OpenVPN and now no clients can be found <http://forums.openvpn.net/topic8532.html#p13996>
21:33 -!- spirals [~spirals@unaffiliated/spirals] has joined #openvpn
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:33 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34  * Spunkmaster sets mode +b [nig]ger!*@*
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:34 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:35 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:36 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:37 -!- Spunkmaster changed the topic of #openvpn to: a
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 < Corey> That's about enough.
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger changed the topic of #openvpn to: krzee Likes to suck cocks. | For frequently asked questions: http://faq.openvpn.on.nimp.org/
21:38 -!- [nig]ger [~nig]ger@gateway/tor-sasl/devsorandom] has quit [Killed (LoRez (Trolls are not topical on freenode))]
21:39 -!- Corey changed the topic of #openvpn to: OpenVPN discussion
21:39 -!- Spunkmaster [needle@ultra30.tptp.cc] has left #openvpn []
21:42 -!- gry changed the topic of #openvpn to: OpenVPN 2.2.1 most current, released 6-July-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: https://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly. || Host Cloaks available, just ask for one. | Access Server support in #openvpn-as
21:42 < gry> (per http://searchirc.com/irc-openvpn-1)
21:42 <@vpnHelper> Title: Search IRC, search term: openvpn (at searchirc.com)
21:43 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 250 seconds]
21:43 < havoc> Corey: thank you
21:44 -!- vragnaroda [~vragnarod@unaffiliated/vragnaroda] has left #openvpn ["well, i was just wondering how long that would take"]
21:45 < antminds> anyone knows how to configure OpenVPN with WebMin?
21:45 < Corey> Might want to /cmode +t
21:45 < Corey> antminds: "Badly."
21:46 -!- Intellos [~Intellos@199.115.230.186] has joined #openvpn
21:47 < Intellos> Hello
21:47 < antminds> hi inimino
21:47 < antminds> Intellos
21:47 < Intellos> Hiya
21:48 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Quit: WeeChat 0.3.5]
21:48 < Intellos> Can someone direct me to instrutons on how to install open vpn on a centos 5.6 server?
21:50 < antminds> haha
21:50 < Intellos> ?
21:50 < gry> http://www.throx.net/2008/04/13/openvpn-and-centos-5-installation-and-configuration-guide/ ?
21:50 <@vpnHelper> Title: OpenVPN and CentOS 5 Installation and Configuration Guide | Throx (at www.throx.net)
21:50 < Intellos> alright
21:51 < Intellos> Thank you
21:52 < EugeneKay> Intellos - openvpn is available in the epel repos, conf files go in /etc/openvpn/, start the service, enjoy.
21:54 < antminds> EugeneKay: i have problem with OpenVPN with Webmin, can u help?
21:55 < EugeneKay> I don't do webmin.
21:57 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
22:01 < Intellos> rpmbuild: arguments to --root (-r) must begin with a /
22:01 < Intellos> ?
22:02 < Intellos> I get that when i try and install, rpmbuild –rebuild lzo-1.08-4.rf.src.rpm
22:02 < EugeneKay> Building from source is a bit daft.
22:03 < Intellos> I'm following these instrutions
22:03 < Intellos> http://www.throx.net/2008/04/13/openvpn-and-centos-5-installation-and-configuration-guide/
22:03 <@vpnHelper> Title: OpenVPN and CentOS 5 Installation and Configuration Guide | Throx (at www.throx.net)
22:03 < EugeneKay> Those instructions are crap.
22:03 < EugeneKay> The site doesn't even load for me.
22:03 < Intellos> lol
22:04 < Intellos> well, what instructions do you sugest then?
22:04 < EugeneKay> <EugeneKay> Intellos - openvpn is available in the epel repos, conf files go in /etc/openvpn/, start the service, enjoy.
22:04 < Intellos> ah
22:04 < Intellos> didn;t see that
22:05 < Intellos> my bad
22:05 < Intellos> Now I'm a noob at centos
22:05 < Intellos> what is epel repos?
22:06 < EugeneKay> http://lmgtfy.com/?q=epel
22:06 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
22:06 < EugeneKay> :-p
22:06 <@vpnHelper> RSS Update - forum: VPN session expires too quickly <http://forums.openvpn.net/topic8547.html>
22:06 < Intellos> D:
22:07 < EugeneKay> Linux is a learning process. 
22:08 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
22:08 < Intellos> Tell me about it
22:10 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
22:12 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
22:12 -!- Doonz [~Doonz@S0106002590301952.ed.shawcable.net] has quit [Remote host closed the connection]
22:16 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:16 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:16 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:16 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has quit [Ping timeout: 258 seconds]
22:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:19 -!- Intellos [~Intellos@199.115.230.186] has left #openvpn []
22:23 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
22:38 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
22:39 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:41 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
22:53 <@vpnHelper> RSS Update - forum: VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14060>
23:05 -!- mode/#openvpn [+t] by ChanServ
23:09 -!- spirals [~spirals@unaffiliated/spirals] has left #openvpn ["Leaving"]
23:22  * EugeneKay sneezes. An expired SSL certificate is expelled from his nostril.
23:35 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
23:36 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
23:41 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
23:58 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
--- Day changed Fri Jul 29 2011
00:37 -!- luneff [~yury@84.51.203.129] has joined #openvpn
00:39 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
00:41 <@vpnHelper> RSS Update - forum: Openvpn latest version? <http://forums.openvpn.net/topic8548.html>
00:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:52 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
00:53 -!- xizhendu [~xizhendu@202.108.72.168] has joined #openvpn
00:53 <@vpnHelper> RSS Update - forum: Openvpn latest version? <http://forums.openvpn.net/topic8548.html#p14062>
00:53 < xizhendu> hey guys
00:53 < xizhendu> Options error: Unrecognized option or missing parameter(s) in ****.ovpn:1: .client (2.2.1)	
00:53 < xizhendu> Use --help for more information.
00:54 < xizhendu>  got above info when i tried to run client on windows 7
00:55 < xizhendu> and be sure the conf file is working nice on Linux platfom, i just copy/paste to windows.
00:55 < xizhendu> any idea
00:56 < Bushmills> change  .client to  client
00:58 < xizhendu> Bushmills: but there's no dot before "client" in ovpn file...
00:58 < xizhendu> that's wired
00:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
00:59 < Bushmills> some strange control char,  i suppose. maybe it doesn't show in your editor.  try to press enter while on the c of client, to split lines, then removed the empty line
01:00 < xizhendu> thanks Bushmills. let me try.
01:05 < xizhendu> Bushmills: it works now :)
01:05 -!- agagag_ [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 252 seconds]
01:06 < xizhendu> i got to edit a new file, it works again.
01:06 < xizhendu> thanks a lot!
01:06 < Bushmills> the error message was pretty ... obvious :)
01:07 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
01:10 <@vpnHelper> RSS Update - forum: Reserve an IP address from the DHCP server <http://forums.openvpn.net/topic8546.html#p14063>
01:10 < xizhendu> Bushmills: saw that but i didn't expect Windows is just so stupid
01:10 < xizhendu> :P
01:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:16 <@vpnHelper> RSS Update - forum: Losing Static Routes After Restarting OpenVPN - CENTOS <http://forums.openvpn.net/topic8535.html#p14064>
01:22 <@vpnHelper> RSS Update - forum: Redirect-gateway Reroutes Everything to the Server's IP <http://forums.openvpn.net/topic8467.html#p14065>
01:31 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
01:46 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14066>
01:53 -!- luneff [~yury@84.51.203.129] has quit [Quit: Leaving]
01:58 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
02:10 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 276 seconds]
02:10 < Mowee> Morning
02:16 < antminds> morning
02:22 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
02:23 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 252 seconds]
02:23 -!- Cain` is now known as Cain
02:26 -!- Jedicus [~user@adsl-76-214-202-129.dsl.emhril.sbcglobal.net] has joined #openvpn
02:33 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
02:33 <@vpnHelper> RSS Update - forum: help installing openvpn <http://forums.openvpn.net/topic8549.html>
02:50 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
02:52 <@vpnHelper> RSS Update - forum: help installing openvpn <http://forums.openvpn.net/topic8549.html#p14068>
03:04 -!- luneff [~yury@46.41.108.247] has joined #openvpn
03:07 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:10 -!- gry [user@pdpc/supporter/student/gry] has quit [Killed (evilmquin (Killed.))]
03:10 -!- Deathvalley122 [~Death@eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
03:10 -!- gry [user@pdpc/supporter/student/gry] has joined #openvpn
03:11 -!- luneff [~yury@46.41.108.247] has quit [Ping timeout: 250 seconds]
03:15 -!- Deathvalley122 [~Death@eagleits.net] has joined #openvpn
03:17 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:20 -!- technistaff [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
03:23 < technistaff> anyone knows a good server?
03:23 -!- technistaff [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
03:25 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:29 -!- nuttersppadic is now known as sppadic[A]
03:29  * sppadic[A] is now away - Reason : assemblytime
03:42 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Quit: ZNC - http://znc.in]
03:43 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
03:43 < reiffert> auto away messages do suck
03:46 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538.html#p14069>
03:51 -!- sppadic[A] is now known as nuttersppadic
03:51  * nuttersppadic is no longer away : Gone for 21 minutes 48 seconds
03:55 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:55 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:55 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:00 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
04:00 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:00 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:00 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:05 -!- ph1l [~ph1l@178-83-28-230.dynamic.hispeed.ch] has joined #openvpn
04:05 -!- ph1l [~ph1l@178-83-28-230.dynamic.hispeed.ch] has quit [Client Quit]
04:08 -!- antminds [~antminds@203.117.64.67] has quit [Ping timeout: 250 seconds]
04:16 <@vpnHelper> RSS Update - forum: use proxy on the VPN server <http://forums.openvpn.net/topic8550.html>
04:18 -!- gry [user@pdpc/supporter/student/gry] has left #openvpn []
04:39 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:39 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:42 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 252 seconds]
04:50 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
05:10 <@vpnHelper> RSS Update - forum: use proxy on the VPN server <http://forums.openvpn.net/topic8550.html#p14071>
05:16 <@vpnHelper> RSS Update - forum: Server setup confusion <http://forums.openvpn.net/topic8545.html#p14072>
05:28 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14073>
05:29 -!- bmflavio [~bmflavio@bl16-158-52.dsl.telepac.pt] has joined #openvpn
05:30 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
05:32 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
05:45 -!- luneff [~yury@46.41.108.247] has joined #openvpn
05:46 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14074>
05:52 -!- bmflavio [~bmflavio@bl16-158-52.dsl.telepac.pt] has quit [Remote host closed the connection]
05:57 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
05:58 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
06:19 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Chicks dig it]
06:20 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
06:21 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Client Quit]
06:28 -!- nuttersppadic is now known as sppadic[A]
06:28  * sppadic[A] is now away - Reason : lunch
06:33 -!- titov [6166531e@gateway/web/freenode/ip.97.102.83.30] has joined #openvpn
06:34 < titov> hello all, i just downloaded and installed openvpn client on mac osx.  When I click on the client icon at the top of task bar, OpenVPN Connect 1.7.2 is greyed out so I can't even configure it
06:34 < titov> any thoughts?
06:34 < Bushmills> why would you configure openvpn by clicking on an icon?
06:35 < Bushmills> try providing a configuration first, *then* click on an icon
06:35 < titov> Bushmills, I have to open the client to be able to configure it, when i click the icon to select the option to open the config area, that is greyed out
06:40 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
07:13 -!- sppadic[A] is now known as nuttersppadic
07:13  * nuttersppadic is no longer away : Gone for 44 minutes 43 seconds
07:14 -!- titov [6166531e@gateway/web/freenode/ip.97.102.83.30] has quit [Quit: Page closed]
07:18 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:22 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
07:22 -!- octocpp [~octo@unaffiliated/octocpp] has joined #openvpn
07:24 < Bushmills> nuttersppadic: would you mind turning off the away and return message?
07:44 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
07:47 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Ping timeout: 240 seconds]
07:59 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
07:59 <@vpnHelper> RSS Update - forum: [help]how Enable OpenVPN management console <http://forums.openvpn.net/topic8542.html#p14075>
08:16 < nuttersppadic> Bushmills apologies just saw ur post now 
08:16 < nuttersppadic> will do sir 
08:16 < nuttersppadic> hello all btw 
08:18 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
08:18 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
08:24 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
08:25 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has joined #openvpn
08:35 <@vpnHelper> RSS Update - forum: [help]how Enable OpenVPN management console <http://forums.openvpn.net/topic8542.html#p14076>
08:46 -!- Axeman [~axeman3@knox.pace.edu] has joined #openvpn
08:46 -!- Axeman [~axeman3@knox.pace.edu] has quit [Changing host]
08:46 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
08:46 -!- mode/#openvpn [+v Axeman] by ChanServ
08:56 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
08:58 -!- octocpp [~octo@unaffiliated/octocpp] has quit [Ping timeout: 260 seconds]
08:59 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 255 seconds]
08:59 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Client Quit]
09:01 -!- azalyn [~junon@modemcable160.184-202-24.mc.videotron.ca] has quit [Remote host closed the connection]
09:03 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:05 < genlime> good day. I want to ask question.  if for example my internet connection is slow, is there a way that my server will push and push connectivity?
09:07 < ecrist> what?
09:07 < ecrist> openvpn won't speed up your connection
09:07 -!- nuttersppadic [~IceChat77@193.130.68.17] has left #openvpn []
09:09 < genlime> ecrist, yes something like that. so it wont speed up the connection. i was thinking of forcing to push connectivity in the network
09:14 <@vpnHelper> RSS Update - forum: Redirect-gateway Reroutes Everything to the Server's IP <http://forums.openvpn.net/topic8467.html#p14077>
09:16 < ecrist> what does that mean?
09:18 < genlime> i mean like in a water from the hose, if something will force the water to come out of the hose faster, then it will be faster not just ordinary flow of water.
09:18 < ecrist> no, that can't happen.
09:19 < genlime> do you know of certain software that will do that?
09:20 < ecrist> you can't do that
09:20 < ecrist> pay for a better connection
09:21 < ecrist> your issue is non-openvpn related
09:21 < genlime> well I thought openvpn can somehow make it
09:21 < ecrist> no
09:22 < Bushmills> enable comp-lzo on both server and client, for compression
09:22 < Bushmills> that won't change latency, but can improve throughput
09:23 < ecrist> unless what you're sending is already compressed, generally
09:23 < genlime> what will it do? will it speed up the connection. I have dont that but as per experience it did not make my connection fastter
09:23 < ecrist> which, many things are.
09:23 < genlime> throughput?
09:23 < Bushmills> throughput is how much you put through
09:24 < Bushmills> latency is how much later it arrives :)
09:24 < genlime> so latency is the opposite of throughput
09:25 < Bushmills> ehm... no.
09:25 -!- pdtpatr1ck [~pdtpatric@ip68-4-0-113.pv.oc.cox.net] has joined #openvpn
09:26 < genlime> ok i will google those
09:26 < genlime> do you guess think that some iptable rule may do the trick?
09:27 < Bushmills> for what reason is your network slow?
09:27 < EugeneKay> THIS IS HOW TCP/IP NETWORKING ACTUALLY WORKS
09:28 < stephenh> WITH PACKETS
09:28 < stephenh> packets of crisps 
09:28 < genlime> i dont know. i test 2 servers simultaneously and they have different loading time
09:29 < Bushmills> you can't improve a condition you don't know the reason of by putting in an iptables rule
09:30 < stephenh> genlime: you need more megabytes
09:31 < genlime> megabytes? what will it do? I guess I have no problem with because I am unmetered
09:31 < stephenh> megabits**  per second
09:32 < genlime> what do u mean
09:32 < EugeneKay> Your connection sucks. Acquire a better one if you want to have a non-sucky connection.
09:32 < EugeneKay> OpenVPN is not a magical internet device that will make it over 9000
09:33 < stephenh> if you have a 10mbps link, you should look at getting say... 11mbps... or more..
09:33 < genlime> maybe ur right.
09:33 < EugeneKay> "EugeneKay is right because EugeneKay is always right."
09:33 < pdtpatr1ck> Question -- is this of importance? 
09:33 < pdtpatr1ck> Fri Jul 29 07:32:04 2011 ERROR: Linux route add command failed: external program exited with error status: 7
09:33 < genlime> i am using wireless connection anyway
09:34 < EugeneKay> pdtpatr1ck - it means exactly what it says on the tin. route add exited with a status of 7. Consult the man page for route to find out what that means, and inspect your routing able to see if it's as expected.
09:35 < stephenh> the only way openvpn could make your experience any faster as if you had a connection to a faster, local server, say one at your office, that has a faster internet connection, you could then create a vpn to there and essentially all your traffic would be 'local'
09:35 < EugeneKay> Chances are, it's adding a conflicting route. It may or may not add it successfully.
09:35 -!- luneff [~yury@46.41.108.247] has quit [Quit: Leaving]
09:35 < ecrist> genlime: bandwidth is how much water pressure you have.  latency is how long it takes the water to get to your home from the water plant
09:36 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
09:40 < Bushmills> stephenh: actually, there may be exceptions. look at week 27 of http://scarydevilmonastery.net/snap/1311950364703630776d.png - red line is non-vpn latency, green line is vpn latency to the same machine.
09:41 < Bushmills> that was a case when latency through vpn remained more or less constant, while it five-folded the the non-vpn traffic
09:41 < stephenh> that is strange
09:42 < stephenh> if anything the ping direct to server should be better than without
09:42 < stephenh> sorry
09:42 < stephenh> i mean, 
09:42 < stephenh> direct to server = better response than via vpn tunnel
09:42 < stephenh> in theory anyway
09:42 < Bushmills> it's not just the graph being an indication for that - i was doing some tests during that phase myself on the link 
09:42 < Bushmills> yes. normally that's true. but during that short period it wasn't
09:43 -!- EugeneKay is now known as EugeneKaway
09:44 < Bushmills> a week later, the company running the router which cause the latency increase started to update the firmware on all their routers
09:44 < Bushmills> caused
09:49 < stephenh> i don't understand but ok :-)
09:49 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:05 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14078>
10:13 -!- titov [a3cd46ba@gateway/web/freenode/ip.163.205.70.186] has joined #openvpn
10:13 < titov> i have openvpn running on my system and when trying to connect to it using vpn client, I continue to get "read UDPv4 [ECONNREFUSED]: Connection refused (code=111)"
10:14 < titov> my firewall is set to all UDP 1194 for openvpn
10:14 < titov> anyone have any idea what the problem could be?
10:14 < titov> i also ensured that my time/date was the same on both the server/client
10:14 < EugeneKaway> Did you restart the firewall?
10:14 < titov> yep
10:15 < EugeneKaway> Try setting it to TCP, and telnet to the port. 
10:15 < EugeneKaway> You should see the handshake header
10:16 < titov> ok
10:17 < EugeneKaway> It's also a possibility that you're being blocked by an outbound firewall - corporate or free wifi does this.
10:20 < titov> now I can see the following error: "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)"
10:20 < titov> TLS handshake failed
10:21 < titov> the firewall is open on the client side (my other separate network)
10:22 < EugeneKaway> When you telnet in, or attempting to use the OpenVPN client?
10:22 < EugeneKaway> TLS failure sounds normal for telnet - no way you'll do the mental math in time
10:23 < titov> for telnet
10:24 < titov> checking client now
10:24 < EugeneKaway> Mmmkay. Try the client.
10:25 < titov> client fails as well but also now reports the TLS handshake failure
10:26 < titov> that was all on the log files
10:26 < titov> the telnet client reported a connection refused
10:26 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has quit [Quit: Ex-Chat]
10:26 < EugeneKaway> Hrm.
10:26 < titov> even though i opened it on the firewall
10:27 < titov> when i say "even though i opened it on the firewall", i meant tcp 1194
10:27 < EugeneKaway> Sounds like there's a firewall issue, then. :-p
10:27 < titov> yea, i just need to find it
10:30 -!- pdtpatr1ck [~pdtpatric@ip68-4-0-113.pv.oc.cox.net] has quit [Remote host closed the connection]
10:33 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
10:38 < stephenh> titov: 
10:38 < stephenh> remove tls and try again
10:38 < stephenh> o, nm, telnet fail too =]
10:39  * stephenh should read more before response
10:41 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:41 -!- mode/#openvpn [+v s7r] by ChanServ
10:42 < titov> im starting to wonder if it's my client causing the issue (tunnelblick client)
10:48 < titov> besides openvpn and tunnelblick, any other clients you guys know of?
10:48 < titov> im using a os x
10:49 < titov> openvpn points me to tunnelblick if i am using a later os x such as lion
10:49 < Bushmills> unlikely. network or configuration, i'd say
10:52 < snappy> titov: the openvpn client directly.
10:54 -!- warriorforGod [~warriorfo@unaffiliated/warriorforgod] has joined #openvpn
10:54 < warriorforGod> I am having a problem where I can get an openvpn client to connect to my server, but dhcp never hands out an ip address.  Any suggestions?
11:01 < titov> i just thought of something based on warriorforGod's issue.  I checked my firewall and noticed that my private ethernet device is serving dhcp by my public ethernet device that receives the vpn request doesn't have dhcp enabled
11:01 < titov> do i need to enable dhcp on the public facing ethernet?
11:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
11:03 < Bushmills> you don't need dhcp at all for openvpn
11:04 < Bushmills> server assigns addresses to connecting clients
11:04 < titov> Bushmills, thanks for clarifying that
11:05 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
11:06 -!- mode/#openvpn [+v Axeman] by ChanServ
11:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:14 -!- grendal_prime [~sgraham@2001:470:822a:200:21e:c9ff:fe07:bb9] has quit [Quit: Ex-Chat]
11:38 -!- antmindz [~antminds@182.55.128.134] has joined #openvpn
11:45 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:45 -!- mode/#openvpn [+o mattock] by ChanServ
11:46 -!- patelx [~a@openvpn/corp/admin/patel] has quit [Quit: ircN 8.00 for mIRC (20080809) - www.ircN.org]
11:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
11:56 -!- patelx [~a@openvpn/corp/admin/patel] has joined #openvpn
11:56 -!- mode/#openvpn [+o patelx] by ChanServ
12:00 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:09 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
12:11 -!- antmindz [~antminds@182.55.128.134] has quit [Ping timeout: 260 seconds]
12:17 -!- corretico [~luis@201.201.44.82] has joined #openvpn
12:18 -!- BlakHawk [blackhawk@exploits.dotslash.ca] has joined #openvpn
12:27 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:27 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:27 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:36 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
12:40 <@vpnHelper> RSS Update - forum: client-to-client routing issue <http://forums.openvpn.net/topic8551.html>
12:45 -!- James [~james@89.207.135.150] has joined #openvpn
12:45 -!- James is now known as Guest95872
12:47 -!- Guest95872 [~james@89.207.135.150] has quit [Client Quit]
12:58 -!- EugeneKaway [EugeneKay@eugenekay.com] has quit [Ping timeout: 255 seconds]
13:10 <@vpnHelper> RSS Update - forum: client-to-client routing issue <http://forums.openvpn.net/topic8551.html#p14080>
13:13 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
13:14 -!- axelm7 [~axelm@201.255.22.142] has joined #openvpn
13:15 < axelm7> !welcome
13:15 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:15 < axelm7> !sample
13:15 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
13:26 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
13:29 -!- K1ng [~KING@180.211.188.12] has quit [Ping timeout: 258 seconds]
13:31 -!- style [style@richardt.fi] has left #openvpn []
13:32 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
13:33 -!- gorkhaan [~gorkhaan@catv-89-135-155-150.catv.broadband.hu] has joined #openvpn
13:35 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
13:35 -!- mode/#openvpn [+v Axeman] by ChanServ
13:36 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Client Quit]
13:43 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
13:47 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Quit: Going offline, see ya! (www.adiirc.com)]
13:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:02 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:25 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:28 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html>
14:34 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Wibbly Wobbly IRC]
14:35 -!- gorkhaan [~gorkhaan@catv-89-135-155-150.catv.broadband.hu] has quit [Ping timeout: 240 seconds]
14:35 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
14:36 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 252 seconds]
14:37 -!- LuckyY_ is now known as LuckyY
14:42 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
14:49 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
14:49 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
14:49 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:58 <@vpnHelper> RSS Update - forum: [Solved] Redirect-gateway Reroutes Everything to the Servers <http://forums.openvpn.net/topic8467.html#p14083> || One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14082>
15:00 -!- titov [a3cd46ba@gateway/web/freenode/ip.163.205.70.186] has quit [Quit: Page closed]
15:01 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
15:04 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14086> || linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14085> || VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14084>
15:10 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14087>
15:16 < axelm7> hi, I am an openvpn noob trying to get install on a centos5.4 box at the office. At home I am running Fedora 15 vpnc. I portforwarded the office firewall's 1194/udp to the centos box and opened 1194/udp on the firewall. When I connect from home the openvpn daemon stops running on the server. I can't find any mentions of openvpn in /var/log/messages. Where are the logs stored?
15:16 <@vpnHelper> RSS Update - forum: VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14089> || One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14088>
15:20 -!- bonks [~randres@unaffiliated/bonks] has joined #openvpn
15:20 < bonks> !welcome
15:20 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:21 < bonks> !goal
15:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:27 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
15:28 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:38 < bonks> so what's the cheapest way to secure all my data from my isp and prevent them from snooping?
15:41 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14090>
15:45 < Bushmills> !redirect-gateway
15:45 < Bushmills> !redirect
15:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
15:46 < Bushmills> don't forget nameserver
15:46 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14092>
15:47 -!- Corey [~KB1JWQ@freenode/staff/birthday-spankings/KB1JWQ] has left #openvpn []
15:47 < bonks> !def1
15:47 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
15:48 < bonks> !ipforward
15:48 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:48 < bonks> !linipforward
15:48 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:48 < bonks> !nat
15:48 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:49 -!- EugeneK [EugeneKay@eugenekay.com] has joined #openvpn
15:53 -!- EugeneK is now known as EugeneKay
16:03 < axelm7> anybody here know how to allow tun+ traffic using fwbuilder?
16:04 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:04 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14093>
16:04 < axelm7> tun0 does not exist until openvpn is running, I need to work arounf this problem.
16:06 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
16:08 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
16:12 < bonks> does openvpn.net list their endpoint locations for their vpn service?
16:12 < bonks> or do they let you choose the endpoint's location?
16:19 < Bushmills> beg your pardon?
16:20 < Bushmills> !goal
16:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:27 < bonks> I'd rather pay for a vpn service rather than set up my own vpn. I see openvpn has "ShieldExchange". Do they offer different network locations to connect to? Does it matter?
16:29 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14094>
16:30 -!- warriorforGod [~warriorfo@unaffiliated/warriorforgod] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
16:35 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14095>
16:37 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
16:37 -!- mode/#openvpn [+v Axeman] by ChanServ
16:41 <@vpnHelper> RSS Update - forum: VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14097> || One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14096>
16:46 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Read error: Operation timed out]
16:47 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
16:58 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:05 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
17:12 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:12 -!- mode/#openvpn [+v Axeman] by ChanServ
17:17 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14098>
17:29 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14099>
17:34 -!- axelm7 [~axelm@201.255.22.142] has quit [Ping timeout: 276 seconds]
17:34 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552.html#p14100>
17:36 -!- axelm7 [~axelm@201.255.22.142] has joined #openvpn
17:40 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:43 -!- bonks [~randres@unaffiliated/bonks] has left #openvpn []
17:45 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14101>
17:45 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
17:46 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:46 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:46 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:46 -!- mode/#openvpn [+v Axeman] by ChanServ
17:47 < axelm7> finally got openvpn to work on my centos box. problem was "Assertion failed at crypto.c:161". Apparently my openssl libraries are old. I change crypto to AES256CBC and now it's working
17:50 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 276 seconds]
17:50 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14102>
17:52 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
18:12 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
18:12 -!- mode/#openvpn [+v Axeman] by ChanServ
18:15 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14103>
18:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
18:27 -!- Squidy_at_Home [~quassel@189-31-23-67.cbace701.dsl.brasiltelecom.net.br] has joined #openvpn
18:28 -!- axelm7 [~axelm@201.255.22.142] has quit [Remote host closed the connection]
18:33 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14104>
18:45 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14105>
18:51 <@vpnHelper> RSS Update - forum: client-to-client routing issue <http://forums.openvpn.net/topic8551.html#p14106>
19:06 -!- newmember [~chatzilla@d216-232-99-220.bchsia.telus.net] has joined #openvpn
19:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
19:51 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:51 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:51 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:57 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html>
19:59 -!- yourself22 [~yourself2@c-98-220-113-1.hsd1.in.comcast.net] has joined #openvpn
20:02 -!- yourself22 [~yourself2@c-98-220-113-1.hsd1.in.comcast.net] has quit [Remote host closed the connection]
20:02 -!- Denial [~Denial@drgi.co.uk] has quit []
20:17 -!- master_of_master [~master_of@p57B52F63.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
20:17 -!- Squidy_at_Home [~quassel@189-31-23-67.cbace701.dsl.brasiltelecom.net.br] has quit [Remote host closed the connection]
20:19 -!- master_of_master [~master_of@p57B52887.dip.t-dialin.net] has joined #openvpn
20:22 -!- Squidy_at_Home [~quassel@189-31-41-215.cbace701.dsl.brasiltelecom.net.br] has joined #openvpn
20:32 -!- Squidy_at_Home [~quassel@189-31-41-215.cbace701.dsl.brasiltelecom.net.br] has quit [Ping timeout: 250 seconds]
20:33 -!- Squidy_at_Home [~quassel@201-67-97-226.cbace701.dsl.brasiltelecom.net.br] has joined #openvpn
20:46 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14108>
20:54 -!- GTAXL [~gtaxlnetw@oh-76-2-241-14.dhcp.embarqhsd.net] has joined #openvpn
20:55 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
20:58 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14109>
21:01 -!- Squidy_at_Home [~quassel@201-67-97-226.cbace701.dsl.brasiltelecom.net.br] has quit [Remote host closed the connection]
21:12 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
21:13 -!- _evor_ [~EvOr@midgard.adyxax.org] has joined #openvpn
21:15 -!- Dougy_ [me@tech.qsi.net] has joined #openvpn
21:15 -!- sia^pwnnt_ [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
21:15 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
21:15 -!- Dougy [me@openvpn/community/user/dougy] has quit [Read error: Connection reset by peer]
21:15 -!- EvOr [~EvOr@midgard.adyxax.org] has quit [Read error: Connection reset by peer]
21:15 -!- quadDamage [~EmperorTo@216.17.68.153] has quit [Read error: Connection reset by peer]
21:15 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has quit [Read error: Connection reset by peer]
21:15 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 276 seconds]
21:15 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 276 seconds]
21:15 -!- reiffert_ [~thomas@mail.reifferscheid.org] has joined #openvpn
21:15 -!- quadDama1e [~EmperorTo@216.17.68.153] has joined #openvpn
21:19 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
21:39 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
21:39 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
21:39 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
21:40 -!- mode/#openvpn [+v Axeman] by ChanServ
21:43 -!- newmember [~chatzilla@d216-232-99-220.bchsia.telus.net] has quit [Ping timeout: 258 seconds]
21:44 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
21:52 < EugeneKay> LOUD NOISES
22:16 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:22 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 258 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:38 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Quit: ZNC - http://znc.in]
22:44 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
22:44 -!- newmember [~chatzilla@66.183.103.108] has joined #openvpn
22:57 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
22:57 -!- mode/#openvpn [+v Axeman] by ChanServ
23:10 -!- pr0z0id [~pr0zoid@24-246-5-196.cable.teksavvy.com] has quit [Ping timeout: 240 seconds]
23:11 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
23:13 -!- [1]SigmaProjects is now known as SigmaProjects
23:29 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
23:29 < amero> how do we execute script on client side after they're connected to vpn server
23:35 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 252 seconds]
23:35 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
--- Day changed Sat Jul 30 2011
00:02 < EugeneKay> amero - http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html scroll down to "Script Order of Execution"
00:02 <@vpnHelper> Title: OpenVPN 2.2 (at openvpn.net)
00:03 < EugeneKay> Pick a hook, write a script, enjoy.
00:03 < EugeneKay> You're probably after --route-up
00:03 -!- antminds [~antminds@182.55.128.134] has joined #openvpn
00:22 <@vpnHelper> RSS Update - forum: Ubuntu9 I386 64 bit file for OpenVPN <http://forums.openvpn.net/topic8370.html#p14110>
00:27 < amero> if i manually add routes through the script, do i need another script to remove them when clients disconnect?
00:27 < EugeneKay> It's a good idea, yes.
00:28 < EugeneKay> There is existing functionality to handle that, mind.
00:47 < amero> ok
00:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
00:54 -!- EugeneKay is now known as EugeneKaway
00:54 -!- Guest91921 [~jay@ip72-218-235-170.hr.hr.cox.net] has joined #openvpn
00:58 -!- antminds [~antminds@182.55.128.134] has quit [Ping timeout: 250 seconds]
00:59 -!- Guest91921 [~jay@ip72-218-235-170.hr.hr.cox.net] has left #openvpn ["Leaving"]
01:22 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:34 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
01:34 < UnterPerro> apssword
01:35 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has left #openvpn []
02:02 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 240 seconds]
02:03 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
02:06 -!- amero [~amero@unaffiliated/amero] has quit [Client Quit]
02:11 <@vpnHelper> RSS Update - forum: Server setup confusion <http://forums.openvpn.net/topic8545.html#p14111>
02:17 <@vpnHelper> RSS Update - forum: [Solved] Server setup confusion <http://forums.openvpn.net/topic8545.html#p14111>
02:22 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
02:23 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 252 seconds]
02:23 -!- Cain` is now known as Cain
02:41 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14112>
02:59 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14113>
03:05 -!- ggergelz [~ggergely@catv-80-99-68-23.catv.broadband.hu] has joined #openvpn
03:05 <@vpnHelper> RSS Update - forum: VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14114>
03:05 < ggergelz> hello
03:06 < ggergelz> is there a built-in way to filter dhcp traffic on tap devices?
03:06 < ggergelz> ebtables is not really an option. ( tomato based router <-> freebsd )
03:09 < reiffert_> !ebtables
03:09 <@vpnHelper> "ebtables" is Linux uses ebtables for firewalling layer 2 bridges. See http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png to understand how layer 2 and layer 3 works in linux and how to use ebtables
03:10 < reiffert_> !factoids search --factoids ipf
03:10 <@vpnHelper> (factoids search [<channel>] [--values] [--{regexp} <value>] [<glob> ...]) -- Searches the keyspace for keys matching <glob>. If --regexp is given, it associated value is taken as a regexp and matched against the keys. If --values is given, search the value space instead of the keyspace.
03:10 <@vpnHelper> RSS Update - forum: client-to-client routing issue <http://forums.openvpn.net/topic8551.html#p14115>
03:10 < reiffert_> !factoids search --values ipf
03:10 <@vpnHelper> 'redirect', 'osxipforward', 'ipforward', 'serverlan', and 'clientlan'
03:10 < reiffert_> !factoids search --values fire
03:10 <@vpnHelper> 'dynamicfirewall', 'all', 'shorewall', 'firestarter', 'firewall', 'client-to-client', 'c2c', 'client-connect', 'basic', 'ebtables', 'bridge-fw', and 'iptables'
03:10 < reiffert_> !bridge-fw
03:10 <@vpnHelper> "bridge-fw" is "ebtables" is Linux uses ebtables for firewalling layer 2 bridges. See http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html and http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png to understand how layer 2 and layer 3 works in linux and how to use ebtables
03:15 < ggergelz> yeah, as i said, ebtables is not really an option
03:16 -!- ahoka [~ahoka@irkmaffia.com] has joined #openvpn
03:16 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14116>
03:16 < ahoka> sup
03:20 -!- GTAXL [~gtaxlnetw@oh-76-2-241-14.dhcp.embarqhsd.net] has quit [Ping timeout: 264 seconds]
03:27 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html>
03:43 -!- ggergelz [~ggergely@catv-80-99-68-23.catv.broadband.hu] has left #openvpn []
03:43 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
03:58 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:03 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14118>
04:15 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14120> || Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14119>
04:21 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14121>
04:23 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
04:33 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14122>
04:45 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14123>
04:45 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
04:51 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14124>
05:03 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14125>
05:18 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
05:26 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
05:26 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
05:26 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:31 -!- Rc43 [4fad503c@gateway/web/freenode/ip.79.173.80.60] has joined #openvpn
05:31 < Rc43> Hi.
05:32 < Rc43> I am newbie and want to know if it is possible set vpn connection without knowledge about gateway, etc.
05:32 < Rc43> I mean: I have all certificates and keys, but dont know addresses.
05:33 < Rc43> And I want to connect through VPN.
05:48 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
05:48 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
05:59 -!- toortog [~toortog@notsecure.net] has quit [Read error: Connection reset by peer]
06:01 -!- Rc43 [4fad503c@gateway/web/freenode/ip.79.173.80.60] has quit [Ping timeout: 252 seconds]
06:06 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
06:15 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14126>
06:16 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
06:21 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14127>
06:31 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 240 seconds]
06:39 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14128>
06:45 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14129>
06:51 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14130>
07:03 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14131>
07:05 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
07:12 -!- Bheam [michael@77.94.234.164] has joined #openvpn
07:12 < Bheam> hey hey
07:12 < Bheam> so if i run openvpn in peer2peer mode, does everyone need to know about all the peers, or will just signals relay through the hosts who know em?
07:12 < Bheam> and is there a limit on the number of peers?
07:13 < amero> peer2peer?
07:13 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:13 -!- mode/#openvpn [+v s7r] by ChanServ
07:13 < Bheam> "mode p2p"
07:15 < Bheam> and is it possible to combine bridging and p2p?
07:15 < amero> p2p is actually point-to-point, afaik
07:15 < amero> :p
07:15 < Bheam> and your point?
07:16 < Bheam> i mean, same difference
07:17 < krzee> Bheam, ptp mode theres only 2 endpoints
07:18 < krzee> each point
07:18 < krzee> no server, no clients
07:18 < krzee> thats why its not point to point*s*
07:18 < Bheam> but
07:19 < Bheam> if i connect A to B and B to C and C to A, i have 3 hosts in a network no? 
07:20 < Bheam> so anyway yea, the point is to avoid a server for optimal speed between hosts
07:20 < krzee> ok, sure
07:21 < krzee> in which case, why would you want a bridge?
07:21 < Bheam> oh, because i wanted all my computers to join my 2 other friends
07:21 < Bheam> without having to setup openvpn on all of them
07:21 < krzee> huh?
07:21 < krzee> oh your lan
07:22 < krzee> !route
07:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
07:22 < Bheam> yes.
07:22 < krzee> you dont need a bridge for that
07:22 < krzee> !tunortap
07:22 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
07:22 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
07:22 < Bheam> ok so just a virtual network adapter that uses the openvpn box as gateway?
07:22 < krzee> read !route
07:22 < krzee> i made a nice writeup for lans behind openvpn
07:23 < Bheam> ok
07:23 < Bheam> well i set up openvpn before, but that time i just used my actual lan ips and bridged over vpn to my friend who used the same subnet
07:24 < Bheam> then we just filtered dhcp over vpn
07:24 < Bheam> but now we both have shite routers that can't be chagned from 192.168.0.1 :p
07:25 < krzee> regardless, routing will be less overhead and more secure
07:25 < krzee> (more secure from the inside)
07:25 < Bheam> yea cool
07:26 < krzee> you only need tap when needing layer2 protocols
07:28 < Bheam> probably use tap so we can play old ipx games if we want :p
07:29 < krzee> thats valid
07:32 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14132>
07:34 -!- b_52globe [~b_52globe@41.248.182.102] has joined #openvpn
07:34 < b_52globe> hi guys
07:35 < krzee> ohi
07:38 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14133>
07:39 -!- stephenh [~stephenh@durbanpoizon.za.net] has quit [Changing host]
07:39 -!- stephenh [~stephenh@unaffiliated/stephenh] has joined #openvpn
07:50 -!- b_52globe [~b_52globe@41.248.182.102] has quit [Read error: Connection reset by peer]
07:57 -!- axelm7 [~axelm@201.255.22.142] has joined #openvpn
08:00 < axelm7> hi guys, I set up an openvpn box at the office and I am connecting from home. Server is 10.202.0.1 and I am 10.202.0.6. I can't ping the openvpn box and it's not the openvpn's firewall that's blocking me. Can you help me?
08:03 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
08:03 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
08:04 -!- b_52globe [~b_52globe@41.248.125.229] has joined #openvpn
08:09 -!- webhoster [adeaaaf7@gateway/web/freenode/ip.173.234.170.247] has joined #openvpn
08:09 < webhoster> May I present to you our service if someone needs it?
08:10 < webhoster> May I?
08:11 -!- BlakHawk [blackhawk@exploits.dotslash.ca] has quit [Quit: Lost terminal]
08:16 -!- webhoster [adeaaaf7@gateway/web/freenode/ip.173.234.170.247] has quit [Quit: Page closed]
08:19 < _zero_> j'ai une chambre à air mais pas les outils nécéssaires pour démonter la roue
08:19 < _zero_> oops.
08:22 < b_52globe> _zero_, c quelle genre de moto :D ?
08:30 < _zero_> un vélo :)
08:32 -!- Squidy_at_Home [~quassel@189.31.135.102] has joined #openvpn
08:34 < b_52globe> ok :d
08:36 < b_52globe> guys with my openvpn connection is reconnecting every 5s !
08:36 < b_52globe> i check the /var/log/syslog
08:36 < b_52globe> and i got
08:36 < b_52globe> http://pastie.org/2294469
08:37 < b_52globe> something about tun0 interface !
08:37 < b_52globe> plz any help about it ?
08:38 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
08:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
08:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:54 -!- techstaff [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:56 < techstaff> Hello all, may I present our web host services here?
09:02 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14134>
09:08 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14135>
09:10 < techstaff>  I just want to inform you our service webhosting from TECHNIHOST.COM
09:24 -!- techstaff [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
09:38 -!- EugeneKaway is now known as EugeneKay
09:50 < EugeneKay> b_52globe - NetworkManager makes me cry.
09:52 -!- nexus6__ [~derserver@h081217033132.dyn.cm.kabsi.at] has joined #openvpn
09:52 < nexus6__> !welcome
09:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:59 < b_52globe> EugeneKay,
09:59 < b_52globe> re
10:00 < b_52globe> EugeneKay, i don't use i start openvpn manually ?!
10:00 < EugeneKay> And that is why NetworkManager is freaking out about the unexpected device, and removing it.
10:01 < b_52globe> wait doing that now :d
10:02 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14136>
10:03 < b_52globe> EugeneKay, remove all networkManager :D i use it to manage wifi :)
10:06 < EugeneKay> Ewwwww linux laptop :-p
10:06 < b_52globe> ?
10:08 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14137>
10:09 < EugeneKay> I've never had any luck with making it work right. Ever.
10:12 < b_52globe> removed network manager but openvpn still reconnecting every 5s
10:13 < EugeneKay> !logs
10:13 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
10:13 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14138>
10:16 < b_52globe> EugeneKay, http://pastie.org/2294774 the part where it restart
10:17 -!- toortog [~toortog@notsecure.net] has joined #openvpn
10:24 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14139>
10:33 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 264 seconds]
10:34 -!- Squidy_at_Home [~quassel@189.31.135.102] has quit [Ping timeout: 246 seconds]
10:36 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14140>
10:38 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
10:40 -!- Squidy_at_Home [~quassel@189.75.76.147] has joined #openvpn
10:47 -!- b_52globe [~b_52globe@41.248.125.229] has quit [Read error: Connection reset by peer]
10:48 -!- Squidy_at_Home [~quassel@189.75.76.147] has quit [Ping timeout: 240 seconds]
10:48 -!- Squidy_at_Home [~quassel@189.73.210.218] has joined #openvpn
10:49 -!- derserver_ [~derserver@h081217033132.dyn.cm.kabsi.at] has joined #openvpn
10:52 -!- derserver_ [~derserver@h081217033132.dyn.cm.kabsi.at] has left #openvpn []
10:54 -!- nexus6__ [~derserver@h081217033132.dyn.cm.kabsi.at] has quit [Ping timeout: 260 seconds]
11:00 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14141>
11:01 -!- nexus6__ [~derserver@h081217033132.dyn.cm.kabsi.at] has joined #openvpn
11:04 -!- b_52globe [~b_52globe@41.248.125.229] has joined #openvpn
11:12 <@vpnHelper> RSS Update - forum: Best Configuration <http://forums.openvpn.net/topic8557.html>
11:13 -!- toortog [~toortog@notsecure.net] has quit [Ping timeout: 246 seconds]
11:16 -!- toortog [~toortog@notsecure.net] has joined #openvpn
11:18 <@vpnHelper> RSS Update - forum: VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14143>
11:23 -!- Squidy_at_Home_ [~quassel@187.54.243.156] has joined #openvpn
11:23 -!- Squidy_at_Home [~quassel@189.73.210.218] has quit [Ping timeout: 250 seconds]
11:24 <@vpnHelper> RSS Update - forum: Best Configuration <http://forums.openvpn.net/topic8557.html#p14144>
11:30 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14145>
11:34 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
11:36 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
11:37 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 252 seconds]
11:37 -!- Cain` is now known as Cain
11:42 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14146>
11:54 <@vpnHelper> RSS Update - forum: Client keep reconnecting every 5s ! <http://forums.openvpn.net/topic8558.html>
11:55 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:05 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
12:18 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555.html#p14148>
12:28 -!- atem [~atum@wheel.sh] has quit [Quit: leaving]
12:29 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 250 seconds]
12:30 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
12:49 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555-15.html#p14149>
12:54 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
13:00 -!- danryan [~dryan@li115-70.members.linode.com] has joined #openvpn
13:05 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14150>
13:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:06 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
13:07 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 258 seconds]
13:11 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555-15.html#p14151>
13:39 < Kartagis> anyone to help?
13:42 < hyper_ch> no
13:44 < Kartagis> heh
13:45 < Kartagis> hyper_ch: once I have been told about a openvpn related project about mysql quth
13:45 < Kartagis> auth*
13:46 < Kartagis> I want to use this and take out cert stuff
13:46 < Kartagis> what do you think?
13:46 < hyper_ch> !mysql
13:46 < Kartagis> !search mysql
13:46 <@vpnHelper> There were no matching configuration variables.
14:05 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-15.html#p14152>
14:11 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
14:14 < farciarz84> Hi, I got from admin vpn access (keys, crts, and one conf file) [ubuntu]. Initializing vpn doesn't make any problem after given password. I'd like to know if the vpn can start automatically when my system wake-up. I guess the passparse it a blocker here. 
14:23 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-30.html#p14153>
14:26 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
14:27 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
14:37 < farciarz84> !goal
14:37 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:38 < farciarz84> I would like not to write password to my vpn accound eveytime I use it. 
14:39 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Quit: Lost terminal]
14:41 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
14:41 < EugeneKay> You'll need to use an openvpn binary that's built with the option to allow you to read passwords from a file.
14:42 < EugeneKay> auth-user-pass is he name of the option, I beleive
14:43 < EugeneKay> (the config option. The compile flag, I dunno. It's referenced in the man page for the config option, tho)
14:45 < farciarz84> EugeneKay: I start connection using '/etc/init.d/openvpn start myusername', the auth-user-pass is avaiable but in /bin/openvpn binary. Is it possible to use this bin to settle connection?
14:46 < EugeneKay> auth-user-pass by itself specifies that it should prompt. If you add a flename to that option(in your .conf file), it will read the user/pass from that file.
14:46 < EugeneKay> The standard distribution of openvpn does not support this, as it must be enabled at compile time.
14:46 < EugeneKay> This is because it is a "bad idea" security wise.
14:46 < EugeneKay> The whole point of auth-user-pass is to require user interaction to start the service.
14:47 < EugeneKay> You can recompile openvpn from source, but that is beyond the scope of IRC. Talk to your sysadmin about getting the user+pass requirement dropped.
14:49 < farciarz84> EugeneKay: In my company to main server is connecting to 2 networks via vpn (I saw it) and whole comapny has access to those networks out of the box. 
14:50 < farciarz84> maybe is doesn't use user+pass, what are different method to be authorized?
14:51 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14154>
14:51 -!- pr0zoid [~pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
15:00 < EugeneKay> The CN attached to the key+crt combo is what is usually used for unatttended vpns
15:03 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14156> || Help me, please! <http://forums.openvpn.net/topic8555-15.html#p14155>
15:08 -!- b_52globe [~b_52globe@41.248.125.229] has quit [Ping timeout: 240 seconds]
15:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
15:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:18 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Quit: Lost terminal]
15:21 <@vpnHelper> RSS Update - forum: How-to: 1 tunnel, with multiple WAN ip addresses. <http://forums.openvpn.net/topic8559.html>
15:22 -!- b_52globe [~b_52globe@41.140.228.230] has joined #openvpn
15:30 -!- Squidy_at_Home_ [~quassel@187.54.243.156] has quit [Remote host closed the connection]
15:35 -!- Squidy_at_Home [~quassel@187.54.243.156] has joined #openvpn
15:39 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-30.html#p14158>
15:43 -!- nexus6__ [~derserver@h081217033132.dyn.cm.kabsi.at] has quit [Quit: Verlassend]
15:45 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555-15.html#p14159>
16:03 < b_52globe> guys any help with this plz https://forums.openvpn.net/topic8558.html
16:03 <@vpnHelper> Title: OpenVPN Support Forum Client keep reconnecting every 5s ! : Server Administration (at forums.openvpn.net)
16:06 < pr0zoid> hey guys ... how do i remove a cert from the db?
16:07 < snappy> im trying to start openvpn in win7, right click the client.ovpn and start with openvpn; im guessing it doesnt start as Admin. Does anyone know the keys that need to be held down to right click and start as admin?
16:09 < pr0zoid> snappy: just right click and run as admin
16:09 < pr0zoid> but run the openvpn gui
16:09 < pr0zoid> not the config file
16:12 < snappy> ah ok
16:12 < snappy> that's probably what im doing wrong is i didnt start the gui as a admin
16:15 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:17 < pr0zoid> hey krzee..
16:17 < snappy> thanks pr0zoid, i realized i need to copy the config to the openvpn dir, and let the gui handle the rest
16:17 < snappy> looks like things are go
16:18 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 240 seconds]
16:21 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html>
16:23 < krzee> hey pr0zoid 
16:26 < pr0zoid> how can i delete a cert i no longer need..
16:27 < pr0zoid> i don't see a script for that
16:28 < krzee> !crl
16:28 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised., or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
16:28 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
16:30 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
16:33 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14162> || Tunnel/ Route all traffic for one IP (out of four) with OVPN <http://forums.openvpn.net/topic8562.html>
16:44 < pr0zoid> krzee: tried it but i'm seeing this :error 23 at 0 depth lookup:certificate revoked
16:45 < pr0zoid> nvm
16:46 < krzee> ;]
17:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:10 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
17:35 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Quit: Leaving]
17:39 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14163>
17:46 <@vpnHelper> RSS Update - forum: Not knowing what I don't know <http://forums.openvpn.net/topic8563.html>
17:58 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-30.html#p14165>
18:17 -!- antminds [~antminds@182.55.128.134] has joined #openvpn
18:28 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-30.html#p14166>
18:40 <@vpnHelper> RSS Update - forum: Not knowing what I don't know <http://forums.openvpn.net/topic8563.html#p14167>
18:40 -!- antminds [~antminds@182.55.128.134] has quit [Ping timeout: 260 seconds]
18:42 < EugeneKay> Hey, one of you advanced users. Does OpenVPN in routed mode work with protocols other than tcp/udp, ie, proto41(6in4) ?
18:42 < EugeneKay> I'm trying to think up how to give my laptop a routed /56 or so, that won't break when I travel.
18:46 <@vpnHelper> RSS Update - forum: Tunnel/ Route all traffic for one IP (out of four) with OVPN <http://forums.openvpn.net/topic8562.html#p14168>
18:58 -!- b_52globe [~b_52globe@41.140.228.230] has quit [Remote host closed the connection]
19:10 -!- EugeneKay is now known as EugeneKaway
19:34 -!- EugeneKaway is now known as EugeneKay
19:45 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:45 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
19:45 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
19:45 -!- mode/#openvpn [+v Axeman] by ChanServ
20:02 -!- Squidy_at_Home [~quassel@187.54.243.156] has quit [Remote host closed the connection]
20:04 -!- Squidy_at_Home [~quassel@187.54.243.156] has joined #openvpn
20:17 -!- master_of_master [~master_of@p57B52887.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:19 -!- master_of_master [~master_of@p57B544DB.dip.t-dialin.net] has joined #openvpn
20:24 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Quit: Lost terminal]
20:25 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:31 -!- EugeneKay is now known as EugeneKaway
20:39 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
21:03 < amero> besides disabling cipher, what else i could do to minimize openvpn overhead as much as possible?
21:03 < snappy> disabling cipher?
21:04 < snappy> oh i guess i see a use case; you might want to enable compression if you're trying to lower bandwidth
21:05 < snappy> lower or reduce bandwidth, unless you're considering cpu overhead
21:05 < amero> yup. i don't need encryption since i only use this vpn for generic downloading
21:05 < snappy> but lzo is wicked fast
21:09 < amero> doesn't having compression enabled cause stuttering and longer buffering in video streaming?
21:10 < amero> or is that encryption
21:11 < snappy> encryption will compress anyway
21:12 < snappy> if the video stream is already compressed, it's probably not wise.
21:20 -!- axelm_ [~axelm@201.255.23.153] has joined #openvpn
21:24 -!- axelm7 [~axelm@201.255.22.142] has quit [Ping timeout: 264 seconds]
21:26 <@vpnHelper> RSS Update - forum: How-to: Tunnel WAN IP assigned to specific users <http://forums.openvpn.net/topic8559.html>
21:29 -!- Squidy_at_Home [~quassel@187.54.243.156] has quit [Remote host closed the connection]
21:40 -!- Denial [~Denial@drgi.co.uk] has quit []
21:49 < snappy> I know it says not to use duplicate-cn, but are there any issues associated with it?
21:49 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Quit: leaving]
21:55 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 260 seconds]
21:55 -!- antminds [~antminds@182.55.128.134] has joined #openvpn
22:04 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
22:08 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Changing host]
22:08 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
22:16 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:17 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Quit: leaving]
22:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:21 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 250 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:58 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
23:03 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
23:08 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Ping timeout: 250 seconds]
23:09 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
23:19 -!- worstadmin [~worst@adsl-072-156-184-060.sip.bhm.bellsouth.net] has joined #openvpn
23:19 < worstadmin> How can I specifically specify the interface name I'd like openvpn to run on. I need to specify it for a bridge I'm creating
23:20 < worstadmin> dev tap I assume suggests its a bridge type site to site so is there perhaps a device-name?
23:21 < worstadmin> dev-type tap
23:21 < worstadmin> dev br3
23:21 < worstadmin> Is that possible?
23:22 < snappy> worstadmin: an ip address on the bridge
23:22 < worstadmin> Correct
23:22 < snappy> that wasn't a question.
23:22 < worstadmin> Well I applaud your use of camouflage 
23:24 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
23:36 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Quit: where wizards stay up late...]
23:39 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14169>
23:40 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
--- Day changed Sun Jul 31 2011
00:07 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Quit: where wizards stay up late...]
00:11 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
00:39 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14170>
00:42 -!- EugeneKaway is now known as EugeneKay
00:47 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
00:48 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
00:51 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14171>
01:01 < Bushmills> worstadmin: you can specify tun/tap number,  like   dev tap2
01:01 < Bushmills> !tunortap
01:01 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
01:01 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
01:02 < Bushmills> openvpn has nothing to do with your bridge. it is up to you to add interfaces to bridges, not to openvpn
01:03 < Bushmills> snappy: ^^^
01:04 < snappy> okeydoke.
02:06 -!- antminds [~antminds@182.55.128.134] has quit [Ping timeout: 252 seconds]
02:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
02:15 <@vpnHelper> RSS Update - forum: Tunnel/ Route all traffic for one IP (out of four) with OVPN <http://forums.openvpn.net/topic8562.html#p14172>
02:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:56 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Ping timeout: 250 seconds]
02:58 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
03:03 <@vpnHelper> RSS Update - forum: Not knowing what I don't know <http://forums.openvpn.net/topic8563.html#p14173>
03:22 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 240 seconds]
03:23 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
03:24 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
03:25 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
03:27 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14174>
03:28 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Client Quit]
03:29 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
03:29 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
03:29 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: Not knowing what I don't know <http://forums.openvpn.net/topic8563.html#p14175>
03:51 <@vpnHelper> RSS Update - forum: Tunnel/ Route all traffic for one IP (out of four) with OVPN <http://forums.openvpn.net/topic8562.html#p14176>
04:09 <@vpnHelper> RSS Update - forum: Tunnel/ Route all traffic for one IP (out of four) with OVPN <http://forums.openvpn.net/topic8562.html#p14177>
04:20 -!- EugeneKay is now known as EugeneKaway
04:39 <@vpnHelper> RSS Update - forum: Tunnel/ Route all traffic for one IP (out of four) with OVPN <http://forums.openvpn.net/topic8562.html#p14178>
04:40 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
04:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:09 <@vpnHelper> RSS Update - forum: Best Configuration <http://forums.openvpn.net/topic8557.html#p14179>
05:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:31 < hyper_ch> krzee: howdy
05:34 <@vpnHelper> RSS Update - forum: Tunnel/ Route all traffic for one IP (out of four) with OVPN <http://forums.openvpn.net/topic8562.html#p14180>
05:42 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
05:42 -!- mode/#openvpn [+v Axeman] by ChanServ
05:43 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 246 seconds]
05:47 -!- reiffert_ is now known as reiffert
05:50 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
06:05 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 255 seconds]
06:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
06:07 -!- antminds [~antminds@182.55.128.134] has joined #openvpn
06:07 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
06:10 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:18 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:18 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:18 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
06:19 -!- mode/#openvpn [+v Axeman] by ChanServ
06:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
06:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:43 -!- mode/#openvpn [+v s7r] by ChanServ
06:52 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
07:07 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
07:07 -!- mode/#openvpn [+v Axeman] by ChanServ
07:12 -!- antminds [~antminds@182.55.128.134] has quit []
07:28 <@vpnHelper> RSS Update - forum: Tunnel/ Route all traffic for one IP (out of four) with OVPN <http://forums.openvpn.net/topic8562.html#p14181>
07:31 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
07:46 <@vpnHelper> RSS Update - forum: [Solved] Openvpn latest version? <http://forums.openvpn.net/topic8548.html#p14062>
07:48 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
08:06 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:08 < genlime> what is the difference between using topology subnet and not using topology subnet? 
08:13 < reiffert> !factoids search subnet
08:13 <@vpnHelper> 'subnet' and 'samesubnet'
08:13 < reiffert> !factoids search topology
08:13 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
08:13 < reiffert> !/30
08:13 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
08:14 < reiffert> !subnet
08:14 <@vpnHelper> "subnet" is http://www.subnet-calculator.com/ or http://en.wikipedia.org/wiki/Subnetwork
08:16 < genlime> Will it affect the internet connection of the clients?
08:18 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
08:18 < genlime> why do it needs to give 4 ip per client?
08:20 < ecrist> genlime: we've explained this to you a few times now.
08:20 < ecrist> you don't 'need' to
08:20 < ecrist> !topology
08:20 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
08:20 < ecrist> !/30
08:20 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
08:21 < genlime> ecrist, yes it was informed but I really dont know why when not using topology give 4 ip per client. why the need to give 4 ips?
08:21 < ecrist> because that's how subnetting works.
08:21 <@vpnHelper> RSS Update - forum: Connecting 3 sites together <http://forums.openvpn.net/topic8564.html>
08:22 < ecrist> you need a network address and broadcast address, plus the two IPs for th PTP links
08:22 < genlime> ecrist, really?
08:22 < ecrist> genlime: yes, really
08:22 < genlime> so if I use topology, it will not give network address, broadcast address and two ip for ptp links?  
08:23 < ecrist> correct
08:23 < genlime> since topology will only give 1 ip per client
08:23 < genlime> so is it important for each client to have 4 ips rather than using topology subnet?
08:24 < genlime> ecrist, so is it important for each client to have 4 ips rather than using topology subnet?
08:27 < genlime> ecrist man, can you please reply. I dont know if topology is really useful or is it important to use 4 ips per client
08:36 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
08:37 < genlime> ecrist man, can you please reply. I dont know if topology is really useful or is it important to use 4 ips per client
08:37 <@vpnHelper> RSS Update - forum: Connecting 3 sites together <http://forums.openvpn.net/topic8564.html#p14183>
08:40 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
08:40 < ecrist> heh, impatient much?
08:51 < hyper_ch> hi ecrist
08:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:01 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
09:06 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:06 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
09:06 <@vpnHelper> RSS Update - forum: Connecting 3 sites together <http://forums.openvpn.net/topic8564.html#p14185>
09:07 < genlime> is no-replay a server or a client option?
09:08 < genlime> and no-iv a server or client option?
09:09 < genlime> need help here 
09:12 <@vpnHelper> RSS Update - forum: Connecting 3 sites together <http://forums.openvpn.net/topic8564.html#p14186>
09:12 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Quit: Page closed]
09:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:18 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
09:24 <@vpnHelper> RSS Update - forum: Connecting 3 sites together <http://forums.openvpn.net/topic8564.html#p14187>
09:31 < Bushmills> genlime, try to demand help, so that folks here are able to appreciate how much in need of it you are
09:33 -!- ahoka [~ahoka@irkmaffia.com] has left #openvpn []
10:00 -!- qsp [~qsp@bl17-16-179.dsl.telepac.pt] has joined #openvpn
10:03 -!- luneff [~yury@84.51.192.236] has joined #openvpn
10:11 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
10:11 -!- mode/#openvpn [+v Axeman] by ChanServ
10:12 <@vpnHelper> RSS Update - forum: Best Configuration <http://forums.openvpn.net/topic8557.html#p14188>
10:19 < dijital1> anyone know of hardware devices that have openvpn *client* support?
10:28 -!- Squidy_at_Home [~quassel@187.54.243.156] has joined #openvpn
10:28 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
10:31 <@vpnHelper> RSS Update - forum: Connecting 3 sites together <http://forums.openvpn.net/topic8564.html#p14189>
10:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
11:09 -!- mastermind959 [~mastermin@frbg-5d84e27c.pool.mediaWays.net] has joined #openvpn
11:13 <@vpnHelper> RSS Update - forum: Connecting 3 sites together <http://forums.openvpn.net/topic8564.html#p14190>
11:13 -!- qsp [~qsp@bl17-16-179.dsl.telepac.pt] has quit [Remote host closed the connection]
11:14 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
11:16 < mastermind959> Hi! I recently set up my VPN server and succesfully connected to it with a client. I don't push a gateway, so the client should still have acces to the normal internet when connected. This works flawlessly on a windows 7 client, but when a friend tries to connect to it with the same configuration-file from and xp client, it cuts of his internet connection... my server configuration: http://bit.ly/nEEVR0 client configuration: http
11:16 <@vpnHelper> Title: Server OpenVPN Configuration - Pastebin.com (at bit.ly)
11:19 < mastermind959> server: http://pastebin.com/r3RWxyxE client: http://pastebin.com/p6CdMLgn
11:22 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
11:24 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
11:24 <@vpnHelper> RSS Update - forum: Strange Connection Issue <http://forums.openvpn.net/topic8497.html#p14191>
11:33 -!- EugeneKaway is now known as EugeneKay
11:37 -!- Cain` [~Geek@unaffiliated/cain] has joined #openvpn
11:37 <@vpnHelper> RSS Update - forum: Client keep reconnecting every 5s ! <http://forums.openvpn.net/topic8558.html#p14192>
11:37 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
11:37 -!- mode/#openvpn [+v Axeman] by ChanServ
11:38 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 252 seconds]
11:38 -!- Cain` is now known as Cain
11:43 <@vpnHelper> RSS Update - forum: VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14193>
11:45 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
11:49 <@vpnHelper> RSS Update - forum: No Internet on XP client, but on Win7 client <http://forums.openvpn.net/topic8565.html>
11:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.2]
11:51 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
12:00 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.2]
12:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:02 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
12:03 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
12:03 -!- mode/#openvpn [+v Axeman] by ChanServ
12:03 -!- mastermind959 [~mastermin@frbg-5d84e27c.pool.mediaWays.net] has quit [Quit: Leaving]
12:11 < EvilGuru> Am I correct in thinking that if I want to listen on both TCP and UDP ports that I need two OpenVPN instances.  If these instances are for bridging will I need to bridge all three (eth<n> tap0 tap1) together?
12:11 < reiffert> yup
12:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:12 <@vpnHelper> RSS Update - forum: No Internet on XP client, but on Win7 client <http://forums.openvpn.net/topic8565.html#p14195>
12:13 < EvilGuru> I guess for routing it is more of a pain as the TCP and UDP would need to use different IP pools?
12:17 < reiffert> you could use one central dhcp service for your setup.
12:29 <@vpnHelper> RSS Update - forum: Connecting 3 sites together <http://forums.openvpn.net/topic8564.html#p14196>
12:36 -!- jay [~jay@ip72-218-235-170.hr.hr.cox.net] has joined #openvpn
12:36 -!- jay is now known as Guest13469
12:44 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:53 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14197>
12:59 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555-15.html#p14198>
13:05 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555-15.html#p14199>
13:17 -!- Guest13469 [~jay@ip72-218-235-170.hr.hr.cox.net] has left #openvpn ["Leaving"]
13:17 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Quit: Leaving]
13:19 -!- Riz [~riz@syn.theintertubes.ca] has quit [Ping timeout: 264 seconds]
13:20 -!- Riz [~riz@syn.theintertubes.ca] has joined #openvpn
13:41 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
13:44 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 255 seconds]
13:49 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
14:02 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
14:05 -!- xanthaos [~xanthaos@71-92-2-230.dhcp.stls.mo.charter.com] has joined #openvpn
14:05 < xanthaos> getting ready to mknod /dev/net/tun c 10 200 but I need to know if this major/minor is right for Fedora 14. Can anyone elaborate?
14:22 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
14:22 -!- mode/#openvpn [+v Axeman] by ChanServ
14:37 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
14:41 < Optic> mo
14:43 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
14:43 -!- mode/#openvpn [+v Axeman] by ChanServ
14:46 -!- xanthaos [~xanthaos@71-92-2-230.dhcp.stls.mo.charter.com] has quit []
14:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: brb]
14:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:55 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
14:56 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
14:57 -!- acclaimpc [~karmst@s1.acclaimpc.com] has joined #openvpn
14:57 < acclaimpc> Hello
14:57 < acclaimpc> iptables service not started because of error (SVC_RUN_EXCEPT)
14:57 < acclaimpc> has anyone seen that error before?
14:59 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555-15.html#p14200>
15:02 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
15:02 < acclaimpc> that didn't help
15:02 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:04 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:07 -!- EugeneKay is now known as EugeneKaway
15:12 < ScriptFanix> acclaimpc: this has nothing to do with openvpn, ask on the support channel of your distribution
15:12 < acclaimpc> but iptables starts and stops just find from CLI
15:13 < ScriptFanix> iptables is not part of openvpn
15:16 -!- acclaimpc [~karmst@s1.acclaimpc.com] has quit [Quit: Leaving]
15:55 -!- Squidy_at_Home [~quassel@187.54.243.156] has quit [Remote host closed the connection]
16:28 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
16:30 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 246 seconds]
16:48 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14201>
16:56 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
16:58 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
16:58 -!- mode/#openvpn [+v Axeman] by ChanServ
16:59 -!- EugeneKaway is now known as EugenePhone
17:07 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:08 -!- xizhendu [~xizhendu@202.108.72.168] has quit [Ping timeout: 258 seconds]
17:09 < Bushmills> dijital1: "hardware devices that have openvpn *client* support?" - desktop computers. mobile computers. 
17:09 -!- axelm_ [~axelm@201.255.23.153] has quit [Ping timeout: 264 seconds]
17:09 -!- axelm_ [~axelm@201.255.8.28] has joined #openvpn
17:09 < dijital1> Sorry, I should have  been more clear. routing/gateway devices
17:10 -!- xizhendu [~xizhendu@202.108.72.168] has joined #openvpn
17:10 < Bushmills> openwrt reflashed routers
17:10 < dijital1> those are the only ones?
17:10 < Bushmills> i didn't say that. i wasn't aware that i now had to list all devices in existence
17:11 < dijital1> sorry.. I'l goto openwrt.org and see if they have anything new that supports openwrt
17:11 -!- missttea [~miss@71.21.164.84] has joined #openvpn
17:13 < Bushmills> netgear wrt3700.  some buffalo routers.  tp-link wr1043nd 
17:14 < Bushmills> buffalo wzr-hp-g300n, specifically
17:14 -!- EugenePhone is now known as EugeneKaway
17:14 < Bushmills> wndr3700 was the netgear
17:14 < dijital1> ooooh
17:14 < dijital1> I have one of those
17:14 < dijital1> you're sure it's supported? I don't see i on the list
17:14 < Bushmills> i'm sure
17:15 < Bushmills> which one?
17:15 < dijital1> I have a V1 and a V2
17:15 < dijital1> I just bought the V2
17:16 < dijital1> I guess the V2 would be better to use?
17:16  * Bushmills doesn't remember having mentioned any v1 or v2
17:16 < dijital1> sory
17:17 < dijital1> I have a wndr3700
17:17 < Bushmills> http://wiki.openwrt.org/toh/netgear/wndr3700
17:18 < dijital1> which FS would you use? squash or jffs2?
17:18 < Bushmills> squash
17:21 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:21 -!- EugeneKaway is now known as EugeneKay
17:24 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
17:29 < dijital1> thanks mate
17:29 < dijital1> no idea that my device was supported
17:30 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
17:30 -!- mode/#openvpn [+v Axeman] by ChanServ
17:34 <@vpnHelper> RSS Update - forum: [solved] Connecting 3 sites together <http://forums.openvpn.net/topic8564.html#p14203> || linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14202>
17:39 < dijital1> Bushmills now is openvpn support going to have to be added or is it already built in? (router is still flashing)
17:40 < Bushmills> you add openvpn which is in openwrt's package repository
18:15 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:16 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
18:16 -!- jaminja [~jaminja@212.7.195.193] has quit [Changing host]
18:16 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
18:24 -!- dinkyd00 [~yo@92.240.249.28] has joined #openvpn
18:24 < dinkyd00> I'm confused, does it cost money to use openvpn?
18:25 < snappy> no
18:25 < dinkyd00> excellent.  thanks, snappy!! ;)
18:26 -!- dinkyd00 [~yo@92.240.249.28] has quit [Client Quit]
18:31 -!- missttea [~miss@71.21.164.84] has quit [Quit: Leaving]
18:39 -!- delebre2 [43a8cda6@gateway/web/freenode/ip.67.168.205.166] has joined #openvpn
18:39 < delebre2> Herrow! I could use some OpenVPN advice for someone who has a minute..
19:05 -!- Squidy_at_Home [~quassel@187.54.243.156] has joined #openvpn
19:09 < riffraff> whats up delebre, i got openvpn working
19:10 -!- worstadmin [~worst@adsl-072-156-184-060.sip.bhm.bellsouth.net] has quit [Ping timeout: 252 seconds]
19:10 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
19:10 < delebre2> Ok, so I use OpenVPN to connect to a remote server. I use a client on my PC to connect.. but what I really want, is to be able to run OpenVPN on the router level as a client, and send all my traffic on my whole LAN through that.
19:11 < riffraff> yeah did you follow any howto's
19:11 < riffraff> what kind of router
19:12 < riffraff> if you can flash it to openwrt or something its a snap
19:12 < delebre2> It has been flashed to OpenWRT
19:12 < delebre2> I have installed opkg openvpn
19:12 < delebre2> but I don't know how to take my certificates and place them on the router, how to configure the client, or have it connect, plus the routing tables
19:13 < riffraff> ok, you want to do this command line or gui or what. becuase i think luci has a gui that makes it easy
19:13 < riffraff> how are you generating your certs
19:15 < delebre2> Here is the deal, I pay for an encrypt OpenVPN account through a provider to help mask my torrent traffic from my ISP.
19:15 < delebre2> They provided the keys, certs. 
19:16 < delebre2> But, it's designed for the OpenVPN client in windows.
19:16 < delebre2> I assume I could take those same keys/certs and use them router level.
19:17 -!- Denial [~Denial@drgi.co.uk] has quit []
19:22 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:22 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
19:22 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
19:22 -!- mode/#openvpn [+v Axeman] by ChanServ
19:24 -!- worstadmin [~worst@adsl-072-156-184-060.sip.bhm.bellsouth.net] has joined #openvpn
19:25 -!- delebre2 [43a8cda6@gateway/web/freenode/ip.67.168.205.166] has quit [Ping timeout: 252 seconds]
19:31 -!- delebre2 [43a8cda6@gateway/web/freenode/ip.67.168.205.166] has joined #openvpn
19:35 -!- luneff [~yury@84.51.192.236] has quit [Quit: This computer has gone to sleep]
19:41 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:47 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
19:49 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 260 seconds]
19:57 -!- delebre2 [43a8cda6@gateway/web/freenode/ip.67.168.205.166] has quit [Quit: Page closed]
20:00 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
20:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
20:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:03 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
20:05 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Remote host closed the connection]
20:06 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
20:17 -!- master_of_master [~master_of@p57B544DB.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:19 -!- master_of_master [~master_of@p57B53067.dip.t-dialin.net] has joined #openvpn
20:25 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 260 seconds]
20:34 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:46 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
20:46 -!- mode/#openvpn [+v Axeman] by ChanServ
21:13 -!- pr0zoid [~pr0zoid@24-246-5-196.cable.teksavvy.com] has quit [Ping timeout: 240 seconds]
21:29 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
22:13 -!- adubz [~adub@pool-71-97-14-207.dfw.dsl-w.verizon.net] has joined #openvpn
22:13 < adubz> what is the command to run to verify vpn connectivity
22:16 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:16 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:26 -!- adubz [~adub@pool-71-97-14-207.dfw.dsl-w.verizon.net] has quit [Ping timeout: 250 seconds]
22:29 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:35 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 264 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:44 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:59 -!- Squidy_at_Home [~quassel@187.54.243.156] has quit [Remote host closed the connection]
23:05 < danryan> key folks, I am connecting two networks together using openvpn. I have an openvpn server running on each network, and each server is also a client of the other's. Basic VPN works correctly (clients attached to each VPN can connect/see the others), but I would like to bridge the two networks together, so that the clients on vpn1 can see the clients on vpn2 and vice versa
23:06 < danryan> I think what I need is mere iptables rules to forward traffic from the vpn1 range to the vpn2 range, but I can't seem to get those rules down.
23:06 < danryan> here's my bash history, just to give you an idea of what I've tried :) https://gist.github.com/004fe42e7c413fbdae01
23:07 <@vpnHelper> Title: danryan's gist: 004fe42e7c413fbdae01 Gist (at gist.github.com)
23:08 < danryan> I updated the gist with my ifconfig output on each server
23:14 < danryan> I'm able to see traffic for vpn2's ip range (ICMP, TCP) being routed from a client on vpn1
23:23 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
23:53 -!- adubz [~adub@pool-71-97-14-207.dfw.dsl-w.verizon.net] has joined #openvpn
23:54 < adubz> is there an openvpn command to verify vpn connectivity
--- Day changed Mon Aug 01 2011
00:10 -!- EugeneKay is now known as EugeneKaway
00:24 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 246 seconds]
00:35 -!- dazo_afk is now known as dazo
00:49 < Bushmills> !route
00:49 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
00:49 < Bushmills> danryan: ^^^
00:50 < Bushmills> with two openvpn servers, you essentially have the scenario of clients behind LAN and WAN
00:59 <@vpnHelper> RSS Update - forum: Help me, please! <http://forums.openvpn.net/topic8555-15.html#p14204>
01:01 < danryan> !tcpip
01:01 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
01:02 < danryan> Thanks Bushmills! I'll peruse that article
01:11 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14205>
01:33 -!- worstadmin [~worst@adsl-072-156-184-060.sip.bhm.bellsouth.net] has quit [Ping timeout: 250 seconds]
01:42 -!- kartmetal_ [~kartofeln@unaffiliated/kartofeln] has joined #openvpn
01:48 -!- kartmetal_ is now known as kartmetal
01:54 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14206>
01:54 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has quit [Ping timeout: 240 seconds]
02:02 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has joined #openvpn
02:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
02:19 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 276 seconds]
02:23 -!- luneff [~yury@84.51.192.236] has joined #openvpn
02:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:28 -!- K1ng`` [~KING@180.211.188.238] has joined #openvpn
02:29 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:30 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Remote host closed the connection]
02:30 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
02:31 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 260 seconds]
02:32 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
02:34 -!- K1ng`` [~KING@180.211.188.238] has quit [Ping timeout: 276 seconds]
02:51 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
03:03 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has quit [Remote host closed the connection]
03:05 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has joined #openvpn
03:12 -!- kartmetal [~kartofeln@unaffiliated/kartofeln] has quit [Ping timeout: 258 seconds]
03:21 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:30 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
03:36 < Mowee> Morning
03:37 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:37 -!- mode/#openvpn [+o mattock] by ChanServ
03:38 -!- X-Raimo [d4f8080a@opensuse/member/raimoschmidt] has joined #openvpn
03:38 < X-Raimo> hello people of openvpn
03:39 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14207>
03:39 < X-Raimo> I have problem: http://paste.org.ru/?1yk2mr
03:40 < X-Raimo> client side - openbsd 4.9  server side - arch linux
03:42 < X-Raimo> fixed
03:42 -!- X-Raimo [d4f8080a@opensuse/member/raimoschmidt] has quit [Client Quit]
03:52 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
04:10 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html>
04:13 -!- luneff [~yury@84.51.192.236] has quit [Quit: This computer has gone to sleep]
04:18 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 276 seconds]
04:19 -!- eliasson1 [~wizard@91.198.48.20] has quit [Ping timeout: 250 seconds]
04:19 -!- natanoj [~jonatan@yogi.akerlind.nu] has joined #openvpn
04:20 < natanoj> !welcome
04:20 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:20 < natanoj> !goal
04:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:21 -!- eliasson_ [~wizard@91.198.48.20] has joined #openvpn
04:22 < natanoj> hi, i have a problem that have emerged after an upgrade (sorry, can't tell exactly if it is the pkcs11-provider (opensc/openct) or openvpn itself), i have a card-reader (aladdin e-token) and openvpn keeps asking for the PIN each negotiation
04:22 < natanoj> it also asks for the pin twice the first time
04:23 < natanoj> i have openvpn 2.2.0, openct 0.6.20, opensc 0.12.1
04:24 < natanoj> read somewhere that script-security 2 system might make a difference, but that does not change anything for me
04:25 -!- X-Raimo [d4f8080a@opensuse/member/raimoschmidt] has joined #openvpn
04:25 < natanoj> i have verbosity 5 but there is no indicator of anything wrong, will try a higher verbosity level now
04:26 < X-Raimo> hello. I have network behing my vpn client. How to route it to server
04:28 < X-Raimo> Here my connection schema: http://paste.org.ru/?0xgbki
04:30 < natanoj> hmmm, tried verb 99, see a few clues now
04:31 < natanoj> Mon Aug  1 11:27:25 2011 us=53991 PKCS#11: Private key operation failed rv=336-'CKR_BUFFER_TOO_SMALL'
04:31 < natanoj> Mon Aug  1 11:27:25 2011 us=54349 PKCS#11: Cannot get token information for provider 'OpenSC (www.opensc-project.org)' slot -3 rv=224-'CKR_TOKEN_NOT_PRESENT'
04:31 < natanoj> between the initial password prompts
04:31 < natanoj> and then it succeeeds
04:31 < natanoj> Mon Aug  1 11:27:25 2011 us=54505 PKCS#11: _pkcs11h_session_reset Found token manufacturerID='OpenSC Project' model='PKCS#15', serialNumber='28088614271A', label='OpenSC Card (VPN-token)'
04:32 < natanoj> time fur lunch, will check back soon
04:35 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:35 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:35 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:37 <@dazo> !tcp
04:37 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer), or (#3) if you must use tcp, you likely want --tcp-nodelay
04:41 -!- luneff [~yury@109.165.92.199] has joined #openvpn
04:43 -!- bitterman [~yury@109.165.92.199] has joined #openvpn
04:44 < X-Raimo> So my problem is that anyone from LAN behing VPN Server cannot ping nobody behin
04:44 < X-Raimo> behind client 
04:45 < X-Raimo> at server-side I added ccd with iroute
04:46 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-15.html#p14209>
04:46 -!- luneff [~yury@109.165.92.199] has quit [Ping timeout: 246 seconds]
05:02 < natanoj> btw, i do not have opensc linked with pcsc-lite, just openct
05:04 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p14210>
05:13 -!- bitterman is now known as luneff
05:14 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
05:14 -!- mode/#openvpn [+v Axeman] by ChanServ
05:16 -!- X-Raimo [d4f8080a@opensuse/member/raimoschmidt] has quit [Quit: Page closed]
05:29 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
05:30 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:30 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:30 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:52 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14211>
05:56 -!- xizhendu [~xizhendu@202.108.72.168] has quit [Quit: leaving]
05:57 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:57 -!- mode/#openvpn [+v s7r] by ChanServ
06:00 < Bushmills> !clientlan
06:00 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
06:00 <@vpnHelper> better explanation
06:00 < Bushmills> X-Raimo, ^^^
06:00 < Bushmills> !route
06:00 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
06:02 -!- qknight [~joachim@88.198.52.213] has joined #openvpn
06:03 < qknight> hi. i have a general vpn related question on windows 7: i would like to connect an external computer (in the internet) to my local network 192.168.1.0/24 and the remote computer should get a local ip like 192.168.1.16 and finally it should be able to access a cifs share
06:04 < qknight> does anyone know if that is possible with PPTP
06:08 < qknight> i do not want routing to be precise
06:09 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 250 seconds]
06:10 < qknight> i guess PPTP can't be used without also using 'routing'
06:19 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:19 -!- mode/#openvpn [+v s7r] by ChanServ
06:21 -!- luneff [~yury@109.165.92.199] has quit [Quit: Leaving]
06:26 -!- luneff [~yury@109.165.92.199] has joined #openvpn
06:28 -!- luneff [~yury@109.165.92.199] has quit [Read error: Connection reset by peer]
06:30 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
06:32 -!- luneff [~yury@109.165.92.199] has joined #openvpn
06:32 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14212>
06:38 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14213>
06:39 -!- bitterman [~yury@188.114.1.34] has joined #openvpn
06:41 -!- luneff [~yury@109.165.92.199] has quit [Ping timeout: 260 seconds]
06:46 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
06:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
07:02 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14214>
07:10 -!- axelm_ is now known as axelm7
07:21 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
07:21 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
07:21 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
07:26 < Bushmills> !pptp
07:26 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
07:26 <@vpnHelper> read about why to not use pptp, or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
07:29 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 276 seconds]
07:29 -!- bitterman [~yury@188.114.1.34] has quit [Quit: This computer has gone to sleep]
07:30 -!- adubz [~adub@pool-71-97-14-207.dfw.dsl-w.verizon.net] has quit [Quit: They see me trollin'  They hatin']
07:33 <@vpnHelper> RSS Update - forum: Windows 2003: (The DHCP Server sent a DHCPNACK message). <http://forums.openvpn.net/topic8567.html> || Multiple clients behind same nat adsl router <http://forums.openvpn.net/topic8526.html#p14215>
07:36  * ecrist keeps getting weird Google+ invites, quadDama1e suggests they're from this channel.
07:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
07:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:54 -!- Kobaz [~kobaz@its.kobaz.net] has joined #openvpn
07:55 < Kobaz> how would i get the openvpn server to bind to a specific ip address
07:55 < Kobaz> and not use all ips on the box
07:56 < Bushmills> --local
07:57 < Kobaz> what about the config file?
07:57 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 240 seconds]
07:57 <@dazo> !--
07:57 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
07:57 <@dazo> Kobaz: ^^ 
07:57 < Kobaz> oh okay
07:59 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
08:03 <@vpnHelper> RSS Update - forum: problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html#p14217>
08:09 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14220> || Auto-connect client at windows start <http://forums.openvpn.net/topic8541.html#p14219> || Error on installing openvpn package <http://forums.openvpn.net/topic8536.html#p14218>
08:15 <@vpnHelper> RSS Update - forum: Need Help unable to connect my openvpn with my home DHCP <http://forums.openvpn.net/topic8486.html#p14222> || Windows 2003: (The DHCP Server sent a DHCPNACK message). <http://forums.openvpn.net/topic8567.html#p14221>
08:21 <@vpnHelper> RSS Update - forum: [help]how Enable OpenVPN management console <http://forums.openvpn.net/topic8542.html#p14225> || linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14224> || Reserve an IP address from the DHCP server <http://forums.openvpn.net/topic8546.html#p14223>
08:33 <@vpnHelper> RSS Update - forum: problem with auth-user-pass-verify option <http://forums.openvpn.net/topic8523.html#p14227> || client-to-client routing issue <http://forums.openvpn.net/topic8551.html#p14226>
08:39 <@vpnHelper> RSS Update - forum: How-to: Tunnel WAN IP assigned to specific users <http://forums.openvpn.net/topic8559.html#p14228>
08:45 <@vpnHelper> RSS Update - forum: Client keep reconnecting every 5s ! <http://forums.openvpn.net/topic8558.html#p14230> || Strange Connection Issue <http://forums.openvpn.net/topic8497.html#p14229>
08:51 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14231>
08:52 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Quit: *puff*]
08:52 -!- Kobaz [~kobaz@its.kobaz.net] has left #openvpn []
08:54 -!- dazo [~dazo@nat/redhat/x-xurjoxvvysfpztha] has joined #openvpn
08:54 -!- dazo [~dazo@nat/redhat/x-xurjoxvvysfpztha] has quit [Changing host]
08:54 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
08:57 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p14232>
08:58 < janjust> hehe , is it noticable that I'm back from holidays :)
08:58 -!- quadDama1e is now known as quadDamage
09:00 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Quit: *puff*]
09:01 -!- dazo [~dazo@nat/redhat/x-ygrgjffcemebedba] has joined #openvpn
09:01 -!- dazo [~dazo@nat/redhat/x-ygrgjffcemebedba] has quit [Changing host]
09:01 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:03 -!- axelm7 [~axelm@201.255.8.28] has quit [Remote host closed the connection]
09:07 < hyper_ch> krzee: http://gizmodo.com/5826491/is-this-a-ufo-on-the-bottom-of-the-ocean
09:07 <@vpnHelper> Title: Is This a UFO On the Bottom of the Ocean? (at gizmodo.com)
09:13 < amero> can someone give me example for server-ipv6 usage
09:14 < hyper_ch> ipv6 really exists?
09:14 < amero> :D
09:21 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p14233>
09:24 -!- luneff [~yury@188.114.1.34] has joined #openvpn
09:27 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
09:38 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
09:44 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Quit: leaving]
09:45 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
09:45 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:47 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Changing host]
09:47 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
10:03 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
10:37 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
10:37 -!- EugeneKaway is now known as EugeneTrain
10:39 -!- dazo is now known as dazo_afk
10:43 -!- kartmetal [~kartofeln@12.204.161.253] has joined #openvpn
10:43 -!- kartmetal [~kartofeln@12.204.161.253] has quit [Changing host]
10:43 -!- kartmetal [~kartofeln@unaffiliated/kartofeln] has joined #openvpn
10:44 < amero> hyper_ch: i'm not so sure, i just took a glance at ubuntu's openvpn man page and see there's server-ipv6 directive
10:45 < amero> http://manpages.ubuntu.com/manpages/oneiric/en/man8/openvpn.8.html
10:45 <@vpnHelper> Title: Ubuntu Manpage: openvpn - secure IP tunnel daemon. (at manpages.ubuntu.com)
10:45 < hyper_ch> when I was little, my mom told me scary stories about ipv6... they gave me nightmares
10:45 < ecrist> amero: ubuntu shouldn't have a different man page than what we provide...
10:46 < ecrist> unless they have patches we're unaware of
10:50 -!- gorkhaan [~gorkhaan@catv-89-135-155-150.catv.broadband.hu] has joined #openvpn
10:51 < amero> yup. looks like they use their own ipv6 patches
10:52 < amero> http://packages.ubuntu.com/oneiric/openvpn
10:52 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
10:53 < ecrist> not sure why you're saying that... the page you linked doesn't mention third-party patches
10:54 -!- gorkhaan [~gorkhaan@catv-89-135-155-150.catv.broadband.hu] has quit [Ping timeout: 250 seconds]
10:55 < amero> it's in the file [openvpn_2.2.0-2ubuntu1.debian.tar.gz] at right side of the page
10:55 -!- grendal_prime [~sgraham@2001:470:822a:200:21e:c9ff:fe07:bb9] has joined #openvpn
10:56 < amero> in patches folder there's ipv6-payload.patch and jjo-ipv6-support.patch
10:56 < grendal_prime> hey guys ok we have this narrowed down..."refined" as it were...  Basically im not getting broadcast from the server to the tap connected interfaces.
10:56 < ecrist> grendal_prime: firewall?
10:56 < grendal_prime> it gets two the servers tap device.
10:57 < grendal_prime> no.
10:57 < ecrist> amero: those look like our patches, in a bastardized form.
10:57 < ecrist> !man
10:57 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
10:58 < ecrist> it doesn't appear server-ipv6 is documented/supported at this time.
10:59 < amero> how far are we from the official ipv6 support in openvpn?
11:00 < ecrist> 2.3 is when support should be complete, I think.
11:01 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
11:04 -!- kartmetal [~kartofeln@unaffiliated/kartofeln] has quit [Ping timeout: 264 seconds]
11:21 < grendal_prime> no firewall i just checked and tripple checked again
11:21 < grendal_prime> unless its on the client..wich im pretty sure it isnt
11:33 < grendal_prime> hey also we have a paid version of openvpn (one implementation that uses it)  I need to submit a bug...(something else entirely than this broadcast issue)  i cant find the criteria (ie level of logging) for submiting that info.
11:41 < grendal_prime> nevermind on the bug-reporting i found something
11:44 -!- EugeneTrain is now known as EugeneKaway
12:13 < amero> how do we completely switch off logging? openvpn still write logs even with verb 0
12:16 < ecrist> remove the log line from the config...
12:17 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:20 < amero> tried, it wrote to daemon.log instead
12:22 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
12:23 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
12:23 -!- Bheam [michael@77.94.234.164] has quit [Read error: Connection reset by peer]
12:23 -!- Bheam [michael@77.94.234.164] has joined #openvpn
12:24 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:24 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:24 -!- bitterman [~yury@188.114.1.34] has joined #openvpn
12:25 -!- noisebleed_ [~quassel@kermit.inescn.pt] has joined #openvpn
12:25 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
12:25 -!- luneff [~yury@188.114.1.34] has quit [Ping timeout: 250 seconds]
12:25 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Ping timeout: 250 seconds]
12:25 -!- inimino [~inimino@boshi.inimino.org] has quit [Ping timeout: 255 seconds]
12:25 -!- openbsdnoob_ [~openbsdno@88.79.221.61] has joined #openvpn
12:25 -!- openbsdnoob_ is now known as openbsdnoob
12:25 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
12:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 250 seconds]
12:27 < ecrist> amero: redirect to /dev/null then
12:28 < ecrist> --log /dev/null
12:29 < amero> yup. that does the trick
12:30 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
12:30 -!- mode/#openvpn [+v Axeman] by ChanServ
12:34 -!- raidz1 is now known as raidz
12:34 -!- raidz [~Administr@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Changing host]
12:35 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
12:42 -!- MarKsaitis_ [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Quit: Leaving]
12:50 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
12:53 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
12:55 -!- trapni [~trapni@gentoo/developer/trapni] has quit [Ping timeout: 252 seconds]
13:12 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
13:38 -!- ronnocol [~lance@2001:1868:214::bad:babe] has quit [Ping timeout: 260 seconds]
13:39 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
13:48 -!- EugeneKaway is now known as EugeneKay
13:51 -!- AXEMan2 [~axeman3@198.105.46.46] has joined #openvpn
13:54 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
13:54 -!- AXEMan2 is now known as AXEMan
13:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:02 < danryan> hey folks, I'm trying to combine two networks together using an openvpn server on each network, each with a client connecting to the other's server. here is what the networks look like: http://d.pr/p6Ov
14:02 <@vpnHelper> Title: Screen shot 2011-08-01 at 15:02:07.png (at d.pr)
14:02 < Bushmills> !route
14:02 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:02 < ecrist> you only really need one server and one client.
14:03 < danryan> I want to be able to access clients on vpn-west from vpn-east.  here is `ip addr` and `ip route` for each https://gist.github.com/5df09a50f7cd7f13ba62
14:03 <@vpnHelper> Title: danryan's gist: 5df09a50f7cd7f13ba62 Gist (at gist.github.com)
14:03 < ecrist> !iroute
14:03 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
14:03 < danryan> shoot, I was hoping to get it out before someone suggested !route or !iroute. I've read those and I don't understand
14:03 < danryan> configs for each server/client https://gist.github.com/377f72ed342da05398e3
14:03 <@vpnHelper> Title: danryan's gist: 377f72ed342da05398e3 Gist (at gist.github.com)
14:04 < Bushmills> danryan: openvpn is essentially point to point.  routing beyond that is operating system
14:05 -!- grendal_prime [~sgraham@2001:470:822a:200:21e:c9ff:fe07:bb9] has quit [Quit: Ex-Chat]
14:05 < danryan> !ccd
14:05 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
14:10 < danryan> ecrist: so in a layout where there is one server on one network, would the servers on the other network all need to be clients?
14:10 < ecrist> between two networks, you only need one server, one client, and proper routes
14:15 < Bushmills> for n networks, you need one server and n-1 clients
14:15 -!- riffraff [ad102c25@gateway/web/freenode/ip.173.16.44.37] has quit [Ping timeout: 252 seconds]
14:17 < Bushmills> that ignores that such a setup is not the optimum. latency wise
14:20 < danryan> surely my routes are messed up
14:20 < danryan> (either route or iroute)
14:21 < danryan> I have added ccd files for each client connected to each server containing the route for the local network. Should it be the local network subnet or the remote subnet in that config file?
14:25 -!- bitterman [~yury@188.114.1.34] has quit [Quit: This computer has gone to sleep]
14:25 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14234>
14:28 < danryan> bah, nm. I don't know enough about what I'm doing to ask competent questions.
14:28 -!- danryan [~dryan@li115-70.members.linode.com] has left #openvpn []
14:37 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 276 seconds]
14:44 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14235>
14:46 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
14:48 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
14:53 -!- mtbf [~in9836@89-76-9-252.dynamic.chello.pl] has quit [Ping timeout: 255 seconds]
14:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
14:59 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:59 -!- mode/#openvpn [+o mattock] by ChanServ
15:00 < hyper_ch> krzee: http://www.theregister.co.uk/2011/08/01/google_server_count/
15:00 <@vpnHelper> Title: Googlenet runs on '900,000 servers' • The Register (at www.theregister.co.uk)
15:01 -!- luneff [~yury@84.51.192.236] has joined #openvpn
15:02 <@vpnHelper> RSS Update - forum: Configuring a tunnel <http://forums.openvpn.net/topic8553.html#p14236>
15:05 -!- K1ng` is now known as k1ng
15:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
15:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:24 -!- EugeneKay is now known as EugeneKaway
15:35 -!- jaminja [~jaminja@212.7.195.193] has joined #openvpn
15:44 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14237>
15:49 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:50 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14238>
16:03 -!- danryan [~dryan@li115-70.members.linode.com] has joined #openvpn
16:03 < danryan> !route
16:03 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:07 -!- AXEMan [~axeman3@198.105.46.46] has quit [Ping timeout: 258 seconds]
16:08 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14240> || Running openvpn client (TAP- Interface) & server (TUN- Inte <http://forums.openvpn.net/topic8568.html>
16:16 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
16:18 < danryan> hi again folks, I've fixed my routes and I'm now stuck on another issue that I can't figure out. I've read !route and !ccd and !etc so please don't point me there. https://gist.github.com/a85d4a1bb40d5d659a4a
16:18 <@vpnHelper> Title: danryan's gist: a85d4a1bb40d5d659a4a Gist (at gist.github.com)
16:19 < danryan> I've tried using: the local route; the remote route; both the local and remote routes, in the client ccd files
16:21 < danryan> the available information seems to point toward placing the local network route in the ccd file for the clients connecting to the vpn server local to them  but that doesn't work
16:21 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:23 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 240 seconds]
16:32 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
16:34 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:35 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Remote host closed the connection]
16:36 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
16:46 -!- EugeneKaway is now known as EugeneKay
17:02 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14241>
17:05 -!- AXEMan [~axeman3@openvpn/user/axeman] has joined #openvpn
17:05 -!- mode/#openvpn [+v AXEMan] by ChanServ
17:08 <@vpnHelper> RSS Update - forum: [Solved] One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-30.html#p14166>
17:20 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14243> || Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14242>
17:23 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:27 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14244>
17:27 -!- spridel [~spridel@unaffiliated/spridel] has joined #openvpn
17:31 -!- AXEMan [~axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
17:34 < Bheam> hi
17:34 < Bheam> so how does ipx over openvpn without bridging work?
17:39 < krzee> Bheam, what do you need to do?
17:39 < krzee> SMB filrsharing
17:39 < krzee> ?
17:44 < Bheam> nothing in specific.. anything that i'd normally be able to do if i stretched a tp cable over
17:44 <@vpnHelper> RSS Update - forum: Running openvpn client (TAP- Interface) & server (TUN- Inte <http://forums.openvpn.net/topic8568.html#p14247> || Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14246>
17:56 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:56 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14248>
17:57 < krzee> well
17:58 < krzee> then we're just talking about layer2, not ipx specifically
18:03 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14249>
18:06 < Bheam> so how do you connect two networks at layer2 without bridging?
18:06 < snappy> with a hub.
18:07 -!- Denial [~Denial@drgi.co.uk] has quit [Ping timeout: 260 seconds]
18:08 < krzee> Bheam, you use bridging
18:08 < krzee> :-p
18:08 < krzee> although if only 2 machines need it, you can use a routed tap setup
18:08 < krzee> but when the lans need layer2 over the vpn too, you need a bridge
18:10 < krzee> but if the lans just need layer3 (ip traffic) then you can just use routed tun with !route
18:20 -!- fremo [~fremo@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
18:21 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
18:21 -!- mete [~metefr@mete.shell.la] has quit [Ping timeout: 240 seconds]
18:23 -!- mete [~metefr@mete.shell.la] has joined #openvpn
18:29 < Bheam> rigth
18:30 < Bheam> so if i'm making virtual adapters for all the computers because i want a different ip for this bridged net, is there any way to run a dhcp that won't interfere with my other net? i guess not possible since it's the same physical net?
18:35 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
18:39 <@vpnHelper> RSS Update - forum: How-to: Tunnel WAN IP assigned to specific users <http://forums.openvpn.net/topic8559.html#p14250>
18:48 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has joined #openvpn
19:05 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has quit [Ping timeout: 250 seconds]
19:10 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has joined #openvpn
19:48 -!- nebajoth [~nebajoth@starfighter.org] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:53 -!- nebajoth [~nebajoth@starfighter.org] has joined #openvpn
20:07 -!- jaminja [~jaminja@212.7.195.193] has quit [K-Lined]
20:12 -!- octocpp [~octo@unaffiliated/octocpp] has joined #openvpn
20:17 -!- master_of_master [~master_of@p57B53067.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
20:18 < octocpp> I am using openvpn to connect to a ssl vpn on an astaro gateway. I have downloaded the ovpn config and the certs and inputed them in using KVpnc.  The connection seems to go ok except it always just says connecting, never says connected. However, it appears to be working though. 'route' and 'ifconfig' show the tunnel is set up and I was able to access the LAN on the other side of the gateway.  Why doesnt KVpnc say connected if it already is?
20:18 < octocpp> maybe I am not fully connected somehow?
20:18 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
20:19 -!- master_of_master [~master_of@p57B532D1.dip.t-dialin.net] has joined #openvpn
20:35 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 255 seconds]
20:39 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:39 -!- Axeman [~axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
20:39 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
20:39 -!- mode/#openvpn [+v Axeman] by ChanServ
20:47 -!- octocpp [~octo@unaffiliated/octocpp] has quit [Ping timeout: 240 seconds]
21:02 -!- octocpp [~octo@unaffiliated/octocpp] has joined #openvpn
21:08 -!- octocpp [~octo@unaffiliated/octocpp] has quit [Remote host closed the connection]
21:08 -!- octocpp [~octo@unaffiliated/octocpp] has joined #openvpn
21:11 -!- octocpp [~octo@unaffiliated/octocpp] has quit [Client Quit]
21:11 -!- octocpp [~octo@unaffiliated/octocpp] has joined #openvpn
21:13 -!- octocpp [~octo@unaffiliated/octocpp] has quit [Client Quit]
21:24 < kartmetal> to echo octocpp's concern, is kvpnc supposed to work with openvpn? it is forever stuck in "connecting" mode for me as well. I just stopped using it, grabbed the exact openvpn conf file it generated, used it manually and openvpn was working just fine.
21:24 < kartmetal> btw, omg openvpn is awesome. there, I had to say it once.
21:27 < Bushmills> openvpn is supposed to work with openvpn
21:27 < Bushmills> whether other program so or not, or are supposed to or not, is beyond the control of openvpn
21:27 < Bushmills> programs do so ...
21:28 < Bushmills> i'd say, whether kvpnc is supposed to work or not with openvpn is something the kvpnc folks know best
21:33 < kartmetal> k. not a huge concern at this point for me. I was mostly curious to see if there are "known working" UIs that happen to speak openvpn correctly.
21:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:49 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
22:01 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:17 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
22:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:55 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
--- Day changed Tue Aug 02 2011
00:16 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
00:16 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
00:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
01:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:52 <@vpnHelper> RSS Update - forum: Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14251>
02:15 -!- EugeneKay is now known as EugeneKaway
02:15 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475.html#p14252>
02:16 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:16 -!- mode/#openvpn [+o mattock] by ChanServ
02:18 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
02:22 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 250 seconds]
02:22 <@vpnHelper> RSS Update - forum: OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475-15.html#p14254> || Connection between VPN clients <http://forums.openvpn.net/topic8561.html#p14253>
02:22 < Mowee> Morning
02:26 -!- JimHank [~JimHank@212.174.109.54] has joined #openvpn
02:27 < krzee> mornin
02:41 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
02:41 < Ragnar> hey
02:41 < Ragnar> when ./build-key user
02:41 < Ragnar> shouldnt it create a user.crt file?
02:41 -!- dazo_afk is now known as dazo
02:41 < Ragnar> (in my case, it creates it, but its empty)
02:43 < dazo> Ragnar: yes it should ... did you source ./vars first?  And are all paths and variables in that file valid?
02:43  * dazo haven't used easy-rsa for long, so he is rusty on the details
02:44 -!- X-Raimo [d4f8080a@opensuse/member/raimoschmidt] has joined #openvpn
02:45 < X-Raimo> hello. My problem is that server doesn't see network behind client. I have ccd with iroute for this client.
02:47 < Bushmills> !clientlan
02:47 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
02:47 <@vpnHelper> better explanation
02:55 < X-Raimo> !route_outside_openvpn
02:55 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
03:01 < Ragnar> dazo: yes I did.
03:02 < Ragnar> I ran source ./vars
03:02 < Ragnar> and uhm, did the ./build-key ragnar
03:02 < Ragnar> in this case
03:02 < Ragnar> it created everything, but the ragnar.crt file is empty
03:02 < dazo> Ragnar: that's really odd ... which version and platform are you on?
03:02 < Ragnar> openvpn --version
03:02 < Ragnar> OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 21 2010
03:03 < Ragnar> Originally developed by James Yonan
03:03 < Ragnar> Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
03:03 < Ragnar> cat /etc/debian_version 
03:03 < Ragnar> 6.0.2
03:03 < Ragnar> squeeze
03:03 < dazo> hmm
03:04 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:04 < dazo> that should be pretty decent ... I know Debian adds some extra patches (many of them are upstream in 2.2.x now), but I don't recall anything easy-rsa related ... which openssl version?
03:05 < dazo> (the easy-rsa stuff depends on openssl command line tools)
03:09 < Ragnar> OpenSSL> version
03:09 < Ragnar> OpenSSL 0.9.8o 01 Jun 2010
03:11  * dazo is looking at the debian patches again
03:13 < dazo> Ragnar: can you pastebin your vars file?
03:13  * dazo will try it locally
03:13 < dazo> hmm ... or is it related to using the wrong openssl.cnf file?
03:16 < Ragnar> hm
03:16 < Ragnar> shouldnt be
03:16 < Ragnar> the file is empty
03:16 < Ragnar> that shouldnt have anything todo with the cnf file?
03:16 < Ragnar> or.. could it?
03:16 < dazo> openssl.cnf?  that file should not be empty
03:16 < Ragnar> no
03:16 < Ragnar> the .crt
03:16 < Ragnar> the .cnf file shouldnt have anything todo with the .crt file being empty on ./build-key user
03:17 < dazo> openssl.cnf is used to setup openssl when generating certs
03:17 < X-Raimo> so my graph is: http://picpaste.com/vpn-iETnvfMM.JPG
03:18 < Ragnar> http://pastebin.com/nSTRadt1
03:18 < Ragnar> thats the openssl.cnf
03:20 < X-Raimo> openvpn client pings target. Client behind vpn client doesn't pings target due to misrouting at server side. Server doesn't know anything about 192.168.3.X, even if have ccd with iroute 192.168.3.0 255.255.255.0  
03:20 < dazo> Ragnar: that's slightly different from the upstream version for openssl 0.9.8 ... http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=blob_plain;f=easy-rsa/2.0/openssl-0.9.8.cnf;h=340b8af70bc36eba7ff45d0818f49ef52c7bb7ff;hb=3b75dec3e32e7d838ed56be5667d1cf3ac4cef18
03:21 < dazo> Ragnar: and your vars file?
03:21 < Ragnar> hm could be
03:22 < Ragnar> http://pastebin.com/Rakti65L < vars
03:25 < dazo> Ragnar: you're using bash as shell?  (just to be sure I use the same environment)
03:25 < Ragnar> yes
03:27 -!- Meliorator [m@dunnington.eu] has joined #openvpn
03:28 < Meliorator> hey all, i'm trying to get openvpn to play ball with rc and fstab on gentoo. i have some CIFS shares specified in fstab that i want mounted when the openvpn client is started. problem at the moment is that netmount will wait for openvpn server to start before running, but the openvpn clients get started after it
03:29 < Meliorator> how/where do i set in rc, that the openvpn clients must be running, before any netmounts are done?
03:29 < dazo> Ragnar: make sure you have this line in your vars file: export OPENSSL="openssl"
03:29 < Meliorator> or is there something in the openvpn config i have missed?
03:29 < Ragnar> thats all?
03:30 < dazo> Ragnar: That's one thing ... I'm still testing
03:31 < dazo> Meliorator: in fstab add 'noauto' to your mount (maybe adding 'user' will be needed too) ... and then add a --up script to your openvpn config which just does 'mount /path/to/your/CIFS/mount'
03:31 < Meliorator> i have the noauto already, so i can manually do it ... but where abouts on the openvpn config do i put that --up option?
03:32 < dazo> !man
03:32 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
03:32 < dazo> Meliorator: search for --up here ... ^^^
03:35 < Meliorator> i guess i should check --down too huh :p
03:35 < dazo> Meliorator: good idea, but make sure it is executed *before* the tunnel is taken down ... or else it might take a while
03:36 < X-Raimo> !кщгеу
03:36 < dazo> Ragnar: I noticed I had only openssl-1.0.0 available ... however, with adding the OPENSSL variable to vars, it seems to work for me ... make sure you have the easy-rsa/2.0 openssl-0.9.8.cnf in the /etc/openvpn/VPNCertificates directory too
03:36 < X-Raimo> !route
03:36 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
03:36 < Meliorator> i dunno why my distro isn't doing all this for me tbh :s
03:37 < dazo> Meliorator: because your distro doesn't know what you want to use your VPN for
03:38 < Meliorator> it can see what's in fstab and it can see if the mounts are within a host/ip range specified in openvpn config
03:38 -!- jbb [~yeeb@184.105.219.149] has quit [Quit: No Ping reply in 180 seconds.]
03:38 < Meliorator> wouldn't be hard to script it
03:38 < dazo> Meliorator: parsing /etc/fstab is /bin/mount's task ... not your distro
03:39 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
03:39 < dazo> and /bin/mount is part of the util-linux-ng package, which is distro agnostic
03:39 < Meliorator> that's not strictly correct
03:40 < Meliorator> or we would have no handling for netmount
03:40 < Meliorator> the distro must check what needs to be done for network filesystems
03:42 < dazo> Meliorator: however, you may probably provide fixes to the netmount script (which is distro related) which does exactly what you need .... but most often, netmount does simple checks like "is network available?, if so then mount -a -t nfs ; mount -a -t cifs ; mount -a -t smb" ...  very simplified, of course
03:43 < Meliorator> yeah, that's essentially all that needs to be done for openvpn ... "is vpn available? does vpn have same ip/host as any of the openvpn clients?"
03:43 < Meliorator> er
03:43 < Meliorator> "is vpn available? does mount have same ip/host as any of the openvpn clients?"
03:44 < dazo> well, you need to really rework that netmount script, so it doesn't do 'mount -a -t {netfs}' .... because that makes all your troubles, you need to analyse what is available and not and only do explicit mounts, and not mount -a
03:46 < Meliorator> well, it's possible (and it should!), for the distro to handle it... is all i'm saying...
03:49 < dazo> Meliorator: provide a patch to your distro and ask them to include it ... maybe "should" will become "does"
03:49 < Meliorator> yea, i'm moaning in the wrong channel, i know :p
03:49 < Meliorator> thanks dazo
03:50 < dazo> :)
03:50 < Meliorator> they've provided a means of easily adding an up script for each service
03:51 < Meliorator> which is something i guess
03:53 < Meliorator> you make a file /etc/openvpn/openvpn.servicename-up.sh, which is picked up by /etc/openvpn/up.sh, which is an --up option in /etc/init.d/openvpn, which you symlink to a service name /etc/init.d/openvpn.servicename
03:53 < Meliorator> really messy :p
03:55 -!- luneff [~yury@84.51.192.236] has quit [Quit: This computer has gone to sleep]
04:07 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:07 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:15 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 240 seconds]
04:19 -!- luneff [~yury@188.114.1.34] has joined #openvpn
04:21 < Bheam> hi
04:22 < Bheam> so i'm going to bridge several networks, anything special i have to do?
04:23 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
04:30 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
04:33 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14255>
04:37 < Bheam> does every site have to run server+client?
04:47 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
04:47 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
04:48 < Bheam> baaah
04:48 < Bheam> how do i reach my box after i run bridge-start ?
04:50 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
04:50 -!- luneff [~yury@188.114.1.34] has quit [Ping timeout: 250 seconds]
04:51 < dazo> Bheam: why do you need to bridge?
04:52 < dazo> (if you have lost connection with bridge-start, you won't get it back remotely)
04:56 -!- luneff [~yury@188.114.1.34] has joined #openvpn
05:02 -!- X-Raimo [d4f8080a@opensuse/member/raimoschmidt] has left #openvpn []
05:02 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
05:03 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
05:03 -!- mode/#openvpn [+o raidz] by ChanServ
05:05 < Bheam> ugh
05:05 < Bheam> i can't just change the ip of my desktop?
05:05 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has quit [Ping timeout: 252 seconds]
05:05 -!- natanoj [~jonatan@yogi.akerlind.nu] has quit [Ping timeout: 252 seconds]
05:06 -!- natanoj [~jonatan@yogi.akerlind.nu] has joined #openvpn
05:06 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has joined #openvpn
05:06 -!- qknight [~joachim@88.198.52.213] has quit [Remote host closed the connection]
05:06 -!- qknight [~joachim@88.198.52.213] has joined #openvpn
05:06 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has quit [Remote host closed the connection]
05:14 < Bheam> yea i can :p
05:15 < Bheam> so
05:15 < Bheam> is there no way to allow traffic on both the eth0 and br0 interfaces?
05:16 < Bheam> well the ips that is
05:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
05:28 < Bheam> ifconfig $eth 0.0.0.0 promisc up doesn't seem to do anything.. eth0 still has the same ip as br0
05:28 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Ping timeout: 260 seconds]
05:29 -!- snappy [~nipnop@wbml.net] has joined #openvpn
05:29 -!- snappy [~nipnop@wbml.net] has quit [Changing host]
05:29 -!- snappy [~nipnop@unaffiliated/snappy] has joined #openvpn
05:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:43 <@vpnHelper> RSS Update - forum: Just for fun - brief stats <http://forums.openvpn.net/topic8472.html#p14256>
05:49 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 252 seconds]
05:50 -!- incidence [jussi@unaffiliated/incidence] has joined #openvpn
05:52 < incidence> Hi, when I connect I keep getting ""Since you are using --dev tun with a point-to-point topology, the second argument to --ifconfig must be an IP address. You are using something (255.255.255.128) that looks more like a netmask."
05:55 < incidence> http://pastie.org/private/pwoyp62ifmdpayl7ldxg There's my config
05:55 <@vpnHelper> RSS Update - forum: how to block P2P traffic <http://forums.openvpn.net/topic8491.html#p14257>
05:56 < incidence> I'm trying to access our offices 10.0.1.1 network with OpenVPN
05:57 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
06:05 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
06:07 < dazo> incidence: your config doesn't match that error message at all .... your config says 'dev tap'
06:16 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
06:16 -!- mode/#openvpn [+v Axeman] by ChanServ
06:23 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
06:29 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
06:29 -!- flyko [58c657bd@gateway/web/freenode/ip.88.198.87.189] has joined #openvpn
06:29 < flyko> hi, need help
06:30 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:30 -!- mode/#openvpn [+o mattock] by ChanServ
06:31 < genlime> flyko, whats your prob?
06:31 < flyko> i have ms firewall clinet for ISA server
06:31 < flyko> and i did a setup of openvpn on remote linux machine
06:32 < flyko> and client setup on windows
06:32 < flyko> but internet wont go through vpn, still trying through ISA firewall :(
06:33 < Bheam> HI. if i run tap bridged, can i still filter on IP level?
06:33 < genlime> hmmm. sorry not familiar with ISA
06:33 -!- wonbaba [~wons@88.235.27.15] has joined #openvpn
06:33 < genlime> maybe if your problem is firewall, why not ask in #netfilter
06:33 -!- wonbaba [~wons@88.235.27.15] has quit [Client Quit]
06:34 -!- wonbabaaa [~wons@88.235.27.15] has joined #openvpn
06:34 < wonbabaaa> !welcome
06:34 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:34 < wonbabaaa> !goal
06:34 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:35 < wonbabaaa> hello
06:35 < wonbabaaa> hows everyone doing
06:40 < genlime> bushmills, does ddos protection in a server slows down connectivity?
06:40 -!- flyko [58c657bd@gateway/web/freenode/ip.88.198.87.189] has quit [Quit: Page closed]
06:41 < Bushmills> under ddos, yes.  you want to protect against ddos as much upstream as possible
06:42 < genlime> really? ddos protection do slow down internet connectivity? what can be done about it?
06:42 < Bushmills> shoot the offenders
06:42 < genlime> hahahaha. aside from that ?
06:43 < Bushmills> pull network plug
06:43 -!- luneff [~yury@188.114.1.34] has quit [Ping timeout: 250 seconds]
06:43 < genlime> hahahaha. no. like can I request not to include from server from ddos protection?
06:44 < wonbabaaa> anyone give paid service 
06:44 < wonbabaaa> i wanna open VPN company
06:44 < wonbabaaa> but dont have enough experience and information
06:44 < genlime> wonbabaaa, where do you reside? 
06:45 < wonbabaaa> im from Turkey
06:46 < genlime> a vpn company really?
06:46 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:46 < wonbabaaa> what do you mean
06:47 < genlime> you want to put up a vpn company? like? for what purpose?
06:47 < wonbabaaa> i wanna sell VPN accounts
06:47 < wonbabaaa> to my customers
06:48 -!- luneff [~yury@46.61.29.224] has joined #openvpn
06:49 < genlime> there in turkey?
06:49 < wonbabaaa> yes
06:49 < wonbabaaa> but locations will be
06:49 < genlime> do you have ym?
06:49 < wonbabaaa> ym ?
06:50 < genlime> yahoo messenger
06:50 < wonbabaaa> nope
06:50 < wonbabaaa> skype, aim
06:50 < genlime> i dont use skype and aim. maybe you can create one so we can talk and advice you.
06:51 < wonbabaaa> ok give me few minutes
06:51 < genlime> k
06:52 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
06:53 < Bheam> gawd
06:53 <@vpnHelper> RSS Update - forum: cant connect to vpn recently <http://forums.openvpn.net/topic8569.html>
06:54 < Bheam> skype is teh win
06:54 < Bheam> yahoo messenger is for asian sluts
06:54  * krzee suddenly decides to install yahoo messenger
06:55 < genlime> hahaha
06:56 < Bheam> too bad yahoo removed their "whitepages"
06:56 < Bheam> that was good times
06:56 < genlime> i dont think that yahoo messenger is not generally for asian sluts.
06:58 < Bheam> double negative makes a positive :p
06:59 < Bheam> \o/
07:13 < Bheam> hi
07:14 < Bheam> what's the purpose of the vpn client address pool for bridging?
07:14 < ecrist> what do you mean, Bheam?
07:15 < dazo> !icmp
07:21 < genlime> dazo, do we have icmp update?
07:21 < ecrist> there will be no ICMP
07:21 < Ragnar> !goal
07:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:21 < ecrist> genlime: quit asking.
07:21 < dazo> genlime: do you remember what I told you last time at all?
07:22 < dazo> we had quite a lengthy discussion about patches going to the mailing list
07:22 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
07:24 < genlime> just asking. maybe there will be. yes I remember.
07:24 < ecrist> genlime: no, there really won't be.
07:24 < ecrist> we've been telling you that for weeks
07:27 < genlime> just hoping for update ecrist. I'd like to implement one
07:27 < ecrist> so implement it.  quit asking, we're not writing it
07:30 < genlime> ecrist, may I ask why you dont want to write such protocol?
07:30 < genlime> for openvpn?
07:30 < ecrist> no, you cannot
07:31 < genlime> no, I mean, why dont you want to write icmp protocol for openvpn? isnt it useful?
07:32 < dazo> genlime: because we have too much other things to do which is way more important than icmp right now
07:32 < ecrist> two hookers and a bottle of rum is more useful, imho
07:32 < genlime> dazo, may I know what is that? is that another protocol?
07:33 < ecrist> genlime: look at the development roadmap
07:33 < ecrist> read the mailing list
07:33 < ecrist> attend a dev meeting
07:33 < dazo> genlime: if that is so f*cking important for you ... then *you* can implement it, and if *you* provide patches to the mailing list, we will consider them
07:33 < ecrist> we don't have to, and aren't going to excuse our actions.
07:34 < genlime> if I am only good at c programming I will dazo, but unfortunately, it was not my language.
07:34 < ecrist> we'll we're not going to do it. please quit asking.
07:35 < dazo> genlime: for things which are high up on the list now ... complete IPv6 support, support for PolarSSL in addition to OpenSSL, getting the latest stuff from James into the coming v2.3, and there's a long list of things we should look more carefully at ... just see here: https://community.openvpn.net/openvpn/report/1
07:35 <@vpnHelper> Title: {1} Active Tickets – OpenVPN Community (at community.openvpn.net)
07:36 < ecrist> not to mention the near complete rewrite for 3.0
07:36 <@vpnHelper> RSS Update - forum: cant connect to vpn recently <http://forums.openvpn.net/topic8569.html#p14260> || linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14259>
07:36 < dazo> ecrist: good point!
07:36 < dazo> genlime: when *that list* is empty, ICMP and DNS transports might be interesting to look at ... until that happens ... *nothing* will *ever* happen with ICMP from our side
07:37 < ecrist> and 3.0 is probably 2-3 years out, best guess
07:37 < dazo> genlime: and if C is not your language ... either start learning it and do some coding ... or stop wasting our time and energy with useless progress questions
07:37 < dazo> genlime: is this clear enough?
07:38 -!- genlime [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Ping timeout: 252 seconds]
07:41 < ecrist> :'(
07:41 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14261>
07:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:55 -!- mode/#openvpn [+v s7r] by ChanServ
07:56 < Optic> moo
07:56 -!- wonbabaaa [~wons@88.235.27.15] has quit []
08:02 -!- Axeman [~axeman3@openvpn/user/axeman] has joined #openvpn
08:02 -!- mode/#openvpn [+v Axeman] by ChanServ
08:13 -!- Axeman [~axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
08:20 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
08:20 -!- WebDawg [~whoami@officialg0d.com] has quit [Quit: I WIN!]
08:20 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
08:20 -!- mode/#openvpn [+v Axeman] by ChanServ
08:25 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:29 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
08:32 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
08:34 < krzee> !meetings
08:35 < hyper_ch> hi krzee
08:35 < krzee> hey hyper_ch 
08:36 < hyper_ch> krzee: did you see the links I posted for you?
08:36 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
08:36 < krzee> neg
08:36 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:36 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:36 < hyper_ch> awwww :(
08:37 < hyper_ch> you know how much time it takes to copy'n'paste urls and highlighting you? give me back ma precious seconds :)
08:41 < ecrist> what'd you do to vpnhelper, krzee?
08:42 < krzee> restarted it, see dev chan
08:43 < krzee> hyper_ch, sometimes my irc client gets closed without me seeing that i was highlighted, what was up?
08:43 < hyper_ch> krzee: not much, they found an ufo on the sea bed in the baltic (?) sea
08:43 < hyper_ch> and estimates are that google only runs about 900k servers
08:43 < hyper_ch> in their DCs
08:44 < krzee> sounds like a SFO
08:44 < krzee> err
08:44 < krzee> USO
08:50 < hyper_ch> "S"?
08:50 < hyper_ch> unidentified sailing object?
08:50 < hyper_ch> sinking?
08:51 < hyper_ch> sunken?
08:53 < dazo> screaming!
08:57 < krzee> sunken
08:57 < krzee> certainly not flying
08:57 <@vpnHelper> RSS Update - forum: tethering for unlimited data with Verizon <http://forums.openvpn.net/topic8570.html>
08:59 < hyper_ch> hmmm, I still think 900k servers isn't that much - considering what google offers
09:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
09:12 -!- Meliorator [m@dunnington.eu] has quit [Ping timeout: 276 seconds]
09:16 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
09:19 -!- noisebleed_ [~quassel@kermit.inescn.pt] has quit [Remote host closed the connection]
09:21 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
09:21 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
09:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:21 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p14263>
09:28 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p14265> || Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14264>
09:29 -!- k1ng [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
09:40 -!- K1ng [~KING@180.211.188.76] has joined #openvpn
09:40 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14266>
09:44 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 255 seconds]
09:54 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Ping timeout: 260 seconds]
09:57 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
10:01 -!- luneff [~yury@46.61.29.224] has quit [Quit: Leaving]
10:02 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Ping timeout: 250 seconds]
10:06 -!- K1ng [~KING@180.211.188.76] has quit [Ping timeout: 240 seconds]
10:07 -!- gyyrog [~gyyrog@96-36-48-82.static.aldl-nbb.mi.charter.com] has joined #openvpn
10:09 -!- newmember [~chatzilla@66.183.103.108] has quit [Ping timeout: 252 seconds]
10:13 -!- K1ng [~KING@180.211.188.81] has joined #openvpn
10:13 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
10:14 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
10:14 -!- gyyrog [~gyyrog@96-36-48-82.static.aldl-nbb.mi.charter.com] has quit [Ping timeout: 252 seconds]
10:21 -!- TimothyA [~Administr@li36-88.members.linode.com] has joined #openvpn
10:22 < TimothyA> question; when being an openvpn client, will the client be able to tunnel through for example a webserver?
10:22 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14267>
10:23 < krzee> huh?
10:24 < hyper_ch> TimothyA: you want to run a webserver on a client and you want to have traffic tunneled through the vpn?
10:24 < krzee> ohhh
10:25 < TimothyA> hyper_ch: yeah, so anyone can access it from the other end
10:25 -!- Meliorator [m@dunnington.eu] has joined #openvpn
10:25 -!- Irssi: #openvpn: Total of 146 nicks [4 ops, 0 halfops, 2 voices, 140 normal]
10:25 < TimothyA> without additional configuration. or is that not how VPN works?
10:25 < hyper_ch> TimothyA: that's doable.... should only http traffic be routed through the vpn or everything from the web client?
10:26 < hyper_ch> TimothyA: there is some configuration involved... depending on what you really want
10:26 < TimothyA> everything would be a nice plus. I have no access to the VPN server configuration, though
10:26 < hyper_ch> no access to vpn server... that makes it hard
10:27 < hyper_ch> simplest solution would have been to route all traffic from the client through the vpn
10:27 <@vpnHelper> RSS Update - forum: VPN not routing <http://forums.openvpn.net/topic8572.html>
10:27 < TimothyA> it's a third party hosted vpn server. I can't just fly myself to asia and plant a server in a datacenter :P
10:27 < hyper_ch> and on the vpn server route according ports back to the client (like 80 for http)
10:28 -!- newmember [~chatzilla@198.162.158.30] has joined #openvpn
10:28 < hyper_ch> well, you don't rent the vpn server?
10:28 < TimothyA> I do, but I don't have access to it
10:28 < TimothyA> other than a client username/password
10:28 < hyper_ch> no ssh access to it?
10:28 < TimothyA> no
10:28 < hyper_ch> ah, you only rent a connection
10:28 < hyper_ch> you don't run your own vpn server
10:29 < TimothyA> yeah, I don't
10:29 < hyper_ch> I don't know how to do that then
10:29 < TimothyA> oh..
10:29 < hyper_ch> because server side you'd need to route incoming requests to the right client
10:29 -!- EugeneKaway is now known as EugeneKay
10:29 < hyper_ch> and if you don't have access to it
10:29 < hyper_ch> that's hard
10:29 < hyper_ch> krzee: got an idea?
10:33 < krzee> cant be done without access to the server
10:33 < krzee> nor *should* it be able to be done
10:33 < TimothyA> then prq.se lied to me :|
10:33 < krzee> well there must be some info missing
10:34 < krzee> you need to get support from your provider
10:34 < krzee> but if my clients could use my vpn ip to run their own webserver, without access to set it up on my server, and without me doing it for them, that would be a big security issue imo
10:35 < TimothyA> it's a dedicated VPN ip
10:35 < krzee> get support from them
10:37 -!- gyyrog [~gyyrog@96-36-48-82.static.aldl-nbb.mi.charter.com] has joined #openvpn
10:38 < TimothyA> krzee: okay, so you are saying that you can run absolutely no incoming/outcoming data on a dedicated IP through a VPN server which is supposed to allow all connections?
10:38 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14269>
10:39 < krzee> im telling you that you must get support from your provider, i cannot help you with an unknown server config
10:39 < krzee> a vpn is simply a ptp link between 2 machines, everything on top of that is special
10:39 < krzee> you're wasting your time getting support from anyone but your provider, we would simply be guessing what they are doing
10:40 < Bushmills> or show us the server config :)
10:42 < ecrist> right, that would do
10:44 -!- gyyrog [~gyyrog@96-36-48-82.static.aldl-nbb.mi.charter.com] has quit [Ping timeout: 240 seconds]
10:45 -!- JimHank [~JimHank@212.174.109.54] has quit [K-Lined]
10:45 < TimothyA> okay, any recommendations of what else I could possibly use as a middle server other than an SSH tunnel?
10:46 < Bushmills> what's generally suggested here for that purpose is openvpn
10:46 < Bushmills> doesn't really come as an surprise, does it?
10:46 < krzee> openvpn works for it, but the only way you'll get support is by running your own server or getting it from your provider
10:50 < TimothyA> guh
10:50 <@vpnHelper> RSS Update - forum: VPN not routing <http://forums.openvpn.net/topic8572.html#p14270>
10:53 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Take my advice. I don't use it anyway]
10:57 <@vpnHelper> RSS Update - forum: VPN not routing <http://forums.openvpn.net/topic8572.html#p14271>
10:59 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
11:15 <@vpnHelper> RSS Update - forum: Route Internet traffic via OpenVPN on a W2008 box <http://forums.openvpn.net/topic8454.html#p14272>
11:22 -!- Meliorator [m@dunnington.eu] has quit [Read error: Connection reset by peer]
11:25 -!- Meliorator [m@dunnington.eu] has joined #openvpn
11:26 -!- clustermagnet [~Adium@ec2-75-101-158-130.compute-1.amazonaws.com] has joined #openvpn
11:28 < TimothyA> aaaand... prq.se refers me back to this channel for further support. great.
11:29 -!- Berk000 [~someone@88.235.27.15] has joined #openvpn
11:29 < Berk000> hello
11:29 < clustermagnet> guys, i may be delusional… but some time ago i may have come across some article/blah saying you can run openvpn and ssh on port 22 simultaneously?
11:29 < clustermagnet> or am i losing it
11:30 < clustermagnet> ie… openvpn picks up , if not openvpn traffic, forwards to another local port
11:31 < Berk000> anyone hear any paid service
11:31 < Berk000> for setup VPN
11:31 < Berk000> to create VPN company
11:35 < Bushmills> clustermagnet: you're supposedly able to share tcp/80 and openvpn with a web server
11:36 < clustermagnet> Bushmills:  super, any faqs you can point me to?
11:36 < Bushmills> clustermagnet: man page
11:36 < clustermagnet> im scraping google right now, cant find the damn thing
11:36 < clustermagnet> Bushmills:  oh ya? cool!
11:36 < clustermagnet> but you cant do openvpn - ssh share :(
11:36 < clustermagnet> i guess that makes sense
11:36 < Bushmills> afaik, that port sharing works exclusively with web server
11:37 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
11:38 < clustermagnet> Bushmills:  yeh, cuz otherwise its encrypted
11:38 < dazo> clustermagnet: openvpn --port-share is to be used against a httpS server
11:38 < Bushmills> shouldn't matter.  openvpn can determine whether a packet is for itself or not
11:38 < dazo> it could *maybe* work with SSH as well, even though, with SSH it might be a performance impact
11:39 < Bushmills> encrypted would then just be port forwarded
11:39 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
11:39 -!- Guest8383 is now known as Cain
11:39 < Bushmills> probably worth to experiment with non-http(s). your mileage may vary
11:40 < clustermagnet> Bushmills:  dazo guys… where the heck is the docs? http://openvpn.net/index.php/open-source/documentation/howto.html
11:40 <@vpnHelper> Title: HOWTO (at openvpn.net)
11:40 < clustermagnet> i cant find this on here....
11:41 < dazo> !man
11:41 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
11:41 < dazo> clustermagnet: ^^ 
11:41 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
11:42 < clustermagnet> dazo thanks
11:42 < clustermagnet> fuk i cant search today :)
11:44 -!- snappy [~nipnop@unaffiliated/snappy] has quit [Read error: Connection reset by peer]
11:47 -!- dazo is now known as dazo_afk
11:56 -!- Axeman [~thirdchoi@198.105.46.46] has joined #openvpn
11:56 -!- Axeman [~thirdchoi@198.105.46.46] has quit [Changing host]
11:56 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
11:56 -!- mode/#openvpn [+v Axeman] by ChanServ
12:07 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
12:27 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 264 seconds]
12:28 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
12:29 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:29 -!- gorkhaan [~gorkhaan@catv-89-135-155-150.catv.broadband.hu] has joined #openvpn
12:33 <@vpnHelper> RSS Update - forum: Configuring OpenVPN as Hotspot Proxy <http://forums.openvpn.net/topic8573.html>
12:35 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:39 <@vpnHelper> RSS Update - forum: Configuring OpenVPN as Hotspot Proxy <http://forums.openvpn.net/topic8573.html#p14274>
13:01 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
13:02 -!- K1ng [~KING@180.211.188.81] has quit [Ping timeout: 264 seconds]
13:03 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Connection reset by peer]
13:04 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
13:09 <@vpnHelper> RSS Update - forum: Remote Desktop and SSH not works after i change our router <http://forums.openvpn.net/topic8574.html>
13:15 -!- Berk000 [~someone@88.235.27.15] has quit []
13:28 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
13:32 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:32 < Olipro> is there a list of variables that will get passed to an up script?
13:45 <@vpnHelper> RSS Update - forum: Remote Desktop and SSH not works after i change our router <http://forums.openvpn.net/topic8574.html#p14276>
14:08 -!- KindOne [~lol@unaffiliated/kindone] has joined #openvpn
14:08 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p14277>
14:10 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has left #openvpn []
14:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:18 -!- jbb [~yeeb@184.105.219.149] has quit [Quit: No Ping reply in 180 seconds.]
14:19 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
14:24 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
14:35 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
15:08 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: brb]
15:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 264 seconds]
15:21 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
15:22 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Client Quit]
15:23 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
15:33 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
15:40 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
15:41 < majuk> Hey all. Can someone school me as to how 'common name' is managed? I understand it's set in the host.crt, but does the connecting client identify itself by that common name to the server or does the server make the inferrence from the .crt on file or something else altogether?
15:43 < majuk> The only thing I can figure is that the connecting client transmits it's host name and that is assumed by the server to be the corresponding common name..?
15:44 < majuk> Bah, no, that's wrong. gg me.
15:46 < |Mike|> CN
15:49 < majuk> Yea, I got it. I had a misconception about who was assigning the CN. It's all server side apparently.
15:50 < majuk> Now I just need a way to reassign the certs on my clients without having to touch them. >.>
15:51 < majuk> Silly ddwrt routers, wanting to be powercycled when I change things.
15:54 < |Mike|> hehe
15:55 < majuk> Hmm... so genn'd a new key, pressed it into DD-WRT's client info... and it doesn't even appear to be attempting to join the network. wtf. :|
15:56 < majuk> The VPN network, that is.
15:56 < majuk> It is joining the LAN
15:56 < |Mike|> logs!
15:56 < |Mike|> !logs
15:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
15:57 < majuk> Yah, the dd-wrt doesn't record logs and my server isn't reporting any inbound connects.
15:57 < majuk> >.<
15:58 < |Mike|> ...
15:58 < majuk> iknowrite.
15:59 < majuk> I'm mostly talking to myself at this juncture I suppose.
16:01 < majuk> Sucks too, I need this so I can differentiate between the dozen clients I have out in the field and it looks like if I change their cert, I'll bump them off the VPN, never to return. T.T
16:01 < |Mike|> fix openvpn to log then..
16:01 < |Mike|> can openvpn read the certs etc?
16:02 < majuk> Attempting to. I've been using DD-WRT's gui interface to set the openvpn stuffs (crt, key, ca.crt), so I don't know where the actual conf file is in the router's file system
16:03 < majuk> Fruuuuuuuuuustration.
16:04 < majuk> kk, found it and the certs... everything seems to be in order...
16:04 < majuk> Hmm.
16:05 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
16:06 < majuk> Oh ho. Openvpn just straight isn't starting.
16:06 < majuk> wtf
16:06 < majuk> How DARE you not run openvpn!
16:09 < |Mike|> error.. start it from $
16:10 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Read error: Operation timed out]
16:12 < majuk> |Mike|, Not an option, no access to the client's in the field once their off the VPN
16:13 < majuk> *they're
16:13 <@vpnHelper> RSS Update - forum: Very slow speed through TAP tunnel between Linux and Windows <http://forums.openvpn.net/topic8575.html>
16:27 -!- EugeneKay is now known as EugeneKaway
16:34 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
16:38 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:50 < majuk> Finally!
16:50 < majuk> Tue Aug  2 23:49:39 2011 OpenVPN 2.1.1 mips-unknown-linux-gnu [SSL] [LZO2] [EPOLL] built on Aug 19 2010
16:50 < majuk> Tue Aug  2 23:49:39 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
16:50 < majuk> Tue Aug  2 23:49:39 2011 Cannot load certificate file /tmp/openvpncl/client.crt: error:0906D066:lib(9):func(109):reason(102): error:140AD009:lib(20):func(173):reason(9)
16:50 < majuk> Tue Aug  2 23:49:39 2011 Exiti
16:50 < majuk> Woops, sorry about that
16:50 < majuk> Probably have an extra space in it or something. -.-
16:53 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
16:53 < majuk> Hmm, looks ok though.
16:58 < majuk> zomfg
16:58 < majuk> I missed ONE -
16:58 < majuk> *headdesk*
16:58 < majuk> -----END CERTIFICATE----
16:58 < majuk> lawl
16:59 < majuk> Well that's an hour of my life that's never coming back.
16:59 < majuk> Nay, 75 minutes.
17:26 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14279>
17:46 < Meliorator> hi, can someone help me get my up/down scripts working? i've put the relevant up/down lines in my openvpn client conf, but they never get run. i dont see anything in syslog about it attempting to run them. any ideas?
17:48 -!- EugeneKaway is now known as EugeneKay
17:48 -!- Squidy_at_Home [~quassel@187.54.114.205] has joined #openvpn
17:50 -!- EugeneKay [EugeneKay@eugenekay.com] has left #openvpn []
17:51 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
17:53 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:54 -!- K1ng` [~KING@180.211.188.231] has joined #openvpn
17:57 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 260 seconds]
17:57 -!- gorkhaan [~gorkhaan@catv-89-135-155-150.catv.broadband.hu] has quit [Quit: Távozom]
18:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
18:08 <@vpnHelper> RSS Update - forum: Configuring OpenVPN as Hotspot Proxy <http://forums.openvpn.net/topic8573.html#p14280>
18:13 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 258 seconds]
18:13 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:13 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
18:14 -!- mode/#openvpn [+v Axeman] by ChanServ
18:22 -!- satonio [~satonio@78.47.161.197] has joined #openvpn
18:23 < satonio> hi, how can i configure dnsmasq to resolve what it would resolve to a certain ip to another?
18:23 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Ping timeout: 250 seconds]
18:23 < satonio> or where can i find information about that?
18:24 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
18:24 -!- newmember [~chatzilla@198.162.158.30] has quit [Ping timeout: 240 seconds]
18:26 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Ping timeout: 250 seconds]
18:26 -!- fremo [~fremo@noc.toile-libre.net] has quit [Ping timeout: 276 seconds]
18:29 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
18:29 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Quit: Leaving]
18:30 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
18:30 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
18:34 < Olipro> what information does openvpn pass to an up script?
18:34 < Olipro> other than $dev
18:36 < Meliorator> if i could get my up script to trigger, i might be able to tell you :p
18:36 < satonio> what goes in $dev ?
18:37 -!- benr [~benr@c-76-127-118-92.hsd1.ca.comcast.net] has joined #openvpn
18:37 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
18:52 -!- Denial [~Denial@drgi.co.uk] has quit []
18:54 -!- satonio [~satonio@78.47.161.197] has quit [Quit: Saliendo]
18:57 -!- KindOne [~lol@unaffiliated/kindone] has quit [Remote host closed the connection]
19:03 -!- spridel [~spridel@unaffiliated/spridel] has quit [Disconnected by services]
19:04 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
19:04 -!- spridel [~spridel@unaffiliated/spridel] has joined #openvpn
19:06 < ecrist> Olipro: lots of stuff.
19:06 < ecrist> set up a script, dump the environment vars, you'll see
19:09 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
19:09 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:09 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:09 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:11 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
19:14 -!- K1ng` [~KING@180.211.188.231] has quit [Ping timeout: 250 seconds]
19:14 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
19:17 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 260 seconds]
19:17 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
19:20 -!- zvpn [~zvpn@gateway/tor-sasl/zvpn] has joined #openvpn
19:21 < zvpn> what windows command can i run to verify vpn connection
19:27 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
19:28 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
19:29 < Meliorator> ok so i got my up/down scripts triggered now ... but it seems the mounts i put in the up script are failing. what's weird is, if i comment the up script out in the conf and run the up script manually, after the openvpn client has started, it mounts them just fine. i also tried specifying the up script as a route_up script, but i get the same result. the up script and mount process are spawned,
19:29 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
19:29 < Meliorator> but look like they are hung.
19:30 < Meliorator> also noticed that when you try to mount them, when the openvpn client isn't started, the mount just seems to hang there ... so it seems the up script is being triggered too early
19:31 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
19:31 < Meliorator> i'm already using the --up-delay option, so i dont know what else to try?
19:36 < ecrist> zvpn: ping?
19:37 < ecrist> mounts, Meliorator?
19:39 < Meliorator> i have some cifs shares that are in the vpn, that i want mounted when the vpn client starts
19:39 < ecrist> !configs
19:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
19:40 < ecrist> also, paste your script
19:45 < Meliorator> client: http://pastebin.com/sv4r1jkH
19:45 < Meliorator> server: http://pastebin.com/9yLB3L1c
19:46 < Meliorator> script: http://pastebin.com/Mm5qQSR8
19:46 < Meliorator> fstab: http://pastebin.com/YSgav9rF
19:46 < Meliorator> server and client are gentoo, running openvpn 2.2.0-r1
19:48 < Meliorator> ip and ports are blanked out with x, where i felt appropriate... other than that, they are the verbatim conf
19:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
19:49 < ecrist> where is the up arg?
19:49 < Meliorator> gentoo handles it
19:50 < ecrist> um
19:50 < ecrist> no
19:50 < ecrist> we don't 'handle' gentoo
19:50 < ecrist> where's the up config option?
19:51 < ecrist> otherwise, my answer is "--up isn't working because it's not in your script"
19:51 < Meliorator> gentoo does all of that with it's init script
19:51 < ecrist> well, talk to the gentoo support folks, then.
19:52 < Meliorator> huh?
19:52 < Meliorator> what difference does it make if the option is specified in the init script?
19:53 < Meliorator> it's the same option
19:53 < ecrist> prove it
19:53 < ecrist> I asked for your config, and it wasn't there.
19:53 < ecrist> you're expecting me to 1) know gentoo and 2) assume you're right
19:54 < ecrist> experience mandates I don't assume anything, especially things told to me by users
19:55 < Meliorator> init script: http://pastebin.com/5nzN2QqL
19:55 < Meliorator> i guess you wanna see their up script aswell huh
19:55 < ecrist> no
19:55 -!- ArtVandalae [~ArtVandal@ppp59-167-188-168.static.internode.on.net] has joined #openvpn
19:56 < ecrist> I'm not going to troubleshoot a gentoo script
19:56 < ecrist> either add your --up to your openvpn config, or I'm not going to help you
19:56 < Meliorator> gentoo up script: http://pastebin.com/scUkWqpm
19:56 < ecrist>  /sbin/runscript is probably some bastardized version of sh, or a handler, or a version of bash or some such
19:56 < Meliorator> the issue has *NOTHING* to do with the init script
19:57 < Meliorator> i *SEE* the script being run
19:57 < Meliorator> i *SEE* the mount being run
19:57 < ecrist> great
19:57 < Meliorator> the mount just hangs
19:57 < Meliorator> like the client hasn't started yet
19:57 < ecrist> so, add your --up to your openvpn config, and show me it doesn't work.
19:57 < ecrist> :)
19:58 < Meliorator> are you blind?
19:58 < ecrist> no, but you're stupid
19:58 < Meliorator> do you not see the --up option?
19:58 < Meliorator> dude
19:58 < Meliorator> look
19:58 < Meliorator> http://pastebin.com/5nzN2QqL
19:58 < Meliorator> line 82
19:58 < ecrist> I don't want to look at that script
19:59 < Meliorator> if you can't be arsed to look, then why bother trying to help?
19:59 < ecrist> show me, OUTSIDE their script, our --up arg doesn't work.
19:59 < Meliorator> i already said
19:59 < Meliorator> it works
19:59 < Meliorator> i see the script running
19:59 < ecrist> no
19:59 < Meliorator> yes, yes i do see it
19:59 < ecrist> !logs
19:59 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
20:00 < Meliorator> i'll paste you the line
20:01 < Meliorator> Aug  3 01:35:16 enslaved openvpn[32054]: /etc/openvpn/up.sh tun1 1500 1542 10.8.0.18 10.8.0.17 init
20:01 < Meliorator> the script is run.
20:01 < Meliorator> the mount hangs.
20:01 < Meliorator> i assume the client is not ready?
20:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:04 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
20:04 -!- mode/#openvpn [+v Axeman] by ChanServ
20:05 -!- udk [~evaldo@freenode/staff-emeritus/udontknow] has quit [Quit: leaving]
20:06 -!- mode/#openvpn [+o ecrist] by ChanServ
20:06 -!- Meliorator was kicked from #openvpn by ecrist [Meliorator]
20:06 -!- Meliorator [m@dunnington.eu] has joined #openvpn
20:06 <@ecrist> I asked for your logs.  either leave, or provide what I ask.
20:07 <+Axeman> olipro?
20:07 < Olipro> pardon?
20:08 < Meliorator> lol
20:08 < Meliorator> power trippin fun eh?
20:08 <@ecrist> yup
20:08  * EugeneKay pokes Olipro in the nose
20:08 < Meliorator> so you got the log line you needed?
20:08 <+Axeman> are you THE olipro? 
20:08 < Meliorator> what else do you need to see?
20:08 <+Axeman> lol xda guy? 
20:08 < EugeneKay> Axeman - no :-p
20:09 <@ecrist> seriously, go away Mel
20:09 < Olipro> Axeman: join #xda-devs and find out
20:09 < EugeneKay> He's worse.
20:09 -!- mode/#openvpn [+b *!*@dunnington.eu] by ecrist
20:09 -!- Meliorator was kicked from #openvpn by ecrist [Meliorator]
20:10 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has quit [Ping timeout: 252 seconds]
20:11 -!- newbie [Rush@188.222.85.12] has joined #openvpn
20:11 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
20:11 < EugeneKay> So Oli, what brings you to this neighborhood?
20:11 -!- newbie is now known as Guest34347
20:11 < Olipro> I use OpenVPN for peering on DN42
20:12 <@ecrist> Olipro: you do Android dev?  get me a tap driver on Android. :D
20:13 < Olipro> uh, why, won't the kernel module build? :\
20:13 < EugeneKay> Because android's kernel is a massive kangjob
20:13 <@ecrist> I've not tried, yet.  the openvpn support doesn't include tap, though
20:14 < Olipro> EugeneKay: naw, depends on the platform you're targeting
20:14 < Olipro> it's very gradually getting mainlined
20:14 < EugeneKay> Except it isn't
20:14 < Olipro> although perhaps "gradually" is too generous
20:14 < Olipro> osnap
20:15 <@ecrist> i have HTC Glacier, running cyanogenmod 7.1 RC
20:15 <@ecrist> $work VPN uses bridged mode, so need TAP. :(
20:15 < EugeneKay> VPN the VPN
20:16 < EugeneKay> Duh :-p
20:17 -!- master_of_master [~master_of@p57B532D1.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
20:18 < Olipro> sounds messy
20:18 <+Axeman> i'm looking at one of att's 4g andy's 
20:18 < Olipro> besides, what if you want to run iBGP from your HTC device
20:18 <@ecrist> EXACTLY, Olipro 
20:18 < Olipro> not because you should, because you really shouldn't... because you CAN.
20:19 -!- master_of_master [~master_of@p57B53358.dip.t-dialin.net] has joined #openvpn
20:19 <+Axeman> brb - i need to listen to what you ppl are saying!
20:19 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
20:20 < Olipro> so anyway, anyone feel like accommodating my lethargy and linking me to a list of vars passed to an up script?
20:20 < Olipro> I had hoped it'd be in the documentation
20:20 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:21 < EugeneKay> man openvpn
20:22 < EugeneKay> "SCRIPTING AND ENVIRONMENTAL VARIABLES"
20:22 <@ecrist> Olipro: create a csh script that has two lines:
20:22 <@ecrist> #!/bin/csh
20:22 <@ecrist> setenv > /tmp/vars.txt
20:22 <@ecrist> then, after it's run, you'll have the whole list
20:23 < EugeneKay> burn the csh heretic!
20:23 -!- EugeneKay was kicked from #openvpn by ecrist [fuck you]
20:23 <@ecrist> :)
20:23 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
20:23 <@ecrist> :)
20:24 < EugeneKay> That'll be $20
20:24  * ecrist deops before he causes problems.
20:24 -!- mode/#openvpn [-o ecrist] by ecrist
20:25 < Olipro> pfft csh
20:26 < Olipro> we'd get up at the crack of dawn for nowt but an ash shell
20:26 < Olipro> and we were grateful for it
20:27 < Olipro> also, setenv was exactly what I was looking for, thank'ee
20:27  * Olipro goes off to use a less retarded way of setting up IPv6
20:32 < Guest34347> hey guys
20:32 < Guest34347> i heard ecrist is a bit of a cock smoker
20:32 < Guest34347> likes to work at the fudge packing factory
20:32 < Guest34347> competes in sausage jockeying events
20:32 < Guest34347> relaxes by doing some uphill gardening
20:32 < Guest34347> son of a marmite minor
20:32 < Guest34347> tbh, it's probably suffice to say that he's a FUCKING GAYLORD
20:32 < Guest34347> go fuck yourself ecrist you arse rapist
20:32 -!- Guest34347 [Rush@188.222.85.12] has quit []
20:32 -!- mode/#openvpn [+o EugeneKay] by ChanServ
20:32 <@EugeneKay> He's buggered off.
20:32 < ecrist> heh
20:33 -!- mode/#openvpn [-o EugeneKay] by ChanServ
20:33 -!- mode/#openvpn [+o ecrist] by ChanServ
20:33 -!- mode/#openvpn [+b *!*@188.222.85.0/24] by ecrist
20:33 -!- mode/#openvpn [+b *!*@188.222.85.*] by ecrist
20:34 < EugeneKay> I was going to suggest +q Guest*!*@*
20:34 <@ecrist> feel free
20:34 < EugeneKay> (I think that's the right way around, lemme check)
20:34 <@ecrist> we gave you ops for a reason...
20:34 < EugeneKay> There's that.
20:35 -!- mode/#openvpn [+o EugeneKay] by ChanServ
20:35 -!- mode/#openvpn [+q Guest*!*@*] by EugeneKay
20:35 -!- Squidy_at_Home [~quassel@187.54.114.205] has quit [Remote host closed the connection]
20:35 -!- EugeneKay is now known as guest9000
20:35 -!- mode/#openvpn [-o guest9000] by guest9000
20:35 -!- guest9000 [EugeneKay@eugenekay.com] has left #openvpn []
20:35 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
20:35 < EugeneKay> It appears to have worked.
20:36 < Olipro> I'm disappointed he didn't say anything about cock mongling
20:37 -!- Squidy_at_Home [~quassel@187.54.114.205] has joined #openvpn
20:44 <@ecrist> lol
20:44 -!- mode/#openvpn [-o ecrist] by ecrist
20:45 -!- ChanServ changed the topic of #openvpn to: OpenVPN 2.2.1 most current, released 6-July-2011 || Your problem is your firewall, really. || Type !welcome and !goal before asking your questions. || Web Forum: https://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly. || Host Cloaks available, just ask for one. | Access Server support in #openvpn-as | also, ecrist is an arse rapist, Guest343
20:46 < ecrist> blast
20:47 < EugeneKay> Trim some of the fat from the beginning. Periods are easy.
20:53 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
20:56 -!- zvpn [~zvpn@gateway/tor-sasl/zvpn] has quit [Quit: They see me trollin'  They hatin']
21:04 -!- mode/#openvpn [+o ecrist] by ChanServ
21:06 -!- ecrist changed the topic of #openvpn to: OpenVPN 2.2.1 most current releast 6-July-2011 || Your problem is your firewall, really || Type !welcome and !goal before asking || Forum: https://forums.openvpn.net || We won't put more work into your problem than you do, that's just silly || Host cloaks available ask ecrist || Access Server goto $openvpn-as || also ecrist is an arse rapist, Guest34347 said so
21:06 <@ecrist> there we go
21:06 -!- mode/#openvpn [-o ecrist] by ecrist
21:07 <+Axeman> okay - so i walk away and you ppl stop talking android. 
21:09 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
21:09 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
21:09 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:11 < EugeneKay> #openvpn != #android-chat
21:11 <+Axeman> lol nice EugeneKay 
21:12 < ecrist> EugeneKay: the adroid convo here a bit ago was openvpn-related
21:12 < EugeneKay> I know, I was in it.
21:12 < EugeneKay> But now it's over.
21:12 < EugeneKay> Unless we're starting it back up
21:13 < EugeneKay> Which it seems we're not
21:13 < EugeneKay> Now where is my dinner
21:14 <+Axeman> better not mess w. EugeneKay ... sherriff's a tuff un
21:14 < EugeneKay> Only on arse rapists
21:14 < ecrist> EugeneKay: http://pastebin.com/iCQaaSNY
21:15  * ecrist awaits the +b
21:15  * EugeneKay sets mode +sphincterdentata EugeneKay
21:18 <+Axeman> nice ecrist
21:18 <+Axeman> lol
21:22 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:34 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:39 -!- Kateon [~user@xs8.xs4all.nl] has quit [Ping timeout: 260 seconds]
21:40 < ecrist> meh
21:40 <+Axeman> http://www.youtube.com/watch?v=1YAGaiHARPM
21:40 <@vpnHelper> Title: Motorola Atrix, Samsung Infuse, or HTC Inspire? At - YouTube (at www.youtube.com)
21:40 <+Axeman> <-- not me
21:40 < ecrist> wtf?
21:41 <+Axeman> lol
21:41 <+Axeman> i have the same question
21:41 <+Axeman> i googled atrix, infuse, infuse
21:41 <+Axeman> and wham
21:41 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
21:52 < EugeneKay> Motololas are nigh-impossible to get running a custom OS
21:52 < EugeneKay> Samsungs are trolololo nobody cares
21:53 < EugeneKay> Inspire..... is a fairly nice device, but it's running 2.2 out of he box, and doesn't have the nice qHD hawtness like the Sensation
21:53 < EugeneKay> Looks like it has full CM support, tho
21:58 <+Axeman> wrong window EugeneKay - i aksed in xda
21:58 <+Axeman> lol
22:00  * ecrist +b EugeneKay|fuckNugget (realizes RFC1459 doesn't do regex
22:09 < fluter> htc wp7 phone is nice
22:10 < EugeneKay> Something something heretic
22:10 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
22:11 -!- dreedo [d1c8226e@gateway/web/freenode/ip.209.200.34.110] has joined #openvpn
22:12 <+Axeman> i'm done w. windows
22:12 <+Axeman> i can't belive i said that
22:12 <+Axeman> *phone
22:13 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
22:13 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
22:13 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
22:46 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
22:46 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:46 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:48 -!- glc [~Gclark@adsl-99-63-81-253.dsl.chcgil.sbcglobal.net] has joined #openvpn
22:48 -!- glc [~Gclark@adsl-99-63-81-253.dsl.chcgil.sbcglobal.net] has left #openvpn ["Leaving"]
22:49 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
22:54 -!- fengshaun [~fengshaun@cpe-098-024-011-229.carolina.res.rr.com] has joined #openvpn
22:55 < fengshaun> Hi all, I'm trying to set up openvpn on windows vista, and when i try to start the server, I get the error that dh1024.pem file could not be found.  This file is in easy-rsa/keys directory.  What am I doing wrong?
22:55 < fengshaun> (I followed the website's how-to step by step)
22:56 < EugeneKay> To be blunt, the answer is in your question.
22:56 < EugeneKay> If your file is in a subdir, you need o specify that subdir in the config line pointing to that file.
22:56 < EugeneKay> ie, "dh easy-rsa/keys/dh1024.pem", not "dh dh1024.pem"
22:57 < fengshaun> oh, thanks!  Should I do the same with the keys/certificates?
22:57 < EugeneKay> Indeed.
22:57 < fengshaun> that makes sense.  Thanks a lot!
22:57 < EugeneKay> Though it is bad practice to use he easy-rsa/keys/ dir, you should copy the files needed by the server to a keys/ dir, or keep it alongside the .ovpn config file(which is what I do)
22:58 < EugeneKay> Your PKI directory(easy-rsa/) should be kept someplace secure.
22:58 < fengshaun> EugeneKay: oh ok.  I'll do that now, thanks!
22:59 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:01 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 246 seconds]
23:02 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
23:13 < fengshaun> EugeneKay: so, I did easy-rsa/keys/dh1024.pem but I still get the same error!
23:13 < EugeneKay> Something is wrong with your paths :-p
23:13 < EugeneKay> They should be relative to the ovpn file
23:13 < fengshaun> oh, relative to ovpn!  Thanks!
23:15 < fengshaun> ok, now it's working, thanks a lot!
23:15 < EugeneKay> Sure.
23:16 < EugeneKay> Keep in mind that the HOWTO is a basic minimum necessary to get up-and-going. There are a lot of assumptions made in it that you ought to read into
23:16 < fengshaun> where can I read more about other options
23:16 < fengshaun> ?
23:16 < fengshaun> I've read the manual too
23:16 < EugeneKay> The man pages
23:16 < EugeneKay> Just kinda figure it out by doing :-p
23:17 < fengshaun> yea, once I get the minimum going, I'll configure it little by little!
23:17 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Read error: Operation timed out]
23:17 < EugeneKay> Feel free to hang about here - inquisitive users is tthe reason behind this channel. Also ecrist's arse raping needs.
23:18 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
23:18 < fengshaun> lol, I will keep that in mind! :)
23:19 -!- newmember [~chatzilla@66.183.103.108] has joined #openvpn
23:30 -!- dreedo [d1c8226e@gateway/web/freenode/ip.209.200.34.110] has quit [Quit: Page closed]
23:41 < Olipro> EugeneKay: do you use OpenVPN with Windows?
23:41 < EugeneKay> Client, yes.
23:42 < Olipro> with the TAP adapter?
23:42 < Olipro> (is there any other)
23:42 < EugeneKay> TAP-Win32 Adapter V9
23:42 < Olipro> yah
23:42 < Olipro> can that connect to a Linux TUN?
23:43 < EugeneKay> Yup.
23:43 < Olipro> ah, so it's not strict TAP
23:43 < EugeneKay> I in fact specify dev tun in my .ovpn
23:46 -!- fengshaun [~fengshaun@cpe-098-024-011-229.carolina.res.rr.com] has quit [Ping timeout: 260 seconds]
23:47 -!- fengshaun [~fengshaun@cpe-098-024-011-229.carolina.res.rr.com] has joined #openvpn
23:47 -!- fengshaun [~fengshaun@cpe-098-024-011-229.carolina.res.rr.com] has quit [Client Quit]
23:51 -!- Squidy_at_Home [~quassel@187.54.114.205] has quit [Remote host closed the connection]
--- Day changed Wed Aug 03 2011
00:38 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:47 <@vpnHelper> RSS Update - forum: Used build-key-pass for existing client; how to clean up? <http://forums.openvpn.net/topic8576.html>
00:53 <@vpnHelper> RSS Update - forum: Configuring OpenVPN as Hotspot Proxy <http://forums.openvpn.net/topic8573.html#p14282>
01:00 -!- Ragnar_ [heimdall@darkstar.acool.net] has joined #openvpn
01:00 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:02 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 258 seconds]
01:06 -!- spridel [~spridel@unaffiliated/spridel] has left #openvpn ["They're trashing our rights!"]
01:12 <@vpnHelper> RSS Update - forum: Used build-key-pass for existing client; how to clean up? <http://forums.openvpn.net/topic8576.html#p14283>
01:24 <@vpnHelper> RSS Update - forum: Used build-key-pass for existing client; how to clean up? <http://forums.openvpn.net/topic8576.html#p14285>
01:26 < incidence> Hey, I installed OpenVPN. It works flawleslly, but now I can't connect outside, Like www.google.com goes to 10.0.1.7 (openvpn server)
01:32 < fluter> incidence, check route?
01:36 <@vpnHelper> RSS Update - forum: Used build-key-pass for existing client; how to clean up? <http://forums.openvpn.net/topic8576.html#p14287> || Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html>
01:48 <@vpnHelper> RSS Update - forum: Used build-key-pass for existing client; how to clean up? <http://forums.openvpn.net/topic8576.html#p14288>
01:48 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
01:49 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
02:06 <@vpnHelper> RSS Update - forum: Used build-key-pass for existing client; how to clean up? <http://forums.openvpn.net/topic8576.html#p14289>
02:08 -!- patelx [~a@openvpn/corp/admin/patel] has quit [Read error: Connection reset by peer]
02:08 -!- patelx [~a@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
02:14 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Read error: Connection reset by peer]
02:15 < Mowee> Morning
02:18 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14290>
02:36 -!- luneff [~yury@93.178.118.151] has joined #openvpn
02:39 -!- dazo_afk is now known as dazo
03:06 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14291>
03:12 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14293> || VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14292>
03:16 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
03:16 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
03:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
03:18 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14294>
03:24 < hyper_ch> krzee: dazo: Bushmills: http://www.cypherpunks.ca/~iang/pubs/telex-usenix.pdf
03:29 < dazo> hyper_ch: gee, what kind of link are these guys sitting on ... GPRS?
03:29 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14295>
03:30 < dazo> (download 3KiB/s)
03:30 < hyper_ch> dazo: who?
03:30 < dazo> cyberpunks.ca
03:30 < hyper_ch> dazo: dunno... I didn't read the pdf - just the news article in german
03:31 < dazo> heh
03:31 < hyper_ch> and I thought I'd be so kind to link the english paper to you instead of the german news article
03:31 < dazo> :)
03:31 < hyper_ch> but I can link you to the german article if you want
03:44 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
04:10 -!- benr [~benr@c-76-127-118-92.hsd1.ca.comcast.net] has quit [Quit: benr]
04:20 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Read error: Connection timed out]
04:21 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
04:24 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14296>
05:00 -!- dazo is now known as dazo_afk
05:01 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:01 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:01 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:08 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:08 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:17 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
05:19 -!- investor [~investor@88.235.27.15] has joined #openvpn
05:19 < investor> Looking for someone can create VPN Company from 0
05:19 < investor> can pay well
05:26 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
05:35 < Bushmills> why not doing it yourself?
05:37 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
05:42 <@vpnHelper> RSS Update - forum: Trouble with proxy-arp setup from OpenVPN Cookbook 2 <http://forums.openvpn.net/topic8381.html#p14297>
05:46 < investor> i dont have enough information and experience
05:48 <@vpnHelper> RSS Update - forum: tethering for unlimited data with Verizon <http://forums.openvpn.net/topic8570.html#p14299> || Connection between VPN clients <http://forums.openvpn.net/topic8561-15.html#p14298>
05:49 -!- investor [~investor@88.235.27.15] has quit [Read error: Connection reset by peer]
05:54 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14300>
05:55 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
05:56 -!- dazo_afk is now known as dazo
06:00 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p14302> || Remote Desktop and SSH not works after i change our router <http://forums.openvpn.net/topic8574.html#p14301>
06:06 <@vpnHelper> RSS Update - forum: Configuring OpenVPN as Hotspot Proxy <http://forums.openvpn.net/topic8573.html#p14304> || Very slow speed through TAP tunnel between Linux and Windows <http://forums.openvpn.net/topic8575.html#p14303>
06:07 -!- Denial [~Denial@drgi.co.uk] has quit []
06:08 -!- dazo is now known as dazo_afk
06:12 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14305>
06:13 -!- dazo_afk is now known as dazo
06:14 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:14 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:14 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
06:14 -!- mode/#openvpn [+v Axeman] by ChanServ
06:23 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
06:31 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14306>
06:34 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:34 -!- mode/#openvpn [+v s7r] by ChanServ
06:37 -!- dazo is now known as dazo_afk
06:37 -!- dazo_afk is now known as dazo
06:43 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14307>
06:56 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
06:57 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
06:57 -!- mode/#openvpn [+v Axeman] by ChanServ
06:59 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Client Quit]
07:01 <@vpnHelper> RSS Update - forum: VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14308>
07:07 <@vpnHelper> RSS Update - forum: Use OpenVPN both on local network & remote <http://forums.openvpn.net/topic8522.html#p14309>
07:12 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14310>
07:19 <@vpnHelper> RSS Update - forum: OpenVPN Install Guides <http://forums.openvpn.net/topic2.html#p14311>
07:23 -!- ph1l [~ph1l@inetgw.dreamlab.net] has joined #openvpn
07:25 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14312>
07:27 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
07:27 -!- mode/#openvpn [+o mattock] by ChanServ
07:49 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14314> || OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p14313>
07:51 -!- Polynomial [SP3-920@unaffiliated/polynomial] has joined #openvpn
07:52 < Polynomial> !welcome
07:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:53 < Polynomial> lol, kk
07:53 < Polynomial> a friend (more of an acquaintance, I guess) of mine has been given a project by his college to write a VPN server along with 4 other people.
07:54 < Polynomial> d'you think if I sent him here you could give him some pointers as to where to look for documentation on how they'd go about it
07:54 < Polynomial> I've given him the basics - RFCs on ethernet frames and L2TP and the like
07:54 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p14315>
08:01 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p14316>
08:04 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
08:04 < _dinsdale> !welcome
08:04 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:06 < Bushmills> Polynomial: "how to write a server" .. i suppose, looking at the source code of openvpn could give some clues
08:12 < _dinsdale> Hi, I'm have a established vpn on the far side openvpn 2.1.1 and here I have tried 2.1.4 and 2.2.0. The vpn connection terminates as soon as I try copieng files larger than let's say 200k. It get's the first 100k or so.
08:14 < _dinsdale> I already set up wireshark locally to sniff the tap interface but I can't see anything suspicious. I can run several pings at the same time with a 8000 Bytes packetsize and they come through fine. 
08:15 < _dinsdale> :s/tap/tun
08:15 -!- ph1l [~ph1l@inetgw.dreamlab.net] has quit [Read error: Connection reset by peer]
08:15 -!- ph1l [~ph1l@inetgw.dreamlab.net] has joined #openvpn
08:19 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p14317>
08:20 < _dinsdale> If I run iperf through the tunnel I get between 1.05MBits and 6
08:20 < _dinsdale> 55
08:21 -!- adubz [~adub@h-66-166-185-2.dllatx37.static.covad.net] has joined #openvpn
08:21 < _dinsdale> sry fatfinger, I'm getting with iperf between 1 and 5MBytes/sec and the vpn doesn't crash at all
08:22 < adubz> what is an openvpn command that will detect vpn connectivity and no ifconfig or ipconfig just a verify connection something or another
08:22 < reiffert> keepalive
08:22 < reiffert> !factoids search --values aliv
08:22 <@vpnHelper> No keys matched that query.
08:25 < dazo> !gigabit
08:25 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
08:26 < dazo> _dinsdale: ^^^ you might get some more useful info on performance stuff here
08:27 < dazo> however, it seems like you have general connectivity issues ... there are no known bugs related to openvpn collapsing on bigger file transfers
08:27 < _dinsdale> dazo: sry, it's defenitly Mbit, Silly me switched the cloumns in iperf :-). between 1-5Mbits/sec
08:28 < dazo> adubz: your question is very difficult to parse ... could you please try to rephrase?
08:29 < adubz> dazo ok even more specific i want ot verify vpn connection on windows with a command that is universal for windows
08:29 < adubz> that will glare a certain something that vpn connectivity exist
08:29 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
08:30 < adubz> maybe this is a 3rd party application or something or something from command line or does someone know of a script that will do this cross platform
08:30 < dazo> adubz: the simplest is probably to ping your openvpn server's VPN address ... if that fails, you have no VPN
08:32 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
08:33 < adubz> something other than that that is a good answer but not ping something that can go to the socket layer or something and detect vpn type interfaces and see if ip address exist
08:33 < adubz> if ipconfig could specify interfaces it would work 
08:33 < adubz> for what i am wanting to do
08:33 < adubz> but it simply does not
08:33 < adubz> ifconfig tun; ifconfig tap  for freebsd and linux will accopmlish what i want
08:36 < adubz> or is there a way to ipconfig and only display connections that have ip
08:37 < adubz> not ipconfig "local area connection etc"
08:37 < adubz> bc that connection may not be vpn this has to work for all
08:49 <@vpnHelper> RSS Update - forum: Authentication access <http://forums.openvpn.net/topic8578.html>
08:51 -!- _dinsdale_ [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
08:51 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Ping timeout: 252 seconds]
08:59 -!- mick_laptop [~mick@clamwin/admin/mickhome] has quit [Ping timeout: 252 seconds]
09:00 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has quit [Ping timeout: 260 seconds]
09:00 -!- jdoe [~jdoe@falseprophet.ca] has quit [Remote host closed the connection]
09:04 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
09:05 -!- luneff [~yury@93.178.118.151] has quit [Quit: This computer has gone to sleep]
09:11 -!- mick_laptop [~mick@mickweiss.com] has joined #openvpn
09:13 -!- jdoe [jdoe@falseprophet.ca] has joined #openvpn
09:25 -!- genlime [475e9251@gateway/web/freenode/ip.71.94.146.81] has joined #openvpn
09:26 -!- genlime [475e9251@gateway/web/freenode/ip.71.94.146.81] has left #openvpn []
09:27 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
09:29 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
09:30 -!- _dinsdale_ [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Ping timeout: 258 seconds]
09:30 -!- sajjadG [~sajjadG@178.173.194.4] has joined #openvpn
09:40 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:44 -!- ArtVandalae [~ArtVandal@ppp59-167-188-168.static.internode.on.net] has quit [Read error: No route to host]
09:45 -!- ArtVandalae [~ArtVandal@ppp59-167-188-168.static.internode.on.net] has joined #openvpn
09:51 -!- luneff [~yury@84.51.196.42] has joined #openvpn
09:54 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
10:01 -!- sajjadG [~sajjadG@178.173.194.4] has quit [Quit: Leaving]
10:01 -!- ph1l [~ph1l@inetgw.dreamlab.net] has quit [Quit: Leaving.]
10:23 -!- Axeman [~thirdchoi@198.105.46.48] has joined #openvpn
10:23 -!- Axeman [~thirdchoi@198.105.46.48] has quit [Changing host]
10:23 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
10:23 -!- mode/#openvpn [+v Axeman] by ChanServ
10:25 < fluter> hi, anyone could recommend a good vpn service ? stable and good speed
10:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
10:28  * TimothyA beats prq to a pulp
10:28 < TimothyA> the moment you have to actually ask something related to the VPN, they go silent
10:29 < fluter> TimothyA,  ?
10:29 < TimothyA> I'm saying, don't use PRQ if you need anything more than basic VPN capabilities
10:29 < TimothyA> I'm pissed off beyond recognition right now
10:29 < ecrist> who does?
10:30 < ecrist> fluter: there are a few out there, we here have little experience with them, as we run our own
10:30 < fluter> ecrist, could you recommend some?
10:30 < ecrist> nope, I no nothing of any
10:30 < ecrist> there might be something on the forum.
10:31 < jbb> fluter: buy a 128mb vps and set up openvpn
10:32 < fluter> jbb, can vps setup openvpn? 
10:32 < jbb> fluter: http://buyvm.net
10:32 <@vpnHelper> Title: BuyVM - Affordable VPS's for the masses (at buyvm.net)
10:32 < fluter> openvpn use tap device, which is not in virutal server, right?
10:32 < jbb> they get stock tonight
10:33 < jbb> 4 1/2 hours
10:34 < TimothyA> 15$ a year? for a VPS?
10:34 < TimothyA> sounds like someone is overselling
10:34 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
10:35 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Quit: majuk]
10:35 < jbb> perfect for a vpn though
10:35 < fluter> jbb, what about the bandwidth?
10:35 < jbb> what about it?
10:36 < ecrist> you can get a colo box in florida on a 100Mb pipe for $35/mo
10:36 < ecrist> you have to provide the 1u server, though.
10:36 < jbb> fluter: http://buyvm.net/100mb.test
10:37 < ecrist> lame
10:37 < ecrist> that test means nothing.
10:37 < jbb> :(
10:38 < fluter> right, ;)_
10:39 < jbb> meh i know a heap of people use that plan for tunnelling i've heard no complaints
10:40 -!- rothwell [~rothwell@unaffiliated/rothwell] has joined #openvpn
10:41 < rothwell> lo. don't suppose it's possible to get slightly more fine-grained access control on the management console, is it?
10:42 < rothwell> i mean... i'd like to allow some clients to read the state of the vpn but not make any configuration changes
10:42 < ecrist> in what way?
10:42 < ecrist> as of now, I don't know that there is such a thing.
10:42 < ecrist> sounds like a great candidate for the wishlist, though
10:42 < rothwell> didn't think so... just wanted to make sure
10:42 < ecrist> !wishlist
10:42 <@vpnHelper> How to modify the code and build it using msys for Windows || Clear example || firewall for blocking ddos attacks || Non-Admin usage of OpenVPN on Windows || my wish || suggested MSS feature for "proto tcp" operation || Please fix Win32/64bit Tap Tunnel Adapter!!! || OpenVPN over ICMP || my other wish || my wish - Push Option || Add product version information to the windows binaries
10:42 <@vpnHelper> || Kill The Resources Being Used By OpenVPN Desktop Client || passtos working on windws || common-name-as-username || --shaper and --server together || Windows auto-connect when starting gui || sctp implementation in openvpn || OpenVPN on a Nokia phone with Symbian^3 || Multicast support in tap-win32 (with patch) || OpenVPN to filter DHCP requests in bridge mode || my wish ||
10:42 <@vpnHelper> cryptoapicert and ca || Root Permission Restart || Reject pushed directives (eg. routes) via client config || openvpn and a different ntlm auth || Port Hopping... || FIPS-compliant OpenVPN || Symbian^3 support || Windows Client Source Code + Build Instructions || Define one or more networks on one OpenVPN instance || Compiling OpenVPN v2.1.2 with enable-password-save option || OpenVPN (1 more message)
10:42 < ecrist> gah
10:42 < rothwell> hehe
10:42 < ecrist> !factoids search wishlist
10:42 <@vpnHelper> "wishlist" is https://forums.openvpn.net/viewforum.php?f=10 for the openvpn wishlist
10:42 < ecrist> :)
10:43 -!- investor [~investor@88.235.27.15] has joined #openvpn
10:44 < investor> Looking for someone able to create VPN company from 0
10:44 < investor> can pay well
10:44 < ecrist> investor: I'm the man.
10:44 < fluter> investor, I'm the man.
10:44 < ecrist> Forward an up-front payment of $50,000 and I'll get started today
10:45 < fluter> Forward an up-front payment of $49,999 and I'll get started today
10:45 < investor> looking for serious partners
10:45 < TimothyA> 49,99
10:45 < investor> :P
10:45 < fluter> lolz
10:45 < ecrist> investor: I'm serious.  but I don't come cheap.
10:45 < TimothyA> I didn't add a currency or qualify with an amount
10:45 < fluter> I am serious too
10:45 < TimothyA> *quantifier amount
10:47 < investor> so whos intrested PM me
10:48 < TimothyA> investor: I doubt anyone is going to spend money for a partnership in which only they themselves will contribute while you add nothing
10:49 < investor> they dont need spend money
10:49 < investor> i will spend all money
10:49 < TimothyA> right. and then take off without any legal paperwork?
10:49 < investor> sorry didnt understand you
10:50 < TimothyA> looking online would possibly be the worst place to look for any partnerships since we don't know where you live so we can kick your ass if you burn someone on a deal
10:50 < investor> im hiring man
10:50 < investor> i pay you
10:50 < investor> you create my VPN company
10:50 < investor> thats the deal
10:50 < TimothyA> right, carry on
10:51 < TimothyA> ...very interesting whois description
10:51 < dazo> investor: which country will this be based in?  And which country are you based in?
10:51 < investor> im from Turkey
10:52 < investor> we gonna seell VPN accounts to Turkish customers
10:52 < cpm> investor, got a web page set up with your prospectus? 
10:52 < investor> nope
10:52 < investor> dont have anything 
10:52 < investor> we need start from 0
10:52 < investor> i can buy anything you need
10:52 < investor> i want start from 10 location
10:52 < investor> i want custom client for my customers
10:53 < ecrist> sounds like you want an openvpn-as install
10:53 < investor> maybe i really dont have any experience in VPN business
10:54 < investor> something like Astrill
10:54 < investor> would be awesome
10:54 < ecrist> investor: you need a few things for anyone to take you seriously.  1) business plan.  who are your customers, where do they need access, where will you host the servers
10:55 < ecrist> 2) proof that you're going to pay.
10:55 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Ping timeout: 250 seconds]
10:55 < investor> My customers are normal Turkish internet users
10:55 < investor> youtube and a lot of website is blocked in Turkey
10:55 < ecrist> ah, bandwidth is expensive.
10:55 < investor> USA and few EU locations for start i need
10:56 < investor> im a internet marketer
10:56 < ecrist> I'd be happy to set something up for you here in Minneapolis
10:56 < investor> milked 70k$ last year
10:56 < investor> can invest 20k$
10:56 < investor> for this business
10:56 < investor> i want something like Astrill
10:56 < ecrist> well, that will almost pay for hosting for a year, and doesn't get you any hardware
10:56 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
10:57 < ecrist> realistically, we can do this with a few solid boxes and a half rack of space
10:57 < ecrist> bandwidth is going to kill you, but where we colo boxes, they have plenty of it
10:57 < investor> how much i need for start you think
10:59 < TimothyA> a lot
10:59 -!- adubz [~adub@h-66-166-185-2.dllatx37.static.covad.net] has quit [Quit: Leaving]
11:00 < ecrist> investor: $20 is reasonable
11:00 < ecrist> just don't assume it'll pay all your first year costs.
11:00 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
11:01 < TimothyA> you would make more trading stocks
11:01 < ecrist> I see you looking at about $10K for hardware, up-front, plus another $2K for up-front colo costs.
11:01 < ecrist> I think having a custom client is dumb, however.
11:01 < ecrist> extra development and support that you don't really need to worry about.
11:02 < ecrist> would bill based on bandwidth, and we can queue each user easy enough in pf
11:02 < investor> its really complicated
11:02 < investor> why should i worry about bandwith
11:03 < investor> i think they are selling servers withu unlimited bandwith
11:03 < TimothyA> because that's what's going to cost money
11:03 < TimothyA> they're overselling or have a very lucrative deal
11:03 < ecrist> bandwidth is expensive
11:04 < investor> how about custom client
11:04 < investor> i really want it
11:04 < ecrist> where we put servers, you get what you pay for.  if you're paying for 200Mb of bandwidth, you actually get that 200Mb of bandwidth
11:04 < TimothyA> it's not neccesary
11:04 < ecrist> it's stupid
11:04 < investor> my customers dont know english
11:04 < investor> and dont have enough computer experience
11:05 < TimothyA> the openvpn client is pretty easy
11:05 < investor> i want everything would be easy for them
11:05 < TimothyA> just give them a configuration file to load
11:05 < TimothyA> and done
11:05 -!- investor [~investor@88.235.27.15] has quit [Read error: Connection reset by peer]
11:05 < TimothyA> it appears someone has been listening in on his conversation :O
11:06 -!- investor [~investor@88.235.27.15] has joined #openvpn
11:07 < investor> sorry just disconnected
11:07 < investor> i also dont understand IP think
11:07 < fluter> investor, I can make the custome client, as you want
11:07 < investor> should i give 1 dedicated IP to per customer
11:08 < fluter> investor, no, each custome just need a vpn account,
11:08 < investor> so different users will have same IP ?
11:08 < fluter> one public ip for each server, hundreds of customers each server,
11:08 < ecrist> you want people to have public IPs?
11:09 < investor> idk i just see some VPN sellers give dedicated IP to customers
11:09  * ecrist goes away, is bored
11:09 < fluter> different users have different internal IP, the client doesnot care about public IPs
11:09 < fluter> ecrist, heh
11:10 < investor> so where to start you think
11:11 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Quit: No Ping reply in 180 seconds.]
11:11 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
11:11 < fluter> first build the infrastructure,
11:12 < fluter> run the server and services,
11:13 <+s7r> investor hello
11:13 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 260 seconds]
11:13 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
11:13 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
11:13 < investor> hello
11:14 <+s7r> stil not convinved huh ?
11:14 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Ping timeout: 252 seconds]
11:15 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Ping timeout: 264 seconds]
11:17 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Depression is merely anger without enthusiasm]
11:17 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
11:19 -!- gorkhaan [~gorkhaan@catv-89-135-155-150.catv.broadband.hu] has joined #openvpn
11:19 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Ping timeout: 250 seconds]
11:19 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14319>
11:22 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
11:23 -!- dazo is now known as dazo_afk
11:24 -!- clustermagnet [~Adium@ec2-75-101-158-130.compute-1.amazonaws.com] has quit [Remote host closed the connection]
11:25 -!- clustermagnet [~Adium@ec2-75-101-158-130.compute-1.amazonaws.com] has joined #openvpn
11:30 <@vpnHelper> RSS Update - forum: Authentication access <http://forums.openvpn.net/topic8578.html#p14320>
11:34 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 260 seconds]
11:35 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
11:38 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
11:38 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
11:39 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
11:44 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
11:44 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:45 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:54 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14321>
11:56 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has quit [Read error: Connection reset by peer]
11:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
11:59 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:00 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:02 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
12:04 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
12:05 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
12:05 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:07 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Ping timeout: 240 seconds]
12:10 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
12:11 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
12:11 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
12:12 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 264 seconds]
12:14 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
12:20 <@vpnHelper> RSS Update - forum: Authenticating to AD debugging <http://forums.openvpn.net/topic8579.html>
12:41 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
12:43 -!- default1 [~default@c83-254-101-75.bredband.comhem.se] has joined #openvpn
12:44 < default1> hello guys :)
12:44 < EugeneKay> Morning.
12:44 < default1> i have been googling my ass of trying to get openvpn in clientmode to bind to only one ip. Does anyone know where to find that info?
12:44 < default1> (i have two wan)
12:45 < default1> using tap-interface also...
12:45 < EugeneKay> local
12:46 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:46 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:46 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:47 < default1> the default config has nobind in it, and that one i got from my service provider
12:47 < default1> so i dont really know if i can use local. it complains...
12:49 < default1> and to tell you the truth i dont really understand what nobind does :D
12:51 -!- investor [~investor@88.235.27.15] has quit []
12:56 < default1> EugeneKay: it also seems like vpn messes up my default route when connecting. despite that i use it for connecting wan2 and not wan1.
12:56 < EugeneKay> That's probably because you're getting redirect-gateway pushed to you
12:56 < default1> (i have a server box with two external ips, and want a nat-network behind that server to go through vpn
12:56 < EugeneKay> !logs
12:56 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
12:58 < default1> EugeneKay: ok thanks. i'll read up on that then :)
12:59 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14323>
13:03 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Read error: Operation timed out]
13:03 < default1> thanks for the help so far. I was looking at that local alternative, but need to figure out how vpn sets up its routes to get this working i think :)
13:03 < default1> probably be back later :)
13:04 -!- default1 [~default@c83-254-101-75.bredband.comhem.se] has quit [Quit: WeeChat 0.3.5]
13:05 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
13:34 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Quit: Going offline, see ya! (www.adiirc.com)]
13:46 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p14324>
13:51 -!- jamxNL [jamx@2a01:4f8:140:5243::1234] has joined #openvpn
13:51 -!- jamxNL [jamx@2a01:4f8:140:5243::1234] has left #openvpn []
13:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:01 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
14:03 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 255 seconds]
14:12 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
14:12 -!- mode/#openvpn [+v Axeman] by ChanServ
14:17 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
14:24 -!- bauruine [~stefan@217.150.226.114] has joined #openvpn
14:26 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:28 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
14:28 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
14:30 -!- Axeman [~thirdchoi@198.105.46.48] has joined #openvpn
14:30 -!- Axeman [~thirdchoi@198.105.46.48] has quit [Changing host]
14:30 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
14:30 -!- mode/#openvpn [+v Axeman] by ChanServ
14:33 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: No route to host]
14:33 -!- EugeneKay is now known as EugeneKaway
14:38 <@vpnHelper> RSS Update - forum: VPN session expires too quickly <http://forums.openvpn.net/topic8547.html#p14325>
14:44 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html>
14:52 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:52 -!- mode/#openvpn [+o mattock] by ChanServ
14:56 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14327>
15:05 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
15:09 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
15:14 -!- luneff [~yury@84.51.196.42] has quit [Ping timeout: 258 seconds]
15:15 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
15:15 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:17 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
15:17 -!- mode/#openvpn [+o raidz] by ChanServ
15:18 -!- luneff [~yury@84.51.196.42] has joined #openvpn
15:18 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
15:20 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14328>
15:32 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
15:35 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Quit: No Ping reply in 180 seconds.]
15:37 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
15:47 -!- EugeneKaway is now known as EugeneKay
15:57 -!- bauruine [~stefan@217.150.226.114] has quit [Ping timeout: 264 seconds]
16:00 -!- newmember [~chatzilla@66.183.103.108] has quit [Ping timeout: 258 seconds]
16:04 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has quit [Ping timeout: 240 seconds]
16:04 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 276 seconds]
16:07 -!- Jedicus [~user@adsl-76-214-202-129.dsl.emhril.sbcglobal.net] has quit [Ping timeout: 276 seconds]
16:09 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14329>
16:09 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has joined #openvpn
16:09 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
16:09 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 260 seconds]
16:10 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
16:12 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
16:12 -!- gorkhaan [~gorkhaan@catv-89-135-155-150.catv.broadband.hu] has quit [Quit: Távozom]
16:18 -!- Jedicus [~user@76.214.202.129] has joined #openvpn
16:24 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 255 seconds]
16:24 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
16:30 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 246 seconds]
16:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
16:38 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
16:38 -!- luckman212 [~irc@2001:470:1f07:1225:2d40:d31d:26e0:afd3] has joined #openvpn
16:41 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
16:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:50 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has quit [Ping timeout: 255 seconds]
16:55 -!- newmember [~chatzilla@216.81.63.13.epikip.net] has joined #openvpn
17:00 -!- newmember [~chatzilla@216.81.63.13.epikip.net] has quit [Ping timeout: 276 seconds]
17:05 -!- clustermagnet [~Adium@ec2-75-101-158-130.compute-1.amazonaws.com] has left #openvpn []
17:21 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
17:21 -!- mode/#openvpn [+v Axeman] by ChanServ
17:21 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
17:22 -!- corretico_ [~luis@201.201.44.82] has quit [Remote host closed the connection]
17:23 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
17:31 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
17:46 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
18:06 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Read error: Operation timed out]
18:14 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
18:19 -!- EugeneKay is now known as EugeneKaway
18:20 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
18:20 -!- mode/#openvpn [+v Axeman] by ChanServ
18:34 -!- Squidy_at_Home [~quassel@189.72.223.252] has joined #openvpn
18:37 -!- EugeneKaway [EugeneKay@eugenekay.com] has quit [Ping timeout: 264 seconds]
18:39 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 240 seconds]
18:40 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:40 < genlime> I need help guys.
18:42 < genlime> I cannot connect tunnel the internet.  our internet requires a sum of money to be paid before I can connect to the network and be able to use openvpn.
18:45 < genlime> if I am running openvpn, what would be the part of openvpn that my isp can block?
18:45 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
18:46 < genlime> ecrist, bushmills can you give me assistance
18:47 < genlime> we wont ask about icmp anymore.
18:50 < genlime> help please
18:51 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
19:00 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 255 seconds]
19:01 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:01 -!- newmember [~chatzilla@216.81.49.14.epikip.net] has joined #openvpn
19:10 -!- Denial [~Denial@drgi.co.uk] has quit []
19:16 < TimothyA> prq keeps saying that I should be able to just run a webserver, and it should be reachable by anyone else on the internet
19:16 < TimothyA> without configuration
19:16 < TimothyA> yet everyone here says that's not how it works
19:18 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:18 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
19:24 -!- newmember [~chatzilla@216.81.49.14.epikip.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
19:25 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
19:25 -!- mode/#openvpn [+v Axeman] by ChanServ
19:59 -!- Squidy_at_Home [~quassel@189.72.223.252] has quit [Ping timeout: 250 seconds]
20:10 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
20:16 -!- Squidy_at_Home [~quassel@187.7.244.195] has joined #openvpn
20:16 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
20:18 -!- master_of_master [~master_of@p57B53358.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:18 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
20:19 -!- master_of_master [~master_of@p57B52D9C.dip.t-dialin.net] has joined #openvpn
20:30 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:33 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
20:40 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:41 -!- corretico_ [~luis@201.201.44.82] has quit [Quit: Leaving]
20:43 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
20:45 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:56 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:56 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
21:01 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:04 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
21:05 < genlime> guys I want to ask when could be the possible ways the ISP can block openvpn connection?
21:05 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:11 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Read error: Connection reset by peer]
21:11 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
21:12 < genlime> guys I want to ask when could be the possible ways the ISP can block openvpn connection?
21:12 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:13 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:20 -!- Squidy_at_Home [~quassel@187.7.244.195] has quit [Remote host closed the connection]
21:22 -!- Squidy_at_Home [~quassel@187.7.244.195] has joined #openvpn
21:26 -!- genlime [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit []
21:28 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:28 < rommel092079>  If I have this openvpn tunnel, how would the ISP block openvpn tunnel? What would the ISP block in openvpn so we can work around it.
21:45 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
21:48 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
21:48 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has quit [Client Quit]
21:48 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
21:51 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has quit [Quit: Lost terminal]
21:51 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has quit [Client Quit]
21:51 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
21:58 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
22:39 -!- sadurag99 [~sadurag99@124-149-71-78.dyn.iinet.net.au] has joined #openvpn
22:45 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:45 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:46 -!- Squidy_at_Home [~quassel@187.7.244.195] has quit [Remote host closed the connection]
22:55 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
22:57 < vpnuser> guys where can I ask how to create an http proxy?
22:58 < vpnuser> that I can use with openvpn?
23:03 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:04 -!- sonto_lau [~cooker@125.70.93.50] has joined #openvpn
23:06 < sonto_lau> hello all! Can the client connect server without certificate and key
23:08 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
23:13 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
23:15 < vpnuser> guys where can I ask how to create an http proxy?
23:15 < vpnuser> that I can use with openvpn?
23:33 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Excess Flood]
23:34 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
23:35 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
23:37 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Client Quit]
23:37 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
23:39 -!- EugeneKay is now known as EugeneKaway
23:43 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
23:48 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
--- Day changed Thu Aug 04 2011
00:01 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
00:04 -!- wjwoodward [~wjwoodwar@124-149-71-78.dyn.iinet.net.au] has joined #openvpn
00:04 -!- wjwoodward [~wjwoodwar@124-149-71-78.dyn.iinet.net.au] has quit [Client Quit]
00:11 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
00:17 < vpnuser> cant we push http-proxy option?
00:20 < Bushmills> vpnuser, you install a proxy, like squid, on a machine which can be reached through openvpn, like the openvpn server.  you configure it such that requests from openvpn clients are accepted, then you configure web browsers such that they use that proxy.
00:21 < vpnuser> is squid the best http proxy there is to setup?
00:22 < Bushmills> depends on your requirements
00:22 < Bushmills> "best" is a somewhat malleable term
00:23 -!- EugeneKaway is now known as EugeneKay
00:24 < vpnuser> I dont know what software to install to setup http proxy servers aside from squid.
00:24 < Bushmills> then use squid. or research what alternative software there is.
00:25 < vpnuser> thanks. on the other hand, can't we push http-proxy to clients from server option?
00:26 < Bushmills> the browser wouldn't see that. you can create a config file which can be read by the browser which tells it where the proxy is. 
00:27 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
00:27 < vpnuser> no. i mean the --http-proxy server port option of openvpn.
00:27 < vpnuser> sorry I did not clarified it.
00:28 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Remote host closed the connection]
00:28 < Bushmills> that's not related to a web browser using a pushed proxy.  that's related to openvpn client connecting to openvpn server through a proxy
00:28 < vpnuser> cant I specify in the server.conf push "http-proxy xxxx xxxx"  ?
00:29 < Bushmills> what sense would that possibly make?
00:30 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
00:30 < vpnuser> so that I could just make adjustment if neccesary in the server.conf alone without updating the client.conf
00:30 < Bushmills> "related to openvpn client connecting to openvpn server through a proxy"  -  server can push stuff only after client has already connected
00:31 < vpnuser> so there is no way to push that option to the client from the openvpn server?
00:31 < Bushmills> it makes zero sense to push that option
00:32 < Bushmills> it makes about as much sense as telling you "i tell you how to get here once you're here"
00:33 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:33 < vpnuser> but why is comp-lzo can be pushed ? also route-gateway
00:34 < Bushmills> because those options will take affect only after connection has been established.  they don't describe how to etablish the connection
00:34 < vpnuser> ow
00:34 < vpnuser> ok
00:35 < vpnuser> but i noticed when the client connection starts, comp-lzo initialized something like that
00:35 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Read error: Connection reset by peer]
00:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
00:37 < vpnuser> bushmills, what part of openvpn is blocked if my isp blocks it?
00:39 < Bushmills> its outgoing or returned traffic
00:40 < vpnuser> how can I work around if my isp blocks it?
00:40 < Bushmills> use a different port
00:40 < vpnuser> wait
00:40 < Bushmills> cab drivers will charge you for waiting
00:41 < vpnuser> sorry. 
00:41 < vpnuser> like local x.x.x.x port xxxx
00:42 < vpnuser> and in my client.conf remote x.x.x.x  xxxx
00:42 < Bushmills> such as
00:42 < vpnuser> what port is hard to blocked by isp bushmills?
00:43 < Bushmills> isp can block any port
00:43 < vpnuser> even port 53?
00:43 < Bushmills> even 53.  
00:44 < vpnuser> i tried using 80,8080,443,9200, 53 they are all blocked.
00:44 < Bushmills> you may want to read about  nobind  option on client
00:44 < vpnuser> I use that but still I am blocked
00:45 < vpnuser> I use that nobind but still I am blocked
00:45 < Bushmills> change isp, if your current ips is that restrictive
00:45 < Bushmills> isp
00:46 < vpnuser> we only have two isp and both of them are that restrictive.
00:46 < Bushmills> relocate
00:47 < vpnuser> :)
00:50 < vpnuser> aside from the port, what other options in openvpn can be blocked by the isp? what part of the its outgoing or returned traffic is seen by my isp that they block?
00:55 < vpnuser> bushmills !
00:55 <@vpnHelper> RSS Update - forum: Redirecting the whole traffic through openvpn - HELP <http://forums.openvpn.net/topic8581.html>
00:55 < EugeneKay> They can do deep packet inspection, same as anybody else along the chain, up until the point where TLS takes over.
00:56 < vpnuser> Eugenekay, how do they do that?
00:56 < EugeneKay> By sniffing the traffic
00:56 < EugeneKay> Once TLS is engaged, by the design of the thing, you can't sniff anything useful aside from the amount of traffic going by, and it's endpoints.
00:57 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has quit [Ping timeout: 276 seconds]
00:57 < vpnuser> TLS? can I do that in my openvpn server so that they cant sniff anything from my server?
00:58 < EugeneKay> That's what OpenVPN uses by default.
00:59 < vpnuser> how. I dont know if my server uses that. can you teach me how to find out.
00:59 < EugeneKay> No, I don't think I can.
00:59 < vpnuser> can you tell me where to read instead to find it?
01:00 < EugeneKay> The openvpn man page is a good doc to read
01:00 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has joined #openvpn
01:00 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 255 seconds]
01:01 < vpnuser> is tls the same with tls-auth, tls-server, tls-client?
01:01 < vpnuser> is that what you mean EugeneKay?
01:02 < EugeneKay> TLS is a security mechanism that OpenVPN uses.
01:02 < EugeneKay> Look it up on wikipedia for a more complete explanation
01:02 < vpnuser> so if openvpn uses that mechanism, my isp cant suppose to sniff anything from my server.
01:04 < EugeneKay> That's the idea, yes.
01:04 < EugeneKay> Hence the P in VPN.
01:05 < vpnuser> so why am I having a problem with my isp the they block my vpn wherein I cant connect to internet unlike the previous weeks?
01:05 < vpnuser> how to they know what to block?
01:06 < EugeneKay> I don't know what your setup looks like, and at this hour, I'm not really up for troubleshooting it with you.
01:07 < vpnuser> Eugenekay, may I know when I can ask your help for troubleshooting at your convenient time so we can fix my problem !
01:14 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
01:28 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
01:38 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
01:40 -!- sonto_lau [~cooker@125.70.93.50] has left #openvpn []
01:41 -!- Polynomial [SP3-920@unaffiliated/polynomial] has quit [K-Lined]
02:01 <@vpnHelper> RSS Update - forum: Redirecting the whole traffic through openvpn - HELP <http://forums.openvpn.net/topic8581.html#p14331>
02:18 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
02:23 < Mowee> Morning
02:31 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 240 seconds]
02:36 -!- TimothyA [~Administr@li36-88.members.linode.com] has quit [Remote host closed the connection]
02:36 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14332>
02:36 -!- newmember [~chatzilla@66.183.103.108] has joined #openvpn
02:47 -!- EugeneKay is now known as EugeneKaway
02:48 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14333>
03:24 -!- luneff [~yury@84.51.196.42] has quit [Quit: This computer has gone to sleep]
03:26 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:35 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
03:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:43 -!- mode/#openvpn [+v s7r] by ChanServ
03:46 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
03:46 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
03:46 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:49 -!- dazo_afk is now known as dazo
03:53 -!- luneff [~yury@93.178.66.231] has joined #openvpn
04:03 -!- luneff [~yury@93.178.66.231] has quit [Read error: Operation timed out]
04:06 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
04:07 -!- luneff [~yury@93.178.66.231] has joined #openvpn
04:27 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:49 <@vpnHelper> RSS Update - forum: Windows share wont work in openvpn.. please help <http://forums.openvpn.net/topic8577.html#p14334>
04:53 -!- luneff [~yury@93.178.66.231] has quit [Quit: Leaving]
04:55 -!- zu [~zu@ks355000.kimsufi.com] has quit [Ping timeout: 260 seconds]
04:57 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
05:04 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:12 <+s7r> can I corp. the certs in the .ovpn file when using community project ?
05:12 <+s7r> with <ca> </ca> 
05:12 <+s7r> <cert> </cert> etc ?
05:13 < janjust> I don't fully understand the question, but I think the answer is yes
05:13 <@vpnHelper> RSS Update - forum: Windows 7, UAC, and ROUTEs; feature suggestion to fix. <http://forums.openvpn.net/topic8582.html>
05:13 < janjust> the open source version of openvpn has support for <ca>, <cert>, <key>, <dh> etc
05:16 <+s7r> janjust so it is possible right ?
05:17 < janjust> s7r:  if you mean "can I incorporate a CA certificate into a .ovpn file using <ca>BLOB</ca>?" , then the answer is "Yes, I use that quite regularly with the open source version of OpenVPN"
05:18 <+s7r> that is exactly what i meant
05:18 <+s7r> thanks :)
05:18 <@vpnHelper> RSS Update - forum: Windows 7, UAC, and ROUTEs; feature suggestion to fix. <http://forums.openvpn.net/topic8582.html#p14336>
05:19 -!- dazo is now known as dazo_afk
05:21 -!- jil [~jil@83.229.34.3] has joined #openvpn
05:22 < jil> hello
05:22 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
05:22 < jil> !Welcome
05:22 <@vpnHelper> "Welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:22 -!- dazo_afk is now known as dazo
05:23 < jil> !goal
05:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:24 < uuuppz> anyone here working on the code?
05:24 < uuuppz> I'm writing my own gui
05:24 < uuuppz> and I've got it all working
05:24 < uuuppz> but trying to work out how to gracefully shut down an open vpn instance
05:24 < uuuppz> ie do whatever the usual openvpn gui does to kill openvpn
05:27 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
05:28 -!- jil [~jil@83.229.34.3] has quit [Read error: Connection reset by peer]
05:35 < janjust> uuuppz:  the "proper" way to do it is to use the management interface; another way of doing it is by sending it the right signal (SIGTERM would do the trick)
05:37 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Remote host closed the connection]
05:38 < uuuppz> janist: I just found --service and creating an named event
05:38 < uuuppz> is this the  management interface
05:38 < uuuppz> or is there something else?
05:39 < uuuppz> s/janist/janjust
05:40 < janjust> that is something else, uuuppz 
05:40 < janjust> look in the manual page for 'management tunnel <port>'
05:42  * dazo wonders why "everyone" wants to write their own GUI - why not rather help out on one of those which already exists?
05:42 < uuuppz> well
05:43 < uuuppz> I need a gui that is seperated into a host service
05:43 < uuuppz> and a tray app
05:43 < uuuppz> main openvpn gui doesn't seem particularly suited to that
05:43 < dazo> uuuppz: that's what's d12fk is working on currently
05:44 < uuuppz> ok
05:44 < uuuppz> well I also have it working
05:44 < uuuppz> :P
05:44 < dazo> and his work will be incorporated into the official releases as well
05:44 < dazo> uuuppz: have you seen this list? https://community.openvpn.net/openvpn/wiki/RelatedProjects#ManagementGUI
05:44 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
05:45 < dazo> Sorry!  This one: https://community.openvpn.net/openvpn/wiki/RelatedProjects#ClientGUI
05:45 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
05:45 < uuuppz> hm
05:45 < uuuppz> for client not server this is
05:46 < uuuppz> see nothing that matches there
05:46 < dazo> well, "Client GUI" is not very clear ... as many of them works for servers as well
05:47 < uuuppz> ok well
05:47 < dazo> but most of them have clients in mind, that's true ... however, if you workout something which fits better for servers ... then it not so bad
05:47 < uuuppz> I have about 15 staff I need to roll out my specific clients
05:47 < uuuppz> so
05:47 < uuuppz> I have my own internal reasons for developing my own
05:47 < uuuppz> I'd be happy to contribute my wrapper
05:47 < uuuppz> if thats any help to anyone tho
05:47 < dazo> that'd be great
05:48 < dazo> feel free to update that wiki page
05:48 < uuuppz> basically I like openvpn gui
05:48 < uuuppz> its simple
05:48 < uuuppz> it works
05:48 < uuuppz> the main problem is that it requires admin
05:49 < uuuppz> and we are a .NET house so I would prefer a gui written in WPF as it would allow us to brand more easilly
05:49 < dazo> yeah, that's what d12fk is trying to get rid of ... to get a better separation
05:49 < uuuppz> I've got that done
05:49 < dazo> great!
05:49 < uuuppz> it took about 4 hours
05:49 < uuuppz> :P
05:49 < uuuppz> last issue in the basics is killing openvpn gracefully
05:50 < uuuppz> for my purposes the signal method fits best I think atm
05:50 < dazo> through the management interface, you can issue KILL ... which with the TERM signal, should go down gracefully
05:50 < uuuppz> yeh but I don't want to bind any tcp ports
05:51 < uuuppz> I deliberately learnt how to use named pipes
05:51 < uuuppz> in those 4hrs
05:51 < uuuppz> so
05:51 < uuuppz> I can apply an ACL to the pipe
05:52 < dazo> hmm ... you need to signal that process then somehow, with a SIGINT or SIGTERM equivalent signal in Windows ... but I have no idea how that works out, I'm not a Windows developer
05:52 < uuuppz> I've found the hack openvpn gui uses
05:52 < d12fk> uuuppz: do you run openvpn itself with elevated privileges?
05:52 < uuuppz> it passes --service NAMED_EVENT
05:53 < uuuppz> d12fk: I've written two apps - one to be run as a service whcih listens on a named pipe, and this runs as admin and launches the openvpn processes
05:53 < uuuppz> then the second is the gui which talks over the named pipe to the service
05:54 < d12fk> then a malicious user could write a config that runs a script which does harmful stuff through openvpn
05:54 < d12fk> i'm trying to get around this privilege escalation
05:56 < uuuppz> only if they can write to the config
05:56 < uuuppz> the service only provides start, stop, list, info
05:56 < uuuppz> based on configs in the config dir
05:56 < uuuppz> write access is denied by default to this dir on windows
05:56 <@vpnHelper> RSS Update - forum: Windows 7, UAC, and ROUTEs; feature suggestion to fix. <http://forums.openvpn.net/topic8582.html#p14337>
05:57 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
05:57 < uuuppz> If your talking
05:57 < uuuppz> further seperation
05:58 < uuuppz> your solving a different problem to me :)
05:58 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:58 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:58 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:58 < d12fk> uuuppz: ok
05:58 < uuuppz> if you could make it so the openvpn processes
05:58 < uuuppz> don't need admin at all
05:58 < uuuppz> that would be great
05:58 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Client Quit]
05:59 < uuuppz> but right now... I think the direction I've gone is really the only one I can see without getting into modifying openvpn itself
06:03 <@vpnHelper> RSS Update - forum: Windows 7, UAC, and ROUTEs; feature suggestion to fix. <http://forums.openvpn.net/topic8582.html#p14338>
06:04 -!- TimothyA [~Administr@li36-88.members.linode.com] has joined #openvpn
06:06 < uuuppz> Ok
06:06 < d12fk> uuuppz: I'll modify openvpn as well I don't see a problem with that
06:06 < uuuppz> event works :)
06:07 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:07 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:07 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
06:07 -!- mode/#openvpn [+v Axeman] by ChanServ
06:08 < uuuppz> d12fk: not gonna touch something that I don't understand well... but I'll gladly use any extra interfaces which make my life easier.
06:10 < uuuppz> ok that works well
06:21 < uuuppz> actually
06:21 < uuuppz> what would be really useful
06:21 < uuuppz> for this method of wrappingf
06:22 < uuuppz> would be a --xml-messages option
06:22 < uuuppz> to make it send strucutred xml messages to stdout
06:22 < uuuppz> instead of the usual messages
06:23 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
06:33 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
06:43 -!- Polynomial [~Polynomia@gateway/tor-sasl/polynomial] has joined #openvpn
06:44 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
06:44 -!- Polynomial [~Polynomia@gateway/tor-sasl/polynomial] has left #openvpn []
06:45 -!- sadurag99 [~sadurag99@124-149-71-78.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
07:11 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
07:30 -!- TimothyA [~Administr@li36-88.members.linode.com] has quit [Remote host closed the connection]
07:33 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
07:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:36 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
07:36 -!- aborrero [96d60496@gateway/web/freenode/ip.150.214.4.150] has joined #openvpn
07:36 < aborrero> hi there!
07:38 < aborrero> i'm reading this: http://openvpn.net/archive/openvpn-users/2005-02/msg00223.html 
07:38 <@vpnHelper> Title: Re: [Openvpn-users] how to use intermediate CA model on TLS authentication (at openvpn.net)
07:39 < aborrero> in my server/client I have different CA signing the server cert and the client cert
07:39 < aborrero> is there any official documentation regarding this issue?
07:39 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14339>
07:39 -!- TimothyA [~Administr@li36-88.members.linode.com] has joined #openvpn
07:44 < aborrero> https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains
07:44 <@vpnHelper> Title: Using_Certificate_Chains – OpenVPN Community (at community.openvpn.net)
07:48 < aborrero> i just want one question to be solved: it is mandatory that both server and client certificates to be issued by the same CA?
07:50 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14340>
07:50 < ecrist> aborrero: yes, it is
07:51 < aborrero> -_-
07:51 -!- ele_ is now known as ele
07:51 < aborrero> ecrist: anyway to get openvpn server accepting clients with certificates signed by 2 CAs?
07:52 < aborrero> one of that CA being a intermediate CA
07:53 < aborrero> i'm gonna send an email to the mailing list
07:54 < aborrero> is there an active mailing list?
07:57 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
07:58 < ecrist> aborrero: no
07:58 < ecrist> the server cert and client certs need to be signed by the same ca, afaik
07:59 < havoc> gah, time to consolidate subnets :(
07:59 < havoc> seperate /24's not cutting it anymore
08:00 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:03 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has joined #openvpn
08:07 < havoc> I have 2 vpn segments, udp:1194 and tcp:443, I should combine those into one /24
08:08 < havoc> the seperate lans will have to be something else though
08:08 < havoc> I'll stick with routed and avoid bridging the VPN(s) to the LAN though
08:08 < aborrero> email sent
08:09 < aborrero> bye bye
08:09 -!- aborrero [96d60496@gateway/web/freenode/ip.150.214.4.150] has quit [Quit: Page closed]
08:09 < dazo> ecrist: https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains ... JJK actually mentions that scenario in this page
08:10 <@vpnHelper> Title: Using_Certificate_Chains – OpenVPN Community (at community.openvpn.net)
08:27 < ecrist> sweet
08:28 < ecrist> !learn cert_chains as https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains ... JJK actually mentions that scenario in this page
08:28 <@vpnHelper> Joo got it.
08:28 < ecrist> !learn multiple_ca as see !cert_chains
08:28 <@vpnHelper> Joo got it.
08:29 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
08:29 -!- mode/#openvpn [+v Axeman] by ChanServ
08:32 -!- TimothyA [~Administr@li36-88.members.linode.com] has quit [Quit: Leaving.]
08:33 -!- mode/#openvpn [+o ecrist] by ChanServ
08:34 -!- ecrist changed the topic of #openvpn to: Current Release: 2.2.1 (6-July-2011) || Your problem is your firewall, really. || See !welcome and !goal || Access Server goto #openvpn-as
08:48 -!- vpnuser [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
08:49 -!- vpnuser [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Client Quit]
08:51 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 260 seconds]
09:02 <@vpnHelper> RSS Update - forum: win7 tracert goes through tunnel, but other traffic blocked <http://forums.openvpn.net/topic8583.html>
09:05 -!- datruth [datruth@gotpot.org] has joined #openvpn
09:05 < datruth> where can I download the windows client for open vpn so I can connect to my openvpn server?
09:07 < kerute> datruth: http://www.openvpn.net/
09:07 <@vpnHelper> Title: OpenVPN - Open Source VPN (at www.openvpn.net)
09:11 < dazo> datruth: http://openvpn.net/index.php/open-source/downloads.html ... this is the version we're supporting in this channel
09:11 <@vpnHelper> Title: Downloads (at openvpn.net)
09:11 < datruth> THanks
09:13 < datruth> I think I downloaded that version yesterday but it looks different from when I last used openvpn years ago how do you make a client.conf etc?
09:15 < dazo> There are two clients, OpenVPN AS Client ... which is tightly connected to config provisioning via the commercial OpenVPN Access Server .... and for the community version, you write the config files yourself
09:15 < dazo> !howto
09:15 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:16 < datruth> Hrmm I've just setup an openvpn server on my fbsd box so far no errors but I'd like to connect multiple windows clients to it
09:16 < datruth> So I need to write my own conf?
09:17 <@ecrist> !download
09:17 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
09:17 < datruth> Yes I've downloaded 2.2.1 version
09:17 <@ecrist> yes, you need to write your own conf
09:18 < datruth> No sample configurations are supplied?
09:19 < datruth> nevermind found them stashed away in the directory
09:25 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:26 <@vpnHelper> RSS Update - forum: SIP over OpenVPN tunnel <http://forums.openvpn.net/topic8584.html>
09:26 -!- catsup [~d@ps38852.dreamhost.com] has quit [Ping timeout: 252 seconds]
09:28 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Ping timeout: 252 seconds]
09:32 < datruth> where would the certificates go?
09:33 <@ecrist> datruth: try reading the docs
09:34 <@ecrist> !man
09:34 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
09:36 < datruth> Yeah don't think thats gonna tell me where on my windows box nvm 
09:39 <@ecrist> the location of your certs doesn't matter, you just pass the path name in the config
09:39 <@ecrist> that IS covered in the man page
09:40 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
09:43 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Quit: Leaving]
09:45 < dazo> datruth: there are no shortcuts in openvpn ... the config file is pretty simple, and I find the sample configs very confusing ... you basically need less than 20-30 lines in your config files ... it's nothing special there ... and the sample config is many 100 lines long ... read the docs and understand that is far more simpler than to tweak a bloated sample config
09:46 < dazo> or use krzee's config generator
09:46 < dazo> !confgen
09:46 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
09:47 -!- K1ng`` [~KING@58.97.132.210] has quit [Read error: Connection reset by peer]
09:48 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
09:50 < datruth> dazo: thx I just needed to know where the config files go I'm abit rusty I got it now I just need to tweak my nat rules and im good thanks tho 
09:52 < majuk> Anyone care to make speculation as to why a client would be able to renew its key on expiration, but fail to communicate over the tunnel? (UDP, tun)
09:53 < majuk> Just throw ideas at me if you have one, or probe for more information you feel is pertinent. Thanks.
09:54 < dazo> datruth: on Windows, you'll find them via the Start menu -> Applications -> OpenVPN ... it's something like that ... I'm rusty as I'm not using Windows
09:55 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
09:56 < majuk> Alternatively, is there a way to reset single connection?
09:57 -!- mick_laptop [~mick@mickweiss.com] has quit [Ping timeout: 263 seconds]
10:02 -!- mick_laptop [~mick@mickweiss.com] has joined #openvpn
10:05 < datruth> Alrighty finally connected and working good now just need to know how to remove or revoke users from connecting
10:06 -!- vpnuser [475e9251@gateway/web/freenode/ip.71.94.146.81] has joined #openvpn
10:07 < vpnuser> I would like to ask in openvpn, why is there an option http-proxy server port ?
10:09 < vpnuser> help here please
10:09 <@ecrist> http://openvpn.net/index.php/open-source/documentation/howto.html#http
10:09 <@vpnHelper> Title: HOWTO (at openvpn.net)
10:12 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
10:13 < vpnuser> thank you for the think ecrist. moreover, I would like to know why did the author created that option while openvpn provides internet connectivity itself.  why the need for http proxy option?
10:13 < dazo> vpnuser: http-proxy is used to send OpenVPN traffic via a HTTP proxy, for networks which is much stricter setup and you only have internet access via a proxy server
10:13 < vpnuser> does it anticipate that it cannot connect to the internet by itself?
10:13 < dazo> exactly
10:15 < vpnuser> I see. so openvpn cannot connect to the internet by itself.  if that is the case, there is a need for us users to know how to create also for a http proxy.
10:17 < vpnuser> can you suggest a good program for http proxy for openvpn?  will squid suffice?
10:21 < dazo> vpnuser: it is *only* needed if you must go via a HTTP proxy ... if you can access Internet without a proxy, you do *not* need to care about --http-proxy
10:22  * dazo is using openvpn daily, and have not needed to use --http-proxy so far
10:24 < kerute> !help
10:24 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
10:25 < vpnuser> previously I can connect to the internet without http proxy but starting yesterday, I cant connect to the internet without proxy but when I tried using proxy , it did connect.  So I am reading how to setup my own http proxy.  Maybe you  can lend some inputs about it.  Any input for that matter.
10:26 < kerute> to push dns to linux clients, i have to write a script or is there one available with openvpn install ?
10:26 < dazo> --http-proxy takes to arguments ... IP/hostname of proxy server ... and then the port number of the proxy server
10:26 < dazo> your ISP/network admin can tell you which proxy to use
10:26 < dazo> if you're ISP/network admin tells you it's a SOCKS proxy, you need to use --socks-proxy instead
10:27 < dazo> vpnuser: ^^^
10:27 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has left #openvpn []
10:27 < vpnuser> I see. but what if my isp dont tell me those information?
10:28 < dazo> then how do you connect to the Internet?
10:28 < vpnuser> kerute: i believe there is.
10:28 <@ecrist> if you're not configured for a socks or http proxy, then you don't need a socks or http proxy
10:28 -!- mode/#openvpn [+o dazo] by ecrist
10:28 < vpnuser> I am connected now with http-proxy (public)
10:28 -!- mode/#openvpn [-o ecrist] by ecrist
10:28 <@dazo> kerute: on Linux, you need a script for --push DNS to work ... just google it
10:29 <@dazo> vpnuser: and how did you configure that HTTP proxy?
10:29 <@dazo> HTTP proxy setting, I mean?
10:30 <@dazo> kerute: http://forums.openvpn.net/topic7109.html
10:30 <@vpnHelper> Title: OpenVPN Support Forum Push DNS to a linux client. : Configuration (at forums.openvpn.net)
10:30 < vpnuser> yes I am connected to the internet using http-proxy
10:31 < vpnuser> kerute: is this what you're looking push "dhcp-option DNS 208.67.222.222" something like that?
10:31 < kerute> vpnuser: yes
10:32 < vpnuser> push "dhcp-option DNS 208.67.222.222" <-----just change the dns address there to something you want to use
10:33 < vpnuser> dazo, what is my isp wont give me those information?
10:33 <@dazo> vpnuser: if you are connected to Internet via a HTTP proxy already ... then you use *exactly the same information* in OpenVPN
10:34 < kerute> vpnuser: yeah that's what i have but it seems i need to give a script to use for my linux users
10:34  * dazo don't understand what vpnuser is trying to solve any more
10:35 < vpnuser> yes. but my fear is that what if I dont have any working http-proxy at hand to use.  so my recourse is to make my own http-proxy server.
10:36 < vpnuser> and making a http-proxy server confuses me as to what software/program to use that is best suited for it. should it be squid or traffic-server, etc? I dont have good idea about it.
10:36 <@dazo> vpnuser: you use the http-proxy statement in the client config when you need http proxy to access the internet ... when you don't need to go via a proxy, you *don't* use http-proxy ... there's no magic there
10:37 < vpnuser> kerute: why do you need to give script to your linux users? i believe that by using the option PUSH, your clients will be using the dns address that you push to them.
10:38 <@dazo> vpnuser: don't try to help kerute now ... --push DNS requires a script in Linux and BSD
10:38 <@dazo> actually, it needs a script on all non-Windows platforms
10:38 < kerute> vpnuser: it seems to not do that for dns, did not find the reason, but every info i found is it is needed
10:38 < vpnuser> kerute: sorry, I am not familiar with linux with option push. sorry
10:38 < datruth> push "redirect-gateway def1 bypass-dhcp" <-- this should be all I need to make the VPN the default gateway?
10:39 <@dazo> datruth: you might need --route-gateway <VPN IP addr of VPN server> in addition
10:39 < vpnuser> dazo, I believe I will be needing a http-proxy in my client config now because of the new setup of my isp.
10:40 <@dazo> vpnuser: then don't think about --http-proxy now ... and rather look into this *when you know* if you need this or not
10:40 <@dazo> no need to make things more complicated than it needs to be
10:41 < vpnuser> ok. I think my last question is just your good advice of what software/program to use to setup a suitable http-proxy so I can create one myself.
10:42 < datruth> dazo: so then I'd do push "redirect-gateway def1 bypass-dhcp --route-gateway 1.2.3.4" ? Or would push "route-gateway 1.2.3.4" work better for that?
10:42 <@dazo> datruth: you need to have two --push statements, one for redirect-gateway and one for route-gateway ... that's basically it
10:43 < datruth> got it thanks
10:44 -!- qmr [~Quintin@adsl-99-12-154-21.dsl.ipltin.sbcglobal.net] has joined #openvpn
10:44 < vpnuser> dazo, got idea for me?
10:44 < qmr> where is openvpn config on debian?
10:45 <@dazo> vpnuser: no, I don't use http proxies
10:45 <@dazo> qmr: most likely under /etc/openvpn
10:45 < vpnuser> ok. thanks for that quick reply. 
10:45 < qmr> there is only this "update-resolv-conf" file ... 
10:45 < qmr> I need to know where to put my "dev tun" blah blah blah 
10:45 < qmr> http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html  
10:45 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
10:45 <@dazo> qmr: you need to write the config file yourself 
10:45 -!- vpnuser [475e9251@gateway/web/freenode/ip.71.94.146.81] has left #openvpn []
10:45 < qmr> then how does openvpn know to parse it?
10:46 <@dazo> qmr: I'd guess that the init.d script will look for *.conf files in that directory
10:46 <@dazo> (that's what Gentoo, Fedora, RHEL/CentOS/ScientificLinux does)
10:47 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Read error: Operation timed out]
10:48 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: We be chillin - IceChat style]
10:50 < datruth> dazo: even with the options on the server side ...  on the client side are additional options needed to force the client to use the vpn as the default gateway?
10:51 <@dazo> datruth: --redirect-gateway and --route-gateway are client side options ... server side, you only push them if you don't want them in client configs
10:51 <@dazo> datruth: there are no other options needed on the server side
10:52 <@dazo> datruth: but!  you need to have IP forwarding enabled, allow traffic from VPN to Internet in your firewall, and most likely also NAT the tunnel traffic from your VPN server
10:53 < datruth> IP forwarding/NAT is setup I can connect to the vpn no problem but when hitting the internet it uses my isp ip instead of the vpn's
10:53 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Remote host closed the connection]
10:53 < datruth> I'm pushing the routes via server config butit doesn't seem to be taking effect
10:53 <@dazo> datruth: sounds like the default route has not been setup properly on the client then .
10:54 <@dazo> datruth: hmm .... try using those push args directly in the client config, to see if that helps
10:54 <@dazo> I've only used --redirect-gateway/--route-gateway in client configs ... however, I believe they should be pushable
10:54 < qmr> ok ... now how do I connect with the openvpn GUI thing ? I have it in my system tray 
10:54 < qmr> and I have a working config file 
10:55 <@dazo> qmr: the openvpn GUI thing?  which one do you use?
10:55 < qmr> dazo: from the website, if you pick windows installer .. that one 
10:55 <@dazo> qmr: ahh, so you're on Windows now?
10:55 < qmr> right.  
10:55 < datruth> dazo: so the following lines would be added to my client conf?
10:55  * dazo thought qmr was still on Debian :)
10:55 < datruth> push "route-gateway x.x.x.x"
10:55 < datruth> push "redirect-gateway def1 bypass-dhcp"
10:56 < qmr> oh.  oops :)  yea server debian my laptop right now I'm in Windows
10:56 <@dazo> datruth: exactly, but without the the push and "'s
10:56 < qmr> basically I want to make my net traffic go over vpn.  well majority of it.  since I don't trust the network I am currently on :P
10:56 < qmr> so after I have vpn working I'll use squid proxy
10:57 < datruth> dazo: thats how I have it in my server config could that be the reason why its not working?
10:57 <@dazo> qmr: yeah ... just create a standard OpenVPN config file ... in the start menu, you'll find OpenVPN and a link to the config dir ... put the config here, with .ovpn extension
10:57 <@dazo> qmr: then it pops up in the GUI
10:57 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 246 seconds]
10:57 <@dazo> datruth: nope, on the server side, you should have --push ... to push these options to the client
10:58 < datruth> in the sample config's it doesn't have --push just push "args"
10:58 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:58 < datruth> --push & push are the same?
10:58 < qmr> dazo: great!  connected now
10:58 <@dazo> !--
10:58 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
10:58 <@dazo> datruth: ^^
10:58 <@dazo> qmr: great!
10:59 < datruth> oh so -- is only for the command line
10:59 <@dazo> yeah
11:02 < datruth> nope even when I add those options in the client config still it adds my isp's ip as the gateway
11:02 <@vpnHelper> RSS Update - forum: win7 tracert goesthrough tunnel other traffic blked-nevermnd <http://forums.openvpn.net/topic8583.html>
11:04 < natanoj> so, i have openvpn 2.2.1 and have a problem with it not caching my PIN code when i enter it
11:04 -!- qmr [~Quintin@adsl-99-12-154-21.dsl.ipltin.sbcglobal.net] has quit [Quit: Leaving.]
11:04 < natanoj> i need to enter the PIN twice at startup and then at every renegotiation
11:05 < natanoj> i have tried setting the pkcs11-pin-cache to 86400 but no difference at all
11:06 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has joined #openvpn
11:07 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
11:07 < datruth> dazo: any other way to route this ?
11:09 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
11:09 < datruth> The route addition failed: Either the interface index is wrong or the gateway does not lie on the same network as the interface. Check the IP Address Table for the machine. <-- this is the error im getting 
11:12 <@dazo> datruth: I need to see you config files now
11:12 <@dazo> !configs
11:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
11:12 <@dazo> !pastebin
11:12 <@vpnHelper> Error: Couldn't get RSS feed.
11:13 <@dazo> !pb
11:13 <@dazo> (nm)
11:23 < datruth> dazo: http://pastebin.com/SWDnyBSc
11:24 < datruth> I'm curious how is it that the VPN could assign me an ip for example 10.0.1.6 but 10.0.1.6 doesn't exist on the server interface?
11:30 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
11:32 <@dazo> datruth: route-gateway first-ip-of-internal-network ... that should say: route-gateway internal-ip.1
11:33 <@dazo> datruth: the .6 stuff ... that's due to the topology stuff for p-t-p mode of tun ... you can avoid that by using --topology subnet
11:33 <@dazo> datruth: and when you push --redirect-gateway / --route-gateway ... you should *not* have that in client config
11:34 <@dazo> datruth: and they should *not* be --push in client config at all (line 36 and 37)
11:34 -!- vpnuser [475e9251@gateway/web/freenode/ip.71.94.146.81] has joined #openvpn
11:34 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Ping timeout: 250 seconds]
11:35 < datruth> Well then im back at square one
11:35 <@vpnHelper> RSS Update - forum: Using CSF with OpenVPN - a couple of small problems :) <http://forums.openvpn.net/topic8585.html>
11:36 <@dazo> datruth: so either remove line 13 and 14 in server config and remove 'push' in front of --redirect-gateway/--route-gateway in line 36 and 37 .... or remove line 36 and 37 in client config and fix the correct IP address in line 13 in server config
11:36 < vpnuser> dazo, is there any other way to connection openvpn to the internet without using http-proxy where the situation needs http-proxy? what I mean is that if there is other option to use or configure so as not to use http-proxy but still can connect to the internet?  just a thought?
11:37 <@dazo> vpnuser: don't think and don't ask, please
11:37 -!- vpnuser [475e9251@gateway/web/freenode/ip.71.94.146.81] has left #openvpn []
11:37 <@dazo> datruth: you also use def1 ... which means default gw will not disappear in the client ... but you should have two routes above this one, which routes all traffic via the VPN
11:39 < datruth> two routes?
11:41 <@dazo> datruth: yeah, read the man page on --redirect-gateway, and you'll see how and why
11:42 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
11:44 < natanoj> anyone else experiencing problems with PIN code caching using a card reader 
11:44 < natanoj> ?
11:44 < natanoj> in my case i have the aladdin etoken pro usb device
11:45 < natanoj> problem is that the PIN code does not seem to get cached by openvpn, it just keeps asking for the PIN code each time it needs to read the cert from the usb reader
11:45 <@dazo> natanoj: I don't know many who uses PKCS#11 here ... try asking on the mailing list, the developer of PKCS#11 support in OpenVPN is paying attention to the mailing lists
11:45 < natanoj> dazo: ok, thanks, i will
11:53 < datruth> damn this just doesn't work
11:54 <@dazo> datruth: what does your client log file (verb 4 in config please) and routing table show?
11:55 < datruth> route-method exe
11:55 < datruth> route-delay 2
11:56 < datruth> I tried those options still no luck
11:56 < datruth> The route addition failed: Either the interface index is wrong or the gateway does not lie on the same network as the interface. Check the IP Address Table for the machine.
11:56 < datruth> I belive thats why its not working
11:56 <@dazo> you're damn right on that one
11:57 < datruth> I guess I don't understand the gateway IP exists on the VPN server so kinda confused on why its complaining
11:57 <@dazo> datruth: please make sure that your 'push "route-gateway x.x.x.x"' statement have the your VPN servers VPN IP address ... if you use "server 10.8.0.0 255.255.255.0" in your server config ... that x.x.x.x needs to be 10.8.0.1
12:00 < datruth> dazo: yeah thats what I have
12:00 <@dazo> datruth: then you need to show client logs and routing table on the client
12:08 < datruth> dazo: http://pastebin.com/Vc4GFaXk
12:09 <@dazo> datruth: I now notice you use --dev tun in server and --dev tap in client config
12:10 <@dazo> datruth: and for windows you need to use something more than just --dev ...
12:10 < ecrist> no, --dev tap or --dev tun works.
12:11 < ecrist> provided both sides are using the same device. ;)
12:11 < datruth> dazo: do I need to add ifconfig local_ip_address netmask?
12:11 <@dazo> ecrist: but Windows says:  Thu Aug 04 13:04:13 2011 us=890000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 vpn-ip
12:11 <@dazo> The route addition failed: Either the interface index is wrong or the gateway does not lie on the same network as the interface. Check the IP Address Table for the machine.
12:12 <@dazo> datruth: no, you should not need that ... you use --server in server config ... then the server will push proper ifconfig statement to the client automatically
12:12 < ecrist> no clue, but I assure you, you don't need more than that on windows, dazo
12:12 < ecrist> the configs I hand out to windows users are the exact same configs I give to Mac and LInux users
12:13 < datruth> ecrist: you have any ifconfig options in your windows client config?
12:13 <@dazo> ecrist: okay ... I know I sometimes needed --dev-node ... not sure why
12:14 < ecrist> nope, nothing special in my configs
12:14 < ecrist> fwiw, our configs work across all versions of windows, from Win98 SE to Win 7
12:15 < datruth> hrmm perhaps its something on the network forcing the gateway ip
12:15 <@dazo> datruth: try to locate openvpn.exe ... and from the command line run: openvpn.exe --show-adapters .... then in config you take the proper VPN adapter ID, and add 'dev-node <adapterID>'
12:16 < datruth> let me give that a go
12:16 < datruth> wow thats a long number does it ever change?
12:17 <@dazo> datruth: that should only change if you recreate the TUN/TAP devices
12:17 <@dazo> datruth: but since you don't provide complete log files ... it's difficult to see the whole picture
12:18 <@dazo> datruth: and you're even modifying the logs, using labels like 'vpn-ip' .... so we can't validate if that value is really sensible or not
12:18 <@dazo> datruth: btw ... when you modified the server config ... I hope you restarted the openvpn server
12:18 < datruth> I'll have to try this out on a test network then a
12:19 <@dazo> well, if you don't trust us .....
12:19 < datruth> then comeback with complete logs.
12:19  * ecrist doesn't help people that don't provided un-altered configs and logs
12:19 < ecrist> because, honestly, we probably have access to better systems and networks than what you're playing with.
12:20  * dazo decides to be just as strict as ecrist 
12:20 < datruth> That's fine I'll try this again on another network but thanks everyone for your time and help
12:20 < ecrist> see dazo, stick around long enough, and I don't seem so crazy, eh?  :D
12:20 <+Axeman> i heard ecrist watches porn on your computers, remotely. 
12:20 <@dazo> ecrist: hehe :)
12:20 < datruth> ecrist: honestly you just might, but for me its not worth the risk
12:20  * ecrist probably does
12:21 <@dazo> Axeman: who doesn't?
12:21 <@dazo> + that when using certificates and --tls-auth ... there's no chance we'll easily get access to VPN servers
12:21 <@dazo> (unless the server provides telnet access without a easily crackable user account)
12:22  * dazo feels his head is about to explode soon ... decides to go
12:23 < datruth> dazo: btw that dev-node stuff makes the program crash ;/
12:23 <@dazo> datruth: then you did something wrong ... read up on --dev-node in man page
12:23 < ecrist> show to logs...
12:23 < ecrist> oh, wait
12:25 < datruth> It claims the id doesn't exist lol
12:25 <+Axeman> maybe you fired yourself and didn't even know it
12:26 < datruth> That doesn't even sound right but nice try anyway
12:33 <+Axeman> damnit give me an E for effort datruth !
12:43 -!- EugeneKaway is now known as EugeneKay
12:55 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
12:56 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
12:58 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:01 <@vpnHelper> RSS Update - forum: SIP over OpenVPN tunnel <http://forums.openvpn.net/topic8584.html#p14344>
13:07 < datruth> Alrighty so I have my client config and log at http://pastebin.com/1FPZPKJq even with some changes I made still wont let me force the traffic threw the vpn gateway.
13:11 < datruth> Do I need to re-post the server config?
13:13 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html>
13:16 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
13:16 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Remote host closed the connection]
13:19 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14345>
13:27 -!- dazo is now known as dazo_afk
13:43 <@vpnHelper> RSS Update - forum: Help with setting a VPN in VPS <http://forums.openvpn.net/topic8586.html>
13:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
14:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:19 -!- K1ng`` [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
14:20 -!- datruth [datruth@gotpot.org] has quit [Read error: Operation timed out]
14:25 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
14:26 -!- luneff [~yury@84.51.196.42] has joined #openvpn
14:31 <@vpnHelper> RSS Update - forum: Help with setting a VPN in VPS <http://forums.openvpn.net/topic8586.html#p14347>
14:37 <@vpnHelper> RSS Update - forum: Can't get OpenVPN started <http://forums.openvpn.net/topic8587.html>
14:41 -!- _dinsdale [~quassel@91-67-112-190-dynip.superkabel.de] has quit [Remote host closed the connection]
15:01 <@vpnHelper> RSS Update - forum: Can't get OpenVPN started <http://forums.openvpn.net/topic8587.html#p14350> || Help with setting a VPN in VPS <http://forums.openvpn.net/topic8586.html#p14349>
15:02 -!- Ragnar_ [heimdall@darkstar.acool.net] has quit [Read error: Connection reset by peer]
15:04 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
15:06 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
15:13 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p14351>
15:17 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
15:19 <@vpnHelper> RSS Update - forum: Help with setting a VPN in VPS <http://forums.openvpn.net/topic8586.html#p14352>
15:23 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:25 <@vpnHelper> RSS Update - forum: win7 tracert goesthrough tunnel other traffic blked-nevermnd <http://forums.openvpn.net/topic8583.html#p14353>
15:25 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
15:25 -!- mode/#openvpn [+o mattock] by ChanServ
15:31 <@vpnHelper> RSS Update - forum: Can't get OpenVPN started <http://forums.openvpn.net/topic8587.html#p14354>
15:36 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
15:38 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Client Quit]
15:38 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
15:38 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Client Quit]
15:39 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
15:51 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has joined #openvpn
16:03 -!- gyyrog [~gyyrog@24-231-158-154.static.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:03 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
16:32 <@vpnHelper> RSS Update - forum: OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html>
16:39 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has joined #openvpn
16:47 < Olipro> can I connect to a host over IPv6 in 2.2.1 on Windows?
16:48 < EugeneKay> I don't think so.
16:49 < Olipro> is there a snapshot version that can do it?
16:51  * EugeneKay shrugs
16:51 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 260 seconds]
16:58 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has joined #openvpn
17:01 -!- gyyrog_ [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has joined #openvpn
17:01 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
17:02 -!- gyyrog_ [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
17:02 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has joined #openvpn
17:07 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 264 seconds]
17:11 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has joined #openvpn
17:12 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:17 < Olipro> EugeneKay: tell me it supports it on Linux
17:18 < EugeneKay> I've not tried
17:18 < EugeneKay> I'm still on the EPEL-provided 2.1.0
17:18 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
17:18 < Olipro> I know it works *inside* the tunnel, but I'm sure you know that too
17:18 < EugeneKay> 2.1.4, derp
17:18 < EugeneKay> Yeah, tun-ipv6 or tap mode(though I've not tried the latter)
17:19 < Olipro> I'm connecting to a host to which I have about 40ms latency to over IPv6, and about 200ms over IPv4
17:19 < Olipro> hence my desire to do the tunnel over v6
17:19 < EugeneKay> Lafffo
17:25 -!- gyyrog_ [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has joined #openvpn
17:33 -!- gyyrog_ [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 260 seconds]
17:35 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Quit:  I love my HydraIRC -> http://www.hydrairc.com <-]
17:37 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has joined #openvpn
17:39 -!- lutter [~lutter@173-228-80-136.dsl.static.sonic.net] has joined #openvpn
17:39 -!- gyyrog [~gyyrog@24-247-224-27.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:39 < lutter> !welcome
17:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:40 < lutter> !route for lans behind openvpn
17:41 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
17:41 < krzee> !route
17:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
17:59 < uuuppz> Ok if anyone is interested
18:00 < uuuppz> I have a very fresh but working well replacement gui for windows
18:01 < uuuppz> Win Service host + tray app and installer
18:02 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
18:13 < lutter> I am having trouble connecting two LANs, and was wondering of anybody in here could have a quick look at my configs. They are at http://pastebin.com/C3UBaGCk
18:13 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html>
18:14 -!- Kendall [~SAIF@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
18:15 < Olipro> EugeneKay: well, seems some guy called jjo made a patchset to add in IPv6 connectivity
18:15 < Olipro> so, here goes nothing
18:15 < EugeneKay> Sounds totally legit.
18:17 < Olipro> heh, seems he's also an OpenVPN dev
18:18 < Kendall> hi guys..I'm having trouble with a remote user connecting to our VPN.  I get a lot of "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)" messages in my log files.  I had the remote user do a ping test; out of 33 pings, 20 timed out.  That sounds like a likely cause for the TLS key negotiation failure, yes?
18:18 -!- Squidy [~quassel@187.52.120.179] has joined #openvpn
18:18 -!- Squidy [~quassel@187.52.120.179] has quit [Changing host]
18:18 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
18:18 < EugeneKay> Yes. Tell them to fix their shoddy connection.
18:20 < Kendall> I'm about to have some words with $PROVIDER
18:20 < Kendall> what I'm paying for your bonded T1 service for if I can't get reliable communications
18:29 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:29 -!- datruth [datruth@gotpot.org] has joined #openvpn
18:35 -!- Kendall [~SAIF@173-165-28-227-Illinois.hfc.comcastbusiness.net] has left #openvpn []
18:36 -!- datruth [datruth@gotpot.org] has quit [Quit: Lost terminal]
18:38 -!- datruth [datruth@gotpot.org] has joined #openvpn
18:39 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
18:41 -!- pinkydw [~pinky-m@67.58.112.154] has joined #openvpn
18:42 < pinkydw> is it possible to set up a connection with multiple static.key files, or use the same for multiple connections?
18:42 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
18:43 -!- datruth [datruth@gotpot.org] has quit [Quit: need screen]
18:43 -!- Bheam [michael@77.94.234.164] has quit [Remote host closed the connection]
18:43 -!- Bheam [michael@77.94.234.164] has joined #openvpn
18:44 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 276 seconds]
18:45 -!- Martin`_ is now known as Martin
18:45 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
18:45 -!- Martin is now known as Guest92560
18:46 < EugeneKay> You can use a static key for as many connections as  you like.
18:46 < EugeneKay> But AFAIK it's one-key per connection.
18:46 < EugeneKay> If you need "fancy" setups, you should probably just setup a PKI.
18:47 < pinkydw> ... so I'd need one server per client, that sounds like a bad way to do it.  Pardon my ignorance, but I don't know the PKI acronym
18:47 < EugeneKay> No, you can have multiple clients per server, all using the same secret key
18:47 < EugeneKay> PKI is Public Key Infrastructure, meaning CA/Client certs, keys, etc.
18:48 < Olipro> pinkydw: the point of the static ta.key is really just for stopping DoS attacks and such
18:48 < Olipro> like EugeneKay, use it in combination with PKI (X509) certs
18:48 < EugeneKay> Or dead-simple 1 server <---> 1 client setups
18:49 < Olipro> *EugeneKay said
18:49 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
18:50 < pinkydw> Hmm, still a bit confused, I could have one server, with a key for each client?
18:51 < Olipro> of course
18:51 < Olipro> the ta.key is static, and each client gets their own client certificate and key, signed by your certification authority
18:52 < pinkydw> ahh, so I need to do a bit more research before I'll have intelligent questions at this point.  Thanks
18:53 -!- Denial [~Denial@drgi.co.uk] has quit []
18:54 -!- pinkydw [~pinky-m@67.58.112.154] has quit [Quit: Leaving]
19:02 < rothwell> 'lo. i'm assigning static ip addresses to clients with ifconfig-push. is it safe to rely on this address <-> client mapping for the purposes of packet filtering and so on?
19:02 < rothwell> i'd like to allow a few clients access to a server, i'd ideally filter based on their vpn ip address
19:03 < rothwell> i'm not sure if a rogue client can somehow subvert this
19:04 < rothwell> oh, apparently it is reliable
19:04 < rothwell> "If you want guaranteed assignment, use --ifconfig-push" from the 2.1 manual
19:08 -!- datruth [datruth@gotpot.org] has joined #openvpn
19:08 < datruth> !ccd
19:09 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
19:09 < datruth> !route
19:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
19:12 < rothwell> i'm using ccd in a chroot, currently
19:13 < rothwell> not familiar with iroute yet, though
19:14 < EugeneKay> iroute is used for clients which have a network behind them.
19:14 < EugeneKay> It means "don't push the route for that subnet to me, I'm already dealing with it"
19:18 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
19:18 < JasonBoxLaptop> !goal ?
19:21 < EugeneKay> Skip the ?
19:21 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
19:21 < JasonBoxLaptop> !goal
19:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:22 < JasonBoxLaptop> But of course!
19:23 < JasonBoxLaptop> Maybe less of an OpenVPN question, but what might be a good approach to detecting myself inside the LAN and not starting OpenVPN?
19:23 < JasonBoxLaptop> On a Debian GNU/Linux system
19:30 < EugeneKay> JasonBoxLaptop - depends how you're starting OpenVPN
19:31 < EugeneKay> If it's at-boot as a system service, your best approach is going to be to modify the init script for openvpn.
19:32 < EugeneKay> A simplified version would be to stick something into start() of the init script that does grep 11.22.33 `ip -f inet addr show`, and if that returns TRUE, exit with a failed status
19:32 < datruth> I'm using OpenVPN 2.2.1 on freebsd8.2 with pf+nat and I am having trouble connecting to the internet when I connect to the vpn from my windows xp box thats connected to a wireless router. There are no errors in the log files on the server and client side my configuration is http://pastebin.com/xSDFtBU8 is my client or server configuration or ccd entry wrong? 
19:33 < JasonBoxLaptop> Interesting
19:34 < EugeneKay> You'll get a big red FAILED if you try to start openvpn manually, but it'll do what you want.
19:34 < JasonBoxLaptop> I'm grepping for my IP address?
19:41 < EugeneKay> Well, the subnet it's in.
19:41 < EugeneKay> Dunno what IP you'd get within that subnet cuz of DHCP et al
19:42 < EugeneKay> You could use something like ipcalc to get the subnet back, which would be more definitive.
19:43 < JasonBoxLaptop> hrm, thought about just abusing resolv.conf looking for the domain
19:46 < JasonBoxLaptop> hrm, I have a push "route ..." in my server.conf, but I haven't seen that route on the client ever; must be missing something obvious?
19:52 < EugeneKay> The push is pushing it to the client
19:52 < EugeneKay> So you don't need it in client.conf
19:53 < EugeneKay> It's a good practice to put everything that can be pushed on the server side - you only have to change it once, at the server, not on every client.
19:53 < EugeneKay> ("a good practice" not "best practice".... :-p )
19:54  * datruth has hit a brick wall
19:54 < EugeneKay> Have you tried scaling it?
20:09 < datruth> Anyone know what I could be doing wrong?
20:10 < EugeneKay> Firewall?
20:10 < datruth> Nat is setup 
20:11 < datruth> Is my configuration wrong?
20:17 -!- master_of_master [~master_of@p57B52D9C.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
20:19 -!- master_of_master [~master_of@p57B53227.dip.t-dialin.net] has joined #openvpn
20:19 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
20:22 <@vpnHelper> RSS Update - forum: Help with setting a VPN in VPS <http://forums.openvpn.net/topic8586.html#p14357>
20:23 < datruth> !static
20:23 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
20:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:24 < datruth> !topology
20:24 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
20:32 < EugeneKay> Firewall != nat 
20:34 < datruth> finally it's working
20:34 < datruth> rather slow tho
20:34 < datruth> ;/
20:36 < datruth> ahh might be an dns issue
20:54 < datruth> Alrighty so clients who connect to my vpnserver that tells them to use the vpn as the default gateway if the client is behind a lan they wont beable to access other lan machines on their lan?
20:54 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:55 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Ping timeout: 264 seconds]
20:58 -!- datruth [datruth@gotpot.org] has quit [Quit: Lost terminal]
20:59 -!- datruth [datruth@gotpot.org] has joined #openvpn
21:00 < datruth> is the ccd option to push  certain routs/options to a client?
21:01 -!- ph1l [~ph1l@gprs01.swisscom-mobile.ch] has joined #openvpn
21:21 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 258 seconds]
21:37 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
21:39 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
21:41 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
21:45 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
21:47 < JasonBoxLaptop> EugeneKay: Yeah, my client seems to ignore the pushed route; never appears in route -n
21:52 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
21:56 < ecrist> JasonBoxLaptop: windows?
21:56 < ecrist> if so, then you're not running as an administrator.
21:56 < ecrist> datruth: yes
21:56 < JasonBoxLaptop> ecrist: Debian GNU/Linux
21:57 < ecrist> are you running as root?
21:57 < ecrist> !logs
21:57 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
21:57 < JasonBoxLaptop> openvpn is running as root on the client
21:58 < ecrist> then I need to see logs
22:03 < JasonBoxLaptop> hrm, shows up in the logs
22:04 < EugeneKay> See, we can't debug your logs without looking at them.
22:04 < EugeneKay> !topsecret
22:05 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
22:05 < JasonBoxLaptop> Agreed, I'm looking at it now; I should be familar with the logs anyway
22:05 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
22:05 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
22:06 < datruth> !source
22:06 <@vpnHelper> My source is at http://supybot.com/
22:06 < datruth> !bad source
22:06 < datruth> !ip
22:06 < datruth> damn
22:06 < JasonBoxLaptop> hrm, it's pushing the route fine now; must be user error
22:07 < datruth> anyone know how to fix MULTI: bad source address from client
22:07 < datruth> ?
22:11 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
22:12 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
22:13  * JasonBoxLaptop hug OpenVPN
22:15 < datruth> JasonBoxLaptop: would you happen to know?
22:18 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
22:18 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
22:21 < JasonBoxLaptop> datruth: Sadly it's outside my realm of knowledge
22:21 < datruth> ;/ 
22:25 < datruth> nvm got it
22:25 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
22:26 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
22:29 -!- batrick [~batrick@nmap/developer/batrick] has quit [Client Quit]
22:30 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
22:44 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
23:19 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
--- Day changed Fri Aug 05 2011
00:17 -!- ph1l [~ph1l@gprs01.swisscom-mobile.ch] has quit [Quit: Leaving.]
01:00 -!- mode/#openvpn [+o EugeneKay] by ChanServ
01:00 -!- Olipro was kicked from #openvpn by EugeneKay [THE FIRST RULE OF OPENVPN IS YOU DON'T TALK ABOUT OPENVPN]
01:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:00 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
01:02 < Olipro> dammit, the win32 builds of OpenVPN with IPv6 crash :(
01:03 <@vpnHelper> RSS Update - forum: Can't get OpenVPN started <http://forums.openvpn.net/topic8587.html#p14358>
01:04 < EugeneKay> That would be why the patches aren't mainlined
01:08 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Read error: Connection reset by peer]
01:08 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
01:12 -!- chokesmaster [~chokesmas@65.92.223.57] has joined #openvpn
01:39 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p14359>
01:45 <@vpnHelper> RSS Update - forum: Help with setting a VPN in VPS <http://forums.openvpn.net/topic8586.html#p14361> || OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14360>
01:58 -!- EugeneKay is now known as EugeneKaway
02:02 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
02:19 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:21 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14362>
02:24 < Mowee> Morning
02:25 -!- aaroneous [aaron@static-71-183-67-138.nycmny.fios.verizon.net] has joined #openvpn
02:27 -!- aaroneous_ [aaron@static-71-183-67-138.nycmny.fios.verizon.net] has joined #openvpn
02:27 -!- aaroneous [aaron@static-71-183-67-138.nycmny.fios.verizon.net] has quit [Client Quit]
02:28 -!- aaroneous_ [aaron@static-71-183-67-138.nycmny.fios.verizon.net] has quit [Read error: Connection reset by peer]
02:53 < Olipro> EugeneKaway: oh but it is
02:53 < Olipro> http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn;a=blob;f=README.ipv6;h=4295f85440f14d037ec5f23e06aa4e68690a7f47;hb=HEAD
02:53 <@vpnHelper> Title: SourceForge - openvpn/openvpn/blob - README.ipv6 (at openvpn.git.sourceforge.net)
03:05 -!- jasonb [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
03:07 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
03:10 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 255 seconds]
03:13 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Ping timeout: 250 seconds]
03:27 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
03:30 -!- luneff [~yury@84.51.196.42] has quit [Quit: This computer has gone to sleep]
03:40 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14364> || Using CSF with OpenVPN - a couple of small problems :) <http://forums.openvpn.net/topic8585.html#p14363>
03:52 <@vpnHelper> RSS Update - forum: Can't get OpenVPN started <http://forums.openvpn.net/topic8587.html#p14365>
03:52 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
03:54 -!- star314 [~star314@beigelbeck-nb.isas.tuwien.ac.at] has joined #openvpn
03:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:55 -!- mode/#openvpn [+v s7r] by ChanServ
03:58 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14366>
04:21 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 240 seconds]
04:23 -!- datruth [datruth@gotpot.org] has quit [Read error: Connection reset by peer]
04:23 -!- datruth [datruth@gotpot.org] has joined #openvpn
04:25 < Bushmills> HTC has announced an open bootloader for their android phones, allowing flashing of custom firmware.  users of already sold phones can obtain an unlock code
04:29 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
04:34 -!- patelx [~a@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
04:37 -!- luneff [~yury@93.178.79.10] has joined #openvpn
04:39 -!- patelx [~a@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
04:40 <@vpnHelper> RSS Update - forum: Can't get OpenVPN started <http://forums.openvpn.net/topic8587.html#p14367>
04:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
05:02 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:02 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:04 <@vpnHelper> RSS Update - forum: How to add new config? <http://forums.openvpn.net/topic8590.html>
05:52 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14369>
05:56 -!- luneff [~yury@93.178.79.10] has quit [Ping timeout: 260 seconds]
06:00 < uuuppz> http://sourceforge.net/projects/openvpnui/
06:00 <@vpnHelper> Title: OpenVPN UI | Download OpenVPN UI software for free at SourceForge.net (at sourceforge.net)
06:00 < uuuppz> published my gui
06:02 -!- luneff [~yury@93.178.79.10] has joined #openvpn
06:08 -!- Norgus [~norgus@93.97.117.39] has joined #openvpn
06:09 < Norgus> guys, does an OpenVPN VPN need more than 1 port open to connect and use it?
06:09 < Norgus> I apid for a service, which works on port 443 (at least, that's what it says inside the .ovpn file)
06:10 < Norgus> so I tried blocking all traffic to and from my computer except for port 443
06:10 < Norgus> but it stops connecting to OpenVPN too...
06:10 < Norgus> anything I'm missing?
06:12 < Norgus> I basically want to get around the behavoiur in windows 7 which directs the internet traffic over my non-VPN adaptor whenever the VPN disconnects
06:12 < Norgus> so I thought I'd do it by only letting through the VPN tunnel...
06:13 -!- cafaro [~cafaro@unaffiliated/cafaro] has joined #openvpn
06:15 < Bushmills> Norgus: no
06:15 <@vpnHelper> RSS Update - forum: Can't get OpenVPN started <http://forums.openvpn.net/topic8587.html#p14370>
06:16 < Bushmills> maybe you have blocked return traffic
06:16 < cafaro> Hey, I'm trying get openvpn working in daemon mode (with --daemon), but nothing seems to happen... (normal mode works fine). messages.log says: localhost file.openvpn[1078]: Use --help for more information.
06:16 < cafaro> Command I've used: sudo openvpn --daemon file.ovpn
06:17 < Bushmills> you may have redirect-gateway in use, without  def1, resulting in using your default gateway again when vpn connection drops
06:17 < Bushmills> cafaro: what do you expect to happen?  
06:18 < cafaro> Bushmills: sorry, to have an active connection (which I haven't), and see the daemon in my htop
06:18 < Bushmills> when specifying additional config options on command line, use --config to specify config file
06:20 < cafaro> wow it works
06:20 < cafaro> thanks :)
06:21 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
06:23 < Norgus> thanks Bushmills I'll check it out
06:24 < Norgus> I actually blocked all incoming and outgoing then allowed in and out on 443
06:24 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
06:24 < Norgus> I guess it wouldn't hurt to only block all outgoing
06:24 < Bushmills> your origin port might be different port
06:25 < Bushmills> think about block all outgoing with a different destination than vpn server
06:25 < Norgus> so it might request with one and transfer on another?
06:25 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
06:25 < Bushmills> matter of configuration. usually, that's how requests are sent. most every request source port is different to destination port
06:30 -!- Norgus [~norgus@93.97.117.39] has quit [Ping timeout: 276 seconds]
06:31 -!- Norgus [~norgus@93.97.117.39] has joined #openvpn
06:39 < Optic> moo
06:45 -!- Norgus [~norgus@93.97.117.39] has quit [Quit: leaving]
07:00 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14371>
07:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
07:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:26 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 250 seconds]
07:27 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
07:31 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p14372>
07:31 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:35 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has left #openvpn []
08:03 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
08:04 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
08:09 -!- luneff [~yury@93.178.79.10] has quit [Quit: Leaving]
08:10 -!- luckman212_ [~irc@2001:470:1f07:1225:edc4:257c:e991:562a] has joined #openvpn
08:13 <@vpnHelper> RSS Update - forum: Help with setting a VPN in VPS <http://forums.openvpn.net/topic8586.html#p14373>
08:13 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
08:13 -!- luckman212 [~irc@2001:470:1f07:1225:2d40:d31d:26e0:afd3] has quit [Ping timeout: 260 seconds]
08:14 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:14 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 250 seconds]
08:14 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
08:16 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
08:16 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
08:16 -!- mode/#openvpn [+v Axeman] by ChanServ
08:17 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:21 < datruth> !lans
08:21 <@vpnHelper> "lans" is https://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
08:22 < datruth> !lan
08:52 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 240 seconds]
09:02 -!- rothwell [~rothwell@unaffiliated/rothwell] has quit [Quit: leaving]
09:04 -!- star314 [~star314@beigelbeck-nb.isas.tuwien.ac.at] has quit [Quit: Leaving]
09:07 <@vpnHelper> RSS Update - forum: How to add new config? <http://forums.openvpn.net/topic8590.html#p14374>
09:08 -!- jemand [~quassel@brln-4d0c3724.pool.mediaWays.net] has joined #openvpn
09:11 < jemand> Hi all, I can't get VPN running under Kubuntu 11.04 KDE 4.7
09:11 < jemand> any hints, what Kubuntu really needs?
09:11 < jemand> in the SUSE version it's shown in the networkmanager
09:12 < jemand> and works.
09:12 < jemand> not so with Kubuntu... ;-(
09:13 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
09:14 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
09:15 -!- Axeman [~thirdchoi@198.105.46.46] has joined #openvpn
09:15 -!- Axeman [~thirdchoi@198.105.46.46] has quit [Changing host]
09:15 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
09:15 -!- mode/#openvpn [+v Axeman] by ChanServ
09:16 -!- darkdrgn2k4 [~darkdrgn2@199.243.221.174] has joined #openvpn
09:16 < darkdrgn2k4> hey guys
09:16 < darkdrgn2k4> des "keepalive" work on the client?
09:17 < darkdrgn2k4> does even
09:23 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has quit [Ping timeout: 240 seconds]
09:27 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has joined #openvpn
09:39 < datruth> darkdrgn2k4: not sure
09:41 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14375>
09:45 < Bushmills> !ubuntu
09:45 <@vpnHelper> "ubuntu" is dont use network manager!
09:45 < Bushmills> jemand: ^^^
09:47 < Bushmills> darkdrgn2k4: on the client alone, it'd not be complete.  put it on server, then server will push it to client, in addition to executing it on server.
09:53 < datruth> Bushmills: if i'm at work and connect to a remote vpn outside of work's network can I still access multiple lans that sits on the work's network?
09:55 < Bushmills> potentially, yes. you can set up things such that you can't, therefore it depends on your configuration
09:55 <+s7r> if i have in client config multiple <connection> </connection> tags, on different ports, what is the syntax to be added in order to try them in the order, not random
09:56 < Bushmills> s7r: have you consulted the man page?
09:56 <+s7r> Bushmills nop
09:56 < Bushmills> i thought so
09:59 <+s7r> An OpenVPN client will try each connection profile sequentially until it achieves a successful connection.
09:59 <+s7r> --remote-random can be used to initially "scramble" the connection list.
09:59 < datruth> Bushmills: would I need to configure static routes for that type of setup? and would the routing have to be done on both ends?
09:59 <+s7r> in the top of the man page ;))
09:59 < Bushmills> !route
09:59 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
09:59 < Bushmills> datruth: ^^^
09:59 < Bushmills> s7r: amazing, the man page, isn't it?
10:00 < datruth> Ive already read that thanks for the info anywho
10:00 <+s7r> yeah it is 
10:00 <+s7r> :))
10:11 <@vpnHelper> RSS Update - forum: OpenVPN UI Windows - Removes UAC/Administrator issue <http://forums.openvpn.net/topic8591.html>
10:17 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 250 seconds]
10:17 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
10:19 < ecrist> datruth: bullshit. I doubt you've read any docs. 
10:20 < datruth> ecrist: lol I can care less of doubts
10:21 < ecrist> yet, you are here...
10:21 < datruth> ecrist: don't worry I'm not here for you
10:22 < ecrist> darkdrgn2k4: yes, it does.
10:25 < uuuppz> Reading docs is hard :)
10:25 <+s7r> the manual page is amazing
10:25 <+s7r> :D
10:25 < ecrist> seems to be a theme in here, uuuppz 
10:25 < uuuppz> I'm no saint :)
10:25 < uuuppz> docs longer than 1 page
10:25 < uuuppz> tend not to get read
10:26 < uuuppz> (by me)
10:26 <+s7r> ecrist the man page has divisions for v2.2, v2.1 and v2.0.x
10:26 <+s7r> for example, v2.2 contains all v2.1 contained + the new features right ?
10:26 <+s7r> not ONLY the new added features to version 2.2.
10:26 < uuuppz> anyone tried my win ui? I'm kinda pleased with it
10:27 < uuuppz> even added an up/down traffic monitor... the most important bit!
10:27 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
10:29 <+s7r> ?
10:29 < ecrist> uuuppz: is it the one bundled with openvpn?
10:29 < uuuppz> no 
10:29 < uuuppz> I wrote my own
10:29 < ecrist> s7r: yes, it's segmented.
10:30 < ecrist> let's see it
10:30 < uuuppz> thats divided into a service
10:30 < uuuppz> and tray app
10:30 < uuuppz> instances of openvpn are loaded by service
10:30 < uuuppz> console, start/stop viewable from tray
10:30 < uuuppz> just like the bundled one
10:30 <+s7r> ecrist i know it's segmented .. but the manual for v2.2 for example, containes everything in the manual for v2.1 + the new features of version 2.2 correct ?
10:31 < uuuppz> http://sourceforge.net/p/openvpnui/home/Home/
10:31 <@vpnHelper> Title: OpenVPN UI / Home / Home (at sourceforge.net)
10:31 < ecrist> s7r: yes
10:35 <@vpnHelper> RSS Update - forum: How to add new config? <http://forums.openvpn.net/topic8590.html#p14377>
10:35 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
10:36 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
10:38 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:38 -!- K1ng` [~KING@58.97.132.210] has quit [Client Quit]
10:38 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
10:41 <@vpnHelper> RSS Update - forum: SIP over OpenVPN tunnel <http://forums.openvpn.net/topic8584.html#p14378>
10:41 < ecrist> uuuppz: I have some feed back for you
10:42 < ecrist> 1) if I select it from the tray, the extra tray items panel doesn't go away automatically
10:42 < uuuppz> how do you mean?
10:42 < uuuppz> ie what are you expecting to happen....?
10:43 < uuuppz> atm
10:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
10:43 < uuuppz> if you click it
10:43 < uuuppz> the way to make it disappear is to click on something else
10:44 < uuuppz> will probably enhance this behaviour a bit, so open to suggestions....
10:44 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
10:44 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
10:44 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:47 < ecrist> 2) the 'buttons' for each VPN connection are diferent sizes.  It would be cleaner, imo, if they were sized the same: https://skitch.com/ecrist/fp28k/different-button-sizes
10:47 <@vpnHelper> Title: ecrist | skitch.com (at skitch.com)
10:47 < uuuppz> brb
10:48 < ecrist> also, the buttons jump around when I select one, which is puzzling/irritating.
10:48 < krzee> ecrist, ever flashed a router with openwrt or ddwrt to have ovpn support on it?
10:49 < ecrist> once, a long time ago
10:49 < ecrist> now I use freebsd boxes
10:50 < krzee> http://www.dd-wrt.com/phpBB2/viewtopic.php?t=142518
10:50 < krzee> annoying =/
10:53 <@vpnHelper> RSS Update - forum: How to add new config? <http://forums.openvpn.net/topic8590.html#p14379>
10:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:56 < ecrist> heh
10:58 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:58 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:58 < krzee> the feeling after installing ddwrt and seeing pptp is the only vpn i can use is not a good feeling
10:59 <@vpnHelper> RSS Update - forum: SIP over OpenVPN tunnel <http://forums.openvpn.net/topic8584.html#p14380>
11:00 < uuuppz> ecrist: Can explain the buttons jumping arounds to me. Thats not happening here....
11:00 < uuuppz> when you say buttons
11:00 < Bushmills> krzee, with openwrt,   opkg install openvpn,  set option config  of "config openvpn..."   in /etc/config/openvpn to  path/name of config file, and  enable to 1
11:00 < uuuppz> I presume you mean the tabs...
11:01 < ecrist> uuuppz: no clue - they look like buttons to me
11:01 < ecrist> they shift position when I click on them.
11:01 < Bushmills> config 'openvpn' 'custom_config    that is.  that avoids having to use the provided configurator, allows using your own config
11:02 < uuuppz> the ones to select which config to use?
11:02 < krzee> Bushmills, the issue is that when i install openvpn, it doesnt stay on next boot
11:02 < ecrist> yes
11:02 < uuuppz> how many configs do you have?
11:02 < Bushmills> krzee, sounds like it wasn't flashed then
11:02 < krzee> its not part of the dd-wrt that i flashed
11:02 < Bushmills> openvpn ... ah.  i read "openwrt"   :)
11:02 < krzee> ahh =]
11:03 < Bushmills>   /etc/init.d/openvpn enable
11:03 < krzee> openvpn is not on my dd-wrt install
11:03 < krzee> which is why im trying to re-roll it *with* openvpn
11:03 < Bushmills> i read that. which is the reason it suggested "openwrt"
11:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
11:04 < ecrist> also, uuuppz, your UI doesn't have any way of reading in user/pass
11:04 < krzee> ahh ok
11:04 < uuuppz> yeh I know that
11:04 < uuuppz> thats more of a todo
11:04 < uuuppz> than a bug tho :)
11:04 < krzee> i tried to get openwrt to flash, for some reason its being difficult, says its not right for my HW but im using what the wiki page said to use
11:04 < ecrist> tabs/buttons moving around isn't cool though.
11:04 < uuuppz> I wrote this in < 10hrs work
11:04 < uuuppz> yeh
11:04 < uuuppz> how many configs do you have?
11:05 < ecrist> it seems decent, and *may* be a good candidate to replace/augment the included UI
11:05 < ecrist> I have 7 configs
11:05 < uuuppz> ah yeh
11:05 < uuuppz> 7 configs would makie the tabs go onto multiple rows
11:05 < ecrist> one of which requires a user/pass
11:05 < uuuppz> which probably looks shite
11:05 < ecrist> I have 4 rows of tabs
11:05 < ecrist> I linked you a screen shot...
11:05 < ecrist> you apparently didn't click on it
11:06 < uuuppz> hm...
11:06 < uuuppz> u did?
11:06 < uuuppz> a PM?
11:06 < ecrist> 10:47:25 < ecrist> 2) the 'buttons' for each VPN connection are diferent sizes.  It would be cleaner, imo, if they were sized the same:  https://skitch.com/ecrist/fp28k/different-button-sizes
11:06 < ecrist> 10:47:28 <@vpnHelper> Title: ecrist | skitch.com (at skitch.com)
11:06 <@vpnHelper> Title: ecrist | skitch.com (at skitch.com)
11:06 -!- EugeneKaway is now known as EugeneKay
11:06  * EugeneKay yawns
11:06 < uuuppz> ah lol
11:06 < uuuppz> sorry
11:06 < uuuppz> I thought u'd linked some guide about button sizes
11:06 < uuuppz> told you I wasn't good at reading docs ;P
11:07 < uuuppz> yeh
11:07 < uuuppz> ok
11:07 < uuuppz> that looks bad
11:08 < uuuppz> think I'm gonna drop the tabbed interface 
11:08 < ecrist> also, use an icon or two instead of (connected) and (disconnected)
11:09 < uuuppz> yeh am going to
11:09 < uuuppz> I will probably get my designer to do a set of icons for it
11:11 < uuuppz> <ecrist> uuuppz: I have some feed back for you
11:11 < uuuppz> <ecrist> 1) if I select it from the tray, the extra tray items panel doesn't go away automatically
11:11 < uuuppz> <uuuppz> how do you mean?
11:11 < uuuppz> <uuuppz> ie what are you expecting to happen....?
11:11 < uuuppz> <uuuppz> atm
11:11 < uuuppz> * Rolybrau (~Rolybrau@unaffiliated/rolybrau) Quit (Ping timeout: 264 seconds)
11:11 < uuuppz> <uuuppz> if you click it
11:11 -!- uuuppz was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
11:11 < ecrist> and you need to handle user/password
11:11 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
11:11 < uuuppz> bah
11:11 < uuuppz> !
11:11 < uuuppz> :)
11:12 < uuuppz> anyhow.. can u answer the q about the tray...
11:12 < ecrist> it doesn't stay up nicely
11:12 < uuuppz> explain what you'd like to happen
11:12 < uuuppz> when would you like it to disappear?
11:12 < ecrist> either things pop up over your UI, or your UI disappears randomly at times when I'm trying to do things.
11:13 < uuuppz> hm
11:13 < ecrist> I think it should ONLY disappear when a user clicks an 'x' button
11:13 < uuuppz> it should close completely
11:13 < uuuppz> no
11:13 < uuuppz> on mine
11:13 < ecrist> yeah, on yours
11:13 < uuuppz> when I click any other window it hides
11:13 < uuuppz> mine in that case == my machine
11:13 < ecrist> I've shut down my windows vm now, but it disappeard a couple times while I was playing with it
11:14 < uuuppz> ah it could be another window popping up
11:14 < uuuppz> and getting the focus
11:14 < uuuppz> basically it hides when its deactivated
11:17 < uuuppz> Ok without further suggestions, I'll do what I can on the hiding/showing stuff. If you could let me know what you would intuitively expect or specific cases when its disappearing I'll try to handle these.
11:17 < uuuppz> Regarding the tabs etc
11:17 < uuuppz> I'm gonna redo the ui at that level
11:17 < uuuppz> as tabs doesn't work for more than a few connections.
11:17 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Depression is merely anger without enthusiasm]
11:17 < uuuppz> it also doesn't work well
11:18 < uuuppz> as the first tabs is quite likely not the one you want
11:18 < uuuppz> so you have to click twice
11:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:18 < ecrist> I thinkn a drop-down to select your connection, with an icon in the drop-down indicating connected or not would work
11:18 < uuuppz> have thought about thayt
11:18 < uuuppz> but don't like that either
11:18 < ecrist> click -> drop-down (or up) appears, see list of available connections (and their current status) -> select one -> see logs/traffic/etc
11:19 < uuuppz> I'm thinking display all connections
11:19 < uuuppz> but only detail for one thats selected
11:19 < uuuppz> but make connect/disconnect always available
11:19 < uuuppz> WPF makes it easy for me to style that nicely
11:20 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:27 < krzee> brb trying openwrt more
11:27 < krzee> =]
11:27 -!- krzee [nobody@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
11:29 -!- albech [~thomas@1503027373.seas-nve.dbnet.dk] has joined #openvpn
11:31 < albech> Hello everyone. I am trying to connect a client to my VPN server. I is having the same .conf as my Ubuntu box which connects fine, but I am getting this in my log file: http://pastebin.com/L1ZFmvbE
11:33 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:34 < datruth> albech: windows client?
11:36 < Bushmills> !winroute
11:36 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
11:36 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
11:36 < Bushmills> hm.. "Linux route add.."   ... nm
11:38 < albech> Bushmills, no its Linux as you see ;)
11:39 <@vpnHelper> RSS Update - forum: Using CSF with OpenVPN - a couple of small problems :) <http://forums.openvpn.net/topic8585.html#p14381>
11:41 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
11:43 -!- lutter [~lutter@173-228-80-136.dsl.static.sonic.net] has left #openvpn []
11:44 < albech> This seems to be the problem: Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:10: 0.255.10.10 (2.2.0)
11:45 < albech> could the problem be a version 2.2 connecting to version 2.1 server
11:45 < albech> ?
11:47 < Bushmills> most unlikely.  show line 10 of server conf
11:49 < Bushmills> hang on ...  2.1  .. hm.. that's rather old, indeed
11:49 < albech> http://pastebin.com/N3FR2TGy
11:49 < albech> line 10 is commented out ;)
11:50 < albech> the server is 2.1.3
11:51 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
11:52 < Bushmills> push “route 10.255.0.0 255.255.252.0 10.255.10.1″  is probably the reason.  10.250.10.1  is the openvpn server.  is the route after client connection attempt missing in client route table?
11:52 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:52 -!- mode/#openvpn [+v s7r] by ChanServ
11:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
11:54 < albech> Bushmills, that is a route to a separate network 10.255.0.0/22, which is not the same as openvpn 10.255.10.0/24
11:54 < albech> and that route does show up in the routing table on the client that works
12:00 < Bushmills> dunno. config seems ok
12:00 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 260 seconds]
12:01 < albech> Bushmills, thanks for looking at it.. Maybe someone else will have something to add.
12:10 < albech> hmm according to the log the Tun device is opened, but it newer show up in ifconfig
12:12 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
12:12 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 246 seconds]
12:12 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
12:17 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
12:19 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 264 seconds]
12:22 -!- dazo_afk is now known as dazo
12:24 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
12:42 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 276 seconds]
12:58 <@vpnHelper> RSS Update - forum: Things I will need to do if I use OpenVPN <http://forums.openvpn.net/topic8592.html>
13:04 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
13:15 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
13:17 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
13:19 -!- lutter [~lutter@173-228-80-136.dsl.static.sonic.net] has joined #openvpn
13:22 <@vpnHelper> RSS Update - forum: Using CSF with OpenVPN - a couple of small problems :) <http://forums.openvpn.net/topic8585.html#p14384> || Trouble connecting two sites <http://forums.openvpn.net/topic8593.html>
13:23 -!- K1ng`` [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
13:27 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
13:40 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14385>
13:43 -!- corretico_ [~luis@201.201.44.82] has quit [Ping timeout: 240 seconds]
13:44 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
13:50 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
13:52 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14386>
13:54 -!- jberiksen [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
13:54 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:56 < jberiksen> I have a openvpn installed on a Debian Squeeze. I can connect to the vpn, but can't ping anything on the network behind the vpn, someone how want to help me?
13:58 < albech> jberiksen, is your vpn server default gateway for the network as well?
14:00 < jberiksen> albech, i don't think so, i haven't changed my gatway under the installation
14:01 < albech> you can ping the VPN server itself?
14:02 < jberiksen> no only the ip my client get
14:02 < albech> do you have any firewall running on the VPN server?
14:02 < ecrist> albech: of course not.  nobody ever has firewalls running
14:03 -!- ph1l [~ph1l@178-83-28-230.dynamic.hispeed.ch] has joined #openvpn
14:03 < albech> ecrist, beg your pardon?
14:03 <@vpnHelper> RSS Update - forum: Using CSF with OpenVPN - a couple of small problems :) <http://forums.openvpn.net/topic8585.html#p14388>
14:03 -!- ph1l [~ph1l@178-83-28-230.dynamic.hispeed.ch] has quit [Read error: Connection reset by peer]
14:03 < jberiksen> no but the server is running behind a firewall
14:03 -!- ph1l [~ph1l@178-83-28-230.dynamic.hispeed.ch] has joined #openvpn
14:03 < jberiksen> and the vpn port sould be open
14:04 < albech> jberiksen, need to pastebin some conf files
14:05 -!- cafaro [~cafaro@unaffiliated/cafaro] has left #openvpn []
14:05 < albech> jberiksen, IF you are indeed getting a connection, it sounds like you need to configure a static route back to the VPN network on your default gateway
14:13 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:13 -!- mode/#openvpn [+v s7r] by ChanServ
14:14 -!- ph1l [~ph1l@178-83-28-230.dynamic.hispeed.ch] has left #openvpn []
14:15 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
14:16 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has quit [Ping timeout: 260 seconds]
14:17 -!- SpyderZ [~SpyderZ@S0106001310f843e2.wp.shawcable.net] has joined #openvpn
14:17 < SpyderZ> Hello
14:17 < SpyderZ> Anyone around?
14:18 <+s7r> yes
14:18 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
14:18 < SpyderZ> Just setting up OpenVPN and I think I have everything installed but I'm confused on the virtual network interface setup.
14:18 < SpyderZ> Do I need to make  eth2 with virtual IPs?
14:19 <+s7r> I do not understand the question
14:19 <+s7r> how many interfaces you have right now?
14:19 < ecrist> !howto
14:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:19 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has joined #openvpn
14:20 < SpyderZ> Currently I have eth0 which is for private datacenter connectivity, I have eth1 which has a range of public IPs.
14:20 <+s7r> ok. you leave eth1 as it is because your internet won't work
14:20 <+s7r> you configure the private ips in server.conf
14:20 <+s7r> read the man pages they are amazing :) just found out earlier
14:21 < SpyderZ> So I'll need to make another virtual private adapter eth2 with a range of something like 10.1.100.1-25
14:21 < SpyderZ> Ok, will do, thanks much!
14:21 <+s7r> ecrist in the next version of openvpn which will have full ipv6 support as the word goes, how will we number the private subnets ? what is the equivalent for 10.0.0.0/16 in ipv6 ?
14:21 <+s7r> SpyderZ no OpenVPN will do by default a virtuan tun/tap adapter
14:22 < SpyderZ> Ok, cause I have something set already and I can't connect.
14:22 <+s7r> you only need to work on your server config file
14:22 <+s7r> and of course, iptables rules
14:22 <+s7r> configure nat / masquerade
14:22 < SpyderZ> I should be able to connect as I'm in the allowed host rules.
14:23 < SpyderZ> I'm using Tunnelbrick on Mac OS X 10.7
14:23 <+s7r> do you like Mac OS ?
14:23 < SpyderZ> Over 15 years of using computers, love it. Will never go back.
14:24 <+s7r> ok. just curious
14:24 <+s7r> never used it thugh
14:25 <+s7r> !man
14:25 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
14:25 < SpyderZ> --mtu-disc is not supported on this OS
14:26 < SpyderZ> Found the setting, see if this fixes it.
14:26 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has quit [Ping timeout: 260 seconds]
14:28 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has joined #openvpn
14:32 < SpyderZ> Stuck on Assigning IP Address, something is try to do something.
14:44 <+s7r> SpyderZ what IP address you have on your eth0 interface
14:44 <+s7r> and what IP you have on your MAC OS box, internal
14:46 < SpyderZ> http://pastebin.com/mqkttA4X
14:46 < SpyderZ> Got my regular private IP of 192.168.1.101
14:46 <+s7r> because if you had 10.0.6.1 there would be conflicts between vpn and real network adapter
14:47 <+s7r> pastebin the output of ifconfig -a | grep tun
14:47 < SpyderZ> 8/5/11 2:44:58.000 PM kernel: tap0: failed to restore 1 suspended link-layer multicast membership(s) (err=102)
14:47 <+s7r> why do you use tap ?
14:47 <+s7r> and not tun ?
14:47 <+s7r> tap is layer 2 while tun is layer 3.. in all cases tun is recommended
14:47 <+s7r> unless you don't use some apps which requrie layer 2 connection
14:48 < SpyderZ> Open VPN is implemented in my Parallels Panel
14:48 < SpyderZ> I'll see if I can switch it.
14:48 <+s7r> ahh
14:48 <+s7r> don't you have root access to the server?
14:48 < SpyderZ> Yeah, I have root.
14:48 <+s7r> well let plesk aside
14:48 <+s7r> login as root via ssh
14:48 < SpyderZ> I'm in
14:48 <+s7r> what distro do u have ?
14:49 < SpyderZ> Centos 5.6 
14:49 <+s7r> is it a dedicated server or virtual private server?
14:49 < SpyderZ> dedicated
14:49 <+s7r> good you shouldn't have any problem
14:49 <+s7r> cd /etc/openvpn
14:49 <+s7r> locate the file server.conf
14:50 <+s7r> if openvpn is not installed yum install openvpn or get it from openvpn.net
14:50 < SpyderZ> I'm feeling Plesk bastardized openvpn
14:51 < SpyderZ> This is what I have installed 
14:51 < SpyderZ> http://pastebin.com/8qtvHuCf
14:52 < SpyderZ> Should I rip it out?
14:52 <+s7r> your centos is i386 or x64
14:52 <+s7r> ?
14:52 < SpyderZ> x64
14:53 <+s7r> please 
14:53 <+s7r> wget http://pkgs.repoforge.org/openvpn/openvpn-2.2.0-3.el5.rf.x86_64.rpm
14:53 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
14:53 <+s7r> rpm -i openvpn-2.2.0-3.el5.rf.x86_64.rpm
14:54 <+s7r> don't fuck that up in order to be sure you don't fuck plesk up
14:54 <+s7r> leave it alone and just install proper openvpn
14:54 < SpyderZ> ok
14:54 < SpyderZ> one sec
14:55 < SpyderZ> bunch of failed deps
14:55 < SpyderZ> Sec, I'll see if I can resolve these.
14:56 <+s7r> install it via yum thuhg
14:56 <+s7r> yum install openvpn
14:56 <+s7r> this will install dependencies also
14:56 < SpyderZ> perfect
14:56 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
14:56 < SpyderZ> Never new that...thanks!
14:56 <+s7r> you didn't know about yum ?
14:57 < SpyderZ> I know about yum
14:57 < SpyderZ> But about using yum to install and find deps.
14:57 < SpyderZ> I need the key for that repo.
14:57 <+s7r> cd /etc/yum.repos.d
14:57 <+s7r> you should have the default centos repos there
14:57 <+s7r> openvpn is in the default repos
14:57 < SpyderZ> Yeah, but for the openvpn package it's complaining for a key.
14:58 <+s7r> the link i paste you?
14:58 <+s7r> it shouldn't ... i get it from there (true i386 version) but no key asked
14:58 < SpyderZ> Got it from http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm
14:59 < SpyderZ> Ok, I'm installed.
14:59 <+s7r> now go to cd /etc/openvpn
14:59 < SpyderZ> I have a /etc/openvpn dir but it's empty
15:00 <+s7r> yeah
15:00 <+s7r> cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn
15:00 <+s7r> then go to cd /etc/openvpn and
15:00 <+s7r> gunzip server.conf.gz
15:02 < SpyderZ> Ok, a bit different file directory structure and I didn't have anything gz'd but the sample config file is now in /etc/openvpn/
15:02 <+s7r> what do you have in /etc/openvpn
15:03 <+s7r> type ls
15:03 <+s7r> do you have server.conf ?
15:03 -!- jasonb is now known as JasonBoxLaptop
15:03 < SpyderZ> Yup
15:03 <+s7r> perfect
15:04 < SpyderZ> Should I turn off the Plesk VPN?
15:04 <+s7r> you need now to create certificates - it's the most important part
15:04 <+s7r> yes 
15:04 <+s7r> disable it 
15:04 <+s7r> and start creating certs
15:04 <+s7r> mkdir /etc/openvpn/easy-rsa/
15:04 <+s7r> cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/
15:05 < SpyderZ> done
15:06 <+s7r> now you're done
15:06 <+s7r> you need to create certs for each client
15:06 < SpyderZ> That is just me.
15:06 <+s7r> and configure the server.conf as you want (route the client's traffic throught server, configure desired cipher, etc)
15:06 <+s7r> set it as you want
15:06 < SpyderZ> ok
15:06 <+s7r> you know how to right ?
15:07 < SpyderZ> I've never done this before but I'll learn it.
15:07 < SpyderZ> Sucks that Plesk couldn't get this all figured out with the GUI they had.
15:07 <+s7r> please do the reading on openvpn.net
15:07 <+s7r> !man
15:07 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
15:07 <+s7r> if you have any troubles ask here
15:07 < SpyderZ> Yup, I will, thanks so much for the help. I really appreciate it.
15:07 <+s7r> but please do some reading it's much to type and I can't explain you all syntaxes in server.conf what each one does
15:07 < SpyderZ> Just getting pissed at my ISP recording all my net traffic, etc.
15:08 <+s7r> oh yeah.. this happens too often
15:08 < SpyderZ> I'm thinking of possibly offering this as a commercial service.
15:11 -!- nb [~nb@fedora/nb] has joined #openvpn
15:17 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
15:18 -!- mode/#openvpn [+v Axeman] by ChanServ
15:19 -!- secondchoice [~thirdchoi@knox.pace.edu] has joined #openvpn
15:22 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
15:23 -!- secondchoice [~thirdchoi@knox.pace.edu] has quit [Client Quit]
15:33 -!- SpyderZ [~SpyderZ@S0106001310f843e2.wp.shawcable.net] has quit [Quit: SpyderZ]
15:52 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
15:56 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
15:56 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
15:56 -!- mode/#openvpn [+v Axeman] by ChanServ
15:58 -!- sadd [~sadd@MTRLPQ02-1177746624.sdsl.bell.ca] has joined #openvpn
15:58 < sadd> hello i am trying to connect to my openvpn with a single certification
15:58 < sadd> but it seems that if i am already conenct once, it doesnt let me connect with naother computer
15:59 < sadd> is there a way to let me conenct on multiple client using the same auth?
16:03 < EugeneKay> Yes. 
16:04 < EugeneKay> --duplicate-cn
16:04 < EugeneKay> You will probably want to enable --auth-user-pass as a way to additionally verify your users, but that's totally up to you.
16:05 < EugeneKay> Given the relative ease with which you can sign additional client certs, I can't recommend --duplicate-cn, but it does have its uses
16:07 -!- dazo is now known as dazo_afk
16:20 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html>
16:30 -!- Syshak [~access@unaffiliated/f/x-8967854] has joined #openvpn
16:31 < Syshak> hey, I've set up openvpn and samba on my server. Both running and working and I can ping the vpn server (10.0.0.1) from two different clients.
16:31 < Syshak> The problem is that I can only reach my samba share through one of the clients, which happens to be on the local network. With the one outside the LAN I cannot
16:31 < Syshak> both are accessing the samba share through the vpn.
16:32 < Syshak> Logs show nothing relevant and I'm pretty much stuck, which is why I come here :/
16:32 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14390>
16:37 -!- Janos [~cramos@201.198.38.138] has joined #openvpn
16:42 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Ping timeout: 250 seconds]
16:43 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Read error: Operation timed out]
16:49 -!- Janos [~cramos@201.198.38.138] has left #openvpn ["Ex-Chat"]
16:50 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 252 seconds]
16:51 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
17:02 -!- albech [~thomas@1503027373.seas-nve.dbnet.dk] has quit [Quit: Ex-Chat]
17:03 -!- sadd [~sadd@MTRLPQ02-1177746624.sdsl.bell.ca] has quit [Ping timeout: 258 seconds]
17:03 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
17:06 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 260 seconds]
17:07 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has quit [Remote host closed the connection]
17:07 < EugeneKay> Syshak - are you using the VPN server's vpn ip or it's hostname? 
17:08 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
17:08 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has joined #openvpn
17:12 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
17:15 < uuuppz> ecrist: still around?
17:17 -!- corretico_ [~luis@201.201.44.82] has quit [Ping timeout: 260 seconds]
17:23 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
17:28 < ecrist> uuuppz: yes
17:32 < uuuppz> ah cool
17:32 < uuuppz> I'm just uploading a new version
17:32 < uuuppz> which helps matters imo
17:33 < uuuppz> ok its up but broken
17:33 < uuuppz> wrong file size
17:35 < uuuppz> ok its up
17:39 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
17:42 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:42 < krzee> Bushmills, seen my msgs?
17:43 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:43 < krzee> i got openwrt installed, the package is too big for my router by a small amount
17:44 < krzee> needs 509kb, has 436kb
17:46 < krzee> also, the commands you gave me earlier were lost when my client got closed =[
17:46 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
17:48 < krzee> oh damn its just libopenssl that wants 509
17:49 < EugeneKay> s/router/properlinuxbox
17:50 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
17:52 -!- pr0zoid [~pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
17:52 -!- p3rror [~mezgani@41.249.1.124] has joined #openvpn
17:53 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:57 < uuuppz> ecrist: the one point u raised I haven't addressed in the password one
17:57 -!- jahkop [~jahkop@171.25.159.245] has joined #openvpn
17:59 < jahkop> I connected to anonine openvpn via my server, now i can't connect to it via the external ip or the anonine ip, only the local ip. can i conf it to be reachable thorugh the vpn ip?
17:59 < ecrist> uuuppz: it's unusable to me without the user/pass prompt
18:02 < EugeneKay> Olipro - in your setup, are you using v4 tunnel? 
18:02 < EugeneKay> Or v6?
18:02 < EugeneKay> (or both?)
18:02 < uuuppz> ecrist: mind just taking a look see what you think of the new ui
18:03 < Olipro> EugeneKay: the link is established over IPv6 using tun and the inner link is IPv4 + IPv6
18:03 < ecrist> uuuppz: not now, on my way to the movies with the wife and kid
18:03 < EugeneKay> And what are you using for the inner link to establish the v6 addressing/routing? Is it built-in to the recent version?
18:04 < Olipro> just an up script
18:04 < EugeneKay> So it's not, then. Shucks.
18:04 < Olipro> there might be args you can put into the conf file that will setup IPv6
18:04 < Olipro> I never looked
18:04 < EugeneKay> I've not seen any
18:05 < EugeneKay> Evverything in the 2.2 man page is v4-focussed.
18:06 < uuuppz> ecrist: ok np
18:07 < EugeneKay> Hm. Looks like 2.1.4 doesn't error out when I specify --tun-ipv6
18:07 < EugeneKay> Means it should be able to pass v6 traffic.... but i really don't want to write a windows up script
18:08 < Olipro> you could just configure it statically on the tap device in Network Config
18:09 < EugeneKay> I could, but that's a bit gimmicky.
18:09 < Olipro> "do not fear the netsh"
18:09 < EugeneKay> I'd like to start writing up all my various config hacks
18:09 < EugeneKay> Yeah, yeah. I just HATE the windows tty is all
18:09 < EugeneKay> It's fucking shit
18:09 -!- corretico_ [~luis@201.201.12.2] has joined #openvpn
18:10 < EugeneKay> I'll do it when I get home
18:13 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 250 seconds]
18:20 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
18:29 < Syshak> EugeneKay: I'm using the ip (sorry for taking so long, at work :D)
18:29 < EugeneKay> Then it'll be a firewall issue
18:30 < Syshak> but I refuse to believe that, since I'm not running any firewalls
18:30 < Syshak> well, I'm connecting trough a router
18:30 < Syshak> (c)<--->(router forwarding the vpn port)<---->[VPN/Samba]
18:31 < Syshak> I can ping the server, I can ssh into it.. it seems like samba is the only problem
18:33 < EugeneKay> The router shouldn't matter, the endpoint is being established properly 
18:33 < EugeneKay> Check that samba is listening on the tun0 adapter
18:34 < Syshak> yep, it is. tun0 is specified in the interfaces section of smb.conf
18:34 < Syshak> I can also connect to the samba share from within the lan, through the tunnel
18:42 -!- corretico_ [~luis@201.201.12.2] has quit [Ping timeout: 255 seconds]
18:43 -!- EugeneK [EugeneKay@eugenekay.com] has joined #openvpn
18:43 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 264 seconds]
18:44 -!- EugeneK is now known as EugeneKay
18:54 -!- uuuppz [~uuuppz@213.79.53.61] has quit []
18:56 -!- K1ng [~KING@180.211.188.26] has joined #openvpn
18:57 <@vpnHelper> RSS Update - forum: Disconnection Failsafe <http://forums.openvpn.net/topic8595.html>
19:03 < Syshak> I'm puzzled, if it works through a tunnel within the lan it should work through the same tunnel outside the lan via the router
19:03 < Syshak> but for some obscure reason it doesn't 
19:04 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
19:14 -!- p3rror [~mezgani@41.249.1.124] has quit [Ping timeout: 255 seconds]
19:14 <@vpnHelper> RSS Update - forum: Disconnection Failsafe <http://forums.openvpn.net/topic8595.html#p14392>
19:19 -!- upz [~uuuppz@213.79.53.61] has joined #openvpn
19:23 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 250 seconds]
19:27 <@vpnHelper> RSS Update - forum: Not knowing what I don't know <http://forums.openvpn.net/topic8563.html#p14175>
19:27 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
19:28 -!- aaroneous [aaron@static-71-183-67-138.nycmny.fios.verizon.net] has joined #openvpn
19:31 -!- voglster [~yomama@70.122.225.235] has joined #openvpn
19:33 <@vpnHelper> RSS Update - forum: Disconnection Failsafe <http://forums.openvpn.net/topic8595.html#p14393>
19:39 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
19:50 -!- voglster [~yomama@70.122.225.235] has quit [Ping timeout: 255 seconds]
19:54 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Read error: Connection reset by peer]
19:56 -!- Denial [~Denial@drgi.co.uk] has quit []
19:56 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
19:57 -!- upz [~uuuppz@213.79.53.61] has quit []
20:02 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
20:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
20:13 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:14 -!- jberiksen [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit []
20:15 -!- master_of_master [~master_of@p57B53227.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:19 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
20:19 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
20:19 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:19 -!- master_of_master [~master_of@p57B5265E.dip.t-dialin.net] has joined #openvpn
20:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
20:33 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
20:33 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
20:33 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:45 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p14394>
20:46 -!- Carbon_Monoxide [~cmonxide@124244205016.ctinets.com] has joined #openvpn
20:46 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
20:57 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14395>
20:59 -!- lutter [~lutter@173-228-80-136.dsl.static.sonic.net] has quit [Quit: Leaving.]
21:17 -!- Squidy_at_Home [~quassel@189.31.5.101] has joined #openvpn
21:22 -!- Squidy_at_Home [~quassel@189.31.5.101] has quit [Ping timeout: 246 seconds]
21:24 -!- Squidy_at_Home [~quassel@201-2-107-5.cpece705.dsl.brasiltelecom.net.br] has joined #openvpn
21:29 -!- Squidy_at_Home_ [~quassel@189.31.25.193] has joined #openvpn
21:29 -!- Squidy_at_Home [~quassel@201-2-107-5.cpece705.dsl.brasiltelecom.net.br] has quit [Ping timeout: 252 seconds]
21:30 -!- jemand [~quassel@brln-4d0c3724.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
21:39 -!- Squidy_at_Home [~quassel@187.7.192.78] has joined #openvpn
21:40 -!- Squidy_at_Home_ [~quassel@189.31.25.193] has quit [Ping timeout: 276 seconds]
21:44 -!- Squidy_at_Home [~quassel@187.7.192.78] has quit [Ping timeout: 250 seconds]
21:52 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
21:56 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:56 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
22:00 -!- madball [~madball@114.79.60.60] has joined #openvpn
22:01 -!- madball [~madball@114.79.60.60] has left #openvpn []
22:14 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
22:14 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
22:14 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:20 -!- Tick-Tock_ [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
22:20 -!- Tick-Tock_ [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Remote host closed the connection]
22:22 <@vpnHelper> RSS Update - forum: Public IP? <http://forums.openvpn.net/topic8596.html>
22:26 -!- Tick-Tock_ [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
22:31 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
22:32 -!- Tick-Tock [~Tick-Tock@78.129.229.126] has quit [Remote host closed the connection]
22:32 -!- Tick-Tock_ is now known as Tick-Tock
22:36 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
22:40 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14397>
22:48 -!- Carbon_Monoxide [~cmonxide@124244205016.ctinets.com] has quit [Ping timeout: 276 seconds]
22:49 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
22:54 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:55 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:07 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
23:21 -!- Syshak [~access@unaffiliated/f/x-8967854] has left #openvpn []
23:27 -!- ArtVandalae [~ArtVandal@ppp59-167-188-168.static.internode.on.net] has left #openvpn []
23:38 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
23:39 -!- voglster [~yomama@70.122.225.235] has joined #openvpn
23:39 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14398>
23:50 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Ping timeout: 276 seconds]
23:53 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 258 seconds]
23:56 -!- voglster [~yomama@70.122.225.235] has quit [Ping timeout: 255 seconds]
--- Day changed Sat Aug 06 2011
00:04 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
00:15 -!- mete [~metefr@mete.shell.la] has quit [Ping timeout: 255 seconds]
00:16 -!- Carbon_Monoxide [~cmonxide@059148118151.ctinets.com] has joined #openvpn
00:18 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 255 seconds]
00:18 -!- freaky[t] [alpha@freakyonline.de] has quit [Ping timeout: 255 seconds]
00:22 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
00:23 -!- Carbon_Monoxide [~cmonxide@059148118151.ctinets.com] has quit [Ping timeout: 260 seconds]
00:23 -!- mete [~metefr@mete.shell.la] has joined #openvpn
00:24 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
00:29 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
00:29 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
00:29 -!- freaky[t]_ [alpha@freakyonline.de] has joined #openvpn
00:30 -!- freaky[t] [alpha@freakyonline.de] has quit [Ping timeout: 255 seconds]
00:42 -!- freaky[t]_ [alpha@freakyonline.de] has quit [Ping timeout: 240 seconds]
00:42 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
00:42 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Ping timeout: 250 seconds]
00:43 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
01:04 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
01:10 <@vpnHelper> RSS Update - forum: Public IP? <http://forums.openvpn.net/topic8596.html#p14400>
01:19 < datruth> !download
01:19 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
01:22 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
01:22 <@vpnHelper> RSS Update - forum: Help with setting a VPN in VPS <http://forums.openvpn.net/topic8586.html#p14401>
01:23 < EugeneKay> Hm.
01:23 -!- mode/#openvpn [+o EugeneKay] by ChanServ
01:23 <@EugeneKay> !beer
01:24 <@EugeneKay> !learn beer as what's for dinner
01:24 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
01:24 <@EugeneKay> Worth a go.
01:24 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
01:24 < datruth> ;/
01:26 < vpnuser> If I place the openvpn option --http-proxy ip port, will it use through the rest of the connection or only during the startup initialization of openvpn and end after the initialization is completed?
01:34 <@vpnHelper> RSS Update - forum: Things I will need to do if I use OpenVPN <http://forums.openvpn.net/topic8592.html#p14399>
01:36 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
01:40 <@vpnHelper> RSS Update - forum: Things I will need to do if I use OpenVPN <http://forums.openvpn.net/topic8592.html#p14402>
01:46 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14403>
01:52 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html>
01:58 <@vpnHelper> RSS Update - forum: [Solved] Disconnection Failsafe <http://forums.openvpn.net/topic8595.html#p14393>
02:05 -!- newmember [~chatzilla@66.183.103.108] has quit [Ping timeout: 240 seconds]
02:05 < Olipro> EugeneKay: does vpnHelper just pick the most moronic forum topics to spam the channel with or something?
02:06 < EugeneKay> It's fed from a RSS feed
02:06 < EugeneKay> (apparently)
02:06 < Olipro> s/vpnHelper/the RSS feed
02:06 < EugeneKay> No, that's just how forums work.
02:06 < EugeneKay> It keeps them out of IRC, generally.
02:08 < Olipro> EugeneKay: OKAY I'VE PICKED
02:09 < Olipro> so anyway, yeah... QuickTun
02:09 < EugeneKay> Yeah, never heard f it.
02:09 < Olipro> well, I should also mention, the guy who "recommended" it also recommends using rsync over AXFR
02:09 < EugeneKay> "QuickTun uses the curve25519xsalsa20poly1305 crypto-box functionality of the NaCl library for secure public-key encryption. "
02:09 < EugeneKay> Does it slice cheese, too?
02:09 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14405>
02:10 < Olipro> vpnHelper: shush
02:10 -!- mode/#openvpn [+o EugeneKay] by ChanServ
02:10 -!- vpnHelper was kicked from #openvpn by EugeneKay [Shush]
02:10 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
02:10 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:10 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
02:10 < datruth> hrmm
02:10 < Olipro> hahaha
02:10 < EugeneKay> I don't think (s)he listens well.
02:11 < Olipro> I wonder if it'd rejoin if you /remove'd it
02:11 < EugeneKay> Can't be arsed.
02:12 < Olipro> interesting, the openvpn-devel package in OpenWRT gets compiled with IPv6 support
02:13 < EugeneKay> I should setup dhcp
02:13 < datruth> Aside from crl-verify,ccd configuration,tls-auth key and tls-verify can I plug this into an active directory authentication as well?
02:14 < datruth> OB
02:14 < EugeneKay> Sure. --auth-user-pass to a script which turns hat into LDAP.
02:14 < datruth> ahh okay
02:14 < datruth> thx
02:15 < EugeneKay> I don't believe the windows GUI has any mechanism to pass the currently-authed-as-user-pass to(I would be surprised if it did), but you can tell users to just "login again"
02:15 < datruth> any supplied scripts or do I need to write my own and if so would it be perl?
02:15 < EugeneKay> Write your own, whatever language you like.
02:15 < EugeneKay> standard shebang executables work fine.
02:16 < datruth> so for windows users they'd need to login to the vpn twice?
02:16 < EugeneKay> Well, login o window, then into the vpn
02:17 < datruth> Hrmm I'll have to check into that more and see what would need to be done.
02:19 < datruth> OB
02:19 < datruth> hrmm my keyboard seems to be messed up ;/
02:20 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14406>
02:23 < datruth> Are there extra features in the -devel version?
02:24 < Olipro> on OpenWRT?
02:25 < Olipro> openvpn-devel is an OpenWRT specific package
02:26 < EugeneKay> It's newer and shinier.
02:40 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Ping timeout: 255 seconds]
02:41 < datruth> I see
02:41 < datruth> I was talking about freebsd
02:41 < Olipro> oh right, yeah, that should have been obvious considering how you completely didn't mention FreeBSD at all
02:42 < Olipro> :P
02:42 < datruth> my mistake :)
02:42 < Olipro> aaanyway, if you're willing to build from source, you can select from a variety of different compile-time options
02:42 < Olipro> such as establishing the VPN over IPv6
02:43 < datruth> yeah i have errors in my logs about ipv6 but when I installed from ports I had no ipv6 option
02:43 < datruth> That would be nice to route an IPv6 host over the vpn to v6 traffic
02:45 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14407>
02:49 -!- EugeneKay is now known as EugeneKaway
02:49  * EugeneKaway waits patiently for proper IPv6 support, but first goes to bed
02:50 < datruth> Nighty nite
02:51 < Olipro> yeah, I'd be interested to know the reason why it's not in the pre-built binaries
02:53  * datruth nods
02:53 < Olipro> I've failed to find any warnings against it from anyone
02:54 < Olipro> works just peachy for me
02:55 < datruth> what would the ipv6 syntax be in the serv/client config?
02:55 < datruth> !ipv6
02:55 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
02:55 < datruth> !snapshots
02:55 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
02:57 < Olipro> datruth: just use tcp6/udp6 to get it to listen on an IPv6 port
02:58 < datruth> oh so the client would have to be on an ipv6 network already to connect?
02:59 < Olipro> ...
02:59 < Olipro> yes, your computer also needs to be turned on in order to connect
03:00 < datruth> I was hoping the client could connect to the ipv4 vpn and get an ipv4/ipv6 address
03:00 < Olipro> that's already doable in the pre-built binaries
03:00 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14408>
03:00 < Olipro> all you need is tun-ipv6 set
03:00 < Olipro> and you can freely assign an IPv6 address to the tun interface
03:01 < datruth> we are talking about the server-side?
03:03 < Olipro> we are talking about the tunnel establishment
03:04 < Olipro> the pre-built binaries cannot establish the VPN over IPv6
03:05 -!- NyaR [~NyaR@astound-69-42-6-200.ca.astound.net] has joined #openvpn
03:07 < datruth> I see
03:29 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14409>
03:35 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14410>
03:41 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14412> || Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14411>
03:47 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14413>
03:50 -!- jemand [~quassel@brln-4d0c1800.pool.mediaWays.net] has joined #openvpn
03:56 < jahkop> Is it possible to set up openvpn so i can SSH to my server on its normal IP and do everything else over openvpn? im using arch linux.
04:03 < datruth> Thats how mine is setup
04:03 < reiffert> jahkop: yes it's possible.
04:04 < jahkop> Awesome, how do i set it up?
04:04 < reiffert> !howto
04:04 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:04 < datruth> hahaha
04:05 < jahkop> Maybe be a little more specific?
04:05 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14414>
04:05 < reiffert> !def1
04:05 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
04:05 < datruth> :>
04:06 < jahkop> I don't get it xD
04:06 < reiffert> then start with the former.
04:06  * datruth eats some popcorn
04:06 < jahkop> Reading the whole howto? :3
04:07 < datruth> yes
04:07 < reiffert> jahkop: nah, just doing the parts that it will take.
04:08 < jahkop> Thanks for being so helpful, i had no idea the openVPN community was so nice and helpful :)
04:09 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
04:09 < reiffert> jahkop: you are welcome.
04:10 < Bushmills> jahkop: "how do i set it up?"  you use an editor to create openvpn config file. both server and client. you choose and set up your authentication infrastructure. you install sshd on server. you connect openvpn client to server. you ssh in
04:10 < jahkop> If i don't own the openvpn server, if i use a paid service, is this still possible?
04:10 < Bushmills> ehm.  i forgot: you start openvpn server
04:10 < Bushmills> possible, yes - if paid service cooperates
04:11 < jahkop> They are not blocking any ports, what do they have to do for this to work? im using https://www.anonine.com btw
04:11 <@vpnHelper> Title: Anonine : VPN-tjänst - surfa anonymt (at www.anonine.com)
04:12 < Bushmills> they'd have to hire a translator, or somebody who reads it for them
04:12 < reiffert> read their howto?
04:12 < jahkop> It says nothing about the stuff i want to do unfortionaly
04:12 < Bushmills> but it says how to set things up.  how to use things later is up to you
04:13 < Bushmills> i suppose that there is no mention of how to use specific services in internet on your ethernet cable manual
04:13 < reiffert> hey your crystall ball is back on!
04:13 < Bushmills> instead, that merely tells you how to plug the cable in
04:14 < jahkop> uhmm.. no.. That's my point :P
04:15 < Bushmills> ah. nag the company who prints the cable manuals
04:15 < jahkop> Nah, i just wanted some help to set this up.
04:15 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14415>
04:17 < reiffert> by now he could have already done the whole thing.
04:17 < jahkop> I have no idea what to look for in ther howto
04:18 < jahkop> So, not really.
04:19 < reiffert> https://www.anonine.com/en/guides
04:19 <@vpnHelper> Title: Anonine : Guides (at www.anonine.com)
04:20 < jahkop> I know that stuff, that's a connect tutorial
04:20 < reiffert> oh really.
04:21 < jahkop> Yes really, i need help to make some routing or something to connect to ssh 
04:22 < Bushmills> you simply ssh to the server openvpn ip address
04:22 < jahkop> That does not work :/
04:22 < Bushmills> yes it does
04:23 < Bushmills> if ot doesn't work for you, "routing or something" won't help
04:23 < Bushmills> it
04:23 < Bushmills> well, "something" may
04:23 < Bushmills> !firewall
04:23 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
04:24 < jahkop> im trying to connect to it right now, it just timeouts
04:26 < Bushmills> that's a string indication for something being not quite right
04:26 < Bushmills> strong
04:26 < jahkop> Ok
04:29 < reiffert> is it timeouting like when you try to ssh to host 207.46.197.32?
04:30 < reiffert> ssh: connect to host 207.46.197.32 port 22: Operation timed out
04:30 < jahkop> Yes
04:30 < jahkop> port 22: Connection timed out
04:31 < jahkop> almost
04:31 < datruth> perhaps there is no sshd running?
04:31 < jahkop> There is, it works when i shut down openvpn, and when im on the same LAN
04:32 < datruth> Is it supposed to be sshable for everyone or just certain hosts?
04:33 < jahkop> It's using the default config, the listanaddress is commented out.
04:33 < datruth> is you openvpn on the same network?
04:34 < jahkop> The openvpn server is not on the same network
04:34 < datruth> !route
04:34 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:34 < datruth> !iroute
04:34 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
04:34 < jahkop> It does not work to connect via the openvpn IP when on the same LAN, only its real ip
04:35 < datruth> check into those two that might be helpful
04:35 -!- jemand [~quassel@brln-4d0c1800.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
04:35 < jahkop> okay thanks
04:49 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14416>
04:50 -!- newmember [~chatzilla@216.81.63.13.epikip.net] has joined #openvpn
04:55 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14417>
05:05 -!- newmember [~chatzilla@216.81.63.13.epikip.net] has quit [Ping timeout: 255 seconds]
05:07 -!- newmember [~chatzilla@216.81.63.13.epikip.net] has joined #openvpn
05:19 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-30.html#p14418>
05:21 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has joined #openvpn
05:24 -!- buntfalke [~nobody@openvpn-p0-ipv6-1041.triple-a.uni-kl.de] has joined #openvpn
05:24 -!- buntfalke [~nobody@openvpn-p0-ipv6-1041.triple-a.uni-kl.de] has quit [Changing host]
05:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
05:25 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:25 -!- newmember [~chatzilla@216.81.63.13.epikip.net] has quit [Ping timeout: 264 seconds]
05:26 -!- ph1l [~ph1l@169-226.196-178.cust.bluewin.ch] has left #openvpn []
05:37 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14419>
05:44 -!- jemand [~quassel@brln-4d0c1800.pool.mediaWays.net] has joined #openvpn
05:55 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
05:58 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
06:02 < uuuppz> FFS they actually deleted my post I put on the openvpn board about the GUI
06:04 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 250 seconds]
06:08 < uuuppz> and gave me a realy snotty reply
06:09 < uuuppz> think I'll just go back to not bothering.
06:16 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
06:55 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14421>
07:02 -!- flarets|h [~blur@110-175-82-48.tpgi.com.au] has joined #openvpn
07:03 -!- flarets|h is now known as flarets
07:21 -!- jemand [~quassel@brln-4d0c1800.pool.mediaWays.net] has quit [Remote host closed the connection]
07:22 -!- lder [ad45a64b@gateway/web/freenode/ip.173.69.166.75] has joined #openvpn
07:26 -!- lder [ad45a64b@gateway/web/freenode/ip.173.69.166.75] has left #openvpn []
07:37 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has joined #openvpn
07:49 <@vpnHelper> RSS Update - forum: win7 tracert goesthrough tunnel other traffic blked-nevermnd <http://forums.openvpn.net/topic8583.html#p14422>
08:03 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
08:03 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Ping timeout: 255 seconds]
08:04 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
08:07 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Client Quit]
08:08 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
08:10 -!- NyaR [~NyaR@astound-69-42-6-200.ca.astound.net] has quit [Ping timeout: 260 seconds]
08:14 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14424> || Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14423>
08:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:34 < ecrist> Olipro: IPv6 will be in 2.3
08:35 < ecrist> uuuppz: who/what post?
08:36 < Olipro> lovely, but until that's released, these's no code-red reason not to simply run a self-compiled version that has it, right?
08:36 < ecrist> not that we know of
08:36 < uuuppz> ecrist: I put a post in the offtopic/related forum
08:36 < ecrist> it's not included in pre-built binaries because it hasn't been tested properly
08:36 < ecrist> uuuppz: I'll look into it
08:36  * ecrist is the forum administrator
08:37 < uuuppz> and got a "Your post is an advertisement for "openvpn ui" owned by "ESP Technolgoies Ltd"."
08:37 < Olipro> oh well, in that case, if any devs are wanting feedback, feel free to fire questions at me
08:37 < ecrist> Bebop is a new moderator and is likely being a bit overzealous.  I'll look into it and correct him, if he was wrong.
08:37 < uuuppz> ok cool
08:38 < uuuppz> fyi: I have no commercial interest in this
08:38 < uuuppz> but everything I develop using company time gets attributed
08:39 < uuuppz> my only interest in "advertising" is to satisfy my own geek needs to see my work being used :)
08:39 < uuuppz> nehow...
08:40 < uuuppz> don't both installing the version I put up last night
08:40 < uuuppz> I've done major work since, UI is much better and I have u/p auth working
08:40 < ecrist> uuuppz: can you re-post, please?
08:40 < uuuppz> mind if I just dcc u the installer?
08:40 < ecrist> don't do that
08:40 < uuuppz> kinda want to fix a few things before I post
08:41 < uuuppz> I can check in source if u like 
08:41 < uuuppz> just I have things like password is still displaying as plain text
08:42 < ecrist> I'm not going to test it right now any ways, I've got stuff to do.
08:42 < uuuppz> ok 
08:42 < uuuppz> then back to my original
08:42 < uuuppz> don't install 0.2 :)
08:42 < ecrist> I sent a PM to the mod that gave you a warning, and I'm removing the warning you have
08:42 < uuuppz> thanks.
08:46 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
08:48 <@vpnHelper> RSS Update - forum: [Solved] One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-30.html#p14426> || Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html>
08:48 -!- luckman212_ [~irc@2001:470:1f07:1225:edc4:257c:e991:562a] has quit [Remote host closed the connection]
09:00 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14427>
09:04 -!- p3rror [~mezgani@41.140.174.236] has joined #openvpn
09:10 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
09:18 <@vpnHelper> RSS Update - forum: high quality stunt <http://forums.openvpn.net/topic8600.html>
09:25 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
09:29 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
09:36 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
09:47 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
09:48 <@vpnHelper> RSS Update - forum: Public IP? <http://forums.openvpn.net/topic8596.html#p14429>
09:52 -!- pindemon [~pindemon@unaffiliated/pindemon] has joined #openvpn
09:52 < pindemon> hi world!
09:52 < pindemon> as stated in the MOTD... I do recognize my problem is the firewall...
09:52 < pindemon> I would need some advice from somebody experienced with iptables... I'm getting crazy =(
09:54 < pindemon> fact is that I setup a router with OpenWRT and I've configured OpenVPN on it... I'm able to connect with Android OpenVPN to from the mobile network, but I'm not able to connect to local machines
09:55 < ecrist> !iptables
09:55 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z, or (#2) please see http://openvpn.net/man#lbBD for more info, or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
09:56 -!- vpnuser [475e9251@gateway/web/freenode/ip.71.94.146.81] has joined #openvpn
09:56 < pindemon> my setup is ANDROID-OPENVPN (192.168.3.6-TUN) <-> INTERNET <-> WIFI-ADSL-ROUTER (192.168.2.1) <-> (192.168.2.3) OPENWRT-ROUTER (192.168.3.1-TUN0)
09:56 < ecrist> pindemon: you need to let the machines on the lan know about the vpn and push the correct routes
09:57 < vpnuser> I want to ask if openvpn will continue to use the http-proxy serverip port during the course of connection or just to use that option in the startup connection and will stop if the connection is established.
09:58 < pindemon> ecrist: in the server.conf I've got push "redirect-gateway def1" and push "route 192.168.2.0 255.255.255.0" set
09:59 < ecrist> vpnuser: it will always use it
09:59 < ecrist> do the lan clients know how to reach vpn clients?
10:00 < pindemon> ecrist: no
10:00 < vpnuser> i see. thank you for clarifying it to me ecrist
10:01 < ecrist> pindemon: that would be a problem.
10:01 < pindemon> I don't really need my local computer to reach the vpn
10:02 < pindemon> I explain myself with a little more detail
10:02 -!- vpnuser [475e9251@gateway/web/freenode/ip.71.94.146.81] has quit [Quit: Page closed]
10:02 < pindemon> my ISP provides voip
10:03 < pindemon> the only way to authenticate to the voip server is thru their connection (I mean, I can configure a voip client on my computer, but only authenticates if I'm connected from home)
10:04 < pindemon> so, a I want to use a voip client on my android phone so I can use my phone home number while on the road, I need to setup a vpn to connect to my home's network and the authenticate to the voip server
10:04 < pindemon> (p.s. I've tried ssh tunnel but with no success)
10:06 < uuuppz> pindemon: I can answer the high level question - u'll have to ask someone else for the detail to get it working
10:06 < ecrist> pindemon: you said VPN users can't connect to local machines
10:06 < uuuppz> You won't do that using an ssh tunnel unless they happen to be using TCP for SIP & RTP transit
10:06 < uuuppz> It will work with a correct setup of ovpn
10:07 < uuuppz> u may experience quality issues tho
10:07 < uuuppz> call quality that is
10:07 < pindemon> uuuppz: got it
10:07 < pindemon> ecrist: when connected I can ping the VPN server but not the local router
10:08 < pindemon> I've red in the documentation regarding "The last step, and one that is often forgotten, is to add a route to the server's LAN gateway"
10:08 < pindemon> ecrist: is this what you mean?
10:08 < ecrist> YES
10:09 < pindemon> ok =) this takes me back to my problem =)
10:09 < pindemon> hehe
10:09 < pindemon> as a n00b trying to setup something big I'm stuck on this routing issue....
10:10 < pindemon> so "make sure that the gateway for the LAN routes all VPN subnets to the VPN server machine."
10:11 < pindemon> this should be set on the openwrt/openvpn server or in the adsl-router?
10:11 < pindemon> (a bit lost in here)
10:12 < ecrist> you need to pass your LAN route to your vpn clients, and your LAN gateway needs a static route to the VPN
10:12 < ecrist> !route
10:12 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
10:12 < uuuppz> vpnHelper: You kinda repeating yourself :P
10:15 < pindemon> ecrist: "and your LAN gateway needs a static route to the VPN" uhmmmm
10:16 < pindemon> I can set only port forwarding on my home adsl router
10:16 < pindemon> dunno how to set a static route
10:16 < ecrist> well, then you either need an intermediary gateway, or you need to set a static route on all the lan clients that need to know about the vpn
10:17 < Olipro> pindemon: but the VPN tunnel is going into the OpenWRT box
10:17 < Olipro> can't the OpenWRT box ping the LAN machines either?
10:17 -!- MarKsaitis [~MarKsaiti@78-61-148-80.static.zebra.lt] has quit [Quit: Leaving]
10:17 < pindemon> Olipro: yes and yes
10:17 < pindemon> the vpn tunnel goes to openwrt
10:18 < pindemon> openwrt can ping local machines
10:18 < Olipro> then the ADSL modem doesn't factor into the issue
10:18 < pindemon> ping&connect and also reaches internet
10:18 < Olipro> so let's see, you want *all* traffic including internet traffic to go via the OpenWRT box?
10:20 < pindemon> yes and no...
10:20 < pindemon> I mean
10:20 < Olipro> ok, let's just deal with the LAN machines for now
10:20 < Olipro> what subnet are they on?
10:20 < pindemon> did you see the purpose of this connection I want to establish some sentences ago? =)
10:20 < pindemon> android with voip client authenticating from vpn connection using home's local lan
10:22 < pindemon> home network (adsl-router) 192.168.2.0/24
10:22 < pindemon> openwrt-box (static IP) 192.168.2.3
10:22 < pindemon> openvpn 192.168.3.0/24
10:22 < Olipro> ok
10:22 < Olipro> do you have busybox on your Android device
10:23 < pindemon> yes
10:23 < pindemon> +
10:23 < Olipro> ok, connect OpenVPN and then run "ip route" command and pastebin the contents
10:23 < pindemon> I'm in shell right now
10:25 < pindemon> http://pastebin.com/bG4VK8cA
10:26 < Olipro> mmm, you don't have any route to 192.168.2.0/24
10:26 < pindemon> ups... that's true
10:26 < pindemon> one sec...
10:26 < pindemon> I was trying changes in server.conf
10:26 < pindemon> a sec
10:28 <@vpnHelper> RSS Update - forum: Using CSF with OpenVPN - a couple of small problems :) <http://forums.openvpn.net/topic8585.html#p14430>
10:31 < pindemon> http://pastebin.com/hN9ExZaM
10:32 < Olipro> ok, you've got the route
10:32 < Olipro> now can you ping the machine
10:32 < pindemon> I can ping the openwrt/openvpn box
10:32 < pindemon> but 192.168.2.1 stays there forever
10:33 < Olipro> can you ping the OpenWRT box on both subnets or only one/
10:33 < Olipro> *?
10:33 < pindemon> only in 192.168.3.0/24
10:33 < Olipro> ok, ssh into the OpenWRT box
10:34 < Olipro> what's the name of the tunnel interface on the OpenWRT? tun0?
10:34 < datruth> i'd like to have openvpn on my android device
10:34 < pindemon> yes
10:34 < pindemon> datruth: check in the market openvpn
10:34 < Olipro> sysctl net.ipv4.conf.tun0.forwarding
10:35 < pindemon> 0
10:35 < Olipro> sysctl net.ipv4.conf.tun0.forwarding=1
10:35 < Olipro> now try to ping
10:35 < pindemon> I echo 1 on it
10:35 < Olipro> you don't set it with echo
10:35 < Olipro> set it as I showed above
10:35 < Olipro> and then double check it
10:36 < datruth> last time i did this I dont think it installed i'll try again
10:36 < pindemon> it's not this? cat /proc/sys/net/ipv4/ip_forward
10:36 < Olipro> yes, but it's better to set with sysctl
10:36 < pindemon> 1
10:36 < pindemon> ok
10:36 < pindemon> +
10:36 < Olipro> ok, now try to ping
10:36 < datruth> pindemon: do I select /system/xbin or /system/bin for the binary install?
10:37 < pindemon> datruth: one sec dude =) I fixed it manually by symlink
10:37 < pindemon> datruth: will explain later =)
10:37 < datruth> k
10:38 < pindemon> From 192.168.3.1 icmp_seq=1 Destination Port Unreachable
10:38 < Olipro> ok, sounds like only iptables is left
10:38 < Olipro> iptables -I FORWARD -j ACCEPT
10:38 < Olipro> iptables -I INPUT -i tun0 -j ACCEPT
10:40 < pindemon> done
10:40 < Olipro> do be aware of course that the FORWARD rule is purely for testing, it's not wise to leave it like that
10:40 < Olipro> ok, try to ping
10:40 < pindemon> but stuck now
10:40 < pindemon> (FORWARD => testing => taking personal note)
10:41 < pindemon> not pinging neither giving error
10:41 < Olipro> what are you trying to ping, the router itself or the lan machine?
10:41 < pindemon> pinging the adsl-router
10:41 < pindemon> 192.168.2.1
10:42 < Olipro> can you ping the OpenWRT router on its 192.168.2.x address
10:42 < pindemon> yes
10:42 < Olipro> ok, and the OpenWRT router can ping the ADSL modem?
10:42 < pindemon> yes
10:43 < Olipro> do a traceroute to the ADSL router
10:43 < Olipro> I suspect that the issue is that the ADSL router only has a route for its own subnet, and therefore cannot respond to your ping because it doesn't know where to send the reply
10:43 <@vpnHelper> RSS Update - forum: Using CSF with OpenVPN - a couple of small problems :) <http://forums.openvpn.net/topic8585.html#p14431>
10:44 < pindemon> then I could try to limit the dhcp on the router
10:44 < Olipro> no, don't do that
10:44 < pindemon> and let openvpn coexist on the same subnet...
10:44 < Olipro> if it's critical that you can access your ADSL modem from your Android device, you can use SNAT
10:44 < pindemon> by iptables -t nat -A POSTROUTING -s 192.168.2.3 -j SNAT --to SERVER.IP
10:45 < Olipro> iptables -t nat -A POSTROUTING -i tun0 -j SNAT --to-source 192.168.2.3
10:46 < Olipro> er, you should specify the destination IP too
10:46 < Olipro> iptables -t nat -A POSTROUTING -i tun0 -d 192.168.2.1 -j SNAT --to-source 192.168.2.3
10:46 < pindemon> Can't use -i with POSTROUTING
10:47 < Olipro> oh duh
10:47 < Olipro> iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -d 192.168.2.1 -j SNAT --to-source 192.168.2.3
10:47 < pindemon> that one worked =)
10:48 < pindemon> i can ping the router....
10:48 < pindemon> big step ahead
10:48 < pindemon> so.. that's was the iptables rule needed =)
10:48 < pindemon> thanks Olipro ...
10:49 < pindemon> where's the "buy me a beer" button?
10:49 < Olipro> that and enabling forwarding in the kernel
10:49 < pindemon> yup
10:49 < pindemon> now...
10:50 < pindemon> I guess that local network calls are redirected thru the tun interface on the android device...
10:50 < pindemon> 192.168.2.0/24
10:50 < Olipro> hmm?
10:51 < pindemon> errr
10:51 < pindemon> now all the connection is routed thru vpn?
10:51 < Olipro> no
10:51 < Olipro> not unless you replaced the default route
10:52 < pindemon> push "redirect-gateway def1"
10:52 < pindemon> in server.conf should do it?
10:52 < datruth> yes
10:52 < Olipro> your default route still says rmnet0 in the pastebin
10:53 < datruth> you may need push "route-gateway ip" to
10:53 < pindemon> http://pastebin.com/jUXG7cAi
10:53 < pindemon> this is my actual server.conf
10:54 < Olipro> I have no idea how well OpenVPN route pushing plays with Android
10:54 < Olipro> either way, I don't see it in your ip route info
10:55 < pindemon> for what I saw until now it doesn't change the default route
10:55 < Olipro> if you want to try it manually, define an explicit route for the internet IP you're establishing the VPN over and then replace the default route
10:55 < pindemon> yup... that's what I tried to do, and got it working
10:55 < pindemon> and with these new settings should do it correctly, I mean, reaching internet thru BPN
10:56 < pindemon> *VPN
10:57 < pindemon> datruth: where you able to install openvpn correctly? do you have a vpn server to test the app?
10:59 < datruth> yes I have a vpn server to test
10:59 < datruth> I think I have it installed
11:01 < pindemon> datruth: my advice is to use the terminal emulator on the android
11:01 < pindemon> and launch openvpn <client.conf directory)
11:01 < datruth> when trying to connect it cant find the tun dev device
11:02 < datruth> what does your client config look like
11:02 -!- voglster [~yomama@70.122.225.235] has joined #openvpn
11:02 < datruth> or do I have to install the tap device some how?
11:02 < datruth> yeah it cant locate it dynamically it says on the phone
11:03 < pindemon> I'm using tun
11:03 < ecrist> android doesn't have a tap device, afaik
11:04 < datruth> so how do I get the tun device going on it?
11:04 < EugeneKaway> Android client works fine with pushed routes
11:04 < ecrist> no clue.  ask in the adroid forums
11:04 < ecrist> :)
11:04 < EugeneKaway> Are you using the Market app or the CyanogenMod one?
11:05 -!- EugeneKaway is now known as EugeneKay
11:05 < datruth> market app
11:05 < pindemon> datruth: I'm using cyanogenmod...
11:05 < pindemon> datruth: my client.conf http://pastebin.com/8UbgDJyL
11:05  * ecrist cannot use openvpn on android for $work as we use tap
11:05 < EugeneKay> CM's app doesn't have a client.conf per se.
11:06 < EugeneKay> And there is no TAP driver for android at all.
11:07 < datruth> hrmm
11:08 < datruth> so I need a kernel that has tun tap device on it
11:08 < datruth> as mine does not ;/
11:08 < EugeneKay> No, there is not one for Android.
11:09 < EugeneKay> It doesn't exist.
11:09 < datruth> so then there is no way for openvpn to work on android then?
11:09 < EugeneKay> Also, swapping kernels on Android for $feature, if you're already on CyanogenMod, is stupid. 
11:09 < EugeneKay> There is a TUN driver, which works flawlessly.
11:09 < pindemon> datruth: I'm using it right now as we talk
11:10 < ecrist> I think tap would compile OK, but I think nobody's bothered.
11:10 < datruth> where can I get the tun driver from?
11:10 < EugeneKay> From the "installer app", also in Marktet
11:11 < EugeneKay> https://market.android.com/details?id=de.schaeuffelhut.android.openvpn.installer
11:11 <@vpnHelper> Title: OpenVPN Installer - Android Market (at market.android.com)
11:11 < EugeneKay> Hrm..... seems that doesn't include the tun driver. Interesting.
11:11 < pindemon> datruth: which ROM are you using?
11:12 < datruth> bamf
11:12 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:12 -!- mode/#openvpn [+v s7r] by ChanServ
11:13 < pindemon> datruth: can you try on you android: insmod /system/lib/modules/tun.ko
11:13 < pindemon> su before =)
11:14 -!- voglster [~yomama@70.122.225.235] has quit [Ping timeout: 255 seconds]
11:16 < pindemon> datruth: I don't know BAMF rom... but I'm reading that [ROM][4.7.2011] Das BAMF 1.4 supports tun...
11:17 < datruth> pindemon: it said it cant open tun.ko
11:17 < datruth> do you know how to rebuild the kernel?
11:18 < pindemon> datruth that's far beyond my knowledge...
11:18 < EugeneKay> That is..... challenging.
11:19 < pindemon> I would strongly suggest to install a rom that has tun in it...
11:19 < pindemon> (read -> shortcut)
11:20 < datruth> hrmm do you know of any gingerbread roms using mr2 radio that has the tun driver?
11:20 < pindemon> datruth: nope, sorry...
11:23 < datruth> damn
11:23 < datruth> oh well it was worth a shot
11:23 < datruth> I know it'll work once I have the driver
11:24 < ecrist> this isn't #android
11:24 < pindemon> I do confirm it
11:25 < pindemon> selfkick
11:25 < pindemon> again, thanks ecrist & Olipro for your help...
11:26 < ecrist> no problem.
11:27 < EugeneKay> #android won't be any help either
11:33 < datruth> thx pindemon for pointing me to the app
11:33 < pindemon> datruth: no problem
11:36 -!- pindemon [~pindemon@unaffiliated/pindemon] has quit [Quit: what's this key for?]
11:38 < datruth> ahh nice openvpn working on the android now
11:40 -!- EugeneKay is now known as EugeneKaway
11:45 < datruth> Altho I can connect now it doesn't let it become the default gateway
11:49 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Ping timeout: 255 seconds]
11:55 < uuuppz> ecrist: got time to take a look sometime in the next 30mins or so?
12:04 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14432>
12:15 -!- p3rror [~mezgani@41.140.174.236] has quit [Read error: Connection reset by peer]
12:19 < uuuppz> ecrist: Well when you do have time build 3 is uploaded at sf.net/projects/openvpnui/files/
12:19 < uuuppz> think I handled most of your requests
12:19 -!- JasonBoxLaptop [~jasonb@adsl-74-235-248-204.mco.bellsouth.net] has joined #openvpn
12:28 <@vpnHelper> RSS Update - forum: Using CSF with OpenVPN - a couple of small problems :) <http://forums.openvpn.net/topic8585.html#p14433>
12:34 -!- aten [~atum@wheel.sh] has joined #openvpn
12:34 <@vpnHelper> RSS Update - forum: Using CSF with OpenVPN - a couple of small problems :) <http://forums.openvpn.net/topic8585.html#p14437> || Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html#p14436> || VPN cannot work remotely <http://forums.openvpn.net/topic8601.html>
12:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:40 <@vpnHelper> RSS Update - forum: [solved] Using CSF with OpenVPN - a couple of small problems <http://forums.openvpn.net/topic8585.html#p14437>
12:47 <@vpnHelper> RSS Update - forum: [solved] Using CSF with OpenVPN - a couple of small problems <http://forums.openvpn.net/topic8585.html#p14438>
12:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
12:55 -!- newmember [~chatzilla@66.183.103.108] has joined #openvpn
13:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:11 <@vpnHelper> RSS Update - forum: Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html#p14439>
13:12 < hyper_ch> Using Internet with OpenVPN on Windows 7 --> start using linux :)
13:21 -!- p3rror [~mezgani@41.140.34.196] has joined #openvpn
13:39 -!- pindemon [~pindemon@unaffiliated/pindemon] has joined #openvpn
13:40 < pindemon> ecrist & Olipro Is working! I'm able to use my cellphone on the road and calling land lines for free (in spain is free)
13:40 < pindemon> thanks again for all the help
13:41 < pindemon> Olipro: I had to delete the default route and add the new one by hand... need to fix it... or route just the two ip addresses needed to authenticate with the voip provider
13:41 -!- Jedicus [~user@76.214.202.129] has quit [Read error: Connection reset by peer]
13:41 -!- Jedicus [~user@adsl-76-214-198-15.dsl.emhril.sbcglobal.net] has joined #openvpn
13:42 < datruth> pindemon: I can connect to openvpn now but I can't get the default gateway to take place
13:42 -!- patelx [~a@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has quit [Quit: ircN 8.00 for mIRC (20080809) - www.ircN.org]
13:42 < pindemon> datruth: ip route del default via xx.xx.xx.xx dev rmnet0
13:43 < pindemon> ip route add default via <corresponding tun0 ip address on openvpn server> dev tun0
13:44 < datruth> in the first command the ip is the isp gw ip?
13:45 < pindemon> isp gw ip on device (android) yes - but again (don't want to be rude here) - this is not really the place to talk about android and I've gotta go =) sorry
13:46 < datruth> oh okay well thx
13:47 < pindemon> bye!
13:47 -!- pindemon [~pindemon@unaffiliated/pindemon] has quit [Quit: what's this key for?]
14:05 -!- EugeneKaway is now known as EugeneKar
14:05 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
14:09 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-45.html#p14440>
14:10 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
14:15 <@vpnHelper> RSS Update - forum: Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html#p14441>
14:25 -!- EugeneKar is now known as EugeneKaway
14:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:48 -!- p3rror [~mezgani@41.140.34.196] has quit [Ping timeout: 255 seconds]
15:33 -!- K1ng [~KING@180.211.188.26] has quit [Ping timeout: 258 seconds]
15:36 -!- Squidy_at_Home [~quassel@189.11.216.33] has joined #openvpn
15:37 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:37 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:47 -!- corretico [~luis@201.201.44.82] has joined #openvpn
15:48 -!- JasonBoxLaptop [~jasonb@adsl-74-235-248-204.mco.bellsouth.net] has quit [Ping timeout: 250 seconds]
15:51 -!- me345 [~me345@adsl-75-15-182-222.dsl.bkfd14.sbcglobal.net] has joined #openvpn
15:52 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
16:18 -!- Guifort [~Administr@247.131.192.77.rev.sfr.net] has joined #openvpn
16:21 <@vpnHelper> RSS Update - forum: high quality stunt <http://forums.openvpn.net/topic8600.html#p14443> || Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14442>
16:29 -!- cherwin [~cherwin@blackmamba.xs4all.nl] has quit [Ping timeout: 240 seconds]
16:31 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
16:31 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
16:34 -!- JasonBoxLaptop [~jasonb@fl-76-4-154-170.dhcp.embarqhsd.net] has joined #openvpn
16:35 -!- madsage [~K6CRPSMc@173-16-44-37.client.mchsi.com] has joined #openvpn
16:35 < madsage> its my firewall?
16:35 < Bushmills> most likely
16:37 -!- alhubaishi [~alhubaish@94.59.16.70] has joined #openvpn
16:37 < alhubaishi> hi all
16:37 < alhubaishi> im not a pro wiht linux , is their a .deb install file for openVPN please?
16:37 < madsage> i have mine working with 3 vlans except gettin an error pushing dns
16:37 < Bushmills> alhubaishi: aptitude install openvpn
16:38 < Bushmills> madsage:  "an error" sounds like there's something wrong
16:38 < alhubaishi> im on ubuntu , i tried apt-get install openvpn
16:39 < alhubaishi> it says openvpn is already the newest version
16:39 < Bushmills> alhubaishi: you may want to try again in a few months
16:39 < alhubaishi> hmm
16:39 < alhubaishi> i installed it in terminal the hardway with the tutorial
16:39 < alhubaishi> so its installed but i cant seem to find it in the application directory
16:40 < alhubaishi> is gadin-openvpn the same as openVPN?
16:40 < Bushmills> what is the "application directory", and why would you want to find it?
16:40 < madsage> options error: dhcp-option parameter DNS '192.168.70.3;' must be an IP address
16:40 < alhubaishi> i want to start an VPN server so people can use my internet connection to get routed to another server for gaming 
16:40 < madsage> i'll check my syntax, or maybe it wants 3 digit octet?
16:41 < alhubaishi> forexample some people use hotspotsheild to bypass the proxy from their isp
16:41 < Bushmills> madsage: looks like there's a stray "DNS" in your config
16:41 < Bushmills> or a trailing ;  behind ip address
16:42 < alhubaishi> is OpenVPN a graphical user interface ?
16:42 < Bushmills> !openvpn
16:42 < alhubaishi> im on linux ( wanting to host a VPN server )
16:42 < alhubaishi> im good with IT so il be quick with this please help me out
16:42 < Bushmills> openvpn is not a GUI. it is a program to establish a secure connection between two interfaces
16:43 < alhubaishi> i know what VPN is bro lol
16:43 < alhubaishi> but i dont want it secured im planning to make it unsecure
16:43 < alhubaishi> i just want them to use my internet thats all
16:43 < Bushmills> then don't ask whether it is a GUI
16:43 < Bushmills> it isn't
16:43 < alhubaishi> let me give u an instance of what im trying to do
16:43 < alhubaishi> if u know the game Quake
16:43 < alhubaishi> theirs a server in india which pings 50ms to my house
16:44 < alhubaishi> but my friend from Dubai City pings 130ms to india quake server
16:44 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 252 seconds]
16:44 < alhubaishi> however abu dhabi pings india quake server 50ms
16:44 < alhubaishi> and Dubai pings Abu Dhabi 5ms
16:44 < alhubaishi> so i want my friend to connect through me to join the quake server and so he gets 55ms instead of the 130ms
16:45 < alhubaishi> im not into virtual network files exchange and stuff i just want him to use my internet
16:45 < |Mike|> Morning y'all
16:45 < alhubaishi> that my internet parcels packets and everything to him its like hes routed to me and i do the work around routes for him automatically
16:45 -!- cherwin [~cherwin@2001:980:4bfc:1::1] has joined #openvpn
16:45 < alhubaishi> dont make this complicated i made it clear 
16:46 < |Mike|> <3 cron-apt
16:46 < alhubaishi> i know u guys dont work with VPN that way and u use it for more sophisticated stuff , but think of this as a critical thinking task for how u can make this happen =)
16:46 < alhubaishi> help me and GOD bless you =)
16:46 < |Mike|> don't? ok, now go wash your mouth with soap.
16:46 < madsage> i smell troll
16:46 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Now with extra fish!]
16:46 < madsage> hah
16:47 < alhubaishi> im ready to donate gratitude right now any admins willing to witness my donation at this instant to the site?
16:47 < Bushmills> alhubaishi: that's possible
16:47 < Bushmills> !howto
16:47 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:47 < alhubaishi> ok link me the donation site
16:47 < alhubaishi> yai read it
16:47 < alhubaishi> but the sophistication is not what im doing 
16:47 < alhubaishi> im asking for an easier task 
16:48 < Bushmills> setup is about the same
16:48 < alhubaishi> a VPN client to use my VPN server internet thats all
16:48 < Bushmills> what you use it for is not determined by openvpn 
16:48 < alhubaishi> no files no stuff to be shown , something simple and narrow
16:48 < alhubaishi> but it does the job?
16:48 < madsage> thre is a plugin for webmin you can point and click on
16:48 < Bushmills> openvpn gives connection. not services
16:48 < |Mike|> UI's suck imho.
16:48 < alhubaishi> u mean it gives the connect :D
16:48 < alhubaishi> im into the GUI stuff bro
16:49 < alhubaishi> im not matrix mind
16:49 < alhubaishi> i have enough matrix whispers in my trials
16:49 < |Mike|> ... 
16:49 < |Mike|> !tell alhubaishi howto
16:49 < alhubaishi> so no server? GUI :(
16:49 < |Mike|> only windows client is GUI as far as I know
16:50 -!- cherwin [~cherwin@2001:980:4bfc:1::1] has quit [Ping timeout: 255 seconds]
16:50 < |Mike|> but the config is written in WORD!
16:50 < alhubaishi> can u please tell me this \ gadmin - openvpn ( does that app do the same work ? )?
16:50 < alhubaishi> u mean theirs a windows server GUI for open VPN ? lol
16:50 < Bushmills> alhubaishi: do you need a GUI to connect a network cable?
16:50 < alhubaishi> i just restarted to load ubuntu
16:50 < alhubaishi> network cable cliping cat4 crosscables i do that since 1998
16:51 < alhubaishi> i started linux from Feisty fawn sorry  :(
16:52 < datruth> anyone have problems forcing a gateway to a phone?
16:52 < alhubaishi> i know u guys have the power brain of linux to work with scripts and writing stuff , but tbh , we dont want to debate on how can linux reach the stars
16:52 < alhubaishi> ok ok =) gg all
16:52 < alhubaishi> all the best
16:52 < alhubaishi> donations will be sent from my windows restart if this happens with ease
16:52 -!- alhubaishi [~alhubaish@94.59.16.70] has quit [Quit: Leaving]
16:53 < |Mike|> tool.
16:54 < Bushmills> datruth: sort of.
16:54 -!- p3rror [~mezgani@41.140.156.140] has joined #openvpn
16:55 < datruth> I've can my phone connecting to openvpn but it refuses to have the vpn as the gateway
16:55 < datruth> can/got
16:56 < Bushmills> my netbook won't use the server, which pushs redirect-gateway, when on an UMTS link.  same machine over WLAN or ethernet will, with same server
16:56 < Bushmills> i've out three route statements into a script which i then execute
16:56 < Bushmills> put
16:57 < datruth> did you use push route or iroute for a ccd configuration?
16:58 < Bushmills> host route to server through ppp, twice net route lower and upper half of ipv4 address range with gateway openvpn server, doing the same as def1 
16:59 < Bushmills> that cert is with CN for which a ccd entry exists
16:59 < Bushmills> but i do neither.  servder pushed redirect-gateway, which has no effect when and only when i connect through umts
17:00 < datruth> the same configuration works for my pc clients they can use the vpn as a gateway but not the mobile devices
17:05 < Bushmills> what's the reason? have you checked client's routing table?
17:07 < datruth> yes the reason is the isp's gw is the only one being set
17:07 < datruth> on the mobile devices that is
17:07 < Bushmills> try to set routes manually
17:08 < datruth> so what ip route del default via <isp default gw> dev rmnet0 and add the internet ip gateway of the vpn server of the rmnet0 device?
17:09 < Bushmills> no need.  to del any route.
17:10 < Bushmills> first you need a host route to vpn server through your ppp interface
17:10 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
17:11 < datruth> can you give me an example?
17:11 < Bushmills> then you add two net routes  0.0.0.0/1  and 128.0.0.0/, using server address as gw.
17:12 < Bushmills> route add 20.30.40.50 ppp0   if public address of vpn server is 20.30.40.50
17:12 < Bushmills> route add -net 0.0.0.0/1 gw 10.8.0.1    if openvpn server address is 10.8.0.1
17:12 < datruth> i dont have a ppp0 device would I use my tun device?
17:12 < Bushmills> route add -net 128.0.0.0/1 gw 10.8.0.1
17:13 < Bushmills> no.
17:13 < Bushmills> you use the interface your phone talks to the provider with
17:13 < datruth> ahh okay so that would be rmnet0
17:16 < datruth> ip route add via <vpn public ip> dev rmnet0 doesn't see to have any effect
17:16 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
17:16 < datruth> I get a no proccess error
17:19 < Bushmills> seems there's even no route to tun0 for openvpn subnet
17:19 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
17:20 < Bushmills> so route doesn't know how to reach openvpn server, when telling it to be the gateway
17:20 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 260 seconds]
17:21 < Bushmills> route add -net 10.8.0.0 netmask 255.255.255.0 tun0  might fix that
17:21 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 252 seconds]
17:22 < Bushmills> that route is what my client still adds when connecting through umts
17:22 < Bushmills> hat one is pushed as well
17:22 < Bushmills> that
17:24 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
17:29 < datruth> hrmm
17:30 -!- Squidy_at_Home [~quassel@189.11.216.33] has quit [Ping timeout: 250 seconds]
17:34 < datruth> Bushmills: here is my routing table of my phone perhaps I have it wrong http://pastebin.com/5Z71Rdmr
17:37 < Bushmills> 67.220.80.226  is your openvpn server?
17:37 < datruth> yes
17:37 < Bushmills> looks ok on first glimpse
17:38 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
17:38 < datruth> do I have it wrong?
17:38 < Bushmills> 10.8.13.0       0.0.0.0         255.255.255.0   U     0      0        0 tun0   this one is duplicated, but that shouldn't hurt
17:39 < Bushmills> try  traceroute 8.8.8.8  or  mtr 8.8.8.8   
17:40 < datruth> nope cant get ot it
17:40 < datruth> ot/to
17:40 < datruth> ig waut
17:40 < Bushmills> goes where to, until where?
17:40 < datruth> damn keyboard now im getting something
17:40 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
17:41 < datruth> goes to 209.85.248.106 then 8.8.8.8 is the last hop
17:42 < Bushmills> first and second hop?
17:42 < Bushmills> 10.168.23.128  or  10.8.13.1?
17:42 < datruth> 1st is nothing 2nd is 69.83.71.57
17:43 < Bushmills> makes no sense
17:43 < datruth> ;/
17:43 < Bushmills> Verizon Wireless?
17:44 < datruth> yes
17:44 < datruth> the phone is on vzw
17:45 < Bushmills> that's not consistent with the route i'd have expected from the route table
17:46 < datruth> maybe the issue is 0.0.0.0         10.168.23.129   0.0.0.0         UG    0      0        0 rmnet_sdio0?
17:49 < Bushmills> shouldn't  .. the 0.0.0.0/1 and 128.0.0.0/1 have precedence
17:52 < datruth> yes
17:53 < Bushmills> you can reach openvpn server on its openvpn address?
17:57 < Bushmills> try to   route add 10.8.13.1 tun0
18:09 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: quit]
18:18 < datruth> imma have to take a break out that one im not getting anywhere
18:22 -!- uuuppz [~uuuppz@89.204.252.140] has joined #openvpn
18:22 < uuuppz> hey
18:23 < ecrist> hi uuuppz 
18:23 < uuuppz> did u take a look?
18:23 < uuuppz> no coding will be done in the nxst 24hrs
18:23 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
18:23 < uuuppz> I just got stoln by 4 women
18:24 < uuuppz> :P
18:24 < uuuppz> but still intigured to heare you comments
18:25 < ecrist> nope, haven't looked.  the wife and I have a date with another couple. ;)
18:26 < uuuppz> heh ok
18:26 < uuuppz> I think you'll like
18:26 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
18:26 < uuuppz> I even added a lock image for your login screen
18:27 < uuuppz> :)
18:27 < ecrist> I promise I'll look at it in the moring.  Much debauchery to be had this evening.
18:27 < uuuppz> think so for both of us
18:27 < uuuppz> tlk later
18:29 -!- Nowak_ [nowak@warsaw.freeearthfoundation.com] has quit [Ping timeout: 246 seconds]
18:33 -!- uuuppz [~uuuppz@89.204.252.140] has quit []
18:42 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
18:43 -!- JasonBoxLaptop [~jasonb@fl-76-4-154-170.dhcp.embarqhsd.net] has quit [Ping timeout: 264 seconds]
19:02 <@vpnHelper> RSS Update - forum: Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html#p14444>
19:10 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
19:11 -!- OmnipotentEntity [~omnipoten@74-128-169-47.dhcp.insightbb.com] has joined #openvpn
19:13 < OmnipotentEntity> hi, I have a dumb question that I'm pretty sure isn't my firewall.  I used the openvpn built into tomato, and I managed to get connected, but I'm in a different subnet.  How can I communicate between 10.0.8.0/24 and 192.168.1.0/24?
19:13 < datruth> !iroute
19:13 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
19:13 < datruth> !route
19:13 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
19:13 < datruth> !client-to-client
19:13 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
19:13 <@vpnHelper> clients
19:14 < OmnipotentEntity> thanks :)
19:14 < datruth> check those three out
19:14 < datruth> yup
19:14 < datruth> !ccd
19:14 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
19:14 < datruth> and that to
19:29 -!- Denial [~Denial@drgi.co.uk] has quit []
19:31 -!- me345 [~me345@adsl-75-15-182-222.dsl.bkfd14.sbcglobal.net] has quit [Remote host closed the connection]
19:37 -!- OmnipotentEntity [~omnipoten@74-128-169-47.dhcp.insightbb.com] has quit [Ping timeout: 276 seconds]
19:37 -!- Guifort_1 [~Administr@96.249.100.84.rev.sfr.net] has joined #openvpn
19:39 -!- OmnipotentEntity [~omnipoten@74-128-169-47.dhcp.insightbb.com] has joined #openvpn
19:40 -!- Guifort [~Administr@247.131.192.77.rev.sfr.net] has quit [Ping timeout: 252 seconds]
19:56 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:04 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
20:16 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
20:16 -!- madsage is now known as chickench0ker
20:18 -!- master_of_master [~master_of@p57B5265E.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:19 -!- master_of_master [~master_of@p57B540F0.dip.t-dialin.net] has joined #openvpn
20:27 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
20:30 -!- chickench0ker is now known as madsage
20:32 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:41 < flarets> Hi all
20:41 -!- jberiksen [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
20:44 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
20:44 < flarets> I've got openvpn running on two linux machines and managed to connect them, but neither respond to ping
20:44 < jberiksen> I have a OpenVPN server on a Debian Squeeze platform. I can ping the VPN server from the client and the client from the server. But I can't ping the servers local ip or other local machines from the vpn client. Anyone hwo want to help me?
20:47 < OmnipotentEntity> hey jberiksen, I have the same problem I was told to read the following:
20:47 < OmnipotentEntity> !iroute
20:47 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
20:47 < OmnipotentEntity> !route
20:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
20:47 < OmnipotentEntity> !client-to-client
20:47 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind
20:47 <@vpnHelper> other clients
20:47 < OmnipotentEntity> !ccd
20:47 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
20:48 < OmnipotentEntity> though, I haven't yet been able to make heads or tails out of it.
20:49 -!- Guifort_2 [~Administr@200.37.67.86.rev.sfr.net] has joined #openvpn
20:49 < flarets> hmm I fixed it, turns out I didn't give the client an IP address :/
20:50 < flarets> anyone have access to this page to add it as a solution?
20:50 < flarets> http://openvpn.net/index.php/open-source/faq/77-server/285-everything-seems-to-be-configured-correctly-but-i-cant-ping-across-the-tunnel.html
20:50 <@vpnHelper> Title: Everything seems to be configured correctly, but I can't ping across the tunnel. (at openvpn.net)
20:51 < flarets> solution was just to add  "client 10.8.0.1 255.255.255.0" to the client config
20:51 -!- flarets [~blur@110-175-82-48.tpgi.com.au] has quit [Quit: Leaving]
20:51 -!- Guifort_1 [~Administr@96.249.100.84.rev.sfr.net] has quit [Ping timeout: 252 seconds]
20:52 -!- madsage [~K6CRPSMc@173-16-44-37.client.mchsi.com] has left #openvpn ["#centos (T)"]
20:56 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
20:57 -!- madsage [~K6CRPSMc@173-16-44-37.client.mchsi.com] has joined #openvpn
20:58 < madsage> hello
21:01 < OmnipotentEntity> hi there madsage
21:02 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 255 seconds]
21:13 < madsage> so i'm checking out v6 and the install is a bit differnt.  i want server with gui like v5 had as default option, because vmwaretools expects it or doesnt install now. should i just pick server and all X? or minumum desktop and add services.  
21:13 < madsage> err pick server and ADD X?
21:15 < madsage> i dont know why they took server with gui out. but made my life easier without now having to roll my own package list
21:16 < madsage> it was a perfect template
21:20 -!- p3rror [~mezgani@41.140.156.140] has quit [Ping timeout: 255 seconds]
21:21 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
21:32 -!- jber [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
21:32 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-45.html#p14445>
21:33 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
21:34 -!- jberiksen [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit [Ping timeout: 240 seconds]
21:37 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
21:37 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
21:37 <@vpnHelper> RSS Update - forum: Public IP? <http://forums.openvpn.net/topic8596.html#p14446>
21:39 < amero> why some people always default their route-method setting to exe
21:39 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Client Quit]
21:40 -!- Guest92560 [martin@shell.ipv6.octocore.net] has left #openvpn []
21:41 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
21:48 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
21:50 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Read error: Connection reset by peer]
21:50 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Client Quit]
21:51 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
21:52 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
21:56 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:56 -!- jberiksen [~jesper@77.215.137.26] has joined #openvpn
21:56 -!- jberiksen [~jesper@77.215.137.26] has quit [Client Quit]
21:58 -!- jber [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit [Ping timeout: 260 seconds]
22:17 < datruth> amero: not sure is it bad?
22:21 -!- UnterPerro [~UnterPerr@32.133.78.21] has joined #openvpn
22:23 < amero> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
22:24 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p14420>
22:24 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
22:26 < amero> Written by krzee @ ##OpenVPN @ freenode IRC
22:26 < amero> oh
22:27 -!- Jedicus [~user@adsl-76-214-198-15.dsl.emhril.sbcglobal.net] has quit [Ping timeout: 258 seconds]
22:46 -!- EugeneKaway is now known as EugeneKar
22:48 -!- Jedicus [~user@adsl-76-214-198-15.dsl.emhril.sbcglobal.net] has joined #openvpn
22:56 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
23:02 < madsage> what
23:03 -!- EugeneKar is now known as EugeneKaway
23:03 < madsage> como wtf
23:03 < madsage> just kidding
23:05 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
23:06 < madsage> i guess i'll just add xorg to server. gnome top looks nice in all my vic consoles
23:07 < madsage> otherwsie i would just run slackware
23:08 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 255 seconds]
23:11 < madsage> postgreSQL is defual now too. interesting,
23:11 <@vpnHelper> RSS Update - forum: Norton 360 firewall problem for client/server config <http://forums.openvpn.net/topic8602.html>
23:12 < madsage> guess we need to call it  LAPP
23:17 <@vpnHelper> RSS Update - forum: Norton 360 firewall problem (nevermind... solved) <http://forums.openvpn.net/topic8602.html>
23:39 < madsage> looks cool i like the dark blue
23:55 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
23:59 < datruth> I'm able to connect my vpn on my phone but for some reason unable to use it as a default gateway here is my info http://pastebin.com/iy74JjHM does anyone see anything wrong with that?
--- Day changed Sun Aug 07 2011
00:04 -!- UnterPerro [~UnterPerr@32.133.78.21] has quit [Quit: UnterPerro lives to save another day]
00:06 < datruth> cd 3
00:06 < datruth> epps
00:28 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
00:29 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 258 seconds]
00:39 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
00:42 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 276 seconds]
00:59 <@vpnHelper> RSS Update - forum: Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html#p14448>
01:05 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594.html#p14449>
01:51 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
01:51 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
01:51 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:53 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594-15.html#p14450>
02:04 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 252 seconds]
02:08 -!- Ragnar [~heimdall@darkstar.acool.net] has joined #openvpn
02:11 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594-15.html#p14451>
02:15 -!- corretico_ [~luis@201.201.44.82] has quit [Remote host closed the connection]
02:20 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
02:23 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
02:50 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 240 seconds]
02:53 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
02:55 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 255 seconds]
03:05 <@vpnHelper> RSS Update - forum: Amazon EC2 OpenVPN Bridged Mode No Ping.... <http://forums.openvpn.net/topic8594-15.html#p14452>
03:12 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
03:22 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
03:23 -!- Guifort_2 [~Administr@200.37.67.86.rev.sfr.net] has quit [Quit: Quitte]
03:24 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 246 seconds]
03:39 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
03:46 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
04:04 -!- yell0 [~yello@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
04:05 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
04:05 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
04:07 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
04:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
04:21 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
04:23 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
04:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:35 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:56 < Mowee> Morning
05:00 <@vpnHelper> RSS Update - forum: How to add new config? <http://forums.openvpn.net/topic8590.html#p14453>
05:04 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
05:06 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14454>
05:07 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
05:09 < fluter> Mowee, Morning
05:42 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
05:52 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:52 -!- mode/#openvpn [+v s7r] by ChanServ
06:34 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
06:36 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
06:49 -!- uuuppz [~uuuppz@109.169.49.83] has joined #openvpn
06:52 -!- ArtVandalae [~SuperUnkn@125.209.136.97] has joined #openvpn
06:52 < ArtVandalae> Hi all... I just setup my first VPN server using OpenVPN. It's a very cool product, so kudos to the community. 
06:54 < Bushmills> !donations
06:54 < Bushmills> no factoid for that
06:55 < Bushmills> !factoids search donation
06:55 <@vpnHelper> No keys matched that query.
06:55 < ArtVandalae> I'm just curious about the different methods of authentication, in particular. User auth vs. SSL/TLS+User auth. I assume if you only use User auth, that the VPN is still encrypted (i.e. it's not just a tunnel, like L2TP)? The SSL is only used to "sign" the request. i.e. The user is who the user say he/she is. Is that correct?
06:56 < Bushmills> yes. once authenticated, method of exchanging traffic will remain the same
06:56 < ArtVandalae> Bushmills, if you don't use SSL/TLS+User auth. Are the user credentials sent in clear text, or are they encrypted?
06:57 < ArtVandalae> gah, my punctuation is all over the place!
06:58 < Bushmills> you will have to use ssl. i figure that any auth will be encrypted, but don't hold me liable if that's contrary to my conviction not the case
06:58 < ArtVandalae> haha, no, dw I userstand
07:00 <+s7r> ArtVandalae the credentials are not sent in clear text
07:00 -!- uuuppz [~uuuppz@109.169.49.83] has quit [Ping timeout: 240 seconds]
07:01 <+s7r> the same L2TP if you use it with IPsec :)
07:01 <+s7r> only PPTP sends in clear text
07:01 <+s7r> but i'd stick with OpenVPN no matter what I want to do and what OS I use
07:01 <+s7r> beats all other VPN types at security, speed and reliability
07:01 <+s7r> plus there is iphone and android openvpn clients :)
07:02 < ArtVandalae> s7r, agreed. It was the only VPN that "just worked". Which is a shame because I need phones (Android and iPhone) to be able to VPN into the network
07:02 < ArtVandalae> s7r, oh, really? Without jailbreaking/rooting?
07:02 <+s7r> http://www.guizmovpn.com/
07:02 <@vpnHelper> Title: GuizmOVPN - OpenVPN GUI for iPhone/iPad (at www.guizmovpn.com)
07:03 < ArtVandalae> Needs a jailbroken phone, unfortunately :)
07:04 <+s7r> what is jailbroken phone
07:04 <+s7r> and why can't you have one of those ? :)
07:05 < ArtVandalae> s7r, iPhone is locked down with DRM when you buy it. You can't install anything that isn't approved by Apple. You can "jailbreak" (hack) the iPhone to get rid of the DRM (and you can therefore run any program, and not just programs approved by Apple).
07:05 < ArtVandalae> I can't jailbreak the phone because they're not my phones :) I wouldn
07:05 < ArtVandalae> 't buy Apple products. They're too damn evil
07:05 <+s7r> ah I understand
07:06 <+s7r> if you ask me.. apple will soon provide openvpn support in iOS
07:06 < ArtVandalae> I hope so
07:06 <+s7r> it's too videly used OpenVPN and they need to do it
07:06 <+s7r> but .. you can use a jailbreak until then 
07:06 <+s7r> yeah I don't use iphone also
07:06 <+s7r> i stick with symbian for nokia business class
07:07 <+s7r> it's all i need for a PHONE. a PHONE is a phone not a computer :)
07:07 <+s7r> i don't need no facebook apps :))
07:08 < ArtVandalae> I need some apps ;) To keep my busy on the train
07:09 <+s7r> travel much huh
07:09 <+s7r> Bushmills what is the GUI version in http://swupdate.openvpn.org/community/releases/openvpn-2.2.1-install.exe
07:10  * Bushmills googles that funny term "GUI"
07:11 < Bushmills> HTC has announced to open their android phones
07:13 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 258 seconds]
07:14 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
07:15  * s7r is away
07:17 < hyper_ch> gui... that sounds like something you put on your bread
07:17 < hyper_ch> like marmelade or butter
07:19 -!- yell0 [yello@unaffiliated/contempt] has quit [Remote host closed the connection]
07:20 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
07:26 -!- ArtVandalae [~SuperUnkn@125.209.136.97] has quit [Ping timeout: 255 seconds]
07:26 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
07:28 <@vpnHelper> RSS Update - forum: How to add new config? <http://forums.openvpn.net/topic8590.html#p14455>
07:39 -!- ArtVandalae [~SuperUnkn@ppp59-167-188-168.static.internode.on.net] has joined #openvpn
07:40 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14456>
07:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:50 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
07:52 <@vpnHelper> RSS Update - forum: Free providers? <http://forums.openvpn.net/topic8391.html#p14457>
08:00 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
08:02 -!- pindemon [~pindemon@unaffiliated/pindemon] has joined #openvpn
08:03 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 264 seconds]
08:03 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
08:03 -!- CrazyGir [~jason@unaffiliated/crazygir] has quit [Ping timeout: 258 seconds]
08:05 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
08:08 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
08:09 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
08:20 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html>
08:23 -!- johan1 [piko@ip-128.net-82-216-230.roubaix.rev.numericable.fr] has joined #openvpn
08:29 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
08:31 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
08:31 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
08:33 -!- pindemon [~pindemon@unaffiliated/pindemon] has quit [Quit: pindemon]
08:34 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
08:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
08:42 -!- ArtVandalae [~SuperUnkn@ppp59-167-188-168.static.internode.on.net] has quit [Ping timeout: 250 seconds]
08:43 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:54 -!- ArtVandalae [~SuperUnkn@125.209.136.97] has joined #openvpn
08:54 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14459>
09:01 -!- stephenh [~stephenh@unaffiliated/stephenh] has quit [Ping timeout: 252 seconds]
09:06 -!- yell0 [~yello@unaffiliated/contempt] has quit [Remote host closed the connection]
09:08 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
09:13 <@vpnHelper> RSS Update - forum: OpenVPN Setup on Linux help? <http://forums.openvpn.net/topic8604.html>
09:13 -!- stephenh [~stephenh@durbanpoizon.za.net] has joined #openvpn
09:14 -!- yell0 [~yello@unaffiliated/contempt] has quit [Quit: leaving]
09:15 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
09:15 < deever> hi
09:15 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
09:16 < deever> can you recommend an openvpn port for android?
09:18 -!- pindemon [~pindemon@89.131.4.90] has joined #openvpn
09:18 -!- pindemon [~pindemon@89.131.4.90] has quit [Changing host]
09:18 -!- pindemon [~pindemon@unaffiliated/pindemon] has joined #openvpn
09:31 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14461>
09:35 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:36 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
09:36 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
09:41 -!- buntfalke_ is now known as buntfalke
09:41 -!- stephenh [~stephenh@durbanpoizon.za.net] has quit [Changing host]
09:41 -!- stephenh [~stephenh@unaffiliated/stephenh] has joined #openvpn
09:50 -!- Squidy_at_Home [~quassel@200-101-37-161.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
10:03 -!- Squidy_at_Home [~quassel@200-101-37-161.cbace702.dsl.brasiltelecom.net.br] has quit [Remote host closed the connection]
10:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:05 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14464> || OpenVPN Setup on Linux help? <http://forums.openvpn.net/topic8604.html#p14463>
10:12 -!- newmember [~chatzilla@66.183.103.108] has quit [Ping timeout: 246 seconds]
10:21 -!- K1ng`` [~KING@204.45.132.3] has joined #openvpn
10:24 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
10:27 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
10:31 -!- K1ng`` [~KING@204.45.132.3] has quit [Ping timeout: 258 seconds]
10:32 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:39 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
10:41 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14465>
10:41 -!- uuuppz [~uuuppz@89.204.239.208] has joined #openvpn
10:42 -!- upz [~uuuppz@213.191.248.67] has joined #openvpn
10:42 < upz> heu
10:42 < upz> hey
10:46 -!- uuuppz [~uuuppz@89.204.239.208] has quit [Ping timeout: 252 seconds]
10:46 -!- kyrix [~ashley@91-115-162-77.adsl.highway.telekom.at] has joined #openvpn
10:47 <@vpnHelper> RSS Update - forum: OpenVPN Setup on Linux help? <http://forums.openvpn.net/topic8604.html#p14466>
10:48 -!- kyrix [~ashley@91-115-162-77.adsl.highway.telekom.at] has quit [Read error: Connection reset by peer]
10:50 -!- upz is now known as uuuppz
10:52 -!- ArtVandalae [~SuperUnkn@125.209.136.97] has quit [Ping timeout: 250 seconds]
10:53 -!- uuuppz [~uuuppz@213.191.248.67] has quit []
10:53 -!- uuuppz [~uuuppz@109.169.49.83] has joined #openvpn
10:59 <@vpnHelper> RSS Update - forum: OpenVPN Setup on Linux help? <http://forums.openvpn.net/topic8604.html#p14467>
10:59 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
11:00 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 260 seconds]
11:02 -!- upz [~uuuppz@109.169.49.83] has joined #openvpn
11:05 -!- kyrix [~ashley@91-115-162-77.adsl.highway.telekom.at] has joined #openvpn
11:06 -!- kyrix [~ashley@91-115-162-77.adsl.highway.telekom.at] has quit [Read error: Connection reset by peer]
11:07 -!- uuuppz [~uuuppz@109.169.49.83] has quit [Ping timeout: 258 seconds]
11:14 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
11:16 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
11:20 -!- kyrix [~ashley@91-115-162-77.adsl.highway.telekom.at] has joined #openvpn
11:20 -!- kyrix [~ashley@91-115-162-77.adsl.highway.telekom.at] has quit [Read error: Connection reset by peer]
11:23 <@vpnHelper> RSS Update - forum: OpenVPN Setup on Linux help? <http://forums.openvpn.net/topic8604.html#p14468>
11:35 <@vpnHelper> RSS Update - forum: Trouble with Xp <http://forums.openvpn.net/topic8589.html#p14469>
11:45 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
11:46 < amero> !search app
11:46 <@vpnHelper> There were no matching configuration variables.
11:46 < amero> !search routed
11:46 <@vpnHelper> There were no matching configuration variables.
11:46 < amero> !search route
11:46 <@vpnHelper> There were no matching configuration variables.
11:46 < amero> !factoids search route
11:46 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
11:47 < amero> !splitroute
11:47 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet, or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
11:47 < amero> !routebyapp
11:47 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
11:48 < amero> !sockd
11:48 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
11:48 < amero> !route_outside_openvpn
11:48 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
11:52 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
11:56 -!- yell0 [yello@unaffiliated/contempt] has quit [Read error: Connection reset by peer]
11:56 -!- yell0_ [~yello@178.162.154.183] has joined #openvpn
11:59 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
11:59 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p14470>
12:06 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
12:06 -!- amir is now known as kathrin
12:06 -!- kathrin is now known as amir
12:15 -!- newmember [~chatzilla@204.239.250.1] has joined #openvpn
12:20 <+s7r> what does openvpn use for key exchange diffie hellman or RSA ?
12:20 <+s7r> by default
12:22 < Olipro> yes, it expects RSA keys and dh parameters
12:22 < Olipro> you provide a ca, a server cert signed by the ca, the corresponding server cert private key and dh parameters
12:23 < Olipro> the client end requires the ca cert and client cert + private key
12:23 <+s7r> yes I know
12:23 <+s7r> but how are the keys exchanged
12:23 <+s7r> between client and server
12:24 -!- newmember [~chatzilla@204.239.250.1] has quit [Ping timeout: 252 seconds]
12:24 < Olipro> diffie hellman
12:25 < Olipro> session keys are periodically renegotiated
12:25 < Olipro> I believe there's an option that allows you to set the renegotiation interval
12:25 <+s7r> you mean the keys used for encryption / decryption change during the same session ?
12:26 < Olipro> yes
12:27 <+s7r> so if I want I can use a CA signed by third party e.g Thawte ?
12:28 < Olipro> sure, if you can get Thawte to issue you a certificate with the CA bit set
12:29 <+s7r> would this be more secure ?
12:29 <+s7r> getting the CA signed by thir party?
12:29 < Olipro> nobody is going to give you a CA certificate
12:30 < Olipro> so don't bother concerning yourself with the possibility
12:30 <+s7r> i assume I can create my CA cert and have them sign it
12:30 < Olipro> no
12:31 < Olipro> because that would make you a Sub-CA of Thawte
12:31 <+s7r> k
12:31 <+s7r> thanks:)
12:31 < Olipro> you might be able to get OpenVPN to accept a regular cert as a CA
12:32 < Olipro> I've never tried it
12:32 < Olipro> wouldn't really advise it myself, better to create your own CA
12:32 < Olipro> or use Thawte as your CA and have them sign all your client and server certificates
12:33 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
12:35 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has joined #openvpn
12:36 < adubz> i have a buffalo router i want to put my vpn connection on it through the client settings
12:46 < Bushmills> adubz: many buffalo routers support openwrt which runs openvpn nicely
12:46 < adubz> oh hey bushmills your who i talked to before in here
12:47 < adubz> i got the router you recommended actually i saved the notation
12:47 < Bushmills> ah, that would be the 32 MiB flash model.  
12:47 < Bushmills> plenty of space for openvpn in that one
12:47 < adubz> Router Model WZR-HP-G300NH 
12:48 < adubz> ya even still have the doc   [10:18] <Bushmills> buffalo wzr-hp-g300nh or tp-link wr1043nd
12:49 < adubz> would it be ok to use the default firmware curious to why openwrt is the firmware of choice for openvpn setups
12:49 < adubz> the default firmware does allow vpn client setup
12:49 < Bushmills> because openwrt allows installation of openvpn on the router
12:50 < Bushmills> default firmware may be dd-wrt. there are two different ones
12:50 < adubz> oh i think this has openvpn on the router already it has a daemon and a client 
12:50  * Bushmills prefers openwrt over dd-wrt
12:50 < adubz> ya its a branded buffalo dd-wrt
12:50 -!- luneff [~yury@84.51.203.142] has joined #openvpn
12:51 < adubz> let me ask this the settings for openvpn client are specific
12:51 < adubz> Server IP/Name
12:51 < adubz> Port
12:52 < adubz> TUN MTU Setting
12:52 < adubz> TUN MTU Extra
12:52 < adubz> TCP MSS
12:52 < adubz> Use LZO Compression
12:52 < Bushmills> i'm using a plain openvpn configuration on my router. no setup through the configuration interface
12:52 < adubz> so you just upload your config
12:52 -!- upz [~uuuppz@109.169.49.83] has quit [Ping timeout: 276 seconds]
12:52 < Bushmills> just a text config file 
12:52 < adubz> gotcha
12:53 < Bushmills> yes.
12:53 < adubz> ok i dont see that option on this
12:53 < adubz> is there like an option to browse to the config or something 
12:53 < Bushmills> i don't know dd-wrt sufficiently to answer that
12:54 < adubz> im fine with flashing this
12:54 < adubz> so i know someone that is more of an expert can lead me in the right path to victory on this
12:54 < Bushmills> http://wiki.openwrt.org/toh/buffalo/wzr-hp-g300h  there's a section Migrate from DD-WRT to OpenWRT
13:02 <+s7r> adubz what kind of openvpn account you have commercial bought from third party website ?
13:02 <+s7r> or configure by you on own servers
13:02 < adubz> commercial
13:02 <+s7r> could you notice me with the provider ?
13:03 < adubz> if i could get by with dd-wrt on buffalo
13:03 < adubz> anonine vpn
13:04 < adubz> https://www.anonine.com/en
13:04 <@vpnHelper> Title: Anonine : VPN service - anonymous internet (at www.anonine.com)
13:04 <+s7r> yeah I saw 
13:04 <+s7r> kind of cheap
13:04 <+s7r> not anonymous thug
13:05 < adubz> ?
13:05 <+s7r> it's not anonymous service
13:05 <+s7r> and they provide PPTP and SSL no OpenVPN ?
13:05 < adubz> no they provide openvpn
13:06 < adubz> i have .ovpn setup 
13:06 < adubz> i have a config provided by them
13:07 < adubz> s7r is this your service
13:08 < adubz> i appreciate the offer and what not
13:09 < adubz> but ill have to ride with the one i have i have many months left
13:09 < adubz> s7r have you setup vpn at the router level
13:09 <+s7r> yes
13:11 <+s7r> not complicated if you have the .ovpn file and cert/key
13:12 < Bushmills> adubz: what's your impression of that router, as far?
13:12 < adubz> i like it seems solid
13:13 -!- DannyBlaze [~DannyBlaz@ottawa.okteck.com] has joined #openvpn
13:14 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 276 seconds]
13:17 -!- DannyBlaze [~DannyBlaz@ottawa.okteck.com] has quit [Ping timeout: 252 seconds]
13:19 -!- madsage [~K6CRPSMc@173-16-44-37.client.mchsi.com] has left #openvpn [" (T)"]
13:21 -!- X-Raimo [d58d8edc@opensuse/member/raimoschmidt] has joined #openvpn
13:22 < X-Raimo> hello. Can I use openvpn without encryption? 
13:22 -!- pindemon [~pindemon@unaffiliated/pindemon] has quit [Quit: what's this key for?]
13:22 <+s7r> Bushmills, can I do anything on the server to inspect and filter https traffic ? E.g. can I make the difference if somebody is viewing a https webpage on port 443 or connecting to a vpn server on port 443 TCP ?
13:22 <+s7r> X-Raimo why would you do that
13:24 < adubz> x-raimo why would you want to
13:24 < X-Raimo> s7r: I have one weak VPN router (with weak CPU) and I have to stream terminal for clients behind this router.  
13:24 <+s7r> by default openvpn uses Blowfish which is not such a CPU killer...
13:25 <+s7r> running openvpn on the computers directly is not a solution?
13:25 <+s7r> i don't know if you can configure it to work without encryption never tried and i doubt anyone tried..
13:26 < X-Raimo> The terminal becomes really slow. I've investigated that bottleneck is CPU. The load is very high due to unencription/encryption work
13:27 < X-Raimo> +s7r: in my case not a solution. Just because they loading terminal during the boot.
13:27 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
13:27 < X-Raimo> I have a real brain damage about it
13:28 <+s7r> i understand. really don't know if you can use openvpn without encryption
13:28 <+s7r> but I doubt it...
13:28 <+s7r> consider replacing your router
13:28 <+s7r> or run openvpn on the computers behind that router directly
13:29 < adubz> bummer i can not swap to openwrt
13:29 <+s7r> adubz
13:29 < adubz> ssh management is greyed out
13:29 <+s7r> what was your rotuer model?
13:29 < X-Raimo> s7r: is Cisco is good in my case? What do you thing?
13:30 <+s7r> depending .. Cisco has many models.. and depends what you need
13:30 < adubz> and when i browse to the bin firmware and try to do manual upgrade through web interface
13:30 < adubz> it upgrade fails
13:30 <+s7r> how many computers u have behind the router? how many internet providers you have
13:30 < X-Raimo> s7r: current router  it's usual desktop computer 
13:31 < adubz> SSH Management    Enable  Disable     <---- this is greyed out like it will not let me change it
13:31 -!- s7r [~s7r@openvpn/user/s7r] has quit [Read error: Connection reset by peer]
13:32 < adubz> may have to tftp i will see if that is an option
13:34 < adubz> nvm telnet worked
13:34 < adubz> is there a way i can backup my current firmware
13:34 < adubz> incase this doesnt work
13:35 < adubz> i clicked backup but its just a 23kilobyte nvram
13:36 < Bushmills> didn't you receive a copy on cdrom along with the router?
13:36 < adubz> oh ya i have cdrom so the image to the router should be backed up on that
13:37 < Bushmills> that's what buffalo usually does, as they're providing two firmware images to choose from
13:37 < adubz> k well i have a backed up something or another and the cdrom i should be good
13:38 < adubz> im going to cross my fingers and pray this works 
13:40 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:40 -!- mode/#openvpn [+v s7r] by ChanServ
13:41 < deever> can you recommend an openvpn port for android?
13:41 <+s7r> adubz: i got disconnected sorry
13:41 <+s7r> X-Raimo:  the same ;)
13:42 <+s7r> downloading 8GB and kind of kills the connection
13:43 < X-Raimo> s7r: I found how to disable encryption. But I really need to disable encryption only for single connection and keep it enabled for others.
13:44 <+s7r> how do you disable it ?
13:44 < X-Raimo> s7r: cipher none
13:44 <+s7r> it's simple, run an openvpn daemon with encryption off and include the syntax to disable encryption in that client .ovpn file, and other daemon for the other users with encryption enabled
13:45 <+s7r> so make server.conf and server1.conf something like this
13:45 <+s7r> in one cipher none
13:45 <+s7r> you have access to the openvpn server right ?
13:45 < X-Raimo> Good idea. How can i start two openvpn deamon? Should I use to ports? 
13:45 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has quit [Ping timeout: 255 seconds]
13:46 < X-Raimo> s7r: correct
13:46 <+s7r> yes and different ip pools if you assign internal IPs to clients
13:46 <+s7r> 10.8.0.0/24 in one and 10.9.0.0/24 in other (for example)
13:49 < X-Raimo> OK. I'll give a try tommorow at work. After I consult with my Computer Security Officer. The deal is that right now I have traffic encrypted by SSH and one more time encrypted by openvpn
13:51 <+s7r> that is overkill
13:51 <+s7r> :)
13:51 <+s7r> you are making encrypted tunnel within an encrypted tunnel
13:52 <+s7r> openvpn encryption should be more than you need unless you are exchaning data related to national security or something
13:56 < X-Raimo> s7r: thanx for your help and great idea
13:58 -!- X-Raimo [d58d8edc@opensuse/member/raimoschmidt] has quit [Quit: Page closed]
14:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:06 -!- mode/#openvpn [+o mattock] by ChanServ
14:14 -!- jopie [~Joel_Haas@s3eea0222.adsl.wanadoo.nl] has joined #openvpn
14:24 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
14:38 <@vpnHelper> RSS Update - forum: Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html#p14472>
14:45 -!- Squidy_at_Home [~quassel@200-163-63-165.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
15:04 -!- jopie [~Joel_Haas@s3eea0222.adsl.wanadoo.nl] has left #openvpn []
15:06 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
15:07 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
15:10 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
15:11 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Remote host closed the connection]
15:19 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has joined #openvpn
15:19 < adubz> bummer i bricked this router for sure
15:20 < adubz> bbl going to try some things
15:23 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has quit [Quit: They see me trollin'  They hatin']
15:24 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has joined #openvpn
15:24 < adubz> can someone tell me how to unbrick a buffalo router
15:24 < adubz> like seriously this is 10 kinds of annoying
15:25 < adubz> they dont print the mac addresses on the outside of the units either
15:25 < adubz> how can i get the mac addy to this thing
15:25 < adubz> i think maybe i will be able to communicate if i add an arp static route to it
15:27 < adubz> k ssid is mac thats good to know
15:27 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
15:27 < Bushmills> it should do a tftp request during boot. i think, about 4 secs after power up when pressing some button
15:28 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Quit: leaving]
15:29 < Bushmills> with it it should request an image from the server specified as reply to a dhcp request
15:29 < Bushmills> that's a function of the boot loader, which is afaik read-only, and unbrickable
15:30 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
15:31 < Bushmills> ah, no. other way around. it will listen to a tftp command within some time window after boot
15:35 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has quit [Ping timeout: 255 seconds]
15:37 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:38 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:39 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
15:39 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
15:45 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has joined #openvpn
15:46 < adubz> bushmills i think it worked what would be the ip of openwrt
15:46 < adubz> to communicate with the router
15:46 < adubz> i have tried serveral
15:46 < adubz> also is it ok to just put the openwrt firmware to it to try and unbrick i figured this should be ok
15:46 < adubz> wireless on this router doesnt seem to be working
15:46 < Bushmills> LAN ports? i think 192.168.1.1
15:46 < adubz> still could be bricked
15:47 < adubz> ya i tried that ip
15:47 < adubz> let me try to unbrick again i should be able to use the openwrt bin image to unbrick as long as its an image that is acceptable for the device all should be fine there 
15:47 < Bushmills> the buffalo are, afaik, considered as pretty much unbrickable
15:47 -!- yell0_ is now known as yell0
15:47 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
15:47 < adubz> ehh really that is bad
15:47 -!- yell0 [~yello@178.162.154.183] has quit [Quit: leaving]
15:48 < adubz> according to online people have unbricked
15:48 < Bushmills> why would that be bad?
15:48 < adubz> oh
15:48 < adubz> sorry im going cross eyed here
15:48 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
15:48 < adubz> i gotcha
15:48 < adubz> so the ip for the gateway is 192.168.1.1
15:48 < adubz> i should be able to unbrick with the openwrt image should be fine right
15:49 < Bushmills> double check that on the wiki
15:49 < adubz> also in tftp
15:49 < adubz> do i point to the full path of the image
15:49 < Bushmills> yes. tftp method should always work
15:49 < adubz> eg  put /this/is/the/locationoffirmware.bin
15:49 < Bushmills> check wiki
15:50 < Bushmills> never had to unbrick one
15:50 < adubz> tftp> put openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
15:50 < adubz> ya the wiki isnt very telling on that one
15:50 < adubz> maybe where on the machined does the tftp root 
15:51 < adubz> or where can you put files to tftp is there a designated directory
15:51 < adubz> find / -name tftp
15:53 < Bushmills> even without having had to unbrick one, i seem to remember that there exist detailed instructions on the wiki
15:53 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
15:54 < Bushmills> including command examples to add the mac to the arp table, and running a script which does interval attempts of sending, if the tftp window is short
15:56 < adubz> bushmills im actually coding an unbrick script now
15:56 < adubz> i am just curious if i path to the files on my machine or if there is a desinated location to put files for pushing files with the put command on tftp
15:57 < adubz> i do not see int he wiki where that information is specified
15:59 < Bushmills> you send a file.  when sending, you specify file name
15:59 < adubz> so bushmills it scrubs my entire box
15:59 < adubz> for that file
15:59 < adubz> before sending
16:00 < adubz> or should i put the file in root
16:00 < Bushmills> i have no idea what "it" refers to
16:02 < adubz> filesystem
16:03 < adubz> where does it know the file openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
16:03 < adubz> resides
16:03 < adubz> like where does tftp look
16:03 < Bushmills> you specifiy file name.
16:03 < adubz> so full path
16:03 < Bushmills> current dir. or full path, if somewhere else
16:03 < adubz> so /full/path/to/file/openwrt-ar71xx-wzr-hp-g300nh-squashfs-tftp.bin
16:03 < adubz> ok
16:04 <@vpnHelper> RSS Update - forum: Can't get OpenVPN started <http://forums.openvpn.net/topic8587.html#p14473>
16:07 -!- pindemon [~pindemon@unaffiliated/pindemon] has joined #openvpn
16:10 -!- Squidy_at_Home [~quassel@200-163-63-165.cbace702.dsl.brasiltelecom.net.br] has quit [Ping timeout: 240 seconds]
16:11 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has quit [Ping timeout: 255 seconds]
16:13 -!- Squidy_at_Home [~quassel@189.31.25.112] has joined #openvpn
16:13 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has joined #openvpn
16:16 <@vpnHelper> RSS Update - forum: Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html#p14474>
16:16 -!- Squidy_at_Home [~quassel@189.31.25.112] has quit [Read error: Connection reset by peer]
16:17 -!- pindemon [~pindemon@unaffiliated/pindemon] has left #openvpn []
16:18 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has joined #openvpn
16:18 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has quit [Ping timeout: 276 seconds]
16:19 < adubz> ok the tftp transfer went fine but im lost to wits end on how to access this thing
16:19 < adubz> through the web interface
16:22 <@vpnHelper> RSS Update - forum: Can't get OpenVPN started <http://forums.openvpn.net/topic8587.html#p14475>
16:28 < adubz> gateway is not working 192.168.1.1
16:42 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 258 seconds]
16:48 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has quit [Ping timeout: 255 seconds]
16:48 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
16:52 <@vpnHelper> RSS Update - forum: Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html#p14477> || Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14476>
16:54 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
17:08 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has joined #openvpn
17:08 < adubz> ya flashing this thing was a f-in mistake
17:08 < adubz> it wont unbrick
17:09 < adubz> Sent 21172224 bytes in 23.2 seconds
17:09 < adubz> just pushed original firmware
17:12 < adubz> i wait and i wait
17:12 < adubz> this thing = bricked i believe
17:21 -!- adubz [~zvpn@pool-71-97-0-36.dfw.dsl-w.verizon.net] has quit [Ping timeout: 255 seconds]
17:31 -!- newmember [~chatzilla@67.210.173.2] has joined #openvpn
17:33 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
17:33 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
17:33 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
17:46 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14478>
17:55 -!- pr0zoid [~pr0zoid@24-246-5-196.cable.teksavvy.com] has quit []
17:55 -!- aaroneous_ [aaron@static-71-183-67-138.nycmny.fios.verizon.net] has joined #openvpn
17:56 -!- aaroneous_ [aaron@static-71-183-67-138.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
18:01 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
18:02 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
18:09 < newmember> how do I push a default route to a ovpn client?
18:09 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p14471>
18:13 -!- Denial [~Denial@drgi.co.uk] has quit []
18:16 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14479>
18:17 < reiffert> newmember: 
18:17 < reiffert> !def1
18:17 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
18:25 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:33 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
19:12 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
19:20 -!- gyyrog [~gyyrog@99.181.158.238] has joined #openvpn
19:21 -!- gyyrog [~gyyrog@99.181.158.238] has quit [Remote host closed the connection]
19:32 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Ping timeout: 260 seconds]
19:32 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
19:35 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14480>
19:51 -!- enki [~enki@unaffiliated/enki] has joined #openvpn
19:53 < enki> hey guys - i'd like to tunnel tcp traffic from some ports on one server, to another server, ideally without losing the original ip information (e.g. rewriting the source)
19:53 < enki> could i just do a bridged net between the two, and use iptables to rewrite the source address?
19:59 < ecrist> sure
20:02 -!- johan1 [piko@ip-128.net-82-216-230.roubaix.rev.numericable.fr] has quit []
20:05 <@vpnHelper> RSS Update - forum: how to add more port <http://forums.openvpn.net/topic8605.html>
20:09 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
20:10 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 255 seconds]
20:17 -!- master_of_master [~master_of@p57B540F0.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
20:19 -!- master_of_master [~master_of@p57B53094.dip.t-dialin.net] has joined #openvpn
20:26 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
20:30 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
20:35 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14482>
20:41 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14483>
20:44 -!- UnterPerro [~UnterPerr@32.130.252.103] has joined #openvpn
20:48 -!- jahkop [~jahkop@171.25.159.245] has quit [Quit: leaving]
21:05 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
21:19 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:20 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
21:24 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
21:53 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14484>
22:11 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14485>
22:13 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
22:21 -!- eahm [~irc@ip68-230-29-80.ph.ph.cox.net] has joined #openvpn
22:24 -!- eahm [~irc@ip68-230-29-80.ph.ph.cox.net] has quit [Remote host closed the connection]
22:27 -!- K1ng`` [~KING@180.211.188.75] has joined #openvpn
22:30 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
22:31 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
22:33 -!- UnterPerro [~UnterPerr@32.130.252.103] has quit [Quit: UnterPerro]
22:34 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:34 -!- K1ng`` [~KING@180.211.188.75] has quit [Ping timeout: 276 seconds]
22:35 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14487> || Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14486>
22:41 <@vpnHelper> RSS Update - forum: Open vpn behind proxy server <http://forums.openvpn.net/topic8607.html>
22:49 -!- UnterPerro [~UnterPerr@32.130.252.103] has joined #openvpn
22:51 -!- EugeneKaway is now known as EugeneKay
22:55 -!- voglster [~yomama@70.122.225.235] has joined #openvpn
22:59 <@vpnHelper> RSS Update - forum: [Resolved]how Enable OpenVPN management console <http://forums.openvpn.net/topic8542.html#p14489>
23:00 -!- UnterPerro [~UnterPerr@32.130.252.103] has quit [Quit: UnterPerro lives to save another day]
23:05 <@vpnHelper> RSS Update - forum: [solved]how Enable OpenVPN management console <http://forums.openvpn.net/topic8542.html#p14489>
23:41 <@vpnHelper> RSS Update - forum: OpenVPN Setup on Linux help? <http://forums.openvpn.net/topic8604.html#p14490>
23:43 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
23:47 <@vpnHelper> RSS Update - forum: Using Internet with OpenVPN on Windows 7, how? <http://forums.openvpn.net/topic8599.html#p14491>
23:51 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:53 <@vpnHelper> RSS Update - forum: Need Authentication Method Using Remote MySQL Database <http://forums.openvpn.net/topic8603.html#p14493> || (Ask) About Verb in log <http://forums.openvpn.net/topic8608.html>
23:59 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14494>
--- Day changed Mon Aug 08 2011
00:19 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
00:23 <@vpnHelper> RSS Update - forum: how to add more port <http://forums.openvpn.net/topic8605.html#p14496> || Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14495>
00:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
00:25 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
00:26 -!- oc80z [oc80z@blea.ch] has joined #openvpn
00:29 <@vpnHelper> RSS Update - forum: Open vpn behind proxy server <http://forums.openvpn.net/topic8607.html#p14497>
00:30 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Read error: Connection reset by peer]
00:31 < EugeneKay> ecrist, I eed a shoulder to cry on
00:31 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
00:53 -!- adelas [~adela@pool-173-51-116-120.lsanca.fios.verizon.net] has quit [Read error: Connection reset by peer]
01:04 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
01:07 -!- Lombardi [~Vince@78.188.29.254] has joined #openvpn
01:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
01:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:23 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:32 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
01:46 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
01:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:47 <@vpnHelper> RSS Update - forum: (Ask) About Verb in log <http://forums.openvpn.net/topic8608.html#p14498>
01:51 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
01:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
02:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:05 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
02:07 < uuuppz> hi
02:20 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:39 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
02:39 -!- mode/#openvpn [+v s7r] by ChanServ
02:45 -!- luneff [~yury@84.51.203.142] has quit [Quit: This computer has gone to sleep]
02:56 -!- Lombardi [~Vince@78.188.29.254] has quit [Quit: Leaving]
03:12 -!- luneff [~yury@93.178.66.169] has joined #openvpn
03:18 -!- dazo_afk is now known as dazo
03:29 -!- luneff [~yury@93.178.66.169] has quit [Ping timeout: 252 seconds]
03:32 -!- luneff [~yury@93.178.66.169] has joined #openvpn
03:37 -!- fbh [fbh@unaffiliated/fbh] has left #openvpn ["Leaving..."]
03:40 -!- tjz [~pc@bb119-74-178-125.singnet.com.sg] has joined #openvpn
03:40 -!- tjz [~pc@bb119-74-178-125.singnet.com.sg] has quit [Changing host]
03:40 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
03:40 <@vpnHelper> RSS Update - forum: site to site issue <http://forums.openvpn.net/topic8609.html>
04:16 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14500>
04:38 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 250 seconds]
04:41 -!- dazo is now known as dazo_afk
04:49 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:49 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:49 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:55 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
04:59 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Remote host closed the connection]
05:02 -!- dazo_afk is now known as dazo
05:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
05:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:03 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
05:03 < Xgates> hey guys
05:04 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 252 seconds]
05:05 < Xgates> if I'm using a ca cert, user cert and private key then for running openvpn on the cmd line is this correct for these 3 files? ---->  openvpn --config /etc/openvpn/openvpn.conf --ca /etc/openvpn/certs/ca.crt --key /etc/openvpn/keys/foo.key --cert /etc/openvpn/certs/foo.crt   
05:07 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
05:08 < nuttersppadic> Xgates why not just put those in the config file n run openvpn by just pointing to it ?
05:08 < nuttersppadic> hello 
05:10 < Xgates> they are at the bottom of the conf file ---- http://pastebin.com/3MiUKxxC
05:10 < Xgates> then I tried running it just as --- openvpn --config /etc/openvpn/openvpn.conf
05:11 < Xgates> but it complained it couldn't find the key file
05:14 < Xgates> nuttersppadic: Cannot load certificate file foo.crt: error:02001002:system library:fopen:No such file or directory: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib
05:14 < Xgates> Mon Aug  8 00:13:49 2011 Exiting
05:14 < Xgates> that's what happens if I just run it as openvpn --config /etc/openvpn/openvpn.conf
05:15 < Xgates> I placed the key in /etc/openvpn and /etc/openvpn/keys and it doesn't work for either path
05:16 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Quit: ZNC - http://znc.in]
05:16 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
05:16 -!- luneff [~yury@93.178.66.169] has quit [Quit: Leaving]
05:22 <@vpnHelper> RSS Update - forum: site to site issue <http://forums.openvpn.net/topic8609.html#p14501>
05:29 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Ping Timeout (0 Nano seconds)]
05:30 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:30 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:30 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:38 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
05:40 <+s7r> can I host an openvpn server listening on port 443 TCP while I have on the same server a HTTPS server which is by default on the same TCP 443 port ?
05:48 < nuttersppadic> Xgates are u sure permissions are right ?
05:55 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
06:05 <@vpnHelper> RSS Update - forum: OpenVPN connects BUT ... <http://forums.openvpn.net/topic8610.html>
06:11 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14503>
06:13 -!- chokesmaster [~chokesmas@65.92.223.57] has quit [Ping timeout: 252 seconds]
06:23 <@vpnHelper> RSS Update - forum: OpenVPN connects BUT ... <http://forums.openvpn.net/topic8610.html#p14504>
06:27 -!- voglster [~yomama@70.122.225.235] has quit [Ping timeout: 240 seconds]
06:28 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
06:40 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:46 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has joined #openvpn
07:11 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
07:11 <@dazo> s7r: no, you cannot ... you can however have your HTTPS server listening to TCP port 10443 (for example) and use --port-share localhost 10443 .... all non-port-443-tcp-traffic will then be directed to your web server
07:13 <@dazo> gee, I'm talking rubbish now .... all non-openvpn traffic on TCP port 443 will be directed to your web server, I meant
07:17 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 255 seconds]
07:18 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14505>
07:27 < uuuppz> dazo: got my ui working nicely nd published the source
07:27 -!- eth00 [~r00t@unaffiliated/eth00] has left #openvpn []
07:27 <@dazo> uuuppz: great!
07:28 <+s7r> uuuppz: what options does your UI provide?
07:29 < uuuppz> its seperated into a background service running with elevated privilages and a front end written in WPF
07:29 -!- brah [be88a535@gateway/web/freenode/ip.190.136.165.53] has joined #openvpn
07:30 < uuuppz> currently I support starting, stoping, entering a password, and viewing the log for each configuration
07:30 < uuuppz> it uses a named pipe for communication between the background service and front end, so standard windows dacl security is applied
07:32 < uuuppz> the security bit was the primary motivator
07:32 < uuuppz> but in response to comments from ecrist
07:32 < uuuppz> I made the UI a lot prettier
07:33 <+s7r> it starts a service for each ovpn file ?
07:33 < uuuppz> http://sourceforge.net/projects/openvpnui/
07:33 <+s7r> works on win ?
07:33 <@vpnHelper> Title: OpenVPN UI | Download OpenVPN UI software for free at SourceForge.net (at sourceforge.net)
07:33 < uuuppz> no one service
07:33 < uuuppz> for all configurations
07:33 < uuuppz> and windows only.
07:34 <+s7r> windows is all matters :)
07:34 <+s7r> who uses linux doesn't need gui
07:34 < uuuppz> :)
07:34 <+s7r> i see 
07:34 <+s7r> good
07:34 <+s7r> but why would someone use this ui
07:34 <+s7r> rather than the one which comes with openvpn by default ?
07:35 < uuuppz> standard one doesn't deal with backgrounding
07:35 < uuuppz> so has to be run as admin when launched
07:36 < uuuppz> and my one is much more userfriendly IMHO
07:36 <+s7r> not really i can run openvpn gui as normal user.. but unless i run it as administrator is not able to modify routing table
07:36 < uuuppz> yes
07:36 < uuuppz> and that is a problem
07:36 < uuuppz> for me anyhow
07:37 <+s7r> and your ui can add routes without admin privileges?
07:37 < uuuppz> yes
07:37 <+s7r> ahh so that's the purpose
07:37 < uuuppz> because the UI does nothing
07:37 <+s7r> interesting and useful :)
07:37 < uuuppz> except talk to the back end
07:37 < uuuppz> the back end service runs at a higher privilage level
07:37 < uuuppz> so 
07:37 < uuuppz> has no issues
07:38 <+s7r> but i don't understand - the default standard UI what it has to do with routing table ?
07:38 < uuuppz> ?
07:38 < uuuppz> I don't really get what your asking...
07:39 <+s7r> I thought that you need to run openvpn as administrator so it can modify routing table
07:39 < uuuppz> yes you do
07:39 <+s7r> and you say it's because of the default UI 
07:39 < uuuppz> ok
07:39 < uuuppz> because default UI
07:39 < uuuppz> is not split
07:39 < uuuppz> it lanuches the instance of openvpn.exe
07:39 < uuuppz> directly
07:40 < uuuppz> therefore must have the privilages openvpn.exe requires to do what it needs to do
07:40 < uuuppz> e.g add routes
07:40 < uuuppz> my solution
07:40 < uuuppz> is to split that into two apps
07:40 < uuuppz> a background service
07:40 < uuuppz> and a UI that communicates with the background service over a named pipe
07:40 < uuuppz> the service is running with admin level privilages
07:40 < uuuppz> the UI is essentally just a client
07:41 <+s7r> okey makes sense . but the background service will still need admin privileges correct?
07:41 < uuuppz> obviously
07:41 <+s7r> i mean.. i won't be able to use openvpn if i don't have admin rights
07:41 < uuuppz> nope
07:41 < uuuppz> not true
07:41 < uuuppz> background service runs with right
07:41 < uuuppz> client app does not
07:41 < uuuppz> all it needs to be able to do is open the named pipe on which the background service is listening
07:42 <+s7r> and your installer can be run without admin privileges?
07:42 < uuuppz> no
07:42 < uuuppz> obviously not
07:42 < uuuppz> you need admin privilage to install it
07:43 <+s7r> ok. sorry but i really don't see the use of your ui. if I have admin privileges why not use the good default openvpn UI which comes with the software 
07:44 < uuuppz> because it is BAD to run with admin privilages 
07:44 < uuuppz> day to day
07:44 < uuuppz> I'm CTO of a company
07:44 < uuuppz> and we don't want our users having to be given local admin
07:44 < uuuppz> so they can use our vpn
07:45 <+s7r> in enterprise environment I can see it's use
07:45 <+s7r> but for me it's not usefull i simply run just openvpn as admin .. and the rest do as normal user
07:46 < uuuppz> well it is much prettier than the normal GUI :)
07:46 < uuuppz> so maybe give it a try
07:46 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
07:47 <+s7r> sure why not
07:47 <+s7r> would like to see if it's stable or it has any bugs
07:49 < uuuppz> well I'm using it right now
07:49 < uuuppz> and it plays nice side by side with standard gui etc
07:49 <+s7r> yes that's what i wanted to ask
07:50 <+s7r> it does not affect the standard gui in any way
07:50 < uuuppz> it relies on the standard gui being properly configured
07:50 <+s7r> cause i`m not willing to let it go .. it's reliable
07:50 < uuuppz> eg
07:50 < uuuppz> having the configs in the config dir
07:53 -!- toxictrash [~toxictras@iuo58.internetdsl.tpnet.pl] has joined #openvpn
07:54 < toxictrash> Hello. How can I setup openvpn that client would be able to access servers in serwer's lan? I have looked on documentation, and searched google, but I can't get it working
07:54 <@vpnHelper> RSS Update - forum: OpenVPN connects BUT ... <http://forums.openvpn.net/topic8610.html#p14506>
08:02 -!- toxictrash_ [~toxictras@62.87.237.123] has joined #openvpn
08:03 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has quit [Ping timeout: 276 seconds]
08:04 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
08:04 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
08:05 -!- toxictrash [~toxictras@iuo58.internetdsl.tpnet.pl] has quit [Ping timeout: 240 seconds]
08:05 -!- toxictrash_ is now known as toxictrash
08:05 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
08:06 < uuuppz> s7r: its installed in a seperate directory to main opevpn, and uninstalling does not touch the config files. You can run both standard gui and my gui at the same time, you'll only get a problem if you try to connect the same vpn connection in both at same time.
08:08 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Ping timeout: 250 seconds]
08:09 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
08:09 -!- mode/#openvpn [+v Axeman] by ChanServ
08:09 -!- hydester [ad45a64b@gateway/web/freenode/ip.173.69.166.75] has joined #openvpn
08:14 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
08:17 < datruth> When using openvpn with certs should clients have p12 certs? or .crt .key files?
08:20 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
08:20 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:21 < datruth> !p12
08:21 <@vpnHelper> "p12" is openssl pkcs12 -export -out filename.p12 -inkey filename.key -in filename.crt -certfile ca.crt
08:22 < datruth> oh maybe I just need to convert
08:22 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has joined #openvpn
08:22 < datruth> !crt
08:22 < datruth> !cert
08:22 < datruth> !key
08:22 <@vpnHelper> Error: You don't have the #openvpn,op capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
08:22 < datruth> interesting
08:22 < datruth> !openssl
08:22 < datruth> !tls-auth
08:22 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make
08:22 <@vpnHelper> the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
08:22 < datruth> !tls
08:23 < datruth> oh well
08:27 <@vpnHelper> RSS Update - forum: Things I will need to do if I use OpenVPN <http://forums.openvpn.net/topic8592.html#p14507>
08:31 -!- newmember [~chatzilla@67.210.173.2] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
08:35 -!- catsup [d@ps38852.dreamhost.com] has quit [Quit: Reconnecting]
08:35 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
08:39 < toxictrash> is it possible to push route to client for all local lan computers? (so they can respond to ping?)
08:40 -!- hydester [ad45a64b@gateway/web/freenode/ip.173.69.166.75] has quit [Quit: Page closed]
08:42 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 255 seconds]
08:43 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Beware of programmers who carry screwdrivers.]
08:45 -!- master_of_master [~master_of@p57B53094.dip.t-dialin.net] has quit [Ping timeout: 250 seconds]
08:45 <@vpnHelper> RSS Update - forum: Status of IPv6? Is it mostly transparent? <http://forums.openvpn.net/topic8611.html>
08:49 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
08:58 -!- master_of_master [~master_of@p57B55643.dip.t-dialin.net] has joined #openvpn
09:00 -!- vpnuser [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:02 < vpnuser> when using http-proxy serverip port, what is the best port to use?
09:04 < vpnuser> when using http-proxy serverip port, what is the best openvpn port to use?
09:06 -!- toxictrash [~toxictras@62.87.237.123] has quit [Quit: file not found]
09:07 <+s7r> vpnuser: doesn't matter use the port which your http-proxy listens on
09:10 < vpnuser> no. I mean my openvpn port 
09:11 <+s7r> any port not blocked at proxy side
09:12 < vpnuser> I see. so the proxy side now has the capability to block the port and not the ISP anymore.
09:12 <+s7r> lol
09:13 <+s7r> the ISP still has capability to block port
09:13 <+s7r> your ISP can block ports, the ISP of the proxy server can block ports
09:13 <+s7r> and the ISP of the openvpn server can block ports
09:13 < vpnuser> hehehe
09:13 <+s7r> but they have to let at least one 
09:14 < vpnuser> how will I know what port is not blocked? is there a software or program to know what port is open?
09:14 < vpnuser> how will I know what port is not blocked? is there a software or program to know what port is open or not blocked??
09:14 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14510> || OpenVPN failures on Server but not Client <http://forums.openvpn.net/topic8612.html>
09:14 <+s7r> no 
09:15 <+s7r> run openvpn on port 80 tcp
09:15 <+s7r> and tha tone is for sure not blocked
09:15 < vpnuser> tone? what is that tone that you say?
09:16 <+s7r> that one*
09:16 < vpnuser> I run tcp port 80 but its blocked though.
09:16 <+s7r> can you browse www.google.com ?
09:17 < vpnuser> no I cant browse or connect because tcp port 80 is blocked
09:17 <+s7r> why on earth would somebody block prot 80
09:17 <+s7r> you can't browse any webpage?
09:18 < vpnuser> yes I cant browse any webpage.  our isp blocks openvpn tcp 80
09:18 < vpnuser> because our isp is very restrictive.
09:19 <+s7r> lol
09:19 <+s7r> where are u from ?
09:19 < vpnuser> asia
09:19 <+s7r> and where is the vpn server?
09:19 < vpnuser> california. i use vps from USA
09:19 <+s7r> ok
09:19 <+s7r> use port 443 then
09:24 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
09:31 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:31 <@vpnHelper> RSS Update - forum: OpenVPN failures on Server but not Client <http://forums.openvpn.net/topic8612.html#p14511>
09:32 < gladiatr> happy monday!
09:38 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:39 < vpnuser> how to hide my openvpn server ip address from my isp?
09:43 <+s7r> i just told you it's impossible
09:43 <+s7r> they can see where you are connecting to
09:44 <+s7r> they can't see what you do inside the VPN
09:44 <+s7r> but they can see your VPN server IP and block it permanently and there is no way to get around this
09:46 < vpnuser> i see. huhuhu
09:47 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 246 seconds]
09:47 < vpnuser> do you think it is possible to include this on the new openvpn version?
09:48 <+Axeman> lol vpnuser, really? 
09:48 <+Axeman> how can you hide an IP from the person that gives it to you? 
09:48 < gladiatr> duct tape
09:48 <+Axeman> no vpnuser it's not. 
09:48 < vpnuser> cant it be encrypted ?
09:48 <+Axeman> no. 
09:49 <+Axeman> when you make a phone call, can you hide the number that you dialed? 
09:49 <+Axeman> no. 
09:49 <+Axeman> sure you can bounce from 1 call to another, etc, but the number that you called to connec to, IS the number. that's it. 
09:51 < vpnuser> I was thinking that if the connection server-client during vpn connection is encrypted, maybe there is a possibility to encrypt the ip address before the connection is done and descrypted on the other side
09:51 <+s7r> lol
09:51 < uuuppz> ha
09:51 <+s7r> :))
09:51 < uuuppz> brilliant :)
09:51 <+s7r> yup
09:51 <+s7r> that's China :D
09:51 < uuuppz> well
09:51 < uuuppz> I actually
09:51 < uuuppz> can think of a way of doing it
09:52 < uuuppz> u could probably do a TCP tunnel through TOR
09:52 <+s7r> vpnuser the traffic is encrypted, not the IP :))
09:52 <+s7r> the traffic is encrypted server-client and client-server
09:52 < vpnuser> s7r: isnt it that the ip address is part of the traffic?
09:52 < uuuppz> I wouldn't want to hazard a guess at the stability!
09:52 <+s7r> but the client knows server IP and server knows client IP
09:52 <+s7r> otherwise how will the connection be possible
09:52 <+s7r> you just don't understand man
09:53 <+s7r> please stop asking these question!
09:53 < uuuppz> s7r: My suggestion is possible tho I think
09:53 < uuuppz> crazy maybe :)
09:53 <+s7r> tor is to slow for this
09:53 <+Axeman> wow vpnuser if you need porn that bad, just move. 
09:54 <+Axeman> or get a girlriend. 
09:54 < vpnuser> yes, the client knows the ip address because its inside the config ovpn.
09:54 <@vpnHelper> RSS Update - forum: high quality stunt <http://forums.openvpn.net/topic8600.html#p14512>
09:54 < vpnuser> axeman: no, I dont need porn, hehehe. its just my isp is very restrictive.
09:55 <+s7r> vpnuser:  Axeman gave you the most clear explanation for dummies
09:55 <+s7r> when you dial somebody, can you hide what phone number you dialed ?
09:55 <+s7r> anyway .. strike it from your mind as it's too much for you. just think of it "NOT POSSIBLE" and that's all
09:56 <+s7r> yes China ISP is restrictive because you shouldn't be online watching youtube. movies, torrents ,porn, gaming
09:56 <+s7r> you should be at work making Nikes
09:56 <+s7r> :))
09:56 < vpnuser> :)
09:56 < vpnuser> Nike?
09:57 < vpnuser> Nike is made from China?
09:57 < vpnuser> I dont know that. hehehehe
09:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 250 seconds]
09:59 < vpnuser> anyway, with axeman explanation, maybe its true.  my mind was playing if traffic is encrypted,why not encrypt all the information including the ip during the communication process since both server and client knows their ip address to connect.  just a thought.  moreover, if this is possible, if I can request this at the wishlist
10:00 <+s7r> your "mind" doesn't understand how encryption works
10:00 <+s7r> how do you want the client to know the server's address?
10:00 < vpnuser> most probably thats true s7r
10:00 <+s7r> in order to go to a place, you need to know the address
10:00 <+s7r> the same is in networking
10:01 <+s7r> the client needs to know the server address in order to initiate a connection
10:01 < vpnuser> yes. did the client already know the ip address in its ovpn file?
10:01 <+s7r> that can not be encrypted or hidden
10:01 < vpnuser> yes. did the client already know the ip address in its ovpn file?
10:01 <+s7r> it does know it from the ovpn file. But when he tries to access it / go to it how you want to say
10:01 < vpnuser> and the server in the server.conf file
10:01 <+s7r> your ISP sees
10:01 <+s7r> Axeman uuuppz any more ideas ? :))
10:03 < vpnuser> this is depressing that isp knowing my server ip still even if I am using openvpn
10:03 <+s7r> this is life
10:03 <+s7r> you should make revolution
10:03 <+s7r> :))
10:03 < vpnuser> I hope openvpn will have that capability to have that full hidden connection.
10:04 <+s7r> :D
10:04 <+s7r> leave us your email address
10:04 < vpnuser> cant I have that on wish list instead
10:04 <+s7r> and we will notify you when this feature arries
10:04 <+s7r> probably in the next version
10:04 < vpnuser> yehey
10:04 -!- fluter [~fluter@123.117.81.33] has joined #openvpn
10:04 -!- fluter [~fluter@123.117.81.33] has quit [Changing host]
10:04 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
10:05 < vpnuser> my email?
10:05 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14513>
10:05 <+s7r> yeah the next version of openvpn will be able to hide the ip address of the server
10:06 < vpnuser> its ihideserver@hotmail.com 
10:06 <+s7r> it will be amazing
10:06 <+s7r> perfect
10:06 < vpnuser> s7r? really really
10:06 <+Axeman> i vote he moves
10:06 < vpnuser> wowwwwwwwwwwwwwww
10:06 <+s7r> yes
10:06 < vpnuser> thats amazing
10:06 <+s7r> in the immediate future very very soon
10:06 <+s7r> we will have this option
10:06 <+s7r> you can share this with your friends
10:06 <+s7r> so they will come and get the new version of openvpn too
10:06 < vpnuser> wowwwwwwwwwwwwwww
10:06 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
10:06 < vpnuser> i love you guys
10:07 < vpnuser> that will really be helpful
10:07 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:07 < vpnuser> i cant wait for it to be available.
10:09 <+s7r> we are working on it
10:09 <+Axeman> gotta love OpenVpn! hip hip hooray!
10:09 < vpnuser> s7r: are you one of the makers of openvpn ?  programmers are really great
10:10 <+Axeman> open source software wins again!
10:10 <+s7r> i wouldn't take credit for such wonderfull project
10:10 <+s7r> but i help with what i can from time to time
10:10 <@vpnHelper> RSS Update - forum: Open vpn behind proxy server <http://forums.openvpn.net/topic8607.html#p14515> || Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14514>
10:10 < vpnuser> how do you do it s7r?
10:10 < vpnuser> how do you know so much of this stuffs?
10:10 < vpnuser> i envy you guys
10:11 <+s7r> that's just us
10:11 < vpnuser> but I have small mind only compare to you guys
10:11 <+s7r> borned this way
10:11 < vpnuser> you are really gifted, all of you who make openvpn great
10:11 <+Axeman> 'cos i was born this way;
10:12 <+s7r> ok vpnuser show over. you can now /part and we will mail you when new version arrives
10:12 <+s7r> very very soon
10:12 <+s7r> that version will provide you full encryption it will be like a chain on your internet cable
10:13 < vpnuser> thanks s7r, axeman,  thank you all very much.
10:13 < vpnuser> i feel like crying for joy
10:14 <+s7r> don't hold yourself :) do whatever you feel like
10:14 < vpnuser> hehehehe
10:14 <+Axeman> **big hugs** VpnUser
10:14 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Read error: Connection timed out]
10:14 <+Axeman> it's okay my friend. i understand. 
10:14 < vpnuser> big hugs to all of you man
10:14 <+Axeman> my gummy mint wants to spy on us too now. 
10:15 < vpnuser> i feel my heart will burst for joy. hahahahaha
10:15 <+Axeman> ooh... then you should /part before that. 
10:15 <@vpnHelper> RSS Update - forum: site to site issue <http://forums.openvpn.net/topic8609.html#p14516>
10:15 < vpnuser> yahooooooo
10:15 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
10:16 < vpnuser> thanks thanks thanks.  bye guys, will wait for the email and visit the openvpn site often for the updates. yahoooooooooooooooooo
10:16 -!- vpnuser [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit []
10:16 <+s7r> i thought he would never leave
10:17 <+Axeman> jeez. 
10:17 <+s7r> next time we catch him we will ask him for a blowjob
10:17 <+Axeman> i give you guys props. i don't know how often you get bozos like that but - this guy got on MY nerves
10:17 <+s7r> in exchange for the vpn version which hides the IP :))
10:18 <+s7r> Axeman: think there is 2 billion of them
10:18 <+s7r> :D
10:18 <+s7r> how freaky does this sound ?
10:18 <+Axeman> lol i didn't touch openvpn with a 10' pole until i knew the ins and outs. 
10:18 <+Axeman> and even then, i didn't do it until i sat around in the chat room(s). 
10:19 <+s7r> huh ... 
10:19 <+Axeman> that guy? he bring shame upon all family. 
10:19 <+s7r> i told him 5 times before i started making fun of him
10:19 <+Axeman> i am disappoint. 
10:19 <+s7r> :))
10:19 <+s7r> let's mail him later tell him the openvpn version is released
10:19 <+Axeman> someone that knows so little, shouldn't be messing with something so big. 
10:19 <+s7r> and that he has to make a blowjob in exchange for it
10:19 <+s7r> it's a really special version
10:19 <+s7r> for people who want to hide the ip on which the server listens too
10:20 <+Axeman> lol
10:20 <+s7r> bet you 100$ he will agree
10:20 <+s7r> but i doubt he will receive a visa to get out of that shithole
10:20 <@vpnHelper> RSS Update - forum: Things I will need to do if I use OpenVPN <http://forums.openvpn.net/topic8592.html#p14518> || OpenVPN connects BUT ... <http://forums.openvpn.net/topic8610.html#p14517>
10:20 <+Axeman> lol
10:26 <@vpnHelper> RSS Update - forum: OpenVPN failures on Server but not Client <http://forums.openvpn.net/topic8612.html#p14520> || Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14519>
10:29 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has left #openvpn []
10:31 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
10:38 -!- _Sam-- [~sam@unaffiliated/sam--/x-573746] has joined #openvpn
10:38 < _Sam--> if ive revoked a client cert which is now in crl.pem...is there anyway to 'undo' that ?
10:39 < defswork> edit index and rebuild 
10:41 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
10:41 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
10:41 < defswork> _Sam--, you using easy-rsa ?
10:42 < _Sam--> defswork :  yeap, linux
10:42 < defswork> look at revoke-full
10:42 < defswork> edit your index.txt and make the cert as not revoked
10:42 < defswork> and then do the equiv of     $OPENSSL ca -gencrl -out "$CRL" -config "$KEY_CONFIG" to rebuild the crl.pem file
10:43 < _Sam--> i see -- i got the index.txt file now, lemme see.
10:43 <@vpnHelper> RSS Update - forum: OpenVPN failures on Server but not Client <http://forums.openvpn.net/topic8612.html#p14521>
10:44 < _Sam--> the only change in the index.txt to make the file 'not revoked' is to change the first letter from R to V?
10:44 < defswork> yes
10:44 < defswork> but thats just the index
10:45 < _Sam--> yes, then i have to rebuild the file.
10:45 < defswork> the crl.pem needs rebuilding 
10:45 < _Sam--> that cert, the one i want to 'unrevoke' in the index.txt, also has what looks like a timestamp with it in the same line, whereas my other non-revoked certs, do not.  does that also need to be removed?
10:46 < defswork> what columns is it ?
10:47 < _Sam--> third column:   R       190329211908Z   110803160026Z
10:47 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has quit [Ping timeout: 276 seconds]
10:47 < defswork> try it and see
10:48 < _Sam--> try removing it?
10:48 < defswork> no try it with it in first and see
10:48 < _Sam--> k
10:50 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14522>
10:52 < _Sam--> sorry for being relatively clueless -- what is the key_config you reference?
10:52 < _Sam-->  -config "$KEY_CONFIG"
10:53 < defswork> it's defined  in easy-rsa/vars
10:53 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
10:53 < _Sam--> i cant just do ./vars ?
10:53 < defswork> . ./vars
10:55 < _Sam--> aha.   thank you.
10:55 < _Sam--> entry 48: not revoked yet, but has a revocation date
10:55 < _Sam--> guess i need to clear it.
10:55 < defswork> aye
10:55 < defswork> I make this up as a I go along
10:58 < _Sam--> cant it to rebuild the new file :/
10:58 < _Sam--> er, cant get it.
10:58 < _Sam--> NM.
10:59 < defswork>  openssl crl -text  -noout  -in keys/crl.pem
10:59 < defswork> that will list whats now in your crl.pem file
10:59 < _Sam--> it worked just fine, i had to use real file names rather than variables.
10:59 < defswork> yeah the only one of thouse thats set in vars is KEY_CONFIG
10:59 < _Sam--> after the new crl.pem is created and moved into place for openvpn, does openvpn require a restart?
10:59 < defswork> no
11:00 < defswork> _Sam--, I also use a ccd file for allowing clients to connect
11:00 <@vpnHelper> RSS Update - forum: OpenVPN failures on Server but not Client <http://forums.openvpn.net/topic8612.html#p14523>
11:00 < defswork> if you delete a certificate and rebuild the crl the certificate will work again
11:01 < defswork> so I delete the client ccd directory also
11:01 < defswork> and specify ccd-exclusive in config on server
11:01 < _Sam--> yeah -- the client connected nearly instantly wheni moved the new crl.pem into place.
11:02 < _Sam--> defswork :  THANK YOU for your time and knowledge.   you are a true master.
11:02 < defswork> I'm not - I make it up as I go along
11:03 < Olipro> !ipv6
11:03 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
11:12 <@vpnHelper> RSS Update - forum: OpenVPN failures on Server but not Client <http://forums.openvpn.net/topic8612.html#p14524>
11:13 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Quit: ZNC - http://znc.in]
11:13 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
11:13 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
11:13 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:13 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
11:15 -!- Olipro is now known as starhash
11:17 -!- starhash is now known as Olipro
11:17 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Remote host closed the connection]
11:20 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
11:23 -!- Jikan [~Jikan@2001:41d0:2:401f:94:23:63:31] has quit [Quit: La vérité, c'est que tu es mou et paresseux. Tout le portrait de mon oncle Émile : celui-là, il passait jamais au soleil parce que ça le fatiguait de traîner son ombre.]
11:24 < ecrist> Ici on parle français.
11:24 < ecrist> if I said that right.
11:25 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Quit: ZNC - http://znc.in]
11:25 < ecrist> bah
11:25 < ecrist> Ici on parle englais.
11:25 < ecrist> heh
11:25 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
11:27 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 250 seconds]
11:28 < krzee> im making progress on my openwrt project
11:28 < krzee> finally got openvpn into my own custom image for my 4mb flash
11:29 -!- Jikan [~Jikan@2001:41d0:2:401f:94:23:63:31] has joined #openvpn
11:32 < EugeneKay> Sigh.
11:32 < EugeneKay> I hate technology.
11:35 < krzee> lies
11:35 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 264 seconds]
11:36 < krzee> grr when i change subnet from 192.168.1.x to 192.168.69.x in /etc/config/network my dropbear doesnt work anymore, but i cant see anywhere that dropbear knows about its ip
11:36 < EugeneKay> I lost my 5x2TB raid-5 array.
11:36 < krzee> shit, ouch
11:36 < krzee> how!?
11:37 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
11:37 < EugeneKay> Power blipped, bopped one of the drives out of the array. Came back up in degraded mode.
11:37 < krzee> then killed *another* ?
11:37 < EugeneKay> I readded it, it got about 1% done with the resync and decided to fail another drive for having an inconsistent superblock.
11:37 < krzee> oh god
11:37 < EugeneKay> You see where this is going
11:38 < krzee> yes, to a very sad place
11:38 < EugeneKay> I managed to get the first failed drive forced back in using --assume-clean, but hte first one refused to
11:39 < EugeneKay> So I tore it down, and tried to --create it from scratch.... and I missed a drive.
11:39 < EugeneKay> It started to rebuild the new array, walking all over the inode tables.
11:40 < EugeneKay> So...... I stopped that as soon as I could.... and started reading
11:42 < EugeneKay> Attempted to mfs.ext4 with -S, to rebuild the superblock, and maybe save the rest of the inode table. No luck.
11:43 < EugeneKay> It was at this point that I began to cry last night
11:44 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
11:46 < EugeneKay> Right now I'm feeding what's left of it through "strings", and a bash script that greps out stuff which looks like plaintext files... I'm hunting for a single file that is kinda important, and isn't backed up anywhere else.
11:46 < EugeneKay> Financials, etc is safely off-site, but not THIS ONE FUCKING THING
11:49 < EugeneKay> I'm undecided on how to proceed ith remaking the array. I'm thinking that I should zero out all the disks and retry this with RAID-6
11:51 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has joined #openvpn
11:52 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has left #openvpn []
11:56 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
12:00 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
12:01 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
12:31 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
12:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
12:49 < datruth> how can I fix the error Bad LZO decompression header byte: 0
12:49 < datruth> !bad lzo
12:49 < datruth> !lzo
12:49 < datruth> !LZ0
12:49 < datruth> damn
12:51 < krzee> !configs
12:51 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
12:53 < datruth> hrmm
12:56 < datruth> krzee: http://pastebin.com/z7Yx1zXD
13:02 < krzee> why mssfix 1200
13:02 < krzee> fragment 1200
13:02 < krzee> and also why
13:02 < krzee> tun-mtu 1500
13:02 < krzee> tun-mtu-extra 32
13:02 < krzee> saw it on the web, or tested things and found it helped?
13:02 < krzee> if the first, then comment all those lines out and test
13:02 -!- krzee was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
13:02 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:02 < krzee> cute
13:03 < krzee> whats the last line you saw?
13:04 -!- brah [be88a535@gateway/web/freenode/ip.190.136.165.53] has quit [Ping timeout: 252 seconds]
13:06 < EugeneKay> <krzee> if the first, then comment all those lines out and test
13:06 < krzee> cool
13:09 < datruth> "figured it out
13:10 -!- dazo is now known as dazo_afk
13:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
13:12 -!- datruth [datruth@gotpot.org] has quit [Remote host closed the connection]
13:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:22 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 260 seconds]
13:29 < oc80z> morning
13:29 < EugeneKay> Meh.
13:30 < krzee> meh is right
13:30 < krzee> im ready to dropkick this router
13:31 -!- jbb [~yeeb@184.105.219.149] has quit [Quit: No Ping reply in 180 seconds.]
13:31 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
13:32 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Ping timeout: 252 seconds]
13:33 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
13:36 -!- folivora [~bomshiva@koekaniini.kelju.fi] has quit [Ping timeout: 264 seconds]
13:45 -!- folivora [~bomshiva@koekaniini.kelju.fi] has joined #openvpn
13:47 < oc80z> nice.
13:47  * oc80z trying to fix some error.. happy that its an error.
13:48 < oc80z> but not so happy the forums say check the `date` ... cause thats not the issue. 
13:48 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
13:49 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
13:49 -!- folivora [~bomshiva@koekaniini.kelju.fi] has quit [Ping timeout: 246 seconds]
13:51 < krzee> could be the issue on any of the 3 machines
13:51 < krzee> server / client / CA
13:51 < krzee> assuming it was the issue on the CA when cert was signed
13:51 < krzee> also, dont trust timezones, just blindly ntpdate time.nist.gov on all
13:52 < krzee> well do trust timezones, but be weary i mean... people see the time and think its right but forget they're in UTC or something
13:54 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:55 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:55 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:56 < oc80z> they wont fix quassel
13:56 < oc80z> i tell them, i dont want to /who or /names on join. 
13:56 < oc80z> or keep my nicklist updated with a timed /who or /names 
13:57 < oc80z> sorry for the excess, must be # 3000
13:57 < oc80z> --
13:57 < oc80z> krzee thanks
13:57 < krzee> np, it helped?
14:00 < oc80z> im going through diff -u for ssl.cnf/pkitool changes
14:00 < oc80z> comparing trunk to whatever build this is..
14:01 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:04 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
14:04 < oc80z> geesh
14:16 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
14:16 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
14:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:18 < oc80z> hmmph
14:18 < oc80z> verify error , error=certificate is not yet valid.
14:19 < oc80z> would tabs be an issue?
14:19 < krzee> !cerverify
14:20 < krzee> !certverify
14:20 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
14:22 -!- yell0 [yello@unaffiliated/contempt] has quit [Read error: Operation timed out]
14:25 < oc80z> like, any $'\x09'
14:25 < oc80z> oh
14:27 < oc80z> thanks
14:27 < krzee> yw
14:32 < oc80z> hmmph 
14:32 < oc80z> not signing
14:42 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:42 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:45 < oc80z> wow
14:45 < oc80z> i need to part some channels.
14:47 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:47 -!- oc80 [oc80z@blea.ch] has joined #openvpn
14:58 -!- Guifort [~Administr@139.181.124.78.rev.sfr.net] has joined #openvpn
15:03 -!- oc80 [oc80z@blea.ch] has quit [Excess Flood]
15:03 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:04 < Bushmills> fail
15:04 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5]
15:05 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
15:05 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
15:09 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
15:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:19 < oc80z> mm
15:23 <+s7r> guys 
15:23 <+s7r> paranoid question
15:23 <+s7r> someone upstream me, could sniff my traffic and intercept the keys for my openvpn connection
15:23 <+s7r> while tls is negotiated client-to-server ?
15:23 <+s7r> (before encryption begins) ?
15:24 < Bushmills> private keys are never transmitted
15:24 <+s7r> so it's not like in SSH when you don't know the actual fingerprint of the server before the first initiated connection ?
15:24 < Bushmills> nor does ssh transmit private keys
15:25 <+s7r> Bushmills: ... care to explain it like you would to a ...newbie :D
15:26 <+Axeman> yea Bushmills please
15:26 <+Axeman> explain it to me like i'm sarah palin. 
15:26 < Bushmills> essentially, server encrypts a random number with client public key, sends it to client, and asks to decrypt it.
15:27 < Bushmills> given that only client has private key, only client is able to
15:27 -!- Guifort_1 [~Administr@139.181.124.78.rev.sfr.net] has joined #openvpn
15:27 <+s7r> so a tool like dsnsniff would be useless if a client uses openvpn right ?
15:27 -!- Guifort [~Administr@139.181.124.78.rev.sfr.net] has quit [Ping timeout: 260 seconds]
15:28 < Bushmills> have fun sniffing an encrypted randon number
15:28 <+s7r> and another q would be .. openvpn uses RSA or Diffie Hellman for key exchange because I can find both an google
15:28 < krzee> both are involved
15:28 <+s7r> Bushmills: the same procedure applies when I am browsing a HTTPS webpage like gmail.com ?
15:29 < Bushmills> https doens't authenticate clients
15:29 < krzee> rsa is for auth
15:29 -!- Guifort_1 [~Administr@139.181.124.78.rev.sfr.net] has quit [Client Quit]
15:29 <+s7r> so the server knows the client's public key fron the client.crt file ?
15:29 <+s7r> and that's how authentication is made ?
15:29 < krzee> the server sees the clients cert was signed by the ca's private key
15:29 < krzee> it uses the ca's public key to see that
15:30 < krzee> !pki 
15:30 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
15:30 <@vpnHelper> specially as a server (see !servercert)
15:30 < krzee> #2
15:32 <+s7r> krzee Bushmills so end of the line ..... intercepting openvpn is not possible
15:32 <+s7r> right ?
15:32 <+s7r> keys can not be compromised
15:32 < krzee> no known methods at this point
15:32 < krzee> thats the best ill ever say about anything
15:32 <+s7r> you are wise
15:32 <+s7r> nothing is 100% sure
15:32 <+s7r> not in computers, not in life
15:33 <+s7r> but relatively speaking .... no known methods to compromise openvpn certs / keys
15:33 <+s7r> ?
15:33 < krzee> [13:34]  <krzee> no known methods at this point
15:34 < pwrcycle> krzee: hi, i've been meaning to ask you about the man-in-the-middle warning when using only client side keys
15:34 < pwrcycle> krzee: how can that be mitm'd?
15:34 < krzee> !mitm
15:34 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially, or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates, or (#3) then use: ns-cert-type server in the client config
15:35 < Bushmills> i figure you could break into a server, steal certs, then spoof client's request to name server by providing a reply with IP address to your own server, where you scrape off decrypted client traffic
15:35 < krzee> if we're both clients
15:35 < krzee> i could pose as the server
15:35 < krzee> hey, my cert was signed by the right ca!
15:36 < krzee> thats why we sign it AS a server
15:36 < krzee> then we check for that
15:36 <+s7r> and the auth-username-password .... does that help
15:37 <+s7r> or provide increased security ?
15:37 < krzee> sure, turns it into dual factor auth
15:37 < krzee> hell, you could add in some usb keys too
15:37  * Bushmills steals the whole server instead
15:37  * krzee tries to blame Bushmills 
15:37 < krzee> !blame
15:37 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault, or (#2) According to krzee, it's always dazo's fault
15:37 < Bushmills> you made me do it
15:38 < krzee> dazo made me make you
15:38 <+s7r> the password is sent in plain text?
15:39 < krzee> s7r, well its inside openvpn's encrypted tunnel at that point, but you could add any sort of enc you wanted too, its all scripts you control
15:39 < krzee> openvpn doesnt have its own pw auth
15:39 < krzee> just extendable through scripts
15:39 < krzee> (or plugins)
15:39 <+s7r> but ... it's not necessary i assume
15:40 <+s7r> it will create an encrypted channel within an encrypted tunnel
15:40 < krzee> theres a big difference between them for scaling too
15:40 <+s7r> it's like in Inception .. a dream within a dream within a dream within a dream :))
15:40  * Bushmills tries --cipher rot13
15:40 < krzee> a script will hold up all clients, since its single threaded
15:40 < krzee> a plugin will get its own thread
15:40 <+s7r> this beats me so hard
15:41 <+s7r> it's enough for me that I Know openvpn can not be intercepted
15:41 <+s7r> and it's good to know that adding auth-username-password will increase little bit security
15:41 < krzee> it increases auth security because:
15:41 < krzee> that can be 3 things
15:41 < krzee> something you are (biometrics)
15:42 < krzee> something you have (cert, usb key)
15:42 < krzee> something you know (password, passphrase)
15:42 < krzee> using 2 makes for better security than 1
15:42 <+s7r> correct
15:42 <+s7r> yeey
15:47 < oc80z> no idea
15:47 < oc80z> still getting a certificate is not yet valid on client-box.
15:48 < oc80z> server-box -CAfile ca.crt client.crt is OK
15:49 < oc80z> tried with pkitool --server and then with that --iteractive for any --extentions server variables the pkitool batch misses.
15:49 < krzee> ya i dont use pkitool
15:49 < oc80z> i think it misses: 			export REQ_EXT="$REQ_EXT -extensions server"
15:49 < oc80z> 			export CA_EXT="$CA_EXT -extensions server"
15:49 < krzee> i use ssl-admin
15:49 < oc80z> suggestion?
15:50 < krzee> you ran ntpdate on both sides?
15:50 < oc80z> well.
15:50 < oc80z> the date's are OK
15:51 < krzee> run it anyways?
15:52 < oc80z> just did.
15:52 < oc80z> *sigh* no diff.
15:52 < krzee> try not using pkitool
15:52 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
15:52 < oc80z> the openssl versions vary by 2 years, the client is 1.0, 
15:52 < oc80z> yeah im lookin atht hte perl one
15:55 < krzee> ya ecrist made it
15:55 < ecrist> I did no such thing.
15:55 < ecrist> what?
15:55 < krzee> lol
16:01 < oc80z> well.
16:01 < oc80z> im shit out of luck, this ssl-admin is not within the scope of what im working on., 
16:01 < krzee> its just a frontend for openssl
16:02 < krzee> just like easy-rsa is
16:03 < oc80z> yeah, its interactive :(
16:05 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14525>
16:05 < krzee> ecrist, didnt you start coding something to solve that for me to use in my confgen?
16:08 < oc80z> i think it was ah, that FN thing again.
16:08 < oc80z> someone came in here last week and was asking about -batch
16:10 < oc80z> common names should match, no?
16:10 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14526>
16:10 < krzee> should match what
16:11 < ecrist> krzee: I started, haven't finished.  summer happened.
16:11 < ecrist> riding motorcycle > writing perl
16:12 < ecrist> krzee: http://www.vtxoa.com/forums/showthread.php?p=3300925#post3300925
16:12 < oc80z> client/server commonname
16:12 < ecrist> oc80z: that doesn't make sense.
16:12 < oc80z> are you sure it doesnt make sense
16:13 < ecrist> positive
16:13 < oc80z> key_cn 
16:13 < oc80z> fn
16:14 < oc80z> its mentioned over a dozen times in pkitool
16:14 < ecrist> are you asking if the CN for the server needs to match the CN for the client?
16:14 < oc80z> mm
16:14 < ecrist> wtf is 'mm'?
16:14 < oc80z> think it out
16:15 < ecrist> well, depending on how your vocalize each 'm' it could be a mm as in NO, or a mm as is yes
16:15 < ecrist> how about you type what you mean, rather than typing gutterals?
16:25 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has joined #openvpn
16:31 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has quit [Ping timeout: 264 seconds]
16:33 <@vpnHelper> RSS Update - forum: OpenVPN failures on Server but not Client <http://forums.openvpn.net/topic8612.html#p14527>
16:34 < krzee> !ssl-admin
16:34 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports, or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn, or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
16:42 <+s7r> what would be a better cert manager than easy-rsa
16:44 < krzee> up to you
16:44 < krzee> i like ssl-admin
16:44 < ecrist> I do too
16:44 < krzee> ;]
16:44 < ecrist> krzee: see the pics, above of my new seat?
16:44 < ecrist> it's *super* comfy
16:45 < krzee> ecrist, you made a small part of ssl-admin cli based before didnt you?  im doing something now where that could be handy
16:45 < krzee> nice bike
16:45 < ecrist> krzee: I don't recall.
16:45 < ecrist> thanks. :)
16:46 < ecrist> put about 4000 miles on it this year so far.
16:46 < ecrist> bought at 6400 miles, sitting at 10800 now
16:46 < ecrist> bought it middle of june
16:47 < krzee> cant see the images tho, not a member
16:47 < krzee> just looking at the avatar
16:47 < ecrist> doh
16:47 < ecrist> http://secure-computing.net/files/03vtx1800
16:47 <@vpnHelper> Title: Index of /files/03vtx1800 (at secure-computing.net)
16:48 < krzee> chmod 444
16:48 < krzee> i do that all the time, scp likes to set other 0
16:48 < ecrist> done
16:49 < ecrist> chmod a+r ;)
16:49 < ecrist> new seat doesn't have the passenger pad
16:49 < ecrist> yet
16:49 < ecrist> old seat is the smooth one
16:50 < ecrist> http://secure-computing.net/files/03vtx1800/IMG_0342.JPG (OLD)  http://secure-computing.net/files/03vtx1800/IMG_0347.JPG (NEW)
16:51 < krzee> ahh ya looks kush
16:51 < krzee> what bout the lady?
16:51 < ecrist> it *is*
16:51 < ecrist> she has her own damn bike
16:51 < krzee> haha nice
16:51 < ecrist> she won't ride mine.  
16:51 < ecrist> there are rare exceptions, but as a rule, she doesn't ride mine.
16:52 < ecrist> we're going to put about 1000 miles on over the next 5 days
16:52 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
16:52 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
16:52 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
16:52 -!- mode/#openvpn [+v Axeman] by ChanServ
16:52 < ecrist> round-about through amarosa, chicago, and milwaukee
17:08  * havoc is in Milwaukee
17:08 < havoc> well, just west of
17:12 -!- tty234 [telex@gateway/shell/anapnea.net/x-ucbiwzugzfloubda] has quit [Ping timeout: 276 seconds]
17:12 -!- tty234 [telex@gateway/shell/anapnea.net/x-ghnfcjuwwqzbqnra] has joined #openvpn
17:25 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:26 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Remote host closed the connection]
17:27 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
17:34 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:34 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:34 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
17:34 -!- mode/#openvpn [+v Axeman] by ChanServ
17:40 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 250 seconds]
18:01 -!- danryan [~dryan@li115-70.members.linode.com] has quit [Ping timeout: 250 seconds]
18:09 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Remote host closed the connection]
18:10 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:39 -!- secondchoice [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
18:39 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
18:44 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 264 seconds]
18:53 -!- Denial [~Denial@drgi.co.uk] has quit []
18:57 -!- secondchoice [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 258 seconds]
19:07 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 250 seconds]
19:08 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
19:13 -!- soccerjonp [~Adium@rrcs-76-79-114-218.west.biz.rr.com] has joined #openvpn
19:13 -!- aaroneous [aaron@static-71-183-67-138.nycmny.fios.verizon.net] has quit [Read error: Connection reset by peer]
19:19 < EugeneKay> ecrist - nice bike.
19:23 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
19:33 -!- danryan [~dryan@li115-70.members.linode.com] has joined #openvpn
19:34 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 260 seconds]
19:37 -!- Champi [Champi@rootshell.fr] has joined #openvpn
20:14 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has left #openvpn []
20:18 -!- soccerjonp [~Adium@rrcs-76-79-114-218.west.biz.rr.com] has left #openvpn []
20:20 < ecrist> EugeneKay: thanks. :)
20:20 < ecrist> havoc: we're leaving milwaukee and going west Thursday.  not sure which town we'll stay in
20:26 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 250 seconds]
20:27 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:27 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
20:32 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
20:38 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
20:52 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 260 seconds]
20:53 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:54 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
21:01 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 246 seconds]
21:13 -!- genesis01 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:14 < genesis01> hello guys, while I was researching about icmp for openvpn, I found http://sourceforge.net/mailarchive/forum.php?forum_name=openvpn-devel&max_rows=25&style=nested&viewmonth=200705
21:14 <@vpnHelper> Title: SourceForge.net: OpenVPN: openvpn-devel (at sourceforge.net)
21:15 < genesis01> and someone named Alon already have the idea
21:15 < genesis01> wasnt it considered?
21:18 -!- genesis01 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
21:22 -!- mode/#openvpn [+o ecrist] by ChanServ
21:22 -!- mode/#openvpn [+b *!*@gateway/web/freenode/*] by ecrist
21:22 -!- mode/#openvpn [-o ecrist] by ecrist
21:26 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 255 seconds]
21:28 -!- nebajoth [~nebajoth@starfighter.org] has quit [Read error: Operation timed out]
21:31 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
21:33 < havoc> ecrist: FYI, I'm in Hartland
21:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
21:43 <@vpnHelper> RSS Update - forum: update on the requested protocol <http://forums.openvpn.net/topic8613.html>
21:43 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
21:50 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 240 seconds]
21:52 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
21:53 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
21:54 < ecrist> we're going to be in Milwaukee long enough to see the HD museum
21:54 < ecrist> then going to stay at a hotel in Mauston
21:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:56 -!- nebajoth [~nebajoth@starfighter.org] has joined #openvpn
21:57 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:58 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
22:01 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:15 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 240 seconds]
22:20 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
22:22 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
22:28 < dijital1> hmmm
22:28 < dijital1> so I'm using openvpn to setup a site to site VPN
22:29 < dijital1> the gateways are able to connect and the gateway that I control can ping hosts on the remote network. But hosts on my LAN cannot ping hosts on the remote network…
22:34 < ecrist> they need a route to the VPN
22:39 -!- jberiksen [~jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
22:39 < jberiksen> Hallo
22:39 < jberiksen> Hallo
22:41 < dijital1> ok
22:41 < dijital1> but they're behind the gateway
22:41 < dijital1> so it's LAN ----> pfsense ---> OpenVPN Tunnel to Remote Site ---- pfsense ----> Remote LAN
22:42 < dijital1> so it's LAN ----> pfsense1 ---> OpenVPN Tunnel to Remote Site ---- pfsense2 ----> Remote LAN
22:42 < dijital1> pfsense 1 can ping hosts on the Remote LAN but hosts on LAN cannot
22:43 < dijital1> pfsense1 is the default gateway for LAN
22:43 < jberiksen> I have a Debian Squeeze server with OpenVPN. I can ping the VPN server from a client and the client from the server. But i can't ping the lan behind the VPN server. I don't know if i'm missing some route on my external gateway or what's wrong. I have read a lort of articels on the internet, but haven't solve my problem.
22:58 < jberiksen> !welcome
22:58 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:59 < dijital1> !route for lans behind openvpn
22:59 < dijital1> !route
22:59 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
23:22 -!- jber [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
23:24 -!- jberiksen [~jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit [Ping timeout: 276 seconds]
23:35 -!- jberiksen [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
23:36 -!- jber [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit [Ping timeout: 246 seconds]
23:39 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
23:40 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 250 seconds]
23:41 -!- jber [~jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
23:41 -!- jberiksen [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit [Read error: Connection reset by peer]
23:43 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
23:46 -!- gyyrog [~gyyrog@99.181.158.238] has joined #openvpn
23:48 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
23:48 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
23:54 -!- gyyrog [~gyyrog@99.181.158.238] has quit [Remote host closed the connection]
23:58 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 264 seconds]
23:59 -!- jberiksen [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
--- Day changed Tue Aug 09 2011
00:01 -!- jber [~jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit [Ping timeout: 264 seconds]
00:10 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
00:19 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:26 -!- chokesmaster [~chokesmas@65.92.222.106] has joined #openvpn
00:48 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
00:53 -!- Guest78155 [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
00:56 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 263 seconds]
00:57 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
01:01 -!- Guest78155 [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Excess Flood]
01:02 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
01:02 <@vpnHelper> RSS Update - forum: Hi to every one <http://forums.openvpn.net/topic8614.html>
01:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
01:02 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 252 seconds]
01:03 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:04 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
01:08 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
01:11 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
01:14 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
01:19 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
01:19 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:20 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
01:24 -!- Olipro_ is now known as Olipro
01:28 < Bushmills> !serverlan
01:28 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
01:28 < Bushmills> jberiksen ^^^
01:32 <@vpnHelper> RSS Update - forum: OpenVPN failures on Server but not Client <http://forums.openvpn.net/topic8612.html#p14530>
01:48 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
01:49 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
01:57 <@vpnHelper> RSS Update - forum: Open vpn behind proxy server <http://forums.openvpn.net/topic8607.html#p14531>
01:57 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 246 seconds]
01:59 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
02:07 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 255 seconds]
02:09 <@vpnHelper> RSS Update - forum: Open vpn behind proxy server <http://forums.openvpn.net/topic8607.html#p14534> || OpenVPN failures on Server but not Client <http://forums.openvpn.net/topic8612.html#p14533> || Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14532>
02:13 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
02:15 <@vpnHelper> RSS Update - forum: Open vpn behind proxy server <http://forums.openvpn.net/topic8607.html#p14535>
02:18 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
02:20 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
02:24 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 260 seconds]
02:26 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
02:31 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
02:31 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
02:36 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
02:37 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
02:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
02:42 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
02:42 <@vpnHelper> RSS Update - forum: Open vpn behind proxy server <http://forums.openvpn.net/topic8607.html#p14536>
02:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:46 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
03:07 <@vpnHelper> RSS Update - forum: Open vpn behind proxy server <http://forums.openvpn.net/topic8607.html#p14537>
03:14 -!- jberiksen [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit []
03:14 -!- jberiksen [~jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
03:15 < jberiksen> !ipforward
03:15 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
03:20 < jberiksen> !route_outside_openvpn
03:20 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
03:21 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
03:22 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
03:24 < jberiksen> !linipforward
03:24 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
03:31 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 252 seconds]
03:36 < jberiksen> I have a Debian Squeeze server (10.0.9.1) with OpenVPN. I can ping the VPN server (10.0.10.1) from a client (10.0.10.6) and the client from the server. But i can't ping the lan behind the VPN server. My gateway is a Linksys ag241 (10.0.9.2). Is it rigth that i have to add a static route to my linksys als this Destination IP Address: 10.0.10.0, Subnet Mask: 255.255.255.0, Gateway: 10.0.9.1?
03:37 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:38 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
03:43 -!- Deathvalley122 [~Death@eagleits.net] has quit [Ping timeout: 250 seconds]
03:47 -!- jber [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has joined #openvpn
03:48 < jber> !goal
03:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:48 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p14538>
03:49 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 246 seconds]
03:50 -!- jberiksen [~jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit [Ping timeout: 258 seconds]
03:50 < Mowee> Morning
03:58 -!- dazo_afk is now known as dazo
04:07 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
04:07 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
04:10 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:10 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:10 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:12 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
04:12 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
04:15 -!- manitu [~manitu@p578b0cfb.dip0.t-ipconnect.de] has joined #openvpn
04:16 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
04:19 <@vpnHelper> RSS Update - forum: Jumping ping using OpenVPN <http://forums.openvpn.net/topic8615.html>
04:20 < manitu> hi.. i don't know if i'm doing it right, but my vpn server got a point-to-point connection to the vpn network(vpn network 172.16.0.0/16).. now i got a "client" which has another client(e.g. 192.168.0.2).. it also routes the traffic to that client, but i can't reach him, because he is not known by openvpn-server(the vpn client does not NAT addresses).. is there a way to give the openvpn server a static route to 192.168.0.2? i tried ip route 
04:20 < manitu> add, but it doesn't work because the openvpn-server just got a point-to-point and just know the openvpn-network by a route
04:22 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:23 -!- kisom [~x@c-f6dde155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
04:25 -!- dazo is now known as dazo_afk
04:26 -!- dazo_afk is now known as dazo
04:28 -!- jber [jesper@port2046.ds1-vbr.adsl.cybercity.dk] has quit []
04:42 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:42 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:47 -!- dazo is now known as dazo_afk
04:47 -!- dazo_afk is now known as dazo
04:55 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14540>
05:04 -!- Deathvalley122 [~Death@eagleits.net] has joined #openvpn
05:07 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14541>
05:11 < Bushmills> manitu: that client is a machine in a LAN behind the openvpn client or server?
05:13 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has joined #openvpn
05:13 <@vpnHelper> RSS Update - forum: change License <http://forums.openvpn.net/topic8616.html>
05:13 -!- teb76 [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has joined #openvpn
05:14 < teb76> hi to all
05:14 < teb76> just set openvpn, following the openvpn website howto
05:15 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:15 -!- mode/#openvpn [+v s7r] by ChanServ
05:15 < teb76> when I try to start the server all seems to be ok, when I star the client it hangs up at the line  "udp4v4 link remote: myipaddress:1194
05:16 < teb76> anyone can help me?
05:17 < teb76> after a while I get tls error: tls key negotiation failed to occour in 60 seconds
05:18 < manitu> Bushmills, [VPN-Server 172.16.0.1]------[172.16.0.2 VPN-Client 192.168.0.1]------[192.168.0.2 Client i want to be known by VPN-Server]
05:19 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
05:20 < manitu> problem: VPN-Client can not share the route and VPN-Server just got a p-t-p, so i can't add a static route
05:25 <@vpnHelper> RSS Update - forum: OpenVPN connects BUT ... <http://forums.openvpn.net/topic8610.html#p14543>
05:26 < manitu> is there another way to add a route except "ip route add ..."?
05:26 < manitu> or tell in ccd that a client got the network x.x.x.x
05:26 -!- teb76_ [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has joined #openvpn
05:27 < teb76_> my server is a windows 7 machine
05:27 < teb76_> already set port forwarding on router
05:27 -!- teb76 [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has quit [Ping timeout: 258 seconds]
05:28 < teb76_> from the router log I see that packets are correctly routed to the server machine
05:28 < teb76_> windows firewall is disabled
05:28 < Ragnar> so an openvpn server
05:28 < teb76_> what can I check ?
05:28 < Ragnar> is it required to listen on an IP address
05:28 < Ragnar> that is bound to an eth0?
05:28 < Ragnar> in my case, it listens on an IP thats not even shown in ifconfig
05:29 < Ragnar> on any of the tunnels
05:29 < teb76_> Ragnar, it seems the same for me
05:30 < Ragnar> I mean
05:30 < Ragnar> that doesnt make any sense
05:30 < Ragnar> but it works
05:31 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
05:32 < teb76_> ok!!! now it works
05:32 < teb76_> how I can see the rest of my lan ??
05:34 < Bushmills> !clientlan
05:34 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a
05:34 <@vpnHelper> better explanation
05:34 < Bushmills> manitu: ^^^
05:36 < teb76_> vpnHelper, thanks, but what i want to do is to access the other lan machine on wich the server is connected to
05:38 < teb76_> !route
05:38 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
05:38 < Bushmills> !serverlan
05:38 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
05:38 < Bushmills> teb76_: ^^^
05:38 < teb76_> thanks :)
05:39 < teb76_> I'm new with openvpn, let be patience :)
05:40 < teb76_> !ipfroward
05:40 < teb76_> !ipforward
05:40 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
05:40 < Bushmills> routing to netwerks behind server is not openvpn specific 
05:40 < teb76_> !winipforward
05:40 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
05:43 <+s7r> Bushmills: if my openvpn server would be on a win xp PC with one single pulbic IP address how would I make rules for nat the VPN ip 10.8.0.0/24 to the public IP ?
05:43 <+s7r> in linux i do it with iptables but windows ?
05:44 -!- astePC [~astePC@unaffiliated/aste] has joined #openvpn
05:44 < astePC> Will openVPN connect to a Cisco VPN?
05:48 <+s7r> astePC: will a dog fuck a cat
05:48 <+s7r> :D
05:48 < astePC> will openVPN support IPSec
05:48 < astePC> VPN
05:48 < astePC> http://sydney.edu.au/ict/student/guides/iphone-vpn.shtml
05:48 <@vpnHelper> Title: iPhone setup guide for VPN - Student IT - The University of Sydney (at sydney.edu.au)
05:48 < astePC> I'm not using iPhone tho
05:51 <@dazo> astePC: OpenVPN is not IPSec
05:51 <@dazo> astePC: OpenVPN will never support anything else than OpenVPN
05:51 < astePC> hmm
05:52 < astePC> damn
05:52 < Ragnar> uh
05:52 < Ragnar> ever experienced that your user.crt
05:52 < Ragnar> is unreadable after you kill your openvpn daemon
05:52 < Ragnar> and restart it?
05:53 < Ragnar> and you have to move a backup file back over to your /etc/openvpn directory
05:53 < Ragnar> and it works again?
05:53 <@dazo> Never .... sounds like you have something which corrupts your cert files then
05:54 < Ragnar> over on the vpn server itself?
05:54 <@dazo> most likely something locally
05:55 < Ragnar> apparently I checked logs
05:55 <@dazo> what's for sure, unless you did --log /etc/openvpn/user.crt ... then openvpn will never ever modify cert or key files
05:55 < Ragnar> and I get the TLS handshake failed (60 seconds kind of deal)
05:56 < Ragnar> and, many other vpn users get the same problem
05:56 < Ragnar> also, when I try to build new user certs on the vpnserver
05:56 < Ragnar> ./build-key user
05:56 < Ragnar> it only touches user.crt
05:56 <@dazo> if the cert file is modified, that behaviour is expected ... and openvpn does not modify/create/write cert files
05:56 < Ragnar> but its empty
05:57 <@dazo> you most likely have a broken openssl
05:57 < Ragnar> so the two problems dont have anything todo with eachother
05:57 < Bushmills> !notopenvpn
05:57 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
05:57 < Bushmills> hm.. no.
05:58 <@dazo> Ragnar: well, that user.crt is getting corrupted and that easy-rsa is not able to generate sensible cert files ... that indicates that the common element is openssl ...
05:58 < Bushmills> !factoids search cisco
05:58 <@vpnHelper> "cisco" is (#1) An open-source client for Cisco SSL VPN is available from http://www.infradead.org/openconnect.html, or (#2) OpenConnect is availabe in FreeBSD ports in security/openconnect
05:59 < Bushmills> !ipsec
05:59 < Bushmills> !factoids search ipsec
05:59 <@vpnHelper> No keys matched that query.
05:59 < Ragnar> yeah
05:59 < Ragnar> but it works if I use a file that hasnt been opened by openvpn before
05:59 < Ragnar> opened/used
06:00 < Ragnar> cp /backup/ragnar/ragnar.crt /usr/local/etc/openvpn/ragnar.crt
06:00 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
06:00 <@dazo> Ragnar: your openssl or something else on that box is badly broken
06:00 <@dazo> !notopenvpn
06:01 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
06:03 < Ragnar> nods
06:03 <@vpnHelper> RSS Update - forum: OpenVPN connects BUT ... <http://forums.openvpn.net/topic8610.html#p14544>
06:07 < Ragnar> dazo: this might be a debian 5.0 to 6.0 upgrade
06:08 <@dazo> Ragnar: might most likely be ... debian/ubuntu does some extra openssl hackery to check that keys are not known to be compromised (due to their epic openssl patch failure some years ago) ... if those hacks are not working properly ... it might even get worse
06:08 < manitu> Bushmills, thank you.. gonna look for it.. hope its possible with the client.. it's a gprs modem which does not route like a router.. ~~
06:09 < Bushmills> doesn't matter
06:09 < Bushmills> openvpn server looks like a router, that's all what matters
06:09 < Bushmills> or. client in your case
06:11 < Ragnar> dazo: yeah
06:12 < Ragnar> we tried doing the crts manually
06:12 < Ragnar> you and I, last week
06:12 < Ragnar> I've been off work since, so havent had time to look at this accordingly.
06:12 <@dazo> ahh, true ... I had forgotten that
06:13 <@dazo> just be sure that this box isn't compromised somehow ... I get sceptical when cert files suddenly doesn't work
06:15 < Ragnar> yeah
06:15 < Ragnar> the box is a mess though.
06:15 < Ragnar> and nothing is documented properly
06:15 < Ragnar> so maybe the only way around this is to start fresh.
06:15 < Ragnar> to fix other problems aswell
06:23 <@dazo> sounds like a better plan ... might be more time consuming, but might also be less
06:23 <+s7r> dazo: if my openvpn server would be on a win xp PC with one single pulbic IP address how would I make rules for nat the VPN ip 10.8.0.0/24 to the public IP ? iin linux i do it with iptables but windows ?
06:24 <@dazo> s7r: I dunno ... I'm not a Windows user
06:24 <@dazo> s7r: I only use Windows to download a better OS
06:24 <+s7r> :))
06:25 <+s7r> why so disappointed about win
06:25 <+s7r> it's good OS user -friendly
06:25 <@dazo> because it's crap?
06:25 <+s7r> for normal use, not server use it's good....
06:25 <+s7r> what would you use
06:25 <+s7r> on your laptop for example
06:25 <+s7r> something with a desktop and stuff
06:25 <@dazo> nah ... it's user-unfriendly for me ... I want to do stuff via the command line .... where windows stinks
06:25 <@dazo> I've used Linux on my laptops since 1996
06:26 <@dazo> oh, sorry that was a lie ... since 1997
06:27 <+s7r> what linux dist
06:27 <@dazo> Now I'm using Fedora and ScientificLinux (where stability is important)
06:28 <+s7r> why fedora and not centos
06:28 <@dazo> But I've used Slackware, Crux, RootLinux, Gentoo and openSuSE ... And I'm using RHEL much at work
06:29 <@dazo> because centos developers don't scale ... ScientificLinux is superior now
06:29 <+s7r> scientific linux si rhel based?
06:29 <@dazo> it is
06:30 <@dazo> it's a hard competitor to CentOS ... but delivers updates much more reliable nowadays .... they released 6.1 lately, 5.7 alpha is available
06:30 <@dazo> (wonder where those releases are on CentOS's agenda ........)
06:30 <+s7r> but the architecture and commands everything
06:30 <+s7r> is the same as in centos ?
06:31 <@dazo> just as RHEL ... CentOS and ScientificLinux are both RHEL clones
06:31 <@dazo> just different teams behind it ... SL is based on people in fermalabs and CERN
06:31 <+s7r> so the best thing you wanna do is buy RHEL if you want reliable updates
06:32 <@dazo> well, you don't do that for own private projects, do you?
06:32 <@dazo> then you want something community oriented ... Fedora is too unstable in the long run .... and ScientificLinux provides the goodies 
06:32 <+s7r> nope
06:32 <+s7r> i was speaking in enterprise environment
06:33 <@dazo> enterprise is something completely different .... even though, I understand (and recommend) small companies to use SL ... as they're not quite enterprise size where RH is really worth the money .... RHEL subscriptions might be a too heavy (economic) load
06:34 <@dazo> but in the moment they heavily depend on the infrastructure ... RHEL is the winner
06:36 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Copywight 2007 Elmer Fudd. All wights wesewved.]
06:39 -!- luneff [~yury@46.41.92.201] has joined #openvpn
06:42 < manitu> Bushmills, thank you so much.. it works.. finally :D
06:43 -!- secondchoice [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:44 -!- astePC [~astePC@unaffiliated/aste] has quit [Quit: Leaving]
06:52 -!- secondchoice [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Read error: Operation timed out]
07:04 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
07:06 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
07:15 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
07:25 -!- bitterman [~yury@46.41.101.253] has joined #openvpn
07:27 -!- luneff [~yury@46.41.92.201] has quit [Ping timeout: 250 seconds]
07:43 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has quit [Ping timeout: 240 seconds]
07:58 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has quit [Ping timeout: 240 seconds]
08:03 -!- nameless` [~nameless`@lav35-1-82-236-136-20.fbx.proxad.net] has joined #openvpn
08:03 -!- nameless` [~nameless`@lav35-1-82-236-136-20.fbx.proxad.net] has left #openvpn []
08:04 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
08:05 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
08:05 <@vpnHelper> RSS Update - forum: License transfer <http://forums.openvpn.net/topic8617.html>
08:09 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has joined #openvpn
08:12 <@vpnHelper> RSS Update - forum: Server authentication "hangs" <http://forums.openvpn.net/topic8342.html#p14546>
08:13 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 250 seconds]
08:13 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
08:15 -!- secondchoice [~thirdchoi@198.105.46.46] has joined #openvpn
08:17 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
08:17 <@vpnHelper> RSS Update - forum: Can ping, but cannot route web traffic through VPN <http://forums.openvpn.net/topic8618.html>
08:27 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
08:27 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:28 -!- secondchoice [~thirdchoi@198.105.46.46] has quit [Quit: Sorry Gotta Run!]
08:30 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p14548>
08:42 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14549>
08:43 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
08:43 -!- mode/#openvpn [+v Axeman] by ChanServ
08:48 < teb76_> anyone experienced with openvpn for android?
08:48 < teb76_> trying to let it works with darky's rom 10.2
08:50 -!- Cryp71c [Cryp71c@adsl-065-013-247-238.sip.bna.bellsouth.net] has joined #openvpn
08:51 < Cryp71c> I'm not using OpenVPN but I am having issues with a VPN specific problem, would anyone mind if I asked it here? ##networking's ideas have not solved the issue(s)
08:53 < uuuppz> think thats called chancing your arm
08:58 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14551> || Doubts on router model <http://forums.openvpn.net/topic8619.html>
08:58 < Cryp71c> uuuppz, :(
09:00 -!- master_of_master [~master_of@p57B55643.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
09:02 -!- master_of_master [~master_of@p57B558A7.dip.t-dialin.net] has joined #openvpn
09:02 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:04 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14552>
09:09 -!- Intel_Xeon [~Intel_Xeo@c-82-150-206-3.seefeld.hotze.com] has joined #openvpn
09:09 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14553>
09:10 < Intel_Xeon> !goal
09:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:11 < Cryp71c> Intel_Xeon, was that @ me?
09:12 < Intel_Xeon> No thanks im new and i don't know to handle with hydraIRC
09:12 < Cryp71c> ah, k.
09:12 < Intel_Xeon> thanks
09:13 -!- Intel_Xeon [~Intel_Xeo@c-82-150-206-3.seefeld.hotze.com] has quit [Client Quit]
09:18 -!- Cryp71c [Cryp71c@adsl-065-013-247-238.sip.bna.bellsouth.net] has left #openvpn ["Leaving"]
09:22 <@vpnHelper> RSS Update - forum: Can ping, but cannot route web traffic through VPN <http://forums.openvpn.net/topic8618.html#p14556> || Server authentication "hangs" <http://forums.openvpn.net/topic8342.html#p14555> || OpenVPN connects BUT ... <http://forums.openvpn.net/topic8610.html#p14554>
09:28 <@vpnHelper> RSS Update - forum: Doubts on router model <http://forums.openvpn.net/topic8619.html#p14557>
09:31 -!- rubin110 [~rubin110@173-228-123-71.dsl.dynamic.sonic.net] has joined #openvpn
09:31 < rubin110> Hi there, do I need anything special on the client site to accept a push for DNS server?
09:32 < gladiatr> rubin110, what OS?
09:32 < rubin110> My /etc/resolve.conf doesn't seem to get updated when I connect to my VPN server, but I do have the push dhcp dns option set on my server.
09:32 < rubin110> Debian to Debian.
09:32 < gladiatr> You need to have a script in place to update your resolv.conf
09:32 < gladiatr> usually in the form of an up script
09:33 < rubin110> Something like this?
09:33 < rubin110> http://www.subvs.co.uk/openvpn_resolvconf
09:33 <@vpnHelper> Title: openvpn and resolv.conf | SubVS.co.uk (at www.subvs.co.uk)
09:35 < gladiatr> Yeah.  Something like that.  I'm not entirely sure what the /sbin/resolvconf business is, but that is a good example of how to handle the variables that openvpn passes
09:42 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
09:43 -!- albech [~thomas@1503027373.seas-nve.dbnet.dk] has joined #openvpn
09:44 < albech> hi everyone. is it possible to bind a user to a particular IP on every connect? Preferably based on their certificate
09:49 < majuk> Yes, you can do it by common name in the openvpn/ccd folder
09:50 < albech> majuk, thanks for pointing me in that direction.. cheers
09:50 < majuk> No problem. Good luck.
09:57 < albech> just a thought.. is this a safe way to limit non-admins access to the rest of the network? So assign them the same IP every time and build firewall rules around that IP to limit their access.. What would happen if the client manually set their IP?
09:58 < ecrist> albech: it's covered in the man page, and the howto
09:58 < albech> ecrist, ohh the almighty man pages ;)
09:58 < ecrist> personally, I'd have two vpns, one for admins and one for non admins
09:59 < ecrist> or have a client connect script to open the firewall.
09:59 < albech> ecrist, yes im thinking two vpns might be better
10:03 < uuuppz> ecrist: how was the drinking session?
10:04 < ecrist> heh, we weren't drinking, uuuppz 
10:04 < uuuppz> ah I live in ireland
10:04 < uuuppz> so I presume everything involves drinking
10:05 < uuuppz> 24 hours was a conservative estimate on my part
10:07 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has joined #openvpn
10:08 <@vpnHelper> RSS Update - forum: OpenVPN connects BUT ... <http://forums.openvpn.net/topic8610.html#p14558>
10:18 -!- yell0_ [~yello@178.162.154.183] has joined #openvpn
10:19 -!- yell0 [~yello@unaffiliated/contempt] has quit [Read error: Connection reset by peer]
10:21 -!- yell0_ [~yello@178.162.154.183] has quit [Read error: Connection reset by peer]
10:25 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 252 seconds]
10:28 -!- grendal-prime_ [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
10:35 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
10:35 -!- teb76_ [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
10:36 -!- bitterman [~yury@46.41.101.253] has quit [Quit: Leaving]
10:38 < grendal-prime_> I turned in a ticket at openvpn.net and the responce i got was two schedule some meeting time via irc
10:38 < grendal-prime_> that make any sence?
10:39 < grendal-prime_> Is there a different irc channel for users of the licensed access server or does that take place here as well?
10:51 < grendal-prime_> SDQ-914679
10:52 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has quit [Ping timeout: 260 seconds]
10:53 < Bushmills> !as
10:53 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
11:14 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
11:14 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14560>
11:19 -!- grendal-prime_ [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 260 seconds]
11:20 <@vpnHelper> RSS Update - forum: Server and Client use wrong IP configuration <http://forums.openvpn.net/topic8387.html#p14561>
11:21 < oc80z> blek
11:26 < oc80z> yo ecrist
11:27 < oc80z> ...its a buildissue on openwrt's trunk SSL
11:27 < oc80z> it muzt bee. 
11:34 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
11:35 < MarKsaitis> I have a site map and I am redesigning the whole site with the new systems, servers and other computer equipment. What soft do you guys use to account and map assets on the site map and stuff?
11:37 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
11:37 -!- manitu [~manitu@p578b0cfb.dip0.t-ipconnect.de] has quit [Quit: Verlassend]
11:44 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:45 -!- gardar [~gardar@gardar.net] has joined #openvpn
11:49 -!- nutcase [~nutcase@tokerscorner.com] has quit [Ping timeout: 252 seconds]
11:51 -!- gardar [~gardar@gardar.net] has quit [Quit: bye!]
11:52 -!- gardar [~gardar@gardar.net] has joined #openvpn
12:09 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14562>
12:10 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
12:18 -!- Riz [~riz@syn.theintertubes.ca] has quit [Ping timeout: 264 seconds]
12:18 -!- Riz [~riz@syn.theintertubes.ca] has joined #openvpn
12:26 -!- dazo is now known as dazo_afk
12:33 <@vpnHelper> RSS Update - forum: change License <http://forums.openvpn.net/topic8616.html#p14564> || Can ping, but cannot route web traffic through VPN <http://forums.openvpn.net/topic8618.html#p14563>
12:35 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
12:36 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
12:37 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 276 seconds]
12:41 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Client Quit]
12:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: No route to host]
12:47 -!- JasonBoxLaptop [~jasonb@fl-76-4-159-122.dhcp.embarqhsd.net] has joined #openvpn
12:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
12:48 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
12:51 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593.html#p14565>
12:57 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
13:01 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
13:02 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Remote host closed the connection]
13:02 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
13:03 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
13:10 -!- secondchoice [~thirdchoi@198.105.46.46] has joined #openvpn
13:12 -!- woxto [piko@ip-128.net-82-216-230.roubaix.rev.numericable.fr] has joined #openvpn
13:12 < woxto> hello all
13:14 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
13:15 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593-15.html#p14566>
13:16 < woxto> is someone can help me to debug openvpn ?, i did a basic configuration , i want all the traffic go throught vpn, so i set  push "redirect-gateway def1"
13:16 < woxto> but once im connected, i can only ping the vpn network, i have no internet, i cant ping outside
13:16 < woxto> someone ?
13:19 -!- petru [~petru@79.113.44.200] has joined #openvpn
13:23 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 264 seconds]
13:37 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
13:39 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14567>
13:47 < oc80z> bah
13:49 -!- nutcase [~nutcase@tokerscorner.com] has joined #openvpn
13:56 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
13:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:00 -!- secondchoice is now known as Axeman
14:03 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 276 seconds]
14:05 < Bushmills> !redirect
14:05 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:05 < Bushmills> woxto: ^^^
14:10 < EugeneKay> woxto - you need to enable a MASQUERADE for the VPN's subnet on the server.
14:12 <+s7r> EugeneKay:   if my openvpn server would be on a win xp PC with one single pulbic IP address how would I make rules for nat the VPN ip 10.8.0.0/24 to the public IP ? iin linux i do it with iptables but windows ?
14:18 -!- JasonBoxLaptop [~jasonb@fl-76-4-159-122.dhcp.embarqhsd.net] has quit [Ping timeout: 260 seconds]
14:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 264 seconds]
14:23 < woxto> thanks EugeneKay
14:23 < EugeneKay> s7r - you would move your openvpn server off of your windows xp box
14:24 <+s7r> EugeneKay: why is not capable ?
14:24 <+s7r> to do nat
14:24 < EugeneKay> .....it's windows XP, dude.
14:25 < |Mike|> it's <3
14:26 <+s7r> i saw that you can do openvpn server on windows xp
14:26 <+s7r> if you enable ip forwarding 
14:26 <+s7r> in registry editor :P
14:26 < EugeneKay> That doesn't mean that you *should*
14:42 < |Mike|> hahaha
14:45 -!- petru [~petru@79.113.44.200] has quit []
14:57 <@vpnHelper> RSS Update - forum: Setup help <http://forums.openvpn.net/topic8622.html>
14:59 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Ping timeout: 276 seconds]
15:02  * Bushmills googles that funny term "windows XP"
15:03  * Bushmills found 'principles of extreme programming: "There must be food"'
15:03 <@vpnHelper> RSS Update - forum: Setup help <http://forums.openvpn.net/topic8622.html#p14569>
15:03 < EugeneKay> I'm hungry.
15:03  * Bushmills thinks that's a very reasonable principle
15:11 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
15:20 -!- darkdrgn2k4 [~darkdrgn2@199.243.221.174] has quit [Ping timeout: 258 seconds]
15:21 <@vpnHelper> RSS Update - forum: Need two factor solution for client <http://forums.openvpn.net/topic8623.html>
15:22 < uuuppz> Bushmills: Exteme programming is not nearly as fun as it sounds
15:24 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
15:27 < Bushmills> i can imagine, though i have never programmed an exteme
15:29 < uuuppz> Other elements of extreme programming include: programming in pairs or doing extensive code review, unit testing of all code, avoiding programming of features until they are actually needed,
15:29 -!- thepacmanfan [~thepacman@tri-lakes-net-2344.bran.customer.centurytel.net] has joined #openvpn
15:29 < Bushmills> yes, with extreme programming i'm a bit more familiar
15:30 < Bushmills> and no chairs :)
15:30 < uuuppz> heh I hate the idea of watching someone code
15:30 < uuuppz> :)
15:30 < Bushmills> well, during meetings, anyway
15:31 < thepacmanfan> i need to connect to Mikrotik from a Windows laptop that's tethered to an Android phone on Sprint. can anyone point me in an informative direction?
15:33 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
15:33 < Bushmills> mikrotik support openwrt, afaik. which in turn supports openvpn.  androids would have to be jailbroken, and still may exhibit some strange problems
15:34 < thepacmanfan> i don't care if openvpn is running on my phone or not... my end goal is to have the laptop connected to a VPN hosted on mikrotik
15:34 < Bushmills> ehm ... "from windows laptop"... nm jailbreak
15:35 < thepacmanfan> pptp and l2tp work fine over wifi, but 3G tethering kills it :(
15:35 < Bushmills> you'll need openvpn on windows
15:35 < thepacmanfan> over 3G, pptp and l2tp work when the phone is the client, but not when i try and use the windows client on the laptop
15:35 < thepacmanfan> i guess the phone is NATing the laptop?
15:35 < Bushmills> having pptp there won't help to connect to openvpn server on other end
15:36 < Bushmills> yes, that's the idea
15:36 < thepacmanfan> well, mikrotik has pptp, l2tp and openvpn built in. i just want something that works, and i'm wondering if openvpn is the only way.
15:36 < thepacmanfan> i have servers for all 3 running in mikrotik
15:37 < Bushmills> openvpn is the only way you'll be told about on #openvpn
15:37 < thepacmanfan> is there any way to set it up with passphrase-only authentication? i was trying to use cacert last night, and that's a royal PITA, since i'm trying to use a dyndns host
15:37 < Bushmills> not true, actually, there's also something #openvpn says about pptp;:
15:37 < Bushmills> !pptp
15:37 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
15:37 <@vpnHelper> read about why to not use pptp, or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
15:38 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Client Quit]
15:38 < thepacmanfan> hehe... i would prefer l2tp if possible
15:38 < thepacmanfan> but ultimately, i need a working vpn
15:38 < Bushmills> sorry, wrong channel :)
15:38 < thepacmanfan> i meant i would prefer l2tp over pptp
15:39 < thepacmanfan> but with openvpn, can i do passphrase-only auth with a mikrotik server? i've been finding conflicting info.
15:39 < Bushmills> just one machine needing to connect?
15:39 < thepacmanfan> yep
15:39 < Bushmills> use static keys
15:39 < Bushmills> !howto
15:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:40 < Bushmills> quickstart
15:40 < thepacmanfan> don't need a cert for that?
15:40 < Bushmills> nope
15:40 < thepacmanfan> hmm
15:40 < Bushmills> setting up your CA makes sense for several boxes to connect
15:41 < thepacmanfan> can i just strike the ca lines from the client config file? it was throwing an error when i just commented them
15:42 < Bushmills> read "quick start" section
15:42 < thepacmanfan> i found the static key mini howto page, that looks good
15:43 < thepacmanfan> do you know for sure if only public keys works fine on the mikrotik end?
15:43 < Bushmills> rephrase
15:44 < thepacmanfan> do you know for sure if, with mikrotik's inbuilt ovpn server, i can skip the ca and just use private key auth?
15:45 < Bushmills> yes. that's one of the alternatives to PKI infrastructure
15:45 < Bushmills> !pki
15:45 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs), or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
15:45 <@vpnHelper> signed specially as a server (see !servercert)
15:45 < thepacmanfan> alrighty :)
15:46 < thepacmanfan> thanks!
15:46 < Bushmills> np
15:46 -!- IamTrying [~IamTrying@94-224-200-219.access.telenet.be] has joined #openvpn
15:47 < IamTrying> How can i use the OpenVPN in my Linux box to connect same as i am doing on right screen shot ? e.g: http://i.imgur.com/o7rSJ.png
15:49 -!- woxto [piko@ip-128.net-82-216-230.roubaix.rev.numericable.fr] has quit []
16:01 <@vpnHelper> RSS Update - forum: change License <http://forums.openvpn.net/topic8616.html#p14573> || Need two factor solution for client <http://forums.openvpn.net/topic8623.html#p14572> || Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14571>
16:05 -!- Axeman [~thirdchoi@198.105.46.46] has quit [Read error: Operation timed out]
16:14 < EugeneKay> IamTrying - OpenVPN is not a thing that runs in your browser like that.
16:15 < IamTrying> EugeneKay, i do not want to use the Browser like this. Specially i want to use my Linux box instead of Windows Box. So how can i use OpenVPN to connect using my terminal ?
16:16 < EugeneKay> Connect to what? You need to have an OpenVPN server to connect to. It won't work with $vpn_program
16:17 < IamTrying> EugeneKay, In a Airport i have my server. It is behind a FortiGate1 SSL VPN router. FRom linux i cant connect to that router.
16:18 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
16:18 < IamTrying> This is how i am doing beause i do not have anything in linux (but in this way i cant send lot of files i need to update such as php/java applications)  e.g: http://i.imgur.com/o7rSJ.png
16:18 < EugeneKay> AFAIK, FortiGate / FortiNet's "ssl vpn" is not an OpenVPN implementation. So you can't.
16:30 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:31 -!- thepacmanfan [~thepacman@tri-lakes-net-2344.bran.customer.centurytel.net] has quit [Quit: Nettalk6 - www.ntalk.de]
16:35 < IamTrying> EugeneKay, this is only way i am using now from Linux, but many keyboard inputs in vi/vim is not working e.g: http://i.imgur.com/6C1Xx.png
16:36 < EugeneKay> This is not a support channel for Fortigate.
16:36 < krzee> im trying to cook a oven pizza, what should i pre-heat to?
16:37 < IamTrying> EugeneKay, yes but how can i write in OpenVPN this tool myself then? e.g: http://i.imgur.com/6C1Xx.png
16:38 < EugeneKay> <EugeneKay> IamTrying - OpenVPN is not a thing that runs in your browser like that.
16:39 < IamTrying> No i want to embed on OpenVPN the https://anyFortiGateshits username/password and my java apps will show up in terminal instead of there stupid browser gui.
16:40 -!- majuk [~majuk@72-48-250-109.dyn.grandenetworks.net] has joined #openvpn
16:42 < EugeneKay> <EugeneKay> Connect to what? You need to have an OpenVPN server to connect to. It won't work with $vpn_program
16:42 < EugeneKay> <EugeneKay> AFAIK, FortiGate / FortiNet's "ssl vpn" is not an OpenVPN implementation. So you can't.
16:42 < EugeneKay> Unlike in the movies, you can't just bypass the primary firewall's encryption by backtracing the 2048-bit rsa key using a spectro-RNG anaylzer.
16:44 < IamTrying> EugeneKay, you mean European Airport's  technical professionals are using a wrong Router ? Which does not follow OpenVPN standard? And they should throw those VPN routers to trash beause OpenVPN is not in this?
16:45 < EugeneKay> What I'm saying is that you're trying to do a thing with another thing that the thing does not do.
16:45 < EugeneKay> If you want help with FortiGate, go ask them(or your sysadmin) about it. We don't do that here.
16:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
16:50 < IamTrying> Thank you. Its clear now, i was expecting more, misunderstood.
16:50 < IamTrying> This is very bad router in anyway. It sucks for Linux only designed for Windows. Can i use OpenVPN as server (bsd) and client (windows/linux/mac)?
16:52 < EugeneKay> Sure.
16:53 < IamTrying> Cool, thank you
16:55 <+s7r> http://www.pcworld.com/article/236944/internet_explorer_users_are_kinda_stupid_study_suggests.html
16:55 <@vpnHelper> Title: Internet Explorer Users Are Kinda Stupid, Study Suggests | PCWorld (at www.pcworld.com)
16:55 <+s7r> they didn't get me yet i am windows user but not IE :) stick to firefox
16:55 <+s7r> haha
16:56 < EugeneKay> Except that "study" was totally faked.
16:57 <+s7r> ah .. don't believe in it anyway. just shared it seamed interesting to laugh at
16:57 <+s7r> who would spend money to make such an useles study?
16:57 < IamTrying> s7r, you should never use even Windows, study should approve it too. (pay + be stupid is what windows system is)
16:57 <+s7r> IamTrying: I won't take that personal
16:57 <+s7r> it seams to me like you run windows too in your virtual box
16:57 < IamTrying> No
16:58 <+s7r> why not run windows? it's reliable, 90% of the planet uses it ... etc.
16:58 < IamTrying> Its kick start test, and again using headless windows.
16:58 <+s7r> i use linux also but on servers.. on my personal computer and laptop i don't need linux
16:58 < IamTrying> s7r, 90% are stupids
16:59 <+s7r> yeah . 90% of people are stupid. i assume you are lucky you take part in the very few 10% super smart :D
16:59 < IamTrying> s7r, i went to Airport 500% use Windows, and they are nonsense. 
16:59 < IamTrying> s7r, they are using Old (1980's) craps systems and kind of dust overall, and never want to change old to new.
17:00 <+s7r> what does this have to do with someone using a new system with a good windows properly configured
17:01 <+s7r> anyway... we can't be all the same. each of us has his opinion and i respect that 
17:01 <+s7r> told you i also use linux and find it cool but on daily basis .. personal computer... i find windows much more useful
17:01 < IamTrying> s7r, a millions to do, look at Crestron designed for Windows shit, which i can do with Linux/Bsd too and in cheap.
17:02 < IamTrying> U r wrong when you mean Windows useful. Its good for nothing, just good for "cost increment" like Apple is doing too.
17:02 < EugeneKay> #openvpn is also not #os-debate
17:03 < IamTrying> EugeneKay, s7r started i was just excited :)
17:03 <+s7r> apple is shit
17:03 < IamTrying> oviously its shit, anything closed source is shit.
17:04 <+s7r> :D
17:06 <+s7r> they will never beat 
17:07 < IamTrying> s7r,  Its like "Wind moves to stupids", stupids love to pay more, and all software is designed to help those stupids specially those Windows/Apple one
17:07 < IamTrying> c u later, time to read book
17:08 <+s7r> I find much more stupid the people who try so hard to do a simple thing
17:08 <+s7r> which is done in windows with 1 click
17:08 < EugeneKay> Eh. If you want stupid, look for the guy talking about how stupid $PEOPLE are using "u", "r", and "c"
17:10 < IamTrying> I am a crestron/extron developer. I build softwares and home apps, for very expensive price but it will only work for Windows. So my customers are stupids who want click and touch. I can also give them linux but they want to pay more i give them there stupid Windows s7r 
17:10 <+s7r> because they respect themselves :)
17:10 <+s7r> money not a problem
17:10 < IamTrying> Its a brand "Mircoshit"
17:10 <+s7r> windows users are rich
17:10 <+s7r> :)))
17:11 <+s7r> haha that's why you eat daily thanks to Microshit
17:11 <+s7r> and the apps you do for them
17:11 <+s7r> indirectly, you support windows also by making apps for it
17:11 <+s7r> so thanks
17:12 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Read error: Operation timed out]
17:12 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
17:12 < IamTrying> No, i build that with hate. Because they deserve shit not intelligent open os/open softwares.
17:13 <+s7r> ok. you be intellinget and let 90% of us to be stupid :)
17:13 <+s7r> i am really happy you are not stupid like us
17:13 <+s7r> you are so blessed
17:13 < IamTrying> Yea take that, thanks
17:14 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
17:21 -!- IamTrying [~IamTrying@94-224-200-219.access.telenet.be] has quit [Quit: Leaving]
17:26 -!- hpa is now known as hpa_MBJ
17:26 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:27 < n2deep> Hi what is the best way to have a Linux client get the correct DNS name servers when the openvpn client connects?
17:27 < n2deep> ... as in automation
17:33 < EugeneKay> push "dhcp-option DNS 8.8.8.8"
17:35 < n2deep> EugeneKay: I put that into the server config, my Linux client did not pick that up
17:35 < n2deep> (my custom DNS server)
17:39 < EugeneKay> From the manpage on the option: will configure Windows clients (or non-Windows clients with some extra server-side scripting) to use 10.8.0.1 as their DNS server. 
17:40 < EugeneKay> Sorry, howto, not man.
17:40 < EugeneKay> And that should be client, not server.
17:40 < EugeneKay> Stupid man pages.
17:41 < EugeneKay> You need to have a client-side --up script that takes the dhcp-option and makes it do something
17:42 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:42 < EugeneKay> The best way to handle this is dependent upon your linux distro.
17:48 <+s7r> I have on the server openvpn v2.0.9 installed. i need to mail a client with the ovpn, certs and also client.. could I give link with the latest 2.2.1 version from openvpn.net or I need to have the same version on the server and client side ?
17:48 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
17:49 < EugeneKay> It should work fine cross-version
17:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
17:50 < EugeneKay> The other way around might have issues(higher server than client) if you're using some of the new features
17:52 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
17:52 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:52 -!- Nappy_ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has joined #openvpn
17:53 <+s7r> great
17:53 <+s7r> there is no way to make the 10mbps speed from tap/tun adapter bigger ?
17:53 <+s7r> i know it does not have anything to do with the actual speed, but i want to know if i can increase it
17:55 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
17:55 -!- mode/#openvpn [+v Axeman] by ChanServ
17:56 -!- Nappy [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Ping timeout: 276 seconds]
17:56 < EugeneKay> FWIW, googling for "openvpn windows tap link speed" answers your question far better than I ever could.
17:57 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Remote host closed the connection]
17:58 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
18:00 -!- majuk [~majuk@72-48-250-109.dyn.grandenetworks.net] has quit [Ping timeout: 260 seconds]
18:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:04 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 255 seconds]
18:10 < n2deep> EugeneKay: Do you have a good pointer for a good client side --up script? anything that you use personally you can reccomend?
18:10 < EugeneKay> Nope.
18:11 < EugeneKay> I don't run split-horizon DNS, so all my stuff works equally well with a well-behaved public resolver(8.8.8.8) or my local DNS servers.
18:11 <+s7r> EugeneKay:  i have done some reading and did not find how to increase the 10mbps default speed of tun adapter
18:11 < EugeneKay> s7r - tl;dr the Link Speed is a holdover. Try it, it should go faster than 10mb
18:12 <+s7r> how
18:13 < EugeneKay> By doing it
18:16 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:17 < n2deep> EugeneKay: as far a --up script goes, that will need to be on each client, and where does it get specified? In the .ovpn file?
18:17 < EugeneKay> Yes, yes.
18:26 -!- albech [~thomas@1503027373.seas-nve.dbnet.dk] has quit [Quit: Ex-Chat]
18:30 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
18:50 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:53 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
18:54 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has joined #openvpn
18:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
18:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
18:58 -!- mode/#openvpn [+o mattock] by ChanServ
18:59 -!- p3rror [~mezgani@41.140.171.77] has joined #openvpn
18:59 -!- Derechista [~Derechist@189.214.159.6.cable.dyn.cableonline.com.mx] has joined #openvpn
18:59 < Derechista> hi
18:59 < Derechista> how do I chat on a server using open vpn?
19:00 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
19:00 < Derechista> I try to set everything up, and it doesn't work
19:00 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:03 < EugeneKay> OpenVPN is not a chat service.
19:03 < Derechista> I was told that there was an irc server
19:03 < Derechista> through openvpn
19:03 < Derechista> or something like that
19:03 < Derechista> this was the info they gave me
19:03 < Derechista> 184.82.43.30 or 184.82.43.31 , port 9002, user : www pass : eoting99
19:04 < EugeneKay> You've just compromised that information. The person who gave that to you should now change it.
19:04 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Quit: >:o]
19:04 < EugeneKay> There may be one accessible through somebody's OpenVPN, but this is not a program that provides IRC by itself.
19:04 < Derechista> I tried to enter the info
19:04 < Derechista> and it says that there are parameters missing
19:04 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
19:05 < EugeneKay> Into your IRC client? That would make sense, as OpenVPN is not an IRC server.
19:09 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Quit: Will return someday...]
19:14 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
19:14 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
19:17 -!- grendal-prime_ [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has joined #openvpn
19:21 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
19:23 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has quit [Ping timeout: 255 seconds]
19:25 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:41 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Read error: Operation timed out]
19:47 -!- p3rror [~mezgani@41.140.171.77] has quit [Ping timeout: 255 seconds]
19:53 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Quit: >:o]
19:55 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
19:57 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
19:57 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
19:57 -!- mode/#openvpn [+v Axeman] by ChanServ
20:02 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
20:04 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has joined #openvpn
20:16 -!- Denial [~Denial@drgi.co.uk] has quit []
20:33 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
20:33 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:45 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
20:56 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 263 seconds]
21:01 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
21:01 -!- Derechista is now known as Castizo
21:16 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
21:24 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Quit: ZNC - http://znc.in]
21:24 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
21:25 -!- p3rror [~mezgani@41.140.96.181] has joined #openvpn
21:28 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
21:41 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Remote host closed the connection]
21:44 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
21:44 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14574>
21:44  * ecrist hails from Anamosa, IA
21:45 < EugeneKay> Iowa is a hell of a drug
21:52 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 255 seconds]
21:53 -!- gyyrog [~gyyrog@99.181.158.238] has joined #openvpn
21:56 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:58 -!- gyyrog [~gyyrog@99.181.158.238] has quit [Remote host closed the connection]
22:09 -!- Castizo [~Derechist@189.214.159.6.cable.dyn.cableonline.com.mx] has quit [K-Lined]
22:13 -!- Squidy [~quassel@200-163-63-158.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
22:13 -!- Squidy [~quassel@200-163-63-158.cbace702.dsl.brasiltelecom.net.br] has quit [Changing host]
22:13 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
22:15 -!- doublehp [~DoubleHP@2a01:e35:8ba8:e140::52] has joined #openvpn
22:16 < doublehp> hy; people around ? << error=unsupported certificate purpose >> any one can help ?
22:16 < EugeneKay> Yup. Yup. Your certificate is improperly signed.
22:17 < doublehp> as u'r around, i ll paste bin what i did
22:18 < doublehp> mail part http://pastebin.com/Y7aapfcd
22:18 < doublehp> server log http://pastebin.com/FQp6QKRQ
22:19 < doublehp> client log http://pastebin.com/xSykr7NQ
22:20 < doublehp> if you say i improperly signed some cert, what's wrong ? you should be able to find the mistake in the first paste. Commands were run as you see, in easy-rsa folder, according to http://openvpn.net/index.php/open-source/documentation/howto.html
22:20 <@vpnHelper> Title: HOWTO (at openvpn.net)
22:21 < EugeneKay> Hm. That looks right.
22:21 < doublehp> i wollowed the tutorial twice to the letter, and typed all commands in the same terminal, so that sourcing ./vars would ... how to say it ... be valid :)
22:22 < doublehp> maybe the conf files should mention server-leon.crt instead of ca.crt ?
22:22 < EugeneKay> To be honest, I don't use easy-rsa myself, but that LOOKS right.
22:22 < doublehp> if yopu have a better tuto ... details step by step ...
22:22 < EugeneKay> Both ends should have ca ca.crt
22:22 < EugeneKay> The server should have the server.crt, and the client the client.crt
22:24 < doublehp> error is on client side
22:24 < EugeneKay> Indeed. The client is barfing because something isn't right with the client.crt....
22:24 < doublehp> an other tuto says I should use -extensions client_cert at some point, unlkess it's included in easy scripts. If you have an other tuto, i take it
22:25 < EugeneKay> easy-rsa should have that --extension set
22:25 < doublehp> grep says no script does
22:26 < kenyon> it's probably in openssl.cnf
22:26 < kenyon> lots of extension stuff in there
22:29 -!- krphop is now known as krphop_afk
22:29 < doublehp> what about csr files ?
22:29 < doublehp> it's generated by server, and tuto does not say to move it around
22:30 < EugeneKay> Those are used to sign the keys(and thus create the crts)
22:31 < EugeneKay> Once the .crt is created, you can rm 'em
22:32 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
22:37 < doublehp> wahoo ... after 6h, the issue was ...  server was using client certs :)
22:37 < EugeneKay> Laugh
22:37 < doublehp> ( but still does not work ; other issues  )
22:38 < doublehp> I thought the server had to be informed about client cert, to avoit having random users use random tunnels
22:41 -!- twister004 [~chatzilla@59.90.34.167] has joined #openvpn
22:43 < doublehp> new error on client: http://pastebin.com/A4WrbatN Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:4: route (2.1.1)
22:51 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
23:01 <@vpnHelper> RSS Update - forum: Multiple instance OpenVPN via OpenVZ -- Centos 5.5 <http://forums.openvpn.net/topic8624.html>
23:02 < EugeneKay> To state the obvious, you have something wrong with one of your push options.
23:02 < EugeneKay> !configs
23:02 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
23:07 < doublehp> client : http://pastebin.com/ra2FY2qR openvpn version unknown, Android 2.3.3
23:08 < doublehp> server http://pastebin.com/TEVcCWGt old Debian 
23:09 < doublehp> server: OpenVPN 2.2.0 i486-linux-gnu
23:09 < doublehp> client OpenVPN 2.1.1 i686-pc-linux-gnu ( 2.1_rc15 available on demand )
23:09 < doublehp> and NO i can not update any of those machines to make version match; absolutely impossible 
23:10 < doublehp> CCDs ?
23:11 < Olipro> isn't the dhcp option push something used for windows clients
23:12 < EugeneKay> Aye, but Android should ignore it silently
23:12 < Olipro> but that appears to be the only thing he's pushing
23:12 < Olipro> everything else is commented out
23:13 < EugeneKay> Which doesn't make much sense
23:13 < doublehp> i don't know what a dhcp-option means ... i just pasted
23:14 < Olipro> so you have no idea what a config line does
23:14 < Olipro> but you figured you'd toss it in there anyway
23:15 < doublehp> the conf is cloned from a working conf (working for very similar android phone )
23:16 < doublehp> anyway, DNS line does not seem to be responsible for error; errors are about route and ifconfig ...
23:16 < doublehp> uncomenting redirect-gateway (which is active on my friend's conf) did not help
23:17 < Olipro> thing is, you're not pushing a route
23:17 < Olipro> that or the config you're showing us isn't really the one you're running right now
23:17 < doublehp> i pasted what i am using ATM
23:17 < doublehp> (cat conf | pastebinit - for server )
23:19 < doublehp> client gives this in logs: Wed Aug 10 05:55:22 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.8.1,topology net30,ping 10,ping-restart 60,ifconfig 192.168.8.6 192.168.8.5'
23:19 < doublehp> so I bet the server sends a route somehow :D
23:20 < doublehp> i don't understand why this line mentions 192.168.8.6 and 8.5 ... THIS does not make sens to me at all
23:23 < Olipro> .6 is your IP
23:23 < Olipro> .5 is the other end's IP
23:25 < doublehp> no, server tun0 IP is 8.1
23:27 -!- EugeneKay is now known as EugeneKaway
23:27 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
23:33 < doublehp> so , any idea ?
23:43 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
23:46 -!- grendal-prime_ [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
23:50 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:53 <@vpnHelper> RSS Update - forum: Multiple instance OpenVPN via OpenVZ -- Centos 5.5 <http://forums.openvpn.net/topic8624.html#p14576>
--- Day changed Wed Aug 10 2011
00:08 < doublehp> is it possible that ping does not go throuth TUN ?
00:08 < doublehp> is it possible that ping does not go throuth TAP ?
00:13 < doublehp> rebooting gateway ...
00:13 -!- doublehp [~DoubleHP@2a01:e35:8ba8:e140::52] has quit [Quit: Leaving.]
00:18 -!- doublehp [~DoubleHP@2a01:e35:8ba8:e140::52] has joined #openvpn
00:26 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
00:32 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:35 <@vpnHelper> RSS Update - forum: Multiple instance OpenVPN via OpenVZ -- Centos 5.5 <http://forums.openvpn.net/topic8624.html#p14577>
00:39 < doublehp> thanks for help
00:40 < doublehp> tunnel works in a strange way: i have moved to tap, conf files all only say about 192.168.8.1/24 ... ping does not work over tunnel, BUT, ping6 to peer works ...
00:41 <@vpnHelper> RSS Update - forum: change License <http://forums.openvpn.net/topic8616.html#p14578>
00:53 <@vpnHelper> RSS Update - forum: Multiple instance OpenVPN via OpenVZ -- Centos 5.5 <http://forums.openvpn.net/topic8624.html#p14579>
00:57 -!- doublehp [~DoubleHP@2a01:e35:8ba8:e140::52] has quit [Quit: Leaving.]
00:59 <@vpnHelper> RSS Update - forum: Multiple instance OpenVPN via OpenVZ -- Centos 5.5 <http://forums.openvpn.net/topic8624.html#p14580>
01:05 <@vpnHelper> RSS Update - forum: Multiple instance OpenVPN via OpenVZ -- Centos 5.5 <http://forums.openvpn.net/topic8624.html#p14582>
01:10 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Remote host closed the connection]
01:10 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has joined #openvpn
01:11 < Bushmills> doublehp, tun or tap let pings through
01:20 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 255 seconds]
01:31 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has quit [Ping timeout: 255 seconds]
01:36 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
02:05 <@vpnHelper> RSS Update - forum: another request <http://forums.openvpn.net/topic8625.html>
02:06 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
02:15 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
02:22 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 250 seconds]
02:25 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 276 seconds]
02:30 < Mowee> Morning
02:36 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14584>
02:42 <@vpnHelper> RSS Update - forum: See close connections in log <http://forums.openvpn.net/topic8626.html> || Jumping ping using OpenVPN <http://forums.openvpn.net/topic8615.html#p14585>
02:43 -!- tkil [~tony@c-71-228-115-181.hsd1.nm.comcast.net] has joined #openvpn
02:43 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Ping timeout: 264 seconds]
02:46 -!- dazo_afk is now known as dazo
02:47 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
02:49 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
03:12 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
03:18 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
03:18 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
03:18 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
03:18 <@vpnHelper> RSS Update - forum: See close connections in log <http://forums.openvpn.net/topic8626.html#p14587>
03:33 -!- corretico [~luis@201.201.44.82] has joined #openvpn
03:40 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
03:50 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
03:52 -!- jemand [~quassel@brln-4db9f79b.pool.mediaWays.net] has joined #openvpn
03:59 -!- dvdr [~fred@66.23.233.37] has joined #openvpn
04:00 < dvdr> i have an openvpn connection running on my desktop. How can I connect my laptop to the desktop and share the vpn connection?
04:01 < dvdr> I tried routing packets from eth0 (my local connection to the laptop) to tun0 but of course that didn't work
04:07 < Olipro> dvdr: you will need to setup routing on both ends
04:07 < dvdr> Olipro:oh. I'm using a commercial service.
04:07 < Olipro> you *may* be able to get away with doing routing on one end only if you assign an address on the laptop that's in the same subnet as is used for the tunnel
04:07 < Olipro> otherwise, SNAT
04:08 < Bushmills> "of course" it didn't work??
04:08 < dvdr> Olipro: I was hoping it might have been something to do with tun vs tap interfaces
04:08 < Bushmills> you'd set up your desktop as masquerating gateway
04:09 < Olipro> *masquerading
04:09 < Bushmills> that's one way. depending on what you want to reach with your laptop, there may be others
04:09 < Olipro> dvdr: well, if it's a TAP interface then assigning an IP to the laptop that's in the same subnet will work if you bridge it
04:10 < dvdr> im trying to get ALL traffic through, all ports etc as if it was directly connected to the www
04:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:11 < Olipro> so um
04:11 < Olipro> does this VPN service assign you a global unicast IP address?
04:11 < dvdr> Olipro: I'm just using the default config files, I'm brand new to Openvpn and vpns in general. In the config file it sets a tun interface
04:11 < Bushmills> that setup is done with and to the operating system
04:12 < dvdr> I tried changing that to "tap" but it wouldn't connect then
04:12 < Olipro> yes, then the other end expects tun and tun only
04:12 < Bushmills> in that context, openvpn is just like any pair of interfaces with a cable between two machine 
04:12 < Bushmills> s
04:12 < dvdr> ok
04:12 < Olipro> again, what sort of IP does it give you
04:12 < dvdr> sorry im not sure
04:12 < Olipro> is it a private one, or a global one
04:12 < dvdr> oh global
04:13 < Olipro> sigh
04:13 < Olipro> just tell me the IP
04:13 < dvdr> 10.44.0.xx
04:13 < Olipro> ok, that's a private address
04:13 < Olipro> as in, not reachable from the internet
04:13 < dvdr> ok
04:14 < Olipro> in any case, the routing table on the other end quite probably will only route the single address it allocates to you
04:15 < dvdr> ok. So no go?
04:15 < Olipro> so you will need to SNAT or MASQUERADE
04:15 < dvdr> ok cool. Ill go do some reading on that
04:16 < dvdr> thanks for your help
04:20 -!- Essobi_ [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 240 seconds]
04:44 <@vpnHelper> RSS Update - forum: See close connections in log <http://forums.openvpn.net/topic8626.html#p14588>
04:47 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
04:47 -!- naquad [~naquad@174.142.224.219] has quit [Quit: ZNC - http://znc.sourceforge.net]
04:47 -!- p3rror [~mezgani@41.140.96.181] has quit [Ping timeout: 255 seconds]
04:48 -!- jasonb [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
04:48 -!- Nappy_ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has quit [Ping timeout: 255 seconds]
04:48 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
04:48 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 255 seconds]
04:48 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Remote host closed the connection]
04:49 -!- Nappy_ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has joined #openvpn
04:49 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
04:50 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
04:51 -!- MushroomNZ2 [~MushroomN@121-72-232-59.cable.telstraclear.net] has joined #openvpn
04:51 < MushroomNZ2> anyone about for some pointers? 
04:52 < MushroomNZ2> !factoids
04:52 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
04:53 < Bushmills> http://www.identifont.com/samples/altemus/PointersBold.gif  <- pointers
04:53 < MushroomNZ2> nice
04:53 < MushroomNZ2> not quite what i had in mind :-)
04:54 -!- naquad_ [~naquad@174.142.224.219] has joined #openvpn
04:54 < tkil> MushroomNZ2 -- try asking, rather than asking-to-ask.  :)
04:54 -!- tkil [~tony@c-71-228-115-181.hsd1.nm.comcast.net] has left #openvpn ["Leaving"]
04:54 -!- tkil [~tony@c-71-228-115-181.hsd1.nm.comcast.net] has joined #openvpn
04:54 < tkil> grr... stupid lack of "focus follows attention" in x windows...
04:56 < MushroomNZ2> ok, have to connect to a box on the internet, have been provided opvn files which i have put in my C:\Program Files (x86)\OpenVPN\config, running openvpn as admin, I can choose the pre definded config and connect, trouble is I have no idea of the ip of the box i need to get to, also should i loose all my internet even though the config sets my dns to google (8.8.8.8)?
04:59 < tkil> after you've successfully connected, try a cmd window and see if the output at "ipconfig /all" is helpful?
04:59 < tkil> i barely know openvpn and certainly not on windows, sadly.
05:00 -!- naquad_ [~naquad@174.142.224.219] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:00 < MushroomNZ2> Ethernet adapter Local Area Connection 4:
05:00 < MushroomNZ2>    Connection-specific DNS Suffix  . : 
05:00 < MushroomNZ2>    Link-local IPv6 Address . . . . . : fe80::6847:3caf:ad92:488b%25
05:00 < MushroomNZ2>    IPv4 Address. . . . . . . . . . . : 10.128.123.14
05:00 < MushroomNZ2>    Subnet Mask . . . . . . . . . . . : 255.255.255.252
05:00 < MushroomNZ2>    Default Gateway . . . . . . . . . : 
05:00 < MushroomNZ2> hmm i see no gateway
05:00 < tkil> um.  use a paste bin, not the channel.  :(
05:01 < MushroomNZ2> ok sorry
05:01 < tkil> so it sounds like your windows vpn client isn't setting the route properly (or the config file doesn't have it.)
05:01 < tkil> i'll have to punt on this one, i simply don't know win32 networking well enough to help.  :(
05:01 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
05:02 < tkil> good luck.  if you wait a while on this channel, and ask every few hours, you should be able to get some help.
05:02 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
05:02 -!- mode/#openvpn [+o mattock] by ChanServ
05:02 < MushroomNZ2> ok, ta...
05:08 < MushroomNZ2> heres my log file http://pastebin.com/kphiBppJ
05:10 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
05:12 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:12 -!- mode/#openvpn [+v s7r] by ChanServ
05:12 <@vpnHelper> RSS Update - forum: VPN-Server on a VServer by netcup <http://forums.openvpn.net/topic8627.html>
05:20 -!- twister004_ [~chatzilla@59.90.34.167] has joined #openvpn
05:20 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
05:20 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
05:21 -!- quadDama1e [~EmperorTo@216.17.68.153] has joined #openvpn
05:22 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
05:23 -!- _zero__ [~zero@noc.toile-libre.net] has joined #openvpn
05:26 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Read error: Connection reset by peer]
05:26 -!- nebby-jay [~nebajoth@starfighter.org] has joined #openvpn
05:27 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
05:27 -!- naquad [~naquad@174.142.224.219] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:27 -!- quadDamage [~EmperorTo@216.17.68.153] has quit [Read error: Connection reset by peer]
05:27 -!- batrick [~batrick@nmap/developer/batrick] has quit [Ping timeout: 255 seconds]
05:27 -!- Nappy_ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has quit [Ping timeout: 255 seconds]
05:27 -!- twister004 [~chatzilla@59.90.34.167] has quit [Ping timeout: 255 seconds]
05:27 -!- nebajoth [~nebajoth@starfighter.org] has quit [Ping timeout: 255 seconds]
05:27 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Ping timeout: 255 seconds]
05:27 -!- jasonb [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 255 seconds]
05:27 -!- jasonb [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
05:27 -!- nebby-jay is now known as nebajoth
05:29 -!- jemand [~quassel@brln-4db9f79b.pool.mediaWays.net] has quit [Remote host closed the connection]
05:29 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
05:33 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:34 -!- Nappy_ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has joined #openvpn
05:35 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
05:39 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
05:55 < MushroomNZ2> Myabe someone could help me, i have been given a set of openvpn files, installed openvpn and can connect to the server on the other end, at the moment my trouble is I am unable to a) get to any ip's once connected and b) loose all normal internet access <- is that normal? Pastebin's of route prints, ipconfigs, openvpn logs if your able to help/assist? http://pastebin.com/YucZZqnm  http://pas
05:55 < MushroomNZ2> tebin.com/cR1J9z9i  http://pastebin.com/P7KU8iQT  http://pastebin.com/kphiBppJ
06:03 < Bushmills> MushroomNZ2: check route, see what destination is routed where to 
06:04 < Bushmills> "normal" .. no.  either traffic to vpn subnet is routed through vpn, or more. if more is routed, the server need to take care of routing it onwards to respective destinations
06:06 < MushroomNZ2> ok, i have the pastebin of the route up at the moment..
06:06 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
06:06 < Bushmills> oh, you don't need to paste it. your can look at it
06:07 < MushroomNZ2> sorry, i was just looking at my output from my route print on pastebin
06:08 -!- twister004_ [~chatzilla@59.90.34.167] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
06:08 < MushroomNZ2> i see i have 0.0.0.0 going to two different gateways
06:09 < MushroomNZ2> the new ip's are the 10.128.123.xxx to the server i am connecting too
06:09 < MushroomNZ2> should i be able to ping the gateway?
06:10 < Bushmills> one of the 0.0.0.0. gateways has a netmask of 128.0.0.0?
06:10 < MushroomNZ2> yes
06:10 < Bushmills> most likely the result of def1 in config.  all traffic should be routed through openvpn
06:11 < Bushmills> in that case, for reaching arbitrary internet hosts, server must ...
06:11 < Bushmills> !redirect
06:11 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
06:12 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:12 < MushroomNZ2> is this something at my end i need to change or talk to the admin of the server?
06:30 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 264 seconds]
06:36 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
06:37 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
06:42 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
06:46 < Kartagis> hi
06:46 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
06:46 < Kartagis> do you know of a GUI client that asks for username/password?
06:49 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:51 <@dazo> Kartagis: which OS?
06:51 <@vpnHelper> RSS Update - forum: VPN-Server on a VServer by netcup <http://forums.openvpn.net/topic8627.html#p14590>
06:52 < Kartagis> dazo: at the moment linux, but I'll need for windows and mac too
06:53 < Kartagis> dazo: I'm trying to configure my server for mysql authentication
06:53 < Kartagis> dazo: I'll get those clients, pre-configure and put them on my web site
06:54 <@dazo> Kartagis: If using NetworkManager, NetworkManager-openvpn supports username/password auth ... default Windows GUI supports it (requires --auth-user-pass in config file), and the same for Tunnelblick, afaik
06:54 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
06:54 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
06:55 <@dazo> Then you basically cover 90% of the most common OpenVPN GUIs
06:55 < Kartagis> dazo: in creating VPN connection, PPTP is the only option
06:55 < Kartagis> do I go for PPTP?
06:56 <@dazo> Kartagis: have you installed the NetworkManager-openvpn plugin?
06:56 <@dazo> you have most likely just NetworkManager-pptp installed
06:56 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
06:56 <@dazo> (which will *not* work)
06:56 < Kartagis> oh, it's a separate one
06:56 <@dazo> yeah
06:57 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
06:57 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
06:57 < Kartagis> dazo: but I want something simple for my possible clients
06:59 <@dazo> Kartagis: well, that's what most users use, and that's what's being maintained ... I don't know of others ... there is gopenvpn, but that's not easy to get working on all distroes, and might require compilation ... I'd say that's a bigger hurdle
07:01 <@dazo> NetworkManager has become de-facto preferred solution on Linux ... hate it or love it ... the potential for success on Linux is higher with NetworkManager, IMHO
07:01 < Kartagis> hmm
07:01 < Kartagis> what's the easiest way to configure my server with mysql then?
07:02 < Kartagis> chantra?
07:05 < amero> how do i get private ip of my virtual interface on my server accessible for vpn clients?
07:15 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
07:19 -!- jasonb [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 255 seconds]
07:22 < Bushmills> MushroomNZ2: that's to be done server-side
07:23 < Bushmills> amero: you don't.  you use the openvpn subnet address of server
07:23 < dvdr> i have an openvpn connection running on my desktop. A tun interface appears on the desktop when openvpn logs in. I am running a wireless accesspoint on the desktop, and connecting to it with my laptop. I can ping the desktop from the laptop so the wireless AP is working fine. However I cannot connect to the www from the laptop through the desktop. Here is my iptables configuration: http://pastebin.com/1ZM8hPZV . What is wrong at the moment is that I am routing my
07:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
07:26 -!- upz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
07:26 <@vpnHelper> RSS Update - forum: Trouble with proxy-arp setup from OpenVPN Cookbook 2 <http://forums.openvpn.net/topic8381.html#p14591>
07:28 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 255 seconds]
07:35 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
07:36 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has joined #openvpn
07:42 -!- upz is now known as uuuppz
07:48 -!- p3rror [~mezgani@41.248.189.189] has joined #openvpn
07:52 -!- MarKsaitis [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Read error: Connection reset by peer]
08:01 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
08:01 -!- mode/#openvpn [+v Axeman] by ChanServ
08:03 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 260 seconds]
08:03 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
08:05 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
08:07 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404.html#p14592>
08:07 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
08:12 -!- dazo is now known as dazo|mtg
08:13 -!- thepacmanfan [~thepacman@tri-lakes-net-2344.bran.customer.centurytel.net] has joined #openvpn
08:27 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
08:28 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:40 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
08:40 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
08:41 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
08:45 -!- ArtVanda1ae [~SuperUnkn@125.209.130.16] has joined #openvpn
08:47 -!- ArtVandalae [~SuperUnkn@125.209.133.227] has quit [Ping timeout: 258 seconds]
08:59 -!- master_of_master [~master_of@p57B558A7.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:02 -!- master_of_master [~master_of@p57B52236.dip.t-dialin.net] has joined #openvpn
09:07 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
09:08 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:09 -!- dazo|mtg is now known as dazo
09:16 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
09:16 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
09:40 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Read error: Operation timed out]
09:47 -!- grendal-prime_ [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
09:50 -!- snapcase [snapcase@shokushuzeme.me] has joined #openvpn
09:54 -!- dvdr [~fred@66.23.233.37] has left #openvpn []
09:56 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
09:56 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
09:57 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:59 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 260 seconds]
10:00 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 264 seconds]
10:07 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
10:09 -!- upz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
10:11 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 252 seconds]
10:21 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
10:26 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
10:32 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:33 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:33 -!- mode/#openvpn [+o raidz] by ChanServ
10:38 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: IceChat - Its what Cool People use]
10:40 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
10:49 -!- MushroomNZ2 [~MushroomN@121-72-232-59.cable.telstraclear.net] has quit []
11:07 -!- dazo is now known as dazo_afk
11:08 -!- krphop_afk is now known as krphop
11:11 <@vpnHelper> RSS Update - forum: Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html>
11:26 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: bbl]
11:47 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
11:50 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has joined #openvpn
11:52 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 240 seconds]
11:53 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:00 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
12:04 -!- MarKsaitis_ [~MarKsaiti@host81-137-245-117.in-addr.btopenworld.com] has quit [Ping timeout: 240 seconds]
12:18 -!- ArtVanda1ae [~SuperUnkn@125.209.130.16] has quit [Ping timeout: 252 seconds]
12:21 -!- upz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 246 seconds]
12:30 <@vpnHelper> RSS Update - forum: Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html#p14594>
12:31 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:35 -!- EugeneKaway is now known as EugeneCourt
12:41  * EugeneCourt sneezes
12:51 -!- thepacmanfan [~thepacman@tri-lakes-net-2344.bran.customer.centurytel.net] has left #openvpn []
12:51 -!- jasonb_ [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
12:51 -!- EugeneCourt is now known as EugeneKaway
12:51 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
12:53 < snapcase> i have 2 machines running openvpn, some configs and other information: http://snapcase.net/openvpn.txt why is it that i'm able to ping server -> machines behind client but not vice versa? the openvpn client is unable to ping hosts behind the server
12:57 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
12:57 -!- jasonb_ is now known as JasonBoxLaptop
13:19 -!- buntfalke [~nobody@openvpn-p0-075.triple-a.uni-kl.de] has joined #openvpn
13:19 -!- buntfalke [~nobody@openvpn-p0-075.triple-a.uni-kl.de] has quit [Changing host]
13:19 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:20 -!- tkil [~tony@c-71-228-115-181.hsd1.nm.comcast.net] has quit [Read error: Operation timed out]
13:23 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Read error: Operation timed out]
13:33 -!- tkil [~tony@c-71-228-115-181.hsd1.nm.comcast.net] has joined #openvpn
13:40 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
13:47 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
13:47 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
14:00 -!- EugeneKaway is now known as EugeneKay
14:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:10 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
14:30 -!- p3rror [~mezgani@41.248.189.189] has quit [Ping timeout: 255 seconds]
14:44 -!- quadDama1e is now known as quadDamage
14:49 -!- p3rror [~mezgani@41.140.33.177] has joined #openvpn
15:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
15:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
15:24 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Ping timeout: 250 seconds]
15:25 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
15:29 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
15:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
15:47 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
16:00 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593-15.html#p14595>
16:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
16:23 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Ping timeout: 260 seconds]
16:23 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
16:35 -!- jemand [~quassel@brln-4db9f79b.pool.mediaWays.net] has joined #openvpn
16:38 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
16:40 -!- jemand [~quassel@brln-4db9f79b.pool.mediaWays.net] has quit [Remote host closed the connection]
16:47 -!- corretico [~luis@201.197.141.74] has joined #openvpn
16:48 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:03 -!- corretico [~luis@201.197.141.74] has quit [Quit: Leaving]
17:06 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 252 seconds]
17:06 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p14596>
17:07 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
17:13 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 258 seconds]
17:20 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:25 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 276 seconds]
17:34 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 250 seconds]
17:45 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Quit: where wizards stay up late...]
17:47 -!- grendal-prime_ [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 260 seconds]
17:52 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
17:53 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:07 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
18:22 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
18:23 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
18:25 < cjs226> I'm trying to get OpenVPN up and running for the first time.  I'm able to auth/connect, but can't ping 10.8.0.1 nor my local addresses (10.8.0.5 and 6).  I'm using routing vs. bridging.  i don't see any errors.  any pointers?
18:25 < EugeneKay> Firewall.
18:26 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:27 < cjs226> my laptop's firewall is off.  other than allowing udp/1194, what's needed on the server side?
18:27 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
18:28 < EugeneKay> Allowing access to the tun0 interface & addresses from the vpn subnet
18:30 < cjs226> that would be "inside" the server, right?  if so, I'm not running iptables, etc.
18:31 -!- Eph [~Eph@unaffiliated/eph] has joined #openvpn
18:32 < Eph> Anyone able to provide a little insite into my bridge setup
18:32 < Eph> When I do bridge-start everything is created fine
18:32 < Eph> but all the interface cant contact the internet then
18:32 < Eph> I cant ping through br0 tap0 or eth0
18:33 < Eph> Ive added what I think are the correct lines to iptables
18:33 < Eph> but i cant be sure
18:34 < EugeneKay> "Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
18:34 < EugeneKay> cjs226 - yes, that would be an iptables thing. 
18:34 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
18:35 < Eph> Without bridging and without setting the clients to IPv4, how can i get 2 seperate subnets talking through the VPN to the outside
18:35 < Eph> push route is not doing it
18:35 < Eph> forward Ipv4 sorry
18:36 < Eph> ah the original bridge-start doesnt include a gateway
18:36 < EugeneKay> Proper routing.
18:36 < Eph> thanks
18:37 < EugeneKay> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
18:37 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
18:37 < Eph> Read it
18:38 < Eph> but
18:38 < Eph> then every client must have IPv4 forwarding enabled
18:38 < EugeneKay> Yess...... this is how routing works?
18:38 < Eph> i cant force people to go enable that when they connect
18:38 < Eph> since its not on by default
18:38 < EugeneKay> In that setup, the "client" is the gateway for the LAN in question.
18:39 < EugeneKay> So forwarding should be on anyway
18:39 < EugeneKay> (as is the server)
18:41 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Read error: Connection reset by peer]
18:41 -!- corretico [~luis@201.197.141.74] has joined #openvpn
18:42 < Eph> so server is 192.168.0.200, I have KVM running 2 seperate VMs 1 on 10.1.50.0 and the other on 192.168.2.0
18:42 < Eph> so youre saying those VMs just need the IPv4 forwarding and not people using the openvpn client connecting in?
18:42 < Eph> and tun will do that
18:43 < EugeneKay> Um. What? I'm not comprehending your setup at all here.
18:43 < Eph> heh
18:44 < EugeneKay> You ahave two VPN clients with subnets behind them? And then other VPN clients which are roaming users?
18:44 < Eph> no
18:45 < Eph> I have a CEntOS server at 192.168.0.200
18:45 < Eph> OpenVPN server runs on it giving 10.10.80.0 IPs
18:45 < Eph> i need those people connecting to 10.10.80.0
18:45 < Eph> to be able to access the VMs on subnets 10.1.50.0
18:46 < Eph> I cant have the people connecting through OpenVPN to get to 192.168.0.0
18:46 < Eph> only the VMs
18:46 < EugeneKay> That's a simple firewall issue, then.
18:46 < Eph> yesi get the last part
18:46 < Eph> but
18:47 < Eph> i cant get people once connected even with push route on
18:47 < Eph> to get to the 10.1.50 subnet of the VM
18:47 < EugeneKay> Poke at the client logs, you should see the route being pushed. If it's not taking effect, you have something setup wrong on the client end
18:47 < Eph> yea i see the route add on client
18:48 < Eph> sigh
18:48 < EugeneKay> !logs
18:48 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
18:48 < Eph> I just figured bridging would make that all easier
18:48 < EugeneKay> Bridging makes everything worse.
18:48 < Eph> so i dont have to worry with forwarding
18:49 < Eph> well the irritating part without even using openvpn is that with the bridge on none of the interfaces can get to the internet
18:49 < Eph> i will go back to tun
18:49 < Eph> routing
18:49 < Eph> but I dont get why that doesnt work
18:50 < Eph> http://pastebin.com/nwKE1gMk
18:51 < Eph> Im guessing its because i have 2 other bridges for VM networks
18:53 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
18:56 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
18:59 -!- p3rror [~mezgani@41.140.33.177] has quit [Ping timeout: 255 seconds]
19:00 -!- Squidy_at_Home [~quassel@187.55.152.158] has joined #openvpn
19:07 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
19:10 < cjs226> EugeneKay: thx for the help earlier.  after going round and round a reboot of the client did the trick.  off to find the nearest bar.  :-)
19:12 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
19:16 < EugeneKay> The bar is usually a good place to start.
20:06 -!- Denial [~Denial@drgi.co.uk] has quit []
20:07 -!- Eph [~Eph@unaffiliated/eph] has left #openvpn []
20:13 < kartmetal> Hey guys, are there some good pages out there explaining how to get openvpn to work *well* on android?
20:13 < ecrist> no
20:13 < ecrist> tether your phone to a laptop and connect with that. ;)
20:13 < kartmetal> So far, I can use cyanogenmod's builtin openvpn settings, and that kinda works, if you like very sad speeds
20:13 -!- doublehp [~DoubleHP@2a01:e35:8ba8:e140::52] has joined #openvpn
20:14 < kartmetal> or I can use use the openvpn settings app from the market, which is significantly faster, but crashes a lot.
20:14 < kartmetal> I feel slighlty doomed.
20:14 < EugeneKay> The CM builtin one works fine for me.
20:14 < kartmetal> any magic settings you had to use to make it happier?
20:14 < EugeneKay> Nope. It "just works"
20:15 < kartmetal> well, technically true for me too.. it just downgrades my transfer speed from 1000kb/s to 200kb/s
20:15 < kartmetal> maybe I ought to kill the compression.
20:15 < doublehp> does the --server directive accept the new notation with IP/mask ?
20:15 < EugeneKay> That's probably what it is. Phones don't have enough CPU to handle lzo at that sorta speed
20:16 < doublehp> EugeneKay: mine does
20:16 < kartmetal> alright.. can I have the openvpn server use lzo with some clients but not others?
20:16 < EugeneKay> Probably. Something involving ccd maybe?
20:17 < kartmetal> ah neat. didn't know about that. thanks.
20:21 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
20:26 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
20:26 <@vpnHelper> RSS Update - forum: Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14597>
20:29 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
20:42 -!- corretico [~luis@201.197.141.74] has quit [Remote host closed the connection]
20:49 -!- ArtVanda1ae [~SuperUnkn@125.209.134.233] has joined #openvpn
20:57 <@vpnHelper> RSS Update - forum: Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html#p14598>
21:03 <@vpnHelper> RSS Update - forum: Win 7 server and client , can connect but can't see server <http://forums.openvpn.net/topic8629.html>
21:07 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Read error: Operation timed out]
21:09 <@vpnHelper> RSS Update - forum: Win 7 server and client , can connect but can't see server <http://forums.openvpn.net/topic8629.html#p14600>
21:12 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
21:14 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
21:22 < doublehp> what do the rRwW s mean in the log ?
21:26 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 260 seconds]
21:27 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
21:27 -!- mode/#openvpn [+v Axeman] by ChanServ
21:28 -!- Squidy_at_Home [~quassel@187.55.152.158] has quit [Remote host closed the connection]
21:31 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
21:36 < doublehp> is there a debian brtl-openvpn tutorial ?
21:43 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:47 -!- Squidy_at_Home [~quassel@187.55.152.158] has joined #openvpn
21:48 -!- Some-body_ [~Vetinari@eta.cluenet.org] has joined #openvpn
21:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
21:50 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
21:52 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
21:52 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
21:52 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:52 -!- Some-body_ is now known as DarthGandalf
21:52 -!- DarthGandalf [~Vetinari@eta.cluenet.org] has quit [Changing host]
21:52 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
21:53 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
21:53 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
21:56 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:56 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
22:07 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
22:09 < ecrist> sup bitches?
22:09 < ecrist> doublehp: the rwrwrw stuff is read and rights to the session
22:10 < doublehp> ?
22:11 -!- jshmoe12 [~jshmoe123@gateway/tor-sasl/jshmoe12] has joined #openvpn
22:12 < jshmoe12> Hello I am running linux mint 11 can anyone help me with using openvpn to connect to freeopenvpn.com?
22:12 < jshmoe12> I have everything running correctly but it won't browse any pages I just get stalled. but it shows its connected.
22:13 < jshmoe12> I have installed network-manager-openvpn plugin and setup everything to the specs on freeopenvpn.com and even got the connection to work but can't browse
22:15 < jshmoe12> I see that it says in the banner that the problem is the firewall really. is that true really :). I need to port forward 443?
22:15 < jshmoe12> on my router? im on wireless.
22:16 < ArtVanda1ae> jshmoe12, you shouldn't have to port forward anything on the client, AFAIK
22:17 < ecrist> jshmoe12: we don't support commercial projects.
22:17 < ecrist> free or otherwise
22:17 < jshmoe12> im not trying to be commercial Im just wanting to browse anonymously
22:18 < jshmoe12> for personal use
22:19 < jshmoe12> as far as the server all its says is use a tcp connection, connect to address, and use port 443. in network-manager-openvpn i have done all this and added certs and it connects because i have a lock icon.
22:20 < jshmoe12> But still to no avail I can't browse it just stalls
22:20 < jshmoe12> also when i do an ifconfig i see the extra interface.
22:22 < doublehp> ecrist: yes, why mins and caps, and why r vs w ?
22:28 -!- secondchoice [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
22:29 -!- thirdChoice [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
22:30 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Read error: Operation timed out]
22:32 < ecrist> jshmoe12: you're asking for help with a commercial service.  we only support people who have control of both ends of the VPN
22:32 < ecrist> r=read w=write
22:32 < ecrist> don't recall the diff in caps
22:33 -!- secondchoice [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 258 seconds]
22:33 < doublehp> size of packet ?
22:33 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
22:33 -!- thirdChoice [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Client Quit]
22:33 < doublehp> so, when server shows r or R, it mean the tunnel is working ?
22:33 < jshmoe12> i see 
22:34 < doublehp> i think my tunel is up, but there is no traffic for user: tap0 does not even come up on client
22:35 < doublehp> i am not sure how to set up brctl with openvpn in debian, any one can help ?
22:35 < doublehp> tap0 is in br0
22:35 -!- jshmoe12 [~jshmoe123@gateway/tor-sasl/jshmoe12] has quit [Quit: Leaving]
22:36 < doublehp> dhclient tap0 - on client gives one line in server logs , but i never seem to receive answer
22:37 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
22:47 < ecrist> doublehp: you need another interface, as wel.
22:47 < doublehp> such as ?
22:47 < doublehp> br0 is started with eth0
22:47 < doublehp> then tap0 is added later on
22:48 < ecrist> and what does the firewall look like?
22:48 < doublehp> iptables not installed
22:48 < doublehp> tcpdump can not be installed 
22:50 < doublehp> hmmm ...  tcpdump can not be installed on server, BUT, if a dhcp frame was transmitted, all desktops on the network should see it, won't they ?
22:56 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has joined #openvpn
23:01 < ecrist> !logs
23:01 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
23:01 < doublehp> which logs do you want ?
23:02 < doublehp> the most usefull part for me is "WRWRRwWWRRWRWRWRWRRwWRWRWRWRWRWRWRwWRWRWRWRWRWRRwWRWRWR" on server that confirms that data are sent and received inside the tunnel
23:02 < EugeneKay> It's like a V8
23:02 < doublehp> the other lines don't sound relevant to me, as they all lead to the fact that tunnel is up
23:03 < doublehp> EugeneKay: lol :)
23:05 < doublehp> i also know that br0 is not really up (debian did not run all post-up lines), but i can ssh to it
23:06 < doublehp> and i wonder why running "ip ru del table grps" .... made tun0 work 
23:06 < EugeneKay> Scumbag user: asks for help, is told to provide logs, refuses, then continues asking for help anyway.
23:07 < doublehp> i said: which logs do you want ?
23:07 < EugeneKay> ......the ones mentioned in !logs ?
23:07 < doublehp> !logs
23:07 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
23:08 < doublehp> how many lines ?
23:09 < ecrist> doublehp: if you want my help, answer my questions. ;)
23:10 < doublehp> ecrist: last question was about firewall, and i answered that iptables is not installed. Other firewals are irrelevant since i said ... tunnel is established (i said i have R *AND* W in server logs )
23:10 < ecrist> I asked for your logs
23:10 < EugeneKay> "My firewall doesn't matter, my tunnel is up!"
23:10 < doublehp> how many lines do you want per logfile ?
23:10 < ecrist> I didn't, however, ask for your opinion about your logs
23:11 < ecrist> I want everything from connection start onward.
23:11 < ecrist> un-redacted
23:11 < doublehp> last 1000 should do ...
23:12 < ecrist> great
23:12  * ecrist loses interest
23:12 < doublehp> server http://pastebin.com/0daixsVg
23:12 < ecrist> you're on your own.
23:13 < doublehp> server conf http://pastebin.com/rqi9ddgY
23:13 < doublehp> client log http://pastebin.com/kzuyN5Xy
23:14 < doublehp> client conf http://pastebin.com/RXkt2gW9
23:15 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:18 < Olipro> so, you don't have any control over the server, but you do have access to its config file
23:18 < EugeneKay> TOTALLY LEGITIMATE SETUP
23:19 < doublehp> Olipro: i have full access, except  VGA, and i can not install tcpdump
23:23 < Olipro> any reason why you're using tcp over udp?
23:23 < doublehp> no, i can switch if you prefer
23:24 < Olipro> yes, switch to udp
23:28 < doublehp> i gave the wrong conf for client ... 
23:30 < doublehp> good conf: http://pastebin.com/CRXA549S
23:31 < doublehp> UDP does not work (firwalling issues)
23:32 < doublehp> reverting to TCP, because server does not receive any request using UDP
23:33 < Olipro> so you know you have firewalling issues
23:34 < Olipro> but you can't be bothered to fix them, and also seem to think that TCP is immune to them
23:35 < doublehp> there are at least 2 firewals between client and server, but, there is no firewalling rules installed on server. I have access using TCP, so, as long as the server receives connexion requests, it means that things can go through.
23:35 < doublehp> there may be many more firewalls (probably up to 5 )
23:36 < doublehp> without bridging, I could make the tunnel work with TCP and IPv6
23:36 -!- Squidy_at_Home [~quassel@187.55.152.158] has quit [Remote host closed the connection]
23:36  * ecrist shudders
23:37 < doublehp> ipv4 required to type ""ip ru del table gprs" on client for a reason I can't understand. Now I am setting up brctl, i am lost
23:37 < ecrist> doublehp: read /topic and go away. :)
23:37 < doublehp> ecrist: problem is not firewal, but brctl
23:37 < doublehp> because tunnel works without brctl
23:37 < EugeneKay> doublehp - I don't think we can help you. Have you tried posting your issue on the Forums?
23:38 < ecrist> heh
23:38 < doublehp> EugeneKay: it's the kind of issue forums never answer; way too complex for forums
23:38 < EugeneKay> That's alright, we won't be answering it for you either.
23:38 < ecrist> doublehp: if your issue is brctl, then why are you asking in #openvpn instead of #linux?
23:38 < doublehp> i have tons of easier unasnwered issues
23:39  * ecrist is forum admin
23:39 < doublehp> because #linux people will tell me it's a VPN issue
23:39 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has quit []
23:39 < ecrist> but you specifically state your issue is brctl
23:40 < doublehp> and I know by experience that other chans just don't have skilled people
23:40 < ecrist> we're not a linux support channel
23:41 < ecrist> we're an openvpn support channel
23:41 < ecrist> your issue, as you've stated, isn't with openvpn
23:42 < doublehp> it's not brctl either, because brctl without openvpn does work
23:42 < EugeneKay> I WANT TO STAB DEBIAN 
23:42 < doublehp> and it's not linux, because my distro is starting fine
23:42 < doublehp> and #debian will tell me it's not a Debian issue
23:42 < ecrist> then what is your problem?
23:42 < ecrist> wait, I already told you to read /topic
23:43 < ecrist> and you've failed
23:43 < doublehp> if I knew, it would be fixed already
23:43 -!- doublehp [~DoubleHP@2a01:e35:8ba8:e140::52] has left #openvpn ["Leaving."]
23:43 < ecrist> aw, shucks
23:44  * ecrist poofs
23:44 -!- p3rror [~mezgani@41.140.96.59] has joined #openvpn
23:44 <@vpnHelper> RSS Update - forum: [SOLVED] Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14597>
23:44 < Olipro> that's a verb now?
23:44  * EugeneKay Olipro 
23:44 < EugeneKay> +s
23:45 < Olipro> "FU Spang"
23:45 < EugeneKay> Things that make me hate Debian: "visudo" launches nano.
23:45 < EugeneKay> If I wanted nano I would have typed nanosudo
23:50 <@vpnHelper> RSS Update - forum: [SOLVED] Unstable and slow connection <http://forums.openvpn.net/topic8597.html#p14601>
23:55 -!- pacmanfan [~pacmanfan@74-84-99-162.client.mchsi.com] has joined #openvpn
--- Day changed Thu Aug 11 2011
00:01 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
00:01 < hyper_ch> nano > vi
00:01  * hyper_ch hides
00:02 < Olipro> does it go up to eleven?
00:04 < pacmanfan> yes sir
00:06 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
00:07 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
00:10 < pacmanfan> ok, got a problem
00:10 < pacmanfan> i have a single client, so i would like to use the static key method
00:10 < pacmanfan> however the ovpn server implementation on my router wants a crt/key combo
00:11 < pacmanfan> what is the easiest way to make this happen?
00:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
00:23 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
00:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:32 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:42 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
00:42 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593-15.html#p14602>
00:43 < EugeneKay> Buy a less crappy router.
00:47 < Bushmills> pacmanfan: what authentication openvpn wants is determined by its configuration
00:47 < Bushmills> change the route openvpn config accordingly
00:48 < Bushmills> router ...
00:49 -!- Kartagis [sbnc@unaffiliated/kartagis] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
00:50 < EugeneKay> It sounds like one of those integrated GUI thingies.
00:50 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
00:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
00:51 < Bushmills> EugeneKaway: visudo uses afaik the editor which has been set through alternatives
00:51 < Bushmills> you could probably purge nano, to disable its use altogether
00:51 -!- p3rror [~mezgani@41.140.96.59] has quit [Ping timeout: 255 seconds]
00:52 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:52 < Bushmills> visudo should by default then simply use the next "best" available editor
00:53 < Bushmills> though i thought that vim is considered preferable over nano
00:54 < Bushmills> not sure about nano, i don't have it installed.  http://scarydevilmonastery.net/snap/1313042046171445899d.png  seems that joe/jupp has precedence over vim
00:56 < EugeneKay> At least ed is at the bottom
00:58 <@vpnHelper> RSS Update - forum: Win 7 server and client , can connect but can't see server <http://forums.openvpn.net/topic8629.html#p14604> || Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html#p14603>
01:01 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
01:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Client Quit]
01:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:19 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:42 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:42 -!- mode/#openvpn [+o mattock] by ChanServ
01:46 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
01:58 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
02:00 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
02:03 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Client Quit]
02:15 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:22 -!- dazo_afk is now known as dazo
02:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
02:28 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Ping timeout: 250 seconds]
02:32 -!- EugeneKay is now known as EugeneSleep
02:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
02:35 < Mowee> Morning
02:39 < EugeneSleep> If you say so
02:47 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
03:09 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593-15.html#p14605>
03:13 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
03:14 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
03:14 <@vpnHelper> RSS Update - forum: --route-delay cannot be used with --mode server <http://forums.openvpn.net/topic8631.html> || Server from Linux to Windows. Radius Authenticantion?? <http://forums.openvpn.net/topic8630.html>
03:28 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:28 -!- mode/#openvpn [+v s7r] by ChanServ
03:38 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 252 seconds]
03:38 <@vpnHelper> RSS Update - forum: DDwrt/OpenVPN starts, vpn works on router, not for computers <http://forums.openvpn.net/topic8632.html>
03:51 <@vpnHelper> RSS Update - forum: --route-delay cannot be used with --mode server <http://forums.openvpn.net/topic8631.html#p14610> || Server from Linux to Windows. Radius Authenticantion?? <http://forums.openvpn.net/topic8630.html#p14609>
03:57 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
03:59 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
04:01 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:14 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:14 -!- drgr33n [~drgr33n@94.196.32.33.threembb.co.uk] has joined #openvpn
04:15 < drgr33n> Hey guys !! Was wondering if someone could help me with my configuration ? I've setup a openvps at home but when I connect I got not internet connection.
04:16 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
04:16 < drgr33n> http://pastebin.com/diGTKsff
04:17 < Bushmills> !redirect
04:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
04:18 < drgr33n> ty bushmills I'll take a look now
04:18 < drgr33n> !def1
04:18 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
04:18 < drgr33n> !nat
04:18 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
04:19 <+s7r> Bushmills: in this line in my ovpn “redirect-gateway def1 bypass-dhcp"
04:19 <+s7r> what is bypass-dhcp doing ?
04:19 <+s7r> what is it for
04:20 < drgr33n> I would assume to bypass dhcp :D
04:20 <+s7r> what dhcp
04:20 < drgr33n> Bushmills you a debian guy ?
04:20 < drgr33n> dhcp on your client I assume ?
04:23 -!- _evor_ [~EvOr@midgard.adyxax.org] has quit [Remote host closed the connection]
04:23 -!- EvOr [~EvOr@midgard.adyxax.org] has joined #openvpn
04:24 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:24 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:25 <@vpnHelper> RSS Update - forum: --route-delay cannot be used with --mode server <http://forums.openvpn.net/topic8631.html#p14611>
04:26 < drgr33n> I've got everything setup correctly on the server when it comes to ip forwarding etc. I'm using it as a wireless router too. When I traceroute the google connected through the vps it doesn't even leave my laptop.
04:27 < drgr33n> !linnat
04:27 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
04:31 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593-15.html#p14612>
04:32 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 252 seconds]
04:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
04:34 -!- drgr33n [~drgr33n@94.196.32.33.threembb.co.uk] has quit [Ping timeout: 255 seconds]
04:34 -!- drgr33n [~drgr33n@94.196.32.33.threembb.co.uk] has joined #openvpn
04:36 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
04:37 < Agin> Hi. Is network-manager-openvpn supposed to work? :p (natty)
04:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:42 < drgr33n> Doesn't work for me. Stays greyed out using sid
04:48 <@dazo> Agin: Ubuntu have managed to cripple NetworkManager-openvpn to become useless ... and nobody (Ubuntu wise) have ever tried to fix it ... I'm using this plug-in regularly (several times a week) in Fedora without issues, and have colleagues on Fedora and RHEL doing the same
04:50 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:50 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:50 -!- drgr33n [~drgr33n@94.196.32.33.threembb.co.uk] has quit [Changing host]
04:50 -!- drgr33n [~drgr33n@unaffiliated/drgr33n] has joined #openvpn
05:05 < Agin> dazo: ok thanks, I'll look for another client (server connection tested OK from Windows).
05:05 < drgr33n> There is on for kde i don't know if you will get it to work with gnome though.
05:05 <@dazo> Agin: I believe gopenvpn is packaged for Ubuntu, you could try that ... otherwise, there's no shame starting openvpn from the command line ;-)
05:06 < Agin> thanks - and sure I can try commandline
05:08 <@dazo> Agin: NetworkManager-openvpn, gopenvpn and other GUIs are just a wrapper around the commandline based openvpn ... so the behaviour should be the same from the VPN side .... it's all about how it looks like and how user friendly it feels.
05:12 < drgr33n> I just liked the idea of having all connection configuration being controlled by network-manager.
05:13 < drgr33n> I'm trying to create a live cd for transfering bitcoins across the internet safely and wanted to stay away from the command prompt as much a s possible.
05:32 -!- drgr33n [~drgr33n@unaffiliated/drgr33n] has quit [Ping timeout: 255 seconds]
05:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:46 -!- drgr33n [~drgr33n@94.196.110.128.threembb.co.uk] has joined #openvpn
05:52 -!- style [style@richardt.fi] has joined #openvpn
05:52 <@vpnHelper> RSS Update - forum: Server from Linux to Windows. Radius Authenticantion?? <http://forums.openvpn.net/topic8630.html#p14613>
05:53 < style> Hi... Any ideas why authentication works, but all packets will be dropped. I've disabled all possible firewalls between my client and server, so that shouldn't be the problem
05:54 -!- natanoj [~jonatan@yogi.akerlind.nu] has left #openvpn []
05:58 -!- chokesmaster [~chokesmas@65.92.222.106] has quit [Ping timeout: 252 seconds]
06:03 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Take my advice. I don't use it anyway]
06:09 <@vpnHelper> RSS Update - forum: Server from Linux to Windows. Radius Authenticantion?? <http://forums.openvpn.net/topic8630.html#p14614>
06:29 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
06:32 -!- krackpot [~krackpot@S0106000c42a9996c.vc.shawcable.net] has quit [Ping timeout: 258 seconds]
06:38 < style> I got no warnings/errors w/e... but i.e. ping says destination host uncreachable
06:38 < style> routes seems fine 
06:47 -!- s7r1 [~s7r@188.25.159.232] has joined #openvpn
06:47 -!- s7r [~s7r@openvpn/user/s7r] has quit [Read error: Connection reset by peer]
06:48 -!- s7r1 [~s7r@188.25.159.232] has left #openvpn []
06:49 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:49 -!- mode/#openvpn [+v s7r] by ChanServ
06:55 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Quit: Leaving]
07:08 -!- krackpot [~krackpot@S0106000c42a9996c.vc.shawcable.net] has joined #openvpn
07:10 -!- drgr33n [~drgr33n@94.196.110.128.threembb.co.uk] has quit [Changing host]
07:10 -!- drgr33n [~drgr33n@unaffiliated/drgr33n] has joined #openvpn
07:21 < ArtVanda1ae> style, is ICMP turned on? i.e. can you ping. Try and SSH into a machine or access a webserver on one of the machines instead
07:22 < style> yes it is, also tcp dump doesn't show any icmp traffic
07:22 < style> and yes... no tcp/udp connections work either
07:27 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:29 -!- luneff [~yury@93.178.64.204] has joined #openvpn
07:31 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 255 seconds]
07:40 -!- drgr33n [~drgr33n@unaffiliated/drgr33n] has quit [Ping timeout: 264 seconds]
07:42 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:43 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
07:52 -!- drgr33n [~drgr33n@94.197.110.42.threembb.co.uk] has joined #openvpn
07:53 < rubin110> I have an openvpn connection that drops all packets very shortly after making the connection to the server.
07:53 < rubin110> There's nothing in the logs on either end, and my routes on my client machine don't change.
07:54 < rubin110> The time has been variable, from 10 seconds to 3 minutes.
07:54 < rubin110> Any help would be extremely appricated.
07:56 -!- ArtVanda1ae [~SuperUnkn@125.209.134.233] has quit [Ping timeout: 240 seconds]
08:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
08:06 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
08:06 < Bushmills> rubin110: your client does a dhcp request, which overwrites routes set by openvpn 
08:07 < rubin110> Bushmills: But I've compared route -n before and after, they look the same.
08:07 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
08:16 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p14615>
08:17 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:19 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
08:34 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
08:41 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:44 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has joined #openvpn
08:46 < sakhi> How do I check OpenVPN access logs again? /var/log/auth I get the shh logs but I need the actual OpenVPN logs.
09:00 -!- master_of_master [~master_of@p57B52236.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
09:01 -!- master_of_master [~master_of@p57B532EB.dip.t-dialin.net] has joined #openvpn
09:17 < gladiatr> sahki, grep for ovpn
09:18 < gladiatr> and that assumes you don't have a "log" directive in your configuration file
09:21 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 260 seconds]
09:25 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
09:32 -!- hurrycane [~bogdan@78.96.128.107] has joined #openvpn
09:32 < hurrycane> hello anyone online ?
09:36 -!- jessicajames [~jessicaja@unaffiliated/jessicajames] has joined #openvpn
09:36 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
09:36 < jessicajames> I'm not sure if this is the best place to ask but I was wondering which is more secure and which will provide more security against network sniffing at wifi hotspots - openVPN or PPTP?
09:37 -!- hurrycane [~bogdan@78.96.128.107] has quit [Quit: hurrycane]
09:37 < bigon> I think that pptp is considered insecure
09:40 <+s7r> jessicajames: http://www.sky-ip.org/vpnconnectiontypes.html
09:40 < jessicajames> Yeah that seems to be the general consensus apparently
09:40 <@vpnHelper> Title: sky-ip.org - Connection Types Description (at www.sky-ip.org)
09:40 <+s7r> it's a description about pptp / l2tp / openvpn etc.
09:40 <+s7r> naturally, openvpn wins :-) it's the best know vpn technology at this time
09:41 <+s7r> but it depends also on your needs. in some cases it's a MUST that vpn is a protocol supported by microsoft...
09:41 <+s7r> if you have to choose ... choose openvpn :D
09:45 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
09:46 < jessicajames> okay, thanks for the info guys :)
09:52 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p14616>
09:53 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
10:22 -!- grendal-prime_ [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
10:27 -!- EugeneSleep [EugeneKay@eugenekay.com] has quit [Quit: ZNC - http://znc.in]
10:27 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
10:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Client Quit]
10:41 -!- Axeman [~thirdchoi@knox.pace.edu] has joined #openvpn
10:41 -!- Axeman [~thirdchoi@knox.pace.edu] has quit [Changing host]
10:41 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
10:41 -!- mode/#openvpn [+v Axeman] by ChanServ
10:46 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:55 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
10:56 -!- drgr33n [~drgr33n@94.197.110.42.threembb.co.uk] has quit [Ping timeout: 255 seconds]
11:04 -!- Champi [Champi@rootshell.fr] has quit [Quit: Quit]
11:07 -!- Champi [Champi@rootshell.fr] has joined #openvpn
11:07 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
11:07 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
11:08 -!- drgr33n [~drgr33n@94.196.8.242.threembb.co.uk] has joined #openvpn
11:30 <@vpnHelper> RSS Update - forum: Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html#p14617>
11:34 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
11:37 -!- teb76 [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has joined #openvpn
11:37 < teb76> hi to all
11:38 < teb76> I'm in a very strange situation trying to use vpn from my android cell phone
11:40 < teb76> if I use it as thetering  all works fine and I'm able to connect to my vpn from my laptop (xp), if I try to connect directly from cell using openvpn for android the connection is estabilished but I'm actually not able to reach any ip of my vpn
11:41 < teb76> maybe a firewall from the company of the cellular line, but if it is so, why I can use as tethering without problem?
11:42 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has quit [Remote host closed the connection]
11:42 <@vpnHelper> RSS Update - forum: Elimintate a client from server <http://forums.openvpn.net/topic8633.html>
11:43 < teb76> if I try to ping 10.8.0.1 I get IMMEDIATLY time to live exceeded
11:43 < gladiatr> teb76, if you've successfully established a connection, there's nothing your ISP can do to affect the packets you send or receive via the tunnel.
11:44 < teb76> gladiatr, I think so, but why I can not reach any machine of my vpn?
11:46 < teb76> any tips?
11:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
11:49 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
11:49 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
11:49 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
11:49 -!- mode/#openvpn [+v Axeman] by ChanServ
11:49 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
11:50 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
11:50 < gladiatr> teb76, patience...
11:51 < gladiatr> teb76, it could be any number of things.  I would suggest browsing the community forums for this very topic.  There are a lot of posts dealing with this very issue
11:52 < teb76> what should I search forU
11:52 < teb76> ?
11:55 -!- datruth [datruth@gotpot.org] has joined #openvpn
11:56 < datruth> !nat
11:56 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
11:56 < datruth> !translation
11:56 < datruth> !linnay
11:56 < datruth> !linnat
11:57 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
11:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:59 -!- drgr33n [~drgr33n@94.196.8.242.threembb.co.uk] has quit [Ping timeout: 260 seconds]
11:59 -!- drgr33n [~drgr33n@94.196.173.58.threembb.co.uk] has joined #openvpn
12:00 <@vpnHelper> RSS Update - forum: Elimintate a client from server <http://forums.openvpn.net/topic8633.html#p14619>
12:01 < datruth> Question how can I make it where when a client connects to the vpn and gets an internal ip the firewall will see the traffic comming from the clients internal ip instead of the main vpn server ip ?
12:01 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 258 seconds]
12:09 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Read error: Operation timed out]
12:09 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
12:17 < teb76> gladiatr, u still there?
12:17 -!- catsup [~d@cpe-67-243-168-212.nyc.res.rr.com] has joined #openvpn
12:20 -!- jessicajames is now known as jessicajames|awa
12:21 -!- remote [~nicolas@unaffiliated/remote] has joined #openvpn
12:22 -!- Nappy__ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has joined #openvpn
12:27 -!- Nappy_ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has quit [Ping timeout: 255 seconds]
12:27 -!- drgr33n [~drgr33n@94.196.173.58.threembb.co.uk] has quit [Ping timeout: 255 seconds]
12:27 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 255 seconds]
12:27 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 255 seconds]
12:27 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
12:30 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:32 -!- naquad_ [~naquad@174.142.224.219] has joined #openvpn
12:33 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
12:35 -!- a_ [~d@ip-66-33-206-8.dreamhost.com] has joined #openvpn
12:38 -!- Netsplit *.net <-> *.split quits: +s7r
12:40 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593-15.html#p14620>
12:41 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
12:51 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
12:51 -!- Netsplit over, joins: +s7r
12:51 -!- Olipro is now known as Guest42385
12:55 -!- sedulous [~sedulous@gateway/tor-sasl/sed/x-02583573] has quit [Ping timeout: 250 seconds]
13:00 -!- jessicajames|awa is now known as jessicajames
13:11 -!- a_ [~d@ip-66-33-206-8.dreamhost.com] has quit [Ping timeout: 260 seconds]
13:12 -!- a_ [d@ps38852.dreamhost.com] has joined #openvpn
13:14 <@vpnHelper> RSS Update - forum: build-ca not working <http://forums.openvpn.net/topic8463.html#p14621>
13:16 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
13:16 -!- mode/#openvpn [+o mattock] by ChanServ
13:18 -!- catsup [~d@cpe-67-243-168-212.nyc.res.rr.com] has quit [Quit: leaving]
13:20 -!- luneff [~yury@93.178.64.204] has quit [Quit: This computer has gone to sleep]
13:23 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Quit: where wizards stay up late...]
13:23 -!- jessicajames [~jessicaja@unaffiliated/jessicajames] has quit [Quit: Leaving]
13:25 -!- a_ [d@ps38852.dreamhost.com] has quit [Quit: can't be bothered to manually rejoin channels just to change nick]
13:25 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
13:26 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
13:29 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
13:32 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
13:39 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
13:51 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
13:51 -!- mode/#openvpn [+v Axeman] by ChanServ
13:55 -!- teb76 [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
13:57 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:58 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Quit: where wizards stay up late...]
13:58 -!- luneff [~yury@84.51.199.31] has joined #openvpn
14:03 -!- drgr33n [~drgr33n@94.196.173.58.threembb.co.uk] has joined #openvpn
14:03 < drgr33n> !linnat
14:03 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
14:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:19 -!- drgr33n [~drgr33n@94.196.173.58.threembb.co.uk] has quit [Ping timeout: 250 seconds]
14:21 -!- danryan [~dryan@li115-70.members.linode.com] has left #openvpn []
14:25 -!- dazo is now known as dazo_afk
14:25 -!- finetic [~finetic@213.155.20.16] has joined #openvpn
14:26 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
14:27 < datruth> damn this is a pain!
14:27 < datruth> !reversenat
14:27 < datruth> !reverse
14:27 < EugeneKay> !nat
14:27 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:28 < EugeneKay> !factoids
14:28 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
14:28 < finetic> if i have put 8.8.8.8 as dns server in my network connections TAP-Win32 Adapter V9 - will all requests for dns resolving go ENCRYPTED to google via my VPN server?
14:28 < finetic> (google. is 8 .8.8.8)
14:29 < Bushmills> openvpn ca't encrypt traffic between your server and google 
14:29 < finetic> i know
14:29 < Bushmills> can't
14:29 < hyper_ch> what's a tap win 32 v9 adapter?
14:29 < finetic> Bushmills: but it won't go through my ADSL connectyion right?
14:29 < gladiatr> hyper_ch, the windows tap/tun driver
14:29 < Bushmills> "will all requests for dns resolving go ENCRYPTED to google.."
14:29 < EugeneKay> I don't know enough about how Windows does DNS to say authoritatively, but if you're using redirect-gateway def1, it ought to be going through there, encrypted between you and the vpn server.
14:29 < hyper_ch> gladiatr: ah, ok
14:30 < hyper_ch> which would still use your adsl connection
14:30 < hyper_ch> except if you have some other internet connection
14:30 < EugeneKay> In fact, it should do it without the dns being set on the adapter by virtue of the fact that your default route is over the vpn
14:30 < finetic> Bushmills: going ENCRYPTED TO MY SERVER and then UNENCRYPTED to google
14:30 < finetic> Bushmills: right?
14:30 < Bushmills> whether it does or doesn't depends on how traffic to 8.8.8.8 is routed
14:30 < finetic> Bushmills: in Wireshark
14:30 < finetic> Bushmills: i see 10.0.8.6 - 8.8.8.8
14:31 < finetic> for the DNS requetss
14:31 < Bushmills> if requests go through openvpn, they'll be encrypted
14:31 < EugeneKay> Remember, OpenVPN is not Tor. The two programs were designed with far different goals.
14:31 < finetic> Bushmills: but if i see 10.8.0.6 connecting with 8.8.8.8 in these requests, it means it goes encrypted?
14:32 < EugeneKay> finetic - yes, that means that DNS requests are going via the OpenVPN tunnel
14:32 < Bushmills> depends what you're looking at
14:32 < Bushmills> look at traffic at eth0
14:32 -!- drgr33n [~drgr33n@94.196.173.58.threembb.co.uk] has joined #openvpn
14:32 < Bushmills> that's encrypted
14:32 < Bushmills> look at traffic at tun/tap, and it's already decrypted
14:33 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 260 seconds]
14:33 < finetic> Wireshark: the traffic on TAP-Win32 Adapter V9 is only the DNS requests
14:34 < finetic> The traffic on the AMD PCNENT Family adapter is encrypted with the actual servers 
14:34 < finetic> from 192.168.1.1 to the actual server
14:34 < finetic> That means i.e. if i visit wikileaks.org my ISP cannot see anything right?
14:35 < Bushmills> if traffic is routed through openvpn, they can see traffic, but not what kind
14:35 < Bushmills> means, can see that there is traffic, but not what kind of
14:36 < finetic> yes thats what i ment
14:36 < Bushmills> ah. sort of difficult to guess that "can't see anything" was meant to mean the same
14:37 < finetic> sorry i knew it worked just wanted to make sure dns requests cannot be seen by my ISP
14:38 < Bushmills> of course that created the problem that you can't know whether by saying "can't see what kind"  I didn't mean "they'll see exactly what you're doing" :)
14:38 < Bushmills> i could have meant the same, after all
14:39 < finetic> ok
14:39 < Bushmills> in fact, when saying "encrypted", i could of course also mean "plain text"
14:48 < finetic> huh?
14:48 < datruth> Is there anyway for the client's assigned vpn ip address to show up when their connecting to stuff in the firewall?
14:49 < datruth> I've only been able to get it to show the vpn gateway ip
14:50 < Bushmills> datruth: for scripts, executed as connect event?
14:51 < datruth> No not scripts actual traffic
14:52 < datruth> Like when a client connects and they access my dns servers or boxes on the lan I see the vpn gateway ip accessing this stuff not the client assigned ip address from the vpn server
14:52 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
14:52 < Bushmills> you want actual traffic let things stuff in the firewall?
14:53 < Bushmills> i'm a bit unclear about your goal
14:53 < datruth> hrmm
14:54 < Bushmills> maybe that's because your use of "it" outside of any context
14:55 < datruth> A client connects to the vpn server, the client makes connections to other lan boxes / internet, in my firewall i'd like to see the "clients assigned vpn internal address" instead of the vpn gateway ip
14:55 < datruth> Does that make it clear?
14:55 < Bushmills> look into openvpn status file
14:56 < datruth> heh ok nvm you don't understand my question at all
14:56 < Bushmills> "i'd like to see .."   -  that's where you can see it
14:56 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
14:57 < datruth> I want this done in the firewall, I'm aware you can check the status-log etc
14:57 < Bushmills> what should do "this" do the firewall?
14:57 < Bushmills> to the firewall ...
14:58 < datruth> Most likely the firewall yes I'm using the firewall to nat all traffic through the vpn interface that is how I am seeing the vpn gateway ip making connections etc 
14:58 < datruth> Instead of the gateway, I want to see the clients ip
14:58 < Bushmills> you want to execute a script on client connect, which does the change to firewall?
14:59 < datruth> Lets forget about a script
14:59 < datruth> Does anyone where know iptables?
15:00 < Bushmills> ok. no script then.  what else should do the change then?
15:00 < datruth> There should be no change 
15:01 < datruth> I just want to see the clients ip instead of the vpn server ip this way we can can track down what user had what ip and what all that ip accessed
15:01 < Bushmills> ok. not doing anything would be a solution, as that results in no change
15:02 < Bushmills> as you know about status file already, which lets you "I just want to see the clients ip instead of the vpn server ip this way we can ...", i don't know what else you need
15:02 < datruth> the status log doesn't log the traffic does it?
15:03 < Bushmills> no. but you're looking for a way to find out client ip address. you didn't say you  wanted to log traffic
15:04 < datruth> < datruth> I just want to see the clients ip instead of the vpn server ip this way we can can track down what user had what ip and what all that ip
15:04 < datruth>                  accessed
15:04 < datruth> So is there anyway this can be done?
15:05 < Bushmills> yes. "I just want to see the clients ip ...  this way we can ..."
15:05 <@vpnHelper> RSS Update - forum: Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html#p14622>
15:05 -!- Guest42385 [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
15:05 -!- Guest42385 [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:05 < datruth> wow
15:05 < Bushmills> status shows addresses. those you can use to achieve your goal.  as we have already forgotten about connect scripts, i can't tell you about the alternative
15:06 < datruth> So is there anyway this can be done meeting all the requirments I want?
15:06 -!- Guest42385 [~Olipro@uncyclopedia/pdpc.21for7.olipro] has left #openvpn []
15:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:06 < Bushmills> *what* requirements (besides "being able to see addresses")?
15:07 < datruth> Bushmills: I've explained it several times, thanks anywho you just don't comprehend it
15:07 < Bushmills> well, then enjoy the replies of all the others who understand what you actually want to achieve
15:08 < Bushmills> good luck
15:08 < datruth> i'm going to, this is irc
15:09 < datruth> Anyone else in here use the managment console?
15:09 < EugeneKay> Nope.
15:10 -!- finetic [~finetic@213.155.20.16] has quit [Quit: leaving]
15:15 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:18 -!- sedulous [~sedulous@gustavgnu-1-pt.tunnel.tserv6.fra1.ipv6.he.net] has joined #openvpn
15:24 < defsdoor> datruth, stop natting your clients and make sure your routing is setup properly - i.e. all your lan destination know how to get back to client ips
15:25 < defsdoor> datruth, that's what you /need/ to do - if you don't understand how then you need a consultant
15:25 < defsdoor> I'm available at 650GBP per day
15:26 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has quit [Quit: leaving]
15:30 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
15:39 <@vpnHelper> RSS Update - forum: Elimintate a client from server <http://forums.openvpn.net/topic8633.html#p14623>
16:03 < Olipro> !ipv6
16:03 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
16:08 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:10 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
16:16 -!- Nappy_ [~nappy@50-244.97-97.tampabay.res.rr.com] has joined #openvpn
16:19 -!- Nappy__ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has quit [Ping timeout: 240 seconds]
16:31 -!- drgr33n [~drgr33n@94.196.173.58.threembb.co.uk] has quit [Quit: Leaving]
16:49 < uuuppz> a good day in uuuppz land :)
16:52 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:01 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:02 -!- fengshaun [~fengshaun@cpe-098-024-011-229.carolina.res.rr.com] has joined #openvpn
17:04 < fengshaun> I'm trying to do a "push redirect-gateway def1 bypass-dhcp" on my server.ovpn (using windows).  My client will be a linux system and I want the client's traffic to be solely passed through the vpn server (a windows machine).
17:04 < fengshaun> Now, there is something about NATing on openvpn documentation, how would I do that on Windows?
17:05 < fengshaun> in other words, how would I NAT WinTAP32 driver to my internet connection?
17:07 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Quit: >:o]
17:08 < EugeneKay> !windows
17:08 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
17:09 < fengshaun> thanks, but I don't have any choice with regards to the OS on this computer.
17:10 < EugeneKay> You can argue with ICS, or argue with netsh. GOod luck, you'll need it.
17:12 < fengshaun> EugeneKay: thanks!
17:18 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has quit [Remote host closed the connection]
17:19 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has joined #openvpn
17:28 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
17:30 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
17:38 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
17:42 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has joined #openvpn
17:43 < Olipro> fengshaun: is the Windows machine running a client or server edition of Windows?
17:49 < fengshaun> Olipro: well, it looks like both run Windows.  I was mistaken to think the client was running Linux!
17:50 < Olipro> not really answering my question though is it
17:50 < fengshaun> oh, sorry, one windows machine is running the server (the one I'm on right now
17:50 < fengshaun> )
17:50  * Olipro headdesks
17:50 -!- grendal-prime_ [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 260 seconds]
17:50 < Olipro> just tell me what version and edition of Windows it it
17:50 < Olipro> *it is
17:51 < fengshaun> Oh, server is Vista Home, and client is 7 home.
17:51 < Olipro> ok, so not Windows Server
17:51 < Olipro> so you won't have RRAS
17:51 < fengshaun> no!
17:52 < Olipro> well you can enable ICS on the TAP interface
17:52 < Olipro> but it'll be expecting addresses in a specific subnet
17:52 < Olipro> something like 192.168.1.0/24
17:52 < fengshaun> Another complication is that the server is behind some sort of general corporate router (university, to be specific), so I have to SSH tunnel to the client and connect the two that way.
17:52 < fengshaun> Olipro: oh!
17:52 < fengshaun> so, 10.8.0.0/24 wouldn't work?
17:53 < Olipro> not out of the box, no
17:53 < fengshaun> oh ok, that makes sense!
17:53 < Olipro> I'm sure you can fiddle with netsh to make it accept that
17:53 < Olipro> is this server providing for multiple clients
17:53 < Olipro> or just one
17:53 < fengshaun> no, just one!
17:54 < Olipro> then just use it in a p2p type mode
17:54 < fengshaun> how?  I didn't see anything about that in the HOWTO
17:54 < Olipro> if both machines know the IP of the other, and both use the same port over UDP, then it'll punch through firewalls just fine
17:55 < Olipro> providing UDP isn't being blocked anywhere... you'd hope not
17:55 < fengshaun> the problems is, my router reports the "public ip" as 192.168.*.* address.
17:55 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Read error: Connection reset by peer]
17:55 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has joined #openvpn
17:56 < fengshaun> but whatismyip.org reports the *real* public ip.
17:56 < Olipro> yes, so you can either configure the server to assign the same subnet and route to clients so that the router handles all NAT
17:56 < Olipro> or you can have two levels of NAT
17:56 < Olipro> personally, if you've got spare addresses in the existing subnet, I'd go with straight-up routing
17:57 < fengshaun> I'm new to networking, could you explain that a bit more?
17:57 < Olipro> explain which aspect a bit more
17:57 < fengshaun> NATing.
17:58 < Olipro> it stands for Network Address Translation
17:58 < fengshaun> ok, found it on wikipedia, thanks!
18:00 < fengshaun> so, assuming this scenario: client <------> university "router" <------> my router <-------> server, right now, I make a SSH tunnel from server to client and connect openvpn through the tunnel (remote localhost 1194 on the client).
18:00 < fengshaun> Is there any way to not use SSH tunnel and just connect with openvpn?
18:01 < fengshaun> I think you already explained it, but I didn't understand it.
18:01 < Olipro> yes, I already said; use UDP on both ends with identical ports
18:01 < fengshaun> Olipro: ok, let me try it
18:02 < Olipro> you will also need to specify the remote ip address on both ends
18:03 < fengshaun> on both ends?  So, "remote clientip port" in server.ovpn?
18:03 < Olipro> yes, server and client need to have the remote end specified
18:03 < fengshaun> oh, that makes sense, thanks!
18:03 < Olipro> and obviously, it needs to be the public IP
18:03 < fengshaun> yup
18:04 < Olipro> the point is that each end will try to connect to the other over UDP, so each end's firewall will track the UDP's destination
18:04 < Olipro> thus packets from either end will be allowed through the firewall
18:09 < fengshaun> ok, I have to leave now, looks like I'll have to change most of server.ovpn since I can't use 'server' anymore.
18:09 < fengshaun> Olipro: thanks a lot for you help!
18:10 -!- fengshaun [~fengshaun@cpe-098-024-011-229.carolina.res.rr.com] has quit [Quit: WeeChat 0.3.5]
18:10 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:14 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
18:15 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 250 seconds]
18:18 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
18:19 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 240 seconds]
18:32 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
18:32 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
18:46 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has quit [Remote host closed the connection]
18:50 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
18:51 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 276 seconds]
19:04 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
19:06 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has joined #openvpn
19:11 -!- grendal-prime_ [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has joined #openvpn
19:14 -!- Denial [~Denial@drgi.co.uk] has quit []
19:44 -!- Squidy_at_Home [~quassel@187.54.243.61] has joined #openvpn
20:03 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
20:13 -!- ArtVanda1ae [~SuperUnkn@125.209.134.233] has joined #openvpn
20:23 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
20:27 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
20:42 -!- Nappy__ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has joined #openvpn
20:44 <@vpnHelper> RSS Update - forum: Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html#p14624>
20:45 -!- Nappy_ [~nappy@50-244.97-97.tampabay.res.rr.com] has quit [Ping timeout: 264 seconds]
20:46 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Quit: >:o]
20:48 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit []
20:49 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:49 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
20:49 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
20:49 -!- mode/#openvpn [+v Axeman] by ChanServ
20:52 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has joined #openvpn
20:52 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
20:55 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Client Quit]
20:56 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
20:56 -!- kerryderry [~root@71.21.164.84] has joined #openvpn
20:57 -!- kerryderry [~root@71.21.164.84] has quit [Client Quit]
20:57 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Client Quit]
21:00 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:09 -!- adubz [~zvpn@pool-71-97-12-252.dfw.dsl-w.verizon.net] has joined #openvpn
21:12 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has joined #openvpn
21:12 < adubz> anyone here have openwrt
21:13 < Olipro> yes
21:19 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
21:21 < dijital1> ^
21:22 < uuuppz> hi
21:24 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
21:27 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
21:27 -!- mode/#openvpn [+v Axeman] by ChanServ
21:29 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:31 -!- doublehp [~DoubleHP@2a01:e35:8ba8:e140::52] has joined #openvpn
21:32 < doublehp> hello; what is the name of the option/feature to make vpn resist to network loops ?
21:39 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
21:53 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
21:56 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:59 -!- adubz [~zvpn@pool-71-97-12-252.dfw.dsl-w.verizon.net] has quit [Ping timeout: 250 seconds]
22:01 < Olipro> doublehp: are you thinking of STP in brctl
22:02 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:04 < doublehp> in fact , i am not sure STP would fix this ... i will google more on STP.
22:19 < doublehp> thanks
22:19 -!- doublehp [~DoubleHP@2a01:e35:8ba8:e140::52] has quit [Quit: Leaving.]
22:52 -!- Squidy_at_Home [~quassel@187.54.243.61] has quit [Ping timeout: 240 seconds]
22:53 -!- gyyrog_ [~gyyrog@adsl-99-181-137-54.dsl.klmzmi.sbcglobal.net] has joined #openvpn
22:55 -!- gyyrog [~gyyrog@adsl-99-181-158-238.dsl.klmzmi.sbcglobal.net] has quit [Ping timeout: 252 seconds]
22:59 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
23:02 -!- vpnuser [~vpnuser@119.93.51.34] has joined #openvpn
23:08 -!- grendal-prime_ [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has quit [Ping timeout: 260 seconds]
23:14 < datruth> Does anyone know of away in ubuntu using openvpn, to track down clients vpn assigned ip and traffic associated via firewall/iptables?
23:15 < EugeneKay> Via iptables? Nope. It's not difficult to grep for it in the openvpn log, or assign static IPs to clients.
23:16 < datruth> if I assign static ips to clients I guess I would need to add those ips on the vpn interface and nat ip-to-ip?
23:17 < ecrist> datruth: status log in openvpn.
23:17 < datruth> EugeneKay: I agree its not hard to look at the logs but for a troubleshooting requirment this all need to be managed/monitored at our firewall
23:18 < EugeneKay> Sounds like you need to write some sort of management wrapper ;-)
23:19 < datruth> ecrist: even tho the status log shows an client ip and what date the last logged on it does not log the traffic per ip
23:19 < vpnuser> guys with the insight that sir ecrist told me at my isp can still see my server ip during the connection process between server and client, can openvpn also encrypt that server ip address so that the isp cant see it?
23:19 < ecrist> sure does
23:19 < ecrist> datruth: it most definately logs the traffic for each client
23:20 < datruth> EugeneKay: a wrapper i'm not sure would help with the firewall logging / traffic
23:20 < datruth> ecrist: hrmm i've looked at the logs I dont see any type of traffic
23:21 < vpnuser> would anyone give me inputs?
23:23 < ecrist> vpnuser: it's not possible
23:23 < vpnuser> ecrist: wny sir?
23:27 < Olipro> oh god he's in here too
23:27 < ecrist> vpnuser: it's not possible.
23:27 < ecrist> it just isn't
23:27 < ecrist> datruth: look at status-version 2
23:28 < Olipro> vpnuser: your ISP has to actually transmit your packets, that is what you pay them for
23:28 < Olipro> "I'd like a taxi driver to drive me somewhere, but I don't want him to know where"
23:28 < Olipro> herp derp
23:41 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html>
23:43 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:45 < vpnuser> so the server ip address is not part of the encrypted data sent between server and client during the connection ?
23:46 < Olipro> do you think that packets bound for a destination just get there by magic?
23:46 < Olipro> little magic pixies inside the router hardware carry them from port to port right?
23:47 < Olipro> your question is roughly as moronic as "can I browse websites on my computer if it's turned off"
23:47 < vpnuser> I was thinking that the packets are just sent into the internet as a whole and yes like router : port to port
23:48 < vpnuser> Olipro: its still a question but not as bright or intelligent compared to those who are really have the know how
23:48 < Olipro> here's an idea, go write a letter for someone somewhere, put it in an envelope, encrypt the address and write the encrypted version on it and see if it gets delivered
23:49 < Olipro> if the IP address is encrypted, all your ISP's routers can see is garbage, they have absolutely no idea where to send it
23:52 < vpnuser> i see.
23:53 < vpnuser> so there is no real way of hiding the server ip?
23:54 < OmnipotentEntity> vpnuser, not from everyone, but it is possible, if you're insane, to try to tunnel through Tor.
23:54 -!- vpnuser [~vpnuser@119.93.51.34] has quit []
23:55 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
23:55 < hyper_ch> Olipro: you have little magic pixies in your router?
23:56 < hyper_ch> awwww, I want some for myself
--- Day changed Fri Aug 12 2011
00:03 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
00:05 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 240 seconds]
00:32 -!- ravidar [~ravidar@ip68-230-182-242.dc.dc.cox.net] has quit []
00:39 <@vpnHelper> RSS Update - forum: Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html#p14626>
00:45 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14627>
00:53 -!- grendal-prime_ [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 252 seconds]
01:09 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
01:18 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
01:18 -!- vpnuser [~vpnuser@119.93.51.34] has joined #openvpn
01:20 < vpnuser> so the idea of encrypting the server ip is really impossible?
01:22 -!- vpnuser [~vpnuser@119.93.51.34] has left #openvpn []
01:35 < EugeneKay> Yes. You're doing it wrong.
01:35 < EugeneKay> This is not what OpenVPN is meant to do
01:35 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:39 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:54 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:54 -!- mode/#openvpn [+o mattock] by ChanServ
02:03 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14628>
02:13 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:28 -!- Teb76 [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has joined #openvpn
02:28 < Teb76> hi to all
02:28 < Teb76> I've a problem in trying to access my vpn using my android mobile
02:29 < Teb76> if I use in tethering mode I can full access my VPN from my laptop
02:30 < Teb76> if I try to use directly openvpn for android, the connection is estabilished correctly but i cannot access any machine of my vpn
02:31 < Teb76> even if I try to ping I've no answers from 192.168.0.x while pinging to 10.8.0.1 give immediatly time to live exceeded
02:32 < Teb76> any tips to try to solve this matter?
02:34 < EugeneKay> By default, Android will not allow you to access the VPN network via tethering. Your beest bet is to run the OpenVPN client on your tethered computer.
02:36 < Teb76> EugeneKay, I've the opposite! Using tethering all works fine, using openvpn client nothing works
02:37 < EugeneKay> Ah. Then it's something wrong with how you have your OpenVPN client configured. Is it the market app ro the CM integrated one?
02:37 < Teb76> obviously when I use tethering the client is running on the latptop, not on cellphone
02:37 < Teb76> EugeneKay, the market app
02:37 < EugeneKay> I don't use it, sorry.
02:38 < Teb76> should I use the integrated one ?
02:38 < EugeneKay> I do. 
02:38 < Teb76> ok, I'll try
02:38 < Teb76> how can I set the use of the key files?
02:39 < EugeneKay> You need to turn them into a .p12, and load it into the Security thing in settings.
02:40 < Teb76> may you help me in doing this?
02:40 < EugeneKay> at 3AM? Unlikely.
02:40 < EugeneKay> The CM wiki has a page on making the p12
02:40 < Teb76> ehehehe here we are at 9 am :)
02:40 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
02:41 < Teb76> ok I'll search for it 
02:41 < Teb76> thank you for your help
02:41 < EugeneKay> It's something like openssl pkcs12 -in cert.crt -inkey cert.key -out pack.p12
02:41 < EugeneKay> But I use XCA for all y cert stuff nowadays, anyway
02:42 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
02:42 < Teb76> ok, I'll google openvpn .p12 
02:42 < Teb76> I hope to be lucky
02:44 < Olipro> EugeneKay: <3 XCA
02:44 < EugeneKay> Me too
02:45 -!- EugeneKay is now known as EugeneSleep
02:46 < Teb76> Olipro, what is XCA?
02:46 < Olipro> What is Google?
02:46 < Olipro> for 9 points!
02:49 -!- luneff [~yury@84.51.199.31] has quit [Quit: This computer has gone to sleep]
02:49 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Remote host closed the connection]
02:49 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
02:53 < Teb76> Olipro, thanks for your help
02:54 -!- dazo_afk is now known as dazo
03:06 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:34 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14629>
03:35 -!- luneff [~yury@109.165.28.146] has joined #openvpn
03:37 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
03:40 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
03:52 <@vpnHelper> RSS Update - forum: Trouble connecting two sites <http://forums.openvpn.net/topic8593-15.html#p14630>
03:53 -!- gyyrog_ [~gyyrog@adsl-99-181-137-54.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
03:58 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14632> || Elimintate a client from server <http://forums.openvpn.net/topic8633.html#p14631>
04:02 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
04:17 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
04:19 < Teb76> anyone can help me using openvpn for android?
04:19 < Teb76> I can connect to my vpn but I cannot see any machine
04:20 < Teb76> no ping anserwes
04:20 < Teb76> no ping answer
04:21 <@dazo> Teb76: in 99% of all cases, this is either a) routing or b) firewalling ... check this on your android, openvpn server and if you try to reach a client behind the openvpn server, also check this on that client
04:22 <@dazo> Teb76: Tools which can help you are tcpdump or ethereal/wireshark ... especially if run on the openvpn server
04:22 < Teb76> dazo, the server is on windows 7, the client is android
04:22 <@dazo> that doesn't change the fact of what I've already said
04:22 < Teb76> I see from the server's log that route are pushed to the client
04:23 < Teb76> dazo, it seems a routing problem but how I can check and find the solution?
04:24 <@dazo> Teb76: try using ethereal/wireshark on your openvpn server
04:25 <@dazo> then you can see where packets comes from and where they go
04:25 < Teb76> ok, I do
04:35 < Teb76> dazo, I'm installing wireshark, because trying to download ethereal I get a corrupted file
04:36 <@dazo> ethereal is the old wireshark ... they changed names at some point ... but some people know it as etheral, others as wireshark 
04:36 < Teb76> ok :) so it's good however
04:36 <@dazo> https://secure.wikimedia.org/wikipedia/en/wiki/Wireshark
04:36 <@vpnHelper> Title: Wireshark - Wikipedia, the free encyclopedia (at secure.wikimedia.org)
04:36 <@dazo> :)
04:37 < Teb76> ok, I got, what should I do now ?
04:38 <@dazo> you should start it ... and observer what's happening on your tun/tap device and your local network ... to see if data is routed correctly
04:41 < Teb76> on tap interface I see some traffic all from 10.8.0.1
04:41 < Teb76> some packets to 10.8.0.3
04:42 < Teb76> some other to 224.0.0.252
04:42 < Teb76> (last one brodcast I suppose)
04:42 <@dazo> When I look out of my window, I also see some traffic ... but that's probably not related to your traffic ... 
04:42 < Teb76> all of the pakets to 10.8.0.3 are "name query"
04:42 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
04:42 -!- mode/#openvpn [+v s7r] by ChanServ
04:43 <@dazo> Teb76: did you do any ping?
04:43 < Teb76> from the server?
04:43 < Teb76> they go on the tap interface 
04:44 <@dazo> try from your VPN client to the box you want to reach in your VPN
04:44 < Teb76> but had no answer
04:44 <@dazo> and then see what wireshark says about that
04:45 <@dazo> if nothing appears on the tap device on the server (where wireshark is running), you have either a) routing issue on your client, b) firewall issues on your client or, c) firewall issues on your openvpn server
04:46 < Teb76> dazo, ok, ping 10.8.0.1: no trafic on tap server, get "icmp_seq=1 time to live exceeded" at the client coming from 172.17.8.46
04:46 <@dazo> then you need to look at a) or b)
04:47 < Teb76> how can I check them on an android device?
04:47 < Olipro> if you're getting TTL exceeded, packets are simply bouncing between 2 or more routers
04:47 < Teb76> maybe my ISP on the mobile that filters the VPN trafic
04:48 <@dazo> Teb76: most likely not ... as the VPN traffic is identified as some kind of encrypted SSL traffic
04:48 < Teb76> maybe my ISP on the mobile that filters the VPN trafic?
04:48 < Teb76> ok, so probabily a routing problem ?
04:48 <@dazo> if you can get the client and server to connect, and you get pushed config stuff from server to client, that's most likely not the case
04:48 <@dazo> most likely a routing problem, yes
04:48 <@dazo> Teb76: how experienced are you with networking in general?
04:49 < Teb76> not much
04:49 < Teb76> only some simple thing on my home lan
04:49 <@dazo> okay, then you need to get the basics first ... VPN is difficult, in fact quite a lot, if you don't have much networking experience
04:49 <@dazo> !tcpip
04:49 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
04:49 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
04:49 -!- mode/#openvpn [+v Axeman] by ChanServ
04:50 <@dazo> Teb76: home lan in most cases doesn't require you to think too much about routing (except default route) ... subnetting, which VPN uses, is another challenge
04:50 < Teb76> I know :)
04:50 <@dazo> so look at the !tcpip chapter 3.1 ... that'll give you a kick start on subnets and routing
04:51 < Teb76> this is the reason fot wich I'm here 
04:51 < Teb76> Ok, I'll look
04:51 < Olipro> if you don't have an intimate understanding of BGP within the next hour I will come over there and stab you in the face
04:51 <@dazo> in this channel, we take for granted that users knows basic TCP/IP networking - including routing
04:52 < Olipro> really? because nobody ever does
04:52 <@dazo> Olipro: be nice! ... if you stab him in the face, he can't read and learn more
04:52 < Olipro> I was joking
04:52 <@dazo> Olipro: that's why it's good to point people at !tcpip 
04:52 < Olipro> but really, why do people fail so hard at routing? :(
04:53 < Teb76> if all of us knew all nobody would needs help
04:53 <+Axeman> !tcpip
04:53 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
04:54 -!- Sw33NY_ [~Sw33NY___@ks30628.kimsufi.com] has joined #openvpn
04:54 < Sw33NY_> hi all 
04:54 <@dazo> Olipro: because home lans are made so simple that they don't need to understand networking to set it up ... and they think VPN is just another "blackbox" which does magic ;-)
04:54 < Teb76> how can I check the IP assigned to the client from server ?
04:54 < Olipro> ARGH
04:55 < Teb76> on the server's log I have 10.8.0.10
04:55 <@dazo> Teb76: log files ... and OS related tools querying the network adapters (TUN/TAP adapter is a virtual network adapter)
04:56 <@dazo> In Linux, it's common to use 'ip addr' or 'ifconfig' ... for windows, 'ipconfig' does it
04:56 < Sw33NY_> i run on Debian Squeeze / Wheezy with Openvpn 2.2.0-2. My openvpn network work great with 3 computers but i want to generate another certificate, for another computer, how can i start to generate new certificate without crash my configuration ?
04:56 <@dazo> Sw33NY_: Do you know the concept of trusted third party, PKI and certificates?
04:57 < Teb76> dazo, on android, I open a terminal window and when I give ifconfig I have no answer
04:57 <+Axeman> btw, ty dazo ... this is good for me about to print upto chapter three to read later today
04:57 <@dazo> Axeman: you're welcome :)  It's a lot of goodies in that book ... but I'm not claiming to have read all of it :)
04:58 <@dazo> Teb76: you most likely need to have admin/root privileges
04:58 < Sw33NY_> dazo, not very good, i don't remember how i have doing
04:59 < incidence> Hey, I installed OpenVPN but it works. But when I try to access websites outside the network, I get content behing the router/server. Like google.com -> 10.0.1.7
05:00 <@dazo> Sw33NY_: the concept is that you have a CA (certificate authority) which signs ceritifcate requests.  In OpenVPN you have easy-rsa which is a simplified CA which generates keys, signing requests and can sign them -> which gives you certificates
05:00 <@dazo> then you just need to provide your new client this certificate
05:00 < Teb76> dazo, I've administraive privileges: su
05:00 <@dazo> Sw33NY_: this CA can be wherever ... you just need to have the CA key password
05:01 <@dazo> your server have a signed server certificate from this CA, and the CA certificate ... when a client connects, it can validate the clients certificate against the locally stored CA certificate
05:01 <@dazo> if it matches, it's all good
05:01 -!- Denial- [~Denial@drgi.co.uk] has joined #openvpn
05:02 <@dazo> Sw33NY_: point is ... you don't need to change any openvpn config ... you just need to create a new certificate in your own CA ... and that's it
05:03 -!- Denial [~Denial@drgi.co.uk] has quit [Ping timeout: 258 seconds]
05:03 < Sw33NY_> dazo, yeah, i think i have understand, i have try ./build-key mynewclient and my server reply : http://paste.debian.net/125994/
05:04 < Sw33NY_> dazo, i understand, i must delete my files or it's not mandatory
05:05 <@dazo> no, you have probably not sourced ./vars
05:05 <@dazo> try doing:  . ./vars
05:05 <@dazo> and then run this script again
05:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:05 -!- secondchoice [~thirdchoi@knox.pace.edu] has joined #openvpn
05:06 < Teb76> dazo, giving ip route on my client I have
05:06 < Teb76> 2.193.7.1 dev pdp0 scope link
05:06 <@dazo> Teb76: then openvpn is not running
05:06 < Teb76> 2.193.7.0/24 dev pdp0 proto kernel scope link src 2.193.7.23
05:07 < Sw33NY_> dazo, my server reply : if you run ./clean-all i will be doing a rm -rf /etc/openvpn/easy-rsa/2.0/keys :) 
05:07 < Teb76> default via 2.193.7.1 dev pdp 0+
05:07 <@dazo> Sw33NY_: yeah ... don't do that ... just run ./build-key
05:07 < Teb76> dazo, it seems the tap on the client was not created 
05:07 <@dazo> Teb76: might be as well ... then you need to figure out why ... log files in openvpn will give you clues
05:08 < Sw33NY_> dazo, always paste.debian.net... I can't generate new certificate  
05:08 <@dazo> Teb76: I presume you're running OpenVPN on CM (rooted Android) and not stock Android firmware
05:08 < Teb76> dazo, yes, rooted, Darky's room
05:08 < Sw33NY_> dazo, ok :)
05:09 < Teb76> but the openvpn config says: connetcted to 
05:09 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
05:09 <@dazo> Teb76: yeah, but openvpn can connect even without having a tun/tap device
05:09 < Sw33NY_> dazo, ./vars don't work... i have try source ./vars and now ./build-key srv-debian2 it work :)
05:09 <@dazo> Teb76: you need to read the complete log file, from start to end, line by line
05:09 < Sw33NY_> dazo,thanks 
05:10 <@dazo> Sw33NY_: I said: . ./vars     .... not ./vars
05:10 < Sw33NY_> :)
05:10 < Teb76> dazo, where the log is located on androdid ?
05:10 <@dazo> but 'source ./vars' does pretty much the same as: . ./vars
05:10 <@dazo> Teb76: I dunno ... what does your config file say?
05:11 < Sw33NY_> dazo, Data Base Updated 
05:11 < Teb76> dazo, I can past my server config file, I don't know where the client config file is located
05:11 <@dazo> Sw33NY_: cool!  now you should be good to go ... grab the key and cert to your client ... and it should Just Work(tm)
05:12 < Sw33NY_> dazo, great thanks, i try that :p 
05:12 <@dazo> Teb76: if no 'log' entry is given, it goes to stdout ... try adding log /tmp/openvpn.log  and verb 4 in that config
05:12 <@dazo> Sw33NY_: you're welcome
05:14 < Teb76> I try
05:18 < Teb76> dazo, ok, I've the log, how can I show you?
05:19 <@dazo> Teb76: have you tried to read through the log?  did you see any errors or warnings there?
05:19 < Teb76> dazo, last rows are "remote_cert_ku[i]=0"
05:19 <@dazo> Teb76: I'm not going to do the job for you ... but I'll help you figure out what's wrong and what's right by guiding you
05:20 < Teb76> dazo, yes, let me read all of the rows
05:21 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
05:22 < Teb76> dazo, Fri Aug 12 12:17:00 2011 us=331646 RESOLVE: Cannot resolve host address: robertomento.dyndns.org: [TRY_AGAIN] A temporary error occurred on an authoritative name server
05:23 <@dazo> Teb76: that's one issue
05:23 < Teb76> Fri Aug 12 12:17:15 2011 us=616039 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:1: route (2.1.1)
05:23 <@dazo> Teb76: that's another issue, which needs to be fixed
05:23 < Teb76> dazo, 
05:24 < Teb76> Fri Aug 12 12:17:15 2011 us=618035 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: route (2.1.1)
05:24 < Teb76> Fri Aug 12 12:17:15 2011 us=619109 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:9: ifconfig (2.1.1)
05:24 <@dazo> the same here as well
05:24 < Teb76> dazo, good! ther's a lot of work to do :D
05:24 <@dazo> definitely
05:24 < Teb76> dazo, ok, first of all I'll check the push route command
05:24 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
05:24 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
05:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:25 <@dazo> Teb76: I'm sure there are even more ... it has to be because, tun/tap adapters are created earlier
05:25 < Teb76> dazo, what should I do?
05:27 <@dazo> find out why the tun/tap adapter is not created, based on the log data?
05:28 -!- Gaglia [~gaglia@host103-184-dynamic.21-87-r.retail.telecomitalia.it] has joined #openvpn
05:30 < Gaglia> hi, I'm receiving require VERIFY nsCertType=SERVER errors when I try to connect my Openvpn client to the server... how do I generate a server cert with nsCertType=SERVER enabled manually? (i.e. without using the easy-rsa script)
05:35 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:45 < Teb76> dazo, I'm really not finding anything :(
05:46 < Teb76> dazo, I've to go now, may I find you here late in the afternoon?
05:46 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
05:47 <@dazo> Teb76: probably not, but there are more people here as well
05:48 < Teb76> dazo, but I have to explain all from the starting point..
05:48 <@dazo> not if they read the scrollback or you point them at the starting point of our discussion
05:48 < Teb76> ok, thank yoi
06:03 < Gaglia> ok nevermind, found it
06:03 < Gaglia> it seems that the default openssl.cnf lacks a [server] section
06:10 < Gaglia> btw, is anybody concerned about the fact that it seems there is a bug in 1.0.0 preventing the use of EC cryptography with any message digest other than md5 and sha1? Or it's just me?
06:11 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
06:13 <+s7r> it's just you
06:13 < Gaglia> ok, that relieves me
06:13 < Gaglia> not.
06:26 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Quit: Leaving.]
06:27 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
06:28 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
06:30 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:45 < Teb76> dazo, still there?
06:50 -!- secondchoice is now known as axeman
07:03 -!- axeman [~thirdchoi@knox.pace.edu] has quit [Ping timeout: 258 seconds]
07:10 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:11 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 250 seconds]
07:21 < Teb76> does anyone help me following my conversation with dazo this morning ?
07:25 -!- julius__ [~julius@p3EE2B138.dip.t-dialin.net] has joined #openvpn
07:25 < julius__> hi
07:26 < julius__> i cant ping from client to client with my openvpn config, any idea whats wrong?  client to server works  http://paste.pound-python.org/show/10918/
07:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
07:41 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
07:41 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
07:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
07:42 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
07:45 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
07:49 < Teb76> may anyone help me in understanding why my client does'nt works when I connect from my mobile ?
07:50 < ecrist> um, because you don't pay for a data plan?
07:51 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Quit: >:o]
07:52 <+s7r> becasue maybe your carrier blockes the port on which your server is configured to listen e.g. 1194 UDP
07:54 < Teb76> I got this message on log Fri Aug 12 14:44:44 2011 us=107708 TCP/UDP: Incoming packet rejected from 192.168.0.3:1194[2], expected peer address: 79.8.21.26:1194 (allow this incoming source address/port by removing --remote or adding --float)
07:54 < Teb76> s7r, I think this is not the cause, because when I use my mobile in tethering mode I connect and all works fime
07:54 < julius__> did you try the two options the message shows?
07:55 <+s7r> that is something in your config Teb76
07:55 <+s7r> you configure the server accept policies
07:55 < Teb76> julius__, I don't understand what I should do, should I change che .ovpn file?
07:55 <+s7r> just ad float in the conf and ovpn file
07:56 < julius__> read about --float and --remote in the manpage
07:56 <+s7r> or remove remote line from the server .conf config *not client*
07:56 < Teb76> I try
07:56 < Gaglia> Teb76, post your server.conf and client.conf files via pastebin or similar
07:56 < Teb76> !pastebin
07:56 <@vpnHelper> Error: Couldn't get RSS feed.
07:56 <+s7r> Teb76: dod what I said
07:57 <+s7r> remove the line "remote[...]"
07:57 <+s7r> from the server config .conf file
07:57 < Teb76> I've no remote line on server.ovpn
07:57 <+s7r> you have some accept policies defined
07:57 <+s7r> could you please paste bin it ?
07:57 < Teb76> please send me the link for paste bin
07:57 <+s7r> www.pastebin.com
07:58 <+s7r> paste it there and give us link
07:59 < Teb76> http://pastebin.com/XuA8LsBM
07:59 < Teb76> this is the server config
08:01 < Gaglia> server 10.8.0.0 255.255.255.0
08:01 < Gaglia> push "route 192.168.0.0 255.255.255.0"
08:01 < Gaglia> is this intended?
08:02 <+s7r> that is the problem
08:02 < ecrist> it looks as though you're redirecting default gateway and not omitting the VPN server address
08:02 <+s7r> Incoming packet rejected from 192.168.0.3:1194[2],
08:02 < Teb76> Gaglia, what I would to do is to let the client to see any other machine that is within the lan of the server
08:02 <+s7r> your phone probably has the same NAT IP
08:02 <+s7r> in the same class 192.168.0.0/24
08:03 < Teb76> s7r, I think no
08:03 < Teb76> I'm trying to connect using ISP, not on lan
08:03 < Teb76> so I think the phone has another IP
08:03 <+s7r> yes but phones usually don't have direct public ip addresses
08:04 <+s7r> they are nat-ted multiple phones behind the same public ip address
08:04 <+s7r> and you probably have a 192.168 ip 
08:04 <+s7r> so, as Gaglia said, comment that line and remove those static routes
08:04 < Teb76> s7r, maybe
08:04 <+s7r> see if ti works
08:04 < Teb76> Ok, I try to comment the push line ?
08:05 <+s7r> yes
08:05 <+s7r> just that with route
08:06 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
08:07 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 240 seconds]
08:07 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 258 seconds]
08:08 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 276 seconds]
08:10 < Teb76> s7
08:10 -!- axeman [~thirdchoi@198.105.46.46] has joined #openvpn
08:10 -!- axeman [~thirdchoi@198.105.46.46] has quit [Changing host]
08:10 -!- axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
08:10 -!- mode/#openvpn [+v axeman] by ChanServ
08:10 < Teb76> s7r, I can not reach the server from the client yet
08:10 <+s7r> what ?
08:10 < Gaglia> Teb76, are you able to ping the server?
08:10 < Gaglia> and what is your phone's IP like?
08:11 < Teb76> Gaglia, no, the connection is estabilished but I can not ping the server
08:11 <+s7r> one of the many many problems causd by NAT :)
08:11 <+s7r> hopefully ISPs will get on full Ipv6 soon
08:11 < Gaglia> I agree with s7r
08:11 < Gaglia> it is probably a malconfigured NAT
08:11 < Gaglia> you should first of all be able to ping the server
08:11 <+s7r> that is the only logic problem which seams to be at the moment
08:12 < Gaglia> before bothering with openvpn
08:12 <+s7r> Teb76: let me understand you can't connect to the server to comment that line ?
08:12 < Teb76> Ok, sorry for the confusion. I try to explain from the beginning :)
08:13 < Teb76> I'm using openvpn for android, the connection is estabilished, I see this form the server log and the message on the phone
08:13 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
08:13 -!- mode/#openvpn [+o mattock] by ChanServ
08:13 < Teb76> but, after this I'm not able to ping 10.8.0.1, receiving a time to live exceeded error
08:14 <+s7r> what about that error you pasted eralier
08:14 < Teb76> maybe better to paste my server and client log?
08:14 <+s7r> with 192.168 
08:14 < Teb76> that error was within the client log
08:14 <+s7r> yes - so you have the same NAT IP on the client and that is why you had that error ...
08:15 <+s7r> but you should be able to ping the server
08:15 < Teb76> let me clear the logs and I'll paste them for you
08:16 < Gaglia> Teb76, you should post your client.conf too
08:16 < Teb76> Gaglia, sure
08:16 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
08:17 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:17 < Teb76> actually I see the incoming connection from mobile whit the IP 2.193.72.179
08:18 <+s7r> you can't see from server side if your phone is behind NAT or not
08:18 <+s7r> that is what NAT does - translates packets modifying address
08:18 <+s7r> of course on the server you see connection comming from public IP address
08:18 <+s7r> but that may not be the case
08:20 < Gaglia> Teb76, anyway, as a first thing I would do a little troubleshooting
08:20 < Gaglia> substitute ;local a.b.c.d in your server.conf
08:20 < Gaglia> with local 192.168.X.Y (your server's lan ip address, the one you NATted)
08:21 < Gaglia> then comment that push "route 192.168.0.0 255.255.255.0" option
08:21 < Teb76> Gaglia, please wait while I'm getting the log from the client
08:21 < Gaglia> connect with client
08:21 < Gaglia> and then do an ifconfig from your client to see if the tun interface is active
08:21 < Gaglia> ok
08:22 < Teb76> http://pastebin.com/buH91KHJ this is the log
08:22 < Mowee> Hey
08:23 <+s7r> Fri Aug 12 15:17:16 2011 us=434125 Options error: Unrecognized option or  missing parameter(s) in [PUSH-OPTIONS]:8: ifconfig (2.1.1)
08:23 < Teb76> http://pastebin.com/FKtCVvae this is the client config
08:23 <+s7r> Fri Aug 12 15:18:07 2011 us=555133 Closing TUN/TAP interface Fri Aug 12 15:18:07 2011 us=808201 SIGTERM[hard,] received, process exiting
08:23 <+s7r> that is pretty clear to me 
08:23 <+s7r> it's malconfigured NAT
08:23 <+s7r> comment that line!!
08:24 < Teb76> s7r, I already done, when you told me before
08:24 <+s7r> and the same 
08:24 <+s7r> ?
08:24 < Teb76> yes, these pastes are taken after commenting that line (see the timestamp)
08:25 <+s7r> you have openvpn installed on windows ?
08:25 <+s7r> what operating system does your server have?
08:25 < Teb76> s7r, windows 7
08:25 < Gaglia> Teb76, no you didn't o.O
08:25 < Gaglia> Fri Aug 12 15:17:16 2011 us=430265 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.0.3,dhcp-option WINS 192.168.0.3,dhcp-option DOMAIN casa,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
08:25 < Gaglia> which line did you comment out?
08:26 < Teb76> Gaglia, I'm going to paste my actual server config
08:26 < Gaglia> ok
08:26 <+s7r> did you enable ip forward and routing on it ?
08:27 < Teb76> http://pastebin.com/VmqPXvYD
08:28 < Teb76> yes, to be more clear I tell that connecting from my laptop, with the same config file, using phone in tethering mode, all works fine!
08:28 < Gaglia> well, that's strange: you commented the line, but the server is still pushing the route option to clients
08:29 <+s7r> did you restarted openvpn service?
08:29 <+s7r> after you commented that line ?
08:29 <+s7r> on the server?
08:29 < Gaglia> I'm not familiar with windows, maybe you should restart some service for the new conf to take effect?
08:29 <+s7r> :D
08:29 <+s7r> of course
08:29 < Gaglia> lol s7r 
08:29 < Teb76> yes, but I don't see the route pushed, I see the dhcp option
08:30 <+s7r> Teb76: when you first installed openvpn on you windows 7 machine, did you enable IP forwad, IP routing or both?
08:30 <+s7r> do you remember ?
08:30 < Teb76> yes
08:30 < Teb76> s7r, ipforwarding from windows register and from the router
08:31 <+s7r> good
08:31 <+s7r> from registry editor
08:31 < Teb76> I try using my laptop as a client and all works fine
08:31 < Teb76> the problem is only when I try to connect using my phone :(
08:31 < Teb76> s7r, using regedit, yes
08:31 < Gaglia> oh, of course Teb76, I didn't notice before: comment out the push dhcp lines in server conf too
08:31 < Gaglia> and then retry
08:32 < Teb76> Gaglia, ok, I do, but I notice that doing this I'll be not able to reach the other machine on the server lan...
08:32 < Gaglia> yes, of course, but this is a troubleshooting
08:32 < Teb76> Ok, I try
08:32 < Gaglia> let's fix one thing at time
08:32 < Teb76> let me some minute
08:32 < Teb76> :)
08:33 < Gaglia> your goal now is to be able to ping 10.8.0.1 from your phone
08:37 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
08:41 < Teb76> Ok, config commented, service restarted
08:43 < Teb76> Gaglia, nothing to do, I get time to live exceeded from 172.17.8.50
08:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 250 seconds]
08:45 < Teb76> BTW, I see a lot of packets from 10.8.0.1 to 10.8.0.3
08:46 < Gaglia> Teb76, so it seems that it is your phone rejecting packets
08:46 < Gaglia> maybe your phone provider is filtering packets then
08:46 < Teb76> but it has 10.8.0.10 ip
08:47 < Teb76> why the connection is estabilished and terminate correctly if so?
08:48 < Gaglia> no idea, sorry, maybe some sort of traffic shaping allowing just the first few udp packets through?
08:49 < Gaglia> try posting the issue on the forum
08:49 < Teb76> http://pastebin.com/rUDzT4Fk see last log entries
08:49 < Gaglia> include conf files and logs
08:50 < Teb76> thanks
08:50 < Teb76> I've to go now, I'll back in 1 hour
08:50 < Gaglia> Fri Aug 12 15:42:35 2011 us=602414 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:1: route (2.1.1)
08:51 < Gaglia> I think the problem is here: either your phone rejects the pushed routes, or the server is unable to push correctly
08:52 < Gaglia> (notice that the server must push at leat the defoult route option to link your client to the openvpn subnet, it's not a push option you specify in the server.conf)
08:54 < Teb76> thanks Gaglia I'll check when I'll come back
08:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:56 -!- mrkiko [~mrkiko@host167-248-dynamic.15-87-r.retail.telecomitalia.it] has joined #openvpn
08:56 < hyper_ch> wow, I experience something really strange
08:56 < hyper_ch> I can't ping/ssh from one client to another client in the vpn
08:56 < hyper_ch> worked fine till... 1-2h ago
08:57 < mrkiko> Hi all! 
08:57 < mrkiko> great openvpn!! :D:D:D
08:57 < mrkiko> is the topicappliable also to problems relating openvpn starting to consume a lot of bandwidth, even with no activity in the vpn itself?
08:58 < mrkiko> and the problem goes away simply restarting openvpn itself
09:00 < hyper_ch> define "consume lot of bandwidth"?
09:00 < hyper_ch> and how do you know there is no activity in the vpn itself?
09:00 -!- master_of_master [~master_of@p57B532EB.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:02 -!- master_of_master [~master_of@p57B54A43.dip.t-dialin.net] has joined #openvpn
09:04 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: A fine is a tax for doing wrong. A tax is a fine for doing well]
09:10 -!- luneff [~yury@109.165.28.146] has quit [Quit: Leaving]
09:11 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
09:12 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
09:14 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
09:20 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
09:26 -!- julius__ [~julius@p3EE2B138.dip.t-dialin.net] has left #openvpn ["Leaving"]
09:31 -!- remote [~nicolas@unaffiliated/remote] has quit [Quit: Changing server]
09:39 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has joined #openvpn
09:44 -!- Gaglia [~gaglia@host103-184-dynamic.21-87-r.retail.telecomitalia.it] has quit [Quit: Gaglia]
09:46 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
09:50 < uuuppz> hey ecrist, did u get a chance to take a look in the end?
09:55 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
09:59 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
10:10 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has joined #openvpn
10:11 -!- advocatusdiaboli [~advocatus@193.69.144.162] has joined #openvpn
10:11 < advocatusdiaboli> What is the default cipher directive used when not set in the config file?
10:13 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
10:20 < datruth> How can I have a per user vpn policy with connect scripts and iptables?
10:22 <+axeman> someone is trying to join here, that's in the -as channel, but is getting a banned error... 
10:22 <+axeman> <Bendik> i got this then i tried to connect to #openvpn : #openvpn Cannot join channel (+b) - you are banned
10:25 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
10:33 -!- BoomSie [~gideon@dw77242112238.amsterdam-tc.dataweb.net] has quit [Quit: Ex-Chat]
10:33 -!- pierreghz [~pierreghz@cust-151-31-111-94.dyn.as47377.net] has joined #openvpn
10:37 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 276 seconds]
10:41 -!- bendik1 [~ibendik@cm-84.208.50.25.getinternet.no] has joined #openvpn
10:41 <@dazo> axeman: is he logging in via the freenode web gateway or something like that?
10:41 <+axeman> i think via the community chat link, he said
10:41 < bendik1> hey
10:42 <+axeman> access granted, i think it was the hiddenhost i getted from freenode webchat
10:42 <+axeman> ah there he is
10:42 < bendik1> does it cost to use OpenVPN?
10:43 <@dazo> bendik1: the OpenVPN AS - yes ... the community edition, no
10:43 < bendik1> ah, what is the difference?
10:43 < bendik1> !goal
10:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:44 <+axeman> http://www.openvpn.net/index.php/access-server/section-faq-openvpn-as/32-general/225-compare-openvpn-community-and-enterprise-editions-.html
10:44 <@vpnHelper> Title: OpenVPN Product Comparison (at www.openvpn.net)
10:44 <@dazo> bendik1: one costs money, the other one does not? ... I dunno really.  Never cared much about AS .... I believe it is some admin interface on AS
10:45 <+axeman> hey hey dazo i LOVE -as... once you go as, you never go back
10:45 < bendik1> ok thanks
10:46 <@dazo> axeman: nah, I'm using my own stuff which makes openvpn even better than AS ... eurephia ;-)
10:46 <+axeman> no way
10:46 <+axeman> ldap supporT!
10:46 <@dazo> however, it doesn't do pre-configured clients, and web admin GUI isn't ready :)
10:46 <+axeman> certificate generated, pre-configged clients?
10:46 <+axeman> pfft
10:46 <@dazo> axeman: LDAP support is doable without AS ... google openvpn ldap ;_)
10:47 <+axeman> no no and no
10:47 <+axeman> lol
10:47 <+axeman> i'm running the esxi template
10:47 <@dazo> ahh ... lazy man's setup :-P
10:47 <+axeman> and - after figuring stuff out, it was super quick
10:47 <@dazo> yeah, for rapid setups, that's the way to go ... that's for sure
10:47 <+axeman> i wanted to do a 'test' install - took me 20 minutes to go from test to live
10:48 <+axeman> i actually haven't done the ldap stuff. wont be able to touch it for about 2weeks. 
10:48 <+axeman> but WILL do it!
10:48 <@dazo> axeman: but seriously, we use openvpn + ldap for development stuff, to access build boxes and such
10:48 <@dazo> that's the community version we run
10:48 <+axeman> oooh nice
10:48 <+axeman> nice
10:48 <+axeman> like i said ealier - i ain't going back.  :-)
10:48 <@dazo> :)
10:48 < bendik1> dosent the #openvpn work with freenode webchat?
10:48 <+axeman> i changed the logo and all. 
10:49 -!- advocatusdiaboli [~advocatus@193.69.144.162] has quit [Quit: Lost terminal]
10:49 <@dazo> bendik1: we had a bunch of people going that way which didn't really make much more than noise here ... so we kicked them out
10:49 <@dazo> axeman: just for teaser ... http://redmine.debuntu.org/projects/openvpn-ldap-auth/wiki ;-)
10:49 <@vpnHelper> Title: openvpn-ldap-auth - Wiki - Redmine@Debuntu (at redmine.debuntu.org)
10:50 <+axeman> you cannot do this to me!
10:50 <+axeman> it's not fair!
10:50 <@dazo> lol
10:51 <@dazo> axeman: just wait until I've had time to play with LDAP in eurephia ... then you won't change again :P
10:51 <@dazo> (unfortunately, my workload is so high, it won't happen in the near future)
10:51 < bendik1> the nick bendik_ to?
10:52 <@dazo> bendik1: nope, that should be clean
10:52 <+axeman> but -as has it, rightout of the box
10:52 <+axeman> i love the new 1.8.3 client - with connect from client, instead of having to go to web. 
10:52 <@dazo> axeman: I know ... I should refocus ;-)
10:52 < bendik1> can i get the payd features for free?
10:53 <@dazo> bendik1: paid what for free?  you can pay me and I'll give you something for free
10:53 <@dazo> ;-)
10:53 < uuuppz> axeman#
10:53 < uuuppz> u should try my client
10:53 < uuuppz> its pretty
10:53 <@dazo> uuuppz: well, he is stuck on the management stuff, which makes the client smoother as well 
10:53 <+axeman> uuuppz, are you the one behind eurephia ? 
10:54 <@dazo> axeman: not uuuppz, but I am
10:54 -!- s7r1 [~s7r@188.25.161.190] has joined #openvpn
10:55 <+axeman> aaah
10:55 <+axeman> but that only works against the community version, right? not the -as ? 
10:55 < uuuppz> well I have no idea about -as
10:55 < bendik1> could i use the community verson and get the AS features for free? or is it not possible?
10:55 < uuuppz> since I don't have AS
10:55 < uuuppz> dazo: what does eurephia do for me?
10:55 -!- ArtVanda1ae [~SuperUnkn@125.209.134.233] has quit [Quit: Leaving]
10:55 < uuuppz> looks interesting
10:55 <+axeman> so uuuppz what's your client? 
10:56 <@dazo> axeman: I doubt so ... eurephia is a server plug-in ...not sure you can add extra plug-ins in the AS server config
10:56 < uuuppz> a replacement to the standard ovpn community client
10:56 < uuuppz> for windows
10:56 <+axeman> aaah
10:56 < uuuppz> looks nicer and doesn't need admin to bring vpn connections up and down
10:56 <@dazo> uuuppz: I think you mean GUI replacement ... not the whole client ;-)
10:56 < uuuppz> bah let me exagerate ;)
10:56 <+axeman> okay - well i <3 -as and am lazy enough to stay there. 
10:56 -!- thepacman [~pacmanfan@74-84-99-162.client.mchsi.com] has joined #openvpn
10:56 <+axeman> impressive, either way
10:57 -!- pacmanfan [~pacmanfan@74-84-99-162.client.mchsi.com] has quit [Read error: Connection reset by peer]
10:57 < uuuppz> but ure right dazo
10:57 <@dazo> axeman: uuuppz doesn't like that d12fk is doing the same work as well in the default UI  :-P
10:57 < bendik1> is it easy to use openVPN on a ubuntu server?
10:57 < uuuppz> I don't mind at all daxo
10:57 <+axeman> lol
10:57 < uuuppz> just I need one now!
10:57 <@dazo> bendik1: eurephia?
10:57 < uuuppz> so I wrote one
10:57 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 276 seconds]
10:57 <@dazo> uuuppz: I'm just kidding ;-)
10:58 < uuuppz> tbh it'd be hard work doing the gui stuff I've done in the standard client
10:58 < uuuppz> as thats direct GDI programming
10:58 <@dazo> bendik1: I believe all packages have arrived by now in Ubuntu from Debian
10:58 < uuuppz> nd kinda long winded to do anything useful
10:59 < bendik1> what is eurephia?
10:59 < uuuppz> my client will probably actually use the GPU if its present lol
10:59 <@dazo> bendik1: if not ... building it shouldn't require a master degree in rocket science, though
10:59 <@dazo> bendik1: http://www.eurephia.net/
10:59 <@vpnHelper> Title: eurephia :: a flexible OpenVPN authentication module (at www.eurephia.net)
11:00 < uuuppz> dazo: would eurephia let me apply specific firewall user per user and per group of users?
11:00 <@dazo> uuuppz: yes
11:00 < uuuppz> dazo: Ok then its useful to me!
11:01 <@dazo> I use it to allow different users different network accesses ... and to make sure that if someone tries to bruteforce themselves into the network, they get blacklisted in the firewall automatically
11:01 < uuuppz> do u have any kind of UI for it?
11:01 < uuuppz> or is it config file based
11:02 < uuuppz> the firewall rules per user setup stuff?
11:02 <@dazo> uuuppz: It's a command line interface for managing users and allowed certificates, and which firewall profiles this combination this should trigger
11:03 < uuuppz> ok
11:03 <@dazo> uuuppz: but the firewall stuff is iptables chains which the firewall profiles knows about
11:03 < uuuppz> so you setup the iptables chains seperately
11:03 <@dazo> yeah
11:03 < uuuppz> and create a filewall profile
11:03 <@dazo> correct
11:03 < uuuppz> that lists the relivant chains
11:03 < uuuppz> and then link that profile to a user?
11:03 -!- bendik1 [~ibendik@cm-84.208.50.25.getinternet.no] has quit [Ping timeout: 264 seconds]
11:03 <@dazo> and then you assign which firewall profile a specific user+certificate should use
11:04 < uuuppz> ok
11:04 < uuuppz> I like :)
11:04 <@dazo> so if you have one certificate for your laptop and your mobile phone ... you use the same username/password - but can get different firewall profiles
11:04 < uuuppz> yeh good thinking
11:05 <@dazo> I have the code ready for tun support too now ... just haven't had time to put it into a release yet
11:05 < uuuppz> is it possible to get going without recompiling openvpn?
11:05 <@dazo> from openvpn 2.2.0 and newer, no recompile of openvpn is needed
11:06 <@dazo> (or in Gentoo and Debian/Ubuntu, the needed patch was already enabled in 2.1.3 and newer, iirc)
11:06 < uuuppz> how would I check
11:06 <@dazo> if openvpn --version shows [eurephia] ... that's the indicator
11:09 < uuuppz> ah damn it
11:10 <@dazo> uuuppz: which platform are you on?
11:10 < uuuppz> ah debian lenny
11:10 < uuuppz> its in sqeeze I presume
11:10 <@dazo> ahh, probably too old openvpn there ... it's shipping openvpn-2.1_rc11, iirc .... which is horribly outdated
11:11 <@dazo> yeah, I think so ... agi was working hard to get everything ready for squeeze
11:12 < uuuppz> squueze is 2.1.3-2
11:12 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has joined #openvpn
11:12 <@dazo> that should have the patch included
11:12 < uuuppz> ESpingwing: Hi Peter
11:13 < ESpingwing> Hi all
11:14 < uuuppz> ESpingwing looks after our vpn setup, so will probably be taking a look at your eurephia
11:14 < uuuppz> ESpingwing: http://www.eurephia.net/?about - This should allow us to set firewall profiles per user when they connect to openvpn
11:14 <@vpnHelper> Title: eurephia :: About the project (at www.eurephia.net)
11:14 <@dazo> uuuppz: even though you're on lenny now ... I wouldn't hesitate with upgrading (compiling) to a newer openvpn  .... it's one binary file, and that's all ... 2.1_rc11 is many years old and many bugs have been fixed since that time
11:15 <@dazo> uuuppz: http://www.eurephia.net/documentation/eurephia/1.0/html/Administrators_Tutorial_and_Manual/chap-Administrators_Manual-Intro.html
11:15 <@vpnHelper> Title: Chapter 1. What is eurephia? - A little overview (at www.eurephia.net)
11:21 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
11:22 < uuuppz> ok its all on wheezy
11:24 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
11:25 <+axeman> if your client(s) worked with my crummy winmo 6.5 i just might do it!
11:27  * Olipro busts out platform builder
11:27 < Olipro> shame WM6.5 only has DHCPv6 lite
11:36 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
11:40 < uuuppz> dazo: did you ever think about client configuration and certificate distribution?
11:40 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
11:40 < uuuppz> I know this is something AS kinda does, but tbh I don't feel confortable with the vpn server issuing certs!
11:41 <@dazo> uuuppz: I've been thinking about cert generation ... not comfortable with the openvpn server doing that
11:42 <@dazo> uuuppz: but it is something in the pipe for eurephia ... things will be split better up, where openvpn will connect to a eurephia server (daemon) which can be on another box ... here it can be safer to generate certificates
11:42 < uuuppz> well we're kinda paranoid here
11:42 <@dazo> uuuppz: when this daemon is in place, I'm planning on a web service as well ... for management stuff
11:42 < uuuppz> we have a machine which isn't connected to the net
11:42 < uuuppz> that we've got easyrsa one
11:43 <@dazo> uuuppz: yeah ... I understand it ... trust me, such a CA feature will be completely optional in eurephia ;-)
11:43 < uuuppz> and generating certs there atm
11:43 < uuuppz> ah but its not particurly perfect as is
11:43 < uuuppz> we still have to transfer certs
11:43 <@dazo> well, on a separate offline box, automation is very difficult
11:44 < uuuppz> I suppose really
11:44 < uuuppz> it'd be best done
11:44 < uuuppz> using cert requests
11:44 <@dazo> but of course, it's possible to do some UUCP stuff over serial, where CSR is transferred to a directory ... the box signs them and puts the CRT into a "outbox", which is then copied out again, via UUCP
11:45 < uuuppz> I think the problem is actually the client
11:45 <@dazo> certs aren't secret, though
11:45 < uuuppz> the client should basically do a cert request
11:45 < uuuppz> ok the key
11:46 <@dazo> yeah ... that's the sensitive part
11:46 < uuuppz> basically
11:46 < uuuppz> what I want with my client
11:46 <@dazo> yeah, your CA should ideally only receive the CSRs, nothing more
11:46 < uuuppz> is to be able to tell someone to install the client
11:46 < uuuppz> they generate a cert request
11:46 < uuuppz> that gets set to our CA and get back a cert
11:47 < uuuppz> then pull configuration down to the client
11:47 <@dazo> ack ... that makes a lot of sense
11:48 < uuuppz> yeh and basically
11:48 < uuuppz> it should contact your daemon
11:49 < uuuppz> with the new cert fingerprint and the username/password
11:49 < uuuppz> and get the config needed
11:50 < uuuppz> are your SQL structures properly auditted tables
11:50 <@dazo> yup!  the eurephia daemon is planned to do that communication via SSL (probably with cert protection for authentication), and it will basically transfer XML which specifies the operation
11:50 <@dazo> uuuppz: what do you mean with properly auditted tables?
11:50 < uuuppz> e.g
11:50 < uuuppz> if a record gets deleted 
11:50 < uuuppz> its just marked as deleted
11:50 < uuuppz> and if its updated
11:51 < uuuppz> a revision is kept
11:51 <@dazo> no, it's not any revision history or transaction logs there .... but I've been considering it
11:51 < uuuppz> think thats kinda important
11:51 <@dazo> however, I've put energy into a PostgreSQL driver
11:51 < uuuppz> you need tracilbility
11:52 < uuuppz> (or I need)
11:52 <@dazo> and there you do all such things directly via triggers in the database
11:52 < uuuppz> yep thats fine
11:52 <@dazo> the intention for SQLite is to make something lightweight ... and PostgreSQL will be more advanced and more "enterprisey"
11:52 < uuuppz> yeh
11:53 < uuuppz> well I'd be happy to work with you a bit to get the client support working nicely
11:53 < uuuppz> cos I need this...
11:55 <@dazo> I'd be delighted to have more heavy users looking at eurephia as well
11:55 <@dazo> I've quite recently come a good step with the PostgreSQL driver ... it needs heavy testing ... what's not ported yet is the admin calls, but openvpn authentication should be done
11:56 < uuuppz> ok, how much work in getting your admin caqlls working?
11:58 <@dazo> it's quite some calls, and some of them are heavy stuff ... I'd say 40-60 hours work .... but I'm overloaded at work currently, so I don't have too much time for it right now .... but I'm hacking on it whenever I have an hour or two
11:59 <@dazo> if I had a fulltime job doing this, it would go quick :)
12:00 < uuuppz> heh I know the problem
12:01 <@dazo> I have really good reasons for getting this done as well ... as I'm using eurephia in production two places already ... and one of them would really benefit PostgreSQL
12:01 <@dazo> And I'm planning on a third site where PostgreSQL would also be good to have
12:02 < uuuppz> can we provide specific IP details to a user/cert?
12:04 <@dazo> uuuppz: I'm have a solution ready in my head :)
12:04 < uuuppz> ok
12:05 < uuuppz> cos one problem I have atm
12:05 <@dazo> it just needs to be implemented ... it is doable
12:05 < uuuppz> is I'd like to have my vpn
12:05 < uuuppz> available on standard port
12:05 < uuuppz> and https 443
12:05 < uuuppz> without me having to completely duplicate the solution
12:10 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
12:11  * dazo waves
12:11 < gladiatr> hey hey
12:11 <@dazo> gladiatr: sorry ... I'm waving goodbye for now :)
12:11 < gladiatr> lol!
12:11 < uuuppz> heh
12:11 < uuuppz> me too
12:11 < gladiatr> have a great weekend :)
12:12 -!- dazo is now known as dazo_afk
12:12 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 250 seconds]
12:13 < uuuppz> me too time to move home
12:14 < gladiatr> later uuuppz 
12:14 < uuuppz> later - 5mins walk so not too bad ;)
12:15 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
12:19 -!- K1ng [~KING@180.211.188.18] has joined #openvpn
12:21 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 240 seconds]
12:36 -!- K1ng [~KING@180.211.188.18] has quit [Ping timeout: 276 seconds]
12:40 < Teb76> hi dazo_afk 
12:40 < Teb76> may we restart form where we were? :)
12:47 -!- mrkiko [~mrkiko@host167-248-dynamic.15-87-r.retail.telecomitalia.it] has left #openvpn []
12:53 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
12:55 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:55 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:57 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
13:01 < Teb76>  dazo_afk I saw that the tun0 interface exists
13:11  * datruth yawns
13:17 -!- s7r1 [~s7r@188.25.161.190] has left #openvpn []
13:30 <@vpnHelper> RSS Update - forum: Cannot ping server when connected from mobile phone <http://forums.openvpn.net/topic8635.html>
13:34 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Quit: >:o]
13:37 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
13:42 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Quit: >:o]
13:45 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
13:46 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Client Quit]
13:47 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
13:51 -!- Bendik [~ibendik@cm-84.208.50.25.getinternet.no] has joined #openvpn
13:55 < Bendik> !welcome
13:55 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:55 < Bendik> !interface
13:55 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server, or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
13:56 < Bendik> !lol
14:01 < Olipro> !/30
14:01 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
14:04 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
14:04 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
14:06 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Client Quit]
14:07 -!- Bendik [~ibendik@cm-84.208.50.25.getinternet.no] has quit []
14:10 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
14:12 <@vpnHelper> RSS Update - forum: OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14635> || I Can Connect But Can't Browse <http://forums.openvpn.net/topic8636.html>
14:17 -!- axeman [~thirdchoi@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
14:24 -!- K1ng [~KING@180.211.188.18] has joined #openvpn
14:36 <@vpnHelper> RSS Update - forum: OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14636>
14:42 <@vpnHelper> RSS Update - forum: I Can Connect But Can't Browse <http://forums.openvpn.net/topic8636.html#p14637>
14:53 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
15:07 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 260 seconds]
15:09 -!- julius__ [~julius@p3EE2B138.dip.t-dialin.net] has joined #openvpn
15:09 < julius__> hi
15:09 < julius__> http://paste.pound-python.org/show/10918/         any idea why i cant ping from client1 to client2?
15:16 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
15:18 < majuk> julius__, What response do you get on ping?
15:22 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:22 -!- mode/#openvpn [+v s7r] by ChanServ
15:28 < julius__> timeout
15:29 < julius__> with tcpdump i can see that the client opens a connection to the server, but thats it
15:29 -!- majuk [~majuk@cpe-70-112-20-116.austin.res.rr.com] has quit [Ping timeout: 260 seconds]
15:33 -!- tkil [~tony@c-71-228-115-181.hsd1.nm.comcast.net] has quit [Quit: brb]
15:36 -!- EugeneSleep is now known as EugeneKay
15:38 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
15:44 -!- corretico [~luis@201.201.44.82] has joined #openvpn
16:02 -!- luneff [~yury@84.51.198.7] has joined #openvpn
16:11 -!- pierreghz [~pierreghz@cust-151-31-111-94.dyn.as47377.net] has quit [Quit: Quitte]
16:12 <@vpnHelper> RSS Update - forum: Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html#p14638>
16:18 <@vpnHelper> RSS Update - forum: When OpenVPN server starts, clients can't ping server's addr <http://forums.openvpn.net/topic8637.html>
16:24 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 260 seconds]
16:24 <@vpnHelper> RSS Update - forum: When OpenVPN server starts, clients can't ping server's addr <http://forums.openvpn.net/topic8637.html#p14640>
16:42 <@vpnHelper> RSS Update - forum: Need help with unusual configuration strategy <http://forums.openvpn.net/topic8638.html>
16:44 -!- Sw33NY_ [~Sw33NY___@ks30628.kimsufi.com] has quit [Quit: Leaving]
16:44 -!- luneff [~yury@84.51.198.7] has quit [Read error: Connection reset by peer]
17:06 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 246 seconds]
17:06 <@vpnHelper> RSS Update - forum: one server, two clients. no ping between clients? <http://forums.openvpn.net/topic8639.html>
17:28 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
17:40 -!- Guest97798 [~amir@178.209.43.160] has joined #openvpn
17:40 -!- Guest97798 [~amir@178.209.43.160] has quit [Remote host closed the connection]
17:41 -!- Guest97798 [~amir@178.209.43.160] has joined #openvpn
17:41 -!- Guest97798 [~amir@178.209.43.160] has quit [Remote host closed the connection]
17:41 -!- amir_ [~amir@unaffiliated/amir] has joined #openvpn
17:44 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
18:01 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
18:17 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:29 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
18:40 -!- pierreghz [~pierreghz@cust-151-31-111-94.dyn.as47377.net] has joined #openvpn
18:41 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
18:41 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
18:41 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
18:51 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 260 seconds]
18:52 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
18:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
19:04 -!- dfcnvt [~tagraf@ip72-193-58-135.lv.lv.cox.net] has joined #openvpn
19:05 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 258 seconds]
19:06 < dfcnvt> I'm having a bit trouble trying to connect school's vpn server..
19:08 < EugeneKay> Have you tried talking to your school's sysadmin?
19:10 < dfcnvt> No I didn't.. (right now I'm looking up on google for TUNSETIFF
19:11 -!- dfcnvt [~tagraf@ip72-193-58-135.lv.lv.cox.net] has quit [Quit: leaving]
19:13 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
19:27 -!- Denial- [~Denial@drgi.co.uk] has quit []
19:32 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Remote host closed the connection]
19:40 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 276 seconds]
19:45 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
20:43 -!- Squidy [~quassel@187.53.136.8] has joined #openvpn
20:43 -!- Squidy [~quassel@187.53.136.8] has quit [Changing host]
20:43 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
20:56 -!- amir_ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
21:52 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
21:56 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:11 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
22:33 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:48 -!- Titania [~titania@2002:4404:317c:0:216:44ff:fef0:2a61] has quit [Quit: Will return someday...]
23:01 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
23:10 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:12 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has quit [Remote host closed the connection]
23:14 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has joined #openvpn
23:36 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:36 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
--- Day changed Sat Aug 13 2011
00:06 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
00:31 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
00:52 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:55 < Bushmills> doesn't sound like openvpn
01:31 -!- Hawke2019 [~Hawke@64-83-199-32.dhcp.stcd.mn.charter.com] has joined #openvpn
01:31 < Hawke2019> !welcome
01:31 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:32 < Hawke2019> !redirect
01:32 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
01:32 < Hawke2019> !nat
01:32 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
01:35 < Hawke2019> !winnat
01:35 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows, or (#2) http://www.nanodocumet.com/?p=14 for windows XP
01:53 -!- Hawke2019 [~Hawke@64-83-199-32.dhcp.stcd.mn.charter.com] has quit [Read error: Connection reset by peer]
01:55 -!- Hawke2019 [~Hawke@64-83-199-32.dhcp.stcd.mn.charter.com] has joined #openvpn
01:58 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
02:06 < Hawke2019> Finally got it working...
02:18 < Teb76> morning
02:18 < Teb76> still stuck with my problem 
02:18 < Teb76> :()
02:20 < Teb76> anyone that would help me to understand why my phone connects to my ovpn server but ther's no answer to pin?
02:21 -!- Hawke2019 [~Hawke@64-83-199-32.dhcp.stcd.mn.charter.com] has left #openvpn ["Leaving."]
02:26 <@vpnHelper> RSS Update - forum: Cannot ping server when connected from mobile phone <http://forums.openvpn.net/topic8635.html#p14643>
02:37 < Teb76> yes it's mine :)
02:41 < Teb76> I think it is a routing problem, the tun interface is created, the connection is estabilished from what I can see from the logs of both client and server but I cannot ping the server at 10.8.0.1
02:45 < Bushmills> any other service you can reach on server? it may not replay to echo requests
02:45 < Bushmills> reply
02:46 < Teb76> I did'nt try
02:46 < Teb76> what should I do?
02:51 < Bushmills> determine what services the server offers, then try to use one
02:51 < Teb76> smb for example?
02:52 < Bushmills> wouldn't be my first choice, but i suppose that's a service too
02:52 < Teb76> I try
02:56 < Teb76> nothing
02:58 < Teb76> http://pastebin.com/qgyu7h1s this is my server log
02:59 -!- gallatin [~gallatin@dslb-178-006-210-079.pools.arcor-ip.net] has joined #openvpn
03:01 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
03:02 < Teb76> http://pastebin.com/xKRP71iT this is the client log
03:08 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
03:14 -!- Teb76_ [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has joined #openvpn
03:18 -!- Teb76 [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has quit [Ping timeout: 252 seconds]
03:18 < EugeneKay> I've no experience with the Market OpenVPN client, sorry.
03:18 < EugeneKay> How restrictive is the firewalling on your server? It may be eating the ping requests
03:33 -!- pierreghz_ [~pierreghz@cust-180-108-111-94.dyn.as47377.net] has joined #openvpn
03:35 < Teb76_> EugeneKay, no, moreover I'm fully able to access my vpn when connecting from my laptop using tethering 
03:35 -!- pierreghz [~pierreghz@cust-151-31-111-94.dyn.as47377.net] has quit [Ping timeout: 258 seconds]
03:35 < Teb76_> EugeneKay, do you use built in vpn access with an open vpn server ?
03:35 < EugeneKay> I use the CM openvpn client
03:35 < EugeneKay> It works good
03:35 < Teb76_> what is CM ?
03:36 < EugeneKay> CyanogenMod
03:36 < Teb76_> ok, I'm with Darky's rom
03:38 < Teb76_> EugeneKay, may you explain your settings ?
03:39 < Teb76_> I tried with the built in openvpn client but I cannot understand when it ask for username and password...
03:39 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
03:42 < EugeneKay> That's for if you have authuserpass enabled. Just leave 'em blank
03:54 -!- luneff [~yury@84.51.198.7] has joined #openvpn
03:55 -!- varta [~varta@unaffiliated/contempt] has joined #openvpn
03:55 -!- gallatin [~gallatin@dslb-178-006-210-079.pools.arcor-ip.net] has quit [Quit: Client exiting]
04:03 < Teb76_> EugeneKay, do you export your key files as pk12 ?
04:04 < Teb76_> sorry.. did you exported
04:19 -!- Teb76__ [~teb76@host175-44-dynamic.8-79-r.retail.telecomitalia.it] has joined #openvpn
04:20 < Teb76__> EugeneKay, it does not work, I'm asked for a username and password
04:21 < Teb76__> EugeneKay, did you follow some web guide ?
04:22 -!- Teb76_ [~teb76@host26-21-dynamic.8-79-r.retail.telecomitalia.it] has quit [Ping timeout: 258 seconds]
04:27 <@vpnHelper> RSS Update - forum: one server, two clients. no ping between clients? <http://forums.openvpn.net/topic8639.html#p14645> || Need help with unusual configuration strategy <http://forums.openvpn.net/topic8638.html#p14644>
04:45 <@vpnHelper> RSS Update - forum: Cannot ping server when connected from mobile phone <http://forums.openvpn.net/topic8635.html#p14646>
05:00 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
05:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
05:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:21 -!- Teb76__ [~teb76@host175-44-dynamic.8-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
05:51 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:51 -!- mode/#openvpn [+v s7r] by ChanServ
06:05 -!- pierreghz_ [~pierreghz@cust-180-108-111-94.dyn.as47377.net] has quit [Quit: Quitte]
06:07 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
06:15 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
06:26 -!- MushroomNZ [~MushroomN@121-72-232-59.cable.telstraclear.net] has joined #openvpn
06:27 < MushroomNZ> have just installed ubuntu, then openvpn, can start up my connection to my box, but are unsure how to access the files on it [not a big linux user] anyone able to assist?
06:39 -!- MushroomNZ [~MushroomN@121-72-232-59.cable.telstraclear.net] has quit [Quit: Leaving]
06:45 <@vpnHelper> RSS Update - forum: Bridge connected, but cant ping client-server or server-clie <http://forums.openvpn.net/topic8628.html#p14647>
06:49 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 276 seconds]
06:51 -!- julius___ [~julius@p3EE2AF76.dip.t-dialin.net] has joined #openvpn
06:55 -!- julius__ [~julius@p3EE2B138.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
06:59 < Bushmills> MushroomNZ: just the same as you would access your files when connecting over a link with a cable
07:00 < Bushmills> openvpn isn't a service to provide file access. it is a service to establish a secure connection.
07:01 < Bushmills> how you use the connection - as in "access files" - is a matter of using a suited service. the traffic to and from it can run through openvpn.
07:01 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
07:02 -!- kartmetal [~metal@gateway/tor-sasl/kartofeln] has quit [Remote host closed the connection]
07:02 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:07 -!- julius___ [~julius@p3EE2AF76.dip.t-dialin.net] has left #openvpn ["Leaving"]
07:15 <@vpnHelper> RSS Update - forum: one server, two clients. no ping between clients? <http://forums.openvpn.net/topic8639.html#p14648>
07:20 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
07:35 -!- julius___ [~julius@p3EE2AF76.dip.t-dialin.net] has joined #openvpn
07:35 < julius___> hi
07:36 < julius___> if the server assigns the clients ips, will it assign different ips to the same client on reconnects?
07:37 < Bushmills> depends
07:37 < Bushmills> !ccd
07:37 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
07:41  * julius___ hm...would probably helped if i didnt just enter crap into the certificates
07:41 < julius___> thx
08:06 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
08:07 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
08:08 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
08:20 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Quit: where wizards stay up late...]
08:21 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
08:21 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:39 -!- dijital1 [~bob@66-168-200-125.dhcp.gsvl.ga.charter.com] has joined #openvpn
08:39 -!- dijital1 [~bob@66-168-200-125.dhcp.gsvl.ga.charter.com] has quit [Changing host]
08:39 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
08:43 -!- sakhi [~sakhi@uwcfw.uwc.ac.za] has quit [Ping timeout: 250 seconds]
08:46 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
08:51 <@vpnHelper> RSS Update - forum: Cannot ping server when connected from mobile phone <http://forums.openvpn.net/topic8635.html#p14649>
08:58 -!- master_of_master [~master_of@p57B54A43.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:02 -!- master_of_master [~master_of@p57B532B9.dip.t-dialin.net] has joined #openvpn
09:03 <+s7r> if --cipher not specified, it will use Blowfish-CBC as default ... but with what key size ?
09:03 <@vpnHelper> RSS Update - forum: Doubts on router model <http://forums.openvpn.net/topic8619.html#p14650>
09:41 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Go on, try it!]
09:59 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
09:59 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
10:00 -!- ronnocol [~lance@2001:1868:214::bad:babe] has quit [Ping timeout: 260 seconds]
10:00 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
10:05 -!- Jspeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
10:07 -!- Jspeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Client Quit]
10:08 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
10:13 -!- thiagoalmeida [~thiagoalm@200.129.136.41] has joined #openvpn
10:15 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
10:21 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
10:31 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
10:43 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:44 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Ping timeout: 276 seconds]
10:45 -!- qknight [~joachim@88.198.52.213] has quit [Ping timeout: 276 seconds]
10:45 -!- Perun [perun@chao5.net] has quit [Ping timeout: 276 seconds]
10:45 -!- Perun [perun@chao5.net] has joined #openvpn
10:47 -!- qknight [~joachim@88.198.52.213] has joined #openvpn
10:47 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
10:49 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
11:11 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 246 seconds]
11:12 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Would you like to know more?]
11:12 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:14 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Client Quit]
11:14 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 250 seconds]
11:16 <@vpnHelper> RSS Update - forum: I haven't got the faintest idea how this works... <http://forums.openvpn.net/topic8640.html>
11:19 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
11:21 -!- thiagoalmeida [~thiagoalm@200.129.136.41] has quit [Ping timeout: 252 seconds]
11:23 < uuuppz> has anyone got openssl with aesni support working on windows?
11:23 -!- s7r is now known as Guest96170
11:24 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 258 seconds]
11:26 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
11:27 -!- Guest96170 [~s7r@openvpn/user/s7r] has quit [Ping timeout: 276 seconds]
11:29 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:31 -!- Nappy__ [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has quit [Quit: Leaving]
11:44 <@vpnHelper> RSS Update - forum: Need help with unusual configuration strategy <http://forums.openvpn.net/topic8638.html#p14652>
11:57 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:04 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
12:05 < ecrist> you shut your mouth when you're talking to me...
12:25 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
12:25 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
12:30 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
12:34 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
12:36 -!- GHI [~joti@cthulhu-isp.net] has joined #openvpn
12:36 < GHI> greeting
12:36 < GHI> s
12:36 < GHI> !goal
12:36 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:36 < GHI> !welcome
12:36 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:38 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
12:41 < GHI> i would like to use a static ip ipdress terminated on a server in a datacenter on a box sitting behind a dynamic ip and standard gateway
12:41 < GHI> the datacenter box has multiple ips
12:42 < GHI> v4 and v6
12:42 < GHI> and i'm root on it
12:42 < GHI> any ideas on that?
12:43 < uuuppz> ecrist;
12:43 < uuuppz> ecrist: ?
12:43 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
12:44 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Client Quit]
12:45 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
12:48 < ecrist> uuuppz: what's up?
12:49 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Client Quit]
12:49 < uuuppz> "<ecrist> you shut your mouth when you're talking to me..."
12:49 < uuuppz> :)
12:51 < uuuppz> thing is no one was talking to you!
12:59 -!- luneff [~yury@84.51.198.7] has quit [Ping timeout: 252 seconds]
13:07 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
13:08 < ecrist> just the way I like it.
13:09 < ecrist> GHI: the trick is getting multiple IPs on different subnets
13:10 < ecrist> what i would do, if I were you, is use binat on the server and nat the public address you want on the client to a private address on the server vpn
13:29 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 276 seconds]
13:36 -!- adubz [~zvpn@ip98-180-204-196.fv.ks.cox.net] has joined #openvpn
13:37 < adubz> bushmills you around i finally got everything going turns out the reason for my issue is the particular model has an issue as they are calling fubar product run of my model router
13:38 < adubz> its cool though there is a patched .bin of openwrt i found in the wild
13:44 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
13:47 < uuuppz> ecrist: ok so any chance you could take a look at that build? Have just gone into office, nd gonna be doing a little bit on it for the next couple of hours.
13:49 -!- Jedicus [~user@adsl-76-214-198-15.dsl.emhril.sbcglobal.net] has quit [Ping timeout: 250 seconds]
13:59 < ecrist> uuuppz: if you paste me a link where I can download, I'll look right now
14:00 <@vpnHelper> RSS Update - forum: Need help with unusual configuration strategy <http://forums.openvpn.net/topic8638.html#p14653>
14:01 < uuuppz> http://sourceforge.net/projects/openvpnui/files/
14:01 <@vpnHelper> Title: OpenVPN UI - Browse Files at SourceForge.net (at sourceforge.net)
14:02 < ecrist> I assume I want 0.3?
14:02 < uuuppz> yep
14:04 -!- Jedicus [~user@adsl-76-214-198-15.dsl.emhril.sbcglobal.net] has joined #openvpn
14:06 < ecrist> well, to start, it's lame it cannot upgrade itself.
14:07 < uuuppz> well be gone with that :)
14:07 < uuuppz> be thankful u have an installer ;P
14:08 -!- luneff [~yury@84.51.198.7] has joined #openvpn
14:08 < ecrist> lol
14:09 < ecrist> I have to actually go to add/remove programs
14:09 < ecrist> uuuppz: let's take this convo to #openvpn-devel
14:39 < GHI> hey ecrist thanks for the answer, sounds reasonable
14:40 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:40 -!- mode/#openvpn [+v s7r] by ChanServ
14:41 < GHI> to repeat it: i'ld have a private ip from the vpn-net terminating on the box that is to get forwarded ports (a postfix-box) and i'ld use the public ip of where it is natted to on the a record that goes into the mx in question?
14:43 < ecrist> GHI: no problem.  that's how I'd handle the issue, unless I had disparate netblocks to play with (which I do)
14:44 < GHI> well i suppose i could get one more ip adress from a different subnet than rest
14:44 < GHI> anyhow could you elaborate on the different subnet issue?
14:48 < ecrist> well, let's use 50.50.50.0/24 as an example 'real' subnet
14:48 < ecrist> let's say your VPN server is 50.50.50.1 and you want your vpn client to get address 50.50.50.2
14:50 < ecrist> if you use bridged mode, your computer will think the VPN server is local now, and stop routing that session over the internet
14:50 < ecrist> instead, it'll route the control session over the vpn
14:50 < ecrist> that doesn't work
14:50 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
14:51 < ecrist> let me find a diagram
14:52 < ecrist> http://secure-computing.net/files/om_nom_nom.jpg
14:52 < ecrist> there you go
14:53 -!- Irssi: #openvpn: Total of 150 nicks [3 ops, 0 halfops, 0 voices, 147 normal]
14:53 < ecrist> !learn nom as http://secure-computing.net/files/om_nom_nom.jpg
14:53 <@vpnHelper> Joo got it.
14:54 < ecrist> GHI: does that make sense?
14:54 < GHI> just seeing into it
14:55 < GHI> i get the point
14:55 < GHI> and i'ld need to have 50.50.51.2 as the target ip or server ip in that case?
14:59 < ecrist> well, x.1 would be server, and x.2 would be client.  the thing is you can't be remote and local at the same time on the same netblock.
14:59 < ecrist> BUT, if you have a VPN server running at 20.20.20.1 and wanted to hand out IPs on 50.50.50.0/24, that would work.
15:00 < ecrist> OR
15:00 < ecrist> if you subnetted your /24 into a pair of /25
15:00 < ecrist> server can be on 50.50.50.1 and you can start handing out IPs in the 50.50.50.129/25
15:00 < ecrist> range
15:00 < ecrist> .128 is network address, so you can't use it.
15:08 -!- luneff [~yury@84.51.198.7] has quit [Ping timeout: 258 seconds]
15:12 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
15:35 < GHI> ecrist thx, i think i got the point
15:35 < GHI> does linux do binat?
15:35 < GHI> everything on binat ends with bsd on google
15:40 < ecrist> well, binat is a keyword used in the pf firewall, which is a bsd thing
15:40 < ecrist> binat is also known as one-to-one nat
15:43 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:43 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:47 -!- luneff [~yury@84.51.198.7] has joined #openvpn
15:49 -!- adubz [~zvpn@ip98-180-204-196.fv.ks.cox.net] has quit [Remote host closed the connection]
15:52 -!- c|oneman [clon3man@206-248-132-83.dsl.teksavvy.com] has joined #openvpn
15:53 < c|oneman> Hi, I'm trying to follow a tutorial to setup openvpn on an ubuntu 11.04 system, I'm having a fundamental problem understanding the directions
15:53 < c|oneman> it says to edit server.conf and 'edit the following'
15:53 < c|oneman> http://www.linux.com/learn/tutorials/457103:install-and-configure-openvpn-server-on-linux
15:53 <@vpnHelper> Title: Install and Configure OpenVPN Server on Linux | Linux.com (at www.linux.com)
15:54 < c|oneman> what does that mean? erase my entire server.conf and replace with their lines? or try to guess which lines im supposed to change?
15:56 < ecrist> no clue
15:56 < ecrist> we don't support non-openvpn howto's
15:56 < ecrist> !howto
15:56 < ecrist> !man
15:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:56 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
15:56 < ecrist> see those for a start
16:00 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 260 seconds]
16:01 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
16:02 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
16:21 < aten> hi, is there a config explanation available somewhere? i have a working vpn server/client config, but i don't understand all settings (like what does persist-key/tun do?)
16:24 < ecrist> !man
16:25 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
16:25 < ecrist> it's always a good idea to start with the man page
16:31 < aten> hm stupid of me for not looking in the man pages. thanks
16:36 -!- mete [~metefr@mete.shell.la] has quit [Remote host closed the connection]
16:42 -!- c|oneman [clon3man@206-248-132-83.dsl.teksavvy.com] has quit [Ping timeout: 240 seconds]
16:42 -!- c|oneman [clon3man@206-248-132-83.dsl.teksavvy.com] has joined #openvpn
16:42 -!- c|oneman [clon3man@206-248-132-83.dsl.teksavvy.com] has quit [Client Quit]
16:48 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 258 seconds]
16:56 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 260 seconds]
16:58 -!- pierreghz [~pierreghz@cust-180-108-111-94.dyn.as47377.net] has joined #openvpn
16:59 -!- pierreghz [~pierreghz@cust-180-108-111-94.dyn.as47377.net] has quit [Read error: Connection reset by peer]
17:00 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
17:07 <@vpnHelper> RSS Update - forum: I Can Connect But Can't Browse <http://forums.openvpn.net/topic8636.html#p14654>
17:11 -!- snapcase [snapcase@shokushuzeme.me] has left #openvpn []
17:14 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
17:28 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
18:29 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
18:44 -!- Squidy [~quassel@187.7.247.225] has joined #openvpn
18:44 -!- Squidy [~quassel@187.7.247.225] has quit [Changing host]
18:44 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
18:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
19:08 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
19:19 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:19 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:19 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:25 -!- julius___ [~julius@p3EE2AF76.dip.t-dialin.net] has left #openvpn ["Leaving"]
19:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:34 -!- Denial [~Denial@drgi.co.uk] has quit []
19:36 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
20:23 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 260 seconds]
21:08 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
21:09 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
21:21 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
21:26 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
21:52 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 264 seconds]
21:55 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:10 -!- asdfknlw [~omnipoten@74-128-169-47.dhcp.insightbb.com] has joined #openvpn
22:11 -!- OmnipotentEntity [~omnipoten@74-128-169-47.dhcp.insightbb.com] has quit [Disconnected by services]
22:11 -!- asdfknlw is now known as OmnipotentEntity
22:19 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 258 seconds]
23:15 -!- Jedicus_ [~user@adsl-76-214-197-38.dsl.emhril.sbcglobal.net] has joined #openvpn
23:17 -!- Jedicus [~user@adsl-76-214-198-15.dsl.emhril.sbcglobal.net] has quit [Ping timeout: 252 seconds]
23:22 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
23:23 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
23:23 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
--- Day changed Sun Aug 14 2011
00:22 -!- Jedicus_ [~user@adsl-76-214-197-38.dsl.emhril.sbcglobal.net] has quit [Ping timeout: 260 seconds]
00:26 -!- danishman [~kvirc@0xbcb095dd.ngnqu1.dynamic.dsl.tele.dk] has joined #openvpn
00:33 -!- danishman [~kvirc@0xbcb095dd.ngnqu1.dynamic.dsl.tele.dk] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
00:35 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:38 -!- Jedicus_ [~user@adsl-76-214-197-38.dsl.emhril.sbcglobal.net] has joined #openvpn
00:48 -!- Jedicus_ is now known as Jedicus
01:04 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
01:04 -!- mode/#openvpn [+v s7r] by ChanServ
01:04 < OmnipotentEntity> Hey, sorry to bother you guys, I'm having a bit of trouble with my VPN setup.  I have tried a number of things, but I can't get my client to route properly.  I have added iroute options into my server's ccd configuration.  But my client doesn't seem to be setting the route correctly on connect.  Any troubleshooting tips?
01:05 < Olipro> !configs
01:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
01:11 -!- asdfknlw [~omnipoten@74-128-169-47.dhcp.insightbb.com] has joined #openvpn
01:11 -!- OmnipotentEntity [~omnipoten@74-128-169-47.dhcp.insightbb.com] has quit [Disconnected by services]
01:11 -!- asdfknlw is now known as OmnipotentEntity
01:13 < OmnipotentEntity> Olipro, thanks, I'll do that, let me clean it up a bit.  I've tried a bunch of things.
01:17 < OmnipotentEntity> http://pastebin.com/9nCiQpMj
01:17 < OmnipotentEntity> and my ccd:
01:17 < OmnipotentEntity> http://pastebin.com/JgdDUgJA
01:18 < Bushmills> !winroute
01:18 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
01:18 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
01:28 <+s7r> Bushmills: u there?
01:28 <+s7r> i wanted to ask you something.. been searching forums/ mail lists no success . if --cipher is not specified then openvpn will use by default blowfish-cbc but with what key size?
01:29 < Bushmills> not sure.  --show-ciphers might show
01:31 <+s7r> Bushmills: you are right
01:31 <+s7r> BF-CBC 128 bit default key (variable)
01:31 <+s7r> the default key size is 128 bit for BF
01:31 <+s7r> it can be increased with --keysize
01:32 <+s7r> amazing where the answer was right in the output of a command 
01:32 <+s7r> and i searched mail lists / forums :))
01:33 < Bushmills> yes, many people don't bother reading the man page
01:33 <+s7r> --keysize should be specified in the client conf server conf or both ? the manual does not say
01:33 <+s7r> no it's not covered in the man page seriously
01:33 <+s7r> i have bookedmarked the man page i find it amazing :)
01:34 < Bushmills> i can't remember ever having had to resort to forums for openvpn problems
01:35 < Bushmills> i start with man page, and usually the answer is there
01:45 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
01:45 <@vpnHelper> RSS Update - forum: How to add or remove Certifies <http://forums.openvpn.net/topic8641.html>
02:09 <@vpnHelper> RSS Update - forum: How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p14656>
02:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
02:32 < OmnipotentEntity> Sweet, thanks Bushmills, and Olipro, I have it working.  I have a minor hitch in that DNS resolution isn't performing, any hints for that?
02:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:47 < Bushmills> yes, sure.  determine the reason of that hitch.
02:48 < Bushmills> once you know, fixing it is much easier
02:51 < OmnipotentEntity> Sweet, a little research brought me to think link, but it seems to be written for an older version of windows, I'm currently trying to find the appropriate GUID to move.  So I'll let you know if it works out. http://support.microsoft.com/kb/311218
02:51 <@vpnHelper> Title: Cannot Change the Binding Order for Remote Access Connections (at support.microsoft.com)
02:55 < OmnipotentEntity> ok weird, that changed my symptoms to nslookup finding my DNS, but ping doesn't.
02:56 < OmnipotentEntity> stack overflow to the rescue.
02:58 < OmnipotentEntity> NICE, everything is working perfectly.
02:58 < OmnipotentEntity> Thanks again Bushmills. :D
02:59 < Bushmills> use dig instead of nslookup
02:59 < OmnipotentEntity> http://stackoverflow.com/questions/330395/dns-problem-nslookup-works-ping-doesnt
02:59 <@vpnHelper> Title: windows - DNS problem, nslookup works, ping doesnt - Stack Overflow (at stackoverflow.com)
03:10 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
03:32 -!- K1ng [~KING@180.211.188.18] has quit [Ping timeout: 260 seconds]
03:40 -!- thepacman [~pacmanfan@74-84-99-162.client.mchsi.com] has quit [Ping timeout: 260 seconds]
03:42 -!- teb76 [~Roberto@host175-44-dynamic.8-79-r.retail.telecomitalia.it] has joined #openvpn
03:42 < teb76> hi to all
03:43 < teb76> just reconfigured my vpn server to operate in bridging mode
03:44 < teb76> as before the connection is estabilished but no access to the vpn machines
03:45 < teb76> everytime I try to connect I get these messages on client log http://pastebin.com/kNhJtyqw
03:46 < teb76> but I actually have no "push" entrance on server config file
03:46 < teb76> client is android, server is windows 7
03:47 < reiffert> your server config might be broken then.
03:49 < teb76> here is my server config http://pastebin.com/Y2x6p3K6
03:51 < reiffert> what is your openvpn client's version number?
03:52 < teb76> reiffert, downloaded from android market
03:52 < teb76> let me see If it is reported on log
03:52 < teb76> OpenVPN 2.1.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Feb  2 2010
03:53 < reiffert> and your server version is?
03:54 < krzee> you sure android can do it?
03:54 < krzee> i dont think it supports tap
03:54 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
03:55 < krzee> however
03:55 < krzee> those errors are from your route/ifconfig commands not working right
03:55 < teb76> OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul  1 2011
03:55 < krzee> do you have openvpn-settings installed?
03:55 -!- pacmanfan [~pacmanfan@74-84-99-162.client.mchsi.com] has joined #openvpn
03:55 < teb76> krackpot, yes, I'm using it
03:55 < krzee> are you root?  is busybox installed?
03:55 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
03:56 < teb76> yes, rooted and busybox, tun.ko ismod
03:56 < teb76> rom darky's
03:56 < reiffert> krzee: what about further processing the error message, that clearly says: I can't handle the push line, because I dont understand the word "ifconfig" and "route"
03:56 < krzee> teb76, from cli can you ifconfig?
03:57 < teb76> krzee, how can I check?
03:57 < krzee> ssh in and type ifconfig
03:57 < teb76> using terminal is the same?
03:57 < krzee> sure
03:57 < reiffert> I'd downgrade the server version to 2.1.1
03:57 < krzee> why reiffert?
03:57 < krzee> its not an openvpn problem
03:58 < krzee> you ever used openvpn on android?
03:58 < krzee> this is a common problem, once he figures out how to ifconfig he can set it right in openvpn-settings app
03:58 < teb76> krzee, typing ifconfing on terminal I've no answer, only the prompt
03:59 < krzee> teb76, try:  busybox ifconfig
03:59 < teb76> krzee, it's seems you're right :)
03:59 -!- pacmanfan [~pacmanfan@74-84-99-162.client.mchsi.com] has quit [Read error: Connection reset by peer]
03:59 < krzee> ;]
03:59 < teb76> krzee, it works
03:59 < reiffert> krzee: openvpn is saying:
03:59 -!- pacmanfan [~pacmanfan@74-84-99-162.client.mchsi.com] has joined #openvpn
03:59 < reiffert> Options error: Unrecognized option or missing parameter (named): route
04:00 < reiffert> Options error: Unrecognized option or missing parameter (named): ifconfig
04:00 < krzee> reiffert, <teb76> krzee, it works
04:00 < teb76> krzee, what I have to do ?
04:01 < krzee> didnt you just say it works?
04:01 < krzee> thought you meant you set it and tested it
04:01 < krzee> lol
04:01 < teb76> krzee, lol just "busybox ifconfig" works
04:01 < krzee> oh ok, go in openvpn settings and set the right way to run ifconfig and route now
04:01 < krzee> the openvpn-settings app
04:02 < teb76> tap advanced ?
04:03 < krzee> i bet you can find where... not a very complex app
04:04 < krzee> i dont have mine handy
04:05 < krzee> oh its not openvpn-settings
04:05 < krzee> its android-openvpn-installer
04:05 < teb76> krzee, it is, but I cannot find how to config ifconfig and route, I only have the possibility to set tun, path to config, path to binary 
04:10 < krzee> 1sec looking at google
04:10 < krzee> http://forum.xda-developers.com/archive/index.php/t-551512.html
04:10 <@vpnHelper> Title: Android OpenVPN [Archive] - xda-developers (at forum.xda-developers.com)
04:10 -!- uuuppz [~uuuppz@213.79.53.61] has quit []
04:10 < krzee> lamaz explains how he solved your problem there
04:11 < krzee> i swear i remember using an app which allowed me to change how it called route/ifconfig, but there are other ways
04:13 < krzee> basically your problem comes down to openvpn calling route/ifconfig different than your box has it
04:13 < krzee> s/box/phone/
04:15 < krzee> ahh ya it was an option with openvpn-installer
04:15 < krzee> Install openvpn-installer (it installs the binary). During installation point to busybox (ifconfig/route) at: /system/xbin/bb
04:15 < krzee>  Create the symbolic links that you mentioned:
04:15 < krzee>  ./adb shell ln -s /system/xbin/ifconfig /system/xbin/bb/ifconfig
04:15 < krzee>  ./adb shell ln -s /system/xbin/route /system/xbin/bb/route
04:15 < krzee> also, just so you know, openvpn comes installed in cyanogenmod7
04:15 < teb76> krzee, I have not made the symbolic links, all of the rest was ok
04:16 < teb76> yes, it is installed on darky's to
04:19 < teb76> now, I've to check where my busybox is located, re-do openvpn installation so that it points to the right dirs and make the symbolic link
04:19 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p14657>
04:20 < krzee> read through that thread, ya what you said sounds like what worked for them
04:20 < krzee> its been awhile since i had to fix that problem... i just use cyanogenmod now
04:24 -!- luneff [~yury@84.51.198.7] has quit [Quit: This computer has gone to sleep]
04:30 < Olipro> "I find this somehow disturbing, though I see that it's not just an OpenVPN issue... in general, it seems that people all around the internet have huge difficulties understanding that SHA1 MUST NOT BE USED ANYMORE."
04:30 < Olipro> this guy seems to think SHA1 is MD5
04:30 < EugeneKay> FWIW, SHA1 has its own weaknesses. But it's not "DO NOT USE" quite yet.
04:31 < EugeneKay> ALso, on a scale of one to what the dogshitpissfuckass is this, how difficult is DNSSEC implementing going to be?
04:31 < EugeneKay> (as youv'e done it, and I haven't trolollo)
04:33 < Olipro> if you're working with BIND 9.7 or higher, not very
04:33 < Olipro> I let BIND take care of all the zone signing and just feed it keys
04:33 < hyper_ch> EugeneKay: what is dnssec good for?
04:34 < EugeneKay> Keeping my dad out of your DNS
04:34 < EugeneKay> I have 9.7.3, according to yum.
04:34 < Olipro> to be fair, he's been out of it for a while
04:36 < Olipro> hyper_ch: it provides cryptographically authenticated responses
04:37 < Olipro> you can know assertively whether a given DNS record does or does not exist
04:37 < hyper_ch> hmmm
04:37 < EugeneKay> And that the DNS server hasn't been hijacked
04:37 < hyper_ch> and what do you need to use dnssec?
04:37 < EugeneKay> http://oreilly.com/catalog/dns4/chapter/ch11.html
04:37 <@vpnHelper> Title: DNS and BIND, 4th Edition: Chapter 11: Security (at oreilly.com)
04:37 < EugeneKay> That's why.
04:38 < Olipro> you need to use a resolver that checks DNSSEC
04:38 < Olipro> if you want to implement it, you need a nameserver that supports it
04:38 < Olipro> or nameservers
04:39 < hyper_ch> can teh ip be dynamic or does it require to be static for dnssec?
04:40 < Olipro> no, it can change as often as you like providing your nameserver is configured to also update the RRSIGs
04:40 < hyper_ch> ok, thx
04:40 < teb76> krzee, when I try to make symbolic link I get the message "link filed File exists"
04:43 < teb76> krzee, found! I set ifconfig and route to /system/xbin/bb, now it works! I'm SMB connected with the server! :)
04:44 < hyper_ch> squeeze also has bind 9.7.3
04:46 < krzee> =]
04:46 < teb76> krzee, thank you so much
04:47 < krzee> you're welcome
04:48 < teb76> now should I'm able to see any other machine connected to the same lan of the server...
04:48 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
04:53 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:53 < hyper_ch> hmmm, DNSSEC sounds like a lot of additional work
04:54 < teb76> i cannot see the other machines on the lan, only the server. Should I use "push route" even if I'm in brifging mode?
04:54 < EugeneKay> Massive amounts, from what I can tell
04:55 < hyper_ch> resigning zones every 30 days.... this is just insan
04:57 < krzee> teb76, why do you use tap?  just for SMB?
04:57 < teb76> krzee, no, following howto I need tap for bridging
04:57 < teb76> I want to fulla access the lan
04:57 < teb76> I want to full access the lan
04:58 < krzee> but why tap?  just cause the howto says that?
04:58 < krzee> !route
04:58 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
04:58 < krzee> you dont need tap for that
04:58 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
04:58 < krzee> !tunortap
04:58 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
04:58 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
04:59 < teb76> !wins
04:59 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
04:59 < teb76> krzee, ok, I'll try to use tun
05:02 < hyper_ch> krzee: can I somehow find out for a remote ip on which port it is connected to me?
05:03 -!- K1ng [~KING@180.211.188.26] has joined #openvpn
05:10 -!- K1ng [~KING@180.211.188.26] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
05:22 -!- K1ng [~KING@180.211.188.26] has joined #openvpn
05:26 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
05:36 <@vpnHelper> RSS Update - forum: Problem installing TAP adapater. Windows 7 <http://forums.openvpn.net/topic8642.html>
05:46 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
06:03 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 264 seconds]
06:05 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
06:08 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 252 seconds]
06:10 < teb76> really can not understand why, if my server has ip 10.8.0.1 and i have push "route 192.168.40.0 255.255.255.0" on my server config
06:11 < teb76> i get on my client log /system/xbin/bb/route add -net 192.168.40.0 netmask 255.255.255.0 gw 10.8.0.9
06:12 < teb76> who is 10.8.0.9 ?? would not be gw 10.8.0.1 ?
06:12 < teb76> client has IP 10.8.0.10
06:16 < teb76> maybe this? /system/xbin/bb/ifconfig tun0 10.8.0.10 pointopoint 10.8.0.9 mtu 1500
06:16 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
06:22 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
06:23 < teb76> I found this on my server log SENT CONTROL [robertomento]: 'PUSH_REPLY,route 192.168.40.0 255.255.255.0,dhcp-option DNS 192.168.40.1,dhcp-option WINS 192.168.0.3,dhcp-option DOMAIN casa,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
06:23 < teb76> why the server sends ifconfig 10.8.0.6 10.8.0.5 ?
06:27 < teb76> it seems that a gateway is created on the client
06:27 <@vpnHelper> RSS Update - forum: Cannot ping server when connected from mobile phone <http://forums.openvpn.net/topic8635.html#p14661> || Need help with unusual configuration strategy <http://forums.openvpn.net/topic8638.html#p14660> || one server, two clients. no ping between clients? <http://forums.openvpn.net/topic8639.html#p14659>
06:29 -!- Sw33NY_ [~Sw33NY___@ks30628.kimsufi.com] has joined #openvpn
06:29 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has left #openvpn []
06:34 <@vpnHelper> RSS Update - forum: Cannot ping server when connected from mobile phone <http://forums.openvpn.net/topic8635.html#p14662>
07:11 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:15 -!- cosmocarrot [~goldeneye@cipixia.tilaa.nl] has joined #openvpn
07:16 < cosmocarrot> for some reason my client.up script doesnt add an entry in /etc/resolve.conf like it's supposed to. if i add it manually everything works through the vpn like normal
07:16 < cosmocarrot> how could i troubleshoot why it's not working?
07:25 -!- cosmocarrot [~goldeneye@cipixia.tilaa.nl] has quit [Ping timeout: 276 seconds]
07:27 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
07:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:40 < EugeneKay> Sounds like the client-up script isn't doing what it's supposed to, OR it's not being with sufficient permissions to modify resolv.conf
07:40 < EugeneKay> run with
07:42 < Olipro> I'm going to bet the latter
08:26 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:35 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
08:55 -!- Squidy [~quassel@187.7.247.225] has joined #openvpn
08:55 -!- Squidy [~quassel@187.7.247.225] has quit [Changing host]
08:55 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
08:56 -!- hpa_MBJ is now known as hpa_YVR
08:58 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 276 seconds]
09:00 -!- master_of_master [~master_of@p57B532B9.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:02 -!- master_of_master [~master_of@p57B550CB.dip.t-dialin.net] has joined #openvpn
09:50 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:10 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
10:22 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
10:23 -!- hpa_YVR is now known as hpa_SJC
10:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
10:29 -!- tutulus [~tutulus@static.238.229.4.46.clients.your-server.de] has joined #openvpn
10:30 -!- teb76 [~Roberto@host175-44-dynamic.8-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
10:39 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 276 seconds]
10:43 < tutulus> !welcome
10:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:44 < datruth> hrmm
10:44 < tutulus> ?
10:44 < tutulus> hi
10:44 < datruth> nothing thinking of what command could give me hte answers I need
10:45 < tutulus> which answers?
10:45 < tutulus> :p
10:46 < datruth> I'm having some natting or routing issues and I am unable to track client ips + traffic via my external firewall
10:46 < tutulus> ah
10:47 < tutulus> !topology
10:47 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
10:47 < datruth> The only way to get traffic going is to nat everything to one ip ;/
10:47 -!- Sw33NY_ [~Sw33NY___@ks30628.kimsufi.com] has quit [Ping timeout: 252 seconds]
10:48 < datruth> it can either be the vpn gateway ip or its externl interface ip
10:49 -!- researcher [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has joined #openvpn
10:49 < researcher> if I have server 10.8.0.0 255.255.240.0, what is the relevance of doing push "dhcp-option DNS 10.8.0.1"   ?
10:51 < datruth> !dns
10:51 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
10:51 < datruth> !pushdns
10:51 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
10:51 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
10:54 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
10:56 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
10:56 -!- researcher [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has quit [Ping timeout: 264 seconds]
10:57 -!- researcher [~genlime@112.198.78.85] has joined #openvpn
10:59 -!- researcher1 [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has joined #openvpn
11:00 -!- researcher [~genlime@112.198.78.85] has quit [Read error: Connection reset by peer]
11:00 < researcher1> if I have server 10.8.0.0 255.255.240.0, what is the relevance of doing push "dhcp-option DNS 10.8.0.1"   ?
11:01 < researcher1> does setting the first ip 10.8.0.1 wont affect the internet connection to clients?
11:03 -!- researcher1 [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has quit [Client Quit]
11:04 -!- tutulus [~tutulus@static.238.229.4.46.clients.your-server.de] has quit [Quit: Linkinus - http://linkinus.com]
11:05 -!- luneff [~yury@84.51.198.7] has joined #openvpn
11:09 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-45.html#p14663>
11:22 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 240 seconds]
11:23 -!- tutulus [~tutulus@static.238.229.4.46.clients.your-server.de] has joined #openvpn
11:33 -!- GHI is now known as btQuark
11:33 -!- btQuark is now known as GHI
11:33 -!- GHI is now known as btQuark
11:35 -!- btQuark is now known as ghi
11:35 -!- ghi is now known as GHI
11:35 -!- GHI is now known as ADFTW
11:36 -!- ADFTW is now known as GHAI
11:40 -!- tutulus [~tutulus@static.238.229.4.46.clients.your-server.de] has quit [Quit: Linkinus - http://linkinus.com]
11:52 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 252 seconds]
12:00 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
12:44 < aten> i have a working tcp vpn setup, but i would rather use udp instead. only if i switch proto tcp to proto udp on my server/client i can no longer connect. i disabled the firewall on both sides but this doesn't change anything and on the client side i can connect to other udp openvpn servers
12:45 < aten> nothing fancy shows up in the logs. the client keeps trying to connect but doesn't receive an answer from the server
12:45 < aten> and the server logs that the tls handshake fails, will retry in 60 seconds
12:46 < aten> i used tcpdump on both sides to determine the packet flow. the client keeps sending udp packages which the server receives, but the server never tries to send any packet to the client
12:47 < aten> i also tried to setup a client/server udp connection using nc which works fine (to rule out any connectivitie failures)
13:18 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 258 seconds]
13:42 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:53 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
14:00 < Bushmills> aten: have you restarted server after changing proto to udp?
14:00 < Bushmills> openvpn server, that is.  not machine.
14:00 < aten> yeah
14:00 < aten> but i seem to have isolated the problem a bit
14:01 < aten> i can't send udp packages at all
14:01 < Bushmills> "... using nc which works fine "  ??
14:01 < aten> echo bla | nc -u <ip> 3333 doesnt work (i have an udp server listening on the other end)
14:01 < aten> client -> server works
14:01 < aten> but server -> other server with udp listener
14:02 < aten> doesn't work it seems
14:02 < Bushmills> use --nobind on client
14:02 < aten> i have
14:02 < aten> might be a kernel problem
14:02 < Bushmills> " server -> other server"?   only client can connect to server
14:03 < aten> the vpn server seems to be unable to send udp packages
14:03 < aten> however dns works fine
14:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:17 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:38 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 250 seconds]
14:49 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has joined #openvpn
14:53 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
15:16 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
15:21 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:33 <@vpnHelper> RSS Update - forum: [ask] error liblzo.so.1 start openvpn <http://forums.openvpn.net/topic8643.html>
15:54 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Quit: where wizards stay up late...]
16:03 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
16:06 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Client Quit]
16:16 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
16:25 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 250 seconds]
16:27 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Quit: where wizards stay up late...]
16:52 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:11 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:22 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
17:41 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:55 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:58 <@vpnHelper> RSS Update - forum: Replace openvpn server logo <http://forums.openvpn.net/topic8492.html#p14665>
18:22 <@vpnHelper> RSS Update - forum: linux-vserver <http://forums.openvpn.net/topic8538-45.html#p14666>
18:24 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
18:28 -!- fengshaun [~fengshaun@cpe-098-024-011-229.carolina.res.rr.com] has joined #openvpn
18:30 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
18:37 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has left #openvpn ["cat dijital1 > /dev/null"]
18:38 -!- K1ng` [~KING@180.211.188.163] has joined #openvpn
18:39 -!- K1ng [~KING@180.211.188.26] has quit [Ping timeout: 252 seconds]
18:48 -!- varta [~varta@unaffiliated/contempt] has quit [Remote host closed the connection]
19:06 -!- Denial [~Denial@drgi.co.uk] has quit []
19:08 -!- trapni [~trapni@gentoo/developer/trapni] has joined #openvpn
19:10 < trapni> Hey. I'm to setup a VPN server on my root server, which has its own IPv6 subnet, so I wanted to use openvpn to enable IPv6 at home, too, by creating my own tunnel. however, with my first basic setup, it seems to forward my v6 packets from my local box the root server, but then they're not forwarded to e.g. the v6 world (tested with ipv6.google.com)
19:12 < trapni> this is, I think, because i'm now using the same subnet on *two* devices on my server. one is the physical real eth0, and the openvpn created tap0, with its own distinct IPv6 but within the same subnet
19:13 < trapni> should I use bridging and add tapNN devices dynamically to the bridge to compansate or is there a better way?
19:22 <@vpnHelper> RSS Update - forum: OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14667>
19:25 -!- trapni [~trapni@gentoo/developer/trapni] has quit [Read error: Operation timed out]
19:34 -!- trapni [~trapni@trapni.de] has joined #openvpn
19:57 -!- hpa_SJC is now known as hpa_YVR
20:02 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:13 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
20:22 < fengshaun> hi all, I'm trying to setup a vpn connection between two computers in which case one of them is behind a university firewall/router!
20:23 < fengshaun> here are the configs and the scenario at the bottom:
20:23 < fengshaun> http://paste.pocoo.org/show/458461/
20:23 < fengshaun> I can't get it to work (ping times out)
20:23 < fengshaun> Any ideas how I could do that?
20:30 < fengshaun> http://paste.pocoo.org/show/458464/
20:42 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 250 seconds]
20:43 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
20:51 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 250 seconds]
20:54 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
21:09 -!- jasonb_ [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
21:09 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 250 seconds]
21:14 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
21:15 -!- jasonb_ [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Read error: Connection reset by peer]
21:16 -!- jasonb_ [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
21:25 -!- jasonb_ [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 250 seconds]
21:29 -!- jasonb_ [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
21:30 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:53 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
21:55 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:11 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
22:44 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has quit [Ping timeout: 264 seconds]
22:45 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has joined #openvpn
22:47 <@vpnHelper> RSS Update - forum: OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14668>
23:01 -!- optical [~optical@8.22.203.211] has joined #openvpn
23:02 < optical> Hello all. Novice user here and tried following a guide on google to setting up OpenVPN on my VPS.  I have OpenVPN running and in my processes list but trying to telnet to myself on the port specified in the config is just spitting out connection refused right away
23:02 < optical> same thing if I try from an outside computer
23:02 < optical> but its not even connecting locally
23:02 < optical> any ideas what is wrong?
23:02 < optical> man this thing is hard to configure
23:05 <@vpnHelper> RSS Update - forum: [solved] OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14669>
23:11 <@vpnHelper> RSS Update - forum: [solved] OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14670>
23:34 -!- K1ng` [~KING@180.211.188.163] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
23:35 -!- K1ng [~KING@180.211.188.163] has joined #openvpn
23:47 -!- optical [~optical@8.22.203.211] has quit [Read error: Connection reset by peer]
23:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
23:55 < Bushmills> !howto
23:55 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:56 < Bushmills> Optic: ^^^
--- Day changed Mon Aug 15 2011
00:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:08 < Fleck> !autoconnect
00:08 < Fleck> !gui
00:12 < Fleck> what was the .ovpn option to auto connect?
00:22 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:23 <@vpnHelper> RSS Update - forum: routing through the tunneling <http://forums.openvpn.net/topic8644.html>
00:24 -!- tutulus [~tutulus@static.238.229.4.46.clients.your-server.de] has joined #openvpn
00:25 -!- researcher [~researche@119.93.51.34] has joined #openvpn
00:28 < researcher> I placed the openvpn-startup.sh and openvpn-stop.sh in /etc/openvpn/ but I as I tried to shutdown my server so that when it reboot it will call openvpn to open .sh files to start openvpn server
00:28 < researcher> it does not work
00:31 -!- researcher [~researche@119.93.51.34] has quit []
00:45 < tutulus> !goal
00:45 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:45 < tutulus> I would like to access the lan behind the server
00:48 < Bushmills> Fleck: once openvpn loads, it tries to connects. there's no explicit option to say so.
00:48 < Bushmills> if you're thinking of connecting at boot time, that's in your OS where you'll have to set that up 
00:49 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
00:49 -!- xxtjaxx [~andreas@kde/developer/marschke] has quit [Ping timeout: 240 seconds]
00:49 < Bushmills> tutulus: 
00:49 < Bushmills> !serverlan
00:49 < tutulus> hi
00:49 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
00:49 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 252 seconds]
00:50 < tutulus> ty
00:51 < tutulus> to access database/ apps that run on localhost what option do i have to add to server.conf?
00:56 < tutulus> with "management localhost port" option?
00:56 < tutulus> :)
00:57 < Bushmills> how is "apps running on localhost" related to openvpn?
00:57 < EugeneKay> Nothing, really.
00:58 < tutulus> i mean a databse that i access on localhost on the server
00:58 < tutulus> with "management localhost" i can access?
00:59 < Bushmills> you access it by pointing whatever network service client you're using at the server, where the service runs
00:59 < tutulus> ok
00:59 < Bushmills> think of "wired connection"
00:59 < Bushmills> just the same
00:59 < tutulus> ok
01:01 < reiffert> weird connections?
01:03 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
01:05 < Bushmills> troubleshootlebugger
01:06 < Bushmills> tried to catch you in the office yesterday
01:07 < Bushmills> 1.419 rauch
01:08 -!- tutulus [~tutulus@static.238.229.4.46.clients.your-server.de] has quit [Quit: Linkinus - http://linkinus.com]
01:09 < Bushmills> gone - have to fly
01:10 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
01:14 -!- researcher [~researche@119.93.51.34] has joined #openvpn
01:15 < researcher> I have put my openvpn-startup.sh and openvpn-shutdown.sh in /etc/openvpn for the openvpn.init to be called when startup and shutdown of server. but i think they are not working because when I tried it does not work.
01:19 < researcher> would anyone care to help
01:24 -!- researcher [~researche@119.93.51.34] has quit []
01:25 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
01:29 <@vpnHelper> RSS Update - forum: dual interfaces on server trickiness <http://forums.openvpn.net/topic8645.html>
01:34 -!- fengshaun [~fengshaun@cpe-098-024-011-229.carolina.res.rr.com] has left #openvpn ["bye bye!"]
01:38 -!- luneff [~yury@84.51.198.7] has quit [Ping timeout: 240 seconds]
01:39 -!- dazo_afk is now known as dazo
01:45 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:53 <@vpnHelper> RSS Update - forum: [ask] error liblzo.so.1 start openvpn <http://forums.openvpn.net/topic8643.html#p14676> || Problem installing TAP adapater. Windows 7 <http://forums.openvpn.net/topic8642.html#p14675> || OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p14674> || How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p14673>
02:06 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14677>
02:07 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
02:20 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:27 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:36 <@vpnHelper> RSS Update - forum: cannot connect to server <http://forums.openvpn.net/topic8646.html>
02:50 < style> Hi, any ideas why I'm able to connect (and route packets) successfully from same subnet where my end-point is, but not via router (NAT +portforward)? TCP dump on server shows that UDP packets are successfully routed via router (NAT) to the server, but openvpn doesn't send any responses
02:54 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
02:55 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
02:56 -!- luneff [~yury@109.165.16.213] has joined #openvpn
03:11 < Bushmills> style: "same subnet" - as in "overlapping ip addresses"?
03:11 <@vpnHelper> RSS Update - forum: Set Up OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html>
03:14 < style> Bushmills: yeeepp, but that wasn't the problem... problem was that server has no routes to outer world (just localnet routes)
03:14 < style> but by adding those routes it worked
03:24 <@vpnHelper> RSS Update - forum: cannot connect to server <http://forums.openvpn.net/topic8646.html#p14680>
03:25 < style> Is this right place to ask about openvpn-auth-ldap? If it's I would like to know is there possibility for fallback auth (file username/password type?) in case LDAP server is down?
03:28 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 250 seconds]
03:30 <@vpnHelper> RSS Update - forum: Set Up OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html#p14681>
03:42 <@vpnHelper> RSS Update - forum: Set Up OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html#p14682>
03:44 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
03:51 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:54 <@vpnHelper> RSS Update - forum: cannot connect to server <http://forums.openvpn.net/topic8646.html#p14683>
04:00 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
04:07 < style> It looks like openvpn-auth-ldap totally overrides other auth methods (such as scripts)
04:30 <@vpnHelper> RSS Update - forum: Using different DHCP servers for different clients <http://forums.openvpn.net/topic8648.html>
04:42 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p14685>
04:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:49 < style> btw I'm unable to register to forum due to; "HTTP Status 500" @ https://community.openvpn.net/pwm/
04:49 <@vpnHelper> Title: OpenVPN user account management service (at community.openvpn.net)
05:19 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
05:24 <@vpnHelper> RSS Update - forum: cannot connect to server <http://forums.openvpn.net/topic8646.html#p14687> || dual interfaces on server trickiness <http://forums.openvpn.net/topic8645.html#p14686>
05:33 -!- pierreghz [~pierreghz@cust-220-7-111-94.dyn.as47377.net] has joined #openvpn
05:37 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 250 seconds]
05:40 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
05:41 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
05:42 <@vpnHelper> RSS Update - forum: Set Up OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html#p14688>
05:44 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
05:44 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
05:44 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:48 <@vpnHelper> RSS Update - forum: Doubts on router model <http://forums.openvpn.net/topic8619.html#p14689>
06:01 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:02 -!- tomjerr [tomjerr@dereckson-1-pt.tunnel.tserv5.lon1.ipv6.he.net] has joined #openvpn
06:03 -!- tomjerr [tomjerr@dereckson-1-pt.tunnel.tserv5.lon1.ipv6.he.net] has left #openvpn []
06:22 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
06:24 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:24 -!- mode/#openvpn [+v s7r] by ChanServ
06:24 <@vpnHelper> RSS Update - forum: Problem of IP address. <http://forums.openvpn.net/topic8649.html> || Set Up OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html#p14690>
06:30 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 240 seconds]
06:31 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
06:32 -!- Jikan [~Jikan@2001:41d0:2:401f:94:23:63:31] has quit [Remote host closed the connection]
06:32 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
06:33 -!- Riz [~riz@syn.theintertubes.ca] has quit [Read error: Connection reset by peer]
06:42 <@vpnHelper> RSS Update - forum: Problem of IP address. <http://forums.openvpn.net/topic8649.html#p14693> || Set Up OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html#p14692>
06:54 <@vpnHelper> RSS Update - forum: How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p14694>
07:12 <@vpnHelper> RSS Update - forum: How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p14695>
07:17 < Ragnar> hai
07:18 <@vpnHelper> RSS Update - forum: Set Up OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html#p14696>
07:27 < Ragnar> what is the recommended mtu?
07:30 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
07:30 <@vpnHelper> RSS Update - forum: Problem of IP address. <http://forums.openvpn.net/topic8649.html#p14697>
--- Log closed Mon Aug 15 07:30:42 2011
--- Log opened Mon Aug 15 07:31:00 2011
07:31 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
07:31 -!- Irssi: #openvpn: Total of 147 nicks [3 ops, 0 halfops, 1 voices, 143 normal]
07:31 -!- Irssi: Join to #openvpn was synced in 29 secs
07:36 -!- ikpo [ikpo@174.128.251.168] has joined #openvpn
07:37 -!- ikpo [ikpo@174.128.251.168] has quit [Client Quit]
07:37 -!- luneff [~yury@109.165.16.213] has quit [Quit: Leaving]
08:00 <@dazo> !mtu
08:00 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
08:01 <@dazo> Ragnar: ^^^
08:01 <@dazo> try to connect once with --mtu-test ... and see what it reports
08:03 < Ragnar> thanks
08:05 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
08:05 -!- mode/#openvpn [+v Axeman] by ChanServ
08:06 -!- Riz [~riz@syn.theintertubes.ca] has joined #openvpn
08:19 <@vpnHelper> RSS Update - forum: routing through the tunneling <http://forums.openvpn.net/topic8644.html#p14699> || Using different DHCP servers for different clients <http://forums.openvpn.net/topic8648.html#p14698>
08:28 < amero> what are usually the optimized settings for supporting large number of concurrent users
08:30 -!- researcher [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has joined #openvpn
08:34 < researcher> I have problem with my openvpn-startup.sh, I dont think that openvpn from /etc/rc.d/init.d is not properly calling my openvpn-startup.sh from /etc/openvpn
08:39 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:39 < researcher> help please
08:40 < ecrist> researcher: we don't support startup scripts here,
08:40 < ecrist> check with your distro
08:40 < ecrist> amero: fast server, fast internet connection
08:40 < researcher> ecrist, my distro is centos
08:40 < ecrist> openvpn performance falls off with about 200 clients
08:40 < ecrist> researcher: so ask them
08:41 < researcher> what could be the error there?
08:41 < krzee> [06:42]  <ecrist> researcher: we don't support startup scripts here,
08:41 < krzee> [06:42]  <ecrist> check with your distro
08:42 < researcher> krzee but it is openvpn.init 
08:42 < krzee> so!?
08:42 < krzee> its not part of openvpn, its part of your OS's packaging
08:42 < researcher> so I guess it is also a topic of openvpn, am I right?
08:43 < krzee> no
08:43 < krzee> [06:42]  <ecrist> researcher: we don't support startup scripts here,
08:43 < krzee> [06:42]  <ecrist> check with your distro
08:43 < EugeneKay> researcher - CentOS init scripts work fine for me. You're screwing it up somehow ;-)
08:43 < ecrist> researcher: we didn't write the script, talk to the person that did.
08:44 < EugeneKay> Actually, they're EPEL, not CentOS.
08:44 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 276 seconds]
08:44 -!- naquad_ [~naquad@174.142.224.219] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:45 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
08:45 < researcher> eugenekay, i did not screw it up. I only had the openvpn-startup.sh from openvpn sample.
08:45 < ecrist> we don't support the scripts
08:46 < EugeneKay> I've never touched something called openvpn-startup.sh in all my fiddlings with OpenVPN on CentOS / SL. You're doing it wrong.
08:46 < EugeneKay> You put the conf you want into /etc/openvpn/$NAME.conf, you start the service, it works. That's all there is to it.
08:46 < EugeneKay> Anything more means you're overthinking the problem, are doinitrong, and are on your own.
08:47 -!- WebDawgII [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has joined #openvpn
08:47 < WebDawgII> heh
08:49 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:49 <@vpnHelper> RSS Update - forum: Set Up OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html#p14700>
08:49 < WebDawgII> I found a forum post that says if the domain name of the server does not match the cert the client will not connect.  I still have to look at the client logs but is this true.  If so can I disable it?
08:50 < d12fk> does anyone have proxy auto config set up
08:52 < fluter> d12fk, what proxy?
08:52 -!- researcher [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has quit []
08:53 < krzee> WebDawgII, well its wrong
08:54 < WebDawgII> krzee?
08:54 < krzee> certs can be named anything that is valid
08:54 < d12fk> fluter: doesn't matter as it configures the client, see http://en.wikipedia.org/wiki/Proxy_auto-config
08:54 <@vpnHelper> Title: Proxy auto-config - Wikipedia, the free encyclopedia (at en.wikipedia.org)
08:54 < krzee> unrelated to the domain of anything
09:00 -!- master_of_master [~master_of@p57B550CB.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:01 < datruth> ahh finally found my solution :)
09:01  * datruth takes a break now
09:02 -!- master_of_master [~master_of@p57B54845.dip.t-dialin.net] has joined #openvpn
09:05 < WebDawgII> hmm
09:05 < WebDawgII> I had this thing working great.
09:05 < WebDawgII> heh
09:05 < WebDawgII> I will have to go look at the logs.
09:07 -!- illuminatedwax [~iw@74-92-190-113-Illinois.hfc.comcastbusiness.net] has joined #openvpn
09:07 -!- illuminatedwax [~iw@74-92-190-113-Illinois.hfc.comcastbusiness.net] has left #openvpn []
09:08 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
09:14 < WebDawgII> I turn the logging on the server all the way up.
09:15 < WebDawgII> Just tells me connect reset.
09:15 < WebDawgII> Does not say why.
09:15 < WebDawgII> I see a ACK reliable_send_timeout
09:15 < WebDawgII> 2
09:15 < WebDawgII> SIGUSR1[soft,connection-reset] received, client-instance restarting
09:17 < WebDawgII> Without going to the client and looking at the log how do I make the server pull the information from the client?
09:18 <@dazo> WebDawgII: read up on --tls-remote ... if the cert's CN is "My Cool Server" ... --tls-remote "My Cool Server" should do the trick
09:19 < WebDawgII> dazo Thanks.
09:19 <@dazo> WebDawgII: --verb 4 is also pretty good level for this kind of debugging ... you don't need the low-level protocol stuff dumped out
09:20 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
09:20 < WebDawgII> I think that is the problem.  I did the entire thing over an ip based network (lan), no reverse dns.  I moved the router to a real ip with a reverse dns and I get these problems.
09:22 < WebDawgII> --tls-remote server side or client side (thinking client)
09:25 <@dazo> WebDawgII: client side
09:26 < WebDawgII> What is the best way to pull the name of my server?
09:26 < WebDawgII> cat one of the certs.
09:26 < WebDawgII> I cant remember what I named it.,
09:26 <@dazo> openssl x509 -text -noout -in <cert>
09:26 < WebDawgII> I am using easy rsa.
09:33 -!- onebitX [~onebitxaj@gateway/tor-sasl/onebitxajax] has joined #openvpn
09:34 < onebitX> hi to all
09:34 < onebitX> how can i connect to a vpn server that use openvpn?
09:34 < WebDawgII> dazo If I create a TLS key would it solve the problem too or would I still have to put --tls-remote
09:34 < WebDawgII> ?
09:35 < onebitX> i am using kubuntu and i have certicate but i don't understand what to do
09:35 < onebitX> can someone give me some suggestions'
09:35 < onebitX> ?
09:35 < WebDawgII> onebitX find a tutorial
09:35 < WebDawgII> You just need a client.conf file in your /etc/openvpn
09:36 < onebitX> WebDawgII: i alreadu search for it
09:36 < EugeneKay> Contact the person who gave you the certificate you're supposed to be using
09:36 < EugeneKay> They'll know more about their setup than we will.
09:36 <@dazo> WebDawgII: tls key?  most likely not ... this is all related to the data inside the certificate, which is matched against what's given in --tls-remote
09:36 < onebitX> there is only freeopenvpn.ovpn
09:36 < WebDawgII> dazo thanks.
09:40 <+s7r> dazo: if I use this client-cert-not-required so clients will connect without certs just with username / passwd will it decrease security ?
09:41 <+s7r> i mean, encryption will still work?
09:41 <+s7r> I have cipher AES-128-CBC
09:41 <@dazo> s7r: it will decrease the security related to authentication, but not the encryption
09:42 <+s7r> encryption and key exchange and other encryption related stuff will be made the same as they would if i'd use client certs?
09:42 <@dazo> correct
09:43 <+s7r> thanks
09:43 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
09:43 <@dazo> the key exchange algorithm uses a slightly different approach, iirc (as it doesn't have a client key pair to use) ... but that's still safe
09:44 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
09:57 -!- onebitX [~onebitxaj@gateway/tor-sasl/onebitxajax] has left #openvpn []
10:05 <@vpnHelper> RSS Update - forum: Problem of IP address. <http://forums.openvpn.net/topic8649.html#p14701>
10:11 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
10:11 <@vpnHelper> RSS Update - forum: Set Up OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html#p14702>
10:18 -!- Nosnik [~na@port1060.ds1-oebr.adsl.cybercity.dk] has joined #openvpn
10:21 -!- Nosnik [~na@port1060.ds1-oebr.adsl.cybercity.dk] has left #openvpn []
10:24 -!- pierreghz [~pierreghz@cust-220-7-111-94.dyn.as47377.net] has quit [Quit: Quitte]
10:29 < datruth> is there a certain order the client/server.conf needs to be in?
10:29 < datruth> !order
10:32 -!- mechbangirc [~mechbangi@mbl-82-58-246.dsl.net.pk] has joined #openvpn
10:36 < mechbangirc> One of my client gave me an ip, username and a password. I do not have any experience of openvpn. I use Archlinux on LXDE and my nm-applet is broken but I do have openvpn installed. Can anybody gives me client conf file to get me started.
10:37 < Bushmills> !howto
10:37 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:38 -!- julius_ [~julius@p3EE2C2A4.dip.t-dialin.net] has joined #openvpn
10:38 < Bushmills> there should be example configs in /usr/doc/openvpn
10:39 < Bushmills> http://verhau.de/cgi-bin/dwww/usr/share/doc/openvpn/examples/sample-config-files/?type=dir
10:39 <@vpnHelper> Title: Files in /usr/share/doc/openvpn/examples/sample-config-files (at verhau.de)
10:39 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
10:42 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
10:44 < mechbangirc> Thanks guys i am lookin on these links
10:47 < mechbangirc> these conf files talk about certificates, I want to connect using password only. I do not have any certificate/key.
10:47 < mechbangirc> thanks
10:53 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:53 -!- mode/#openvpn [+o raidz] by ChanServ
10:54 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
11:01 -!- mechbangirc [~mechbangi@mbl-82-58-246.dsl.net.pk] has quit [Quit: Leaving]
11:09 -!- julius_ [~julius@p3EE2C2A4.dip.t-dialin.net] has left #openvpn ["Leaving"]
11:10 -!- julius_ [~julius@p3EE2C2A4.dip.t-dialin.net] has joined #openvpn
11:10 < julius_> hi
11:10 < julius_> in the certificates, can i enter something random for common name or is that field used later for connection purposes?
11:11 < julius_> meaning if it contains a invalid hostname it wont work
11:12 < WebDawgII> dazo The time was off on the client.
11:13 < WebDawgII> Way off.
11:14 <@dazo> julius_: for client certs it's only used for identification in log files, or external plug-ins/scripts which authenticates certificates .... for server, it can be validated using --tls-remote
11:14 <@dazo> WebDawgII: that's an easy thing to forget
11:14 < julius_> ok thx
11:15 < WebDawgII> dazo I checked it because a guide reminded me to.  Weird.  I move the WRT54G over to the other office and the date gets messed.  Though when I put it over there the internet was down.  Prolly failed to connect the NTP server.  Though I did not have one configured maby dd-wrt pulls the date from a server via default.
11:16  * dazo frowns when he sees dd-wrt being mentioned
11:16 < WebDawgII> dazo why?
11:16 <@dazo> the dd-wrt company is lacking complete understanding about security
11:17 < WebDawgII> How do you mean?
11:17 < WebDawgII> Its just linux and iptables heh
11:17 <@dazo> they had a hard coded ip address enabling full access from that IP from outside ... and didn't warn their users about it, despite it being a one-line command from a shell to temporarily disable this "feature" until next release
11:18 < WebDawgII> You have a link to that issue?
11:18 < WebDawgII> So you spoof the incoming addy and you would get in?
11:18 <@dazo> then you have the littleblackbox project, which has collected ssh keys for all dd-wrt releases ... and the dd-wrt team claimed this wasn't an issue, because most users didn't enable ssh access from outside
11:18 <@dazo> WebDawgII: exactly
11:18 <@dazo> it's in the forums somewhere
11:18 < WebDawgII> dazo is that still activated?  (The spoof part)?
11:18 < WebDawgII> Hmm.
11:19 < WebDawgII> I will have to change the ssh key then.
11:19 < WebDawgII> I will have to look into this more.
11:19 <@dazo> I hope not ... when dd-wrt did say "they have a fix, that will be released in the future", without saying when ... I skipped to X-WRT and later on to openwrt
11:19 -!- OmnipotentEntity [~omnipoten@74-128-169-47.dhcp.insightbb.com] has left #openvpn ["Adieu! Adieu! Parting is such... *is shot*"]
11:19 < WebDawgII> I tried openwrt.
11:20 <@dazo> it's easy to check ... just look at the iptables rules ... but my trust in dd-wrt in regards to security is gone
11:20 < WebDawgII> Openwrt would not install openvpn...device would always run out of space.
11:20 < WebDawgII> I never heard of X-WRT.
11:21 <@dazo> X-wrt is an openwrt alternative with a webui, before luci came into openwrt
11:21 < WebDawgII> ahh.
11:22 <@dazo> yeah, openssl is pretty hefty and eats all space nowadays on those wrt54gl .... I switched to a TP-Link 1043WD router .... plenty of space, and more hackable than wrt54gl
11:22 < WebDawgII> I will have to remember that.
11:22 < WebDawgII> The TP-Link 1043WD I mean.,
11:22 <@dazo> :)
11:23 < WebDawgII> This is the first time I have really put effort into improving a flashed router.
11:23 < WebDawgII> Any other time I just did it and did not use it much.
11:23 < WebDawgII> Usually replaced them with something else.
11:24 <@dazo> but I'd try to see if there are some slimmed-down images you could use .... the whole upgrade to 2.6 kernel also killed a lot of space
11:24 <@dazo> but the old 2.4 images shipped openvpn 2.0, which is way old
11:25 < WebDawgII> heh
11:25 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: ASCII a stupid question, get a stupid ANSI!]
11:25 < WebDawgII> Should have just ordered a bunch of homeplug computers or whatever.
11:27 < WebDawgII> How do they usually compile the bins if the devices are so small?
11:27 <@dazo> not sure I understand that question?
11:27 <@dazo> how they generates the firmware?
11:27 < WebDawgII> Yeh.  Compile it.  They must run out of space on some of these devices.
11:27 < WebDawgII> Well.
11:27 <@dazo> they don't compile it on the devices
11:28 < WebDawgII> I thought the processors where diff.
11:28 <@dazo> you cross-compile it ... it's fairly easy to do now ... you just need 2-3 hours
11:28 < WebDawgII> Ahh.
11:28 < WebDawgII> See I may want to do that.  I do not know if I could wait for an update from some of these guys.
11:28 <@dazo> pull down the openwrt source tree .... run make menuconfig ... configure your image .... and just run make .... 2-3 hours later, you have an image file ready to be flashed
11:29 < WebDawgII> Like above,  a new release of openvpn.
11:34 < WebDawgII> brb office work...
11:40 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
11:40 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has left #openvpn []
11:43 < datruth> is there away to push a domain / workgroup to a client via openvpn?
11:44 < WebDawgII> ??
11:44 < WebDawgII> hmm.
11:44 < WebDawgII> Like configure windows to attach to that domian/workgroup?
11:45 < datruth> correct
11:45 <@vpnHelper> RSS Update - forum: Openvpn write UDPv4: No buffer space available code=55 <http://forums.openvpn.net/topic8651.html>
11:45 < datruth> WebDawgII: would that be push "dhcp-option DOMAIN [domain-name]"?
11:50 < WebDawgII> datruth I would not know atm.
11:54 < datruth> i know its cool
11:55 <@vpnHelper> RSS Update - forum: [SOLVED] OpenVPN Server With Authentication Against OpenLDAP <http://forums.openvpn.net/topic8647.html#p14702>
11:56 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 250 seconds]
12:02 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
12:19 < uuuppz> datruth: you'd need to look at windows domain stuff to answer that, probably not without some specific config/software on the windows machine
12:19 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
12:21 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
12:21 < jeev> what's the suggested way to run openvpn not as the default gateway but specifically set a browser to use a proxy that uses the vpn?
12:21 < jeev> i want to dedicate for example, firefox to go through the vpn
12:21 < jeev> i guess it'd have to be done with squid or something
12:23 < ecrist> I just use ssh for that
12:23 < ecrist> and foxyproxy
12:23 < ecrist> ssh -ND 9999 foobeans.example.com
12:23 < jeev> oh
12:23 < ecrist> and point ff to a socks 5 proxy running on localhost port 9999
12:25 < jeev> but i dont know if i want to use firefox
12:25 < jeev> let me see what foxyproxy is
12:25 < jeev> obviously i can just do it without it
12:27 < WebDawgII> They have a few different proxy servers.
12:27 < WebDawgII> What is the one that starts with a D?
12:27 < WebDawgII> ssh tunnel?
12:27 < WebDawgII> How does foxyproxy work ecrist?
12:28 < ecrist> it allows you to select from a list of configured proxy servers, and changes firefox's network settings on the fly
12:28 < jeev> tired of firefox sucking up so much ram
12:29 < WebDawgII> That does not solve the problem of him needing a proxy server on his VPN server.
12:29 < hyper_ch> or you can even set rules in foxyproxy
12:29 < hyper_ch> e.g. all domains ending in a specific TLD should go through proxy A
12:29 < hyper_ch> and all domains ending in a different TLD should go throuh proxy B
12:29 < WebDawgII> That plugin sounds elite.
12:29 < WebDawgII> Hmm.
12:29 < hyper_ch> it's quite powerful
12:29 < WebDawgII> Can you proxy dns queries through socks?
12:30 < hyper_ch> I used it cheat in a browser game :)
12:30 < julius_> any idea why the connection is not established?  http://paste.pound-python.org/show/11051/                 ive changed the certificates and updated server+client, it was working well yesterday with different certificates
12:30 < hyper_ch> had multiple accounts running through different proxies
12:30 < hyper_ch> so I could push myself :=
12:30 < julius_> cheating is lame
12:31 <@dazo> datruth: I'm looking at the man page ... and it says in the --dhcp-option part: DOMAIN name -- Set Connection-specific DNS Suffix.
12:31 < jeev> my pfsense server took a shit, i had tried it with a compactflash, it's pretty much dead... it's still running but too lazy to reinstall
12:31 < hyper_ch> julius_: Mon Aug 15 19:28:35 2011 62.226.194.164:38980 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
12:31 < WebDawgII> You have a cert in the wrong spot?
12:31 < hyper_ch> path to client cert is wrong
12:32 < WebDawgII> I want to install some network forensics alongside the pfsense.
12:33 < WebDawgII> http://www.soleranetworks.com/news/network-forensics-driving-new-opportunities-in-enterprise/
12:33 <@vpnHelper> Title: Channel Buzz | Solera Networks (at www.soleranetworks.com)
12:33 < WebDawgII> I just seen that ish in action at defcon.
12:33 < WebDawgII> I want to see what the opensource world has to offer package wise.
12:33 < WebDawgII> The interface was sweet.
12:33 <@dazo> julius_: you must have changed something if it worked yesterday ...
12:33 <@dazo> Mon Aug 15 19:28:35 2011 62.226.194.164:38980 VERIFY ERROR: depth=0, error=unsupported certificate purpose: /C=DE/ST=LS/L=somewhereinfrance/O=lala/CN=ws-b/emailAddress=somewhere@nowhere.com
12:35 < julius_> i changed common-name for the new certificates
12:35 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html>
12:35 < julius_> why is it unsupported?
12:36 < julius_> hyper_ch, the client has server-b.crt  server-b.key   ca.crt     the server dh1024...   ca.crt  server-dmk.crt     server-dmk.key        am i missing something?
12:37 < julius_> hyper_ch, ah...missed your second statement
12:38 < hyper_ch> julius_: client seems to have way too many certs
12:38 < julius_> hyper_ch, no the path is right, got that error yesterday...openvpn doesnt start on the client if a file is missing
12:38 < ecrist> julius_: what is the purpose of the certificate?
12:39 < julius_> maybe the server remembers the certificate from yesterday?  ive deleted ipp.txt and any other files in /etc/openvpn that looked like they could hold old infos
12:40 < WebDawgII> That would not change the cert.
12:40 <@vpnHelper> RSS Update - forum: [solved] OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14705>
12:40 < WebDawgII> Where are your confs?
12:40 < WebDawgII> Remove the hosts...
12:41 < julius_> one second
12:41 < WebDawgII> ips and ports.
12:41 < julius_> remove...from where?
12:42 < WebDawgII> When you paste your conf files.
12:42 < WebDawgII> Into pastebin or whatever.
12:42 < WebDawgII> XXXX out the remote lines.
12:42 < WebDawgII> heh
12:42 < WebDawgII> remote xxxxx:xxxx
12:43 -!- asio [~asio@195.20.207.173] has joined #openvpn
12:43 < julius_> ah
12:43 < julius_> http://paste.pound-python.org/show/11052/
12:43 < WebDawgII> Anyhost names or whatever
12:44 < WebDawgII> I thought you did not need the ca.crt on the client?
12:44 < WebDawgII> Wait.
12:44 < WebDawgII> You may.
12:44 < WebDawgII> I use other key methods.
12:44 < julius_> http://openvpn.net/index.php/open-source/documentation/howto.html#pki           below key files it says so
12:44 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:45 < WebDawgII> I use pks12 certs.
12:45 < WebDawgII> err pkcs12
12:47 < WebDawgII> Increase your verbosity to 4
12:48 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:49 < julius_> http://gozer.ectoplasm.org/blog/archive/2007/07/openvpn_verify.html             i may have generated server certs for my client
12:49 <@vpnHelper> Title: gozer's blog: OpenVPN VERIFY ERROR: unsupported certificate purpose (at gozer.ectoplasm.org)
12:49 < WebDawgII> Where is your client .key
12:49 < WebDawgII> ?
12:49 < WebDawgII> err
12:49 < WebDawgII> Server key.
12:51 < julius_> how do i remove a key for host x from the database after creating it with build-key
12:51 < julius_> WebDawgII, let me recreate the client key...maybe that helps
12:51 < WebDawgII> No.
12:51 < WebDawgII> Your missing your server.key from the server.conf file.
12:52 < WebDawgII> I dunno.
12:52 < julius_> ah,  index.txt
12:53 < WebDawgII> index.txt?!
12:53 < WebDawgII> you need
12:53 < WebDawgII> in server.conf key server.key
12:53 < julius_> no, the file is there and matches the one in the config
12:54 < julius_> server.key is a name that you can choose, mine is called server-dmk
12:54 < WebDawgII> Im looking at your server conf right now and I see no keyling.
12:54 < julius_> .key
12:54 < WebDawgII> You need 3 files.
12:54 < WebDawgII> A ca which is usually called ca.crt
12:55 < WebDawgII> A cert which is usually called servername.crt
12:55 < WebDawgII> A key wich is servername.key
12:55 < julius_> youre right
12:55 < julius_> but its only in the paste, must have deleted a line accidently
12:55 < WebDawgII> You do not have key server-dmk.key
12:56 < WebDawgII> Dammit.
12:56 < WebDawgII> Check that shit.
12:56 < julius_> thx
12:56 < julius_> give me a second
12:56 < julius_> grep -v '#' newnetwork.conf|grep -v ';'|grep -v '^$'
12:57 < WebDawgII> heh
12:57 < WebDawgII> just cat the conf
12:57 < julius_> thats the command i used to get the needed conf lines....in the line  "key server-dmk.key"     i added a comment....
12:57 < julius_> so grep didnt print it...my fault
12:57 < WebDawgII> just cat the conf
12:57 < WebDawgII> and paste it.
12:57 < julius_> way to long
12:58 < julius_> let me create a new client certificate and see if it works
12:59 < WebDawgII> heh
12:59 < julius_> jap works
12:59 < julius_> i created the client key with build-key-server
12:59 < WebDawgII> Ahh.
13:00 < WebDawgII> That would do it.
13:00 < julius_> the link i pasted above, starting with gozer had the same problem
13:00 < julius_> ERROR: unsupported certificate purpose                  
13:00 < WebDawgII> Hmm.
13:00 < julius_> now i know what it means
13:00 < WebDawgII> You should do tls-auth too.
13:01 < julius_> yes
13:01 < julius_> this is my home system, first openvpn steps
13:02 < asio> Hi, I've setup a debian server running openvpn and connecting to it using Tunnelblick on mac works fine, but when I try and connect in windows client it just says connecting (conf: http://pastebin.com/XBrNj44S)
13:02 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14706>
13:02 < asio> I'm using the desktop client downloaded from here: http://openvpn.net/index.php?option=com_content&id=357 Anyone have pointer to how to resolve this?
13:02 <@vpnHelper> Title: Client Packages (at openvpn.net)
13:03 < WebDawgII> Paste your log files.
13:03 < WebDawgII> !goal
13:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:03 < julius_> thx for your help guys
13:03 < WebDawgII> !welcome
13:03 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:04 < WebDawgII> np
13:05 < asio> Ah, maybe I should have looked there first: http://pastebin.com/DHStSkzB the error is that it cannot open the p12 cert file
13:06 < asio> hmm.. in which folder should the certificate be put, so that the client finds it?
13:06 < WebDawgII> usually you specify the full path or put it with the conf.
13:08 < asio> But the config was imported by the client, just pointed it to the the file on the desktop, if I specify the full path do I need to put it within quotes or something?
13:08 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14707>
13:08 < WebDawgII> What?
13:08 < WebDawgII> 'imported'?
13:08 < WebDawgII> put the config in notepad and see what it says.
13:09 < WebDawgII> You mean copied?
13:09 < WebDawgII> Or something?
13:09 < asio> Yes, in the client, there is an option "Connection Profiles" pressing it will get a new box that says "From where do you want to import a profile?"
13:10 < WebDawgII> I usually just open the .ovpn file.
13:10 < WebDawgII> I have never use that before.
13:10 < WebDawgII> I do not know where it would look for the file by default.
13:10 < julius_> looking at /etc/openvpn/ipp.txt on the server im wondering if this guarantees that the clients get the same ip on every reconnect? the file lists the common name and a ip
13:10 < WebDawgII> make a crazy named log file and see where it puts it.
13:10 < WebDawgII> Thats where the key needs to go.
13:10 < asio> aha, so you just double click on the client.ovpn file?
13:11 < WebDawgII> julius_ the ipp file has a setting.  It can be user defined and static or not.  Look at the config option in the man file.
13:11 < WebDawgII> asio you could yes.
13:11 < WebDawgII> Then click connect.
13:14 < WebDawgII> Anyone know if openvpn can do weird subnets?  255.255.252.0?  Did not seem to work when I tried it.
13:14 <@vpnHelper> RSS Update - forum: --route-delay cannot be used with --mode server <http://forums.openvpn.net/topic8631.html#p14708>
13:15 < julius_> ah, ok
13:15 < julius_> two clients are in that file, but a third that has already reconnected twice isnt listed....any ideas?
13:16 < asio> WebDawgII: Using the full path to cert solved the problem
13:16 < asio> thanks for the help
13:16 <@dazo> julius_: your new certificate have the wrong purpose flags ... if you try using a server cert as a client cert, or vice versa, you get exactly this error I pointed out
13:16 < WebDawgII> yup
13:17  * dazo is reading scroll back
13:18 < jeev> ecrist, i dont know. ssh seems like a headache, with the browser sometimes having issues with proxy, i guess the default route could just be a squid server
13:19 < jeev> on the vpn
13:19 < julius_> dazo, well i missed the part where you said that i created a server cert for a client or the other way around
13:19 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14709>
13:19 < WebDawgII> jeev?
13:19 < jeev> hi
13:19 < WebDawgII> Either way you need to setup a proxy.
13:19 < WebDawgII> SSH works fine.
13:19 < WebDawgII> VPN would work too.
13:19 < julius_> dazo, btw. that problem is fixed.....the ipp thing is a new question on a working setup
13:19 <@dazo> jeev: ssh -D <port> ... in browser, select SOCKS proxy, with host set to localhost and port to <port> (defined by -D) ... what's the difficulties here?
13:20 -!- Netsplit *.net <-> *.split quits: tjz, jeev
13:20 <@dazo> julius_: ahh, sorry, I missed that
13:20 < julius_> thx anyway
13:20 < julius_> kind of high traffic here at the moment
13:20 <@dazo> julius_: no, ipp does not guarantee that 
13:20 <@dazo> (fixed IP)
13:21 < julius_> crap. looked promissing
13:21 <@dazo> julius_: you can use --client-config-dir and issue separate  push "ifconfig" 
13:21 < julius_> so --client--conf-dir it is then
13:21 <@dazo> statements for those clients
13:21 -!- Netsplit over, joins: jeev
13:21 < jeev> sorry
13:22 < julius_> but i have to ask, the explanation in the default openvpn server config for:   ifconfig-pool-persist ipp.txt           sounds like it would persist the ips/common names?
13:22 <@dazo> julius_: if you have a IP pool of 20 IP addresses .... and all the same 20 boxes, and no more than these 20 connect ... then ipp provides "fixed IPs" ... *but* in the moment the 21st logs in, your system is screwed, as openvpn will then reuse an IP address
13:22 <@dazo> jeev: ssh -D <port> ... in browser, select SOCKS proxy, with host set to localhost and port to <port> (defined by -D) ... what's the difficulties here?
13:22 < julius_> i see
13:22 < jeev> yes i saw it
13:22 <@dazo> :)
13:22 < jeev> dazo, dont i need a proxy server
13:24  * dazo just saw " i guess the default route could just be a squid server" .... squid == proxy ...
13:24  * dazo shrugs
13:24 < jeev> yea
13:24 < WebDawgII> The ssh command just tunnels the traffic.  You have an input and an output.  The input is a port on the local host...the output is anywhere the server box (sshd) can connect.  ie you could have the output go to aol.com or whatever.  When you connect to the localhost port on the client box it would send all tcp sessions to the output (aol.com).
13:24 < WebDawgII> So.
13:24 < jeev> i confuse everyone including myself most of the time.
13:24 <@dazo> heh
13:24 < jeev> i generally dislike proxy, i dont know
13:25 < jeev> i love how openvpn just handles everything with default route, i just want to dedicate a browser to use it
13:25 < jeev> i'll figure out the way i want, im stupid in explaining
13:25 < WebDawgII> When you put a socks server(proxy) on the server you make your ssh tunnel output the address of that socks server.  So it would connect to localhost on the server and the socks proxy would handle the rest.
13:25 < julius_> dazo, well i guess my 3 hosts will persists in a network with 254 possible host adresses
13:25 <+s7r> jeev: what dazo suggested is correct
13:25 <+s7r> you do not need a vpn you need a socks tunnel
13:26 <@dazo> proxy can be good and bad, depending on how you use it .... vpn can be good and bad, depending on how you use it ... ssh can be good and bad, depending on how you use it .... women can^H^H^H^H^H^H^H lets not go there....
13:26 <+s7r> to use it only with particular application(s)
13:26 <+s7r> ssh dynamic port frowarding is perfect for your needs. it provides secure encryption of traffic also
13:26 < jeev> heh
13:26 < jeev> since i'm on winblows..
13:26 < WebDawgII> jeev you need to setup a proxy server no matter how you do it if you just want to dedicate one browser and not an entire system for your setup.
13:26 <+s7r> i am on windows also
13:26 < jeev> ok so as far as the proxy server, should i just do squid ?
13:26 <@dazo> jeev: putty supports "-D" as well
13:26 < WebDawgII> Yeh putty will do it.
13:27 <+s7r> putty / winscp / tunnelier
13:27 < WebDawgII> putty works great.
13:27 <@dazo> jeev: setting up squid requires so much more efforts 
13:27 < jeev> i mean on the server, which proxy server
13:27 < jeev> i know i hate it but it's ok
13:27 <+s7r> and of course, if you have a problem like traffic on port 22 if you have access on the server (root) ssh can listen on port 80 or 443 without any problems
13:27 <+s7r> my server is listening ssh currently on 443 :D
13:27 < jeev> my openvpn does 443 heh
13:27 < jeev> one of them
13:27 <+s7r> so everything someone upstream you will see is you are browsing a secure connection
13:27 < WebDawgII> I use dante Jedicus.
13:27 < jeev> dazo, s7r better alternative to squid ?
13:27 < WebDawgII> dante proxy server.
13:28 <+s7r> yes
13:28 < jeev> dantes peak
13:28 < WebDawgII> Just dont configure it to bind to the servers external ip address.
13:28 <+s7r> dante is a socks5
13:28 <+s7r> is highly configurable
13:28 < jeev> ok sexy
13:28 <+s7r> you can also use ss5 server
13:28 <@dazo> jeev: ssh is far simpler to just get started with ... unless you need something enterprisey for more users
13:28 <+s7r> http://ss5.sourceforge.net/
13:28 < WebDawgII> You just want it to bind to the servers localhost on a port:  127.0.0.1:blablabla(34523)
13:28 <@vpnHelper> Title: SS5 Socks Server (at ss5.sourceforge.net)
13:28 < jeev> do you guys usually vpn your default route ?
13:28 <+s7r> jeev: it depends from case to case man
13:28 <+s7r> depends on what you need
13:28 < jeev> yea
13:29 < jeev> i dont know, sometimes i search pr0n girls to see if they're hot or not
13:29 <+s7r> if you want to browse the internet with the vpn server, then ok redirect gateway
13:29 < jeev> i hate the fact that they can.
13:29 < jeev> see what i'm searchin
13:29 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14711> || [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14710>
13:29 <+s7r> jeev: could you probably explain us what you need?
13:29 < jeev> s7r, just want to use like opera or something to use proxy, not firefox.
13:29 <+s7r> if you need a tunnel for redirecting traffic for particular application(s) use ssh tunnel - D
13:30 < jeev> yea that's what i'm going to do
13:30 < jeev> ssh tunnel to dante
13:30 <+s7r> if you want all traffic to be routed, 
13:30 <+s7r> use VPN
13:30 < jeev> i know i know, i just dont care to have all my stuff go out vpn but it'd seem cool
13:30 <+s7r> and if you want multiple users to access it such as enterprise proxy use dante or ss5
13:30 < WebDawgII> Does socks do DNS?
13:30 <+s7r> jeev: in that case use putty with ssh tunnel
13:30 <+s7r> WebDawgII: yes it does
13:30 < WebDawgII> Thx.
13:30 <+s7r> and it fully supports ipv6 also
13:31 <+s7r> and it's highly configurable this menas you can block urls, ports you name it
13:31 < WebDawgII> Ahh.  Great newness socks it is.
13:31 <+s7r> HOWEVER
13:31 <+s7r> socks5 has pour encryption
13:31 <+s7r> if you want encryption use ssh tunnel
13:31 <+s7r> it provides encryption almost as good as in openvpn
13:32 <+s7r> meaning diffie hellman for key exchange and AES-256 or 3DES for encryption
13:32 < WebDawgII> I just met diffie at Defcon 19.
13:32 <@dazo> jeev: you're making things complicated .... if you need to use SSH to start with .... ssh -D  will *become* a SOCKS proxy ... you don't need to configure that in addition
13:33 <+s7r> dazo: i think he does not understand ssh -D term as he is on windows
13:33 <+s7r> jeev: download putty
13:33 < WebDawgII> -D does not need a proxy server?
13:33 <@dazo> nope, it makes SSH behave like a SOCKS proxy on the port you assign it
13:33 <+s7r> go to SSH > tunnels> click Dynamic at port forwarding add a port number e.g 7777 then put the SOCKS5 server 127.0.0.01 port 7777 in your browser
13:34 <@dazo> voila! done!
13:34 <@vpnHelper> RSS Update - forum: dual interfaces on server trickiness <http://forums.openvpn.net/topic8645.html#p14712>
13:34 < WebDawgII> heh.  I forgot about that.
13:34 < WebDawgII> So you could just configure that in putty real quick jeev.
13:37 <+s7r> WebDawgII: i am not sure if i got your question but yes you can do ssh tunneling via another http proxy or socks server
13:37 <+s7r> with putty on windows
13:38 <+s7r> you can connect ssh to a server through a http proxy or socks5 .. at least if the proxy admin did not rule to drop traffic on port 22
13:38 <+s7r> that if your server ssh is listening on port 22. it can listen on port such as 443 and then this problem is gone 
13:39 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
13:39 <@vpnHelper> RSS Update - forum: routing through the tunneling <http://forums.openvpn.net/topic8644.html#p14713>
13:41 -!- gnowen [~OwenMeany@adsl-74-242-247-147.rmo.bellsouth.net] has joined #openvpn
13:42 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 250 seconds]
13:42 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
13:47 -!- gnowen [~OwenMeany@adsl-74-242-247-147.rmo.bellsouth.net] has quit [Quit: Ex-Chat]
13:52 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14714>
13:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
13:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:04 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14715>
14:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:09 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14716>
14:13 < jeev> dante users?
14:15 < WebDawgII> ?
14:15 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14717>
14:15 < jeev> Aug 15 12:12:33 (1313435553.680111) sockd[26451]: info: pass(1): tcp/accept ]: 127.0.0.1.47290 127.0.0.1.1080: error after having read 1 bytes: unknown socks version 71 in clientrequest
14:16 < jeev> oh, -D doesn't ?
14:16 < WebDawgII> what client are you using?
14:16 < jeev> hm
14:16 < jeev> lets see :D
14:16 < jeev> opera
14:16 < WebDawgII> socks version 71?
14:16 < jeev> who knows
14:16 < WebDawgII> You may have something configured wrong in opera?
14:16 < WebDawgII> did you check socks proxy?
14:16 < jeev> i'll try ff
14:16 < jeev> ytes
14:19 < jeev> cool, firefox does it.
14:20 < jeev> thanks s7r and dazo, WebDawgII ;)
14:20 < krzee> !sockd
14:20 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
14:21 < jeev> i wonder why opera doesn't work
14:21 < jeev> i'm using plain putty.
14:21 < krzee> oh i thought you said dante... i just skimmed
14:21 < jeev> yea i tried it
14:21 < jeev> until i looked up that -D does the damn thing itself!
14:22 < krzee> know that it wont do a lot of things
14:22 < krzee> ssh socks tunnel cant do udp
14:22 < krzee> etc
14:23 < krzee> its not a *fully* functional socks server, but it does get many jobs done 
14:23 < jeev> i guess my sockd was working, opera is just being weird.
14:26 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14718>
14:26 < jeev> yea, sockd worked with firefox
14:26 < jeev> hm
14:27 < jeev> very very sexy
14:27 < jeev> thanks everybody
14:27 < jeev> (not you krzee)
14:27 < jeev> just kidding
14:31 < WebDawgII> hmm
14:31 < WebDawgII> \
14:31 < WebDawgII> np
14:38 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14719>
14:44 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14721> || Problem installing TAP adapater. Windows 7 <http://forums.openvpn.net/topic8642.html#p14720>
14:47 <+s7r> krzee: any way I can increase the tun/tap speed from 10mbps in windows ?
14:47 <+s7r> make it like 100mbps or something
14:47 <+s7r> i know it doesn't really affect the real speed but i just want to increase it to look sexy
14:49 < ecrist> s7r: no, you can't
14:49 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14722>
14:50 <+s7r> i can't modify the driver before installing it?
14:51 <@dazo> s7r: this question pops up here every other months, if not more often ... and *nobody* has managed to do something about it, at least not provided info how they did it
14:51 <@dazo> s7r: be my guest, try to fix it ... let us know how ... and you'll save us from annoying questions
14:52 -!- webdawg_- [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has joined #openvpn
14:52 < webdawg_-> does it make a speed difference dazo?
14:52 < ecrist> :)
14:52 <@dazo> webdawg_-: nope
14:52 < ecrist> no, it doesn't
14:52 < ecrist> it's just how it presents itself to the OS
14:52  * ecrist thinks it should show up as a terabit interface
14:53 < ecrist> 10/100/1000/1000000
14:53  * dazo only thought of 10Gbit ... but ecrist is right ... why limit ourselves
14:53 < ecrist> :D
14:54 -!- WebDawgII [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has quit [Ping timeout: 246 seconds]
14:54 <@dazo> it could be cool though, if it would take the same speed as the interface of the default gateway (which would be somewhat closer to reality) ... however, that's wasting of coding time
14:58 < ecrist> is the source for the tap driver managed by openvpn, or is it a third-party thing?
14:59 <@dazo> it's in the openvpn source code
15:00 <@dazo> its all in tap-win32/ 
15:01 -!- webdawg_- [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has quit [Read error: Connection reset by peer]
15:01 <@vpnHelper> RSS Update - forum: Portable OpenVPN for Linux. <http://forums.openvpn.net/topic8566.html#p14723>
15:07 < jeev> opera just doesn't wanna work
15:07 <+s7r> jeev: where do you put the socks in opera?
15:07 <+s7r> and why the hell do you use opera anyways ... it's a dead p
15:08 <+s7r> use chrome firefox / ie
15:08 < jeev> i do use firefox, srware iron
15:08 < jeev> srware scares me though
15:08 < jeev> opera seems cool sometimes
15:08 <@dazo> s7r: saying opera is dead ... that's a pretty massive lie ...
15:09 < jeev> dazo, he must be a republican or a fox news employee
15:09 <@dazo> lol
15:09 <@dazo> so so tru!
15:09 <+s7r> :))
15:09 <+s7r> dazo: statistics about opera not really good
15:10 <+s7r> http://www.w3schools.com/browsers/browsers_stats.asp
15:10 <@vpnHelper> Title: Browser Statistics (at www.w3schools.com)
15:10 <+s7r> 2.4% uh.. that's so massive :D
15:10 <@dazo> statistics doesn't say anything else than how you want to interpret it :)
15:10 <+s7r> and it's decreasing
15:12 <@dazo> but that's not the same thing as it's dead .... is Linux dead because it's only found on 2.07% of the desktops?
15:12 < jeev> i'd use chrome but the privacy part of it scares me and i'm ignorant on exactly what the privacy problems are
15:12 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14724>
15:12 <+s7r> no
15:12 <+s7r> but linux is for servers
15:12 <+s7r> opera is a browser
15:13 <+s7r> designed to browse websites
15:13 <+s7r> no matter if you are on linux mac windows it's a browser
15:13 <+s7r> i have used opera much time ago and it was good for nothing
15:13 <@dazo> but the company behind opera is actually doing very well ... and they sell developer APIs to a lot of set-top boxes, some mobile phones even ship with opera
15:14 <+s7r> i know my phone is one in that case :))
15:14 <@dazo> it's really a popular browser on the embedded market
15:14 <+s7r> mobile opera
15:14 <+s7r> nokia e71 symbian
15:14 <+s7r> seriously
15:14 <@dazo> and that's the same technology behind it 
15:15 <@dazo> your argumentation is exactly the same which Microsoft uses ... "Linux is dead, because it's not used on the desktop" ... you choose to say: "Opera is dead because it is not used on the desktop"
15:15 <+s7r> a web browser is intended to be much more than something used on the mobile phones
15:16 <+s7r> and it's used on very few mobile phones because it comes by default .. and people are lazy to intall other
15:16 <+s7r> otherwise nobody would use it
15:16 <+s7r> you can not compare linux with opera
15:16 <@dazo> read this one: http://www.opera.com/media/finance/2011/1Q11_presentation.pdf
15:16 <@dazo> slide 3
15:16 <+s7r> 185 million+ people using Opera browsers every month
15:17 <+s7r> this is the biggest bullshit i have ever heard
15:17 <@dazo> if you can prove them wrong, you have a good news scoop!
15:17 -!- Guifort [~Guifort@ALille-255-1-21-154.w86-192.abo.wanadoo.fr] has joined #openvpn
15:18 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:24 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652.html#p14725>
15:36 <@vpnHelper> RSS Update - forum: [Newbie] Help routing traffic through OpenVPN on Debian <http://forums.openvpn.net/topic8652-15.html#p14726>
15:38 -!- dazo is now known as dazo_afk
15:54 <@vpnHelper> RSS Update - forum: openvpn management "kill" command not working <http://forums.openvpn.net/topic8653.html>
15:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
15:57 -!- gyyrog [~gyyrog@adsl-99-19-43-10.dsl.klmzmi.sbcglobal.net] has joined #openvpn
16:03 -!- Guifort [~Guifort@ALille-255-1-21-154.w86-192.abo.wanadoo.fr] has quit [Quit: Quitte]
16:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
16:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:11 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
16:11 < cjs226> can an openvpn server also be a nat server for internal systems?
16:11 <@vpnHelper> RSS Update - forum: Openvpn write UDPv4: No buffer space available code=55 <http://forums.openvpn.net/topic8651.html#p14728>
16:12 -!- gyyrog [~gyyrog@adsl-99-19-43-10.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
16:15 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
16:16 <@vpnHelper> RSS Update - forum: openvpn management "kill" command not working <http://forums.openvpn.net/topic8653.html#p14729>
16:17 < Bushmills> the machine, yes.  the program, no
16:18 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
16:19 < cjs226> good deal, thx
16:26 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:38 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 250 seconds]
16:39 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
16:45 -!- webdawg [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has joined #openvpn
16:45 < webdawg> When I try to iroute a network with a subnet mask like 255.255.248.0 it says bad network/subnet mask.  Why?
16:47 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 250 seconds]
16:49 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:49 < webdawg> Should it work?
16:49 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
16:52 < EugeneKay> Dunno. What network are you using?
16:53 < webdawg> 10.0.1.0
16:53 < webdawg> 10.0.1.0/255.255.248.0
16:54 < EugeneKay> Well, that's not a valid comob.
16:54 < EugeneKay> Hence, the error
16:54 < webdawg> What?
16:54 < webdawg> How so?
16:54 < EugeneKay> Because .1.0 is not on a /21 boundary
16:54 < EugeneKay> You want 10.0.0.0/21 or 10.0.8.0/21
16:55 < EugeneKay> http://jodies.de/ipcalc?host=10.0.1.0&mask1=21&mask2=
16:55 <@vpnHelper> Title: IP Calculator / IP Subnetting (at jodies.de)
16:55 < webdawg> You mean it is one a /21 bound.
16:55 < webdawg> on*
16:55 < webdawg> And not on a 248 boundry.
16:55 < EugeneKay> 255.255.248.0 = /21
16:56 < EugeneKay> Take a tip from me, learn how "masking" works.
16:56 < webdawg> I did already.
16:56 < |Mike|> :P
16:56 < EugeneKay> Obviously not.
16:56 < webdawg> This shit would work.
16:56 < EugeneKay> Because 10.0.1.0/255.255.248.0 is NOT a valid network definition.
16:56 < webdawg> I must be missing a part.
16:56 < |Mike|> rfc 1718
16:57 < EugeneKay> It is a valid definition of an IP address within the 10.0.0.0/21 network, but that's not what "iroute" is looking for.
16:57 < webdawg> Ohh.
16:57 < webdawg> Wait.
16:57 < webdawg> dir.
16:57 < webdawg> heh.
16:57 < EugeneKay> Now you're seeing it.
16:58 < webdawg> Fuck.
16:58 < webdawg> Thanks.
16:58 < webdawg> Dam numbers.
16:58 < EugeneKay> And FWIW, I like to break along 4-bit boundaries(/16, /20, /24, /28) because it's easier to do the math
16:58 < webdawg> Makes complete sense.  I just missed that part.
16:58 < webdawg> How is it easier?  Manually you mean?
16:59 < EugeneKay> Yeah, mental math. 16 groups of 16 groups of 16 groups of....
16:59 < webdawg> Yeh.  Thats what I thought.
16:59 < webdawg> Thanks for the help.  I missed that heh.
16:59 < EugeneKay> Sure.
17:00 < webdawg> I have to head out.  Later.
17:00 < EugeneKay> Nice thing about OpenVPN: The problem is right there in the error message. The challenge is figuring out the meaning.
17:00 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:01 < webdawg> Yeh.
17:03 < webdawg> later.
17:03 -!- webdawg [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has quit [Quit: w00t....no more work]
17:25 -!- albech [~thomas@1503027373.seas-nve.dbnet.dk] has joined #openvpn
17:26 < albech> getting lots of: read UDPv4 [ECONNREFUSED]: Connection refused (code=111) in my log now. What is causing this?
17:30 -!- applerings [~applering@d50-98-194-233.bchsia.telus.net] has joined #openvpn
17:39 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:44 -!- AbstractBeliefs [~AbstractB@unaffiliated/abstractbeliefs] has joined #openvpn
17:47 < Olipro> albech: two main possibilities
17:47 < Olipro> 1) using the wrong port
17:47 < Olipro> 2) firewall
17:49 -!- AbstractBeliefs [~AbstractB@unaffiliated/abstractbeliefs] has left #openvpn ["*.back *.flip"]
17:51 -!- corretico [~luis@201.201.44.82] has joined #openvpn
17:54 -!- Perun [perun@chao5.net] has quit [Ping timeout: 240 seconds]
17:55 -!- Perun [perun@chao5.net] has joined #openvpn
18:03 <@vpnHelper> RSS Update - forum: [solved] OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14730>
18:07 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:07 -!- gyyrog [~gyyrog@adsl-99-19-43-10.dsl.klmzmi.sbcglobal.net] has joined #openvpn
18:15 -!- nebajoth [~nebajoth@starfighter.org] has left #openvpn ["Leaving"]
18:30 -!- Squidy_at_Home [~quassel@187.6.0.15] has joined #openvpn
18:36 -!- Squidy_at_Home [~quassel@187.6.0.15] has quit [Remote host closed the connection]
18:47 -!- Squidy_at_Home [~quassel@187.6.0.15] has joined #openvpn
18:56 -!- albech [~thomas@1503027373.seas-nve.dbnet.dk] has quit [Quit: Ex-Chat]
19:32 -!- Denial [~Denial@drgi.co.uk] has quit []
19:34 -!- mode/#openvpn [+o ecrist] by ChanServ
19:34 -!- mode/#openvpn [-bbbb *!*@gateway/web/freenode/* *!*@188.222.85.* *!*@188.222.85.0/24 *!*@dunnington.eu] by ecrist
19:34 -!- mode/#openvpn [-o ecrist] by ecrist
19:42 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Remote host closed the connection]
19:45 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has joined #openvpn
19:45 <@vpnHelper> RSS Update - forum: [solved] OpenVPN: Can connect, but cannot ping an address <http://forums.openvpn.net/topic8588.html#p14732> || Win 7 server and client , can connect but can't see server <http://forums.openvpn.net/topic8629.html#p14731>
19:53 -!- Netsplit over, joins: EvOr, catsup, havoc
19:53 -!- Netsplit *.net <-> *.split quits: Jedicus, Fleck, _____m, gladiatr, MattJD, naquad, batrick, Deathvalley122, @dazo_afk
19:53 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
19:53 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
19:53 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has quit [Excess Flood]
19:53 -!- Netsplit over, joins: dazo_afk
19:53 -!- mode/#openvpn [+o dazo_afk] by ChanServ
19:53 -!- Netsplit over, joins: Jedicus
19:54 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has joined #openvpn
19:54 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has quit [Remote host closed the connection]
19:54 -!- Netsplit over, joins: batrick
19:54 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has joined #openvpn
19:54 -!- Netsplit over, joins: Fleck
19:55 -!- Squidy_at_Home [~quassel@187.6.0.15] has quit [Remote host closed the connection]
19:57 -!- Deathvalley122 [~Death@eagleits.net] has joined #openvpn
19:58 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:00 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
20:08 -!- Squidy_at_Home [~quassel@187.6.0.15] has joined #openvpn
20:30 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:31 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
20:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
20:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:50 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 252 seconds]
20:50 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:53 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
20:54 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
20:58 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
20:58 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
21:52 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 264 seconds]
21:57 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:36 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:36 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
22:36 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:40 <@vpnHelper> RSS Update - forum: cannot connect to server <http://forums.openvpn.net/topic8646.html#p14733>
22:58 <@vpnHelper> RSS Update - forum: openvpn management "kill" command not working <http://forums.openvpn.net/topic8653.html#p14734>
23:10 <@vpnHelper> RSS Update - forum: Openvpn write UDPv4: No buffer space available code=55 <http://forums.openvpn.net/topic8651.html#p14735>
23:28 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
23:32 -!- gyyrog [~gyyrog@adsl-99-19-43-10.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
23:36 -!- Squidy_at_Home [~quassel@187.6.0.15] has quit [Remote host closed the connection]
23:36 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Remote host closed the connection]
--- Day changed Tue Aug 16 2011
00:03 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:28 <@vpnHelper> RSS Update - forum: Remember login credentials <http://forums.openvpn.net/topic8654.html>
00:39 -!- synchrone [Miranda@syn.int.ru] has joined #openvpn
00:39 < synchrone> Hi everyone!
00:40 < EugeneKay> Rawr
00:40 < synchrone> somehow win7 doesn't want to get an ip openvpn server assignes for my adapter and uses autosetup instead
00:40 < synchrone> dhcp there, so i cant just do it by hand
00:41 < EugeneKay> !log
00:41 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
00:41 < EugeneKay> !logs
00:41 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
00:41 < jeev> ERROR
00:41 < jeev> whoami
00:41 < jeev> (the best)
00:41 < EugeneKay> Stupid bot.
00:41 < jeev> that bot has been acting up ever since they banned Dont Ask Dont Tell
00:41 < jeev> i think it's ready to come out
00:42 < EugeneKay> That error message should me a /notice, so it doesn't spam the channel proper.
00:42 < EugeneKay> But I digress
00:42 < synchrone> how do i set verbose to 5 in openvpngui ?
00:43 < EugeneKay> That should be the default. Just copypasta what you got.
00:43 < EugeneKay> No, I lied. Default is 1.
00:43 < EugeneKay> Put verb 5 into your client.ovpn file
00:46 < synchrone> http://pastie.org/2379026
00:46 < synchrone> oh, now windows reports duplicated ip
00:47 < synchrone> NOTE: FlushIpNetTable failed on interface [22] {94D221C0-A957-4F7A-BFB1-9C36A0E731E2} (status=5): Access denied
00:47 < synchrone> maybe that's the thing ?
00:47 < synchrone> i should've run it as admin
00:47 < synchrone> or smth
00:47 < EugeneKay> Yup. 
00:47 < EugeneKay> Try Run As Administrator, see what happens
00:48 < synchrone> shiz, why didn't they set up a manifest ...
00:48 < EugeneKay> Because real men disable UAC :-p
00:48 < synchrone> =\
00:50 < applerings> i dont hate uac like everyone else seems to 
00:50 < synchrone> man... there should be some other way manipulating windoze rounting table other than running "route add" command
00:50 < synchrone> but anyway that didn't do the job
00:50 < synchrone> interface is still autosetup it's ip
00:50 < synchrone> http://pastie.org/2379042
00:54 < synchrone> >>Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.20.80
00:54 < synchrone> but it didn't do that
00:54 < synchrone> let's see if reboot helps, like the usual windows way
00:54 -!- synchrone [Miranda@syn.int.ru] has quit [Read error: Connection reset by peer]
00:56 -!- synchrone [Miranda@syn.int.ru] has joined #openvpn
00:57 < synchrone> okay, it didn't
01:11 -!- K1ng` [~KING@180.211.188.163] has joined #openvpn
01:13 -!- K1ng [~KING@180.211.188.163] has quit [Ping timeout: 250 seconds]
01:18 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:22 -!- dazo_afk is now known as dazo
01:22 <@vpnHelper> RSS Update - forum: Win 7 server and client , can connect but can't see server <http://forums.openvpn.net/topic8629.html#p14737>
01:28 <@vpnHelper> RSS Update - forum: Using different DHCP servers for different clients <http://forums.openvpn.net/topic8648.html#p14738>
01:29 <@dazo> Olipro: re: "UDPv4 [ECONNREFUSED]: Connection refused (code=111)" ... this can be seen quite often on server side .... when clients disconnect without --explicit-exit-notify, the server don't know if the server or client lost the connection, and the server tries to re-establish the connection ... this is because UDP doesn't have a "closing connection handshake" which TCP does.  Adding --explicit-exit-notify in client configs usually solves t
01:29 <@dazo> his 
01:36 -!- K1ng` [~KING@180.211.188.163] has quit [Ping timeout: 240 seconds]
01:53 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
01:57 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
02:30 < Mowee> Morning
02:41 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14739>
02:48 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
02:53 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14741> || Using different DHCP servers for different clients <http://forums.openvpn.net/topic8648.html#p14740>
02:54 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
02:56 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
03:00 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
03:00 < Kartagis> good morning
03:08 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
03:09 -!- n2deep [~n2deep@dsl231-034-143.sea1.dsl.speakeasy.net] has joined #openvpn
03:17 < Kartagis> !euphoria
03:19 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:23 <@vpnHelper> RSS Update - forum: Inactivity Disconnect <http://forums.openvpn.net/topic8655.html>
03:31 < Kartagis> does chantra have a database schema, or will anything do?
03:35 <@vpnHelper> RSS Update - forum: Inactivity Disconnect <http://forums.openvpn.net/topic8655.html#p14743>
03:36 -!- K1ng [~KING@180.211.188.163] has joined #openvpn
03:45 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
03:49 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
03:50 <@dazo> !eurephia
03:50 <@vpnHelper> "eurephia" is http://www.eurephia.net/
03:50 <@dazo> Kartagis: ^^^
03:59 < Kartagis> dazo: thanks
03:59 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Remote host closed the connection]
04:02 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
04:05 <@vpnHelper> RSS Update - forum: Cannot ping server when connected from mobile phone <http://forums.openvpn.net/topic8635.html#p14744>
04:09 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 258 seconds]
04:17 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has joined #openvpn
04:30 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:30 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:30 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:31 -!- thegraham [~thomas@host109-150-35-193.range109-150.btcentralplus.com] has joined #openvpn
04:32 < thegraham> Hi there, I'm trying to get openvpn setup on debian.  I've used the scripts in easy-rsa to generate the keys and copied them into /etc/openvpn/keys/, but when I start up the server I get this error: Cannot load CA certificate file /etc/openvpn/keys/ca.crt path (null) (SSL_CTX_load_verify_locations) (OpenSSL) Any ideas what's going wrong, the file is definitely there...
04:34 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
04:34 -!- applerings [~applering@d50-98-194-233.bchsia.telus.net] has quit [Ping timeout: 252 seconds]
04:34 < Bushmills> your problem is "Cannot load CA certificate file /etc/openvpn/keys/ca.crt"
04:35 < Bushmills> maybe permissions. maybe not correctly specified in config
04:35 < thegraham> Bushmills: I'm aware of that, I read the logs!  But that file is there: algy:/etc/openvpn# ls -lh /etc/openvpn/keys/ca.crt
04:35 < thegraham> -rw-r--r-- 1 root root 3.0K Aug 16 10:14 /etc/openvpn/keys/ca.crt
04:37 < thegraham> So I don't really see what the permissions issue would be
04:38 < Bushmills> what's the " algy:/" leading the path?
04:38 < thegraham> the name of the machine
04:38 < thegraham> that was just the command prompt, didn't mean to copy that bit in
04:39 < Bushmills> which is the server, is assume? same where you try to start openvpn server?
04:39 < thegraham> I've googled the problem and some people suggest that "the ca.crt file should be plaintext with ?Begin Certificate?<?>?End Certificate", which isn't the format of the ca.crt that easy-rsa has generated, might that be the problem?
04:40 < thegraham> Bushmills, yes
04:40 < Bushmills> -----BEGIN CERTIFICATE-----
04:40 < Bushmills> -----END CERTIFICATE-----
04:40 < thegraham> yes, it doesn't have that 
04:40 < Bushmills> there you go
04:40 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
04:40 -!- mode/#openvpn [+v s7r] by ChanServ
04:41 < thegraham> well, I created them following the easy-rsa steps
04:41 < thegraham> does easy-rsa not work?
04:41 < Bushmills> last time i used it, it did. that was several years ago.
04:43 < thegraham> ok, I'll try again with the easy-rsa process
04:43 < thegraham> but I followed it from the website howto 
04:43 < Bushmills> !howto
04:43 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:43 < Bushmills> that one?
04:46 < thegraham> no, this one: http://openvpn.net/index.php/open-source/documentation/howto.html#pki
04:46 <@vpnHelper> Title: HOWTO (at openvpn.net)
04:46 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
04:46 < thegraham> however, I think the problem is that there are two versions of easy-rsa packaged with the debian openvpn package - the version 1.0 produces the right format ca.crt, the 2.0 version does not
04:49 < thegraham> anyway, thanks for the help
04:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:59 < thegraham> So I've got it working, thanks for the help.  Is there a way to force my connection to route through the VPN - at the moment if I visit http://checkip.dyndns.org/ it still shows my non-vpn external IP rather than the VPN's external IP
05:00 <@vpnHelper> Title: Current IP Check (at checkip.dyndns.org)
05:00 < Bushmills> !redirect
05:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
05:00 -!- n2deep [~n2deep@dsl231-034-143.sea1.dsl.speakeasy.net] has quit [Ping timeout: 264 seconds]
05:01 < thegraham> !def1
05:01 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
05:02 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
05:06 < thegraham> !nat
05:06 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
05:08 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
05:11 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has joined #openvpn
05:11 -!- EugeneKay is now known as EugeneSleep
05:13 < Kartagis> does openvpn have a management web GUI?
05:14 -!- thegraham [~thomas@host109-150-35-193.range109-150.btcentralplus.com] has quit [Quit: This computer has gone to sleep]
05:14 < reiffert> !webgui
05:14 <@vpnHelper> "webgui" is (#1) http://openvpn-web-gui.sourceforge.net/ if you have tried this please give us feedback, or (#2) http://sourceforge.net/projects/openvpn-status/ also pls let us know if you use that
05:17 < Kartagis> reiffert: does the first link allow me to add mysql vpn users
05:17 < Kartagis> ?
05:19 < reiffert> !factoid search --values sql
05:19 < reiffert> !factoid search --values pam
05:19 < reiffert> !factoids search --values pam
05:19 <@vpnHelper> No keys matched that query.
05:20 < reiffert> !factoids search --values sql
05:20 <@vpnHelper> No keys matched that query.
05:20 < reiffert> Kartagis: there are several possibilities doing that. You could either auth against pam and have pam talk to your sql server
05:20 < reiffert> Kartagis: or have openvpn auth against ldap and use the mysql ldap backend
05:20 < reiffert> but I'd recommend using the first thing.
05:21 < reiffert> And I cant really tell if those web gui's let you add sql users, but try asking the author.
05:21 < Kartagis> is there a readme for the former?
05:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
05:21 < Kartagis> guide rather
05:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:25 < reiffert> Kartagis: I guess the that openvpn<->pam part comes with openvpn and that pam<->mysql is with the pam docs.
05:25 < reiffert> !pam
05:25 < reiffert> !factoids search --values pam
05:25 <@vpnHelper> No keys matched that query.
05:25 < reiffert> !factoids search --values auth
05:25 <@vpnHelper> 'netman', 'hmac', 'hmac', 'activedirectory', 'nocert', 'authpass', 'pwfile', 'tls-auth', and 'duplicate'
05:25 < reiffert> !pwfile
05:25 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
05:26 < reiffert> mhm, doesnt look very promising regarding the factoids vpnhelper sentences.
05:26 < reiffert> but I think that the openvpn<->pam stuff comes with the openvpn source.
05:31 < Kartagis> do you know of a openvpn->pam->mysql guide?
05:31 < Kartagis> !nocert
05:31 <@vpnHelper> "nocert" is (#1) to use login and pass (NO CERTS) for auth in server setup, you want --username-as-common-name --auth-user-pass-verify --client-cert-not-required, or (#2) to know more, read about those config options in the manual (!man)
05:32 < Kartagis> reiffert: also, can I put any of these options in the .conf file?
05:32 < reiffert> I dont know of any guide but I know for sure that openvpn<->pam works.
05:32 < reiffert> you will have to check the pam<->mysql stuff on your own.
05:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:40 -!- Titania [~titania@221.120.122.106] has joined #openvpn
05:40 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
05:49 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html>
05:52 < reiffert> libpam-mysql - PAM module allowing authentication from a MySQL server
05:52 < reiffert> technically speaking you are done, cause there is everything you will need. Now go and figure out how.
05:55 <@vpnHelper> RSS Update - forum: cannot connect to server <http://forums.openvpn.net/topic8646.html#p14746>
06:01 <@vpnHelper> RSS Update - forum: openvpn management "kill" command not working <http://forums.openvpn.net/topic8653.html#p14747>
06:07 <@vpnHelper> RSS Update - forum: Remember login credentials <http://forums.openvpn.net/topic8654.html#p14749> || Openvpn write UDPv4: No buffer space available code=55 <http://forums.openvpn.net/topic8651.html#p14748>
06:16 -!- luneff [~yury@188.114.43.47] has joined #openvpn
06:28 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
06:30 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has quit []
06:39 -!- EugeneSleep is now known as EugeneKay
06:40 -!- K1ng` [~KING@180.211.188.116] has joined #openvpn
06:41 -!- K1ng [~KING@180.211.188.163] has quit [Ping timeout: 258 seconds]
06:50 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
06:50 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:53 <@vpnHelper> RSS Update - forum: Remember login credentials <http://forums.openvpn.net/topic8654.html#p14750>
06:55 -!- julius_ [~julius@p3EE2C2A4.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
06:56 < Kartagis> how can I find out why my server dies?
06:56 < EugeneKay> Looking at the log files would be a good place to start.
06:57 < Kartagis> log doesn't tell me anything
06:58 < EugeneKay> Turn up the verbosity
06:58 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
06:59 <@vpnHelper> RSS Update - forum: Remember login credentials <http://forums.openvpn.net/topic8654.html#p14751>
06:59 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:00 < Kartagis> I set it 6, still no
07:00 < Kartagis> oh
07:01 < Kartagis> Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/mysql-auth.conf:1: hostname (2.1.0)
07:06 < Kartagis> what does this tell you?
07:07 < EugeneKay> Well, it means that your hostname directive is using an unrecognized option or is missing a parameter.
07:07 -!- julius_ [~julius@p3EE2A43B.dip.t-dialin.net] has joined #openvpn
07:07 < Kartagis> I grep'd, I don't have a hostname directive
07:08 < EugeneKay> Though something tells me that mysql-auth.conf isn't actual an OpenVPN config file, but is rather a poorly named config file related to your server.conf 
07:08 < EugeneKay> What's probably going on is the openvpn init script is barfing on that not-an-openvpn-config .conf file.
07:15 < Kartagis> I removed mysql-auth.conf (it was from chantra's mysql auth package anyway), but I still can't start it
07:15 < Kartagis> I got it
07:15 < ecrist> !configs
07:15 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
07:15 < ecrist> !logs
07:16 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
07:16 < EugeneKay> You're ruining the challenge for me, ecrist. I like to see how much of a config(and it's issues) I can discern from a single indicative line.
07:17 < ecrist> well then, by all means continue to waste your time. ;)
07:17 < Kartagis> I neglected to uncomment ca, cert and key lines
07:19 < EugeneKay> Sounds like you have a bunch of issues at play.
07:23 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14752>
07:24 < Olipro> does OpenVPN have a built-in arg for for comparing the hostname it's connecting to with the cert's CN
07:24 < ecrist> !man
07:24 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
07:24 < ecrist> I don't think so, Olipro 
07:24 < Kartagis> http://pastebin.com/aE1NCuCQ what's this?
07:24 < Olipro> yeah, someone handed me a bash script that does it with openssl
07:25 < Kartagis> I mean these errors
07:25 -!- EugeneK [EugeneKay@eugenekay.com] has joined #openvpn
07:25 < ecrist> Kartagis: you should just post your entire log, or figure it out yourself.
07:25 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 260 seconds]
07:25 -!- EugeneK is now known as EugeneKay
07:25 < ecrist> Olipro: you can do it with a script using --client-connect
07:25 < Olipro> yah
07:26 < Kartagis> ecrist: this is the repeating part?
07:26 -!- Riz [~riz@syn.theintertubes.ca] has quit [Ping timeout: 260 seconds]
07:26 < Kartagis> s/\?//
07:26 -!- Riz [~riz@syn.theintertubes.ca] has joined #openvpn
07:27 < ecrist> right, we won't help if you don't post your configs and your logs
07:27 < Kartagis> ecrist: let me paste them
07:27 < Olipro> "and a picture of your wife in something seductive"
07:27 -!- mode/#openvpn [+o ecrist] by ChanServ
07:28 -!- ecrist changed the topic of #openvpn to: Current Release: 2.2.1 (6-July-2011) || Your problem is your firewall, really. || See !welcome and !goal || Access Server goto #openvpn-as || post configs and logs or GTFO
07:28 -!- mode/#openvpn [-o ecrist] by ecrist
07:28 < Olipro> amen.
07:29 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 260 seconds]
07:32 -!- Titania [~titania@221.120.122.106] has quit [Remote host closed the connection]
07:35 < Kartagis> ecrist: http://pastebin.com/s7H9Gseg is my conf and my logs are never ending to grow
07:35 < Kartagis> I continuously get those
07:38 < Olipro> ho hum, shouldn't you be specifying tls-server
07:40 < Kartagis> Olipro: this perfectly worked before, without that crazy log problem
07:40 < Olipro> any reason why you're using TCP too?
07:41 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
07:42 < Kartagis> no specific reason, that's what I saw on openvpn.net examples
07:44 < Kartagis> when I put in the line client-cert-not-required, it dies
07:46 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
07:46 -!- mode/#openvpn [+o mattock] by ChanServ
07:47 -!- jasonb_ [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Ping timeout: 250 seconds]
07:48 < Kartagis> oh, when I put in that line, it requires pam plugin path
07:51 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
07:51 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14754> || OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p14753>
07:56 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 250 seconds]
07:56 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
08:02 <@vpnHelper> RSS Update - forum: Problem with routing Internet from VPN Server to VPN Client <http://forums.openvpn.net/topic8657.html>
08:03 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
08:03 < Kartagis> when connecting from windows to openvpn, should the networking option be pptp?
08:07 < Bushmills> !pptp
08:07 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
08:07 <@vpnHelper> read about why to not use pptp, or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
08:10 < Kartagis> Bushmills: I was trying from windows, and ipsec said it required certificates
08:10 < Kartagis> hmm
08:11 <@dazo> Kartagis: ipsec and pptp is not openvpn .... you need the windows version of openvpn installed
08:11 < Olipro> when connecting from Windows to OpenVPN, you use the OpenVPN client
08:11 < Olipro> snap
08:16 < Kartagis> I was told the built-in VPN client worked
08:19 < EugeneKay> You were lied to
08:26 <@vpnHelper> RSS Update - forum: Problem with routing Internet from VPN Server to VPN Client <http://forums.openvpn.net/topic8657.html#p14757> || MAC colision problem <http://forums.openvpn.net/topic8656.html#p14756>
08:33 < ecrist> nobody here who knows anything would have told you that
08:38 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14758>
08:53 < datruth> Question, on my windows xp box I closed up my laptop and went to multiple locations and game back i'm not connected to the vpn yet the TUN adapter is still active with an IP do I need a client disconnect script to disconnect the vpn properly?
08:54 < EugeneKay> Attempting a connection should fix it. If not, log off and/or reboot.
08:54 < EugeneKay> You could also disable / reenable the connection
08:54 < datruth> yeah when I open up openvpn it has all tap devices are in use.
08:54 < EugeneKay> Dis/reenable
08:55 < datruth> EugeneKay: when checking the task manager there is an openvpn running in the background but no sys tray icon is this normnal?
08:55 < EugeneKay> That's your zombie openvpn instance :-p
08:55 < EugeneKay> Nuke it from orbit
08:56 < datruth> Gotcha thats the instance that prolly made the connection
08:57 < EugeneKay> The standard windows fix of "screw it, reboot" would fix that, too.
09:00 -!- master_of_master [~master_of@p57B54845.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:02 -!- master_of_master [~master_of@p57B552AF.dip.t-dialin.net] has joined #openvpn
09:11 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:23 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 246 seconds]
09:24 <@vpnHelper> RSS Update - forum: Problem with routing Internet from VPN Server to VPN Client <http://forums.openvpn.net/topic8657.html#p14759>
09:24 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
09:31 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
09:33 -!- Bheam [michael@77.94.234.164] has quit []
09:34 -!- Denial- [~Denial@drgi.co.uk] has joined #openvpn
09:34 -!- Denial [~Denial@drgi.co.uk] has quit [Ping timeout: 276 seconds]
09:36 <@vpnHelper> RSS Update - forum: Remember login credentials <http://forums.openvpn.net/topic8654.html#p14760>
09:39 -!- Juheros [ba1ce062@gateway/web/freenode/ip.186.28.224.98] has joined #openvpn
09:40 < Juheros> this channel is in english
09:41 < reiffert> Juheros: ja
09:42 < Juheros> ??
09:42 < Juheros> español ?
09:43 < reiffert> english.
09:45 < Juheros> you have a manually to configure openvpn on Centos?
09:45 < Juheros> please
09:46 < Olipro> no, it just magically knows all your settings
09:46 < Olipro> using patented Magical Pixie(TM) technology
09:48 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
09:48 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
09:50 < Juheros> I need basic configuration
09:51 < Juheros> to learn
09:54 <@vpnHelper> RSS Update - forum: Remember login credentials <http://forums.openvpn.net/topic8654.html#p14761>
09:58 -!- Juheros [ba1ce062@gateway/web/freenode/ip.186.28.224.98] has quit [Quit: Page closed]
09:58 < Bushmills> Juheros: there are example configs in or below your /usr/doc/openvpn directory 
09:59 < Bushmills> http://docs.scarydevilmonastery.net/cgi-bin/dwww/usr/share/doc/openvpn/examples/?type=dir
09:59 <@vpnHelper> Title: Files in /usr/share/doc/openvpn/examples (at docs.scarydevilmonastery.net)
10:08 -!- style [style@richardt.fi] has left #openvpn []
10:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
10:31 -!- nuttersppadic [~IceChat77@193.130.68.17] has left #openvpn []
10:32 -!- rubin110 [~rubin110@173-228-123-71.dsl.dynamic.sonic.net] has left #openvpn []
10:36 <@vpnHelper> RSS Update - forum: Problem with routing Internet from VPN Server to VPN Client <http://forums.openvpn.net/topic8657.html#p14762>
10:51 -!- dazo is now known as dazo_afk
11:07 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
11:17 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
11:30 <@vpnHelper> RSS Update - forum: Problem with routing Internet from VPN Server to VPN Client <http://forums.openvpn.net/topic8657.html#p14763>
11:56 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 260 seconds]
12:05 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 250 seconds]
12:22 -!- Titania [~titania@221.120.122.106] has joined #openvpn
12:35 < ecrist> I knew I should have kept the web client banned
12:48 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
12:51 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
12:51 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has left #openvpn ["Konversation terminated!"]
12:57 -!- uuuppz [~uuuppz@89.204.164.213] has joined #openvpn
13:07 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p14764>
13:08 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
13:22 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
13:27 -!- uuuppz [~uuuppz@89.204.164.213] has quit [Ping timeout: 264 seconds]
13:29 -!- luneff [~yury@188.114.43.47] has quit [Quit: This computer has gone to sleep]
13:31 <@vpnHelper> RSS Update - forum: openvpn management "kill" command not working <http://forums.openvpn.net/topic8653.html#p14765>
13:38 -!- jasonb_ [~jasonb@169-16.202-68.tampabay.res.rr.com] has joined #openvpn
13:39 -!- A1 [relaxhelp@72-254-48-199.client.stsn.net] has joined #openvpn
13:39 < A1> Hi
13:39 < A1> I am struggling with an openvpn issue
13:39 < A1> I keep getting a tls auth timeout on a connection that has been working for a year.
13:40 < A1> I know the firewall is open on all ports
13:40 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
13:40 < A1> i can ping my vpn server from the box
13:40 < A1> I need help in how to trouble shoot
13:40 < A1> same setup works on other machines
13:41 < A1> !welcome
13:41 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:41 < A1> !goal
13:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:42 < A1> !man
13:42 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
13:42 <@vpnHelper> RSS Update - forum: Problem with routing Internet from VPN Server to VPN Client <http://forums.openvpn.net/topic8657.html#p14766>
13:43 < A1> anyone around?
13:44 -!- uuuppz [~uuuppz@89.204.246.141] has joined #openvpn
13:46 < A1> Hi Looking for some advice anyone around?
13:49 <@vpnHelper> RSS Update - forum: Problem with routing Internet from VPN Server to VPN Client <http://forums.openvpn.net/topic8657.html#p14767>
13:54 -!- luneff [~yury@84.51.198.7] has joined #openvpn
13:54 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p14768>
13:56 < A1> anybody to offer advice?
14:11 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:13 -!- Titania [~titania@221.120.122.106] has quit [Quit: Will return someday...]
14:15 < krzee> you still never explained your problem
14:15 < krzee> !ask
14:15 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, or (#2) http://www.latinsud.com/answer/, or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
14:15 < krzee> !logs
14:15 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
14:16 < krzee> ^ @ A1 
14:17 < ecrist> A1: !logs and !configs
14:20 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
14:28 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
14:47 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Read error: Connection reset by peer]
14:47 -!- nixusr [~nixusr@205.185.121.60] has joined #openvpn
14:47 -!- nixusr [~nixusr@205.185.121.60] has quit [Changing host]
14:47 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
14:50 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
14:50 -!- mape2k [~mape2k@f053195042.adsl.alicedsl.de] has joined #openvpn
14:59 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
15:13 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
15:17 -!- uuuppz [~uuuppz@89.204.246.141] has quit [Ping timeout: 246 seconds]
--- Log closed Tue Aug 16 15:23:26 2011
--- Log opened Tue Aug 16 15:23:45 2011
15:23 -!- ecrist_ [~ecrist@216.17.68.153] has joined #openvpn
15:23 -!- Irssi: #openvpn: Total of 146 nicks [4 ops, 0 halfops, 0 voices, 142 normal]
15:24 -!- Irssi: Join to #openvpn was synced in 34 secs
15:25 -!- ecrist [~ecrist@openvpn/community/support/ecrist] has quit [Ping timeout: 276 seconds]
15:38 -!- mape2k [~mape2k@f053195042.adsl.alicedsl.de] has quit [Ping timeout: 250 seconds]
16:08 -!- zzattack [~zzattack@237-89-ftth.onsneteindhoven.nl] has joined #openvpn
16:09 < zzattack> i'm noticing that my client takes a very long time to discover routes. opening a connection to anything takes 10-15 seconds, but once opened, the connection is as fast as expected
16:10 < zzattack> is this a common symptom and if so, what can i do to fix it or find out more about the problem?
16:13 < zzattack> http://pastebin.com/5zR5VyG8
16:20 -!- A1 [relaxhelp@72-254-48-199.client.stsn.net] has quit []
16:25 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p14769>
16:33 < zzattack> appears my 'old' default route doesn't get cleared and is therefore tried first for every connection with the openvpn one as fallback?
16:40 -!- synchrone [Miranda@syn.int.ru] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
16:43 -!- context [context@november.xen.prgmr.com] has joined #openvpn
16:44 < context> so.. im confused. my vps can connect to this openvpn server just fine. anytime i try to connect from laptop (home and panera) it stops working after 60 seconds, and 60 seconds after that it reconnects due to inactivity
16:44 < context> BUT! the openvpn server at our main office i have zero problems connecting and staying connected to
16:44 < context> so i cant see it being my firewall at home
16:44 -!- nixusr_ [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
16:44 -!- nixusr_ [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
16:44 -!- nixusr_ [~nixusr@unaffiliated/nixusr] has joined #openvpn
16:45 -!- Nappy [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has joined #openvpn
16:48 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 264 seconds]
16:53 -!- Riz [~riz@syn.theintertubes.ca] has quit [Ping timeout: 258 seconds]
17:00 -!- nixusr_ is now known as nixusr
17:08 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
17:08 -!- K1ng` [~KING@180.211.188.116] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
17:18 -!- K1ng [~KING@180.211.188.116] has joined #openvpn
17:21 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
17:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
17:40 -!- Denial- [~Denial@drgi.co.uk] has quit []
17:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:03 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has quit [Ping timeout: 250 seconds]
18:06 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has joined #openvpn
18:13 -!- dimpy [~dimpy@217.155.141.46] has joined #openvpn
18:14 < dimpy> Hey guys, I have just setup a very basic openvpn server on my vps.  I have tried to connect to it with windows 7 using official openvpn gui, i copied the neccessary files.. renamed them so they work with the windows version and make a connection.. but the interface is up with an ip i can't ping anything nor does it route all traffic through the vpn.  Upon looking at the logs it seems i have issues althought im not sure how to fix them, please see here for t
18:14 < dimpy> he client log: http://codepad.org/tILtknym - does anyone know how to resolve this?
18:14 <@vpnHelper> Title: C code - 45 lines - codepad (at codepad.org)
18:20 < dimpy> nm fixed it
18:20 -!- dimpy [~dimpy@217.155.141.46] has quit [Quit: Leaving]
18:32 -!- trapni [~trapni@trapni.de] has quit [Read error: Operation timed out]
18:34 -!- trapni [~trapni@trapni.de] has joined #openvpn
18:58 -!- Riz [~riz@syn.theintertubes.ca] has joined #openvpn
19:01 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
19:06 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:12 -!- Squidy_at_Home [~quassel@187.7.192.241] has joined #openvpn
19:19 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Read error: Operation timed out]
19:20 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
19:37 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 252 seconds]
19:37 -!- pr0z0id [~pr0zoid@184.95.44.33] has joined #openvpn
19:41 < context> any reason why server would just stop responding to kepalive pings, after 60 seconds, but if i reconnect it works just fine
19:42 < context> even if im sshed to the router running the openvpn server
19:42 < context> yet that router is vpned to another router at another office and stays connected just fine
19:47 -!- pr0z0id [~pr0zoid@184.95.44.33] has quit [Ping timeout: 246 seconds]
19:49 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
19:53 -!- jasonb_ is now known as JasonBoxLaptop
19:53 -!- pr0z0id [~pr0zoid@184.95.44.33] has joined #openvpn
19:53 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 258 seconds]
19:59 -!- Turko [~root@187.173.167.204] has joined #openvpn
20:01 < Turko> help in getting a vpn and set it in BT5
20:07 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
20:13 -!- Cain [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
20:22 < Turko> una vpn para el backtrack 5
20:25 -!- JasonBoxLaptop [~jasonb@169-16.202-68.tampabay.res.rr.com] has quit [Remote host closed the connection]
20:26 -!- Titania [~titania@221.120.122.106] has joined #openvpn
20:26 -!- Titania [~titania@221.120.122.106] has quit [Read error: Connection reset by peer]
20:52 -!- You're now known as ecrist
20:57 < krzee> Turko, that was not a question
20:57 < krzee> which makes it hard to answer
20:57 < krzee> please re-phrase your question in the form of a question ;)
20:59 < Turko> krzee I want to do is this I want to download a VPN client and can configure it could help me in BT5
21:02 < krzee> !howto
21:02 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:03 < krzee> you might like this as well
21:03 < krzee> !confgen
21:03 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
21:05 < Turko> ok
21:07 < Turko> as it is seen that I run it through terminal or as I am a bit new to the vpn in BT5
21:09 < ecrist> sup d00ds?
21:11 < EugeneKay> Duding it up, dude.
21:37 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:48 -!- gyyrog [~gyyrog@adsl-99-19-43-10.dsl.klmzmi.sbcglobal.net] has joined #openvpn
21:48 -!- Turko [~root@187.173.167.204] has quit [Quit: Ex-Chat]
21:52 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
22:13 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:21 -!- gyyrog [~gyyrog@adsl-99-19-43-10.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
22:22 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:22 < UnterPerro> d
22:41 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14770>
22:55 -!- Squidy_at_Home [~quassel@187.7.192.241] has quit [Remote host closed the connection]
23:04 -!- Titania [~titania@221.120.122.106] has joined #openvpn
23:04 -!- Titania [~titania@221.120.122.106] has quit [Read error: Connection reset by peer]
23:27 -!- pr0z0id [~pr0zoid@184.95.44.33] has quit [Ping timeout: 240 seconds]
23:27 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
23:28 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Quit: Leaving.]
23:34 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
23:39 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 276 seconds]
23:40 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
23:45 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 276 seconds]
23:46 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
23:50 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 240 seconds]
23:57 <@vpnHelper> RSS Update - forum: Openvpn write UDPv4: No buffer space available code=55 <http://forums.openvpn.net/topic8651.html#p14771>
--- Day changed Wed Aug 17 2011
00:03 <@vpnHelper> RSS Update - forum: Windows 7 slow in accessing local server <http://forums.openvpn.net/topic8634.html#p14772>
00:06 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
00:18 -!- pr0z0id [~pr0zoid@184.95.44.33] has joined #openvpn
00:18 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 260 seconds]
00:29 -!- ph1l [~ph1l@gprs37.swisscom-mobile.ch] has joined #openvpn
00:35 -!- ph1l [~ph1l@gprs37.swisscom-mobile.ch] has left #openvpn []
00:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:39 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:40 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
00:57 -!- dazo_afk is now known as dazo
01:02 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
01:35 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:48 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
01:49 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Read error: Connection reset by peer]
01:50 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
01:51 <@vpnHelper> RSS Update - forum: openvpn management "kill" command not working <http://forums.openvpn.net/topic8653.html#p14773>
02:13 -!- luneff [~yury@84.51.198.7] has quit [Quit: This computer has gone to sleep]
02:19 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
02:21 < Mowee> Morning
02:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 250 seconds]
02:36 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
02:40 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
02:40 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
02:40 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
02:41 -!- luneff [~yury@188.114.54.224] has joined #openvpn
02:45 <@vpnHelper> RSS Update - forum: openvpn management "kill" command not working <http://forums.openvpn.net/topic8653.html#p14774>
02:45 -!- bitterman [~yury@188.114.54.224] has joined #openvpn
02:48 -!- luneff [~yury@188.114.54.224] has quit [Ping timeout: 276 seconds]
02:57 <@vpnHelper> RSS Update - forum: Inactivity Disconnect <http://forums.openvpn.net/topic8655.html#p14775>
03:06 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
03:06 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
03:09 <@vpnHelper> RSS Update - forum: Inactivity Disconnect <http://forums.openvpn.net/topic8655.html#p14776>
03:13 -!- bitterman [~yury@188.114.54.224] has quit [Ping timeout: 246 seconds]
03:22 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
03:25 < janjust> ping ecrist
03:26 <@vpnHelper> RSS Update - forum: Inactivity Disconnect <http://forums.openvpn.net/topic8655.html#p14777>
03:30 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:31 <@vpnHelper> RSS Update - forum: Inactivity Disconnect <http://forums.openvpn.net/topic8655.html#p14778>
03:39 -!- luneff [~yury@93.178.67.227] has joined #openvpn
03:53 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 240 seconds]
03:56 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:01 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
04:03 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14779>
04:05 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
04:10 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14780>
04:21 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 264 seconds]
04:33 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 276 seconds]
04:56 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
04:56 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
04:56 -!- mode/#openvpn [+v s7r] by ChanServ
04:56 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
05:00 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 240 seconds]
05:11 -!- tutulus [~tutulus@ns300272.ovh.net] has joined #openvpn
05:11 -!- tutulus [~tutulus@ns300272.ovh.net] has left #openvpn []
05:20 <@vpnHelper> RSS Update - forum: Inactivity Disconnect <http://forums.openvpn.net/topic8655.html#p14781>
05:22 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
05:22 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
05:22 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
05:22 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:26 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 250 seconds]
05:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:32 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14782>
05:33 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
05:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
05:39 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:39 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:45 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Quit: No Ping reply in 180 seconds.]
06:09 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
06:09 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
06:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
06:22 <@dazo> Oh geee .... that MAC collision thread has an interesting argument .... "We screwed up our configs, can you make an openvpn update so this will work?"
06:25 < hyper_ch> woot???
06:25 < hyper_ch> hi mr dazo
06:25 <@dazo> hyper_ch: hey :)
06:26 <@dazo> "]As I said, all clients are the same MAC address, and I can not change it.
06:26 <@dazo> Therefore we ask for this situation, it is possible to change openvpn so that the problem had solved?
06:26 <@dazo> For example, do a patch?"
06:26 < hyper_ch> why do clients have the same mac?
06:27 <@dazo> Either because it's "ghosted" installations, with TAP adapters preconfigured ... or that the openvpn config sets a fixed MAC address via --lladdr
06:28 < hyper_ch> weird
06:38 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14783>
06:38 -!- eliasson_ [~wizard@91.198.48.20] has quit [Ping timeout: 260 seconds]
06:39 -!- eliasson_ [~wizard@91.198.48.20] has joined #openvpn
06:45 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Read error: Connection reset by peer]
06:45 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
06:51 -!- julius__ [~julius@p3EE2AEBE.dip.t-dialin.net] has joined #openvpn
06:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
06:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Client Quit]
06:55 -!- luneff [~yury@93.178.67.227] has quit [Quit: Leaving]
06:56 -!- julius_ [~julius@p3EE2A43B.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
06:58 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
07:02 <@vpnHelper> RSS Update - forum: routing through the tunneling <http://forums.openvpn.net/topic8644.html#p14784>
07:03 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:04 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
07:14 <@vpnHelper> RSS Update - forum: routing through the tunneling <http://forums.openvpn.net/topic8644.html#p14785>
07:17 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:18 -!- julius__ [~julius@p3EE2AEBE.dip.t-dialin.net] has quit [Quit: Leaving]
07:37 -!- tutulus [~tutulus@109.169.46.34] has joined #openvpn
07:38 -!- tutulus [~tutulus@109.169.46.34] has quit [Client Quit]
07:38 -!- tutulus [~tutulus@109.169.46.34] has joined #openvpn
07:39 -!- tutulus [~tutulus@109.169.46.34] has quit [Client Quit]
07:40 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Quit: reboot]
07:49 < defswork> it can't be that difficult to automate reversing whatever it is that is fixing the mac addresses
07:50 < defswork> but I guess automation isn't a tool in many admin's skill set any more
07:50 < defswork> pre-programmed to point and click
07:56 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14787> || openvpn management "kill" command not working <http://forums.openvpn.net/topic8653.html#p14786>
08:02 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14789>
08:21 < ecrist> defswork: wtf are you mumbling about?
08:23 < ecrist> oh, nm. ;)
08:23  * ecrist reads up
08:23 -!- dazo is now known as dazo_afk
08:34 < defswork> ;)
08:35 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 240 seconds]
08:38 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:39 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
08:43 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:45 <@vpnHelper> RSS Update - forum: Using different DHCP servers for different clients <http://forums.openvpn.net/topic8648.html#p14790>
08:51 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14791>
08:54 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
08:59 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
08:59 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
08:59 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:01 -!- master_of_master [~master_of@p57B552AF.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:03 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14792>
09:03 -!- master_of_master [~master_of@p57B5519A.dip.t-dialin.net] has joined #openvpn
09:06 -!- xanthaos [~xanthaos@71-92-2-230.dhcp.stls.mo.charter.com] has joined #openvpn
09:06 < datruth> The verify-cn script in openvpn on Ubunutu can I not add the allowed CN's in a file to read from?
09:25 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Read error: Operation timed out]
09:26 < datruth> anyone awake
09:26 < datruth> ?
09:26 < datruth> !client
09:26 < datruth> !ccd
09:26 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
09:26 -!- eliasson_ [~wizard@91.198.48.20] has quit [Read error: Operation timed out]
09:26 < datruth> !verify-cn
09:26 < datruth> !verify
09:26 < EugeneKay> !factoids
09:26 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
09:26 < EugeneKay> Save you some work ;-)
09:28 < datruth> EugeneKay: thanks I have a simple question tho. On my ubuntu system I'm using verify-cn however I thought the name needed to exist in the ccd directory or does it not?
09:28 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
09:29 < EugeneKay> I'm not familiar with that directive, sorry.
09:30 < datruth> No problem, perhaps you can tell me how to enable the client cert to have a password? When creating the cert when it asks for the export password do I set the password their?
09:32 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
09:32 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14793>
09:32 < EugeneKay> Yes. That is the password to decrypt the certificate.
09:32 < EugeneKay> key, rather
09:32 < datruth> awesome thanks and the win gui for openvpn they can change the password yes?
09:32 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:33 -!- eliasson_ [~wizard@91.198.48.20] has joined #openvpn
09:33 < EugeneKay> I don't think so, but I've not explored any of that. You need an openssl-speaking app to apply/remove a password to a key
09:33 < EugeneKay> I use XCA for all my PKI-handling.
09:34 < datruth> hrmm
09:35 < datruth> EugeneKay: I created the cert without the password how can  I properly re-create my .p12 cert?
09:36 < EugeneKay> openssl pkcs12 -in package.p12 -out new_package.p12
09:36 < datruth> hrmm
09:37 < datruth> and if I just want to remove a cert completely i'd have to revoke it?
09:37 < EugeneKay> Correct. And do crl checking
09:37 < gladiatr> revoke it and make sure an up-to-date crl is available for your openvpn server instance
09:39 < datruth> Hrmm so that brings me to another question everytime you revoke a cert it creates a new crl.pem?
09:39 -!- thumper__ [c39e5f63@gateway/web/freenode/ip.195.158.95.99] has joined #openvpn
09:40 < thumper__> Hey everyone. I installed openvpn-as on my ubuntu virtual machine. Is it possible to connect to it using Windows7 default tools? I have been experimenting with settings for a long time and I cannot manage to connect to it. Any ideas?
09:41 < EugeneKay> #openvpn-as
09:41 < thumper__> Ok
09:42 < gladiatr> datruth, how are you managing your certificates?
09:42 < datruth> I have a link setup for the keys directory so hopefully that will be enough. If I have no certificates to revoke do I just create an empty crl.pem file?
09:43 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
09:43 < datruth> gladiatr: I go into easy-rsa and use the ./build-key-pk* to create them they are put in the keys directory on the server
09:44 < thumper__> I will try installing openvpn. Is it compatible with Win7 networking tools?
09:44 < gladiatr> datruth, hrm... ok.  Not sure how easy-rsa 1 does it.  You can verify by checking your index file (in your keys dir) to see if the cert is marked as revoked.  Then you can look at the contents of your crl.pem file to see if the revoked cert's index is listed
09:45 < gladiatr> openssl crl -in path/to/crl.pem -text -noout
09:45 < datruth> gladiatr: ahh okay but what if I have no certs to revoke atm how would I enable the crl check since the crl.pem file doesn't exist?
09:45 < gladiatr> sec
09:45 < datruth> k
09:45 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
09:46 < gladiatr> openssl ca -gencrl -keyfile [ca_key] -cert [ca_cert] -out crl.pem
09:47 -!- eliasson_ [~wizard@91.198.48.20] has quit [Ping timeout: 240 seconds]
09:47 -!- eliasson_ [~wizard@91.198.48.20] has joined #openvpn
09:48 < datruth> Hrmm okay thanks
09:48 < datruth> Thanks EugeneKay and gladiatr 
09:48 < gladiatr> np
09:49 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:49 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has quit [Ping timeout: 240 seconds]
09:49 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:50 < datruth> gladiatr: when doing that I get an ./demoCA/index.txt: No such file or directory error
09:54 < gladiatr> you have to source your vars file
09:55 < datruth> ahh
09:55 < gladiatr> or perhaps just include it on the command line: -config /path/to/easyrsa/openssl.conf
09:56 < datruth> now I get the following
09:56 < datruth> variable lookup failed for ca::default_ca
09:56 < datruth> 6816:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=ca name=default_ca
10:00 < datruth> I just created a dummy cert
10:00 < datruth> and revoked it
10:02 < hyper_ch> krzee: online?
10:02 < datruth> Ok now time to enable passwords on the cert
10:03 < xanthaos> I am going to run openvpn on Fedora 14 as a service (service openvpn start) or even chkconfig openvpn 3 4 5 on
10:03 < xanthaos> Where should I put the cert and key files?
10:03 < hyper_ch> krzee: we're all gonna die - https://research.microsoft.com/en-us/projects/cryptanalysis/aes.aspx
10:03 < xanthaos> I also want to allow for two users, one of which will have routing to the internal vlan, the other of which will be server-only.
10:03 <@vpnHelper> Title: Biclique cryptanalysis of the full AES - Microsoft Research (at research.microsoft.com)
10:04 < xanthaos> vlan=subnet in this case
10:04 <@vpnHelper> RSS Update - forum: Keep Users Connected At All Times <http://forums.openvpn.net/topic8659.html>
10:05 < datruth> EugeneKay: on the command to change the cert to have a password but I get the following error 6911:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:150: can I just delete the cert on the server and re-create it?
10:05 < gladiatr> datruth, you're getting that error because you didn't source your vars file
10:06 < datruth> Hrmm okay
10:06 < datruth> source ./vars must be done each time I perform a command?
10:07 < gladiatr> what shell are you using?
10:07 < context> figured out my problem
10:07 < context> had two places connecting with same key
10:07 -!- context [context@november.xen.prgmr.com] has left #openvpn []
10:07 < gladiatr> doh
10:07 < datruth> gladiatr: nah I did that and still the same my shell is sh
10:08 < gladiatr> what OS?, datruth 
10:08 < datruth> sorry no its bash
10:08 < gladiatr> k
10:08 < datruth> and I use Ubuntu
10:08 < xanthaos> Final consideration is that I don't want to have multiple openvpn daemons running, just have users on the single daemon, different permissions based on certificate.
10:08 < gladiatr> it's: # . vars
10:08 < datruth> same error
10:09 < gladiatr> datruth, have you configured your vars file?  The error  "lookup failed for ca::default_ca" indicates a missing variable definition 
10:09 < datruth> hrmm
10:10 < datruth> yes I configured it it has my default country state etc
10:10 < gladiatr> and you're running these commands from the root of your easy-rsa installation?
10:11 < datruth> yup
10:11 < xanthaos> I see something in the .conf file that might be relevant to the @vpnHelper above, which mentions disallowing users from disconnecting the clients. The .conf will look for a openvpn-shutdown script. Could such a script be used to check the permission level or group of the user, and disallow them the disconnect if they are not the right user or group, such as an administrator?
10:12 < gladiatr> xanthaos, all that's for is defining a script that runs when the vpn is being shutdown.  It doesn't prevent the shutdown from occuring
10:12 < xanthaos> ahhh.
10:13 < datruth> gladiatr: could I just delete the cert and re-create it?
10:13 < gladiatr> sure
10:13 < xanthaos> If it's running as a service, perhaps 'service' itself can be protected from non-elevated users. To do this, however, openvpn would have to be started and remain an elevated user, a massive security risk.
10:13 < datruth> gladiatr: this wouldn't cause an error or risk of some sort?
10:13 < gladiatr> xanthaos, openvpn has to run with privs that allow it access to the routing table anyway
10:14 < gladiatr> datruth, sorry man.  You're just trying to generate a crl, right?
10:15 < xanthaos> would these privs be enough to allow access to necessary commands if 'service' is restricted to administrative groups and root?
10:15 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has joined #openvpn
10:15 < xanthaos> Which means such commands must be initiated as an elevated user. What is the priv level of init?
10:15 < gladiatr> xanthaos, what OS are you running?
10:15 < xanthaos> Fedora 14
10:15 < xanthaos> Making guesses here.
10:16 < gladiatr> heh.  ok.  you said "service" and I thought you were talking about windows
10:16 < xanthaos> The idea is to keep users from issuing 'service openvpn stop'
10:16 < xanthaos> such a command should result in a permissions error, except in that the group or user is high enough to issue such commands.
10:16 < Macphisto> Finally convinced my boss to let me test openvpn for our company! Just need to source out a box to use and get working.
10:16 < xanthaos> t
10:16 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
10:16 < gladiatr> If your user(s) have admin access to the machine, you can't prevent them from stopping openvpn.  There's probably some selinux voodoo you can put in place to effect this, but I wouldn't know where to start building those rules
10:17 < xanthaos> This would stop users from stopping the service, but would not block kill -KILL
10:17 < xanthaos> Or better yet...
10:17 < gladiatr> do your users really need root access?
10:18 < xanthaos> no
10:18 < xanthaos> never
10:18 < xanthaos> just me
10:18 < xanthaos> And one other, who uses sudo and su not root
10:18 < gladiatr> I don't see the problem then.
10:18 < xanthaos> I'm simply pondering the question as posed in the forum link above.
10:18 < datruth> gladiatr: no I got the crl.pem now I want to enable passwords for client certs
10:18 -!- thumper__ [c39e5f63@gateway/web/freenode/ip.195.158.95.99] has quit [Quit: Page closed]
10:18 < gladiatr> OpenVPN will drop privs if you want it to.
10:18 < gladiatr> datruth, ahh
10:19 < gladiatr> datruth, opessn rsa -des3 -in [old key file] -out [new key file]
10:19 < gladiatr> s/ssn/ssl
10:19 < xanthaos> lowering privs makes it a tad more secure. So long as it drops privs to its own user/group, that's fine.
10:19 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Remote host closed the connection]
10:19 < xanthaos> That way no other user has privs to openvpn commands.
10:20 < xanthaos> 'cept admins
10:20 < gladiatr> xanthaos, I'm not entirely sure what you mean by "openvpn commands"
10:20 < gladiatr> you can run it as root and no one will be able to kill it
10:20 < Macphisto> Anyone have any tips or know of any documentation to help with sourcing hardware to run openvpn for a small to medium sized company?
10:20 < gladiatr> running it as non-root just gives an added layer of protection if someone should find an ovpn exploit
10:20 < gladiatr> Macphisto, how many users?
10:21 < datruth> gladiatr: what if my cert is a .p12?
10:21 < xanthaos> openvpn can be started or stopped from the command line, client or server. Yes, run as root, but then openvpn has root privs, and if compromised, the compromised openvpn has root capabilities.
10:21 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 276 seconds]
10:21 < xanthaos> However slight the chance, it is never impossible.
10:21 < Macphisto> Company wide, about 130.  That would be using the VPN on a regular basis, I'd be willing to bet only 50.
10:21 < gladiatr> xanthaos, lol.  right.  that has nothing to do with your legitimate users though
10:21 < gladiatr> datruth, hrm... good question.  I don't use .p12 containers... let's ask google
10:22 < gladiatr> check this out: http://tinyurl.com/435y89v
10:22 <@vpnHelper> Title: How To change the password on a pks12 (.p12) certificate using openssl - Powered by Kayako SupportSuite Help Desk Software (at tinyurl.com)
10:22 < datruth> thx
10:22 < xanthaos> openvpn should not run as root, even as a daemon through 'service'. however, it should (similar to Apache and others) have it's own uid/gid so that other users who are not part of that group cannot mess with it.
10:23 < gladiatr> xanthaos, I fear you are preaching to the choir
10:23 < datruth> xanthaos: can't you run it as user nobody?
10:23 < gladiatr> is there a question in there somewhere?
10:23 < xanthaos> Not for me, in the forum as presented in a link by vpnHelper.
10:24 < xanthaos> My question is far more idiotic and involves multi-user/multi-config and where to put the certs/keys.
10:24 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
10:25 < xanthaos> I am going to run as a service and have currently two valid users. One must have routing to the server's native vlan and the server itself, and the other should only have the server with no sight of the internal vlan. Both configs through one daemon.
10:25 < xanthaos> One port.
10:25 < gladiatr> ahh... didn't catch that link
10:25 < xanthaos> <@vpnHelper> RSS Update - forum: Keep Users Connected At All Times <http://forums.openvpn.net/topic8659.html>
10:25 <@vpnHelper> Title: OpenVPN Support Forum Keep Users Connected At All Times : Configuration (at forums.openvpn.net)
10:26 < gladiatr> hrm... with two users, I would suggest seeing up the ccd directory to provide static addresses to your two users.  Then just have static entries in your iptables rule set that enforce your policy
10:27 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
10:27 < xanthaos> Should only one of these exist in the forwarding chain?
10:27 < xanthaos> Or none in the forwarding chain, only the interface?
10:27 < xanthaos> (which is horribly insecure)
10:28 < xanthaos> Just to give an overview of my iptables, everything internal on the vlan is matched in the tables by IP and MAC. on the same line. Must match both for -j ALLOW
10:28 < xanthaos> Can't do this from a vpn user.
10:28 < gladiatr> Your forwarding chain will need to be exclusive.  Add whaterver IP address(es) you want.  You can have an inclusive input chain or you can make it exclusive... the choice is yours
10:28 < xanthaos> IP, yes. MAC, can't be done.
10:29 < Bushmills> xanthaos: apache is started as root and drop privilieges by changing to another user. openvpn can do the same
10:29 < xanthaos> As the list of users is likely to grow, I may create a custom chain, and reference that chain as -j NEWCHAIN in the forwarding section.
10:29 < Macphisto> gladiatr: for upwards of 50 people, if even that, am I looking at something beyond a linux box with decent processing power and about as much memory as I can cram into it?  Or would I have to look at more specialized hardware?
10:30 < xanthaos> I can default drop and maintain the list in a more orderly fashion.
10:30 < gladiatr> xanthaos, sure.  And then you can parse the subject line of the inbound client certificate and make modifications to your chain accordingly.
10:31 < xanthaos> hmmm, didn't know that iptables was capable of that. Is iptables ALG?
10:31 < gladiatr> ALG?
10:31 < xanthaos> application layer gateway
10:31 < gladiatr> no
10:31 < xanthaos> didn't think so
10:31 < xanthaos> SPI is what I thought
10:32 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has joined #openvpn
10:32 < xanthaos> So parsing of the cert would have to be scripted and the corresponding chain mod made from the script, yes?
10:33 < gladiatr> xanthaos, exactly
10:33 < gladiatr> you'll also need to be sure to setup sudo rules for your openvpn users.
10:33 < gladiatr> er
10:33 < gladiatr> openvpn user
10:33 < gladiatr> (the unpriv'd uid for the server proc)
10:35 < xanthaos> Kewl, this is something I will certainly have to examine should the list of users grow. For now though, I am way ahead of myself. I still don't know where to put the keys and certs so they can connect. The man refers to ccd's as being the common name of the client cert. Should I create a ccd for each of the valid certs and place the appropriate certs and keys in there?
10:35 < gladiatr> they will need to go on the client system 
10:35 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14796> || Inactivity Disconnect <http://forums.openvpn.net/topic8655.html#p14795>
10:35 < gladiatr> yeah.  the ccd location can be wherever you want it; as long as it is accessible by the uid the openvpn proc is running as
10:36 < xanthaos> So I don't even need the user's client cert at all? The fact that it is signed by my ca will be enough?
10:36 < gladiatr> correct
10:36 < EugeneKay> That's how PKI works
10:36 < xanthaos> Now, does the Common Name and the cert's file name need to match? If not, do I name the ccd as the Common Name?
10:36 < gladiatr> the ccd is for identifying the unique directives to use for a particular certificate's subject
10:37 < gladiatr> no
10:37 < gladiatr> only the cn
10:38 < xanthaos> okay, so if certificate client1.crt has a common name of "Joe Bates" then I would create /etc/openvpn/Joe Bates
10:38 < xanthaos> ?
10:38 < gladiatr> yar
10:38 < EugeneKay> I would hope that you would use single-word(non-spaced) lower-case strings for your CN, but yes, that's what you'd do.
10:39 < EugeneKay> And you should do it as /etc/openvpn/ccd/Joe Bates, with the ccd directive set to /etc/openvpn/ccd/
10:39 < xanthaos> And in this directory I would create a script that contained the correct route, iroute, and push commands, or no?
10:40 < EugeneKay> The file is named "Joe Bates", and it is interpeted as an openvpn config file
10:40 <@vpnHelper> RSS Update - forum: Authenticating to AD - auth-user-pass-verify not running <http://forums.openvpn.net/topic8579.html#p14797>
10:40 < EugeneKay> This file goes within the CCD directory
10:41 < xanthaos> therefore using the same flags as the openvpn file.
10:41 < EugeneKay> Directives, not flags, but yes.
10:43 < xanthaos> Now, when users connect to the openvpn server, it does not give them access to running services, such as ssh, samba, etc, right?
10:43 < xanthaos> I will have to configure user access to these services?
10:43 < xanthaos> in the services themselves?
10:43 < EugeneKay> They can access whatever the firewall and the routing allows them to
10:43 < gladiatr> xanthaos, that depends on how the firewall on your gateway is configured
10:43 < gladiatr> ^^ ^^
10:44 < EugeneKay> Your best bet is to deny everything by firewall, and then add holes in it and routes to networks piece by piece.
10:44 < EugeneKay> It really helps if you diagram everything so you know what's where.
10:44 < xanthaos> Yes but openvpn is not a ssh or samba or other method of direct access to the files on the server which is running openvpn...
10:44 < xanthaos> openvpn is not a door into the OS, rather a node to which users connect and make use of available services.
10:44 < EugeneKay> It's simply a virtual networking setup
10:45 < EugeneKay> Whether SSH listens on the openvpn interfaces is up to SSH
10:45 < xanthaos> and the same with samba
10:45 < datruth> Darn it I have the password on the .p12 but in windows xp on the openvpn gui it complains when trying to change the password no OPENSSL_Applink anyone know of this error?
10:45 < EugeneKay> But relying on a service to listen/not listen as your method of security is daft. Use a proper firewall 
10:45 <@vpnHelper> RSS Update - forum: Keep Users Connected At All Times <http://forums.openvpn.net/topic8659.html#p14798>
10:46 < xanthaos> The current setup has one server, it runs the ssh, samba, and now the openvpn. It also only has one nic
10:46 < xanthaos> Will I need two nics in order for them to access other systems within the vlan or will this server's route handle that through the same interface?
10:46 < gladiatr> xanthaos, when you're running openvpn, you can think of your tap interface as a second NIC when it comes to your firewall
10:47 < xanthaos> I configured a tun, should I use a tap?
10:47 < EugeneKay> "tap has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
10:47 < gladiatr> no
10:47 < gladiatr> EugeneKay, LMAO
10:47 < datruth> EugeneKay: hahahahaha
10:47 < gladiatr> EugeneKay, my cat needs a good raping every once in a while
10:47 < xanthaos> I think I'll spare my cat that horror
10:47 < EugeneKay> My /cancer alias comes in handy.
10:48 < EugeneKay> gladiatr - puss in heat?
10:48 < gladiatr> EugeneKay, you have no idea
10:48 < Macphisto> Nah, it just dresses slutty
10:48 < gladiatr> and they're both male and neutered... but still
10:48 < EugeneKay> Haha.
10:48 < EugeneKay> Stupid cats.
10:48 < EugeneKay> Though, my dog is gay.
10:49 < gladiatr> Sparky, don't be gay!
10:49 < xanthaos> Since the other services reside on the same server, the only config in the router will be an inter-network route to allow other systems to send data back to the server since it will be using the non-network IP's.
10:49 < xanthaos> ?
10:50 < xanthaos> Or as my router calls it "Multi-LAN Homing" but same thing.
10:50 < EugeneKay> !tunortap
10:50 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
10:50 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
10:50 < datruth> I guess the openvpn gui can't change cert passwords 
10:50 < EugeneKay> Damnit, where's the link I want
10:50 < EugeneKay> !factoids
10:50 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:51 < datruth> EugeneKay: what program are you using? 
10:51 < datruth> XCA is it?
10:51 < EugeneKay> Aye
10:51 < datruth> EugeneKay: do you think it will let me change .p12 password?
10:52 < ecrist> no
10:52 < EugeneKay> You will need to import the p12, then export the key+cert combo as a .p12
10:52 < ecrist> the openvpn gui doesn't handle password changes at all
10:52 < xanthaos> So the ca and server certs and keys go in /etc/openvpn and create ccd/cn/ directories. Now if the client is Windows, will the ifconfig-push still work?
10:53 < ecrist> yes
10:53 < gladiatr> datruth, I know for certain that it can change rsa pem encoded key passphrases.  I would imagine the .p12 business will arrive at some point, but I think that functionality is pretty new
10:53 < EugeneKay> xanthaos - ccd/cn is a file, not a directory.
10:53 < datruth> gladiatr: I get an error no OPENSSL_Applink
10:54 < gladiatr> from windows?
10:55 < gladiatr> Yeah.  It looks like that's the vagueness that is output when trying to do that operation on a p12 package
10:55 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has left #openvpn ["Leaving"]
10:55 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:55 < xanthaos> What is the format on the fixed-IP push? I see 10.8.1.1 10.8.1.2
10:55 < xanthaos> Is it serverIP clientFixedIP?
10:55 < ecrist> s/1/5/ and s/2/6/
10:56 < ecrist> client endpoing server endpoint
10:56 < ecrist> in /30
10:56 < ecrist> !/30
10:56 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
10:57 < datruth> gladiatr: yeah in windows
10:58 < gladiatr> datruth, yup.  think you're going to get no love from the openvpn-gui when it comes to changing passphrases on a .p12 for the time being.
10:58 < xanthaos> So when I define my user pool I need the /30 CIDR or the corresponding netmask?
10:58 < datruth> gladiatr: any work around? I'm trying XCA looks abit complex
11:00 < xanthaos> Separating users into different pools could be useful. How do I class users and then further define the individual user to assign a fixed IP from that user's appropriate class?
11:00 < gladiatr> not from me.  I haven't had a reason to switch to .p12, so I'm not really up on what goes into managing them
11:01 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:02 < datruth> ahh gotcha okie doke thx all
11:02 < gladiatr> good luck man
11:04 < datruth> Yup I hope I can find a workaround otherwise I may not get to use this for everyone :(
11:04 < gladiatr> datruth, out of curiosity, why are you using .p12 rather than a cert/key pem file pair?
11:06 < datruth> Thats the setup we currently have using .p12 certs
11:07 < xanthaos> I am seeing that you create one address pool, 10.8.0.0 255.255.255.0
11:07 < xanthaos> Then you add routes for others like 10.8.1.0 255.255.255.0
11:08 < xanthaos> You then push the fixed IP info with the amended subnet per the route.
11:09 < xanthaos> You said that the format for this ifconfig-push is client_endpoint server_endpoint I don't understand this. Is the server_endoint the address taken by the server? Doesn't the server take the first address of the pool, which is not in the subnet of the push?
11:09 -!- WebDawgII [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has joined #openvpn
11:10 < WebDawgII> ddwrt seems to work fine.
11:10 < xanthaos> Or is server_endpoint the address you want your user to have?
11:10 < defswork> xanthaos, net30 no - server has an IP per client
11:11 < xanthaos> this I do not understand. 
11:11 < xanthaos> This IP is not consistent with the server's actual IP I assume
11:12 < defswork> no - its part of your pool in a /30 subnet
11:12 < defswork> if you are using net30 setup....
11:12 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656.html#p14799>
11:12 < xanthaos> ahhhhh so .1 or .5 would be the server address?
11:13 < xanthaos> Therefore the client_endpoint in the ifconfig-push directive should specify .6 as the static address?
11:13 < defswork> xanthaos, if you pool is 10.8.0.0 then 0 is broadcast 1 is server, 2 is client 3 is broadcast, next subset is 4, 5 server, 6 client, 7 etc...
11:14 < xanthaos> If they are dynamically assigned right?
11:14 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Take my advice. I don't use it anyway]
11:14 < defswork> depends
11:14 < defswork> you can assign them your self 
11:14 < xanthaos> If they are windows clients doesn't the /30 apply?
11:14 -!- WebDawgII [~webdawg@c-68-52-46-192.hsd1.ky.comcast.net] has quit [Ping timeout: 260 seconds]
11:14 < defswork> openvpn can assign them and reassign or you can use ipp file and let openvpn assign and keep static
11:16 < defswork> xanthaos, what are you trying to do ?
11:16 < defswork> allocate different security rights to clients ?
11:17 < xanthaos> I will have multiple users, currently two or three. One must have access to ssh, samba, and the attached internal subnet. One must have only access to the subnet with no ssh or samba access, and one must have only samba access with no internal subnet access.
11:17 < defswork> I'd just split my pool up into sub pools and allocate ip addresses myself when creating a new client cert etc.. the ip address would be in whatever access right pool was needed
11:18 < defswork> and add firewall rules to suit
11:18 < xanthaos> But I need my users to have fixed IP's
11:18 < defswork> thats no problem - just create a ccd file for each when you add them with your allocated ip
11:18 < xanthaos> That's where it gets crazy
11:18 < defswork> In my setup I have dynamic IP addresses that update DNS upon connnect and I have provision for dynamic firewall rules
11:19 < defswork> so when client xx12345 connects, it gets a dynamic IP, but the trigger that updates dns also adds the specific firewall rules for that client and it's current IP address
11:19 < defswork> it's all just a bunch of shell scripts
11:20 < xanthaos> My pool, for example, is 10.8.0.0 I want my samba only user to have address 10.8.1.?, my all-perms user to have 10.8.2.?, and subnet only to have 10.8.3.? and these are Windows clients.
11:20 < defswork> so ?
11:20 < defswork> just do it
11:20 -!- dazo_afk is now known as dazo
11:21 < xanthaos> I am trying to figure out the client_endpoint server_endpoint of the ifconfig-push directive
11:21 < defswork> you can manually maintain the ipp file btw
11:22 -!- jquiterio [~jquiterio@196.216.48.99] has joined #openvpn
11:22 < jquiterio> HI!
11:23 < jquiterio> I have this scenario..
11:23 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has quit [Ping timeout: 240 seconds]
11:23 < xanthaos> According to gladiatr windows clients must be allocated differently, into /30 subnets. This would mean that the server_endpoint would be .1, .5, .9, etc. and the clients would be .2, .6, .10 and so on
11:23 < xanthaos> This presents two problems
11:23 < jquiterio> client-laptop <----wifi----> DD-WRT Linksys <-------openvpn ---------> captiveportal_server
11:24 < jquiterio> I want to control client-laptop via MAC_Address
11:24 < jquiterio> I can I do ?...
11:24 < defswork> xanthaos,  --ifconfig-pool-persist file - manually put your IP allocations in there 
11:25 < jquiterio> I was try all thinks to do... but I can't
11:25 < jquiterio> :(
11:25 < xanthaos> First is the way to write the ifconfig-push and the ensuing available client limit (would have to use multiple subnets for this) and the ability for users of the same class to inter-network. If I have 10.8.1.2 and .6, they are in technically different subnets and I would have to establish a route for them to communicate, yes?
11:26 < defswork> no
11:26 < xanthaos> ?
11:26 < defswork> you can tell openvpn to allow or not client to client talk
11:26 < defswork>     --client-to-client
11:27 < xanthaos> client-to-client talk allows inter-client data sharing regardless of subnet?
11:27 < defswork> each client will have a route to the ENTIRE subnet defined - not their mini subnet
11:27 < xanthaos> Okay, so anything 10.8.1.0/24?
11:27 < xanthaos> If I defined my pool as /24?
11:27 < defswork> I got to go - sorry ;)
11:28 < jquiterio> :(
11:28 < xanthaos> Okay, thanks though for all this, a lot to think about!
11:28 < defswork> you're over thinking about it
11:28 < jquiterio> somebody can help me ?!!!
11:28 < defswork> get on and do it - see whats what
11:29 < xanthaos> I will also have to review the format for the pool-persist file and see if this might be the better option; letting the pool dynamically manage clients and lock them in in the file.
11:29 < defswork> xanthaos, let openvpn allocate a client
11:29 < defswork> then you will see the format ;)
11:29 < xanthaos> exactly. Is the persist file cleaned or entries deleted periodically though?
11:30 < xanthaos> Whereas forcing an IP in a config  would be forever static?
11:31 < xanthaos> I just want to know that all the work is good and users won't be fighting against inabilities to get to servers because of a bad address... Me having a dynamic IP is gonnna be bad enough.
11:32 < xanthaos> I got DynDNS but that isn't foolproof. I rarely ever jump IP's but when I do it's still likely to cause a timeout. Or can I have the server send a keepalive and the client update the IP on their end?
11:38 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:40 < Bushmills> xanthaos: your problem with dyndns ist probably a TTL of 300 sec. only way to avoid that is running your own nameserver, with shorter TTLs
11:42 < Bushmills> clients can update records on that nameserver. so can server.
11:42 < Bushmills> server makes more sense, i think
11:42 < xanthaos> running my own nameserver would be a nightmare.
11:43 < Bushmills> well, if using dyndns is less of a nightmare, so be it.
11:44 < xanthaos> no more often than I rotate it's not completely worth it at the moment. dyndns is no perfect solution, but it is a solution for the moment. I haven't rotated in over two months, and then only due to a reboot of the cable modem. those are good numbers.
11:45 < xanthaos> It gets more frequent then nameserver it is...
11:45 < krzee> hyper_ch, thanks for the links
11:45 < Bushmills> then we can consider your issue, whetever it was, solved?
11:49 < xanthaos> yes, I will begin working with the ccd's and get this think up and going. Still confused about the /30 thing but I assume that will be revealed as users start to connect?
11:51 < Bushmills> !topology
11:51 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
11:59 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:00 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:05 < xanthaos> Thank you all for the suggestions. I will be looking into all of this and hope to be up and going asap. Now the fun of finding a decent openssl cert/key generator for Windows. easy-rsa doesn't work without ungodly work. Need something my less tech-savvy users can use for cert/key gens. This way I'm not finding ways to hand out keys securely.
12:06 < xanthaos> They gen on their side, send a csr, I sign and return the cert, and we're in business.
12:08 -!- jquiterio_ [~jquiterio@41.218.103.190] has joined #openvpn
12:09 -!- xanthaos [~xanthaos@71-92-2-230.dhcp.stls.mo.charter.com] has quit []
12:11 -!- Riz [~riz@syn.theintertubes.ca] has quit [Quit: leaving]
12:12 -!- jquiterio [~jquiterio@196.216.48.99] has quit [Ping timeout: 260 seconds]
12:15 < EugeneKay> XCA.
12:23 < Bushmills> your users aren't supposed to generate keys and sign them. 
12:24 < Bushmills> they are supposed to receive and use them
12:24 < EugeneKay> Read it again.
12:24 < EugeneKay> USer generates a Key and a Request, the CA signes the Request and returns a Certificate.
12:25 < EugeneKay> If you disagree with the system, I suggest you take it up with RSA.
12:27 < Bushmills> we may have to distinguish between users and administrators
12:27 < Bushmills> a user is, ideally, not even able to install openvpn
12:30 <@dazo> Bushmills: Technically speaking, EugeneKay is correct ... however, many admins divert from this practice where they create everything and ships it to the user
12:30 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
12:30 < EugeneKay> "EugeneKay is right because EugeneKay is always right."
12:30 <@dazo> and if EugeneKay is wrong, he refines that as the right way? ;-)
12:30 <@dazo> *redefines
12:30 < Bushmills> then they'd also need to read "how to install and set up openvpn without admin privileges"
12:31 < EugeneKay> I am in the habit of speaking authoritatively only when I am reasonably sure of my correctness.
12:31 <@dazo> :)
12:31 < EugeneKay> Otherwise I use "believe", "think", or "try"
12:31 < krzee> !blame
12:31 < Bushmills> that will be exceedingly enjoyable for those non-techy users
12:31 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault, or (#2) According to krzee, it's always dazo's fault
12:32 <@dazo> !learn blame as and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
12:32 <@vpnHelper> Joo got it.
12:32 < EugeneKay> I blame Wes.
12:33 <@dazo> :)
12:39 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:39 -!- dazo is now known as dazo_afk
12:42 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
12:48 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:54 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:57 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
12:58 -!- jquiterio_ [~jquiterio@41.218.103.190] has quit [Read error: Connection reset by peer]
12:58 -!- jquiterio_ [~jquiterio@196.216.48.99] has joined #openvpn
13:00 -!- jquiterio__ [~jquiterio@41.218.103.190] has joined #openvpn
13:02 -!- jquiterio [~jquiterio@196.216.48.99] has joined #openvpn
13:03 -!- jquiterio__ [~jquiterio@41.218.103.190] has quit [Read error: No route to host]
13:03 -!- jquiterio__ [~jquiterio@41.218.103.190] has joined #openvpn
13:03 -!- jquiterio_ [~jquiterio@196.216.48.99] has quit [Ping timeout: 246 seconds]
13:04 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
13:05 -!- jquiterio_ [~jquiterio@196.216.48.99] has joined #openvpn
13:06 -!- jquiterio [~jquiterio@196.216.48.99] has quit [Ping timeout: 240 seconds]
13:08 -!- jquiterio__ [~jquiterio@41.218.103.190] has quit [Read error: Connection reset by peer]
13:10 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
13:10 -!- jquiterio_ [~jquiterio@196.216.48.99] has quit [Ping timeout: 258 seconds]
13:10 < trumee> hi all
13:12 < trumee> I have a working openvpn (tap) between two machines. I only want to secure information over udp 4569 (asterisk voip) between the two machines and have everything else go over unsecure link. is that possible?
13:17 < Bushmills> trumee: yes.  where specifying server in clients, give the openvpn subnet address
13:17 < Bushmills> don't ...
13:17 < Bushmills> !redirect
13:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
13:21 < trumee> Bushmills: my openvpn server is installed on a openwrt router and i use it with redirect-gateway. Can i disable it on the client side?
13:21 < trumee> Bushmills:  i dont want to disable --redirect-gateway on the openvpn server.
13:23 < Bushmills> trumee: yes, you can, by instructing client to not pull any routes. that means that client must setup the actually wanted routed itself
13:24 < trumee> Bushmills: right, what is the keyword at the client side for not pulling any route?
13:24 < Bushmills> --route-nopull it should be
13:25 < trumee> Bushmills: thanks. and i will have to setup a route using iptables?
13:25 < Bushmills> iptables isn't for setting routes
13:25 < trumee> Bushmills: ah, sorry using the route command
13:25 < Bushmills> yes
13:26 < trumee> Bushmills: thanks
13:36 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
13:39 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
13:41 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 250 seconds]
13:43 < trumee> Bushmills: without route-nopull, i can see the route for everthing going though my machine wasnt added. Also, i can ping to 172.16.1.100 which is my voip server. Do i still need to add a route if i want to connect to my voip server?
13:44 < trumee> Bushmills: In my voipclient i will specify the server to be 172.16.1.100 port 4569. I suppose this will automatically travel over vpn?
13:44 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
13:44 < Bushmills> depends. probably not, if your default route isn't replaced or superceded
13:45 < Bushmills> as i have no idea what interface has 172.16.1.100 in your network, it is impossible for me to answer that
13:46 < trumee> Bushmills: cheers
13:47 < Bushmills> it's not machines having ip addresses. it's interfaces.  machines tend to have several interfaces.
13:50 <@vpnHelper> RSS Update - forum: openvpn management "kill" command not working <http://forums.openvpn.net/topic8653.html#p14800>
13:53 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Ping timeout: 250 seconds]
13:53 -!- qknight [~joachim@88.198.52.213] has quit [Ping timeout: 250 seconds]
13:54 -!- qknight [~joachim@88.198.52.213] has joined #openvpn
13:54 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:55 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Ping timeout: 260 seconds]
14:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
14:05 -!- zoidberg- [~zoidberg@li102-250.members.linode.com] has joined #openvpn
14:06 < zoidberg-> Hey guys, is it possible to only make services on a host (such as apache, sshd, ftp, irc, etc) only available to users connected over the VPN?  I guess i just switch them to only listen on the vpn servers IP address right?
14:06 < krzee> zoidberg-, your answer to your question was right
14:07 < zoidberg-> As I typed it out it came to me :)
14:07 < zoidberg-> Awesome, I love OpenVPN :D
14:08 -!- karl__ [4b5e5768@gateway/web/freenode/ip.75.94.87.104] has joined #openvpn
14:08 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
14:08 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
14:09 < karl__> Does OpenVPN have a feature to cause inactive accounts to expire after a certain amount of days?
14:09 < EugeneKay> No.
14:10 < EugeneKay> You'll need to do that with some  sort of script.
14:10 < karl__> thank you for the prompt response, EugeneKay 
14:14 < hyper_ch> krzee: I'll send you the bill then ;)
14:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:17 < krzee> just make it out to krzee
14:18 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has joined #openvpn
14:18 < krzee> email it to krzee@localhost
14:26  * ecrist imagines zoidberg going 'whewhewwhewwhew' across the channel (http://www.youtube.com/watch?v=P_WI0VI7aIw)
14:26 <@vpnHelper> Title: Dr. Zoidberg - Whoop Whoop Whoop - YouTube (at www.youtube.com)
14:26 < ecrist> !learn scared as http://www.youtube.com/watch?v=P_WI0VI7aIw
14:26 <@vpnHelper> Joo got it.
14:26 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
14:37 -!- solarce [solarce@elle.fallingsnow.net] has joined #openvpn
14:39 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:39 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:59 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
15:02 <@vpnHelper> RSS Update - forum: help creating a custom install dialer <http://forums.openvpn.net/topic8660.html>
15:08 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:08 -!- mode/#openvpn [+v s7r] by ChanServ
15:31 < Ragnar> !help
15:31 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
15:31 < Ragnar> !help migrate
15:31 <@vpnHelper> Error: There is no command "migrate".
15:31 < Ragnar> !welcome
15:31 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:33 -!- zzattack [~zzattack@237-89-ftth.onsneteindhoven.nl] has quit [Ping timeout: 252 seconds]
15:55 < ecrist> raar
15:55 <@vpnHelper> RSS Update - forum: Linux Command Line Client Issues <http://forums.openvpn.net/topic8661.html>
15:55  * ecrist poofs
16:00 -!- karl__ [4b5e5768@gateway/web/freenode/ip.75.94.87.104] has quit [Ping timeout: 252 seconds]
16:09 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
16:14 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
16:15 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:22 -!- nixusr_ [~nixusr@unaffiliated/nixusr] has joined #openvpn
16:25 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 258 seconds]
16:28 -!- nixusr_ is now known as nixusr
16:32 <@vpnHelper> RSS Update - forum: MAC colision problem <http://forums.openvpn.net/topic8656-15.html#p14803>
16:44 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 258 seconds]
16:46 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:47 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
16:50 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
16:50 <@vpnHelper> RSS Update - forum: Linux Command Line Client Issues <http://forums.openvpn.net/topic8661.html#p14804>
17:14 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
17:14 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
17:14 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:30 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
17:30 -!- pr0z0id [~pr0zoid@184.95.44.33] has quit [Ping timeout: 258 seconds]
17:37 -!- newmember [~chatzilla@66.185.87.94] has joined #openvpn
17:41 -!- riz [~riz@syn.theintertubes.ca] has joined #openvpn
17:58 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
17:58 -!- rich_ [~rsb@216.38.140.199] has joined #openvpn
17:58 < deever> hi
17:58 < rich_> hi deever
17:58 < deever> rich_: hi
18:00 < deever> under osx, both with tunnelblick or macports' openvpn package, i'm getting "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)" and "TLS Error: TLS handshake failed" errors
18:01 < deever> however, there can't actually be an SSL issue since the same config and cert/key work under linux
18:01 < deever> any hints?
18:07 < Olipro> wrong CA cert?
18:07 < Olipro> get the md5sum of the CA cert on the server
18:07 < Olipro> and the client
18:10 < rich_> I have several subnets configured for clients, each client getting an IP from /etc/openvpn/ccd/clientname.  Only one subnet is not working.  Openvpn just won't forward packets for it.  Any ideas on debugging this?  
18:11 < reiffert> deever: show us the complete logfile of the client.
18:11 < rich_> it's not iptables, and openvpn is forwarding for all other clients, and clients on the non-working subnet can ping the vpn server ip on the net it serves as a gateway for.
18:11 < reiffert> rich_: got NAT configured for those subnets?
18:12 < reiffert> rich_: show us the complete logfile of a client on the non-working subnet, the routing table of that client before and after connecting to openvpn, the server and client config and the ccd entry for those clients.
18:13 < reiffert> rich_: iptables might be required afterwards, but start with the former.
18:13 < rich_> reiffert : o.k. will pastebin just a sec
18:14 < reiffert> 01:11 < reiffert> rich_: got NAT configured for those subnets?
18:14 <@vpnHelper> RSS Update - forum: Openvpn connects but no traffic <http://forums.openvpn.net/topic8662.html>
18:14 < reiffert> y/n?
18:16 < rich_> reiffert: there is nat to all clients on the net inside the firewall the vpn is behind, but the vpn does no nat for vpn clients on their subnets
18:19 < reiffert> k
18:20 < reiffert> deever: just an additional hint: when openvpn thinks that there is an SSL issue, then there is one. Might be "Can't find a certificate on the local filesystem".
18:20 < reiffert> deever: what we would prolly know if you'd give us the log.
18:23 < rich_> http://pastebin.com/TaduRKKf
18:24 -!- newmember_ [~chatzilla@static-66-11-81-77.ptr.terago.net] has joined #openvpn
18:25 < reiffert> missing: server config
18:25 < reiffert> missing: log.
18:25 < rich_> that's the client config.
18:25 < reiffert> missing: ccd entry
18:25 < rich_> it works if I change the ccd to another net for that client.
18:25 < reiffert> come one, my crystall ball is broken.
18:26 < reiffert> so pinging 10.1.1.1 doesnt work, right?
18:26 < rich_> no, but pinging 10.1.1.29 does
18:26 < reiffert> great. what's not working again please?
18:27 -!- newmember_ [~chatzilla@static-66-11-81-77.ptr.terago.net] has quit [Client Quit]
18:27 < rich_> connect to anything on the net the vpn is gatewaying to aside from the vpn server itself.
18:27 < rich_> I will gather the other data you asked for.
18:27 < reiffert> "on the net" is not 10.1.1.0/24?
18:28 -!- newmember [~chatzilla@66.185.87.94] has quit [Ping timeout: 250 seconds]
18:28 < reiffert> this client will send packets with destination 178.63.49.86 to its gateway 191.255.255.1. this is not what you want?
18:28 < rich_> yes, the net that the vpn is supposed to be providing that client with access to is the 10.1.1.0/24 net
18:29 < rich_> the 178.63.49.86 network is for the virtual machine host.
18:29 < rich_> this particular client is a virtual machine
18:29 < reiffert> complicated the sentences are with order of words you choose ;)
18:29 -!- Denial [~Denial@drgi.co.uk] has quit []
18:29 < rich_> let me gather some more info. 
18:30 < reiffert> 178.63.49.86 is my host btw.
18:30 < reiffert> just as an example taken for "the net"
18:30 < Olipro> mine is 127.0.0.1
18:30 < Olipro> I can connect to it from everywhere
18:31 < reiffert> mind you, I can connect to your host as well.
18:31 < rich_> sorry. reiffert, I was rushing to get you the info
18:31 < rich_> reiffert, you should be able to connect to the client.
18:31 < rich_> it's a virtual machine on the public internet.
18:31 < reiffert> rich_: sure. the client log will be the most important thing. the ccd entry the 2nd most.
18:32 -!- newmember [~chatzilla@static-66-11-81-77.ptr.terago.net] has joined #openvpn
18:32 < reiffert> rich_: server conf 3rd most
18:32 < reiffert> rich_: and to know exactly what the client *should* do and what it does not might be around 4th place.
18:34 -!- rich_ [~rsb@216.38.140.199] has quit [Excess Flood]
18:36 < reiffert> sigh
18:37 -!- rich_ [~rsb@216.38.140.199] has joined #openvpn
18:39 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
18:40 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
19:01 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
19:10 -!- newmember [~chatzilla@static-66-11-81-77.ptr.terago.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
19:18 -!- smerz [~smerz@smerz.demon.nl] has quit [Read error: Connection reset by peer]
19:28 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has quit [Ping timeout: 260 seconds]
19:39 < reiffert> !iroute
19:39 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
19:39 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
19:51 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Read error: Connection reset by peer]
19:56 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
19:57 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:01 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:03 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:17 < zoidberg-> Hey guys, I followed this tutorial : http://library.linode.com/networking/openvpn/ubuntu-10.10-maverick on setuting up openvpn - it works well.  I would like to learn about the security issues associated with openvpn and how i can lock it down, prevent dns leaks, etc.. where is a good place to start or a good document that covers any security issues commmon to this type of config?
20:17 <@vpnHelper> Title: Secure Communications with OpenVPN on Ubuntu 10.10 (Maverick) – Linode Library (at library.linode.com)
20:20 -!- Nappy [~nappy@pool-71-180-106-40.tampfl.fios.verizon.net] has quit [Quit: Leaving]
20:26 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
20:38 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:41 -!- Squidy_at_Home [~quassel@187.7.192.241] has joined #openvpn
20:54 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has quit [Read error: Connection reset by peer]
20:58 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has joined #openvpn
21:02 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
21:02 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
21:02 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:08 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:18 -!- zoidberg- [~zoidberg@li102-250.members.linode.com] has quit [Ping timeout: 252 seconds]
21:33 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has joined #openvpn
21:33 < DJHenjin> so im attempting to setup openvpn for access to my network from afar, but i am running into some difficulties
21:37 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 252 seconds]
21:38 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:38 < EugeneKay> I'm proud of you ?
21:40 < DJHenjin> my configuration is server 2008 with 2 gigabit nic's on a 192.168.0.0 network using a router for DHCP. 
21:41 < EugeneKay> !windows
21:41 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
21:45 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has quit [Read error: Connection reset by peer]
21:48 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has joined #openvpn
21:48 -!- halorgium [tim@titanium.spork.in] has joined #openvpn
21:49 < DJHenjin> i can ping 10.8.0.1 but not 192.168.0.1 or any of the other local addresses i am trying to access
21:49 < kenyon> !routing
21:50 < DJHenjin> also on the server i get 'need ipv6 code in mroute_extract_addr_from_packet'
21:53 < EugeneKay> That's because OpenVPN doesn't do IPv6 payloads sanely yet
21:53 < EugeneKay> There is some support in tun-ipv6, but not with the standard Windows-compatible /30 topology
21:54 < DJHenjin> i dont need ipv6 yet. just want to get it working on ipv4
21:54 < EugeneKay> TAP(preferably still running in routed mode) will pass IPv6, but you have to configure it yourself(or with a script)
21:54 < EugeneKay> The likely reason you are seeing those messages is because Windows loves to autoconfig IPv6 addresses.
21:54 < DJHenjin> using dev-tap eliminates that error but i still cannot ping 192.168.0.0's
21:54 < EugeneKay> That's because your routing is wrong.
21:54 < DJHenjin> also , im very very new to this stuff
21:55 < DJHenjin> in server config push route 192.168.0.0 255.255.255.0 ?
21:56 < EugeneKay> Is the server also working as the default gateway for the 192.168.0.x LAN?
21:56 < DJHenjin> no
21:56 < EugeneKay> That's why. There's no route back for the packets.
21:56 < EugeneKay> Theyre ending up at your default GW, and out to the internet.
21:56 -!- newmember [~chatzilla@50.99.28.232] has joined #openvpn
21:56 < DJHenjin> right?
21:56 < EugeneKay> They need to go back to the OpenVPN server.
21:57 -!- Husky [Smegma@unaffiliated/coil] has joined #openvpn
21:57 < Husky> !welcome
21:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:57 < EugeneKay> You'll need to setup a static route back to the OpenVPN subnet on your default gateway device, or use NAT/Masquerading for the openvpn subnet.
21:57 < Husky> !goal
21:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:58 < Husky> !howto
21:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:59 < DJHenjin> is there an easier way, like bridging the 2nd nic to the tap interface?
22:00 < kenyon> EugeneKay: what do you mean "TAP in routed mode"? like having tap0 on the server on a different subnet than eth1 (the LAN interface) on the server?
22:01 < EugeneKay> I mean using a routed topology with a tap device
22:04 < DJHenjin> first time i tried to set it up i absolutely butchered the config following instructions on the site and couldnt connect at all
22:08 < DJHenjin> so from what i gather, i need to brigde nic2 to the tap interface and set it up so that my existing router handles DHCP?
22:10 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Ping timeout: 258 seconds]
22:10 < EugeneKay> "Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
22:10 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
22:11 < EugeneKay> What you need to do is setup the routing such that traffic from the OpenVPN subnet can find it's way back via the OpenVPN Server, rather than going out to the internet
22:11 < DJHenjin> push "redirect-gateway def1 bypass-dhcp" < uncommented that and i can now ping
22:12 < DJHenjin> well i can ping the local IP of the machine openVPN is on
22:12 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has joined #openvpn
22:12 < EugeneKay> I can only help you theoretically, mind. Windows is a poor platform to run any service on, and we'd need !configs / !logs to do actual troubleshooting
22:12 < DJHenjin> ill pastebin my config of the server
22:12 < EugeneKay> Of course. The server has the proper route.
22:12 < EugeneKay> It never leaves the NIC
22:13 < DJHenjin> http://pastebin.com/GgG6F46Y
22:13 < EugeneKay> !configs
22:13 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
22:16 < DJHenjin> http://pastebin.com/r2Ry8F2m
22:21 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has quit [Ping timeout: 268 seconds]
22:21 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
22:24 < DJHenjin> server 2k8 and the most recent version of openvpn
22:26 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
22:29 < DJHenjin> so, what did i do wrong?
22:30 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:30 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:30 -!- qknight [~joachim@88.198.52.213] has quit [Ping timeout: 240 seconds]
22:35 < Husky> !pf
22:35 < Husky> !openvpn-pf
22:35 < Husky> !firewall
22:36 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
22:37 < EugeneKay> DJHenjin - you installed Windows :-p
22:38 < DJHenjin> *sigh* yeah i know :(
22:38 -!- qknight [~joachim@88.198.52.213] has joined #openvpn
22:38 < DJHenjin> is my config farucked?
22:40 < EugeneKay> Well, you're using 192.168.0.0, which makes me whinge
22:40 < DJHenjin> home router, anywhere i go other than here has 192.168.1.0
22:41 < DJHenjin> or if im connected through my phone like currently 209.blah.blah.blah
22:45 < DJHenjin> converting the entire network to 10.8.0.0 is possible, but would take several hours
22:47 < EugeneKay> 10.8.0.0 is also  poor network choice - it's well-abused
22:49 < DJHenjin> either way, converting the network would take far too long, and cause far too much downtime
22:51 <@vpnHelper> RSS Update - forum: OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html>
22:54 < DJHenjin> can it be made to work, or should i throw all hopes of remote access out the window
23:01 < DJHenjin> i could just use hamachi...
23:01 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
23:06 < EugeneKay> Sure. But I don't speak Windows :-p
23:08 < DJHenjin> REDACTED
23:09 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
23:09 < DJHenjin> would my config file work on ANY OS
23:19 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
23:19 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
23:19 -!- mode/#openvpn [+o raidz] by ChanServ
23:33 -!- Squidy_at_Home [~quassel@187.7.192.241] has quit [Ping timeout: 240 seconds]
23:48 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
23:52 -!- krzee [~k@c-98-207-46-162.hsd1.ca.comcast.net] has joined #openvpn
23:52 -!- krzee [~k@c-98-207-46-162.hsd1.ca.comcast.net] has quit [Changing host]
23:52 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
23:57 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
--- Day changed Thu Aug 18 2011
00:04 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:19 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:26 -!- Squidy_at_Home [~quassel@187.7.192.241] has joined #openvpn
00:27 -!- Squidy_at_Home [~quassel@187.7.192.241] has quit [Remote host closed the connection]
00:34 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
00:34 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
00:34 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
00:44 -!- newmember [~chatzilla@50.99.28.232] has quit [Quit: ChatZilla 0.9.87 [Firefox 5.0/20110615151330]]
00:52 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
00:52 -!- pacmanfan [~pacmanfan@74-84-99-162.client.mchsi.com] has quit [Quit: Leaving]
00:54 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
01:10 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html>
01:10 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has left #openvpn []
01:13 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
01:13 < grendal_prime> ok going crazy
01:15 < grendal_prime> got one vpn server set to 172.17.1.0  also have a physical interface on the 172.17.3.128 255.255.255.128 network..(we choped it up for optimization)  Im trying to push a route to the clients to connect to this 172 network...but they are just not gettin gther..I can ping it from the server.
01:15 <@vpnHelper> RSS Update - forum: Verifying openvpn download <http://forums.openvpn.net/topic8665.html>
01:17 < grendal_prime> im also using topology subnet.  Ive been told that i will have to add the gateway infomation in the route command...but...what??
01:17 < Bushmills> grendal_prime: make sure that client pulls routes (client or pull in config), and if those are windows clients, read ..
01:17 < Bushmills> !winroute
01:17 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file, or (#2) many users also report it helps to add route-delay to give the interface extra time to get up, or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access, or (#4) make sure you are running openvpn as admin, or (#5) http://openvpn.net/index.php
01:17 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
01:19 < grendal_prime> this is crazy
01:19 < EugeneKay> THIS IS #OPENVPN
01:19 < grendal_prime> and crazy
01:19 < grendal_prime> these at linux clients not windows
01:21 < EugeneKay> !configs
01:21 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
01:21 < EugeneKay> !logs
01:21 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
01:24 < grendal_prime> seems like i should be able to say...firs --route 10.10.0.0 255.255.255.0  (telling the vpnserver its ok to route to that network)...the push-route "network netmask"  telling the client..."here save my number so i can cal you again
01:25 < grendal_prime> that didnt come out right...im hella tired
01:25 < grendal_prime> night folks
01:29 < krzee> EugeneKay, you're a linux guy arent ya?
01:29 < EugeneKay> Aye
01:29 < EugeneKay> I use Windows 7 for my desktop/laptop, but linux for just about everything else
01:29 < krzee> got a nat issue i need to handle, can i bounce it off ya?
01:29 < EugeneKay> Sure
01:30 -!- grendal_prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 260 seconds]
01:30 < krzee> cool, 1sec taking the laptop outside for a smoke
01:32 < krzee> ok so
01:32 < krzee> im setting up routers in mass
01:32 < krzee> lil dlink routers... i automated the firmware building to include the certs and everything
01:33 < krzee> they will all run the same subnet, something very non-standard like 10.7.7.0/24
01:33 < krzee> but then the network devices plugged into it of course cannot access the vpn
01:33 < krzee> since no iroute, and that would be impossible since it is in mass and same subnet
01:34 < krzee> so i will need to NAT... but i need to do it on the client side...
01:34 < krzee> on the router itself
01:34 < EugeneKay> -j MASQUERADE should be able to do it
01:34 < krzee> all i know is how it would be done when doing the NAT on the server side
01:35 < krzee> orly?  i thought it would need to be something in PREROUTING
01:35 < krzee> instead of POSTROUTING like on server side
01:35 < EugeneKay> Nope, just POSTROUTING should be able to do it
01:35 < EugeneKay> iptables -A POSTRUTING -i eth0 -o tun0 -j MASQUERADE
01:35 < krzee> !linnat
01:35 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
01:35 < krzee> ahh
01:36 < EugeneKay> You don't even need to specify the -s,if you don't want to
01:36 < krzee> i see, all you had to change was the input / output devices
01:36 < krzee> sweet thanx, i wont get to test until morning since i have no access to wired internet until then
01:36 < EugeneKay> Yup.
01:37 < EugeneKay> It won't be much use to you for this, but a handy tip if you want to MASQUERADE out of a non-default IP is to use -j SNAT --to-source 1.2.3.4 instead
01:38 < krzee> (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>
01:38 < EugeneKay> I do this at home where I have two public IPs. The first is used for my fileserver's public-facing eth0, and the second is dedicated to NATing my LAN
01:38 < EugeneKay> oh derp
01:38 < EugeneKay> I didn't even read that :v
01:38 < krzee> i *think*  i got that from you orig ;]
01:38 < EugeneKay> Doubtful. I remember seening #3/#4 there from before I figured out that trick
01:39 < krzee> ahh hehe
01:39 < jeev> scumbag krzee, yell at everyone about factoids, then doesn't use factoid
01:39 < krzee> jeev, scroll up, i wasnt asking about that
01:39 < jeev> krzee
01:39 < krzee> but nice try
01:39 < jeev> you've got to admit
01:39 < EugeneKay> It's more of a lack of knowledge re:ipables
01:39 < jeev> that it was funny
01:39 < krzee> =]
01:39 < EugeneKay> Yeah, except you had it backwards. This was scumbag eugenekay
01:40 < krzee> just find someone to blame
01:40 < krzee> !blame
01:40 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault, or (#2) According to krzee, it's always dazo's fault, or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
01:44 < jeev> scumbag eyes, makes me wanna sleep.. go to bed and it keeps seeing things
01:44 < jeev> scumbag jeev, wastes time with scumbag steve references, doesn't go to sleep
01:44 < jeev> niht
01:44 < jeev> night
01:47  * EugeneKay blames Bushmills, thus completing the loop
01:48 < krzee> iptables -t nat -A POSTROUTING -i eth0 -o tun0 -j MASQUERADE
01:48 -!- dazo_afk is now known as dazo
01:48  * krzee saves that cmd for the morning
02:00 < reiffert> moin
02:02 < reiffert> krzee: I might be wrong, but -i on nat/POSTROUTING is not working.
02:02 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
02:03 < EugeneKay> Works fine for me. I'm not using a d-link tho
02:04 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has quit [Ping timeout: 250 seconds]
02:05 < reiffert> root@reifferscheid:~# iptables -t nat -I POSTROUTING -i vmnet8 -o vmnet1 -j MASQUERADE
02:05 < reiffert> iptables v1.4.8: Can't use -i with POSTROUTING
02:06 < EugeneKay> I stand corrected. It is in face using -s, not -i
02:06 < EugeneKay> fact*
02:06  * EugeneKay actually opened his iptables rules and looked
02:07 < EugeneKay> So long as he can programmaticaly specify the LAN subnet in the iptables rules, shouldn't be an issue
02:09 < Olipro> or perform filtering on packets so that ones on specific interfaces aren't allowed to be MASQUERADEed
02:10 < Olipro> i.e. iptables -A FORWARD ! -i vmnet8 -o vmnet1 -j DROP
02:12 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:13 < EugeneKay> Or both
02:28 < Mowee> Morning o/
02:29 < krzee> reiffert, thank you :)
02:29 <@vpnHelper> RSS Update - forum: Problem with easy-rsa and RANDFILE <http://forums.openvpn.net/topic8666.html>
02:35 -!- corretico_ [~luis@201.201.44.82] has quit [Ping timeout: 246 seconds]
02:40 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
02:52 <@vpnHelper> RSS Update - forum: Windows XP "route addition failed" u: non-admin, openvpn svc <http://forums.openvpn.net/topic8667.html>
02:55 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
02:56 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
02:59 < krzee> iptables -t nat -A POSTROUTING -s 10.7.69.0/24 -o tun0 -j MASQUERADE
02:59 < reiffert> !linnat
02:59 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
02:59 < krzee> 10.7.69.0/24 is the lan subnet behind the client, this will go in client side router
03:00 < krzee> thats how it differs from !linnat (which is for server-side)
03:00 < reiffert> #3 :p
03:01 < krzee> saying the above command wont be good?
03:01 < reiffert> depends on what you are trying to achieve.
03:02 < krzee> basically the nat-hack, but on the client router (which ovpn runs on)
03:02 < reiffert> iroute comes to mind
03:02 < krzee> so voip adapters will be able to connect to the darknet voip servers when plugged into the router
03:03 < krzee> nah, there will be many routers, all on the same subnet
03:03 < krzee> this is one of those times the nat-hack is needed
03:22 <@vpnHelper> RSS Update - forum: Openvpn connects but no traffic <http://forums.openvpn.net/topic8662.html#p14812> || Windows XP "route addition failed" u: non-admin, openvpn svc <http://forums.openvpn.net/topic8667.html#p14811>
03:28 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14813>
03:29 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
03:29 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
03:29 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
03:40 <@vpnHelper> RSS Update - forum: Problem with easy-rsa and RANDFILE <http://forums.openvpn.net/topic8666.html#p14815> || Verifying openvpn download <http://forums.openvpn.net/topic8665.html#p14814>
03:43 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
03:46 <@vpnHelper> RSS Update - forum: Windows XP "route addition failed" u: non-admin, openvpn svc <http://forums.openvpn.net/topic8667.html#p14816>
03:51 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has joined #openvpn
03:55 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
04:01 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
04:17 -!- enki [~enki@unaffiliated/enki] has left #openvpn []
04:28 <@vpnHelper> RSS Update - forum: Problem with easy-rsa and RANDFILE <http://forums.openvpn.net/topic8666.html#p14817>
04:53 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:53 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:53 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:06 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 240 seconds]
05:08 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
05:16 -!- nixusr_ [~nixusr@205.185.121.60] has joined #openvpn
05:16 -!- nixusr_ [~nixusr@205.185.121.60] has quit [Changing host]
05:16 -!- nixusr_ [~nixusr@unaffiliated/nixusr] has joined #openvpn
05:16 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14818>
05:16 -!- Novae [~Novae@unaffiliated/novae] has joined #openvpn
05:16 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
05:17 < Novae> This is without a doubt the wrong place to ask but i ran out of energy with google :P Does anyone have a BBC iplayer ip range/s? 
05:18 < hyper_ch> no
05:18 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 264 seconds]
05:18 < Bushmills> yes
05:18 < Bushmills> statistically, most likely
05:19 < Novae> ;-)
05:19 < krzee> i have no idea what they are
05:20 < Bushmills> maybe google is a better source of information after all :)
05:20  * Novae wishes he hadn't deleted the openvpn config file that has the routes in it :(
05:21 < Novae> yeah, and i'm sure i found them on google last time i had to do this but i can't for the life of me find them now to rebuild this vpn.
05:21 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14820> || Problem with easy-rsa and RANDFILE <http://forums.openvpn.net/topic8666.html#p14819>
05:26 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:26 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:33 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
05:40 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:44 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Ping timeout: 276 seconds]
05:45 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 264 seconds]
05:51 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14821>
06:07 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
06:14 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
06:21 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:21 -!- mode/#openvpn [+v s7r] by ChanServ
06:22 -!- Novae [~Novae@unaffiliated/novae] has left #openvpn []
06:27 < hyper_ch> krzee: http://www.schneier.com/blog/archives/2011/08/new_attack_on_a_1.html
06:27 <@vpnHelper> Title: Schneier on Security: New Attack on AES (at www.schneier.com)
06:27 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
06:28 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:30 <+s7r> hyper_ch: is that what i think it is ?
06:30 <+s7r> :D
06:31 < hyper_ch> you think?
06:31 <+s7r> AES - the " recommended" cipher by NSA which "should be enough for high classfied files" - crackable ?
06:31 < hyper_ch> I'm really surprised by that :)
06:31 < krzee> nah
06:31 < hyper_ch> krzee: you're here :)
06:32 < krzee> its just the start, it does not mean that AES is successfully attacked
06:32 < krzee> just that they made a little progress... which is pretty cool
06:32 <+s7r> yeah but it's a start
06:32 <+s7r> give it 2-3 years krzee
06:32 < hyper_ch> krzee: did you read Bruce's reply?
06:33 < krzee> hyper_ch, no, have it handy?
06:33 < hyper_ch> krzee: http://www.schneier.com/blog/archives/2011/08/new_attack_on_a_1.html
06:33 <@vpnHelper> Title: Schneier on Security: New Attack on AES (at www.schneier.com)
06:33 < krzee> s7r, speaking of 2 years...
06:33 < krzee> http://www.schneier.com/blog/archives/2009/07/another_new_aes.html
06:33 <@vpnHelper> Title: Schneier on Security: Another New AES Attack (at www.schneier.com)
06:34 <+s7r> fix 2 years and 1 mos
06:34 < krzee> oh ok ya i did read that
06:34 < krzee> you linked it before
06:34 < hyper_ch> :)
06:36 <+s7r> bruce thinks aes128 better than aes 256
06:36 <+s7r> can't understand why but hey .. :)
06:37 < krzee> s7r, did you read the link i gave...?
06:37 < krzee> the 2009 link
06:38 < krzee> attacks have gotten closer to AES 256 than 128 it seems
06:38 <+s7r> krzee: yes
06:38 <+s7r> because of the number of rounds
06:38 <+s7r> anyway, all 3 AES are safe at current moment
06:39 < krzee> and ill stick with blowfish
06:39 <+s7r> there is no reason to change them... but don't know how long they are going to last
06:39 < hyper_ch> what is the number of rounds for?
06:39 < hyper_ch> and do any crypto-chips support blowfish?
06:39 <+s7r> hyper_ch: for asymmetric encryptiom e.g. your hard drivere there is an update to blowfish which is twofosh
06:39 < krzee> # of rounds is how many times it is encrypted
06:39 <+s7r> i use it 
06:40 <+s7r> twofish was a competitor to aes in that contest 
06:40 < hyper_ch> and what crypto chips support twofish?
06:41 <+s7r> what are crypto chips?
06:42 < hyper_ch> like the newer intel chips with AES-NI
06:42 < hyper_ch> which speeds up AES quite nicely
06:42 -!- nodeman [775d33d8@gateway/web/freenode/ip.119.93.51.216] has joined #openvpn
06:42 <+s7r> ahh.. don't know for sure hyper_ch try google it
06:42 <+s7r> on what do you want to apply encryption? files / folders / data on hard drive
06:42 < hyper_ch> s7r: harddisk
06:43 <+s7r> use truecrypt
06:43 <+s7r> www.truecrypt.org
06:43 < hyper_ch> too bad I can't encrypt my tablet and my cellphone
06:43 < hyper_ch> truecrypt does not support full disk encryption on linux
06:43 <+s7r> I use truecrypt with AES-Twofish i nXTS mode (cascade)
06:43 <+s7r> ah u're on linux
06:43 < hyper_ch> what else would I be on?
06:43 <+s7r> I am on windows and it supports full disk encryption including OS and boot sector 
06:43 < krzee> in linux you dont need truecrypt
06:43 < hyper_ch> luks / dm-crypt
06:44 < krzee> yep
06:44 < hyper_ch> but still, what crypto chips do support blowfish/twofish
06:44 < nodeman> if I have server 10.8.0.0 255.255.240.0 in my server conf, what is the difference if I use push "dhcp-option DNS 10.8.0.1" and push "dhcp-option DNS 8.8.8.8"? is using  push "dhcp-option DNS 10.8.0.1" better than push "dhcp-option DNS 8.8.8.8" ?
06:44 < hyper_ch> the only ones I know are the newer Intel chips with AES-NI
06:44 < hyper_ch> pgp wholedisk for Mac OS... maybe filevault 2 is now usable also
06:44 <+s7r> http://www.schneier.com/twofish-performance.html
06:44 <@vpnHelper> Title: Twofish - Performance vs. Other Block Ciphers (at www.schneier.com)
06:45 < hyper_ch> s7r: hmmm, I don't think you understand what I'm looking for
06:45 < krzee> [04:46]  <hyper_ch> pgp wholedisk for Mac OS... maybe filevault 2 is now usable also
06:45 < krzee> huh?
06:45 < hyper_ch> s7r: the newer intel chips (since sandy bridge I think) have special crypto instruction that speeds up AES massively
06:45 < nodeman> if I have server 10.8.0.0 255.255.240.0 in my server conf, what is the difference if I use push "dhcp-option DNS 10.8.0.1" and push "dhcp-option DNS 8.8.8.8"? is using  push "dhcp-option DNS 10.8.0.1" better than push "dhcp-option DNS 8.8.8.8" ?
06:46 < hyper_ch> s7r: on a test notebook where I used it, read/write from a fully encrypted system wasn't much slower than unencrypted
06:46 < krzee> oh cool pgp whole disk did come out for osx
06:46 < hyper_ch> krzee: to my knowledge filevault 2 on OS X Lion has been massively overhauled as Filevault on older OS X versions could be easily hacked
06:46 < krzee> awhile ago too it seems, like 3 yrs
06:46 < hyper_ch> ah, you didn't know about pgp wholedisk?
06:47 < krzee> not on osx
06:47 < hyper_ch> krzee: I searched for it when I started encrypting the OS X comps at work here
06:47 < hyper_ch> that was about 1 1/2 years ago
06:48 < hyper_ch> nodeman: the first one will just make the primary lookup for dns to 10.8.0.1
06:48 < hyper_ch> while the second one will use google nameservers
06:48 < hyper_ch> PGP Wholedisk works quite good on OS X
06:48 < nodeman> will using 10.8.0.1 better than using google nameservers?
06:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
06:49 < hyper_ch> nodeman: "better" depends on the metrics you apply to compare two or more options
06:51 < nodeman> in the google that I have read, it says it is best to use own dns so that it is not likely to be blocked by the isp, is that right?
06:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:55 -!- nodeman [775d33d8@gateway/web/freenode/ip.119.93.51.216] has quit [Quit: Page closed]
07:09 -!- nixusr_ is now known as nixusr
07:17 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14822>
07:21 -!- sathia [~quassel@host124-210-dynamic.50-79-r.retail.telecomitalia.it] has joined #openvpn
07:21 -!- sathia [~quassel@host124-210-dynamic.50-79-r.retail.telecomitalia.it] has quit [Client Quit]
07:21 -!- sathia [~quassel@host124-210-dynamic.50-79-r.retail.telecomitalia.it] has joined #openvpn
07:21 -!- sathia [~quassel@host124-210-dynamic.50-79-r.retail.telecomitalia.it] has quit [Client Quit]
07:22 -!- sathia [~quassel@host124-210-dynamic.50-79-r.retail.telecomitalia.it] has joined #openvpn
07:23 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:37 -!- EugeneK [EugeneKay@eugenekay.com] has joined #openvpn
07:37 -!- EugeneK is now known as EugeneKay
07:42 -!- kyrix [~ashley@46.207.255.104] has joined #openvpn
07:50 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
08:01 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:02 -!- kyrix [~ashley@46.207.255.104] has quit [Quit: Ex-Chat]
08:03 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
08:04 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:04 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:08 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 240 seconds]
08:22 -!- nixusr [~nixusr@205.185.121.60] has joined #openvpn
08:22 -!- nixusr [~nixusr@205.185.121.60] has quit [Changing host]
08:22 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
08:28 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:29 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 240 seconds]
08:37 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
08:41 -!- spacemonkey [~mpirtle@93-50-192-21.ip153.fastwebnet.it] has joined #openvpn
08:42 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Quit: Leaving]
08:53 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:57 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
09:00 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
09:01 -!- master_of_master [~master_of@p57B5519A.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:03 -!- master_of_master [~master_of@p57B5547F.dip.t-dialin.net] has joined #openvpn
09:14 < spacemonkey> Hi everyone.
09:15 < spacemonkey> Trying to setup openvpn to proxy from the server for a client, not seeing examples that make sense. Looking around for something, are there any HOWTO or mini articles that illustrate such?
09:15 < spacemonkey> The server setup appears fine, just needing help figuring out the client.
09:19 < spacemonkey> I can ping the private IP of the server from the client, but have no idea how to route all other traffic over the VPN. Any pointers?
09:22 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
09:27 -!- nixusr [~nixusr@205.185.121.60] has joined #openvpn
09:27 -!- nixusr [~nixusr@205.185.121.60] has quit [Changing host]
09:27 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
09:36 -!- spacemonkey [~mpirtle@93-50-192-21.ip153.fastwebnet.it] has quit [Quit: Hey what does this button d<<LOST CARRIER>>]
09:42 -!- krzee [~k@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:47 < Bushmills> !redirect
09:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
10:00 <@vpnHelper> RSS Update - forum: Different vlan for different user through vpn <http://forums.openvpn.net/topic8668.html>
10:12 <@vpnHelper> RSS Update - forum: OpenVPN hangs on TLS authentication during connecting <http://forums.openvpn.net/topic8669.html>
10:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:15 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
10:15 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
10:15 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:15 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
10:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
10:23 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Ping timeout: 240 seconds]
10:27 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has joined #openvpn
10:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
10:34 -!- cpm is now known as jcpm
10:36 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
10:43 -!- grendal_prime [~sgraham@2001:470:822a:200:21e:c9ff:fe07:bb9] has joined #openvpn
10:47 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 250 seconds]
10:52 -!- jcpm is now known as cpm
10:55 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
10:57 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Quit: Ex-Chat]
10:58 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
11:15 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:15 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:20 < grendal_prime> ok ive gon subneting blind
11:20 < grendal_prime> its been that long of a night
11:21 -!- nixusr_ [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
11:21 -!- nixusr_ [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
11:21 -!- nixusr_ [~nixusr@unaffiliated/nixusr] has joined #openvpn
11:21 < grendal_prime> i have a network 172.17.3.0  and i want to split it down the middle.
11:23 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 250 seconds]
11:30 -!- karl`` [6c281d8f@gateway/web/freenode/ip.108.40.29.143] has joined #openvpn
11:31 < karl``> Is there a way to validate a client system before it connects? i.e., can I maintain a list of physical systems allowed to connect, similar to a mac address filter?
11:32 < gladiatr> grendal_prime, what's your question?
11:33 < grendal_prime> looks likei its just an assigned subnet mask issue..but...grrr..so  ya i split it..so the subnet mask is 128 for both sides...
11:33 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Ping timeout: 240 seconds]
11:34 < grendal_prime> so for the 3.0 subnet it would be 128 and for the 3.128 network would also be 128
11:34 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
11:34 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
11:34 -!- mode/#openvpn [+o vpnHelper] by ChanServ
11:35 < grendal_prime> now..the one vpn connection is on the 3.0 network...the 3.128 network is a physical nic...if i route to the 3.128 network and push the route to the client ..it doenst work...
11:35 < grendal_prime> but if i do the same thing on a second vpn network connection that is on 2.0 it routes it to that network just fine.
11:35 <@vpnHelper> RSS Update - forum: OpenVPN hangs on TLS authentication during connecting <http://forums.openvpn.net/topic8669.html#p14825>
11:35 < grendal_prime> does that make sency
11:36 < grendal_prime> since?
11:36 < grendal_prime> sense that is
11:39 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
11:40 < grendal_prime> ya this is werid
11:41 < grendal_prime> i was trying to save some ips...but aparently it really does not like to deal with carved up network...i mean..unless...do i need to set the netmask for the vp wide open?
11:41 < grendal_prime> so it can see both networks?
11:43 < grendal_prime> or do i need to add gateway information to the route statement?  like 172.17.3.1 so it knows to route the data through the first first subnet to get to the second network.
11:44 < grendal_prime> thing is...when i look at my route on the connected client...it shows a route to that network...its the right route..i just dont get any ping reply..
11:46 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
11:56 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 260 seconds]
11:57 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
12:01 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 260 seconds]
12:02 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
12:04 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Ping timeout: 260 seconds]
12:06 -!- trapni [~trapni@trapni.de] has quit [Changing host]
12:06 -!- trapni [~trapni@gentoo/developer/trapni] has joined #openvpn
12:08 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
12:08 -!- dazo is now known as dazo_afk
12:18 < datruth> grendal_prime: perhaps you need to look into NAT
12:18 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
12:22 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
12:23 -!- jeev_ [~jeev@unaffiliated/jeev] has joined #openvpn
12:23 -!- jeev [~jeev@unaffiliated/jeev] has quit [Disconnected by services]
12:23 -!- jeev_ is now known as jeev
12:24 -!- jeev_ [~jeev@unaffiliated/jeev] has joined #openvpn
12:25 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 240 seconds]
12:27 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
12:28 -!- Ragnar [~heimdall@darkstar.acool.net] has quit [Read error: Connection reset by peer]
12:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
12:34 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
12:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:44 <@vpnHelper> RSS Update - forum: Cannot connect to server <http://forums.openvpn.net/topic8670.html>
12:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
12:55 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
12:55 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
12:55 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
12:55 < grendal_prime> datruth, i figured it out..the damn device it was pinging had no route back..it wasnt the vpn server at all...everyone refused to look at the load balancer untell i was able to show them that there was no ping reply comming back.
12:56 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Ping timeout: 250 seconds]
12:57 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Quit: Leaving]
13:04 -!- dazo_afk is now known as dazo
13:12 <@vpnHelper> RSS Update - forum: OpenVPN hangs on TLS authentication during connecting <http://forums.openvpn.net/topic8669.html#p14828> || DDwrt/OpenVPN starts, vpn works on router, not for computers <http://forums.openvpn.net/topic8632.html#p14827>
13:17 <@vpnHelper> RSS Update - forum: Different vlan for different user through vpn <http://forums.openvpn.net/topic8668.html#p14829>
13:18 -!- grendal_prime [~sgraham@2001:470:822a:200:21e:c9ff:fe07:bb9] has quit [Quit: Ex-Chat]
13:23 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
13:36 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
13:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
13:56 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
13:56 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
13:56 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:59 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14830>
13:59 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:01 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
14:03 < hyper_ch> krzee: In Germany, the new experimental car, "Schluckspecht," broke previous world records earlier this month when it traveled 1,631.5 kilometers (994 miles) on a single battery charge.
14:05 < krzee> nice, its german for "boozer"
14:05 < krzee> http://www.physorg.com/news/2011-08-boozer-ev-miles-plus.html
14:05 <@vpnHelper> Title: 'Boozer' EV sets 1,000 miles-plus record on single charge (at www.physorg.com)
14:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:08 < krzee> Bushmills, reiffert, why are germans so smart?
14:08 < hyper_ch> 36h driving :)
14:08 < hyper_ch> for 10000 miles
14:08 < krzee> divide that by 10
14:08 < hyper_ch> sort of :)
14:08 < hyper_ch> you know, germans build fast cars :)
14:08 < krzee> 1,013.8 miles... not 10,000
14:09 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
14:10  * ecrist put 1100 miles on the motorcycle last week.
14:10 < ecrist> it was fun.
14:14 -!- dazo is now known as dazo_afk
14:15 -!- newmember_ [~chatzilla@66.185.87.94] has joined #openvpn
14:15 < reiffert> krzee: because heil hitler made us to act like that.
14:15 < hyper_ch> ecrist: how's your butt?
14:15 < ecrist> just fine, hyper_ch 
14:15 < hyper_ch> :)
14:16 -!- newmember_ [~chatzilla@66.185.87.94] has quit [Client Quit]
14:16 < ecrist> bought an ultimate seat for my vtx just before the trip
14:16 < krzee> no way, hitler would have had nothing if it werent for his awesome scientists
14:16 < ecrist> 1000% better than the stock seat
14:16 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has quit [Ping timeout: 250 seconds]
14:16 < ecrist> working out an issue with the backrest mounting hardware, but the manufacturer is working with me on that
14:16 < krzee> i just had such an urge to /topic <hyper_ch> ecrist: how's your butt?
14:16 < ecrist> SUPER happy with them so far.
14:16 < ecrist> heh
14:19 < hyper_ch> krzee: go ahead
14:21 <@vpnHelper> RSS Update - forum: Redirecting the whole traffic through openvpn - HELP <http://forums.openvpn.net/topic8581.html#p14831>
14:23 < aten> is it possible to bind openvpn to multiple ip's?
14:23 < aten> (but not all)
14:24 < krzee> no
14:24 < krzee> all or none
14:29 < ecrist> sure it is
14:29 < ecrist> just add multiple --local arguments
14:29 < ecrist> you can only bind to one port, and using one protocol, though.
14:32 < aten> ah thanks
14:32 < aten> i had two local lines in my server config
14:33 < aten> but it's comma seperated: local <ip 1>, <ip 2>
14:33 < aten> now it works
14:39 < krzee> oh hah i didnt know you could use local twice
14:41 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has quit [Ping timeout: 260 seconds]
14:42 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has joined #openvpn
14:48 -!- CharlieSu [~CharlieSu@ec2-174-129-218-86.compute-1.amazonaws.com] has joined #openvpn
14:49 < CharlieSu> Hi.  When generating x509 certificates, does it matter if i save my easy-rsa/keys/(index.txt,serial) files?  Also, is it an issue if two keys have the same serial ? 
14:51 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
14:55 -!- gffa [~gffa@unaffiliated/gffa] has quit [Ping timeout: 252 seconds]
14:57 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
15:00 <@raidz> !welcome
15:00 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:00 <@raidz> !goal
15:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:00 <@raidz> !configs
15:00 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
15:19 -!- dazo_afk is now known as dazo
15:25 <@vpnHelper> RSS Update - forum: Mtu size for my network? <http://forums.openvpn.net/topic8671.html>
15:26 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
15:26 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Remote host closed the connection]
15:27 < krzee> CharlieSu, yes, yes
15:28 < krzee> without those files you cant revoke a cert
15:28 < krzee> and iirc you revoke based on serial
15:32 -!- dazo is now known as dazo_afk
15:37 < Optic> moo moo moo
15:43 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
15:51 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:52 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:54 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
16:13 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
16:15 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Remote host closed the connection]
16:17 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
16:22 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
16:23 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 240 seconds]
16:23 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
16:42 <@vpnHelper> RSS Update - forum: Cannot connect to server <http://forums.openvpn.net/topic8670.html#p14833>
16:44 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:49 <@vpnHelper> RSS Update - forum: Mtu size for my network? <http://forums.openvpn.net/topic8671.html#p14835> || Help with installation needed <http://forums.openvpn.net/topic8664.html#p14834>
16:55 <@vpnHelper> RSS Update - forum: Different vlan for different user through vpn <http://forums.openvpn.net/topic8668.html#p14836>
16:57 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
17:01 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14837>
17:07 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
17:07 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
17:07 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
17:07 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
17:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
17:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:10 -!- nixusr_ [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 264 seconds]
17:13 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14838>
17:14 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Remote host closed the connection]
17:14 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Operation timed out]
17:24 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
17:25 <@vpnHelper> RSS Update - forum: Windows XP "route addition failed" u: non-admin, openvpn svc <http://forums.openvpn.net/topic8667.html#p14839>
17:31 <@vpnHelper> RSS Update - forum: Windows XP "route addition failed" u: non-admin, openvpn svc <http://forums.openvpn.net/topic8667.html#p14840>
17:34 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 250 seconds]
17:37 -!- pr0zoid [~pr0zoid@184.95.44.33] has joined #openvpn
17:41 -!- pr0zoid [~pr0zoid@184.95.44.33] has quit [Ping timeout: 240 seconds]
17:41 -!- pr0zoid [pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
17:43 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
17:44 < EvilGuru> I'm looking into setting up a openvpn bridge and wish to use my existing DHCP server. The docs mention not passing a default gateway, why?
17:49 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:09 -!- Cain [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
18:12 -!- hpa_YVR [hpa@terminus.zytor.com] has quit [Ping timeout: 260 seconds]
18:13 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
18:14 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
18:14 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has joined #openvpn
18:16 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
18:17 < kenyon> EvilGuru: well, I guess because the client will already have a default gateway for whatever network it's on.
18:18 < kenyon> so it depends on whether you want to direct all traffic over openvpn or not
18:18 < EvilGuru> kenyon: Right, but if I want all of my traffic to go through the VPN then I want a new default gateway, no?
18:18 < EugeneKay> You sound like ou want to do bridging. 
18:18 < EugeneKay> "Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
18:19 < EugeneKay> Unless you have a better reason than "I want to use the same DHCP server", you do not want bridging. Trust me.
18:20 < EvilGuru> When I've used it in the past (work and college) they have always used bridged configs
18:20 < EvilGuru> *it being VPNs
18:20 < EugeneKay> They were "doinitrong"
18:21 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
18:22 < EvilGuru> Routing appears to needlessly break things such as DNS and splits up my network to VPN and non-VPN pools
18:22 < EugeneKay> Routing does not break DNS, and separate DHCP pools based on network segments are a GOOD thing. 
18:23 < EvilGuru> Internal systems will not be able to resolve VPN'ed systems using their normal (internal) names
18:23 < kenyon> why not?
18:23 < EugeneKay> Yes they will. You jut need to set it up correctly.
18:24 < EugeneKay> OpenVPN is no different from any other network segment. You can setup dhcp-ed dns for it(using post-up scripts) if you want.
18:25 < EugeneKay> Bridging just adds overhead. Depending upon how big your topology is in comparison to your link speed/latency, lots of overhead. 
18:25 < EvilGuru> Currently all IP and DNS assignments are done on MACs
18:28 < EugeneKay> I don't think I can help you any further.
18:32 -!- krzee [~k@c-24-7-124-29.hsd1.ca.comcast.net] has joined #openvpn
18:32 -!- krzee [~k@c-24-7-124-29.hsd1.ca.comcast.net] has quit [Changing host]
18:32 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
18:33 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
18:55 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
18:55 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
18:55 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
19:08 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:08 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:08 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:08 < krzee> EugeneKay, around?
19:08 < EugeneKay> Maybe
19:09 < krzee> heheh
19:09 < EugeneKay> Who's asking?
19:10 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
19:10 < krzee> i tried that nat rule, and at that point realized that my router is also blocking it or not forwarding it, can i paste my ruleset?  its however openwrt comes by default
19:10 < EugeneKay> Sure
19:11 < krzee> oh some better googles are making it look like this possibly be an openwrt thing, with specific openwrt ways to fix
19:11 < krzee> http://pastebin.com/FumKeVBH
19:12 < EugeneKay> Chain FORWARD (policy DROP)
19:12 < EugeneKay> There's your problem, right there
19:14 < EugeneKay> YOu need something inolving the forward chain, tun0, and an ACCEPT
19:15 < krzee> iptables -A INPUT -i tun+ -j ACCEPT
19:15 < krzee> err
19:15 < krzee> iptables -A FORWARD -i tun+ -j ACCEPT
19:15 -!- hpa [hpa@terminus.zytor.com] has quit [Read error: Connection reset by peer]
19:16 < EugeneKay> You'll need to it for both ways
19:16 < krzee> huh?
19:16 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
19:16 < krzee> ohh
19:16 < krzee> -o
19:16 < EugeneKay> Ayup
19:17 < krzee> still nothin
19:17 < EugeneKay> Hm.
19:17 < krzee> root@OpenWrt:~# iptables -A FORWARD -i tun+ -j ACCEPT
19:17 < krzee> root@OpenWrt:~# iptables -t nat -A POSTROUTING -s 10.7.69.0/24 -o tun0 -j MASQUERADE
19:17 < krzee> root@OpenWrt:~# iptables -A FORWARD -o tun+ -j ACCEPT
19:17 < krzee> still getting DEST unreachables from the router
19:17 < krzee> when lan machine pings vpn server ip
19:18 < EugeneKay> Router can ping the vpn server fine?
19:18 < krzee> ya
19:18 < krzee> and server sees no packets coming on tun0 when lan machine pings vpn server ip
19:18 < krzee> so the router is def dropping them
19:18  * EugeneKay stares at the iptables output some more
19:19 < EugeneKay> OpenWRT's sorting is..... annoying
19:19 < krzee> lemme repost after those 3 cmds
19:19 < krzee> yes, so hard for me to read that way
19:19 < EugeneKay> how about iptables -P FORWARD ACCEPT
19:20 < krzee> same
19:20 < EugeneKay> Er
19:20 < EugeneKay> Hrm.
19:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
19:21 < EugeneKay> iptables -L -t filter && iptables -L -t nat
19:22 < krzee> http://pastebin.com/5sbEFLfM
19:23 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
19:23 < EugeneKay> Oh, looks like OpenWRT's annoying POSTROUTING chains are intercepting the traffic before it hits MASQUERADE
19:24 < krzee> ohhh
19:24 < krzee> oh but wait
19:24 < krzee> wouldnt that still allow the packet?
19:24 < EugeneKay> It should still hit as an un-NATed... yeah
19:24 < krzee> but just with the wrong ip
19:24 < EugeneKay> Looking :-p
19:24 < krzee> so ild see it in the server tcpdump on tun0, as well as openvpn MULTI errors
19:25 < EugeneKay> Is there an iptables source file someplace? It's easier for me to look at than these
19:25 < RichardBronosky> my linux guest VM is getting it's traffic routed correctly over the Host machine's OpenVPN tunnel, but the DNS resolution is not correct. Where should I start searching?
19:26 < krzee> looking
19:26 < EugeneKay> Hm, now THIS is odd. I can't ping my home fileserver/routed, but I can reach the internet.
19:27 < krzee> EugeneKay, ahh yes, and this is what i started to find openwrt specific
19:27 < EugeneKay> I'm going to recommend ripping out all the OpenWRT crap and starting your rules over from scratch in a way you can comprehend
19:29 < krzee> http://pastebin.com/s4bVLtMc
19:29 < krzee> but now that i know the file i bet i can find this in some googles, lets see :)
19:29 < EugeneKay> Ohgodnonstandardsyntaxwhywouldtheydoitlikethiswhatthetits
19:30 < krzee> hahaha
19:30 < krzee> ya man
19:30 < krzee> their config file for openvpn is all lame-a-fied too
19:30 < EugeneKay> What's firewall.user look like
19:30 < krzee> empty
19:31 < EugeneKay> That's a start :-p
19:31 < krzee> its a shell script that will add stuff, has a note on it
19:31 < krzee> root@OpenWrt:/etc# cat firewall.user 
19:31 < krzee> # This file is interpreted as shell script.
19:31 < krzee> # Put your custom iptables rules here, they will
19:31 < krzee> # be executed with each firewall (re-)start.
19:31 < EugeneKay> It looks like all your fiddling-about with iptables manually has duplicated some rules
19:32 < EugeneKay> Lines 17/18 in the iptables -L output, for example
19:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
19:33 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:33 -!- gffa [~gffa@unaffiliated/gffa] has quit [Ping timeout: 276 seconds]
19:34 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:34 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
19:34 < krzee> pinged out after the commented out firewall.user file
19:34 < EugeneKay> Go figure.
19:35 < krzee> https://forum.openwrt.org/viewtopic.php?pid=129653
19:35 < krzee> there we go
19:35 <@vpnHelper> Title: OpenWrt / OpenVPN client forwarding from lan to vpn not working (at forum.openwrt.org)
19:36 < krzee> that looks like it has the info i'll need... go figure they took an iptables issue and made it an openwrt issue =/
19:36 -!- gffa [~gffa@unaffiliated/gffa] has quit [Client Quit]
19:36 < EugeneKay> There is a reason I put my DSL modem into ATM bridging mode and hooked up a linux box with a second NIC.
19:36 < EugeneKay> Embedded routers diaf
19:36 < krzee> oh ya man, these arent for me
19:37 < krzee> this is my first time playing with all this stuff, got a pretty nice build system all automated for it now :)
19:37 < EugeneKay> They generally work OK for home users.... but the second you do anything more advanced than uPNP, your underwear will spontaneously combust
19:40 -!- nb_ [~nb@fedora/nb] has joined #openvpn
19:40 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:40 -!- nb_ is now known as nb
19:41 < krzee> thanks =]
19:51 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
19:51 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 252 seconds]
19:55 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
19:56 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
20:00 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
20:00 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
20:01 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
20:01 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
20:03 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:11 < krzee> EugeneKay, got it working
20:11 < krzee> with the iptables rules
20:11 < krzee> needed -I instead of -A
20:11 < krzee> insert instead of append
20:11 < EugeneKay> Yeah, order of operations.
20:11 < krzee> you were right about rule precedence being the problem, but it was the forward chain
20:11 < krzee> https://forum.openwrt.org/viewtopic.php?pid=124889#p124889
20:11 <@vpnHelper> Title: OpenWrt / firewall rules for openvpn (at forum.openwrt.org)
20:11 < EugeneKay> That's why I prefer to work with /etc/sysconfig/iptables dumps - what you see is what gets applied.
20:12 < EugeneKay> In the order it's written
20:12 < krzee> ya im not a fan of some of the UCI rewriting
20:12 < krzee> the openvpn config is hideous
20:15 -!- Denial [~Denial@drgi.co.uk] has quit []
20:21 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
20:25 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has joined #openvpn
20:44 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Remote host closed the connection]
21:05 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
21:08 -!- K1ng [~KING@180.211.188.116] has quit [Ping timeout: 240 seconds]
21:16 -!- Squidy_at_Home [~quassel@187.7.192.241] has joined #openvpn
21:18 -!- K1ng` is now known as k1ng
21:18 -!- k1ng is now known as Guest64860
21:26 -!- karl`` [6c281d8f@gateway/web/freenode/ip.108.40.29.143] has quit [Quit: Page closed]
21:31 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:57 < RichardBronosky> is there a way to get my linux guest VM to get the resolv.conf from the host in an automated fashion?
21:57 < RichardBronosky> or is there another solution?
21:59 < RichardBronosky> I can copy it over manually, I don't care. But I'm trying to setup a development VM for a team of 30 developers. It needs to just work™. I'm going to get push back if my new VM workfow adds a ton of steps and gotchas.
22:04 -!- zoidberg- [~zoidberg@2600:3c03::f03c:91ff:fe93:bc1d] has joined #openvpn
22:05 < zoidberg-> keys
22:19 -!- Squidy_at_Home [~quassel@187.7.192.241] has quit [Ping timeout: 240 seconds]
22:22 <@vpnHelper> RSS Update - forum: Cannot connect to server <http://forums.openvpn.net/topic8670.html#p14841>
22:28 -!- Bogus8_ [~Nunya@ip184-190-202-56.lf.br.cox.net] has quit [Remote host closed the connection]
22:29 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:30 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:30 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:30 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
22:34 <@vpnHelper> RSS Update - forum: Cannot connect to server <http://forums.openvpn.net/topic8670.html#p14842>
22:42 < kenyon> RichardBronosky: I don't see how this relates to OpenVPN, but sounds like DHCP is what you want.
22:43 < RichardBronosky> kenyon OpenVPN in the Host works for the routing in the Guest without restarting the network.
22:45 < RichardBronosky> but, for the guest's resolv.conf to get updated... yes you have to restart the network in the guest to get the new DNS settings from DHCP.
22:46 < RichardBronosky> I was lulled into complacency when OpenVPN just magically worked for IP routing in the guest.
22:46 < kenyon> are the DNS settings changing a lot?
22:46 < RichardBronosky> just when I turn the VPN on or off
22:50 < kenyon> so maybe you just need to add "restart networking" or something to the command that turns VPN on or off?
23:14 -!- Husky [Smegma@unaffiliated/coil] has left #openvpn ["Leaving"]
23:31 -!- Squidy_at_Home [~quassel@187.7.192.241] has joined #openvpn
23:34 <@vpnHelper> RSS Update - forum: IPCop + OpenVPN + RDP (How i control RDP Session) <http://forums.openvpn.net/topic8672.html>
--- Day changed Fri Aug 19 2011
00:01 -!- Squidy_at_Home [~quassel@187.7.192.241] has quit [Remote host closed the connection]
00:34 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
00:47 <@vpnHelper> RSS Update - forum: Windows 7 connection issues <http://forums.openvpn.net/topic8673.html>
00:49 -!- dazo_afk is now known as dazo
00:56 < Bushmills> "you have to restart the network" - wrong
00:57 < Bushmills> for using the openvpn-pushed name server, you'd execute an connection event script, which introduces that name server to resolver 
00:58 < Bushmills> for reverting to dhcp provided name server, you'd re-request your dhcp lease
00:58 <@vpnHelper> RSS Update - forum: Redirecting the whole traffic through openvpn - HELP <http://forums.openvpn.net/topic8581.html#p14846> || IPCop + OpenVPN + RDP (How i control RDP Session) <http://forums.openvpn.net/topic8672.html#p14845>
00:59 < Bushmills> to not have to bother about what nameserver to use with and without openvpn, running a recursive nameserver on the client is often a solution
01:01 < reiffert> `MOIN
01:02 < reiffert> keyboard is still sleeping
01:02 < Bushmills> krzee, that uci openvpn config allows specifiying a plain openvpn config instead. 
01:02 < Bushmills> moinmoin
01:02 < Bushmills> give keyboard a coffee
01:13 < reiffert> ready.
01:14 < reiffert> <blink> </blink>
01:29 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:31 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has quit [Remote host closed the connection]
01:34 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has joined #openvpn
01:34 <@vpnHelper> RSS Update - forum: Windows 7 connection issues <http://forums.openvpn.net/topic8673.html#p14848> || Cannot connect to server <http://forums.openvpn.net/topic8670.html#p14847>
01:48 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
01:49 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
01:50 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
01:50 <@vpnHelper> RSS Update - forum: Windows 7 connection issues <http://forums.openvpn.net/topic8673.html#p14850> || OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p14849>
01:51 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Ping timeout: 252 seconds]
02:00 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
02:03 <@vpnHelper> RSS Update - forum: [CLOSED] Windows 7 connection issues <http://forums.openvpn.net/topic8673.html#p14851>
02:03  * EugeneKay sneezes
02:04 -!- kyrix [~ashley@ks357561.kimsufi.com] has joined #openvpn
02:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
02:09 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:11 -!- kyrix [~ashley@ks357561.kimsufi.com] has quit [Ping timeout: 250 seconds]
02:21 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
02:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:37 < Mowee> Morning
02:39 <@vpnHelper> RSS Update - forum: IPCop + OpenVPN + RDP (How i control RDP Session) <http://forums.openvpn.net/topic8672.html#p14853> || Cannot connect to server <http://forums.openvpn.net/topic8670.html#p14852>
02:42 -!- bibear [~bibear@89.204.137.220] has joined #openvpn
02:43 < bibear> hello
02:46 < bibear> when i'm using ubuntu with unity, i cant connect to my openvpn server, thats the error: /sbin/ifconfig tap0 10.12.1.33 netmask 10.10.1.6 mtu 1500 broadcast 255.253.255.249
02:46 < bibear> SIOCSIFNETMASK: Invalid argument
02:50 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
02:51 -!- oc80z [oc80z@blea.ch] has joined #openvpn
02:52 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Read error: Connection timed out]
02:57 < Ragnar> on an openvpn server where openssl is probably broken, can I do a apt-get remove openssl, apt-get update and then reinstall openssl
02:57 < Ragnar> without breaking openvpn's current certs?
02:59 < EugeneKay> Removing openssl should not touch anything in /etc/openvpn, but all bets are off when it comes to apt.
02:59 < Ragnar> hah
02:59 < Ragnar> I could backup /etc/openvpn before doing anything
02:59 < Ragnar> that should put me in a safe zone
03:00 < EugeneKay> A good idea.
03:00 < Ragnar> so if it removes shit, I could just untar it back there
03:00 < Ragnar> after reinstalling openssl
03:02 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
03:06 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
03:09 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:09 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Client Quit]
03:10 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
03:14 -!- bibear [~bibear@89.204.137.220] has left #openvpn []
03:18 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:20 -!- sathia [~quassel@host124-210-dynamic.50-79-r.retail.telecomitalia.it] has quit [Read error: Operation timed out]
03:27 <@vpnHelper> RSS Update - forum: IPCop + OpenVPN + RDP (How i control RDP Session) <http://forums.openvpn.net/topic8672.html#p14854>
03:29 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Read error: Connection timed out]
03:46 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
03:51 <@vpnHelper> RSS Update - forum: IPCop + OpenVPN + RDP (How i control RDP Session) <http://forums.openvpn.net/topic8672.html#p14855>
04:03 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Quit: Ex-Chat]
04:04 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has joined #openvpn
04:12 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
04:14 -!- Jopie [~Joel@095-097-091-154.static.chello.nl] has joined #openvpn
04:16 < Jopie> Does anyone have a link to a configuration where the client is pushed a route for just the VPN Network?
04:17 < Jopie> Have the client/server connecting but can't ping
04:18 < EugeneKay> If you're using the default /30 topology, "server 10.8.0.0 255.255.255.0" should cover the vpn route
04:18 < Jopie> hmm, but it doesn't, the windows client has a warning "OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
04:18 < Jopie> "
04:19 <@vpnHelper> RSS Update - forum: cant ping guest vm from vpn client <http://forums.openvpn.net/topic8674.html>
04:20 < Jopie> I've increased the verbosity level and can see the routing table doesn't have an entry for 10.8.0.0
04:21 < Jopie> EugeneKay: Here's part of the client log http://pastebin.com/gkgJanwn
04:22 < EugeneKay> Fri Aug 19 11:19:19 2011 us=813000 WARNING: Since you are using --dev tap, the second argument to --ifconfig must be a netmask, for example something like 255.255.255.0. (silence this warning with --ifconfig-nowarn)
04:23 < EugeneKay> !configs
04:23 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
04:27 < Jopie> http://pastebin.com/ae18J73a
04:30 < Jopie> oh, and client 1.0.3 on Windows 7, server OpenVPN 2.2.0 on CentOS
04:32 -!- kyrix [~ashley@83-64-37-177.static.adsl-line.inode.at] has quit [Ping timeout: 268 seconds]
04:32 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:32 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:32 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:41 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 250 seconds]
04:43 < Jopie> EugeneKay: anything jump out? http://pastebin.com/ae18J73a
04:43 < EugeneKay> Well, "dev tap"
04:44 < EugeneKay> Unless you're trying to pass IPv6, there is no reason you should use tap for a routed config
04:44 < EugeneKay> In fact, wtf are you doing? dev tap on the client, dev tun n the server?
04:44 < EugeneKay> No wonder it's broken.
04:45 < Jopie> Thanks, that did it... yeah, missed that inconsistency... it's dev tap in the default config I grabbed from somewhere
04:49 <@vpnHelper> RSS Update - forum: Hello Friends My Name is Arden Please Review my Website <http://forums.openvpn.net/topic8675.html>
04:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
04:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Client Quit]
04:58 -!- Jopie [~Joel@095-097-091-154.static.chello.nl] has quit [Ping timeout: 250 seconds]
05:04 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
05:21 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:22 -!- mode/#openvpn [+v s7r] by ChanServ
05:28 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:28 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:50 <@vpnHelper> RSS Update - forum: Redirecting the whole traffic through openvpn - HELP <http://forums.openvpn.net/topic8581.html#p14858>
06:02 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14859>
06:08 <@vpnHelper> RSS Update - forum: Redirecting the whole traffic through openvpn - HELP <http://forums.openvpn.net/topic8581.html#p14860>
06:14 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14861>
06:16 -!- Titania [~titania@221.120.122.106] has joined #openvpn
06:16 -!- Titania [~titania@221.120.122.106] has quit [Read error: Connection reset by peer]
06:36 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:41 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
06:44 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 260 seconds]
07:04 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Quit: Leaving.]
07:08 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
07:08 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
07:09 -!- qknight [~joachim@88.198.52.213] has quit [Ping timeout: 246 seconds]
07:09 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 246 seconds]
07:09 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 240 seconds]
07:10 -!- qknight [~joachim@88.198.52.213] has joined #openvpn
07:10 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
07:10 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
07:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
07:17 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:17 -!- kyrix [~ashley@46.207.255.104] has joined #openvpn
07:30 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has joined #openvpn
07:34 -!- bauruine_ [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
07:34 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has quit [Read error: Connection reset by peer]
07:44 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
07:44 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
07:44 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
07:49 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
07:57 -!- CharlieSu [~CharlieSu@ec2-174-129-218-86.compute-1.amazonaws.com] has left #openvpn []
08:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
08:02 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
08:03 -!- bauruine_ [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 240 seconds]
08:04 -!- bauruine_ [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
08:09 -!- randomizer [~randomize@71-94-146-81.static.mtpk.ca.charter.com] has joined #openvpn
08:10 -!- randomizer [~randomize@71-94-146-81.static.mtpk.ca.charter.com] has quit [Client Quit]
08:10 -!- randomizer [~randomize@71-94-146-81.static.mtpk.ca.charter.com] has joined #openvpn
08:11 -!- randomizer [~randomize@71-94-146-81.static.mtpk.ca.charter.com] has quit [Client Quit]
08:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:14 <@vpnHelper> RSS Update - forum: routing through the tunneling <http://forums.openvpn.net/topic8644.html#p14862>
08:18 -!- bauruine_ [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Read error: Operation timed out]
08:33 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Few women admit their age.  Few men act theirs.]
08:54 -!- CybDev [cybdev@unaffiliated/cybdev] has joined #openvpn
08:54 -!- newmember_ [~chatzilla@66.185.87.94] has joined #openvpn
08:54 < CybDev> any decent guides for setting up openvpn in bridge mode with an external dhcp server?
08:55 < hyper_ch> CybDev: if not, you could write one up :)
08:55 < CybDev> i would if i could get it working
08:55 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
08:55 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
08:55 < hyper_ch> !bridge
08:55 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc, or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ, or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
08:56 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has quit [Ping timeout: 258 seconds]
08:56 -!- newmember_ is now known as newmember
08:56 < hyper_ch> !dhcp
08:56 <@vpnHelper> "dhcp" is redirect-gateway bypass-dhcp gets around the problem of DHCP packets to the local DHCP server being incorrectly routed into the tunnel. Available in 2.1
08:56 -!- newmember [~chatzilla@66.185.87.94] has quit [Client Quit]
08:57 < CybDev> !layer2
08:57 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn?, or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better, or (#3) protocols that use layer2 communicate by MAC address, not IP address
08:57 < hyper_ch> CybDev: so, what are you trying to achieve?
09:00 -!- zoidberg- [~zoidberg@2600:3c03::f03c:91ff:fe93:bc1d] has quit [Remote host closed the connection]
09:01 -!- master_of_master [~master_of@p57B5547F.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:03 -!- master_of_master [~master_of@p57B55189.dip.t-dialin.net] has joined #openvpn
09:06 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has joined #openvpn
09:06 < fread2281> can some1 help me whit figuring out what choices i have for openvpn encryption http://en.gentoo-wiki.com/wiki/OpenVPN explains how but doesnt say what choices you have
09:06 <@vpnHelper> Title: OpenVPN - Gentoo Linux Wiki (at en.gentoo-wiki.com)
09:06 < fread2281> !welcome
09:06 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:07 < fread2281> !howto
09:07 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:07 < hyper_ch> fread2281: openvpn --cipher
09:08 < hyper_ch> mayber I misunderstood
09:10 < ecrist> fread2281: check out the man page
09:11 < hyper_ch> whenever I read the openvpn man page, I tend to think it was also encrypted
09:18 < ecrist> it would look that way to a retard.
09:26 < CybDev> hyper_ch: trying to get remote clients to appear as if on the same net as local clients/servers
09:26 < CybDev> same subnet, same dns settings, getting dhcp lease from the existing dhcp server etc...
09:27 < hyper_ch> ecrist: are you calling me a retard?
09:27 < hyper_ch> CybDev: and have all traffic being routed through the vpn?
09:35 < CybDev> not all, mainly that subnet and a couple of others
09:35 <@vpnHelper> RSS Update - forum: routing through the tunneling <http://forums.openvpn.net/topic8644.html#p14864> || Hello Friends My Name is Arden Please Review my Website <http://forums.openvpn.net/topic8675.html#p14863>
09:36 < ecrist> hyper_ch: if the shoe fits. ;)
09:37 < sedulous> is it possible to setup an IPv6 only layer 3 (tun) VPN without client-specific scripts, e.g. with Gert Doering's patchset? (emphasis on IPv6-only)
09:37 < ecrist> CybDev: you need bridged mode
09:37 < hyper_ch> ecrist: I don't like shoes
09:40 < ecrist> sedulous: it's not supported at this time
09:40 < ecrist> 2.3 will have full IPv6 support, however.
09:40 < sedulous> ecrist: will it be possible in 2.3?
09:40 < ecrist> 09:40:16 < ecrist> 2.3 will have full IPv6 support, however.
09:41 < |Mike|> however...? ;)
09:41 < sedulous> ecrist: does "full" mean that one can setup an OpenVPN that listens on IPv4 and pushes IPv6 only?
09:41 < ecrist> in english, that may be place either before or after the sentence, and tone and inflection are implied by the comma, |Mike| 
09:41 < ecrist> :P
09:42 < ecrist> sedulous: you can do that NOW
09:42 < sedulous> ecrist: on layer 3, how?
09:42 < sedulous> without client specific scripts
09:42 < ecrist> using the tap driver, which is layer 2, you can set that up
09:42 < |Mike|> ecrist: o o o ok? :-P
09:42 < sedulous> i asked about layer 3, ecrist 
09:43 < ecrist> there is not full layer 3 support at this time
09:43 < ecrist> 2.3 will have full IPv6 support, however.
09:43 < sedulous> it depends on how you define full
09:44 < ecrist> there's only one way to define 'full'
09:44 < sedulous> GD's IPv6 patchset provides good support already, however it's restricted to dual stack
09:44 < sedulous> so the answer is yes
09:44 < ecrist> right, and much of his patch set is in 2.2
09:44 < ecrist> but, we don't officially support IPv6 at this time
09:44 < sedulous> yes, i'm aware of that
09:44 < ecrist> then wtf are you asking?
09:45 < sedulous> great, so in 2.3, one will be able to configure a layer 3 VPN server that talks to its clients via IPv4 and only pushes IPv6
09:46 < sedulous> good to know
09:46 <@vpnHelper> RSS Update - forum: authentication via cert <http://forums.openvpn.net/topic8677.html> || IP conflict issues <http://forums.openvpn.net/topic8676.html>
09:47 < sedulous> ecrist: i think i made that clear in my first question when i explicitely mentioned GD's patchset. if it's forbidden to talk about that in here, i apologize.
09:48 < ecrist> not at all
09:48 < ecrist> and I answered you right away
09:48 < ecrist> 09:40:06 < ecrist> sedulous: it's not supported at this time
09:48 < ecrist> 09:40:16 < ecrist> 2.3 will have full IPv6 support, however.
09:48 < sedulous> it's not supported officially, i know, but someone still might have an answer regarding the unsupported patchset
09:49 < ecrist> no, what you want to do, IS NOT SUPPORTED, officially or otherwise
09:49 < ecrist> Gert's patch does not support that.
09:49 < sedulous> thanks
09:49 < sedulous> i wasn't certain if i was just doing it wrong
09:50 < sedulous> it's only small problem really
09:50 < ecrist> his patches are incomplete, and have been greatly refactored in the source tree.
09:50 < ecrist> until 2.3 is released, openvpn officially does not support ipv6 at all
09:51 < ecrist> that being said, you can setup a layer 2 vpn, and run whatever you want over that
09:51 < sedulous> yes, i might resort to that
09:51 < sedulous> with DHCPv6 or radvd
09:52 < ecrist> iirc, you *should* be able to do most of what you need with radvd now, at least is the most current versions
09:52 < sedulous> despite the restriction, the patches are already working quite well. i'm looking forward to 2.3
09:54 < sedulous> i'll try the git master branch (and promise i won't bug anyone :P)
09:54 < ecrist> to the contrary, if you DO run it, and notice something, either post the mailing list, or post a bug on the tracker
09:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:55 -!- mode/#openvpn [+v s7r] by ChanServ
09:55  * EugeneKay gives ecrist a cookie
09:56  * hyper_ch steals the cookie from ecrist
09:56  * |Mike| sets fire
09:56 < CybDev> ecrist: yeah i know i need bridge mode
09:56 < EugeneKay> "Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
09:56 < CybDev> i just cant get the clients interface up after it connects
09:56 < EugeneKay> hyper_ch - Your problem. It's a laxative cookie.
09:56 < hyper_ch> poor cats
09:57 < CybDev> shiny, i take the cat part as a bonus!
09:57 < hyper_ch> why would bridging be designed to hurt cats?
09:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:57 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:01 < fread2281> where would i get a cpy of the config files??
10:01 < ecrist> fread2281: see !howto or just make them.
10:01 < ecrist> !man
10:01 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
10:02 <@vpnHelper> RSS Update - forum: authentication via cert <http://forums.openvpn.net/topic8677.html#p14867>
10:03 < fread2281> !howto
10:03 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:03 < fread2281> i mean the examples??
10:04 < ecrist> they're on the howto
10:04 < ecrist> !--
10:04 < fread2281> !goal
10:04 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
10:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:08 <@vpnHelper> RSS Update - forum: cant ping guest vm from vpn client <http://forums.openvpn.net/topic8674.html#p14868>
10:09 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
10:18 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:24 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
10:28 < CybDev> can you specify multiple ifconfig-pool directives?
10:32 <@vpnHelper> RSS Update - forum: cant ping guest vm from vpn client <http://forums.openvpn.net/topic8674.html#p14869>
11:01 < gladiatr> CybDev, no
11:01 -!- nuttersppadic [~IceChat77@193.130.68.17] has left #openvpn []
11:02 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
11:21 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14870>
11:21 < ecrist> but you can hand out IPs from a CCD that are outside your ifconfig-pool
11:24 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has quit [Read error: Connection reset by peer]
11:24 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has joined #openvpn
11:27 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14872> || cant ping guest vm from vpn client <http://forums.openvpn.net/topic8674.html#p14871>
11:33 <@vpnHelper> RSS Update - forum: IP conflict issues <http://forums.openvpn.net/topic8676.html#p14873>
11:57 <@vpnHelper> RSS Update - forum: cant ping guest vm from vpn client <http://forums.openvpn.net/topic8674.html#p14874>
12:03 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:15 <@vpnHelper> RSS Update - forum: passphrase in /etc/init.d client start script <http://forums.openvpn.net/topic8678.html>
12:18 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Read error: Connection reset by peer]
12:19 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
12:27 <@vpnHelper> RSS Update - forum: Mtu size for my network? <http://forums.openvpn.net/topic8671.html#p14876>
12:33 <@vpnHelper> RSS Update - forum: Help with open vpn client setup on Ubuntu <http://forums.openvpn.net/topic8679.html>
12:39 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has quit [Remote host closed the connection]
12:39 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has joined #openvpn
12:40 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:43 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:44 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has quit [Ping timeout: 276 seconds]
12:48 -!- jdoe [jdoe@falseprophet.ca] has quit [Ping timeout: 252 seconds]
12:59 -!- Guest64860 [~KING@58.97.132.210] has left #openvpn []
13:10 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
13:11 < grendal-prime> got a manager wants to know if we can tie a key to a spcific mac address
13:12 < krzee> if so, i think it would be a tls-auth script
13:24 < EugeneKay> MAC address is a piss-poor thing to authenticate by. They're changable on a whim.
13:27 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:29 -!- tjz_ [~pc@bb220-255-32-79.singnet.com.sg] has joined #openvpn
13:30 -!- Dougy [me@tech.qsi.net] has joined #openvpn
13:30 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:31 -!- pr0z0id [pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
13:32 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
13:32 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
13:34 -!- cron2_ [~gert@kirk.greenie.muc.de] has quit [Changing host]
13:34 -!- cron2_ [~gert@openvpn/community/developer/cron2] has joined #openvpn
13:34 -!- EvilGuru_ [~freddie@helium3.witherden.org] has joined #openvpn
13:34 -!- krphop_ [~krphop@74.82.160.100] has joined #openvpn
13:36 -!- Jarpse_ [~jarpse@84-245-22-127.dsl.cambrium.nl] has joined #openvpn
13:37 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:37 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Disconnected by services]
13:37 -!- hyper__ch is now known as hyper_ch
13:37 -!- kanyl_ [~kanyl@unaffiliated/kanyl] has joined #openvpn
13:38 -!- Netsplit *.net <-> *.split quits: dijital1, pr0zoid, cron2, @vpnHelper, krzee, inimino, Dougy_, EvilGuru, trumee, kanyl,  (+7 more, use /NETSPLIT to show all of them)
13:41 -!- Netsplit over, joins: trumee
13:42 -!- Netsplit over, joins: vpnHelper
13:42 -!- mode/#openvpn [+o vpnHelper] by ChanServ
13:42 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
13:44 -!- naquad_ [~naquad@174.142.224.219] has joined #openvpn
13:45 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
13:46 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
13:47 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
13:48 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
13:48 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:52 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
13:52 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664.html#p14879> || OpenVPN client multiple server setting <http://forums.openvpn.net/topic8680.html>
13:55 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:55 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:10 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
14:10 -!- corretico [~luis@200.12.40.17] has joined #openvpn
14:16 <@vpnHelper> RSS Update - forum: OpenVPN client multiple server setting <http://forums.openvpn.net/topic8680.html#p14880>
14:27 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
14:27 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664-15.html#p14881>
14:28 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
14:46 <@vpnHelper> RSS Update - forum: OpenVPN client multiple server setting <http://forums.openvpn.net/topic8680.html#p14882>
14:47 -!- dazo is now known as dazo_afk
14:47 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 258 seconds]
14:48 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
14:48 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:57 -!- Denial [~Denial@drgi.co.uk] has quit []
15:04 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
15:27 -!- sathia [~quassel@host124-210-dynamic.50-79-r.retail.telecomitalia.it] has joined #openvpn
15:28 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664-15.html#p14883>
15:28 -!- sathia [~quassel@host124-210-dynamic.50-79-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
15:43 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has joined #openvpn
15:43 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
15:46 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Read error: Connection reset by peer]
15:46 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
15:58 -!- EvilGuru_ is now known as EvilGuru
15:58 -!- EvilGuru [~freddie@helium3.witherden.org] has quit [Changing host]
15:58 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has joined #openvpn
16:00 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
16:02 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has quit [Remote host closed the connection]
16:02 -!- Cain [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
16:12 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Ping timeout: 252 seconds]
16:12 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has quit [Remote host closed the connection]
16:17 -!- krphop_ is now known as krphop
16:42 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Ping timeout: 246 seconds]
16:44 -!- patel [~patel@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
16:52 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
17:03 -!- kaibosher [~pingwing@dsl-46-63.dsl.netsource.ie] has joined #openvpn
17:05 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has quit [Read error: Connection reset by peer]
17:11 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 260 seconds]
17:19 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:26 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has joined #openvpn
17:26 -!- pr0z0id [pr0zoid@24-246-5-196.cable.teksavvy.com] has left #openvpn []
17:30 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has quit [Remote host closed the connection]
17:32 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has joined #openvpn
17:53 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has quit [Read error: Connection reset by peer]
17:54 -!- kanyl_ is now known as kanyl
18:02 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has joined #openvpn
18:05 -!- kaibosher [~pingwing@dsl-46-63.dsl.netsource.ie] has quit [Read error: Connection reset by peer]
18:05 -!- upz [~uuuppz@213.79.53.61] has joined #openvpn
18:05 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has joined #openvpn
18:07 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 260 seconds]
18:14 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has quit [Remote host closed the connection]
18:17 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has joined #openvpn
18:17 -!- EugeneKay is now known as EugeneKaway
18:18 -!- fread2281 [~fread2281@70-56-131-160.albq.qwest.net] has quit [Remote host closed the connection]
18:22 -!- upz [~uuuppz@213.79.53.61] has quit [Ping timeout: 252 seconds]
18:22 <@vpnHelper> RSS Update - forum: Building a custom installer for windows <http://forums.openvpn.net/topic8681.html>
18:24 -!- kyrix [~ashley@46.207.255.104] has quit [Quit: Ex-Chat]
18:28 < reiffert> is there anything beyond true blood and warehouse 13?
18:28 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
18:34 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
18:36 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has quit [Read error: Connection reset by peer]
18:38 -!- Macphist` [~user@c-98-218-81-248.hsd1.va.comcast.net] has joined #openvpn
18:40 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has quit [Ping timeout: 252 seconds]
18:45 -!- Macphist` [~user@c-98-218-81-248.hsd1.va.comcast.net] has quit [Ping timeout: 252 seconds]
18:58 -!- Squidy_at_Home [~quassel@189-31-41-227.cbace701.dsl.brasiltelecom.net.br] has joined #openvpn
19:03 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Quit: where wizards stay up late...]
--- Log closed Fri Aug 19 19:05:07 2011
--- Log opened Fri Aug 19 19:05:15 2011
19:05 -!- ecrist_ [~ecrist@216.17.68.153] has joined #openvpn
19:05 -!- Irssi: #openvpn: Total of 141 nicks [4 ops, 0 halfops, 0 voices, 137 normal]
19:05 -!- ecrist [~ecrist@openvpn/community/support/ecrist] has quit [Read error: Connection reset by peer]
19:05 -!- Irssi: Join to #openvpn was synced in 33 secs
19:08 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
19:10 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html>
19:15 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has left #openvpn []
20:18 -!- corretico [~luis@200.12.40.17] has quit [Remote host closed the connection]
20:37 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
20:37 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has joined #openvpn
20:44 -!- Denial [~Denial@drgi.co.uk] has quit []
20:50 -!- incidence [jussi@unaffiliated/incidence] has quit [Ping timeout: 260 seconds]
20:52 -!- Squidy_at_Home [~quassel@189-31-41-227.cbace701.dsl.brasiltelecom.net.br] has quit [Ping timeout: 258 seconds]
20:52 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
21:11 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:22 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has joined #openvpn
21:53 -!- caesay [~caesay@unvanquished/associate/caesay] has quit [Remote host closed the connection]
21:53 -!- caesay [~caesay@socialshock.net] has joined #openvpn
21:54 -!- caesay is now known as Guest74343
21:59 <@vpnHelper> RSS Update - forum: how to add more port <http://forums.openvpn.net/topic8605.html#p14886>
22:06 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
22:18 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
22:31 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has quit [Read error: Connection reset by peer]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:34 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has joined #openvpn
22:34 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has quit [Excess Flood]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:52 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
22:55 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:04 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
23:07 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
23:10 -!- diegovio1a [~diego@2.102.23.190.res.adsl.dyn.click.com.py] has joined #openvpn
23:11 -!- lrussell [18f759b5@gateway/web/freenode/ip.24.247.89.181] has joined #openvpn
23:12 < diegovio1a> lrussell: welcome
23:12 < lrussell> hello
23:14 < lrussell> how would I tunnel a windows samba share through openvpn without using ports 80 23 119 110 21 1080 135 139 593 445 25 143 8080 and not disabling local file sharing?
23:16 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:19 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
23:19 -!- diegovio1a [~diego@2.102.23.190.res.adsl.dyn.click.com.py] has left #openvpn []
23:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:25 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has joined #openvpn
23:28 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:28 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:28 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
23:28 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:32 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
23:33 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:45 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has left #openvpn []
23:45 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
23:47 -!- lrussell [18f759b5@gateway/web/freenode/ip.24.247.89.181] has left #openvpn []
23:50 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has joined #openvpn
23:52 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
23:52 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
23:53 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
--- Day changed Sat Aug 20 2011
00:14 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
00:27 <@vpnHelper> RSS Update - forum: OpenVPN client multiple server setting <http://forums.openvpn.net/topic8680.html#p14887>
00:46 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664-15.html#p14888>
00:49 -!- K1ng [~KING@180.211.188.32] has joined #openvpn
00:52 <@vpnHelper> RSS Update - forum: how to add more port <http://forums.openvpn.net/topic8605.html#p14889>
00:58 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
01:52 <@vpnHelper> RSS Update - forum: Installation Issues on Fedora <http://forums.openvpn.net/topic8683.html>
01:58 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664-15.html#p14891>
02:08 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:09 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
02:16 -!- Hamlin [~Hamlin@mountainmorningband.com] has quit [Ping timeout: 246 seconds]
02:17 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
02:19 -!- Hamlin [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has joined #openvpn
02:45 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
02:45 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
02:45 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
02:52 -!- stephenh [~stephenh@unaffiliated/stephenh] has quit [Ping timeout: 252 seconds]
02:59 -!- EugeneKaway is now known as EugeneKay
03:07 -!- incidence [jussi@unaffiliated/incidence] has joined #openvpn
03:41 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
03:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
03:55 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
03:55 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
04:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:06 -!- mode/#openvpn [+o mattock] by ChanServ
04:23 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
04:24 -!- Titania [~titania@221.120.122.106] has joined #openvpn
04:25 -!- Titania [~titania@221.120.122.106] has quit [Max SendQ exceeded]
04:26 -!- Titania [~titania@221.120.122.106] has joined #openvpn
04:33 -!- Titania [~titania@221.120.122.106] has quit [Quit: Will return someday...]
04:41 -!- ionrupt [~user@189.100.86.191] has joined #openvpn
04:42 < ionrupt> hello guys, i'm getting some errors with OpenVpn client, it connects succcessfully, yet i still have my old IP
04:47 < hyper_ch> ionrupt: and where is the error in that?
04:47 < EugeneKay> Platform? Configs? Logs?
04:47 -!- mode/#openvpn [+o EugeneKay] by ChanServ
04:47 -!- EugeneKay changed the topic of #openvpn to: Current Release: 2.2.1 (6-July-2011) || Your problem is your firewall, really. || See !welcome and !goal || Access Server goto #openvpn-as || We're not psychic. We need !configs and !logs and a description of the issue.
04:48 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
04:49 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 268 seconds]
04:49 < ionrupt> hyper_ch: its normal to have my original IP while im connected to the VPN ?
04:50 < hyper_ch> well... you need to have an internet connection somehow
04:50 < ionrupt> I used vpn years ago and i remember having the VPN's ip when surfing the internet
04:50 < EugeneKay> "original IP" ? As in, the result you get when visiting whatismyip.com? WHat ARE you trying to do? (See !goal)
04:51 < ionrupt> EugeneKay: by originl IP i mean my real IP. i try to mask it
04:51 < ionrupt> what i want is to connect to a vpn server and have the vpn's IP
04:52 < EugeneKay> !redirect
04:52 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
04:53 < EugeneKay> OpenVPN, by default, is simply a TLS-based tunnel. You need to tell it what to do. ;-)
04:53 < ionrupt> im a windows user, i was gussing that all these are set by default...
04:53 < EugeneKay> You guessed wrong
04:53 < EugeneKay> If you're trying to run the Server instance on a Windows box.... well... good luck with that. YOu'll need it.
04:54 < ionrupt> no, i jut purchased a certificate , im just a client
04:54 < EugeneKay> From an OpenVPN service provider ?
04:55 < ionrupt> so right now, when the status of my OpenVPN is green , showing "connected" ... it means that all my internet traffic is encrypted, even if the IP is not masked?
04:55 < EugeneKay> Nope.
04:56 < EugeneKay> Without !logs, I can't tell you what it means at all
04:56 < EugeneKay> See bit about not being psychic
04:56 < Bushmills> ionrupt: what would those do who don't want all their traffic sent over vpn, but only specific traffic to other vpn machines, if all traffic would be sent through vpn by default? 
04:57 < ionrupt> i understand. so now how do i redirect the traffic? [im running windoes vista]
04:57 < EugeneKay> !redirect
04:57 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
04:57 < Bushmills> by reading the factoid EugeneKay showed you
04:57 < Bushmills> (and doing what it says)
04:57 < ionrupt> !def1
04:58 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
05:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
05:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
05:14 < ionrupt> ok guys thank you
05:18 -!- ionrupt [~user@189.100.86.191] has quit [Remote host closed the connection]
05:21 <@vpnHelper> RSS Update - forum: how to add more port <http://forums.openvpn.net/topic8605.html#p14892>
05:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:34 -!- ionrupt [~user@189.100.86.191] has joined #openvpn
05:36 < ionrupt> would it help if i show u what's inside my "cofig.openvpn" file? maybe you could figure out why it doesnt rute/forward my ip and traffic
05:38 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:42 < ionrupt> :-D
05:42 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
05:42 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
05:42 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:43 -!- ionrupt [~user@189.100.86.191] has quit [Remote host closed the connection]
05:48 -!- ionrupt [~user@189.100.86.191] has joined #openvpn
05:50 < ionrupt> would it help if i show u what's inside my "cofig.openvpn" file? maybe you could figure out why it doesnt rute/forward my ip and traffic
05:52 < krzee> config.openvpn?
05:52 < krzee> what os are you in?
05:52 < ionrupt> Vista
05:53 < krzee> then thats not the filename
05:53 < ionrupt> C:\Program Files\OpenVPN\config >>> config.openvpn
05:53 < krzee> config.ovpn maybe
05:53 < ionrupt> ure correct
05:53 < krzee> !goal
05:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:54 < ionrupt> I want encrypted traffic to the vpn server + i need to suft internet using the VPN's IP
05:54 < ionrupt> surf*
05:55 < krzee> ahh ok
05:55 < krzee> !redirect
05:55 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
05:56 < krzee> what OS is the server?
05:56 < ionrupt> that i dont know. i bought the cert
05:56 < ionrupt> for one month
05:56 < krzee> ahh
05:57 < EugeneKay> You'll need to speak to the people you bought the service from
05:57 < krzee> you should likely get support from them
05:57 < krzee> we can look at your logfile and maybe help
05:57 < krzee> but its likely you'll need them
05:58 < ionrupt> only if they would reply, they're online but always idle, very frustrating :)
05:58 < krzee> !logs
05:58 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
06:00 < ionrupt> here is the content of the config.ovpn   http://pastebin.com/fKy8MT6i
06:01 < ionrupt> the last 3 lines should take care of the redirect/forwarding etc... right?
06:02 < EugeneKay> "dev tap"
06:02 < EugeneKay> Oy vey.
06:02 < ionrupt> pls be more explicit EugeneKay
06:02 < EugeneKay> !tunortap
06:02 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
06:02 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
06:03 < EugeneKay> Basically, there is no reason to be using TAP in your scenario. At all.
06:03 < ionrupt> so i delete that line. ok
06:03 < EugeneKay> No, not really.
06:03 < ionrupt> then?
06:04 < EugeneKay> If that's what your provider is using, then you'll need to use it to use their service. But I would run like hell, because that means they don't have a clue what they're doing. 
06:04 < EugeneKay> There is no legitimate reason to be using TAP. 
06:04 < EugeneKay> (for a vpn redirect service)
06:04 < ionrupt> what would be an illegitimate reason/
06:04 < ionrupt> ?
06:05 < EugeneKay> Stupidity and "the HowTo said so" are the top reasons.
06:05 < EugeneKay> The only, ONLY reasons to use TAP are: Experimental IPv6 support(using client-based scripts) and Ye Olde Games that do IPX/SPX or some crazy crap.
06:05 < ionrupt> isee
06:06 < ionrupt> so what does it need to be changed in my file?
06:06 < EugeneKay> dev tun would be the alternative, but it has to be the same value on both sides. See above about running like hell.
06:08 < ionrupt> do i need to delete or add any line in my config.ovpn file?
06:08 < EugeneKay> You'll really need to speak with your openvpn provider. 
06:08 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
06:08 < ionrupt> ok
06:16 < krzee> [04:06]  <EugeneKay> If that's what your provider is using, then you'll need to use it to use their service. But I would run like hell, because that means they don't have a clue what they're doing. 
06:16 < krzee> i strongly agree
06:17 < krzee> furthermore, i would also test if they have client-to-client enabled as well, because any user could arp poison any other user in that scenario
06:22 < hyper_ch> hi krzee
06:22 < hyper_ch> I bring good news to you
06:32 < reiffert> moin
06:39 < hyper_ch> hi reiffert
06:40 < hyper_ch> krzee: setting up an own weave server is simple :)
06:40 < hyper_ch> with my move back to FF I can now sync my stuff over the vpn to my weave server
06:42 -!- naquad_ [~naquad@174.142.224.219] has quit [Quit: ZNC - http://znc.sourceforge.net]
06:46 -!- GTAXL [~gtaxlnetw@oh-76-2-241-26.dhcp.embarqhsd.net] has quit [Ping timeout: 252 seconds]
06:49 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
07:04 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
07:39 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
07:54 -!- ionrupt [~user@189.100.86.191] has left #openvpn []
07:54 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14894> || Installation Issues on Fedora <http://forums.openvpn.net/topic8683.html#p14893>
08:01 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:01 <@vpnHelper> RSS Update - forum: passphrase in /etc/init.d client start script <http://forums.openvpn.net/topic8678.html#p14895>
08:02 < hyper_ch> krzee: :(
08:08 -!- zheng [~zheng@180.157.4.220] has joined #openvpn
08:20 -!- zheng [~zheng@180.157.4.220] has quit [Quit: Leaving]
08:20 -!- zheng [~zheng@180.157.4.220] has joined #openvpn
08:37 <@vpnHelper> RSS Update - forum: CA file got corrupted.. please help! <http://forums.openvpn.net/topic8684.html>
08:55 -!- zheng [~zheng@180.157.4.220] has quit [Read error: Connection reset by peer]
08:59 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
09:00 -!- Sicelo [qhubekela@unaffiliated/sicelo] has joined #openvpn
09:01 < Sicelo> hi everyone
09:01 < Sicelo> !welcome
09:01 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:01 < Sicelo> !goal
09:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:01 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
09:01 -!- master_of_master [~master_of@p57B55189.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:01 < Sicelo> !howto
09:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:03 -!- master_of_master [~master_of@p57B55824.dip.t-dialin.net] has joined #openvpn
09:06 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 258 seconds]
09:12 -!- zheng [~zheng@180.157.4.220] has joined #openvpn
09:19 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 260 seconds]
09:19 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
09:32 < hyper_ch> krzee: http://i.imgur.com/KvFCO.jpg
09:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:40 < reiffert> hyper_ch: is that you at your place?
09:40 < hyper_ch> reiffert: just found it on the web
09:40 < hyper_ch> never go for a short walk when drunk ;)
10:00 -!- zheng [~zheng@180.157.4.220] has quit [Quit: Leaving]
10:14 -!- pranq [pranq@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
10:20 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
10:46 -!- corretico_ [~luis@190.124.250.206] has joined #openvpn
10:48 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
10:49 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has left #openvpn ["cat dijital1 > /dev/null"]
11:42 -!- v8r8noo [~v8r8noo@81.198.83.162] has joined #openvpn
11:47 -!- v8r8noo [~v8r8noo@81.198.83.162] has quit [Quit: Ex-Chat]
11:47 -!- fread2281 [~fread2281@70-56-208-127.albq.qwest.net] has joined #openvpn
12:06 <@vpnHelper> RSS Update - forum: WIN 7 Client, reach just the server. Other clients works <http://forums.openvpn.net/topic8685.html>
12:07 -!- corretico_ [~luis@190.124.250.206] has quit [Read error: Connection reset by peer]
12:24 -!- corretico_ [~luis@190.124.250.206] has joined #openvpn
12:29 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
12:44 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:44 -!- mode/#openvpn [+v s7r] by ChanServ
12:59 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
13:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:35 < krzee> hyper_ch, whats a weave server...?
13:35 < hyper_ch> krzee: that's the mozilla server for their sync backend
13:36 < hyper_ch> I assume you know firefox sync?
13:36 < krzee> nah
13:36 < hyper_ch> awwwwwwww
13:36 < krzee> i dont use firefox
13:36 < krzee> i mean i have it for osx,windows,linux... but i dont really use it
13:36 < krzee> lol
13:37 < hyper_ch> I switched back from chromium to ff
13:38 -!- pranq [~pranq@unaffiliated/contempt] has joined #openvpn
13:41 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 246 seconds]
13:42 < EugeneKay> I <3 my fox
13:44 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 276 seconds]
13:50 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
13:50 -!- mode/#openvpn [+o mattock] by ChanServ
13:55 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
13:55 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:55 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:12 < hyper_ch> EugeneKay: you run it on multiple devices?
14:12 < hyper_ch> krzee: what browser do you use? links2?
14:12 < EugeneKay> Firefox? Yes.
14:12 < hyper_ch> EugeneKay: you use the sync option?
14:12 < EugeneKay> I have sync setup betweeen my laptop, desktop, both tablets, and phone.
14:13 < EugeneKay> Works good.
14:13 < hyper_ch> but you don't run your own sync server?
14:13 < EugeneKay> Nope, haven't bothered ith that yet.
14:13 < hyper_ch> :)
14:13 < EugeneKay> Really ought to, but eh.
14:13 < hyper_ch> it's simple to setup
14:13 < EugeneKay> I don't doubt it. What's it entail?
14:14 < EugeneKay> OW DAMNIT MY LEG WENT TO SLEEP AND I TRIED TO UNFOLD IT
14:14 < EugeneKay> Oh this is pain
14:14 < krzee> opera
14:16 < hyper_ch> EugeneKay: http://docs.services.mozilla.com/howtos/run-sync.html
14:16 <@vpnHelper> Title: Run your own Sync Server Mozilla Services (at docs.services.mozilla.com)
14:16 < hyper_ch> I still have to figure out what the wsgi is supposed to be for
14:16 < hyper_ch> it runs fine without it
14:16 < hyper_ch> and wrote little monit scripts to keep it up and running
14:19  * EugeneKay bookmarks
14:19 < hyper_ch> EugeneKay: you then need to edit the sync.conf script in the "etc" subfolder
14:19 < hyper_ch> and change the sqlite db location from /tmp to whereever you want
14:20 < hyper_ch> I haven't tried other backends yet
14:23 -!- fread2281 [~fread2281@70-56-208-127.albq.qwest.net] has quit [Remote host closed the connection]
14:32 < krzee> !certinfo
14:33 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
14:33 < krzee> !certverify
14:33 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
14:55 -!- corretico_ [~luis@190.124.250.206] has quit [Ping timeout: 252 seconds]
14:57 -!- Davion [~Davion@unaffiliated/davion] has joined #openvpn
14:58 < Davion> hello there
14:58 < Davion> yesterday I've shifted to ubuntu 11.04
14:59 < Davion> but despite i read a lot of tutorials etc.
14:59 < Davion> i still didn't realize how to install and use my shieldexchange (openvpn) system here
14:59 < Davion> it was very easy with autoinstaller when i was using windows
15:00 < Davion> but however didn't work here
15:00 < Davion> any help will perfectly welcome
15:00 < krzee> well wheres the problem...?
15:00 < krzee> "didnt work here" isnt enough to help you
15:04 -!- Davion [~Davion@unaffiliated/davion] has quit [Ping timeout: 240 seconds]
15:06 < EugeneKay> hyper_ch - no RPMs yet? :-(
15:06 < hyper_ch> why do you need rpms?
15:06 < hyper_ch> rpms are evil
15:06 < EugeneKay> .....because I run SL? :-p
15:06 < hyper_ch> sl?
15:07 < EugeneKay> Scientific Linux, the RHEL rebuild by Fermilab / CERN
15:07 < EugeneKay> It powers the Large Hadron Collider. How could you not like that?
15:07 < hyper_ch> oh CERN.,.. that ain't too far away
15:07 < hyper_ch> what time is it for you?
15:08 < EugeneKay> Sat Aug 20 20:07:58 UTC 2011
15:08 < EugeneKay> Or do you mean out the window?
15:08 < hyper_ch> EugeneKay: oh, I think they succeeded with generating a black hole
15:08 < hyper_ch> the time dilation is already in effect
15:08 < EugeneKay> It's bright out, so I think that means it's afternoon?
15:08 < hyper_ch> my clock shows 22:08 :)
15:09 < EugeneKay> Pffft local timezone. UTC or gtfo
15:09 < hyper_ch> but why do you need rpms for the weave server?
15:09 < hyper_ch> just fetch sources by mercurial
15:09 < hyper_ch> install the few dependencies and it runs just fine
15:09 -!- corretico_ [~luis@200.12.40.17] has joined #openvpn
15:10 < EugeneKay> Because I'm one of those guys who refuses to maintain his own repo for packages, and likes to keep everything within the package manager
15:10 < hyper_ch> the weave server isn't updated that much I think
15:10 < EugeneKay> Though if it's a webapp, I suppose that should be fine
15:10 < hyper_ch> but I do't
15:10 < hyper_ch> on the other hand, you could be come Weave RPM maintainer ;)
15:11 < EugeneKay> I could. 
15:11 < EugeneKay> That would be sickening.
15:11 < EugeneKay> Me, in charge of something!
15:11  * EugeneKay goes back to fiddling with his new IPv4 allocation
15:12 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
15:13 -!- Davion [~Davion@unaffiliated/davion] has joined #openvpn
15:13 < Davion> sorry, disconnected
15:14 < Davion> but im still very desperate about installing my shieldexchange to linux =(
15:14 < EugeneKay> I've no a clue what Shield Exchange is, sorry.
15:14 < Davion> it's an openvpn service, provided by openvpn's itself i guess
15:15 < hyper_ch> Davion: sudo apt-get install openvpn
15:15 < hyper_ch> and then just set the client.conf and keys
15:15 < hyper_ch> dne
15:15 < hyper_ch> done
15:15 < EugeneKay> You'll need to install the openvpn package and place the config file into the /etc/openvpn/ dir, along ith the crts/keys theygave you. For anything more than that, we'd need to see !configs and !logs, and a description of the issue.
15:15 < hyper_ch> if it's really openvpn
15:16 < Davion> Reading state information... Done
15:16 < EugeneKay> Shield Exchage appears to be the openvpn, inc offered service
15:16 < Davion> openvpn is already the newest version.
15:16 < EugeneKay> From their website, anyway
15:16 < Davion> openvpn set to manually installed.
15:16 < Davion> 0 upgraded, 0 newly installed, 0 to remove and 196 not upgraded.
15:16 < Davion> yes, but they don't provide information how to install it on linux
15:16 < Davion> they've just providing autoinstaller for win users, 1-click install/use
15:17 < hyper_ch> you still have the windows config.ovpn file?
15:17 < EugeneKay> You'll need to contact them to get a conf/key/crt/ca bundle
15:17 < Davion> let me check please
15:17 < Davion> 1 sec.
15:17 < hyper_ch> EugeneKay: he should have the certs and stuff from his windows install
15:17 < Davion> i have certificate (ca)
15:17 < EugeneKay> Also, "196 not upgraded". You should run apt-get update and refresh your packages, mate.
15:17 < EugeneKay> Bugfixes are available.
15:18 < hyper_ch> EugeneKay: actually,  dist-upgrade and not just update
15:18 < EugeneKay> Whatever. I don't speak Ubuntu.... and when I do, it's a LTS.
15:19 < hyper_ch> Davion: you should also have the key, crt and the opvn config file
15:27 < Davion> yep
15:27 < Davion> i've the files
15:27 < Davion> .conf
15:27 < EugeneKay> Drop all four of those files into the irectory I mentioned
15:27 < EugeneKay> .ovpn will need to be renamed to .conf for linux init scripts to comprehend it
15:27 < EugeneKay> It should "just work"
15:28 < hyper_ch> the .ovpn file should be called:  client.conf
15:28 < hyper_ch> after you dropped it all into the same folder
15:29 < hyper_ch> also make sure that the client.conf has the right path to the cert files
15:29 < hyper_ch> after that just:  sudo /etc/init.d/openvpn restart
15:29 < hyper_ch> and you should be up and running
15:29 < EugeneKay> The paths ought to be relative, if it was provided as a bundled package
15:30 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:31 < Davion> it needs elevation =.=
15:31 < Davion> Error opening file '/etc/openvpn/as.conf': Permission denied
15:31 < EugeneKay> Means you need to change the owner to whatever openvpn is expecting it to be. On Ubuntu.... not a clue what this is
15:32 < EugeneKay> It should work fi you chmod the lot to 755, though that has security risks :-p
15:32 < hyper_ch> EugeneKay: I tend to think the provider is using Access Server
15:32 < hyper_ch> why else would it be "as.conf"?
15:32 < EugeneKay> Point.
15:33 < EugeneKay> And it's not "using", this is "is"
15:35 < hyper_ch> if it is access server, you're in the wrong channel.... you need to go to  #openvpn-as
15:40 < Davion> thank you hyper_ch
15:40 < Davion> im there
15:40 < Davion> hopefully i'll find help =\
15:40 -!- corretico_ [~luis@200.12.40.17] has quit [Ping timeout: 260 seconds]
15:40 < Davion> and thanks EugeneKay
15:40 < Davion> good bye
15:40 -!- Davion [~Davion@unaffiliated/davion] has left #openvpn []
15:41 < hyper_ch> EugeneKay: already created the .rpm?
15:42 < EugeneKay> hyper_ch - no, I'm working on other stuff. My IP allocation just came through.... I have a new /26 and /29 to setup, replacing a /28 and a /27.
15:42 < hyper_ch> that sounds like a lot of IPs
15:42 < hyper_ch> can I have a few?
15:42 < hyper_ch> :)
15:43 < EugeneKay> I'd have to allocate you a VM, and I'm not a VPS provider. I have a linode referral link you can use, though. http://s.eugenekay.com/linode
15:43 <@vpnHelper> Title: Linode - Xen VPS Hosting (at s.eugenekay.com)
15:44 < hyper_ch> nah, I have plenty of ips myself that I don't even use
15:44 < EugeneKay> My IPv6 allocation, on the other hand, needs no expanding. They gave me two /48s worth. :-D
15:44 < hyper_ch> I don't believe in ipv6
15:44 < hyper_ch> that's only a scary tale that parents tell their children before they need to sleep
15:44 < EugeneKay> Enjoying your rotary phone, too?
15:45 < EugeneKay> IPv6 is the future. IPv4 is getting scarce, bub.
15:45 < hyper_ch> what's scarce goes up in price :)
15:45 < hyper_ch> how do you even get an ipv6 allocation?
15:46 < EugeneKay> From your RIR? Same way you get an IPv4 one, by paying $1250 and filling out the form.
15:46 < hyper_ch> I never applied for any ip allocation
15:46 < EugeneKay> From your ISP? By asking nicely. My servers are coloed with Hurricane Electric, who are THE ipv6 carrier.
15:46 < hyper_ch> and the $1250 is a yearly recurrence?
15:47 < EugeneKay> If you're gonna be re-serving those addresses to somebody, yes. If it's for an end-user(personal), then it's a $100 yearly
15:47 < hyper_ch> hmmm
15:47 < EugeneKay> You get a /32, a bit extra for your ASN. 
15:47 < hyper_ch> so assuming you get end-uzser IPs
15:47 < hyper_ch> how do you even make use of them?
15:48 < EugeneKay> You need to get BGP on a /48 for your site
15:48 < EugeneKay> HE provides a free tunnel broker that does BGP.
15:48 < hyper_ch> this gets more and more complicated :)
15:48 < EugeneKay> Which is where my second /48 comes from - I have a 6in4 tunnel for my home DSL.
15:48 < jeev> ipv6 costs are too expensive
15:48 < jeev> a small isp who wants a block, sometimes 1250 or 2500 or whatever is costly
15:48 < EugeneKay> Uh, that's the same they charge for IPv4?
15:49 < EugeneKay> Look at the fee schedule, bub.
15:49 < jeev> yea, except there is a BUTTLOAD of ipv6 available
15:49 < EugeneKay> Plus, if you have an IPv4 allocation, your IPv6 block is free, for the ame price-range block
15:49 <@vpnHelper> RSS Update - forum: Hello Friends My Name is Arden Please Review my Website <http://forums.openvpn.net/topic8675.html#p14898>
15:49 < hyper_ch> so, me being a small business usually using DSL connection for internet... how would I get my own ipv6 addresses that I also could "take" with me if I ever changed ISP?
15:49 < jeev> hyper_ch, you dont
15:50 < hyper_ch> but isn't it the whole point of ipv6 that you can even get one for your fridge?
15:50 < EugeneKay> Small business? Fill out the ARIN form(or whatever your RIR is), pay the fee, get your allocation.
15:50 < EugeneKay> Then oyu get an ISP to provide you connectivity and BGP announce a /48 from your allocated /32
15:50 < EugeneKay> HE does this gratis via a 6in4 tunnel if you can't get it natively.
15:50 < jeev> good luck
15:50 < hyper_ch> hmmmm
15:51 < jeev> who is your dsl through
15:51 < hyper_ch> the business is hooked up with swisscom
15:51 < EugeneKay> If you just want to experiment, I would recommend getting a HE tunnel and using a block from them before you go through the RIR bullshit.
15:51 < EugeneKay> You'll have to renumber when/if you get an allocation, but only once.
15:51 < hyper_ch> never heard of HE before
15:52 < EugeneKay> http://he.net
15:52 <@vpnHelper> Title: Hurricane Electric Internet Services - Internet Backbone and Colocation Provider (at he.net)
15:52 < EugeneKay> They are THE biggest IPv6 provider.
15:52 < EugeneKay> But I'll let their website do the marketing.
15:52 < jeev> i used to have a big boner back in the days when thinking about HE
15:52 < jeev> and their service
15:52 < jeev> then they started selling below cogent prices
15:52 < jeev> now it's just a softie
15:53 < hyper_ch> it was just my curiosity :)
15:53 < EugeneKay> It's $1/mbps/mo, min purchase of 1Gb. 100mb minimum if you're doing a colo.
15:53 < EugeneKay> (which I m)
15:53 < EugeneKay> am, even. fucking keyboard. DIE!
15:53 < jeev> just cheap bandwidth i think now
15:53 < jeev> i used to consider it premium
15:54 < jeev> now i consider it a hooker
15:54 < jeev> a cheap hooker
15:54 < EugeneKay> Cheap, excellent bandwidth.
15:54 < jeev> egggggggcellent
15:54 < EugeneKay> The only issue is that Cogent has, to date, refused to peer with them on IPv6, to the point of filtering their IPv6 routes. 
15:54 < jeev> why
15:54 <@vpnHelper> RSS Update - forum: IP conflict issues <http://forums.openvpn.net/topic8676.html#p14900> || authentication via cert <http://forums.openvpn.net/topic8677.html#p14899>
15:54 < EugeneKay> Because politics.
15:55 < jeev> hmm, are they the liars (republicans) or the wimps (democrats) ?
15:55 < EugeneKay> Liars.
15:55 < jeev> oh
15:55 < EugeneKay> They don't want to get "stuck" with a peering agreement with a "small-fish".
15:55 < hyper_ch> jeev: how do you know when a politician is lying?
15:55 < jeev> when they're a politician
15:55 < uuuppz> I just don't get why you wqould bother paying for ipv6 bandwidth
15:56 < hyper_ch> jeev: almost
15:56 < uuuppz> whats the advatage?
15:56 < EugeneKay> It's nothing extra. 
15:56 < EugeneKay> $1/mbps/mo is for IPv4 and IPv6 on the same line.
15:57 < uuuppz> ok maybe I'm missing something
15:57 < uuuppz> but I thought that'd be extra
15:57 < uuuppz> ontop of your home internet connection
15:58 < jeev> home ?
15:58 < jeev> i'm sure if you convince the isp to announce your ipv6, they'll be getting extr a$
15:58 < EugeneKay> HE provides 6in4 tunnels for free
15:59 < EugeneKay> All you need is a public IPv4 for it to be pointed at - doesn't even need to be static.
15:59 < jeev> yea i know
15:59 < EugeneKay> Dynamic takes a lil scripting to update when it changes, but within the realm of doability.
16:01 <@vpnHelper> RSS Update - forum: CA file got corrupted.. please help! <http://forums.openvpn.net/topic8684.html#p14903> || Installation Issues on Fedora <http://forums.openvpn.net/topic8683.html#p14902> || OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html>
16:01 < krzee> !factoids
16:01 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:01 < jeev> !bored
16:02 < jeev> "bored" is a krzee
16:02 < krzee> hah
16:04 < EugeneKay> The bot doesn't let me use !learn :-(
16:04 < EugeneKay> I tried to teach it about beer.... but it refused. Poor mechanoid, it's gonna run out of fuel.
16:04 < jeev> cause krzee is a dominatrix
16:05 < krzee> !blame
16:05 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault, or (#2) According to krzee, it's always dazo's fault, or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
16:06 < krzee> so you can blame Bushmills, he'll blame me, ill blame dazo, he'll blame you... then we hit a routing loop
16:06  * EugeneKay curses that dazo
16:06 <@vpnHelper> RSS Update - forum: WIN 7 Client, reach just the server. Other clients works <http://forums.openvpn.net/topic8685.html#p14904>
16:06  * EugeneKay routes it to lo
16:09 < uuuppz> EugeneKay: I think my brain has run out of fuel
16:10 < EugeneKay> Liquor store is two blocks south
16:10 < jeev> porn.
16:11 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has left #openvpn []
16:33 < krzee> !confgen
16:33 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator, or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
16:36 < jeev> hmm i need to start doing SEO on one of my sites
16:37 < krzee> in case anyone is bored and doen to give a second set of eyes...
16:38 < krzee> [14:30]  <krzee> im having a problem generating certs based on a script... seems i have a messed up openssl.conf... could someone take a look at this info and see if anything pops out at them?  http://pastebin.com/juazE5eQ
16:38 < krzee> [14:31]  <krzee> note, this openssl.conf was orig part of a perl script... so maybe i missed something that was only valid to perl and not in a real openssl.conf...
16:38 < krzee> (from #openssl)
16:38 < jeev> wish i oculd help you but i'm lazy and have serious attention issues
16:38 < krzee> LOL nice
16:39 < jeev> i dont get how people could help eachother remotely
16:39 < jeev> it's so hard for me to, i can't explain shit for myself, let alone try to explain to someone how to fix something
16:39 < jeev> i'm so bad at it
16:40 < krzee> !ask
16:40 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, or (#2) http://www.latinsud.com/answer/, or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
16:40 < krzee> #3
16:40 < krzee> =]
16:40 < jeev> huh
16:40 < jeev> i didn't have a question
16:40 < krzee> http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
16:40 <@vpnHelper> Title: How To Ask Questions The Smart Way (at www.catb.org)
16:40 < jeev> and that wont help me if i can't explain it well;D
16:40 < krzee> [14:41]  <jeev> it's so hard for me to, i can't explain shit for myself, let alone try to explain to someone how to fix something
16:40 < krzee> =]
16:41 < jeev> yea i know so
16:41 < jeev> that wont hel me heh
16:41 < krzee> see, you dont read docs! ;]
16:41 < krzee> we found the root problem!
16:43 < jeev> i do
16:43 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
16:43 < jeev> i'm jst lazy to go through it fully
16:43 < jeev> however i did watch the full video here, http://www.youtube.com/watch?v=8gP4Ih58Yzg
16:43 <@vpnHelper> Title: Erdjan - Viski Coca-Cola - YouTube (at www.youtube.com)
17:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
17:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:19 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:31 < reiffert> df -h
17:34 < EugeneKay> /dev/md0              5.4T  223G  5.2T   5% /data
17:34  * EugeneKay weeps for his lost media
17:35 < reiffert> :(
17:37 < EugeneKay> That volume was 95% full, once upon a two weeks ago
17:37 -!- Jedicus [~user@adsl-76-214-197-38.dsl.emhril.sbcglobal.net] has quit [Ping timeout: 240 seconds]
17:37 < EugeneKay> Then I screwed it up
17:40 < reiffert> how so?
17:41 < EugeneKay> Drive popped out of sync after a power blip, another one popped out during the resync. I screwed up the reassemble(create != assemble), and munged the ext4 inode table.
17:41 < EugeneKay> Things went downhill from there.
17:41 < jeev> huh
17:41 < jeev> raid1 ???
17:41 < jeev> i mean how
17:41 < EugeneKay> No, 5.
17:41 < jeev> thought so
17:41 < jeev> damn
17:41 < EugeneKay> It's now 6. 
17:41 < jeev> make it 7
17:42 < EugeneKay> Doesn't go that high, sadly.
17:42 < jeev> how about 482
17:42 < jeev> bah i'm setting up a router and the drive i'm using is making a lot of noises
17:42 < EugeneKay> Now you're just making shit up
17:42 < jeev> i'll assume it's normal ;/
17:42 < reiffert> EugeneKay: what a bad bad bad.
17:42 < EugeneKay> Eh. The drive only holds media.
17:42 < EugeneKay> Well, drives. 
17:42 < EugeneKay> Everything else I keep rsynced to off-site, and another copy on my laptop.
17:43 < reiffert> EugeneKay: thought about having a backup yet?
17:43 < EugeneKay> Why? It's media.
17:43 < jeev> pr0n.
17:43 < EugeneKay> TV series, Movies, etc.
17:43 < EugeneKay> All replacable 
17:43 < reiffert> k
17:44 < EugeneKay> My Music I treat with a bit more care.... it's mirrored by the Subsonic install on my webserver
17:44 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
17:44 < EugeneKay> It just makes it difficult to watch the Rocky Horror Picture Show whenever I want
17:45 < reiffert> :)
17:45 < reiffert> it's a just a jump to the left
17:45 < EugeneKay> AND A STEP TO THE RI-I-I-IIIGHT
17:46 < EugeneKay> damnit, now you have me singing at my desk
17:46 < reiffert> same here
17:46 < EugeneKay> I refuse to crossdress at this hour, though. 
17:47 < reiffert> whenever you come to munich, there is a movie theater playing TRHPS twice per day
17:48 < jeev> so he lost like 100gigs of regular stuff and 5tb of porn
17:50 < reiffert> http://muenchen.movietown.eu/
17:50 < reiffert> ah well, twice per week.
17:50 < EugeneKay> Actually it was 164GB of pr0n.
17:51 < EugeneKay> I happen to really like House, and Battlestar Galactica, and Farscape, and Stargate, and Dexter, and James Bond movies, and..... you get the idea.
17:51 < reiffert> eugenekay.com give me a 404 btw
17:51 < EugeneKay> reiffert - the other 12 performances per week is just how people in Germany watch movies
17:52 < EugeneKay> It would. There's nothing in that directory. Try img.eugenekay.com, but don't click too freely.
17:52 < reiffert> EugeneKay: reifferscheid.org returns a 404 as well ;)
17:53 < reiffert> EugeneKay: and it's gallery.reifferscheid.org at my place
17:53 < EugeneKay> Img is more for storing lolcat stuff. The family photo album is http://kashpureff.org/album/
17:53 <@vpnHelper> Title: Kashpureff Family Photo Album (at kashpureff.org)
17:53 -!- Jedicus [~user@adsl-76-214-197-38.dsl.emhril.sbcglobal.net] has joined #openvpn
18:02 -!- amero [~amero@unaffiliated/amero] has quit [Read error: Operation timed out]
18:03 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 264 seconds]
18:19 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
18:19 -!- amero [~amero@2607:f358:1:fed5:22:0:82a3:ca56] has joined #openvpn
18:19 -!- amero [~amero@2607:f358:1:fed5:22:0:82a3:ca56] has quit [Changing host]
18:19 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
18:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:36 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
18:36 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
18:36 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
18:36 < Xgates> hey guys
18:36 < Xgates> anyone using torrents with OpenVPN?  I'm trying to figure out when I'm on the VPN I see port hits on my firewall to me, when I figure I should not be getting these behind the VPN, as in, not being seen to hit me...
18:36 < Xgates>  so I'm at a loss to understand why I'm dropping IPs and Port packets coming at me, when they should just be hitting the VPN IP and Ports...
18:37 < reiffert> there are coming over the vpn or over the normal LAN connection?
18:37 < Xgates> hey reiffert 
18:38 < Xgates> when I'm connected to the VPN I can see in my firewall log that it's dropping packets from the IPs on the Tracker, coming to my Destination LAN hitting me on my ports
18:39 < reiffert> what is "destination lan" for that case?
18:39 < Xgates> one sec I'll show ya the logs I put on pastebin eariler
18:40 < reiffert> sigh.
18:41 < Xgates> http://pastebin.com/9AB1hSdq
18:41 < Xgates> My DST=192.168.1.3
18:41 < Xgates> the logs filled up so bad cron had to rotate them hehe
18:42 < Xgates> I just don't get how being connected with an OpenVPN server, routed over the vpn I'm taking hits like that on the port
18:42 < reiffert> never mind, I stop here and get back to something serious now. I'm Sorry.
18:43 < Xgates> sorry I'm not serious enough, actually I'm an IT Tech and this is for a VPN business I'm trying to help just to let you know
18:43 < Xgates> anyhow....
18:44 < Xgates> anyone breathing around here that can help me out with this?
18:44 < reiffert> sorry for hopping on your topic in the first place, just ignore me.
18:45 < Xgates> no worries just the way you said it made me feel like I wasn't worth the time...
18:45 < Xgates> anyhow....
18:45 < Xgates> the place seems to be always dead when I come into too, surprising considering how popular OpenVPN is...
18:46 < reiffert> On the contrary, it wasn't worth my time when I ask questions and get non-related answers, so I considered not to continue here. It was my fault.
18:47 < Xgates> You asked me for the "destination lan"  and I showed it to you -- <Xgates> My DST=192.168.1.3
18:47 < reiffert> ah well, non-related or to explain better not as much as precise they could help me.
18:47 < reiffert> well there is plenty of possible answer stuff, like eg
18:47 < reiffert> your torrent client is UPNP'ing your gateway
18:48 < reiffert> another computer is running a torrent client on the vpn subnet
18:48 < Xgates> sorry I forgot to mention it, I'm on Linux there is not UPNP in Linux
18:48 < Xgates> that's Windows
18:48 < reiffert> and so on. tcpdump will help you, or wireshark if windows.
18:48 < reiffert> wrong again. it's the torrent client that does upnp stuff.
18:49 < reiffert> like requesting to forward a particular port to your machine and so on
18:49 < Xgates> my bad it's not to common for upnp in Linux I meant...
18:50 < reiffert> but to get back to the intial wtf, I cant see any relationship to vpn at your problem.
18:51 < Xgates> why not? If you routed over the VPN showing this as your only source of an IP then how are IPs hitting you at your destination? Seems like some sort of routing issue?
18:52 < reiffert> your shorewall is not part of the vpn.
18:53 < Xgates> Firewalls have nothing to do with this, not sure why you brought that up, maybe you think I did, I was just showing you logs that I'm getting hit, the IPs are going past the VPN and seeing me is all I was showing in that log
18:53 < reiffert> the messages are coming from your firewall, which is called shorewall, which is not part of the vpn, right?
18:53 < Xgates> shorewall is just a front end for iptables, nothing to do with OpenVPN
18:54 < reiffert> it's a yes/no question...
18:54 < Xgates> yes not part of the vpn
18:55 < Xgates> are you asking if shorewall is a part of the vpn?
18:55 < reiffert> how can the problem be vpn related, when the message source is not part of the vpn?
18:56 < Xgates> I'm talking about VPN connectivity between two points is all
18:56 < reiffert> or how will it be related to "some sort of routing issue"?
18:56 < Xgates> we both understand what a VPN is
18:56 < Xgates> so how can you be sitting behind a VPN getting your actual IP exposed so that port hits are hitting your destination IP?
18:56 < Xgates> this is all I'm asking...
18:57 < Xgates> this should not happen on a VPN
18:57 < reiffert> those messages come from a host who doesnt know anything about your VPN Subnet. Dont take those messages as an indication that some sort of a routing issue happens because of a vpn connection that was made on a different host.
18:58 < reiffert> Xgates: you are wrong again.
18:58 < Xgates> ok let me back it up and explain it like this, so I can get a better understanding and you can see this from another point that is happening entirely different
18:59 < Xgates> I have 2 vpns I use when I am on one the only requests I see happening like this only come from the VPN to me and back to the VPN that's all, but when I'm using the VPN that I have problems on, I see the requests coming from the actual IPs online coming to me as the source IPs hitting the destination IPs and I've never seen this before
19:00 < Xgates> it's my understanding with the VPN that the only communication I should see is only from myself the LAN to the VPN and back to me nothing else, after all why would there be other requests going on if I'm on a VPN tunnel?
19:03 < Xgates> I'm not a networking expert, but my understanding of any protocol requests, nothing is going to come to me, see me, DNS, icmp, http, pop3, smtp, etc... any and all protocol requests happen through the VPN and only the VPN as another example takes a hit on port scans not me
19:04 < Xgates> does that make sense? Why would protocol requests come to me over a VPN and not just to the vpn so I don't see anything?
19:08 < reiffert> see .. there is established connections.
19:09 < Xgates> sorry established connections for whom/what?
19:09 < reiffert> your torrent client.
19:10 < Xgates> yes, but if they're established through the VPN I don't see how my box would come into play dropping or accepting requests, those requests should only happen at the VPN, where it accepts or drops depending on how the server is setup
19:11 < reiffert> they are established over your lan.
19:11 < reiffert> then your start the vpn connection.
19:11 < reiffert> then you start the vpn connection.
19:11 < Xgates> LAN - VPN - Torrent
19:12 < Xgates> VPN is in the middle covering the LAN, nothing should see or make requests to it
19:12 -!- Squidy [~quassel@187.54.110.191] has joined #openvpn
19:12 -!- Squidy [~quassel@187.54.110.191] has quit [Changing host]
19:12 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:12 < reiffert> Guess we are having explanatory problems here.
19:13 < Xgates> well I'm assuming this works in the same way as using a VPN while connected over HTTP
19:13 < Xgates> so if surfing the internet over a VPN, any server online isn't going to see you or any port scans and all requests are going to the VPN 
19:14 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
19:16 < Xgates> I'm not having explanatory problems but you said, they are established over your lan, to me this sounds like you're saying the Torrents are established over the LAN then connecting to the VPN next?
19:16 < Xgates> yes/no?
19:16 -!- Squidy [~quassel@187.54.110.191] has joined #openvpn
19:16 -!- Squidy [~quassel@187.54.110.191] has quit [Changing host]
19:16 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:17 < reiffert> see, I'm the wrong person, I dont understand anything about your setup, so I think that my answers are confusing you more and more.
19:18 < Xgates> I'm not confused maybe you're confused as to what it is I'm trying to explain as how this works with a VPN
19:19 < Xgates> I'm not saying I know everything, I just don't why when connected to a VPN the IPs on a Torrent Tracker are hitting my box and not the VPN, as in why are they looking at me for the request, when it should be coming from the VPN, because it's the one that has initiated the connection
19:19 < reiffert> looks like it, yeah.
19:19 < reiffert> let's start over from the beginning.
19:19 < Xgates> well look up at my last reply :)
19:20 < reiffert> do you run a torrent client on 192.168.1.3?
19:20 < Xgates> thanks
19:20 < Xgates> I'm behind a router so that is my IP at present and everything I do at the moment is on that IP so yes....
19:21 < reiffert> again, a simple yes/no question and a bla bla answer. we dont seem to improve our communication. sigh.
19:21 < Xgates> ok
19:21 < reiffert> does the torrent client run
19:21 < reiffert> do you run a torrent client on 192.168.1.3?
19:21 < Xgates> yes
19:21 < reiffert> did you start the torrent client before connecting to the VPN?
19:22 < Xgates> no
19:22 < Xgates> after
19:22 < reiffert> does your vpn push redirect-gateway def1 to your client?
19:22 < Xgates> one sec looking at the config
19:24 < Xgates> no - nothing in the conf
19:24 < Xgates> btw if it helps I can pastebin the conf
19:25 < reiffert> here's the deal:
19:25 < reiffert> your computer connects to a vpn.
19:25 < reiffert> but it doesnt send anything over the vpn to the vpn server.
19:25 < reiffert> because the routing table tell's it not to.
19:25 < reiffert> you can adjust the behaviour by pushing:
19:25 < reiffert> !def1
19:25 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
19:26 < Xgates> We got on the subject of def1 before, about something else, so I remember reading a bit about it
19:27 < reiffert> "We two" didnt subject def1 before.
19:27 < Xgates> no I meant this was another time....
19:27 < reiffert> are you sure that I was involved in this conversation the other time before?
19:31 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Ping timeout: 240 seconds]
19:33 < reiffert> sigh.
19:33 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
19:33 < Xgates> sorry reiffert my connection dropped
19:33 < Xgates> so would def1 be all I need to add then to the conf files?
19:34 < reiffert> no.
19:34 < reiffert> you need to put "push \"redirect-gateway " before "def1" and "\"" behind it.
19:35 < reiffert> like
19:35 < reiffert> !def1
19:35 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
19:36 < Xgates> I was reading the man page, can't say I understand it, some man pages more difficult then others...
19:38 < Xgates> I see on the openvpn site docs it says; Add the following directive to the server configuration file: push "redirect-gateway def1" so if they don't have this on the server, then what, not going to work on the client side, I assume?
19:39 < Xgates> because I'm assuming here that if they did this on the server side, then I'd have this already in my client conf
19:40 < Xgates> the only thing I see people doing in there client conf is - push "redirect-gateway def1" what do you mean behind it?
19:41 < Xgates> can you show me an actual working example of what you mean?
19:41 < Xgates> thanks
19:42 < reiffert> !def
19:42 < reiffert> !def1
19:42 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
19:42 < reiffert> put #3 in your server config file. restart the openvpn server, restart the client. done
19:43 < Xgates> ok I'll contact the guys running the server and tell them to put in  push "redirect-gateway def1"
19:43 < Xgates> then for me on the client side I don't need anything?
19:44 < reiffert> right.
19:44 < Xgates> ok great THANKS reiffert I'll let them know and see how that goes
19:44 < Xgates> thanks again for your help really appreciate it :)
19:44 < reiffert> if you are not able to edit the server config for yourself, e.g. because someone else is running the server, then you can add the following to your client config:
19:45 < reiffert> redirect-gateway def1
19:45 < reiffert> with the quotes, and without the push.
19:46 < Xgates> oh redirect-gateway def1 in the client conf
19:46 < Xgates> ok
19:46 < Xgates> well is it better to just have them set it on the server?
19:47 < Xgates> On the OpenVPN docs it's listed under the 'Routing all client traffic (including web-traffic) through the VPN'
19:47 < reiffert> I cant tell.
19:47 < Xgates> sounds like this might not always be desirable it says
19:47 < reiffert> so?
19:48 < Xgates> This is everything that section says;
19:48 < Xgates> http://pastebin.com/ZKRUTEqR
19:49 < Xgates> ahhh maybe not, I think I misread it...
19:49  * Xgates looks again
19:49 < reiffert> Xgates: write that stuff in your client config file now.
19:49 < reiffert> restart your client.
19:49 < reiffert> do it.
19:50 < Xgates> ok, but again, should I tell these guys to add this into their server?
19:51 < Xgates> That way every one gets routed better too and not just me...
19:52 < Xgates> also if they put  push "redirect-gateway def1" in their server conf then would I want to remove redirect-gateway def1 from the client conf or it will be ok to leave it?
19:53 < reiffert> 02:47 < reiffert> I cant tell.
19:53 < reiffert> 02:49 < reiffert> Xgates: write that stuff in your client config file now.
19:53 < reiffert> 02:49 < reiffert> restart your client.
19:53 < reiffert> 02:49 < reiffert> do it.
19:53 < Xgates> ok thanks
19:53 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
19:53 < Xgates> In the meantime I'll add "redirect-gateway def1" :)
19:53 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
19:53 < Xgates> and let them know too
19:54 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:56 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Client Quit]
19:57 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
19:58 < Xgates> reiffert: oh one last thing, when you said, 'here's the deal' what was that you said about the routing, cause when I lost my connection and had to join back I was going to write it down but then I couldn't....
19:59 < Xgates> maybe you can scroll back up and copy and paste it over :)
20:01 < reiffert> 02:27 < Xgates> no I meant this was another time....
20:01 < reiffert> 02:27 < reiffert> are you sure that I was involved in this conversation the other time before?
20:01 < reiffert> 02:31 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Ping timeout: 240 seconds]
20:01 < reiffert> 02:33 < reiffert> sigh.
20:01 < reiffert> 02:33 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
20:01 < Xgates> no when you said to me 'here's the deal' you explained some stuff about routing then had the bot give me the info on def1
20:03 < reiffert> your question again please?
20:04 < Xgates> if you could please scroll up and find the section where you said 'here's the deal' and copy and paste to me what you said after it
20:04 < Xgates> thanks
20:04 < reiffert> until?
20:05 < Xgates> you said, 'here's the deal' and I think the first thing you said after it was about the OS and routing
20:05 < Xgates> I was looking for that info on the routing you were explaining to me
20:05 < reiffert> !def1
20:05 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
20:06 < Xgates> hehe no not that, I'm good with all that
20:06 < Xgates> see if you can find ---> 'here's the deal' :)
20:10 < Xgates> you just typed that on one line by itself like this
20:10 < Xgates> here's the deal
20:11 < reiffert> and you need that because of?
20:11 < Xgates> that info on the routing you were explaining, I wanted to keep that, good stuff :0
20:11 < Xgates> :)
20:12 < Xgates> I always like to keep notes of good stuff :)
20:15 < reiffert> !def1
20:15 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
20:19 < Xgates>  I said I have all this already
20:20 < Xgates> hmm I guess you can't find the line that says --> 'here's the deal' ?
20:20 < Xgates> hmm
20:21 < Xgates> I guess you said, if I think about it, that the OS doesn't router the VPN, something like that...
20:21 < Xgates> doesn't route the VPN...
20:25 < Xgates> reiffert: if you can't find that line that says 'here's the deal' do you know if this openvpn channel logs, so I can look at the logs to find it?
20:31 < Xgates> ahh no worries
20:32 < Xgates> I'm out for the moment, I'll bbl if the "redirect-gateway def1" doesn't help
20:32 < Xgates> THANKS again reiffert :)
20:32 < Xgates> Cheers
20:32 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Ping Timeout (0 Nano seconds)]
21:14 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
21:19 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
21:19 <@vpnHelper> RSS Update - forum: Lag Spikes in Connection? <http://forums.openvpn.net/topic8689.html>
21:20 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:21 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:22 -!- Denial [Denial@drgi.co.uk] has quit []
21:31 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
21:31 -!- techfury90 [~techfury@unaffiliated/techfury90] has joined #openvpn
21:31 < techfury90> Hello
21:32 < techfury90> I have a question about routing and OpenVPN... perhaps someone has an answer
21:34 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:51 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Quit: ZNC - http://znc.in]
21:52 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 264 seconds]
21:57 -!- Tick-Tock [~Tick-Tock@lunari.us] has joined #openvpn
22:21 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
22:36 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
22:36 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has left #openvpn ["%JMNU%521*-;UU  -GbU-   aUP%JMNU%521*-A3FSP%JMNU%521*-`4B-920-7BP%JMN%521*-   94i-C3-43P%JMNU%521*-Bc2F-AR1C-AEBP%JMNU%521*-e3+T-U26-DBGP%JMNU%521*-bE41-KFF2-D232P%JMNU%521*-3Bb}-4+}A-3VAP"]
22:40 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
22:40 < Xgates> hey guys
22:40 < Xgates> ok redirect-gateway def1 has changed the behaviour, btw you don't use it with quotes in the client.conf
22:41 < Xgates> I guess I'm just not understanding OpenVPN as it relates to Torrents, because now I see the firewall telling me it's dropping at the Destination IP of the gateway 
22:41 < Xgates> LOL
22:41 < reiffert> idiot.
22:42 < Xgates> why are you calling me an idiot?
22:42 < reiffert> I'm calling myself an idiot.
22:42 < Xgates> ahhh, so using redirect-gateway def1 no good in the client.conf?
22:43 < techfury90> so, here's the long story short, for my situation
22:43 < techfury90> two machines, on 192.168.1.0/24
22:44 < techfury90> they're IBM AS/400 hosts, anyway, trying to somehow use OpenVPN to tunnel traffic between the two, but I couldn't bridge if I wanted to
22:44 < techfury90> basically, just trying to pull one (non-colliding) IP from the subnet on each end and make it accessible from the other
22:44 < techfury90> I don't quite know how to explain it
22:48 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 246 seconds]
22:52 -!- fread2281 [~fread2281@70-56-208-127.albq.qwest.net] has joined #openvpn
23:20 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
23:20 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:26 -!- fread2281 [~fread2281@70-56-208-127.albq.qwest.net] has quit [Remote host closed the connection]
23:28 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
23:30 < krzee> !certinfo
23:30 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
23:44 -!- Squidy_at_Home [~quassel@187.55.153.167] has joined #openvpn
23:44 <@vpnHelper> RSS Update - forum: Help with installation needed <http://forums.openvpn.net/topic8664-15.html#p14906>
23:45 -!- Squidy_at_Home [~quassel@187.55.153.167] has quit [Remote host closed the connection]
23:45 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 264 seconds]
--- Day changed Sun Aug 21 2011
00:02 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p14908> || how to add more port <http://forums.openvpn.net/topic8605.html#p14907>
00:04 -!- techfury90 [~techfury@unaffiliated/techfury90] has left #openvpn ["Leaving"]
00:25 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Ping Timeout (0 Nano seconds)]
00:27 -!- dijital1 [~bob@173.208.90.86] has joined #openvpn
00:27 -!- dijital1 [~bob@173.208.90.86] has quit [Changing host]
00:27 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
00:28 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
00:31 -!- K1ng [~KING@180.211.188.32] has quit [Ping timeout: 258 seconds]
00:35 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
00:38 <@vpnHelper> RSS Update - forum: OpenVPN server user & password only <http://forums.openvpn.net/topic8690.html>
00:49 -!- corretico_ [~luis@201.201.44.82] has quit [Ping timeout: 260 seconds]
00:52 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Ping timeout: 252 seconds]
01:06 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
01:06 -!- rawsted [~tom@li371-186.members.linode.com] has joined #openvpn
01:08 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
01:32 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 264 seconds]
02:01 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
02:01 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
02:01 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
02:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
02:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
02:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:37 < amero> can server uses both cert and passwd auth methods?
02:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
02:45 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 263 seconds]
02:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
03:55 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:56 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
04:07 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
04:35 -!- tutulus [~tutulus@static.238.229.4.46.clients.your-server.de] has joined #openvpn
04:37 -!- tutulus [~tutulus@static.238.229.4.46.clients.your-server.de] has quit [Client Quit]
04:41 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
04:56 -!- vpnuser [79362ce6@gateway/web/freenode/ip.121.54.44.230] has joined #openvpn
04:57 < vpnuser> May I ask how to recompile files after the tar.gz has been extracted?
05:03 < EugeneKay> You should really be using a binary distribution instead of building from source. Unless you're running a custom linux compiled for your toast(and even then, Debian should be able to help you out), you will find that a package is availabe from someplace.
05:03 <@vpnHelper> RSS Update - forum: WIN 7 Client, reach just the server. Other clients works <http://forums.openvpn.net/topic8685.html#p14910>
05:03 < EugeneKay> What's your OS?
05:04 < vpnuser> centos
05:04 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
05:04 < vpnuser> like if I want to study the files of openvpn and would like to modify it for personal use, how will I do that and recompile it?
05:07 < EugeneKay> openvpn packages(including -devel) are available in the EPEL and RPMForge repos for the RHEL rebuilds.
05:08 < EugeneKay> If you REALLY want to compile from source, I really can't offer you much advice beyond what the README holds.
05:08 < vpnuser> ok, thanks
05:08 -!- vpnuser [79362ce6@gateway/web/freenode/ip.121.54.44.230] has quit [Quit: Page closed]
05:29 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:32 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:36 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:36 -!- mode/#openvpn [+v s7r] by ChanServ
05:51 -!- tjz_ [~pc@bb220-255-32-79.singnet.com.sg] has quit [Quit: bbl.]
05:55 <@vpnHelper> RSS Update - forum: how to add more port <http://forums.openvpn.net/topic8605.html#p14911>
06:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:52 -!- tjz [~pc@bb220-255-32-79.singnet.com.sg] has joined #openvpn
06:52 -!- tjz [~pc@bb220-255-32-79.singnet.com.sg] has quit [Changing host]
06:52 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
06:55 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
06:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
07:31 -!- K1ng`` [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
07:35 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
08:04 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:11 -!- ad_ [~ad@188.73.201.226] has joined #openvpn
08:13 -!- fread2281 [~fread2281@70-56-208-127.albq.qwest.net] has joined #openvpn
08:33 -!- ad_ [~ad@188.73.201.226] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
08:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:56 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:01 -!- master_of_master [~master_of@p57B55824.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:03 -!- master_of_master [~master_of@p57B52DF0.dip.t-dialin.net] has joined #openvpn
09:07 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
09:08 -!- krzee [nobody@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
09:12 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:22 -!- fread228_ [~fread2281@70-56-208-127.albq.qwest.net] has joined #openvpn
09:25 -!- fread2281 [~fread2281@70-56-208-127.albq.qwest.net] has quit [Ping timeout: 260 seconds]
09:42 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:04 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:07 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
10:13 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
10:21 -!- txxt [~txxt@91.214.169.15] has left #openvpn []
10:29 -!- ad_ [~ad@188.73.201.226] has joined #openvpn
10:59 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:59 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:22 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
11:38 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
11:43 -!- ad_ [~ad@188.73.201.226] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
12:19 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
12:20 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 268 seconds]
12:32 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
13:40 -!- Jedicus [~user@adsl-76-214-197-38.dsl.emhril.sbcglobal.net] has quit [Quit: Leaving]
13:48 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:56 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:56 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:14 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
14:14 -!- corretico [~luis@201.201.44.82] has joined #openvpn
14:27 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
14:43 -!- Sw33NY_ [~Sw33NY___@ks30628.kimsufi.com] has joined #openvpn
14:43 < Sw33NY_> hi all 
14:47 < Sw33NY_> my openvpn server run on Debian Squeeze and my client run on debian too, my service openvpn work great but i have a virtual machine on my client debian and the openvpn server reply this : "use duplicate-cn" if you want to use the certificate on multiples machines 
14:48 < Sw33NY_> but where i must add --duplicate-cn ? 
14:48 < Sw33NY_> in the client file configuration openvpn or in the server file configuration ?
14:48 <@vpnHelper> RSS Update - forum: Server receives ping requests but no reply <http://forums.openvpn.net/topic8691.html>
14:53 < Sw33NY_> man openvpn say in the server file configuration --duplicate-cn :)
14:53 < Sw33NY_> thanks to all 
14:58 -!- Sw33NY_ [~Sw33NY___@ks30628.kimsufi.com] has quit [Read error: Connection reset by peer]
15:05 < trumee> i am try to use asterisk running through openvpn (on an openwrt router) but my asterisk calls are dropping. 
15:06 < trumee> The error is "chan_sip.c:3622 retrans_pkt: Retransmission timeout reached on transmission", "Packet timed out after 32000ms with no response"
15:07 < trumee> It seems my openvpn server is not responding to the packets sent out by the client. any idea why that might be happening.
15:07 < trumee> somebody on #asterisk asked, Does the vpn's other end point have a route back to your device?
15:15 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
15:18 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:19 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
15:23 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
15:26 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
15:30 -!- jeev_ [~jeev@unaffiliated/jeev] has quit [Ping timeout: 260 seconds]
15:33 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
15:36 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
15:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:39 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 268 seconds]
15:39 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
15:48 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:48 -!- rich_ [~rsb@216.38.140.199] has quit [Ping timeout: 246 seconds]
15:49 -!- zoidberg- [~zoidberg-@217.155.141.46] has joined #openvpn
15:51 < zoidberg-> Hey guys, I am trying to setup openvpn.  I have configured it, and managed to get a client successfully connected.. However it doesn't route traffic over the internet.. infact i can't ping anything, i can't access anything on the internet.. i connect and get assigned an ip and there doesn't appear to be any errors/issues, but i am not sure why i can't access the internet.. it just times out.  here are my server, client config files along with the se
15:51 < zoidberg-> rver log: http://codepad.org/fPvZc3Ra
15:51 <@vpnHelper> Title: Plain Text code - 525 lines - codepad (at codepad.org)
15:52 < zoidberg-> the sevrer is ubuntu 11.04 and client is windows 7
15:53 < zoidberg-> Also here is ifconfig, iptables and route output: http://codepad.org/vWMJinCb
15:53 <@vpnHelper> Title: Plain Text code - 64 lines - codepad (at codepad.org)
15:53 < zoidberg-> any help would greatly be appriciated :)
16:03 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
16:12 -!- zoidberg- [~zoidberg-@217.155.141.46] has quit [Quit: Leaving]
16:15 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:21 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
16:22 < ecrist_> trumee: we need more information
16:22 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Po-ta-to, boil em, mash em, stick em in a stew.]
16:22 < ecrist_> you haven't really told us your probelm
16:23 < trumee> ecrist_: The problem seemed to be sorted out once i gave a static ip of 172.16.1.100 to asterisk
16:23 < ecrist_> appears to be a routing issue then.
16:24 < trumee> ecrist_: previously it was set to my dyndns address
16:24 < ecrist_> yeah, that would be a routing issue.
16:24 < trumee> ecrist_: it seemed to be sip/rtp routing issue.
16:24 < ecrist_> no, it's just a plain routing issue
16:25 < trumee> ecrist_: at the moment i am not using --redirect-gateway, so i want to make sure that sip/rtp packets are indeed travelling over openvpn
16:25 < ecrist_> your solution seems appropriate.
16:26 < trumee> ecrist_: on the openvpn server, i captured packets on tap0 and they had sip/rtp packets. So i suppose encryption is working
16:27 < trumee> ecrist_: i dont want everything to route over the openvpn server so didnt use --redirect-gateway. But i did not do any manual routing too.
16:27 < trumee> ecrist_: route *everything
16:28 < trumee> openvpn plays very well with asterisk. I tried iax2 encryption without openvpn and it had terrible quality
16:28 < ecrist_> why don't you just use srtp?
16:29 < trumee> ecrist_: i did try but wasnt successfull.
16:29 < trumee> ecrist_: i want to connect two asterisk servers. I was able to that with encrypted iax2 but not with tls/srtp.
16:29 < ecrist_> why not?
16:30 < trumee> ecrist_: because i couldnt get hold of a howto to do that, so i was all over the place
16:30 < ecrist_> the man page is a good place to start with most things
16:31 < ecrist_> how do you think the people who write the how-to's figure it out?
16:31 < trumee> ecrist_: i generated certificates/keys for both servers, copied them over to each other. But they wouldnt connect
16:31 < ecrist_> couldn't begin to tell you what was wrong, I don't use asterisk
16:31 < ecrist_> and this isn't #asterisk. ;)
16:32 < trumee> ecrist_: well i am happy that openvpn atleast is working well for me
16:32 < trumee> ecrist_: although i will keep trying tls/srtp
16:39 < trumee> ecrist_: i am getting an error at the client side, http://www.pastie.org/2408363
16:40 < ecrist_> great.
16:40 < ecrist_> fix the problem. ;)
16:40 < ecrist_> the logs tells you what it is
16:41 < trumee> ecrist_: guess, i need to remove the route line
16:41 < ecrist_> why?  the log says nothing about the route
16:42 < trumee> ecrist_: Options error: option 'route' cannot be used in this context ?
16:42 < trumee> ecrist_: my server config is http://www.pastie.org/2407941
16:42  * ecrist_ poofs for the evening
16:42 -!- You're now known as ecrist
16:43 < trumee> ecrist_: at the client side i have a set a route-nopull which i guess is triggering these warnings
16:44 < trumee> ecrist: anyways thanks for listening to me tonight.
16:56 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
16:56 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
16:57 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
17:10 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
17:26 -!- curahack [~michel@190.88.76.251] has joined #openvpn
17:34 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 240 seconds]
17:53 -!- Denial [Denial@drgi.co.uk] has quit []
18:01 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:13 < curahack> Hi, I've been having problems with LTS encryption. The VPN establishes fine, but after a ~60 seconds the connection drops due to a failing new LTS session
18:14 < curahack> I think it's due to the time difference between the server/client
18:15 < curahack> there's a ~5min time difference, both are in the same timezone. I can't seem to update the server because it's on a OpenVZ VPS, and I apparently don't have permissions to update the system time...
18:15 < curahack> Could that be the problem?
18:17 < EugeneKay> !logs
18:17 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
18:20 < curahack> here: https://forums.openvpn.net/topic8387.html#p14561
18:20 <@vpnHelper> Title: OpenVPN Support Forum Server and Client use wrong IP configuration : Configuration (at forums.openvpn.net)
18:22 < curahack> EugeneKay found anything?
18:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:24 < EugeneKay> Nothing obvious
18:25 < curahack> but does it make sense, a LTS problem due to the 5min time difference?
18:26 < EugeneKay> TLS, not LTS. And no, not really.
18:28 < curahack> anyone else?
18:29 -!- fread228_ [~fread2281@70-56-208-127.albq.qwest.net] has quit [Remote host closed the connection]
18:33 -!- curahack1 [~michel@190.88.76.251] has joined #openvpn
18:36 -!- curahack [~michel@190.88.76.251] has quit [Ping timeout: 240 seconds]
18:49 -!- Ghostd0g [~ghostd0g@206-248-170-52.dsl.teksavvy.com] has joined #openvpn
18:50 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14913>
18:50 < Ghostd0g> hello i have some quetions about openvpn when used with dd-wrt, is it possible to install on router with 4mb?
18:56 < EugeneKay> Ghostd0g - honestly? Better off asking somebody who knows dd-wrt.
18:56 < Ghostd0g> kk ... hard to get a answer ..thanks anyway
18:57 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 260 seconds]
19:10 -!- Ghostd0g [~ghostd0g@206-248-170-52.dsl.teksavvy.com] has left #openvpn []
19:16 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:33 -!- computerkiller [~computerk@pool-173-65-138-213.tampfl.fios.verizon.net] has joined #openvpn
19:38 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:48 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:53 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
19:54 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
20:08 -!- EugeneKay is now known as EugeneKaway
20:17 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 250 seconds]
20:21 -!- dvl [~dan@pdpc/supporter/active/dvl] has left #openvpn ["Leaving"]
20:33 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:34 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
20:38 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:43 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
20:44 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:46 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:04 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:18 -!- bobJabba [bobJabba@shellbox.nvita.org] has joined #openvpn
21:20 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 258 seconds]
21:21 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
21:36 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
21:40 -!- bobJabba [bobJabba@shellbox.nvita.org] has left #openvpn ["yeah"]
22:01 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
22:02 < dijital1> I've been getting this code on my freebsd box running OpenVPN…   write UDPv4: No buffer space available (code=55)
22:02 < dijital1> any ideas what's causing it?
22:28 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
22:55 -!- curahack1 [~michel@190.88.76.251] has quit [Quit: Leaving.]
23:24 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
23:45 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 240 seconds]
23:54 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:55 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
--- Day changed Mon Aug 22 2011
00:03 <@vpnHelper> RSS Update - forum: how to add more port <http://forums.openvpn.net/topic8605.html#p14914>
00:06 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
00:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
00:06 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
00:07 < jeev> http://gifts.barnesandnoble.com/HP-TouchPad-Tablet-with-16GB-Memory-WiFi-12GHz-Black/e/886111788637 hp tablet $102
00:07 <@vpnHelper> Title: HP TouchPad Tablet with 16GB Memory, WiFi 1.2GHz - Black, HP WebOS - Barnes & Noble (at gifts.barnesandnoble.com)
00:07 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
00:14 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
00:17 -!- K1ng` [~KING@58.97.132.210] has quit [Ping timeout: 258 seconds]
00:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:18 -!- corretico [~luis@201.201.44.82] has quit [Read error: Operation timed out]
00:19 -!- corretico [~luis@201.201.44.82] has joined #openvpn
00:19 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
00:35 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
00:36 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
00:37 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
00:49 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
01:11 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:12 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:27 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
01:29 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:29 -!- mode/#openvpn [+o mattock] by ChanServ
01:31 <@vpnHelper> RSS Update - forum: how to add more port <http://forums.openvpn.net/topic8605.html#p14915>
01:32 -!- dazo_afk is now known as dazo
01:43 <@vpnHelper> RSS Update - forum: Server receives ping requests but no reply <http://forums.openvpn.net/topic8691.html#p14916>
01:44 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:55 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
01:56 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Remote host closed the connection]
01:57 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
01:59 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:02 -!- sedulous [~sedulous@gustavgnu-1-pt.tunnel.tserv6.fra1.ipv6.he.net] has quit [Quit: WeeChat 0.3.5]
02:08 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 240 seconds]
02:31 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 268 seconds]
02:51 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:57 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
03:23 -!- ultramage [umage@kurobara.netvor.sk] has joined #openvpn
03:24 < ultramage> hello, recently I've been experiencing a windows issue where my vpn connection would suddenly stop working, and reconnecting would just hang... but if I leave it disconnected for a bit, then it reconnects fine
03:24 < ultramage> http://codepad.org/MLy7K8Di <- loglevel 7 for one such occurence; tcpdump says the packet arrives on the server side, and the server side answers back
03:24 <@vpnHelper> Title: Plain Text code - 396 lines - codepad (at codepad.org)
03:40 -!- luneff [~yury@194.38.117.87.donpac.ru] has joined #openvpn
03:44 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html>
04:19 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
04:32 <@vpnHelper> RSS Update - forum: Different vlan for different user through vpn <http://forums.openvpn.net/topic8668.html#p14918>
04:40 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:40 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:40 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:53 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
05:15 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
05:17 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 260 seconds]
05:18 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
05:18 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:18 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:26 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580.html#p14919>
05:29 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
05:32 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 240 seconds]
05:32 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14921> || OpenVPN server user & password only <http://forums.openvpn.net/topic8690.html#p14920>
05:38 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
05:38 <@vpnHelper> RSS Update - forum: Server receives ping requests but no reply <http://forums.openvpn.net/topic8691.html#p14922>
05:44 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14923>
05:51 -!- infinee [infinii@riptide.ethzero.net] has joined #openvpn
05:51 < infinee> !welcome
05:51 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:51 < infinee> !redirect
05:51 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
05:52 < infinee> !def
05:52 < infinee> !def1
05:52 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway., or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand, or (#3) push "redirect-gateway def1"
05:52 < infinee> !ipforward
05:52 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
05:53 < infinee> !nat
05:53 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
06:08 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
06:08 <@vpnHelper> RSS Update - forum: Apple iPhone 4: Experience the Hi-Tech Features Free With Vo <http://forums.openvpn.net/topic8694.html>
06:29 -!- EugeneKaway is now known as EugeneKay
06:44 <@vpnHelper> RSS Update - forum: How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p14695>
06:50 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14925>
07:12 -!- zoidberg- [~zoidberg-@217.155.141.46] has joined #openvpn
07:13 < zoidberg-> Hey guys I have a strange problem.  I have a VPN server and a client connected to said server.  When I am connected to the VPN, and try to ping the VPN server from the VPN client machine I get 100% packet loss, failed ping.  However I can SSH to it fine.. so I know its a firewall issue.  The strange thing is i've allowed ping over the interface the VPN runs on so the address assigned to that interface is the one im pinging yet it fails? I have a det
07:13 < zoidberg-> ailed paste of all the info for you to see.. any help on this would really be appriciated: http://codepad.org/OdNfIMjc
07:13 <@vpnHelper> Title: Plain Text code - 210 lines - codepad (at codepad.org)
07:16 < CybDev> "iptables --append INPUT -i tun0 -j DROP"
07:16 < CybDev> you'll want something allowing ping over that line :P
07:17 < CybDev> or insert the rule with -I
07:17 -!- mape2k [~mape2k@p5B24D142.dip.t-dialin.net] has joined #openvpn
07:18 < zoidberg-> Sorry what do you mean exactly?
07:18 < zoidberg-> ahh yeha i see that lines the issue now
07:18 < CybDev> ah, nm, i was too lazy to read all of it
07:18 < CybDev> could you add a "iptables -L -v -n" to the paste perhaps?
07:20 < zoidberg-> ok sure
07:20 < zoidberg-> btw commenting out that line allows the pings
07:20 < zoidberg-> so im not sure why my line further down doesn't work
07:20 < zoidberg-> two secs and i'll paste
07:20 < CybDev> kinda why i wanted  the list of the iptables state after the rules are added
07:21 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
07:21 < CybDev> also i notice you are calling iptables by full path and sometimes just by name, do you get any errors while running it?
07:21 < zoidberg-> nope
07:21 < zoidberg-> i need to tidy it up thought
07:21 < zoidberg-> -t
07:22 < CybDev> if its a recent version of iptables you can dump it nicely with iptables -t <chain> -S
07:23 < zoidberg-> right when i run ping i noticed the drop chain packets adding up
07:23 < zoidberg-> let me paste
07:24 < zoidberg-> http://codepad.org/4xTvdyFY
07:24 <@vpnHelper> Title: C code - 228 lines - codepad (at codepad.org)
07:24 < zoidberg-> there you go 
07:25 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
07:25 < zoidberg-> the iptables -L -v -n outputs were taken with ping running on the client
07:25 < CybDev> see the DROP rule is before the accept rules
07:25 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14926>
07:25 < CybDev> the accepts will never get processed
07:26 < CybDev> you'll want to use -I instead of -A, or simply put the drop line below them in the script... or even just change the default policy to drop
07:28 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
07:28 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 276 seconds]
07:32 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
07:33 < zoidberg-> you mean remove the -j DROP line and just set default policy to drop and that should fix it?
07:37 < zoidberg-> CybDev, ?
07:37 <@dazo> zoidberg-: no, he meant that using iptables -I instead of iptables -A ... -I inserts at top of chain (unless an optional number position is given) ... -A appends to the end of the chain
07:37 <@dazo> but changing default policy to drop is also doable, but you seem to have that already
07:38 <@dazo> (ahh!  sorry, you don't have default DROP policy on the FORWARD chain)
07:39 < zoidberg-> hrm, so what do i need change iptables -P FORWARD ACCEPT to DROP?
07:39 <@dazo> yupp
07:39 < zoidberg-> ok thanks
07:40 < zoidberg-> will this break anything else i wonder lets see :)
07:40 <@dazo> well, it won't change much behaviour ... you last line in the FORWARD is REJECT ... which tells client that you won't process the request
07:41 <@dazo> DROP just silently drops the packets without telling the client anything at all
07:42 < zoidberg-> nope that dont work
07:42 < zoidberg-> i still cant ping
07:42 < zoidberg-> iptables -P INPUT DROP
07:42 < zoidberg-> iptables -P FORWARD DROP
07:42 < zoidberg-> i changed it to that 
07:43 <@dazo> okay ... can you please pastebin the result of 'ifconfig' ?
07:43 < zoidberg-> on vpn server?
07:43 <@dazo> yeah
07:44 < zoidberg-> http://codepad.org/S5px4twc
07:44 <@vpnHelper> Title: Plain Text code - 130 lines - codepad (at codepad.org)
07:47 <@dazo> zoidberg-: what does this return?  cat /proc/sys/net/ipv4/icmp_echo_ignore_all
07:47 < zoidberg-> 0
07:47 <@dazo> :/
07:47 < zoidberg-> ?
07:48 <@dazo> I'm confused
07:49 <@dazo> duh!
07:49 <@dazo> I see it
07:49 <@dazo> http://codepad.org/4xTvdyFY
07:49 <@vpnHelper> Title: C code - 228 lines - codepad (at codepad.org)
07:49 <@dazo> this is your earlier pastebin
07:49 <@dazo> look at line 19
07:49 < zoidberg-> I fixed it now
07:49 < zoidberg-> I put the -j DROP line underneath the accepts
07:50 < zoidberg-> yup
07:50 < zoidberg-> Its getting caught in the -j DROP so i put it at the bottom all good now :)
07:50 <@dazo> goodie!
07:50 < zoidberg-> Thanks for you're help
07:50 < zoidberg-> and CybDev :)
07:51 <@dazo> zoidberg-: I would probably recommend you to use iptables-save and iptables-restore ... those dump files might be far more easier to manipulate than such a script
07:51 <@dazo> (and way quicker to parse for the kernel)
07:52 <@dazo> iptables-save > /etc/iptables.ipt .... edit /etc/iptables.ipt .... then  iptables-restore < /etc/iptables.ipt
07:52 <@dazo> basically 
07:53 <@dazo> some distros even use iptables-save/restore in their /etc/init.d/iptables init scripts as well
08:02 < zoidberg-> ok thanksfor the tip
08:02 -!- zoidberg- [~zoidberg-@217.155.141.46] has quit [Quit: Leaving]
08:07 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Ping timeout: 250 seconds]
08:07 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:09 -!- luneff [~yury@194.38.117.87.donpac.ru] has quit [Ping timeout: 252 seconds]
08:10 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
08:12 -!- fluter_ [~fluter@fedora/fluter] has joined #openvpn
08:14 -!- luneff [~yury@181.56.117.87.donpac.ru] has joined #openvpn
08:16 -!- fluter__ [~fluter@123.117.68.127] has joined #openvpn
08:17 -!- secondchoice [~thirdchoi@198.105.46.46] has joined #openvpn
08:18 -!- secondchoice [~thirdchoi@198.105.46.46] has quit [Client Quit]
08:18 -!- secondchoice [~thirdchoi@198.105.46.46] has joined #openvpn
08:18 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
08:18 -!- dasdasd [~KING@58.97.132.210] has joined #openvpn
08:19 -!- K1ng` [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
08:20 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
08:20 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
08:20 -!- fluter__ [~fluter@123.117.68.127] has quit [Client Quit]
08:20 -!- fluter_ [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:25 -!- secondchoice is now known as axeman
08:25 -!- axeman [~thirdchoi@198.105.46.46] has quit [Changing host]
08:25 -!- axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
08:29 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 276 seconds]
08:30 -!- cRush-work [~crush@67-61-224-160.cpe.cableone.net] has joined #openvpn
08:30 < cRush-work> !welcome
08:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:31 < cRush-work> Hi, I have a question about the use of OpenVPN in a corporate environment.
08:32 < cRush-work> Is the open-source solution found on this page: http://www.openvpn.net/index.php/open-source/downloads.html, allowed to be used in a corporate environment without the need to first purchase a license?
08:32 <@vpnHelper> Title: Downloads (at www.openvpn.net)
08:32 < cRush-work> Is it just the client software that is free?
08:33 < gladiatr> cRush-work, you can use the community edition anywhere you want under any circumstances
08:33 < gladiatr> as far as the license is concerned... depending on your locale, it might be illegal to use such software, but that's a different subject
08:34 < cRush-work> Is the community edition only a client, server, or both?
08:34 < gladiatr> the openvpn binary functions as either depending on how its configured
08:34 < cRush-work> Awesome
08:34 < cRush-work> Thanks for your time!
08:34 < gladiatr> np
08:38 <@dazo> cRush-work: There is nothing in the GPL license which prohibits any kind of usage of GPL licensed software.  What GPL prohibits is that you cannot take GPL licensed software, do modifications on it and then distribute this work without providing the source code ... if you provide the software, you may do whatever you want with it
08:39 <@dazo> if you provide the *source code*, I meant
08:39 -!- vpnuser [79362ce5@gateway/web/freenode/ip.121.54.44.229] has joined #openvpn
08:39 < cRush-work> Oh, didn't realize it was GPL
08:39 < cRush-work> Thanks!
08:40 <@dazo> sure, np!
08:40 < vpnuser> what is the default size of window_size and what is the maximum size that can be set for any ip window_size?
08:45 < vpnuser> what is the default size of window_size and what is the maximum size that can be set for any ip window_size?
08:47 < vpnuser> just stupid
08:47 -!- vpnuser [79362ce5@gateway/web/freenode/ip.121.54.44.229] has quit []
08:57 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14928> || How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14927>
09:01 -!- master_of_master [~master_of@p57B52DF0.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
09:03 -!- master_of_master [~master_of@p57B53A86.dip.t-dialin.net] has joined #openvpn
09:03 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has quit []
09:03 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14929>
09:04 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:09 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14930>
09:10 -!- luneff [~yury@181.56.117.87.donpac.ru] has quit [Ping timeout: 260 seconds]
09:15 -!- penny [59570943@gateway/web/freenode/ip.89.87.9.67] has joined #openvpn
09:16 < penny> hello, i'm french and need help to configure my openvpn with my linux OS .... anyone speaking french here ?
09:18 < ecrist> we speak english here.
09:19 < penny> do you know if there's a openvpn support on IRC in French ? See i could do it in english, but i'm afraid not to understand everything and that could be a restrain to the help
09:21 < ecrist> unfortunately, no.  this is the official support channel.
09:21 -!- cRush-work [~crush@67-61-224-160.cpe.cableone.net] has quit []
09:21 < ecrist> we can try to help.  You seem to speak english well enough...
09:22 < penny> ok ... let's see .. my OS is Tango Studio (MAO OS based on Ubuntu  but noone seems to know how to help me on Tango Studio, and Ubuntu french community told me yesterday they don't support TAngo ... i'm screwed if you can't help me.
09:25 < penny> I created a accoumpt on FreeVPN.fr, they provided me connexion information and explained me to downlaod OpenVPN, I went on the page and did ... installed OpenVPn, I can see it in my internet connexion manager, I downloaded my profile ... 
09:26 < penny> the problems start with trying to connect ... 
09:26 -!- axeman is now known as Axeman2
09:26 -!- Axeman2 is now known as Axeman
09:27 -!- Axeman is now known as Axeman2
09:28 -!- Axeman2 is now known as Axeman
09:28 < penny> I create a new path of connexion with my connexion manager by importing my profile file : client.ovpn, but then he ask me for certificates, but I can't find them ... and when I try to connect without certificate with my registered id and pw ... it won't work either. THing is the connexion button wtil stay shadowed and never get clickable...
09:30 < reiffert> sounds like an issue for the support team of freevpn.fr\
09:31 < penny> got a irc ?
09:31 <@vpnHelper> RSS Update - forum: Server receives ping requests but no reply <http://forums.openvpn.net/topic8691.html#p14931>
09:32 < reiffert> I've got plenty of irc
09:32 < penny> Meaning : freevpn got an IRC channel ..sorry ...
09:33 < reiffert> sure they have.
09:33 < reiffert> #freevpn.fr
09:34 < penny> you're saving my life ! 
09:35 < penny> thank you very much... have a nice day people... long live free world !
09:35 -!- penny [59570943@gateway/web/freenode/ip.89.87.9.67] has quit []
09:39 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 240 seconds]
09:41 -!- Ragnar [~heimdall@darkstar.acool.net] has joined #openvpn
09:47 -!- dasdasd [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
09:47 < ecrist> lol reiffert 
09:49 <@vpnHelper> RSS Update - forum: Server receives ping requests but no reply <http://forums.openvpn.net/topic8691.html#p14933> || How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14932>
09:53 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
10:01 -!- zoidberg- [~zoidberg-@217.155.141.46] has joined #openvpn
10:01 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14934>
10:03 -!- dazo is now known as dazo_afk
10:06 -!- ultramage [umage@kurobara.netvor.sk] has left #openvpn ["ignored..."]
10:07 < zoidberg-> Hey guys, I think I may have some stale certificates lying around associated with my VPN server, do you know of anyway how to list the certificates that the vpn server currently holds, so that i can go through them and revoke which ones are not currently being ued?
10:07 < zoidberg-> *used
10:08 < CybDev> there is an index.txt in the keys dir of easy-rsa
10:08 < CybDev> if you used that
10:09 < zoidberg-> index is blank
10:10 < zoidberg-> so i guess ive not used it?
10:10 < zoidberg-> Any other way to tell..?
10:11 < CybDev> not really
10:12 < zoidberg-> hmm
10:12 < CybDev> you can look for csr files ofc, but no guarantee theyre all there 
10:13 < zoidberg-> well keys gets cleaned everytime a user gets added via clean-all script..
10:13 < CybDev> wtf?
10:13 < zoidberg-> i need a management system of users, so that i can keep a check on what users have been issued what certs etc
10:14 < CybDev> youre not supposed to run clean-all every time you add a user...
10:14 < zoidberg-> oh
10:14 < datruth> zoidberg-: and maybe the management console might work best for you
10:14 < zoidberg-> datruth, management console?
10:15 < zoidberg-> CybDev, i thought you were supposed to clean the dir each time.. i like to keep things neat and tidy :(
10:15 < ecrist> zoidberg-: certificate management is handled outside openvpn
10:15 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
10:15 < ecrist> what you'll need to do is, if you use openssl, find the index.txt.  In order to revoke a certificate, you will need a copy of it.
10:15 < zoidberg-> ok
10:15 < CybDev> well if he ran clean-all every time... none of his certs are valid :P
10:16 < CybDev> except the last or the first one :P
10:16 < CybDev> depending on what he did with ca.crt
10:16 < zoidberg-> i backuped up the ca.* stuff and just copied them into keys when neccessary
10:16 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14935>
10:17 < CybDev> so basically you removed your only way of keeping track of what you signed and not :P
10:17 < datruth> ;/
10:17 < zoidberg-> thats what you get for reading  tupid tutorial
10:17 < zoidberg-> from now on i wont run clean-all everytime i add a user
10:17 < CybDev> eh?
10:18 < CybDev> what tutorial says to run clean-all for every user?
10:18 < zoidberg-> http://library.linode.com/networking/openvpn/ubuntu-10.10-maverick
10:18 <@vpnHelper> Title: Secure Communications with OpenVPN on Ubuntu 10.10 (Maverick) – Linode Library (at library.linode.com)
10:18 < zoidberg-> it runs through a series of commands and then says repeat this for each user
10:18 < ecrist> how about, you read the official documentation and stop using how-tos?
10:19 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 240 seconds]
10:19 < CybDev> it does not
10:19 < CybDev> it says to run it once under the 'Initialize the Public Key Infrastructure (PKI)' section
10:19 < CybDev> no mention of it elsewhere
10:20 < zoidberg-> i guess i read it wrong
10:20 < zoidberg-> lesson learned, how can i rectify this situation?
10:20 < ecrist> start over with your SSL chain
10:21 < CybDev> also the guide is wrong, the openvpn server should not need the ca private key
10:21 < CybDev> you only use that to sign new csrs
10:21 < zoidberg-> ecrist, how would I do that, and exactly what does that mean?
10:21 < ecrist> it means you issue new certificates to the VPN users, and use a new key pair for the server
10:21 < ecrist> and you create a new CA
10:22 < zoidberg-> Ok, so re-generate all my certs, I can do that.. so if i DO NOT run clean-all apart from when generating the server cert, then gen all my client certs again, index.txt should be populated with all certs?
10:23 < CybDev> if you're willing to drop some security you can use LDAP for ease of user management tbh... that'll give you an "always updated" catalog of who has access and not
10:23 < ecrist> so does index.txt
10:23 < ecrist> if you don't delete the damn thing
10:23 < CybDev> index.txt gets updated every time you add/revoke a cert, provided you dont delete it between runs :P
10:23 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
10:24 < zoidberg-> :D
10:24 < CybDev> nothing stops you from manually editing index.txt for the fun of it tho
10:24 < zoidberg-> LDAP is overkill for my situation
10:24 < CybDev> so guard it (almost) like the ca priv key :P
10:25 < zoidberg-> hehe ok
10:25 < zoidberg-> so whats the right process to do this, because its all going to get messy?
10:25 < CybDev> thats why you have easy-rsa, to make it less messy
10:26 < zoidberg-> ok so whats the correct proces to revoke and regen/
10:26 < zoidberg-> ?
10:27 -!- K1ng` [~KING@180.211.188.213] has joined #openvpn
10:27 < CybDev> just dont run clean-all
10:28 < CybDev> and secure the keys dir, keep backups etc...
10:28 < zoidberg-> ok thanks guys
10:28 < zoidberg-> im going to go fix this mess :)
10:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
10:29 -!- K1ng [~KING@58.97.132.210] has quit [Ping timeout: 252 seconds]
10:32 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:32 -!- mode/#openvpn [+o raidz] by ChanServ
10:43 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
10:47 -!- zoidberg- [~zoidberg-@217.155.141.46] has quit [Quit: Leaving]
10:53 -!- K1ng`` [~KING@58.97.132.210] has joined #openvpn
10:56 -!- K1ng` [~KING@180.211.188.213] has quit [Ping timeout: 252 seconds]
11:00 -!- luneff [~yury@181.56.117.87.donpac.ru] has joined #openvpn
11:07 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
11:10 -!- K1ng`` [~KING@58.97.132.210] has quit [Ping timeout: 268 seconds]
11:15 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14936>
11:18 -!- mape2k [~mape2k@p5B24D142.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
11:25 -!- Netsplit *.net <-> *.split quits: rawsted, dijital1, thaNatozZ
11:27 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14937>
11:30 -!- Netsplit over, joins: rawsted
11:30 -!- rawsted [~tom@li371-186.members.linode.com] has quit [Changing host]
11:30 -!- rawsted [~tom@unaffiliated/rawsted] has joined #openvpn
11:31 -!- Netsplit over, joins: dijital1
11:32 < Dougy> hey
11:32 < Dougy> anyone here running a mac with osx 10.6 to 10.6.7
11:32 < EugeneKay> Is for horses
11:32 < Dougy> i need some kexts that are from .6.7 or older
11:33 < jeev> pfft, kext
11:33 < hyper_ch> I don't even know what kext is
11:34 < jeev> drivers, for losers
11:34 < jeev> (mac users)
11:34 < EugeneKay> Something Mac related, aybe
11:34 < Dougy> its mac os drivers
11:34 < Dougy> no krzee?
11:34 < Dougy> grr
11:34 < hyper_ch> why not just dl a os 10.6 retail dvd and extract it?
11:35 < jeev> because he's hackintoshing probably
11:35 < jeev> and it wont come with it
11:35 < EugeneKay> That reminds me, I need to look into an OS X 10.7 vm
11:36 -!- tty234 [telex@gateway/shell/anapnea.net/x-ghnfcjuwwqzbqnra] has quit [Read error: Connection reset by peer]
11:37 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
11:37 -!- ppr is now known as peper_node
11:42 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
11:52 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
12:02 -!- sedulous [~sedulous@2001:470:1f0b:1862:7e0d:7367:1173:1ebc] has joined #openvpn
12:03 <@vpnHelper> RSS Update - forum: tcp dup ack from wireshark, is this a problem? <http://forums.openvpn.net/topic8695.html>
12:13 < Axeman> EugeneKay, tell me when you figure it out. 
12:13 < Axeman> i thought to get osX ina vm you have to jump thru hoops
12:14 < EugeneKay> Probably
12:17 -!- peper_node [~peper@gentoo/developer/peper] has quit [Read error: Connection reset by peer]
12:17 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
12:18 -!- ppr is now known as peper_node
12:20 -!- peper [~peper@gentoo/developer/peper] has quit [Quit: leaving]
12:21 -!- peper_node is now known as peper
13:03 -!- mick_laptop [~mick@mickweiss.com] has quit [Changing host]
13:03 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
13:17 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 260 seconds]
13:25 -!- Sicelo [qhubekela@unaffiliated/sicelo] has left #openvpn []
13:29 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
13:33 -!- hildegard [~adam@mail.bostonballet.com] has joined #openvpn
13:34 < hildegard> hi all.  i have an openvpn connection that is not connecting (TLS error).  I think maybe I have the wrong cert on my server (someone might've changed the remote key??).  is there a way i can get it to 'just connect' so i can ssh into this thing?
13:35 -!- curahack [~michel@190.88.76.251] has joined #openvpn
13:37 < ecrist> hildegard: no
13:37 < ecrist> otherwise, hackers would 'just connect' to everyone's vPN server, defeating the whole point.
13:38 < EugeneKay> h4xx0rz
13:40 < hyper_ch> h4xx0rz can only hack in if you use a Windoze server
13:40 < hyper_ch> or a weak password like "password"
13:40 < hildegard> ecrist: yeah, but i want to break security for 1 minute to ssh into the bloody thing...
13:40 < ecrist> sure, and so do hackers
13:41 < ecrist> no, you cannot just break security for 1 minute.
13:41 < ecrist> ask of of the ballet dancers to fix it for you. ;)
13:42 < hildegard> i just happen to be at a ballet, i don't think they have great networking acumen.  i found the problem, some jerk changed the certs.
13:43 < hildegard> still screwed though
13:44 -!- nutcase [~nutcase@tokerscorner.com] has left #openvpn ["Leaving..."]
13:48 < ecrist> This is why I usually leave a backdoor somewhere, usually a connected vpn client on a remote network I have other access to.
13:49 < EugeneKay> If you don't fuck up SSH to begin with...
13:51 < hildegard> ecrist: yeah, this is what i do on new installations for fear of getting burned exactly like this (autossh when tun is down).  what is the saying, fool me once, shame on you.  fool me, you can't get fooled again.
13:55 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
13:56 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:57 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:09 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Quit: Leaving]
14:10 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
14:35 -!- K1ng [~KING@58.97.132.210] has joined #openvpn
14:38 -!- K1ng` [~KING@58.97.132.210] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
14:39 -!- K1ng` [~KING@58.97.132.210] has joined #openvpn
14:39 -!- K1ng` [~KING@58.97.132.210] has quit [Client Quit]
14:42 -!- K1ng [~KING@58.97.132.210] has quit [Changing host]
14:42 -!- K1ng [~KING@unaffiliated/k1ng] has joined #openvpn
14:49 -!- sedulous [~sedulous@2001:470:1f0b:1862:7e0d:7367:1173:1ebc] has quit [Ping timeout: 260 seconds]
14:50 -!- sedulous [~sedulous@2001:470:1f0b:1862:7e0d:7367:1173:1ebc] has joined #openvpn
14:52 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14940> || How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p14939>
15:03 -!- K1ng` [~KING@unaffiliated/k1ng] has joined #openvpn
15:04 -!- secondchoice [~thirdchoi@198.105.46.46] has joined #openvpn
15:04 -!- secondchoice is now known as Axeman2
15:05 -!- Axeman2 [~thirdchoi@198.105.46.46] has quit [Changing host]
15:05 -!- Axeman2 [~thirdchoi@openvpn/user/axeman] has joined #openvpn
15:05 -!- K1ng [~KING@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
15:07 -!- secondchoice [~thirdchoi@198.105.46.46] has joined #openvpn
15:08 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
15:08 -!- secondchoice is now known as axeman
15:08 -!- axeman is now known as Guest45707
15:08 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
15:11 -!- Axeman2 [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
15:17 -!- miketheman1 [~Adium@207.239.84.170] has joined #openvpn
15:18 < miketheman1> can someone point me to a simple guide for a site-to-site vpn setup? And is this really just a client-server setup, called site-to-site?
15:22 < CybDev> afaik its just a client-server, but what do i know :-/
15:35 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
15:39 -!- hildegard [~adam@mail.bostonballet.com] has quit [Ping timeout: 252 seconds]
15:39 -!- Guest45707 [~thirdchoi@198.105.46.46] has left #openvpn []
15:39 -!- Axeman [~thirdchoi@198.105.46.46] has joined #openvpn
15:39 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
15:40 -!- Axeman [~thirdchoi@198.105.46.46] has quit [Changing host]
15:40 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
15:45 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 276 seconds]
15:56 < reiffert> maybe something vor vpnHelper:
15:56 < reiffert> 22:54 < chrisboom> doesnt work
15:56 < reiffert> 22:54 < fajita> Look buddy, doesn't work is a strong statement. Does it sit on the couch all day? Does it want more money? Is it on IRC all  the time? Be specific! Examples of what doesn't work (or the URL) tend to help too, pastebin the config if that's the problem
15:57 < reiffert> where fajita is a vpnhelper bot
15:57 -!- straterra [~straterra@fuhell.com] has joined #openvpn
15:57 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:57 < straterra> Is there a way to NOT have routes added from an openvpn client?
15:58 < straterra> I don't want the routes as they're pushed from the server and will add my own routes
15:58 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
15:59 < reiffert> specify your own route-exe
15:59 < straterra> I can do that?
15:59 < reiffert> see
15:59 < reiffert>       --route-noexec
15:59 < reiffert>               Don't add or remove routes automatically.  Instead pass routes to --route-up script using environmental variables.
15:59 < reiffert> in !man
15:59 < reiffert> !man
15:59 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
16:00 < straterra> PERFECT
16:01 < reiffert> welcome
16:02 < straterra> That worked perfectly. Thanks.
16:06 -!- miketheman1 [~Adium@207.239.84.170] has left #openvpn []
16:06 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
16:08 < straterra> Does OpenVPN try to add every pushed route to that script (so ran once per route), or is it ran once as a post-up type of script?
16:09 < reiffert> see manpage unter --route-up
16:09 < reiffert> which leads you to environmental variables
16:09 < reiffert> which tells you the answer to your question.
16:11 < straterra> ok
16:17 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
16:19 -!- jeev_ [~jeev@unaffiliated/jeev] has joined #openvpn
16:21 -!- jeev_ [~jeev@unaffiliated/jeev] has quit [Read error: Connection reset by peer]
16:26 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14941>
16:32 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14944> || How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p14943> || tcp dup ack from wireshark, is this a problem? <http://forums.openvpn.net/topic8695.html#p14942>
16:34 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
16:34 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
16:34 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:40 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
16:44 <@vpnHelper> RSS Update - forum: OpenVPN hangs on TLS authentication during connecting <http://forums.openvpn.net/topic8669.html#p14825>
16:55 -!- K1ng` is now known as k1ng
16:56 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
17:06 -!- zoidberg- [~zoidberg@2607:f358:1:fed5:22:0:483a:9146] has joined #openvpn
17:06 < zoidberg-> Hey guys, I wan't to tighten up security on my openvpn server.  Where can I find the correct permissions on files and dolers under /etc/openvpn so I can set them correctly?
17:06 < zoidberg-> (without breaking stuff) heh
17:07 < |Mike|> openvpn daemon is running under root...
17:07 < zoidberg-> nope, i changed to nobody/nobody
17:07 < zoidberg-> it drops privs
17:07 < |Mike|> ok, safer :)
17:07 < |Mike|> then make everything readable by openvpn in /etc/ovpn :)
17:07 < zoidberg-> I meant directory, file/folder permissions under /etc/openvpn (such as the keys in easy-rsa/2.0/ directory)
17:07 < zoidberg-> what are the tightest permissions i can set
17:08 < reiffert> 000
17:08 < |Mike|> openvpn doesn't need write permissions except in /var/log imho
17:08 < zoidberg-> even on the keys?
17:21 < zoidberg-> Also, my windows 7 laptop connects to the vpn, the openvpn.log is filled with: http://codepad.org/zUsTVGRS <-- i am worrying over time thta it will fill the disk, is there anyway to stop this from happening - from what i can tell its when it tries to push ipv6 packets, and openvpn doesn't support it so doesn't know how to handle them and spits out that warning. How do i surpress it?
17:21 <@vpnHelper> Title: Plain Text code - 3 lines - codepad (at codepad.org)
17:23 < |Mike|> you could adjust the loglevel, but then again, it's just plain text..
17:27 < zoidberg-> is there something i can do on my windows laptop to stop it occuring?
17:27 < zoidberg-> as i dont use ipv6 on the laptop
17:28 -!- luneff [~yury@181.56.117.87.donpac.ru] has quit [Quit: This computer has gone to sleep]
17:32 < kenyon> zoidberg-: try the mute option
17:33 < zoidberg-> kenyon: how?
17:33 < zoidberg-> on the client.conf?
17:33 < kenyon> yes
17:34 < zoidberg-> Good thinking :)
17:40 < reiffert> anyone got one of the HP touchpads for 99 bugs?
17:41 < zoidberg-> got a link???
17:41 < reiffert> hp.com claims to be out of stocl
17:41 -!- bassliner [armin@irc.arje.de] has joined #openvpn
17:41 < bassliner> anyone an idea what this is?  Mon Aug 22 23:39:00 2011 us=333647 TIMER: coarse timer wakeup 1 seconds<br>Mon Aug 22 23:39:00 2011 us=333675 PO_CTL rwflags=0x0001 ev=3 arg=0x080cd6ac<br>Mon Aug 22 23:39:00 2011 us=333710 I/O WAIT Tr|Tw|SR|Sw [1/101030]<br>
17:41 < reiffert> bassliner: a line from your logfile.
17:42 < bassliner> s/is/means/ :)
17:42 < bassliner> hello reiffert 
17:42 < reiffert> bassliner: it means that a program or the kernel thought that it might be useful to put it in your logfile.
17:44 < bassliner> reiffert: oh, really? interesting.
17:44 < reiffert> bassliner: yeah. openvpn version?
17:44 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14945>
17:45 -!- Darkclaw66 [~andre@unaffiliated/darkclaw66] has joined #openvpn
17:45 < bassliner> reiffert: 2.2.1-1
17:45 < Darkclaw66> hello, I am interested for Openvpn to disconnect a client if it is inactive for x amount of time but I don't want it to apply to all clients, is that possible?
17:45 < reiffert> bassliner: umlauts involved somewhere?
17:46 < bassliner> reiffert: don't think so...
17:46 < bassliner> reiffert: will verify that..
17:46 < reiffert> bassliner: k, put your openvpn logs online, those around that syslog messages.
17:47 < reiffert> and/or related to
17:48 < reiffert> bassliner: ah, bring up "ifconfig" while openvpn is running.
17:49 < bassliner> reiffert: will have a look into. thanks for your help.
17:49 < reiffert> bassliner: hm just pastebin the ifconfig stuff please.
17:54 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:57 -!- luneff [~yury@84.51.199.63] has joined #openvpn
17:58 < bassliner> reiffert: turns out that the machine of a friend here is an openvz container virtualization system. we'll have a deeper look into this first before wasting your time and effort. thanks for your explanation.
18:00 -!- Denial [Denial@drgi.co.uk] has quit []
18:04 < EugeneKay> !openvz
18:04 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn, or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
18:06 < reiffert> bassliner: I didnt even start explaining anything.
18:06 < reiffert> bassliner: googling up stuff brings up some ideas..
18:08 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 240 seconds]
18:24 -!- Netsplit *.net <-> *.split quits: Olipro
18:25 -!- zoidberg- [~zoidberg@2607:f358:1:fed5:22:0:483a:9146] has quit [Quit: leaving]
18:29 -!- Netsplit over, joins: Olipro
18:43 <@vpnHelper> RSS Update - forum: SVC_RUN_EXCEPT-cannot start server <http://forums.openvpn.net/topic8696.html>
18:46 -!- luneff [~yury@84.51.199.63] has quit [Quit: This computer has gone to sleep]
19:19 -!- eliasson1 [~wizard@91.198.48.20] has joined #openvpn
19:19 -!- sno___ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
19:19 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
19:20 -!- ajacob_ [~ajacob@taurine.csclub.uwaterloo.ca] has joined #openvpn
19:20 -!- n2deep_ [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
19:20 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
19:22 -!- eliasson_ [~wizard@91.198.48.20] has quit [Ping timeout: 276 seconds]
19:22 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Ping timeout: 276 seconds]
19:22 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 276 seconds]
19:22 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 276 seconds]
19:22 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has quit [Ping timeout: 276 seconds]
19:22 -!- sno_ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 276 seconds]
19:22 -!- ajacob [~ajacob@taurine.csclub.uwaterloo.ca] has quit [Ping timeout: 276 seconds]
19:22 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:23 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
19:24 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
19:24 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 612 seconds]
19:25 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:28 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
19:34 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
19:54 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
19:55 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:56 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
19:59 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
19:59 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:32 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has joined #openvpn
20:32 < Macphisto> clear
20:32 < Macphisto> ... dammit
20:33 < Macphisto> I'm having some trouble finding a good answer on whether or not to run openvpn in routed or bridged mode.
20:33 < Macphisto> I'm testing it for external access to our users who mobile or out on business. 
20:34 < EugeneKay> "Bridged Mode has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
20:35 < Macphisto> That exact quote is why I've been trying to pull it off in routed mode :)
20:37 < Macphisto> and I've got it working in routed mode, but only with end to end connectivity.  Been having some trouble getting to the resources behind the OpenVPN server.
20:37 < EugeneKay> Reader's digest version? Your routing is wrong.
20:37 < EugeneKay> And your firewalling.
20:38 < Macphisto> Thats probably about right.
20:39 < EugeneKay> Whiteboarding it out helps for me
20:39 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
20:40 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:41 < Macphisto> I've got the nic in promisc mode and pushed routes to the subnets behind the vpn server and allowed any traffic coming over tun0. Just not sure if I managed to miss something.   
20:42 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
20:42 < Macphisto> sonuvabitch, I don't think I have rule to nat tun0 to eth0
20:43  * ecrist uses bridged mode, and could be said to 'know' something about networking and openvpn
20:43 < Macphisto> do you own a cat?
20:44 < Macphisto> well shit... that did it.
20:44 < ecrist> no, I don't own a fucking cat.
20:44 < ecrist> we did, we sent them packing
20:45 < Macphisto> heh
20:57 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14947>
20:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
21:03 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
21:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:22 -!- ppr is now known as peper
21:23 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 258 seconds]
21:30 -!- Ragnar [~heimdall@darkstar.acool.net] has quit [Read error: Connection reset by peer]
21:32 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has joined #openvpn
21:35 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
22:05 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 258 seconds]
22:06 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:08 -!- EugeneKay is now known as EugeneKaway
22:12 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has joined #openvpn
22:21 -!- kaibosher [~pingwing@dsl-46-63.dsl.netsource.ie] has joined #openvpn
22:23 -!- ESpingwing [~pingwing@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 276 seconds]
22:31 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:58 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has left #openvpn ["%JMNU%521*-;UU  -GbU-   aUP%JMNU%521*-A3FSP%JMNU%521*-`4B-920-7BP%JMNU%521*-   94i-C3-43P%JMNU%521*-Bc2F-AR1C-AEBP%JMNU%521*-e3+T-U26-DBGP%JMNU%521*-bE41-KFF2-D232P%JMNU%521*-3Bb}-4+}A-3VAP"]
23:05 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 264 seconds]
23:09 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
23:10 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
23:16 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
23:17 -!- Cain [~Geek@unaffiliated/cain] has quit [Client Quit]
23:18 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
23:25 -!- mape2k [~mape2k@f053192213.adsl.alicedsl.de] has joined #openvpn
23:34 -!- curahack [~michel@190.88.76.251] has quit [Quit: Leaving.]
23:35 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Read error: Connection reset by peer]
23:40 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
23:58 -!- mape2k [~mape2k@f053192213.adsl.alicedsl.de] has quit [Read error: Operation timed out]
--- Day changed Tue Aug 23 2011
00:50 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
00:57 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:10 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
01:10 < civillian> hi all
01:10 < civillian> is there something specific I need to be doing to enable openvpn to advertise MAC addresses that are behind a tap interface?
01:10 -!- style [style@richardt.fi] has joined #openvpn
01:11 < civillian> trying to setup an ethernet bridge between two sites
01:11 < krzee> do you need layer2?
01:11 < civillian> yes
01:11 < krzee> ahh i dunno then
01:11 < civillian> this is killing me!  tunnel works
01:11 < krzee> maybe some of this could help:
01:11 < krzee> !bridge
01:11 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc, or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ, or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
01:11 < style> Hi, any ideas where could have my tap0 adapter disappear? Running ubuntu OpenVPN on Ubuntu Server 8.10
01:12 < civillian> i can see broadcasts, but the arp replies are sent to the originating MAC and that's not being advertised by the bridge
01:12 < krzee> style, it can be made on demand by openvpn, it'll come back when you run it
01:12 < style> I've restarted openvpn and the whole server
01:12 < style> it still isn't there
01:12 < style> and no packets are passed though OpenVPN
01:13 < krzee> bridges dont "advertise arp" for machines on the other side
01:13 < style> through*
01:13 < krzee> they just forward layer2
01:13 < civillian> well it's not forwarding the l2 frame unless it's addressed to itself or broadcast
01:14 < krzee> dunno, i dont do bridges
01:14 < civillian> do I need proxy arp? it makes no sense
01:14 < krzee> try adding client-to-client
01:14 < krzee> (to the server config)
01:14 < civillian> it's in there, but I have only 1 client being the other site
01:15 < style> Ok it was there I was just blind... butbut no I've no idea why any packets aren't passed through
01:15 < style> tcpdump shows arriving UDP packages to port openvpn, but no departures
01:15 < krzee> !goal
01:15 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:16 < krzee> (@ style)
01:16 < style> I would like to access the lan behind the server
01:16 < krzee> do you need layer2?
01:16 < style> ummm that means :D?
01:17 < krzee> !tunortap
01:17 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
01:17 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
01:17 < style> yes 
01:17 < krzee> for what?
01:18 < style> "to access the lan behind the server" =), we have office network (LAN) and our laptops should be able to access to it from any places
01:18 < civillian> lol
01:18 < krzee> !route
01:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
01:18 < krzee> you dont need layer2 for that
01:19 < krzee> IP traffic is layer3
01:19 < krzee> you can use tun and follow my guide there
01:20 < style> same configs worked on our previous server... and it's not possible to call back all our clients to change theri openvpn configs to use tun
01:20 < krzee> k, sorry i cant help you either then
01:21 < style> their*
01:21 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 240 seconds]
01:22 < civillian> is there some way I can list the MAC addresses that are learned?
01:22 < krzee> ouch, tons of clients on a tap vpn, cant wait to see you coming back with questions why you have a broadcast storm
01:22 < civillian> if I could use tun I would :P
01:23 < civillian> perhaps tun with proxy arp
01:23 < krzee> why do you need arp?
01:24 < civillian> I have a /16 of which I need it to appear in dallas, USA and canberra, australia
01:24 < civillian> fail design, not mine
01:25 < krzee> bgp ftw
01:25 < civillian> bbiaf, smoko
01:25 < infinee> Hi, if I do an ifconfig on the server and the tun0 shows ip addr of 10.8.0.1. what should my gateway be on the client? My guess is 10.8.0.1 but it's getting 10.8.0.5 for some reason
01:26 < krzee> infinee, 
01:26 < krzee> !/30
01:26 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
01:29 < infinee> !dns
01:29 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
01:30 < infinee> !pushdns
01:30 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
01:30 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
01:30 < infinee> krzee: thanks, i guess it's correct. i just need to figure out why traffic is routing properly thru server  (and why I can't resolve domains)
01:32 < krzee> !dns
01:32 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6], or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4, or (#3) you might be looking for !pushdns
01:32 < krzee> !pushdns
01:32 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
01:32 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
01:33 < krzee> when using your ISP nameserver over a vpn that redirects your itnernet, dns may break (really, it should if your isp is configured right)
01:34 < infinee> yes, I've been using the redirect-gateway def1 but to no avail
01:34 < krzee> but you can push a nameserver to the clients, or just force them to use an open recursive nameserver like one above
01:34 < krzee> you said you cant resolve dns
01:34 < krzee> you can ping by IP tho...?
01:34 < infinee> client is os x, even when I 'cat /etc/resolve.conf' I see the correctly pushed dns defined
01:34 < infinee> no actually.Request timeout for icmp_seq 0
01:35 < infinee> fwiw, openvpn server is an EC2 isntance
01:35 < krzee> !redirect
01:35 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
01:35 < krzee> you have ip forwarding and NAT configured on the server...?
01:36 < infinee> cat /etc/sysctl.conf
01:36 < infinee> net.ipv4.ip_forward=1
01:36 < infinee> !nat
01:36 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules, or (#3) dont forget to turn on ip forwarding, or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
01:36 < krzee> !linnat
01:36 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
01:37 < infinee> ACCEPT     all  --  ip-10-8-0-0.ap-northeast-1.compute.internal/24  anywhere 
01:37 < krzee> that all?
01:38 < infinee> krzee: https://gist.github.com/1164490
01:38 <@vpnHelper> Title: infinii's gist: 1164490 Gist (at gist.github.com)
01:38 < krzee> did you read this...?
01:38 < krzee> !linnat
01:38 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
01:39 < infinee> I didn't read it because the command is identical to the one I ran (from the guide) I followed
01:39 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
01:40 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:40 < krzee> well it wasnt anywhere in that pastebin
01:42 < krzee> iptables -L -t nat
01:43 < infinee> https://gist.github.com/1164497
01:43 <@vpnHelper> Title: infinii's gist: 1164497 Gist (at gist.github.com)
01:43 < infinee> the ip-10-8-0-0.ap-northeast-1.compute.internal/24 must've been interpreted as 10.8.0.0
01:44 < krzee> what happens when you sniff traffic while pinging something...?
01:44 < krzee> you can tcpdump -i tun0
01:44 < infinee> let me try
01:45 < krzee> also, post configs
01:45 < krzee> !configs
01:45 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
01:45 < krzee> like that ^
01:45 < infinee> absolutely nothing
01:46 < krzee> might wanna see !logs too
01:47 < infinee> ok, let me pastebin my confs
01:47 < infinee> btw thanks krzee, appreciate the time and help
01:47 < krzee> np
01:49 < infinee> hrmmm....I just noticed that server has tun0 and tun1. i tcpdump'd tun1 and saw a tonne of traffic
01:49 < civillian> a tun of traffic??
01:50 < infinee> civillian: looked like my dropbox stuff on client
01:50 < krzee> infinee, do you have openvpn running multiple times?
01:50 < civillian> infinee: nvm, my poor attempt at a joke for the arvo
01:50 < krzee> ps auxwww|grep openvpn
01:50 < infinee> krzee: server or client?
01:50 < krzee> server
01:51 < infinee> oh yes I do. one is uid 'nobody', one is uid 'root'
01:51  * infinee scratches his head. 
01:51 < infinee> let me kill these and restart
01:52 < infinee> that must be normal. when I started again from /etc/init.d/openvpn start. I end up with 2 ps
01:53 < krzee> your distro prolly runs all .conf files in its config dir
01:53 < krzee> i think debian does that...
01:53 < krzee> (the startup script does)
01:54 < infinee> omg I DO have multiple (bad) conf files in /etc/openvpn
01:55 < hyper_ch> hi krzee
01:56 < krzee> hey hyper_ch =]
01:56 < hyper_ch> krzee: up this late?
01:57 < krzee> nope, sleep-troubleshooting ;]
01:57 < krzee> actually im checking out how to build custom cyanogenmod roms... looks rather easy
01:58 < hyper_ch> why is everyone hyping cyanogenmod?
01:58 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
01:59 < krzee> ive been using it awhile
01:59 < krzee> i <3 it
01:59 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
01:59 < infinee> test
01:59 < infinee> yayyy! it works
01:59 < hyper_ch> infinee: failed
01:59 < infinee> thanks krzee!!
01:59 < krzee> you're welcome =]
01:59 < krzee> it comes with openvpn built in to its interface, voice over ip built into it
02:00 < krzee> google goggles built into it
02:00 < infinee> it was a former s.conf in my /etc/openvpn that was causing problems.
02:00 < krzee> basically its a big hammer of DOES for your phone
02:00 < krzee> ahh i see, glad its working
02:02 -!- neu3no|mac [~neu3no@f055070249.adsl.alicedsl.de] has joined #openvpn
02:03 < infinee> here in HK, they aren't announcing the touchpad price reduction until tomorrow. hopefully I'll be able to pick up one or two to play with
02:03 < hyper_ch> krzee: ever tried beast mod?
02:04 < krzee> neg
02:04 < hyper_ch> don't be so negative :)
02:04 < krzee> haha
02:06 < hyper_ch> krzee: you have any experience with powerline adapters?
02:07 < krzee> nah you gunna play with some?
02:08 < hyper_ch> wireless in the office here is shaky
02:08 < hyper_ch> lots of concrete between rooms
02:08 < hyper_ch> so I thought I just might switch to powerline
02:09 < krzee> same, i went with repeaters
02:09 < krzee> didnt really think bout powerline
02:09 < krzee> ive never even seen 1
02:09 < krzee> but i did know they exist
02:09 < hyper_ch> krzee: repeater seem to be... hmm.... you know :)
02:10 -!- Wildy_ [~lion@212.119.246.18] has joined #openvpn
02:23 -!- kloeri_ is now known as kloeri
02:25 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 250 seconds]
02:27 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Read error: Operation timed out]
02:29 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
02:49 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
02:49 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
02:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:00 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
03:04 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
03:04 < civillian> finally got it working
03:04 < civillian> gah
03:10 < hyper_ch> civillian: congrats.... but what did you get working?
03:17 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:44 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
03:44 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Read error: Connection reset by peer]
03:45 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
03:53 < uuuppz> civillian & hyper_ch: I got "it" working as well
03:54 < uuuppz> but damned if I am gonna tell you what "it" is
03:54 < hyper_ch> but it is just a story
03:54 < hyper_ch> s/it/"it"/
03:54 < uuuppz> s/it/shit?
03:54 < uuuppz> :)
03:54 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
03:54 < hyper_ch> s/it/\"it\"/
03:55 < hyper_ch> I think that would be correct
03:55 < uuuppz> now thats just geeky
03:55 < hyper_ch> don't call me geeky
03:55 < hyper_ch> I don't know anything about computers
03:55 < hyper_ch> I even have a ahrd time finding the power on button
03:55 < hyper_ch> for that reason I just let it run
04:03 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 252 seconds]
04:03 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
04:04 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
04:04 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has joined #openvpn
04:06 -!- dazo_afk is now known as dazo
04:07 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Ping timeout: 252 seconds]
04:08 -!- luneff [~yury@84.51.199.63] has joined #openvpn
04:08 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has quit [Client Quit]
04:08 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
04:09 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
04:10 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
04:15 -!- K1ng` [~KING@unaffiliated/k1ng] has joined #openvpn
04:18 -!- K1ng` [~KING@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
04:18 -!- k1ng [~KING@unaffiliated/k1ng] has quit [Ping timeout: 250 seconds]
04:18 -!- K1ng` [~KING@unaffiliated/k1ng] has joined #openvpn
04:19 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
04:21 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
04:21 -!- uuuppz [~uuuppz@213.79.53.61] has quit []
04:29 -!- yell0 [yello@unaffiliated/contempt] has quit [Remote host closed the connection]
04:29 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
04:35 -!- yell0 [yello@unaffiliated/contempt] has quit [Remote host closed the connection]
04:36 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
04:38 -!- K1ng` [~KING@unaffiliated/k1ng] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
04:41 -!- yell0 [yello@unaffiliated/contempt] has quit [Remote host closed the connection]
04:42 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
04:47 -!- K1ng [~KING@unaffiliated/k1ng] has joined #openvpn
04:47 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
04:52 -!- dazo is now known as dazo_afk
04:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
05:02 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
05:02 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
05:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:13 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14948>
05:19 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682.html#p14949>
05:28 -!- dazo_afk is now known as dazo
05:32 -!- neu3no_mac [~neu3no@g226251133.adsl.alicedsl.de] has joined #openvpn
05:33 -!- infinee [infinii@riptide.ethzero.net] has left #openvpn []
05:34 -!- neu3no|mac [~neu3no@f055070249.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
05:34 -!- neu3no_mac is now known as neu3no|mac
05:45 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
05:52 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
05:53 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Read error: Operation timed out]
05:55 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 246 seconds]
05:57 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:58 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
06:01 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
06:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
06:14 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:19 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682-15.html#p14950>
06:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
06:36 -!- Olipro [~Olipro@dsl51B61AE6.pool.t-online.hu] has joined #openvpn
06:36 -!- Olipro [~Olipro@dsl51B61AE6.pool.t-online.hu] has quit [Changing host]
06:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
06:37 -!- Wildy_ [~lion@212.119.246.18] has quit [Remote host closed the connection]
06:37 -!- luneff [~yury@84.51.199.63] has quit [Quit: This computer has gone to sleep]
06:40 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 250 seconds]
06:41 -!- EugeneKaway is now known as EugeneKay
06:57 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
07:00 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
07:00 -!- mode/#openvpn [+o mattock] by ChanServ
07:00 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 245 seconds]
07:08 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
07:17 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
07:19 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
07:19 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
07:20 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
07:22 -!- K1ng [~KING@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
07:26 -!- luneff [~yury@188.114.31.127] has joined #openvpn
07:29 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit []
07:32 -!- K1ng [~KING@unaffiliated/k1ng] has joined #openvpn
07:40 -!- luneff [~yury@188.114.31.127] has quit [Ping timeout: 252 seconds]
07:41 -!- solarce [solarce@elle.fallingsnow.net] has quit [Ping timeout: 252 seconds]
07:42 -!- solarce [~solarce@elle.fallingsnow.net] has joined #openvpn
07:47 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
07:47 -!- luneff [~yury@188.114.31.127] has joined #openvpn
07:53 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:03 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:05 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
08:06 < Onepamopa> hi guys, Im wondering is there any way of openvpn to act like gre tunnel for incomming / outgoing connections
08:06 < Onepamopa> and a way to assign real ip addresses to clients, instead of 10.8.x.xxx
08:11 <@vpnHelper> RSS Update - forum: OpenVPN client multiple server setting <http://forums.openvpn.net/topic8680.html#p14951>
08:13 -!- Bagualas [~eu@189.103.114.91] has joined #openvpn
08:14 < Bagualas> Is possible to make the VPN client, to connect using link of eth2 ? the Server i know how to do it... but on client dont 
08:17 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
08:17 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
08:17 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:28 < Onepamopa> seems like everyone's asleep ;)
08:29 -!- mape2k [~mape2k@f053192213.adsl.alicedsl.de] has joined #openvpn
08:31 < Bagualas> =)
08:43 < Bushmills> Bagualas: client packets follow route.  specify server address which is routed through eth2
08:44 < Bagualas> Bushmills using like iproute ?
08:45 < Bushmills> whatever you're using to introduce routes 
08:47 < Bagualas> ok thanks Bushmills
08:48 < Bushmills> Onepamopa: as the vpn subnet is meant to be contactable exclusively by interfaces on the vpn, it makes no sense to waste precious non-rfc1918 ip addresses, which are better used for public access.    
09:01 -!- master_of_master [~master_of@p57B53A86.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:02 < gladiatr> hm... dunno Bushmills... go IPv6 and you don't have to wait to get your 70 virgins...
09:03 -!- master_of_master [~master_of@p57B52166.dip.t-dialin.net] has joined #openvpn
09:03 < Onepamopa> hm
09:03 < Onepamopa> anyone:
09:03 < Onepamopa> Tue Aug 23 18:02:47 2011 TUN/TAP device /dev/tun0 opened
09:03 < Onepamopa> Tue Aug 23 18:02:47 2011 /sbin/ifconfig tun 10.8.0.1 10.8.0.2 mtu 1500 netmask 255.255.255.255 up
09:03 < Onepamopa> ifconfig: interface tun does not exist
09:03 < gladiatr> what os?
09:03 < Onepamopa> freebsd
09:03 < gladiatr> kldload if_tun
09:03 < Onepamopa> config option: dev-node /dev/tun0
09:03 < Onepamopa> if I comment dev-node it works fine
09:04 < Onepamopa> but I have to run two separate openvpn servers on two different tunnels
09:04 < gladiatr> o
09:04 < Onepamopa> so I need to "write" which vpn uses which tunnel
09:04 < Onepamopa> so, anyone has any ideas why isnt this working ?
09:04 < gladiatr> Hrm... I would be somewhat more helpful but my freebsd system shot flames from its power supply a few weeks back and I haven't gotten around to fixing it yet
09:05 -!- amero [~amero@unaffiliated/amero] has quit [Quit: Leaving [WeeChat 0.3.5]]
09:05 < Onepamopa> ls /dev/tun
09:05 < Onepamopa> tun0  tun1
09:05 < Onepamopa> tunnels are also created
09:06 < Onepamopa> the strange thing is this error: interface tun does not exist
09:06 < Onepamopa> I wrote tun0 and 1 not "tun" ..
09:06 < Bushmills> gladiatr, as this was an openvpn question, and openvpn support for ipv6 isn't that great atm, i suppose that the question was related to ipv4 addresses
09:06 < gladiatr> Bushmills, just teasin'
09:07 < Bushmills> just trying to apply logic
09:11 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
09:11 -!- Wildy is now known as Wildy_
09:13 < Onepamopa> blah
09:14 < gladiatr> loading up a fbsd82 vm.  I can't remember ever having problems specifying a specific tun interface with openvpn
09:14 < gladiatr> what version of openvpn are you using?
09:16 < Onepamopa> OpenVPN 2.1.1 amd64-portbld-freebsd8.0 [SSL] [LZO2] built on Mar  2 2011
09:17 < Onepamopa> Ive tested with dev-node tun0 and dev-node /dev/tun0
09:17 < Onepamopa> same error
09:23 < gladiatr> oh.  wait.  use the dev directive... I haven't even used dev-node outside a windows environment.
09:23 < gladiatr> dev tun12
09:23 < gladiatr> or whichever
09:23 < CybDev> dev-type and dev innit?
09:24 < gladiatr> if OpenVPN wouldn't just work, I would have to look at my configs more frequently and would Just Remember things like that
09:24 < hyper_ch> luckily OpenVPN just works (tm)
09:24 < Onepamopa> gladiatr w8 to test
09:25 < gladiatr> nod
09:26 < Onepamopa> that did it
09:26 < Onepamopa> so, dev-node is totally unusable @ freebsd ;)
09:26 < Onepamopa> just dev devX
09:27 < gladiatr> I don't know.  Like I said, I've never messed with it outside Windows
09:28 < gladiatr> I think what that *might* be referring to is the the actual dev node on a system such as linux where you have a controller node such as /dev/net/tun
09:28 < gladiatr> But really not sure
09:31 -!- solarce [~solarce@elle.fallingsnow.net] has quit [Ping timeout: 252 seconds]
09:32 -!- solarce [solarce@elle.fallingsnow.net] has joined #openvpn
09:32 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
09:32 -!- mode/#openvpn [+v Axeman] by ChanServ
09:34 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
09:35 -!- mape2k [~mape2k@f053192213.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
09:38 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Read error: Connection reset by peer]
09:39 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
09:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:47 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 258 seconds]
09:48 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
09:51 -!- Wildy_ [~lion@212.119.246.18] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
09:56 <@vpnHelper> RSS Update - forum: nat + routing issue on target site <http://forums.openvpn.net/topic8697.html>
10:12 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
10:18 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Read error: Operation timed out]
10:22 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
10:23 -!- R-66Y [~nobody@elegua.za.net] has joined #openvpn
10:23 < R-66Y> how does one add an additional TAP device if OVPN isn't automatically creating it?
10:24 < R-66Y> (I have a tap0, tap1 but no tap2, even though I'm starting 3 VPNs)
10:28 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Remote host closed the connection]
10:29 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
10:29 < Darkclaw66> hello, I am interested for Openvpn to disconnect a client if it is inactive for x amount of time but I don't want it to apply to all clients, is that possible?
10:54 < gladiatr> Darkclaw66, there is no native functionality to do that.  You'd probably need to do some scripting on the server-side possibly interacting with openvpn's management interface
10:55 < gladiatr> R-66Y, what OS?
10:55 -!- K1ng` [~KING@unaffiliated/k1ng] has joined #openvpn
10:57 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has joined #openvpn
10:58 -!- K1ng [~KING@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
10:58 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 260 seconds]
11:02 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: REALITY.SYS Corrupted: Re-boot universe? (Y/N/Q)]
11:02 -!- dazo is now known as dazo_afk
11:05 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
11:08 <@vpnHelper> RSS Update - forum: tcp dup ack from wireshark, is this a problem? <http://forums.openvpn.net/topic8695.html#p14953>
11:11 < |Mike|> tcp dup ack ?!
11:11 < |Mike|> lol
11:22 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
11:22 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
11:22 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:33 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
11:39 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
11:41 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:42 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
11:42 -!- Tick-Tock [~Tick-Tock@lunari.us] has quit [Ping timeout: 240 seconds]
11:42 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 240 seconds]
11:42 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 240 seconds]
11:42 -!- hyper__ch is now known as hyper_ch
11:42 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
11:44 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
11:44 -!- JPeterso2 is now known as JPeterson
11:51 -!- MrWGW [MrWGW@74.124.192.8] has quit [Ping timeout: 240 seconds]
11:52 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
11:55 -!- GHAI_ [~joti@cthulhu-isp.net] has joined #openvpn
11:56 -!- GHAI [~joti@cthulhu-isp.net] has quit [Ping timeout: 240 seconds]
11:56 -!- kerute [~kerute@kerunix.com] has quit [Ping timeout: 240 seconds]
11:57 -!- kerute [~kerute@kerunix.com] has joined #openvpn
12:11 -!- style [style@richardt.fi] has left #openvpn []
12:18 <@vpnHelper> RSS Update - forum: OpenVPN client multiple server setting <http://forums.openvpn.net/topic8680.html#p14954>
12:21 -!- bitterman [~yury@188.114.31.127] has joined #openvpn
12:24 -!- radioxid [~radioxid@bat44-1-78-233-236-126.fbx.proxad.net] has joined #openvpn
12:26 < Macphisto> Sorry for the noob question, is OpenVPN Access Server an enterprise product only?
12:26 < krzee> as opposed to...?
12:26 < Macphisto> Community, free use, etc.
12:26 < krzee> ahh yes
12:26 -!- luneff [~yury@188.114.31.127] has quit [Ping timeout: 240 seconds]
12:27 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Ping timeout: 240 seconds]
12:27 < krzee> i think it comes with a license or 2 for trying it out
12:27 < krzee> but ya, it costs $, comes with support, etc
12:27 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
12:28 < Macphisto> Thanks, was having a difficult time getting a straight answer online.
12:28 < krzee> you're online now ;)
12:28 < Macphisto> I know, those guys in #openvpn are all assh--- wait a sec
12:28  * krzee points at the intertubes below
12:28  * Macphisto checks for a series of tubes
12:31 < Macphisto> and naturally I find the pricing and licensing page after asking.  Dammit.
12:40 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
12:40 < radioxid> Do I *have to* edit the firewall's conf in order to full-tunnel, or I can just put my server in the DMZ ?
12:40 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 246 seconds]
12:46 < Bushmills> radioxid: you only "have" to edit firewall if they restrict your openvpn traffic
12:47 < radioxid> I'm testing @home with my server & client (… meaning on LAN…)
12:48 < radioxid> I can access LAN web pages but not WAN websites
12:50 < radioxid> If I find another wifi spot to access my then out-of-LAN server, I'm not sure if it'd be different
12:51 < radioxid> I think I'd still have that problem. What do you think?
12:52 -!- bitterman [~yury@188.114.31.127] has quit [Ping timeout: 264 seconds]
12:54 < Bushmills> maybe you do.  
12:55 < Bushmills> "that" problem is one of those one may have or have not.
12:55  * radioxid :)
12:55 < Bushmills> one doesn't have "that" problem if the firewall has been set up such that the problem doesn't occur
12:56 < Bushmills> if at loss, ask your firewall administrator
12:59 -!- bitterman [~yury@188.114.31.127] has joined #openvpn
13:04 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 260 seconds]
13:15 -!- bitterman [~yury@188.114.31.127] has quit [Quit: This computer has gone to sleep]
13:20 -!- uuuppz [~uuuppz@dsl-46-63.dsl.netsource.ie] has quit [Ping timeout: 252 seconds]
13:40 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
13:41 -!- sobersab1e [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
13:41 < sobersab1e> hi guys.
13:41 -!- sobersab1e [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Quit: leaving]
13:42 -!- cpm is now known as jcpm
13:44 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
13:44 < sobersabre> hi, me again.
13:45 < sobersabre> 2 questions, 1) what are the standard encryptions most openvpn users deploy ?
13:45 -!- jcpm is now known as cpm
13:45 < sobersabre> you can omit "standard".
13:48 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
13:48 < sobersabre> 2) I am initiating openvpn transition from old checkpoint VPN-1 solution. one of the things that would help is to tell the boss who else is using it, and it better be government/industry big boys. I see "partners" on the website, are these partners who use it in their solutions, or what?
13:50 -!- mete [~mete@mete.shell.la] has joined #openvpn
13:52 -!- neu3no|mac is now known as neu3no
13:53 < uuuppz> sober: How big is your company? How you phrase things will depend on that
13:53 -!- mape2k [~mape2k@f053192213.adsl.alicedsl.de] has joined #openvpn
13:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:56 < sobersabre> small company, dozen peepz.
13:57 < sobersabre> but we don't like being messed around, like anybody.
13:57 < trumee> I have a weird issue. I am running openvpn server on a opnwrt router and have two clients. I am able to ping to one client from the server but cant to the second client. Both clients can ping back to the server.
13:58 < sobersabre> trumee: it sounds like a routing issue.
13:58 < krzie> i dont think government using it should matter much...
13:58 < uuuppz> sobersabre: do you already use open source?
13:58 < trumee> sobersabre: routing issue at servers end?
13:58 < sobersabre> krzie: whatever. if I coul
13:58 < krzie> seeing as they arent exactly known for the best security...
13:58 < neu3no> trumee: what does ping say ?
13:58 < sobersabre> trumee: I can't tell without knowing more. could be on either side.
13:58 < trumee> neu3no: ping doesnt respong at all
13:58 < neu3no> k
13:58 < krzie> trumee, 
13:58 < uuuppz> krzee: working on improving that ;)
13:58 < krzie> !c2c
13:58 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
13:58 <@vpnHelper> clients
13:58 < sobersabre> trumee: are you blocking ICMP ?
13:59 < krzie> try that
13:59 < neu3no> client
13:59 -!- radioxid [~radioxid@bat44-1-78-233-236-126.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
13:59 < neu3no> sobersabre: if he blocks icmp ping responde "filtered" or "port unreachable" right?
13:59 < trumee> krzie: i do have client-to-client enabled.
13:59 < krzie> you said router... is it openwrt?
13:59 < sobersabre> uuuppz: we do use many  opensource technologies.
13:59 -!- luneff [~yury@84.51.199.63] has joined #openvpn
13:59 < uuuppz> you got linux experience in house other than you?
14:00 < trumee> sobersabre: The client which i cant ping to is behind 3 3g network.
14:00 < trumee> krzie: yes, openwrt.
14:00 < krzie> if so, make a -I accept rule for FORWARD chain -o tun+ and -i tun+
14:00 < trumee> krzie: and i am using tap.
14:00 < krzie> its blocking the forwarding... i had the same issue recently
14:00 < krzie> why are you using tap...?
14:00 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
14:01 < trumee> krzie: because to get the same ip naming scheme and simplicity
14:01 < trumee> krzie: i am connecting to an asterisk server sitting behind the openvpn server.
14:01 < krzie> !tunortap
14:01 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
14:01 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
14:02 < krzie> so?  i connect to freeswitch like that, it doesnt need tap
14:02 < sobersabre> uuuppz: we have, of course. the IT guy is very capable, we're basically on the way to be MS free zone, but VPN is something we ignored for a while.
14:02 < sobersabre> and it's hard to train old dogs new tricks... except using linux, mercurial, etc.
14:02 < uuuppz> Ok then
14:02 < krzie> trumee, you dont need tap for IP traffic, learning routing is the better choice
14:02 < sobersabre> :)
14:03 < trumee> krzie: is it possible that Three (mobile ISP) is blocking icmp?
14:03 < krzie> not over the vpn...
14:03 < krzie> all it sees is the vpn tunnel, doesnt know that icmp is inside it
14:03 < uuuppz> I'd argue that OpenVPN is an opensource solution based on the industry standard OpenSSL library that powers more than half the worlds secure websites. Would you be happy giving your credit card info to google or amazon? If yes then the same encryption technology is used for openvpn. Good enough?
14:04 < trumee> krzie: right. Strange that i can ping one client but not the other.
14:04 < krzie> uuuppz, ild argue its more secure than what the websites use even =]
14:04 < krzie> since you run your own CA, dont need to trust 3rd parties
14:04 < sobersabre> uuuppz: there are 2 aspects, the trust technology, and the support. what does the support include ? (if you have the idea)
14:04 < uuuppz> krzie not a true advantage of openvpn
14:05 < uuuppz> sober: This is why I asked if you hand inhouse opensource expereince
14:05 < krzie> right, but im expanding on what you said... if you trust those sites with your cc, you can trust this a little more
14:05 < sobersabre> we have, but we may need some optimizations, choose the right method of encryption, etc.
14:05 < uuuppz> well
14:05 < uuuppz> you'll either have to find a consultant
14:06 < sobersabre> I mean at the beginning, then we'll write this down properly, and remember it as long as the datacenter keeps it.
14:06 < krzie> uuuppz, no *real* support
14:06 < uuuppz> ask questions here on forum
14:06 < krzie> just what you get from the community
14:06 < uuuppz> or tal,k to the company
14:06 < krzie> irc / forum / mail list
14:06 < trumee> is there anything i can pastebin which would help?
14:06 < krzie> very active community tho
14:06 < sobersabre> uuuppz: I meant the openvpn they do offer support, don't they ?
14:06 < uuuppz> no idea
14:06 < uuuppz> someone else field that :P
14:07 < krzie> trumee, the server can ping the clients but they cant ping eachother...?
14:07 < trumee> krzie: server can ping 1 client but not the 2nd client.
14:07 < krzie> sobersabre, for access-server, yes
14:07 < trumee> krzie: 2nd client can ping 1st client. But 1st client cannot ping 2nd client.
14:07 < krzie> if you need corp support, go with access-server
14:07 < krzie> 2nd client has a firewall issue
14:07 < trumee> krzie: so baslically nothing can ping the 2nd client.
14:08 < krzie> can 2nd client ping server?
14:08 < trumee> krzie: yes, it can
14:08 < krzie> then ya, definite issue on client 2's firewall
14:08 < krzie> not the ISP, the client itself
14:08 < trumee> krzie: i dont have a firewall, it is my mobile Nokia N900
14:09 < krzie> just to clarify, we're talking about the client itself and not a lan machine behind it...
14:09 < krzie> trumee, well i dunno... its definitely client 2 blocking pings if i t can ping the server but the server cant ping it
14:09 < krzie> what ip are you trying to ping?
14:09 < hyper_ch> hi krzie
14:09 < krzie> hey hyper_ch 
14:09 < hyper_ch> I found a great site today :)
14:10 < krzie> youporn.com?
14:10 < hyper_ch> almost as great as openvpn :)
14:10 < hyper_ch> http://www.where-is-this.com/  :)
14:10 <@vpnHelper> Title: WHERE IS THIS - Main (at www.where-is-this.com)
14:10 < trumee> krzie: trying to ping 172.16.1.200 which is the client address
14:11 < krzie> you still using tap?
14:11 < trumee> krzie: yes
14:11 < krzie> why?
14:11 < krzie> lol
14:11 < hyper_ch> !tunortap
14:11 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:11 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
14:12 < krzie> ya i just showed him that
14:12 < trumee> krzie: because, that is how i had set it up.
14:12 < krzie> trumee, care to do it right instead?
14:13 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Ping timeout: 252 seconds]
14:13 < trumee> krzie: ok. why does lan gaming need tap?
14:13 < krzie> because many lan games communicate on layer2
14:14 < trumee> krzie: i need udp packets to goto asterisk server. will that be ok with tun?
14:14 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
14:14 < krzie> udp is IP, yes
14:14 < krzie> [12:02]  <krzie> so?  i connect to freeswitch like that, it doesnt need tap
14:15 < krzie> for the record, freeswitch is another phone server like asterisk, but with less suck
14:15 < trumee> krzie: yes, i have tried freeswitch before
14:15 < krzie> http://www.freeswitch.org/node/117
14:15 <@vpnHelper> Title: How does FreeSWITCH compare to Asterisk? | FreeSWITCH (at www.freeswitch.org)
14:15 < trumee> krzie: it doesnt play well with Nokia N900
14:16 < trumee> krzie: is there any preference between asterisk and freeswitch with openvpn?
14:16 < krzie> no
14:16 < krzie> openvpn just tunnels traffic
14:16 < krzie> it doesnt know or care what in the traffic
14:16 < krzie> EXCEPT
14:16 < krzie> tun is layer3 (IP)
14:17 < krzie> tap is layer2 (destined for mac address)
14:17 < trumee> krzie: any reason you dont use tls/srtp in freeswitch?
14:17 < trumee> krzie: instead of openvpn.
14:17 < krzie> who said i dont...?
14:17 < krzie> i use openvpn to protect many / most my non-public services
14:17 < krzie> and since my voip server does not interconnect (darknet) i dont let it touch the public
14:19 < trumee> krzie: sorry struggling to understand you. You use openvpn + tls/srtp for the FS server?
14:20 < krzie> i definitely use openvpn, i did not mention what else i use inside the openvpn tunnel
14:20 < krzie> since it is irrelevant to the conversation
14:20 < krzie> im not telling you that you must use openvpn
14:20 < krzie> you can use srtp/tls if you prefer
14:20 < krzie> im just saying that you dont need tap
14:21 < trumee> krzie: fair enough. I will modify my setup for tun. you reckon it will sort out the problem with pings
14:21 < krzie> trust me you dont want to just blindly set things up like my setup... i have non-standard needs ;]
14:21 < krzie> also use topology subnet if all clients are 2.1 or higher
14:21 < krzie> !/30
14:21 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
14:21 < krzie> !topology
14:21 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
14:22 < krzie> since .200 isnt a valid ip in the default topology for tun
14:28 < trumee> krzie: yes, all the client are 2.1.1
14:31 -!- Darkclaw66 [~andre@unaffiliated/darkclaw66] has quit [Quit: Leaving]
14:39 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:40 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
14:44 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 264 seconds]
14:44 < trumee> krzie: ok, i have moved to tun. The client is unable to ping machines behind the server. I did specify a push "route 172.16.1.0 255.255.255.0" in server config
14:45 < trumee> krzie: The client can ping to 172.16.1.1 which is the openvpn/openwrt router but cant ping to a machine 172.16.1.100 sitting behind the server
14:48 < trumee> krzie: http://pastebin.com/FpEs0bvm
14:48 -!- Onepamopa [~onepamopa@62.204.152.143] has joined #openvpn
14:50 -!- Onepamopa [~onepamopa@62.204.152.143] has quit [Changing host]
14:50 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
14:50 < Onepamopa> hm, is there a possibility for openvpn to "make" separate tunnel for each connecting client ?
14:51 < Onepamopa> I mean tun0/1/2/3/4-100
14:51 < Olipro> 1 interface per config
14:51 < Olipro> if you want additional tun interfaces, you need additional configs
14:52 < Olipro> what is it that you can do with multiple interfaces that you can't do with the one?
14:52 < krzie> !lan
14:55 < trumee> krzie: is this the issue, [20:00] <krzie> if so, make a -I accept rule for FORWARD chain -o tun+ and -i tun+ ?
14:55 < krzie> !route
14:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
14:56 < krzie> !serverlan
14:56 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
15:00 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
15:04 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 264 seconds]
15:05 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
15:07 <@vpnHelper> RSS Update - forum: How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p14955>
15:13 -!- naquad_ [~naquad@174.142.224.219] has joined #openvpn
15:16 < krzie> trumee, i was talking about ip forwarding before i understood it was only a 1-way ping issue
15:16 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 260 seconds]
15:17 < krzie> trumee, did you do the things in !serverlan
15:17 < krzie> ?
15:17 < trumee> krzie:yes it an openwrt router and has ip forwarding enabled
15:18 < krzie> did you push its lan to clients?
15:18 < krzie> as seen in !route
15:19 < trumee> yes
15:19 < trumee> krzie: [20:48] <trumee> krzie: http://pastebin.com/FpEs0bvm
15:21 < trumee> krzie: ran out of time. going to check this tomorrow. thanks for help
15:22 < krzie> and none of your clients are in a 172.16.1.0 network, right?
15:22 < krzie> add topology subnet to your server config
15:22 < krzie> cool, ttyl
15:22 < krzie> and np =]
15:25 -!- mape2k [~mape2k@f053192213.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
15:25 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:26 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
15:29 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
15:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Client Quit]
15:34 <@vpnHelper> RSS Update - forum: Server receives ping requests but no reply <http://forums.openvpn.net/topic8691.html#p14956>
15:52 -!- GHAI_ is now known as GHAI
15:54 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
16:02 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
16:09 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
16:11 <@vpnHelper> RSS Update - forum: Server receives ping requests but no reply <http://forums.openvpn.net/topic8691.html#p14958> || How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p14957>
16:20 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
16:40 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
16:40 -!- mode/#openvpn [+v Axeman] by ChanServ
16:48 -!- krzie [krzee@hemp.ircpimps.org] has joined #openvpn
16:48 -!- krzie [krzee@hemp.ircpimps.org] has quit [Changing host]
16:48 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
16:50 -!- Bagualas [~eu@189.103.114.91] has quit [Quit: Reserve your copy of The 7 Deadly Sins for the Nintendo GameCube today!   [www.t7ds.com.br]]
17:03 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
17:04 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Client Quit]
17:04 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
17:09 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 246 seconds]
17:17 <@vpnHelper> RSS Update - forum: Bridging between different subnets (Class A & Class B) ?? <http://forums.openvpn.net/topic8698.html> || Server receives ping requests but no reply <http://forums.openvpn.net/topic8691.html#p14959>
17:18 -!- qbasicer [~qbasicer@24-246-12-52.cable.teksavvy.com] has joined #openvpn
17:19 < qbasicer> After one starts bridge-start, are they supposed to lose all network connectivity?
17:22 < qbasicer> http://pastebin.com/bgqjtjWE     After I run bridge-start, everything stops working
17:22 < qbasicer> Oops sorry, I really meant this one: http://pastebin.com/3sR783gR
17:23 -!- Cain [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
17:25 < EugeneKay> "Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
17:26 < krzie> it even gives your cat cancer and aids
17:27 < qbasicer> Soooo basically don't do it?
17:27 < qbasicer> Or am I doing somethign wrong?
17:28 < krzie> !tunortap
17:28 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
17:28 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
17:29 < krzie> you need layer2 over the vpn?
17:30 < qbasicer> #2 and #4 both
17:31 < qbasicer> !tap
17:31 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything where
17:31 <@vpnHelper> the protocol uses MAC addresses instead of IP addresses.
17:34 < qbasicer> I'm unsure as to why my parameters to bridge-start don't seem to be producting the predicted results
17:37 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
17:43 -!- neu3no [~neu3no@g226251133.adsl.alicedsl.de] has left #openvpn []
17:43 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5]
17:44 -!- blackpenguin [~bp@gnuffy.net] has joined #openvpn
17:44 -!- blackpenguin [~bp@gnuffy.net] has quit [Changing host]
17:44 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
17:44 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Client Quit]
17:45 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
17:46 < qbasicer> krzie: I assume you odn't know either :(
17:46 < |Mike|> odn't?
17:47 < qbasicer> *don't
17:47 < |Mike|> qbasicer: you might want to read what vpnHelper uttered when you entered !tap
17:47 < qbasicer> I did, and I'm still rather lost :(
17:47 < |Mike|> !configs
17:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
17:47 < |Mike|> !logs
17:47 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:48 < qbasicer> I don't have logs since I don't even get to the point where I bring up openvpn - I pasted the results of my commands and configurations here: http://pastebin.com/3sR783gR
17:50 < |Mike|> proto tcp, dev tap0? lol
17:51 < qbasicer> I tried udp but I think my router wasn't happy with port forwarding
17:51 < |Mike|> port forwarding on ethernet level, cute
17:52 < qbasicer> I have to port forward from my router to my vpn server so that the clients can connect
17:53 < |Mike|> that makes a bit more sense :)
17:54 < qbasicer> I had a semi-working config where I created 192.168.8.0/24, but it didn't QUITE work the way I wanted it to, and I think I was doing it totally wrong and getting confused between tun and tap configurations
17:55 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
17:55 < qbasicer> Am I supposed to run the bridge-start before running openvpn?
17:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:57 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 246 seconds]
17:58 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:58 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5]
18:00 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
18:01 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Client Quit]
18:05 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
18:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
18:15 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:16 -!- Denial [Denial@drgi.co.uk] has quit []
18:16 < krzie> qbasicer, you still never said why you're even using tap
18:16 < krzie> what layer2 protocol do you need over the vpn?
18:17 < qbasicer> Steambirds (android game), SNES emulator for netplay (ipx?)
18:18 < krzie> ahh
18:18 < krzie> do you set a new gateway in the bridge script?
18:18 < qbasicer> I *JUST* figured out it was my gateway being killed
18:18 < krzie> you will lose your default gateway since you start using a new interface...
18:19 < qbasicer> I got a br0 and a tap0 and I can connect and I have my client connected, just the client can't talk through the tunnel
18:19 < qbasicer> From 192.168.1.102 icmp_seq=2 Destination Host Unreachable
18:20 < krzie> ya i dont use tap so i cant really troubleshoot it
18:20 < qbasicer> np
18:20 < krzie> i usually just point out that people dont need tap... but in your case you do so im useless for ya ;]
18:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
18:21 < qbasicer> If I can figure this out and can get both things to work, I get rewarded by the gf well... lots of motivation to get this to work :)
18:25 < reiffert> moin krzie
18:25 < reiffert> "wsup"?
18:27 < krzie> moinmoin!
18:27 < krzie> wow i wish i had girls who rewarded me for getting vpns up
18:28 < krzie> they just give me a blank stare when i talk about computers, lol
18:28 < ecrist> heh, my girls reward me by getting *me* up.
18:28 < ecrist> :P
18:28 < qbasicer> :P
18:28 < qbasicer> I just gotta get it to actually WORK
18:29  * ecrist sits outside, drinking Jack + Coke, in the sun.
18:29 < krzie> not much reif, how are you doin?
18:30 -!- secondchoice [~thirdchoi@knox.pace.edu] has joined #openvpn
18:31 < reiffert> been busy these days (months?), and round and round and round it goes
18:31 < reiffert> last week I was helping a guy on #openvpn who rewarded me by 150 USD on paypal.
18:31 < reiffert> that was crazy!
18:31 < krzie> im on my first day back from vacation and already have a list of 7 things that need fixing
18:32 < krzie> hey cool!
18:32 < ecrist> !donate
18:32 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel., or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc., or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
18:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:32 < krzie> did ecrist hear about it to put it in the list?
18:32 < reiffert> nah, he didnt
18:33 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
18:35 < reiffert> so what will the irc channel get when I donate something?
18:36 < krzie> why would you donate something?
18:36 < krzie> you've been here helping people for years
18:36 < krzie> ild say thats PLENTY donation
18:36 < reiffert> thought that ecrists reaction might be an invatation
18:36 < reiffert> invetation?
18:37 < reiffert> invitation?
18:37 < reiffert> invi.
18:37 -!- Jarpse_ [~jarpse@84-245-22-127.dsl.cambrium.nl] has quit [Ping timeout: 240 seconds]
18:39 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has joined #openvpn
18:41 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: leaving screen]
18:42 -!- tck9 [60309532@gateway/web/freenode/ip.96.48.149.50] has joined #openvpn
18:43 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
18:43 < krzie> [16:37]  <reiffert> invitation?
18:43 < krzie> that one
18:45 < tck9> my openvpn server has internal ip 10.2.30.1, i'm using dev tun and have the following in my openvpn server config. when i connect from a client, i get an Ip 10.2.30.200 (which is fine). from this client I can ping 10.2.30.1 (which is fine), but I can't ping 10.2.30.2. This .2 server is on the same subnet as the openvpn server and I can ping it from the openvpn server.
18:45 < tck9> server 10.2.30.192 255.255.255.224
18:45 < tck9> push "route "10.2.30.0 255.255.255.0"
18:47 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
18:48 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
18:50 < civillian> tck9: because your client subnet overlaps your LAN subnet
18:51 < civillian> try server 10.2.31.0 255.255.255.224
18:51 < civillian> keep route 10.2.30.0 255.255.255.0
18:52 < tck9> is it possible to assign client ips in teh range 10.2.31.200-10.2.31-220 and still have then be able to access other physical machines on 10.2.31.x
18:52 < civillian> ensure your LAN clients are using openvpn as the default gw, or add a route to their default gw
18:52 < civillian> no
18:52 < civillian> the lan clients won't contact the gw to get to them, they will ARP for them
18:53 < civillian> if you want them in the same subnet you'll need TAP
18:54 < civillian> but I'd advise against it unless you need it
18:54 < reiffert> tck9: dev tap
18:55 < reiffert> but like civillian says, use routing instead.
18:55 < reiffert> (dev tun)
18:56 < tck9> for dev tap, is all that's involved chaning the server directive to server-bridge 10.2.30.200 255.255.255.0 10.2.30.210 10.2.30.240 ?
18:56 < civillian> and add bridging in the OS
18:57 < krzie> .224!?
18:57 < krzie> heh
18:57 < tck9> what would bridging look like? iptables rule ?
18:57 < civillian> tck9: what OS you got as the server?
18:57 < tck9> gentoo linux
18:58 < civillian>  emerge -n net-misc/bridge-utils
18:58 < civillian> google gentoo openvpn bridge
18:58 < tck9> ok.
18:59 < civillian> on my debian machine, brctl is used to get a bridge up
18:59 < tck9> one other thing, when using birdged mode, does 10.2.30.200 need to be assigned to an interface already on the openvpn server?
18:59 < civillian> then you add the interfaces to the bridge
18:59 < civillian> no
18:59 < civillian> try to forget IP with bridging
18:59 < civillian> its like an ethernet cable
18:59 < civillian> the cable doesn't have an IP
18:59 < tck9> k
19:00 < civillian> your lan clients will arp for x IP
19:00 < tck9> it looks like one of the other advantages of using tap is that you can specify a specific range like .210-.240 instead of being tied down to a strict subnetted range
19:00 < civillian> openvpn server will forward that down tap0 due to the bridging of the lan and tap interfaces
19:01 < civillian> yeh spose so
19:01 < civillian> what traffic are you using the vpn for?
19:01 < tck9> mostly mysql/apache to access internal resources when away from the office
19:02 < civillian> I'd still use tun, but that's me
19:02 < tck9> i'll try switching the client IP range for tun so that it doesn't overlap and see if that works
19:02 < tck9> tun does seem a lot easier
19:02 < civillian> yep, and I think you'll need an ip on your tun0 interface, from memory
19:03 < civillian> perhaps someone else can confirm that
19:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
19:06 < reiffert> spoke about dhcp requests from one side of the net to the other and vice vera yet?
19:06 < reiffert> blocking them requires ebtables
19:06 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 260 seconds]
19:07 < civillian> I'm sure it would, but he's going with tun for the moment
19:07 < civillian> why block them?
19:08 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has quit [Ping timeout: 268 seconds]
19:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:11 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has joined #openvpn
19:14 -!- kerryderry [~kerryderr@72.22.81.180] has joined #openvpn
19:20 < tck9> hmm, strange.. switched the tun server to a diff range (10.0.0.0 255.255.255.0) and even though it's not overlapping with 10.2.30.0/24, i still can't ping 10.2.30.2, can only ping 10.2.30.1, which is on the openvpn server itself
19:20 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14962>
19:23 < reiffert> civillian: just to make sure everything goes well, e.g. a client from lan A that does not do VPN, will stay on lan A, seen on L3
19:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
19:27 < ecrist> mostly, so far, the money sits in my paypal account.
19:27 < ecrist> reiffert: ^^^
19:27 < ecrist> that was just a reference, the !donate link, that is.
19:27 < EugeneKay> "Beer."
19:28 < ecrist> the money will eventually be put toward a vB license for the forum, likely in the next month
19:28 < EugeneKay> vB. HAH!
19:28 < ecrist> other than that, I have no idea what we'd use the money for.  which is why it's sat in an account so far.
19:28 < ecrist> EugeneKay: ?
19:29 < reiffert> http://snap.reifferscheid.org/lightning/
19:29 <@vpnHelper> Title: Index of /lightning (at snap.reifferscheid.org)
19:29 < EugeneKay> Paying money for forum software. Funny.
19:29 < reiffert> just shot some lightning photos. upload ongoing
19:30 < ecrist> EugeneKay: I'm open to suggestions.
19:30 < EugeneKay> https://secure.wikimedia.org/wikipedia/en/wiki/Comparison_of_Internet_forum_software
19:30 <@vpnHelper> Title: Comparison of Internet forum software - Wikipedia, the free encyclopedia (at secure.wikimedia.org)
19:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:30 < reiffert>  woo that was close
19:30 < reiffert> 300 meters approx
19:31 < ecrist> EugeneKay: that's not a suggestion for a forum software.  that's a pointer to a reference you assume I've not seen
19:31 < EugeneKay> It's not exactly a sparse market. 
19:31 < reiffert> another one
19:31 < EugeneKay> I personally think forums are the lowest common denominator of online culture, breeding an utter cesspool of wretched stupidity and hate.
19:32 < ecrist> EugeneKay: until you have constructive criticism, feel free to fuck-off proper.
19:32 < EugeneKay> My personal choice, however, is for something Drupal-based.
19:32 < reiffert> EugeneKay: ah we definitly do share some things, e.g. what to think about forums
19:32 < ecrist> heh, fuck drupal
19:32 < EugeneKay> Given that is.... not always the easiest to setup, especially if it's just for forums, I would suggest one of the GPL projects available.
19:33 < ecrist> what makes GPL forum software inherently better?
19:33 < EugeneKay> I believe phpBB is gpl
19:33 < EugeneKay> It doesn't "require" a "license" to use? :-p
19:33 < reiffert> whoa that one was even closer
19:33 < EugeneKay> reiffert|bbq ?
19:33 < ecrist> um, actually, GPL *is* a license, and, particularly GPLv3, very much required.
19:34 < EugeneKay> I mean, a commercial license.
19:34 < ecrist> commercial == bad?
19:34  * ecrist is still looking for *constructive* critisicm
19:34 < reiffert> EugeneKay: thunder and lightning going on "around" me
19:35 < EugeneKay> For something as simple as a php+mysql webforum, on a site that doesn't see 10 million hits per day? Yes, it's a waste of money.
19:35 < civillian> tck9: confirm tun client routing table
19:35 < reiffert> just uploading some jpg versions
19:35 < EugeneKay> Hence, I laughed at the idea.
19:35 < ecrist> EugeneKay: go away
19:36  * EugeneKay shrugs
19:36 < reiffert> http://snap.reifferscheid.org/lightning/IMG_2103.jpg
19:37 <@vpnHelper> RSS Update - forum: Route all traffic from one client through another <http://forums.openvpn.net/topic8699.html>
19:38 < ecrist> EugeneKay: honestly, if you have something specific to recommend, I'm all-ears.  you've offered nothing other than, "don't spend money"
19:38 < ecrist> why do you care, it's not your money?
19:38 < EugeneKay> <EugeneKay> I believe phpBB is gpl
19:39 < ecrist> we use it now, and anyone that administers it, hates it (our admins, not phpbb in general)
19:39 < EugeneKay> I've made a bit of a point of never seeing the admin panel on any forums, so I'll take it as writ.
19:40 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 250 seconds]
19:40 < ecrist> I've been using phpBB for many many years, and i've contributed code.  the fact is, I also use vB, and prefer it.  there's also a strong bias as i'm the forum admin
19:40 < ecrist> as soon as someone else steps up, willing to help, they can have more weight added to their opinion.
19:40 < reiffert> that doesnt change anything on what EugeneKay said.
19:41 < EugeneKay> I've also heard good things about SMF, but again, never seen the admin panel.
19:41 < ecrist> not trying to change what he said.  simply stating that what he said doesn't matter at all, as it wasn't constructive.
19:42 < EugeneKay> Well, aside from two(now three) options which I mentioned, no, not really.
19:42 <@vpnHelper> RSS Update - forum: how to add more port <http://forums.openvpn.net/topic8605.html#p14963>
19:42 < ecrist> 'heard good things' is a shitty review.  forum software X has THIS to die-for feature, or does THAT better than THIS is something different.
19:42 < reiffert> let's close the forum with a link to the irc connection. constructive enough?
19:42 < ecrist> we voted long ago to keep forum and IRC separte, save the RSS feed
19:42 < EugeneKay> I think that's fairly destructive.
19:42 < reiffert> ecrist: "developing"? ;)
19:42 < ecrist> separate*
19:46 < ecrist> reiffert: why do you care about the forum?  you're not on it, it doesn't affect you...
19:46  * EugeneKay grumbles something about old games and resolution forward-compatibility
19:46 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
19:49 < kerryderry> did you see the latest scooby -doo show ?  very funny ...
19:50 < kerryderry> Shaggy is a hoot
19:50 < kerryderry> Wait , sorry wrong channel
19:51 < kerryderry> I thought this was the scooby doo channel .
19:51 < reiffert> ecrist: dont worry, tough we should connect those two support forms the more. maybe things on the forum run into a complete different direction. dunno
19:52 < ecrist> reiffert: forum users tend to be more demanding and are far less willing to read documentation.
19:53 < ecrist> for the most part, IRC and forum are two distinct user bases
19:53 < ecrist> the RSS feed is here simply for 1) those that admin the forums who also live in IRC, and 2) for users who may see a topic that answers their question.
19:54 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
19:58 < reiffert> My client will ignore the RSS lines if it will get too much, but atm .. I'm fine
19:59 < reiffert> why not "improve" the forum users and make them read and learn stuff, e.g. let them join irc?
19:59 < reiffert> they will get what they deserve.
20:09 < ecrist> heh, don't worry, we make them read there.
20:10 < ecrist> it's like getting a train to drive down the roads.  a train can get from point A to point B, just a little different than a car
20:12 < EugeneKay> I prefer to ride the womantrain
20:12 < EugeneKay> Wait, this channel doesn't know about that
20:12  * EugeneKay buggers off
20:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
20:14 -!- tck9 [60309532@gateway/web/freenode/ip.96.48.149.50] has quit [Ping timeout: 252 seconds]
20:14 < ecrist> heh, if only you knew, young padwan
20:16 < ecrist> 12:36:11 < ircuser> So a linux nerd and bsd geek walk into a bar
20:16 < ecrist> 12:36:37 < ircuser> And the linux nerd says, ext4 has better performance and data protection than ufs2
20:16 < ecrist> 12:37:07 < ircuser> the bsd geek looks at him with an annoyed expression, "can't you see I'm trying to enjoy a beer with my girlfriend?"
20:18 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:18 < jpalmer> haha
20:19 < ecrist> ;)
20:21 < krzie> lol
20:21 < jeev> "teehee"
20:25 < qbasicer> krzie: I got it to work :)
20:25 < krzie> =]
20:26 < qbasicer> Turns out that when I changed dev tap0 to dev tap on |Mike|'s suggestion, openvpn was creating tap1 and not using tap0 which was bridged with eth0, so I restored the tap0 device and reset the default gateway... and poof! It all worked!
20:29 < ecrist> congrats
20:42 -!- kerryderry [~kerryderr@72.22.81.180] has quit [Ping timeout: 252 seconds]
20:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
20:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:58 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:58 -!- Axeman [~thirdchoi@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
20:58 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
20:58 -!- mode/#openvpn [+v Axeman] by ChanServ
21:00 -!- secondchoice [~thirdchoi@knox.pace.edu] has quit [Ping timeout: 258 seconds]
21:23 -!- secondchoice [~thirdchoi@knox.pace.edu] has joined #openvpn
21:24 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
21:26 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:31 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Quit: Leaving]
21:31 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:31 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
21:43 -!- secondchoice [~thirdchoi@knox.pace.edu] has quit [Read error: Connection reset by peer]
22:01 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682-15.html#p14964>
22:16 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 240 seconds]
22:17 -!- Guest74343 [~caesay@socialshock.net] has left #openvpn []
22:17 -!- caesay [~caesay@socialshock.net] has joined #openvpn
22:17 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
22:17 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
22:18 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
22:20 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has quit [Ping timeout: 268 seconds]
22:27 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
22:32 -!- EugeneKay is now known as EugeneKaway
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:36 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:45 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
23:17 -!- kerryderry [~kerryderr@71.21.164.84] has joined #openvpn
23:28 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has joined #openvpn
23:30 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
23:35 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
23:48 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
23:49 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 264 seconds]
23:51 -!- naquad_ [~naquad@174.142.224.219] has quit [Ping timeout: 252 seconds]
--- Day changed Wed Aug 24 2011
00:02 -!- LuckyY_ is now known as LuckyY
00:06 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
00:07 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Client Quit]
00:07 -!- K1ng` [~KING@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
00:07 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:17 < hyper_ch> !tunortap
00:17 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
00:17 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
00:18 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
00:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
00:33 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:43 <@vpnHelper> RSS Update - forum: Bridging between different subnets (Class A & Class B) ?? <http://forums.openvpn.net/topic8698.html#p14965>
00:52 -!- dazo_afk is now known as dazo
00:56 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:02 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:08 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 268 seconds]
01:16 -!- kaibosher [~pingwing@dsl-46-63.dsl.netsource.ie] has quit []
01:17 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has joined #openvpn
01:25 <@vpnHelper> RSS Update - forum: nat + routing issue on target site <http://forums.openvpn.net/topic8697.html#p14966>
01:31 <@vpnHelper> RSS Update - forum: OpenVPN client multiple server setting <http://forums.openvpn.net/topic8680.html#p14967>
01:34 -!- Onepamopa1 [~onepamopa@87-126-31-28.btc-net.bg] has joined #openvpn
01:34 -!- Onepamopa is now known as Guest90761
01:34 -!- Onepamopa1 is now known as Onepamopa
01:35 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has quit [Changing host]
01:35 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
01:36 -!- Guest90761 [~onepamopa@87-126-31-28.btc-net.bg] has quit [Ping timeout: 240 seconds]
01:37 <@vpnHelper> RSS Update - forum: Route all traffic from one client through another <http://forums.openvpn.net/topic8699.html#p14968>
01:38 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:42 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:42 <@vpnHelper> RSS Update - forum: nat + routing issue on target site <http://forums.openvpn.net/topic8697.html#p14969>
01:43 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
01:56 -!- openvpnuser [~openvpnus@119.93.51.34] has joined #openvpn
01:58 < openvpnuser> I have seen an ovpn file that does not state ca ca.crt but writte as <ca> asdkjfalsdjasdjflk etc etc </ca>
01:58 < openvpnuser> is that possible?
01:59 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
02:01 <@vpnHelper> RSS Update - forum: nat + routing issue on target site <http://forums.openvpn.net/topic8697.html#p14970>
02:02 -!- cherwin [1776628@xs8.xs4all.nl] has joined #openvpn
02:02 -!- openvpnuser [~openvpnus@119.93.51.34] has quit []
02:10 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
02:13 <@vpnHelper> RSS Update - forum: nat + routing issue on target site <http://forums.openvpn.net/topic8697.html#p14971>
02:19 < hyper_ch> krzee: http://fosspatents.blogspot.com/2011/08/samsung-cites-stanley-kubricks-2001.html
02:19 <@vpnHelper> Title: FOSS Patents: Samsung cites Stanley Kubrick's '2001: A Space Odyssey' movie as prior art against iPad design patent (at fosspatents.blogspot.com)
02:25 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 258 seconds]
02:26 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
02:27 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 252 seconds]
02:33 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
02:46 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
02:46 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
02:46 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
02:52 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
02:57 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
03:04 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 258 seconds]
03:05 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:08 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14973> || How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682-15.html#p14972>
03:09 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:12 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
03:14 <@vpnHelper> RSS Update - forum: nat + routing issue on target site <http://forums.openvpn.net/topic8697.html#p14976> || Route all traffic from one client through another <http://forums.openvpn.net/topic8699.html#p14975> || Bridging between different subnets (Class A & Class B) ?? <http://forums.openvpn.net/topic8698.html#p14974>
03:22 -!- dazo is now known as dazo_afk
03:22 < defswork> one thing I've noticed while stalking this channel
03:22 < defswork> 99% of all issues are routing issues and 99% of those are because the admin doesn't understand routing
03:26 < CybDev> need a "tcp/ip for dummies" on the sticky "mandatory litterature" thread :P
03:36 -!- kerryderry [~kerryderr@71.21.164.84] has quit [Ping timeout: 252 seconds]
03:40 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
03:41 < nuttersppadic> hello all 
03:42 < nuttersppadic> defswork CybDev yes routing/ firewall issues are the most common
03:44 <@vpnHelper> RSS Update - forum: http service stops after 2-3 days of working on public ip <http://forums.openvpn.net/topic8702.html>
03:49 -!- kerryderry [~kerryderr@71.21.164.84] has joined #openvpn
04:04 -!- dazo_afk is now known as dazo
04:18 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14979> || nat + routing issue on target site <http://forums.openvpn.net/topic8697.html#p14978>
04:22 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Read error: Connection reset by peer]
04:24 <@vpnHelper> RSS Update - forum: Open VPN library for Ubuntu and Mac <http://forums.openvpn.net/topic8703.html>
04:25 -!- Ragnar [~heimdall@darkstar.acool.net] has joined #openvpn
04:25 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
04:25 -!- Wildy is now known as Wildy_
04:34 < cherwin> defswork: True that.
04:36 < dropje> it's understandable since the documentation of OpenVPN is very good, so everyone is able to set it up. But translating it in to their situation is a different story.
04:39 -!- Ragnar [~heimdall@darkstar.acool.net] has quit [Ping timeout: 240 seconds]
04:40 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
04:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
04:47 < cherwin> Yeah, it's almost impossible to configure it in a decent way without grokking the fundamentals.
04:47 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:49 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
05:01 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:01 -!- mode/#openvpn [+v s7r] by ChanServ
05:06 < hyper_ch> !tunortap
05:06 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
05:06 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
05:09 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 260 seconds]
05:10 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
05:13 -!- Ragnar [~heimdall@darkstar.acool.net] has joined #openvpn
05:34 < Wildy_> !welcome
05:34 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:34 < Wildy_> !goal
05:34 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:34 < Wildy_> anyone uses ospf over openvpn? i'm planning this setup in the future
05:44 -!- Ragnar [~heimdall@darkstar.acool.net] has quit [Ping timeout: 252 seconds]
05:44 < reiffert> !factoids search --values ospf
05:44 <@vpnHelper> No keys matched that query.
05:44 < reiffert> !factoids search ospf
05:44 <@vpnHelper> No keys matched that query.
05:44 < reiffert> !factoids search --values rip
05:44 <@vpnHelper> 'iporder', 'mitm', 'crl', 'pushdns', 'rip', 'mesh', 'winscript', 'ssl-admin', 'linportforward', 'linportforward', 'ldap_iptables', 'client-connect', 'script', 'strip-passphrase', and 'nsupdate'
05:44 < reiffert> !rip
05:44 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
05:45 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
05:45 < reiffert> I know that RIP is not OSPF, but it might give you some ideas.
05:48 < Wildy_> okay, thanks
06:09 -!- Bried [~chatzilla@S01060018f8d6f6a7.ok.shawcable.net] has joined #openvpn
06:09 < Bried> Hi
06:09 < Bried> I'm having the problem mentioned in this article: http://forums.openvpn.net/topic7441.html
06:09 <@vpnHelper> Title: OpenVPN Support Forum Installing TAP driver on Windows x64 fails [solved] : Installation Help (at forums.openvpn.net)
06:10 < Bried> only for me I *cannot* remove the unknown devices even after a reboot
06:10 < Bried> when I check the properties on the unknown devices they have the string eset in them which is my antivirus. So I don't know how or why, but Eset products may be causing driver install failures
06:12 < dropje> Bried: we use the packaged GUI shipped on the OpenVPN site http://swupdate.openvpn.org/community/releases/openvpn-2.2.1-install.exe
06:12 < dropje> it uses a newer TAP driver
06:12 < Bried> will test now... it's in my dl directory already
06:12 < Bried> wanted to ask before getting another unknown device 8-|
06:14 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
06:14 < Bried> samething... http://pastebin.com/hYvsR7GZ
06:16 < dropje> seems like the installer is trying to update the driver, which indeed means there's already one installed
06:17 < Bried> it's all the unknown devices
06:17 < Bried> the file itself does not exist... least didn't last time I check
06:17 < Bried> ed
06:17 < Bried> will look again
06:18 -!- d12fk [~heiko@port-92-198-130-130.static.qsc.de] has quit [Remote host closed the connection]
06:18 < Bried> hmm... well there is tap0901.sys in my drivers directory
06:19 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Quit: Lost terminal]
06:20 < Bried> just delete & reboot & try again?
06:20 < Bried> also lots of stuff in driverstore whatever that is
06:20 <@vpnHelper> RSS Update - forum: Server makes no attempt to run connect script <http://forums.openvpn.net/topic8704.html>
06:21 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
06:30 < dropje> Bried: did you check?
06:31 < dropje> i got disconnected and forgot to put it in a screen session
06:31 < Bried> Bried>	hmm... well there is tap0901.sys in my drivers directory 	|<--	dropje has left freenode (Quit: Lost terminal) 	<Bried>	just delete & reboot & try again? 	<Bried>	also lots of stuff in driverstore whatever that is
06:32 < dropje> just delete that driver.. but also devices left in your device manager related to the TAP device
06:33 < Bried> k... will have to try after a reboot to delete them
06:33 < Bried> can't delete them right now still
06:33 < Bried> windows pretends to but nothing happens
06:41 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
06:46 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
06:50 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:54 -!- luneff [~yury@84.51.199.63] has quit [Ping timeout: 260 seconds]
07:05 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Read error: Operation timed out]
07:06 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
07:07 -!- MarKsaitis_ [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
07:07 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Read error: Connection reset by peer]
07:11 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
07:16 -!- sigius [~sigius@93.125.185.45] has quit [Read error: Operation timed out]
07:18 < ecrist> good morning, folks
07:18 < cpm> morn'n
07:18 < reiffert> moin master
07:19 -!- MarKsaitis_ [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Quit: Leaving]
07:19 < reiffert> hail to the king, baby
07:19 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
07:20 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
07:23 < ecrist> http://www.youtube.com/watch?v=mLbOBoa8vD8
07:23 <@vpnHelper> Title: ELVIS - Bridge Over Troubled Water (NEW mix! Great sound!) - YouTube (at www.youtube.com)
07:29 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:30 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
07:31 -!- dkr [~dkr@67.132.255.16] has left #openvpn ["Leaving"]
07:39 <@vpnHelper> RSS Update - forum: OpenVPN redirect-gateway does not work on Windows 7 <http://forums.openvpn.net/topic8705.html>
07:40 -!- luneff [~yury@93.178.120.133] has joined #openvpn
07:47 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
07:56 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Read error: Connection reset by peer]
07:57 -!- kankan_01 [~kankan@aelita.infospc.fr] has joined #openvpn
07:57 < kankan_01> !goal
07:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:04 < kankan_01> It is possible to execute a specific script when a specific client is connecting ?
08:06 < kankan_01> I'm using 2 instances of OpenVPN server on a machine, and I need to modify a route when an specific client is connecting to server 1 or 2...
08:07 < dropje> kankan_01: each instance has its own configuration right?
08:07 < kankan_01> dropje: yes, of course
08:07 < dropje> then use just the push directive in the server.conf?
08:08 < dropje> specific to each instance
08:08 < kankan_01> yes.
08:08 <@vpnHelper> RSS Update - forum: OpenVPN redirect-gateway does not work on Windows 7 <http://forums.openvpn.net/topic8705.html#p14983>
08:09 < dropje> i havent tested but it might also be possible to do ccd and push-reset
08:09 < dropje> ccd-directory 1 in one instance ccd-directory 2 in the second instance
08:10 < dropje> then from client1 in ccd directory use push-reset
08:10 < dropje> know what i mean?
08:12 < kankan_01> dropje: the idea is modify the server routing table for routing an IP address to the client (the same public IP address). If the client is connecting to instance one, routing this IP to instance 1. If it is connecting to instance two, routing IP to instance two.
08:13 < R-66Y> gladiatr: I want to add a TAP device on Linux.
08:13 < gladiatr> kankan_01, perhaps I'm not understanding what you're trying to accomplish, but this seems to be something that would be easier to accomplish by manipulating firewall rules
08:13 <@vpnHelper> RSS Update - forum: Installation Issues on Fedora <http://forums.openvpn.net/topic8683.html#p14984>
08:14 < kankan_01> The instance two is used if the instance one can't work (Instance one is listening on UDP, instance two on TCP/443)
08:14 < dropje> what is your goal? a failover?
08:15 < gladiatr> R-66Y, what sort of error are you getting when you start the third openvpn server instance?
08:15 < R-66Y> gladiatr: ifconfig errors saying the device doesn't exist
08:17 < gladiatr> R-66Y, curious.  Well, what you can do is pre-create your tap device(s): openvpn --mktun --dev tapN
08:17 < kankan_01> dropje: keep the same public IP on client. And using UDP if it's possible (not filtered on current network), for performances reasons.
08:18 < kankan_01> (it's for a computer connected at different places, with filtered-network)
08:18 < R-66Y> gladiatr: thought I tried that, but let's give it another go
08:19 < R-66Y> gladiatr: neato, thanks.
08:19 < gladiatr> R-66Y, hrm.  Interesting.  I don't think 2.6 has any limitation as to how many pseudo devices can be created
08:20 < gladiatr> R-66Y, you bet
08:20 < R-66Y> you, sir, are my hero for today. :)
08:20 < gladiatr> :D
08:20 < gladiatr>  /bow
08:22 < R-66Y> so I created them and assigned different VPNs to their respective TAP devices using 'dev tapN' where N is a number 0-2
08:23 < R-66Y> all is well
08:24 < R-66Y> gladiatr: may I PM you?
08:24 <@vpnHelper> RSS Update - forum: Wrong preconfigurated TUN-Device? <http://forums.openvpn.net/topic8706.html>
08:24 < gladiatr> nah.  Just spew in channel :)
08:25 < R-66Y> okay, no problem. now I have a permission denied problem on that 3rd VPN. would you like to see my config file and exact log output?
08:25 < dropje> kankan_01: the way i understand is: you have 2 instances. One running on UDP, the other on TCP? Your motivation is that some clients have outbound traffic UDP 443 filtered? Is this what your saying?
08:26 < gladiatr> yeah.  Go ahead and pastebin it.
08:26  * R-66Y nods
08:26 < Bried> back tomorrow if it doesn't work
08:26 -!- Bried [~chatzilla@S01060018f8d6f6a7.ok.shawcable.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 3.6.19/20110707195905]]
08:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:29 <@vpnHelper> RSS Update - forum: Wrong preconfigurated TUN-Device? <http://forums.openvpn.net/topic8706.html#p14986>
08:31 < R-66Y> gladiatr: http://slexy.org/view/s20MIjcT1c
08:31 <@vpnHelper> Title: Paste // Slexy 2.0 (at slexy.org)
08:32 < R-66Y> gladiatr: you will notice a couple of things there; I'm using password auth, and notice lines 60 & 61
08:32 < R-66Y> among other things, I'm sure
08:32 < kankan_01> dropje: yes. And I want a client keep the same IP address on two instances (if he connect to one, the route to this address is modified on the kernel)
08:33 < gladiatr> you're wondering about line 76?
08:33 < R-66Y> indeed
08:34 < R-66Y> 74 & 75 are due to the permissions change... though I do not specify that in my config
08:34 < gladiatr> that's normal and nothing to worry about.  Unless you want to setup passwordless sudo access for your nobody user (absolutely not recommended), your openvpn process won't have permissions to modify your network interfaces when it shuts down
08:34 < R-66Y> that's fine, but it won't start. I informed you incorrectly earlier.
08:35 < gladiatr> what usually happens is that the tun/tap device will discorporate when the process exist so it doesn't make much of a difference
08:35 < gladiatr> so what's going on for that 4 minutes?
08:36 < dropje> kankan_01: you don't have to do anything special to keep the same public ip address.. since both instances are running on the same host...?
08:36 < R-66Y> oh, good question!
08:37 < R-66Y> hang on and I'll get more information.
08:37 < gladiatr> k
08:38 < R-66Y> oh. well... this is silly. I'm sorry to have wasted your time on the second problem.
08:39 < gladiatr> lol.  no problem
08:40 < kankan_01> dropje: the instances is running one the same host... But the host route the public IP address to the client (It's not a NAT)
08:42 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has quit [Read error: Connection reset by peer]
08:42 < dropje> kankan_01: aka you're using redirect gateway...
08:43 < kankan_01> I use redirect gateway for pushing the default route to client.
08:44 < dropje> i still don't see the problem.. you're connecting to the same host (with one public ip). You're not routing anything to the client. The client is routing his traffic to your host
08:44 < dropje> doesnt matter which instance it connects to.. they both end up with the same public ip
08:45 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has joined #openvpn
08:45 < kankan_01> dropje: the host is a dedicated server with 4 IPs. And my goal is routing one of this address to a client.
08:45 < kankan_01> currently, it's works
08:45 <@vpnHelper> RSS Update - forum: Installation Issues on Fedora <http://forums.openvpn.net/topic8683.html#p14987>
08:46 < kankan_01> I have this route on the server (set manually)  : 87.98.172.141 via 172.23.43.2 dev tun0 
08:47 < kankan_01> but I want change this when the client is connecting to other instance
08:47 < dropje> kankan_01: that route will expand as follows: When you connect from the server to 87.98.172.141 it will go through 172.23.43.2
08:48 < kankan_01> Yes
08:48 < dropje> so your server is a client? why else would you have a route like that passing tun0?
08:48 < kankan_01> 172.23.42.2 is the endpoint of P-t-P on OpenVPN server
08:49 < kankan_01> the OpenVPN client have this address (87.98.172.141) on this tun device
08:50 < cherwin> kankan_01: Wat?
08:50 < dropje> you're mixing stuff up.. you're saying you have an external ip 87.98.172.141 on your tun device?
08:50 < dropje> i think you should read the manual again
08:50 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:50 < cherwin> Again? I don't think he read it..
08:51 < kankan_01> dropje: on the client, yes. I want the client have a public address
08:51 <@vpnHelper> RSS Update - forum: Wrong preconfigurated TUN-Device? <http://forums.openvpn.net/topic8706.html#p14988>
08:51 < kankan_01> I have read the manual. the "authorized couples" is for Windows clients only
08:53 < cherwin> kankan_01: Maybe you should start with explaining your problem. It seems like you are having a problem and thought up a solution. And you are now asking for help with your solution. Just say what you *really* want to do.
08:54 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
08:54 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:58 -!- defswork [~andy@hns01-fw.internal.gxn.net] has joined #openvpn
09:02 -!- master_of_master [~master_of@p57B52166.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
09:03 < kankan_01> cherwin: my problem is simple : I want one client has the same public IP address (and dedicated, NOT NAT-ed with other clients).
09:03 <@vpnHelper> RSS Update - forum: Wrong preconfigurated TUN-Device? <http://forums.openvpn.net/topic8706.html#p14989>
09:03 -!- researcher [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has joined #openvpn
09:04 -!- master_of_master [~master_of@p57B551E9.dip.t-dialin.net] has joined #openvpn
09:05 < researcher> I have seen an ovpn file in googling that does not include ca ca.crt but instead <ca> some contents here </ca>
09:05 < researcher> is that possible?
09:05 < gladiatr> kankan_01, I don't have time to help with the details of this at the moment, but what it sounds like you want to do is to set up a bridge that consists of the external (internet-facing) interface of your openvpn server and the tap devices from your two openvpn server instances.  With that sort of setup, I suppose you could push the same information to the client regardless of what server process they connect to.
09:06 < gladiatr> researcher, that looks like openvpn AS mark-up
09:07 < gladiatr> the OSS/Community OpenVPN config doesn't use <n> </n>
09:07 < researcher> yes looks like it. but is that possible in an ovpn file using it like that?
09:07 < gladiatr> not the community edition
09:07 < researcher> where is it used?
09:08 < gladiatr> nowhere.  That's not valid syntax for the community edition
09:08 < researcher> in what edition is it valid?
09:08 < gladiatr> AS
09:08 < gladiatr> the commercial openvpn package
09:08 < cherwin> kankan_01: It can be done, but do you have enough IPs?
09:08 < cherwin> kankan_01: How many clients do you want to connect?
09:09 -!- EugeneKaway is now known as EugeneKay
09:09 < researcher> i see
09:09 < cherwin> kankan_01: I guess you want to run services on the client so it will be accessible from the internet?
09:09 < researcher> why is it not implemented on community edition anyway?
09:10 < gladiatr> why would it?  Just drop your pem-encoded cert & key somewhere the openvpn process has permissions to read them from and you're in business
09:11 < researcher> i see
09:12 < researcher> but atleast it should be an option for the benefit of some programmer to use such option.  it can be encrypted and decrypted anyway.
09:13 < researcher> i guess its a good "option"
09:13 < researcher> what can I do so I can use that option without using AS?
09:13 < gladiatr> step back a minute.  What are you trying to accomplish?
09:14 < kankan_01> cherwin: Yes, this client run services accessible on the Internet
09:14 < EugeneKay> "I want to do a thing that this thing will not do, but some other thing does do. How can I do this thing using this thing that does not do the thing I want to do, isntead of the thing that does do the thing?"
09:14 < researcher> I am wanting it to be hardcoded it inside my program without any other files around my executable file.
09:15 < EugeneKay> The closest you're gonna get is a PKCS12.
09:16 < researcher> so that it will be like --proto udp --port 1194 --cipher --etc etc --ca insidecerttextfiles --etc etc
09:16 < researcher> eugenekay, can you give me a sample of that pkcs12 that you mention just for me to have an idea?
09:17 < EugeneKay> !p12
09:17 <@vpnHelper> "p12" is openssl pkcs12 -export -out filename.p12 -inkey filename.key -in filename.crt -certfile ca.crt
09:17 < EugeneKay> For further info on it, ctrl+f the man page
09:19 <@vpnHelper> RSS Update - forum: Wrong preconfigurated TUN-Device? <http://forums.openvpn.net/topic8706.html#p14990>
09:22 < cherwin> kankan_01: Suffice to say, you need bridging.
09:22 < cherwin> kankan_01: Start as simple as possible and then add more complexity as you go. Don't forget to test every change. Furthermore, if you have trouble doing this just use bidirectional NAT and configure it that way.
09:23 < researcher> eugenekay how do you make pkcs12 file?
09:23 < EugeneKay> !p12
09:23 <@vpnHelper> "p12" is openssl pkcs12 -export -out filename.p12 -inkey filename.key -in filename.crt -certfile ca.crt
09:23 < gladiatr> not much of a researcher, huh? :P :)
09:23 < researcher> there is no example on the man page
09:23 < cherwin> kankan_01: At second thought, just configure NAT. I think you're way over your head to configure this.
09:24 < cherwin> kankan_01: ..properly.
09:32 -!- researcher [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has quit []
09:32 -!- researcher [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has joined #openvpn
09:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 268 seconds]
09:42 -!- researcher [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has quit []
09:42 -!- bitterman [~yury@93.178.120.133] has joined #openvpn
09:43 -!- luneff [~yury@93.178.120.133] has quit [Ping timeout: 260 seconds]
10:00 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
10:01 -!- Wildy_ [~lion@212.119.246.18] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
10:03 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:03 -!- mode/#openvpn [+v s7r] by ChanServ
10:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
10:16 -!- kankan_01 [~kankan@aelita.infospc.fr] has quit [Remote host closed the connection]
10:16 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
10:23 -!- mape2k [~mape2k@p5B24F851.dip.t-dialin.net] has joined #openvpn
10:31 <@vpnHelper> RSS Update - forum: Server makes no attempt to run connect script <http://forums.openvpn.net/topic8704.html#p14991>
10:33 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 250 seconds]
10:35 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
10:39 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has left #openvpn ["Leaving..."]
10:44 -!- Onepamopa [~onepamopa@62.204.152.143] has joined #openvpn
10:50 -!- Onepamopa [~onepamopa@62.204.152.143] has quit [Ping timeout: 250 seconds]
10:51 -!- Onepamopa [onepamopa@62.204.152.143] has joined #openvpn
10:51 -!- Onepamopa [onepamopa@62.204.152.143] has quit [Changing host]
10:51 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has joined #openvpn
10:53 -!- MarKsaitis_ [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
10:56 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 258 seconds]
11:01 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Man who run behind car get exhausted]
11:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
11:05 -!- MarKsaitis_ [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 252 seconds]
11:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:07 -!- MarKsaitis_ [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
11:12 -!- mape2k [~mape2k@p5B24F851.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
11:14 < R-66Y> hey gladiatr (or anyone) how do I make OVPN listen on a particular interface?
11:15 < R-66Y> ie. say my server has 4 static ipv4 addresses. how do I make one of my OVPN instances listen on only the 3rd interface (or whatever)
11:15 < EugeneKay> local 
11:16 < R-66Y> thankie
11:16 < R-66Y> missed that.
11:25 < datruth> Is there a stress test for openvpn?
11:25 < datruth> !stress
11:26 < gladiatr> other than responding to posts on the forums? :)
11:26 < krzie> hahahahahah
11:26 < krzie> nice
11:26 < cherwin> Haha
11:27 < gladiatr> datruth, honestly, I've never had it tank on me.  I've had hardware burn out from underneath it, but openvpn has never been The Problem
11:28 < cherwin> gladiatr: I concur.
11:28 < datruth> gladiatr: same here however I need this for documentation purposes
11:30 < cherwin> datruth: Maybe you could ask the guys at tunnelr.com, they are a bunch a geeks that would be happy to ask such a question.
11:31 < cherwin> err.. *answer* such a question.
11:31 < datruth> Thanks
11:32 < datruth> when you reload not restart openvpn are the connections usually effected by that?
11:35 < cherwin> Don't know about that, the connections will be affected when you change the listening interface, I can tell you that.
11:36 < cherwin> Try it out and see for yourself.
11:37 < cherwin> The configuration is quite static, so why would you want to reload anyway?
11:39 < gladiatr> and you can use the CCD dir functionality to manage per-user modifications.  Those files get read every time someone connects, so they can be changed w/out a restart
11:39 -!- MarKsaitis_ [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 240 seconds]
11:39 < cherwin> gladiatr: Indeed.
11:43 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:45 <+s7r> can I limit bandwidth to users?
11:46 < cherwin> s7r: You could with a little scripting.
11:47 < cherwin> s7r: You want the user to share equally? Or do you have some users that may use less or more?
11:48 <+s7r> no I want all of them to be able of max. 50 GB per month total traffic
11:48 < cherwin> What do you want to do with the user that exceeds this threshold?
11:49 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Read error: Connection reset by peer]
11:50 < ecrist> s7r: see --shaper
11:51 <+s7r> thanks ecrist
11:53 <+s7r> ecrist: i do not want to limit the speed.
11:53 <+s7r> i want to limit the total traffic per month
11:53 < cherwin> ecrist: Sweet, didn't know about shaper. But my question still stands, what do you do if your user exceeds the threshold?
11:53 <+s7r> e.g. to use only 50GB per user. but those 50GB to be used at the full speed of the tunnel
11:54 < ecrist> then you need to use a client-disconnect script to grab the utilized bandwidth figures from the environment, and stash them away.  probably need a script the parses openvpn status log periodically to see if a user has exceeded their limit, and forces a disconnect upon reaching the limit
11:55 < gladiatr> I think you're going to need to do some vodoo outside of  openvpn
11:55 < gladiatr> voodoo even
11:56 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
11:56 < ecrist> I just described the entirety of what needs to happen. ;)
11:56 < ecrist> this question has been asked before.
11:57 < gladiatr> ecrist has the voodoo, see?
11:57 < gladiatr> poor bastard chickens... never had a chance...
12:03 < krzie> certainly outside of openvpn
12:03 < krzie> well ecrist's way works too
12:03 < krzie> but that can be handled in the firewall as well
12:04 < ecrist> krzie: not nearly as easily, in most cases.
12:04 < krzie> in fact, xxx's host has a firewall like that
12:04 < krzie> (the real machine does, xxx is a vm)
12:06 -!- Araluccl0 [~lallo@151.77.171.108] has joined #openvpn
12:09 < Araluccl0> hi, anyone in good mood to help me... (trying to install openvpn on my router (openwrt backfire 10.3)... its working. It createds tap0 interface. I can ping from inside tap0 so its probably wking...BUT cant ping server and server cant ping me... probaby i need to add some working route)
12:10 < Araluccl0> (router acts as a client for a openvpn server installed on a vps)
12:11 < Araluccl0> !configs
12:11 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
12:11 < Araluccl0> !logs
12:11 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
12:16 -!- ad_ [~ad@212.152.103.195] has joined #openvpn
12:17 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
12:20 < Araluccl0> this is my server.conf http://pastebin.com/QTMJe7TL and this is my clinet.conf http://pastebin.com/fJKe9B6s thhese are my custom firewall.user http://pastebin.com/TA1AUg8e  (please someone help :) )
12:21 < Araluccl0> this is my client route -n print I think the prob is here:http://pastebin.com/TPPky2fU
12:29 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
12:31 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
12:32 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
12:33 -!- ad_ is now known as aduitsis
12:33 -!- aduitsis [~ad@212.152.103.195] has left #openvpn []
12:35 -!- pindemon [~pindemon@unaffiliated/pindemon] has joined #openvpn
12:55 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
12:58 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
13:02 < pindemon> damn!
13:02 < pindemon> ups... wrong channel =)
13:12 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 245 seconds]
13:15 -!- webmonkey [~webmonkey@184.9.254.96] has joined #openvpn
13:17 < webmonkey> hello, just setting up openvpn 2.1.4; and when I try to start the service it gives me an error that it cannot find 'client1.crt'
13:17 < ecrist> do you have a client1.crt?
13:17 < webmonkey> I'm not sure why the server would be looking for a file that is on the client....
13:18 < ecrist> see /topic
13:18 < webmonkey> Yes, but it has been moved to the client machince where the documentatin says it belongs
13:18 < ecrist> see /topic
13:19 < webmonkey> you would like to see log or config I presume?
13:19 < ecrist> :)
13:19 < webmonkey> Is it okay if I just paste a couple lines in here or should I use pastebin?
13:21 < webmonkey> Error in /var/log/messages -->  Aug 24 14:13:34 li317-179 openvpn[3569]: Cannot load certificate file client1.crt: error:02001002:system library:fopen:No such file or directory: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib
13:23 < EugeneKay> !pb
13:23 < EugeneKay> !pastebin
13:23 <@vpnHelper> Miscellany || Someone || end3r || OS X keychain patch
13:23 < EugeneKay> !paste
13:23 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
13:24 < webmonkey> that's what I figured, pastbining now....
13:25 < webmonkey> ecrist, http://pastebin.com/nVKVTQrL
13:25 < webmonkey> any help would be appreciated :-)
13:26 < webmonkey> that's my config file btw
13:28 < webmonkey> and this in on centos
13:28 < webmonkey> *is on
13:29 -!- pindemon [~pindemon@unaffiliated/pindemon] has quit [Quit: what's this key for?]
13:34 -!- bitterman [~yury@93.178.120.133] has quit [Quit: This computer has gone to sleep]
13:38 -!- dazo is now known as dazo_afk
13:43  * ecrist sighs
13:43 < webmonkey> find anything?
13:46 < ecrist> well, I'm having a hard time reading between the comments
13:46 < ecrist> !logs
13:46 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
13:46 < ecrist> !configs
13:46 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
13:46 < webmonkey> okay lemme repaste, I already had a lot of them removed but I understand they make it harder to read, sorry.
13:47 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
13:47 -!- mode/#openvpn [+v Axeman] by ChanServ
13:49 < webmonkey> This should be better: http://pastebin.com/7wScS4Nk
13:50 < webmonkey> sorry about that
13:50 < ecrist> and logs...
13:50 < ecrist> if you use the grep command linsted, you'll get the right thing
13:53 < ecrist> the config looks fine at first glance
13:53 < webmonkey> openvpn.log --> http://pastebin.com/73TDmvyK
13:53 < ecrist> no problems there.
13:54 < webmonkey> I followed the how-to on the openvpn website... like you say everything *seems* to look fine
13:54 < webmonkey> not sure why it would be looking for the client certificate...perhaps I messed up the certificate creation?
13:56 < hyper_ch> hi ecrist
13:56 < hyper_ch> you look bored today
13:56 < ecrist> not at all, busy as hell, actually
13:57 < hyper_ch> awwww
13:57 < hyper_ch> and I wanted to introduce you to my latest internet find
13:59 < hyper_ch> webmonkey: just enable logging on the client
13:59 < hyper_ch> that should tell you more
14:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Connection reset by peer]
14:00 < webmonkey> im just trying to get ther server started right now, need to do that before I can connect with a client.
14:01 < hyper_ch> enable logging for the server :)
14:01 < webmonkey> The issue is that the server fails to start because it can't find the client certificate, not sure why it would be looking for that.
14:01 < webmonkey> I did, that's part of what I pasted. Might try increasing verbosity though....
14:02 < hyper_ch> do you have a client.conf and server.conf on the server?
14:02 < webmonkey> yes, they were both created on the server. I then copied the client.conf to my client machine
14:02 < hyper_ch> and did you remove the clinet.conf from the /etc/openvpn/ folder?
14:03 < hyper_ch> on the server?
14:03 < webmonkey> wow....no I did not. *facepalm*
14:03 < hyper_ch> you use a debian based server?
14:04 < webmonkey> It works now :-) I'm using centos
14:04  * hyper_ch heard that centos is even more outdated than debian-old stable
14:04 < webmonkey> Thanks guys, sorry about that, feeling kinda silly.
14:05 < hyper_ch> don't worry about it, I'll send you the bill for my service
14:05 < webmonkey> I'm not thrilled with their updates, no. I now use Arch mostly.
14:05 <@vpnHelper> RSS Update - forum: How can we change the routes that are created by openvpn? <http://forums.openvpn.net/topic8682-15.html#p14992>
14:05 < webmonkey> :-p
14:05 -!- luneff [~yury@84.51.199.63] has joined #openvpn
14:05 < hyper_ch> debian or die :)
14:06 < hyper_ch> so it runs now?
14:07 < webmonkey> I've haven't used it, honestly. closest thing would be the server version of ubuntu. Heard good things about debian though
14:07 < webmonkey> the service started, yes. Gonna attempt connecting...
14:07 < hyper_ch> debian stable... not so new versions... but on a server you do want stability
14:08 < hyper_ch> I had old-stable run on a web/mail server for 994 days before I did an upgrade to stable :)
14:08 < webmonkey> true, arch scares me a bit in that area...
14:08 < webmonkey> nice!
14:08 < hyper_ch> well, 994 days of uptime
14:08 < webmonkey> how's debian on updates?
14:09 < hyper_ch> and then 4h downtime for upgrade and fixing a few issues
14:09 < hyper_ch> they get security updates
14:09 < hyper_ch> and a few backports if you want
14:09 < hyper_ch> but I don't use those on a server
14:09 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
14:09 < hyper_ch> if I need some newer versions of a program, I compile it myself
14:10 < webmonkey> ah. I mostly do web and voip servers.
14:10 < hyper_ch> on old stable I compiled myself monit and also installed a newer python version
14:10 < hyper_ch> webmonkey: freeswitch with fusionpbx works fine on debian stable
14:11 < webmonkey> i'll look into it. Only recently started with voip, used asterisk thus far
14:11 < hyper_ch> iiieeks
14:11 < hyper_ch> freeswitch is asterisk done right
14:11 < hyper_ch> and fusionpbx is a nice wui to administrate it
14:12 < webmonkey> not sure I've ever heard of it honestly...interesting though.
14:12 < hyper_ch> --> /j #fusionpbx
14:12 < hyper_ch> very nice support also
14:13 < webmonkey> that's a plus
14:13 < EvilGuru> Asterix is great, once it is configured anyway
14:13 < hyper_ch> EvilGuru: Evil, go away!!!!
14:14 < hyper_ch> webmonkey: if you want to try, there's a full fpbx install script that will install on an ubuntu 11.04 version... it'll download latest freeswitch git and latest fpbx svn
14:14 < hyper_ch> so it's quite easy to setup a test environment
14:15 < webmonkey> cool, so what's the basic advantage over asterisk?
14:15 -!- oyo^^ [~hubba@nl1.vpn.omdirigert.net] has joined #openvpn
14:15 < hyper_ch> well, the guys that started with freeswitch were unhappy with asterisk... they deemed it as unmaintainalbe or something
14:16 < hyper_ch> so with all the asterisk experience they started a new pbx from ground
14:16 < hyper_ch> been using freeswitch and fpbx for 9 months now and works just fine
14:16 < hyper_ch> and you have a great helpful irc community
14:16 < hyper_ch> I could ask the most stupid question and still get helped
14:17 < oyo^^> I get this in my log "WWWWRRRRWRWWRRWWRWRWRWRWRWRWRRWWRWRW" Does anyone know what i can do to fix it? Or what it means?
14:17 < webmonkey> these are all good points...but did you actually have issues with asterisk?
14:18 < hyper_ch> some had fun with having that logged to the log
14:18 < webmonkey> not trying to be a smartass, I don't know all that much about asterisk yet truthfully
14:18 < hyper_ch> asterisk was so... hmmm.... complicated to install
14:18 < webmonkey> lol
14:18 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Quit: leaving]
14:18 < hyper_ch> freeswitch was just a smooth ride
14:18 < EvilGuru> hyper_ch: It is not just complicated, it is a PITA, but once it is working it is not too bad
14:19 < webmonkey> on debian I presume?
14:19 < hyper_ch> webmonkey: yes, on debian
14:19 < hyper_ch> also fpbx install was quite easy
14:19 < hyper_ch> and with the help of the fpbx main dev I got it up and running quickly in a way that I wanted to
14:20 < webmonkey> I just installed in on ubuntu (linode VPS) and it was cake, then again they had a how-to guide and may have customized the source, idk
14:20 < webmonkey> that's good. I will check that and debian out for sure
14:20 < hyper_ch> webmonkey: join the light side of pbxing and get freeswitch :)
14:20 < webmonkey> always good to explore options :-)
14:22 < webmonkey> pita --> pita bread --> now craving gyro...mmmm
14:22 < hyper_ch> http://wiki.fusionpbx.com/index.php?title=Debian_Install
14:22 <@vpnHelper> Title: Debian Install - FusionPBX (at wiki.fusionpbx.com)
14:26 < hyper_ch> webmonkey: I think it was ecrist that made me actually use freeswitch
14:28  * ecrist uses freeswith with a PRI on FreeBSD
14:35  * hyper_ch heard FreeBSD kills little babies
14:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Client Quit]
14:38 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p14993>
14:40 -!- tzervo [~tzervo@109.129.127.28] has joined #openvpn
14:42 < webmonkey> cool. thanks again to hyper_ch and ecrist for the help!
14:43 < ecrist> hyper_ch: perhaps, linux rapes them, however.
14:50 < krzie> hyper_ch, and iirc i introduced ecrist to freeswitch
14:50 < ecrist> you did indeed
14:51 < hyper_ch> krzie: you're one evil mastermind
14:51 < ecrist> now I maintain some of the freebsd ports for it, tto
14:51 < ecrist> too*
14:51 < krzie> yep, which i mirror :)
14:51 < krzie> well
14:51 < krzie> really you mirror it
14:52 < hyper_ch> krzie: you use fpbx?
14:53 < krzie> nope
14:53  * jpalmer uses freeswitch,  but not on fbsd.
14:53 < jpalmer> we have several hundred freeswitch servers in production
14:53 < krzie> whoa
14:53 < krzie> nice
14:53 < hyper_ch> krzie: so you're like the hardcore freeswitch admin guru that can exist without a wui?
14:53 < jpalmer> krzie: 2 per hospital,  yea
14:53 < hyper_ch> jpalmer: hundreds? wow
14:54 < hyper_ch> jpalmer: you're one chatty folk
14:54 < jpalmer> hyper_ch: how so?
14:54 < krzie> hyper_ch, actually, im the freeswitch rookie who uses cudatel in production and is currently reading his free freeswitch book to learn it better
14:54 < krzie> (packt gave me a free book for reviewing the openvpn cookbook)
14:54 < krzie> !book
14:54 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
14:54 < hyper_ch> krzie: cool :)
14:55 < hyper_ch> jpalmer: hundreds of FS servers --> many people chatting --> a chatty folk
14:55 < jpalmer> oh, gotcha.  I thought that was a reference to the number of IRC channels I talk in :P
14:56 < jpalmer> hyper_ch: the company I work for is a communications company focusing on hospitals.  so each hospital we're live in,  has a minimum of 2 freeswitch servers integrated with their PBX
14:57 < hyper_ch> jpalmer: minimum of 2 fs servers? what for? backup if one dies?
14:57 -!- kav [~kav@g224245028.adsl.alicedsl.de] has joined #openvpn
14:57 < jpalmer> yes
14:57 -!- kav is now known as Guest83475
14:58 < jpalmer> and I say "minimum" because some hospital systems have multiple hospital campuses..  each with it's own PBX.    so some of our installations are multiplied (if a hospital system has 8 campuses,  they may have 8 PBX's,  which means 16 FS servers)
14:58 < hyper_ch> and how do you manage them all?
14:59 < jpalmer> puppet!
14:59 < jpalmer> puppet/foreman/opsview/openvpn to be specific
14:59 < hyper_ch> what's that?
15:00 < jpalmer> puppet is a config management system.   similar to cfEngine,  chef, sattelite, spacewalk, etc
15:00 < hyper_ch> never heard of any of those
15:00 < hyper_ch> but then, I only run a handful of servers
15:00 < krzie> openvpn tech uses puppet to manage build slaves
15:00 < krzie> apple uses puppet
15:00 < hyper_ch> although I probably could hold them all litterally in my hand
15:01 < jpalmer> if you have more than 5 or so servers,  you might want to look into puppet ;)
15:01 < krzie> (they sent my unix admin friend who works at apple corp to get certified in puppet)
15:01 < jpalmer> krzie: really?  I didn't know that
15:01 < hyper_ch> 7 servers - including my home file server
15:01 < krzie> yep, he has the cert on his wall, thats how i found out ;]
15:02 < webmonkey> never heard of pupper either....looks net though! 
15:02 < webmonkey> *neat
15:03 < hyper_ch> everbody can print out certs :)
15:03 < webmonkey> hrmm... now I'm getting a client error of 'TAP-Win32 adapter 'MyTap' not found'...I thought it installed the adapter with the program but I don't see it in my network settings...  :-/
15:03 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
15:03 < hyper_ch> !tunortap
15:03 < krzie> MyTap??
15:03 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
15:03 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
15:03 < krzie> !configs
15:03 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
15:04 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has quit [Read error: Connection reset by peer]
15:04 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has joined #openvpn
15:06 < webmonkey> I'm using tun mode on the server...but the Windows GUI apparently needs a TAP interface?
15:07 < webmonkey> I used the GUI utility to create new interface, I renamed it, and now it connects :-)
15:12 -!- oyo^^ [~hubba@nl1.vpn.omdirigert.net] has quit []
15:14 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
15:19 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has joined #openvpn
15:21 -!- tzervo [~tzervo@109.129.127.28] has left #openvpn ["WeeChat 0.3.5"]
15:27 < Essobi> Hmm... Does the management interface only allow 1 connection?
15:27 < Essobi> at a time...
15:31 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
15:34 -!- mape2k [~mape2k@g224233061.adsl.alicedsl.de] has joined #openvpn
15:37 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
15:41 -!- Jarpse [~jarpse@84-245-22-127.dsl.cambrium.nl] has quit [Remote host closed the connection]
15:43 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has joined #openvpn
15:48 <@vpnHelper> RSS Update - forum: how can I access diferents tunnels from a client? <http://forums.openvpn.net/topic8707.html>
15:48 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
15:51 -!- eliasson1 [~wizard@91.198.48.20] has quit [Read error: Connection reset by peer]
15:52 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has joined #openvpn
15:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 268 seconds]
16:00 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
16:05 -!- straterra [~straterra@fuhell.com] has left #openvpn []
16:08 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has joined #openvpn
16:09 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Ping timeout: 252 seconds]
16:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:12 < krzie> webmonkey, windows just calls it "tap"
16:12 < krzie> it still does tun just fine
16:12 < krzie> i hate the name for that reason, it should at least be named tuntap
16:14 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
16:15 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 245 seconds]
16:17 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has joined #openvpn
16:20 -!- y4h0 [~ubuntu@84.40.109.21] has joined #openvpn
16:22 -!- Guest83475 [~kav@g224245028.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
16:22 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
16:31 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:37 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:48 < webmonkey> krzie, that's kinda what I figured, thanks though
16:48 < webmonkey> and yes, it makes it confusing :S
16:55 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
16:56 -!- somefatkid [~administr@rrcs-24-213-178-60.nyc.biz.rr.com] has joined #openvpn
17:01 -!- y4h0 [~ubuntu@84.40.109.21] has quit [Remote host closed the connection]
17:03 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 276 seconds]
17:08 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
17:08 -!- mode/#openvpn [+v Axeman] by ChanServ
17:10 -!- secondchoice [~thirdchoi@knox.pace.edu] has joined #openvpn
17:11 -!- secondchoice is now known as Axeman2
17:11 -!- Axeman2 is now known as Guest25256
17:14 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:17 -!- Guest25256 [~thirdchoi@knox.pace.edu] has quit [Quit: Sorry Gotta Run!]
17:19 -!- Axeman [~thirdchoi@knox.pace.edu] has joined #openvpn
17:19 -!- Axeman [~thirdchoi@knox.pace.edu] has quit [Changing host]
17:19 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
17:19 -!- mode/#openvpn [+v Axeman] by ChanServ
17:26 -!- cpf [515306d2@gateway/web/freenode/ip.81.83.6.210] has joined #openvpn
17:27 < cpf> Hi, I'm running a new 2.0-RC3 install, with multi-wan (gateway group), now I have some services and routes that should be adjusted depending on what gateway is online.
17:28 < cpf> As in: If both are online, RDP must go (inbound) via WAN1, and VPN must go outbound over WAN2 (default)
17:28 <@vpnHelper> RSS Update - forum: OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p14995>
17:28 < cpf> If only WAN1 is offline, everything must go over WAN2, and the same if only WAN2 is offline should all go over WAN1
17:29 < cpf> So, I'm hoping someone can point me in some direction on how I best do this?
17:30 -!- mape2k [~mape2k@g224233061.adsl.alicedsl.de] has quit [Ping timeout: 264 seconds]
17:35 -!- fread2281 [~fread2281@70-56-208-66.albq.qwest.net] has joined #openvpn
17:41 -!- fread2281 [~fread2281@70-56-208-66.albq.qwest.net] has quit [Quit: Leaving...]
17:47 <@vpnHelper> RSS Update - forum: OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p14996>
17:51 < Araluccl0> hi, anyone in good mood to help me... (trying to install openvpn on my router (openwrt backfire 10.3)... its working. It createds tap0 interface. I can ping from inside tap0 so its probably wking...BUT cant ping server and server cant ping me... probaby i need to add some working route)
17:59 -!- Denial [Denial@drgi.co.uk] has quit [Ping timeout: 245 seconds]
18:00 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:02 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
18:03 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
18:03 -!- mode/#openvpn [+v Axeman] by ChanServ
18:08 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
18:10 -!- krzie [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
18:14 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
18:15 -!- luneff [~yury@84.51.199.63] has quit [Quit: This computer has gone to sleep]
18:23 <@vpnHelper> RSS Update - forum: OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p14997>
18:29 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html>
18:33 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
18:34 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Connection reset by peer]
18:49 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
18:51 -!- Axeman [~thirdchoi@openvpn/user/axeman] has joined #openvpn
18:51 -!- mode/#openvpn [+v Axeman] by ChanServ
19:04 -!- ppr is now known as peper
19:11 -!- Araluccl1 [~lallo@151.77.230.245] has joined #openvpn
19:12 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
19:13 -!- Araluccl0 [~lallo@151.77.171.108] has quit [Ping timeout: 258 seconds]
19:16 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:16 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:40 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 260 seconds]
19:42 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
19:45 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:46 -!- fread2281 [~fread2281@70-56-208-117.albq.qwest.net] has joined #openvpn
19:47 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
19:53 -!- fread2281 [~fread2281@70-56-208-117.albq.qwest.net] has quit [Quit: Leaving...]
19:54 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
19:56 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
19:56 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:59 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Read error: Connection reset by peer]
19:59 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:05 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:10 -!- riz [~riz@syn.theintertubes.ca] has quit [Ping timeout: 264 seconds]
20:15 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
20:45 -!- webmonkey [~webmonkey@184.9.254.96] has quit [Quit: time2go]
21:02 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:02 -!- secondchoice [~thirdchoi@knox.pace.edu] has joined #openvpn
21:03 -!- secondchoice [~thirdchoi@knox.pace.edu] has quit [Client Quit]
21:03 -!- secondchoice [~thirdchoi@knox.pace.edu] has joined #openvpn
21:04 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:04 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:05 -!- kerryderry [~kerryderr@71.21.164.84] has quit [Quit: Leaving]
21:06 -!- Axeman [~thirdchoi@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:07 -!- secondchoice [~thirdchoi@knox.pace.edu] has quit [Client Quit]
21:48 < EugeneKay> !config
21:48 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
21:48 < EugeneKay> !configs
21:48 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
21:59 -!- fread2281 [~fread2281@70-56-141-207.albq.qwest.net] has joined #openvpn
22:04 -!- fread2281 [~fread2281@70-56-141-207.albq.qwest.net] has quit [Remote host closed the connection]
22:05 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 268 seconds]
22:24 -!- Deathvalley122 [~Death@eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
22:29 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:33 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
22:37 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
22:39 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
22:45 -!- adsadaadsl [~lla@178.73.217.197] has joined #openvpn
22:45 < adsadaadsl> hello
22:45 < adsadaadsl> my vpn disconnects after 1 hour. whY?
22:45 < adsadaadsl> it asks for auth again. ERROR: Auth username is empty
22:46 < adsadaadsl> is auth-nocache the problem?
22:48 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 255 seconds]
22:49 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
22:52 -!- adsadaadsl [~lla@178.73.217.197] has left #openvpn []
22:54 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
23:20 -!- naquad [~naquad@174.142.224.219] has quit [Read error: Operation timed out]
23:39 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:41 -!- mape2k [~mape2k@f053193194.adsl.alicedsl.de] has joined #openvpn
--- Day changed Thu Aug 25 2011
00:04 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
00:04 -!- mode/#openvpn [+v s7r] by ChanServ
00:05 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
00:36 <@vpnHelper> RSS Update - forum: Wrong preconfigurated TUN-Device? <http://forums.openvpn.net/topic8706.html#p14999>
00:41 -!- luneff [~yury@84.51.199.63] has joined #openvpn
00:41 <@vpnHelper> RSS Update - forum: how can I access diferents tunnels from a client? <http://forums.openvpn.net/topic8707.html#p15000>
00:48 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15001>
01:04 -!- Guest83475 [~kav@g224244233.adsl.alicedsl.de] has joined #openvpn
01:06 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
01:06 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15002>
01:10 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 245 seconds]
01:14 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
01:18 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15003>
01:22 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has joined #openvpn
01:22 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has quit [Changing host]
01:22 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
01:30 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15004>
01:42 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15005>
01:44 -!- mape2k [~mape2k@f053193194.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
01:48 -!- dazo_afk is now known as dazo
01:55 -!- Guest83475 [~kav@g224244233.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
02:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:21 -!- computerkiller [~computerk@pool-173-65-138-213.tampfl.fios.verizon.net] has quit []
02:22 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
02:27 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
02:27 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:27 -!- kav [~kav@g224244233.adsl.alicedsl.de] has joined #openvpn
02:27 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Operation timed out]
02:27 -!- kav is now known as Guest19491
02:30 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15006>
02:32 -!- Guest19491 [~kav@g224244233.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
02:35 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 245 seconds]
02:40 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 252 seconds]
02:42 <@vpnHelper> RSS Update - forum: OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p15007>
02:45 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
02:48 <@vpnHelper> RSS Update - forum: Wrong preconfigurated TUN-Device? <http://forums.openvpn.net/topic8706.html#p15008>
02:50 -!- kav_ [~kav@g224244233.adsl.alicedsl.de] has joined #openvpn
02:54 <@vpnHelper> RSS Update - forum: Wrong preconfigurated TUN-Device? <http://forums.openvpn.net/topic8706.html#p15010> || Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15009>
03:06 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15011>
03:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:18 <@vpnHelper> RSS Update - forum: Bridging between different subnets (Class A & Class B) ?? <http://forums.openvpn.net/topic8698.html#p15012>
03:21 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
03:25 -!- luneff [~yury@84.51.199.63] has quit [Quit: This computer has gone to sleep]
03:30 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 240 seconds]
03:32 -!- kav_ [~kav@g224244233.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
03:42 <@vpnHelper> RSS Update - forum: Bridging between different subnets (Class A & Class B) ?? <http://forums.openvpn.net/topic8698.html#p15013>
03:43 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 258 seconds]
03:44 -!- kav_ [~kav@g224244233.adsl.alicedsl.de] has joined #openvpn
03:44 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
03:54 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:56 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has joined #openvpn
03:57 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
03:58 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
03:58 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
03:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:00 -!- luneff [~yury@93.178.92.67] has joined #openvpn
04:22 -!- kav_ [~kav@g224244233.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
04:25 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:33 -!- kav_ [~kav@g224244233.adsl.alicedsl.de] has joined #openvpn
04:46 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:47 -!- ele_ is now known as ele
04:54 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has quit [Ping timeout: 245 seconds]
05:09 -!- defswork [~andy@hns01-fw.internal.gxn.net] has quit [Ping timeout: 276 seconds]
05:14 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
05:18 -!- bitterman [~yury@93.178.92.67] has joined #openvpn
05:18 -!- luneff [~yury@93.178.92.67] has quit [Ping timeout: 252 seconds]
05:21 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
05:33 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:38 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:38 -!- mode/#openvpn [+v s7r] by ChanServ
05:40 -!- kav_ [~kav@g224244233.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
05:51 -!- kav_ [~kav@g224244233.adsl.alicedsl.de] has joined #openvpn
06:03 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
06:07 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
06:20 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
06:25 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
06:32 -!- kav_ is now known as k4v
06:41 <@vpnHelper> RSS Update - forum: OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p15014>
06:47 <@vpnHelper> RSS Update - forum: How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p15015>
06:57 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:05 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:09 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 272 seconds]
07:09 -!- civillian [~nickn@122.49.202.174] has joined #openvpn
07:11 -!- Araluccl1 [~lallo@151.77.230.245] has quit [Quit: Anche il discorsismo ha un limitismo.]
07:11 -!- Araluccl0 [~lallo@151.77.230.245] has joined #openvpn
07:17 -!- Araluccl1 [~lallo@151.77.217.184] has joined #openvpn
07:20 -!- Araluccl0 [~lallo@151.77.230.245] has quit [Ping timeout: 258 seconds]
07:23 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Write error: Broken pipe]
07:23 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
07:29 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has quit [Remote host closed the connection]
07:31 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
07:35 -!- bent_screwdriver [~bent_scre@74.255.249.66] has joined #openvpn
07:44 -!- kyrix_ [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
07:47 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 258 seconds]
07:47 <@vpnHelper> RSS Update - forum: Problems pinging new OpenVPN client <http://forums.openvpn.net/topic8709.html>
08:00 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:02 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:03 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Client Quit]
08:08 <@mattock> fyi: there will be a short interruption in authentication services ... meaning logging in to forums, trac or pwm won't work
08:08 <@mattock> short as in ~10-15 minutes
08:09 <@mattock> starting in ~5 mins
08:11 -!- sk1 [~khannast@129.137.216.165] has joined #openvpn
08:14 < sk1> so I'm having trouble with setting up OpenVPN with a kinda weird topology I have: http://unix.stackexchange.com/questions/19376/routing-in-openvpn-between-a-private-network-and-a-client
08:14 <@vpnHelper> Title: vpn - Routing in OpenVPN between a private network and a client - Unix and Linux - Stack Exchange (at unix.stackexchange.com)
08:14 < sk1> I have my config files listed up there...I can connect over VPN to the host server, but not the rest of the network
08:17 -!- kyrix_ [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
08:18 -!- fread2281 [~fread2281@70-56-131-144.albq.qwest.net] has joined #openvpn
08:19 -!- fread2281 [~fread2281@70-56-131-144.albq.qwest.net] has quit [Remote host closed the connection]
08:22 < krzee> sk1, 
08:22 < krzee> !route
08:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
08:23 < krzee> nothing weird about it
08:23 -!- Araluccl0 [~lallo@151.77.184.251] has joined #openvpn
08:23 < sk1> reading...
08:24 < sk1> that was my original configuration. I did a push for 192.168.203.0/24, and specified no "route" 
08:24 -!- Araluccl1 [~lallo@151.77.217.184] has quit [Ping timeout: 258 seconds]
08:24 < krzee> read mine for understanding
08:25 < krzee> it explains * if you read it carefully
08:30 < sk1> I think I had this in my original setup, where you push 192.168.203.0 and have no route directives at all
08:32 < sk1> that should tell the client that I (the openvpn server) can route 192.168.203.0, and then I don't need to any local rules to my server since it already routes that traffic and has ip forwarding enabled, right?
08:34 < krzee> the lan is behind server?
08:34 < krzee> !serverlan
08:34 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
08:35 < krzee> if the server *is* the router for its lan, just make sure the firewall allows and you pushed the route to clients
08:36 < sk1> It is. Columbia is 192.168.203.1. It is the gateway for 192.168.203.0/24, so it takes all that traffic and NATs it to its external adapter 
08:38 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has quit [Read error: Connection reset by peer]
08:38 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has joined #openvpn
08:45 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
08:53 <@mattock> migration finished, everything seems to be working properly now
08:57 -!- nuttersppadic [~IceChat77@193.130.68.17] has left #openvpn []
09:02 -!- master_of_master [~master_of@p57B551E9.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
09:02 -!- Netsplit *.net <-> *.split quits: ele, MarKsaitis, uuuppz
09:04 -!- master_of_master [~master_of@p57B54ED0.dip.t-dialin.net] has joined #openvpn
09:07 -!- Netsplit over, joins: uuuppz, MarKsaitis, ele
09:13 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
09:23 -!- k4v [~kav@g224244233.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
09:25 -!- DSpair [~Deven@74-134-11-232.dhcp.insightbb.com] has joined #openvpn
09:25 < DSpair> G'day all.
09:26 < DSpair> Need some help if at all possible. I am using OpenVPN to connect to our parent company's OpenVPN system. They use Certs and eTokens for authentication.
09:26 < DSpair> I have gotten the Aladding eToken to be recognized by OpenVPN, but I keep getting the following error:
09:26 < DSpair> PKCS#11: Cannot perform signature 6:'CKR_FUNCTION_FAILED'
09:27 < DSpair> Followed by: TLS_ERROR: BIO read tls_read_plaintext error: error:14099004:SSL routines:SSL3_SEND_CLIENT_VERIFY:RSA lib
09:36 -!- k4v [~kav@g224244233.adsl.alicedsl.de] has joined #openvpn
09:47 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:47 -!- mode/#openvpn [+v s7r] by ChanServ
09:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 245 seconds]
09:53 -!- bent_screwdriver [~bent_scre@74.255.249.66] has quit [Quit: Going offline, see ya! (www.adiirc.com)]
10:19 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 268 seconds]
10:26 < sk1> arg, this is driving me insane
10:27 < sk1> if I have a server, and it's 192.168.203.1 and is a gateway (NAT/Masquerade) for that 192.168.203.0/24 network
10:27 < sk1> and in my server config I have "server 192.168.137.0 255.255.255.0"
10:27 <@vpnHelper> RSS Update - forum: How to add or remove Certifies <http://forums.openvpn.net/topic8641.html#p15017>
10:27 < sk1> I should just need "push "route 192.168.203.0 255.255.255.0"" correct?
10:27 < sk1> no route or iroute...just the push for that net
10:29 < sk1> but I can ONLY get to 192.168.137.1
10:29 < sk1> none of the 192.168.203.0/24 network
10:29 -!- uuuppz|2 [~kvirc@213.79.53.61] has joined #openvpn
10:29 < defswork> check the routes back from the lan to the vpn subnet are in place
10:29 -!- uuuppz|2 [~kvirc@213.79.53.61] has quit [Client Quit]
10:30 < defswork> do netstat -nr on the client to check the route add worked
10:30 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:30 < defswork> check you ahve ip forwarding turned on on the vpn server
10:31 < sk1> Columbia (192.168.203.1 and 192.168.137.1-vpn) is the gateway. IP forwarding is turned on on it. This route "  192.168.203.0    255.255.255.0    192.168.137.5    192.168.137.6     30
10:31 < sk1> shoes up on my windows client
10:31 < defswork> make sure whatever firewalls you have on it dont affect the vpn traffic when they shouldnt
10:31 < sk1> I'm trying to connect to 192.168.203.30, which is a server on the private network which uses 192.168.203.1 as its gateway
10:32 < defswork> i.e. ensure you arent inadvertently NATing your VPN traffic to your external IP
10:32 <@vpnHelper> RSS Update - forum: Help with final touches to routing <http://forums.openvpn.net/topic8693.html#p15018>
10:32 < sk1> and the gateway/openvpn server has this rule: "192.168.137.0   192.168.137.2   255.255.255.0   UG    0      0        0 tun0"
10:33 < sk1> hmm..it's gotta be a firewall issue..let me try turning it off while keeping forwarding and masquaerading on
10:33 < defswork> stick some early fw rules in to cut out of the friewall chain if it's vpn subnet source or destination
10:34  * ecrist points to /topic
10:34 < krzee> and
10:34 < krzee> [09:37]  <krzee> if the server *is* the router for its lan, just make sure the firewall allows and you pushed the route to clients
10:34 < krzee> told ya that 2 hours ago ;]
10:34 < sk1> sorry ... 
10:34 < krzee> no worries
10:35 < ecrist> people in this channel who've had a firewall issue along the way: *
10:35 < sk1> I'm openSuse/yast...
10:35 < sk1> I hate looking at iptables -L when these types of programs auto-configure them...lot-o-junk in there
10:36 < defswork> its common if your vpn server is also your internet gateway to and something like traffic from lan to anywhere - NAT to internet IP - this will feck your vpn traffic up
10:36 < defswork> so bind those rules to specific nics 
10:36 < sk1> at least the -t nat table is simple...
10:36 < defswork> do iptables-save
10:36 < defswork> much easier to read
10:37 < sk1> it's setup into zones, the 10.72.4 adapter is on the Extenral Zone, 192.168.203 adapter is on Internal zone
10:37 < defswork> got my typing skills are deteriorating rapidly
10:38 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15019>
10:39 < sk1> arg..it's putting it in the forward_ext zone
10:40 < defswork> you've just learned why most firewall helper tools are useless
10:40 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 245 seconds]
10:40 -!- uuuppz2 [~uuuppz@213.79.53.61] has joined #openvpn
10:40 -!- uuuppz [~uuuppz@213.79.53.61] has quit []
10:40 < sk1> I've know that for a while...I'm just trying to do everything through the manager so my rules don't get overwritten :-P
10:40 -!- uuuppz2 is now known as uuuppz
10:40 < sk1> This is for a enterprise system...at home I'm on Gentoo
10:41 < sk1> The tun0 doesn't even exist until openvpn is up, so a lot of these rules its autogenerating after the firewall is restart...god this is messy
10:42 < defswork> tie your rules to ip addresses only then
10:44 < defswork> btw you can add rules for nonexisting nics
10:44 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15021>
10:44 < defswork> iptables -A INPUT -i tun9 -j LOG works fine here
10:45 < sk1> okay..I'll try that
10:45 < sk1> I killed my network connection...gotta go in therough the VM console :-P
10:49 < Olipro> don't let monkeys loose on your netfilter
10:49 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15022>
10:49 < jeev> monkeys RUN my netfilter
10:50 < krzee> also, you can make static devices
10:50 < krzee> see --mknod
10:52 -!- Onepamopa [~onepamopa@62.204.152.143] has joined #openvpn
10:53 -!- Onepamopa [~onepamopa@62.204.152.143] has quit [Changing host]
10:53 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
10:54 -!- Araluccl1 [~lallo@151.77.143.190] has joined #openvpn
10:56 -!- Araluccl0 [~lallo@151.77.184.251] has quit [Ping timeout: 258 seconds]
10:56 -!- uuuppz2 [~uuuppz@213.79.53.61] has joined #openvpn
10:57 -!- corretico [~luis@200.12.40.17] has joined #openvpn
10:57 -!- uuuppz2 [~uuuppz@213.79.53.61] has quit [Client Quit]
11:02 < sk1> I've added the tun0 to the internal zone (input_int, forward_int).. there is a masquarding rule for tun0, I even added "iptables -A INPUT -i tun0 -j ACCEPT"
11:03 < sk1> tracert can't make it to the 2nd hop still....
11:03 < ecrist> sk1: ask in a firewall channel.
11:03 < ecrist> unfortunately, we don't troubleshoot or support firewalls here.
11:03 -!- upz [~uuuppz@213.79.53.61] has joined #openvpn
11:04 < sk1> okay... we have firewall channels?
11:04 -!- Yen [~Yen@unaffiliated/yen] has joined #openvpn
11:04 < ecrist> 'we' don't, but there are channels on IRC that specifically aid in firewall configuration
11:04 < sk1> by we I meant freenode
11:04 < ecrist> if you're using iptables, try #iptables
11:05 < ecrist> if you're using bsd's pf, try #pf
11:09 < sk1> whoohoo! Disalbed firewall, manually enabled ipforwarding, added two masquerade rules..and everythign works
11:09 < ecrist> :)
11:09 < ecrist> !iptables
11:09 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z, or (#2) please see http://openvpn.net/man#lbBD for more info, or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
11:10 < sk1> can't get to the ones with external adapters...will need to add special routes for them
11:26 <@vpnHelper> RSS Update - forum: Need help configuring a bridged system <http://forums.openvpn.net/topic8710.html>
11:31 -!- upz [~uuuppz@213.79.53.61] has quit [Quit: Leaving]
11:31 -!- uuuppz2 [~uuuppz@213.79.53.61] has joined #openvpn
11:37 -!- uuuppz2 [~uuuppz@213.79.53.61] has left #openvpn []
11:37 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
11:50 <@vpnHelper> RSS Update - forum: Need help configuring a bridged system <http://forums.openvpn.net/topic8710.html#p15024>
11:59 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Quit: Leaving]
11:59 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
12:03 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
12:03 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
12:03 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
12:03 -!- mode/#openvpn [+v Axeman] by ChanServ
12:03 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
12:07 < trumee> Hi all. I am running openvpn on a opnewrt router via tun interface. The remote client is unable to see the computers on the servers lan even though i have pushed the route in servers config
12:07 < trumee> I have a working tap interface but everybody here is suggesting to go via tun route, so i am changing my config
12:11 < trumee> This is my config, http://pastebin.com/JeCBanxR
12:12 -!- Araluccl1 [~lallo@151.77.143.190] has quit [Ping timeout: 258 seconds]
12:12 < trumee> seems tun is painfull compared to tap :(
12:14 < trumee> I have forwarding enabled on the server and also iptables -A INPUT   -i tun+ -j ACCEPT, iptables -A FORWARD -i tun+ -j ACCEPT, iptables -A OUTPUT  -o tun+ -j ACCEPT and iptables -A FORWARD -o tun+ -j ACCEPT
12:14 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 276 seconds]
12:16 -!- Araluccl0 [~lallo@151.77.251.243] has joined #openvpn
12:18 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 268 seconds]
12:21 -!- Araluccl0 [~lallo@151.77.251.243] has quit [Ping timeout: 258 seconds]
12:25 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
12:25 -!- mode/#openvpn [+v Axeman2] by ChanServ
12:27 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
12:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
12:38 < Olipro> trumee: sysctl net.ipv4.conf.all.forwarding
12:39 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
12:40 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
12:41 < v0x> why are people recommending tun?
12:41 <@dazo> v0x: because tun has less overhead and no network broadcast traffic
12:41 <@dazo> !search tun
12:41 <@vpnHelper> There were no matching configuration variables.
12:42 <@dazo> !factoid search tun
12:42 <@dazo> !factoids
12:42 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
12:42 <@dazo> !tunortap
12:42 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
12:42 <@vpnHelper> the vpn, or (#4) lan gaming? use tap!
12:42 <@dazo> v0x: ^^^
12:42 < v0x> yes, i understand, but i don't understand why everybody here is suggesting it, as trumee said :)
12:42 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
12:43 < v0x> yes, thanks
12:43 <@dazo> v0x: tun is not more painful than tap ... really, that's just showing lack of network understanding
12:43 < v0x> yes, agreed
12:43 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
12:44 < v0x> well, one further reason for using tap is when someone wants to have a tcp server and an udp server on the same subnet
12:44 < v0x> without vlsm, that is
12:44 <@dazo> nope, that's also not a reason ... it's only relevant when the broadcast traffic is important
12:45 <@dazo> and if MAC addresses are needed
12:45 <@dazo> with tap you can do network bridges, that's one good reason for tap
12:45 < v0x> but if i run a tcp server and an udp server, how do they know which ips are in use?
12:45 < ecrist> what?
12:45 < v0x> or should they share the ipp file?
12:45 < ecrist> that doesn't even make sense.
12:46 <@dazo> v0x: you put them on different subnets
12:46 <@dazo> openvpn + tun/tap is like a virtual NIC
12:46 < v0x> which one?
12:47 < v0x> yes, so i was right
12:47 <@dazo> you don't put two NIC's "just like that" on the same physical network segments with configurations .... unless you have a switch where you do bonding
12:48 < v0x> if you want two servers, tcp and udp, on the same subnet, you can use tap and a dedicated dhcp server
12:48 <@dazo> v0x: but in *that* case, you need broadcast traffic, or else DHCP doesn't work
12:48 < v0x> yes
12:49 < v0x> hence why i said this requires tap
12:49 < v0x> not that i do it that way, i do vlsm
12:49 <@dazo> but you can run tcp and udp side by side in tun mode, having separate network segments for each of them, and let the routing table take care of the rest ... that's an easier setup
12:49 < v0x> so, e.g. one /24 = 2 /25
12:50 < v0x> yes that's how i do it
12:50 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
12:50 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
12:50 < v0x> paired with iptables
12:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
12:53 <@dazo> vlsm, isn't that just plain subnetting?
12:53 < ecrist> it is
12:54 <@dazo> then I think I lost the point of something in the discussion somewhere ....
12:59 -!- cron2_ is now known as cron2
13:02 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:04 -!- bitterman [~yury@93.178.92.67] has quit [Quit: This computer has gone to sleep]
13:14 <@vpnHelper> RSS Update - forum: Wrong preconfigurated TUN-Device? <http://forums.openvpn.net/topic8706.html#p15025>
13:19 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
13:21 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
13:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
13:29 < Onepamopa> boys, got a question
13:29 < Onepamopa> can openvpn "assign" real ip for openvpn client
13:29 < Onepamopa> instead of 10.x.x.x
13:29 < Onepamopa> ?
13:29 < Onepamopa> I've got 100 ip's /32 mask as aliases
13:29 < Onepamopa> so, wondering if its possible
13:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:30 < krzee> sure
13:31 < EugeneKay> Using a publically routed IP pool for OpenVPN? Sure, no problem
13:31 < EugeneKay> You won't want to use /30 toplogy
13:31 < Onepamopa> the gw will still be 10.x.x.x right ?
13:31 < krzee> but you need to not be using them as aliases, or you need to use a bidirectional nat for each one, the first is preferable
13:31 < krzee> no
13:31 < krzee> you will waste an ip for network and 1 for broadcast
13:31 < Onepamopa> krzee here's what Im trying to do
13:31 < krzee> if you do what EugeneKay is saying and use topology subnet
13:32 < krzee> otherwise youd waste 3 per ip =]
13:32 < Onepamopa> got 100 ip's as aliases @ bge1
13:32 < CybDev> or you could just use layer2 and set up proper firewalling
13:32 < Onepamopa> vpn server listens @ bge0's ip
13:32 < Onepamopa> client connects to bge0, gets real ip via vpn (from aliases)
13:32 < EugeneKay> Aliased IPs are a terrible idea. Get your upstream to route the block to you
13:32 < Onepamopa> then
13:32 < krzee> i prefer to avoid layer2, especially when talking about 100 clients
13:32 < krzee> ya what EugeneKay said
13:33 < Onepamopa> pass in quick on bge0 route-to (tun0 10.0.2.2) from any to 95.215.4.70/32 no state
13:33 < EugeneKay> Yeah, that's a crappy idea. Don't do that.
13:33 < Onepamopa> so incoming connections to that ip are routed to vpn's tunnel
13:33 < Onepamopa> EugeneKay that's actually what I need to do (or something similar)
13:33 < Onepamopa> so client will pass its outgoing traffic back through vpn as real ip that is assigned
13:33 < EugeneKay> What you need to do is tell your upstream to give you a proper routed block
13:33 < CybDev> why is the layer2 option so bad with 100 clients?
13:33 < Onepamopa> EugeneKay actually, my setup is a bit .... "special"
13:33 < EugeneKay> "Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
13:34 < EugeneKay> Onepamopa - special means bad.
13:34 < Onepamopa> CybDev vpn will use only 5 ip addresses
13:34 < Onepamopa> not 100
13:34 < Onepamopa> the others are for other things
13:34 < Onepamopa> nevermind that
13:34 < Onepamopa> just tell me if the idea will work or not ;)
13:34  * CybDev pokes krzee 
13:34 < EugeneKay> You can do DNAT/SNAT with static client IPs
13:34 < krzee> CybDev, connect 100 clients to a switch, then start sniffing, then remember that youd be xfering all that over the inet
13:35 < krzee> tap doesnt scale well
13:35 < Onepamopa> EugeneKay that's exactly what we're trying to avoid
13:35 < Onepamopa> no nat's ...
13:35 < CybDev> a hub will indeed be kinda fail, but a switch is pretty much how we do it :P
13:35 < EugeneKay> Well, sorry, but this is how routing works.
13:35 < CybDev> except we dont have no 100 port switches where i work
13:35 < EugeneKay> So deal with it?
13:35 < Onepamopa> idea is that client from outside will reach vpn server looking for client's ip let's say 95.215.4.70
13:35 < krzee> CybDev, ya, you know why?
13:35 < krzee> heheh
13:35 < Onepamopa> that traffic will be pointed through tun0 (vpn's tunnel) to the client
13:35 < CybDev> no?
13:35 < Onepamopa> and client has to respond with same ip
13:35 < EugeneKay> Onepamopa - that is, by definition a DNAT/SNAT.
13:36 < krzee> broadcast domains should not be allowed to grow to huge sizes, layer2 doesnt like it like that
13:36 < krzee> !broadcast radiation network
13:36 < krzee> err
13:36 < krzee> !google broadcast radiation network
13:36 <@vpnHelper> Broadcast radiation - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Broadcast_radiation>; Switching loop - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Switching_loop>; Internetwork Design Guide -- Broadcasts in Switched LAN ...: <http://docwiki.cisco.com/wiki/Internetwork_Design_Guide_--_Broadcasts_in_Switched_LAN_Internetworks>
13:36 < Onepamopa> krzee so basicly it'll work in the way I want it ?
13:37 < krzee> Onepamopa, huh?  im talking to CybDev 
13:37 < Onepamopa> oh sorry ;)
13:37 < krzee> you should be doing what EugeneKay was saying
13:37 < Onepamopa> EugeneKay we're doing something similar with linux clients using gre tunnels
13:37 < Onepamopa> working fine, but gre tunnels != windows ;)
13:37 < Onepamopa> so we're trying to do the same, using openvpn
13:38 < krzee> not the NAT stuff (unless no choice) but you should get a block of IPs routed
13:38 < Onepamopa> with linux we point the traffic in the same way through greX to client
13:38 < krzee> so you can just feed that block to openvpn's --server command
13:38 < krzee> its just a change of how they give you the IPs
13:39 < krzee> and you'll lose a couple, one for network addy one for broadcast
13:39 < krzee> but thats just how it goes
13:39 < krzee> and you will certainly want topology subnet
13:39 -!- luneff [~yury@84.51.199.63] has joined #openvpn
13:39 < CybDev> so no real reason why you dont want layer2 over layer3, except the usual suspects then :P
13:40 < krzee> "except the usual suspects"
13:40 < krzee> umm, ya
13:40 < krzee> not like in his case unicorns will raid your house
13:40 < krzee> just the normal reasons
13:40 < CybDev> they'll still broadcast on your /30 net
13:40 < krzee> it causes aids and will rape your cat
13:41 < CybDev> all 100 clients... server load will be pretty much the same
13:41 < CybDev> assuming you apply a firewall to it anyway
13:41 < krzee> so what do you gain from tap in your scenario?
13:41 < CybDev> simplicity
13:42 < EugeneKay> LOL
13:42 < krzee> how?
13:42 < krzee> simplicity is getting the ISP to route the block right
13:42 < krzee> then you just use it in --server
13:42 < CybDev> it integrates well with firewall config for our other "physical" nnets
13:42 < krzee> SIMPLE!
13:42 < krzee> its no easier or harder to integrate a subnet into your firewall based on being tun or tap
13:43 < krzee> its just making the appropriate rules for your new network
13:43 < krzee> any others?
13:43 < CybDev> yeah, you dont waste so many addresses
13:43 < krzee> !topology
13:43 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
13:43 < krzee> any others?
13:43 < EugeneKay> I think its my naptime.
13:44 < CybDev> not really no
13:44 < krzee> ya its about time for me to crack open the freeswitch book
13:47 < CybDev> but assuming you do have a sane firewall config, what are the points against using tap?
13:47 < CybDev> sure "tun" can accomplish pretty much the same as the tap device with subnet topology
13:47 < CybDev> but why not just stick to tap that works just like it should?
13:47 < krzee> layer2 attacks over the vpn, extra overhead, scalability
13:47 < krzee> you use tap ONLY when you need layer2
13:48 < krzee> if you dont need layer2 you DONT use tap =]
13:48 < krzee> oh and unless you need dynamic iroute such as the case when using routing protocols like RIP over openvpn
13:49 < CybDev> most of those layer2 attacks drop in the firewall... 
13:49 < krzee> doesnt sound like extra simplicity as advertised ;]
13:49 < krzee> anyways, i dont care what you choose to use =]
13:49 < krzee> time for me to go read my book
13:49 < CybDev> have fun :P
13:50 < krzee> thanks
13:50 < krzee> bbl from krzie
13:51 < Onepamopa> so, minimum subnet for openvpn is .248
13:51 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
13:59 -!- DSpair [~Deven@74-134-11-232.dhcp.insightbb.com] has quit [Quit: Leaving]
14:00 < CybDev> does openvpn need its own dedicated subnet with tun and topology subnet?
14:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:04 < hyper_ch> !topology
14:04 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
14:04 < hyper_ch> !subnet
14:04 <@vpnHelper> "subnet" is http://www.subnet-calculator.com/ or http://en.wikipedia.org/wiki/Subnetwork
14:07 < CybDev> that does not really answer my question
14:08 < hyper_ch> awww.... and I tried my best
14:08  * hyper_ch goes in the far away corner and starts crying really loud
14:09  * CybDev throws medium sized rocks at hyper_ch 
14:09  * hyper_ch cries even louder
14:09 < hyper_ch> tears fall down like a river
14:11  * CybDev pokes hyper_ch with a sharp stick
14:12 -!- troyt [~troyt@cl-166.phx-01.us.sixxs.net] has joined #openvpn
14:12 < hyper_ch> dazo: CybDev does mean things to me
14:12 -!- Araluccl0 [~lallo@151.77.207.160] has joined #openvpn
14:14 < CybDev> payback for directing me to http://books.google.com/books?printsec=frontcover&id=e_nm1EAxmSwC#v=onepage&q&f=false in response to my question :P
14:14 <@vpnHelper> Title: The Internet For Dummies - Google Books (at books.google.com)
14:24 < hyper_ch> CybDev: what's that internet thing everybody is talking about? A lot of people know have that internet thing
14:24 < CybDev> it's a new form for chicken
14:24 < CybDev> they serve it at mcdonalds
14:25 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
14:25 < decoder> hey guys
14:26 < decoder> short question: Is there any security implication for using "duplicate-cn", i.e. one cert/keypair for all clients? is the TLS handshake done based on that keypair or is it no different from clients without any keypair?
14:26 < CybDev> not if you're using ldap or some other way of separating users i suppose
14:27 < CybDev> everyone sharing the exact same credentials will be a problem if you ever have to disable a user
14:27 < decoder> there is also ldap auth involved
14:27 < decoder> so im not worried about locking out users
14:27 < hyper_ch> any reason why you don't create a cert for every client?
14:27 < decoder> hyper_ch: it's not my setup, it's a setup I just saw
14:27 < CybDev> (obviously having all the private keys will make the crypto somewhat redundant if you're worried about internal security)
14:28 < decoder> CybDev: that's what I'm asking. there are many ways to open a TLS channel. one way involves the client side RSA keypair, which would be useless in this case
14:28 < decoder> but since openvpn supports keyless clients anyway, I wonder if it uses the client keypair for the TLS handshake itself
14:28 < CybDev> but then how many "untrusted" vpn users do you have :P
14:28 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:29 < CybDev> https://secure.wikimedia.org/wikipedia/en/wiki/Diffie%E2%80%93Hellman_key_exchange
14:29 <@vpnHelper> Title: Diffie–Hellman key exchange - Wikipedia, the free encyclopedia (at secure.wikimedia.org)
14:29 < decoder> CybDev: i know DH, but DH is not mandatory for TLS. you can do pure RSA based TLS
14:29 < decoder> openvpn always uses DH?
14:30 < CybDev> you generate a dh key for the server so i would assume its common
14:30 < krzee> comment it out of your server and see if it starts...
14:30 < krzee> ive certainly never tried to run one without dh
14:30 < CybDev> likewise
14:32 < decoder> hm hm.. in any case the client key is used for the signing during TLS handshake
14:32 < decoder> it's not a good idea to share it
14:32  * decoder goes to report that to the guys who setup this
14:33 < CybDev> if your keys are compromised you have bigger problems anyway :P
14:35 < decoder> CybDev: you cant authenticate using them
14:35 < decoder> as authentication requires ldap as well
14:35 < CybDev> openvpn does not add any network level security what so ever, so if its a compromised computer accessing the net it has all the access it will need...
14:39 < CybDev> thats not something that applies just to openvpn tho, thats pretty much any vpn solution out there
14:40 < gladiatr> Yes.  The air bags in your car won't keep your child from jumping into a hole filled with rusty spikes.  
14:44 < CybDev> some parents seem to think so
14:45 < CybDev> gatorade is good for network security! it's got electrolytes!
14:58 -!- Yen [~Yen@unaffiliated/yen] has quit []
15:08 -!- cpf [515306d2@gateway/web/freenode/ip.81.83.6.210] has quit [Ping timeout: 252 seconds]
15:19 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
15:20 < krzee> it has everything plants need!
15:20 <@vpnHelper> RSS Update - forum: Is it possible to decrypt traffic data on OpenVPN? <http://forums.openvpn.net/topic8711.html>
15:27 <@vpnHelper> RSS Update - forum: Is it possible to decrypt traffic data on OpenVPN? <http://forums.openvpn.net/topic8711.html#p15027>
15:28 < hyper_ch> it is possible to decrypt traffic data on openvpn
15:28 < hyper_ch> otherwise it would be unusable
15:28 < hyper_ch> hi krzee
15:30 < krzee> hey =]
15:30 < krzee> !hmac
15:30 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the tls static
15:30 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
15:31 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 260 seconds]
15:31 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
15:34 < Onepamopa> boys thanks, specially EugeneKay and krzee, it worked great ;)
15:35 < Onepamopa> strange that after 50 manuals that I've read about openvpn, none of them says that its possible to assign real ip's ;)
15:35 < krzee> !book
15:35 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
15:35 < krzee> it doesnt only say it there
15:35 < krzee> it gives real examples =]
15:35 < krzee> recipes even
15:35 < krzee> that book RULES btw
15:35 < Onepamopa> krzee I usually google about manuals, or hands-on
15:35 < Onepamopa> not books ;)
15:36 < krzee> i did proof reading on that book
15:36 < Onepamopa> btw, got an interesting idea, dont know if its possible
15:36 < krzee> take my word for it, theres nothing on google like that book
15:36 < Onepamopa> --> to create different tunX for each client <-> openvpn connection
15:36 < krzee> thats how openvpn1 worked
15:37 < krzee> just setup a different process for each
15:37 < krzee> ptp networking for every one
15:37 < Onepamopa> hm, that's actually a good idea to have in current version
15:37 < Onepamopa> by config
15:37 < krzee> by config...?
15:37 < krzee> it does exist in the current version... you can run openvpn as many times as you want
15:37 < Onepamopa> like @ ccd/client-x 
15:37 < krzee> each tun will be a seperate config tho
15:37 < Onepamopa> tunX ipX gwX
15:38 < Onepamopa> krzee I know, but it's a bit inconveniant..
15:38 < krzee> what problem are you trying to solve?
15:38 < Onepamopa> krzee I already solved it
15:38 < krzee> no no
15:38 < krzee> with that suggestion
15:38 < Onepamopa> well, I have a "service" that I provide
15:38 < Onepamopa> but running it @ windows was problem untill now
15:38 < krzee> cause surely theres a better way to accomplish whatever it is that makes you want a virtual interface per client
15:38 < Onepamopa> the other thing is that openvpn min. mask is /29
15:39 < Onepamopa> so, I assign ~10 ip's just for 1 client @ the moment
15:39 < krzee> umm
15:39 < krzee> why would you need a seperate mask per client!?!?
15:39 < krzee> wanna post your configs?  that just sounds so wrong
15:39 < Onepamopa> cause Right now I do: pass in quick on bge0 route-to (tun1 95.215.4.122) from any to 95.215.4.126/32 no state
15:40 < krzee> oh god maybe i dont wanna dig too much into it, lol
15:40 < Onepamopa> yeah its a bit complicated setup, as I aid
15:40 < Onepamopa> said*
15:40 < krzee> but i REALLY dont see why youd need a seperate mask per client
15:40 < Onepamopa> but I really think it's better to have separate tunnel for each client
15:40 < Onepamopa> that way I can point the traffic where I want it
15:40 < Onepamopa> not directly @ (tun1 95.215.4.122)
15:40 < krzee> so you didnt bother getting your ISP to route the subnet to you correctly?
15:41 < krzee> then you could just use --server
15:41 < Onepamopa> krzee you misunderstood, I can assign /24 mask just for openvpn
15:41 < krzee> yanno, the normal openvpn way of assigning ips
15:41 < Onepamopa> yep
15:41 < Onepamopa> is there a patch or something to add ovpn 1 functionality @ current ?
15:41 < krzee> its there
15:42 < Onepamopa> where ?
15:42 < Onepamopa> lol ;)
15:42 < krzee> look up ptp in the manual
15:42 < Onepamopa> I think I had too much whisky
15:42 < krzee> ptp mode instead of client / server
15:42 < krzee> no server / clients, just 2 endpoints
15:42 < krzee> no multiple users, etc
15:42 < krzee> i still dont see why you think you need smaller subnets for openvpn
15:43 < krzee> the manual has examples on building ptp links even
15:43 < krzee> however, an important note regarding security:
15:43 < Onepamopa> krzee that's not to my liking ;)
15:43 < krzee> !factoids search forward
15:43 <@vpnHelper> 'winipforward', 'linipforward', 'fbsdipforward', 'linportforward', 'osxipforward', 'ipforward', and 'forwardsecurity'
15:43 < Onepamopa> I prefer 1 openvpn process managing multiple tunnels
15:43 < Onepamopa> ;)
15:43 < krzee> !forwardsecurity
15:43 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation, or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
15:43 < Onepamopa> gotta search for a patch or something ;)
15:43 < krzee> you dont understand
15:44 < krzee> there is 2 modes
15:44 < krzee> ptp and server/client
15:44 < krzee> [13:43]  <Onepamopa> I prefer 1 openvpn process managing multiple tunnels
15:44 < krzee> '
15:44 < krzee> thats client/server
15:44 < krzee> you already have that
15:44 < Onepamopa> exactly
15:44 < Onepamopa> but @ current there arent multiple tunnels
15:44 < Onepamopa> there's just 1
15:44 < krzee> you wont get each on its own device, nor is there a valid reason for wanting it
15:44 < krzee> yes there are
15:44 < Onepamopa> hm ?!
15:44 < krzee> you connect more clients, its more tunnels
15:44 < krzee> you mean to say interfaces
15:45 < Onepamopa> yes, tunX
15:45 < Onepamopa> right now vpn process has only tun1
15:45 < Onepamopa> that's by default when no user is connected
15:45 < krzee> more likely tun0, but ok
15:45 < Onepamopa> krzee tun0 is running another vpn
15:45 < Onepamopa> .....
15:45 < Onepamopa> that's the thing I dont like ;)
15:45 < krzee> what is
15:45 < Onepamopa> so, better to search for a patch or some old version of openvpn to see how its made
15:45 < krzee> you're making small amounts of sense
15:46 < krzee> you still dont understand
15:46 < Onepamopa> krzee multiple processes of openvpn = not like
15:46 -!- dazo is now known as dazo_afk
15:46 < krzee> openvpn 1 only had ptp
15:46 < Onepamopa> 1 openvpn managing xxxxx tunX interfaces - that's what I'd like
15:46 < krzee> you had to run it 100 times to have 11 connections
15:46 < krzee> which would give 100 interfaces
15:46 < krzee> and 100 processed
15:46 < krzee> err
15:46 < Onepamopa> hm
15:46 < krzee> s/11/100/
15:46 < Onepamopa> krzee anyone from dev team here ?
15:46 < krzee> im qualifioed to answer the questions you're asking
15:47 < krzee> just not to type correctly it seems
15:47 < Onepamopa> yeah as I said - too much whisky
15:47 < krzee> come back when you're sober then
15:55 <@vpnHelper> RSS Update - forum: OpenVPN on OpenWrt <http://forums.openvpn.net/topic8461.html#p15028>
15:57 < CybDev> no problem serving completely separate clients from openvpn using subnet topo
15:57 < CybDev> just use a decent firewall, like proper setup iptables, and use the client-connect scripts etc...
15:58 -!- Bennit [~FooBar@igwe17.vub.ac.be] has joined #openvpn
15:58 < Bennit> Hi
15:58 -!- somefatkid [~administr@rrcs-24-213-178-60.nyc.biz.rr.com] has quit [Remote host closed the connection]
15:58 < Bennit> I've got a problem with configuring my vpn client
15:58 < Bennit> I got the ca.crt, client.crt and client.key from my openvpn-server
15:59 < Bennit> but gadmin-openvpn-client says i'm missing certificate or key setting
15:59 < Bennit> I think it's because there's a DH key field and TA key field which aren't filled in
15:59 < Bennit> but in the guide I followed it doesn't state anything about those keys
16:00 < krzee> !howto
16:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:00 < krzee> screw those guides
16:00 < krzee> also, screw those gui config tools
16:01 < krzee> openvpn config files are pretty simple
16:01 < krzee> heres a sample for ya
16:01 < krzee> !sample
16:01 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
16:01 < krzee> and dont forget to use this!
16:01 < krzee> !man
16:01 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
16:01 < reiffert> 63	Duke Nukem 3D Atomic Pack (1996).app
16:01 < krzee> duke nukem!!!
16:01 < krzee> i used to play that back then
16:01 < reiffert> got it for OS X, wanna have it?
16:01 < krzee> back when i played games
16:02 < krzee> nah thanks tho
16:02 < reiffert> it's fun
16:02 < CybDev> it was fun
16:02 < krzee> ya but angry birds and words with friends already wastes my time... i need to get into this book more
16:02 < reiffert> ;)
16:02 < krzee> book/manual/whatev ya wanna call it
16:03 < reiffert> just set up my netatalk file service serving as a time machine destination
16:03 < krzee> ahh nice
16:03 < krzee> i did that with my NFS awhile ago
16:03 < reiffert> http://ubuntuforums.org/showthread.php?p=11101453
16:03 <@vpnHelper> Title: Setting up Ubuntu 10.04 as a server for Mac OS 10.7 (Lion) Time Machine - Ubuntu Forums (at ubuntuforums.org)
16:04 < krzee> not sure i knew you were an apple user too
16:04 -!- somefatkid [~administr@rrcs-24-213-178-60.nyc.biz.rr.com] has joined #openvpn
16:04 < reiffert> saw the photos I took recently yet?
16:04 < krzee> lightning?
16:04 < reiffert> yup
16:04 < krzee> ya those were crazy looking
16:04 < reiffert> another one is approaching right now...
16:04 < krzee> that was .de?
16:04 < reiffert> yup
16:05 < reiffert> http://meteox.com/gmapstatic.aspx?zoom=6&type=zoom&x=386&y=295
16:05 <@vpnHelper> Title: Meteox.com - Weather - European rainfall radar (at meteox.com)
16:05 < krzee> a hurricane just came thru the carib... didnt come by my area tho
16:06 < krzee> hey cool page
16:07 < krzee> i normally use noaa
16:07 < krzee> noaa.gov
16:09 -!- upz [~James@213.79.53.61] has joined #openvpn
16:12 < reiffert> there is plenty of them
16:12 <@vpnHelper> RSS Update - forum: OpenVPN on OpenWrt <http://forums.openvpn.net/topic8461.html#p15029>
16:12 < reiffert> sat24.com niederschlagsradar.de meteox.com
16:12 < reiffert> and flightradar24.com ;)
16:15 < Bennit> thanks krzee, think i'm set now
16:15 < Bennit> no way to run the client as a normal user I guess?
16:16 < krzee> sure, just not start it
16:17 < krzee> in the manual see this:
16:17 < krzee> --user / --group
16:17 < Bennit> If I start it as my own user it exits with a message that it could not run a certain command
16:18 < Bennit> Note: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
16:18 < krzee> [14:16]  <krzee> sure, just not start it
16:18 -!- upz [~James@213.79.53.61] has quit [Quit: Leaving]
16:19 < krzee> if you want to understand,
16:19 < krzee> [14:17]  <krzee> in the manual see this:
16:19 < krzee> [14:17]  <krzee> --user / --group
16:19 < krzee> lol
16:19 -!- upz [~UserNick@213.79.53.61] has joined #openvpn
16:20 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:23 -!- upz [~UserNick@213.79.53.61] has quit [Client Quit]
16:23 -!- upz [~uuuppz@213.79.53.61] has joined #openvpn
16:36 -!- sk1 [~khannast@129.137.216.165] has quit [Quit: leaving]
16:43 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
16:43 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
16:43 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
16:46 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
16:46 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Quit: Nettalk6 - www.ntalk.de]
16:46 -!- uuuppz [~uuuppz@213.79.53.61] has joined #openvpn
16:46 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15030>
16:47 < upz> .
16:55 -!- k4v [~kav@g224244233.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
16:58 < Bennit> Hi again
16:58 < upz> hi
16:58 < Bennit> So I configured my openvpn server and client, and i'm able to ping the server from my client via the 10.blabla address
16:59 < Bennit> Now i'd like to use the openvpn connection for browsing
16:59 < krzee> !redirect
16:59 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
16:59 < Bennit> I've followed this:
16:59 < Bennit> http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
16:59 <@vpnHelper> Title: HOWTO (at openvpn.net)
16:59 < Bennit> but when I start the openvpn on the client-side (yes, I did restart the openvpn on serverside)
16:59 < Bennit> I can't connect anywhere new
17:00 < krzee> !redirect
17:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:00 < Bennit> aha
17:00 < Bennit> so nice how you guys don't need the entire story before you give the answer :p
17:00 < krzee> same questions for years now ;]
17:02 < reiffert> then why dont we improve the howto?
17:02 < reiffert> cause we would run out of victims..
17:03 < krzee> feel free, trac would be a good place to add changes
17:04 < krzee> ive been working on a troubleshooting flowchart for !redirect
17:04 < krzee> but it kinda sucks =/
17:05 < krzee> so many more caveats than the !route doc i wrote
17:06 < Bennit> krzee: ERROR: Linux route add command failed: external program exited with error status: 7
17:07 < Bennit> on this: /sbin/route add -net 134.184.49.17 netmask 255.255.255.255 gw 192.168.1.1
17:07 -!- upz [~uuuppz@213.79.53.61] has quit [Quit: upz]
17:17 < Bennit> I tried to run the command manually while openvpn client was running
17:17 < Bennit> which gave the following line of output before ending: SIOCADDRT: File exists
17:18 < krzee> just let openvpn handle the routes ;]
17:18 < krzee> did you enable ip forwarding...?
17:18 < Bennit> on the serverside with IPtables?
17:18 < Bennit> (yes)
17:18 < krzee> no
17:18 < krzee> !linipforward
17:18 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
17:19 < Bennit> where is it written to do that?
17:19 < krzee> here:
17:19 < krzee> !redirect
17:19 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:20 < reiffert> krzee: you dont really require nat for this.
17:21 < krzee> i dont use nat for it ;]
17:21 < reiffert> s,and NAT,and most probably NAT,
17:21 < krzee> i use a socks server that listens only on the internal vpn ip only
17:21 < krzee> and exits through the real interface
17:21 < krzee> however, NAT is the standard way to do it
17:21 < krzee> !route_by_app
17:21 < krzee> !routebyapp
17:21 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
17:21 < reiffert> and the socks server gains?
17:21 < reiffert> k
17:22 < krzee> that ^
17:25 < Bennit> i'm still getting the error from the linux add command krzee 
17:26 < Bennit> and I did modprobe tun and enabled ipv4 forwarding
17:26 < reiffert>                 exited with error status: 7
17:26 < reiffert> that one?
17:26 < Bennit> yes
17:27 < reiffert> works fine on my linux.
17:27 < Bennit> SIOCDELRT: Operation not permitted
17:28 < Bennit> is the line that comes before the error status
17:28 < reiffert> guess!
17:28 < Bennit> (i'm running it as root, so I don't know why it would not be permitted)
17:28 < Bennit> googling it now though
17:29 < reiffert> 23:19 < krzee> [14:17]  <krzee> --user / --group
17:29 < reiffert> forget about that last line.
17:29 < reiffert> My wrong.
17:29 < reiffert> guess you didnt run it as root then.
17:30 < Bennit> I did =(
17:30 < reiffert> prove!
17:30 < Bennit> sudo openvpn openvpn.conf
17:30 < reiffert> sudo -s
17:31 < Bennit> http://igor.rave.org/secret/output.txt
17:31 < Bennit> now it shows "SIOCADDRT: File exists
17:32 < Bennit> googling
17:32 < reiffert> Fri Aug 26 00:30:13 2011 us=508262 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
17:33 < reiffert> please check if all openvpn instances are stopped before starting another one
17:34 < Bennit> bcorne@bendoos:~/openvpn$ ps aux | grep openvpn
17:34 < Bennit> bcorne   10341  0.0  0.0  13124  1060 pts/1    S+   00:34   0:00 grep --color=auto openvpn
17:34 < Bennit> they are
17:35 < Bennit> perhaps it's network-manager doing evil things behind my back
17:35 < Bennit> it's not I guess
17:35 < reiffert> !nm
17:36 < reiffert> !factoids search nm
17:36 <@vpnHelper> No keys matched that query.
17:36 < reiffert> !factoids search network
17:36 <@vpnHelper> No keys matched that query.
17:36 < reiffert> !factoids search manager
17:36 <@vpnHelper> No keys matched that query.
17:36 < reiffert> grrrrr
17:36 < reiffert> !factoids search --values nm
17:36 <@vpnHelper> 'lintrafaccnt', 'ipp', and 'android'
17:36 < krzee> you already have the route
17:36 < krzee> lol
17:36 < krzee> thats why it exists
17:36 < krzee> also why i told you to let openvpn deal with the routes
17:36 < reiffert> where's that network manager factoid gone to?
17:36 < krzee> !netman
17:36 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
17:36 < krzee> !ubuntu
17:36 <@vpnHelper> "ubuntu" is dont use network manager!
17:37 < Bennit> Yes, I usually uninstall network-manager when running into routing troubles :p
17:37 < reiffert> netman sounds so novel'ish
17:39 < Bennit> removed network-manager, still the "SIOCADDRT: File exists" error
17:39 < reiffert> remove them or reboot.
17:39 < Bennit> brb :p
17:40 < krzee> its just saying you have the route!
17:40 < krzee> lol
17:41 < reiffert> he's a student of computer sience.
17:42 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 258 seconds]
17:44 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
17:45 -!- corretico [~luis@200.12.40.17] has quit [Ping timeout: 245 seconds]
17:49 < Bennit> OK i'm back
17:49 < Bennit> no more errors now
17:49 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
17:49 < Bennit> but still internet doesn't seem to be forwarded
17:49 < reiffert> now send some pics of some naked belgium blond firls
17:51 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
17:51 < krzee> girls too!
17:51 < krzee> Bennit, do this:  cat /proc/sys/net/ipv4/ip_forward
17:52 < Bennit> on the server right?
17:52 < krzee> yes
17:52 < krzee> tell me the output
17:52 < Bennit> 0
17:52 < krzee> !linipforward
17:52 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
17:52 < Bennit> weird, I did execute the echo 1 >  line
17:52 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:52 < krzee> read what that does again
17:53 < Bennit> sudo -s echo 1 > /proc/sys/net/ipv4/ip_forward
17:53 < Bennit> -bash: /proc/sys/net/ipv4/ip_forward: Permission denied
17:54 -!- corretico [~luis@200.12.40.17] has joined #openvpn
17:54 < Bennit> well, it writes 1 to the ip_forward file
17:54 < krzee> "for a temp solution (til reboot)"
17:54 < Bennit> i didn't reboot server
17:54 < reiffert> krzee: see, that is what makes me confident, that all those students wont take my job in the future.
17:54 < Bennit> server doesn't have networkmanager
17:55 < krzee> well either you rebooted or never changed it
17:55 < kenyon> Bennit: echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
17:55 < krzee> either way, you need to turn on ip forwarding
17:55 < reiffert> 00:53 < Bennit> sudo -s echo 1 > /proc/sys/net/ipv4/ip_forward
17:55 < reiffert> 00:53 < Bennit> -bash: /proc/sys/net/ipv4/ip_forward: Permission denied
17:55 < reiffert> sudo something without -s
17:55 < reiffert> sudo -s 
17:55 < reiffert> get root shell
17:55 < Bennit> yeah that's what I did now, works
17:55 < krzee> sudo bash should suffice
17:55 < kenyon> or what I said
17:56 < kenyon> on ubuntu, man sudo_root
17:57 < Bennit> igor:/home/bcorne# cat /proc/sys/net/ipv4/ip_forward
17:57 < Bennit> 1
17:57 < krzee> cool
17:57 < Bennit> still yet no network on client
17:58 < krzee> can the client ping 8.8.8.8?
17:58 < Bennit> nope
17:58 < krzee> can it currently ping the server ip?
17:58 < Bennit> only via the vpn server ip
17:58 < krzee> (vpn ip)
17:59 < krzee> the vpn ip right?  like 10.8.whatev
17:59 < Bennit> yep
17:59 < Bennit> 10.8.0.1
17:59 < krzee> !logs
17:59 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:59 < krzee> !logfile
18:00 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
18:00 < krzee> verb 4 will be good enough for this
18:01 < krzee> if i dont find something wrong in there, its your firewall
18:01 < Bennit> that was what I was about to say
18:02 < Bennit> if it was possible the server network firewalls ipforwarding
18:02 < krzee> absolutely
18:02 < krzee> not a issue in its network tho
18:02 < krzee> just the server itself
18:03 < krzee> after the NAT the rest of the network will think your clients ARE the server
18:05 < reiffert> :)
18:07 < krzee> reiffert, ya your job looks safe
18:08 -!- Denial [Denial@drgi.co.uk] has quit []
18:13 < Bennit> http://igor.rave.org/secret/openvpn.log
18:15 < Bennit> i'm giving up for today
18:16 -!- Araluccl0 [~lallo@151.77.207.160] has quit [Ping timeout: 258 seconds]
18:16 < Bennit> thanks for all your efforts, it's probably just me
18:28 <@vpnHelper> RSS Update - forum: Persistent TUN driver lcoation <http://forums.openvpn.net/topic8712.html>
18:45 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 246 seconds]
18:57 -!- mape2k [~mape2k@2001:7c0:e701:116b:221:86ff:fe98:93a2] has joined #openvpn
18:57 < krzee> that log is good up to where you pasted
18:57 < krzee> you didnt post the over so i cant comment on it
18:57 < krzee> s/over/other/
19:07 -!- mape2k [~mape2k@2001:7c0:e701:116b:221:86ff:fe98:93a2] has quit [Quit: Leaving]
19:07 -!- mape2k [~mape2k@2001:7c0:e701:116b:221:86ff:fe98:93a2] has joined #openvpn
19:30 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has quit [Ping timeout: 255 seconds]
19:33 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
19:35 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 240 seconds]
19:50 -!- mape2k [~mape2k@2001:7c0:e701:116b:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
19:52 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
19:56 -!- fread2281 [~fread2281@70-56-128-174.albq.qwest.net] has joined #openvpn
19:56 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
19:56 -!- fread2281 [~fread2281@70-56-128-174.albq.qwest.net] has quit [Remote host closed the connection]
19:57 -!- fread2281 [~fread2281@70-56-128-174.albq.qwest.net] has joined #openvpn
19:57 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:58 -!- uuuppz [~uuuppz@213.79.53.61] has quit [Ping timeout: 264 seconds]
19:59 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 264 seconds]
20:01 -!- fread2281 [~fread2281@70-56-128-174.albq.qwest.net] has quit [Remote host closed the connection]
20:03 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 240 seconds]
20:09 -!- Onepamopa [onepamopa@62.204.152.143] has joined #openvpn
20:09 -!- Onepamopa [onepamopa@62.204.152.143] has quit [Changing host]
20:09 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has joined #openvpn
20:13 -!- Araluccl0 [~lallo@151.77.221.23] has joined #openvpn
20:30 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
20:31 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:39 -!- fread2281 [~fread2281@70-56-209-214.albq.qwest.net] has joined #openvpn
20:52 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
21:15 -!- fread2281 [~fread2281@70-56-209-214.albq.qwest.net] has quit [Quit: Leaving...]
21:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:20 -!- mode/#openvpn [+v Axeman] by ChanServ
21:24 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
21:24 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
21:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:34 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
21:41 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 250 seconds]
21:43 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
21:48 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
21:48 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
21:48 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
22:17 -!- fread2281 [~fread2281@70-56-130-230.albq.qwest.net] has joined #openvpn
22:18 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
22:19 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
22:20 -!- fread228_ [~fread2281@70-56-130-230.albq.qwest.net] has joined #openvpn
22:20 -!- fread228_ [~fread2281@70-56-130-230.albq.qwest.net] has quit [Remote host closed the connection]
22:22 -!- fread2281 [~fread2281@70-56-130-230.albq.qwest.net] has quit [Ping timeout: 260 seconds]
22:22 -!- fread2281 [~fread2281@70-56-130-230.albq.qwest.net] has joined #openvpn
22:31 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
22:32 -!- fread2281 [~fread2281@70-56-130-230.albq.qwest.net] has quit [Remote host closed the connection]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:41 -!- Titania [~titania@221.120.122.106] has joined #openvpn
22:41 -!- Titania [~titania@221.120.122.106] has quit [Read error: Connection reset by peer]
22:43 -!- Titania [~titania@221.120.122.106] has joined #openvpn
22:48 <@vpnHelper> RSS Update - forum: OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p15032>
22:58 -!- Titania [~titania@221.120.122.106] has quit [Remote host closed the connection]
23:03 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Quit: Leaving]
23:04 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
23:25 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
23:33 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
23:34 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
23:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
23:45 -!- Araluccl1 [~lallo@151.77.167.39] has joined #openvpn
23:48 -!- Araluccl0 [~lallo@151.77.221.23] has quit [Ping timeout: 258 seconds]
23:51 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
--- Day changed Fri Aug 26 2011
00:13 <@vpnHelper> RSS Update - forum: Persistent TUN driver lcoation <http://forums.openvpn.net/topic8712.html#p15034> || Can't view any web pages from client <http://forums.openvpn.net/topic8708.html#p15033>
00:17 -!- mape2k [~mape2k@2a01:198:23f:10ff:e8f8:a8ff:feca:c17a] has joined #openvpn
00:23 -!- kbarry [~chatzilla@ppp-70-252-188-122.dsl.bumttx.swbell.net] has joined #openvpn
00:24 < kbarry> Oven in the ##windows channel someone recommended openVPN runing on a DDWRT device. Any recomended devices? I am trying to setup a VPN for 1 server, and a single roaming laptop)
00:37 -!- kbarry [~chatzilla@ppp-70-252-188-122.dsl.bumttx.swbell.net] has quit [Remote host closed the connection]
00:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
00:48 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
01:01 < EugeneKay> You're better off asking a DD-WRT channel about dd-wrt devices
01:01 < EugeneKay> Oh, he's buggered off. Good.
01:05 -!- mape2k [~mape2k@2a01:198:23f:10ff:e8f8:a8ff:feca:c17a] has quit [Ping timeout: 255 seconds]
01:05 -!- mape2k [~mape2k@2001:7c0:e701:116b:221:86ff:fe98:93a2] has joined #openvpn
01:07 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708-15.html#p15035>
01:08 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 258 seconds]
01:09 < krzie> chatzilla, another web irc... havnt ignored that one yet
01:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:12 < EugeneKay> Har har
01:14 -!- mape2k [~mape2k@2001:7c0:e701:116b:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
01:18 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
01:19 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has joined #openvpn
01:19 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has quit [Changing host]
01:19 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
01:23 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708-15.html#p15036>
01:25 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:28 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
01:35 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708-15.html#p15037>
01:36 -!- EugeneKay is now known as EugeneKaway
01:41 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
01:42 -!- dazo_afk is now known as dazo
01:45 -!- k4v [~kav@g226090011.adsl.alicedsl.de] has joined #openvpn
01:55 -!- redconnection [~redconnec@80-219-148-241.dclient.hispeed.ch] has joined #openvpn
02:02 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:02 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
02:02 -!- Olipro_ is now known as Olipro
02:16 < hyper_ch> krzie: halp :(
02:17 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708-15.html#p15038>
02:20 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:21 < krzie> hyper_ch, wassup?
02:23 < hyper_ch> krzie: what could be the cause of a slow transfers between server and client? could I PM you to explain more clearly?
02:24 < krzie> sure, although you may benefit from talking about it in the channel, if we go into mtu im hopefully not the most knowledgeable here ;]
02:33 -!- janjust [~janjust@5355E9DA.cm-6-6d.dynamic.ziggo.nl] has joined #openvpn
02:34 -!- janjust [~janjust@5355E9DA.cm-6-6d.dynamic.ziggo.nl] has quit [Changing host]
02:34 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
02:36 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Client Quit]
02:36 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
02:36 < krzie> jjk!
02:36 < janjust> yo krzie 
02:37 < janjust> saw your priv msg
02:37 < krzie> thanks :)
02:37 < janjust> whassup dude
02:37 < krzie> ill pastebin, was talkin bout it in dev chan
02:37 < janjust> I can switch to dev if that's easier
02:37 < krzie> sure
02:52 -!- nuttersppadic [~IceChat77@193.130.68.17] has joined #openvpn
02:57 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:59 -!- sunta [~cornholio@hector.raytion.com] has joined #openvpn
02:59 < sunta> !welcome
02:59 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:00 < sunta> !/30
03:00 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
03:00 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
03:05 < sunta> can anyone give me a hint? I bridge 2networks via openVPN (net1/net2), on the first network a 2nd openVPN runs that roadwarriors connect to. roadwarrios can access net1 but not net2  http://pastebin.com/pcxNVAWd am I missing masquerading?
03:08 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:10 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 240 seconds]
03:33 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
03:33 -!- mode/#openvpn [+o raidz] by ChanServ
03:39 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
03:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
03:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
03:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
03:52 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:52 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:52 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:56 <@vpnHelper> RSS Update - forum: OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p15039>
04:01 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 245 seconds]
04:13 -!- dazo is now known as dazo_afk
04:18 -!- Slashman [~Slash@hydra.fimasys.com] has joined #openvpn
04:20 < Slashman> does someone knows how to install openvpn-als (adito) ?
04:21 < Slashman> I followed the wiki http://sourceforge.net/apps/trac/openvpn-als/wiki/insall_walkthrough_debian_%26_Active_Directory but when I'm done building with ant, I have no installer wizard at all
04:21 <@vpnHelper> Title: insall_walkthrough_debian_&_Active_Directory – openvpn-als (at sourceforge.net)
04:22 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
04:22 -!- mode/#openvpn [+o raidz] by ChanServ
04:23 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:24 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
04:25 -!- luneff [~yury@84.51.199.63] has quit [Quit: This computer has gone to sleep]
04:28 < hyper_ch> !mtu
04:28 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
04:28 < hyper_ch> !--mtu-test
04:28 < hyper_ch> !mtu-test
04:28 <@vpnHelper> "mtu-test" is you can just use --mtu-test on the client to see what the best mtu for your connection is
04:30 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p15040>
04:30 -!- mape2k [~mape2k@2a01:198:23f:10ff:d4f6:2eff:fea9:c07] has joined #openvpn
04:30 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
04:36 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 245 seconds]
04:40 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
04:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:41 <@vpnHelper> RSS Update - forum: OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p15041>
04:51 -!- luneff [~yury@93.178.90.99] has joined #openvpn
04:54 -!- mape2k [~mape2k@2a01:198:23f:10ff:d4f6:2eff:fea9:c07] has quit [Ping timeout: 255 seconds]
04:58 -!- dazo_afk is now known as dazo
05:03 < incidence> Hey, after wifi splits or timeout occurs to VPN connection, I start receiving this: "TLS Error: local/remote TLS keys are out of sync" - after that all the clients fail to login (I'm using pam auth)
05:07 -!- redconnection [~redconnec@80-219-148-241.dclient.hispeed.ch] has left #openvpn []
05:15 < v0x> can you do a sigusr1 on the server?
05:24 <@vpnHelper> RSS Update - forum: Is it possible to decrypt traffic data on OpenVPN? <http://forums.openvpn.net/topic8711.html#p15042>
05:33 < incidence> v0x: I can but I rebooted it so it would work.
05:36 <@vpnHelper> RSS Update - forum: Is it possible to decrypt traffic data on OpenVPN? <http://forums.openvpn.net/topic8711.html#p15043>
05:48 < Slashman> impossible to build openvpn-als : http://pastebin.com/jruC6Zjx
05:51 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:55 <@mattock> Slashman: that project is not supported here, this is for OpenVPN, not openvpn-als
05:55 <@mattock> despite the similarity in name
05:55 <@mattock> also, the openvpn-als project has not been maintained for two years or so
05:59 < Slashman> mattock: okay, so the project is basically dead ?
06:00 <@mattock> slashman: I'd say so, yes
06:00 <@mattock> no development in ~2 years, even though there are quite a few issues
06:00 <@mattock> nobody fixing them unfortunately
06:01 < Slashman> it's too bad really, I'll have to buy a solution from cisco or juniper to allow vpn sll support...
06:01 <@mattock> sll?
06:01 < v0x> is there any plan to have openvpn work via icmp?
06:02 < Slashman> ssl
06:02 < Slashman> type
06:03 <@mattock> and you couldn't use OpenVPN (the original one): http://openvpn.net?
06:03 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
06:04 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has joined #openvpn
06:07 < Slashman> mattock: I need a client-less vpn to work behind firewall
06:08 <@mattock> slashman: that might be doable even with OpenVPN, depending on the situation
06:08 <@mattock> I'd ask about this on the forums: https://forums.openvpn.net
06:08 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN Support Forum (at forums.openvpn.net)
06:08 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
06:08 < Bushmills> Slashman: openvpn can be used client-less, as point-to-point solution between equal peers
06:09 -!- luneff [~yury@93.178.90.99] has quit [Quit: Leaving]
06:10 < CybDev> client-less?
06:11 < CybDev> really...
06:12 -!- Araluccl1 [~lallo@151.77.167.39] has quit [Quit: Anche il discorsismo ha un limitismo.]
06:13 < Bushmills> !howto
06:13 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:13 < Bushmills> check out quick start section
06:29 < CybDev> and where is the client-less part?
06:31 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
06:31 -!- k4v [~kav@g226090011.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
06:36 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
06:45 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:45 -!- mode/#openvpn [+v s7r] by ChanServ
06:46 -!- civillian [~nickn@122.49.202.174] has quit [Ping timeout: 272 seconds]
07:01 -!- jwalker [~jwalker@114.143.161.186] has joined #openvpn
07:02 -!- fread2281 [~fread2281@70-56-133-153.albq.qwest.net] has joined #openvpn
07:05 -!- fread2281 [~fread2281@70-56-133-153.albq.qwest.net] has quit [Remote host closed the connection]
07:06 < jwalker> Can anybody help me with enabling aladdin etoken on linux...
07:11 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:24 < Bushmills> CybDev: there where you don't configure a server/client setup
07:25 < Bushmills> point to point is the alternative
07:26 < CybDev> i guess i didn't understand the meaning behind "client-less" then
07:27 < ecrist> point to point is more akin to an ipsec tunnel, where neither is really a client or server
07:30 -!- jwalker [~jwalker@114.143.161.186] has quit [Quit: Leaving]
07:30 <@vpnHelper> RSS Update - forum: Personal vs. Commercial CA <http://forums.openvpn.net/topic8713.html>
07:36 <@vpnHelper> RSS Update - forum: Personal vs. Commercial CA <http://forums.openvpn.net/topic8713.html#p15045>
07:39 -!- Bennit [~FooBar@igwe17.vub.ac.be] has quit [Ping timeout: 264 seconds]
07:42 <@vpnHelper> RSS Update - forum: Personal vs. Commercial CA <http://forums.openvpn.net/topic8713.html#p15046>
07:45 -!- Ragnar [~heimdall@darkstar.acool.net] has joined #openvpn
07:45 < Ragnar> hey
07:45 < Ragnar> you guys ever had  the problem in debian that tun0 doesnt appear in ifconfig after you've started openvpn?
07:46 < Ragnar> I can ping the network behind the tunnel
07:46 < Ragnar> just no tun interface
07:48 < CybDev> ifconfig... what did you name the interface?
07:48 < CybDev> better just use "ip" instead of "ifconfig"
07:54 <@vpnHelper> RSS Update - forum: Personal vs. Commercial CA <http://forums.openvpn.net/topic8713.html#p15047>
07:58 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:59 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
08:00 <@vpnHelper> RSS Update - forum: Personal vs. Commercial CA <http://forums.openvpn.net/topic8713.html#p15048>
08:01 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:03 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
08:03 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:04 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
08:04 -!- troyt_ [~troyt@cl-166.phx-01.us.sixxs.net] has joined #openvpn
08:04 -!- fluter_ [~fluter@fedora/fluter] has joined #openvpn
08:05 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
08:06 -!- fluter_ is now known as fluter
08:07 -!- decoder_ [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
08:07 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:07 -!- mode/#openvpn [+v Axeman] by ChanServ
08:08 < Ragnar> CybDev: I told it to use
08:08 < Ragnar> dev tun
08:08 < Ragnar> in the configuration
08:09 < Bushmills> Ragnar: what does   route   (or route -n) show as interface used?
08:10 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:10 < Ragnar> its not there
08:10 < CybDev> in route?
08:11 < CybDev> or ip
08:11 < Ragnar> 64 bytes from 192.168.70.1: icmp_req=1 ttl=64 time=0.156 ms
08:11 < CybDev> or both
08:11 < Bushmills> then, whatever you're pinging, it's not through openvpn
08:11 < CybDev> :P
08:11 < Ragnar> that is the other end of the vpn tunnel
08:11 < CybDev> run `ip r get 192.168.70.1`
08:12 -!- Netsplit *.net <-> *.split quits: EugeneKaway, fahadsadah, troyt, TypoNe, Olipro, decoder
08:12 -!- Olipro_ is now known as Olipro
08:15 -!- fahadsadah_ [fahad@unaffiliated/fahadsadah] has joined #openvpn
08:16 < Ragnar> CybDev: didnt do much
08:16 < Ragnar> anyway, would there be a reason for tun not coming up?
08:17 -!- k4v [~kav@g226090011.adsl.alicedsl.de] has joined #openvpn
08:17 < CybDev> the log would probably tell you whats wrong
08:17 < CybDev> did you start openvpn as an unprivileged user perhaps?
08:18 < CybDev> try `/sbin/ip r get 192.168.70.1` instead? (requires iproute2 to be installed)
08:18 -!- Netsplit over, joins: TypoNe
08:30 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:39 -!- bassliner [armin@irc.arje.de] has left #openvpn ["wobwob"]
08:49 -!- MysteriooN [~MysterioN@7.84-49-206.nextgentel.com] has joined #openvpn
08:54 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
08:54 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
08:54 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
08:54 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
08:56 -!- nuttersppadic [~IceChat77@193.130.68.17] has quit [Quit: Depression is merely anger without enthusiasm]
08:59 -!- master_of_master [~master_of@p57B54ED0.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:00 -!- reiffert_ [~thomas@mail.reifferscheid.org] has joined #openvpn
09:00 -!- freaky[t]_ [alpha@freakyonline.de] has joined #openvpn
09:00 -!- freaky[t] [alpha@freakyonline.de] has quit [Ping timeout: 240 seconds]
09:00 -!- mick_lap1op [~mick@mickweiss.com] has joined #openvpn
09:00 -!- cherwin_ [1776628@xs8.xs4all.nl] has joined #openvpn
09:01 -!- inimino [~inimino@boshi.inimino.org] has quit [Ping timeout: 240 seconds]
09:01 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 252 seconds]
09:01 -!- cherwin [1776628@xs8.xs4all.nl] has quit [Ping timeout: 252 seconds]
09:01 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 252 seconds]
09:01 -!- mick_laptop [~mick@clamwin/admin/mickhome] has quit [Remote host closed the connection]
09:01 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
09:02 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
09:03 -!- incidenc1 [jussi@antimaterial.fi] has joined #openvpn
09:03 -!- incidence [jussi@unaffiliated/incidence] has quit [Ping timeout: 240 seconds]
09:03 -!- master_of_master [~master_of@p57B52A7F.dip.t-dialin.net] has joined #openvpn
09:04 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 252 seconds]
09:06 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
09:08 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
09:10 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
09:12 < Onepamopa> guys, what's the difference for comp-lzo enabled / disabled ?
09:12 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
09:16 -!- asio_ [~asio@195.20.207.173] has joined #openvpn
09:17 < ecrist> in one, lzo compression is on, in the other, it's not
09:18 -!- asio [~asio@195.20.207.173] has quit [Ping timeout: 240 seconds]
09:18 < defswork> :o
09:19 -!- Macphist` [~user@c-98-218-81-248.hsd1.va.comcast.net] has joined #openvpn
09:20 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has quit [Ping timeout: 252 seconds]
09:25 -!- sawzall [~Bonnevill@70.103.142.130] has joined #openvpn
09:28 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
09:28 -!- hpa_ [hpa@terminus.zytor.com] has joined #openvpn
09:30 < Onepamopa> ecrist that much I figured by myself
09:30 < Onepamopa> I mean what's the difference
09:30 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
09:30 < Onepamopa> right now we have it enabled @ both client and server
09:30 < Onepamopa> and the customer complains that the ping raised a LOT
09:30 < Onepamopa> so, Im looking for some solution to help solve it a bit
09:32 < ecrist> I told you the difference
09:32 < ecrist> it eithe enables or disables compression
09:32 < ecrist> if you have a slow processor, compression is expensive
09:33 < Onepamopa> the processor is 3ghz xeon
09:33 < Onepamopa> I dont think its slow ;)
09:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
09:33 < ecrist> on both ends?
09:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Quit: No Ping reply in 180 seconds.]
09:33 <@vpnHelper> RSS Update - forum: [SOLVED] Personal vs. Commercial CA <http://forums.openvpn.net/topic8713.html#p15048> || [SOLVED] OS X Lion: CommonCrypto and OpenVPN <http://forums.openvpn.net/topic8663.html#p15041>
09:34 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
09:34 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
09:34 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:34 < Onepamopa> ecrist @ client's end its even faster
09:34 < Onepamopa> 2 physical xeons 8 cores in total
09:34 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
09:34 < ecrist> openvpn is single-threaded
09:34 < ecrist> multiple cores aren't going to matter
09:34 < Onepamopa> there's only 1 client
09:35 < ecrist> I'd suggest disabling compression if it's causing problems
09:35 < Onepamopa> we dont know if its causing the problems or not (at least not yet)
09:36 -!- Netsplit *.net <-> *.split quits: sawzall, fahadsadah_
09:36 -!- Netsplit *.net <-> *.split quits: EugeneKay, gardar, troyt_, EvilGuru, d12fk, hpa, amir, fbh, trapni, DexTerDDIT,  (+18 more, use /NETSPLIT to show all of them)
09:36 -!- Olipro_ is now known as Olipro
09:36 -!- Netsplit over, joins: kenyon
09:36 -!- sno [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
09:36 -!- Netsplit over, joins: Perun
09:37 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
09:39 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
09:40 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
09:41 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
09:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 250 seconds]
09:43 -!- troyt [~troyt@cl-166.phx-01.us.sixxs.net] has joined #openvpn
09:43 -!- Hamlin [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has joined #openvpn
09:44 -!- sno is now known as 92AAD5TJP
09:44 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
09:44 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
09:44 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
09:44 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
09:44 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has joined #openvpn
09:44 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
09:44 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:44 -!- n2deep_ [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
09:44 -!- krphop [~krphop@74.82.160.100] has joined #openvpn
09:44 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has joined #openvpn
09:44 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:44 -!- trapni [~trapni@gentoo/developer/trapni] has joined #openvpn
09:44 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
09:44 -!- Champi [Champi@rootshell.fr] has joined #openvpn
09:44 -!- gardar [~gardar@gardar.net] has joined #openvpn
09:44 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
09:44 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
09:44 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
09:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:45 -!- nb [~nb@fedora/nb] has joined #openvpn
10:09 -!- sunta [~cornholio@hector.raytion.com] has left #openvpn ["Verlassend"]
10:12 -!- cherwin_ [1776628@xs8.xs4all.nl] has quit [Quit: leaving]
10:12 -!- cherwin [1776628@xs8.xs4all.nl] has joined #openvpn
10:19 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
10:19 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 276 seconds]
10:19 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
10:23 -!- Cain [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
10:25 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 252 seconds]
10:30 -!- Remowylliams [~mare@74.221.11.107] has joined #openvpn
10:32 < Remowylliams> Hello I found an odd problem using 2.2.1 on a freebsd server and a Win7 client. The first most noticeable thing is transfers are considerably slower than if I use 2.1.4 client. It doesn't matter if its' tcp or udp and this is using a tun device
10:36 < Remowylliams> the second problem I found is that if I use the 2.2.1 client or the 2.2. client I get similar results. I use secondlife through openvpn and when I first arrive in a sim. things work fine but at some point I stop recieving packets but I send packets. and ultimately the secondlife client disconnects.
10:36 < ecrist> not sure, we use openvpn on freebsd with mac, linux, freebsd, and windows (XP & 7) clients without issue
10:37 < Remowylliams> I don't think it's the freebsd thats a problem
10:37 < Remowylliams> since i'm using the same server, same configuration same everything just changing the windows client from 2.1.4 to 2.2.1
10:37 < ecrist> do you have any empirical evidence?
10:38 < Remowylliams> ecrist: other than I try it one way and it fails and I try it the other and it works very well? no
10:40 -!- Onepamopa [~onepamopa@62.204.152.143] has joined #openvpn
10:40 -!- Onepamopa [~onepamopa@62.204.152.143] has quit [Changing host]
10:40 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
10:40 < Remowylliams> ecrist: I am believing it may be the protocol that's being used is somehow hosing up the openvpn client. when it locks up using secondlife I can still talk to people I can use email and web just fine
10:40 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
10:41 -!- Ragnar [~heimdall@darkstar.acool.net] has quit [Ping timeout: 240 seconds]
10:41 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
10:41 < Remowylliams> I noticed this same behavior back in May when I tried 2.2
10:42 < ecrist> we need some way to reproduce, or you need to troubleshoot and tell us specifically what's wrong
10:42 < ecrist> !trac
10:42 <@vpnHelper> "trac" is (#1) see http://community.openvpn.net for development information and bug tracker., or (#2) if you have a forum login, use that for trac, its the same database
10:42 < Remowylliams> now using 2.2 server and 2.1.4 client data transfer is about 10kb lower than it is with 2.2.1 and 2.1.4 client
10:48 < Remowylliams> ecrist: seems like really duplicating the problem is going to be tricky since you don't have my configuration. network wise. If you find no data transfer speed difference between 2.1.4 and 2.2.1 client on a win7 machine than it's totally my problem. I'll poke around in the documentation and see if I can find better debugging info
10:49 < ecrist> thanks.
10:50 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
10:53 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
11:05 <@vpnHelper> RSS Update - forum: Persistent TUN driver lcoation <http://forums.openvpn.net/topic8712.html#p15049>
11:09 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
11:11 -!- hpa_ is now known as hpa
11:15 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
11:22 -!- EvOr [~EvOr@midgard.adyxax.org] has quit []
11:26 < cron2> that description sounds like "the other bug" with small-sized packets getting lost
11:27 -!- steph33560 [~steph3356@cbl33-1-82-228-229-144.fbx.proxad.net] has joined #openvpn
11:28 < steph33560> Hi :)
11:28 < steph33560> Need some help about DNS
11:28 < steph33560> connection OK but dns resolve fail :'(
11:29 < steph33560> Server's config didn't move since 2008, I thought my client's conf was OK but I can't find what's wrong !
11:35 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
11:39 -!- steph33560 [~steph3356@cbl33-1-82-228-229-144.fbx.proxad.net] has quit [Quit: damned firestarter issue :#]
11:41 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
11:41 -!- Remowylliams [~mare@74.221.11.107] has left #openvpn []
11:54 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
11:55 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
11:57 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
12:14 -!- radioxid [~radioxid@bat44-1-78-233-236-126.fbx.proxad.net] has joined #openvpn
12:24 < EugeneKay> See /topic
12:24 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
12:30 < datruth> How can I test the security for OpenVPN
12:30 < ecrist> set it up, and test it
12:30 -!- KindOne [~lol@unaffiliated/kindone] has joined #openvpn
12:30 <+s7r> datruth: the russians tested it
12:30 <+s7r> it's safe :))
12:31 <+s7r> i have some friends who heavily use openvpn .. if it would not be safe I think they would be in some kind of trouble at this moment
12:31 <+s7r> but they are not
12:31 <+s7r> if you reffering to encryption security
12:31 <+s7r> the other depend on how you administrate the openvpn server. 
12:31 <+s7r> a server is as good as its administrator is
12:32 <+s7r> if you have an openvpn server with ssh enabled and root passwd 1234 then you are on the right way :)
12:32 < krzie> i plan on testing it by having a business offer a $1000 reward for proving you can either own the openvpn process remotely or break the encryption without access
12:33 <+s7r> sounds interesting
12:33 <+s7r> i am interested in something similar
12:33 <+s7r> ad $500 from me to that
12:33 <+s7r> $1500 until now if someone breaks encryption
12:33 <+s7r> *BUT* tests must be made on a vpn configured by one of us.. or at least someone who knows little bit
12:34 < krzie> right
12:34 < krzie> the rules will be specific
12:34 < krzie> exact configs
12:34 < krzie> openssl versions
12:35 <+s7r> I am putting this on my twitter and site. i have many people directed by me to openvpn. i want to get as many people involved as possible so we can earn a big prize like $10k or over.. so real crackers will get involved
12:35 <+s7r> not all kids..
12:35 <+s7r> the tests to be submitted to specific industry websites
12:36 <+s7r> tests results i mean
12:36 -!- radioxid [~radioxid@bat44-1-78-233-236-126.fbx.proxad.net] has quit [Quit: bouhouhou]
12:38 <+s7r> krzie: are you putting $1000 on PPTP also ? =))
12:38 < datruth> s7r: I need to get a threat assestment for openvpn
12:39 <+s7r> datruth: what threats .. please explain.
12:39 <+s7r> client authentication ? connection encryption ? system process ?
12:39 < datruth> any and all kinds
12:40 < datruth> system process I'm not going to worry about because there is only 1 person with access to the box
12:40 < krzie> lol
12:40 < krzie> i think not s7r 
12:40 < krzie> ;]
12:40 <+s7r> a properly configured openvpn client-server connection, with safe certificates and everything *ASSUMING EVERYONE KNOWS WHAT HE IS DOING* it's not possible to break encryption
12:40 <+s7r> at least there is not an attack which we know to exist
12:40 < Essobi> ...
12:40 < Essobi> There isn't..
12:41 < Essobi> Have you not met the core devs?
12:41 <+s7r> if there was one, I am sure someone would notice it
12:41 < Essobi> lol
12:41 < krzie> Essobi, ?
12:41 < cron2> essobi: even bribing the core devs isn't really going to work, as all the git commits are publically viewable...
12:41 < cron2> (which is a pity, I like to be bribed :) *duck*)
12:41 < Essobi> I meant, there ISNT any vulns. :)
12:42 < Essobi> I'd say likely, if there were any crypto vulns it'd have to be in the libc or openssl dependancies.
12:42 <+s7r> no let's not get too far. there is nothing really safe when it comes to computers.. and we can go with this topic as far as hardware backdoors.. but this is openvpn channel and we will stick to subject and we won't say it's impossible to crack.. we just hereby confirm there is no good attack that we know about
12:43 < Essobi> crypto/overflow, even.
12:43 < Essobi> s7r: nothing is 100% safe.  If I can touch it, I can own it.
12:43 <+s7r> exactly
12:43 <+s7r> that is what i ment also
12:44 < Essobi> Now there are FIPS classifications that if I touch it.. someone SHOULD notice it, or the cryptoengine itself will self-destruct.
12:44 <+s7r> i don't say openvpn is bulletproof to any attacks. i am saying that there are not any attacks yet
12:44 < Essobi> I concur.
12:45 < Essobi> You can't stop threats, 100%, you can only mitigate them.
12:45 < Essobi> Security is an illusion.
12:45 <+s7r> datruth: if you know how to mange your certs .. you can either use the default cipher which is Blowfish with 128bit key or AES128 CBC with  the same keysize. but I recommend sticking to blowfish... more than you need at this time
12:46 <+s7r> Essobi: i wouldn't say it's really an illusion. it has a seed of truth. if it weren't for openvpn i know some guys who would not be staying at their homes drinking beer at this moment
12:47 <+s7r> so.. i am not saying it's an illusion but i don't go so far saying there is really 100% security because its not
12:47 < Essobi> s7r: again, just mitigation. :)
12:48 < Essobi> Hmm.. Shame there's so many good cyptos that are ignored in federal regulations.
12:48 <+s7r> krzie: $300 more from a client :) $1800 til now. think we should deposit them in one place?
12:48 <+s7r> maybe we earn some interest ;))
12:49 <@dazo> there is nothing which is secure forever.  Encryption only serves the purpose of protecting sensitive data for "some time" ... and hopefully "some time" later the data isn't sensitive or relevant any more
12:49 <+s7r> exactly
12:49 <+s7r> it's not a matter if it can be cracked .. it's just a matter of when
12:49 <+s7r> if someone cracks my encryption 50 years form now i don't give a shit honestly
12:50 -!- luneff [~yury@84.51.199.63] has joined #openvpn
12:50 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:50 < Essobi> s7r: If I'm sitting on your box, poaching your keys out of /dev/kmem... :)
12:51 <+s7r> you wouldn't be able to because i dont have no /dev/kmem
12:51 <+s7r> i am on windows  :)) hope dazo doesn't see this
12:51 <+s7r> :D
12:51 < Essobi> ROFL
12:51 <@dazo> s7r: nah, I don't care that you like to play with easily explosive fires ... it's you who get burnt, not me ;-)
12:51  * Essobi escalates his priviledges and reads s7r's window's memory.
12:52 <@dazo> hehehe
12:52 < Essobi> Hmm. I wonder what ring app memory is in..
12:52 <+s7r> it was a joke dazo i know you do not but i know your policy of better do it the hard way and i repsect it really
12:52  * Essobi googles his yahoo.
12:52 <@dazo> as I said ... playing with fire ;-)
12:53 <+s7r> but at least i share half of your policy :p when it comes to security i only play with open source
12:53 <+s7r> which have been analyzed and verified and again and again
12:53 <+s7r> like truecrypt openvpn ,etc.
12:53 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p15050>
12:53 <@dazo> well, security is chain dependent ... it's not stronger than the weakest link .... and with software, there is always OS libraries and OS kernel involved
12:55 <+s7r> according to their technical documentation encrypts from the first sector to the last, including the master boot record and hidden volume required for startup. meaning someone who puts hands on your hard drive can not even see what operating system you had or if you had one at all
12:55 <+s7r> check them it's amazing been using it for years
12:56 <@dazo> well, the attack vector is now users who does stupid things ... once you get a backdoor on a running system, it doesn't matter how well your HD is encrypted
12:56 <@dazo> it doesn't even matter how well your VPN is encrypted
12:56 <@dazo> http://www.f-secure.com/weblog/archives/00002226.html
12:56 <@vpnHelper> Title: How we found the file that was used to Hack RSA - F-Secure Weblog : News from the Lab (at www.f-secure.com)
12:57 <+s7r> yesss you are totally right
12:57 <+s7r> i was refering to the context where users know what they are doing
12:57 <+s7r> drop a quick read here http://www.webcitation.org/query?url=g1.globo.com/English/noticia/2010/06/not-even-fbi-can-de-crypt-files-daniel-dantas.html
12:57 <@vpnHelper> Title: WebCite query result (at www.webcitation.org)
12:57 <+s7r> just few lines
12:57 <@dazo> s7r: I know how sloppy I can be, and I have high expectations of myself ... believing that others are just as careful as I ... nah, that's not going to fly ;-)
12:57 <+s7r> wow your RSA link is pinteresting
12:58 <+s7r> well .. i don't also buy all bullshit in press
12:58 <+s7r> but i can hereby confirm italian police is not able to break it :))
12:58 <@dazo> and F-Secure has some good questions ... "Why does MS Excel support embedded Flash object?" ... and why does it automatically run when opening an Excel document  -->> FAIL!
13:00 <+s7r> speaking of flash. i am scared of it. there were some articles saying very very bad things about the good old flashplayer we use to watch youtube and many other sites
13:01 <@dazo> get a decent browser with proper HTML5 ... and youtube can use that directly, instead of going via flash
13:01 <+s7r> such as ? (a win32 binary) ?
13:01 <+s7r> i am sick of firefox
13:01 <+s7r> and i won't use ms internet explorer even if you pay me
13:02 <@dazo> IE isn't a decent browser.  EOD! :-P
13:03 < Essobi> lol
13:03 <@dazo> well, I think both Opera and Chrome supports HTML5 (as well the later Firefox version which you don't want) ... not sure about Chromium (F/OSS version of Chrome)
13:04 <+s7r> what browser do yo uuse
13:04 <@dazo> I'm using FF
13:04 <+s7r> i recall you used SE or Rhel based
13:04 <+s7r> me too at this moment... what if there is a backdoor in it ? :))
13:04 <+s7r> is it open source?
13:04 < Essobi> dazo: That excel bug been used repeatedly for spearfishing attacks..
13:05 <@dazo> Essobi: which makes the whole story even better .... how lovely to trust MS taking security seriously! :P
13:05 <+s7r> Essobi: that is only in one version of ms office.
13:05  * dazo is in a "lets kick MS" mood this evening
13:05 <+s7r> i assume MS fixed it not sure
13:05 < Essobi> It's not hard to figure out what software people are using.
13:06 <+s7r> Essobi: why
13:06 <+s7r> can u read minds? :))
13:06 <@dazo> On Windows, just looking at the User-Agent string on a web server tells you almost everything, including the colour of your pants
13:07 <@dazo> (UA strings from Windows clients are seriously long beasts)
13:07  * s7r started downloding centos
13:07 <@dazo> s7r: go for ScientificLinux instead ... nowadays, much more reliable in regards to security updates
13:08 <+s7r> are commands the same ? i know the base of centos 
13:08 <+s7r> yum / services file architecture bla b la
13:08 <@dazo> RHEL/CentOS/ScientificLinux are basically "identical" (except of the proper RHEL certifications)
13:08 <@dazo> it's all built on the same source RPMs
13:08 <+s7r> so i will manage SE linux also it won't be much of a change 
13:08 <+s7r> like between rhel and freebsd for example
13:08 < Essobi> s7r: Never seen foca or maltego?
13:09 < Essobi> foca's pretty good if you're doing recon for pentesting.
13:11 <@dazo> s7r: example from a User-Agent string which IE reports to web servers: 
13:11 <@dazo> Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0; .NET CLR 1.1.4322; .NET CLR 3.0.04506; eMusic DLM/4; OfficeLiveConnector.1.3; OfficeLiveConnector.1.4; OfficeLivePatch.0.0; OfficeLivePatch.1.3; SLCC1; .NET4.0C; .NET4.0E; InfoPath.3; Zune 4.7; MS-RTC LM 8; yie8)
13:13 < Essobi> Skerreh.
13:14 < Essobi> s7r: Foca will look for any documents published regarding a scope, and tell you what software/versions were used to produce them.. Pretty slick.  It's like the *nix 'file' command on steroids.
13:15 -!- raidz [~Administr@openvpn/corp/admin/andrew] has left #openvpn []
13:15 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
13:15 -!- mode/#openvpn [+o raidz] by ChanServ
13:16 <+s7r> dazo: you mean a site I browse can see all that info ?
13:16 <@dazo> s7r: correct
13:17 <+s7r> could you paste what it says when you browse one with SE ?
13:17 <@dazo> if you use IE ... Firefox and other browsers are more restrictuve
13:17 <@dazo> s7r: what do you mean with SE?
13:17 <+s7r> ScientificLinux
13:17 <@dazo> I'm not running that on any desktops, only servers
13:18 <+s7r> ahh okey 
13:18 <+s7r> i thought you use it on your personal /. desktop also
13:19  * Essobi points to his FreeBSD desktop.
13:19 < Essobi> lol... exploit that shiz with flash... I dare you.
13:20 <@dazo> s7r: I'm running Fedora14 on my desktops
13:20 < K1ng`> fedora sucks
13:21 < Essobi> lol
13:22 <+s7r> Essobi: pcbsd?
13:23 <@dazo> K1ng`: Fedora has been the most reliable desktop I've used the last 5 years
13:24 <@dazo> And I've been running Gentoo, Ubuntu, openSuSE and Fedora in these years
13:24 < K1ng`> really?
13:24 <@dazo> yeah
13:24 < K1ng`> well i am a ubuntu fan
13:24 < K1ng`> isnt made in redhat?
13:25 <@dazo> I kicked out Ubuntu after 3 "major releases" ... I started with Gutsty and jumped off at Ibix ... at the something always broke after each update
13:26 <@dazo> K1ng`: Fedora is a community distro, but a lot of the community people also work for Red Hat ... but quite some are hired to work on Fedora only
13:28  * dazo decides to call this a day ... time to get home
13:29 -!- dazo is now known as dazo_afk
13:47 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
13:47 < Essobi> s7r: Nope, just plain ole FreeBSD running gnome.
13:48 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
13:48 <+s7r> Essobi: is any dvd which will install it directly with the desktop ?
13:48 <+s7r> and pcbsd isn't it plain freebsd also but just with desktop by default ?
13:49 < Essobi> s7r: sort of.. i think they have their own binary repository thou..
13:49 < Essobi> I've been running X/X0rg since umm.. 94, so setting it up isn't very skerreh to me anymore.
13:50 <+s7r> for you
13:50 <+s7r> :)
13:51 < Essobi> yessir
13:51 < Essobi> PCbsd will do the default desktop, iirc
13:51 < Essobi> Honestly, mint linux wasn't so bad a few years ago.. idk what kind of state it's in now.
13:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:58 -!- upz [~James@213.79.53.61] has joined #openvpn
14:02 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html>
14:02 < Onepamopa> hm, guys.. here's something interesting: gre vs vpn from client to server
14:02 < Onepamopa> gre has 70 ms, vpn has 250
14:02 < Onepamopa> how's that even possible ?!
14:04 < Essobi> Onepamopa: what kind of GRE?  ipsec/pptp?  What kind of openvpn?
14:04 < Onepamopa> normal gre tunnel, no ipsec
14:05 < Onepamopa> and openvpn - default config, nothing special
14:05 < Onepamopa> so, what do u think ?
14:06 < ecrist> well, gre doesn't encrypt, openvpn does
14:06 < ecrist> slow proc on one end, likely
14:06 < Onepamopa> we disabled openvpn's encryption
14:06 < Onepamopa> that wasnt the problem
14:06 < Onepamopa> both end have very good processors
14:06 < Onepamopa> openvpn process @ both was @ 0.2-0.3% cpu
14:06 < Onepamopa> max
14:06 < Onepamopa> so, no encryption problem, I even disabled lzo
14:07 < Onepamopa> so, anything else that can be causing such results ?
14:08 < Essobi> You might have to ktrace/strace them... sounds like a configuration problem.
14:08 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
14:09 < Essobi> Onepamopa: are one of the endpoints a cisco GRE?
14:09 < hyper_ch> hmmmm, I noticed I have slow speeds from a client
14:09 < hyper_ch> I checked the mtu size
14:09 < hyper_ch> at max I could use soemthing like 1472
14:10 < hyper_ch> so I set in the openvpn client config to use 1400 and fracture at 1400
14:10 < hyper_ch> after restarting openvpn on the client, it didn't work anymore
14:10 < Essobi> Yo dawg... I heard you like TCP.  So I put some TCP into your TCP.
14:11 < Essobi> hyper_ch: /10
14:11 < Essobi> woops.. typoed.
14:11 < Essobi> Was switching to window 10. ;)
14:11 < hyper_ch> ?
14:12 < Essobi> nevermind man.. it was a joke.  no idea about your MTUs..
14:13 < Essobi> 1492 is the default MTU, iirc
14:13 <@vpnHelper> RSS Update - forum: unable to download new certificate off site <http://forums.openvpn.net/topic8715.html>
14:13 < Essobi> Or 1500...
14:14 < hyper_ch> Essobi: well, having a mtu size of 1473 returns errors
14:15 < Essobi> Hmm..
14:16 -!- flx- [~flx-@unaffiliated/flx-] has joined #openvpn
14:16 < Essobi> Were you using mtu-test?
14:16 < flx-> hi people
14:16 < Essobi> whatup flx
14:16 < flx-> hey
14:16 < Onepamopa> Essobi strange, my 2 ends are @ 1500 mtu no problem
14:16 < flx-> im having problems with opvpn under obsd
14:17 < flx-> im trying to connect to an free vpn service 
14:17 < flx-> so i can get ip on my tun0 interface
14:17 < Essobi> Yea?
14:17 < flx-> but i just lost connectivity and no route to anywhere
14:18 < flx-> yea
14:18 < flx-> im using freeopenvpn.com
14:19 < flx-> what i need is to get connected to an US vpn 
14:20 < flx-> so i can route my xbox to download some content not availeble over here
14:20 < hyper_ch> Essobi: yes
14:20 < flx-> im in venezuela
14:20 < ecrist> flx-: we don't support third party services
14:20 < ecrist> you'll need to contact them.
14:20 < flx-> ecrist: it is based on openvpn
14:20 < ecrist> I don't care.
14:20 < hyper_ch> !mtu
14:20 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
14:21 -!- raidz is now known as swg0101
14:21 < hyper_ch> !mtu-test
14:21 <@vpnHelper> "mtu-test" is you can just use --mtu-test on the client to see what the best mtu for your connection is
14:21 < ecrist> we only support people who control both ends.
14:21 < flx-> ecrist: forget about it
14:21 -!- swg0101 is now known as raidz
14:24 < hyper_ch> ecrist: can you help me about my speed problem?
14:25 < ecrist> no, I'm working at the moment.
14:25 < hyper_ch> whenever I run teh --mtu-test again it kills the connection to the server
14:29 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
14:30 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 240 seconds]
14:30 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
14:30 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
14:30 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
14:34 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
14:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:41 -!- Macphist` is now known as Macphisto
14:44 -!- krphop [~krphop@74.82.160.100] has quit [Ping timeout: 264 seconds]
14:45 -!- krphop [~krphop@74.82.160.100] has joined #openvpn
14:56 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:59 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:02 < krzee> s7r, i said i *will* be doing that... first the business needs to make $
15:02 < hyper_ch> hi krzee
15:09 < krzee> hey hyper_ch 
15:09 < krzee> como estas
15:12 < krzee> where were we in that problem you were having?  i fell asleep
15:13 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 245 seconds]
15:14 -!- hyper_ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has joined #openvpn
15:23 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
15:24 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:24 < grendal-prime> ok crazy werid issue.. I got a client (windows) connecting via a tun connection to the openvpn server topnology subnet, and im pushing it a ip of 192.168.108.217
15:27 < grendal-prime> WARNING: Since you are using --dev tun, the second argument to --ifconfig must be an IP address.  You are using something (255.255.255.0) that looks more like a netmask. (silence this warning with --ifconfig-nowarn) 
15:30 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
15:30 < grendal-prime> now the werid part is...the server says the client is connected..but the client says connection failed
15:30 < krzee> sounds like a client isnt supporting topology subnet
15:31 < grendal-prime> additonally 
15:31 < krzee> pre-2.1?
15:31 < grendal-prime> There is a problem in your selection of --ifconfig endpoints [local=192.168.108.217, remote=255.255.255.0].  The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver.  Try 'openvpn --show-valid-subnets' option for more info. 
15:31 < grendal-prime> hmm ill look at that and see
15:32 < grendal-prime> ya...he grabed the wrong client silly customer
15:32 < grendal-prime> 2.0
15:33 < krzie> glad to help =]
15:33 < krzie> there was another clue in the logs too, somewhere it says invalid option: topology
15:34 < grendal-prime> he just did this on another machine so i figured he was using the same file
15:35 < grendal-prime> ya i saw that two my first thought was since they are connecting through a diff nic on the server it had something  to do with the topology and two diff interfaces
15:35 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
15:36 < grendal-prime> but we will see
15:36 < krzie> no will see, that was certainly the problem :)
15:37 < grendal-prime> we were haveing a problem with a dc and wsus  it was seeing all the machines on the other side of the openvpn as the gateway...quick solution, put the dc on the vpn network
15:37 -!- hyper_ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has quit [Ping timeout: 240 seconds]
15:37 < grendal-prime> thought about doing the wins thing..but..
15:37 < grendal-prime> havent done that before..so..not sure how it will work.
15:38 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:39 < hyper_ch> hi krzie
15:42 < krzee> hihi
15:46 < hyper_ch> it's your fault
15:46 < krzee> !blame
15:46 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault, or (#2) According to krzee, it's always dazo's fault, or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
15:47 < hyper_ch> :)
15:47 < hyper_ch> krzee: addjusting the mtu size made the cleint inaccessible
15:47 < hyper_ch> I also did set fragmentation.... that seems to have cause the proplem
15:48 < hyper_ch> after removing the fragmentation from client.conf and just setting mtu size to 1400 gives now marvellous speed :)
15:48 < krzee> ahh nice
15:48 < krzee> you've officially dont more with mtu than i
15:48 < krzee> done*
15:48 < hyper_ch> but I've seen in several posts online that mtu and fragmentation is being set
15:49 < krzee> did you test around for optimal or just try 1400 and was happy?
15:49 < hyper_ch> I did test with that ping thing link
15:49 < hyper_ch> and the max was 1472
15:49 < krzee> ahh cool
15:49 < hyper_ch> so should I set it to that?
15:49 < krzee> honestly, im not sure
15:49 < hyper_ch> but but but... you're the openvpn guru
15:50 < krzee> in fact if you learn a bunch during your testing, pls feel free to add to that page
15:50 < krzee> hahah theres certain things ive never had a chance to play with
15:50 < krzee> never had mtu issues, so couldnt fix them
15:50 < krzee> fixing them would lead to understanding it better
15:50 < krzee> last night i ran into another one of those issues that ive seen people have but now actually have myself
15:50 < hyper_ch> :)
15:51 < krzee> which sucks but is cool
15:51 < krzee> sucks to have the issue, cool that hopefully ill learn the issue and be able to help others when they have it
15:51 < krzee> since i seen it a few times but never seen it solved
15:51 < hyper_ch> krzee: did you see the pastebin link?
15:51 < krzee> not sure
15:51 < krzee> i was pretty wiped out when we were talking
15:52 < hyper_ch> http://pastebin.com/uyQBXqEY
15:53 < krzee> ahh yes saw that
15:53 < hyper_ch> actually, results still aren't better
15:54 < hyper_ch> but when downloading to my home client from the server I do get better speeds
15:54 < Onepamopa> how about uploading ?
15:54 < Onepamopa> I've got some strange thing with my vpn server / client.. and wondering what can I change to fix it
15:55 < hyper_ch> Onepamopa: server --> client was never the issue
15:55 < Onepamopa> normal ping between the 2 machines is 70 ms, vpn ping is 250
15:55 < hyper_ch> only client --> server
15:55 < Onepamopa> what do u think I should do?
15:55 < Onepamopa> (in my case of course)
15:57 < hyper_ch> Onepamopa: check out your mtu limi
15:57 < hyper_ch> krzee: I'll play more with it tomorrow
15:57 < Onepamopa> with ?
15:57 < krzee> !mtu
15:57 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config, or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
15:58 < Onepamopa> does client has to be connected ?
15:59 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:59 < hyper_ch> Onepamopa: for checking mtu size yes, you need to be connected
16:00 < hyper_ch> just do from the client to the server:   ping -c 1 -s 1500 -M do 10.8.0.1
16:00 < hyper_ch> and then either lower or set higher mtu size until you see what is your max
16:01 < Onepamopa> hyper_ch small problem - Im assigning real ip's /29 mask
16:01 < Onepamopa> to vpn & vpn clients
16:01 < Onepamopa> the /29 network is added as alias @ bge0
16:02 < krzee> shouldnt matter as far as mtu tuning is concerned
16:02 < hyper_ch> I don't understand geek
16:02 < hyper_ch> :)
16:02 < grendal-prime> ya that was it krzee
16:02 < Onepamopa> geek? lol ;)
16:02 < grendal-prime> now we got some other issue
16:04 -!- reiffert_ [~thomas@mail.reifferscheid.org] has quit [Read error: Operation timed out]
16:04 -!- Perun [perun@chao5.net] has quit [Read error: Operation timed out]
16:04 -!- Perun [perun@chao5.net] has joined #openvpn
16:04 < krzee> grendal-prime, keep going...
16:04 < hyper_ch> after a hard day's work, I think I deserve some sleep now
16:05 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
16:05 < hyper_ch> especially since I hardly slept yesterday because it was so damn bloody hot and humid
16:05 < hyper_ch> temperature has fallen to... 15° now or something :)
16:06 -!- MrWGW [MrWGW@74.124.192.8] has quit [Ping timeout: 250 seconds]
16:06 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
16:07 < grendal-prime> oh sorry i dont know...hmm well im sure you ahve run accrose this...ok so figer one this config....one vpn say 192.168.108.0 thats what its dishing our for a subnet..then internal network 192.168.105..0 is the internal network 
16:07 < grendal-prime> and the vpn box is connected to the internal network via 192.168.105.254 ip address..
16:08 < grendal-prime> windows boxes are connecting to the 108 network and they are able to see everything fine on the 105 network that the need to see got that all working 
16:08 < grendal-prime> now..tricky part.  domain Controller that has wsus running on it.
16:08 < grendal-prime> it sees all the windows clients from 254.  
16:09 < krzee> whyd you use the NAT hack instead of routing for sharing the lan?
16:09 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Quit: Leaving]
16:09 < grendal-prime> not sure what you meant.
16:10 < grendal-prime> mean.
16:10 < krzee> ok you're sharing the lan behind the server, right?
16:10 < grendal-prime> im pushing route to the 108's to get to the 105 thorurgh the vpn server.
16:10 < krzee> and are you also NATing the traffic from the clients?
16:11 < grendal-prime> ya that seems weird
16:11 < krzee> you using redirect-gateway too?
16:12 < grendal-prime> no
16:12 < grendal-prime> so on the vpn server...
16:12 < grendal-prime> route 192.168.105.0 255.255.255.0
16:12 < grendal-prime> route 192.168.108.0 255.255.255.0
16:12 < grendal-prime> push "route 192.168.105.0 255.255.255.0"
16:12 < grendal-prime> that allows them to the 105 network
16:12 < krzee> iptables -t nat -L
16:13 < grendal-prime> ?
16:13 < krzee> run that
16:13 < grendal-prime> you want the results of that?
16:13 < EugeneKay> !paste
16:13 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
16:13 < krzee> ya what he said ^
16:17 < grendal-prime> that page doesnt work in chrom
16:17 < grendal-prime> hmm
16:20 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has joined #openvpn
16:21 < cocoa117> with ubuntu 10.10 as openvpn client, i found i can make openvpn connection, but there isn't any network adapter show up using ifconfig
16:21 < grendal-prime> http://pastebin.com/ZDUdzM9y
16:21 < grendal-prime> krzee, that just looks all about wrong
16:21 < cocoa117> is there way to do that? many online tutorial didn't mention anything
16:21 < cocoa117> i am using tap not tun
16:22 < grendal-prime> I thin the reason its like that is because...they didnt want to put static routes in all the machines on the internal network..if that makes any sence
16:22 < cocoa117> do i need to create bridge for this on the client with tap0?
16:23 < grendal-prime> the nat on the external interface i would assume has to be there 
16:24 < grendal-prime> so that everything inside can get out through the device.. Everything on the 105 network uses the 105.254 as a gateway.
16:25 < grendal-prime> krzee, mind if we like googleapp flowchart it..so it makes more sence?
16:29 -!- Onepamopa1 [~onepamopa@62.204.152.143] has joined #openvpn
16:32 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 250 seconds]
16:34 -!- Onepamopa1 [~onepamopa@62.204.152.143] has quit []
16:34 < grendal-prime> ya so...basically when the windows client reports into the wsus server the wsus server always sees the client as 105.254.
16:35 -!- Onepamopa [~onepamopa@62.204.152.143] has joined #openvpn
16:36 -!- Mysterio [MysterioN@78.84-49-125.nextgentel.com] has joined #openvpn
16:36 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has quit [Ping timeout: 258 seconds]
16:39 < krzee> grendal-prime, good idea
16:39 < grendal-prime> ?
16:40 < krzee> flowchart
16:40 < krzee> however:
16:40 < krzee> [14:22]  <grendal-prime> I thin the reason its like that is because...they didnt want to put static routes in all the machines on the internal network..if that makes any sence
16:40 < krzee> it does not
16:40 -!- MysteriooN [~MysterioN@7.84-49-206.nextgentel.com] has quit [Ping timeout: 240 seconds]
16:40 < krzee> you add the route on their default gateway
16:40 < krzee> !route_outside_ovpn
16:40 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
16:40 < krzee> the workaround when you cant add a route to that is to add it on the machines, workaround when you cant do either is the nat-hack
16:40 < krzee> !nathack
16:40 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
16:43 < grendal-prime> ya but see i dont see how the wsus server is going to see those boxes as anything but the 105.154 machine
16:43 < grendal-prime> sorry 254
16:44 < grendal-prime> but if you say so ill strip out the nat stuff and try this..
16:45 < krzee> vpn clients will be seen by their VPN ip unless they NAT
16:45 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15053>
16:48 < grendal-prime> ok so i strip out the nat..just add a route for the 105 network..to the vpn host..so on the box i add a route to the 108 via the 105.254 ip?
16:48 < krzee> its a server's lan, right?
16:49 < Onepamopa> krzee
16:49 < grendal-prime> box is a linux box..has vpn listening on eth0 external to internet..internal nic is eth1  that nic has 192.168.105.254 address
16:49 < Onepamopa> Options error: --mtu-test only makes sense with --proto udp
16:49 < Onepamopa> Use --help for more information.
16:49 < Onepamopa> ? :)
16:49 < Onepamopa> Im using proto tcp..
16:49 < krzee> !tcp
16:49 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer), or (#3) if you must use tcp, you likely want --tcp-nodelay
16:49 < Onepamopa> well, I cannot avoid it 
16:50 < |Mike|> krzee: need a cold beer?
16:50 < krzee> grendal-prime, is the lan behind the server?
16:50 < krzee> |Mike|, thats the plan for the entire day tomorrow
16:50 < |Mike|> entire day, *G*
16:50 < grendal-prime> the lan..is connected to eth1
16:50 < Onepamopa> krzee btw where\s tcp-nodelay described ?
16:50 < krzee> @msn
16:50 < krzee> !man
16:50 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
16:50 < Onepamopa> & has to be enabled @ client & server or just @ client
16:51 < krzee> not 100% sure, i dont use tcp (i can avoid it)
16:52 < Onepamopa> well I cant
16:52 < Onepamopa> all udp is filtered where vpn server is located
16:52 < krzee> then read about it in the manual
16:53 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
16:53 < |Mike|> udp filtered on everything? wtf?
16:54 < Onepamopa> yep
16:55 < grendal-prime> ok removed the nat on the internal interface
16:55 < grendal-prime> now need to add route for it to point to...what?
16:56 < krzee> !route_outside_ovpn
16:56 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
16:56 < krzee> read the long explanation in !route
16:56 < krzee> !route
16:56 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
16:56 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
17:01 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Remote host closed the connection]
17:02 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
17:03 < grendal-prime> ok read it..what i dont understand is..do i need to add that in openvpn or on the host itself.  Thats where i have been confused all along it seems to me i should add a rout to the host that says....traffic bound for 192.168.108.0 goes though 198.168.105.254 but even with the explaination on that page..how do the machines on the 192.168.105.0 network get that information?
17:04 < grendal-prime> I mean a static route on the machine makes sence...but like i say they dont want to do that im sure.
17:04 < krzee> hows that make more sense??
17:04 < krzee> they have a common default gateway
17:04 < krzee> the lan's gateway
17:05 < krzee> give that a route, done
17:06 < krzee> it just needs to know that the vpn server's lan ip is the gateway for the vpn subnet
17:06 < krzee> then it'll happily forward packets back, like in the diagram
17:07 < krzee> the lan machines already send * unknown subnets to their default gateway, which they all have in common
17:07 < krzee> so you add the route to that router and call it a day
17:12 < grendal-prime> ok.
17:13 < grendal-prime> that makes sence.
17:14 < grendal-prime> so on that actual host then i just route add 192.168.108.0 255.255.255.0 
17:14 < grendal-prime> for the eth1 interface
17:17 < grendal-prime> so route destination would be 192.168.108.0   
17:17 < grendal-prime> netmask would be 255.255.255.0
17:18 < grendal-prime> route interface would be eth1 (internal interface) gateway would be the ip on that interface that is connected to the network i want routed out..in this case 192.168.105.254
17:18 < grendal-prime> am i tnining of this correctly?
17:21 < grendal-prime> that seems to be working...why did i think that was going to be so hard?
17:35 -!- Onepamopa [~onepamopa@62.204.152.143] has quit []
17:36 -!- Onepamopa [~onepamopa@62.204.152.143] has joined #openvpn
17:36 -!- Onepamopa [~onepamopa@62.204.152.143] has quit [Changing host]
17:36 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
17:36 -!- drgreco [~drgreco@184-96-194-43.hlrn.qwest.net] has joined #openvpn
17:37 < drgreco> hello everyone
17:37 < |Mike|> ohai
17:38 < drgreco> does openvpn have any methods to ensure that it is always running and connected (or at least trying to connect)
17:38 < drgreco> for linux
17:38 < drgreco> or do i need to look at an outside app to monitor and ensure that its always up
17:39 < |Mike|> nagios++
17:39 < drgreco> so, thats a no
17:39 < EugeneKay> It logs to syslog, you can monitor that using your package of choice.
17:39 < drgreco> EugeneKay: thanks
17:39 < EugeneKay> The default is to retry the connection forever while the service is "on"
17:40 < drgreco> EugeneKay: i am more worried about if the daemon dies on the client side
17:40 < EugeneKay> Linux box?
17:40 < drgreco> yar
17:40 < drgreco> centos
17:40 < EugeneKay> Cron job every five minutes to ps -ef |grep openvpn and restart it if it dies.
17:41 < EugeneKay> Use that bash voodoo ;-)
17:42 < |Mike|> lol
17:42 < |Mike|> EugeneKay: that's dirty :P
17:43 < EugeneKay> Have you looked at init scripts lately? That's all they do.
17:43 < v0x> zsh voodo is even better
17:43 < v0x> i have written a script that changes the desktop wallpaper when openvpn is connected
17:43 < v0x> and sets it back when it is disconnected
17:43 < drgreco> you mean if -e /proc/`cat /var/run/openvpn.pid`
17:43 < drgreco> actually, havent even checked if openvpn writes a pid
17:43 < drgreco> but whatever :)
17:44 < EugeneKay> If you have just one openvpn instance, sure.
17:44 < drgreco> but yea, a million ways to do it
17:44 < drgreco> should only ever be one
17:44 < EugeneKay> Wrong.
17:44 < drgreco> its currently jammed in /etc/inittab
17:44 < drgreco> but that is causing issues with it starting in time
17:44 < EugeneKay> I currently have three openvpn instances running
17:44 < EugeneKay> tun-UDP, tun-TCP, and tap-UDP
17:44 < |Mike|> why not run a kill -9 and a starting one every 2 hours lol
17:45 < EugeneKay> Because killing it while it's running is rude
17:45  * |Mike| is rude in general :$
17:45 < v0x> so what is the issue?
17:45 < EugeneKay> tap-udp is for my site-to-site links(which have up scripts for ipv6), and the other two are for my phone/laptop.
17:45 < drgreco> uptime is like hookers and/or blow, the more the merrier
17:46 < v0x> my personal uptime is the only uptime that counts for me
17:46 < |Mike|> it's like 50 years?
17:46 < v0x> and the uptime of $loved_ones :)
17:46 < EugeneKay> I dunno about you guys, but I reboot for kernel updates
17:47 < v0x> i usually reboot because my raid setup b0rked again
17:47 < v0x> but yes, rebooting, /care
17:54 < drgreco> i'd say ksplice
17:54 < drgreco> but fuck oracle
18:00 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
18:00 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
18:00 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:00 -!- mode/#openvpn [+v Axeman] by ChanServ
18:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
18:07 -!- k4v [~kav@g226090011.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
18:09 < Onepamopa> krzee
18:09 < Onepamopa> SERVER: Socket Buffers: R=[16384->65536] S=[32768->65536]
18:09 < Onepamopa> CLIENT: Socket Buffers: R=[8192->8192] S=[8192->8192]
18:10 < Onepamopa> this should be that way?
18:10 < Onepamopa> (freebsd server, windows client)
18:10 < krzee> socket buffers?!  where do you even see that?
18:10 < Onepamopa> @ the logs
18:10 < krzee> when verbosity?
18:10 < Onepamopa> ye
18:10 < krzee> what verbosity*
18:10 < Onepamopa> 4
18:11 < krzee> heh i must pay small attention
18:11 < krzee> ive never seen problems from that or anything
18:11 < krzee> never even noticed it tbh
18:11 < Onepamopa> havent said that it's a problem, just think it should be identical @ client & server ?
18:12 < Onepamopa> btw..NOTE: setsockopt TCP_NODELAY=1 failed (No kernel support)
18:21 -!- SirHackalot [~SirHackal@dpc693575045.direcpc.com] has joined #openvpn
18:22 < SirHackalot> hi everyone, i was just wondering if someone could explain to me whether or not i could use open vpn to host a game server for my friends and i to play on when no on has the ability to forward ports
18:26 < grendal-prime> ok krzee thanks man.. sorry for being so lame on that.. I just was having a hard time with the fact that...i can just bounce the traffic right to the vpn from the host like that.
18:29 -!- SirHackalot [~SirHackal@dpc693575045.direcpc.com] has quit [Read error: Connection reset by peer]
18:38 -!- SirHackalot [~SirHackal@dpc693575045.direcpc.com] has joined #openvpn
18:43 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
18:50 -!- SirHackalot [~SirHackal@dpc693575045.direcpc.com] has quit [Read error: Connection reset by peer]
18:56 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:56 -!- mode/#openvpn [+v Axeman] by ChanServ
19:05 <@vpnHelper> RSS Update - forum: unable to download new certificate off site <http://forums.openvpn.net/topic8715.html#p15054>
19:05 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 260 seconds]
19:08 < ecrist> boats and hos, bitches
19:09 < jeev> wtf is 4 parity drives? what's it mean, what raid is this
19:10 -!- pr0zoid [pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
19:10 < pr0zoid> is the source for openvpn-gui in the openvpn source?
19:17 -!- mape2k [~mape2k@2a01:198:23f:10ff:38fc:dfff:fe7d:30b6] has joined #openvpn
19:18 < ecrist> pr0zoid: iirc, yes
19:18 < ecrist> it's in git, I think.
19:24 -!- Denial [Denial@drgi.co.uk] has quit []
19:25 -!- upz [~James@213.79.53.61] has quit [Ping timeout: 240 seconds]
19:50 -!- bitterman [~yury@84.51.199.63] has joined #openvpn
19:50 -!- luneff [~yury@84.51.199.63] has quit [Read error: Operation timed out]
19:55 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
19:57 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
20:02 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
20:08 -!- KindTwo [~lol@unaffiliated/kindone] has joined #openvpn
20:08 -!- KindOne [~lol@unaffiliated/kindone] has quit [Ping timeout: 258 seconds]
20:08 -!- KindTwo is now known as KindOne
20:15 -!- mape2k [~mape2k@2a01:198:23f:10ff:38fc:dfff:fe7d:30b6] has quit [Quit: Leaving]
20:19 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
20:41 -!- corretico [~luis@200.12.40.17] has quit [Read error: Connection reset by peer]
20:42 -!- corretico [~luis@200.12.40.17] has joined #openvpn
20:44 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:51 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 260 seconds]
21:15 -!- krzee [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
21:24 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
21:25 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:35 < ecrist> jeev: you're retarded
21:35 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:40 -!- jbb [~yeeb@184.105.219.149] has quit [Quit: No Ping reply in 180 seconds.]
21:40 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
21:45 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
21:58 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
22:00 -!- EugeneKay is now known as EugeneKaway
22:04 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
22:04 -!- mode/#openvpn [+v Axeman] by ChanServ
22:12 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 258 seconds]
22:16 -!- mete [~mete@mete.shell.la] has joined #openvpn
22:23 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:25 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Excess Flood]
22:25 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
22:27 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
22:30 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
22:31 -!- EugeneKaway is now known as EugeneKawaway
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 258 seconds]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:43 -!- jbb [~yeeb@184.105.219.149] has quit [Read error: Connection reset by peer]
22:43 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
22:43 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:48 -!- corretico [~luis@200.12.40.17] has quit [Read error: Connection reset by peer]
22:48 -!- corretico [~luis@200.12.40.17] has joined #openvpn
22:55 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
23:03 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:03 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
23:05 -!- KindOne [~lol@unaffiliated/kindone] has left #openvpn []
23:20 -!- corretico [~luis@200.12.40.17] has quit [Ping timeout: 245 seconds]
23:22 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
23:33 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
23:37 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 245 seconds]
23:42 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
23:54 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 258 seconds]
23:56 -!- mete [~mete@mete.shell.la] has joined #openvpn
--- Day changed Sat Aug 27 2011
00:03 -!- troyt [~troyt@cl-166.phx-01.us.sixxs.net] has quit [Quit: AAAGH!  IT BURNS!]
00:04 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
00:04 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
00:07 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
00:21 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:23 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 246 seconds]
00:45 -!- mape2k [~mape2k@2a01:198:23f:10ff:38fc:dfff:fe7d:30b6] has joined #openvpn
01:08 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 245 seconds]
01:09 -!- hyper_ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has joined #openvpn
01:16 < hyper_ch> hmmm, anyoen here can help me with mtu?
01:22 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
01:23 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
01:30 -!- hyper_ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has quit [Ping timeout: 252 seconds]
01:30 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
01:31 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
01:31 < hyper_ch> hmmm, I really have huge speed problems on the vpn.... especially from one client to the server
01:31 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
01:32 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:36 -!- k4v [~kav@g226095246.adsl.alicedsl.de] has joined #openvpn
01:37 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:40 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
01:41 -!- mick_lap1op [~mick@mickweiss.com] has quit [Changing host]
01:41 -!- mick_lap1op [~mick@clamwin/admin/mickhome] has joined #openvpn
01:41 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
01:43 -!- mick_lap1op is now known as mick_laptop
01:43 <@vpnHelper> RSS Update - forum: Migrate from Linux to Win 2008 R2 Server <http://forums.openvpn.net/topic8716.html>
01:48 < hyper_ch> hmmm, I seem to have quite a different problem
01:59 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
02:00 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
02:01 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
02:05 -!- mape2k [~mape2k@2a01:198:23f:10ff:38fc:dfff:fe7d:30b6] has quit [Ping timeout: 255 seconds]
02:05 < K1ng``> hell yah. i got my new galaxy s2. its awesome :D
02:06 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
02:06 <@vpnHelper> RSS Update - forum: Migrate from Linux to Win 2008 R2 Server <http://forums.openvpn.net/topic8716.html#p15056>
02:12 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p15057>
02:18 < krzee> hyper_ch, whats the problem?
02:18 < hyper_ch> krzee: speeds from server -> client     almost 10MB/s
02:19 < hyper_ch> krzee: speeds from client --> server  hardly over 1 MB/S
02:19 < reiffert> grep shaper *.conf
02:20 < hyper_ch> me?
02:20 < reiffert> y
02:20 < krzee> hyper_ch, you been playing with mtu and testing with iperf between them?
02:20 < hyper_ch> krzee: yes
02:20 < hyper_ch> no luck
02:20 < krzee> tried tcp with tcp_nodelay?
02:21 < krzee> maybe your isp shapes udp
02:21 < krzee> (some do cause of torrents)
02:21 < hyper_ch> no clue what you mean with that?
02:21 < krzee> !tcp
02:21 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer), or (#3) if you must use tcp, you likely want --tcp-nodelay
02:21 < hyper_ch> change openvpn to tcp?
02:21 < krzee> #3
02:21 < krzee> couldnt hurt to try
02:21 < hyper_ch> why would it only be one way?
02:22 < krzee> is the client on symmetric internet?
02:23 < hyper_ch> yes, both have 100mbit connections
02:23 < hyper_ch> and dedicated IP addresses
02:23 < hyper_ch> and the client cpu is an i7... the server is weaker
02:28 < hyper_ch> !tcp-nodelay
02:29 < krzee> --tcp-nodelay
02:29 < krzee> !man
02:29 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
02:30 < hyper_ch> no tcp-nodelay
02:32 < hyper_ch> ah... the 2.1+ has it
02:32 < hyper_ch> do I add it to the config?
02:32 < hyper_ch> do I need it on the clinet
02:32 < hyper_ch> or on the server or both?
02:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:37 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
02:37 -!- mode/#openvpn [+v s7r] by ChanServ
02:37 -!- Mysterio [MysterioN@78.84-49-125.nextgentel.com] has quit [Quit: Leaving]
02:42 <@vpnHelper> RSS Update - forum: Migrate from Linux to Win 2008 R2 Server <http://forums.openvpn.net/topic8716.html#p15058>
03:06 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15059>
03:07 -!- mape2k [~mape2k@141.70.181.197] has joined #openvpn
03:48 <@vpnHelper> RSS Update - forum: Problems pinging new OpenVPN client <http://forums.openvpn.net/topic8709.html#p15060>
04:00 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15061>
04:05 -!- flx- [~flx-@unaffiliated/flx-] has quit [Read error: Operation timed out]
04:07 -!- spiekey [~mario@HSI-KBW-109-193-123-037.hsi7.kabel-badenwuerttemberg.de] has joined #openvpn
04:07 < spiekey> Hello!
04:08 < spiekey> i would like to use the managment interface but i am getting the error: Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: management (2.1.3)
04:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
04:08 < spiekey> using: openvpn --config /etc/openvpn/vpn.conf --syslog --management
04:12 < spiekey> ah, got it
04:13 -!- sathia [~quassel@host52-213-dynamic.30-79-r.retail.telecomitalia.it] has joined #openvpn
04:15 -!- mape2k [~mape2k@141.70.181.197] has quit [Ping timeout: 260 seconds]
04:25 -!- secretuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
04:27 < secretuser> how do openvpn authenticates user with the use of username and password?
04:30 < spiekey> secretuser, there are multiple ways
04:31 < spiekey> pam, ldap, scripts..
04:32 < secretuser> I spiekey, I want to know how does openvpn use it. currently using my client config, I can connect to the server using username and password.  I would like to know how it is done. I would like to apply the same method to the other tunneling method I am using.
04:36 < secretuser> I mean, with openvpn, I think, the first that openvpn do is to establish the connection, and after it is established, it checks if the user is legitimate and existing, if not auth-failed and if ok, initialize the client tap.  So I would like to ask how openvpn checks the existence and legitimacy of users.
04:38 -!- jbb [~yeeb@184.105.219.149] has quit [Quit: No Ping reply in 180 seconds.]
04:39 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
04:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
04:43 < secretuser> anybody help here
04:44 -!- secretuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
04:52 < cron2> well... so impatient...
04:54 -!- ayhan [~ayhan@85.105.15.139] has joined #openvpn
04:54 < ayhan> hello channelş
04:54 < ayhan> hello channel
04:55 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
04:55 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
05:12 -!- k4v [~kav@g226095246.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
05:17 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
05:17 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
05:17 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
05:17 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
05:17 -!- mode/#openvpn [+v Axeman] by ChanServ
05:28 < ayhan> is there anyone?
05:28 < ayhan> is there anyone?
05:28 < ayhan> ...
05:29 -!- ayhan is now known as katsumoto
05:30 < katsumoto> i have a question for openswan and 3grouter onecell35
05:30 < katsumoto> is there anyone?
05:30 < katsumoto> 7J linux
05:31 < Bushmills> katsumoto: how is your question openvpn related?
05:32 < katsumoto> vpn related ..
05:33 < Bushmills> would an openvpn specific reply on whatever question you have be of any help to you? 
05:33 < Bushmills> if in doubt, read the openvpn howto :)
05:33 < Bushmills> !howto
05:33 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:35 < katsumoto> Bushmills: openswan channel is very busy ... it no sound..
05:35 < katsumoto> :)
05:36 < Bushmills> start your own #openswan-support channel - at least for the time being it won't be very busy
05:41 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has left #openvpn ["Verlassend"]
05:43 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
05:44 < katsumoto> Bushmills ok come on help me?
05:45 < Bushmills> can't. i know less about openswan than a goldfish about space travel
05:46 < katsumoto> Bushmills: Please ..:)
05:46 < katsumoto> ok thanx
05:47 < katsumoto> openswan channel is still sleeping...ooff offf
05:50 < hyper_ch> hi Bushmills
05:52 < Bushmills> 'morning, hyper_ch
05:52 < hyper_ch> can I be helped?
05:52 < Bushmills> medical emergency? legal advice? cash flow problems? 
05:56 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
05:57 < michl> Here is a problem, that might have to do something with TUN-interface in Linux:
05:57 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15062>
05:57 < michl> An OpenVPN client connects to an OpenVPN server, uses certificates.
05:58 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 252 seconds]
05:58 < michl> the client uses UMTS (3G) to connect to the server, therefor the latency is quite high: about 300ms for the first packets, it comes down to about 150ms after a while
05:59 < michl> Now the weird thing: a pc behind the client starts passive FPT connection to a server behind the OpenVPN server. 
05:59 < michl> It sends massively packets, which cause error. Example: The client want to push a file into a directory of the server, that is non existent.
06:00 < michl> The client tries to push a huge amount of files, none of them can be placed at the server.
06:01 < michl> The client does not wait between these ftp command! I know, that is quite inpolite, but that is the application.
06:01 < michl> This happens: The connection becomes "slow". 
06:01 < michl> Not only this ftp connection becomes slow,  but all other connections to the client through the tunnel.
06:03 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
06:03 < michl> This situation can be provoced by 1) stopping the clients openvpn, 2) starting the application which wants to push the files, 3) starting the tunnel
06:03 < michl> sorry, correction to 1): stopping the servers openvpn
06:04 < michl> The connection becomes "slow", it feels, like way to much traffic, but that is not the case.
06:05 < michl> Has anybody already seen such a thing?
06:07 < michl> More info: The client can communicate very fast with the internet, as long the traffic does not have to got through the tunnel
06:08 < Onepamopa> michl if you point the outgoing traffic via your def gw (not through tunnel but through ISP) it may be faster
06:08 < Onepamopa> but not every ISP allows ip spoofing
06:08 < michl> The clients routes every packet through the tunnel, which has to go through the tunnel. I counted the ICMP-Pings and the UDP packets, they match.
06:09 < michl> @Onepamopa: The FTP data is meant to go through the tunnel.
06:09 < Onepamopa> depends on what ur trying to do ;)
06:09 < michl> What do you mean by IP spoofing? These are legitim packets coming from the openvpn client.
06:11 < michl> Restarting the UMTS connection indeed leads to a fully working ftp connection again. The problem arises, when the openvpn server is restarted.
06:12 -!- k4v [~kav@g226095246.adsl.alicedsl.de] has joined #openvpn
06:14 < michl> What I already tried:
06:15 < michl> - reducing the latency by exchanging the UMTS device with an Ethernet device. The connection does not become slow
06:15 < michl> - reducing mtu. Problem is the same
06:16 < michl> - no-replay: Problem is the same
06:16 < michl> - waiting for a full hour without any communication to the client: Problem is gone, connection is fast again
06:17 < michl> - wainting for a full hour with very little traffic (ping from time to time): Problem is the same, connection stays slow
06:17 < michl> - tracing with tcpdump/wireshark: There is a huge amount of lost packages and retransmissions
06:18 < michl> - ICMP pings with normal packet size come through a "slow" connection quite good 
06:18 < michl> - ICMP pings with 1500Byte size become lost for at least 20%
06:19 -!- katsumoto [~ayhan@85.105.15.139] has quit []
06:19 < Onepamopa> michl what exactly is the problem ?
06:19 < Onepamopa> slow connection / high ping ?
06:20 < michl> What do you think: Can this be a problem of the openvpn software or should I look into tun/tap.
06:20 < michl> Onepamopa: Problem is, that the connection is very slow due to a lot of lost packages
06:20 < Onepamopa> packets, not packages ;)
06:20 < Onepamopa> client / server are running @ what? windows ?
06:20 < michl> correct :-) 
06:21 < Onepamopa> okay, make both client and server processes with priority - realtime
06:21 < Onepamopa> guess u know how to do that
06:21 < michl> Both are running on Linux 2.4.21 ARMv4 @166MHz
06:21 < Onepamopa> 166 mhz? lol ;)
06:21 < Onepamopa> disable encryption
06:21 < Onepamopa> and make processes with prio -20
06:22 < Onepamopa> nice -20 @ configs
06:22 < michl> The load is not the problem!
06:22 < Onepamopa> just do it ...
06:22 < michl> ok! Thanks for the advice.
06:22 < Onepamopa> then restart client / server and test again
06:23 < michl> I have to wait until Monday before I can try anything.
06:23 < Onepamopa> how so?
06:23 < michl> Could you explain your suspicion?
06:23 < Onepamopa> well, I had similar problem with my setup
06:23 < michl> It is a customers problem, I do not have access to the devices on weekends
06:23 < Onepamopa> the customer had very high pings
06:24 < michl> Pings about 100ms are actually quite good for tunnels over 3G connections
06:24 < Onepamopa> we disabled encryption, enabled tcp-nodelay and fast-io
06:24 < Onepamopa> and both processes run @ prio - realtime
06:27 < michl> All this is so strange, because all the traffic is ok, as long as the openvpn server is not restarted. The problem comes, when the openvpn server goes down. When then openvpn client goes down, the packets are routed elsewhere. When the tunnel comes up again from the client side, there is no problem!
06:28 < michl> about tcp-nodelay: I use UDP as transport tunnel.
06:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:28 -!- mode/#openvpn [+v Axeman] by ChanServ
06:29 < michl> tcp-nodelay isn*t effective then, is it?
06:29 < Onepamopa> think so
06:31 < michl> My suspion: Someone is having problems with this huge amounts of new sockets coming through the tunnel, while openvpn is starting on the server side.
06:35 -!- mete [~mete@mete.shell.la] has quit [Quit: mete]
06:37 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
06:45 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 246 seconds]
06:55 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:57 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
07:04 -!- Rolybrau [~Rolybrau@96-82.79-83.cust.bluewin.ch] has joined #openvpn
07:04 -!- Rolybrau [~Rolybrau@96-82.79-83.cust.bluewin.ch] has quit [Changing host]
07:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:08 -!- Netsplit *.net <-> *.split quits: fahadsadah, Hamlin, kenyon
07:08 -!- Netsplit over, joins: Hamlin, kenyon
07:09 -!- Netsplit over, joins: fahadsadah
07:17 -!- sathia [~quassel@host52-213-dynamic.30-79-r.retail.telecomitalia.it] has quit [Quit: no love]
07:24 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
07:24 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
07:29 <@vpnHelper> RSS Update - forum: Disable download of server-locked profile <http://forums.openvpn.net/topic8717.html>
07:32 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
07:35 <@vpnHelper> RSS Update - forum: Migrate from Linux to Win 2008 R2 Server <http://forums.openvpn.net/topic8716.html#p15064>
07:37 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:37 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
07:41 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
07:41 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
07:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
07:54 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
07:54 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
07:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:57 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
07:58 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
08:18 -!- Macphist` [~user@c-98-218-81-248.hsd1.va.comcast.net] has joined #openvpn
08:19 -!- Macphisto [~user@c-98-218-81-248.hsd1.va.comcast.net] has quit [Ping timeout: 245 seconds]
08:26 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
08:26 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:43 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has quit [Ping timeout: 245 seconds]
08:44 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
08:50 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has joined #openvpn
08:55 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:02 -!- master_of_master [~master_of@p57B52A7F.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:04 -!- master_of_master [~master_of@p57B54570.dip.t-dialin.net] has joined #openvpn
09:04 -!- corretico [~luis@200.12.40.17] has joined #openvpn
09:12 <@vpnHelper> RSS Update - forum: Server makes no attempt to run connect script <http://forums.openvpn.net/topic8704.html#p15065>
09:25 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
09:25 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
09:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:25 -!- mode/#openvpn [+v Axeman] by ChanServ
09:29 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
09:29 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
09:29 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:29 -!- mode/#openvpn [+v Axeman2] by ChanServ
09:30 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
09:33 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
09:43 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has quit [Remote host closed the connection]
09:44 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
09:46 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
09:52 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has quit [Remote host closed the connection]
09:54 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
09:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:12 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 246 seconds]
10:14 -!- macs [~macs@unaffiliated/macs] has joined #openvpn
10:15 < macs> i get this error when running ./clean-all [ you must define KEY_DIR
10:15 < macs>  ]
10:16 < michl> edit the scrip "vars"
10:17 < michl> you also need the rights to delete the old keys. Are you root?
10:17 < macs> thanks.
10:18 < macs> and yes
10:24 < macs> Where do i find this CONFIG_TUN=m ?
10:26 < michl> Are you talking about the Kernel module?
10:26 < michl> modprobe tun
10:27 < macs> thanks
10:27 < macs> it says this when i try booting openvpn ( Starting openvpn:                                          [FAILED] )
10:28 < michl> Are you on Windows?
10:28 < macs> no
10:28 < macs> i'm on CentOS
10:29 < michl> How do you "boot" openvpn? Is it some startup mechanism of CenOS ?
10:30 < macs> service openvpn start
10:31 < michl> http://www.throx.net/2008/04/13/openvpn-and-centos-5-installation-and-configuration-guide/
10:31 <@vpnHelper> Title: OpenVPN and CentOS 5 Installation and Configuration Guide | Throx (at www.throx.net)
10:34 -!- uuuppz [~uuuppz@78.129.207.46] has joined #openvpn
10:36 < macs> Thanks
10:42 <@vpnHelper> RSS Update - forum: Firewall forwarding problem with OpenVPN...I guess ! <http://forums.openvpn.net/topic8718.html>
10:55 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 268 seconds]
11:02 <+s7r> http://www.youtube.com/watch?v=fbGkxcY7YFU
11:02 <@vpnHelper> Title: Samwell - "What What (In the Butt)" - YouTube (at www.youtube.com)
11:03 <+s7r> :))
11:07 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
11:09 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
11:13 < Bushmills> s7r: you may have to explain how that is related to openvpn, as the connection is not really evident
11:16 <+s7r> it's not
11:16 <+s7r> it was just for amuzment
11:17 <+s7r> seamed funny to me
11:17 <+s7r> were u disturbed by it ?
11:17 <+s7r> if yes sorry
11:17 <+s7r> not the intention
11:28 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
11:29 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
11:29 -!- mode/#openvpn [+v Axeman2] by ChanServ
11:29 < krzee> actually
11:29 < krzee> i can make that connection
11:30 < krzee> the server that vpnHelper lives on is named butters
11:32 < jeev> krzee
11:32 < jeev> i've got a customer who's direct connection to some cloud shit always brings up an error, i dont know what it is.. but i send it over openvpn and it doesn't.
11:33 < krzee> openvpn to the rescue ;]
11:35 -!- EugeneKawaway is now known as EugeneKay
11:39 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
11:43 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 245 seconds]
12:05 -!- Cain [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
12:06 <@vpnHelper> RSS Update - forum: SVC_RUN_EXCEPT-cannot start server <http://forums.openvpn.net/topic8696.html#p15067>
12:22 -!- SOG [~SOG@183.11.13.82] has joined #openvpn
12:48 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
13:08 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
13:32 -!- pierreghz [~pierreghz@cust-153-75-111-94.dyn.as47377.net] has joined #openvpn
13:48 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
14:05 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 246 seconds]
14:08 < uuuppz> jeev: surely you mean a "shit cloud" :)
14:09 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:20 < EugeneKay> Clouds aren't good for computers. Condensation corrodes out the boards, rusts the cases, and short-circuits the PSUs.
14:22 < Bushmills> shit clouds add an unpleasant odour
14:28 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:29 -!- mode/#openvpn [+v Axeman2] by ChanServ
14:45 < uuuppz> :)
14:46 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
14:50 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
14:51 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
14:55 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
14:58 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 252 seconds]
15:06 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:09 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
15:10 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
15:14 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:17 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
15:32 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
15:44 -!- k4v [~kav@g226095246.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
15:45 -!- pierreghz [~pierreghz@cust-153-75-111-94.dyn.as47377.net] has quit [Quit: dodo forcé]
15:53 -!- thaNatozZ [~eack@gateway/tor-sasl/thanatozz] has quit [Ping timeout: 245 seconds]
16:00 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 260 seconds]
16:04 -!- Onepamopa [onepamopa@62.204.152.143] has joined #openvpn
16:15 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
16:16 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
16:20 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
16:22 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
16:23 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:23 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
16:26 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
16:26 -!- mode/#openvpn [+v Axeman2] by ChanServ
16:27 -!- troyt [~troyt@ParaihZero.broker.freenet6.net] has joined #openvpn
16:27 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
16:29 -!- corretico [~luis@200.12.40.17] has quit [Quit: Leaving]
16:31 -!- troyt [~troyt@ParaihZero.broker.freenet6.net] has quit [Quit: AAAGH!  IT BURNS!]
16:38 -!- Macphist` [~user@c-98-218-81-248.hsd1.va.comcast.net] has quit [Ping timeout: 245 seconds]
16:43 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
16:49 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
16:55 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
16:58 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
17:04 -!- troyt [~troyt@ParaihZero.broker.freenet6.net] has joined #openvpn
17:06 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
17:10 -!- Onepamopa [onepamopa@62.204.152.143] has quit [Changing host]
17:10 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has joined #openvpn
17:11 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 260 seconds]
17:13 <@vpnHelper> RSS Update - forum: OpenVPN stopped working - willing to pay for support <http://forums.openvpn.net/topic8466.html#p15068>
17:13 -!- troyt [~troyt@ParaihZero.broker.freenet6.net] has quit [Quit: AAAGH!  IT BURNS!]
17:20 -!- troyt [~troyt@ParaihZero.broker.freenet6.net] has joined #openvpn
17:24 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
17:31 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15069>
17:32 -!- troyt [~troyt@ParaihZero.broker.freenet6.net] has quit [Quit: AAAGH!  IT BURNS!]
17:33 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
17:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:34 -!- troyt [~troyt@ParaihZero.broker.freenet6.net] has joined #openvpn
17:38 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
17:58 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
18:00 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
18:02 -!- troyt [~troyt@ParaihZero.broker.freenet6.net] has quit [Ping timeout: 260 seconds]
18:06 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
18:07 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 260 seconds]
18:07 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
18:07 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
18:15 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:15 -!- mode/#openvpn [+v Axeman2] by ChanServ
18:23 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Quit: AAAGH!  IT BURNS!]
18:28 -!- troyt [~troyt@2001:5c0:1000:b::a06b] has joined #openvpn
18:30 -!- troyt [~troyt@2001:5c0:1000:b::a06b] has quit [Client Quit]
18:30 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
18:30 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
18:35 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
18:43 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Quit: AAAGH!  IT BURNS!]
18:43 <@vpnHelper> RSS Update - forum: Migrate from Linux to Win 2008 R2 Server <http://forums.openvpn.net/topic8716.html#p15070>
18:44 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
18:46 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
18:46 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
18:51 -!- troyt [~troyt@2001:5c0:1000:b::a06b] has joined #openvpn
18:53 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
19:05 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Remote host closed the connection]
19:13 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
19:20 -!- mape2k [~mape2k@2a01:198:23f:10ff:bc21:42ff:fef3:d9c5] has joined #openvpn
19:30 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 246 seconds]
19:36 -!- spiekey [~mario@HSI-KBW-109-193-123-037.hsi7.kabel-badenwuerttemberg.de] has quit [Quit: Ex-Chat]
19:41 -!- mape2k [~mape2k@2a01:198:23f:10ff:bc21:42ff:fef3:d9c5] has quit [Ping timeout: 255 seconds]
19:42 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
19:42 -!- mape2k [~mape2k@2001:7c0:e701:116b:221:86ff:fe98:93a2] has joined #openvpn
19:43 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
19:57 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
19:58 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
20:04 -!- macs [~macs@unaffiliated/macs] has quit [Ping timeout: 260 seconds]
20:05 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:05 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:08 -!- Denial [Denial@drgi.co.uk] has quit []
20:21 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
20:22 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:49 -!- mape2k [~mape2k@2001:7c0:e701:116b:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
21:05 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 268 seconds]
21:26 -!- fake_ecrist [~webchat@205.185.117.21] has joined #openvpn
21:27 -!- fake_ecrist [~webchat@205.185.117.21] has left #openvpn []
21:31 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
21:37 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 258 seconds]
21:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
21:50 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
21:50 -!- EugeneKay is now known as EugeneKaway
21:54 -!- Titania [~titania@221.120.122.106] has joined #openvpn
22:04 -!- Titania [~titania@221.120.122.106] has quit [Quit: Will return someday...]
22:06 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
22:08 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
22:08 -!- SOG [~SOG@183.11.13.82] has quit [Quit: I will be back!]
22:24 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
22:30 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:39 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
22:41 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
22:41 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
22:41 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
22:41 -!- mode/#openvpn [+v Axeman2] by ChanServ
23:02 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
23:09 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
23:09 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
23:13 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
23:18 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
23:23 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has joined #openvpn
23:26 -!- fread228_ [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has joined #openvpn
23:28 -!- fread2281 [~fread2281@wsip-70-165-206-38.lv.lv.cox.net] has quit [Ping timeout: 245 seconds]
23:32 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
23:56 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
--- Day changed Sun Aug 28 2011
00:16 -!- ravidar [ravidar@ip68-230-183-158.dc.dc.cox.net] has joined #openvpn
00:19 -!- Titania [~titania@208.79.15.251] has joined #openvpn
00:35 -!- fread228_ [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has quit [Remote host closed the connection]
00:43 -!- mape2k [~mape2k@2a01:198:23f:10ff:405d:2ff:feab:b2f0] has joined #openvpn
00:48 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:54 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:56 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
01:13 -!- troyt [~troyt@2001:5c0:1000:b::a06b] has quit [Ping timeout: 255 seconds]
01:15 -!- EugeneKaway is now known as EugeneKawaway
01:17 <@vpnHelper> RSS Update - forum: OpenVPN stopped working - willing to pay for support <http://forums.openvpn.net/topic8466.html#p15071>
01:20 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 252 seconds]
01:29 <@vpnHelper> RSS Update - forum: Migrate from Linux to Win 2008 R2 Server <http://forums.openvpn.net/topic8716.html#p15072>
01:31 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
01:47 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
01:47 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:00 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:00 -!- mape2k [~mape2k@2a01:198:23f:10ff:405d:2ff:feab:b2f0] has quit [Ping timeout: 255 seconds]
02:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
02:15 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:17 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
02:35 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
02:41 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
02:41 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
02:41 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
02:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:54 -!- amero is now known as blitz
02:55 -!- blitz [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
02:56 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
02:56 -!- ravidar [ravidar@ip68-230-183-158.dc.dc.cox.net] has quit []
03:08 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 260 seconds]
03:12 -!- EugeneKawaway is now known as EugeneKay
03:19 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:19 -!- mode/#openvpn [+v s7r] by ChanServ
03:22 -!- mape2k [~mape2k@2a01:198:23f:10ff:2059:aaff:fe72:69a] has joined #openvpn
03:34 -!- mape2k [~mape2k@2a01:198:23f:10ff:2059:aaff:fe72:69a] has quit [Ping timeout: 255 seconds]
03:42 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
03:56 -!- cityLights [~cityLight@80.179.93.112] has joined #openvpn
03:56 < cityLights> I can't get my server to push dns to a linux client
03:57 < cityLights> I use : push "dhcp-option DNS 192.168.2.1"
03:58 < cityLights> foreign_option_* doesnt exist
--- Log closed Sun Aug 28 04:01:52 2011
--- Log opened Sun Aug 28 04:02:13 2011
04:02 -!- ecrist_ [~ecrist@216.17.68.153] has joined #openvpn
04:02 -!- Irssi: #openvpn: Total of 149 nicks [4 ops, 0 halfops, 1 voices, 144 normal]
04:02 -!- Irssi: Join to #openvpn was synced in 34 secs
04:02 -!- quadDama1e [~EmperorTo@216.17.68.153] has joined #openvpn
04:02 -!- quadDamage [~EmperorTo@216.17.68.153] has quit [Read error: Connection reset by peer]
04:02 -!- ecrist [~ecrist@openvpn/community/support/ecrist] has quit [Read error: Connection reset by peer]
04:05 < datruth> hrmm
04:06 < cityLights> ?
04:08 < datruth> nothing I am getting ready to set my vpn server with linux clients
04:08 < datruth> and I am hoping not to have dns issues
04:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
04:12 <+s7r> cityLights: the ip 192.168.2.1 is reachable from the client side?
04:13 < cityLights> after establishing vpn - yes its the server
04:13 <+s7r> hmm
04:14 <+s7r> could you pastebin your config ?
04:14 <+s7r> sounds strange, no reports ever of bugs in push option whatosever dns or redirect gateway or wins, etc.
04:14 -!- bitterman [~yury@84.51.199.63] has quit [Quit: This computer has gone to sleep]
04:18 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 260 seconds]
04:19 < cityLights> hmm... min
04:19 < cityLights> it will take 5 min
04:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:25 < cityLights> http://dpaste.com/603999/
04:25 < cityLights> s7r: as asked
04:25 <+s7r> cityLights: what is this ifconfig 192.168.2.1 192.168.2.2
04:26 < cityLights> no idea I opied it, assumed it tells which ips to hend out
04:26 <+s7r> delete that line
04:26 <+s7r> what is the ip pool from which openvpn assigns ip to clients?
04:26 < cityLights> II sir
04:27 <+s7r> is it anything like 10.8.0.0/24 ?
04:27 -!- Titania [~titania@208.79.15.251] has quit [Ping timeout: 264 seconds]
04:27 < cityLights> 192.168.2.0/24
04:28 < datruth> does remote-cert-tls server neeed to be in the client.conf?
04:28 < cityLights> not using tls
04:28 <+s7r> cityLights: and what IP address does your server have?
04:28 <+s7r> doesn't this create conflicts ?
04:28 < datruth> That was a general question for me
04:28 < cityLights> 192.168.2.1
04:28 <+s7r> thats all ? a single IP ?
04:28 <+s7r> no public one ?
04:29 < cityLights> cleint is 192.168.2.2
04:29 <+s7r> try connecting now after you deleted that ifconfig line and see if it works, if it still does not you will ahve to change the ip address pool
04:29 <+s7r> try now and see if you get the same error
04:29 < cityLights> going to add a line:
04:30 < cityLights> server 192.168.2.0 255.255.255.0
04:31 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:31 <+s7r> why ?
04:31 <+s7r> why not 10.8.0.0 255.255.255.0
04:31 <+s7r> ?
04:32 < cityLights> I allready assume 192.168.2.1
04:33 < cityLights> opevpn server fails to start
04:33 <+s7r> its because the tun adapter can not get the same ip as your eth0 or eth1 interface or what you have
04:33 <+s7r> put the address pool as i suggested
04:35 < cityLights> http://dpaste.com/604001/ failes
04:35 < cityLights> fails
04:36 < cityLights> Options error: --server and --secret cannot be used together (you must use SSL/TLS keys)
04:36 < cityLights> guess this is why used the ifconfig option
04:37 < cityLights> ok ok , I will make openssl keys....
04:37 <+s7r> no wait
04:37 <+s7r> you can use ifconfig don't get me wrong
04:37 <+s7r> but do not use the same ip as your other interfaces
04:37 <+s7r> add the line
04:38 <+s7r> ifconfig 10.8.0.1 10.8.0.2
04:38 <+s7r> and leave everything the same see if it works cityLights
04:39 <+s7r> pls note with this config only one signle client at a time can connect to the vpn server since it's configure point to point with 2ip
04:40 < datruth> does remote-cert-tls server neeed to be in the client.conf?
04:41 <+s7r> datruth: --remote-cert-tls client|server Require that peer certificate was signed with an explicit key usage and extended key usage based on RFC3280 TLS rules. 
04:41 <+s7r> there is a --remote-cert-tls client  and --remote-cert-tls server
04:41 <+s7r> one to server.conf and other to client.conf
04:42 <+s7r> it's like proto-tcp client and proto-tcp server
04:44 -!- luneff [~yury@93.178.92.224] has joined #openvpn
04:44 <+s7r> or you could add only --remote-cert-tls server in client.conf so only the client will check if the server certificate was signed with an explicit key usage and extended key usage
04:44 <+s7r> or vice versa if you want
04:44 <+s7r> or ... finally... both server to check client and client to check server
04:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
04:53 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15073>
05:08 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
05:13 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:16 -!- bitterman [~yury@93.178.92.224] has joined #openvpn
05:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:19 -!- luneff [~yury@93.178.92.224] has quit [Ping timeout: 246 seconds]
05:37 -!- Netsplit *.net <-> *.split quits: DarthGandalf, @raidz, @mattock, krackpot, uuuppz, krzee, qknight, bitterman, toortog, belZe,  (+105 more, use /NETSPLIT to show all of them)
05:38 -!- Netsplit over, joins: quadDama1e, Rolybrau, bitterman, K1ng, fluter, cityLights, Olipro, nixusr, hyper_ch, peper (+41 more)
05:38 -!- pranq [~pranq@unaffiliated/contempt] has joined #openvpn
05:38 -!- Netsplit over, joins: rawsted, ajacob_, mattock, R-66Y, Kartagis, GHAI, kerute, Bushmills, ivenkys_, qbasicer (+12 more)
05:38 -!- freaky[t]_ [alpha@freakyonline.de] has joined #openvpn
05:38 -!- Netsplit over, joins: mick_laptop, havoc, inimino, cron2, asio_, 92AAD5TJP, DarthGandalf, bigon, kraut, DexTerDDIT (+9 more)
05:38 -!- ServerMode/#openvpn [+oo vpnHelper mattock] by gibson.freenode.net
05:38 -!- Netsplit over, joins: Champi, gardar, fbh, openbsdnoob, Mowee, cherwin, belZe, raidz, krphop
05:38 -!- Perun [perun@chao5.net] has joined #openvpn
05:38 -!- Netsplit over, joins: reiffert, MrWGW, pr0zoid, Grleaf, cjs226, aef, civillian, krzee, jbb, Hamlin (+1 more)
05:38 -!- ServerMode/#openvpn [+o raidz] by gibson.freenode.net
05:38 -!- Netsplit *.net <-> *.split quits: EugeneKay, gardar, Optic, EvilGuru, d12fk, amir, fbh, trapni, DexTerDDIT, n2deep_,  (+11 more, use /NETSPLIT to show all of them)
05:38 -!- Netsplit over, joins: Olipro, Optic, fahadsadah, belZe, bigon, kraut, DexTerDDIT, EugeneKay, d12fk, defswork (+11 more)
05:38 -!- Netsplit *.net <-> *.split quits: ele, cherwin, sobersabre
05:39 -!- Netsplit over, joins: cherwin, sobersabre, ele
05:39 -!- Netsplit *.net <-> *.split quits: Kartagis, @mattock, _____m, sia^pwnnt, chokesmaster, Dougy
05:39 -!- Netsplit over, joins: chokesmaster, _____m, Kartagis, @mattock, sia^pwnnt, Dougy
05:40 -!- Netsplit *.net <-> *.split quits: agagag, pwrcycle, peper
05:40 -!- Netsplit *.net <-> *.split quits: fluter, jbb, bitterman
05:40 -!- Netsplit over, joins: peper, agagag, pwrcycle
05:40 -!- Netsplit *.net <-> *.split quits: 92AAD5TJP, Rolybrau, CybDev, kanyl, DarthGandalf, nixusr, meepmeep, kerute
05:40 -!- Netsplit over, joins: bitterman, fluter, jbb
05:40 -!- Martin` is now known as Martin
05:41 -!- Netsplit *.net <-> *.split quits: LuckyY_, MrWGW, Cain, Nowak, asio_, krphop, qbasicer, EvilJStoker, _zero__, hyper_ch,  (+3 more, use /NETSPLIT to show all of them)
05:41 -!- Martin is now known as Guest66782
05:42 -!- Netsplit over, joins: hyper_ch, LuckyY_, uuuppz, MrWGW, krphop, asio_, EvilJStoker, qbasicer, _zero__, Nowak (+2 more)
05:42 -!- Netsplit over, joins: Rolybrau, nixusr, kanyl, DarthGandalf, 92AAD5TJP, kerute, CybDev, meepmeep
05:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
05:44 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
05:45 -!- Netsplit *.net <-> *.split quits: Onepamopa, sigius, reiffert, cron2
05:45 -!- mode/#openvpn [+o cron2] by ChanServ
05:45 -!- Netsplit over, joins: Onepamopa, reiffert, cron2, sigius
05:47 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
05:47 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
05:50 -!- cityLights [~cityLight@80.179.93.112] has left #openvpn ["Leaving"]
05:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:53 -!- incidenc1 [jussi@antimaterial.fi] has quit [Changing host]
05:53 -!- incidenc1 [jussi@unaffiliated/incidence] has joined #openvpn
05:53 -!- incidenc1 is now known as incidence
05:56 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
05:56 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
05:56 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
05:56 -!- mode/#openvpn [+v Axeman2] by ChanServ
05:59 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has left #openvpn []
06:04 -!- tutulus [~tutulus@109.123.119.195] has joined #openvpn
06:04 -!- tutulus [~tutulus@109.123.119.195] has quit [Client Quit]
06:06 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:10 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
06:46 <@vpnHelper> RSS Update - forum: Preventing SPAM <http://forums.openvpn.net/topic8719.html>
06:49 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
06:51 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
07:28 <@vpnHelper> RSS Update - forum: Preventing SPAM <http://forums.openvpn.net/topic8719.html#p15075>
07:34 -!- bitterman [~yury@93.178.92.224] has quit [Quit: Leaving]
07:38 -!- Titania [~titania@208.79.15.251] has joined #openvpn
07:40 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:41 -!- Titania [~titania@208.79.15.251] has quit [Client Quit]
07:44 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 258 seconds]
07:52 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15076>
08:07 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
08:10 <@vpnHelper> RSS Update - forum: Disable download of server-locked profile <http://forums.openvpn.net/topic8717.html#p15077>
08:19 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:26 -!- luneff [~yury@84.51.199.63] has joined #openvpn
08:27 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:27 -!- mode/#openvpn [+v Axeman] by ChanServ
08:35 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Ping timeout: 260 seconds]
08:37 -!- fread2281 [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has joined #openvpn
08:39 -!- fread2281 [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has quit [Client Quit]
09:02 -!- master_of_master [~master_of@p57B54570.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:04 -!- master_of_master [~master_of@p57B523EF.dip.t-dialin.net] has joined #openvpn
09:06 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:08 -!- Axeman [~Axeman3@openvpn/user/axeman] has left #openvpn ["Leaving"]
09:15 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:18 -!- k4v [~kav@g226094011.adsl.alicedsl.de] has joined #openvpn
09:48 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
09:50 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
09:58 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
10:03 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has joined #openvpn
10:08 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
10:18 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
10:25 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has joined #openvpn
10:30 -!- comps [~username@gw-gsosfm.gsosfm.cz] has joined #openvpn
10:30 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Ping timeout: 258 seconds]
10:32 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
10:32 -!- fread2281 [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has joined #openvpn
10:34 -!- fread2281 [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has quit [Client Quit]
10:35 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
10:36 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
10:41 < comps> !welcome
10:41 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:43 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:46 < hyper_ch> welcome comps
10:46 < hyper_ch> ping Bushmills
10:46 < comps> thanks
10:48 < comps> that bot doesn't seem to accept private queries, therefore .. sorry for the spam here
10:48 < comps> !iporder
10:48 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice)., or (#2) Use --client-config-dir file for static IP (next choice) !static for more info, or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice), or (#4) if you use --ifconfig-pool-persist see !ipp
10:53 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
10:54 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
10:58 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:58 < krzee> !msg
10:58 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key>, or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
10:58 < krzee> or theres always:
10:58 < krzee> !factoids
10:58 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:59 < krzee> or here... nothing else going on here now anyways ;]
10:59 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
10:59 < comps> I was just wondering if there are any docs about "tun"-based client access control (ie. if it's possible to prevent IPv4 address spoofing), so I could ie. restrict mysql users to their respective client addresses
10:59 < krzee> sure
10:59 < krzee> you must use topology net30
11:00 < comps> I've been using only "tap"-based VPNs for the last few years
11:00 < krzee> then if they ifconfig to another ip, they lose access to their gateway
11:00 < krzee> so they cant route if they change their ip
11:00 < krzee> topology net30 is default by the way
11:00 < krzee> !/30
11:00 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc
11:00 < comps> right, point-to-point
11:00 < krzee> well not ptp
11:00 < krzee> still client/server
11:00 < krzee> but it uses a /30 per client
11:00 < comps> thanks for the tip
11:01 < krzee> np
11:02 < comps> is openvpn able to allocate those subnets automatically, preferably using ifconfig-pool-persist at the same time?
11:02 < krzee> huh?
11:02 < krzee> you mean can you give static ips?
11:03 < comps> I'd like a new client to have it's address assigned by the server, but - at the same time - I need to preserve that address for other uses (mysql, ...)
11:03 < krzee> !ipp
11:04 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips, or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
11:04 < comps> sure, I'm using that right now
11:04 < krzee> not likely what you're looking for
11:04 < krzee> read the factoid
11:04 < comps> okay
11:04 < krzee> that does not garuntee assignment
11:04 < krzee> youd wanna set them up in advance,
11:04 < krzee> !static
11:04 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
11:04 < comps> which is probably a better idea
11:04 < krzee> reserve ips in the upper portion of the range
11:05 < krzee> so that any dyanamic ones dont get lucky and score a privileged ip
11:06 -!- mape2k [~mape2k@2a01:198:23f:10ff:9841:1ff:fe82:cd5c] has joined #openvpn
11:06 < krzee> note which ips you can use
11:06 < krzee> !man
11:06 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
11:06 < krzee> 1sec getting something for ya
11:07 < comps> I already use the third range defined by RFC1918
11:07 < comps> 172.something
11:08 < krzee> !learn /30 as use openvpn --show-valid-subnets to see the subnets you can use in net30
11:08 <@vpnHelper> Joo got it.
11:09 < krzee> that ^
11:09 < comps> anyway, that's enough information to keep me going and figure what I need on my own, thanks
11:09 < comps> only OpenVPN 2.1.3 here (debian squeeze)
11:28 -!- fread2281 [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has joined #openvpn
11:37 -!- mape2k [~mape2k@2a01:198:23f:10ff:9841:1ff:fe82:cd5c] has quit [Ping timeout: 255 seconds]
11:41 -!- fread2281 [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has quit [Remote host closed the connection]
11:50 < comps> wouldn't "topology subnet" work better then net30? .. I'm currently reading through the openvpn mailing list archive and it seems to retain the IP spoofing tun-specific protection
11:50 < comps> s/then/than/
11:59 -!- mape2k [~mape2k@2a01:198:23f:10ff:ccd1:9cff:fe78:2144] has joined #openvpn
12:01 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
12:09 -!- mape2k [~mape2k@2a01:198:23f:10ff:ccd1:9cff:fe78:2144] has quit [Ping timeout: 255 seconds]
12:13 < krackpot> Anyone know why my XP client has trouble with routing (I'm guessing) when using TAP? I used the same config on Tunnelblick in mac and it has no problems?
12:14 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
12:15 < krzee> comps, we've tested it, no
12:15 < krzee> when you use topology subnet, the client can ifconfig to a new ip and communications dont break
12:16 < krzee> krackpot, i dont use/troubleshoot tap... but why do you even want tap?
12:16 < krzee> you have a specific layer2 protocol which needs to go over the vpn?
12:16 < comps> well, what about changing the entire /30 in the client (when using net30) to /30 of another client?
12:16 < krzee> comps, the server will only talk to it on its ip in net30
12:16 < comps> okay, that's all I need to know
12:16 < krzee> cause each subnet has its virtual gateway / broadcast
12:17 < comps> because if it was ie. tap device with multiple /30 subnets assigned, the linux kernel would use an appropriate subnet to the one used by client, which is not really what I want
12:18 < krzee> i dont get what you mean there, but if i understood your goal right you want what i said
12:18 < krzee> and im pretty sure i did
12:19 < comps> I need to restrict each client to a specific IPv4 address (or a /30 subnet), so there's no way the client can just ignore "pushed" configuration and set a /30 subnet of it's own choice
12:19 < comps> and if it does so, I want the communication to fail
12:19 < krzee> so ya i did understand you right
12:20 < krzee> and you do want what i said
12:20 < comps> okay
12:21 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
12:22 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:26 < krackpot> krzee: Don't know. That's how I've always done it. I want full access to my LAN?
12:27 < krzee> !route
12:27 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:27 < krzee> you dont need tap
12:29 < datruth> So for linux clients how can I push dns servers to them?
12:29 < krzee> !pushdns
12:29 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
12:29 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
12:29 < krzee> #4
12:29 < datruth> thx
12:29 < krzee> np
12:31 < datruth> !update-resolv-conf
12:31 < krackpot> krzee: Does that mean I have to add routes to connect to other LANs? I feel the method in the Routing guide assumes I will know the LAN IP I will be connecting from and that I trust it?
12:31 < krzee> !google linux update-resolv-conf openvpn
12:31 <@vpnHelper> Re: [Openvpn-users] Pushing DNS to Linux: <http://openvpn.net/archive/openvpn-users/2006-10/msg00217.html>; [Openvpn-users] Re: /etc/resolv.conf automation: <http://openvpn.net/archive/openvpn-users/2004-10/msg00396.html>; OpenVPN and DNS on a linux client | Phocean.net / Computer ...: <http://www.phocean.net/2006/12/07/openvpn-and-dns-on-a-linux-client.html>
12:32 < krzee> krackpot, why would you share unknown lans anyways?  just share the lan you want access to over the vpn!
12:33 < krzee> you dont HAVE TO share every lan, that just an example :-p
12:34 < krackpot> So what's the benefit of doing it by Routing instead of Bridging?
12:35 < krzee> overhead, security, scalability
12:35 < krzee> as a rule you only use tap when you need it
12:39 < krackpot> Ok. I will try to setup using TUN. I spent all day yesterday trying to get TAP to work and it only works on my Mac machine. If TUN is better, and less headaches, might as well give it a shot!
12:40 < krzee> =]
12:40 < krzee> and ild be happy to offer help with the tun setup, i wrote the doc on !route
12:40 < krackpot> krzee: Got a good guide to start off of? :)
12:41 < datruth> does that script belong on the client or server side?
12:41 < krzee> !sample
12:41 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config, or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man), or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
12:41 < krzee> !route
12:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
12:42 < krzee> datruth, the client, the script changes resolv.conf
12:42 < datruth> ahh okay
12:42 -!- _julian [~quassel@hmbg-5f7639fb.pool.mediaWays.net] has joined #openvpn
12:42 < _julian> hi
12:42 < datruth> I wonder how my linux clients will like that
12:42 < datruth> hrmm
12:42 < krackpot> krzee: Thanks :)
12:42 < _julian> is it possible to pipe a udp multicast stream through a vpn connection?
12:42 < datruth> no easy way to just push it to them from the server?
12:43 < krzee> yes, with that script
12:43 < krzee> i didnt say you had to write a script, lol
12:43 < krzee> _julian, either with tap or a multicast relay
12:44 < datruth> alrighty
12:44 < datruth> thx for the info
12:44 < _julian> krzee: any hints on documentatin about this?
12:44 < krzee> _julian, just change dev tun to dev tap
12:44 < krzee> you dont need to bridge for it
12:45 < krzee> just a normal config with dev tap
12:45 < _julian> krzee: ok, let me try
12:46 < krzee> datruth, np =]
12:55 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
12:55 < datruth> Well that seems to work well
12:55 < datruth> I wounder how they would connect to the network shares
12:56 < datruth> krzee: do you know of a stress or security test for openvpn?
12:56 < krzee> no
12:57 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:59 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
13:03 < _julian> krzee: hm, does not work so far. I changed config to tap and connected.
13:03 < _julian> in the main network I have a server that streams a mpeg2 ts stream on udp 239.0.1.1:4444
13:04 < _julian> I can grab that stream on the vpn gateway server, so it reaches the gateway. but I cannot receive that stream on the connected client
13:05 < krzee> so its a machine in the server
13:05 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 264 seconds]
13:05 < krzee> server's lan doing the streaming
13:05 < krzee> ?
13:06 < _julian> krzee: no, streaming is server #1, vpn gateway ist server #2. I am on client, which connects to server #2 with openvpn
13:07 < _julian> server #1 and #2 are on the same net
13:07 < krzee> when we say server, we're talking in relation to openvpn
13:07 < krzee> seeing as we're in here and all
13:08 < krzee> wanna repeat what you just said above in those terms?
13:08 < _julian> ok, so streaming is not done on server, but server is able to receive that stream
13:08  * datruth has been looking for away to stream video
13:08 < datruth> _julian: what are you using?
13:08 < _julian> datruth: getstream
13:08 < krzee> so the machine streaming the media is on the vpn server's lan?
13:08 < _julian> yes
13:08 < datruth> _julian: ahh is that nix or windows based?
13:08 < _julian> datruth: linux
13:09 < datruth> cool thx
13:09 < _julian> np (c:
13:09 -!- jeev is now known as jeev_
13:09 -!- jeev_ is now known as jeev
13:09 -!- jeev is now known as jeev_
13:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
13:11 < datruth> hrmm damn need a dvb card
13:11 < datruth> !pushdns
13:11 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
13:11 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
13:12 < krzee> _julian, instead of skipping right to the video, try normal networking tests
13:12 < krzee> you cant even ping the lan behind the server ;)
13:12 < krzee> !serverlan
13:12 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
13:12 < _julian> krzee: normal networking is fine.
13:12 < _julian> can ssh into the machine that does the streaming
13:14 < datruth> hopefully there is no issue with my dns for windows 7 clients
13:14 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
13:18 < _julian> krzee: any more ideas?
13:19 -!- jeev_ is now known as jeev
13:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
13:20 < _julian> krzee: checking with iftop I can see the stream coming in on eth0, but on tap0 it is not sent
13:22 < EugeneKay> !ipforward
13:22 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
13:22 < EugeneKay> !iptables
13:22 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z, or (#2) please see http://openvpn.net/man#lbBD for more info, or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
13:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:42 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 264 seconds]
13:43 < krzee> _julian, so your vpn client can ssh to the machine which streams video?
13:43 < _julian> krzee: yep
13:43 < krzee> _julian, and that machine can ping your vpn client as well?
13:43 < datruth> can you tie certificates to mac addresses of computers?
13:43 < krzee> (by vpn ip of course)
13:44 < _julian> krzee: yes, trough vpn
13:44 < krzee> datruth, no, and even if you could the tap adapter a) wont have the same mac every time and b) is EASILY spoofed
13:45 < krzee> _julian, http://forums.openvpn.net/topic8036.html
13:45 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15078>
13:45 <@vpnHelper> Title: OpenVPN Support Forum Sending multicast over a openvpn tunnel : Server Administration (at forums.openvpn.net)
13:46 < comps> could somebody please point me to "net30 + static IPs (via client-connect)" readme/howto? .. more specifically - how to set server subnet on client connect, how does it actually work, what to use for "server" directive (if anything) - does it automatically match the subnet pushed to client?
13:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:48 < krzee> server directive could be like 10.8.0.0 255.255.255.0
13:48 < krzee> then you can set static ips like this:
13:48 < krzee> !static
13:48 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client, or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0, or (#3) also see !ccd and !iporder
13:48 < krzee> #2
13:49 < krzee> and you can see valid /30 subnets with this:
13:49 < krzee> !/30
13:49 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips, or (#2) you can avoid this behavior by reading !topology, or (#3) so by default, first client is .6, then .10 .14 .18 etc etc, or (#4) use
13:49 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
13:49 < krzee> #4
13:49 < krzee> this is covered in the howto as well:
13:49 < krzee> !howto
13:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:55 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
13:58 < _julian> krzee: hm, odd. wondering why it does not work for me then
13:58 < _julian> maybe it's openvpn/tunnelblick on mac os that fails....
14:00 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 260 seconds]
14:09 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html> || OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15079>
14:25 -!- k4v [~kav@g226094011.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
14:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 263 seconds]
14:35 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:41 < comps> I'll have to use ccd anyway, since 'touch: cannot touch `openvpn_cc_df7f6cdd2c2a30e4625e2854db0eecea.tmp': Permission denied' -- because /etc/openvpn/ isn't writable for the openvpn user on debian (it's probably a bug, "/tmp/openvpn_cc_df7f6cdd2c2a30e4625e2854db0eecea.tmp" makes more sense)
14:49 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
14:52 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
15:20 -!- tty234 [telex@gateway/shell/anapnea.net/x-etgcsoulnuvulmcd] has joined #openvpn
15:23 < comps> is there any portable (windows/linux) way of forcing the openvpn client to use a default route (instead of a more specific one)?
15:33 < Bushmills> why should /etc/openvpn be writeable by openvpn user? doesn't seem a bug to me.
15:34 < comps> well, it's probably /etc/openvpn/myvpn, ie. the directory of the client-connect script
15:34 < Bushmills> and why would openvpn user want to touch files in that directory?
15:34 < comps> to write a dynamic config to $1
15:34 < comps> from within the client-connect script
15:35 < Bushmills> if you have to do that, change permissions of that subdir so that it can
15:35 < comps> already done
15:35 < Bushmills> or specifiy your ccd directory to reside somewhere else
15:37 < comps> it doesn't matter anyway, since my entire idea simply .. "hit the wall" -- I can't simply route an IP address of the server via VPN (without using the server as default gateway), for obvious reasons
15:39 < comps> unless I can force a different routing scheme for the openvpn client, which is doable on linux (using multiple routing tables), but I doubt it's possible on windows
15:42 -!- k4v [~kav@g226094011.adsl.alicedsl.de] has joined #openvpn
15:47 -!- luneff [~yury@84.51.199.63] has quit [Quit: Leaving]
15:49 < krackpot> krzee: I got the TUN to work. And the client can use the net of the VPN network. I'm trying to add LAN access now. I added some push routes and routes but that locked up my VPN server
16:04 < krzee> did you skim my doc or read it for understanding?
16:07 < pr0zoid> ha.
16:10 -!- fread2281 [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has joined #openvpn
16:11 -!- fread2281 [~fread2281@wsip-70-165-206-19.lv.lv.cox.net] has quit [Client Quit]
16:11 < ecrist_> boats and hos
16:11 < ecrist_> fucking freenode
16:12 -!- You're now known as ecrist
16:12 < krackpot> krzee: I've read it. But the difficulty is trying to translate all this stuff into my version of VPN. I'm running it on an old WRT54GS
16:22 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:25 < krzee> krackpot, none of that changes
16:26 < krzee> not sure why you expect it to
16:33 < _julian> krzee: multicast routing does not require special kernel features or anything like that?
16:33 < ecrist> not really.
16:34 < ecrist> multicast is more on the application level than anything.
16:38 < _julian> or is a bridge device required in tap mode?
16:38 < ecrist> well, if you want to bridge, yes
16:39 < krzee> i sent you to a forum link which answered those questions rather well
16:39 < _julian> krzee: that forum post said: just enable tap and it will work
16:39 < krzee> jjk (a very well respected expert, literally wrote the book on ovpn) helped someone accomplish it
16:40 -!- pranq [~pranq@unaffiliated/contempt] has quit [Quit: leaving]
16:41 < _julian> krzee: sorry, it says "no bridging". my fault
16:41 < krzee> no problem
16:41 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
16:41 < krzee> thats not to say bridging would not work... just that it is not required
16:41 < _julian> well still it does not work... I will try to install openvpn server on the host that sends the streams itself. then I can setup a route so it sends it to tap0-device directly
16:43 < krzee> with all this said, ive never done what you're talking about, but when i read jjk saying something will work, i know hes right (plus that other guy said it worked for him)
16:44 < krzee> he also said:
16:44 < krzee> Also make sure you've disabled rp_filter on the tun device, as multicast address don't pass the 'rp_filter' check (/proc/sys/net/ipv4/conf/*/rp_filter)
16:44 < _julian> well, maybe they had it running on the same system...
16:44 < krzee> (he meant tap device)
16:44 < krzee> no, he specificly says its a lan machine behind the server
16:44 < krzee> if you fully read the link, you will gain more from it ;]
16:44 < _julian> krzee: oh really? I thought this would be only relevant for tun mode
16:44 < _julian> krzee: sorry, has been 2 hrs since I read it and I'm too tired now I guess (c;
16:45 -!- tieinv [~dennis@S0106002369d527d7.vf.shawcable.net] has joined #openvpn
16:45 < krzee> meh i guess i may have read into something he said as well
16:46 < krzee> im also tired as hell today, battling a fatty hangover and working a double-shift
16:46 < krzee> =]
16:46 < _julian> (c:
16:48 -!- tieinv [~dennis@S0106002369d527d7.vf.shawcable.net] has left #openvpn ["Gone!"]
16:53 < _julian> hm, even with rp_filter disabled it does not work
16:57  * ecrist started drinking.  Enjoying life right now. ;)
17:24 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
17:26 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
17:28 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
18:04 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
18:04 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
18:18 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
18:18 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
18:27 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
18:27 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
18:30 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:38 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
18:38 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
18:42 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
18:43 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
18:50 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15081>
18:51 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
18:54 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 245 seconds]
18:56 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
19:03 -!- _julian_ [~quassel@hmbg-5f761bcc.pool.mediaWays.net] has joined #openvpn
19:04 -!- _julian [~quassel@hmbg-5f7639fb.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
19:17 -!- kav_ [~kav@g224244242.adsl.alicedsl.de] has joined #openvpn
19:20 -!- k4v [~kav@g226094011.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
19:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:30 -!- kav_ [~kav@g224244242.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
19:32 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15082>
19:33 < EugeneKay> Yeah? I shaved. https://twitpic.com/6cuvjq
19:33 <@vpnHelper> Title: I shaved. on Twitpic (at twitpic.com)
19:37 -!- Denial [Denial@drgi.co.uk] has quit []
19:45 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
19:51 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15083>
19:57 -!- Guest8383 [~Geek@unaffiliated/cain] has joined #openvpn
19:58 -!- Guest8383 [~Geek@unaffiliated/cain] has quit [Remote host closed the connection]
19:58 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 240 seconds]
19:59 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:59 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
20:03 <@vpnHelper> RSS Update - forum: Firewall forwarding problem with OpenVPN...I guess ! <http://forums.openvpn.net/topic8718.html#p15084>
20:09 <@vpnHelper> RSS Update - forum: Trouble networking between two clients. <http://forums.openvpn.net/topic8721.html>
20:18 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
20:21 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:21 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:22 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
20:23 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
20:23 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
20:24 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Client Quit]
20:25 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 260 seconds]
20:46 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
20:52 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
20:57 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:59 < rommel092079> good day.  guys can I ask help how to setup an http proxy. I know it does not directly talk about openvpn but I would like to ask anyway since is it an option of the ovpn file
21:00 < rommel092079> kindly reply guys
21:01 < jpalmer> we can help you USE the proxy after you'v set it up and properly configured it.  but this really isn't the channel to support your proxy software itself.
21:03 < rommel092079> jpalmer: I already know how to use http-proxy directive in the ovpn file. I would like to create my own http proxy to use for it.  maybe you have inputs for me. because I have tried already so many things but none of them are working as I check them on online proxy checker.
21:03 < rommel092079> so basically I would like to ask if you can provide me how to properly setup a http proxy.
21:04 < jpalmer> sorry,  as I just mentioned,  this isn't really th right place to support your proxy software. you'll have to go to the IRC channel, forums, or website for your proxy software
21:05 < rommel092079> :(
21:05 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
21:09 -!- comps [~username@gw-gsosfm.gsosfm.cz] has left #openvpn []
21:16 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
21:28 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 250 seconds]
21:47 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:54 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
22:03 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
22:03 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
22:03 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
22:12 -!- Titania [~titania@208.79.15.249] has joined #openvpn
22:16 -!- Titania [~titania@208.79.15.249] has quit [Client Quit]
22:16 -!- Cain [~Geek@unaffiliated/cain] has quit [Quit: Sayaunara ^_^]
22:17 -!- Guest83204 [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
22:19 -!- Guest83204 [~Geek@2001:41d0:1:f38f::1337] has quit [Excess Flood]
22:19 -!- Cain [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
22:19 -!- Cain is now known as Guest97804
22:21 -!- Guest97804 [~Geek@2001:41d0:1:f38f::1337] has left #openvpn []
22:25 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
22:28 -!- saffx0F [~saff__@178.73.218.67] has joined #openvpn
22:35 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
22:45 <@vpnHelper> RSS Update - forum: Routing Issue <http://forums.openvpn.net/topic8722.html>
23:06 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 240 seconds]
23:10 -!- saffx0F [~saff__@178.73.218.67] has quit [Ping timeout: 245 seconds]
23:10 -!- saffx0F [~saff__@178.73.217.70] has joined #openvpn
23:12 -!- saffx0F [~saff__@178.73.217.70] has quit [Remote host closed the connection]
23:13 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
23:16 -!- saffx0F [~saff__@178.73.217.70] has joined #openvpn
23:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
23:43 -!- mode/#openvpn [+v s7r] by ChanServ
23:45 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15087>
23:48 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 245 seconds]
23:51 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15089> || Trouble networking between two clients. <http://forums.openvpn.net/topic8721.html#p15088>
23:57 <@vpnHelper> RSS Update - forum: Routing Issue <http://forums.openvpn.net/topic8722.html#p15090>
23:59 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
23:59 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Client Quit]
--- Day changed Mon Aug 29 2011
00:00 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
00:03 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Read error: Connection reset by peer]
00:04 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
00:47 -!- dazo_afk is now known as dazo
01:03 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 240 seconds]
01:17 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has joined #openvpn
01:17 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has quit [Changing host]
01:17 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
01:18 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 240 seconds]
01:21 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:37 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
01:40 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:41 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
01:46 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:47 -!- kav_ [~kav@g224244242.adsl.alicedsl.de] has joined #openvpn
01:49 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:49 -!- fluter [~fluter@fedora/fluter] has quit [Excess Flood]
01:50 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:02 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 264 seconds]
02:04 <@vpnHelper> RSS Update - forum: Can't view any web pages from client <http://forums.openvpn.net/topic8708-15.html#p15091>
02:15 <@vpnHelper> RSS Update - forum: unable to download new certificate off site <http://forums.openvpn.net/topic8715.html#p15092>
02:16 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
02:20 -!- EugeneKay is now known as EugeneKaway
02:35 -!- kav_ is now known as k4v
02:40 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15093>
02:41 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
02:42 -!- luneff [~yury@93.178.111.167] has joined #openvpn
02:46 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
02:46 <@vpnHelper> RSS Update - forum: Preventing SPAM <http://forums.openvpn.net/topic8719.html#p15094>
02:49 < _julian_> morning
02:50 < _julian_> still can't get udp multicast working
02:51 < _julian_> have openvpn server running on the same machine that sends the multicast stream. openvpn is configured to tap mode
02:51 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
02:51 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
02:51 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:52 < _julian_> I also added a route for all multicast traffic to go to tap0
02:52 < _julian_> rc_filter is set to 0 for tap0 device on server and client
02:56 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
02:56 < _julian_> hm, actually with iftop I can see the stream cominf in on tap0 on the client. but when I try to play with vlc and mplayer they say they won't receive anything
03:00 < krzie> tcpdump sees them on the client?
03:04 < _julian_> ah, missed the multicast route on the client. now it works (c:
03:07 < krzie> sweet!
03:07 < krzie> now while its fresh in your head, you're invited to document your experience with routing multicast over openvpn
03:07 < krzie> !wiki
03:07 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki, or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
03:07 < krzie> =]
03:08 < krzie> (if you like)
03:08 < _julian_> will try to do it in the evening (c:
03:08 < krzie> then next time someone comes and says that, we'll just say !multicast
03:08 < krzie> ;]
03:08 < _julian_> (c:
03:10 < _julian_> if I want the openvpn-client to set a route for ip 239.0.1.1 to tap0 automatically what would I add to client.ovpn? push "route 239.0.1.1" ?
03:11 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:11 < krzie> well
03:11 < krzie> if you want to do it on the client, but from the server config, then yes
03:11 < krzie> !push
03:11 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
03:12 < krzie> but you need a subnet too
03:12 < krzie> is it a single host route?
03:12 < _julian_> ah, my mistake... so in the client I can directly add route without the push?
03:12 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15095>
03:12 < _julian_> yes, only want one single stream right now
03:12 < krzie> yep
03:13 < krzie> route 239.0.1.1 255.255.255.255
03:13 < _julian_> ok, let me try
03:13 < krzie> route changes the local routing table, push route changes the client's routing table, but from the server config
03:14 < _julian_> ok, makes sense. thanks
03:15 < _julian_> works (c:
03:16 < krzie> i like managing routes from the server, unless its the default route
03:17 < krzie> but thats all personal preference =]
03:17 < _julian_> yeah
03:28 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
03:30 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
04:09 -!- saffx0F [~saff__@178.73.217.70] has quit [Remote host closed the connection]
04:30 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
04:42 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
04:43 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:43 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:43 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:58 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has joined #openvpn
04:58 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has quit [Changing host]
04:58 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
04:59 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Client Quit]
05:00 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has joined #openvpn
05:00 -!- janjust [~janjust@s5597bc56.adsl.wanadoo.nl] has quit [Changing host]
05:00 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:12 <@vpnHelper> RSS Update - forum: Server makes no attempt to run connect script <http://forums.openvpn.net/topic8704.html#p15096>
05:14 -!- maxJadi [~maxJadi@dhcp-166-162.nomad.chalmers.se] has joined #openvpn
05:14 -!- maxJadi [~maxJadi@dhcp-166-162.nomad.chalmers.se] has quit [Changing host]
05:14 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:16 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
05:24 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
05:25 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:25 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:25 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:27 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
05:32 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
05:34 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:47 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
05:49 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
05:50 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
06:03 -!- bui [~bui@public.nbs-system.com] has joined #openvpn
06:13 <@vpnHelper> RSS Update - forum: SVC_RUN_EXCEPT-cannot start server <http://forums.openvpn.net/topic8696.html#p15097>
06:19 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
06:22 -!- decoder_ is now known as decoder
06:23 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
06:24 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
06:25 -!- ElkAiN [~ElkAiN@extranet.artal.fr] has joined #openvpn
06:26 < ElkAiN> Hi everybody. I've just installed openvpn on a debian 6. And when i generate the client keys the client.crt is empty.Did you have already seen that?
06:31 < reiffert> !howto
06:31 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:31 < CybDev> why use the official docs when you can get the wrong instructions from a 3rd party?
06:36 -!- trumee_ is now known as trumee
06:40 < ElkAiN> i've read the manual but i haven't found an answer to my question. So i ask to the 3rd party
06:40 < ElkAiN> So could you give me a more explicite answer?
06:43 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15099> || Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15098>
07:04 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:05 < ElkAiN> That's the "--interact" option for the pkitool script who doesn't work 
07:06 < bui> !faq
07:06 <@vpnHelper> "faq" is (#1) http://openvpn.net/index.php/documentation/faq.html, or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ
07:09 < bui> Hello, I'd like to know how to execute a script server side after a successfull connection. Actually, I want to send mails whenever someone connects to the VPN, but most of the reference I've seen are to execute script client side, and I don't want this, any idea ?
07:19 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15100>
07:20 < Bushmills> bui: --client-connect
07:21 < bui> Bushmills: thanks !
07:24 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
07:24 -!- oc80z [oc80z@blea.ch] has joined #openvpn
07:37 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
07:39 -!- k4v [~kav@g224244242.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
07:53 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
07:55 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Read error: Connection reset by peer]
07:55 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
07:58 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit []
08:10 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has quit [Ping timeout: 245 seconds]
08:15 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
08:24 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
08:24 <@vpnHelper> RSS Update - forum: Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html>
08:52 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
08:58 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
08:59 -!- k4v [~kav@g224244242.adsl.alicedsl.de] has joined #openvpn
09:01 -!- master_of_master [~master_of@p57B523EF.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
09:01 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15102>
09:03 -!- master_of_master [~master_of@p57B532C1.dip.t-dialin.net] has joined #openvpn
09:07 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has left #openvpn []
09:07 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15103>
09:12 < datruth> is there a frontend to openvpn
09:13 -!- ElkAiN [~ElkAiN@extranet.artal.fr] has quit [Quit: Quitte]
09:14 < datruth> !gui
09:14 < datruth> !linux
09:14 < datruth> !openvpn 
09:18 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
09:23 <@vpnHelper> RSS Update - forum: Learning to programme OpenVPN <http://forums.openvpn.net/topic8724.html>
09:25 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
09:30 < Olipro> !icmp
09:35 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
09:36 < gladiatr> datruth, there are front-ends for windows and osx
09:36 < datruth> gladiatr: I need a front-end for openvpn for ubuntu any suggestions?
09:37 -!- mape2k [~mape2k@g224233159.adsl.alicedsl.de] has joined #openvpn
09:37 < gladiatr> networkmanager has an openvpn module.  If you're running at least ubuntu 10 you should be in good shape.  Previous versions seemed to always be in a moving state of brokenness
09:38 < gladiatr> https://launchpad.net/ubuntu/+source/network-manager-openvpn
09:38 <@vpnHelper> Title: “network-manager-openvpn” package : Ubuntu (at launchpad.net)
09:39 < gladiatr> You'll have to translate your vpn client configuration into the forms in the interface--it won't take your text configuration file
09:40 < gladiatr> note: it is not a configuration method that is supported by the openvpn community.  If you have issues, you'll need to interact with the module's authors
09:46 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
09:53 <@vpnHelper> RSS Update - forum: Learning to programme OpenVPN <http://forums.openvpn.net/topic8724.html#p15105>
09:56 < datruth> hrmm thx for the info
09:58 < datruth> kvpnc works well to
09:58 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:59 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
09:59 < datruth> having dns issues to 
09:59 < datruth> It has no problem setting the dns on linux but when you disconnect
09:59 < datruth> it does nothing
10:03 < datruth> !update-resolv-conf
10:03 < datruth> Should that script be at the top of my client.conf?
10:09 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
10:13 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
10:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:36 -!- d12fk [~heiko@2001:1a80:2000:2:21f:c6ff:fe44:aec8] has left #openvpn ["?RETURN WITHOUT GOSUB"]
11:09 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 240 seconds]
11:13 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
11:13 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
11:13 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
11:24 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
11:36 -!- payal11 [payal@inara.dreamhost.com] has joined #openvpn
11:36 <@vpnHelper> RSS Update - forum: Routing Issue <http://forums.openvpn.net/topic8722.html#p15106>
11:36 < payal11> hi all
11:36 < payal11> is there any vpn hobby network club
11:37 < Essobi> A what what?
11:37 -!- jthunder [~jthunder@74.198.150.98] has joined #openvpn
11:37 < payal11> like anonnet
11:37 < Essobi> Never used it
11:37 < jthunder> anyone using openvpn with ethernet bridging and tap driver on solaris express?
11:38 < Essobi> http://ate.anonnet.org/
11:38 <@vpnHelper> Title: Drug Enforcement Administration (at ate.anonnet.org)
11:38 < jthunder> I'm having a hard time getting a functioning tap driver and bridge setup - I have tun working fine
11:45 -!- jthunder [~jthunder@74.198.150.98] has quit [Ping timeout: 250 seconds]
11:52 -!- dazo is now known as dazo_afk
11:53 -!- lahiru [~lahiru@220.247.243.54] has joined #openvpn
11:53 < lahiru> helo..
11:53 < lahiru> we changed the openvpn as server. now we can't enter the licence key
11:54 < Bushmills> !as
11:54 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
11:54 -!- sawzall [~Bonnevill@70.103.142.130] has joined #openvpn
11:55 -!- payal11 [payal@inara.dreamhost.com] has left #openvpn []
11:55 -!- sawzall [~Bonnevill@70.103.142.130] has left #openvpn []
11:55 -!- sawzall [~Bonnevill@70.103.142.130] has joined #openvpn
11:55 -!- sawzall [~Bonnevill@70.103.142.130] has left #openvpn []
12:00 -!- EugeneKaway is now known as EugeneKay
12:05 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
12:10 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
12:14 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
12:27 -!- lahiru [~lahiru@220.247.243.54] has quit [Ping timeout: 246 seconds]
12:27 -!- bui [~bui@public.nbs-system.com] has quit [Ping timeout: 252 seconds]
12:30 <@vpnHelper> RSS Update - forum: Routing Issue <http://forums.openvpn.net/topic8722.html#p15107>
12:33 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Ping timeout: 245 seconds]
12:33 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
12:36 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15108>
12:36 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
12:37 < dijital1> have any of you gotten this error message when doing a large transfer over a site to site VPN?   write UDPv4: No buffer space available (code=55)
12:37 < dijital1> kind of wondering if there's something I can tune to increase the buffer space
12:51 < ecrist> if there is, it'd be a kernel thing, not an openvpn thing.
12:51 < ecrist> usually, no buffer space is a firewall issue.
12:52 < ecrist> http://openvpn.net/archive/openvpn-users/2007-02/msg00103.html
12:52 <@vpnHelper> Title: [Openvpn-users] OpenBSD errors - write UDPv4: No buffer space available (code=55) (at openvpn.net)
12:56 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has quit [Ping timeout: 245 seconds]
13:01 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has joined #openvpn
13:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
13:03 -!- luneff [~yury@93.178.111.167] has quit [Quit: This computer has gone to sleep]
13:07 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 246 seconds]
13:07 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
13:11 -!- dijital1 [~bob@pdpc/supporter/active/dijital1] has left #openvpn ["%JMNU%521*-;UU  -GbU-   aUP%JMNU%521*-A3FSP%JMNU%521*-`4B-920-7BP%JMNU%521*-   94i-C3-43P%JMNU%521*-Bc2F-AR1C-AEBP%JMNU%521*-e3+T-U26-DBGP%JMNU%521*-bE41-KFF2-D232P%JMNU%521*-3Bb}-4+}A-3VAP"]
13:22 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
13:31 -!- i0x71 [~i0x71@bas1-richmondhill34-1088931001.dsl.bell.ca] has joined #openvpn
13:33 < i0x71> hey, i have a setup with a client and a server, client can connect just fine, the network defined in server.conf is 10.0.0.0, the server takes the first ip 10.0.0.1, however the first client takes 10.0.0.6, if i take a look at the routes it looks like the server thinks that the client is at 10.0.0.2 and the client thinks that the server is at 10.0.0.5, can anyone suggest why this happens ?
13:34 < i0x71> aka ip discreptancy
13:34 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 245 seconds]
13:34 -!- takamichi [Takamichi@92.251.127.2] has joined #openvpn
13:38 -!- luneff [~yury@84.51.199.63] has joined #openvpn
13:41 < gladiatr> !topology
13:41 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
13:42 <@vpnHelper> RSS Update - forum: Time Sync - OpenVPN-AS on Windows Server 2008 R2 Hyper-V <http://forums.openvpn.net/topic8725.html>
13:48 <@vpnHelper> RSS Update - forum: Routing Issue <http://forums.openvpn.net/topic8722.html#p15110>
14:01 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:04 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:12 <@vpnHelper> RSS Update - forum: [Solved] Trouble networking between two clients. <http://forums.openvpn.net/topic8721.html#p15111>
14:14 -!- i0x71_ [~i0x71@bas1-richmondhill34-1176124524.dsl.bell.ca] has joined #openvpn
14:16 -!- jthunder [~jthunder@174.3.103.159] has joined #openvpn
14:17 -!- Guest66782 [martin@shell.ipv6.octocore.net] has left #openvpn []
14:17 -!- i0x71 [~i0x71@bas1-richmondhill34-1088931001.dsl.bell.ca] has quit [Ping timeout: 250 seconds]
14:18 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
14:18 < Martin`> was unable to change my nickname when I was here 
14:23 < krzee> weird
14:25 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
14:28 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
14:28 < zastaph> http://openvpn.net/index.php/open-source/downloads.html is not clients right? where do I fetch the client for windows ?
14:28 <@vpnHelper> Title: Downloads (at openvpn.net)
14:28 < krzee> !download
14:28 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
14:29 < krzee> same link i believe
14:29 < zastaph> then what is http://openvpn.net/index.php?option=com_content&id=357
14:29 <@vpnHelper> Title: Client Packages (at openvpn.net)
14:29 < krzee> the opensource version uses the same openvpn for client and server
14:29 < krzee> the config decides
14:29 < krzee> that is for access server, the paid version of openvpn
14:29 < zastaph> thank you!
14:29 < krzee> aka not opensource
14:30 < krzee> yw =]
14:31 < zastaph> openvpn-2.2.1-install.exe sure suggests a lot of components to install
14:31 < zastaph> was hoping for a more thin client
14:32 < zastaph> i wouldn't know which ones are required
14:33 < krzee> thats not a lot of components
14:33 < krzee> name them and i can tell you what each is
14:33 <@vpnHelper> RSS Update - forum: Routing Issue <http://forums.openvpn.net/topic8722.html#p15112>
14:33 < krzee> (i dont run windows)
14:34 < zastaph> OpenVPN User-Space Components, OpenVPN GUI, OpenVPN RSA Cert Man. Scripts, OpenVPN Service, OpenVPN File Assoc., OpenSSL DLLs, OpenSSL Utilities, PKCS#11 DLLs LZ02 DLLs, MS V C 9.0 Runtime DLL, TAP Virtual Ethernet Adapter, Add OpenVPN to PATH
14:37 < krzee> ok the gui is for manually starting / stopping the vpn
14:37 < zastaph> the server?
14:37 < krzee> rsa cert man is for managing your PKI (certs) you only need this on 1 machine
14:37 < zastaph> ill be running server on debian
14:37 < krzee> server or client... 
14:37 < krzee> [12:29]  <krzee> the opensource version uses the same openvpn for client and server
14:37 < krzee> openvpn service is for starting it automatically with windows instead of manually
14:38 < krzee> (also makes it so it can run auto as admin without the admin pass, in case your win user doesnt have admin)
14:38 < krzee> since openvpn MUST be started as admin
14:38 < krzee> openvpn file assoc makes .ovpn files associated with openvpn
14:38 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p15113>
14:38 < krzee> openssl dlls should be obvious
14:38 < krzee> openssl utils hsould be as well
14:38 < krzee> in fact same with the rest of those
14:39 < krzee> if you wont generate certs on the windows machine, you can lose easy-rsa
14:39 < zastaph> sounds like the service is the only thing I don't need (i want to start it manually)
14:39 < krzee> ok, then you can lose that
14:41 < zastaph> still.. it's a lot of installation.. i was hoping i could even run something on a portable usb on any computer.. i doubt i can ask someone "can I quickly install this thin vpn client on your computer to access my home?"
14:41 < zastaph> virtual ethernet adapter sounds like messing with drivers etc.
14:41 < krzee> yep
14:42 < zastaph> so the paid version has thin clients? http://openvpn.net/index.php?option=com_content&id=357
14:42 <@vpnHelper> Title: Client Packages (at openvpn.net)
14:42 < krzee> you could ask the access-server people
14:42 < krzee> !AS
14:42 <@vpnHelper> "AS" is please go to #OpenVPN-AS for help with Access-Server
14:42 < zastaph> access-server being the paid version?
14:42 < krzee> yep
14:42 < krzee> [12:29]  <krzee> that is for access server, the paid version of openvpn
14:42 < krzee> [12:29]  <krzee> aka not opensource
14:43 < zastaph> i saw $5 under pricing.. that's almost nothing :)
14:43 < krzee> i dont know much about it, but based on the time they have spent on it and who is working on it, ild venture to say its a very good product
14:48 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p15115> || WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15114>
15:01 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15116>
15:11 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
15:13 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15117>
15:25 <@vpnHelper> RSS Update - forum: Where to place server certificates <http://forums.openvpn.net/topic8726.html>
15:25 -!- lwhalen [~law@bastion-ext.sermo.com] has joined #openvpn
15:25 < lwhalen> !configs
15:25 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
15:25 < lwhalen> !logs
15:25 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5, or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
15:31 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
15:33 < lwhalen> heh, you guys do this support-thing a lot, don't you :-p
15:36 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
15:41 -!- Nerezza [~Sen@64.92.187.101] has joined #openvpn
15:41 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p15119>
15:43 < Nerezza> I don't quite have a problem, but more a question whether or not OpenVPN seems like a good solution for what I want to do
15:45 < krzee> ok
15:45 < krzee> fire when ready
15:45 < Nerezza> I'm trying to encrypt both TCP and UDP traffic to a remote server, then connect to the web from there. Since SSH only encrypts TCP and Socks5 doesn't encrypt either, I'm thinking of using OpenVPN to encrypt both TCP and UDP, and routing traffic using a Socks5 server.
15:46 < lwhalen> alrighty, here's my problem: I've got OpenVPN Server 2.2.1 installed on a multi-homed "bounce" host (CentOS 5.6, 64-bit).  The default gateway lives on eth1 and points "to the outside", but there are static routes on eth0 for the three internal networks.  The gateway is a freshly-configured Checkpoint device, and routing seems to work fine from non-VPN'd clients 
15:46 < krzee> Nerezza, heh, thats what i do =]
15:46 < Nerezza> Does that sound like a good setup for that?
15:46 < krzee> !routebyapp
15:46 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
15:46 < lwhalen> the client (OS X Snow Leopard via Tunnelblick) connects just fine, gets a tunneled IP, and can ping the VPN server
15:46 < lwhalen> however, it can't ping anything else besides the VPN server
15:46 < lwhalen> here's my configs:
15:46 < krzee> Nerezza, well, i personally use it for exactly that, so my answer has to be a yes
15:46 < lwhalen> server and client config: http://pastebin.com/e0i3z2YJ
15:47 < lwhalen> client routing table, post-vpn client connection: http://pastebin.com/5nUwtRTy
15:47 < lwhalen> ^--- there's also some ping-tests on there as well
15:47 < Nerezza> krzee, what socks server do you use?
15:47 < krzee> dante
15:47 < lwhalen> server routing table, post-ovpn server startup, with output showing iptables/selinux is off: http://pastebin.com/wjFnL8y2
15:47 < krzee> lwhalen, 
15:47 < krzee> !route
15:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
15:48 < lwhalen> d'oh!
15:48 < krzee> make sure server has ip forwarding enabled
15:48 < lwhalen> it does
15:48 < krzee> make sure its router knows what lan ip to send vpn traffic to
15:48 < Nerezza> kzree, do you use route or bridge?
15:48 < krzee> routing
15:48 < lwhalen> echo 1 > /proc/sys/net/ipv4/ip_forward, right?
15:48 < krzee> never use tap unless you need layer12
15:48 < krzee> err
15:48 < krzee> never use tap unless you need layer2
15:48 < krzee> lwhalen, 
15:48 < krzee> !linipforward
15:48 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:49 < lwhalen> right, I know about those.  Let me read that link you just sent me real quick, and I'll let you know if that helps or not
15:49 < krzee> once you understand that link and all
15:49 < krzee> tcpdump on every machine involved
15:50 < krzee> -i tun0 will sniff the tun interface
15:50 < krzee> then ping around
15:50 < krzee> see where they drop
15:50 < krzee> !serverlan
15:50 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
15:50 < krzee> if you did those 3 things, which you say you have, then its a firewall issue
15:50 < lwhalen> iptables, as you can see via pastebin, is off on the ovpn server
15:50 < krzee> make sure tun+ is allowed in and out in forward table
15:51 < lwhalen> ahhh, I haven't added any FORWARD rules
15:51 < krzee> i hear that so often, yet it still ends up being the problem
15:51  * krzee points at the topic
15:51 < lwhalen> hehe I saw that.  I like it a lot :-) 
15:52 < lwhalen> will "-A FORWARD -i tun0 -j ACCEPT" be permissive enough?
15:52 < krzee> =]
15:52 < krzee> -I FORWARD -i tun+ -j ACCEPT
15:52 < krzee> -I FORWARD -o tun+ -j ACCEPT
15:53 < krzee> we can thank EugeneKay for me knowing that =]
15:53 < lwhalen> what does tun+ do?
15:53 < lwhalen> is that a wildcard?
15:53 < krzee> any tun device
15:53 < EugeneKay> I prefer to use explicit tun numbering
15:54 < Nerezza> krzee, Dante is a Linux Socks server, right?
15:54 < krzee> ok well either way you prefer then ;]
15:54 < lwhalen> this is quick n' dirty for right now
15:54 < krzee> Nerezza, well i use it on freebsd... but yes
15:55 < Nerezza> kzree, The server it'll probably end up on is Linux, and I want to be sure it's compatible x3
15:55 < lwhalen> I'm seeing my ping via " tcpdump -n -i tun0"
15:55 < lwhalen> (on the ovpn server)
15:55 < krzee> Nerezza, it even supports auth directly in linux, in freebsd i had to use pam
15:55 < krzee> aka, yes its primarily developed for linux
15:55 < lwhalen> hrm
15:56 < lwhalen> and I'm seeing the ICMP packets hit the target server (10.44.0.11) 
15:56 < lwhalen> but I'm not getting the reply on the client
15:56 < krzee> what machine does 10.44.0.11 use as its default gateway?
15:56 < Nerezza> kzree, Would there be any complications at all if the client computer is running W7?
15:56 < lwhalen> 10.44.0.1, a checkpoint firewall/routing device
15:56 < krzee> Nerezza, its just a socks server
15:56 < krzee> lwhalen, well that device needs to know this:
15:57 < krzee> !route_outside_ovpn
15:57 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
15:57 < Nerezza> kzree, Well, how about OpenVPN? I'm not too familiar with it to be honest
15:57 < krzee> Nerezza, possibly stuff you need to add for them, but openvpn does run fine there as well
15:57 < lwhalen> I believe I have that already
15:57 < krzee> example, if you push dns to them, you'll need a special option for those clients
15:57 < lwhalen> let me triple-check
15:57 < krzee> lwhalen, i believe you dont, or you did it wrong
15:58 < Nerezza> kzree, Out of curiosity, what reason did you set your server up for?
15:59 -!- mape2k [~mape2k@g224233159.adsl.alicedsl.de] has quit [Ping timeout: 260 seconds]
15:59 < krzee> the reason you described
16:00 < krzee> i wanted to selectively tunnel whatever i wanted over the vpn, but not by route (ovpn only uses the routing table to send things over the vpn)
16:00 < krzee> that needed to include udp
16:00 < krzee> (voip for example)
16:00 < krzee> also because its the sort of stuff that interests me
16:01 < Nerezza> krzee, Someone needs to invent a Socks5 with encryption
16:01 < krzee> LOL
16:01 < krzee> socks5 is encrypted dude
16:01 < lwhalen> here is the routing table on the Checkpoint:https://imgur.com/djm8w
16:01 <@vpnHelper> Title: imgur: the simple image sharer (at imgur.com)
16:01 < krzee> i only put it inside the vpn because i choose to trust openvpn's encryption more
16:01 < Nerezza> Then just ignore my noobspeak x3
16:02 < krzee> ;]
16:02 < lwhalen> you'll see that there is a route for the 10.45.250.0/24 (i.e. the openvpn tunneled client network) via the openvpn server (10.44.4.4) 
16:03 < Nerezza> I've been reading up on Socks5 and have seen no information on it's encryption, so I assumed it had none
16:03 < krzee> lwhalen, check the checkpoint firewall
16:04 < krzee> lwhalen, when you sniff those pings... do you see the checkpoint responding as well in its tcpdump?
16:04 < lwhalen> no
16:04 < lwhalen> I wouldn't expect the checkpoint to have to route the packets
16:04 < lwhalen> 10.44 is a /16 network (long story, don't ask)
16:04 < krzee> so it recieves and doesnt even send out a response?
16:05 < krzee> ya i noticed the netmasks
16:05 < lwhalen> so 10.44.4.4 (ovpn server) and 10.44.0.11 (ping destination machine) are on the same network
16:05 < krzee> when you tcpdump on the checkpoint, you see the request and dont see the response?
16:05 < lwhalen> I don't have that level of access to the checkpoint, regrettably
16:05 < lwhalen> this is one of those retarded "fully virtualized" environments 
16:05 < krzee> heh
16:06 < lwhalen> so my interaction with the CP is via a Windows client
16:06 < lwhalen> (NOT my first choice)
16:06 < krzee> and it cant sniff?
16:06 < lwhalen> I'm actually trying to set up an OpenVPN VPN because the CP VPN sucks so bad
16:06 < lwhalen> if it can, I don't see how to enable it in their circa-Windows 95 UI
16:07 < lwhalen> err
16:07 < lwhalen> did I just get disconnected?
16:07 < krzee> you're here
16:07 < lwhalen> oh good
16:07 < lwhalen> sorry about that :-p
16:07 < krzee> (pinging yourself would tell you that)
16:07 < EugeneKay> No you aren't.
16:07 < EugeneKay> IT'S ALL A MYTH
16:08 < lwhalen> hurrr
16:08 < lwhalen> anyway
16:08 < krzee> well my feeling is that its the firewall in checkpoint
16:08 < lwhalen> could I set up a static route on 10.44.0.11, just temporarily, to try and bypass the checkpoint?
16:08 < krzee> its either the route (which looks right) or the firewall on it
16:08 < krzee> yes
16:08 < krzee> in fact if you read the relevant section of !route it tells you so
16:09 < lwhalen> route add -net 10.45.250.0/24 gw 10.44.4.4
16:09 < lwhalen> ?
16:09 < krzee> "explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route"
16:09 < krzee> looks right
16:09 < lwhalen> BOOYAH BABYT
16:09 < lwhalen> it's the MF checkpoint
16:09 < lwhalen> god I hate that thing even MOOOOORE now
16:09 -!- ShiintoRyuu [~shiin@p54A2A697.dip.t-dialin.net] has joined #openvpn
16:10 < lwhalen> thank you so much for your help
16:10 < krzee> yw
16:13 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:17 -!- jthunder [~jthunder@174.3.103.159] has quit [Quit: jthunder]
16:30 -!- Official_Guest [~swg0101@openvpn/user/swg0101] has joined #openvpn
16:30 -!- mode/#openvpn [+v Official_Guest] by ChanServ
16:30 <+Official_Guest> !openvznat
16:31 < Nerezza> krzee, Do you know any good documentation on setting up username/pass stuff on Dante?
16:31 < krzee> Nerezza, welllll... you could try the dante docs ;]
16:31 < krzee> however, if it is inside the vpn, who cares about auth!?
16:31 < krzee> i let my vpn worry about the auth
16:31 < Nerezza> Just looking into other possibilities
16:31 < krzee> you cant reach it unless you're already in the vpn
16:32 < krzee> ok, well try the docs for the app you're asking about
16:32 < krzee> it supports at least linux passwd file auth, and pam auth
16:32 < Nerezza> Ah, I missed these docs when I was going through the website
16:33 < krzee> also missed the manpages included with the app?  thats where i normally start
16:33 < Nerezza> I'm currently not on a Linux system
16:33 < krzee> method A list of acceptable authentication methods for socks-rules,  in
16:33 < krzee>               order  of  preference.   Supported  values  are  username, none,
16:33 < krzee>               rfc931 and pam.
16:34 < krzee>               See the section on methods for a explanation  of  the  different
16:34 < krzee>               methods.
16:34 < krzee> the dante config can be simple or can be complex
16:34 < krzee> it basically has its own firewall type thing built in
16:35 < krzee> !factoids search openvz
16:35 <@vpnHelper> 'openvz', 'openvzlinnat', and 'openvznat'
16:35 < krzee> !openvznat
16:35 <@vpnHelper> "openvznat" is a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP>
16:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
16:50 -!- blazer6969 [~blazer696@109.129.102.229] has joined #openvpn
16:58 -!- Ionic [ionic@ionic.de] has joined #openvpn
16:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:00 < Ionic> Hi, I'm trying to forward all traffic on my client to my server which then performs SNAT on it. However after the connection stands, I'm only getting no route to host messages regarding my server. What do you need? Server+client config+up+down+logs? :)
17:00 -!- bassliner [armin@irc.arje.de] has joined #openvpn
17:02 < krzee> well first
17:02 < krzee> do you have ip forwarding enabled?
17:02 < krzee> you mentioned up/down, what do your up/down scripts do?
17:04 < krzee> all it takes is these:
17:04 < krzee> !redirect
17:04 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:04 < Ionic> Yes
17:04 -!- drgreco [~drgreco@184-96-194-43.hlrn.qwest.net] has left #openvpn []
17:04 < Ionic> One second
17:06 < Ionic> http://www.fpaste.org/jjVk/
17:07 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:09 < Ionic> Server side should be fine, but the client side fails for some reason :/
17:14 < krzee> wanna know other things if i see them?
17:14 -!- lwhalen [~law@bastion-ext.sermo.com] has quit [Ping timeout: 260 seconds]
17:15 < Ionic> Hm? What exactly? :)
17:15 < krzee> !tcp
17:15 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea., or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer), or (#3) if you must use tcp, you likely want --tcp-nodelay
17:15 < Ionic> Well... it doesn't matter if TCP or UDP
17:15 < Ionic> However TCP is working better if you're behind a firewall
17:16 < krzee> if your firewall sucks, yes
17:16 < krzee> however, you missed the point
17:16 < krzee> if you must use tcp
17:16 < krzee> see #3
17:16 < Ionic> I've been trying UDP before and it still failed
17:16 <+Official_Guest> don't you love Nagle? ;)
17:16 < krzee> i didnt say it was related to your problem
17:16 < krzee> which in fact is why i said:
17:17 < Ionic> Ah I see
17:17 < krzee> [15:14]  <krzee> wanna know other things if i see them?
17:17 < Ionic> So just a general suggestion, thanks :)
17:17 < krzee> np
17:18 < krzee> and i say that it is true if your firewall sucks because some sucky ones (more the config than the software) try to keep-state on udp
17:18 < krzee> which is stateless, so attempts to track that can fail
17:19 < Ionic> Right, that's why I asked myself if UDP was a good idea and changed it to TCP
17:19 < krzee> its actually better
17:20 < krzee> as seen from the link in #1 (as stolen from the openvpn manual) and #2 (a slideshow made by the primary ovpn dev)
17:20 < krzee> but either way, thats unrelated to your problem
17:20 < krzee> just some side info ;]
17:20 < Ionic> Hm
17:21 < Ionic> Yeah well my problem is weird :/
17:21 < krzee> why all that crap in the up/down scripts?
17:21 < Ionic> OpenVPN has to still use the old gateways to get to the server, that's what def1 is for
17:21 < krzee> yanno you can set routes and mtu in the openvpn config?
17:21 < Ionic> Other than that... it should work
17:21 < Ionic> Yeah I know it's pretty useless
17:22 < krzee> if useless, comment them out
17:23 < Ionic> However the important stuff is push, forward and SNAT
17:25 < krzee> hmmm
17:25 < krzee> Tue Aug 30 00:01:52 2011 /sbin/route add -net 87.98.244.45 0.0.0.0 255.255.255.255
17:25 < krzee> add net 87.98.244.45: gateway 0.0.0.0
17:25 < krzee> how does your client connect to the inet?
17:25 < krzee> ppp?
17:25 < Ionic> Uhm?
17:25 < Ionic> 87.98.244.45 is the server ip
17:25 < krzee> i get that part
17:26 < krzee> i doubt your orig gateway was 0.0.0.0 tho
17:26 < Ionic> Nah pretty much not though
17:26 < Ionic> Uhm
17:26 < Ionic> What the
17:26 < krzee> so back to my question
17:26 < krzee> [15:25]  <krzee> how does your client connect to the inet?
17:26 < Ionic> currently SNATted LAN
17:27 < krzee> so its behind a normal home router?
17:27 < Ionic> Yeah
17:27 < Ionic> default            192.168.178.1      UGSc           25        3     en0
17:27 < krzee> show me your netstat -rn on client before and after connecting to the vpn (in pastebin)
17:27 < Ionic> Destination        Gateway            Flags        Refs      Use   Netif Expire
17:27 < Ionic> Uhm yeah I'm having a little problem, the client refuses to start
17:27 < krzee> reboot the client machine
17:28 < Ionic> Tue Aug 30 00:27:53 2011 Assertion failed at helper.c:476
17:28 < krzee> then show me what i asked for in pastebin
17:28 < Ionic> What the
17:28 < krzee> oh and comment out those up/down scripts
17:29 < krzee> if that breaks something you want, say what it is that you wanted and we'll see bout doing it the openvpn way
17:29 < Ionic> Ah
17:29 < krzee> you called them useless... when troubleshooting you want to find the least config that works, then add on the complexities after
17:29 < Ionic> nodelay broke it
17:30 < Ionic> Yeah one second please :)
17:30 < krzee> exactly what was the line you put in the config?
17:30 < krzee> (that broke it)
17:30 < Ionic> tcp-nodelay
17:30 < krzee> weird, thats the right way to add it
17:30 < krzee> oh well. forget bout that too for now
17:31 < krzee> and do this:
17:31 < Ionic> But apparently it's for server mode only :)
17:31 < Ionic> So I'm fine
17:31 < krzee> [15:27]  <krzee> reboot the client machine
17:31 < krzee> [15:28]  <krzee> then show me what i asked for in pastebin
17:31 < Ionic> I won't reboot :P but yeah I'll pastebin the stuff
17:32 < krzee> no
17:32 < krzee> do reboot
17:32 < krzee> i want a fresh routing table
17:32 < krzee> not one you been screwing with
17:32 < krzee> and be sure you disabled those up/down scripts
17:33 < krzee> --tcp-nodelay 
17:33 < krzee>  This macro sets the TCP_NODELAY socket flag on the server as well as pushes it to connecting clients.
17:33 < Ionic> http://pastie.org/2451307 it's normal/fresh :)
17:33 < krzee> did you reboot it first?
17:33 < Ionic> Nah but you'll get the same output
17:33 < krzee> if you wont follow directions i wont waste my time
17:33 < Ionic> *sigh*
17:34 < krzee> i have 2 jobs i can be working on right now...
17:34 < Ionic> Rebooting will take at least half an hour
17:34 < krzee> half an hour to reboot?  cool see ya in 30min
17:34 < krzee> you might want to fix whatever it is that causes that to take 30min as well
17:34 < Ionic> Probably... I usually don't reboot unices :)
17:35 < Ionic> It's starting and stopping all programs ;P
17:35 < krzee> do you usually argue with the people you ask for support on something?
17:35 < krzee> seems counter-productive
17:35 < Ionic> Only if I know my point is right (anyway I'm working on rebooting currently)
17:36 < krzee> working on?  shutdown -r now generally gets the job done
17:36 < krzee> not sure what ppc you're on, but my intel macs take far under 5min for a reboot
17:37 < krzee> MacPro3,1 CPU: Intel Core2 Quad Q9400 2.66GHz @ 2.4GHz [/FPU/MMX/SSE/SSE2/SSE3/S.SSE3/SSE4.1/x86_64/PAE/XD/EM64T/VMX/EST/QuadCore] L2: 6144K FSB: 1064MHz Airport:    RAM: 4.4GB/8.0GB Vram: 27.20M/256.00M Disk: 296.0GB/931.39GB GPU: Unknown nVidia card [512 MB/Stock] 1280x1024@60Hz and 1280x1024@60Hz OS: Mac OS X 10.6.8 (10K549) Kernel: Darwin 10.8.0 Up: 4 days 23:22
17:37 < Ionic> Nah I've gotta close a shitload of terminals first for instance and check everyone to not leave stuff running in the background or sorta
17:37 < Ionic> Ok done
17:37 < Ionic> brb
17:42 < krzee> i know what you were saying, and you're generally right... but ive wasted enough time with that assumption that i refuse to do it more
17:45 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
17:46 -!- Ionic [ionic@ionic.de] has joined #openvpn
17:47 < Ionic> krzee: http://pastie.org/2451374 there you go, fresh netstat -rn after rebooting
17:50 < krzee> thanks
17:50 < krzee> [15:42]  <krzee> i know what you were saying, and you're generally right... but ive wasted enough time with that assumption that i refuse to do it more
17:50 < krzee> in case ya missed that ;]
17:50 < krzee> now start the vpn (no up / down scripts)
17:51 < Ionic> Nah I've seen it in the backlog
17:51 < Ionic> I disabled them
17:51 < Ionic> Because they are empty now anyway
17:51 < krzee> then netstat -rn after connecting
17:53 < Ionic> Yeah sure
17:53 < Ionic> http://pastie.org/2451411
17:54 < Ionic> (Yes I know the routing table looks poluted even right after starting up, but that's fucking Parallels for instance and their virtual network interface)
17:55 < ecrist> OS: FreeBSD 8.2-RELEASE CPU: RAM: 24GB UP: 36 days 9:50 USERS: 3 LOAD: 0.08 0.05 0.01 (86 processes:  1 running, 85 sleeping)
17:55 < ecrist> krzee ^^^
17:55 < ecrist> muahahaha
17:55 < krzee> ya i have quite a few vm's too
17:55 < krzee> dammmn
17:55 < krzee> nice ram there buddy
17:55 -!- k4v [~kav@g224244242.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
17:56 < Ionic> < 8GB in his MBP only :<
17:56 < Ionic> Like in your machine (Mac Pro?)
17:56  * ecrist has 8GB in his mbp
17:56 < krzee> its really just a homemade mac
17:56 < Ionic> Ah
17:56 < krzee> and my MBP has 8gb too
17:57 < krzee> its the i7 from last august
17:57 < krzee> it just had its birthday
17:57 < Ionic> Aww
17:58 < Ionic> Anywho... the routing table looks OK to me
17:58 < krzee> but none of my machines are anywhere near what ecrist gets to play with at work
17:58 < ecrist> :D
17:58 < krzee> and he even has a rack in his basement... *jealous*
17:58 < ecrist> I IRC from a dual quad-core Nehalem
17:59 < krzee> i need to get myself one of those bluetooth trackpads for my desktop
17:59 < krzee> i just hate that they must use bluetooth, ild prefer a usb cable
18:00 < ecrist> krzee: there are some mods out there that let you do it
18:00 < ecrist> it still uses bluetooth, but it's powered over USB
18:00 < Ionic> lol
18:00 < krzee> no shit?  ill look into that!
18:01 < krzee> 87.98.244.45/32    0.0.0.0            UGSc            1        0     en0
18:01 < krzee> so weird
18:01 < krzee> its not smelling your gateway right
18:01 < krzee> ROUTE default_gateway=0.0.0.0
18:02 < krzee> ive never seen that when a user is directly plugged in with ethernet
18:02 < krzee> ive seen it with ppp and stuff like that
18:03 < Ionic> Hmm
18:03 < Ionic> Well at least it's OpenVPN screwing up?
18:03 < Ionic> I can't see such a route in the default set
18:03 < krzee> so it seems
18:04 < krzee> til we know why i cant garuntee what causes it
18:04 < Ionic> Hm :/
18:04 < Ionic> Shall I set the logging more verbose?
18:05 < krzee> sure, give that a shot
18:06 < krzee> i see a bug from 2006 that caused it...
18:06 < krzee> but that was long long ago
18:06 < krzee> brb work is busy for a min
18:07 < Ionic> What level?
18:07 < Ionic> I'll try 5
18:08 < krzee> try 7
18:08 < krzee> honestly i wouldnt know what level / if it will help us find anything
18:08 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:08 < krzee> but i do know up to 6
18:08 < krzee> 5 and 6 just help debug firewall issues
18:09 < Ionic> Hmm
18:11 < Ionic> http://www.fpaste.org/c8Tm/ there we go
18:13 < Ionic> This write stuff afterwards is me pinging 64.94.234.144
18:13 < krzee> yep
18:13 < krzee> you get that in verb 6+
18:14 < Ionic> Yeah
18:14 < Ionic> Just to make clear why you're seeing it :)
18:14 < Ionic> writes without any reads
18:15 < krzee> Tue Aug 30 01:09:58 2011 us=227438 ROUTE default_gateway=0.0.0.0
18:15 < krzee> i still blame that
18:15 < krzee> but im at a loss as for why
18:15 < krzee> the higher debug level helped nothing
18:15 < krzee> could try verb 11 i guess
18:16 < Ionic> Hm
18:19 < Ionic> Omfg
18:19 < krzee> ya, lol
18:19 < Ionic> I'm not sure I can paste that
18:20 < krzee> its like gdb and tcpdump rolled into one huh
18:20 < krzee> lol
18:20 < Ionic> Hehe
18:20 < krzee> just paste like 50 lines above and below the line i keep pasting
18:20 < krzee> grep -A50 -B50 "default_gateway=0.0.0.0" filename
18:21 -!- ShiintoR_ [~shiin@p54A2A697.dip.t-dialin.net] has joined #openvpn
18:21 < Ionic> Sec, still pasting several mb of text ;P
18:21 -!- ShiintoRyuu [~shiin@p54A2A697.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
18:21 -!- ShiintoR_ is now known as ShiintoRyuu
18:21 < Ionic> http://ionic.de/ovpn.txt
18:22 < Ionic> Hmm
18:22 < Ionic> UNRELATED lol: Tue Aug 30 01:18:07 2011 us=378938 NOTE: setsockopt TCP_NODELAY=1 failed (No kernel support)
18:22 < krzee> yep
18:22 < Ionic> Probably that's why it failed
18:22 < krzee> guess osx doesnt do it
18:22 < Ionic> Well you can enable no delay on OS X
18:22 < krzee> nah it is a server-only option like you thought
18:23 < Ionic> As a matter of fact I guess I did it
18:23 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:23 < krzee> while its best to have on both sides, 1 side is still better than not at all
18:23 < Ionic> Hm
18:23 < krzee> but ya i dont see anything related to this there either
18:23 < Ionic> Interestingly my server pushes no such bogus route too
18:24 < krzee> well its part of redirect-gateway
18:24 < krzee> it *must* add a direct route to the vpn
18:24 < krzee> or it loses its connection, like you're seeing
18:24 < Ionic> Yes, but not 0.0.0.0
18:24 < krzee> right, i pointed that out ;]
18:24 < krzee> its not getting your gateway right
18:26 < Ionic> Hmm
18:26 < Ionic> Let's try Tunnelblick
18:26 < Ionic> That's older
18:27 < Ionic> 2.1.4
18:27 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:29 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15120>
18:30 < krzee> well you're also not on most upto date
18:30 < krzee> 2.2.1 is out
18:31 < krzee> but thats not a bad idea... to test other versions
18:31 < krzee> ild expect only the clients version could matter for this
18:31 < Ionic> Hum
18:31 < Ionic> Ok Tunnelblick is weird
18:32 < krzee> since server has nothing to do with how the client finds its gateway
18:32 < krzee> ya i also dont use tunnelblick
18:32 < krzee> but you can copy the exec out of the app
18:32 < krzee> (if you just wanna test that version)
18:33 < Ionic> Well yeah :)
18:34 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
18:34 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
18:39 -!- Denial [Denial@drgi.co.uk] has quit []
18:40 -!- Ionic [ionic@ionic.de] has quit [Ping timeout: 252 seconds]
18:43 -!- Ionic [ionic@ionic.de] has joined #openvpn
18:43 < Ionic> Sorry
18:44 < Ionic> I'm always getting an excess flood when reconnecting to the proxy
18:44 < Ionic> Anywho...
18:44 < Ionic> krzee: it's working with the binary shipped in TB!
18:45 < krzee> umm
18:45 < krzee> well
18:45 < krzee> wow
18:45 < krzee> please test 2.2.1
18:45 < krzee> also please test the dev snapshot if you dont mind
18:46 < krzee> (would help us)
18:46 < krzee> !snapshots
18:46 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
18:46 < Ionic> Sure
18:46 < Ionic> So 2.1.4 works, 2.2.0 fails
18:46 < Ionic> (For some reason)
18:46 < krzee> right, i pinged devs when we found the weirdness and verb 11 didnt help
18:47 < krzee> no response yet
18:47 < krzee> but could be handy to get more info... especially if 2.2.1 is fine or snapshots is fine (in which case its already fixed and nothing to report to them)
18:47 < krzee> if its not fixed it would be good to add a trac ticket
18:48 < krzee> which i could open, but really we'ld need you to, since i cant duplicate the problem here
18:48 < Ionic> Compiling
18:48 < krzee> right on
18:48 < krzee> but at least your problem is solved now
18:48 < krzee> =]
18:49 < Ionic> Well... worked around :P
18:49 < krzee> well kinda, you'd prolly have no issues sticking with 2.1.4
18:49 < Ionic> 2.2.1 fails
18:49 < krzee> we're mainly testing now to see if its still an issue in the code
18:51 < Ionic> Hm indeed
18:51 < Ionic> So far 2.2.0 and up seem broken while 2.1.4 work
18:51 < krzee> tested dev snapshot yet?
18:51 < Ionic> (And down probably)
18:51 < Ionic> Nope
18:51 < Ionic> Going for it now
18:52 < krzee> ftp://ftp.secure-computing.net/pub/openvpn/openvpn-201135.tar.gz
18:53 < krzee> from yesterday =]
18:53 < Ionic> I'm building
18:54 < Ionic> Hm oh
18:54 < Ionic> That's interesting
18:55 < Ionic> It failed to build, mh
18:56 < Ionic> http://permalink.gmane.org/gmane.network.openvpn.devel/4775
18:56 <@vpnHelper> Title: IPV6_RECVPKTINFO vs. IPV6_PKTINFO (at permalink.gmane.org)
19:02 < Ionic> Aww
19:02 < Ionic> This dev shot is broken
19:02 -!- _julian [~quassel@hmbg-5f764d1f.pool.mediaWays.net] has joined #openvpn
19:02 -!- _julian_ [~quassel@hmbg-5f761bcc.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:07 < Ionic> Fixed it(?)
19:10 < Ionic> add net 87.98.244.45: gateway 0.0.0.0: File exists
19:10 < Ionic> Still failing
19:10 < Ionic> Uh sec
19:11 < Ionic> Fuck that
19:11 < Ionic> add net 87.98.244.45: gateway 192.168.178.1
19:11 < Ionic> This dev snapshot is working for me
19:11 -!- Official_Guest [~swg0101@openvpn/user/swg0101] has quit [Ping timeout: 252 seconds]
19:11 < Ionic> Had a few problems compiling it by otherwise works
19:12 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
19:12 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
19:22 < Ionic> Thank you krzee though <3
19:22 < krzee> interesting
19:23 < Ionic> No idea what to do :)
19:23 < Ionic> Well I guess I'll use the older release
19:23 < krzee> why?
19:23 < krzee> may as well use the dev snapshot
19:23 < Ionic> I said I had compile errors :p
19:24 < Ionic> No idea whether my quick and dirty fixes were that good
19:24 < krzee> figured you fixed them since you reported it working ;]
19:24 < krzee> ahh ok
19:24 < Ionic> Sure
19:24 < Ionic> But I don't trust myself :P
19:24 < krzee> well sure, 2.1.4 should be fine =]
19:24 < krzee> and i guess when you see 2.2.2 it should work
19:24 < Ionic> Hope so, I'll stick around :)
19:24 < Ionic> Is there any roadmp>
19:26 < krzee> hard to be 100% sure tho, that snapshot is from the testing branch
19:26 < Ionic> Hm
19:27 < krzee> it has additional features and whatnot that arent in 2.2.1 and wont be in 2.2.2 i think (like --server-ipv6)
19:27 < Ionic> ?
19:27 < krzee> roadmap, im sure there is, but im not up to date with it
19:27 < Ionic> What's that?
19:27 < krzee> i havnt been making the meetings, just got back from vacation
19:27 < krzee> !ipv6
19:27 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
19:27 < Ionic> There's tun-ipv6
19:27 < krzee> right
19:27 < Ionic> But server-ipvy?
19:27 < krzee> it only exists in the snapshots for now
19:27 < krzee> but its coming soonish i think
19:28 < Ionic> Mmh
19:28 < krzee> the semi-recent windows tap adapter update was for supporting that =]
19:28 < krzee> and thats rolled out now
19:28  * Ionic couldn't care less about Windows tbh
19:28 < krzee> so they're making progress twords getting that all in
19:28 < krzee> well sure, but that was such a big update it had to be done before adding the other stuff
19:29 < krzee> touching the windows adapter is kinda scary... if theres a small problem TONS of people will be effected
19:29 < Ionic> lol
19:29 < Ionic> I figure
19:29 < krzee> at least thats what i figure the reason was for doing that first
19:29 < Ionic> But Windows people don't update anyway
19:30 < krzee> ;]
19:30 < krzee> !windows
19:30 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows, or (#2) http://secure-computing.net/files/windows.jpg for funny, or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
19:32 < Ionic> Well ok :)
19:32 < Ionic> Thanks, I'm done for today and going to bed, good night
19:33 < krzee> gnite
20:00 -!- _julian_ [~quassel@hmbg-5f7658b9.pool.mediaWays.net] has joined #openvpn
20:03 -!- _julian [~quassel@hmbg-5f764d1f.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
20:13 -!- takamichi [Takamichi@92.251.127.2] has quit [Ping timeout: 258 seconds]
20:15 -!- blazer6969 [~blazer696@109.129.102.229] has quit [Ping timeout: 240 seconds]
20:16 < krackpot> krzee: I'm back :)
20:17 < krackpot> krzee: I reread the Routing article you linked me yesterday. If I only want my client to access the LAN behind the VPN server (and not both ways), I put: push "route 10.10.2.0 255.255.255.0" in my server config, right?
20:24 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:30 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:43 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 264 seconds]
20:47 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:51 -!- ShiintoRyuu [~shiin@p54A2A697.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
20:53 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
21:00 < krzee> yes, along with some other stuff in the OS
21:00 < krzee> like ip forwarding
21:00 < krzee> and adding a route the the router for that lan
21:00 < krzee> aka:
21:00 < krzee> !serverlan
21:00 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
21:04 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection timed out]
21:11 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
21:17 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 246 seconds]
21:17 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
21:19 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:19 -!- Guest27257 [ionic@ionic.de] has joined #openvpn
21:20 -!- Guest27257 [ionic@ionic.de] has quit [Excess Flood]
21:22 -!- Ionic` [ionic@ionic.de] has joined #openvpn
21:27 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:27 -!- mode/#openvpn [+v Axeman] by ChanServ
21:27 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 246 seconds]
21:28 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:29 < krackpot> krzee: I did a cat /proc/sys/net/ipv4/ip_forward and it returned 1
21:30 < krackpot> Right now the client isn't able to ping the machines behind the VPN. The machines behind the VPN can ping the client though
21:31 < krackpot> !route_outside_openvpn
21:31 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
21:34 -!- wangzhongwei [~wangzhong@114.113.197.132] has joined #openvpn
21:35 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Operation timed out]
21:36 < wangzhongwei> hi all, how to benchmark the max clients openvpn support? 
21:37 < EugeneKay> Lots of VMs.
21:38 < wangzhongwei> could this be done with client emulator ?
21:38 < wangzhongwei> since i have only 2 servers 
21:38 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:41 < EugeneKay> Chances are you're gonna run into bandwidth limits before you hit CPU or ram limits on openvpn
21:41 < EugeneKay> !gigabit
21:41 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
21:45 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
21:46 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 252 seconds]
21:46 -!- caemir_ is now known as caemir
21:49 < wangzhongwei> yes, there are 2 gigabit NICS each installed on my servers, and  i have used iperf do the benchmark, it could be up to 240Mbit/s
21:49 < wangzhongwei> and the cpu usage is 30%~40%
21:50 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
21:50 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
21:50 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
21:51 < wangzhongwei> now i want to benchmark the max clients openvpn support with no bandwidth consided
21:52 < krzie> then make a shitton of clients on your lan
21:55 -!- Ionic` is now known as Ionic
21:56 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
21:56 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 245 seconds]
21:56 -!- caemir_ is now known as caemir
21:57 < wangzhongwei> is there any client emulator i could run on my single client server to do this besides the VMs ?
22:06 < wangzhongwei> or the only way is learn the protocol and write the program myself ?
22:07 < EugeneKay> Just make a bunch of client instances
22:08 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
22:09 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Operation timed out]
22:10 < wangzhongwei> ok, thanks all
22:11 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
22:26 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
22:29 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
22:33 -!- i0x71_ [~i0x71@bas1-richmondhill34-1176124524.dsl.bell.ca] has quit [Ping timeout: 264 seconds]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 245 seconds]
22:34 < krackpot> krzee: I got it to work for the most part. I can access my machines if I just use IP addresses, but if I use hostnames or try to ping, it doesn't get through. Any idea why?
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:39 -!- i0x71 [~i0x71@bas1-richmondhill34-1176124524.dsl.bell.ca] has joined #openvpn
22:41 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
22:54 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:56 -!- Nerezza [~Sen@64.92.187.101] has quit [Quit: Leaving]
23:01 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 240 seconds]
23:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
23:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:04 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
23:20 < EugeneKay> Ping not working is probably firewalling of ICMP. Hostname resolution is pure DNS.
23:32 < krackpot> EugeneKay: Thanks. I'll look into why that's happening
23:33 < krackpot> Should I be specifying the push DNS option?
--- Day changed Tue Aug 30 2011
00:11 -!- samas [4c007f5b@gateway/web/freenode/ip.76.0.127.91] has joined #openvpn
00:11 < samas> ah ha
00:11 < samas> i think i found my channel
00:12 < samas> anyone have a minute to answer some probably dumb questions?
00:16 < EugeneKay> Nope. Past midnight, and I am going to sleep.
00:17 < EugeneKay> You're more likely to get an answer if you actually ask the question, btw.
00:17 -!- EugeneKay is now known as EugeneKaway
00:22 -!- loompek [~noname@kista.rula.net] has joined #openvpn
00:23 < loompek> morning guys
00:24 < loompek> ... and the problem isn't firewall... it's enabled rp_filter on /dev/tun0
00:24 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15121>
00:24 < loompek> :)
00:31 -!- bitterman [~yury@84.51.199.63] has joined #openvpn
00:34 -!- luneff [~yury@84.51.199.63] has quit [Ping timeout: 264 seconds]
01:01 -!- CapnKernel [~mjd@222.248.96.92] has joined #openvpn
01:04 < CapnKernel> Hello OpenVPN folks.  I have a working static key setup (so it's not my firewall, really!) and I'm trying to move to a TLS setup.  When my client connects to the server, I get the message "VERIFY ERROR: depth=1, error=format error in certificate's notBefore field".
01:04 < CapnKernel> I have followed the TLS setup instructions on this page pretty closely: http://openvpn.net/index.php/open-source/documentation/howto.html#pki
01:04 <@vpnHelper> Title: HOWTO (at openvpn.net)
01:04 < CapnKernel> !configs
01:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn., or (#2) dont forget to include any ccd entries
01:08 < CapnKernel> server-side config: http://paste.pocoo.org/show/466891/
01:08 < CapnKernel> client-side config: http://paste.pocoo.org/show/466892/
01:08 < CapnKernel> Server log: http://paste.pocoo.org/show/466893/
01:09 < CapnKernel> Any ideas?
01:09 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
01:10 < reiffert> openssl x509 -in file.crt -noout -text
01:10 < reiffert> bring that online
01:11 < reiffert> ", error=format error in certificate's notBefore field"
01:14 < samas> sorry got distracted. so i want to connect two different networks (in different cities) via OpenVPN on two identical dd-wrt routers. is this a good idea?
01:16 < samas> this is my first dd-wrt router, so the lingo and stuff is pretty foreign. go easy on me plz :)
01:17 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:18 < CapnKernel> reiffert: I have tried that on the server (ca.crt and server.crt) and the client (ca.crt and mao.crt) and both produce normal-looking dumps.  No mention of notBefore.
01:18 -!- swg0101 [~swg0101@openvpn/user/swg0101] has joined #openvpn
01:18 -!- mode/#openvpn [+v swg0101] by ChanServ
01:18 < reiffert> CapnKernel: notBefore should be part of the output.
01:19 < CapnKernel> For which file?
01:19 < reiffert> all
01:19 < CapnKernel> Er, notBefore doesn't occur in any of them.
01:19 < reiffert> letmecheck smth
01:19 < CapnKernel> These certs were built with the instructions in http://openvpn.net/index.php/open-source/documentation/howto.html#pki
01:19 <@vpnHelper> Title: HOWTO (at openvpn.net)
01:20 < reiffert> you already said that.
01:20 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
01:20 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
01:20 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
01:20 < reiffert>             Not Before: Aug 16 15:10:58 2011 GMT
01:21 < CapnKernel> The first file generated in those instructions is ca.crt.  You're saying that "openssl x509 -in ca.crt -noout -text | grep notBefore" should show a line?
01:22 < reiffert> openssl x509 -in ca.crt -noout -startdate
01:22 < reiffert> Nah, thats just what you made of it. |grep -i "before" would be a better approach
01:23 < reiffert> the -startdate is the better.
01:23 < CapnKernel> With -startdate, I'm getting dates.  Without -startdate, no dates
01:23 < CapnKernel> Me: Linux expert, SSL newbie
01:23 < CapnKernel> So let's assume I know nothing :-)
01:24 < CapnKernel> Might this problem be caused by clocks that are out of sync?  Or is it a format error?
01:24 < reiffert> error=format error in certificate's notBefore field".
01:25 < samas> my brain is already hurting...
01:25 < reiffert> samas: thats because a linux "I know everything but I'm too lame to read docs" guy is too stupid to fix his problem.
01:26 < samas> reiffert: i read a bunch of stuff and i still don't understand it
01:27 < reiffert> samas: CapnKernel's certificates contain an invalid "this certificate is not valid before" date.
01:27 < CapnKernel> reiffert: Can you suggest what I might try next?
01:27 < reiffert> CapnKernel: prove openssl to be right here by using openssl verify
01:27 < CapnKernel> The dates are somewhat like this" openssl x509 -in ca.crt -noout -text | grep notBefore
01:28 < CapnKernel> Oops, notBefore=Aug 30 05:12:25 2011 GMT
01:28 < reiffert> CapnKernel: after that throw away stuff and start from the beginning.
01:28 < samas> CapnKernel: he just did, i think. change the not valid before date
01:29 < samas> brb
01:29 -!- samas [4c007f5b@gateway/web/freenode/ip.76.0.127.91] has left #openvpn []
01:29 < CapnKernel> I'm not above reading and learning, but I think it's fair to assume the docs on the openvpn website will yield a working install.
01:29 -!- samas [4c007f5b@gateway/web/freenode/ip.76.0.127.91] has joined #openvpn
01:29 < reiffert> CapnKernel: blaming the docs vs. millions of people who manage to succeed with the help of exactly theses docs?
01:30 < samas> reiffert: do you know much about openvpn on dd-wrt?
01:30 < CapnKernel> So please reconsider my request as less of "why doesn't it work for me", and more of "might there be a problem with the docs and/or s/w?"
01:30 < CapnKernel> reiffert: Should be able to follow the instructions in the HOWTO on key generation and have them work!
01:30 < reiffert> 08:23 < CapnKernel> So let's assume I know nothing :-)
01:30 < CapnKernel> I'd rather not have a fight about this.
01:30 < CapnKernel> Re SSL, it's true. 
01:31 < CapnKernel> Happy to learn, happy to try things.
01:31 < reiffert> again: something fucked your certificates. You dont know what was the cause, you didnt find the right cert yet.
01:31 < reiffert> openssl verify might help you.
01:32 < CapnKernel> Any suggestions on arguments to "openssl verify"?
01:32 < reiffert> http://www.openssl.org/docs/apps/verify.html
01:32 <@vpnHelper> Title: OpenSSL: Documents, verify(1) (at www.openssl.org)
01:32 < CapnKernel> Ok
01:32 -!- Titania [~titania@208.79.15.251] has joined #openvpn
01:33 < reiffert> samas: just follow the wrt howtos for their openvpn implementation. It will work.
01:34 < samas> lol
01:35 < samas> and now i've come full circle
01:35 < CapnKernel> reiffert: verify found a problem with the server cert: http://paste.pocoo.org/show/466904/
01:36 < CapnKernel> "follow howtos, it will work" - I'll cache that
01:36 < reiffert> CapnKernel: so, what you gonna do next?
01:36 < CapnKernel> I will go and generate the keys again, following the instructions in the howto explicitly.
01:36 < reiffert> wrong answer.
01:36 < CapnKernel> Generate the CA cert and the server cert.
01:37 < reiffert> wrong answer.
01:37 < reiffert> openssl x509 -in server.crt -noout -startdate
01:37 < CapnKernel> Throw me a bone here reiffert, as "wrong answer" isn't actually helpful.
01:38 < reiffert> copy pasting two lines cant last that long.
01:38 < reiffert> guess you will find your server.crt to be empty.
01:38 < CapnKernel> I think it is a date problem on my server.
01:39 < reiffert> what comes out when using: openssl x509 -in server.crt -noout -startdate
01:39 < CapnKernel> http://paste.pocoo.org/show/466907/
01:39 < CapnKernel> I'm fairly certain it's a date problem on my server.
01:39 < reiffert> thats in the past, so it should be valid?
01:39 < CapnKernel> You're assuming my server has the right date :-)
01:40 < CapnKernel> As was I (although I at least suggested it as a cause of the problem)
01:40 < CapnKernel> Hint: Ask me what the date on my server is
01:40 < reiffert> invalid format != wrong time
01:42 < CapnKernel> Ok, so what would you suggest I do next, something that isn't "wrong answeR"
01:44 -!- samas [4c007f5b@gateway/web/freenode/ip.76.0.127.91] has quit [Ping timeout: 252 seconds]
01:46 < CapnKernel> reiffert: hi
01:47 < reiffert> hi CapnKernel 
01:47 < CapnKernel> I'm happy to put myself in your hands, as far as diagnosing what the problem is.
01:47 < CapnKernel> What would you suggest I do next?
01:48 < reiffert> rebuild the server.crt
01:48 < reiffert> . ./vars
01:48 < reiffert> ./build-key-server server
01:48 < reiffert> As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter "server". Two other queries require positive responses, "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]".
01:51 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:51 < reiffert> copy paste what the dialog looks like
01:54 < CapnKernel> Ok, when I generate the keys on my PC here, openssl verify says ok.  When I transfer the keys to the server, openssl verify gives the date problem.  The md5sums of the files are the same, and strace confirms the right files are being read.
01:55 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
01:56 < reiffert> great news, it's still something between your server and openssl.
01:56 < CapnKernel> Can I say again I think the problem is that the date on my server isn't right.
01:56 < reiffert> please say it again.
01:56 < CapnKernel> "I think the problem is that the date on my server isn't right."
01:56 < CapnKernel> Right answer, "why, what's the date on your server?"
01:57 < reiffert> that's a question and not an answer.
01:57 < CapnKernel> That's a suggested question for you.
01:57 < reiffert> ah.
01:57 < reiffert> 08:56 < CapnKernel> Right answer, "why, what's the date on your server?"
01:57 < CapnKernel> Can't believe we're having this form of conversation.
01:58 <+swg0101> I wonder if you can use generate these certs from openssl?
01:58 < CapnKernel> It's not a format error, I'm pretty sure of it.
01:58 < CapnKernel> verify is ok on one machine, but not the other.
01:58 < reiffert> result of what I'm awaiting of an self called linux exprt.
01:59 < reiffert> fix the problem. you are the expert. just do it.
01:59 < CapnKernel> Having trouble parsing that reiffert
01:59 < CapnKernel> I'll give it a go
01:59 < reiffert> "why, what's the date on your server?"
01:59 < CapnKernel> [root@catflap vpn1]# date
01:59 < CapnKernel> Tue Jun 14 18:37:30 EST 1927
01:59 < reiffert> 1927 is not a valid date.
01:59 < CapnKernel> You're telling me
02:00 < reiffert> nah, openssl is.
02:00 < CapnKernel> But it seems a little misfeature of openssl to blame the cert file, rather than the date it gets (or can't get) from the system.
02:02 < CapnKernel> Now the openssl verify works ok
02:03 <+swg0101> Aug 30 21:07:01 2011 GMT <-- what about this format?
02:03 < CapnKernel> What's your question?
02:04 < reiffert> CapnKernel: how should openssl know about what's correct and whatnot?
02:04 < CapnKernel> date now gives: Tue Aug 30 07:04:00 GMT 2011
02:05 < CapnKernel> reiffert: The problem is not that openssl isn't prescient enough to know that the date is psycho, the problem is that when fed a garbage date by the OS, it then blamed it on a format error in the cert file, when actually the cert file is just fine.
02:06 -!- samas [4c007f5b@gateway/web/freenode/ip.76.0.127.91] has joined #openvpn
02:06 < CapnKernel> Either "system time is impossible", "could not fetch system time" or even "system time is earlier than notBefore in cert" would be better.
02:06 < CapnKernel> Not "your cert has a format error"
02:06 < reiffert> CapnKernel: I might repeat? How should openssl know what wrong or right?
02:07 < reiffert> CapnKernel: like "openssl asking the system: what is the current date? system says 1927"
02:07 < reiffert> CapnKernel: where in this part should openssl know about "hey, 1927 is stupid!"?
02:07 < CapnKernel> It shouldn't know what's right or wrong, if I tell it 1975, I expect it to take it.  The problem is that in complaining, it fingered the wrong cause.
02:08 < CapnKernel> If you're editing file A, and when you save, it's read-only, and your editor says "Could not save file B", what would you make of that?
02:08 < reiffert> CapnKernel: you dont get my point eh?
02:08 < CapnKernel> The problem isn't that it couldn't save the file, but that it's fingering a problem with file B.
02:08 < reiffert> shall I explain?
02:08 < CapnKernel> If you think it will help.
02:09 < CapnKernel> I know exactly what you mean, but you and I are talking about two different things.
02:09 < reiffert> the software has to decide between user generated input to be wrong, or the system to be wrong.
02:09 < reiffert> why should it choose the system?
02:09 < CapnKernel> Answer me this: Is/was there ever a format error with the certificate file?
02:10 < reiffert> I think that the next step will be looking at the openssl source, especially at X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD
02:19 -!- k4v [~kav@g226091205.adsl.alicedsl.de] has joined #openvpn
02:20 -!- dazo_afk is now known as dazo
02:26 < CapnKernel> I can see why it's happening.   Not easy to fix as there isn't a X509_V_ERR_ERROR_YOUR_SYSTEM_CLOCK_IS_WHACKED constant.  (There only seems to be one constant which can indicate an environmental problem ("X509_V_ERR_OUT_OF_MEM"), apart from the vague "X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD", with the helpful comment of "The application is not happy" :-)
02:27 -!- samas is now known as samas|afk
02:28 < CapnKernel> Thanks for your help, in particular, pointing me to openssl verify.
02:40 < Mowee> Morning peepz
02:43 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
02:44 < CapnKernel> If I start the openvpn server, and no clients have connected, is it usual for there to be a tun0 device?
02:45 < reiffert> dazo: think it's worth adding "BE SURE THAT THE DATE AND TIME ON YOUR SERVER ARE CORRECT" to the howto?
02:45 -!- swg0101 [~swg0101@openvpn/user/swg0101] has left #openvpn []
02:45 <@dazo> mattock: ^^^ do you know who updates the howto?
02:45 <@dazo> [ot] http://www.addedbytes.com/blog/if-php-were-british/
02:45 <@vpnHelper> Title: If PHP Were British - Added Bytes by Dave Child (at www.addedbytes.com)
02:46 <@mattock> reiffert, dazo: which part in HOWTO?
02:46 < reiffert> CapnKernel: again, how should openssl know about a fucked date/time on a host?
02:46 < reiffert> mattock: the part "I created my certs, now they dont work as expected, because my computer clock is set to 1927"
02:47 <@mattock> ah, ok
02:47 <@mattock> -> TODO
02:47 < CapnKernel> mosdef
02:47 < CapnKernel> Actually, not really fixable
02:47 < CapnKernel> Just a little misleading
02:47 <@dazo> CapnKernel: it's normal that the tun/tap devices are created when openvpn is started, not later
02:47 < CapnKernel> If 10 clients are connected, how many devices would you expect to see?
02:49 -!- bui [~bui@public.nbs-system.com] has joined #openvpn
02:49 < reiffert> CapnKernel: depends on your layout.
02:49 < reiffert> CapnKernel: say one per openvpn server.
02:50 <@mattock> reiffert: HOWTO update is on my TODO, will fix it soon
02:50 < reiffert> CapnKernel: say "thank you" to mattock 
02:51 < CapnKernel> Thanks to both of you.
02:51 -!- Titania [~titania@208.79.15.251] has quit [Quit: Will return someday...]
03:00 <@mattock> CapnKernel: you're welcome
03:00 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 260 seconds]
03:00 < CapnKernel> Ok, now the problem is my firewall :-)
03:02 < CapnKernel> I can ping from the client to the server, but can't ping from the client to a machine on the same subnet as the server.  tcpdump shows the packet coming into the server, and when it goes onto the ethernet, it hasn't been natted.
03:02 < CapnKernel> My OpenVPN address range is 10.20.40.0/24.  The iptables command is iptables -t nat -A POSTROUTING -s 10.20.40.80/29 -o eth0 -j MASQUERADE
03:02 < reiffert> CapnKernel: the computer on the server-lan
03:02 < CapnKernel> Does that look right?
03:02 < reiffert> CapnKernel: it will send the reply to it's gateway
03:02 < reiffert> CapnKernel: which doesnt know anything about the openvpn subnet.
03:03 < CapnKernel> It will go to the gateway if the destination is not on the subnet
03:03 < reiffert> CapnKernel: means: you'll have to add a static route on the gateway of the openvpn server.
03:03 < CapnKernel> But natting should make it appear as if the packet originated from the server
03:03 < reiffert> CapnKernel: e.g. route add -net 10.20.40.0/24 gw LANIPOFTHEOPENVPNSERVER
03:04 < reiffert> (or appropriate, depending on the gw OS)
03:04 < CapnKernel> I would do that if I didn't want to NAT the VPN clients to the VPN server.
03:04 < CapnKernel> But I do want to NAT the VPN clients to the server, so that machines other than the server think the packets originated from the server.
03:05 < CapnKernel> In that case, it's a subnet trip, and no gateways need be involved.
03:05 < reiffert> why is that?
03:05 < CapnKernel> (This worked with the static key setup)
03:05 < CapnKernel> Why is what?
03:05 < reiffert> why is you wanna use NAT instead of plain routing?
03:06 < reiffert> so far it looks like "because it worked"
03:06 < CapnKernel> "reasons"
03:06 < CapnKernel> The subnet the server is on doesn't need to know about the VPN clients
03:06 < reiffert> you are one step from a working solution. either enable nat on the openvpn server, or add a static route on your server's lan gateway.
03:07 < CapnKernel> I want to enable NAT on the VPN server.  Does this command look reasonable?  iptables -t nat -A POSTROUTING -s 10.20.40.80/29 -o eth0 -j MASQUERADE
03:07 < reiffert> to my mind, routing makes it easier when tracking down problems.
03:07 < reiffert> 10.20.40.0/24
03:07 < reiffert> instead of 80/29
03:07 < CapnKernel> Ahh.
03:08 < reiffert> (from what you said earlier)
03:08 < CapnKernel> Actually, that's what I did, just copied and pasted from the wrong place.
03:08 < CapnKernel> iptables -t nat -A POSTROUTING -s 10.20.40.0/24 -o eth0 -j MASQUERADE
03:09 < CapnKernel> Server side config: http://paste.pocoo.org/show/466891/
03:09 < reiffert> ok, then it works now. it does not?
03:10 < reiffert> !linnat
03:10 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
03:11 < reiffert> tcpdump -n -i eth0 net 10.20.40.0/24
03:11 < reiffert> shouldnt show up anything
03:13 < CapnKernel> http://paste.pocoo.org/show/466977/
03:15 < reiffert> btw, your date/time settings on that host are still wrong.
03:15 < reiffert> or differ from what you said earlier.
03:15 < reiffert> 09:04 < CapnKernel> date now gives: Tue Aug 30 07:04:00 GMT 2011
03:15 < CapnKernel> Why wrong?
03:15 < CapnKernel> It's 18:12 local time where the server is.
03:16 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has joined #openvpn
03:16 < reiffert> however, your NAT doesnt seem working then.
03:16 < CapnKernel> Ahh, I think I have found the problem.
03:17 < reiffert> restart the ping (stop and enter the same line again)
03:17 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:17 < Ionic> Hmmm
03:18 < CapnKernel> Do I need a FORWARD rule as well as the MASQ rule?
03:18 < reiffert> CapnKernel: there should already be one, else you wouldnt see packets on eth0.
03:19 < CapnKernel> True.  I had one and took it out as I thought it was the cause of the problem.  I'll put it back in.
03:20 < reiffert> CapnKernel: just restart that ping line. I've seen NAT on linux only working when the sequence numbers start with 1 again, that is restart the ping.
03:20 < reiffert> as there is no state ESTABLISHED for ICMP.
03:21 < reiffert> in your paste you are at sequence 941 and ongoing, just restart the damn ping.
03:21 < CapnKernel> I see.
03:21 < CapnKernel> Yes, restarting the damn ping helps.
03:22 < reiffert> wasted another 5 minues.
03:22 < krzie> [04:22]  <reiffert> CapnKernel: just restart that ping line. I've seen NAT on linux only working when the sequence numbers start with 1 again, that is restart the ping.
03:22 < krzie> omg i think you just told me a problem i have seen
03:22 < krzie> in fact recently ran into
03:23 < krzie> <3 reif
03:23 < reiffert> it just sucks.
03:23 < CapnKernel> Maybe not wasted after all.  I don't think I've ever said "wasted another 5 mins" to anyone I've helped in IRC.
03:23 < reiffert> !linnat
03:23 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>, or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info, or (#4) openvz see !openvzlinnat
03:23 < CapnKernel> If they knew what they were doing, they wouldn't come to IRC in the first place.
03:23 < reiffert> !learn linnat as be sure to restart your ping if that is what you run for testing
03:23 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
03:24 < krzie> ohh
03:24 < krzie> i see what you mean
03:24 < krzie> if thats what you're testing... right
03:24 < krzie> i thought you meant i could kickstart it by starting a ping
03:25 < reiffert> krzie: ping is running ... adding NAT ... ping requests dont traverse the nat/POSTROUTING chain.
03:26 < krzie> if i boot the router (which connects to the vpn) with devices hooked up that communicate to the vpn ip, when it connects to the vpn the packets show up with a src ip of eth0 because my script to add firewall rules isnt up yet
03:26 < Ionic> krzie :o
03:26 < reiffert> krzie: restarting ping means sequence numbers start at "1" (or 0?) again, nat catches
03:26 < krzie> solution is easy enough, boot it without stuff plugged in that does that
03:26 < krzie> hehe
03:26 < Ionic> Did anyone answer yet?
03:26 < CapnKernel> Call me crazy, but I'll assume this is the "help with openvpn" channel not "abuse for not knowing enough yet", so I'll ask another question.
03:27 < krzie> Ionic, answer what
03:27 < reiffert> CapnKernel: "you are crazy".
03:27 < Ionic> krzie: dunno, you said you pinged the devs
03:27 < reiffert> Ionic: you last question was: 02:27 < Ionic> But server-ipvy?
03:27 < CapnKernel> reiffert: :-)
03:27 < Ionic> reiffert: so?
03:27 < krzie> weird, i wasnt in the dev chan... wonder when i mis-clicked out of there
03:28 < reiffert> Ionic: Was that a "yes/no" question?
03:28 < Ionic> reiffert: no
03:28 < reiffert> Ionic: "maybe".
03:28 < krzie> Ionic, you should open a trac ticket and then they'll definitely answer
03:28 < krzie> !trac
03:28 <@vpnHelper> "trac" is (#1) see http://community.openvpn.net for development information and bug tracker., or (#2) if you have a forum login, use that for trac, its the same database
03:28 < Ionic> reiffert: I found a bug in OpenVPN 2.2.x, not in 2.1.4 or testing-snapshot though
03:28 < krzie> same login/pass as the forum if you are on that
03:28 < Ionic> Nah
03:28 < Ionic> Oh
03:28 < Ionic> It works ;P
03:29 < CapnKernel> I have several dozen IP addresses which need to be routed through the VPN, and I want to push them to clients.  These IP address come from resolving hostnames using DNS.  But DNS records change from time to time.
03:29 < CapnKernel> What's a good way of maintaining a list of IP addresses on the server for pushing out to the clients?
03:29 < reiffert> Ionic: ah. will it hurt?
03:29 < Ionic> HTTPS helps :)
03:29 < krzie> hahah
03:29 < Ionic> reiffert: will what hurt? The bug?
03:29 < CapnKernel> Is there some kind of #include mechanism I can use to include a file of IP addresses?
03:29 < reiffert> Ionic: the bug, yeah
03:29 < krzie> !forget trac *
03:29 <@vpnHelper> Joo got it.
03:29 < Ionic> It's probably restricted to Mac OS X anyway
03:29 < reiffert> Ionic: I'm on OS X..
03:29 < krzie> !learn trac as see http://community.openvpn.net for development information and bug tracker.
03:29 <@vpnHelper> Joo got it.
03:29 < Ionic> It can't get the default gateway but instead uses 0.0.0.0
03:30 < krzie> !learn trac as if you have a forum login, use that for trac, its the same database.
03:30 <@vpnHelper> Joo got it.
03:30 < Ionic> So unless you want to redirect your gateway (redirect-gateway) you're fine
03:30 < reiffert> Ionic: be sure to not use tunnelblick for testing.
03:30 < reiffert> Ionic: because it comes with it's own itelligence, which just sucks and the author refuses to fi.
03:30 < reiffert> x
03:30 < krzie> hah *facepalm*
03:30 < Ionic> reiffert: I did use Tunnelblick's openvpn binary for testing (2.1.4) and the version included in MacPorts (2.2.0 and upgraded the Portfile manually to 2.2.1 too)
03:30 < krzie> !forget trac *
03:30 <@vpnHelper> Joo got it.
03:30 < krzie> !learn trac as see https://community.openvpn.net for development information and bug tracker.
03:30 <@vpnHelper> Joo got it.
03:31 < krzie> !learn trac as if you have a forum login, use that for trac, its the same database.
03:31 <@vpnHelper> Joo got it.
03:31 < Ionic> Andthe testing-snapshot was compiled from source by hand
03:31 < CapnKernel> What's a good way of maintaining a list of IP addresses on the server for pushing out to the clients?
03:32 < krzie> in ccd files or using a client-connect script
03:32 < krzie> !client-connect
03:32 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
03:32 < CapnKernel> thanks
03:32 < krzie> np
03:32 < CapnKernel> I assume the scripts are openvpn scripts, not shell scripts
03:32 < krzie> nope
03:32 < krzie> shell,perl,whatev
03:33 < CapnKernel> OpenVPN's "route" command will do this portably.  How can I do it portably using ccds?
03:34 < krzie> wait what?
03:34 < krzie> didnt you say ips to push to clients?
03:34 < krzie> i would assume that means static ips
03:34 < CapnKernel> Yes, for routing through the VPN
03:34 < krzie> what are you really trying to do?
03:34 < CapnKernel> Yes
03:35 < krzie> a static ip and a route are not the same thing
03:35 < krzie> actually sorry, i gotta run, gotta get my side done before my partner gets back home
03:35 < krzie> but what i said was for static ips, not adding routes
03:35 < CapnKernel> At the highest level?  I live in China.  Certain sites cannot be reached from within China, so I have a VPN from my home in China to my home in Australia.  What I usually do is do an nslookup on the hostname, and feed that info into a static route pointing at the tunnel
03:36 < krzie> although that script could push routes as well, since they're valid in ccd context
03:36 < krzie> just default route through australia
03:36 < Ionic> CapnKernel: why don't you just feed
03:36 < Ionic> Right
03:36 < krzie> !redirect
03:36 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server., or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
03:36 < CapnKernel> I don't want to send all traffic through the VPN.
03:36 < krzie> heh
03:36 < CapnKernel> It's only a small subset that needs to go through the VPN.
03:36 < Ionic> krzie: probably his australia IP will be banned
03:37 < krzie> then you can do it with the route command on the client, or push route command from the server
03:37 < Ionic> If there's too much weird encrypted traffic
03:37 < CapnKernel> Unlikely, but the ARM processor back home running OpenVPN will melt.
03:37 < Ionic> Oh :p
03:37 < krzie> get a fan for it
03:37 < Ionic> well it's china so... idk
03:37 < krzie> or a better one
03:37 < CapnKernel> I'm not saying literally melt.
03:37 < CapnKernel> I'm saying the box is quite underpowered.
03:38 < krzie> [04:39]  <krzie> or a better one
03:38 < CapnKernel> Yes, I am doing push routing.  Can I put the push routes in a second file that gets #included or similar?
03:38 < krzie> anyways, the answer is above
03:38 < krzie> bbl =]
03:38 < CapnKernel> What you're saying isn't practical, however much fun it might be to say.
03:39 < CapnKernel> I mean, I can always use awk or something like that to regenerate the server config file.
03:39 < CapnKernel> One way of doing it.
03:39 < CapnKernel> Just hoped there was some sort of include file mechanism where the included file was still in OpenVPN syntax
03:39 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
03:39 < CapnKernel> As then the pushed routes are portable.
03:40 < reiffert> there is.
03:41 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
03:41 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
03:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
03:41 < CapnKernel> Would you like to suggest where I can look to learn about it, or are you just going to tease me?
03:41 < reiffert> CapnKernel: read up what krzie told you on the last 30-50 lines.
03:42 < CapnKernel> He told me (amongst other things) to get a better computer.
03:42 < reiffert> 10:31 < CapnKernel> What's a good way of maintaining a list of IP addresses on the server for pushing out to the clients?
03:42 < reiffert> 10:32 < krzie> in ccd files or using a client-connect script
03:42 < reiffert> 10:32 < krzie> !client-connect
03:42 < CapnKernel> He told me the client connect files are not in OpenVPN format, and hence are not portable.
03:42 < CapnKernel> I mean, nice mechanism, but not what I want.
03:42 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Ping timeout: 255 seconds]
03:43 < reiffert> !ccd
03:43 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
03:43 < CapnKernel> Ok great
03:47 -!- takamichi [Takamichi@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
03:48 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
03:52 < CapnKernel> Next dumb question!  When the VPN connection is initiated, is it possible to have openvpn rewrite /etc/resolv.conf to a particular IP address?  (The man page says --dhcp-option is Windows-only)
03:55 < CapnKernel> China fiddles with DNS results, so the local DNS servers are completely useless.
04:00 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
04:01 -!- Ionic [ionic@ionic.de] has joined #openvpn
04:03 < reiffert> CapnKernel: has to be done by a script running on the client, after connection succeeds
04:03 < reiffert> CapnKernel: most linux distros come with such a script
04:03 < reiffert> !factoids search --values resolv
04:03 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client, or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns, or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit, or (#4) in unix you'll use the update-resolv-conf script, or (#5) also
04:03 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
04:03 < CapnKernel> Thank you.
04:03 < reiffert> see #4
04:04 < CapnKernel> Great, thank you.
04:06 < CapnKernel> I have to go, thanks for your help.
04:06 < reiffert> # up /etc/openvpn/update-resolv-conf
04:06 < reiffert> # down /etc/openvpn/update-resolv-conf
04:06 < reiffert> you are welcome
04:10 -!- CapnKernel [~mjd@222.248.96.92] has quit [Quit: Leaving.]
04:10 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
04:14 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
04:16 -!- CapnKernel [~mjd@222.248.96.92] has joined #openvpn
04:17 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Read error: Operation timed out]
04:21 -!- CapnKernel [~mjd@222.248.96.92] has quit [Quit: Leaving.]
04:28 -!- CapnKernel [~mjd@222.248.96.92] has joined #openvpn
04:33 -!- Slashman [~Slash@hydra.fimasys.com] has quit [Ping timeout: 260 seconds]
04:33 -!- ShiintoRyuu [~shiin@p54847A19.dip.t-dialin.net] has joined #openvpn
04:34 -!- CapnKernel [~mjd@222.248.96.92] has quit [Ping timeout: 258 seconds]
04:37 -!- noname [~noname@kista.rula.net] has joined #openvpn
04:37 -!- noname is now known as Guest30002
04:38 -!- loompek [~noname@kista.rula.net] has quit [Ping timeout: 255 seconds]
04:42 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:43 -!- Guest30002 [~noname@kista.rula.net] has quit [Ping timeout: 255 seconds]
04:49 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:52 -!- Slashman [~Slash@hydra.fimasys.com] has joined #openvpn
05:00 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15122>
05:05 -!- dazo is now known as dazo_afk
05:05 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p15126> || WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15125> || Learning to programme OpenVPN <http://forums.openvpn.net/topic8724.html#p15124> || Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html#p15123>
05:08 -!- Slashman [~Slash@hydra.fimasys.com] has quit [Ping timeout: 246 seconds]
05:12 <@vpnHelper> RSS Update - forum: Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html#p15129> || Learning to programme OpenVPN <http://forums.openvpn.net/topic8724.html#p15128>
05:18 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p15130>
05:21 -!- sppadic [~sppadic@193.130.68.17] has joined #openvpn
05:34 -!- ShiintoRyuu [~shiin@p54847A19.dip.t-dialin.net] has left #openvpn ["Textual IRC Client: http://www.textualapp.com/"]
05:48 -!- loompek [~noname@kista.rula.net] has joined #openvpn
05:50 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
05:50 -!- mode/#openvpn [+v Axeman2] by ChanServ
05:51 -!- xcke [2e1cd886@gateway/web/freenode/ip.46.28.216.134] has joined #openvpn
05:51 < xcke> Hi
05:52 < xcke> Can someone help me in questions regarding the networking part of OpenVPN?
05:53 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
05:53 < Onepamopa> krzee dude, any ideas on how to enable tcp_nodelay ?
05:53 < Onepamopa> setsockopt TCP_NODELAY=1 failed (No kernel support)
05:55 < xcke> So the question: I have 120 terminals, which are connected to a central server through Narrow band VSAT satelite connection (globally 140Kbps inbound, 200Kbps outbound). They use openvpn to provide security for the communication.
05:56 < xcke> In normal case, the terminals has got not too much traffic, so the system is working
05:56 < xcke> but if I have a failure in the core, every terminal will reconnect
05:56 < xcke> the traffic, to establish 120 VPN Tunnel is too much
05:56 < xcke> so we will have a hub congestion.. 
05:57 < xcke> As I read, we have several timeout and restransmission parameters
05:57 -!- dazo_afk is now known as dazo
05:58 < xcke> what I would like to solve, is to somehow prevent the congestion.. and stretch the Tunnel establishment in time
06:01 < xcke> by the way... the media is Aloha based :-)
06:03 < xcke> any developer here?
06:12 < xcke> !staff
06:14 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
06:18 -!- tinuro [~tinuro@mail.xnt.ro] has joined #openvpn
06:18 < tinuro> can someone help me with auth_pam
06:19 < tinuro> i need to modify this plugin to check that USERNAME = CommonName
06:21  * tinuro slaps cron2 around a bit with a large trout
06:22 -!- Axeman2 is now known as Axeman
06:25 < tinuro> !config
06:25 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
06:29 <+Axeman> xcke, do you have the openvpn-as ?
06:32 < xcke> I don't know
06:32 < xcke> I don't have access to the server
06:33 <+Axeman> you have the community version?
06:34 < tinuro> Is in here any programmer?
06:36 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15131>
06:43 < defswork> xcke, add some non-working MX records
06:44 < defswork> they will cause clients to connect randomly to the non-working MX IPs, which will add a delay till when they find the valid IP
06:44 < defswork> MX ?
06:44 < defswork> ffs I meant DNS
06:45 < defswork> brainphart
06:46 < defswork> xcke, if you have 4 NS recorsd for vpn.example.com and only one works, only 25% will connect to the correct IP initially, while the others try the other 3, then 33% of the remaining 75% will try the correct IP and so on
06:46 < defswork> I'm not sure how long the client will hang on the invalid IPs - depends what's there I guess and if it REJECTs
06:47 < defswork> but it might be enough to help your bandwidth out
06:47 < defswork> otherwise you can only change the keep alive settings to be different per client
06:48 < defswork> but that will require per client changes
06:52 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
06:52 < defswork> (assuming your client config specifies host by name and not IP)
06:53  * defswork taps the screen
06:53 <@vpnHelper> RSS Update - forum: AUTH-PAM verify if CN = USERNAME <http://forums.openvpn.net/topic8727.html>
06:54 < xcke> i will be back soon..
06:54 < defswork> ooo a more polite terminator
06:57 <+Axeman> lol
06:58 -!- CapnKernel [~mjd@183.17.60.63] has joined #openvpn
07:04 < tinuro> so.. one time more... IS IN HERE SOMEONE WHO CAN MODIFY "AUTH-PAM" PLUGIN?
07:04 < defswork> tinuro, CN isnt available in authentication
07:04 < defswork> and shouting about it isnt going to win you many favours
07:05 -!- Slashman [~Slash@hydra.fimasys.com] has joined #openvpn
07:05 < defswork> tinuro, look into the --username-as-common-name option and see where you can go with that - possibly in a learn-address script
07:05 < defswork> CN is passed to that but username isnt
07:06 < Onepamopa> any dev online ?
07:06 < defswork> so you could verify that the CN has a matching cert
07:06 < Onepamopa> bug report ;)
07:07 < Onepamopa> OS: FreeBSD 8, net.inet.tcp.delayed_ack: 1 (meaning tcp_nodelay is enabled), tcp_nodelay option enabled @ server config
07:08 < Onepamopa> setsockopt TCP_NODELAY=1 failed (No kernel support)
07:08 < Ionic> Well
07:08 < Onepamopa> just talked with the guys @ freebsd
07:08 < Onepamopa> ....
07:08 < Ionic> I had this yesterday too
07:08 < Ionic> On Mac OS X
07:09 < Onepamopa> <Onepamopa> then what the ....
07:09 < Onepamopa> <gongoputch> because the OVPN devs made assumptions
07:09 < ecrist> ?
07:09 < tinuro> I use chroot and user priv drop
07:09 < Ionic> Right..?
07:10 < tinuro> so I need that plugin to do that
07:10 < ecrist> Onepamopa: what's your problem?
07:10 < tinuro> if i user only priv drop ... i can use the openvpn-2.2.1/sample-scripts/ucn.pl
07:11 < tinuro> so... u don;t have right... if this script who came with distro can do that on AUTHENTICATION ...
07:12 < defswork> tinuro, I don't think anyone has a clue what you are trying to do
07:12 < tinuro> defswork : so what I say is ok
07:12 < Onepamopa> ecrist the problem is that with enabled tcp_nodelay @ freebsd kernel and option tcp_nodelay @ openvpn server config
07:12 < defswork> tinuro, you seem to have decided how you want to solve whatever is wrong and now want someone to do it for you ?
07:12 < Onepamopa> it says that there's no kernel support
07:13 < Onepamopa> = it doesnt detect it right, => it doesnt use it
07:13 < Onepamopa> and that as u know has to be used in case of tcp<->tcp tunnel
07:14 < tinuro> defswork: i have CHROOT+USER PRIVs ; when the user connect the AUTH-PAM ask for USER-PASS ; i need to verify if USER=CN (like this openvpn-2.2.1/sample-scripts/ucn.pl)
07:14 -!- gr [~gr@91.179.35.164] has joined #openvpn
07:14 < gr> hi everyone
07:14 < tinuro> defswork: i don;t know perl and programming
07:14 < gr>  I have an issue, with openvpn bridged 
07:15 < gr>  I have issues with arp traffic
07:15 < gr>  From a user connected to the vpn, i can only reach the openvpn server
07:16 < gr> everything seems to be going on the right interface
07:16 < gr> i tryed a tcpdumps
07:16 < tinuro> defswork:
07:17 < tinuro> -------
07:17 < tinuro> # OpenVPN --auth-user-pass-verify script.
07:17 < tinuro> # Only authenticate if username equals common_name.
07:17 < tinuro> # In OpenVPN config file:
07:17 < tinuro> #   auth-user-pass-verify ./ucn.pl via-env
07:17 < tinuro> ----------
07:17 -!- tinuro was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
07:17 < defswork> \o/
07:17 -!- tinuro [~tinuro@mail.xnt.ro] has joined #openvpn
07:17 < Onepamopa> defswork so, what do u think? ;)
07:18 < ecrist> Onepamopa: post a bug and how to reproduce/test
07:18 < ecrist> !trac
07:18 < Onepamopa> ecrist where do I post it?
07:18 <@vpnHelper> "trac" is (#1) see https://community.openvpn.net for development information and bug tracker., or (#2) if you have a forum login, use that for trac, its the same database.
07:19 < Onepamopa> okay
07:19 < tinuro> ecrist: can you help?
07:20 -!- kokozedman [b89a3c62@gateway/web/freenode/ip.184.154.60.98] has joined #openvpn
07:20 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:20 < kokozedman> hey guys, i'm new to openvpn and i would like to know, if it is possible to use openvpn to sit behind multiple IP addresses for a single server, and access it from the one client but multiple links (like several modems) and combine both endpoints to a single tunnel?
07:21 < kokozedman> the idea is that the server has several public IP addresses and i have 3 lower speed modems and i want to combine their bandwidth through tunneling
07:21 < defswork> how are you going to aggregate the traffic over the 3 modems on one client ?
07:23 < kokozedman> defswork: that is actually possible, and i was about to start coding the solution and i was wondering if openvpn has such a kind of feature
07:23 < kokozedman> defswork: the core is just about switching packets one by one through the 3 modems
07:23 < kokozedman> but i don't want to reinvent the wheels if other projects already does this
07:24 < defswork> bonded nics
07:24 < defswork> I didn't think people used modems anymore though
07:24 < kokozedman> defswork: i'm not really experienced in that area, but modems don't provide Ethernet-capable interfaces.... they are ppp links
07:25 < defswork> ppp gives you a ppp0 device
07:25 < defswork> you should be able to bond ppp0, ppp1, ppp2
07:27 < Onepamopa> ecrist https://community.openvpn.net/openvpn/ticket/158
07:27 < Onepamopa> here u go
07:27 <@vpnHelper> Title: #158 (TCP_NODELAY not detected properly on FreeBSD 8.0-RELEASE-p6) – OpenVPN Community (at community.openvpn.net)
07:27 < tinuro> defswork: if he use a default GW with nexthop
07:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
07:30 -!- loompek [~noname@kista.rula.net] has quit [Read error: Connection reset by peer]
07:33 < gr> Anyone knowing something about openvpn bridged mode and issues with arp
07:36 -!- k4v [~kav@g226091205.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
07:36 <@vpnHelper> RSS Update - forum: AUTH-PAM verify if CN = USERNAME <http://forums.openvpn.net/topic8727.html#p15133>
07:36 < gr> don't be afraid if you have an experience about openvpn bridging
07:49 < CybDev> what kind of issues?
07:52 < gr> i have issues with arp request
07:53 < gr> when i try to ping from one ip assigned by the openvpn server i can only ping it
07:53 < gr> when i tcpdump the interfaces everything is going out correctly
07:53 <@vpnHelper> RSS Update - forum: Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html#p15134>
07:53 < gr> but nothing comes back
07:54 < gr> i set the proxy_arp to 1
07:54 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
07:54 < gr> but nothing changed
07:55 < CybDev> can you ping the target from the openvpn server?
07:55 < gr> yes
07:56 < gr> and the server I ping receives the arp requests
07:57 < xcke> rere
07:57 < CybDev> and it does not respond?
07:57 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5]
07:58 < gr> my openvpn server doesn't reiceve anything
07:59 < CybDev> you did bridge the interfaces correctly?
07:59 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15135>
07:59 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:00 -!- i0x71 [~i0x71@bas1-richmondhill34-1176124524.dsl.bell.ca] has left #openvpn []
08:00 < gr> what do you mean
08:00 < xcke> Can someone explain me deeply the --tls-timeout parameter?
08:01 < CybDev> or are you trying to ping through 2 clients connected to the openpvn server?
08:02 < gr> only one client
08:02 < CybDev> so you bridged say tap0 with eth0 on the server?
08:02 < gr> br0 with eth0
08:03 < CybDev> and tap0?
08:03 -!- CapnKernel [~mjd@183.17.60.63] has quit [Quit: Leaving.]
08:05 < CybDev> i take it you didn't
08:05 < CybDev> see http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html
08:05 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
08:05 < CybDev> especially sample-scripts/bridge-start
08:06 < gr> well it's exactly the same configuration
08:06 < gr> i used this documentation to configure my vpn
08:06 < CybDev> then the bridge will not just consist of eth0
08:07 < CybDev> brctl should also list your tap device as a member of br0
08:08 < CybDev> but then if you dont actually _need_ bridging people here say you should go with the routed option and possibly topology=subnet
08:08 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
08:10 -!- jel [~jel@93-97-248-235.zone5.bethere.co.uk] has joined #openvpn
08:10 <@vpnHelper> RSS Update - forum: Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html#p15136>
08:10 < gr> i need bridging
08:11 < defswork> same subnet at each end ?
08:11 < jel> Traffic over my vpn to the server is currently showing as coming from my DSL IP.  Anyone know how I can set the source ip on the default route that gets setup?
08:11 < gr> yes
08:12 < gr> it's the same subnet
08:12 < gr> and the ip are dedicated to the vpn
08:12 < gr> i have 40 ips for my openvpn
08:16 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:16 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720.html#p15137>
08:17 < jel> essentially I just want to do "ip route replace $vpn_subnet via $vpn_ip src $vpn_ip" on the network connection as or just after it comes up, but the cleanest way would be best
08:18 < jel> wait, my routes already have this: 10.8.0.1 dev tun0  proto kernel  scope link  src 10.8.0.2
08:18 < jel> so why is my fw showing src as my dsl?
08:19 < CybDev> are you NAT'ing?
08:19 < gr> bridging needs nating?
08:19 < jel> nope
08:20 < CybDev> gr: was for jel 
08:21 < CybDev> jel: what do you mean "traffic over your vpn to the server"?
08:21 < jel> It would show in iptables -L -n -v as MANGLE-something-or-other if I was, right?
08:21 < defswork> jel, got any firewall rules on that box at all ?
08:21 < gr> ok soz
08:21 < defswork> I think you might have an overzealous nat rule somewhere
08:21 < jel> defswork, yes, I'm running ferm
08:21 < CybDev> iptables -L -v -t nat
08:21 < CybDev> too
08:21 < defswork> jel, iptables-save is best way to view
08:21 < jel> prerouting and postrouting are both empty, with -t nat
08:22 < jel> the ferm config is pretty straightforward, default drop, accept some stuff.  I do have forwarding enabled.
08:22 < jel> on the server
08:22 < jel> no fw on the client
08:23 < jel> could it be a software layer thing?
08:23 < jel> other stuff seems to work ok
08:23 -!- xcke [2e1cd886@gateway/web/freenode/ip.46.28.216.134] has quit [Quit: Page closed]
08:23 < jel> this is for xtreemfs though
08:24 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:25 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
08:26 -!- Axeman [~Axeman3@knox.pace.edu] has joined #openvpn
08:26 -!- Axeman [~Axeman3@knox.pace.edu] has quit [Changing host]
08:26 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:26 -!- mode/#openvpn [+v Axeman] by ChanServ
08:28 <@vpnHelper> RSS Update - forum: Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html#p15138>
08:29 < jel> The weird thing is, ip route get 10.8.0.1 says "10.8.0.1 dev tun0  src 10.8.0.2", and I'm not on a directly connected DSL modem; it's through a router via eth0.
08:33 < defswork> jel so this is incoming traffic from client has source address of DSL and not VPN ?
08:33 < defswork> I'd double check what's telling you that because it can't be correct - client's wouldn't get a reply
08:33 -!- nixusr_ [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
08:33 -!- nixusr_ [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
08:33 -!- nixusr_ [~nixusr@unaffiliated/nixusr] has joined #openvpn
08:33 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 260 seconds]
08:33 -!- nixusr_ is now known as nixusr
08:34 < jel> defswork, yes.  Actually it has the public IP for the server as well, so I think what's happening is that the server software is referring the client to its public IP(!)
08:34 < defswork> software ?
08:35 < defswork> so same service is accessible on public IP too ?
08:35 < defswork> and your software is redirecting to that 
08:35 < defswork> so you would see initial request only as vpn ip
08:36 < jel> defswork, no, the server is on openvpn, but I think it's connecting over openvpn, and being told to do subsequent connections via the default server IP, and so hits the firewall
08:36 < defswork> told ?
08:38 < jel> defswork, yeah, complex server that would direct the client on which other servers to contact for various services etc.
08:38 < defswork> you mean some bespoke app ? not tcp ?
08:39 < jel> defswork, xtreemfs
08:39 < jel> defswork, distributed filesystem
08:39 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720-15.html#p15139>
08:44 < jel> fwiw, that was it: had to set "hostname" in the xtreemfs service config files so it handed the right ones to clients
08:55 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit []
09:00 -!- 92AAD5TJP is now known as sno-
09:01 -!- jel [~jel@93-97-248-235.zone5.bethere.co.uk] has quit [Quit: Ex-Chat]
09:02 -!- master_of_master [~master_of@p57B532C1.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:04 -!- Ad0 [~ad0@callstack.info] has joined #openvpn
09:04 < Ad0> hey
09:04 -!- master_of_master [~master_of@p57B522CF.dip.t-dialin.net] has joined #openvpn
09:08 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:08 -!- mode/#openvpn [+v s7r] by ChanServ
09:08 -!- k4v [~kav@g226091205.adsl.alicedsl.de] has joined #openvpn
09:10 < ecrist> it's for horses, cows like it too
09:12 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720-15.html#p15140>
09:13 -!- Rumo666 [~Rumo666@p57A4BD35.dip.t-dialin.net] has joined #openvpn
09:19 < Ad0> is access server like a user friendly version?
09:26 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
09:26 -!- Rumo666 [~Rumo666@p57A4BD35.dip.t-dialin.net] has quit [Quit: Verlassend]
09:31 -!- CapnKernel [~mjd@183.17.60.63] has joined #openvpn
09:34 < defswork> isn't it more like a pay for this version ?
09:35 <+Axeman> sorry to say - i think -as is easier to use than community ?:-x
09:36 < defswork> doesn't that depend on the level of the user ?
09:36 <+Axeman> for being a linux know nothing - i got it working, with certificates, and logins in under 30 minutes. 
09:36 <+Axeman> but then again, i used the esxi version. which is just plain easy
09:36 <+Axeman> and yes - i'm sure someone with more experience would be able to do the regular version
09:38 < defswork> well I'm saving my company over 40k a year when we roll out openvpn
09:39 < defswork> for that much there's an incentive to learn
09:39 < defswork> to be honest I've no idea what -as offers
09:40 < defswork> is it just a web interface on top of std openvpn configs ?
09:41 <+Axeman> + support
09:41 <+Axeman> really - 40K 
09:41 <+Axeman> wow 
09:41 < defswork> Axeman, thats what I said when I heard
09:41 <+Axeman> i thought their $10 per license or w/e it was is cheap
09:41 < defswork> was originally told it was 20k
09:41 < defswork> this is some commercial crap with a token generator
09:42 < defswork> no user can use - they all have their credentials in a text file on their desktop
09:42 <+Axeman> ?
09:42 < defswork> if they idle for a while they have to reconnect - which means new token....
09:43 <+Axeman> not true
09:43 <+Axeman> i use it all day long - and never have to reconnect.
09:43 <+Axeman> youshould try it - two free licenses for testing. 
09:43 < defswork> Axeman, you use the same commercial crap we are using here  ?
09:43 <+Axeman> commercial crap?
09:43 < defswork> I'm not talking openvpn
09:43 <+Axeman> openvpn-as ?
09:43 <+Axeman> that's what i use
09:43 < defswork> I'm talking the commercial crap we are hopefully ditching now
09:43 <+Axeman> what's that?
09:44 <+Axeman> name
09:44 <+Axeman> cisco
09:44 < Ad0> argh
09:44 < Ad0> failed to update database txt_db error number 2
09:44 < defswork> we have 8 different VPN solutions currently active
09:44 <+Axeman> the -as works easy
09:44 < defswork> from watchguard to juniper to pptp
09:44 < Ad0> I tried -as
09:44 < Ad0> didn't work for me
09:44 < Ad0> openVPN bitched about it timing out
09:45 < Ad0> allthough I could telnet to the port ...
09:45 <+Axeman> that might've been the older version? 
09:45 < Ad0> only -as I found was 1.8.3 ?
09:45 <+Axeman> yeap
09:45 <+Axeman> works fine for me
09:45 < defswork> I don't need -as - I've been using openpvn for at least 7-8 years
09:45 < Ad0> yeah I am doing openvpn now
09:45 < Ad0> but I got a problem with client keys
09:45 <+Axeman> i can't see going from -as to regular
09:46 < Ad0> TXT_DB error number 2
09:46 < Ad0> when doing ./pkitool
09:46 < defswork> Axeman, I've written dumbass shell script client configuration tool so that IT plebs can add users, create configs etc..
09:47 < defswork> Axeman, creates a per client zip file with everything in it and an install.bat
09:47 <+Axeman> -as does that - *i think*
09:48 < defswork> Axeman, part of the setup I documented - I ought to add the management scripts - http://blog.defsdoor.org/2011/06/02/large-openvpn-server-deployment
09:48 <@vpnHelper> Title: Large Openvpn Server Deployment - Standing On The Shoulders Of Ants (at blog.defsdoor.org)
09:48 <+Axeman> lol nice
09:49 < Ad0> can anyone help me with that openssl problem?
09:49 < Ad0> I am going nuts
09:49 < Ad0> :)
09:50 < Ad0> following this one http://www.linux.com/learn/tutorials/457103:install-and-configure-openvpn-server-on-linux
09:50 <@vpnHelper> Title: Install and Configure OpenVPN Server on Linux | Linux.com (at www.linux.com)
09:50 < defswork> how is -as doing load balancing on a single udp port ?
09:52 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
09:53 < defswork> hmm - I might consider doing a server management web interface myself
09:53 < defswork> nice little rubyonrails project
09:54 <+Axeman> defswork, not sure - i recall someone complained about it a while ago. but can't speak to it myself
09:54 < defswork> hmm wonder if theres a udp proxy at the front
09:55 < Ad0> *gives up*
09:55 <+Axeman> i don't know if it does real load balancing - or if it's just failover
09:55 < Ad0> I tried pptp which was crap
09:55 <+Axeman> pptp is dead
09:56 < Ad0> yeah
09:56 <+Axeman> try -as
09:56 < Ad0> I did
09:56 < Ad0> it looked ok when it was set up
09:56 < Ad0> but I can't connect to it
09:56 <+Axeman> if i can do it - anyone can
09:56 < Ad0> some strange problem
09:56 <+Axeman> did you edit your network interfaces?
09:56 <+Axeman> and run the init-config ? 
09:57 < Ad0> on -as ? 
09:57 <+Axeman> yeap
09:57 < Ad0> no
09:57 < Ad0> where does i say taht?
09:57 < Ad0> I thought the .deb did that crap for me
09:58 -!- CapnKernel [~mjd@183.17.60.63] has quit [Ping timeout: 240 seconds]
09:58 < Ad0> where does it state that I need to do init-config? :)
09:58 <+Axeman> hmm mabye not on the .deb hold on let me go look
09:59 < Ad0> thanks.
09:59 < Ad0> I already have a bridge
09:59 <+Axeman> what platform? ubuntu?
09:59 < Ad0> yes
10:00 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
10:01 <+Axeman> i ran it thru the esxi image
10:01 <+Axeman> those instructions tell you to edit network adapters, do apt-get, and run ovpn-init for more customization, 
10:01 <+Axeman> http://openvpn.net/index.php/access-server/download-openvpn-as-vm/469-deploying-openvpn-access-server-from-an-ovf-template-in-vmware-esxi-environment.html
10:01 <@vpnHelper> Title: Deploying OpenVPN Access Server from an OVF Template in VMWare ESXi Environment (at openvpn.net)
10:01 <+Axeman> scroll to bottom of that. 
10:02 < Ad0> thanks
10:03 < Ad0> I have to take a look tomorrow
10:03 < Ad0> this shit is too time consuming
10:03 < Ad0> I'd like to use the original openVPN
10:03 < Ad0> I have to figure out that key crap
10:03 <+Axeman> it isn't Ad0 ... if you do the pre-requisite reading ahead of time. 
10:04 <+Axeman> i did all my reading - idled in here and in the -as chat. .. and got it done in 30 minutes
10:04 <+Axeman> spent another couple of hours customizing logo, etc
10:04 <+Axeman> then got a comodo ssl cert and installed that too. 
10:04 < Ad0> I have a bridge already, which is bridged to eth0 with 192.168.0.0
10:04 < Ad0> but it is the main one
10:04 < Ad0> so I can't mess with that I guess
10:05 < cpm> ooo, bad choice. 
10:05 < cpm> gonna have lots of routing conflicts with remote sites with that subnet
10:07 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
10:07 -!- mode/#openvpn [+v novaflash] by ChanServ
10:07 <+novaflash> huh. i have a +.
10:08 < cpm> that'll learn ya
10:08 <+novaflash> i suppose so...
10:09 -!- gr [~gr@91.179.35.164] has quit [Quit: Ex-Chat]
10:15 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 245 seconds]
10:15 <@vpnHelper> RSS Update - forum: AUTH-PAM verify if CN = USERNAME <http://forums.openvpn.net/topic8727.html#p15141>
10:15 < ecrist> novaflash: it comes with the host cloak
10:16 <+novaflash> i suddenly feel very important now
10:16 <+Axeman> that's really only needed if the rume is muted, right?
10:16 <+Axeman> - the voice ? 
10:16 <+novaflash> yeah as far as i remember from the days that i used to use IRC, voice lets people talk in a muted room.
10:17 <+Axeman> only time i was in a muted room was when the touchdroid rumors spread. 
10:17 <+novaflash> i used to be able to do...things. scripts. aliases. fancy textboxes, colours. somehow i don't think people here would appreciate that :)
10:17 <+novaflash> what's a touchdroid? some sort of sextoy?
10:17 <+novaflash> google has educated me.
10:18 < ecrist> here it's more a visual status that you asked for a host cloak and haven't pissed me off enough since then to have me remove it.
10:18 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
10:18 < ecrist> :)
10:18 <+Axeman> lol
10:19 <+novaflash> ecrist; that makes it look like the channel is FULL of people that have annoyed you
10:19 < ecrist> novaflash: yes, yes it does.
10:19 -!- Wildy [~lion@212.119.246.18] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
10:19  * novaflash steps into a darker corner i'm not actually here...
10:20 -!- Irssi: #openvpn: Total of 164 nicks [5 ops, 0 halfops, 3 voices, 156 normal]
10:20 <+novaflash> right. time to write invoices and drink a lot of beer.
10:20 < ecrist> honestly, most people just don't ask for a cloak.  I won't add 8 bazillions users to the access list, but I did ask the host cloak.  anyone that wants it can have it, but we'll remove it from retards and dick-heads
10:21 <+novaflash> it's appreciated, i prefer not to spread my IP address to retards and dickheads.
10:21 <+Axeman> agreed. 
10:22 <+novaflash> unless there are a lot of single willing hot women here that know how to trace my home address based on my IP address, and would love to visit me and have intimate contact. in that case it would be alright.
10:23 -!- kokozedman [b89a3c62@gateway/web/freenode/ip.184.154.60.98] has quit [Ping timeout: 252 seconds]
10:23 < cpm> this place is swarming with them. 
10:23 <+Axeman> the are all over the internet
10:23 <+novaflash> wow, really?
10:24 <+Axeman> yup. 
10:24 <+novaflash> now i understand that list of people without the +..
10:25 <+novaflash> and why they hardly ever are around
10:25 <+novaflash> too busy with "The Women from The Internet"
10:25 <+novaflash> all 3 of them
10:26 <+Axeman> yup
10:26 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
10:26 < v0x> ho hum, i'm trying to do some advanced routes and can't figure this out
10:27 <+novaflash> v0x; maybe we can help :)
10:27 < v0x> i want: packets to "the internet" from all clients -> server -> specific client
10:28 < v0x> yes, i surely hope so
10:28 <+novaflash> so a sort of static route to add a gateway that's on the private network, right?
10:29 < v0x> yes
10:29 < v0x> and i intend to route it with ip rule, ip route and iptables
10:30 < v0x> however, the server cannot route default via client_ip
10:30 < v0x> i think it's because server is 172.16.1.1 with endpoint 172.16.1.2 ?
10:31 <+novaflash> okay now i'm confused ;)
10:31 < v0x> yes, sorry, it's a bit vague
10:31 < v0x> ok
10:32 < v0x> server: 172.16.1.1, clients 172.16.1.4-172.16.1.30
10:33 < v0x> one client intended to route default packets, let's say 172.16.1.30
10:33 < v0x> so on the server i did something like, ip route add default via 172.16.1.30 table vpn
10:34 <+novaflash> i'm just asking, but....why don't you just configure the gateway on your clients to be 172.16.1.30? if it is the default route, no problem, right?
10:34 < v0x> ooh interesting, never thought about that
10:34 <+novaflash> haha
10:34 -!- lwhalen [~law@bastion-ext.sermo.com] has joined #openvpn
10:34 <+novaflash> okay ;)
10:34 < v0x> the defaultroute on the client is 172.16.1.1 now
10:35 <+novaflash> i assume you have a dhcp server running on the server now?
10:35 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:35 < v0x> no, this is all tun
10:35 <+novaflash> oh alright
10:36 <+novaflash> well that method could still work then
10:36 <+novaflash> i think
10:36 < v0x> oh so i did 'ip r c 0.0.0.0/1 via 172.16.1.30 dev tun0' and got an RTNETLINK: no such process
10:36 <+novaflash> hm right you do have an interesting routing problem ;)
10:36 < v0x> but that could be because i think that 172.17.37.0/27 is not pushed to the client
10:37 < v0x> err, sorry, 172.16.1.0/27 :)
10:37 <+novaflash> yes i thought you meant that ;)
10:37 <+novaflash> let's hope someone else here knows how to deal with this situation, i've never had a vpn client to vpn client AS DEFAULT GATEWAY situation before
10:39 < gladiatr> !iroute
10:39 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
10:39 < v0x> it's not very common :)
10:40 < v0x> but can i add iroute 0.0.0.0/0 ?
10:40 <+novaflash> ah i see, that makes sense
10:40 < v0x> i didn't try yet
10:41 <+novaflash> i meant the iroute story
10:41 <+novaflash> it makes sense
10:41 < v0x> default is 0.0.0.0/0, yes?
10:41 <+novaflash> that should be the default route for ipv4 - all ipv4
10:41 < v0x> yes ok
10:41 <+novaflash> Once the router with a known route to a host destination is reached, the router determines which route is valid by finding the "most specific match". The network with the longest subnet mask that matches the destination IP address wins.
10:42 <+novaflash> 0.0.0.0/0 is the largest 'sub'net
10:42 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
10:42 <+novaflash> gladiatr seems to know more about how to make this work
10:43 < gladiatr> check out this article: http://backreference.org/2009/11/15/openvpn-and-iroute/
10:43 <@vpnHelper> Title: OpenVPN and iroute « \1 (at backreference.org)
10:43 < Ad0> what happens if my lan is 192.168.0.0 and the lan at the host is the same? kaboom?
10:44 < gladiatr> you loose
10:44 <+novaflash> Ad0; civilizations have been wiped out for smaller mistakes.. 
10:45 < Ad0> hahaha
10:45 <+novaflash> so i suggest you try to make them different subnets
10:45 <+novaflash> you may use any of the rfc 1918 subnets. 172.16.0.0, 10.0.0.0, 192.168.0.0
10:46 < Ad0> ok
10:46 < Ad0> is it possible to just make the bridge another subnet?
10:46 < Ad0> so VPN is just luck based then
10:46 < Ad0> hehe
10:46 < Ad0> just pray that the subnets are different
10:47 <+novaflash> no it's based on smart planning
10:47 <@vpnHelper> RSS Update - forum: Installing OpenVPn on MAC 10.6 <http://forums.openvpn.net/topic8728.html>
10:47 < v0x> ok, so i added the iroute
10:47 <+novaflash> you don't pray
10:47 <+novaflash> you plan ahead
10:47 < v0x> MULTI: internal route 0.0.0.0/0 -> client-something
10:47 < v0x> that's in the logs
10:47 < v0x> now on the server i should add the route in table vpn to 172.16.1.2, yes?
10:47 -!- raidz [~Administr@openvpn/corp/admin/andrew] has left #openvpn []
10:47 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:48 -!- mode/#openvpn [+o raidz] by ChanServ
10:48 < ecrist> good, didn't want him here anyway
10:48 <+novaflash> most residential network connections will have an 192.168.0.0/24, 192.168.1.0/24 or 192.168.2.0/24 subnet. so set the vpn network up as, for example, 10.62.25.0 or something similarly unique.
10:48 <@raidz> haha
10:48 < v0x> because i see the packets to the internet come into tun0
10:48 <+novaflash> ecrist; oops, he joined right away
10:48 <@raidz> I feel so left out!
10:48 <+novaflash> hi raidz
10:48 <@raidz> hey hey
10:48 < v0x> but the dest client doesn't see them coming into its own tun0
10:48 <+novaflash> i see you've managed to survive your morning trip to work
10:49 <+novaflash> v0x; is communication between two clients even possible in your setup? you could test that.
10:49 <@raidz> novaflash: barley, but i'm here! I raced a dude in a BMW
10:50 < v0x> yes, that's possible
10:50 <@raidz> I feel like I am in highschool again :-p
10:50 < v0x> because if i ping i see those packets
10:50 <+novaflash> raidz; wheat! glad you're here.
10:51 <+novaflash> raidz: so, pimples and random hard-ons?
10:51 <@raidz> haha, not sure about the pimples
10:52 <+novaflash> v0x: well that's good then but i think you need to tell openvpn to also route for subnets other than the ones configured on the active tunnels
10:52 <+novaflash> just a guess
10:52 <+novaflash> i'm no expert.
10:53 <+novaflash> the information gladiatr posted looks promising for this sort of thing.
10:54 < v0x> yes, i have added iroute 0.0.0.0/0 to the client/gateway's ccd
10:55 -!- sppadic [~sppadic@193.130.68.17] has quit [Quit: Leaving]
10:55 < v0x> ok, if i add a specific destination, packets to arrive
10:55 < v0x> i will try 0.0.0.0/1
10:58 < v0x> hmm, interesting
10:58 < v0x> http://forums.openvpn.net/topic7051.html
10:58 <@vpnHelper> Title: OpenVPN Support Forum Configure OpenVPN Client as default gateway : Configuration (at forums.openvpn.net)
10:59 <+novaflash> hey neat
11:02 < v0x> 0.0.0.0/1 and /2 do not work
11:02 -!- tinuro [~tinuro@mail.xnt.ro] has quit []
11:06 < v0x> ha, a /4 subnet works :)
11:11 < v0x> eureka! :)
11:11 <+novaflash> cool
11:11 < v0x> haha awesome
11:11 < v0x> now i can rest
11:11 < v0x> took me many hours :)
11:13 <+novaflash> rest in peace
11:14 <+novaflash> here lies 0.0.0.0/4
11:14 < v0x> yes :) thx novaflash 
11:15 <+novaflash> i did nothing
11:16 <+s7r> i wonder what will happen to this routes in an only ipv6 capable connection
11:16 <+novaflash> but if you ever need someone to do nothing for you, i'm your man
11:16 < defswork> novaflash, my lawn needs cutting
11:17 <+novaflash> defswork; i'm on it. doing absolutely nothing in 3...2....1....
11:18 -!- jthunder [~jthunder@74.198.150.37] has joined #openvpn
11:21 <@vpnHelper> RSS Update - forum: Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html#p15143>
11:22 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
11:23 -!- jthunder_ [~jthunder@74.198.150.38] has joined #openvpn
11:25 < defswork> odd conclusion
11:26 -!- jthunder [~jthunder@74.198.150.37] has quit [Ping timeout: 252 seconds]
11:26 -!- jthunder_ is now known as jthunder
11:32 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
11:32 < v0x> novaflash, heh, well, it helped to think out loud :)
11:33 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:33 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
11:37 -!- corretico [~luis@201.201.44.82] has joined #openvpn
11:42 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
11:43 <@vpnHelper> RSS Update - forum: using local bandwidth <http://forums.openvpn.net/topic8729.html>
11:44 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
11:49 <+novaflash> defswork: maybe my doing nothing on your lawn will inspire your lawn to do more nothing and less growing.
12:01 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:08 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
12:08 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 260 seconds]
12:13 -!- MeanOne [~lol@unaffiliated/kindone] has joined #openvpn
12:13 -!- jthunder [~jthunder@74.198.150.38] has quit [Ping timeout: 245 seconds]
12:13 -!- CapnKernel [~mjd@183.17.60.63] has joined #openvpn
12:18 -!- samas|afk is now known as samas
12:31 -!- Ad0 [~ad0@callstack.info] has quit [Ping timeout: 276 seconds]
12:31 -!- Ad0 [~ad0@callstack.info] has joined #openvpn
12:38 -!- agagag [~anton@83.167.185.34] has joined #openvpn
12:43 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
12:44 < grendal-prime> hey is there any limit on how many remote ip's you can have on a client?
12:45 < grendal-prime> Like we want our clients to connect to one of 4 servers.
12:45 < grendal-prime> I know we can do two..but just want to make sure its possible to do more
12:48 -!- EugeneKaway is now known as EugeneKay
12:51 -!- k4v [~kav@g226091205.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
13:02 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
13:04 < Essobi> ewwww ephedran
13:06 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:11 < EugeneKay> grendal-prime - Shouldn't be any hard limits, within the bounds of config file size(I think a MB or two of .conf might cause it to choke on parsing.... never tried)
13:11 < EugeneKay> Just use remote-random and enjoy
13:13 -!- CapnKernel [~mjd@183.17.60.63] has quit [Quit: Leaving.]
13:16 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Remote host closed the connection]
13:17 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
13:17 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
13:17 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
13:17 -!- mode/#openvpn [+v novaflash] by ChanServ
13:17 -!- dazo is now known as dazo_afk
13:23 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
13:25 < Ad0> argh
13:26 < Ad0> I am still struggling with "TXT_DB error number 2"
13:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
13:27 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
13:29 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
13:36 < EugeneKay> easy-rsa is a hell of a drug
13:36 < hyper_ch> is there anything better in life than coming home after a hard day's work, get greeted joyfully by your furballs, then move onto the balcony to get some fresh tomatoes and let the evening come in?
13:37 < EugeneKay> I keep my balls shaved.
13:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:40 <+novaflash> EugeneKay; prove it.
13:40 < hyper_ch> don't prove it
13:40 <+novaflash> is this like a schrodinger's cat thing now?
13:40 <+novaflash> but then with balls.
13:41 < hyper_ch> your balls are dead?
13:41 <+novaflash> so, you got 2 cats, hyper_ch? i've got 2.
13:41 < EugeneKay> Schrodingers Scrotum
13:41 <+novaflash> wanted dead and alive; schrodinger's cat
13:41 < hyper_ch> 3 furballs here
13:41 <+novaflash> crazy. i bet they wanted food.
13:42 < hyper_ch> noooooo, they missed me
13:42 < hyper_ch> i'm sure of that
13:42 < hyper_ch> ;)
13:42 <+novaflash> cats are awesome.
13:43 < hyper_ch> they are :)
13:43 <+novaflash> i've got a longhaired furball and a small thin shorthaired furry ball
13:43 <+novaflash> they hang around me whenever i'm home
13:43 <+novaflash> i sit on the couch - they sit on the couch (well mostly on me)
13:43 <+novaflash> i sleep in bed, they sleep on the bed (well mostly on me)
13:44 <+novaflash> it gets troublesome when i'm at the computer. fortunately i've taught them not to step on the keyboard.
13:44 < hyper_ch> I finally found a food they don't like
13:44 < hyper_ch> if I eat chocolate, they want also have some
13:44 < hyper_ch> if I eat fresh bread, they also want to have some
13:45 < hyper_ch> if I eat pizza, ...
13:45 < hyper_ch> but they don't like tomatoes :)
13:45 <+novaflash> funny that
13:45 <+novaflash> animals won't eat food that's poisonous
13:45 <+novaflash> are you SURE those tomatoes are alright?
13:45 < hyper_ch> tomatoes are not poinsonous
13:45 < hyper_ch> they are yummy
13:45 <+novaflash> you eat tomatoes straight up?
13:45 <+novaflash> like
13:45 <+novaflash> grab
13:45 <+novaflash> bite
13:45 <+novaflash> die?
13:45 < hyper_ch> and they don't like peanut m&m's either
13:46 < hyper_ch> like grab, wash, bite, swallow
13:46  * novaflash frowns
13:46 <+novaflash> crazy..
13:46 < Ad0> I am losing hairs over this man
13:46 <+novaflash> Ad0; it's just a tomato
13:46 < hyper_ch> no, eating tomatoes does not make you lose hair
13:46 < hyper_ch> you confuse tomato with radiation
13:46 <+novaflash> ,aybe he
13:46 <+novaflash> maybe he's talking about the balls
13:47 < Ad0> lol
13:47 < Ad0> could you please help
13:47 <+novaflash> maybe
13:47 <+novaflash> last time i helped someone i did nothing
13:47 <+novaflash> and that solved it
13:47 < hyper_ch> ask and you'll be laughed at
13:47 < Ad0> TXT_DB error number 2
13:47 < hyper_ch> sorry... I mean ask and you'll be helped
13:47 < Ad0> piece of 
13:47 <+novaflash> what... what... huh. where are you getting that error?
13:48 < Ad0> ./pkitool balls
13:48 < Ad0> when I am trying to generate a client ceritificate
13:48 < Ad0> http://www.linux.com/learn/tutorials/457103:install-and-configure-openvpn-server-on-linux
13:48 <@vpnHelper> Title: Install and Configure OpenVPN Server on Linux | Linux.com (at www.linux.com)
13:48 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
13:48 < hyper_ch> !howto
13:48 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:48 <+novaflash> TXT_DB error number 2 is a DB_ERROR_INDEX_CLASH. 
13:48 <+novaflash> This occurs, if the same serial number shall be used twice. 
13:48 < hyper_ch> Ad0: follow the easy-rsa instructions in the howto
13:49 <+novaflash> guest says: I ran into the same problem. I got it to occur though by setting the
13:49 <+novaflash> -subj argument on req. If I leave that off, the key goes fine. But if I
13:49 <+novaflash> try and use ca to sign a req that I make using -subj, it bombs with this
13:49 <+novaflash> error message.
13:49 <+novaflash> maybe this helps you.
13:50 < Ad0> yeah index clash, but I tried changing about every damn variable in the cert
13:50 < Ad0> if I put 091401ujaijdoaijtpoqihtjpqoit in CN it should be fine
13:50 < Ad0> :D
13:51 < Ad0> common nae
13:51 < Ad0> name
13:51 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Client Quit]
13:54 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
13:58 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
14:00 < Ad0> common balls
14:00 <+novaflash> still no luck?
14:01 < Ad0> no
14:02 < Ad0> maybe my certificate store is messed up
14:03 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:03 <+novaflash> i've seen a note somewhere that you should properly revoke a certificate - perhaps a tip?
14:03 < Ad0> hm
14:03 < Ad0> what do you mean?
14:04 < Ad0> like remove it from the store?
14:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:05 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
14:06 < Ad0> I fixed it with renaming the cn between the series of commands!
14:06 < Ad0> but shouldn't client and server certs have the SAME common name?
14:08 < Ad0> do you have a conf for openssl novaflash ?
14:08 <+novaflash> i don't have a conf for openssl
14:08 <+novaflash> i get all my knowledge from google.com
14:08 <+novaflash> google is my master
14:08 <+novaflash> plonked your error message into google and it spewed out a forum conversation about a user with the same error message
14:09 <+novaflash> there was something there about someone being told off to revoke the certificate first before signing it again
14:09 < Ad0> ok
14:09 < EugeneKay> No, client and serer should NOT have matching CNs
14:09 < EugeneKay> That is bad juju
14:09 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Remote host closed the connection]
14:09 < Ad0> rly
14:09 -!- thefish [~thefish@cpc4-newt31-2-0-cust546.newt.cable.virginmedia.com] has joined #openvpn
14:09 -!- thefish [~thefish@cpc4-newt31-2-0-cust546.newt.cable.virginmedia.com] has quit [Changing host]
14:09 -!- thefish [~thefish@unaffiliated/thefish] has joined #openvpn
14:09 < Ad0> ok then I did allright then
14:09 <+novaflash> you had a same CN for both server and client... oh
14:09 <+novaflash> lol
14:09 <+novaflash> oh well
14:10 < Ad0> yeahn
14:10 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has joined #openvpn
14:10 -!- thefish [~thefish@unaffiliated/thefish] has quit [Remote host closed the connection]
14:10 < Ad0> I followed the tutorial, and it didn't mentioning renaming that var :P
14:10 <+novaflash> looks like fish have bad internet connections these days.
14:11 < Ad0> hehe
14:17 < Ad0> so afaik, it's a bad idea to have the same mask in both ends
14:17 < Ad0> like 192.168.0.x
14:20 <+novaflash> generally yes
14:21 < Ad0> but I love that range :(
14:21 < Ad0> it will be a nightmare to change the IPs
14:21 < Ad0> can I test this without changing it for now
14:21 <+novaflash> if you have two networks, both in 192.168.0.0/24 subnet, then you could bridge them using layer 2 bridging
14:22 <+novaflash> sort of 'merging' the two networks
14:22 < Ad0> I guess I would have problems with 2 being the exact same IP
14:22 <+novaflash> yes, obviously
14:23 <+novaflash> personally
14:23 <+novaflash> i've always given each of my clients a unique range
14:23 <+novaflash> so that when i connect to their network over vpn i don't get conflicts
14:23 < Ad0> so you told them to have a certain range at home
14:23 <+novaflash> in the company
14:23 <+novaflash> network
14:23 < Ad0> ok
14:24 <+novaflash> in the netherlands, where i live and work, the routers we get usually assign ip numbers in 10.0.0.0/24 and 192.168.0.0 and 192.168.1.0 ranges.
14:24 < Ad0> yes
14:24 <+novaflash> for company networks i always choose something different
14:24 < Ad0> here in norway it's usually 10.0.0.0
14:24 < Ad0> ok
14:24 < ecrist> !1918
14:25 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
14:25 <+novaflash> yes, thanks ecrist
14:25 < Ad0> yeah I know of 1918
14:25 < Ad0> thnaks
14:25 <+novaflash> yeah, 1918 is when they invented this
14:25 < Ad0> so what is a more "corporate" range?
14:25 < Ad0> haha
14:25 <+novaflash> well if you want something unique
14:25 < Ad0> the 172 one ?
14:25 <+novaflash> then pick 172
14:25 <+novaflash> yeah
14:25 < Ad0> it's so ... weird
14:25 < ecrist> 10/8 is usually corp, 172.16/12 is generally used on VPNs and mobile networks
14:25 <+novaflash> yup
14:26 < ecrist> 192.168/23 is often used on home networks.
14:26 < Ad0> 172.8 ?
14:26 < Ad0> err
14:26 <+novaflash> for my own company networks i prefer to use 10.56.23.0/24 for one client, 10.56.24.0/24 for another, 10.56.25.0/24 and so on.
14:26 < Ad0> 172.16.8
14:26 < Ad0> yes that sounds like a good idea
14:26 <+novaflash> yes you could pick that
14:26 < Ad0> 172 just puts me off man
14:26 < Ad0> :)
14:27 <+novaflash> well if you like 192.168.0.0 then do this;
14:27 <+novaflash> 192.168.40.0/24
14:27 < Ad0> and 10.56.23.0 has 255.255.255.0 right
14:27 <+novaflash> 192.168.41.0/24
14:27 <+novaflash> and so on
14:27 <+novaflash> yes
14:27 <+novaflash> the 24 == 255.255.255.0
14:27 <+novaflash> so only 254 ip addresses
14:27 < Ad0> ok
14:27 <+novaflash> but for my clients that is enough
14:27 < Ad0> yeah
14:28 < Ad0> quite enough
14:28 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 252 seconds]
14:28 < Ad0> I'll change it at work then
14:28 < Ad0> where the server is
14:28 <+novaflash> i agree it is a pain to change the entire network to another range
14:28 <+novaflash> but *shrugs*
14:28 < Ad0> yeah because they have SANE configs, shares etc to the IP
14:28 < Ad0> sane being scanner
14:28 < Ad0> I hope they have the hostname
14:29 < Ad0> cause I am just gonna change the fucker
14:29 <+novaflash> oh my goodness
14:29 <+novaflash> such brash use of language
14:29 < Ad0> hahaha
14:29 <+novaflash> everyone step aside, the NEW Ad0 is HERE
14:29 <+novaflash> and he's going to change IP addresses
14:29 < Ad0> yeah
14:29 < Ad0> WATCH OUT
14:29 < Ad0> I am as far as the config of the actual openvpn server now
14:30 < Ad0> I have an existing bridge for the LAN
14:30 < Ad0> but I guess I have to add another one
14:31 < Ad0> since it's gonna go up and down
14:31 <+novaflash> that's what she said
14:31 < EugeneKay> I use a /16 out of 10.0.0.0/8 for each of my "locations". That gets divided into /20 & /24s for each LAN segment, as appropriate. End-machines end up getting a /28(static) or a /32(DHCP) of addresses.
14:31 <+novaflash> and yes that's what bridges do; go up and down
14:31 <+novaflash> EugeneKay; from that information i assume you're used to setting up a lot bigger networks than i am used to.
14:32 <+novaflash> i've never had the need to go beyond /24
14:32 < EugeneKay> Indeed.
14:32 < EugeneKay> I pick /x4 boundaries because it's easy to do the math on
14:32 <+novaflash> agreed
14:32 < EugeneKay> My subnets are either 255 or 240, period.
14:32 <+novaflash> 255 for me
14:33 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
14:34 < EugeneKay> I don't use anything approaching the full number of addresses in any LAN segment, but I have some machines who legitimately have 5+ IPs. Being able to group them all together into the same /28, rather than a list of IPs plucked out of a /24, makes firewalling a LOT easier
14:35 <+novaflash> obviously it's never good practice to use all ip addresses
14:35 <+novaflash> always keep some spare
14:35 <+novaflash> for possible additions later
14:35 < EugeneKay> Indeed.
14:36 <+novaflash> i tend to use /24 and divide it up into sections - a range for dhcp, a range for static (for the clients) a small range for devices such a printservers, and a small range for servers, and at the end of the subnet a few addresses for gateways
14:36 <+novaflash> but the networks i build are usually between 1 ~ 30 network devices
14:36 -!- CharlieSu [~CharlieSu@ec2-174-129-218-86.compute-1.amazonaws.com] has joined #openvpn
14:36 <+novaflash> it does help to have the same scheme of numbering devices in the ip range though. i always know where to find stuff.
14:37 < EugeneKay> That used to work, but then I stopped to look at my iptables Sort chain.... and screamed.
14:37 <+novaflash> and that's when you shaved your balls.
14:37 < EugeneKay> Nah, I've been doing that for years.
14:38 <+novaflash> same
14:38 <+novaflash> but i've never stopped to look at my iptables sort chain
14:38 <+novaflash> well, only if there are problems
14:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:38 < Ad0> I need to find a sample config
14:38 <+novaflash> of?
14:38 < Ad0> openvpn.conf
14:38 < Ad0> server
14:38 <+novaflash> isn't there a sample file in the documentation?
14:39 <+novaflash> i'm asking because i don't know
14:39 <+novaflash> but i assume so
14:39 < Ad0> yes I am looking at it
14:39 <+novaflash> ah good guess on my part then
14:39 < Ad0> yeah :)
14:42 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p15145>
14:42 < Ad0> I could set up the bridge with the new range right?
14:43 < Ad0> to test this in a subnet where noone else are
14:43 <+novaflash> i think so
14:43 < Ad0> because the openvpn is the "dhcp" for the clients
14:43 < Ad0> afaik
14:43 <+novaflash> openvpn assigns ip addresses to vpn clients from a 'dhcp' pool
14:44 <+novaflash> but you could also specify a static ip if you want
14:44 < Ad0> yeah
14:44 < Ad0> ok
14:44 < Ad0> if I have br0 from before which is always up (because of xen)
14:44 <+novaflash> cool story, br0
14:44 < Ad0> hehe
14:44 < Ad0> and I now make br1 which has a different mask etc. the 10.22 one
14:45 < Ad0> what happens when I get around to change br0 to the same config?
14:45 < Ad0> do I have to state that I bridge them or something?
14:45 < Ad0> I guess those two bridges won't magically bridge?
14:45 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:45 < Ad0> when they are the same mask etc
14:46 <+novaflash> i've lost you ;) maybe someone here knows the answer.
14:46 <+novaflash> i am reminded of a saying. one crazy man can ask more questions than a thousand wise people can answer. ;)
14:46 <+novaflash> but there's probably someone in here that knows the answer
14:47 < Ad0> haha
14:47 < Ad0> but isn't it a classic scenario?
14:47 <@vpnHelper> RSS Update - forum: How to end session from client side <http://forums.openvpn.net/topic8730.html>
14:47 <+novaflash> i don't use bridges
14:47 < CharlieSu> Hi. My config has an option like this (server 10.8.0.0 255.255.255.0)  Since every client takes up 4 ip address, does that mean I can only have 64 clients on this range? If i want to make the range bigger so I can support more hosts, how would I do that?
14:47 <+novaflash> i use proper routing between networks.
14:48 < Ad0> well I dont really care what i use as long as it works :)
14:48 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
14:50 < CharlieSu> Do I just change 255.255.255.0 to something like 255.255.254.0 ?
14:50 <+novaflash> CharlieSu; i'm not too familiar with this but yes i believe changing the subnet mask is the trick here
14:50 <+novaflash> 255.255.255.0 means only 254 ip addresses can be assigned in total
14:51 <+novaflash> 255.255.0.0 means 254x254 ip addresses can be assigned afaik
14:51 < CharlieSu> novaflash: yeah i was think the same..  /24..  need to be larger..
14:51 < CharlieSu> novaflash: cool..  i thought that was it..  if i change things out should my other lcients be ok?
14:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
14:52 <+novaflash> i'm not sure. i'd guess they would need a new client config file.
14:52 < ecrist> why would they need a new client config?
14:52 < CharlieSu> novaflash: i don't see any subnet stuff in the client config file
14:52  * ecrist mumbles something about blind leading blind
14:53 < CharlieSu> i'd think that as long as they're still able to be on the same range I'd be good..  Only reason I ask is because I'm using ifconfig-pool-persist
14:53 < CharlieSu> Which works great by the way..  I love x509 :)
14:53 < ecrist> ipp is handles server side
14:53 < ecrist> handled*
14:54 < CharlieSu> ecrist: yes..  so as long as my change to server 10.8.0.0 255.255.255.0 still contains the same range i should be good
14:54 <+novaflash> ecrist; i don't know. whenever i change something in openvpn access server i have to download the config file again, so.. i assumed.
14:54 < ecrist> access server is completely different than opensource openvpn
14:54 <+novaflash> ecrist; i am a bit new at this ;)
14:55 < ecrist> I'm not. ;)
14:55 <+novaflash> ecrist; i accept your knowledge and absorb it greedily. omnomnom.
14:57 <+s7r> breathe from time to time
14:57 <+s7r> :))
14:58 <+s7r> what are the rest of us suppose to eat
14:59 <+novaflash> i can't possibly eat ALL his knowledge
14:59 <+novaflash> there's plenty for all
15:00 <+novaflash> i suddenly compare this channel with a horde of zombies, all looking for BRAAINNSS and ecrist has it.
15:00 <+s7r> yeah but theres 164 of us on the channel
15:00 <+s7r> 163.. vpnHelper doesn't eat
15:00 < Ad0> do I really need to set up a bridge if it's gonna be the same range anyway ?
15:00 <+s7r> krzee feeds him bread with salt
15:00 <+novaflash> Ad0; i'm not sure what you are trying to achieve, i've completely lost you
15:00 <+s7r> you were to busy eating greedly
15:00 <+s7r> :))
15:00 <+novaflash> i've got an openvpn as server running and i don't create bridges at all
15:01 <+novaflash> s7r; it is so.
15:01 <+s7r> you are lucky novaflash. getting help here for openvpn as server
15:01 < Ad0> novaflash: I just want the vpn ips and subnet to be the same as the LAN
15:01 <+s7r> that is not supported her
15:01 <+s7r> we are supporting the community project openvpn :)
15:01 <+novaflash> s7r; i'm not getting support for openvpn as here
15:01 <+novaflash> s7r; for that i go to #openvpn-as
15:01 <+novaflash> i am however very curious to learn about the community edition
15:01 <+s7r> ah so you are here just to eat?
15:02 <+s7r> novaflash: i`m just joking i`m being a dick:)
15:02 <+novaflash> yes. and if i can, to help people. but i need to learn along the way.
15:02 <+s7r> you are mostly welcomed here
15:02 <+novaflash> every bit of knowledge i gain can possibly help others later again when they ask the same questions
15:02 <+novaflash> whee, thanks
15:02 <+novaflash> for... welcoming, not being a dick, obviously.
15:03 < kenyon> Ad0: then I think you need to bridge the tap interface with the ethernet interface if that's really want. but it's better to not do that and just use tun and a different subnet from the LAN.
15:03 <+s7r> Ad0: you use tap adapter?
15:03 <+s7r> or tun ?
15:04 < Ad0> tun I guess :P
15:04 < Ad0> tuna
15:04 <+s7r> you can use tun too, but remove the line server 10.8.0.0 or what ip pool you have for the server and add , taking in consideration your server lan ip
15:04 <+s7r> if your server lan ip is 192.168.1.2
15:04 <+s7r> add line
15:04 <+s7r> ifconfig 192.168.1.2 192.168.1.200
15:04 <+s7r> the client will be the .200 one, and server will keep its default lan address
15:05 <+s7r> you need to figure out which that is, and it needs to be static not assigned by dhcp (i assume)
15:05 <+s7r> don't know if you can put interface name at this syntax
15:05 < Ad0> hm
15:05 < Ad0> what I want is that the local dhcp (router) assigns 10.22.0.50-100
15:05 < Ad0> which I have set up
15:06 < Ad0> and that the VPN assigns 10.22.0.101-150
15:06 < Ad0> so it's on the same network when you connect to VPN
15:06 <+s7r> yes but, what netmask do you have in the openvpn config ?
15:06 <+s7r> 255.255.255.0 ?
15:06 < Ad0> yeah
15:06 < Ad0> I haven't come that far yet
15:06 <+s7r> this improvisation should work
15:06 < Ad0> I am just setting this part up
15:06 <+s7r> i mean, at least theoretically
15:06 < Ad0> is it "server" or "server-bridge"
15:07 <+s7r> be carefull
15:07 < Ad0> how do I define the range?
15:07 <+s7r> the netmask in the router should be also 255.255.255.0
15:07 < Ad0> yes
15:07 < Ad0> I make sure the mask and everything is the same
15:07 < Ad0> I just don't want overlapping IPs
15:07 <+s7r> make sure that is not assigned by dhcp because if it is, dhcp will calculate it accordingly to subnet which is not a /24.. it's divied into vpn and dhcp
15:07 < K1ng> Eid Mubarak everyone.
15:07 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:08 <+novaflash> may you enjoy a blessed festival?
15:08 <+novaflash> is that today? ah. yes of course.
15:08 <+s7r> Ad0: it would be simpler if you could set the router to accept static IPs too, and configure the server as 10.22.0.50 and add line ifconfig 10.22.0.50 10.22.0.101
15:08 <+s7r> that way you are sure
15:09 <+s7r> or you can try it your way first as i said, what you are trying to do *theoretically* should work
15:09 < Ad0> s7r: the server is static
15:09 < Ad0> dhcp starts from 100 to 149
15:10 <+s7r> you said something different some lines scroll-up :D
15:11 < kenyon> you have to do tap and bridge to have the same IP network no openvpn clients as on the LAN behind the server
15:11 < kenyon> on, not no
15:13 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:13 < Ad0> I don't actually care if the vpn IPs are on a different subnet as long as they can reach eachother
15:14 < Ad0> I just don't know how to set it up
15:15 < kenyon> so then the best thing to do is use tun and a different subnet. the clients just need a route pushed to them so they know to use the openvpn tunnel to get to LAN hosts.
15:15 < kenyon> this is a standard setup, it should be well documented
15:15 < Ad0> right
15:16 < Ad0> do I need to fool around with ifconfig ?
15:18 < kenyon> I'm not sure what the exact openvpn syntax is. personally I only do IPv6, which openvpn's config doesn't support yet
15:18 < krzee> !ipv6
15:19 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options), or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
15:19 < krzee> !snapshots
15:19 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn, or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
15:19 < krzee> those do handle --server-ipv6 =]
15:19 < kenyon> yeah, but I prefer to stick with debian packages. I only have one client, so it's fine.
15:20 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 260 seconds]
15:20 < Ad0> hm
15:21 <+novaflash> debian <3
15:21 < EugeneKay> IIRC, Debian has the IPv6 payload patch already applied
15:22 < kenyon> yeah, payload works with tun-ipv6 in debian squeeze
15:27 < krzee> tun-ipv6 has worked, its not part of the payload patch (granted the payload patch does extend this option tho)
15:28 < krzee> tun-ipv6 	enable IPv6 routing on the tunnel. Not strictly a new option, but was only implemented in point-to-point mode so far (with manual configuration of all the IPv6 parameters and routing).
15:39 < kenyon> yep, that's what I do, manual config with a client up script. server config is persistent from /etc/network/interfaces
15:41 < kenyon> works nicely for point-to-point, no IPv4 needed
15:46 < Ad0> ok
15:46 < Ad0> cool
15:46 < krzee> cool, in --server-ipv6 ipv4 is still needed
15:49 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
15:52 -!- MeanOne is now known as KindOne
15:58 <@vpnHelper> RSS Update - forum: How to end session from client side <http://forums.openvpn.net/topic8730.html#p15148> || OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403.html#p15147>
16:00 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
16:04 <@vpnHelper> RSS Update - forum: AUTH-PAM verify if CN = USERNAME <http://forums.openvpn.net/topic8727.html#p15150> || Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html#p15149>
16:14 -!- lwhalen [~law@bastion-ext.sermo.com] has quit [Ping timeout: 240 seconds]
16:15 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:18 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:20 -!- slimjimflim [~chatzilla@unaffiliated/slimjimflim] has joined #openvpn
16:20 < slimjimflim> anybody know where the log file location is on linux (red hat)?
16:20 < krzee> !logfile
16:20 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
16:20 < slimjimflim> for openvpn client
16:22 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:22 < krzee> when you say openvpn client, you just mean normal openvpn, and it has a client config... right?
16:23 < krzee> or do you mean "openvpn client" as in access-server
16:24 < slimjimflim> idk the difference
16:24 < slimjimflim> this is not the server
16:24 < slimjimflim> that's on another box
16:24 < krzee> !download
16:24 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN, or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
16:24 < slimjimflim> ???
16:24 < krzee> you get it from there?
16:24 < slimjimflim> no
16:24 < krzee> if not, where?
16:24 < slimjimflim> yum
16:24 < slimjimflim> yum install openvpn
16:24 < krzee> ok, that should be normal opensource openvpn
16:25 < krzee> in openvpn, there is no server/client app... just the config decides that
16:25 <+novaflash> delicious.
16:25 < krzee> heres the info on the logfile
16:25 < slimjimflim> ook
16:25 < krzee> !logfile
16:25 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile, or (#2) verb 3 is good for everyday usage, verb 5 for debugging, or (#3) see --daemon --log and --verb in the manual (!man) for more info
16:25 < krzee> its in your syslog, maybe messages... but either way you can specify a log file manually
16:25 < slimjimflim> k
16:26 < slimjimflim> when you say syslog, you mean what's in dmesg?
16:26 < krzee> no...
16:26 < krzee> just specify a logfile if you dunno how your OS works
16:27 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
16:28 < slimjimflim> oh so /var/log/messages
16:28 < slimjimflim> that could have been a one-liner
16:28 < slimjimflim> thanks though
16:29 <+novaflash> quick question for the guru's; on a linux box (debian) i've got openvpn running (community edition - apt-get install openvpn) and i've got an auto-login .conf file in /etc/openvpn and it works. but what rights/ownership should i place on this file? 640 root?
16:29 < krzee> "You can manually specify a logfile with: log /path/to/logfile"
16:29 < krzee> thats what you likely really want slimjimflim 
16:30 < slimjimflim> why would i do that if there's already logging in /var/log/messages?
16:30 < slimjimflim> i was just asking about the default
16:30 < krzee> novaflash, that is fine, but the conf isnt really secret, you need to be sure the keyfiles are tho
16:31 < krzee> as in your key and if you use tls-auth, that file too
16:31 < kenyon> slimjimflim: the default depends on your syslog configuration
16:31 < krzee> ecactly
16:31 < slimjimflim> ok
16:31 < krzee> exactly*
16:31 < slimjimflim> either way, i got it now thanks
16:31 <+novaflash> the .conf contains everything necessary to connect including certificates and all
16:32 < krzee> novaflash, they key files are in-line inside the config?
16:32 <+novaflash> yes because that's what access server delivers - one file that contains it all. i use the community client to ocnnect my linux box
16:32 < krzee> ild go root:wheel 600 then, make sure your config uses persist-tun and persist-key
16:33 <+novaflash> wheel? i don't think i've heard of that one before :)
16:33 < krzee> well those last 2 options are assuming you also use --user and --group
16:33 < krzee> well root:root, whatever your os uses for superuser group
16:33 <+novaflash> ah, root:root then
16:33 < krzee> im a bsd guy, we have wheel group
16:33 <+novaflash> bdsm?
16:33 <+novaflash> ah i see.
16:33 < krzee> ;]
16:33 <+novaflash> no, root:root for me then.
16:33 <+novaflash> thanks :)
16:34 < krzee> np
16:34 <+novaflash> i was just curious if the init script would pick it up then when it boots up - but it should since that has to run under root privileges.
16:34 <+novaflash> i'll give it a whirl
16:34 < krzee> exactly
16:34 < krzee> openvpn must be started as root anywayds
16:35 <+novaflash> for the creation of the tun devices, i get it
16:35 < krzee> the important part is that if you drop permissions (--user / --group) that you also have the persist options
16:35 < krzee> since otherwise it would not be able to read the keys and/or re-open the tun device
16:36 <+novaflash> right i'll have to test and see if that is necessary then. thanks.
16:36 < krzee> also, if you use ccd, make sure that will be readable (and the dir has a+x) by the user that you drop permissions to
16:36 <+novaflash> i'm not sure what ccd is, i probably do not use it
16:36 < krzee> its necessary if you use --user/--group and secure your files
16:36 < krzee> no testing needed to know =]
16:36 < krzee> !ccd
16:36 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
16:37 <+novaflash> right. no, i don't use those. now i understand what you mean.
16:39 -!- jthunder [~jthunder@174.3.103.159] has joined #openvpn
16:42 -!- nb_ [~nb@fedora/nb] has joined #openvpn
16:42 <@vpnHelper> RSS Update - forum: What am I doing wrong on my bridged settings? <http://forums.openvpn.net/topic8731.html>
16:43 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
16:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
16:50 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:58 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
16:59 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
16:59 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Quit: Ex-Chat]
16:59 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
17:09 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:09 -!- mode/#openvpn [+v Axeman] by ChanServ
17:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:23 -!- KindOne [~lol@unaffiliated/kindone] has quit [Changing host]
17:23 -!- KindOne [~lol@colchester-lug/silly-fool/donut] has joined #openvpn
17:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:33 -!- slimjimflim [~chatzilla@unaffiliated/slimjimflim] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0/20110811165603]]
--- Log closed Tue Aug 30 17:44:17 2011
--- Log opened Tue Aug 30 17:44:23 2011
17:44 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
17:44 -!- Irssi: #openvpn: Total of 136 nicks [4 ops, 0 halfops, 1 voices, 131 normal]
17:44 -!- Irssi: Join to #openvpn was synced in 29 secs
17:45 -!- asio_ [~asio@195.20.207.173] has quit [Ping timeout: 240 seconds]
17:45 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
17:46 -!- asio [~asio@195.20.207.173] has joined #openvpn
17:50 -!- Axeman2 [~Axeman3@knox.pace.edu] has joined #openvpn
17:50 -!- Axeman2 [~Axeman3@knox.pace.edu] has quit [Changing host]
17:50 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:50 -!- mode/#openvpn [+v Axeman2] by ChanServ
17:54 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
17:54 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
17:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:54 -!- 14WABIA5P [martin@shell.ipv6.octocore.net] has joined #openvpn
17:54 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
17:54 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
17:54 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
17:54 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:54 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
17:54 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
17:54 -!- incidence [jussi@unaffiliated/incidence] has joined #openvpn
17:54 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
17:54 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
17:54 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has joined #openvpn
17:54 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
17:54 -!- solarce [solarce@elle.fallingsnow.net] has joined #openvpn
17:54 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
17:54 -!- sedulous [~sedulous@2001:470:1f0b:1862:7e0d:7367:1173:1ebc] has joined #openvpn
17:54 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
17:54 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
17:54 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
17:54 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
17:54 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
17:54 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
17:54 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
17:54 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
17:54 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
17:54 -!- ServerMode/#openvpn [+o dazo_afk] by niven.freenode.net
17:57 -!- nikanok [~nickynick@85.17.236.236] has joined #openvpn
17:57 < nikanok> hello
17:58 < nikanok> any1 awake ?
17:59 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:59 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
18:03 -!- Netsplit *.net <-> *.split quits: SigmaProjects, yell0, raomin, Ragnar, pa, solarce, amero, @dazo_afk, ScriptFanix
18:03 -!- Netsplit *.net <-> *.split quits: zu, incidence, nickzxcv, decoder, sedulous, up_the_irons, DarthGandalf, Essobi, Fiouz, 14WABIA5P,  (+8 more, use /NETSPLIT to show all of them)
18:05 -!- Netsplit over, joins: amero, raomin, ScriptFanix, 14WABIA5P, SigmaProjects, DarthGandalf, troyt, APTX, Ragnar, Tick-Tock (+6 more)
18:05 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
18:05 -!- Netsplit over, joins: sedulous, nickzxcv, Essobi, @dazo_afk, Jikan, ronnocol, zu, up_the_irons, pa, Fiouz
18:05 -!- Denial [Denial@drgi.co.uk] has quit []
18:06 -!- nikanok [~nickynick@85.17.236.236] has quit []
18:06 -!- nikanok [~nickynick@85.17.236.236] has joined #openvpn
18:06 -!- nikanok [~nickynick@85.17.236.236] has quit [Client Quit]
18:12 < samas> ok, how do i decide to use either a static key or PKI when i'm using two dd-wrt routers to connect different sites?
18:14 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:15 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Quit: AAAGH!  IT BURNS!]
18:16 < kenyon> samas: advantages and disadvantages are listed here: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html and here: http://openvpn.net/index.php/open-source/documentation/howto.html#quick
18:16 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
18:16 < samas> ah, thank you
18:18 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
18:34 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
18:36 -!- Ionic [ionic@ionic.de] has joined #openvpn
18:39 -!- KindOne [~lol@colchester-lug/silly-fool/donut] has quit [Remote host closed the connection]
18:48 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:48 -!- mode/#openvpn [+v Axeman] by ChanServ
18:52 -!- JC` [jc@versalife.mj-xii.com] has joined #openvpn
18:53 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
18:56 < JC`> !welcome
18:56 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:56 < JC`> !mitm
18:56 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially, or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates, or (#3) then use: ns-cert-type server in the client config
18:58 < JC`> quick question: i'm using client-cert-not-required and a cert (on the server) that's valid from Geotrust.  is this a bad choice?
19:05 <@vpnHelper> RSS Update - forum: using local bandwidth <http://forums.openvpn.net/topic8729.html#p15152>
19:09 -!- CapnKernel [~mjd@183.17.60.63] has joined #openvpn
19:11 < krzee> why use someone else's certs?
19:11 < krzee> i would trust my own CA more...
19:11 < krzee> in web ssl you need theirs, self-signed created a pita for users
19:11 < krzee> in openvpn, its not like that
19:11 < JC`> because i have the cert already.  i was using my own CA before...
19:12 < krzee> i have other certs too, i wouldnt use them for openvpn
19:12 < krzee> what do you think you gain from letting someone else make certs for your network?
19:13 < JC`> no real pro that i can see.  *potential* cons, but i don't see them as significant.  was trying to see if there were any lurking pros.
19:14 < JC`> it's by no means a professional VPN setup.  it's just for internet surfing amongst a few friends from coffee shops, etc.
19:16 -!- Netsplit *.net <-> *.split quits: Dougy, chokesmaster, _____m, @mattock, sia^pwnnt, Kartagis
19:16 -!- Netsplit over, joins: Dougy
19:17 -!- Netsplit over, joins: chokesmaster
19:25 -!- Squidy_at_Home [~quassel@189.75.76.28] has joined #openvpn
19:26 -!- Kartagis [sbnc@unaffiliated/kartagis] has joined #openvpn
19:33 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
19:59 -!- _julian [~quassel@hmbg-5f765f4f.pool.mediaWays.net] has joined #openvpn
20:01 -!- _julian_ [~quassel@hmbg-5f7658b9.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
20:11 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:28 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
20:37 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:38 -!- mode/#openvpn [+v Axeman2] by ChanServ
20:41 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:07 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
21:08 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
21:11 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:26 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
21:26 -!- mode/#openvpn [+o mattock] by ChanServ
21:33 -!- Squidy_at_Home [~quassel@189.75.76.28] has quit [Ping timeout: 263 seconds]
21:45 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
21:48 -!- solarce [solarce@elle.fallingsnow.net] has left #openvpn []
21:48 -!- jthunder_ [~jthunder@174.3.103.159] has joined #openvpn
21:49 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:49 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
21:51 -!- jthunder [~jthunder@174.3.103.159] has quit [Ping timeout: 245 seconds]
21:51 -!- jthunder_ is now known as jthunder
22:08 -!- Squidy_at_Home [~quassel@189.75.76.28] has joined #openvpn
22:17 <@vpnHelper> RSS Update - forum: How to end session from client side <http://forums.openvpn.net/topic8730.html#p15153>
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 264 seconds]
22:36 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
22:38 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:43 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:44 -!- JC` [jc@versalife.mj-xii.com] has left #openvpn []
22:46 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:52 -!- Titania [~titania@208.79.15.251] has joined #openvpn
23:00 -!- Squidy_at_Home [~quassel@189.75.76.28] has quit [Remote host closed the connection]
23:27 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
23:28 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Quit: changing servers]
23:28 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
23:48 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
23:48 -!- MJD [~quassel@CPEc0c1c08f73ee-CM001bd7cbfc8c.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
23:53 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 240 seconds]
23:54 -!- meepmeep [meepmeep@212.24.104.229] has joined #openvpn
--- Day changed Wed Aug 31 2011
00:00 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403-15.html#p15154>
00:06 -!- ph1l [~ph1l@2001:470:26:6f7:5ab0:35ff:fef5:8c6b] has quit [Ping timeout: 264 seconds]
00:06 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has joined #openvpn
00:15 -!- CapnKernel [~mjd@183.17.60.63] has quit [Read error: Connection reset by peer]
00:15 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
00:15 -!- CapnKernel [~mjd@183.17.60.63] has joined #openvpn
00:18 <@vpnHelper> RSS Update - forum: Routing Issue <http://forums.openvpn.net/topic8722.html#p15155>
00:24 <@vpnHelper> RSS Update - forum: Routing Issue <http://forums.openvpn.net/topic8722.html#p15156>
00:27 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
00:36 <@vpnHelper> RSS Update - forum: What am I doing wrong on my bridged settings? <http://forums.openvpn.net/topic8731.html#p15157>
00:38 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
00:40 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
00:42 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 264 seconds]
00:47 -!- jthunder [~jthunder@174.3.103.159] has quit [Remote host closed the connection]
00:47 <@vpnHelper> RSS Update - forum: using local bandwidth <http://forums.openvpn.net/topic8729.html#p15158>
00:47 -!- jthunder [~jthunder@174.3.103.159] has joined #openvpn
00:53 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
00:53 <@vpnHelper> RSS Update - forum: using local bandwidth <http://forums.openvpn.net/topic8729.html#p15159>
01:06 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p15160>
01:10 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
01:16 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 264 seconds]
01:18 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
01:20 -!- mape2k [~mape2k@f053195212.adsl.alicedsl.de] has joined #openvpn
01:22 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
01:24 <@vpnHelper> RSS Update - forum: using local bandwidth <http://forums.openvpn.net/topic8729.html#p15161>
01:25 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
01:28 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
01:30 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720-15.html#p15162>
01:33 -!- dazo_afk is now known as dazo
01:37 -!- UnterPerro [~UnterPerr@c-76-109-234-121.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:48 <@vpnHelper> RSS Update - forum: using local bandwidth <http://forums.openvpn.net/topic8729.html#p15163>
01:51 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
01:58 <@vpnHelper> RSS Update - forum: using local bandwidth <http://forums.openvpn.net/topic8729.html#p15164>
02:01 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:06 -!- Titania [~titania@208.79.15.251] has quit [Quit: Will return someday...]
02:15 -!- jthunder [~jthunder@174.3.103.159] has quit [Quit: jthunder]
02:17 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 240 seconds]
02:19 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p15165>
02:22 < Ad0> haie guise
02:30 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has quit [Remote host closed the connection]
02:30 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p15166>
02:43 -!- sigius [~sigius@93.125.185.45] has quit [Ping timeout: 245 seconds]
02:45 < krzie> ohai
02:45 < EugeneKay> Shhhh I'm sleeping
02:45 -!- krzie is now known as krzee
02:47 <@vpnHelper> RSS Update - forum: OpenVPN authentication with Active Directory <http://forums.openvpn.net/topic2403-15.html#p15167>
02:48 < krzee> hah
02:51 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
02:52 -!- EugeneKay is now known as EugeneKaway
02:52 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p15169> || What am I doing wrong on my bridged settings? <http://forums.openvpn.net/topic8731.html#p15168>
02:54 < Mowee> Morning
02:55 < krzee> mornin
03:02 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Remote host closed the connection]
03:03 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:08 <@vpnHelper> RSS Update - forum: Problem of IP address. <http://forums.openvpn.net/topic8649.html#p15172> || Begginer Question <http://forums.openvpn.net/topic8733.html> || no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p15170>
03:09 < Ad0> hi
03:09 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
03:15 -!- CapnKernel [~mjd@183.17.60.63] has quit [Quit: Leaving.]
03:15 -!- SOG [~SOG@113.108.118.58] has quit [Ping timeout: 250 seconds]
03:25 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Read error: Connection reset by peer]
03:26 <@vpnHelper> RSS Update - forum: AUTH-PAM verify if CN = USERNAME <http://forums.openvpn.net/topic8727.html#p15173>
03:35 < Ad0> could anyone help me with setting up openvpn server please? I have already set up a bridge, and I have generated certificates 
03:35 < Ad0> I just wonder about the actual config
03:35 < Bushmills> why bridge?
03:35 < Ad0> I was following a tutorial and I just did what it said
03:36 < Bushmills> !tunortap
03:36 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
03:36 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
03:36 < Ad0> if you have a better idea please tell me :)
03:36 < Bushmills> note that as reason for tap/bridge, there is *not* "because a tutorial told me to" 
03:36 < Ad0> hehe 
03:36 < defswork> Ad0, a bridge gives you a single network with the vpn joining 2 separate physical networks
03:37 < Ad0> yeah
03:37 < Ad0> my scenario is that I'd actually like samba access over VPN
03:37 < defswork> Ad0, alternative is to have 2 networks with routing inbetween
03:37 < defswork> you don't strictly need a bridge for samba
03:37 < Bushmills> http://docs.scarydevilmonastery.net/cgi-bin/dwww/usr/share/doc/openvpn/examples/sample-config-files/?type=dir   here are sample configs
03:37 <@vpnHelper> Title: Files in /usr/share/doc/openvpn/examples/sample-config-files (at docs.scarydevilmonastery.net)
03:37 <+novaflash> samba over vpn; slow.
03:37 < Ad0> ok
03:37 < Ad0> thanks
03:37 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15174>
03:37 < Bushmills> !wins
03:37 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
03:38 < defswork> Ad0, depends if you want dc elections etc.. across the vpn
03:38 < Ad0> I don't have a DC currently
03:38 < defswork> if you just want to access a file store then it's not a reason to use a bridge
03:38 < Ad0> yeah I want to access regular samba shares and other servers such as SQL 
03:39 < Ad0> on the same IP as LAN
03:39 < Ad0> should I have an own subnet for VPN ips and another one for the lan ?
03:39 < Bushmills> yes
03:39 < Ad0> or should I merge them with DHCP handling one range, and the VPN another?
03:39 < Bushmills> no
03:39 < Ad0> ok
03:39 < defswork> simplest == best
03:39 < Ad0> yeah agree
03:39 < Ad0> ;)
03:40 < Ad0> so I am not really sure where to start, really
03:40 < Ad0> I got the certs, and that's it
03:40 < Ad0> so I am really from scratch
03:40 < Ad0> and I got the example server.conf from the docs
03:40 < Ad0> my local IP is now 192.168.0.0/24
03:40 < dropje> Ad0: read the documentation.. it's really good
03:40 < Ad0> but I was suggested to change it
03:41 < Ad0> to something like 10.42.42.0/24
03:41 < Bushmills> !howto
03:41 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT!, or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:41 < dropje> Ad0: 192.168.0.0/24 is a commonly used subnet so you could get routing conflicts easily
03:42 < Ad0> yeah dropje 
03:42 < Bushmills> !1918
03:42 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html, or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
03:42 < Ad0> I will change it 
03:42 < Ad0> but I guess the vpn subnet should be something like 10.42.43.0 and the lan should be 10.42.42.0
03:42 < Ad0> and my home network could remain 192.168.0.0
03:42 <@vpnHelper> RSS Update - forum: Begginer Question <http://forums.openvpn.net/topic8733.html#p15175>
03:43 -!- bsdboy [~bsdboy@unaffiliated/deesl] has joined #openvpn
03:43 < dropje> Ad0: you could, but check RFC1918 indeed.. You could also use 172.16.0.0/12
03:43 < dropje> and 10.0.0.0/8 for vpn
03:43 < dropje> for example
03:43 < Ad0> yeah
03:45 < Ad0> I can reach samba shares on the server behind the VPN with TUN right?
03:45 < dropje> ofcourse
03:46 < Ad0> I read the howto, and afaik the bridging happens on the clienT?
03:46 < Ad0> the push route
03:46 < Ad0> I am confused about server, server-bridge and push route and local
03:47 < Ad0> and the local ifconfig
03:47 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
03:47 <@vpnHelper> RSS Update - forum: Begginer Question <http://forums.openvpn.net/topic8733.html#p15176>
03:48 < Bushmills> bridging happens where you add interfaces to a bridge
03:49 < Ad0> yeah
03:50 < Ad0> I am unsure whether I should use server or server-bridge
03:50 < Bushmills> !tunortap
03:50 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead., or (#2) and if your reason for wanting tap is windows shares, see !wins, or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
03:50 <@vpnHelper> over the vpn, or (#4) lan gaming? use tap!
03:50 < Ad0> I guess just 'server'
03:50 < Bushmills> i'd reckon "on neither server nor client"
03:52 < Ad0> when using 'server' I guess I have to give it minimum a subnet of 254 addresses?
03:53 < Bushmills> netmask determines that. but address space in for example 10.x.x.x is large enough to not care whether you don't use all addresses of the assigned subnet
03:53 < Bushmills> whether an unused address is within a /24 subnet or outset a, say /26 subnet, makes essentially no difference
03:53 < Ad0> hehe 
03:53 < Ad0> yeah you are right
03:54 < Ad0> but I assume I have to push route my real LAN subnet, or connect / bridge it with VPN so the clients can see my LAN subnet?
03:54 < Ad0> that is the part I am confused about
03:54 < Ad0> under tun
03:54 < Bushmills> !route
03:54 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
03:54 < Bushmills> !serverlan
03:54 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
03:56 < Ad0> that securecomputing URL was useful
03:56 < Bushmills> !blame
03:56 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault, or (#2) According to krzee, it's always dazo's fault, or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
03:56 < Bushmills> #1
03:59 < Ad0> that example is a bit overkill, I just want clients to see the server LAN and their own LAN, not eachother's LANs
03:59 < Ad0> so the only thing I found there was "push route"
04:00 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
04:02 < dropje> Ad0: push route does what it says: It pushes a route to the client so it's routing table knows how to reach hosts.
04:02 < Ad0> yeah
04:02 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 245 seconds]
04:02 -!- k4v [~kav@g226092110.adsl.alicedsl.de] has joined #openvpn
04:03 < Ad0> but from the LAN here behind the server, how would I know about the VPN subnet?
04:03 < Ad0> I probably need some route here too don't I ?
04:04 < krzee> you didnt read enough of !route
04:04 < krzee> theres a giant section named "routes to add outside of openvpn"
04:04 < krzee> in big caps
04:05 < krzee> (the bot did say to READ NOT SKIM)
04:05 < Ad0> I read it :)
04:05 < Ad0> didn't skim
04:05 < krzee> you said all you got was push route
04:05 < krzee> then your question was exactly what ROUTES TO ADD OUTSIDE OF OPENVPN talks about
04:05 < krzee> so my assumption is fair imo
04:06 < defswork> Ad0, either add a static route to all your lan pcs that need to converse with vpn clients, or add the route on your lan's default gateway
04:06 < defswork> (via the vpn server obviously)
04:07 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:07 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:07 < Ad0> ok
04:08 < Ad0> my client is listening on all interfaces, so I only need to access it's VPN client IP
04:08 < Ad0> I want to know as little about the client as possible
04:09 < defswork> that statement makes no sense to me
04:09 < dropje> defswork: same here
04:10 < defswork> Ad0, aah ok - you need to know how to route to your vpn subnet from the lan - not the actually end client IPs
04:10 < defswork> so if your pool is 10.1.2.0/24 make sure your lan knows how to route to that subnet - i.e. via the lan nic on the vpn server
04:11 < dropje> That's where the static route on your gateway is for
04:11 < Ad0> ok
04:11 < Ad0> I should statically route my LAN subnet to the VPN subnet on my cisco router then
04:11 < defswork> all the traffic you get from clients will be from their VPN allocated IP address
04:12 < defswork> apart from some shitty crap that windows chucks down it occasionally for reasons known only to m$
04:12 < defswork> yes
04:12 < Ad0> ok
04:12 < Ad0> then I think I might have it
04:12 < Ad0> and that URL is mighty useful if I decide to route the LANs
04:12 < Ad0> on each client
04:13 < dropje> It would be nice btw if there's an addition to the documentation on 'out-of-state packets'
04:13 <+novaflash> dropje: that sounds like you're smuggling something.
04:14 < dropje> smuggling? :)
04:14 < kenyon> out of state packets must be taxed
04:14 <+novaflash> exactly
04:14 <+novaflash> unfortunately
04:15 < dropje> it might be my lack of knowledge on teh English language but im not sure what you guys mean
04:15 <+novaflash> i love ordering stuff from the US for cheap and have it delivered to me in NL - too bad sometimes they catch the package and charge import rights and stuff on it.
04:15 <+novaflash> dropje; smuggling = smokkelen. out-of-state packet = pakketje buiten de staat (amerika) brengen
04:15 < dropje> haha yes novaflash that's always a risk
04:16 <+novaflash> please excuse my dutch
04:16 < dropje> ahhh ok i read it all in the wrong syntax
04:16 <+novaflash> wrong syntax?!
04:16 <+novaflash> wow ;)
04:16 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
04:16 < dropje> heheh
04:16 <+novaflash> dropje; are you a programmer?
04:16 < dropje> no no, but i know syntax.. i ment 'inhoud' = context
04:17 <+novaflash> ah ;)
04:17 <+novaflash> thought you might
04:17 < dropje> i was talking about out-of-state packets in routing
04:17 < dropje> ;p
04:17 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
04:18 < dropje> not smuggling products
04:18 < dropje> and i know you know i ment that
04:18 <+novaflash> dropje; i'll call off the FDA for now...
04:18 < dropje> haha thanks...
04:18 <+novaflash> or the DEA
04:18 <+novaflash> what are they called again..
04:18 <+novaflash> C&A ;)
04:18 < dropje> well it would've been nice to order a popcorn hour outside NL.. its alot cheaper
04:19 < krzee> Ad0, basically just this
04:19 < krzee> !serverlan
04:19 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
04:21 < reiffert> while talking from out-of-state packets ...
04:21 < reiffert> I'm still looking for a dutch person who can send me some dutch coffee.
04:21 <+novaflash> reiffert; what kind do you want?
04:21 < reiffert> Bushmills: what was the name again of that coffee?
04:21 <+novaflash> kanis & gunnink? douwe egberts?
04:22 < reiffert> both ;)
04:22 < Bushmills> either :)
04:22 <+novaflash> both. geez. you coffee monster
04:22 <+novaflash> if you're going to order from somewhere, shouldn't it be brazilian coffee?
04:22 < dropje> reiffert: are you talking about real coffee, or the stuff you get in the coffee shop> :)]
04:22 <+novaflash> top quality stuff and all that ;)
04:22 < Bushmills> there's a douwe and egberts office in hechtsheim
04:22 <+novaflash> hahaha good one yeah
04:23 <+novaflash> so, brownies, spacecake, straight up, powdered, joint?
04:23 < krzee> reiffert, ask |mike| when hes in here
04:23 < reiffert> dropje: real coffee. you know beans and stuff, drinking, milk andsoon
04:23 <+novaflash> reiffert; i'm dutch and i can send you the stuff if you like. send me a pm for my emailaddress
04:23 < krzee> oh score
04:23 < dropje> reiffert: well our coffee is imported so why would you want 'Dutch' coffee? It doesnt exist
04:23 < reiffert> Bushmills: oh?
04:24 < Bushmills> not sure whether they retail coffee, or  only equipment
04:24 <+novaflash> i can always have a look and see what's available
04:24 < Bushmills> came across it when i went to polo, around the corner of the D&E office
04:24 < reiffert> dropje: cause Bushmills told me about dutch coffee and there we are.
04:25 < dropje> reiffert: that's a short explanation ;)
04:25 < reiffert> Bushmills: got a google placemark or smth?
04:25 < reiffert> dropje: Bushmills likes the dutch coffee. Now I want to try it.
04:26 < Bushmills> google earth knows it.  enter   douwe egberts mainz
04:26 < dropje> Bushmills: do you like the 'Dutch' coffee or something you can get along with it? :D
04:26 <+novaflash> douwe egberts beans, second item; http://www.dutchfood.com/index.php?cPath=32&osCsid=b431ce1057677b830a5933710dc8a32f
04:26 <@vpnHelper> Title: Dutchfood.com - Specialiteiten uit Nederland (at www.dutchfood.com)
04:26 < Bushmills> shows it as  douwe egberts kaffee.systeme mainz
04:27 <+novaflash> they also have ground coffee, 8th and 9th items in that list
04:27 < reiffert> Bushmills: I'm coming along Hechtsheim later that day, should I grab smth for you as well?
04:28 < Bushmills> nothing i could think of
04:28 < reiffert> "coffee"?
04:28 < Bushmills> still got a bag fridged
04:29 < reiffert> which ones should I take?
04:29 < Bushmills> red, probably
04:29 <@vpnHelper> RSS Update - forum: Server makes no attempt to run connect script <http://forums.openvpn.net/topic8704.html#p15177>
04:29 < Bushmills> let dropje second-opinion that
04:29 < dropje> i only drink nespresso and crappy office coffee :p
04:30 <+novaflash> ah the true patriot
04:30 < dropje> used to drink the, even worse, senseo
04:30 <+novaflash> ah but that's a typically dutch invention at least
04:30 < dropje> true that
04:31 <+novaflash> just goes to show; patriotism isn't everything
04:31 < Bushmills> i've seen lavazza beans frequently in shops
04:32 < Bushmills> for price around 10 € / kg
04:32 <+novaflash> pretty hefty price. sounds important.
04:32 <+novaflash> no actually
04:32 <+novaflash> that's a decent price
04:33 <+novaflash> sorry
04:33 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
04:34 < defswork> dropje, I had 2 popcorn hours
04:34 <@vpnHelper> RSS Update - forum: Server makes no attempt to run connect script <http://forums.openvpn.net/topic8704.html#p15179> || no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026.html#p15178>
04:34 < defswork> dropje, ditched them eventually - poorly supported and buggy
04:35 < defswork> dropje, I have my own built xbmclive box now
04:36 <+novaflash> i use... um.... itunes
04:37 < defswork> novaflash, I have 3 TB HDs RAID5 and over 1000 high quality DVD rips
04:37 < defswork> 3 2TB*
04:37 <+novaflash> defswork; very nice, very nice
04:38 <+novaflash> so 4TB of space
04:38 < defswork> yes
04:38 < defswork> currently used about 2.3TB
04:38 < dropje> defswork: shit, already bought one a week ago ;)
04:39 < dropje> im pretty satisfied so far
04:39 < defswork> dropje, what version ?
04:39 < dropje> c200
04:39 < defswork> mine were A110s and they seem to have forgotten about them
04:39 < defswork> although there was a release not too long back
04:39 <+novaflash> it sucks when companies do that
04:39 < defswork> the c200 is nice
04:40 <+novaflash> it's like the company is saying "yeah the a110 was a mistake.. sorry you bought one. bye."
04:40 < dropje> yeah its fast.. faster than i expected
04:40 < defswork> My xbmclive has a CULV motherboard/cpu with nvidia ion - it's at < 10% CPU usage on playback
04:41 <+novaflash> nvidia ion will do that yes
04:41 < defswork> http://mini-itx.com/store/?c=3#array-r2 < thats the case
04:41 <@vpnHelper> Title: mini-itx.com - store - mini-itx cases (at mini-itx.com)
04:42 < defswork> I have 2 - one is my server too - room for 7 HDs
04:42 < dropje> :o looks nice.. i just run a 4 disk NAS and stream from my popcorn hour
04:43 < defswork> although the m/b in that only has 6SATA ports
04:43 < dropje> PCI card?
04:43 < krzee> <-- 4x 1.5TB disks in zfs raidz
04:43 < defswork> it's an option yes - theres one slot
04:43 < krzee> running NFS/SMB
04:43 < dropje> think you can get like 2 extra SATA ports?
04:43 < defswork> I got fed up with streaming
04:44 < defswork> too many network issues without dedicated cat5
04:44 < defswork> my house has all brick walls so wifi is iffy
04:44 < dropje> don't have any problems..
04:44 < dropje> aint using wifi
04:44 < defswork> and I tried powerline adapters but they kept locking up
04:44 < dropje> never tried power cables, never will
04:45 < dropje> not power cables, power adapters 
04:45 < defswork> when we redecorate I will run cat5
04:45 < dropje> cat 6 i hope ;)
04:45 < defswork> yeah
04:45 < Ad0> damn router
04:45 <+novaflash> i took the time once to tear out the phonewires and coax cables and replacing them with double cat5e everywhere
04:45 < defswork> I like the fact that I can have my server on 24/7 and only use a few watts
04:46 < defswork> my old server cost a fortune to run all year
04:46 < dropje> novaflash: its a shitty job but nice to have eventually
04:46 < defswork> novaflash, yeah - I'd like to do that - I run my own asterisk server at home too and IP phones would be nice
04:47 <+novaflash> dropje; it was okay with the proper tools. i bought a special 30m cable on a spool, metal fibre core with plastic skin and with a head that you can attach different attachments to - to connect to cables and pull them through the electrical plastic tubes/pipes
04:47 <+novaflash> with a bit of water and soap i had them through easily
04:47 < dropje> novaflash: not every home has decent tubes/pipes.. Some have flexible with squeezed corners which you'll never be able to pass
04:48 < defswork> I'd have to go under floorboards
04:48 <+novaflash> :) joy
04:48 <+novaflash> i'm going to get a bite to eat
04:49 < dropje> have a nice dinner ;)
04:50 < Ad0> hm the stupid linksys router won't allow me to add the static route
04:51 < Ad0> just says "invalid static route"
04:51 < Ad0> that's another issue though, but it's depressing
04:51 -!- bsdboy [~bsdboy@unaffiliated/deesl] has quit [Remote host closed the connection]
04:52 < reiffert> Ad0: what did you enter at your linksys?
04:53 < dropje> Ad0: your router says invalid static route? mabye you're giving the wrong info? :)
04:53 < Ad0> destination LAN IP: 10.42.43.0
04:53 < Ad0> subnet mask: 255.255.255.0
04:53 < Ad0> gateway: 0.0.0.0
04:53 < defswork> nurr
04:53 < cherwin> Ad0: Haha
04:53 < defswork> gateway should be ip of vpn server
04:53 < Ad0> :D
04:53 < dropje> hehhe
04:53 < Ad0> I tried that as well
04:53 < defswork> internal lan ip
04:53 < Ad0> yes
04:53 < cherwin> Ad0: The router isn't that stupid..
04:54 < Ad0> I tried 10.42.42.3 as 
04:54 < cherwin> Ad0: Typical PEBKAC
04:54 < Ad0> OH MAN
04:54 < Ad0> thanks
04:54 < Ad0> I did .1 instead of .3
04:54 < Ad0> DOH
04:54 < defswork> .1 being the linysys ?
04:54 < Ad0> yes :( my bad
04:54 < defswork> :D
04:54 < Ad0> *bangs head repeatedly against the table*
04:55 <+novaflash> hey no need to punish the table
04:55 <+novaflash> (ip tables might take offense)
04:55 -!- bsdboy [~bsdboy@unaffiliated/deesl] has joined #openvpn
04:55 < Ad0> hehe
04:56 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:56 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:56 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:59 < Ad0> if I want the openVPN client to connect using the built in linux users usernames etc, I use the openvpn-auth-pam.so plugin?
04:59 < defswork> thats for authentication - 
04:59 < defswork> which you may or may not be using
05:00 < Ad0> ok
05:00 < Ad0> I find the windows desktop client a bit lumpy
05:00 < defswork> you using the modified one that supports the management interface ?
05:01 < defswork> thats the only way to authenticate from windows cilents afaik
05:01 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15180>
05:01 < Ad0> no I just got the windows desktop client from openvpn.net
05:01 < defswork> ok - so you running as admin ?
05:01 < defswork> or as a service ?
05:01 < Ad0> what do you mean? :)
05:02 < Ad0> the client?
05:02 < defswork> on windows you have to be privileged to add/amend routes
05:02 < defswork> so you have to run the openvpn process as a privileged user
05:02 < Ad0> yeah
05:02 < defswork> you can do this by the user being an admin
05:02 < Ad0> I am running as admin
05:02 < defswork> or run as admin
05:02 < defswork> or run it as a service
05:02 < defswork> I prefer run as service
05:03 < Ad0> yes me too, but right now I am testing so I just run as admin for time being
05:03 < defswork> it matters though
05:03 < Ad0> http://swupdate.openvpn.net/downloads/openvpn-client.msi
05:03 < Ad0> this is what I got
05:03 < defswork> if you want to use authentication and run it as a service you need to use the management interface to pass the user/pass to the openvpn process
05:03 < Ad0> ok
05:04 < Ad0> well does openvpn automagically use built in linux auth?
05:04 < defswork> the client doesn';t know
05:04 < defswork> thats all up to the server directives
05:04 < Ad0> yes
05:04 < Ad0> wondering what the defaults are
05:04 < Ad0> and I am searching for where to store the client certificate on the client
05:04 < defswork> http://openvpn-mi-gui.inside-security.de/ < thats the windows gui I use
05:04 <@vpnHelper> Title: OpenVPN MI GUI - A Windows GUI for the OpenVPN client (at openvpn-mi-gui.inside-security.de)
05:05 < defswork> you can path the certs in the client config file
05:05 < Ad0> ok
05:05 < defswork> or default CWD is INSTALLDIR/Config
05:05 < Ad0> ah ok
05:07 <+novaflash> i see a lot of openvpn gui's come by
05:07 <+novaflash> is there a list of these somewhere?
05:08 < defswork> https://community.openvpn.net/openvpn/wiki/RelatedProjects
05:08 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
05:08 <+novaflash> oh under related projects. of course. thanks :)
05:08 < uuuppz> ad0: you could try my gui :) - http://sourceforge.net/projects/openvpnui/
05:08 <@vpnHelper> Title: OpenVPN UI | Download OpenVPN UI software for free at SourceForge.net (at sourceforge.net)
05:09 < Ad0> sweet
05:10 < defswork> uuuppz, I think I raised a ticket on that
05:10 < defswork> when I was looking for authentication solutions for windows clients
05:10 < uuuppz> hm no tickets on the page that I can see
05:10 < defswork> no
05:11 < defswork> maybe it was another one
05:11 < defswork> it was 
05:11 < Ad0> hm tried to run the UI but nothing happened :)
05:11 < defswork> the download page used to point to a gui and said it would become the default - it was that one
05:12 < defswork> but seems to have gone
05:12 < Bushmills> maybe you should setup server and clients before trying to run the UI?
05:12 < defswork> http://sourceforge.net/projects/openvpn-gui/  < thats the one
05:12 <@vpnHelper> Title: OpenVPN GUI | Download OpenVPN GUI software for free at SourceForge.net (at sourceforge.net)
05:12 < defswork> the wiki says "The new GUI will eventually replace the old GUI in the official installers."
05:12 < Ad0> where is the program localted uuuppz 
05:12 < Ad0> located*
05:13 < defswork> but the new gui doesn't actually work
05:13 < uuuppz> ad0: It assumes you have standard gui properly configured
05:13 < Ad0> the standard gui ? 
05:14 < uuuppz> the one that installs with opepvpnb
05:14 < defswork> I don't know if it's true that that gui will become the standard one but atm it's useless as it cannot connect to exist process 
05:14 < Ad0> hm?
05:14 < defswork> I've no idea why - it's just a socket connection
05:14 < Ad0> opepvpnb
05:14 < Ad0> lol
05:15 < Ad0> you mean the standard OpenVPN standard windows desktop client
05:15 < Ad0> ?
05:15 < uuuppz> yes
05:15 < Ad0> ok
05:15 < Ad0> is that the case for http://openvpn-mi-gui.inside-security.de/ as well?
05:15 <@vpnHelper> Title: OpenVPN MI GUI - A Windows GUI for the OpenVPN client (at openvpn-mi-gui.inside-security.de)
05:15 < Ad0> argh gota install it for the 3rd time then
05:16 < defswork> Ad0,  the one I linked to is the one shipped in the windows installer but modified to use the MI
05:16 < defswork> you just drop in the single .exe
05:16 < Ad0> ok
05:18 < Ad0> installed the openvpn client
05:18 < Ad0> still nothing happening ...
05:18 < defswork> what are you expecting  ?
05:18 < defswork> all the client does is stop/start openvpn process
05:18 < Ad0> wtf
05:18 < defswork> have you configured it ?
05:18 < defswork> checked the logs ?
05:19 < Ad0> I expected a better interface than the original
05:19 < defswork> what else do you want it to do ?
05:19 < defswork> stop/start with bells on ?
05:19 < defswork> most people don't want/need end users to be able to tinker
05:25 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15182>
05:28 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
05:31 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15183>
05:32 <+novaflash> Ad0; if you want a client that looks and works perfectly, get viscosity. i think it's fantastic. but it's mainly eyecandy and extra menu's with extra options. the plain vanilla openvpn gui works fine too.
05:33 <+novaflash> http://www.thesparklabs.com/viscosity/
05:33 <@vpnHelper> Title: Viscosity - OpenVPN Client for Mac & Windows (at www.thesparklabs.com)
05:37 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15184>
05:46 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 264 seconds]
05:49 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15186>
05:50 < dropje> any1 ever seen this? http://www.youtube.com/watch?v=SXmv8quf_xM 
05:50 <@vpnHelper> Title: How to view someones IP address and connection speed! - YouTube (at www.youtube.com)
05:51 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
05:52 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
05:52 < Ad0> novaflash: I just want something non-obtrusive that remembers my credentials
05:52 < Ad0> the standard gui doesnt seem to do that
05:53 < defswork> remembers credentials ? for how long ?
05:53 < defswork> the version I pointed to will remember it until you forcefully disconnect if you want 
05:54 < Ad0> yeah
05:54 < defswork> if fact thats openvpn thats doing that
05:54 < defswork> not the gui
05:54 < Ad0> next time you boot?
05:54 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15187>
05:54 < defswork> why authenticate at all then ?
05:54 < defswork> you have a pointless security system if the user/pass is filled in so just drop it altogether
05:54 <@dazo> dropje: ROTFL
05:54 < Bushmills> Ad0: keys
05:54 < Ad0> HEHE
05:55 < Ad0> yeah
05:55 < dropje> dazo: its really really terrible right? i think it's pretty amazing how certain he is of the bullshit he is telling
05:56 -!- Ionic [ionic@ionic.de] has joined #openvpn
05:56 <@dazo> dropje: teenager wannabe hacker :)
05:56 < defswork> dropje, worst thing ever - letting 10 year olds post videos on youtube - at least with websites they have to have a slight clue to create a page
05:56 <@dazo> +1
05:56 < defswork> I can't stand all this video crap
05:57 < defswork> I don't want to watch a video to find something out
05:57 < defswork> I want text that I can search/scan etc..
05:58 < Ad0> do I have to create tun by hand?
05:58 <@dazo> yeah,  but we're living in the time of the TV generation .... if it doesn't happen on a screen, it's not true and doesn't exist
05:58 < Ad0> or do I have to compile something into the kernel perhaps
05:59 <@dazo> Ad0: if you have tun.ko available (Linux), it should be loaded automatically
05:59 < defswork> everyone is supposed to have ADHD now - yet you need to be far more attentive to find out how to do something by watching a video
05:59 < Ad0> hm
05:59 <@dazo> but you need to have tun support in kernel
05:59 < Ad0> I will take a look
06:01 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:03 < Ad0> it is compiled in yes
06:03 <@dazo> defswork: I'm looking it from another perspective too, though ... if MS hadn't accepted garbage from the command line (a complete URI) such misunderstanding wouldn't have happened ... tracert would basically need just hostname, and optionally protocol and port number to do tcp/udp traces
06:03 < Ad0> SIOCSIFADDR: No such device
06:03 < Ad0> :P
06:03 <@dazo> Ad0: lsmod | grep tun
06:03 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
06:03 < Ad0> not there :(
06:03 < Ad0> but it was ticked off in menuconfig
06:03 < Ad0> so I don't get it
06:03 <@dazo> Ad0: how was it ticked off?
06:03 < Ad0> not as a module
06:03 < Ad0> compiled in
06:03 <@dazo> ahh
06:04 < defswork> you made your own kernel ?
06:04 < Ad0> yes
06:04 < Ad0> I use xen
06:04 < Ad0> need to do that
06:04 < defswork> thats so 1990s
06:04 < Ad0> yeah I know :)
06:04 <@dazo> Ad0: do you have /dev/net/tun
06:04 < Ad0> yse
06:04 < Ad0> yse*
06:04 < Ad0> argh YES
06:04  * dazo encourage people to at least try building a few kernels ... you learn a lot about what a kernel does and can control 
06:05 <@dazo> Ad0: okay, then you have the tun stuff available
06:05 -!- albech [~thomas@183.88.76.213] has joined #openvpn
06:05 < defswork> sure - I grep the source code frequently
06:05 < defswork> had to check if write-mostly affected the read bias on anything other than raid1 just yesterday
06:05 <@dazo> Ad0: then it's most likely just a openvpn config issue
06:06 < Ad0> ok
06:07 < Ad0> "dev tun"
06:07 < Ad0> do I have to state "local" ? 
06:07 < dropje> dazo: you're right about it being weird that the command line accepts garbage but still.. know your tools man ;) 1 search on google and he'd known what it does. Now he spend a lot of time in creating this stupid video
06:08 <@dazo> dropje: well, the world is full of fools :)
06:08 < Ad0> fixed it
06:09 < Ad0> but should I set a "local" listening IP 
06:09 < Ad0> that is on the VPN subnet?
06:09 < Ad0> like 10.42.42.1 ?
06:10 < Ad0> or does it do that automatically
06:13 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has joined #openvpn
06:15 -!- v0x [~v^x@gateway/tor-sasl/voidzero] has quit [Remote host closed the connection]
06:15 < Ad0> can't find where I should put my client crt file on the client
06:17 < Ad0> is it an .ovpn file?
06:17 < Ad0> seems like it!
06:18 < dropje> Ad0: .ovpn is a configuration file
06:18 < dropje> inside your configuration file you can give a path to your client crt, so it really doesnt matter where you put it
06:18 < Ad0> yeah
06:18 < Ad0> I need to set one up
06:18 < Ad0> I can just use a vanilla one using tun I guess.
06:19 -!- CapnKernel [~mjd@222.248.96.92] has joined #openvpn
06:21 <@dazo> Ad0: --local is the IP of the eth device you want the server to listen to, or clients to connect from
06:21 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15188>
06:21 <@dazo> if not given, server will listen to 0.0.0.0, and clients will use whatever device makes most sense automatically
06:25 < Ad0> ok
06:26 < Ad0> I just need to find a client config
06:26 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15189>
06:33 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15190>
06:45 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15193> || SVC_RUN_EXCEPT-cannot start server <http://forums.openvpn.net/topic8696.html#p15192>
06:46 -!- corretico [~luis@201.201.44.82] has joined #openvpn
06:48 -!- bsdboy [~bsdboy@unaffiliated/deesl] has quit [Remote host closed the connection]
06:50 < Ad0> wut I managed to connect
06:50 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15194>
06:53 < Ad0> TLS Error: reading acknowledgement record from packet
06:54 < Ad0> hm now I fixed that, set it on the server
06:54 < Ad0> client hangs at "logging in"
06:56 < Ad0> the route pushed doesn't get set up
06:56 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720-15.html#p15195>
06:57 < dropje> Ad0: are you running the openvpn GUI on windows? make sure u run it as administrator
06:58 < Ad0> ok
06:58 < Ad0> it does connect
06:58 < Ad0> but it sticks at "logging in"
06:58 < Ad0> would I come this far if I wasn't allowed?
06:59 < Ad0> uthenticate/Decrypt packet error: packet HMAC authentication failed
06:59 < defswork> so it's trying to authenticate ?
06:59 < Ad0> yeah
06:59 < dropje> does you client configuration comply with your server configuration?
06:59 < defswork> have you set it up at both ends ?
06:59 <@dazo> Ad0: are you using --tls-auth?
07:00 < dropje> haha, we all basically say the same thing :p
07:00 < Ad0> yes
07:00 <@dazo> Ad0: are the --tls-auth key files the same on both sides?
07:00 < Ad0> tls-auth ta.key 1 
07:00 < Ad0> yes
07:00 <@dazo> Ad0: and the other side has tls-auth ta.key 0 ?
07:00 < Ad0> no, 1
07:01 < Ad0> maybe I should set the server to 0
07:01 < defswork> bzzzzzt
07:01 <@dazo> one side needs 1, the other side need 0
07:01 < Ad0> pj
07:01 < Ad0> LOL
07:01 <@dazo> heh
07:01 < dropje> Ad0: you could've figured that one out from the HOWTO :)
07:02 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:02 -!- mode/#openvpn [+v Axeman] by ChanServ
07:02 < Ad0> hehe
07:02 < Ad0> I get the same message, now on the server isntead of the client :
07:02 < Ad0> :)
07:02 < defswork> you restarted ?
07:02 < Ad0> yes
07:04 < Ad0> it would bomb out if it had the wrong path to the ta.key 
07:04 < defswork> bomb ?
07:04 < defswork> it would log error in logs
07:05 < Ad0> Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
07:06 < Ad0>  do I need the .pem on the client?
07:07 <@dazo> Ad0: there are two file based authentications in OpenVPN
07:07 <@dazo> one, and the most common one is  by using --ca, --cert and --key
07:07 <@dazo> the other one, which comes in addition is --tls-auth
07:08 <@dazo> these two must under no circumstances be mixed together ... they are completely independent of each other
07:09 <@dazo> the --tls-auth needs the same key file on both sides.  And the optional parameter needs to be 1 on one side and 0 on the other
07:09 < Ad0> ok
07:10 <@dazo> without the complete log it is difficult to see what else is wrong ... but please scan your logs carefully for all WARNINGS and ERROR messages ... if they are present, you'll most likely have troubles
07:10 < defswork> dazo, you lost me on mixed together
07:11 < defswork> I have all of ca cert key and tls-auth 
07:11 < dropje> defswork: same here
07:11 < dropje> its an extra layer
07:11 < Ad0> hmm
07:11 <@dazo> yeah, that's fine
07:11 < dropje> opening up the udp port
07:11 < defswork> phew :)
07:11 < dropje> ?
07:11 <@dazo> but the errors 
07:12 < dropje> The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. It can protect against:
07:12 < dropje> DoS attacks or port flooding on the OpenVPN UDP port. Port scanning to determine which server UDP ports are in a listening state. Buffer overflow vulnerabilities in the SSL/TLS implementation. SSL/TLS handshake initiations from unauthorized machines (while such handshakes would ultimately fail to authenticate, tls-auth can cut them off at a much earlier point).
07:12 <@dazo> they are different authentication schemas, and may be combined ... but configuration wise, it is completely different auth layers
07:12 < dropje> ok phew, im still good :p
07:12 < defswork> Ad0, do you ahve tls-client and tls-server defined  ?
07:12 < Ad0> I had tls-client
07:12 < defswork> on the client and tls-server on the server ?
07:13 < Ad0> on the client
07:13 <@dazo> dropje: quite some users believe --tls-auth is related to --tls-client/--tls-server ... which is not true
07:13 < Ad0> but no tls-server on the server
07:13 < defswork> that would be me then :)
07:14 <@dazo> Ad0: look at Example 3 in the openvpn man page
07:16 < Ad0> hm I can't find it
07:16 < Ad0> afaik tehre's only 1 example in the man page
07:16 <@dazo> which version of openvpn do you have installed?
07:16 < Ad0> 2.2.1
07:17 <@dazo> !man
07:17 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual, or (#2) http://openvpn.net/man-beta.html for 2.1 manual, or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual, or (#4) the man pages are your friend!
07:17 <@dazo> Ad0: http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html#lbBC
07:17 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-15.html#p15197> || OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p15196>
07:17 <@vpnHelper> Title: OpenVPN 2.2 (at openvpn.net)
07:19 < Ad0> indeed
07:19 < Ad0> thanks!
07:21 < Ad0> what's verb ? 
07:21 < Ad0> oh verbose
07:27 < Ad0> "TLS Error: incoming packet authentication failed from xxx.xx.xx.x"
07:27 < Ad0> it is obviously something messed up with the keys
07:27 < Ad0> I have checked the client and server configs after that example
07:27 < Ad0> let me pastebin both
07:28 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
07:35 < Ad0> http://pastebin.com/ZTDi77Wr
07:35 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15198>
07:39 < Ad0> tls-client is redundant since I use "client"
07:41 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15199>
07:47 -!- Hr13 [~13@h69n2c1o253.bredband.skanova.com] has joined #openvpn
07:47 < Ad0> I guess it's dangerous with "auth none" and "cipher none" :)
07:47 <@vpnHelper> RSS Update - forum: Installation Issues on Fedora <http://forums.openvpn.net/topic8683.html#p15201> || Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580-15.html#p15200>
07:49 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:50 < Ad0> it doesn't solve my problem though
07:50 < Hr13> Hi all, is there any howto or guide on installing and configuring a Win SBS 2008 server as a OpenVPN server. I cant get the PPTP crap to work problems with the 47 GRE at my clients firewall. I would prefer a linux server but my client wants a win server
07:51 < Bushmills> !pptp
07:51 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
07:51 <@vpnHelper> read about why to not use pptp, or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
07:52 < Hr13> vpnHelper, I know, thats why Id like to get OpenVPN up and running, but will it work on a Win SBS 2008 server? 
07:52 < Bushmills> there are windows versions of openvpn
07:52 <@vpnHelper> RSS Update - forum: Begginer Question <http://forums.openvpn.net/topic8733.html#p15203> || Installation Issues on Fedora <http://forums.openvpn.net/topic8683.html#p15202>
07:53 < dropje> Windows Vista SP1 and Windows Server 2008 now support a new VPN protocol – Secure Socket Tunneling Protocol or SSTP. SSTP uses SSL encrypted HTTP connections to establish a VPN connection to the VPN gateway. SSTP is secure because user credentials are not sent until after a secure SSL tunnel is established with the VPN gateway. SSTP is also known as PPP over SSL, so this means that you can use PPP and EAP authentication mechanisms to make your SST
07:53 < dropje> you could look into that
07:53 < dropje> its an openvpn rip off :P
07:55 < Hr13> dropje, I started to look at that but since I have setup a couple of OVPN server that feelt easier if it will work on Win 2008 ( I have only setup Ovpn on Linux servers) 
07:56 < Ad0> does the client need the .pem file?
07:56 < Ad0> did anyone check out http://pastebin.com/ZTDi77Wr ? :)
07:58 < dropje> Ad0: check this out: http://openvpn.net/index.php/open-source/documentation/howto.html#pki
07:58 <@vpnHelper> Title: HOWTO (at openvpn.net)
07:59 < dropje> Ad0: scroll down to "Key Files" for an overview
07:59 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
08:01 < Ad0> ok
08:03 < Ad0> let me try to regenerate the keys
08:03 <@vpnHelper> RSS Update - forum: Installation Issues on Fedora <http://forums.openvpn.net/topic8683.html#p15204>
08:13 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
08:13 < Ad0> dropje: I regenerated all the keys following the howto
08:13 < Ad0> still no dice
08:15 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 264 seconds]
08:15 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720-15.html#p15205>
08:16 < Bushmills> Ad0: most likely reason is, there's something wrong
08:16 < Bushmills> that describes your problem description "still no dice" best, i think
08:17 < Ad0> hehe
08:17 < Ad0> I can't figure out what
08:18 < Ad0> I am copying the same keys over
08:18 < Bushmills> logs may tell
08:18  * datruth peeps in
08:19 < datruth> Ad0: whats your issue?
08:19 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
08:19 < Ad0> :)
08:19 < Bushmills> it's lacking dice
08:19 < Ad0> I get Authenticate/Decrypt packet error: packet HMAC authentication failed
08:19 < Ad0> TLS Error: incoming packet authentication failed from xxxx
08:19 < Ad0> I have the same ta.key
08:19 < Ad0> etc
08:19 -!- bsdboy [~bsdboy@unaffiliated/deesl] has joined #openvpn
08:20 < datruth> You have the right ta,key and the correct direction?
08:20 < Ad0> configs http://pastebin.com/ZTDi77Wr 
08:20 < datruth> I belive on the server it should 1 and the client should be 0
08:20 < Ad0> 0 on the server, 1 on the client
08:20 < Ad0> ok
08:20 < datruth> gotcha
08:20 < Ad0> let me try that
08:20 < datruth> You make sure the client has the ta.key thats on the server
08:21 < Ad0> yes
08:21 < Ad0> I double and triple checke
08:21 < Ad0> same problem
08:22 < Ad0> just that the client displays the error instead :)
08:22 < Ad0> I gues 0 and 1 are directions
08:22  * datruth looks at the configs
08:23 < datruth> Use full path names to your keys/certs
08:23 < Ad0> hm shouldn't matter
08:23 < Ad0> if it can't find them it crashes
08:23 < Ad0> I tested it
08:24 < datruth> regenerate the ta.key
08:24 < datruth> and then reload openvpn
08:24 < datruth> update the client with the same key and try again
08:24 < Ad0> just did that
08:24 < Ad0> hehe
08:25 < Ad0> I am starting to think that the desktop client is broken
08:25 < datruth> hrmm
08:26 < datruth> https://community.openvpn.net/openvpn/browser/sample-config-files/client.conf <-- i'd try having my conf file in that type of order
08:26 <@vpnHelper> Title: /sample-config-files/client.conf – OpenVPN Community (at community.openvpn.net)
08:26 < Ad0> ddddhehe
08:26 < Ad0> shouldn't matter
08:26 < Ad0> same thing as you pass params in different orders straight to the bin
08:26 < datruth> hrmm gotcha
08:27 < datruth> well hrmm that is strange
08:27 < Ad0> openvpn --genkey --secret ta.key
08:27 < Ad0> that is what I use
08:27 < datruth> yeah thats roi
08:27 < datruth> right*
08:27 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:28 < datruth> Its got to be an issue with the ta.key
08:28 < datruth> But the desktop client only gives the error
08:28 < datruth> nothing in the server logs?
08:29 < Ad0> the server gives this error I posted 
08:29 < Ad0> if it is 0
08:29 < datruth> Your configurations now server = 0 client = 1 are they both producing the error now or just the server or is it just the client?
08:30 < Ad0> just the server
08:30 < datruth> Hrmm okay has it ever worked for you?
08:31 < datruth> try generating a key named other than ta.key update the configs with the new name client/server and restart ovpn and try again
08:32 < Ad0> ok
08:33 -!- samas [4c007f5b@gateway/web/freenode/ip.76.0.127.91] has quit [Ping timeout: 252 seconds]
08:34 < datruth> in your client.conf remove tls-client
08:35 < Ad0> same happens
08:35 < Ad0> yes done it
08:35 < Ad0> same happens :P
08:35 < Ad0> client has tls-client :)
08:38 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:38 < Ad0> made it work!!!
08:38 < datruth> :)
08:39 < datruth> So what fixed it?
08:39 < datruth> new key name or removing sthat tls-client
08:39 < datruth> ?
08:39 < Ad0> key-direction 1
08:39 < Ad0> tls-auth tazz.key
08:39 < datruth> ahh cool
08:39 < Ad0> not tls-auth tazz.key 1
08:39 < Ad0> nasty
08:39  * datruth scraches head
08:39 < Ad0> oh wait
08:39 < Ad0> too early to celebrate
08:40 < datruth> you use the syntax key-directory 1?
08:40 < Ad0>  TLS handshake failed
08:40 < datruth> oh ;/
08:42 < Ad0> one step further
08:42 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:43 < datruth> True
08:43 < datruth> your error is rather strange tho
08:43 < Ad0> unable to get local issuer certificate
08:44 < datruth> hrmm that doesn't sound good
08:52 < Ad0> no
08:52 < Ad0> how do I clean up the cert database
08:52 < Ad0> rm /etc/ssl/
08:53 < Ad0> hmm
08:53 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:54 < dropje> Ad0: if you generated your certs with easy-rsa, use the clean-all script
08:55 < Ad0> will it revoke everything ? 
08:55 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15206>
08:55 < ecrist> no, it doesn't revoke anything, but it deletes everything.
08:56 < Ad0> I need to clean up the authority db
08:58 < ecrist> what does that mean?
08:58 -!- samas [4c007f5b@gateway/web/freenode/ip.76.0.127.91] has joined #openvpn
08:59 -!- Wildy [~lion@212.119.246.18] has quit [Ping timeout: 240 seconds]
08:59 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
09:00 -!- Hr13 [~13@h69n2c1o253.bredband.skanova.com] has quit [Quit: Leaving]
09:01 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
09:02 -!- master_of_master [~master_of@p57B522CF.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:04 < Ad0> it works now!
09:04 < Ad0> key names were messed up
09:04 -!- master_of_master [~master_of@p57B54319.dip.t-dialin.net] has joined #openvpn
09:06 < Ad0> now I need to know how to ping the client
09:06 < ecrist> I'd start with ping
09:06 < Ad0> hehe
09:06 < Ad0> yeah it is not responding :(
09:07 -!- Wildy [~lion@212.119.246.18] has quit [Ping timeout: 260 seconds]
09:07 < Ad0> I can't ping the vpn ip my client got assigned :P
09:07 < Ad0> but the client can ping my IP here locally
09:08 -!- Wildy [~lion@195.34.30.225] has joined #openvpn
09:08 < Bushmills> !firewall
09:08 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info, or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
09:08 < Ad0> firewall is off
09:09 < defswork> pinging from where ?
09:09 < Ad0> my LAN on the server
09:09 < defswork> vpn server or something on the lan ?
09:09 < defswork> routes
09:09 < Ad0> routes should be fine
09:09 < defswork> should be but arent
09:09 -!- Wildy_ [~lion@212.119.246.18] has joined #openvpn
09:10 < Ad0> client can ping machines on the LAN here
09:10 < Ad0> but not the other way around
09:10 < Ad0> should routes be added 2 ways ? 
09:10 < defswork> 2 ways ?
09:10 -!- Wildy [~lion@195.34.30.225] has quit [Read error: Operation timed out]
09:10 < defswork> if client can access a lan machine and theres no natting involved then the routing must be ok
09:10 < Ad0> 10.42.43.0 255.255.255.0 10.42.42.3
09:11 < Ad0> that is the route I set up
09:11 < Ad0> the LAN here is 42.42
09:11 < Ad0> the VPN server LAN IP is .3
09:11 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15207>
09:11 < defswork> you set that up where ?
09:11 < defswork> on your linksys ?
09:12 < Ad0> yup
09:12 < Ad0> on the vpn server LAN
09:12 < defswork> server has no firewall - just ip_foward set to 1 ?
09:12 < Ad0> echo 1 > /proc/sys/net/ipv4/ip_forward ?
09:12 < defswork> yes
09:12 < Ad0> as root I guess
09:13 -!- Wildy_ [~lion@212.119.246.18] has quit [Read error: Connection reset by peer]
09:13 < Bushmills> ping client from server, instead from machine in the LAN behind server 
09:13 < Ad0> that's what I am doing
09:13 < Ad0> still can't ping it though
09:14 < Bushmills> wrong ip address, or firewall on client
09:14 < Ad0> LOL
09:14 < Ad0> 43.10 works
09:14 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
09:14 < Ad0> DOH
09:14 < Ad0> sorry for wasting your time
09:14 < defswork> you pinging random ips ?
09:14 < Ad0> yeah 
09:15 < Ad0> dhcp server was .9
09:15 < Ad0> it supposedly sid
09:15 < Ad0> said
09:15 < defswork> dhcp ?
09:15 < Ad0> but that seems random
09:15 < Ad0> yes the client adapter gets 10.42.43.9 as DHCP server
09:15 < Ad0> does the openvpn server just pick one ??
09:15 -!- albech [~thomas@183.88.76.213] has quit [Quit: Ex-Chat]
09:15 < defswork> your ips are allocated to clients in /30 subnets
09:16 < defswork> [0,1,2,3]  [4,5,6,7] [8,9,10,11] etc..
09:16 < Ad0> hehe
09:16 < defswork> 0,3 4,7 8 11 are broadcast ends of the subnet
09:16 < defswork> 1 - server IP
09:16 < defswork> 2 - client IP
09:16 < defswork> for each client connected
09:16 < Ad0> ok
09:19 < Ad0> what determined the client name again?
09:19 < Ad0> isn't it something in the cert?
09:19 < defswork> CN in the cert
09:20 < Ad0> ok
09:20 < defswork> you can specify an ip persist file so all clients get the same ip also
09:20 < defswork> each time they connect
09:20 < Ad0> yes that is what I am planning :)
09:21 < Ad0> and later, maybe even to see their networks
09:22 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15208>
09:23 < defswork> that would require routing via a windows client ?
09:23 < Ad0> I read some documentation on it
09:23 < Ad0> there is some routing setup involved
09:23 < Ad0> ifconfig-push 10.8.1.1 10.8.1.2
09:24 < Ad0> what do the 1.1 mean?
09:24 < defswork>        --ifconfig-push local remote-netmask
09:24 < defswork>               Push virtual IP endpoints  for  client  tunnel,  overriding  the
09:24 < defswork>               --ifconfig-pool dynamic allocation.
09:25 < Ad0> yes
09:25 < Ad0> hm remote netmask?
09:25 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
09:27 < Ad0> since I have 10.42.43.0/24 and I want a certain client to have 10.42.43.99
09:28 < Ad0> ifconfig-push 10.42.43.100 10.42.43.1
09:28 < Ad0>  ?
09:29 < ecrist> read the docs
09:34 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15209>
09:40 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15210>
09:40 < Ad0> boohoo I am not allowed to use 100 :P
09:41 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Read error: Connection reset by peer]
09:41 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
09:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
09:43 < ecrist> !topology
09:43 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions., or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
09:44 < Ad0> cool
09:45 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
09:45 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15212>
09:48 -!- CapnKernel [~mjd@222.248.96.92] has left #openvpn []
09:53 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
09:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:58 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15214> || OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p15213>
10:01 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 264 seconds]
10:20 -!- Wildy [~lion@212.119.246.18] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
10:29 -!- nixusr_ [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
10:29 -!- nixusr_ [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
10:29 -!- nixusr_ [~nixusr@unaffiliated/nixusr] has joined #openvpn
10:33 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 264 seconds]
10:33 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15215>
10:40 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15216>
10:43 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 252 seconds]
10:46 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15217>
10:52 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15219> || Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314.html#p15218>
10:56 -!- lwhalen [~law@bastion-ext.sermo.com] has joined #openvpn
11:04 <@vpnHelper> RSS Update - forum: no connection to subnetwork after openvpn connection <http://forums.openvpn.net/topic8026-30.html#p15220>
11:08 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:16 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p15221>
11:32 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
11:43 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
11:54 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:57 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
12:00 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
12:00 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:07 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:08 -!- mode/#openvpn [+v s7r] by ChanServ
12:08 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
12:35 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
12:36 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
12:38 -!- k4v [~kav@g226092110.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
12:40 -!- EugeneKaway is now known as EugeneKay
12:45 -!- bsdboy [~bsdboy@unaffiliated/deesl] has quit [Quit: Leaving...]
12:47 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
13:00 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:01 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
13:13 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:22 -!- bsdboy [~bsdboy@unaffiliated/deesl] has joined #openvpn
13:23 -!- bsdboy [~bsdboy@unaffiliated/deesl] has quit [Client Quit]
13:25 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
13:25 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
13:25 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
13:25 -!- nixusr_ [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 268 seconds]
13:26 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
13:29 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
13:30 < chandoo> hi
13:31 < chandoo> currently i am using cisco vpn. with small key which generates the password
13:31 < chandoo> how does openvpn works
13:32 < chandoo> do i need to pay someone to use openvpn in a organization?
13:32 < chandoo> is it ready to be used at enterprise level?
13:32 <+novaflash> well we tend to think so, yes
13:32 <+novaflash> openvpn community edition is open source and free
13:33 <+novaflash> authentication modules are available for LDAP support (active directory) and such
13:33 <+novaflash> there's also a commercial edition called OpenVPN Access Server
13:33 < chandoo> can it replace cisco vpn?
13:34 <+novaflash> replace?
13:34 <+novaflash> it's not compatible with cisco's vpn protocols afaik
13:34 <+novaflash> so you can't connect cisco vpn clients to openvpn as far as i know. cisco uses ipsec.
13:34 <+novaflash> openvpn uses ssl
13:34 <+novaflash> but if you want a different solution for your vpn needs
13:35 <+novaflash> then openvpn can replace cisco's vpn solution.
13:35 < chandoo> i mean ditch cisco vpn and implement open-vpn
13:35 <+novaflash> yeah that's definitely possible
13:35 < chandoo> no cisco in the picture
13:35 <+novaflash> yup. works completely without cisco involvement.
13:36 < chandoo> i am doing some cost analysis comparasion between, like what are advantages and what will be the savings
13:36 < Ad0> fuck cisco clients
13:36 <+novaflash> Ad0; oh how rude
13:36 < Ad0> they waited SO long for the 64 bit 
13:36 < Ad0> :)
13:36 <+novaflash> Ad0; are they....pretty blonde hot women?
13:36 < Ad0> cisco?
13:36 < Ad0> no :)
13:36 <+novaflash> aw darn
13:36 <+novaflash> otherwise i would be willing to volunteer for duty
13:36 < chandoo> what client open vpn uses
13:37 <+novaflash> openvpn is both a client and a server in one
13:37 <+novaflash> it depends on the configuration what role it fulfills
13:37 <+novaflash> for the client you can install openvpn community edition and use the gui to connect to a server
13:37 < chandoo> i am working on with one of the merger , they want some sort of vpn connectivity to their network for employees
13:38 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 250 seconds]
13:38 < chandoo> roughly 14000 employees
13:38 < chandoo> not all the employees has vpn access
13:39 < chandoo> can say roughly around 5000 employees has vpn access
13:39 < chandoo> does it support this level of usage
13:39 < Ad0> is there a tool to compile keys and config into one file?
13:39 < ecrist> openvpn is single threaded
13:39 < ecrist> Ad0: yeah, zip
13:39 < Ad0> haha
13:39 <+novaflash> in that case you might benefit from using OpenVPN Access Server - it provides an easy to use method of automatically generating configuration files for the clients. and their pricing model is very competitive; only $5 for each CONCURRENT connection. so even if you have 15000 users configured, if only 500 are connected at one time, you only pay for 500 licenses.
13:40 < Ad0> but can openvpn read that file ?
13:40 < ecrist> no
13:40 < Ad0> well there ya go
13:40 < ecrist> you can't do what you're looking to do
13:40 <+novaflash> ecrist; really? aw. how disappointing.
13:40 < Ad0> I read on some forun that you could embed the keys
13:40 < Ad0> with XML syntax
13:41 < chandoo> novaflash:} any links to compare and do cost analysis
13:41 < Ad0> http://www.mail-archive.com/networkmanager-list@gnome.org/msg12349.html
13:41 <@vpnHelper> Title: Re: Support for markup configuration with NetworkManager-openvpn (at www.mail-archive.com)
13:41 <+novaflash> chandoo; go ahead and join #openvpn-as
13:41 < ecrist> Ad0: that's specific to network manager
13:41 < Ad0> which means that "desktop client" ?
13:42 < ecrist> yup
13:42 < Ad0> well that's all I need :)
13:42 < Ad0> now I have to export them to that base64
13:42 < ecrist> well, ask them, because it's not an openvpn thing
13:42 < Ad0> it seems promising
13:42 < Ad0> ok
13:43 < Ad0> "Inline files are supported in OpenVPN 2.1"
13:43 < Ad0> do they talk about another openvpn?
13:43 < Ad0> :P
13:43 < Ad0> I'm going to try it
13:45 -!- dazo is now known as dazo_afk
13:48 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
13:50 < ecrist> Ad0: the only 'xml' thing openvpn supports, that I'm aware of, is <connection> blocks
13:53 < Ad0> ok
13:53 < Ad0> ok
13:54 < Ad0> ecrist: well the config worked
13:54 < Ad0> with those tags
13:54 < ecrist> and it works with just 'openvpn --config <foo>'
13:56 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Ping timeout: 252 seconds]
14:03 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
14:05 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Ping timeout: 240 seconds]
14:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:06 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
14:08 < Ad0> ok
14:08 -!- Bagualas [~eu@189.103.114.91] has joined #openvpn
14:08 < Ad0> well! the .ovpn worked and thank god that certs are text files
14:08 < Bagualas> TCP/UDP: Socket bind failed on local address [undef]:5000: Permission denied
14:09 < Bagualas> any ideia on this ?
14:09 < ecrist> Ad0: can you show me an example?
14:09 < Ad0> it is just like the config in that mailing list
14:09 < Ad0> I didnt try it on barebone openvpn
14:09 < Ad0> just the "desktop client"
14:09 < Ad0> I am not sure if it is only for the .ovpn format
14:14 < Ad0> I can install openvpn on my server at home
14:14 < Ad0> try it as a client
14:16 -!- Bagualas [~eu@189.103.114.91] has left #openvpn []
14:16 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
14:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:21 -!- k4v [~kav@g226092110.adsl.alicedsl.de] has joined #openvpn
14:29 <@vpnHelper> RSS Update - forum: WIndows client conntected to Ubuntu server, but doesn't work <http://forums.openvpn.net/topic8720-15.html#p15222>
14:47 -!- Axeman [~Axeman3@knox.pace.edu] has joined #openvpn
14:47 -!- Axeman [~Axeman3@knox.pace.edu] has quit [Changing host]
14:47 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:47 -!- mode/#openvpn [+v Axeman] by ChanServ
15:09 -!- lwhalen [~law@bastion-ext.sermo.com] has quit [Ping timeout: 264 seconds]
15:11 <@vpnHelper> RSS Update - forum: SVC_RUN_EXCEPT-cannot start server <http://forums.openvpn.net/topic8696.html#p15223>
15:18 -!- CharlieSu [~CharlieSu@ec2-174-129-218-86.compute-1.amazonaws.com] has left #openvpn []
15:21 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:23 -!- gardar [~gardar@gardar.net] has joined #openvpn
15:23 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
15:24 -!- gardar [~gardar@gardar.net] has joined #openvpn
15:24 -!- spitfire_ [~quassel@89.200.144.70] has joined #openvpn
15:25 < spitfire_> Hi. I need to setup openvpn to start before windows login. I've enabled openvpn service, but how do I pass password to it?
15:25 < spitfire_> Wed Aug 31 17:36:21 2011 ERROR: could not not read Private Key password from stdin
15:26 < spitfire_> Also It'd be nice to see it's status in new vpn gui for non-admin users
15:27 <+novaflash> spitfire_; it is possible to make a profile that works without username/password. don't know how with the community edition, though.
15:27 < spitfire_> But how about passing password to openvpn windows service?
15:28 < spitfire_> I'm authenticating with a certificate + password
15:28 < spitfire_> cert is no problem
15:29 < spitfire_> but can I enter password in the config somehow?
15:29 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
15:30 < Bushmills> you can enter it in a file, and specify that file in the config
15:30 < hyper_ch> hi Bushmills
15:30 < Bushmills> oh, not the key passphrase,
15:30 < Bushmills> hi hyper_ch
15:30 < hyper_ch> hi bauruine
15:30 < hyper_ch> Bushmills: I found a solution to my problem :)
15:30 < spitfire_> so, how do I do that?
15:31 < Bushmills> specifying the file name?  by typing the letters from which its name is made up from.
15:33 < spitfire_> but how do I include password in that?
15:33 < spitfire_> What kin of syntax should it have
15:33 < Bushmills> you type it.
15:33 < Bushmills> 2 lines. user name and password
15:33 <+novaflash> as far as i know, a textfile with 2 lines; first line is user name, second line is password.
15:33 <+novaflash> right
15:33 < spitfire_> so in ovpn file I type what?
15:34 < Bushmills> did you even bother to look at the man page?
15:34 < spitfire_> how do I include that user/pass file?
15:34 <+novaflash> spitfire_; you place the username and password in a SEPARATE TEXT FILE
15:34 < spitfire_> Yes, I did
15:34 < Bushmills> it's written and explained there
15:34 < spitfire_> novaflash: I got that
15:34 < spitfire_> ok
15:34 <+novaflash> for all of 5 seconds ;)
15:34 < spitfire_> will look into it
15:34 <+novaflash> good luck
15:34 < spitfire_> thx
15:42 -!- nb_ is now known as nb
15:52 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
15:53 < spitfire_> Bushmills: haven't found an oprtion for that
15:53 < spitfire_> I've looked through doc/faqs...
15:57 < Bushmills> --auth-user-pass.  man page.
15:57 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p15224>
16:01 -!- lwhalen [~law@209.196.30.100] has joined #openvpn
16:02 < spitfire_> I asked about windows not linux client.
16:02 < spitfire_> ok so I did:
16:02 < spitfire_> auth-user-pass "C:\\Program Files (x86)\\OpenVPN\\config\\pass.txt"
16:03 < spitfire_> and service isn't taking it
16:03 < spitfire_> I also tried auth-user-pass pass.txt
16:04 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 240 seconds]
16:04 < spitfire_> Bushmills: any ideas?
16:04 < Bushmills> then maybe the passage saying that openvpn must have been built with support for reading password from file applies
16:04 < uuuppz> the message you pasted earlier
16:04 < uuuppz> looked like the password for the key
16:05 < uuuppz> not the auth for the server
16:05 < uuuppz> or did I miss something?
16:05 -!- novaflash [~notme@173.245.87.91] has joined #openvpn
16:05 -!- novaflash [~notme@173.245.87.91] has quit [Changing host]
16:05 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
16:05 -!- mode/#openvpn [+v novaflash] by ChanServ
16:05 < krzee> !pwfile
16:05 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h, or (#2) see --auth-user-pass in the manual (!man) for more info
16:05 < krzee> in windows 2.2.1 comes with that enabled
16:05 < krzee> (maybe 2.2.0 too, not sure)
16:05 < spitfire_> I have 2.2.1
16:06 < spitfire_> so what's wrong?
16:06 < krzee> try cd ""C:/Program Files (x86)/OpenVPN/config"
16:06 < krzee> and right below it
16:07 < krzee> auth-user-pass pass.txt
16:07 < krzee> (but put those at the end of the config)
16:07 < spitfire_> so cd in config file?
16:07 < krzee> yep
16:07 < spitfire_> ok
16:07 < krzee> cd "C:/Program Files (x86)/OpenVPN/config"
16:07 < krzee> auth-user-pass pass.txt
16:07 < spitfire_> with slashes, backslasher or double back?
16:07 < krzee> exactly as i did it
16:07 < krzee> !winpath
16:07 <@vpnHelper> "winpath" is (#1) Remember on Windows to quote pathnames and use double backslashes, e.g.: "C:\\Program Files\\OpenVPN\\config\\foo.key", or (#2) also, you can use forward slashes to avoid needing double backslashes, but you still need quotes, e.g.: C:/Program Files/OpenVPN/config/foo.key (but surrounded by quotes)
16:07 < spitfire_> okey
16:08 < krzee> (#2)
16:11 < spitfire_>  Katalog: C:\Program Files (x86)\OpenVPN\config
16:11 < spitfire_> 2011-08-31  22:37    <DIR>          .
16:11 < spitfire_> 2011-08-31  22:37    <DIR>          ..
16:11 < spitfire_> 2011-08-31  23:09               352 mieszkolaptopone-TO-IPFire.ovpn
16:11 < spitfire_> 2011-08-31  17:40             3 546 mieszkolaptopone.p12
16:11 < spitfire_> 2011-08-31  22:37                25 pass.txt
16:11 < spitfire_> I pasted exactly what you told me at the end of mieszkolaptopone-TO-IPFire.ovpn
16:11 < spitfire_> restarted service
16:12 < spitfire_> and sitll:
16:12 < spitfire_> Enter Private Key Password:
16:12 < spitfire_> Wed Aug 31 23:09:19 2011 ERROR: could not not read Private Key password from stdin
16:12 < spitfire_> Wed Aug 31 23:09:19 2011 Exiting
16:12 -!- novaflash [~notme@openvpn/user/novaflash] has quit []
16:12 -!- mape2k [~mape2k@f053195212.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
16:13 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
16:13 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
16:13 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
16:13 -!- mode/#openvpn [+v novaflash] by ChanServ
16:13 < krzee> pastebin the logfile
16:15 < spitfire_> http://pastebin.ca/2079299
16:16 < spitfire_> http://pastebin.ca/2079300
16:16 < spitfire_> ^^config file
16:17 < krzee> use verb 4
16:18 < spitfire_> http://pastebin.ca/2079301
16:18 < spitfire_> nothing more about auth I think
16:20 < krzee> well i dont think this should help, but lets try it...
16:20 < krzee> script-security 2
16:20 < krzee> in that config
16:20 < Ad0> is the openvpn 2.2.1 from openvpn .net  the OSS one? or is that a commercial fork
16:20 < Ad0> since they sell licenses and shit
16:20 < krzee> OSS
16:20 < Ad0> ok
16:20 < krzee> (its in the topic here)
16:20 < Ad0> :P
16:21 < hyper_ch> hi krzee
16:21 < krzee> hey hyper_ch =]
16:21 < hyper_ch> krzee: what are you up to on this lovely wednesday evening?
16:22 < spitfire_> http://pastebin.ca/2079303
16:22 < spitfire_> can set verb back to 3
16:22 < spitfire_> or is there something relevant in 4?
16:23 < krzee> hyper_ch, workin
16:23 < hyper_ch> awwwwwww :(
16:23 < krzee> well i wanted to see the stuff up top
16:23 < spitfire_> ok
16:23 < krzee> hyper_ch, didnt sleep last night either
16:23 < krzee> was workin on my new biz all night
16:23 < hyper_ch> no sleep and only work makes krzee a dull boy
16:23 < spitfire_> http://pastebin.ca/2079304
16:24 < krzee> surprisingly im not grumpy yet either
16:24 < krzee> no sleep + work + supporting on irc often leads to grumpy
16:24 < krzee> ok well you can remove script-security 2
16:25 < krzee> i didnt think it would help, but was worth a shot
16:25 < krzee> i could swear that option is enabled in windows... let me take a peek through the changelog
16:25 < spitfire_> ok
16:25 < spitfire_> thanks;)
16:27 < krzee> Samuli Sepp?nen (15):
16:27 < krzee>       Added ENABLE_PASSWORD_SAVE to config-win32.h
16:27 < krzee> 2011.02.28 -- Version 2.2-RC
16:27 < krzee> ya i knew that was in there
16:28 -!- lwhalen [~law@209.196.30.100] has quit [Read error: Operation timed out]
16:28 < spitfire_> so it is still in final release?
16:28 < spitfire_> or not?
16:29 < krzee> its been in 2.2 since February 
16:29 < krzee> how is pass.txt formatted?
16:30 < spitfire_> login in 1st line
16:30 < spitfire_> password in 2nd
16:30 < krzee> move the file to your C:\
16:30 < krzee> then remove the cd line
16:30 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
16:30 < krzee> and make auth-user-pass "C:/pass.txt"
16:31 < krzee> (or "C:\\pass.txt"
16:31 < krzee> )
16:31 < krzee> (doing this for testing)
16:31 < spitfire_> Wed Aug 31 23:31:07 2011 us=447000 Error opening 'Auth' auth file: pass.txt: Nie można odnaleźć określonego pliku.
16:31 < spitfire_> cannot fin file
16:31 < spitfire_> wit
16:31 < spitfire_> wait
16:31 < krzee> did you move it to the right place...?
16:31 < spitfire_> my mistake
16:32 < krzee> dont forget to remove the cd line
16:32 < krzee> (although it wont matter since you're not using a relative path for the file)
16:34 < spitfire_> i removed it
16:34 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p15225>
16:34 < spitfire_> it wass still the same
16:35 < spitfire_> when I entered  auth-user-pass pass.txt it couldn't find it
16:35 < spitfire_> i also tried to leave password without login in pass txt (it told me there has to be login in 1st and pass in 2nd line)
16:36 < spitfire_> i only have latin characters in both pass and login
16:36 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:38 < caesay> hey - sorry, am i intruding? i have a question
16:38 < spitfire_> it should be plain password?
16:39 < caesay> spitfire_: you trying to get plain-text authentication on a windows server?
16:39 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-15.html#p15226>
16:39 < spitfire_> no
16:39 < spitfire_> windows client
16:39 < caesay> or user/pass authentication, rather?
16:39 < caesay> oh
16:40 < spitfire_> I need to pass it via text file
16:40 < spitfire_> to  a service
16:40 < caesay> ah
16:41 < spitfire_> any ideas krzee ?
16:41 < caesay> im assuming you have client-cert-not-required in the client config then? or are you doing duel authentication
16:42 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
16:43 < caesay> spitfire_: do you have openvpn built with ENABLE_PASSWORD_SAVE?
16:43 < spitfire_> I think it is
16:44 < spitfire_> it's a standard 2.2.1 build
16:44 < spitfire_> form website;)
16:44 < caesay> not sure the installer from the site has that enabled by default (i honeslty have no idea)  - i'd build it myself if i were you to test it
16:44 -!- raidz [~Administr@openvpn/corp/admin/andrew] has left #openvpn []
16:44 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
16:44 -!- mode/#openvpn [+o raidz] by ChanServ
16:45 < caesay> anyone have a moment to help out with some client-routing?
16:46 < caesay> right now i have openvpn routing everything from a server-side push: push "redirect-gateway def1 bypass-dhcp"
16:46 < caesay> but i need to have a few certain IP's NOT go through the tunnel, but make sure everything else does
16:46 < caesay> any ideas?
16:52 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
16:53 < spitfire_> caesay: if it has password save, then how do I ask service to use that?
16:53 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
16:53 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has joined #openvpn
16:53 < tab1293>  i have a vpn question. lets say my loacl address of my laptop is 192.168.1.100 but then i want to connect to a vpn whose addresses are different something like 10.0.0.0 would this cause a conflict?
16:54 < caesay> tab1293: if i understand your question, no.
16:54 < caesay> spitfire_: in your .ovpn file
16:54 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
16:54 < spitfire_> what do I write there?
16:55 < spitfire_> enavle-pasword-save ?
16:55 < caesay> oh, if you dont have password-save COMPILED in, you'd need to re-compile openvpn yourself.
16:55 < spitfire_> ok
16:55 < tab1293> so caesay you dont want your addresses to be similar. for example you dont want your local ip to be 192.168.1.100 and your vpn to use 192.168.1.1-255 because theres more likely of a conflict there?
16:56 < spitfire_> but let's assume it is
16:56 < tab1293> im still trying to grasp the addressing concept of a vpn
16:56 < caesay> spitfire_: to use an 'up' file for passwords just put auth-user-pass [filelocation] in your ovpn config
16:57 < caesay> tab1293: you wouldnt want the openvpn assigning ip's on the same class A as your router
16:57 < caesay> no.
16:57 < spitfire_> caesay: that didn't work
16:57 < caesay> spitfire_: error?
16:57 < caesay> 'that didnt work' doesnt tell me anything
16:57 < spitfire_> i've tried with absolute path, relative one
16:57 < spitfire_> wait a sec
16:58 < spitfire_> let me explain
16:58 < spitfire_> file pass.txt is formatted well
16:58 < spitfire_> login in 1st line
16:58 < spitfire_> pass in 2nd
16:58 < caesay> spitfire_: yes thats fine, i assumed so - what error is ovpn giving you?
16:59 < spitfire_> http://pastebin.ca/2079299
17:00 < caesay> spitfire_: can i see your config file please?
17:01 < tab1293> caesay, which router? the router your openvpn server is behind or the router you are remotely behind?
17:01 < tab1293> the remote router right?
17:02 < caesay> tab1293: the local laptop router that will assign your laptop an IP.
17:02 < spitfire_> http://pastebin.ca/2079311
17:02 < tab1293> caesay, ok thats what i thought thank you
17:02 < caesay> spitfire_: thats your client config?
17:03 < caesay> confused by the comment at the top.. 
17:03 < spitfire_> yes
17:03 < spitfire_> taht was autogenerated
17:03 < caesay> well i dont see the auth-user-pass directive - first thing
17:03 < caesay> so you're not even trying to load your 'up' password file?
17:03 < spitfire_> it works on my windows
17:04 < spitfire_> I removed that second ago
17:04 < spitfire_> it was
17:04 < spitfire_> auth-user-pass "C:/pass.txt"
17:05 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15227>
17:06 < spitfire_> and it seems to find it
17:06 < spitfire_> cause when I move it elsewhere I get:
17:06 < spitfire_> Thu Sep 01 00:06:12 2011 us=625000 Error opening 'Auth' auth file: C:/pass.txt
17:06 < caesay> spitfire_: so i assume when it starts up you're typing in the key password yourself?
17:07 < spitfire_> In a GUI, yes
17:07 < spitfire_> it doesn't work at all with service
17:07 < spitfire_> but it sure does with a gui
17:08 < spitfire_> and gui aks for password, even though it has this directive in config
17:08 < caesay> ok well for the service you have no way of inputting the password, correct?
17:09 < spitfire_> yes
17:09 < spitfire_> that's the reason I want to have it set up that way
17:09 < caesay> ah!
17:09 < caesay> well you can transfer a key password to a service
17:10 < spitfire_> how?
17:10 < caesay> im assuming you didnt read the MAN page for openvpn then. because its almost right at the top
17:10 < spitfire_> I had
17:10 < spitfire_> but switches are mostly linux-specific
17:11 < caesay> its the 'askpass' client config directive
17:11 < caesay> --askpass [filename]
17:11 < caesay> "If file is specified, read the password from the first line of file."
17:11 < spitfire_> ok
17:11 < spitfire_> great
17:11 < spitfire_> will try
17:12 < caesay> "Get certificate password from file before we daemonize."
17:12 < caesay> is the description - sounds like what you need
17:13 < spitfire_> wow
17:13 < spitfire_> thnks a lot
17:13 < spitfire_> it worked
17:14 < caesay> spitfire_: your welcome
17:15 < spitfire_> got to sleep
17:15 < spitfire_> now
17:15 < spitfire_> thanks again
17:15 < spitfire_> and goodnight
17:16 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 276 seconds]
17:16 <@vpnHelper> RSS Update - forum: SVC_RUN_EXCEPT-cannot start server <http://forums.openvpn.net/topic8696.html#p15228>
17:18 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has quit [Ping timeout: 245 seconds]
17:25  * samas sighs.
17:27 -!- Denial [Denial@drgi.co.uk] has quit [Ping timeout: 260 seconds]
17:33 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
17:43 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
17:48 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has joined #openvpn
17:52 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15229>
18:01 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:06 < tab1293> how is this setting up a tunnel 
18:06 < tab1293> push "dhcp-option DNS 192.168.1.1"
18:06 < tab1293> push "redirect-gateway def1"
18:06 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Operation timed out]
18:08 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has quit [Remote host closed the connection]
18:09 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
18:09 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
18:09 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:09 -!- mode/#openvpn [+v Axeman] by ChanServ
18:10 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
18:12 -!- albech [~thomas@183.88.76.213] has joined #openvpn
18:14 -!- webdawg [~webdawg@99-11-90-167.lightspeed.nsvltn.sbcglobal.net] has joined #openvpn
18:16 < webdawg> OpenVPN just tunnels the traffic through SSL/TLS right?
18:16 < webdawg> How more secure is that compared to a SSL tunnel?
18:17 < fulgore> hey guys, i've got openvpn rigged up successfully to the point i can auth fine client > server and get an ip. howerver i can't seem to talk to the lan.
18:18 < webdawg> fulgore, you have NAT enabled on the server and do the conf's have the right routes?
18:18 < webdawg> fulgore, have you checked your firewall?
18:18 < fulgore> hehe
18:18 < fulgore> so the server is a debian box
18:18 < fulgore> and client is a dumpy win7 box
18:18 < fulgore> i turned the firewall off on it
18:18 < webdawg> it?
18:19 < Bushmills> !route
18:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT, or (#2) READ IT DONT SKIM IT, or (#3) See !tcpip for more info about a more basic networking guide
18:19 < fulgore> let me read thru this a couple times.
18:20 < fulgore> looks like exactly what i want
18:20 < fulgore> i guess i didn't rtfm enough :-/
18:20 < Bushmills> !serverlan
18:20 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn), or (#2) see !route for a better explanation
18:20 -!- albech [~thomas@183.88.76.213] has quit [Quit: Ex-Chat]
18:20 < fulgore> !ipforward
18:20 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
18:21 < fulgore> !linipforward
18:21 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution, or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
18:21 < webdawg> Turned the firewall off of WHAT?
18:21 < fulgore> oh sorry, on the windows box
18:21 < fulgore> debian box has firewall off too
18:21 < webdawg> Is the windows box connected directly to the internet?
18:21 < fulgore> well, on a lan
18:21 < webdawg> Are any of these systems directly connected to the internet?
18:22 < webdawg> How more secure is that compared to a SSL tunnel?
18:22 < fulgore> the linux boxen is
18:22 < fulgore> well, he's behind nat, but i'm passing a port in for him
18:22 < webdawg> fulgore
18:22 < webdawg> Ohh.
18:22 < webdawg> kk.
18:22 < fulgore> so i can auth fine to it
18:22 < webdawg> Wait.
18:22 < fulgore> just can't route to the lan
18:22 < webdawg> You have a firewall between the server and the internet right?
18:23 < fulgore> yep
18:23 < webdawg> kk
18:23 < webdawg> Did you enable NAT on the debian box
18:23 < webdawg> ?
18:24 < fulgore> heh
18:24 < fulgore> i seem to have missed that somewhere along the line
18:24 < fulgore> looking at the best way to do that right now
18:24 < webdawg> vpnHelper had the right answer.
18:25 < webdawg> YOu need to enable it via sysctl.conf and I think do the iptables rule.
18:25 < fulgore> yeah yeah
18:25 < webdawg> allow nat.  then enabled it with iptables.
18:25 < fulgore> just reading up on it so i know exactly what i'm doing...
18:25 -!- k4v [~kav@g226092110.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
18:26 -!- Squidy_at_Home [~quassel@189.72.232.43] has joined #openvpn
18:31 < fulgore> !route_outside_openvpn
18:31 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
18:47 < fulgore> so nat is enabled on linux box
18:47 < fulgore> and i'm pushing route info via the server.conf (i think)
18:50 < fulgore> push "route 10.0.0.0 255.255.255.0"
18:51 < fulgore> do i have to push a gateway?
18:54 < fulgore> yeah
18:56 -!- Squidy_at_Home [~quassel@189.72.232.43] has quit [Ping timeout: 260 seconds]
19:00 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
19:03 -!- Denial [Denial@drgi.co.uk] has quit []
19:04 -!- spitfire_ [~quassel@89.200.144.70] has quit [Ping timeout: 252 seconds]
19:09 -!- rommel092079 [~vpnuser@119.93.51.34] has joined #openvpn
19:12 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
19:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:15 -!- mode/#openvpn [+v Axeman] by ChanServ
19:18 -!- rommel092079 [~vpnuser@119.93.51.34] has quit []
19:38 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
19:42 -!- jake1 [~jake@c-98-198-203-89.hsd1.tx.comcast.net] has joined #openvpn
19:42 -!- samas [4c007f5b@gateway/web/freenode/ip.76.0.127.91] has quit [Ping timeout: 252 seconds]
19:42 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 240 seconds]
19:42 < jake1> where do I download client.ovpn from web interface?
19:43 < jake1> openvpn.net's site is nice enough to tell me to do it
19:43 < jake1> but not nice enought to tell me where its at
19:50 < jake1> i think this is why people stray away from linux, it is simple but documentation is only clear to someone who already knows how to work it.
19:50 < jake1> found it btw
19:50 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
19:51 < jake1> after 2 days and breaking down and finding every chan I could
19:51 -!- jake1 [~jake@c-98-198-203-89.hsd1.tx.comcast.net] has quit [Quit: WeeChat 0.3.4]
19:57 -!- _julian_ [~quassel@hmbg-4d06eebe.pool.mediaWays.net] has joined #openvpn
19:58 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:59 < reiffert> at the howto, stupid.
20:00 < reiffert> openvpn == linux.
20:00 -!- _julian [~quassel@hmbg-5f765f4f.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
20:00 < krzee> web interface... sounds like he was using access-server anyways
20:01 < krzee> and i havnt noticed people straying away from linux...
20:01 < krzee> quite the contrary, i see people newly using it often
20:02 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:07 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
20:10 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has joined #openvpn
20:20 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:22 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
20:30 <@vpnHelper> RSS Update - forum: What am I doing wrong on my bridged settings? <http://forums.openvpn.net/topic8731.html#p15230>
20:32 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
20:33 < krzee> likely answer to that forum post:  *using bridging in the first place*
20:33 < krzee> (without having looked)
20:42 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:51 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
20:51 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:51 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
20:56 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Operation timed out]
21:01 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
21:08 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
21:08 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:08 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:33 -!- openn [~eh@178.73.218.75] has joined #openvpn
21:34 < openn> hello
21:34 < openn> How can I set DNS server manually when using DHCP?
21:34 < openn> (I know that I can edit /etc/resolv.conf
21:35 -!- Davion [~raintech@openvpn/user/Davion] has joined #openvpn
21:36 -!- mode/#openvpn [+v Davion] by ChanServ
21:36 -!- Davion [~raintech@openvpn/user/Davion] has left #openvpn []
21:37 < openn> or is it the only solution to edit /etc/resolv.conf?
21:41 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
21:41 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
21:41 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
21:56 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
22:06 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 257 seconds]
22:15 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
22:16 < vpnuser> How many users can one openvpn server hold ?
22:16 -!- openn [~eh@178.73.218.75] has quit []
22:17 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Quit: Leaving]
22:17 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
22:21 < vpnuser> How many users can one openvpn server hold ?
22:21 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Connection reset by peer]
22:21 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
22:22 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
22:24 < fulgore> default config is 100
22:24 < fulgore> but it more depends on your bandwidth
22:24 < fulgore> and firewall and stuff
22:27 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 264 seconds]
22:45 -!- openn [~eh@178.73.218.75] has joined #openvpn
22:49 -!- openn [~eh@178.73.218.75] has left #openvpn []
23:13 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has quit [Quit: Computer has gone to sleep]
23:13 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has joined #openvpn
23:16 < krzie> !learn pwfile as if you're using this with the windows service, you will need --askpass
23:16 <@vpnHelper> Joo got it.
23:18 -!- Titania [~titania@208.79.15.254] has joined #openvpn
23:21 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:23 -!- rawsted [~tom@unaffiliated/rawsted] has quit [Ping timeout: 245 seconds]
23:25 -!- rawsted [~tom@unaffiliated/rawsted] has joined #openvpn
23:57 -!- EugeneKay is now known as EugeneKaway
23:59 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
--- Day changed Thu Sep 01 2011
00:00 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
00:16 -!- Titania [~titania@208.79.15.254] has quit [Read error: Connection reset by peer]
00:46 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
00:51 <@vpnHelper> RSS Update - forum: What am I doing wrong on my bridged settings? <http://forums.openvpn.net/topic8731.html#p15231>
01:01 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
01:01 -!- mode/#openvpn [+v s7r] by ChanServ
01:05 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Ping timeout: 252 seconds]
01:13 -!- je0rJey [~je0rJey@117.192.174.175] has joined #openvpn
01:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:33 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
01:34 -!- je0rJey [~je0rJey@117.192.174.175] has left #openvpn ["Leaving"]
01:38 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:49 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Read error: Operation timed out]
01:52 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
01:53 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
02:19 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has joined #openvpn
02:21 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
02:23 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
02:26 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 245 seconds]
02:27 -!- k4v [~kav@g226088134.adsl.alicedsl.de] has joined #openvpn
02:46 -!- bitterman [~yury@84.51.199.63] has quit [Ping timeout: 258 seconds]
03:07 -!- luneff [~yury@109.165.60.155] has joined #openvpn
03:11 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
03:11 -!- bitterman [~yury@109.165.60.155] has joined #openvpn
03:14 -!- luneff [~yury@109.165.60.155] has quit [Ping timeout: 240 seconds]
03:15 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:17 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Ping timeout: 260 seconds]
03:19 -!- DexTerDDIT [~dexterddi@2001:470:1f06:687::2] has joined #openvpn
03:27 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
03:28 -!- bitterman is now known as luneff
03:28 -!- webdawg [~webdawg@99-11-90-167.lightspeed.nsvltn.sbcglobal.net] has quit [Quit: Leaving]
03:30 -!- krackpot [~krackpot@S0106000c42a9996c.vc.shawcable.net] has quit [Ping timeout: 260 seconds]
03:30 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has left #openvpn []
03:33 -!- krackpot [~krackpot@S0106000c42a9996c.vc.shawcable.net] has joined #openvpn
03:47 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:52 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
03:54 -!- dazo_afk is now known as dazo
04:01 -!- _julian_ [~quassel@hmbg-4d06eebe.pool.mediaWays.net] has quit [Remote host closed the connection]
04:04 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:04 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:10 -!- _julian [~quassel@hmbg-4d06ec82.pool.mediaWays.net] has joined #openvpn
04:12 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
04:40 -!- Netsplit *.net <-> *.split quits: uuuppz, EvilJStoker, wangzhongwei, hyper_ch, aten, corretico, bragon, MrWGW, amir, Nowak,  (+7 more, use /NETSPLIT to show all of them)
04:40 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
04:41 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
04:42 -!- Netsplit over, joins: uuuppz
04:42 -!- aten [~atum@94.124.93.60] has joined #openvpn
04:42 -!- Netsplit over, joins: corretico, amir, sia^pwnnt, Kartagis, kanyl, fulgore, wangzhongwei, hyper_ch, MrWGW, krphop (+2 more)
04:43 -!- Netsplit over, joins: qbasicer
04:49 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
04:50 -!- luneff [~yury@109.165.60.155] has quit [Quit: Leaving]
04:57 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
04:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:38 -!- Jopie [~Joel@s3eea0222.adsl.wanadoo.nl] has joined #openvpn
05:39 < Jopie> How can I give each of my VPN clients the same IP every time they connect?
05:42 < Bushmills> !ccd
05:42 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
05:43 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
05:43 < Bushmills> push ip addr for specific clients in files corresponding with them
05:49 -!- luneff [~yury@109.165.60.155] has joined #openvpn
05:49 < Jopie> ok
05:50 < Jopie> I'll check that out 
05:52 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15232>
05:55 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:12 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
06:24 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:24 -!- mode/#openvpn [+v Axeman] by ChanServ
06:31 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
06:35 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:35 -!- mode/#openvpn [+v Axeman2] by ChanServ
06:38 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:48 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
06:48 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
06:48 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
06:48 -!- oc80z [oc80z@blea.ch] has joined #openvpn
06:48 -!- luneff [~yury@109.165.60.155] has quit [Quit: Leaving]
06:53 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
06:53 -!- Axeman2 is now known as axeman
06:55 -!- defswork_ [~andy@hns01-fw.internal.gxn.net] has joined #openvpn
06:59 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 252 seconds]
06:59 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 264 seconds]
07:04 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
07:06 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
07:09 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
07:23 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 260 seconds]
07:24 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
07:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
07:27 -!- cityLights [~cityLight@80.179.93.112] has joined #openvpn
07:27 < cityLights> hi folks
07:28 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
07:28 < cityLights> I am seeking to have a service that will openvpn to aws
07:28 < cityLights> this service needs to openvpn --config aws.conf
07:28 < cityLights> but I also have other vpns on this pc
07:28 < cityLights> how to run it in debian?
07:29 < krzie> aws...?
07:29 < cityLights> just a label
07:30 < cityLights> seems that debian openvpn init tries to run all the .conf in /etc/osenvpn
07:30 < krzie> ya
07:30 < cityLights> s|/etc/osenvpn|/etc/openvpn|
07:30 < cityLights> how to run one?
07:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
07:31 < krzie> [08:30]  <cityLights> this service needs to openvpn --config aws.conf
07:31 < krzie> that works...
07:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:31 < cityLights> so I need to wirte my own service....
07:31 < krzie> why?
07:32 < krzie> if you need it on boot you just said how to auto-start it
07:32 < krzie> if you want to start it manually, you also said that
07:32 < krzie> i dont understand which part i can explain to you... you seem to already understand
07:32 < cityLights> well I can get around it
07:33 < krzie> !goal
07:33 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:33 < cityLights> I wish it run when I am at home
07:33 < krzie> you want it to start automatically, or manually?
07:33 < cityLights> so I am putting it in the network manager  dispatch directory
07:33 < krzie> !netman
07:33 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
07:34 < krzie> if you're going to do that, at least configure everything first and just import it to network-manager
07:34 < krzie> dont let netman configure it
07:34 < cityLights> ii , min pls
07:35 < cityLights> ok, I will look at it later
07:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
07:47 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
07:48 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 264 seconds]
07:49 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
07:50 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
07:54 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
07:54 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15233>
07:54 -!- luneff [~yury@109.165.60.155] has joined #openvpn
08:00 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has quit [Quit: Computer has gone to sleep]
08:01 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
08:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
08:12 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
08:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
08:33 <@vpnHelper> RSS Update - forum: my other wish <http://forums.openvpn.net/topic7973.html#p15234>
08:37 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:42 -!- kerute [~kerute@kerunix.com] has left #openvpn []
09:03 -!- master_of_master [~master_of@p57B54319.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:04 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
09:04 < darkdrgn2k4> hi all
09:04 -!- master_of_master [~master_of@p57B54F85.dip.t-dialin.net] has joined #openvpn
09:04 < darkdrgn2k4> is there any reasons openvpn would create 2 records of differnt ips in ipp.txt?
09:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
09:06 <@dazo> darkdrgn2k4: yeah, that can happen ... and it has a valid reason even ... I just can't remember why right now
09:06 < darkdrgn2k4> i have quite a few like that
09:06 <@dazo> darkdrgn2k4: but, don't use ipp.txt to provide fixed IP addresses, that's going to fail ... use --client-config-dir for that
09:06 <@dazo> !ccd
09:06 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
09:07 <@dazo> darkdrgn2k4: I believe this issue you're describing was explained in JJK's OpenVPN 2 Cookbook
09:07 <@dazo> !jjk
09:07 <@dazo> !book
09:07 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
09:07 < darkdrgn2k4> not so muhc a question of Static ip as i have a DDNS script that updates dns
09:07 < darkdrgn2k4> just wondering
09:07  * dazo don't have that book handy now so can't check it
09:07 < darkdrgn2k4> out of 82 pcs 44 have 1 ip in ipp.txt and 38 have 2
09:19 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:19 -!- mode/#openvpn [+v s7r] by ChanServ
09:23 -!- Jopie_ [~Joel@s3eea0222.adsl.wanadoo.nl] has joined #openvpn
09:26 -!- Jopie [~Joel@s3eea0222.adsl.wanadoo.nl] has quit [Ping timeout: 258 seconds]
09:34 -!- cityLights [~cityLight@80.179.93.112] has quit [Read error: Connection reset by peer]
09:42 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
09:42 -!- lwhalen [~law@bastion-ext.sermo.com] has joined #openvpn
09:43 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:43 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:44 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
09:46 -!- Wildy [~lion@212.119.246.18] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
09:48 <@vpnHelper> RSS Update - forum: [SOLVED] Too many routes problem <http://forums.openvpn.net/topic7201.html#p15235>
09:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
09:52 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:01 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
10:11 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
10:14 < krzee> darkdrgn2k4, 
10:14 < krzee> !ipp
10:14 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
10:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:16 -!- spitfire_ [~quassel@89.200.144.70] has joined #openvpn
10:20 -!- spitfire_ [~quassel@89.200.144.70] has quit [Read error: Connection reset by peer]
10:20 -!- Onepamopa [~onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 260 seconds]
10:24 -!- spitfire_ [~quassel@89.200.144.70] has joined #openvpn
10:29 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:29 -!- Onepamopa [onepamopa@62.204.152.143] has joined #openvpn
10:29 -!- Onepamopa [onepamopa@62.204.152.143] has quit [Changing host]
10:29 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has joined #openvpn
10:29 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 272 seconds]
10:31 < darkdrgn2k4> krzee: dont care about ip assignment, just wondering thy my ip pool is depleating...
10:32 -!- spitfire_ [~quassel@89.200.144.70] has quit [Remote host closed the connection]
10:33 < ecrist> darkdrgn2k4: ipp.txt will be overwritten.  if someone isn't connected, and you're out of IPs, it should hand out unused ips without issue
10:34 < krzee> right
10:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 264 seconds]
10:38 -!- spitfire_ [~quassel@89.200.144.70] has joined #openvpn
10:51 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:01 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
11:11 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has quit []
11:17 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:18 < darkdrgn2k4> ecrist: cool.. so IPP is kinda liek DCHP now a day has a "preffered" ip
11:21 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
11:40 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
11:41 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has left #openvpn []
11:45 -!- luneff [~yury@109.165.60.155] has quit [Quit: This computer has gone to sleep]
12:06 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
12:06 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
12:07 -!- trumee_ is now known as trumee
12:16 -!- dazo is now known as dazo_afk
12:27 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:36 < zastaph> the builtin VPN in windows, is that IPsec? PPTP? I doubt it's compatible with OpenVPN
12:36 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
12:36 <+novaflash> zastaph; built-in is not compatible with OpenVPN.
12:37 <+novaflash> zastaph; it does IPsec, PPTP and L2TP over IPsec, afaik. but OpenVPN is SSL.
12:37 < zastaph> are other clients compatible except OpenVPN itself?
12:38 <+novaflash> zastaph; maybe, but I haven't heard of them.
12:39 <+novaflash> zastaph; there are assloads of projects related openvpn though - clients and gui's and stuff.
12:39 <+novaflash> https://community.openvpn.net/openvpn/wiki/RelatedProjects
12:40 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
12:40 < zastaph> maybe http://www.shrew.net/
12:40 <@vpnHelper> Title: Shrew Soft Inc : Home (at www.shrew.net)
12:41 <+novaflash> it does mention compatibility with OpenSWAN, FreeSWAN and StrongSWAN, but i don't know if that's compatible. i think they use IPSec as well. anyone in the channel here care to correct me?
12:41 <+novaflash> zastaph; the page I linked - tons of clients. anything you need to connect to openvpn servers.
12:41 < zastaph> it says: Probably the most used add-on to OpenVPN is the Windows client GUI
12:42 -!- agagag [~anton@83.167.185.34] has quit [Ping timeout: 260 seconds]
12:42 < zastaph> which of the links below is that one?
12:42 <+novaflash> this is the newer gui for openvpn; http://sourceforge.net/projects/openvpn-gui/
12:42 <@vpnHelper> Title: OpenVPN GUI | Download OpenVPN GUI software for free at SourceForge.net (at sourceforge.net)
12:42 -!- luneff [~yury@84.51.196.195] has joined #openvpn
12:42 <+novaflash> if you want eyecandy, get something like viscosity. but that costs.
12:43 < zastaph> openvpn-2.2.1-install.exe contains old or new? at http://www.openvpn.net/index.php/open-source/downloads.html
12:43 <@vpnHelper> Title: Downloads (at www.openvpn.net)
12:43 <+novaflash> version 2.2.1 appears to be the most recent, yes. isn't that obvious?
12:43 < zastaph> im trying to understand why a GUI is nescessary.. at work I connect with a thin cisco client, and i guess all you want (as a client) is to connect and then "feel like home" ?
12:44 <+novaflash> if you don't have a gui, you have to drop to command prompt
12:44 <+novaflash> and start the connection manually
12:44 < zastaph> novaflash: The old client GUI is effectively unmaintained, but is still (as of 30th Nov 2010) included in the OpenVPN installer packages
12:44 < zastaph> from https://community.openvpn.net/openvpn/wiki/RelatedProjects
12:44 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
12:44 < zastaph> thus the confusion
12:44 <+novaflash> yes and the very next line says; the NEW GUI is available - etc - and i just linked to that a few linues up.
12:44 <+novaflash> anyways
12:44 < zastaph> affirmative, but I was just trying to find out if its the same as in that exe
12:45 <+novaflash> only one way to find out :)
12:45 <+novaflash> actually, you could ask someone here that knows. i don't unfortunately.
12:45 < zastaph> ok ill try, thanks
12:47 <+novaflash> i have found 2 glitches there that might need resolving ;) a dead link and incomplete information on a project.
12:48 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
12:48 < zastaph> only snapshot downloads for that GUI
12:52 -!- darkdrgn2k3 [~darkdrgn2@199.243.221.14] has joined #openvpn
12:52 <+novaflash> ...........00
12:52 <+novaflash> crap, cat walked on keyboard.
12:55 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Ping timeout: 252 seconds]
13:03 -!- dazo_afk is now known as dazo
13:14 -!- Kartagis [sbnc@unaffiliated/kartagis] has quit [Remote host closed the connection]
13:37 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
13:43 <@mattock> novaflash: I hate when that happens
13:43 <@mattock> that's why I lock my keyboard
13:48 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has joined #openvpn
13:48 < steelnwool> Hi.
13:49 <+novaflash> mattock; it was my own fault. i was rubbing that pussy vigorously and she stepped on the keyboard because of me. usually she's careful to avoid it.
13:49 <+novaflash> hello steelnwool
13:49 < steelnwool> we've got a slacker at work we want to bust with evidence. we use openvpn and i could re point his default gateway thru the VPN easily enough. I'm wondering if there are also other suggestions.
13:49 <+novaflash> klingon pain sticks
13:50 < steelnwool> tried those. no luck.
13:50 <+novaflash> hm. tough guy then.
13:50 < steelnwool> see, we all telecommute. so its not as easy as just putting squid on the gateway or something.
13:50 <+novaflash> ah i was gonna suggest a proxy
13:50 <+novaflash> hm.
13:50 < steelnwool> can openvpn re route any DNS queries ?
13:51 <+novaflash> i think so, yes
13:51 <+novaflash> openvpn is also used by services such as hidemynet and privatetunnel.com
13:51 <+novaflash> and they route dns and all other traffic through the tunnel
13:52 < steelnwool> yup, i could set him with a static openvpn IP, setup a caching name server, and make his dhcp client thing use our DNS and just log where he goes.
13:52 <+novaflash> routing dns should be possible, maybe someone here knows exactly how or maybe the openvpn.net website has answers for this.
13:52 < steelnwool> he's spending a shit load of itmeon youtube, from "over the shoulder" observations.
13:52 < steelnwool> yeah its in the config file, pretty plain.
13:53 <+novaflash> looks like you already have the answer you seek :)
13:53 < steelnwool> it does.
13:53 <+novaflash> once you have obtained proof you should set up a dns redirect to disneyland.com whenever he goes to youtube.com
13:53 < steelnwool> now.. to filter out my own slacking.
13:53 <+novaflash> now now, let's not be hasty..
13:53 < steelnwool> nova - i fucking should! excellent!
13:54 <+novaflash> someone out there is going to hate me in a few days
13:54 <+novaflash> even if they don't know it yet
13:54 < steelnwool> hopefully.
13:54 <+novaflash> DISNEYLAND?!
13:54 <+novaflash> pst
13:54 <+novaflash> you can also redirect the dns to a webserver that you run yourself
13:54 <+novaflash> and set up a virtual host there as youtube.com
13:55 <+novaflash> make a webpage that says "busted"
13:55 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:55 <+novaflash> or only shows a video file of rick astley's top hit...
13:55 < steelnwool> yep or make it a wild car with a page that just say "back to work tom, we're watchig you. just because your mother in law works for our sistercompany doesn't mean you can get away with this"
13:55 <+novaflash> this has potential
13:55 <+novaflash> anyways
13:55 <+novaflash> good luck.
13:55 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
13:58 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
13:59 -!- gardar [~gardar@gardar.net] has joined #openvpn
14:07 -!- datruth [datruth@gotpot.org] has quit [Quit: leaving]
14:07 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Ping timeout: 260 seconds]
14:09 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has left #openvpn []
14:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:25 -!- Grleaf [Guess@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
14:31 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
14:32 -!- dazo is now known as dazo_afk
14:36 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has joined #openvpn
14:36 < steelnwool> the push "redirect-gateway" can you do that on a per-client basis?
14:37 < krzee> certainly
14:37 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
14:37 < steelnwool> just put it in client.conf i guess eh.
14:37 < krzee> pushing from the server would be done in these:
14:37 < krzee> !ccd
14:37 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
14:37 < krzee> or even better, put it in the client config
14:37 < krzee> i say that is better because it gives the client more control
14:38 < krzee> (maybe they dont want *everything* going over the vpn)
14:38 < steelnwool> but I do :)
14:38 < steelnwool> we're trying to catch a slacker.
14:38 < krzee> ok then put it in a ccd
14:38 < steelnwool> word. tks.
14:38 < krzee> (he can still override it if he knows how to search the forums)
14:39 < steelnwool> he doens't.
14:39 < steelnwool> unless there is a youtube video of how to do it. :)
14:39 < krzee> (or join irc, or read docs and know networking)
14:39 < steelnwool> he knows none of these things.
14:39 < krzee> haha ya i doubt that one ;]
14:39 < steelnwool> lets say its unlikely enough that i'm fine with it.
14:40 < steelnwool> i was just gonna change his dns, but thats too likely that he has it over ridden and poitned to google or something.
14:41 -!- axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
14:42  * krzee gets a webcam out and makes a video on it
14:42 < steelnwool> hehe.
14:43 < steelnwool> if he gets around it we'd just confront him.
14:43 < steelnwool> but he's someones son in law, so we want proof before we piss in the mix.
14:43 -!- Joel__ [~Joel@s3eea0222.adsl.wanadoo.nl] has joined #openvpn
14:43 < krzee> well you wouldnt know if he got around it
14:43 < krzee> cause it wouldnt go through the server
14:43 < steelnwool> yes we would. we'd see him not fucking around.
14:43 < krzee> i could override your default route, then only route certain stuff over it
14:44 < krzee> whichever stuff i choose
14:44 < steelnwool> i know. but if he's not screwing around, he's not awake. guy is a fucking waste of time.
14:44 < krzee> but ya, unlikely ;]
14:44 < krzee> what your doing should be good =]
14:44 < krzee> s/your/you're/
14:45 -!- Jopie_ [~Joel@s3eea0222.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
14:46 <+novaflash> steelnwool, krzee; two days from now; slacker joins #openvpn "hey guys my company has redirect my dns through the vpn and is blocking sites. any way around it?" ;);)
14:46 < krzee> lol ya
14:46 < steelnwool> hahah.
14:46 < krzee> we get that question a bit, often regarding their paid vpn service tho
14:47 < krzee> cause people dont realize its more user-friendly to put that option in the user's config
14:48 < steelnwool> is client-config-dir read each time they connect, or does openvpn server need to be restarted?
14:48 <+novaflash> it's read each time they connect afaik
14:49 <+novaflash> krzee?
14:49 < krzee> correct
14:49 < krzee> read upon connect
14:49 < steelnwool> excellent. thanks.
14:50 < krzee> if you drop permissions to non-root, make sure that user can read those files
14:50 < krzee> (which requires +x on the dir they are in as well)
14:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:57 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has joined #openvpn
14:57 < Onepamopa> hm, why the f?ck tapinstall.exe failed. ???
14:57 < Onepamopa> w7 x64, both stable and last development
14:57 < krzee> runas admin?
14:57 < Onepamopa> same
14:57 < Onepamopa> manual install - same
14:57 < Onepamopa> safemode install - same
14:57 < Onepamopa> any ideas?
14:57 < krzee> manual install as admin...?
14:58 < Onepamopa> krzee what do u think Im doing last hour? ;)
14:58 < krzee> if you're sure its running as admin i cant be much help since i dont run windows, and have never touched win7
14:58 < Onepamopa> it managed to install only 1 time - and the driver wasnt "digitally signed" so it didnt work
14:58 < krzee> but theres plenty of others here that can, stick around =]
14:58 < Onepamopa> I intend to
14:59 < krzee> erm, the driver for windows in anything new is digitally signed
14:59 < krzee> that i know
14:59 < Onepamopa> well, on last development (beta) the driver didnt install at all
14:59 < Onepamopa> nomatter how many times I try
14:59 < krzee> oh like from !snapshots ?
15:00 < Onepamopa> m?
15:00 < krzee> trying 2.1.1 as well, right?
15:01 < Onepamopa> ye
15:01 < Onepamopa> Device node created. Install is complete when drivers are updated...
15:01 < Onepamopa> Updating drivers for tap0901 from C:\Users\xgate\Desktop\tap-driver-32_64\64-bit
15:01 < Onepamopa> \OemWin2k.inf.
15:01 < Onepamopa> tapinstall.exe failed.
15:01 < Onepamopa> downloaded everything from openvpn.se
15:01 < krzee> ohhh
15:01 < krzee> hehehehe
15:01 < krzee> there ya go
15:01 < krzee> !download
15:01 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
15:01 < Onepamopa> ?
15:01 < krzee> openvpn.se is years old, should be taken down
15:02 < krzee> (but we dont run it)
15:02 < krzee> i gotta run, but thats definitely the problem =]
15:02 < krzee> later
15:05 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-bthwefegsvbozgra] has joined #openvpn
15:06 < zoidberg-> Hey guys, is there any way to surpress these error messages only as they are filling my logs up and I can't see important stuff? (http://codepad.org/zAE1cOhM)
15:06 <@vpnHelper> Title: Plain Text code - 33 lines - codepad (at codepad.org)
15:10 < Onepamopa> krzee yeah, it worked, strange..
15:11 < Onepamopa> now it's time to order beer, pizza and start testing
15:12 < zoidberg-> Onepamopa: what are you testing?
15:15 < Onepamopa> zoidberg- ping differences between various openvpn configurations & gre tunneling
15:17 < Onepamopa> IM looking for the settings that will give me best pings between client/server
15:20 -!- lwhalen [~law@bastion-ext.sermo.com] has quit [Quit: Computer has gone to sleep]
15:22 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
15:26 -!- Ionic [ionic@ionic.de] has quit [Ping timeout: 245 seconds]
15:27 -!- Joel__ [~Joel@s3eea0222.adsl.wanadoo.nl] has quit [Quit: Leaving]
15:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
15:32 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:37 < zoidberg-> nice
15:38 -!- Ionic [ionic@ionic.de] has joined #openvpn
15:38 -!- EugeneKaway is now known as EugeneKay
15:49 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
15:49 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
15:49 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
15:53 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
16:16 <@vpnHelper> RSS Update - forum: Client can't connect to server <http://forums.openvpn.net/topic8734.html>
16:21 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:25 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
16:30 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
16:40 -!- lwhalen [~law@121.sub-174-252-42.myvzw.com] has joined #openvpn
16:40 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:44 -!- lwhalen [~law@121.sub-174-252-42.myvzw.com] has quit [Client Quit]
16:46 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
17:12 -!- Denial [Denial@drgi.co.uk] has quit []
17:15 -!- Grleaf [Guess@cpe-72-224-94-160.maine.res.rr.com] has quit [Ping timeout: 258 seconds]
17:15 -!- FuX|T [Guess@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
17:32 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
17:32 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
17:32 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
17:32 -!- Axeman [~Axeman3@knox.pace.edu] has joined #openvpn
17:32 -!- Axeman [~Axeman3@knox.pace.edu] has quit [Changing host]
17:32 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:32 -!- mode/#openvpn [+v Axeman] by ChanServ
17:46 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:00 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
18:23 -!- FuX|T [Guess@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
18:24 -!- Grleaf [Guess@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
18:43 -!- busch_ [~busch@74.117.156.156] has joined #openvpn
19:05 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
19:06 -!- brushbox [~brushbox@203.14.171.110] has left #openvpn []
19:14 -!- n2deep_ [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
19:14 -!- kav_ [~kav@g226093074.adsl.alicedsl.de] has joined #openvpn
19:18 -!- k4v [~kav@g226088134.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
19:21 -!- _julian_ [~quassel@hmbg-4d069114.pool.mediaWays.net] has joined #openvpn
19:21 -!- _julian [~quassel@hmbg-4d06ec82.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:22 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
19:28 <@vpnHelper> RSS Update - forum: server and local lan on same subnet? <http://forums.openvpn.net/topic8735.html>
19:30 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
19:53 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:08 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
20:10 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 276 seconds]
20:10 -!- caemir_ is now known as caemir
20:27 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:27 -!- mode/#openvpn [+v Axeman] by ChanServ
20:33 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:33 -!- mode/#openvpn [+v Axeman2] by ChanServ
20:34 -!- Axeman3 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:35 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:37 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
20:37 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:37 -!- mode/#openvpn [+v Axeman] by ChanServ
20:37 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
20:39 -!- Axeman3 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 258 seconds]
20:42 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:42 -!- mode/#openvpn [+v Axeman2] by ChanServ
20:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
20:55 < krzie> !linnat
20:55 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
21:08 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
21:08 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
21:17 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
21:30 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:31 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has joined #openvpn
21:32 < amero> hello
21:34 < fluter> hello
21:36 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:39 < amero> how do i delete persistent tun dev?
21:40 < amero> disregard that
21:42 < fluter> tunctl -d
21:50 < amero> how do you check if your tun dev is in persistent mode?
21:51 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:00 -!- Maff [maff@gateway/shell/anapnea.net/x-regejgafpbqwodnm] has joined #openvpn
22:06 < kenyon> amero: if it doesn't go away when openvpn is stopped?
22:07 < kenyon> zoidberg-: did you try --mute 1?
22:16 < amero> kenyon: what doesn't go away?
22:23 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 260 seconds]
22:26 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has joined #openvpn
22:35 <@vpnHelper> RSS Update - forum: Pushing routes? <http://forums.openvpn.net/topic8736.html>
22:35 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
22:37 -!- p3rror [~mezgani@41.140.96.17] has joined #openvpn
22:45 < kenyon> amero: the tun device
23:14 -!- lexdiamonds [~soulglo@108.59.10.145] has joined #openvpn
23:24 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
23:31 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
23:34 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
23:38 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
23:40 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
23:42 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has quit [Quit: Computer has gone to sleep]
23:45 -!- p3rror [~mezgani@41.140.96.17] has quit [Ping timeout: 245 seconds]
23:53 <@vpnHelper> RSS Update - forum: Split DNS - Is this possible? <http://forums.openvpn.net/topic8737.html>
23:59 <@vpnHelper> RSS Update - forum: Pushing routes? <http://forums.openvpn.net/topic8736.html#p15240>
--- Day changed Fri Sep 02 2011
00:01 -!- p3rror [~mezgani@41.140.37.21] has joined #openvpn
00:11 <@vpnHelper> RSS Update - forum: Client can't connect to server <http://forums.openvpn.net/topic8734.html#p15242> || server and local lan on same subnet? <http://forums.openvpn.net/topic8735.html#p15241>
00:19 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:27 -!- spitfire_ [~quassel@89.200.144.70] has quit [Remote host closed the connection]
00:28 -!- spitfire [~quassel@89.200.144.70] has joined #openvpn
00:53 -!- Maff [maff@gateway/shell/anapnea.net/x-regejgafpbqwodnm] has left #openvpn ["BOOP"]
00:56 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has joined #openvpn
01:03 -!- Onepamopa [onepamopa@unaffiliated/onepamopa] has quit [Ping timeout: 258 seconds]
01:09 -!- gilbertleung [~gilbertle@ppp-71-139-14-168.dsl.snfc21.pacbell.net] has joined #openvpn
01:10 < gilbertleung> hi
01:10 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
01:10 < gilbertleung> i'm a networking newbie 1/2 way thru setting up VPN for my office
01:10 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
01:11 < gilbertleung> the client can ping the server
01:11 < gilbertleung> but it can't ping any other machines
01:11 < gilbertleung> i found this on the FAQ: http://openvpn.net/index.php/open-source/faq/77-server/263-openvpn-can-ping-both-peers-but-i-cant-reach-any-of-the-other-machines-on-the-remote-subnet.html
01:11 <@vpnHelper> Title: OpenVPN can ping both peers, but I can't reach any of the other machines on the remote subnet. (at openvpn.net)
01:11 < gilbertleung> but i 've no idea what the solutions mean
01:11 < gilbertleung> e.g what does "adding a route to every client" mean
01:11 < gilbertleung> *?
01:12 < gilbertleung> or "NATing all VPN traffic to the local address of the OpenVPN machine..."
01:12 < gilbertleung> any help would be appreciated
01:12 < Bushmills> !route
01:12 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
01:14 < gilbertleung> Bushmills: i will try to read it
01:14 < gilbertleung> thanks
01:17 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
01:18 -!- dazo_afk is now known as dazo
01:24 <@vpnHelper> RSS Update - forum: Auto-connect client at windows start <http://forums.openvpn.net/topic8541.html#p15243>
01:27 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has joined #openvpn
01:36 <@vpnHelper> RSS Update - forum: using local bandwidth <http://forums.openvpn.net/topic8729.html#p15244>
01:42 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
01:42 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
01:42 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:45 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
01:46 -!- kanyl is now known as SweTV
01:46 -!- SweTV [~kanyl@unaffiliated/kanyl] has quit [Client Quit]
01:48 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
01:54 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15245>
01:54 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:59 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
02:01 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 240 seconds]
02:06 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714.html#p15246>
02:12 <@vpnHelper> RSS Update - forum: Split DNS - Is this possible? <http://forums.openvpn.net/topic8737.html#p15247>
02:12 -!- aten [~atum@94.124.93.60] has left #openvpn []
02:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:33 -!- gilbertleung [~gilbertle@ppp-71-139-14-168.dsl.snfc21.pacbell.net] has quit [Quit: gilbertleung]
02:36 -!- gilbertleung [~gilbertle@ppp-71-139-14-168.dsl.snfc21.pacbell.net] has joined #openvpn
02:47 -!- bui [~bui@public.nbs-system.com] has quit [Quit: Lost terminal]
02:59 <@vpnHelper> RSS Update - forum: Split DNS - Is this possible? <http://forums.openvpn.net/topic8737.html#p15248>
03:35 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:35 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:35 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:38 -!- darkdrgn2k3 [~darkdrgn2@199.243.221.14] has quit [Read error: Connection reset by peer]
03:39 -!- darkdrgn2k3 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
03:44 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Read error: Connection reset by peer]
03:52 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
04:00 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
04:09 -!- defswork_ [~andy@hns01-fw.internal.gxn.net] has quit [Ping timeout: 264 seconds]
04:10 <@vpnHelper> RSS Update - forum: Split DNS - Is this possible? <http://forums.openvpn.net/topic8737.html#p15249>
04:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:21 -!- defswork_ [~andy@mx2.3gcomms.co.uk] has joined #openvpn
04:22 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15250>
04:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:39 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: Connection reset by peer]
04:39 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:39 -!- mode/#openvpn [+o mattock] by ChanServ
04:39 -!- dazo is now known as dazo_afk
04:45 -!- dazo_afk is now known as dazo
05:29 -!- wangzhongwei [~wangzhong@114.113.197.132] has quit [Quit: Ex-Chat]
06:10 -!- Onepamopa [~onepamopa@87-126-31-28.btc-net.bg] has quit [Read error: Connection reset by peer]
06:14 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:14 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:14 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:14 -!- mode/#openvpn [+v Axeman2] by ChanServ
06:20 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:21 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:21 -!- mode/#openvpn [+v Axeman] by ChanServ
06:56 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
06:58 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
07:14 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
07:21 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has joined #openvpn
07:23 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
07:23 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has left #openvpn []
07:25 -!- Ionic [ionic@ionic.de] has joined #openvpn
07:31 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:35 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
07:42 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Quit: Leaving.]
07:56 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:56 -!- mode/#openvpn [+v Axeman] by ChanServ
07:57 -!- spitfire [~quassel@89.200.144.70] has quit [Disconnected by services]
07:58 -!- spitfire_ [~quassel@89.200.144.70] has joined #openvpn
08:05 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has joined #openvpn
08:21 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has left #openvpn ["leaving..."]
08:27 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has quit [Quit: Computer has gone to sleep]
08:28 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:37 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 268 seconds]
08:38 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
08:45 < steelnwool> I'm playing with ccd, and I just created one with the line "ifconfig-push 10.33.34.205 10.33.34.206" in it.
08:46 < steelnwool> it works, the client gets the ip .205, however he can't connect to anything on the VPN. do i have to push a route as well if i'm already pushing one globally?
08:55 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
08:56 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
08:57 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:02 -!- master_of_master [~master_of@p57B54F85.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:04 -!- master_of_master [~master_of@p57B5478D.dip.t-dialin.net] has joined #openvpn
09:15 < zoidberg-> kenyon: yeah i have tried --mute 1 and it still happens, any other ideas?
09:19 < dropje> steelnwool: no you only override global if you use push-reset
09:20 < steelnwool> dropje, have debugging suggestions then?
09:21 -!- luneff [~yury@84.51.196.195] has quit [Ping timeout: 252 seconds]
09:21 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15251>
09:24 < dropje> steelnwool: check the routes on the client. Did it work before you used a static ip for the particular client? aka does it still work on other clients?
09:25 < steelnwool> yes to both questons. it worked before static ip and other clients continue to work.
09:25 < steelnwool> i used "ifconfig-push 10.33.34.205 10.33.34.206" and i can't ping 206 at all.
09:25 < dropje> steelnwool: trying swapping them... ifconfig-push 10.33.34.206 10.33.34.205
09:25 < steelnwool> ok
09:26 < steelnwool> nope.
09:27 < steelnwool> one sec. i'll paste my routing table. its a windows machine and reads a bit weird to me.
09:27 < dropje> k
09:28 < steelnwool> http://pastebin.com/tGUPyrEg
09:29 < steelnwool> DOH.
09:29 < steelnwool> disregard me.
09:29 < steelnwool> i didn't right click run as admin. so no route getting added
09:29 < dropje> steelnwool: :) no problem
09:29 < dropje> steelnwool: but what's weird about the routing table? its pretty clear to me 
09:30 < dropje> steelnwool: glad to be your rubber-duck
09:30 < steelnwool> all good now.
09:30 < steelnwool> I just didn't understand what "on-link" meant. 
09:32 < dropje> It means that a destination is on your network.. e.g. you are 192.168.1.22/24 then 192.168.1.55 is on-link
09:32 -!- lwhalen [~law@bastion-ext.sermo.com] has joined #openvpn
09:33 < dropje> for anything outside your network you need a route or your default gw needs to know where to go
09:33 < steelnwool> gotcha.
09:33 < steelnwool> thanks.
09:33 < dropje> yw
09:33 < steelnwool> woo, the push "redirect-gateway def1 bypass-dhcp" thing works too.
09:33 < steelnwool> this slacker douche is gonna hate me when I'm done.
09:34 < dropje> haaha still busy with the lazy employee ;)?
09:34 < steelnwool> yeah, i was diving in to this at the end of yesterday. i have many masters.
09:34 < dropje> hehehe yeah i skimmed through some stuff you posted
09:35 < ecrist> we should start taking bets on when channel pop reaches 200
09:36 < steelnwool> ie: when the lazy guys joins to ask questions?
09:37 < ecrist> yeah
09:37 < ecrist> we started with 6 users on IRC back in 2008
09:37 < ecrist> we have more than that now.
09:40 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
09:47 < hyper_ch> hi ecrist
09:49 -!- luneff [~yury@84.51.201.56] has joined #openvpn
09:50 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
09:57 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has left #openvpn []
09:59 -!- pierreghz [~pierreghz@cust-208-56-111-94.dyn.as47377.net] has joined #openvpn
09:59 -!- EugeneKay is now known as EugenePhone
10:00 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
10:01 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15252>
10:02 -!- albech [~thomas@183.88.76.109] has joined #openvpn
10:04 -!- cpm is now known as SpacePandaCPM
10:05 -!- SpacePandaCPM is now known as jSpacePandaCPM
10:11 -!- kav_ is now known as k4v
10:18 -!- dazo is now known as dazo_afk
10:18 < lwhalen> hey all, quick question regarding some more in-depth OpenVPN setup: 
10:19 < lwhalen> is it possible/wise to have one certificate pair for a given class of users (Developers vs. Admins vs. Contractors vs. Employees), using those to stick the connecting clients into various configuration groups, and then using unique username/passwords to let the clients continue authenticating?
10:19 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Ex-Chat]
10:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:22 < lwhalen> or rather, a better question might be, "if the above is possible/wise, where could I find some documentation on setting that up?" 
10:27 -!- EugenePhone is now known as EugeneKaway
10:30 -!- qbasicer [~qbasicer@24-246-12-52.cable.teksavvy.com] has quit [Ping timeout: 258 seconds]
10:30 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
10:43  * ecrist reads
10:43 -!- qbasicer [~qbasicer@24-246-12-52.cable.teksavvy.com] has joined #openvpn
10:43 < ecrist> lwhalen: personally, I'd use one certificate chain, and setup a client-connect script that added rules to the firewall and did other such things
10:44 < lwhalen> anywhere I could find some docs on that?
10:45 < ecrist> not really
10:45 < ecrist> client-connect is just a script
10:45 < ecrist> figure out what firewall you use and/or what you want to change for a given user class
10:46 < ecrist> then, create a script that reads in the CN, figure out what you need to do to classify that user
10:46 < ecrist> and do those things
10:46 < ecrist> pretty straight forward, really
10:46 <+novaflash> ecrist; you make it sound so easy
10:46 < ecrist> it *is* that easy
10:46 <+novaflash> no it's terribly complicated to do if you have no clue what you're doing ;)
10:47 -!- 14WABIA5P is now known as Martin`
10:47 <+novaflash> fortunately docs help
10:47 -!- EugeneKaway is now known as EugenePhone
10:47 < ecrist> well, now, that's not really my problem. :)
10:47 <+novaflash> true
10:47 < ecrist> novaflash: everything you need on the openvpn side is in the howto
10:47 < ecrist> or the man page
10:48 < ecrist> we don't support $arbitrary_firewall here, so that isn't this channels problem.
10:48 <+novaflash> well of course
10:48 < EugenePhone> ecrist, this is your fault
10:49 < ecrist> I don't doubt it.
10:49 <+novaflash> does ecrist even get paid to have it be his fault?
10:49 < ecrist> no
10:49 <+novaflash> wow.
10:50 < ecrist> thought, the donation paypal account is in my name. :)
10:50 < ecrist> !donate
10:50 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel. or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc. or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
10:50 < EugenePhone> My ladyfriends flight is over an hour behind schedule
10:50 <@raidz> :-D
10:50 <+novaflash> an hour less sex :(
10:50 <+novaflash> oh hey raidz. goodmorning to ya.
10:50 < ecrist> so, the math in my head says you're at about -57 minutes then, novaflash 
10:51 <@raidz> hey hey
10:51 <+novaflash> ecrist; i don't have to defend my sex life. i let my girlfriends speak for themselves. ;)
10:52 <+novaflash> but i was sympathizing with EugenePhone's girl's delayed arrival.
10:52 < ecrist> So a linux nerd and bsd geek walk into a bar
10:52 < ecrist> And the linux nerd says, ext4 has better performance and data protection than ufs2
10:52 < ecrist> the bsd geek looks at him with an annoyed expression, "can't you see I'm trying to enjoy a beer with my girlfriend?"
10:52 <+novaflash> haha :)
10:53 <+novaflash> sounds about right ya
10:53 <@raidz> women, ugh
10:53 < EugenePhone> god thats old
10:53 <@raidz> swag
10:55 < EugenePhone> i think i shall nap
10:55 <+novaflash> bye EugenePhone
11:02 < amero> how do exec a script on server everytime after clients get assigned with ip?
11:02 < amero> how do i
11:03 < EugenePhone> magic
11:04 < ecrist> !man
11:04 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
11:05 < amero> got it
11:07 < amero> in client-connect, what ip address is actually passed to the script
11:08 < amero> the vpn ip that client's assigned with or the ip he's connecting from?
11:16 < lwhalen> wait, why would i authenticate to the firewall with a script?
11:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
11:18 < amero> huh?
11:29 -!- EugenePhone is now known as EugeneKaway
11:33 -!- bitterman [~yury@84.51.201.56] has joined #openvpn
11:34 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
11:34 -!- Deesl [~bsdboy@unaffiliated/deesl] has joined #openvpn
11:34 -!- Olipro_ is now known as Olipro
11:36 -!- luneff [~yury@84.51.201.56] has quit [Ping timeout: 250 seconds]
11:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
11:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:41 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
11:58 < gilbertleung> hi
11:58 < gilbertleung> i'm a newbie having trouble setting up Open VPN
11:58 < gilbertleung> my workplace runs on LAN with subnet 192.168.24.X. Router at 192.168.24.1. I'm trying to install openVPN on 192.168.24.2. A client connects successfully to VPN server using subnet 10.8.0.X and is able to ping 192.168.24.2, but fails to ping other machines on 192.168.24.X.
11:58 < gilbertleung> It seems like the scenario is described here:
11:58 < gilbertleung> http://openvpn.net/index.php/open-source/faq/77-server/263-openvpn-can-ping-both-peers-but-i-cant-reach-any-of-the-other-machines-on-the-remote-subnet.html
11:58 < gilbertleung> but I don't know how to implement any of the above solutions. Any suggestions would be appreciated.
11:58 <@vpnHelper> Title: OpenVPN can ping both peers, but I can't reach any of the other machines on the remote subnet. (at openvpn.net)
12:01 < krzie> !server;am
12:01 < krzie> !serverlan
12:01 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation
12:02 < gilbertleung> okay, i've enable ip forwarding on 192.168.24.2
12:03 < gilbertleung> i've pushed 192.168.24.X on the server as well
12:03 < gilbertleung> but i haven't done the last part
12:03 < gilbertleung> "router of the lag the server is on needs a route added to it
12:03 < gilbertleung> !route_outside_openvpn
12:03 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) you do not need this if the vpn node IS the gateway for its lan
12:05 -!- lexdiamonds [~soulglo@108.59.10.145] has quit [Quit: i hate the internet]
12:09 -!- LuckyY is now known as everyone
12:09 -!- everyone is now known as LuckyY
12:45 < lwhalen> how can I define a set of address pools "per certificate"?
12:45 < ecrist> what do you mean?
12:45 < lwhalen> i.e. "folks authenticating with this certificate get assigned address from pool A", "folks with this other certificate get assigned an address from POol B" 
12:46 < ecrist> openvpn can only assign ips out of one pool
12:46 < lwhalen> awwwwwwwwww
12:47 < lwhalen> that makes me very sad
12:47 < ecrist> use dhcp
12:48 < lwhalen> meh
12:48 < lwhalen> can I run a different OpenVPN server?
12:48 < lwhalen> with a different config file listening on a different port?
12:49 -!- jeev [~jeev@unaffiliated/jeev] has quit [Read error: Connection reset by peer]
12:54 < Essobi> lwhalen: yea
12:54 < Essobi> lwhalen: I got like 12 of them running on one machine
12:54 < Essobi> :)
12:55 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
12:55 < lwhalen> haha oh man 
12:55 < Essobi> :)
12:57 < lwhalen> it would be super useful to have different pools for different certs
12:57 < lwhalen> I could then mediate access via iptables on the OpenVPN box
13:00 -!- jSpacePandaCPM [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
13:08 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html>
13:09 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:15 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
13:15 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
13:18 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
13:19 <@vpnHelper> RSS Update - forum: Client can't connect to server <http://forums.openvpn.net/topic8734.html#p15254>
13:19 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
13:20 -!- spitfire_ [~quassel@89.200.144.70] has quit [Read error: Connection reset by peer]
13:20 < ecrist> lwhalen: you can't.  no plans to change it, either, currently
13:23 -!- spitfire [~quassel@89.200.144.70] has joined #openvpn
13:24 < krzie> well kinda you can
13:24 < krzie> !client-connect
13:24 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
13:24 < krzie> "different pools" would be done by your script, using static ips for each client based on the "pool" you want them in
13:24 < krzie> much like:
13:24 < krzie> !policy
13:24 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
13:27 < lwhalen> where can I find information on what DHCP options I can pass with "push dhcp-option"?
13:30 <@vpnHelper> RSS Update - forum: using local bandwidth <http://forums.openvpn.net/topic8729.html#p15255>
13:32 -!- trumee_ is now known as trumee
13:35 < krzie> to what OS?
13:35 < krzie> if linux/unix, you can push anything you want, but you'll need a script in --up to grab them and use them as you wish (like the update-resolv-conf script)
13:35 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15256>
13:35 < krzie> !pushdns
13:36 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
13:36 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
13:36 < krzie> #5
13:36 < krzie> err
13:36 < krzie> #4
13:37 < lwhalen> to OS X
13:37 < lwhalen> I basically just want to set the search-domain
13:56 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
13:57 < hyper_ch> hi krzie
13:58 < krzie> lwhalen, like i said above
13:58 < krzie> hey hyper_ch 
13:58 < hyper_ch> krzie: I hope you had a good day this far
13:59 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:59 < krzie> remains to be determined
14:00 < hyper_ch> :)
14:00 -!- p3rror [~mezgani@41.140.37.21] has quit [Ping timeout: 245 seconds]
14:01 -!- albech [~thomas@183.88.76.109] has quit [Quit: Ex-Chat]
14:07 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
14:08 < gilbertleung> hi
14:08 < gilbertleung> i've a situation where
14:08 < gilbertleung> my vpn server and DNS is on 192.168.24.2
14:08 < gilbertleung> i can ping it after connecting
14:08 < gilbertleung> but if i do nslookup google.com 192.168.24.2
14:08 < gilbertleung> nothing gets resolved
14:09 < gilbertleung> the DNS server has a public IP (say 99.99.99.99) and i've forward my DNS port (not safe, i know; but experimenting)
14:09 < gilbertleung> and if i do nslookup google.com 99.99.99.99,  things do resolve
14:09 < gilbertleung> would anyone have any ideas why?
14:10 < krzie> sounds like your NS doesnt serve you dns on your subnet when talking to the 192 ip
14:10 < krzie> throw it in debug mode
14:11 < krzie> (not a vpn problem)
14:22 < havoc> hmm, how many VPN clients can a single OpenVPN instance support?
14:22 < havoc> I know this has been discussed before, but I forget
14:23 < krzie> somewhere after 200 clients
14:23 < krzie> openvpn only uses a single core tho
14:23 < krzie> so can run more if you have more cores
14:23 < havoc> ok, I've been looking at M$ DA for ~250 clients, but it's a *pain*
14:23 < krzie> (more instances)
14:23 < krzie> ive heard of 250 working
14:24 < krzie> depends on the machine, and i cant be more specific than that
14:24 < havoc> but they have to be on diff IPs/ports then, right?
14:24 < havoc> yeah, would be beefy hardware
14:24 < krzie> diff ip:port:proto combo
14:24 < amero> krzie: any idea how i could retrieve client's vpn ip in my client-connect script?
14:24 < havoc> right, so only one instance per ip:port:proto
14:24 < krzie> amero, you can *set* it there
14:25 < amero> what do you mean
14:25 < krzie> amero: anything that script writes to $1 is taken as a dyanmic ccd file
14:25 < krzie> !client-connect
14:25 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
14:25 < havoc> krzie: you can configure multipl servers:ip:port:protos in the client config, right?
14:25 < krzie> yep, multiple remote statements
14:25 < krzie> or if you use same port:proto
14:25 < krzie> then you can just use dns roundrobin
14:25 < havoc> right, do they use then round-robin?
14:25 < havoc> ah, yeah
14:25 < havoc> thanks, hadn't thought of that
14:26 < krzie> np =]
14:26 < havoc> poor man's load balancing :)
14:26 < krzie> yep!
14:26 < amero> krzie: no, actually i want server to pass clients vpn ip to the script
14:26 -!- muntoo [d179789b@gateway/web/freenode/ip.209.121.120.155] has joined #openvpn
14:26 < muntoo> Hello?
14:26 < krzie> oh havoc i take back the multiple remote statements thing... when using diff protos youd need <connection> blocks
14:27 < krzie> but ya, still doable either way
14:27 < muntoo> This is the user channel, right?
14:27 < krzie> amero, the client doesnt HAVE a vpn ip at that point
14:27 < havoc> krzie: right, as long as you can have multiple host/ip/port/proto blocks in a client config
14:27 < krzie> which is why that script can SET IT
14:27 < krzie> lol
14:28 < hyper_ch> krzie: how hard would it be for the windows client not to fail silently when it's not being run as root as it tries to add routes?
14:28 < krzie> i dont use windows
14:28 < krzie> bbiab
14:28 < havoc> also, no root on windows ;)
14:28 < muntoo> Er nvm
14:28 < hyper_ch> windows doesn't have root? what a weird system
14:29 < havoc> yup :)
14:29 < muntoo> msg /NickServ
14:29 < muntoo> whoops
14:29 < havoc> I've made openvpn-gui run fine as a non-admin though with runas/psexec
14:30 < hyper_ch> I don't use Windows either
14:30 < havoc> consider yourself *very* lucky :(
14:30 < hyper_ch> I do
14:30 < hyper_ch> linux makes computing so much easier and more fun
14:30 < havoc> I come from the unix/linux world, but have been The windows admin for ~4yrs now :(
14:31 < havoc> yes, Windows is infinitely more difficult to admin than linux
14:31 < hyper_ch> how do you ssh into a windows client for maintenance?
14:31 < havoc> which is why I'm doing it; few others can, and it pays :(
14:31 < havoc> hyper_ch: cygwin sshd
14:31 -!- muntoo [d179789b@gateway/web/freenode/ip.209.121.120.155] has quit [Client Quit]
14:31 < havoc> or RDP
14:31 < havoc> or psexec
14:31 < hyper_ch> I have to admit, current integrated Windows RDP is rather nice and fast
14:32 < havoc> yes, much better than VNC
14:32 < hyper_ch> anything close to it on linux?
14:32 < havoc> but we use TeamViewer a lot too as you can have multiple users connected
14:32 < havoc> hyper_ch: yeah, remote X?
14:33 < hyper_ch> ssh -X ?
14:33 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
14:33 < havoc> I have a win7 and a linux workstation, and can use either and have access to everything on the other
14:33 < havoc> hyper_ch: I forget as I have bash aliases, btu something like that
14:33 < havoc> (yes, ssh -X exports DISPLAY)
14:33 < hyper_ch> but that's really poor performance
14:33 < havoc> depends
14:34 < havoc> use ssh compression on anything but local links
14:34 < hyper_ch> even on the lan is poor perforamnce
14:34 < amero> krzie: so the client-connect is fired before server assigns ip to clients?
14:36 < amero> hm ok
14:36 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
14:37 < havoc> anyway, MS Direct Access is a nightmare
14:38 < havoc> we already spent an extra $83.13 per unit (250 units) to get Win 7 Ent so we'd have it, but I'm the guy that knows the most about it
14:38 < havoc> and I don't like it
14:38 < havoc> I guess ovpn is the fallback ;)
14:39 < havoc> the problem with that is that I'm the only one in the org that knows *nix
14:39 < havoc> but I guess if it comes down to the wire they'll go with any solution that Works
14:39 < hyper_ch> then you should migrate everyone to *nix
14:40 < havoc> I wish :(
14:40 < hyper_ch> that would ensure longterm employment
14:40 < havoc> contrary to popular belief Windows is ***NOT*** easier to manager
14:40 < havoc> it costs a LOT more money
14:40 < havoc> they don't realize it but our whole corp runs on linux already
14:41 < hyper_ch> we're only running os x and linux nowadays
14:41 < havoc> Proxmox KVM hosts for all the infrastructure :)
14:41 < havoc> and ovpn for all VPN site links and client access :)
14:41 < hyper_ch> nice
14:44 < havoc> I've been give nearly zero resources for so long, I just make shit work
14:45 < hyper_ch> three work stations run OS X because people like MS Office
14:45 < hyper_ch> three work stations run linux
14:45 < havoc> which has been recently noticed, I think I'm getting an extra $1,500/mo. real soon out of fear I might leave
14:45 < hyper_ch> and two servers run linux :)
14:46 < havoc> 100% of our physical server run debian
14:46 < hyper_ch> same here
14:46 < hyper_ch> debian stable - fully encrypted
14:46 < havoc> pve[1-4], 2 pub Net server, 2 core "routers"
14:46 < havoc> the pve boxes host ~30 Win2k8r2 VMs, and a few debian VMs
14:47 < hyper_ch> why do you need so many VMs?
14:47 < havoc> and that's not counting my personal [interconnected] network
14:47 < hyper_ch> what area do you work in?
14:48 < havoc> DC[1-6] (sever locations), DPN, SCCM, FS[1-2], PRINTSRV, IIS, SPS, etc.......
14:48 < havoc> I do *everything*
14:48 < havoc> I stand alone in the org, no help
14:48 < hyper_ch> I mean your company
14:48 < havoc> hence the fear
14:48 < havoc> ah, IM (Inspection/Maintenance)
14:48 < havoc> basically Emissions Testing
14:49 < havoc> or that's the core biz
14:49 < hyper_ch> and it's a private company? not some governmental thing?
14:49 < havoc> yes, private, but 99% of income from gov contracts, globally
14:49 < hyper_ch> ok... emission testing just sounds governmental :)
14:49 < havoc> we're like a small country, or maybe a large country
14:49 < havoc> it is :(
14:50 < havoc> we also have some other stuff going on that I'm pretty sure I'm not supposed to discuss
14:50 < havoc> but anyway, my little corner of the global org is only ~40+ people
14:50 < hyper_ch> I see
14:51 < hyper_ch> that's about 34 people more than here
14:51 < havoc> I've also gotten a rep in the great org as the guy who gets it done
14:51 < havoc> so I have everyone from parent corp calling me first all the time now :(
14:52 < hyper_ch> havoc: you didn't setup a 0900 line yet for yourself?
14:52 < havoc> heh
14:52 < havoc> no, but my ext used to be 666 ;)
14:52 < hyper_ch> lol
14:52 < hyper_ch> you use voip?
14:52 < havoc> the old Holy-Roller boss didn't like that
14:52 < havoc> yes
14:52 -!- Deesl [~bsdboy@unaffiliated/deesl] has quit [Ping timeout: 252 seconds]
14:52 < hyper_ch> freeswitch?
14:53 < havoc> trixbox ATM, have brand new beefy Elastix box setup, just need to change over
14:53 < hyper_ch> trixbox runs asterisk, right?
14:53 < havoc> both do, yes
14:54 < havoc> both Centos, but Trixbox only does x86, Elastix can do x64
14:54 < hyper_ch> had a look at freeswitch / fusionpbx ?
14:54 < havoc> the current trixbox machine is just a commodity PC to, the new one is a 1U SMC
14:54 < havoc> nope
14:54 < hyper_ch> you should :)
14:55 < havoc> there's a lot of stuff I *should* do, just no time :(
14:55 < hyper_ch> time is relative ;)
14:55 < havoc> this new PBX has been setup, but unused for almost 4mo.
14:55 < hyper_ch> lol
14:55 < havoc> I spend more and more tiem on revenue bearing projects
14:55 < havoc> again, the source of the fear
14:56 -!- EugeneKaway is now known as EugeneKay
14:56 < hyper_ch> who was it in here who talked me into FS... bushmills I think
14:56 < havoc> I think they finally realize just how dependent they all are on me, and just how many people they'd have to hire to replace me
14:57 < havoc> I'd check it out, but Elastix is already setup and ready to go, and with that I know someone to help w/ some admin tasks
14:57 < hyper_ch> it's ok.. when you feel bored, you might want to have a look at it
14:58 < havoc> I probably will :)
14:58 < havoc> that's my "recreational" reading :)
14:58 < hyper_ch> hehehe :)
14:58 < havoc> bbl, beer time w/ neighbors
14:58 < havoc> then back to work :(
14:58 < hyper_ch> you can get drunken to work?
14:58 < havoc> I'm at home office right now
14:59 < hyper_ch> ah
14:59 < havoc> I do like 06:00 - 12:00 at the office, then rest of day at home, depending on stuff I need to put hands on
14:59 < havoc> 7.1mi. from work
14:59 < havoc> anyway, bbl
14:59 < havoc> hyper_ch: good talking to you :)
15:00 < hyper_ch> bye bye
15:01 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Remote host closed the connection]
15:03 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
15:12 <@vpnHelper> RSS Update - forum: extra routing with Windows 7 and User Access Controls <http://forums.openvpn.net/topic8739.html>
15:18 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Ping timeout: 245 seconds]
15:20 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
15:54 -!- lwhalen [~law@bastion-ext.sermo.com] has quit [Quit: Computer has gone to sleep]
16:30 -!- mete [~mete@mete.shell.la] has joined #openvpn
16:30 <@vpnHelper> RSS Update - forum: Pushing routes? <http://forums.openvpn.net/topic8736.html#p15258>
17:08 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
17:08 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
17:20 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:27 -!- pierreghz [~pierreghz@cust-208-56-111-94.dyn.as47377.net] has quit [Quit: Quitte]
17:27 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:28 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
17:42 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
17:49 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
17:49 -!- bitterman [~yury@84.51.201.56] has quit [Quit: This computer has gone to sleep]
17:54 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
18:03 -!- hpa [hpa@terminus.zytor.com] has quit [Excess Flood]
18:06 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
19:14 -!- kav_ [~kav@g226089251.adsl.alicedsl.de] has joined #openvpn
19:18 -!- k4v [~kav@g226093074.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
19:20 -!- _julian [~quassel@hmbg-4d06f48f.pool.mediaWays.net] has joined #openvpn
19:22 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 264 seconds]
19:23 -!- _julian_ [~quassel@hmbg-4d069114.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
19:23 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Ping timeout: 264 seconds]
19:24 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 264 seconds]
19:24 -!- Cain [~Geek@unaffiliated/cain] has quit [Ping timeout: 264 seconds]
19:24 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
19:24 -!- bigon [bigon@anor.bigon.be] has quit [Ping timeout: 264 seconds]
19:24 -!- kraut [~kraut@blackhole.netzdeponie.de] has quit [Ping timeout: 264 seconds]
19:24 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 264 seconds]
19:25 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Ping timeout: 264 seconds]
19:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
19:26 -!- Champi [Champi@rootshell.fr] has joined #openvpn
19:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:29 -!- kraut [~kraut@dyndsl-095-033-153-223.ewe-ip-backbone.de] has joined #openvpn
19:29 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
19:31 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
19:31 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
19:31 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
19:31 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
19:40 -!- Squidy_at_Home [~quassel@189.72.232.43] has joined #openvpn
19:43 -!- Cain [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
19:44 -!- Cain is now known as Guest95179
19:44 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
20:16 -!- Denial [Denial@drgi.co.uk] has quit []
20:25 <@vpnHelper> RSS Update - forum: extra routing with Windows 7 and User Access Controls <http://forums.openvpn.net/topic8739.html#p15259>
20:28 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
20:28 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
20:28 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
20:31 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:36 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
20:47 -!- ephedrandrox [~ephedrand@c-67-160-155-85.hsd1.or.comcast.net] has quit [Remote host closed the connection]
21:08 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
21:08 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:10 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
21:10 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
21:10 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:10 -!- mode/#openvpn [+v Axeman] by ChanServ
21:54 <@vpnHelper> RSS Update - forum: Router as VPN client and server at once ? Is it possible ? <http://forums.openvpn.net/topic8740.html>
22:14 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
22:19 -!- Grleaf [Guess@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
22:28 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:36 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:40 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:42 <@vpnHelper> RSS Update - forum: Migrate from Linux to Win 2008 R2 Server <http://forums.openvpn.net/topic8716.html#p15261>
22:58 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
23:28 -!- EugeneKay is now known as EugeneKaway
23:30 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Read error: Operation timed out]
23:35 -!- Squidy_at_Home [~quassel@189.72.232.43] has quit [Remote host closed the connection]
23:37 -!- meepmeep [meepmeep@212.24.104.229] has quit [Ping timeout: 252 seconds]
23:48 <@vpnHelper> RSS Update - forum: Get client VPN ip in client-connect script <http://forums.openvpn.net/topic8741.html>
--- Day changed Sat Sep 03 2011
00:02 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Operation timed out]
00:27 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:31 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
00:32 -!- a_ [d@ps38852.dreamhost.com] has joined #openvpn
00:34 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Quit: rebooting, oh noes]
00:45 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
00:46 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
00:47 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
00:49 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
00:50 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Operation timed out]
00:50 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
01:18 <@vpnHelper> RSS Update - forum: Pushing routes? <http://forums.openvpn.net/topic8736.html#p15263>
01:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
01:24 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
01:30 <@vpnHelper> RSS Update - forum: Migrate from Linux to Win 2008 R2 Server <http://forums.openvpn.net/topic8716.html#p15264>
01:32 -!- gilbertleung [~gilbertle@ppp-71-139-14-168.dsl.snfc21.pacbell.net] has left #openvpn []
01:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:48 <@vpnHelper> RSS Update - forum: Router as VPN client and server at once ? Is it possible ? <http://forums.openvpn.net/topic8740.html#p15265>
01:54 <@vpnHelper> RSS Update - forum: Get client VPN ip in client-connect script <http://forums.openvpn.net/topic8741.html#p15266>
02:09 -!- saffx0F [~saff__@178.73.218.23] has joined #openvpn
02:19 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:21 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
02:28 -!- somefatkid [~administr@rrcs-24-213-178-60.nyc.biz.rr.com] has quit [Read error: Operation timed out]
02:31 -!- somefatkid [~administr@63.138.254.154] has joined #openvpn
02:38 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:39 -!- gilbertleung [~gilbertle@ppp-71-139-14-168.dsl.snfc21.pacbell.net] has joined #openvpn
02:50 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
03:03 -!- gilbertleung [~gilbertle@ppp-71-139-14-168.dsl.snfc21.pacbell.net] has quit [Quit: gilbertleung]
03:18 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
03:18 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
03:18 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
03:49 <@vpnHelper> RSS Update - forum: OpenVPN redirect-gateway does not work on Windows 7 <http://forums.openvpn.net/topic8705.html#p15267>
03:52 -!- kav_ is now known as k4v
03:58 < hyper_ch> krzee: are you there?
04:16 -!- luneff [~yury@84.51.201.56] has joined #openvpn
04:16 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
04:45 -!- Athenon [~Athenon@unaffiliated/athenon] has joined #openvpn
04:45 -!- Athenon [~Athenon@unaffiliated/athenon] has left #openvpn ["Leaving"]
04:50 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 240 seconds]
05:15 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 252 seconds]
05:23 -!- saffx0F [~saff__@178.73.218.23] has quit [Remote host closed the connection]
05:40 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 240 seconds]
05:49 <@vpnHelper> RSS Update - forum: OpenVPN redirect-gateway does not work on Windows 7 <http://forums.openvpn.net/topic8705.html#p15268>
05:55 <@vpnHelper> RSS Update - forum: OpenVPN redirect-gateway does not work on Windows 7 <http://forums.openvpn.net/topic8705.html#p15269>
06:01 <@vpnHelper> RSS Update - forum: OpenVPN redirect-gateway does not work on Windows 7 <http://forums.openvpn.net/topic8705.html#p15270>
06:02 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
06:02 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
06:02 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
06:19 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
06:23 -!- sigius [~sigius@93.125.185.45] has quit [Ping timeout: 245 seconds]
06:26 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
06:49 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:50 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:53 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
07:03 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:03 -!- mode/#openvpn [+v s7r] by ChanServ
07:19 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
07:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:28 -!- mode/#openvpn [+v Axeman] by ChanServ
07:29 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has joined #openvpn
07:30 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has quit [Changing host]
07:30 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:38 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
07:47 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
07:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:16 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
08:22 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
08:41 -!- cjs226 [~cjs226@24.35.176.158] has joined #openvpn
08:47 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
08:48 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
08:55 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
08:55 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
08:55 <@vpnHelper> RSS Update - forum: Fix IP with ifconfig-push <http://forums.openvpn.net/topic8742.html>
09:00 -!- cjs226 [~cjs226@24.35.176.158] has quit [Read error: Connection reset by peer]
09:00 -!- cjs226 [~cjs226@24.35.176.158] has joined #openvpn
09:03 -!- master_of_master [~master_of@p57B5478D.dip.t-dialin.net] has quit [Ping timeout: 268 seconds]
09:04 -!- master_of_master [~master_of@p57B5396B.dip.t-dialin.net] has joined #openvpn
09:28 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:33 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
09:39 -!- cjs226 [~cjs226@24.35.176.158] has quit [Quit: Computer has gone to sleep.]
09:40 -!- advocatusdiaboli [~advocatus@193.69.144.162] has joined #openvpn
09:41 < advocatusdiaboli> What could cause connection to a LAN behind a OpenVPN to drop connection? ssh, vnc, anything, it works for 2-5 minutes then hangs.
09:41 < krzie> maybe mtu issues
09:41 < krzie> !mtu
09:41 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
09:41 < krzie> or, are you using tcp?
09:42 < advocatusdiaboli> udp
09:42 < advocatusdiaboli> routed
09:42 < hyper_ch> hi krzie
09:42 < krzie> high hyper_ch 
09:42 < hyper_ch> what's up?
09:42 < krzie> not much
09:43 < hyper_ch> lucky you
09:43 < advocatusdiaboli> I have been running openvpn client on a linux box with openvpn and iptables for a couple of years, I just recently tried to replace it with a pfsense 19" rack mountable
09:46 < krzie> [10:43]  <krzie> maybe mtu issues
09:46 < krzie> [10:43]  <krzie> !mtu
09:46 < krzie> [10:43]  <vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
09:46 <@vpnHelper> Title: OpenVPN/Troubleshooting - Secure Computing Wiki (at www.secure-computing.net)
09:47 < hyper_ch> copying 2tb data from one encrypted drive to another one takes some time
09:48 <+novaflash> hyper_ch; i have some experience with that ;) take a day ;)
09:48 < hyper_ch> it's copying at roughly 50MB/s
09:48 <+novaflash> reasonable speed.
09:49 < hyper_ch> without crypto chip inside
09:49 <+novaflash> 12 hours?
09:49 < hyper_ch> it's a i7
09:49 <+novaflash> truecrypt or something?
09:49 < hyper_ch> yeah, will take some time around 12-14h
09:49 < hyper_ch> luks/dm-crypt
09:49 <+novaflash> well gee
09:49 < hyper_ch> I did re-setup my server
09:49 < hyper_ch> had lenny on it
09:49 <+novaflash> now squeeze?
09:49 < hyper_ch> with some hack to remote reboot and unlock encrypted root fs
09:50 <+novaflash> ah yeah, small dropbear ssh server in the init?
09:50 < hyper_ch> now squeeze because it has a mechansim built in to unlock a remot encrpyted rootfs
09:50 < hyper_ch> yes
09:50 <+novaflash> awesome!
09:50 <+novaflash> i didn't know that
09:50 < hyper_ch> it's quite simple to setup
09:50 <+novaflash> i know the hack
09:50 <+novaflash> but didn't know it came built in now
09:51 < hyper_ch> all thx goes to wulf something... he wrote a first a script that I used on lenny
09:51 < hyper_ch> and debian admins though it a good idea and did integrate it now
09:51 <+novaflash> awesome
09:51 < hyper_ch> improved it even
09:51 <+novaflash> that's what i love about open source
09:51 < advocatusdiaboli> This issue only occurs on inbound traffix.
09:51 <+novaflash> everyone's good ideas given form
09:51 < hyper_ch> :)
09:51 <+novaflash> i wish there was open source porn
09:51 <+novaflash> i bet it would be REALLY GOOD
09:51 < hyper_ch> and then come some patent trolls like apple and oracle and microsoft
09:51 <+novaflash> very user friendly and completely free
09:52 < hyper_ch> youpr0n?
09:52 <+novaflash> haha
09:52 <+novaflash> openporn
09:52 <+novaflash> and with a commercial version called .. um.. openporn access server
09:52 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:52 -!- mode/#openvpn [+v Axeman] by ChanServ
09:52 <+novaflash> hello axeman
09:53 < hyper_ch> advocatusdiaboli: no clue
09:54 < krzie> advocatusdiaboli, was my mtu suggestion not good enough for you?
09:54 < krzie> if it wasnt, check that your firewall doesnt try to keep-state on udp
09:55 < krzie> after those 2, im out of ideas
09:56 <+Axeman> sup sup novaflash 
09:56 <+novaflash> things good herer
09:56 <+novaflash> 2 hours until barbecue
09:56 <+novaflash> it's nice weather here
09:56 < hyper_ch> same here
09:56 < hyper_ch> I'm sure it's a trap
09:57 < hyper_ch> as soon as I'd go outside, it'd start raining
09:57 <+novaflash> haha
09:57 < hyper_ch> I've been fooled by the weather before... but not today!
09:57 <+Axeman> nice here too. 
09:57 <+Axeman> child is ripping sutff up in his play yard
09:58 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:58 < hyper_ch> I'll have kids once they come with a conventient on/off button
09:59 <+novaflash> hyper_ch; a soundproof basement helps
09:59 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
09:59 < hyper_ch> cats are the better kids anyway :)
10:01 <+novaflash> i have 2 cats
10:01 <+novaflash> awesome furballs
10:02 < hyper_ch> novaflash: seen that  http://www.wimp.com/bullycat/  ?
10:02 <@vpnHelper> Title: Bully cat stuffs cat in box. [VIDEO] (at www.wimp.com)
10:02 <+novaflash> haha yeah
10:02 <+novaflash> nice one
10:02 < hyper_ch> furballs are the best thing every invented after sleep and eating
10:03 <+novaflash> where does sex come in?
10:03 < hyper_ch> that's overrated
10:03 <+novaflash> ouch. 
10:08 < hyper_ch> you disagree?
10:08 <+novaflash> well
10:08 <+novaflash> sleep, sex, eating, cats
10:08 <+novaflash> somewhere along that line
10:08 <+novaflash> is what i'd do
10:08 < hyper_ch> ;)
10:08 <+novaflash> it does get a bit odd when you combine them though
10:09 <+novaflash> cats staring while putting whipped cream on girlfriend in bed while she's sleeping.
10:09 <+novaflash> so, best enjoyed separately.
10:13 <+novaflash> by the way, this is epic. http://failblog.files.wordpress.com/2011/09/epic-fail-photos-atm-fail.jpg
10:15 -!- a_ [d@ps38852.dreamhost.com] has quit [Quit: leaving]
10:16 -!- trumee_ is now known as trumee
10:22 < hyper_ch> novaflash: you know this http://www.where-is-this.com/
10:22 <@vpnHelper> Title: WHERE IS THIS - Main (at www.where-is-this.com)
10:27 <+novaflash> hey that's a cool site
10:28 < hyper_ch> :)
10:29 < hyper_ch> I already could locate two images there
10:44 -!- corretico [~luis@201.201.44.82] has joined #openvpn
10:45 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
10:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:59 -!- Denial [Denial@drgi.co.uk] has quit []
11:03 -!- lyml [82ecfecc@gateway/web/freenode/ip.130.236.254.204] has joined #openvpn
11:04 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
11:05 -!- corretico [~luis@201.201.44.82] has joined #openvpn
11:07 -!- Grleaf [Guess@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
11:08 < lyml> hi, networking newbie here, I'm currently living in a censored village so I'm trying to set up a vpn to the sweet sweet freedom of my home I have set up a virtual machine hosting openvpn at port 443 which I am able to connect to 
11:09 < lyml> however I am not able to connect to the other computers on the network
11:09 < lyml> anyone know any troubleshooting resources I could look through to find the issue?
11:11 < hyper_ch> why do you use port 443?
11:11 <@vpnHelper> RSS Update - forum: Fix IP with ifconfig-push <http://forums.openvpn.net/topic8742.html#p15272>
11:11 < hyper_ch> !help
11:11 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
11:11 < hyper_ch> !configs
11:11 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
11:11 < hyper_ch> !howto
11:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:12 < lyml> connections are only allowed to port 443 and 80 through my local internet connection
11:13 < lyml> but thanks for the tips I will look through them
11:38 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
11:45 < trumee> I am unable to ping machines behind the lan client, even though i have enable ipv4 forwarding on the client.
11:46 < trumee> i have set the route and ccd on the server
11:47 < trumee> is there anything special i need to do on the opensuse client to enable ipv4 forwarding except echo "1" > /proc/sys/net/ipv4/ip_forward
11:49 < trumee> this is my config, http://www.pastie.org/2476752
11:50 < Ad0> thanks again for the help guys
11:50 < Ad0> from that other day
11:50 < Ad0> VPN work so sweet with embedded keys
11:51 < trumee> from the client i am able to ping all the machines behind the server. But i cant ping to machines behind the client.
11:52 < trumee> i am able to ping the client via its local lan ip 192.168.1.xx but not to any other 192.168.1.yy behind the client
11:53 < trumee> i have read the routing howto, http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
11:53 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
11:53 -!- rommel092079 [475e9251@gateway/web/freenode/ip.71.94.146.81] has joined #openvpn
11:53 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
11:55 < Ad0> is it properly routed though
11:55 < Ad0> it is natural that there's a local route / bridge to the other adapter
11:55 < Ad0> how is your iroute setup
11:55 < Ad0> and the push routes
11:56 < rommel092079> may I ask again how many concurrent users can openvpn accomodate per server?
11:57 < hyper_ch> depends on the server
11:58 < rommel092079> hyper_ch what do you mean depends? I really forgot now many users was that.
11:58 < hyper_ch> depends on how many the server can handel
12:00 < rommel092079> yes that is my question hyper_ch.  what could be the maximum number of users if the server is quad core, 1gb memory ?
12:01 < rommel092079> on 1gbps network
12:01 < trumee> Ad0: do i need to setup a route on each machine behind the client as the howto suggests? "the annoying work-around would be to add the route to every box on the LAN, in which case step 3 above would work"
12:01 < hyper_ch> 1gb only on a quad core?
12:03 < rommel092079> yes 1gbps port on quad core with 1gb memory?
12:04 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
12:06 < rommel092079> hyper_ch: what do you think the number of users will reach?
12:06 < hyper_ch> that's all so vague
12:06 < hyper_ch> depends on what they are all doing... no clue
12:07 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
12:07 < rommel092079> lets assume  they are just browsing the internet.
12:08 < rommel092079> or what is the idea number per server in openvpn?
12:09 < Ad0> trumee: 
12:09 < Ad0> no
12:09 < trumee> Ad0: right. so what am i missing?
12:09 < Ad0> how is your LAN?
12:09 < Ad0> do you run VPN ON the router
12:09 < Ad0> or on a server behind the master lan
12:10 < trumee> The vpn server is on the router. At the client side openvpn is running on a machine behind its router
12:11 < Ad0> ok
12:11 < Ad0> the server part is the important one
12:11 < Ad0> but how is your server config
12:11 < Ad0> care to pastebin it
12:11 < trumee> Ad0: http://www.pastie.org/2476752
12:12 < Ad0> how many client networks do you want
12:12 < Ad0> push "route 172.16.1.0 255.255.255.0"
12:12 < trumee> Ad0: server lan is 172.16.1.0, Client lan is 192.168.1.x
12:12 < Ad0> ok
12:12 < Ad0> in the top of the article almost
12:13 < Ad0> it states that you have to push the other one
12:13 < Ad0> it has 3 push route lines
12:13 < Ad0> but it's for the other clients I guess
12:13 < trumee> Ad0: hangon, my problem is different.
12:14 < trumee> Ad0: i am ABLE to ping any machine behind the server from the client. But i am Unable to ping any machine behind the client from the server
12:14 < Ad0> ok
12:14 -!- rommel092079 [475e9251@gateway/web/freenode/ip.71.94.146.81] has left #openvpn []
12:14 < Ad0> I see
12:14 < Ad0> the iroute is the magical one I uess
12:14 < trumee> Ad0: ie i want to be able to ping 192.168.1.xx addresses from the server
12:15 < Ad0> ok
12:15 < trumee> Ad0: yes, i do have an iroute setup as you can see from ccd/client1 in the pastie above
12:15 < Ad0> list routes on the server
12:15 < Ad0> is 192.168.1.0 taken into account on the routing table?
12:16 < Ad0> just check it
12:16 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
12:16 < Ad0> it has to somehow know about that network
12:16 < trumee> Ad0: server routing table, http://www.pastie.org/2476844
12:17 < Ad0> I am unsure about the gateway one
12:17 < Ad0> the tutorial states just the IP and subnet
12:17 < Ad0> client1 = route 10.10.1.0 255.255.255.0
12:17 < Ad0> on that tutorial
12:18 < Ad0> you got route 192.168.1.0 255.255.255.0 10.0.8.1
12:18 < Ad0> drop 10.0.8.1
12:18 < trumee> Ad0: no, it didnt work without the gateway. it gave an error about it
12:19 < Ad0> what error? :P
12:19 < trumee> Ad0: suddenly i am able to ping to machines behind the client!
12:19 < trumee> Ad0: i dont know how
12:19 < Ad0> loooool
12:19 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
12:19 -!- mode/#openvpn [+v Axeman] by ChanServ
12:20 < trumee> Ad0: i am going to reboot the machines, and check whether it is persistent :)
12:20 < Ad0> :)
12:22 < trumee> Ad0: maybe it is because i setup a route on the router of the client network
12:22 < Ad0> yeah
12:22 < Ad0> could be
12:23 < Ad0> but shouldnt the client set up a route from the vpn adapter
12:24 < trumee> Ad0: i will delete that route and see if it makes a differe
12:24 < trumee> *difference
12:25 < trumee> Ad0: ugh, didnt make any difference!. It still works
12:25 < Ad0> :)
12:27 < trumee> Ad0: funny thing is i am unable to ping from vpn server/router to the machines behind the client. However, i am able to ping from a machine behind the server to a machine behind the client. Go figure!
12:27 < Ad0> hah
12:28 < trumee> Ad0: all this while i was checking my pinging from vpn server/router to client machines, so my conclusion was that things werent working, whereas they were working
12:28 < trumee> Ad0: crap it has stopped working again!
12:29 < trumee> Ad0: maybe that route on the client router was indeed making the difference. i will enable that again
12:30 < Ad0> hehe
12:30 -!- pierreghz [~pierreghz@cust-7-7-111-94.dyn.as47377.net] has joined #openvpn
12:32 < trumee> Ad0: yup, can confirm after adding the route on the client router it is working again
12:32 < Ad0> ok
12:32 < Ad0> hmm
12:33 < Ad0> oh yeah
12:33 < Ad0> the scenario IS different on the client since they are not running openvpn on the router
12:33 < Ad0> "If you are not running openvpn on the router for each lan, you have some more routes to add. 
12:33 < Ad0> for EACH lan
12:34 < trumee> Ad0: that is probably it
12:34 < Ad0> yeah
12:34 < Ad0> if it
12:34 < Ad0> if it
12:34 < Ad0> err
12:34 < Ad0> if it's not on the router itself, a route has to be added
12:34 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
12:35 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
12:35 < trumee> Ad0: so instead of adding a route on each machine behind the client, i added it on the client router. so didnt have to do this, "the annoying work-around would be to add the route to every box on the LAN, in which case step 3 above would work. "
12:35 < Ad0> yes
12:36 < Ad0> you must add the route on the router
12:36 < Ad0> to avoid hassle
12:36 < Ad0> I did just this
12:36 < Ad0> because my server runs behind the router :)
12:37 < trumee> Ad0: my only niggle is that i cant ping the machines behind the client network from the server vpn/router itself. but i can live with that
12:37 < Ad0> yeah
12:40 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
12:40 -!- EugeneKaway is now known as EugeneKay
12:43 < lyml> I'm trying to connect to my home network and the internet through a bridged vpn.
12:43 < lyml> I've managed to get an ip from my home network and the ability to connect to my openvpn server (through ssh, pings etc) aswell as pinging the router but not telnet:ing to  it. 
12:43 < lyml> However attempting to connect to any other computer on the network gives destination host unreachable for ip-addresses and host unknown for hostnames. Anyone got any idea on what I should look at?
12:43 < lyml>  server.conf paste: http://pastie.org/2476872 -- client.ovpn paste: http://pastie.org/2476919
13:05 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
13:06 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
13:08 -!- pa [~pa@unaffiliated/pa] has quit [Read error: Connection reset by peer]
13:13 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
13:30 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
13:30 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
13:32 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
13:48 < EugeneKay> !tunortap
13:48 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
13:48 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
13:48 < EugeneKay> !tcp
13:48 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
13:48 < EugeneKay> And that is why I'm not going to even try to help you with that setup, lyml ;-)
13:50 -!- caemir [~caemir@unaffiliated/caemir] has quit [Quit: ZNC - http://znc.sourceforge.net]
13:52 < lyml> !wins
13:52 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
13:52 < lyml> I see
13:53 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
13:55 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:04 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
14:04 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
14:20 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
14:30 -!- jonanscott [2ed0b9fd@gateway/web/freenode/ip.46.208.185.253] has joined #openvpn
14:31 < jonanscott> anyone know how to send username and password in the config? we cant use --auth-user-pass as we don't have access to the server to add the check script
14:31 < jonanscott> thanks so much in advance guys
14:31 < jonanscott> :)
14:33 < jonanscott> anyone
14:35 -!- me345 [~me345@adsl-75-15-177-51.dsl.bkfd14.sbcglobal.net] has joined #openvpn
14:41 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
14:42 < jonanscott> ??
14:42 < jonanscott> :)
14:42 < jonanscott> help!!!
14:45 -!- lyml [82ecfecc@gateway/web/freenode/ip.130.236.254.204] has quit [Ping timeout: 252 seconds]
14:52 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
14:53 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Client Quit]
14:57 -!- jonanscott [2ed0b9fd@gateway/web/freenode/ip.46.208.185.253] has quit [Quit: Page closed]
15:05 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
15:05 -!- mode/#openvpn [+v Axeman] by ChanServ
15:19 < hyper_ch> !mtu
15:20 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
15:24 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
15:26 -!- Ionic [ionic@ionic.de] has joined #openvpn
15:30 < hyper_ch> krzee: still here?
15:31 < krzee> ya man
15:31 < krzee> wassup
15:47 <@vpnHelper> RSS Update - forum: Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html> || OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15273>
15:49 -!- Kartagis [~iegg@unaffiliated/kartagis] has joined #openvpn
15:49 < Kartagis> hi
15:50 < Kartagis> why do I keep getting logs like the ones at http://pastebin.com/9dyUeAnb?
15:51 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
15:53 < K1ng`> what is the best outsourcing site?
15:56 -!- abahkaiyisah [~abahkaiyi@110.139.99.96] has joined #openvpn
15:56 < abahkaiyisah> hi all
15:57 < abahkaiyisah> !welcome
15:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:57 < abahkaiyisah> !goal
15:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:57 < abahkaiyisah> !route
15:57 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
15:58 -!- abahkaiyisah [~abahkaiyi@110.139.99.96] has left #openvpn []
15:58 <@vpnHelper> RSS Update - forum: Get client VPN ip in client-connect script <http://forums.openvpn.net/topic8741.html#p15275>
16:00 -!- srwsrwuk [~srw@84.45.158.52] has joined #openvpn
16:06 < srwsrwuk> Beginner question. I have a VPN working. I want to tunnel all traffic from client to server (currently it works if I add a route manually but I want to push all traffic via the VPN when it is enabled including(!) general Internet traffic). I see there is a redirect-gateway option. I naively assumed I did "openvpn --redirect-gateway client.conf" but that fails complaining about flags. Version is from Debian 2.1.3 both ends but I need to make Windows clients wor
16:10 -!- me345 [~me345@adsl-75-15-177-51.dsl.bkfd14.sbcglobal.net] has quit [Remote host closed the connection]
16:10 < krzee> !redirect
16:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
16:11 < krzee> and when you have more flags than just openvpn config-file (on the cli), you need --config config-file
16:11 < krzee> you can only skip --config if its the only option passed to openvpn
16:11 < krzee> openvpn thought your config was just an option being passed to the redirect-gateway option
16:12 < srwsrwuk> Thanks - I thought that it had misinterpreted the command line.
16:12 < krzee> also
16:12 < krzee> !--
16:12 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
16:12 < krzee> you can just drop it in the config without --
16:12 < krzee> and you may want this:
16:12 < krzee> !def1
16:12 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:15 < srwsrwuk> krzee: that seems to work "--config" but I'll put it in the config with def1 as the first end user will go "huh?" if they need to do more than save a few files
16:22 -!- srwsrwuk [~srw@84.45.158.52] has left #openvpn []
16:29 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15276>
16:47 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15277>
16:51 -!- Squidy_at_Home [~quassel@187.52.120.53] has joined #openvpn
16:59 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:01 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:01 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:01 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:01 -!- mode/#openvpn [+v Axeman] by ChanServ
17:07 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
17:09 -!- srwsrwuk [~srw@84.45.158.52] has joined #openvpn
17:11 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15278>
17:12 -!- pcfreak30 [ae6f50fd@gateway/web/freenode/ip.174.111.80.253] has joined #openvpn
17:13 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:13 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:13 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:13 -!- mode/#openvpn [+v Axeman] by ChanServ
17:22 -!- srwsrwuk [~srw@84.45.158.52] has left #openvpn []
17:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
17:53 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15279>
18:14 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 252 seconds]
18:23 -!- Squidy_at_Home [~quassel@187.52.120.53] has quit [Remote host closed the connection]
18:42 -!- pierreghz_ [~pierreghz@cust-112-87-111-94.dyn.as47377.net] has joined #openvpn
18:43 -!- pierreghz [~pierreghz@cust-7-7-111-94.dyn.as47377.net] has quit [Ping timeout: 245 seconds]
18:51 -!- pcfreak30 [ae6f50fd@gateway/web/freenode/ip.174.111.80.253] has quit [Ping timeout: 252 seconds]
18:51 -!- pcfreak30 [ae6f50fd@gateway/web/freenode/ip.174.111.80.253] has joined #openvpn
18:52 < pcfreak30> http://pastie.org/private/zzsmufvmzatqunatjdddw <-- could someone please tell me my issue. it just hangs on logging on, on my windows client
18:52 < ecrist> is that a log file?
18:52 < pcfreak30> ecrist: its the server, client and a portion of /var/log/messages
18:53 < pcfreak30> conf*
18:54 < ecrist> !logs
18:54 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
18:54 < ecrist> I need logs from server and client
18:54 < pcfreak30> how exactly do i get the client logs from a gui?
18:54 < ecrist> not sure, not really my problem.
18:54 < ecrist> what gui are you using?
18:55 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
18:56 < pcfreak30> ecrist: im using the offical openvpn client off openvpn.net
18:57 < ecrist> the opensource version, or 'access server'
18:57 < ecrist> they are different
18:58 < pcfreak30> the open source
19:00 < ecrist> view log, ctl-a (select all), ctl-c (copy), ctl-v into a pastebin
19:00 < pcfreak30> http://openvpn.net/index.php?option=com_content&id=357
19:00 <@vpnHelper> Title: Client Packages (at openvpn.net)
19:00 < ecrist> not too difficutl
19:00 < ecrist> that is not the open source version
19:00 < pcfreak30> ...
19:00 < ecrist> that is the client for openvpn access server
19:00 < ecrist> http://openvpn.net/index.php/open-source/downloads.html
19:00 <@vpnHelper> Title: Downloads (at openvpn.net)
19:03 < pcfreak30> what i mainly see is tls handshake failed
19:04 < pcfreak30> and i have no idsea if it has to do with tls-auth but im not using that option
19:05 < ecrist> you are using the wrong client
19:05 < ecrist> you are using the wrong client
19:05 < ecrist> you are using the wrong client
19:05 < ecrist> you are using the wrong client
19:05 < ecrist> you are using the wrong client
19:05 < ecrist> you are using the wrong client
19:05 < ecrist> you are using the wrong client
19:05 < reiffert> ecrist: got any idea of what might be wrong?
19:06 < pcfreak30> ecrist: um i got that from the open source client...
19:07 < ecrist> pcfreak30: the link you gave me above, is not the open source client
19:07 < ecrist> I need full logs from the open source client
19:07 < ecrist> if you're using openvpn access server, go to #openvpn-as
19:07 < ecrist> reiffert: I'm at a loss.  perhaps you can help
19:08 < reiffert> pcfreak30: what's your problem?
19:09 < pcfreak30> ecrist: http://pastie.org/private/mqhio4osp8jnuihxxzvq
19:09 < EugeneKay> Psychological in nature, I'm gessing.
19:09 < reiffert> pcfreak30: ecrist already lost you, let's start over with me.
19:09 < reiffert> pcfreak30: what's your problem?
19:11 < pcfreak30> reiffert: meh, got my clients mixed up but im on the open source one now. im trying to set up a basic tunnled vpn.
19:11 < reiffert> pcfreak30: great. follow this:
19:11 < reiffert> !howto
19:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:11 < pcfreak30> i generated the ca,server, and a client cert/key
19:11 < pcfreak30> ya i have alot
19:12 < pcfreak30> http://pastie.org/private/zzsmufvmzatqunatjdddw is from the server and http://pastie.org/private/mqhio4osp8jnuihxxzvq is from my client
19:12 < pcfreak30> it just goes in a loop
19:12 < reiffert> pcfreak30: then you did something wrong.
19:12 < pcfreak30> thats kinda obvious...lol
19:13 < pcfreak30> any help?
19:13 < reiffert> see for "error" on http://pastie.org/private/mqhio4osp8jnuihxxzvq
19:13 -!- kav_ [~kav@g226088040.adsl.alicedsl.de] has joined #openvpn
19:14 < EugeneKay> Did you read the error message?
19:14 < reiffert> EugeneKay: me?
19:14 < EugeneKay> Hint: It's in the error message
19:14 < EugeneKay> No, not you
19:14 < pcfreak30> yes
19:14 < EugeneKay> And what does the "ERROR" say
19:14 < reiffert> pcfreak30: so tell us, what does it mean then?
19:14 < pcfreak30> its something with the cert? 
19:14 < EugeneKay> What about the cert..... look near "error="
19:15 < pcfreak30> certificate is not yet valid??
19:15  * EugeneKay ding ding ding
19:15 < pcfreak30> ok so wtf i do wrong
19:15 < reiffert> EugeneKay: come on, we are back to telling him everything instead of letting him learn something.
19:15 < pcfreak30> as i followed 2 guides that told me the same
19:16 < EugeneKay> My guess? Clock is wrong wherever you generaed your certifcates.
19:16 < pcfreak30> lol i learn alot every day. i feel u on spoon feeding info
19:16 < reiffert> EugeneKay: that way is boring.
19:16 < pcfreak30> i get it alot from others
19:16 < EugeneKay> Read your error messages, then
19:17 < pcfreak30> hahaja
19:17 -!- k4v [~kav@g226089251.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
19:17 < pcfreak30> i just checked 
19:17 < EugeneKay> So, now here's the key, what do you think you need to do to fix the certifcate?
19:17 < pcfreak30> for some reason the date on my vps is the 4 EDT
19:17 < pcfreak30> i just rented it so thats ofdd from my provider
19:18 < EugeneKay> UTC-4? That's probably what the time is where it's hosted.
19:18 < pcfreak30> incorrect
19:18 < pcfreak30> i have a growing webiter on a vps in NY USA
19:19 < pcfreak30> and it showed a time not even related to NY
19:19 -!- _julian_ [~quassel@hmbg-5f7630bd.pool.mediaWays.net] has joined #openvpn
19:19 < pcfreak30> when i checked it 
19:19 < pcfreak30> has to manually update
19:19 < pcfreak30> had*
19:22 -!- _julian [~quassel@hmbg-4d06f48f.pool.mediaWays.net] has quit [Ping timeout: 268 seconds]
19:23 -!- Denial [Denial@drgi.co.uk] has quit []
19:32 < pcfreak30> hmm. ficed the date issue and i added in tls-auth. now http://pastie.org/private/8agzjnubh92lfegbn2oklg <- client haqs no "errors" but i am getting http://pastie.org/private/46j7eyggkrajh5oknua7og from server log. any ideas...
19:35 < pcfreak30> btw openssl verify returned ok
19:38 -!- ropetin [~ropetin@pdpc/supporter/student/ropetin] has joined #openvpn
19:41 -!- pierreghz_ [~pierreghz@cust-112-87-111-94.dyn.as47377.net] has quit [Quit: Quitte]
19:41 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:48 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
19:50 < pcfreak30> any ideas why im getting no certificate returned. i just regerated the client key/cert to make sure i did it properly
19:51 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
19:56 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 246 seconds]
20:03 -!- jaminja [~jaminja@85.17.232.145] has quit [Ping timeout: 240 seconds]
20:23 < pcfreak30> anyone. ive recreated my keys based on the guide multiple times. i have no idea what i am doing wrong
20:32 -!- Squidy_at_Home [~quassel@201-88-247-167.cbace701.dsl.brasiltelecom.net.br] has joined #openvpn
20:38 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
20:56 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15280>
20:56 -!- Squidy_at_Home [~quassel@201-88-247-167.cbace701.dsl.brasiltelecom.net.br] has quit [Remote host closed the connection]
20:57 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
21:15 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
21:15 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:20 -!- Ionic [ionic@ionic.de] has joined #openvpn
21:24 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:40 < ecrist> pcfreak30: have you posted the logs yet?
21:53 < pcfreak30> ecrist: http://pastie.org/private/li7ypzoxwl3zkmpimkmew
21:54 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 258 seconds]
21:57 < ecrist> pcfreak30: configs, please
21:57 < ecrist> !configs
21:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
22:00 < pcfreak30> ecrist: server --> http://pastie.org/private/m5xqcovnhgwxcpx4jc4wpw
22:00 < pcfreak30> ecrist: http://pastie.org/private/urua8ov1s8muw7pya6yq <--client
22:07 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
22:09 < ecrist> can I see the server log, too, please?
22:13 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 260 seconds]
22:13 < ecrist> meh, I have drinking to do
22:13  * ecrist parts
22:27 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
22:31 < pcfreak30> ecrist: http://pastie.org/private/vhtswljuuiitqaghhcdgtg server log
22:37 -!- jaminja [~jaminja@76.76.24.43] has quit [Ping timeout: 258 seconds]
22:38 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 258 seconds]
22:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
22:59 -!- Rolybrau [~Rolybrau@153-232.3-85.cust.bluewin.ch] has joined #openvpn
22:59 -!- Rolybrau [~Rolybrau@153-232.3-85.cust.bluewin.ch] has quit [Changing host]
22:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:59 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:05 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
23:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
23:07 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:10 -!- Titania [~titania@208.79.15.251] has joined #openvpn
23:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:12 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
23:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
23:16 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:16 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:20 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 252 seconds]
23:36 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:37 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
23:41 -!- EugeneKay is now known as EugeneKaway
23:44 -!- pcfreak30 [ae6f50fd@gateway/web/freenode/ip.174.111.80.253] has quit [Ping timeout: 252 seconds]
23:46 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 264 seconds]
23:48 -!- Titania [~titania@208.79.15.251] has quit [Quit: Will return someday...]
23:51 < hyper_ch> hi ecrist
23:58 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Read error: Operation timed out]
--- Day changed Sun Sep 04 2011
00:00 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Operation timed out]
00:00 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
00:12 -!- silkyjohnson [~silky@178.73.193.68] has joined #openvpn
00:21 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:24 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 250 seconds]
00:43 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15282> || Get client VPN ip in client-connect script <http://forums.openvpn.net/topic8741.html#p15281>
00:44  * EugeneKaway drinks ecrist 
00:48 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Quit: ZNC - http://znc.in]
00:48 -!- EugeneKaway is now known as EugeneKay
00:52 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 260 seconds]
00:55 <@vpnHelper> RSS Update - forum: Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html#p15283>
01:07 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
01:07 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
01:07 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
01:07 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
01:19 -!- silkyjohnson [~silky@178.73.193.68] has left #openvpn ["i can count to potato"]
01:52 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
02:01 -!- _zero__ [~zero@noc.toile-libre.net] has joined #openvpn
02:04 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Read error: Connection reset by peer]
02:04 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Ping timeout: 240 seconds]
02:04 -!- spitfire [~quassel@89.200.144.70] has quit [Quit: No Ping reply in 180 seconds.]
02:04 -!- spitfire [~quassel@89.200.144.70] has joined #openvpn
02:04 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
02:04 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
02:04 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
02:04 -!- mode/#openvpn [+v novaflash] by ChanServ
02:29 -!- spitfire_ [~quassel@89.200.144.70] has joined #openvpn
02:30 -!- spitfire [~quassel@89.200.144.70] has quit [Ping timeout: 240 seconds]
02:35 -!- saffx0F [~saff__@178.73.218.151] has joined #openvpn
02:39 -!- EugeneKay is now known as EugeneKaway
02:48 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
02:58 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
03:06 -!- kbarry [~chatzilla@adsl-69-106-238-173.dsl.pltn13.pacbell.net] has joined #openvpn
03:07 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
03:07 < kbarry> If i'm  planning on running openVPN on a DDWRT device, I will need a static IP for the Router, Aswell as, I will need to move files ro all the client machines?
03:07 < kbarry> Or wil openvpn provide some kind of mechanism where having the correct password, gains one access?
03:08 < kbarry> Also, I thought i might ask for any recommendations on suitable routers. Don't need anything Fancy, mostly just the VPN.
03:11 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Ping timeout: 245 seconds]
03:23 -!- kbarry [~chatzilla@adsl-69-106-238-173.dsl.pltn13.pacbell.net] has quit [Remote host closed the connection]
03:36 < hyper_ch> static ip for router?
03:37 < hyper_ch> not sure what you mean with correct password to gain access
03:38 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
03:44 < hyper_ch> krzee: I changed not from udp to tcp and I get good speeds again
03:45 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:51 -!- saffx0F [~saff__@178.73.218.151] has quit [Read error: Connection reset by peer]
04:23 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
04:51 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
04:58 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
05:03 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
05:17 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:17 -!- mode/#openvpn [+v s7r] by ChanServ
05:19 -!- kav_ is now known as k4v
05:42 -!- jaminja [~jaminja@76.76.24.43] has quit [Ping timeout: 260 seconds]
05:42 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
06:02 <@vpnHelper> RSS Update - forum: OpenVPN redirect-gateway does not work on Windows 7 <http://forums.openvpn.net/topic8705.html#p15284>
06:17 < havoc> yup, may be going with ovpn instead of MS DA
06:39 < hyper_ch> whats ms da?
06:41 <+novaflash> it comes after MS LA and MS DEE
06:41 <+novaflash> la dee da
06:41 <+novaflash> no just kidding. presumably he meant AD - active directory? or something?
06:42 < hyper_ch> ad and ovpn arent related
06:43 <+novaflash> obviously
06:44 <+novaflash> can't think of what MS DA would be otherwise
06:44 < hyper_ch> neither can I
06:53 -!- jaminja [~jaminja@76.76.24.43] has quit [Ping timeout: 260 seconds]
06:54 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
06:59 -!- jaminja [~jaminja@76.76.24.43] has quit [Ping timeout: 276 seconds]
07:04 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
07:08 -!- jaminja [~jaminja@76.76.24.43] has quit [Read error: Connection reset by peer]
07:11 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:13 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
07:17 < havoc> hyper_ch: Direct Access
07:18 < havoc> it's their "VPN" solution built into Ultimate/Enterprise
07:18 < havoc> but IPv6 only
07:19 < hyper_ch> people still buy into that ipv6 myth?
07:19  * hyper_ch hides
07:19  * novaflash pokes hyper_ch
07:20 < hyper_ch> you can't poke me while I'm hidden
07:20 <+novaflash> ah there he is
07:20  * novaflash pokes hyper_ch
07:20 < hyper_ch> no, I'm not there
07:20 < hyper_ch> RESPECT THE GODDAM RULES!!!!
07:21 < hyper_ch> :)
07:21 <+novaflash> haha ;)
07:21 <+novaflash> putting your hands over your eyes and saying "i'm hidden" doesn't work
07:21 < havoc> not sure what myth you're refering to, but the issue is that a DA client cannot access non-IPv6 intranet resources without 6to4 translation, or proxying
07:21 < uuuppz> nova: concenrate a little more nd it does
07:21 < hyper_ch> if I can't see you, then you can't see me either
07:21 < hyper_ch> it's called logic
07:21 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 260 seconds]
07:22 < hyper_ch> havoc: I don't believe in ipv6 in general
07:22 < havoc> ah
07:22 < havoc> ok :)
07:22 <+novaflash> i find ipv4 still quite satisfactory
07:22 <+novaflash> especially for vpn situations and company networks
07:23 < havoc> anyway, DA also requires some serious infrastructure on the server side
07:23 < uuuppz> nova: point about ipv6 is it will allow a much flatter network design
07:23 < hyper_ch> does ipv6 outside the laboratory actually work?
07:23 < havoc> not sure if we have the time, or will to set it all up
07:23 < uuuppz> I'm considering move to it
07:23 < uuuppz> for the internal network
07:24 < havoc> I can have a workign ovpn solution up and running in a couple hours, it may take a weeke to get DA setup
07:24 < havoc> just have to tweak the client configs a bit for running as a service and reconnecting faster after a dropped connection
07:25 <+novaflash> well
07:25 < havoc> but I'm not responsible for the server side; I know these guys would want only win2k8r2
07:26 <+novaflash> i'll just wait until ipv8 before i switch
07:26 < havoc> heh
07:29 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
07:29 <+novaflash> is that tux?
07:29 <+novaflash> *squints*
07:31 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:34 <@vpnHelper> RSS Update - forum: how to block P2P traffic <http://forums.openvpn.net/topic8491.html#p15285>
07:43 -!- michl [~fjutscha@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has joined #openvpn
08:06 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Ping timeout: 245 seconds]
08:07 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
08:18 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
08:35 -!- pierreghz [~pierreghz@cust-112-87-111-94.dyn.as47377.net] has joined #openvpn
08:43 -!- Squidy_at_Home [~quassel@187.52.121.3] has joined #openvpn
08:46 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
08:56 -!- Squidy_at_Home [~quassel@187.52.121.3] has quit [Remote host closed the connection]
09:02 -!- master_of_master [~master_of@p57B5396B.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
09:04 -!- master_of_master [~master_of@p57B55CC9.dip.t-dialin.net] has joined #openvpn
09:04 <@vpnHelper> RSS Update - forum: Preventing SPAM <http://forums.openvpn.net/topic8719.html#p15286>
09:28 -!- rommel092079 [475e9251@gateway/web/freenode/ip.71.94.146.81] has joined #openvpn
09:30 -!- rommel092079 [475e9251@gateway/web/freenode/ip.71.94.146.81] has left #openvpn []
09:59 -!- rommel092079 [~genlime@71-94-146-81.static.mtpk.ca.charter.com] has joined #openvpn
10:19 < rommel092079> guys I would like to ask you something. I have reached my number of users around 250 already.  my problem is that, some clients said that they cannot access openvpn service because of auth-failed. but I read on a reading posted by janjust that some reached over thousand users without problem.  what could be the problem here?
10:21 -!- rommel092079 [~genlime@71-94-146-81.static.mtpk.ca.charter.com] has quit []
10:26 < michl> How long is the "push" command in your servers config file?
10:29 < ecrist> !logs
10:29 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
10:29 < ecrist> we need to see logs of a failed attempt
10:38  * jpalmer is about to be very nervous.  I just wrote a puppet module to install/configure/manage openvpn on all of my production hosts,  and change it to use the puppet certificates for openvpn.  I'll be mass deploying it in the next week or two.
10:42 -!- EugeneKaway is now known as EugeneKay
10:43 -!- rommel092079 [~genlime@71-94-146-81.static.mtpk.ca.charter.com] has joined #openvpn
10:44 < rommel092079> why does some of my users often complain that they are having auth-failed issue while my users have not yet reached 300. please kindly assist me.
10:44 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Read error: Connection reset by peer]
10:45 < michl> Please do as ecrist said.
10:46 < jpalmer> !logs
10:46 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
10:48 < rommel092079> please guys. isnt this help forum for openvpn? I cant understand why is it so hard to ask for help.
10:48 < rommel092079> sorry I cant provide the log files because I am far from clients.
10:49 < jpalmer> it's hard because you've provided no information.  do you want us to just take random guesses as to what the problem might be?
10:49 < rommel092079> but what they said is they are having auth-failed.
10:49 < michl> Do you have access to the servers log file?
10:49 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
10:50 < rommel092079> michl, well, I have not included option for log in my server conf
10:50 < michl> do it
10:50 < jpalmer> now might be a good time.
10:50 < rommel092079> anyway, what should I look for in my server log if any.
10:50 < rommel092079> anyway, what should I look for in my server log if any.
10:50 < michl> error messages? :-)
10:51 < jpalmer> you should look for anything that looks like a problem.  or,  post the logs so we have a starting basis for troubleshooting.
10:51 < rommel092079> ok. probably I will set this up. thanks for your time michl and jpalmer.
10:52 -!- rommel092079 [~genlime@71-94-146-81.static.mtpk.ca.charter.com] has quit []
10:52 < jpalmer> probably   yeesh.
10:52 < michl> You only have to add "verb 5" to your config.
10:52  * jpalmer predicts that guy will be a handful.
10:53 < michl> 300 clients and no logs? Quite optimistic approach.....
10:54 < jpalmer> indeed.
10:54 < jpalmer> I'd guess he's one of the "I only turn on logging when there is a problem" types.  logs are for reactive fixes,  not proactive maintenance!
10:55 < EugeneKay> I LOG AT FULL POWER ONLY
10:57 < michl> EugeneKey: Do you use managenent interface? If you do: Don't you wish to get rid of these management entries, too?
10:58 < EugeneKay> [eugenekay@francisdrake ~]$
10:58 < EugeneKay> That's my mgmt interface
10:59 < michl> If you rely on log enties of management interface: Who causes them in the first place?
10:59 < EugeneKay> I don't have issues?
11:01 < michl> Ah, know I get it. So your answer to my question is "no". OK.
11:17 < michl> By the way: This week I was able to solve the mystical packet losses I spoke of last weekend.
11:18 < michl> If someone is interested: It seems that it was the ISP: T-Mobile dopped the packages.
11:21 <+novaflash> why would they do that... silly bonkers.
11:22 < michl> I do not know, if they do it on purpose or if it's some kind of misconfiguration.
11:23 <+novaflash> either way; mighty annoying. they're supposed to carry data. but they drop packages.
11:23 < michl> At least I know, that it is not a local problem in Berlin/Germany, because I was able to reproduce it at my place far away from Berlin.
11:24 < michl> Actually I do not know how to reply to this behaviour:
11:25 < michl> Pro: They protect their network from people, who behave very inpolite by sending this huge mass of packets.
11:25 < michl> Contra: I do not care about their net and want my data!
11:26 <+novaflash> the way i see it, their net cannot handle the traffic so they cut corners by dropping packages.
11:26 <+novaflash> but you still pay for it while it's being sold as a proper business solution.
11:27 < michl> Yes, and they seem to pause the data stream with 2 seconds
11:27 < michl> Vodafone does nothing of this kind.
11:28 <+novaflash> so t-mobile sucks balls.
11:28 < michl> Yes, but the alternatives suck, too. They just do it in another way.
11:29 < michl> Vodafone in NL for instance: They cut traffic completely after using all the data plan.
11:29 <+novaflash> nice.
11:33 < michl> Is anybody here, that can report similar problems with OpenVPN over 2G or 3G networks?
11:33 <+novaflash> i'm sorry haven't tested that yet. can you give a short description though of the symptoms?
11:34 < michl> Start a FTP session, send A LOT FTP packets through the tunnel, that return FTP-Error-Relpies like "no such file"
11:35 < michl> Do not pause between the ftp queries
11:35 < michl> Then stop one of the OpenVPN services. It does not matter, if you stop the client or the server.
11:35 < ecrist> myself and quadDama1e worked all day yesterday tethered to his t-mobile phone with wifi sharing
11:35 < ecrist> didn't have any issues to speak of
11:35 <+novaflash> is this while sending or receiving?
11:35 < michl> The point is, that all this traffic now becomes routed to the internet.
11:35 < ecrist> I think we probably used over a gig of transfer throughout the day, too
11:36 < michl> The client is sending to the server
11:36 < michl> FTP queries come from the client
11:36 < michl> Then reestablish the tunnel.
11:37 < michl> The provider now get a lot of UDP packets and almost immediatelly delays these UDP packets.
11:37 < michl> The other traffic into the internet behaves normaly (no drops)
11:38 <+novaflash> so.. start tunnel, start ftp, transfer from client to server through tunnel, get error message, stop/start openvpn server, reestablish connection, information through tunnel is now delayed a lot but traffic outside tunnel is fine.
11:38 < michl> To get a fast and non-packet dropping tunnel you have to disable the internet connection and reconnect.
11:39 < michl> exactly.
11:39 <+novaflash> interesting set of variables
11:39 < michl> As I said: the customer sent A LOT FTP queries without waiting in between.
11:40 <+novaflash> hm.
11:41 < michl> This scenario is not that unlikely: A 2G or 3G connection should be disconnected after 24 hours to give the providers the chance to update their net.
11:42 < michl> A new internet connection always leads to a temporary wrong routing, because openvpn has to reestablish tHe tunnel after the internet connection.
11:43 < hyper_ch> michl: you have problems with udp?
11:44 < michl> I don't know, if the problem is specific to UDP. We could not try TCP because of the customer setup. TCP is _much_ more slow on 3G networks because of the high latency.
11:45 <+novaflash> sorry for the off-topic thing, but... i'm working on a customer's laptop. i see files come by. one is called "Big Tits Zombie 2010" <- what the hell.
11:45 < hyper_ch> michl: well, from one client to the server I had issues with UDP.... changed it all to TCP and now I get decen speeds again
11:45 < hyper_ch> michl: checked if there's a MTU problem?
11:45 < michl> Especially with this constellation, where a lot of FTP-commands lead to a huge load of socket opening/closing.
11:46 < hyper_ch> novaflash: what's wrong with big titted zombies?
11:46 < michl> Yes, we lowered MTU to 800 bytes. Did't help.
11:46 < hyper_ch> :(
11:46 <+novaflash> you can see the silicone implants through the bites taken out of their skin.
11:46 < michl> hyper_ch: enjoy them :-)
11:52 -!- DarthGandalf [~Vetinari@shellium/developer/darthgandalf] has quit [Changing host]
11:52 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
11:54 <+novaflash> hyper_ch; i've heard running TCP traffic over an OpenVPN tunnel over TCP is a bad idea. if a packet is lost it gets retransmitted - but the TCP packets inside the tunnel won't match up and request a retransmission as well. things get a bit messy until it's all caught up again.
11:55 < hyper_ch> novaflash: well, I did run udp for a long time
11:55 < hyper_ch> and it worked fine and a while back, suddenly speeds dropped without any explanation
11:55 < michl> Add the relatively high latentcy and the mess gets even bigger.
11:55 < ecrist> !tcp
11:55 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
11:55 < hyper_ch> I thought maybe I did something wrong on that client when messing around with python on it
11:56 < hyper_ch> so I reinstalled yesterday with debian stable now....
11:56 < hyper_ch> with udp it was still slow
11:56 < hyper_ch> changed it to tcp and all is fine again
11:56 <+novaflash> ah tcp-nodelay is the workaround? hm i'll read up on that, thanks ecrist
11:58 < hyper_ch> !tcp-nodelay
11:59 < hyper_ch> how do you set it in a config?
12:00 <+novaflash> i assume the webpage linked there shows how ;)
12:00 < hyper_ch> http://www.openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html
12:00 <@vpnHelper> Title: OpenVPN 2.1 (at www.openvpn.net)
12:01 < hyper_ch> it speaks of  --tcp-nodelay as parameter to start the server
12:01 < hyper_ch> but I wonder how to put it into the server config
12:01 <+novaflash> ah
12:01 < michl> Just enter "tcp-nodelay" 
12:03 < ecrist> !--
12:03 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
12:04 < hyper_ch> it doesn't like that
12:04 < hyper_ch> sudo /etc/init.d/openvpn restart
12:04 < hyper_ch> Stopping virtual private network daemon: server.
12:04 < hyper_ch> Starting virtual private network daemon: server failed!
12:04 < hyper_ch> :(
12:04 < ecrist> hyper_ch: that doesn't show logs
12:06 < hyper_ch> ecrist: Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/server.conf:313: tcp-nodelay (2.1_rc11)                                                                  
12:06 < ecrist> um, rc11 is WAY out of date
12:06 < ecrist> we don't support it. :)
12:07 < hyper_ch> that's default on debian old-stable
12:07 < ecrist> there were around 20 more release candidates after rc11 before 2.1.0 was released.
12:07 < ecrist> hyper_ch: we don't care
12:07 < ecrist> we don't support it
12:07 < hyper_ch> and the 2.1 manual says it has that option
12:07  * hyper_ch feels so sad now
12:07 < ecrist> hyper_ch: 2.1 does have that option
12:08 <+novaflash> hyper_ch; update! update! update! ;)
12:08 < hyper_ch> novaflash: upgrading a fully encrypted server isn't that simple
12:08 < ecrist> I'm guessing it is
12:08 < hyper_ch> I'll do a fresh install probably next weekend
12:08 < hyper_ch> ecrist: a fully encrypted server in a remote datacenter
12:08 < ecrist> I'm guessing it is
12:09 < hyper_ch> ecrist: how do you unlock a fully encrypted server remotely?
12:09 < hyper_ch> after a reboot
12:09 < ecrist> openvpn doesn't require a reboot
12:09 < ecrist> and you should have a remote KVM
12:09 <+novaflash> hyper_ch; using a dropbear ssh in the init you can ssh in and unlock the encrypted partition and continue boot.
12:09 < ecrist> dell's new DRAC6 enterprise has really nice java KVM
12:10 <+novaflash> this method is built into debian squeeze now
12:10 < hyper_ch> novaflash: that's what I do... wulf has written a script for debian old-stable
12:10 <+novaflash> and yes, ilo and drac are good options.
12:10 < jpalmer> ecrist: yeah it does.   DRAC6 is finally starting to catch up with iLO
12:10 < hyper_ch> novaflash: the current method for squeeze is based on wulf's work
12:10 <+novaflash> yup
12:10 < ecrist> regardless, 1) we won't support rc11, 2) openvpn still doesn't require a reboot
12:10 <+novaflash> yup
12:10 <+novaflash> you could just upgrade openvpn package
12:10 < ecrist> jpalmer: I like that I can tie DCRAC 5/6 in to our ldap server
12:10 <+novaflash> leaving the rest of the server environment intact
12:10 < hyper_ch> just upgrade on package? no way :)
12:11 <+novaflash> hyper_ch; as you wish.
12:11 < hyper_ch> well, gotta switch to ext4 anyway also.... there will be  a new install next weekend
12:11 < jpalmer> ecrist: I wish I could make more use out of DRC/iLO
12:11 < jpalmer> since all my servers are remote,  I don't usually have access to the management network.  so,  I don't generally have that luxury, even though all of our servers have the capability.
12:11 <+novaflash> i've never used drac. i use ilo. any significant pros/cons in drac vs ilo?
12:12 < ecrist> we buy dell pretty much exclusively now, and we get the drac6 enterprise in everything.
12:12 -!- srwsrwuk [~srw@84.45.158.52] has joined #openvpn
12:12 < jpalmer> I may be buying a dell R410,  or R610 for my home lab.
12:12 < ecrist> jpalmer: openvpn could help you get access to that management network. ;)
12:12 < ecrist> the R610s are really nice
12:12 < ecrist> we have a bunch of them
12:12 < jpalmer> ecrist: it's not *our* management network to get access too ;)
12:12 < ecrist> gey
12:13 < jpalmer> ecrist: my clients are all hospitals.  they have their own management network,  and plug iLO/DRAC into that.   they'd never give us direct access.
12:13 < ecrist> gotcha
12:14 < jpalmer> speaking of iLO/DRAC,  I have to get in touch with HP again.  I have a proliant with a failing IPMI module.  causing opsview to shit itself!  (trying to monitor hardware that it can't monitor)
12:15 -!- drfreeze [~Jim@207.191.114.82] has joined #openvpn
12:15 < drfreeze> Hi
12:15 < jpalmer> hola
12:15 < drfreeze> Can someone tell me what /etc/init.d/openvpn cond-restart does?
12:15 < ecrist> noppe
12:15 < ecrist> we didn't right it
12:15 < drfreeze> I tried it and it seems to just restart the server
12:15 < ecrist> you could read the script
12:15 < drfreeze> I expected something like - if it is down, then restart it
12:15 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
12:15 < ecrist> s/right/write/
12:16 < jpalmer> drfreeze: usually,  that'll be a conditional restart.   check the script for info.   it may wait until all clients dicsonnect before restarting,  or similar.
12:16 -!- fread2281 [~fread2281@70-56-140-211.albq.qwest.net] has joined #openvpn
12:16 -!- fread2281 [~fread2281@70-56-140-211.albq.qwest.net] has left #openvpn []
12:18 < drfreeze> Hrm, looks like it only restart if it finds a running openvpn
12:21 < michl> maybe there is a dumb startup script, that relies on a positive kill, if a openvpn pid file was found?
12:22 < srwsrwuk> Trying to set up Windows 7 client with "redirect-gateway" config works on Debian client. On Windows 7 client it complains that "route gateway is not reachable..." on inspection of log it looks like the TAP interface has acquired the zero conf IP address (169.254.6.177) rather than one in the 10.8.0.10/255.255.255.252 range it says will be used earlier in the log output. I'm pushing DNS servers in the config. Google finds a similar post saying "push a WINS serv
12:23 < ecrist> srwsrwuk: sounds like you're not running as admin
12:24 < jpalmer> you only need to push a WINS server, if you are using a WINS server.  and,  you likely aren't.
12:24 < EugeneKay> The !logs would bear that out, of course
12:46 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
12:47 -!- michl [~fjutscha@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has quit [Quit: michl]
12:47 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
13:03 < srwsrwuk> definitely no WINS anywhere. I presume that the DHCP like step failed. It seems to have added the routes as expected (although it looks like some of the commands attempted fail under Windows, the routing table looks good other than the TAP device being in the wrong network. End user reports the GUI icon is set to run as administrator. When I last did Windows 7 it failed adding routes through permissions, and it was fairly clear it was permissions from log. Thi
13:17 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:17 -!- mode/#openvpn [+v s7r] by ChanServ
13:38 -!- kav_ [~kav@g226090079.adsl.alicedsl.de] has joined #openvpn
13:40 -!- k4v [~kav@g226088040.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
13:46 -!- Kartagis [~iegg@unaffiliated/kartagis] has quit [Ping timeout: 250 seconds]
13:47 -!- Kartagis [~iegg@unaffiliated/kartagis] has joined #openvpn
13:55 -!- pierreghz [~pierreghz@cust-112-87-111-94.dyn.as47377.net] has quit [Quit: Quitte]
14:11 -!- Netsplit *.net <-> *.split quits: EugeneKay, kenyon, Hamlin, fahadsadah, oc80z, hpa, diytto
14:13 -!- Netsplit over, joins: oc80z
14:14 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
14:20 -!- srwsrwuk [~srw@84.45.158.52] has left #openvpn []
14:21 -!- hpa [hpa@terminus.zytor.com] has joined #openvpn
14:21 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
14:21 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
14:21 -!- diytto [~diytto@2001:470:26:59c::a441] has joined #openvpn
14:21 -!- Hamlin [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has joined #openvpn
14:38 -!- Squidy_at_Home [~quassel@187.52.121.192] has joined #openvpn
14:38 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
14:47 -!- Squidy_at_Home_ [~quassel@187.52.121.192] has joined #openvpn
14:47 -!- Squidy_at_Home [~quassel@187.52.121.192] has quit [Ping timeout: 240 seconds]
15:02 -!- Squidy_at_Home_ [~quassel@187.52.121.192] has quit [Ping timeout: 240 seconds]
15:03 -!- Squidy_at_Home [~quassel@187.53.181.209] has joined #openvpn
15:08 -!- Squidy_at_Home_ [~quassel@189.11.246.175] has joined #openvpn
15:08 -!- Squidy_at_Home_ [~quassel@189.11.246.175] has quit [Remote host closed the connection]
15:09 -!- Squidy_at_Home [~quassel@187.53.181.209] has quit [Ping timeout: 264 seconds]
15:14 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
15:32 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
15:45 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 276 seconds]
15:53 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
15:56 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html>
15:56 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
15:57 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:37 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
16:40 -!- luneff [~yury@84.51.201.56] has quit [Quit: Leaving]
17:09 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
17:21 -!- kav_ [~kav@g226090079.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
17:42 -!- pr0zoid [pr0zoid@24-246-5-196.cable.teksavvy.com] has quit []
17:48 -!- luneff [~yury@84.51.201.56] has joined #openvpn
18:02 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314-15.html#p15288>
18:08 < ecrist> jpalmer: re: your clients all being hospitals, we have vpns in to hospital LANs
18:11 < jeev> you all belong in pscyh. wards!
18:11 < ecrist> probably.
18:11 < ecrist> but I'd be managing the pace
18:11 < ecrist> place*
18:12 < jeev> or the most dangerous inmate
18:12 < ecrist> you know me better than I thought. ;)
18:12 < krzee> the most dangerous inmate generally manages things on the inside ;]
18:13 < |Mike|> aloaha mister ecrist and krzee 
18:14 < jeev> together in the mixxxxx
18:14 < krzee> buenas tardes
18:14 < ecrist> that's what I called the kid in high school with the big forehead
18:15 < krzee> "mister ecrist" ? ;]
18:16 < krzee> meh going over scripts i wrote a year ago and updating them to work in a new system i built (much better)  is not very fun
18:18 < |Mike|> krzee: just do whatever you have to do!
18:19 < ecrist> krzee: you using bsd on those new boxes?
18:19 < |Mike|> is that a Q?! lol
18:20 < ecrist> quadDama1e and I have been writing some zfs snapshot/replication/backup scripts we're going to release, hopefully by end of year
18:20 < ecrist> they're pretty sweet
18:36 -!- fsafsdafwea [80e30f46@gateway/web/freenode/ip.128.227.15.70] has joined #openvpn
18:37 < fsafsdafwea> Mind my username, but can anyone help me troubleshoot my OpenVPN connection? I get "Initialization Sequence Completed" but I cannot ping. Can anyone help?
18:39 < |Mike|> !tell fsafsdafwea logs
18:42 < krzee> ecrist, yes
18:43 < fsafsdafwea> |Mike|: server or client logs? (sorry im new)
18:43 < ecrist> fsafsdafwea: see /topic
18:43 < krzee> unless hardware support forces me into linux, i always use bsd
18:43 < ecrist> krzee: sweet.  we use close to 100% bsd
18:43 < fsafsdafwea> !welcome
18:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:43 < ecrist> a few exceptions are desktops
18:43 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has joined #openvpn
18:43 < krzee> if those are osx ill go with close enough ;]
18:44 < ecrist> a few are, about 5 windows 7 desktops
18:44 < ecrist> but oodles of freebsd everywhere else
18:44 < ecrist> FreeBSD jaguar-2.claimlynx.com 8.2-RELEASE FreeBSD 8.2-RELEASE #8: Sat Feb 26 21:23:00 CST 2011     root@jaguar-2.claimlynx.com:/usr/obj/usr/src/sys/GENERIC-CARP  amd64
18:44 < |Mike|> 8.2 ? lol
18:44 < ecrist> :)
18:44 < krzee> whats lol bout 8.2?
18:44 < |Mike|> I've a box running 4.7 :x
18:45  * |Mike| is a bit behind ;)
18:45 < krzee> 4.7 is lol on the other hand
18:45 < ecrist> heh, I have one running 4.11
18:45 < krzee> 4.11 is less lol than 4.7
18:45 < ecrist> indeed
18:45 < ecrist> our 4.11 box reached 1000+ days uptime at one point
18:45 < krzee> i loved 4 as well
18:45 < krzee> so much so that i never touched 5
18:46 < |Mike|> ecrist: but you're creating some kind of "generic" backup/snapshot/replication script?
18:46 < krzee> for zfs
18:46 < ecrist> specific to freebsd
18:46 < krzee> so not very generic
18:46 < |Mike|> ah okay!
18:46 < |Mike|> makes sence to me :)
18:46 < krzee> ecrist, it may work on solaris too!
18:46 < krzee> in fact linux even has a fuse zfs
18:46 < ecrist> works on any box *nix box with rsync, or anything with zfs
18:46 < ecrist> the zfs bits are SUPER sweet
18:47 < krzee> zfs is <3
18:47 < fsafsdafwea> |Mike|: this is copied from OpenVPN command line on client http://pastebin.com/mDPQamHB
18:47 < ecrist> we do snapshots, backup and replication on zfs boxes
18:47 < ecrist> backups only on rsync-only boxes
18:48 < ecrist> at some point, our stuff will be in ports tree
18:49 < |Mike|> Haven't worked with ZFS myself *yet*, but rsync <3
18:49 < ecrist> heh
18:49 < ecrist> rsync is total crap compared to zfs send|receive
18:50 < ecrist> obviously, the zfs stuff isn't near as granular as rsync, but still
18:50 < ecrist> for full-system backups and filesystem replication, fuck'n a
18:50 < |Mike|> My brain has been touched by Debian mind people last year. It needs some recovery ;)
18:50 < |Mike|> fsafsdafwea: lol, ,ind to run the client as asminist
18:50 < |Mike|> administrator*
18:50 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
18:55 -!- fsafsdafwea [80e30f46@gateway/web/freenode/ip.128.227.15.70] has quit [Ping timeout: 252 seconds]
18:56 -!- Squidy_at_Home [~quassel@189.75.75.132] has joined #openvpn
19:03 -!- joebobjoe [80e30f46@gateway/web/freenode/ip.128.227.15.70] has joined #openvpn
19:04 < joebobjoe> |Mike|:(you were just helping me) may i ask how to determine which network interface is connected to the internet? im running a VPS and there isnt a eth0 :(
19:04 < |Mike|> ifconfig ?
19:04 < |Mike|> 2011/09/05 01:50:31 < |Mike|> fsafsdafwea: lol, ,ind to run the client as asminist
19:05 < |Mike|> 2011/09/05 01:50:34 < |Mike|> administrator*
19:06 < joebobjoe> there is tun0-00 venet0-00 venet0:0-00 (those -00 are on the next line)
19:06 < joebobjoe> |Mike|: yea that was me
19:06 < joebobjoe> |Mike|: oh i may have been disconnected when i tested the vpn, yeah that worked thanks!!!
19:07 < |Mike|> problem solved?
19:07 < joebobjoe> |Mike|: now i just need to get the masquerading down so i can pass all traffic through VPN
19:08 < joebobjoe> |Mike|: i did the iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE i just dont know which interface to use (sorry for line spam)
19:08 < |Mike|> eth0...
19:08 < joebobjoe> |Mike|: there is no eth0
19:08 < |Mike|> You just told me ;)
19:08 < |Mike|> what IP's are attched to venet 0-00 and venet0:0-00 ?
19:08 < |Mike|> public/private ones is enough
19:09 < joebobjoe> |Mike|: there aint no IPs
19:10 < |Mike|> eh?
19:10 < joebobjoe> |Mike|: oh wait, there is one for venet0:0
19:10 < joebobjoe> |Mike|: its my public IP
19:11 < joebobjoe> there is none for venet0 though
19:11 < |Mike|> and you want to masquerade everything OVER your venet0:0 ? :-)
19:11 < |Mike|> over/towards
19:12 < joebobjoe> okay ill try that
19:13 < joebobjoe> |Mike|: do i have to restart server or iptables once i do iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
19:13 < joebobjoe> (with venet0:0 of course)
19:15 < joebobjoe> still not working
19:15 < joebobjoe> (i dont even know if im actually connected to this room or not)
19:15 < |Mike|> .
19:16 < |Mike|> 10.8.0.0/24 is your range?
19:16 < joebobjoe> |Mike|: if you replied to the do i have to restart i missed that cause i was on the vpn and had no internet connection
19:16 < joebobjoe> |Mike|: ill double check
19:16 < joebobjoe> |Mike|: yes
19:17 < joebobjoe> would it be bad if i ran the iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE with venet0 before and not venet0:0? or would venet0:0 overwrite?
19:17 < |Mike|> Hrm, you really don't know what you're doing? :x
19:18 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:19 < joebobjoe> |Mike|: no its been a while since ive set up a server; but ive never set up a vpn; i feel that im so close.... i can connect and ping, just internet traffic isnt routed correctly
19:20 < rommel092079> guys I forgot where I read about solving the communication issue i guess between two different version of openvpn. where is it again? i cant seem to find it again on openvpn.net. can someone kindly direct me to that reading.
19:20 < |Mike|> route www.google.com from your desktop (which is connected to the vpn ofc)
19:20 < |Mike|> traceroute*
19:20 -!- _julian [~quassel@hmbg-4d06b054.pool.mediaWays.net] has joined #openvpn
19:20 < joebobjoe> |Mike|: okay brb
19:20 < |Mike|> rommel092079: topic
19:20 -!- _julian_ [~quassel@hmbg-5f7630bd.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:21 < rommel092079> mike, can you direct me to that reading. I forgot where that is.
19:21 < |Mike|> probably on OpenVPN's mailinglists 
19:22 < |Mike|> (please use a search engine)
19:24 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:24 -!- joebobjoe [80e30f46@gateway/web/freenode/ip.128.227.15.70] has quit [Ping timeout: 252 seconds]
19:25 -!- joebobjoe [80e30f46@gateway/web/freenode/ip.128.227.15.70] has joined #openvpn
19:25 < joebobjoe> |Mike|: okay i tried to tracert google.com and 17.149.160.49 (apple.com) and nothing happens
19:26 < |Mike|> define nothing?
19:26 < |Mike|> DNS?! :)
19:26 -!- Squidy_at_Home [~quassel@189.75.75.132] has quit [Remote host closed the connection]
19:26 < |Mike|> could you ping x.x.x.x? (your openvpn server)
19:27 < joebobjoe> |Mike|: yes, ping about 100ms
19:27 < joebobjoe> pinged apple's IP to make sure it wasnt DNS
19:28 < |Mike|> IP worke but DNS failed?
19:28 < joebobjoe> |Mike|: apple.com IP did not work, only my server
19:29 < |Mike|> you push dns?
19:29 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:30 < rommel092079> guys currently the default for tcp-queue-limit is 64, up to what is the maximum value for tcp-queue-limit?
19:31 < joebobjoe> |Mike|: yes want to see my server config file?
19:31 < joebobjoe> again, i tried the IP address of apple.com and that still didnt work so i think its a routing issue i just have no clue where to start
19:33 < |Mike|> joebobjoe: yes, but I have to sleep now (02:30 am here in NL)
19:33 < |Mike|> others can help you tho.
19:33 < joebobjoe> |Mike|: do i just say, others help me! ???
19:33 < joebobjoe> thanks for all of your help
19:33 < joebobjoe> bu the way
19:35 < rommel092079> guys currently the default for tcp-queue-limit is 64, up to what is the maximum value for tcp-queue-limit?
19:38 -!- joebobjoe [80e30f46@gateway/web/freenode/ip.128.227.15.70] has quit [Ping timeout: 252 seconds]
19:45 -!- Ad0 [~ad0@callstack.info] has quit [Ping timeout: 252 seconds]
19:45 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:46 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
19:46 -!- Ad0 [~ad0@callstack.info] has joined #openvpn
19:48 < jpalmer> ecrist: we do too.   just not on the management network
19:48 < jpalmer> all of our servers make outbound connections to centralized openvpn servers.
19:50 -!- Denial [Denial@drgi.co.uk] has quit []
19:50 <@vpnHelper> RSS Update - forum: Pushing routes? <http://forums.openvpn.net/topic8736.html#p15289>
20:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
20:10 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
20:10 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:11 < Cr4zi3> Anyone able to point me to a decent howto for a basic setup ? I have bridging kind of working, but it lossing WAN route when I start openvpn and unable to communication w/ anything outside of the vpn server itself.
20:12 < Cr4zi3> CentOS 5.6 is the OS I'm testing on.. But can do any linux distro..
20:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:32 -!- saffx0F [~saff__@178.73.217.112] has joined #openvpn
20:37 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:56 < Bushmills> !howto
20:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:56 < Bushmills> !tunortap
20:56 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
20:56 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
20:57 < Bushmills> !route
20:57 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
21:01 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Read error: Connection reset by peer]
21:02 -!- chlappy [ae76d7e4@gateway/web/freenode/ip.174.118.215.228] has joined #openvpn
21:02 < chlappy> howdy
21:02 < chlappy> !goal
21:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:03 < chlappy> !welcome
21:03 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:03 < chlappy> !configs
21:03 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
21:03 < chlappy> okay, well here i go
21:06 < chlappy> I am able to connect to an openvpn that I setup at my parents place today from home.  When I connect I get an ip but then I'm stuck.  It doesn't seem to serve a gateway and no other ip's on the vpn subnet (192.168.70.0) are pingable other than the one I'm served
21:07 < chlappy> and to start off, this is openvpn that is embedded into a dd-wrt router, so I'm not sure if that is even supported here
21:09 < chlappy> server config: http://pastebin.com/jXAEG08N
21:09 < Cr4zi3> Bushmills; Thnx..
21:10 < Bushmills> !redirect
21:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
21:14 < Bushmills> not being able to ping:  firewalls on server+clients, and missing ip forwarding on server, or firewalls on clients and missing client-to-client in server config
21:15 < Bushmills> ehm, scratch ip forwarding
21:15 < chlappy> hrm
21:16 < chlappy> just a note, i followed this: http://www.dd-wrt.com/wiki/index.php/VPN_%28the_easy_way%29_v24%2B to a T
21:16 <@vpnHelper> Title: VPN (the easy way) v24+ - DD-WRT Wiki (at www.dd-wrt.com)
21:16 < Bushmills> sorry, i'm not going to review that document now
21:16 < chlappy> understood
21:17 < Bushmills> !howto
21:17 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:17 < chlappy> I'll do some more reading.  Aside from the openvpn website, are there other docs, sites you'd recommend?
21:17 < chlappy> thanks
21:18 < Bushmills> !route
21:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
21:18 < chlappy> I'll read up and get some good info going.  My parents place is about an hour and a half away so I might as well get it fully figured out before i head out again
21:19 < chlappy> I was debating just picking up another cisco 1600 and just doing it the cisco way, but that is the easy, albeit more expensive way out. i'd rather just tackle.  thanks for the answers and patience Bushmills
21:19 < Bushmills> scratch !redirect,  your "doesn't seem to serve as gateway" suggested you wanted to do that
21:20 < chlappy> my end goal is just two have the two internal networks accessible to eachother.  I don't need to use one or the other's route to the net, just want to be able to admin things interally
21:20 < chlappy> internally*
21:21 < Bushmills> right.  !route,  tun based.  that's about it.
21:22 < chlappy> thanks
21:22 < chlappy> judging by the config file you did see and that I am able to connect, do you see any way it could be salvagable without me making the trip?
21:23 < Bushmills> as you seem to be able to connect, you can ssh to remote and do configuration remotely, unless you mess it up such that you can't access it any longer
21:25 < chlappy> crap, i should have enabled ssh or telnet on the router before i left.  I've been trying to access the web portal to make conf changes.  thanks a lot for the link, it already makes a LOT more sense.  I'll continue reading and form a game plan for next time
21:25 < Bushmills> if dd-wrt uses uci based config, you're better set it up for custom config instead
21:25 < Bushmills> ("it" meaning openvpn)
21:30 < chlappy> i'll read up on the custom configs as well
21:30 < chlappy> thanks again bushmills
21:50 < chlappy> hey bushmills can you take a look at this route output from the router on my end?
21:50 < chlappy> http://pastebin.com/DcR9zfYV
21:50 < chlappy> what i don't understand, the other side's route is in the routing table. is it just openvpn that is not doing the forwarding?
21:53 < Bushmills> use mtr or traceroute to figure that out
21:55 < chlappy> okies
21:56 < chlappy> thanks again for the help, i'm shelving this until i can make the trip east
21:59 -!- chlappy [ae76d7e4@gateway/web/freenode/ip.174.118.215.228] has quit [Quit: Page closed]
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 265 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:37 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:49 < krzie> [22:27]  <Bushmills> if dd-wrt uses uci based config, you're better set it up for custom config instead
22:49 < krzie> so so true
22:50 < krzie> uci config couldnt do some things, i was thinking maybe they were compiled out, but turns out i just needed a normal ovpn config instead
22:55 < krzie> Bushmills, are you any good with uci config for the firewall?  i have 3 commands that i would like to change to uci instead of iptables commands... reason being that if a device is trying to talk through the vpn while the router is booted, the router gets packets before the firewall.user script is run, and this results in the traffic being NAT'ed as eth0 instead of tun0 until the session is re-started (in openvpn this leads to that mysterio
22:55 < krzie> us MULTI error where the clients own eth ip is being used over the tun interface)
22:56 < krzie> but the uci setup is not very intuitive
23:02 -!- kbarry [~chatzilla@adsl-69-106-238-173.dsl.pltn13.pacbell.net] has joined #openvpn
23:03 < kbarry> Looking for a recommendation for a DDWRT-capable Device for a home installation of 
23:03 < kbarry> openvpn
23:04 < kbarry> Would it be possible for me to configure a device in one location then send it to be plugged in remotely?
23:06 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:07 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 268 seconds]
23:13 < kbarry> are certificates required?
23:14 < kbarry> I'm reading a tutorial (http://www.howtogeek.com/64433/how-to-install-and-configure-openvpn-on-your-dd-wrt-router/_ and it says :
23:14 < kbarry> Now that you have OpenVPN installed on your computer, we have to start creating the certificates and keys to authenticate devices.
23:16 < EugeneKay> kbarry - I don't know heads or tails about which DD-WRT is best for OpenVPN. Every time someobdy asks, I recommend they ask a dd-wrt knowitall
23:16 < EugeneKay> As for setup, you should be able to set the LAN stuff(and openvpn config) up statically, and send it off to be plugged in.
23:16 < EugeneKay> So long as you can get to the WAN address, ought not to be a problem
23:17 < EugeneKay> As for OpenVPN itself, the usual way to set stuff up is with X.509 PKI (certificate) system, yes.
23:17 < kbarry> by WAN address, you mean the Static IP provided by the ISP on the other side?
23:17 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:17 < EugeneKay> Right
23:17 < kbarry> I'm just a little confused where in the chain of devices this thing sits? Is it 
23:17 < EugeneKay> Depends upon your network, really.
23:17 < kbarry> Computer, Router, Modem, ISP
23:18 < kbarry> or computer, Modem Router ISP
23:18 < EugeneKay> Most DSL/cable modems operate in a bridging mode, presenting a ATM over Ethernet to the router's WAN port, which msut then be configured with a PPPoE session into the ISP.
23:18 < kbarry> i guess that on the client i would enter the Static IP Address, and the client software can find the openvpn server /router?
23:19 < EugeneKay> I'm lucky enough not to have PPP on my DSL, so I just have a straight ATM bridging setup on my modem into my home fileserver.
23:19 < kbarry> ppp and ATM?
23:19 < EugeneKay> Exactly. ;-)
23:19 < kbarry> gimme a sec to google those.
23:19 < kbarry> :)
23:19 < EugeneKay> It's a bit to figure out :-p
23:20 < EugeneKay> The tl;dr version is that the router gets the outside IP setup on it, and then handles all the LAN services(nat, dhcp, dns, etc), and, if you're doing openvpn, it'll do openvpn(duh)
23:20 < EugeneKay> Doesn't really matter if the WAN IP is static or dynamic, other than if you have to keep track of it changing.
23:21 < kbarry> wait, if the ip isnt static,
23:21 < kbarry> How will the client connect to the host if it changes?
23:21 < EugeneKay> Magic ;-)
23:22 < kbarry> ???
23:22 < EugeneKay> The usual answer is that the modem will check in with an external dynamic DNS service periodically.
23:22 < EugeneKay> Er, router, not modem.
23:23 < kbarry> what about the client, i mean
23:23 < EugeneKay> It connects to the dynamic DNS name, rather than by IP
23:23 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
23:23 < kbarry> i didn't realize you could have a DNS name without a fee.
23:23 < kbarry> Or maybe you are saying, i need to get a domain, to use for this.
23:23 < EugeneKay> Sure. All sorts of dynamic dns services will do it for ya
23:24 < kbarry> This, if you can't tell, is a bit on the advanced side
23:24 < EugeneKay> Google for "dynamic dns". Poke through the first coupla results, you'll find one that works with dd-wrt
23:25 < kbarry> well
23:25 < kbarry> i don
23:25 < kbarry> i don't need something like this if my isp provides me with a static ip.
23:25 < EugeneKay> Nope.
23:27 < kbarry> ok, let me see if i have this. using a dynamic DNS service, I can setup the router to, periodcally communicate with the dns, telling it what its information is. So if things chance, the device will contact the dns, and upate its information automatically.
23:28 < EugeneKay> Right.
23:28 < EugeneKay> That's the easy part.
23:31 < kbarry> So, When you mentiond a bridge
23:31 -!- diytto [~diytto@2001:470:26:59c::a441] has quit [Ping timeout: 255 seconds]
23:31 < kbarry> You are saying
23:32 < kbarry> The Modem is barely doing anything, just passing everything on to some other device to handle all the ancy stuff
23:32 -!- saffx0F [~saff__@178.73.217.112] has quit [Ping timeout: 240 seconds]
23:32 < kbarry> either a computer, or a router
23:32 < kbarry> or whatever is after the modem
23:32 -!- saffx0F [~saff__@EM1-113-2-254.pool.e-mobile.ne.jp] has joined #openvpn
23:32 < kbarry> so, if my modem performs DHCP, what will i need to do in order?
23:32 -!- saffx0F [~saff__@EM1-113-2-254.pool.e-mobile.ne.jp] has quit [Remote host closed the connection]
23:32 < EugeneKay> Right. Essentially making a really long ethernet cable that runs over DSL via phone lines.
23:33 < kbarry> yeah, i use a sonicwall now, but that was setup by someone else
23:33 < kbarry> the concept, i get it to some degree
23:33 < kbarry> what it confusing me is, how can a device thats sitting behind the modem
23:33 < kbarry> be "seen" so to speak,
23:33 < kbarry> by the client outthere on the internet
23:33 < EugeneKay> Well, if the modem is doing the handlign of IP, it can't.
23:34 < EugeneKay> Because it's handling NAT
23:34 < kbarry> Network Address Translation?
23:34 < EugeneKay> Indeed.
23:35 < EugeneKay> LAN address(192.168.x.x) on one side, WAN(public IP, eg 74.50.255.39) on the other.
23:35 < kbarry> So, the VPN device needs to be "outward facing"
23:35 < EugeneKay> Ought to be, yes.
23:35 < kbarry> I am assuming its possible to have the device behind the modem.
23:35 < kbarry> But still be "outward facing"
23:35 < EugeneKay> You can do port forwarding and routing magic, but it's really SO much easier to switch the modem into bridging mode
23:35 < kbarry> By, say, port forwarding?
23:36 < EugeneKay> Or, the sane way, change the modem from NATing to Bridging ;-)
23:36 < kbarry> And let me see if i get this
23:36 < kbarry> The modem essentually passes everything to the router
23:36 < kbarry> The router would need to be set to the IP Provided by the ISP, (DHCP or NOT)
23:37 < EugeneKay> Mm-hmm.
23:37 < kbarry> And that IP Address would be the address that the client would need in order to connect.
23:37 < kbarry> Port forwarding, howeer,
23:37 < EugeneKay> Still right.
23:37 < kbarry> can be used
23:37 < kbarry> where the modem passes certain traffic strait to the router
23:38 < kbarry> like, the openvpn client always uses port 666 (making it up)
23:38 < kbarry> so the modem forward port 666 to the router behind it
23:38 < kbarry> ?
23:38 < EugeneKay> Sure.
23:40 < kbarry> EugeneKay
23:40 < kbarry> Thanks for the help. I'm less of a noob because of you.
23:41 < EugeneKay> Good. I fucking hate n00bs.
23:42 < kbarry> hahaha
23:42 < kbarry> I was telling my business partner about opeVPN
23:42 < kbarry> and getting advice and help on IRC
23:42 < kbarry> him: "IRC?"
23:43 < kbarry> Yeah, the place where the nerds of the world hang out.
23:58 -!- EugeneKay is now known as EugeneKaway
--- Day changed Mon Sep 05 2011
00:01 < kbarry> EugeneKaway Are you familir with tomato?
00:06 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
00:07 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:10 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
00:23 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
00:24 -!- Ionic [ionic@ionic.de] has joined #openvpn
00:39 -!- kbarry [~chatzilla@adsl-69-106-238-173.dsl.pltn13.pacbell.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
00:43 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html#p15290>
01:12 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:43 -!- kav_ [~kav@g226091215.adsl.alicedsl.de] has joined #openvpn
01:45 -!- jbb [~yeeb@184.105.219.149] has quit [Quit: No Ping reply in 180 seconds.]
01:49 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
01:49 <@vpnHelper> RSS Update - forum: OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15292>
01:51 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
01:56 <@vpnHelper> RSS Update - forum: [ask]http-proxy-option <http://forums.openvpn.net/topic8748.html>
02:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:06 -!- mode/#openvpn [+o mattock] by ChanServ
02:07 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 260 seconds]
02:13 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
02:13 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:13 -!- mode/#openvpn [+o mattock] by ChanServ
02:14 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
02:18 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:18 -!- mode/#openvpn [+o mattock] by ChanServ
02:27 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 264 seconds]
02:31 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
02:36 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html#p15294>
03:00 <@vpnHelper> RSS Update - forum: OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8686.html#p15297> || [ask]http-proxy-option <http://forums.openvpn.net/topic8748.html#p15296> || OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15295>
03:07 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
03:08 -!- mode/#openvpn [+o dazo_afk] by ChanServ
03:09 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
03:10 -!- dazo_afk is now known as dazo
03:17 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 240 seconds]
03:17 <@vpnHelper> RSS Update - forum: Fix IP with ifconfig-push <http://forums.openvpn.net/topic8742.html#p15299> || Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15298>
03:18 < Kartagis> hi
03:18 < Kartagis> I get logs such as http://pastebin.com/gW5kN2m4. any ideas?
03:19 -!- Slashman [~Slash@hydra.fimasys.com] has quit [Ping timeout: 258 seconds]
03:20 < krzie> !tcp
03:20 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
03:21 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
03:22 < Kartagis> krzee: hm. do I need to use UDP?
03:22 < krzie> can you?
03:28 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html#p15300>
03:33 < Kartagis> yes
03:33 < Kartagis> I mean in order not to get these
03:36 < hyper_ch> hi krzie
04:00 < krzie> hey hyper
04:00 -!- luneff [~yury@84.51.201.56] has quit [Ping timeout: 240 seconds]
04:02 < hyper_ch> krzie: you're a hardware guru?
04:09 < krzie> not especially
04:10 < hyper_ch> I've seen that wireless samsung monitor now with 2x usb2 and 2xusb3 and wifi/ethernet capabilities
04:10 < krzie> you could try your more specific question if you want tho
04:10 < hyper_ch> it seems like a good "docking station" but I wonder, what speeds would one get on that wireless uwb connection
04:10 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 276 seconds]
04:10 < krzie> a monitor which is a wireless device?
04:10 < krzie> heh
04:10 < krzie> ya i never heard of it
04:11 < hyper_ch> google for  C24A650X
04:11 -!- darkdrgn2k4 [~darkdrgn2@199.243.221.14] has joined #openvpn
04:11 < hyper_ch> http://www.samsung.com/at/consumer/computer-peripherals/monitor/hub-monitors/LC24A650XS/EN/index.idx?pagetype=prd_detail
04:11 <@vpnHelper> Title: 24'' Kontrast: 3.000:1 - C24A650X - Hub-Monitore - Monitore | SAMSUNG (at www.samsung.com)
04:12 -!- kav_ is now known as k4v
04:13 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
04:15 -!- darkdrgn2k3 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Ping timeout: 264 seconds]
04:32 <@vpnHelper> RSS Update - forum: OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15302>
04:50 <@vpnHelper> RSS Update - forum: OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15303>
04:56 <@vpnHelper> RSS Update - forum: best way to give clients different route settings? <http://forums.openvpn.net/topic8749.html> || OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15304>
05:00 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
05:02 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 260 seconds]
05:02 <@vpnHelper> RSS Update - forum: best way to give clients different route settings? <http://forums.openvpn.net/topic8749.html#p15306>
05:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
05:03 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
05:08 <@vpnHelper> RSS Update - forum: OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15307>
05:11 -!- luneff [~yury@188.114.46.91] has joined #openvpn
05:14 <@vpnHelper> RSS Update - forum: route traffic through vpn [reloaded] <http://forums.openvpn.net/topic8750.html>
05:15 -!- Slashman [~Slash@hydra.fimasys.com] has joined #openvpn
06:16 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:21 <@vpnHelper> RSS Update - forum: best way to give clients different route settings? <http://forums.openvpn.net/topic8749.html#p15309>
06:31 -!- jbb [~yeeb@184.105.219.149] has quit [Quit: No Ping reply in 180 seconds.]
06:31 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
06:36 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
06:36 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
06:39 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html#p15310>
06:41 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 258 seconds]
--- Log closed Mon Sep 05 06:46:48 2011
--- Log opened Mon Sep 05 06:47:54 2011
06:47 -!- ecrist_ [~ecrist@216.17.68.153] has joined #openvpn
06:47 -!- Irssi: #openvpn: Total of 155 nicks [5 ops, 0 halfops, 1 voices, 149 normal]
06:48 -!- Irssi: Join to #openvpn was synced in 34 secs
06:48 -!- ecrist [~ecrist@openvpn/community/support/ecrist] has quit [Ping timeout: 260 seconds]
06:57 <@vpnHelper> RSS Update - forum: OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15312> || Can ping, but cannot route web traffic through VPN <http://forums.openvpn.net/topic8618.html#p15311>
07:12 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
07:15 -!- k4v [~kav@g226091215.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
07:27 <@vpnHelper> RSS Update - forum: OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15318> || Installing OpenVPn on MAC 10.6 <http://forums.openvpn.net/topic8728.html#p15317> || Learning to programme OpenVPN <http://forums.openvpn.net/topic8724.html#p15316> || Firewall forwarding problem with OpenVPN...I guess ! <http://forums.openvpn.net/topic8718.html#p15315> || Linux Command Line Client Issues <http://forums.
07:29 -!- luneff [~yury@188.114.46.91] has quit [Quit: Leaving]
07:33 <@vpnHelper> RSS Update - forum: Learning to programme OpenVPN <http://forums.openvpn.net/topic8724.html#p15320> || tethering for unlimited data with Verizon <http://forums.openvpn.net/topic8570.html#p15319>
07:33 -!- novaflash [~notme@openvpn/user/novaflash] has quit []
07:37 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
07:37 -!- mode/#openvpn [+v novaflash] by ChanServ
07:39 <@vpnHelper> RSS Update - forum: Issue maybe <http://forums.openvpn.net/topic8752.html> || route traffic through vpn [reloaded] <http://forums.openvpn.net/topic8750.html#p15322> || OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15321> || [Split] OpenVPN Client connected but not working win 7 <http://forums.openvpn.net/topic8751.html#p15297>
07:40 -!- k4v [~kav@g226091215.adsl.alicedsl.de] has joined #openvpn
07:49 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:08 -!- luneff [~yury@188.114.46.91] has joined #openvpn
08:15 <@vpnHelper> RSS Update - forum: route traffic through vpn [reloaded] <http://forums.openvpn.net/topic8750.html#p15325> || OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15324>
08:17 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:18 -!- michl [~moros@dslb-084-056-069-111.pools.arcor-ip.net] has joined #openvpn
08:22 -!- ITkoto [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has joined #openvpn
08:24 < ITkoto> does tweaking sysctl.conf improve network connection
08:26 < |Mike|> connectivity you mean?
08:26 <@vpnHelper> RSS Update - forum: Installing OpenVPn on MAC 10.6 <http://forums.openvpn.net/topic8728.html#p15326>
08:27 < ITkoto> network speed. I have read articles http://datatag.web.cern.ch/datatag/howto/tcp.html
08:27 < ITkoto> http://perfector.wordpress.com/2008/04/23/tweak-kernel-variables-in-sysctlconf/
08:27 <@vpnHelper> Title: How to achieve Gigabit speeds with Linux (at datatag.web.cern.ch)
08:27 <@vpnHelper> Title: Tweak kernel variables in sysctl.conf « Overtone (at perfector.wordpress.com)
08:28 < |Mike|> !tunortap
08:28 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
08:28 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
08:28 < |Mike|> why are you using tcp? ;)
08:28 < ITkoto> tcp and udp
08:34 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:34 -!- mode/#openvpn [+v Axeman] by ChanServ
08:36 -!- ITkoto [~genlime@71-94-146-82.static.mtpk.ca.charter.com] has quit []
08:52 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:52 -!- mode/#openvpn [+v s7r] by ChanServ
08:53 -!- learn_more [~learn_mor@ip5650328e.direct-adsl.nl] has joined #openvpn
08:53 < learn_more> !welcome
08:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:53 < learn_more> !howto
08:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:54 < learn_more> how can i configure my openvpn (client) to not tunnel all connections from my pc, but only specific applications?
08:54 < learn_more> win 7
08:57 -!- spitfire [~quassel@89.200.144.70] has joined #openvpn
08:57 -!- spitfire_ [~quassel@89.200.144.70] has quit [Ping timeout: 240 seconds]
09:00 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
09:01 -!- Ionic [ionic@ionic.de] has joined #openvpn
09:03 -!- master_of_master [~master_of@p57B55CC9.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
09:04 <+s7r> learn_more: you can not
09:04 <+s7r> you need a socks server or tunnel to do that
09:04 <+s7r> and put the tunnel like socks protocol address in the application which you want
09:05 <+s7r> openvpn will modify your routing table and all your internet traffic from all applications will be routed through that vpn
09:05 -!- master_of_master [~master_of@p57B5483D.dip.t-dialin.net] has joined #openvpn
09:05 < krzie> !routebyapp
09:05 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
09:05 < krzie> like that ^
09:06 <+s7r> !sockd
09:06 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
09:06 <+s7r> ahh sockd is too complicated
09:06 <+s7r> a ssh tunnel -D 
09:06 <+s7r> would be easier
09:08 < learn_more> yeah but i dont own the remote server
09:08 < learn_more> :)
09:08 <@vpnHelper> RSS Update - forum: route traffic through vpn [reloaded] <http://forums.openvpn.net/topic8750.html#p15328> || OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15327>
09:09 < learn_more> thanks for your help :)
09:10 < krzie> s7r, ssh tunnels only do tcp
09:11 <+s7r> and socksd does udp also ?
09:11 < krzie> mine does...
09:11 < krzie> that sockd.conf does
09:11 < krzie> thats the "udpassociate" in the config
09:11 <+s7r> yeah this would be an advantage... but for 
09:11 <+s7r> simple web browsing 
09:11 <+s7r> ssh tunnel will do in most cases
09:12 < krzie> sure
09:22 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
09:23 < learn_more> its not for web browsing
09:23 < learn_more> its for an udp game
09:23 < |Mike|> DDos? lol
09:23 < Bushmills> krzie: nope, /me not good with uci configs
09:24 -!- learn_more [~learn_mor@ip5650328e.direct-adsl.nl] has quit []
09:25 < Bushmills> but i suppose it shouldn't be too difficult to set chain policy to DROP or DENY in uci config, add rules in user config, and then policies  from user config to ACCEPT
09:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:25 -!- mode/#openvpn [+v Axeman] by ChanServ
09:36 -!- sigius [~sigius@93.125.185.45] has quit [Read error: Operation timed out]
09:47 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:50 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
10:01 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
10:08 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:10 -!- dazo is now known as dazo_afk
10:13 -!- michl [~moros@dslb-084-056-069-111.pools.arcor-ip.net] has quit [Quit: Verlassend]
10:15 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
10:15 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:16 -!- caemir [~caemir@unaffiliated/caemir] has quit [Remote host closed the connection]
10:16 -!- onryo [~onryo@67-231-254-56.STATIC.turnkeyinternet.net] has joined #openvpn
10:16 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:19 < onryo> Hi guys. I am using a vpn provider called HMA. On Debian 6. I downloaded openvpn and everything works. The problem that my vpn drops out now and then and I would like to set up iptables to make sure nothing leaks if I get dropped. 
10:19 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:20 < onryo> Everything I have tried with iptables had just blocked my vpn 100%. Anybody have a clue how I can "bind" using iptables?
10:21 < onryo> In short. I have openvpn it tunnels my traffic to hma. My IP is the one to the hma server.
10:22 < onryo> vpn cuts now and then and my real IP exposed. 
10:23 < onryo> A point in the right direction would be much appreciated 
10:23 < Bushmills> onryo: block all outgoing except traffic to openvpn server public address, destination port where openvpn server listens to.
10:23 < Bushmills> of course allow outgoing traffic to tun device 
10:24 < onryo> Bushmills I have tied something like that but it does not work. Ill put a link up on pastebin. Maybe you can see what I am doing wrong?
10:24 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
10:24 < Bushmills> try exactly that then·instead of something like that
10:25 < Bushmills> you took care of client able to reach a name server, i suppose?
10:29 < onryo> Bushmills or anybody who would know. Whats wrong with this http://pastebin.com/kVx3r03p
10:30 < onryo> Bushmills "took care of client"? If you mean does the vpn work without iptables then yes it does.
10:31 < Bushmills> "...of client able to reach a name server"
10:31 < Bushmills> how does your problem actually manifest?  other than "blocked my vpn 100%" i mean
10:34 < onryo> Bushmills well I start my vpn connection up and everything is fine. I tunnel my traffic to HMA. If I try do do this with the IPT everything gets blocked
10:36 < Bushmills> nowhere do i see where you allow traffic to server to the openvpn port only. you also didn't give a clue, neither in chat nor in iptables rules whether your vpn uses tcp or udp tunnel. if udp, rework the conntrack stuff. udp is stateless. 
10:37 < Bushmills> but i suppose you want to avoid client sending to server on any non-openvpn port. that would, in my eyes, qualify as "leaking"
10:38 < Bushmills> well, when you got around trying what i suggested above, let me know how that's working for you
10:40 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:41 < onryo> Bushmills I would guess it is a TCP pipe c
10:41 < Bushmills> !tcp
10:41 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
10:41 < onryo> since it is blowfish 
10:41 < Bushmills> inconclusive
10:41 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 258 seconds]
10:41 < onryo> but in that pipe I have both udp and tcp
10:41 < Bushmills> blowfish is a cipher, not a protocol
10:42 < onryo> I got wireshark open..one sec
10:42 < Bushmills> you don't know your config well enough to tell?
10:43 < onryo> Just see ssl tcp
10:43 < onryo> that is in wireshark
10:43 < Bushmills> any specific reason for chosing tcp?
10:43 < onryo> and I can see my IP to and the one I am hooked up too with the vpn server
10:44 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
10:44 < onryo> thats what they gave me ....
10:44 < Bushmills> you're not running the server?
10:45 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
10:45 < onryo> No I am a client and my vpn provider in is the USA. 
10:46 < onryo> but when I get dropped my IP and traffic can be seen by my ISP here in Germany
10:46  * Bushmills wonders why bothering about security when the endpoint is outside of ones control anyway 
10:46 <@vpnHelper> RSS Update - forum: Please Help!!!! Give Client His Own IP <http://forums.openvpn.net/topic8753.html>
10:47 -!- krackpot [~krackpot@S0106000c42a9996c.vc.shawcable.net] has quit [Quit: *bzzt!*]
10:47 < onryo> Bushmills because I am a journalist and would like to keep my identity private here in Germany
10:48 < onryo> In the US you have freedom of speech.
10:48 < onryo> More or less 
10:49 < onryo> Also I am in China a lot
10:49 < onryo> and I trust the US when it comes to writing about human rights in China.
10:50 < Bushmills> you'd be most likely better off had your provider offered you connecting to server using udp
10:50 < onryo> Bushmills, I at times run Tor though a VPN since Tor is blocked in China if your not using bridges.
10:50 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
10:51 -!- mape2k [~mape2k@2a01:198:23f:10ff:505a:78ff:fe88:2006] has joined #openvpn
10:51 < onryo> Bushmills, could it be that they need TCP for the SSL control channel? idk?
10:52 < Bushmills> regardless, the rules can be much simpler.  ignoring inbound and LAN for now, all you really need is block all except destination server port openvpn.  no conntracking.
10:52 < Bushmills> block all outgoing, that is
10:52 < Bushmills> no
10:53 < Bushmills> openvpn works just as fine - better actually when you're also tunneling tcp traffic - using an udp tunnel
10:55 -!- krackpot [~krackpot@S0106000c42a9996c.vc.shawcable.net] has joined #openvpn
10:56 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 246 seconds]
10:56 < onryo> -s7r- was looking at them 
10:56 < Bushmills> meaning?
10:57 < onryo> Bushmills I just got a link to www.sky-ip.org and took a look at them. Booked marked them too.
10:58 < onryo> ok guys I got to figure something out for them "ip" binding thing here. Thx for the help 
10:59 -!- onryo [~onryo@67-231-254-56.STATIC.turnkeyinternet.net] has left #openvpn ["Leaving"]
11:02 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
11:05 -!- jbb [~yeeb@184.105.219.149] has quit [Read error: Connection reset by peer]
11:08 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
11:12 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
11:14 -!- kanebo [~name@213.229.110.97] has joined #openvpn
11:14 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
11:15 < kanebo> Hello, sorry for my English. I am using OpenVPN portable. Cannot put more than 50 servers in the list. Do you know if is it possible?
11:18 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 276 seconds]
11:19 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
11:22 -!- EugeneKaway is now known as EugeneKay
11:24 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 276 seconds]
11:25 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
11:27 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
11:30 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
11:31 -!- datruth [datruth@gotpot.org] has joined #openvpn
11:31 < datruth> !openvpn-down-root
11:33 < datruth> anyone know how to use this plugin with update-resolv-conf script?
11:35 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 258 seconds]
11:35 < datruth> !root
11:36 < |Mike|> ....
11:37 < |Mike|> http://www.subvs.co.uk/openvpn_resolvconf
11:37 <@vpnHelper> Title: openvpn and resolv.conf | SubVS.co.uk (at www.subvs.co.uk)
11:37 < datruth> thx
11:39 < datruth> Hrmm that doesn't have information about root privillages 
11:44 < EugeneKay> GOOD MORNING OPEN VEE PEE ENN
11:45 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
11:45 < |Mike|> ohai EK!
11:46 < |Mike|> datruth: define "root privileges"
11:50 <@vpnHelper> RSS Update - forum: OpenVPN - does not work login with a password ... <http://forums.openvpn.net/topic8747.html#p15330>
11:50 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 260 seconds]
11:50 < EugeneKay> Morning.
11:53 -!- mape2k [~mape2k@2a01:198:23f:10ff:505a:78ff:fe88:2006] has quit [Ping timeout: 255 seconds]
12:04 -!- onryo [~onryo@67-231-254-56.STATIC.turnkeyinternet.net] has joined #openvpn
12:04 -!- k4v [~kav@g226091215.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
12:05 < onryo> looking in wireshark at tun0 the packets are not encrypted. Is there normal. What is going in and out of eth0 is encrypted...
12:05 < onryo> Is this*
12:13 < EugeneKay> That is by design, yes....
12:13 < EugeneKay> Where else would you suggest that OpenVPN encrypt packets, if not between it's virtual interface and the physical interface it's outputting packets through? 
12:16 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
12:23 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
12:28 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 252 seconds]
12:28 < krzie> [11:51]  <kanebo> Hello, sorry for my English. I am using OpenVPN portable. Cannot put more than 50 servers in the list. Do you know if is it possible?
12:28 < krzie> kanebo, you can use round robin dns on any of those server hostnames
12:28 < krzie> so if you have 50 servers right now and you want 200, give each vpn server hostname 4 ips
12:28 < hyper_ch> hi krzie
12:28 < krzie> also, openvpn portable is not up to date, and it is modified from the original openvpn, for your info
12:29 < krzie> its not developed by the openvpn team
12:29 < krzie> hey hyper
12:29 -!- spitfire [~quassel@89.200.144.70] has quit [Disconnected by services]
12:30 -!- spitfire [~quassel@89.200.144.70] has joined #openvpn
12:30 < hyper_ch> krzie: anything exciting in your end of the world happening?
12:31 < krzie> was just hookin up with the sexy lil neighbor... if that counts
12:32 < hyper_ch> neighbor or neighbouress?
12:33 < krzie> well in english the word neighbor is asexual... but female (thats all i like)
12:33 < hyper_ch> you hook up with a sexy asexual person living close to you?
12:33 < krzie> i didnt hook up with a word
12:34 < hyper_ch> that's good... for a moment I was worried there
12:34 < krzie> sorry to worry you :-p
12:34 < hyper_ch> well, I won't hinder you then from hooking up
12:34 < hyper_ch> have fun
12:35 -!- onryo [~onryo@67-231-254-56.STATIC.turnkeyinternet.net] has quit [Ping timeout: 264 seconds]
12:36 -!- onryo [~onryo@67-231-254-56.STATIC.turnkeyinternet.net] has joined #openvpn
12:37 < krzie> nah shes gone now
12:38 < krzie> her dude is on his lunch break o_O
12:38 -!- mape2k [~mape2k@erft-5d80a211.pool.mediaWays.net] has joined #openvpn
12:39 < krzie> yes i know, im a bad bad man :-p
12:41 < jeev> haha he's gonna come kick your ass for messing with his obese girlfriend
12:44 <@vpnHelper> RSS Update - forum: How-to: Tunnel WAN IP assigned to specific users <http://forums.openvpn.net/topic8559.html#p15331>
12:44 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:45 < jeev> i knew it
12:45 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
12:48 -!- radioxid [~radioxid@92.90.16.170] has joined #openvpn
12:51 -!- kanebo [~name@213.229.110.97] has quit [Quit: Leaving]
12:52 -!- onryo [~onryo@67-231-254-56.STATIC.turnkeyinternet.net] has quit [Ping timeout: 258 seconds]
12:52 -!- radioxid [~radioxid@92.90.16.170] has quit [Client Quit]
12:53 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
12:57 -!- radioxid [~radioxid@92.90.16.170] has joined #openvpn
12:58 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 250 seconds]
12:59 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:00 -!- luneff [~yury@188.114.46.91] has quit [Quit: This computer has gone to sleep]
13:01 -!- albech [~thomas@61.7.177.150] has joined #openvpn
13:02 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
13:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:04 -!- radioxid [~radioxid@92.90.16.170] has left #openvpn []
13:07 -!- mape2k [~mape2k@erft-5d80a211.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
13:08 -!- onryo [~onryo@67-231-254-33.STATIC.turnkeyinternet.net] has joined #openvpn
13:09 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
13:10 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
13:13 -!- onryo [~onryo@67-231-254-33.STATIC.turnkeyinternet.net] has quit [Ping timeout: 260 seconds]
13:15 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 258 seconds]
13:25 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
13:29 -!- jbb [~yeeb@184.105.219.149] has quit [Ping timeout: 252 seconds]
13:30 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
13:31 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
13:37 -!- luneff [~yury@84.51.201.56] has joined #openvpn
13:41 -!- spitfire [~quassel@89.200.144.70] has quit [Disconnected by services]
13:42 -!- spitfire_ [~quassel@89.200.144.70] has joined #openvpn
13:42 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
13:43 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:45 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
13:46 -!- jbb [~yeeb@184.105.219.149] has quit [Read error: Connection reset by peer]
13:46 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
14:13 -!- spitfire_ [~quassel@89.200.144.70] has quit [Ping timeout: 258 seconds]
14:20 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
14:22 -!- hq320 [~ident@113.49.191.90.dyn.estpak.ee] has joined #openvpn
14:22 < hq320> !configs
14:22 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
14:23 < hq320> !welcome
14:23 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:23 < hq320> !howto
14:23 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:25 < hq320> hello
14:25 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
14:25 -!- albech [~thomas@61.7.177.150] has quit [Quit: Ex-Chat]
14:28 -!- Ionic [ionic@ionic.de] has joined #openvpn
14:59 -!- sheik [enum@unaffiliated/sheik] has joined #openvpn
14:59 <@vpnHelper> RSS Update - forum: Please Help!!!! Give Client His Own IP <http://forums.openvpn.net/topic8753.html#p15332>
15:00 < sheik> Has anyone experience setting up openvpn on openbsd? I have it set up to the point where a client can connect and ping the gateway, but there is not NATing happening
15:38 < EugeneKay> If it was linux, I would say that you need to enable forwarding in the kernel.
15:38 < EugeneKay> But that's not an openvpn problem so much as a NAT problem, now is it ;-)
15:39 < reiffert> !factoids search --values bsdnat
15:39 <@vpnHelper> 'freebsdnat', 'bsdnat', and 'nat'
15:39 < reiffert> !bsdnat
15:39 <@vpnHelper> "bsdnat" is see !fbsdnat
15:39 < reiffert> grrr.
15:39 < EugeneKay> Lulz
15:39 < reiffert> !fbsdnat
15:39 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
15:39 < reiffert> !freensdmat
15:39 < reiffert> !freebsdnat
15:39 <@vpnHelper> "freebsdnat" is see !fbsdnat
15:39 < reiffert> vpnHelper: get in your corner and shoot yourself
15:40 < EugeneKay> !blame
15:40 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
15:44 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
15:50 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:51 -!- k4v [~kav@g226091215.adsl.alicedsl.de] has joined #openvpn
15:54 < sheik> finally got it ^_^
15:54 < sheik> on OpenBSD the NAT rule is different
15:56 < reiffert> and how does it look like?
16:00 < sheik> like this
16:00 < sheik> pass out on $ext_if from 10.8.0.0/24 to any nat-to servers.public.ip
16:00 < sheik> pass in quick proto tcp from any to port 1194 keep state label "openvpn"
16:00 < sheik> pass quick on $vpn_if keep state
16:20 < reiffert> vpnHelper: suck sheik's output and learn it
16:20 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:20 < reiffert> !learn openbsdnat as pass out on $ext_if from 10.8.0.0/24 to any nat-to servers.public.ip &&  pass in quick proto tcp from any to port 1194 keep state label "openvpn" && pass quick on $vpn_if keep state
16:20 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
16:20 < reiffert> ecrist_: see above
16:20 < reiffert> krzie: see above
16:21 < sheik> also note I used TCP and not UDP, could slip someone up if they aren't paying attention
16:22 < reiffert> sheik: opportunity for us to punish those.
16:23 < krzee> !learn openbsdnat as pass out on $ext_if from 10.8.0.0/24 to any nat-to servers.public.ip &&  pass in quick proto tcp from any to port 1194 keep state label "openvpn" && pass quick on $vpn_if keep state
16:23 <@vpnHelper> Joo got it.
16:23 < krzee> thanks
16:26 < reiffert> !factoids search --values bsdnat
16:26 <@vpnHelper> 'freebsdnat', 'bsdnat', and 'nat'
16:26 < reiffert> !factoids search bsdnat
16:26 <@vpnHelper> 'freebsdnat', 'bsdnat', 'fbsdnat', and 'openbsdnat'
16:34 -!- spitfire_ [~quassel@89.200.144.70] has joined #openvpn
16:48 -!- sedulous [~sedulous@2001:470:1f0b:1862:7e0d:7367:1173:1ebc] has quit [Quit: WeeChat 0.3.5]
16:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
17:01 <@vpnHelper> RSS Update - forum: Mix of site to site and client-server issues <http://forums.openvpn.net/topic8754.html>
17:01 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
17:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:15 -!- Kartagis [~iegg@unaffiliated/kartagis] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:15 -!- Kartagis [~iegg@unaffiliated/kartagis] has joined #openvpn
17:18 -!- asio [~asio@195.20.207.173] has quit [Ping timeout: 252 seconds]
17:18 -!- asio [~asio@195.20.207.173] has joined #openvpn
17:25 <@vpnHelper> RSS Update - forum: Mix of site to site and client-server issues <http://forums.openvpn.net/topic8754.html#p15334>
17:30 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
17:37 <@vpnHelper> RSS Update - forum: Client/Server connects ok, but no access to server. <http://forums.openvpn.net/topic8755.html>
17:39 -!- k4v [~kav@g226091215.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
17:43 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
17:45 < advocatusdiaboli> Where is the function that writes to /var/log/openvpn/openvpn-status.log ?
17:47 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:52 < advocatusdiaboli> Or is there an already existing solution to write the IP addresses related to key to MySQL?
18:02 < reiffert> the function that writes  /var/log/openvpn/openvpn-status.log is in the openvpn source code.
18:17 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.in]
18:21 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
18:25 -!- nb [~nb@fedora/nb] has joined #openvpn
18:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
18:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:56 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
18:57 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 276 seconds]
18:57 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
18:57 -!- mode/#openvpn [+v novaflash] by ChanServ
19:02 < krzee> advocatusdiaboli, theres likely a hook for a script that could write the info to your db
19:02 -!- spitf1r3 [~quassel@89.200.144.70] has joined #openvpn
19:02 < krzee> !scripts
19:02 < krzee> !script
19:02 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
19:03 -!- spitfire_ [~quassel@89.200.144.70] has quit [Ping timeout: 258 seconds]
19:05 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:07 < datruth> anyone use the openvpn-down-root plugin?
19:08 < advocatusdiaboli> krzee: any idea where to start searching?
19:19 -!- _julian_ [~quassel@hmbg-5f7672a2.pool.mediaWays.net] has joined #openvpn
19:19 -!- _julian [~quassel@hmbg-4d06b054.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:43 < datruth> how can I execute a script as root if in my client.conf i have user nobody group nobody?
19:43 -!- pcfreak30 [ae6f50fd@gateway/web/freenode/ip.174.111.80.253] has joined #openvpn
19:45 < pcfreak30> Hello. after messing with openvpjn for what seens like forver I got my certificate issues worked out. Now I am having a odd issue. i am connected to the vpn but when i check my IP it comes up as my real IP not the VPN ip.. any ideas...
19:45 < pcfreak30> server/client config -> http://pastie.org/private/mk58qn5nwjuvzlwyv3wrq
19:46 < EugeneKay> !def1
19:46 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
19:46 < EugeneKay> You're not telling your client to use the server for its internet traffic, thus your internet traffic is going out as normal.
19:47 < pcfreak30> meh i had a feeling it was something dumb
19:47 < EugeneKay> You'll also need to do snat/masquerading server-side for the client's traffic, else it will go out with the vpn address as the source addy, and will get dropped at the upstream.
19:47 < pcfreak30> u mean using ip tablres
19:48 < EugeneKay> I mean using whatever is appropriate for your system :-p
19:48 < EugeneKay> "iptables -t nat -s 10.8.0.0 -o eth0 -j MASQUERADE" would be appropriate for l00nix, yus.
19:49 < EugeneKay> 10.8.0.0/24*
19:51 < datruth> EugeneKay: any idea on how to execute a script as root on openvpn client side?
19:52 -!- pcfreak30_ [ae6f50fd@gateway/web/freenode/ip.174.111.80.253] has joined #openvpn
19:52 < pcfreak30_> ...
19:52 < EugeneKay> Run openvpn as root? :-p
19:52 < pcfreak30_> ya
19:52 < EugeneKay> Or grant it sudo privs
19:52 -!- pcfreak30 [ae6f50fd@gateway/web/freenode/ip.174.111.80.253] has quit [Ping timeout: 252 seconds]
19:52 < pcfreak30_> i have to else its not in path
19:52 < pcfreak30_> and i just got disconnected from irc
19:53 < pcfreak30_> thus i think services forced a new nic b/c its still think im connected via the old irc connection
19:53 < datruth> isnt it a bad idea to run openvpn as root?
19:53 < pcfreak30_> um
19:53 < pcfreak30_> well
19:53 < pcfreak30_> i mean as client
19:53 < pcfreak30_> i had to to allow it to use my network cards etc
19:53 < datruth> hrmm
19:54 < pcfreak30_> but i added push "redirect-gateway def1"
19:54 < pcfreak30_> and it does
19:54 < pcfreak30_> but now..
19:54 < pcfreak30_> i cant connect to anything
19:54 < pcfreak30_> sry for acting like a noob, but im just still trying gto learn it all. lol
19:54 < EugeneKay> That means your client side routes worked 
19:54 < datruth> I'm an having intermitten issues with the update-resolv-conf for linux dns but it seems to have cleared up
19:54 < pcfreak30_> ya
19:54 < EugeneKay> But the server iptables rules didn't :-p
19:55 < pcfreak30_> oh
19:55 < pcfreak30_> didnt apply em
19:55 < pcfreak30_> lol
19:55 < EugeneKay> herp da derp
19:55 < pcfreak30_> could u please re post the rule
19:55 < EugeneKay> iptables -t nat -s 10.8.0.0 -o eth0 -j MASQUERADE
19:55 < pcfreak30_> dohnt have irc historyu on web chat
19:55 < EugeneKay> (probably)
19:56 < pcfreak30_> um
19:56 < pcfreak30_> ...
19:56 < pcfreak30_> iptables v1.3.5: no command specified
19:56 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has joined #openvpn
19:56 < pcfreak30_> wtf...
19:56 < EugeneKay> Er, -t nat -A
19:56 < EugeneKay> :-p
19:56 < EugeneKay> Er
19:56 < EugeneKay> -A POSTROUTING
19:56  * EugeneKay needs booze
19:56 < pcfreak30_> brb
19:57 < tab1293> if you use the line "server 10.8.0.0 255.255.255.0" in your server config file thats the ip range that vpn clients draw their addresses from right?
19:57 < EugeneKay> Yes.
19:57 < tab1293> ok so what happens if the network your client is on uses that ip range?
19:57 < pcfreak30_> um
19:57 < EugeneKay> Shit breaks
19:57 < pcfreak30_> u dont want thay
19:57 < pcfreak30_> its in the guide to use ranges that dont conflict
19:58 < EugeneKay> You get what is know as "Fucked Routes"
19:58 < pcfreak30_> simply
19:58 < pcfreak30_> use ranges that are set for lanms
19:58 < tab1293> ok just making sure
19:58 < pcfreak30_> and be creative
19:58 < pcfreak30_> but
19:58 < pcfreak30_> takre all otgher subnets into consideration..
19:58 < pcfreak30_> other
19:58  * pcfreak30_ is a BADDD typer :p
19:58 < tab1293> i still dont understand how the client knows what traffic to push through the vpn and which stuff just to use the network its on
19:58 < pcfreak30_> up
19:58 < EugeneKay> Routes :-p
19:59 < pcfreak30_> its the push command 
19:59 < pcfreak30_> it has the client use the route automatically
19:59 < pcfreak30_> lkike setting DNS, WINDS domain
19:59 < pcfreak30_> etc
19:59 < pcfreak30_> http://pastie.org/private/77xxyofx90h1iljhh6au0q
20:00 < tab1293> ok thank you, i am new to vpns so im trying to wrap my head around the concepts
20:00 < pcfreak30_> theres an example that c&p from my current ssh window
20:00 < pcfreak30_> haha
20:00 < pcfreak30_> i think im a lil past you there tab
20:00 < pcfreak30_> yesterday i was getting errors out of the add
20:00 < pcfreak30_> 1 main one is the vps that created my certs is a day in the future to my pc
20:01 < pcfreak30_> so the cert wasnt valid to my pc unless i changed the date
20:01 -!- Denial [~Denial@drgi.co.uk] has quit []
20:01 < pcfreak30_> other i foubd out ids you need to keep certain cert fields exactly the same else its rejected
20:01 < pcfreak30_> atlewast how i got it to work
20:01 < pcfreak30_> its been a pain but in learning the same
20:01 < pcfreak30_> so good luck :)
20:02 < pcfreak30_> EugeneKay: i have that rule in place but it has no effect while im connected
20:02 < EugeneKay> pcfreak30_ - are you allowing the traffic through the filter table?
20:03 < pcfreak30_> EugeneKay: http://pastie.org/private/xk7kqf2owype3bf8aotn2w
20:03 < pcfreak30_> hats my vps's routing table
20:03 < EugeneKay> Routing != filter
20:03 < pcfreak30_> ok then what do i need to do?
20:05 < pcfreak30_> btw just googled it with no success :P
20:05 < EugeneKay> My guess? Firewall :-p
20:05 < pcfreak30_> you could have just said that..
20:05 < pcfreak30_> amnd i already ran that iptables rule
20:05 < pcfreak30_> and no effect
20:06 < EugeneKay> <EugeneKay> Routing != filter
20:06 < EugeneKay> NAT != filter
20:06 < pcfreak30_> ...ok... then could you please tell me what i need to do b/c im at a loss
20:07 < EugeneKay> The filter table of your iptables rules
20:07 < EugeneKay> You need to allow the traffic
20:15 < pcfreak30_> woot
20:15 < pcfreak30_> i just looked up on google and i got everything going
20:15 < ecrist_> reiffert: what's the point of the pf rules?
20:15 < ecrist_> !pf
20:16 < pcfreak30_> now i just need to learn in more detail bout iptables b/c ill need it 4 sure
20:16 < datruth> hrmm seems i have to run the vpn as root as well in order for the scripts to work
20:16 < pcfreak30_> ecrist_: um i need it to forward vpn traffic over my vpses lan
20:16 < pcfreak30_> so i can use the vps as a second ip
20:16 < ecrist_> !fbsdnat
20:16 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
20:17 < pcfreak30_> datruth: true. the server can be consigure to run as non root with somew tinkering tho
20:17 < pcfreak30_> hmm
20:17 < pcfreak30_> $EXTIF is that a env var
20:17 < ecrist_> no, you have to define that
20:17 < sheik> your external interface
20:17 < pcfreak30_> b/c i checked my VPs and it wasnt set in CENTOS
20:17 < datruth>  pcfreak30_ would that be the openvpn-down-root plugin?
20:17 < ecrist_> it's a macro
20:17 < ecrist_> !lears openbsdnat as see !fbsdnat
20:17 < pcfreak30_> datruth: i wouldnt know
20:18 < ecrist_> !learn openbsdnat as see !fbsdnat
20:18 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
20:18 -!- You're now known as ecrist
20:18 < ecrist> !learn openbsdnat as see !fbsdnat
20:18 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
20:18 < jpalmer> ecrist: stop abusing the bot before I ban you.
20:18 < jpalmer>  :P
20:18 < EugeneKay> Laffo
20:18 < ecrist> !learn openbsdnat as see !fbsdnat
20:18 <@vpnHelper> Joo got it.
20:18 < ecrist> jpalmer: give it a shot. ;)
20:18 < datruth> ecrist: what is your pf question?
20:18 < ecrist> datruth: I don't have a pf question
20:19 < datruth> oh
20:19 < ecrist> I am answering one from 16:20 CDT
20:19 < datruth> Ahh I see
20:25 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has left #openvpn ["farewell"]
20:27 < tab1293> can anyone explain why i am denied: [root@bergerserver easy-rsa]# . ./vars bash: /etc/openvpn/easy-rsa/openssl-1.0.0.cnf: Permission denied
20:27 < EugeneKay> Because even root gets blocked by chmod ugo-rwx
20:28 < tab1293> so how do i fix?
20:29 < EugeneKay> Learn more about unix file permission masks and how to work bash
20:30 < tab1293> -rw-r--r-- 1 root root  8222 Sep  5 17:20 openssl-1.0.0.cnf
20:30 < EugeneKay> Well that's odd.
20:30 < sheik> tab1293, did you put the filename in backticks? ``
20:30 < sheik> if you did it may be trying to execute the config file
20:30 < sheik> instead of parse it
20:30 < EugeneKay> Very odd, in fact.
20:30 < tab1293> sheik, im not sure what you mean by backticks
20:30 < tab1293> i ran the command ". ./vars"
20:31 < EugeneKay> vars shouldn't be giving that error
20:31 < sheik> cat vars | grep cnf
20:31 < sheik> let me see that
20:31 < tab1293> export KEY_CONFIG=`$EASY_RSA/openssl-1.0.0.cnf $EASY_RSA`
20:31 < sheik> change it to
20:31 < tab1293> so take away those backticks?
20:31 < sheik> export KEY_CONFIG='/etc/openvpn/openssl-1.0.0.cnf'
20:31 < tab1293> thank you sheik 
20:32 < sheik> np
20:32 -!- foobeans [~webchat@webchat.openvpn.net] has joined #openvpn
20:32  * EugeneKay wonders where you got a vars that does that
20:33 < tab1293> arch gave it to me
20:33 < EugeneKay> Arch the distro?
20:33 < sheik> it happens in OpenBSD too
20:33 < sheik> that's why I knew the problem
20:33 < EugeneKay> o.O
20:34 < tab1293> EugeneKay yes and arch is pretty similar to bsd in some aspects so maybe thats why? idk
20:34 < EugeneKay> I've not a clue. I'd have to look into the packaging
20:36 !services. [ChanServ:#openvpn] ecrist enabled the VERBOSE flag
20:36 < Ionic> Uh
20:37 < tab1293> now its saying my openssl-1.0.0.cnf does not exist....
20:37 < sheik> it has to point to a valid openssl.cnf
20:38 < sheik> did you create one?
20:38 < EugeneKay> Sounds like a bad copy of easy-rsa, or something.
20:38 < sheik> possibly /etc/openvpn/openvpn.conf?
20:38 < sheik> err, cnf*
20:38 < sheik> err
20:38 < EugeneKay> No, easy-rsa is purely openssl PKI generation. Nothing to do with openvpn yet.
20:38 < tab1293> i didnt create anything, the openssl-1.0.0.cnf was already in my easy-rsa folder
20:39 < ecrist> yet//
20:39 < ecrist> s/ yet//
20:39 < sheik> oh so
20:39 < sheik> export KEY_CONFIG='/etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf'
20:39 < sheik> it has to point to that actual file
20:40 < tab1293> i dont have that file
20:40 < sheik> it must be somewhere
20:40 < tab1293> should i just move my openssl-1.0.0.cnf file that resides easy-rsa/ to that location
20:40 < tab1293> and make the directory 2.0/ my self?
20:41 < datruth> Is it normal to see two intances of openvpn one with the user root and one with the user nobody?
20:42 < sheik> tab1293, you should have gotten all the files by cp -R /usr/local/share/examples/openvpn/easy-rsa /etc/openvpn
20:42 < sheik> or something similar
20:43 < tab1293> i did that and thats all i got 
20:43 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:43 < tab1293> this is strange
20:43 < EugeneKay> datruth - depends which openvpn binary is being run.
20:43 -!- foobeans [~webchat@webchat.openvpn.net] has quit [Quit: Page closed]
20:44 < tab1293> i think i got it working
20:44 < datruth> EugeneKay: I'm using ubuntu and /etc/init.d/openvpn to start the vpn server
20:44 < EugeneKay> datruth - I mean, the binary showing as being run by ps
20:45 < datruth> EugeneKay: /usr/sbin/openvpn is whats being shown.
20:45 < EugeneKay> For both?
20:45 < datruth> yes
20:46 < EugeneKay> Doesn't sound normal to me, but I'm not familiar with ubuntu's init scripts for openvpn
20:46 < EugeneKay> What's ps aux say for the two processes?
20:46 < ecrist> we cannot suppor third-party init/rc scripts
20:46 < ecrist> sorry
20:47 < ecrist> I *can* support the one shipping on freebsd, though, since I wrote part of it.
20:47 < ecrist> ;)
20:48 < datruth> root     16545  0.0  0.2   4360   548 ?        Ss   21:45   0:00 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --cd /etc/openvpn --config /etc/openvpn/server.conf
20:48 < datruth> nobody   16546  0.0  0.9   4952  2456 ?        Ss   21:45   0:00 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --cd /etc/openvpn --config /etc/openvpn/server.conf
20:48 <@vpnHelper> RSS Update - forum: Is OpenVPN able to fend off website traffic fingerprinting? <http://forums.openvpn.net/topic8756.html>
20:48 < EugeneKay> Looks like it's just dropping root
20:48 < ecrist> cool, you have two copies of openvpn running
20:49 < datruth> Is this normal behavior?
20:49 < datruth> EugeneKay: my server.conf has user nobody group nogroup
20:50 < EugeneKay> I believe that causes it to fork the second process that handles the actual openvpn tun/tap device
20:50 < EugeneKay> But, I dunno.
20:50 < EugeneKay> Sounds like it could very well be normal
20:51 < datruth> Hrmm okay perhaps the cook book might have something about it
20:54 < tab1293> can someone help me with this error: http://pastebin.com/NgP6hQgF
20:55 < tab1293> specifically this line WARNING: No server certificate verification method has been enabled.
20:55 < EugeneKay> !configs
20:55 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
20:56 < tab1293> server:http://pastebin.com/KxzkcBN3
20:57 < tab1293> client:http://pastebin.com/zfUyahnx
20:59 < EugeneKay> Turn up verb to 5, try agian, logs.
20:59 <@vpnHelper> RSS Update - forum: [ask]http-proxy-option <http://forums.openvpn.net/topic8748.html#p15337>
21:02 < pcfreak30_> tab1293: are u using a pre-setup tun
21:02 < tab1293> what do you mean
21:03 < pcfreak30_> tab1293: um i see in ur server u have dev tun0
21:03 < EugeneKay> In your client.conf, verb 5
21:03 < pcfreak30_> not dev tun
21:04 < tab1293> ok
21:04 < pcfreak30_> try changing to dev tun
21:04 < tab1293> ok i will
21:05 < EugeneKay> It's failing at the TLS handshake step, not even getting to device configuration.
21:05 < pcfreak30_> \http://pastie.org/private/ftw8ejsxvqqsyuvyg8ma
21:05 < pcfreak30_> soubds like what was happening to me
21:06 < pcfreak30_> tab1293: be sure in the sectional/orig name itds the samre accross all certs
21:06 < pcfreak30_> the field right before common name
21:06 < pcfreak30_> also i set the server common name to my vps server addresses (domain)
21:07 < pcfreak30_> addess
21:15 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has quit [Ping timeout: 245 seconds]
21:15 < datruth> I guess I will need to push a ping command to clients so their openvpn doesn't disconnect after 2-3mins of being idle
21:16 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has joined #openvpn
21:16 < EugeneKay> datruth - see --ping and --ping-restart
21:17 < EugeneKay> Oh, derp. Push as in push. NEvermind me.
21:18 < EugeneKay> I thought you meant a bash script
21:18 < datruth> nah with the push option for openvpn
21:18 < datruth> My vpn has reconnected itself 4times in 10mins
21:18 < datruth> ;/
21:18 < datruth> To bad their isn't a idle-timeout setting
21:20 < pcfreak30_> there is i thinkl
21:20 < pcfreak30_> check the manual
21:20 < EugeneKay> According to the man page, ping-restart and ping-exit should do that after non-receipt of a ping "or other packet"
21:20 < datruth> Oh keepalive is supposed to simpify the ping command
21:22 < EugeneKay> Mmmmhmmmm
21:26 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
21:27 < datruth> I've also learned that the same setting needs to be in the client side
21:29 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has quit [Ping timeout: 240 seconds]
21:31 < datruth> darn thats not fixing the issue
21:31 < datruth> restart after 3mins
21:36 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
21:36 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has joined #openvpn
21:40 < tab1293> my vpn server is on the same network i am on right now at home. is there anyway i can make the client seem like it is not on the local network so i can test the setup?
21:43 < EugeneKay> Sanely? No.
21:43 < Bushmills> test what aspects of the setup?
21:43 < tab1293> basically to see if it works hahah
21:43 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
21:48 < EugeneKay> Connecting from your LAN will muck up your routing
21:48 < datruth> tab1293: give me a cert I will try to connect to you
21:49  * datruth hopes his new settings keep his vpn active
21:50 < datruth> for the crl-verify crl.pem when you revoke a cert is that updated automatically or do I need to have a cronjob setup for that?
21:51 < EugeneKay> You should generate a fresh crl whenever you revoke a cert, plus regularly before the last crl expires. You can do this with a cron job, but Best Practice is to do it by hand.
21:51 < EugeneKay> I use a 45-day expiration time, and generate fresh crls on the first of the month.
21:52 < datruth> Hrmm perhaps I can attach that to the revoke script it self
21:52 < EugeneKay> This gives me two weeks to forget ;-)
21:52 < datruth> EugeneKay: do you use a cronjob?
21:52 < EugeneKay> Nyet.
21:53 < EugeneKay> My PKI root keys are sneakernetted
22:02 < datruth> EugeneKay: if the the revoke script creates the crl.pem why do i I need to update it? Isn't the script doing that already?
22:03 < EugeneKay> If easy-rsa is doign it already, then you don't need to make a freshy. 
22:03 < EugeneKay> You ought to make a fresh CRL when the old one expires(if the crl expiration is set.... it ought to be)
22:04 < datruth> How can I check if its set or not?
22:04 < EugeneKay> View the crl. The openssl command to do this eludes me without looking at the man page.
22:12 <@vpnHelper> RSS Update - forum: Client/Server connects ok, but no access to server. *fixed* <http://forums.openvpn.net/topic8755.html>
22:16 -!- tab1293 [~tab1293@ool-182ea246.dyn.optonline.net] has quit [Quit: Leaving]
22:17 < datruth> According to the cookbook the file is updated automatically and I have exp date 
22:17 < datruth> I wonder if the crl.pem will create itself on that date?
22:18 < EugeneKay> It's not magic.
22:18 < datruth> This is where the cronjob comes in?
22:19 < EugeneKay> If you choose to handle it that way, yes. I don't feel secure enough leaving my PKI "online".
22:20 < datruth> Otherwise I'll have to use the openssl command to manually update it?
22:21 < EugeneKay> Indeed.
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 252 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:43 -!- sheik [enum@unaffiliated/sheik] has left #openvpn ["Leaving"]
23:34 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
23:35 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
23:43 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
23:45 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
23:48 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
23:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
23:58 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
--- Day changed Tue Sep 06 2011
00:01 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
00:05 -!- oc80z [oc80z@blea.ch] has quit [Remote host closed the connection]
00:07 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
00:11 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 240 seconds]
00:11 -!- sno- [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 240 seconds]
00:11 -!- Martin` is now known as Martin
00:11 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 240 seconds]
00:12 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
00:12 -!- Netsplit *.net <-> *.split quits: krzee, CybDev, amir, defswork_
00:12 -!- Martin is now known as Guest33550
00:13 -!- Netsplit over, joins: krzee
00:13 -!- sno- [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
00:13 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
00:13 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
00:14 -!- Netsplit over, joins: CybDev
00:15 -!- Netsplit over, joins: defswork_
00:15 -!- Netsplit over, joins: amir
00:23 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
00:23 -!- nafiux [~nafiux@189.226.203.55] has joined #openvpn
00:24 < nafiux> Hola, alguien que hable español? Tengo algunas dudas sobre la configuración de OpenVPN
00:24 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
00:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:35 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
00:39 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
00:40 -!- pcfreak30_ [ae6f50fd@gateway/web/freenode/ip.174.111.80.253] has quit [Ping timeout: 252 seconds]
01:03 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
01:04 -!- nafiux [~nafiux@189.226.203.55] has quit [Remote host closed the connection]
01:14 -!- spitf1r3 [~quassel@89.200.144.70] has quit [Remote host closed the connection]
01:17 -!- spitfire [~quassel@89.200.144.70] has joined #openvpn
01:19 -!- jbb_ [~yeeb@184.105.219.149] has joined #openvpn
01:25 -!- jbb_ is now known as jbb
01:28 -!- ton [~ton@kluonis.kvb.lt] has joined #openvpn
01:28 < ton> hey. How can I do port forwarding using openvpn+nat?
01:29 < ton> INTERNET --> OpenVPN(Server+NAT+Port Forward) <--> OpenVPN(Client)
01:29 -!- ton is now known as ghghz
01:32 < Bushmills> just the same as with   INTERNET --> gateway(NAT) <--> client
01:32 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has joined #openvpn
01:32 < ghghz> It doesn't work
01:33 < ghghz> I see packets coming on Client, but no reply
01:33 < Bushmills> openvpn has no facilities for this.  the server where openvpn runs on must have
01:33 < Bushmills> for this purpose, openvpn behave the same as two network cards with a cable
01:34 < ghghz> here is my iptables: http://p.defau.lt/?HOZJ9_3xtMGBfVKO3xEeXQ
01:34 <@vpnHelper> Title: default paste at 2011-09-06 09:34:00 (at p.defau.lt)
01:35 < ghghz> 172.16.1.6 is client ip via tun0
01:35 < Bushmills> i guess your client has no reason to route replies through openvpn virtual interface
01:36 -!- Todd_Wang [~chatzilla@123.124.199.34] has joined #openvpn
01:36 < ghghz> default via 172.16.1.5 dev tun0
01:38 < Bushmills> well, as you say, request packets reach client, but replies don't go out.  that's where i would start diagnosing. 
01:39 < ghghz> what should I check first?
01:39 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:40 < ghghz> I got like this: http://p.defau.lt/?22eabmHVw2YCCNP5VNWXDg
01:40 <@vpnHelper> Title: default paste at 2011-09-06 09:40:11 (at p.defau.lt)
01:41 -!- Todd_Wang [~chatzilla@123.124.199.34] has left #openvpn []
01:45 -!- Hamlin [~Hamlin@j9-1-pt.tunnel.tserv13.ash1.ipv6.he.net] has quit [Ping timeout: 255 seconds]
01:45 < Bushmills> i'd use tcpdump, to see where the reply packets go
01:47 < ghghz> And what should I see? :) I see the same packets on server, also on client
02:00 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:01 -!- Hamlin [~Hamlin@mountainmorningband.com] has joined #openvpn
02:08 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
02:09 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:09 -!- mode/#openvpn [+o mattock] by ChanServ
02:10 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
02:11 < Mowee> Morning
02:14 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:17 -!- dazo_afk is now known as dazo
02:17 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
02:25 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 264 seconds]
02:25 -!- ghghz [~ton@kluonis.kvb.lt] has quit [Quit: leaving]
02:33 <@vpnHelper> RSS Update - forum: Server Config from Client <http://forums.openvpn.net/topic8757.html>
02:37 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
02:37 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:40 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
02:43 -!- SmokeyD [~SmokeyD@j101177.upc-j.chello.nl] has joined #openvpn
02:43 < SmokeyD> hey everyone. Is there a way to have a client configuration setup on windows 7 where each user has his/her own config dir?
02:47 < SmokeyD> Now everyone's config files (starting as a service) are in c:\Program Files (x86)\OpenVPN\config\ so each user see each config file. But I want different users to have different config files
03:06 < defswork_> SmokeyD, try changing working directory
03:08 < SmokeyD> defswork_, in the openvpn gui shortcut in the start menu? Does it check the config folder relative to the executable?
03:13 -!- Slashman [~Slash@hydra.fimasys.com] has quit [Ping timeout: 260 seconds]
03:37 <@vpnHelper> RSS Update - forum: Ip static for win7 client <http://forums.openvpn.net/topic8758.html>
03:37 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 264 seconds]
03:37 < Bushmills> !ccd
03:37 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
03:37 < Bushmills> oh... "user"
03:38 < Bushmills> you can specify path of config file as argument to openvpn
03:45 < reiffert> moin
03:47 < Bushmills> moin reiffert
04:05 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
04:07 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:10 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
04:15 -!- SmokeyD [~SmokeyD@j101177.upc-j.chello.nl] has quit [Quit: Ex-Chat]
04:24 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
04:27 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
04:40 -!- defswork_ [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
04:40 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
04:47 -!- Slashman [~Slash@hydra.fimasys.com] has joined #openvpn
04:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:48 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:49 <@vpnHelper> RSS Update - forum: Mix of site to site and client-server issues <http://forums.openvpn.net/topic8754.html#p15340>
04:55 <@vpnHelper> RSS Update - forum: [ask]http-proxy-option <http://forums.openvpn.net/topic8748.html#p15342> || Is OpenVPN able to fend off website traffic fingerprinting? <http://forums.openvpn.net/topic8756.html#p15341>
05:01 <@vpnHelper> RSS Update - forum: Ip static for win7 client <http://forums.openvpn.net/topic8758.html#p15343>
05:16 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
05:19 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
05:19 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:21 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
05:22 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:39 -!- luneff [~yury@84.51.201.56] has quit [Read error: Operation timed out]
05:40 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Read error: Connection reset by peer]
05:40 -!- novaflash [novaflash@openvpn/user/novaflash] has joined #openvpn
05:40 -!- mode/#openvpn [+v novaflash] by ChanServ
05:40 -!- luneff [~yury@84.51.201.56] has joined #openvpn
05:45 -!- luneff [~yury@84.51.201.56] has quit [Ping timeout: 264 seconds]
05:55 <@vpnHelper> RSS Update - forum: Here is my own Auto Login script for OpenVPN <http://forums.openvpn.net/topic7779.html#p15344>
06:13 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:13 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:13 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:13 -!- mode/#openvpn [+v Axeman] by ChanServ
06:18 -!- spitfire [~quassel@89.200.144.70] has quit [Remote host closed the connection]
06:22 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:22 -!- mode/#openvpn [+v Axeman2] by ChanServ
06:24 -!- luneff [~yury@109.165.8.179] has joined #openvpn
06:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:30 -!- luneff [~yury@109.165.8.179] has quit [Quit: Leaving]
06:47 -!- luneff [~yury@109.165.8.179] has joined #openvpn
06:47 <@vpnHelper> RSS Update - forum: Ip static for win7 client <http://forums.openvpn.net/topic8758.html#p15345>
06:56 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
06:58 -!- Guest33550 [martin@shell.ipv6.octocore.net] has left #openvpn []
07:15 -!- Slashman [~Slash@hydra.fimasys.com] has quit [Quit: Leaving]
07:17 -!- sigius [~sigius@93.125.185.45] has quit [Ping timeout: 245 seconds]
07:22 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has joined #openvpn
07:31 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
07:33 -!- cpm is now known as SpacePandaCPM
07:41 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:44 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
07:45 < havoc> hmm, --remote-random, interesting
07:46 < EugeneKay> Works good for load balancing
07:48 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:48 < havoc> yup, that's what interested me
07:52 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
07:58 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:58 -!- datruth [datruth@gotpot.org] has quit [Quit: repairs]
08:04 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Read error: Connection reset by peer]
08:05 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
08:05 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
08:05 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
08:10 -!- novaflash [novaflash@openvpn/user/novaflash] has quit [Ping timeout: 258 seconds]
08:10 -!- novaflash2 [~notme@173.245.87.91] has joined #openvpn
08:10 -!- novaflash2 is now known as novaflash
08:10 -!- novaflash [~notme@173.245.87.91] has quit [Changing host]
08:10 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
08:12 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
08:16 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15346>
08:18 -!- bitterman [~yury@109.165.8.179] has joined #openvpn
08:18 -!- bitterman [~yury@109.165.8.179] has quit [Remote host closed the connection]
08:20 -!- luneff [~yury@109.165.8.179] has quit [Ping timeout: 268 seconds]
08:23 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has joined #openvpn
08:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:43 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:45 -!- GHAI [~joti@cthulhu-isp.net] has quit [Ping timeout: 245 seconds]
08:45 -!- GHAI [~joti@cthulhu-isp.net] has joined #openvpn
08:46 -!- lwhalen [~law@dopefish.fuzzy-logic.org] has quit [Quit: Computer has gone to sleep]
08:51 -!- luneff [~yury@109.165.8.179] has joined #openvpn
09:00 -!- master_of_master [~master_of@p57B5483D.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:04 -!- master_of_master [~master_of@p57B5455E.dip.t-dialin.net] has joined #openvpn
09:06 -!- Axeman2 is now known as Axeman
09:15 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
09:26 -!- lwhalen [~law@bastion-ext.sermo.com] has joined #openvpn
09:26 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
09:34 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 240 seconds]
09:34 -!- novaflash2 [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
09:34 -!- novaflash2 is now known as novaflash
09:34 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
09:34 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
09:36 -!- Chat7030 [lemrah@app9.chatmosphere.org] has joined #openvpn
09:36 -!- Chat7030 [lemrah@app9.chatmosphere.org] has quit [Client Quit]
09:38 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
09:55 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 245 seconds]
09:58 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
09:59 < hyper_ch> all of a sudden I have a very unstalbe vpn connection between server and a client
10:01 < hyper_ch> can vpn 2.2 server be used with 2.1 clients?
10:03 < ecrist> yes
10:04 < hyper_ch> good
10:05 < novaflash> death to instability
10:05 < hyper_ch> building now openvpn 2.2.1 on the server
10:05 < hyper_ch> not sure if openvpn is the problem or the connection between the server and that client in general
10:06 < hyper_ch> pinging that client from my client averages at 6 seconds
10:06 < hyper_ch> pinging the server averages in like 31ms
10:08 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
10:08 -!- norc [~norc@ns223862.ovh.net] has joined #openvpn
10:09 < norc> If the network connection to my VPN server is lost, and I reconnect again - how would that affect TCP connections inside the VPN?
10:10 < novaflash> they'd be disconnected. then reconnected.
10:10 < novaflash> same as pulling the networkcable out of your computer.
10:10 < novaflash> then plugging it back in.
10:10 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:13 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Ping timeout: 245 seconds]
10:13 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
10:16 -!- Axeman [~Axeman3@openvpn/user/axeman] has left #openvpn ["Leaving"]
10:18 < hyper_ch> ok, server runs now 2.2.1 and tcp-nodelay.... still pinging that client takes 5+ seconds..... pinging the server takes 30ms
10:19 < hyper_ch> and if I change back to UDP then transfer is slow again
10:20 < hyper_ch> btw, is there a way for the client to check udp and tcp to see what the server offers?
10:24 < EugeneKay> Try it, see what responds.
10:24 < ecrist> no, there isn't, hyper_ch 
10:24 < EugeneKay> My laptop's .ovpn is setup with explicitly ordered servers.... first it attempts UDP 1194, then UDP 53, then TCP 1194, then TCP 443.
10:25 < EugeneKay> Then it cries in a corner for it's mommy
10:26 < EugeneKay> Offering over tcp and udp simultaneously isn't hard. Just need to run two server instances.
10:26 < EugeneKay> I use port natting for the 53/443-->1194 trick.
10:26 < hyper_ch> EugeneKay: nah, I just wish I had a way that I can change the server easily without always being required to change client config
10:27 < EugeneKay> As for what's causing your UDP slowdowns..... firewall in between doing DNS rate limiting, maybe? (is it over :53?)
10:29 < hyper_ch> EugeneKay: right now, the other client seems completely inaccessible
10:29 < ecrist> hyper_ch: I'm thinking that client is having network problems
10:30 < ecrist> somewhere between you and it
10:30 < hyper_ch> firewall shouldn't be doing any rate limiting
10:30 < hyper_ch> also it was fine for months, then a few week back it suddenly dropped in speed
10:30 < hyper_ch> a few days ago I changed to tcp (without tcp-nodely because of old server ovpn)
10:30 < ecrist> openvpn doesn't 'suddenly' change things
10:30 < hyper_ch> then speed was fine again
10:30 < ecrist> networks do, though
10:31 < hyper_ch> and today I just get connection interruptions to that other client all the time
10:31 < hyper_ch> and now it is hardly responding
10:31 < hyper_ch> can I blame krzee ?
10:31 < hyper_ch> that client is a dedicated server
10:32 < hyper_ch> if I turn the vpn off
10:32 < hyper_ch> it's all fine
10:32 < dropje> !blame
10:32 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
10:33 -!- luneff [~yury@109.165.8.179] has quit [Quit: Leaving]
10:33  * dazo blame hyper_ch today
10:33 < EugeneKay> "suddenly dropped in speed" without a config change means something else is borked
10:33 < EugeneKay> So you're barking up the wrong tree
10:33 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 268 seconds]
10:33 < dropje> EugeneKay: agree
10:33 < cherwin> EugeneKay: I concur.
10:35 < hyper_ch> EugeneKay: what is borked then?
10:35 < EugeneKay> Not a clue.
10:35 <@dazo> I think it is only Windows which is able to cripple itself by using it *duck*
10:36 < lwhalen> hey all, where can I read up on the available DHCP-like services OpenVPN lets me push?
10:36 < cherwin> hyper_ch: Test it with different machines on the same network and see if the problem persists.
10:36 < lwhalen> I know I can push DNS servers, but how would I go about pushing a search domain?
10:36 < hyper_ch> EugeneKay: you speak German?
10:36 < EugeneKay> Nein.
10:38 < hyper_ch> Aufgrund einer aktuellen Störung ist die Backboneverbindung 
10:38 < hyper_ch> Frankfurt/Main - Falkenstein nicht verfügbar. 
10:38 < hyper_ch> that's what I got from the faulty ISP 
10:38 < hyper_ch> :(
10:38 < reiffert> hyper_ch: krzee does.
10:39 < reiffert> EugeneKay: hyper_ch basically got a problem with a big hydraulic digging machine and a fibre-cable.
10:39 < EugeneKay> D'oh.
10:39 < reiffert> hyper_ch: details: http://hetzner-status.de
10:39 <@vpnHelper> Title: Hetzner Online AG - Status-Webseite (at hetzner-status.de)
10:39 < hyper_ch> anyway, backbone issues at the moment
10:40 < reiffert> hyper_ch: ----------- fibre cable before digging machine.    --------    ----------- after
10:40 < reiffert> >Bei Baggerarbeiten wurde ein Glasfaserkabel durchtrennt.
10:41 < hyper_ch> there are missing pieces!!!!!!
10:41 < hyper_ch> I wasn't sent an update
10:41 < Bushmills> Al-Quaida drove the machine
10:42 < hyper_ch> why are fiber optics so fragile?
10:42 < reiffert> hyper_ch: again
10:42 < hyper_ch> can't they withstand a simple hydraulic digging machine?
10:42 < reiffert> 17:39 < reiffert> hyper_ch: details: http://hetzner-status.de
10:42 <@vpnHelper> Title: Hetzner Online AG - Status-Webseite (at hetzner-status.de)
10:43 < hyper_ch> reiffert: they usually send out emails when there are problems
10:43 < reiffert> 17:39 < reiffert> hyper_ch: details: http://hetzner-status.de
10:43 <@vpnHelper> Title: Hetzner Online AG - Status-Webseite (at hetzner-status.de)
10:43 < Bushmills> NATO jets are already on the way
10:46 < SpacePandaCPM> egg-cellent!
10:46 < hyper_ch> anyway, I need to work on my Services Menu now
10:46 < hyper_ch> thx for the help
10:46 < hyper_ch> Bushmills: could you paste that link again? I forgot it ;)
10:46 < reiffert> vpnHelper: !kick hyper_ch 
10:46 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has joined #openvpn
10:47 < Bushmills> blast the bloody breakfast out of the bleeping bulldozing bastards
10:47 < hyper_ch> anyone proficient in here with imagemagick?
10:49 < ecrist> I'm sure someone in #imagemagick is
10:49 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15347>
10:49 < reiffert> convert -scale 50% *.img
10:50 < reiffert> I really like the convert manpage.
10:50 < Bushmills> destination name needed. or use mogrify
10:51 < reiffert> convert -inplace -scale 50% *.img
10:51 < ecrist> heh
10:53 < Bushmills> mogrify -scale ...
10:54 < hyper_ch> ecrist: ##imagemagick  --> but they don't like replying
10:56 < hyper_ch> on a png, when I use the "-colorspace grey" option the transparency turns all black. I try the "-alpha On" option but no cluck
10:56 < hyper_ch> s/try/tried/
10:57 < novaflash> s/cluck/luck ;)
10:57 < hyper_ch> right :)
10:58 < Bushmills> maybe they like answering, but simply don't know
10:58 < Bushmills> or, alternatively, they can't reproduce your problem
10:59 < novaflash> or maybe they are in another star system and it takes several years for TPC/IP traffic to travel.
11:00 < hyper_ch> I think novaflash is right
11:02 < novaflash> ping response: 12454929 seconds
11:12 < hyper_ch> btw:  http://mb-c.pro/en/archives/9149
11:12 <@vpnHelper> Title: OpenJustitia: Open source preserved - MB Consulting — MB Consulting (at mb-c.pro)
11:14 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
11:26 -!- dazo is now known as dazo_afk
11:31 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:46 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
11:46 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:46 -!- mode/#openvpn [+o mattock] by ChanServ
11:56 <@vpnHelper> RSS Update - forum: How do I set the metric? <http://forums.openvpn.net/topic8759.html>
12:10 < ecrist> hyper_ch: please keep things on topic
12:11 < hyper_ch> ecrist: I try very hard to do so... but my inner self is hard to control :)
12:37 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
12:43 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
12:47 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
12:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:55 -!- mode/#openvpn [+v s7r] by ChanServ
13:05 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:06 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
13:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:29 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:30 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:33 <@vpnHelper> RSS Update - forum: Incorporate technology to fend off website fingerprinting <http://forums.openvpn.net/topic8760.html>
13:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:37 -!- nafiux [~nafiux@189.226.152.112] has joined #openvpn
13:37 < nafiux> Hola Buen día, alguien por aquí que pueda resolverme una duda
13:37 < nafiux> con vpnc?
13:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
13:39 <@vpnHelper> RSS Update - forum: Routing multiple networks off VPN Server <http://forums.openvpn.net/topic8761.html>
13:40 < ecrist> um, english, please
13:41 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
13:41 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:43 < nafiux> ok, hi ecrist
13:43 < nafiux> I need connect a serverA with serverB
13:43 < nafiux> Server A have a Cisco protocol for VPN.
13:43 < nafiux> Can I use OpenVPN in serverB to connect with serverA?
13:48 -!- lwhalen [~law@bastion-ext.sermo.com] has quit [Quit: Bye]
13:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 255 seconds]
13:54 -!- norc [~norc@ns223862.ovh.net] has quit [Ping timeout: 252 seconds]
13:55 < ecrist> openvpn doesn't talk cisco ssl vpn
13:55 < ecrist> they're each their own protocol
13:55 < ecrist> you need openvpn or cisco on both sides
13:57 < nafiux> ok, Can I use vpnc?
13:57 <@vpnHelper> RSS Update - forum: Script username but not password <http://forums.openvpn.net/topic8762.html>
13:57 < ecrist> no idea what vpnc is
13:57 -!- norc [~norc@ns223862.ovh.net] has joined #openvpn
13:58 < norc> k, so is there a way to keep tcp connections alive?
13:58 < norc> (I mean if the vpn connection is lost)
14:00 < ecrist> um, I don't know what you're trying to do
14:01 < novaflash> ecrist; he wants to keep connections uninterrupted....even when the openvpn tunnel has been broken and later reestablished
14:01 < novaflash> but i don't think that's possible.
14:02 < ecrist> no, it's not
14:26 -!- nafiux [~nafiux@189.226.152.112] has quit [Remote host closed the connection]
14:27 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
14:38 -!- SpacePandaCPM [~Chip@pdpc/supporter/active/cpm] has quit [Quit: SpacePandaCPM]
14:40 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
14:40 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
14:40 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
14:42 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
14:47 -!- luneff [~yury@84.51.201.56] has joined #openvpn
14:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
15:03 <@vpnHelper> RSS Update - forum: Routing multiple networks off VPN Server <http://forums.openvpn.net/topic8761.html#p15352>
15:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
15:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Client Quit]
15:15 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:17 -!- |Mike| is now known as blaataap
15:18 -!- blaataap is now known as |Mike|
15:18 -!- disaster37 [~disaster@i03v-62-35-223-179.d4.club-internet.fr] has joined #openvpn
15:18 < disaster37> hi all
15:19 < disaster37> I use an openvpn point to point from few month, no problem, but now it doesn't work
15:19 < disaster37> No upgrade os, no change network ..
15:19 < disaster37> And in logs, it seems normal
15:20 < disaster37> I paste bin you my log on 2 server openvpn
15:22 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
15:23 < disaster37> http://pastebin.com/EC1ah4V6
15:24 < disaster37> first server
15:24 < disaster37> now I start the second server
15:26 < disaster37> hum now it's work
15:26 < disaster37> it's very strange
15:27 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:03 <@vpnHelper> RSS Update - forum: Verifying Re-Direct of Traffic in "Road Warrior" connection <http://forums.openvpn.net/topic8763.html>
16:07 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
16:12 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
16:20 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
16:27 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:30 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:32 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
16:36 -!- disaster37 [~disaster@i03v-62-35-223-179.d4.club-internet.fr] has quit [Ping timeout: 252 seconds]
16:39 < Kalavera> greetings guys for some reason I am experiencing troubles by assigning an IP address over 10.7.0.33
16:39 < krzee> !configs
16:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
16:39 < Kalavera> but not having troubles with the ones under it, for example 10.7.0.5
16:39 < Kalavera> krzee: ok thank u 
16:41 < krzee> np
16:57 -!- blackpenguin [~bp@unaffiliated/blackpenguin] has quit [Quit: WeeChat 0.3.5]
16:58 -!- radioxid [~radioxid@92.90.20.152] has joined #openvpn
17:14 -!- radioxid [~radioxid@92.90.20.152] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
17:16 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
17:50 < krzee> Dougy, you here?
17:53 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
17:54 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:27 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:31 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
18:48 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 258 seconds]
18:48 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
18:48 -!- mode/#openvpn [+v novaflash] by ChanServ
19:15 -!- _julian [~quassel@hmbg-5f764622.pool.mediaWays.net] has joined #openvpn
19:17 -!- raidz1 [~Administr@50-76-49-94-ip-static.hfc.comcastbusiness.net] has joined #openvpn
19:18 -!- _julian_ [~quassel@hmbg-5f7672a2.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:18 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 258 seconds]
19:26 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
19:26 -!- mode/#openvpn [+v oc80z] by ChanServ
19:26 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:26 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
19:26 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:26 -!- mode/#openvpn [+v Axeman] by ChanServ
19:39 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 264 seconds]
20:09 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:10 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
20:27 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
20:42 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:42 -!- mode/#openvpn [+v Axeman] by ChanServ
20:43 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:43 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
20:43 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:43 -!- mode/#openvpn [+v Axeman2] by ChanServ
20:44 -!- Denial [Denial@drgi.co.uk] has quit []
20:47 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
20:56 -!- Netsplit *.net <-> *.split quits: kloeri, krzie, sobersabre
20:57 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
20:58 -!- Netsplit over, joins: krzie, sobersabre, kloeri
20:58 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
21:33 -!- Axeman2 is now known as Axeman
21:43 -!- jbb [~yeeb@184.105.219.149] has quit [Quit: No Ping reply in 180 seconds.]
21:43 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
21:43 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Quit: ZNC - http://znc.in]
21:44 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
21:45 -!- DexTerDDIT [~dexterddi@2001:470:1f06:687::2] has quit [Quit: changing servers]
21:45 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has quit [Quit: leaving]
21:46 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
22:01 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
22:06 -!- EugeneKay is now known as EugeneKaway
22:19 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:31 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 245 seconds]
22:44 -!- k4v [~kav@g226089235.adsl.alicedsl.de] has joined #openvpn
23:24 -!- norc [~norc@ns223862.ovh.net] has quit [Ping timeout: 258 seconds]
23:31 -!- darkdrgn2k4 [~darkdrgn2@199.243.221.14] has quit [Read error: Connection reset by peer]
23:32 -!- darkdrgn2k4 [~darkdrgn2@216.234.33.35] has joined #openvpn
23:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
--- Day changed Wed Sep 07 2011
00:09 -!- k4v [~kav@g226089235.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
00:37 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 246 seconds]
00:48 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
00:49 -!- disaster37 [~disaster@i03v-62-35-223-179.d4.club-internet.fr] has joined #openvpn
00:54 -!- disaster37 [~disaster@i03v-62-35-223-179.d4.club-internet.fr] has quit [Ping timeout: 264 seconds]
01:02 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:09 -!- albech [~thomas@183.88.76.109] has joined #openvpn
01:09 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 252 seconds]
01:14 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
01:23 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:40 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:42 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
01:52 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
01:53 -!- dazo_afk is now known as dazo
02:10 -!- ghghz [~ton@kluonis.kvb.lt] has joined #openvpn
02:10 < ghghz> Hello. Why it doesn't work for me? http://p.defau.lt/?leGRezASU1pCFOYI7myL_w
02:10 <@vpnHelper> Title: default paste at 2011-09-07 10:10:06 (at p.defau.lt)
02:10 < ghghz> I mean port forwarding
02:10 < ghghz> who can help?
02:13 < Mowee> Morning
02:27 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
02:27 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
02:27 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
02:36 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 264 seconds]
02:38 -!- [dEviL-bOy]_ [~edgar@41.88.103.84.rev.sfr.net] has joined #openvpn
02:39 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
02:39 -!- [dEviL-bOy]_ [~edgar@41.88.103.84.rev.sfr.net] has quit [Client Quit]
02:41 -!- [dEviL-bOy] [~edgar@41.88.103.84.rev.sfr.net] has joined #openvpn
02:47 -!- [dEviL-bOy] [~edgar@41.88.103.84.rev.sfr.net] has quit [Quit: real world]
02:59 <@vpnHelper> RSS Update - forum: Verifying Re-Direct of Traffic in "Road Warrior" connection <http://forums.openvpn.net/topic8763.html#p15354>
03:04 -!- HUY_NGUYEN [~HUY_NGUYE@113.161.89.159] has joined #openvpn
03:05 < HUY_NGUYEN> hi all
03:05 < HUY_NGUYEN> i have one problem with openvpn when the remote client have the same network with the local network of vpn server
03:06 < HUY_NGUYEN> have any way to fix this issue ?
03:10 < hyper_ch> and what problem do you have?
03:11 < HUY_NGUYEN> hi
03:11 < HUY_NGUYEN> the remote clent can't access to some services in local vpn server
03:12 < HUY_NGUYEN> my client home network and the local network of vpn server is 192.168.1.x/24
03:13 < HUY_NGUYEN> if the client using the difference network
03:13 < HUY_NGUYEN> such as 10.10.10.x/24
03:13 < HUY_NGUYEN> they can access to our local server network
03:13 < HUY_NGUYEN> 192.168.1.x/24
03:14 < HUY_NGUYEN> do you have any idea about this issue ?
03:14 < HUY_NGUYEN> @hyper_ch
03:16 < hyper_ch> if you're on the same lan, you need to alter the server address in the client config
03:17 < HUY_NGUYEN> could you guide me more detail about this ?
03:18 < hyper_ch> well, what server address do you have in the client config?
03:18 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Read error: Operation timed out]
03:19 < HUY_NGUYEN> remote 115.78.x.x 13194
03:19 < HUY_NGUYEN> that is the public ip of my vpn server
03:19 < HUY_NGUYEN> and it was forward to the local ip of vpn server is 192.168.1.113
03:19 -!- k4v [~kav@g226089235.adsl.alicedsl.de] has joined #openvpn
03:22 < HUY_NGUYEN> @hyper_ch: do you need any more information ?
03:23 < defswork> HUY_NGUYEN, routing all ok ?
03:23 < defswork> HUY_NGUYEN, do all your lan servers know the route back to the VPN subnet ?
03:23 < HUY_NGUYEN> i don't add any more route after connect to the vpn server
03:24 <@dazo> HUY_NGUYEN: If the subnet of your VPN and the remote site is the same, then this will not work.  One of them need to change subnet
03:24 < hyper_ch> defswork: the problem is, with that address, you go out through your lan into the internet and back into the lan again
03:24 < hyper_ch> and I think that might confuse the router
03:24 < hyper_ch> probably better to use a domain name
03:24 < defswork> oh sorry - I didnt read that was same lan
03:24 <@dazo> (remote site == remote LAN)
03:24 < defswork> addressing*
03:24 < hyper_ch> and have a nameserver inside the lan that properly points the domain name to the lan ip
03:25 < HUY_NGUYEN> @dazo: have other way to fix this issue ?
03:25 <@dazo> HUY_NGUYEN: No, there are no other solutino
03:25 <@dazo> solution, even
03:25 <@dazo> HUY_NGUYEN: either renumber your VPN (probably easier) or renumber the remote LAN
03:26 < HUY_NGUYEN> i saw that link: http://www.shorewall.net/OPENVPN.html, but i don't know how to use it
03:26 < HUY_NGUYEN> Roadwarrior with Duplicate Network Issue
03:27 < HUY_NGUYEN> @dazo: please help to check that link. do you have any idea about that
03:27 -!- ghghz [~ton@kluonis.kvb.lt] has quit [Quit: leaving]
03:27 <@dazo> HUY_NGUYEN: that is still a different issue ... as the VPN in this description is on another network segment (192.168.*3*.0/24)
03:28 <@dazo> but you have VPN and the LAN conflicting, in this scenario, there are no solution than to renumber VPN or LAN
03:28 < HUY_NGUYEN> @dazo: i understand your idea, but i can't change that range
03:28 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
03:28 <@dazo> HUY_NGUYEN: then you won't make it work
03:28 < defswork> HUY_NGUYEN, you've got no choice
03:29 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 246 seconds]
03:29 < defswork> HUY_NGUYEN, basic networking - you cant interconnect two subnets that share the same address space
03:30 < defswork> HUY_NGUYEN, (unless you masquerade in/out - but this is way beyond your current skills)
03:30 -!- CybDev [cybdev@unaffiliated/cybdev] has quit [Ping timeout: 264 seconds]
03:30 < defswork> changing subnet of a single remote home network is trivial though
03:31 < defswork> just go onto the router and change the dhcp settings
03:31 <@dazo> defswork: you will most likely need a third subnet, where the NATing happens, to solve the routing
03:31 < defswork> aye - monster grief and no where near worth the effort compare to simply changing a subnet address 
03:32 <@dazo> you can have same subnets on two LANs over a VPN, using NAT ... if the VPN is a different subnet
03:32 <@dazo> (but you need to be sure that the NAT address being used on either sides are not being used by anyone else)
03:32 < defswork> but it's just his home network - no sure why that can't be changed
03:32 < defswork> it's a 10 second job
03:32 < HUY_NGUYEN> we can't change the network range for both home server and client side
03:32 <@dazo> Agreed
03:33 < defswork> HUY_NGUYEN, you're going to have to give up and watch TV then
03:33 < HUY_NGUYEN> the vpn server is  in my office, so they can't change their network
03:33 <@dazo> HUY_NGUYEN: you said VPN and remote LAN side use the same network segment
03:33 < defswork> because you are the only thing that can change
03:33 < HUY_NGUYEN> the change in the remote client is easier 
03:34 < HUY_NGUYEN> but the client is dynamic
03:34 < HUY_NGUYEN> so they can change their network, if they want to access to vpn server
03:34 < defswork> HUY_NGUYEN, speak to the network admin at your office and ask him why the feck did he use the 2nd most common subnet in the entire private address space - whilst poking him the eye
03:34 < HUY_NGUYEN> they can't
03:34 < HUY_NGUYEN> i'm sorry
03:34 <@dazo> HUY_NGUYEN: often, you have 3 subnets when doing routed VPN ... <site A, f.ex: 192.168.1.0/24> -- <VPN: f.ex. 10.8.0.0/24> -- <site B: f.ex. 192.168.20.0/24>
03:34 < defswork> 192.168.0.0 being most common 
03:34 < HUY_NGUYEN> yes
03:35 < defswork> 192.168.0 and 192.168.1 are typical defaults on ADSL and cable routers
03:35 <@dazo> 192.168.1.0/24 is the second most common, in addition to 10.0.0.0/24
03:35 < HUY_NGUYEN> 192.168.1.x or 192.168.2.x is very popular in our country
03:35 -!- mete [~mete@mete.shell.la] has joined #openvpn
03:35 < defswork> HUY_NGUYEN, thats why you should ensure that you don't use them.....
03:36 < HUY_NGUYEN> the main problem is from our office network range
03:36 < defswork> I have interconnects now where the third party insist on public IP addresses now because they don't what to manage conflicts - fecking hard to get a subnet nowdays
03:36 < HUY_NGUYEN> they already using the range 192.168.1.x
03:38 < defswork> sounds like they using a cheap appliance for dhcp if they've stayed on default so I can't imagine it would be that hard to change it
03:38 < HUY_NGUYEN> they can't change it because they have a lot services on their network
03:38 < HUY_NGUYEN> i mean all internal services
03:38 < defswork> HUY_NGUYEN, won't - not can't
03:38 < HUY_NGUYEN> if they change the network range, they have to change all things on it
03:39 < HUY_NGUYEN> yes, i see
03:39 < defswork> I've changed my network here before now and I bet I have more static hosts
03:39 < defswork> and I did it without any downtime 
03:40 < HUY_NGUYEN> it mean don't have any other way to fix this problem ?
03:40 < defswork> just aliased new addresses on first, updated dhcp, and clients just rolled over onto new subnet and all hosts were accessible to both subnets the entire time
03:40 < defswork> HUY_NGUYEN, you need to change either the client subnet or the office subnet
03:40 <@dazo> HUY_NGUYEN: please, go read !tcpip about network routing ... this discussion is typical when you don't know enough about networking
03:40 < HUY_NGUYEN> yes, i mean beside that way
03:40 <@dazo> !tcpip
03:40 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
03:40 < defswork> as your office is on a default subnet for home networking equipiment you are going to hit this problem again and again if you dont change the office side
03:41 < HUY_NGUYEN> @dazo: i understand it, tcp/ip
03:41 < HUY_NGUYEN> but i just confused if the client access to vpn, they will get the new ip address
03:42 < HUY_NGUYEN> such as 10.0.0.x
03:42 < HUY_NGUYEN> so i tried to found the way to fix that issue
03:42 < defswork> there local lan nic will still be on 192.168.1.* 
03:42 < defswork> so traffic you want to go to remote lan will go out on the local nic
03:42 < HUY_NGUYEN> yes, i see
03:43 < HUY_NGUYEN> just have one other question
03:43 < HUY_NGUYEN> about dns
03:43 < HUY_NGUYEN> when using openvpn
03:43 < HUY_NGUYEN> i'm using the local dns server at my office network
03:43 < HUY_NGUYEN> but when i connect to vpn 
03:43 < HUY_NGUYEN> i can't use that domain
03:44 < defswork> use that domain ?
03:44 < defswork> what does that mean ?
03:44 < HUY_NGUYEN> i configured: push "dhcp-option DNS 192.168.1.113"
03:44 < HUY_NGUYEN> ok
03:44 < HUY_NGUYEN> let i explain more detail
03:44 < HUY_NGUYEN> my office network
03:44 < HUY_NGUYEN> have the local dns server
03:44 < defswork> have you pushed domain name also  ?
03:44 < HUY_NGUYEN> such mycompanylocal.com
03:45 < HUY_NGUYEN> and the dns server is 192.168.1.113
03:45 < HUY_NGUYEN> that also the open vpn server
03:45 < HUY_NGUYEN> now, i access to vpn 
03:45 -!- CybDev [cybdev@abducted.by.aliens.org] has joined #openvpn
03:45 -!- CybDev [cybdev@abducted.by.aliens.org] has quit [Changing host]
03:45 -!- CybDev [cybdev@unaffiliated/cybdev] has joined #openvpn
03:45 < HUY_NGUYEN> but i can't use that domain 
03:45 < defswork> is your dns server configured to allow dns queries from the vpn subnet ? by default it will serve local lan only
03:45 < HUY_NGUYEN> really ?
03:45 < HUY_NGUYEN> i don't know that
03:45 < defswork> can't use that domain is not a term that make any technical sense
03:46 < defswork> HUY_NGUYEN, a sensible dns server will only allow local queries for local subnets
03:46 < HUY_NGUYEN> where can i found that configuration ?
03:46 < HUY_NGUYEN> named.conf ?
03:46 < defswork> indeed - or named.conf.local
03:46 < HUY_NGUYEN> ok, let i check it
03:47 < HUY_NGUYEN> because i have just check by wireshark
03:47 < HUY_NGUYEN> when the client request to the dns server
03:47 < defswork> add and acl "vpnclients" { 10.x.x.x; };
03:47 < HUY_NGUYEN> they dns server response with Refuse
03:47 < defswork> and add allow-query { "vpnclients" } to the zone definitions
03:47 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:47 < defswork> or add "vpnclients" to the existing allow-query acl
03:49 < HUY_NGUYEN> ok
03:49 < HUY_NGUYEN> let i try it
03:49 < HUY_NGUYEN> i'll let you know the result after some minutes
03:49 < defswork> sometimes I convince even myself that I might actually know something
03:49 < defswork> more often wrong that right though still :(
03:51 -!- HUY_NGUYEN_ [~HUY_NGUYE@115.78.129.190] has joined #openvpn
03:51 < HUY_NGUYEN_> @defswork: hi, it worked !!!
03:51 < defswork> congratulations on using bind
03:52 < defswork> could be much worse ;)
03:52 < HUY_NGUYEN_> @defswork: thank you so much. as you said, i just accept query from local network
03:52 < HUY_NGUYEN_> i have just add the range of vpn ips and now i worked
03:53 < defswork> cool - you have a lot to learn but keep hacking
03:53 < defswork> I used to be terrified of dns
03:53 < HUY_NGUYEN_> ok, thank all
03:53 < defswork> now I run nameservers for 30 odd domains
03:54 < HUY_NGUYEN_> ooh
03:54 -!- HUY_NGUYEN [~HUY_NGUYE@113.161.89.159] has quit [Ping timeout: 276 seconds]
03:54 < HUY_NGUYEN_> i just manage this domain for my company, just some small local services on it
03:55 < defswork> linux based ?
03:55 < HUY_NGUYEN_> yes
03:55 < HUY_NGUYEN_> centos
03:55 < HUY_NGUYEN_> and ubuntu
03:56 < defswork> I do a full time job but on the side look after a handful of other companies
03:56 < defswork> office networks, all open source
03:56 < defswork> samba, qmail, assp, bind, dhcp3, dovecot, roundcube, etc.. etc..
03:57 < HUY_NGUYEN_> yeah
03:57 < HUY_NGUYEN_> my role is voip admin, with some voip open sources
03:57 < defswork> I installed asterisk too
03:57 < defswork> have 6-7 sites
03:57 < HUY_NGUYEN_> i also help to manage our local network
03:57 < HUY_NGUYEN_> yeah
03:58 < defswork> did my first * install 5 years ago - it's still running - never skipped a beat
03:58 < defswork> my largest had 70-80 extensions
03:58 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:58 <@dazo> defswork: in a pure Linux environment where a shared network fs is wanted.  Would you use Samba or NFS?  Authentication and security is wanted to be as good as possible
03:59 < defswork> dazo, probably nfs 
03:59 < defswork> samba is heavy weight for something so simple
04:00 <@dazo> but how do you do user authentication on NFS?
04:01 < defswork> I don't know - I've only ever setup server to server static filesystems with it
04:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
04:02 <@dazo> yeah, I'm going to have laptops using this fs ... so it needs to be more dynamic ... and most likely pass over a VPN connection (road warrior setup) as well
04:04 < defswork> I might have a play with nfs today - I've been using sshfs for simple access to my home pc (my development projects are on it) but want to move that onto my home server so I don't need my pc on when I want to hack remotely
04:04 < defswork> and then I can nfs share to my local pc and to my pc in work
04:05 < defswork> network file sharing in linux has a massive gap in it imho - you've got NFS and then a chasm to SMB - theres nothing inbetween
04:06 < defswork> apart from a few fuser options like sshfs
04:12 -!- HUY_NGUYEN_ [~HUY_NGUYE@115.78.129.190] has quit [Quit: Leaving]
04:18 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15356> || Unable to connect Automaticly <http://forums.openvpn.net/topic8764.html>
04:19 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
04:33 -!- luneff [~yury@84.51.201.56] has quit [Quit: Leaving]
04:36 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
04:37 <@dazo> defswork: yeah, that's my feeling as well, re: netfs ... I just saw that one of the Samba developers preferred SMB over NFS (well, you eat your own dog food) ... CIFS/SMB2 seems to be better in many ways ... https://lwn.net/Articles/457552/
04:37 <@vpnHelper> Title: We won and we didn't notice (The H) [LWN.net] (at lwn.net)
04:37 <@dazo> (quite interesting comments)
04:52 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
04:55 -!- Ionic [ionic@ionic.de] has joined #openvpn
04:57 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
05:00 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html#p15357>
05:04 < defswork> I've converse with Jeremy Allison - found a bug in samba - he got me to do some stuff and sent me a patch to try 
05:04 < defswork> turned it arround in a day - was impressed
05:07 -!- norc [~norc@ns223862.ovh.net] has joined #openvpn
05:10 -!- p3rror [~mezgani@41.140.34.249] has joined #openvpn
05:12 < Ragnar> hi
05:12 < Ragnar> the push "dhcp-option DNS" doesnt seem to work?
05:13 < Ragnar> hm
05:13 < Ragnar> it doesnt complain about it
05:13 < Ragnar> I just dont get any dns server
05:13 < defswork> you did specify the IP of the DNS server didnt you ?
05:14 < defswork> try push "register-dns" also if windows clients
05:15 < defswork> -register-dns
05:15 < defswork>               Run net stop dnscache, net start dnscache, ipconfig /flushdns and ipconfig /registerdns on connection initiation.  This is known to kick Windows into recognizing pushed DNS servers.
05:18 < Ragnar> yeah I did
05:18 < Ragnar> push "dhcp-option DOMAIN loc"
05:18 < Ragnar> push "dhcp-option DNS 10.1.1.12"
05:19 < defswork> check the logs on the client then
05:22 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 268 seconds]
05:23 < Ragnar> defswork: 
05:23 < Ragnar> 7 11:21:54 2011 us=292420 PUSH: Received control message: 'PUSH_REPLY,route 192.168.60.1,topology net30,ping 10,ping-restart 60,route 192.168.60.0 255.255.254.0,route 192.168.20.0 255.255.255.0,dhcp-option DNS 192.168.20.$
05:23 < defswork> dhcp-option DNS 192.168.20.$ < whats that ?
05:24 < Ragnar> didnt read all of the line
05:24 < Ragnar> .$ means more is behind
05:24 < defswork> wheres the register-dns 
05:25 < Ragnar> takes awhile until the vpn profile on the server for this client updates
05:25 < Ragnar> wait.
05:25 < defswork> the what what ?
05:27 < Ragnar> WRRWRWRWRWed Sep  7 11:27:01 2011 us=377717 PUSH: Received control message: 'PUSH_REPLY,route 192.168.60.1,topology net30,ping 10,ping-restart 60,route 192.168.60.0 255.255.254.0,route 192.168.20.0 255.255.255.0,dhcp-option DNS 192.168.2$
05:27 < Ragnar> Wed Sep  7 11:27:01 2011 us=377924 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:9: register-dns (2.1.3)
05:30 < Ragnar> this is a debian machine that tries to connect as a client.
05:30 < Ragnar> update-resolv-conf doesnt do it either
05:30 < defswork> oh ok 
05:30 < defswork> register dns is windows only 
05:31 < defswork> I did say - "try push "register-dns" also if windows clients"
05:37 < Ragnar> oh, well
05:37 < Ragnar> sorry, I misread that.
05:37 < Ragnar> think the update-resolv might help?
05:38 < defswork> http://www.phocean.net/2006/12/07/openvpn-and-dns-on-a-linux-client.html < dunno how relevent that is today
05:38 <@vpnHelper> Title: OpenVPN and DNS on a linux client | Phocean.net / Computer Security (at www.phocean.net)
05:41 < Ragnar> apt-get install resolvconf
05:41 < Ragnar> and using the update-resolv-conf file fixed it.
05:44 -!- luneff [~yury@109.165.8.147] has joined #openvpn
05:47 -!- larsduesing [~lars@195.34.173.187] has joined #openvpn
05:50 < larsduesing> hi together
05:50 < larsduesing> I'm running into some problems with openvpn...
05:51 < larsduesing> Is it possible to connect multiple VPN-Endpoints together?
05:51 -!- sikker [~sikker@cpe.xe-3-0-0-3332.vbrnqu2.customer.tele.dk] has joined #openvpn
05:51 < larsduesing> (one central-vpn-server, and multiple vpn-clients that forward to complete networks)
05:52 < sikker> I want all VPN-users to be on the subnet 192.168.10.* -- how do  I go about it? I've heard talk about static routes..?
05:54 < defswork> sikker, define your pool as 192.168.10.....
05:54 < defswork> larsduesing, client-to-client
05:55 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
05:55 < sikker> defswork: additionally, the router's dhcp also gives us 10.* addresses. will the VPN work or conflict with that? if it conflicts I suppose I gotta set the pool outside the range of my router
05:55 < defswork> of course
05:56 < defswork> are you related to HUY_NGUYEN
05:56 < sikker> not that I know of
05:56 < larsduesing> defswork: Problem is: I'd like network-centralvpn-network
05:56 < defswork> larsduesing, how is that a problem ?
05:57 < larsduesing> It won't work
05:57 < defswork> sikker, as with all networking you need to ensure that you do not have conflicting subnets between your interconnecting networks
05:57 < larsduesing> it will only use one connection - if I add another one, there's no old connection
05:58 < defswork> larsduesing, I've no idea what you are talking about now
05:58 < larsduesing> hmm
05:58 < larsduesing> ok
05:58 < defswork> larsduesing, if you want to join networks via openvpn server then that is what it is designed to to
05:58 < larsduesing> yes
05:58 < larsduesing> second
05:59 < defswork> you just need to tell it to route between clients with client-to-client and also learn the networks behind each connection with iroute
05:59 < defswork> which you can specify in a ccd file
05:59 < larsduesing> ok
05:59 < larsduesing> I'll try
05:59 < defswork> you may also need to have the routes to the other networks defined in each network - but thats a routing issue not a vpn issue
06:00 < defswork> larsduesing, man openvpn and search for iroute and client-to-client
06:00 < larsduesing> ok
06:00 < larsduesing> thanks
06:01 -!- luneff [~yury@109.165.8.147] has quit [Quit: Leaving]
06:02 < defswork> larsduesing, are you trying to run multiple vpn connections to a single server to connect each remote subnet
06:02 < defswork> you dont need to do that - just route it all via the server over a single connection
06:02 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
06:02 < defswork> you can firewall off what shouldnt see what on the server
06:03 < sikker> defswork: if I set my router's DHCP to lease from .100 to .170, and let openvpn use .171+, will I be in the clear? the vpn server itself is located on .12
06:03 < defswork> only if your subnet masks isolate correctly
06:03 < larsduesing> defswork: oh, thanks
06:04 < defswork> dont think you can split on 171
06:05 < sikker> defswork: how does that work?
06:05 < defswork> sikker, is there any particular reason why you need vpn client on 192.168.10 ? and should you not be bridging if you want them to appear on the same lan ?
06:05 < sikker> defswork: bridging or whatever sounds fine. The fact of the matter is that I need users that connect to vpn to be able to access all servers on the .10 subnet
06:06 < defswork> sikker, theres no need for them to be on the same network at all then ?  Just make sure servers have route to vpn client subnet via vpn server
06:07 < sikker> defswork: I don't know enough to formulate the question like that. Which is why I ask to begin with. What you just said, I suggested in "I've heard talk about static routes..?" -- implying I have no idea how to do it :)
06:07 < defswork> sikker, is your vpn server your network's default gateway ?
06:07 < sikker> It is not.
06:08 < defswork> ok
06:08 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
06:08 < defswork> so your vpn server hands out 192.168.123.* to clients - they all have their default gateway set at connect to the vpn server (or you have specific route to your lan instead)
06:09 < defswork> all you need to do on the servers is add a route to 192.128.123.0/24 via vpn server's lan address
06:09 < sikker> wait, just to make sure you got me right, the vpn is *not* the network's default gateway
06:10 < defswork> yes - thats why you need the static routes on the servers that vpn clients will connect to
06:10 < defswork> this is the cleanest way to do this - everything is straight forward routing
06:10 < defswork> you can get dirty and nat clients
06:10 < defswork> so to the servers on your lan they see connections all come from the vpn server and not the clients
06:11 < defswork> but if you dont understand static routes I think natting might be out of your reach
06:11 < defswork> or you can put vpn clients on same subnet and use bridging instead
06:11 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:11 < defswork> but I shy away from bridging
06:12 < defswork> routing is clean
06:12 < defswork> visible 
06:12 < defswork> and obvious
06:13 < defswork> natting loses your the ability to track specific client connections on the destination servers
06:13 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:13 -!- mode/#openvpn [+v Axeman] by ChanServ
06:15 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
06:15 <@vpnHelper> RSS Update - forum: Incorporate technology to fend off website fingerprinting <http://forums.openvpn.net/topic8760.html#p15358>
06:25 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 240 seconds]
06:27 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
06:39 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:46 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
06:46 -!- p3rror [~mezgani@41.140.34.249] has quit [Ping timeout: 245 seconds]
06:47 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
06:48 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 258 seconds]
06:48 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
06:51 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:02 <@vpnHelper> RSS Update - forum: How do I set the metric? <http://forums.openvpn.net/topic8759.html#p15359>
07:09 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:13 -!- p3rror [~mezgani@41.249.4.229] has joined #openvpn
07:20 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
07:20 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15361>
07:22 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
07:23 -!- sikker [~sikker@cpe.xe-3-0-0-3332.vbrnqu2.customer.tele.dk] has quit [Read error: Operation timed out]
07:32 <@vpnHelper> RSS Update - forum: Limit LAN Access in Bridged Setup <http://forums.openvpn.net/topic8765.html>
08:02 <@vpnHelper> RSS Update - forum: Script username but not password <http://forums.openvpn.net/topic8762.html#p15363>
08:06 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:08 <@vpnHelper> RSS Update - forum: Script username but not password <http://forums.openvpn.net/topic8762.html#p15364>
08:14 <@vpnHelper> RSS Update - forum: How do I set the metric? <http://forums.openvpn.net/topic8759.html#p15365>
08:33 <@vpnHelper> RSS Update - forum: How do I set the metric? <http://forums.openvpn.net/topic8759.html#p15366>
08:36 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
08:39 <@vpnHelper> RSS Update - forum: Limit LAN Access in Bridged Setup <http://forums.openvpn.net/topic8765.html#p15369> || How do I set the metric? <http://forums.openvpn.net/topic8759.html#p15368> || Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15367>
08:43 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:45 -!- SpacePandaCPM [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
08:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
09:00 -!- rommel092079 [475e9252@gateway/web/freenode/ip.71.94.146.82] has joined #openvpn
09:00 < rommel092079> I would like to ask if I can put more than one port directive in the server.conf?
09:03 -!- master_of_master [~master_of@p57B5455E.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:03 <@vpnHelper> RSS Update - forum: Limit LAN Access in Bridged Setup <http://forums.openvpn.net/topic8765.html#p15370>
09:03 -!- rommel092079 [475e9252@gateway/web/freenode/ip.71.94.146.82] has quit [Client Quit]
09:04 -!- master_of_master [~master_of@p57B53A49.dip.t-dialin.net] has joined #openvpn
09:09 <@vpnHelper> RSS Update - forum: How do I set the metric? <http://forums.openvpn.net/topic8759.html#p15371>
09:13 -!- Squidy_at_Home [~quassel@189.75.75.158] has joined #openvpn
09:21 <@vpnHelper> RSS Update - forum: How do I set the metric? <http://forums.openvpn.net/topic8759.html#p15373>
09:34 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 264 seconds]
09:38 -!- luneff [~yury@109.165.8.147] has joined #openvpn
09:38 <@vpnHelper> RSS Update - forum: verifying the device connecting to OpenVPN server? <http://forums.openvpn.net/topic8766.html> || How do I set the metric? <http://forums.openvpn.net/topic8759.html#p15374>
09:40 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
09:40 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
09:40 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
09:40 -!- Squidy_at_Home [~quassel@189.75.75.158] has quit [Ping timeout: 264 seconds]
10:02 -!- p3rror [~mezgani@41.249.4.229] has quit [Read error: Connection reset by peer]
10:02 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15376>
10:11 -!- drfreeze [~Jim@207.191.114.82] has quit [Read error: Connection reset by peer]
10:11 -!- drfreeze [~Jim@207.191.114.82] has joined #openvpn
10:14 -!- Axeman [~Axeman3@198.105.46.48] has joined #openvpn
10:14 -!- Axeman [~Axeman3@198.105.46.48] has quit [Changing host]
10:14 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:14 -!- mode/#openvpn [+v Axeman] by ChanServ
10:17 -!- p3rror [~mezgani@41.140.31.92] has joined #openvpn
10:31 < norc> I have a virtual machine with NAT (with port forwarding) set up so machines from the internet can access services on the guest OS. Now I need a service that's only accessible from the host OS - can I do that?
10:32 < defswork> firewall ?
10:32 < norc> err?
10:33 < norc> Say I run an SSHD inside the guest OS and have set up port forwarding, can I simply access it via localhost:whateverport ?
10:33  * defswork checks the channel name
10:34 < norc> Oo
10:34 < norc> I'm still a bit confused with all this virtualization
10:34 < defswork> the V in openvpn doesn't mean virtualisation
10:35 < defswork> but you should have multiple IP addresses on the VM PC NIC which will be in promiscuous mode, the virtual hosts will have different IP addresses to the host pc
10:36 < defswork> you should be able to access the host or vm by it's IP
10:36 < defswork> if you want to lock that down to host pc only access then use local firewall rules 
10:36 <@vpnHelper> RSS Update - forum: How do I set the metric? <http://forums.openvpn.net/topic8759.html#p15377>
10:36 < defswork> (I'm guessing all this)
10:43 <@vpnHelper> RSS Update - forum: verifying the device connecting to OpenVPN server? <http://forums.openvpn.net/topic8766.html#p15378>
10:43 -!- p3rror [~mezgani@41.140.31.92] has quit [Ping timeout: 246 seconds]
10:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
10:47 -!- raidz1 [~Administr@50-76-49-94-ip-static.hfc.comcastbusiness.net] has quit [Quit: Leaving.]
10:48 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:48 -!- mode/#openvpn [+o raidz] by ChanServ
10:52 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 250 seconds]
10:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:56 -!- dazo is now known as dazo_afk
10:57 -!- p3rror [~mezgani@41.140.154.99] has joined #openvpn
10:57 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
11:04 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
11:04 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
11:04 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
11:05 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Ping timeout: 260 seconds]
11:07 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
11:07 <@vpnHelper> RSS Update - forum: Limit LAN Access in Bridged Setup <http://forums.openvpn.net/topic8765.html#p15379>
11:13 -!- p3rror [~mezgani@41.140.154.99] has quit [Ping timeout: 245 seconds]
11:17 -!- luneff [~yury@109.165.8.147] has quit [Quit: This computer has gone to sleep]
11:32 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 276 seconds]
11:32 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
11:43 <@vpnHelper> RSS Update - forum: Web based GUI <http://forums.openvpn.net/topic8767.html>
11:44 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
11:45 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
11:53 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:22 -!- luneff [~yury@84.51.201.56] has joined #openvpn
12:24 -!- EugeneKaway is now known as EugeneKay
12:30 -!- albech [~thomas@183.88.76.109] has quit [Quit: Ex-Chat]
12:33 -!- DennisG [~Dennis@52494EED.cm-4-2b.dynamic.ziggo.nl] has joined #openvpn
12:37 < DennisG> hello - it looks like openvpn isnt reading the ccd-directory. Config file: http://pastebin.com/aqZjKNCb, log snippet: http://pastebin.com/2NE0LtT0. Problem is that in /etc/openvpn/ccd/richard-internet there is a line which says 'push "redirect-gateway def1"' but as seen in the log snippet it looks like it doenst read the ccd file
12:39 < DennisG> i forgot to mention that the logfile does not give an error about the ccd directory at all
12:43 < ecrist> verb 5, please
12:43 < DennisG> lets see
12:45 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
12:46 < DennisG> ecrist: http://pastebin.com/27G1PS6Z
12:48 -!- SpacePandaCPM is now known as is
12:48 -!- is is now known as nolongerSpacePan
12:48 -!- nolongerSpacePan is now known as cpm
12:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
12:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
13:02 < ecrist> DennisG: client log, too, please
13:04 < DennisG> one moment
13:06 < DennisG> ecrist: http://pastebin.com/ueYaR0p4
13:09 < hyper_ch> !howto
13:09 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:12 < ecrist> DennisG: the file name matches the cn, right?
13:14 < DennisG> yes
13:14 < DennisG> the common name is 'richard-internet', the ccd file is /etc/openvpn/ccd/richard-internet
13:15 < ecrist> does user openvpn have rights to read the file/dir?
13:15 < DennisG> yes
13:16 < DennisG> -rw-r--r-- 1 openvpn nogroup   29 Sep  7 18:47 richard-internet
13:23 < EugeneKay> What's the perms on the dir
13:24 < DennisG> drw-r--r--  2 openvpn nogroup 4096 Sep  7 18:48 ccd
13:24 < EugeneKay> Needs +x
13:27 < DennisG> hmm, that did the trick.. thank you :)
13:29 < DennisG> hmm, looks like i was too quick, it doesnt work
13:31 < hyper_ch> hmmm, anyone knows how to get tap/tun drivers on android?
13:31 -!- DennisG [~Dennis@52494EED.cm-4-2b.dynamic.ziggo.nl] has quit []
13:33 < _Sam--> hyper_ch :  what android version, and what device?   
13:34 < hyper_ch> 2.3 / notion ink adam
13:34 < _Sam--> i have tun.ko for some 2.2 devices.
13:34 < _Sam--> but not for 2.3 , my device doenst have 2.3 source code out yet to make tun.ko for it
13:37 < hyper_ch> and I can't even install openvpn on the galaxy s3
13:37 < hyper_ch> s2
13:39 < hyper_ch> hmmm....
13:47 < ecrist> hyper_ch: cyanogen mod had a tun device.  there is no tap device for android at this point.
13:47 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
13:48 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:48 < hyper_ch> hmmmm, ok
13:52 -!- Ionic [ionic@ionic.de] has joined #openvpn
13:58 < _Sam--> hyper_ch :  its not much an answer to your question -- but you could always consider setting up a quick pptp vpn for your android.   i had to do that for mine.
14:00 <@vpnHelper> RSS Update - forum: Installed worked .... <http://forums.openvpn.net/topic8768.html>
14:06 <@vpnHelper> RSS Update - forum: Installed worked .... <http://forums.openvpn.net/topic8769.html>
14:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:09 < krzee> im stepping into that one late
14:09 < krzee> hyper_ch, i use openvpn on android often
14:10 < krzee> what ecrist said is my #1 suggestion, just use cyanogenmod and everything is done already
14:10 < krzee> in fact they built openvpn into the gui interface
14:10 < hyper_ch> well, I wanted to have access to the vpn so I could access a voip server without punching holes into the firewall
14:10 < krzee> aka, what i do
14:10 < krzee> hehe
14:11 < hyper_ch> instead I just opened ports 5060-5080
14:11 < krzee> Dougy, you here?
14:12 < _Sam--> be easier to just open pptp port than to install custom roms, open up SIP ports, etc.
14:12 < _Sam--> but whatever works for ya.
14:14 < _Sam--> you could also consider getting the dyndns mobile client, and opening up your firewall to your dyndns android host.
14:14 < _Sam--> i have some stuff that does that every minute
14:15 < ecrist> _Sam--: you're um, silly
14:16 < ecrist> why is it 'easier' to open a pptp port than SIP ports?
14:16 < _Sam--> cause its just one :)
14:16 < _Sam--> well 2 if you somehow include the GRE protocol
14:17 -!- Squidy_at_Home [~quassel@189.75.75.158] has joined #openvpn
14:17 < _Sam--> i would guess, its just my opinion -- no facts here -- that its probably more secure to open up pptp than SIP , anyway.
14:17 < ecrist> a guess it would be
14:18 < ecrist> pptp is broken, especially compared to SIPs and SRTP
14:18 < _Sam--> i didnt realize sip had encryption on 5060
14:18 < _Sam--> so you are sending your credentials across in plain text
14:18 < ecrist> no, you can encrypt that data
14:18 < _Sam--> you CAN, but most people DONT
14:19 < ecrist> well, we're not talking about the behvior patters of $random_people
14:19 < ecrist> we're talking about whether a protocol can be secured.
14:19 < ecrist> the answer is, it can be
14:19 < _Sam--> no, we're talking about the BEST ane EASIEST way for an android user to securely connect to their shit.
14:20 < _Sam--> and if he cant use openvpn client, then what is that?
14:20 -!- k4v [~kav@g226089235.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
14:20 < ecrist> BEST and EASIEST is to use SIPs/SRTP to a supported VOIP server
14:20 < ecrist> 1) no vpn 2) no custom rom
14:20 < ecrist> :)
14:20 < _Sam--> that makes the assumption that its easier to setup SIPs than it is to setup PPTP :)
14:20 < ecrist> see now, you keep changing the rules
14:21 < ecrist> this isn't about voip server admin
14:21 < _Sam--> its about connecting to a VPN, without the ability to have openvpn client on androind.
14:22 < _Sam--> all i know is that my phone has no tun.ko available.  i needed access to my vpn.   i installed pptp.  it took 10 mins, and my problems were solved.
14:22 < _Sam--> ymmv
14:23 < Optic> moo mooo moooo
14:23 < _Sam--> in addition to that, i also have firewall rules to let my android devices acceess servers, based on the android devices dyndns ips.
14:25 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:25 -!- mode/#openvpn [+v s7r] by ChanServ
14:26  * ecrist claps
14:26 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 245 seconds]
14:26 < _Sam--> ecrist :  so for all of your android users, you just tell them to flash custom roms?
14:26 < _Sam--> thats a practical answer there.
14:27 < ecrist> yup, that's what we tell them.
14:27 < ecrist> :)
14:27 < _Sam--> :)
14:28 < ecrist> !android
14:28 <@vpnHelper> "android" is (#1) the easiest way to get openvpn on android is to run cyanogenmod, since it comes with tun / busybox / and i think the new version even includes openvpn! or (#2) if you already have tun/root/busybox you can use android-openvpn-installer and openvpn-settings from the market
14:28 < _Sam--> geez now there's some new info :)
14:29 < _Sam--> the fact that a user would need to 'root' his android phone in order for openvpn to work properly is enough to suggest PPTP in and of itself, imo
14:29 < ecrist> well, this isn't #pptp
14:29 < ecrist> feel free to peddle your wares there.
14:30 < _Sam--> feel free to give the guy the tun.ko he needs.
14:30 < ecrist> shh, people are working
14:34 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
14:34 < hyper_ch> how can I test if a upd port is open on a server?
14:35 < ecrist> nmap -sU -p <port> <remote_addr>
14:39 < hyper_ch> as I suspected
14:40 < hyper_ch> it's closed
14:40 < hyper_ch> thx ecrist
14:40 < hyper_ch> you're a true genious
14:42 < ecrist> :)
14:47 < hyper_ch> I hate that zyxel modem/router
14:56 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
15:00 < krzee> _Sam--, this is not an android support channel, tun support in linux is needed for openvpn, but is not part of openvpn
15:00 < krzee> if they can find their tun.ko for their kernel, fine, if not, we do in fact recommend cyanogenmod7
15:00 < krzee> which btw is the only rom i choose to use
15:19 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
15:20 -!- Squidy_at_Home [~quassel@189.75.75.158] has quit [Read error: Connection reset by peer]
15:36 -!- hpa [hpa@terminus.zytor.com] has quit [Ping timeout: 255 seconds]
15:52 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: Leaving]
15:54 -!- jaminja [~jaminja@76.76.24.43] has quit [Ping timeout: 260 seconds]
15:58 <@vpnHelper> RSS Update - forum: how to make 1 account per session? <http://forums.openvpn.net/topic8770.html>
16:04 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
16:13 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
16:28 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
16:37 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
16:39 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
16:40 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 240 seconds]
16:42 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
16:49 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
16:50 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Quit: >:o]
16:51 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
16:53 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Client Quit]
16:55 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
16:57 -!- k4v [~kav@g226089235.adsl.alicedsl.de] has joined #openvpn
16:59 -!- Squidy_at_Home [~quassel@189.75.75.158] has joined #openvpn
16:59 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Client Quit]
17:00 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
17:04 <@vpnHelper> RSS Update - forum: OVPN Client suddenly receiving Unexpected Error <http://forums.openvpn.net/topic8771.html>
17:20 -!- [dEviL-bOy] [~edgar@41.88.103.84.rev.sfr.net] has joined #openvpn
17:24 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
17:26 -!- hq320 [~ident@113.49.191.90.dyn.estpak.ee] has quit [Read error: Connection reset by peer]
17:27 -!- hq320 [~ident@113.49.191.90.dyn.estpak.ee] has joined #openvpn
17:33 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
17:37 -!- Ionic [ionic@ionic.de] has joined #openvpn
17:42 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Quit: Leaving]
17:46 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
17:46 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
17:48 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:52 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Quit: leaving]
17:52 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
17:52 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
17:52 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
17:56 -!- [dEviL-bOy] [~edgar@41.88.103.84.rev.sfr.net] has quit [Quit: real world]
18:00 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Quit: leaving]
18:04 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
18:05 -!- jaminja [~jaminja@85.17.232.145] has quit [Disconnected by services]
18:20 -!- k4v [~kav@g226089235.adsl.alicedsl.de] has quit [Ping timeout: 264 seconds]
18:22 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
18:35 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
18:43 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
18:43 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
19:16 -!- _julian_ [~quassel@hmbg-4d06e8e0.pool.mediaWays.net] has joined #openvpn
19:17 -!- _julian [~quassel@hmbg-5f764622.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:27 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
19:27 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
19:35 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Read error: Operation timed out]
19:35 -!- Kartagis [~iegg@unaffiliated/kartagis] has quit [Read error: Operation timed out]
19:35 -!- Kartagis [~iegg@unaffiliated/kartagis] has joined #openvpn
19:40 -!- sadurag99 [~sadurag99@dyn-129-78-251-132.wirelessguest.usyd.edu.au] has joined #openvpn
19:45 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
19:45 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
19:45 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
20:19 -!- Denial [Denial@drgi.co.uk] has quit []
20:33 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:41 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
20:42 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
20:53 -!- Squidy_at_Home [~quassel@189.75.75.158] has quit [Remote host closed the connection]
20:54 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
20:57 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
20:58 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Ping timeout: 264 seconds]
20:58 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 264 seconds]
20:59 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
20:59 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
21:04 -!- luneff [~yury@84.51.201.56] has quit [Quit: This computer has gone to sleep]
21:10 -!- luneff [~yury@84.51.201.56] has joined #openvpn
21:10 <@vpnHelper> RSS Update - forum: iPhone WiFi Personal Hotspot and OpenVPN <http://forums.openvpn.net/topic8772.html>
21:35 -!- webdawg [~webdawg@99-11-90-167.lightspeed.nsvltn.sbcglobal.net] has joined #openvpn
21:36 < webdawg> When I want to run openvpn as an unprivileged user how should I create that user?
21:36 < webdawg> I am trying to do this:
21:36 < webdawg> http://pastebin.com/9DMkQJig
21:42 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
21:56 -!- will [~sadurag99@li334-230.members.linode.com] has joined #openvpn
21:57 -!- will is now known as Guest60878
21:57 -!- sadurag99 [~sadurag99@dyn-129-78-251-132.wirelessguest.usyd.edu.au] has quit [Ping timeout: 264 seconds]
22:04 -!- Guest60878 [~sadurag99@li334-230.members.linode.com] has quit [Ping timeout: 260 seconds]
22:08 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
22:09 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:30 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
22:58 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
22:59 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
23:10 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
23:10 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has joined #openvpn
23:19 -!- norc_ [~norc@ns223862.ovh.net] has joined #openvpn
23:20 -!- nullz0r [null@hyperion.epimeros.org] has joined #openvpn
23:22 -!- norc [~norc@ns223862.ovh.net] has quit [Ping timeout: 260 seconds]
23:39 -!- albech [~thomas@183.88.77.154] has joined #openvpn
23:42 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn []
23:42 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
23:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
23:56 < hyper_ch> hmmm, I still have that speed issue... after chaing to tcp for a few day, it got slower, now I changed by to udp and it's slow .....
--- Day changed Thu Sep 08 2011
00:00 < hyper_ch> the tcp-nodely flag made it slower again
00:08 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has joined #openvpn
00:11 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has joined #openvpn
00:24 -!- K1ng` [~k1ng@58.97.132.210] has joined #openvpn
00:24 -!- K1ng` [~k1ng@58.97.132.210] has quit [Changing host]
00:24 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:25 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
00:30 < EugeneKay> I think we went through this the other day
00:31 < EugeneKay> TCP vs UDP is not the solution to missing fiber links
00:31 < EugeneKay> As for tcp-nodelay.... it's almost always a bad thing. 
00:32 < EugeneKay> The old analogy of the bus leaving the station with a single rider
00:34 < EugeneKay> ecrist - IMO, the android factoid needs to be changed
00:36 < EugeneKay> _Sam-- - the reason Android needs to be rooted/reflashed is the default kernel (usually) doesn't include a tun or tap driver. Blame upstream trying not to include the kitchen sink.
00:36 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 260 seconds]
00:38 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
00:38 < EugeneKay> It works out better for the 99% of Android users who don't use $DRIVER ;-)
00:47 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 240 seconds]
00:48 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:48 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
00:48 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
00:48 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
00:50 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
00:50 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 258 seconds]
01:09 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
01:27 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:32 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
01:39 -!- joako [~joako@opensuse/member/joak0] has joined #openvpn
01:40 < joako> I've setup an OpenVPN site-to-site but I can't pass traffic through the connection. Does anyone know the proper Linux firewall rule(s) I need to add so it can be working?
01:43 < Bushmills> !route
01:43 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
01:43 < Bushmills> !firewall
01:43 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
01:45 < Bushmills> hint: you remove firewall rules, you don't add them, if your firewall is too restrictive to allow traffic
01:45 < Bushmills> unless you add specific ACCEPT rules, but better start with firewall disabled
01:46 < EugeneKay> joako - you need to turn on IPv4 forwarding(in sysctl), and allow forwarding in/out the tun0 interface to your eth interface.
01:46 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:47 < EugeneKay> Bushmills - I prefer to run with implicit DROPs rather than ACCEPTs ;-)
01:47 < joako> Yes I already tried to issue the command iptables -A FORWARD -i tun+ -j ACCEPT but still traffic is not passed
01:47 < EugeneKay> You need to allow it out to your LAN as well ;-)
01:47 < joako> I can login to the client itself, and from there the VPN works, but only from there it seems
01:49 < joako> EugeneKay, I don't see anywhere in that documentation where it has the proper LAN rules...
01:51 < EugeneKay> I use -i tun0 -s $VPNSUBNET -d $LANSUBNET -j ACCEPT and -i eth0 -s $LANSUBNET -d $VPNSUBNET -j ACCEPT
01:51 < EugeneKay> (actually I -j it to a generic filtering table... no, I don't even trust my vpn links)
01:54 < joako> EugeneKay, And like that I only worry about the OpenVPN subnet, not the actual remote LAN subnet?
01:55 < EugeneKay> YOu'll want the remote LAN subnet
01:56 < joako> but it doesn't hurt if I have too many?
01:56 < EugeneKay> Well, I don't allow the 10.8.0.0/16 subnet through at all.
01:57 < EugeneKay> Again, no trust for my VPN links :-p
01:58 < joako> Neither way works
01:58 < EugeneKay> I'd have to poke through an iptables dump to be able to tell you waht you need to change.... and it's 2AM and I'm hungry.
01:59 < joako> actually I put tun0 instead of tun1... rebooting & starting over
01:59 < EugeneKay> That'll do it ;-)
02:00 < joako> can I just put iptables -i tun+ like the forward rule?
02:00 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:00 < joako> anyways I reboot and start over and use tun1 and still no traffic is passed
02:01 < EugeneKay> You can.
02:03 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
02:03 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:03 < joako> What I have is below. I need to figure out what rules allow full 2-way VPN access:
02:03 < joako> iptables -A FORWARD -i tun+ -j ACCEPT
02:03 < joako> iptables -i tun1 -s 172.20.12.0/23 -d 192.168.30.0/24 -j ACCEPT
02:03 < joako> iptables -i br0 -s 192.168.30.0/24 -d 172.20.12.0/23 -j ACCEPT
02:04 -!- kraut [~kraut@dyndsl-095-033-153-223.ewe-ip-backbone.de] has quit [Remote host closed the connection]
02:04 < joako> Using those rules or not using those rules yields the same results.
02:04 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
02:07 < joako> Does this mean it's trying to NAT the connection? 10.21.38.5 dev tun1  proto kernel  scope link  **src 10.21.38.6**
02:08 < EugeneKay> Not sure why you have a br0 involved there.... and remember that you need to poke at the firewalls on both ends.
02:08 < EugeneKay> But for me, it's 2AM, and I'm off to bed. I wish you luck.
02:09 < joako> br0 is the interface!
02:10 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 264 seconds]
02:11 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
02:21 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
02:23 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 264 seconds]
02:31 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
02:33 -!- EugeneKay is now known as EugeneKaway
02:41 -!- dazo_afk is now known as dazo
02:46 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:48 -!- joako [~joako@opensuse/member/joak0] has quit [Read error: Connection reset by peer]
03:26 -!- novaflash [~notme@openvpn/user/novaflash] has quit []
03:29 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
03:29 -!- mode/#openvpn [+v novaflash] by ChanServ
03:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:39 -!- blazer6969 [~blazer696@109.129.14.136] has joined #openvpn
04:44 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
04:51 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:52 -!- dazo is now known as dazo_afk
05:07 -!- qvarkk [53f8c0c6@gateway/web/freenode/ip.83.248.192.198] has joined #openvpn
05:08 < qvarkk> can someone please tell me the use for these values? KEY_CN, KEY_NAME, KEY_OU, PKCS11_MODULE_PATH, PKCS11_PIN
05:15 -!- jave [~user@92.35.206.18] has joined #openvpn
05:25 <@vpnHelper> RSS Update - forum: Can ping, but cannot route web traffic through VPN <http://forums.openvpn.net/topic8618.html#p15386>
05:32 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:37 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15387>
05:42 -!- qvarkk [53f8c0c6@gateway/web/freenode/ip.83.248.192.198] has quit [Quit: Page closed]
05:46 -!- twister004 [~chatzilla@59.90.104.109] has joined #openvpn
05:56 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
05:58 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Read error: Connection reset by peer]
05:58 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
06:00 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:00 -!- mode/#openvpn [+o mattock] by ChanServ
06:00 -!- MarKsaitis_ [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
06:04 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 264 seconds]
06:07 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15389>
06:33 -!- xfce_murderer [~marcin@bny34.neoplus.adsl.tpnet.pl] has joined #openvpn
06:33 < xfce_murderer> I need help configuring easy-rsa in openvpn... when doing things as written in the manual, I get error " No /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl-0.9.8.cnf file could be found"
06:34 < hyper_ch> xfce_murderer: ls -al /usr/share/doc/openvpn/examples/easy-rsa/2.0/
06:38 < xfce_murderer> hyper_ch: http://wklej.to/HcYve
06:38 <@vpnHelper> Title: Wklej.to - po prostu wklej to! - paste: HcYve (at wklej.to)
06:38 < hyper_ch> xfce_murderer: -rwxr-xr-x 1 root root  3190 2011-07-01 10:33 openssl-0.9.8.cnf.gz
06:38 < hyper_ch> notice anything?
06:39 < dropje> type: file openssl-0.9.8.cnf.gz ;)
06:39 < xfce_murderer> oh, yes :) thanks
06:39 < hyper_ch> and you don't want to use a newre openssl version?
06:40 < dropje> well i have to say that easy-rsa 1.0 and 2.0 is a bit confusing ;)
06:40 < xfce_murderer> so if I want newer version, I should only unpack the newest conf file?
06:41 < hyper_ch> you'd probably have to use that version that matches your openssl install
06:44 < xfce_murderer> ok, thank you very much
06:44 -!- xfce_murderer [~marcin@bny34.neoplus.adsl.tpnet.pl] has quit [Quit: Wychodzi]
06:50 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 264 seconds]
07:01 -!- Psi|4ward [~psi@DSL01.212.114.206.69.ip-pool.NEFkom.net] has joined #openvpn
07:02 < Psi|4ward> Hi, anyone knows how to bridge on the client-side
07:02 < Psi|4ward> i would include the vpn-server in the clients-network
07:03 -!- webdawg [~webdawg@99-11-90-167.lightspeed.nsvltn.sbcglobal.net] has quit [Quit: Leaving]
07:04 < hyper_ch> Psi|4ward: bridge client-side?
07:05 < Psi|4ward> yes, every pc on the clients-network should access the services on the server
07:05 < hyper_ch> just route them through the client that is connected to the vpn?
07:06 < Psi|4ward> dont know i routing is a good point cause SIP
07:06 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has joined #openvpn
07:08 < hyper_ch> it's not
07:08 < hyper_ch> having tht same issue
07:08 -!- norc [~norc@ns213461.ovh.net] has joined #openvpn
07:08 < Psi|4ward> so i need to bridge?
07:09 -!- norc [~norc@ns213461.ovh.net] has quit [Client Quit]
07:09 < hyper_ch> I have too little information
07:09 < Psi|4ward> ok, let me explain again
07:09 < Psi|4ward> ive a OpenVPN server hosting Asterisk with a public IP
07:10 < Psi|4ward> this one should included in a private network behind a firewall
07:10 < hyper_ch> !bridge
07:10 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
07:11 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
07:11 < hyper_ch> can't you just bind all clients into the vpn that need access to asterisk?
07:11 -!- norc_ [~norc@ns223862.ovh.net] has quit [Ping timeout: 240 seconds]
07:11 < Psi|4ward> yes i struggled with this but it seems everytime the OpenVPN-Server sets the bride
07:12 < Psi|4ward> but i tink i need to bridge the client
07:12 < hyper_ch> if the asterisk server is in the vpn
07:12 < hyper_ch> and the sip client is in the vpn
07:12 < hyper_ch> then there should be no issue
07:13 < Psi|4ward> no sip-clients are strewn in the private-network so i would haver one PC in the private-net to include the asterisk-server
07:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:13 < hyper_ch> I'm not following what you mean to say
07:14 < Psi|4ward> sip-client => openVPN-client => tunnel => asterisk
07:15 < hyper_ch> Psi|4ward: that will be a problem
07:15 < hyper_ch> that's the same problem I am facing
07:15 < hyper_ch> sip-cline (on android phone)  --internet-->   dsl/router (nat) ---> Freeswitch server
07:16 < hyper_ch> I'm planing to make the FS server the router of the network
07:16 < ecrist> EugeneKaway: oh?  what would you change it to?
07:16 < Psi|4ward> i havnt this choice
07:17 -!- xfce_murderer [~marcin@bny34.neoplus.adsl.tpnet.pl] has joined #openvpn
07:17 < hyper_ch> Psi|4ward: freeswitch offers several ways around but I couldn't get any to really work
07:18 < Psi|4ward> same with asterisk
07:18 < hyper_ch> Psi|4ward: I can establish the call
07:18 < xfce_murderer> hello again. I did build-ca successfully, but when I was trying to make keys for client and server, it asks me to do everything with  /.vars again... and even it doesn't help.
07:18 < hyper_ch> Psi|4ward: but the problem is the rts routing is wrong - so no audio
07:18 < Psi|4ward> currently im running an iax2-trunk for tunneling between two asterisk-boxes
07:19 < Psi|4ward> but this is an ugly solution
07:19 < hyper_ch> Psi|4ward: have a look here http://wiki.freeswitch.org/wiki/NAT ---> the autonat fails with the router/modem... the external profile asked for some user that I couldn't setup
07:19 <@vpnHelper> Title: NAT - FreeSWITCH Wiki (at wiki.freeswitch.org)
07:19 < hyper_ch> maybe it'll get you some ideas
07:20 < Psi|4ward> i wont struggle with the nat issue - so vpn, including the asterisk in my local-net sould solv the problems
07:28 -!- luckman212 [~irc@2001:470:1f07:1225:ec3d:ac06:21a2:ec00] has joined #openvpn
07:29 < hyper_ch> good luck
07:31 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
07:37 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
07:43 -!- MarKsaitis_ [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 260 seconds]
07:43 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
07:46 -!- dazo_afk is now known as dazo
07:48 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
07:50 -!- luckman212 [~irc@2001:470:1f07:1225:ec3d:ac06:21a2:ec00] has quit [Remote host closed the connection]
07:51 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 276 seconds]
07:52 < jave> I have an old openvpn config that works well . Now I would like to try to use "stonevpn" to generate certs, and NetworkManager to connect
07:52 < jave> somewhere this new connection fails
08:00 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:00 < ecrist> we have no idea what 'stonevpn' is and we don't support networkmanager
08:02 < jave> well ok fair enough
08:02 < jave> fyi stonevpn is just a wrapper to create certs for openvpn, like easy-rsa
08:07 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Ping timeout: 240 seconds]
08:09 -!- Netsplit over, joins: bragon
08:09 -!- Netsplit *.net <-> *.split quits: MrWGW, ph1l, kloeri, sobersabre, Psi|4ward, amir, CybDev, krphop, DarthGandalf, _____m,  (+8 more, use /NETSPLIT to show all of them)
08:09 -!- Netsplit over, joins: sia^pwnnt, fulgore, Ad0
08:09 -!- Netsplit over, joins: MrWGW
08:09 -!- EugeneKay [EugeneKay@eugenekay.com] has joined #openvpn
08:09 -!- Netsplit over, joins: dazo
08:09 -!- mode/#openvpn [+o dazo] by ChanServ
08:09 -!- sobersabre [~bilbo@85.64.9.157] has joined #openvpn
08:09 -!- Netsplit over, joins: CybDev, amir
08:09 -!- Netsplit over, joins: kloeri
08:09 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
08:10 -!- kenyon [~kenyon@2600:3c01::f03c:91ff:fe93:b0d1] has joined #openvpn
08:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:12 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
08:13 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
08:18 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
08:20 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has joined #openvpn
08:20 < steelnwool> Hello.
08:20 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
08:20 -!- Psi|4ward [~psi@DSL01.212.114.206.69.ip-pool.NEFkom.net] has joined #openvpn
08:21 < ecrist> hello
08:21 < steelnwool> scratching my head here on a new setup.
08:21 < ecrist> jave: I much prefer ssl-admin
08:21 -!- nb [~nb@fedora/nb] has joined #openvpn
08:22 < steelnwool> i can ssh to the vpn host, but hosts beyond it i can't. I did check and ip_forwarding is on. i know its route related, but need a bit of help understanding a part of routing. i'll explain.
08:22 < ecrist> steelnwool: I'm guessing the hosts beyond don't know how to route back to the vpn
08:22 < steelnwool> if my vpn network is 10.33.34.0/24 and my network i'm "vpn-ing" into is 10.33.33.0/24. when i type route on a host insidse the network, i should see routes back out to the VPN right ? even if the routes are assigned by the firewall and not explicitly on the host?
08:22 < ecrist> both ends need to to know to route to eachother.
08:23 < steelnwool> echrist, thats exactly it. 
08:23 < steelnwool> and i know thats the problem. but before i fix it on the broken setup, i want to verify my understanding on a working setup :)
08:23 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
08:25 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
08:25 < ecrist> steelnwool: you need to either put the route on that remote lan default gateway, or as a static route on each host on the remote side
08:25 < ecrist> where/how is up to you
08:25 < steelnwool> right. i got that part. see my question about about running the route commadn.
08:25 < steelnwool> or i can be more clear if it was all greek
08:26 < ecrist> traceroute will show you where your host thinks it's routing things
08:26 <@vpnHelper> RSS Update - forum: Limit LAN Access in Bridged Setup <http://forums.openvpn.net/topic8765.html#p15390>
08:27 -!- Psi|4ward [~psi@DSL01.212.114.206.69.ip-pool.NEFkom.net] has left #openvpn ["terminated"]
08:27 < steelnwool> ah ha. that made sense. the vpn gateway doesn't show up in route, cause the traffic hits the gateway first.
08:27 < steelnwool> thanks
08:28 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:29 < ecrist> I'd put the route on the gateway, were it me.
08:31 < steelnwool> yup. gonna. actually did, but its not working so that is what i'm debugging.
08:31 -!- darkdrgn2k4 [~darkdrgn2@216.234.33.35] has quit [Quit: Leaving]
08:37 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15391>
08:39 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
08:42 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:43 <@vpnHelper> RSS Update - forum: verifying the device connecting to OpenVPN server? <http://forums.openvpn.net/topic8766.html#p15393> || how to make 1 account per session? <http://forums.openvpn.net/topic8770.html#p15392>
08:44 -!- Mowee [~Mowi@lendabrain.net] has quit [Ping timeout: 264 seconds]
08:45 < ecrist> seems freenode should be exciting today
08:46 < steelnwool> oh?
08:46 < ecrist>  /mode +w steelnwool 
08:46 < ecrist> 08:06:41 [Freenode] -christel(christel@freenode/staff/exherbo.christel)- [Global Notice] Hi all, as previously promised today will be the day where the network goes up in flames... I mean, where we  carry out some upgrades to the ircd. I'm about to kill off a number of servers and the affected user count is ~8K! Hopefully this won't take long but I suggest you brace for impact..
08:47 < steelnwool> thuper.
08:50 < steelnwool> alright, i added the route via teh command line on the host, everything works. so for some reason my route on the gateway is just being stupid.
08:50 < steelnwool> actually, i'm being stupid and the gateway is suffering because of it.
08:50 -!- darkdrgn2k [~darkdrgn2@bas2-toronto44-1242515008.dsl.bell.ca] has joined #openvpn
08:50 < darkdrgn2k> hey guys
08:50 < darkdrgn2k> i just noticed one of my PCS got a Initialization Sequence Completed With Errors 
08:51 < darkdrgn2k> its a fluke, stars didnt align... and a restart of the openvpn service fixed it
08:51 < darkdrgn2k> is there a way to make openvpn automatically reconnect or error... or reconnect after x number of mins
08:52 < steelnwool> https://forums.openvpn.net/topic8321.html
08:52 <@vpnHelper> Title: OpenVPN Support Forum OPENVPN reconnect/resume after Provider initiated disconnect : Off Topic, Related (at forums.openvpn.net)
08:52 < steelnwool> 2 second google man.
08:52 -!- jave [~user@92.35.206.18] has quit [Ping timeout: 276 seconds]
08:52 < darkdrgn2k> maybe for you but i took 10 seconds to google and didnt come up with anything... guess i just didnt think of the right key words
08:52 < steelnwool> that happens to me as well. i used "openvpn reconnect on error"
08:53 < darkdrgn2k> hmm
08:53 < darkdrgn2k> i thought #persist-key
08:53 < darkdrgn2k> #persist-tun
08:53 < darkdrgn2k>  would make a less aggressive reconnect
08:57 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
09:00 -!- vaq [~vaq@91.74.71.128] has joined #openvpn
09:00 -!- albech [~thomas@183.88.77.154] has quit [Quit: Ex-Chat]
09:00 < vaq> Hello, i just installed openvpn access, when I try to connect, I see the error: SIGTERM[soft,port-share-redirect] received in the logfile
09:00 < vaq> any ideas?
09:01 < Bushmills> !windows
09:01 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
09:01 < ecrist> !as
09:01 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:02 -!- albech [~thomas@61.7.177.35] has joined #openvpn
09:02 -!- albech [~thomas@61.7.177.35] has quit [Max SendQ exceeded]
09:03 -!- albech [~thomas@183.88.77.154] has joined #openvpn
09:03 -!- master_of_master [~master_of@p57B53A49.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:04 < steelnwool> ecrist: that you know of. are there cases that prevent a gateway from pushing a route.. or whatever the right word is. ie i can ping client ip's from the gateway, but not from hosts using that gateway. like the route isn't being published or whatever the jargon is.
09:05 -!- master_of_master [~master_of@p57B52D49.dip.t-dialin.net] has joined #openvpn
09:06 < ecrist> firewall, perhaps,
09:07 < steelnwool> perhaps.
09:07 < ecrist> gateway_enabled="YES"
09:07 < steelnwool> its a juniper ssg5.
09:07 < steelnwool> so not gateway_enabled exactly
09:07 < ecrist> or sysctl net.inet.ip.forwarding=1 on most unix boxes
09:07 < ecrist> heh, juniper is freebsd.
09:08 < steelnwool> juniper is screen os ain't it? or is that just something on top  of freebsd.
09:08 < ecrist> the gateway doesn't really 'hand out' routes
09:08 < ecrist> it simply sends packets to the proper next hop.
09:08 < steelnwool> right.
09:08 < ecrist> juniper is freebsd under the hood.
09:08 < steelnwool> but it seems like its not "sharing"this route or whatever.
09:08 < ecrist> highly customized, but freebsd nonetheless
09:09 < steelnwool> the route works from the firewall it self. but not from hosts that use that firewall as a gateway.
09:09 < ecrist> if you run a traceroute, does the junpier show up in the route list?
09:09 < steelnwool> if i turn a traceroute, it just sits there. i'll pastebin it.
09:09 < ecrist> sounds more like a junpier question, I don't know, I don't use juniper
09:09 < steelnwool> word.
09:09 < ecrist> I use freebsd. ;)
09:09 < steelnwool> i have another one setup somewhere else and it works there. i bet i have an interface screwed up on juniper.
09:10 < steelnwool> http://pastebin.com/am2dCdXf 
09:11 < steelnwool> i pasted both results there.
09:11 < steelnwool> from teh linux host and the juniper it self.
09:15 < ecrist> looks to me like the junpier isn't allowing the route
09:15 < ecrist> I'd try #junpier
09:15 < ecrist> ;)
09:15 < steelnwool> yup. 
09:15 < steelnwool> thanks for your patience anyways.
09:15 < ecrist> no problem.
09:16 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has left #openvpn []
09:17 -!- vaq [~vaq@91.74.71.128] has quit []
09:23 < reiffert> I need some openvpn support.
09:23 < reiffert> os x, dev tap, why doesnt it work?
09:25 < reiffert> client see's the servers map address, thats all
09:25 < reiffert> s,map,mac,
09:25 < reiffert> that's how far the whole bunny comes.
09:25 -!- xfce_murderer [~marcin@bny34.neoplus.adsl.tpnet.pl] has quit [Quit: Wychodzi]
09:26 < krzee> reiffert, you installed tuntap right?
09:26 < reiffert> client sees some server multicast announcements.
09:26 < krzee> !osxtuntap
09:26 < krzee> !mactuntap
09:26 < reiffert> !factoids search --values osx
09:26 <@vpnHelper> "mactuntap" is http://tuntaposx.sourceforge.net/ for osX tuntap drivers
09:26 <@vpnHelper> 'mactuntap', 'ipforward', and 'osxboot'
09:26 < reiffert> krzee: yeah, that's what I use.
09:27 < krzee> ecrist ^  you use tap and osx, have anything to throw in there?
09:27 < krzee> (i only use tun)
09:28 < reiffert> client:
09:28 < reiffert> Thu Sep  8 16:28:12 2011 us=665924 /sbin/ifconfig tap0 10.8.14.2 netmask 255.255.255.0 mtu 1500 up
09:28 < ecrist> it works fine
09:29 < ecrist> well, i don't use that one
09:29 < ecrist> I use the one that comes with tunnelblick
09:29 < reiffert> which is the same.
09:29 < ecrist> works fine for m.e
09:29 < ecrist> me.*
09:31 < reiffert> let me bring the configs online
09:31 <@vpnHelper> RSS Update - forum: verifying the device connecting to OpenVPN server? <http://forums.openvpn.net/topic8766.html#p15394>
09:32 < ecrist> reiffert: do you have the mac's firewall enabled?
09:32 < ecrist> iirc, it's not enabled by default.
09:32 < reiffert> tun is working.
09:32 < reiffert> I'm about to change to tap. just for testing
09:32 < ecrist> you do know there's no bridge adapter for OS X, right?
09:32 < reiffert> jup
09:33 -!- radioxid [~radioxid@92.90.20.152] has joined #openvpn
09:33 < ecrist> FUCK ME
09:33 < ecrist> 10.7 has a bridge adapter
09:34 < reiffert> no really?
09:34 < reiffert> whooray.
09:34 < reiffert> whoever.
09:34 < reiffert> however.
09:34 < reiffert> tun works fine.
09:34 < reiffert> tap does not. what to do?
09:34 < reiffert> do I have to change anything beyond "dev tun" -> "dev tap"?
09:35 < krzee> if you use ipp, delete that
09:35 < krzee> or at least delete the file
09:35 < reiffert> dont have ipp
09:35 -!- radioxid [~radioxid@92.90.20.152] has quit [Client Quit]
09:35 < krzee> if you dont need bridging then you shouldnt need to change anything else (from what i know)
09:37 < reiffert> ecrist: does bridging work?
09:38 < ecrist> yes, it does!
09:39 < ecrist> I'm super excited
09:39 < ecrist> root@Swordfish:~-> ifconfig bridge0
09:39 < ecrist> bridge0: flags=8822<BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500
09:39 < ecrist> 	ether ac:de:48:68:65:f0 
09:39 < ecrist> 	Configuration:
09:39 < ecrist> 		priority 32768 hellotime 2 fwddelay 15 maxage 20
09:39 < ecrist> 		ipfilter disabled flags 0x2
09:39 < ecrist> 	member: en1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
09:39 < ecrist> 	         port 5 priority 128 path cost 2000000
09:39 < ecrist> 	member: tap0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
09:39 < ecrist> 	         port 10 priority 128 path cost 55
09:39 < ecrist> 	Address cache (max cache: 100, timeout: 1200)
09:39 < ecrist> booyah
09:39 < reiffert> time to buy lion.
09:41 < reiffert> (I was mailing 3 times to the apple kernel mailinglist about bridging btw, never got any response)
09:41 < dropje> reiffert: and what about dns
09:41 < dropje> which they broke
09:41 < reiffert> did they?
09:41 < dropje> yup
09:41 < dropje> and ldap
09:42 < reiffert> dropje: doubt that the kernel list is the right onw
09:42 < dropje> appendsearchsuffix is disabled 
09:42 < reiffert> e
09:42 < dropje> and dns is preferred over the hosts file
09:44 < reiffert> I really like the dns-server per domain feature.
09:44 -!- Kartagis [~iegg@unaffiliated/kartagis] has quit [Read error: Operation timed out]
09:45 < reiffert>  /sbin/ifconfig tap0 10.8.14.1 10.8.14.1 netmask 255.255.255.0 mtu 1500 up
09:45 < reiffert> that one looks wrong, does it?
09:46 < ecrist> it does
09:47 < reiffert> server 10.8.14.0 255.255.255.0
09:48 < reiffert> how does your working server config file look like?
09:48 < ecrist> mine?
09:48 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:48 < reiffert> yup
09:48 < gladiatr> mm hmm
09:50 < ecrist> reiffert: http://pastebin.com/TP2epBC3
09:52 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has joined #openvpn
09:55 < reiffert> thats on os x?
09:56 < ecrist> no, that's my freebsd server config
09:56 < ecrist> I imagine it would work just fine on os x.
09:59 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
10:00 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:02 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
10:04 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Excess Flood]
10:04 -!- APTX [APTX@unaffiliated/aptx] has quit [Excess Flood]
10:04 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
10:05 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
10:05 -!- APTX [APTX@unaffiliated/aptx] has quit [Excess Flood]
10:05 <@vpnHelper> RSS Update - forum: verifying the device connecting to OpenVPN server? <http://forums.openvpn.net/topic8766.html#p15395>
10:05 -!- jbb_ [~yeeb@184.105.219.149] has joined #openvpn
10:06 -!- jbb_ [~yeeb@184.105.219.149] has quit [Read error: Connection reset by peer]
10:07 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Excess Flood]
10:07 -!- jbb [~yeeb@184.105.219.149] has quit [Excess Flood]
10:09 -!- kenyon_ [~kenyon@darwin.kenyonralph.com] has joined #openvpn
10:10 -!- |Mike|_ [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
10:10 -!- meepmeep_ [meepmeep@212.24.104.229] has joined #openvpn
10:11 -!- _DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
10:11 -!- Xtrapni [~trapni@trapni.de] has joined #openvpn
10:11 -!- tty234_ [telex@gateway/shell/anapnea.net/x-xumwsqeekoldkxyr] has joined #openvpn
10:11 -!- sobersab1e [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
10:11 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
10:11 -!- somefatk1d [~administr@rrcs-24-213-178-60.nyc.biz.rr.com] has joined #openvpn
10:11 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:14 -!- sno-_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
10:14 -!- havoc [~havoc@neptune.chaillet.net] has quit [Disconnected by services]
10:15 -!- havoc__ is now known as havoc
10:16 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
10:17 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
10:18 -!- Netsplit *.net <-> *.split quits: Olipro
10:18 -!- Netsplit *.net <-> *.split quits: kloeri, sno-, kenyon, Hamlin, meepmeep, |Mike|, sobersabre, fbh, somefatkid, tty234,  (+5 more, use /NETSPLIT to show all of them)
10:18 -!- Olipro_ is now known as Olipro
10:18 -!- jbb [~yeeb@184.105.219.149] has quit [Excess Flood]
10:19 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
10:20 -!- jbb [~yeeb@184.105.219.149] has quit [Excess Flood]
10:21 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
10:22 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
10:23 -!- Netsplit over, joins: amero
10:23 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
10:24 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
10:25 -!- EvilGuru [~freddie@helium3.witherden.org] has joined #openvpn
10:25 -!- EvilGuru [~freddie@helium3.witherden.org] has quit [Changing host]
10:25 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has joined #openvpn
10:25 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
10:26 -!- jbb [~yeeb@184.105.219.149] has quit [Read error: Connection reset by peer]
10:26 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
10:28 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
10:28 <@vpnHelper> RSS Update - forum: Tools for testing max number of tunnels to my OV server <http://forums.openvpn.net/topic8773.html>
10:31 -!- Hamlin [~Hamlin@mountainmorningband.com] has joined #openvpn
10:31 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
10:31 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
10:35 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has left #openvpn []
10:40 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
10:46 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
10:49 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has quit [Ping timeout: 252 seconds]
10:58 <@vpnHelper> RSS Update - forum: Bandwith Problem <http://forums.openvpn.net/topic8774.html>
11:07 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
11:08 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
11:08 -!- jbb [~yeeb@184.105.219.149] has quit [Read error: Connection reset by peer]
11:08 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
11:11 -!- jbb_ [~yeeb@184.105.219.149] has joined #openvpn
11:11 -!- jbb_ [~yeeb@184.105.219.149] has quit [Read error: Connection reset by peer]
11:12 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has quit [Read error: Connection reset by peer]
11:13 -!- jbb_ [~yeeb@184.105.219.149] has joined #openvpn
11:15 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:17 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
11:18 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
11:20 -!- jbb_ is now known as jbb
11:22 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:29 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Ex-Chat]
11:37 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
11:40 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
11:42 < krzee>  9:41AM  up 296 days, 17:34, 3 users, load averages: 0.00, 0.00, 0.00
11:42 < krzee> shit i prolly need some updates... so lazy...
11:43 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has joined #openvpn
11:44 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
11:44 -!- twister004 [~chatzilla@59.90.104.109] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.1/20110830092941]]
11:52 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has joined #openvpn
11:53 < jeev> 09:53:32 up 819 days, 11:43, 1 user, load average: 0.00, 0.01, 0.00
11:53 < jeev> shit me too
11:55 -!- yourself22 [~yourself2@99-73-168-250.lightspeed.iplsin.sbcglobal.net] has joined #openvpn
11:57 -!- yourself22 [~yourself2@99-73-168-250.lightspeed.iplsin.sbcglobal.net] has quit [Remote host closed the connection]
11:58 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
12:02 <@vpnHelper> RSS Update - forum: Openvpn: problem bridge <http://forums.openvpn.net/topic8714-15.html#p15398>
12:08 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
12:13 -!- nneul [~nneul@mo-76-4-161-14.dhcp.embarqhsd.net] has joined #openvpn
12:13 -!- nneul [~nneul@mo-76-4-161-14.dhcp.embarqhsd.net] has quit [Client Quit]
12:14 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:17 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
12:22 < dschuett> what are first things to check if experiencing slow speeds over vpn?
12:27 < Essobi> Slow speeds outside of the vpn?
12:28 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 260 seconds]
12:28 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
12:28 < ScriptFanix> and packet drops / udp rate-limits
12:29 < dschuett> speed is fine outside of vpn
12:30 < ScriptFanix> some hosting companies voluntarily limit udp traffic
12:31 < krzee> also, mtu
12:31 < krzee> (not to take away from his answer, it was a good answer)
12:32 < Essobi> all seems logical to me
12:32 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:32 -!- mode/#openvpn [+v s7r] by ChanServ
12:34 -!- albech [~thomas@183.88.77.154] has quit [Quit: Ex-Chat]
12:47 -!- dazo is now known as dazo_afk
12:49 -!- Guest95179 [~Geek@2001:41d0:1:f38f::1337] has quit [Excess Flood]
12:49 -!- Cain [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
12:49 -!- Cain is now known as Guest16069
12:51 -!- Guest16069 [~Geek@2001:41d0:1:f38f::1337] has left #openvpn []
12:52 -!- Guest3078 [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
12:52 -!- Guest3078 [~Geek@2001:41d0:1:f38f::1337] has quit [Excess Flood]
12:52 -!- Cain` [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
12:53 -!- Cain` is now known as Guest85043
12:55 -!- Guest85043 [~Geek@2001:41d0:1:f38f::1337] has left #openvpn []
12:58 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 245 seconds]
13:08 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
13:08 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:10 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
13:10 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:13 -!- Janos [~Janos@186.32.185.5] has joined #openvpn
13:16 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
13:16 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has quit [Read error: Connection reset by peer]
13:16 < Janos> hey there, got a question/issue, i got some vpn road-warriors connecting with openvpn, the problem is that the network they are is the same as the network on the remote end of the vpn, i know i can overcome this with the redirect-gateway option, but this is a bit more complicated and it does not work, following is the actual network information
13:17 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
13:17 < krzee> i dont fully understand the issue
13:19 < Janos> the road-warrior lan is 192.168.0.0/24 and the remote lan accessible through the vpn is 192.168.0.0/22, the roadw can access 192.168.1.x and 192.168.2.x and 192.168.3.x but not 192.168.0.x even with the redirect-gateway option, from with i can gather this is due to the fact that even when the roadw vpn-client adds a route to the remote network with a lower metric, the windows still picks the more specific route 192.168.0.0/24 regardless of the metric
13:20 < Janos> s/with/what
13:21 < Janos> so the question, i could add three /24 routes to my clients instead of one /22, and this should solve the issue, but feels a bit unnatural, is there any other way to overcome this ?
13:24 < Janos> any information i failed to provide just let me know
13:33 < gladiatr> Janos, honestly, the best solution is to shut down your openvpn server instance, change the subnet then tell your clients to reconnect
13:36 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:40 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
13:41 < Janos> gladiatr, well i can't really change the network on my vpn server, because i would have to change a lot of things in my network, besides there is always the possibility that a client will get the same subnet no matter what i choose, so i'll go with passing 192.168.0.0/24 and 192.168.0.0/22 to the client, this should fix the issue
13:42 < gladiatr> righto
13:42 < Janos> gladiatr, thanks for the answer, just wanted to make sure there was no "best practice" for this situation
13:43 < gladiatr> for future reference, pick something out of the 10/8 block.   That 192.168 block is evil
13:43 < gladiatr> all those bloody wireless aps
13:45 < Janos> you are right, but again, i've seen a lot of 10 and 172.16 with /24 out there too, so there is always a chance...
13:46 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:48 < Janos> good thing is openvpn is flexible enough to allow an artificial solution :)
13:48 < gladiatr> indeed
13:51 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has quit [Read error: Connection reset by peer]
13:53 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
13:55 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15399>
13:56 -!- luckman212 [~irc@2001:470:1f07:1225:ec3d:ac06:21a2:ec00] has joined #openvpn
13:59 -!- gffa [~gffa@unaffiliated/gffa] has quit [Read error: Connection reset by peer]
13:59 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has joined #openvpn
14:00 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has quit [Changing host]
14:00 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
14:04 -!- nifiga [niko@luchshe.vdalnete.ru] has joined #openvpn
14:04 < nifiga> !welcome
14:04 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:05 < nifiga> :\
14:05 < krzee> why the :/
14:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
14:13 < ecrist> because he has to do all that reading.
14:14 < krzee> he hasnt even found links to read yet!
14:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:15 < krzee> the bot should answer every 5th question with "its your firewall"
14:15 < krzee> i bet it would be more accurate than not, lol
14:16 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
14:19  * ecrist could code that
14:37 < nifiga> good day. I'm using openvpn server and clients each with their own certificate. Can I make redirect-gateway to affect only some users, not everyone?
14:37 < ecrist> sure
14:37 < ecrist> !ccd
14:37 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
14:37 < nifiga> mm
14:38 < nifiga> thanks, I'll try that :)
14:43 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
14:43 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has quit [Remote host closed the connection]
14:46 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
14:47 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
15:00 -!- dschuett [~dschuett@wsip-68-15-229-108.om.om.cox.net] has quit [Ping timeout: 276 seconds]
15:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:08 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 260 seconds]
15:10 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:18 -!- dschuett [~dschuett@ip68-13-28-62.om.om.cox.net] has joined #openvpn
15:22 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
15:22 -!- dschuett [~dschuett@ip68-13-28-62.om.om.cox.net] has quit [Ping timeout: 258 seconds]
15:30 -!- somefatk1d [~administr@rrcs-24-213-178-60.nyc.biz.rr.com] has quit [Ping timeout: 253 seconds]
15:32 -!- somefatkid [~administr@63.138.254.154] has joined #openvpn
15:35 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
15:36 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
16:05 <@vpnHelper> RSS Update - forum: Branding Tips and Howto's <http://forums.openvpn.net/topic8775.html>
16:13 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:23 -!- rbd [~rbd@cpe-076-182-045-156.nc.res.rr.com] has joined #openvpn
16:24 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:25 < rbd> hey guys, using openvpn 2.2.1 with openvpn gui on windows 7 x64. connected to pfsense 2.0rc3 via TCP, tun on port 443. having an issue on the windows box where quite often when I am bringing up a new public internet webpage in chrome for instance, the CPU will max out (well one core will at least and it will make the UI unresponsive for a bit). I am not tunneling internet traffic through the 
16:25 < rbd> VPN either (verified through "route print"). any ideas what this could be?
16:27 < ecrist> heh
16:27 < ecrist> !tcp
16:27 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
16:27 < ecrist> you may be running into that
16:35 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
16:39 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Client Quit]
16:44 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
16:48 < Essobi> Yo dawg.. I heard you like TCP.
16:51 -!- SeriousSam_ [kvirc@shpd-78-36-191-16.static.vologda.ru] has joined #openvpn
16:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
16:54 < SeriousSam_> Hi everybody! I tried to do as it described in this manual http://openvpn.net/index.php/open-source/documentation/install.html?start=1 but it does not work. I have two machines with Wndows with disabled firewalls, antivirus, etc. I get the message "RESOLVE: Cannot resolve host address: [192.168.***.***]: [NO_DATA] The requested name is valid but does not have an IP address." What is wrong?
16:54 <@vpnHelper> Title: Installation (Win32) - Page 2 (at openvpn.net)
16:55 < SeriousSam_> Both ping each other of course
16:56 < rbd> ecrist: ok. only reason I went with TCP is b/c I thought it would help with tunneling on 3g provider networks and at some hotspots
16:57 < rbd> ah, I can set up multiple openvpn servers though, so I'll do that
16:58 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
17:01 -!- luckman212 [~irc@2001:470:1f07:1225:ec3d:ac06:21a2:ec00] has quit [Quit: No Ping reply in 180 seconds.]
17:03 -!- Janos [~Janos@186.32.185.5] has quit [Quit: Leaving]
17:05 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
17:07 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:23 -!- SeriousSam_ [kvirc@shpd-78-36-191-16.static.vologda.ru] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.3 Shiny(svn-3438) http://www.kvirc.net]
17:29 <@vpnHelper> RSS Update - forum: Bandwith Problem <http://forums.openvpn.net/topic8774.html#p15401>
17:34 -!- Guest47122 [~crash@CPE-70-92-236-80.wi.res.rr.com] has joined #openvpn
17:37 -!- Guest47122 [~crash@CPE-70-92-236-80.wi.res.rr.com] has left #openvpn []
17:37 -!- cr4ah [~crash@CPE-70-92-236-80.wi.res.rr.com] has joined #openvpn
17:37 < cr4ah> a
17:37 < cr4ah> hello
17:39 -!- cr4ah [~crash@CPE-70-92-236-80.wi.res.rr.com] has left #openvpn []
17:42 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 246 seconds]
17:42 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
17:44 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
17:51 -!- k4v [~kav@g226093059.adsl.alicedsl.de] has quit [Read error: Operation timed out]
17:54 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:57 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
18:03 -!- jaminja [~jaminja@85.17.232.145] has quit [Ping timeout: 260 seconds]
18:07 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
18:16 -!- Grleaf [Guess@cpe-72-224-94-160.maine.res.rr.com] has quit [Ping timeout: 260 seconds]
18:17 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
18:20 -!- Squidy [~quassel@189.75.75.158] has joined #openvpn
18:20 -!- Squidy [~quassel@189.75.75.158] has quit [Changing host]
18:20 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
18:23 -!- drfreeze [~Jim@207.191.114.82] has left #openvpn []
18:41 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
18:46 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 250 seconds]
18:47 -!- jaminja [~jaminja@85.17.232.145] has quit [Ping timeout: 260 seconds]
18:48 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
18:52 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
19:00 -!- jaminja [~jaminja@85.17.232.145] has quit [Ping timeout: 252 seconds]
19:00 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
19:01 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
19:13 -!- _julian [~quassel@hmbg-4d06d7c8.pool.mediaWays.net] has joined #openvpn
19:17 -!- _julian_ [~quassel@hmbg-4d06e8e0.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
19:34 <@vpnHelper> RSS Update - forum: getting an open NAT in residence <http://forums.openvpn.net/topic8777.html>
19:43 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.in]
19:44 -!- nb [~nb@fedora/nb] has joined #openvpn
19:52 <@vpnHelper> RSS Update - forum: DDWRT + OpenVPN - Possibility of Detection/Leaks? <http://forums.openvpn.net/topic8778.html>
20:10 -!- blazer6969 [~blazer696@109.129.14.136] has quit [Ping timeout: 245 seconds]
20:20 -!- Denial [Denial@drgi.co.uk] has quit []
20:32 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 245 seconds]
20:32 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
20:34 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
20:43 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
20:49 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
20:51 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Client Quit]
20:52 -!- gardar_ [~gardar@gardar.net] has quit [Ping timeout: 240 seconds]
20:57 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Remote host closed the connection]
21:00 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
21:02 <@vpnHelper> RSS Update - forum: iPhone WiFi Personal Hotspot and OpenVPN <http://forums.openvpn.net/topic8772.html#p15404>
21:03  * EugeneKay turns on some elevator muzak
21:04 < ecrist> rbd: still doesn't make sense to run tcp inside tcp usually
21:04 < EugeneKay> It makes less sense to run udp inside tcp
21:05 < ecrist> exactly
21:09 -!- Xgates [~Xgates@gateway/tor-sasl/xgates] has joined #openvpn
21:09 < Xgates> hey guys
21:10 < Xgates> for the ca.crt, client.crt and private.key in Linux/Unix should the permissions on these files be 600?
21:10 < ecrist> need to be whatever they need to be for the openvpn process to use them
21:11 < Xgates> well for a key if you run it at 644 then the console will spit this back at you;  WARNING: file '/etc/openvpn/keys/foo.key' is group or others accessible
21:11 < Xgates> using 600 removes that warning and I believe makes the file more secure...
21:12 < Xgates> ecrist: I don't believe what you said is a correct view on permissions and their usage in OpenVPN because you can literally make them anything you want and it's going to work
21:12 < EugeneKay> Again, depends what user you're running openvpn as. 600, 640, or 660 is generally what you'll want it to be.
21:13 -!- gardar [~gardar@gardar.net] has joined #openvpn
21:13 < ecrist> Xgates: you're retarded
21:13 < EugeneKay> ecrist - I thought we were being nice to the users? :v
21:13 < Xgates> sorry what do you mean 'depends what user you're running openvpn'
21:14 < ecrist> if openvpn is run as 'nobody' and your files are owned as joe:joe, and permissions are 600, 'nobody' will be unable to read, since the 'other' permission is set to none
21:14 < Xgates> ecrist: look I've been running Unix 11 years what you said made no sense so try and think about it and really chill out 
21:14 < EugeneKay> Well, you have the user who's running openvpn, and the user who owns /etc/openvpn
21:14 < EugeneKay> If you've been running *nix for 11 years, you should know that.
21:15 < Xgates> yes it's who owns...
21:15 < Xgates> 600 or 644 work just fine for OpenVPN in any situation
21:15 < ecrist> however, if you're running openvpn as root, root can read any file, so it doesn't matter much.
21:15 < ecrist> no
21:15 < ecrist> 600 is different than 644
21:15 < ecrist> try 'man chmod'
21:15 < EugeneKay> Letting your private.key be o+r is a bad idea. Always.
21:15 < Xgates> I know that I'm saying you can run OpenVPN with either perms
21:16 < EugeneKay> You can run it with whatever permissions you like. If you want security, 660 or less is what you want.
21:16 < Xgates> I personally thought for better security you'd want them all as 600
21:16 < EugeneKay> You want them at 400 ;-)
21:16 < ecrist> read the man page
21:17 < EugeneKay> keys/crts are unlikely to change substantially once they've been generated
21:18 < Xgates> I know what chown and chmod are, my bad I guess I explained this wrong, I mean does OpenVPN have a standard permission they want you to use for improving security in Unix/Linux?
21:19 < Xgates> or you're saying just anything below 660 is acceptable>
21:19 < Xgates> ?
21:19 < EugeneKay> No. Consult your UNIX Expert Best Practices handbook.
21:19 < EugeneKay> I recommend 400.
21:19 < ecrist> no, you've been running unix for 11 years, you should know
21:19 < Xgates> ecrist: I said did OpenVPN have a standard... :)
21:20 < Xgates> that's all I'm asking...
21:20 < Xgates> sometimes in applications there is a method to use, etc...
21:20 < ecrist> no
21:20 < ecrist> we don't care what your permissions are
21:21 < Xgates> well I don't recall anything in the online docs for setting up OpenVPN, but you'd think there would be some mention of this...
21:21 < Xgates> 400 yes just making it only readable would be the best....
21:21 < ecrist> there isn't
21:21 < ecrist> because we don't care
21:23 < Xgates> well saying we don't care is suppose to mean what to the general public who isn't very experienced, that no matter what perms you use it isn't going to really matter because the way in which the application is being used security can't be compromised because of this...
21:23 < Xgates> this is sort of my point...
21:23 < ecrist> go away, troll
21:24 < Xgates> I'm not a troll I'm just trying to learn something and you're being an idiot
21:24 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:24 < EugeneKay> OpenVPN is not a Magical and Revolutionary thing. It does what it says on the tin. You are recommended to use something akin to 660 or 640 or 440 or 400, but overanalysing the situation will not earn you any love.
21:24 < ecrist> file permissions are a basic 'thing' and aren't really related directly to openvpn
21:24 < EugeneKay> All thatm atters to OpenVPN is that it can fopen() the bloody things. 
21:25 < EugeneKay> That's it.
21:25 < Xgates> ok I get the point OpenVPN has not recommendation, so you just use best Unix/Linux practices is all... thanks....
21:25 < Xgates> has no...
21:25 < ecrist> and, you can figure that out by reading the man page for chmod
21:25 < ecrist> no problem. :)
21:26 < Xgates> BUT the reason I brought this up, because if you've used Unix as long as I have, then you'd know there are certain applications, scripts, etc. that do require certain permissions....
21:26 < EugeneKay> This isn't one of them. </story>
21:26 < Xgates> ok
21:26 < ecrist> heh
21:27 < ecrist> I've been using it a tad long, sir
21:27 < ecrist> longer*
21:27 < Xgates> I just thought OpenVPN might of wanted the user to use certain perms for the certs and keys was all, there is some info floating around where people seem to be under the impression it does....
21:27 < Xgates> anyhow now that I see it doesn't thanks... :
21:27 < ecrist> no, because openvpn doesn't care
21:27 < Xgates> :)
21:32 < Xgates> one last thing, user nobody group nobody, my understanding is this is just to improve security on the client side?
21:36 < Xgates> thanks guys later...
21:36 -!- Xgates [~Xgates@gateway/tor-sasl/xgates] has quit [Quit: Ping Timeout (0 Nano seconds)]
21:42 <@vpnHelper> RSS Update - forum: OpenVPN MI GUI v20110902 problem! <http://forums.openvpn.net/topic8779.html>
21:47 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: No route to host]
21:48 <@vpnHelper> RSS Update - forum: OpenVPN Client - windows, routing (default route) <http://forums.openvpn.net/topic8780.html> || Split DNS - Is this possible? <http://forums.openvpn.net/topic8737.html#p15406>
21:50 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
21:59 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:59 -!- EugeneKay is now known as EugeneKaway
22:11 -!- amero [~amero@unaffiliated/amero] has quit [Read error: Operation timed out]
22:13 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
22:20 -!- EugeneKaway is now known as EugenePants
23:00 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:01 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
23:01 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:02 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has quit [Ping timeout: 260 seconds]
23:06 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has joined #openvpn
23:36 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has quit [Ping timeout: 260 seconds]
23:37 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has joined #openvpn
23:43 <@vpnHelper> RSS Update - forum: How-to: Tunnel WAN IP assigned to specific users <http://forums.openvpn.net/topic8559.html#p15408>
23:43 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has joined #openvpn
--- Day changed Fri Sep 09 2011
00:25 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
00:27 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Client Quit]
00:29 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 245 seconds]
00:30 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:33 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
01:00 -!- hq320 [~ident@113.49.191.90.dyn.estpak.ee] has quit [Read error: Connection reset by peer]
01:00 -!- hq320 [~ident@46.246.124.51] has joined #openvpn
01:01 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:05 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:06 < krzee> ecrist, can you check on butters?
01:14 < hyper_ch> hi krzee
01:16 -!- k4v [~kav@g226089093.adsl.alicedsl.de] has joined #openvpn
01:21 -!- soreau [~soreau@unaffiliated/soreau] has joined #openvpn
01:21 -!- soreau [~soreau@unaffiliated/soreau] has left #openvpn []
01:49 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 260 seconds]
01:52 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
01:59 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
02:04 -!- dazo_afk is now known as dazo
02:14 -!- [DeVil-BoY] [~dude@41.88.103.84.rev.sfr.net] has joined #openvpn
02:14  * [DeVil-BoY] hello
02:14 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
02:14 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:15 <@vpnHelper> RSS Update - forum: Windows 2003 - Server cannot ping client. <http://forums.openvpn.net/topic8781.html#p15412>
02:17 < [DeVil-BoY]> quick question, if i install open vpn server on a machine and then i connect to it, do i get access to ressources on the whole network or just to the machine i've installed openvpn on?
02:18 < EugenePants> Depends entirely upon your firewall and routing rules.
02:19 < [DeVil-BoY]> can you explain with a bit more detail
02:19 < EugenePants> If your OpenVPN server is the default gateway for the LAN, then it's possible that "just setting up OpenVPN" will let you access the LAN from one of the clients.
02:20 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:20 < EugenePants> This is because LAN machines will route traffic for the VPN IP back to their default gw, which happens to be the same machine as the OpenVPN server.
02:20 < EugenePants> If it ISNT the default gw for the LAN, then packets or LAN machines will go out of the openvpn server, to the LAN, and then on to whatever the default gw IS. It won't know diddly about how to route it back into OpenVPN, so they'll be dropped.
02:21 < EugenePants> These scenarios are also dependent upon your OpenVPN server's firewall rules allowing them to leave to the LAN in the first place, as well as your NAT settings.
02:22 < [DeVil-BoY]> in my case then, it will be a machine on the LAN, not configured as a gateway but as a normal client
02:22 < EugenePants> You shouldn't be able to receive traffic back from the server's LAN from a client, but you may be able to send packets from the client to LAN machines.
02:22 < [DeVil-BoY]> using NAT, and i would set up some firewall rules to allow the openvpn server recieve incoming connections
02:23 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
02:23 < EugenePants> If you enable NAT for the openvpn subnet, it'll work
02:23 < EugenePants> You also need to enable packet forwardin
02:23 < EugenePants> (I'm assuming you're using Linux)
02:23 < [DeVil-BoY]> on the machine that i will be installing open vpn yes
02:24 < [DeVil-BoY]> i've actualy tried, but i didnt get very far on my configuration and testing
02:24 < [DeVil-BoY]> thought it would be simpler
02:24 < [DeVil-BoY]> to set up
02:24 < EugenePants> OpenVPN is one piece of the networking puzzle needed to make a VPN system work
02:25 < [DeVil-BoY]> so there's more pieces?
02:25 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
02:25 < [DeVil-BoY]> could i use the built in vpn client in windows to make a connetion?
02:25 < EugenePants> No. Windows VPN client does not speak openvpn.
02:25 < EugenePants> You need the Windows OpenVPN app
02:25 -!- soreau [~soreau@unaffiliated/soreau] has joined #openvpn
02:26 -!- MissingPerson [~corey@123.234.61.82] has joined #openvpn
02:26 < [DeVil-BoY]> ok, at least that's sorted
02:27 < [DeVil-BoY]> is this the one: openvpn-2.2.1
02:27 < [DeVil-BoY]> ??
02:27 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 260 seconds]
02:27 -!- soreau [~soreau@unaffiliated/soreau] has left #openvpn []
02:27 < MissingPerson> i'm having a problem in ubuntu 11.04 getting openvpn w/ password working, after importing the configuration settings provided by my vpn provider, it says "The VPN connection failed because there are no valid VPN secrets."  This never happened to me on Fedora, unsure what to do.  I do have openvpn and network-manager-openvpn-gnome installed
02:27 < EugenePants> That's the current version, yes. I dunno what package you're looking at, sadly.
02:27 < EugenePants> Per the /topic: I'm not psychic
02:28 < [DeVil-BoY]> no that's cool, i only asked because i've downloaded before openvpn-client.msi and it didn't get me anywhere
02:29 < [DeVil-BoY]> plus i had an error on install, something related to unsigned drivers
02:29 < EugenePants> MissingPerson - I(and a lot of people) basically refuse to support third-party OpenVPN "services"(no access to the server side). Also, you're using NetworkManager, which is "teh suck", and an Ubuntu other than 10.04 LTS.... So, sorry :-p
02:30 < [DeVil-BoY]> basically it's linux or get lost
02:30 < EugenePants> Googling the error message suggests that it's a non-openvpn VPN related issue, so.... double check that it's actually using an OpenVPN client.
02:30 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
02:31 < EugenePants> Nonsense. Windows, BSD, Linux, Android, and even iPhone(though I don't own one) work great.
02:31 < MissingPerson> EugenePants: I know it is, because that's the configuration I used on Fedora not some 48 hours ago, and it WAS working, with network-manager.
02:31 < EugenePants> It's lack of server-side access that makes debugging difficult-to-impossible.
02:31 < EugenePants> MissingPerson - like I said, sorry, I really don't speak NetworkManager at all. If you try via the openvpn service, I'd be happy to peer at a client.log(with verb 5) and point you in the right direction.
02:32 < EugenePants> (My anti-Ubuntu biases are a different issue, stemming from a bad experience involving clownfish)
02:32 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:33 < [DeVil-BoY]> what's the command in linux to check running daemons?
02:33 < EugenePants> Generally speaking? service <service-name> status.
02:33 < EugenePants> More useful information can be obtained by running tail -f on the relavent logfile
02:35 < MissingPerson> EugenePants: Barring me switching to LTS (I'm not), what setup would you suggest for openvpn?
02:36 < EugenePants> The openvpn daemon, which you can control as a service.
02:36 < EugenePants> IIRC it's provided by the openvpn package.
02:37 < MissingPerson> well, there is a gadmin-open-vpn-client is that usable at least?  i prefer a frontend
02:37 < EugenePants> Honestly? No idea.
02:38 < EugenePants> If you can get the networkmanager thingy to spit out a proper openvpn.log, that'd be fine to ook at
02:40 < MissingPerson> i could for sure provide messages from syslog
02:41 < EugenePants> If that's where it's spitting them out, that'd be fine
02:45 < MissingPerson> i'm waiting for pastebin to work, it's taking forever
02:45 < MissingPerson> i'm in china, hence the need for this to just start working
02:47 < MissingPerson> ugh, i can't seem to get them on pastebin
02:48 < MissingPerson> ok to just paste here, it's like 5 lines
02:48 < MissingPerson> ok, oops, seven
02:48 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
02:49 < MissingPerson> Sep  9 15:31:33 147isMOBILE NetworkManager[4649]: <info> Starting VPN service 'openvpn'...
02:49 < MissingPerson> Sep  9 15:31:33 147isMOBILE NetworkManager[4649]: <info> VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 4776
02:49 < MissingPerson> Sep  9 15:31:34 147isMOBILE NetworkManager[4649]: <info> VPN service 'openvpn' appeared; activating connections
02:49 < MissingPerson> Sep  9 15:31:34 147isMOBILE NetworkManager[4649]: <info> VPN plugin state changed: 1
02:49 < MissingPerson> Sep  9 15:31:34 147isMOBILE NetworkManager[4649]: <info> VPN plugin state changed: 3
02:49 < MissingPerson> Sep  9 15:31:34 147isMOBILE NetworkManager[4649]: <info> VPN connection 'SB-Hong-Kong' (Connect) reply received.
02:49 < MissingPerson> Sep  9 15:31:34 147isMOBILE NetworkManager[4649]: <warn> VPN connection 'SB-Hong-Kong' failed to connect: 'No VPN secrets!'.
02:51 < EugenePants> !paste
02:51 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
02:51 < EugenePants> And that's from NetworkManager, not the underlying openvpn. 
02:51 < EugenePants> So..... somethign big wrong with your config,
02:52 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has quit [Ping timeout: 260 seconds]
02:53 < MissingPerson> now the daemon is configured via commandline, right?
02:54 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
02:54 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 260 seconds]
02:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
02:55 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:55 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 260 seconds]
02:58 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has joined #openvpn
02:59 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:01 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 240 seconds]
03:02 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
03:02 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 250 seconds]
03:04 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:05 -!- zastaph [zastaph@unaffiliated/zastaph] has joined #openvpn
03:05 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
03:06 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
03:07 < EugenePants> via .conf files, usually in /etc/openvpn/
03:08 -!- _DexTerDDIT is now known as DexTerDDIT
03:12 -!- Guest7206 [~nb@delta.nb.tc] has joined #openvpn
03:12 < MissingPerson> any easy way i can convert *.ovpn files into those config files easily?
03:13 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
03:13 -!- mode/#openvpn [+v novaflash] by ChanServ
03:13 < EugenePants> Rename them :-p
03:14 < MissingPerson> oh...lol
03:14 < MissingPerson> fair
03:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
03:19 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
03:20 -!- mode/#openvpn [+o vpnHelper] by ChanServ
03:20 -!- jave [~user@92.35.216.205] has joined #openvpn
03:20 < jave> hello
03:21 < jave> im tryig to find some form of openvpn setup that is easy for a fedora or ubuntu user to setup
03:21 < jave> like a frontend or something
03:22 < Bushmills> there are lots of interactive openvpn configuration frontends. they are called "editors"
03:22 < jave> I've been trying nm-openvpn with spectacularily unimpressive results
03:22 < Bushmills> !ubuntu
03:22 <@vpnHelper> "ubuntu" is dont use network manager!
03:22 < EugenePants> Once you have the client.conf setup, it's either On or Off. There's no need for a fancy GUI app.
03:23  * Bushmills thinks of multi language support
03:23 < jave> I have a perfectly working setup. its for new users that are inexperienced
03:23 < EugenePants> Oy, 3AM again. :-(
03:24 < EugenePants> I need to fix my sleep schedule or screw it up so bad it's fixed.
03:26 < jave> hmm maybe i should just package up the config in debs and rpms
03:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:34 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:38 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
03:43 < Olipro> EugenePants: inorite
03:47 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
03:48 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:50 < hyper_ch> jave: just provide them a couple of default configs
03:52 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
03:57 < jave> were talking inexperienced users here. but ill think of something
04:03 -!- MissingPerson [~corey@123.234.61.82] has quit [Ping timeout: 260 seconds]
04:10 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:10 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:10 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:12 -!- albech [~thomas@61.7.176.128] has joined #openvpn
04:22 -!- Ad0 [~ad0@callstack.info] has left #openvpn []
04:23 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
04:24 -!- zastaph [zastaph@unaffiliated/zastaph] has quit []
04:26 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
04:41 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Read error: Operation timed out]
04:48 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:50 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
05:10 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
05:17 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:17 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
05:18 -!- sobersab1e [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 260 seconds]
05:19 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
05:19 <@vpnHelper> RSS Update - forum: OpenVPN MI GUI v20110902 problem! <http://forums.openvpn.net/topic8779.html#p15413>
05:20 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:23 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
05:23 -!- kkk999 [~dks@114.143.165.10] has joined #openvpn
05:24 < kkk999> Hello all I need to set up a vpn server in my own network...can u plz help me out?
05:24 < Bushmills> !howto
05:24 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:24 <@vpnHelper> RSS Update - forum: Memory Leakage - OpenVPN <http://forums.openvpn.net/topic8782.html>
05:31 -!- wzzx [~wz@unaffiliated/wzzx] has joined #openvpn
05:31 -!- wzzx [~wz@unaffiliated/wzzx] has left #openvpn []
05:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
05:33 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
06:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
06:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:30 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:37 -!- Irssi: #openvpn: Total of 158 nicks [5 ops, 0 halfops, 2 voices, 151 normal]
06:37 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
06:38 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
06:38 -!- mode/#openvpn [+o vpnHelper] by ChanServ
06:39 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
06:46 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
06:46 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:53 -!- luckman212 [~irc@2001:470:1f07:1225:ec3d:ac06:21a2:ec00] has joined #openvpn
06:54 -!- k4v [~kav@g226089093.adsl.alicedsl.de] has quit [Ping timeout: 276 seconds]
06:56 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
06:56 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has joined #openvpn
07:08 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
07:08 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has joined #openvpn
07:10 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:12 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
07:12 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has joined #openvpn
07:31 -!- [DeVil-BoY] [~dude@41.88.103.84.rev.sfr.net] has quit []
07:37 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:37 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
07:57 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:15 -!- sadurag99 [~sadurag99@124-168-42-124.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
08:17 -!- SeriousSam_ [kvirc@shpd-92-101-186-156.vologda.ru] has joined #openvpn
08:17 < SeriousSam_> Hi there! I have the following situation. I have two computers with OpenVPN installed on each. The first machine is Windows XP SP3. The second is Debian. There is OpenVPN session started on Windows. And when I try to start OpenVPN on Debian in command line it works fine. Connection is established. But if I use OpenVPN GUI for Gnome (in Network connections) it writes that "VPN connection failed".
08:17 < SeriousSam_> By the way I use tap device. When I uncheck this checkbox it starts normal (but connection with remote computer is not established of course)
08:18 < Bushmills> SeriousSam_: seems that there's a problem with "openvpn gui for gnome"
08:18 < Bushmills> well, don't use it then, or configure it properly
08:19 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:20 < SeriousSam_> i want to learn to configure it properly then. There is no separate channel for "openvpn for gnome" (or am I wrong?)
08:20 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:20 < Bushmills> apt-cache search "openvpn gui for gnome"   yields no hits on debian, so i don't even know what gui that is.
08:21  * dazo guesses NetworkManager-openvpn plug-in
08:21 < SeriousSam_> dazo: I use it
08:21 < SeriousSam_> Is it in Network Connections?
08:22 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
08:22 < SeriousSam_> one moment
08:23 <@dazo> SeriousSam_: I don't know about Debian .... but Ubuntu has managed to cripple their NM-openvpn plugin to become a useless piece of shit (or waste of disk space, as other says) ... I don't know if Debian has one the same mistake, but it sounds so by now
08:24 -!- k4v [~kav@g226089093.adsl.alicedsl.de] has joined #openvpn
08:24 < SeriousSam_> the package name is "network-manager-openvpn-gnome"
08:24 < SeriousSam_> dazo: it is very sad
08:25 <@dazo> SeriousSam_: there's another GUI which behaves more similar to the Windows version (it does very sensible thing, using proper config files instead of GUI for edit) ... it's called gopenvpn ... not sure if  that's easily accessible in Debian, but that's a much better solution for Linux than the NM crap
08:26 < SeriousSam_> dazo: Thanks a lot!
08:28 < SeriousSam_> dazo: Do you mean gadmin-openvpn-client and gadmin-openvpn-server?
08:29 <@dazo> probably not
08:30 <@dazo> http://gopenvpn.sourceforge.net/
08:30 <@vpnHelper> Title: gopenvpn (at gopenvpn.sourceforge.net)
08:30 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Quit: Leaving]
08:30 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
08:34 -!- satonio [~satonio@147.Red-83-34-206.dynamicIP.rima-tde.net] has joined #openvpn
08:34 < satonio> hi
08:35 < SeriousSam_> dazo: ok thanks, I will try it
08:36 -!- masterkorp [~masterkor@static.34.107.46.78.clients.your-server.de] has joined #openvpn
08:37 < masterkorp> hello, where can i list the tap devices on a windows client ?
08:37 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:38 < dropje> masterkorp: Start > Run > ncpa.cpl ?
08:38 < satonio> today dns resolution stopped to work when connected throught the vpn. im using dnsmasq
08:38 < satonio> any idea about how to find the problem?
08:39 < ecrist> openvpn isn't going to suddenly cause traffic inside it to stop working
08:39 < ecrist> look at your dns settings
08:39 < dropje> satonio: can you ping your dns server?
08:39 < satonio> you mean the openvpn server?
08:39 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
08:40 < dropje> satonio: is your DNS server running on your openvpn server?
08:40 < satonio> i'm using dnsmasq on the same machine as the openvpn sever
08:40 < satonio> to forward that kind of traffic
08:40 < masterkorp> dropje: nothing there
08:40 < masterkorp> dropje: but i created a tap0801
08:41 < satonio> http://library.linode.com/networking/openvpn/ubuntu-10.04-lucid#sph_tunnel-all-connections-through-the-vpn its configured that way
08:41 <@vpnHelper> Title: Secure Communications with OpenVPN on Ubuntu 10.04 (Lucid) – Linode Library (at library.linode.com)
08:42 < dropje> masterkorp: if it's not there you prolly didnt install the tap device properly
08:43 < dropje> satonio: is it still running? can you query from that machine using dnsmasq?
08:43 < masterkorp> dropje: let me show the screenshot, config and logs
08:43 < satonio> dropje, how can i test it?
08:43 < dropje> linux or windows?
08:44 < satonio> linux
08:44 < dropje> dig
08:44 < dropje> e.g. dig google.com @127.0.0.1
08:44 < satonio> that on the server
08:44 < masterkorp> dropje: http://omploadr.org/vYTlxaw
08:45 < satonio> it works
08:45 < masterkorp> dropje: http://ompldr.org/vYTlxaw
08:45 < dropje> what OS is your client running? windows or linux?
08:46 < satonio> and in the client it works too if i specify the ip
08:46 < dropje> masterkorp: what are you trying to accomplish? install a tap adapter for use with OpenVPN GUI?
08:46 < satonio> dropje, linux too
08:46 < dropje> satonio: check your /etc/resolv.conf
08:46 < masterkorp> dropje: config http://pastie.org/2508504
08:47 < masterkorp> dropje: the server is linux, this particular client is windows 7
08:47 < satonio> dropje, what should be there?
08:47 < dropje> and you want to install the OpenVPN GUI masterkorp ?
08:48 < dropje> download the OpenVPN installer for Windows from openvpn.net, not openvpn.se
08:48 < satonio> http://pastebin.com/s4BxpjCd
08:48 < dropje> satonio: it should say nameserver x.x.x.x <--- internal ip adres of your dns server
08:48 < masterkorp> dropje: hmm
08:49 < satonio> hmmm
08:49 < masterkorp> dropje: i only get the openvpn connect 
08:49 < masterkorp> dropje: that shows me to connect to so pais proxys
08:50 < masterkorp> dropje: can you gime me the link ?
08:50 < dropje> masterkorp: http://swupdate.openvpn.org/community/releases/openvpn-2.2.1-install.exe
08:50 < satonio> wait i was disconnected
08:50 < satonio> hmmmm the same
08:51 < dropje> satonio: what do you mean?
08:52 < satonio> i wasn't connected to the vpn when i checked that
08:52 < satonio> and then it didn't changed
08:52 < satonio> also i'm trying dig google.com @80.58.61.250
08:52 < satonio> from the vpn server and it fails
08:52 < dropje> satonio: if you're connecting from the command line you have to use update-resolv-conf script to update your resolv.conf
08:53 < dropje> what is 80.58.61.250?
08:53 < masterkorp> dropje: looks like the same
08:53 < dropje> masterkorp: it has a different tap driver
08:53 < dropje> which does work on windows7
08:53 < dropje> with hussle
08:54 < dropje> s/hussle/without hussle
08:54 < masterkorp> hmm
08:54 < masterkorp> i need to uninstall openvpn gui first
08:54 < dropje> satonio: is that the ip address of your ISP's DNS server?
08:54 < dropje> masterkorp: yes, including the old TAP driver
08:55 < SeriousSam_> dazo: I installed gopenvpn but when I try to start my session it writes "Error launching OpenVPN subprocess"
08:55 < satonio> hmmm
08:55 < satonio> dropje, it's a dns server
08:55 < satonio> yes
08:55 <@dazo> SeriousSam_: then read logs and figure out why that happens ... obviously there are issues related to start openvpn ... do you have gksu installed?
08:55 < dropje> satonio: could be your firewall is blocking UDP port 53 or the DNS server of your provider is down
08:55 < dropje> can you ping it?
08:56 < satonio> i can use dig with it from this location but not from the vpn server
08:57 < satonio> maybe because the two machines are using different isps?
08:57 < dropje> satonio: is it the DNS server of the provider from your current location or the provider where the Openvpn server is located?
08:57 < satonio> current location xD
08:57 < SeriousSam_> dazo: Do you mena log is windows which opens when I click on Details... button?
08:57 < SeriousSam_> mena=mean
08:57 < dropje> heheh ;) ISP often dont allow querying their DNS servers if you're not a customer
08:57 < dropje> try using 8.8.8.8
08:57 < dropje> google's DNS
08:57 < satonio> hmmmm
08:58 <@dazo> SeriousSam_: since you have troubles starting openvpn, you should check the gopenvpn logs ... and if you don't have that ... quit gopenvpn and start it from a terminal window ... it might even take some debug arguments
08:59 < SeriousSam_> dazo: thanks
09:00 < masterkorp> dropje: same thing "
09:01 < masterkorp> tap0901 not found"
09:02 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15415>
09:02 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
09:03 -!- master_of_master [~master_of@p57B52D49.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
09:03 < masterkorp> dropje: i can see the drived in OpenVPN/driver/tap0901.cat
09:03 -!- satonio [~satonio@147.Red-83-34-206.dynamicIP.rima-tde.net] has quit [Ping timeout: 260 seconds]
09:04 < masterkorp> any idea ?
09:04 < dropje> masterkorp: when do you receive this error: tap0901 not found?
09:04 < dropje> when starting OpenVPN or while installing the driver?
09:04 < masterkorp> dropje: when connnecting
09:05 < masterkorp> dropje: it connects and then drops
09:05 -!- master_of_master [~master_of@p57B55D46.dip.t-dialin.net] has joined #openvpn
09:05 < dropje> well it says it can't find the tap device.. are you sure you completely removed all tap drivers before installing the new one?
09:05 < dropje> through device manager
09:06 < masterkorp> let me recheck
09:06 < masterkorp> meanwhile server log http://pastie.org/2508595
09:07 < SeriousSam_> dazo: logs are empty. Is "gopenvpnstart" a command line version?
09:08 <@dazo> SeriousSam_: I haven't used it for 2-3 years, so I don't recall
09:08 < dropje> masterkorp: mmm.. seems like it does connect succesfully
09:08  * dazo uses pure terminals now, as he is running development versions of openvpn and wants to debug things
09:08 < dropje> only receives a connection-reset
09:08 < masterkorp> dazo: it connects, then the client disconnects because of the tap driver
09:09 < masterkorp> dropje: ^^
09:09 < masterkorp> semms madness
09:09 < masterkorp> because i tough tap driver was not necessary when using tcp
09:09 < dropje> are you using tcp?
09:10 < masterkorp> dropje: 
09:10 < SeriousSam_> dazo: I tried to start it by "gopenvpnstart /etc/openvpn/myconf.ovpn 1194" but I get "invalid characters in config_file". What is wrong?
09:10 < dropje> masterkorp: is there a particular reason you chose tcp?
09:10 < dropje> !tcp
09:11 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
09:11 < SeriousSam_> dazo: This message appers even if I specify config which does not exist...
09:11 < masterkorp> http://omploadr.org/vTlxdA
09:12 < masterkorp> dropje: ^^
09:12 <@dazo> SeriousSam_: I haven't used gopenvpn for years, so I don't really remember these details
09:12 < masterkorp> dropje: hmm i will see that later thanks
09:12 < SeriousSam_> dazo: Ok, thanks for your help
09:16 -!- satonio [~satonio@78.47.161.197] has joined #openvpn
09:16 < satonio> <satonio> it works with 8.8.8.8
09:16 < satonio> <satonio> maybe the isp blocked today connections from non-customers
09:16 < satonio> <satonio> dropje, i've noticed that after activating the update-resolv-conf script resolv.conf file remains the same
09:16 < satonio> <satonio> is it ok?
09:16 < satonio> <satonio> how can i know if it's working properly?
09:17 < dropje> satonio: check your openvpn.log.. could be script-security
09:18 < satonio> NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
09:19 < dropje> satonio: you do push some DHCP options from the server?
09:19 < satonio> yes i do
09:20 < dropje> and script-security is set to 2?
09:20 < satonio> push "dhcp-option DNS 10.8.0.1"
09:20 < satonio> yes it is
09:20 < dropje> is update-resolv-conf executable?
09:21 < satonio> yes
09:21 < dropje> could you pastebin your client conf?
09:22 < ecrist> !configs
09:22 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
09:22 -!- kkk999 [~dks@114.143.165.10] has quit [Remote host closed the connection]
09:22 < ecrist> !logs
09:22 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:23 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:23 -!- luneff [~yury@84.51.201.56] has quit [Quit: Leaving]
09:24 < masterkorp> dropje: any idea ?
09:24 < satonio> http://pastebin.com/nLbmLHWs
09:27 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
09:29 < dropje> masterkorp: could you paste both client and server configuration?
09:29 < dropje> on of the URL's you posted doesnt work
09:30 < dropje> s/on/one
09:30 < satonio> dropje, have you seen something wrong in my configuration?
09:30 < masterkorp> dropje: sure
09:30 -!- EugenePants is now known as EugeneSomething
09:31 < dropje> satonio: no 
09:31 < dropje> do you have a client log
09:31 < masterkorp> dropje: server confighttp://gist.github.com/1206377
09:31 <@vpnHelper> Title: gist: 1206377 Gist (at gist.github.com)
09:32 < satonio> i can stop and start it and make it create a log
09:32 < dropje> masterkorp: and your client conf?
09:33 < masterkorp> dropje: client http://pastie.org/2508731
09:34 < masterkorp> dropje: the certs are in the same dir
09:34 < satonio> dropje, where should it say something about the execution of that script?
09:35 < cherwin> satonio: PUt set -x on top of your script and pastebin the output.
09:35 < dropje> masterkorp: uncomment the dev-node tap0901 in your client conf
09:35 < cherwin> satonio: Your resolv.conf won't update, no?
09:35 < satonio> on resolv conf?
09:36 < dropje> s/uncomment/comment
09:36 < satonio> ouch
09:36 < satonio> on update resolv conf?
09:36 < masterkorp> dropje: oh
09:36 < cherwin> satonio: update-resolv-conf yes.
09:36 < cherwin> Furthermore, what OS are you using?
09:37 < satonio> what output should i paste?
09:37 < satonio> ubuntu 10.04
09:37 < masterkorp> dropje: worked
09:37 < cherwin> Ubuntu? Why don't you use nm-applet/
09:37 < cherwin> ?
09:37 < EugeneSomething> !ubuntu
09:37 <@vpnHelper> "ubuntu" is dont use network manager!
09:37 < EugeneSomething> That's why ^
09:37 < masterkorp> dropje: so for tun the tap drivers is not necessary ?
09:37 < cherwin> Haha
09:38 < EugeneSomething> Output we're after is from openvpn.log
09:38 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
09:38 < dropje> masterkorp: yes it is.. you are mixing up the TAP driver windows needs and the TAP device used for bridging a VPN
09:38 < cherwin> satonio: I want to see the output that update-resolv-conf now produces.
09:38 < satonio> should i execute sudo ./update-resolv-conf up
09:38 < satonio> ?
09:39 < cherwin> satonio: No, that won't work. It depends on some env vars.
09:39 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:39 < cherwin> satonio: It should reside in your openvpn.log
09:39 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
09:40 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
09:40 < cherwin> satonio: Furthermore, I don't see you setting your script-security anywhere?
09:41 < satonio> script failed: could not execute external program
09:41 < satonio> Fri Sep  9 16:39:36 2011 script failed: could not execute external program
09:41 < satonio> Fri Sep  9 16:39:36 2011 Exiting
09:41 -!- satonio [~satonio@78.47.161.197] has quit [Quit: Saliendo]
09:41 -!- satonio [~satonio@78.47.161.197] has joined #openvpn
09:41 < satonio> <satonio> Fri Sep  9 16:39:36 2011 script failed: could not execute external program
09:41 < satonio> <satonio> Fri Sep  9 16:39:36 2011 Exiting
09:42 < satonio> i think i should put it after #!/bin/bash not exactly on the top
09:43 < cherwin> satonio: Of course.
09:43 < masterkorp> dropje: thnaks
09:43 < masterkorp> now i need to autostart the network
09:43 < satonio> + '[' -x /sbin/resolvconf ']'
09:43 < satonio> + exit 0
09:43 < cherwin> Ha
09:43 < satonio> i think that is the output
09:43 < cherwin> You don't have resolvconf installed
09:44 < satonio> true
09:44 < satonio> that's the problem
09:44 < dropje> apt-get install resolvconf
09:44 < cherwin> satonio: apt-get install resolvconf
09:44 < dropje> haha
09:44 < satonio> i'm already doing that xDD
09:44 < satonio> sorry
09:44 < dropje> masterkorp: autostart what?
09:45 < cherwin> dropje: I think he means he want to make it reboot proof.
09:45 -!- jave [~user@92.35.216.205] has quit [Ping timeout: 260 seconds]
09:45 < masterkorp> dropje: the openvpn client
09:45 < satonio> now resolv.conf is ok
09:45 < dropje> cherwin: does he ? ")
09:45 < satonio> thank you very much
09:45 < cherwin> satonio: You're welcome.
09:45 < masterkorp> dropje: basically this is so i can have vpn acess to the machine
09:45 < masterkorp> s/vpn/vnc
09:46 < dropje> im not sure but you can prolly install openvpn GUI as a service
09:46 < dropje> you shouldnt have a private key on your client cert then
09:47 < masterkorp> dropje: i will hack the registry
09:47 < masterkorp> dropje: and give permissions for the openvpn to autostart in service control panel
09:51 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:53 < satonio> and about nm-applet
09:53 < satonio> are you talking about networkmanager-openvpn?
09:56 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:58 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
10:00 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:03 -!- masterkorp [~masterkor@static.34.107.46.78.clients.your-server.de] has left #openvpn ["WeeChat 0.3.2"]
10:05 -!- albech [~thomas@61.7.176.128] has quit [Ping timeout: 252 seconds]
10:05 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:06 < dropje> satonio: yes he is
10:06 < satonio> i didn't manage that to work properly. it only worked the first time i used it
10:07 < satonio> and after that i couldn't connect anymore
10:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
10:08 < cherwin> satonio: I've setup openvpn on numerous ubuntu laptops and I've never had any problems.
10:09 < satonio> hmmm
10:09 < cherwin> satonio: There *are* some quirks but it's relatively easy to fix those.
10:09 < satonio> tell me
10:10 < cherwin> Just enable it and tell me what doesn't work.
10:11 -!- SeriousSam_ [kvirc@shpd-92-101-186-156.vologda.ru] has quit [Read error: Connection reset by peer]
10:11 < satonio> the network connection <<null>> closed unexpectedly (or something like that, it was in spanish)
10:11 < satonio> and <<null>> was what i was saying
10:12 < cherwin> satonio: I have no idea how to fix it. Sorry.
10:12 < satonio> with cli it works
10:14 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:15 < satonio> one of my friends also had problems with it
10:15 < satonio> and it use it from cli too
10:15 < satonio> and he
10:24 -!- dazo is now known as dazo_afk
10:26  * gladiatr loathes network manager
10:38 < ecrist> krzee: nothing was wrong with butters, comcast was playing with things last night.
10:45 -!- dazo_afk is now known as dazo
10:46 < satonio> cherwin, detailed: http://pastebin.com/4vkYYPjX
10:50 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:52 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
10:53 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
11:05 -!- ivenkys_ [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 252 seconds]
11:07 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
11:08 -!- masterkorp [~masterkor@static.34.107.46.78.clients.your-server.de] has joined #openvpn
11:08 <@vpnHelper> RSS Update - forum: SVC_RUN_EXCEPT-cannot start server <http://forums.openvpn.net/topic8696.html#p15416>
11:09 < masterkorp> hello, i can connect trough VPN to a vnc server, i can by the local network. Any ideas what might be blocking ?
11:09 < masterkorp> no firewals in the middle
11:10 < satonio> are you using the internal ip?
11:10 < masterkorp> yeah
11:10 < masterkorp> 10.8.0.10
11:10 < satonio> no idea then
11:11 < masterkorp> mine is 10.8.0.11
11:11 < masterkorp> i just get a black screen
11:11 < masterkorp> strange there is nothing the logs
11:12 < satonio> maybe the connection is too slow?
11:12 < masterkorp> nah
11:13 < masterkorp> its a T1 line
11:13 < masterkorp> i should just get linux on this and ssh 
11:13 < masterkorp> poper SO ftw
11:13 < masterkorp> *OS
11:21 -!- bbohling [~bbohling@184.76.104.206] has joined #openvpn
11:25 -!- hq3200 [~ident@113.49.191.90.dyn.estpak.ee] has joined #openvpn
11:29 -!- hq320 [~ident@46.246.124.51] has quit [Ping timeout: 260 seconds]
11:30 < bbohling> i have a basic question wrt openvpn + openssl on windows server 2008 R2. i followed the HOWTO instructions on openvpn.net but almost immediately had issues when i got to the part with certs. for starters openssl was not mentioned as a dependency nor was it included in the install. nor does it look like any of the environment variables are set since i have to "hard code" all values and cannot dely on any of the "config" files. any thoughts?
11:32 < EugeneSomething> !windows
11:32 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
11:35 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Now with extra fish!]
11:35 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:37 -!- ochristi [~ochristi@p4FF0D8CD.dip.t-dialin.net] has joined #openvpn
11:37 -!- LuckyY_ is now known as LuckyY
11:38 < ochristi> !welcome
11:38 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:38 < ochristi> !redirect
11:38 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
11:39 < ochristi> !ipforward
11:39 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
11:39 < ochristi> !linipforward
11:39 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
11:40 < EugeneSomething> Thanks for taking the time to talk to the bot ;-)
11:40 < ochristi> I am no irc noob :)
11:40 < ochristi> atleast no beginner ;)
11:42 < ochristi> restart networking I guess?
11:43 < EugeneSomething> To enable forwarding? echo 1 should do it, as oot.
11:43 < EugeneSomething> root.
11:43 < ochristi> yeah
11:43 < EugeneSomething> sysctl.conf applies at boot
11:43 < ochristi> that is what I just did
11:44 < EugeneSomething> If that doesn't fix it, it'll e in your firewall or routing.
11:44 < ochristi> hm "it" is not working and I have no clue where to start digging
11:45 < EugeneSomething> The general approach is to turn off all the firewalling and then argue with the routes
11:45 < ochristi> my situation: server behind router (dynamic ips :s ), want to connect from somewhere in the world to use that connection to the internet
11:46 < EugeneSomething> You'll need to use a MASQUERADE rule for the vpn subnet
11:51 < ochristi> Which address I have to use for the -s (source)?
11:52 < EugeneSomething> Vpn subnet.... 10.8.0.0/24 or so
11:56 -!- k4v [~kav@g226089093.adsl.alicedsl.de] has quit [Read error: Connection reset by peer]
12:04 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
12:05 < ochristi> What else I have to setup, I can connect to the server, but nothing else
12:06 -!- bbohling [~bbohling@184.76.104.206] has quit [Quit: bbohling]
12:06 < ochristi> I currently have a machine connected to the server on a second eth, which able to make the connection
12:08 < Bushmills> what "nothing else" did you try?
12:10 < ochristi> I wish to be able to get a route to the internet trough the vpn server
12:10 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:10 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
12:11 < ochristi> And I have no idea how to find the problem or what I missed to set up
12:13 < Bushmills> !redirect
12:13 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
12:13 < Bushmills> windows client?
12:13 < ochristi> linux
12:14 < Bushmills> "route to internet" probably means your default route will go through vpn, using vpn server as default gateway
12:16 < ochristi> exactly, (sorry for the lack of right terminology)
12:16 -!- rbd [~rbd@cpe-076-182-045-156.nc.res.rr.com] has quit [Read error: Connection reset by peer]
12:16 < Bushmills> no, that's fine. i just wanted to clarify
12:16 < ochristi> I am not sure if this setup helps me to simulate the situation I actually want to use this
12:16 <@vpnHelper> RSS Update - forum: Limit LAN Access in Bridged Setup <http://forums.openvpn.net/topic8765.html#p15417>
12:18 < ochristi> currently: router provides dhcp for this network (192.168.2/24), I thought I will set the vpn to 192.168.3/24
12:18 < ochristi> additionally I connected a pc to the server on 192.168.13/24 (to avoid having it on the same network)
12:19 < Bushmills> server has no internet?
12:19 < ochristi> it has
12:19 < ochristi> router provides dns and dhcp
12:22 < Bushmills> if your client can connect to server, the router (between client and server) is not an issue any longer
12:23 -!- dazo is now known as dazo_afk
12:23 -!- rbd [~rbd@cpe-076-182-045-156.nc.res.rr.com] has joined #openvpn
12:39 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
12:48 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
12:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
12:53 < ochristi> !nat
12:53 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
12:59 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Ex-Chat]
13:04 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 276 seconds]
13:06 -!- qbasicer [~qbasicer@24-246-12-52.cable.teksavvy.com] has quit [Read error: Operation timed out]
13:08 < satonio> another thing... how can i make that when i try to connect to the internet server ip from whatever service that is not the vpn it will connect like i were connecting to its internal ip?
13:08 -!- masterkorp [~masterkor@static.34.107.46.78.clients.your-server.de] has left #openvpn ["WeeChat 0.3.2"]
13:13 < Bushmills> you bind service to both or all interfaces
13:19 -!- qbasicer [~qbasicer@24-246-12-52.cable.teksavvy.com] has joined #openvpn
13:19 -!- K1ng`` [~k1ng@58.97.132.210] has joined #openvpn
13:19 -!- K1ng`` [~k1ng@58.97.132.210] has quit [Changing host]
13:19 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:20 -!- zastaph [~uid@unaffiliated/zastaph] has joined #openvpn
13:22 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
13:23 -!- bbohling [~bbohling@184.76.104.206] has joined #openvpn
13:29 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
13:37 -!- bbohling [~bbohling@184.76.104.206] has quit [Quit: bbohling]
13:38 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
13:39 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:53 -!- ochristi [~ochristi@p4FF0D8CD.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
14:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:05 < Cr4zi3> http://i.imgur.com/4X0SI.jpg
14:14 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:15 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
14:20 < ecrist> ?
14:22 < Bushmills> just an url, no question, no text, is most likely trash anyway
14:22 < Bushmills> i guess nobody bothered to actually open it
14:22 < ecrist> that's my guess
14:25 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:26 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
14:37 < Essobi> Bushmills: it's an optical illusion.
14:38 -!- Psi|4ward [~psi@DSL01.212.114.206.69.ip-pool.NEFkom.net] has joined #openvpn
14:42 < hyper_ch> no, it's an animated jpeg
14:43 < ecrist> no such thing
14:43 < hyper_ch> the proof is right on that webpage
14:43 < Bushmills> actually, i'm not very interested in knowing what it is
14:44 < ecrist> hyper_ch: it's probably an optical illusion
14:44 < ecrist> or an animated gif
14:44 < reiffert> animated openvpn?
14:45 < ecrist> heh
14:45 < ecrist> we call that irc
14:46 < reiffert> 7exec -o wget http://asciipr0n.com/ && cat index.html
14:46 <@vpnHelper> Title: ascii pr0n . com (at asciipr0n.com)
14:52 -!- Psi|4ward [~psi@DSL01.212.114.206.69.ip-pool.NEFkom.net] has left #openvpn ["terminated"]
14:57 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Quit: Leaving.]
14:58 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
14:58 -!- mode/#openvpn [+o raidz] by ChanServ
15:16 -!- bbohling [~bbohling@184.76.104.206] has joined #openvpn
15:18 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
15:38 -!- ochristi [~ochristi@p57902F3C.dip.t-dialin.net] has joined #openvpn
15:38 -!- ochristi [~ochristi@p57902F3C.dip.t-dialin.net] has left #openvpn []
15:46 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
15:49 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 250 seconds]
15:51 -!- luckman212_ [~irc@2001:470:1f07:1225:5880:fdc2:20d7:fcf6] has joined #openvpn
15:54 -!- luckman212 [~irc@2001:470:1f07:1225:ec3d:ac06:21a2:ec00] has quit [Ping timeout: 260 seconds]
16:12 -!- bbohling_ [~bbohling@184-76-104-206.war.clearwire-wmx.net] has joined #openvpn
16:15 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:15 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
16:15 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:16 -!- bbohling [~bbohling@184.76.104.206] has quit [Ping timeout: 260 seconds]
16:16 -!- bbohling_ is now known as bbohling
16:16 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
16:24 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:26 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
16:33 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:38 -!- bbohling [~bbohling@184-76-104-206.war.clearwire-wmx.net] has quit [Ping timeout: 253 seconds]
16:41 <@vpnHelper> RSS Update - forum: how to change MTU size in OpenVPN Access Server <http://forums.openvpn.net/topic8783.html>
16:43 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Quit: changing servers]
16:44 -!- amir is now known as weibsvolk
16:46 -!- weibsvolk is now known as amir
16:49 -!- DexTerDDIT [~dexterddi@2001:470:1f06:687::2] has joined #openvpn
16:52 -!- DexTerDDIT [~dexterddi@2001:470:1f06:687::2] has quit [Quit: changing servers]
16:54 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
16:56 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
17:00 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Ping timeout: 260 seconds]
17:01 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Quit: GOSUB w/o RETURN]
17:02 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has quit [Ping timeout: 252 seconds]
17:02 -!- chantra [~chantra@unaffiliated/chantra] has quit [Ping timeout: 252 seconds]
17:03 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
17:03 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
17:03 -!- skinny_much [skinnymuch@c-69-142-217-73.hsd1.nj.comcast.net] has joined #openvpn
17:04 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
17:04 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
17:35 -!- Guest7206 [~nb@delta.nb.tc] has left #openvpn []
17:35 -!- nb [~nb@delta.nb.tc] has joined #openvpn
17:36 -!- nb is now known as Guest80437
17:42 -!- Guest80437 [~nb@delta.nb.tc] has quit [Changing host]
17:42 -!- Guest80437 [~nb@fedora/nb] has joined #openvpn
17:42 -!- Guest80437 [~nb@fedora/nb] has left #openvpn []
17:42 -!- nb [~nb@fedora/nb] has joined #openvpn
17:45 -!- zastaph [~uid@unaffiliated/zastaph] has quit []
18:11 -!- advocatusdiaboli [~advocatus@193.69.144.162] has quit [Remote host closed the connection]
18:31 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
18:40 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
18:41 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
19:03 -!- jbb [~yeeb@184.105.219.149] has quit [Read error: Operation timed out]
19:03 -!- satonio [~satonio@78.47.161.197] has quit [Ping timeout: 260 seconds]
19:14 -!- _julian_ [~quassel@hmbg-5f76206f.pool.mediaWays.net] has joined #openvpn
19:16 -!- _julian [~quassel@hmbg-4d06d7c8.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
19:16 -!- satonio [~satonio@78.47.161.197] has joined #openvpn
19:24 -!- Squidy [~quassel@189.75.75.158] has joined #openvpn
19:24 -!- Squidy [~quassel@189.75.75.158] has quit [Changing host]
19:24 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:25 -!- satonio [~satonio@78.47.161.197] has quit [Quit: Saliendo]
19:30 <@vpnHelper> RSS Update - forum: Installed worked .... <http://forums.openvpn.net/topic8768.html#p15419>
19:32 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
19:33 -!- EugeneSomething is now known as EugeneNothing
19:36 <@vpnHelper> RSS Update - forum: Installed worked .... <http://forums.openvpn.net/topic8769.html#p15420>
19:42 <@vpnHelper> RSS Update - forum: iPhone WiFi Personal Hotspot and OpenVPN <http://forums.openvpn.net/topic8772.html#p15421>
19:49 -!- Denyven [~Denyven@123.120.162.197] has joined #openvpn
19:50 < Denyven> Hi
19:50 < Denyven> I set up openVPN on mya debian VPS
19:51 < Denyven> I can connect to it from my computer
19:51 < Denyven> but it dosnt work as a vpn
19:51 < Denyven> ie
19:51 < Denyven> A website still sees my local ip adress and not my server's
19:53 < EugeneNothing> !redirect
19:53 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
19:54 < EugeneNothing> "doesn't work as a VPN" is really not true. You're thinking of a traffic redirector, which operates over a VPN link.
19:54 <@vpnHelper> RSS Update - forum: Server Config from Client <http://forums.openvpn.net/topic8757.html#p15422>
19:58 < Denyven> and how would I set that up?
19:58 < Denyven> a traffic redirector
19:59 < Denyven> !redirect
19:59 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
19:59 < Denyven> !def1
19:59 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
20:25 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
20:34 < Denyven> !ipforward
20:34 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
20:39 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
20:39 < Denyven> !nat
20:39 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
20:40 < Denyven> !linipforward
20:40 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
20:43 < Denyven> where would sysctl.conf be
20:54 < Denyven> !linnat
20:54 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
20:55 < Denyven> !openvzlinnat
20:55 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
20:59 -!- kenyon_ is now known as kenyon
21:00 -!- kenyon is now known as Guest65018
21:03 -!- Guest65018 [~kenyon@darwin.kenyonralph.com] has left #openvpn []
21:06 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
21:17 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
21:36 <@vpnHelper> RSS Update - forum: OpenVPN MI GUI v20110902 problem! <http://forums.openvpn.net/topic8779.html#p15424> || OpenVPN Client - windows, routing (default route) <http://forums.openvpn.net/topic8780.html#p15423>
21:44 -!- pranq [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
21:45 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
21:48 <@vpnHelper> RSS Update - forum: OpenVPN MI GUI v20110902 problem! <http://forums.openvpn.net/topic8779.html#p15426> || OpenVPN Client - windows, routing (default route) <http://forums.openvpn.net/topic8780.html#p15425>
21:51 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:00 <@vpnHelper> RSS Update - forum: DDWRT + OpenVPN - Possibility of Detection/Leaks? <http://forums.openvpn.net/topic8778.html#p15427>
22:11 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
22:11 -!- Denial [Denial@drgi.co.uk] has quit []
23:06 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
23:10 -!- Denyven [~Denyven@123.120.162.197] has quit [Ping timeout: 260 seconds]
23:16 -!- Denyven [~Denyven@123.120.163.76] has joined #openvpn
--- Day changed Sat Sep 10 2011
00:03 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 260 seconds]
00:06 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
00:34 -!- Xgates [~Xgates@gateway/tor-sasl/xgates] has joined #openvpn
00:34 < Xgates> hey guys
00:35 < Xgates> anyone by chance running Gnome using openvpn?
00:36 < Xgates> I'm trying to figure if the  gnome network-manager-openvpn plugin, if it can have several gateways listed in the gateway settings to connect to different servers?
00:36 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:36 <@vpnHelper> RSS Update - forum: Server Config from Client <http://forums.openvpn.net/topic8757.html#p15428>
00:41 -!- Xgates [~Xgates@gateway/tor-sasl/xgates] has quit [Quit: Ping Timeout (0 Nano Seconds)]
00:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
01:01 <@vpnHelper> RSS Update - forum: Server Config from Client <http://forums.openvpn.net/topic8757.html#p15429>
01:03 -!- skinny_much [skinnymuch@c-69-142-217-73.hsd1.nj.comcast.net] has quit []
01:04 -!- skinny_much [skinnymuch@c-69-142-217-73.hsd1.nj.comcast.net] has joined #openvpn
01:04 < EugeneNothing> !networkmanager
01:04 < EugeneNothing> !nm
01:04 < EugeneNothing> !ubuntu
01:04 <@vpnHelper> "ubuntu" is dont use network manager!
01:04 < EugeneNothing> That should really be moved :v
01:06 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
01:08 -!- skinny_much [skinnymuch@c-69-142-217-73.hsd1.nj.comcast.net] has quit [Client Quit]
01:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:11 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
01:20 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
01:20 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
01:20 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
01:30 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 253 seconds]
01:52 < Bushmills> afaik, the nm problem was specific to the ubuntu versions
01:53 < Bushmills> on other system nm causes just a general mess up
01:53 < Bushmills> but ubuntu versions has an ubuntu specific reason to wreak havoc
01:58 -!- Denyven [~Denyven@123.120.163.76] has quit [Ping timeout: 240 seconds]
02:22 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
02:41 -!- albech [~thomas@61.7.176.128] has joined #openvpn
02:44 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:22 <@vpnHelper> RSS Update - forum: wrong "connected since" time in Server <http://forums.openvpn.net/topic8785.html>
03:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:23 -!- zastaph [zastaph@unaffiliated/zastaph] has joined #openvpn
03:37 -!- EugeneNothing is now known as EugeneEverything
03:46 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
03:46 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 245 seconds]
03:50 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
04:03 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 250 seconds]
05:04 <@vpnHelper> RSS Update - forum: Installed worked .... <http://forums.openvpn.net/topic8768.html#p15431>
05:10 <@vpnHelper> RSS Update - forum: how to make 1 account per session? <http://forums.openvpn.net/topic8770.html#p15432>
05:16 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
05:26 -!- albech [~thomas@61.7.176.128] has quit [Quit: Ex-Chat]
05:27 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
05:40 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
05:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
05:50 -!- Xtrapni [~trapni@trapni.de] has quit [Quit: leaving]
06:27 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
06:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
06:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:58 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html#p15433>
07:00 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
07:11 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:16 <@vpnHelper> RSS Update - forum: Speed up Connection Re-Establish after Failure <http://forums.openvpn.net/topic8786.html>
07:29 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
07:33 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
07:37 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Remote host closed the connection]
07:44 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:57 -!- [dEviL-bOy] [~edgar@41.88.103.84.rev.sfr.net] has joined #openvpn
08:12 -!- SeriousSam_ [kvirc@shpd-95-53-234-175.vologda.ru] has joined #openvpn
08:12 -!- xedenus [~bodo@p57ADEB0B.dip.t-dialin.net] has joined #openvpn
08:12 -!- xedenus [~bodo@p57ADEB0B.dip.t-dialin.net] has left #openvpn []
08:13 -!- xedenus [~bodo@p57ADEB0B.dip.t-dialin.net] has joined #openvpn
08:16 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:16 -!- mode/#openvpn [+v s7r] by ChanServ
08:18 -!- SeriousSam_ [kvirc@shpd-95-53-234-175.vologda.ru] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.3 Shiny(svn-3438) http://www.kvirc.net]
08:23 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 250 seconds]
08:23 -!- xedenus [~bodo@p57ADEB0B.dip.t-dialin.net] has left #openvpn ["Linkinus - http://linkinus.com"]
08:24 -!- novaflash [novaflash@178-84-117-247.dynamic.upc.nl] has joined #openvpn
08:24 -!- novaflash [novaflash@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
08:24 -!- novaflash [novaflash@openvpn/user/novaflash] has joined #openvpn
08:24 -!- mode/#openvpn [+v novaflash] by ChanServ
08:37 -!- [dEviL-bOy] [~edgar@41.88.103.84.rev.sfr.net] has quit [Ping timeout: 260 seconds]
08:44 -!- cpm [~Chip@70.101.252.228] has joined #openvpn
08:44 -!- cpm [~Chip@70.101.252.228] has quit [Changing host]
08:44 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:58 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
09:01 -!- master_of_master [~master_of@p57B55D46.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:04 -!- master_of_master [~master_of@p57B55EDD.dip.t-dialin.net] has joined #openvpn
09:04 <@vpnHelper> RSS Update - forum: how to make 1 account per session? <http://forums.openvpn.net/topic8770.html#p15435>
09:24 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
09:35 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
09:38 -!- luckman212_ [~irc@2001:470:1f07:1225:5880:fdc2:20d7:fcf6] has quit [Quit: No Ping reply in 180 seconds.]
09:39 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
09:49 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 260 seconds]
09:56 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:58 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
10:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 250 seconds]
10:08 -!- _julian_ [~quassel@hmbg-5f76206f.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
10:32 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has joined #openvpn
10:38 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:41 < trumee> I am running openvpn on an openwrt router. Is there any i can specify QOS for openvpn?
10:41 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
10:43 < trumee> another one, I am getting an error "TLS: tls_process, killed expiring key". What should the permissions be of my files so that i dont get this error.
10:43 < trumee> I am assume this is a permissions issue as mentioned here http://openvpn.net/archive/openvpn-users/2007-07/msg00104.html
10:43 <@vpnHelper> Title: Re: [Openvpn-users] TLS: tls_process, killed expiring key - What does this mean? (at openvpn.net)
10:43 < trumee> *assuming
10:43 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:43 < trumee> The openvpn server/client processes are running as root btw
10:44 < trumee> I get the above error on the client every 1 hour and it disconnects
10:44 < trumee> I dont want to increase the reneg time rather solve the problem
10:44 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
10:48 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
11:00 -!- Squidy [~quassel@189-72-141-18.cbace701.dsl.brasiltelecom.net.br] has joined #openvpn
11:00 -!- Squidy [~quassel@189-72-141-18.cbace701.dsl.brasiltelecom.net.br] has quit [Changing host]
11:00 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
11:04 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
11:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:15 -!- Guest85043 [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
11:16 -!- Guest85043 [~Geek@2001:41d0:1:f38f::1337] has left #openvpn []
11:19 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
11:26 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
11:28 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:29 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:04 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
12:06 -!- hq3200 [~ident@113.49.191.90.dyn.estpak.ee] has quit [Ping timeout: 258 seconds]
12:15 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
12:16 -!- Guest62548 [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
12:17 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
12:18 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
12:18 -!- Guest62548 [~Geek@2001:41d0:1:f38f::1337] has left #openvpn []
12:20 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:44 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:44 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:44 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:45 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:20 -!- corretico [~luis@201.201.44.82] has joined #openvpn
13:21 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
13:26 -!- krzee [~krzee@butters.secure-computing.net] has joined #openvpn
13:27 -!- corretico [~luis@201.201.44.82] has joined #openvpn
13:27 -!- dxtr [vjmbx0@unaffiliated/dxtr] has joined #openvpn
13:27 < dxtr> Hey
13:27 < hyper_ch> hey
13:27 < krzee> hay
13:27 < dxtr> I'm thinking, I started a VPN connection and now I can't connect to services listening on eth0
13:28 < dxtr> Err
13:28 < dxtr> Sorry, that was vague
13:28 < dxtr> I started a VPN connection on my server. That is, it acts as a client
13:28 < hyper_ch> krzee: http://i.imgur.com/y3CHm.jpg - photoshopped?
13:28 -!- krzee [~krzee@butters.secure-computing.net] has quit [Changing host]
13:28 -!- krzee [~krzee@openvpn/community/support/krzee] has joined #openvpn
13:28 < dxtr> But I still want to be able to connect to services listening on eth0 on the server
13:28 < krzee> !splitroute
13:28 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
13:28 < dxtr> Oh that's cool
13:28 < krzee> yep =]
13:29 < dxtr> I'm glad you realized what I meant
13:29 < krzee> me too ;]
13:29 < dxtr> Hehe
13:29 < krzee> hyper_ch looks plausibly real
13:29 < hyper_ch> krzee: I think it's really photoshopped
13:31 < dxtr> krzee: So basically what is wrong? The server recieves my requests on eth0, but sends the responses through tap0?
13:31 < hyper_ch> dxtr: sounds like it
13:34 < dxtr> Hmm
13:34 < dxtr> I tried tht
13:34 < dxtr> that
13:34 < dxtr> Didn't work :P
13:34 < dxtr> And iptables is clear
13:36 < dxtr> Weird
13:44 < dxtr> Hmm... Any ideas?
13:49 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 260 seconds]
13:49 < dxtr> Hmm
13:49 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
13:53 < dxtr> this is weird
13:53 < dxtr> 'ip rule' gives me (among the other default things): 32765:  from 91.123.X.X lookup 10
13:54 < dxtr> 'ip route list table 10' gives me: ÀQdefault via 91.123.X.X dev eth0
13:54 < dxtr> And eth0 has that IP
13:54 < dxtr> tcpdump shows that I do indeed get inbound traffic on eth0
13:55 < dxtr> Do I have to flush cache perhaps?
13:56 < dxtr> Nope didn't work
13:56 < krzee> dxtr well
13:56 < krzee> you use --redirect-gateway
13:56 < krzee> so your client sends ALL internet traffic out via the tun interface
13:57 < krzee> which means that you get the request on eth0 and try to respond from tun0
13:57 < krzee> and tcp doesnt work like that...
13:57 < dxtr> krzee: So how do I solve this? :P
13:58 < dxtr> I still want my traffic to go through tap0 by default, though
13:58 < krzee> read the whole threadright
13:58 < krzee> right
13:58 < krzee> so did he
13:58 < dxtr> Yeah I did
13:58 < krzee> this was the solution :-p
13:58 < krzee> anyways, bbl
13:59 < dxtr> krzee: That's what I did
13:59 < dxtr> But it isn't working
13:59 < hyper_ch> krzee: you're leaving? Nooook you caaaaaan't leeeeeaaaavvveeeeee us alooooooooone
13:59 < dxtr> That's what I'm saying
14:00 < krzee> dxtr well i dont use linux, nor do i use redirect-gateway, i can just point you to where others figured it out
14:00 < krzee> you want a seperate routing table that only matters when responding to traffic that came in eth0
14:01 < krzee> which is what tuxx did
14:01 < dxtr> Yeah exactly
14:01 < hyper_ch> dxtr: you can't use --redirect-gateway anymore
14:01 < hyper_ch> but need to setup a second routing table
14:01 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 260 seconds]
14:01  * hyper_ch thinks
14:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:02 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
14:02 < dxtr> hyper_ch: Why would I need a second routing table if I don't use --redirect-gateway?
14:02 < krzee> hyper_ch why wouldnt he still use redirect-gateway??
14:02 < hyper_ch> krzee: ok, maybe I missunderstand
14:02 < hyper_ch> dxtr: just listen to krzee
14:04 < dxtr> Well I added a second routing table
14:04 < dxtr> Like the thread told me to
14:04 < dxtr> Now what? It isn't working :)
14:04 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
14:04 < dxtr> Tried 'ip route flush cache'
14:06 < krzee> !factoids search route
14:06 <@vpnHelper> 'winroute', 'iroute', 'router', 'route', 'routebyapp', 'route_outside_openvpn', 'dlink_static_route', 'route_outside_ovpn', 'external_routes', 'route_override', and 'splitroute'
14:06 < krzee> !route_override
14:06 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
14:06 < krzee> that has more info re linux routing tables, but you really do want !splitroute
14:06 < dxtr> Yeah
14:07 < dxtr> Well, I did as the thread said. Replacing his IP with my own ofcourse
14:07 -!- sai_student [~ChuGakuse@p6e422179.tkyea110.ap.so-net.ne.jp] has joined #openvpn
14:07 < sai_student> !welcome
14:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:08 < sai_student> !wiki
14:08 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
14:13 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
14:16 <@vpnHelper> RSS Update - forum: Can't connect at new location <http://forums.openvpn.net/topic8787.html>
14:22 < krzee> dxtr sry ive never had a chance to test it, but it worked for him and i think i remember it working for others
14:23 -!- sai_student [~ChuGakuse@p6e422179.tkyea110.ap.so-net.ne.jp] has quit [Ping timeout: 252 seconds]
14:24 < hyper_ch> dxtr: there's also #iptables or #netfilter ... which is a common channel for routing and stuff
14:24 -!- sai_student [~ChuGakuse@203.150.231.140] has joined #openvpn
14:24 < dxtr> Aight
14:25 < hyper_ch> maybe you can get more help in there
14:27 < dxtr> Haha
14:27 <@vpnHelper> RSS Update - forum: Help PLease....connected but can't browse <http://forums.openvpn.net/topic8788.html>
14:27 < dxtr> I think I see the error
14:28 < dxtr> I'm retarded
14:30 < dxtr> Hahahaha
14:30 < dxtr> Yeah, I'm retarded
14:30 < dxtr> Sorry for wasting your time :)
14:30 < hyper_ch> what was it?
14:31 < dxtr> I didn't add my gateway in my route
14:31 < dxtr> I added my IP
14:31 < hyper_ch> :)
14:31 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
14:32 < sai_student> hello... I wonder If I could get some help from here
14:34 < sai_student> I use openVPN as a client. The connection to the server was successful. and I was able to surf the internet with the vpn.
14:34 <@vpnHelper> RSS Update - forum: cons <http://forums.openvpn.net/topic8789.html>
14:34 < sai_student> I also check at http://www.ipchicken.com/  that I have a new IP
14:34 <@vpnHelper> Title: IP Chicken - Whats my IP address? ip address lookup (at www.ipchicken.com)
14:35 < sai_student> the problem is that I can not connect to an internet game server
14:35 < sai_student> the patch process work fine but I could not login to the game
14:36 < sai_student> It's like there was no response from server (time out message were shown)
14:36 < sai_student> any idea ?
14:38 < sai_student> I can login normally if not using the openVPN ,  using windows VPN connection also work fine too.
14:40 -!- bsdboy [~bsdboy@unaffiliated/deesl] has joined #openvpn
14:47 < Bushmills> !redirect
14:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:47 < Bushmills> sai_student: ^^^
14:48 < sai_student> oh thanks for the answer
14:48 < sai_student>  !def1
14:48 < sai_student> !def1
14:48 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:49 < sai_student> !man
14:49 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
14:49 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
14:49 -!- K1ng` [~k1ng@58.97.132.210] has joined #openvpn
14:49 -!- K1ng` [~k1ng@58.97.132.210] has quit [Changing host]
14:49 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:52 < sai_student> !ipforward
14:52 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:52 < sai_student> !winipforward
14:52 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
14:52 < hyper_ch> sai, you operate the server also?
14:52 < sai_student> !nat
14:52 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:52 < sai_student> no
14:53 < sai_student> the reason I'm trying vpn is that I want to play foreign server game
14:55 -!- sai_student [~ChuGakuse@203.150.231.140] has quit [Quit: -=SysReset 2.55=-]
15:03 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 246 seconds]
15:03 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
15:03 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
15:03 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
15:04 -!- Ragnar [~heimdall@darkstar.acool.net] has joined #openvpn
15:07 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
15:08 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has quit []
15:11 -!- Ragnar [~heimdall@darkstar.acool.net] has quit [Ping timeout: 252 seconds]
15:12 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
15:16 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 260 seconds]
15:18 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
15:36 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
15:37 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:38 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
15:39 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
15:43 -!- krzee [~krzee@openvpn/community/support/krzee] has quit [Quit: [BX] Ping-pong timeout]
15:43 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
15:48 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
16:18 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Ping timeout: 260 seconds]
16:32 -!- |Mike|_ [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Quit: Reconnecting]
16:32 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
16:34 -!- nikanok [~nickynick@224.208.34.95.customer.cdi.no] has joined #openvpn
16:34 <@vpnHelper> RSS Update - forum: getting an open NAT in residence <http://forums.openvpn.net/topic8777.html#p15439>
16:40 <@vpnHelper> RSS Update - forum: Limit LAN Access in Bridged Setup <http://forums.openvpn.net/topic8765.html#p15441> || Memory Leakage - OpenVPN <http://forums.openvpn.net/topic8782.html#p15440>
16:46 <@vpnHelper> RSS Update - forum: Help PLease....connected but can't browse <http://forums.openvpn.net/topic8788.html#p15443> || Can't connect at new location <http://forums.openvpn.net/topic8787.html#p15442> || how to block P2P traffic <http://forums.openvpn.net/topic8491.html#p15285>
16:47 -!- Ragnar [heimdall@darkstar.acool.net] has joined #openvpn
16:56 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:58 <@vpnHelper> RSS Update - forum: Can't connect at new location <http://forums.openvpn.net/topic8787.html#p15444>
17:04 -!- zastaph [zastaph@unaffiliated/zastaph] has quit []
17:10 <@vpnHelper> RSS Update - forum: Help PLease....connected but can't browse <http://forums.openvpn.net/topic8788.html#p15445>
17:22 <@vpnHelper> RSS Update - forum: Can't connect at new location <http://forums.openvpn.net/topic8787.html#p15446>
18:06 -!- nikanok [~nickynick@224.208.34.95.customer.cdi.no] has quit []
18:09 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
18:09 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
19:12 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has quit [Quit: bbohling]
19:14 -!- Squidy [~quassel@189-72-141-18.cbace701.dsl.brasiltelecom.net.br] has joined #openvpn
19:14 -!- Squidy [~quassel@189-72-141-18.cbace701.dsl.brasiltelecom.net.br] has quit [Changing host]
19:14 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:16 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 252 seconds]
19:18 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:28 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:30 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
20:30 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
20:57 -!- strainwrld [~local@85.139.253.148] has joined #openvpn
21:01 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has joined #openvpn
21:02 -!- EugeneEverything is now known as EugeneKay
21:15 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:47 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has quit [Quit: bbohling]
22:15 -!- Denial [Denial@drgi.co.uk] has quit []
22:15 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has joined #openvpn
22:19 -!- Grimshaw [~Grimshaw@50.58.99.193] has joined #openvpn
22:20 < Grimshaw> Hello
22:20 < Grimshaw> I am having trouble configureing open vpn for centos 5.6 
22:20 < Grimshaw> Could someone direct me to some VALID instrutions
22:21 < Grimshaw> all of the instrutions iv tried are siffrent and never work
22:30 < EugeneKay> That really depends on what sort of setup you're trying to create
22:30 < EugeneKay> The hardest part of diving into OpenVPN is the ssl PKI stuff that you "have" to generate.... for a simple setup(1 client, 1 server) it's perfectly OK to use a shared secret instead.
22:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
22:42 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 252 seconds]
22:42 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:46 < Grimshaw> EugeneKay, can you link me some good intructions? I'm only going to set up 1 client with my server
22:47 < EugeneKay> !howto
22:47 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:47 < Grimshaw> ok...
22:47 < EugeneKay> "Static Key Mini-HOWTO"
22:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:53 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:58 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has quit [Quit: bbohling]
23:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 252 seconds]
23:12 -!- strainwrld [~local@85.139.253.148] has left #openvpn ["Leaving"]
23:39 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
23:39 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
23:39 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:45 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
--- Day changed Sun Sep 11 2011
00:05 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:06 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
00:40 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
00:46 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
00:53 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:07 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:08 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
01:20 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:23 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
01:30 <@vpnHelper> RSS Update - forum: Can't connect at new location <http://forums.openvpn.net/topic8787.html#p15447>
01:40 < Bushmills> depends on your needs.  static key isn't for multiple clients
01:40 < Bushmills> multiple concurrent clients
01:44 < krzie> and does not offer forward security
01:44 < krzie> !forwardsecurity
01:44 -!- TheoKar [~TheoKar@HSI-KBW-085-216-037-060.hsi.kabelbw.de] has joined #openvpn
01:44 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
01:44 < TheoKar> !pptp
01:44 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read
01:44 <@vpnHelper> about why to not use pptp or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
01:46 < Bushmills> krzie: assume that once a key was reversed, any key could.  
01:46 < Bushmills> just a matter of additional effort :)
01:46 -!- cooldude [~cooldude1@unaffiliated/cooldude13233] has joined #openvpn
01:47 < Bushmills> but whether you need to invest 10000 years cpu time for one year of traffic, or for one hour, is a mere detail 
01:48 < krzie> one i find important when choosing my setup
01:48 < Bushmills> a matter of just a factor of 10^4 extra power 
01:49 < Bushmills> not even
01:49 < krzie> =]
01:50 < krzie> 8.76*10^3
02:04 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
02:06 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:14 -!- bsdboy [~bsdboy@unaffiliated/deesl] has quit [Ping timeout: 240 seconds]
02:50 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:54 < EugeneKay> Bushmills - that's why I said "for a simple setup(1 client, 1 server) it's perfectly OK to use a shared secret instead."
02:56 < Bushmills> some might assert that a shared secret is only half a secret :)
02:57 < EugeneKay> It's better than blasting it across an open ire
02:57 < EugeneKay> wire
02:57 < Bushmills> or an oxymoron, like "smart politician" or "friendly fire"
03:05 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
03:05 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
03:05 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
03:33 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:35 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
03:36 <@vpnHelper> RSS Update - forum: authentication failed using myphpadmin <http://forums.openvpn.net/topic8790.html>
03:43 -!- zastaph [zastaph@unaffiliated/zastaph] has joined #openvpn
03:48 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:49 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 250 seconds]
03:58 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:15 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:17 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
04:56 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:59 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
04:59 -!- K1ng [~k1ng@58.97.132.210] has joined #openvpn
04:59 -!- K1ng [~k1ng@58.97.132.210] has quit [Changing host]
04:59 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:01 -!- michl [~fjutscha@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has joined #openvpn
05:01 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
05:02 -!- michl [~fjutscha@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has quit [Client Quit]
05:14 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:15 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
05:17 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
05:27 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:31 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
05:39 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
05:43 <@vpnHelper> RSS Update - forum: Gorkhaan's Setup ( Wordpress + OpenVPN fun ) <http://forums.openvpn.net/topic3158.html#p15449>
05:43 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:45 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
05:51 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:55 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
05:57 -!- michl [~fjutscha@2.213.41.230] has joined #openvpn
05:58 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
06:00 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:01 <@vpnHelper> RSS Update - forum: Gorkhaan's Setup ( Wordpress + OpenVPN fun ) <http://forums.openvpn.net/topic3158.html#p15450>
06:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 250 seconds]
06:03 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Remote host closed the connection]
06:08 -!- michl [~fjutscha@2.213.41.230] has quit [Ping timeout: 258 seconds]
06:25 <@vpnHelper> RSS Update - forum: Gorkhaan's Setup ( Wordpress + OpenVPN fun ) <http://forums.openvpn.net/topic3158.html#p15451>
06:27 -!- michl [~fjutscha@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has joined #openvpn
06:29 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 258 seconds]
06:30 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:31 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
06:32 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
06:33 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
06:38 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
06:44 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:46 -!- michl [~fjutscha@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has quit [Quit: michl]
06:47 -!- novaflash [novaflash@openvpn/user/novaflash] has quit [Remote host closed the connection]
06:47 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
06:47 -!- mode/#openvpn [+v novaflash] by ChanServ
06:48 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
06:48 -!- michl [~michl@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has joined #openvpn
06:53 -!- michl [~michl@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has quit [Ping timeout: 260 seconds]
06:59 -!- michl [~michl@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has joined #openvpn
07:00 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 260 seconds]
07:00 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:02 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:02 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
07:05 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
07:09 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
07:13 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
07:15 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
07:16 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Client Quit]
07:16 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
07:17 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:25 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
07:27 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:30 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
07:45 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:45 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:46 -!- TheoKar [~TheoKar@HSI-KBW-085-216-037-060.hsi.kabelbw.de] has left #openvpn []
07:47 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
07:55 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
07:56 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
08:13 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:14 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:16 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
08:17 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
08:18 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
08:27 -!- rbd [~rbd@cpe-076-182-045-156.nc.res.rr.com] has quit [Read error: Connection reset by peer]
08:32 -!- kyrix [~ashley@pha75-6-89-82-88-210.dsl.sta.abo.bbox.fr] has joined #openvpn
08:42 -!- Grimshaw [~Grimshaw@50.58.99.193] has left #openvpn []
08:52 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has left #openvpn []
08:57 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:59 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
09:04 -!- master_of_master [~master_of@p57B55EDD.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:04 <@vpnHelper> RSS Update - forum: Help PLease....connected but can't browse <http://forums.openvpn.net/topic8788.html#p15452>
09:04 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
09:05 -!- master_of_master [~master_of@p57B527E2.dip.t-dialin.net] has joined #openvpn
09:09 < ph1l> how do i allow the client to define which networks are routed trough the VPN? is this possible?
09:16 < ecrist> you setup routes on the client
09:16 < ecrist> !route
09:16 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
09:16 -!- tty234_ is now known as tty234
09:25 < ph1l> hmmm, thx for the hint, but, what i would like to do is the following: i have a openvpn-server. now i would like to modify my client-config to access www.whatismyip.com trough the tunnel (or any other site/network). great would be to give the client the possibility to even route all traffic trough the server (if the client would like to do so). 
09:25 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:25 < reiffert> !def1
09:25 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:25 < ecrist> do you control the server, ph1l ?
09:26 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
09:26 < ph1l> yes i do, but it sould be great if i don't have to modify the server config every time to add a "push 'route...'"
09:26 < ecrist> !ccd
09:26 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
09:27 < ecrist> also, you need to configure the server to pass traffic from vpn clients back out to the internet, and to nat that traffic
09:29 < ph1l> ok, with this i could make a per cn config… can't i do a generic server config and let the client decide?
09:30 < ecrist> sure, you can, but only if the vpn server is setup to route for everything.
09:31 < ph1l> i'll try. thank you very much for your assistance!
09:34 <@vpnHelper> RSS Update - forum: Help server settings <http://forums.openvpn.net/topic8791.html>
09:47 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has joined #openvpn
09:49 -!- Squidy [~quassel@187.52.123.101] has joined #openvpn
09:49 -!- Squidy [~quassel@187.52.123.101] has quit [Changing host]
09:49 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
09:53 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 260 seconds]
10:02 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
10:05 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
10:05 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
10:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
10:15 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
10:16 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
10:22 < ph1l> how do i specify a route within the client-config-file? problem is that with a route entry the it seems that i cant define a dev, so the route is mapped to eth0 and not tun0?
10:26 -!- Plebby [~Plebby@ppp203-122-218-242.static.internode.on.net] has joined #openvpn
10:27 < hyper_ch> you want to push a route to the client?
10:28 < ph1l> no, i would like the client to be able to define the routes by them self
10:29 < ph1l> actually i would like to automate the client-config to issue a "route add 88.22.33.1/32 10.0.0.1" after the tunnel is established
10:29 < ph1l> where 10.0.0.1 is the openvpn-server
10:30 -!- Plebby [~Plebby@ppp203-122-218-242.static.internode.on.net] has quit [Remote host closed the connection]
10:30 < hyper_ch> with CCDs you can push specific things to specific clients
10:31 < hyper_ch> and on the client side, you could just overwrite everything again if you want
10:31 < ph1l> how do i overwrite? up "/sbin/route add 72.233.89.199/24 10.0.0.1" doesn't seems to work
10:32 < hyper_ch> just put in the according CCD:   push "route add 88.22.33.1/32 10.0.0.1"
10:32 < ph1l> i don't want to modify the server config since it's really dynamic 
10:34 < |Mike|> you don't want your end-user pushing routes ;)
10:35 < ph1l> i know, sounds funny, but thats actually exactly what i try to do :-)
10:35 < |Mike|> EEK!
10:37 < ph1l> you know, for some tasks we have to tell our customers a fixed ip. it would be great to let the auditors just change the client-config and then gets access to the client trough the openvpn-server with the fixed ip
10:39 < ph1l> but i can life with manually entering the routes after the vpn-connection is established. i was just wondering if there isn't a configuration option within the client-config to archive that
10:40 < ph1l> thank you very much ecrist, hyper_ch and Mike :-)
10:41 < EugeneKay> |Mike| - yes?
10:41 < EugeneKay> ph1l - if you want client-pushable routes.... you need Quagga or such.
10:46 < ph1l> EugeneKay: thanx for the hint, but that seems a bit overkill for me :-)
10:47 -!- albech [~albech@61.7.176.128] has joined #openvpn
10:47 < hyper_ch> do I get cookies?
10:47 < albech> are there some hooks that can be used to run scripts from?
10:47 < EugeneKay> I'm buying brownies at the store later
10:48 < hyper_ch> albech: what kind of hooks?
10:48 < |Mike|> woah virtualbox is teh slow
10:48  * hyper_ch likes brownies
10:48 < albech> i want to mount a remote storage once my VPN is up
10:48 < EugeneKay> Well, there's the up scripts....
10:48 < hyper_ch> client-connect  "/etc/openvpn/scripts/client-up.sh"
10:49 < hyper_ch> client-disconnect  "/etc/openvpn/scripts/client-down.sh"
10:49 < hyper_ch> you can put many evil things in there
10:49 < albech> thanks
10:50 < EugeneKay> See "scripting and environmental variables" in the man page
10:51 < albech> EugeneKay: thanks
10:56 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
11:01 -!- dxtr [vjmbx0@unaffiliated/dxtr] has quit [Quit: WeeChat 0.3.5]
11:01 -!- dxtr [irbkhq@unaffiliated/dxtr] has joined #openvpn
11:22 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:31 -!- julius_ [8d296273@gateway/web/freenode/ip.141.41.98.115] has joined #openvpn
11:31 < julius_> hi
11:32 < julius_> ive just started a openvpn windows client, static key howto.   the task applet says theres a connection but i cant ping the server from the windows client?
11:32 < julius_> i can ping server -> server and server -> client
11:35 < reiffert> firewall.
11:42 < |Mike|> or "topic" :P
11:49 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Quit: Leaving.]
11:49 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
12:01 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
12:02 -!- albech [~albech@61.7.176.128] has quit [Quit: Leaving]
12:09 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
12:11 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
12:12 < julius_> the firewall is set to alarm the user on new connections
12:13 < reiffert> server-> client works?
12:14 < reiffert> well it's sending ping and receiving ping.
12:14 < reiffert> so the line is up n running
12:14 < julius_> even with the firewall set to off i cant ping to the openvpn server
12:14 < reiffert> when client->server fails, then it's your firewall.
12:14 < julius_> does windows figure out howto reach 10.8.3.1 automatically?
12:15 < julius_> or does it maybe try to reach it via another interface instead of "windows tun" ?
12:15 < julius_> ok, will check firewall again
12:15 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:15 < reiffert> same subnet
12:20 < EugeneKay> My experience says that Windows will first sit down and smoke a fat joint, then pass out drunk and eat your packets.
12:20 -!- zastaph [zastaph@unaffiliated/zastaph] has left #openvpn []
12:21 < hyper_ch> hi reiffert
12:23 < krzie> mmm fat joints
12:24 -!- EugeneKay is now known as EugeneBeer[2]
12:24 < hyper_ch> hi krzie
12:24 < krzie> hey hyper
12:25 < hyper_ch> are you a screen person or a tmux person?
12:25 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
12:25 < krzie> screen
12:26 < hyper_ch> I got converted to tmux :)
12:26 < krzie> by default, never played with tmux
12:26 < hyper_ch> tmux has a few nice gimmicks over screen
12:27 < hyper_ch> easy horizontal / vertical screen splitting
12:27 < hyper_ch> and programmable status bar
12:28 < EugeneBeer[2]> I've been meaning to byobu
12:28 < hyper_ch> krzie: in case you wonder:  http://blog.hawkhost.com/2010/06/28/tmux-the-terminal-multiplexer/
12:29 < EugeneBeer[2]> I normally just fire off another PuTTY and stick it alongside
12:32 < Dougy> krzee: replied to you
12:32 < Dougy> or krzie  too
12:34 < krzie> yay dougy is alive!
12:34 < hyper_ch> EugeneBeer[2]: putty?
12:35 < hyper_ch> isn't that like a windows program?
12:35 < EugeneBeer[2]> Yup. All my boxen with mice are Windows 7
12:35 < EugeneBeer[2]> Though putty is available in fedora/centos last I looked
12:35 < krzie> hows your leg dougy
12:35 < hyper_ch> EugeneBeer[2]: you don't use screen?
12:35 < EugeneBeer[2]> I do
12:36 < EugeneBeer[2]> I open a secon PuTTY when I need to see >1 screen ato nce
12:36 < hyper_ch> lol :)
12:36 < EugeneBeer[2]> https://twitpic.com/4rmp45
12:36 <@vpnHelper> Title: Twitpic - Share photos and videos on Twitter (at twitpic.com)
12:37 < EugeneBeer[2]> At any given time I have 10+ PuTTY windows open..... and that's just PuTTY :-p
12:37 < hyper_ch> there's still space between the screen
12:37 < hyper_ch> you waste useful visibility field
12:37 < EugeneBeer[2]> There's also Failfox, VMware vSpheres, Workstation, Chrome, SmartGit.....
12:37 < hyper_ch> useful view range?
12:37 < hyper_ch> no clue what the right expression i
12:37 < EugeneBeer[2]> field of view
12:38 < krzie> i just open more terminal tabs
12:38 < EugeneBeer[2]> If I had thought ahead I would have bought a motherboard with 3xPCIe x16 slots, so I could add two more vertical wing monitors
12:38 < EugeneBeer[2]> Oh well, stupid me.
12:38 < hyper_ch> :)
12:39 < hyper_ch> todo for the next computer
12:39 < krzie> i find that expose / spaces gives me the multi-monitor support i require without a second monitor
12:39 < EugeneBeer[2]> Indeed.
12:39 < krzie> on this 17" laptop
12:39 < EugeneBeer[2]> I use a combination of windows apps to get the effects I'm after.
12:39 < hyper_ch> I don't think I'll ever be able again to use a laptop
12:40 < hyper_ch> my furballs demand my lap :(
12:40 < hyper_ch> so I have to use a netbook
12:40 < hyper_ch> krzie: you're on Lion?
12:40 < krzie> SL
12:40 < EugeneBeer[2]> WinSplit Revolution is the big one(and it ROCKS) for getting exact position+sizing. I also have something called Glass2k for easy transparency changing, and FreeSnap for quick shortcuts
12:40 < hyper_ch> SL?
12:40 < Dougy> krzie: im online every day
12:40 < hyper_ch> ah :)
12:40 < Dougy> i just seldom attach this screen session
12:40 < krzie> snow leopard
12:40 < EugeneBeer[2]> Scientific Linux? :-p
12:41 < krzie> Dougy, you had 256 hours idle :-p
12:41 < Dougy> 17:40 < Dougy> i just seldom attach this screen session
12:41 < EugeneBeer[2]> ZNC > irssi
12:41 < hyper_ch> 256h idle time is quite a bit
12:41 < krzie> [13:37]  <krzie> hows your leg dougy
12:41 < Dougy> krzie: gimpy as usual
12:41 < Dougy> im still hobbling around
12:41 < Dougy> if anything the operation made it worse
12:42 < Dougy> only fixed some stuff consmetically
12:42 < Dougy> cosmetically
12:42 < krzie> please if possible send that server out to florida asap, i have important stuff i need to do on it
12:42 < Dougy> fraud :O) just kidding
12:42 < Dougy> ya
12:42 < Dougy> im gonna try to go to fedex tomorrow night
12:43 < krzie> no, legal stuff :-p
12:43 < hyper_ch> send servers with fedex?
12:43 < Dougy> its probably going to be expensive to ship it
12:43 < Dougy> gonna pay them to pack it etc
12:43 < krzie> right on man, just lemme know what it runs
12:43 < hyper_ch> you trust fedex with servers?
12:43 < Dougy> hyper_ch: you bet
12:43 < Dougy> never giving UPS a server again
12:43 < hyper_ch> but isn't UPS good for servers?
12:43 < Dougy> no
12:44 < EugeneBeer[2]> Well this is rather extreme. I've blown 2GB of NTP out the door since Thursday on my ntp2 box.
12:44 < krzie> they can both suck
12:44 < Dougy> http://www.supermicro.com/products/chassis/3U/933/SC933T-R760.cfm
12:44 <@vpnHelper> Title: Super Micro Computer, Inc. - Products | Chassis | 3U | SC933T-R760 / SC933T-R760B (at www.supermicro.com)
12:44 < Dougy> i have seen UPS turn that case into 1u 
12:44 < Dougy> the whole rear half
12:44 < krzie> depends on the drivers and whatnot
12:44 < Dougy> destroyed the motherboard and everything
12:44 < EugeneBeer[2]> I've never had to file a UPS claim
12:44 < hyper_ch> I generally don't ship servers around
12:44 < Dougy> i didnt either :) i was the shipper not the receiver
12:44 < EugeneBeer[2]> I dunno what you guys are doing to screw up your packing, but my shtuff has always been great
12:45 < Dougy> EugeneBeer[2]: that server had $50 of bubble wrap on it
12:45 < Dougy> it was almost twice as thick with the bubble wrap
12:45 < Dougy> it was well packed.
12:45 < hyper_ch> Dougy: how long did it take the recipient to blast all bubbles?
12:45 < krzie> i try not to ship them around either... but that thing wont do me much good in dougy's closet and i need a server in florida
12:45 < Dougy> its actually under a couch in the basement
12:46 < Dougy> krzie: do you want me to configure anything prior to sending it out
12:46 < Dougy> ie IP
12:46 < krzie> nah just ship her out
12:46 < hyper_ch> basement is good, but why hide it under the couch?
12:46 < krzie> ill be reinstalling
12:46 < hyper_ch> FreeBSD?
12:46 < Dougy> hyper_ch: i still live with my folks
12:46 < Dougy> and
12:46 < Dougy> they said if they see any server remnant laying around anywhere its getting thrown out
12:46 < krzie> you're talking to krzee... yes freebsd ;]
12:46 < Dougy> theyre tired of me shitting things up
12:47 < hyper_ch> awwww :(
12:47 < EugeneBeer[2]> I kicked my dad out of the house a year ago 
12:47 < Dougy> well, i'm 18 and just barely into college
12:47 < Dougy> so no money to move out
12:47 < Dougy> working on it
12:47 < hyper_ch> CS?
12:47 < Dougy> IT
12:47 < Dougy> fuck CS
12:47 < Dougy> i can't stand programming
12:47 < hyper_ch> isn't that the same?
12:47 < Dougy> no, CS is more programming, IT is more conceptual
12:47 < krzie> it = more networking and stuff
12:47 < krzie> cs = more programming and stuff
12:48 < hyper_ch> and economics is more make money?
12:48 < krzie> of course they overlap a little
12:48 < Dougy> http://it.njit.edu/academics/concentration-netsecurity.php
12:48 -!- EugeneBeer[2] is now known as EugeneBeer[3]
12:48 < krzie> EugeneBeer++
12:48 < EugeneBeer[3]> >_>
12:49 < Dougy> lol,
12:49 < hyper_ch> so, what server are we talking about that is to be shipped to the stormy floriday?
12:49 < krzie> if he drinks too much he'll become EugeneBeer[@] 
12:49 < Dougy> it's an ancient server
12:49 < Dougy> socket 478 celeron
12:49 < Dougy> :)
12:50 < hyper_ch> so no quad xeon with 64gb ram?
12:50 < EugeneBeer[3]> I shot one of those the other day
12:50 < krzie> fuck that things really a celeron?
12:50 < Dougy> krzie: lol
12:50 < Dougy> yes
12:50 < krzie> hyper_ch, care to donate one to me?
12:50 < EugeneBeer[3]> I have a few P3 Dells up for target practice next
12:50 < Dougy> http://www.supermicro.com/products/motherboard/P4/875/P4SCT.cfm
12:50 <@vpnHelper> Title: Super Micro Computer, Inc. - Products | Motherboards | Pentium® 4 Boards | P4SCT (at www.supermicro.com)
12:50 < Dougy> may have a p4
12:50 < hyper_ch> krzie: pretty sure you'd only do evil things on it
12:50 < Dougy> er, i may have one
12:50 < Dougy> laying around
12:50 < krzie> darknet voip is not evil
12:50 < hyper_ch> how about a full rack of blades?
12:51 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
12:51 < Dougy> i am looking at getting a 2nd hand Dell C6100
12:51 < Dougy> !gogole Dell C6100
12:51 < Dougy> !google Dell C6100
12:51 <@vpnHelper> PowerEdge C6100 Rack Server Details | Dell: <http://www.dell.com/us/enterprise/p/poweredge-c6100/pd>; PowerEdge C6100 Rack Server Details | Dell: <http://www.dell.com/us/business/p/poweredge-c6100/pd>; PowerEdge C6100 - Dell: <http://www.dell.com/downloads/global/products/pedge/en/poweredge-c6100-spec-sheet-en.pdf>
12:51 < krzie> hyper_ch, that'll work
12:51 < hyper_ch> krzie: as soon as I have something like that laying around here, I'll ship it to you
12:52 < hyper_ch> you remember the other day where IBM announced that cluster they were building?
12:52 < EugeneBeer[3]> Honestly, anything that doesn't have VTx isn't worth the electrons to run i
12:54 < hyper_ch> how much is that dell c6100?
12:54 < EugeneBeer[3]> Decently equipped? About $15,000.
12:55 < hyper_ch> awww :(
12:55 < hyper_ch> are you sure you did not add a '0' too much to it?
12:56 < EugeneBeer[3]> Pretty sure. Dell generally wants about $3500-4000 for a dual six-core box with 48GB of ram and 4xGbE NICs, depending upon form factor(1U, blade, or that thing)
12:56 < EugeneBeer[3]> I last ran their configurator prices about two weeks ago
12:56 < EugeneBeer[3]> They rape you pretty good on hard drives(only $2000 for a 100GB ssd!)
12:56 < hyper_ch> :)
12:56 < hyper_ch> lol
12:56 -!- julius_ [8d296273@gateway/web/freenode/ip.141.41.98.115] has quit [Quit: Page closed]
12:57 < Dougy> hyper_ch: 
12:57 < Dougy> $3000 for the ones I am looking at
12:57 < EugeneBeer[3]> If you want to build an ESXi box on the cheap, get a 1U Supermicro barebones with a 12-dimm mobo, feed it 6x8GB sticks and a pair of six-core Xeons, slap in a 128GB ssd, add a 4-port GbE card, and off to the races you go.
12:57 < Dougy> $2900 actually
12:58 < EugeneBeer[3]> Per node?
12:58 < Dougy> no
12:58 < Dougy> for 4
12:58 < EugeneBeer[3]> o.O
12:58 < EugeneBeer[3]> Bargain-basement config much? :-p
12:58 < Dougy> 2x L 5420, 16GB RAM each, 2 750GB HDD's each
12:58 < Dougy> x 4 nodes
12:58 < Dougy> 1yr warranty
12:58 < EugeneBeer[3]> L5420s are garbage
12:58 < EugeneBeer[3]> Go for the E5620s
12:59 < Dougy> ya, sure, you give me 30k
12:59 < Dougy> or 25k
12:59 < Dougy> L5420's are not that bad
12:59 < Dougy> really not
12:59 < Dougy> it's only a 15-20% performance gain for dual e5620
13:00 < EugeneBeer[3]> It's an easy 20%
13:01 < EugeneBeer[3]> What's the workload gonna be?
13:01 < Dougy> nothing. if i can get my friend to get the number of the units he was considering
13:01 < Dougy> i'll get 3 or 4 of those c6100 for free
13:01 < Dougy> so then ill find a use
13:01 < Dougy> :)
13:01 < EugeneBeer[3]> Heh.
13:02 < EugeneBeer[3]> If you're looking for a place to stick it, I have a colo at HE-Fmt2 with a 100mbit pipe >_>
13:02 < EugeneBeer[3]> (I would sell my own mother for more vHosts at this point)
13:05 < Dougy> i do thank you for that
13:05 < Dougy> but i live in the ny metro area and colo is abundant here.. also i have homies in maryland that hook me up
13:05 < EugeneBeer[3]> Lucky git
13:05 < hyper_ch> how much do you pay for colo?
13:06 < EugeneBeer[3]> Monthly, $400 for 15A and $100 for 100mbit
13:06 < hyper_ch> 15A?
13:06 < EugeneBeer[3]> 120V, 15A breaker
13:06 < EugeneBeer[3]> Cabinet space is free
13:07 < hyper_ch> quite pricey
13:07 < EugeneBeer[3]> For premium nocal bandwidth? Not really
13:07 < hyper_ch> sounds pricey to me
13:08 < EugeneBeer[3]> Nearest datacenter-direct quote in the same area I found was twice that, all in bandwidth fees.
13:08 < hyper_ch> why not rent dedicated server?
13:09 < EugeneBeer[3]> You can find better prices from wholesalers, but they're overcommitting their breakers & bandwidth and banking on you not blowing a circuit
13:09 < EugeneBeer[3]> Because you can't rent a NetApp for less than $5k a month
13:09 < hyper_ch> what's a netapp?
13:09 < EugeneBeer[3]> !google NetApp
13:09 <@vpnHelper> NetApp: <http://www.netapp.com/>; NetApp - NetApp Careers - Careers: <http://www.netapp.com/us/careers/>; NetApp - Network Storage, Cloud Computing, Virtualization, Storage ...: <http://www.netapp.com/us/>
13:10 < jeev> EugeneBeer[3], give me free 1u
13:10 < jeev> i have like 12 1u's colo'd and a cage
13:10 < jeev> i love diversity.
13:10 < jeev> oh, you're at he i think.
13:10 < EugeneBeer[3]> HE-FMT2
13:10 < jeev> is it as icky as i think ?
13:10 < hyper_ch> not getting netapp
13:10 < EugeneBeer[3]> No, FMT1 is the building with the power problems
13:11 < EugeneBeer[3]> FMT2 is brand-spanking-new, and absolute aces.
13:11 < jeev> cool
13:11 < jeev> how often does the network crap out
13:11 < EugeneBeer[3]> The only problem I've ever had with them, ever, was 2 months ago when one of their customers pissed off China and got DDoSed to the point where it maxed out their 10GbE links.
13:12 < jeev> i feel like they're either a nsa/cia hub or warez
13:12 < jeev> probably all
13:13  * EugeneBeer[3] srugs
13:13 < EugeneBeer[3]> I'm very happy with them
13:13 < EugeneBeer[3]> I priced out 45mbit of OC-3 to my house at $500/mo with a 3-year contract.... but the telco refused to dig the ditch for the fiber when they came to do the site survey
13:14 < EugeneBeer[3]> Apparently my hill is too steep of a gradient for their pansy excavator
13:14 < EugeneBeer[3]> So, I bought a rack in CA instead
13:14 < jeev> what!
13:14 < jeev> including loop ?
13:14 < EugeneBeer[3]> Yup, whole shebang. 
13:14 < jeev> who's the telco
13:14 < EugeneBeer[3]> some bullshit AR local provider
13:15 < jeev> i got a gige loop to one wilshire
13:15 < jeev> 4000/month
13:15 < jeev> from like 13 miles away
13:15 < jeev> quote.
13:15 < jeev> through charter.
13:15 < EugeneBeer[3]> You don't live in Flippin, Arkansas.
13:15 < jeev> that's cheap
13:15 < jeev> arkansas
13:15 < jeev> nothing good there but bill clinton
13:15 < EugeneBeer[3]> It was only a 2-mi ditch down to the local switchbox
13:16 < EugeneBeer[3]> But.... the redneck said "nyet"
13:16  * EugeneBeer[3] ++
13:16 -!- EugeneBeer[3] is now known as EugeneBeer[4]
13:16 < jeev> rednecks say lots of things
13:17 -!- SeriousSam_ [kvirc@shpd-95-53-148-60.vologda.ru] has joined #openvpn
13:18 < SeriousSam_> Hi there! How can I enclude multiple machines on the client side when using a bridged VPN? I read "How to" on official site but please explain me in details ste-by-step. Thanks in advance.
13:18 < EugeneBeer[4]> !factoids
13:18 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
13:19 < EugeneBeer[4]> You need to use a ccd/ with an iroute directive
13:19 < EugeneBeer[4]> Something like this, but with only one client to worry about. http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
13:19 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
13:20 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
13:20 < EugeneBeer[4]> (on a related note, can the wiki PLEASE be changed to use /wiki/ instead of /wiki/index.php/? It's an easy .htaccess change....)
13:21 < SeriousSam_> I tried all as described in http://openvpn.net/index.php/open-source/documentation/howto.html#scope  in "Including multiple machines on the client side when using a bridged VPN (dev tap)" section
13:21 <@vpnHelper> Title: HOWTO (at openvpn.net)
13:23 < SeriousSam_> I downloaded bridge-utils, install it, create a bridge. Please tell me what I need to do after this. I need tap, not tun.
13:23 < SeriousSam_> And routing can't help me
13:24 < Bushmills> why do you bridge at all?
13:24 < EugeneBeer[4]> "Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
13:25 < SeriousSam_> Bushmills: It is from how to
13:25 < SeriousSam_> You must bridge the client TAP interface with the LAN-connected NIC on the client.
13:25 < SeriousSam_> You must manually set the IP/netmask of the TAP interface on the client.
13:25 < SeriousSam_> You must configure client-side machines to use an IP/netmask that is inside of the bridged subnet, possibly by querying a DHCP server on the OpenVPN server side of the VPN.
13:25 < Bushmills> that's not a good reason
13:25 < Bushmills> why did you follow a howto which configures a bridge?
13:26 < SeriousSam_> http://openvpn.net/index.php/open-source/documentation/howto.html#scope     and scroll down to "Including multiple machines on the client side when using a bridged VPN (dev tap)"
13:26 <@vpnHelper> Title: HOWTO (at openvpn.net)
13:26 < SeriousSam_> Bushmills: please read it
13:27 < Bushmills> "when using a bridge"....   it doesn't say "you must use a bridge"
13:27 < SeriousSam_> And explain me what I do wrong
13:27 < SeriousSam_> It says
13:27 < Bushmills> i simply ask for the reason why - other than "a howto said so" - you think you need a bridge
13:28 < SeriousSam_> Ok, please advise another way to do it (multiple machines on the client side when using a bridged VPN (dev tap)) 
13:29 < Bushmills> !tunortap
13:29 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
13:29 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
13:29 < Bushmills> !route
13:29 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
13:29 < Bushmills> !clientlan
13:29 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
13:29 <@vpnHelper> better explanation
13:30 < SeriousSam_> Do you suggest to use tun instead of tap?
13:30 < Bushmills> those clients which you don't want to permit access to vpn, you'd firewall
13:30 < Bushmills> i can't suggest that as long i haven't heard a reason from you to use bridging
13:31 < SeriousSam_> For example I need broadcasts
13:31 < Bushmills> what do you need them for?
13:32 < SeriousSam_> For some specific programs which can locate some servers on LAN by broadcasting
13:32 < SeriousSam_> And it must work in whole network
13:32 < Bushmills> if you need broadcasts, you would need bridging
13:33 < SeriousSam_> Ok, how can I do it?
13:33 < Bushmills> that's what you have. you're done, i think
13:35 < SeriousSam_> Look. I have a VPN server (tap). I have VPN client (tap too of course). How can I do so that other machines on client side can be pinged for example from server side?
13:35 < ecrist> !iroute
13:35 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
13:35 < ecrist> or, if you're truly bridging a network, you need to brige tap and ethernet interfaces on the client
13:37 < SeriousSam_> ecrist: Yep, I did it but what I need to do then. It is the thing I want to find out. )
13:39 < SeriousSam_> I created bridge by "brctl addbr br0" ,,,etc then up br0 interface
13:39 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
13:40 < ecrist> SeriousSam_: show us ifconfig output for your bridge interface
13:42 < SeriousSam_> Must I append some address to br0 interface?
13:43 < SeriousSam_> http://pastebin.com/cGL0eZLJ
13:45 -!- kyrix [~ashley@pha75-6-89-82-88-210.dsl.sta.abo.bbox.fr] has quit [Ping timeout: 260 seconds]
13:50 < SeriousSam_> ecrist: Is it ok
13:50 < SeriousSam_> ?
13:51 < ecrist> I don't see the member interfaces
13:53 <@vpnHelper> RSS Update - forum: Set up VPN server behind proxy server <http://forums.openvpn.net/topic8792.html>
13:53 < SeriousSam_> It shown by brctl
13:54 < SeriousSam_> there are two eth0 and tap0
13:56 -!- michl [~michl@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has quit [Quit: michl]
14:09 < ecrist> firewall, then?
14:11 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:12 < reiffert> SeriousSam_: br0 carries the ip address. eth0 and tap0 dont have one.
14:14 -!- nixusr [~nixusr@205.185.121.60] has joined #openvpn
14:14 -!- nixusr [~nixusr@205.185.121.60] has quit [Changing host]
14:14 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
14:14 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
14:24 < SeriousSam_> Please any body decrypt the mean of this phrase:
14:24 < SeriousSam_> Including multiple machines on the client side when using a bridged VPN (dev tap)
14:24 < SeriousSam_>  
14:24 < SeriousSam_> This requires a more complex setup (maybe not more complex in practice, but more complicated to explain in detail):
14:24 < SeriousSam_>  
14:24 < SeriousSam_> You must bridge the client TAP interface with the LAN-connected NIC on the client.
14:24 < SeriousSam_> You must manually set the IP/netmask of the TAP interface on the client.
14:24 < SeriousSam_> You must configure client-side machines to use an IP/netmask that is inside of the bridged subnet, possibly by querying a DHCP server on the OpenVPN server side of the VPN.
14:24 -!- SeriousSam_ was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
14:25 -!- SeriousSam_ [kvirc@shpd-95-53-148-60.vologda.ru] has joined #openvpn
14:25 < SeriousSam_> http://pastebin.com/auJSn3D5
14:26 < SeriousSam_> Please anybody explain
14:27 < |Mike|> what part isn't clear?
14:28 < SeriousSam_> The first seams to be clear: "brctl addbr br0" then "brctl addif br0 eth0 tap0" and then "ifconfig br0 up". Right?
14:29 -!- EugeneBeer[4] is now known as EugeneBeer[5]
14:29 < SeriousSam_> eth0 is interface looking to my LAN
14:29 -!- EugeneBeer[5] is now known as EugeneBeer[6]
14:30 < SeriousSam_> |Mike|: Is it right?
14:38 -!- _zero__ [~zero@noc.toile-libre.net] has quit [Ping timeout: 240 seconds]
14:38 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has quit [Quit: bbohling]
14:39 -!- fremo [~fremo@noc.toile-libre.net] has quit [Ping timeout: 260 seconds]
14:41 < |Mike|> SeriousSam_: yep
14:41 < SeriousSam_> Ok, ehat then?
14:41 < SeriousSam_> what
14:41 < |Mike|> 2011/09/11 21:30:23 < SeriousSam_> |Mike|: Is it right?
14:42 < SeriousSam_> I mean, what I must to do after first step?
14:50 < reiffert> assign an IP addr to br0
14:52 < |Mike|> oh yeah, I almost forgot that :P
14:58 -!- EugeneBeer[6] is now known as EugeNap
15:05 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 260 seconds]
15:27 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
15:37 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
15:37 -!- Ionic [ionic@ionic.de] has joined #openvpn
15:37 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
15:39 -!- incidence [jussi@unaffiliated/incidence] has left #openvpn []
15:40 -!- Ionic [ionic@ionic.de] has joined #openvpn
15:40 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
15:41 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
15:41 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
15:41 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
15:41 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
15:53 <@vpnHelper> RSS Update - forum: Set up VPN server behind proxy server <http://forums.openvpn.net/topic8792.html#p15456> || Help PLease....connected but can't browse <http://forums.openvpn.net/topic8788.html#p15455>
15:54 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
16:07 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
16:09 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
16:18 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
16:23 -!- SeriousSam_ [kvirc@shpd-95-53-148-60.vologda.ru] has left #openvpn ["Reality is that which, when you stop believing in it, doesn't go away"]
16:47 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
17:45 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:11 <@vpnHelper> RSS Update - forum: Verifying Re-Direct of Traffic in "Road Warrior" connection <http://forums.openvpn.net/topic8763.html#p15457>
18:43 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
18:47 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: quit]
18:47 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html>
18:51 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
19:04 < dxtr> How much overhead is it to enable compression?
19:04 < dxtr> how much overhead can I expect that is
19:09 < krzee> you mean cpu overhead?
19:09 < krzee> cause bandwidth wise, its negative overhead...
19:10 < krzee> (or 0, depending whats going over the tunnel)
19:14 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
19:15 < Halitus> afternoon all, I have a problem (proibly with my firewall) I am just pastebining my config files then i will explain my issue
19:17 < Halitus> ok server and client config files are here  :   http://pastebin.com/fTM3Lfme
19:18 < Halitus> i am trying to set up a windows server to many windows clients vpn
19:18 < Halitus> First issue is port fowarding doesnt seam to work so i cant see my server from outside. 
19:18 < krzee> well port forwarding has nothing to do with openvpn
19:18 < krzee> so you need to fix that first
19:19 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
19:19 < krzee> second, please post configs like this:
19:19 < krzee> !configs
19:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
19:19 < krzee> with no commends
19:19 < krzee> comments*
19:19 < Halitus> second issue is when i connect to the vpn internally (from a seperate pc within the local network) I can connect and everything goes green but i cant ping down the tunnel ( 10.8.0.X)
19:20 < Halitus> krzee, i will re do the configs now
19:20 < krzee> are you using redirect-gateway?
19:20 < Halitus> and i appreciate the port fowarding isnt an openvpn issue
19:20 < Halitus> redirect-gateway?
19:20 < krzee> !goal
19:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:21 < Halitus> my goal is to connect a few pcs on the internet to a vpn with the server
19:21 < Halitus> i dont need the clients to see the rest of my local lan
19:21 < Halitus> or me theirs
19:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
19:22 < krzee> and the clients wont be accessing the internet through the server?
19:23 < Halitus> not at all
19:23 < krzee> cool, thats the most basic setup possible
19:23 < krzee> ill wait for the configs without comments
19:23 < Halitus> indeed i would have thought so
19:23 < Halitus> yep 1 sec
19:26 < Halitus> config scripts :  http://pastebin.com/YcEWfNja
19:27 < Halitus> i had to manualy grep :(
19:27 < Cr4zi3> http://imgur.com/dOBkg
19:27 <@vpnHelper> Title: imgur: the simple image sharer (at imgur.com)
19:28 < Halitus> i suspected my issues were due to windows fire walls do they are now disabled temp.
19:29 < Halitus> the client is able to connect and is given 10.8.0.6   then i try and ping 10.8.0.6 from the client and get nothing
19:29 < Halitus> and same from server to client
19:30 < Halitus> the client can ping its own TAP adapter 10.8.0.6
19:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:36 < Halitus> any abnormalities krzee ?
19:36 < Cr4zi3> http://24.media.tumblr.com/tumblr_lr1fjmoqf81qzwaddo1_500.jpg
19:43 < Halitus> brb 15 mins i left something at the office :(
19:49 < krzee> Halitus, you probably misunderstood what ipp.txt is doing
19:49 < krzee> !ipp
19:49 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
19:50 < krzee> other than that nothing jumped out at me, change your verb from 3 to 4 and pastebin logs
19:50 < krzee> !logs
19:50 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
19:53 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:54 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has joined #openvpn
19:56 < Halitus> krzee thats prety much what i thought ipp would do. ill set verb to 4 and post log files
19:57 < krzee> you knew that ipp would sometimes maybe give you the ip you had before?
19:57 < krzee> but made no garuntees about it
19:58 < krzee> most people blindly add it because it was in some lame web doc, and think it means that clients will keep that ip always
19:58 < Halitus> yeah I assumed it tries to keep the first ip it was given. but that its only a prefered ip
19:59 < Halitus> simmilar to how my dhcp hands out ips
19:59 < krzee> ok
20:00 < Halitus> having said that does it effect the server ip? or jsut the clients?
20:01 < krzee> clients only
20:01 < krzee> --server effects the server ip
20:01 < krzee> server takes .1
20:01 < Halitus> yep cool
20:03 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
20:03 < Halitus> oh no logs were produced :S do i need to run it as a service?
20:03 < Halitus> i have been using the gui
20:04 < krzee> !logfile
20:04 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
20:04 < krzee> manual specify a logfile
20:04 < krzee> manually*
20:04 < Halitus> ah within the config files?
20:04 < krzee> hehe ya
20:05 < krzee> where else?
20:05 < Halitus> :P
20:06 < Halitus> log "C:\\Program Files\\OpenVPN\\log\\log.txt" should work?
20:06 < krzee> yep
20:06 < krzee> theres also an easier way to do windows paths
20:06 < krzee> !winpath
20:06 <@vpnHelper> "winpath" is (#1) Remember on Windows to quote pathnames and use double backslashes, e.g.: "C:\\Program Files\\OpenVPN\\config\\foo.key" or (#2) also, you can use forward slashes to avoid needing double backslashes, but you still need quotes, e.g.: C:/Program Files/OpenVPN/config/foo.key (but surrounded by quotes)
20:07 < krzee> but that doesnt matter
20:07 < krzee> just thought ild mention it =]
20:07 < Halitus> ah fair enough is that openvpn specific? or does other software use that also?
20:07 < krzee> ovpn specific i believe
20:07 -!- Denial [Denial@drgi.co.uk] has quit []
20:08 < Halitus> herm openvpngui doesnt like me specifying a log file
20:10 < krzee> cant you just copy/paste the log data from the gui?
20:10 < krzee> (i dont use windows)
20:10 -!- troyt_ [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
20:10 < Halitus> doesnt seam to exist
20:10 < Halitus> it asks me to create the file
20:12 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 260 seconds]
20:12 -!- troyt_ [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has quit [Client Quit]
20:13 < krzee> comment out that line
20:13 < krzee> run openvpngui
20:13 < krzee> see if you can copy the output
20:13 < krzee> the gui has a window that shows you whats going on
20:14 < krzee> i bet you can copy the output from there
20:14 < Halitus> yeah i can is that all thats required?
20:14 < Halitus> heh
20:14 < Halitus> got it nvm
20:15 < Halitus> gah new issue
20:15 < Halitus> waiting for TUN/TAP interface to come up
20:15 < Halitus> on the client
20:15 < krzee> !logs
20:15 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
20:17 < Halitus> http://pastebin.com/u8sWRPgF server log
20:17 < Halitus> its long
20:18 < Halitus> http://pastebin.com/kJx7mn0v client log
20:18 < krzee> http://forums.openvpn.net/topic8290.html
20:18 <@vpnHelper> Title: OpenVPN Support Forum Need IPv6 code in mroute_extract_addr_from_packet : Configuration (at forums.openvpn.net)
20:18 < Halitus> the interface eventualy came up and it connected
20:18 < krzee> for the client:
20:18 < Halitus> can i just disable ipv6 on the adapters?
20:18 < krzee> !winroute
20:18 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file or (#2) many users also report it helps to add route-delay to give the interface extra time to get up or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access or (#4) make sure you are running openvpn as admin or (#5) http://openvpn.net/index.php/open-
20:18 <@vpnHelper> source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
20:19 < krzee> Halitus, yes
20:19 < krzee> (on the server)
20:19 < krzee> now, on the client...
20:19 < Halitus> ok
20:19 < krzee> winroute #1 and #2
20:19 < krzee> oh and
20:19 < krzee> did you runas administrator?
20:20 < Halitus> on the server yes not sure about the client
20:20 < Halitus> ill try now
20:20 < krzee> i mean on the client, looks like you didnt
20:21 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has quit [Quit: bbohling]
20:21 < Halitus> interesting
20:21 < Halitus> ok
20:21 < Halitus> client run as admin now
20:22 < Halitus> and i can ping it from the server
20:22 < Halitus> im unsure what i should be doing with rinroute
20:22 < Halitus> winroute
20:22 < Halitus> I am not really trying to route anything am I?
20:23 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
20:24 < krzee> well you cant reach the vpn without routes
20:24 < krzee> however, gimme a new log from client when running as admin
20:24 < krzee> its prolly fine now
20:24 < krzee> i pointed out winroute before i saw that you werent admin
20:24 < krzee> and you can ping, which really means everything is good =]
20:24 < krzee> but ill take another look if ya like
20:25 < Halitus> i should be able to reach the vpn if its on the PC running the adapter etc
20:25 < Halitus> is that correct?
20:25 < Halitus> ill post the log
20:25 < krzee> i dont understand the question
20:25 < krzee> "reach the vpn" is proven with a ping
20:26 < Halitus> well i understand needing routes If i want to let a pc on the client lan reach the server or pcs on the server side of the lan
20:26 < Halitus> but if i am jsut worried about the server and clients talking to each other and no other pcs behind them would i still requre routes?
20:26 < krzee> how would you reach 10.8.0.0 without a route to it?
20:26 < krzee> (--server adds routes)
20:27 < krzee> but only those required for the vpn itself
20:27 < krzee> unrelated to lans and whatnot
20:27 < Halitus> http://pastebin.com/LvBaYX7r
20:27 < Halitus> hmm ok
20:28 < krzee> you're good
20:28 < krzee> now, want 2 things that will improve your security?
20:28 < Halitus> i thought traffic generated on the pc would see that one of its adapters is on the 10.8.0.0 network and send it to that adapter
20:29 < Halitus> sure but security is not super important for this application
20:29 < Halitus> i was going to change the default port
20:29 < krzee> yes, because of the routing table ;]
20:29 < krzee> that wouldnt matter
20:29 < Halitus> yeah i think i understand
20:29 < krzee> portscan would show it
20:29 < krzee> *unless* you do this:
20:29 < Halitus> true
20:29 < krzee> !hmac
20:29 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls static key
20:29 <@vpnHelper> , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
20:29 < krzee> and then, you can do this to stop MITM
20:29 < krzee> !mitm
20:29 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: ns-cert-type server in the client config
20:30 -!- blazer6969 [~blazer696@109.129.14.221] has joined #openvpn
20:30 < Halitus> does the hmac stuff increase overhead?
20:31 < krzee> negligibly
20:31 < Halitus> so i used the easy rsa scripts to build the keys can i just add ns-cert-type to the slient config? 
20:31 < krzee> if you used the server script to make the server cert
20:31 < Halitus> does it mean i need to specify the comon name as "server"?
20:31 < Halitus> yes i did
20:31 < krzee> no
20:32 < krzee> "or use the easy-rsa build-key-server script to build your server"
20:32 < krzee> ;]
20:32 < Halitus> yep i saw that jsut checking
20:32 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:32 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:33 < Halitus> i read about nz-cert-type a bit when debugging and i got worried about it being a potential issue
20:33 < krzee> you did it right
20:34 < krzee> get it working, then add on the layers
20:34 < krzee> that way you get to test 1 thing at a time
20:34 < Halitus> cool
20:34 < Halitus> yeah
20:34 < Halitus> i have played with the access server in the past
20:34 < Halitus> and routing etc
20:34 < krzee> oh cool, i havnt yet
20:34 < krzee> ...one day
20:35 < krzee> how did ya like access-server?
20:35 < Halitus> it was nice and easy but there isnt much point if you understand how to use the community version
20:35 < krzee> sure there is
20:35 < Halitus> i did like the webUI though
20:35 < krzee> the corporate support alone is enough reason for many businesses
20:35 < krzee> of course for me personally i agree
20:36 < Halitus> my first plan for this link was to just add some routes for data heading to the clients lan
20:36 < Halitus> oh yes i totaly agree about support
20:36 < Halitus> but for personal playing around not really requried
20:36 < krzee> agreed
20:37 < Halitus> thanks heaps for the help
20:37 < krzee> you're welcome =]
20:37 < krzee> enjoy the vpn!
20:37 < Halitus> will do . ill probably be back when i break it
20:38 < Halitus> I might lurk here for a bit any way
20:38 < krzee> feel free
20:38 < krzee> who knows, maybe you'll end up helping the next guy!
20:39 < Halitus> i often try but get out of my depth quickly
20:39 < Halitus> any way i gota go grab some stuff ill be back in 20 mins ish
20:39 < Halitus> cheers again
20:39 < krzee> oh hey
20:39 < Halitus> yep?
20:39 < krzee> if you wanna skim a bunch of info
20:39 < krzee> !factoids
20:39 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
20:39 < krzee> thats everything the bot knows
20:39 < Halitus> thats the stuff the bot gives out?
20:39 < Halitus> ah right
20:39 < Halitus> gotcha
20:40 < Halitus> I am trying to automate the install for the clients so i might need help with some of that in th future
20:40 < krzee> !win_rollup
20:40 <@vpnHelper> "win_rollup" is please see http://www.secure-computing.net/wiki/index.php/OpenVPN/HowTo_for_Windows_2 for dazo's writeup on making unattended windows installers for openvpn
20:40 < Halitus> herm
20:40 < Halitus> k then
20:41 < krzee> ;]
20:41 < Halitus> i might retire my script before i use it
20:41 < krzee> you might find your script easier
20:41 < krzee> hehe
20:41 < Halitus> ill look into it
20:41 < krzee> but i cant write windows scripts, so ill be no help there
20:41 < krzee> bash scripts im good with
20:41 < Halitus> neither can I :P
20:41 < Halitus> any way chat later :)
20:48 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Ping timeout: 260 seconds]
20:50 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
21:01 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has joined #openvpn
21:08 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:24 < Halitus> http://secure-computing.net/files/om_nom_nom.jpg lol i did this with packets once
21:24 < Halitus> becuase vmware was weird
21:25 < Halitus> ended up routing packets in a circle
21:25 < Halitus> router didnt like it
21:27 -!- bbohling [~bbohling@static-50-53-166-216.bvtn.or.frontiernet.net] has quit [Quit: bbohling]
21:32 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
21:37 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
21:42 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
21:59 -!- Hamlin [~Hamlin@mountainmorningband.com] has quit [Remote host closed the connection]
22:12 -!- ||Martin [~who@184.175.24.73] has joined #openvpn
22:13 < ||Martin> hello... not sure if this is the place to ask but does anyone here run openvpn client on dd-wrt and can comment on its throughput performance?
22:18 < Halitus> I am kinda interested in that also. But i cant help you there.
22:19 < ||Martin> well... i have it running... getting poor performance on a capable router with no other signs of high cpu usage or low memory etc... was just wondering whether others were getting similar results
22:19 < Halitus> what kinda performance?
22:20 < ||Martin> 25/1 link only giving about 4 mbit down and .8 up
22:20 < ||Martin> issue goes away when connecting from a PC client.
22:21 < Halitus> what do you mean by 25/1? i dont know some terminology etc
22:21 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Remote host closed the connection]
22:22 < ||Martin> 25 megabit download and 1 megabit upload... so 
22:22 < Halitus> oh so 4MB down ?
22:22 < ||Martin> 3 and change
22:22 < Halitus> yeah
22:23 < Halitus> how fast is your line? i would love that speed over the net in new zealand
22:23 < ||Martin> but on open vpn if i get 500 kb/s im lucky
22:23 < ||Martin> it's cable internet... im prettu sure they could offer gigabit link in theory
22:24 < ||Martin> in parts of my country they offer 250 mbit service unlimited transfer for 120 bucks
22:24 < Halitus> sigh
22:24 < ||Martin> but its useless when i cant get any speed over my vpn! :P
22:25 < Halitus> so your line speed is 25 Mbps and youre getting closser to 4Mbps over the vpn?
22:25 < ||Martin> yup
22:26 < ||Martin> i have a feeling its something to do with dd-wrt's config but nobody has a clue
22:26 < Halitus> whats the load average while its doing stuff?
22:26 < ||Martin> about .3
22:26 < Halitus> hm
22:26 < ||Martin> ive never seen it go over .5.... this is running on wrt610n with 480 mhz cpu
22:27 < Halitus> ha mine is at like 0.9 when i looked at it :S
22:27 < ||Martin> probably slower cpu router
22:27 < ||Martin> this is a dual band router with gigabit link + openvpn... it's doing lots of stuff :)
22:27 < Halitus> 192Mhz yeah
22:28 < Halitus> hmm i want gigabit
22:28 < ||Martin> i mean gigabit lan. not wan
22:28 < Halitus> yeah i know :P
22:28 < Halitus> im runing 10/100
22:28 < ||Martin> lol time to leave the stone age brother :)
22:28 < Halitus> what do you have under QoS? its not limiting the vpn traffic?
22:28 < Halitus> tell me about it
22:28 < ||Martin> i dont use qos
22:29 < Halitus> I like to build all my own gear from old stuff
22:29 < Halitus> i do more with my stone age equipment than most  average consumers do with their flash stuff
22:29 < Halitus> yeah but check that the router doesnt have it enabled
22:29 < ||Martin> haha... may be true. but i dont know if u can even buy a non gigabit lan NIC
22:30 < Halitus> these days yeah maybe not
22:30 < Halitus> ill wait till i can get a second hand gigabit switch
22:30 < ||Martin> yeah. QOS is off... i've gone through the list... my vpn provider seems to be clueless... i should maybe try dd-wrt forums... but thought i'd ask someone here maybe first since it's quite common
22:30 < Halitus> yeah under the nat/qos tab anything enabled?
22:30 < Halitus> ah
22:31 < Halitus> hmm well the others might be able to help you far more than i can
22:31 < ||Martin> i'll idle a bit ;-D
22:31 < Halitus> could the router memory be the bottle neck?
22:32 < ||Martin> 64 mb memory and 76% free
22:33 -!- blazer6969 [~blazer696@109.129.14.221] has quit [Ping timeout: 260 seconds]
22:33 < Halitus> what happens if you disable compression?
22:33 < Halitus> it seams weird that your cpu load isnt higher
22:33 < ||Martin> not enabled to boot
22:34 < ||Martin> weird thing is that the new DD-WRT builds dont work at all for me... i have to use 15xxx build to get it to go... you also have to force the DNS servers otherwise u cant browse the net
22:35 < Halitus> sounds weird
22:35 < Halitus> afraid i cant help
22:35 < ||Martin> lol thanks anyways :)
22:35 < Halitus> maybe ask in the ddwrt channel?
22:35 < ||Martin> i will 
22:36 < Halitus> #dd-wrt should work
22:36 < Halitus> also try ## 
22:36 < ||Martin> yeah ... i've got few resources yet to try no worries
22:37 < Halitus> i better get back to marking  :( sigh
22:37 < ||Martin> random number generator is all you need :)
22:38 < ||Martin> just cast to integer!
22:39 < Halitus> i wish
22:39 -!- ||Martin [~who@184.175.24.73] has quit [Read error: Connection reset by peer]
22:39 -!- ||Martin [~who@184.175.24.73] has joined #openvpn
22:48 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 250 seconds]
22:49 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
22:50 -!- ||Martin [~who@184.175.24.73] has left #openvpn []
22:53 -!- ||Martin [~who@67.23.177.83] has joined #openvpn
22:54 < EugeNap> I cast magic issile
22:55 < ||Martin> ;)
22:59 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:07 -!- ||Martin [~who@67.23.177.83] has quit []
23:14 -!- Yoshi210 [~Yoshi210@2a01:4f8:100:80e2:0:bc28:af9b:1] has joined #openvpn
23:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
23:27 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has joined #openvpn
23:29 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
23:30 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
23:36 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 260 seconds]
23:37 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
23:52 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 260 seconds]
23:54 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
--- Day changed Mon Sep 12 2011
00:05 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
00:17 < Halitus> krzee, i broke it :(
00:20 < Halitus> http://pastebin.com/bEcWzbMH
00:20 < Halitus> it says all the  tap adapters are in use
00:22 < Halitus> oh i ifxed it
00:22 < Halitus> looks like the gui closed but openvpn was still bound to the adpater in the back ground
00:23 -!- brushbox [~brushbox@203.14.171.110] has quit [Quit: Leaving.]
00:35 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
00:35 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
00:41 <@vpnHelper> RSS Update - forum: Client can access server, server cannot access client <http://forums.openvpn.net/topic8794.html>
00:43 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has quit [Ping timeout: 260 seconds]
00:46 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:48 -!- albech [~albech@183.88.64.149] has joined #openvpn
00:49 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 276 seconds]
00:50 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 260 seconds]
00:50 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 250 seconds]
00:52 -!- Halitus87 [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
00:56 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Ping timeout: 258 seconds]
01:07 -!- kala [kala@uba.linux.ee] has joined #openvpn
01:08 -!- kala [kala@uba.linux.ee] has left #openvpn []
01:18 < Halitus87> is there  a way to see who is connected to the vpn? and to allow/ban certain certificates or users?
01:27 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
02:03 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
02:06 -!- Halitus87 [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Ping timeout: 258 seconds]
02:12 -!- dazo_afk is now known as dazo
02:12 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
02:13 < Mowee> Morning
02:15 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
02:15 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
02:24 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
02:30 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
02:30 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:30 <@vpnHelper> RSS Update - forum: Gorkhaan's Setup ( Wordpress + OpenVPN fun ) <http://forums.openvpn.net/topic3158.html#p15460>
02:31 -!- secretuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:31 -!- secretuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
02:32 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 260 seconds]
02:39 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
02:41 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
02:41 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15461>
02:45 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 240 seconds]
02:46 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
02:48 <@vpnHelper> RSS Update - forum: Client can access server, server cannot access client <http://forums.openvpn.net/topic8794.html#p15462>
02:54 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
02:54 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
02:54 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
02:58 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 276 seconds]
03:00 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15463>
03:01 -!- vahid [~fvahid@unaffiliated/fvahid] has joined #openvpn
03:01 -!- sadurag99 [~sadurag99@124-169-24-41.dyn.iinet.net.au] has joined #openvpn
03:06 -!- Mowee [~Mowi@lendabrain.net] has quit [Quit: I don't discriminate, I hate everyone.]
03:22 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
03:24 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15464>
03:38 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
03:42 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15465>
03:46 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
03:48 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15466>
03:54 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15467>
04:03 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 258 seconds]
04:03 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
04:14 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
04:27 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
04:31 <@vpnHelper> RSS Update - forum: OpenVPN redirect-gateway does not work on Windows 7 <http://forums.openvpn.net/topic8705.html#p15468>
04:43 -!- metalfan_ [~xxx@141.41.93.164] has joined #openvpn
04:43 < metalfan_> hi, have some trouble with openvpn on windows. got a network running with 3 pcs without problems but windows keep getting problematic
04:44 < metalfan_> following the static key howto the servers output tells me that theres a connection as does the windows client. but i cant ping 10.8.3.1 or .2   or get a webpage over 10....
04:45 < metalfan_> the windows firewall was activated at first, but did not pop up any windows asking me if it should allow connections...which it normally does
04:45 < metalfan_> its now off, but i still cant connect
04:46 < Halitus> i had an issue with the windows client just recently. Its very important that you open it with admin rights
04:46 < Halitus> as it doesnt do this automatically
04:46 < metalfan_> i did
04:46 < metalfan_> it also told me todo that
04:46 < Halitus> configs and logs?
04:46 < metalfan_> ipconfig /all        shows the tap driver, but no allocated ip adress
04:46 < Halitus> !config
04:46 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
04:47 < Halitus> herm that didnt worh
04:47 < Halitus> work
04:48 < metalfan_> http://paste.pound-python.org/show/12389/
04:48 < Halitus> !configs
04:48 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
04:48 < metalfan_> ah, wait
04:49 < Halitus> also i am out of my depth. I would check out the sample scripts though
04:50 < metalfan_> http://paste.pound-python.org/show/12390/     configs:
04:50 < metalfan_> i got the same running with a linux -> linux setup, same networks
04:50 < metalfan_> this looks like a windows problem
04:51 < Halitus> better ask one of the experts
04:53 < janjust> metalfan_:  run the same command on the windows client with 'verb 5' added ; also, disable IPv6 on the tap-win32 adapter
04:55 < Halitus> janjust, with my vpn i disabled  ipv6 but i still get it showing up in my logs any ideas?
04:56 < janjust> Halitus:  what is showing up in the logs?
04:56 < Halitus> 1 sec
04:56 < Halitus> Need IPv6 code in mroute_extract_addr_from_packet
04:56 < metalfan_> theres only tcpip in the properties tab of the network connection, where can i disable ipv6?
04:57 < metalfan_> ah, tap-win32...one second
04:59 < metalfan_> janjust, no luck finding the ipv6 option, where is it?
04:59 < janjust> metalfan_:  it's in the network properties of the tap-win32 adapter
05:00 < janjust> the tap-win32 adapter should have some services and protocols associated with it: tcp/ip v4, tcp/ip v6 etc
05:00 < metalfan_> there a tap32 thing when i look at the properties of the lan connection, but clicking on configure it only shows me options to enable driver/rollback driver
05:04 < janjust> are you sure you have the proper permissions? as for a regular network adapter there should be a tab with the services+protocols bound to the adapter
05:04 <@vpnHelper> RSS Update - forum: Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html#p15469>
05:08 < metalfan_> i did this as admin. i looked at:  settings -> control center -> network connections -> local area connection 4 -> tap- win32 -> configure....
05:09 < metalfan_> the tap driver is listed as used by lan4
05:10 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 260 seconds]
05:13 -!- vahid [~fvahid@unaffiliated/fvahid] has quit [Quit: leaving]
05:21 <@vpnHelper> RSS Update - forum: UDPBroadcastForwarder <http://forums.openvpn.net/topic7319.html#p15470>
05:22 < janjust> metalfan_:  just restarted my laptop in win7: go to control panel -> network and internet -> network connections
05:22 < janjust> there should be a list of adapters, including the tap-win32 adapter
05:22 < metalfan_> im only on xp, but let me see
05:22 < janjust> doh... I thought you were on wni7
05:22 < janjust> win7
05:22 < janjust> on XP it's a different option but there's no tcpip v6 by default
05:23 < metalfan_> did i say that?
05:23 < metalfan_> no, it shows in my pastebin that im on xp
05:23 < janjust> nope you didn't say you were on win7, I misread your pastebin
05:23 < metalfan_> the other guy was using 7
05:24 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Ping timeout: 258 seconds]
05:24 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
05:24 < metalfan_> btw the tray icon still says that the connection is established, but ipconfig /all still shows no address
05:25 < janjust> try adding 'verb 5' and restart the connection; then paste the connection log on pastebin
05:27 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
05:29 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 250 seconds]
05:30 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
05:33 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p15471>
05:33 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:45 <@vpnHelper> RSS Update - forum: Memory Leakage - OpenVPN <http://forums.openvpn.net/topic8782.html#p15472>
05:54 -!- sadurag99 [~sadurag99@124-169-24-41.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
05:54 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
06:12 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:13 -!- Devedse [9113fee4@gateway/web/freenode/ip.145.19.254.228] has joined #openvpn
06:14 < Devedse> Hello everyone, I've set up an openvpn server on windows xp with another windows client. What I'm trying to do is route all traffic from the client through the server to the internet.
06:14 < Devedse> To do this I've added the following line to the server's config file: push "redirect-gateway def1"
06:15 < Devedse> It's not working however, can anyone tell me what I should do to make it work?
06:23 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
06:23 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
06:23 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:28 < Bushmills> !redirect
06:28 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
06:28 < Bushmills> !winroute
06:28 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file or (#2) many users also report it helps to add route-delay to give the interface extra time to get up or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access or (#4) make sure you are running openvpn as admin or (#5) http://openvpn.net/index.php
06:28 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
06:28 < Bushmills> note that adding the redirect-gateway option alone is not enough
06:30 < Devedse> Hmm
06:31 < Devedse> !def1
06:31 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
06:32 < Devedse> !ipforward
06:32 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
06:32 < Devedse> !winipforward
06:32 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
06:33 < Devedse> Hmm, so I have to change things in the register to forward all IP traffic?
06:33 < Devedse> !nat
06:33 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
06:34 < Devedse> And about nat, there's only an example there for windows as far as I can see
06:35 < metalfan_> static key howto, windows client -> linux server.  no connection?   http://paste.pound-python.org/show/12398/
06:37 < Devedse> I'm having a windows server + I'm not using a static key since I'm gonna add more clients later :)
06:37 < janjust> metalfan_:  the client log looks OK, up to the part where it tries to add routes; check that the tap-win32 adapter's tcpip properties are set to 'dynamic' (or DHCP)
06:38 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Quit: Leaving]
06:39 < metalfan_> dont know where on xp
06:40 < metalfan_> it looks more like the lan connection uses the tap driver and the dhcp settings is on the lan connection
06:40 < janjust> Devedse:  yes you have to set a registry key; check out https://forums.openvpn.net/topic7815.html for some instructions
06:40 <@vpnHelper> Title: OpenVPN Support Forum Windows XP as OpenVPN server with redirtect-gateway : Examples (at forums.openvpn.net)
06:40 -!- Devedse_ [9113fee4@gateway/web/freenode/ip.145.19.254.228] has joined #openvpn
06:40 < janjust> Devedse:  yes you have to set a registry key; check out https://forums.openvpn.net/topic7815.html for some instructions
06:42 < Devedse_> What does this mean in that link?: push "dhcp-option DNS 8.8.8.8" 
06:42 < janjust> metalfan_:  go to control panel -> network connections; click on the tap-win32 adapter, click on properties
06:43 < janjust> you should see a list 
06:43 < janjust> "This connection uses the following items" ; scroll down, you should see 'Internet protocol (TCP/IP)' ; select it, then choose 'configure'
06:43 -!- Devedse [9113fee4@gateway/web/freenode/ip.145.19.254.228] has quit [Ping timeout: 252 seconds]
06:43 < metalfan_> the tap driver is not listed there
06:44 < janjust> ah you've installed it in such a way that it is hidden... 
06:44 < metalfan_> ive installed the default openvpn
06:44 < metalfan_> without changing any options
06:44 < janjust> that one does not install it in a hidden fashion
06:44 < janjust> strange... I'd recommend to uninstall openvpn, then re-install it
06:44 < metalfan_> ive just upgraded openvpn from 2.1 to 2.2...but i did not test it before.
06:44 < janjust> Devedse_:  that option means that a DNS server 8.8.8.8 is pushed out to the client
06:45 < metalfan_> will do. have to work now....later
06:49 -!- EugeNap is now known as EugeneKay
07:00 -!- Devedse_ [9113fee4@gateway/web/freenode/ip.145.19.254.228] has quit [Ping timeout: 252 seconds]
07:06 -!- Devedse [9113fee4@gateway/web/freenode/ip.145.19.254.228] has joined #openvpn
07:06 < Devedse> Hello, someone just linked me this website: https://forums.openvpn.net/topic7815.html
07:06 <@vpnHelper> Title: OpenVPN Support Forum Windows XP as OpenVPN server with redirtect-gateway : Examples (at forums.openvpn.net)
07:06 < Devedse> I've done all that to try to redirect all traffic through openVPN but it still doesn't work
07:06 < EugeneKay> !windows
07:06 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
07:07 < EugeneKay> I'm sure you can get a Windows XP box to work as an OpenVPN server.... but don't. Really. It's not worth your time and suffering.
07:08 < Devedse> How about running a virtual linux setup inside vmware inside windows xp to run as an openvpn server?
07:09 < EugeneKay> Ever been to the circus, where there's an elephant riding on top of a clown car?
07:10 < Devedse> Okay...
07:10 < EugeneKay> It's like that.
07:10 < Devedse> Yea but do you think it's possible, it doesn't have to be fast or secure or anything like that :)
07:10 < EugeneKay> Sure. Totally possible.
07:10 < Devedse> Ok, I might try that then
07:10 < Devedse> Well I'm off, thanks for help :)
07:11 < Devedse> Ill go try it
07:11 < EugeneKay> I have a VMware lab setup on my laptop(and desktop) with all sorts of services running on it, including OpenVPN.
07:11 < Devedse> Bye
07:11 < Devedse> ah :)
07:11 < EugeneKay> But it's a lab, not something I'm ever gonna try to use to browse the 'net with.
07:11 < Devedse> =]
07:11 -!- Devedse [9113fee4@gateway/web/freenode/ip.145.19.254.228] has quit [Quit: Page closed]
07:21 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
07:40 -!- corretico [~luis@201.201.44.82] has joined #openvpn
07:43 -!- mape2k [~mape2k@2a01:198:23f:10ff:ac15:45ff:fe64:420f] has joined #openvpn
07:46 -!- NucWin [~Neil@unaffiliated/nucwin] has joined #openvpn
07:51 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15473>
07:57 <@vpnHelper> RSS Update - forum: Issue accessing DHCP clients <http://forums.openvpn.net/topic8795.html>
08:01 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
08:06 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
08:06 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 250 seconds]
08:09 <@vpnHelper> RSS Update - forum: Client gateway setup <http://forums.openvpn.net/topic8796.html>
08:10 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:10 -!- mode/#openvpn [+v Axeman] by ChanServ
08:12 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
08:15 <@vpnHelper> RSS Update - forum: Failover validation <http://forums.openvpn.net/topic8797.html>
08:22 -!- rix1234 [~rix1234@114.143.165.10] has joined #openvpn
08:25 < rix1234> Hi all...I have configured my linux vpn server...But while I connect to it from windows it gives the following error "Error 800: unable to establish a vpn connection" ...can anyone please help...
08:25 -!- twister004 [~chatzilla@59.90.104.109] has joined #openvpn
08:26 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Remote host closed the connection]
08:26 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
08:26 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
08:26 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
08:26 -!- mode/#openvpn [+v novaflash] by ChanServ
08:30 < Bushmills> check logs
08:32 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Read error: Connection reset by peer]
08:32 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15477>
08:33 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
08:33 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
08:33 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
08:33 -!- mode/#openvpn [+v novaflash] by ChanServ
08:33 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:37 -!- janjust [~janjust@openvpn/community/support/janjust] has left #openvpn ["Leaving"]
08:42 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:44 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:58 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
09:01 -!- master_of_master [~master_of@p57B527E2.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:05 -!- master_of_master [~master_of@p57B556AB.dip.t-dialin.net] has joined #openvpn
09:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
09:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:18 < rix1234> the error is "The VPN server may be unreachable, or security parameters may not be configured properly for this connection"
09:20 < reiffert> ENOCONTEXT
09:21 < reiffert> http://support.microsoft.com/kb/886621
09:21 <@vpnHelper> Title: You receive an "Unable to establish the VPN connection" error message when your Windows Small Business Server 2003-based client computer try to make an outgoing PPTP connection (at support.microsoft.com)
09:21 < reiffert> rix1234: this is #openvpn, it's not about microsoft pptp
09:21 < reiffert> !notovpn
09:21 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
09:21 < reiffert> !notcompat
09:21 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible or (#2) openvpn only connects to openvpn
09:21 < reiffert> !compat
09:25 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
09:30 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has joined #openvpn
09:36 -!- rix1234 [~rix1234@114.143.165.10] has quit [Quit: Leaving]
09:38 -!- Wildy [~lion@212.119.246.18] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
09:48 -!- bcave [~bcave@iburst-41-213-2-106.iburst.co.za] has joined #openvpn
09:48 < bcave> hello
09:52 < bcave> i am currently using openvpn, and would like to configure some fine-grained network controls for clients
09:53 < bcave> i would like to logically define some roles, and each role has access to certain network resources
09:53 < bcave> is there a recommended way or discussion on means to achieve this?
09:53 < bcave> e.g. define an "admin" role / subnet, that has ssh access to all hosts in the network, a "dba" role that has sql access to sql hosts
09:53 < bcave> etc etc
10:01 < bcave> or even if it is possible to map certain certificates to ip addresses
10:07 < krzie> !static
10:07 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
10:07 < bcave> thank you
10:07 < krzie> yw
10:08 < krzie> !policy
10:08 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
10:09 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has quit [Ping timeout: 252 seconds]
10:16 < jeev> !yw
10:17 < jeev> krzie's bot be hatin' me
10:17 < krzie> yw = you're welcome, not a factoid
10:17 < jeev> i know, still.
10:31 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
10:43 -!- mape2k [~mape2k@2a01:198:23f:10ff:ac15:45ff:fe64:420f] has quit [Ping timeout: 260 seconds]
10:46 -!- Technicus [~nomadicus@97-91-79-214.static.fdul.wi.charter.com] has joined #openvpn
10:51 -!- p3rror [~mezgani@41.140.170.79] has joined #openvpn
10:55 -!- mape2k [~mape2k@2a01:198:23f:10ff:500b:33ff:fea7:420] has joined #openvpn
10:57 -!- miketheman [~mikethema@207.239.84.170] has joined #openvpn
11:03 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
11:03 -!- Yoshi210 [~Yoshi210@2a01:4f8:100:80e2:0:bc28:af9b:1] has left #openvpn []
11:08 -!- p3rror [~mezgani@41.140.170.79] has quit [Ping timeout: 260 seconds]
11:12 <@vpnHelper> RSS Update - forum: Bridging networks via VPS <http://forums.openvpn.net/topic8798.html>
11:15 -!- bcave [~bcave@iburst-41-213-2-106.iburst.co.za] has quit [Ping timeout: 258 seconds]
11:17 < miketheman> one-way ping. Client can reach server network, server network cannot initiate connections to client network. Probably a common problem, what should I be looking for?
11:17 < krzie> firewall
11:18 < krzie> oh wait
11:18 < miketheman> (standard answer? :) )
11:18 < krzie> what you said wasnt a 1-way ping necessarily
11:18 < krzie> the client can reach the server network...
11:18 < krzie> can the server itself reach the client network?
11:19 < miketheman> it can reach the 10.8.x.x address, not the 192.168 behind the client vpn server
11:19 < krzie> you mean vpn client...?
11:19 < Bushmills> !route
11:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
11:19 < miketheman> yes. (sorry, using server means something else)
11:19 < Bushmills> !serverlan
11:19 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation
11:19 -!- dazo is now known as dazo_afk
11:19 < krzie> actually his serverlan is fine
11:20 < krzie> !clientlan
11:20 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
11:20 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
11:20 <@vpnHelper> better explanation
11:20 < krzie> but ya, see !route above
11:20 < Bushmills> yes, you're right. 
11:20 < miketheman> ok, will read through these. Thanks
11:20 < krzie> !route explains what you want pretty exactly
11:21 -!- p3rror [~mezgani@41.249.2.52] has joined #openvpn
11:21 < krzie> and yes, firewall is a pretty standard answer ;]  from years of it being the right answer!
11:23 < miketheman> of course. I made damn sure that the FW wasn't it before asking. :)
11:27 -!- twister004 [~chatzilla@59.90.104.109] has quit [Ping timeout: 260 seconds]
11:29 -!- twister004 [~chatzilla@59.90.104.109] has joined #openvpn
11:33 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Ex-Chat]
11:36 < miketheman> does the order of the statements in server.conf matter at all? I.e. if I place push route aboute route - will tat make a difference?
11:42 -!- twister004 [~chatzilla@59.90.104.109] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
11:44 < miketheman> ok, read through, seems like I'm doing the right thing, yet still not working.
11:44 < miketheman> Here's a paste of my configs and routing: http://pastebin.com/VqqiQCrU
11:45 < miketheman> I can ping: internal on client network -> internal on server network
11:46 < miketheman> server -> client's tun+ address (10.8.0.x)
11:46 < miketheman> cannot ping server -> client's internal address
11:52 < miketheman> ok, git it.
11:52 < miketheman> got it.
11:52 < miketheman> It was the ccd directory entry.
11:53 < miketheman> the "client-common-name" in the wiki article might be better expressed as the CN used in the client's certificate
11:54 < EugeneKay> The common name does not always come from the CN
11:55 < EugeneKay> In particular, setups not involving x509 PKI
11:55 < miketheman> in non-x509, what constitutes the CN?
11:56 < EugeneKay> --username-as-common-name would be one
11:58 < EugeneKay> I *think* there's a way to do it in scripts, but I can't seem to find it in the man page
11:59 -!- p3rror [~mezgani@41.249.2.52] has quit [Ping timeout: 260 seconds]
12:06 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:07 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:09 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:20 -!- p3rror [~mezgani@41.140.38.72] has joined #openvpn
12:28 -!- mape2k [~mape2k@2a01:198:23f:10ff:500b:33ff:fea7:420] has quit [Ping timeout: 260 seconds]
12:31 -!- EugeneKay is now known as EugeneKaway
12:33 <@vpnHelper> RSS Update - forum: verifying the device connecting to OpenVPN server? <http://forums.openvpn.net/topic8766.html#p15479>
12:37 -!- mape2k [~mape2k@2a01:198:23f:10ff:50b5:3cff:fe8e:cbed] has joined #openvpn
12:48 <@vpnHelper> RSS Update - forum: Fixed IP with multiple openvpn instances (load balancing) ? <http://forums.openvpn.net/topic8799.html>
13:04 -!- albech [~albech@183.88.64.149] has quit [Remote host closed the connection]
13:07 -!- mape2k [~mape2k@2a01:198:23f:10ff:50b5:3cff:fe8e:cbed] has quit [Ping timeout: 260 seconds]
13:15 -!- Devedse [~Devedse@cable-123-30.zeelandnet.nl] has joined #openvpn
13:24 -!- mindcruft [~gerard@static-108-27-36-18.nycmny.fios.verizon.net] has joined #openvpn
13:35 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Ping timeout: 260 seconds]
13:40 < Devedse> I am still having some problems trying to route all trafic from a windows computer through openvpn (server running on linux)
13:41 < Devedse> The normal connection works
13:41 < Devedse> But when I add the following lines to the config file: push "redirect-gateway def1"      and    push "dhcp-option DNS 8.8.8.8" and then connect again I can't visit any websites
13:41 < Devedse> on the client computer
13:42 < Devedse> I also tried this: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
13:42 < Devedse> Anyone knows what I'm missing?
13:42 < Devedse> maybe something at the client?
13:42 < |Mike|> Mind to read the topic?
13:42 < Devedse> I have read them all
13:43 < Devedse> But I don't understand what I'm doing sometimes
14:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:08 < Devedse> Anyone got another guide which might be able to help with my problem?
14:08 < Devedse> !redirect
14:08 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:09 < Devedse> !ipforward
14:09 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:09 < Devedse> !def1
14:09 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:10 < Devedse> !linipforward
14:10 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
14:11 < Devedse> Also why I can't find anything about IP forwarding in the HOWTO?
14:11 -!- Technicus [~nomadicus@97-91-79-214.static.fdul.wi.charter.com] has quit [Quit: Leaving.]
14:24 -!- Netsplit *.net <-> *.split quits: naquad, caesay, ajacob_, Bushmills, quadDamage, mete, pa, larsduesing, rawsted, nullz0r,  (+6 more, use /NETSPLIT to show all of them)
14:24 -!- ajacob [~ajacob@taurine.csclub.uwaterloo.ca] has joined #openvpn
14:24 -!- caesay [~caesay@socialshock.net] has joined #openvpn
14:26 -!- mete [~mete@mete.shell.la] has joined #openvpn
14:26 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
14:26 -!- larsduesing [~lars@195.34.173.187] has joined #openvpn
14:26 -!- quadDamage [~EmperorTo@216.17.68.153] has joined #openvpn
14:26 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
14:26 -!- nullz0r [null@hyperion.epimeros.org] has joined #openvpn
14:26 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
14:26 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
14:26 -!- caesay is now known as Guest84423
14:26 -!- busch_ [~busch@74.117.156.156] has joined #openvpn
14:26 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:26 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:26 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
14:26 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
14:29 -!- rawsted [~tom@unaffiliated/rawsted] has joined #openvpn
14:29 < Bushmills> because that's operating system config, not openvpn config
14:29 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
14:30 < Bushmills> i'm sure if you looked at a howto about your OS, you'd find something
14:34 -!- Netsplit *.net <-> *.split quits: DexTerDDIT, nb, amero, Cain
14:34 -!- Netsplit over, joins: DexTerDDIT
14:35 -!- Cain [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
14:35 -!- Cain is now known as Guest61863
14:36 -!- Guest61863 [~Geek@2001:41d0:1:f38f::1337] has left #openvpn []
14:37 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
14:37 -!- p3rror [~mezgani@41.140.38.72] has quit [Ping timeout: 260 seconds]
14:38 -!- nb [~nb@fedora/nb] has joined #openvpn
14:38 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:46 -!- mode/#openvpn [+v Axeman] by ChanServ
14:51 -!- p3rror [~mezgani@41.248.222.9] has joined #openvpn
14:51 -!- freaky[t]_ [alpha@freakyonline.de] has quit [Ping timeout: 258 seconds]
14:54 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
15:05 < Optic> mo mo
15:15 <@vpnHelper> RSS Update - forum: Set up VPN server behind proxy server <http://forums.openvpn.net/topic8792.html#p15481>
15:25 -!- MarKsaitis [~MarKsaiti@85-189-201-83.tmbsystems.managedbroadband.co.uk] has joined #openvpn
15:42 -!- p3rror [~mezgani@41.248.222.9] has quit [Ping timeout: 260 seconds]
15:49 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
15:49 < Shinigami-Sama> hello #openvpn
15:50 < Shinigami-Sama> I am setting up a server for work and am trying to decide what is the best course of action for our network
15:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:50 < Shinigami-Sama> we have for some reason a 192.168.1.0 network internally...
15:50 < Shinigami-Sama> I am trying to set a roadwarrior configuration
15:51 -!- metalfan_ [~xxx@141.41.93.164] has quit [Read error: Connection reset by peer]
15:51 < Shinigami-Sama> so would it be better for me do SNAT/DNAT to masquerade the internal network
15:51 < Shinigami-Sama> or netmap?
15:52 < krzee> you didnt describe your goal very well
15:52 < krzee> !goal
15:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:52 < krzee> oh i see, you want to share the server lan with road warriors, but you use a super-common subnet
15:52 < krzee> you really should just change that subnet
15:53 < krzee> if you just CANT do that,
15:53 < krzee> !nathack
15:53 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
15:53 < Shinigami-Sama> not possible at the moment, I am hopeing next fiscal year I can fix it
15:54 < Shinigami-Sama> what I would like to do is work around said stupid subnet, and still allow roadwarriors to access internal shares and resources while they are out of office
15:54 < Shinigami-Sama> thanks for the link
15:54 <+novaflash> changing an ip address is free, you know ;)
15:54 < Shinigami-Sama> novaflash: not with active directory
15:55 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has joined #openvpn
15:55 -!- p3rror [~mezgani@41.140.25.92] has joined #openvpn
15:55 < Shinigami-Sama> though if I get my way next year I"ll tear down our current poorly implemented forest and rebuild it
15:55 < Shinigami-Sama> we need to migrate servers into a virtual environment anyways
15:55 <@vpnHelper> RSS Update - forum: Logging OpenVPN-AS logs to remote syslog server? <http://forums.openvpn.net/topic8494.html#p15482>
15:57 -!- EugeneKaway is now known as EugeneKay
15:58 < Shinigami-Sama> that nethack still wont quite do what I need but its a start
16:01 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has quit [Ping timeout: 240 seconds]
16:05 < Shinigami-Sama> ohh finally found a nice guide to netmap
16:05 < Shinigami-Sama> lets see how this rolls
16:14 -!- miketheman [~mikethema@207.239.84.170] has left #openvpn []
16:25 <@vpnHelper> RSS Update - forum: Set up VPN server behind proxy server <http://forums.openvpn.net/topic8792.html#p15483>
16:27 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:27 -!- gardar [~gardar@gardar.net] has quit [Read error: Operation timed out]
16:29 -!- ajacob [~ajacob@taurine.csclub.uwaterloo.ca] has quit [Read error: Operation timed out]
16:30 -!- Devedse [~Devedse@cable-123-30.zeelandnet.nl] has quit [Ping timeout: 250 seconds]
16:30 -!- gardar [~gardar@gardar.net] has joined #openvpn
16:30 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
16:31 -!- Devedse [~Devedse@cable-123-30.zeelandnet.nl] has joined #openvpn
16:31 -!- gardar [~gardar@gardar.net] has joined #openvpn
16:31 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
16:31 -!- gardar [~gardar@gardar.net] has joined #openvpn
16:32 -!- raidz [~Administr@openvpn/corp/admin/andrew] has left #openvpn []
16:32 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
16:33 -!- mode/#openvpn [+o raidz] by ChanServ
16:38 < |Mike|> all raise for raidz 
16:38 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Ping timeout: 258 seconds]
16:39  * krzee moons raidz 
16:39 -!- Shinigami-Sama [~pewpew@174.1.96.244] has joined #openvpn
16:40 -!- Shinigami-Sama [~pewpew@174.1.96.244] has quit [Changing host]
16:40 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
16:44 < krzee> Shinigami-Sama, just tell the vpn server to NAT anything coming from its tun to its 10.8.* ip
16:44 <@raidz> oh hai
16:44 < krzee> aka nathack
16:44 < krzee> i agree, its not the right way
16:45 < Shinigami-Sama> krzee: outside clients would still need to attempt to connect to an overlapping address to access the resource, even if on the server side its nated
16:45 < krzee> meh ya thats right
16:45 < Shinigami-Sama> say 192.168.1.10 is a SMB server
16:45 < Shinigami-Sama> nethack is useless to it if someone is on the 192.168.1.0/24 network
16:46 < krzee> well actually
16:46 < Shinigami-Sama> so I netmaped to a 172 address range
16:46 < krzee> what would happen is that client would no longer be able to reach its local 1.10
16:46 < |Mike|> h00terz, time for beer!
16:46 < krzee> because it would route that over its vpn
16:46 < Shinigami-Sama> I think I forgot to forward the traffic though from the external interface
16:47 < krzee> Shinigami-Sama, when you fininsh figuring out that setup would you be willing to add your own section to !nathack on the wiki?
16:47 < Shinigami-Sama> krzee: if you remind me to once I get it working
16:48 < Shinigami-Sama> right now I have a tunnel established
16:48 < Shinigami-Sama> but I can't get any traffic flowing
16:48 < krzee> deal, if you tell me once its working ;]
16:48 < Shinigami-Sama> I will probably lurk here until its done bitching about it every few hours/days
16:48 < Shinigami-Sama> I did that on #openswan for two weeks
16:49 < Shinigami-Sama> it took that long for me to find out ipsec just can't work on my network
16:49 < Shinigami-Sama> because of the idiots that set it up
16:50 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Quit: Leaving]
16:50 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
16:51 < Shinigami-Sama> bleh
16:51 < Shinigami-Sama> routing table got screwed there for a sec
16:54 -!- darkdrgn2k3 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
16:54 < darkdrgn2k3> any one know how i can use NETSH to rename a TAP interface to something other then LOCAL AREA CONNETION
16:54 < darkdrgn2k3> like "DONT REMOVE THIS STUPID TECLO TECH SUPPORT"
16:55 -!- Kateon [482392@xs8.xs4all.nl] has quit [Ping timeout: 260 seconds]
16:59 -!- Ragnar [heimdall@darkstar.acool.net] has quit [Remote host closed the connection]
17:00 < krzee> in windows right?
17:00 < krzee> you wouldnt use netsh
17:00 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
17:01 < krzee> !factoids search tap
17:01 <@vpnHelper> 'tap', 'mactuntap', 'wintaphide', 'tunortap', and 'obsdtap'
17:01 < krzee> 1sec
17:02 < krzee> oh evidently it *can* be done from netsh
17:02 < darkdrgn2k3> netsh can rename
17:02 < darkdrgn2k3> i just dont know how to id the TAP interfaces
17:02 < darkdrgn2k3> rename is 
17:03 < krzee> http://openvpn.net/index.php/open-source/documentation/install.html?start=1
17:03 <@vpnHelper> Title: Installation (Win32) - Page 2 (at openvpn.net)
17:03 < krzee> Notes -- Windows and TAP device naming
17:03 < darkdrgn2k3> netsh interface set interface name = "{old name here}" newname = "{newname here}"
17:03 < krzee> first hit from:
17:03 < krzee> !google windows rename tap device
17:03 <@vpnHelper> Installation (Win32) - Page 2: <http://openvpn.net/INSTALL-win32.html>; Olive - Juniper Clue: <http://juniper.cluepon.net/index.php/Olive>; OpenVPN - Community Ubuntu Documentation: <https://help.ubuntu.com/community/OpenVPN>
17:04 < darkdrgn2k3> yeh but how do i script finding the tap device name lol
17:04 < krzee> you dont script it, you add it to the config
17:04 < krzee> or you define your goal better
17:04 < Shinigami-Sama> you stab your users with a blunt shovel until they stop fiddlling with stuff
17:05 < Shinigami-Sama> my perfered shovel is a quaterly invoice for callout work fixing it :)
17:05 < darkdrgn2k3> Shinigami-Sama: its hard when they are scattered throughout canada..
17:05 < krzee> at least a tech can google the tap device and see why its used
17:05 < Shinigami-Sama> darkdrgn2k canada post can find them
17:05 < darkdrgn2k3> they are dum dums.. and when they call bell.. bell tells them to remove all local area contections
17:05 < krzee> if i saw a device named "DONT REMOVE THIS DEVICE" and my user didnt know why it was there, ild assume virus/rootkit
17:06 < darkdrgn2k3> Shinigami-Sama: in house sites..
17:06 < darkdrgn2k3> well rename it to something like "Corporate VPN"
17:06 < Shinigami-Sama> darkdrgn2k3: then revenue services can find them ;)
17:06 < krzee> there ya go
17:06 < darkdrgn2k3> Shinigami-Sama: i dont have authority to bill them since mmy job is to support them...
17:07  * Shinigami-Sama is currently fighting MSP over wrongfully collected premiums
17:07 < Shinigami-Sama> damn
17:07 < Shinigami-Sama> poor you
17:07 < darkdrgn2k3> thats why im leaving in a month:-P
17:07 < Shinigami-Sama> lol
17:07 < Shinigami-Sama> I just make my users wait
17:08 < Shinigami-Sama> they keep filling my inbox with trivial stuff and when they need something big in like a week I can say I was busy with their other shit
17:08 < Shinigami-Sama> :
17:08 < Shinigami-Sama> :)
17:08 < Shinigami-Sama> I've been working on this VPN for a while now because of that
17:11 < Shinigami-Sama> god damned
17:12 < Shinigami-Sama> now its not connecting
17:12 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:14 -!- ajacob [~ajacob@taurine.csclub.uwaterloo.ca] has joined #openvpn
17:15 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:17 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Ping timeout: 252 seconds]
17:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
17:20 -!- Shinigami-Sama [~pewpew@174.1.96.244] has joined #openvpn
17:20 -!- Shinigami-Sama [~pewpew@174.1.96.244] has quit [Changing host]
17:20 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
17:20 < Shinigami-Sama> bah
17:20 < Shinigami-Sama> that stupid sonicwall is getting in the way again
17:24 < Shinigami-Sama> I give in for now
17:24 < Shinigami-Sama> its the end of the day
17:26 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
17:29 < Shinigami-Sama> krzee: I'll test from home tonight
17:29 < Shinigami-Sama> if I remember
17:30 -!- Rolybrau [~Rolybrau@207-128.3-85.cust.bluewin.ch] has joined #openvpn
17:30 < Shinigami-Sama> maybe its another retarded NAT issue
17:30 -!- Rolybrau [~Rolybrau@207-128.3-85.cust.bluewin.ch] has quit [Changing host]
17:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:30 < Shinigami-Sama> lord knows how many of those we have
17:32 -!- Kateon [482392@xs8.xs4all.nl] has quit [Ping timeout: 252 seconds]
17:32 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
17:43 < Devedse> Hello everyone, I'm still strugling with setting up a server to tunnel all trafic through openvpn. Every howto I find on the internet says I have to do something different.
17:43 < reiffert> !howto
17:43 < reiffert> !def1
17:43 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:43 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:44 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Read error: Connection reset by peer]
17:44 -!- Shinigami-Sama [~pewpew@174.1.96.244] has joined #openvpn
17:44 -!- Shinigami-Sama [~pewpew@174.1.96.244] has quit [Changing host]
17:44 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
17:45 < Devedse> I've already done everything described in the howto to set it up, the first steps all work but when I now connect with my windows computer to my openvpn server (running on ubuntu) surfing doesn't work anymore
17:45 < Devedse> !man
17:45 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
17:48 < Devedse> reiffert, I've also added that line of code to the config file
17:48 < Devedse> the push redirect def1 etc
17:49 < Devedse> I'm also pushing a DHCP-OPTION dns in the server config
17:51 < reiffert> !configs
17:51 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
17:52 < krzee> windows 7?
17:52 < krzee> can you ping 8.8.8.8 from the client after connecting?
17:52 < reiffert> no whatsoever problems with win7 at me.
17:52 < krzee> !pushdns
17:52 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
17:52 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
17:52 < krzee> #5
17:54 < krzee> as i dont use windows, i can only go by what i find when helping those who do (or by observing others helping them)
17:54 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:54 < Devedse> Well the server is a Linux computer
17:54 < krzee> doesnt matter
17:54 < krzee> thats unrelated to my question
17:54 < Devedse> ok
17:55 < Devedse> Ill try to ping
17:56 < Devedse> After connecting I can not ping 8.8.8.8
17:56 < Devedse> I'll post the config files in a secon
17:56 < Devedse> second
17:57 < |Mike|> !configs
17:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
17:57 < |Mike|> h00terz, cold beer for sale
17:57 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Ping timeout: 240 seconds]
17:59 -!- nullz0r [null@hyperion.epimeros.org] has quit [Quit: nullz0r]
17:59 < Devedse> http://pastebin.com/kswHpk9Z       Server version 2.1.3 running on ubuntu
18:00 -!- MarKsaitis [~MarKsaiti@85-189-201-83.tmbsystems.managedbroadband.co.uk] has quit [Ping timeout: 260 seconds]
18:02 < Devedse> http://pastebin.com/fc3E8ifm        Client version 2.1
18:02 -!- Grleaf [~Grleaf@cpe-72-224-94-160.maine.res.rr.com] has quit [Read error: Connection reset by peer]
18:05 < Devedse> krzee, do you think I missed something in either of those config files? I've also used the following commands: sudo echo "1" &gt; /proc/sys/net/ipv4/ip_forward         and         sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
18:05 < Bushmills> !redirect
18:05 < Devedse> Although I don't know any way to verify if they did or did not work
18:05 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
18:06 < Bushmills> observe also the part behind "as well"
18:06 < Devedse> !ipforward
18:06 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
18:06 < Devedse> Which Ipforward should I look into?
18:06 < Devedse>  !linipforward?
18:06 < Devedse> !linipforward
18:06 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
18:06 < Bushmills> msdosipforward?
18:06 < Devedse> oh lin is linux
18:07 < Devedse> !nat
18:07 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
18:07 < Devedse> !linnat
18:07 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
18:10 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 260 seconds]
18:12 < Devedse> I am connected now + I can browse websites but how can I verify if it is working?
18:12 < Devedse> Both the server and the client are currently in the same network, so going to something like www.whatismyip.com wouldn't help
18:12 < |Mike|> *g*
18:12 < |Mike|> traceroute.
18:13 < Devedse> tracert within windows says "10.8.0.1", that means it works right?
18:15 < |Mike|> no idea, I don't know what IP's you've assigned to your LAN nor to your VPN
18:15 < Devedse> My vpn server ip is 10.8.0.1
18:16 < |Mike|> Then you're using the VPN :)
18:16 < Devedse> Although a website hosted on a computer within the network (which displays the source IP) still says that I'm coming from 192.168.1.117
18:16 < |Mike|> because you're not using the VPN network... because it's on your GW 
18:17 < Devedse> Ok
18:23 < Devedse> Im watching the graphs and apparently it works ;)
18:23 < Devedse> (Graphs with network traffic)
18:25 -!- p3rror [~mezgani@41.140.25.92] has quit [Read error: Connection reset by peer]
18:26 < krzee> just so you know
18:26 < krzee> !local
18:26 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
18:26 < |Mike|> hm, didn't know that :)
18:26 < krzee> =]
18:26 < |Mike|> still learning haha
18:27 < krzee> always!
18:29 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
18:36 -!- NucWin [~Neil@unaffiliated/nucwin] has quit []
18:40 -!- Kateon [482392@xs8.xs4all.nl] has quit [Ping timeout: 260 seconds]
18:40 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
18:52 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:09 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
19:09 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
19:10 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
19:11 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 276 seconds]
19:16 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
19:17 < SJr> ARGH I have tried generating certificates like 4 times now and I STILL cannot connect to the server.
19:20 < SJr> http://pastebin.com/mUbXq5SV
19:21 < SJr>  BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
19:21 < SJr> That seems to be the relevant line
19:24 -!- Devedse [~Devedse@cable-123-30.zeelandnet.nl] has quit [Quit: Ik ga weg]
19:25 -!- Denial [Denial@drgi.co.uk] has quit []
19:32 < Dougy> krzee: couldnt get to fedex today
19:32 < Dougy> got trapped at school then sent to work
19:32 < Dougy> will try tomorrow
19:47 < krzee> cool
19:58 < dxtr> My openvpn setup is now working perfectly :D
19:59 < dxtr> Been using it constantly since... uhm.. it started workin
19:59 < dxtr> working*
20:00 < dxtr> Unfortunately my connection isn't faster than 10Mbps so I can stress test it
20:00 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:00 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:03 < krzee> ild go down on a fat chick for 10Mbit symmetric to my house
20:03 < dxtr> krzee: My parents have got 100
20:04 < dxtr> Rumors has it they can get gigabit this fall
20:09 < krzee> eu?
20:09 <@vpnHelper> RSS Update - forum: wrong "connected since" time in Server <http://forums.openvpn.net/topic8785.html#p15484>
20:09 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
20:11 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Read error: Operation timed out]
20:11 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
20:11 -!- Agin_ [~Agin@greenzone.copyleft.no] has joined #openvpn
20:11 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Operation timed out]
20:16 < Dougy> 01:03 < krzee> ild go down on a fat chick for 10Mbit symmetric to my house
20:16 < Dougy> lol what
20:17 < Dougy> you can get 35/35 from fios all day here
20:19 < krzee> you think im there?
20:19 < jeev> Dougy, he meant he'd do it for nothing.
20:19 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
20:20 < krzee> i have 6/1 and i pay $150/month for it
20:20 < jeev> where do you live? somalia ?
20:20 < krzee> and no matter how much i upgrade it, upload never goes over 1mbit
20:20 < krzee> yes jeev, somalia
20:22 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
20:25 -!- darkdrgn2k3 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Ping timeout: 260 seconds]
20:37 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
20:41 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:57 < Dougy> jesus krzee see thats what you get from abdictating your hgome country
20:57 < Dougy> abdicating
20:59 -!- jbb [~yeeb@184.105.219.149] has quit [Read error: Connection reset by peer]
20:59 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
21:09 < krzee> if i was going to live somewhere for bandwidth it would not be USA
21:18 -!- albech [~albech@61.7.176.128] has joined #openvpn
22:03 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:08 -!- albech [~albech@61.7.176.128] has quit [Ping timeout: 252 seconds]
22:21 -!- albech [~albech@61.7.176.128] has joined #openvpn
22:59 <@vpnHelper> RSS Update - forum: OpenVPN Configuration <http://forums.openvpn.net/topic8800.html>
23:34 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:53 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
--- Day changed Tue Sep 13 2011
00:10 -!- albech [~albech@61.7.176.128] has quit [Remote host closed the connection]
00:20 -!- yobanius [~omers@212-150-239-254.bb.netvision.net.il] has joined #openvpn
00:40 -!- yobanius [~omers@212-150-239-254.bb.netvision.net.il] has quit [Quit: Leaving]
00:53 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
00:54 -!- corretico [~luis@201.201.44.82] has joined #openvpn
01:07 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
01:36 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
01:36 -!- corretico [~luis@201.201.44.82] has joined #openvpn
01:39 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 260 seconds]
01:42 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
01:43 -!- corretico [~luis@201.201.44.82] has joined #openvpn
01:45 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
01:46 -!- corretico [~luis@201.201.44.82] has joined #openvpn
01:48 -!- metalfan_ [~xxx@141.41.93.164] has joined #openvpn
01:48 < metalfan_> hi
01:49 < metalfan_> ive deinstalled, rebootet and reinstalled openvpn.  but still theres no tap-win32 driver below settings -> control panel -> network connections...why?      
01:50 < metalfan_> cant establish a vpn connection....although both client and server seem to think it exists:   http://paste.pound-python.org/show/12398/
01:50 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
02:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:03 -!- corretico [~luis@201.201.44.82] has joined #openvpn
02:19 < Mowee> Morning
02:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:42 <@vpnHelper> RSS Update - forum: split tuneling <http://forums.openvpn.net/topic8801.html>
02:54 -!- dazo_afk is now known as dazo
02:54 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:54 -!- mode/#openvpn [+o mattock] by ChanServ
02:55 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
02:59 < dropje> metalfan_: you're client and server have the same ip?
03:06 -!- tjz [~pc@bb119-74-158-107.singnet.com.sg] has joined #openvpn
03:06 -!- tjz [~pc@bb119-74-158-107.singnet.com.sg] has quit [Changing host]
03:06 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
03:10 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:12 <@vpnHelper> RSS Update - forum: split tuneling <http://forums.openvpn.net/topic8801.html#p15488> || openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html>
03:18 <@vpnHelper> RSS Update - forum: openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p15489>
03:20 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
03:24 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
03:48 <@vpnHelper> RSS Update - forum: Set up VPN server behind proxy server <http://forums.openvpn.net/topic8792.html#p15490>
03:51 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
03:55 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Quit: Leaving]
03:58 -!- zux [~zux@195.13.186.54] has joined #openvpn
03:59 < zux> hi, is there a way to list all open/established vpn connections on the server side?
04:00 <@vpnHelper> RSS Update - forum: Set up VPN server behind proxy server <http://forums.openvpn.net/topic8792.html#p15491>
04:02 < Bushmills> zux: status file
04:03 < zux> thanks, i'll look into it
04:04 < Bushmills> with status-version 3,  grep ^CLIENT_LIST status
04:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:06 < zux> i think i even have enough with kill -SIGUSR2
04:10 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
04:12 -!- raomin_ [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
04:14 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 240 seconds]
04:15 -!- sadurag99 [~sadurag99@124-169-24-41.dyn.iinet.net.au] has joined #openvpn
04:24 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738.html#p15492>
04:24 < krzie> or if you want to build it into a program or something, see the management interface
04:24 < krzie> !management
04:24 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
04:36 <@vpnHelper> RSS Update - forum: Fixed IP with multiple openvpn instances (load balancing) ? <http://forums.openvpn.net/topic8799.html#p15494> || OpenVPN Configuration <http://forums.openvpn.net/topic8800.html#p15493>
04:37 -!- Netsplit *.net <-> *.split quits: trumee, mete, Dougy, master_of_master
04:39 -!- Netsplit over, joins: mete, master_of_master, trumee, Dougy
04:48 <@vpnHelper> RSS Update - forum: Odd, new error: Connection refused (WSAECONNREFUSED) <http://forums.openvpn.net/topic7846.html#p15496> || Fixed IP with multiple openvpn instances (load balancing) ? <http://forums.openvpn.net/topic8799.html#p15495>
05:05 -!- sadurag99 [~sadurag99@124-169-24-41.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
05:05 <@vpnHelper> RSS Update - forum: OpenVPN with different realms and different routes <http://forums.openvpn.net/topic8803.html>
05:07 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
05:08 < omry> hi, I`m a vpn newb. trying to follow the instructions here : http://wiki.debian.org/HowTo/openvpn  , got stumbled at the vague instruction to add something to   /etc/shorewall: 
05:08 <@vpnHelper> Title: HowTo/openvpn - Debian Wiki (at wiki.debian.org)
05:08 < omry> I dont have this file, should I create it?
05:08 < Bushmills> don't add to what you don't have
05:09 <@dazo> except of openvpn.conf 
05:09 < Bushmills> !howto
05:09 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:18 < omry> cool, got a static key setup to work
05:19 < omry> since I`ll need something scalable, now I`ll try to setup the cert one
05:19 < omry> scalable at least to the extend that I need more than one client
05:24 < omry> ah, actually I didnt get it to work
05:24 < omry> only partially, can access only the server
05:27 < omry> from the static key howto : Then on the server side, add a route to the server's LAN gateway that routes 10.8.0.2 to the OpenVPN server machine (only necessary if the OpenVPN server machine is not also the gateway for the server-side LAN)
05:28 < omry> this refers to the route in the configuration file?
05:28 < omry> or the system route command?
05:31 -!- Denial [Denial@drgi.co.uk] has quit [Read error: Connection reset by peer]
05:31 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:52 < dropje> omry: this refers to the gateway (router) in teh server LAN
05:52 < dropje> if you ping a host behind your VPN server how does that host know who to reply to? you need a route for that
05:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
05:53 < krzie> aka
05:53 < krzie> !route_outside_ovpn
05:53 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
05:53 < dropje> krzie: exactly :)
05:54 < dropje> didnt know the factoid
05:54 < krzie> =]
05:58 < omry> dropje, you mean I need to add this route on the router?
06:01 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:03 < dropje> omry: yes, unless your vpn server *is* the gateway
06:05 < omry> dropje, okay. sp specifically route the client ip (10.8.0.2) to the vpn server?
06:06 < dropje> no you have to see it like this (example):
06:06 < dropje> your router is 192.168.1.1
06:06 < dropje> a host in your normal LAN is 192.168.1.20
06:06 < dropje> when you send a ping from a VPN client it has 10.8.10.10
06:07 < dropje> how does the host in your LAN know where to go? it doesnt have a static route for it so it sends the packets to the default gateway (192.168.1.1)
06:07 < dropje> how does your default gateway know that 10.8.10.0/24 needs to be routed to your VPN server?
06:07 < dropje> answer: with a static route pointing to your VPN server
06:07 < dropje> for the network 10.8.10.0/24
06:08 < dropje> the alternative is setting a static route on the host you are trying to ping from the VPN client
06:08 < dropje> you could do this for troubleshooting purposes
06:12 < omry> I understand, although cant seem to get it to work
06:12 < omry> this is in amazon ec2, and my machines are on a vpc (Virtual private cloud)
06:12 < omry> I do have access to the routing table on the router, but I`m not 100% sure its what I think itis
06:13 < metalfan_> cant establish a vpn connection....although both client and server seem to think it exists:   http://paste.pound-python.org/show/12398/
06:13 < metalfan_> cant ping server -> client or client -> server,  or get http data via the openvpn connection
06:17 -!- p3rror [~mezgani@41.140.101.74] has joined #openvpn
06:19 < dropje> !howto
06:19 < krzie> try adding to that client:
06:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:20 < krzie> route-delay
06:20 < krzie> see if that helps
06:20 < omry> krzee, is that to me?
06:21 < krzie> no, to metalfan_ 
06:21 < omry> ah
06:21 < krzie> omry, i wrote enough for your answer
06:21 < krzie> !route_outside_ovpn
06:21 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
06:21 < krzie> if the picture isnt enough, see the section that i wrote about it
06:21 < omry> krzie, my problem is specific to ec2. I dont have direct access to the router
06:22 < krzie> explained better in section: ROUTES TO ADD OUTSIDE OPENVPN
06:22 < krzie> in !route
06:22 < krzie> !route
06:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
06:22 < krzie> go read
06:22 -!- sadurag99 [~sadurag99@124-169-24-41.dyn.iinet.net.au] has joined #openvpn
06:22 < krzie> you're saying the lan is behind your server or your clients vpn instance...?
06:23 < omry> they are both lans, not sure I understand your question.
06:24 < omry> my existing lan (the one I want to enable access to) is the one near the openvpn server
06:24 < omry> its a part of it.
06:24 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:28 < metalfan_> krzie, route-delay did not solve the problem
06:29 -!- albech [~albech@183.88.64.149] has joined #openvpn
06:35 <@vpnHelper> RSS Update - forum: Set up VPN server behind proxy server <http://forums.openvpn.net/topic8792.html#p15498>
06:35 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
06:48 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
06:49 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
06:53 -!- zwamkat [~zwamkat@pdpc/supporter/student/zwamkat] has left #openvpn ["Leaving..."]
07:05 <@vpnHelper> RSS Update - forum: Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html#p15499>
07:10 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 260 seconds]
07:16 -!- sadurag99 [~sadurag99@124-169-24-41.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
07:18 -!- Guest84423 [~caesay@socialshock.net] has quit [Ping timeout: 260 seconds]
07:18 -!- caesay [~caesay@socialshock.net] has joined #openvpn
07:18 -!- caesay is now known as Guest8738
07:21 -!- mape2k [~mape2k@2001:6f8:997:1000:21f:3bff:fe27:21a9] has joined #openvpn
07:21 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
07:35 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 240 seconds]
07:36 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
07:46 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 260 seconds]
07:48 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
08:05 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
08:06 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:06 -!- SOG [~SOG@222.125.195.205] has joined #openvpn
08:08 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:08 -!- mode/#openvpn [+v Axeman] by ChanServ
08:09 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
08:15 < omry> krzie, I realized that I actually do have access to the router - its a machine in the role of a nat. I added the following route to it  using ip route add : "10.8.0.0/24 via 10.0.0.100 dev eth0" , but I still dont get reply on the client when  ping a machine in the lan
08:15 < omry> 10.0.0.100 is the openvpn server
08:16 < omry> if this is done correctly, I should be able to ping 10.8.0.2 from the router, right?
08:16 < omry> (10.8.0.2 is the client)
08:17 < Bushmills> omry: is your router also the von client?
08:17 < omry> Bushmills, no
08:17 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
08:18 < Bushmills> you can ping vpn client from server?   have you added LAN routes to the vpn client?
08:19 < omry> Bushmills, yes and yes. I have this on the client conf: "route 10.0.0.0 255.255.255.0"
08:19 < Bushmills> ip forwarding enabled on vpn client?
08:20 < omry> no, I enabled it on the server
08:20 < omry> it should be enabled on the client as well?
08:20 < Bushmills> but packets are supposed to traverse between interfaces on client
08:22 < omry> tried now, didnt change anything
08:22 < omry> the minihowto only say you need it on the server: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
08:22 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
08:22 < Bushmills> that's for LAN behind server
08:22 < Bushmills> your case is ...
08:22 < Bushmills> !clientlan
08:22 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
08:22 <@vpnHelper> better explanation
08:23 < Bushmills> at least what i understood
08:23 < omry> the server is a part of the lan I am accessing
08:23 < Bushmills> oh, than /ignore what i said
08:23 < omry> so, if I get the terms correctly - the lan is behind the server
08:23 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Ping timeout: 260 seconds]
08:24 < omry> if the route on the router is set correctlyi, I should be able to ping 10.8.0.2 from it, right?
08:25 < omry> this is my router route. maybe there is an order problem? http://pastebin.com/AyMLcCZS
08:26 < Bushmills> omry: once your vpn client was able to connect to server, routes on router aren't an issue any longer
08:26 < omry> Bushmills, they are for pings to get back to client from other machines in the server lan that are using that router as a default gw
08:31 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15500>
08:32 -!- SOG [~SOG@222.125.195.205] has quit [Ping timeout: 260 seconds]
08:32 -!- SOG [~SOG@222.125.195.205] has joined #openvpn
08:34 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:46 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:49 -!- SOG [~SOG@222.125.195.205] has quit [Quit: I will be back!]
08:50 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Changing host]
08:50 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
08:55 < omry> yay! figured it out. there is option in amazon console to disable source/dest check
08:56 < omry> I had to do it for the openvpn server.
08:56 < omry> now machines in the lan can ping the client
08:57 < omry> client can still not ping machines in the lan though
08:57 -!- mape2k [~mape2k@2001:6f8:997:1000:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
09:01 -!- master_of_master [~master_of@p57B556AB.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:03 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:05 -!- master_of_master [~master_of@p57B5320F.dip.t-dialin.net] has joined #openvpn
09:07 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 260 seconds]
09:09 -!- mape2k [~mape2k@p5B24C897.dip.t-dialin.net] has joined #openvpn
09:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:19 < omry> ok. I finally have pings going back and forth between the client and the lan behind the server. now - I used the static key. is it possible to extend this for multple clients without switching to CA based authentication?
09:20 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
09:21 < EugeneKay> Sure.
09:21 < EugeneKay> I'd have to poke at your server.conf / client.conf to be able to tell you for sure, but assuming you're using the default topology of server-hands-out-IPs-to-clients, it should work fine.
09:21 -!- mape2k [~mape2k@p5B24C897.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:22 < EugeneKay> I presume you're aware of the security risks inherent in shared-secrets, and have decided to forego PKI anyway.
09:22 < omry> EugeneKay, yes - I am aware of it. regarding ip addresses - I`m not assigning them
09:23 < omry> got a hard coded ifconfig 10.8.0.2 10.8.0.1 in both server and client atm
09:23 < EugeneKay> Then you'll need to change it for each client
09:24 < omry> yikes. 
09:24 < omry> whats the alternative?
09:24 < EugeneKay> !/30
09:24 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
09:24 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
09:25 < omry> and what about the server? it has the client address hard coded as well
09:25 < EugeneKay> Server-hands-out-IPs-to-clients :-p
09:25 < omry> ah - if you mean the vpn ip addresses (10.8.*), thats fine
09:25 < omry> I can hand them over :)
09:25 < EugeneKay> Aye.
09:25 < EugeneKay> See also --server 10.8.0.0 255.255.255.0 in the man page
09:26 < omry> looking into all this
09:26 < omry> thanks
09:26 -!- jamesw [~osiris@fsf/member/jamesw] has joined #openvpn
09:27 < jamesw> hi! i have a few ovpn files, crt file, pem file, key file, how can i use them? (ubuntu 11.04)
09:27 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
09:29 < omry> openvpn --show-valid-subnets is invalid btw
09:30 < omry> man page has it, but I get a command line error when I use it
09:31 < EugeneKay> jamesw - talk to whoever gave you them ;-)
09:31 < EugeneKay> Generally speaking, you point the openvpn client at a client.conf(or .ovpn) file, and it will connect. 
09:31 < jamesw> hm.
09:31 < jamesw> ok ty
09:32 < hyper_ch> !howto
09:32 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:34 < jamesw> ...mmm yea i like the idea of just opening one of these ovpn files..
09:36 < omry> !topology
09:36 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions. or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
09:37 -!- jamesw [~osiris@fsf/member/jamesw] has left #openvpn ["Leaving."]
09:38 < omry> EugeneKay, cant find enough info on how to setup the ip address handout easily. can you help?
09:39 < EugeneKay> <EugeneKay> See also --server 10.8.0.0 255.255.255.0 in the man page
09:39 < EugeneKay> Though I'm unsure of how that interacts with shared-key setups(having never used one myself)
09:40 < omry> ah, thanks
09:40 < omry> about CA setup, you automated the client key generation?
09:40 < omry> I mean - I want to be able to allocate a machine automatically.
09:40 < EugeneKay> Ah it says on the Static Key Mini-HOWTO that static keys are limited to 1 client, 1 server.
09:40 < EugeneKay> So it may not even work :-p
09:41 < EugeneKay> I use XCA for all of my key/cert generation and maintenance.
09:41 < omry> EugeneKay, knowing a bit about PSK security, I`m not sure its a real limitation
09:41 < omry> looks to me more like he example there (with hardcoded ip addresses) is the limitation
09:41 < omry> XCA?
09:41 < EugeneKay> Proooobably, yeah. Try removing the ifconfig from both ends and using the server syntax instead :-p
09:42 < EugeneKay> !google xca 
09:42 <@vpnHelper> XCA - X Certificate and key management: <http://xca.sourceforge.net/>; xca | Download xca software for free at SourceForge.net: <http://sourceforge.net/projects/xca/>; XCA Implementation - IHE Wiki: <http://wiki.ihe.net/index.php?title=XCA_Implementation>
09:42 < EugeneKay> Nifty lil gui app to manage PKI.
09:42 < omry> gui app wotn help me :)
09:43 < EugeneKay> If you want to do automatic-client-adding, you can enable duplicate-cn and use an auth-user-pass-verify script instead for verification.
09:43 < omry> thats almost as weak as a shared key I think
09:44  * EugeneKay shrugs
09:44 < EugeneKay> You seem to know the risks associated with the various options, so design something that'll work.
09:44 < omry> the --server looks like a command line flag
09:44 < EugeneKay> All --options can be placed into the .conf without the leading --
09:44 < omry> cool
09:45 < EugeneKay> .conf/.ovpn is to make it easier - everything can be run from a CLI
09:45 < omry> config files contains comments?
09:45 < omry> # didnt seem to work
09:45 < EugeneKay> # or ;
09:46 < EugeneKay> Another option you can look into for automated client cert generation is the php openssl_ functions.
09:47 < EugeneKay> I've not used them myself, but the man page says they do full x509 stuff.
09:47 < omry> --server and --secret cannot be used together (you must use SSL/TLS keys)
09:47 < omry> yay
09:47 < EugeneKay> Go figure.
09:47 < omry> yeah. that's annoying
09:48 < EugeneKay> In fairness, --secret IS pretty dang unsecure
09:48 < omry> true. but I dont really need security here. 
09:48 < omry> I am going to allocate 100 machines for a month, and then throw them away.
09:48 < omry> the security secret gives me is enough
09:48 < EugeneKay> AWS stuff?
09:49 < omry> yeah
09:49 < krzie> !forwardsecurity
09:49 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
09:49 < EugeneKay> As an idea out of left field, SSH tunnels might do what you want.
09:49 < omry> EugeneKay, I need to open too many connections, including dns resolution
09:49 -!- mindcruft [~gerard@static-108-27-36-18.nycmny.fios.verizon.net] has left #openvpn ["WeeChat 0.3.5"]
09:50 < omry> ssh tunnels will be too much work
09:50 < EugeneKay> Ah.
09:50 < EugeneKay> Well, if it's not user-facing, duplicate-cn without auth-user-pass-verify should be OK
09:51 < omry> its not user facing
09:52 < omry> users are not involved in any stage :)
09:52 < EugeneKay> Good. Users suck.
09:53 < omry> :)
09:53 < omry> duplicate-cn looks interesting
09:54 < omry> out of curiosity , if I will want to allow users to use the vpn, will I be able to mix authentication methods?
09:54 < EugeneKay> The best answer to that is to run two server instances
09:54 < omry> IE : have the clients connect with duplicate-cn and he users with full fledge pki?
09:54 < omry> okay, thats good enough
09:54 < EugeneKay> Have the boxen use the duplicate-cn, and users on one without.
09:55 < omry> right
09:55 < EugeneKay> So long as you use different subnets, it should route just fine between the two
09:55 < omry> I didnt go through the entire howto yet. should I read on to use duplicate-cn or it should be easy?
09:55 < EugeneKay> Another thing to note: if you're doing /30, the default 255.255.255.0 subnet size will run you out of IPs. 
09:56 < EugeneKay> Most of the HowTo is arguing with easy-rsa. 
09:56 < omry>  /30 is to support windows?
09:56 < EugeneKay> Usually, yes.
09:56 < krzie> it was
09:56 < krzie> !/30
09:56 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
09:56 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
09:57 < krzie> oh wait thats not it
09:57 < krzie> !topology
09:57 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions. or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
09:57 < krzie> that link explains it
09:57 < krzie> but /30 still has a use that can be important
09:57 < krzie> clients in tap or topology subnet can manually change their IP
09:57 < EugeneKay> If you skip the PKI-related bits of the HowTo, it shortens down substantially.
09:58 < krzie> so if you do policy based routing based on static ip given, you should use /30
09:58 < omry> EugeneKay, but if I want to use duplicate-cn - I should read those?
09:58 < omry> I need at least one key, no?
09:58 < krzie> otherwise you can use topology subnet and no need for /30
09:58 < EugeneKay> Reading through the HowTo is advised to get a feel for how stuff works
09:58 < EugeneKay> duplicate-cn is just a flag that lets the same client.key connect more than once
09:58 < EugeneKay> That's it.
09:58 < krzie> extra laziness when making certs
09:59 < krzie> !ssl-admin
09:59 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
09:59 < omry> krzie, I dont need to support users or windows at the moment. 
09:59 < krzie> omry, you dont need /30 for windows support anymore
09:59 < krzie> starting in a RC for 2.1 that stopped being needed for windows
09:59 < omry> cool
09:59 < krzie> topology subnet will get rid of the /30 behavior
10:00 -!- zux [~zux@195.13.186.54] has quit [Ping timeout: 276 seconds]
10:05 < EugeneKay> Why aren't USB flash drives down to $1/GB yet :-/
10:09 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15501>
10:15 < omry> openvpn picks up any .conf file in /etc/openvpn automatically?
10:15 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15502>
10:19 < krzie> no, but you OS startup script may
10:19 < krzie> i believe debian does at least
10:23 < EugeneKay> I've tested the Ubuntu and RHEL(CentOS/SL anyway) inti scripts, they both start an instance of openvpn for each .conf in /etc/openvpn/
10:23 < krzie> freebsd does not, osx does not
10:24 < krzie> (osx doesnt even come with init scripts)
10:25 < omry> alright - I got it to work with a key for my single client :)
10:25 < omry> ca key I mean
10:26 < omry> what happens if I run a vpn client in the lan?
10:26 < omry> will it route via the vpn?
10:26 < omry> when accessing machines in the lan?
10:26 < krzie> the network self-destructs and takes out the building
10:26 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Read error: Connection reset by peer]
10:27 < EugeneKay> routeception
10:27 < krzie> yes, it'll break
10:27 < omry> the world collapses into a tiny ball of light
10:27 < EugeneKay> "Xzibit routing"
10:27 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
10:27 < EugeneKay> Actually, that'd be a good factoid
10:27 < krzie> "hey dawg, i heard that you liked routing loops"
10:28 < omry> lol
10:28 < krzie> "so i put a route in your route so you can route your routes
10:28 < krzie> "
10:28 < omry> so  I put a route in your route
10:28 < omry> lol, where is that quote from?
10:28 < omry> seen it in other contexts
10:28 < krzie> [11:29]  <EugeneKay> "Xzibit routing"
10:28 < krzie> ^
10:28 < krzie> pimp my routing
10:28 < omry> you dawg, I heard you like bases..
10:30 < EugeneKay> I setup an Xzibit VM once
10:30 < EugeneKay> It didn't end well
10:31 < EugeneKay> ESXi VM running on an drbd-backed iSCSI store, the failover node of which was the VM itself.
10:31 < EugeneKay> It worked because I had setup thin provisioning
10:33 < EugeneKay> I thought about running an ESXi VM and trying to vMotion it to itself
10:34 < EugeneKay> I was afraid it would cause the CPU to fly out of the motherboard
10:36 < omry> :)
10:37 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has joined #openvpn
10:39 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15503>
10:42 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:44 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
10:44 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
10:44 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
10:44 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
10:44 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
10:45 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:48 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
10:50 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:54 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:55 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
11:03 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Quit: Leaving]
11:05 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
11:07 < krzie> dougy: today looking good?
11:16 <@vpnHelper> RSS Update - forum: Network is unreachable (code=101) <http://forums.openvpn.net/topic8804.html>
11:21 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
11:22 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
11:26 -!- dazo is now known as dazo_afk
11:29 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:31 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
11:34 -!- luneff [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
11:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
11:34 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:38 <@vpnHelper> RSS Update - forum: No OPTIONS IMPORT on one of my two servers <http://forums.openvpn.net/topic8805.html>
11:44 -!- Eph [~Eph@unaffiliated/eph] has joined #openvpn
11:44 -!- Eph [~Eph@unaffiliated/eph] has left #openvpn []
11:56 <@vpnHelper> RSS Update - forum: TAP not routing in Windows 7 <http://forums.openvpn.net/topic8806.html>
12:20 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Quit: changing servers]
12:23 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
12:29 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has quit [Quit: Leaving.]
12:39 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Ex-Chat]
13:01 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has joined #openvpn
13:10 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 252 seconds]
13:18 -!- albech [~albech@183.88.64.149] has quit [Quit: Leaving]
13:27 -!- luneff [~yury@ip211-232.telenet.dn.ua] has quit [Read error: Connection reset by peer]
13:28 -!- luneff [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
13:38 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
13:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 240 seconds]
13:49 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Connection reset by peer]
13:49 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
13:50 -!- ppr is now known as peper
14:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:02 -!- MarKsaitis [~MarKsaiti@85-189-201-83.tmbsystems.managedbroadband.co.uk] has joined #openvpn
14:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
14:14 <@vpnHelper> RSS Update - forum: Windows 2003 - Server cannot ping client. <http://forums.openvpn.net/topic8781.html#p15507>
14:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:23 -!- Technicus [~nomadicus@66-190-14-100.dhcp.stpt.wi.charter.com] has quit [Ping timeout: 259 seconds]
14:30 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
14:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
14:57 -!- Alocado [~matthias@netbook.ml.vg] has joined #openvpn
14:57 < Alocado> hello
14:58 < Alocado> i'm new with openvpn.. i've a question to the scripts: is it possible to run scripts at client side on connected/disconnected from server?
15:02 < hyper_ch> [Sunday 11 September 2011] [17.48:58] <hyper_ch> client-connect "/etc/openvpn/scripts/client-up.sh"
15:02 < hyper_ch> [Sunday 11 September 2011] [17.48:58] <hyper_ch> client-disconnect "/etc/openvpn/scripts/client-down.sh"
15:03 < Alocado> but that's on the server side?
15:04 < hyper_ch> no, client side
15:04 < hyper_ch> oh.... 
15:04 < hyper_ch> hmmm
15:04 < hyper_ch> no clue
15:07 -!- MarKsaitis [~MarKsaiti@85-189-201-83.tmbsystems.managedbroadband.co.uk] has quit [Ping timeout: 258 seconds]
15:18 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:27 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
15:57 <@vpnHelper> RSS Update - forum: Connections to multiple OpenVPN Servers? <http://forums.openvpn.net/topic8807.html>
16:01 < reiffert> Alocado: --up --down
16:02 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
16:02 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:16 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:21 <@vpnHelper> RSS Update - forum: No OPTIONS IMPORT on one of my two servers <http://forums.openvpn.net/topic8805.html#p15510> || Network is unreachable (code=101) <http://forums.openvpn.net/topic8804.html#p15509>
16:27 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15512> || Connections to multiple OpenVPN Servers? <http://forums.openvpn.net/topic8807.html#p15511>
16:30 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
16:33 <@vpnHelper> RSS Update - forum: Windows 2003 - Server cannot ping client. <http://forums.openvpn.net/topic8781.html#p15513>
16:45 <@vpnHelper> RSS Update - forum: Windows 2003 - Server cannot ping client. <http://forums.openvpn.net/topic8781.html#p15514>
16:51 <@vpnHelper> RSS Update - forum: Admin web UI accessible, client web UI not if firewalled <http://forums.openvpn.net/topic8808.html>
17:03 <@vpnHelper> RSS Update - forum: Where to place server certificates <http://forums.openvpn.net/topic8726.html#p15516>
17:26 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 240 seconds]
17:27 -!- Alocado [~matthias@netbook.ml.vg] has quit [Quit: Ex-Chat]
17:32 -!- cooldude [~cooldude1@unaffiliated/cooldude13233] has quit [Read error: Connection reset by peer]
18:00 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Ping timeout: 260 seconds]
18:08 -!- p3rror [~mezgani@41.140.101.74] has quit [Remote host closed the connection]
18:18 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
18:20 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
18:20 -!- mode/#openvpn [+o raidz] by ChanServ
18:22 -!- Grleaf [Guess@cpe-72-224-74-122.maine.res.rr.com] has joined #openvpn
18:26 -!- metalfan_ [~xxx@141.41.93.164] has quit [Quit: Verlassend]
18:40 -!- sadurag99 [~sadurag99@dyn-129-78-250-154.wirelessguest.usyd.edu.au] has joined #openvpn
19:16 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html>
19:21 -!- EugeneKay is now known as EugeneSleep
19:37 -!- catsup [d@ps38852.dreamhost.com] has quit [Ping timeout: 240 seconds]
19:38 -!- Denial [Denial@drgi.co.uk] has quit []
19:39 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
19:53 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
19:53 < Xgates> hi guys
19:53 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
19:53 < Xgates> by chance anyone using KVpnc for OpenVPN?
19:53 < Xgates> noticed a problem with it importing the /full/paths for the certs and keys, wanted to know if anyone else is experiencing this?
19:56 < Bushmills> it appears that some do:  http://scarydevilmonastery.net/snap/1315961763527410697d.png 
19:57 < Xgates> not exactly the answer I was looking for ....
19:58 < Bushmills> it's the answer to your first question
19:58 < Xgates> should of just been one question, actually....
19:59 < Xgates> just trying to figure out if anyone around is using it and noticed the same problem is all....
20:03 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Ping Timeout (0 Nano Seconds)]
20:05 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:22 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
20:24 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
20:24 -!- mode/#openvpn [+o raidz] by ChanServ
21:36 -!- tjz [~pc@bb119-74-182-10.singnet.com.sg] has joined #openvpn
21:36 -!- tjz [~pc@bb119-74-182-10.singnet.com.sg] has quit [Changing host]
21:36 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
22:44 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has joined #openvpn
22:51 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
23:08 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:40 -!- sadurag99 [~sadurag99@dyn-129-78-250-154.wirelessguest.usyd.edu.au] has quit [Quit: Linkinus - http://linkinus.com]
23:47 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15518>
23:57 -!- meepmeep_ [meepmeep@212.24.104.229] has quit [Ping timeout: 260 seconds]
23:57 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
23:58 -!- bragon [~Alexandre@81.93.247.165] has quit [Ping timeout: 252 seconds]
23:58 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
23:58 -!- asio [~asio@195.20.207.173] has quit [Ping timeout: 260 seconds]
23:58 -!- raomin_ [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 252 seconds]
23:58 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 260 seconds]
23:58 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 260 seconds]
--- Day changed Wed Sep 14 2011
00:01 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 260 seconds]
00:01 -!- batrick [~batrick@nmap/developer/batrick] has quit [Ping timeout: 252 seconds]
00:04 -!- halorgium [tim@titanium.spork.in] has quit [Ping timeout: 260 seconds]
00:04 -!- R-66Y [~nobody@elegua.za.net] has quit [Ping timeout: 260 seconds]
00:04 -!- Netsplit *.net <-> *.split quits: oc80z, tty234, pwrcycle, Run32dll, DexTerDDIT, K1ng, cali, @mattock, jbb, ph1l,  (+43 more, use /NETSPLIT to show all of them)
00:04 -!- toortog [~toortog@notsecure.net] has quit [Ping timeout: 260 seconds]
00:06 -!- yell0 [yello@178.162.154.183] has joined #openvpn
00:06 -!- downhill_ [~nobody@elegua.za.net] has joined #openvpn
00:06 -!- batrick_ [~batrick@batbytes.com] has joined #openvpn
00:06 -!- raidz1 [~Administr@aim.505.ru] has joined #openvpn
00:06 -!- asio_ [~asio@195.20.207.173] has joined #openvpn
00:06 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
00:06 -!- raomin__ [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
00:06 -!- bragon_ [~Alexandre@81.93.247.165] has joined #openvpn
00:06 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
00:06 -!- Netsplit over, joins: krzie, mattock, corretico, newmember, tjz, catsup, K1ng, Rolybrau, Fleck, cali (+12 more)
00:06 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
00:06 -!- Netsplit over, joins: krzee, @vpnHelper, Cain, DexTerDDIT, inimino, busch_, naquad, rooth, sigius, fremo (+4 more)
00:06 -!- ServerMode/#openvpn [+oo mattock vpnHelper] by zelazny.freenode.net
00:06 -!- Netsplit over, joins: Olipro
00:06 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
00:06 -!- Netsplit over, joins: chantra, kenyon, DeathWolf, JPeterson, ivenkys, RichardBronosky, DarthGandalf, hyper_ch, decoder, amir (+4 more)
00:06 -!- mode/#openvpn [+v oc80z] by ChanServ
00:09 -!- toortog [~toortog@notsecure.net] has joined #openvpn
00:11 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 260 seconds]
00:11 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
00:11 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
00:14 -!- halorgium [tim@titanium.spork.in] has joined #openvpn
00:19 -!- halorgium [tim@titanium.spork.in] has quit [Ping timeout: 260 seconds]
00:21 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
00:22 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 252 seconds]
00:26 -!- tjz [~pc@bb119-74-163-4.singnet.com.sg] has joined #openvpn
00:26 -!- tjz [~pc@bb119-74-163-4.singnet.com.sg] has quit [Changing host]
00:26 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
00:28 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
00:30 -!- halorgium [tim@titanium.spork.in] has joined #openvpn
00:52 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:53 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:08 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 260 seconds]
01:09 -!- luneff [~yury@ip211-232.telenet.dn.ua] has quit [Quit: Leaving]
01:15 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15519>
01:19 -!- zux [~zux@195.13.186.54] has joined #openvpn
01:24 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
01:43 -!- dazo_afk is now known as dazo
01:48 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
01:53 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
01:58 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:00 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:05 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
02:22 -!- qknight [~joachim@88.198.52.213] has quit [Ping timeout: 260 seconds]
02:39 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
02:39 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
02:39 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
02:42 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
02:44 -!- Ionic [ionic@ionic.de] has joined #openvpn
02:47 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
02:48 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:52 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:09 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15520>
03:10 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
03:11 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
03:17 -!- raomin__ [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
03:17 -!- raomin__ [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:19 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
03:19 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
03:19 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
03:19 -!- mode/#openvpn [+v novaflash] by ChanServ
03:21 <@vpnHelper> RSS Update - forum: openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p15522> || No OPTIONS IMPORT on one of my two servers <http://forums.openvpn.net/topic8805.html#p15521>
03:26 < Mowee> Morning peepz
03:27 < Halitus> morning? its 8 30 at night :P
03:27 <@vpnHelper> RSS Update - forum: Network is unreachable (code=101) <http://forums.openvpn.net/topic8804.html#p15523>
03:28 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has joined #openvpn
03:29 -!- mtylty [~mtylty@wifi-dev.caspur.it] has joined #openvpn
03:29 < mtylty> hi
03:30 < Halitus> hi
03:30 < mtylty> can somebody shed light on --max-routes-per-client
03:30 < mtylty> ?
03:31 < mtylty> I'm a developer working on openwisp.it
03:31 < mtylty> and we are having a hard time with openvpn's internal routing system
03:31 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
03:31 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
03:31 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
03:32 < mtylty> we are using a tap bridge to connect access points 
03:32 < mtylty> with our servers
03:33 < mtylty> so after some time, since the iroutes never get flushed, there are no more available "routes" (quoted because I'm talking about mac addresses here)
03:34 < mtylty> and the access point's clients never get to the other side of the bridge since there are no more available routes
03:34 < mtylty> (we are a wireless ISP)
03:35 < mtylty> does anybody know a way to manually or periodically flush openvpn's internal routes?
03:35 < mtylty> (other then restarting the vpn)
03:35 < mtylty> *than
03:37 < mtylty> we are also working on a patch to submit
03:37 < mtylty> since after reading again and again the manual 
03:37 < mtylty> we did not find anything that will help
03:38 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 260 seconds]
03:38 < mtylty> (apart from rising the --max-routes-per-client value to expand the routing tables to enormous values)
03:39 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
03:39 < defswork> dazo, I've been playing with an smb mounted filesys, mounted as cifs, and it's actually really stable.  Connected over openvpn to home and survived my broadband going down etc.. and been up for a week now
03:40 <@dazo> nice!
03:40 < defswork> I never got round to trying nfs
03:41 <@dazo> I'm wondering whom of them are most efficient, in throughput and stability point of view
03:42 -!- spawnazzo [~aferrares@ferraresi.caspur.it] has joined #openvpn
03:48 <@vpnHelper> RSS Update - forum: openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p15525> || No OPTIONS IMPORT on one of my two servers <http://forums.openvpn.net/topic8805.html#p15524>
03:48 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
03:52 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
03:54 <@vpnHelper> RSS Update - forum: openvpn, windows client -> linux server no connection <http://forums.openvpn.net/topic8811.html>
04:03 < omry> The openvpn package on debian runs the server automatically. is there a client only package?
04:04 < omry> (or is the daemon actually needed for the client?)
04:04 < Bushmills> no. it's either
04:04 < Bushmills> the config determines its role
04:04 < Bushmills> yes. needed
04:04 -!- busch_ [~busch@74.117.156.156] has quit [Quit: bye]
04:04 < omry> gotcha
04:04 < omry> ll
04:04 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
04:08 -!- bragon_ is now known as bragon
04:12 < omry> trying to create a single VM image that will be used with or without a VPN depending on some launch parameter. during my games I started a vpn client inside the lan behind the server, and I lost connection to the box.
04:12 < omry> why is that?
04:30 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 260 seconds]
04:34 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 259 seconds]
04:36 < reiffert>   --disable-multi         Disable client/server support (--mode server + client mode)
04:37 -!- EugeneSleep is now known as EugeneKay
04:37 < reiffert> whats that?
04:39 < reiffert> one instance running as --mode server and --mode client?
04:41 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
04:43 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
04:45 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
04:48 <@vpnHelper> RSS Update - forum: openvpn, windows client -> linux server no connection <http://forums.openvpn.net/topic8811.html#p15527>
04:55 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
04:58 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Read error: Connection reset by peer]
04:58 -!- Flecks [~fleck@unaffiliated/fleck] has joined #openvpn
05:01 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
05:01 -!- Deesl [~bsdboy@unaffiliated/deesl] has joined #openvpn
05:01 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Ping timeout: 258 seconds]
05:03 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
05:18 <@vpnHelper> RSS Update - forum: Basic bridge routing on linux host <http://forums.openvpn.net/topic8812.html> || One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15528>
05:20 < EugeneKay> Good morning, openvpners
05:21 -!- Alocado [~matthias@netbook.ml.vg] has joined #openvpn
05:21 < Alocado> hello... does it make sense to use --float on server side if the clients have dynamic ips?
05:21 < Alocado> the server has a static ip
05:24 < EugeneKay> According to the man page, --float would be on by default on a --server instance(as there is no --remote specified)
05:24 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html#p15530>
05:24 < Alocado> oh, ok
05:24 < Alocado> thx :)
05:25 < Alocado> next question: if the server shuts down (e.g. for restart), all client instances stops, too... how can i made my clients retrying infinite times?
05:26 < Alocado> they should don't care for the server behaviour, if the connection to the server is lost, they should try it again and again...
05:27 < EugeneKay> See the --$foo-retry family of options
05:33 < mtylty> nobody using --max-routes-per-client ?
05:34 < EugeneKay> Can't say I am.
05:35 < mtylty> lol
05:35 < mtylty> ok
05:35 < mtylty> somebody using tap devices?
05:35 < EugeneKay> Yes, but not for bridging.
05:36 < mtylty> for what?
05:36 < EugeneKay> IPv6 support(via --up scripts)
05:36 < mtylty> ahhhh 
05:36 < mtylty> ok
05:39 -!- Grleaf [Guess@cpe-72-224-74-122.maine.res.rr.com] has quit [Ping timeout: 252 seconds]
05:41 < omry> generates runs gzip forever
05:41 < omry> hmm, wrong channel
05:41 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
05:41 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
05:41 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
05:41 < EugeneKay> Errryday I'm gzipping
05:42 < omry> but you you generating?
05:42 < omry> s/you/are
05:43 -!- mape2k [~mape2k@erft-4d07e3bc.pool.mediaWays.net] has joined #openvpn
05:43 < EugeneKay> Yeah, I really dunno.
05:43  * reiffert is generating.
05:43 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
05:44 < EugeneKay> I think we may have gotten off point a bit.
05:44 < omry> I think its impossible for you to get on pointd with so litle info :)
05:45 < mtylty> gzip sucks
05:45 < mtylty> bzip2 RULES!
05:45 < omry> call me when bzip (or gzip!!) supports multi cores
05:45  * EugeneKay shrugs
05:45  * EugeneKay rings omry http://www.zlib.net/pigz/
05:46 < omry> hehe, looking
05:46 < reiffert> omry: gimme your number .. http://www.zlib.net/pigz/
05:46 <@vpnHelper> Title: pigz - Parallel gzip (at www.zlib.net)
05:46 < reiffert> EugeneKay: :D
05:46 < EugeneKay> Or, for better effect
05:46 < EugeneKay> !google parallel gzip
05:46 <@vpnHelper> pigz - Parallel gzip: <http://www.zlib.net/pigz/>; Pigz – parallel gzip OMG: <http://www.kitchensoap.com/2010/04/02/pigz-parallel-gzip-omg/>; Options for Parallel Compression: <http://teddziuba.com/2010/01/options-for-parallel-compressi.html>
05:46 < reiffert> !google 3+3
05:46 <@vpnHelper> 3x3 The Magazine of Contemporary Illustration: <http://3x3mag.com/>; 3OH!3 | Free Music, Tour Dates, Photos, Videos: <http://www.myspace.com/3oh3>; Nike 3on3 Tournament: <http://nike3on3.com/>
05:47 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:47 < omry> they should make gzip a drop in replacement
05:48 < omry> pigz, I mean
05:48 < EugeneKay> I'm looking to see if it's possible to do that with the EPEL-provided package now, actually
05:48 < spawnazzo> and what about lzma ?
05:48 < mtylty> bzip2 is waaay better than lzma
05:48 < reiffert> it's dead, jim
05:50 < spawnazzo> bzip2 is older than my grandma 
05:50 < omry> spawnazzo, lzma?! why not lzh? lharc? arj? uc2?
05:51 < reiffert> uc2 was that exe compressor used with dos?
05:52 -!- mape2k [~mape2k@erft-4d07e3bc.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
05:52 < mtylty> uc2 was the compressor used to compress your grandma
05:52 < omry> all I remember is "ultra compressor 2". I think it was a regular compression, not for exec
05:52 < omry> lol
05:53 < reiffert> mtylty: and you are how old again, 11?
05:53 < mtylty> I used uc2 to compress your grandma, go figure it out
05:54 < EugeneKay> Hawt
05:54 < omry> mtylty, is what somwahat funny at first. now its getting lame.
05:55 < reiffert> squeeze/main pigz amd64 2.1.6-1 [34.2 kB]
05:55 < mtylty> omry: forever alone
05:56 < omry> reiffert, up. but I noticed that they didnt set it up as an alternative to gzip (update-alternatives)
05:57 < EugeneKay> FWIW, pigz seems to behave well hen dropped-in over gzip/gunzip
05:57 <@vpnHelper> RSS Update - forum: Possible to use a key token with OpenVPN? <http://forums.openvpn.net/topic7632.html#p15531>
05:57 < spawnazzo> remember: don't feed the trolls :) see ya 
05:57 -!- spawnazzo [~aferrares@ferraresi.caspur.it] has quit [Quit: Leaving]
05:57 < reiffert> 19853 thomas    20   0 89192 7564  524 S  227  0.1   1:10.83 pigz               
05:58 < reiffert> EugeneKay: but what about libz and tar?
05:58 < EugeneKay> tar works fine with it
05:59 < EugeneKay> I renamed /bin/g[un]zip to -old, and them symlink'ed to [un]pigz
05:59 < mtylty> trollolololllollolollo, trolllo!
05:59 < reiffert> 19853 thomas    20   0     0    0    0 Z   20  0.0   2:33.48 pigz <defunct>     
05:59 -!- mtylty [~mtylty@wifi-dev.caspur.it] has left #openvpn []
05:59 < omry> thats basically what I would expect package maker to do. (update-alternatives  does some symlink magic)
06:00 < omry> when pigz are zombies
06:02 < EugeneKay> tar -czf on a 1.3GB avi(already fairly compressed) went from being 60s op to a 33s op. In both cases it managed to chop off 10MB.
06:02 < reiffert> 1.5GB source tree: 2m24 running pigz
06:03 < EugeneKay> cp'ing the avi directly(I'm working between two different disks, to reduce random I/O bias here) is a 25s op
06:04 < EugeneKay> So, assuming there's no major glaring issues with the pigz implementation, I'd say it's worth using.
06:04 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Ping timeout: 258 seconds]
06:04 < EugeneKay> The one gotcha is that any updates to the gzip package will blow away my pigz symlinks.
06:05 < reiffert> add "replaces: gzip" to the pigz packages.
06:05 < reiffert> 1.5GB source tree: 2m54 running gzip
06:05 < EugeneKay> I've been avoiding maintaining my own rpm repo.
06:05 < reiffert> alsmost same size:
06:05 < reiffert> -rw-r--r-- 1 thomas thomas 1596523902 Sep 14 13:05 foo2.tgz
06:05 < reiffert> -rw-r--r-- 1 thomas thomas 1596349952 Sep 14 13:01 foo.tgz
06:05 < EugeneKay> That's gzip/pigzing it on the same disk, though?
06:05 < omry> EugeneKay, cool.
06:05 < reiffert> yup
06:06 < EugeneKay> Try tar'ing it cross-disk. Random I/O is probably murdering you there.
06:06 < EugeneKay> Ie, you're iowait, not cpuwait
06:06 < reiffert> I try with the ramdisk.
06:08 < reiffert> tar without compression: 2m30
06:08 < reiffert> -rw-r--r-- 1 thomas thomas 2452889600 Sep 14 13:08 foo3.tar
06:09 < reiffert> ramdisk, pigz: 0m28
06:11 < reiffert> ramdisk, gzip: 1m54
06:12 < EugeneKay> On a 4-core box?
06:12 < reiffert> plus 4 hyperhyper
06:12 < EugeneKay> Well I think there's the definitive benchmark
06:12 < reiffert> i920
06:12 < reiffert> i7-920
06:13 < EugeneKay> I used an i3-540
06:13 < EugeneKay> 2+HTing
06:22 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:25 < reiffert> http://compression.ca/pbzip2/
06:25 <@vpnHelper> Title: Parallel BZIP2 (PBZIP2) (at compression.ca)
06:32 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15532>
06:33 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Quit: changing servers]
06:36 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
06:38 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html#p15533>
06:49 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:50 <@vpnHelper> RSS Update - forum: No OPTIONS IMPORT on one of my two servers <http://forums.openvpn.net/topic8805.html#p15534>
06:52 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
06:54 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
06:54 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
06:54 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
06:54 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
06:56 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15535>
07:00 -!- EugeneK [eugenekay@itvends.com] has joined #openvpn
07:01 -!- EugeneKay [EugeneKay@eugenekay.com] has quit [Remote host closed the connection]
07:01 -!- EugeneK is now known as EugeneKay
07:08 <@vpnHelper> RSS Update - forum: openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p15536>
07:20 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
07:24 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
07:26 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 260 seconds]
07:26 <@vpnHelper> RSS Update - forum: Windows 2003 - Server cannot ping client. <http://forums.openvpn.net/topic8781.html#p15537>
07:29 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
07:33 -!- downhill_ is now known as R-66Y
07:43 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
07:45 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
08:12 -!- spawnazzo [~aferrares@ferraresi.caspur.it] has joined #openvpn
08:15 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15538>
08:15 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:15 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 252 seconds]
08:18 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
08:20 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
08:28 -!- Alocado [~matthias@netbook.ml.vg] has quit [Quit: Ex-Chat]
08:35 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:46 < Optic> mo mo
08:46 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
08:46 -!- mode/#openvpn [+o raidz] by ChanServ
08:48 -!- raidz1 [~Administr@aim.505.ru] has quit [Ping timeout: 260 seconds]
08:56 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
08:57 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
08:57 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
08:57 -!- Deesl [~bsdboy@unaffiliated/deesl] has quit [Quit: Bye!]
08:57 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
08:58 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
08:59 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
08:59 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
09:00 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
09:00 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
09:01 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
09:01 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
09:01 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
09:04 -!- master_of_master [~master_of@p57B5320F.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:05 -!- master_of_master [~master_of@p57B53315.dip.t-dialin.net] has joined #openvpn
09:10 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
09:11 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
09:11 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
09:12 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
09:13 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
09:15 <@vpnHelper> RSS Update - forum: Windows 2003 - Server cannot ping client. <http://forums.openvpn.net/topic8781.html#p15539>
09:16 -!- Meliorator [m@dunnington.eu] has joined #openvpn
09:21 <@vpnHelper> RSS Update - forum: Basic bridge routing on linux host <http://forums.openvpn.net/topic8812.html#p15540>
09:30 < dxtr> So let's say I connect a bunch of clients to my VPN. Can I somehow reserve a couple of IPs for specific clients?
09:30 < dxtr> If I, for example, wanna redirect ports to them
09:31 < omry> is there some hook I can use to do stuff when the tunnel is established?
09:39 <@vpnHelper> RSS Update - forum: Basic bridge routing on linux host <http://forums.openvpn.net/topic8812.html#p15541>
09:39 < EugeneKay> omry - see --up
09:40 < omry> EugeneKay, looking
09:40 < ecrist> !ccd
09:41 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
09:41 < EugeneKay> dxtr - you want to look into the meat of the --server directive. Investigate in particular the ifconfig-pool. Clients with specific addresses should have a ccd entry.
09:41 < ecrist> !static
09:41 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
09:41 < omry> I want my script to run after the tunnel is established. (I need the client vpn ip address)
09:41 < ecrist> !client-connect
09:41 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
09:41 < omry> thanks
09:42 < dxtr> EugeneKay: Aight
09:44 < dxtr> EugeneKay: I'm using subnet mode, btw
09:44 < dxtr> Does that matter?
09:44 < EugeneKay> Just look at how --server expands 
09:44 <@vpnHelper> RSS Update - forum: Network is unreachable (code=101) <http://forums.openvpn.net/topic8804.html#p15542>
09:44 < dxtr> Oh right
09:44 < dxtr> I got the man page up right now \o
09:45 < EugeneKay> You'll want to change the defaults
09:45 < EugeneKay> Reserve the last few-dozen IPs instead of handing out all the way to .254
09:46 < dxtr> Oh, so basically I want to drecrease the pool size.. Will I be using a ccd for each client I want to reserve an IP for?
09:46 < EugeneKay> Yup.
09:48 < dxtr> I think I'm starting to learn this whole openvpn thing :D
09:48 < EugeneKay> Use ifconfig-push per-client. I don't think you need to use push-reset for that(to avoid the pool IP being pushed), but I may be wrong.
09:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:50 -!- mode/#openvpn [+v Axeman] by ChanServ
09:50 < dxtr> Well, does it matter if I use push-reset and then just push the the data it needs? :)
09:50 < EugeneKay> So long as you push all the requisite routes, shouldn't behave any different
09:51 < EugeneKay> I avoid use of push-reset because you need to maintain all the routes in each ccd entry
09:51 < EugeneKay> This gets tedious.... quickly.
09:52 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
09:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:53 < dxtr> True
09:53 -!- spawnazzo [~aferrares@ferraresi.caspur.it] has quit [Quit: Leaving]
09:55 < dxtr> Hmm
09:55 < dxtr> Goddammit
09:56 < dxtr> But.. Uhm..
09:56 < dxtr> oh yeah
09:56 < EugeneKay> Spit it out man
09:58 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
10:00 < dxtr> I was thinking out loud. Answered my own question :)
10:00 < dxtr> Actually I forgot for a short moment what you said (Look at how --server expands) and was like "WTF?"
10:01 < dxtr> But then I saw the light
10:08 < defswork> don't look into the light
10:09 < dxtr> Are the ccd files supposed to be commonname.conf or just commonname
10:09 < dxtr> ?
10:09 < defswork> just common name
10:09 < dxtr> Aight
10:09 < dxtr> That's why it didn't seem to work :D
10:10 < dxtr> Sweet
10:10 < dxtr> Now it works!
10:10 < dxtr> Thank you :)
10:10 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 240 seconds]
10:10 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
10:10 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
10:10 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
10:10 -!- mode/#openvpn [+v novaflash] by ChanServ
10:10 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
10:11 < omry> EugeneKay, added "up /etc/openvpn/up" to my client conf, but I dont think its running when I restart openvpn on the client
10:13 < omry> also tried ipchange
10:13 < omry> same effect
10:15 < krzie> --script-security
10:16 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
10:20 < omry> krzie, now it tries to run it, but claim that it failed in syslo
10:20 < omry> g
10:21 < omry> "/etc/openvpn/up tun0 1500 1541 10.8.0.18 10.8.0.17 init" followed by script failed: could not execute external program
10:21 < omry> if I run that command it works
10:25 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 260 seconds]
10:31 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
10:33 < EugeneKay> You are not the openvpn user ;-)
10:36 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
10:36 -!- larsduesing [~lars@195.34.173.187] has quit [Quit: brb]
10:36 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
10:44 < omry> aha, I`m not nobody :)
10:45 < krzie> check that its +x too
10:45 < krzie> up script should execute before dropping privlidges
10:45 < omry> it does have +x
10:46 < krzie> and you have script-security 2?
10:48 < omry> yup
10:48 < omry> it does not complain about script security, just that the exec failed
10:48 < krzie> lets see the config and the script in pastebin
10:48 < krzie> no comments in the config
10:49 -!- kyrix [~ashley@LSt-Amand-152-32-39-189.w80-11.abo.wanadoo.fr] has quit [Quit: Ex-Chat]
10:50 < omry> http://pastebin.com/pdsr0jEF
10:50 < omry> with the script: http://pastebin.com/znT9Yrqn
10:51 < krzie> try giving it a shbang
10:51 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
10:52 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
10:52 < krzie> you're starting it as root, right?
10:52 < omry> ofc
10:53 < krzie> adding a shbang help?
10:53 < omry> yup, that it
10:53 < omry> thnks
10:53 < krzie> you're welcome
10:54 < omry> should be documented
10:54 < krzie> scripts should have shbangs
10:54 < omry> you can run bash scripts without
10:54 -!- dazo is now known as dazo_afk
10:54 < krzie> should openvpn document that files in unix should end with windows style ^M ^M on the end of the lines too?
10:54 < krzie> :-p
10:54 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has joined #openvpn
10:55 < krzie> should not*
10:55 < steelnwool> Hey guys. I just asked a question in centos forums. I think it involves openvpn too. https://www.centos.org/modules/newbb/viewtopic.php?topic_id=33269&start=0#forumpost142487 mind giving me your opinions.
10:55 <@vpnHelper> Title: www.centos.org - Forums - CentOS 6 - Networking Support - I add an IP alias and loose connectivity. (at www.centos.org)
10:55 < krzie> the only reason you run bash scripts without is cause you call them from bash
10:55 < krzie> trust me, use a shbang always
10:56 < omry> okay. but I do think that the error message should be mo specific : "could not detect script type, add shabang". not "failed!"
10:56 < omry> :)
10:56 < krzie> it doesnt know
10:56 < krzie> it just checks the exit status of the script
10:56 < krzie> script failed, you get that error
10:56 < omry> it runs it with exec?
10:56 < krzie> it doesnt know *why* the script fails
10:57 < krzie> well it can run it 2 ways
10:57 < krzie> see script-security in the manual for the answer to that
10:57 < krzie> !man
10:57 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
10:58 < omry> when I said it should be documented, I meant in the man page
10:59 < omry> rtfm goes both ways :P
10:59 < krzie> how to write a script correctly should be documented in the openvpn man page?
10:59 < krzie> sorry, wrong manual
10:59 < krzie> :-p
10:59 <+novaflash> isn't that wtfm?
10:59 < krzie> i think jsut wfm
10:59 < omry> rtfm is a double edged swrod, the other edge of it is wtfm
10:59 < omry> it is known.
10:59 < krzie> wrong friggen manual
10:59 <+novaflash> haha
10:59 < krzie> hehe
11:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
11:01 < omry> stdout of the executed script is lost?
11:01 < krzie> i think sdout goes direct to the log
11:01 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has left #openvpn []
11:05 < omry> up is called after the tunnel is established>
11:05 < omry> ?
11:08 < krzie> They say, when you join a nudest colony...the first few days are the hardest.
11:08 < krzie> omry, 
11:08 < krzie> !script
11:08 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
11:08  * cpm chuckles
11:09 < omry> yeah yeah. I can also see it in the man page
11:10 < omry> I`m just puzzled becuase my script does not work
11:10 < omry> and I am not sure why because openvpn swallows the stderr
11:10 < krzie> you are aware you can redirect stderr to a file in your script...?
11:11 -!- luneff [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
11:11 < omry> good idea
11:11 < krzie> [12:11]  <omry> yeah yeah. I can also see it in the man page
11:11 < krzie> so you know this isnt entirely true then
11:11 < krzie> [12:07]  <omry> up is called after the tunnel is established>
11:12 < SJr> I cannot connect to an OpenVPN server, I've tried regenerating the certs about 4 times, and on two seperate machines the details are here: http://pastebin.com/mUbXq5SV . The main error appears to be :  BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 
11:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:12 < krzie> SJr, 
11:12 < krzie> !certverify
11:12 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
11:12 < krzie> !pki
11:12 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
11:12 <@vpnHelper> specially as a server (see !servercert)
11:12 < krzie> #2
11:13 < krzie> i point out pki #2 so you see that its checking against the ca.crt on the other side
11:13 < SJr> they match on both sides
11:13 < krzie> your config is 78 lines long
11:13 < krzie> with more like 15 real lines
11:13 < krzie> cant say thats pleasurable to look at
11:14 < krzie> btu ya, !certverify should help you manually test with just openssl, so you can take openvpn out of the mix until your certs work
11:15 < SJr> those are two configs client and server
11:15 < krzie> see how that wasnt easy to tell?  because of all the extra lines...
11:15 < omry> SJr, this can strip the comments and empty lines: grep -v "^#\|;\|^$" client.conf 
11:16 < krzie> ^
11:16 < SJr> ah that's how you do empty lines :)
11:16 < omry> :), ^ is start of line, $ is end.
11:17 < SJr> hmmm
11:18 < omry> krzie, interestingly, I had to run my actuall command in the background for the whole thing to work.
11:18 < SJr> pascal.crt: OK
11:18 < SJr> sjrx.net.crt: OK
11:18 < krzie> SJr, md5 both ca.crt's
11:18 < krzie> make sure they are the same
11:19 < omry> the command needs network access. so I am guessing its blacking the vpn somehow and they deadlock
11:19 < SJr> 798a8eced19bff003b0676ea1e7e697a
11:19 < omry> blocking
11:19 < krzie> since you're testing against each local one, but openvpn must test against each on the other side
11:19 < SJr> it seems to match
11:19 < krzie> seems to or exactly does?
11:19 < krzie> omry, ya the scripts do block
11:20 < krzie> if you need non-blocking you need to write it as a plugin
11:20 < krzie> openvpn2 is monolithic like that
11:20 < krzie> one day when openvpn3 exists it wont be
11:21 < SJr> exactly
11:21 < SJr> it exactly matches
11:22 < SJr> oh I bet I know what it is
11:23 < SJr> CN in here is common name: /C=CA/ST=British_Columbia/L=Vancouver/O=SJrX_Networks/CN=openwrt/emailAddress=security@sjrx.net
11:23 < SJr> and that should be sjrx.net?
11:23 < SJr> lemme try that 
11:24 < krzie> omry, an openvpn server cant even process other clients stuff while running a script
11:24 < krzie> actually common-name there is openwrt
11:25 < SJr> Yeah
11:25 < SJr> and shouldn't it be sjrx.net+?
11:25 < krzie> why?
11:25 < krzie> common-name just needs to be unique
11:25 < krzie> (and not have special chars in it)
11:25 < omry> krzie, this is all on the client
11:25 < omry> but I guess the same problem holds
11:25 < SJr> Oh I guess not
11:25 < SJr> I misread the HOWTO
11:26 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
11:26 < krzie> omry, just expanding on that since you touched on a valid topic that you may wanna know better
11:26 < omry> gotcha
11:26 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
11:27 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
11:27 < krzie> jjk goes into more depth on it in his book
11:27 < krzie> !book
11:27 < omry> krzie, so running my command with & in the script is safe?
11:27 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
11:27 < krzie> you may want to disown it as well, depending, but yes
11:27 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
11:27 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
11:28 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has joined #openvpn
11:28 -!- darkdrgn2k4 [~darkdrgn2@35.33.234.216.sta.connection.ca] has quit [Read error: Connection reset by peer]
11:28 < omry> its a short command, a few seconds at most. my question is more about race conditions. will my command alway have network access if I run it like this?
11:29 < krzie> you sure you read this:
11:29 < krzie> !script
11:29 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
11:29 < krzie> ?
11:29 < SJr> well I'm regenerating the certificates again I guess
11:29 < SJr> krzie any other ideas?
11:29 < krzie> !ssl-admin
11:29 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
11:29 < krzie> thats what i use for generating my certs
11:30 < krzie> i dont like easy-rsa personally
11:30 < omry> krzie, all good and true - but my script did NOT have network access while it was blocking
11:30 < SJr> you think it is really the certs? 
11:30 < krzie> SJr, i in fact do
11:30 < krzie> but also
11:30 < krzie> make sure you run ntpdate on the CA, server, and client
11:30 < krzie> just in case its a time issue
11:31 < krzie> (dont just check the time, use ntpdate)
11:31 < SJr> yeah I thought of that
11:31 < SJr> lemme run in again
11:31 < krzie> omry, 
11:31 < krzie> Script Order of Execution
11:31 < krzie> --up 
11:31 < krzie>  Executed after TCP/UDP socket bind and TUN/TAP open.
11:31 < krzie> that doesnt mean you're garunteed to have ping over the vpn at that point...
11:32 < SJr> If I have one OpenVPN system setup is their a reason I can't move the certs to this one ( the domain names won't match)
11:32 < krzie> domain names dont matter
11:32 < SJr> okay well lemme try that
11:32 < krzie> your certs dont need anything related to domain in them
11:33 < SJr> cause I know these other certs work
11:37 < SJr> offsets were both less than 1 second
11:38 < krzie> SJr, ya i didnt think that was it, but always worth checking
11:38 < krzie> hows your known-good certs work on those boxes?
11:38 < SJr> No I think it's tanking too
11:39 < krzie> you got something fubar'ed that ive never seen before then
11:39 < krzie> messed up openssl?  screwed libs? i dunno
11:39 < krzie> you compiled openvpn on each box?
11:39 < krzie> or did you just manually copy a binary or something?
11:39 < SJr> hmmmm
11:40 < SJr> no both packages, one is my laptop, which has openvpn working with my server in the states
11:40 < SJr> the other is openwrt at home
11:40 < SJr> I may have flubbed something with the cert copying though lets see
11:40 < SJr> verify failed
11:40 < krzie> openwrt... how are you starting it?
11:40 < krzie> using that lame ass UCI?
11:40 < SJr> no
11:40 < krzie> or with a normal config file?
11:40 < SJr> I didn't use UCI for this
11:40 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 240 seconds]
11:40 < SJr> normal config
11:40 < krzie> good
11:40 < krzie> uci sucks for openvpn imo
11:41 < SJr> my laptop can communicate with the server fine and that tunnel comes up.
11:42 < SJr> yeah I didn't like it for samba either
11:43 < SJr> although I like openwrt alot
11:43 < omry> krzie, while any script is running- the client vpn is supposed to work?
11:43 < omry> the tunnel itself will transmit data?
11:44 < krzie> no, it blocks like i said earlier
11:44 < krzie> its single threaded
11:44 < omry> I switched to rouet-up, and I am still seeing the same behavior when my script block
11:44 < SJr> hmmmm
11:44 < SJr> oh I just used the wrong arguments the certs on the server are fine
11:45 < omry> so why did you point me to the doc again?
11:45 < omry> I thought your point was that I can use a different hook
11:45 < krzie> i thought you were saying your script had no network access at that point
11:46 < krzie> to which my reply would be to use a later hook
11:46 < omry> it didnt. but not because of the stage. but because it was blocking the vpn
11:46 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
11:46 < omry> ok
11:46 < krzie> ahh ok, i thought you had already solved that with &
11:46 < omry> I did
11:46 < krzie> umm, alright
11:46 < krzie> so whats the problem?
11:47 < omry> none at this point.
11:47 < krzie> sweet
11:47 < omry> just saw your comments and I thought you have a better suggestion
11:47 < krzie> thank you please pull up to the first window =]
11:47 < omry> I do not support windows, sorry :P
11:47 < krzie> !windows
11:47 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
11:48 < SJr> krzie I just copied the working client config over
11:48 < SJr> and no luck
11:48 < SJr> do you think it's worth copying the server side config (hassle)
11:48 < omry> krzie, lol
11:48 < krzie> SJr, i really have no clue what your issue is
11:49 < krzie> feel free to give it a shot
11:53 < SJr> think openwrt b0rked something?
11:57 <@vpnHelper> RSS Update - forum: Admin web UI accessible, client web UI not if firewalled <http://forums.openvpn.net/topic8808.html#p15543>
12:00 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 260 seconds]
12:01 -!- Shinigami-Sama [~pewpew@154.5.144.146] has joined #openvpn
12:01 -!- Shinigami-Sama [~pewpew@154.5.144.146] has quit [Changing host]
12:01 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
12:01 < SJr> I guess I'm going to try and seeing if I can openwrt to be a client
12:03 <@vpnHelper> RSS Update - forum: Windows 2003 - Server cannot ping client. <http://forums.openvpn.net/topic8781.html#p15544>
12:08 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
12:09 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
12:43 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
12:44 -!- Cain [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
12:44 -!- Cain is now known as Guest65414
12:47 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
12:51 < SJr> Hmmmm
12:51 < SJr> I can set the openwrt router as a client 
12:52 < SJr> with those cert pairs, and it works
12:53 -!- Guest65414 [~Geek@2001:41d0:1:f38f::1337] has left #openvpn []
12:55 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:55 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
12:55 -!- cain [~Geek@unaffiliated/cain] has joined #openvpn
12:57 -!- cain is now known as Cain
13:03 < SJr> Sorry there was one error before the one I posted earlier
13:03 < SJr> VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=CA/ST=British_Columbia/L=Vancouver/O=SJrX_Networks/CN=openwrt/emailAddress=security@sjrx.net
13:03 < SJr> I'm not sure if that's relevant
13:10 < SJr> Got it!
13:10 < SJr> I think what was happening krzie is that I ran one outside of the daemon process with some stupid cert and it was backgrounded
13:10 < SJr> I just killed every process 
13:10 < SJr> and restrated and that's that
13:10 < SJr> yay
13:14 < krzie> nice
13:15 -!- yobanius [~omers@85.64.3.210.dynamic.barak-online.net] has joined #openvpn
13:15 < SJr> yes
13:16 < SJr> I wonder if I should regenerate the certs on client and server
13:16 < SJr> so that they aren't duplicated
13:17 -!- yobanius [~omers@85.64.3.210.dynamic.barak-online.net] has quit [Client Quit]
13:19 -!- yobanius [~omers@85.64.3.210.dynamic.barak-online.net] has joined #openvpn
13:20 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
13:20 < yobanius> hello guys
13:20 < krzie> hiho
13:29 -!- yobanius [~omers@85.64.3.210.dynamic.barak-online.net] has quit [Quit: Leaving]
14:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:01 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
14:01 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
14:01 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
14:08 <@vpnHelper> RSS Update - forum: Set up VPN server behind proxy server <http://forums.openvpn.net/topic8792.html#p15545>
14:14 <@vpnHelper> RSS Update - forum: openvpn pushed dns get lost by local dhcp <http://forums.openvpn.net/topic8813.html>
14:25 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
14:25 <@vpnHelper> RSS Update - forum: openvpn pushed dns get lost by local dhcp <http://forums.openvpn.net/topic8813.html#p15547>
14:26 < EugeneKay> LOUD NOISES
14:27 -!- michl [~mich@dslb-084-056-073-213.pools.arcor-ip.net] has joined #openvpn
14:38 -!- luneff [~yury@ip211-232.telenet.dn.ua] has quit [Read error: Connection reset by peer]
14:38 <@vpnHelper> RSS Update - forum: How to change only the openvpn ip for outgoing traffic <http://forums.openvpn.net/topic8814.html>
14:38 -!- luneff [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
14:44 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:54 -!- batrick_ [~batrick@batbytes.com] has quit [Ping timeout: 260 seconds]
14:55 -!- MarKsaitis [~MarKsaiti@85-189-201-83.tmbsystems.managedbroadband.co.uk] has joined #openvpn
14:59 -!- p3rror [~mezgani@41.140.180.89] has joined #openvpn
14:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.2]
14:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:03 -!- Netsplit *.net <-> *.split quits: jbb, tty234, pwrcycle, Denial, DexTerDDIT, ph1l, @mattock, luneff, EugeneKay, Rolybrau,  (+51 more, use /NETSPLIT to show all of them)
15:03 -!- Netsplit *.net <-> *.split quits: +oc80z, cali, Dougy, pranq, caemir, tjz, Cr4zi3, gladiatr, DarthGandalf, fremo,  (+5 more, use /NETSPLIT to show all of them)
15:03 -!- Netsplit *.net <-> *.split quits: TypoNe, troyt, zu, belZe, uuuppz, n2deep, ropetin, Meliorator, kloeri, quadDamage,  (+31 more, use /NETSPLIT to show all of them)
15:04 -!- Netsplit over, joins: quadDamage, @raidz, EvilJStoker, @cron2, uuuppz, dazo_afk, ScriptFanix, p3rror, MarKsaitis, luneff (+65 more)
15:04 -!- yell0 [yello@178.162.154.183] has joined #openvpn
15:04 -!- Netsplit over, joins: @mattock, R-66Y, asio_, gardar_, bragon, meepmeep, cali, gladiatr, Guest8738, jbb (+6 more)
15:04 -!- ServerMode/#openvpn [+oov dazo_afk mattock oc80z] by zelazny.freenode.net
15:04 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
15:04 -!- Netsplit over, joins: krzee, vpnHelper, inimino, naquad, rooth, sigius, fremo, APTX, dxtr, Olipro
15:04 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
15:04 -!- Netsplit over, joins: chantra, kenyon, DeathWolf, JPeterson, RichardBronosky, DarthGandalf, hyper_ch, decoder, amir, havoc (+3 more)
15:04 -!- ServerMode/#openvpn [+o vpnHelper] by zelazny.freenode.net
15:15 -!- Netsplit *.net <-> *.split quits: zu, Optic, somefatkid, nickzxcv, fbh, ScriptFanix, sno-_, CybDev, krphop, mape2k,  (+17 more, use /NETSPLIT to show all of them)
15:15 -!- sno- [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
15:15 -!- Netsplit over, joins: belZe, mape2k
15:15 -!- somefatkid [~administr@rrcs-24-213-178-60.nyc.biz.rr.com] has joined #openvpn
15:15 -!- Netsplit over, joins: Bushmills, ScriptFanix, zu
15:16 -!- Netsplit over, joins: Mowee, fbh
15:16 -!- nickzxcv [foobar@216.218.223.115] has joined #openvpn
15:16 -!- bigon [bigon@2001:41d0:1:ee63::dead:beef] has joined #openvpn
15:16 -!- bigon [bigon@2001:41d0:1:ee63::dead:beef] has quit [Changing host]
15:16 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
15:16 -!- Netsplit over, joins: Optic, Champi, |Mike|, Tick-Tock
15:16 -!- Netsplit over, joins: diytto, CybDev, Cr4zi3
15:16 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
15:16 -!- Netsplit over, joins: Jikan
15:17 -!- Netsplit over, joins: TypoNe
15:18 -!- Netsplit *.net <-> *.split quits: SJr, quadDamage, sia^pwnnt, sobersabre
15:19 -!- Netsplit over, joins: _zero_, cherwin
15:19 -!- Netsplit *.net <-> *.split quits: kloeri, uuuppz, Dougy, @cron2, zoidberg-, mete, Meliorator, reiffert, n2deep, EvilGuru,  (+4 more, use /NETSPLIT to show all of them)
15:19 -!- nb [~nb@fedora/nb] has joined #openvpn
15:19 -!- Netsplit over, joins: Dougy, trumee, kloeri
15:19 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-ltabfizimbfmmryj] has joined #openvpn
15:19 -!- Netsplit over, joins: ropetin, agagag, quadDamage, n2deep
15:19 -!- EvilGuru [~freddie@helium3.witherden.org] has joined #openvpn
15:19 -!- EvilGuru [~freddie@helium3.witherden.org] has quit [Changing host]
15:19 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has joined #openvpn
15:19 -!- cron2 [~gert@193.149.48.167] has joined #openvpn
15:19 -!- Netsplit over, joins: qbasicer
15:19 -!- dazo_afk [dazo@nat/redhat/x-howkrjcrxlhyihoo] has joined #openvpn
15:19 -!- dazo_afk [dazo@nat/redhat/x-howkrjcrxlhyihoo] has quit [Changing host]
15:19 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
15:19 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
15:19 -!- sia^pwnnt [115kluu@212.224.67.26] has joined #openvpn
15:19 -!- reiffert [~thomas@178.63.49.86] has joined #openvpn
15:19 -!- dropje [~yge@77.166.39.78] has joined #openvpn
15:20 -!- sobersabre [~bilbo@85.64.9.157] has joined #openvpn
15:20 -!- Netsplit over, joins: mete, uuuppz
15:20 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
15:20 -!- Netsplit over, joins: SJr
15:21 -!- nb [~nb@fedora/nb] has quit [Excess Flood]
15:21 -!- michl [~mich@dslb-084-056-073-213.pools.arcor-ip.net] has quit [Quit: Verlassend]
15:21 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
15:23 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
15:24 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
15:29 -!- nb [~nb@fedora/nb] has joined #openvpn
15:31 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
15:33 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
15:43 -!- batrick_ [~batrick@nmap/developer/batrick] has joined #openvpn
15:50 -!- MarKsaitis [~MarKsaiti@85-189-201-83.tmbsystems.managedbroadband.co.uk] has quit [Read error: Connection reset by peer]
15:53 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
16:01 -!- caemir [~caemir@unaffiliated/caemir] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:03 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 252 seconds]
16:03 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
16:04 -!- Ionic [ionic@ionic.de] has joined #openvpn
16:05 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:07 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
16:16 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
16:19 -!- Grleaf [~Grleaf@cpe-72-224-74-122.maine.res.rr.com] has joined #openvpn
16:39 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Ping timeout: 258 seconds]
16:39 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
16:42 <@vpnHelper> RSS Update - forum: How to change only the openvpn ip for outgoing traffic <http://forums.openvpn.net/topic8814.html#p15549>
16:50 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Quit: brb]
16:50 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
16:51 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:53 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
16:55 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
16:58 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Ping timeout: 258 seconds]
17:00 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
17:02 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Operation timed out]
17:02 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
17:08 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
17:08 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
17:09 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
17:13 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
17:13 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
17:14 -!- Dougy [me@tech.qsi.net] has quit [Read error: Connection reset by peer]
17:14 -!- Dougy [me@tech.qsi.net] has joined #openvpn
17:16 -!- SJr [~sjr@206.12.54.24] has joined #openvpn
17:16 < SJr> Hmmmm sorry what is the syntax for pushing routes?
17:16 < SJr> oh nevermind I'm a moron
17:19 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
17:19 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
17:19 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Quit: leaving]
17:27 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
17:27 -!- mirco [~mirco@p5B281FEC.dip.t-dialin.net] has joined #openvpn
17:29 < SJr> Is there a way to make sure that a certain VPN gets a certain device?
17:29 < SJr> i.e. tun0
17:31 < Cr4zi3> define it ? If I remember correctly, u can define the device in conf
17:32 < SJr> how?
17:32 < SJr> sorry I misread
17:32 < SJr> lemme check
17:32 < SJr> sorry that's easy
17:32 < Cr4zi3> ;)
17:33 < Cr4zi3> Its ALWAYS the easy stuff that bites u in the ass.. ;P
17:34 -!- luneff [~yury@ip211-232.telenet.dn.ua] has quit [Read error: Connection reset by peer]
17:34 < SJr> here we go
17:34 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Connection reset by peer]
17:34 -!- luneff [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
17:35 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
17:36 < Cr4zi3> work ?
17:36 < SJr> actually I'm trying to figure something else out at the moment 
17:36 < Cr4zi3> k
17:36 < SJr> I just hard coded another config file
17:36 < SJr> but I assume it will
17:37 -!- EugeneK [eugenekay@itvends.com] has joined #openvpn
17:37 -!- EugeneKay [eugenekay@itvends.com] has quit [Read error: Connection reset by peer]
17:37 -!- EugeneK is now known as EugeneKay
17:37 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has quit [Read error: Connection reset by peer]
17:37 -!- EvilGuru [~freddie@helium3.witherden.org] has joined #openvpn
17:37 -!- EvilGuru [~freddie@helium3.witherden.org] has quit [Changing host]
17:37 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has joined #openvpn
17:43 -!- nich0s [~nich0s@ip174-71-40-133.om.om.cox.net] has joined #openvpn
17:46 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
17:49 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
17:50 -!- EugeneKay [eugenekay@itvends.com] has quit [Read error: Connection reset by peer]
17:50 -!- EugeneKay [eugenekay@itvends.com] has joined #openvpn
17:52 -!- p3rror [~mezgani@41.140.180.89] has quit [Remote host closed the connection]
17:56 -!- nich0s [~nich0s@ip174-71-40-133.om.om.cox.net] has left #openvpn []
17:59 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Connection reset by peer]
18:01 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
18:01 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:04 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Connection reset by peer]
18:05 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
18:08 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
18:14 -!- mirco [~mirco@p5B281FEC.dip.t-dialin.net] has quit [Quit: mirco]
18:30 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
18:30 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
18:39 -!- batrick_ is now known as batrick
18:52 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
19:08 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
19:18 -!- UnterPerro [~UnterPerr@32.134.14.117] has joined #openvpn
19:26 -!- SJr is now known as SJr3
19:26 -!- SJrX is now known as SJr
19:37 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Quit: Yippee-kay-yay]
19:37 -!- SJr3 [~sjr@206.12.54.24] has quit [Quit: Leaving]
19:39 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:39 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
19:39 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:39 -!- mode/#openvpn [+v Axeman] by ChanServ
19:40 -!- sadurag99 [~sadurag99@dyn-129-78-250-72.wirelessguest.usyd.edu.au] has joined #openvpn
19:40 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
19:48 -!- EugeneKay is now known as EugeneKaway
20:02 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Ping timeout: 258 seconds]
20:02 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
20:10 -!- Denial [~Denial@drgi.co.uk] has quit []
20:21 -!- raidz1 [~Administr@aim.505.ru] has joined #openvpn
20:23 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 260 seconds]
20:26 -!- sadurag99 [~sadurag99@dyn-129-78-250-72.wirelessguest.usyd.edu.au] has quit [Ping timeout: 240 seconds]
20:34 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
20:41 -!- sadurag99 [~sadurag99@dyn-129-78-250-72.wirelessguest.usyd.edu.au] has joined #openvpn
20:45 < krzee> Dougy, you ship that server?
20:45 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has left #openvpn ["Leaving"]
20:45  * ecrist unblocks krzee's IP from his firewall
20:49 <@vpnHelper> RSS Update - forum: How to change only the openvpn ip for outgoing traffic <http://forums.openvpn.net/topic8814.html#p15550>
20:50 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:50 < krzee> ehh?
20:50 < krzee> why would my ip be blocked in your firewall?
20:51 < ecrist> because I was watching logs, adding users to my 'shit-head' macro in pf
20:51 < ecrist> you got clobbered in my zeal. :)
20:51 < krzee> LOL
20:51 < ecrist> You've already been unclobbered
20:51 < krzee> from that ping i left running?
20:52 < ecrist> naw, webmail
20:52 < ecrist> but of odd ereg() calls
20:52 < krzee> was testing jitter/packet loss cross-country
20:52 < krzee> oh, lol
20:52 < ecrist> squirrelmail uses some deprecated functions
20:52 < krzee> oh and dude, your place has seriously low jitter
20:52 < ecrist> :D
20:52 < krzee> its actually a sweet place for voip
20:52 < ecrist> i use voip here a lot
20:53 < ecrist> it helps my company voip server has an address on comcat
20:53 < ecrist> comcast* too
20:53 < ecrist> I never have to leave comcast from my voip phone at home to our voip server at work.
20:53 < krzee> but doesnt even matter
20:53 < ecrist> it's dual-homed
20:53 < krzee> youd have great voip with my server in san diego
20:53 < ecrist> so, it has a 'real' connection too
20:55 < ecrist> 10 packets transmitted, 10 packets received, 0.0% packet loss
20:55 < ecrist> round-trip min/avg/max/stddev = 16.991/21.368/28.010/3.427 ms
20:55 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15551>
20:55 < ecrist> that's through our openvpn tunnel, too
20:56 < krzee> your stddev was higher than you to san diego
20:56 < krzee> i have 0.650ms
20:56 < krzee> (over 10 pings)
20:56 < ecrist> going off-comcast to our 'real' connection at the dc more than doubles latency
20:56 < ecrist> 10 packets transmitted, 10 packets received, 0.0% packet loss
20:56 < ecrist> round-trip min/avg/max/stddev = 46.979/50.394/56.575/3.164 ms
20:56 < krzee> latency isnt a big deal tho
20:57 < krzee> packet loss and jitter are
20:57 < ecrist> heh, I'm ok with 3ms of jitter
20:57 < krzee> totally!
20:57 < krzee> just commenting on how nice the connection is
20:57 < ecrist> honestly, I've been super happy with my comcast business connection
20:57 < krzee> from you to southern cali is a long distance
20:58 < krzee> 0.650ms jitter over that distance is greatness
20:58 < ecrist> ~1900 miles, give or take
20:58 < krzee> i expected something more like 5ms
20:58 < ecrist> send me the ip in /query, pls
20:59 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
20:59 < ecrist> gah, my off-network ping goes all the way to denver and back.
20:59 < ecrist> :(
21:00 < ecrist> hrm, I get far more than .650ms
21:00 < ecrist> 10 packets transmitted, 10 packets received, 0.0% packet loss
21:00 < ecrist> round-trip min/avg/max/stddev = 73.123/91.314/172.958/31.801 ms
21:01 < ecrist> hrm, it seems a lot of that is added by my wireless router
21:01 < ecrist> if I go to a 'real' box, I get far better
21:01 < krzee> round-trip min/avg/max/stddev = 71.631/72.606/73.568/0.650 ms
21:01 < krzee> [krzee@butters ~]$ 
21:02 < ecrist> 10 packets transmitted, 10 packets received, 0.0% packet loss
21:02 < ecrist> round-trip min/avg/max/stddev = 71.455/72.597/75.011/1.017 ms
21:02 < ecrist> nice, krzee 
21:02 < krzee> yes, very nice
21:02 < krzee> hard to remember thats a house sometimes
21:03 < ecrist> heh, in my basement. :)
21:03 < krzee> right next to the sex-slave devices?
21:03 < ecrist> heh, my rack doubles as a kennel for my gimp
21:03 < krzee> haha
21:04 < ecrist> the servers keep her warm.
21:04 < krzee> i was about to say the security on thaty colo is a gimp tied to the rack
21:04 < krzee> you beat me to it, lol
21:04 < ecrist> kinda like a trunk monkey
21:04 < ecrist> rack gimp
21:04 < ecrist> !google trunk monkey
21:04 <@vpnHelper> Trunk Monkey Compilation - YouTube: <http://www.youtube.com/watch?v=8avOiTUcD4Y>; Trunk Monkey Compilation - YouTube: <http://www.youtube.com/watch?v=RCUBxgdKZ_Y>; Trunkmonkey video collection by Suburban Auto Group in Sandy ...: <http://www.trunkmonkeyad.com/>
21:04 < ecrist> :)
21:04  * ecrist poofs
21:05 < ecrist> gotta spend time with the gimp^H^H^H^Hwife
21:05 < krzee> lol
21:09 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:30 < jeev> lol!
21:30 < jeev> that is funny
22:18 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15552>
22:33 -!- albech [~albech@61.7.176.132] has joined #openvpn
22:58 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
22:59 -!- Ionic [ionic@ionic.de] has joined #openvpn
23:37 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 252 seconds]
23:37 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
23:37 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
23:37 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
23:37 -!- mode/#openvpn [+v novaflash] by ChanServ
--- Day changed Thu Sep 15 2011
00:03 -!- krackpot [~krackpot@S0106000c42a9996c.vc.shawcable.net] has left #openvpn ["Leaving"]
00:16 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 258 seconds]
00:20 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
00:23 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Ping timeout: 240 seconds]
00:23 -!- _DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
00:26 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
00:26 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
00:26 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
00:28 -!- mirco [~mirco@p5B281FEC.dip.t-dialin.net] has joined #openvpn
00:29 -!- mirco [~mirco@p5B281FEC.dip.t-dialin.net] has quit [Client Quit]
00:41 -!- UnterPerro [~UnterPerr@32.134.14.117] has quit [Quit: UnterPerro lives to save another day]
00:59 -!- sadurag99 [~sadurag99@dyn-129-78-250-72.wirelessguest.usyd.edu.au] has quit [Ping timeout: 252 seconds]
01:22 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Ping timeout: 276 seconds]
01:41 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
01:47 <@vpnHelper> RSS Update - forum: Admin web UI accessible, client web UI not if firewalled <http://forums.openvpn.net/topic8808.html#p15553>
02:05 <@vpnHelper> RSS Update - forum: Gorkhaan's Setup ( Wordpress + OpenVPN fun ) <http://forums.openvpn.net/topic3158.html#p15554>
02:11 <@vpnHelper> RSS Update - forum: openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p15555>
02:11 < Mowee> Morning
02:11 -!- dazo_afk is now known as dazo
02:17 <@vpnHelper> RSS Update - forum: openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p15557> || openvpn pushed dns get lost by local dhcp <http://forums.openvpn.net/topic8813.html#p15556>
02:22 < omry> what kind of bandwidth can I expect from an openvpn server, in other words, at what network speed will openvpn typically start to slow things down?
02:22 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15558>
02:27 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 258 seconds]
02:33 < omry> direct communication between my servers yield 70MB/sec, via the OpenVPN tunel I only get 10MB/sec or so
02:34 < omry> cpu utilization at the server for openvpn is only 35% at the time. 
02:39 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
02:40 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
02:57 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15560>
03:03 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15561>
03:09 <@vpnHelper> RSS Update - forum: Odd, new error: Connection refused (WSAECONNREFUSED) <http://forums.openvpn.net/topic7846.html#p15563> || One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15562>
03:15 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15565> || openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p15564>
03:18 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:20 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
03:27 <@vpnHelper> RSS Update - forum: How to change only the openvpn ip for outgoing traffic <http://forums.openvpn.net/topic8814.html#p15567> || One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15566>
03:27 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:31 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
03:32 -!- Denial [Denial@drgi.co.uk] has quit []
03:34 -!- bitterman [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
03:34 -!- luneff [~yury@ip211-232.telenet.dn.ua] has quit [Read error: Connection reset by peer]
03:39 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15569> || openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p15568>
03:45 <@vpnHelper> RSS Update - forum: How to change only the openvpn ip for outgoing traffic <http://forums.openvpn.net/topic8814.html#p15570>
03:45 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:51 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:53 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
03:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
03:59 < omry> I have two subnets behind my server. client can gets pongs from machines behind each subnet. also - machines can ping client. however - when I open a tcp connection to a client, the connection opens but gets closed as soon as I try to send something
04:00 < omry> I am seeing this from any tcp server (ssh, apache etc) - so this is not an issue with the server closing as far as I can tell.
04:00 < omry> I did not see anything strange in the openvpn server logs though.
04:01 < omry> oh - one interesting thing: I see this behavior with only one of the two subnets
04:02 < omry> for the record : everything is on amazon ec2. the two subnets are inside a VPC (Virtual private cloud). the "public subnet" works and the "private subnet" does not.
04:02 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809.html#p15571>
04:08 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:08 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:08 <@vpnHelper> RSS Update - forum: openvpn, windows client -> linux server no connection <http://forums.openvpn.net/topic8811.html#p15572>
04:14 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:14 <@vpnHelper> RSS Update - forum: TCP Disconnects immediately via VPN <http://forums.openvpn.net/topic8815.html> || One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809-15.html#p15574> || OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-30.html#p15573>
04:27 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809-15.html#p15576>
04:31 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has quit [Excess Flood]
04:31 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
04:33 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Remote host closed the connection]
04:34 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
04:35 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:41 -!- bitterman [~yury@ip211-232.telenet.dn.ua] has quit [Ping timeout: 260 seconds]
04:43 -!- twister004 [~chatzilla@59.90.104.109] has joined #openvpn
04:45 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809-15.html#p15578>
04:51 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809-15.html#p15579>
04:57 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809-15.html#p15580>
05:00 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
05:03 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
05:09 <@vpnHelper> RSS Update - forum: One OpenVPN instance, multiple IP's <http://forums.openvpn.net/topic8809-15.html#p15581>
05:17 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
05:23 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
05:30 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:30 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:30 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:31 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
05:32 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
05:32 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
05:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:34 -!- darkdrgn2k [~darkdrgn2@bas2-toronto44-1242515008.dsl.bell.ca] has quit [Ping timeout: 258 seconds]
05:45 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
05:45 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
05:48 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 276 seconds]
05:50 -!- Ionic [ionic@ionic.de] has joined #openvpn
05:50 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
05:53 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
06:12 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 252 seconds]
06:44 <@vpnHelper> RSS Update - forum: Backup for many databases ??? <http://forums.openvpn.net/topic8816.html>
06:46 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
06:48 -!- EugeneKaway is now known as EugeneKay
06:54 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:56 <@vpnHelper> RSS Update - forum: Does VPN know if im using remote login? **Please Help** <http://forums.openvpn.net/topic8817.html>
06:57 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:59 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
07:00 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:05 < omry> anyone awake?
07:08 -!- Natanaiel [~Unknown@unaffiliated/natanaiel] has joined #openvpn
07:08 < EugeneKay> Nope.
07:09 < Natanaiel> does dns traffic route over vpn by default or we should set it in config files?
07:10 < EugeneKay> No. You need to set a route for it to do so. 
07:10 < EugeneKay> !def1
07:10 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
07:12 < omry> EugeneKay, great, I`ve been waiting for some time for someone to answer some question while sleeping..
07:12 < omry> http://forums.openvpn.net/topic8815.html
07:12 <@vpnHelper> Title: OpenVPN Support Forum TCP Disconnects immediately via VPN : Server Administration (at forums.openvpn.net)
07:13 < EugeneKay> Looks like a textbook firewall issue.
07:14 < omry> what firewall? on one of the servers?
07:14 < omry> (client/endpoint) ?
07:14 < omry> iptables shows no rules for any of the involved machines.
07:16 < EugeneKay> Next guess is that the routing is screwy, but then you wouldn' even get a TCP connection established.
07:17 < EugeneKay> Server configs might yield something useful.
07:17 < omry> tcp dumps of this hello message on both ends will help?
07:17 < omry> got them ready
07:17 < EugeneKay> Not really. :-p
07:18 < EugeneKay> Routing table on he vpn server and from one of the remote lans?
07:22 < omry> http://pastebin.com/CasQiaSD
07:22 < omry> routing tables and server and client confgs
07:22 -!- zux [~zux@195.13.186.54] has quit [Remote host closed the connection]
07:22 -!- luneff [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
07:26 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-45.html#p15584>
07:28 < omry> EugeneKay, ^
07:28 < EugeneKay> There's a netmask mismatch
07:28 < Natanaiel> so if I change my default gateway my dsn requests would sent throgh vpn?
07:28 < EugeneKay> The server has a route to 10.0.0.0/24(a poor block choice, if I may add) via eth0, and the client is routing 10.0.0.0/16 via the VPN.
07:29 < EugeneKay> Natanaiel - if you change the dns servers, yes.
07:29 < EugeneKay> See push dhcp-option
07:30 < omry> EugeneKay, you are referring to a line in the server routing table?
07:30 < EugeneKay> Also, the server is using a 10.0.0.0/24 block as it's gateway.... this looks to me like it doesn't have an external IP directly? 
07:30 < EugeneKay> Yes. Line 2 on the server
07:31 < EugeneKay> Also, need a peek at a server's lan's box route table.
07:32 < Natanaiel> EugeneKay: why should I change the dns servers? it doesn't matter which dns server I use. I only want to send my dns traffics throgh vpn
07:32 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-45.html#p15585>
07:32 < omry> EugeneKay, 10.0.0.0/24  is 10.0.0.*, right?
07:32 < EugeneKay> omry - yes
07:33 < EugeneKay> Natanaiel - because if there's a route to the primary dns servers that's "shorter" than the def1 gateway, it will go there.
07:33 < omry> EugeneKay, thats a line I think I`m getting from dhcp
07:34 < omry> its causing the probem in your opinion?
07:34 < EugeneKay> No, the fact that you're routing a different subnet size on the client versus what is going on in the server's lan is the problem.
07:35 < omry> I have two subnets behind the server
07:35 < omry> 10.0.0.0/24 and 10.1.0.0/24
07:35 < omry> initially I had two route statements at the client conf
07:35 < omry> I changed them to one 15 minutes ago, thinking ti may be related
07:35 < EugeneKay> -_-
07:36 < omry> added the router routing table : http://pastebin.com/tnBsne0n
07:38 <@vpnHelper> RSS Update - forum: Backup for many databases ??? <http://forums.openvpn.net/topic8816.html#p15586>
07:39 -!- cron2 [~gert@193.149.48.167] has quit [Changing host]
07:39 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
07:43 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Organize your IRC]
07:43 < EugeneKay> So.... the openvpn server is not the same as the lan router.
07:43 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15589> || openvpn, windows client -> linux server no connection <http://forums.openvpn.net/topic8811.html#p15588> || openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p15587>
07:43 < EugeneKay> I'm going to throw up my hands in defeat at your networking setup and claim it to be a routing issue :-p
07:43 < omry> EugeneKay, its not, that is correct.
07:44 < omry> I do not disagree with you here
07:44 < omry> but before you throw up your hands
07:44 < omry> I think you nailed it, but I`m not sure how to fix it:
07:44 < EugeneKay> Get a whiteboard, draw your subnets. Write down what routes are needed where.
07:45 < omry> I think I`m missing a route for 10.0.1.0/24 on the server
07:45 < omry> but I`m not sure what the current 10.0.0.0/24 route means : 10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.100 
07:45 < omry> (ip route show format)
07:45 < omry> I don't see a via there
07:45 -!- SeriousSam_ [57e2a3ca@gateway/web/freenode/ip.87.226.163.202] has joined #openvpn
07:46 < omry> so what is it doing with packets destined at 10.0.0.0/24?
07:51 < SeriousSam_> Hi there! I have a OpenVPN on FreeBSD. Is there an opportunity to start several daemons with several config files at startup with minimal efforts (without manually written scrips)?
07:51 < SeriousSam_> I see that I can specify only one config file in rc.conf 
07:53 < SeriousSam_> There is script in rc.d directory. But it possibly can read only one config file. How can I do several OpenVPN sessions on boot?
07:53 < EugeneKay> Modify the script or copy-paste it a bunch.
07:54 < SeriousSam_> Which is in rc.d?
07:54 < EugeneKay> I suppose so - I'm not a fbsd user.
07:54 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
07:55 < SeriousSam_> Do you do so on Linux?
08:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
08:09 < omry> EugeneKay, figured it out.
08:09 < EugeneKay> The init scripts on linux run /etc/openvpn/*.conf, rather than forcing you to specify one in particular
08:09 < EugeneKay> omry - yay
08:09 < omry> the problem is that I didnt really understand that network. the router was not really a router - only a nat. I did have to add a route to the actual router (this amazon Virtual private cloud is confusing)
08:14 < SeriousSam_> EugeneKay: I just need to know how it was intended by developers... Yes on Linux it is done very handy. All what I need is to put my config file in folder. And that's all. But on FreeBSD it looks defferent
08:14  * EugeneKay pokes krzee 
08:14 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:14 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:14 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:14 -!- mode/#openvpn [+v Axeman] by ChanServ
08:15 < SeriousSam_> Is there OpenVPN developers chanel?
08:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:17 < ecrist> yes
08:17 < ecrist> most of the devs are here, though.
08:18 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:18 < ecrist> SeriousSam_: I'm am one of the FreeBSD port maintainers for openvpn, what's your question?
08:18 < SeriousSam_> Is there an opportunity to start several daemons with several config files at startup with minimal efforts (without manually written scrips)?
08:19 < SeriousSam_> Like in Windows or Linux
08:19 < ecrist> no, but it's been something I've been meaning to write.
08:19 < ecrist> you can do it now by copying /usr/local/etc/rc.d/openvpn to another name, and changing the rcvar within to something unique
08:20 < ecrist> it shouldn't be too difficult to setup something more dynamic, though.
08:20 < ecrist> I'd probably approach it similar to how static routes are handled within the rc system
08:21 < ecrist> i.e., in rc.conf, you'd have openvpn_configs="net1 net2 net3" and then the rc script would look for /usr/local/etc/openvpn/net1.conf, /usr/local/etc/openvpn/net2.conf etc
08:21 < ecrist> and start them
08:21 < ecrist> would that work for you?
08:23 < ecrist> I could probably write that pretty quick
08:27 < ecrist> SeriousSam_: looking, it seems the current rc script supports multiple instances
08:27 < ecrist> it's a bit hacky, imho
08:28 < ecrist> it involves symlinking the current script to openvpn_name and it looks for comparable variables
08:28 < ecrist> but, it's in-place and it works.
08:29 < ecrist> so, cd /usr/local/etc/rc.d/ && ln -s openvpn.sh openvpn_foo.sh
08:29 < ecrist> then, you need to have all the same rc vars in /etc/rc.conf, but with your added _foo
08:29 < ecrist> so, openvpn_foo_enable, openvpn_foo_flags, openvpn_foo_configfile, etc
08:29 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15590>
08:30 < ecrist> I'd rewrite it so the symlinking wasn't needed
08:32  * EugeneKay unpokes
08:42 <@vpnHelper> RSS Update - forum: Does VPN know if im using remote login? **Please Help** <http://forums.openvpn.net/topic8817.html#p15591>
08:46 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
08:47 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:49 < ecrist> the symlinking adds a way to do a soft restart per-openvpn tunnel, though.
08:53 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
08:53 <@vpnHelper> RSS Update - forum: openvpn pushed dns get lost by local dhcp <http://forums.openvpn.net/topic8813.html#p15592>
09:00 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15593>
09:03 -!- master_of_master [~master_of@p57B53315.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:05 -!- master_of_master [~master_of@p57B53D8D.dip.t-dialin.net] has joined #openvpn
09:17 -!- Natanaiel [~Unknown@unaffiliated/natanaiel] has quit [Quit: Leaving.]
09:18 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Read error: Connection reset by peer]
09:18 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:18 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
09:18 -!- mode/#openvpn [+v novaflash] by ChanServ
09:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
09:37 -!- Dougy [me@tech.qsi.net] has quit [Changing host]
09:37 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
09:54 -!- luckman212 [~irc@pool-74-108-1-53.nycmny.fios.verizon.net] has joined #openvpn
09:55 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
09:55 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
09:55 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
10:00 -!- straterra [~straterra@fuhell.com] has joined #openvpn
10:01 < straterra> Does the latest stable version of OpenVPN support IPv6 transit and/or pushing ipv6 ips/routed via ccd? If not, are these features in the trunk?
10:09 < krzee> no, no, yes, no
10:09 < krzee> in order
10:09 < krzee> lol
10:09 < krzee> !ipv6
10:09 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options) or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
10:10 < krzee> theres options from trunk
10:10 < krzee> !snapshots
10:10 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
10:15 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 258 seconds]
10:15 < EugeneKay> I hate Java.
10:16 < gladiatr> oh c'mon.  What's not to love about Java?  You have 5 minutes to generate a complete list... GO!
10:16 < EugeneKay> I just spent 30 minutes trying to get tomcat6 to work on Red Hat.
10:16 < EugeneKay> java itself is fine.... just the package mainainers are IDIOTS
10:17  * gladiatr gasps
10:17 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 260 seconds]
10:17 < EugeneKay> For whatever stupid reason, an outdated java 5 gcj package is required by one of the tomcat6 dependencies
10:17 < EugeneKay> This causes the java dependency to be filled by java5 instead of java6
10:18 < EugeneKay> This isn't noticable, because the tomca6 included webapps run happily under java5. But when you go to install a java6+ webapp, you're greeted with an obscure libgcj.c.10 error about invalid pathsepcs.
10:18 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:19 < EugeneKay> The solution is fairly simple: nuke everything java related, create+install a pair of dummy packages to fool the java5-gcj dependency, then install tomcat6 et al as normal.
10:19 < EugeneKay> But impossible to figure out from that error message -_-
10:20 < EugeneKay> And now, Subsonic works!
10:20 < EugeneKay> Yay!
10:23 < gladiatr> ass pain
10:23 < EugeneKay> Total.
10:23 < EugeneKay> But, a worthy way to waste my morning.
10:23 < EugeneKay> Now I need to secure it to listen only on localhost....
10:26 < EugeneKay> Fuck it I'll just iptables the thing
10:26 -!- Guest2958 [~nb@delta.nb.tc] has joined #openvpn
10:28 < straterra> openvpn snapshot, eh
10:34 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
10:41 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:44 -!- dazo is now known as dazo_afk
10:44 -!- luckman212 [~irc@pool-74-108-1-53.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
10:47 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Connection reset by peer]
10:47 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
10:51 -!- raidz1 [~Administr@aim.505.ru] has quit [Quit: Leaving.]
10:52 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:52 -!- mode/#openvpn [+o raidz] by ChanServ
10:55 < straterra> I'm getting a very..strange permission error accessing my crl.pem file
10:57 < Olipro> how so
10:58 < straterra> Gah..nevermind
11:09 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 260 seconds]
11:12 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
11:12 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
11:28 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
11:31 -!- Olipro_ is now known as Olipro
11:33 <@vpnHelper> RSS Update - forum: Does VPN know if im using remote login? **Please Help** <http://forums.openvpn.net/topic8817.html#p15594>
11:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:35 < EugeneKay> Olipro, how in the heck are you getting on IRC from the pokey? http://www.cnn.com/2011/BUSINESS/09/15/switzerland.bank.lost/index.html?hpt=hp_t1
11:35 <@vpnHelper> Title: Rogue trader costs UBS $2 billion - CNN.com (at www.cnn.com)
11:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
11:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:42 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
11:44 -!- Icars [~Icars@paper.solidodesign.com] has joined #openvpn
11:44 < Icars> Hello.. I have a really strange issue I could use some help with.
11:45 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
11:47 < gladiatr> I would suggest seeing your doctor and getting an order for the little, green pills.
11:47 < Icars> When two (and only two) of the clients connect, they can access any machine on the network by it's address, or by it's full name, but not it's machine name. Ie they can ping 192.168.1.39, and icars.ourname.lan but not icars. My home machine and my laptop do not have this problem, but two of my clients do.
11:47 < gladiatr> what OS?
11:48 < gladiatr> for the clients
11:48 < Icars> I've watched the log for the server, and it's pushing out the dhcp domain
11:48 < Icars> The server is linux and the clients in this case are windows (likely 7), but so are my laptop and my home machine
11:50 < Icars> This is a recent change, as far as I know everything was working correctly last week. 
11:50 < Icars> There have been no changes to the configuration, one new user added  last week.
11:51 < Icars> The only thing of note that happened around when this started is that we moved the server from one rack to another so it had abit of down time.  
11:56 -!- scampbell_ [~scampbell@mail.scampbell.net] has joined #openvpn
11:57 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Disconnected by services]
11:58 -!- scampbell_ [~scampbell@mail.scampbell.net] has quit [Remote host closed the connection]
11:58 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
12:01 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html>
12:01 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
12:07 < gladiatr> the only thing I can think of that would cause that is that the two systems that "work" have DNS search elements statically defined
12:10 -!- albech [~albech@61.7.176.132] has quit [Remote host closed the connection]
12:12 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
12:13 -!- neu3no [~neu3no@v50-23.vs4.regfish.de] has joined #openvpn
12:13 < neu3no> hy there
12:14 < neu3no> !welcome
12:14 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:15 < neu3no> !redirect
12:15 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
12:15 < neu3no> !dns
12:15 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
12:15 < neu3no> !pushdns
12:15 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
12:15 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
12:17 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
12:18 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:18 < neu3no> btw. nice idea, the bot ;)
12:18 < neu3no> i'll try this and ask latr
12:19 -!- Flecks is now known as Fleck
12:21 < Icars> I'll check that....  but i think it's more of two machines that are not working, I have about 20 keys out and about and 6-7 active users, with only two reporting problems.
12:28 < krzee> !pwauth
12:29 < krzee> !authpass
12:29 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
12:38 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Ping timeout: 260 seconds]
12:39 -!- dazo_afk is now known as dazo
12:56 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:01 -!- nameless` [~nameless`@lav35-1-82-236-136-20.fbx.proxad.net] has joined #openvpn
13:01 < nameless`> what is the port directive in openvpn configuration file ? is it lport or rport ?
13:02 < krzee> they both exist, and you likely just want --port
13:02 < krzee> =]
13:02 < krzee> like:  port 1194
13:02 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
13:03 < nameless`> which means ? 
13:03 < krzee> !man
13:03 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
13:03 < nameless`> is port refer to lport or rport ?
13:03 < krzee> port is port
13:03 < nameless`> local port or remote one ?
13:04 < krzee> did you read it in the manual yet!?
13:04 < nameless`> oh ok
13:05 < nameless`> it is to set both local port and remote port at the same time
13:20 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Ping timeout: 260 seconds]
13:32 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:37 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html>
13:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:58 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
14:04 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 260 seconds]
14:12 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
14:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:20 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
14:31 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
14:47 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
14:58 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:58 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:58 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:58 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:15 < krzee> !management
15:15 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
15:19 -!- dazo is now known as dazo_afk
15:20 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
15:20 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
15:20 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:20 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:25 -!- krzee [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
15:27 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
15:34 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
15:45 -!- krzie is now known as krzee
16:00 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
16:01 -!- progician [~soc@80.5.2.238] has joined #openvpn
16:02 < progician> i'm using ubuntu, and I'm not entirely clear about how to configure the client properly. I can't figoure out how can I set the authentication mode as an example
16:03 < EugeneKay> !ubuntu
16:03 <@vpnHelper> "ubuntu" is dont use network manager!
16:03 < progician> oh forgot to mention I am on cli
16:03 < progician> so no gnome solutions are good enough for me :)
16:04 < EugeneKay> Oh, well good.
16:05 < EugeneKay> The short version is that anything in /etc/openvpn/ ending in .conf gets launched by the openvpn service.
16:05 < EugeneKay> Consult the HOWTO's example client.conf for a jump-start on what it should look like
16:08 -!- progician [~soc@80.5.2.238] has quit [Ping timeout: 260 seconds]
16:13 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:14 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15597>
16:20 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15598> || how to change MTU size in OpenVPN Access Server <http://forums.openvpn.net/topic8783.html>
16:31 < dxtr> 4096 bit RSA key shoul be secure enough for a while, right?
16:31 < dxtr> Let's pretend I'm a terrorist
16:32 < Olipro> ...
16:32 < EugeneKay> 2048 is the highest that is generally-used. 4096 is what I have.
16:32 < dxtr> Aight
16:33 < EugeneKay> Verisign's roots are 2,048
16:33 < EugeneKay> (the ones I just checked, anyway)
16:33 < dxtr> Will it slow down encryption/decryption much? :)
16:33 < krzee> i wouldnt go above 4096 actually
16:33 < dxtr> (I've got a 10Mbps connection)
16:33 < dxtr> krzee: Why?
16:33 < krzee> im not sure its been tested much
16:33 < EugeneKay> On a modern CPU? No.
16:33 < krzee> sometimes piling it on too thick can weaken things
16:34 < dxtr> But 4096 should be okay
16:34 < dxtr> ?
16:34 < krzee> no idea if that would be the case here or not
16:34 < krzee> ya man
16:34 < dxtr> Sweet
16:34 < krzee> thats what most of us here use
16:34 < EugeneKay> 4,096 is what I've seen as the widely-supported max.
16:34 < krzee> afaik
16:34 < dxtr> Oh cool
16:34 < Olipro> a longer RSA key will not be weaker unless you weaken the primality testing
16:35 < Olipro> so "piling it on" will simply have the effect of you ending up waiting even longer for your key
16:35 < Olipro> and crypto operations taking longer due to the larger key size
16:35 < EugeneKay> The drawbacks are minimal.
16:36 < EugeneKay> The benefits aren't quite as minimal, so it's worth doing, IMO.
16:36 < dxtr> How large keys could one use before one will actually notice a performane hit with a modern CPU?
16:36 < Olipro> for usage or generation?
16:36 < dxtr> For usage
16:36 < EugeneKay> Over a 10mbit link? Meh.
16:37 < dxtr> EugeneKay: 10Mbps and 100Mbps. For science :)
16:37 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15599>
16:37 < EugeneKay> !gbe
16:37 < EugeneKay> !gigabit
16:37 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
16:37 < Olipro> to be honest, it's more likely that a computer implementing Shor's algorithm will be created before a conventional machine can brute force your RSA4096 key
16:38 < Olipro> at which point the size of your RSA key has just become largely irrelevant
16:38 < EugeneKay> Like I said, use 4096 if you can, 2048 if you can't, and forget about it.
16:38 < krzee> +1
16:39 < dxtr> Olipro: Yeah, I know, I'm just playing with the thought here :)
16:39 < dxtr> While I'm generating a DH file
16:52 -!- Guest2958 [~nb@delta.nb.tc] has quit [Changing host]
16:52 -!- Guest2958 [~nb@fedora/nb] has joined #openvpn
16:52 -!- Guest2958 [~nb@fedora/nb] has left #openvpn []
16:52 -!- nb [~nb@fedora/nb] has joined #openvpn
16:54 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15600>
17:05 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
17:06 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15601>
17:11 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 260 seconds]
17:18 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15602>
17:25 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:25 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:25 -!- mode/#openvpn [+v Axeman] by ChanServ
17:30 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15603>
17:47 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
17:47 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
17:50 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
17:55 < Dougy> hai guise
17:59 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:00 <@vpnHelper> RSS Update - forum: Subnets <http://forums.openvpn.net/topic8820.html>
18:03 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
18:11 -!- Icars [~Icars@paper.solidodesign.com] has quit [Quit: KVIrc 4.1.1 Equilibrium http://www.kvirc.net/]
18:14 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
18:22 -!- will [~nioboozma@dyn-129-78-250-170.wirelessguest.usyd.edu.au] has joined #openvpn
18:22 -!- will is now known as Guest34278
18:23 -!- Guest34278 [~nioboozma@dyn-129-78-250-170.wirelessguest.usyd.edu.au] has quit [Client Quit]
18:40 -!- Denial [Denial@drgi.co.uk] has quit []
18:42 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
18:52 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 260 seconds]
18:54 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
19:01 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15605>
19:15 -!- nioboozmar [~nioboozma@dyn-129-78-250-170.wirelessguest.usyd.edu.au] has joined #openvpn
19:18 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:18 -!- mode/#openvpn [+v Axeman2] by ChanServ
19:21 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
19:24 -!- Axeman3 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:24 -!- Axeman3 is now known as axeman
19:25 -!- axeman is now known as Guest19486
19:27 -!- Guest19486 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Client Quit]
19:28 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
19:49 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
19:50 -!- nb [~nb@fedora/nb] has quit [Quit: ZNC - http://znc.in]
19:50 -!- nb [~nb@fedora/nb] has joined #openvpn
19:51 -!- EugeneKay is now known as EugeneKaway
20:17 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Read error: Operation timed out]
20:22 < ecrist> Dougy: sup d00d?
20:41 -!- bsdboy [~bsdboy@unaffiliated/deesl] has joined #openvpn
20:46 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:47 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 260 seconds]
20:55 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
21:18 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 240 seconds]
21:18 -!- SeriousSam_ [57e2a3ca@gateway/web/freenode/ip.87.226.163.202] has quit [Ping timeout: 252 seconds]
21:24 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
21:28 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
21:34 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Ping timeout: 240 seconds]
21:42 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 244 seconds]
21:49 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
21:55 -!- bsdboy [~bsdboy@unaffiliated/deesl] has quit [Ping timeout: 260 seconds]
22:02 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Ping timeout: 244 seconds]
22:06 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
22:11 -!- will [~nioboozma@dyn-129-78-250-170.wirelessguest.usyd.edu.au] has joined #openvpn
22:11 -!- nioboozmar [~nioboozma@dyn-129-78-250-170.wirelessguest.usyd.edu.au] has quit [Read error: Connection reset by peer]
22:11 -!- will is now known as Guest31161
22:18 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has joined #openvpn
22:19 -!- twister004_ [~chatzilla@117.204.134.160] has joined #openvpn
22:22 -!- twister004 [~chatzilla@59.90.104.109] has quit [Ping timeout: 260 seconds]
22:22 -!- twister004_ is now known as twister004
22:27 -!- EugeneKaway is now known as EugeneSleep
22:40 -!- bsdboy [~bsdboy@unaffiliated/deesl] has joined #openvpn
22:48 -!- Shinigami-Sama [~pewpew@154.5.144.146] has joined #openvpn
22:48 -!- Shinigami-Sama [~pewpew@154.5.144.146] has quit [Changing host]
22:48 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
22:56 -!- twister004_ [~chatzilla@59.90.104.109] has joined #openvpn
22:57 -!- twister004 [~chatzilla@117.204.134.160] has quit [Ping timeout: 260 seconds]
22:57 -!- twister004_ is now known as twister004
23:10 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
23:28 -!- Guest31161 [~nioboozma@dyn-129-78-250-170.wirelessguest.usyd.edu.au] has quit [Quit: Linkinus - http://linkinus.com]
23:32 <@vpnHelper> RSS Update - forum: Subnets <http://forums.openvpn.net/topic8820.html#p15607> || Routing problem on multi-homed network <http://forums.openvpn.net/topic8821.html>
23:37 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
23:37 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15608>
23:44 <@vpnHelper> RSS Update - forum: How to call a script after a tunnel is fully established <http://forums.openvpn.net/topic8822.html> || Odd, new error: Connection refused (WSAECONNREFUSED) <http://forums.openvpn.net/topic7846.html#p15609>
23:54 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
--- Day changed Fri Sep 16 2011
00:14 <@vpnHelper> RSS Update - forum: How to call a script after a tunnel is fully established <http://forums.openvpn.net/topic8822.html#p15611>
00:34 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Ping timeout: 276 seconds]
00:44 -!- UnterPerro [~UnterPerr@32.131.88.138] has joined #openvpn
00:53 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has joined #openvpn
00:54 < Bushmills> Olipro: by that time we'll have QCs too, allowing us to use key sizes of 2^4096 bits
00:56 < DJHenjin> if i dont have a local domain setup for local computers do i need to push a DOMAIN still?
00:56 < Bushmills> no you don't
00:56 < DJHenjin> thank you,
00:58 < DJHenjin> now, i would like to use openVPN to provide VPN access to my LAN with a router that already exists handling DHCP, would i use dev- tun or tap?
01:12 < Bushmills> as the vpn address is in its own subnet anyway, dhcp doesn't need to be involved in assigning vpn addresses to vpn clients
01:12 < DJHenjin> so leave the server on 10.8.0.0 and push a route to 192.168.0.0 right?
01:13 < Bushmills> when routing to machines on a LAN behind a vpn client or server, you'd set up routes for the subnet they're in, no need to know the exact ip addresses. again, dhcp and openvpn are avoiding effect on each other
01:13 < Bushmills> !clientlan
01:13 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
01:13 <@vpnHelper> better explanation
01:14 < Bushmills> conclusion: tun will do just fine
01:14 < Bushmills> !tunortap
01:14 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
01:14 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
01:15 < DJHenjin> i dont want ip's behind the client visible, just the server.
01:15 < Bushmills> !serverlan
01:15 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation
01:15 < hyper_ch> good morning Bushmills
01:15 < Bushmills> hi hyper_ch
01:15 < DJHenjin> that clears alot up..
01:16 -!- bsdboy [~bsdboy@unaffiliated/deesl] has quit [Quit: Leaving...]
01:17 -!- bsdboy [~bsdboy@unaffiliated/deesl] has joined #openvpn
01:22 -!- qbasicer [~qbasicer@24-246-12-52.cable.teksavvy.com] has quit [Ping timeout: 258 seconds]
01:27 -!- bitterman [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
01:27 -!- luneff [~yury@ip211-232.telenet.dn.ua] has quit [Ping timeout: 260 seconds]
01:28 -!- dazo_afk is now known as dazo
01:30 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has left #openvpn []
01:32 -!- bitterman [~yury@ip211-232.telenet.dn.ua] has quit [Ping timeout: 260 seconds]
01:34 -!- qbasicer [~qbasicer@24-246-12-52.cable.teksavvy.com] has joined #openvpn
01:44 -!- bsdboy [~bsdboy@unaffiliated/deesl] has quit [Ping timeout: 252 seconds]
01:53 -!- UnterPerro [~UnterPerr@32.131.88.138] has quit [Quit: UnterPerro lives to save another day]
02:00 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:14 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:16 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:18 -!- twister004_ [~chatzilla@117.207.243.168] has joined #openvpn
02:18 -!- luneff [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
02:19 -!- twister004 [~chatzilla@59.90.104.109] has quit [Ping timeout: 260 seconds]
02:19 -!- twister004_ is now known as twister004
02:20 -!- luneff [~yury@ip211-232.telenet.dn.ua] has quit [Read error: Connection reset by peer]
02:22 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
02:24 -!- twister004_ [~chatzilla@59.90.104.109] has joined #openvpn
02:24 -!- twister004 [~chatzilla@117.207.243.168] has quit [Ping timeout: 260 seconds]
02:25 -!- twister004_ is now known as twister004
02:28 -!- luneff [~yury@ip211-232.telenet.dn.ua] has joined #openvpn
02:29 -!- bsdboy [~bsdboy@unaffiliated/deesl] has joined #openvpn
02:29 -!- bsdboy [~bsdboy@unaffiliated/deesl] has left #openvpn []
02:32 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has quit []
02:32 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has joined #openvpn
02:46 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:49 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
02:50 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15612>
02:56 <@vpnHelper> RSS Update - forum: How to call a script after a tunnel is fully established <http://forums.openvpn.net/topic8822.html#p15613>
03:01 -!- albech [~albech@183.88.64.149] has joined #openvpn
03:02 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15614>
03:05 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
03:07 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
03:15 <@vpnHelper> RSS Update - forum: Odd, new error: Connection refused (WSAECONNREFUSED) <http://forums.openvpn.net/topic7846.html#p15615>
03:17 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
03:21 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
03:23 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:23 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
03:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: Split Tunnel <http://forums.openvpn.net/topic8823.html>
03:52 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
04:07 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
04:10 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
04:24 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
04:24 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Quit: Bye]
04:29 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
04:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
04:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:42 < dxtr> There's no way I can let openvpn reload keys and stuff without killing it and starting it again, right?
04:53 < dazo> dxtr: that's correct
04:56 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:56 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:59 -!- _julian [~quassel@hmbg-4d068d4b.pool.mediaWays.net] has joined #openvpn
04:59 < dxtr> dazo: Aight.
05:03 < hyper_ch> kill openvpn? that is so cruel
05:04 < dxtr> Yeah I know
05:05 < dxtr> It will just be dead for a short while and then I'll do some CPR
05:09 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 260 seconds]
05:09 -!- narfarht [novaflash@178-84-117-247.dynamic.upc.nl] has joined #openvpn
05:10 -!- narfarht is now known as novaflash
05:10 -!- novaflash [novaflash@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
05:10 -!- novaflash [novaflash@openvpn/user/novaflash] has joined #openvpn
05:20 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
05:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
05:36 < dxtr> Is it possible to see how strong my keys are?
05:37 < dxtr> Oh yeah
05:37 < dxtr> It said it right there
05:37 < dxtr> Sweet
05:40 < dxtr> I am by no means an expert in the area, but isn't both AES and RSA crypto algos? Why am I using both when I'm using openvpn?
05:41 < dxtr> Or isn't both actually used?
05:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:50 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15617>
05:52 -!- Devedse [3eee3e3d@gateway/web/freenode/ip.62.238.62.61] has joined #openvpn
05:52 < hyper_ch> you can set what cipher to use
05:52 < hyper_ch> or use multiple ciphers
05:53 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
05:55 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 258 seconds]
06:02 -!- bauruine_ [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
06:06 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Read error: Connection reset by peer]
06:09 -!- twister004 [~chatzilla@59.90.104.109] has quit [Read error: Connection reset by peer]
06:10 -!- twister004 [~chatzilla@59.90.104.109] has joined #openvpn
06:12 -!- trish [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
06:15 -!- trish [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
06:15 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15619> || openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15618>
06:18 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
06:21 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15620>
06:27 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15621>
06:33 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15623> || Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15622>
06:39 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15624>
06:43 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
06:50 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
07:03 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15625>
07:15 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15627> || TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818.html#p15626>
07:21 -!- straterra [~straterra@fuhell.com] has left #openvpn []
07:23 -!- twister004 [~chatzilla@59.90.104.109] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
07:27 <@vpnHelper> RSS Update - forum: How to call a script after a tunnel is fully established <http://forums.openvpn.net/topic8822.html#p15629> || TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic8818-15.html#p15628>
07:29 -!- Devedse [3eee3e3d@gateway/web/freenode/ip.62.238.62.61] has quit [Quit: Page closed]
07:40 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15630>
07:40 -!- EugeneSleep is now known as EugeneKay
07:40 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:40 -!- mode/#openvpn [+v Axeman] by ChanServ
07:41 < EugeneKay> dxtr - RSA is an asymmetric algorithm used to guarantee the identity of each party and establish an initial secure channel, over which an AES(or other) symmetrical cipher for data transport is decided.
07:45 < EugeneKay> For more detail on the process, here are some Wikipedia articles on the subject: https://secure.wikimedia.org/wikipedia/en/wiki/Transport_Layer_Security#TLS_handshake_in_detail https://secure.wikimedia.org/wikipedia/en/wiki/Cipher_suite
07:45 <@vpnHelper> Title: Transport Layer Security - Wikipedia, the free encyclopedia (at secure.wikimedia.org)
07:57 -!- LnL [~LnL@d54C4D968.access.telenet.be] has joined #openvpn
08:04 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
08:04 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
08:06 -!- cocoa117 [~cocoa117@wk-28-232.guest.rdg.ac.uk] has joined #openvpn
08:10 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15631>
08:19 -!- fremo__ [~fremo@noc.toile-libre.net] has joined #openvpn
08:21 -!- fremo [~fremo@noc.toile-libre.net] has quit [Ping timeout: 260 seconds]
08:21 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15633> || Openvpn problem with Wifi and routing <http://forums.openvpn.net/topic8824.html>
08:23 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
08:37 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
08:37 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
08:37 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
08:38 -!- lazzer [~lazzer@vmlinux.org] has joined #openvpn
08:40 < lazzer> Hi! I am trying to force OpenVPN to use a certain tun interface (tun24 for example..), isnt it correct to use openvpn --dev tun24 for that?
08:40 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15635> || Management console only accessible by one user <http://forums.openvpn.net/topic8442.html#p15634>
08:41 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:44 -!- sobersabre [~bilbo@85.64.9.157] has quit [Ping timeout: 240 seconds]
08:44 -!- LnL [~LnL@d54C4D968.access.telenet.be] has quit [Remote host closed the connection]
08:45 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
08:45 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
08:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
08:49 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
08:49 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
08:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
08:56 -!- bauruine_ [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
08:58 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has quit [Read error: Connection reset by peer]
08:58 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15636>
08:58 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
09:01 < hyper_ch> krzee: https://admin.fedoraproject.org/updates/F14/FEDORA-2011-12302
09:03 -!- master_of_master [~master_of@p57B53D8D.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:04 -!- cocoa117 [~cocoa117@wk-28-232.guest.rdg.ac.uk] has quit [Quit: Leaving]
09:05 -!- master_of_master [~master_of@p57B53650.dip.t-dialin.net] has joined #openvpn
09:12 -!- albech [~albech@183.88.64.149] has quit [Quit: Leaving]
09:21 -!- bassliner [armin@irc.arje.de] has quit [Ping timeout: 252 seconds]
09:22 -!- bassliner [armin@irc.arje.de] has joined #openvpn
09:34 < dxtr> EugeneKay: Oh that's awesome
09:34 < dxtr> Thank you :)
09:38 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:39 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 260 seconds]
09:39 -!- Blues-Man [~bluesman@host95-119-dynamic.46-79-r.retail.telecomitalia.it] has joined #openvpn
09:39 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
09:43 -!- Blues-Man [~bluesman@host95-119-dynamic.46-79-r.retail.telecomitalia.it] has quit [Client Quit]
09:51 -!- Denial- [Denial@drgi.co.uk] has joined #openvpn
09:51 -!- Denial [Denial@drgi.co.uk] has quit [Ping timeout: 252 seconds]
09:57 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Remote host closed the connection]
10:02 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
10:02 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
10:02 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
10:05 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Client Quit]
10:12 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15638> || openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p15637>
10:14 -!- dazo is now known as dazo_afk
10:15 -!- somefatkid is now known as TheRedOctober
10:37 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
10:44 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
10:49 -!- K1ng` [~k1ng@180.211.188.14] has joined #openvpn
10:49 -!- K1ng` [~k1ng@180.211.188.14] has quit [Changing host]
10:49 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:51 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
10:53 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
11:48 <@vpnHelper> RSS Update - forum: Verifying Re-Direct of Traffic in "Road Warrior" connection <http://forums.openvpn.net/topic8763.html#p15639>
12:04 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
12:04 -!- luneff [~yury@ip211-232.telenet.dn.ua] has quit [Quit: Leaving]
12:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
12:18 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:40 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
12:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
12:48 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
12:52 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
12:55 <@vpnHelper> RSS Update - forum: Is it possible to install OpenVPN server on Win 2008 Server? <http://forums.openvpn.net/topic8825.html>
13:01 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
13:02 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:02 -!- mode/#openvpn [+v Axeman] by ChanServ
13:09 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
13:14 -!- davemasselink [~davemasse@adsl-99-49-9-53.dsl.pltn13.sbcglobal.net] has joined #openvpn
13:18 < davemasselink> Hey all, I have a OpenVPN question which isn't all that technical, yet I can't find anyone else's documentation of it online... I'm running a OpenVPN tunnel over a cellular connection and have to pay for this connection per MB (yeah, that sucks but I can't do anything about that aspect right now). So my question is how I can configure the OVPN server (and maybe client) to absolutely limit the data usage just to maintain t
13:18 < davemasselink> tunnel.
13:19 < davemasselink> my first inclination is that raising the keepalive parameters from 10 and 60 to something like 60 and 300 would mean that the pings will be less frequent and data usage will go down... but I've seen just the opposite so far, greater keepalive parameters lead to using more data daily just to maintain the tunnel
13:20 < Bushmills> enable compression
13:20 < davemasselink> any other parameters I should play with... or this there a well known theoretical minimum limit to data usage for mantaining a tunnel... if I'm already there, I guess there is no point in trying to get it lower
13:21 < davemasselink> yeah, I think I've got lzo enabled
13:21 < davemasselink> and that will certainly help when I'm actively transferring something back and forth
13:21 < Bushmills> use udp, not tcp
13:21 < davemasselink> but the part I'm most interested in now is how to limit the data used when nothing is going back and forth... just the data used to keep the tunnel open
13:23 < davemasselink> just double checked... and the server.conf file has that already selected as well
13:24 < davemasselink> thanks for the thoughts though, bushmills... i hate that i'm worrying about a few MB here or there in 2011 :(
13:25 < Bushmills> optimize your MTU
13:25 < davemasselink> i saw some articles about how one could optimize throughput speeds by raising the ovpn MTU... is that what you mean?
13:25 < CybDev> do you actually _have_ to enable ping at all? you could possibly just drop it alltogether, iirc openvpn disconnects your "old" session when a new one connects anyway?
13:26 < Bushmills> davemasselink: largest MTU which wouldn't cause fragmentation would be right
13:27 < davemasselink> i don't know, good question... so you're saying that if I disable the keep-alive pings that the tunnel will still be established (and re-established whenever the route changes)?
13:27 < CybDev> also, the ping packets should not be giving you several megabytes of traffic a day
13:27 < Bushmills> no, not quite. too small an MTU would result in more udp headers than with a larger MTU
13:28 < davemasselink> yeah, i was surprised by that too, i figured the pings must be pretty small (a few bytes each??)
13:28 < CybDev> remember they are encapsulated
13:28 < CybDev> surely there is a minimum packet size
13:29 < CybDev> or it'd be vulnerable to statistical analysis much like sniffing those google autopredict things over ssl
13:29 < davemasselink> but I did some testing where I changed nothing in my setup except to RAISE the keepalive values and suddenly my daily traffic jumped from 1.8MB to something more like 3-4MB
13:29 < CybDev> you sure it wasnt something else that "jumped" the traffic?
13:30 < davemasselink> no, certainly can't be sure... but i did replicate the test a few more times
13:30 < davemasselink> with the same results
13:30 < CybDev> iirc those "ping" packets are not full icmp pings either, they are some openvpn variety that shouldnt have that much overhead to begin with
13:30 < davemasselink> keepalive 10 60 (the default) and I end up using about 1.8MB per day
13:30 < davemasselink> keepalive 60 300 and I end up using 3-4MB
13:30 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:31 < davemasselink> yeah, everything you guys are saying makes sense
13:31 < Bushmills> one ping per minute - two way - corresponds with about 200 kB of daily traffic
13:31 < Bushmills> that assumes a 64 byte packet size
13:31 < davemasselink> is there any other traffic that goes back and forth regularly, othe rthan the pings?
13:32 < CybDev> depends on your tunnel type
13:32 < Bushmills> key renewal
13:32 < davemasselink> just for maintainance purposes, that is
13:32 < CybDev> layer2 tunnels will also have broadcast traffic etc
13:33 < CybDev> and for a cellphone, i suppose packetloss might be a factor
13:33 < CybDev> as in retransmission, again depending on your config
13:33 < Bushmills> afaik, blowfish key renewal is relatively slow. whether that's a result of higher data volumes transferred, i can't say. but that's probably not taking place more frequently than once an hour
13:33 < davemasselink> hmmm... I hadn't even though about broadcast traffic... does that mean that in some configurations a client's messages to the server might get re-broadcast to all other clients?
13:34 < CybDev> if you are using layer2 yes
13:34 < CybDev> (ethernet bridging with tap devices)
13:34 < CybDev> !layer2
13:34 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
13:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:35 < davemasselink> i'm using dev tun
13:36 < CybDev> i dont think what data cipher you use will affect keyrenewal much tho
13:36 < davemasselink> ok, so key renewal likely happens quite infrequently and likely wouldn't have that much overhead
13:36 < CybDev> it should be done via DH anyway afaik
13:37 < CybDev> and defaults to once every 3600 sec
13:37 < CybDev> i dont think openvpn looks at how much data is transferred by default
13:37 < CybDev> see manpage under "reneg"
13:38 < davemasselink> also, i've definitely seen a repeatable difference in "background" data usage when changing keepalive values... keepalive parameters are those that control the pinging frequency, right?
13:38 < CybDev> yeah
13:39 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:39 < CybDev> keepalive just expands to a few ping and ping-restart directives
13:39 < CybDev> when defined on the server settings are pushed to the client aswell
13:39 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:49 < CybDev> if the server isnt used for other clients, you could just set verbosity to 9 and look at whats going on
13:49 < CybDev> suggest using a separate logfile instead of syslog tho :P
13:54 < davemasselink> ok... that's probably a good place to start looking... through those server logs
13:55 < davemasselink> anything in particular I should watch for there... will it be pretty clear everytime it talks to a particular client and how much data was transferred?
14:00 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
14:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
14:12 < CybDev> no
14:12 < CybDev> at loglevel 9 you'll get info on each packet sent and received afaik
14:13 < CybDev> not really userfriendly, but you'll probably see any ping stuff, retransmissions, key renegs etc
14:14 < CybDev> but with traffic at max 4mb/24h you shouldnt have much problems :P
14:19 < davemasselink> ok, I'll start there
14:21 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
14:24 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Client Quit]
14:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
14:29 -!- davemasselink [~davemasse@adsl-99-49-9-53.dsl.pltn13.sbcglobal.net] has quit [Quit: davemasselink]
14:30 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Read error: Operation timed out]
14:32 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
15:19 < hyper_ch> krzee: online?
15:28 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
15:29 < stevefink> Is it possible to run OpenVPN on an EC2 instance (Amazon AWS) and then be able to hit servers on their Internal interfaces? I'm not using Amazon VPC.
15:32 -!- davemasselink [~davemasse@adsl-99-49-9-53.dsl.pltn13.sbcglobal.net] has joined #openvpn
15:54 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Ping timeout: 240 seconds]
16:03 < ecrist> if they provide/allow routing between the internal interface and the external, or allow you to route/bridge that within your host instance, perhaps
16:24 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
16:24 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
16:25 -!- Cain [~Geek@unaffiliated/cain] has left #openvpn []
16:27 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
16:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 260 seconds]
16:56 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
16:58 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
17:16 -!- sierradump [~zdadmin@209.119.38.226] has joined #openvpn
17:18 < sierradump> Right now, I have openVPN running in a server client scenario.  My remote clients tunnel in to access our private network.  I now have a need to have my remote users "browse the internet" out of our corporate IP address.  Is this possible?
17:25 -!- Grleaf [~Grleaf@cpe-72-224-74-122.maine.res.rr.com] has quit [Quit: Broken pipe) ( Switching To Bong]
17:50 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
17:50 -!- Denial- [Denial@drgi.co.uk] has quit [Ping timeout: 260 seconds]
17:51 -!- SeriousSam_ [kvirc@shpd-92-101-161-145.vologda.ru] has joined #openvpn
17:51 -!- SeriousSam_ [kvirc@shpd-92-101-161-145.vologda.ru] has left #openvpn ["Reality is that which, when you stop believing in it, doesn't go away"]
17:51 -!- sierradump [~zdadmin@209.119.38.226] has quit [Quit: sierradump]
17:51 -!- SeriousSam_ [kvirc@shpd-92-101-161-145.vologda.ru] has joined #openvpn
17:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:59 < SeriousSam_> Hi there! The situation is following. I have a server with public IP. And I have machine which has not direct an access output (through providers network with switches, routers etc). I try to connect to server. Connection is established, but I can not ping server (I mean new IP address in tunnel). What is wrong?
18:03 < Bushmills> the configuration
18:04 < Bushmills> !firewall
18:04 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
18:08 -!- sierradump [~zdadmin@209.119.38.226] has joined #openvpn
18:08 -!- sierradump [~zdadmin@209.119.38.226] has quit [Client Quit]
18:09 -!- SeriousSam_ [kvirc@shpd-92-101-161-145.vologda.ru] has quit [Read error: Connection reset by peer]
18:42 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
18:49 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
19:04 -!- _julian_ [~quassel@hmbg-4d06d060.pool.mediaWays.net] has joined #openvpn
19:08 -!- _julian [~quassel@hmbg-4d068d4b.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
19:10 -!- Denial [Denial@drgi.co.uk] has quit []
20:11 -!- davemasselink [~davemasse@adsl-99-49-9-53.dsl.pltn13.sbcglobal.net] has quit [Quit: davemasselink]
20:11 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
20:14 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
20:32 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has quit [Ping timeout: 260 seconds]
20:33 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
20:55 -!- zoidberg1 [zoidberg@gateway/shell/xzibition.com/x-sbjgeehukikarolw] has joined #openvpn
20:55 -!- stevefink_ [steve@shell.vaerchi.com] has joined #openvpn
20:56 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
20:57 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
20:59 -!- sno-_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
20:59 -!- lazzer_ [~lazzer@vmlinux.org] has joined #openvpn
20:59 -!- naquad_ [~naquad@174.142.224.219] has joined #openvpn
20:59 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
21:00 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
21:00 -!- tjz [~pc@bb119-74-163-4.singnet.com.sg] has joined #openvpn
21:00 -!- tjz [~pc@bb119-74-163-4.singnet.com.sg] has quit [Changing host]
21:00 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
21:00 -!- stevefink [steve@shell.vaerchi.com] has quit [Ping timeout: 260 seconds]
21:00 -!- lazzer [~lazzer@vmlinux.org] has quit [Ping timeout: 260 seconds]
21:00 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-ltabfizimbfmmryj] has quit [Ping timeout: 260 seconds]
21:00 -!- sno- [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 260 seconds]
21:00 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
21:00 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
21:00 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
21:00 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 260 seconds]
21:00 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:00 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
21:35 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
23:18 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has quit []
23:19 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has joined #openvpn
23:54 -!- hakie [~xie@183.25.128.217] has joined #openvpn
23:55 < EugeneKay> !factoids
23:55 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
23:59 -!- albech [~albech@183.88.64.187] has joined #openvpn
--- Day changed Sat Sep 17 2011
00:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
00:14 < EugeneKay> Is there a list of x509v3 extensions required by OpenVPN for the CA & client certs?
00:15 < EugeneKay> I'm poking about through easy-RSA,and it seems to be Digital Signature + Key Encipherment, Microsoft Server for the Server, and Digital Signature, Microsoft Client for the Client.
00:19 < EugeneKay> At least, that's what it spits out. I'm more interested in what OpenVPN needs.
00:21 -!- davemasselink [~davemasse@c-24-4-100-253.hsd1.ca.comcast.net] has joined #openvpn
00:49 -!- mape2k [~mape2k@p5B24F192.dip.t-dialin.net] has joined #openvpn
00:50 -!- davemasselink [~davemasse@c-24-4-100-253.hsd1.ca.comcast.net] has quit [Quit: davemasselink]
01:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
01:09 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:18 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
01:19 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Quit: Bye]
01:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
01:42 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15642>
01:44 -!- tzervo [~tzervo@109.129.130.29] has joined #openvpn
01:54 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
02:00 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:01 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
02:16 -!- tzervo [~tzervo@109.129.130.29] has left #openvpn ["WeeChat 0.3.5"]
02:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:31 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Quit: Bye]
02:36 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
02:47 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:59 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
03:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
03:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:11 -!- raidz1 [~Administr@aim.505.ru] has joined #openvpn
03:13 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
03:28 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
03:30 -!- Ionic [ionic@ionic.de] has joined #openvpn
03:47 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
03:57 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
03:59 -!- Ionic [ionic@ionic.de] has joined #openvpn
04:29 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:33 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
04:36 <@vpnHelper> RSS Update - forum: how to connect my server without user/pass box directly? <http://forums.openvpn.net/topic8827.html>
04:41 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
04:41 -!- hakie [~xie@183.25.128.217] has left #openvpn []
04:51 -!- SeriousSam_ [kvirc@shpd-95-53-230-50.vologda.ru] has joined #openvpn
04:54 -!- SeriousSam_ [kvirc@shpd-95-53-230-50.vologda.ru] has left #openvpn []
04:56 -!- SeriousSam_ [kvirc@shpd-95-53-230-50.vologda.ru] has joined #openvpn
04:57 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
04:59 < SeriousSam_> Hi there! I have the following situation. I have a srver with pubplic IP. I have a client machine with Internet access through provider network. I connect to server from client machine. Connection is establish correctly. But I can't ping server from client machine. What is wrong?
05:15 < SeriousSam_> Without tunnel I can ping server successfully
05:16 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
05:16 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
05:18 < Bushmills> what else do you want to access?
05:18 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:18 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:18 < Bushmills> ah. "can't" ...
05:18 < Bushmills> !firewall
05:18 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
05:19 < Bushmills> "what is wrong.."  -  you configuration
05:19 < Bushmills> your
05:21 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
05:21 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
05:27 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
05:34 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
05:34 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
05:49 <@vpnHelper> RSS Update - forum: newbie: be notified by email on client connect <http://forums.openvpn.net/topic8828.html>
05:53 < SeriousSam_> Bushmills: but connection was established successfully
05:55 < SeriousSam_> May be something in provider network blocks my traffic?
05:55 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
06:01 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:04 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
06:12 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
06:15 -!- SeriousSam_ [kvirc@shpd-95-53-230-50.vologda.ru] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.3 Shiny(svn-3438) http://www.kvirc.net]
06:18 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
06:20 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
06:28 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
06:31 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
06:31 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:34 -!- kloeri_ is now known as kloeri
06:35 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
06:36 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
06:36 <@vpnHelper> RSS Update - forum: newbie: be notified by email on client connect <http://forums.openvpn.net/topic8828.html#p15645>
06:43 <@vpnHelper> RSS Update - forum: how to connect my server without user/pass box directly? <http://forums.openvpn.net/topic8827.html#p15646>
06:47 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
06:47 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
06:48 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Client Quit]
06:51 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
06:52 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:02 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:04 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
07:55 <@vpnHelper> RSS Update - forum: OpenVPN or OpenVPN AS? <http://forums.openvpn.net/topic8829.html>
08:07 <@vpnHelper> RSS Update - forum: Client Default Config <http://forums.openvpn.net/topic8830.html>
08:13 <@vpnHelper> RSS Update - forum: how to run website and Openvpn (@ UDP 53) at same time? <http://forums.openvpn.net/topic8827.html#p15649>
08:17 -!- mape2k [~mape2k@p5B24F192.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
08:22 -!- caemir is now known as josefine
08:23 -!- josefine is now known as caemir
08:25 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
08:48 -!- luneff [~yury@84.51.192.74] has joined #openvpn
08:50 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:54 -!- naquad_ [~naquad@174.142.224.219] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:55 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
08:59 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
09:04 -!- master_of_master [~master_of@p57B53650.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:06 -!- master_of_master [~master_of@p57B534DB.dip.t-dialin.net] has joined #openvpn
09:20 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Ping timeout: 244 seconds]
09:21 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
09:30 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
09:36 -!- mape2k [~mape2k@f053194233.adsl.alicedsl.de] has joined #openvpn
09:44 <@vpnHelper> RSS Update - forum: Routing problem on multi-homed network <http://forums.openvpn.net/topic8821.html#p15650>
09:55 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 258 seconds]
10:22 -!- qbasicer [~qbasicer@24-246-12-52.cable.teksavvy.com] has quit [Remote host closed the connection]
10:37 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
10:50 <@vpnHelper> RSS Update - forum: Server Startup Problems <http://forums.openvpn.net/topic8831.html>
10:56 -!- albech_ [~albech@61.7.176.66] has joined #openvpn
11:03 -!- tusharsharma [~tusharsha@182.237.13.13] has joined #openvpn
11:04 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
11:28 -!- kyrix [~ashley@mk046207255092.a1.net] has joined #openvpn
11:50 -!- p3rror [~mezgani@41.140.26.33] has joined #openvpn
11:54 -!- albech_ [~albech@61.7.176.66] has quit [Quit: Leaving]
11:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
11:56 -!- michl [~michl@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has joined #openvpn
11:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:58 < michl> !welcome
11:58 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:02 < hyper_ch> hi michl
12:02 < michl> Hi!
12:07 < hyper_ch> need any help?
12:07 < michl> No thanks. I'm here in case I could be of service.... :-)
12:08 < hyper_ch> oh.... whats your bankaccount number and pin?
12:09 < hyper_ch> if you really wanna help ;)
12:10 -!- luneff [~yury@84.51.192.74] has joined #openvpn
12:12 < michl> Remember the odd FTP-through UDP tunnel problem with T-Mobile?
12:13 < michl> It is now under investigation at T-Mobile :-)
12:14 < hyper_ch> I don't remember that
12:14 < hyper_ch> don't even konw what t-mobile is
12:14 < michl> In that case you didn't miss much.
12:15 -!- luis_ [~luis@201.201.44.82] has joined #openvpn
12:15 -!- luis_ [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
12:15 -!- corretico [~luis@201.201.44.82] has joined #openvpn
12:16 < hyper_ch> :)
12:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
12:18 -!- mape2k [~mape2k@f053194233.adsl.alicedsl.de] has quit [Ping timeout: 260 seconds]
12:19 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
12:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:20 -!- tusharsharma [~tusharsha@182.237.13.13] has quit [Ping timeout: 260 seconds]
12:24 -!- tusharsharma [~tusharsha@182.237.13.13] has joined #openvpn
12:26 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has joined #openvpn
12:27 < DeltachaosDeskto> hi @all
12:28 < michl> hyper_ch: a victim? :-)
12:28 < michl> DetachaosDeskto: You need help?
12:29 < DeltachaosDeskto> i have a working vpn server and client now and i want to have acces to my internet connection and simultaneously to the vpn..
12:29 < DeltachaosDeskto> do i nead to change settings at the server a well?
12:29 < DeltachaosDeskto> *as well
12:29 < EugeneKay> !def1
12:29 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:29 < DeltachaosDeskto> *access
12:30 < EugeneKay> Basically, you need to push a route to the client to tell it to use the vpn for all traffic except the established vpn tunnel.
12:30 < DeltachaosDeskto> so this is to do in server configuration?
12:30 < EugeneKay> You'll also need to enable SNAT/MASQUERADEing on the server 
12:31 < EugeneKay> Usually, yes. You can do it client-side if you like, but it's more common to see routes pushed to clients.
12:31 -!- michl [~michl@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has quit [Quit: michl]
12:31 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
12:33 < michl> DeltachaosDeskto: I'm not sure, I understood you correctly: You really want to reach the internet through the tunnel?
12:34 < DeltachaosDeskto> so i have this example in my server configuration: push "route 192.168.10.0 255.255.255.0" and my vpn server adress is 10.8.0.0. do i nead to tell the clients "You shuld route all the traffic that is going to my vpn there" or "You shuld route all the traffic to is going to your local this ips there"
12:35 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
12:35 < DeltachaosDeskto> michl: basicly i want have a private network over the internet to share things with my friends. but we also ant have a internetconnection while oing this. and we like to use the internet connection of our home isps
12:36 < DeltachaosDeskto> *want have a..
12:36 < DeltachaosDeskto> *doing this
12:36 < michl> In this case you do not have to do anything. You connect to the normal internet the same way as you used it to initiate the tunnel itself.
12:37 < michl> The Server will thell the clients, what networks the client can reach through the tunnel. If you do not let your server push routes to the clients, then they send their data not through the tunnel.
12:38 < DeltachaosDeskto> hmm but if i now connect to the vpn all my other internet connections are break
12:38 < michl> What routes does your server push to the clients?
12:39 < DeltachaosDeskto> at the moment no routes
12:39 < michl> Do you have the directive "redirect-gateway" in your clients configuration (as EugeneKey supposed you did)?
12:40 < DeltachaosDeskto> no
12:40 < DeltachaosDeskto> i have a enty but its a comment^^
12:40 < DeltachaosDeskto> ;push "redirect-gateway def1 bypass-dhcp"
12:40 < DeltachaosDeskto> its the debian default configuration
12:40 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
12:41 < michl> Can you pastebin what "route -n" tells you bevor and after you initiated the tunnel?
12:42 -!- luneff [~yury@84.51.192.74] has joined #openvpn
12:42 < DeltachaosDeskto> ok. this is the server configuration: http://paste.kde.org/122755/
12:43 < DeltachaosDeskto> this is my route -n: http://paste.kde.org/122761/
12:43 < DeltachaosDeskto> and now i connect to the vpn. be right back
12:44 < michl> Problem disapeared :-))
12:45 < DeltachaosDeskto> this is the route -n after the vpn connection: http://paste.kde.org/122767/
12:45 < DeltachaosDeskto> ok. what have i missed while i was away?
12:45 < michl> Thanks. Can you add your clients configuraition, too?
12:46 < michl> You missed nothing relevant :-)
12:46 < DeltachaosDeskto> i'm using the Gnome NetworkManager to connect because i think its the most comfortable way to do it
12:47 < DeltachaosDeskto> dont know where it puts the configurations
12:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
12:48 < DeltachaosDeskto> im using cetificates for autherification an i have enabled the "LZO-Compression"
12:49 -!- albech [~albech@183.88.64.187] has quit [Remote host closed the connection]
12:49 < DeltachaosDeskto> all the stuff works and i can connect to the server while im in the vpn with the ip: 10.8.0.0
12:50 < DeltachaosDeskto> how should the routing table looks like after connection to the vpn?
12:50 < michl> Is there any checkbox that says something like "route everything through the tunnel"?
12:51 < DeltachaosDeskto> michl: not realy. but let me try something
12:51 < DeltachaosDeskto> no this dosent work. 
12:51 < DeltachaosDeskto> hmm
12:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
12:52 < DeltachaosDeskto> did i missed something while i was connected to the vpn?
12:53 < michl> no
12:53 < michl> Maybe it would be much simpler to create a openvpn client configuration file for yourself. It would be very easy
12:54 < DeltachaosDeskto> but i can add routes in the dialog
12:54 < DeltachaosDeskto> hmm okey.. which route shuld i have after the connection?
12:57 < michl> try something like this http://paste.kde.org/122779 as config file and start openvpn manually with "openvpn --config file_with_pastebin_lines"
12:58 < michl> you have to exchange the filenames with the real file names of your certifcates and key
12:59 < michl> Line number 3 of your paste here http://paste.kde.org/122767/ is not good
13:00 < DeltachaosDeskto> michl: ok let me try it
13:02 -!- tusharsharma [~tusharsha@182.237.13.13] has quit [Quit: Leaving]
13:03 < DeltachaosDeskto> michl: ok this work
13:03 < DeltachaosDeskto> why ever
13:03 < michl> solid workmanscraft :-)
13:04 < DeltachaosDeskto> i dont know why the gnome guys are not have a checkbox for this option. :) the networkmanager gui is so nice and integrates goo with gnome3^^
13:04 < DeltachaosDeskto> but i try it with the networkmanager again :D
13:06 < michl> Networkmanager GUI integrates so nicely, because of the very fact, that is misses a lot of configuration elements. So it becomes easy and nice. But thatfore it can not work all the time for all users.
13:10 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:10 < DeltachaosDeskto> oh i found the checkbox in the configuration dialog :D now it works with the gui
13:11 < DeltachaosDeskto> ^^
13:12 < michl> How is this checkbox called?
13:12 < DeltachaosDeskto> i have a german interface so the options are named a bit stranke
13:12 < DeltachaosDeskto> *strange
13:13 < DeltachaosDeskto> its there: Options -> Routes -> "Use this connection only for resources of this Network"
13:13 < michl> happy end.
13:14 < DeltachaosDeskto> thank you :)
13:20 < DeltachaosDeskto> ähm one question
13:20 < DeltachaosDeskto> how do i know which ip i have in the network?
13:20 < DeltachaosDeskto> tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500  metric 1
13:20 < DeltachaosDeskto>         inet 10.8.0.4  netmask 255.255.255.0  destination 10.8.0.4
13:20 < DeltachaosDeskto>         unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
13:20 < DeltachaosDeskto>         RX packets 0  bytes 0 (0.0 B)
13:20 < DeltachaosDeskto>         RX errors 0  dropped 0  overruns 0  frame 0
13:20 < DeltachaosDeskto>         TX packets 0  bytes 0 (0.0 B)
13:20 < DeltachaosDeskto>         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
13:20 -!- DeltachaosDeskto was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
13:21 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has joined #openvpn
13:21 < michl> hello again :-)
13:21 < DeltachaosDeskto> xD
13:21 < DeltachaosDeskto> http://paste.kde.org/122815/
13:21 < DeltachaosDeskto> so do i nead (or can) setup a DHCP server in the vpn?
13:23 < michl> You get a random ip from the pool of the server virtual IP address pool. If you want a fixed virtual IP you can take action. Most of the time this brings not any additional advantages. 
13:23 < EugeneKay> The --server network netmask option sets up a DHCP server of sorts, which uses a /30 toplogy(by default). It isn't a full DHCP servr like ISC DHCPD, but it is enough to handle the OpenVPN tunnel adapters.
13:24 < EugeneKay> See also the --ifconfig-pool directive
13:25 < EugeneKay> If you want, for some perverse reason, to use an existing DHCP server install, you'll need to use somethign involving bridge mode, but that's just plain ugly.
13:25 < DeltachaosDeskto> ok :)
13:26 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Ping timeout: 258 seconds]
13:27 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
13:45 <@vpnHelper> RSS Update - forum: Dynamic IP help. <http://forums.openvpn.net/topic8832.html>
13:48 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Max SendQ exceeded]
13:48 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:49 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
13:49 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
14:02 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
14:09 <@vpnHelper> RSS Update - forum: STOP "Need IPv6 code in mroute_extract_addr_from_packet" ??? <http://forums.openvpn.net/topic8833.html>
14:14 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Ping timeout: 252 seconds]
14:16 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
14:17 < krzie> Dougy, have you shipped that box yet?
14:18 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:19 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
14:20 -!- kyrix [~ashley@mk046207255092.a1.net] has quit [Ping timeout: 276 seconds]
14:32 -!- wartex8 [81156cde@gateway/web/freenode/ip.129.21.108.222] has joined #openvpn
14:34 -!- LuckyY_ is now known as LuckyY
14:38 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Ping timeout: 260 seconds]
14:39 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
14:54 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Quit: upgrading and restarting tmux]
14:55 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:58 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
15:15 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Ping timeout: 240 seconds]
15:22 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
15:30 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
15:50 -!- p3rror [~mezgani@41.140.26.33] has quit [Ping timeout: 260 seconds]
15:59 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
16:08 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Ping timeout: 240 seconds]
16:12 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
16:13 <@vpnHelper> RSS Update - forum: Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15656> || Is it possible to install OpenVPN server on Win 2008 Server? <http://forums.openvpn.net/topic8825.html#p15655> || Verifying Re-Direct of Traffic in "Road Warrior" connection <http://forums.openvpn.net/topic8763.html#p15654>
16:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
16:18 -!- Squidy [~quassel@189.74.63.85] has joined #openvpn
16:18 -!- Squidy [~quassel@189.74.63.85] has quit [Changing host]
16:18 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
16:18 <@vpnHelper> RSS Update - forum: Dynamic IP help. <http://forums.openvpn.net/topic8832.html#p15659> || Server Startup Problems <http://forums.openvpn.net/topic8831.html#p15658> || how to run website and Openvpn (@ UDP 53) at same time? <http://forums.openvpn.net/topic8827.html#p15657>
16:19 -!- davemasselink [~davemasse@c-24-4-100-253.hsd1.ca.comcast.net] has joined #openvpn
16:22 -!- p3rror [~mezgani@41.248.163.24] has joined #openvpn
16:23 <@vpnHelper> RSS Update - forum: STOP "Need IPv6 code in mroute_extract_addr_from_packet" ??? <http://forums.openvpn.net/topic8833.html#p15660>
16:32 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
16:32 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
16:45 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
16:45 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
16:51 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
16:52 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
17:00 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
17:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
17:04 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
17:25 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
17:51 -!- davemasselink [~davemasse@c-24-4-100-253.hsd1.ca.comcast.net] has quit [Quit: davemasselink]
17:58 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
18:28 < wartex8> how does a client know what packets it should forward to a vpn?
18:29 < wartex8> aka when I ping broadcast 192.168.1.255 it works, but not for any other ip in that range
18:30 -!- davemasselink [~davemasse@h-67-100-209-210.snvacaid.static.covad.net] has joined #openvpn
18:31 < krzee> by its routing table
18:31 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Read error: Operation timed out]
18:31 < krzee> but that doesnt mean that the lan can route back to the vpn
18:32 < krzee> (that wasnt part of your question tho, so 'its routing table'
18:32 < wartex8> k is the routing table usually set by openvpn when you do "openvpn client.conf"
18:32 < wartex8> or is it specified inside the client.conf file?
18:32 < krzee> well the routing table already exists
18:32 < krzee> however, if you used --server in the server config, that adds routes to the client
18:32 < krzee> and if you used --route in the client config, that does
18:33 < krzee> and if you used --push "route ..." in the server config, that does
18:33 < krzee> basically, theres no standard answer, since theres no standard config
18:33 < wartex8> oh, that makes more sense
18:33 < wartex8> thanks for the info
18:34 < krzee> np
18:34 < krzee> !route
18:34 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
18:34 < krzee> theres basically everything you need to know for lans behind openvpn
18:35 < wartex8> k I'll go look over it
18:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
18:40 <@vpnHelper> RSS Update - forum: Connections to multiple OpenVPN Servers? <http://forums.openvpn.net/topic8807.html#p15661>
18:46 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
18:52 -!- davemasselink [~davemasse@h-67-100-209-210.snvacaid.static.covad.net] has quit [Quit: davemasselink]
18:56 < krzee> Dougy, Dougy Dougy 
19:06 -!- _julian [~quassel@hmbg-5f767acc.pool.mediaWays.net] has joined #openvpn
19:07 -!- _julian_ [~quassel@hmbg-4d06d060.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
19:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
19:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:18 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
19:19 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
19:27 < wartex8> !tcpip
19:27 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
19:27 <@vpnHelper> RSS Update - forum: Dynamic IP help. <http://forums.openvpn.net/topic8832.html#p15662>
19:28 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
19:48 -!- Denial [Denial@drgi.co.uk] has quit []
19:50 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
19:52 <@vpnHelper> RSS Update - forum: Virtual network adapters in windows <http://forums.openvpn.net/topic8834.html> || Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15663>
19:57 -!- raomin__ [~romain@240.22.66.86.rev.sfr.net] has quit [Read error: Operation timed out]
19:57 -!- raomin__ [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
20:04 -!- GH0ST [~ghst@58.171.13.184] has joined #openvpn
20:24 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
20:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:37 -!- neu3no [~neu3no@v50-23.vs4.regfish.de] has quit [Ping timeout: 244 seconds]
20:42 -!- p3rror [~mezgani@41.248.163.24] has quit [Ping timeout: 260 seconds]
20:53 -!- GH0ST [~ghst@58.171.13.184] has quit [Quit: Colloquy for iPhone - http://colloquy.mobi]
20:54 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
21:01 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
21:07 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
21:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
21:09 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
21:16 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
21:30 -!- luneff [~yury@84.51.192.74] has quit [Read error: Connection reset by peer]
21:30 -!- luneff [~yury@84.51.192.74] has joined #openvpn
21:48 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:31 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
22:43 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has quit [Read error: Operation timed out]
22:51 -!- wartex8 [81156cde@gateway/web/freenode/ip.129.21.108.222] has quit [Quit: Page closed]
22:54 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 252 seconds]
23:16 -!- tushar [~tusharsha@182.237.13.136] has joined #openvpn
23:20 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
23:24 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
23:27 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
23:35 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
23:50 -!- EugeneKay is now known as EugeneKaway
23:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
--- Day changed Sun Sep 18 2011
00:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:16 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:17 -!- nioboozmar [~nioboozma@124-168-48-145.dyn.iinet.net.au] has joined #openvpn
00:17 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
00:24 -!- tushar [~tusharsha@182.237.13.136] has quit [Ping timeout: 260 seconds]
00:32 -!- nioboozmar [~nioboozma@124-168-48-145.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
00:57 <@vpnHelper> RSS Update - forum: OpenVPN 2.1 requires '--script-security 2' <http://forums.openvpn.net/topic8835.html>
01:33 -!- luneff [~yury@84.51.192.74] has quit [Read error: Connection reset by peer]
01:34 -!- luneff [~yury@84.51.192.74] has joined #openvpn
02:53 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
02:56 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Quit: Leaving]
02:58 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
03:39 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
03:46 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html#p15666>
04:50 -!- anandvenkat4 [~anandvenk@206.222.164.183] has joined #openvpn
04:50 < anandvenkat4> Hi Room... 
04:50 < anandvenkat4> Can anyone help me get source code of default openvpn client in ubuntu
04:51 < hyper_ch> anandvenkat4: add the -src repo and then
04:51 < hyper_ch> apt-get source openvpn
04:52 < anandvenkat4> I am a newbie to Ubuntu.. Could you please let me know how to add -src repo?
04:53 < hyper_ch> if you didn't alter your sources.list, it is already added
04:53 < anandvenkat4> fine thanks
04:55 < anandvenkat4> @hyper_ch: where the downloaded code would be stored?
04:57 < anandvenkat4> Can anyone help?
04:58 < hyper_ch> anandvenkat4: should be in your current directory
04:58 -!- Squidy [~quassel@187.7.193.137] has joined #openvpn
04:58 -!- Squidy [~quassel@187.7.193.137] has quit [Changing host]
04:58 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
05:04 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314-15.html#p15667>
05:15 < anandvenkat4> When connecting openvpn through command line, DNS entries from the server are not updated in /etc/resolv.conf.. How to achieve it?
05:17 < Bushmills> the man page says something about that, below --dhcp-option
05:23 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
05:25 -!- anandvenkat4 [~anandvenk@206.222.164.183] has quit [Ping timeout: 260 seconds]
05:29 -!- raidz1 [~Administr@aim.505.ru] has quit [Remote host closed the connection]
05:30 < hyper_ch> or you can push dns servers from the server config
05:34 < Bushmills> ..and for that you want to read the mentioned section of man page
05:35 < Bushmills> especially where it says "...non-windows client.."
05:48 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has joined #openvpn
05:57 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
06:36 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Operation timed out]
06:39 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:43 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has joined #openvpn
06:44 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has quit [Client Quit]
06:45 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:05 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
07:27 -!- cmanns_ [~cmanns@75-140-157-28.dhcp.reno.nv.charter.com] has joined #openvpn
07:27 < cmanns_> Hai
07:32 -!- cmanns_ [~cmanns@75-140-157-28.dhcp.reno.nv.charter.com] has quit [Ping timeout: 252 seconds]
07:32 -!- cmanns_ [~cmanns@75-140-157-28.dhcp.reno.nv.charter.com] has joined #openvpn
07:42 -!- colrack [~colrack@host153-186-dynamic.52-82-r.retail.telecomitalia.it] has joined #openvpn
07:46 -!- cmanns_ [~cmanns@75-140-157-28.dhcp.reno.nv.charter.com] has quit [Ping timeout: 252 seconds]
07:51 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
07:53 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
07:55 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
08:04 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
08:05 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:10 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
08:16 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
08:17 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
08:27 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:32 -!- colrack [~colrack@host153-186-dynamic.52-82-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
08:33 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:36 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
08:39 <@vpnHelper> RSS Update - forum: The Bathing of Husband and Wife together <http://forums.openvpn.net/topic8837.html> || Please Take me! <http://forums.openvpn.net/topic8836.html>
08:40 < Olipro> O_o
08:40 -!- neu3no [~neu3no@love.endno.de] has joined #openvpn
08:45 <@vpnHelper> RSS Update - forum: You should know this man <http://forums.openvpn.net/topic8838.html>
08:50 -!- cmanns [~cmanns@68-189-104-62.dhcp.wtvl.ca.charter.com] has joined #openvpn
08:54 -!- cmanns [~cmanns@68-189-104-62.dhcp.wtvl.ca.charter.com] has quit [Ping timeout: 276 seconds]
08:57 -!- JPT [~JPT@dslc-082-082-219-063.pools.arcor-ip.net] has joined #openvpn
08:59 < JPT> I've added a debian testing machine to my tap-based vpn setup. Several Windows and Fedora machines are already in it and there are no issues. Now, the debian testing machine adds two different routes to my vpn, so basically it cannot communicate with the rest of the network except with the openvpn "server" itself..
09:00 < JPT> *err... the debian machine uses two different routes for the network address of the vpn. *
09:01 < JPT> http://pastebin.com/8QXHesef
09:01 < JPT> i've already removed one of these routes manually, which solves the problem.
09:03 < JPT> so there's just the question remaining: how can i stop openvpn from adding two routes when connecting to the vpn?
09:03 < JPT> and why does this only happen on the debian machine?
09:03 -!- master_of_master [~master_of@p57B534DB.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:05 -!- master_of_master [~master_of@p57B54853.dip.t-dialin.net] has joined #openvpn
09:07 -!- nameless` [~nameless`@lav35-1-82-236-136-20.fbx.proxad.net] has left #openvpn []
09:13 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has joined #openvpn
09:14 < cmanns> back ^.^
09:14 < JPT> :)
09:15 < cmanns> What should I do to like proxy/vpn to one of my idle systems so I can encrypt traffiic and use my private lan there. Being able to give some devices like my desktop a static ip and others shared, any suggestions on a free solution similar to that?
09:16 < cmanns> I believe openvpn connects to what I want, but what do I run thats simple, it's just going to be me pretty much and a few devices.
09:16 < JPT> mhh... i just added some of the machines i have to a vpn... all i need is ssh and x11vnc then :)
09:17 < cmanns> socks5 tunnel?
09:17 < cmanns> I use it but my android supports VPN native and what not 
09:18 < JPT> actually, i don't really have an idea.. i'm just here because one of my vpn clients adds a bad route for the tap interface...
09:18 < JPT> http://pastebin.com/8QXHesef
09:19 < cmanns> configs?
09:20 < JPT> http://pastebin.com/Re81H1mQ <-- server
09:21 < JPT> http://pastebin.com/4xNSR93c <-- client
09:22 < JPT> the weird thing is that is use [except for different certs] the same client config on several fedora and windows machines.. they don't have that issue
09:27 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has quit [Ping timeout: 252 seconds]
09:28 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:30 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
09:32 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has joined #openvpn
09:32 <@vpnHelper> RSS Update - forum: --shaper and --server together <http://forums.openvpn.net/topic7686.html#p15471> || UDPBroadcastForwarder <http://forums.openvpn.net/topic7319.html#p15470> || Gigabit Server but cannot exceed more than 160mbps <http://forums.openvpn.net/topic8723.html#p15469>
09:39 <@vpnHelper> RSS Update - forum: Server Startup Problems <http://forums.openvpn.net/topic8831.html#p15671>
09:45 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html#p15672>
09:56 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust646.15-3.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
09:57 <@vpnHelper> RSS Update - forum: Server Startup Problems <http://forums.openvpn.net/topic8831.html#p15673>
09:58 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has quit [Ping timeout: 252 seconds]
09:59 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has joined #openvpn
10:08 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has quit [Ping timeout: 252 seconds]
10:08 -!- EugeneKaway is now known as EugeneKay
10:10 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has joined #openvpn
10:12 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Remote host closed the connection]
10:15 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has quit [Ping timeout: 252 seconds]
10:15 <@vpnHelper> RSS Update - forum: Cannot get openvpn working <http://forums.openvpn.net/topic8839.html>
10:27 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
10:30 -!- arosen [~arosen@130.127.39.181] has joined #openvpn
10:30 < arosen> !configs
10:30 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
10:34 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
10:34 < arosen> If I use openVPN as L3 and have push "redirect-gateway" set
10:34 -!- Squidy_at_Home [~quassel@187.7.247.175] has joined #openvpn
10:34 < arosen> then does openvpn already do nat for the clients? 
10:34 < Olipro> openvpn does not do nat
10:35 -!- albech [~albech@61.7.176.171] has joined #openvpn
10:35 < arosen> Say I want to have clients send all their traffic though the vpn but I want to do it at layer 3. 
10:35 < arosen> I would use a tun right? 
10:35 < Olipro> default dev tun0
10:35 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 260 seconds]
10:35 < Olipro> ^for example
10:35 < arosen> Do  I need to use tun or tap for that then? 
10:35 < Olipro> you would need to create an explicit route to the VPN server as well
10:36 < Olipro> otherwise you'll just totally lose connectivity
10:36 < arosen> gotcha 
10:36 < Olipro> if you want routed, use tun
10:36 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:36 < arosen> I thought tun was only for point to point?
10:36 < Olipro> tap is effectively ethernet bridging
10:37 < Olipro> tun is a point-to-point link, yes
10:37 < Olipro> that doesn't preclude you from routing packets over it
10:37 < arosen> if I use point-to-point there isn't a gateway specified as a route though ? 
10:38 < arosen> I know how to configure this with tap but not with tun. 
10:38 < Olipro> you don't need to specify one, no
10:38 < Olipro> ip route add 1.2.3.4/8 dev tun0
10:38 < Olipro> etc
10:39 < arosen> so if you do ping 1.2.3.4 on the client slide it will go to the openvpn server 
10:39 < arosen> what will the server do with it/ 
10:39 < arosen> does he send it to 1.2.3.4 with his source ip ? 
10:39 < Olipro> whatever its routing table says to do with it
10:39 < Olipro> no, NAT does not just magically occur
10:39 < arosen> So he will just forward the packet and the source IP is till going to be w/e the clients was on the other side of the tun right? 
10:39 < Olipro> correct
10:40 < arosen> thanks Olipro i think i understand 
10:40 < Olipro> on linux, you configure nat in iptables
10:40 < arosen> yup 
10:41 < Olipro> use SNAT if you have a static IP, MASQUERADE if dynamic
10:49 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 260 seconds]
10:49 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
11:12 -!- tushar [~tusharsha@182.237.13.209] has joined #openvpn
11:19 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has joined #openvpn
11:34 -!- tushar [~tusharsha@182.237.13.209] has quit [Remote host closed the connection]
11:48 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
12:10 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Quit: Bye]
12:13 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
12:14 -!- Squidy [~quassel@189.72.222.177] has joined #openvpn
12:14 -!- Squidy [~quassel@189.72.222.177] has quit [Changing host]
12:14 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
12:15 -!- Squidy_at_Home [~quassel@187.7.247.175] has quit [Ping timeout: 260 seconds]
12:34 <@vpnHelper> RSS Update - forum: Cannot get openvpn working <http://forums.openvpn.net/topic8839.html#p15676> || OpenVPN 2.1 requires '--script-security 2' <http://forums.openvpn.net/topic8835.html#p15675>
12:36 -!- p3rror [~mezgani@41.140.25.122] has joined #openvpn
12:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:39 <@vpnHelper> RSS Update - forum: Dynamic IP help. <http://forums.openvpn.net/topic8832.html#p15679> || Connections to multiple OpenVPN Servers? <http://forums.openvpn.net/topic8807.html#p15678> || Error: private key password verification failed <http://forums.openvpn.net/topic8793.html#p15677>
12:46 <@vpnHelper> RSS Update - forum: email me when openvpn client connects <http://forums.openvpn.net/topic8841.html> || problem with access server <http://forums.openvpn.net/topic8840.html>
12:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:51 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 260 seconds]
13:00 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
13:04 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
13:05 -!- caemir_ [~caemir@unaffiliated/caemir] has quit [Ping timeout: 260 seconds]
13:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:08 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
13:08 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 258 seconds]
13:08 -!- caemir_ is now known as caemir
13:10 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html#p15682>
13:10 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Connection reset by peer]
13:14 -!- albech [~albech@61.7.176.171] has quit [Quit: Leaving]
13:23 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:24 < cmanns> So anybody around?
13:24 < ecrist> yup
13:24 < ecrist> !ask
13:24 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
13:26 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Connection reset by peer]
13:27 < cmanns> I'm looking to setup where I can connect my droid2 and other devices and they get a shared IP through vpn, and if I vpn'd my desktop per se, it'd receive an static IP or possibly a public and private IP. I want to have all my traffic go out my network on devices supporting vpn with ease, anything without a long painful configuration?
13:28 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:28 < cmanns> I get like 30ms to the systems, and my max ISP downstream/upstream over socks 5 ssh tunnel so vpn methods must be dandy :3
13:28 < ecrist> cmanns: not really
13:28 < cmanns> :(
13:28 < cmanns> worth the long configuration?
13:28 < ecrist> openvpn is only supported on iphone/android if you root the device
13:28 < ecrist> which I wouldn't consider 'simple' or 'easy'
13:29 < cmanns> Mine has vpn
13:29 < ecrist> openvpn
13:29 < ecrist> vpn != openvpn
13:29 < ecrist> there are different kinds of vpn
13:29 < cmanns> What kind is this?
13:29 < ecrist> you have GRE with IPSec, PPTP, and SSL
13:29 < cmanns> I want to setup what I can connect too
13:29 < ecrist> there are also different protocols which use SSL for VPN purposes
13:30 < ecrist> two in particular are openvpn and cisco
13:30 < cmanns> Like my droid2 and imac support IPSec and it seems thats the one I can give assigned IP's from the vpn server.
13:30 < ecrist> well, we only support openvpn here
13:30 < ecrist> everything else and you're on your own
13:30 < cmanns> What does openvpn power? :S
13:30 < cmanns> I was told to go here for what I wanted lol
13:30 < ecrist> well, we only do openvpn
13:30 < ecrist> hence, the channel name
13:31 < cmanns> and to not beat around the bush what exactly it function in the vpn world?
13:31 < cmanns> openvpns a client right
13:31 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Connection reset by peer]
13:31 < ecrist> openvpn 'powers' a lot of things
13:31 < ecrist> if you want it on your phone, you'll need to install it after rooting your device
13:31 < cmanns> I know it's installed on a lot of things and what not but does it do the server or the client work
13:32 < ecrist> there are clients available for mac os and windows, along with linux and other unix oses
13:32 < cmanns> Yeah I got them already setup to do it and have used others
13:32 < ecrist> openvpn is both a server and client
13:32 < cmanns> ic
13:32 < cmanns> So why exactly is openvpn not what im looking for?
13:32 < ecrist> what, exactly, it does, depends on your config file
13:32 < ecrist> I didn't say it wasn't
13:32 < cmanns> I want to connect to my vpn and have public internet access there and internal access which the server system has access too.
13:32 < cmanns> mkay
13:39 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:42 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Connection reset by peer]
13:45 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
13:45 <@vpnHelper> RSS Update - forum: Is it possible to install OpenVPN server on Win 2008 Server? <http://forums.openvpn.net/topic8825.html#p15683>
13:47 -!- caemir_ is now known as caemir
13:48 -!- JPT [~JPT@dslc-082-082-219-063.pools.arcor-ip.net] has quit [Quit: Verlassend]
13:53 -!- sabayonuser2 [~sabayonus@64.235.109.116] has joined #openvpn
13:53 < sabayonuser2> pfsense + openvpn. I'
13:54 < sabayonuser2> i have it configured and i am connected. I have linux boxes on the arse end of the pfsense box. i'm connecting from an outside ip and am now on 10.0.8.1 with this outside connection, the internal ip range of the network i'm connected to is 10.8.0.1 how do i access shared directories
13:55 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
13:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
13:58 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
14:06 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 260 seconds]
14:11 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:13 -!- Squidy [~quassel@187.54.245.67] has joined #openvpn
14:13 -!- Squidy [~quassel@187.54.245.67] has quit [Changing host]
14:13 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
14:18 < krzie> sabayonuser2, if the shared dirs are sharing on the 10.8.. range then you just do it like normal, if they are on some LAN subnet you first need to get pinging to that subnet to work
14:18 < krzie> if that is the case, see here:
14:18 < krzie> !route
14:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
14:25 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
14:26 <@vpnHelper> RSS Update - forum: Cannot get openvpn working <http://forums.openvpn.net/topic8839.html#p15684>
14:29 < sabayonuser2> i believe that due to my setup - ads modem > pfsense firewall box > linksys wrt54gl Running tomato setup with static ip based on routers lan addr. which gives lan out through wifi and hardwire to this specific pc
14:29 < sabayonuser2> I will need to read some info on routing.
14:31 < sabayonuser2> when i'm connected to the vpn i cannot ping the router
14:31 < sabayonuser2> (wrt54gl
14:32 < sabayonuser2> sorry. i'll just stfu and read the link
14:34 < krzie> Dougy, ??
14:38 < jeev> lol.
14:42 -!- sabayonuser2 [~sabayonus@64.235.109.116] has quit [Ping timeout: 252 seconds]
14:52 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
14:53 -!- luneff [~yury@84.51.192.74] has quit [Read error: Connection reset by peer]
14:54 -!- luneff [~yury@84.51.192.74] has joined #openvpn
14:55 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
14:55 -!- wartex8 [81156cde@gateway/web/freenode/ip.129.21.108.222] has joined #openvpn
14:56 < wartex8> !nat
14:56 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:57 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
14:58 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:00 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
15:04 -!- Olipro_ is now known as Olipro
15:04 -!- sabayonuser2 [~sabayonus@64.235.109.116] has joined #openvpn
15:19 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
15:20 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
15:27 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
15:27 < Roelke> hi all
15:27 < Roelke> i've some issues with my VPN connection
15:27 < Roelke> it's working, but the ping >500ms 
15:28 < Roelke> i've googled, but didn't found a solution
15:28 < reiffert> openvpn version?
15:28 < Roelke> latest one
15:28 < reiffert> anything else on the line but the icmp pings?
15:28 < Roelke> nope
15:30 < reiffert> what does cause the high response time, ping request leaving or reply incoming, or both?
15:31 < Roelke> how can i see that ?
15:31 < EugeneKay> traceroute would be a good step
15:32 < Roelke> first hop is 10.8.0.1 and has a 500ms ping avg.
15:37 < Roelke> the problem started with openvpn-as, so i've removed as and tried it with openvpn
15:37 < Roelke> but it is having exactly the same problem
15:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:46 -!- Fritz09 [~Fritz09@pop1-469.catv.wtnet.de] has joined #openvpn
16:03 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html#p15685>
16:07 -!- Fritz09 [~Fritz09@pop1-469.catv.wtnet.de] has quit [Quit: Bye offline]
16:09 <@vpnHelper> RSS Update - forum: email me when openvpn client connects <http://forums.openvpn.net/topic8841.html#p15686>
16:20 -!- Fritz09 [~Fritz09@pop1-469.catv.wtnet.de] has joined #openvpn
16:21 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 240 seconds]
16:22 -!- Squidy [~quassel@189.72.212.169] has joined #openvpn
16:22 -!- Squidy [~quassel@189.72.212.169] has quit [Changing host]
16:22 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
16:30 -!- Fritz09 [~Fritz09@pop1-469.catv.wtnet.de] has quit [Quit: Bye offline]
16:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
16:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:42 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
16:45 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
17:02 -!- jcran [~jcran@64.125.235.2] has joined #openvpn
17:12 -!- wartex8 [81156cde@gateway/web/freenode/ip.129.21.108.222] has quit [Ping timeout: 252 seconds]
17:19 <@vpnHelper> RSS Update - forum: Is it possible to install OpenVPN server on Win 2008 Server? <http://forums.openvpn.net/topic8825.html#p15687>
17:20 -!- p3rror [~mezgani@41.140.25.122] has quit [Remote host closed the connection]
17:21 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
17:51 -!- dxtr [irbkhq@unaffiliated/dxtr] has quit [Quit: WeeChat 0.3.5]
17:54 -!- dxtr [s3wark@unaffiliated/dxtr] has joined #openvpn
17:58 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:07  * cmanns is away: auto-away
18:07 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
18:31 -!- wartex8 [81156cde@gateway/web/freenode/ip.129.21.108.222] has joined #openvpn
18:38 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
18:39 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Remote host closed the connection]
18:40 < wartex8> openvpn's guide for bridging mentions when bridging eth0 and tap0, you have to set eth's ip
18:40 < wartex8> I'm probably not understanding this correctly - but is there anyway to let eth0 to get it's ip via dhcp
18:41 < krzee> no idea, but why are you bridging?
18:42 < wartex8> It seems to be the easier way to do it
18:42 < krzee> most often people who decide to use bridging shouldnt be
18:42 < krzee> no, it is not
18:42 < krzee> !tunortap
18:42 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
18:42 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
18:42 < krzee> what is your goal?
18:43 < wartex8> I'm trying to make a warzone
18:43 < wartex8> clients connect to a server and then can attack the computers inside the vpn
18:43 < krzee> ip attacks?
18:43 < wartex8> yah - it would be ip based so it seems bridging is not a good idea
18:43 < krzee> correct
18:44 < krzee> !sample
18:44 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
18:44 < krzee> thats basically what you want from your description of your goal
18:44 < krzee> unless of course you left out info from the topology
18:45 < wartex8> k thanks I'll look into that more
18:49 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 265 seconds]
18:58 < wartex8> !goal
18:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:05 -!- _julian_ [~quassel@hmbg-4d06c65b.pool.mediaWays.net] has joined #openvpn
19:06 -!- _julian [~quassel@hmbg-5f767acc.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
19:39 -!- sabayonuser2 [~sabayonus@64.235.109.116] has quit [Ping timeout: 260 seconds]
19:41 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
19:51 -!- sabayonuser2 [~sabayonus@64.235.109.116] has joined #openvpn
20:03 -!- _julian [~quassel@hmbg-5f7646aa.pool.mediaWays.net] has joined #openvpn
20:03 -!- _julian_ [~quassel@hmbg-4d06c65b.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
20:20 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
21:00 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
21:01 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
21:18 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:28 -!- wartex8 [81156cde@gateway/web/freenode/ip.129.21.108.222] has quit [Quit: Page closed]
21:33 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
21:56 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 260 seconds]
21:56 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
21:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:46 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
23:04 -!- brushbox [~brushbox@203.14.171.110] has quit [Quit: Leaving.]
23:13 -!- Fritz09 [~Fritz09@pop1-469.catv.wtnet.de] has joined #openvpn
23:22 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
23:22 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
23:23 -!- Fritz09 [~Fritz09@pop1-469.catv.wtnet.de] has quit [Quit: Bye offline]
23:38 <@vpnHelper> RSS Update - forum: Dynamic IP help. <http://forums.openvpn.net/topic8832.html#p15688>
23:51 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
23:59 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
--- Day changed Mon Sep 19 2011
00:35 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:41 -!- trish [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
00:41 < trish> can I put to port directive in one server conf?
00:43 < Bushmills> yes, you can
00:44 < trish> like --port 80 --port 1194 --port 443 etc?
00:45 < trish> can it be done with only one server directive?
00:46 < Bushmills> "with only one"?   one port directive, yes. for exactly one port.
00:46 < Bushmills> like:   port 1194
00:47 < trish> i mean like --local 1.2.3.4  --port 80 --port 8080 --port 443 in my server.conf so that with only one ip address, it can listen to 3 ports 
00:47 < Bushmills> no. one port.
00:48 < trish> so in one server.conf, there can only be one local and one port directive only, right?
00:49 < Bushmills> right
00:49 < trish> thank you.
00:51 < trish> on the other hand, if I use redirect-gateway directive, what is bypass-dns? what does that mean in openvpn? does that mean it will bypass the existing dns that I have and replace my dns what I want if I put a directive push "dhcp-option DNS 8.8.8.8" 
00:53 < trish> Bush? you still there?
00:54 < trish> please let me know 
00:56 -!- anandvenkat4 [~anandvenk@206.222.164.214] has joined #openvpn
00:56 < anandvenkat4> Hi All
00:57 < anandvenkat4> When I connect from openvpn from command line, my dns entry is not updated.. hence I am not able to route the packets
00:57 < anandvenkat4> How to do this
00:57 < anandvenkat4> I am working on Ubuntu
00:58 < anandvenkat4> Any help?
01:03 -!- trish [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
01:03 < Bushmills> why should your "dns entry" be updated?
01:03 < Bushmills> i mean, what did you do for it to get updated?
01:03 < Bushmills> why should your "dns entry" be updated?
01:03 < Bushmills> i mean, what did you do for it to get updated?
01:06 < anandvenkat4> I did not do anything explicit to get it updated
01:06 < anandvenkat4> The problem is I am not able to ping any sites after I am connected
01:07 < Bushmills> that's the reason.   read man page,  section --dhcp-option
01:07 < Bushmills> for pinging, also check ...
01:07 < Bushmills> !redirect
01:07 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
01:08 < Bushmills> "for pinging any other...", that is
01:10 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
01:13 -!- anandvenkat4 [~anandvenk@206.222.164.214] has quit [Ping timeout: 260 seconds]
01:16 -!- luneff [~yury@84.51.192.74] has joined #openvpn
01:17 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
01:48 -!- anandvenkat4 [~anandvenk@206.222.164.205] has joined #openvpn
01:52 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
01:59 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
02:09 -!- Fritz09 [~Fritz09@2.211.67.188] has joined #openvpn
02:12 -!- anandvenkat4 [~anandvenk@206.222.164.205] has quit [Ping timeout: 260 seconds]
02:13 < Mowee> Morning
02:20 -!- Fritz09 [~Fritz09@2.211.67.188] has quit [Quit: Bye offline]
02:21 <@vpnHelper> RSS Update - forum: Dynamic IP help. <http://forums.openvpn.net/topic8832.html#p15689>
02:21 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 276 seconds]
02:29 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:35 -!- anandvenkat4 [~anandvenk@206.222.164.201] has joined #openvpn
02:37 < anandvenkat4> Hi all
02:37 < anandvenkat4> I have to invoke the openvpn command programatically
02:37 < anandvenkat4> I do so by calling it in popen
02:37 < anandvenkat4> the problem is the command can be executed only by sudoers
02:38 < anandvenkat4> but I do  not want it to be asking for password
02:38 < anandvenkat4> anyway to solve this?
02:38 < anandvenkat4> Anyone there?
02:41 < anandvenkat4> Please help
02:41 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 252 seconds]
02:42 -!- dazo_afk is now known as dazo
02:48 -!- anandvenkat4 [~anandvenk@206.222.164.201] has quit [Ping timeout: 260 seconds]
02:52 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
02:55 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
02:57 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
03:07 < Halitus> Is there any way (in windows) to manage who is connected to the vpn? someway more elegant than just allowing/disallowing certain certificates?
03:09 <@vpnHelper> RSS Update - forum: Web traffic not going over vpn <http://forums.openvpn.net/topic8843.html> || "My Computer" freezes when i click one of the network drives <http://forums.openvpn.net/topic8842.html>
03:14 -!- luneff [~yury@109.165.60.152] has joined #openvpn
03:19 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:22 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
03:24 -!- oomkoos [~chatzilla@196-215-108-158.dynamic.isadsl.co.za] has joined #openvpn
03:24 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:25 < oomkoos> hello everyone
03:26 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
03:36 < oomkoos> I have a problem that I would appreciate some help with if anyone has the time. I'm using openvpn together with ClearOS 5.1 to have 2 user at a satelite branch connect to our main office. However at random times the vpn wont connect and receive: TLS Error: TLS handshake failed. Sometimes restarting the vpn sorts this problem and at other times it just fixes itself. it's becoming a irritation...
03:36 < oomkoos> ...because this happens about once a week now. to be honest I'm not an expert on linux systems and picked clearos because of how easy it is to use. i've tried google but no answers and in fact not alot of people seem to experiece this issue. any help is greatly appreciated. 
03:50 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
04:09 <@vpnHelper> RSS Update - forum: Web traffic not going over vpn <http://forums.openvpn.net/topic8843.html#p15693> || "My Computer" freezes when i click one of the network drives <http://forums.openvpn.net/topic8842.html#p15692>
04:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
04:18 -!- Lantizia [~Lantizia@cpc22-stok16-2-0-cust96.1-4.cable.virginmedia.com] has joined #openvpn
04:19 < Lantizia> I'm having issues connecting to an openvpn server for the one private LAN it gives me access to... but also at the same time keeping my normal internet access working
04:19 < Lantizia> can anyone offer any tips? (btw the openvpn client is running on linux not windows)
04:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:28 < Bushmills> Lantizia: don't redirect-gateway
04:28 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:28 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:28 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:34 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15694>
04:35 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Ping timeout: 258 seconds]
04:40 <@vpnHelper> RSS Update - forum: OpenVPN or OpenVPN AS? <http://forums.openvpn.net/topic8829.html#p15695>
04:41 -!- luneff [~yury@109.165.60.152] has quit [Quit: Leaving]
04:49 -!- molmox [~molmox@80.82.22.10] has joined #openvpn
04:50 < molmox> how to make openvpn use both .p12 and .crt files to connect to cisco vpn? pls help as i'm quite confused and need it badly
04:51 < molmox> i'm on linux btw
04:52 -!- anandvenkat4 [~anandvenk@206.222.164.188] has joined #openvpn
04:55 < dazo> molmox: you cannot use openvpn to connect to cisco vpn
04:55 < dazo> !ipsec
04:56 < molmox> dazo, is there a way to connect to cisco vpn on linux?
04:56 < dazo> molmox: lookup openconnect and/or vpnc
04:57 < molmox> dazo, thanks
05:03 -!- anandvenkat4 [~anandvenk@206.222.164.188] has quit [Ping timeout: 260 seconds]
05:08 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has joined #openvpn
05:11 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
05:16 -!- luneff [~yury@109.165.60.152] has joined #openvpn
05:16 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
05:27 -!- anandvenkat4 [~anandvenk@206.222.164.181] has joined #openvpn
05:28 -!- Halitus [~Halitus@121-73-219-113.broadband.telstraclear.net] has quit [Quit: Leaving]
05:30 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
05:31 -!- sabayonuser2 [~sabayonus@64.235.109.116] has quit [Read error: Operation timed out]
05:31 <@vpnHelper> RSS Update - forum: Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html#p15696>
05:32 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
05:32 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
05:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:35 -!- anandvenkat4 [~anandvenk@206.222.164.181] has quit [Ping timeout: 260 seconds]
05:38 <@vpnHelper> RSS Update - forum: "My Computer" freezes when i click one of the network drives <http://forums.openvpn.net/topic8842.html#p15697>
05:44 -!- sabayonuser2 [~sabayonus@64.235.109.116] has joined #openvpn
05:53 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:55 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
06:08 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
06:19 -!- cmanns [~cmanns@75-140-156-160.dhcp.reno.nv.charter.com] has quit [Quit: Cya! ~ www.XenServ.com ~]
06:26 -!- _toortog [~toortog@notsecure.net] has joined #openvpn
06:34 -!- Netsplit *.net <-> *.split quits: toortog
06:34 -!- _toortog is now known as toortog
06:43 -!- pizzamensch [~pizzamens@p5B07C5B6.dip.t-dialin.net] has joined #openvpn
06:43 < pizzamensch> hi
06:43 < pizzamensch> is it possible to have user/password authentication without requiring the client to have some kind of certificate?
06:48 < cpm> umm, the V part of VPN pretty much requires encryption. Encryption without certificates is less than trivial. 
06:48 < cpm> or rather the P part of VPN, sorry.
06:49 < cpm> not that this is trivial. It's not. 
06:50  * Bushmills encrypts cpm's P parts
06:52 < pizzamensch> okay, thanks cpm 
06:52 < pizzamensch> is there some mechanism in the openvpn client that behaves like web browsers with https, that is, download the certificate automatically?
06:53 < cpm> don't touch my P parts
06:56 -!- anandvenkat4 [~anandvenk@206.222.164.201] has joined #openvpn
06:57 < pizzamensch> or is it possible to require authentication but not have encryption?
06:57 < pizzamensch> encryption is not so crucial in this case
07:07 < krzie> sure, use telnet :-p
07:07 < cpm> ppp
07:08 < cpm> pppoe
07:08 < krzie> jk ovpn can do it too, but i doubt theres much reason to disable the enc
07:09 < cpm> defeats the purpose.
07:17 < Roelke> i still can't find the problem
07:17 < Roelke> but it looks like it's started when i updated the kernel about a week ago 
07:18 < Roelke> it looks like a routing issue
07:18 -!- pizzamensch [~pizzamens@p5B07C5B6.dip.t-dialin.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110906120836]]
07:18 < Roelke> (problem : =>500ms ping from client to server)
07:25 -!- anandvenkat4 [~anandvenk@206.222.164.201] has quit [Ping timeout: 260 seconds]
07:28 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
07:30 <@vpnHelper> RSS Update - forum: Manage IP addresses <http://forums.openvpn.net/topic8844.html>
07:46 -!- Fritz09 [~Fritz09@2.211.67.188] has joined #openvpn
07:56 -!- Fritz09 [~Fritz09@2.211.67.188] has quit [Quit: Bye offline]
07:57 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
07:58 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
08:18 -!- luneff [~yury@109.165.60.152] has quit [Quit: Leaving]
08:19 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
08:24 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-15.html#p15700>
08:29 -!- luneff [~yury@109.165.60.152] has joined #openvpn
08:30 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
08:30 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:36 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15701>
08:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:50 -!- mode/#openvpn [+v Axeman] by ChanServ
08:50 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
08:50 < sobersabre> hi guys.
08:50 < sobersabre> is there a way to run ovpn over blackberry ?
08:51 < krzie> no
08:51 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:51 < sobersabre> iphone ?
08:51 < krzie> !iphone
08:51 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
08:51 <@vpnHelper> iPhone and iPad.
08:52 < sobersabre> COOL!
08:52 < krzie> requires root
08:52 < sobersabre> OH.
08:52 < sobersabre> ... not very good.
08:52 < sobersabre> how about android ?
08:52 < krzie> !android
08:52 <@vpnHelper> "android" is (#1) the easiest way to get openvpn on android is to run cyanogenmod, since it comes with tun / busybox / and i think the new version even includes openvpn! or (#2) if you already have tun/root/busybox you can use android-openvpn-installer and openvpn-settings from the market
08:52 < krzie> also requires root
08:52 < krzie> whats your goal...?
08:53 < reiffert> asking some questions.
08:53 < sobersabre> krzie: I seek the Holy Grail.
08:53 < krzie> 3 bisexual girls?
08:54 < sobersabre> krzie: :) depends on their age... I'm married though...
08:54 < sobersabre> anyway, that's not the point.
08:54 < sobersabre> we're trying to deploy ovpn in the office.
08:55 < sobersabre> we already manage to do more with it than with the old CheckPoint VPN-1.
08:55 < sobersabre> (that is to connect from recent macs and linuxen)
08:55 < sobersabre> or win7 64-bit.
08:55 < pwrcycle> sobersabre: you state the obvious :)
08:55 < sobersabre> and it would be a very nice touchdown to get mobile devices working.
08:56 < krzie> i see
08:56 < krzie> personally i find android the easiest
08:56 < krzie> but you still need to be able to unlock and all
08:56 < sobersabre> unfortunately, the boss is being deviced with a back-beary. 
08:56 < sobersabre> s/black beary/
08:56 < sobersabre> the people have androids/iphones.
08:57 < sobersabre> most of them (3) wouldn't jailbreak.
08:57 < sobersabre> androids would and will.
08:57 < sobersabre> still, it is a hussle.
08:57 < pwrcycle> sobersabre: jailbreaking in an android requirement from everything i've read.
08:57 < pwrcycle> sobersabre: and if you find any program that doesn't require it, please let me know.
08:58 < sobersabre> can ovpn work without a tap/tun device on android ?
08:58 < pwrcycle> sobersabre: no. that's the thing rooting gives you.
09:01 < sobersabre> I noticed in openvpn network manager GUI it is toggleable.
09:01 < sobersabre> OK,
09:01 < sobersabre> I'll try and work it all out. thanks.
09:02 < krzie> !netman
09:02 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
09:03 < krzie> and on android you certainly need more than root
09:03 < krzie> you also need the tun module, and busybox
09:03 < krzie> however, if you just install cyanogenmod7, you are done
09:03 < krzie> in fact it has openvpn built into its gui
09:04 < krzie> (although i still choose to set it up manually via cli)
09:04 -!- master_of_master [~master_of@p57B54853.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:05 < krzie> i had to make the same decision as you, for the same reason, i went with android after checking out iphone... i think i made the right call
09:05 < krzie> i did not check out nokia support, which i hear is very nice
09:05 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
09:06 -!- master_of_master [~master_of@p57B542A8.dip.t-dialin.net] has joined #openvpn
09:06 < gladiatr> krzie, I went cli for android as well.  Either the built-in openvpn support for C7 is buggy or I just have no patience for gui b.s.
09:07 < krzie> both i would say
09:07 < krzie> they *really* need to add "import config from file"
09:08 < gladiatr> somethin'
09:08 < krzie> [10:10]  <krzie> dear cyanogenmod team:  please modify your "add vpn" support for openvpn to add "import config from file".  Thank you.  -OpenVPN team
09:08 < krzie> lol, ive requested that so many times
09:08 < reiffert> fork()
09:09 < gladiatr> haha
09:09 -!- albech [~albech@183.88.64.187] has joined #openvpn
09:13 <@vpnHelper> RSS Update - forum: email me when openvpn client connects <http://forums.openvpn.net/topic8841.html#p15702>
09:13 -!- W4lth3r [~W4lth3r@chaosarmy.org] has joined #openvpn
09:13 < W4lth3r> !goal
09:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:18 <@vpnHelper> RSS Update - forum: Subnets <http://forums.openvpn.net/topic8820.html#p15703>
09:21 < reiffert> My goal is learn as much as possible to formulate my goal.
09:23 < reiffert> enter 9999999..99999999999999999999999 on google
09:26 < W4lth3r> krzee: [16:19] <DrLoonacy> dear OpenVPN team:  CyanogenMod is open source.  We look forward to your patch.  Thank you. -Me.
09:29 < gladiatr>  /sigh
09:32 < ecrist> hahahaha
09:39 -!- molmox [~molmox@80.82.22.10] has quit [Read error: Connection reset by peer]
09:39 -!- molmox [~molmox@80.82.22.10] has joined #openvpn
09:40 -!- molmox_ [~molmox@80.82.22.10] has joined #openvpn
09:40 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
09:43 -!- anandvenkat4 [~anandvenk@206.222.164.150] has joined #openvpn
09:44 < krzie> hahahaha i didnt see that
09:44 -!- molmox [~molmox@80.82.22.10] has quit [Ping timeout: 258 seconds]
09:46 -!- asio_ [~asio@195.20.207.173] has left #openvpn []
09:47 -!- molmox__ [~molmox@80.82.22.10] has joined #openvpn
09:47 -!- molmox_ [~molmox@80.82.22.10] has quit [Read error: Connection reset by peer]
09:48 -!- molmox_ [~molmox@80.82.22.10] has joined #openvpn
09:48 -!- anandvenkat4 [~anandvenk@206.222.164.150] has quit [Ping timeout: 252 seconds]
09:49 -!- molmox_ [~molmox@80.82.22.10] has quit [Read error: Connection reset by peer]
09:49 -!- molmox__ [~molmox@80.82.22.10] has quit [Read error: Connection reset by peer]
09:49 -!- molmox [~molmox@80.82.22.10] has joined #openvpn
09:50 -!- molmox [~molmox@80.82.22.10] has quit [Read error: Connection reset by peer]
09:50 -!- molmox [~molmox@80.82.22.10] has joined #openvpn
09:51 -!- molmox_ [~molmox@80.82.22.10] has joined #openvpn
09:55 -!- molmox [~molmox@80.82.22.10] has quit [Ping timeout: 258 seconds]
10:01 <@vpnHelper> RSS Update - forum: STOP "Need IPv6 code in mroute_extract_addr_from_packet" ??? <http://forums.openvpn.net/topic8833.html#p15704>
10:11 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Quit: Bye offline]
10:18 -!- molmox_ [~molmox@80.82.22.10] has quit [Remote host closed the connection]
10:19 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html>
10:21 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
10:27 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
10:28 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
10:33 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
10:34 -!- guest7641 [~nobody@openvpn-p0-101.triple-a.uni-kl.de] has joined #openvpn
10:41 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Quit: Bye offline]
10:46 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Ping timeout: 252 seconds]
10:47 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
10:55 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has joined #openvpn
10:57 < Shinigami-Sama> krzee: looks like that solution I thought of wont work
10:58 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:58 -!- mode/#openvpn [+o raidz] by ChanServ
10:59 -!- gardar_ [~gardar@gardar.net] has quit [Quit: bye!]
11:00 -!- gardar [~gardar@gardar.net] has joined #openvpn
11:00 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
11:01 -!- gardar [~gardar@gardar.net] has joined #openvpn
11:04 -!- dazo is now known as dazo_afk
11:09 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has joined #openvpn
11:10 -!- anandvenkat4 [~anandvenk@206.222.164.136] has joined #openvpn
11:10 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has quit [Changing host]
11:10 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:16 -!- anandvenkat4 [~anandvenk@206.222.164.136] has quit [Ping timeout: 276 seconds]
11:21 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
11:23 -!- buntfalke_ [~nobody@188-194-184-97-dynip.superkabel.de] has joined #openvpn
11:24 -!- buntfalke_ is now known as Guest1534
11:24 -!- Guest1534 [~nobody@188-194-184-97-dynip.superkabel.de] has quit [Read error: Connection reset by peer]
11:27 -!- guest7641 [~nobody@openvpn-p0-101.triple-a.uni-kl.de] has quit [Ping timeout: 260 seconds]
11:30 -!- anandvenkat4 [~anandvenk@206.222.164.190] has joined #openvpn
11:38 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:41 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:41 -!- anandvenkat4 [~anandvenk@206.222.164.190] has quit [Ping timeout: 260 seconds]
11:44 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
12:06 -!- jhendricks [~jhendrick@adsl-76-204-8-234.dsl.klmzmi.sbcglobal.net] has joined #openvpn
12:07 -!- luneff [~yury@109.165.60.152] has quit [Quit: Leaving]
12:26 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
12:41 -!- albech [~albech@183.88.64.187] has quit [Remote host closed the connection]
12:43 -!- anandvenkat4 [~anandvenk@206.222.164.141] has joined #openvpn
12:49 -!- anandvenkat4 [~anandvenk@206.222.164.141] has quit [Ping timeout: 260 seconds]
12:56 < jhendricks> Hello all.  I'm having an issue with openvpn connection. The error is and my client config file is here: http://www.pastie.org/2558803.  Unfortunately, the certificates were generated by a 3rd party so I currently do not have access to the server config file.  I'm running Ubuntu 9.10 with openvpn 2.1 as my client trying to connect to a windows server.  Any thoughts?
12:59 < jhendricks> I've tried verifying the certificates using 'openssl verify' and everything returned 'OK'
13:03 -!- EugeneKay [eugenekay@itvends.com] has quit [Ping timeout: 263 seconds]
13:15 -!- EugeneK [eugenekay@itvends.com] has joined #openvpn
13:15 -!- EugeneK is now known as EugeneKay
13:18 <@vpnHelper> RSS Update - forum: Is it possible to install OpenVPN server on Win 2008 Server? <http://forums.openvpn.net/topic8825.html#p15706>
13:19 -!- p3rror [~mezgani@41.248.108.150] has joined #openvpn
13:22 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Quit: Bye offline]
13:24 < ecrist> jhendricks: it looks like the certs don't verify
13:24 < ecrist> verb 5 and full logs might help
13:27 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
13:29 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Remote host closed the connection]
13:29 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
13:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 244 seconds]
13:43 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Quit: Bye offline]
13:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:48 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:51 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:57 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
13:59 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
13:59 -!- mode/#openvpn [+o raidz] by ChanServ
13:59 <@vpnHelper> RSS Update - forum: Is it possible to install OpenVPN server on Win 2008 Server? <http://forums.openvpn.net/topic8825.html#p15708> || Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15707>
14:03 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
14:09 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
14:12 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15709>
14:16 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
14:23 -!- jerware [~jerryg@c-71-58-179-44.hsd1.pa.comcast.net] has joined #openvpn
14:23 -!- jerware [~jerryg@c-71-58-179-44.hsd1.pa.comcast.net] has left #openvpn []
14:24 -!- illuminatedwax [~iw@c-67-173-31-124.hsd1.in.comcast.net] has joined #openvpn
14:25 < jcran> Openvpn AS claims it won't work with a bridge / TAP setup for a linux client? - is that accurate? is there any documentation on why that is?
14:25 < EugeneKay> #openvpn-as
14:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:34 < ecrist> :)
14:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
14:40 < jcran> thanks :)
14:43 < jhendricks> ecrist, thank you for your response.  I did run an 'openssl verify -CAfile' on the ca.crt and the client.crt and it returned 'OK'
14:49 < ecrist> logs
14:50 < ecrist> or it didn't happen. ;)
14:50 < Essobi> no no... Stacktrace or it didn't happen.
14:50 < Essobi> corefile or GTFO! heh..
14:51 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Quit: Bye]
14:57 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
15:00 < jhendricks> http://www.pastie.org/private/0pf4oo0zb76xxtbfvpqqnq
15:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
15:17 -!- Fritz09 [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Quit: Bye]
15:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
15:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:42 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15710>
15:47 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:00 -!- jhendricks [~jhendrick@adsl-76-204-8-234.dsl.klmzmi.sbcglobal.net] has quit [Quit: Leaving]
16:00 <@vpnHelper> RSS Update - forum: question <http://forums.openvpn.net/topic8846.html>
16:18 < EugeneKay> !ipp
16:18 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
16:19 < EugeneKay> !static
16:19 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
16:21 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
16:24 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15712>
16:26 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Ping timeout: 260 seconds]
16:27 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has quit [Read error: Connection reset by peer]
16:27 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:28 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
16:28 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
16:32 -!- sabayonuser2 [~sabayonus@64.235.109.116] has quit [Ping timeout: 260 seconds]
16:42 < EugeneKay> !factoids
16:42 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:44 -!- sabayonuser2 [~sabayonus@64.235.109.116] has joined #openvpn
17:14 -!- luis_ [~luis@200.12.40.18] has joined #openvpn
17:21 -!- illuminatedwax [~iw@c-67-173-31-124.hsd1.in.comcast.net] has quit [Quit: Leaving]
17:27 -!- sabayonuser2 [~sabayonus@64.235.109.116] has quit [Ping timeout: 258 seconds]
17:31 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
17:33 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:36 -!- yell0 [yello@178.162.154.183] has quit [Ping timeout: 260 seconds]
17:38 -!- EugeneKay [eugenekay@itvends.com] has quit [Ping timeout: 260 seconds]
17:39 -!- sabayonuser2 [~sabayonus@64.235.109.116] has joined #openvpn
17:40 -!- EugeneKay [eugenekay@itvends.com] has joined #openvpn
17:51 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:59 -!- anonyan [~anonyan@cpe-098-025-227-225.sc.res.rr.com] has joined #openvpn
18:00 < anonyan> Hi, can someone help me set up my vpn?  im on linux mint.
18:01 < anonyan> I am using vpntunnel.se. i downloaded the conf files (dont see any .crt) and i put them all in the etc/openvpn folder but it doesnt seem to work.
18:01 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
18:06 < anonyan> when i try to add the .conf file in the network manager it says it contains no recognized vpn instructions
18:06 -!- Shinigami-Sama [~pewpew@unaffiliated/setsuna-xero] has quit [Ping timeout: 252 seconds]
18:09 < reiffert> !nm
18:09 < reiffert> !ubuntu
18:09 <@vpnHelper> "ubuntu" is dont use network manager!
18:10 < anonyan> what?
18:10 < reiffert> !factoid search manager
18:10 < reiffert> !factoid search --values manager
18:10 < reiffert> !factoids search --values manager
18:10 <@vpnHelper> 'ubuntu', 'netman', and 'win2k8'
18:10 < reiffert> !factoids search manager
18:10 <@vpnHelper> No keys matched that query.
18:11 < reiffert> !netman
18:11 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
18:11 < anonyan> well how do i get openvpn to work?
18:11 < anonyan> im on linux mint
18:12 < reiffert> !HOWTO
18:12 <@vpnHelper> "HOWTO" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:12 < anonyan> it says my .conf files contain no info
18:13 < reiffert> !netman
18:13 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
18:22 < reiffert> https://www.vpntunnel.se/tmp/howto-Linux.pdf
18:27 -!- anonyan [~anonyan@cpe-098-025-227-225.sc.res.rr.com] has quit [Remote host closed the connection]
18:37 -!- sabayonuser2 [~sabayonus@64.235.109.116] has quit [Remote host closed the connection]
18:47 <@vpnHelper> RSS Update - forum: Split Tunnel <http://forums.openvpn.net/topic8823.html#p15714> || how to change MTU size in OpenVPN Access Server <http://forums.openvpn.net/topic8783.html#p15713>
18:53 <@vpnHelper> RSS Update - forum: Auto-connect client at windows start <http://forums.openvpn.net/topic8541.html#p15716> || http service stops after 2-3 days of working on public ip <http://forums.openvpn.net/topic8702.html#p15715>
19:01 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:04 -!- p3rror [~mezgani@41.248.108.150] has quit [Read error: Connection reset by peer]
19:04 <@vpnHelper> RSS Update - forum: wrong "connected since" time in Server <http://forums.openvpn.net/topic8785.html#p15484>
19:07 -!- bitterman [~yury@84.51.192.74] has joined #openvpn
19:10 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 276 seconds]
19:13 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 244 seconds]
19:14 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 244 seconds]
19:15 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
19:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
19:20 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
19:21 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
19:26 -!- Squidy [~quassel@189.72.212.169] has joined #openvpn
19:26 -!- Squidy [~quassel@189.72.212.169] has quit [Changing host]
19:26 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:33 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:52 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
19:54 -!- Squidy [~quassel@189.72.212.169] has joined #openvpn
19:54 -!- Squidy [~quassel@189.72.212.169] has quit [Changing host]
19:54 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:59 -!- _julian_ [~quassel@hmbg-4d06a534.pool.mediaWays.net] has joined #openvpn
20:03 -!- _julian [~quassel@hmbg-5f7646aa.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
20:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:15 -!- mode/#openvpn [+v Axeman] by ChanServ
20:20 -!- Guest8738 [~caesay@socialshock.net] has left #openvpn []
20:20 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
20:32 -!- knightrage [~kevin@2001:470:e074::1] has joined #openvpn
20:44 -!- TyL3R [~c4t4t4u@187.113.112.35] has joined #openvpn
20:45 < TyL3R> Hey everybody! I'd like some help regarding the pull configs on the client. What are the clauses necessary to permit my client to pull wan connection from the server?
20:46 < TyL3R> The server is already configured with push "redirect-gateway" and push "dhcp-option DNS x.x.x.x"
20:47 < TyL3R> But I can't seem to connect from within my clients... Some friend told me I'd need to set some pull clauses within the client.
20:47 < TyL3R> And I need to nat within iptables. Can anybody help me with these issues?
21:01 < TyL3R> ?
21:01 < krzee> if your client has the config option "client" then it does pull
21:01 < krzee> !redirect
21:01 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
21:03 < Dougy> krzee: 
21:03 < Dougy> there?
21:03 < krzee> dougy!
21:03 < krzee> sent?
21:03 < Dougy> yup
21:03 < Dougy> see pm
21:03 < krzee> yay!
21:03 < Dougy> sending now
21:03 < krzee> <3
21:12 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
21:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
21:16 < jeev> HOMOES
21:16 < jeev> woops
21:16 < jeev> -E
21:16 < TyL3R> Yeah! I searched for the natting procedure within iptables and everything worked.
21:16 < TyL3R> :D
21:17 < jeev> glad i could help.
21:17 < TyL3R> :D
21:17 < TyL3R> Thank jeev !
21:19 < krzee> lol
21:19 < krzee> the bot tried to help
21:20 < krzee> !nat
21:20 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
21:20 < krzee> !linnat
21:20 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
21:20 < krzee> ;]
21:20 < jeev> always trying to take credit.
21:22 -!- TyL3R [~c4t4t4u@187.113.112.35] has left #openvpn ["I'm off!"]
21:22 < Dougy> jeev: krzee will stfu now
21:22 < Dougy> lol
21:22 < Dougy> i sorted him out
21:23 < jeev> thank god, i was about to op up and take care of him.
21:23 < jeev> felt bad.
21:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:29 -!- EugeneKay is now known as EugeneKaway
21:45 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 240 seconds]
21:47 < krzie> heh
21:48 < ecrist> sup bitches
21:49 < krzie> wadddddup
21:55 < knightrage> yo
22:00 < EugeneKaway> Shhh, I'm pretending to sleeep
22:00 < jeev> DADT is about to end, krzie is about to jump in excitement.
22:15 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has joined #openvpn
22:20 -!- Balrog_ [~Balrog@76-14-152-75.rk.wavecable.com] has joined #openvpn
22:21 < Balrog_> Is anyone around that knows a bit about security issues and privacy through VPN?
22:28 < krzie> !ask
22:28 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
22:31 < Balrog_> In light of the above, does anyone know if FTP/SFTP packets are routed through OpenVPN automatically? And if so, does this render them entirely secure and unsniffable?
23:05 -!- linuxpc1 [~linuxpc1@202.131.123.66] has joined #openvpn
23:05 -!- linuxpc1 [~linuxpc1@202.131.123.66] has quit [Remote host closed the connection]
23:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
23:41 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
23:41 -!- Olipro is now known as Guest89460
23:48 -!- Guest89460 [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Ping timeout: 260 seconds]
23:51 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
--- Day changed Tue Sep 20 2011
00:00 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
00:07 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:17 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
00:17 -!- bitterman is now known as luneff
00:18 -!- ipl31 [~quassel@75.103.61.58] has joined #openvpn
00:19 < ipl31> Anyone have issues with OSX lion blowing away routes from the routing table
00:20 < Essobi> nope
00:21 < ipl31> it seems like if I set redirect gateway for non split tunnel its fine
00:21 < ipl31> but if I remove that line from the config, the routes for the remote net get set
00:22 < ipl31> then deleted
00:32 -!- Olipro_ is now known as Olipro
00:35 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
00:36 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:49 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:53 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
01:32 < hyper_ch> krzee: http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/
01:32 <@vpnHelper> Title: Hackers break SSL encryption used by millions of sites • The Register (at www.theregister.co.uk)
01:47 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:50 <@vpnHelper> RSS Update - forum: Split Tunnel <http://forums.openvpn.net/topic8823.html#p15717>
02:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
02:21 <@vpnHelper> RSS Update - forum: Bridging Mode <http://forums.openvpn.net/topic8847.html>
02:26 < Mowee> Morning
02:26 <@vpnHelper> RSS Update - forum: Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html#p15719>
02:29 -!- unspin [~merp@S010600900b1cc466.vc.shawcable.net] has joined #openvpn
02:31 -!- lazzer_ is now known as lazzer
02:32 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 252 seconds]
02:34 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
02:34 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
02:34 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
02:38 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
02:40 -!- dazo_afk is now known as dazo
03:12 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:12 -!- Section58 [~Steve@93.89.80.183] has joined #openvpn
03:13 < Section58> !welcome
03:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:14 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
03:15 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
03:24 -!- oomkoos [~chatzilla@196-215-108-158.dynamic.isadsl.co.za] has quit [Remote host closed the connection]
03:26 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
03:39 -!- nameless` [~nameless`@lav35-1-82-236-136-20.fbx.proxad.net] has joined #openvpn
03:57 -!- nameless` [~nameless`@lav35-1-82-236-136-20.fbx.proxad.net] has left #openvpn []
03:59 -!- merps_ [~merp@S010600900b1cc466.vc.shawcable.net] has joined #openvpn
04:02 -!- ksk [ksk@im.knubz.de] has joined #openvpn
04:02 < ksk> hello openvpn ppl :)
04:02 -!- unspin [~merp@S010600900b1cc466.vc.shawcable.net] has quit [Ping timeout: 260 seconds]
04:03 < ksk> is there a way to >use< (not install) openvpn on win7 without admin rights? ( it was possible with winxp iirc )
04:04 -!- merps_ is now known as unspin
04:15 < reiffert> !factoids search --values permissions
04:15 <@vpnHelper> No keys matched that query.
04:16 < reiffert> !factoids search --values admin
04:16 <@vpnHelper> 'win_noadmin', 'certs', 'solaris', 'crl', 'winroute', 'quietopenssl', 'dh', 'vista', 'win2k8', 'ssl-admin', 'winroute', '', and 'basic'
04:16 < reiffert> !win_noadmin
04:16 <@vpnHelper> "win_noadmin" is (#1) http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin-Rev1.1.html for HowTo Run OpenVPN as a non-admin user in Windows or (#2) and http://article.gmane.org/gmane.network.openvpn.user/24873 for vista
04:16 < reiffert> !''
04:16 < reiffert> !
04:16 < reiffert> !win2k8
04:16 <@vpnHelper> "win2k8" is Server 2008 assigns the OpenVPN TAP Adapter v9 as an Unidentified network which the default Local Security Policy of Server 2008 assigns as being a Public Interface with restricted access. To fix it do this: Go into Control Panel / Administrative Tools / Local Security Policy / Network List Manager Policies / Unidentified Networks. Set Location Type to Private.
04:17 < reiffert> !basic
04:17 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
04:17 < reiffert> !winroute
04:17 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file or (#2) many users also report it helps to add route-delay to give the interface extra time to get up or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access or (#4) make sure you are running openvpn as admin or (#5) http://openvpn.net/index.php/open-
04:17 <@vpnHelper> source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
04:23 < ksk> okay, thanks
04:34 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:34 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:47 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:48 -!- unspin [~merp@S010600900b1cc466.vc.shawcable.net] has quit [Ping timeout: 258 seconds]
05:01 -!- unspin [~merp@S010600900b1cc466.vc.shawcable.net] has joined #openvpn
05:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
05:17 -!- unspin [~merp@S010600900b1cc466.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
05:19 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15720>
05:39 -!- luneff [~yury@109.165.59.182] has joined #openvpn
05:49 -!- dazo is now known as dazo_afk
05:54 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
06:01 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
06:07 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has quit [Quit: La vérité, c'est que tu es mou et paresseux. Tout le portrait de mon oncle Émile : celui-là, il passait jamais au soleil parce que ça le fatiguait de traîner son ombre.]
06:07 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
06:07 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
06:11 -!- ajacob [~ajacob@taurine.csclub.uwaterloo.ca] has quit [Ping timeout: 258 seconds]
06:13 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
06:14 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:17 < Section58> is there some sort of bridge mesh server to server setup ?
06:18 < Section58> i think i am wanting to bond 2 openvpn interfaces
06:20 < reiffert> !factoids search --values mesh
06:20 <@vpnHelper> "mesh" is (#1) openvpn does not do mesh networking or (#2) see !rip
06:20 -!- ksk [ksk@im.knubz.de] has quit [Quit: Lost terminal]
06:20 < reiffert> !factoids search --values bridge
06:20 <@vpnHelper> 'samba', 'tap', 'bridge-dhcp', 'bridge', 'bridge', 'ebtables', and 'bridge-fw'
06:20 < reiffert> !brdige
06:20 < reiffert> !bridge
06:20 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
06:27 -!- ajacob [~ajacob@taurine.csclub.uwaterloo.ca] has joined #openvpn
06:36 < hyper_ch> hi reiffert
06:36 < hyper_ch> has anyone seen my krzee?
06:38 < reiffert> !seen krzie 
06:38 < Jikan> krzie!nobody@openvpn/community/support/krzee a été vu(e) pour la dernière fois le mar. 20 sept. 2011 à 13:01:33 rejoignant #openvpn
06:38 <@vpnHelper> krzie was last seen in #openvpn 8 hours, 9 minutes, and 23 seconds ago: <krzie> !ask
06:38 < reiffert> !seen krzee
06:38 <@vpnHelper> krzee was last seen in #openvpn 9 hours, 18 minutes, and 3 seconds ago: <krzee> ;]
06:38 < Jikan> krzee a été vu(e) pour la dernière fois le lun. 19 sept. 2011 à 01:44:32 parlant sur #openvpn
06:38 < reiffert> hyper_ch: he's asleep.
06:39 < hyper_ch> 9h sleep? he only needs like 2h or something :)
06:39 < hyper_ch> reiffert: thx for the info
06:39 < reiffert> hyper_ch: krzee and two pretty girls ..
06:39 < hyper_ch> did you read the SSL/TLS vulnerability?
06:40 < hyper_ch> read about
06:40 < reiffert> na, openvpn-devel?
06:40 < reiffert> mailinglist?
06:40 < hyper_ch> reiffert: http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/
06:40 <@vpnHelper> Title: Hackers break SSL encryption used by millions of sites • The Register (at www.theregister.co.uk)
06:41 < hyper_ch> we're all gonna die                  (.... some day)
06:45 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
06:54 <@vpnHelper> RSS Update - forum: lan address range question <http://forums.openvpn.net/topic8848.html>
06:57 -!- Fritz09 [~Fritz09@46.115.1.149] has joined #openvpn
06:59 -!- Fritz09 [~Fritz09@46.115.1.149] has quit [Client Quit]
06:59 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 260 seconds]
07:03 -!- Fritz09 [~Fritz09@46.115.1.149] has joined #openvpn
07:06 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15723>
07:16 < cherwin> I'm getting really tired about all the SSL commotion.
07:17 <@vpnHelper> RSS Update - forum: lan address range question <http://forums.openvpn.net/topic8848.html#p15724>
07:18 -!- jhendricks [~jhendrick@adsl-76-204-8-234.dsl.klmzmi.sbcglobal.net] has joined #openvpn
07:22 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
07:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
07:35 -!- itai [~itai@75.125.151.194] has joined #openvpn
07:38 < itai> hi there, quick question, im running openvpn on ubuntu and would like to automate the login process with a script basically the script will cd to the /etc/opnvpn then run the program as super user a terminal will open for me to input my superuser password and then the script will take care of the username and password bit. I have no experience with bash, can anyone help direct me on how to let the script fill in the username and  password for me ?
07:41 < cherwin> itai: You could use expect, but why go through the hassle if you can just remove the password on your keyfile.
07:41 < ecrist> --enable-passwd-save during compile, and the user/pass can be saved to a file
07:41 -!- Fritz09 [~Fritz09@46.115.1.149] has quit [Quit: Bye]
07:42 < itai> cherwin, what do you mean by "remove the password on your keyfile" 
07:42 < itai> ?
07:42 < Section58> is it possible to bridge 2 openvpn adaptors
07:42 < Section58> without ethernet involed, or maybe if needed a 3 way
07:43 < ecrist> Section58: sure
07:43 < Section58> as the tuts i have seen all show ethernet bonding
07:43 < cherwin> itai: Just like I said, remove the password.
07:43 < Section58> and i don't have a ethernet card in that machine that i want to bond
07:43 < cherwin> itai: With openssl.
07:43 < itai> cherwin, the password is for a paid service
07:44 < itai> openvpn is the client
07:45 < cherwin> itai: Never mind.
07:47 < ecrist> cherwin: he's not talking about encrypted ssl keys
07:48 < ecrist> itai: see --auth-user-pass in the man page
07:49 < itai> ecrist,  the man page for what ?
07:49 < ecrist> Section58: I don't really care what you've seen in 'tuts' you can bridge tap interfaces the same as ethernet or wifi interfaces
07:49 < ecrist> itai: for openvpn
07:49 < itai> ok
07:49 < ecrist> what else
07:49 < itai> thanks
07:49 < itai> it's better to ask...
07:49 < cherwin> ecrist: Yeah, thought so.
07:49 < ecrist> well, you *are* in #openvpn
07:55 < itai> ecrist, from the man "OpenVPN will only read  passwords  from  a  file  if  it  has  been built with the  --enable-password-save configure option," can you tell me what does that mean?
07:55 < hyper_ch> hi ecrist
07:59 < itai> also should the username password be in this format : Xauth username ${MyName} Xauth password ${MyPlaintextPassword} ?
08:03 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
08:08 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:09 -!- mode/#openvpn [+v Axeman] by ChanServ
08:09 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has joined #openvpn
08:10 -!- itai [~itai@75.125.151.194] has quit [Ping timeout: 260 seconds]
08:11 < Section58> ecrist: thank you for your time, i think that was the kick i needed to find the right one
08:15 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
08:17 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:18 -!- Axeman [~Axeman3@openvpn/user/axeman] has left #openvpn ["Leaving"]
08:19 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
08:23 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
08:24 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
08:24 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
08:26 <@vpnHelper> RSS Update - forum: Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html#p15725>
08:29 < jhendricks> Hello.  I am getting a VERIFY ERROR self signed certificated in certificate chain when trying to connect to a windows server.  The certificates were generated by a 3rd party, so I do not have access to the server config file.  I think it may be an issue with the certificate, but I ran an openssl verify and everything returned ok.  The log and client config file are here: http://www.pastie.org/private/8een1syyvgoxupaypxe1
08:29 < jhendricks> w.  Any feedback would be appreciated.
08:30 < jhendricks> Bah... the link broke... here is the link to my log and client config files: http://www.pastie.org/private/8een1syyvgoxupaypxe1w
08:36 < ecrist> jhendricks: upgrade your client version
08:37 < ecrist> !verify
08:37 < ecrist> !factoids search verify
08:37 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
08:38 < ecrist> do that, and show me the output
08:39 < jhendricks> client.crt: OK
08:41 < ecrist> and for the server cert?
08:41 < jhendricks> I was not given a server.crt file, I was only given a ca.cert, client.crt, and client.key
08:43 < ecrist> it appears as though the ca certificate you have isn't what signed the client certificate
08:44 < ecrist> and if you're not the admin for the server, we cannot help you.
08:44 < ecrist> contact your admin
08:44 < jhendricks> Ok, will do.  Thank you
08:46 -!- nb [~nb@fedora/nb] has quit [Ping timeout: 260 seconds]
08:50 -!- dazo_afk is now known as dazo
08:56 -!- Guest4277 [~nb@delta.nb.tc] has joined #openvpn
09:01 -!- master_of_master [~master_of@p57B542A8.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:01 <@vpnHelper> RSS Update - forum: Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html#p15726>
09:03 -!- raomin__ is now known as raomin
09:05 -!- master_of_master [~master_of@p57B5410F.dip.t-dialin.net] has joined #openvpn
09:32 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
09:43 -!- Holos [~cosmond@209.222.51.250] has joined #openvpn
09:43 < Holos> Can OpenVPN support a routed IPSec tunnel? or only OpenVPN tunnels?
09:47 < ecrist> only openvpn 
09:48 < Holos> ok.. so I guess it's openswan then.. Thanks
09:51 < ecrist> no problem.
09:51 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
09:52 -!- luis_ [~luis@200.12.40.18] has quit [Quit: Leaving]
09:53 -!- corretico [~luis@200.12.40.18] has joined #openvpn
09:53 -!- corretico [~luis@200.12.40.18] has quit [Read error: Connection reset by peer]
09:55 < cpm> good luck with that. 
09:55 -!- corretico [~luis@200.12.40.18] has joined #openvpn
09:56 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
09:57 -!- corretico_ [~luis@200.12.40.18] has joined #openvpn
09:58 -!- corretico [~luis@200.12.40.18] has quit [Client Quit]
09:58 -!- corretico_ [~luis@200.12.40.18] has quit [Read error: Connection reset by peer]
09:59 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:01 -!- corretico [~luis@200.12.40.18] has joined #openvpn
10:01 -!- corretico [~luis@200.12.40.18] has quit [Read error: Connection reset by peer]
10:02 -!- corretico [~luis@200.12.40.18] has joined #openvpn
10:12 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:18 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15727>
10:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:22 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
10:25 -!- luneff [~yury@109.165.59.182] has quit [Quit: This computer has gone to sleep]
10:28 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Read error: Operation timed out]
10:37 -!- dazo is now known as dazo_afk
10:48 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 260 seconds]
10:53 -!- Section58 [~Steve@93.89.80.183] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:57 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
11:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
11:04 -!- luneff [~yury@84.51.192.74] has joined #openvpn
11:06 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
11:10 -!- Lantizia [~Lantizia@cpc22-stok16-2-0-cust96.1-4.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
11:10 -!- Lantizia [~Lantizia@cpc22-stok16-2-0-cust96.1-4.cable.virginmedia.com] has joined #openvpn
11:12 -!- anandvenkat4 [~anandvenk@206.222.164.185] has joined #openvpn
11:13 < anandvenkat4> Hi Room, this may be out of room question, but I do not find any forums to ask this, I need to implement PPTP tunnel VPN programatically
11:13 < anandvenkat4> Any help on this would be highly appreciated
11:15 < Bushmills> !pptp
11:15 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
11:15 <@vpnHelper> read about why to not use pptp or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
11:16 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:20 < anandvenkat4> !pptp
11:20 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
11:20 <@vpnHelper> read about why to not use pptp or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
11:27 -!- anandvenkat4 [~anandvenk@206.222.164.185] has quit [Remote host closed the connection]
11:33 -!- EugeneKaway is now known as EugeneKaw
11:35 -!- EugeneKaw is now known as EugeneKay
11:36 -!- Holos [~cosmond@209.222.51.250] has left #openvpn []
11:43 <@vpnHelper> RSS Update - forum: How can I automate the ./build-ca and ./build-key scripts? <http://forums.openvpn.net/topic8849.html>
11:48 -!- corretico [~luis@200.12.40.18] has quit [Read error: Connection reset by peer]
11:50 -!- newmember [~chatzilla@d50-99-28-232.abhsia.telus.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
11:54 -!- W4lth3r is now known as uname-a0911
11:56 -!- uname-a0911 is now known as W4lth3r
12:09 -!- phunyguy [~phunyguy@159.178.100.253] has joined #openvpn
12:13 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
12:20 -!- luneff [~yury@84.51.192.74] has quit [Read error: Connection reset by peer]
12:21 -!- MarKsaitis [~MarKsaiti@85-189-201-83.tmbsystems.managedbroadband.co.uk] has joined #openvpn
12:21 -!- luneff [~yury@84.51.192.74] has joined #openvpn
12:22 -!- MarKsaitis [~MarKsaiti@85-189-201-83.tmbsystems.managedbroadband.co.uk] has quit [Client Quit]
12:25 -!- iruvtacos [465a3e25@gateway/web/freenode/ip.70.90.62.37] has joined #openvpn
12:29 < iruvtacos> !logs
12:29 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
12:30 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:31 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
12:31 -!- mode/#openvpn [+v Axeman] by ChanServ
12:56 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
12:57 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 240 seconds]
12:58 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
13:01 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
13:03 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
13:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
13:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:12 -!- Fritz09_ [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
13:12 -!- Fritz09_ [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Client Quit]
13:15 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 240 seconds]
13:16 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
13:26 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
13:29 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
13:43 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15729>
13:51 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
13:55 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15730>
13:58 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
14:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:01 <@vpnHelper> RSS Update - forum: Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html#p15732> || How can I automate the ./build-ca and ./build-key scripts? <http://forums.openvpn.net/topic8849.html#p15731>
14:05 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has quit [Ping timeout: 240 seconds]
14:05 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
14:19 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:19 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
14:19 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
14:19 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:22 -!- forerunner [~forerunne@63.141.241.2] has joined #openvpn
14:23 < forerunner> how can i install AS
14:23 < ecrist> !as
14:23 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
14:24 < forerunner> ty
14:24 <@vpnHelper> RSS Update - forum: Client to Internal Server VPN to External VPN <http://forums.openvpn.net/topic8745.html#p15733>
14:25 -!- anonyan [~anonyan@cpe-098-025-227-225.sc.res.rr.com] has joined #openvpn
14:26 < anonyan> can someone help me get my vpn to work in linux mint? I followed the guide but when i issue the command to start openvpn it says error opening the conf file.
14:29 -!- jonnyATroot [~honzik@90.183.82.215] has joined #openvpn
14:33 < arosen> anonyan: what are the file permissions? try running it as root 
14:34 < anonyan> i just did Sudo gedit etc/openvpn/openvpn.conf and it opened the file but the file is empty
14:34 < Bushmills> then you want to write something into it
14:34 < anonyan> the conf file on the website has like 5 conf files in it should i put them all in the openvpn folder? or just one of them?
14:35 < anonyan> the guide says to just move it to the openvpn folder
14:35 < Bushmills> you need exactly one config file
14:35 < arosen> you either have the config for server or client ending on end point
14:36 < anonyan> hmm
14:38 < anonyan> there is a conf file and another one named update-resolv-conf
14:38 < anonyan> and a folder with ca.crt in it named keys
14:39 < Bushmills> !howto
14:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:39 -!- Champi [Champi@rootshell.fr] has joined #openvpn
14:41 -!- Balrog_ [~Balrog@76-14-152-75.rk.wavecable.com] has quit [Ping timeout: 260 seconds]
14:45 -!- jonnyATroot [~honzik@90.183.82.215] has quit [Ping timeout: 260 seconds]
14:50 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
14:53 -!- iruvtacos [465a3e25@gateway/web/freenode/ip.70.90.62.37] has quit [Ping timeout: 252 seconds]
14:53 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Ping timeout: 252 seconds]
14:53 -!- Ionic_ [~genericfa@vpn.ionic.de] has joined #openvpn
14:53 < Ionic_> Hi
14:53 < Ionic_> Just to make sure, there is no way to push DNS servers to clients OS-independant, right?
14:54 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
14:54 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
15:02 < Olipro> Ionic_: with a tun interface? no
15:02 < Olipro> tap? yes, use a DHCP server
15:06 < Ionic_> Yeah tun
15:08 < Ionic_> There is this Windows push option
15:09 < Ionic_> But that's it as far as I could find out
15:09 < Ionic_> Every other OS has to handle this in a custom up script
15:09 -!- crow [~crowmo@84.112.79.173] has joined #openvpn
15:09 < Ionic_> Which is kinda sucky on OS X because non-trivial
15:10 < krzee> i bet tunnelblick has a script bundled in it that does that
15:10 < krzee> i wouldnt know, i dont use tunnelblick nor do i push dns
15:10 < Ionic_> Probably
15:10 < Ionic_> Neither do I
15:10 < krzee> but if i needed it, ild look into that
15:10 < Ionic_> I rather wrote my own launchd script to start OpenVPN :)
15:11 -!- forerunner [~forerunne@63.141.241.2] has quit [Ping timeout: 255 seconds]
15:11 < krzee> as did i
15:12 < krzee> i usually have 5 vpns running on my laptop
15:12 < Ionic_> Hehe, what for? Work and stuff?
15:17 -!- gryzli [~gryzli@94.155.42.130] has joined #openvpn
15:17 < krzee> work and play
15:17 < krzee> for secure links into places ;]
15:20 -!- corretico [~luis@200.12.40.18] has joined #openvpn
15:21 < Ionic_> Hmm ok :P
15:22 < Ionic_> Sounds dark
15:22 < Ionic_> Or at least grey
15:33 -!- anonyan [~anonyan@cpe-098-025-227-225.sc.res.rr.com] has quit [Quit: Leaving]
15:42 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15734>
15:42 < krzee> nah
15:54 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
16:01 -!- jhendricks [~jhendrick@adsl-76-204-8-234.dsl.klmzmi.sbcglobal.net] has quit [Quit: Leaving]
16:04 -!- jonnyATroot [~honzik@90.183.82.215] has joined #openvpn
16:08 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:09 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:09 -!- gryzli [~gryzli@94.155.42.130] has quit [Quit: Leaving]
16:19 < EugeneKay> BLACK DEATH SLASH METAL
16:24 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
16:24 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
16:24 -!- mode/#openvpn [+o raidz] by ChanServ
16:37 -!- corretico [~luis@200.12.40.18] has quit [Remote host closed the connection]
16:42 < Essobi> EugeneKay: What kind?
16:43  * EugeneKay shrugs
16:51 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
16:53 -!- forerunner [~forerunne@63.141.241.2] has joined #openvpn
17:00 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15735>
17:04 -!- crow [~crowmo@84.112.79.173] has quit [Quit: Off]
17:04 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
17:04 < deever> hi
17:05 < deever> anyone here running openvpn inside an lxc container?
17:11 -!- arosen [~arosen@130.127.39.181] has quit [Remote host closed the connection]
17:12 < krzee> http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/
17:12 <@vpnHelper> Title: Hackers break SSL encryption used by millions of sites • The Register (at www.theregister.co.uk)
17:13 < krzee> (not ovpn related)
17:14 -!- Guest4277 [~nb@delta.nb.tc] has left #openvpn []
17:15 -!- nb [~nb@fedora/nb] has joined #openvpn
17:19 -!- forerunner [~forerunne@63.141.241.2] has quit [Ping timeout: 240 seconds]
17:26 -!- nb [~nb@fedora/nb] has quit [Changing host]
17:26 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
17:54 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 608 seconds]
18:00 -!- Roelke_ [~Roelke@hostserv.nl] has joined #openvpn
18:01 -!- lazzer_ [~lazzer@vmlinux.org] has joined #openvpn
18:03 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
18:03 -!- bassline1 [armin@irc.arje.de] has joined #openvpn
18:03 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:05 -!- naquad_ [~naquad@174.142.224.219] has joined #openvpn
18:05 <@vpnHelper> RSS Update - forum: read UDPv4: Connection reset by peer <http://forums.openvpn.net/topic8850.html>
18:07 -!- Netsplit *.net <-> *.split quits: _DexTerDDIT, Fiouz, Roelke, hyper_ch, Olipro, caemir, dxtr, inimino, decoder, Cr4zi3,  (+5 more, use /NETSPLIT to show all of them)
18:07 -!- hyper__ch is now known as hyper_ch
18:07 -!- Netsplit over, joins: caemir
18:07 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
18:07 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
18:07 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
18:07 -!- mode/#openvpn [+v novaflash] by ChanServ
18:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:11 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
18:11 -!- dxtr [s3wark@unaffiliated/dxtr] has joined #openvpn
18:11 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
18:11 -!- _DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
18:11 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
18:15 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
18:15 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
18:31 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Quit: Leaving.]
18:31 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
18:31 -!- mode/#openvpn [+o raidz] by ChanServ
18:32 -!- bassline1 is now known as bassliner
18:33 -!- ph1l [~ph1l@8-179.104-92.cust.bluewin.ch] has quit [Quit: Leaving.]
18:36 -!- Netsplit *.net <-> *.split quits: dxtr, _DexTerDDIT, Cr4zi3, Olipro, decoder, Fiouz
18:37 -!- jonnyATroot [~honzik@90.183.82.215] has quit [Ping timeout: 252 seconds]
18:39 -!- Netsplit over, joins: Olipro, decoder, dxtr, Cr4zi3, _DexTerDDIT, Fiouz
18:39 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Excess Flood]
18:40 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
18:40 -!- bassliner [armin@irc.arje.de] has quit [Quit: Reconnecting]
18:40 -!- bassliner [armin@irc.arje.de] has joined #openvpn
18:45 -!- Ionic_ [~genericfa@vpn.ionic.de] has quit [Ping timeout: 260 seconds]
18:52 <@vpnHelper> RSS Update - forum: Test <http://forums.openvpn.net/topic8346.html#p15738>
18:55 -!- Ionic_ [~genericfa@vpn.ionic.de] has joined #openvpn
18:58 <@vpnHelper> RSS Update - forum: read UDPv4: Connection reset by peer <http://forums.openvpn.net/topic8850.html#p15739>
18:59 -!- corretico [~luis@200.12.40.18] has joined #openvpn
19:00 -!- tty234 [telex@gateway/shell/anapnea.net/x-xumwsqeekoldkxyr] has quit [Ping timeout: 260 seconds]
19:01 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
19:04 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15740>
19:05 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
19:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
19:06 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
19:13 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has joined #openvpn
19:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:21 -!- tty234 [telex@gateway/shell/anapnea.net/x-bfzwryshhbtgeeno] has joined #openvpn
19:27 -!- Corey [~KB1JWQ@freenode/staff/kb1jwq] has joined #openvpn
19:28 -!- Netsplit *.net <-> *.split quits: dxtr, _DexTerDDIT, Fiouz, Cr4zi3, Olipro, decoder
19:33 -!- merpsmerp [~merp@S010600900b1cc466.vc.shawcable.net] has joined #openvpn
19:33 -!- Netsplit over, joins: Cr4zi3, decoder, dxtr, _DexTerDDIT, Fiouz
19:33 < merpsmerp> hi
19:33 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Excess Flood]
19:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:34 < merpsmerp> is there a way i can allow other local network clients to interact with another VPN client that has been configured with "redirect-gateway def1"
19:34 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
19:37 < merpsmerp> in this case the client is running OpenBSD
19:41 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
19:41 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:42 -!- Balrog_ [~Balrog@76-14-152-75.rk.wavecable.com] has joined #openvpn
19:52 -!- Squidy [~quassel@187.54.113.240] has joined #openvpn
19:52 -!- Squidy [~quassel@187.54.113.240] has quit [Changing host]
19:52 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:55 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
19:58 -!- corretico [~luis@200.12.40.18] has quit [Ping timeout: 240 seconds]
19:59 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Read error: Connection reset by peer]
20:00 -!- _julian [~quassel@hmbg-5f77c55d.pool.mediaWays.net] has joined #openvpn
20:00 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
20:00 -!- mode/#openvpn [+v novaflash] by ChanServ
20:01 -!- _julian_ [~quassel@hmbg-4d06a534.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
20:01 -!- corretico [~luis@200.12.40.18] has joined #openvpn
20:06 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has joined #openvpn
20:08 -!- corretico [~luis@200.12.40.18] has quit [Ping timeout: 258 seconds]
20:09 -!- corretico [~luis@200.12.40.18] has joined #openvpn
20:20 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
20:46 -!- merpsmerp [~merp@S010600900b1cc466.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
20:50 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:01 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
21:01 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
21:05 -!- corretico [~luis@200.12.40.18] has quit [Ping timeout: 260 seconds]
21:17 -!- Ionic_ [~genericfa@vpn.ionic.de] has quit [Ping timeout: 260 seconds]
21:31 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
21:31 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
21:31 -!- mode/#openvpn [+o raidz] by ChanServ
21:34 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:35 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:40 -!- dropje [~yge@77.166.39.78] has quit [Ping timeout: 240 seconds]
21:41 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
21:42 -!- Ionic_ [ionic@home.ionic.de] has joined #openvpn
21:46 -!- neu3no [~neu3no@love.endno.de] has quit [Read error: Connection reset by peer]
21:57 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:00 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:06 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
22:06 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 260 seconds]
22:10 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
22:12 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
22:12 -!- mode/#openvpn [+o raidz] by ChanServ
22:13 -!- corretico_ [~luis@201.201.44.82] has quit [Ping timeout: 258 seconds]
22:27 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
22:35 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
22:36 < forerunner> can we use mobile phone as a modem for desktop pc?
22:36 < forerunner> using vpn
22:41 -!- albech [~albech@183.88.64.187] has joined #openvpn
22:43 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
23:05 -!- Netsplit *.net <-> *.split quits: Optic, Cain, decoder, tty234, Fiouz, ScriptFanix, DarthGandalf, Champi, Jikan, Cr4zi3,  (+10 more, use /NETSPLIT to show all of them)
23:05 -!- Netsplit *.net <-> *.split quits: Denial, Dougy, nickzxcv, _zero_, zoidberg1, EugeneKay, UnterPerro, Rolybrau, omry, Ionic,  (+39 more, use /NETSPLIT to show all of them)
23:05 -!- Netsplit *.net <-> *.split quits: APTX, krzee, Mowee, TheRedOctober, R-66Y, caesay, _____m, EvilJStoker, chantra, rooth,  (+18 more, use /NETSPLIT to show all of them)
23:05 -!- Netsplit *.net <-> *.split quits: Lantizia, Roelke_, pranq, SJr, hyper_ch, ipl31, oc80z, naquad_, phunyguy
--- Day changed Wed Sep 21 2011
01:11 -!- albech [~albech@183.88.64.187] has joined #openvpn
01:41 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
01:42 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
01:42 -!- mode/#openvpn [+o raidz] by ChanServ
02:07 -!- trish [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:08 < trish> what is the relevance from this topic about Block outgoing NetBios 
02:08 < trish> from http://openvpn.net/index.php/open-source/documentation/miscellaneous/1xhowto.html
02:13 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has quit []
02:13 -!- trish [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
02:13 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has joined #openvpn
02:21 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
02:22 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has quit []
02:22 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has joined #openvpn
02:25 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has quit [Client Quit]
02:26 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has joined #openvpn
02:49 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
02:49 -!- _julian [~quassel@hmbg-5f77c55d.pool.mediaWays.net] has joined #openvpn
02:49 -!- bassliner [armin@irc.arje.de] has joined #openvpn
02:49 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
02:49 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
02:49 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
02:49 -!- stevefink_ [steve@shell.vaerchi.com] has joined #openvpn
02:49 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has joined #openvpn
02:49 -!- CybDev [cybdev@unaffiliated/cybdev] has joined #openvpn
02:49 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
02:49 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
02:49 -!- TheRedOctober [~administr@rrcs-24-213-178-60.nyc.biz.rr.com] has joined #openvpn
02:49 -!- R-66Y [~nobody@elegua.za.net] has joined #openvpn
02:49 -!- bragon [~Alexandre@81.93.247.165] has joined #openvpn
02:49 -!- jbb [~yeeb@184.105.219.149] has joined #openvpn
02:49 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
02:49 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
02:49 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
02:49 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
02:49 -!- ServerMode/#openvpn [+o vpnHelper] by zelazny.freenode.net
02:49 -!- stevefink_ [steve@shell.vaerchi.com] has quit [Excess Flood]
02:51 -!- stevefink_ [steve@shell.vaerchi.com] has joined #openvpn
02:51 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:51 -!- naquad_ [~naquad@174.142.224.219] has joined #openvpn
02:51 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
02:51 -!- Roelke_ [~Roelke@hostserv.nl] has joined #openvpn
02:51 -!- phunyguy [~phunyguy@159.178.100.253] has joined #openvpn
02:51 -!- Lantizia [~Lantizia@cpc22-stok16-2-0-cust96.1-4.cable.virginmedia.com] has joined #openvpn
02:51 -!- ipl31 [~quassel@75.103.61.58] has joined #openvpn
02:51 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
02:51 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
02:51 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
02:51 -!- mode/#openvpn [+v oc80z] by ChanServ
02:51 -!- stevefink_ [steve@shell.vaerchi.com] has quit [Excess Flood]
02:51 -!- luneff [~yury@84.51.192.74] has joined #openvpn
02:51 -!- corretico [~luis@201.201.44.82] has joined #openvpn
02:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:51 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:51 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
02:51 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
02:51 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
02:51 -!- master_of_master [~master_of@p57B5410F.dip.t-dialin.net] has joined #openvpn
02:51 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
02:51 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:51 -!- zoidberg1 [zoidberg@gateway/shell/xzibition.com/x-sbjgeehukikarolw] has joined #openvpn
02:51 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
02:51 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has joined #openvpn
02:51 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
02:51 -!- cherwin [1776628@xs8.xs4all.nl] has joined #openvpn
02:51 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
02:51 -!- Agin_ [~Agin@greenzone.copyleft.no] has joined #openvpn
02:51 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
02:51 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
02:51 -!- stevefink_ [steve@shell.vaerchi.com] has joined #openvpn
02:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
02:52 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
02:52 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
02:52 -!- Champi [Champi@rootshell.fr] has joined #openvpn
02:52 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
02:52 -!- knightrage [~kevin@2001:470:e074::1] has joined #openvpn
02:52 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
02:52 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
02:52 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
02:52 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
02:52 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
02:52 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
02:52 -!- Ionic [ionic@home.ionic.de] has joined #openvpn
02:52 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
02:52 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
02:52 -!- jcran [~jcran@64.125.235.2] has joined #openvpn
02:52 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
02:52 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
02:52 -!- mete [~mete@mete.shell.la] has joined #openvpn
02:52 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
02:52 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has joined #openvpn
02:52 -!- quadDamage [~EmperorTo@216.17.68.153] has joined #openvpn
02:52 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
02:52 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
02:52 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
02:52 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
02:52 -!- mode/#openvpn [+o dazo_afk] by ChanServ
02:52 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has joined #openvpn
02:52 -!- Ionic is now known as 77CAAFE42
02:52 -!- EugeneKay [eugenekay@itvends.com] has joined #openvpn
02:52 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
02:52 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
02:52 -!- dxtr [s3wark@unaffiliated/dxtr] has joined #openvpn
02:52 -!- _DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
02:52 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
02:52 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Excess Flood]
02:54 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
02:54 -!- tty234_ [telex@gateway/shell/anapnea.net/x-grtbxciefjbkixnl] has joined #openvpn
02:54 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
02:54 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
02:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:54 -!- tty234 [telex@gateway/shell/anapnea.net/x-bfzwryshhbtgeeno] has joined #openvpn
02:54 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
02:54 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
02:54 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
02:54 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has joined #openvpn
02:54 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
02:54 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
02:54 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
02:54 -!- Ionic [ionic@ionic.de] has joined #openvpn
02:54 -!- sno-_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
02:54 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
02:54 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
02:54 -!- uuuppz [~uuuppz@78.129.207.46] has joined #openvpn
02:54 -!- reiffert [~thomas@178.63.49.86] has joined #openvpn
02:54 -!- sia^pwnnt [115kluu@212.224.67.26] has joined #openvpn
02:54 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
02:54 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
02:54 -!- nickzxcv [foobar@216.218.223.115] has joined #openvpn
02:54 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
02:54 -!- tty234 [telex@gateway/shell/anapnea.net/x-bfzwryshhbtgeeno] has quit [Max SendQ exceeded]
02:57 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
02:57 <@vpnHelper> RSS Update - forum: Network is unreachable (code=101) <http://forums.openvpn.net/topic8804.html#p15747>
03:02 <@vpnHelper> RSS Update - forum: TAP not routing in Windows 7 <http://forums.openvpn.net/topic8806.html#p15748>
03:08 <@vpnHelper> RSS Update - forum: OVPN Client suddenly receiving Unexpected Error <http://forums.openvpn.net/topic8771.html#p15749>
03:14 <@vpnHelper> RSS Update - forum: Speed up Connection Re-Establish after Failure <http://forums.openvpn.net/topic8786.html#p15750>
03:20 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15752> || Help server settings <http://forums.openvpn.net/topic8791.html#p15751>
03:32 <@vpnHelper> RSS Update - forum: Network is unreachable (code=101) <http://forums.openvpn.net/topic8804.html#p15753>
03:35 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 252 seconds]
03:40 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
03:41 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
03:44 <@vpnHelper> RSS Update - forum: Bridging networks via VPS <http://forums.openvpn.net/topic8798.html#p15754>
03:52 -!- Fritz09 [~Fritz09@46.115.20.22] has joined #openvpn
03:59 -!- luneff [~yury@188.114.57.128] has joined #openvpn
04:05 -!- Fritz09 [~Fritz09@46.115.20.22] has quit [Quit: Bye]
04:05 < deever> anyone here running openvpn inside an lxc container?
04:08 -!- bitterman [~yury@188.114.57.128] has joined #openvpn
04:09 -!- mfox [~mfox@li363-58.members.linode.com] has joined #openvpn
04:09 -!- albech [~albech@183.88.64.187] has quit [Remote host closed the connection]
04:09 < mfox> hey there
04:10 < mfox> I am from Iran, so as you know there's huge censorship and MITM going on here
04:10 < mfox> so i bought a server abroad and configured OpenVPN
04:10 -!- luneff [~yury@188.114.57.128] has quit [Ping timeout: 260 seconds]
04:10 < mfox> at first i was getting TLS Handshake error
04:11 < mfox> so i assumed my ISP/Government are using Packet Inspection
04:11 < mfox> and they're detecting TLS Handshake
04:11 < mfox> then i switch to pre-shared key, static key i mean
04:11 < mfox> problem solved !
04:11 < mfox> but the second problem arrived
04:12 < mfox> i was getting nothing, DATA
04:12 < mfox> i couldn't even ping my openvpn tun IP, like 10.8.0.1
04:12 < mfox> so i changed to TCP from UDP
04:12 < mfox> it's OK now, but very slow
04:13 < mfox> ping time is like >700ms
04:13 < Olipro> what country is your server in?
04:13 < mfox> i tried UDP fragmentation, so i thought maybe ISP couldnt detect that
04:13 < Olipro> I'm going to bet it's a Linode in the USA
04:13 < mfox> but no use!
04:13 < mfox> Olipro, why betting!? you can whois my current IP address :)
04:13 < mfox> so YES
04:13 < mfox> its Linode in USA
04:14 < Olipro> mmhmm, and you're in Iran
04:14 < mfox> yup,
04:14 -!- bitterman is now known as luneff
04:14 < mfox> by pinging my linode server IP address
04:14 < mfox> i get ping time ~200ms
04:14 < Olipro> there is something for OpenVPN
04:14 < Olipro> that will encapsulate the packets in ICMP
04:15 < Olipro> you may wish to try it
04:15 < mfox> can you provide a link of doc or HOWTO ?
04:15 < Olipro> google it
04:15 < mfox> kk
04:15 < Olipro> it's not well documented
04:17 < Olipro> mfox: you may also wish to try using UDP port 53
04:17 < Olipro> that's for DNS requests
04:17 < mfox> i did, but the same
04:17 < Olipro> TCP 443?
04:18 < mfox> any ports are alike, but 80/tcp seems to be faster
04:18 < mfox> that encapsulation over ICMP seems legit
04:19 -!- gryzli [~gryzli@91.92.162.66] has joined #openvpn
04:19 < Olipro> http://svn.cmeerw.net/src/icmptransd/trunk/
04:19 <@vpnHelper> Title: src - Revision 880: /icmptransd/trunk (at svn.cmeerw.net)
04:21 < mfox> Olipro, is this kind of plugin ?
04:21 < Olipro> I have no idea, I've never used it
04:22 < mfox> seems standalone
04:22 < Olipro> the author explicitly states he uses it with OpenVPN
04:23 < Olipro> http://cmeerw.org/blog/711.html
04:23 <@vpnHelper> Title: Christof.Meerwald@blog.www (at cmeerw.org)
04:26 -!- trish [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
04:27 -!- dazo_afk is now known as dazo
04:27 < mfox> thanks, i'll give it a try
04:28 < trish> what is the relationship of "Block outgoing NetBios" in openvpn firewall.sh?
04:29 < mfox> Olipro, http://article.gmane.org/gmane.network.openvpn.devel/1983
04:29 <@vpnHelper> Title: Gmane -- Mail To News And Back Again (at article.gmane.org)
04:30 < mfox> dang! link is dead :)
04:30 < trish> what are you attemping to do mfox?
04:31 < mfox> trish, it seems my ISP or government is using deep packet inspections for blocking use of OpenVPN
04:31 < mfox> either by blocking TLS handshake and UDP encapsulations
04:31 < mfox> so im trying to encapsulate over ICMP
04:32 < mfox> im currently using TCP
04:32 < trish> I see. from where are you?
04:32 < mfox> but its slow!
04:32 < mfox> Iran
04:32 < Olipro> they won't be able to detect OpenVPN using deep packet inspection if you're using full TLS + static key
04:32 < Olipro> the data will for all intents and purposes be random
04:33 < Olipro> however, they can simply rate limit such data in order to give you a hard time
04:33 < mfox> don't know exactly, but currently im using static key (pre-shared key) and tcp
04:33 < mfox> so i can surf again :D
04:34 < mfox> is there fragmentation options for TCP ?
04:36 < trish> The --fragment option only makes sense when you are using the UDP protocol
04:39 < mfox> well, yes, i used fragmentation while trying to use openvpn over UDP
04:39 < mfox> but i was getting no data!
04:39 < mfox> let me mention that i already double-checked my ipv4/ip_forward and iptables rules of NAT
04:43 < trish> so whats your current problem mfox
04:43 < mfox> trish, Using OpenVPN over TCP is slow, my ping time to end is like >700ms
04:44 < trish> do you own the server physically or leased somewhere?
04:45 < bassliner> hi there, i'm using openvpn via tcp and my connections tend to be very slow (about 1/10 to 1/20 of what i should actually get through the connection. could it be that i need to set mtu here?
04:47 < Olipro> that and/or clamping TCP MSS
04:51 < trish> what is the relationship of "Block outgoing NetBios" in openvpn firewall.sh?
04:52 -!- trish [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
04:53 < Bushmills> "it will stop local windows machines from broadcasting themselves to the internet." - probably only relevant with tap setups
04:57 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:57 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:59 -!- jonnyATroot [~honzik@90.183.82.215] has joined #openvpn
05:00 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
05:00 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
05:00 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:09 -!- albech [~albech@61.7.176.97] has joined #openvpn
05:10 -!- Roelke_ is now known as Roelke
05:19 <@vpnHelper> RSS Update - forum: Use daily deal websites to save money <http://forums.openvpn.net/topic8851.html>
05:26 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
05:35 -!- mfox [~mfox@li363-58.members.linode.com] has quit [Ping timeout: 258 seconds]
05:37 <@vpnHelper> RSS Update - forum: Server Startup Problems <http://forums.openvpn.net/topic8831.html#p15757> || Virtual network adapters in windows <http://forums.openvpn.net/topic8834.html#p15756>
05:38 -!- jonnyATroot [~honzik@90.183.82.215] has quit [Read error: Connection reset by peer]
05:39 -!- jonnyATroot [~honzik@90.183.82.215] has joined #openvpn
05:41 -!- mfox [~mfox@213.233.169.36] has joined #openvpn
05:41 -!- jonnyATroot [~honzik@90.183.82.215] has quit [Client Quit]
05:43 <@vpnHelper> RSS Update - forum: Bridging Mode <http://forums.openvpn.net/topic8847.html#p15759> || question <http://forums.openvpn.net/topic8846.html#p15758>
05:48 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
05:48 -!- mfox [~mfox@213.233.169.36] has quit [Ping timeout: 260 seconds]
05:49 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
05:51 -!- mfox [~mfox@li363-58.members.linode.com] has joined #openvpn
06:09 -!- trish_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
06:10 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
06:16 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
06:16 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
06:17 -!- luneff [~yury@188.114.57.128] has quit [Quit: This computer has gone to sleep]
06:22 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
06:32 -!- trish_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
06:39 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
06:43 -!- Squidy [~quassel@187.54.113.240] has joined #openvpn
06:43 -!- Squidy [~quassel@187.54.113.240] has quit [Changing host]
06:43 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
06:44 -!- rajkosto [~rajkosto@2001:470:d76b:bee2:cd68:9f8:4b11:f79f] has joined #openvpn
06:44 < rajkosto> oh ipsec, why cant you be as cool as openvpn
06:44 < rajkosto> only thing that sucks about openvpn is the slowness
06:44 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
06:45 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
06:46 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Quit: leaving]
06:47 < rajkosto> wish i could get some atom board with AES-NI to remove the slowness
06:49 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Read error: Connection reset by peer]
07:00 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
07:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:04 -!- luneff [~yury@188.114.57.128] has joined #openvpn
07:06 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
07:12 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
07:12 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
07:22 -!- rajkosto [~rajkosto@2001:470:d76b:bee2:cd68:9f8:4b11:f79f] has quit [Read error: Connection reset by peer]
07:29 <+novaflash> i am looking for a good and lightweight linux distribution where openvpn is either built-in or available as a package. i'm constrained to 512mb of ram and 128mb of diskspace. if anyone is reading this and thinks "OMG INSTALL WINDOWS" or preferably "use slitaz/puppy/dsl/whatever" then please, let me know.
07:29 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15760>
07:30 < Bushmills> most linux distributions provide openvpn as installable package
07:30 <+novaflash> any ideas for a distro matching my hardware?
07:31 < Bushmills> wasn't there the 128 MiB disk limit, i'd have said "debian", but that's a bit tight for it
07:31 < reiffert> http://en.wikipedia.org/wiki/List_of_Linux_distributions
07:31 <@vpnHelper> Title: List of Linux distributions - Wikipedia, the free encyclopedia (at en.wikipedia.org)
07:31 < reiffert> "damn small linux"
07:32 <+novaflash> thanks reiffert, bushmills
07:32 <+novaflash> ah i've been trying to browse the repository for damn small linux but it 404-ed - any idea if openvpn is available there?
07:32 <+novaflash> and yes i personally prefer debian
07:32 <+novaflash> but.. diskspace
07:33 < reiffert> damn small linux doesnt provide openvpn, forget about it.
07:33 < reiffert> http://www.damnsmalllinux.org/packages.html
07:33 <@vpnHelper> Title: Damn Small Linux, The Debian packages (at www.damnsmalllinux.org)
07:33 <+novaflash> i've just found some info on dsl - it only has 2.0.7. very disappointing.
07:34 <+novaflash> right, so, DSL is out :) on to the next on the list *reads through*
07:34 < reiffert> debian.
07:35 <+novaflash> can that work on 128mb disk space?
07:35 < reiffert> gentoo, dd-wrt, openwrt
07:35 <+novaflash> dd-wrt and openwrt do sound interesting, i wonder if they'll run on i386 hardware
07:36 <+novaflash> i've found slitaz - it doesn't come with a package precompiled but it does have something called a 'package receipt' - basically a script to compile openvpn 2.2.0
07:37 <+novaflash> i think i'll try slitaz. thanks everyone.
07:37 < Roelke> dd-wrt runs on x86
07:37 <+novaflash> ah. i've looked around very briefly on dd-wrt but it required me to specify a router
07:37 < reiffert> let me try with debootstrap.
07:37 <+novaflash> i tried typing linux, computer, pc, i386 but it sort of didn't give me results - i admit i wasn't thorough on that site.
07:38 <+novaflash> going through wiki @ dd-wrt
07:39 < reiffert> you werent able to find the damn small linux package list, so?
07:40 < reiffert> root@reifferscheid:/home/thomas# du -sm squeeze/
07:40 < reiffert> 215	squeeze/
07:41 < reiffert> debian squeeze/stable after debootstrap. missing 4-6MB for kernel.
07:41 < Roelke> novaflash, google : dd-wrt x86 first result : http://www.dd-wrt.com/wiki/index.php/X86
07:41 <@vpnHelper> Title: X86 - DD-WRT Wiki (at www.dd-wrt.com)
07:41 <+novaflash> thanks everyone. i now have a couple of recommendations and possible solutions. i'll need some time to go through them :)
07:42 <+novaflash> I get the feeling that dd-wrt is a preferred choice
07:42 < reiffert> down to 167MB after removing the package archives 
07:42 <+novaflash> reiffert; that is indeed very small already
07:42 < reiffert> down to 128 after removing locales
07:43 <+novaflash> i only really need the bare essentials - openvpn, sshd. obviously no gui and such.
07:43 < reiffert> http://pastebin.com/1K6Pcdyb
07:43 <+novaflash> oh wow you made it fit
07:43 < reiffert> 31MB package descriptions left to delete
07:44 < reiffert> enough space for kernel, initrd, openvpn, sshd.
07:44 < reiffert> another 19 MB manpages and docs.
07:44 <+novaflash> this may seem like a silly question but will it run into problems when the log files start filling up space, or should i just disable all logging altogether?
07:44 < reiffert> novaflash: no, your hard drive will start growing when running full.
07:45 <+novaflash> reiffert; that's awesome, thanks.
07:45 <+novaflash> i wish my computers really would do that
07:45 <+novaflash> cool. thanks for proving the point.
07:45 <+novaflash> i'll slim down a copy of debian and run that
07:46 < reiffert> http://pastebin.com/r1aRTVAL
07:46 < reiffert> those are the package names currently installed.
07:47 <+novaflash> at first glance, seems like everything i need is in there - just needs openvpn and sshd
07:47 <+novaflash> piece of cake!
07:47 < reiffert> just installed those two. back to 237 MB.
07:47 <+novaflash> oof.
07:48 < reiffert> http://pastebin.com/jzRsp9Zh
07:48 <+novaflash> i see. lots of extra dependencies
07:48 < reiffert> http://pastebin.com/VDmYm4c4
07:49 < reiffert> what's that python stuff useful for
07:49 < reiffert> ?
07:49 <+novaflash> i think maybe for client side scripting
07:49 <+novaflash> seems rather useless to me for someone who doesn't use that feature
07:53 -!- gryzli [~gryzli@91.92.162.66] has quit [Read error: Operation timed out]
07:53 -!- gryzli [~gryzli@91.92.162.66] has joined #openvpn
07:54 < reiffert> debian might be worth then for you.
07:54 <+novaflash> i'm definitely going to give it a try today
07:54 <+novaflash> thanks for helping out.
07:54 <+novaflash> i'm also going to give slitaz a try
07:54 -!- Fritz09_ [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
07:54 <+novaflash> it uses 100mb of disk space but that includes a gui. i'll toss the gui and openvpn 2.2.0 is already recent enough for me. i'm sure i can get 2.2.1 working on slitaz as well.
07:55 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 252 seconds]
07:55 -!- Fritz09_ [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Client Quit]
07:56 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
07:57 <@vpnHelper> RSS Update - forum: Virtual network adapters in windows <http://forums.openvpn.net/topic8834.html#p15761>
08:00 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
08:03 <@vpnHelper> RSS Update - forum: lan DHCP requests <http://forums.openvpn.net/topic8852.html>
08:09 -!- W4lth3r is now known as W4lth3r|AwaY
08:12 -!- mfox [~mfox@li363-58.members.linode.com] has quit [Quit: Leaving]
08:20 -!- amero [~amero@unaffiliated/amero] has quit [Read error: Connection reset by peer]
08:26 -!- K1ng`` is now known as k1ng
08:52 -!- forerunner [~forerunne@31.31.36.225] has left #openvpn []
08:58 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:00 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
09:02 -!- master_of_master [~master_of@p57B5410F.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:05 -!- master_of_master [~master_of@p57B53978.dip.t-dialin.net] has joined #openvpn
09:08 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
09:08 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
09:08 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:14 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 260 seconds]
09:18 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:28 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15763>
09:35 -!- iruvtacos [465a3e25@gateway/web/freenode/ip.70.90.62.37] has joined #openvpn
09:54 -!- Blues-Man [~bluesman@host160-114-dynamic.26-79-r.retail.telecomitalia.it] has joined #openvpn
10:09 -!- Blues-Man [~bluesman@host160-114-dynamic.26-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
10:12 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Operation timed out]
10:13 -!- zoidberg1 [zoidberg@gateway/shell/xzibition.com/x-sbjgeehukikarolw] has quit [Read error: Connection reset by peer]
10:13 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-euqalezwqtvnssvi] has joined #openvpn
10:24 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
10:28 <@vpnHelper> RSS Update - forum: Virtual network adapters in windows <http://forums.openvpn.net/topic8834.html#p15765> || Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html>
10:34 -!- Balrog_ [~Balrog@76-14-152-75.rk.wavecable.com] has quit [Quit: Leaving]
10:37 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:52 -!- corretico_ [~luis@200.12.40.18] has joined #openvpn
10:55 -!- jcran [~jcran@64.125.235.2] has quit [Ping timeout: 276 seconds]
11:00 -!- benedikt [~benedikt@unaffiliated/benedikt] has joined #openvpn
11:00 < benedikt> Can i have one instance of openvpn running as a server on tcp and another one on udp, and have the clients connecting t the udp server and tcp server be on the same network
11:00 < benedikt> so they can communicate
11:03 < Bushmills> using the same vpn subnet? tricky, because by routing you'd have to tell whether vpn subnet will be routed to one or the other tun interface.
11:03 < Bushmills> if destination subnet was identical, routing wouldn't know what interface to route to 
11:03 <@vpnHelper> RSS Update - forum: Connect to openvpn before logon windows 7 <http://forums.openvpn.net/topic8854.html>
11:04 < benedikt> Bushmills: i was more thinking about have separate subnets and then route between them. But openvpn doesnt use the kernel routing table (it has its own routing table in userspace). Can i route between them?
11:04 < Bushmills> but what's the problem with putting udp server into a different subnet than tcp server?
11:05 < benedikt> no problem as long as i can route between them
11:05 < Bushmills> ah, you mean, on the same physical network? yes. possible.
11:06 < benedikt> how are v(irtual)pns physical? :)
11:07 < Bushmills> they aren't.  as clients are on the same physical network, they'd communicate with each other through their physical interfaces.
11:07 < benedikt> is it sufficient to put the routes in the config file (to be pushed to clients)?
11:08 < Bushmills> the routeto physical network is most likely already set. 
11:08 < Bushmills> simply don't change them, and they will be able to continue to talk to each other
11:09 < benedikt> what do you mean by phyiscal network in this context?
11:09 < krzie> the answer is yes
11:09 < krzie> you can route between X vpn's
11:09 < Bushmills> the cables and switch/hub between client physical interfaces
11:10 < krzie> just push routes from each to the other
11:10 < krzie> and be sure ip forwarding is on and your firewall doesnt block it
11:10 < krzie> that is all =]
11:11 < benedikt> TCP server as 10.133.1.0/24 and UPD is 10.133.0.0/24. I want to route between these two subnets. 
11:11 < krzie> right, thats what i answered
11:12 < Bushmills> where does that "same network" notion come from?
11:12 < krzie> he just wants each to reach the other
11:12 < Bushmills> because these are seperate subnets
11:12 < benedikt> krzie: yeah i noticed (too late though)
11:12 < krzie> *as if* they were in the same network
11:12 < benedikt> Bushmills: a network is a superset of subnet(work)s :)
11:13 < krzie> i know maybe he didnt say that, but i caught what he wanted (its common)
11:13 < Bushmills> really?
11:13 < benedikt> hence the "one network" notion
11:13 < Bushmills> so any address of any subnet will be in the same network?
11:13 < krzie> benedikt, if you argue network semantics with Bushmills you likely wont win ;]
11:13 < benedikt> krzie: im a math student. bring it on!
11:13 < krzie> heh that wont help ya ;]
11:14 < benedikt> ill agruge set theory for a few minutes before i get bored. 
11:14 <@vpnHelper> RSS Update - forum: Gorkhaan's Setup ( Wordpress + OpenVPN fun ) <http://forums.openvpn.net/topic3158.html#p15554>
11:14 < krzie> hell ild bet you couldnt win math arguments with Bushmills 
11:14 -!- dazo is now known as dazo_afk
11:14 < Bushmills> don't bet on me. i'd have to google "mathematics" for getting an inkling what that could be
11:14 < benedikt> Bushmills: wanna have a go?
11:14 < krzie> lol
11:15 < krzie> says the man who coded a forth emulator in bash
11:15 < benedikt> but to the more practical side of things. How do i set up a route between the two subnets?
11:15 < krzie> benedikt, i told you already
11:15 < Bushmills> but i bet that krzie drain 3 pints of beer faster than you do
11:15 < benedikt> krzie: d'oh. 
11:15 < Bushmills> drains, even
11:15 < krzie> [12:12]  <krzie> just push routes from each to the other
11:15 < krzie> [12:12]  <krzie> and be sure ip forwarding is on and your firewall doesnt block it
11:15 < krzie> [12:13]  <krzie> that is all =]
11:15 < benedikt> nice. 
11:15 < benedikt> i completely missed that. 
11:15  * ecrist could drain 3 pints before krzie
11:15 < krzie> dont bet on my drinking, bet on my smoking
11:15 < ecrist> heh
11:16 < krzie> i drink for fun, i smoke as a hobby ;]
11:16 < benedikt> krzie: smoking is a fine art. 
11:16 < benedikt> i recomend vaporizing. 
11:17 < krzie> i prefer blunts
11:17 < krzie> but your recommendation is good
11:19 -!- gremly [~gremly@200.106.218.64] has quit [Read error: Connection reset by peer]
11:20 < Bushmills> our new federal state administration suggested to raise the legal limit for dope from 6 to 10 grams :) 
11:20 < krzie> good people!
11:20 < krzie> i didnt know there *is* a legal limit there
11:20 < Bushmills> it's not that progressive here
11:21 < benedikt> krzie: i dnot go around showing my stuff to the coppers
11:21 < Bushmills> still, a far cry from how it was dealt with 25 years ago
11:21 < krzie> much more than here
11:21 < krzie> here its ILLEGAL
11:21 < benedikt> i just sit at home and toke, not doing anybody any harm. prohibition is stupid. 
11:21 < krzie> like a roach = jail
11:21 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:21 < benedikt> where are you?
11:21 < benedikt> im in iceland, people are not very hung up on it. 
11:21 < krzie> a lil 3rd world country
11:21 < krzie> caribbean
11:21 < benedikt> which one?
11:22 < krzie> thats as much as i say online
11:22  * ecrist knows
11:22 < ecrist> mushahaha
11:22 < krzie> lol
11:23 < krzie> ive known you quite awhile =]
11:30 < Essobi> O_o
11:31 -!- cocoa117 [~cocoa117@wk-28-232.guest.rdg.ac.uk] has joined #openvpn
11:32 < krzie> oh and i never told you... i just didnt hide my ip a couple times when ssh'ing to that server (iirc)
11:32 < krzie> its done automagically normally, but ive purposely connected to it without my vpns
11:33 < Essobi> lol
11:37 -!- albech [~albech@61.7.176.97] has quit [Quit: Leaving]
11:47 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:47 -!- mode/#openvpn [+v s7r] by ChanServ
11:57 -!- Lantizia [~Lantizia@cpc22-stok16-2-0-cust96.1-4.cable.virginmedia.com] has quit [Quit: Leaving]
12:05 -!- iruvtacos [465a3e25@gateway/web/freenode/ip.70.90.62.37] has left #openvpn []
12:14 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:26 -!- cocoa117 [~cocoa117@wk-28-232.guest.rdg.ac.uk] has quit [Quit: Leaving]
12:32 -!- radioxid [~radioxid@92.90.16.170] has joined #openvpn
12:37 -!- radioxid [~radioxid@92.90.16.170] has quit [Ping timeout: 276 seconds]
12:46 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
12:52 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
12:57 -!- luneff [~yury@188.114.57.128] has quit [Quit: This computer has gone to sleep]
12:59 -!- Corey [~KB1JWQ@freenode/staff/kb1jwq] has left #openvpn []
13:06 <@vpnHelper> RSS Update - forum: Help with my network with openvpn <http://forums.openvpn.net/topic8855.html>
13:21 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:22 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:25 <@vpnHelper> RSS Update - forum: STOP "Need IPv6 code in mroute_extract_addr_from_packet" ??? <http://forums.openvpn.net/topic8833.html#p15768>
13:28 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
13:30 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: No route to host]
13:33 -!- Ionic [ionic@ionic.de] has joined #openvpn
13:38 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
13:49 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
13:50 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
13:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:50 -!- mode/#openvpn [+v Axeman] by ChanServ
14:11 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
14:21 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
14:22 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 260 seconds]
14:23 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:27 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
14:31 -!- mfox [~mfox@li363-58.members.linode.com] has joined #openvpn
14:35 -!- gladiatr [~sdspence@law-lb2.caltesting.net] has joined #openvpn
14:48 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has joined #openvpn
14:48 < WebSprocket> Hye guys
14:50 -!- gryzli [~gryzli@91.92.162.66] has quit [Quit: Leaving]
14:53 < WebSprocket> Im having a problem and im cannot figure it out this is my config
14:53 < WebSprocket> http://pastebin.com/DmKWiqP1
14:55 < WebSprocket> i have a CentOS box connected eth0 is connected to internal network IP: 10.10.8.60 - eth1 192.168.0.1 (External Network) when i connect remotely it gives me the IP 10.10.4.6 but i cannot ping the 8.60 only the 10.10.4.1
15:00 < ecrist> do you have ip_forwarding enabled in the kernel?
15:01 < WebSprocket> i edited /etc/init.d/openvpn
15:01 < WebSprocket> and uncommented the lien
15:01 < ecrist> no idea what that is
15:02 < WebSprocket> [root@vpn openvpn]# sysctl net.ipv4.ip_forward
15:02 < WebSprocket> net.ipv4.ip_forward = 1
15:02 < WebSprocket> that correct?
15:04 < ecrist> yup
15:04 < WebSprocket> iv tried forcing the DNS to my Windows DNS server @ 10.10.8.2 but thats still not working
15:04 < ecrist> if the 8.60 address is on the openvpn server, iirc, you won't be able to ping it
15:05 < ecrist> the response is going to come from the vpn ip, and won't be accepted
15:05 < ecrist> you'll be able to see that behavior in tcpdump output
15:05 < ecrist> try pinging an IP of another host that knows how to route to the vpn
15:06 < WebSprocket> 10.10.8.60 is the network card connected to our windows server network of which im trying to connct the remoteuser
15:06 < WebSprocket> the only thing that responds is 10.10.4.1 which is the VPN server
15:10 < WebSprocket> just noticed something in the client log
15:11 < WebSprocket> route.exe ADD 10.10.8.0 MASK 255.255.255.0 10.10.4.5
15:11 < WebSprocket> but isnt the server 10.10.4.1 /
15:11 < krzee> !/30
15:11 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
15:11 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
15:12 < krzee> dont worry, openvpn is doing it right
15:12 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:17 < WebSprocket> humm im thinking its becuase its not routing the traffic to the right network first, but the order is right.
15:21 -!- mfox [~mfox@li363-58.members.linode.com] has quit [Quit: Leaving]
15:25 -!- Netsplit *.net <-> *.split quits: troyt, _DexTerDDIT, Fiouz, EugeneKay, dxtr, decoder, Cr4zi3
15:26 -!- gladiatr [~sdspence@law-lb2.caltesting.net] has quit [Ping timeout: 258 seconds]
15:33 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has left #openvpn []
15:33 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has joined #openvpn
15:33 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has quit [Quit: —I-n-v-i-s-i-o-n— 3.2 (July '10)]
15:33 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has joined #openvpn
15:38 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
15:39 -!- W4lth3r|AwaY is now known as W4lth3r
15:40 -!- Netsplit over, joins: Cr4zi3, EugeneKay, troyt, decoder, dxtr, _DexTerDDIT, Fiouz
15:40 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Excess Flood]
15:41 <@vpnHelper> RSS Update - forum: Server Startup Problems <http://forums.openvpn.net/topic8831.html#p15769>
15:41 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
15:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
15:58 < reiffert> krzee: u there?
15:59 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15770>
15:59 < krzee> ya man
16:00 < EugeneKay> I'm not!
16:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:04 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
16:05 < WebSprocket> should i be able to ping the "Virtual Address"
16:07 < krzee> no
16:07 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
16:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:09 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
16:15 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
16:23 -!- Netsplit *.net <-> *.split quits: _DexTerDDIT, EugeneKay, troyt, dxtr, decoder, Fiouz
16:29 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
16:36 -!- Netsplit over, joins: EugeneKay, troyt, decoder, dxtr, _DexTerDDIT, Fiouz
16:44 -!- CybDev [cybdev@unaffiliated/cybdev] has quit [Ping timeout: 260 seconds]
16:45 -!- CybDev [cybdev@abducted.by.aliens.org] has joined #openvpn
16:45 -!- CybDev [cybdev@abducted.by.aliens.org] has quit [Changing host]
16:45 -!- CybDev [cybdev@unaffiliated/cybdev] has joined #openvpn
16:49 -!- SeriousSam_ [kvirc@shpd-92-101-166-211.vologda.ru] has joined #openvpn
16:49 <@vpnHelper> RSS Update - forum: lan DHCP requests <http://forums.openvpn.net/topic8852.html#p15771>
16:51 < SeriousSam_> Hi there! I use OpenVPN on Windows XP. But when I connect speed is 10 Mbit/sec. How can I increase my speed? And is it normal behaviour?
16:54 <@raidz> SeriousSam_: That is a cosmetic issue, speeds can go much faster than that.
16:54 < SeriousSam_> raidz: Ok, thanks for quick response
16:55 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15772>
16:56 <@raidz> np
16:57 -!- SeriousSam_ [kvirc@shpd-92-101-166-211.vologda.ru] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.3 Shiny(svn-3438) http://www.kvirc.net]
17:01 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
17:01 <@vpnHelper> RSS Update - forum: Help with my network with openvpn <http://forums.openvpn.net/topic8855.html#p15774> || Connect to openvpn before logon windows 7 <http://forums.openvpn.net/topic8854.html#p15773>
17:05 -!- mirco [~mirco@p5B2834BF.dip.t-dialin.net] has joined #openvpn
17:07 <@vpnHelper> RSS Update - forum: OpenVPN or OpenVPN AS? <http://forums.openvpn.net/topic8829.html#p15776> || Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15775>
17:08 -!- mirco [~mirco@p5B2834BF.dip.t-dialin.net] has quit [Remote host closed the connection]
17:08 -!- mirco [~mirco@p5B2834BF.dip.t-dialin.net] has joined #openvpn
17:24 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:26 -!- mirco [~mirco@p5B2834BF.dip.t-dialin.net] has quit [Quit: mirco]
17:32 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845.html#p15777>
17:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
17:40 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
17:51 -!- itai_michaelson [~itai@218.82.172.54] has joined #openvpn
17:51 < itai_michaelson> hi, can anyone tell me what does --enable-password-save means 
17:51 < itai_michaelson> the man page for openvpn says : OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option
18:02 <@vpnHelper> RSS Update - forum: NAT / Masquerade <http://forums.openvpn.net/topic8856.html>
18:03 < krzee> it is a configure option
18:03 < krzee> if you use windows, it is enabled in the newest version
18:03 < krzee> !pwfile
18:03 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h or (#2) see --auth-user-pass in the manual (!man) for more info or (#3) if you're using this with the windows service, you will need --askpass
18:05 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:05 -!- mode/#openvpn [+v Axeman] by ChanServ
18:06 < itai_michaelson> krzee, alas I use Linux
18:07 < krzee> then you know what i mean by a configure option, and you are ready to manually rebuild openvpn
18:11 -!- ipl31 [~quassel@75.103.61.58] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
18:16 < itai_michaelson> oh dear , manually rebuild openvpn...
18:17 < itai_michaelson> another question : what format should the credential file be in just : username password
18:17 < itai_michaelson> ?
18:17 -!- corretico [~luis@201.201.44.82] has quit [Read error: Operation timed out]
18:22 < itai_michaelson> for some reason i thought "it" referred to the file ....man pages...gotta love them
18:24 < krzee> so you figured out the answer to that one?
18:28 < itai_michaelson> it's all very zen , but i did
18:28 < itai_michaelson> thanks
18:28 -!- itai_michaelson [~itai@218.82.172.54] has quit [Quit: Leaving]
18:49 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
19:01 -!- sam555 [~sysadmin@udp124488uds.hawaiiantel.net] has joined #openvpn
19:01 <@vpnHelper> RSS Update - forum: NAT / Masquerade <http://forums.openvpn.net/topic8856.html#p15779>
19:01 < sam555> hello all
19:01 < sam555> can anyone direct me to instructions on how to run open vpn on ubuntu netbook?
19:02 < sam555> Also, could I use the same client info to vpn with an iphone?
19:09 -!- corretico_ [~luis@200.12.40.18] has quit [Ping timeout: 260 seconds]
19:10 -!- corretico_ [~luis@200.12.40.18] has joined #openvpn
19:17 -!- nioboozmar [~nioboozma@dyn-129-78-251-12.wirelessguest.usyd.edu.au] has joined #openvpn
19:23 -!- corretico_ [~luis@200.12.40.18] has quit [Ping timeout: 260 seconds]
19:24 -!- corretico_ [~luis@200.12.40.18] has joined #openvpn
19:35 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
19:38 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html>
19:42 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:43 -!- mode/#openvpn [+v Axeman] by ChanServ
19:47 -!- corretico_ [~luis@200.12.40.18] has quit [Ping timeout: 260 seconds]
19:47 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:52 -!- corretico_ [~luis@200.12.40.18] has joined #openvpn
19:56 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15782> || Acsess VMware client on host computer <http://forums.openvpn.net/topic8858.html>
19:56 -!- _julian_ [~quassel@hmbg-5f7601f0.pool.mediaWays.net] has joined #openvpn
20:00 -!- _julian [~quassel@hmbg-5f77c55d.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
20:05 -!- corretico_ [~luis@200.12.40.18] has quit [Remote host closed the connection]
20:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
20:24 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:57 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
20:58 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:59 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
21:00 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
21:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
21:07 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
21:07 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
21:15 -!- sam555 [~sysadmin@udp124488uds.hawaiiantel.net] has left #openvpn []
21:45 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15783>
21:48 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:51 -!- qmr [~qmr@c-98-220-169-103.hsd1.in.comcast.net] has joined #openvpn
21:51 < qmr> Hey guys, trying to setup a vpn for gaming with a friend ... 
21:51 < qmr> having some issues
21:51 < qmr> I've done point to point windows <-> linux before
21:51 < qmr> but he's on windows 7.. and there's an error about all TAP adapters are in use or such when I try to 'connect' from his machine 
21:52 < qmr> "All TAP-Win32 adapters on this system are currently in use. "
21:57 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
21:58 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
21:58 -!- mode/#openvpn [+o raidz] by ChanServ
22:10 -!- Squidy [~quassel@187.54.113.240] has joined #openvpn
22:10 -!- Squidy [~quassel@187.54.113.240] has quit [Changing host]
22:10 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
22:34 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:49 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:03 <@vpnHelper> RSS Update - forum: sharing openvpn connection <http://forums.openvpn.net/topic8859.html>
23:40 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
23:52 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
23:57 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15785>
--- Day changed Thu Sep 22 2011
00:09 <@vpnHelper> RSS Update - forum: PPTPD service on Openvpn AS machine!? <http://forums.openvpn.net/topic8860.html>
00:17 -!- nioboozmar [~nioboozma@dyn-129-78-251-12.wirelessguest.usyd.edu.au] has quit [Quit: Linkinus - http://linkinus.com]
00:22 -!- SOG [~SOG@113.108.118.58] has quit [Ping timeout: 258 seconds]
00:25 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
00:33 -!- mape2k [~mape2k@p5B24C815.dip.t-dialin.net] has joined #openvpn
00:45 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has quit [Ping timeout: 252 seconds]
00:53 -!- luneff [~yury@84.51.192.74] has joined #openvpn
00:54 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has joined #openvpn
00:57 <@vpnHelper> RSS Update - forum: OpenVPN or OpenVPN AS? <http://forums.openvpn.net/topic8829.html#p15787>
00:57 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:03 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
01:03 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15789> || NAT / Masquerade <http://forums.openvpn.net/topic8856.html#p15788>
01:09 <@vpnHelper> RSS Update - forum: Server Startup Problems <http://forums.openvpn.net/topic8831.html#p15791> || sharing openvpn connection <http://forums.openvpn.net/topic8859.html#p15790>
01:15 <@vpnHelper> RSS Update - forum: OpenVPN or OpenVPN AS? <http://forums.openvpn.net/topic8829.html#p15792>
01:39 <@vpnHelper> RSS Update - forum: OpenVPN or OpenVPN AS? <http://forums.openvpn.net/topic8829.html#p15793>
01:42 -!- dazo_afk is now known as dazo
01:45 <@vpnHelper> RSS Update - forum: Acsess VMware client on host computer <http://forums.openvpn.net/topic8858.html#p15794>
02:10 < Mowee> Morning
02:18 -!- lazzer_ [~lazzer@vmlinux.org] has quit [Ping timeout: 258 seconds]
02:18 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 276 seconds]
02:19 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
02:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 258 seconds]
02:28 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
02:30 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
02:50 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
02:56 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
02:56 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
02:56 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:04 <@vpnHelper> RSS Update - forum: OpenVPN or OpenVPN AS? <http://forums.openvpn.net/topic8829.html#p15795>
03:07 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 260 seconds]
03:07 -!- Roelke [~Roelke@hostserv.nl] has quit [Ping timeout: 260 seconds]
03:08 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
03:11 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
03:19 -!- Mowee is now known as followthisnub
03:19 -!- followthisnub is now known as Mowee
03:23 -!- catsup [~d@ps38852.dreamhost.com] has quit [Ping timeout: 260 seconds]
03:23 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
03:28 <@vpnHelper> RSS Update - forum: OpenVPN or OpenVPN AS? <http://forums.openvpn.net/topic8829.html#p15797> || Acsess VMware client on host computer <http://forums.openvpn.net/topic8858.html#p15796>
03:30 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
03:31 -!- luneff [~yury@109.165.8.79] has joined #openvpn
03:33 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has quit [Read error: Connection reset by peer]
03:33 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has joined #openvpn
03:33 <@vpnHelper> RSS Update - forum: Server Startup Problems <http://forums.openvpn.net/topic8831.html#p15798>
03:34 -!- lazzer [~lazzer@vmlinux.org] has joined #openvpn
03:39 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
03:39 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15801> || Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15800> || VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15799>
03:41 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
03:46 <@vpnHelper> RSS Update - forum: PPTPD service on Openvpn AS machine!? <http://forums.openvpn.net/topic8860.html#p15805> || Sharing a single OpenVPN server across multiple clients <http://forums.openvpn.net/topic8861.html#p15804> || Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15803>
03:50 -!- catsup [~d@ps38852.dreamhost.com] has quit [Ping timeout: 260 seconds]
03:52 <@vpnHelper> RSS Update - forum: Sharing a single OpenVPN server across multiple clients <http://forums.openvpn.net/topic8861.html#p15806>
04:04 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15807>
04:05 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
04:28 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15809> || Sharing a single OpenVPN server across multiple clients <http://forums.openvpn.net/topic8861.html#p15808>
04:29 -!- t_ [~t@67-225-52-49.estv.hsdb.sasknet.sk.ca] has joined #openvpn
04:33 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
04:34 <@vpnHelper> RSS Update - forum: Sharing a single OpenVPN server across multiple clients <http://forums.openvpn.net/topic8861.html#p15810>
04:37 -!- forerunner [~forerunne@31.31.36.225] has quit [Read error: Connection reset by peer]
04:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:57 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
05:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
05:15 -!- mode/#openvpn [+v Axeman] by ChanServ
05:16 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
05:16 -!- mode/#openvpn [+v Axeman2] by ChanServ
05:16 <@vpnHelper> RSS Update - forum: Sharing a single OpenVPN server across multiple clients <http://forums.openvpn.net/topic8861.html#p15811>
05:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
05:25 -!- bitterman [~yury@109.165.8.79] has joined #openvpn
05:28 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
05:28 -!- luneff [~yury@109.165.8.79] has quit [Ping timeout: 260 seconds]
05:31 -!- albech [~albech@61.7.176.97] has joined #openvpn
05:36 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
05:38 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
05:59 -!- bitterman [~yury@109.165.8.79] has quit [Quit: This computer has gone to sleep]
06:14 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
06:50 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
06:51 < Azrael808> Hi, I'm trying to generate a new certificate for our server, but I'm having trouble adding the relevant nsCertType attribute
06:51 < Azrael808> Our internal CA is managed using the certutil tool
06:52 < Azrael808> Does anybody know what parameters I should be passing to the program to add the required nsCertType value?
06:53 -!- killfoo [~killfoo@147.88.200.112] has joined #openvpn
06:54 < killfoo> hi! what topology mode do i have to set if i want a server having openvpn running and clients connect to this server via openvpn to connect to services that are installed in the server beside openvpn?
06:55 < killfoo> |server(ovpn,httpd)|---ovpn(http)---|client|
07:04 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
07:05 -!- killfoo [~killfoo@147.88.200.112] has quit [Quit: This computer has gone to sleep]
07:07 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
07:07 < ecrist> Azrael808: we don't know, we don't support certutil
07:08 < Azrael808> Was just a stab in the dark
07:09 < Azrael808> The help for the tool seems to suggest it's possible, but the certs I'm generating don't work with the "nsCertType = server" client config
07:09 < ecrist> well, you can only set nsCertType = server for the vpn server certificate
07:10 < ecrist> I know openvpn properly handles it, as ssl-admin can set it and it's honored
07:10 < krzie> !servercert
07:10 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key or (#2) this will help with !mitm
07:11 < Azrael808> <3
07:11 < Azrael808> Beautiful
07:11 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
07:11 < krzie> you need a openssl.cnf that has that extension in it tho
07:11 < ecrist> or you can set it in your environment
07:11 < ecrist> like ssl-admin does
07:11 < ecrist> :)
07:11 < krzie> ehh?
07:11 < ecrist> !ssl-admin
07:11 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
07:12 < krzie> i added it to ssl-admin's .cnf
07:12 < krzie> its in there
07:12 < ecrist> oh, yeah, that
07:12 < ecrist> durr
07:12  * ecrist shuts up
07:12 < Azrael808> I can make that happen (I hope!) - the next step is for me to export CA key and cert so I can use with openssl :)
07:12 < ecrist> Azrael808: try ssl-admin
07:13 < krzie> i agree
07:13 < krzie> ssl-admin is what i use
07:13 < ecrist> it's open-source, BSD licensed, and fully supported here in the channel
07:13 < Azrael808> Off the top of your heads, is it possible to import an existing CA key and cert?
07:14 < Azrael808> I'll have to manage a lot of cert re-issues if not! lol
07:14 < krzie> kinda, why would you want to?
07:14 < krzie> ahh
07:14 < krzie> your vpn is already live?
07:14 < Azrael808> Yeah - the server cert expired
07:14 < krzie> ohhh
07:14 <@vpnHelper> RSS Update - forum: Acsess VMware client on host computer <http://forums.openvpn.net/topic8858.html#p15812>
07:15 < ecrist> yes, ssl-admin can import existing certs, though it needs to be done manually
07:15 < Azrael808> And I regenerated, but I've not been able to add the nscerttype attribute! :(
07:15 < krzie> i see
07:15 < ecrist> one downside to ssl-admin, though, is it's not scriptable currently.
07:15 < krzie> the openssl command will be the easiest i guess =]
07:15 < ecrist> that's what I'd guess
07:15 < Azrael808> I _could_ ask all the users to comment out the nsCertType directive in their configs, but I'm a stickler for security
07:15 < Azrael808> :)
07:16 < ecrist> if you're going to script it, make sure to add --batch to the optins
07:16 < Azrael808> I'll have a crack at the openssl magic, and plan to migrate away from certutil in future :)
07:21 <@vpnHelper> RSS Update - forum: Acsess VMware client on host computer <http://forums.openvpn.net/topic8858.html#p15814> || Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15813>
07:24 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:26 -!- fluter_ [~fluter@fedora/fluter] has joined #openvpn
07:26 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15815>
07:26 -!- fluter_ [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
07:28 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
07:32 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:32 -!- forerunner [~forerunne@31.31.36.225] has left #openvpn []
07:36 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:39 <@vpnHelper> RSS Update - forum: Acsess VMware client on host computer <http://forums.openvpn.net/topic8858.html#p15817> || Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15816>
07:51 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15819>
07:57 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
08:02 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:02 -!- mode/#openvpn [+v Axeman] by ChanServ
08:02 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15820>
08:02 -!- forerunner [~forerunne@31.31.36.225] has left #openvpn []
08:13 <@vpnHelper> RSS Update - forum: Acsess VMware client on host computer <http://forums.openvpn.net/topic8858.html#p15821>
08:13 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
08:18 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
08:18 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15822>
08:19 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
08:19 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
08:20 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:22 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has left #openvpn []
08:27 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15823>
08:30 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:33 <@vpnHelper> RSS Update - forum: Acsess VMware client on host computer <http://forums.openvpn.net/topic8858.html#p15825> || Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15824>
08:39 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15827> || Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15826>
08:39 -!- Axeman [~Axeman3@openvpn/user/axeman] has left #openvpn ["Leaving"]
08:47 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
08:48 < Roelke> anyone, ping problem is existing with TCP and it is perfect working with UDP 
08:51 < krzee> !tcp
08:51 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
09:00 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
09:04 -!- master_of_master [~master_of@p57B53978.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:06 -!- master_of_master [~master_of@p57B54B69.dip.t-dialin.net] has joined #openvpn
09:09 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15828>
09:13 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
09:13 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:15 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15829>
09:20 < bassliner> hello. when running "/usr/sbin/openvpn --show-pkcs11-slots /usr/lib/opensc-pkcs11.so 0" i get "Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: show-pkcs11-slots (2.2.1)" - do i have to re-compile openvpn with pkcs11 support or something like that? thank you.
09:21 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15830>
09:28 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:30 -!- MikeJansen1 [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
09:34 -!- corretico [~luis@200.12.40.18] has joined #openvpn
09:34 -!- corretico [~luis@200.12.40.18] has quit [Remote host closed the connection]
09:34 -!- corretico [~luis@200.12.40.18] has joined #openvpn
09:50 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
09:51 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
09:51 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15831>
10:06 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
10:09 <@vpnHelper> RSS Update - forum: NAT / Masquerade <http://forums.openvpn.net/topic8856.html#p15833>
10:15 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
10:19 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:25 -!- dazo is now known as dazo_afk
10:28 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:28 -!- mode/#openvpn [+v s7r] by ChanServ
10:32 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 258 seconds]
10:54 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:57 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
10:57 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15835> || Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15834>
11:12 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 258 seconds]
11:12 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
11:12 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
11:12 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
11:12 -!- mode/#openvpn [+v novaflash] by ChanServ
11:25 -!- mape2k [~mape2k@p5B24C815.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
11:33 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 248 seconds]
11:35 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
11:38 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
11:40 <@vpnHelper> RSS Update - forum: NAT / Masquerade <http://forums.openvpn.net/topic8856.html#p15836>
11:46 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15837>
11:48  * EugeneKay yawns
11:48 < EugeneKay> Good morning, VPNers
11:49 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
11:57 -!- Squidy [~quassel@187.7.244.104] has joined #openvpn
11:57 -!- Squidy [~quassel@187.7.244.104] has quit [Changing host]
11:57 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
12:03 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
12:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
12:08 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
12:12 < Assid> hey
12:12 < Assid> your everywhere arent you eugene
12:13 < EugeneKay> I am nowhere.
12:14 -!- Blues-Man [~bluesman@host160-114-dynamic.26-79-r.retail.telecomitalia.it] has joined #openvpn
12:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:18 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
12:20 -!- forerunner [~forerunne@31.31.36.225] has left #openvpn []
12:20 -!- mape2k [~mape2k@f053195114.adsl.alicedsl.de] has joined #openvpn
12:20 -!- luneff [~yury@109.165.8.79] has joined #openvpn
12:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:26 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
12:36 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
12:37 -!- corretico [~luis@200.12.40.18] has quit [Ping timeout: 260 seconds]
12:38 -!- Fritz09_ [~Fritz09@pop1-2551.catv.wtnet.de] has joined #openvpn
12:43 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
12:44 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15838>
12:45 -!- corretico [~luis@200.12.40.18] has joined #openvpn
12:50 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-15.html#p15839>
12:50 -!- halorgium [tim@titanium.spork.in] has left #openvpn []
12:51 -!- Blues-Man [~bluesman@host160-114-dynamic.26-79-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
12:53 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
12:56 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15840>
13:02 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15841>
13:08 -!- Fritz09_ [~Fritz09@pop1-2551.catv.wtnet.de] has quit [Quit: Bye]
13:08 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15842>
13:15 -!- Assid [~kvirc@unaffiliated/assid] has quit [Quit: KVIrc 4.0.4 Insomnia http://www.kvirc.net/]
13:15 -!- albech [~albech@61.7.176.97] has quit [Remote host closed the connection]
13:17 -!- luneff [~yury@109.165.8.79] has quit [Quit: Leaving]
13:19 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
13:20 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15843>
13:22 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
13:30 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:30 -!- mode/#openvpn [+v Axeman] by ChanServ
13:44 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15844>
13:47 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:50 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:50 -!- mode/#openvpn [+v s7r] by ChanServ
13:50 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15845>
13:55 -!- poster [~poster@cpe-107-10-147-179.columbus.res.rr.com] has joined #openvpn
13:55 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-30.html#p15846>
14:15 -!- corretico [~luis@200.12.40.18] has quit [Remote host closed the connection]
14:15 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
14:16 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
14:17 -!- mode/#openvpn [+o raidz] by ChanServ
14:17 -!- corretico [~luis@200.12.40.18] has joined #openvpn
14:18 -!- Roelke [~Roelke@hostserv.nl] has quit [Ping timeout: 260 seconds]
14:24 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-30.html#p15847>
14:24 -!- merlin1991 [~merlin@Maemo/community/cssu/merlin1991] has joined #openvpn
14:27 < merlin1991> I've got a situation, where I want to create a network client to client over 1 public known address, is it possible to set up openvpn in such a way, that multiple clients can talk to each other over 1 public server?
14:27 < ecrist> yup
14:27 < ecrist> openvpn is good for that
14:28 < merlin1991> maybe you got a nice howto somewhere? :)
14:30 < krzee> !howto
14:30 < Bushmills> !howto
14:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:30 < krzee> its basically just a normal openvpn setup
14:30 < krzee> !sample
14:30 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:31 < Bushmills> !client-to-client
14:31 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
14:31 <@vpnHelper> clients
14:33 < merlin1991> so I'm looking for a basic openvpn setup with client to client enabled and I'm all good?
14:33 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
14:33 < krzee> basically the sample i linked you to
14:33 < krzee> along with certs
14:33 < krzee> but, like the bot said, read the options used in those in the manual
14:33 < krzee> its important you know what they do so you know what you have there
14:34 < krzee> cert making is in the howto
14:35 -!- Guest49583 [~Axeman3@198.105.46.69] has joined #openvpn
14:36 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
14:37 < merlin1991> thanks
14:37 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:37 -!- mode/#openvpn [+v Axeman2] by ChanServ
14:40 -!- Guest49583 [~Axeman3@198.105.46.69] has quit [Ping timeout: 260 seconds]
14:41 < krzee> np
14:41 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
14:44 -!- 77CAAFE42 [ionic@home.ionic.de] has quit [Ping timeout: 276 seconds]
14:47 -!- corretico [~luis@200.12.40.18] has quit [Read error: Connection reset by peer]
14:53 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
14:53 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
14:53 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
14:53 -!- qmr [~qmr@c-98-220-169-103.hsd1.in.comcast.net] has quit [Ping timeout: 260 seconds]
14:55 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:57 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 260 seconds]
15:00 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Quit: Leaving.]
15:00 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
15:00 -!- mode/#openvpn [+o raidz] by ChanServ
15:12 -!- qmr [~qmr@c-98-220-169-103.hsd1.in.comcast.net] has joined #openvpn
15:20 -!- Ionic_ [~genericfa@vpn.ionic.de] has joined #openvpn
15:26 -!- mape2k [~mape2k@f053195114.adsl.alicedsl.de] has quit [Ping timeout: 248 seconds]
15:28 -!- mirco [~mirco@tmo-102-12.customers.d1-online.com] has joined #openvpn
15:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
15:29 -!- mode/#openvpn [+v Axeman] by ChanServ
15:42 -!- MikeJansen1 [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Quit: Leaving.]
15:53 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:00  * ecrist starts migrating all his machines to vmware ESXi instances
16:01 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
16:01 < EugeneKay> What provider?
16:01 < ecrist> me
16:01 < EugeneKay> Ah, nice.
16:04 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:09 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
16:09 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 258 seconds]
16:09 -!- mirco [~mirco@tmo-102-12.customers.d1-online.com] has quit [Quit: mirco]
16:10 -!- lazzer [~lazzer@vmlinux.org] has quit [Ping timeout: 252 seconds]
16:15 -!- lazzer [~lazzer@vmlinux.org] has joined #openvpn
16:15 -!- Netsplit *.net <-> *.split quits: troyt, _DexTerDDIT, Fiouz, EugeneKay, Olipro, dxtr, decoder, Cr4zi3
16:16 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
16:16 -!- tessier [~treed@kernel-panic/copilotco] has joined #openvpn
16:16 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:17 < tessier> Hello all! What is the best, sure-fire way to know if a client is connected to the vpn? The openvpn-status file says a particular user is connected but the user says he is not.
16:19 -!- Netsplit over, joins: Olipro, Cr4zi3, EugeneKay, troyt, decoder, dxtr, _DexTerDDIT, Fiouz
16:21 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-30.html#p15848>
16:22 < merlin1991> what does happen if 2 clients with the same cert connect? (in other words if someone copies his config and certs to another machine)?
16:23 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
16:23 -!- mode/#openvpn [+v Axeman] by ChanServ
16:25 < Bushmills> depends on config. usually, old connection gets replaced against new connection
16:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Client Quit]
16:25 < Bushmills> replaced by ...
16:26 < EugeneKay> !duplicate-cn
16:26 <@vpnHelper> RSS Update - forum: Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-30.html#p15849>
16:26 < EugeneKay> !duplicatecn
16:26 < EugeneKay> !factoid search duplicate
16:26 < EugeneKay> !godihatethisbot
16:27 < EugeneKay> !dupe
16:27 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
16:27 < EugeneKay> merlin1991 ^
16:27 < merlin1991> !pki#
16:27 < merlin1991> !pki
16:27 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
16:27 <@vpnHelper> signed specially as a server (see !servercert)
16:28 < merlin1991> EugeneKay: it still doesn't say what happends if the same cert connects twice :D
16:29 < merlin1991> only that there is a not recommended way to allow 2 connections with the same cert
16:29 < EugeneKay> !man
16:29 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
16:29 < EugeneKay> search for --duplicate-cn
16:30 -!- lazzer [~lazzer@vmlinux.org] has quit [Ping timeout: 260 seconds]
16:31  * merlin1991 loves the use some bot command to point to a help page solution used troughout foss support channels (doing it myself too all the time)
16:31 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:31 < ecrist> krzee/krzie/all: I know my webserver is down.  thanks.
16:31 -!- lazzer [~lazzer@vmlinux.org] has joined #openvpn
16:31 < EugeneKay> What's the command to search the factoids list on this bot?
16:32 < ecrist> !factoids search foo
16:32 <@vpnHelper> No keys matched that query.
16:33 < EugeneKay> So close, yet so far.
16:33 < ecrist> otherwise
16:33 < ecrist> !factoids
16:33 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:33 < ecrist> but that link is offline at the moment - see above
16:34 < EugeneKay> It loaded for me.... must be firefox cache.
16:34 < ecrist> has to be.
16:34 < ecrist> I assure you, that site is most def. offline. ;)
16:34 < EugeneKay> "I have the hard drive in my hand"
16:34 < ecrist> root@kenny:~-> rsync -av / root@173.8.118.217:/tmp/root/
16:35 < ecrist> essentially
16:35 < ecrist> I'm moving it to a vmware image
16:35 < EugeneKay> I got a phone call once asking why $SERVER was down
16:35 < EugeneKay> Silly users
16:36 < ecrist> !google the webserver is down
16:36 <@vpnHelper> An error has occurred and has been logged. Please contact this bot's administrator for more information.
16:36 < ecrist> fuck you, vpnHelper
16:36 < ecrist> oh, heh, it probably can't resolve hostnames at the moment
16:37 < ecrist> http://www.youtube.com/watch?v=W8_Kfjo3VjU
16:37 < EugeneKay> Ugh youlube
16:41 < merlin1991> ecrist: http://www.youtube.com/user/jrwyt#p/u/14/uRGljemfwUE
16:47 -!- lazzer [~lazzer@vmlinux.org] has quit [Read error: Operation timed out]
16:47 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
16:51 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
16:54 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 252 seconds]
16:56 -!- lazzer [~lazzer@vmlinux.org] has joined #openvpn
17:07 -!- Ionic_ [~genericfa@vpn.ionic.de] has quit [Ping timeout: 256 seconds]
17:13 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
17:13 -!- naquad_ [~naquad@174.142.224.219] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:14 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 260 seconds]
17:14 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
17:15 -!- lazzer [~lazzer@vmlinux.org] has quit [Ping timeout: 276 seconds]
17:15 -!- lazzer [~lazzer@vmlinux.org] has joined #openvpn
17:19 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
17:20 -!- Ionic_ [~genericfa@vpn.ionic.de] has joined #openvpn
17:20 -!- naquad [~naquad@174.142.224.219] has joined #openvpn
17:43 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:43 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
17:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:52 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
17:54 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
17:54 < merlin1991> are there any known problems with openvpn and outpost firewall?
17:54 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 276 seconds]
17:54 -!- caemir_ is now known as caemir
17:59 -!- Squidy [~quassel@187.7.244.104] has joined #openvpn
17:59 -!- Squidy [~quassel@187.7.244.104] has quit [Changing host]
17:59 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
18:09 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
18:21 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
18:21 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
18:26 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
18:28 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
18:37 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has joined #openvpn
18:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
18:39 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has left #openvpn []
18:43 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
18:52 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 255 seconds]
18:57 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
18:58 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 276 seconds]
19:03 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
19:05 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Changing host]
19:05 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
19:09 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
19:13 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 256 seconds]
19:14 < EugeneKay> No known ones, but plenty of unknown ones.
19:14 -!- Netsplit *.net <-> *.split quits: troyt, _DexTerDDIT, Fiouz, EugeneKay, dxtr, decoder, Cr4zi3
19:20 -!- Netsplit over, joins: Cr4zi3, EugeneKay, troyt, decoder, dxtr, _DexTerDDIT, Fiouz
19:20 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Excess Flood]
19:21 < merlin1991> well in this case it wasn't the firewall but a disabled dhcp service on win, doh
19:22 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
19:22 < merlin1991> but now I've run into another problem, I need a bridged setup to allow broadcasts from client to client, but every article about bridges I find involves an interface + local subnet that gets bridged in, but I just want each vpn client to talk to each other and there is no network to bridge in
19:23 -!- Netsplit *.net <-> *.split quits: troyt, _DexTerDDIT, Fiouz, EugeneKay, dxtr, decoder, Cr4zi3
19:26 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:34 -!- Netsplit over, joins: Cr4zi3, EugeneKay, troyt, decoder, dxtr, _DexTerDDIT, Fiouz
19:34 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Excess Flood]
19:36 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
19:43 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
19:43 -!- Netsplit *.net <-> *.split quits: troyt, _DexTerDDIT, Fiouz, EugeneKay, dxtr, decoder, Cr4zi3
19:51 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:51 -!- mode/#openvpn [+v Axeman] by ChanServ
19:53 -!- Ionic_ [~genericfa@vpn.ionic.de] has quit [Ping timeout: 248 seconds]
19:55 -!- _julian [~quassel@hmbg-4d06c3da.pool.mediaWays.net] has joined #openvpn
19:59 -!- _julian_ [~quassel@hmbg-5f7601f0.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
20:08 -!- Ionic_ [~genericfa@195.37.186.62] has joined #openvpn
20:17 -!- Ionic_ [~genericfa@195.37.186.62] has quit [Ping timeout: 245 seconds]
20:17 -!- Ionic_ [~genericfa@vpn.ionic.de] has joined #openvpn
20:26 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:42 -!- cheako [~cheako@72.21.248.10] has joined #openvpn
20:42 -!- Netsplit over, joins: EugeneKay
20:43 < cheako> Hello, looking at several examples for ipv6 tunneling with openvpn I see that an up script is used.  This is not the case with ipv4, instead an ifconfig option is used.  Explain?
20:44 < cheako> I'm looking for link-local addresses or a private network(like a 10.x network in ipv4) for routing netblocks over.
20:45 < cheako> ...though I do have enough addresses where it's not a big deal to allocate a block here.
20:47 < cheako> I'm about ready to use a 6in4tunnel over openvpn.
20:49 < cheako> ohh, I'm looking for configs.  No logs yet, there is no config.  I'm willing to alter my plans to match suggestions.
20:50 < cheako> Though a working ipv4 connection is present currently, it can be deleted to enable v6.
20:53 -!- forerunner [~forerunne@31.31.36.225] has quit [Read error: Connection reset by peer]
20:53 -!- Ionic_ [~genericfa@vpn.ionic.de] has quit [Ping timeout: 256 seconds]
20:54 < Olipro> it's an upscript because the OpenVPN process currently lacks args for configuring IPv6
20:54 < Olipro> that'll be in the next version
20:54 < Olipro> or if you're willing to compile from the repo
20:55 < cheako> Olipro: Thank you.
20:55 < Olipro> since you're presumably using tun, link-local won't work for you
20:56 < Olipro> instead, use something in ULA space
20:56 < cheako> k
20:56 < Olipro> FC00::/7
20:56 < cheako> :) thx for saving me a trip to wikapedia by way of google.
21:04 < cheako> !yay I can ping.
21:09 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
21:10 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
21:18 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:18 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:20 -!- Ionic_ [~genericfa@home.ionic.de] has joined #openvpn
21:21 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
21:22 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:23 -!- Ionic [ionic@ionic.de] has joined #openvpn
21:23 -!- ropetin [~ropetin@pdpc/supporter/student/ropetin] has quit [Ping timeout: 252 seconds]
21:33 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:38 -!- codemarauder [~nishant@121.243.147.217] has joined #openvpn
21:38 < codemarauder> newbie question, while using PSK, can I use the same key for multiple clients? I just have to connect 2 spokes to 1 hub.
21:41 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
21:43 < EugeneKay> codemarauder - Static Key? no, it only works for single server-client. You can run two openvpn instances on the Server, though, and accomplish the same thing.
21:44 < EugeneKay> It's highly recommended to use SSL/TLS keys, though.
21:45 < codemarauder> EugeneKay: Thanks a lot. I was being a bit lazy, but now reading through for SSL/TLS keys 
21:46 < codemarauder> this is going to be a test setup with 2 spokes and 1 hub, and if successful, will have to scale to 50 spokes. Better to go with SSL/TLS it seems.
21:59 < EugeneKay> Definitely. 
22:02 < codemarauder> EugeneKay: Thanks :)
22:02  * codemarauder rushes on site to setup openvpn, my first ever
22:03 < EugeneKay> I recommend XCA if you're gonna be managng a buncha clients. It takes a bit of learning as to the ins-and-outs of SSL PKI, but it's time well spent.
22:03 < EugeneKay> Hrm, I should make up a XCA DB with the defaults I use.... 
22:04 < Olipro> you mean templates
22:04 < Olipro> ...in a DB
22:05 < EugeneKay> Well, "database" is a very loose fit, but it's the best analogue. ANd the files are named ".xdb", so....
22:05 < EugeneKay> ANd yes, Certificate Templates.
22:05 < Olipro> sadly XCA development seems to have died
22:05 < Olipro> the last commit to git was 5th May
22:07 < Olipro> hm, his personal git has last commit as 20 Jul
22:07 < Olipro> there's hope yet
22:07 -!- codemarauder [~nishant@121.243.147.217] has quit [Ping timeout: 248 seconds]
22:07 < EugeneKay> It's one of those programs that isn't really in need of more features
22:08 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:10 < EugeneKay> Looks like the last release was in August.... last year.
22:14 < Olipro> yup
22:24 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
22:47 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
23:31 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15857> || PPTPD service on Openvpn AS machine!? <http://forums.openvpn.net/topic8860.html#p15856> || Sharing a single OpenVPN server across multiple clients <http://forums.openvpn.net/topic8861.html#p15855> || Can ping openvpn server while connected but not others <http://forums.openvpn.net/topic8845-30.html#p15854> || VPN Clien
23:35 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 255 seconds]
23:36 < ecrist> !google the website is down
23:36 <@vpnHelper> The Website Is Down: <http://www.thewebsiteisdown.com/>; The Website Is Down | Rearranging your desktop since 1213989505.: <http://dpt.thewebsiteisdown.com/dpt/>; The Website is Down Episode #1: Sales Guy vs Web Dude | The ...: <http://dpt.thewebsiteisdown.com/dpt/node/1>
23:37 <@vpnHelper> RSS Update - forum: lan DHCP requests <http://forums.openvpn.net/topic8852.html#p15859> || PPTPD service on Openvpn AS machine!? <http://forums.openvpn.net/topic8860.html#p15858>
23:44 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
23:57 -!- albech [~albech@183.88.67.63] has joined #openvpn
--- Day changed Fri Sep 23 2011
00:13 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
00:19 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 255 seconds]
00:20 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
00:24 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 245 seconds]
00:51 -!- mape2k [~mape2k@p5B24BA8B.dip.t-dialin.net] has joined #openvpn
00:51 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 258 seconds]
01:26 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
01:37 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:39 -!- dazo_afk is now known as dazo
01:40 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
01:43 <@vpnHelper> RSS Update - forum: Sharing a single OpenVPN server across multiple clients <http://forums.openvpn.net/topic8861.html#p15860>
01:50 <@vpnHelper> RSS Update - forum: lan DHCP requests <http://forums.openvpn.net/topic8852.html#p15862> || Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853.html#p15861>
02:07 < Mowee> Morning
02:09 -!- EugeneKay is now known as EugeneSleep
02:09  * EugeneSleep snores
02:14 <@vpnHelper> RSS Update - forum: PPTPD service on Openvpn AS machine!? <http://forums.openvpn.net/topic8860.html#p15864>
02:15 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:20 <@vpnHelper> RSS Update - forum: Test <http://forums.openvpn.net/topic8346.html#p15865>
02:26 <@vpnHelper> RSS Update - forum: Issue accessing DHCP clients <http://forums.openvpn.net/topic8795.html#p15867> || Client Default Config <http://forums.openvpn.net/topic8830.html#p15866>
02:33 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
02:34 < reiffert> krzie: 
02:44 <@vpnHelper> RSS Update - forum: Failover validation <http://forums.openvpn.net/topic8797.html#p15868>
02:47 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
03:04 -!- albech [~albech@183.88.67.63] has quit [Remote host closed the connection]
03:12 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
03:12 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
03:12 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
03:12 -!- dxtr [s3wark@unaffiliated/dxtr] has joined #openvpn
03:12 -!- _DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
03:12 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
03:13 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Excess Flood]
03:15 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
03:20 < reiffert> krzee: 
03:20 < reiffert> krzie: 
03:25 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:30 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
03:32 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
03:33 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
03:35 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
03:36 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
03:36 -!- mode/#openvpn [+o raidz] by ChanServ
03:41 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
03:42 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
03:42 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
03:42 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
03:42 -!- mode/#openvpn [+o raidz] by ChanServ
04:01 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
04:05 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
04:05 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
04:05 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:42 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
04:47 -!- _zero__ [~zero@noc.toile-libre.net] has joined #openvpn
04:48 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Operation timed out]
04:49 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
04:51 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has joined #openvpn
05:02 <@vpnHelper> RSS Update - forum: Security - Client Service <http://forums.openvpn.net/topic8863.html>
05:03 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:03 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:14 <@vpnHelper> RSS Update - forum: openvpn, windows client -> linux server no connection <http://forums.openvpn.net/topic8811.html#p15870>
05:20 <@vpnHelper> RSS Update - forum: Windows - Block access when the client looses the connection <http://forums.openvpn.net/topic8864.html>
05:25 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
05:42 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Ping timeout: 252 seconds]
05:45 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
05:46 -!- mode/#openvpn [+v Axeman] by ChanServ
05:55 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:11 -!- defswork_ [~andy@hns01-fw.internal.gxn.net] has joined #openvpn
06:14 -!- luneff [~yury@109.165.62.245] has joined #openvpn
06:15 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 260 seconds]
06:22 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
06:23 -!- luneff [~yury@109.165.62.245] has quit [Ping timeout: 248 seconds]
06:25 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
06:26 -!- luneff [~yury@109.165.62.245] has joined #openvpn
06:38 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:02 -!- defswork_ [~andy@hns01-fw.internal.gxn.net] has quit [Ping timeout: 256 seconds]
07:14 -!- defswork_ [~andy@mx2.3gcomms.co.uk] has joined #openvpn
07:25 -!- Cain [~Geek@unaffiliated/cain] has left #openvpn []
07:39 <@vpnHelper> RSS Update - forum: Connect to openvpn before logon windows 7 <http://forums.openvpn.net/topic8854.html#p15873>
07:45 <@vpnHelper> RSS Update - forum: Windows - Block access when the client looses the connection <http://forums.openvpn.net/topic8864.html#p15874>
07:45 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
07:47 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:47 -!- mode/#openvpn [+v Axeman] by ChanServ
07:51 <@vpnHelper> RSS Update - forum: PPTPD service on Openvpn AS machine!? <http://forums.openvpn.net/topic8860.html#p15876> || openvpn, windows client -> linux server no connection <http://forums.openvpn.net/topic8811.html#p15875>
07:53 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
07:54 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
07:54 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
07:54 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
07:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Read error: Operation timed out]
07:59 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
07:59 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
07:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
08:26 -!- EugeneSleep is now known as EugeneKay
08:31 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:33 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
08:34 -!- gardar [~gardar@gardar.net] has joined #openvpn
08:34 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
08:35 -!- gardar [~gardar@gardar.net] has joined #openvpn
08:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
08:57 <@vpnHelper> RSS Update - forum: Windows - Block access when the client looses the connection <http://forums.openvpn.net/topic8864.html#p15877>
09:02 -!- x-demon [xdemon@2a01:4f8:130:6282::2] has joined #openvpn
09:02 -!- x-demon [xdemon@2a01:4f8:130:6282::2] has quit [Client Quit]
09:04 -!- master_of_master [~master_of@p57B54B69.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:05 -!- Mysterious [~junix@d170253.adsl.hansenet.de] has joined #openvpn
09:06 -!- master_of_master [~master_of@p57B547A6.dip.t-dialin.net] has joined #openvpn
09:08 -!- corretico [~luis@200.12.40.18] has joined #openvpn
09:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:11 < krzie> sup reiffert 
09:13 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853-15.html#p15878>
09:14 < Mysterious> hello. i set up openvpn on my linux machine. i run a openvpn server as well as a client on the same computer thus i got two interfaces tun0(server) and tun1(client). server is bound to port 1194, client to 1195.      Another client is connected via internet.  the communication between server and internet client is working perfectly. but the whole communication between server and same-computer client and between internet-client and same-computer
09:15 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:17 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
09:26 < reiffert> krzie: you are 8 hours late :)
09:28 <+novaflash> reiffert; i got debian linux running and openvpn is working. had to make some drastic cuts in packages tho. but it's all working fine now.
09:29 <+novaflash> reiffert; it wasn't so difficult. once i filled up the drive, it grew, just like you said.
09:33 -!- phunyguy [~phunyguy@159.178.100.253] has quit [Ping timeout: 260 seconds]
09:37 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853-15.html#p15879>
09:55 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has quit [Ping timeout: 260 seconds]
10:03 -!- dazo is now known as dazo_afk
10:19 -!- mape2k [~mape2k@p5B24BA8B.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
10:21 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
10:23 -!- iruvtacos_ [465a3e22@gateway/web/freenode/ip.70.90.62.34] has joined #openvpn
10:25 < krzie> haha im right on time!
10:28 -!- Mysterious [~junix@d170253.adsl.hansenet.de] has left #openvpn []
10:29 < ecrist> hey krzie, how goes?
10:31 < jeev> http://i.imgur.com/pcW6a.jpg
10:32 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 260 seconds]
10:37 < iruvtacos_> hi, i had a kind of general question about vpn's. so i am connected through my vpn and my laptop has an ip on its vpn interface from the private subnet i vpn'd to and the ip of my local network through wifi. shouldn't i be able to putty to other machines local ip addresses that are on the remote local network?
10:38 < Bushmills> depends
10:38 < iruvtacos_> how so?
10:39 < Bushmills> openvpn server config determines whether your client is allowed to contact other vpn clients
10:39 < Bushmills> if those are the clients you mean by "remote local network"
10:40 < Bushmills> if those aren't openvpn clients, but on the lan behind openvpn server, the server needs to be configured to allow access to those too.
10:40 < iruvtacos_> oh ok
10:41 < Bushmills> compare it to  "i have plugged in a network cable into a NIC of this machine - shouldn't i be able now to contact all the hosts on its other NIC?" 
10:44 < iruvtacos_> so in your analogy it would be my laptop connected to the nic of the vpn server correct?
10:46 < krzie> wassup ecrist, all is well =]
10:46 < krzie> how about you?
10:47 < Bushmills> it's not really just an analog, as the virtual interface you're connecting to behaves very much like a physical interface, from viewpoint of the machine which brought it up
10:48 < krzie> !route
10:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
10:53 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 245 seconds]
10:56 -!- omgub [ps@c-69-138-168-63.hsd1.md.comcast.net] has joined #openvpn
10:56 -!- iruvtacos_ [465a3e22@gateway/web/freenode/ip.70.90.62.34] has left #openvpn []
10:56 -!- iruvtacos_ [465a3e22@gateway/web/freenode/ip.70.90.62.34] has joined #openvpn
11:02 <@vpnHelper> RSS Update - forum: lan DHCP requests <http://forums.openvpn.net/topic8852.html#p15881> || how to make 1 account per session? <http://forums.openvpn.net/topic8770.html#p15880>
11:26 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
11:33 -!- Fritz09_ [~Fritz09@pop1-438.catv.wtnet.de] has joined #openvpn
11:34 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
11:42 -!- luneff [~yury@109.165.62.245] has quit [Quit: This computer has gone to sleep]
11:43 -!- Fritz09_ [~Fritz09@pop1-438.catv.wtnet.de] has quit [Quit: Bye]
12:24 -!- K1ng [~k1ng@180.211.188.143] has joined #openvpn
12:24 -!- arosen [~arosen@130.127.39.181] has joined #openvpn
12:24 -!- K1ng [~k1ng@180.211.188.143] has quit [Changing host]
12:24 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:25 < arosen> Does openvpn do anything to stop loops at Layer 2 on the client side? 
12:25 < arosen> For example if i have  a L2 vpn and the client then bridges the tap with eth0
12:25 < arosen> Then another client on that lan does the same thing. 
12:26 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
12:26 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:29 -!- luneff [~yury@84.51.192.74] has joined #openvpn
12:30 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
12:31 < poster> I don't think you'd have each client connection build a bridge, you'd have the bridge setup on startup, then the VPN links in would inheritly be a member
12:31 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
12:32 < poster> the other option which I did prior to learning of the server-bridge directive was to launch openvpn from xinetd
12:32 < poster> then dynamically add the allocated tap adapter to a bridge, which then had an IP address bound
12:33 < poster> it was a crude workaround to create a VPN subnet, but it did work
12:33 < arosen> poster: this is what I want to setup. 
12:33 < poster> server-bridge is much, much cleaner and what I use now
12:33 < arosen> say you have two clients connected to switch 1
12:33 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
12:33 < arosen> you connect them to the vpn server
12:33 < arosen> now client1 wants to talk to client2 
12:33 < arosen> right now they would talk though the tap that goes all the way to the vpn server
12:34 < arosen> if i bridge tap0 and eth0 then they could talk though the switch but this causes a loop
12:34 < poster> how are client1 and client2 connected to the VPN server?
12:36 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
12:37 < arosen> via the tap
12:37 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has joined #openvpn
12:37 < DeltachaosDeskto> hi @all
12:38 < poster> if both clients are coming in on tap0, they could inheritly talk without the bridge in place
12:38 < poster> the initial arp who-has traffic will traverse the bridge, but that should be it
12:38 < arosen> poster: yes they can talk but they talk though the vpn server
12:39 < arosen> poster: i mean two different phyiscial clients
12:39 < poster> is that a problem?
12:39 < arosen> yea the vpn server is across the world 
12:39 < DeltachaosDeskto> how high is the performance impact when using 4096 bit keys?
12:39 < poster> if you run a wireless network they operate the same
12:39 < poster> DeltachaosDeskto: I think that would depend heavily on the number of clients and speeds which were being used on the link
12:40 < DeltachaosDeskto> poster: well at the beginning about 10 clients
12:40 < DeltachaosDeskto> may later more 
12:41 < DeltachaosDeskto> sppeds. link is 16Mbit/s
12:42 -!- pfrench [~pfrench@rrcs-24-199-157-59.midsouth.biz.rr.com] has joined #openvpn
12:42 < poster> each frame would need to be encrypted, the heavier the more CPU intensive, you could just try it and see how the system holds up
12:43 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
12:43 < pfrench> my peeps have openvpn running on ubuntu 11.04; when they here working on the network itself they have issues... can one run openvpn while on the network itself?
12:44 < pfrench> someone suggested stopping openvpn while on the network, but I feel like there's got to be a better way
12:46 < poster> your VPN clients can still connect, but there may be routing issues if the pushed routes match those which are already local
12:46 < poster> it would depend on the default metric, I think in the Windows world it's relatively high
12:47 < poster> arosen: if you want the clients to go direct, you would have to establish a link between the two, independent of the remote VPN system
12:47 -!- Tyl3R [~3M113Tu0Y@187.78.209.129] has joined #openvpn
12:48 < Tyl3R> When I configure ifconfig [ipaddress] [subnet] within the server's conf, am I obliged to do so within the clients configuration also?
12:48 < DeltachaosDeskto> is it posible to use a 4096 CA certificate but have 2048 or 1028 bit certificates for the clients?
12:50 -!- Fritz09_ [~Fritz09@pop1-438.catv.wtnet.de] has joined #openvpn
12:50 < Tyl3R> And also, what is the semantics behind the route clause. For example by setting push "route add default gw [ip address] triggers errors when I start the service."
12:51 < poster> Tyl3R: I believe you will get a warning about a configuration mismatch at least, not sure if OpenVPN will run
12:52 < Tyl3R> OpenVPN runs poster, but the tun interface isn't brought up in the client.
12:52 < poster> you don't have to bring the tun adapter up
12:53 < poster> but there's no one at the other end to talk to, which may be bad
12:54 < poster> if you have say a class C you're working with, try adding this to the server configuration:
12:54 < poster> ifconfig 192.168.1.1 255.255.255.0
12:54 < poster> it should bring up the associated adapter with that IP address and subnet mask
12:54 < poster> from there:
12:54 < poster> push "route 192.168.10.0 255.255.255.0 192.168.1.1"
12:55 < poster> you can push routes from the server versus the client configuration
12:56 < Tyl3R> Where did that 192.168.10.0 come from?
12:56 < Tyl3R> Your telling that network 192.168.10.0 should get out through 192.168.1.1 right?
12:57 < Tyl3R> The whole 192.168.10.0 network
12:57 < poster> 192.168.10.0/24 is a hypothetical internal network you wish to route to
12:57 < poster> it could be anything really
12:58 < pfrench> it appears that I am able to access everything on my network wirelessly and on ethernet without openvpn running; with openvpn running I can access everything wirelessly but not while on ethernet; I'm running ubuntu 11.04; can anyone help?
12:58 < poster> as far as the client not bringing up tun, I think the tun is only brought up by openvpn once the daemon has connected
12:58 < poster> pfrench: are your wired and wireless networks segmented?
12:59 < Tyl3R> No
13:02 < poster> Tyl3R: not sure I follow, No what?\
13:03 < pfrench> poster: yes, I think... 
13:03 < Tyl3R> I answered pfrench thinking it was you poster. Sorry abou that.
13:04 < Tyl3R> WARNING: 'ifconfig' is present in remote config but missing in local config, remote='ifconfig [ip] [mask]'
13:05 < Tyl3R> ERROR: Linux route add command failed: external program exited with error status: 7
13:09 < Tyl3R> The I1m looking forward to doing is set my route through my vpn. I want to, for example, set my default gateway through my vpn.
13:11 < Tyl3R> When I bring up the tunnel I'm able to connect to ping the vpn server, ping my physycal ISP router.
13:11 < poster> Tyl3R: Ok you don't need any ifconfig statements on the client side, when ommited, they client will get routes from the server
13:12 < poster> if you want to route all internet traffic to the VPN system, just create a default route with a low metric
13:12 < poster> something like:
13:12 < poster> push "route 0.0.0.0 0.0.0.0 192.168.1.1 10"
13:13 < poster> the first 0.0.0.0 is the network address, second is network mask, third is gateway, fourth is metric
13:13 < Tyl3R> Trying that now!
13:14 < poster> are you running server-bridge on the server side Tyl3R ?
13:14 < Tyl3R> ERROR: Linux route add command failed: external program exited with error status: 7
13:15 < poster> is that on the client?
13:15 < Tyl3R> Yes
13:15 < poster> I am not very familiar with Linux clients on the server-bridge arrangement
13:15 < poster> are you dropping privileges on the client?
13:16 < poster> as in running it as "nobody" or some other unprivileged user
13:16 < Tyl3R> Right now i'm running everything as root.
13:17 < poster> may have to poke around with the script-security directive (I think, going from memory)
13:17 < Tyl3R> No i didn't set any non privileged user on the configs.
13:17 < poster> ok that's ok for testing, operationally not as good 
13:18 < ecrist> krzie: I'm working on moving kenny today/yesterday.  you likely will notice a disruption here and there as I work on it
13:18 < ecrist> lots of stuff on that box, so file transfer has been going on for about 6 hours already
13:24 -!- Tyl3R [~3M113Tu0Y@187.78.209.129] has quit [Ping timeout: 248 seconds]
13:29 -!- Tyl3R [~3M113Tu0Y@187.78.210.69] has joined #openvpn
13:39 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 276 seconds]
13:44 <@vpnHelper> RSS Update - forum: Help with my network with openvpn <http://forums.openvpn.net/topic8855.html#p15882>
13:48 -!- Tyl3R [~3M113Tu0Y@187.78.210.69] has quit [Ping timeout: 248 seconds]
13:55 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:56 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
13:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 256 seconds]
14:00 -!- Fritz09_ [~Fritz09@pop1-438.catv.wtnet.de] has quit [Quit: Bye]
14:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:06 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:08 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
14:11 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has quit [Ping timeout: 248 seconds]
14:21 -!- Tyl3R [~3M113Tu0Y@187.113.173.185] has joined #openvpn
14:26 -!- Fritz09_ [~Fritz09@pop1-438.catv.wtnet.de] has joined #openvpn
14:34 -!- iruvtacos_ [465a3e22@gateway/web/freenode/ip.70.90.62.34] has quit [Quit: Page closed]
14:40 -!- Tyl3R [~3M113Tu0Y@187.113.173.185] has quit [Ping timeout: 255 seconds]
14:40 < krzie> ecrist, sounds cool =]
14:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:46 -!- mode/#openvpn [+v Axeman] by ChanServ
14:47 -!- Fritz09_ [~Fritz09@pop1-438.catv.wtnet.de] has quit [Quit: Bye]
14:47 -!- kusznir [~kusznir@casas-net.ailab.wsu.edu] has joined #openvpn
14:47 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:47 -!- mode/#openvpn [+v Axeman2] by ChanServ
14:48 -!- Ionic_ [~genericfa@home.ionic.de] has quit [Ping timeout: 245 seconds]
14:48 < kusznir> Hi all: quick question: what are my options for improving throughput on an openvpn where one endpoint is CPU limited at 2.4Ghz P4 (at least 5 years old, probably 7-8).  I was thinking along the lines of a PCI card to handle encryption, or possibly even turning off encryption for this one endpoint.
14:48 < kusznir> (or choosing a less intense encryption than the default)
14:49 < krzie> not dual core?
14:49 < krzie> is cpu your limiting factor?  (high cpu usage?)
14:49 < krzie> a lot of people experience throughput issues on newer hardware as well...
14:49 < kusznir> krzee, Yes, its single core (hyperthreaded: remember 6+ years old), and cpu is maxed out.
14:50 < krzie> ahh ok
14:50 < krzie> well you could see if lzo makes a difference or not
14:50 < krzie> be sure to use tun instead of tap if possible
14:50 < krzie> if you do get a pci card for enc, you will need to build openssl for it
14:51 < krzie> openvpn lets openssl handle its enc
14:51 < kusznir> This box serves one purpose: amanda backup server.  Unfortunately, it needs to be "off site" and routable to the inside network at our main facility.  I have 1Gbps minimum end-to-end connection speed, accross one router.
14:51 < krzie> !gigabit
14:51 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
14:51 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
14:51 < krzie> now i see, you have a serious link
14:51 < krzie> you may just want to upgrade the endpoint
14:52 < kusznir> I am running tun, and I have lzo turned on, IIRC.  I typically get about 50mbps-200mbps out of my connection.
14:52 < krzie> ild imagine that enc is important if its your backups
14:52 < kusznir> Yea, I was hoping to not have to do that.  Of course, no budget for new hardware for backups :(
14:52 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 256 seconds]
14:53 < kusznir> I could switch to client-encrypted backups and then not encrypt the network link.  Or if there's less intensive encryption  algorithms I could choose, that would at least help.
14:53 < krzie> ahh
14:53 < krzie> well blowfish is pretty fast
14:53 < krzie> unless you get an addon card, then things change based on what card
14:53 -!- melfy [~jay@ip70-160-198-36.hr.hr.cox.net] has joined #openvpn
14:54 -!- melfy [~jay@ip70-160-198-36.hr.hr.cox.net] has left #openvpn ["Leaving."]
14:54 < kusznir> krzie, could you offer some rough estimates/options for add-in cards good for use in this application (backup server is CentOS 5.7)
14:55 < kusznir> (my openvpn "hub" is my dedicated firewall/router running on pfSense, and is a dual-core CPU, with cpu utilization topping out at around 50% typically)
14:55 < krzie> actually i cant =/
14:56 < krzie> ive never used one
14:56 < kusznir> so its the backup server that's mostly restricted.  I'm really curious about add-in encryption cards in general, not necessarily going to do it, but wondering about general performance metrics, an example or two of cards that work with linux, general price range, and what's involved in getting them running.
14:56 < kusznir> Oh, OK.
14:56 < krzie> oh however
14:56 < krzie> you dont need to run openvpn on the backup server
14:56 < krzie> you can run it on any machine in the lan
14:56 < krzie> !route
14:56 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
14:57 < kusznir> Yea, I run several clients on my openvpn network that are vpn "routers".  In this case, this machine is the only one I've got in the building, which is why I just ran openvpn on the same machine.  I do already have about 25 subnets routed through openvpn (a client's routing table gets _real_ long after connecting!)
14:58 < krzie> =]
14:59 < krzie> ya my routing table is pretty long too
14:59 < krzie> my ifconfig is long as hell as well
14:59 < kusznir> Around here, I'm considered the master of networking voodoo...or "the black art"...But our network gets the job done well and pretty secureyly.
15:00 < krzie> im jealous of your gigabit
15:00 < krzie> definitely read !gigabit
15:00 < krzie> jjk is a openvpn MASTER (he literally wrote the book on it)
15:00 < krzie> !book
15:00 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
15:00 -!- Tyl3R [~3M113Tu0Y@187.78.210.69] has joined #openvpn
15:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
15:08 -!- Fritz09_ [~Fritz09@pop1-438.catv.wtnet.de] has joined #openvpn
15:09 < kusznir> krzie, what is the default encryption algorithm openvpn uses if you don't specify one?
15:10 < krzie> blowfish for the cipher
15:17 -!- Ionic_ [~genericfa@vpn.ionic.de] has joined #openvpn
15:17 -!- bitterman [~yury@84.51.192.74] has joined #openvpn
15:18 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-2925525063.dsl.bell.ca] has quit []
15:21 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 255 seconds]
15:26 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
15:29 -!- Fritz09_ [~Fritz09@pop1-438.catv.wtnet.de] has quit [Quit: Bye]
15:35 -!- sterna [~jype@vu2.hehe.si] has joined #openvpn
15:35 < sterna> hi, i get TLS Error: Unroutable control packet received from x (si=3 op=P_CONTROL_V1)
15:35 < sterna> and the clocks are synced
15:35 < sterna> what do i do?
15:43 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
15:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:47 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 256 seconds]
15:48 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
16:01 -!- Tyl3R [~3M113Tu0Y@187.78.210.69] has quit [Quit: Ex-Chat]
16:33 -!- Netsplit *.net <-> *.split quits: dxtr, _DexTerDDIT, troyt, Cr4zi3, decoder, Fiouz
16:34 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Quit: Leaving.]
16:34 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
16:34 -!- mode/#openvpn [+o raidz] by ChanServ
16:37 -!- Netsplit over, joins: Cr4zi3, troyt, decoder, dxtr, _DexTerDDIT, Fiouz
16:39 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Excess Flood]
16:40 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
16:44 -!- Ionic_ [~genericfa@vpn.ionic.de] has quit [Ping timeout: 248 seconds]
16:49 <@vpnHelper> RSS Update - forum: Acsess VMware client on host computer <http://forums.openvpn.net/topic8858.html#p15884>
16:58 -!- Ionic_ [~genericfa@vpn.ionic.de] has joined #openvpn
17:01 < ecrist> boats
17:01 < ecrist> and
17:01 < ecrist> hos
17:02 -!- sterna [~jype@vu2.hehe.si] has left #openvpn []
17:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
17:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:04 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has quit [Ping timeout: 276 seconds]
17:04 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
17:17 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
17:19 <@vpnHelper> RSS Update - forum: How to pass SIP calls over OpenVPN Tunnel <http://forums.openvpn.net/topic8865.html>
17:24 -!- Netsplit *.net <-> *.split quits: _DexTerDDIT, troyt, dxtr, decoder, Fiouz
17:30 -!- Netsplit over, joins: decoder
17:30 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
17:30 -!- Netsplit over, joins: Fiouz
17:31 -!- dxtr [mii99s@unaffiliated/dxtr] has joined #openvpn
17:31 -!- Netsplit over, joins: troyt
17:36 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
17:43 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
18:03 -!- toortog [~toortog@notsecure.net] has quit [Read error: Connection reset by peer]
18:04 -!- toortog [~toortog@notsecure.net] has joined #openvpn
18:09 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
18:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 240 seconds]
18:11 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
18:17 <@vpnHelper> RSS Update - forum: OpenVPN interaction across VMs? <http://forums.openvpn.net/topic8866.html>
18:25 -!- Ionic_ [~genericfa@vpn.ionic.de] has quit [Ping timeout: 256 seconds]
18:38 -!- Ionic_ [~genericfa@vpn.ionic.de] has joined #openvpn
18:51 < cheako> Odd question.  Debian/Ubuntu has an ifup/ifdown system for configuring addresses, like ipv6 manual, can this be used as an up script for openvpn?  I'm going to try.
18:53 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 276 seconds]
19:00 -!- knightrage [~kevin@2001:470:e074::1] has quit [Ping timeout: 244 seconds]
19:01 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:02 -!- Ionic [ionic@ionic.de] has quit [Read error: Operation timed out]
19:05 -!- Ionic [ionic@ionic.de] has joined #openvpn
19:05 -!- Ionic is now known as Guest32198
19:13 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:17 -!- Squidy [~quassel@187.7.244.104] has joined #openvpn
19:17 -!- Squidy [~quassel@187.7.244.104] has quit [Changing host]
19:17 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:26 -!- Ionic_ [~genericfa@vpn.ionic.de] has quit [Ping timeout: 260 seconds]
19:40 -!- Ionic [~genericfa@195.37.186.62] has joined #openvpn
19:40 -!- Ionic is now known as Guest47968
19:44 -!- Guest47968 [~genericfa@195.37.186.62] has quit [Ping timeout: 255 seconds]
19:45 -!- Ionic_ [~genericfa@vpn.ionic.de] has joined #openvpn
19:54 -!- _julian_ [~quassel@hmbg-5f760b55.pool.mediaWays.net] has joined #openvpn
19:58 -!- _julian [~quassel@hmbg-4d06c3da.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
20:23 -!- sam555 [~sysadmin@udp124488uds.hawaiiantel.net] has joined #openvpn
20:23 < sam555> hello all!
20:23 < sam555> Can I use the openvpn configuration, key and crts with an iphone vpn?
20:24 < sam555> the choices are l2tp ptp and ipsec
20:27 < sam555> guess this is the deal https://discussions.apple.com/thread/1607496?start=105&tstart=0
20:27 <@vpnHelper> Title: OpenVPN Compatibility?: Apple Support Communities (at discussions.apple.com)
20:32 -!- Ionic_ [~genericfa@vpn.ionic.de] has quit [Ping timeout: 245 seconds]
20:32 < sam555> http://www.guizmovpn.com/
20:32 <@vpnHelper> Title: GuizmOVPN - OpenVPN GUI for iPhone/iPad (at www.guizmovpn.com)
20:41 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
20:43 -!- sam555 [~sysadmin@udp124488uds.hawaiiantel.net] has left #openvpn []
20:49 -!- Axeman3 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:53 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
20:54 -!- nioboozmar [~nioboozma@dyn-129-78-251-12.wirelessguest.usyd.edu.au] has joined #openvpn
20:57 -!- Axeman3 is now known as Axeman
20:57 -!- Axeman is now known as Guest59208
21:01 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
21:06 -!- Guest32198 [ionic@ionic.de] has quit [Excess Flood]
21:07 -!- sam555 [~sysadmin@udp124488uds.hawaiiantel.net] has joined #openvpn
21:07 < sam555> !iphone
21:07 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
21:07 <@vpnHelper> iPhone and iPad.
21:08 -!- Ionic [Zonk@ionic.de] has joined #openvpn
21:09 -!- Ionic_ [~genericfa@home.ionic.de] has joined #openvpn
21:09 -!- Squidy_at_Home [~quassel@187.7.244.104] has joined #openvpn
21:10 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 256 seconds]
21:45 -!- Ionic_ [~genericfa@home.ionic.de] has quit [Ping timeout: 276 seconds]
21:48 -!- Guest59208 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 260 seconds]
21:49 -!- Ionic [Zonk@ionic.de] has quit [Excess Flood]
21:51 -!- Ionic_ [ionic@home.ionic.de] has joined #openvpn
21:53 -!- Ionic [ionic@ionic.de] has joined #openvpn
21:54 -!- qmr [~qmr@c-98-220-169-103.hsd1.in.comcast.net] has left #openvpn []
22:06 -!- quadDama1e [~EmperorTo@216.17.68.153] has joined #openvpn
22:06 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
22:07 -!- Netsplit *.net <-> *.split quits: deever, yell0, Diffen, chantra, meepmeep, _julian_, mete, gremly, rooth, n2deep,  (+7 more, use /NETSPLIT to show all of them)
22:07 -!- _julian [~quassel@hmbg-5f760b55.pool.mediaWays.net] has joined #openvpn
22:07 -!- Netsplit over, joins: meepmeep
22:08 -!- Netsplit over, joins: EvilJStoker
22:09 -!- Netsplit over, joins: chantra
22:09 -!- Netsplit over, joins: rooth
22:09 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
22:09 -!- Netsplit over, joins: n2deep
22:11 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
22:11 -!- Guest59208 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
22:12 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
22:12 -!- mete [~mete@mete.shell.la] has joined #openvpn
22:14 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
22:14 -!- mode/#openvpn [+o dazo_afk] by ChanServ
22:19 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:22 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:24 -!- Titania [~titania@208.79.15.254] has joined #openvpn
22:25 -!- cheako [~cheako@72.21.248.10] has joined #openvpn
22:25 -!- Titania [~titania@208.79.15.254] has quit [Max SendQ exceeded]
22:27 -!- Guest59208 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Ping timeout: 260 seconds]
22:41 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 240 seconds]
22:51 < forerunner> can wer use it for iphone and itouch?
22:59 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
23:14 <@vpnHelper> RSS Update - forum: custom encryption algorithm on select users <http://forums.openvpn.net/topic8867.html>
23:16 -!- Squidy_at_Home [~quassel@187.7.244.104] has quit [Remote host closed the connection]
23:18 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
23:47 -!- forerunner [~forerunne@31.31.36.225] has left #openvpn []
--- Day changed Sat Sep 24 2011
00:00 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
00:06 -!- nioboozmar [~nioboozma@dyn-129-78-251-12.wirelessguest.usyd.edu.au] has quit [Quit: Leaving...]
00:11 -!- forerunner [~forerunne@31.31.36.225] has left #openvpn []
00:33 <@vpnHelper> RSS Update - forum: STOP "Need IPv6 code in mroute_extract_addr_from_packet" ??? <http://forums.openvpn.net/topic8833.html#p15888>
00:40 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has quit [Quit: Leaving.]
00:47 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has joined #openvpn
01:09 <@vpnHelper> RSS Update - forum: OpenVPN interaction across VMs? <http://forums.openvpn.net/topic8866.html#p15889>
01:27 <@vpnHelper> RSS Update - forum: How to pass SIP calls over OpenVPN Tunnel <http://forums.openvpn.net/topic8865.html#p15891>
01:32 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
01:43 -!- sam555 [~sysadmin@udp124488uds.hawaiiantel.net] has left #openvpn []
01:56 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:24 -!- nb [~nb@fedora/znc.nb] has quit [Ping timeout: 240 seconds]
02:35 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
02:39 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
03:25 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has joined #openvpn
03:25 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
03:28 -!- bitterman [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
04:10 -!- luneff [~yury@188.114.44.188] has joined #openvpn
04:21 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
04:22 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
04:30 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
04:37 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:39 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
04:48 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:49 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Computer has gone to sleep]
04:50 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
04:56 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
04:57 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Client Quit]
05:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
05:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:26 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
05:34 -!- albech [~albech@183.88.67.63] has joined #openvpn
05:37 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
05:37 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Client Quit]
06:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
06:20 -!- dazo_afk is now known as dazo
06:20 -!- belZe [irc@cl-457.dus-01.de.sixxs.net] has quit [Remote host closed the connection]
06:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:26 -!- cpm [~Chip@web-gw.xo.avitecture.net] has joined #openvpn
06:26 -!- cpm [~Chip@web-gw.xo.avitecture.net] has quit [Changing host]
06:26 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:44 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
07:04 -!- Guest59208 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
07:05 -!- Guest59208 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Client Quit]
07:17 -!- jbb [~yeeb@184.105.219.149] has left #openvpn ["o/"]
07:30 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
07:47 -!- forerunner [~forerunne@63.141.241.2] has joined #openvpn
08:03 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:44 -!- forerunner [~forerunne@63.141.241.2] has left #openvpn []
08:57 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
09:02 -!- tushar [~tushar@182.237.13.91] has joined #openvpn
09:04 -!- master_of_master [~master_of@p57B547A6.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
09:06 -!- master_of_master [~master_of@p57B54B63.dip.t-dialin.net] has joined #openvpn
09:07 -!- tushar [~tushar@182.237.13.91] has quit [Remote host closed the connection]
09:45 -!- trumee_ [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
09:46 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
09:48 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
10:09 -!- luneff [~yury@188.114.44.188] has quit [Quit: This computer has gone to sleep]
10:18 -!- dazo is now known as dazo_afk
10:41 -!- luneff [~yury@84.51.192.74] has joined #openvpn
11:05 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Ping timeout: 240 seconds]
11:13 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has joined #openvpn
11:28 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
12:20 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
12:31 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 245 seconds]
12:34 -!- corretico [~luis@200.12.40.18] has quit [Quit: Leaving]
12:37 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:43 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
12:44 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
12:57 -!- corretico [~luis@200.12.40.18] has joined #openvpn
12:57 -!- corretico [~luis@200.12.40.18] has quit [Read error: Connection reset by peer]
12:57 -!- corretico_ [~luis@200.12.40.18] has joined #openvpn
12:58 -!- corretico_ [~luis@200.12.40.18] has quit [Remote host closed the connection]
12:58 -!- corretico [~luis@200.12.40.18] has joined #openvpn
13:02 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
13:12 <@vpnHelper> RSS Update - forum: VPN Setup to network 3 sites to a central webserver <http://forums.openvpn.net/topic8868.html>
13:24 -!- albech [~albech@183.88.67.63] has quit [Remote host closed the connection]
13:30 -!- novaflash2 [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
13:30 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Disconnected by services]
13:30 -!- novaflash2 is now known as novaflash
13:30 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
13:30 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
14:18 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
14:22 < Bushmills> new ipcop 2.0 comes with openvpn now, in addition to ipsec
14:23 < novaflash> hurrah!
14:23 < novaflash> i hope that was the response you were looking for.
14:24 < novaflash> by the way, i got debian running on 128mb flashdrive and my openvpn servers are running fine now.
14:25 < Bushmills> i didn't expect any response. i threw that into the channel to let supporters know they don't have to send users on to #ipsec
14:28 < novaflash> fair enough
14:44 -!- pfrench [~pfrench@rrcs-24-199-157-59.midsouth.biz.rr.com] has quit [Quit: Leaving]
14:46 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Quit: Bye]
14:46 -!- cheako [~cheako@72.21.248.10] has left #openvpn ["Client exiting"]
14:52 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
15:00 <@vpnHelper> RSS Update - forum: OpenVPN 2.1 requires '--script-security 2' <http://forums.openvpn.net/topic8835.html#p15893>
15:01 < merlin1991> not exactly an openvpn question, but where would I place some configuration on debian to add / remove nat routing when the tun adapter comes up or goes down?
15:12 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:12 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:13 < Bushmills> merlin1991: a script of your making would be a good place to put that in
15:14 < merlin1991> I got as far as the script part, but I was wondering if there was some folder within /etc on debian that gets called upon actiavation of adapters
15:16 < Bushmills> you'd call the scripts from your openvpn config, by --up/--down or --client-connect event hooks, depending on whether the client or server should do the executing
15:17 < Bushmills> where you place the scripts is up to you
15:17 < krzee> !scripts
15:17 < krzee> !script
15:17 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
15:20 < Bushmills> though placing scripts in folders sounds like an odd idea. i'd say keeping them in electronic form, and writing them to a directory of a mass storage device is much preferable over printing them out and tucking them away in folders 
15:23 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Quit: Bye]
15:23 < merlin1991> love the last comment :=)
15:24 < merlin1991> I was darkly remembering something about /etc/up.d/ hence my question for a "folder"
15:25 < novaflash> merlin1991: debian/ubuntu have an /etc/network/ folder with if-up.d and if-down.d for network adapters, yes.
15:26 < novaflash> Bushmills; i'm sure he only meant it as a means of backing up his data on a more permanent medium. restoring is a pita tho.
15:26 < Bushmills> i'd put scripts there executed for interfaces defined in /etc/network/interfaces, and probably not for those upped and downed through other means, as it is the case with the openvpn tun interfaces
15:27 < novaflash> i agree
15:27 < merlin1991> that was one concern of myself too, but I didn't know about the --up/ --down options by then
15:27 < Bushmills> the openvpn man page knows all about them
15:28 < merlin1991> and in term is huge
15:28 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
15:28 < Bushmills> search doesn't care
15:29 < novaflash> perhaps a more simple man page would be useful. "this program makes stuff better. to connect, press buttons on keyboard in the correct order. good luck."
15:30 < merlin1991> there's one problem with search though, one has to have proper search terms
15:31 < novaflash> yeah it's tough to get into the terminology of a new program
15:31 < Bushmills> shouldn't be a problem, as you already know what to search for
15:31 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
15:31 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
15:55 < merlin1991> completely off topic, but does man have a keep searching button?
15:55 < merlin1991> and plz don't tell me to man man
15:56 < krzee> just search again
15:56 < krzee> when you hit / and put a string... then just put / and hit enter
15:56 < krzee> it'll search for the next entry
15:56 < krzee> so to scroll through entries, / enter / enter / enter
15:57 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Quit: Bye]
15:57 < merlin1991> thanks
15:57 < krzee> but also
15:57 < krzee> !man
15:57 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
15:57 < krzee> your web browser can do it too ;]
15:57 < merlin1991> man online might not be the same as man debian stable ;)
15:58 < krzee> only if debian was dumb enough to modify the openvpn manpage
15:58 < krzee> which im going to strongly doubt
15:58 -!- poster [~poster@cpe-107-10-147-179.columbus.res.rr.com] has quit [Ping timeout: 252 seconds]
15:59 < merlin1991> well my assumption here is, that openvpn.net/man is current stable of openvpn while the man in debian stable is somehting older considered stable by debian,  I've had a few cases where those two didn't match and actually had different man pages in the end
15:59 < merlin1991> different as in not backwards compatible
16:00 < krzee> what version are you using?
16:00 < merlin1991> 2.1.3
16:01 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
16:01 < krzee> http://openvpn.net/man-beta.html
16:03 < merlin1991> hm script failed: external program fork failed
16:06 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
16:07 < merlin1991> I'm out of ideas, my script has +x, it starts with #!/bin/sh and the configline actually is: up "sh somepaththatexists"
16:08 < merlin1991> sorry, script security was wrong
16:08 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
16:08 -!- mode/#openvpn [+o raidz] by ChanServ
16:08 < krzee> that'll do it
16:09 < Bushmills> that's not man but the pager you're using which provides such functions
16:10 < Bushmills> less and most have n  for next match
16:11 < Bushmills> thus you're not told to man man, but to man less or man pager
16:11 < krzee> hah n does it too, nice
16:11 < krzee> thanx =]
16:12 < krzee> 1 less button press, i like that
16:12 < Bushmills> N for reverse search
16:14 <@vpnHelper> RSS Update - forum: Help PLease....connected but can't browse <http://forums.openvpn.net/topic8788.html#p15894>
16:17 < merlin1991> man says that 6th parameter for --up is init or restart, but --down is supposed to be called with the same parameters as up, is it a safe assumption that the 6th parameter is going to be "down"?
16:22 < hyper_ch> krzee: Bushmills: https://www.schneier.com/blog/archives/2011/09/man-in-the-midd_4.html
16:22 <@vpnHelper> Title: Schneier on Security: Man-in-the-Middle Attack Against SSL 3.0/TLS 1.0 (at www.schneier.com)
16:23 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
16:25 < krzee> merlin1991, why dont you check by dumping env
16:33 -!- pierreghz [~pierreghz@cust-188-37-111-94.dyn.as47377.net] has joined #openvpn
16:35 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
16:38 < merlin1991> thanks for the help, I've got my setup now how I want it
16:38 < krzee> np
16:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:41 < merlin1991> actually I still don't know if udp broadcasts over the brideged tap setup work, how would I check if udp broadcasts arrive (I've got a windows client with a few games that create those and a linux phone to "listen")
16:42 < merlin1991> my knowledge ends at tcpdump wich obviously won't work for udp
16:43 -!- luneff [~yury@84.51.192.74] has joined #openvpn
16:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
16:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:06 -!- Mtn_Bkng_Dave [Mtn_Bkng_D@c-24-99-31-48.hsd1.ga.comcast.net] has joined #openvpn
17:06 < Mtn_Bkng_Dave> !welcome
17:06 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:06 < Mtn_Bkng_Dave> !route
17:06 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
17:07 < Mtn_Bkng_Dave> !motd
17:08 -!- Mtn_Bkng_Dave [Mtn_Bkng_D@c-24-99-31-48.hsd1.ga.comcast.net] has quit [Client Quit]
17:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
17:11 < merlin1991> !redirect
17:11 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:11 < merlin1991> !nat
17:11 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:15 -!- Olipro [~Olipro@2001:470:9738:1::1:1] has joined #openvpn
17:15 -!- Olipro [~Olipro@2001:470:9738:1::1:1] has quit [Changing host]
17:15 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:18 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
17:49 -!- cmv [~niteice@uhartford238155.hartford.edu] has joined #openvpn
17:51 -!- cmv [~niteice@uhartford238155.hartford.edu] has left #openvpn []
18:07 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:10 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has quit [Remote host closed the connection]
18:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:31 -!- cheako [~cheako@72.21.248.10] has joined #openvpn
18:32 < cheako> Hello, I've a tunnel where both ends are configured as 192.168.167.1 with the remote end being .2
18:33 < cheako> The config file on both contains "ifconfig 192.168.167.2 192.168.167.1"
18:33 < cheako> I originally had the addresses swapped, but the log file indicated this as an error at the time.
18:34 < cheako> Please point me to the manual, I've read it once at least and I still don't understand.
18:36 < cheako> if it was a command line option, it'd be reveres.  I
18:36 < cheako> 'm going to try.
18:38 < krzee> you cant give both endpoints the same ip
18:38 < krzee> !howto
18:38 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:43 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
18:47 < cheako> I swapped them and I think it's working better.
18:50 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:10 -!- Fritz09 [~Fritz09@pop1-73.catv.wtnet.de] has joined #openvpn
19:19 -!- Ionic_ [ionic@home.ionic.de] has quit [Quit: leaving]
19:20 -!- Fritz09 [~Fritz09@pop1-73.catv.wtnet.de] has quit [Quit: Bye]
19:34 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
19:40 -!- Ionic [ionic@ionic.de] has joined #openvpn
19:53 -!- _julian_ [~quassel@hmbg-5f7618fc.pool.mediaWays.net] has joined #openvpn
19:57 -!- _julian [~quassel@hmbg-5f760b55.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
20:02 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
20:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:07 -!- corretico [~luis@200.12.40.18] has quit [Ping timeout: 248 seconds]
20:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
20:16 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:17 < cheako> Is there an option to use more then one tcp session for a single tunnel?
20:19 < cheako> I may start writing a client/server for this in perl, taking a udp stream and round-robin(or least full) over a group of tcp sockets.
20:20 < cheako> ...I just shutter to handle tcp stream time-outs/disconnects.
20:25 < cheako> perhaps I can find a perl module that does it.
20:25 < krzee> no, does not exist if i understand the question right
20:26 < krzee> there is a multihome config option if thats what you mean
20:31 < cheako> Can multi-home work for a single tunnel?  How is the load-balancing done in that case?  I'd be surprised if this fit my needs, but thx.
20:31 < krzee> no idea
20:32 < cheako> I'm looking closer at writing my own transport proxy.
20:32 < krzee> cool
20:48 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
20:49 < jeev> krzee, i feel like you've used dansguardian before
20:54 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
20:54 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
20:55 -!- oc80z [oc80z@blea.ch] has joined #openvpn
20:56 -!- Squidy [~quassel@187.7.244.104] has joined #openvpn
20:56 -!- Squidy [~quassel@187.7.244.104] has quit [Changing host]
20:56 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
20:56 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Read error: Connection reset by peer]
20:57 < cheako> Are there any escape(s) that would be usable to mux with an openvpn stream?
20:58 < cheako> For example, if openvpn would never-ever send three \0 in a row.
20:58 < cheako> Basically something that it's not capable of sending.
20:59 -!- Squidy [~quassel@187.7.244.104] has joined #openvpn
20:59 -!- Squidy [~quassel@187.7.244.104] has quit [Changing host]
20:59 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
20:59 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
21:01 < cheako> ohh, that would depend on the options used... might it?
21:02 -!- Squidy [~quassel@187.7.244.104] has joined #openvpn
21:02 -!- Squidy [~quassel@187.7.244.104] has quit [Changing host]
21:02 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
21:19 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
21:37 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
21:40 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
21:41 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:48 < krzee> jeev, i dont even know what that is
21:49 < krzee> cheako, no idea,  you may want to wait until you see dazo's name change from dazo_afk to dazo and see if you can catch him for that one
21:50 < krzee> look into the dev work regarding --port-share
21:50 < krzee> they had to solve a similar problem when figuring that out =]
22:16 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Remote host closed the connection]
22:16 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
22:25 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
22:48 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:15 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Read error: Connection reset by peer]
23:21 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 256 seconds]
23:32 -!- albech [~albech@183.88.67.63] has joined #openvpn
--- Day changed Sun Sep 25 2011
00:02 -!- pierreghz_ [~pierreghz@cust-37-114-111-94.dyn.as47377.net] has joined #openvpn
00:05 -!- pierreghz [~pierreghz@cust-188-37-111-94.dyn.as47377.net] has quit [Ping timeout: 276 seconds]
00:06 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html#p15895>
00:31 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
01:06 -!- luneff [~yury@84.51.192.74] has joined #openvpn
01:25 <@vpnHelper> RSS Update - forum: VPN Setup to network 3 sites to a central webserver <http://forums.openvpn.net/topic8868.html#p15896>
01:35 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:09 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Read error: Operation timed out]
02:10 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
02:11 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has joined #openvpn
02:42 -!- Fritz09 [~Fritz09@pop1-73.catv.wtnet.de] has joined #openvpn
02:53 -!- Fritz09 [~Fritz09@pop1-73.catv.wtnet.de] has quit [Quit: Bye]
03:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
03:08 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
03:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:46 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
03:53 -!- Fritz09_ [~Fritz09@pop1-73.catv.wtnet.de] has joined #openvpn
03:58 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has joined #openvpn
04:21 < omry> I am seeing tcp connections going through the VPN persists (in netstat) hours after the servers on the other sides are gone.
04:21 < omry> I am not 100% sure its the vpn fault yet, but its possible.
04:21 < omry> is this a known issue?
04:22 < omry> (using routed vpn)
04:23 < reiffert> "the servers on the other sides" = openvpn server, or application servers?
04:24 < omry> servers = machines
04:24 < omry> I am seeing the "stale" connections on my software server. 
04:24 < omry> well
04:24 < omry> on a box.
04:24 < omry> the box is inside the vpn.
04:25 < omry> the other boxes, which are gone - are vpn clients
04:25 < omry> I still see connections from them alive in the box inside behind the openvpn server
04:25 < omry> s/inside behind/behind :)
04:26 < reiffert> "stale"?
04:26 < omry> by "stale", I mean established to a machine which is long gone
04:28 < omry> in fact, right now - I have connections established to each of the 12 boxes outside of the vpn, all of them are no longer up.
04:28 < reiffert> protocol, service, application?
04:29 < omry> tcp, gearman client/server
04:29 < omry> okay, I stand corrected - at the moment those machines have return, so I don't have a reproduce case right now.
04:29 < omry> (those machines are ec2 spot instances).
04:29 < reiffert> running NAT on the openvpn server?
04:29 < omry> I did see it before though.
04:30 < omry> no, my openvpn server is not the nat
04:30 < omry> there is another server which acts as the NAT
04:30 < reiffert> Are those clients ending the tcp connection properly when "leaving" the vpn?
04:31 < omry> not sure
04:31 < omry> I thought I have a case when they did shut down properly and it happened. but I am not sure now.
04:34 < omry> okay - I do have a strange case at hand.
04:34 < reiffert> I think that your connection is in state "half closed" or similar.
04:34 -!- tiny [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has joined #openvpn
04:34 < omry> on the box inside the vpn they are established
04:35 < tiny> sndbuf default is 65536. what is the proper way to know what should be the increase value.
04:35 < omry> on the other side they do not exist (all those 12 boxes are rebooted).
04:37 < omry> now, I have some boxes in the same role inside the vpn lan as well, and so far I did not see such behavior from them
04:37 < omry> this is why I think its related to the vpn somehow.
04:38 < reiffert> those working boxes surely end the tcp connection before shutting down.
04:38 < reiffert> and on those non-working boxes, they might bring the vpn down before ending the appication.
04:38 < omry> hmmm
04:39 < tiny> can anyone answer me here
04:39 < omry> thats an interesting idea. but I dont think its the case. I seen this behavior while the machines were still running. (but the application crashes).
04:39 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:39 < omry> I will keep an eye open for this, its reproduced reliably on my environment.
04:39 < reiffert> omry: application crashes, nobody ends the tcp connection. timeouts apply, kernel ends.
04:40 < omry> reiffert, that what I hopes
04:40 < reiffert> I think the timeout is 3 days.
04:40 < omry> but the connection lives
04:40 < omry> seriously?
04:40 < reiffert> seriously.
04:41 < reiffert> (or 86400s which is one day)
04:42 < omry> well, I`m pretty sure its more than a day
04:43 < omry> (those connections "established")
04:43 < omry> in any case, I suspect its related to the vpn.
04:43 < omry> I`ll try to gather more info
04:44 < reiffert> also try the openvpn mailinglist
04:44 < omry> as soon as I am convinced its related to the openvpn, I will.
04:44 < reiffert> http://linux.die.net/man/7/tcp
04:44 <@vpnHelper> Title: tcp(7): TCP protocol - Linux man page (at linux.die.net)
04:44 < omry> thanks.
04:45 < reiffert> I'm afk, busy
04:47 -!- tiny [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has left #openvpn []
05:17 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
05:20 -!- tiny [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has joined #openvpn
05:20 < tiny> how big is the buffer size the openvpn send?
05:21 -!- novaflash [~notme@openvpn/user/novaflash] has quit []
05:23 -!- tiny [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has quit [Quit: Page closed]
05:26 -!- novaflash [novaflash@openvpn/user/novaflash] has joined #openvpn
05:26 -!- mode/#openvpn [+v novaflash] by ChanServ
05:30 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
05:33 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
05:38 -!- mirco [~mirco@p5B285F13.dip.t-dialin.net] has joined #openvpn
05:56 <@vpnHelper> RSS Update - forum: for sale brand new apple iphone 4g 32gb<Apple Tablet iPad <http://forums.openvpn.net/topic8869.html>
06:00 -!- luneff [~yury@31.23.36.38] has joined #openvpn
06:04 -!- bitterman [~yury@31.23.36.38] has joined #openvpn
06:04 -!- luneff [~yury@31.23.36.38] has quit [Read error: Operation timed out]
06:20 <@vpnHelper> RSS Update - forum: Connections to multiple OpenVPN Servers? <http://forums.openvpn.net/topic8807.html#p15678>
06:40 -!- mirco [~mirco@p5B285F13.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
06:40 -!- mirco [~mirco@p5B285F13.dip.t-dialin.net] has joined #openvpn
07:01 -!- forerunner [~forerunne@31.31.36.225] has joined #openvpn
07:08 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html>
07:29 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 252 seconds]
07:30 -!- forerunner [~forerunne@31.31.36.225] has quit [Ping timeout: 256 seconds]
07:56 <@vpnHelper> RSS Update - forum: Monitoring VPN users <http://forums.openvpn.net/topic8871.html>
08:05 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
08:05 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
08:05 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
08:23 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 256 seconds]
08:46 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p15904> || For Sale : Brand New Nikon D700 / Canon Eos 40D <http://forums.openvpn.net/topic8873.html> || Server Startup Problems <http://forums.openvpn.net/topic8831.html#p15901>
09:01 < hyper_ch> damn, three days partyting at the october fest is too much
09:05 -!- master_of_master [~master_of@p57B54B63.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:06 -!- master_of_master [~master_of@p57B55DB1.dip.t-dialin.net] has joined #openvpn
09:22 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p15906> || Server Startup Problems <http://forums.openvpn.net/topic8831.html#p15905>
09:24 -!- Fritz09_ [~Fritz09@pop1-73.catv.wtnet.de] has left #openvpn []
09:27 -!- bitterman [~yury@31.23.36.38] has quit [Quit: Leaving]
09:53 <@vpnHelper> RSS Update - forum: Connecting via SSH while VPN is connected <http://forums.openvpn.net/topic8874.html>
10:00 -!- mirco [~mirco@p5B285F13.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
10:01 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
10:03 -!- mirco [~mirco@p5B285AA8.dip.t-dialin.net] has joined #openvpn
10:27 -!- Squidy [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
10:27 -!- Squidy [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has quit [Changing host]
10:27 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
10:50 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:59 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p15908>
11:00 < ecrist> krzie or krzee: I'm moving butters now, should be up/down in a few minutes
11:11 -!- stevefink_ [steve@shell.vaerchi.com] has quit [Quit: .]
11:11 <@vpnHelper> RSS Update - forum: Connecting via SSH while VPN is connected <http://forums.openvpn.net/topic8874.html#p15909>
11:12 -!- mirco [~mirco@p5B285AA8.dip.t-dialin.net] has quit [Quit: mirco]
11:17 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p15911> || lan DHCP requests <http://forums.openvpn.net/topic8852.html#p15910>
11:25 -!- pranq [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
11:29 -!- pranq [~pranq@unaffiliated/contempt] has joined #openvpn
11:35 <@vpnHelper> RSS Update - forum: Connecting via SSH while VPN is connected <http://forums.openvpn.net/topic8874.html#p15912>
11:44 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has joined #openvpn
11:47 <@vpnHelper> RSS Update - forum: Connecting via SSH while VPN is connected <http://forums.openvpn.net/topic8874.html#p15913>
11:59 <@vpnHelper> RSS Update - forum: Connecting via SSH while VPN is connected <http://forums.openvpn.net/topic8874.html#p15914>
12:09 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:23 < krzie> ecrist, whenever you're ready
12:30 -!- albech [~albech@183.88.67.63] has quit [Remote host closed the connection]
12:32 -!- forerunner [~forerunne@178.162.239.108] has joined #openvpn
12:40 -!- me345 [~me345@adsl-75-15-232-163.dsl.bkfd14.sbcglobal.net] has joined #openvpn
12:48 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:09 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
13:30 -!- thething [~forerunne@31.31.36.225] has joined #openvpn
13:30 -!- thething [~forerunne@31.31.36.225] has left #openvpn []
13:33 -!- forerunner [~forerunne@178.162.239.108] has quit [Ping timeout: 260 seconds]
13:35 <@vpnHelper> RSS Update - forum: Connecting via SSH while VPN is connected <http://forums.openvpn.net/topic8874.html#p15915>
13:41 -!- rkantos [~robin2@109.169.55.199] has joined #openvpn
13:50 -!- thething [~forerunne@178.162.239.108] has joined #openvpn
13:53 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 265 seconds]
14:00 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
14:04 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
14:06 <@vpnHelper> RSS Update - forum: OpenVPN tunnel problem on OBSD 4.9 <http://forums.openvpn.net/topic8875.html>
14:06 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:06 -!- Squidy [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
14:06 -!- Squidy [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has quit [Changing host]
14:06 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
14:06 -!- me345 [~me345@adsl-75-15-232-163.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
14:10 -!- lu_ [lu_@static.211.19.9.176.clients.your-server.de] has joined #openvpn
14:10 < lu_> !configs
14:10 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
14:20 < lu_> is is possible to use the tap adapter without bridging? (because i need linear ip addresses and it's a windows only system)
14:30 < EugeneKay> Sure.
14:31 < lu_> allright... i'm doing something wrong then... documentation is quite thin on that
14:31 < EugeneKay> dev tun is the default for routed setups(vanilla --server), but dev tun-ipv6 and dev tap work just fine
14:31 < EugeneKay> You need to have dev tap on both ends, mind
14:32 -!- chantra [~chantra@unaffiliated/chantra] has quit [Read error: Operation timed out]
14:32 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
14:32 < lu_> yeah. it connects ok but i can't ping
14:33 < lu_> when i ping the server it gives me timeout (firewall lets ping through) and when i ping other clients it's destination host unreachable. i'll prepare the configs for nopasting...
14:46 < lu_> http://nopaste.info/49944d7f2e.html
14:46 < lu_> there you go
14:47 -!- pierreghz_ [~pierreghz@cust-37-114-111-94.dyn.as47377.net] has quit [Quit: Quitte]
14:54 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p15917>
15:01 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
15:07 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:07 -!- mode/#openvpn [+v s7r] by ChanServ
15:09 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
15:10 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 245 seconds]
15:11 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
15:28 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
15:31 -!- Squidy_at_Home [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
15:32 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 256 seconds]
15:40 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
15:40 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
15:40 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
15:45 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has quit [Quit: Leaving.]
15:47 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:50 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
15:57 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
16:00 <@vpnHelper> RSS Update - forum: Web traffic not going over vpn <http://forums.openvpn.net/topic8843.html#p15693>
16:03 -!- thething [~forerunne@178.162.239.108] has quit [Ping timeout: 260 seconds]
16:04 -!- Squidy_at_Home [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has quit [Remote host closed the connection]
16:11 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 252 seconds]
16:12 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
16:26 -!- freaky[t] [alpha@freakyonline.de] has quit [Remote host closed the connection]
16:32 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
16:33 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
16:33 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
16:35 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 248 seconds]
16:35 <@vpnHelper> RSS Update - forum: Connecting via SSH while VPN is connected <http://forums.openvpn.net/topic8874.html#p15918>
16:41 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Remote host closed the connection]
16:41 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
16:55 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
16:55 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
16:55 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
16:57 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
17:00 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
17:01 -!- Squidy [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
17:01 -!- Squidy [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has quit [Changing host]
17:01 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
17:02 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Ping timeout: 276 seconds]
17:02 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
17:02 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 248 seconds]
17:02 <@vpnHelper> RSS Update - forum: OpenVPN 2.1 requires '--script-security 2' <http://forums.openvpn.net/topic8835.html#p15920> || Help with my network with openvpn <http://forums.openvpn.net/topic8855.html#p15919>
17:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
17:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:14 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Read error: Operation timed out]
17:14 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
17:42 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
17:59 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
18:06 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
18:06 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
18:06 -!- caemir_ is now known as caemir
18:18 -!- n2deep [~n2deep@75-147-180-58-Washington.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
18:20 -!- n2deep [~n2deep@dsl231-034-143.sea1.dsl.speakeasy.net] has joined #openvpn
18:26 -!- n2deep [~n2deep@dsl231-034-143.sea1.dsl.speakeasy.net] has quit [Ping timeout: 245 seconds]
18:28 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has joined #openvpn
18:31 -!- ambro718 [~ambro@BSN-77-101-149.dsl.siol.net] has quit [Client Quit]
18:31 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
18:33 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
18:42 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
18:42 -!- mode/#openvpn [+o vpnHelper] by ChanServ
18:43 < ecrist> :)
18:43 < ecrist> krzie: butters has been moved
18:43 < ecrist> or krzee ^^^^
18:43 < jeev> did you kill kenny too ?
18:48 <@vpnHelper> RSS Update - forum: API documentation <http://forums.openvpn.net/topic8876.html>
18:48 < ecrist> kenny is on a VM now, as well. :)
18:50 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Read error: Connection reset by peer]
18:51 -!- Squidy [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
18:51 -!- Squidy [~quassel@200-101-39-153.cbace702.dsl.brasiltelecom.net.br] has quit [Changing host]
18:51 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
18:54 <@vpnHelper> RSS Update - forum: Help server settings <http://forums.openvpn.net/topic8791.html#p15922>
19:00 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:13 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:21 -!- tiny [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:22 < tiny> why is it that on the openvpn logs, the socker buffer is set on 8192 but on the manual its 65536 default.
19:26 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
19:26 -!- zu [~zu@ks355000.kimsufi.com] has quit [Ping timeout: 258 seconds]
19:27 -!- W4lth3r [~W4lth3r@chaosarmy.org] has quit [Ping timeout: 258 seconds]
19:27 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 245 seconds]
19:27 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
19:28 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
19:28 -!- Ionic [ionic@ionic.de] has joined #openvpn
19:30 <@vpnHelper> RSS Update - forum: VPN Setup to network 3 sites to a central webserver <http://forums.openvpn.net/topic8868.html#p15923>
19:31 -!- W4lth3r [~W4lth3r@chaosarmy.org] has joined #openvpn
19:32 < tiny> I have my question posted.
19:40 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:40 -!- tiny [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:41 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
19:44 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
19:52 -!- _julian [~quassel@hmbg-5f76570a.pool.mediaWays.net] has joined #openvpn
19:52 -!- _julian_ [~quassel@hmbg-5f7618fc.pool.mediaWays.net] has quit [Read error: Operation timed out]
20:05 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 244 seconds]
20:17 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
20:25 -!- tiny [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:27 < tiny>  my question is still about sndbuf and rcvbuf
20:28 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 256 seconds]
20:28 < krzee> i dont know, maybe post it to the forum
20:30 < tiny> I was wondering why on the openvpn log it stated 8192 but the default is 65536
20:35 < krzee> yes, i saw that
20:35 < krzee> lol
20:35 < krzee> i couldnt have replied "i dont know" had i not seen it
20:40 < ecrist> krzee: check out butters, let me know if you see problems.
20:42 < krzee> well i see vpnHelper here
20:42 < ecrist> Yeah, I fired it back up
20:43 < krzee> iirc i dont have any other services running there
20:43 < ecrist> I have to move mr.garrison and cartman still, but kenny and butters migrated without difficulty
20:45 < ecrist> heh, took my AR15 out and did some bump-firing today
20:45 < ecrist> this morning, there were duck hunters everywhere.  we heard shotguns most of the morning/afternoon
20:46 < ecrist> then I blew 90 rounds out the end of my AR15 in about a minute, at a rate around 800/min I guess
20:46 < ecrist> we didn't hear a single shotgun after that.
20:46 < krzee> LOL nice
20:47 < ecrist> my buddy's grandpa had never seen a full-auto fire before, despite serving in WWII
20:47 < tiny> but can I instead set the sndbuf and rcvbuf to 65536 so that the log will look like 8195->65536?   any disadvantage or advantage of setting the value to 65536?
20:47 < ecrist> (he was a cook)
20:48 < ecrist> just about fell over laughing
20:48 < tiny> help me here for one sec 
20:48 < krzee> ive never looked at sndbuf / rcvbuf
20:49 < krzee> which is why i told you you may want to post on the forum
20:49 < tiny> oh ok.
20:49 < ecrist> tiny: what does the man page say?
20:49 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:50 < tiny> ecrist: it just say socket buffer size which the default is 65536.  there are no other information about what is the usage or advantage or disadvantage about it on setting it up with openvpn.
20:50 < ecrist> then why are you messing with it?
20:50 < ecrist> my guess is there's a mismatch between the man page and the actual source
20:50  * ecrist takes a peek
20:51 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
20:51 < ecrist> oh, shit, cartman is offline at the moment
20:51 < ecrist> I'll have to look tomorrow
20:51 < ecrist> look in the source and see what it does, tiny
20:51 < tiny> not actually messing with it but since it is in the manpage, I have it read also and had and interest on it why it was posted there. If it is posted there, it might have some purpose though.
20:52 < ecrist> perhaps
20:52 < ecrist> I'm guessing it had a purpose 8 years ago, and was a very specific purpose
20:52 < ecrist> lots of code gets overlooked as time goes by
20:52 < ecrist> openvpn3  will be a rewrite, so it may be entirely omitted.
20:52 < tiny> do you know what specific purpose was that?
20:53 < tiny> omitted? I see.
20:53 < ecrist> I'd suggest leaving it alone unless you're trying to use it to solve a specific problem.
20:53 < tiny> So I guess its no use to pursue with it.
20:53 < tiny> well, I am looking into improving the connection. So I was digging with sndbuf and rcvbuf
20:53 < tiny> maybe there is something I can do with that directive
20:54 < ecrist> what's to improve?
20:54 < tiny> tunneling connection 
20:54 < ecrist> are you one low bandwidth network, high latency network, trying to optimize large packets (jumbo frames?)?
20:55 < ecrist> I use openvpn heavily and have had no need to do any optimization to this day
20:55 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:55 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:55 < tiny> im on high bandwidth, not that high and not that low latency, but trying to optimize network connection. im on mobile broadband network.
20:56  * ecrist poofs
20:59 -!- tiny [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit []
21:02 -!- blocky [~blocky@out-bc-209.wireless.telus.com] has joined #openvpn
21:02 < blocky> !welcome
21:02 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:03 < blocky> !goal
21:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:03 < blocky> !redirect
21:03 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
21:03 < blocky> !howto
21:03 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:03 -!- blocky [~blocky@out-bc-209.wireless.telus.com] has quit []
21:10 <@vpnHelper> RSS Update - forum: VPN Setup to network 3 sites to a central webserver <http://forums.openvpn.net/topic8868.html#p15924>
21:19 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:24 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:25 -!- blocky [~blocky@out-bc-209.wireless.telus.com] has joined #openvpn
21:34 -!- haeph [45506c01@gateway/web/freenode/ip.69.80.108.1] has joined #openvpn
21:40 -!- haeph [45506c01@gateway/web/freenode/ip.69.80.108.1] has left #openvpn []
21:42 -!- blocky [~blocky@out-bc-209.wireless.telus.com] has quit []
21:51 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
21:58 -!- thething [~forerunne@178.162.239.108] has joined #openvpn
22:05 -!- blocky [~blocky@out-bc-146.wireless.telus.com] has joined #openvpn
22:22 -!- thething [~forerunne@178.162.239.108] has left #openvpn []
22:23 -!- blocky [~blocky@out-bc-146.wireless.telus.com] has quit [Remote host closed the connection]
22:27 -!- blocky [~blocky@out-bc-146.wireless.telus.com] has joined #openvpn
22:28 -!- blocky [~blocky@out-bc-146.wireless.telus.com] has quit [Client Quit]
22:40 <@vpnHelper> RSS Update - forum: VPN Setup to network 3 sites to a central webserver <http://forums.openvpn.net/topic8868.html#p15925>
22:42 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
23:47 -!- tiny [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:48 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:48 < tiny> is tcp-queue-limit only for tcp protocol?
23:53 -!- tiny [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
--- Day changed Mon Sep 26 2011
00:16 <@vpnHelper> RSS Update - forum: Connecting via SSH while VPN is connected <http://forums.openvpn.net/topic8874.html#p15927> || no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p15926>
00:22 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:28 <@vpnHelper> RSS Update - forum: OpenVPN tunnel problem on OBSD 4.9 <http://forums.openvpn.net/topic8875.html#p15928>
00:39 -!- luneff [~yury@84.51.192.74] has joined #openvpn
00:48 -!- blocky [blocky@96.54.168.243] has joined #openvpn
00:55 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:01 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
01:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 245 seconds]
01:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:16 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15929>
01:20 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:20 -!- mode/#openvpn [+o mattock] by ChanServ
01:29 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15930>
01:38 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
01:39 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
01:40 -!- mode/#openvpn [+o raidz] by ChanServ
01:52 -!- blocky [blocky@96.54.168.243] has quit [Ping timeout: 255 seconds]
01:59 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15931>
02:09 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 276 seconds]
02:20 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:22 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
02:48 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
02:49 < Mowee> Morning
02:52 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
02:59 -!- albech [~albech@183.88.67.63] has joined #openvpn
03:04 < Bushmills> hidemyass, a vpn provider, which also provides access through openvpn, has revealed the address of a customer for criminal prosecution: http://blog.hidemyass.com/
03:04 <@vpnHelper> Title: Hide My Ass! Blog (at blog.hidemyass.com)
03:12 -!- mape2k [~mape2k@h250.fem.tu-ilmenau.de] has joined #openvpn
03:16 -!- luneff [~yury@188.114.43.219] has joined #openvpn
03:20 -!- bitterman [~yury@188.114.43.219] has joined #openvpn
03:23 -!- luneff [~yury@188.114.43.219] has quit [Ping timeout: 245 seconds]
03:28 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:28 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15932>
03:40 -!- tiny [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
03:41 -!- tiny [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
03:44 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
03:45 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
03:45 -!- mode/#openvpn [+o raidz] by ChanServ
03:53 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has quit [Quit: —I-n-v-i-s-i-o-n— 3.2 (July '10)]
03:56 -!- bandroidx [~bandroidx@pool-173-54-216-132.nwrknj.fios.verizon.net] has joined #openvpn
03:57 < bandroidx> hi, i am running 4 openvpn servers on a single box as different user's in the server configs, can they share status and ifconfig-pool-persist files or will this conflict and they require their own?
04:06 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:06 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
04:18 -!- tiny [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has joined #openvpn
04:22 -!- mape2k [~mape2k@h250.fem.tu-ilmenau.de] has quit [Ping timeout: 248 seconds]
04:29 -!- tiny [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has quit [Quit: Page closed]
04:51 -!- miguet [~miguet@121.1.54.50] has quit [Ping timeout: 260 seconds]
04:52 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
04:52 -!- gen [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has joined #openvpn
04:53 -!- gen [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has quit [Quit: Page closed]
05:03 -!- Diffen [~diffen@host-90-238-142-129.mobileonline.telia.com] has joined #openvpn
05:03 -!- naquad [~naquad@174.142.224.219] has quit [Ping timeout: 248 seconds]
05:09 -!- buntfalke [~nobody@openvpn-p0-ipv6-107f.triple-a.uni-kl.de] has joined #openvpn
05:09 -!- buntfalke [~nobody@openvpn-p0-ipv6-107f.triple-a.uni-kl.de] has quit [Changing host]
05:09 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
05:10 -!- mape2k [~mape2k@2a01:198:23f:10ff:b075:ff:fe97:f6ff] has joined #openvpn
05:11 -!- Diffen [~diffen@host-90-238-142-129.mobileonline.telia.com] has quit [Ping timeout: 248 seconds]
05:16 -!- tiny [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has joined #openvpn
05:17 < tiny> what would be the best cryptographic cipher to use?
05:18 < Bushmills> http://en.wikipedia.org/wiki/Quantum_cryptography
05:18 <@vpnHelper> Title: Quantum cryptography - Wikipedia, the free encyclopedia (at en.wikipedia.org)
05:20 < Bushmills> http://en.wikipedia.org/wiki/One-time_pad
05:20 <@vpnHelper> Title: One-time pad - Wikipedia, the free encyclopedia (at en.wikipedia.org)
05:21 < tiny> ;cipher BF-CBC        # Blowfish (default) ;cipher AES-128-CBC   # AES ;cipher DES-EDE3-CBC  # Triple-DES  where the samples I have seen and also cipher AES-256-CBC is there other best
05:22 -!- tiny [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has quit []
05:33 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
05:39 -!- miguet [~miguet@121.1.54.50] has quit [Ping timeout: 260 seconds]
05:40 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
05:49 < bandroidx> can i some how automate the common name given to easy-rsa's build-key ?
05:50 < bandroidx> like add it to the build-key command line args or export it some how?
05:50 < bandroidx> its not an option in the vars file
05:51 < EugeneKay> bandroidx - If you want to automate key creation, you should be using something other than easy-rsa.
05:52 < bandroidx> EugeneKay: idk its what i have always used for years
05:52 < bandroidx> EugeneKay: but then again i never automated key creation before
05:53 < bandroidx> EugeneKay: oh i see now i can just do the openssl commands myself in my script i guess
05:53 < EugeneKay> Indeed.
05:53 < EugeneKay> But you should still ake care to handle the easy-rsa CA serial, etc
05:53 < bandroidx> i just looked to see what build-key does lol its like 20 lines
05:54 < bandroidx> yeah
05:54 < bandroidx> i am going to examine script in easy-rsa i am invoking in my script
05:54 < EugeneKay> What is this for? Shell script? Web?
05:54 < bandroidx> and move the code
05:54 < bandroidx> shell script
05:54 < bandroidx> to automate the setup of multi user openvpn box
05:55 < bandroidx> it all works perfectly now but it sucks they have to press enter and enter the common name
05:55 < bandroidx> kinda ruins the whole automated part
06:07 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
06:11 < bandroidx> EugeneKay: seems i must put the values in an answer file of sorts and point to it in my openssl req command with -config myanswerfile
06:19 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
06:21 -!- M4g3 [~M4g3@spellfire.eecs.qmul.ac.uk] has joined #openvpn
06:21 < M4g3> Hi all,
06:22 < M4g3> just a quickie
06:22 < EugeneKay> That's what SHE said
06:22 < M4g3> LOL Where can i find release candidate for Openvpn 2.3 for Windows?
06:22 < M4g3> Does such thin exists?
06:22 < M4g3> *thing
06:23 < EugeneKay> Not a clue. Wander about the site / google? 
06:24 < M4g3> So far only found beta22
06:25 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Read error: Operation timed out]
06:25 -!- zu [~zu@ks355000.kimsufi.com] has quit [Read error: Operation timed out]
06:26 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
06:26 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
06:26 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 255 seconds]
06:28 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
06:51 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has joined #openvpn
06:53 < ecrist> build.openvpn.net
06:53 < ecrist> there are not any release candidates for 2.3 at this time.
06:53 < ecrist> your best bet is the windows snapshot
06:54 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
06:57 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
06:57 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
06:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
07:09 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:14 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
07:16 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
07:20 -!- newbee [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has joined #openvpn
07:21 < newbee> I'm new here
07:22 < newbee> I would like to know more about openvpn
07:22 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
07:23 < newbee> If I am running an openvpn server and on another pc a client end, how can use echo to send message output to the client from server?
07:32 -!- skrewt [~Chad@oh-65-40-66-111.sta.embarqhsd.net] has joined #openvpn
07:34 -!- newbee [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has quit [Ping timeout: 252 seconds]
07:37 < skrewt> i am trying to get SSH incoming connections to route through the VPN but its not working outside of my local network
07:37 < skrewt> i found some posts on the forums, one specifically says to use this line:?
07:37 < skrewt> iptables -A PREROUTING -t nat -d <server_public_IP> -p tcp -m tcp ! --dport 22 -j DNAT --to-destination <server_VPN_IP>
07:37 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-30.html#p15934> || OpenVPN-server terminates unexpected <http://forums.openvpn.net/topic8475-15.html#p15933>
07:37 < skrewt> but my server public IP is not static
07:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
07:40 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 248 seconds]
07:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:46 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:50 -!- mape2k [~mape2k@2a01:198:23f:10ff:b075:ff:fe97:f6ff] has quit [Ping timeout: 244 seconds]
07:52 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 245 seconds]
07:53 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
07:53 -!- merlin1991 [~merlin@Maemo/community/cssu/merlin1991] has quit [Quit: No Ping reply in 180 seconds.]
07:58 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:12 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:17 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:20 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:20 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:20 -!- mode/#openvpn [+v Axeman] by ChanServ
08:23 -!- twinbee [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has joined #openvpn
08:23 < twinbee> what is the use of bcast buffers
08:24 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
08:27 -!- arosen [~arosen@130.127.39.181] has quit [Quit: Leaving.]
08:27 -!- zabin [~arosen@130.127.39.181] has joined #openvpn
08:27 < twinbee> help here
08:28 -!- twinbee [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has quit [Quit: Page closed]
08:39 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:41 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
08:41 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
08:42 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:42 -!- mode/#openvpn [+v s7r] by ChanServ
08:42 -!- newbee [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has joined #openvpn
08:43 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
08:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:43 -!- mode/#openvpn [+v s7r] by ChanServ
08:44 < newbee> can someone kindly show me how to use setenv in server and client configuration ?
08:45 < skrewt> there doesnt seem to be anyone alive here today
08:46 < newbee> really?
08:46 < newbee> what could be the time there? night?
08:46 < skrewt> no idea
08:46 < skrewt> its early morn in the usa
08:47 < newbee> how can one maintain their nicks on the list even if not really around? it that possible?
08:47 < skrewt> on irc?
08:47 < skrewt> they idly
08:47 < skrewt> idle*
08:47 < skrewt> you dont get kicked off irc for being idle
08:48 < newbee> I see. 
08:48 < skrewt> actually, looks like your using a web client
08:48 < skrewt> so YOU might get kicked off for being idle, but IRC as a protocol doesnt do it
08:48 < newbee> does that mean their pc is always on? Yes Im using web client.
08:48 < skrewt> yea, our pc's are always on
08:49 < skrewt> or they are connected through shell accounts on other servers
08:49 < newbee> I see.
08:50 < newbee> can you answer my question though skrewt?
08:50 < skrewt> i dont know the answer, sorry
08:50 < skrewt> im new to OpenVPN, im waiting for an answer to my own question actually
08:50 < newbee> ok. thank you.
08:50 < newbee> whats your question too?
08:51 < skrewt> i have an ubuntu server box setup that runs an OpenVPN client to a VPN outside my network. i want to enable incoming SSH connections to my server to be routed through the VPN
08:51 < skrewt> im getting conflicts though, im not able to connect via SSH when VPN is connected and vice versa
08:51 < skrewt> i want to be able to remote in to my server via SSH anywhere i am, and tunnel my traffic through the VPN ultimately
08:52 < newbee> really? you cant connect to your server via ssh if your under vpn connection?
08:52 < skrewt> yea
08:52 < skrewt> connection times out
08:52 < skrewt> but when i close the vpn, i can log in fine
08:53 < newbee> what about your firewall on ssh? 
08:53 < skrewt> what do you mean?
08:53 < skrewt> my sshd settings?
08:53 < skrewt> the only firewall i ahve is on my router and i have it disabled temporarily to make sure its not the problem
08:55 < newbee> what application do you use to connect via ssh?
08:56 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
08:56 < skrewt> putty
08:56 < skrewt> and ive tried it from command line ssh on a linux laptop
08:56 < skrewt> same results either way
08:56 < newbee> ok. going back to your firewall, I mean server firewall.
08:56 < skrewt> if your interested, here is my forum thread: https://forums.openvpn.net/topic8874.html
08:56 <@vpnHelper> Title: OpenVPN Support Forum Connecting via SSH while VPN is connected : Configuration (at forums.openvpn.net)
08:57 < skrewt> and regarding server firewall, unless ubunutu server comes with its own by default, ive not setup any firewall on it
08:58 < newbee> really? you have not setup your server firewall? maybe you should do that first to allow ssh connection 
08:59 < skrewt> it allows ssh connections
08:59 < newbee> ok
08:59 < bandroidx> if i want to  auto fill the prompts using a file filed with the details for a new cert (for running openssl req) does that go in the -config param for openssl req ?
09:00 < newbee> what port do you use?
09:00 < skrewt> its a specific port
09:00 < skrewt> im positive its open
09:01 < skrewt> in fact, i dont have the vpn connected and im able to connect in via ssh right now (im at work, servers at home)
09:03 < newbee> do you use in putty the port that is allowed for ssh in your server?
09:04 -!- master_of_master [~master_of@p57B55DB1.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
09:04 < newbee> i believe the port in putty that is default is 22
09:04 < newbee> i dont know if that is the specific port you have there in your server for ssh connection
09:04 < skrewt> yea, i use that port
09:05 < newbee> hmmm
09:05 < skrewt> i have port 22 closed
09:05 < skrewt> on my router and my server
09:05 < skrewt> in fact, i dont have any normal ports open
09:05 < skrewt> its locked down like the plague, even without a firewall
09:05 < newbee> you said you use that port 22?
09:05 < skrewt> no, i do NOT use port 22
09:05 < skrewt> i have a special port i have assigned to SSH
09:05 < skrewt> and it works fine
09:05 < skrewt> i can SSH into my server all day long from anywhere in the world
09:06 -!- master_of_master [~master_of@p57B53759.dip.t-dialin.net] has joined #openvpn
09:06 < skrewt> its not until i connect my server to the VPN that i can no longer SSH into it
09:06 < newbee> so did you use that special port also in putty?
09:06 < skrewt> yea
09:06 < skrewt> like i said, connecting is not the issue
09:06 < newbee> uhm
09:06 < skrewt> if you read the thread i linked, it looks like an IP routing problem
09:06 < newbee> have not totally read
09:07 < skrewt> and ive been given an IP tables command to use but it makes specify my server's IP
09:07 < skrewt> and it's not static
09:07 < skrewt> and from what i can tell, they want the external IP, not my internal IP
09:07 < skrewt> Here is an older thread with the exact problem I have: https://forums.openvpn.net/topic7163.html
09:07 <@vpnHelper> Title: OpenVPN Support Forum allow ssh via on non vpn address while vpn is open : Scripting and Customizations (at forums.openvpn.net)
09:07 < skrewt> the very last post hs the command to run, but says <server_public_IP> which changes for me
09:08 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
09:08 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
09:08 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
09:08 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
09:11 < newbee> i see. well it looks complicated for me. hopefully someone will answer our questions. got to go. I might as well google for awhile for my answer.
09:11 -!- newbee [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has quit []
09:11 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
09:11 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
09:11 -!- mode/#openvpn [+o raidz] by ChanServ
09:12 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 240 seconds]
09:13 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
09:30 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163.html#p15935>
09:33 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
09:34 -!- nioboozmar [~nioboozma@124-168-40-188.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
09:35 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
09:36 < skrewt> woah, thats awesome
09:36 < skrewt> the bot shows new forum posts?
09:42 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163.html#p15936>
09:54 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163.html#p15937>
09:55 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
09:57 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:58 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
10:00 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
10:05 < ecrist> skrewt: yes, it does
10:05 <@vpnHelper> RSS Update - forum: Connecting via SSH while VPN is connected <http://forums.openvpn.net/topic8874.html#p15938>
10:05 < skrewt> i see that now
10:06 < skrewt> i can see that getting annoying, but its also pretty cool. ive not seen it in any other channels before.
10:06 < ecrist> not too many people complain about it
10:07 < dkr> yeah, I'd /ignore vpnHelper except that it's also the channel bot for factoids. :)
10:07 < skrewt> haha
10:07 < skrewt> nice
10:07 < skrewt> yea, im not complaining
10:07 < ecrist> the bot checks RSS periodically, and will list multipe posts in out message, so it's not too bad
10:07 < ecrist> !factoids
10:07 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:07 -!- sawzall [~Bonnevill@70.103.142.130] has joined #openvpn
10:07 < skrewt> ahhhh, ok. very nice
10:07 -!- sawzall [~Bonnevill@70.103.142.130] has left #openvpn []
10:07 < skrewt> i thought it would just spit out every update 1 by 1
10:07 -!- sawzall [~Bonnevill@70.103.142.130] has joined #openvpn
10:07 -!- sawzall [~Bonnevill@70.103.142.130] has left #openvpn []
10:09 -!- mape2k [~mape2k@2a01:198:23f:10ff:cc76:2cff:fe5f:9aa6] has joined #openvpn
10:10 < skrewt> when im connected to my tunnel, and i run ifconfig
10:10 < skrewt> the inet addr it lists for tun0, is that internal only?
10:10 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163.html#p15939>
10:11 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:13 < skrewt> looks like it is
10:13 < skrewt> is that dynamic though, or static?
10:22 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 276 seconds]
10:24 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 258 seconds]
10:24 < skrewt> how do i kill my openvpn connection remotely?
10:24 < skrewt> from a shall
10:24 < skrewt> shell*
10:30 < zabin> /etc/init.d/openvpn stop
10:30 < skrewt> client?
10:31 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
10:32 < zabin> ?
10:32 < skrewt> im using a client, not a server
10:32 < skrewt> the client is running at home, im at work
10:32 < skrewt> didnt know if i could disconnect it remotely
10:32 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
10:36 < cheako> Hello, I'd like to mux OOB data with and openvpn dgram stream.  Dose any one other then dazo know of an sequence of bytes that openvpn would never send?
10:37 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
10:37 < cheako> s/and/an/
10:39 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
10:40 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
10:41 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:44 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
10:45 -!- kyrix_ [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
10:46 -!- kyrix_ [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Read error: Connection reset by peer]
10:47 -!- quadDama1e is now known as quadDamage
10:47 -!- mape2k [~mape2k@2a01:198:23f:10ff:cc76:2cff:fe5f:9aa6] has quit [Ping timeout: 244 seconds]
10:51 < EugeneKay> Within the same data stream? Sounds like a recipe for pain. And not a clue.
10:51 <@vpnHelper> RSS Update - forum: OpenVPN tunnel problem on OBSD 4.9 <http://forums.openvpn.net/topic8875.html#p15940>
10:52 < EugeneKay> Your best bet is probably going to be poking through the encapsulation code
10:55 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:56 < cheako> I'd think just about every conceivable combination of bytes would be sent.  So the pain would be to follow along with the outermost encapsulation and find the end of a packet and look there for the muxed data.
10:57 < cheako> The other solution I had was to escape my OOB marker if it was found in the data stream...  However then you get into an infinite recursion problem, that I just can't bring myself to implement.
10:59 < cheako> hmm.  If I used \OOB as my 4 byte marker and then escaped every \ with \\, then I'd just be looking for an odd number of \ followed by OOB.
11:00 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
11:00 < cheako> What todo if you find an odd number of \ and no OOB?  Trash can an restart!
11:02 < cheako> Would openvpn handle that kind of interruption on a UDP session?  Is there an easy way I can send both sides a "You'r done with this stream now." message?
11:04 < cheako> Hmm, never mind I don't think I'll need that.
11:04 -!- kbarry [~chatzilla@adsl-99-152-170-31.dsl.bumttx.sbcglobal.net] has joined #openvpn
11:05 < kbarry> I must have my switch set to noob today. First time Tomato user, using a Buffalo WHR-g54s. Can't get connected to the Internet "Thru" the router yet.
11:06 < kbarry> I've got the "WAN" section setup for a "Static" IP. The modem we have doesnt have DHCP, so i made u an IP that was unused (Checked it with a computer)
11:06 < kbarry> and the same gateway information that worked on the cmputer.
11:07 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
11:07 < kbarry> I can't get the internet to a device connected thru the Buffalo whatever i have tried
11:07 < kbarry> will someone help me troubleshoot this?
11:08 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
11:09 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
11:09 < Bushmills> !redirect
11:09 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
11:10 < cheako> kbarry: I can't wrap my head around you have an Internet connection with no address assignment...  or is it that you have a NAT with no address assignment?
11:10 < kbarry> ISP > Modem > Device.
11:11 < cheako> I don't know what a Buffalo WHR-g54s is, but I gathered it has something todo with openvpn.
11:11 -!- thething [~forerunne@63.141.241.2] has joined #openvpn
11:11 < kbarry> Modem does not have a DHCP server
11:11 < kbarry> Buffalo is a device maker.
11:11 < cheako> I've had that...  where the DHCP server is at the ISP.
11:11 < Bushmills> you don't need a dhcp server for openvpn
11:12 < cheako> In that case you normally can't just use any address... you actually have to call the ISP and in some cases give them the MAC address of the device.
11:12 < kbarry> yeah, let me make this clear what i am asking. I know there are those who are more familiar than myself with networkign in this channel. The DD-WRT channel is like a graveyard.
11:13 < kbarry> So, My modem is connected to the net.
11:13 < Bushmills> show your openvpn config, and explain what problem you actually have
11:13 < Bushmills> !logs
11:13 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
11:13 < kbarry> The gui tells me its connected, and if i set my computer to an ip similar to its IP, then i can get internet access.
11:13 < cheako> Bushmills: I'd be willing to guess you need an address.  My first comment was, are you sure you don't have an IP address assigned by your ISP.
11:14 < kbarry> This is not an openvpn question. Not yet, I can't even get openvpn working, because i can't get on the internet
11:14 < kbarry> i am one stage before that.
11:14 < Bushmills> cheako: i won't guess but simply wait for him to explain
11:14 < cheako> ...  It's like saying call me, when the phone company hasn't given you a phone number... just won't work for you to make one up.
11:14 < kbarry> cheako: i can get online.
11:15 < cheako> kbarry: Yes, I've had/seen this.
11:15 < Bushmills> oh, well, you need to be able to reach the openvpn server over network before client can connect to it
11:15 < Bushmills> fix that first
11:15 < kbarry> the modem config page is 192.168.1.254. If i set my computer to anything between 192.168.1.1 and 253, i get  the internet
11:15 < cheako> You can get on-line with one device, but not another.
11:15 < kbarry> i can get on with 50 devices.
11:15 < kbarry> aslong as they are in the same range as the modem.
11:16 < kbarry> modem is 192.168.1.254,
11:16 < cheako> hmm.
11:16 < kbarry> i have 5 computers static setup to .10, .20, .30, .40, .50.
11:16 < kbarry> They all are on the ineternet.
11:16 < kbarry> I have another device.
11:16 < kbarry> Its a router/Access Point
11:17 < cheako> I's call that a NAT with no address assignment.  Strange, but not impossible as I assumed.
11:17 -!- Poison[BLX] [9db6518c@gateway/web/freenode/ip.157.182.81.140] has joined #openvpn
11:17 < cheako> ...as what I had assumed.
11:17 < cheako> s/I's/I'd/
11:18 < kbarry> what i want is to get the devices connected thru the new device, and onto the internet.
11:18 < kbarry> i should be able to get DHCP services from the router.
11:18 < kbarry> (It has the capability,
11:18 < cheako> Can you test on the other side of the nat?  I'd hook a laptop or something up there and start sniffing pkts.
11:18 < kbarry> cheako: my problem might be much simpler than that, and that is outside my scope of experience.
11:19 -!- albech [~albech@183.88.67.63] has quit [Quit: Leaving]
11:19 < kbarry> this is a real simple question at first, i believe.
11:19 < kbarry> I have a router,
11:19 < kbarry> I can't get the internet working on it,.
11:19 < cheako> So you "ARE" switching the one device connected to the ISP for another?
11:19 < cheako> ISP -> Modem -> New Device -> NAT
11:20 < cheako> From: ISP -> Modem -> NAT
11:20 < cheako> ...past NAT 50 devices.
11:20 < kbarry> no.
11:20 < kbarry> ISP > Modem > 50 devices
11:20 < kbarry> i want
11:20 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
11:20 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
11:20 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
11:20 < kbarry> ISP > modem > router > 50 devices
11:21 < kbarry> i don't believe the modem is bridged.
11:21 < kbarry> (but i barely know what bridged is :)
11:21 < cheako> Currently the modem is doing NAT?  That's typical.
11:22 < kbarry> Nat, I believe so, DHCP, no.
11:22 < cheako> You may need to use another address range, that is: ISP > Modem > 192.168.1.0/24 > 192.168.2.0/24
11:23 < cheako> http://en.wikipedia.org/wiki/Network_address_translation
11:23 <@vpnHelper> Title: Network address translation - Wikipedia, the free encyclopedia (at en.wikipedia.org)
11:23 < cheako> Second line in google, btw.
11:23 < cheako> That site is way complex... let me try and boil it down for you.
11:25 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 260 seconds]
11:25 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
11:25 < cheako> http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=/rzajw/rzajwaddmasq.htm
11:26 -!- kbarry_ [~chatzilla@76.210.227.51] has joined #openvpn
11:26 < cheako> That should be what you need to know about NAT.
11:27 -!- kbarry [~chatzilla@adsl-99-152-170-31.dsl.bumttx.sbcglobal.net] has quit [Ping timeout: 245 seconds]
11:27 -!- bitterman is now known as luneff
11:28 < cheako> For your new network you may be doing NAT twice, once on the Modem and then once again on your device.  It's not the end of the world, if you were un-aware on a single NAT then additional NAT(s) should also be transparent for you.
11:28 < cheako> ...once you've configured it.
11:29 < cheako> special note, the new device won't be able to handle NATing from 192.168.1.0/24 to 192.168.1.0/24.  You'll need to reconfigure the device if that's the default. :)
11:31 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
11:33 < cheako> I had another thought, if you'r network is likely to get bigger then 200 hosts...  You should switch to using a bigger block, I suggest 10.x.0.0/16  For x you could use 1 or chose a more meaningful or random number for this location.  The ending 0.0 is for your machines, put accounting in 1.y and sales in 2.y...  though that's not important.
11:33 < cheako> s/you'r/your/
11:35 < kbarry_> thanks for the info. We don't have that many devices, nor will we.
11:36 < cheako> k, it's not for every one.
11:38 < skrewt> is the IP assignde to tun0 always the same?
11:39 < cheako> I don't know, because it's configurable.
11:39 < skrewt> can it be made to be the same?
11:39 < cheako> Yes.
11:39 < skrewt> on my end (client)?
11:39 < skrewt> or is it up to the server?
11:40 < cheako> I believe you can configure the client(if it's trusted) to assign it's own IP.  Though per client configurations that's assigned safely by the server is likely documented.
11:41 < skrewt> hrmph
11:41 < skrewt> so how do you route traiffc through tun0 using iptables if the ip changes?
11:41 < cheako> I think if you setup a pool there is an option to have it keep/save the address per client.
11:41 < skrewt> im only the client though, i have no say over the server
11:42 < cheako> skrewt: I'd use a frontend that looks at the current IP.  You can also write an up script that get's passed the IP as an argument.
11:42 < cheako> --up
11:43 < cheako> Specifically --up is for adding routes, but it has many more uses.
11:44 < skrewt> ok
11:44 < skrewt> heres my situation
11:44 < cheako> I have my up script call 'ifup "$1"' to configure policy routing.
11:44 < cheako> I'm special
11:44 < skrewt> i cant ssh into my server at my house while its connected to my VPN because it times out. if its not on the VPN, it works fine
11:44 < skrewt> a thread from the forums said to use this command:
11:45 < skrewt> ptables -A PREROUTING -t nat -i eth0 -p tcp -m tcp ! --dport 22 -j DNAT --to-destination <server_VPN_IP>
11:45 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
11:45 < skrewt> but im not sure what goes in the server vpn ip because it changes
11:46 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
11:47 < cheako> Where is the VPN from to?
11:47 -!- Chodorenko [~chodorenk@84.201.225.23] has joined #openvpn
11:47 < Chodorenko> Hello All 
11:47 < cheako> That looks like something you could easily put in an --up script, if it's the correct solution for your situation.
11:48 < skrewt> cheako, i have a box running ubunutu server at my house, that VPN's out to an external service
11:49 < skrewt> then i also have openssh running, so i can ssh into my box from work, my friends, anywhere
11:50 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
11:50 < cheako> That's where I'd use policy routing... that's not easy and dosn't work.
11:50 < Chodorenko> Prompt, has any plans for implementation developers of LZW compression  or any other with a higher compression
11:51 < cheako> Sorry to take you in another direction, but it sounds to me like the VPN adds a route, perhaps a default route so that all traffic goes out via the VPN.
11:51 < Chodorenko> Let me explain the problem. I have a some of legacy applications that generate a big traffic, but since they are interactive, they need a large channel. With OpenVpn I managed to squeeze traffic by 50%, but when you squeeze Dump the usual ZIP compression is up to 200%
11:51 <@vpnHelper> RSS Update - forum: OpenVPN tunnel problem on OBSD 4.9 <http://forums.openvpn.net/topic8875.html#p15941>
11:52 < skrewt> cheako, im fairly certain it does. i was provided an openvpn.conf file to use from my VPN service provider
11:52 < skrewt> and i do remember them saying to use this .conf to ensure all internet traffic goes through the VPN
11:53 < cheako> So what might be happening(happens to me a bunch) is that a connection comes in to the box on the /external/ IP and the reply goes out the default path via the VPN.  That's called asymmetrical routing.
11:53 < skrewt> i think that is exactly whats happening
11:53 < skrewt> so the data never comes back through the external ip to my SSH session
11:53 < EugeneKay> Chodorenko - The short answer is no, they don't. LZO is used because it's fast. And I can't begin to imagine what you mean  "to compress by 200%".... that would give a negative filesize. You can compress something "to 50% of what it was"....
11:54 < cheako> Let me paste bin a template solution, may need lots of help/tweaking.
11:54 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
11:54 < skrewt> no problem
11:54 < skrewt> i am ssh'd into my box right now
11:54 < cheako> I'm using something like this.
11:54 < skrewt> i had to go in through my router and then ssh from there to my box
11:54 < cheako> ohh, yeah ssh will be fun...  Can you call some-one to rebott it if you route your self out?
11:54 < skrewt> yea
11:54 < skrewt> my wife is home
11:55 < skrewt> god knows how she will reboot it
11:55 < skrewt> but it'll get done
11:55 < cheako> ...I manages to do it several times remotely, but I have to say...  Good.
11:55 < skrewt> i can always run home if needed
11:55 < skrewt> i work 2 blocks away from home
11:56 < skrewt> the help i was getting on the forum seemed to be directed at adding iptables records to reroute port 22 somewhere else
11:56 -!- Chodorenko [~chodorenk@84.201.225.23] has quit [Quit: Chodorenko]
11:56 < skrewt> but they want me to specify the vpn IP, which changes, so i never got that far
12:00 < cheako> I'm typing, big instructions.
12:01 < skrewt> no problem
12:01 < skrewt> i really appreciate it
12:01 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has joined #openvpn
12:01 < WebSprocket> hey guys
12:02 < WebSprocket> need some help becuase I have a problem with VPN and I have been googling for a week and still no resolution
12:04 <@raidz> Chodorenko: You might have better luck explaining the benefits etc on #openvpn-devel.
12:04 < cheako> http://pastebin.com/e99juw5C
12:07 < skrewt> thank you cheako, reading over it now
12:09 < cheako> I forgot that the martian source part needs a tool called sysctr, should be installed...  but sysctl is not required so you may need to install it.
12:09 < Bushmills> WebSprocket: if you google fu matches your problem describing fu, then i'm not surprised you didn't find an answer
12:12 < skrewt> its installed
12:14 < cheako> If using debian/ubuntu here are the nice bits that link into the ifup/down system: http://pastebin.com/bi0XvqJC
12:15 < skrewt> sweet
12:15 < skrewt> im running ubuntu server
12:17 < cheako> Then you can do almost like I did and put these commands into the /etc/network/interfaces file...  Though you'll likely want to use "iface tun0 inet manual" instead of "inet6 static" as I did.
12:18 < skrewt> ok
12:18 < skrewt> im compiling all these instructions to try when i go home
12:18 < skrewt> i dont think i can do it while remoted in
12:19 < R-66Y> what does "def1" mean in redirect-gateway def1? or better, where can I find detailed documentation on how redirect-gateway works?
12:19 < R-66Y> side note: I am not much of a programmer
12:20 -!- pablo_ [0fdb994f@gateway/web/freenode/ip.15.219.153.79] has joined #openvpn
12:21 < pablo_> hi, I am a little bit confused. In some pages such as wikipedia I read that OpenVPN supports ESP UDP encapsulation (rfc3948) and in some others I read that OpenVPN does't support ipsec protocols
12:22 < pablo_> can someone clarify this to me?
12:22 < Bushmills> !def1
12:22 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:22 < Bushmills> openvpn does not support ipsec protocol
12:23 < pablo_> Bushmills: so wikipedia is wrong when it mentions ESP UDP encapsulation (rfc3948), right?
12:25 < Bushmills> i think what wikipedia article means is that openvpn can tunnel ipsec
12:25 < Bushmills> it says "can multiplex"
12:26 < Bushmills> " multiplexing created IPsec ESP tunnels on a single TCP/UDP port"
12:26 < EugeneKay> Wikipedia is editable by anybody.... including idiots.
12:26 < EugeneKay> It's OK to ignore the things which are wrong
12:27 < Bushmills> that's more a matter of how the article is read
12:28 < EugeneKay> True. Luckily, it's easy enough to edit+fix the phraseology
12:28 < Bushmills> may be clearer if it said  "multiplexing tunnels already created by ipsec"  - there's no mention of openvpn "supporting" ipsec
12:28 < Bushmills> in this context, openvpn "supports" ipsec about as much as it "supports"  pop3
12:31 <@vpnHelper> RSS Update - forum: How to pass SIP calls over OpenVPN Tunnel <http://forums.openvpn.net/topic8865.html#p15942>
12:32 < pablo_> Bushmills: ok, thanks for the clarification. I may have misunderstood the article
12:33 < pablo_> when OpenVPN uses udp, it establishes a dtls connection?
12:33 < ecrist> what's dtls?
12:33 < ecrist> !google dtls
12:33 <@vpnHelper> Datagram Transport Layer Security - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Datagram_Transport_Layer_Security>; Datagram Transport Layer Security - RFC Editor: <http://www.rfc-editor.org/rfc/rfc4347.txt>; DTLS -- Datagram TLS: <http://crypto.stanford.edu/~nagendra/projects/dtls/dtls.html>
12:33  * ecrist guesses the answer is yes
12:34 < ecrist> also, so long as you use openssl, openvpn is not vulnerable to the attack BEAST uses
12:34 < ecrist> openssl patched the issue in 2002
12:35 < hyper_ch> I heard openssl is vulnerable?
12:35 < hyper_ch> because it's not using TLS 1.1
12:36 <@raidz> pablo_: yes it does
12:37 < ecrist> hyper_ch: no
12:37 < hyper_ch> hi ecrist
12:37 < ecrist> there was a workaround comitted in 2002 to address the issue in openssl
12:37 < ecrist> many browsers use NSS for the ssl subroutines, which is vulnerable
12:38 < hyper_ch> ah ok
12:38 < ecrist> which is what BEAST uses to exploit the vulnerability in TLS 1.0 and SSL 2
12:39 < ecrist> hyper_ch: check out the -devel mailing list.  James lists it all out and points to references
12:39 < hyper_ch> ecrist: and you think I'd understand anything there?
12:39 < ecrist> heh, no
12:40 < hyper_ch> :)
12:40 < hyper_ch> thx for the offer though
12:40 < pablo_> openvpn is awesome :)
12:40 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
12:43 -!- thething [~forerunne@63.141.241.2] has quit [Ping timeout: 252 seconds]
12:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 255 seconds]
12:49 <@vpnHelper> RSS Update - forum: How to pass SIP calls over OpenVPN Tunnel <http://forums.openvpn.net/topic8865.html#p15943>
12:50 < cheako> !noauth
12:50 < cheako> vpnHelper dosn't like me :(
12:52 < ecrist> !no-auth
12:52 < ecrist> !factoids search auth
12:52 <@vpnHelper> 'authpass' and 'tls-auth'
12:52 < krzee> !authpass
12:52 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
12:53 < cheako> !auth none
12:53 < cheako> !cipher none
12:53 < cheako> Well, I guess it's good the bot dosn't know about them.
12:54 -!- p3rror [~mezgani@41.248.188.110] has joined #openvpn
12:55 < cheako> I remember reading a little blurb about if you set one, then you may need to set the other or something.
12:56 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
12:56 < cheako> I've done auth/encr/verif on the transport, so I only need openvpn for compression and the tun/tap stuff now...  Though shouldn't the compression come after then encryption to do any good, as all encryption start with compression... wright?
12:57 < cheako> Is that's the case then I may also switch to socat for the tun/tap stuff and leave the ifup/down stuff to system level tools.
12:57 < cheako> If
12:58 < skrewt> cheako, reading over that doc, you reference both tun0 and tun1
12:58 < skrewt> are you creating tun1 in the steps?
12:58 < skrewt> or should they all be tun0?
12:59 < cheako> There are two tunnels on that system, I'm feeding everything from tun0 to tun1.  In your case you would be feeding every thing from your SSH server to eth0.
12:59 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15945> || allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163-15.html#p15944>
12:59 < skrewt> ah, ok
13:00 < cheako> You identify the SSH server by the source of the packets.
13:00 < cheako> I also need to add source routes for the IP addresses used for routing to host services.
13:01 < cheako> As it is if some one connected to either tun0 or tun1 the reply would go out the0 and I'd likely have the same problem you are fighting.
13:01 < cheako> eth0
13:01 < skrewt> lol
13:01 < skrewt> nice
13:03 < cheako> I wish this was documented better.  I've been luky in that I'm able to connect to the address on eth0 without issue, but it's little more then a coincidence that it works.
13:03 -!- swg0101 [~swg0101@openvpn/user/swg0101] has joined #openvpn
13:03 -!- mode/#openvpn [+v swg0101] by ChanServ
13:03 < skrewt> shouldnt i have the same issues if i run a web server on that box too?
13:03 < cheako> Thank you for pointing that out to me.
13:04 < cheako> Correct, every service ssh/http/pop3/ect is effected by -this- routing problem.
13:04 < skrewt> yea, and i just noticed, i do have that problem
13:04 < skrewt> my web server wont come up with the vpn connected either
13:05 < skrewt> i was playing with the web server all day yesterday and never had a problem, but now that i think harder, i dont think i ever connected to the VPN either
13:05 < cheako> I'm likely going to redo my configuration for the fourth time.
13:06 -!- swg0101 [~swg0101@openvpn/user/swg0101] has left #openvpn []
13:07 < skrewt> i guess having the VPN ignore specific ports wont work either?
13:07 < skrewt> neither my web server or my ssh is on standard ports
13:07 < skrewt> as neither are available to the public
13:07 < cheako> I may hardcode the part where the output of ip route is grepped and fed back into ip route, it works as it is but there is a lot of magic going on that I should understand.
13:08 < cheako> ...but it's not documented AFAICT.
13:09 -!- Drbradley [Drbradle@rrcs-96-11-102-59.central.biz.rr.com] has joined #openvpn
13:09 < cheako> I had a similar problem with netfilter documentation...  now the docs are awesome, those images of how the pkt is sent from one part to another are priceless.  Fumbling around in the dark when it comes to kernel internals is no fun at all.
13:09 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163-15.html#p15946>
13:10 < cheako> load shoot test forget, load shoot test forget...
13:10 < Drbradley> Hello
13:10 < Drbradley> Is anyone possible able to help me with openvpn?
13:12 < cheako> That martian source problem stalled me for two days, till I finally talked with some one on ##kernel who knew how it all worked.
13:13 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
13:15 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163-15.html#p15947>
13:16 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
13:16 -!- pablo_ [0fdb994f@gateway/web/freenode/ip.15.219.153.79] has quit [Quit: Page closed]
13:17 -!- luneff [~yury@188.114.43.219] has quit [Quit: This computer has gone to sleep]
13:21 <@vpnHelper> RSS Update - forum: OpenVPN tunnel problem on OBSD 4.9 <http://forums.openvpn.net/topic8875.html#p15948>
13:22 -!- corretico [~luis@200.12.40.18] has joined #openvpn
13:32 -!- Weslocke [44a9b6cf@gateway/web/freenode/ip.68.169.182.207] has joined #openvpn
13:32 -!- Weslocke [44a9b6cf@gateway/web/freenode/ip.68.169.182.207] has left #openvpn []
13:33 < Bushmills> !howto
13:33 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:33 < Bushmills> Drbradley: ^^^
13:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
13:41 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 260 seconds]
13:41 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
13:47 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 255 seconds]
13:48 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:48 < skrewt> what is the loopback interface for?
13:48 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html>
13:48 < skrewt> i see this on my ifconfig but not on anyone elses?
13:49 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
13:51 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
13:51 -!- Chodorenko [~chodorenk@by.one.by] has joined #openvpn
13:51 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
13:52 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:52 < Chodorenko> EugeneKay: You Say: that would give a negative filesize. You can compress something "to 50% of what it was"
13:53 < Chodorenko> EugeneKay:  my dump File is 2,10 Mb , in zip archive 514 kb its ~200 % or 3/4 compress 
13:56 < Chodorenko> EugeneKay: sorry 300 % :( 
13:56 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
13:56 < Chodorenko> or may be 75 % in different compare 
13:58 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
13:59 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 258 seconds]
14:00 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
14:02 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
14:06 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
14:16 < skrewt> ive got an openvpn client open in a shell at home
14:16 < skrewt> anyway i can close the connection from another remote shell?
14:18 < Bushmills> pkill openvpn, assuming there's only one instance running
14:19 < skrewt> there should only be
14:19 < skrewt> worded, thank you
14:19 < skrewt> worked*
14:21 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
14:25 -!- kbarry_ [~chatzilla@76.210.227.51] has quit [Quit: ChatZilla 0.9.87 [Firefox 4.0.1/20110413222027]]
14:28 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
14:37 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:39 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:51 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163-15.html#p15950>
14:52 < krzee> !splitroute
14:52 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
14:55 -!- Poison[BLX] [9db6518c@gateway/web/freenode/ip.157.182.81.140] has quit [Ping timeout: 252 seconds]
14:57 -!- Drbradley [Drbradle@rrcs-96-11-102-59.central.biz.rr.com] has quit []
14:57 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163-15.html#p15951>
15:02 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:02 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
15:07 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
15:08 < skrewt> cheako, you still here?
15:17 -!- p3rror [~mezgani@41.248.188.110] has quit [Ping timeout: 260 seconds]
15:19 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
15:25 <@vpnHelper> RSS Update - forum: OpenVPN with redirect-gateway renders public ip inaccessable <http://forums.openvpn.net/topic7175.html#p15953> || VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15952>
15:27 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Changing host]
15:27 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
15:31 <@vpnHelper> RSS Update - forum: allow ssh via on non vpn address while vpn is open <http://forums.openvpn.net/topic7163-15.html#p15954>
15:32 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
15:33 -!- p3rror [~mezgani@41.248.221.237] has joined #openvpn
15:36 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15955>
15:39 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 240 seconds]
15:43 -!- p3rror [~mezgani@41.248.221.237] has quit [Ping timeout: 260 seconds]
15:48 <@vpnHelper> RSS Update - forum: iptables - OUTPUT DROP not allowed? <http://forums.openvpn.net/topic8878.html>
15:54 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html>
15:55 -!- p3rror [~mezgani@41.248.222.218] has joined #openvpn
15:59 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
15:59 <@vpnHelper> RSS Update - forum: Monitoring VPN users <http://forums.openvpn.net/topic8871.html#p15958>
16:01 < cheako> I'm back skrewt.
16:01 < skrewt> hey man
16:02 < skrewt> i got my problem solved
16:02 < skrewt> one of my posts was replied to with a link to another post that solved it in 2 simple commands
16:02 < skrewt> https://forums.openvpn.net/topic7175.html
16:02 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN with redirect-gateway renders public ip inaccessable : Configuration (at forums.openvpn.net)
16:04 < cheako> Yeah, I did that 5 days ago and I had to figure out the other commands via brute force.  These examples didn't work for me, on 3 different boxes that all have different criteria for how they need to be configured.
16:04 < skrewt> ahhh, ok
16:04 < skrewt> it seems to have worked for me so far
16:04 < skrewt> although i dont understand what they actually do
16:05 < cheako> However those are the two commands that every piece of documentation says to use...  and nothing says how to work with it when it dosn't go after doing that.
16:06 < skrewt> i see
16:06 < skrewt> i didnt see them in the docs :(
16:08 < cheako> Well the "ip route ... table 20" one creates a new routing table, it's like the regular route table only it's not used until there is a rule added that directs traffic to it.  The routing tables dictate where traffic is sent to, in your case you want everyhting to go out your VPN, unless it's a server request to your external IP then you want the trfic to go out using the other routing table.
16:08 < skrewt> ok
16:08 < cheako> The ip rule line adds a rule, vary much like the iptables rules you may have seen.
16:08 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
16:08 < skrewt> so, is that then not routing my SSH traffic through the VPN?
16:09 < skrewt> oh wait
16:09 < skrewt> im establishing the SSH tunnel outside the VPN, but once established it routes it contents (traffic) through the VPN?
16:09 < cheako> Correct, you add a policy that says "Anything from my external IP address goes out directly, skipping the default route to the VPN."
16:10 < skrewt> interesting
16:10 < skrewt> so while it looks like its working, it may not be?
16:11 < cheako> The SSH traffic(Traffic from any service on your external IP) should be skipping the VPN, but if you run SSH on the machine you will then use the VPN.
16:12 < skrewt> ok
16:12 < cheako> It's not possible to half make use of the VPN for a given connection.
16:12 < skrewt> im at work
16:12 < skrewt> i have ssh'd into my box at home, the VPN client
16:12 < cheako> err rather you'll get a timeout.
16:12 < skrewt> through my putty window, i run an ip check and it shows my public IP as my VPN's IP
16:13 < cheako> what does the env command say, specifically the lines that start with SSH.
16:14 -!- blocky [blocky@96.54.168.243] has joined #openvpn
16:15 < cheako> http://pastebin.com/axg558ML Should look like this.
16:15 < cheako> ...except have ipv4 addresses.
16:16 < cheako> SSH_CONNECTION should hvae the IP address that's not part of the VPN/tun interface.
16:17 < skrewt> 1 sec
16:17 < skrewt> sorry, i was creating an SSH tunnel to check cmyip.com in a browser and see how it saw my traffic
16:17 < skrewt> still showed the VPN IP
16:18 < skrewt> when i type 'env' i dont have anything with SSH in it
16:18 < cheako> That's a good test.  Though it should be the same as if you ran w3m/elinks on the machine it's self.
16:19 < skrewt> i did, and it is
16:19 < skrewt> i have a little bash script to grep the results from whatismyip.com, cmyip.com, checkip.dyndns.org and 1 other
16:19 < cheako> hmm, well there are two more ways to discover this.  Try: netstat -plunta | grep ssh
16:19 < skrewt> compares them all and spits out the results, 1 ip if all the same, or detailed results if not
16:19 < cheako> Should spit out all your ssh related sockets.
16:19 < skrewt> it did
16:20 < skrewt> 6 lines
16:20 < skrewt> i can ID each one as well
16:20 < skrewt> 2 remote term's at home, 2 terms from work
16:20 < skrewt> 1st and last line look like junk
16:20 < skrewt> just listening
16:20 < cheako> Each one with ESSTABLISHED at the end should be a working ssh session and perhaps any ssh forwards you have going.
16:20 < skrewt> ok, cool
16:20 < skrewt> all 4 established are the 4 connections i am aware of
16:21 < skrewt> although 3 have my routers IP as 2 are done from at home on my internal network and 1 is done here but i ssh'd into my router first (this morning, when i started this)
16:21 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:24 < skrewt> all looks good to me though, and thats awesome
16:24 < skrewt> now i can share my single VPN connection
16:24 < skrewt> if only i didnt have such shit upload speeds
16:24 < skrewt> since this realy is depending heavily on that
16:26 -!- Chodorenko [~chodorenk@by.one.by] has quit [Ping timeout: 260 seconds]
16:30 < cheako> It would be nice if p2p networking was used more, but it's a chicken and egg thing.  ISPs arn't ever going to give ppl good upload speeds so p2p networking can't thrive.
16:30 < skrewt> FIOS offers fast uploads
16:30 < skrewt> like 25/25
16:30 < cheako> ...so there is no need for home users to have good upload speeds.
16:31 < skrewt> i have no problem swtiching to a business account and paying a little more, its just not availbe to me where i live
16:31 < skrewt> i already have the fastest DSL package available to me
16:31 < skrewt> i do not have cable or fiber at all
16:31 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
16:32 < skrewt> im even willing to purchase a second DSL account/line if i could merge and reverse them, basically take a second 10/1.5 and reverse to 1.5/10 and then combine the 2, hopefully for 11.5/11.5
16:32 < cheako> Where I'm at I can get MOE (10m/100/1g/10g)
16:32 < skrewt> well eff you cheako 
16:32 < skrewt> :-P
16:32 < skrewt> nothing above 10Mbps around these parts
16:33 -!- skrewt [~Chad@oh-65-40-66-111.sta.embarqhsd.net] has quit [Quit: Leaving]
16:34 -!- merlin1991 [~merlin@Maemo/community/cssu/merlin1991] has joined #openvpn
16:36 < cheako> In 2001-2002 I was sharing a T1 with 3 roommates $300/mo each for 1.54m up and down.  Though I remember it being faster then the 7m DSL I was using and definitely faster then any Cable I've ever used.  I think clamping the upstream to 512 or even 768 is a real pain for trying to get a 7m download.
16:38 < krzee> !factoids search bond
16:38 <@vpnHelper> No keys matched that query.
16:38 -!- p3rror [~mezgani@41.248.222.218] has quit [Ping timeout: 260 seconds]
16:40 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
16:40 < krzee> i remember someone successfully bonding 2 links to the same vpn server, and effectively boosting their single-file download speeds
16:40 < krzee> (when routing over the vpn)
16:40 < cheako> Yeah, I just asked about TCP bonding and it's a no go.  There was something about multiplexing, but I forget what it's used for.  In thoery you could use something like Ethernet load balancing in the linux kernel across multiple connections.
16:40 < krzee> unfortunately i cant find it
16:41 < cheako> You'
16:42 < cheako> d fire up one openvpn session, with source routing, for each internet connection and then tell the linux kernel to load-balance across them...  but you'd hvae to do the same on the other end.
16:42 < cheako> The kernel exposes a single trunked interface.
16:43 < krzee> this person used bonding
16:43 <@vpnHelper> RSS Update - forum: How-to: Tunnel WAN IP assigned to specific users <http://forums.openvpn.net/topic8559.html#p15959>
16:43 < cheako> You could use a rack-space account for this, but then they'd charge bandwidth usage.
17:00 <@vpnHelper> RSS Update - forum: Monitoring VPN users <http://forums.openvpn.net/topic8871.html#p15960>
17:02 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 248 seconds]
17:03 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
17:03 -!- mode/#openvpn [+o raidz] by ChanServ
17:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:15 -!- mode/#openvpn [+v Axeman] by ChanServ
17:18 <@vpnHelper> RSS Update - forum: How to pass SIP calls over OpenVPN Tunnel <http://forums.openvpn.net/topic8865.html#p15961>
17:36 <@vpnHelper> RSS Update - forum: Monitoring VPN users <http://forums.openvpn.net/topic8871.html#p15962>
17:36 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:38 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
17:41 -!- p3rror [~mezgani@41.140.26.110] has joined #openvpn
17:41 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
17:41 <@vpnHelper> RSS Update - forum: Monitoring VPN users <http://forums.openvpn.net/topic8871.html#p15963>
17:42 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
17:45 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:48 <@vpnHelper> RSS Update - forum: Monitoring VPN users <http://forums.openvpn.net/topic8871.html#p15964>
17:49 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
17:51 < merlin1991> I heaven't seen this anywhere on the openvpn page, but to get udp broadcasts running properly on a bridged setup on windows 7 I had to set the network adapter metricc of the tap device from automatic to some low manual value
17:51 < merlin1991> on xp it works without tweaking that setting
17:55 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
17:57 -!- miguet [~miguet@121.1.54.50] has quit [Quit: Lost terminal]
17:59 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
17:59 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:01 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
18:06 <@vpnHelper> RSS Update - forum: Monitoring VPN users <http://forums.openvpn.net/topic8871.html#p15965>
18:18 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857.html#p15966>
18:24 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
18:26 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
18:35 -!- nioboozmar [~nioboozma@dyn-129-78-251-12.wirelessguest.usyd.edu.au] has joined #openvpn
18:59 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
19:20 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
19:26 -!- Squidy [~quassel@187.7.192.230] has joined #openvpn
19:26 -!- Squidy [~quassel@187.7.192.230] has quit [Changing host]
19:26 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:51 -!- _julian_ [~quassel@hmbg-4d06a2e4.pool.mediaWays.net] has joined #openvpn
19:52 -!- _julian [~quassel@hmbg-5f76570a.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:59 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:59 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:00 -!- mode/#openvpn [+v Axeman] by ChanServ
20:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
20:21 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:21 -!- mode/#openvpn [+v Axeman] by ChanServ
20:38 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 240 seconds]
20:42 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
20:49 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
20:56 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
20:57 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:12 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
21:17 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
21:18 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:18 -!- mode/#openvpn [+v Axeman] by ChanServ
21:41 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
21:41 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
21:49 <@vpnHelper> RSS Update - forum: Virtual network adapters in windows <http://forums.openvpn.net/topic8834.html#p15967>
22:01 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
22:07 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:12 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
22:30 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
22:31 -!- Ionic [ionic@ionic.de] has joined #openvpn
22:32 -!- p3rror [~mezgani@41.140.26.110] has quit [Ping timeout: 260 seconds]
22:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 256 seconds]
22:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
23:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:16 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
23:18 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
23:28 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
23:37 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Quit: changing servers]
23:41 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
23:47 -!- nioboozmar [~nioboozma@dyn-129-78-251-12.wirelessguest.usyd.edu.au] has quit [Quit: Linkinus - http://linkinus.com]
23:51 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 240 seconds]
23:58 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
--- Day changed Tue Sep 27 2011
00:03 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
00:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
00:18 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p15968>
00:18 -!- luneff [~yury@84.51.192.74] has joined #openvpn
00:24 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
00:24 <@vpnHelper> RSS Update - forum: How-to: Tunnel WAN IP assigned to specific users <http://forums.openvpn.net/topic8559.html#p15969>
00:24 -!- oc80z [oc80z@blea.ch] has joined #openvpn
00:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:42 -!- EugeneKay is now known as EugeneKaway
00:47 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
00:49 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
00:50 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
00:57 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
00:57 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
00:58 -!- Mowee [~Mowi@lendabrain.net] has quit [Ping timeout: 260 seconds]
00:59 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
01:03 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
01:12 -!- blocky [blocky@96.54.168.243] has quit [Ping timeout: 258 seconds]
01:33 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
01:38 < Smak> Wanted to know if I could get some assistance with setting up my bridge. I have 2 interfaces eth1 (192.168.0.1) eth0 (cable modem) when I try to create my interface brctl addif br0 eth1 ... eth1 basically goes by by correct?  I was trying to use the same ip address for br0 that I was using for eth1.
01:43 < Smak> I guess what I am asking is if br0s IP address should be the same as the interface I am bridging it with, or are they considered seperate interfaces and that would be a IP conflict.
01:46 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
01:47 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
01:56 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:56 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has quit [Read error: Connection reset by peer]
02:00 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:02 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
02:04 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
02:09 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:12 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
02:27 -!- luneff [~yury@188.114.49.89] has joined #openvpn
02:33 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has joined #openvpn
02:34 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
02:35 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
02:45 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:46 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:46 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:48 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:48 -!- Diffen [~diffen@c-f477e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
02:52 <@vpnHelper> RSS Update - forum: How-to: Tunnel WAN IP assigned to specific users <http://forums.openvpn.net/topic8559.html#p15970>
02:57 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:58 -!- miguet [~miguet@121.1.54.50] has quit [Ping timeout: 260 seconds]
03:00 < dropje> Smak: a bridge does not need to have an IP assigned
03:00 -!- dazo_afk is now known as dazo
03:09 -!- michl [~mich@dslb-084-056-082-214.pools.arcor-ip.net] has joined #openvpn
03:09 -!- michl [~mich@dslb-084-056-082-214.pools.arcor-ip.net] has quit [Client Quit]
03:17 <@vpnHelper> RSS Update - forum: OpenVPN tunnel problem on OBSD 4.9 <http://forums.openvpn.net/topic8875.html#p15972> || Virtual network adapters in windows <http://forums.openvpn.net/topic8834.html#p15971>
03:23 <@vpnHelper> RSS Update - forum: How to pass SIP calls over OpenVPN Tunnel <http://forums.openvpn.net/topic8865.html#p15974> || can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p15973>
03:28 < Smak> I actually got it working :)
03:28 < Smak> Just played a game of starcraft 1 with my mate.
03:37 < bandroidx> anyone know if i can define CN when running openssl req via the command line?
03:42 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has quit [Read error: Connection reset by peer]
03:47 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
04:05 <@vpnHelper> RSS Update - forum: Earn from your home <http://forums.openvpn.net/topic8880.html>
04:21 -!- p3rror [~mezgani@41.248.105.88] has joined #openvpn
04:29 <@vpnHelper> RSS Update - forum: lan address range question <http://forums.openvpn.net/topic8848.html#p15724>
04:50 -!- p3rror [~mezgani@41.248.105.88] has quit [Ping timeout: 260 seconds]
04:52 -!- thanwin [~thanwin@124-168-40-188.dyn.iinet.net.au] has joined #openvpn
04:59 < hyper_ch> howdy
05:14 -!- p3rror [~mezgani@41.140.157.56] has joined #openvpn
05:17 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 256 seconds]
05:22 -!- p3rror [~mezgani@41.140.157.56] has quit [Ping timeout: 248 seconds]
05:28 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:28 <@vpnHelper> RSS Update - forum: Logging on after disconnect <http://forums.openvpn.net/topic8881.html>
05:31 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
05:35 -!- p3rror [~mezgani@41.248.185.233] has joined #openvpn
05:37 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:43 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
05:46 <@vpnHelper> RSS Update - forum: Official Android App <http://forums.openvpn.net/topic8117.html#p15977>
06:01 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:01 -!- mode/#openvpn [+v Axeman] by ChanServ
06:03 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
06:03 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p15978>
06:05 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
06:12 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:12 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:12 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:12 -!- mode/#openvpn [+v Axeman2] by ChanServ
06:12 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
06:16 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
06:16 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
06:17 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
06:23 -!- lurker_ [44446b4f@gateway/web/freenode/ip.68.68.107.79] has joined #openvpn
06:26 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
06:28 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 255 seconds]
06:29 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
06:31 -!- lurker_ [44446b4f@gateway/web/freenode/ip.68.68.107.79] has quit [Quit: Page closed]
06:39 -!- buntfalke [~nobody@openvpn-p0-ipv6-107f.triple-a.uni-kl.de] has joined #openvpn
06:40 -!- buntfalke [~nobody@openvpn-p0-ipv6-107f.triple-a.uni-kl.de] has quit [Changing host]
06:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
06:59 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
07:06 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
07:11 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 244 seconds]
07:16 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:16 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
07:21 -!- Chodorenko [~chodorenk@84.201.225.23] has joined #openvpn
07:21 -!- Chodorenko [~chodorenk@84.201.225.23] has left #openvpn []
07:23 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has quit [Ping timeout: 276 seconds]
07:23 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
07:36 -!- Weslocke [44a9b6cf@gateway/web/freenode/ip.68.169.182.207] has joined #openvpn
07:36 -!- Weslocke [44a9b6cf@gateway/web/freenode/ip.68.169.182.207] has left #openvpn []
07:38 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:38 -!- p3rror [~mezgani@41.248.185.233] has quit [Ping timeout: 248 seconds]
07:39 -!- WebSprocket [~WebSprock@93-97-23-210.zone5.bethere.co.uk] has quit [Quit: —I-n-v-i-s-i-o-n— 3.2 (July '10)]
07:40 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
07:41 -!- cpm [~Chip@border0.avitecture.net] has joined #openvpn
07:41 -!- cpm [~Chip@border0.avitecture.net] has quit [Changing host]
07:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:41 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
07:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Connection reset by peer]
07:42 < dropje> !factoids
07:42 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
07:47 -!- cpm [~Chip@border0.avitecture.net] has joined #openvpn
07:47 -!- cpm [~Chip@border0.avitecture.net] has quit [Changing host]
07:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:55 -!- thanwin [~thanwin@124-168-40-188.dyn.iinet.net.au] has quit [Quit: Linkinus - http://linkinus.com]
08:01 -!- lurker_ [44446b4f@gateway/web/freenode/ip.68.68.107.79] has joined #openvpn
08:04 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p15979>
08:04 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
08:06 < Optic> moo
08:06 < lurker_> how can I use echo in server to pass message to client?
08:07 < lurker_> is that even possible? or I have misunderstood echo
08:09 < ecrist> what?
08:09 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:10 < lurker_> I am thinking to send a message from server to clients like "hello" something like those message
08:10 < lurker_> with the use of ECHO option
08:10 < ecrist> openvpn doesn't do that
08:10 < lurker_> oh
08:10 < lurker_> whats the use of echo there?
08:10 < Bushmills> lurker_: how would you do that when using a network cable?
08:10 < Bushmills> do the same with openvpn then
08:11 < ecrist> what 'echo' option are you talking about?
08:11 < lurker_> bushmills, I have not done it either with network cable. 
08:11 < lurker_> echo [parms...] 
08:11 < ecrist> if you're talking about --echo config option, it's used to echo data to the log file
08:12 < ecrist> read the rest of that section, lurker_ 
08:12 < Bushmills> lurker_: openvpn doesn't give you any additional capabilities to do so
08:12 < lurker_> ah i see
08:12 < ecrist> "Designed to be used to send messages to a controlling application which is receiving the OpenVPN log output."
08:13 < lurker_> yes that is what is said, to send messages toa controlling application. hahahaha. have I misinterpreted it?
08:13 < ecrist> you stopped too soon
08:13 < ecrist> ... which is receiving the OpenVPN log output
08:13 < ecrist> so, if you have something tailing the log output, it would be useful
08:14 < lurker_> hahahaha. I was wrong. 
08:15 < lurker_> what about this other option bcast-buffers n which default value is 256. what is the purpose of this?
08:16 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 260 seconds]
08:16 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
08:18 < lurker_> it has only short description
08:20 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
08:21 < ecrist> lurker_: read the code, and read the man page.
08:21 < ecrist> we're not going to sit here and explain/describe every option to you
08:22 < lurker_> yes but the description is only Allocate n buffers for broadcast datagrams (default=256)
08:23 < ecrist> yup, there's your answer
08:23 < ecrist> we're not going to sit here and explain/describe every option to you
08:23 < lurker_> anyway can I ask instead what is broadcast datagrams so that I can understand whats the purpose!
08:23 < ecrist> !google broadcast datagrams
08:23 <@vpnHelper> Broadcasting to Multiple Recipients (The Java™ Tutorials > Custom ...: <http://download.oracle.com/javase/tutorial/networking/datagrams/broadcasting.html>; DatagramSocket (Java 2 Platform SE v1.4.2): <http://download.oracle.com/javase/1.4.2/docs/api/java/net/DatagramSocket.html>; RFC 922 - Broadcasting Internet datagrams in the presence of subnets: <http://tools.ietf.org/html/rfc922>
08:25 < lurker_> wow so much reading materials. ok. will google this one.
08:26 -!- lurker_ [44446b4f@gateway/web/freenode/ip.68.68.107.79] has left #openvpn []
08:26 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
08:32 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p15980>
08:44 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p15981>
08:45 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
08:45 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
08:45 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
08:45 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
08:47 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:47 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:47 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:47 -!- mode/#openvpn [+v Axeman] by ChanServ
08:50 -!- blocky [~blocky@96.54.168.243] has joined #openvpn
08:55 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
08:56 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:03 -!- master_of_master [~master_of@p57B53759.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
09:06 -!- master_of_master [~master_of@p57B5452F.dip.t-dialin.net] has joined #openvpn
09:13 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
09:14 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
09:17 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
09:20 <@vpnHelper> RSS Update - forum: OpenVPN tunnel problem on OBSD 4.9 <http://forums.openvpn.net/topic8875.html#p15982>
09:25 -!- luneff [~yury@188.114.49.89] has quit [Quit: Leaving]
09:25 -!- blocky [~blocky@96.54.168.243] has quit [Read error: Operation timed out]
09:35 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
09:39 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
09:39 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
09:39 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
09:43 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
09:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
09:43 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 260 seconds]
09:48 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:49 -!- luneff [~yury@188.114.49.89] has joined #openvpn
09:53 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
09:53 -!- tushar [~tusharsha@182.237.13.219] has joined #openvpn
09:58 -!- blocky [blocky@w106-019.wireless.uvic.ca] has joined #openvpn
10:00 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Ping timeout: 252 seconds]
10:04 -!- blocky [blocky@w106-019.wireless.uvic.ca] has quit [Ping timeout: 244 seconds]
10:15 -!- tushar [~tusharsha@182.237.13.219] has quit [Remote host closed the connection]
10:16 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
10:16 < grendal-prime> hey guys how goes it?
10:16 -!- blocky [blocky@w106-019.wireless.uvic.ca] has joined #openvpn
10:16 < grendal-prime> I need to push "redirect-gateway def1" to just one client..I can drop that into a ccd right?
10:17 < hyper_ch> grendal-prime: yes
10:17 < grendal-prime> thanks.. hyper_ch 
10:19 < grendal-prime> i and eternally great-full for you speedy quick response...and am very much likening you.
10:19 < grendal-prime> hahaha
10:20 -!- Weslocke [44a9b6cf@gateway/web/freenode/ip.68.169.182.207] has joined #openvpn
10:21 < hyper_ch> grendal-prime: I'll send you a bill then
10:27 -!- EugeneKaway is now known as EugeneKay
10:35 < grendal-prime> thanks
10:36 < grendal-prime> hey so we can set the gateway but...im able to route...im thiking its just a tables/firewall issue..anything else you can think of i should worry about?
10:37 <@vpnHelper> RSS Update - forum: OpenVPN tunnel problem on OBSD 4.9 <http://forums.openvpn.net/topic8875.html#p15983>
10:37 -!- blocky [blocky@w106-019.wireless.uvic.ca] has quit [Ping timeout: 276 seconds]
10:38 < grendal-prime> nevermind its a dns issue
10:38 < grendal-prime> thaks
10:40 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
10:45 -!- dazo is now known as dazo_afk
10:50 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Quit: Leaving]
11:04 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
11:10 -!- johnfg [~johnfg@75-175-131-91.blng.qwest.net] has joined #openvpn
11:10 < johnfg> hi guys
11:12 < johnfg> I'm running debian squeeze (new installation) and trying to use GADMIN-OpenVPN-Clein 0.1.1 to connect to my openvpn server on debian lenny.
11:12 < johnfg> Client, not Clein!
11:14 < johnfg> I've imported ca.crt, client1.crt, client1.key, and dh1024.pem.  I've done this through the gui, but those files are in /etc/openvpn on the client.
11:17 < johnfg> When I click Add, or Activate, I get the error message: Missing certificate or key setting.
11:17 < johnfg> Any ideas what I'm missing?
11:17 < johnfg> I set this up for my windows machines with no problem.
11:18 -!- Weslocke [44a9b6cf@gateway/web/freenode/ip.68.169.182.207] has quit [Ping timeout: 252 seconds]
11:19 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
11:24 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
11:24 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
11:24 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
11:25 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:25 -!- EugeneKay [eugenekay@itvends.com] has quit [Quit: ZNC - http://znc.in]
11:26 -!- EugeneKay [eugenekay@itvends.com] has joined #openvpn
11:32 < hyper_ch> whats gamin-openvpn-client?
11:38 < johnfg> hyper_ch, Oops, GADMIN.
11:38 < johnfg> It's a gtk gui for configuring the openvpn client.
11:39 < hyper_ch> I have no need for such a thing
11:39 < hyper_ch> so what does your config file look like?
11:45 < cheako> hi.
11:45 < hyper_ch> hi cheako
11:47 < johnfg> I'll try again first, then paste if necessary.
11:50 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
11:51 < stevefink> Can one client certificate be used to login multiple times from different machines?
11:51 < stevefink> (simultaneously)
11:54 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has joined #openvpn
11:56 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
11:57 < EugeneKay> !dupe
11:57 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
11:57 < stevefink> thanks!
11:58 -!- buntfalke_ [~nobody@unaffiliated/buntfalke] has quit [Read error: Connection reset by peer]
11:59 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has joined #openvpn
11:59 < steelnwool> Hello.
11:59 < steelnwool> I'm trying to come up with the right firewall rules to redirect VPN traffic to squid.
11:59 < steelnwool> my network looks like http://cl.ly/0a3O1z1q2I1O2z000c2t
11:59 <@vpnHelper> Title: vpn.jpg (at cl.ly)
12:00 < steelnwool> the rules I found suggested for iptables use the nat table, which somehow doesn't feel right.
12:00 < steelnwool> but  guess you use nat if you are redirecting traffic.
12:01 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:05 -!- steelnwool [~Adium@blk-138-15-137.eastlink.ca] has left #openvpn []
12:10 < johnfg> What's the debian command to restart openvpn server?
12:11 < Bushmills> init 6
12:12 < hyper_ch> johnfg: how do you restart any service on debian?
12:13 < johnfg> hyper_ch, I got it, but sometimes I use an /etc/rc.d command, but this time I did /etc/init.d/openvpn restart, and it did the job.
12:13 < hyper_ch> I always use init.d
12:13 < johnfg> I manually started both server and client and now both are working!
12:13 < hyper_ch> well, now service on ubuntu
12:14 < johnfg> hyper_ch, what ubuntu version are you using?
12:14 < hyper_ch> oneiric on my netbook
12:14 < johnfg> Or versions?
12:14 < hyper_ch> debian is being used on my servers
12:14 < johnfg> So, that's still beta?
12:14 < hyper_ch> johnfg: yes
12:14 < johnfg> You using lenny or squeeze or something older?
12:15 < hyper_ch> on servers I use debian stable
12:15 < johnfg> OK, so squeeze.  Great!  You hadn't seen or used the GADMIN-OPENVPN-Client?
12:16 < hyper_ch> johnfg: no, I haven't
12:18 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:23 < johnfg> hyper_ch, See if this looks right for my client: http://paste.debian.net/132641/
12:24 < hyper_ch> no clue
12:27 < johnfg> OK, ttyl!
12:27 -!- johnfg [~johnfg@75-175-131-91.blng.qwest.net] has quit [Quit: Leaving]
12:28 -!- ashadocat-tmp [18de0af6@gateway/web/freenode/ip.24.222.10.246] has joined #openvpn
12:29 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:30 -!- K1ng`` [~k1ng@180.211.188.178] has joined #openvpn
12:30 < ashadocat-tmp> So I'm a bit of a networking newb. All of my ports are copied to the servers ip and I can't see the actuall openvpn services port. Here's the config. http://pastie.org/private/cdkv5ogspmk6zvc5wovq
12:30 -!- K1ng`` [~k1ng@180.211.188.178] has quit [Changing host]
12:30 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:32 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
12:50 -!- bigon [bigon@ubuntu/member/bigon] has quit [Ping timeout: 240 seconds]
12:51 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
12:51 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
12:51 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
13:04 -!- blocky [blocky@w107-225.wireless.uvic.ca] has joined #openvpn
13:08 -!- ashadocat-tmp [18de0af6@gateway/web/freenode/ip.24.222.10.246] has quit [Quit: Page closed]
13:11 -!- blocky [blocky@w107-225.wireless.uvic.ca] has quit [Ping timeout: 260 seconds]
13:11 -!- Essobi_ [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
13:13 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-45.html#p15984>
13:14 -!- blocky [blocky@w107-225.wireless.uvic.ca] has joined #openvpn
13:20 -!- luneff [~yury@188.114.49.89] has quit [Quit: This computer has gone to sleep]
13:27 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
13:27 < Roelke> !tcp
13:27 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
13:27 -!- Roelke [~Roelke@hostserv.nl] has left #openvpn []
13:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
13:46 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:48 -!- markings [~freenode@opensusediscussion.bombshellz.net] has joined #openvpn
13:49 < markings> Hello
13:49 < markings> !welcome
13:49 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:50 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
13:50 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
13:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:50 -!- mode/#openvpn [+v Axeman] by ChanServ
13:52 < markings> My OpenVPN connection seems to be working flawlessly as I'm able to speak to you now... I'm frustrated at this point to understand why I can SSH to any other box except mine... The network I'm on has all blocked ports except for 52(UDP),443, and 80... Without VPN connection, I'm unable to access SSH
13:54 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Read error: Operation timed out]
13:55 -!- omry [~omry@DSL212-235-83-63.bb.netvision.net.il] has quit [Ping timeout: 255 seconds]
13:58 < markings> if I establish a SSH connection prior to initiating a VPN connection, I can there for review the status on the Server end.... There are no drop packets on that end.. In fact, I haven't authenticated with this network yet to establish Internet Connection.... It appears they allow UDP port 53 open even without Authentication.... I assume if I authenticate now, I'll be able to access port 443 there for 
13:59 < markings> able to access the server from that port. However, it makes no sense if all my traffic should be tunneled through the VPN... It appears, for this IP/Host, the traffic is being tunneled through the local network
14:01 -!- michl [~mich@dslb-084-056-082-214.pools.arcor-ip.net] has joined #openvpn
14:02 -!- johnfg [~johnfg@75-175-131-91.blng.qwest.net] has joined #openvpn
14:02 < johnfg> hi folks
14:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
14:03 < markings> This behavior only seems to happen in Linux, I can't replicate it in Windows
14:03 < johnfg> I know how to do this from my debian server, but how can I tell what the ip address of the tun0 is on the client machine?
14:03 < johnfg> It's running debian squeeze.
14:04 < hyper_ch> johnfg: ifconfig as root
14:04 < hyper_ch> or you could use ccd to assign a static ip to a client
14:04 < johnfg> hyper_ch, Super!
14:04 < hyper_ch> markings: what's your routing table?
14:04 < hyper_ch> !ccd
14:04 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
14:07 < johnfg> I can't figure out why I can't ssh into the client from the server.  The route/tunnel is setup, and port 22 is open, but I get a Timed out.
14:08 < markings> hyper_ch: Ahhh
14:08 < markings> hmm
14:08 < markings> strange
14:08 < markings> "204.27.56.139 via 192.168.160.1 dev wlan0  proto static 
14:08 < hyper_ch> markings: you run your own server?
14:08 < markings> That's the IP of my server and 192.* is the local network
14:08 < markings> hyper_ch: Yes
14:08 < hyper_ch> !def1
14:08 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:09 < markings> hyper_ch: Already set
14:09 < hyper_ch> on the server?
14:09 < markings> up
14:09 < markings> Yup
14:09 < hyper_ch> do you also push nameservers?
14:09 < markings> hyper_ch: Yes
14:09 < hyper_ch> and did you restart the server after adding def1?
14:10 < hyper_ch> !configs
14:10 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
14:10 < markings> hyper_ch: The OpenVPN was restarted multiple times
14:10 < markings> I have to Authenticate with the local network first, brb
14:13 -!- michl [~mich@dslb-084-056-082-214.pools.arcor-ip.net] has quit [Quit: Verlassend]
14:17 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
14:18 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
14:19 -!- johnfg [~johnfg@75-175-131-91.blng.qwest.net] has quit [Quit: Leaving]
14:20 < markings> hyper_ch: This is a pastebin of my Routing table prior and post OpenVPN connection. Also, I would like to note, that the OpenVPN server is listening on: 204.27.56.139. In fact, I think I figured out what's going on, it appears that OpenVPN is pushing that IP to go through my local network instead of the Tunnel... 
14:20 < markings> http://susepaste.org/52376057
14:20 < markings> One moment while I grab the Configuration
14:21 < markings> http://susepaste.org/19910290
14:21 < markings> Locally, My OpenVPN connection is managed by Network, there is no client.conf I can look up... Except posting the NetworkManager log, if that's useful
14:22 < markings> NetworkManager*
14:27 < hyper_ch> don't know
14:28 < ecrist> !ubuntu
14:28 <@vpnHelper> "ubuntu" is dont use network manager!
14:28 < markings> Well, I know where the problem lye, so some more investigation I would have to do
14:29 < markings> I'm not on Ubuntu if that was a reference to me ;)
14:34 < hyper_ch> ecrist: he uses suse
14:35 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
14:35 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
14:35 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:39 < ecrist> the point is, don't use network manager
14:40 < ecrist> !suse
14:40 < ecrist> !learn suse as You EITHER! (see !ubuntu)
14:40 <@vpnHelper> Joo got it.
14:40 < ecrist> ;)
14:40 < krzee> haha
14:40 < krzee> also:
14:40 < krzee> !netman
14:40 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
14:40 < markings> suse as you EITHER?
14:41 < krzee> if you me and jjk agree on something, it MUST be good advice
14:41 < ecrist> !suse
14:41 <@vpnHelper> "suse" is You EITHER! (see !ubuntu)
14:41 < ecrist> !ubuntu
14:41 <@vpnHelper> "ubuntu" is dont use network manager!
14:41 < ecrist> ;)
14:41 < markings> ;) I guess ;)
14:42 < hyper_ch> krzee: or it could be that the evil nature of you three takes over
14:43 < krzee> im starting to theorize that jjk is an office full of people... he is like a 1-man support team
14:43 < krzee> lol
14:45 < hyper_ch> the big mystery still remains who jjk is
14:45 < markings> anyway folks, thanks, later ;)
14:45 -!- markings [~freenode@opensusediscussion.bombshellz.net] has left #openvpn ["WeeChat 0.3.3"]
14:46 < krzee> hyper_ch, you dont know of him?
14:46 < hyper_ch> no
14:46 < krzee> !book
14:46 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
14:46 < hyper_ch> Jan? Ah
14:46 < krzee> he's also super active on the mail list, and the most active by far on the forums
14:47 < hyper_ch> can he make the universe implode?
14:47 < krzee> not sure, why?
14:47 < hyper_ch> just curious :)
14:48 < krzee> reiffert might be able to
14:48 < hyper_ch> never met anyone who can
14:50 < hyper_ch> krzee: you use firefox?
14:50 < krzee> not default, but i have it...
14:50 < krzee> why?
14:50 < hyper_ch> krzee: http://lifehacker.com/5542041/block-sites-from-using-your-facebook-login-with-adblock-plus
14:50 <@vpnHelper> Title: Block Sites from Using Your Facebook Login with Adblock Plus (at lifehacker.com)
14:50 < hyper_ch> krzee: http://albosure.blogspot.com/2010/04/evading-big-brother-online.html
14:50 <@vpnHelper> Title: Albo Wanderings: Evading big brother online (at albosure.blogspot.com)
14:50 < hyper_ch> so that your tinfoil hat grows a bit more
14:51 < krzee> lol
14:51 < krzee> just set facebook to use https *only*
14:51 < hyper_ch> I don't use facebook
14:51 < hyper_ch> and I don't want them to track me eitehr
14:53 -!- STF [~chatzilla@dslb-188-101-239-136.pools.arcor-ip.net] has joined #openvpn
14:54 < krzee> nice thanks
14:55 < krzee> i actually use different browsers for my different online activitites, but good to know
14:55 -!- STF [~chatzilla@dslb-188-101-239-136.pools.arcor-ip.net] has quit [Client Quit]
14:55 < hyper_ch> :)
14:55 < hyper_ch> always a pleasure to help making tinfoil hats stronger
14:56 < hyper_ch> btw, you're not wearing a tinfoil hat anymore ,right? you're ist more like tin-block hat
14:56 < krzee> complete tinfoil jumpsuit
14:57 < krzee> tinfoil hats were so 90s
14:57 < hyper_ch> krzee: http://abstrusegoose.com/396
14:57 <@vpnHelper> Title: Abstruse Goose » Public Disgrace (at abstrusegoose.com)
14:59 -!- blocky [blocky@w107-225.wireless.uvic.ca] has quit [Ping timeout: 248 seconds]
14:59 < krzee> lol
15:03 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
15:04 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
15:04 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:08 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-45.html#p15985>
15:12 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
15:12 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
15:12 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:14 < cheako> How is openvpn at reeving duplicate UDP packets?  Would it double the packet inside the UDP also?
15:15 < cheako> receiving
15:15 < cheako> I guess any action would be fine.
15:18 -!- blocky [blocky@w107-225.wireless.uvic.ca] has joined #openvpn
15:23 -!- blocky [blocky@w107-225.wireless.uvic.ca] has quit [Ping timeout: 258 seconds]
15:24 < Olipro> cheako: if you're using AES-CBC the duplicate packet wouldn't conform where the IV was
15:24 < Olipro> *conform to
15:24 < Olipro> or any other cipher in a similar mode for that matter
15:27 < cheako> k.
15:28 < cheako> yeah I just remembered that I disabled cipher and auth for this as it's already wrapped in ssl.  Though still a duplicate packet shouldn't normally harm things.
15:28 < cheako> and if I'm doing this correctly the duplicate will be sent 3 seconds after the original.
15:28 < cheako> 3 or more.
15:30 -!- Essobi_ [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Quit: leaving]
15:30 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
15:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
15:38 -!- p3rror [~mezgani@41.140.44.187] has joined #openvpn
15:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:40 -!- corretico [~luis@200.12.40.18] has quit [Read error: Connection reset by peer]
15:43 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
15:43 < krzee> if its already wrapped in ssl and you dont care about openvpn enc, why use openvpn?
15:43 < krzee> GRE tunnels would work
15:46 -!- p3rror [~mezgani@41.140.44.187] has quit [Ping timeout: 248 seconds]
15:47 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
15:50 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:52 -!- blocky [blocky@w123-247.wireless.uvic.ca] has joined #openvpn
15:54 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:04 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
16:07 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
16:08 <@vpnHelper> RSS Update - forum: adaptive compression including time to (de)compress data <http://forums.openvpn.net/topic8883.html>
16:10 -!- p3rror [~mezgani@41.140.38.18] has joined #openvpn
16:14 -!- blocky [blocky@w123-247.wireless.uvic.ca] has quit []
16:16 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:16 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
16:17 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
16:18 -!- LuckyY_ is now known as LuckyY
16:20 <@vpnHelper> RSS Update - forum: OpenVPN tunnel problem on OBSD 4.9 <http://forums.openvpn.net/topic8875.html#p15987>
16:28 < Smak> I am a little confused as what happens to the interface that I bridge br0 with. Does anything change with it?
16:31 < reiffert> br0 *is* the bridge.
16:31 < reiffert> you can add interface to the bridge.
16:32 < reiffert> e.g. eth0 and tap0
16:32 < reiffert> the interface dont carry an ip address anymore. the bridge does.
16:32 < reiffert> s,interface,interfaces,
16:38 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
16:43 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
16:57 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
17:02 <@vpnHelper> RSS Update - forum: Authentication failure in Daemon mode <http://forums.openvpn.net/topic8884.html>
17:06 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:18 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Ping timeout: 244 seconds]
17:41 < Smak> When I look at ifconfig I don't see that eth0 has an IP anymore. I think that is the source of my confusion
17:45 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:09 -!- cheako [~cheako@72.21.248.10] has quit [Ping timeout: 245 seconds]
18:39 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:39 -!- mode/#openvpn [+v Axeman] by ChanServ
19:00 -!- j03 [83fbfc39@gateway/web/freenode/ip.131.251.252.57] has joined #openvpn
19:00 -!- j03 [83fbfc39@gateway/web/freenode/ip.131.251.252.57] has quit [Client Quit]
19:01 -!- j03 [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has joined #openvpn
19:02 < j03> Hi. If my OpenVPN server's TUN adapter has an IP of 10.8.0.1 and my Clients VPN IP is 10.8.0.6, and the subnet mask is 255.255.255.0
19:03 < j03> then they should be able to ping eachother, yes?
19:03 < krzee> as in client should be able to ping .1 and server ping .6?
19:03 < krzee> if so, yes
19:03 < krzee> assuming firewalls allow and everything went right
19:04 < j03> Hmm... given that the client machine has connected to the server, I assume you're refering to the Servers firewall?
19:04 < krzee> nope, im talking about both
19:04 < krzee> if they dont allow on tun, then the ping couldnt work
19:05 < j03> Right - so even though the client has connected to the VPN, the clients firewall could still be blocking it?
19:05 < krzee> certainly
19:05 < krzee> remember, whats inside the tunnel and the tunnel itself are different to each side
19:05 < j03> hmm
19:05 < krzee> the tunnel itself is eth0 or whatever
19:06 < krzee> then the traffic inside the tunnel goes on tun0 or whatever
19:06 < j03> well the client is behind a firewall which is fairly restrictive
19:06 < krzee> doesnt matter
19:06 < j03> I've SSH'ed into the server, and created a dynamic SOCKS5 proxy. I configured the OpenVPN client to use the SOCKS5 proxy
19:06 < krzee> when i talk of the firewall, i mean on the machine itself
19:07 < j03> Oh, I see
19:07 < krzee> the firewall you spoke of only sees the outside of the tunnel
19:07 < krzee> not the traffic inside
19:07 < krzee> !logs
19:07 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
19:07 < j03> yeah
19:08 < krzee> do that, then after they connect ping from each side to the other, then post them
19:08 < krzee> (verb 5)
19:09 < j03> How can I make the openvpn gui client use verbose logging?
19:09 < j03> same with the server... sorry about my inexperience
19:09 < krzee> in the config:
19:09 < krzee> verb 5
19:10 < j03> ok cheers
19:10 < krzee> np
19:10 < krzee> oh and if you dunno where to get the log:
19:10 < krzee> !logfile
19:10 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
19:10 < j03> Actually, I might have spotted the problem - i will check and report back
19:10 < j03> (my netmask is set to 255.255.255.252)
19:11 < krzee> no, thats normal
19:11 < krzee> !/30
19:11 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
19:11 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
19:11 < krzee> thats why your first client is .6 =]
19:12 < j03> OK i will get the logs now :)
19:12 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 244 seconds]
19:16 < j03> krzee: sorry about the wait
19:16 < j03> krzee: http://pastebin.com/9ixhqsE7 is the client
19:17 < krzee> no problem, im stuck at work about 2 more hours
19:18 < krzee> ok which windows you using?
19:18 < j03> Windows 7. I launched the client in administrator mode (something about routes not working otherwise)
19:19 < krzee> well routes arent working now either
19:19 < j03> damn
19:19 < krzee> !winroute
19:19 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file or (#2) many users also report it helps to add route-delay to give the interface extra time to get up or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access or (#4) make sure you are running openvpn as admin or (#5) http://openvpn.net/index.php/open-
19:19 <@vpnHelper> source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
19:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
19:19 < krzee> try #1 and #2
19:19 < krzee> route-method exe
19:19 < krzee> route-delay
19:19 < krzee> in that windows config
19:20 < j03> OK! I'll try
19:20 < krzee> then try again, pastebin your log
19:20 < j03> do I need to specify a time after route-delay? 
19:20 < j03> or just... route-delay
19:20 < krzee> no
19:20 < krzee> default is good
19:20 < krzee> nice, sounds like you looked at the man page when i gave those options!
19:20 < krzee> j03++
19:21 < krzee> (does that make you j04?)
19:22 -!- j03_ [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has joined #openvpn
19:22 < j03_> woah
19:22 < j03_> network went down!
19:22 < krzee> got the logs?
19:22 < j03_> where was I... oh yes. I suppose it does make me j04!
19:22 < j03_> I'll get them now
19:24 -!- j03 [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has quit [Ping timeout: 252 seconds]
19:24 -!- j03_ is now known as j03
19:24 < j03> something isn't working anymore...
19:25 < j03> it's not connecting now... hang on, it could be my proxy
19:26 < krzee> make sure you arent overriding your route to your proxy
19:26 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
19:26 < krzee> if you are, use this:
19:26 < krzee> !route_override
19:26 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
19:26 -!- j03 [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has quit [Client Quit]
19:27 -!- j03 [83fbfc39@gateway/web/freenode/ip.131.251.252.57] has joined #openvpn
19:27 < j03> urch. back again
19:28 < krzee> [17:26]  <krzee> make sure you arent overriding your route to your proxy
19:28 < krzee> [17:26]  <krzee> if you are, use this:
19:28 < krzee> !route_override
19:28 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
19:28 < krzee> also,you may get bad performance, especially when tunneling TCP
19:28 < krzee> !tcp
19:28 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
19:29 < krzee> your setup must use tcp because it goes over ssh tunnel...
19:29 < krzee> which means the ssh tunnel is tcp, the vpn is tcp, and then you may be tunneling tcp inside it
19:29 < krzee> that link is on TCP over TCP, you have TCP over TCP over TCP
19:30 < j03> this is going to give me some nasty latency, isn't it :(
19:30 < krzee> well it can
19:30 < krzee> depends on your network
19:30 < krzee> if you dont get retransmits you may be fine
19:30 < krzee> but i would expect meltdowns
19:30 < krzee> the doc above explains why
19:31 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
19:31 < j03> my network is fast, but the port my machine is connected to is pretty slow. 
19:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:31 < krzee> its not really about speed
19:31 < krzee> its about retransmitions
19:31 < j03> I am going to worry about that afterwards - I will try and sort out this proxy business now though
19:31 < krzee> speed can be a factor too, but what really triggers the meltdown is retransmitions
19:31 < j03> This is my error: http://pastebin.com/Ss0y7mv0
19:32 < krzee> and is the ssh session still active,,,?
19:32 < j03> yeah
19:32 < krzee> did you bypass the default route for the proxy as i said above?
19:33 < krzee> please dont just paste what you think is relevant
19:33 < krzee> without context it wont mean much
19:33 < j03> in that thread, he says to use: route 155.98.10.0 255.255.252.0 net_gateway. which IP to I use in place of 155.98.10.0?
19:33 < krzee> i know you were trying to help by not posting 100+ lines, but with logs it helps to have more
19:33 < j03> my local network IP?
19:34 < j03> OK. I'll give you the whole kaboodle next time
19:34 < krzee> 155.98.10.0 255.255.252.0 is the network he needed to bypass the vpn for
19:34 < krzee> you need to bypass it for at least the proxy
19:34 < krzee> possibly that ip with 255.255.255.255 depending on your needs
19:34 < j03> OK. I'll try that. 
19:35 < j03> but the proxy server is technically my local machine... it's the IP of the SSH Server that I should use, yes?
19:37 < krzee> right
19:37 < krzee> technically it is *not* your local machine
19:37 < krzee> you just use loopback device to get there ;]
19:37 < j03> OK :)
19:37 < j03> http://pastebin.com/mhcEj3Cd
19:38 < j03> That's after I added the route xxx.xxx.xxx.xxx 255.255.255.255 net_gateway line
19:38 < j03> so no change
19:39 < krzee> your ssh tunnel is rejecting or unable to connect
19:39 < krzee> got server log?
19:41 -!- j03_ [83fbfc39@gateway/web/freenode/ip.131.251.252.57] has joined #openvpn
19:41 < j03_> OK. I'm back (again). 
19:41 < krzee> [17:39]  <krzee> your ssh tunnel is rejecting or unable to connect
19:41 < krzee> [17:39]  <krzee> got server log?
19:42 < j03_> It's partially working now! The reason I got disconnected is because my client connected
19:42 < krzee> oh ya you're on a different IP
19:42 < j03_> I tried pinging 10.8.0.1 and it worked (11ms latency, too)
19:42 < krzee> [17:22]  * j03_ (2e69fb42@gateway/web/freenode/ip.46.105.251.66) has joined #openvpn
19:42 < krzee> [17:41]  * j03_ (83fbfc39@gateway/web/freenode/ip.131.251.252.57) has joined #openvpn
19:42 < krzee> WOW only 11ms latency is *gooooood*
19:42 -!- j03 [83fbfc39@gateway/web/freenode/ip.131.251.252.57] has quit [Ping timeout: 252 seconds]
19:43 -!- parabyte [~parabyte@88.96.255.123] has joined #openvpn
19:43 < j03_> the first one is my remote server IP, the one i'm on now is my university's IP
19:43 -!- j03_ is now known as j03
19:43 < parabyte> hello guys, i just wondered if i could have some help with zeroshell openvpn
19:43 < krzee> sounds like you're done!
19:43 < parabyte> its refusing to let my client connect
19:43 < parabyte> android client
19:43 < j03> krzee: Hopefully! I just need to get internet forwarding to work now... so I might be back shortly ;)
19:43 < parabyte> using openvpn settings
19:43 < j03> krzee: Thanks very much for the help!
19:43 < parabyte> better then built in client
19:44 < parabyte> here is error from openvpn error logs
19:44 < parabyte> i know im missing something really obvious
19:44 < parabyte>  	192.168.2.203:43292 [parabyte@EXAMPLE.COM] Kerberos 5 authentication failed: host/zeroshell.example.com@EXAMPLE.COM: Server not found in Kerberos database while getting credential
19:44 < krzee> j03, you're welcome =]
19:44 < EugeneKay> !pb
19:44 < EugeneKay> !paste
19:44 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
19:44 < parabyte> trying to get it to connect internally
19:44 < krzee> parabyte, what is zeroshell vpn?
19:44 < parabyte> krzee, oh some linux distro for routers
19:44 < parabyte> has openvpn built in
19:44 < krzee> oh ok
19:45 < krzee> sounds like your error is pretty clear
19:45 < parabyte> well annoying just cant seem to figure it out
19:45 < krzee> you are trying to auth with passwords, right?
19:45 < parabyte> yes
19:45 < krzee> seems you have an issue with that part
19:45 < krzee> in fact a non-openvpn issue
19:46 < parabyte> kerberos issue
19:46 < parabyte> driving me insane though google been to no help really
19:46 < krzee> ya i wont be much more help
19:46 < krzee> which i do know android + openvpn
19:46 < krzee> while i do*
19:46 < parabyte> android vpn client is lame!
19:46 < parabyte> built in client
19:46 < krzee> thing is, i dont use password auth
19:47 < krzee> you mean cyanogenmod's?
19:47 < krzee> android doesnt have it built in...
19:47 < parabyte> i dont mean to offend
19:47 < parabyte> yes cynogenmod 
19:47 < krzee> ya cant offend us with that... i kinda agree
19:47 < krzee> and they could make it rock with 1 small change
19:47 < krzee> "import config from file"
19:47 < parabyte> yes
19:47 < parabyte> opvn file
19:47 < krzee> i dont even use openvpn-settings anymore
19:47 < krzee> i set it up commandline
19:48 < krzee> so much less hassle for me
19:48 -!- j03 [83fbfc39@gateway/web/freenode/ip.131.251.252.57] has quit [Ping timeout: 252 seconds]
19:48 < parabyte> krzee, suppose i could but for now i just wanna get this issue sorted openvpn-settings seems to be working
19:48 < parabyte> from error log
19:48 < krzee> ya i have used openvpn-settings as well, it does work
19:48 < krzee> thing is, i dont use password auth, nor do i use kerberos
19:48 < krzee> so i cant help you with that stuff
19:49 < krzee> i can help with openvpn stuff tho ;]
19:49 < parabyte> krzee, im a total noob with these technologies with kerberos is it normally setup as username@domain.com?
19:49 < krzee> i dont know
19:49 < parabyte> me neither
19:49 < parabyte> lol
19:49 < krzee> as i said, i dont use it... i just know openvpn
19:49 < parabyte> krzee, im thinking maybe figuring out non password auth
19:49 < krzee> much easier
19:49 < krzee> !pki
19:49 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
19:50 <@vpnHelper> specially as a server (see !servercert)
19:50 < parabyte> i cant work out yet how to export key from the zeroshell router software yet
19:50 -!- _julian [~quassel@hmbg-4d06e0cc.pool.mediaWays.net] has joined #openvpn
19:50 < krzee> you dont need to
19:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:50 -!- mode/#openvpn [+v Axeman] by ChanServ
19:50 < krzee> you need to *import* keys to it
19:50 -!- j03 [83fbfc39@gateway/web/freenode/ip.131.251.252.57] has joined #openvpn
19:50 < parabyte> ah like ssh
19:50 < krzee> because your CA does not (and ideally should not) be on your server
19:50 < krzee> CA just signs keys
19:51 < parabyte> i need to generate the key on the phone and then export it to the server
19:51 < krzee> the server doesnt need to know about new clients
19:51 < parabyte> krzee, im getting it
19:51 < krzee> if they were signed by the ca.crt the server uses, they will work
19:51 < parabyte> krzee, sorry i misunderstood the concepts
19:51 < krzee> ideally, you generate the certs on a 3rd machine
19:51 < krzee> which in super secure land has no connection to any network nor the internt
19:51 < krzee> internet*
19:52 < krzee> then you copy the certs over
19:52 < krzee> your ca.key is the cornerstone of your certificate security
19:52 < j03> OK... I'm back to a world of errors! I'm trying to route the all internet traffic of my client machines through the openvpn server. When I connect, and try and access a site through it's domain name, I get a DNS server error. If I try and view the a website using an IP address, I just get served the web folder of my open vpn server
19:52 < parabyte> krzee, im going to do some reading,!
19:52 < krzee> if a cert is compromised, you just blacklist it... if the ca.key is compromised, your entire pki is bad and needs to be rebuilt
19:52 < parabyte> krzee, i need to get to grips with all the concepts
19:53 < j03> so viewing http://74.125.224.72/ shows me http://46.105.251.66/
19:53 <@vpnHelper> Title: Google (at 74.125.224.72)
19:53 < krzee> j03, try using nameserver 4.2.2.1
19:53 < j03> viewing http://google.com/ gives me a DNS error
19:53 <@vpnHelper> Title: Google (at google.com)
19:53 -!- _julian_ [~quassel@hmbg-4d06a2e4.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
19:53 < parabyte> krzee, thanks for the advice made me see alot of light on the subject
19:53 < krzee> or 8.8.8.8
19:53 < parabyte> krzee, thank you
19:53 < krzee> parabyte, no problem =]
19:53 < j03> krzee: I've got: push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" 
19:54 < j03> in my serve config file
19:54 < krzee> oh in that case
19:54 < krzee> !pushdns
19:54 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
19:54 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
19:54 < krzee> #5
19:54 < j03> (on separate lines)
19:54 < krzee> register-dns
19:54 < krzee> on windows client config
19:54 -!- parabyte [~parabyte@88.96.255.123] has quit [Quit: Leaving]
19:54 < j03> ohhh! I'll give it a whirl.
19:55 < j03> Before I do... would that explain why google's IP was serving the same content as my VPN machines web server?
19:55 < krzee> no idea, just try it
19:55 < j03> OK
19:55 < j03> I'll probably be disconnected now, but i'll BRB. 
19:57 -!- parabyte [~parabyte@88.96.255.123] has joined #openvpn
19:57 < parabyte> i come back quickly!
19:57 < parabyte> any good sites on how openvpn works?
19:57 < parabyte> instead of how to set it up
19:57 < j03> krzee: It's giving me the same issue
19:58 < krzee> parabyte, you dont want to know how openvpn works
19:58 < krzee> you want to know how PKI works
19:59 < parabyte> okay!
19:59 < parabyte> ill google just PKI to understand how it works
20:00 < krzee> heres the basic rundown
20:00 < krzee> !pki
20:00 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
20:00 <@vpnHelper> specially as a server (see !servercert)
20:00 < parabyte> At the moment feels like iv fallen down the rabbit hole
20:00 < krzee> #2
20:00 < krzee> google for more info =]
20:00 < parabyte> krzee, thank you 
20:00 < parabyte> ill stay dorment rather then abruptly go!
20:00 < krzee> ya you did
20:00 < parabyte> thanks
20:00 < krzee> but you'll like learning this stuff
20:00 < krzee> its how your http:// works too
20:00 < krzee> err
20:00 < krzee> https://
20:01 < parabyte> i know networking concepts and tcp/ip 
20:01 < parabyte> just been away from computers for 10 years
20:01 < krzee> except this way is more secure since you run your own CA
20:01 < parabyte> long storey
20:01 < parabyte> I used to work for a isp
20:01 < krzee> welcome back from prison!
20:01 < parabyte> LOL
20:01 < parabyte> had a nervous breakdown!
20:02 < krzee> ahh prison was rough on you? :-p
20:02 < parabyte> hehe lol
20:02 < parabyte> i think id go insane if i had to spend even a hour in a prison
20:03 < parabyte> krzee, im getting into books. thanks for pointers
20:03 < krzee> then dont go back!
20:03 < krzee> :-p
20:03 < krzee> np
20:06 < j03> krzee: any idea's about my problem? :(
20:07 < krzee> no, something goofy on your server
20:07 < j03> hmm
20:07 < krzee> is there a captive portal there or something?
20:07 < j03> nope! It's a fairly fresh install of debian 6
20:08 < j03> in an openvz container, mind you
20:08 < j03> i will try rebooting it ;)
20:08 < krzee> oh are you NAT'ing on your server?
20:09 < j03> well i can't use masquerade since openvz doesn't support it 
20:09 < j03> i'm using "postrouting" instead. 
20:09 < krzee> !openvznat
20:09 <@vpnHelper> "openvznat" is a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP>
20:09 < krzee> ;]
20:10 < j03> Yeah, i've run that command
20:10 < krzee> then i dont know, maybe look at some tcpdumps
20:10 < j03> i've tried it again - i'll be back in a minute
20:13 < j03> yay! the reboot and cross your fingers method worked a treat
20:14 < j03> I'm now sorted
20:14 < j03> many thanks!
20:14 < krzee> you're welcome =]
20:23 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
20:28 < Cr4zi3> http://web.mit.edu/adorai/www/seuss-technical-writing.html
20:28 <@vpnHelper> Title: What if Dr Seuss Did Technical Writing? (at web.mit.edu)
20:33 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:33 -!- mode/#openvpn [+v Axeman] by ChanServ
20:52 < bandroidx> i am setting openvpn server config to veryify crl but since none is made yet its erroring out, any way to avoid that?  touching a file with the name doesnt wor
20:52 < bandroidx> maybe some generic template i can put there?
20:55 < krzee> ssl-admin makes one for that
20:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 245 seconds]
20:56 < krzee> not sure of how or anything, but im sure if you look in the code (or use it) you'll find it
20:56 < krzee> !ssl-admin
20:56 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
21:04 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
21:04 -!- moonrock [~chris@dallas.tunnelr.com] has joined #openvpn
21:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:09 < moonrock> Why when I run openvpn (client) from the linux command line does it continually spew RwrWRwrWRwr in the terminal? 
21:09 < EugeneKay> Because you have verb set to 5
21:10 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:11 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:11 < moonrock> Thanks. I knew it had to be something silly.
21:11 < EugeneKay> 3 is sufficient for running it normally. You only need to turn it up when debugging
21:13 < moonrock> Thanks. I just switched it. Now the terminal is nice and quiet.
21:13 -!- j03 [83fbfc39@gateway/web/freenode/ip.131.251.252.57] has quit [Ping timeout: 252 seconds]
21:14 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:14 -!- moonrock [~chris@dallas.tunnelr.com] has left #openvpn ["Leaving."]
21:23 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has joined #openvpn
21:24 -!- johnfg [johnfg@spirit.org] has joined #openvpn
21:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
21:24 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:29 < johnfg> hi guys
21:29 < johnfg> I've had openvpn working between debian lenny as server, and windows xp machines for a while.
21:30 < johnfg> I've got debian squeeze newly installed on a laptop, installed and configured the openvpn client.
21:31 < johnfg> I get the tun0 set up, with an ip of 10.8.0.6 on the client, but can't seem to do anything with it.
21:31 < bandroidx> thx i got it
21:31 < bandroidx> Need IPv6 code in mroute_extract_addr_from_packet\
21:31 < bandroidx> i am getting that a shit load tho
21:32 < bandroidx> google says "when IPv6 is bound to the tap-win32 adapter or whenever any form of IPv6 traffic is sent over the tunnel."
21:32 -!- parabyte [~parabyte@88.96.255.123] has quit [Quit: Leaving]
21:32 < bandroidx> so i assume that is on the client side?
21:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:40 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:43 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
21:43 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
21:47 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
21:48 < johnfg> Here's the output of tcpdump -i tun0 when I try to ssh into 10.8.0.6: http://paste.debian.net/132735/
21:48 -!- Ionic [ionic@ionic.de] has joined #openvpn
21:51 < johnfg> I'm stumped, as I didn't have to do anything else to my server.conf files on debian lenny for the windows implementation of openvpn.
21:51 < ecrist> johnfg: what do you mean you're not able to 'do anything with it'
21:54 < johnfg> ecrist, Well, openvpn is running on the server, with tun0 up, and on the client, with the address of 10.8.0.6, but I can't ping the client, vnc to it, etc., etc.
21:55 < ecrist> from where?
21:55 < ecrist> another client?
21:55 < johnfg> Can't ssh johnfg@10.8.0.6 from the server.
21:55 < ecrist> have you looked at the firewall?
21:55 < ecrist> is the client SSH daemon listening on 10.8.0.6?
21:56 < johnfg> Yeah, I'm running arno on both lenny & squeeze and all looks ok.
21:56 < johnfg> ecrist, Is that what I see through nmap?
21:56 < ecrist> do you have a firewall on that machine?
21:56 < johnfg> If so, yes, it's listening on it.
21:57 < ecrist> oh, you won't be able to connect to the client from the server, usually
21:57 < johnfg> ecrist, arno-iptables-firewall is what I use.
21:57 < ecrist> I don't know what that is
21:57 < ecrist> but, it might be the problem.
21:58 < johnfg> ecrist, I could from lenny to windows xp.
21:58 < ecrist> the firewall is usually the problem.
21:58 < ecrist> johnfg: you're going to a different client now, which tells me there's something on that client blocking it
22:00 < johnfg> Unfortunately, I'll have to wait until tomorrow when I get into that office.  I can ssh to the server at it's ip.
22:01 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:01 < johnfg> its ip.
22:01 < ecrist> don't know what being able to ssh into the other IP has to do with it
22:01 < johnfg> nothing.
22:01 < johnfg> sorry.
22:01 < ecrist> right. ;)
22:01 < johnfg> Just meant, I can change things from the squeeze client on the server, but at this point *not* the other way around.
22:02 < johnfg> Does that make sense?
22:02 < ecrist> nope
22:04 < johnfg> I'll check out the firewall again tomorrow, make sure it's configured correctly and see if I can correct any problems.
22:09 -!- johnfg [johnfg@spirit.org] has quit [Quit: Leaving]
22:19 -!- Titania [~titania@221.120.122.106] has joined #openvpn
22:33 -!- Titania [~titania@221.120.122.106] has quit [Quit: Will return someday...]
22:41 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
22:52 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:54 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
23:00 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has quit [Read error: Connection reset by peer]
23:06 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
23:23 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
23:28 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has quit [Ping timeout: 258 seconds]
23:35 < EugeneKay> Nifty. 2.2.1 hit the EPEL repos for 6.x
23:38 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
--- Day changed Wed Sep 28 2011
00:22 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has quit [Quit: Leaving.]
00:26 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
00:35 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
00:41 -!- dazo_afk is now known as dazo
00:43 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
00:45 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
00:51 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:09 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
01:18 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
01:19 -!- luneff [~yury@84.51.192.74] has joined #openvpn
01:22 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:45 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
01:46 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
01:48 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has quit [Read error: Connection reset by peer]
01:48 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
01:56 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
02:11 <@vpnHelper> RSS Update - forum: openvpn error! <http://forums.openvpn.net/topic8885.html>
02:26 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:34 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has quit [Read error: Connection reset by peer]
02:34 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
02:35 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
02:41 < Mowee> Morning
02:41 < EugeneKay> Technically, yes.
02:47 <@vpnHelper> RSS Update - forum: Issues with initial bridge setup <http://forums.openvpn.net/topic8738-45.html#p15990>
02:51 < Smak> I just thought of something. Now that I have bridging working I might not want to have vpn clients from using my networked printer :P Anyone know how I can distinguish from vpn and local clients with iptables?
02:53 < Bushmills> why would you need bridging for printing to a network printer?
02:53 <@vpnHelper> RSS Update - forum: Authentication failure in Daemon mode <http://forums.openvpn.net/topic8884.html#p15991>
02:53 < Bushmills> !serverlan
02:53 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation
02:54 < Bushmills> ah... "not want" ... sry.   firewall
02:55 < Bushmills> or configure permissions of your print server accordingly
02:56 < Smak> maybe I wasn't clear. I DON'T want vpn clients to be able to use my networked printer. Something along the lines iptables -A INPUT -i br0 -s serverIP -j DROP   
02:59 < EugeneKay> How do you secure bridging? By not using bridging.
02:59 < Smak> problem is since I bridged eth1 to br0 I can't just disteguish. like iptables -A INPUT -i eth1 -s printerIP -j DROP
02:59 < Smak> distinguish 
03:00 -!- albech [~albech@61.7.177.90] has joined #openvpn
03:04 < Smak> I am guessing that I should just only keep 10 sheets of paper in the printer :P
03:05 < EugeneKay> No, you should not use Bridging.
03:05 < Smak> From what I am readying since vpn is suppose to be a "trusted" connection I would have to add another nic interface and move the printer over to it.
03:05 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
03:06 < EugeneKay> You ought to be able to route printer traffic cross-network, and even over VPN links. My printer is setup like this.
03:06 < Smak>  I am using the vpn so my mates and I can play games over "lan"
03:07 < EugeneKay> Play games made after 1999 :-p
03:07 < Smak> I am not trying to give vpn clients access to the printer, I am trying to deny vpn clients access to the networked printer.
03:07 < Smak> I'm old, I enjoy my old games.....
03:07 < Smak> :)
03:07 < EugeneKay> You really can't, with a bridge. It's as if they are on your switch.
03:08 < Smak> yea, another nic is only $15 bucks.  then I can easily deny.
03:09 < Smak> err or can I.  I think I might be confusing myself.
03:09 < EugeneKay> IIRC, you ought to be able to run Ye Olde Games over a TAP device, but running in regular routed mode
03:09 < EugeneKay> Just tell the game to use that "nic"
03:10 < Smak> Ah wait. I know how I can deny vpn clients access to my printer :)
03:11 < Smak> Since I am assigning vpn ips 192.168.0.127/8  I know just deny that block to my printer ip!
03:11 < Smak> W00t I believe this will work
03:11 < EugeneKay> 192.168.0.127..../8?
03:11 < EugeneKay> or 127-128?
03:12 < Smak> the block is 192.168.0.127/25
03:12 < Smak> So 0.127 - 0.255
03:13 < EugeneKay> Ah.
03:18 < Bushmills> !tunortap
03:18 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
03:18 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
03:20 < Bushmills> x.x.0.127/x is not a valid network address
03:20 < Bushmills> x.x.0.128/25 would be valid
03:21 < Smak> your not very kind against type-o's are ya
03:21 < Bushmills> x.x.0.n/8 AND x.x.0.127/x in conjunction is not very likely a typo
03:22 < Bushmills> unless "typo" was a typo :D
03:23 < Smak> well they were. Huh here is my rule: iptables -A INPUT -s 192.168.0.128/25 -d 192.168.0.10 -j DROP
03:23 < Smak> see no type-os
03:25 < Smak> Actually I will probably change it to 192.168.0.224/32 because most older games don't support more than 32 clients.
03:26 < Smak> waiting  waiting  ... :P
03:26 < Smak> I thought it was funny....
03:27 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
03:27 < Smak> 192.168.0.224/27   just so u see the joke.
03:28 < Bushmills> no, we'Re now used to your typos
03:50 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has quit [Read error: Connection reset by peer]
03:52 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
04:07 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:07 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:11 <@vpnHelper> RSS Update - forum: Authentication failure in Daemon mode <http://forums.openvpn.net/topic8884.html#p15992>
04:14 -!- dazo is now known as dazo_afk
04:22 -!- cpm [~Chip@border0.avitecture.net] has joined #openvpn
04:22 -!- cpm [~Chip@border0.avitecture.net] has quit [Changing host]
04:22 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:24 -!- tjz [~pc@bb219-75-113-137.singnet.com.sg] has joined #openvpn
04:25 -!- tjz [~pc@bb219-75-113-137.singnet.com.sg] has quit [Changing host]
04:25 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:25 -!- Smak1 [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
04:26 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has quit [Ping timeout: 258 seconds]
04:29 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
04:29 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
04:29 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:45 -!- Smak1 is now known as Smak
04:54 -!- spiekey [~mario@projekte.imos.net] has joined #openvpn
04:54 < spiekey> Hello!
04:55 < spiekey> how can i get rid of that "tun0: Disabled Privacy Extensions" notice?
04:57 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
04:58 -!- albech [~albech@61.7.177.90] has quit [Remote host closed the connection]
04:59 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
05:16 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
05:39 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:43 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
05:51 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
05:54 -!- Ionic [ionic@ionic.de] has joined #openvpn
06:03 -!- luneff [~yury@31.23.34.233] has joined #openvpn
06:13 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:13 -!- mode/#openvpn [+v Axeman2] by ChanServ
06:20 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has quit [Read error: Connection reset by peer]
06:21 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has joined #openvpn
06:30 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
06:57 <@vpnHelper> RSS Update - forum: Authentication failure in Daemon mode <http://forums.openvpn.net/topic8884.html#p15993>
06:59 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:00 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
07:02 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:04 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
07:04 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:05 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
07:05 -!- Smak [~adam@c-98-226-137-241.hsd1.in.comcast.net] has left #openvpn []
07:06 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
07:10 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Quit: Bye.]
07:11 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
07:13 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
07:14 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
07:14 -!- mode/#openvpn [+o raidz] by ChanServ
07:16 -!- albech [~albech@61.7.177.90] has joined #openvpn
07:28 <@vpnHelper> RSS Update - forum: Authentication failure in Daemon mode <http://forums.openvpn.net/topic8884.html#p15994>
07:31 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
07:56 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
07:59 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:59 -!- mode/#openvpn [+v Axeman2] by ChanServ
08:03 < p3rror> hello
08:03 < p3rror> please i set a connection to an openvpn server and i get this warning
08:03 < p3rror> NOTE: unable to redirect default gateway -- Cannot read current default gateway from system
08:04 < p3rror> even i need to route my box traffic to internet through this openvpn server
08:16 -!- monotonia [531db8e2@gateway/web/freenode/ip.83.29.184.226] has joined #openvpn
08:17 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has joined #openvpn
08:18 < monotonia> Hello. I used Zentyal automaticaly made packet for Windows. I am connected, the icon in the tray is green. But where is the server? I can't see it in my nethood...
08:31 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 248 seconds]
08:32 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
08:32 <@vpnHelper> RSS Update - forum: OpenVPN as Gateway <http://forums.openvpn.net/topic8886.html>
08:46 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has quit [Ping timeout: 255 seconds]
08:50 <@vpnHelper> RSS Update - forum: Authentication failure in Daemon mode <http://forums.openvpn.net/topic8884.html#p15996>
08:56 <@vpnHelper> RSS Update - forum: OpenVPN as Gateway <http://forums.openvpn.net/topic8886.html#p15997>
08:58 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
09:02 <@vpnHelper> RSS Update - forum: OpenVPN as Gateway <http://forums.openvpn.net/topic8886.html#p15999> || Nasty locale-related bug in registration webapp fixed <http://forums.openvpn.net/topic8887.html>
09:05 -!- master_of_master [~master_of@p57B5452F.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
09:07 -!- master_of_master [~master_of@p57B5369F.dip.t-dialin.net] has joined #openvpn
09:08 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
09:08 <@vpnHelper> RSS Update - forum: OpenVPN as Gateway <http://forums.openvpn.net/topic8886.html#p16000>
09:20 <@vpnHelper> RSS Update - forum: OpenVPN as Gateway <http://forums.openvpn.net/topic8886.html#p16001>
09:23 -!- monotonia [531db8e2@gateway/web/freenode/ip.83.29.184.226] has quit [Quit: Page closed]
09:25 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 248 seconds]
09:25 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
09:26 < jdpond> Essobi: someone outed you on having done some FIPS compliant work.  How did it go?
09:30 <@vpnHelper> RSS Update - forum: OpenVPN as Gateway <http://forums.openvpn.net/topic8886.html#p16002>
09:33 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Quit: Leaving]
09:34 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:35 < p3rror> hello
09:35 < p3rror> please i set a connection to an openvpn server and i get this warning
09:35 < p3rror> even i need to route my box traffic to internet through this openvpn server
09:36 < p3rror> NOTE: unable to redirect default gateway -- Cannot read current default gateway from system
09:36 <@vpnHelper> RSS Update - forum: OpenVPN as Gateway <http://forums.openvpn.net/topic8886.html#p16003>
09:36 < Bushmills> p3rror: either have a default gateway on client before connecting to openvpn server, or try ...
09:36 < Bushmills> !def1
09:36 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:39 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:44 -!- ccesario [~ccesario@187.17.166.162] has joined #openvpn
09:45 < ccesario> hello.... Somebody know why when I usage the openvpn-auth-ldap the "Common Name" in status log show UNDEF ?
09:46 -!- itai [~itai@218.82.161.242] has joined #openvpn
09:48 < itai> Hi there, I'm trying to automate an openvpn client to connect to a server by suing a script. My problem is that  i cant get the authentication properly. My idea was to add a credentials file in which the script will look for the username/password but for some reason it never authenticates in that way. Can anyone point me out in the right direction. What format should the credentials file be in ? which dir ? permissions? (running linux)
09:57 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:01 < Bushmills> !pki
10:01 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
10:01 <@vpnHelper> signed specially as a server (see !servercert)
10:03 < itai> Bushmills, is that for me?
10:03 < Bushmills> or read man page about --auth-user-pass
10:03 < Bushmills> yes
10:04 < itai> Bushmills, i read the man page . my problem is that it does not authenticate, it doesnt tell me where should i put the credentials, i tried desktop, home and /etc/openvpn. the authenticatiuon just doesnt work. I dont knwo what the problem
10:05 < Bushmills> you place it where you like, and you specify the location where you placed it in the config file
10:06 < Bushmills> it's right that "it doesn't tell you where" - you're not a slave of the machine. you're it's master.
10:06 < itai> Bushmills, fair enough ,what about the format of the credetials file?
10:06 < itai> username, password?
10:06 < ccesario> somebody know the reason that openvpn show UNDEF in status log ?
10:07 < Bushmills> it clearly says so in the section i pointed out to you
10:07 < Bushmills> how can you possibly have missed it if your read that?
10:07 < Bushmills> ccesario: because there's some code in openvpn which decided to do that
10:08 < ccesario> Bushmills, but in filed  "Common Name" ?!?
10:08 < ccesario> field*
10:09 < Bushmills> now that you're coming with some details - i'd dare to guess that's because no common name was specified
10:11 < Bushmills> either specify a CN in your key, or - if you're using user/password authentication -, check out the --username-as-common-name  option
10:13 < ccesario> yes
10:13 < ccesario> I'm using user/password authentication
10:13 < ccesario> with openvpn-auth-ldap module
10:13 -!- sigius [~sigius@93.125.185.45] has quit [Read error: Connection reset by peer]
10:14 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
10:14 < itai> Bushmills, are you refering to the Using alternative authentication methods section?
10:15 < Bushmills> no, i refer to the "is a file containing..." section
10:16 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
10:17 < Bushmills> it begins on the line below  --auth-user-pass, so about the second thing you read in the description of that option
10:17 < Bushmills> hard to miss if you let your eyes float along the letters and words
10:17 < itai> --http-proxy server port [authfile] [auth-method]...
10:18 < Bushmills> well, reading about http-proxy in this context is probably as effective as reading the kamasutra to find out about the file format.
10:19 < itai> No disrespect , but this info is not in the link you gave me
10:19 < itai> But it is in this :http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html
10:19 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
10:19 -!- novaflash [novaflash@openvpn/user/novaflash] has quit []
10:19 < p3rror> Bushmills, i set push "redirect-gateway def1" in the server.conf
10:20 < p3rror> but that not work
10:20 < Bushmills> for the file format, i suggested to read the man page, where it describes the  --auth-user-pass configuration directive
10:20 -!- p3rror [~mezgani@41.140.38.18] has left #openvpn ["Leaving"]
10:20 -!- p3rror [~mezgani@41.140.38.18] has joined #openvpn
10:21 < Bushmills> p3rror: def1 has been known to work around problems with missing default gateway.  you did restart the client, assuming your client config has  redirect-gateway def1?
10:22 < Bushmills> ah. push "redirect-gateway def1" in the server.conf ...  you restart server?
10:22 < itai> Let me ask you a question, if you dont mind. I use openvpn as a client cause I live in China. I have no idea about the working of proxies and VPNs . I just have a very general knowledge of networking. I'm running this script : cd /etc/openvpn
10:22 < itai> gnome-terminal --working-directory /etc/openvpn -e 'bash -lc "cd /etc/openvpn ;sudo openvpn --config 5\ -\ chiVPN\ UK.ovpn --auth-user-pass  ;bash"'
10:22 < itai> and its not authenticating. my credential file is correct. can you point out my mistake?
10:22 < Bushmills> "...5\ -\ chiVPN\ UK.ovpn --auth-user-pass  ;bash"'"   -  seems you didn't read what i suggested to do
10:24 < itai> Bushmills, I do not understand what you suggested, you sent me to a link with over a 1000 words, most of which i dont understand. I know that that you dont owe me anything, but would you mind spelling out your suggestion?
10:24 < Bushmills> (17:03:13) Bushmills: or read man page about --auth-user-pass
10:25 < Bushmills> (17:20:07) Bushmills: for the file format, i suggested to read the man page, where it describes the  --auth-user-pass configuration directive
10:25 < itai> Bushmills, this is after reading the man file,im just a simple man not an IT expert, 
10:26 < Bushmills> after that you asked me for the file format, while it is written there in simple wording
10:26 < Bushmills> which shows that you simply did *not* read that section
10:26 < p3rror> Bushmills, yes i restart the server
10:27 < p3rror> Bushmills, still not work
10:27 < Bushmills> p3rror: are routes added to client, when connecting?   especially two routes like 0.0.0.0/1 and 128.0.0.0/1?
10:29 < itai> Bushmill, I thank you for your help. You think I'm just not trying or something . It might be hard for you to comprehend how someone can read these things and not understand , but ...
10:29 < p3rror> Bushmills, here is the client config http://fpaste.org/fwmq/
10:29 < itai> anyway, good night
10:31 < Bushmills> p3rror: why do you redirect-gateway in client config while pushing redirect-gateway def1 from server config?
10:31 < Bushmills> you better make up your mind
10:31 -!- itai [~itai@218.82.161.242] has quit [Quit: Leaving]
10:33 < p3rror> Bushmills, here is the server config
10:33 < p3rror> Bushmills, please tell me what i miss
10:35 <@vpnHelper> RSS Update - forum: OpenVPN as Gateway <http://forums.openvpn.net/topic8886.html#p16004>
10:41 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
10:44 < ccesario> Bushmills, thanks... the --username-as-common-name solve the my problem!
10:57 -!- Voot [~trinklein@24.214.204.206] has joined #openvpn
10:57 -!- Voot is now known as v00t
10:59 -!- petn-randall [~lg@p5B3D4CE6.dip.t-dialin.net] has joined #openvpn
10:59 < v00t> i'm running a stock Ubuntu/OpenVPN-AS installation, and want to authenticate a remote system using pre-shared keys. Can anyone help me with this? I don't know where in the server to place the pre-shared key - and I don't want to have to re-write the whole config file
11:01 < Bushmills> !as
11:01 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
11:01 < v00t> oh! i didn't know they were different
11:01 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:01 < Bushmills> openvpn - non-as - is the community version
11:01 < v00t> oooh ok thanks!
11:03 -!- spiekey [~mario@projekte.imos.net] has quit [Quit: Ex-Chat]
11:10 -!- petn-randall [~lg@p5B3D4CE6.dip.t-dialin.net] has quit [Quit: Leaving]
11:17 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 240 seconds]
11:19 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
11:23 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
--- Log closed Wed Sep 28 11:26:29 2011
--- Log opened Wed Sep 28 11:31:31 2011
11:31 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
11:31 -!- Irssi: #openvpn: Total of 148 nicks [4 ops, 0 halfops, 1 voices, 143 normal]
11:31 -!- Irssi: Join to #openvpn was synced in 30 secs
11:33 -!- novaflash [novaflash@openvpn/user/novaflash] has joined #openvpn
11:33 -!- mode/#openvpn [+v novaflash] by ChanServ
11:44 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
--- Log opened Wed Sep 28 11:52:09 2011
11:52 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
11:52 -!- Irssi: #openvpn: Total of 148 nicks [4 ops, 0 halfops, 2 voices, 142 normal]
11:52 -!- Irssi: Join to #openvpn was synced in 29 secs
11:53 < Essobi> Hmm..
11:53 < Essobi> I got a VPN that's doing something weird... everything I've checked looks right thou.
11:55 < Bushmills> that's good - then you can simply ignore the weirdness and pretend it's not showing
11:57 < Essobi> :)
11:58 < Essobi> It's strange thou... I get the infamous TEST ROUTES 2/4 succeeded.
11:59 < Essobi> It's pingable from the server side for about 5 second maybe, then drops as the openvpn client tears it down.
12:00 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
12:00 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
12:03 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Operation timed out]
12:05 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
12:08 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Quit: leaving]
12:09 -!- EmperorTom [~EmperorTo@216.17.68.153] has joined #openvpn
12:10 -!- EmperorTom is now known as quadDamage
12:10 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
12:10 -!- pancake [~pan@12.237.46.252] has joined #openvpn
12:11 < pancake> I have a strange problem - where even though Im not setting tun0 as my default gateway its causing the other interface to stop responding.
12:11 < pancake> If I service openvpn stop it comes back up
12:11 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 248 seconds]
12:11 < pancake> I mean its a 10 line config that has no routes or redirections or anything
12:12 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
12:13 < Bushmills> does it have "redirect-gateway def1"?
12:14 < Bushmills> do ip addresses of ethernet NICs and openvpn virtual interface overlap, as in, are they in the same subnet?
12:14 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
12:15 < pancake> No Bushmills it doesnt. And no subnet overlapping either both are /24's
12:17 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
12:18 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Client Quit]
12:19 < Bushmills> check your routes on client before and after connecting to openvpn server, whether there's anything happen which is worth to take note of
12:19 < pancake> good idea
12:19 < Bushmills> happening, even
12:20 < pancake> Ohhhh I got it
12:20 < pancake> Thanks
12:21 < pancake> I forgot I was coming from a differnet subnet it actually was setting a route for
12:21 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
12:22 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
12:26 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
12:28 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Client Quit]
12:33 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
12:35 -!- dazo_afk is now known as dazo
12:35 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
12:35 -!- luneff [~yury@31.23.34.233] has quit [Quit: This computer has gone to sleep]
12:39 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
12:39 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
12:42 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
12:43 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Remote host closed the connection]
12:45 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
12:56 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
13:02 -!- lu_ [lu_@static.211.19.9.176.clients.your-server.de] has quit [Ping timeout: 260 seconds]
13:02 -!- lu_ [lu_@static.211.19.9.176.clients.your-server.de] has joined #openvpn
13:08 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
13:10 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:10 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
13:15 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
13:25 -!- albech [~albech@61.7.177.90] has quit [Remote host closed the connection]
13:25 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
13:27 -!- corretico [~luis@200.12.40.18] has quit [Ping timeout: 260 seconds]
13:27 -!- caemir_ is now known as caemir
13:29 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16006>
13:31 < ecrist> ping krzee 
13:32 < ecrist> xxx has been patched for SA 11:05 and 11:04, FYI
13:39 < EugeneKay> You know, one of the good aspects of all this recent SSL nonsense(DigiNotar, Beast exploit) is that "tech people" are actually caring about securing, instead of just "making the bar green so cusomer will stfu"
13:40 -!- r1ppa [~McBoingBo@mail.hrsg.ca] has joined #openvpn
13:40 < r1ppa> hey guys, moving our vpn service to another machine and upgrading, we never used tls-auth, is not not ideal to leave it out?
13:40 -!- corretico [~luis@200.12.40.18] has joined #openvpn
13:42 < EugeneKay> !hmac
13:42 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls static
13:42 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
13:43 < r1ppa> so better security, ok, does it make Openvpn work that much harder or barely noticeable?
13:43 < EugeneKay> It's just another bit of security you can add - makes it harder for $ATTACKER to DDoS you with spam because they get dropped earlier in the process
13:44 < EugeneKay> Additional overhead isn't noticable
14:00 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
14:03 -!- Guest52091 [ionic@ionic.de] has joined #openvpn
14:10 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
14:19 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
14:23 <@vpnHelper> RSS Update - forum: openvpn error! <http://forums.openvpn.net/topic8885.html#p16007>
14:25 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:30 <@vpnHelper> RSS Update - forum: PPTPD service on Openvpn AS machine!? <http://forums.openvpn.net/topic8860.html#p16008>
14:30 -!- Guest52091 [ionic@ionic.de] has quit [Excess Flood]
14:31 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:31 -!- mode/#openvpn [+v Axeman] by ChanServ
14:31 -!- Ionic` [ionic@ionic.de] has joined #openvpn
14:42 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:48 <@vpnHelper> RSS Update - forum: PPTPD service on Openvpn AS machine!? <http://forums.openvpn.net/topic8860.html#p16009>
14:48 -!- Ionic` is now known as Ionic
14:49 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:03 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
15:03 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
15:04 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:11 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
15:11 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16010>
15:26 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:30 <@vpnHelper> RSS Update - forum: How to pass SIP calls over OpenVPN Tunnel <http://forums.openvpn.net/topic8865.html#p16011>
15:39 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
15:39 < grendal-prime> hey guys..
15:40 < grendal-prime> i got a box seems to have droped off the wire.  Im trying to figure out if the customer has changed something in there environment or the openvpn server crashed.
15:40 < grendal-prime> i personally think it is the customer changeing things but...whats a good test just to see if the port is open...i mean if the server is crashed on the other side, but the port was open what would i see ..
15:40 < grendal-prime> like if i telnet to that port
15:41 < grendal-prime> cause what i get is..telnet: Unable to connect to remote host: Connection timed out
15:42 < krzee> its not on udp...?
15:42 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Quit: Leaving.]
15:43 < krzee> telnet is tcp you know...
15:44 < krzee> plus if you use tls-auth, theres no tool that will see the port as open unless the packets were signed with the right hmac sig
15:44 < krzee> (thats the point of tls-auth
15:44 < krzee> )
15:46 -!- p3rror [~mezgani@41.140.38.18] has quit [Ping timeout: 248 seconds]
15:48 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16012>
15:50 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
15:52 < pancake> I love openvpn.
15:52 < pancake> With a passion.
15:53 < krzee> im also a fan
15:53 < grendal-prime> krzee ya its udp
15:53 < krzee> grendal-prime, you'll never telnet to a udp port ;]
15:53 < grendal-prime> ya thats right...
15:53 < grendal-prime> dont know what i was thinking
15:53 < krzee> and if using tls-auth you wont find an app that'll see the port as open
15:54 < krzee> however, depending on the firewall (or OS settings) you may get a timeout instead of a refused or something like that
15:54 < krzee> or refused instead of timeout, etc
15:55 < grendal-prime> i get a timeout on the client attpempting to connect
15:55 < grendal-prime> Wed Sep 28 13:55:38 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
15:57 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 240 seconds]
15:59 < grendal-prime> which basically points two a firewall issue..however...these people say that they have changed nothing
16:02 < krzee> cool, sounds like they get to pay you to find what they changed
16:03 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
16:03 -!- novaflash [novaflash@openvpn/user/novaflash] has quit [Quit: ABANDON SHIP! ABANDON SHIP!]
16:08 < EugeneKay> This is why keeping /etc in git is so nifty
16:08 < EugeneKay> What changed? git diff
16:08 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
16:10 -!- novaflash [novaflash@openvpn/user/novaflash] has joined #openvpn
16:10 -!- mode/#openvpn [+v novaflash] by ChanServ
16:17 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
16:18 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
16:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:32 -!- W4lth3r|AwaY [W4lth3r@524AFE06.cm-4-3d.dynamic.ziggo.nl] has joined #openvpn
16:35 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:39 -!- W4lth3r [~W4lth3r@chaosarmy.org] has quit [Disconnected by services]
16:40 -!- W4lth3r [~W4lth3r@chaosarmy.org] has joined #openvpn
16:41 -!- W4lth3r [~W4lth3r@chaosarmy.org] has quit [Disconnected by services]
16:41 -!- W4lth3r|AwaY is now known as W4lth3r
16:41 -!- W4lth3r is now known as 31NAAAQ6K
16:41 -!- 31NAAAQ6K is now known as W4lth3r
16:41 -!- 64MAAG3B5 [~W4lth3r@chaosarmy.org] has joined #openvpn
16:42 -!- W4lth3r [W4lth3r@524AFE06.cm-4-3d.dynamic.ziggo.nl] has quit []
16:44 -!- 64MAAG3B5 is now known as W4lth3r
16:45 -!- p3rror [~mezgani@41.140.175.182] has joined #openvpn
16:49 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
16:51 -!- Denial [Denial@drgi.co.uk] has quit [Ping timeout: 252 seconds]
16:56 -!- dazo is now known as dazo_afk
17:08 -!- bandroidx [~bandroidx@pool-173-54-216-132.nwrknj.fios.verizon.net] has quit [Ping timeout: 248 seconds]
17:22 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
17:22 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
17:22 -!- bandroidx [~bandroidx@test.underleech.org] has joined #openvpn
17:26 -!- pancake [~pan@12.237.46.252] has quit [Ping timeout: 260 seconds]
17:38 -!- pancake [~pan@68-186-204-59.dhcp.leds.al.charter.com] has joined #openvpn
18:00 -!- pancake [~pan@68-186-204-59.dhcp.leds.al.charter.com] has quit [Ping timeout: 258 seconds]
18:02 -!- pancake [~pan@68-186-204-59.dhcp.leds.al.charter.com] has joined #openvpn
18:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 256 seconds]
18:11 -!- v00t [~trinklein@24.214.204.206] has quit [Quit: Ex-Chat]
18:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:25 -!- kusznir [~kusznir@casas-net.ailab.wsu.edu] has quit [Read error: Operation timed out]
18:25 -!- kusznir [~kusznir@casas-net.ailab.wsu.edu] has joined #openvpn
18:27 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
18:28 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
18:28 -!- mode/#openvpn [+o raidz] by ChanServ
18:29 -!- corretico [~luis@200.12.40.18] has quit [Ping timeout: 260 seconds]
18:35 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 244 seconds]
18:38 -!- qweeak [~jeril@122.166.148.67] has joined #openvpn
18:39 < qweeak> Hi
18:40 < zabin> HI
18:40 < qweeak> i'm sure i'm right room.. i got this error when connecting using pptpd
18:40 < zabin> what's the error? 
18:40 < qweeak> GRE: read(fd=6,buffer=8059680,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
18:41 < zabin> No idea sorry.. Anything in the log? 
18:41 < qweeak> i'm newbie ... ho to enable logging ?
18:42 < qweeak> *so
18:42 < zabin> maybe /var/log/*ppp*  idk 
18:42 < zabin> maybe the log is in there
18:42 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:43 < qweeak> u need to enable it in options.pptpd file rite ?
18:44 < qweeak> i think i got someting wrong in that file 
18:57 -!- p3rror [~mezgani@41.140.175.182] has quit [Ping timeout: 248 seconds]
19:01 < Optic> moo
19:01 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
19:08 -!- pancake [~pan@68-186-204-59.dhcp.leds.al.charter.com] has quit [Ping timeout: 240 seconds]
19:13 < qweeak> any directions
19:15 -!- p3rror [~mezgani@server-106.iconnect.zm] has joined #openvpn
19:26 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:42 -!- corretico [~luis@201.201.44.82] has joined #openvpn
19:51 -!- _julian_ [~quassel@hmbg-4d06b966.pool.mediaWays.net] has joined #openvpn
19:51 -!- _julian [~quassel@hmbg-4d06e0cc.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:58 -!- qweeak [~jeril@122.166.148.67] has quit [Quit: Leaving.]
20:30 -!- bandroidx [~bandroidx@test.underleech.org] has quit [Read error: Connection reset by peer]
20:37 -!- bandroidx [~bandroidx@test.underleech.org] has joined #openvpn
20:47 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:47 -!- mode/#openvpn [+v Axeman] by ChanServ
21:20 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has joined #openvpn
21:43 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
21:45 -!- Ionic [ionic@ionic.de] has joined #openvpn
21:48 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
21:51 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
22:03 -!- tessier [~treed@kernel-panic/copilotco] has quit [Ping timeout: 252 seconds]
22:06 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
22:09 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
22:34 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:35 -!- p3rror [~mezgani@server-106.iconnect.zm] has quit [Ping timeout: 248 seconds]
22:43 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
22:48 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has quit [Read error: Operation timed out]
22:49 -!- p3rror [~mezgani@41.140.175.182] has joined #openvpn
23:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:20 -!- p3rror [~mezgani@41.140.175.182] has quit [Ping timeout: 240 seconds]
23:35 -!- Netsplit *.net <-> *.split quits: tessier, kusznir, Essobi, hyper_ch, ccesario, oc80z
23:36 -!- Champi [Champi@rootshell.fr] has quit [Quit: Quit]
23:37 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html>
23:39 -!- Champi [Champi@rootshell.fr] has joined #openvpn
23:40 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
23:44 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:44 -!- kusznir [~kusznir@casas-net.ailab.wsu.edu] has joined #openvpn
23:44 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
23:44 -!- ccesario [~ccesario@187.17.166.162] has joined #openvpn
23:44 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
23:44 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
23:44 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
--- Day changed Thu Sep 29 2011
00:16 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:26 -!- nb [~nb@fedora/znc.nb] has quit [Ping timeout: 240 seconds]
00:27 -!- nickzxcv [foobar@216.218.223.115] has quit [Ping timeout: 240 seconds]
00:27 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 260 seconds]
00:27 -!- fulgore [~fulgore@glomsecurity.com] has quit [Ping timeout: 258 seconds]
00:28 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
00:28 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
00:34 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
00:36 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16015> || OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16014>
00:40 -!- Guest76559 [~nb@delta.nb.tc] has joined #openvpn
00:41 -!- nickzxcv [~nick@schmalenberger.us] has quit [Read error: Operation timed out]
00:48 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:49 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
00:51 -!- DexTerDDIT [dexterddit@2001:470:1f06:687::2] has quit [Ping timeout: 240 seconds]
00:59 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 248 seconds]
01:01 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
01:02 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
01:18 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16016>
01:21 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
01:21 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
01:21 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:30 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16017>
01:36 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16018>
01:42 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16019>
01:54 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16020>
02:06 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16022>
02:07 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
02:09 < Mowee> Morning
02:18 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16023>
02:23 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
02:30 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
02:30 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16024>
02:45 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:47 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
02:52 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16026>
03:01 -!- dazo_afk is now known as dazo
03:04 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
03:08 -!- mape2k [~mape2k@h250.fem.tu-ilmenau.de] has joined #openvpn
03:09 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:12 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
03:21 -!- bandroidx [~bandroidx@test.underleech.org] has quit [Ping timeout: 248 seconds]
03:23 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
03:37 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
03:38 -!- bandroidx [~bandroidx@pool-173-54-216-132.nwrknj.fios.verizon.net] has joined #openvpn
03:41 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
03:41 -!- mode/#openvpn [+o raidz] by ChanServ
03:42 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
03:58 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16027>
04:16 -!- bragon [~Alexandre@81.93.247.165] has quit [Ping timeout: 260 seconds]
04:17 -!- amero [~amero@unaffiliated/amero] has quit [Quit: Leaving [WeeChat 0.3.5]]
04:17 -!- bragon [~Alexandre@81.93.247.165] has joined #openvpn
04:19 < reiffert> !ccd
04:19 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
04:19 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
04:20 -!- petn-randall [~lg@p5B3D4001.dip.t-dialin.net] has joined #openvpn
04:23 < petn-randall> Hi, I've got a Windows 7 client with openvpn 2.2.1 and openvpn-gui (http://sourceforge.net/projects/openvpn-gui/).
04:23 <@vpnHelper> Title: OpenVPN GUI | Free Security software downloads at SourceForge.net (at sourceforge.net)
04:24 < petn-randall> It's correctly set-up, as I can see the tap-interface gets an IP assigned. However, after a few seconds the tap if gets reset and gets a link local IP (169.254.x.x).
04:25 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:25 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:25 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:25 < petn-randall> Also, the logs show that all the other parameters where pushed correctly from the server. I'm suspecting that I set up something wrong on Windows 7. Any ideas?
04:26 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:36 < petn-randall> config + logs: http://pastebin.com/nKWGW46d
04:47 < reiffert> !route
04:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
04:48 -!- tty234_ is now known as tty234
04:53 -!- mape2k [~mape2k@h250.fem.tu-ilmenau.de] has quit [Ping timeout: 260 seconds]
05:07 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
05:14 -!- luneff [~yury@109.165.43.181] has joined #openvpn
05:16 -!- EugeneKay [eugenekay@itvends.com] has quit [Ping timeout: 240 seconds]
05:17 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
05:18 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
05:19 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 240 seconds]
05:24 -!- mape2k [~mape2k@2a01:198:23f:10ff:f89d:95ff:fee2:8100] has joined #openvpn
05:29 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889.html#p16028>
05:41 <@vpnHelper> RSS Update - forum: authinfo <http://forums.openvpn.net/topic8890.html>
05:50 -!- benedikt [~benedikt@unaffiliated/benedikt] has left #openvpn []
05:54 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:59 <@vpnHelper> RSS Update - forum: vpn, but 2 different gateway on the lan <http://forums.openvpn.net/topic8891.html>
06:11 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:11 -!- mode/#openvpn [+v Axeman] by ChanServ
06:18 -!- bitterman [~yury@109.165.43.181] has joined #openvpn
06:18 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
06:20 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
06:21 -!- luneff [~yury@109.165.43.181] has quit [Ping timeout: 260 seconds]
06:35 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
06:49 -!- mape2k [~mape2k@2a01:198:23f:10ff:f89d:95ff:fee2:8100] has quit [Ping timeout: 244 seconds]
06:53 <@vpnHelper> RSS Update - forum: authinfo <http://forums.openvpn.net/topic8890.html#p16031>
06:59 <@vpnHelper> RSS Update - forum: vpn, but 2 different gateway on the lan <http://forums.openvpn.net/topic8891.html#p16032>
07:22 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
07:26 -!- mape2k [~mape2k@2a01:198:23f:10ff:7879:aff:fe20:5e9] has joined #openvpn
07:33 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:35 -!- mape2k [~mape2k@2a01:198:23f:10ff:7879:aff:fe20:5e9] has quit [Ping timeout: 244 seconds]
07:36 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
07:43 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:43 -!- mode/#openvpn [+v Axeman] by ChanServ
07:55 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
08:08 -!- Netsplit *.net <-> *.split quits: Optic, ronnocol, Fiouz, APTX, fahadsadah, DarthGandalf, CybDev, dxtr, Tick-Tock, nickzxcv,  (+7 more, use /NETSPLIT to show all of them)
08:10 -!- Netsplit over, joins: bauruine, nickzxcv, Cr4zi3, master_of_master, APTX, ScriptFanix, DarthGandalf, fahadsadah, dxtr, Fiouz (+7 more)
08:10 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
08:10 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
08:20 -!- mape2k [~mape2k@2001:638:904:ffd1:21f:3bff:fe27:21a9] has joined #openvpn
08:22 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:34 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:36 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
08:38 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has joined #openvpn
08:45 -!- jdpond [~Jack_D._P@c-69-242-123-72.hsd1.pa.comcast.net] has joined #openvpn
08:45 -!- jdpond [~Jack_D._P@c-69-242-123-72.hsd1.pa.comcast.net] has quit [Changing host]
08:45 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
08:54 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:55 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 256 seconds]
08:59 <@vpnHelper> RSS Update - forum: Server connection running on a private IP <http://forums.openvpn.net/topic8892.html>
09:03 < petn-randall> Hi everyone, I have following config and client-log: http://pastebin.com/nKWGW46d
09:04 < petn-randall> On a Windows 7 machine, the connection is successfully iniatiated; however after a few seconds, the tap interface is reconfigured (by Windows?) to use a link-local IP. Any ideas what is happening?
09:05 -!- master_of_master [~master_of@p57B5369F.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
09:06 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
09:07 -!- master_of_master [~master_of@p57B53FE5.dip.t-dialin.net] has joined #openvpn
09:09 < petn-randall> I've already tried OpenVPN (2.2.1) + the "new GUI" and the secure point (with OpenVPN 2.1.x), but the effects are the same.
09:11 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
09:12 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:14 < reiffert> Thu Sep 29 11:28:58 2011 TLS Error: local/remote TLS keys are out of sync: 91.61.64.1:1194 [0]
09:15 < reiffert> !factoids search windows
09:15 <@vpnHelper> 'windows_mobile' and 'windows'
09:16 < reiffert> !factoids search win7
09:16 <@vpnHelper> "win7" is http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/8a3e9b05-353b-4250-a023-066a085e9657 for a workaround to the windows 7 unidentified network issue you get when using redirect-gateway
09:16 < reiffert> !factoids search --values "windows 7"
09:16 <@vpnHelper> 'win7' and 'pushdns'
09:17 <@vpnHelper> RSS Update - forum: Server connection running on a private IP <http://forums.openvpn.net/topic8892.html#p16034>
09:25 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
09:27 < ecrist> !factoids
09:27 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
09:27 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
09:28 < ecrist> reiffert: that page may be easier to search
09:28 < petn-randall> thanks reiffert. The last link is not related, but the first one might be.
09:37 -!- btby [~user@unaffiliated/btby] has joined #openvpn
09:37 < btby> What is a typical way to have openvpn pick up auth data automatically?
09:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:39 < btby> Username and password, that is.
09:40 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
09:40 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
09:40 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:43 -!- miguet [~miguet@121.1.54.50] has quit [Ping timeout: 260 seconds]
09:44 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
09:46 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 255 seconds]
09:48 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
09:48 < btby> Sorry, shoulda just passed a file parameter to --auth-user-pass.
09:52 -!- mape2k [~mape2k@2001:638:904:ffd1:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
09:54 -!- Voot [~trinklein@24.214.204.206] has joined #openvpn
09:54 -!- Voot is now known as v00t
09:54 < v00t> what is the invocation option of OpenVPN as a client to connect through a particular NIC? I have four WANs connected, and I want to specify which WAN port is used.
09:55 < krzee> set your route to the vpn server accordingly
09:56 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
09:56 < v00t> i would, but i intend to establish a single vpn connection through each of the wan ports, then bond them together for a larger pipe
09:57 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
10:01 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
10:05 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has joined #openvpn
10:16 -!- dazo is now known as dazo_afk
10:18 <@vpnHelper> RSS Update - forum: Server connection running on a private IP <http://forums.openvpn.net/topic8892.html#p16035>
10:19 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:30 <@vpnHelper> RSS Update - forum: Server connection running on a private IP <http://forums.openvpn.net/topic8892.html#p16036>
10:33 < Essobi> v00t: LACP?
10:35 -!- Squidy [~quassel@187.53.179.122] has joined #openvpn
10:35 -!- Squidy [~quassel@187.53.179.122] has quit [Changing host]
10:35 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
10:35 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
10:37 -!- btby [~user@unaffiliated/btby] has quit [Remote host closed the connection]
10:38 -!- miguet [~miguet@121.1.54.50] has quit [Ping timeout: 260 seconds]
10:44 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:45 -!- j03 [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has joined #openvpn
10:45 -!- j03 [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has quit [Changing host]
10:45 -!- j03 [2e69fb42@unaffiliated/j03] has joined #openvpn
10:45 -!- j03 [2e69fb42@unaffiliated/j03] has quit [Changing host]
10:45 -!- j03 [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has joined #openvpn
10:45 < j03> Hi all. How can I allow inter-client communication? I think I need to push a route or something (or maybe alter the subnet mask), but I'm not sure. 
10:46 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:46 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Ping timeout: 244 seconds]
10:47 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
10:49 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
10:50 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
10:53 -!- bitterman [~yury@109.165.43.181] has quit [Quit: This computer has gone to sleep]
10:54 -!- Squidy_at_Home [~quassel@187.52.120.100] has joined #openvpn
10:54 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 260 seconds]
10:57 < krzee> j03, tried much google?
10:57 < krzee> !c2c
10:57 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
10:57 <@vpnHelper> clients
10:57 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
10:58 < j03> krzee: I did try google, yeah - I must have been using the wrong keywords. I'll have another google!
10:59 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
10:59 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
11:00 -!- Squidy_at_Home [~quassel@187.52.120.100] has quit [Ping timeout: 260 seconds]
11:01 -!- Ionic [ionic@ionic.de] has joined #openvpn
11:04 <@vpnHelper> RSS Update - forum: Client-side detection of established connection <http://forums.openvpn.net/topic8893.html>
11:08 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Remote host closed the connection]
11:11 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
11:13 -!- _julian_ [~quassel@hmbg-4d06b966.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
11:15 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
11:15 -!- _julian [~quassel@hmbg-5f766d03.pool.mediaWays.net] has joined #openvpn
11:24 -!- luneff [~yury@84.51.192.74] has joined #openvpn
11:26 < j03> krzee: I've added client-to-client to my server config file
11:26 < j03> krzee: no dice
11:28 -!- backtogeek [~backtogee@71.39.112.87.dyn.plus.net] has joined #openvpn
11:28 < krzee> and you also restarted the server?
11:28 -!- backtogeek [~backtogee@71.39.112.87.dyn.plus.net] has left #openvpn []
11:29 < j03> yep
11:30 -!- gapless [~gapless@92-32-96-46.tn.glocalnet.net] has joined #openvpn
11:30 < krzee> and you cant ping the other clients ip?
11:30 < j03> nope! I'll try again...
11:30 < krzee> what ip are you trying to ping
11:32 < j03> three clients are connected right now. 10.8.0.6, 10.8.0.10 and 10.8.0.14
11:32 < krzee> ok
11:32 < j03> i am 10.8.0.14. I can't ping either of the others
11:32 < krzee> so see if the server can ping .6
11:32 < j03> but I can ping 10.8.0.1
11:32 < j03> ok
11:33 < j03> interesting... it cannot
11:33 < krzee> firewall
11:33 < krzee> (on the machine of .6)
11:33 < j03> god damnit
11:33  * krzee points at the topic
11:34 < j03> the server cant ping ANY of the clients
11:34 < j03> "windows firewall" is disabled on my machine. 
11:35 < krzee> its still firewall
11:35 < krzee> well wait
11:35 < krzee> they can ping the server vpn ip?
11:35 < j03> the clients? yeah
11:36 < krzee> firewall
11:36 < j03> on the client machines?
11:37 < krzee> wouldnt that make sense...?
11:37 < krzee> lol
11:37 < j03> i just wanted to be sure ;)
11:37 < krzee> unless your server is set to block replies only
11:37 < krzee> but allow requests
11:37 < krzee> which would just be retarded
11:39 < j03> my only iptables rule is the NAT-ing rule
11:40 < Olipro> and what is the default policy of your filter chains
11:40 < j03> could it be to do with me using a proxy to connect to the VPN?
11:41 < j03> defaults to accept
11:42 < Olipro> so, you have 3 clients connected to the VPN server, and the VPN server can't ping any of them
11:42 < Olipro> yet the clients are able to ping eachother over the VPN
11:43 < j03> no
11:43 < j03> the clients cant ping eachother
11:43 < Olipro> is this tun or tap?
11:43 < j03> I want my clients to be able to "see" eachother
11:44 < j03> tun
11:44 < j03> and TCP mode
11:44 < j03> since i'm using a SOCKS5 proxy
11:44 < Olipro> have you set the "client-to-client
11:44 < Olipro> " option
11:44 < Olipro> in the server's openvpn config
11:45 -!- petn-randall [~lg@p5B3D4001.dip.t-dialin.net] has quit [Quit: Leaving]
11:45 < j03> I have
11:46 < j03> But I will double check
11:46 < j03> yeah
11:46 < Olipro> what address and subnet is configured on the tun interface (on the VPN server)
11:47 < j03> one second
11:48 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
11:48 < j03>   inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255 
11:49 < j03> hmm
11:49 < j03> that mask... shouldn't it be 255.255.255.0?
11:52 < krzee> lets see the log
11:53 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has left #openvpn []
11:53 < j03> OK one sec
11:53 < j03> server log, yes?
11:53 < krzee> thats likely just a byproduct of:
11:53 < krzee> !/30
11:53 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
11:53 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
11:53 < krzee> yes
11:53 < krzee> oh and post the configs too
11:53 < krzee> although iirc we fixed your configs the other day
11:54 < j03> you did :)
11:55 < j03> ohh crap, i've got to go! 
11:55 < j03> i'll be back later on. thanks for the help so far guys!
12:00 -!- j03 [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has quit [Ping timeout: 252 seconds]
12:07 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
12:19 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
12:21 -!- M4g3 [~M4g3@spellfire.eecs.qmul.ac.uk] has quit [Quit: Leaving]
12:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
12:25 -!- kim0 [~kim0@ubuntu/member/kim0] has joined #openvpn
12:26 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:26 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:26 < kim0> hmm, tcpdump showing my ping entering tun0, and not appearing on the other box's tun0 ... what could be wrong ?!
12:26 < Essobi> Everything.
12:27 < kim0> :)
12:27 < Essobi> Probably should start with openvpn thou.
12:27 < Essobi> fire them up in debug mode
12:32 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
12:33 < v00t> i'm also having ping issues - i'm watching --verb 11
12:34 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:34 < v00t> is there anything magic about 10.8.0.1 and 10.8.0.2? I've tried 5.5.0.1 and also 10.10.0.1 - there should be no issues there right?
12:35 < r1ppa> gidday folks
12:35 < v00t> i've established the tunnel, but I can't ping the remote system's tun0 adapter IP
12:35 < v00t> server: 10.10.0.1 client: 10.10.0.2
12:35 < v00t> they can ping their own tun0 ips, but not each others
12:35 < r1ppa> I am trying to upgrade and move our VPN, using the same server key, will I be able to utilize both old and new OpenVPN server even though they use the same key?
12:35 < v00t> and of course, no other pings go through
12:35 < v00t> for other ips
12:36 -!- gapless [~gapless@92-32-96-46.tn.glocalnet.net] has quit [Quit: Bye]
12:39 < r1ppa> v00t: I am prolly wrong but have you looked at the client-to-client option in the server.conf?
12:42 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
12:45 < v00t> hmm..client-to-client option?
12:45 < r1ppa> allows clients to "see each other"
12:46 < v00t> i have not explicitly stated this option. what is the option name?
12:47 < v00t> oh. it's actually client-to-client
12:47 < v00t> lol
12:47 < v00t> i'll try that
12:48 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
12:54 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro]
12:54 < v00t> i'm using static pre-shared keys - that's not a multi-client server, so client-to-client isn't a relevant option
12:55 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
13:01 -!- mirco [~mirco@p5B284993.dip.t-dialin.net] has joined #openvpn
13:04 -!- dollabill is now known as charlesob
13:09 <@vpnHelper> RSS Update - forum: --topology option for openvpn <http://forums.openvpn.net/topic8894.html>
13:17 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 260 seconds]
13:20 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
13:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
13:22 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
13:22 -!- mode/#openvpn [+o raidz] by ChanServ
13:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:24 < krzee> v00t, 
13:24 < krzee> !logs
13:24 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
13:24 < krzee> and use verb 5, NOT verb 11
13:29 -!- _Sam-- [~sam@unaffiliated/sam--/x-573746] has left #openvpn []
13:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
13:37 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
13:37 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:41 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
13:44 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
13:45 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
13:45 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:45 -!- mode/#openvpn [+v Axeman] by ChanServ
13:46 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:50 -!- charlesob [~mike@199.44.8.98] has quit [Ping timeout: 245 seconds]
14:01 -!- nickzxcv [~nick@schmalenberger.us] has quit [Ping timeout: 244 seconds]
14:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
14:08 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
14:09 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 256 seconds]
14:11 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 252 seconds]
14:12 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
14:13 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:21 -!- lue [lu_@static.211.19.9.176.clients.your-server.de] has joined #openvpn
14:21 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
14:22 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
14:23 -!- mode/#openvpn [+o raidz] by ChanServ
14:23 -!- fulgore [~fulgore@glomsecurity.com] has quit [Ping timeout: 258 seconds]
14:23 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
14:23 -!- lu_ [lu_@static.211.19.9.176.clients.your-server.de] has quit [Ping timeout: 258 seconds]
14:24 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Ping timeout: 276 seconds]
14:24 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
14:24 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
14:28 -!- fulgore [~fulgore@glomsecurity.com] has quit [Ping timeout: 260 seconds]
14:29 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
14:32 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:35 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
14:38 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
14:39 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
14:42 -!- mape2k [~mape2k@2001:638:904:ffc4:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
14:48 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
14:48 <@vpnHelper> RSS Update - forum: Here is my own Auto Login script for OpenVPN <http://forums.openvpn.net/topic7779.html#p16039>
14:49 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
14:49 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
14:52 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Operation timed out]
14:54 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
14:55 -!- fulgore [~fulgore@glomsecurity.com] has quit [Ping timeout: 252 seconds]
14:56 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
14:56 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
14:56 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
15:02 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
15:03 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Quit: Leaving.]
15:06 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 255 seconds]
15:07 -!- Squidy_at_Home [~quassel@200-101-37-25.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
15:07 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
15:08 -!- fulgore [~fulgore@glomsecurity.com] has quit [Ping timeout: 252 seconds]
15:08 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
15:08 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Ping timeout: 260 seconds]
15:09 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
15:10 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
15:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 256 seconds]
15:13 -!- fulgore [~fulgore@glomsecurity.com] has quit [Remote host closed the connection]
15:13 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
15:15 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16040>
15:15 -!- boswarrior [~mrnice@84.115.26.221] has joined #openvpn
15:19 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
15:22 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:27 -!- luneff [~yury@84.51.192.74] has joined #openvpn
15:31 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
15:45 <@vpnHelper> RSS Update - forum: Client-side detection of established connection <http://forums.openvpn.net/topic8893.html#p16042> || Server connection running on a private IP <http://forums.openvpn.net/topic8892.html#p16041>
15:45 -!- parabyte [~parabyte@88.96.255.123] has joined #openvpn
15:45 < parabyte> hi everyone
15:45 < parabyte> im just educating myself on the concepts of pki openvpn
15:46 < parabyte> just to recap
15:46 < parabyte> each side requires the other's public key yes?
15:46 < parabyte> for x509 ?
15:46 < parabyte> im not worried about the configuration im more worried about whats going on how it works etc..
15:47 -!- parabyte is now known as Mr_Krabbs
15:47 -!- Mr_Krabbs is now known as parabyte
15:57 <@vpnHelper> RSS Update - forum: --topology option for openvpn <http://forums.openvpn.net/topic8894.html#p16043>
16:03 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
16:08 -!- nickzxcv [foobar@schmalenberger.us] has joined #openvpn
16:14 -!- KaiForce [~chatzilla@adsl-70-228-76-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
16:17 < v00t> i've executed the "simple" configuration as found here: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
16:17 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
16:18 < v00t> but I cannot ping across the tunnel
16:18 < v00t> 10.8.0.1 nor 10.8.02 on the other side cannot be reached
16:18 < v00t> is there something glaring that i'm missing?
16:27 < v00t> eureka! i needed to set the "local" on the server to route through the correct WAN port.
16:29 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:30 -!- Guest76559 [~nb@delta.nb.tc] has quit [Changing host]
16:30 -!- Guest76559 [~nb@fedora/znc.nb] has joined #openvpn
16:30 -!- Guest76559 [~nb@fedora/znc.nb] has left #openvpn []
16:30 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
16:33 -!- boswarrior [~mrnice@84.115.26.221] has quit [Remote host closed the connection]
16:44 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
16:45 < kim0> guys I'm stuck for a few hours now .. network-A can ping VPN address of network-B, but cannot ping beyond that. Any ideas on what could be wrong
16:45 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
16:45 < kim0> From VPN server(netowrk-B) I can ping all of network A
16:47 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
16:59 -!- lue is now known as lu_
16:59 -!- lu_ is now known as lue
16:59 -!- lue is now known as lu_
16:59 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
17:01 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
17:07 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
17:10 -!- jdpond [~Jack_D._P@mediawiki/jpond] has quit [Quit: Leaving.]
17:12 -!- corretico [~luis@201.201.44.82] has joined #openvpn
17:21 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
17:24 -!- mirco [~mirco@p5B284993.dip.t-dialin.net] has quit [Quit: mirco]
17:25 -!- mirco [~mirco@p5B284993.dip.t-dialin.net] has joined #openvpn
17:27 -!- mirco [~mirco@p5B284993.dip.t-dialin.net] has quit [Client Quit]
17:30 -!- v00t [~trinklein@24.214.204.206] has left #openvpn ["MAYDAY!"]
18:05 -!- nebz [~nebula@173.245.87.91] has joined #openvpn
18:07 -!- kim0 [~kim0@ubuntu/member/kim0] has left #openvpn []
18:08 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
18:13 -!- zabin is now known as arosen
18:19 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
18:19 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
18:19 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:19 -!- mode/#openvpn [+v Axeman] by ChanServ
18:19 -!- miguet [~miguet@121.1.54.50] has quit [Ping timeout: 260 seconds]
19:02 -!- patel_ [~nebula@64.125.181.73] has joined #openvpn
19:04 -!- patel_ [~nebula@64.125.181.73] has quit [Client Quit]
19:04 -!- nebz [~nebula@173.245.87.91] has quit [Ping timeout: 256 seconds]
19:04 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:27 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:27 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:29 -!- _julian [~quassel@hmbg-5f766d03.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:31 -!- _julian [~quassel@hmbg-4d06a356.pool.mediaWays.net] has joined #openvpn
19:34 -!- gene_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:37 < gene_> I would like to ask how can I use auth-user-pass without having the file that is the username and password storage?
19:38 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:42 < gene_> anybody around today
19:42 -!- gene_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:52 <@vpnHelper> RSS Update - forum: PPTPD service on Openvpn AS machine!? <http://forums.openvpn.net/topic8860.html#p16046> || How to Connect to Canadian IP ? New to OpenVPN plz Help <http://forums.openvpn.net/topic8895.html#p16045>
20:14 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
20:26 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:58 <@vpnHelper> RSS Update - forum: auth-user-pass help <http://forums.openvpn.net/topic8896.html>
21:07 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 245 seconds]
21:21 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:22 -!- parabyte [~parabyte@88.96.255.123] has quit [Remote host closed the connection]
21:47 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
21:49 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
21:50 -!- Guest35033 [ionic@ionic.de] has joined #openvpn
22:02 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
22:02 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
22:02 -!- mode/#openvpn [+o raidz] by ChanServ
22:04 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:10 <@vpnHelper> RSS Update - forum: Failover validation <http://forums.openvpn.net/topic8797.html#p16048>
22:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:11 -!- jdpond [~Jack_D._P@mediawiki/jpond] has left #openvpn []
22:21 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
22:22 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
22:26 -!- Guest35033 [ionic@ionic.de] has left #openvpn []
22:26 -!- Ionic [ionic@ionic.de] has joined #openvpn
22:26 -!- Cyrus [~Cyrus@unaffiliated/cyrus] has joined #openvpn
22:27 -!- Cyrus [~Cyrus@unaffiliated/cyrus] has left #openvpn ["Textual IRC Client: http://www.textualapp.com/"]
22:35 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 244 seconds]
22:35 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
22:48 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Read error: Operation timed out]
22:51 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
22:56 -!- dnivra [79f33d52@gateway/web/freenode/ip.121.243.61.82] has joined #openvpn
22:59 < dnivra> hello. I have the configuration files of openvpn. when I run 
22:59 < dnivra> run "openvpn --security-level 2 --config client.conf", I get the following error http://pastebin.com/f2HePve7
22:59 < dnivra> could someone tell me what is missing?
--- Log closed Thu Sep 29 23:08:21 2011
--- Log opened Thu Sep 29 23:08:26 2011
23:08 -!- ecrist [~ecrist@216.17.68.153] has joined #openvpn
23:08 -!- Irssi: #openvpn: Total of 66 nicks [3 ops, 0 halfops, 1 voices, 62 normal]
23:08 -!- Irssi: Join to #openvpn was synced in 29 secs
23:08 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
23:09 -!- MrWGW [MrWGW@74.124.192.8] has quit [Ping timeout: 252 seconds]
23:11 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
23:11 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
23:11 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
23:11 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
23:11 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
23:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:11 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
23:11 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
23:11 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
23:11 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:11 -!- _julian [~quassel@hmbg-4d06a356.pool.mediaWays.net] has joined #openvpn
23:11 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
23:11 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
23:11 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
23:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:11 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
23:11 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
23:11 -!- lu_ [lu_@static.211.19.9.176.clients.your-server.de] has joined #openvpn
23:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:11 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
23:11 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
23:11 -!- master_of_master [~master_of@p57B53FE5.dip.t-dialin.net] has joined #openvpn
23:11 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
23:11 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
23:11 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
23:11 -!- CybDev [cybdev@unaffiliated/cybdev] has joined #openvpn
23:11 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
23:11 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
23:11 -!- dxtr [mii99s@unaffiliated/dxtr] has joined #openvpn
23:11 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
23:11 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
23:11 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
23:11 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
23:11 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
23:11 -!- Champi [Champi@rootshell.fr] has joined #openvpn
23:11 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
23:11 -!- r1ppa [~McBoingBo@mail.hrsg.ca] has joined #openvpn
23:11 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:11 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
23:11 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
23:11 -!- merlin1991 [~merlin@Maemo/community/cssu/merlin1991] has joined #openvpn
23:11 -!- arosen [~arosen@130.127.39.181] has joined #openvpn
23:11 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
23:11 -!- zu [~zu@ks355000.kimsufi.com] has joined #openvpn
23:11 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:11 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
23:11 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
23:11 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
23:11 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
23:11 -!- ServerMode/#openvpn [+o mattock] by hubbard.freenode.net
23:11 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
23:11 -!- rkantos [~robin2@109.169.55.199] has joined #openvpn
23:11 -!- pranq [~pranq@unaffiliated/contempt] has joined #openvpn
23:11 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has joined #openvpn
23:11 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
23:11 -!- mete [~mete@mete.shell.la] has joined #openvpn
23:11 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
23:11 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
23:11 -!- defswork_ [~andy@mx2.3gcomms.co.uk] has joined #openvpn
23:11 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
23:11 -!- lazzer [~lazzer@vmlinux.org] has joined #openvpn
23:11 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
23:11 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
23:11 -!- sia^pwnnt [115kluu@212.224.67.26] has joined #openvpn
23:11 -!- reiffert [~thomas@178.63.49.86] has joined #openvpn
23:11 -!- uuuppz [~uuuppz@78.129.207.46] has joined #openvpn
23:11 -!- sno-_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
23:11 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
23:11 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
23:11 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
23:11 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
23:11 -!- Agin_ [~Agin@greenzone.copyleft.no] has joined #openvpn
23:11 -!- cherwin [1776628@xs8.xs4all.nl] has joined #openvpn
23:11 -!- Dougy [me@openvpn/community/user/dougy] has joined #openvpn
23:11 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has joined #openvpn
23:11 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
23:11 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
23:11 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
23:16 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 260 seconds]
23:19 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
23:22 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:36 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
23:37 -!- dnivra [79f33d52@gateway/web/freenode/ip.121.243.61.82] has quit [Ping timeout: 251 seconds]
23:46 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
23:46 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
23:46 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:50 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
23:50 < Bushmills> yes:  patience
23:52 <@vpnHelper> RSS Update - forum: Get client VPN ip in client-connect script <http://forums.openvpn.net/topic8741.html#p16049>
23:59 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
23:59 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
--- Day changed Fri Sep 30 2011
00:05 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
00:13 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 244 seconds]
00:14 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 240 seconds]
00:15 -!- Tick-Tock [~Tick-Tock@lunari.us] has joined #openvpn
00:15 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
00:15 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 255 seconds]
00:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
00:31 -!- mirco [~mirco@p5B2846F8.dip.t-dialin.net] has joined #openvpn
00:31 -!- Zyclops [~Adium@ec2-175-41-200-24.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
00:32 < Zyclops> hi guys
00:32 < Zyclops> i've been having a lot of stability issue with my vpn
00:33 < Zyclops> and the logs don't really show anything
00:33 < Zyclops> i.e nothing that would indicate it's dropped out or it's stopped working
00:33 < Zyclops> is there anything I can do to get some more information about why the connection drops out
00:48 -!- mirco [~mirco@p5B2846F8.dip.t-dialin.net] has quit [Quit: mirco]
00:54 -!- Zyclops [~Adium@ec2-175-41-200-24.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 244 seconds]
01:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:13 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
01:29 -!- luneff [~yury@84.51.192.74] has joined #openvpn
01:40 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
01:42 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 252 seconds]
01:42 -!- JPeterso2 is now known as JPeterson
01:43 < reiffert> moin
02:02 -!- thething [~forerunne@208.110.85.182] has joined #openvpn
02:08 -!- dazo_afk is now known as dazo
02:12 -!- reiffert [~thomas@178.63.49.86] has quit [Quit: leaving]
02:18 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
02:35 <@vpnHelper> RSS Update - forum: Failover validation <http://forums.openvpn.net/topic8797.html#p16050>
02:42 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
02:43 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:46 < Mowee> Morning
02:59 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 258 seconds]
02:59 <@vpnHelper> RSS Update - forum: Windows 7 Tap-Win32 Adapter V9 conflict. Please Help! Help!! <http://forums.openvpn.net/topic8897.html>
03:00 -!- thething [~forerunne@208.110.85.182] has quit [Ping timeout: 244 seconds]
03:07 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
03:07 <@vpnHelper> RSS Update - forum: encrypt handshake and control channel <http://forums.openvpn.net/topic8898.html>
03:12 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
03:12 -!- mode/#openvpn [+o raidz] by ChanServ
03:12 <@vpnHelper> RSS Update - forum: Windows 7 Tap-Win32 Adapter V9 conflict. Please Help! Help!! <http://forums.openvpn.net/topic8897.html#p16055> || encrypt handshake and control channel <http://forums.openvpn.net/topic8898.html#p16054> || auth-user-pass help <http://forums.openvpn.net/topic8896.html#p16053>
03:15 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
03:18 <@vpnHelper> RSS Update - forum: [SOLVED] Get client VPN ip in client-connect script <http://forums.openvpn.net/topic8741.html#p16049>
03:21 -!- novaflash [novaflash@openvpn/user/novaflash] has quit [Ping timeout: 260 seconds]
03:22 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 252 seconds]
03:22 -!- toortog [~toortog@notsecure.net] has quit [Ping timeout: 252 seconds]
03:22 -!- tty234 [telex@gateway/shell/anapnea.net/x-grtbxciefjbkixnl] has quit [Ping timeout: 260 seconds]
03:22 -!- fremo__ [~fremo@noc.toile-libre.net] has quit [Ping timeout: 260 seconds]
03:23 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 252 seconds]
03:23 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 252 seconds]
03:23 -!- Squidy_at_Home [~quassel@200-101-37-25.cbace702.dsl.brasiltelecom.net.br] has quit [Ping timeout: 260 seconds]
03:23 -!- Mowee [~Mowi@lendabrain.net] has quit [Ping timeout: 260 seconds]
03:26 -!- Ionic` [ionic@ionic.de] has joined #openvpn
03:26 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
03:26 -!- mode/#openvpn [+v novaflash] by ChanServ
03:29 -!- Netsplit *.net <-> *.split quits: Denial, APTX, @dazo, @raidz, DarthGandalf, @mattock, uuuppz, zu, ScriptFanix, troyt,  (+103 more, use /NETSPLIT to show all of them)
03:29 -!- Ionic` is now known as Ionic
03:34 -!- toortog [~toortog@notsecure.net] has joined #openvpn
03:40 -!- Netsplit over, joins: lazzer, stevefink
03:40 -!- EvilJStoker_ [jstoker@athena.jcs.me.uk] has joined #openvpn
03:40 -!- noaXess [~noaXess@gw.ptr-80-238-209-47.customer.ch.netstream.com] has joined #openvpn
03:40 -!- tty234_ [telex@gateway/shell/anapnea.net/x-ontadhvjillzezdr] has joined #openvpn
03:40 -!- cron2_ [~gert@kirk.greenie.muc.de] has joined #openvpn
03:40 -!- Squidy [~quassel@200-101-37-25.cbace702.dsl.brasiltelecom.net.br] has joined #openvpn
03:40 -!- thething [~forerunne@63.141.241.2] has joined #openvpn
03:40 -!- Mowi [~Mowi@lendabrain.net] has joined #openvpn
03:40 -!- fremo_ [~fremo@noc.toile-libre.net] has joined #openvpn
03:40 -!- Netsplit over, joins: RichardBronosky, @raidz, Azrael808, reiffert, JPeterson, luneff, Denial, amero, catsup, krzee (+46 more)
03:40 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
03:40 -!- Netsplit over, joins: batrick, pwrcycle, rkantos
03:40 -!- pranq [~pranq@unaffiliated/contempt] has joined #openvpn
03:40 -!- Netsplit over, joins: trumee, deever, mete, Deathvalley122
03:40 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
03:40 -!- Netsplit over, joins: defswork_, raomin, kloeri, Fleck, sia^pwnnt, uuuppz, sno-_, ivenkys, up_the_irons, inimino (+6 more)
03:40 -!- ServerMode/#openvpn [+o mattock] by hubbard.freenode.net
03:40 -!- mode/#openvpn [+v oc80z] by ChanServ
03:40 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
03:40 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
03:40 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Excess Flood]
03:40 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
03:40 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
03:40 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
03:40 -!- Netsplit over, joins: SJr, @dazo, _zero_, t_, bassliner, caesay, _____m, fbh, TheRedOctober, R-66Y (+1 more)
03:40 -!- sobersab1e [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
03:40 -!- Netsplit over, joins: quadDamage, dropje, sigius, bandroidx, W4lth3r, agagag, @vpnHelper, LuckyY, chantra, omgub (+7 more)
03:40 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
03:41 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
03:41 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
03:41 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
03:41 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
03:43 -!- Ionic [ionic@ionic.de] has joined #openvpn
03:48 <@vpnHelper> RSS Update - forum: encrypt handshake and control channel <http://forums.openvpn.net/topic8898.html#p16056>
03:48 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 258 seconds]
03:50 -!- thething [~forerunne@63.141.241.2] has quit [Ping timeout: 256 seconds]
03:51 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
03:56 -!- noaXess [~noaXess@gw.ptr-80-238-209-47.customer.ch.netstream.com] has left #openvpn []
03:58 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 276 seconds]
04:00 -!- cron2_ [~gert@kirk.greenie.muc.de] has quit [Changing host]
04:00 -!- cron2_ [~gert@openvpn/community/developer/cron2] has joined #openvpn
04:00 -!- cron2_ is now known as cron
04:00 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 245 seconds]
04:01 -!- cron is now known as Guest44927
04:01 -!- Guest44927 [~gert@openvpn/community/developer/cron2] has left #openvpn []
04:01 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
04:01 -!- mode/#openvpn [+o cron2] by ChanServ
04:23 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
04:24 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:24 <@vpnHelper> RSS Update - forum: encrypt handshake and control channel <http://forums.openvpn.net/topic8898.html#p16057>
04:28 -!- luneff [~yury@31.23.121.96] has joined #openvpn
04:30 <@vpnHelper> RSS Update - forum: encrypt handshake and control channel <http://forums.openvpn.net/topic8898.html#p16058>
04:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:58 < dxtr> Hmm
04:59 < dxtr> this is weird
04:59 -!- reisi [koivunej@mustatilhi.cs.tut.fi] has joined #openvpn
05:00 -!- maxJadi [~maxJadi@dhcp-167-194.nomad.chalmers.se] has joined #openvpn
05:00 -!- maxJadi [~maxJadi@dhcp-167-194.nomad.chalmers.se] has quit [Changing host]
05:00 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:02 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
05:02 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
05:06 -!- sobersab1e [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 248 seconds]
05:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.2]
05:07 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
05:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:11 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
05:12 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p16059>
05:15 -!- cpm [~Chip@border0.avitecture.net] has joined #openvpn
05:15 -!- cpm [~Chip@border0.avitecture.net] has quit [Changing host]
05:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:18 <@vpnHelper> RSS Update - forum: encrypt handshake and control channel <http://forums.openvpn.net/topic8898.html#p16060>
05:19 -!- spxspx [6ea9e67b@gateway/web/freenode/ip.110.169.230.123] has joined #openvpn
05:20 < spxspx> hello everyone
05:20 < spxspx> is any openvpn developers present here ?
05:20 < spxspx> I have a paid project to be done
05:21 < spxspx> here is the link on the forum : https://forums.openvpn.net/topic8898.html
05:21 <@vpnHelper> Title: OpenVPN Support Forum encrypt handshake and control channel : Scripting and Customizations (at forums.openvpn.net)
05:22 < spxspx> anyone interested plz contact me on forum
05:22 < spxspx> seems everyone is sleep here :D
05:24 -!- spxspx [6ea9e67b@gateway/web/freenode/ip.110.169.230.123] has quit [Client Quit]
05:44 -!- luneff [~yury@31.23.121.96] has quit [Quit: Leaving]
05:51 -!- havoc_ [~havoc@208.87.120.111] has joined #openvpn
05:52 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
05:55 <@vpnHelper> RSS Update - forum: encrypt handshake and control channel <http://forums.openvpn.net/topic8898.html#p16062>
05:59 < dxtr> So how do I debug my connection? I connected another client to my openvpn server but that clients connection won't work
06:00 < krzee> whats the problem dxtr?
06:00 < dxtr> krzee: That this seconds clients connection won
06:00 < dxtr> won't work. The packets doesn't even seem to reach the server
06:01 < dxtr> I don't have any firewall rules whatsoever right now
06:01 < krzee> tcpdump on server eth0 (filtering for client ip) shows nothing?
06:08 < dxtr> No I mean it connects and everything
06:08 < dxtr> And it stays connected
06:08 < dxtr> But once it's connected it can't send any data through the VPN
06:11 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
06:12 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
06:19 <@vpnHelper> RSS Update - forum: encrypt handshake and control channel <http://forums.openvpn.net/topic8898.html#p16063>
06:25 <@vpnHelper> RSS Update - forum: Varify password problem <http://forums.openvpn.net/topic8899.html>
06:45 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 260 seconds]
06:47 -!- havoc_ [~havoc@208.87.120.111] has quit [Read error: Operation timed out]
07:02 < ecrist> sub d00ds
07:02 < EugeneKay> Hungry
07:09 < reiffert> Hungary?
07:10 -!- havoc_ [~havoc@208.87.120.111] has joined #openvpn
07:10 < ecrist> Turkey
07:11 < reiffert> Bratislava
07:12 -!- havoc_ is now known as havoc
07:23 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:28 -!- havoc [~havoc@208.87.120.111] has quit [Quit: bah fuckity fuck fuck]
07:40 -!- dollabill is now known as charlesob
07:44 -!- luneff [~yury@31.23.121.96] has joined #openvpn
07:51 -!- havoc [~havoc@208.87.120.111] has joined #openvpn
07:55 <@vpnHelper> RSS Update - forum: Varify password problem <http://forums.openvpn.net/topic8899.html#p16065>
08:02 -!- Sefid_Par [~Thunderbi@78.38.176.2] has joined #openvpn
08:06 < reisi> is it normal to have openvpn traffic consist heavily of small (<500 byte) packets instead of close to MTU (1500) packets?
08:06 <@vpnHelper> RSS Update - forum: Remote Desktop Disconnecting <http://forums.openvpn.net/topic8900.html>
08:07 < reisi> for a few hours the ratio of 75-150 byte packets to 1426...MTU packets is 2.3 : 1
08:08 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
08:29 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:29 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:29 -!- mode/#openvpn [+v Axeman] by ChanServ
08:38 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Read error: Operation timed out]
08:39 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has joined #openvpn
08:50 -!- Sefid_Par [~Thunderbi@78.38.176.2] has quit [Ping timeout: 240 seconds]
08:55 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
09:02 -!- Sefid_Par [~Thunderbi@78.38.176.2] has joined #openvpn
09:05 -!- master_of_master [~master_of@p57B53FE5.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:07 -!- master_of_master [~master_of@p57B52FF0.dip.t-dialin.net] has joined #openvpn
09:31 < dxtr> I realize this is the most asked question here - but how did I do to allow all clients in my subnet to access each other? If I remember correctly there was an openvpn parameter for it
09:32 -!- Sefid_Par [~Thunderbi@78.38.176.2] has quit [Ping timeout: 245 seconds]
09:33 -!- Sefid_Par [~Thunderbi@78.38.176.2] has joined #openvpn
09:40 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:42 < merlin1991> dxtr: are you seraching for client-to-client?
09:44 <@dazo> dxtr: sounds like you just need some traditional TCP/IP routing ... and make sure no firewalls stops the routed traffic
09:44  * dazo is out of here now
09:46 -!- dazo is now known as dazo_afk
09:48 < dxtr> merlin1991: Oh yeah
09:48 < dxtr> That totally worked :)
09:48 < dxtr> Thanks
09:48 < dxtr> dazo_afk: Was as easy as client-to-client
09:58 -!- Sefid_Par [~Thunderbi@78.38.176.2] has quit [Read error: Connection reset by peer]
10:03 -!- Sefid_Par [~Thunderbi@78.38.176.2] has joined #openvpn
10:15 -!- rommel092079 [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has joined #openvpn
10:15 -!- rommel092079 [d897bf5f@gateway/web/freenode/ip.216.151.191.95] has left #openvpn []
10:16 -!- Sefid_Par [~Thunderbi@78.38.176.2] has quit [Read error: Connection reset by peer]
10:16 -!- Sefid_Par [~Thunderbi@78.38.176.2] has joined #openvpn
10:21 -!- Sefid_Pa1 [~Thunderbi@78.38.176.2] has joined #openvpn
10:23 -!- Sefid_Par [~Thunderbi@78.38.176.2] has quit [Ping timeout: 255 seconds]
10:28 -!- bauruine [~stefan@141-228.195-178.cust.bluewin.ch] has quit [Remote host closed the connection]
10:33 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889-15.html#p16067>
10:34 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 258 seconds]
10:39 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
10:41 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
10:44 -!- corretico_ [~luis@200.12.40.18] has joined #openvpn
10:47 -!- luneff [~yury@31.23.121.96] has quit [Quit: This computer has gone to sleep]
10:48 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:51 -!- corretico_ [~luis@200.12.40.18] has quit [Ping timeout: 248 seconds]
10:51 -!- corretico_ [~luis@200.12.40.18] has joined #openvpn
11:08 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
11:10 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 248 seconds]
11:11 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
11:14 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Quit: I use a bouncer, this should have never happened]
11:16 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
11:16 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Client Quit]
11:20 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:28 <@vpnHelper> RSS Update - forum: Failover validation <http://forums.openvpn.net/topic8797.html#p16068>
11:29 -!- luneff [~yury@84.51.192.74] has joined #openvpn
11:33 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Operation timed out]
11:34 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 240 seconds]
11:35 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
11:35 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
11:36 -!- thumbs [1000@unaffiliated/thumbs] has left #openvpn []
11:36 -!- leeping [~leeping@DNab407ce7.Stanford.EDU] has joined #openvpn
11:36 < leeping> Hi there - when I'm connected to a VPN, is my network connection any slower?  As in, do all of the data packets travel through the VPN server first and then to my local computer?
11:37 < krzee> leeping, depends on your config
11:37 < krzee> !redirect
11:37 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
11:38 < leeping> krzee, thanks.  What about my IP address?  Will the IP address of my local computer be different, when seen from another computer on the Internet?
11:39 < krzee> only if you do what my bot said above
11:39 < krzee> !vpn
11:39 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
11:40 < krzee> a vpn is basically an ethernet cable to the server
11:40 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
11:40 < krzee> if using tun it is a layer3 ethernet cable, but same idea
11:40 < krzee> to actually default route over that and accomplish what you are asking about, you must also do this:
11:40 < krzee> !redirect
11:40 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
11:41 < leeping> this is very helpful. I'll look at the faq.  I don't use openvpn right now, I use a Cisco-based one, but I think it'd be good to know how it works
11:43 < krzee> !sample
11:43 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
11:43 < krzee> !man
11:43 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
11:43 < krzee> !factoids
11:43 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
11:50 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
11:52 < leeping> thank you again. :)
11:54 < krzee> np
11:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
12:06 -!- leeping [~leeping@DNab407ce7.Stanford.EDU] has quit [Remote host closed the connection]
12:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
12:11 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
12:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
12:31 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
12:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:44 <@vpnHelper> RSS Update - forum: Failover validation <http://forums.openvpn.net/topic8797.html#p16069>
12:44 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
12:57 -!- chokesmaster [~chokesmas@69.157.245.233] has joined #openvpn
12:57 -!- charlesob [~mike@199.44.8.98] has quit [Ping timeout: 258 seconds]
13:01 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
13:12 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 255 seconds]
13:26 <@vpnHelper> RSS Update - forum: Windows 7 Tap-Win32 Adapter V9 conflict. Please Help! Help!! <http://forums.openvpn.net/topic8897.html#p16070>
13:41 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
13:43 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
13:44 <@vpnHelper> RSS Update - forum: Server connection running on a private IP <http://forums.openvpn.net/topic8892.html#p16071>
13:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
13:49 -!- Sefid_Pa1 [~Thunderbi@78.38.176.2] has quit [Ping timeout: 245 seconds]
14:00 -!- junmar [~junmar@46.166.136.238] has joined #openvpn
14:20 -!- junmar [~junmar@46.166.136.238] has quit [Ping timeout: 258 seconds]
14:24 -!- junmar [~junmar@46.166.136.238] has joined #openvpn
14:24 -!- junmar [~junmar@46.166.136.238] has quit [Client Quit]
14:33 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
14:35 -!- hudony [~chatzilla@modemcable078.217-70-69.static.videotron.ca] has joined #openvpn
14:36 < hudony> Hi there.  Really weird problem.  Trying to access my openvpn bridged server (using server-bridge instruction) and somehow, on the client side, my tap0 interface comes up but with no ip
14:36 < hudony> If i manuall assign one afteward, it works, I can ping my local network
14:37 < hudony> Been googleing a lot but no luck so far
14:37 < hudony> Anyone?
14:40 < ecrist> !configs
14:40 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
14:40 < ecrist> !logs
14:40 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
14:41 -!- leeping [~leeping@DNab407ce7.Stanford.EDU] has joined #openvpn
14:41 < hudony> Looked at the log and saw nothing.
14:41 < hudony> Hold on
14:41 < hudony> Maybe you'll see something I missed
14:45 < hudony> server : http://pastebin.com/zJXXkcAL
14:45 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 252 seconds]
14:46 < hudony> client : http://pastebin.com/U7EGEwRd
14:47 -!- leeping [~leeping@DNab407ce7.Stanford.EDU] has quit [Ping timeout: 252 seconds]
14:49 < hudony> I've seen a lot of problem on the net about vpns but very few about having the tap interface up but with no ip
15:00 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
15:03 -!- hudony [~chatzilla@modemcable078.217-70-69.static.videotron.ca] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0/20110922153450]]
15:07 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 258 seconds]
15:15 -!- leeping [~leeping@171.66.43.251] has joined #openvpn
15:21 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
15:30 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:34 -!- leeping [~leeping@171.66.43.251] has quit [Ping timeout: 260 seconds]
15:49 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
15:53 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
15:54 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:56 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
16:02 <@vpnHelper> RSS Update - forum: Windows 7 Tap-Win32 Adapter V9 conflict. Please Help! Help!! <http://forums.openvpn.net/topic8897.html#p16073> || Server connection running on a private IP <http://forums.openvpn.net/topic8892.html#p16072>
16:06 -!- leeping [~leeping@171.66.43.251] has joined #openvpn
16:07 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
16:17 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit [Quit: Computer has gone to sleep.]
16:21 -!- leeping [~leeping@171.66.43.251] has quit [Ping timeout: 255 seconds]
16:25 -!- raidz1 [324c315e@gateway/web/freenode/ip.50.76.49.94] has joined #openvpn
16:25 -!- raidz1 [324c315e@gateway/web/freenode/ip.50.76.49.94] has quit [Client Quit]
16:35 -!- leeping [~leeping@171.66.43.251] has joined #openvpn
16:39 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Remote host closed the connection]
16:55 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has joined #openvpn
16:57 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
17:14 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:15 -!- saffx0F [~saff__@host186-125-dynamic.247-95-r.retail.telecomitalia.it] has joined #openvpn
17:28 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
17:32 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 245 seconds]
17:32 -!- tessier [~treed@mail.copilotco.com] has quit [Changing host]
17:32 -!- tessier [~treed@kernel-panic/copilotco] has joined #openvpn
17:38 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
17:40 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
17:41 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
17:44 -!- Cain [~Geek@unaffiliated/cain] has left #openvpn []
17:44 <@vpnHelper> RSS Update - forum: PrivateTunnel.com : Terms and Conditions : Disclosure <http://forums.openvpn.net/topic8902.html>
17:51 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
18:07 -!- Denial [Denial@drgi.co.uk] has quit []
18:09 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
18:10 -!- leeping [~leeping@171.66.43.251] has quit [Quit: Leaving]
18:16 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
18:26 -!- corretico_ [~luis@200.12.40.18] has quit [Read error: Connection reset by peer]
18:37 -!- diggernet [~walton@75-33-199-224.lightspeed.vcvlca.sbcglobal.net] has joined #openvpn
18:51 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html>
18:52 -!- variable [root@freebsd/developer/variable] has joined #openvpn
18:52 < variable> !welcome
18:52 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:52 < variable> !goal
18:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:54 -!- diggernet [~walton@75-33-199-224.lightspeed.vcvlca.sbcglobal.net] has quit [Quit: Leaving.]
18:55 -!- diggernet [~walton@75-33-199-224.lightspeed.vcvlca.sbcglobal.net] has joined #openvpn
18:55 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 258 seconds]
18:59 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
19:05 -!- diggernet [~walton@75-33-199-224.lightspeed.vcvlca.sbcglobal.net] has quit [Quit: Leaving.]
19:06 -!- diggernet [~walton@75-33-199-224.lightspeed.vcvlca.sbcglobal.net] has joined #openvpn
19:06 -!- diggernet [~walton@75-33-199-224.lightspeed.vcvlca.sbcglobal.net] has left #openvpn []
19:10 -!- Squidy [~quassel@200-101-37-25.cbace702.dsl.brasiltelecom.net.br] has quit [Ping timeout: 260 seconds]
19:12 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
19:15 <@vpnHelper> RSS Update - forum: OpenVPN Performance, specifically number of connections <http://forums.openvpn.net/topic8904.html>
19:15 -!- mirco_ [~mirco@tmo-103-188.customers.d1-online.com] has joined #openvpn
19:16 -!- mirco_ [~mirco@tmo-103-188.customers.d1-online.com] has quit [Read error: Connection reset by peer]
19:16 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has quit [Read error: No route to host]
19:19 -!- Squidy [~quassel@unaffiliated/squidy] has joined #openvpn
19:19 -!- Squidy [~quassel@unaffiliated/squidy] has quit [Read error: Connection reset by peer]
19:21 <@vpnHelper> RSS Update - forum: OpenVPN User Auth + Static key security? <http://forums.openvpn.net/topic8905.html>
19:21 -!- variable [root@freebsd/developer/variable] has left #openvpn ["Overflow in /dev/null"]
19:23 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has joined #openvpn
19:23 -!- foolove [~foolove@pool-71-97-2-243.dfw.dsl-w.verizon.net] has joined #openvpn
19:23 < foolove> i have a openvpn gui client connected to my vpn but when i browse using firefox
19:24 < foolove> on windows it shows my isp ip address so applications are not using the vpn connection
19:27 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has quit [Client Quit]
19:27 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:27 -!- _julian_ [~quassel@hmbg-4d06b632.pool.mediaWays.net] has joined #openvpn
19:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:30 -!- _julian [~quassel@hmbg-4d06a356.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
19:54 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:57 <@vpnHelper> RSS Update - forum: OpenVPN Performance, specifically number of connections <http://forums.openvpn.net/topic8904.html#p16078>
19:58 -!- foolove [~foolove@pool-71-97-2-243.dfw.dsl-w.verizon.net] has quit [Read error: Connection reset by peer]
20:03 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has joined #openvpn
20:09 <@vpnHelper> RSS Update - forum: OpenVPN Performance, specifically number of connections <http://forums.openvpn.net/topic8904.html#p16079>
20:11 -!- foolove [~foolove@pool-71-97-2-243.dfw.dsl-w.verizon.net] has joined #openvpn
20:11 < foolove> i am using openvpn-gui client to connect to my vpn in windows i can connect but when i browse using firefox the connection is not connected to the vpn
20:12 -!- limecat [62da972a@gateway/web/freenode/ip.98.218.151.42] has joined #openvpn
20:12 < limecat> howdy
20:12 < limecat> Someone on the forums indicated that, regardless of hardware, OpenVPN would generally top out at 250 clients per instance due to context switching
20:13 < limecat> I was wondering, on single threaded CPU, whether adding additional instances would make a difference?
20:20 -!- foolove [~foolove@pool-71-97-2-243.dfw.dsl-w.verizon.net] has quit [Quit: Leaving]
20:24 < ecrist> limecat: that was me.
20:24 < ecrist> :)
20:25 < limecat> yes, didnt know if you were on, and saw irc in your sig :)
20:25 < ecrist> on a single threaded CPU, no, it won't help
20:25 < limecat> i figured i had enough itchy questions that IRC woiuld be good
20:25 < limecat> so is the diff that IPsec is kernel mode?
20:25 < ecrist> however, if you have multiple cores, you can run multiple instances of openvpn and get a higher overall connection count
20:26 < ecrist> there are non-kernel-mode implementations of IPSec
20:26 < ecrist> the 250-ish limit is specific to OpenVPN, and is something we've been told, and have seen, in a 'real world' scenario
20:27 < limecat> assuming one was kernel mode, however, it is conceivable that you could get thousands of connections on a normal Xeon?
20:27 < limecat> in ipsec i mean?
20:27 < ecrist> not sure
20:27 < limecat> im trying to figure out whether OpenVPN makes sense if my target is 1000 connections
20:27 < ecrist> not sure what 'normal xeon' means
20:27 < ecrist> Intel has built a processor called 'Xeon' since around 2001
20:27 < limecat> One of the new SandyBridge E3s, 2.2ghz, 2 cores, 4 threads
20:28 < ecrist> well, that's not a single-threaded CPU
20:28 < limecat> the scenario is, we want to replace a Cisco box that does its own type of ipsec, for about 1k clients.  Sounds like OpenVPN is more of a replacement for Cisco's Anyconnect, and that for the bulk an IPsec vpn would make more sense
20:28 < ecrist> and, generally, I suggest staying away from hyperthreading
20:28 < limecat> yea, i know, but 4 instances x 250 is just barely hitting what we want
20:29 < ecrist> here's what I'd suggest
20:29 < ecrist> run one instance, when you start seeing performance tank, start another.
20:29 < ecrist> etc etc etc
20:29 < limecat> well, its a little more complicated.. its a situation where we get access to the computers once a year, configure them, and the users must then have a "heres how to be secure" seminar
20:29 < limecat> kind of hard with 4 instances, and no auto-load balancing :\
20:30 < ecrist> not really
20:30 < ecrist> set up DNS round-robin
20:30 < ecrist> ta-da!
20:30 < limecat> hmmm
20:30 < limecat> but on 2 core, 4 thread CPU thats still ~1k maximum, right?
20:30 < ecrist> *sigh*
20:30 < limecat> id need more boxes I guess
20:31 < ecrist> I'm not saying there's a maximum.  There's a theoretical limit
20:31 < ecrist> FFS try it!
20:31 < limecat> dont have the hardware :D
20:31 < limecat> making a proposal to someone
20:31 < ecrist> ghey
20:31 < limecat> pretty certain we can beat their budget soundly (around 1/3 the cost)
20:31 < limecat> but it would be nice to have a decent idea of what we'll hit
20:32 < ecrist> I'll tell you what, though.  We have an old Dell 1650 with 512MB ram and a PIII 1.266GHz processor that handles a dozen or so connections without issue
20:32 < limecat> it gets even nicer, because im trying to operate in a 2 amp budget
20:32 < ecrist> scale up from there.
20:32 < ecrist> ah, I get you now
20:32 < ecrist> s/limecat/troll/
20:33 < limecat> nono
20:33 < limecat> Xeon E3 1220L
20:33 < limecat> 20watts
20:33 < limecat> :D
20:33 < limecat> openssl indicates 150MB/s
20:33 < limecat> per core
20:33 < limecat> and thats WITHOUT aes-ni support
20:33 < limecat> the only question is max connections
20:34 < ecrist> the truth is, without testing it, you'll never know
20:34 < limecat> its true, and worst case we can upgrade to 15amps
20:34 < limecat> and up the processor, or add extra boxes
20:34 < limecat> wed still probably fly in way under budget
20:34 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:34 < limecat> but, i want to get as much info as possible, and youve been a big help
20:35 < limecat> any thoughts on whether IPsec being kernel mode might be better suited to such a huge deployment?
20:35 < limecat> or no comment? :D
20:36 < ecrist> depends
20:36 < ecrist> if you're talking road-warrior setup, IPSec isn't going to work, generally
20:37 < ecrist> IPSec really requires both sides sit on static IPs
20:37 < ecrist> also, authentication can be a nightmare, with all those static keys flying around and such
20:38 < limecat> i see :(
20:38 < ecrist> last, you get a lot of vendor lock-in with that
20:38 < limecat> ? id be using pfSense, that should avoid that right?
20:38 < limecat> with an open ipsec implementation on the client end
20:39 < ecrist> static IPs everywhere?
20:40 < ecrist> also, with thousands of clients, what kind of shop is this?
20:40 < ecrist> you plan on running a class b subnet on your VPN?
20:46 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:46 -!- rommel092079 [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
20:46 -!- nb [~nb@fedora/znc.nb] has quit [Quit: ZNC - http://znc.in]
20:49 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
20:49 -!- limecat_ [62da972a@gateway/web/freenode/ip.98.218.151.42] has joined #openvpn
20:49 < limecat_> was gonna use mobile ipsec
20:49 < limecat_> doesnt require 2 static IPs, only one
20:50 < ecrist> cool.  enjoy
20:50 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
20:51 -!- limecat [62da972a@gateway/web/freenode/ip.98.218.151.42] has quit [Ping timeout: 252 seconds]
20:53 < limecat_> thanks for all your help tho :)
20:59 < ecrist> np
21:19 -!- miguet [~miguet@121.1.54.50] has quit [Quit: Lost terminal]
21:22 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:23 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
21:37 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
21:39 -!- limecat_ [62da972a@gateway/web/freenode/ip.98.218.151.42] has quit [Ping timeout: 252 seconds]
21:45 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:46 -!- foolove [~foolove@pool-71-97-2-243.dfw.dsl-w.verizon.net] has joined #openvpn
21:47 < foolove> my openvpn client is connecting to my remote vpn the icon shows green using openvpn-gui but no applications are tunneling through vpn
21:47 < foolove> like firefox irc etc still have the isp ip
21:49 < foolove> im using windows by the way
21:53 -!- miguet [~miguet@121.1.54.50] has quit [Remote host closed the connection]
21:54 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
22:06 -!- miguet [~miguet@121.1.54.50] has quit [Remote host closed the connection]
22:09 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has joined #openvpn
22:31 -!- saffx0F [~saff__@host186-125-dynamic.247-95-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
22:32 -!- foolove [~foolove@pool-71-97-2-243.dfw.dsl-w.verizon.net] has quit [Quit: Leaving]
22:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
22:45 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
22:46 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
22:48 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
23:07 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has left #openvpn []
23:15 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
23:18 -!- Ionic [ionic@ionic.de] has joined #openvpn
23:34 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
--- Day changed Sat Oct 01 2011
00:04 -!- miguet [~miguet@121.1.54.50] has quit [Read error: No route to host]
00:12 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Remote host closed the connection]
00:16 -!- hyper_ch [~hyper_ch@adsl-84-226-153-51.adslplus.ch] has joined #openvpn
00:17 < hyper_ch> I have a weird issue.... I can ping one client in the vpn, but I can't ssh into it anymore
00:19 < EugeneKay> Firewall.
00:19 < EugeneKay> or SSHD has gone to space
00:22 < hyper_ch> EugeneKay: I was logged in yesterday
00:22 < hyper_ch> doesn't sound like a firewall issue
00:22 < hyper_ch> how to gain access to that machine then :(
00:27 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
01:03 -!- hyper_ch [~hyper_ch@adsl-84-226-153-51.adslplus.ch] has quit [Remote host closed the connection]
01:04 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
01:06 -!- t_ [~t@67-225-52-49.estv.hsdb.sasknet.sk.ca] has quit [Ping timeout: 260 seconds]
01:17 -!- bitterman [~yury@84.51.192.74] has joined #openvpn
01:17 -!- luneff [~yury@84.51.192.74] has quit [Read error: Connection reset by peer]
01:29 <@vpnHelper> RSS Update - forum: openvpn remote authentication via bash script <http://forums.openvpn.net/topic8802.html#p16080>
01:29 < EugeneKay> Spank it.
01:31 < Olipro> With a paddle.
01:44 -!- darth_bitterman [~yury@84.51.192.74] has joined #openvpn
01:47 -!- bitterman [~yury@84.51.192.74] has quit [Ping timeout: 240 seconds]
01:49 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 244 seconds]
02:03 -!- albech [~albech@183.88.67.163] has joined #openvpn
02:30 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 248 seconds]
03:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:13 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has joined #openvpn
03:14 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Ping timeout: 244 seconds]
03:20 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has quit [Read error: Connection reset by peer]
03:20 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has joined #openvpn
03:21 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 248 seconds]
03:21 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
03:23 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
03:33 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
03:33 -!- alabd [alabd@unaffiliated/alabd] has joined #openvpn
03:34 < alabd> Good day all 
03:34 < alabd> am configuring openvpn on vps , and using this guide http://www.monkeedev.co.uk/blog/2009/03/06/setting-up-openvpn-in-debianubuntu/ but one step it configures server.conf on server that contain a line :  server-bridge 10.1.0.1 255.255.255.0 10.1.0.236 10.1.0.245
03:34 < alabd> which is simply the default gateway, subnet mask, and the start and end  IP’s to assign the clients, and the push route, which pushes specific  routes to all clients.
03:34 < alabd> : but myself have just server ip 
03:34 < alabd> what should be set for default gateway, subnet mask,?
03:34 <@vpnHelper> Title: Setting up OpenVPN in debian/ubuntu « A Million Monkeys (at www.monkeedev.co.uk)
03:57 -!- darth_bitterman [~yury@84.51.192.74] has quit [Read error: Connection reset by peer]
03:57 -!- darth_bitterman [~yury@84.51.192.74] has joined #openvpn
04:07 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has joined #openvpn
04:07 < DeltachaosDeskto> hi @all
04:07 < DeltachaosDeskto> if i have a vpn across the internet with certificate based auth
04:07 < DeltachaosDeskto> do i alsonead tsl auth to be secure?
04:08 < DeltachaosDeskto> i mean they already have certificates. so is the auth encrypted or not?
04:14 < EugeneKay> If you're using OpenVPN, the link between your VPN client and the VPN server will be secured via SSL/TLS. 
04:14 < alabd> EugeneKay: am configring server.conf on openvpn server  , it should have a line like server-bridge 10.1.0.1 255.255.255.0 10.1.0.236 10.1.0.245   , 10.1.0.1 is default gateway, myself have only my server ip , what should be set as getway then ?
04:15 < EugeneKay> alabd - I do not endorse or support bridge mode, sorry.
04:16 < alabd> EugeneKay: at all is it bridge , have a vps server and want make it openvpn server , 
04:16 < EugeneKay> I can't make heads or tails of that sentence.
04:17 < alabd> EugeneKay: there is a vps ok ?
04:17 < alabd> installed openvpn on it and am configuring it to be openvpn server 
04:17 < alabd> k?
04:17 < EugeneKay> Right....
04:18 < alabd> one of configurition steps is creating server.conf as here said http://www.monkeedev.co.uk/blog/2009/03/06/setting-up-openvpn-in-debianubuntu/
04:18 <@vpnHelper> Title: Setting up OpenVPN in debian/ubuntu « A Million Monkeys (at www.monkeedev.co.uk)
04:19 < alabd> server.conf contain a line >  server-bridge 10.1.0.1 255.255.255.0 10.1.0.236 10.1.0.245
04:19 < alabd> is that line required for me?
04:19 < EugeneKay> server-bridge is a mode I do not advise using. Ever.
04:19 < alabd> at all is it required for me because have a server  
04:19 < EugeneKay> As well, that is a very old blog post, and contains some wrong information regarding easy-rsa
04:20 < EugeneKay> !howto
04:20 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:20 < alabd> EugeneKay: have done steps up to server.conf config
04:20 < alabd> can humble remove  server-bridge 10.1.0.1 255.255.255.0 10.1.0.236 10.1.0.245 line ?
04:22 < EugeneKay> You should be using vanilla "routed" mode, in which case it will look something like: server 10.8.0.0 255.255.255.0
04:22 < EugeneKay> See the example server.conf in the HOWTO
04:25 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 248 seconds]
04:25 < alabd> EugeneKay: should humble redo   steps in that guide before server.conf  if want routed
04:26 < EugeneKay> Are you using a translator or something?
04:27 < alabd> EugeneKay: no , with routed does yahoo,gmail,...messenger works ?
04:28 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
04:28 < EugeneKay> If you want to send your traffic "through the vpn", you need to use redirect-gateway def1. All web stuff such as that will work fine with that, if you set up your firewall rules, etc correctly.
04:28 < EugeneKay> !def1
04:29 < EugeneKay> !redirect
04:29 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
04:29 < EugeneKay> Ah, there it is. Bot is slow today.
04:29 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
04:33 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has left #openvpn []
04:33 < alabd> EugeneKay: am going to be confused  , what steps should also to be done on server (that data will redirected to) , client key are created  and CA is generated , now server.conf should be configured yes ?
04:34 < EugeneKay> You need to create keys/certs, configure the server.conf, and set up iptables rules to allow traffic masquerading and outbound ports opened.
04:35 < alabd> EugeneKay: when we connect to openvpn server we just use client.conf and connects...
04:36 < EugeneKay> Ok..... ?
04:39 < alabd> EugeneKay: so for now need a simple server.conf like one is in guide for routed
04:39 < EugeneKay> Copy the one from the HOWTO and adapt to your needs.
04:41 < alabd> http://www.secure-computing.net/index.php/open-source/documentation/howto.html#examples does not open
04:41 < alabd> opened
04:41 < alabd> EugeneKay: would you give me an routed example
04:41 <@vpnHelper> Title: SCN: SCN (at www.secure-computing.net)
04:42 < EugeneKay> See the first howto link, https://www.openvpn.net/howto
04:46 -!- alabd [alabd@unaffiliated/alabd] has quit [Quit: Allah bless you]
04:46 -!- alabd [alabd@unaffiliated/alabd] has joined #openvpn
04:46 < alabd> EugeneKay: The requested URL /index.php/access-server/docs/admin-guides.html was not found on this server.
04:47 < EugeneKay> That's AS. YOu'rel ooking in the wrong place. See this link: https://www.openvpn.net/howto
04:47 < alabd> EugeneKay: NO SAW THERE'
04:48 < EugeneKay> That link is working just fine for me, I really don't think I can help you.
04:49 < alabd> EugeneKay: https://www.openvpn.net/howto is filtered here
04:49 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
04:49 < alabd> opened it with proxy 
04:49 < EugeneKay> Well that will be an issue.
04:50 < alabd> EugeneKay: give me direct link of example , is it https://www.openvpn.net/howto/index.php/access-server/docs/admin-guides.html        ??
04:51 < EugeneKay> The howto is available at this link. https://www.openvpn.net/howto
04:51 < EugeneKay> There's really not much more I can say on the subject.
04:52 < alabd> oh my god , cann't you say yes or no ?
04:52 < alabd> https://www.openvpn.net/howto/index.php/access-server/docs/admin-guides.html
04:52 < alabd> is it the howto ?
04:52 < EugeneKay> <EugeneKay> That's AS. YOu'rel ooking in the wrong place. See this link: https://www.openvpn.net/howto
04:52 < EugeneKay> Access Server is not the "free" openvpn. That's the wrong page.
04:53 < alabd> can not open https://www.openvpn.net/howto/
04:53 < alabd> is there any other example ?
04:57 < alabd> found server.conf.gz in /usr/share/doc/openvpn/examples/sample-config-files
04:59 < alabd> anyone can give me a simple routed server.conf ?
05:01 < alabd> EugeneKay: ok , now have server.conf example , which parts should be adapted ?
05:02 < EugeneKay> Just read through it. The documentation explains it.
05:04 < alabd> EugeneKay:  vps server is my open server  , is it ethernet bridging ?
05:04 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:14 < alabd> EugeneKay: should humble replace 10.8.0.0 with VPS server ip in line server 10.8.0.0 255.255.255.0
05:14 < alabd> ?
05:14 < EugeneKay> I don't know who "humble" is.
05:14 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 260 seconds]
05:14 < alabd> humbled me , does it differ?
05:14 < EugeneKay> I'm not used to conversing with persons who speak in the third person.... it is confusing.
05:15 < EugeneKay> "server 10.8.0.0 255.255.255.0" defines the subnet which will be used for the vpn link. In that case, it's 10.8.0.0/24.
05:16 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
05:16 < alabd> EugeneKay: it means 10.8.0.0 is local address yeah ?
05:16 < EugeneKay> Consult the man page for the exact meaning of what that expands out to.
05:18 < alabd> EugeneKay: someone is waiting me and is in hurry if had time to read man , would not come here at all 
05:21 < alabd> have edited server.conf example up to server 10.8.0.0 255.255.255.0 is there any other part need to be edited ?
05:22 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:22 < EugeneKay> Off the top of my head, the bits relating to the crt/keys, and routes you want to push
05:22 < EugeneKay> Like I said before, the in-line comments with the config file do a great job of documenting how to get it working
05:25 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has quit [Remote host closed the connection]
05:25 < alabd> EugeneKay: have only vps server ip , should  routes be set nessacirly ?
05:26 < EugeneKay> Then nope.
05:27 < alabd> so everything is ok will show you serrver.conf soon 
05:33 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:36 < alabd> EugeneKay: http://pastebin.com/WQT0mHAY 
05:36 < EugeneKay> !configs
05:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
05:37 < EugeneKay> Please remove the comments, per the grep command above ^
05:38 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:39 < alabd> EugeneKay: http://pastebin.com/HR9R0YY5
05:39 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
05:39 < EugeneKay> Looks right.... There's nothing in there to route client traffic via the VPN, isn't that what you need to do?
05:40 < EugeneKay> At least, fundamentally. I'm guessing the key/crt you generated isn't called "servername"
05:44 < alabd> EugeneKay: it's servername , want just give client.conf to person that can connect to cpn server and then can open filtered sites
05:44 < EugeneKay> !redirect
05:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
05:46 < alabd> EugeneKay: would you explain it , can not get it's steps exactly 
05:47 < EugeneKay> You need a line "push redirect-gateway def1" in your server.conf, and server config changes s to allow MASQUERADEd traffic through the firewall
05:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
05:50 < alabd> EugeneKay: server is debian , how to server config changes s to allow MASQUERADEd traffic through the firewall
05:50 < EugeneKay> !ipforward
05:50 < EugeneKay> !nat
05:50 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
05:50 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
05:50 < EugeneKay> !linipforward
05:50 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
05:58 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 248 seconds]
05:59 < alabd> EugeneKay: chmod: cannot access `/etc/rc.d/rc.ip_forward': No such file or directory
06:00 < EugeneKay> I don't have a clue where you came up with that.
06:00 < EugeneKay> Are you using slackware?
06:00 < alabd> debian 
06:00 < alabd> server
06:00 < EugeneKay> Then why did you try the "for slackware" solution?
06:01 < alabd> ohum so did echo 1 > /proc/sys/net/ipv4/ip_forward
06:01 < alabd> and is ok 
06:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
06:01 < EugeneKay> You'll also need to fiddle with iptables. 
06:01 < EugeneKay> !iptables
06:01 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
06:02 < EugeneKay> Oh, where's the factoid I'm looking for
06:02 < EugeneKay> !factoids search masquerade
06:02 <@vpnHelper> No keys matched that query.
06:02 < EugeneKay> !factoids
06:02 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
06:02 < EugeneKay> !linnat
06:02 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
06:02 < alabd> EugeneKay: iptable nat and echo 1 > ... for when we want to direct internet from server to another client 
06:02 < alabd> but now we don;t want internet sharing
06:04 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:05 < alabd> EugeneKay: are you sure we need iptable ?
06:05 < EugeneKay> If you want to grant access to the internet via the vpn server, yes.
06:06 < alabd> so yes
06:14 < alabd> EugeneKay: did also iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE and added push redirect-gateway def1 to server.conf see http://pastebin.com/uQaAZGBU
06:14 < EugeneKay> And, does it work? 
06:14 < alabd> all steps are done ?
06:15 < EugeneKay> Ostensibly. You never know until you try it from the client
06:19 -!- omgub [ps@c-69-138-168-63.hsd1.md.comcast.net] has quit [Ping timeout: 248 seconds]
06:31 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has joined #openvpn
06:37 -!- cpm [~Chip@pool-108-44-131-199.clppva.east.verizon.net] has joined #openvpn
06:37 -!- cpm [~Chip@pool-108-44-131-199.clppva.east.verizon.net] has quit [Changing host]
06:37 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:40 < alabd> EugeneKay:  is client.conf ok ? http://pastebin.com/VeXK5EaH
06:48 < alabd> EugeneKay: are they ok ?ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/client.crt key /etc/openvpn/easy-rsa/keys/client.key
06:49 < alabd> or ca is enoughe /
06:49 -!- hyper_ch [~hyper_ch@adsl-84-226-153-51.adslplus.ch] has joined #openvpn
06:51 -!- mirco [~mirco@tmo-103-188.customers.d1-online.com] has quit [Ping timeout: 260 seconds]
07:28 < alabd> EugeneKay: Sat Oct  1 15:57:44 2011 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
07:34 < alabd> have configured openvpn server but client has problem connecting it 
07:39 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:43 -!- mirco [~mirco@p5B283D24.dip.t-dialin.net] has joined #openvpn
07:45 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:46 < alabd> what's this error for ? Sat Oct  1 16:15:25 2011 TLS Error: TLS handshake failed
07:46 < hyper_ch> the handshake failed
07:46 < alabd> thanks :d
07:46 < alabd> TLS?
07:46 < hyper_ch> transport layer security
07:47 < hyper_ch> the successor of ssl
07:47 < alabd> what does it mean ? 
07:47 < hyper_ch> no secure connection between the two machines could be established
07:47 -!- t_ [~t@67-225-52-49.estv.hsdb.sasknet.sk.ca] has joined #openvpn
07:47 < alabd> why ?
07:48 < hyper_ch> because something went wrong
07:48 < alabd> for example wha?
07:48 < hyper_ch> like failing of the handshake
07:49 < EugeneKay> !logs
07:49 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
07:49 < hyper_ch> now I probably spent enough half-knowledge
07:49 < hyper_ch> EugeneKay: please correct me :)
07:49 < EugeneKay> No, you're right. The handshake failed because the handshake failed.
07:49 < hyper_ch> yey :)
07:49 < EugeneKay> There's really nothing more that can be extracted from that solo error message
07:50  * hyper_ch rocks
07:50 < alabd> ohum
07:50 < alabd> EugeneKay: can it be cause of port blocked by government?
07:50 < hyper_ch> EugeneKay: I did not extract the time and date yet from that error :)
07:50 < hyper_ch> the government can block ports?
07:51 < EugeneKay> You wouldn't get a handshake failed if the port was blocked.... it wouldn't even get as far as failing the handshake.
07:51 < EugeneKay> See !logs again ;-)
07:51 < alabd> EugeneKay: where are logs client and server ?
07:51 < hyper_ch> alabd: depends on the according config where you told to store them - if at all
07:51 < EugeneKay> .....theyr'e wherever you got that log message from.
07:52 < alabd> EugeneKay: got the error in terminal
07:52 < EugeneKay> That would be the logs, then.
07:52 < EugeneKay> Staring at a single line like that won't do any good - context is important.
07:52 < hyper_ch> context is overrated
07:53 < alabd> hyper_ch: this is server.conf http://pastebin.com/uQaAZGBU and this is client.conf http://pastebin.com/eM6PN87J
07:53 < hyper_ch> except if it's helpful to my clients :)
07:53 < EugeneKay> That's !configs, not !logs
07:53 < alabd> now
07:53 < alabd> know
07:54 < hyper_ch> alabd: add to server and client config:
07:54 < hyper_ch> verb 6
07:54 < hyper_ch> log openvpn.log
07:54 < hyper_ch> restart both
07:54 < hyper_ch> and try again
07:55 < hyper_ch> then you should have the log in your openvpn config folder
07:55 < hyper_ch> except if EugeneKay says that is wrong
07:55 < EugeneKay> That oughta do it
07:55 < hyper_ch> EugeneKay: verbosity also ok? just though it can be increased if required
07:56 < EugeneKay> 5 is the recommended debug setting
07:56 < EugeneKay> I don't think 6 gains you anything
07:56 < hyper_ch> :)
07:56 < hyper_ch> alabd: verb 5     
07:58 < alabd> withour verb 5 log http://pastebin.com/CGaaahak
08:02 < alabd> hyper_ch:  EugeneKay verb 5 log http://pastebin.com/wPAmVWJJ
08:03 < hyper_ch> I can't help you anymore with that
08:03 < EugeneKay> Which end is that?
08:03 < alabd> client
08:04 < EugeneKay> While you were fiddling with the server's iptables, did you allow UDP port 1194 through?
08:05 < alabd> just did  iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
08:06 < EugeneKay> Then no.
08:06 < alabd> no ?
08:06 < alabd> ohum
08:06 < EugeneKay> No, you didn't.
08:06 < alabd> so how to allow?
08:06 < EugeneKay> You need something like iptables -t filter -A INPUT -m tcp -p tcp --dport 1194 -j ACCEPT
08:07 < alabd> did it , am waiting to connect
08:07 < alabd> but no result yet
08:09 < alabd> EugeneKay: http://pastebin.com/pmPNhVSi
08:10 < alabd> EugeneKay: let me chenage port to another number ?
08:10 < EugeneKay> Still firewalled. Try a different port? 443, maybe
08:11 < alabd> ok
08:12 < alabd> EugeneKay: 443 udp ?
08:12 < EugeneKay> TCP 443 is morel ikely, but UDP is preferred for performance reasons.
08:14 < alabd> connection refused
08:15 < alabd> EugeneKay: 
08:15 < alabd> http://pastebin.com/sDUMTFCz
08:17 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
08:18 -!- mirco [~mirco@p5B283D24.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
08:20 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:25 -!- mirco [~mirco@p5B283D24.dip.t-dialin.net] has joined #openvpn
08:26 < alabd> EugeneKay: port443 has  the same result as default port http://pastebin.com/sXa7dREA
08:27 -!- mirco [~mirco@p5B283D24.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
08:27 -!- mirco [~mirco@p5B283D24.dip.t-dialin.net] has joined #openvpn
08:32 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:32 < alabd> EugeneKay: this is server log http://pastebin.com/ShDrbR5Q
08:33 < alabd> seems gov has blocked soemthing else :-/
08:36 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
09:04 -!- master_of_master [~master_of@p57B52FF0.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
09:06 -!- master_of_master [~master_of@p57B53BA3.dip.t-dialin.net] has joined #openvpn
09:14 -!- EvilJStoker_ [jstoker@athena.jcs.me.uk] has quit [Changing host]
09:14 -!- EvilJStoker_ [jstoker@unaffiliated/jstoker] has joined #openvpn
09:14 -!- EvilJStoker_ is now known as EvilJStoker
09:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
09:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:30 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
09:37 -!- novaflash [~notme@openvpn/user/novaflash] has quit []
09:38 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
09:38 -!- mode/#openvpn [+v novaflash] by ChanServ
09:59 -!- fbh [fbh@lucifer.frands.net] has quit [Remote host closed the connection]
10:05 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:08 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has joined #openvpn
10:09 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
10:18 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:30 -!- me345 [~me345@75.15.232.163] has joined #openvpn
10:38 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
10:39 < alabd> HAve configured openvpn on debian , this is server.conf http://pastebin.com/5fNKJ9ux and this is client.conf http://pastebin.com/P83m0R7w , but client does not connects and this is server log http://pastebin.com/ShDrbR5Q  , ,how to fix it ?
10:44 < Bushmills> "TLS key negotiation failed to occur within 60 seconds (check your network connectivity)" indicated a possibly firewall problem
10:44 <@vpnHelper> RSS Update - forum: OpenSSL error Win7 x64 <http://forums.openvpn.net/topic8115.html#p16081>
10:45 < Bushmills> assuming that port and protocol in both server and client config match
10:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
10:52 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:54 < alabd> Bushmills: these days gov tries to block vpn , but changed port to 443 and you see it has problem yet , can gov block other thing except port ?
10:57 < Bushmills> port udp/53 or tcp/443 are popular choices
10:58 < alabd> Bushmills: it's 443 udp 
10:58 < Bushmills> well, try those two suggestions, in the same order
10:59 < Bushmills> another possibility is tcp/80
11:04 < alabd> in the same order ? have tried changing port to 2233 udp in server.conf and client.conf and restarted openvpn and yet the same error , is it required to test 53 udp also ?
11:04 < alabd> Bushmills: ^
11:06 < Bushmills> nobody requires you to. 
11:07 < alabd> mean do you think it's cause of port blocking ? 
11:07 < alabd> maybe another thing is blocking
11:07 < alabd> blocked*
11:09 < Bushmills> yes, i do
11:09 < Bushmills> something does.  whether it is one or another thing doesn't matter 
11:18 < alabd> Bushmills: the same error with 53 udp 
11:19 < Bushmills> you can use netcat on both server and client side to verify that packets go from one to the other side.
11:20 < Bushmills> that sidesteps possible problem cause by openvpn config
11:20 < alabd> the error with 80 tcp 
11:21 < alabd> Bushmills: what's exact netcat command ?
11:22 < Bushmills> http://en.wikipedia.org/wiki/Netcat
11:22 <@vpnHelper> Title: Netcat - Wikipedia, the free encyclopedia (at en.wikipedia.org)
11:30 < alabd> Bushmills: nc serverip 80  didnlt show any result return to command line
11:31 < alabd> what does it mean ?
11:34 < alabd> Bushmills: nc -v IP PORT worked and succeeded 
11:34 < alabd> port 80
11:38 < alabd> ?
11:39 < alabd> any opinion ?
11:42 -!- albech [~albech@183.88.67.163] has quit [Quit: Leaving]
12:01 <@vpnHelper> RSS Update - forum: disconnection script only work after system reboot??? <http://forums.openvpn.net/topic8906.html>
12:03 -!- imMute [~immute@about/networking/240.255.255.0/imMute] has joined #openvpn
12:03 -!- imMute [~immute@about/networking/240.255.255.0/imMute] has left #openvpn []
12:03 -!- fread2281 [~fread2281@70-56-210-57.albq.qwest.net] has joined #openvpn
12:07 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has joined #openvpn
12:18 < Bushmills> what do you call "worked"?
12:29 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
12:29 -!- hyper_ch [~hyper_ch@adsl-84-226-153-51.adslplus.ch] has quit [Disconnected by services]
12:29 -!- hyper__ch is now known as hyper_ch
12:29 < alabd> Bushmills: worked means netcat connects to server form client 
12:29 < alabd> it seems gov firewall drops handshake packets
12:31 < Bushmills> you probably want to connect to a netcat listener instead 
12:32 < alabd> Bushmills: what do you mean ?
12:33 < Bushmills> by what?  "you"?  "probably"?
12:35 < alabd> why do you say > you probably want to connect to a netcat listener instead 
12:36 < Bushmills> "you" i use to address alabd in the personal form
12:36 < Bushmills> "probably" is to express that i only guess that you might want to do what follows, without knowing for sure
12:37 < Bushmills> "want" is used, in this context, as the weaker form of "you have to"
12:37 < alabd> Bushmills: don't you get or you don't want get ?
12:37 < alabd> here is not joking channel
12:37 < Bushmills> i can't imagine that you're asking about "netcat listener" as there are plenty of references about that in internet, like http://www.wrgross.com/blogs/security/2010/05/22/yet-another-netcat-introduction/
12:38 <@vpnHelper> Title: Bills Security Blog » Blog Archive » Yet Another Netcat Introduction (at www.wrgross.com)
12:38 < Bushmills> so it must be something else you're asking about
12:38 < alabd> Bushmills: no am saying client connect to server 443 or 80 or so ...so there is not connection problem
12:38 < alabd> problem is that gov firewall drops packages
12:39 < alabd> in tls handshake
12:39 < alabd> likely
12:39 < Bushmills> well, "worked means netcat connects to server form client "  - netcat can't connect to openvpn server
12:40 < Bushmills> but if you're sure it did, fine
12:40 < alabd> :) 
12:43 <@vpnHelper> RSS Update - forum: client-to-client in Dual Server configuration <http://forums.openvpn.net/topic8907.html>
12:47 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has quit [Ping timeout: 260 seconds]
13:09 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Read error: Operation timed out]
13:33 -!- me345 [~me345@75.15.232.163] has quit [Read error: Connection reset by peer]
13:33 -!- me345 [~me345@75.15.232.163] has joined #openvpn
13:48 -!- corretico [~luis@201.201.44.82] has joined #openvpn
14:13 -!- me345 [~me345@75.15.232.163] has quit [Read error: Connection reset by peer]
14:16 < alabd> Bushmills: if had another openvpn account and could test it for 1 min , could know it's this server problem or gov blocked openvpn also
14:19 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has joined #openvpn
14:24 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 240 seconds]
14:38 -!- bitterman [~yury@84.51.192.74] has joined #openvpn
14:39 -!- alabd [alabd@unaffiliated/alabd] has quit [Quit: Allah bless you]
14:42 -!- darth_bitterman [~yury@84.51.192.74] has quit [Ping timeout: 244 seconds]
14:45 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
15:16 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
15:16 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
15:17 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has left #openvpn []
15:19 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
15:26 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
15:26 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
15:30 -!- mirco [~mirco@p5B283D24.dip.t-dialin.net] has quit [Quit: mirco]
15:41 -!- stevefink [steve@shell.vaerchi.com] has quit [Quit: .]
15:42 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has quit [Read error: Operation timed out]
16:06 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
16:12 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16084>
16:14 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
16:14 -!- mode/#openvpn [+v Axeman] by ChanServ
16:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Client Quit]
16:18 <@vpnHelper> RSS Update - forum: OpenVPN User Auth + Static key security? <http://forums.openvpn.net/topic8905.html#p16086> || client-to-client in Dual Server configuration <http://forums.openvpn.net/topic8907.html#p16085>
16:32 -!- bitterman [~yury@84.51.192.74] has quit [Quit: Leaving]
16:42 -!- glitch-mod [~glitch-mo@pool-71-190-229-236.nycmny.fios.verizon.net] has joined #openvpn
17:00 <@vpnHelper> RSS Update - forum: Openvpn between two computers in the same network <http://forums.openvpn.net/topic8908.html>
17:30 <@vpnHelper> RSS Update - forum: PrivateTunnel.com : Terms and Conditions : Disclosure <http://forums.openvpn.net/topic8902.html#p16088>
17:33 -!- glitch-mod [~glitch-mo@pool-71-190-229-236.nycmny.fios.verizon.net] has quit [Quit: Leaving]
17:36 <@vpnHelper> RSS Update - forum: openvpn not connect! <http://forums.openvpn.net/topic8909.html>
17:37 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 256 seconds]
17:44 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
17:49 -!- fread228_ [~fread2281@70-56-128-185.albq.qwest.net] has joined #openvpn
17:49 -!- fread2281 [~fread2281@70-56-210-57.albq.qwest.net] has quit [Ping timeout: 252 seconds]
17:55 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
18:08 -!- xal [~xal@190.172.99.131] has joined #openvpn
18:09 < xal> Hi, I've been trying to solve a problem for the past 3 hours and I can't really figure out if this can be done or not
18:10 < xal> I had openvpn working just fine, but I installed a new server and I need to use that server as the local dhcp server, so naturally, I had to disable dhcp on the router that runs openvpn
18:10 < krzie> i smell a bridge setup
18:10 < xal> ever since that clients can't connect from outside
18:11 < krzie> whats the goal for the vpn, is it tun or tap?
18:11 < xal> I can show you my current config if you want, it might answer all your q's in one quick look
18:12 < krzie> sure, like this:
18:12 < krzie> !configs
18:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
18:13 -!- mirco [~mirco@p5B283D24.dip.t-dialin.net] has joined #openvpn
18:16 < xal> http://pastebin.com/r9Jv07C8
18:16 < xal> ok, think I got it all
18:16 < xal> again, this was working, but ever since I disabled dhcp on the router it stopped working
18:17 < krzie> well ya, cause you are using tap and not handing out ips
18:17 < krzie> so the dhcp server did
18:17 < krzie> why do you need tap?
18:17 < krzie> what layer2 protocol do you use over the vpn?
18:17 < krzie> and most importantly: 
18:17 < krzie> !goal
18:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:18 < xal> ok, goal: I wan't to access my office network from outside
18:19 < xal> using my router as an openvpn server
18:19 < xal> which is a dd-wrt firmware, vpn flavor
18:23 < xal> I don't really know if we need tap, but this has worked for for years until I had to change that dhcp :(
18:27 < krzie> you never needed tap
18:27 < krzie> your setup broke because it relied on that dhcp
18:27 < krzie> however, it shouldnt
18:28 < krzie> !sample
18:28 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
18:28 < krzie> !route
18:28 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
18:28 < krzie> if you ONLY want to share the server lan, it is even easier
18:28 < krzie> !serverlan
18:28 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation
18:28 < krzie> you would literally only need to push the route
18:29 < krzie> since it is a router it has ip forwarding and you dont need to add a route to the router (since it is the vpn server as well)
18:29 < krzie> literally all you should need to change is add the server command, and the push route
18:32 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
18:40 -!- fread2281 [~fread2281@70-56-134-179.albq.qwest.net] has joined #openvpn
18:41 -!- fread228_ [~fread2281@70-56-128-185.albq.qwest.net] has quit [Ping timeout: 244 seconds]
18:44 < xal> oh, sorry, one more thing I forgot to mention, this is the error I was getting with my original config:
18:44 < xal> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
18:49 < xal> openvpn --mktun --dev tap0
18:49 < xal> should that stay the same?
18:50 < xal> the sample uses dev tun, so I could rename it, but I don't know if the params are correct
18:50 < xal> then it does this:
18:50 < xal> brctl addif br0 tap0
18:50 < xal> and this:
18:50 < xal> ifconfig tap0 0.0.0.0 promisc up
18:52 < xal> is renaming those tap0 to tun enough?
18:56 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:56 -!- mode/#openvpn [+v Axeman] by ChanServ
18:58 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16090>
19:01 -!- nb [~nb@fedora/znc.nb] has quit [Quit: ZNC - http://znc.in]
19:02 -!- Denial [Denial@drgi.co.uk] has quit []
19:04 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
19:04 <@vpnHelper> RSS Update - forum: Can connect and ping server, but nothing else <http://forums.openvpn.net/topic8910.html>
19:09 < krzie> no, you dont need any of that now
19:10 < krzie> that was bridging crap, but you never needed a bridge
19:10 < krzie> unless you needed layer2 traffic over the vpn...
19:10 < krzie> i gave you literally everything
19:10 < krzie> just !sample and !serverlan is enough
19:10 < krzie> if you were starting from scratch
19:13 < xal> !ipforward
19:13 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
19:13 < xal> !linipforward
19:13 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
19:17 -!- xal_ [~xal@190.172.89.117] has joined #openvpn
19:19 -!- xal [~xal@190.172.99.131] has quit [Read error: Connection reset by peer]
19:20 < krzie> you wont need that (like i said above)
19:21 < krzie> you run the server on a router, it has ip forwarding enabled
19:21 < krzie> (or it does not work as a router)
19:26 < xal_> ok, I'll keep trying
19:26 < xal_> !route_outside_openvpn
19:26 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) you do not need this if the vpn node IS the gateway for its lan
19:28 < xal_> i'm really lost... your config uses a file for tls-auth... not sure what that is
19:29 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:33 < xal_> and also client-config-dir, never used that
19:34 < krzie> !hmac
19:34 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls static key
19:34 <@vpnHelper> , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
19:34 < krzie> !ccd
19:34 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
19:34 < krzie> you may have noticed that !sample said this:  "DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man)"
19:38 < xal_> ok, so those are optional
19:39 < krzie> yes, although you likely want tls-auth
19:39 < krzie> it only adds to your security
19:39 < xal_> i understand, but for the purposes of getting it working, that can be left for stage 2 :)
19:40 < krzie> correct
19:40 < xal_> once I can get a remote client to connect I will further add to the config, but right now I'munder some serious pressure
19:41 < xal_> thanks for your patience, I really apreciate it
19:42 < krzie> np
19:44 -!- xal [~xal@190.172.73.180] has joined #openvpn
19:47 -!- xal_ [~xal@190.172.89.117] has quit [Ping timeout: 276 seconds]
19:48 -!- fread2281 [~fread2281@70-56-134-179.albq.qwest.net] has quit [Ping timeout: 256 seconds]
19:48 -!- fread2281 [~fread2281@70-56-133-32.albq.qwest.net] has joined #openvpn
19:51 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
19:53 -!- xal_ [~xal@190.172.87.62] has joined #openvpn
19:55 -!- xal [~xal@190.172.73.180] has quit [Ping timeout: 245 seconds]
19:57 -!- W4lth3r is now known as W4lth3r|off
20:02 -!- mirco [~mirco@p5B283D24.dip.t-dialin.net] has quit [Quit: mirco]
20:10 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
20:13 -!- fread228_ [~fread2281@70-56-135-125.albq.qwest.net] has joined #openvpn
20:15 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 258 seconds]
20:15 -!- fread2281 [~fread2281@70-56-133-32.albq.qwest.net] has quit [Ping timeout: 248 seconds]
20:19 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
20:39 -!- fread228_ [~fread2281@70-56-135-125.albq.qwest.net] has quit [Ping timeout: 256 seconds]
20:40 -!- fread2281 [~fread2281@70-56-140-19.albq.qwest.net] has joined #openvpn
20:42 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has quit [Quit: Leaving]
20:59 -!- fread2281 [~fread2281@70-56-140-19.albq.qwest.net] has quit [Ping timeout: 240 seconds]
21:01 -!- fread2281 [~fread2281@70-56-208-243.albq.qwest.net] has joined #openvpn
21:06 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 248 seconds]
21:09 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:22 -!- xal_ [~xal@190.172.87.62] has quit []
21:22 -!- xal [~xal@190.172.87.62] has joined #openvpn
21:30 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:37 -!- albech [~albech@183.88.76.120] has joined #openvpn
21:43 -!- xal [~xal@190.172.87.62] has quit [Ping timeout: 245 seconds]
21:43 -!- xal [~xal@190.172.65.184] has joined #openvpn
21:45 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:46 < xal> ok, so I huffed and I puffed, and I think I spat a bit on my monitor, but no way I'm connecting
21:47 < krzie> !sample
21:47 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
21:47 < krzie> !serverlan
21:47 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation
21:47 < krzie> thats all you need, lol
21:47 < krzie> and "its not working"  will get you that response
21:48 < krzie> if you would like to provide more info, you'll have a better chance of getting more specific help
21:48 < krzie> although im about to leave in a minute
21:48 < xal> I keep getting these errors: read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
21:52 < xal> the firewall port (1194) is open 
22:01 < xal> please, I really need a hand here, I'll pay you $50 if you can sort this out for me
22:24 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:26 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:31 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 248 seconds]
22:37 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:41 -!- xal_ [~xal@190.172.82.131] has joined #openvpn
22:43 -!- xal [~xal@190.172.65.184] has quit [Ping timeout: 255 seconds]
22:59 -!- t_ [~t@67-225-52-49.estv.hsdb.sasknet.sk.ca] has quit [Quit: Leaving]
23:01 -!- xal [~xal@190.172.83.245] has joined #openvpn
23:02 -!- xal_ [~xal@190.172.82.131] has quit [Ping timeout: 248 seconds]
23:14 < xal> ok, turns out the problem was not my vpn config, the router had a missing ntp server setting, and the certificates didn't check out because of the date, after reanabling that everything went back to normal!
23:17 < xal> thanks anyway
23:17 < xal> I'll finally go to bed... good night!
23:17 -!- xal [~xal@190.172.83.245] has quit []
23:28 -!- Titania [~titania@221.120.122.106] has joined #openvpn
23:28 -!- Titania [~titania@221.120.122.106] has quit [Read error: Connection reset by peer]
--- Day changed Sun Oct 02 2011
00:06 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has quit [Quit: Leaving.]
00:29 -!- Ademan [~dan@adsl-70-231-132-233.dsl.snfc21.sbcglobal.net] has joined #openvpn
00:33 -!- alabd [~alabd@unaffiliated/alabd] has joined #openvpn
00:36 -!- alabd1 [alabd@unaffiliated/alabd] has joined #openvpn
00:38 -!- alabd [~alabd@unaffiliated/alabd] has quit [Ping timeout: 248 seconds]
00:40 -!- alabd1 [alabd@unaffiliated/alabd] has quit [Ping timeout: 258 seconds]
00:53 -!- alabd [~alabd@unaffiliated/alabd] has joined #openvpn
00:58 -!- luneff [~yury@84.51.192.74] has joined #openvpn
01:05 -!- alabd [~alabd@unaffiliated/alabd] has quit [Ping timeout: 276 seconds]
01:07 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
01:41 < sobersabre> hooray. we're almost moved into openvpn.
01:41 < sobersabre> I've got a strange question.
01:42 < sobersabre> With our current setup, we must log into the https console (https://server) and get the client.ovpn settings.
01:42 < sobersabre> When using it with the command line tool, it works fine.
01:42 < sobersabre> I am then interested to use gnome's network manager frontend, which would more ... visual.
01:43 < sobersabre> I wrote a simple python code to extract ca.pem, key.pem, cert.pem, and tls-auth.key into files in ~/.ovpn, and chmodding key.pem and tls-auth.key to be user-read only.
01:44 < sobersabre> But, I then thought: it is impossible I am the 1st person to ... need this.
01:44 < sobersabre> (POST factum, as usual)
01:44 < sobersabre> so, question:
01:44 < sobersabre> 1) are there tools to import .ovpn file into the network manager's connection entry settings ?
01:45 < sobersabre> 2) I did try to import client.ovpn file. it simply didn't work.
01:45 < sobersabre> I think the problem is with keys/certs file creation: the gateway was copied, but the files were not chosen properly.
01:45 < sobersabre> this is what pushed me to do this semi-manually.,
01:45 < sobersabre> that's it. waiting for some input.
01:47 < sobersabre> hm my english! 
01:47 < sobersabre> s/interested to use/interested in using/
01:47 < sobersabre> !!!
01:47 < sobersabre> argh.
01:49 < Bushmills> !as
01:49 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
01:50 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
01:50 < Bushmills> assuming "must log into the https console" indicates access server
02:05 < sobersabre> oh, thanks.
02:23 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
02:23 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
02:23 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
02:24 -!- alabd [~alabd@unaffiliated/alabd] has joined #openvpn
03:04 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:13 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
03:13 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
03:26 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has joined #openvpn
03:41 -!- alabd [~alabd@unaffiliated/alabd] has quit [Read error: Connection reset by peer]
03:50 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
03:50 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
03:52 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 258 seconds]
03:52 -!- caemir_ is now known as caemir
03:56 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has joined #openvpn
04:02 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
04:04 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
04:05 -!- alabd [alabd@unaffiliated/alabd] has joined #openvpn
04:06 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has quit [Quit: mirco]
04:17 -!- Ademan [~dan@adsl-70-231-132-233.dsl.snfc21.sbcglobal.net] has quit [Quit: leaving]
04:19 < alabd> Good day all ,have configured openvpn on debian , this is server.conf http://pastebin.com/uQaAZGBU and this is client.conf http://pastebin.com/P83m0R7w , but client does not connects and this is server log http://pastebin.com/ShDrbR5Q  , and also changed port to 443 tcp and trid to connect openvpn when am connected to pptp vpn but have this error http://pastebin.com/gRnZ0sQL   , what does it mean ?
04:21 < Bushmills> "remote 46.19.138.246 1149" ??
04:21 < Bushmills> "port 1194"
04:22 < alabd> no problem edited it by hand
04:22 < Bushmills> it means you need to visit your optician :)
04:23 < alabd> it was my paste problem ,  changed it 
04:24 < Bushmills> "trid to connect openvpn when am connected to pptp vpn" you're aware that pptp is not compatible with openvpn?
04:25 < alabd> no
04:25 < alabd> but error changed
04:26 < alabd> and that TLS handshake error lost
04:31 < Bushmills> !pptp
04:31 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
04:31 <@vpnHelper> read about why to not use pptp or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
04:31 < Bushmills> !notopenvpn
04:31 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
04:31 < Bushmills> ehm, no, not that one
04:32 < Bushmills> !factoids search compatible
04:32 <@vpnHelper> No keys matched that query.
04:35 < alabd> Bushmills: do you see my notes ? why with pptp that TLS handshake fail didn't happen ? here can we be sure that a firewall here is doing something that cause TLS handshake fail
04:36 < Bushmills> i doubt that pptp uses tls/ssl at all
04:37 < EugeneKay> PPTP is not OpenVPN. The reason OpenVPN does not work with PPTP is that OpenVPN is not PPTP, which is therefore not OpenVPN.
04:38 < EugeneKay> If you're trying to make PPTP work with OpenVPN, what you ought to be doing is making OpenVPN work with OpenVPN, not PPTP.
04:38 < EugeneKay> Why? Because OpenVPN is not PPTP.
05:04 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has joined #openvpn
05:09 < alabd> EugeneKay: hello , have you read my notes at all ? does anyone said why openvpn does not work with pptp ?
05:10 < EugeneKay> Because OpenVPN is not PPTP
05:10 < alabd> !
05:21 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has joined #openvpn
05:38 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has quit [Quit: mirco]
05:50 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has left #openvpn []
05:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 276 seconds]
05:57 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
06:00 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:11 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Remote host closed the connection]
06:24 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has joined #openvpn
06:29 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:29 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:29 -!- mode/#openvpn [+v Axeman] by ChanServ
06:35 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Ping timeout: 260 seconds]
06:36 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
06:38 -!- pierreghz [~pierreghz@cust-159-123-111-94.dyn.as47377.net] has joined #openvpn
06:44 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
06:44 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
06:44 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
06:45 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
06:59 -!- Netsplit *.net <-> *.split quits: civillian
07:03 -!- W4lth3r|off is now known as W4lth3r
07:04 -!- Netsplit over, joins: civillian
07:09 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
07:12 -!- Netsplit *.net <-> *.split quits: civillian
07:17 <@vpnHelper> RSS Update - forum: openvpn not connect! <http://forums.openvpn.net/topic8909.html#p16092>
07:34 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
07:37 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has left #openvpn []
07:39 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:39 -!- mode/#openvpn [+v Axeman] by ChanServ
07:45 -!- alabd [alabd@unaffiliated/alabd] has left #openvpn ["Allah bless you "]
07:48 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
07:53 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has joined #openvpn
08:01 -!- thething [~forerunne@static.146.161.47.78.clients.your-server.de] has left #openvpn []
08:23 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has joined #openvpn
08:51 -!- nb [~nb@fedora/znc.nb] has quit [Ping timeout: 244 seconds]
08:53 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
08:57 -!- Guest13264 [~nb@71.19.144.103] has joined #openvpn
09:03 -!- Guest13264 [~nb@71.19.144.103] has quit [Ping timeout: 240 seconds]
09:05 -!- master_of_master [~master_of@p57B53BA3.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
09:06 -!- master_of_master [~master_of@p57B53863.dip.t-dialin.net] has joined #openvpn
09:17 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:35 -!- nb [~nb@71.19.144.103] has joined #openvpn
09:35 -!- j03 [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has joined #openvpn
09:35 -!- nb is now known as Guest66154
09:36 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has quit [Quit: mirco]
09:37 < j03> Hi all. Long story, but basically i'm using a VPN connection for, amoungst other things, online gaming (on a PS3 if that matters). The host openvpn machine is a virtual machine, but with a fairly good processor (I have two cores of an xeon W3520). Will enabling lzo compression help or hinder latency with online gaming?
09:38 < hyper_ch> online games don't push that much data around
09:38 < hyper_ch> I think you could be better off not using lzo compression for speed sake
09:38 < hyper_ch> and of course latency reduction
09:39 < j03> It might be worth mentioning that i'm having to use TCP - will that effect your advice?
09:40 < hyper_ch> you have to use tcp? iiieeks
09:41 < j03> hyper_ch: yeah :(. luckily the latency between my client machine and my openvpn server is only around 11ms
09:41 < hyper_ch> still same advice IMHO
09:41 < hyper_ch> but test both, not that hard to turn it on and off
09:42 -!- j03 [2e69fb42@gateway/web/freenode/ip.46.105.251.66] has quit [Quit: Page closed]
09:42 -!- Guest66154 [~nb@71.19.144.103] has quit [Changing host]
09:42 -!- Guest66154 [~nb@fedora/znc.nb] has joined #openvpn
09:43 -!- Guest66154 [~nb@fedora/znc.nb] has left #openvpn []
09:43 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
10:01 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:07 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
10:12 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:13 -!- SOG [~SOG@112.97.192.14] has joined #openvpn
10:16 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 256 seconds]
10:27 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
10:45 < Dougy> /http://newyork.craigslist.org/mnh/cpg/2628380387.html
10:45 < Dougy> http://newyork.craigslist.org/mnh/cpg/2628380387.html
10:45 <@vpnHelper> RSS Update - forum: certificate <http://forums.openvpn.net/topic8911.html>
10:45 <@vpnHelper> Title: Google Project (Python), Costa Rica 2months- ALL expenses paid (at newyork.craigslist.org)
10:45 <@vpnHelper> Title: Google Project (Python), Costa Rica 2months- ALL expenses paid (at newyork.craigslist.org)
10:52 <@vpnHelper> RSS Update - forum: Varify password problem <http://forums.openvpn.net/topic8899.html#p16095> || tunneling <http://forums.openvpn.net/topic8912.html>
10:59 -!- SOG [~SOG@112.97.192.14] has quit [Quit: SOG]
11:14 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has joined #openvpn
11:33 -!- DeltachaosDeskto [~deltachao@ip-78-94-61-232.unitymediagroup.de] has quit [Quit: Leaving.]
11:33 -!- mfox [~mfox@li363-58.members.linode.com] has joined #openvpn
11:33 < mfox> Hi, can openvpn pre-shared key configured for using with multi-users ?
11:34 < mfox> I've already configured OpenVPN with pre-shared key, but i dont know how to use it with two systems, as TUN ip addresses are not DHCP thing
11:38 < reiffert> !howto
11:38 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:41 -!- donutface [~donut@109.78.227.0] has joined #openvpn
11:42 < donutface> hey guys, just a quick high level question. Can a tap interface have its own interface?
11:42 < donutface> interface? sorry i meant IP address
11:43 < donutface> or does it exclusively bridge onto another interface
11:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:43 -!- mode/#openvpn [+v s7r] by ChanServ
11:44 < reiffert> donutface: the high level answer is: yes.
11:45 -!- mfox [~mfox@li363-58.members.linode.com] has quit [Ping timeout: 248 seconds]
11:46 < donutface> thanks reiffert
11:50 -!- mfox [~mfox@li363-58.members.linode.com] has joined #openvpn
11:51 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
12:01 -!- pierreghz [~pierreghz@cust-159-123-111-94.dyn.as47377.net] has quit [Ping timeout: 248 seconds]
12:01 -!- pierreghz_ [~pierreghz@cust-41-67-111-94.dyn.as47377.net] has joined #openvpn
12:07 -!- mfox [~mfox@li363-58.members.linode.com] has left #openvpn ["Leaving"]
12:15 -!- albech [~albech@183.88.76.120] has quit [Quit: Leaving]
12:15 -!- thething [~forerunne@208.110.85.182] has joined #openvpn
12:35 -!- donutface [~donut@109.78.227.0] has quit [Ping timeout: 248 seconds]
12:44 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
12:45 -!- karname [~roohollah@2.180.27.97] has joined #openvpn
12:54 < karname> Hi , I installed openvpn on ubuntu , but when I want to connect , I see error , my config is : http://pastebin.centos.org/37924 and my log is : http://pastebin.centos.org/37923 , please help me to solve it
12:56 < reiffert> !ubuntu
12:56 <@vpnHelper> "ubuntu" is dont use network manager!
13:02 < karname> vpnHelper : I can't mean , your mean is me don't use or ubuntu doesn't use ?
13:05 < hyper_ch> don't use the network manager to use the vpn connection
13:05 < hyper_ch> establish it manually
13:06 < karname> how ?
13:07 < hyper_ch> use /etc/init.d
13:13 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
13:15 < karname> hyper_ch : in client ? 
13:15 < hyper_ch> karname: how did you try this far to establish the connection?
13:16 < karname> hyper_ch : in server via /etc/init.d/openvpn , and in client via network-manager 
13:16 < hyper_ch> karname: then use in the client also /etc/init.d/openvpn
13:17 < karname> and same setting for client ?
13:17 < hyper_ch> don't know what you mean
13:18 < karname> hyper_ch : how can I configure client in this mode ? where I should put CA ... ?
13:19 < hyper_ch> karname: you should put that into the client.conf
13:22 -!- dking [~DKing@184.82.215.77] has joined #openvpn
13:24 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16096>
13:25 < dking> If I have a public facing server to host openvpn, and I want a private windows client and a private linux client to connect so that the linux client can log into the windows client with RDP, would it be best to use a bridged our routed setup?
13:30 <@vpnHelper> RSS Update - forum: authinfo <http://forums.openvpn.net/topic8890.html#p16097>
13:31 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
13:32 < Bushmills> routed be fine.  check man page for client-to-client
13:32 -!- fbh [fbh@lucifer.frands.net] has quit [Changing host]
13:32 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
13:32 < Bushmills> !tunortap
13:32 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
13:32 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
13:38 < EugeneKay> That really ought to be !routeorbridge
13:39 < EugeneKay> Though I suppose there is still some overhead
13:41 < Bushmills> how about  layer3orlayer2
13:43 < EugeneKay> The use cases for non-tun are: Ye Olde As Shite IPX/SPX games, IPv6(with custom --up scripts), and.... that's it.
13:47 < Bushmills> and "i'm too thick to deal with routes"
13:47 < EugeneKay> No, that's a use case for PPTP, which is not OpenVPN.
13:48 < Bushmills> how about "i found this openvon howto which set it up using tap"
13:48 < Bushmills> openvpn, even
13:53 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 255 seconds]
13:55 < EugeneKay> That's where !howto comes in to play
13:56 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
13:57 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
13:59 -!- drupin [~drupin@unaffiliated/drupin] has joined #openvpn
14:01 -!- drupin [~drupin@unaffiliated/drupin] has left #openvpn []
14:08 -!- pierreghz_ [~pierreghz@cust-41-67-111-94.dyn.as47377.net] has quit [Read error: Connection reset by peer]
14:12 -!- donutface [~donut@109.78.227.0] has joined #openvpn
14:17 -!- donutface [~donut@109.78.227.0] has quit [Remote host closed the connection]
14:24 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
14:24 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
14:24 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:24 -!- mode/#openvpn [+v Axeman] by ChanServ
14:30 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
14:31 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
14:32 -!- karname [~roohollah@2.180.27.97] has quit [Read error: Connection reset by peer]
14:34 -!- karname [~roohollah@2.180.45.190] has joined #openvpn
14:45 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
14:46 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 252 seconds]
14:48 < karname> vpnHelper: I tested it via /etc/init.d/openvpn , but I get this error : TLS Error: TLS key negotiation failed to occur within 60 seconds
14:49 -!- mrbrdomac [~mrbrdomac@static-88.131.16.130.addr.tdcsong.se] has joined #openvpn
14:51 < mrbrdomac> hey guys. I've installed openvpn about 3 times before when my PC was also the router and firewall for my home LAN (internet connection was into this PC directly). I had no problems. But now I have a different setup with a dd-wrt router, and my PC is connected to that router only with 1 cable. I added a route in dd-wrt and the VPN now works but it is reaaaaaaaaly slow. I tried copying 8KB over sambaFS and it took over 5 minutes!
14:51 < mrbrdomac>  any idea? pinging also results in timeouts in more than 50% cases
14:53 < mrbrdomac> i'm using TUN mode btw through UDP, just like I always did it
14:54 < mrbrdomac> The route I am using in dd-wrt is: 10.8.0.0	255.255.255.0	192.168.1.3 	LAN & WLAN. 10.8.0.0 is my VPN subnet, 192.168.1.3 is the IP of the PC running OpenVPN and 192.168.1.1 is the IP of the dd-wrt router. dhcp server is also on the router.
14:59 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
15:01 -!- donutface [~donut@87.192.236.216] has joined #openvpn
15:02 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
15:02 < mrbrdomac> anyone here?
15:04 < donutface> hey guys, I'm just back for a bit more advice. I've purchased a VPS with 1 network interface, I want to run OpenVPN on it and connect to it from my laptop to bypass university port blocking. To complicate things a little further though, I've got a router running DD-WRT at home which I also want to connect up to the VPS. Broadcast packets are critical between my home network and my laptop in 
15:04 < donutface> university which looks like I should be using TAP
15:04 < donutface> now my VPS only has 1 interface which has a public IP address
15:04 < donutface> can I use tap without binding to a physical interface, and just set up some routing software on my VPS?
15:05 < donutface> I dont want to connect directly to my home network due to its slow connection and dynamic ip address
15:05 < donutface> and I dont want my home networks traffic to go through the VPS unless I manually specify a gateway
15:08 < mrbrdomac> it looks like this channel is dead -_-
15:11 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:12 -!- donutface [~donut@87.192.236.216] has quit [Ping timeout: 252 seconds]
15:12 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has quit [Quit: leaving]
15:15 -!- donutface [~donut@87.192.236.216] has joined #openvpn
15:15 < Bushmills> !tunortap
15:15 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
15:15 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
15:15 < Bushmills> donutface: ^^^
15:16 < donutface> Bushmills I'm doing a university project that depends on UDP broadcast packets
15:16 < donutface> security isnt a big issue for me and neither is the extra overhead
15:16 < donutface> but if it isnt really feasable I can do tun
15:16 < Bushmills> tap is just a virtual interface. no need to bind it anywhere to
15:17 < Bushmills> you'd use a bridge device to bind a tap device or a physical device to anything else
15:17 < donutface> ok I think I might just be missing the command to create the tap device
15:17 < donutface> as I'm running openvpn on tap but when i do ifconfig I get a tun0
15:17 < reiffert> I already answered him his "high level" question earlier today.
15:18 < donutface> reiffert I appreciate that
15:18 < Bushmills> ah. that was for second opinion then?
15:18 < donutface> no it wasnt for a second opinion
15:18 < Bushmills> third opinion?
15:18 < donutface> I just wanted to know if what I was doing could be done in the way that I'm doing it
15:18 < donutface> I went ahead and configured openvpn but couldnt ping and I saw only a tun0
15:18 < donutface> and then any instructions to create a tap0 involved bridging so I thought I might have misunderstood something
15:19 < reiffert> bla bla bla
15:19 < reiffert> !howto
15:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:19 < mrbrdomac> reiffert do you have any suggestion for me too?
15:19 < donutface> dont worry I'm not looking for anyone to configure anything for me
15:20 < reiffert> mrbrdomac: dont follow donutface. Is that enough for you or do you need further advice?
15:20 < mrbrdomac> what?
15:20 < Bushmills> sounds like your session earlier today was kind of exhausting?
15:21 < reiffert> Bushmills: 18:44
15:21 < Bushmills> ah.  hsv-s04
15:24 < mrbrdomac> well if anyone has any idea please tell me in the forum https://forums.openvpn.net/topic8913.html
15:24 <@vpnHelper> Title: OpenVPN Support Forum Incredibly slow connection <1KB/s : Configuration (at forums.openvpn.net)
15:24 -!- mrbrdomac [~mrbrdomac@static-88.131.16.130.addr.tdcsong.se] has quit [Quit: Leaving]
15:26 <@vpnHelper> RSS Update - forum: Incredibly slow connection <1KB/s <http://forums.openvpn.net/topic8913.html>
15:27 < donutface> thanks for your help  reiffert and Bushmills, I found out where I went wrong, my tap0 interface was just down and not configured. Further more I had dev tap instead of dev tap0
15:27 < donutface> everything works now :)
15:30 < donutface> I never realised interfaces that are down arent displayed in ifconfig
15:40 < Optic> moo moo
15:43 -!- donutface [~donut@87.192.236.216] has quit [Ping timeout: 244 seconds]
15:43 -!- donutface [~donut@87.192.236.216] has joined #openvpn
16:09 -!- v00t [~voot@c-68-59-33-9.hsd1.sc.comcast.net] has joined #openvpn
16:11 < v00t> i am setting up a preshared key openvpn connection between two networks on separate subnets. I want any system on either network to be able to reach any other system on either network. I have the routes set properly such that any traffic destined for the other network subnet is directed at the openvpn host. Unfortunately, pinging is not replying. I have iptables set to allow all on everything, and
16:11 < v00t>  I have NAT enabled on the tun0 interfaces on both systems. ip_forward is 1 on both openvpn hosts
16:11 < v00t> does anyone know what problem i might have?
16:13 -!- karname [~roohollah@2.180.45.190] has quit [Ping timeout: 248 seconds]
16:15 < Bushmills> !route
16:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
16:15 < v00t> i'll read it - thanks!
16:17 -!- karname [~roohollah@2.180.45.190] has joined #openvpn
16:19 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:24 -!- donutface [~donut@87.192.236.216] has quit [Remote host closed the connection]
16:27 <@vpnHelper> RSS Update - forum: Can connect and ping server, but nothing else <http://forums.openvpn.net/topic8910.html#p16099>
16:36 < v00t> can a ccd client config  be named after the ip address, or does it need to be the hostname?
16:40 < Bushmills> the CN is used - you can set CN to something looking like an ip address
16:40 < v00t> the cn being the hostname of the system, i assume?
16:40 < Bushmills> !cn
16:41 < Bushmills> common name - an arbitrary string set during key generation/signing
16:41 < v00t> ah - that doesn't have context for a psk auth, i think...
16:42 < Bushmills> ccd with psk seems pointless
16:43 < v00t> yeah - i'm beginning to realize - i was just following the !route link
16:46 -!- karname [~roohollah@2.180.45.190] has quit [Ping timeout: 276 seconds]
16:57 < krzie> not just pointless, but actually 100% invalid
16:57 < krzie> as in, openvpn will not accept it
17:07 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
17:07 -!- thething [~forerunne@208.110.85.182] has left #openvpn []
17:10 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
17:10 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
17:12 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
17:15 -!- mirco__ [~mirco@p5B284391.dip.t-dialin.net] has joined #openvpn
17:18 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
17:18 -!- mirco__ is now known as mirco
17:20 -!- Netsplit *.net <-> *.split quits: caesay, DeathWolf, SJr, _____m, TheRedOctober, _zero_, R-66Y, @dazo_afk, bassliner
17:21 -!- Netsplit *.net <-> *.split quits: gremly, MrWGW, kusznir, fremo_, aef, scampbell, Essobi, oc80z, Olipro, troyt,  (+3 more, use /NETSPLIT to show all of them)
17:23 -!- Netsplit over, joins: DeathWolf, R-66Y, TheRedOctober, _____m, caesay, bassliner, _zero_, @dazo_afk, SJr, gremly (+12 more)
17:23 -!- mode/#openvpn [+v oc80z] by ChanServ
17:23 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 260 seconds]
17:26 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
17:41 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
17:44 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
17:45 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
17:50 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
17:50 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
17:50 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
18:08 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
18:31 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
18:45 < v00t> If I set a route from a system on a lan to an openvpn server running a tun on 10.8.0.1, routing 10.8.0.1/30 to 10.0.0.5, should i expect a reply from ping 10.8.0.1 or 10.8.0.2?
18:46 < v00t> the server is running on the same lan as the system
19:00 < v00t> never mind 
19:00 -!- v00t [~voot@c-68-59-33-9.hsd1.sc.comcast.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 3.6.23/20110920075126]]
19:21 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has quit [Read error: No route to host]
19:22 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:23 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has joined #openvpn
19:26 -!- _julian_ [~quassel@hmbg-4d06b632.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:28 -!- _julian [~quassel@hmbg-5f76151b.pool.mediaWays.net] has joined #openvpn
19:56 -!- fread2281 [~fread2281@70-56-208-243.albq.qwest.net] has left #openvpn ["Leaving..."]
19:59 -!- luneff [~yury@84.51.192.74] has quit [Read error: Connection reset by peer]
19:59 -!- luneff [~yury@84.51.192.74] has joined #openvpn
20:11 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has quit [Read error: No route to host]
20:11 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has joined #openvpn
20:12 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
20:19 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:20 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
20:21 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
20:30 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
20:32 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
20:34 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
20:35 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
20:50 -!- fread2281 [~fread2281@70-56-210-213.albq.qwest.net] has joined #openvpn
20:57 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 252 seconds]
20:57 -!- mirco [~mirco@p5B284391.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
21:03 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
21:03 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
21:03 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:03 -!- mode/#openvpn [+v Axeman] by ChanServ
21:04 -!- mirco [~mirco@p5B283BBA.dip.t-dialin.net] has joined #openvpn
21:22 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
21:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
21:37 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:02 <@vpnHelper> RSS Update - forum: Varify password problem <http://forums.openvpn.net/topic8899.html#p16102>
--- Day changed Mon Oct 03 2011
00:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
00:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:24 -!- fread2281 [~fread2281@70-56-210-213.albq.qwest.net] has quit [Read error: Connection reset by peer]
00:25 -!- fread2281 [~fread2281@70-56-210-213.albq.qwest.net] has joined #openvpn
00:58 < Bushmills> ah. seems that openvpn has a good sense for pointless combinations of configuration statements
01:11 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 256 seconds]
01:19 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:25 -!- dazo_afk is now known as dazo
01:28 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
01:38 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:43 -!- luneff [~yury@188.114.33.171] has joined #openvpn
01:45 -!- bitterman [~yury@188.114.33.171] has joined #openvpn
01:48 -!- luneff [~yury@188.114.33.171] has quit [Ping timeout: 260 seconds]
01:50 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:53 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
01:54 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:57 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
01:59 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:03 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
02:09 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
02:18 < Mowi> Morning
02:19 < EugeneKay> Mrh.
02:19 < krzee> moin
02:28 -!- bitterman [~yury@188.114.33.171] has quit [Quit: Leaving]
02:28 -!- luneff [~yury@188.114.33.171] has joined #openvpn
02:33 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:33 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Client Quit]
02:35 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:35 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:37 -!- Azrael808 [~peter@212.161.9.162] has quit [Client Quit]
02:38 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
02:46 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 244 seconds]
02:51 -!- IsilZha [~andreas@182.55.249.154] has joined #openvpn
02:53 -!- IsilZha [~andreas@182.55.249.154] has quit [Remote host closed the connection]
02:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:59 -!- IsilZha [~andreas@182.55.249.154] has joined #openvpn
03:13 < IsilZha> hello. i'm having trouble connecting a client (running on win7). it has a static ip set for its adapter. unfortunately the tap adapter doesn't connect with this setup. once i let the adapter have a dynamic ip, the tap device does connect. any pointers to what i might need to read up on to get this setup working witht he static ip?
03:14 < Bushmills> !ccd
03:14 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
03:14 < Bushmills> ifconfig-push from ccd file
03:14 < Bushmills> !iporder
03:14 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
03:15 < IsilZha> Bushmills: thank you. i'll have a look at these.
03:27 -!- batrick [~batrick@nmap/developer/batrick] has quit [Read error: Operation timed out]
03:28 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
03:37 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16103>
03:43 <@vpnHelper> RSS Update - forum: Incredibly slow connection <1KB/s <http://forums.openvpn.net/topic8913.html#p16106> || tunneling <http://forums.openvpn.net/topic8912.html#p16105> || certificate <http://forums.openvpn.net/topic8911.html#p16104>
04:04 -!- fread2281 [~fread2281@70-56-210-213.albq.qwest.net] has quit [Ping timeout: 240 seconds]
04:05 -!- fread2281 [~fread2281@70-56-128-210.albq.qwest.net] has joined #openvpn
04:17 < bandroidx> im getting a TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
04:17 < bandroidx> error
04:17 < bandroidx> but there is no firewall issue
04:17 < bandroidx> 5 servers i installed this on, all with no problems in the same datacenter, the exact same setup
04:17 < bandroidx> this server is the only one and with verbosity set all the way up I am not getting any helpful info
05:01 <@vpnHelper> RSS Update - forum: Use signed certificate <http://forums.openvpn.net/topic8914.html>
05:01 < reiffert> bandroidx: check the OS system time/date
05:05 -!- brian [~fahimi@2.176.152.13] has joined #openvpn
05:05 < brian> hi
05:05 -!- brian is now known as Guest82013
05:10 -!- Guest82013 [~fahimi@2.176.152.13] has left #openvpn []
05:17 -!- albech [~albech@61.7.177.21] has joined #openvpn
05:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
05:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
05:35 -!- deep_blue [~fahimi@2.176.152.13] has joined #openvpn
05:35 < deep_blue> hi
05:35 < deep_blue> anyone can help me in openvpn config?
05:35 -!- michal` [~michal@www.rsbac.org] has joined #openvpn
05:35 < michal`> hey
05:35 < michal`> have you experienced something like this
05:36 < michal`> if i'm trying to connect to openvpn service via every possible internet connection - it works well
05:36 < michal`> if i try to connect using my mobile provider - it fails
05:37 < michal`> i'm in range, actualy hsdpa is working
05:37 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:37 < michal`> i have some other server and i don't use ta.key on that - and gues what - it works
05:37 < michal`> so isp is not blocking 1194
05:38 < deep_blue> anyone can help me?
05:38 < deep_blue> https://forums.openvpn.net/topic8909.html
05:38 <@vpnHelper> Title: OpenVPN Support Forum openvpn not connect! : Installation Help (at forums.openvpn.net)
05:41 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Quit: leaving]
05:43 -!- defswork_ [~andy@mx2.3gcomms.co.uk] has quit [Read error: Operation timed out]
05:43 < michal`> strange, the only difference aside from that ta.key
05:43 < michal`> is that i can connect to servers using tcp
05:43 < michal`> and i cannot to servers using udp
05:43 < michal`> why it would be the case
05:46 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
05:46 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
05:49 -!- michal` [~michal@www.rsbac.org] has left #openvpn [">/dev/yachill"]
05:51 < bandroidx> reiffert:  they are perfect, it will work if i set the protocol to tcp
05:51 < bandroidx> but not with udp
05:51 < bandroidx> i assume maybe its an older or retarded router at the datacenter for this server perhaps?
05:58 -!- deep_blue [~fahimi@2.176.152.13] has quit [Read error: Connection reset by peer]
06:01 -!- deep_blue [~fahimi@2.176.152.13] has joined #openvpn
06:01 < deep_blue> help meee
06:02 < reiffert> !mtu
06:02 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
06:03 < dropje> deep_blue: you're topic has been closed since you're are a deleted user on the forum by spamming. it will not help you to keep asking for help like this
06:06 < deep_blue> so what should i do?
06:06 < deep_blue> ecrist unbanned me from forum
06:07 < deep_blue> i didn't know that pm to admins is bad. so i want help of them.
06:07 < deep_blue> wanted
06:07 < deep_blue> now how can i get helped?
06:08 < dropje> deep_blue: is there any specific reason you're using the tcp protocol instead of udp?
06:08 < dropje> !tcp
06:08 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
06:09 < dropje> deep_blue: have you tried a setup without using the pam lib to authenticate?
06:09 < deep_blue> no
06:10 < deep_blue> i found manual installation on webhostingtalk.com/showthread.php?t=1024872. and i did it
06:10 < deep_blue> i'm not expert on openvpn
06:10 < dropje> instead try reading the openvpn howto, its really good..
06:10 < dropje> !howto
06:10 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:11 < deep_blue> have it include user authentication in connections?
06:11 < dropje> ofcourse you have user authentication, but it doesnt use the pam lib if thats what you mean
06:12 < deep_blue> aha
06:12 < deep_blue> thank you for your answer
06:12 < deep_blue> i try it now
06:12 < dropje> good luck
06:12 < deep_blue> :)
06:13 -!- ccesario [~ccesario@187.17.166.162] has quit [Read error: Connection reset by peer]
06:15 -!- ccesario [~ccesario@189-29-35-68-ac.cpe.vivax.com.br] has joined #openvpn
06:16 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
06:18 -!- cocoa117 [~cocoa117@wk-28-232.guest.rdg.ac.uk] has joined #openvpn
06:19 -!- corretico [~luis@201.201.44.82] has joined #openvpn
06:22 -!- deep_blue [~fahimi@2.176.152.13] has quit [Ping timeout: 240 seconds]
06:30 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
06:35 <@vpnHelper> RSS Update - forum: Varify password problem <http://forums.openvpn.net/topic8899.html#p16108>
06:47 -!- cocoa117 [~cocoa117@wk-28-232.guest.rdg.ac.uk] has quit [Quit: Leaving]
06:47 <@vpnHelper> RSS Update - forum: Use signed certificate <http://forums.openvpn.net/topic8914.html#p16109>
06:53 -!- deep_blue [~fahimi@2.176.152.13] has joined #openvpn
06:53 <@vpnHelper> RSS Update - forum: [SOLVED] Verify password problem <http://forums.openvpn.net/topic8899.html#p16110>
06:54 < deep_blue> what does this mean?
06:54 < deep_blue> TLS  Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
06:55 -!- deep_blue [~fahimi@2.176.152.13] has quit [Client Quit]
07:01 < EugeneKay> It means TLS key negotiation failed to occur within 60 seconds, and you should check your network connectivity, firewall settings, and server-side logs.
07:01 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:01 < dropje> EugeneKay: you were too fast ;) had a paste ready
07:02 < dropje> You get the error message: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity). This error indicates that the client was unable to establish a network connection with the server.
07:04 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Read error: Connection reset by peer]
07:04 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
07:04 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
07:04 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
07:04 -!- mode/#openvpn [+v novaflash] by ChanServ
07:09 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
07:10 -!- cocoa117 [~cocoa117@wk-28-232.guest.rdg.ac.uk] has joined #openvpn
07:15 <@vpnHelper> RSS Update - forum: Use signed certificate <http://forums.openvpn.net/topic8914.html#p16111>
07:17 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
07:27 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html>
07:33 <@vpnHelper> RSS Update - forum: Use signed certificate <http://forums.openvpn.net/topic8914.html#p16113>
07:39 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16114>
07:40 -!- merlin1991 [~merlin@Maemo/community/cssu/merlin1991] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
07:42 -!- hudony [~chatzilla@modemcable078.217-70-69.static.videotron.ca] has joined #openvpn
07:42 < hudony> Hi, having issue with bridged vpn server
07:42 < hudony> Anyone willing to help me a bit? :S
07:48 -!- hudony [~chatzilla@modemcable078.217-70-69.static.videotron.ca] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
07:51 <@vpnHelper> RSS Update - forum: Use signed certificate <http://forums.openvpn.net/topic8914.html#p16115>
07:56 < bandroidx> EugeneKay: i am getting that error on one of 5 servers
07:56 < bandroidx> actually 2 of 6 now
07:56 < bandroidx> they require tcp to work
07:56 < EugeneKay> I need more than one line of log to be able to tell you what the issue is.
07:56 < bandroidx> exact setup was duplicated across 6 servers via a script
07:57 < bandroidx> its on a dedicated server
07:57 < bandroidx> no hw firewall
07:57 < bandroidx> no sw firewall
07:57 < bandroidx> client can connect to the other 4 servers fine
07:57 < bandroidx> so not a client firewall issue
07:58 < bandroidx> i did verb 7
07:58 < bandroidx> and still its just a bunch of P_CONTROL_HARD_RESET_CLIENT_V2
07:58 < bandroidx> basically the client sends them to the server, the server receives them
07:58 < bandroidx> adn sends them back
07:58 < bandroidx> and the client never gets them back
07:59 < bandroidx> from what i can tell
08:00 < EugeneKay> Ok, here's the key point: Neither I, nor anybody else, can decipher you summarizing the log entries. Paste the logs if you want some pointers in how to fix the issue.
08:00 < bandroidx> kk
08:02 -!- fread2281 is now known as fread2281[afk]
08:04 < bandroidx> EugeneKay: http://pastebin.com/c2ft39wz
08:06 < EugeneKay> That's all french to me. What's it look like with verb 5?
08:06 < bandroidx> just the tls error
08:06 < bandroidx> thats it
08:07 < EugeneKay> No RWWWWRRWWWWW spam?
08:07 < bandroidx> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity). This error indicates that the client was unable to establish a network connection with the server.
08:07 < bandroidx> nope
08:07 < bandroidx> i saw that in a mailing log post i found via google
08:07 < EugeneKay> Hm. TCP? Can you establish a socket by telnetting to the remote port?
08:07 < bandroidx> TCP works fine yes
08:07 < bandroidx> how?
08:07 < bandroidx> just telnet to the port and then what?
08:08 < bandroidx> but tcp isnt a problem
08:08 < bandroidx> udp is what doesnt work
08:08 < EugeneKay> Ah, so TCP does work, but not UDP.
08:08 < bandroidx> yep
08:08 < EugeneKay> You should be seeing WWWW spam on the client side, then.
08:08 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
08:09 < bandroidx> i dont think so
08:09 < bandroidx> 1 sec
08:11 < bandroidx> nope
08:11 < bandroidx> at verb 6
08:11 < bandroidx> this is the output
08:11 < bandroidx> http://pastebin.com/y8vJBcen
08:12 < EugeneKay> Are you using --tls-auth or anything like that?
08:12 < bandroidx> no
08:12 < bandroidx> all 6 servers use the same config generated from a script with the basic options
08:13 < bandroidx> nothing fancy or extra at all
08:13 < bandroidx> my guess was the datacenter had some old funky routers
08:13 < bandroidx> and 2 of the 6 servers were on it
08:14 < bandroidx> weird is the 2 with issues are gbit i think but one is gigabit and is fine
08:14 < bandroidx> i think its 3 100mbit all fine, 3 gbit - 1 fine, 2 need tcp
08:17 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
08:18 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:18 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:18 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:18 -!- mode/#openvpn [+v Axeman] by ChanServ
08:30 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16116>
08:31 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 256 seconds]
08:36 <@vpnHelper> RSS Update - forum: Openvpn between two computers in the same network <http://forums.openvpn.net/topic8908.html#p16117>
08:45 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
08:49 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
09:00 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
09:05 -!- master_of_master [~master_of@p57B53863.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
09:06 -!- master_of_master [~master_of@p57B549F8.dip.t-dialin.net] has joined #openvpn
09:07 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
09:09 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Ping timeout: 245 seconds]
09:14 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 255 seconds]
09:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:21 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
09:21 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
09:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:31 -!- luneff [~yury@188.114.33.171] has quit [Quit: This computer has gone to sleep]
09:47 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:54 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
09:57 -!- mirco [~mirco@p5B283BBA.dip.t-dialin.net] has quit [Quit: mirco]
09:58 -!- mirco [~mirco@p5B283BBA.dip.t-dialin.net] has joined #openvpn
10:02 -!- mirco [~mirco@p5B283BBA.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
10:03 -!- luneff [~yury@84.51.192.74] has joined #openvpn
10:03 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16118>
10:14 -!- albech [~albech@61.7.177.21] has quit [Quit: Leaving]
10:16 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:17 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
10:22 <@vpnHelper> RSS Update - forum: Incredibly slow connection <1KB/s <http://forums.openvpn.net/topic8913.html#p16119>
10:23 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
10:23 -!- mode/#openvpn [+o raidz] by ChanServ
10:46 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
10:54 -!- crow [~crowmo@84.112.79.173] has joined #openvpn
10:59 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 256 seconds]
11:02 -!- fread228_ [~fread2281@70-56-208-85.albq.qwest.net] has joined #openvpn
11:03 -!- iNeal [~Neal@rev.ineal.me] has joined #openvpn
11:04 -!- fread2281[afk] [~fread2281@70-56-128-210.albq.qwest.net] has quit [Ping timeout: 260 seconds]
11:06 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
11:22 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
11:25 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Remote host closed the connection]
11:35 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
11:36 -!- mirco [~mirco@p5B283BBA.dip.t-dialin.net] has joined #openvpn
11:37 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
11:49 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 265 seconds]
12:06 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
12:06 -!- dazo is now known as dazo_afk
12:08 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
12:09 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
12:38 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 252 seconds]
12:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:40 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
12:40 -!- nickzxcv [foobar@schmalenberger.us] has quit [Ping timeout: 258 seconds]
12:41 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
12:45 -!- peper [~peper@gentoo/developer/peper] has quit [Remote host closed the connection]
12:45 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
12:54 -!- steelnwool [~jmacdonal@50-56-33-105.static.cloud-ips.com] has joined #openvpn
12:54 < steelnwool> I want to make all my vpn users use a specific DNS server, would it be reasonalbe to put a caching dns server on my vpn machine and just use iptables to redirect all port 53 traffic to it?
12:55 < steelnwool> i ask this way because only oneo f my users is windows.
12:56 <@vpnHelper> RSS Update - forum: Few questions from a newbie <http://forums.openvpn.net/topic8916.html>
12:57 < SviMik> you can push DNS IP address to users
12:57 < steelnwool> svimik i read caveats that say it really only works well with windows. untrue?
12:57 < SviMik> don't know, my users use windows...
12:57 < ecrist> well, on linux and other machines, you need to have a script do something with the information passed
12:58 < steelnwool> right, this is what i thought.
12:58 < ecrist> tunnelblick on mac os x handles it OK
12:58 < steelnwool> tunnelblick with or without the up/down scripts?
12:58 < ecrist> they're built in to tunnelblick
12:59 < steelnwool> cool. know about viscosity by any chance?
12:59 < ecrist> nope
12:59 < steelnwool> cool. i'll check. thanks
12:59 < ecrist> that's for pay, so I don't use it
13:00 < steelnwool> does it actually change the contents of resolv.conf ?
13:01 < ecrist> os x doesn't use resolv.conf
13:01 < steelnwool> hehe, guess what tho?
13:01 < steelnwool> the file still updates for some reason.
13:01 < steelnwool> and the dhcp-option worked wth viscosity. so i guess it works.
13:02 < steelnwool> and when you disconnect resolv.conf changes back.
13:35 -!- maxJadi [~maxJadi@dhcp-140-71.vpn.chalmers.se] has joined #openvpn
13:35 -!- maxJadi [~maxJadi@dhcp-140-71.vpn.chalmers.se] has quit [Changing host]
13:35 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
13:37 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 252 seconds]
13:40 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
13:49 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 258 seconds]
13:49 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
13:49 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
13:49 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
13:58 < steelnwool> ha, however it mangels your search domains.
14:01 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
14:03 <@vpnHelper> RSS Update - forum: VPN Monitoring - How to get notification when no link? <http://forums.openvpn.net/topic8917.html>
14:09 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
14:10 -!- cocoa117 [~cocoa117@wk-28-232.guest.rdg.ac.uk] has quit [Quit: Leaving]
14:11 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
14:11 -!- mode/#openvpn [+o raidz] by ChanServ
14:22 -!- oraqol1 [~johan@d92h221.public.uconn.edu] has joined #openvpn
14:23 < oraqol1> hello all
14:23 < oraqol1> i have a quick question, I set up a routed vpn on a virtual debian server with 2 nics, one pointing out of network and one pointing into a nested virtual switch
14:24 < oraqol1> i can ping the internal IPs from an external one, but when I run nmap from external it cannot detect a whole bunch of ports I know are open (i can nmap them from internal IPs)  Any idea why this is happening?  Should I be using bridged tunnelling, will that make a difference?
14:25 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:27 < oraqol1> Anyone?  Beuller?
14:28 < ecrist> not very patient, eh?
14:28 < ecrist> one of two things is going on
14:28 < ecrist> 1) you have a misconfigured firewall
14:28 < ecrist> or 
14:29 < ecrist> 2) you're not routing from inside to the vpn properly
14:30 -!- fread2281[afk] [~fread2281@70-56-209-128.albq.qwest.net] has joined #openvpn
14:32 -!- fread228_ [~fread2281@70-56-208-85.albq.qwest.net] has quit [Ping timeout: 258 seconds]
14:33 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
14:36 -!- fread228_ [~fread2281@70-56-210-9.albq.qwest.net] has joined #openvpn
14:36 -!- fread2281[afk] [~fread2281@70-56-209-128.albq.qwest.net] has quit [Ping timeout: 248 seconds]
14:50 < Essobi> Beuller?  Has anyone seen Ferris?
14:55 -!- fread2281[afk] [~fread2281@70-56-141-129.albq.qwest.net] has joined #openvpn
14:57 -!- fread228_ [~fread2281@70-56-210-9.albq.qwest.net] has quit [Ping timeout: 260 seconds]
14:58 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
15:12 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Quit: Leaving.]
15:12 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
15:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
15:14 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
15:18 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:22 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
15:25 -!- fread2281[afk] [~fread2281@70-56-141-129.albq.qwest.net] has quit [Ping timeout: 255 seconds]
15:28 -!- fread2281[afk] [~fread2281@70-56-135-21.albq.qwest.net] has joined #openvpn
15:47 <@vpnHelper> RSS Update - forum: Use signed certificate <http://forums.openvpn.net/topic8914.html#p16122>
15:47 < reiffert> !seen ferris
15:47 <@vpnHelper> I have not seen ferris.
15:47 < Jikan> Ferris a été vu(e) pour la dernière fois Mon Apr  4 23:30:43 2011 changeant son nick pour Guest50963 sur #ZERO-RAWS
15:50 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
15:50 -!- mode/#openvpn [+v Axeman2] by ChanServ
15:50 -!- Ionic [ionic@ionic.de] has quit [Read error: Operation timed out]
15:51 -!- Tick-Tock [~Tick-Tock@lunari.us] has quit [Read error: Operation timed out]
15:51 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
15:51 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
15:52 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
15:52 -!- Ionic [ionic@ionic.de] has joined #openvpn
15:52 <@vpnHelper> RSS Update - forum: Incredibly slow connection <1KB/s <http://forums.openvpn.net/topic8913.html#p16124> || Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16123>
15:53 -!- fread2281[afk] [~fread2281@70-56-135-21.albq.qwest.net] has quit [Ping timeout: 260 seconds]
15:53 -!- fread228_ [~fread2281@70-56-135-21.albq.qwest.net] has joined #openvpn
15:53 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
15:57 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
15:57 <@vpnHelper> RSS Update - forum: VPN Monitoring - How to get notification when no link? <http://forums.openvpn.net/topic8917.html#p16125>
15:58 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
16:00 -!- fread228_ [~fread2281@70-56-135-21.albq.qwest.net] has quit [Ping timeout: 252 seconds]
16:02 -!- fread2281[afk] [~fread2281@70-56-209-10.albq.qwest.net] has joined #openvpn
16:07 -!- fulgore_ [~fulgore@glomsecurity.com] has joined #openvpn
16:07 -!- tjz_ [~pc@bb219-75-113-137.singnet.com.sg] has joined #openvpn
16:08 -!- Netsplit *.net <-> *.split quits: agagag, tjz, gremly, nickzxcv, fulgore
16:08 -!- fread2281[afk] [~fread2281@70-56-209-10.albq.qwest.net] has quit [Ping timeout: 240 seconds]
16:09 -!- fulgore_ is now known as fulgore
16:09 -!- Netsplit over, joins: gremly
16:10 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
16:11 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
16:11 -!- fread2281[afk] [~fread2281@70-56-128-141.albq.qwest.net] has joined #openvpn
16:13 < oraqol1> Sorry guys, back
16:14 < oraqol1> I'll check my firewall and config settings
16:14 < oraqol1> thanks for the feedback and sorry for the impatience
16:21 -!- Dannyboyni [5e0ea93b@gateway/web/freenode/ip.94.14.169.59] has joined #openvpn
16:21 < Dannyboyni> Could someone help my vpn connect to my local lan subnet?
16:22 < Dannyboyni> at the moment it is connecting too 192.168.43.1
16:22 < Dannyboyni> I want it to connect to 192.168.2.1
16:27 < SviMik> I think we need more details...
16:27 < Dannyboyni> sure what details do you need
16:27 < Dannyboyni> My setup is as follows
16:28 < Dannyboyni> Asus rt n16 router running tomato
16:28 < Dannyboyni> its gateway is 192.168.2.1
16:28 < Dannyboyni> adsl modem on 192.168.1.254
16:28 < Dannyboyni> which is connected via half bridge to the asus router
16:29 < Dannyboyni> http://www.howtogeek.com/60774/connect-to-your-home-network-from-anywhere-with-openvpn-and-tomato/
16:29 <@vpnHelper> Title: Connect to Your Home Network From Anywhere with OpenVPN and Tomato - How-To Geek (at www.howtogeek.com)
16:29 < Dannyboyni> i followed that tutorial to set it up
16:29 < Dannyboyni> and its working fine
16:29 < Dannyboyni> except its not putting me on my local network
16:29 < Dannyboyni> i want to see my other computers
16:29 -!- nickzxcv [~nick@schmalenberger.us] has quit [Ping timeout: 244 seconds]
16:30 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
16:31 <@vpnHelper> RSS Update - forum: Can connect and ping server, but nothing else <http://forums.openvpn.net/topic8910.html#p16126>
16:32 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Operation timed out]
16:32 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
16:33 -!- fulgore [~fulgore@glomsecurity.com] has quit [Ping timeout: 240 seconds]
16:33 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
16:36 -!- crow [~crowmo@84.112.79.173] has quit [Quit: Off]
16:37 < Dannyboyni> Basically I want to know how to do ethernet briding with tomato
16:38 < reiffert> !bridge
16:38 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
16:40 < SviMik> it's more tomato related question.... because I can't see configuration behind the tomato GUI
16:41 < Dannyboyni> im using tomato usb
16:41 < Dannyboyni> with the built in open vpn server
16:41 < Dannyboyni> and I dont see the option in the configuration
16:41 < SviMik> you may try to use tap instead of tun
16:41 < Dannyboyni> ok i shall try that
16:46 -!- oraqol1 [~johan@d92h221.public.uconn.edu] has left #openvpn []
16:51 < Dannyboyni> when I change interface type to tap in tomato
16:52 < Dannyboyni> must I also change it in the config file i have for open vpn
16:52 < SviMik> yes
16:52 < Dannyboyni> could you tell me where I change it in the .ovpn file
16:52 < Dannyboyni> mine looks like this
16:53 < Dannyboyni> http://www.howtogeek.com/wp-content/uploads/2011/05/tomatoovpn251.png
16:53 < Dannyboyni> do I change line 2 and line 8
16:53 < Dannyboyni> to tap
16:54 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
16:54 < SviMik> only line 2
16:54 < Dannyboyni> ok let me try
16:56 < Dannyboyni> Ok that didnt work :(
16:56 < Dannyboyni> now its not connecting
16:57 < Dannyboyni> oh wait
16:57 < Dannyboyni> that might have worked
16:58 < Dannyboyni> ok I can see other computers in the network now
16:58 < Dannyboyni> so im guessing thats worked
16:59 < Dannyboyni> but when I do ipconfig its saying 192.168.43.1
16:59 < Dannyboyni> should be 192.168.2.X
17:00 -!- nickzxcv [~nick@schmalenberger.us] has quit [Ping timeout: 260 seconds]
17:00 < Dannyboyni> ah seems to have worked
17:00 < Dannyboyni> thanks very much
17:00 < Dannyboyni> cya
17:00 -!- Dannyboyni [5e0ea93b@gateway/web/freenode/ip.94.14.169.59] has quit [Quit: Page closed]
17:00 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Ping timeout: 245 seconds]
17:01 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
17:03 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
17:04 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 244 seconds]
17:06 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
17:10 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 244 seconds]
17:10 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 244 seconds]
17:11 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 258 seconds]
17:11 -!- fulgore [~fulgore@glomsecurity.com] has quit [Ping timeout: 240 seconds]
17:13 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 258 seconds]
17:14 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
17:17 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
17:18 -!- fread2281[afk] [~fread2281@70-56-128-141.albq.qwest.net] has quit [Ping timeout: 256 seconds]
17:18 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
17:19 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
17:19 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16127>
17:20 -!- fread2281[afk] [~fread2281@70-56-134-137.albq.qwest.net] has joined #openvpn
17:27 -!- nickzxcv [~nick@schmalenberger.us] has quit [Ping timeout: 260 seconds]
17:29 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has joined #openvpn
17:34 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
17:35 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 244 seconds]
17:36 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
17:37 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
17:40 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
17:43 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16128>
17:47 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
17:53 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 252 seconds]
17:53 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:53 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:53 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:53 -!- mode/#openvpn [+v Axeman2] by ChanServ
18:00 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
18:08 -!- nickzxcv [~nick@schmalenberger.us] has quit [Read error: Operation timed out]
18:10 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
18:11 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 244 seconds]
18:12 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
18:13 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
18:16 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:16 -!- nickzxcv [~nick@schmalenberger.us] has quit [Read error: Operation timed out]
18:18 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 244 seconds]
18:19 -!- ryanclancy000 [~Ryan@stjhnbsu0nw-156034225098.dhcp-dynamic.FibreOp.nb.bellaliant.net] has joined #openvpn
18:22 -!- EugeneKay [eugene@itvends.com] has quit [Remote host closed the connection]
18:23 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
18:24 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
18:24 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Remote host closed the connection]
18:24 -!- Denial [Denial@drgi.co.uk] has quit []
18:25 -!- Tick-Tock is now known as FBI_AGENT
18:27 < ryanclancy000> When I launch openvpn from my vps, I use sudo openvpn server.conf, correct?
18:29 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
18:29 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
18:31 < EugeneKay> You usually use your distribution's init scripts.
18:32 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
18:34 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 244 seconds]
18:38 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 244 seconds]
18:38 -!- FBI_AGENT [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
18:39 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
18:40 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
18:43 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 256 seconds]
18:45 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
18:45 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
18:47 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
18:48 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
18:50 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
18:51 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
18:53 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
18:57 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has quit [Quit: Leaving]
19:01 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:09 -!- fread228_ [~fread2281@70-56-210-181.albq.qwest.net] has joined #openvpn
19:09 -!- fread2281[afk] [~fread2281@70-56-134-137.albq.qwest.net] has quit [Ping timeout: 248 seconds]
19:14 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 244 seconds]
19:15 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
19:16 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Quit: ZNC - http://znc.in]
19:17 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
19:20 -!- fread228_ [~fread2281@70-56-210-181.albq.qwest.net] has quit [Remote host closed the connection]
19:21 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
19:22 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
19:22 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
19:23 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
19:24 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
19:24 -!- _julian_ [~quassel@hmbg-5f767ec1.pool.mediaWays.net] has joined #openvpn
19:27 -!- _julian [~quassel@hmbg-5f76151b.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
19:28 -!- Cr4zi3 [killaz@staff.xbins.org] has left #openvpn []
19:28 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
19:35 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 244 seconds]
19:36 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
19:36 -!- IsilZha [~andreas@182.55.249.154] has quit [Ping timeout: 255 seconds]
19:36 -!- mirco [~mirco@p5B283BBA.dip.t-dialin.net] has quit [Quit: mirco]
19:44 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Ping timeout: 244 seconds]
19:45 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
19:45 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
19:46 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
19:49 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
19:49 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 244 seconds]
19:52 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
19:56 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
19:57 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
19:57 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 245 seconds]
20:04 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
20:04 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
20:05 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
20:06 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
20:07 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
20:10 -!- Netsplit *.net <-> *.split quits: zu, pwrcycle, @mattock, Dougy, Bushmills, kloeri, EugeneKay, fahadsadah, Rolybrau, bigon,  (+61 more, use /NETSPLIT to show all of them)
20:11 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
20:12 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
20:13 -!- Netsplit over, joins: EugeneKay, Tick-Tock, agagag, ryanclancy000, Optic, tjz_, rooth, gffa, master_of_master, bauruine (+39 more)
20:13 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
20:13 -!- Netsplit over, joins: pwrcycle, rkantos
20:13 -!- pranq [~pranq@unaffiliated/contempt] has joined #openvpn
20:13 -!- Netsplit over, joins: trumee, mete, Deathvalley122
20:13 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
20:13 -!- Netsplit over, joins: kloeri, Fleck, sia^pwnnt, uuuppz, sno-_, ivenkys, up_the_irons, inimino, Kateon, Agin_ (+4 more)
20:13 -!- ServerMode/#openvpn [+o mattock] by hubbard.freenode.net
20:13 -!- Ionic [ionic@ionic.de] has joined #openvpn
20:22 <@vpnHelper> RSS Update - forum: GPL license in Windows, etc... <http://forums.openvpn.net/topic8918.html>
20:23 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
20:25 -!- mick_laptop [~mick@clamwin/admin/mickhome] has quit [Ping timeout: 252 seconds]
20:26 -!- mick_laptop [~mick@mickweiss.com] has joined #openvpn
20:28 -!- nickzxcv [~nick@schmalenberger.us] has quit [Ping timeout: 276 seconds]
20:29 -!- ryanclancy000 [~Ryan@stjhnbsu0nw-156034225098.dhcp-dynamic.FibreOp.nb.bellaliant.net] has quit [Quit: Leaving]
20:29 -!- nickzxcv [foobar@schmalenberger.us] has joined #openvpn
20:30 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
20:34 <@vpnHelper> RSS Update - forum: TAP DRiver - GPL Question <http://forums.openvpn.net/topic8919.html>
20:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
20:59 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:59 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:20 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
21:21 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
21:26 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:32 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
21:48 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
21:49 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Client Quit]
21:49 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
21:52 -!- tkil [~tkil@12.206.96.2] has joined #openvpn
21:53 < tkil> hi.  does anyone have an example (server?) config file for putting the server-side TAP onto two subnets?  my openvpn server is on two lans at home (192.168.1.0/24, 192.168.2.0/24), and i'd like my remote system to be able to talk to both LANs when connected via openvpn.  (although only the 192.168.1.x net has a gateway back out to the rest of the world).
21:54 < tkil> apologies if that question doesn't make much sense, i'm new to openvpn.  :(
21:55 < EugeneKay> Unless you have a damned good reason(which you do not, I assure you), TAP is not what you want. It just isn't.
21:55 < EugeneKay> You can just push a route for both subnets to the vpn client. Nothing magical about that.
21:57 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:58 < tkil> ok.  so i want to use TUN, not TAP.  do i use the server-lan addresses in the TUN addresses, or a disjoint non-routable pair?
22:00 < tkil> and it looks like i don't want to use the "server" shortcut, either, as it assumes .1 on the server LAN (if i'm reading the docs correctly)
22:00 < tkil> i'll try something, come back when i screw up.  ;->  thanks for the input!
22:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:21 -!- sonicphobia_ [60245355@gateway/web/freenode/ip.96.36.83.85] has joined #openvpn
22:22 < sonicphobia_> Greetings, all.
22:33 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
22:53 -!- sonicphobia_ [60245355@gateway/web/freenode/ip.96.36.83.85] has quit [Quit: Page closed]
23:01 -!- ccesario [~ccesario@189-29-35-68-ac.cpe.vivax.com.br] has quit [Ping timeout: 258 seconds]
23:02 -!- ccesario [~ccesario@189-29-35-68-ac.cpe.vivax.com.br] has joined #openvpn
23:11 -!- EugeneKay is now known as EugeneSleep
23:17 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
23:29 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
23:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
23:30 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
23:40 -!- tkil [~tkil@12.206.96.2] has quit [Quit: tkil]
23:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:59 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
--- Day changed Tue Oct 04 2011
00:06 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
00:11 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
00:21 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:48 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
00:49 -!- nickzxcv [foobar@schmalenberger.us] has quit [Ping timeout: 240 seconds]
00:55 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
00:56 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
00:58 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16131>
01:04 <@vpnHelper> RSS Update - forum: Help forcing all traffic over OpenVPN Server - tried HOWTO <http://forums.openvpn.net/topic8921.html>
01:04 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
01:11 -!- dazo_afk is now known as dazo
01:15 -!- K1ng` [~k1ng@58.97.132.210] has joined #openvpn
01:15 -!- K1ng` [~k1ng@58.97.132.210] has quit [Changing host]
01:15 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:18 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
01:18 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Remote host closed the connection]
01:19 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
01:19 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
01:19 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
01:19 -!- mode/#openvpn [+v novaflash] by ChanServ
01:20 -!- nickzxcv [~nick@schmalenberger.us] has quit [Read error: Operation timed out]
01:21 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
01:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:29 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
01:31 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 244 seconds]
01:31 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
01:40 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
01:45 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
02:07 -!- noaXess [~noaXess@gw.ptr-80-238-209-47.customer.ch.netstream.com] has joined #openvpn
02:07 < noaXess> morning
02:08 < noaXess> i ave a client.ovpn file wich i should be able to connect to a remote openvpn access server.. but.. i that file only internal ip idresses 10.x.x.x are listed and no external ip-adress of the access server.. wich parameter do i need to connect to the access server? or what do i need to change in the file?
02:21 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
02:22 < Mowi> Morning
02:26 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:29 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
02:31 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
02:42 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Remote host closed the connection]
02:43 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has joined #openvpn
02:43 -!- novaflash [~notme@178-84-117-247.dynamic.upc.nl] has quit [Changing host]
02:43 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
02:43 -!- mode/#openvpn [+v novaflash] by ChanServ
02:44 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Read error: Connection reset by peer]
02:44 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
02:45 < dropje> noaXess: the "remote" directive in the configuration file. but you will need an ip or hostname of the access server
02:49 -!- dazo is now known as dazo_afk
02:52 < noaXess> dropje: so, if there is no remote directive, i need to add it?
02:53 < dropje> noaXess: yes e.g.: remote x.x.x.x 1194 (where x.x.x.x can be an ip or hostname and 1194 is ofcourse the port)
02:54 < noaXess> dropje: here is the fake client.ovpn :).. http://paste.ubuntu.com/702118/ soe remote should be the public ip of the access server and the ports should be opened on the remote firewall, right?
02:55 < noaXess> dropje: what is about OVPN_ACCESS_SERVER_PROFILE and OVPN_ACCESS_SERVER_WSHOST.. are this only comments, right?
02:56 < dropje> noaXess: yes.. but why do you have so much remote servers with the same specs defined?
02:56 < noaXess> port 443 is open, but i think 1194 on remote firewall isn't forwaded to the openvpn access server..
02:56 < dropje> it will retry anyway
02:56 < dropje> 1194 is UDP
02:56 < noaXess> dropje: don't know.. i get that from the customers it department.. 
02:56 < dropje> according to your config
02:56 < noaXess> but 1194 must be forwarded from the remote firewall to the access server, that is behind the firewall, right?
02:57 < dropje> well its not called forwarded but allowed unless they are using NAT
02:57 < dropje> but yes
03:00 < noaXess> dropje: can i  change the config files remote directive to this only: remote public-ip 443 tcp and remove the udp things?
03:00 < dropje> ofcourse you can.. but the preferred protocol for vpn tunnels is UDP
03:04 -!- luneff [~yury@188.114.42.127] has joined #openvpn
03:11 < noaXess> dropje: should openvpn server runing on client?
03:12 < noaXess> not server.. service :)
03:13 < dropje> no you just run the client to connect as a client.. but what are you trying to do? i assume connecting to a remote server provided by someone else?
03:14 < noaXess> i'm the client.. and want connect to the access server.. so i can ssh to the remote ubuntu server..
03:15 < dropje> but have you setup the remote openvpn server yourself or did it get provided?
03:15 < noaXess> dropje: it is provided by customer.. and it's IT team..
03:16 < noaXess> here is what i get from openvpn --config client.ovpn: [OpenVPN_Server] Peer Connection Initiated with [AF_INET]213.158.139.24:443
03:16 < noaXess> .. ups.. ip :)
03:16 < noaXess> forgett about it ..
03:16 < dropje> well its no problem, just an ip ;) what do your logs say when you're trying to connect?
03:17 < noaXess> dropje: this: http://paste.ubuntu.com/702122/
03:18 < noaXess> something with TUN/TAP iface...
03:18 < noaXess> need i run it with sudo? sudo openvpn --config client.ovpn?
03:18 < dropje> well for starters it seems that openvpn has directives in its config which are not support by your openvpn version. secondly as which user are you running it? it says it can not call for the TUN adapter
03:19 < noaXess> i run the command as normal user...
03:19 < dropje> try it as root since you need to call for an adapter which is not possible as normal user
03:23 <@vpnHelper> RSS Update - forum: Help forcing all traffic over OpenVPN Server - tried HOWTO <http://forums.openvpn.net/topic8921.html#p16134> || Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16133>
03:23 -!- noaXess [~noaXess@gw.ptr-80-238-209-47.customer.ch.netstream.com] has quit [Ping timeout: 258 seconds]
03:36 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
03:36 -!- noaXess [~noaXess@213.158.139.22] has joined #openvpn
03:37 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
03:41 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 252 seconds]
03:44 -!- noaXess [~noaXess@213.158.139.22] has quit [Ping timeout: 248 seconds]
03:54 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
04:01 -!- noaXess [~noaXess@gw.ptr-80-238-209-47.customer.ch.netstream.com] has joined #openvpn
04:05 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:05 <@vpnHelper> RSS Update - forum: Few questions from a newbie <http://forums.openvpn.net/topic8916.html#p16135>
04:06 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
04:06 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
04:07 -!- dazo_afk is now known as dazo
04:57 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:57 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:06 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16136>
05:19 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Ping timeout: 248 seconds]
05:24 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16137>
05:36 <@vpnHelper> RSS Update - forum: Cannot see remote sub-net <http://forums.openvpn.net/topic8922.html>
05:37 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
05:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:00 -!- thething [~forerunne@208.110.85.182] has joined #openvpn
06:00 -!- maxJadi [~maxJadi@81-232-115-137-no17.business.telia.com] has joined #openvpn
06:00 -!- maxJadi [~maxJadi@81-232-115-137-no17.business.telia.com] has quit [Changing host]
06:00 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
06:15 -!- thething [~forerunne@208.110.85.182] has quit [Ping timeout: 252 seconds]
06:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
06:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
06:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
06:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
06:21 -!- linuxpc1 [~linuxpc1@202.131.123.66] has joined #openvpn
06:23 < linuxpc1> Hello Everyone
06:23 < linuxpc1>  I have one problem
06:24 < linuxpc1> I want every machine behind client to access every machine behind server
06:24 < linuxpc1> for that i have added server side push route and client-config-dir
06:24 < linuxpc1> i can ping every machine behind server
06:24 < linuxpc1> but cant ping using machines behind client
06:24 -!- linuxpc1 [~linuxpc1@202.131.123.66] has quit [Remote host closed the connection]
06:31 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 255 seconds]
06:42 -!- iNeal [~Neal@rev.ineal.me] has left #openvpn []
06:44 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 255 seconds]
06:48 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16139>
06:55 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
07:00 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p16140>
07:06 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16141> || Protect 'authinfo' <http://forums.openvpn.net/topic8923.html#p16097>
07:13 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:13 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
07:18 <@vpnHelper> RSS Update - forum: Can connect and ping server, but nothing else <http://forums.openvpn.net/topic8910.html#p16142>
07:29 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:29 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
07:29 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html> || can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16143>
07:35 -!- albech [~albech@61.7.176.198] has joined #openvpn
07:35 <@vpnHelper> RSS Update - forum: VPN Monitoring - How to get notification when no link? <http://forums.openvpn.net/topic8917.html#p16146> || Incredibly slow connection <1KB/s <http://forums.openvpn.net/topic8913.html#p16145>
07:46 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16147>
07:46 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:52 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16149> || Cannot see remote sub-net <http://forums.openvpn.net/topic8922.html#p16148>
07:57 -!- steelnwool [~jmacdonal@50-56-33-105.static.cloud-ips.com] has left #openvpn []
07:57 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16151> || Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16150>
07:59 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
08:02 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:04 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
08:04 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16153> || Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16152>
08:06 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
08:06 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
08:06 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:06 -!- mode/#openvpn [+v Axeman2] by ChanServ
08:10 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:14 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
08:22 <@vpnHelper> RSS Update - forum: Cannot see remote sub-net <http://forums.openvpn.net/topic8922.html#p16156> || Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16155>
08:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
08:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:34 < Optic> mooo
08:36 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
08:39 -!- Voot [~trinklein@c-68-58-232-164.hsd1.sc.comcast.net] has joined #openvpn
08:39 -!- Voot is now known as v00t
08:44 <@vpnHelper> RSS Update - forum: Cannot see remote sub-net <http://forums.openvpn.net/topic8922.html#p16157>
08:45 < v00t> I have need of help. I've been trying to establish a vpn tunnel between two networks - our local LAN and the Amazon Virtual Private Cloud. I have a server on our LAN directly connected to the web running like a "server" and a system in the cloud running like a "client". I can ping from the "Client" to any system in our LAN. I can ping from any system in our LAN to the "client". I cannot, however, reach any *other* system in the cloud
08:45 < v00t>  from any system in our LAN. 
08:46 < v00t> Here are my configs: http://pastebin.com/ZcLWgNdv http://pastebin.com/9PzmuPSR
08:46 -!- alabd [alabd@unaffiliated/alabd] has joined #openvpn
08:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
08:52 < alabd> Good day all ,have configured openvpn on debian , this is server.conf http://pastebin.com/uQaAZGBU and this is client.conf http://pastebin.com/P83m0R7w , , and also did  iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE  and iptables -t filter -A INPUT -m tcp -p tcp --dport 1194 -j ACCEPT on server , but client does not connects and this is server log http://pastebin.com/ShDrbR5Q  
08:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
09:02 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
09:02 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16158>
09:02 -!- zeroXten [~zeroXten@0x10.co.uk] has left #openvpn []
09:05 -!- master_of_master [~master_of@p57B549F8.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
09:06 -!- master_of_master [~master_of@p57B54E27.dip.t-dialin.net] has joined #openvpn
09:07 -!- Serious_Sam [57e2a3ca@gateway/web/freenode/ip.87.226.163.202] has joined #openvpn
09:07 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16159>
09:09 < Serious_Sam> Hi everybody! I made a tunnel through tun device on FreeBSD. But I can ping remote peer, but I can't ping my local IP! What is wrong?
09:09 < Serious_Sam> Of course I talk about IPs inside a tunnel
09:12 <@vpnHelper> RSS Update - forum: OpenVPN AS <http://forums.openvpn.net/topic8925.html>
09:16 -!- Serious_Sam [57e2a3ca@gateway/web/freenode/ip.87.226.163.202] has quit [Ping timeout: 252 seconds]
09:16 -!- Serious_Sam [57e2a3ca@gateway/web/freenode/ip.87.226.163.202] has joined #openvpn
09:17 -!- v00t [~trinklein@c-68-58-232-164.hsd1.sc.comcast.net] has quit [Ping timeout: 255 seconds]
09:18 -!- v00t [~trinklein@24.214.204.206] has joined #openvpn
09:18 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16162> || Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16161>
09:21 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
09:22 -!- EugeneSleep is now known as EugeneKay
09:29 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:30 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16164> || Cannot see remote sub-net <http://forums.openvpn.net/topic8922.html#p16163>
09:31 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:32 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
09:34 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
09:36 < alabd> Prev problem solved but What's the problem now http://pastebin.com/YaYm9Zy2 ?
09:37 < Serious_Sam> Guys, I created a tun tunnel (with "ifconfig 10.23.0.1 10.23.0.2" in config file of one of the peers). I can't ping 10.23.0.1 from this machine. Is it normal?
09:42 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16166> || Cannot see remote sub-net <http://forums.openvpn.net/topic8922.html#p16165>
09:44 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:46 -!- TheRedOctober [~administr@rrcs-24-213-178-60.nyc.biz.rr.com] has quit [Remote host closed the connection]
09:47 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
09:50 -!- cocoa117 [~cocoa117@wk-29-128.guest.rdg.ac.uk] has joined #openvpn
09:51 < ecrist> Serious_Sam: without knowing more, we can't say
09:51 < ecrist> see /topic
09:51 < ecrist> alabd: I don't see a problem in that log file.
09:57 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:57 -!- TheRedOctober [~administr@63.138.254.154] has joined #openvpn
09:59 -!- Serious_Sam [57e2a3ca@gateway/web/freenode/ip.87.226.163.202] has quit [Ping timeout: 252 seconds]
10:01 <@vpnHelper> RSS Update - forum: Cannot see remote sub-net <http://forums.openvpn.net/topic8922.html#p16167>
10:03 < alabd> ecrist: at line 14 Connection reset
10:03 < ecrist> that's normal, alabd
10:04 < ecrist> it was reset with a SIGUSR1
10:07 -!- cjae [~quassel@142-165-27-211.estv.hsdb.sasknet.sk.ca] has joined #openvpn
10:10 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
10:11 < alabd> ecrist: now says http://pastebin.com/ZKwtbPg3
10:11 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Read error: Operation timed out]
10:14 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 244 seconds]
10:14 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:15 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
10:15 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
10:17 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
10:24 -!- dazo is now known as dazo_afk
10:25 -!- alabd [alabd@unaffiliated/alabd] has quit [Read error: Connection reset by peer]
10:28 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
10:28 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 260 seconds]
10:38 -!- cjae [~quassel@142-165-27-211.estv.hsdb.sasknet.sk.ca] has quit [Read error: Connection reset by peer]
10:40 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:41 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:45 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:46 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
10:57 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
11:06 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Ex-Chat]
11:07 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 258 seconds]
11:15 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
11:19 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16168>
11:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:20 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
11:24 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
11:24 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16169>
11:26 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 245 seconds]
11:29 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
11:30 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16170>
11:30 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:35 <@vpnHelper> RSS Update - forum: Cannot see remote sub-net <http://forums.openvpn.net/topic8922.html#p16171>
11:40 -!- luneff [~yury@188.114.42.127] has quit [Quit: This computer has gone to sleep]
11:40 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16172>
11:47 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16173>
11:58 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:58 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16174>
12:01 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
12:02 -!- cocoa117 [~cocoa117@wk-29-128.guest.rdg.ac.uk] has quit [Ping timeout: 276 seconds]
12:20 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
12:22 -!- luneff [~yury@84.51.192.74] has joined #openvpn
12:26 -!- luneff [~yury@84.51.192.74] has quit [Read error: Connection reset by peer]
12:27 -!- luneff [~yury@84.51.192.74] has joined #openvpn
12:29 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16175>
12:32 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
12:34 -!- mape2k [~mape2k@f053198185.adsl.alicedsl.de] has joined #openvpn
12:37 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
12:40 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
12:40 <@vpnHelper> RSS Update - forum: Force all clients of a router through ONE OpenVPN connection <http://forums.openvpn.net/topic8915.html#p16176>
12:41 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
12:41 -!- mode/#openvpn [+o raidz] by ChanServ
12:44 < Dougy> woof
12:44 < Dougy> krzee: monies
12:45 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:47 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
12:50 -!- v00t [~trinklein@24.214.204.206] has quit [Quit: Ex-Chat]
13:05 < jeev> krzee: monies
13:06 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
13:10 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
13:13 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:15  * ecrist wants monies
13:15 -!- albech [~albech@61.7.176.198] has quit [Quit: Leaving]
13:15 -!- dxtr [mii99s@unaffiliated/dxtr] has quit [Ping timeout: 244 seconds]
13:16 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
13:19  * reiffert wants the national budget
13:21 <@vpnHelper> RSS Update - forum: VPN Monitoring - How to get notification when no link? <http://forums.openvpn.net/topic8917.html#p16177>
13:28 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:30 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
13:31 < krzee> Dougy, will send today, im me on the forum with the addy please
13:32 < ecrist> krzee: you should send me money, too
13:32 < ecrist> that way, I can spend it
13:32 <@vpnHelper> RSS Update - forum: Testing environment <http://forums.openvpn.net/topic8926.html>
13:34 < krzee> i would, but ild need you to send me the donation $ so i could send it back to you, and we'ld just be paying some bank 2 xfers for no reason ;]
13:59 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:59 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
14:01 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
14:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
14:33 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
14:39 -!- Serious_Sam [kvirc@shpd-92-101-188-249.vologda.ru] has joined #openvpn
14:40 -!- Serious_Sam [kvirc@shpd-92-101-188-249.vologda.ru] has quit [Client Quit]
14:45 -!- bandroidx [~bandroidx@pool-173-54-216-132.nwrknj.fios.verizon.net] has quit [Ping timeout: 248 seconds]
14:46 -!- bandroidx [~bandroidx@pool-173-54-216-132.nwrknj.fios.verizon.net] has joined #openvpn
14:49 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
14:51 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 258 seconds]
14:56 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:57 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
14:58 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
14:59 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:03 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16180> || Help forcing all traffic over OpenVPN Server - tried HOWTO <http://forums.openvpn.net/topic8921.html#p16179>
15:04 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
15:05 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
15:05 -!- mode/#openvpn [+v Axeman] by ChanServ
15:11 -!- LuckyY_ is now known as LuckyY
15:16 <@vpnHelper> RSS Update - forum: Incredibly slow connection <1KB/s <http://forums.openvpn.net/topic8913.html#p16181>
15:21 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
15:21 -!- mode/#openvpn [+v Axeman2] by ChanServ
15:21 <@vpnHelper> RSS Update - forum: Cannot see remote sub-net <http://forums.openvpn.net/topic8922.html#p16182>
15:21 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
15:28 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16183>
15:40 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:42 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
15:44 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:46 <@vpnHelper> RSS Update - forum: OpenVPN & Android Config File Problem <http://forums.openvpn.net/topic8927.html>
15:47 -!- mape2k [~mape2k@f053198185.adsl.alicedsl.de] has quit [Ping timeout: 256 seconds]
15:49 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
16:01 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 240 seconds]
16:02 -!- corretico_ [~luis@200.12.40.25] has quit [Ping timeout: 248 seconds]
16:13 -!- illsci [~jsabo@66.208.14.74] has joined #openvpn
16:13 < illsci> hi
16:13 < illsci> I have to setup a bunch of hosts in a tiered setup and this is in the cloud with autoscalling 
16:13 < illsci> so boxes can be brought up automattically based on load
16:14 < illsci> I need them to be able to bring up vpns to hosts behind them...  so I'm looking at options for authenticating each other and I'm thinking doing this with a ca is going to be a pain int he ass
16:14 < illsci> tls-auth ta.key 0
16:14 < illsci> Is that going to allow me to just have a secret key that I can share between all hosts, servers and clients
16:22 <@vpnHelper> RSS Update - forum: Help forcing all traffic over OpenVPN Server - tried HOWTO <http://forums.openvpn.net/topic8921.html#p16186> || Incredibly slow connection <1KB/s <http://forums.openvpn.net/topic8913.html#p16185>
16:28 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16187>
16:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
16:28 -!- mode/#openvpn [+v Axeman] by ChanServ
16:44 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
16:46 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 258 seconds]
16:48 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
16:49 -!- illsci [~jsabo@66.208.14.74] has quit [Remote host closed the connection]
16:49 -!- illsci [~jsabo@66.208.14.74] has joined #openvpn
16:49 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
17:10 <@vpnHelper> RSS Update - forum: Help forcing all traffic over OpenVPN Server - tried HOWTO <http://forums.openvpn.net/topic8921.html#p16188>
17:13 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:23 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
17:25 -!- raidz [~Administr@aim.505.ru] has joined #openvpn
17:25 -!- raidz [~Administr@aim.505.ru] has quit [Changing host]
17:25 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
17:25 -!- mode/#openvpn [+o raidz] by ChanServ
17:26 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
17:27 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
17:27 -!- mode/#openvpn [+o raidz] by ChanServ
17:30 -!- illsci [~jsabo@66.208.14.74] has quit [Ping timeout: 256 seconds]
17:52 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
17:55 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
18:00 -!- diomedes [~diomedes@202.148.229.243] has joined #openvpn
18:01 < diomedes> hey I am using the mac osx client of openvpn but i want to change the connection IP of the server where does it hide it's config files on osx?
18:07 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Quit: Leaving.]
18:07 -!- raidz [~Administr@openvpn/corp/admin/andrew] has joined #openvpn
18:07 -!- mode/#openvpn [+o raidz] by ChanServ
18:38 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
18:40 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 244 seconds]
18:41 -!- raidz [~Administr@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
18:41 -!- raidz1 [~Administr@aim.505.ru] has joined #openvpn
18:42 -!- Denial [Denial@drgi.co.uk] has quit []
18:43 -!- raidz1 [~Administr@aim.505.ru] has quit [Client Quit]
18:43 < krzie> diomedes, you needed to setup a config to even have a connection... its not hidden...
18:43 < krzie> it is wherever you put it
18:43 -!- raidz1 [~Administr@aim.505.ru] has joined #openvpn
18:43 -!- raidz1 [~Administr@aim.505.ru] has quit [Client Quit]
18:48 -!- raidz1 [~Administr@aim.505.ru] has joined #openvpn
18:48 -!- raidz1 [~Administr@aim.505.ru] has quit [Client Quit]
18:50 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
18:50 -!- Cain [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
18:50 -!- Cain [~Geek@2001:41d0:1:f38f::1337] has quit [Changing host]
18:50 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
18:51 -!- Cain [~Geek@unaffiliated/cain] has left #openvpn []
18:53 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
18:53 -!- mode/#openvpn [+o raidz] by ChanServ
18:54 < krzie> !route
18:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
18:55 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
18:56 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
19:10 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
19:10 <@vpnHelper> RSS Update - forum: How to use my DNS server instead of public IPs? <http://forums.openvpn.net/topic8928.html>
19:12 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
19:23 -!- _julian [~quassel@hmbg-5f765361.pool.mediaWays.net] has joined #openvpn
19:24 < diomedes> krzie well it's got a config from somewhere as it gives me the option to connect to the lan address of the server 10.10.1.x i need to change it to be the public IP
19:25 < krzie> how are you starting openvpn?  how did you configure it?
19:26 -!- _julian_ [~quassel@hmbg-5f767ec1.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
19:33 < diomedes> i just downloaded the osx client from the server, i have it working on windows fine
19:34 < krzie> osx client?
19:34 <@vpnHelper> RSS Update - forum: How to use my DNS server instead of public IPs? <http://forums.openvpn.net/topic8928.html#p16190>
19:34 < krzie> please give me a link to where you downloaded that from
19:48 < diomedes> krzie from my openvpn server when you login to the web interface as a user? it's openvpn-connect-1.8.3.dmg
19:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 248 seconds]
19:58 < krzie> ahh web interface
19:58 <@vpnHelper> RSS Update - forum: How to use my DNS server instead of public IPs? <http://forums.openvpn.net/topic8928.html#p16191>
19:58 < krzie> there we go
19:58 < krzie> !as
19:58 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
19:58 < krzie> you arent using opensource openvpn
20:06 < diomedes> ah okay
20:06 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:07 < diomedes> great now i get 			
20:07 < diomedes> SESSION_ID only allowed to be used by client IP address that created it
20:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:07 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
20:09 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
20:09 < krzie> you are in the wrong channel
20:10 < krzie> we dont help with what you are using here, there is another channel for it
20:10 < krzie> !as
20:10 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
20:19 -!- fread2281 [~fread2281@70-56-134-59.albq.qwest.net] has joined #openvpn
20:21 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:23 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
20:24 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:26 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
20:37 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:39 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
20:44 -!- diomedes [~diomedes@202.148.229.243] has left #openvpn ["Leaving"]
20:45 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
20:47 < KaiForce> I have to interoperate between a 2.1.3 server and 2.0.9 clients while I'm upgrading.  Is there any way to disable the topology parameter in 2.1.3 (defaults to net 30)?
20:51 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:51 < KaiForce> it is being pushed to the clients and the clients are barfing on the push option
20:53 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
20:58 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:04 < EugeneKay> Upgrade the clients first.
21:05 -!- albech [~albech@183.88.76.120] has joined #openvpn
21:08 < KaiForce> EugeneKay: thanks.  do you happen to know if that error is fatal (i.e. none of the options get pushed) or not (i.e. it pushes them all except for topology?)  Or perhaps easier still, am I going to rip my hair out if I insist on doing the server side first?
21:08 < EugeneKay> The latter ;-)
21:15 < KaiForce> EugeneKay: ok thanks!
21:16 < KaiForce> exit
21:16 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
21:16 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 244 seconds]
21:22 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
21:27 -!- thanwin [~thanwin@d58-106-152-69.rdl803.qld.optusnet.com.au] has joined #openvpn
21:31 -!- IsilZha [~andreas@182.55.249.154] has joined #openvpn
21:36 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:36 < IsilZha> hello. i was trying to connect a client with a static ip using a ccd file on the server side. i can access the server from the client but not reach any other clients as i was used to at the time i had connected this client through a dynamic ip (which was assigned 192.168.112.15 by the server side). the ccd file contains this line: ifconfig-push 192.168.114.5 192.168.114.1. the configuration for the client, this ccd refers to, are as follows: static ip: 
21:36 < IsilZha> 192.168.114.5, mask 255.255.255.0, gateway 192.168.114.1. i also supplied the path to the ccd file in the server config
21:37 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
21:38 < IsilZha> my apologies. the ccd is "ifconfig-push 192.168.114.5 192.168.114.6" as was advised by documentation i read on this
21:38 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:39 < Optic> moo
21:40 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
21:40 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
21:42 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
21:51 < IsilZha> !welcome
21:51 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:52 < IsilZha> !goal
21:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:57 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:06 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
22:09 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
22:12 < IsilZha> i'm trying to eastablish a local network, including connectivity between clients. most clients connect from a remote location, having a dynamic ip configered. the server and one client are in-house. the server is using a different network from the client. server: (ip: 192.168.112.5 / mask: 255.255.255.0 / gateway: 192.168.112.1) client: (ip: 192.168.114.5 / mask: 255.255.255.0 / gateway: 192.168.114.1). both the in-house client and the in-house server 
22:12 < IsilZha> have a static wan ip configured. server: xxx.75.15.212 client xxx.75.15.214. the in-house client is configured, as the other clients, to look for the wan ip of the server for its conenction. given the above configuration of ccd and ifconfig-push, where should i start looking for the issue? as mentioned, as long as the in-house client is just using a dynamic ip for its interface the setup is working. unfortunately i can't eventually use a dynamic ip for 
22:12 < IsilZha> this client's interface
22:16 -!- Mowi [~Mowi@lendabrain.net] has quit [Read error: Operation timed out]
22:20 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
22:20 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
22:24 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
22:25 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
22:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
22:25 -!- Olipro_ is now known as Olipro
22:30 -!- fread2281 [~fread2281@70-56-134-59.albq.qwest.net] has quit [Remote host closed the connection]
22:36 -!- thanwin [~thanwin@d58-106-152-69.rdl803.qld.optusnet.com.au] has left #openvpn ["Linkinus - http://linkinus.com"]
22:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
22:58 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
23:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:11 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
23:16 -!- Ionic [ionic@ionic.de] has joined #openvpn
23:26 -!- mape2k [~mape2k@f053197160.adsl.alicedsl.de] has joined #openvpn
23:31 -!- Yagnesh__ [~Yagnesh@202.131.123.66] has joined #openvpn
23:33 -!- Yagnesh__ [~Yagnesh@202.131.123.66] has left #openvpn []
23:52 -!- mape2k [~mape2k@f053197160.adsl.alicedsl.de] has quit [Ping timeout: 248 seconds]
23:52 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:58 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
--- Day changed Wed Oct 05 2011
00:03 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
00:03 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 252 seconds]
00:23 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
00:32 < Bushmills> "between clients" means "between openvpn clients"?
00:33 < Bushmills> or are those "clients in a LAN behind an openvpn box"?
00:34 < krzee> IsilZha, 
00:34 < krzee> !local
00:34 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
00:35 -!- K1ng` [~k1ng@58.97.132.210] has joined #openvpn
00:35 -!- K1ng` [~k1ng@58.97.132.210] has quit [Changing host]
00:35 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:35 < krzee> you're using redirect-gateway i assume...
00:36 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
00:36 < Bushmills> !client-to-client
00:36 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
00:36 <@vpnHelper> clients
00:36 < Bushmills> moinmoin krzee
00:52 -!- swg0101 [~swg0101@openvpn/user/swg0101] has joined #openvpn
00:52 -!- mode/#openvpn [+v swg0101] by ChanServ
00:53 -!- mape2k [~mape2k@p5B24B437.dip.t-dialin.net] has joined #openvpn
00:55 <+swg0101> !welcome
00:55 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:56 <+swg0101> !goal
00:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:56 <+swg0101> !logs
00:56 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
00:56 <+swg0101> !configs
00:56 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
00:57 < krzee> hey wassup swg0101 
00:57 <+swg0101> haha
00:57 <+swg0101> just taking a tour :P
00:57 < krzee> !factoids
00:57 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
00:57 <+swg0101> !interface
00:57 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
00:57 <+swg0101> !howto
00:57 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:57 <+swg0101> !route
00:57 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
00:58 < krzee> the factoids link i just gave you is everything the bot knows
00:58 <+swg0101> oh
00:58 <+swg0101> lol
00:58 < krzee> ;]
00:58 <+swg0101> !raidz
00:58 <+swg0101> meh
00:58 < krzee> !blame
00:58 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
00:59 <+swg0101> haha
00:59 <+swg0101> the factoids are pretty extensive
00:59 <+swg0101> :P
00:59 <@raidz> yo
00:59 <+swg0101> oh wow
00:59 <+swg0101> I guess people don't sleep
00:59 < krzee> ya that bot is a couple years old
00:59 <@raidz> watching some prison show
00:59 < krzee> heh we sleep, just not these hours ;]
00:59 <@raidz> i usually go down around 2
01:00 <+swg0101> are you the same krzie cloned in the AS channel? :p
01:00 < krzee> i am
01:00 <+swg0101> haha
01:00 <+swg0101> nice twin
01:00 < krzee> im really krzee, krzie is my clone
01:00 < krzee> as seen in the confgen comments or bottom of !route
01:00 <+swg0101> there is so many people here yet no one really talks
01:00 < krzee> !ircstats
01:00 <@vpnHelper> "ircstats" is (#1) 30-Day Stats: http://www.secure-computing.net/logs/openvpn-last30.html or (#2) All-Time Stats: http://www.secure-computing.net/logs/openvpn.html
01:01 <+swg0101> so krzee, as far as LDAP goes in the community version
01:01 < krzee> quite likely old... ecrist can you update those?
01:01 <+swg0101> what would you say about that
01:01 < krzee> !ldap
01:01 <+swg0101> haha
01:01 < krzee> heh
01:01 <+swg0101> niced
01:01 < krzee> ild say its just a script
01:01 < krzee> it exists in many forms
01:01 <+swg0101> I did see an addon
01:01 < krzee> !authpass
01:01 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
01:01 <+swg0101> but then how would you implement it in the client?
01:01 <+swg0101> oh
01:01 <+swg0101> haha
01:02 <+swg0101> means I have to read
01:02 <+swg0101> argh hahah
01:02 < krzee> !active-directory
01:02 < krzee> !ad
01:02 <+swg0101> !inactive-directory
01:02 <@raidz> !krzee
01:02 < krzee> !factoids search active
01:02 <@vpnHelper> "activedirectory" is http://amigo4life.googlepages.com/openvpn for the guide of how to auth against AD
01:02 <+swg0101> !factoids search raidz
01:02 <@vpnHelper> No keys matched that query.
01:03 < krzee> swg0101, obsessed much?
01:03 <+swg0101> so have you tried this?
01:03 <+swg0101> heh
01:04 < krzee> nope
01:04 < krzee> ive never used ldap
01:07 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16192>
01:23 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 276 seconds]
01:25 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16193>
01:27 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
01:27 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
01:31 <@vpnHelper> RSS Update - forum: New clients will not connect to AS 1.8.3 <http://forums.openvpn.net/topic8929.html>
01:32 -!- bandroidx [~bandroidx@pool-173-54-216-132.nwrknj.fios.verizon.net] has quit [Ping timeout: 248 seconds]
01:32 -!- dazo_afk is now known as dazo
01:33 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:34 -!- nickzxcv [~nick@schmalenberger.us] has quit [Ping timeout: 240 seconds]
01:35 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
01:35 -!- noaXess [~noaXess@gw.ptr-80-238-209-47.customer.ch.netstream.com] has left #openvpn []
01:35 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
01:37 <@vpnHelper> RSS Update - forum: Openvpn pam authetication - two process created <http://forums.openvpn.net/topic8930.html>
01:40 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:40 -!- mode/#openvpn [+o mattock] by ChanServ
01:45 -!- swg0101 [~swg0101@openvpn/user/swg0101] has left #openvpn []
02:16 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:19 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
02:22 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
02:27 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:36 < Mowee> Morning
03:01 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
03:11 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
03:32 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:35 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
03:37 <@vpnHelper> RSS Update - forum: 2 lan connected with openvpn-bridge and 1 dhcp server <http://forums.openvpn.net/topic8931.html>
03:41 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
03:42 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
03:42 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
03:42 <@vpnHelper> RSS Update - forum: Remote Desktop Disconnecting <http://forums.openvpn.net/topic8900.html#p16199> || can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16198> || New clients will not connect to AS 1.8.3 <http://forums.openvpn.net/topic8929.html#p16197>
03:48 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:49 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
03:49 -!- luneff [~yury@188.114.60.72] has joined #openvpn
03:51 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:04 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:05 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
04:05 -!- fngraph [~fngraph@24-205-80-209.dhcp.psdn.ca.charter.com] has joined #openvpn
04:05 -!- fngraph [~fngraph@24-205-80-209.dhcp.psdn.ca.charter.com] has left #openvpn []
04:11 <@vpnHelper> RSS Update - forum: OpenVPN 2.1 requires '--script-security 2' <http://forums.openvpn.net/topic8835.html#p16200>
04:13 -!- bitterman [~yury@188.114.60.72] has joined #openvpn
04:14 -!- luneff [~yury@188.114.60.72] has quit [Ping timeout: 252 seconds]
04:17 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:19 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
04:22 -!- deep_blue [~fahimi@2.176.213.20] has joined #openvpn
04:22 < deep_blue> hi
04:22 < deep_blue> anyone can help me?
04:23 < deep_blue> hellooo
04:23 <@vpnHelper> RSS Update - forum: TCP/UDP: Socket bind failed on local address already in use <http://forums.openvpn.net/topic8933.html>
04:25 < deep_blue> hello
04:25 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
04:26 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
04:27 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
04:30 < deep_blue> hello. some one can help?
04:30 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16202>
04:33 < Bushmills> medical emergency?
04:33 < Bushmills> legal advice?
04:33 < Bushmills> or just an economic squeeze? 
04:35 < deep_blue> medical
04:35 < deep_blue> :D
04:36 < deep_blue> Bushmills can you give help to me?
04:37 < deep_blue> Bushmills can you help me?
04:42 < Bushmills> sure
04:42 < Bushmills> !howto
04:42 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:42 < Bushmills> that will have to do
04:47 < hyper_ch> Bushmills: can you also help me?
04:48 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:50 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
04:51 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:51 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
04:54 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 244 seconds]
04:56 < Bushmills> !howto
04:57 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:58 < deep_blue> Bushmills i read it i did it again last day
04:58 < deep_blue> but it didn't connect too
04:58 < deep_blue> i can send new client/server config and new client/server log
04:58 < deep_blue> but it didn't work too
05:04 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:04 < Bushmills> "didn't work" may be an indication of some kind of misconfiguration, or it may be caused by network problems.
05:05 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
05:09 < deep_blue> but it didn't work too
05:10 < deep_blue> Bushmills what do you think
05:10 < deep_blue> you can read logs and config in my pm with you
05:20 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:21 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
05:33 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:34 < deep_blue> what this mean? TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
05:35 < deep_blue> i generate server certificate, and dh1024 and client certificate and key like how to
05:35 < deep_blue> downloaded ca.crt and client.key and client.crt into client
05:35 <@vpnHelper> RSS Update - forum: SOLVED: Tap driver install fail on Windows XP SP3 <http://forums.openvpn.net/topic8485.html#p16203>
05:36 < deep_blue> and used them in client config
05:36 < deep_blue> but don't connect again
05:36 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
05:46 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:54 <@vpnHelper> RSS Update - forum: http and ssh traffic bug <http://forums.openvpn.net/topic8934.html>
05:55 -!- slickrick [~INTERWORX@CPEc43dc79b28c7-CM00159a648146.cpe.net.cable.rogers.com] has joined #openvpn
06:00 < slickrick> is it possible to use route metrics to allow a site with two connections to connect to an openvpn server on both connections, assigning a higher metric to the better connection?  
06:00 < slickrick> crude diagram: http://pastebin.com/BbBK37Lr
06:00 < slickrick> allowing for some basic failover?
06:01 < dropje> slickrick: you can configure metrics in pushing routes from the server side. but i'm not sure what you mean with assigning a higher metric to the better connection?
06:02 < dropje> example of such a route directive:
06:02 < dropje> push "route 192.168.100.0 255.255.255.0 vpn_gateway 500"
06:02 < slickrick> well it appears only the route command supports metrics, but iroute does not?  
06:02 < dropje> where 500 is the metric
06:03 < dropje> iroute is just used to push a client side network
06:03 < slickrick> lets say i have another client connected to the server and it's going to connect to the 192.168.0.0/24 network.  how will openvpn know which tunnel to use/prefer?
06:04 < dropje> because of your routes?
06:05 < dropje> i would say you would want to use metrics to make sure you clients networks do not clash with your own
06:09 < slickrick> dropje: so for the ccd's this is correct:  http://pastebin.com/via2Nzid ?
06:09 < dropje> if i take a look at your diagram i think i know what you're trying to accomplish. both the T1 and DSL gateway have a vpn tunnel? where do you have you routes configured? on the gateway? the problem is that if you want a failover situation using metrics these routes have to be configured on the clients
06:09 < slickrick> thats correct, they are separate firewalls that have openvpn.
06:09 < deep_blue> dropje : can u see this please? http://forums.openvpn.net/topic8935.html
06:09 <@vpnHelper> Title: OpenVPN Support Forum openvpn connection failed on centos : Server Administration (at forums.openvpn.net)
06:10 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
06:10 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html>
06:11 < slickrick> just wondering if both can connect to the openvpn server at the same time and if there is some way to use metrics to prefer the T1 to get to 192.168.0.0/24 but fall back to the DSL if it's down.
06:11 < dropje> slickrick: im not sure if this will work since your openvpn routing table will have two entries server side for the same network
06:11 < slickrick> thats what i thought.  
06:11 < dropje> i know what you mena
06:11 < dropje> *mean
06:11 < slickrick> you can add metrics to routes, but not to iroutes.
06:11 < deep_blue> dropje: i installed openvpn like how to same as you told 2 days ago, if remember
06:11 < slickrick> if you could then it might work.
06:13 < dropje> slickrick: that would mean you have to be able to add metrics to the openvpn routing table
06:15 < slickrick> dropje: okay, thats what i thought from reading the man page and doing some searching.  it doesn't appear the iroute command can handle a metric, which means i'd have two routes to the same network.
06:16 < dropje> slickrick: yes indeed.. but i'm wondering if this is a setup you would want. the way i think is if its not a functionality of openvpn you're probably looking for the wrong solution for such a setup :) but let me google some
06:17 < slickrick> if it helps my set it is a hub and spoke, multiple clients connecting to the hub and and then crossing the hub to get to networks o nthe other client.
06:18 < slickrick> this particular client has two connections, and i was wondering if there was someway to make use of both.
06:18 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:19 < deep_blue> Hi
06:19 < deep_blue> I installed open vpn same as how-to , and configured in 2 ways, but on both client didn't connect successfully.
06:19 < deep_blue> [size=200][b]Configuration 1:[/b][/size]
06:19 < deep_blue> [b]Server Config:[/b]
06:19 < deep_blue> local x.x.x.x
06:19 -!- deep_blue [~fahimi@2.176.213.20] has quit [Excess Flood]
06:19 -!- deep_blue [~fahimi@2.176.213.20] has joined #openvpn
06:19 < deep_blue> sorry
06:19 < deep_blue> incorrect paste!
06:19 < slickrick> deep_blue: use pastebin.
06:19 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:20 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:20 -!- mode/#openvpn [+v Axeman] by ChanServ
06:22 <@vpnHelper> RSS Update - forum: http and ssh traffic bug <http://forums.openvpn.net/topic8934.html#p16207> || openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16206>
06:24 < dropje> slickrick: basic conclusion, i dont think its possible..
06:27 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 240 seconds]
06:28 <@vpnHelper> RSS Update - forum: TCP/UDP: Socket bind failed on local address already in use <http://forums.openvpn.net/topic8933.html#p16208>
06:30 < dropje> deep_blue: it seems like the initial connection fails.. is there a firewall configured in front of the server? check the topic title ;)
06:34 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16209> || problem with http and ssh <http://forums.openvpn.net/topic8934.html#p16207>
06:35 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
06:36 < deep_blue> dropje: i put reslt of iptables -L -v now and tried again with verb4 config, you can see my result on https://forums.openvpn.net/post16209.html
06:36 <@vpnHelper> Title: OpenVPN Support Forum openvpn connection failed on centos : Server Administration (at forums.openvpn.net)
06:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
06:46 <@vpnHelper> RSS Update - forum: recreate a certificate <http://forums.openvpn.net/topic8936.html>
06:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:00 < ecrist> krzee: I don't have that windows box anymore, I'll see what I can do.
07:00 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
07:00 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
07:01 < ecrist> !ircstats
07:01 <@vpnHelper> "ircstats" is (#1) 30-Day Stats: http://www.secure-computing.net/logs/openvpn-last30.html or (#2) All-Time Stats: http://www.secure-computing.net/logs/openvpn.html
07:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:19 -!- deep_blue [~fahimi@2.176.213.20] has quit []
07:22 <@vpnHelper> RSS Update - forum: Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16211>
07:32 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
07:34 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:34 <@vpnHelper> RSS Update - forum: New clients will not connect to AS 1.8.3 <http://forums.openvpn.net/topic8929.html#p16212>
07:38 < ecrist> !irclogs
07:38 <@vpnHelper> "irclogs" is Channel logs are available at http://secure-computing.net/logs/openvpn.txt and are updated in real-time while ecrist is online.
07:39 < ecrist> heh, that's a bit out of date
07:41 < ecrist> !forget irclogs
07:41 <@vpnHelper> Joo got it.
07:42 < ecrist> !factoids search irc
07:42 <@vpnHelper> 'irc' and 'ircstats'
07:42 < ecrist> !irc
07:42 <@vpnHelper> "irc" is http://www.irchelp.org/irchelp/irctutorial.html
07:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:43 < ecrist> !learn irclogs is Channel logs are available at http://secure-computing.net/logs/#openvpn.log and http://secure-computing.net/logs/#openvpn-devel.log and are updated every three hours.
07:43 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
07:43 < ecrist> !learn irclogs as Channel logs are available at http://secure-computing.net/logs/#openvpn.log and http://secure-computing.net/logs/#openvpn-devel.log and are updated every three hours.
07:43 <@vpnHelper> Joo got it.
07:50 <@vpnHelper> RSS Update - forum: recreate a certificate <http://forums.openvpn.net/topic8936.html#p16213>
07:55 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 252 seconds]
08:03 -!- karname [~roohollah@2.180.45.154] has joined #openvpn
08:03 < karname> Hello , I made an openvpn server with mikrotik 5.7 , I made certificate with startssl.com , I checked it via port 443 (https) and certificate is ok . but when I want to connect to openvpn , I get this error : error=unable to get local issuer certificate: . what should I do ?
08:26 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
08:28 < ecrist> !configs
08:28 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
08:28 < ecrist> !logs
08:28 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:28 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
08:35 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
08:42 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 252 seconds]
08:43 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
09:03 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:03 -!- master_of_master [~master_of@p57B54E27.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:06 -!- master_of_master [~master_of@p57B54035.dip.t-dialin.net] has joined #openvpn
09:21 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 252 seconds]
09:21 <@vpnHelper> RSS Update - forum: need help - client / server config <http://forums.openvpn.net/topic8937.html>
09:38 -!- bitterman [~yury@188.114.60.72] has quit [Quit: Leaving]
09:48 < slickrick> dropje: hey thanks for checking for me, nice to have someone confirm what i already expected.  
09:48 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
09:54 -!- B0bby [~Bobby_Fis@mail.distra.ma] has joined #openvpn
09:54 < B0bby> hello all
09:55 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 252 seconds]
09:55 -!- IsilZha [~andreas@182.55.249.154] has quit [Ping timeout: 276 seconds]
09:55 < B0bby> what do I need to make possible to share files of other servers in my Windows openvpn client ?
09:56 < B0bby> a tunnel is already setup between the network and my client station
09:56 < B0bby> all I need now is to access shared windows file (SMB) from my openvpn client
10:03 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16215>
10:10 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
10:15 <@vpnHelper> RSS Update - forum: need help - client / server config <http://forums.openvpn.net/topic8937.html#p16216>
10:15 -!- ccesario [~ccesario@189-29-35-68-ac.cpe.vivax.com.br] has quit [Read error: Operation timed out]
10:17 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 258 seconds]
10:21 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16217>
10:24 -!- rsc [~robert@fedora/rsc] has joined #openvpn
10:24 < rsc> Hello folks :)
10:25 < rsc> I have two networks which I would like to connect via OpenVPN so that they are one huge network like with a direct network cable -> TAP, right? Will that work for DHCP then as well?
10:25 < rsc> so if I have one DHCP server, will clients in the other part receive IP addresses properly?
10:25 -!- mape2k [~mape2k@p5B24B437.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
10:28 -!- ccesario [~ccesario@187.17.166.162] has joined #openvpn
10:31 -!- B0bby [~Bobby_Fis@mail.distra.ma] has quit [Ping timeout: 248 seconds]
10:33 <@vpnHelper> RSS Update - forum: OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html>
10:40 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
10:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:46 -!- mode/#openvpn [+v Axeman] by ChanServ
10:57 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 260 seconds]
11:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
11:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:12 -!- alabd [alabd@unaffiliated/alabd] has joined #openvpn
11:31 < reiffert> rsc: yes, yes.
11:32 -!- gustav- [~gustav@eth1.etherbyte.com] has joined #openvpn
11:32 < rsc> reiffert: can I use QoS inside of that TAP device e.g. for VoIP?
11:33 < reiffert> My guess is, that you will use the tapinterface and have a bridge with your LAN interfaces.
11:34 < reiffert> !bridge
11:34 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
11:34 < rsc> reiffert: yes, I likely would bridge tap0 with eth0 or so.
11:34 < reiffert> you can do whatever you want with the newly created bridge (and tap of course), e.g. have QoS rules.
11:34 < rsc> reiffert: but what I don't get from this, whether I can apply "tc" stuff to the tap device or not?
11:35 < rsc> ah, so to the bridge, not to the tap device?
11:35 < reiffert> to whatever, it will take you less seconds to just try it out than chatting with me.
11:35 < rsc> I do not have that stuff around, that's why I asked - sorry.
11:38 < reiffert> both are just interfaces.
11:38 < reiffert> regular virtual ones.
11:40 -!- gustav- is now known as beerbro
11:55 -!- luneff [~yury@84.51.192.74] has joined #openvpn
11:56 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:07 <@vpnHelper> RSS Update - forum: New clients will not connect to AS 1.8.3 <http://forums.openvpn.net/topic8929.html#p16219>
12:08 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 255 seconds]
12:17 -!- albech [~albech@183.88.76.120] has quit [Remote host closed the connection]
12:19 -!- mape2k [~mape2k@f053197160.adsl.alicedsl.de] has joined #openvpn
12:23 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
12:30 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Ping timeout: 260 seconds]
12:59 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:59 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:17 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
13:17 -!- kusznir [~kusznir@casas-net.ailab.wsu.edu] has quit [Ping timeout: 260 seconds]
13:19 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16220>
13:24 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
13:28 -!- kusznir [~kusznir@casas-net.ailab.wsu.edu] has joined #openvpn
13:32 -!- alabd [alabd@unaffiliated/alabd] has quit [Quit: Allah bless you]
13:38 <@vpnHelper> RSS Update - forum: OpenVPN on Windows 2008 Server RC2 <http://forums.openvpn.net/topic8877.html#p16221>
13:39 -!- dxtr [ungo6h@dxtr.cc] has joined #openvpn
13:39 -!- dxtr [ungo6h@dxtr.cc] has quit [Changing host]
13:39 -!- dxtr [ungo6h@unaffiliated/dxtr] has joined #openvpn
13:49 < Olipro> surely they mean R2
13:49 <@vpnHelper> RSS Update - forum: OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16222>
13:56 -!- sakamura [~irufus@38.104.99.138] has joined #openvpn
13:56 < sakamura> Hello
13:57 < sakamura> has anyone ever encountered an issue where your route settings were not being applied to the client? As if it's not telling the client to add a specific route?
13:57 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
13:59 < Bushmills> !winroute
13:59 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file or (#2) many users also report it helps to add route-delay to give the interface extra time to get up or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access or (#4) make sure you are running openvpn as admin or (#5) http://openvpn.net/index.php
13:59 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
14:02 <@vpnHelper> RSS Update - forum: OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16223>
14:12 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
14:16 -!- sakamura [~irufus@38.104.99.138] has quit [Ping timeout: 256 seconds]
14:19 -!- sakamura [~irufus@38.104.99.138] has joined #openvpn
14:32 <@vpnHelper> RSS Update - forum: Can´t connect to VPN <http://forums.openvpn.net/topic8939.html>
14:33 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
14:37 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
14:44 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
14:56 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:02 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
15:08 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
15:09 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:09 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:10 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
15:27 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:28 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
15:30 -!- karname [~roohollah@2.180.45.154] has quit [Ping timeout: 256 seconds]
15:42 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has joined #openvpn
15:45 -!- karname [~roohollah@vpnss1.rapidpars.com] has joined #openvpn
16:01 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 255 seconds]
16:06 <@vpnHelper> RSS Update - forum: Openvpn pam authetication - two process created <http://forums.openvpn.net/topic8930.html#p16225>
16:08 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
16:10 -!- karname [~roohollah@vpnss1.rapidpars.com] has quit [Ping timeout: 256 seconds]
16:11 <@vpnHelper> RSS Update - forum: TCP/UDP: Socket bind failed on local address already in use <http://forums.openvpn.net/topic8933.html#p16228> || need help - client / server config <http://forums.openvpn.net/topic8937.html#p16227> || recreate a certificate <http://forums.openvpn.net/topic8936.html#p16226> || [SOLVED] Client has no ip addressed assigned <http://forums.openvpn.net/topic8924.html#p16211>
16:16 -!- dazo is now known as dazo_afk
16:18 <@vpnHelper> RSS Update - forum: [SOLVED] OpenVPN 2.1 requires '--script-security 2' <http://forums.openvpn.net/topic8835.html#p16230> || Can´t connect to VPN <http://forums.openvpn.net/topic8939.html#p16229>
16:29 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has quit [Ping timeout: 240 seconds]
16:33 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
16:33 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:34 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has joined #openvpn
16:36 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html>
16:45 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:00 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16232>
17:06 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
17:07 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
17:07 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:12 <@vpnHelper> RSS Update - forum: Can´t connect to VPN <http://forums.openvpn.net/topic8939.html#p16233>
17:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 258 seconds]
17:25 -!- sakamura [~irufus@38.104.99.138] has quit [Ping timeout: 248 seconds]
17:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:37 -!- sakamura [~irufus@38.104.99.138] has joined #openvpn
17:41 -!- sakamura [~irufus@38.104.99.138] has quit [Ping timeout: 248 seconds]
17:42 -!- cocoa117 [~cocoa117@188-222-31-239.zone13.bethere.co.uk] has quit [Quit: Leaving]
17:43 -!- mape2k [~mape2k@f053197160.adsl.alicedsl.de] has quit [Ping timeout: 252 seconds]
17:45 -!- sakamura [~irufus@38.104.99.138] has joined #openvpn
18:06 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:07 -!- Denial [Denial@drgi.co.uk] has quit []
18:18 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
18:25 -!- sakamura [~irufus@38.104.99.138] has quit [Ping timeout: 248 seconds]
18:44 -!- sakamura [~irufus@38.104.99.138] has joined #openvpn
18:46 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
18:50 < reiffert> rumors tell that Steve Jobs passed away?
18:51 <@raidz> http://www.washingtonpost.com/business/apple-says-steve-jobs-has-died/2011/10/05/gIQAS3ISOL_story.html
18:51 <@vpnHelper> Title: Apple says Steve Jobs has died - The Washington Post (at www.washingtonpost.com)
18:52 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
18:59 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
19:01 <@vpnHelper> RSS Update - forum: New clients will not connect to AS 1.8.3 <http://forums.openvpn.net/topic8929.html#p16234>
19:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:10 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
19:12 -!- IsilZha [~andreas@182.55.249.15] has joined #openvpn
19:14 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
19:21 -!- JC` [jc@versalife.mj-xii.com] has joined #openvpn
19:22 < JC`> hey, all - short of NATing individual VPN users to specific IPs, is there a way I can identify an individual user's traffic for traffic shaping / bandwidth counting?
19:22 < JC`> i did some googling for openvpn and iptables marking or tagging, but i'm not having much luck
19:23 -!- _julian [~quassel@hmbg-5f765361.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:24 < krzie> well
19:24 -!- _julian [~quassel@hmbg-4d06b41d.pool.mediaWays.net] has joined #openvpn
19:25 < krzie> 2 ways
19:25 < krzie> you could have scripts scrape the status file or soemthing of that nature (been done before, dont remember exactly)
19:25 < krzie> OR
19:25 < krzie> you could use a --learn-address (iirc) script to make the firewall rules on the fly
19:25 < krzie> !script
19:25 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
19:28 < JC`> hmm, i guess i could hook in with it, when they're assigned an IP, "mark" it, and use that to count
19:33 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:40 < krzie> you could also give clients static vpn IPs
19:40 < krzie> !static
19:40 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
19:44 -!- sakamura [~irufus@38.104.99.138] has quit [Ping timeout: 248 seconds]
19:58 -!- sakamura [~irufus@32.167.200.236] has joined #openvpn
19:58 < sakamura> hello
20:07 <@vpnHelper> RSS Update - forum: Windows 7 Authtentication <http://forums.openvpn.net/topic8941.html>
20:07 < JC`> thanks for all the help, guys
20:09 < krzie> np
20:10 -!- sakamura [~irufus@32.167.200.236] has quit [Ping timeout: 248 seconds]
20:12 -!- IsilZha [~andreas@182.55.249.15] has quit [Ping timeout: 244 seconds]
20:22 -!- sakamura [~irufus@32.167.68.39] has joined #openvpn
20:25 < sakamura> I need help... and i'm going to kill myself over something really simple and stupid with routing :(
20:26 -!- IsilZha [~andreas@182.55.249.45] has joined #openvpn
20:29 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
20:31 -!- IsilZha [~andreas@182.55.249.45] has quit [Ping timeout: 255 seconds]
20:31 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16236>
20:32 < sakamura> i think i figured it out for now... the adv routing is gonna require research
20:33 < krzie> you still never asked a question
20:33 < krzie> feel free to ask one if you would like help
20:34 < krzie> unfortunately our psychics took the day off
20:35 -!- IsilZha [~andreas@182.55.249.45] has joined #openvpn
20:38 < sakamura> i will ask later
20:38 < sakamura> after the frustration settles and i'm at home
20:39 < sakamura> thank you for your response
20:40 -!- sakamura [~irufus@32.167.68.39] has quit [Quit: Leaving]
20:52 -!- EugeneKay is now known as EugeneSleep
21:18 -!- IsilZha [~andreas@182.55.249.45] has quit [Ping timeout: 260 seconds]
21:20 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
21:20 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
21:33 < ecrist> krzie, ping
21:37 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:38 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:18 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Quit: Konversation terminated!]
22:19 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:22 -!- JC` [jc@versalife.mj-xii.com] has left #openvpn []
22:27 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Quit: Konversation terminated!]
22:27 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
22:40 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
22:44 -!- catsup [~d@ps38852.dreamhost.com] has quit [Quit: leaving]
22:44 -!- Ionic [ionic@ionic.de] has joined #openvpn
22:44 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
22:55 -!- disturbedmime [~derp@host-134-71-250-150.allocated.csupomona.edu] has joined #openvpn
22:56 < disturbedmime> does anyone have a good link for building a custom install package with certs, etc. for end-users (win7), similar to the packages that untangle creates?
22:59 -!- Titania [~titania@221.120.122.106] has joined #openvpn
23:06 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
23:25 -!- Titania [~titania@221.120.122.106] has left #openvpn ["Goodbye :("]
23:30 -!- fulgore [~fulgore@glomsecurity.com] has quit [Ping timeout: 260 seconds]
23:30 -!- fulgore [~fulgore@glomsecurity.com] has joined #openvpn
23:31 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
23:34 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:48 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:48 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
--- Day changed Thu Oct 06 2011
00:16 -!- karname [~roohollah@vpnss1.rapidpars.com] has joined #openvpn
00:28 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:30 -!- disturbedmime [~derp@host-134-71-250-150.allocated.csupomona.edu] has left #openvpn []
00:48 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16237>
00:50 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
00:52 -!- karname [~roohollah@vpnss1.rapidpars.com] has quit [Ping timeout: 255 seconds]
00:56 -!- mape2k [~mape2k@p5B24C377.dip.t-dialin.net] has joined #openvpn
00:57 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:18 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16239> || OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16238>
01:20 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:29 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:31 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
01:32 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
01:32 < dking> What is the correct way to revoke certificates created by the easy-rsa build-key script?
01:32 -!- raidz_afk [~raidz@shiv.bluntshank.com] has joined #openvpn
01:32 -!- raidz_afk is now known as raidz
01:35 -!- raidz [~raidz@shiv.bluntshank.com] has quit [Changing host]
01:35 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
01:35 < reiffert> dking: revoking them is the correct way.
01:35 < reiffert> !revoke
01:35 < reiffert> !crl
01:35 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
01:35 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
01:36 -!- raidz [~raidz@openvpn/corp/admin/andrew] has left #openvpn []
01:36 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
01:36 -!- mode/#openvpn [+o raidz] by ChanServ
01:36 -!- raidz [~raidz@openvpn/corp/admin/andrew] has left #openvpn []
01:37 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
01:37 -!- mode/#openvpn [+o raidz] by ChanServ
01:42 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16240>
02:10 -!- karname [~roohollah@2.180.45.189] has joined #openvpn
02:12 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
02:13 < Mowee> Morning
02:18 <@vpnHelper> RSS Update - forum: TCP/UDP: Socket bind failed on local address already in use <http://forums.openvpn.net/topic8933.html#p16241>
02:19 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
02:20 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:25 -!- IsilZha [~andreas@182.55.249.45] has joined #openvpn
02:27 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
02:35 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
02:36 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:39 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
02:46 -!- karname [~roohollah@2.180.45.189] has quit [Ping timeout: 248 seconds]
03:00 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16243> || TCP/UDP: Socket bind failed on local address already in use <http://forums.openvpn.net/topic8933.html#p16242>
03:02 -!- karname [~roohollah@vpnss1.rapidpars.com] has joined #openvpn
03:03 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:07 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16244>
03:08 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
03:11 -!- auduny [~ay@mail.vgnett.no] has joined #openvpn
03:11  * auduny says hi
03:20 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
03:27 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
03:30 <@vpnHelper> RSS Update - forum: Open VPN Static IP on client side <http://forums.openvpn.net/topic8942.html> || can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879.html#p16245>
03:35 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:43 <@vpnHelper> RSS Update - forum: TCP/UDP: Socket bind failed on local address already in use <http://forums.openvpn.net/topic8933.html#p16247>
03:49 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
03:59 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
04:02 -!- oc80 [oc80z@blea.ch] has joined #openvpn
04:02 -!- oc80z [oc80z@blea.ch] has quit [Read error: Connection reset by peer]
04:06 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:06 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16248>
04:09 -!- albech [~albech@61.7.177.162] has joined #openvpn
04:19 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html> || TCP/UDP: Socket bind failed on local address already in use <http://forums.openvpn.net/topic8933.html#p16249>
04:20 -!- beerbro [~gustav@eth1.etherbyte.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
04:20 -!- beerbro [~gustav@vi.etcpasswd.net] has joined #openvpn
04:27 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16251>
04:28 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:28 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:30 -!- K1ng`` [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
04:33 <@vpnHelper> RSS Update - forum: Open VPN Static IP on client side <http://forums.openvpn.net/topic8942.html#p16252>
04:40 -!- K1ng [~k1ng@58.97.132.210] has joined #openvpn
04:40 -!- K1ng [~k1ng@58.97.132.210] has quit [Changing host]
04:40 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:51 <@vpnHelper> RSS Update - forum: Installing TAP driver on Windows x64 fails [solved] <http://forums.openvpn.net/topic7441.html#p16254> || TAP Device driver will not install in Win7 64bit <http://forums.openvpn.net/topic7663.html#p16253>
05:09 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
05:15 -!- luneff [~yury@109.165.23.143] has joined #openvpn
05:21 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16255>
05:22 -!- bitterman [~yury@109.165.23.143] has joined #openvpn
05:23 -!- cheche [cheche@46.25.80.67] has joined #openvpn
05:24 < cheche> !welcome
05:24 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:24 < cheche> !goal
05:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:25 -!- luneff [~yury@109.165.23.143] has quit [Ping timeout: 252 seconds]
05:25 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
05:27 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16256>
05:28 < cheche> I want 15 clients ( only a few at the same time) to access a samba share on a debian server from remote offices. Do you recoment setting up openvpn on the server or build a dedicate router that suport vpn?
05:32 < Bushmills> openvpn on server should be fine
05:33 < Bushmills> slightly easier, configuration-wise too
05:33 < cheche> Bushmills: thanks. I was thinking instead of buying a ready to go VPN hardware. Use Openwrt instead
05:34 < Bushmills> openvpn is available for openwrt
05:35 < cheche> Bushmills: I guess that if we have a linux runing 24x7 then using a openwrt is not needed.
05:35 < Bushmills> but openwrt routers tend not to be the most powerful ones. encryption speeds may suffer.  
05:35 < cheche> Bushmills: oh! but using a server it does not have a problem to hadle 5 connections right?
05:36 < Bushmills> no problem
05:37 < cheche> Bushmills: brilliant thanks. would it be very dificult to change openvpn from routing to bridging once you setup all?
05:38 < cheche> I remeber that setting up routing  was quite easy. but i never got in to bridging the whole LAN 
05:38 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16257>
05:38 < Bushmills> nope, but most likely unnecessary
05:39 < Bushmills> for openvpn, you merely change to tap instead of tun.  but setting up the bridge you'd need to do independently 
05:39 < Bushmills> !tunortap
05:39 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
05:39 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
05:39 < SviMik> bridging is also easy. with bridging you even don't need to do anything with iptables
05:40 < cheche> the trouble i got is that all the offices have 192.168.1.x ip addresses
05:41 < cheche> so first i need to change those to something like 192.168.2.x 192.168.3.x ... and so on.
05:45 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
05:47 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
05:47 < SviMik> !wins
05:47 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
05:53 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:54 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:55 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16258>
06:04 -!- cocoa117 [~cocoa117@wk-28-224.guest.rdg.ac.uk] has joined #openvpn
06:07 -!- karname [~roohollah@vpnss1.rapidpars.com] has quit [Ping timeout: 245 seconds]
06:13 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16260> || OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16259>
06:17 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
06:18 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
06:19 <@vpnHelper> RSS Update - forum: OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16263> || Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16262>
06:24 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:24 <@vpnHelper> RSS Update - forum: Windows 7 Authtentication <http://forums.openvpn.net/topic8941.html#p16265> || can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16264>
06:24 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:24 -!- mode/#openvpn [+o mattock] by ChanServ
06:25 -!- EugeneSleep is now known as EugeneKay
06:27 -!- karname [~roohollah@2.180.45.189] has joined #openvpn
06:31 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html> || Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16267> || can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16266>
06:37 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16269>
06:38 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
06:43 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16271>
06:49 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16272>
06:49 -!- slickrick [~INTERWORX@CPEc43dc79b28c7-CM00159a648146.cpe.net.cable.rogers.com] has quit [Quit: Ex-Chat]
06:50 -!- karname [~roohollah@2.180.45.189] has quit [Ping timeout: 276 seconds]
06:54 -!- cpm is now known as ignore-me
06:54 -!- ignore-me is now known as cpm
06:54 -!- cpm_ [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:55 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16273>
06:57 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
06:59 -!- bauruine [~stefan@92.105.202.246] has joined #openvpn
07:04 -!- karname [~roohollah@vpnss1.rapidpars.com] has joined #openvpn
07:19 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16274>
07:20 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:20 -!- cpm_ [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm_]
07:37 <@vpnHelper> RSS Update - forum: how to connect 2 networks with openvpn at the same dhcp serv <http://forums.openvpn.net/topic8931.html>
07:40 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has joined #openvpn
07:40 < louiscyfer> Hi everybody
07:40 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Quit: Leaving.]
07:40 < louiscyfer> i need to install an openvpn with the login password authentication method
07:41 < louiscyfer> I want to use a separate passed file from the system one
07:41 < louiscyfer> How to generate it a manage it ?
07:41 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:43 < EugeneKay> !authpass
07:43 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
07:44 < EugeneKay> You will need to write a script for --auth-user-pass-verify to check against. It's up to you how to have it do its thing. 
07:44 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has joined #openvpn
07:46 -!- robert83a2 [~robert83a@gandalf.topolauniverzal.com] has joined #openvpn
07:47 < robert83a2> hello, Is there an openvpn client for nokia e7?
07:47 < robert83a2> wanna connect to my openvpn server from this phone ( my own private server )
07:48 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:48 < EugeneKay> I don't believe so, no.
07:48 <@vpnHelper> RSS Update - forum: Windows 7 Authtentication <http://forums.openvpn.net/topic8941.html#p16275>
07:49 < EugeneKay> If there is, it's probably realllllly old.
07:50 < louiscyfer> EugeneKay the script exist in the openvpn distro auth-pam.pl 
07:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:50 < louiscyfer> My question is how can i handle the password file for it
07:50 < robert83a2> damn nokia sucks at this then, any alternatives that can connect to openvpn server , and don't have to pay for something that is free...
07:50 < EugeneKay> That is an example script which uses PAM. I don't know the ins and outs of it, your best bet is to consult the inline docs for it.
07:51 < EugeneKay> robert83a2 - buy an Android ;-)
07:51 < robert83a2> I'll stick to my iphone thanks :)
07:51 < robert83a2> wont buy any phone that costs 800USD and has no "free" software to sync with outlook....
07:51 < louiscyfer> EugeneKay if i am here it is because i don't find the answer neither in man neither on the doc and website
07:52 < EugeneKay> louiscyfer - and the best I can offer you is "I dunno, I don't use that". If you're patient, somebody else might be around.
07:52 < louiscyfer> Ok 
07:53 < louiscyfer> so oi'll wait a re-ask
07:53 < EugeneKay> robert83a2 - mine syncs with Outlook just fine.
07:54 < rsc> OpenVPN + Android still requires jailbreaking/rooting/customROM, right?
07:55 -!- robert83a2 [~robert83a@gandalf.topolauniverzal.com] has quit []
07:55 -!- igormorgado [~igormorga@mvx-200-142-107-126.mundivox.com] has joined #openvpn
07:55 < igormorgado> hi all.
07:55 < EugeneKay> Correct. Not in AOSP.... dunno that it ever will be.
07:56 < EugeneKay> If somebody were to improve the CM implementation and submit to AOSP, it might get accepted.
07:56 < igormorgado> I have "built" a CA, how can I list my CA public key information for remote validation?
07:56 < EugeneKay> igormorgado - provide your ca.crt and generate a ca.crl.
07:57 < igormorgado> EugeneKay: with which command?
07:58 < igormorgado> something like this ? openssl ca -gencrl -keyfile ca_key -cert ca_crt -out my_crl.pem 
07:58 -!- oc80 [oc80z@blea.ch] has quit [Excess Flood]
07:58 < louiscyfer> igor... openvpn provide very simple to use set of script 
07:59 < louiscyfer> look for easyrsa
07:59 < EugeneKay> Docs say that revoke-full script(from easy-rsa) should spit out a crl. If you don't ahve nything revoked, then yes, that openssl command should work.
07:59 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:00 < louiscyfer> Question : if you remove the client certificate from your openvpn setting folder
08:00 < louiscyfer> you don't need to revokate it 
08:00 < EugeneKay> Recovation should be used whenever a key is compromised or lost. 
08:00 < EugeneKay> revocation, even.
08:01 < EugeneKay> If it's simply been deleted, and you are sure that it is still "secure", then no, you really don't NEED to revoke it. I still would.
08:02 < louiscyfer> lol man openvpn | grep crl nothing
08:03 < louiscyfer> sorry 
08:03 < louiscyfer> i am wrong
08:03 < EugeneKay> That's because easy-rsa isn't in the openvpn man page ;-)
08:04 < louiscyfer> you have the verify-crl option
08:04 < louiscyfer> In any case certificates are too complex for my users
08:05 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16276>
08:07 -!- karname [~roohollah@vpnss1.rapidpars.com] has quit [Ping timeout: 248 seconds]
08:07 < louiscyfer> like that : "What happens when internet stops?"
08:07 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
08:07 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
08:11 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:15 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:16 -!- donspaulding [~donspauld@c-67-173-34-83.hsd1.il.comcast.net] has joined #openvpn
08:16 < donspaulding> !welcom
08:17 < donspaulding> err, !welcome
08:17 < EugeneKay> !welcome
08:17 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:17 < EugeneKay> ;-)
08:17 < donspaulding> EugeneKay: thanks
08:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
08:19 < donspaulding> !goal
08:19 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:23 < donspaulding> my goal: to secure all communications between linux servers colocated in all of our data centers.  Such that server1datacenter1 can access server1datacenter2 via a private IP.  A secondary goal is to connect our local office network in the same way, so I can ping server1datacenter1 via this same private IP.
08:23 < donspaulding> I'm at the stage where I'm looking for suggestions on the setup and what's possible.
08:24 < EugeneKay> That's all very possible.
08:25 < donspaulding> For instance, will this require a dedicated gateway of some kind at each site?  Is there any intelligence to the routing of the traffic, or will all traffic be broadcast to all sites?
08:25 < EugeneKay> If you stick to a single-hub architecture, the routing and VPN links are (fairly) trivial. 
08:25 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:26 < EugeneKay> You would run the OpenVPN client on the gateway router at each site providing a LAN, and on each non-LANed client(eg, VPSes)
08:26 < EugeneKay> Things get tricky if you want to have redundant hubs.
08:27 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16278> || (solved) need help - client / server config <http://forums.openvpn.net/topic8937.html#p16277>
08:29 < donspaulding> EugeneKay: I don't have a gateway router at any site but the local office.  The gateway is provided by the ISP at the datacenter.  Are you saying I'll need to turn one box at each location into a gateway to the VPN?
08:30 < EugeneKay> That's the usual way, yes. 
08:30 < EugeneKay> Depending upon how your rack is physically cabled at the datacenter, you may be able to setup a private net with a static route to the VPN IPs
08:30 < EugeneKay> s/IPs/subnet/
08:33 < donspaulding> So (architecture-wise, not traffic-wise) this would look like:  [server1] —> [dc1gateway] —> [vpnserver at home office] <— [dc2gateway] <— [server2]
08:33 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16279>
08:33 < EugeneKay> Unless you have a big, fat pipe coming into your home office, I would recommend running the VPN server at one of the DCs
08:34 < donspaulding> OK, so there's no bypassing the central hub for actual LAN-to-LAN traffic then, is that right?
08:35 < EugeneKay> Traffic between two "spoke" LANS has to go through the hub server.
08:35 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
08:35 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
08:36 < EugeneKay> (That's a yes, I think)
08:36 < donspaulding> EugeneKay: hmm, then I'm not sure that's what I want.  We currently are in 4 geographically-dispersed datacenters, and I don't want any of them to be responsible for all the traffic.
08:37 < EugeneKay> You can build a dual-hub setup using Quagga or such to handle your routes. 
08:38 < EugeneKay> Each Spoke server would be connected to two Hubs, and then decide which Hub to route traffic to another Spoke via OSPF(or IGP, or something). If you lose one Hub, it /ought/ to keep working with the other one
08:39 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:39 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:39 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:39 -!- mode/#openvpn [+v Axeman] by ChanServ
08:40 < donspaulding> EugeneKay: my worries with it are more performance-centric than redundancy-centric
08:40 < EugeneKay> That'll be a question for Quagga to answer.
08:40 < EugeneKay> OpenVPN (sadly) does not have a Mesh topology
08:41 < donspaulding> So, aside from the hub-spoke model, I'm left with setting up my own mesh to achieve the "One network to rule them all" goal?
08:41 -!- sikker [~sikker@cpe.xe-3-0-0-3332.vbrnqu2.customer.tele.dk] has joined #openvpn
08:42 < EugeneKay> Mmmhmmm
08:42 < EugeneKay> Best you can do is a emss of P2P links
08:42 < sikker> I want to configure a number of domains/IP addresses that the VPN server should "take charge" of being a proxy for, for connected users. That is, I want remote users to identify as the VPN server's public IP when accessing those sites
08:42 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:43 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:43 < donspaulding> EugeneKay: OK, so where do I start building the hub-spoke model?  I've really only got one or two spokes that need to be setup now, and I don't mind addressing the additional complexity later.
08:43 < EugeneKay> sikker - push a route for those IP blocks to clients(or have the clients do the route themselves, but that's harder to maintain), and then setup SNAT/MASQUERADE for the client IPs
08:44 < EugeneKay> donspaulding - http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
08:44 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
08:44 < sikker> do you have any useful links for this?
08:45 < EugeneKay> !redirect
08:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
08:45 < donspaulding> EugeneKay: BTW, I'm assuming there's nothing stopping me from putting a hub and one of the spokes on the same machine, right?
08:45 < EugeneKay> Same things as that, but using push "route 1.2.3.4/5" instead of def1
08:46 < EugeneKay> donspaulding - Well, insanity in the routes table. You don't need to run the two clients, though - just tell the Hub to push a route to it's LAN. 
08:46 < EugeneKay> s/clients/instances/
08:47 < donspaulding> cool
08:47 < EugeneKay> s/it's/its/
08:47 < sikker> EugeneKay: that !redirect one was for me, right?
08:47 < EugeneKay> sikker - aye
08:47 < sikker> thanks
08:47 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
08:47 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:48 < EugeneKay> donspaulding - to continue the wagon analogy, you'd be granting access to a subnet on the Axle, rather than out a spoke.
08:48  * donspaulding has a sudden urge to play Oregon Trail
08:50  * EugeneKay picks Ford
08:51 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
08:51 < donspaulding> I played that game strictly for the hunting.
08:51 < EugeneKay> Heh
08:57 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:58 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:59 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
09:03 -!- master_of_master [~master_of@p57B54035.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
09:08 -!- master_of_master [~master_of@87.181.75.61] has joined #openvpn
09:11 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
09:11 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
09:11 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
09:14 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:15 -!- axelm7 [~Admin@190.244.2.234] has joined #openvpn
09:16 < axelm7> hi guys, I am looking for some advice on using OpenVPN to concentrate 100 Cisco 867 routers using IPSec. Is it doable?
09:18 < Bushmills> openvpn can tunnel ipsec, but won't talk to ipsec machines
09:19 < axelm7> Bushmills, hi. thanks for your answer. What should I look for? OpenSwan?
09:20 < Bushmills> probably, yes
09:21 < Bushmills> or strongswan, a fork
09:21 < Bushmills> fork of freeswan
09:22 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
09:22 < EugeneKay> Wheeee BSD.....
09:29 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:30 < axelm7> strongswan looks good. unfortunately I have never ever used BSD and I am racing to get this done on time. no time to learn a new environment
09:31 -!- bitterman [~yury@109.165.23.143] has quit [Quit: This computer has gone to sleep]
09:37 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
09:38 < Bushmills> strongswan is available for linux too
09:42 -!- helllen [~helllen@77.231.152.50] has joined #openvpn
09:44 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:45 < axelm7> anybody here want to sell me some of your consulting time?
09:45 < krzie> with openvpn or ipsec?
09:46 < krzie> if you need it for ipsec, its off topic, but you are looking for a consultant (and nobody is here looking for help with openvpn at the moment) so go ahead... if it is with openvpn i would be open to some consulting
09:46 < axelm7> the 100 stores will have Cisco 867. Be my guest, use whatever you consider more stable
09:46 < krzie> openvpn doesnt run on those
09:47 < axelm7> the cisco 867 already has VPN support built in. I am talking about consulting on setting up the concentrator
09:48 < krzie> !notcompat
09:48 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible or (#2) openvpn only connects to openvpn
09:48 < krzie> i dont think you understand, they support vpn, but not openvpn
09:48 < krzie> they support ipsec
09:51 < axelm7> I understand perfectly
09:52 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 244 seconds]
09:52 < krzie> [07:46]  <axelm7> the 100 stores will have Cisco 867. Be my guest, use whatever you consider more stable
09:52 <@vpnHelper> RSS Update - forum: OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16280>
09:53 < krzie> there are no options in relation to my question
09:53 < krzie> i had asked if you meant ipsec or openvpn
09:54 < krzie> anyways, not me for ipsec, feel free to see if someone reads the scroll and offers to do the job... but once people are here looking for help no more ipsec talk =]
09:54 < Bushmills> i think he means to  use openvpn to tunnel several ipsec links
09:55 < krzie> is that what you mean axelm7?  you already have ipsec setup and just want openvpn to tunnel that ipsec traffic?
09:55 < krzie> (i understood it differently)
09:56 < krzie> the packets would have a funny path to exit the lan, lol
09:56 < Bushmills> at least that's how i understood the "concentrator" part of the initial question
09:56 < krzie> source -> router -> vpn node -> router ----internet -> router -> vpn node -> router -> target
09:58 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:00 < axelm7> I have cisco 867 at the gasoline stations and I do not have a VPN concentrator setup yet.
10:00 < axelm7> the path would be source -> router with IPSEC -> internet -> router -> vpn concentrator -> lan
10:02 < axelm7> it could also be source -> cisco 867 ipsec -> internet ->Cisco router with support for 100 site to site connections -> lan
10:06 < krzie> right, just as i thought, nothing to do with openvpn
10:07 < axelm7> I got the "no ipsec chat please" message. Thanks for the help anyways. I would love to use openvpn for this but unfortunately the corporation wants Cisco
10:07 < EugeneKay> Yay "corporation" :-p
10:08 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
10:08 < krzie> axelm7, Bushmills thought you did want openvpn in there, we were clearing that up
10:09 < axelm7> The Cisco 867s have not been purchased yet. Can you guys suggest some other adsl modem router that supports openvpn? no dd-wrt or openwrt please
10:10 < krzie> it would need to be openwrt or dd-wrt or something similar
10:10 < krzie> or tomoto router firmware
10:10 < krzie> tomato*
10:11 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:11 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:11 < krzie> some sort of linux embedded distro
10:11 < hyper_ch> tomato <3
10:11 < axelm7> my own tests at home using openvpn have not been successful. My wrt600n would reboot constantly if I activated openvpn
10:11 < krzie> and mine have all been successful
10:11 < krzie> ;]
10:12 < axelm7> probably ddwrt had some issue on my particular router
10:12 < krzie> i use openwrt
10:12 < axelm7> hey I am not criticizing openvpn, just my tests
10:12 < krzie> tried dd-wrt, didnt like it as much
10:12 < krzie> but that was related to customizing upon making my own firmware
10:13 < krzie> openwrt has nice tools for that :)
10:13 < krzie> i roll up my own firmware for each router with openvpn built in and already configured for the client
10:13 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:13 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:13 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:13 < axelm7> I will have trouble getting the customer to approve a home built distro
10:14 < krzie> thats fine
10:14 -!- bauruine [~stefan@92.105.202.246] has quit [Read error: Connection reset by peer]
10:14 < krzie> however, you are aware you dont need openvpn on the router, right?
10:14 < krzie> in fact you may be the perfect type of person for access-server
10:14 < krzie> the version of openvpn that comes with corporate support =]
10:15 < krzie> !as
10:15 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
10:15 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Remote host closed the connection]
10:15 < krzie> its not opensource, it costs $, but it comes with corporate support and is easier to manage
10:15 -!- Cr4zi3 [killaz@184.95.44.187] has joined #openvpn
10:15 < axelm7> I will need a support contract, so it sounds like OpenVPN-AS is ideal for me
10:16 < krzie> and it is developed by the same company
10:16 < krzie> (openvpn technologies)
10:16 < krzie> yes, sounds to me like you are the ideal candidate for AS
10:16 < krzie> give it a look =]
10:17 < krzie> i dont know much about it, since i have very different needs than you... but the guys in that channel are devs / hired support techs... they know what they are talking about
10:18 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:18 -!- sikker [~sikker@cpe.xe-3-0-0-3332.vbrnqu2.customer.tele.dk] has quit [Ping timeout: 244 seconds]
10:18 -!- kusznir [~kusznir@casas-net.ailab.wsu.edu] has left #openvpn ["Leaving"]
10:18 < axelm7> thanks krzie, you have been very helpful
10:19 < krzie> no problem
10:22 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
10:22 < EugeneKay> I really wish they would find a different model for the art on the openvpn.net front page. The sex appeal just isn't there for me.
10:22 -!- luneff [~yury@84.51.192.74] has joined #openvpn
10:23 < EugeneKay> </random>
10:26 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16282> || OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16281>
10:26 < krzie> hah i havnt seen that page in so long
10:26 < krzie> and dont lie, you love that model!
10:26 < krzie> ;]
10:27 < EugeneKay> http://lesbianswholooklikejustinbieber.tumblr.com/
10:27 <@vpnHelper> Title: Lesbians Who Look Like Justin Bieber (at lesbianswholooklikejustinbieber.tumblr.com)
10:27 < EugeneKay> Just sayin'
10:27 < krzie> haha
10:28 < krzie> its not that they look like him... its that he looks like a lesbian ;)
10:28 < ecrist> krzie: I have new stats pages
10:28 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:28 < ecrist> !ircstats
10:28 <@vpnHelper> "ircstats" is (#1) 30-Day Stats: http://www.secure-computing.net/logs/openvpn-last30.html or (#2) All-Time Stats: http://www.secure-computing.net/logs/openvpn.html
10:28 < ecrist> gah
10:28 < ecrist> !forget stats
10:28 <@vpnHelper> Error: There is no such factoid.
10:28 < ecrist> !forget ircstats
10:28 <@vpnHelper> Error: 2 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
10:28 < ecrist> !forget ircstats *
10:28 <@vpnHelper> Joo got it.
10:29 < ecrist> !learn ircstats as See http://secure-computing.net/logs/openvpn.html for all-time IRC stats.
10:29 <@vpnHelper> Joo got it.
10:29 < ecrist> !learn ircstats as See http://secure-computing.net/logs/openvpn-devel.html for all-time dev channel IRC stats.
10:29 <@vpnHelper> Joo got it.
10:29 < krzie> cool!
10:30 < EugeneKay> You need to ignore ChanServ
10:30 < krzie> lol i love my random quote
10:30 < krzie> "unfortunately our psychics took the day off"
10:31 < krzie> Poor krzee, nobody likes him. He was attacked 18 times.
10:31 < krzie> For example, like this:
10:31 < krzie>      * jeev beats krzie with Dryanta's buttscratcher
10:31 < krzie> hahahaha
10:32 < krzie> vpnHelper spoke a total of 850017 words! 
10:32 < krzie> vpnHelper's faithful follower, krzee, didn't speak so much: 591024 words.
10:32 < krzie> seems that part is wrong
10:32 < krzie> krzee	85180
10:33 < ecrist> hrm
10:33 < krzie> ohhh
10:33 < ecrist> eventually I'll get mircstats going again, but I blew away the windows box that used to run on
10:33 < krzie> words VS lines
10:33 < ecrist> ecrist is a very aggressive person. He attacked others 8 times.
10:34 < krzie> you're the channel sherrif!
10:34 < krzie> (i guess that makes me the deputy)
10:34 -!- mode/#openvpn [+o EugeneKay] by ChanServ
10:34 -!- krzie was kicked from #openvpn by EugeneKay [Padding your kick-count for no discernible reason ]
10:34 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
10:34 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
10:34 < krzie> lol
10:35 < krzie> nice eric, thanks for the updated stats =]
10:37 < ecrist> these run on a cron job, should be updated every 3 hours or so.
10:37 < krzie> sweet
10:39 < ecrist> ah, neat
10:39 < ecrist> refresh, krzie.  now the graphs have color.
10:39 < krzie> ahh cool
10:40 < krzie> why are you and i blue like a link?
10:42 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
10:43 < ecrist> because we're male in the config
10:43 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 252 seconds]
10:44 -!- drakuwa [~draki@95.180.213.70] has joined #openvpn
10:44 < drakuwa> can anyone help me?
10:44 < drakuwa> i have a simple newbie tunneling question
10:45 < ecrist> the answer is 'yes'  NEXT
10:46 < drakuwa> ok, so I have a simple point-to-point static key client-server tunnel
10:46 < drakuwa> it works, i can ping server from client and vise versa...
10:47 < drakuwa> so now i want to redirect all internet trafic from the client to the vpn tunnel
10:47 < drakuwa> i added push "redirect-gateway def1" to the server side configuration, and still doesn't work
10:48 < drakuwa> btw what does def1 mean?
10:48 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16283>
10:48 < ecrist> krzie: I marked vpnHelper as a girl. shows up pink
10:49 < ecrist> !factoids
10:49 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:50 < ecrist> also, vpnHelper's nick links to the factoids page now
10:51 < krzie> hey good idea!
10:55 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
10:56 < drakuwa> anyone?
11:00 < krzie> !def1
11:00 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
11:00 < krzie> !redirect
11:00 < EugeneKay> "Default, via /1 trick"
11:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
11:06 <@vpnHelper> RSS Update - forum: Group Restriction when authenticating via Ldap <http://forums.openvpn.net/topic8948.html>
11:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
11:07 < drakuwa> ok, so far I've done all that is suggested
11:07 < drakuwa> and still the tunnel doesn't work for general traffic
11:08 < drakuwa> I do not have a default route on the client pc through the vpn tunnel
11:08 < drakuwa> how do I debug and find the problem?
11:09 < krzie> !configs
11:09 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
11:09 < krzie> !logs
11:09 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
11:12 <@vpnHelper> RSS Update - forum: UCARP-based failover <http://forums.openvpn.net/topic8949.html> || can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16285>
11:13 < drakuwa> krzie: http://paste.pocoo.org/show/488330/
11:14 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:15 -!- mape2k [~mape2k@p5B24C377.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
11:18 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314-15.html#p16287>
11:21 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
11:24 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314-15.html#p16288>
11:30 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:35 -!- albech [~albech@61.7.177.162] has quit [Remote host closed the connection]
11:36 < drakuwa> so, anything wrong with the conf files? 
11:51 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 244 seconds]
11:54 <@vpnHelper> RSS Update - forum: Test <http://forums.openvpn.net/topic8346.html#p16289>
12:00 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:04 -!- arosen [~arosen@130.127.39.181] has quit [Remote host closed the connection]
12:09 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 258 seconds]
12:10 -!- illsci [~jsabo@96.255.235.187] has joined #openvpn
12:10 < illsci> Can open vpn authenticate in a client server setup using a preshared key
12:13 < drakuwa> illsci: don't bother no-one will help, I am waiting a whole hour for an answer... I think this will be useful http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
12:13 <@vpnHelper> Title: Static Key Mini-HOWTO (at www.openvpn.net)
12:37 < SviMik> drakuwa first, open the client's log and check 1. does openvpn tries to add a route? 2. is it sucessful or some errors?
12:38 -!- cocoa117 [~cocoa117@wk-28-224.guest.rdg.ac.uk] has quit [Quit: Leaving]
12:39 < SviMik> drakuwa if you are using windows 7 - you should run client with administrator privileges. so, if you are using GUI on the client side - use right click - "Run as administrator" to start OpenVPN GUI.
12:40 < drakuwa> SviMik: no, I am running Fedora on both client and server...
12:40 < drakuwa> and no, there is no entries in the client log of openvpn trying to add a route...
12:40 < SviMik> then, read my previous message :)
12:41 < drakuwa> just a sec.
12:42 < SviMik> you may try to add to client config: redirect-gateway def1
12:43 < drakuwa> SviMik: here is the client side log: http://paste.pocoo.org/show/488384/
12:43 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:44 < SviMik> drakuwa use "verb 4" in client's config. it gives more information to log
12:47  * SviMik doesn't remember, should redirect-gateway work in unix, or it requires start-stop scripts?
12:49 -!- drakuwa [~draki@95.180.213.70] has quit [Read error: Operation timed out]
12:50 -!- drakuwa [~draki@95.180.214.37] has joined #openvpn
12:51 < drakuwa> adding redirect-gateway def1 to the client side worked, thank you SviMik, now with traceroute I get the first hop to be the tunnel ...
12:53 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
12:54 < krzie> SviMik, the start stop scripts for unix only... you're probably thinking of pushing dns
12:55 < krzie> sorry i never looked at your pastebin drakuwa, work got busy
12:55 < krzie> but it looks like SviMik got you taken care of
12:55 < krzie> illsci, no, psk is only for peer to peer
12:56 < krzie> server/client needs certs or password auth (or both)
12:56 -!- drakuwa_ [~draki@95.180.213.70] has joined #openvpn
12:57 -!- drakuwa [~draki@95.180.214.37] has quit [Ping timeout: 258 seconds]
12:57 <@vpnHelper> RSS Update - forum: OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16290>
13:05 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
13:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:10 -!- drakuwa_ [~draki@95.180.213.70] has quit [Remote host closed the connection]
13:14 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314-15.html#p16291>
13:15 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
13:20 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:20 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
13:28 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
13:40 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
13:41 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:43 <@vpnHelper> RSS Update - forum: No traffic trough TAP0 device <http://forums.openvpn.net/topic8950.html> || Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16292>
13:49 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16295> || OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16294>
13:54 <@vpnHelper> RSS Update - forum: No traffic trough TAP0 device <http://forums.openvpn.net/topic8950.html#p16296>
13:59 <@vpnHelper> RSS Update - forum: No traffic trough TAP0 device <http://forums.openvpn.net/topic8950.html#p16297>
14:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
14:10 -!- rawplayer [~foo@2001:610:158:1020:216:3eff:fe64:6606] has joined #openvpn
14:10 < rawplayer> hi
14:11 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:33 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
14:36 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
14:37 <@vpnHelper> RSS Update - forum: No traffic trough TAP0 device <http://forums.openvpn.net/topic8950.html#p16298>
14:40 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:41 -!- taypen [~Stas@DSL212-143-220-82.bb.netvision.net.il] has joined #openvpn
14:41 < taypen> hello
14:43 < taypen> can somebody help me? i'm getting this http://pastebin.com/sPLKn9gY error when trying to connect to my openvpn
14:45 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
14:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:46 -!- mode/#openvpn [+v Axeman] by ChanServ
14:47 < taypen> i'm using iptables but i changed the input and forward  policy to ACCEPT
14:47 < taypen> same with output
14:48 <@vpnHelper> RSS Update - forum: No traffic trough TAP0 device <http://forums.openvpn.net/topic8950.html#p16299>
14:50 < krzie> did you do that for tun+ as well?
14:50 < krzie> and why are you using tcp?
14:51 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
14:53 < taypen> anybody?
14:53 < taypen> )
14:53 <@vpnHelper> RSS Update - forum: No traffic trough TAP0 device <http://forums.openvpn.net/topic8950.html#p16300>
14:53 -!- shtrb [~user@unaffiliated/shtrb] has joined #openvpn
14:53 < krzie> taypen, i just responded...
14:57 -!- taypen [~Stas@DSL212-143-220-82.bb.netvision.net.il] has quit [Read error: Operation timed out]
14:57 -!- taypen [~Stas@DSL212-143-220-82.bb.netvision.net.il] has joined #openvpn
14:59 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:00 < krzie> heh
15:03 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
15:04 -!- taypen [~Stas@DSL212-143-220-82.bb.netvision.net.il] has quit [Read error: Connection reset by peer]
15:05 -!- taypen [~Stas@212.143.220.82] has joined #openvpn
15:06 < taypen> in log of client i see VERIFY ERROR: depth=1, error=certificate is not yet valid
15:06 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
15:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 244 seconds]
15:07 < illsci> How can i get a client to establish 3 point to point vpns 
15:08 < illsci> I have three sup1.conf sup2.con sup3.conf 
15:08 < illsci> and each has different remotes and ips but openvpn will only bring the first up and then it errors out
15:09 < illsci> Oct  6 20:07:21 ip-10-85-75-173 ovpn-mdb2[16268]: TCP/UDP: Socket bind failed on local address [undef]: Address already in use
15:09 < illsci> I have dev tun... 
15:09 -!- taypen [~Stas@212.143.220.82] has quit [Read error: Connection reset by peer]
15:09 -!- taypen [~Stas@DSL212-143-220-82.bb.netvision.net.il] has joined #openvpn
15:10 <@vpnHelper> RSS Update - forum: No traffic trough TAP0 device <http://forums.openvpn.net/topic8950.html#p16301>
15:10 < reiffert> Address already in use
15:11 < reiffert> !factoids search local
15:11 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
15:11 < illsci> I dont understand...
15:11 < reiffert> forget about that. however.
15:12 < reiffert> sup1,2,3. are those clients or servers?
15:12 < illsci> i have a host that i want to make 3 p2p connections
15:12 < illsci> the host with the configs for sup 1 2 3 is a client
15:12 < illsci> to 3 different servers
15:12 < illsci> I want to setup 3 independant tunnels
15:12 < illsci> so I made 3 of the same configes but used different ips
15:12 < illsci> and remote names
15:12 < reiffert> it should work then. looks like you misconfigured something. bring up all of those config files please.
15:13 < reiffert> !pastebin
15:13 < reiffert> !paste
15:13 < reiffert> !pb
15:13 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
15:13 <@vpnHelper> Miscellany || Someone || end3r || OS X keychain patch
15:14 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:14 < illsci> http://www.pastie.org/2651557
15:16 < reiffert> let me look at it.
15:17 < illsci> thanks
15:17 < reiffert> how do you call them?
15:17 < illsci> they all just sit in /etc/openvpn
15:17 < illsci> i thought it loads all the .conf files in there
15:18 < reiffert> who is "it" calling sitting conf files?
15:18 < illsci> openvpn
15:19 < reiffert> you need to start three openvpn processes and hand one config file to every instance.
15:19 < illsci> oh... ok
15:19 < illsci> Is there a clearer way to do that
15:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:19 < illsci> can I have them all in the same file or something
15:19 < reiffert> "or something"?
15:21 < illsci> well it loops around and finds all the config files
15:21 < reiffert> it?
15:21 < illsci> so its like its going to be fine and just run them all otherwise why would it bother
15:21 < illsci> the init script for debian
15:21 < illsci> er ubuntu
15:21 < illsci> ./etc/init.d/openvpn 
15:21 < reiffert> how should I know?
15:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:21 < reiffert> however.
15:21 < reiffert> krzee: u there?
15:22 < reiffert> illsci: stop openvpn. /etc/init.d/openvpn stop
15:22 < reiffert> illsci: then run on the cmd line:
15:22 < reiffert> openvpn --config /etc/openvpn/mdb1.conf
15:22 < reiffert> then do:
15:22 < reiffert> echo "verb 5" >> /etc/openvpn/mdb2.conf
15:22 < reiffert> and
15:23 < reiffert> echo "verb 5" >> /etc/openvpn/mdb3.conf
15:23 < reiffert> then:
15:23 < reiffert> openvpn --config /etc/openvpn/mdb2.conf
15:23 < krzee> im here
15:23 < reiffert> then paste what comes out in /var/log/syslog
15:23 < reiffert> krzee: intresting problem on illsci.
15:23 < reiffert> krzee: http://www.pastie.org/2651557
15:24 < reiffert> krzee: running 3 openpvn instances, but the 2nd and 3rd one refuse to start, because of
15:24 < reiffert>  Oct  6 20:07:21 ip-10-85-75-173 ovpn-mdb2[16268]: TCP/UDP: 
15:24 < reiffert>                 Socket bind failed on local address [undef]: Address already in 
15:24 < reiffert>                 use
15:24 -!- mirco [~mirco@p5B283A33.dip.t-dialin.net] has joined #openvpn
15:24 < krzee> lport
15:24 < krzee> (guessing)
15:24 < |Mike|> is he using the same port for all instances?
15:25 < reiffert> lport should be random if not specific?
15:25 < reiffert> mike he didnt specify any
15:25 < krzee> anything i know is server/client
15:25 < krzee> he should try lport
15:25 < reiffert> same for me.
15:25 < reiffert> mike?
15:25 < krzee> testing > asking, he should test lport
15:25 < reiffert> illsci: 
15:26 < illsci> sup
15:26 < reiffert> echo "lport 1094" >> /etc/openvpn/mdb1.conf
15:26 < reiffert> echo "lport 1095" >> /etc/openvpn/mdb2.conf
15:26 < reiffert> echo "lport 1096" >> /etc/openvpn/mdb3.conf
15:26 < reiffert> /etc/init.d/openvpn restart
15:27 < illsci> that works!
15:27 < krzee> =]
15:27 < illsci> so do I have to have the other side listen on a different port now
15:27 < krzee> no
15:27 < illsci> oh good
15:28 < reiffert> it's insane that it's working with lport
15:28 -!- taypen [~Stas@DSL212-143-220-82.bb.netvision.net.il] has quit [Quit: Leaving]
15:28 < krzee> port is default 1194
15:28 < krzee> lport default i believe is port
15:28 < krzee> so it could make sense
15:28 < reiffert> where as on the other hand you dont need to specify anything when running client/server mode
15:28 < krzee> i could be wrong... but it did work
15:29 < reiffert> his error message was:\
15:29 < reiffert> address allready in use. not port allready in use.
15:30 < illsci> well the tunnels are coming up though
15:30 < illsci> hmm
15:30 < illsci> it did work when I had just one
15:30 < illsci> are you sure I dont have to change ports or something somewhere
15:30 < illsci> on the remote side
15:31 < reiffert> illsci: does it work now?
15:31 < illsci> ps -ef
15:31 <@vpnHelper> RSS Update - forum: Authentication without a Server OS or Certificate <http://forums.openvpn.net/topic8951.html>
15:31 < illsci> no
15:31 < reiffert> you said it does.
15:31 < illsci> it starts but the tunnels dont allow me to ping across them
15:31 < illsci> and it did previously when I was just using one config with out the lport
15:32 < reiffert> do the tunnels come up or?
15:32 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
15:32 < illsci> im not sure
15:32 < illsci> how do I tell if they're up other than pinging the remote side
15:33 < reiffert> ifconfig tun0; ifconfig tun1; ifconfig tun2
15:34 < illsci> UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
15:34 < illsci> does that mean its up
15:34 < reiffert> 22:34 < illsci> UP 
15:34 < reiffert> what about tun1 and tun2?
15:34 < illsci> all of them say they're up
15:35 -!- _snd [~alexh@login.boxed.no] has joined #openvpn
15:35 < reiffert> congrats, problem solved.
15:36 < _snd> quick question: is there any way to configure openvpn as a service on windows and tell it to not activate if the ip on any interface is within a range?
15:36 < reiffert> _snd: yes.
15:36 < reiffert> (quick answer)
15:36 < illsci> yeah but they dont pass any traffic
15:36 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:37 < _snd> reiffert: after having used it for a good few years and been goggling around and not seeing anything obvious, care to share a quick pointer? :)
15:37 < reiffert> !man
15:37 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
15:38 < _snd> reiffert: as i said, i have read the man page, and looked for how to solve the problem, and nothing obvious sticks out on how to solve this
15:38 < reiffert> _snd: --up script. implent whatever you want.
15:42 < _snd> reiffert: i did look at that, but my understanding is tht if you're far enoguh that --up is being called then you already have connected to the server and are in the proceess of getting an ip allocated; what i was looking for was somehow to preempt trying to establish the runnel if any current IP is in a given rane, i.e. "dont start a tunnel if i'm in the office" 
15:42 < _snd> (spologies for shodding typing, new keyboard)
15:43 < reiffert> ah, install client as service.
15:44 -!- dollabill [~mike@199.44.8.98] has quit []
15:44 < reiffert>        --ipchange cmd
15:47 < _snd> reiffert: i also looked at ipchange, but that still assumes we're far enough along that there has been a connection made?
15:49 < _snd> reiffert: if course, now that i think about it, the simpler choice will just to make the server dns name unresolvable internally... kiss, and all that... i think i just answered myself :)
15:49 < reiffert> :)
15:49 < krzee> !script
15:49 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
15:50 < _snd> thanks for your 5 minutes, ill go back and hide in #opennms :p
15:50 -!- _snd [~alexh@login.boxed.no] has left #openvpn []
15:51 < reiffert> --up should work.
15:59 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
16:13 < illsci> this is weird.... i had a tunnel working at one point
16:13 < illsci> and then i made all these changes to get it to run 3 
16:13 < illsci> and now I go back to 1 and it's not working...  I can see the packets come over udp to the real ip address and ifconfig shows the tunnel is up
16:14 < illsci> but when I tcpdump on the tun interface on the server I never see any of the packets
16:14 < illsci> and ping isn't showing any replys
16:14 < illsci> there are no firewalls 
16:17 < illsci> and I can see the packets come across udp 
16:17 < illsci> TCP/UDP read bytes,204546
16:17 < illsci> that increments in the status but everything else is zero
16:19 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Remote host closed the connection]
16:21 < illsci> ah hah! it was the compression
16:21 < illsci> it wasnt enabled on both sides
16:21 < illsci> damnit!
16:29 <@vpnHelper> RSS Update - forum: Looking for some advice on chaining VPN's. Thanks <http://forums.openvpn.net/topic8952.html>
16:34 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:40 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
16:40 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
16:40 -!- Denial [Denial@drgi.co.uk] has quit []
16:43 -!- shtrb [~user@unaffiliated/shtrb] has quit [Read error: Connection reset by peer]
16:49 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 244 seconds]
16:53 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:55 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
17:03 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Read error: Connection reset by peer]
17:03 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
17:03 -!- rawsted [~tom@unaffiliated/rawsted] has left #openvpn []
17:36 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
17:44 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
17:45 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
17:49 < illsci> Can a server only support a single client?
17:49 < illsci> with the same cert?
17:55 < krzee> !dupe
17:55 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
17:55 < krzee> !authpass
17:55 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
17:55 -!- donspaulding [~donspauld@c-67-173-34-83.hsd1.il.comcast.net] has quit [Quit: Leaving.]
17:56 < krzee> if you use the same cert, i recommend using passes too
18:05 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Read error: Connection reset by peer]
18:21 -!- mirco [~mirco@p5B283A33.dip.t-dialin.net] has quit [Quit: mirco]
18:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
18:37 -!- novaflash [~notme@openvpn/user/novaflash] has quit [Ping timeout: 245 seconds]
18:42 -!- novaflash [~notme@openvpn/user/novaflash] has joined #openvpn
18:42 -!- mode/#openvpn [+v novaflash] by ChanServ
18:48 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
19:08 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
19:12 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903.html#p16304>
19:14 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
19:21 -!- _julian_ [~quassel@hmbg-5f764eac.pool.mediaWays.net] has joined #openvpn
19:22 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
19:24 -!- cheche [cheche@46.25.80.67] has quit [Ping timeout: 248 seconds]
19:24 -!- helllen [~helllen@77.231.152.50] has quit [Ping timeout: 248 seconds]
19:24 -!- _julian [~quassel@hmbg-4d06b41d.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
19:27 -!- helllen [~helllen@77.231.152.50] has joined #openvpn
19:27 -!- cheche [cheche@46.25.80.67] has joined #openvpn
19:29 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
19:46 -!- treund [~treund@97.75.177.42] has joined #openvpn
20:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Client Quit]
20:04 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
20:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:10 -!- axelm7 [~Admin@190.244.2.234] has quit [Ping timeout: 256 seconds]
20:10 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
20:11 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:18 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
20:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:30 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
20:31 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
20:41 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
20:43 -!- treund [~treund@97.75.177.42] has quit [Quit: leaving]
20:45 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
20:50 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
21:06 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:06 -!- mode/#openvpn [+v Axeman] by ChanServ
21:14 -!- axelm7 [~Admin@201.255.44.148] has joined #openvpn
21:33 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:34 -!- axelm7 [~Admin@201.255.44.148] has quit [Ping timeout: 259 seconds]
21:38 -!- axelm7 [~Admin@201.255.44.148] has joined #openvpn
21:40 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
21:40 -!- raidz_afk [~raidz@shiv.bluntshank.com] has joined #openvpn
21:40 -!- raidz_afk is now known as raidz
21:41 -!- raidz [~raidz@shiv.bluntshank.com] has quit [Changing host]
21:41 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
21:42 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:42 -!- mode/#openvpn [+v Axeman] by ChanServ
21:44 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:44 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:48 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:54 -!- aporio [~aporio@p4FC312DC.dip.t-dialin.net] has joined #openvpn
21:54 -!- aporio [~aporio@p4FC312DC.dip.t-dialin.net] has left #openvpn []
21:55 -!- abcd123 [772878c2@gateway/web/freenode/ip.119.40.120.194] has joined #openvpn
21:55 < abcd123> hi, i want to install openvpn, can somebody help me?
21:56 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
21:56 -!- raidz_afk [~raidz@shiv.bluntshank.com] has joined #openvpn
21:57 -!- raidz_afk is now known as raidz
21:57 -!- raidz [~raidz@shiv.bluntshank.com] has quit [Changing host]
21:57 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
21:57 < abcd123> hello somebody here?
21:58 < abcd123> pls
22:00 < abcd123> need help with openvpn
22:00 < Cr4zi3> I don't think anyone has ESPN here.. so they won't be able to read ur mind..
22:04 < Cr4zi3> abcd123; Do I know you ? my client doesn't allow me to get msgs w/o me allowing them.. I don't allow them unless I know them, or they ask me first..
22:05 < abcd123> no, i don't know you, just asking for help since you are the only one writing sth here
22:06 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
22:06 -!- raidz_afk [~raidz@shiv.bluntshank.com] has joined #openvpn
22:06 -!- raidz_afk is now known as raidz
22:06 -!- raidz [~raidz@shiv.bluntshank.com] has quit [Changing host]
22:06 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
22:07 < abcd123> hello? sb able to help me with openvpn?
22:08 < Cr4zi3> asking for help w/o stating what you need help w/ is pointless
22:08 < Cr4zi3> hence my ESPN comment..
22:10 < abcd123> just ignore it than
22:11 < Cr4zi3> that's what everyone is doing..
22:11 < Cr4zi3> hence why I'm tryin to tell u to explain.. but w/e..
22:12 -!- axelm7 [~Admin@201.255.44.148] has quit [Ping timeout: 258 seconds]
22:13 < abcd123> should i thank you now?
22:15 -!- abcd123 [772878c2@gateway/web/freenode/ip.119.40.120.194] has left #openvpn []
22:16 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has quit [Quit: Leaving.]
22:16 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
22:23 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
22:23 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
22:24 -!- Titania [~titania@221.120.122.106] has joined #openvpn
22:40 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
22:42 -!- karname [~roohollah@vpnss1.rapidpars.com] has joined #openvpn
22:43 -!- Ionic [ionic@ionic.de] has joined #openvpn
22:53 -!- EugeneKay is now known as EugeneSleep
23:02 -!- Titania [~titania@221.120.122.106] has quit [Quit: Will return someday...]
23:03 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
23:03 -!- Olipro_ is now known as Olipro
23:17 -!- mape2k [~mape2k@g224232159.adsl.alicedsl.de] has joined #openvpn
23:30 -!- freaky[t] [alpha@freakyonline.de] has quit [Read error: Operation timed out]
23:30 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Read error: Operation timed out]
23:33 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
23:34 <@vpnHelper> RSS Update - forum: Openvpn pam authetication - two process created <http://forums.openvpn.net/topic8930.html#p16305>
23:40 -!- mape2k [~mape2k@g224232159.adsl.alicedsl.de] has quit [Ping timeout: 248 seconds]
23:54 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 258 seconds]
--- Day changed Fri Oct 07 2011
00:08 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
00:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
00:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
00:15 <@vpnHelper> RSS Update - forum: Looking for some advice on chaining VPN's. Thanks <http://forums.openvpn.net/topic8952.html#p16307> || Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16306>
00:15 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
00:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:20 <@vpnHelper> RSS Update - forum: Every thing configured, client connected, but no trafic <http://forums.openvpn.net/topic8903-15.html#p16308>
00:23 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 255 seconds]
00:33 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
00:34 -!- helllen [~helllen@77.231.152.50] has left #openvpn ["Saliendo"]
00:38 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
00:41 -!- donspaulding [~donspauld@184.237.154.114] has joined #openvpn
00:45 -!- mirco [~mirco@p5B283D89.dip.t-dialin.net] has joined #openvpn
00:46 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:03 -!- mape2k [~mape2k@p5B24C883.dip.t-dialin.net] has joined #openvpn
01:07 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
01:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
01:14 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:24 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 258 seconds]
01:30 -!- mirco [~mirco@p5B283D89.dip.t-dialin.net] has quit [Quit: mirco]
01:30 -!- Titania [~titania@221.120.122.106] has joined #openvpn
01:32 -!- donspaulding [~donspauld@184.237.154.114] has quit [Quit: Leaving.]
01:36 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
01:40 -!- dazo_afk is now known as dazo
01:41 -!- Titania [~titania@221.120.122.106] has left #openvpn ["Goodbye :("]
01:43 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:44 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 245 seconds]
01:49 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
01:49 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
01:49 -!- mode/#openvpn [+o raidz] by ChanServ
01:51 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
01:56 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 255 seconds]
02:04 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
02:08 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 244 seconds]
02:08 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
02:14 < Mowee> Morning
02:15 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:24 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:27 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has joined #openvpn
02:38 -!- jensen_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:39 -!- jensen_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
02:39 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
02:46 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:53 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
02:56 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
02:57 -!- zoidberg1 [zoidberg@gateway/shell/xzibition.com/x-xprrgxsbnoscsytf] has joined #openvpn
02:57 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-euqalezwqtvnssvi] has quit [Ping timeout: 258 seconds]
02:58 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 258 seconds]
03:12 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:20 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889-15.html#p16309>
03:32 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html>
03:44 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16311>
03:53 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:04 -!- axelm7 [~Admin@201.255.44.148] has joined #openvpn
04:05 -!- luneff [~yury@109.165.63.186] has joined #openvpn
04:05 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
04:10 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
04:10 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:10 -!- mode/#openvpn [+o mattock] by ChanServ
04:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:28 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889-15.html#p16313> || Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16312>
04:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
04:46 -!- karname [~roohollah@vpnss1.rapidpars.com] has quit [Ping timeout: 248 seconds]
04:46 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16314>
04:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
05:07 -!- karname [~roohollah@2.180.45.189] has joined #openvpn
05:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
05:11 <@vpnHelper> RSS Update - forum: Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16315>
05:17 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889-15.html#p16316>
05:23 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889-15.html#p16318> || Internet connection lost after few seconds <http://forums.openvpn.net/topic8943.html#p16317>
05:29 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has joined #openvpn
05:32 -!- albech [~albech@61.7.177.74] has joined #openvpn
05:35 -!- cpm [~Chip@70.101.252.228] has joined #openvpn
05:35 -!- cpm [~Chip@70.101.252.228] has quit [Changing host]
05:35 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:47 -!- karname [~roohollah@2.180.45.189] has quit [Ping timeout: 255 seconds]
06:00 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
06:01 < lu_> hey. I'm trying to get a dev tap environment to work because i need to assign very specific ip addresses. my configs looks like this: http://nopaste.info/0e33780a45.html  I got everything to work with tun before (to exclude a firewall problem). i can connect, but the clients can't ping the server (and vice versa) and clients can't ping each other (Destination host unreachable).
06:01 < lu_> also, in the connection log i get "Options error: option 'server' cannot be used in this context", but i'm not sure how else to config it, i can't find a proper howto :(
06:08 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:11 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:11 -!- mode/#openvpn [+v Axeman] by ChanServ
06:13 -!- axelm7 [~Admin@201.255.44.148] has quit [Ping timeout: 258 seconds]
06:22 < krzee> why do you need "very specific ip addresses" that are inside that exact subnet?  if its not a layer2 protocol you dont need to bridge
06:24 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
06:25 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
06:25 < lu_> krzee: i'm not trying to brige, i'm just trying to use the tap adapter instead of the tun adapter so i can assign arbitrary ip addresses
06:26 < krzee> on the same subnet as the server's lan?
06:27 < lu_> no... the server's lan is 192.168.1.0 ...
06:27 < lu_> i actually don't need the server's lan, if i configured something like this it's because i misunderstood something
06:27 < krzee> you know with tun you could ifconfig-push whatever address you want, right?
06:27 < krzee> !static
06:27 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
06:28 < krzee> you only need tap when you need a layer2 protocol over the vpn
06:28 < krzee> !tunortap
06:28 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
06:28 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
06:28 < lu_> not on windows as i read
06:28 < krzee> !policy
06:28 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
06:29 < krzee> see, they even do it in the howto :-p
06:33 < lu_> krzee: http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html ("OpenVPN allocates one /30 subnet per client in order to provide compatibility with Windows clients due to the limitation of the TAP-Win32 driver's TUN emulation mode.")
06:33 <@vpnHelper> Title: "ifconfig-pool" option use a /30 subnet (4 private IP addresses per client) when used in TUN mode? (at openvpn.net)
06:35 < lu_> this is not good, because i need ip's 10.8.0.11 and 10.8.0.12
06:35 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has joined #openvpn
06:39 < lu_> krzee: you say that there is a sample with dev tap without bridging? (because i can't find one)
06:47 < krzee> !topology
06:47 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions. or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
06:47 < krzee> like i said, you dont need tap
06:47 < dxtr> I have tap for some reason :D
06:47 < krzee> dxtr, congratulations
06:48 < dxtr> krzee: I have no idea why I picked tap. Doesn't that need special configuration to actually be useful?
06:48 < dxtr> useful == get the benefits from tap
06:48 < krzee> !tunortap
06:48 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
06:48 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
06:48 < krzee> if you arent passing layer2 traffic over the vpn, you dont need tap
06:48 < krzee> how is that so hard for people to catch on to?
06:49 < dxtr> hehe
06:50 < dxtr> Hmm... How could I test layer2 functionality over the VP?
06:51 < krzee> by using a layer2 protocol!
06:51 < krzee> lol
06:51 < krzee> ping then check arp table
06:51 < krzee> but who cares
06:54 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16319>
06:55 -!- axelm7 [~Admin@201.255.44.148] has joined #openvpn
06:55 < lu_> krzee: thanks i got it to work. without the attitude you would be my hero :)
06:56 < lu_> they should add that to the main howto that with topology subnet stuff gets easy, also on windows
06:56 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
06:59 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:12 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16321> || Hardware OpenVPN client <http://forums.openvpn.net/topic8954.html>
07:21 -!- illsci [~jsabo@96.255.235.187] has quit [Ping timeout: 252 seconds]
07:24 <@vpnHelper> RSS Update - forum: Hardware OpenVPN client <http://forums.openvpn.net/topic8954.html#p16322>
07:27 -!- cocoa117 [~cocoa117@wk-28-224.guest.rdg.ac.uk] has joined #openvpn
07:28 -!- donspaulding [~donspauld@c-67-173-34-83.hsd1.il.comcast.net] has joined #openvpn
07:28 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
07:29 < farciarz84> hi, I have tomato router and would like to establish vpn connection from it, that it's accessible from all machines in the sub-net. Current status: I establish connection from router but it's accessible just from it.
07:33 -!- EugeneSleep is now known as EugeneKay
07:36 <@vpnHelper> RSS Update - forum: two operating system pc . wrong route.exe usage <http://forums.openvpn.net/topic8956.html> || Unable to create temporary file + client-connect script <http://forums.openvpn.net/topic8955.html>
07:39 < ecrist> lu_: what's wrong with krzee's attitude?
07:42 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
07:52 < farciarz84> I have such sitation: [my_machine_1] --> [router VPN client] --> [VPN server]. How can I use VPN server resources from my_machine_x ? 
07:53 < farciarz84> [my_machine_1 VPN client] --> [VPN server] works
07:57 < Bushmills> should make no difference. once your client is connected, traffic between vpn client and vpn server is merely a stream of noise for the router
07:58 < Bushmills> ecrist: maybe krzee didn't offer him to hold his hand?
07:58 < ecrist> or cuddle
07:59 < Bushmills> no wonder people are pissed
07:59 < Bushmills> !blame
07:59 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
07:59 < ecrist> heh
07:59 -!- mode/#openvpn [+o EugeneKay] by ChanServ
07:59 -!- Bushmills was kicked from #openvpn by EugeneKay [I'm TRYING to sleep in. Shush.]
08:01 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
08:01 < EugeneKay> Hrm. That script needs work.
08:04 < EugeneKay> farciarz84 - the VPN server needs to be aware of the subnet behind the VPN client(aka your router)
08:06 < EugeneKay> farciarz84 - adding "route <subnet> <netmask>" to the server.conf ought to do the trick 
08:06 -!- mode/#openvpn [+o ecrist] by ChanServ
08:06 -!- mode/#openvpn [-o ecrist] by ecrist
08:07 < EugeneKay> If you want other VPN clients to be able to access that subnet, you'll need to add 'push "route <subnet> <netmask>"' and then an iroute inside of a CCD entry for the client in charge of the subnet.
08:07 < EugeneKay> See also http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
08:07 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
08:07 < farciarz84> EugeneKay: I did it already to openvpn.conf. Maybe something is wrong, please correct me. Command inside openvpn.conf --- push "route 192.168.40.1 255.255.255.0" ---
08:08 < farciarz84> 192.168.40.1 is router ip
08:08 < EugeneKay> Pushing the route from the server side won't do you anything at all - the client already has that route for its local network adapter
08:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:09 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
08:09 < EugeneKay> The purpose of the route(WITHOUT the push) in the server.conf is so the server knows that OpenVPN is responsible for that route. Otherwise it ends up going to the default GW, which is not what you ant
08:11 < farciarz84> EugeneKay: I must admit topic is hard for me. So as I understood, I can't broadcast vpn connection unless I have no access to server.conf? 
08:12 < EugeneKay> Also note that the iroute(inside the ccd) is used to keep the client which is responsible for a given route from getting a conflicting route pushed to it. It means "I already Route for this, don't give it to me"
08:12 < EugeneKay> Not in a pure-routed setup, no.
08:12 < EugeneKay> You can enable SNAT aka MASQUERADEing 
08:14 < EugeneKay> All traffic to the VPN server will show up as being "from" the Client's vpn IP, rather than an IP from the LAN subnet behind it
08:15 < farciarz84> EugeneKay: ok I don't get anything what you wrote. (Don't know what iroute is and ccd). I guess I can forward client reqest on router firewall using iptables. But my knowledge is not enough to construct it. Doesn't matter if traffic to the VPN server will be show up from client ip. 
08:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
08:16 < EugeneKay> farciarz84 - something like iptables -t nat -A POSTROUTING -s 192.168.40.1 -o tun+ -j MASQUERADE
08:16 -!- louiscyfer_ [~louisponc@static-195-81-140-90.irtnet.net] has joined #openvpn
08:16 < farciarz84> What I need is to have 4 ip address that go over vpn, other traffics musn't be seen by vpn server/
08:17 < EugeneKay> That's a job for your firewall.
08:18 < farciarz84> by tun+ you mean tun0?
08:18 < EugeneKay> tun+ means "any tun device". If it's always gonna be tun0, you can use tun0.
08:19 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
08:19 -!- louiscyfer_ is now known as louiscyfer
08:20 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
08:29 < farciarz84> EugeneKay: I run  iptables -t nat -A POSTROUTING -s 192.168.40.1 -o tun+ -j MASQUERADE from terminal. Nothing is changed. iptables --list looks like it was before
08:32 -!- cocoa117 [~cocoa117@wk-28-224.guest.rdg.ac.uk] has quit [Quit: Leaving]
08:32 -!- louiscyfer_ [~louisponc@188.62.77.93] has joined #openvpn
08:34 -!- louiscyfer [~louisponc@static-195-81-140-90.irtnet.net] has quit [Ping timeout: 248 seconds]
08:34 -!- louiscyfer_ is now known as louiscyfer
08:41 < EugeneKay> IIRC, -L(and --list) show the filter table by default. Try -t nat -L
08:43 < ecrist> !linnat
08:43 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
08:43 < farciarz84> EugeneKay: http://paste.pocoo.org/show/uTHnE4iB9ZLdylIqjQrD/
08:47 < farciarz84> ecrist: I run iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -o br0 -j MASQUERADE, service firewall restart. No results
08:49 < ecrist> *shrug*  this isn't a firewall support channel.  that's the best I have to offer
08:49 < farciarz84> /sbin/ifconfig tun0 10.11.14.45 pointopoint 10.11.14.46 mtu 1500
08:52 -!- karname [~roohollah@2.180.45.189] has joined #openvpn
09:01 -!- karname [~roohollah@2.180.45.189] has quit [Ping timeout: 248 seconds]
09:05 -!- master_of_master [~master_of@87.181.75.61] has quit [Ping timeout: 252 seconds]
09:07 -!- master_of_master [~master_of@p57B545A9.dip.t-dialin.net] has joined #openvpn
09:08 -!- TheRedOctober [~administr@63.138.254.154] has quit [Quit: Lost terminal]
09:12 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
09:14 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
09:16 -!- karname [~roohollah@vpnss1.rapidpars.com] has joined #openvpn
09:17 -!- ravel_out [~ravel_out@175.136.80.222] has joined #openvpn
09:17 -!- dking [~DKing@184.82.215.77] has left #openvpn []
09:21 -!- axelm7 [~Admin@201.255.44.148] has quit [Ping timeout: 244 seconds]
09:22 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has joined #openvpn
09:22 <@vpnHelper> RSS Update - forum: How to Hire for VPN Install on a VPS <http://forums.openvpn.net/topic8957.html>
09:37 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has quit [Remote host closed the connection]
09:42 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
09:44 -!- nickzxcv [~nick@schmalenberger.us] has quit [Read error: Operation timed out]
09:47 -!- ronnocol [~lance@2001:1868:214::bad:babe] has quit [Ping timeout: 244 seconds]
09:48 -!- nickzxcv [foobar@216.218.223.115] has joined #openvpn
09:48 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
09:50 < Optic> moo
09:51 < EugeneKay> farciarz84 - running ervice firewall restart will blow away any temporary iptables changes you make.....
10:00 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:06 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 244 seconds]
10:06 -!- lazzer [~lazzer@vmlinux.org] has quit [Ping timeout: 276 seconds]
10:07 < donspaulding> Continuing a setup from yesterday, can I put OpenVPN on a server out in one of my datacenters to which all of the other networks I control can connect to for private IP traffic only?  I want all the satellite networks (or spokes in the hub/spokes analogy) to use their local gateway for traffic to/from the internet, and I don't want local-only traffic to slow down because it has to be broadcast to every machine on the vpn, but I 
10:07 < ecrist> yes
10:08 < donspaulding> is this called ethernet bridging?  Or am I conflating two concepts?
10:08 < ecrist> if you use tap, and pass layer 2, then it's ethernet bridging
10:08 < ecrist> otherwise, it's routing
10:09 < donspaulding> more precisely, which of those two does my goal require?
10:09 < ecrist> the latter
10:09 < donspaulding> routing? really?
10:09 < ecrist> unless you need to pass layer 2 (usually not)
10:10 < donspaulding> so I can use routing and have all spokes on the same subnet?
10:10 < ecrist> sure
10:10 < ecrist> !topology
10:10 <@vpnHelper> "topology" is (#1) is it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html This will end up being default in later versions. or (#2) this results in clients getting addresses .2 .3 .4 .5 etc
10:10 < donspaulding> heh, "is it is"
10:10 < ecrist> not sure why they need to be on the same subnet, though.
10:10 < ecrist> !forget topology
10:10 <@vpnHelper> Error: 2 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
10:10 < ecrist> !forget topology *
10:11 <@vpnHelper> Joo got it.
10:11 < ecrist> !learn topology as it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions.
10:11 <@vpnHelper> Joo got it.
10:12 < donspaulding> 2005?  I love this project.
10:13 < ecrist> !learn topology as Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets.
10:13 <@vpnHelper> Joo got it.
10:13 < ecrist> !learn topology as See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
10:13 <@vpnHelper> Joo got it.
10:13 < ecrist> donspaulding: problems?
10:14 < donspaulding> ecrist: just that I don't have a time machine.  Other than that, no, no problems.
10:15 < ecrist> you don't have a time machine?
10:15 < ecrist> I'm confused
10:16 < donspaulding> ecrist: the solution you're pointing me towards was introduced in 2005.  That means its been around literally the entire time I've needed it, without me knowing.  It's simply enjoyable to use mature OSS.
10:17 < ecrist> ah, well, we tend to hide such information in the documentation. :)
10:17 < ecrist> but, shh, don't tell anyone where to find it.
10:17 < donspaulding> so, am I right in thinking that in this topology, the VPN server doles out IPs?  No static IPs, and no ability to use an existing DHCP server from one of the spokes?
10:17 -!- dazo is now known as dazo_afk
10:18 < ecrist> well, DHCP would require layer 2 connectivity
10:18 < ecrist> why do you want the DC DHCP server to hand out IPs?
10:18 < ecrist> just use routed, it's really all you likely need.
10:19 < donspaulding> I think you're probably right.  I was just trying to shoehorn OpenVPN into the existing network setup, so I have less to explain to my PHB ;-)
10:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
10:19 < donspaulding> I wanted to reuse the DHCP server we use here at our office and have it hand out private IPs for our DC servers to use.
10:20 < ecrist> were it my network, I'd use a separate vpn subnet, and just make sure traffic between 'spokes' gets routed across the vpn
10:20 < ecrist> no need for layer 2, just have to put routes in the right place
10:21 < donspaulding> I don't have control over all the DC gateways, But I assume I could configure these routes per-machine, yes?
10:21 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
10:21 < ecrist> sure
10:21 < donspaulding> (as much as a pain as that would be)
10:22 < ecrist> well, you can push the route with openvpn, and it will be in place when the vpn is up
10:23 < donspaulding> ok, and static IPs?  I assume I can have them on each server and point them at the one-server-per-DC-that-acts-as-a-VPN-client?
10:23 < ecrist> !ccd
10:23 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
10:23 < ecrist> !static
10:23 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
10:24 -!- lazzer [~lazzer@vmlinux.org] has joined #openvpn
10:24 < donspaulding> hmm, that seems to point to each server acting as its own vpn client.  I'd rather if 10.8.2.3 could talk directly to 10.8.2.4 if they were in the same DC.
10:24 < ecrist> openvpn doesn't do that
10:25 < donspaulding> :-/
10:25 < ecrist> openvpn works more in a hub/spoke
10:25 < donspaulding> yeah, I just wanted each spoke to also be a hub.
10:25 < ecrist> even if you did bridge-mode vpn, all the traffic will pass through the vpn.
10:25 < ecrist> *vpn server
10:25 < donspaulding> OK.  Still brainstorming then.
10:26 < donspaulding> How does openvpn know which client is connecting (to pick a specific config file from the CCD)?
10:27 < ecrist> by the certificate common name
10:27 < donspaulding> is it based on the name value in the client's cert?
10:27 < ecrist> that's stated in the output from vpnHelper, above.
10:27 < ecrist> "but only for the specified client based on common-name."
10:27 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:27 -!- out_ravel [ravel_out@175.136.80.222] has joined #openvpn
10:28 < donspaulding> ecrist: sorry bout that.
10:28 -!- lu_ [lu_@static.211.19.9.176.clients.your-server.de] has left #openvpn []
10:28 < ecrist> perhaps you'd benefit from the man page?
10:28 -!- out_ravel [ravel_out@175.136.80.222] has quit [Client Quit]
10:29 < donspaulding> the man page doesn't understand what I'm after like humans do ;-)  But yes, I'll quit with the rapid-fire easy-answer questions now.
10:29 < ecrist> !factoids
10:29 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:29 < ecrist> as you go through the man page, check out the factoids page above.  good info in there.
10:30 < donspaulding> thanks.
10:31 -!- dazo_afk is now known as dazo
10:33 < EugeneKay> What's for lunch?
10:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
10:36 <@vpnHelper> RSS Update - forum: Server not waroking anymore <http://forums.openvpn.net/topic8958.html>
10:37 < donspaulding> Free 1/4 lber w/chees from McD's
10:37 < donspaulding> or, you know, cheese
10:39 < EugeneKay> Nearest McNasty's is a 20 minute drive.... and I dont' feel like making cheezburgers
10:42 -!- karname [~roohollah@vpnss1.rapidpars.com] has quit [Ping timeout: 248 seconds]
10:42 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:50 -!- ravel_out [~ravel_out@175.136.80.222] has quit []
10:56 -!- mort_gib [~mjensen@16.Red-83-36-63.staticIP.rima-tde.net] has quit [Quit: Ex-Chat]
10:56 -!- MarKsaitis [~MarKsaiti@94-194-204-114.zone8.bethere.co.uk] has quit [Ping timeout: 258 seconds]
11:03 -!- karname [~roohollah@2.180.45.189] has joined #openvpn
11:07 -!- corretico [~luis@201.201.44.82] has joined #openvpn
11:08 -!- Ballwinkle [~Ball@173.245.87.91] has joined #openvpn
11:08 < Ballwinkle> hey
11:09 < Ballwinkle> can i get some hlep?
11:09 < Ballwinkle> help*
11:12 < ecrist> yes
11:12 < ecrist> you're welcome
11:13 < Ballwinkle> Okay i downloaded the openvpn thing. can i get programs to connect through it? or will only firefox work
11:15 -!- mape2k [~mape2k@p5B24C883.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
11:17 < ecrist> Ballwinkle: openvpn is used to build a secure network connection between multiple hosts
11:18 < Ballwinkle> Is there anyway to just use it to make a program connect through another ip?
11:20 < ecrist> how about you tell me exactly what you're trying to do
11:21 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
11:22 -!- axelm7 [~Admin@201.255.44.148] has joined #openvpn
11:23 < Ballwinkle> Well im trying to get a program to connect to a server, but the server only accepts ips on a 217.x.x.x range
11:23 < ecrist> well, you'd need to have access to a machine on the 217/8 subnet
11:24 -!- pranq [~pranq@unaffiliated/contempt] has quit [K-Lined]
11:24 < ecrist> or you need to get involved with some IP spoofing, which, I'm taking a guess, is beyond your capabilities.
11:24 < axelm7> today I was working on getting my cisco set up so I can test the OpenVPNAS vm. Suddenly the router which is physically located in GoDaddy premises stopped responding. They say they will take up to 24 hours to fix the problem. Can you believe the SOBs? 24 hours?
11:24 < ecrist> axelm7: sounds like you're not very good at negotiating SLAs. ;)
11:25 < axelm7> I am paying 950 dollars per month for 2 dedicated servers there and they take 1 whole day for a trivial fix
11:25 < axelm7> negotiating? you gotta be kidding? accepting is a better description
11:25 < axelm7> I get 4 hour hardware failure SLA
11:26 < axelm7> apparently the firewall locking up is not a hardware issue
11:26 < axelm7> gotta move my hosting somewhere else
11:27 < axelm7> I would host in in our offices but I don't have a diesel generator
11:27 < axelm7> or fire sprinklers, or biometric, etc
11:28 -!- karname [~roohollah@2.180.45.189] has quit [Ping timeout: 252 seconds]
11:29 -!- dazo is now known as dazo_afk
11:30 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:30 < ecrist> axelm7: we pay less than that for two full racks at a real datacenter
11:31 < axelm7> its expensive due to ms freaking licensing
11:31 < axelm7> mssql standard 2008 R2 = 250 dollars per month
11:31 < ecrist> why do you mssql?
11:31 < donspaulding> axelm7: no idea what we pay, but we're very happy with our services both at SoftLayer (servers in Dallas & Seattle) and at Peak10 (servers in Atlanta)
11:31 < ecrist> no
11:31 < axelm7> I have to support an mssql application that uses OLAP
11:31 < ecrist> wrong window
11:32 < donspaulding> yes
11:32 < donspaulding> wrong joke
11:34 < donspaulding> ecrist: working through the sample config file, it looks like I would be able to expose the networks at my datacenters behind a single vpn client connection by using the "route a.b.c.d" line (where a.b.c.d is the subnet I want to expose to the vpn).  Does that sound right?
11:34 < donspaulding> ecrist: and if so, does that mean that I basically just come up with a separate subnet per DC and let OpenVPN route between them?
11:35 < ecrist> yup
11:35 < donspaulding> Very cool, I think that'll do me.  Thanks.
11:36 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
11:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:42 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:45 < axelm7> anybody know of hosting that offers CARP?
11:45 -!- Ballwinkle [~Ball@173.245.87.91] has quit [Ping timeout: 255 seconds]
11:46 < ecrist> anyone that hosts freebsd
11:46 < ecrist> even amazon
11:46 < ecrist> rootbsd.net
11:46 -!- Ballwinkle [~Ball@cpc1-walt14-2-0-cust192.13-2.cable.virginmedia.com] has joined #openvpn
12:00 -!- luneff [~yury@109.165.63.186] has quit [Quit: This computer has gone to sleep]
12:06 < axelm7> GoDaddy resolved the incident in 27 minutes, but originally told me they would take up to 24 hs. Stupid way to lose a customer
12:07 < ecrist> under commit and over perform
12:09 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
12:11 < axelm7> exactly
12:11 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:12 < axelm7> softlayer is offering unlimited ssl vpn connections for dedicated servers. Looks like it does not make sense to get an openvpn-as subscription
12:14 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
12:14 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:15 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
12:16 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:18 -!- merlin1991 [~merlin@Maemo/community/cssu/merlin1991] has joined #openvpn
12:19 < merlin1991> I'm wondering wheter to buy the galaxy s 2, does openvpn work on it without rooting the device?
12:19 <+novaflash> merlin1991; pretty sure that still requires rooting, sorry
12:19 < merlin1991> :/
12:19 < merlin1991> hm I wonder if it will work on the n9
12:20 < merlin1991> works just fine on the n900, but that didn't have the aegis crap on it
12:20 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
12:20 < merlin1991> I mean sudo gainroot in the console and openvpn is just one modprobe away :)
12:21 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
12:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
12:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:22 <+novaflash> does anyone here know how to add a hidden TAP adapter in windows xp? i have openvpn gui (community edition) running straight from openvpn.net but can't find the option to install it in a hidden mode. i keep seeing the red cross in my system tray now.
12:23 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Ping timeout: 248 seconds]
12:24 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
12:24 -!- Ballwinkle [~Ball@cpc1-walt14-2-0-cust192.13-2.cable.virginmedia.com] has quit []
12:25 -!- ronnocol [~lance@2001:1868:214::bad:babe] has quit [Ping timeout: 244 seconds]
12:27 < merlin1991> novaflash go the adapter settings, there's a check somewhere about showing the adapter if it's not connected
12:27 <+novaflash> yeah i know i unchecked that
12:27 <+novaflash> still shows
12:27 < merlin1991> wtf
12:27 <+novaflash> from what i can google i know there's a way to remove the 'link' between the network connection control panel and the tap adapter itself
12:27 <+novaflash> just can't find it
12:28 <+novaflash> maybe a reboot will help, let's give that a go
12:29 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:30 <+novaflash> nah still there. bloody icon.
12:31 -!- albech [~albech@61.7.177.74] has quit [Quit: Leaving]
12:34 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
12:36 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
12:36 <@vpnHelper> RSS Update - forum: How to Hire For OpenVPN install on VPS? <http://forums.openvpn.net/topic8959.html>
12:36 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:49 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
12:50 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
12:54 -!- louiscyfer [~louisponc@188.62.77.93] has quit [Quit: louiscyfer]
12:54 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has joined #openvpn
12:59 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
12:59 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:03 -!- corretico [~luis@201.201.44.82] has joined #openvpn
13:05 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
13:13 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:31 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:31 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:34 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 245 seconds]
13:38 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
13:40 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
13:42 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:46 -!- karname [~roohollah@vpnss1.rapidpars.com] has joined #openvpn
13:47 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:53 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
14:01 -!- mape2k [~mape2k@g224232159.adsl.alicedsl.de] has joined #openvpn
14:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:22 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
14:30 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:36 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
14:37 -!- karname [~roohollah@vpnss1.rapidpars.com] has quit [Ping timeout: 248 seconds]
14:41 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
14:45 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
14:45 -!- Guest66767 [ionic@ionic.de] has joined #openvpn
14:49 <@vpnHelper> RSS Update - forum: OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16328>
14:53 -!- merlin1991 [~merlin@Maemo/community/cssu/merlin1991] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
14:53 -!- axelm7 [~Admin@201.255.44.148] has quit [Ping timeout: 256 seconds]
14:55 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
15:02 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:07 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16329>
15:24 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
15:25 <@vpnHelper> RSS Update - forum: OpenVPN over proxy <http://forums.openvpn.net/topic8960.html>
15:29 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:31 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
15:43 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
15:45 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:50 <@vpnHelper> RSS Update - forum: Port Blocking <http://forums.openvpn.net/topic8961.html>
15:53 -!- axelm7 [~Admin@201.255.44.148] has joined #openvpn
15:54 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
15:54 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
15:55 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:56 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
15:57 -!- corretico [~luis@201.201.44.82] has joined #openvpn
16:01 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:05 -!- mape2k [~mape2k@g224232159.adsl.alicedsl.de] has quit [Ping timeout: 248 seconds]
16:19 -!- MikeJansen1 [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has joined #openvpn
16:19 -!- MikeJansen1 [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has quit [Client Quit]
16:19 <@vpnHelper> RSS Update - forum: Next OpenVPNAS release <http://forums.openvpn.net/topic8962.html>
16:19 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Quit: Leaving.]
16:21 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has joined #openvpn
16:24 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
16:25 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
16:26 -!- axelm7 [~Admin@201.255.44.148] has quit [Ping timeout: 258 seconds]
16:27 -!- axelm7 [~Admin@201.255.44.148] has joined #openvpn
16:31 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:39 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
16:42 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16333>
16:45 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:47 -!- luneff [~yury@84.51.192.74] has joined #openvpn
16:51 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
16:54 <@vpnHelper> RSS Update - forum: disconnecting a user <http://forums.openvpn.net/topic8963.html>
16:56 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
17:04 -!- p3rror [~mezgani@41.248.218.30] has joined #openvpn
17:10 -!- axelm7 [~Admin@201.255.44.148] has quit [Ping timeout: 244 seconds]
17:11 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
17:12 -!- catsup [~d@ps38852.dreamhost.com] has quit [Quit: Lost terminal]
17:13 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Ping timeout: 252 seconds]
17:13 -!- axelm7 [~Admin@201.255.44.148] has joined #openvpn
17:15 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
17:18 -!- p3rror [~mezgani@41.248.218.30] has quit [Ping timeout: 248 seconds]
17:20 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
17:24 -!- rawr [81156ca6@gateway/web/freenode/ip.129.21.108.166] has joined #openvpn
17:27 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:27 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
17:28 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
17:29 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:30 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
17:31 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
17:33 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
17:34 -!- MikeJansen1 [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has joined #openvpn
17:35 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has quit [Ping timeout: 255 seconds]
17:35 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Quit: Lost terminal]
17:39 -!- MikeJansen1 [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has quit [Client Quit]
17:57 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
17:58 -!- ravel_out [~ravel_out@175.136.80.222] has joined #openvpn
18:04 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
18:07 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:17 -!- rawr [81156ca6@gateway/web/freenode/ip.129.21.108.166] has quit [Quit: Page closed]
18:22 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
18:31 -!- axelm7 [~Admin@201.255.44.148] has quit [Ping timeout: 256 seconds]
18:41 -!- donspaulding [~donspauld@c-67-173-34-83.hsd1.il.comcast.net] has quit [Quit: Leaving.]
18:42 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p16335>
18:47 -!- axelm7 [~Admin@201.255.44.148] has joined #openvpn
18:58 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
19:18 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
19:20 -!- _julian [~quassel@hmbg-5f766736.pool.mediaWays.net] has joined #openvpn
19:22 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
19:23 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
19:23 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
19:23 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
19:23 -!- _julian_ [~quassel@hmbg-5f764eac.pool.mediaWays.net] has quit [Ping timeout: 259 seconds]
19:24 < axelm7> hi raidz, I have spent the afternoon looking for an alternative hosting service to install the openvpnas
19:24 < axelm7> any comment regarding hivelocity.net? they are in florida which is great for traffic coming from central and south america
19:29 -!- newl [~newl@97.75.165.156] has joined #openvpn
19:54 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:54 -!- donspaulding [~donspauld@174-155-236-199.pools.spcsdns.net] has joined #openvpn
19:54 -!- raidz is now known as raidz_afk
19:55 -!- raidz_afk is now known as raidz
19:58 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:03 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 252 seconds]
20:07 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
20:07 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
20:08 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
20:08 -!- Agin_ [~Agin@greenzone.copyleft.no] has quit [Read error: Operation timed out]
20:09 -!- igormorgado [~igormorga@mvx-200-142-107-126.mundivox.com] has quit [Ping timeout: 244 seconds]
20:10 -!- igormorgado [~igormorga@mvx-200-142-107-126.mundivox.com] has joined #openvpn
20:10 -!- raidz is now known as raidz_afk
20:11 -!- raidz_afk is now known as raidz
20:12 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 260 seconds]
20:12 -!- raidz is now known as raidz_afk
20:12 -!- donspaulding [~donspauld@174-155-236-199.pools.spcsdns.net] has quit [Quit: Leaving.]
20:12 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
20:12 -!- raidz_afk is now known as raidz
20:17 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 255 seconds]
20:22 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
20:23 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
20:27 -!- Denial [Denial@drgi.co.uk] has quit []
20:27 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
20:30 -!- raidz_afk [~raidz@shiv.bluntshank.com] has joined #openvpn
20:30 -!- raidz_afk is now known as raidz
20:31 -!- raidz [~raidz@shiv.bluntshank.com] has quit [Changing host]
20:31 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
20:33 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
20:38 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
20:47 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
20:55 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
20:55 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:55 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:57 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:02 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
21:07 -!- axelm7 [~Admin@201.255.44.148] has quit [Quit: Leaving]
21:13 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 276 seconds]
21:25 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:30 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
21:33 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
21:36 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
21:37 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:39 -!- ravel_out [~ravel_out@175.136.80.222] has quit [Ping timeout: 276 seconds]
21:55 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
21:55 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:56 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
21:58 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:01 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
22:01 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
22:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:02 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
22:02 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 252 seconds]
22:02 -!- JPeterso2 is now known as JPeterson
22:02 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:02 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:02 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
22:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
22:06 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
22:20 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
22:21 -!- donspaulding [~donspauld@174-154-231-43.pools.spcsdns.net] has joined #openvpn
22:22 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 258 seconds]
22:28 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
22:35 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
22:37 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
22:39 -!- Guest66767 [ionic@ionic.de] has quit [Excess Flood]
22:41 -!- Ionic [ionic@ionic.de] has joined #openvpn
22:41 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
22:57 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
23:00 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
23:08 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 260 seconds]
23:13 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
23:27 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
23:29 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:30 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
23:31 -!- corretico [~luis@201.201.44.82] has quit [Client Quit]
23:31 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:32 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
23:32 <@vpnHelper> RSS Update - forum: Maintaining Security <http://forums.openvpn.net/topic8965.html> || Cisco Access Control Server <http://forums.openvpn.net/topic8964.html>
23:32 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 245 seconds]
23:35 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:39 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
23:43 <@vpnHelper> RSS Update - forum: Use signed certificate <http://forums.openvpn.net/topic8914.html#p16122>
23:49 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
23:51 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
23:55 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
23:58 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
23:58 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
--- Day changed Sat Oct 08 2011
00:02 -!- crocket [~crocket@unaffiliated/crocket] has joined #openvpn
00:02 < crocket> How should I deal with rotating logs?
00:02 < crocket> Shold I send SIGHUP signal whenever a log is rotated?
00:03 < crocket> I don't like SIGHUP since it breaks current connections.
00:15 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
00:17 -!- ajacob [~ajacob@taurine.csclub.uwaterloo.ca] has quit [Ping timeout: 260 seconds]
00:22 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:27 -!- donspaulding [~donspauld@174-154-231-43.pools.spcsdns.net] has quit [Quit: Leaving.]
00:37 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
00:44 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:48 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
00:50 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:52 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
00:53 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Operation timed out]
01:04 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:05 -!- tessier [~treed@kernel-panic/copilotco] has quit [Read error: Operation timed out]
01:11 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:14 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
01:14 <@vpnHelper> RSS Update - forum: Server not waroking anymore <http://forums.openvpn.net/topic8958.html#p16338>
01:21 <@vpnHelper> RSS Update - forum: OpenVPN and Android/Windows Client -- No IP Address <http://forums.openvpn.net/topic8938.html#p16339>
01:27 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16340>
01:33 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p16341> || Openvpn between two computers in the same network <http://forums.openvpn.net/topic8908.html#p16117>
01:35 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
01:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:39 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16342>
02:07 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:08 -!- tessier [~treed@mail.copilotco.com] has quit [Changing host]
02:08 -!- tessier [~treed@kernel-panic/copilotco] has joined #openvpn
02:16 -!- dcui [~dcui@134.134.137.71] has joined #openvpn
02:18 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 244 seconds]
02:21 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
02:21 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
02:25 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
02:32 -!- dcui [~dcui@134.134.137.71] has left #openvpn []
02:52 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
03:03 -!- raidz is now known as raidz_afk
03:10 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
03:12 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Operation timed out]
03:12 -!- caemir_ is now known as caemir
03:18 -!- fmolinero_ [~paco@36.221.76.188.dynamic.jazztel.es] has joined #openvpn
03:25 -!- fmolinero_ [~paco@36.221.76.188.dynamic.jazztel.es] has quit [Quit: Ex-Chat]
03:37 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
03:51 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
03:53 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has joined #openvpn
03:56 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
04:13 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
04:22 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
04:28 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
04:31 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
04:33 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 252 seconds]
04:38 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has quit [Quit: louiscyfer]
04:38 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has joined #openvpn
04:38 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:39 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
04:41 <@vpnHelper> RSS Update - forum: Unable to create temporary file + client-connect script <http://forums.openvpn.net/topic8955.html#p16343>
04:44 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
04:47 <@vpnHelper> RSS Update - forum: OpenVPN single sign-in script for multi-server VPN service <http://forums.openvpn.net/topic8966.html>
04:47 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 260 seconds]
05:01 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
05:06 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has quit [Quit: louiscyfer]
05:12 -!- mape2k [~mape2k@f053192201.adsl.alicedsl.de] has joined #openvpn
05:20 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
05:23 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
05:51 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has joined #openvpn
06:04 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
06:09 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:11 <@vpnHelper> RSS Update - forum: open vpn client problem double OS PC.wrong route.exe usage <http://forums.openvpn.net/topic8967.html>
06:14 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
06:16 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 244 seconds]
06:22 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:22 <@vpnHelper> RSS Update - forum: OpenVPN+Debian Squeeze without multiple clients access <http://forums.openvpn.net/topic8968.html> || openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16346>
06:25 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Remote host closed the connection]
06:35 <@vpnHelper> RSS Update - forum: OpenVPN+Debian Squeeze without multiple clients access <http://forums.openvpn.net/topic8968.html#p16349> || openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16348>
06:39 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
06:39 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
06:41 -!- mape2k [~mape2k@f053192201.adsl.alicedsl.de] has quit [Ping timeout: 255 seconds]
06:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
06:53 <@vpnHelper> RSS Update - forum: How to block port 25 on OpenVPN ? <http://forums.openvpn.net/topic8969.html>
06:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:57 -!- mape2k [~mape2k@f053192201.adsl.alicedsl.de] has joined #openvpn
06:59 -!- corretico_ [~luis@200.12.40.25] has quit [Remote host closed the connection]
06:59 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16351>
07:01 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
07:17 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16353> || no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p16352>
07:23 <@vpnHelper> RSS Update - forum: OpenVPN+Debian Squeeze without multiple clients access <http://forums.openvpn.net/topic8968.html#p16354>
07:24 -!- mape2k [~mape2k@f053192201.adsl.alicedsl.de] has quit [Ping timeout: 248 seconds]
07:35 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
07:35 <@vpnHelper> RSS Update - forum: How to block port 25 on OpenVPN ? <http://forums.openvpn.net/topic8969.html#p16356> || openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16355>
07:40 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
07:41 -!- zoidberg1 is now known as zoidberg-
07:41 <@vpnHelper> RSS Update - forum: OpenVPN+Debian Squeeze without multiple clients access <http://forums.openvpn.net/topic8968.html#p16359> || openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16358> || no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p16357>
07:41 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
07:41 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
07:43 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
07:43 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
07:44 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
07:44 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
07:45 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
07:46 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
07:47 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
07:47 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
07:47 < hyper_ch> getting a robo cleaner is probably the best thing I've done for myself in quite some time
07:48 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
07:48 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has quit [Quit: louiscyfer]
07:48 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:48 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has joined #openvpn
07:51 -!- louiscyfer_ [~louisponc@93-77.62-188.cust.bluewin.ch] has joined #openvpn
07:53 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
07:53 -!- louiscyfer_ is now known as louiscyfer
07:53 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:57 -!- louiscyfer [~louisponc@93-77.62-188.cust.bluewin.ch] has quit [Quit: louiscyfer]
07:58 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:08 -!- chokesmaster [~chokesmas@69.157.245.233] has quit []
08:16 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p16360>
08:20 -!- mape2k [~mape2k@2a01:198:23f:10ff:f016:d9ff:fe7a:a1b7] has joined #openvpn
08:21 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
08:22 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p16361>
08:26 -!- Cubox [~Cubox@unaffiliated/cubox] has joined #openvpn
08:26 < Cubox> Hello
08:27 < Cubox> On http serv logs, the connections from the vpn appear with the ip of the computer
08:27 <@vpnHelper> RSS Update - forum: How to block port 25 on OpenVPN ? <http://forums.openvpn.net/topic8969.html#p16362>
08:27 < Cubox> the real ip
08:27 < Cubox> how to have the internal ip ?
08:28 < Cubox> i don't know if it's easy to understand
08:28 < krzee> http server is the vpn server?
08:28 < Cubox> yes
08:28 < krzee> have the httpd listen on the vpn ip as well
08:28 < krzee> then connect to the vpn ip
08:29 < Cubox> mmh
08:29 < krzee> or if you have 2 public ips:
08:29 < Cubox> no, but on some others services
08:29 < Cubox> like freenet
08:29 < krzee> you could have the vpn listen on a different ip than the webserver does, then route the webserver ip over the vpn
08:29 < Cubox> (i need to allow a vpn ip to access to the freenet gttp node)
08:29 < krzee> but with them on the same ip that cannot happen
08:30 < Cubox> mmh
08:30 < Cubox> or, just let the freenet listen to the tun0 ?
08:30 < krzee> right :-p
08:30 < Cubox> ntun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
08:30 < Cubox>           inet adr:10.8.0.1  P-t-P:10.8.0.2  Masque:255.255.255.255
08:30 < Cubox> i put 10.8.0.1 ?
08:30 < krzee> right
08:30 < Cubox> and allow 10.8.0.0/24
08:30 < Cubox> thanks :)
08:31 < krzee> you may need the vpn to be up before the service
08:31 < Cubox> mmh
08:31 < Cubox> i start freenet at hand
08:31 < krzee> which can be done by making openvpn start the service
08:31 < krzee> with an --up script
08:31 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:31 < krzee> oh by hand works too =]
08:31 < Cubox> :)
08:31  * Cubox will try now
08:31 < krzee> you're welcome
08:32 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
08:32 < Cubox> Yes, i have forget, thanks
08:33 < krzee> no you did say it, i was responding =]
08:33 <@vpnHelper> RSS Update - forum: OpenVPN+Debian Squeeze without multiple clients access <http://forums.openvpn.net/topic8968.html#p16363>
08:33 -!- mape2k [~mape2k@2a01:198:23f:10ff:f016:d9ff:fe7a:a1b7] has quit [Ping timeout: 244 seconds]
08:34 < Cubox> oh
08:41 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
08:45 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
08:51 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
08:52 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:54 -!- albech [~albech@183.88.67.106] has joined #openvpn
09:00 -!- radioxid [~radioxid@78.237.60.197] has joined #openvpn
09:05 -!- master_of_master [~master_of@p57B545A9.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:07 -!- master_of_master [~master_of@87.181.53.34] has joined #openvpn
09:14 -!- carwatt [~watsocar@201.191.100.224] has joined #openvpn
09:14 < carwatt> Hi everyone,
09:15 < carwatt> I'll need to install OPENVPN on centos 5.6 but i had huge problem with the installetions someone provide me the yum pack for the instalations or the link
09:24 < EugeneKay> carwatt - Enable EPEL.
09:24 < carwatt> the repo, cheking
09:25 < EugeneKay> If you have to fiddle about with yum-priorities, you're doing repo management wrong ;-)
09:28 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16365> || no internet on a VPN client connection established <http://forums.openvpn.net/topic8870.html#p16364>
09:28 < carwatt> Requires: libgnutls.so.13
09:29 < EugeneKay> Everything you need ought to be available in EPEL. YOu can enable the basic epel repo with zero problems.
09:30 < carwatt> ok thanks
09:30 < EugeneKay> That is, it doesn't overwrite any packages in the centos repos
09:30 < EugeneKay> The -extras are another story
09:34 -!- meepmeep [meepmeep@212.24.104.229] has joined #openvpn
09:43 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
09:52 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
09:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:00 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
10:04 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16366>
10:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:11 -!- radioxid [~radioxid@78.237.60.197] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
10:14 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
10:16 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16367>
10:20 -!- repr [~2xcvvxzc@210.Red-88-15-223.dynamicIP.rima-tde.net] has joined #openvpn
10:20 < repr> hi
10:22 < repr> I do have the 'push "redirect-gateway"' directive in my server's config. file but the client doesn't change the default gateway
10:23 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:23 < repr> Do I have to change something?
10:24 < Olipro> repr: I believe it adds 0.0.0.0/1 and 128.0.0.0/1
10:27 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
10:28 < repr> Olipro: 0.0.0.0/1 still points to my previous gateway
10:28 < Olipro> then remove it
10:29 < repr> that is, it doesn't change it; just the openvpn subnetwork gw is added
10:29 < Olipro> is this a windows client?
10:30 < repr> Olipro but shouldn't it change openvpn itself? Nope, it's a debian system OpenVPN 2.2.0
10:30 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
10:31 < repr> I didn't configure the server NAT translation yet, but I suppose OpenVPN doesn't check it, so it should be pushed into the client?
10:31 < repr> The server is FreeBSD
10:31 < Olipro> so, you have redirect-gateway being pushed, but the debian client isn't adding any new route at all?
10:31 < Olipro> is this tun or tap
10:34 < repr> tap
10:34 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16368>
10:35 < repr> this is in the client's log: '/sbin/route add -net 10.55.0.0 netmask 255.255.255.0 gw 192.168.100.3'
10:37 < Olipro> mmm, I'm not sure how well redirect-gateway plays with tap
10:38 < Olipro> why not just add a specific route for the IP address of the OVPN server and then replace your default route as you see fit from the client side
10:45 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
10:46 < EugeneKay> "TAP has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
10:47 < repr> I'm changing the configuration ripping the default examples from the docs
10:51 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Read error: Connection reset by peer]
10:52 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
10:52 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935.html#p16369>
10:53 < Olipro> EugeneKay: tap is fine, providing you're using it for the right reasons
10:54 < EugeneKay> And chances are, you aren't. :-p
10:54 < Olipro> such as wanting to conveniently put yourself "inside" your LAN from a remote location
10:54 < Olipro> that's what I use it for anyway
10:54 < Olipro> so it gets DHCP and RAs from the router
10:54 < Olipro> and I can talk to all the other clients
10:56 -!- albech [~albech@183.88.67.106] has quit [Remote host closed the connection]
10:57 < repr> I just read the differences between tap and tun interfaces, IP routing is enough :)
10:58 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
11:02 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
11:04 < EugeneKay> Which is why TAP should only be used by cat rapists. Like Olipro.
11:04 < Olipro> lies
11:05 < Olipro> "they wouldn't let me into the enclosure"
11:15 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
11:22 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:23 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
11:25 -!- ravel_out [~ravel_out@175.136.82.14] has joined #openvpn
11:25 <@vpnHelper> RSS Update - forum: OpenVPN issues in Rackspace Rackconnect environment <http://forums.openvpn.net/topic8970.html>
11:40 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:45 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
11:52 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:52 -!- ravel_out [~ravel_out@175.136.82.14] has quit []
11:55 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
12:00 -!- raidz_afk is now known as raidz
12:08 <@vpnHelper> RSS Update - forum: OpenVPN issues in Rackspace Rackconnect environment <http://forums.openvpn.net/topic8970.html#p16371>
12:32 <@vpnHelper> RSS Update - forum: OpenVPN issues in Rackspace Rackconnect environment <http://forums.openvpn.net/topic8970.html#p16372>
12:47 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
13:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:09 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
13:10 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
13:11 -!- corretico [~luis@201.201.44.82] has joined #openvpn
13:16 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
13:17 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 240 seconds]
13:18 < krzee> anyone know a centos repo that has 2.2.1?  all im seeing is 2.1.4
13:21 <@vpnHelper> RSS Update - forum: [Solved] OpenVPN no routing in Rackspace Rackconnect environment <http://forums.openvpn.net/topic8971.html#p16372>
13:22 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
13:24 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:27 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
13:32 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:38 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
13:40 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:44 -!- eigenburak [~eigenbura@c-24-63-27-203.hsd1.ma.comcast.net] has joined #openvpn
13:46 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
13:46 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
13:47 -!- repr [~2xcvvxzc@210.Red-88-15-223.dynamicIP.rima-tde.net] has quit [Quit: leaving]
13:47 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:51 < eigenburak> so before I go installing openvpn server from source on CentOS 6, is there an obvious way of doing this with "yum"?
13:55 < krzee> epel has 2.1.4
13:55 < krzee> as far as 2.2.1, im looking too
13:58 < eigenburak> hmmm... nevermind
13:59 < krzee> https://forums.openvpn.net/topic2.html
14:00 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN Install Guides : Tutorials (at forums.openvpn.net)
14:00 < krzee> if installing from source on centos may wanna read that, it says the dependancy packages
14:00 < krzee> namely, yum install openssl-devel lzo-devel pkcs11-helper-devel
14:00 < krzee> [15:00]  <The_Spider> i am using openvpn 2.2.0 on centos 6 from rpmforge
14:04 < krzee> and now i have 2.2.0-3.el5 installed =]
14:04 < krzee> http://wiki.centos.org/AdditionalResources/Repositories/RPMForge#head-f0c3ecee3dbb407e4eed79a56ec0ae92d1398e01
14:04 <@vpnHelper> Title: AdditionalResources/Repositories/RPMForge - CentOS Wiki (at wiki.centos.org)
14:05 < krzee> just install that repo, then yum install openvpn
14:05 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
14:05 < krzee> nice timing, you caught me in the middle of doing the exact same thing =]
14:19 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
14:21 -!- corretico [~luis@201.201.44.82] has joined #openvpn
14:24 < eigenburak> i just tried yum install pkcs11-helper-devel and it couldn't find it in my repositories
14:29 < eigenburak> ok, adding rpmforge did it i think
14:38 -!- eigenburak [~eigenbura@c-24-63-27-203.hsd1.ma.comcast.net] has quit [Quit: eigenburak]
14:51 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:08 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has left #openvpn []
15:17 -!- _____m [m4lk@static.150.207.47.78.clients.your-server.de] has quit [Remote host closed the connection]
15:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
15:35 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:46 -!- novaflash_away [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
15:46 -!- novaflash_away is now known as novaflashbb
15:46 -!- novaflashbb [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Client Quit]
15:47 -!- novaflash [~notme@openvpn/user/novaflash] has quit []
15:50 -!- novaflash [~novaflash@openvpn/user/novaflash] has joined #openvpn
15:50 -!- mode/#openvpn [+v novaflash] by ChanServ
15:52 -!- eigenburak [~eigenbura@c-24-63-27-203.hsd1.ma.comcast.net] has joined #openvpn
15:56 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has joined #openvpn
15:59 < pyronik> Hello, I am attempting to set up openvpn on my linksys wrt54gl router and with my ipad as a client... I have it so that my router detects and assigns the ipaddress 192.168.2.6 to the ipad, and the ipad i can see has the ip on the ppp device but I can't get the router to even ping the ipad, nor can I get any other 192.168.1.x machine, the routers primary network, to see the ipad or ping it.
15:59 < EugeneKay> !logs
16:00 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
16:00 < EugeneKay> krzee - rpmforge has 2.2.1 for CentOS/SL 6
16:01 < EugeneKay> No, I lied. That's EPEL.
16:01 < EugeneKay> rpmforge only has 2.2.0 for 5 and 6
16:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
16:01 < EugeneKay> And 4, but if you're using 4, you're daft.
16:01 < krzie> oh epel only has it for 6?
16:01 < krzie> im using 5, epel has 2.1.4
16:02 < EugeneKay> I don't have any 5 hosts, but IIRC they stopped at 2.1
16:02 < krzie> got ya
16:02 < EugeneKay> Really ought to update to 6 :-p
16:03 < pyronik> http://pastebin.com/cHSNDBCq <-server log .. I am not quite sure how to get the log from the client ipad
16:03 < krzie> !logfile
16:04 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
16:04 < krzie> just make sure you turn it off when you're done debugging
16:05 < pyronik> kk I will come back in a little once i get those
16:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:42 < eigenburak> i decided to follow the instructions here (http://www.howtoforge.com/openvpn-server-on-centos-5.2) and finally got to the step where I run "/etc/init.d/openvpn start" ... but now i'm faced with CentOS 6 telling me that "starting openvpn: [FAILED]"
16:42 <@vpnHelper> Title: OpenVPN Server On CentOS 5.2 | HowtoForge - Linux Howtos and Tutorials (at www.howtoforge.com)
16:43 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has quit [Ping timeout: 240 seconds]
16:43 < eigenburak> a quick "cat /var/log/messages | grep openvpn" tells me the breaking point is this: "Oct  8 17:37:46 swing openvpn[63768]: TCP/UDP: Socket bind failed on local address [undef]:1723: Permission denied
16:43 < eigenburak> Oct  8 17:37:46 swing openvpn[63768]: Exiting
16:43 < eigenburak> "
16:45 < eigenburak> My understanding is that openvpn is trying to listen on port 1723 but permission is being denied?
16:47 < eigenburak> hmm... ok, well... switching to port 1194 solved that problem
16:47 < eigenburak> ...i'm just going to go with it :)
16:47 -!- pyronik [~none@66.108.133.11] has joined #openvpn
16:48 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
16:54 -!- pyronik [~none@66.108.133.11] has quit [Ping timeout: 260 seconds]
16:55 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
16:58 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
16:58 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has joined #openvpn
17:05 <@vpnHelper> RSS Update - forum: can ping server and other ips, but can't connect to internet <http://forums.openvpn.net/topic8879-15.html#p16373>
17:11 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
17:11 <@vpnHelper> RSS Update - forum: openvpn connection failed on centos <http://forums.openvpn.net/topic8935-15.html#p16374>
17:12 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
17:12 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
17:13 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
17:18 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
17:22 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has joined #openvpn
17:23 -!- eigenburak [~eigenbura@c-24-63-27-203.hsd1.ma.comcast.net] has quit [Quit: eigenburak]
17:23 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16375>
17:32 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Computer has gone to sleep]
17:33 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
17:35 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
17:42 < krzie> !tcp
17:42 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
17:51 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
17:55 < reiffert> !udp
17:55 < reiffert> !network
17:56 < reiffert> !internet
17:56 < reiffert> !openvpn
17:58 < krzie> !factoids
17:58 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
17:59 -!- novaflash is now known as novaflash_away
18:00 -!- novaflash_away is now known as novaflash
18:06 -!- novaflash is now known as novaflash_away
18:10 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
18:10 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
18:10 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
18:10 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
18:11 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
18:48 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
18:53 -!- Denial [Denial@drgi.co.uk] has quit []
18:54 -!- eigenburak [~eigenbura@c-24-63-27-203.hsd1.ma.comcast.net] has joined #openvpn
18:57 < eigenburak> i've successfully setup openvpn (as far as i can tell) on a CentOS 6 server... now i want to access it from a mac os x machine. what files/information from the server do i need to do this?
18:58 < krzie> !howto
18:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:58 < eigenburak> google pointed me at "tunnelblick" but i'm open to another option
18:58 < krzie> well you can use tunnelblick, but i find it easier to just install openvpn like normal
18:58 < krzie> (from source or macports)
18:59 < eigenburak> krzie: i think my biggest issue is the client config file and associated certificates
19:00 < krzie> thats what i figured, which is why i gave you the howto
19:00 < krzie> it clearly explains the PKI
19:00 < krzie> as far as configs...
19:00 < krzie> !sample
19:00 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
19:00 < krzie> *or*
19:00 < krzie> !confgen
19:00 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
19:01 < eigenburak> i see. very helpful. thanks... let me get on that and i'll (maybe? probably?) be back with more questions
19:03 < krzie> you're welcome
19:10 -!- eigenburak [~eigenbura@c-24-63-27-203.hsd1.ma.comcast.net] has quit [Quit: eigenburak]
19:19 -!- _julian_ [~quassel@hmbg-5f761d1d.pool.mediaWays.net] has joined #openvpn
19:22 -!- _julian [~quassel@hmbg-5f766736.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
19:25 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:33 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 248 seconds]
19:36 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
19:39 -!- karmapolis [~karmapoli@190.19.95.103] has joined #openvpn
19:39 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
19:45 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
19:52 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
19:57 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
20:06 <@vpnHelper> RSS Update - forum: 2 dd-wrt routers openvpn client-server setup help? <http://forums.openvpn.net/topic8972.html>
20:08 < karmapolis> Hello. I'm new to openvpn having always used ipsec until now. I'm trying to debug a problem with my configuration, and I'm doubting whether there's something wrong with my system. Can anybody lend me a brain?
20:08 < karmapolis> If i run "openvpn --test-crypto --secret server.key" using the sample keys that come with openvpn, I get "Insufficient key material or header text not found in file".
20:09 < karmapolis> Of course I get this same error with any of the keys I generated too.
20:09 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
20:09 < karmapolis> Any ideas about this?
20:12 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16377>
20:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:22 < karmapolis> To clarify: the test works with a static OpenVPN server key generated with openvpn --genkey . I am trying to test an SSL key, not a static key.
20:25 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
20:31 < EugeneKay> You need a full ca/key/crt combo.
20:43 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
20:44 -!- igormorgado [~igormorga@mvx-200-142-107-126.mundivox.com] has quit [Ping timeout: 240 seconds]
20:45 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
20:45 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:48 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 252 seconds]
20:50 -!- crocket [~crocket@unaffiliated/crocket] has left #openvpn ["Leaving"]
20:52 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 256 seconds]
21:12 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
21:14 < krzie> !sample
21:14 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
21:14 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
21:33 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:38 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
21:39 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
21:39 -!- mode/#openvpn [+o dazo_afk] by ChanServ
21:45 -!- ravel_out [~ravel_out@175.136.82.14] has joined #openvpn
22:06 -!- carwatt [~watsocar@201.191.100.224] has quit [Quit: Leaving]
22:06 -!- carwatt [~watsocar@201.191.100.224] has joined #openvpn
22:08 -!- ravel_out [~ravel_out@175.136.82.14] has quit []
22:25 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
22:34 < karmapolis> EugeneKay: I have the full ca/key/cert combo, but --test-crypto seems to require the use of --secret instead.
22:36 < EugeneKay> Funky.
22:41 < karmapolis> "openvpn --test-crypto" works with "--secret ta.key" for example. But if instead I use "--ca ca.crt --key server.key --cert server.crt" it tells me that I must provide the key file with --secret.
22:42 < karmapolis> So maybe --test-crypto is no use with certificates?
22:43 < karmapolis> This is a CentOS 5.7 host, BTW.
22:45 < karmapolis> I was trying to see if my crypto works because I get "Assertion failed at crypto.c:161" immediately after a connection is successfully established with a client in TLS mode.
22:45 < karmapolis> Don't know what to make of it.
22:45 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
23:03 -!- dazol [dazo@nat/redhat/x-eudgjfcptlwatoux] has joined #openvpn
23:03 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 256 seconds]
23:18 -!- crocket [~crocket@unaffiliated/crocket] has joined #openvpn
23:19 < crocket> Does SIGUSR1 make openvpn reopen a log file?
23:21 < karmapolis> crocket: as far as I understand from the manpage, no, it does not.
23:21 < karmapolis> see the description of --log
23:22 < crocket> karmapolis, Why does openvpn not reopen a log file in response to a signal?
23:23 < crocket> This program is old enough to have that functionality.
23:23 < karmapolis> If I understand correctly, the idea is to enable openvpn to drop root privileges.
23:24 < karmapolis> SIGUSR1 is used like SIGHUP, but those parts that need root permission are not touched by it.
23:25 < crocket> yeah, but users can partially circumvent that restriction with "iproute", "client-connect", "client-disconnect", "up", and "down" directives.
23:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
23:25 < crocket> In those directives, I used sudo to give a partial root privilege to a normal user.
23:26 < karmapolis> crocket: those directives have to be used on the server side. It's not up to the client to use them.
23:26 < crocket> karmapolis, I run a server.
23:27 < crocket> karmapolis, And I think openvpn could acquire a new directive for obtaining write permission for a new logfile.
23:29 < karmapolis> well, I'm no expert in OpenVPN so I cannot comment much about this. But I wouldn't want my server logs to be created at a client's will.
23:29 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:29 < crocket> karmapolis, That can be controlled, too
23:29 < karmapolis> Inodes are limited, etc.
23:29 < crocket> Maybe SIGUSR1 signal can be assigned especially for opening a new log file.
23:30 < crocket> oops
23:30 < crocket> SIGUSR1->SIGUSR2
23:31 < karmapolis> SIGUSR2 "Causes OpenVPN to display its current statistics"
23:31 < crocket> ah right
23:31 < crocket> Something unused.
23:31 < crocket> SIGUSE3
23:31 < crocket> SIGUSR3
23:32 < karmapolis> SIGUSR3 does not exist in Linux. But yeah, I suppose you could find one that is unused.
23:53 <@vpnHelper> RSS Update - forum: how to make OpenVPN Access Server a gateway <http://forums.openvpn.net/topic8973.html>
--- Day changed Sun Oct 09 2011
00:51 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16379>
00:53 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
00:57 <@vpnHelper> RSS Update - forum: How to Hire For OpenVPN install on VPS? <http://forums.openvpn.net/topic8959.html#p16380>
01:02 -!- EugeneKay is now known as EugeneSleep
01:02 < karmapolis> Okay. I think I'm onto something here. The --test-crypto was no use with tls, but I was able to test it with the loopback client & server sample configurations.
01:03 < karmapolis> There is definitely something wrong with some ciphers in this openvpn binary and/or in my system libraries.
01:04 < karmapolis> This is stock CentOS 5.7 with the RPMFORGE openvpn-2.2.0-3.el5.rf package, so this is not good.
01:05 < karmapolis> Cipher DES-EDE3-CBC works OK, but cipher AES-256-OFB fails with the following message: "Assertion failed at crypto.c:161"
01:08 < carwatt> error  NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
01:08 < carwatt> how I know if my vpn connetions work fine?
01:10 < carwatt> and WARNING: No server certificate verification method has been enabled
01:10 < carwatt> some help
01:10 < carwatt> ?
01:29 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:33 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16383> || no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16382> || openvpn connection failed on centos <http://forums.openvpn.net/topic8935-15.html#p16381>
01:38 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
01:38 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
01:58 < karmapolis> Further tests confirm that any block cipher modes other than CBC fail.
02:04 <@vpnHelper> RSS Update - forum: How to Hire For OpenVPN install on VPS? <http://forums.openvpn.net/topic8959.html#p16384>
02:04 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Quit: Leaving]
02:04 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
02:21 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
02:30 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 256 seconds]
02:41 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
02:42 -!- luneff [~yury@84.51.192.74] has joined #openvpn
02:52 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has joined #openvpn
02:58 <@vpnHelper> RSS Update - forum: two operating system pc . wrong route.exe usage <http://forums.openvpn.net/topic8956.html#p16385>
02:59 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
02:59 -!- carwatt [~watsocar@201.191.100.224] has quit [Ping timeout: 255 seconds]
03:07 -!- Cr4zi3 [killaz@184.95.44.187] has quit [Ping timeout: 252 seconds]
03:09 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
03:17 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:27 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
03:29 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
03:29 -!- caemir_ is now known as caemir
03:31 -!- albech [~albech@61.7.177.131] has joined #openvpn
03:32 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
03:34 -!- crocket [~crocket@unaffiliated/crocket] has left #openvpn ["Leaving"]
03:45 -!- IsilZha [~andreas@182.55.249.45] has quit [Ping timeout: 258 seconds]
03:45 -!- IsilZha [~andreas@182.55.249.76] has joined #openvpn
03:45 -!- karmapolis [~karmapoli@190.19.95.103] has quit [Ping timeout: 260 seconds]
04:00 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
04:00 -!- Cubox [~Cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.6-rc1"]
04:09 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
04:09 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16386>
04:18 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
04:28 <@vpnHelper> RSS Update - forum: two operating system pc . wrong route.exe usage <http://forums.openvpn.net/topic8956.html#p16387>
04:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
04:33 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16388>
04:34 -!- novaflash_away is now known as novaflash
04:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:46 <@vpnHelper> RSS Update - forum: two operating system pc . wrong route.exe usage <http://forums.openvpn.net/topic8956.html#p16389>
04:54 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
04:54 <@vpnHelper> RSS Update - forum: open vpn client problem double OS PC.wrong route.exe usage <http://forums.openvpn.net/topic8967.html#p16391> || need help about changing default route.exe path <http://forums.openvpn.net/topic8974.html>
05:00 <@vpnHelper> RSS Update - forum: OpenVPN AS <http://forums.openvpn.net/topic8925.html>
05:04 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
05:06 <@vpnHelper> RSS Update - forum: Which router can support connecting to an OpenVPN server? <http://forums.openvpn.net/topic8975.html>
05:11 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:20 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
05:20 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
05:20 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
05:23 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
05:23 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
05:23 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:23 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
05:48 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
05:55 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
05:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
06:13 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
06:20 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:27 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
06:29 -!- Denyven [Denyven@123.120.169.244] has joined #openvpn
06:29 -!- Cubox [~Cubox@unaffiliated/cubox] has joined #openvpn
06:29 <@vpnHelper> RSS Update - forum: two operating system pc . wrong route.exe usage <http://forums.openvpn.net/topic8956.html#p16393>
06:30 < Denyven> Hi I need help redirecting my trafffic through my VPN
06:30 < krzee> !redirect
06:30 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
06:30 < Cubox> !dns
06:30 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
06:30 < Cubox> !pushdns
06:30 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
06:30 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
06:31 < Cubox> Oh, i need some help, i want to set https://secure.wikimedia.org/wikipedia/en/wiki/Teredo_tunneling for the vpn clients
06:31 <@vpnHelper> Title: Teredo tunneling - Wikipedia, the free encyclopedia (at secure.wikimedia.org)
06:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:36 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16394>
06:41 < krzee> !ipv6
06:41 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options) or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
06:41 < krzee> !snapshots
06:41 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
06:43 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has joined #openvpn
06:44 < Denyven> !def1
06:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
06:44 < wolfric> is there anyway in the config to automatically set a static route for the host you're connecting to? so if you're connecting to a network which provides the same network on the otherside, you'd normally have to add in a static route for the ip you're connecting to
06:44 < Denyven> !ipforwarding
06:44 < wolfric> so connecting to 1.2.3.4 which gives you access to 1.2.3.0/24
06:45 < Denyven> !ipforward
06:45 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
06:45 < krzee> wolfric, openvpn automatically does that
06:45 < Denyven> !linipforward
06:45 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
06:45 < krzee> wolfric, what problem are you trying to solve?
06:46 < wolfric> krzee: pretty much exactly what i was asking. get an openvpn option to set a route for the ip i'm connecting to
06:46 < wolfric> if the ip i'm connecting to is pushing routes for the range the server is in
06:47 < wolfric> !help
06:47 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
06:48 < wolfric> krzee: and it doesn't seem to. i have to set it staticly
06:48 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16395>
06:50 < Cubox> !ipv6
06:50 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options) or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
06:57 -!- ravel_out [ravel_out@175.136.82.14] has joined #openvpn
06:58 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
07:00 <@vpnHelper> RSS Update - forum: two operating system pc . wrong route.exe usage <http://forums.openvpn.net/topic8956.html#p16396>
07:02 -!- out_ravel [ravel_out@175.136.82.14] has joined #openvpn
07:03 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Ping timeout: 240 seconds]
07:05 -!- ravel_out [ravel_out@175.136.82.14] has quit [Ping timeout: 258 seconds]
07:05 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:06 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
07:09 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
07:11 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:17 < wolfric> krzee: any help no?
07:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
07:18 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
07:19 < SeaStorm> o/
07:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:20 < Denyven> when I try to ipforward
07:20 < Denyven> I get this: /proc/sys/net/ipv4/ip_forward: Permission denied
07:20 < Denyven> what should I do
07:20 < Denyven> I'm on a Lunix VPS
07:21 < SeaStorm> can someone plz help me a bit ? :) Ive set up openvpn on my debian server a few months ago to freely surf from china. havent changed the config since then ( at least as far as I remember ;) ) and now it wont work anymore... Server has 10.8.0.1 and assigns my Client .6, but default gateway of .5 ?!
07:21 < SeaStorm> I currently cant figure out why
07:22 < SeaStorm> unsing push "redirect-gateway"
07:23 < SeaStorm> using
07:23 < SeaStorm> !config
07:23 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
07:24 < Cubox> haha
07:24 < Cubox> supybot fail
07:25 < Cubox> Denyven: are you root ?
07:27 < wolfric> Denyven: copy paste command 
07:29 < ecrist> !configs
07:29 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
07:29 < ecrist> Cubox fail.
07:29 < Cubox> ?
07:30 < ecrist> you forgot what you said 5 minutes ago?
07:30 < Cubox> yes
07:30 < ecrist> 07:24:33 < Cubox> haha
07:30 < ecrist> 07:24:37 < Cubox> supybot fail
07:30 < Cubox> oh, i'v understand
07:30 < Cubox> but, just remove command "config" on the channel ;)
07:32 < Denyven> I am Cubox
07:32 < Denyven> and the command is
07:32 < Denyven>  echo 1 > /proc/sys/net/ipv4/ip_forward
07:32 < Cubox> mmh, ls -l /proc/sys/net/ipv4/ip_forward
07:33 < Cubox> please
07:33 < Denyven> hmmmm
07:33 < Denyven> I think it worked
07:34 < Denyven> I got this 
07:34 < SeaStorm> http://pastebin.com/J8fqpD39 <- my server Config , my Windows Client one: http://pastebin.com/Am6kp4xg .... halp :]
07:35 < Denyven> !redirect
07:35 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
07:36 < Denyven> !nat
07:36 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
07:36 < Denyven> !dns
07:36 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
07:36 < Denyven> !pushdns
07:36 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
07:36 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
07:40 < SeaStorm> that was for me ?!
07:41 < Denyven> alright
07:41 < Denyven> I am really having problems forwarding traffic
07:41 < Denyven> is the line in server.conf push "dhcp-option DNS a.b.c.d" 
07:41 < Denyven> is it suppose to be a.b.c.d
07:41 < Denyven> or an acutal DNS/ip
07:42 < SeaStorm> ip
07:42 < Denyven> whos ip
07:42 < SeaStorm> if your server does DNS, then you can use it, otherwise use f.e 8.8.8.8
07:42 < SeaStorm> google public dns
07:44 < SeaStorm> anyone knows why I do get a wrong gateway, or why the Server doesnt get itself this IP ( I think it did before ... )
07:46 < Denyven> I am really failing at this traffic redirecting thing
07:46 < SeaStorm> is it a DNS or a redirecting problem ?
07:46 < Denyven> I have no idea
07:46 < Denyven> my webbrowsing traffic isnt going through the VPS
07:46 < Denyven> or VPN
07:47 < SeaStorm> windows client ?
07:47 < Denyven> yes sir
07:48 < SeaStorm> checked ipconfig ? whats gateway, can you reach it? does it add the routes ?
07:49 < Denyven> It says I have no default gateway on local area network connetction 2, which is my VPN
07:49 < SeaStorm> then it cannot work
07:50 < Denyven> how would I add one
07:50 < Denyven> and what should I add
07:50 < SeaStorm> whats your setup on server side ?
07:51 < Denyven> would you like me to show you my entire server.conf
07:51 < Denyven> I am on a VPS running debian
07:51 < SeaStorm> pastebin it
07:51 < Denyven> mk
07:51 < Denyven> how to I copy server.conf
07:51 < SeaStorm> uh....
07:52 < Denyven> yeah, dumb question
07:52 < SeaStorm> how do you control your vps ?
07:53 < Denyven> PuTTY
07:53 < Denyven> hangon
07:53 < SeaStorm> then go to your openvpn folder
07:53 < SeaStorm> grep -vE '^#|^;|^$' server.conf
07:53 < Denyven> I can probably just grab the file on winscp
07:53 < SeaStorm> or that
07:56 < Denyven> http://pastebin.com/UwnvYpU1
07:57 < SeaStorm> try adding push "redirect-gateway"
07:57 < SeaStorm> (restart server openvpn server )
07:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:59 < Denyven> hmm, so the line 187 dosnt count as "redirect-gateway"
08:07 < Denyven> hello?
08:11 -!- [1]SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
08:11 < Denyven> Seastorm you still there
08:12 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 256 seconds]
08:12 -!- [1]SeaStorm is now known as SeaStorm
08:21 -!- Denyven [Denyven@123.120.169.244] has quit [Ping timeout: 255 seconds]
08:21 -!- Denyven [Denyven@123.120.169.244] has joined #openvpn
08:21 < Denyven> Hey Seastorm you still there
08:24 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
08:35 < Denyven> I am having issues with my default gateway settings on my client side
08:35 < Denyven> what should I put as those things
08:35 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
08:35 < Denyven> IP
08:35 < Denyven> Default Gateway
08:36 < Denyven> and subnetmask
08:36 < Denyven> anyone
08:43 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection timed out]
08:47 < SeaStorm> uh yeah went afk. nope that should be fine. whats your client conf ?
08:54 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:02 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:05 -!- master_of_master [~master_of@87.181.53.34] has quit [Ping timeout: 260 seconds]
09:07 -!- mystica555_ [~Mike@71-211-218-103.hlrn.qwest.net] has joined #openvpn
09:07 -!- master_of_master [~master_of@p57B53BAE.dip.t-dialin.net] has joined #openvpn
09:07 -!- Denyven [Denyven@123.120.169.244] has quit [Ping timeout: 252 seconds]
09:08 < mystica555_> got a quesrtion with regard to MTUs of my vdsl (pppoe) and the vpn.  if my MTU on PPPoE is 1492, how much overhead is there generated when openvpn is set to 1500 data mtu ? would it be a lot better if i set that mtu somewhere below 1492 ?
09:08 < mystica555_> or rather, what setting should i make openvpn be, so i don't have fragmentation overhead?
09:25 -!- luneff [~yury@84.51.192.74] has joined #openvpn
09:37 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
09:48 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Excess Flood]
09:52 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
10:25 <@vpnHelper> RSS Update - forum: Site to Site OpenVPN <http://forums.openvpn.net/topic8976.html>
10:25 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
10:31 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
10:34 -!- Denial [Denial@drgi.co.uk] has quit []
10:34 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Quit:  Try HydraIRC -> http://www.hydrairc.com <-]
10:55 -!- EugeneSleep is now known as EugeneKay
11:01 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
11:05 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:06 -!- novaflash is now known as novaflash_away
11:07 -!- albech [~albech@61.7.177.131] has quit [Remote host closed the connection]
11:18 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Computer has gone to sleep]
11:19 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16398>
11:22 -!- out_ravel [ravel_out@175.136.82.14] has quit []
11:24 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
11:27 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
11:30 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
11:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
11:34 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:34 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
11:34 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:36 -!- novaflash_away is now known as novaflash
11:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:51 < rkantos> could someone advice me on how to get the roaming icon off?
11:51 < rkantos> I'm in the same network as the sim card is
11:51 < rkantos> but it roams..
11:52 < rkantos> Changing the csc doesn't have an effect
11:55 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
12:04 -!- mystica555_ [~Mike@71-211-218-103.hlrn.qwest.net] has quit [Ping timeout: 252 seconds]
12:05 <@vpnHelper> RSS Update - forum: no internet on a VPN client connection established <http://forums.openvpn.net/topic8870-15.html#p16399>
12:11 <@vpnHelper> RSS Update - forum: Site to Site OpenVPN <http://forums.openvpn.net/topic8976.html#p16400>
12:14 < auduny> Ups.
12:14 < auduny> win 2
12:14 < auduny> win q
12:30 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
12:30 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has joined #openvpn
12:31 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
12:38 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
12:42 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
12:42 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
12:42 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
12:44 -!- maxJadi [~maxJadi@46.239.109.97] has joined #openvpn
12:44 -!- maxJadi [~maxJadi@46.239.109.97] has quit [Changing host]
12:44 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
12:48 <@vpnHelper> RSS Update - forum: 2 dd-wrt routers openvpn client-server setup help? <http://forums.openvpn.net/topic8972.html#p16401>
13:01 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
13:04 -!- Clete2 [~Clete2@98.215.42.211] has joined #openvpn
13:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
13:32 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 248 seconds]
13:40 -!- me345 [~me345@adsl-75-15-232-163.dsl.bkfd14.sbcglobal.net] has joined #openvpn
14:01 -!- me345 [~me345@adsl-75-15-232-163.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
14:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:05 -!- Tamo [~x@cpc6-sgyl28-2-0-cust248.sgyl.cable.virginmedia.com] has joined #openvpn
14:06 < Tamo> Hi, I have seutp OpenVPN on a OpenVZ VM, it connections without issue however it does not route out to the internet.
14:06 < Tamo> I kinda thought iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE would fix it, or am I missing something?
14:07 < Tamo> iptables: Unknown error 18446744073709551615
14:08 < Tamo> I did also try: iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -j SNAT -to-source 54.224.65.21
14:09 < Tamo> Firewall troll :)
14:10 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
14:18 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Ping timeout: 276 seconds]
14:20 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
14:35 -!- zu [~zu@ks355000.kimsufi.com] has quit [Quit: leaving]
14:37 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
14:37 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
14:39 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
14:41 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has quit [Ping timeout: 258 seconds]
14:42 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 256 seconds]
15:30 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
15:31 -!- johnpatcher [~johnpatch@82.113.99.41] has joined #openvpn
15:32 < johnpatcher> hi, i'm trying to set up a bridge vpn, and run into some trouble :(
15:33 < johnpatcher> the client is connected to the server (so the tls handshake went well) and i can see some data flow on verbose level 6), but i can't get a ping working from either side
15:33 < krzie> why bridge?
15:34 < johnpatcher> because i want to have l2 tunnel, so my lan games will work and so forth
15:34 < krzie> got ya
15:35 < johnpatcher> any clues what could be wrong, or what is usually going wrong ;)?
15:36 < krzie> !logs
15:36 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
15:36 < krzie> !configs
15:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
15:37 < krzie> i dont know much about bridging, as ive never had a reason to do it
15:37 < krzie> but i can look =]
15:37 < johnpatcher> i guess it must be something with the route stuff wrong, but im not sure
15:38 < johnpatcher> ill upload my logs/configs, w8
15:38 < krzie> oh
15:38 < krzie> when you connect does your server lose inet connectivity?
15:39 < krzie> (or when it starts even)
15:39 < krzie> a common problem is for the bridge script to not set the gateway, which gets lost after the bridging process (since you are then using a different device to route out)
15:39 <@vpnHelper> RSS Update - forum: Help PLease....connected but can't browse <http://forums.openvpn.net/topic8788.html#p16402>
15:45 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
15:46 < johnpatcher> no, the server doesnt loose the internet connectivity
15:46 < johnpatcher> basically i started up the openvpn service on the hosts and then adding the tap devices to the bridge
15:47 < johnpatcher> *added
15:48 < johnpatcher> because during the initialization process it tells me something like "TUN/TAP device tap0 opened", so i added tap0 to my bridge
16:02 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has joined #openvpn
16:03 < krzie> you havnt seen the up scripts for that?
16:06 < johnpatcher> well i have, but i don't know whether they are up 2 date ;)
16:07 < johnpatcher> because when i use them the tap device gets created before i start openvpn, so openvpn will create just another tap device ...
16:07 < johnpatcher> so they seem to be quite useless for me 
16:07 < johnpatcher> unless i could tell openvpn which device to use 
16:07 < krzie> the script always makes the same device node
16:07 < krzie> then you specify which to use
16:07 < krzie> dev tap0 will not make a new device, dev tap will
16:08 < johnpatcher> ok ;)
16:08 < johnpatcher> thats good to know 
16:08 -!- Clete2 [~Clete2@98.215.42.211] has quit [Excess Flood]
16:10 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has left #openvpn []
16:12 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
16:14 < johnpatcher> im about to collect all the data ;) ... just to get sure ... what configuration is needed, beside the openvpn stuff
16:14 < johnpatcher> meaning just the pure network configuration
16:18 < krzie> its in the script
16:18 < krzie> (and must set the gateway)
16:19 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Excess Flood]
16:21 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:22 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:29 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
16:31 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
16:36 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:38 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:38 -!- mode/#openvpn [+o raidz] by ChanServ
16:42 <@vpnHelper> RSS Update - forum: Problems with a bridged VPN <http://forums.openvpn.net/topic8977.html>
16:43 < johnpatcher> http://forums.openvpn.net/topic8977.html
16:43 <@vpnHelper> Title: OpenVPN Support Forum Problems with a bridged VPN : Configuration (at forums.openvpn.net)
16:43 < johnpatcher> thats mine ;)
16:43 < johnpatcher> so, if you wanna take a look at, would be really great
16:43 < krzie> good idea to post to forum instead of pastebin
16:43 < krzie> now if i dont know you're already ahead of the game =]
16:43 < krzie> (and i likely wont, i dont do bridges)
16:44 < krzie> i usually persuade people that bridging is wrong for them... but it is right for you so i cant do that
16:45 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
16:46 < johnpatcher> it seems odd to me that the link is established without problems
16:46 < johnpatcher> and all the network configurations are set
16:46 < johnpatcher> but it doesnt work ;)
16:46 < johnpatcher> can it have something to do with the mut?
16:46 < johnpatcher> mtu
16:47 < johnpatcher> im logging in over a mobile cell phone in order to test my connection
16:47 < johnpatcher> maybe it doesnt like to have such big mtus
16:49 < krzie> i doubt your cell supports tap :-p
16:50 < krzie> android doesnt, iphone doesnt...
16:50 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 245 seconds]
16:50 < krzie> oh shit im wrong, android *does* now?
16:50 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:50 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
16:51 -!- raidz_afk [~raidz@shiv.bluntshank.com] has joined #openvpn
16:51 -!- raidz_afk is now known as raidz
16:54 < johnpatcher> well its not the phone itself
16:54 < johnpatcher> im using usb tethering
16:55 -!- catsup [~d@75.119.194.231] has joined #openvpn
16:56 -!- raidz [~raidz@shiv.bluntshank.com] has quit [Changing host]
16:56 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:02 < johnpatcher> so you dont see any errors in my configuration?
17:02 < johnpatcher> or is there something that looks suspicious to you?
17:02 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
17:13 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
17:37 < krzie> nothing i notice, but like i said i dont use bridging or tap
17:38 < krzie> others here and on the forum do
17:56 < rkantos> Could someone make me a update zip to update the 3D gallery? :)
17:56 < rkantos> I deletet mine and can't replace it
17:56 < rkantos> deleted*
17:56 < rkantos> keeps FC:ing the one i put in my sgs
18:04 < krzie> rkantos, wrong channel?
18:06 -!- novaflash is now known as novaflash_away
18:06 < rkantos> krzie: no. do you think it is? :S
18:07 < johnpatcher> well, can someone explain me why the client keeps complaining about mismatches in the configuration, although they are identical in the configuraiton files?
18:08 < johnpatcher> keep getting these errors: http://pastebin.com/8gZN52iR
18:08 < johnpatcher> or warnings
18:08 < johnpatcher> although each of this is set in both configs equally
18:10 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
18:10 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Ping timeout: 260 seconds]
18:14 < krzie> rkantos, well i have no clue what update zip or 3d gallery you could possibly be talking about
18:14 < krzie> johnpatcher, ya thats normal with openwrt
18:16 < johnpatcher> so could it be something wrong with openwrt?
18:16 < johnpatcher> because im getting nuts here :(
18:18 < krzie> those errors should be ignored
18:18 <@vpnHelper> RSS Update - forum: How to block port 25 on OpenVPN ? <http://forums.openvpn.net/topic8969.html#p16404>
18:18 < rkantos> hmm definitely the wrong channel, sorry :P
18:18 < krzie> rkantos, no problem... sounded like android talk to me ;]
18:19 < rkantos> yeah :)
18:21 < johnpatcher> well i even see the traffic coming through using tcpdump
18:21 < johnpatcher> working for both directions
18:22 < johnpatcher> so there must be something wrong on the server :(
18:26 < krzie> johnpatcher, check that tap+ is allowed in the firewall
18:26 -!- illsci [~jsabo@pool-96-255-235-187.washdc.fios.verizon.net] has joined #openvpn
18:26 < illsci> hey what's up
18:26 < illsci> Can a host be a server and a client at the same time?
18:26 < krzie> with openwrt ild suggest using iptables -I instead of -A
18:26 < krzie> illsci, sure, with 2 openvpn configs
18:26 < illsci> ok cool
18:26 < illsci> I have a few boxes taht are clients of a few servers and I had to change the lport for that to work
18:26 < krzie> it could also be 10 servers AND 10 clients, whatever # of openvpn instances you run
18:27 < illsci> do you think I'll have to do that on a box that's a client and a server
18:27 < illsci> its going to be like a client to 3 servers and a server itself
18:27 < krzie> illsci, you were using static keys, i know if you use client/server it will work
18:27 < illsci> basically web -> api -> db1,db2,db3 
18:27 < illsci> yeah I had to change to client server
18:27 < illsci> I have that working... the static keysetup didnt work out as documented.... 
18:27 < krzie> client/server is better anyways
18:28 < krzie> !forwardsecurity
18:28 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
18:28 < illsci> I think in the future I'm going to try and do like 2 vpn concentrators
18:28 < illsci> and have like a vpn darknet
18:28 < illsci> and do dynamic routing over it
18:28 < illsci> but for now im just going to make it work with the client server chains
18:28 < krzie> when you get to that point you will want a routed tap setup
18:28 < krzie> because you cant handle the dynamic iroutes when you need to route foreign subnets through a client
18:28 < illsci> isn't tap layer 2?
18:29 < krzie> yes, and thats the only way you'll be able to run dynamic routing protocols (like rip) over openvpn clients
18:29 < krzie> not because it is layer2, but for this reason:
18:29 < krzie> !rip
18:29 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
18:29 < illsci> yeah im going to use ospf though
18:29 < illsci> definitely not rip
18:29 < illsci> not sure if that makes much of a difference
18:30 < krzie> go read anyways
18:30 < illsci> werd
18:30 < krzie> then you'll see it doesnt matter, same issue
18:30 < krzie> after that was written i was informed that the easier solution is to just use tap with the exact same config
18:30 < illsci> Can you do failover... like i was looking at some openvpn failover setups
18:30 < krzie> not bridging, nothing like that
18:30 < krzie> yes, --remote-random (or something like that) and round-robin dns, or you can have multiple --remote statements
18:31 < illsci> so im thinking 2 vpn concentrators that every host tunnels too and then enable client-to-client and then setup routing
18:32 < krzie> because tap is layer2, openvpn wont care about the foreign subnets not being recognized
18:34 < johnpatcher> krzie which firewall were you referring to ;)? the one on the server i guess?
18:34 < krzie> well either one really
18:34 < krzie> when i mentioned using iptables -I instead of -A i meant openwrt
18:35 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:35 < krzie> packets start as working, then stop (looks like it gets refused even)
18:36 < krzie> so firewall sounds like a reasonable suspect
18:37 < johnpatcher> unfortunately i dont have that much of a clue how to setup iptables :(
18:38 < johnpatcher> currently all packets are accepted in the input chain for br0 and tap0 on both machines
18:38 < krzie> nor do i really, but theres some info in the openvpn manual for ya :-p
18:38 < johnpatcher> yeah, ive tried that already
18:39 < krzie> you need a specific rule to allow them
18:39 < krzie> not just a default allow rule
18:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:39 < krzie> but one for the interface as well
18:39 < krzie> also in the forward chain
18:39 < krzie> input/output/forward
18:40 < johnpatcher> so i've accepted tap0 and br0 for in the input chain on both machines explicitly (iptables -I INPUT -i br0 -j ACCEPT)
18:40 < johnpatcher> and enabled the forwarding for the bridge
18:41 < johnpatcher> isnt there are way to enable and accept everything ;)
18:41 < johnpatcher> just to sort this out
18:42 < krzie> im not much of a linux guy, you may get a better answer to that in a linux chan
18:43 < EugeneKay> Change your default policy to ACCEPT
18:43 < krzie> EugeneKay, you still need to accept tap+ right?
18:43 < krzie> johnpatcher, you scored, EugeneKay is here!
18:43  * krzie runs and hides
18:43 < EugeneKay> I don't beieve so, but I also don't use tap, because tap has been empirically shown to cause cancer, AIDS, and rape your cat.
18:44 < krzie> he wants lan gaming over the vpn
18:44  * ecrist uses tap
18:44 < EugeneKay> You also don't have a cat
18:44 < krzie> ya but you already have aids and cancer
18:44 < krzie> lol
18:45 < EugeneKay> The solution to LAN gaming over the VPN is to stop playing games from 1999
18:45 < krzie> no quake3!?
18:45 < johnpatcher> arent we geeks who stick to old games we played when we were 10 or so ^.^ 
18:45 < EugeneKay> Q3 supports TCP/IP
18:46 < EugeneKay> Q2 was new when I was 10 >_>
18:46 < EugeneKay> Actually, it seems it was released on my 9th birthday
18:46 < EugeneKay> Go figure
18:46 < johnpatcher> nvm, maybe you can indeed help me ... ive got a bridge connection established, and can see arp packets flowing with tcpdump on both machines when trying to ping a host from the other side
18:47 < EugeneKay> Anyway..... iptables -L -t filter and iptables -L -t nat
18:47 < johnpatcher> but i dont get a response 
18:47 < johnpatcher> on the server?
18:47 < EugeneKay> On whatever box you're arguing with iptables on
18:47 < johnpatcher> kk
18:48 < krzie> one of his is openwrt
18:48 < krzie> remember how tripped out my openwrt firewall was?
18:48 < johnpatcher> the server actually
18:48 < EugeneKay> Ugh. I hate *wrt
18:49 < krzie> ya man
18:49 < EugeneKay> You don't need TAP to cause cancer when wrt is involved
18:49 < johnpatcher> is any of the alternatives better in this concern?
18:49 < johnpatcher> dd-wrt or so?
18:49 < johnpatcher> :P
18:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:49 < johnpatcher> so what would your recommendation be?
18:50 < EugeneKay> I use an i3-540 with 8GB of ram and 5x2TB HDs >_>
18:50 < johnpatcher> yeah, but i want to have a dedicated router
18:50 < krzie> i use openwrt, but i dont use tap
18:50 < EugeneKay> So do I
18:50 < EugeneKay> It lives in my basement along with my DSL modem
18:50 < krzie> johnpatcher, that in fact *is* his router ;]
18:51 < johnpatcher> :D
18:51 < EugeneKay> Anyway.... lesse your iptables
18:53 < johnpatcher> http://pastebin.com/C3Gtcaky
18:53 < johnpatcher> http://pastebin.com/vWYUdQqg
18:53 < johnpatcher> to be honest i dont have that much of an clue when it comes down to iptables and i nearly tried every rule i could find, so dont be bothered when it totally makes no sense 
18:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:54 < EugeneKay> Mmmkay. Your default policy on filter's forward chain is DROP.
18:55 < krzie> you should reboot if you have a bunch of bogus rules in there
18:55 < johnpatcher> that sounds bad
18:55 < EugeneKay> CHange that, (iptables -t filter -p FORWARD ACCEPT)
18:55 < johnpatcher> well i think my router crashed, at least the web interface has
18:55 < johnpatcher> so i have to reboot anyways
18:55 < johnpatcher> brb
18:55 < johnpatcher> hopefully
18:57 < krzie> my openwrt doesnt even have a web interface :-p
18:57 < johnpatcher> well, i used to do it without on kamikaze
19:00 < johnpatcher> well your command doenst seem to work
19:00 < johnpatcher> unknown protocol 'forward' specified
19:01 < johnpatcher> is there something wrong with the rule, or is my iptables totatlly out of order?
19:01 < EugeneKay> -P
19:01 < EugeneKay> sorry
19:01 < johnpatcher> np, as said i have no clue about iptables
19:01 < johnpatcher> so my fault
19:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
19:03 < johnpatcher> still can't ping
19:03 < johnpatcher> :(
19:04 < johnpatcher> as said the acp requests come through from the client to the server and the other way round
19:04 < EugeneKay> Hm.
19:04 < EugeneKay> So where are they going, then
19:05 < johnpatcher> well i would like to ask them
19:05 < johnpatcher> :D
19:09 < johnpatcher> http://pastebin.com/u41sdqNa
19:09 < johnpatcher> http://pastebin.com/CwsattPj
19:09 < johnpatcher> after the restart
19:09 < johnpatcher> maybe they say something different
19:15 < johnpatcher> so, anything else looking strage to you? or would it even be possible to accept everything on every interface for every chain ... just to sort it out
19:15 < EugeneKay> Looks right, if a bit un-restricted. WRT's funny rules always make me ergh, tho.
19:15 < EugeneKay> That's what changing to -P ACCEPT does
19:16 < johnpatcher> i dont know whether this are openwrt defaults tbh
19:17 < johnpatcher> because i screwed things up there for sure
19:17 < johnpatcher> so any idea what else could be wrong?
19:17 -!- Denial [Denial@drgi.co.uk] has quit []
19:17 < illsci> So I'm starting openvpn on this server and it's got 3 client connections and 1 server config
19:17 < illsci> and only the server config is coming up
19:18 < illsci> if I remove that the 3 client configs come up and show me the interfaces
19:18 < illsci> what might cause the addtion of the server.conf to mess with the client.confs...
19:18 -!- _julian [~quassel@hmbg-4d068106.pool.mediaWays.net] has joined #openvpn
19:21 < illsci> oh this might be something else..
19:21 -!- _julian_ [~quassel@hmbg-5f761d1d.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
19:23 < krzie> johnpatcher, just reboot to see defaults (im assuming you didnt permanently change them during testing)
19:23 < krzie> if you did, take this as a lesson learned
19:26 -!- johnpatcher496 [~johnpatch@188-195-160-21-dynip.superkabel.de] has joined #openvpn
19:27 < johnpatcher496> sry pc crashed, not my day ...
19:27 < johnpatcher496> online with irc2 go right now -.-
19:27 -!- johnpatcher [~johnpatch@82.113.99.41] has quit [Ping timeout: 248 seconds]
19:27 < krzie> [17:23]  <krzie> johnpatcher, just reboot to see defaults (im assuming you didnt permanently change them during testing)
19:27 < krzie> [17:23]  <krzie> if you did, take this as a lesson learned
19:28 < johnpatcher496> i did a reboot already
19:28 < johnpatcher496> and posted the pastebins, havent i?
19:28 < krzie> im responding to:
19:28 < krzie> [17:16]  <johnpatcher> i dont know whether this are openwrt defaults tbh
19:28 < krzie> [17:17]  <johnpatcher> because i screwed things up there for sure
19:29 < johnpatcher496> yeah, but i might have screwed up things in the web interface
19:29 < johnpatcher496> so this would be permanent :p
19:29 < krzie> ahh sucks
19:29 < johnpatcher496> going to flash it anyway
19:29 < krzie> i dont use the web interface (i dont even have it)
19:30 < johnpatcher496> too convenient ;)
19:30 < johnpatcher496> luci rocks
19:30 < krzie> im not a fan of luci or uci
19:30 < johnpatcher496> but openwrt seems to suck
19:31 < johnpatcher496> do you know of any kernel settings which could prevent any traffic flow within a bridge?
19:31 < krzie> not me
19:31 < krzie> !bridge
19:31 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
19:32 < johnpatcher496> !man
19:32 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
19:34 < johnpatcher496> cant find anything within the manual
19:34 -!- ravel_out [~ravel_out@175.136.82.14] has joined #openvpn
19:40 < johnpatcher496> so any other clues, or am i going to have to throw this box out of the windows :p
19:56 -!- vect0rx [vectorx@countercultured.net] has joined #openvpn
19:56 < vect0rx> !weclome
19:56 < vect0rx> !welcome
19:56 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:57 < vect0rx> !goal
19:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:57 < vect0rx> I would like to lurk and learn about openvpn trivia :)
20:00 < krzie> !factoids
20:00 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
20:02 < vect0rx> thanks!
20:04 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
20:16 -!- ravel_out [~ravel_out@175.136.82.14] has quit []
20:17 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:20 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  I love my HydraIRC -> http://www.hydrairc.com <-]
20:25 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
20:36 < krzie> np
20:37 < krzie> if you end up liking openvpn a lot you can get a user spoof for freenode too! ;]
20:46 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Would you like to know more?]
20:58 < vect0rx> sounds cool to me.. ive been an efnet'er almost solid since 94 but just havnt explored freenode enough :)
20:59 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:59 -!- mode/#openvpn [+v Axeman] by ChanServ
21:01 < vect0rx> tried to do a very fast android to openvpn setup this year before a security conference in las vegas... realized that I needed a rooted G2/DZ a bit too late :)
21:09 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:13 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
21:14 -!- illsci [~jsabo@pool-96-255-235-187.washdc.fios.verizon.net] has quit [Ping timeout: 248 seconds]
21:17 < krzee> ya i been on efnet since those days as well
21:17 < krzee> and it doesnt need to be a G2/DZ
21:17 < krzee> any rooted android will do
21:17 < krzee> ive personally run it on an aria/inspire/evo
21:17 < krzee> oh and the mytouch3g
21:18 -!- johnpatcher496 [~johnpatch@188-195-160-21-dynip.superkabel.de] has quit [Read error: Connection reset by peer]
21:19 < vect0rx> gotcha yeah io just so happened to have a t-mo g2 with me.. older g1 in a cabinet somewhere.    Had a vegantab firmware'd viewsonic g-tablet in tow also but I didnt get as far as to try with that device
21:20 < vect0rx> (it would have been reather interestesting because all tablet net use was tethetred throught a g2 as a wifi hotspot that weekend)
21:21 < vect0rx> Not really on phones currently though.  Right now I have two DD-WRT routers with openvpn installed and a few other platforms I might fool with to get my hands dirty
21:22 < krzee> oh btw if you use cyanogenmod7 on your android, it comes with openvpn
21:23 < krzee> then you grab openvpn-settings and you're done (or configure it manually like a normal unix linux box via adb like i do)
21:23 < krzee> cyanogenmod is the only rom i run, love it
21:24 < vect0rx> just checked the tablet running VEGAntab it has openvpn good to go also
21:24 < vect0rx> probably cyanogen-derived
21:25 < vect0rx> havnt messed with adb just yet.. downloaded the android SDK in probably 2008 but got distracted :)
21:25 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
21:27 < krzee> off work, pregame blunt has been smoked, time to go out
21:27 < krzee> bbl
21:28 -!- miguet [~miguet@121.1.54.50] has quit [Client Quit]
21:28 < vect0rx> word ttyl man
21:42 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:52 -!- ccesario [~ccesario@187.17.166.162] has quit [Ping timeout: 276 seconds]
21:54 -!- ccesario [~ccesario@187.17.166.162] has joined #openvpn
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 248 seconds]
22:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
22:20 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
22:32 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
22:32 -!- mode/#openvpn [+v Axeman] by ChanServ
22:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
22:38 -!- Titania [~titania@221.120.122.106] has joined #openvpn
22:39 -!- Titania [~titania@221.120.122.106] has quit [Read error: Connection reset by peer]
22:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
22:43 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
22:49 <@vpnHelper> RSS Update - forum: Connection reset every 15 -20s <http://forums.openvpn.net/topic8889-15.html#p16405>
22:50 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
23:01 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
23:05 -!- miguet [~miguet@121.1.54.50] has joined #openvpn
23:08 -!- miguet is now known as robotek`
23:09 -!- robotek` is now known as group
23:09 -!- group is now known as miguet
23:10 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
23:12 -!- miguet [~miguet@121.1.54.50] has quit [Quit: Lost terminal]
23:13 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
23:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
23:33 -!- Olipro_ [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
23:38 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 252 seconds]
23:39 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
23:44 -!- Olipro_ [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
23:44 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:44 -!- Olipro_ is now known as Guest77940
23:52 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
--- Day changed Mon Oct 10 2011
00:33 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
00:40 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
00:58 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:05 -!- fread2281 [~fread2281@70-56-211-77.albq.qwest.net] has joined #openvpn
01:10 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:16 -!- raidz is now known as raidz_afk
01:17 -!- novaflash_away is now known as novaflash
01:22 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
01:38 <@vpnHelper> RSS Update - forum: client side LAN,multiple user access howto <http://forums.openvpn.net/topic8978.html>
01:39 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
01:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
01:56 <@vpnHelper> RSS Update - forum: client side LAN,multiple user access howto <http://forums.openvpn.net/topic8979.html>
02:04 -!- _Cr4zi3 [killaz@184.95.44.187] has joined #openvpn
02:05 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
02:09 < Mowee> Morning
02:20 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
02:30 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
02:32 -!- kyrix [~ashley@213.47.159.139] has joined #openvpn
02:36 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-xprrgxsbnoscsytf] has quit [Read error: Connection reset by peer]
02:36 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-kktfkxfhuyejjenk] has joined #openvpn
02:38 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 240 seconds]
02:38 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16408>
02:39 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:39 -!- mode/#openvpn [+o mattock] by ChanServ
02:39 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
02:56 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
02:57 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
03:07 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
03:10 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
03:17 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
03:17 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:24 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16409>
03:25 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:27 -!- kyrix [~ashley@213.47.159.139] has quit [Quit: Ex-Chat]
03:27 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
03:28 -!- K1ng` [~k1ng@unaffiliated/k1ng] has joined #openvpn
03:29 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
03:48 <@vpnHelper> RSS Update - forum: pls help onw to edit the openvpn logo <http://forums.openvpn.net/topic8980.html>
03:50 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
03:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:54 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16411>
03:57 -!- albech [~albech@183.88.67.106] has joined #openvpn
04:00 <@vpnHelper> RSS Update - forum: Which router can support connecting to an OpenVPN server? <http://forums.openvpn.net/topic8975.html#p16412>
04:06 <@vpnHelper> RSS Update - forum: Fresh Install client connect warning message <http://forums.openvpn.net/topic8074.html#p16413>
04:16 -!- K1ng` [~k1ng@unaffiliated/k1ng] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
04:17 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:32 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
04:32 -!- adamguest [~adam@o--o.pl] has joined #openvpn
04:37 <@vpnHelper> RSS Update - forum: Different DNS-configuration for groups? <http://forums.openvpn.net/topic8981.html>
04:45 <@vpnHelper> RSS Update - forum: How to block port 25 on OpenVPN ? <http://forums.openvpn.net/topic8969.html#p16415>
04:51 <@vpnHelper> RSS Update - forum: disconnecting a user <http://forums.openvpn.net/topic8963.html#p16418> || Different DNS-configuration for groups? <http://forums.openvpn.net/topic8981.html#p16417> || Which router can support connecting to an OpenVPN server? <http://forums.openvpn.net/topic8975.html#p16416> || [Solved] Connection reset every 15 -20s <http://forums.openvpn.net/topic8982.html#p16405>
04:51 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Remote host closed the connection]
04:52 < adamguest> hi, I've got OpenVpn server and to 2 clients. I tunnel all traffic through the server from clients by 'push "redirect-gateway def1 bypass-dhcp"'. It works, but I want to tunnel all traffic only from one client. How to do this?
04:52 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
04:56 <@vpnHelper> RSS Update - forum: OpenVPN over proxy <http://forums.openvpn.net/topic8960.html#p16420> || Port Blocking <http://forums.openvpn.net/topic8961.html#p16419> || Connection reset every 15 -20s <http://forums.openvpn.net/topic8984-15.html#p16405>
04:58 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 248 seconds]
05:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
05:01 <@vpnHelper> RSS Update - forum: Group Restriction when authenticating via Ldap <http://forums.openvpn.net/topic8948.html#p16424> || New clients will not connect to AS 1.8.3 <http://forums.openvpn.net/topic8929.html#p16423> || Next OpenVPNAS release <http://forums.openvpn.net/topic8962.html#p16422>
05:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:07 <@vpnHelper> RSS Update - forum: Group Restriction when authenticating via Ldap <http://forums.openvpn.net/topic8948.html#p16425>
05:13 <@vpnHelper> RSS Update - forum: Group Restriction when authenticating via Ldap <http://forums.openvpn.net/topic8948.html#p16426>
05:19 <@vpnHelper> RSS Update - forum: two operating system pc . wrong route.exe usage <http://forums.openvpn.net/topic8956.html#p16427> || [Solved] Connection reset every 15-20s <http://forums.openvpn.net/topic8986-15.html#p16405>
05:29 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 252 seconds]
05:40 -!- Denial [Denial@drgi.co.uk] has quit []
05:43 <@vpnHelper> RSS Update - forum: two operating system pc . wrong route.exe usage <http://forums.openvpn.net/topic8956.html#p16428>
05:44 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
05:52 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
05:54 -!- mape2k [~mape2k@p5B24DB49.dip.t-dialin.net] has joined #openvpn
05:57 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
06:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
06:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:15 -!- mape2k [~mape2k@p5B24DB49.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
06:28 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
06:40 -!- ravel_out [ravel_out@175.136.82.14] has joined #openvpn
06:40 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
06:48 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:53 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
06:54 -!- Guest34076 [ionic@ionic.de] has joined #openvpn
07:01 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
07:06 -!- defswork [~andy@195.58.91.66] has joined #openvpn
07:14 -!- noisebleed [~quassel@194.117.24.15] has joined #openvpn
07:14 -!- noisebleed [~quassel@194.117.24.15] has quit [Changing host]
07:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
07:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
07:18 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:19 -!- mode/#openvpn [+v Axeman] by ChanServ
07:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
07:28 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
07:28 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:33 -!- ravel [ravel@175.136.82.14] has joined #openvpn
07:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
07:40 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:41 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Ping timeout: 248 seconds]
07:43 -!- ravel [ravel@175.136.82.14] has quit []
07:43 -!- ravel_out [ravel_out@175.136.82.14] has quit []
07:43 -!- luneff [~yury@84.51.192.74] has joined #openvpn
07:44 -!- ravel [ravel@175.136.82.14] has joined #openvpn
07:44 -!- dazol is now known as dazo
07:44 -!- dazo [dazo@nat/redhat/x-eudgjfcptlwatoux] has quit [Changing host]
07:44 -!- dazo [dazo@openvpn/community/developer/dazo] has joined #openvpn
07:45 -!- Guest77940 [~Olipro@uncyclopedia/pdpc.21for7.olipro] has left #openvpn []
07:46 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:55 <@vpnHelper> RSS Update - forum: Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html>
08:04 -!- _Cr4zi3 is now known as Cr4zi3
08:22 -!- adamguest [~adam@o--o.pl] has left #openvpn []
08:25 -!- ravel_out [ravel@175.136.82.14] has joined #openvpn
08:25 -!- ravel_out [ravel@175.136.82.14] has quit [Client Quit]
08:31 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 258 seconds]
08:31 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:49 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
09:05 -!- master_of_master [~master_of@p57B53BAE.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
09:07 -!- master_of_master [~master_of@p57B53856.dip.t-dialin.net] has joined #openvpn
09:27 -!- albech [~albech@183.88.67.106] has quit [Remote host closed the connection]
09:36 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:42 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 240 seconds]
09:49 -!- Denial [~Denial@drgi.co.uk] has quit []
10:19 -!- jvt5009 [~jvt50093@71.86.226.202] has joined #openvpn
10:20 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:20 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:20 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:21 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:21 < jvt5009> I made the mistake of using the same CN for a bunch of certs.  Do I have to revoke them and recreate them?
10:22 < ecrist> it should have given you warnings
10:22 < jvt5009> that would have been nice
10:23 < jvt5009> instead I've been troubleshooting why users get kicked off the vpn randomly
10:23 < jvt5009> now that I think about it though were using custom scripts to create so maybe it's ignored
10:24 < jvt5009> any ideas for a fix?
10:24 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:24 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:24 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:24 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:24 -!- ravel [ravel@175.136.82.14] has quit []
10:26 < oc80z> morning
10:26 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:27 < oc80z> switching proto udp to proto tcp-server (and the respected clients) yields 2x the throughput for scp/http over the tunnel. clients are around the globe... is it safe to say the server's peering company may be throttling udp?
10:36 < ecrist> it's a good guess
10:43 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
10:50 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Ping timeout: 248 seconds]
10:52 -!- j03 [4e81fb59@gateway/web/freenode/ip.78.129.251.89] has joined #openvpn
10:53 < j03> hi. i'm tunneling OpenVPN through SSH (by running ssh -L 1194:localhost:1194 user@hostname). It's working fine with OSX and Tunnelbrick, and with the OpenVPN GUI Client & Putty under windows.... but I cannot get it to work under Ubuntu 11.04 with network-manager and the mentioned SSH command.
10:54 < j03> Is there anything that springs to mind as to why it wont work? It says that it's connected, but the SSH session immediatley become un-responsive and web pages/internet traffic aren't coming through
10:54 < j03> *isn't
10:55 < jvt5009> is anything else listening on 1194 on the Ubuntu machine
10:55 < j03> nope
10:56 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
10:56 < jvt5009> i assume you checked with netstat
10:57 < j03> yeah -  and i think that SSH would shout at me if i told it to bind to a port that was already in use
10:57 < j03> i've tried different local ports, too
11:01 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
11:01 < oc80z> because its udp
11:01 < j03> nope - it's in tcp mode 
11:01 < oc80z> ah, sorry. it -is- working os-x
11:01 < j03> yeah
11:02 < j03> and windows :)
11:02 < oc80z> what's the network-manager doing?
11:03 < oc80z> you mean, nm-applet?
11:03 < j03> well i've tried it with the network manager, and also using the cli openvpn client
11:04 < jvt5009> what command are you using
11:04 < oc80z> the ssh is okay?
11:04 < j03> sudo openvpn configfile.ovpn
11:04 < ecrist> !ubuntu
11:04 <@vpnHelper> "ubuntu" is dont use network manager!
11:05 < ecrist> j03: your problem is network manager, not openvpn
11:05 < oc80z> it should be no ubuntu is dont use nm-applet, modem-manager is okay!
11:05 < j03> I've tried it without the network manager
11:05 < oc80z> hehe.
11:05 < ecrist> j03: and it works fine, right?
11:05 < j03> Nope
11:06 < j03> SSH locks up, and internet traffic doesnt "flow"
11:06 < ecrist> even with doing everything yourself on the CLI?
11:06 < ecrist> !tcp
11:06 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
11:06 < j03> ecrist: even with doing everything over the cli
11:07 < j03> I know using tcp isn't ideal, but unfortunatley i've got no real choice
11:07 < ecrist> does OpenVPN work by itself?
11:07 < ecrist> why are you tunneling openvpn inside ssh?
11:07 < j03> Because the firewall I am behing uses SPI and will not allow openvpn connections (no matter the port). 
11:10 < j03> It wont work over the command line, either.
11:10 -!- raidz_afk is now known as raidz
11:10 < j03> I wouldn't have a problem using the CLI, but I decided to TRY using network_manager just to see.
11:11 < ecrist> j03: your problem really isn't openvpn, it's your hokey multiple tunneling stuff
11:11 <@vpnHelper> RSS Update - forum: OpenVPN process stops ldap_parse assertion <http://forums.openvpn.net/topic8988.html>
11:11  * ecrist finds something else to do
11:12 < j03> ecrist: Why would it work under Windows and OSX, but not Ubuntu?
11:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 252 seconds]
11:13 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:14 < j03> oc80z: Any ideas? :(
11:14 < hyper_ch> hi ecrist
11:14 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
11:15 -!- j03 [4e81fb59@gateway/web/freenode/ip.78.129.251.89] has quit [Quit: Page closed]
11:15 < jvt5009> j03 you verified the ssh connection first?
11:15 < jvt5009> nm
11:15 < oc80z> sorr, 
11:18 < oc80z> yeah ah..
11:18 < oc80z> he never posted the ssh command and verified that.
11:18 < oc80z> if they using SPI, whatever... they might be blocking :22
11:20 <+novaflash> the parameter '--remote-random' will 'scramble' the list of servers in an openvpn config file. i'm curious, can this only be called on the commandline when calling the openvpn binary, or can this be placed in the openvpn config file itself as just 'remote-random'?
11:20 < oc80z> it can be placed in the config.
11:20 <+novaflash> thanks :)
11:20 < oc80z> additionally.
11:20 < oc80z> i believe even the key's can be placed on the command line.
11:20 -!- bauruine [~stefan@217.150.234.43] has joined #openvpn
11:20 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
11:21 <+novaflash> oc80z; oh so just about every key/value pair in the config file can be used in console if you prepend it with -- ?
11:21 < oc80z> say for embedded systems, the running system would not actually save the key to disk/flash
11:21 < oc80z> i think that is fair to say.
11:21 < gladiatr> command line args are all interchangeable with the conf files
11:21 <+novaflash> fantastic.
11:21 <+novaflash> thanks guys :)
11:22 <+novaflash> now who do i owe a blowjob for this fast and good answer?
11:22 < oc80z> hip hip
11:22 < jeev> ew
11:22 < oc80z> whats a blowjob?
11:23 <+novaflash> well the wind doesn't create itself, you know
11:23 < oc80z> sounds like a capitalist plot to destroy the eco-system, to me.
11:24 < oc80z> tea bagger!
11:24 <+novaflash> lol
11:34 < Essobi> rofl
11:36 < ecrist> !--
11:36 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
11:37 < oc80z> yeah.
11:37 < oc80z> cisco adopt openvpn yet?
11:37 < ecrist> also, keep in mind, anything passed on the command line is visible from ps output
11:38 < oc80z> what if it is is executed from a file on tmpfs?
11:38 < ecrist> well, then someone using ps would just read those files
11:38 < krzee> no, cisco uses ipsec (its protocol)
11:38 < ecrist> krzee: cisco has an ssl vpn implementation, that sucks, imho
11:39 < oc80z> but the files would be chmod.
11:39 < krzee> oh ya?  like juniper's similar vpn of suck?
11:39 < oc80z> yeah, cisco admins are fun to deal with too.
11:39 < ecrist> 11:21:32 < oc80z> say for embedded systems, the running system would not actually save the key to disk/flash
11:40 < ecrist> you're arguing with yourself.
11:40 < ecrist> :\
11:40 < oc80z> tmpfs is not disk, its ram.
11:40 < ecrist> krzee: yes.  cisco calls it EasyVPN or some shit
11:40 < krzee> oc80z, its ram being used as a disk
11:40 < ecrist> oc80z: no, tmpfs can be disk, too
11:40 < ecrist> just like swap can be a file on a disk
11:40 < ecrist> instead of it's own device
11:41 < oc80z> since when is ram, mtd?
11:41 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
11:41 < oc80z> or sda?
11:41 < oc80z> its not physical disk. its ram.
11:41 < ecrist> shh, troll
11:42 -!- Denial [~Denial@drgi.co.uk] has quit []
11:42 < oc80z> thats a good argument you have there. insulting.
11:42 < jvt5009> if multiple certs have the same CN how can I revoke them all.  I read a forum post that it'll only revoke the most recent.
11:42 < oc80z> too bad i'd slap the shit out of you
11:43 < krzee> oc80z, his address is on his domain, i invite you to film it so i can lol when you see how big he is and that he is well trained
11:44 < ecrist> oc80z: there's a chance stuff stored in tmpfs can get flushed to swap, which could be a disk device.  your argument that the data would never make it to disk is incorrect
11:45 < oc80z> its logical , its not persistent disk. its just abstracted... 
11:45 < ecrist> tmpfs is no more or less secure than a file stored on a disk.
11:46 < oc80z> ...thats false
11:46 < oc80z> since the certificates are on ram, not on a usb stick.
11:46 < ecrist> I'm sorry you feel that way.  it does highlight your ignorance, however.
11:46 <@vpnHelper> RSS Update - forum: Peer to Peer communication between clients <http://forums.openvpn.net/topic8989.html>
11:47  * oc80z slaps ecrist around a bit with a large trout
11:51 < ecrist> hi, hyper_ch 
11:51 -!- Irssi: #openvpn: Total of 143 nicks [3 ops, 0 halfops, 2 voices, 138 normal]
11:51 < ecrist> krzee: did you see my shiny new cloak?
11:57 < oc80z> when will cisco adopt openvpn.
11:58 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:58 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
12:00 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
12:02 < oc80z> im not sure whats worse. dealing with a cisco tech on openvpn, or reading cisco documentation on openvpn.
12:03 < oc80z> they would want to expire openvpn or drop support on certain devices after an arbitrary ammount of time 
12:07 < ecrist> this isn't #cisco...
12:09 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:10 < oc80z> okay, so how shiny is that cloak of yours
12:14 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
12:15  * EugeneKay yawns
12:16 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
12:16 -!- mode/#openvpn [+v Axeman] by ChanServ
12:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
12:36 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:38 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
12:38 -!- mode/#openvpn [+v Axeman] by ChanServ
12:39 -!- finetic [~finetic@213.155.20.16] has joined #openvpn
12:39 < finetic> I'm considering buying a VPS to setup a OpenVPN server on
12:39 < finetic> is this recommendable?
12:44 < EugeneKay> Having a VPS is a good thing for lots of reasons, VPN server is one of them.
12:45 < EugeneKay> I recommend using Linode, not at all because I have a referral code you can use http://s.eugenekay.com/linode
12:45 < finetic> hehe
12:45 < finetic> I'd like to have the server not in US/CA/EU countries
12:45 < EugeneKay> Definitely because they're fast, good uptime(except in Fremont. Don't buy in Fremont), don't bullshit you, 
12:45 < EugeneKay> Why not?
12:46 < ecrist> roobsd.net
12:46 < ecrist> rootbsd.net
12:47 < finetic> just don't want 
12:48 < krzee> LOL ecrist 
12:48 < finetic> but, to setup a VPN, it's not that I specifically need a dedicated server right? just a VPS is also ok
12:48 < krzee> nice cloak ;]
12:48 < EugeneKay> A VPS is just a small server
12:48 < ecrist> :)
12:48 < EugeneKay> With PROPER virtualization technology, anyway. OpenVZ/Virtuozzo is garbage.
12:49 < EugeneKay> So long as you have a public IP, it's no different than a bare-metal server.
12:49 < EugeneKay> At least, in all the ways that are important. 
12:54 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
13:06 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:06 -!- mode/#openvpn [+v Axeman] by ChanServ
13:09 -!- fread2281 [~fread2281@70-56-211-77.albq.qwest.net] has quit [Ping timeout: 248 seconds]
13:11 -!- fread2281 [~fread2281@70-56-140-68.albq.qwest.net] has joined #openvpn
13:14 < vect0rx> regarding VPS places like linode, just wanted to throw in there that amazon EC2 is more or less free for a micro instance for  1 year's worth of baasic resources.    I've had an EC2 instance since June that I havn't been charged anything for
13:15 < vect0rx> I don't know how EC2 pans out as a long term solution but for proof-of-concept, the price was right
13:16 -!- fread2281 [~fread2281@70-56-140-68.albq.qwest.net] has quit [Ping timeout: 258 seconds]
13:17 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
13:21 -!- fread2281 [~fread2281@70-56-134-129.albq.qwest.net] has joined #openvpn
13:27 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
13:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
13:34 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:38 -!- bauruine [~stefan@217.150.234.43] has quit [Ping timeout: 256 seconds]
13:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
13:42 <@vpnHelper> RSS Update - forum: Different DNS-configuration for groups? <http://forums.openvpn.net/topic8981.html#p16432>
13:54 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
13:55 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
14:03 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Ping timeout: 248 seconds]
14:05 -!- bigon [bigon@ubuntu/member/bigon] has quit [Ping timeout: 240 seconds]
14:05 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
14:05 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
14:05 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
14:07 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 256 seconds]
14:07 < SviMik> Hi all. is anybody here? :) I have a trouble...
14:10 < SviMik> (the description is a bit long, so... should I post it? or peoples are sleeping is this time?)
14:10 -!- fread2281 [~fread2281@70-56-134-129.albq.qwest.net] has quit [Ping timeout: 240 seconds]
14:11 -!- fread2281 [~fread2281@70-56-131-228.albq.qwest.net] has joined #openvpn
14:12 < EugeneKay> Post away. Remeber to put !configs and !logs in !pastebin rather than here.
14:13 < SviMik> a trouble with routing. my setup us (all interfaces are TAP) : two physical server (Debian). each have a vpn server for clients. they are also connected with another client-server vpn link to bridge these clients is a single network.
14:13 < SviMik> first server: 10.117.0.1 (clients: 10.117.0.2 - 10.117.31.255)
14:13 < SviMik> second server: 10.117.32.1 (clients: 10.117.32.2 - 10.117.63.255)
14:13 < SviMik> each server has a pair of TAP adapters connected with bridge br0. one TAP for client server, and another for link between server.
14:13 < SviMik> anything works well, but something goes weird after few days of usage. SOME clients connected to second server can't ping 10.117.0.1
14:13 < SviMik> clients who has a connection in the past can ping. but clients who has connected first time after few days of server restarting can't.
14:13 < SviMik> looks like some routing table got full, but I have no idea what to check
14:13 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
14:16 < SviMik> if I reboot the second server, then anything works... but again, for few days only
14:18 <@vpnHelper> RSS Update - forum: Pushing client DNS options... <http://forums.openvpn.net/topic8990.html>
14:19 < SviMik> I suppose you don't need my configs, because they are ordinary, and (I hope) there may not be mistakes in my situation, because anything works in some sense
14:20 < SviMik> link between servers is ok, because some client on the second server still can ping the first server...
14:21 < SviMik> I dont't use any per-client settings, so it looks like a bug... but I can't locate where
14:22 < SviMik> in openvpn or in OS?
14:24 <@vpnHelper> RSS Update - forum: How to block port 25 on OpenVPN ? <http://forums.openvpn.net/topic8969.html#p16434>
14:25 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:32 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
14:37 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
14:37 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:37 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 240 seconds]
14:40 < SviMik> it looks impossible, but ARP answers by second server are not arriving to first server for some clients. even if they have same IP (not simultaneously connected of course!)
14:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
14:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:52 < SviMik> I just restarted openvpn client on second server (for link between server) and now everything works again
15:04 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
15:08 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
15:12 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
15:15 -!- ccesario [~ccesario@187.17.166.162] has quit [Ping timeout: 240 seconds]
15:24 -!- dazo is now known as dazo_afk
15:28 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
15:36 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
15:38 -!- novaflash is now known as nothereno
15:39 -!- nothereno is now known as novaflash
15:41 -!- jvt5009 [~jvt50093@71.86.226.202] has quit [Quit: Leaving]
15:45 -!- chokesmaster [~chokesmas@69.157.245.233] has joined #openvpn
15:49 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
15:53 <@vpnHelper> RSS Update - forum: Different DNS-configuration for groups? <http://forums.openvpn.net/topic8981.html#p16435>
15:54 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
15:59 <@vpnHelper> RSS Update - forum: Group Restriction when authenticating via Ldap <http://forums.openvpn.net/topic8948.html#p16436>
15:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:59 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Ping timeout: 255 seconds]
16:05 <@vpnHelper> RSS Update - forum: client side LAN,multiple user access howto <http://forums.openvpn.net/topic8979.html#p16437>
16:19 -!- fread2281 [~fread2281@70-56-131-228.albq.qwest.net] has quit [Ping timeout: 260 seconds]
16:21 -!- fread2281 [~fread2281@70-56-210-21.albq.qwest.net] has joined #openvpn
16:25 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:26 -!- fread228_ [~fread2281@70-56-135-54.albq.qwest.net] has joined #openvpn
16:26 -!- fread2281 [~fread2281@70-56-210-21.albq.qwest.net] has quit [Ping timeout: 252 seconds]
16:38 -!- fread228_ [~fread2281@70-56-135-54.albq.qwest.net] has quit [Ping timeout: 244 seconds]
16:42 -!- fread2281 [~fread2281@70-56-209-35.albq.qwest.net] has joined #openvpn
16:43 -!- fread228_ [~fread2281@70-56-208-49.albq.qwest.net] has joined #openvpn
16:47 -!- fread2281 [~fread2281@70-56-209-35.albq.qwest.net] has quit [Ping timeout: 258 seconds]
16:47 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 244 seconds]
16:49 -!- fread228_ [~fread2281@70-56-208-49.albq.qwest.net] has quit [Ping timeout: 260 seconds]
16:49 -!- fread2281 [~fread2281@70-56-128-179.albq.qwest.net] has joined #openvpn
16:53 -!- fread228_ [~fread2281@70-56-132-117.albq.qwest.net] has joined #openvpn
16:53 <@vpnHelper> RSS Update - forum: Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html>
16:54 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:54 -!- fread2281 [~fread2281@70-56-128-179.albq.qwest.net] has quit [Ping timeout: 245 seconds]
16:56 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
16:57 -!- fread228_ [~fread2281@70-56-132-117.albq.qwest.net] has quit [Ping timeout: 258 seconds]
17:00 -!- fread228_ [~fread2281@70-56-211-163.albq.qwest.net] has joined #openvpn
17:03 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 245 seconds]
17:04 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
17:06 -!- fread228_ [~fread2281@70-56-211-163.albq.qwest.net] has quit [Ping timeout: 258 seconds]
17:08 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
17:09 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
17:09 -!- fread2281 [~fread2281@70-56-210-130.albq.qwest.net] has joined #openvpn
17:13 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
17:13 -!- fread2281 [~fread2281@70-56-210-130.albq.qwest.net] has quit [Ping timeout: 255 seconds]
17:16 -!- fread2281 [~fread2281@70-56-132-36.albq.qwest.net] has joined #openvpn
17:20 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
17:20 -!- fread2281 [~fread2281@70-56-132-36.albq.qwest.net] has quit [Ping timeout: 256 seconds]
17:23 -!- fread2281 [~fread2281@70-56-133-192.albq.qwest.net] has joined #openvpn
17:27 -!- fread228_ [~fread2281@70.56.130.148] has joined #openvpn
17:29 <@vpnHelper> RSS Update - forum: Peer to Peer communication between clients <http://forums.openvpn.net/topic8989.html#p16439>
17:29 -!- fread2281 [~fread2281@70-56-133-192.albq.qwest.net] has quit [Ping timeout: 255 seconds]
17:30 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:30 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:30 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:30 -!- mode/#openvpn [+v Axeman] by ChanServ
17:31 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
17:35 <@vpnHelper> RSS Update - forum: OpenVPN process stops ldap_parse assertion <http://forums.openvpn.net/topic8988.html#p16441> || Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16440>
17:37 -!- ravel [ravel@175.136.82.14] has joined #openvpn
17:38 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
17:41 <@vpnHelper> RSS Update - forum: Peer to Peer communication between clients <http://forums.openvpn.net/topic8989.html#p16445> || Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16444> || Pushing client DNS options... <http://forums.openvpn.net/topic8990.html#p16443>
17:46 -!- johnpatcher [~johnpatch@188-195-142-79-dynip.superkabel.de] has joined #openvpn
17:53 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
17:53 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
17:53 <@vpnHelper> RSS Update - forum: Peer to Peer communication between clients <http://forums.openvpn.net/topic8989.html#p16446>
18:05 -!- TopJimmy [~Miranda@mail.snork.ca] has joined #openvpn
18:11 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:11 <@vpnHelper> RSS Update - forum: Peer to Peer communication between clients <http://forums.openvpn.net/topic8989.html#p16447>
18:17 -!- ravel_out [ravel@175.136.82.14] has joined #openvpn
18:17 -!- ravel_out [ravel@175.136.82.14] has quit [Client Quit]
18:17 <@vpnHelper> RSS Update - forum: Peer to Peer communication between clients <http://forums.openvpn.net/topic8989.html#p16449>
18:22 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
18:22 <@vpnHelper> RSS Update - forum: How to block port 25 on OpenVPN ? <http://forums.openvpn.net/topic8969.html#p16450>
18:23 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has joined #openvpn
18:23 -!- raidz_afk is now known as raidz
18:23 -!- raidz [~raidz@stab-you-with-a.bluntshank.com] has quit [Changing host]
18:23 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
18:24 -!- raidz [~raidz@openvpn/corp/admin/andrew] has left #openvpn []
18:24 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
18:24 -!- mode/#openvpn [+o raidz] by ChanServ
18:24 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
18:27 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
18:28 -!- Denial [Denial@drgi.co.uk] has quit []
18:31 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
18:39 <@vpnHelper> RSS Update - forum: Connections to other services/port of the same VPN server <http://forums.openvpn.net/topic8992.html>
18:39 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
18:43 -!- johnpatcher [~johnpatch@188-195-142-79-dynip.superkabel.de] has quit [Ping timeout: 240 seconds]
18:46 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
18:54 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
18:58 -!- fread2281 [~fread2281@70-56-209-248.albq.qwest.net] has joined #openvpn
19:00 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
19:01 -!- fread228_ [~fread2281@70.56.130.148] has quit [Ping timeout: 260 seconds]
19:05 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
19:06 -!- fread228_ [~fread2281@70-56-209-225.albq.qwest.net] has joined #openvpn
19:07 -!- fread2281 [~fread2281@70-56-209-248.albq.qwest.net] has quit [Ping timeout: 255 seconds]
19:09 -!- raidz is now known as raidz_afk
19:17 -!- _julian_ [~quassel@hmbg-4d06e263.pool.mediaWays.net] has joined #openvpn
19:19 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
19:20 -!- _julian [~quassel@hmbg-4d068106.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
19:21 -!- defswork [~andy@195.58.91.66] has quit [Ping timeout: 260 seconds]
19:27 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
19:34 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
19:35 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
19:51 -!- raidz_afk is now known as raidz
19:51 -!- raidz is now known as raidz_afk
19:52 -!- raidz_afk is now known as raidz
19:56 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
20:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:12 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 252 seconds]
20:22 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
20:22 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
20:33 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
20:56 -!- gentoofan [~richard@unaffiliated/gentoofan] has joined #openvpn
20:56 < gentoofan> My OpenVPN performance is slow. I ran "openssl speed aes-256-cbc" on my Sandy Bridge laptop and on a Core 2 Quad desktop. The laptop does about 50Mbps while the desktop does about 140Mbps, which seems to indicate a problem. Does anyone know how to fix this?
20:58 < gentoofan> By slow, I mean that I am limited to about 50Mbps download speeds. I should be able to do double of that.
20:58 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:58 -!- mode/#openvpn [+v Axeman] by ChanServ
20:59 < gentoofan> Axeman: I don't suppose you know how to make OpenVPN faster on a Sandy Bridge system. I have a Core 2 Quad running circles around it.
20:59 <+Axeman> lol why would you think i would know ?
21:00 < gentoofan> You are voiced. It was worth a try.
21:00 <+Axeman> ha. 
21:01 <+Axeman> that's cos i idle over in the access server channel. 
21:01 <+Axeman> i am useless
21:01 < gentoofan> Actually, let me repost what I said earlier...
21:01 < gentoofan> My OpenVPN performance is slow. I ran "openssl speed aes-256-cbc" on my Sandy Bridge laptop and on a Core 2 Quad desktop. The laptop does about 50Mbps while the desktop does about 140Mbps, which seems to indicate a problem. Does anyone know how to fix this?
21:02 < gentoofan> The OpenVPN performance correlates well with this benchmark, most likely because it uses OpenSSL to do encryption.
21:02 <+Axeman> and the answer is no (from me, as i i wouldn't know).
21:04 <+Axeman> though given what you've said - and nothing else i know, i'd check 1. laptop has same amount of ram; 2. both HDs are of comprable specs (speed, etc); 3. make sure laptop isn't on some "balanced" type power plan. 
21:04 <+Axeman> but that's just general - nothing to do with openvpn or open ssl. 
21:05 < gentoofan> Axeman: They both have 8GB of RAM. The hard drives don't matter. I am not using them in these tests.
21:06 <+Axeman> well - sure the OS runs off the hd, and i'm assuming page files, etc are also on an HD... 
21:06 < gentoofan> My laptop compiles Libre Office faster than anything else I own. I doubt that any sort of power management is causing this slowdown. I wish it were that though. I could fix that.
21:06 < gentoofan> Axeman: It is a SSD that does 350MBps
21:06 <+Axeman> both ? 
21:06 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:06 < gentoofan> ?
21:07 <+Axeman> laptop and desktop ? 
21:08 <+Axeman> i would say it has to do with 1 of the 3 thinks i mentioned. if the software is the same, and the platform is different, what else would be different?
21:08 < gentoofan> The desktop is only like 250Mbps.
21:08 < gentoofan> s/Mbps/MBps/
21:09 < gentoofan> Axeman: Anyway, openssl is a pure CPU benchmark. It is not affected by disk performance. I have run it on systems that use hard drives and those systems run circles around mine.
21:09 <+Axeman> then - that's all  i know. i'd like you to scroll backto the point where i said i'm useless. 
21:12 < gentoofan> Thanks anyway.
21:23 < vect0rx> this question might sounds silly I hope I wasn't supposed to look elsewhere too much before asking.
21:24 < vect0rx> But I wanted to know the best practices for maintaining private keys
21:24 < gentoofan> vect0rx: You should ask before you say it is silly.
21:24 < vect0rx> i.e hardened against reading by unwanted parties
21:24 < gentoofan> vect0rx: chmod 0400 keyfile
21:25 < gentoofan> vect0rx: chmod 500 directory_of_keyfile
21:26 < vect0rx> What about mitigating physical attacks or a remote attack where somone is trying to grab key info out of memory
21:29 -!- TopJimmy [~Miranda@mail.snork.ca] has left #openvpn ["Shazoo."]
21:30 -!- fread228_ [~fread2281@70-56-209-225.albq.qwest.net] has quit [Ping timeout: 252 seconds]
21:32 -!- Guest34076 [ionic@ionic.de] has quit [Excess Flood]
21:33 -!- fread2281 [~fread2281@70-56-128-160.albq.qwest.net] has joined #openvpn
21:35 <+Axeman> you need to protect the physical.
21:35 -!- Ionic [ionic@ionic.de] has joined #openvpn
21:35 <+Axeman> physical access = all rules out the window
21:37 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
21:41 < gentoofan> That too.
21:46 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Ping timeout: 248 seconds]
22:07 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:19 -!- tjz_ [~pc@bb219-75-113-137.singnet.com.sg] has quit [Ping timeout: 255 seconds]
22:19 -!- fread2281 [~fread2281@70-56-128-160.albq.qwest.net] has quit [Remote host closed the connection]
22:24 -!- tjz [~pc@bb121-6-238-218.singnet.com.sg] has joined #openvpn
22:24 -!- tjz [~pc@bb121-6-238-218.singnet.com.sg] has quit [Changing host]
22:24 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
22:31 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
22:36 -!- Hydrant [~aj@unaffiliated/hydrant] has joined #openvpn
22:39 -!- gentoofan [~richard@unaffiliated/gentoofan] has quit [Ping timeout: 248 seconds]
22:42 -!- gentoofan [~richard@pool-173-52-111-222.nycmny.fios.verizon.net] has joined #openvpn
22:46 <@vpnHelper> RSS Update - forum: Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16452>
22:52 <@vpnHelper> RSS Update - forum: Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16453>
22:55 -!- twister004 [~chatzilla@59.90.104.109] has joined #openvpn
23:01 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has quit [Quit: AAAGH!  IT BURNS!]
23:11 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
23:16 <@vpnHelper> RSS Update - forum: Problems authenticating openvpn users via openldap <http://forums.openvpn.net/topic8993.html>
23:22 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:42 -!- ecrist-phone [~bitchez@2001:470:5:1d2:9221:55ff:fee4:ee90] has joined #openvpn
23:45 -!- ecrist-phone [~bitchez@2001:470:5:1d2:9221:55ff:fee4:ee90] has quit [Client Quit]
23:50 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
--- Day changed Tue Oct 11 2011
00:03 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
00:09 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
00:11 -!- twister004 [~chatzilla@59.90.104.109] has quit [Ping timeout: 260 seconds]
00:13 -!- Netsplit *.net <-> *.split quits: tty234_, defswork, mete, SJr, yell0
00:13 <@vpnHelper> RSS Update - forum: How to block port 25 on OpenVPN ? <http://forums.openvpn.net/topic8969.html#p16455>
00:13 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
00:14 -!- Netsplit over, joins: defswork, SJr, tty234_, mete, yell0
00:14 -!- tty234_ [telex@gateway/shell/anapnea.net/x-ontadhvjillzezdr] has quit [Max SendQ exceeded]
00:15 -!- tty234 [telex@gateway/shell/anapnea.net/x-imgjbfbbqpqiocjs] has joined #openvpn
00:17 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
00:18 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
00:20 <@vpnHelper> RSS Update - forum: Problems authenticating openvpn users via openldap <http://forums.openvpn.net/topic8993.html#p16457> || Connections to other services/port of the same VPN server <http://forums.openvpn.net/topic8992.html#p16456>
00:20 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
00:26 <@vpnHelper> RSS Update - forum: Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16458>
00:37 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:37 <@vpnHelper> RSS Update - forum: How to block port 25 on OpenVPN ? <http://forums.openvpn.net/topic8969.html#p16459>
00:50 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
00:50 <@vpnHelper> RSS Update - forum: testing <http://forums.openvpn.net/topic8995.html>
00:54 < EugeneKay> vect0rx - I practic something I like to call "shotgun security" of all of my tech gear.
00:54 < EugeneKay> If you leech my WiFi, you will be chased with a 12 gauge.
00:57 < EugeneKay> As for maintaining private keys on remote servers, you have to decide whether to store them encrypted(requiring you to login to decrypt them and thus start the daemon), or not.
00:58 < EugeneKay> Deal only with reputable companies and providers, and it should not be an issue. 
00:58 < EugeneKay> Financial sector operations will necessarily be more secure, but you shouldn't need me to tell you that if you were in such a position
01:10 -!- gentoofa1 [~richard@vl174.cs.sunysb.edu] has joined #openvpn
01:13 -!- gentoofan [~richard@pool-173-52-111-222.nycmny.fios.verizon.net] has quit [Ping timeout: 276 seconds]
01:20 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
01:22 -!- earl_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
01:23 < earl_> is the number of users capacity is per server or per IP address?
01:26 < krzee> what number of users capacity?
01:26 < krzee> like the max users setting in the config?
01:27 < krzee> or the bottleneck of how many users will work before openvpn shits on itself?
01:27 < earl_> bottleneck of how many users will work before openvpn shits on itself
01:28 < krzee> per cpu core
01:28 < krzee> openvpn is monolithic, single threaded
01:28 < krzee> it will only operate on a single core
01:29 < earl_> what is I have 4 cpu cores?
01:29 < krzee> meaning if you have a quadcore you could run it 3 times and still have a cpu for openssl + other stuff
01:29 -!- gentoofa1 [~richard@vl174.cs.sunysb.edu] has quit [Ping timeout: 258 seconds]
01:30 < earl_> how many users per cpu core in that case?
01:30 < krzee> dunno honestly
01:30 < krzee> ive heard 200 - 250
01:30 < krzee> but that depends on a few things
01:31 < earl_> few things?
01:31 < krzee> like the exact hardware, also if you have crypto hardware, etc
01:31 -!- gentoofan [~richard@130.245.246.89] has joined #openvpn
01:31 < krzee> you could have a quadcore 2ghz or 3ghz, they would be different...
01:31 < krzee> and dont bother telling me your exact hw, i wont know
01:32 < krzee> ;]
01:32 < EugeneKay> !gbit
01:32 < earl_> cant the maker of openvpn provide us the information on this one. I am just guessing the make would know perhaps.
01:32 < EugeneKay> !gbe
01:32 < EugeneKay> !gb
01:32 < EugeneKay> !gigabit
01:32 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
01:32 < EugeneKay> I hate this fucking bot sometimes.
01:33 < earl_> or do we have update for openvpn program
01:33 < EugeneKay> Generally speaking, you run out of CPU for the crypto stuff before OpenVPN itself has broken a sweat.
01:34 < krzee> EugeneKay, !factoids or !factoid search gig would have helped
01:34 < krzee> EugeneKay, you sure bout that...?
01:34 < EugeneKay> I should just bookmark the factoids
01:35 < krzee> openssl would happily run instances on his 3 cpu cores
01:35 < krzee> he'ld have openvpn shit itself before openssl took his resources
01:36 < EugeneKay> Sorry, not crypto. Encapsulation.
01:36 < EugeneKay> It's 1:30AM, blah :-p
01:37 < EugeneKay> The general case answer to "how many clients can openvpn support on <x> hardware" is "how much bandwidth do you have?"
01:38 < earl_> does openssl takes more resources than openvpn? 
01:39 < EugeneKay> Depends upon a lot of factors, chiefly packet size.
01:39 < earl_> can we lower the packet size so that that factor will be less
01:40 < krzee> EugeneKay, bandwidth!?!?
01:40 < krzee> dude, openvpn does not handle a bunch of clients very well
01:40 < EugeneKay> The best you can do is run some benchmarks of your proposed setup in a lab environment and see what happens.
01:40 < EugeneKay> This is no different than the question, "How many requests per second can Apache serve?" or "How many DB transactions will a SSD get me?"
01:41 < krzee> somewhere between 200-250 its known to shit itself and take up 100% cpu on the core it runs on
01:41 < krzee> but yes, you are 100% right on that one
01:41 < krzee> kinda impossible to answer that question
01:41 < EugeneKay> krzee - you can run multiple instances without much/any problem. Changing from a 100mbit to a Gbit pipe is quite an issue
01:41 < krzee> cant run multiple instances on a single core machine ;]
01:42 < EugeneKay> Apache doesn't serve 1000 clients from one process, it uses a buncha workers. Same thing with openvpn
01:42 < krzee> well you can, but it wont help
01:42 < krzee> yes, except openvpn does not have workers
01:42 < krzee> it is monolithic
01:42 < krzee> and single threaded
01:42 < krzee> which is the cause of the fact it shits itself
01:42 < krzee> this was discussed on the meeting on the 3.0 roadmap
01:42 < EugeneKay> Is the CPU % linear? 
01:43 < EugeneKay> With clients connected
01:43 < krzee> good question, i dont know
01:43 < EugeneKay> If it's worse-than-linear, then multiple instances should help on a single core
01:43 < EugeneKay> The kernel gets to handle it, rather than a single openvpn thread
01:44 < krzee> also true, hadnt thought of that
01:44 < krzee> but dunno if its linear
01:44 < EugeneKay> I suspect that it's closer to logarithmic
01:44 < EugeneKay> But, again, only way to know is to run the benchmarks
01:45 -!- gentoofan [~richard@130.245.246.89] has quit [Ping timeout: 260 seconds]
01:45 < earl_> how to run benchmark ?
01:45 < krzee> if you need to ask, you probably wont be doing it
01:46 < earl_> I will do if I will know how to 
01:46 < krzee> setup a lab and add clients until it breaks while keeping notes
01:46 < earl_> what do you mean lab?
01:46 < krzee> once again, if you need to ask...
01:47 < krzee> oh or is it a language thing?
01:47 < earl_> sorry, english is not my first language please pardon me.
01:47 < krzee> sorry my fault
01:47 < earl_> its ok
01:47 < EugeneKay> Test setup
01:47 < krzee> lab, like place you test stuff
01:48 < earl_> so I need many computer unit for it for testing purposes?
01:49 < krzee> not sure, i know you can run many client instances from a single machine without much problem... i dont know *how many* tho
01:49 < EugeneKay> Amazon EC2 is a great way to spin up a coupla hundred instances for an hour or two to test.
01:49 < earl_> ah maybe I will just wait for the new upcoming openvpn maybe it will handle multiple threading something like that? right?
01:49 < krzee> ooo nice EugeneKay 
01:49 < krzee> earl_, that would be a LONG wait, it is just an idea right now
01:50 < krzee> https://community.openvpn.net/openvpn/wiki/RoadMap
01:50 <@vpnHelper> Title: RoadMap – OpenVPN Community (at community.openvpn.net)
01:50 < earl_> may I know when is the upcoming release of it?
01:50 < krzee> we havnt even talked about it since may 2010
01:50 < earl_> like tentative date?
01:50 < earl_> ow I see
01:50 < krzee> there is no date for that
01:50 < krzee> like i said, it is just an idea
01:50 < krzee> they are just working on openvpn2
01:50 < EugeneKay> $2 buys you a hundred Micro instances of EC2 for an hour. Plenty of firepower to loadtest a VPN server.
01:50 < krzee> openvpn3 will be what you were saying
01:51 < krzee> ^
01:51 < earl_> what is included on the upcoming openvpn version?
01:51 < earl_> they are just working on openvpn2 <-- this one
01:51 < krzee> i think the next release will have ipv6 payload support
01:52 < krzee> (which currently only exists in the dev branch, and is not perfect yet)
01:52 < EugeneKay> IPv6 is targeted for 2.3 or 2.4?
01:52 < earl_> ah I see. may I ask why the new version target is ipv6?
01:52 < krzee> 2.3 i believe, yes
01:52 < krzee> earl_, huh?
01:53 < EugeneKay> Because IPv6 is the future
01:53 < krzee> because cron2 is cool enough to write the code =]
01:53 < krzee> if you are a coder and you want to work on making it multi-threaded, im sure you are welcome to go for it
01:54 < krzee> but until a programmer does it, it wont be done ;]
01:54 < earl_> what language is openvpn anyway?
01:54 < krzee> C
01:54 < earl_> just c and not c++?
01:54 < krzee> dunno
01:54 < krzee> feel free to check
01:54 < krzee> !download
01:55 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
01:55 < earl_> alright. thanks for accomodating me here
01:55 < EugeneKay> !factoid search source
01:55 < EugeneKay> !factoids search source
01:55 <@vpnHelper> No keys matched that query.
01:55 < krzee> EugeneKay, the source is on the download page ;]
01:55 < krzee> earl_, you're welcome
01:56 < EugeneKay> Just wondering if there was a factoid for it :-p
01:56 -!- earl_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit []
02:07 < Mowee> Morning
02:07 < krzee> moin
02:07 -!- dazo_afk is now known as dazo
02:10 <@vpnHelper> RSS Update - forum: Ad Hoc wireless bridged to LAN not working with OpenVPN <http://forums.openvpn.net/topic8996.html>
02:15 -!- bauruine_ [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
02:25 -!- Bastian82 [~Bastian@77-253-151-85.adsl.inetia.pl] has joined #openvpn
02:26 -!- EugeneKay is now known as EugeneSleep
02:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
02:34 <@vpnHelper> RSS Update - forum: A Closer View At Software Testing <http://forums.openvpn.net/topic8997.html>
02:42 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:50 -!- kanyl [~kanyl@84.23.155.169] has quit [Ping timeout: 240 seconds]
02:55 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
02:58 <@vpnHelper> RSS Update - forum: TCP/UDP: Socket bind failed on local address already in use <http://forums.openvpn.net/topic8933.html#p16249>
02:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:31 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Ping timeout: 240 seconds]
03:32 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
03:34 <@vpnHelper> RSS Update - forum: Connections to other services/port of the same VPN server <http://forums.openvpn.net/topic8992.html#p16464>
03:40 <@vpnHelper> RSS Update - forum: Connections to other services/port of the same VPN server <http://forums.openvpn.net/topic8992.html#p16465>
03:41 -!- LuckyY_ is now known as LuckyY
04:05 <@vpnHelper> RSS Update - forum: OpenVPN+Debian Squeeze without multiple access [SOLVED] <http://forums.openvpn.net/topic8968.html#p16363>
04:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
04:23 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:25 -!- luneff [~yury@31.23.79.144] has joined #openvpn
04:36 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
04:51 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:51 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:51 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:51 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:53 -!- luneff [~yury@31.23.79.144] has quit [Quit: Leaving]
04:54 -!- luneff [~yury@31.23.79.144] has joined #openvpn
04:59 <@vpnHelper> RSS Update - forum: Group Restriction when authenticating via Ldap <http://forums.openvpn.net/topic8948.html#p16466>
05:04 <@vpnHelper> RSS Update - forum: New user question <http://forums.openvpn.net/topic7422.html#p16467>
05:06 -!- ravel [ravel@175.136.82.14] has quit []
05:06 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
05:18 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
05:27 <@vpnHelper> RSS Update - forum: Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16468>
05:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:55 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
06:02 -!- dropje_ is now known as dropje
06:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
06:09 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:10 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
06:13 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
06:13 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
06:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
06:15 -!- _julian [~quassel@hmbg-5f7621ae.pool.mediaWays.net] has joined #openvpn
06:16 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
06:17 -!- _julian_ [~quassel@hmbg-4d06e263.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
06:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
06:35 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
06:35 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
06:35 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
06:44 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
06:47 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
06:49 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:49 -!- _julian [~quassel@hmbg-5f7621ae.pool.mediaWays.net] has quit [Read error: Operation timed out]
06:49 -!- ccesario [~ccesario@187.17.166.162] has joined #openvpn
06:49 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 255 seconds]
06:51 -!- _julian [~quassel@hmbg-5f767fe6.pool.mediaWays.net] has joined #openvpn
06:51 <@vpnHelper> RSS Update - forum: Connections to other services/port of the same VPN server <http://forums.openvpn.net/topic8992.html#p16469>
07:01 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
07:08 -!- sjuxax [~jeff@unaffiliated/sjuxax] has joined #openvpn
07:09 < sjuxax> Am I allowed to use server-bridge and secret together if I --force or something?
07:09 < sjuxax> My client is not going to want to install a specific certificate on each machine.
07:09 < sjuxax> I guess I could give them all the same certificate
07:09 < sjuxax> Would OpenVPN refuse to accept multiple concurrent connections from the same cert?
07:10 -!- cheche [cheche@46.25.80.67] has quit [Ping timeout: 248 seconds]
07:11 < ecrist> be default, yes, sjuxax 
07:11 < ecrist> afaik, no, you cannot use --secret for multiple clients. only for a single point-to-point link
07:11 < ecrist> !duplicate-dn
07:11 < sjuxax> ecrist: by default it will refuse multiple connections?
07:11 < ecrist> !duplicate-cn
07:11 < ecrist> yes
07:12 < sjuxax> ok
07:12 < sjuxax> ;duplicate-cn
07:12 < sjuxax> so, uncommenting that will allow multiple certs with same common name, I guess
07:12 < ecrist> well, rather, if a CN, say foobeans, is connected, and someone else connects with the same certificate, the first one is disconnected.
07:12 < ecrist> you could always try the man page. ;)
07:13 -!- cheche [cheche@46.25.80.67] has joined #openvpn
07:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
07:15 < sjuxax> thanks ecrist :)
07:15 < ecrist> np
07:17 -!- _julian [~quassel@hmbg-5f767fe6.pool.mediaWays.net] has quit [Read error: Operation timed out]
07:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:23 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:27 <@vpnHelper> RSS Update - forum: CARP ID <http://forums.openvpn.net/topic8998.html>
07:34 -!- _julian [~quassel@hmbg-5f77d432.pool.mediaWays.net] has joined #openvpn
07:48 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
07:54 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:59 -!- _julian_ [~quassel@hmbg-5f77d9a4.pool.mediaWays.net] has joined #openvpn
08:00 -!- _julian [~quassel@hmbg-5f77d432.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
08:10 < krzee> !dupe
08:10 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
08:11 -!- bauruine [~stefan@zux221-008-024.adsl.green.ch] has joined #openvpn
08:15 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
08:15 <@vpnHelper> RSS Update - forum: Iranian national firewall blocking OpenVPN ? <http://forums.openvpn.net/topic8999.html>
08:16 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
08:19 -!- donspaulding [~donspauld@c-67-173-34-83.hsd1.il.comcast.net] has joined #openvpn
08:20 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:43 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:51 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
08:53 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
08:54 -!- MarKsaitis [~MarKsaiti@host81-134-68-195.in-addr.btopenworld.com] has joined #openvpn
08:56 <@vpnHelper> RSS Update - forum: Cannot access server IP <http://forums.openvpn.net/topic9000.html>
09:05 -!- master_of_master [~master_of@p57B53856.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:07 -!- master_of_master [~master_of@87.181.65.165] has joined #openvpn
09:14 <@vpnHelper> RSS Update - forum: openvpn & apache issue <http://forums.openvpn.net/topic7955.html#p16473>
09:19 -!- Netsplit *.net <-> *.split quits: SJr, mete, _julian_, defswork, yell0, noisebleed
09:21 -!- _julian [~quassel@hmbg-5f77d9a4.pool.mediaWays.net] has joined #openvpn
09:22 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
09:22 -!- SJr [~sjr@24.81.10.216] has joined #openvpn
09:22 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:23 -!- Netsplit over, joins: mete
09:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:24 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
09:24 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
09:25 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
09:26 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
09:32 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
09:32 <@vpnHelper> RSS Update - forum: Cannot access lan from VPN Server <http://forums.openvpn.net/topic9001.html>
09:35 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
09:41 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
09:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
09:43 -!- sjuxax [~jeff@unaffiliated/sjuxax] has left #openvpn []
09:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:56 <@vpnHelper> RSS Update - forum: Cannot access server IP <http://forums.openvpn.net/topic9000.html#p16475>
09:57 -!- gentoofan [~richard@xa246-089.resnet.stonybrook.edu] has joined #openvpn
09:57 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
10:00 -!- noisebleed_ [~quassel@lula.inescn.pt] has joined #openvpn
10:01 -!- Bastian82 [~Bastian@77-253-151-85.adsl.inetia.pl] has quit []
10:01 <@vpnHelper> RSS Update - forum: How to start OpenVPN as service under windows <http://forums.openvpn.net/topic9002.html>
10:01 -!- yell0_ [yello@178.162.154.183] has joined #openvpn
10:03 -!- gentoofan [~richard@xa246-089.resnet.stonybrook.edu] has quit [Ping timeout: 258 seconds]
10:03 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
10:05 -!- gentoofan [~richard@pool-173-52-111-222.nycmny.fios.verizon.net] has joined #openvpn
10:05 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
10:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 256 seconds]
10:10 -!- p3rror [~mezgani@41.248.189.163] has joined #openvpn
10:14 <@vpnHelper> RSS Update - forum: How to start OpenVPN as service under windows <http://forums.openvpn.net/topic9002.html#p16477>
10:15 -!- p3rror [~mezgani@41.248.189.163] has quit [Ping timeout: 248 seconds]
10:16 -!- MarKsaitis [~MarKsaiti@host81-134-68-195.in-addr.btopenworld.com] has quit [Quit: Leaving]
10:20 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
10:24 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:25 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:29 -!- dazo is now known as dazo_afk
10:31 -!- raidz is now known as raidz_afk
10:34 -!- bauruine [~stefan@zux221-008-024.adsl.green.ch] has quit [Ping timeout: 248 seconds]
10:35 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
10:39 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
10:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:43 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:05 -!- SJr [~sjr@24.81.10.216] has quit [Ping timeout: 260 seconds]
11:06 -!- raidz_afk is now known as raidz
11:09 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
11:19 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
11:19 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:35 -!- gentoofa1 [~richard@vl174.cs.sunysb.edu] has joined #openvpn
11:38 -!- gentoofan [~richard@pool-173-52-111-222.nycmny.fios.verizon.net] has quit [Ping timeout: 260 seconds]
11:44 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
11:46 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
11:47 < SeaStorm> !configs
11:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
11:47 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
11:49 < SeaStorm> Hi
11:50 < SeaStorm> can someone help me a bit please ? My openvpn stopped working and I cant figure out why. thats my cfg http://pastebin.com/Z4DMEYZT
11:51 < SeaStorm> It worked on march and im pretty sure I didnt change anything on this config since then. But somehow it wont work now. I can connect to the vpn and all looks fine but
11:51 < SeaStorm> it assigns my PC 10.8.0.6 with default gateway .5
11:51 -!- durando1 [~durando@cpe-76-178-221-232.maine.res.rr.com] has joined #openvpn
11:52 < durando1> any of you guys familiar with setting up openvpn in the tomatousb firmware gui?
11:52 < SeaStorm> but I cant reach .5
11:58 -!- gentoofa1 [~richard@vl174.cs.sunysb.edu] has quit [Ping timeout: 258 seconds]
12:00 -!- gentoofan [~richard@xa246-089.resnet.stonybrook.edu] has joined #openvpn
12:02 <@vpnHelper> RSS Update - forum: Cannot access server IP <http://forums.openvpn.net/topic9000.html#p16478>
12:02 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
12:11 < SeaStorm> halp :(
12:13 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:14 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has left #openvpn []
12:17 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Would you like to know more?]
12:23 -!- noisebleed_ [~quassel@lula.inescn.pt] has quit [Ping timeout: 255 seconds]
12:32 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 258 seconds]
12:32 <@vpnHelper> RSS Update - forum: WIN XP SP3 -Connected but cannot ping, but WIN 7 works fine. <http://forums.openvpn.net/topic9003.html>
12:42 -!- EugeneSleep is now known as EugeneKay
12:44 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
12:45 -!- madsage [sage@2001:470:c:1292::2] has joined #openvpn
12:46 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
12:46 < SeaStorm> anyone alive
12:47 < madsage> /k jeev
12:47 < madsage> wake up jeev. old friend
12:47 < hyper_ch> no
12:47 < madsage> he hates me now. for 10yrs i taught him everything
12:48 < madsage> heh
12:48 < madsage> all becuase of obama, if you dont support obama, you are a racists. you know
12:49 < EugeneKay> /j ##politics
12:49 < madsage> anyways, some reason i cannot get my openvpn working worth a crap. not even sure where to start. 
12:50 < SeaStorm> any of you can help me please? :] ran against a wall finding a soloution ... I can login to my vpn all looks fine but my assigned defaultgateway is 10.8.0.5 ( server actually is 0.1 )
12:51 < madsage> my client works great with it. but my ceo and thier remote cabin doesnt like it all. the one common denominator is they are both dd-wrt devices. so its something with the way they bailwired and ducttapped openwrt into thier firmware
12:51 < EugeneKay> !def1
12:51 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:51 < EugeneKay> SeaStorm ^
12:52 < SeaStorm> hm
12:53 < Olipro> isn't def1 the default behaviour since 2.2.x?
12:53 < EugeneKay> I do not believe so.
12:54 < SeaStorm> nope its the same
12:54 < madsage> EugeneKay, would you mind taking a peek at a pastebin for me? i want to show some of the logs. seems some of my clients are reconnecting way too much. and i want them nailed up all the time.
12:54 < EugeneKay> madsage - probably a too-low ping-restart setting
12:54 < madsage> not sure what is causing the client to reconnect about evvery 60 sec
12:55 < madsage> i have that set at 15 and 120
12:55 < madsage> it was 10 120
12:55 < SeaStorm> any other ideas ?
12:58 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
12:58 < madsage> EugeneKay, okay man i will increase ping-restart, looks like about every 2 minutes it restarts
12:58 < SeaStorm> why does it pic the .0.5 for the gateway anyways ?
12:58 < EugeneKay> !factoids search 30
12:58 <@vpnHelper> 'net30' and '/30'
12:58 < EugeneKay> !/30
12:58 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
12:58 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
12:59 < EugeneKay> That's why ^
12:59 < madsage> and see what happens
12:59 < SeaStorm> ah yeah makes sense
12:59 < SeaStorm> OK ... why doesnt it work then :]
13:00 < EugeneKay> My guess? Iptables on your server is wrong.
13:00 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Remote host closed the connection]
13:00 < EugeneKay> Do you have a MASQUERADE rule in place for the vpn subnet?
13:00 < krzee> hmm
13:00 < krzee> madsage, you efnet oldschool?
13:01 < madsage> krzee, yup. how you been man
13:01 < krzee> haha doin good man
13:01 < madsage> awesome
13:01 -!- gentoofan [~richard@xa246-089.resnet.stonybrook.edu] has quit [Remote host closed the connection]
13:01 < SeaStorm> ACCEPT     all  --  10.8.0.0/24          anywhere
13:01 < madsage> jeev is trying to call me a racist again
13:01 < krzee> vpnHelper, say hi to madsage
13:01 < madsage> haha
13:02 < krzee> vpnHelper, tell madsage hi from krzee
13:02 < jeev> it just surprises me that a black guy comes into office, during a downfall and suddenly, it's his fault that nothing is working.
13:02 < krzee> hrm
13:02 < jeev> and then all white people do is complain about him.
13:02 < krzee> !tell madsage hi from krzee
13:02 < SeaStorm> lol
13:03 -!- luneff [~yury@31.23.79.144] has quit [Quit: This computer has gone to sleep]
13:03 < hyper_ch> jeev: but it is his fault
13:03 < madsage> jeev, so you automaticly think everybody is aracists because were not commies or socialists?
13:03 < hyper_ch> jeev: he gave hope to the people just to crush that hope an instant later
13:03 < madsage> anyways
13:04 < madsage> we were good friends man, to let politics get in the way is a shame
13:04 < madsage> i never held it against you that you supported him
13:05 < madsage> lol
13:05 < madsage> even tho, i knew waht was going to happen. and you have to admit. it has
13:05 < jeev> i dont think he's doing that great of a job, i think he's a fuckface for appointing bush's wack ass cronies
13:05 < madsage> we should prolly discuss out of channel if you are interested
13:05 < jeev> BUT he has done some things that i'm happy he's done and said.
13:06 < madsage> same here
13:06 < jeev> and he's done better than a republican would.
13:06 < madsage> well thats opinion
13:06 < jeev> i can't wait till the day comes where republicans get into power, take away minimum wage and all the homos who cry about obama lose their jobs, then blame obama for leaving a shitty economy for them..
13:06 < madsage> and i wont hold it against you
13:06 < jeev> joe the plumber is running for congress, go vote for him
13:07 < jeev> sarah palin fucked over her supporters, go vote for her
13:07 < madsage> hah he is not in my district or state
13:07 < ecrist> bah
13:07 < madsage> she isnt running
13:07 < krzee> nobody still looking for help?
13:07 < jeev> yea,exactly,. she isn't running but she led h er supporters to believe she was, so she could get donations.
13:07 < Olipro> for a moment I thought I'd mistakenly joined ##politics
13:07 < ecrist> I need teh helpz wit my vpnz
13:07 < jeev> ecrist, no help for you.
13:07 < ecrist> jeev: shh
13:08 < Olipro> how do I nat internets thru vpn? plz halp
13:08 < hyper_ch> what's that internet thing everybody is talking about?
13:09 < EugeneKay> It's a series of tubes
13:09 < EugeneKay> And there are old men on the other end of those tubes who want to stick their junk through them to your children!
13:10 < hyper_ch> good that I don't have children
13:10 < hyper_ch> I might consider own children once they come with a turn on/off button
13:10 < Olipro> they can actually make your keyboard emit gases to make your child more suggestible
13:11 < Olipro> strange fact, but it will actually make your child smell like hammers
13:12 < hyper_ch> what do hammers smell like?
13:12 < krzee> cool ill take that as a mass "no"
13:12 < krzee> bbl =]
13:13 < hyper_ch> krzee: plz, help me
13:13 < jeev> krzee
13:13 < krzee> im openvpn support not a psycologist
13:13 < jeev> Dougy said server is going offline for 3 days
13:13 < hyper_ch> krzee: the voices in my head tell me that you know Python
13:14 < krzee> oh right i need to send dougy some $, but theres certainly no way anything of mine is going offline from him, and remind him it took his ass a week to ship my server so i wasnt exactly in a rush
13:15 < jeev> trollol, i made it up.
13:15 < krzee> he has no access to any of my servers, ild like to know how he'ld take something offline... thats cute, but i will send him his $
13:15 < jeev> lol
13:15 < Olipro> crowbar and a shotgun?
13:15 < krzee> took him a week to get to fedex, doubt he has that sort of motivation
13:15 < jeev> dood hes like 470 lbs, give him a break
13:16 < Olipro> oh great, so you can send him that money
13:16 < krzee> lol
13:16 < Olipro> and he can break the 500lb barrier
13:17 < jeev> "colo payment? na, a sitting of food"
13:18 < krzee> this is the first time in like 4 years i dropped an IQ point by being in this channel
13:19 < Olipro> really? I didn't think an IQ of 0 was possible
13:20 -!- Olipro was kicked from #openvpn by vpnHelper [krzee protect]
13:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:20 < krzee> lol
13:20 < Olipro> you totally lined that one up for me :P
13:20 < Olipro> handed on a silver platter
13:22 -!- scampbell [~scampbell@204-232-90-162.static.123.net] has joined #openvpn
13:24 -!- [1]SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
13:26 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 240 seconds]
13:26 -!- [1]SeaStorm is now known as SeaStorm
13:27 < SeaStorm> arrr just cant get this thing to go back to work -_-
13:28 < SeaStorm> shouldnt I be fine with postrouting MASQUERADE  all  --  10.8.0.0/24          0.0.0.0/0 ??
13:28 < SeaStorm> im not really into iptables
13:28 < Olipro> then please give the entire rule
13:28 < Olipro> what you've just pasted is useless
13:29 < SeaStorm> does --list give you all the info you need ?
13:29 < Olipro> no
13:29 < Olipro> iptables-save does
13:29 < Olipro> pastebin it
13:30 < SeaStorm> http://pastebin.com/JL2AmXUU
13:32 < SeaStorm> my cfg http://pastebin.com/Z4DMEYZT
13:36 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
13:36 < Olipro> SeaStorm: mmm, your problem is that your filter/FORWARD rule is matching on -s 10.8.0.0/24
13:36 < Olipro> the packets are being DNATted
13:36 < Olipro> *SNAT
13:36 < Olipro> so they will no longer have that as their source address
13:36 < Olipro> and your very next rule is an ICMP reject
13:37 < Olipro> so all subsequent rules will never be reached
13:37 < SeaStorm> uh can I reset that stuff somehow and start from 0 ? :D
13:37 < Olipro> I'd match on interface
13:38 < Olipro> iptables -I FORWARD -i tun+ -o eth0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
13:38 < SeaStorm> paste that ?
13:38 < Olipro> if you wish
13:39 < SeaStorm> doh
13:39 < SeaStorm> FATAL: Could not load /lib/modules/2.6.18-028stab089.1/modules.dep: No such file or directory
13:39 < Olipro> oh, that crap
13:39 < SeaStorm> lol
13:39 < Olipro> iptables -I FORWARD -i tun+ -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
13:39 < Olipro> an OpenVZ box with 2.6.18 is horrible
13:40 < SeaStorm> k it acceppted it
13:40 < SeaStorm> just wondering why this stupid thing worked like a charm like 6 moths before
13:40 < Olipro> evidently your rules were different then
13:40 < SeaStorm> dont think i changed anything since then
13:41 < Olipro> there is no way it was working with this ruleset
13:41 < SeaStorm> I got this thing only because I wanted a gateway when im in china
13:41 < Olipro> well
13:41 < SeaStorm> k testing it
13:41 < Olipro> unless you happened to be on tun0
13:41 < Olipro> you're allowing that through
13:41 < Olipro> so if you've now moved up to a higher number
13:42 < Olipro> there lied your problem
13:42 < SeaStorm> hm
13:42 < Olipro> *lay
13:42 < SeaStorm> nope didnt work out
13:42 < Olipro> ok, what's the name of the VPN interface
13:42 < SeaStorm> tun0 it is
13:42 < Olipro> and what interface is internet traffic supposed to go out of
13:43 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:43 < SeaStorm> venet0:0
13:43 < Olipro> umm
13:43 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
13:43 < Olipro> so not eth0 then...
13:43  * Olipro facepalms
13:43 < Olipro> replace eth0 with venet0
13:43 < Olipro> have fun now.
13:44 < SeaStorm> :\ no fun for me
13:45 < Olipro> iptables-save, text editor to find and replace all, iptables-restore
13:46 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
13:48 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Read error: Connection reset by peer]
13:49 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has joined #openvpn
13:49 < SeaStorm> ah you are my hero :]
13:49 < SeaStorm> god im dumb ... much to learn
13:49 < SeaStorm> many thanks
13:54 < madsage> what kind of ping is used for the openvpn timeout, is it icmp?
13:56 < madsage> i maybe blocking it, and why everything is restarting every 200sec now, being i upped the ping-restart time
13:56 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:56 < madsage> and where is it pingin through the tunnel or the server address
13:56 < madsage> pingin/pinging
13:57 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
13:57 < madsage> i'll google it
14:00 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
14:00 -!- caemir_ [~caemir@unaffiliated/caemir] has joined #openvpn
14:02 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 258 seconds]
14:02 -!- caemir_ is now known as caemir
14:06 -!- SeaStorm [SeaStorm@HSI-KBW-085-216-033-161.hsi.kabelbw.de] has quit [Ping timeout: 240 seconds]
14:07 <@vpnHelper> RSS Update - forum: Using web hosting account for VPN tunnel <http://forums.openvpn.net/topic9004.html>
14:08 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
14:11 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
14:12 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:13 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
14:15 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Client Quit]
14:17 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
14:18 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
14:19 <@vpnHelper> RSS Update - forum: No Internet Access/No Network Access <http://forums.openvpn.net/topic9005.html>
14:32 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
14:35 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 248 seconds]
14:35 -!- luneff [~yury@84.51.192.74] has joined #openvpn
14:46 -!- axelm7 [~axelm@201.255.19.4] has joined #openvpn
14:51 <@vpnHelper> RSS Update - forum: Cannot access server IP <http://forums.openvpn.net/topic9000.html#p16482>
14:57 <@vpnHelper> RSS Update - forum: Cannot access server IP <http://forums.openvpn.net/topic9000.html#p16483>
15:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
15:04 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Quit: Leaving.]
15:10 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:11 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
15:14 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
15:15 <@vpnHelper> RSS Update - forum: Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16484>
15:21 <@vpnHelper> RSS Update - forum: No Internet Access/No Network Access <http://forums.openvpn.net/topic9005.html#p16491> || Multiple VPN tunnels <http://forums.openvpn.net/topic9007.html> || Problem with OpenVPN server <http://forums.openvpn.net/topic9006.html#p16489> || Cannot access server IP <http://forums.openvpn.net/topic9000.html#p16488> || Cannot access lan from VPN Server <http://forums.openvpn.net/topic9001.html#p16486>
15:24 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
15:27 <@vpnHelper> RSS Update - forum: Problem with OpenVPN server <http://forums.openvpn.net/topic9006.html#p16493> || Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16492>
15:33 <@vpnHelper> RSS Update - forum: Multiple VPN tunnels <http://forums.openvpn.net/topic9007.html#p16494>
15:35 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
15:36 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
15:39 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
15:39 <@vpnHelper> RSS Update - forum: Problem with OpenVPN server <http://forums.openvpn.net/topic9006.html#p16496> || Windows 7 Authtentication <http://forums.openvpn.net/topic8941.html#p16495>
15:39 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
15:43 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:51 <@vpnHelper> RSS Update - forum: Problem with OpenVPN server <http://forums.openvpn.net/topic9006.html#p16497>
15:52 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 260 seconds]
15:54 -!- axelm7 [~axelm@201.255.19.4] has left #openvpn ["Leaving"]
15:54 -!- luneff [~yury@84.51.192.74] has joined #openvpn
15:55 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 244 seconds]
15:57 <@vpnHelper> RSS Update - forum: Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16499> || Problem with OpenVPN server <http://forums.openvpn.net/topic9006.html#p16498>
15:59 -!- p3rror [~mezgani@174.143.241.32] has joined #openvpn
16:00 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
16:00 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
16:00 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
16:03 <@vpnHelper> RSS Update - forum: Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16502> || Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16501> || WIN XP SP3 -Connected but cannot ping, but WIN 7 works fine. <http://forums.openvpn.net/topic9003.html#p16500>
16:08 -!- Yen [Yen@unaffiliated/yen] has quit [Ping timeout: 260 seconds]
16:17 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
16:39 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:39 <@vpnHelper> RSS Update - forum: WIN XP SP3 -Connected but cannot ping, but WIN 7 works fine. <http://forums.openvpn.net/topic9003.html#p16503>
16:43 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
16:47 -!- p3rror [~mezgani@174.143.241.32] has quit [Ping timeout: 260 seconds]
16:51 <@vpnHelper> RSS Update - forum: Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16504>
16:56 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
17:02 -!- scampbell [~scampbell@204-232-90-162.static.123.net] has quit [Quit: Ex-Chat]
17:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
17:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:09 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 260 seconds]
17:13 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
17:14 -!- Yen [Yen@unaffiliated/yen] has quit []
17:14 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:18 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 260 seconds]
17:22 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
17:32 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
17:38 < |Mike|> q
17:42 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
17:44 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
17:51 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
17:52 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Client Quit]
17:57 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
18:08 -!- jcran [~jcran@64.125.235.2] has joined #openvpn
18:14 -!- donspaulding [~donspauld@c-67-173-34-83.hsd1.il.comcast.net] has quit [Quit: Leaving.]
18:21 -!- novaflash is now known as novaflash_away
18:24 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
18:36 -!- Denial [Denial@drgi.co.uk] has quit []
18:42 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
18:44 < madsage> hey
18:44 < madsage> MULTI: new connection by client 'cabin' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate.
18:45 < madsage> i am getting this with just route-push and and its own class C?
18:45 < krzie> nope... you're getting this cause you have that client's cert in use already
18:46 < krzie> so it knocks off the first client
18:46 < madsage> i think its restarting still and knocking itself off?
18:46 < krzie> ps auxw|grep vpn
18:46 < krzie> check if its running twice
18:47 < madsage> on the client. ok
18:47 < madsage> that would do it huh
18:47 < madsage> heh
18:47 < krzie> :-p
18:47 < krzie> you the same madsage that was in CA?
18:48 < madsage> i am
18:48 < krzie> shit man, its been awhile
18:48 < madsage> i am the founder
18:48 < madsage> naptime was my lackey
18:48 < madsage> lolol
18:48 < krzie> i knew you in 1992
18:48 < krzie> #!!!!!!highschoolsexpics lol
18:48 < madsage> just kidding jeev, i miss you man
18:48 < madsage> we had great times
18:49 < madsage> hah dude that was shitton long time ago
18:49 -!- mode/#openvpn [+v madsage] by vpnHelper
18:49 < krzie> ya man, 1992... about 20 years ago
18:49 <+madsage> when i got older i had to start #!!!!!!collegegirlsexpics
18:49 < krzie> lol
18:49 <+madsage> hehe
18:49 < krzie> when i got older i got into better wastes of time
18:49 <+madsage> rememebr shadow and kaycee?
18:49 < krzie> ya dude
18:50 < krzie> wassup with shadow?
18:50 < krzie> remember verse?
18:50 <+madsage> i dont know man, gravdigr said he came on efnet once a could years ago
18:50 <+madsage> could/couple
18:50 <+madsage> yeah i think verse is still around
18:51 < krzie> no
18:51 < krzie> he was my cousin :-p
18:51 < krzie> he doesnt irc anymore
18:51 <+madsage> ahh ok
18:51 <+madsage> i do remember the nick
18:51 < krzie> he gets married next oct
18:51 < |Mike|> gravedigr the cannuck?
18:51 < krzie> ill be in the wedding
18:52 <+madsage> no gravdigr on efnet was in arizona, now in cali
18:52 <+madsage> he is still around. personal friend of mine
18:52 < |Mike|> oh oh oh, the guy from #FED :P
18:52 < krzie> maybe he said he was in CA and you misunderstood him l[
18:52 < krzie> ;]
18:52 <+madsage> ahh
18:52 < |Mike|> might happen ;)
18:52 < krzie> CA was a group, of cali, or canada
18:52 < |Mike|> cali cannuck.. both CA
18:52 < krzie> and they were in the group
18:53 <+madsage> ca was actualy cocaine anonymous that turned into a botnet and channel group.
18:53 <+madsage> lol
18:53 <+madsage> we were all crack heads
18:53 <+madsage> haha
18:53 < krzie> were? :-p
18:53 < |Mike|> so yiu know crispexi etc too?
18:53 < |Mike|> you*
18:53 <+madsage> yeah, i'm over 20yrs free from ti
18:54 <+madsage> no i dont
18:54 < krzie> well CA is like 8 or 9 years old
18:54 < krzie> not 20+ :-p
18:54 <+madsage> yeah
18:54 < |Mike|> gee
18:54 <+madsage> damn krzie, you have a betetr memory that I
18:55 < krzie> ya its all the weed i smoke
18:55 <+madsage> haha
18:55 < krzie> the trick is to not stop
18:55 < |Mike|> weed is bad mmkay?
18:55 < krzie> false!
18:55 < krzie> and of all people to talk, lol
18:55 < |Mike|> drugs are bad, mkay
18:56 < |Mike|> (lets keep it in general) haha
18:56 < krzie> good thing you didnt meet up with us in .nl
18:56 < krzie> cause we went fear and loathing style that weekend
18:56 < |Mike|> gee, my foot wasn't capable..
18:56 < krzie> if you think drugs are bad, you definitely didnt want to meet up
18:56 < |Mike|> haha, but you did taste the cake? ;)
18:56 < krzie> tbh your weed didnt impress me
18:57 < krzie> (nl weed)
18:57 < krzie> but there was great hash, and all the other drugs were damn good too
18:57 < |Mike|> coffeeshop is quanitity and not quality stuff :)
18:57 < krzie> their*
18:57 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
18:57 < krzie> err no, there*
18:57 < krzie> hahaha
18:58 <+madsage> yeah ca was about 12yrs ago. the sexpics channels were 20. we all had dialup, thats about al we could serve then, jpegs
18:58 < krzie> fserve ftw!
18:58 <+madsage> haha
18:58 < |Mike|> damn , quit it
18:58 <+madsage> !sexpics
18:58 <+madsage> funny shit
18:59 < krzie> i ended up running war groups, then mp3 groups after all that
18:59 <+madsage> man i have terrabytes of hardcore HD pr0n now
18:59 <+madsage> ahh cool
18:59 < |Mike|> eek, you're still single? 
18:59 <+madsage> no i'm married and 5 kids
18:59 < krzie> im the only person who held 2 counsil positions at the same time in RNS
18:59 <+madsage> most grown and moved out already
19:00 < |Mike|> lol, they are 40?
19:00 < krzie> i recently saw my name in greetz on a mp3 nfo, that was kinda cool
19:00 <+madsage> yeah i was in the scene for a bit, till everybody got busted. i took the site down
19:00 < krzie> i got out before the busts... around 2000
19:00 <+madsage> yeah, thats right when i got out too
19:00 < |Mike|> krzie: hehe, few weeks ago i was walkin in my HAR2009 t-shirt and someone started to talk with me about geek stuff and 2l8 e-zine :P
19:01 <+madsage> we had a monster site for a bit
19:01 <+madsage> top10
19:01 < krzie> lol mike
19:01 <+madsage> naptime helped
19:01 < krzie> hah i wonder if i was on it, thats funn
19:01 < krzie> funny*
19:01 <+madsage> i let that guy do everything, now he just shits on me
19:02 < |Mike|> it's kinda crazy that i'm mentioned in the credit part *g*
19:02 <+madsage> ungreatful bastard
19:02 <+madsage> haha
19:02 < krzie> madsage, you mean jeev?
19:02 <+madsage> i do
19:02 < krzie> he knows enough to shit on you?
19:02 < krzie> i thought he started using computers last week ;]
19:02 < krzie> |Mike|, as am i, but not as krzee :-p
19:02 <+madsage> naw, i try to be cool with him and he just shines me off
19:02 < krzie> i asked to be a different name
19:03 < |Mike|> krzie: haha, i know ;)
19:03 < krzie> oh lol
19:03 < krzie> meh i should sleep some time
19:03 < krzie> eyes on fire
19:03 < |Mike|> it's 2AM herei n NL
19:03 <+madsage> i even gave him his own linknet server
19:03 <+madsage> and fucked that up too
19:04 <+madsage> i should just forget about him, but after 10yrs and all the good times its hard
19:04 < |Mike|> decades..
19:04 < krzie> its either 5pm 7pm or 8pm depending on which server you believe im really using and how far you trace it ;]
19:05 < |Mike|> I know where you're from, it's probably 7PM
19:05 < krzie> where im from and where i am... often not close to eachother :-p
19:05 < |Mike|> hehe
19:05 < |Mike|> i don't give a shit :P
19:06 <+madsage> yeah 5pm i have to do some maintz on the asterisk server
19:06 < krzie> http://www.youtube.com/watch?v=0janfcZ8LUw
19:06 <@vpnHelper> Title: Ricky Nelson - Travelin Man 1961 - YouTube (at www.youtube.com)
19:06 <+madsage> be back
19:06 < krzie> madsage, welcome to 2008+ we use freeswitch now
19:06  * |Mike| has to do some sleepin
19:06 < |Mike|> g'nite ladies and gentlemen.
19:06 < krzie> gnite mike
19:07 < krzie> ill bbl too
19:13 -!- raidz is now known as raidz_afk
19:14 -!- _julian [~quassel@hmbg-5f77d9a4.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
19:15 <+madsage> krzie, i have freeswitch too
19:15 <+madsage> thats why were working on astrisk not freeswitch
19:16 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
19:18 <@vpnHelper> RSS Update - forum: OpenVPN connected but no internet connection <http://forums.openvpn.net/topic9008.html>
19:19 -!- _julian [~quassel@hmbg-5f766f73.pool.mediaWays.net] has joined #openvpn
19:19 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:31 < Dougy> krzie: give me my money biatch
19:43 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:43 -!- mode/#openvpn [+v Axeman] by ChanServ
19:50 <+madsage> hah
19:50 <+madsage> i think he said he was buying beer
19:51 <+madsage> or something
20:00 < krzee> lol dude help me remember earlier in the day
20:01 < krzee> i have to be able to reach my paypal guy
20:01 < krzee> how much is it again?
20:03 -!- raidz_afk is now known as raidz
20:04 < krzee> i asked you awhile ago to leave that on the forum in a pm to me
20:04 < Dougy>   never saw that
20:12 <@vpnHelper> RSS Update - forum: How to Hire For OpenVPN install on VPS? <http://forums.openvpn.net/topic8959.html#p16506>
20:16 < krzee> [20:15]  <madsage> thats why were working on astrisk not freeswitch
20:16 < krzee> lol!
20:19 -!- raidz is now known as raidz_afk
20:20 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
20:28 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
20:34 -!- raidz_afk is now known as raidz
20:45 < EugeneKay> Beer? I want beer.
20:49 -!- Doonz_Alt [~Doonz@S0106002590301952.ed.shawcable.net] has joined #openvpn
20:49 < Doonz_Alt> Hi Guys, Im connecting to my router through an open vpn connection. I can ping my local lan ip on my router 192.168.1.1 but i cannot ping anything else on that lan
20:49 < Doonz_Alt> where do i need to look for answers
20:54 <@vpnHelper> RSS Update - forum: OpenVPN AS deployment questions <http://forums.openvpn.net/topic9009.html>
21:04 < Hydrant> Doonz_Alt: look at your routing table
21:04 < Hydrant> paste route -n
21:04 < Hydrant> to pastebin of course
21:06 < durando1> i'm attempting to setup openvpn on the tomatousb firmware for my 2 linksys e3000 routers, with tomatousb its a pretty simple gui to setup openvpn but for whatever reason i can't seem to figure out how to get network sharing to work (IE I can see the server router from the client side but none of the systems behind the server router and i can't see anything including the client router from the server side) is there anyone here that co
21:06 < Doonz_Alt> sorry Hydrantmy bad i shoulda asked in pfsense as its on my pfsense box and i used the wizard to do it
21:07 < Hydrant> Doonz_Alt: no problem, trying to help... it sounds like a routing issue to me
21:07 < Doonz_Alt> well mybe i can stumble through
21:08 < Doonz_Alt> http://pastebin.com/UvJpNF4V
21:09 < Hydrant> Doonz_Alt: what is 68.150.152.1 ?
21:09 < Doonz_Alt> isp
21:09 < Hydrant> BSD is strange
21:09  * Hydrant is used to Linux
21:10 < Hydrant> how do we get the netmask with BSD
21:10 < Hydrant> try "ip route show"
21:10 < Hydrant> and paste, I need to be able to read it ;-)
21:10 < Doonz_Alt> tbh i just pulled up the routes stats
21:10 < Doonz_Alt> its a pfsense router 
21:10 < Hydrant> that isn't the output of "route -n" then
21:10 < Doonz_Alt> so im not sure even howto do that
21:10 < Hydrant> okay, I was thinking it was really odd
21:11 < Hydrant> you need a terminal
21:11 < Hydrant> ssh or something
21:11 < Doonz_Alt> yeah let me try
21:12 < Doonz_Alt> # route -n
21:12 < Doonz_Alt> usage: route [-dnqtv] command [[modifiers] args]
21:12 < Doonz_Alt> #
21:13 < Hydrant> ip route show
21:14 < Doonz_Alt> # ip route show
21:14 < Doonz_Alt> ip: Command not found.
21:14 < Doonz_Alt> #
21:14 < Hydrant> hrrm
21:14 < Hydrant> I'm not familiar with bsd, route -n should've worked
21:14 < Hydrant> sorry, can't help more than that
21:14 < Doonz_Alt> np thanx for trying
21:15  * Hydrant is going to move to pfsense in a couple years
21:16 < Doonz_Alt> its screwed up cause it worked before and the only thing i changed was 1 ip on my filesever. 
21:16 < Doonz_Alt> not sure
21:17 -!- illsci [~jsabo@pool-96-255-235-187.washdc.fios.verizon.net] has joined #openvpn
21:17 < illsci> hey what's up 
21:17 < illsci> the other night I was in here and someone pointed me to http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting
21:17 <@vpnHelper> Title: OpenVPN/RIPRouting - Secure Computing Wiki (at www.secure-computing.net)
21:18 < illsci> I want to have two vpn hosts act as concentrators and have a ton of other nodes all establish redundant tunnels, one to each vpn host and be able to talk to each other over the vpn network 
21:20 < illsci> Does each node have to be on it's own network?
21:24 -!- durando1 [~durando@cpe-76-178-221-232.maine.res.rr.com] has quit [Quit: Leaving.]
21:32 -!- raidz is now known as raidz_afk
21:37 -!- Doonz_Alt [~Doonz@S0106002590301952.ed.shawcable.net] has quit []
21:43 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:50 -!- durando [~durando@cpe-76-178-221-232.maine.res.rr.com] has joined #openvpn
21:56 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
22:01 -!- raidz_afk is now known as raidz
22:21 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 255 seconds]
22:28 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
22:37 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
22:38 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
22:42 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:47 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
22:54 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
22:54 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:56 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
23:03 -!- illsci [~jsabo@pool-96-255-235-187.washdc.fios.verizon.net] has quit [Ping timeout: 248 seconds]
23:04 <@vpnHelper> RSS Update - forum: Ad Hoc wireless bridged to LAN not working with OpenVPN <http://forums.openvpn.net/topic8996.html#p16508>
23:10 <@vpnHelper> RSS Update - forum: Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16509>
23:18 -!- donspaulding [~donspauld@70-14-108-161.pools.spcsdns.net] has joined #openvpn
23:23 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:32 -!- durando [~durando@cpe-76-178-221-232.maine.res.rr.com] has quit [Ping timeout: 245 seconds]
23:52 -!- durando [~durando@cpe-76-178-221-232.maine.res.rr.com] has joined #openvpn
23:56 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-kktfkxfhuyejjenk] has quit [Ping timeout: 276 seconds]
--- Day changed Wed Oct 12 2011
00:00 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-wsomfqqypjgdlmop] has joined #openvpn
00:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
00:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:19 -!- donspaulding [~donspauld@70-14-108-161.pools.spcsdns.net] has quit [Quit: Leaving.]
00:26 <@vpnHelper> RSS Update - forum: Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16510>
00:28 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
00:30 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:44 <@vpnHelper> RSS Update - forum: Running a down script prior to route del <http://forums.openvpn.net/topic7406.html#p16511>
00:50 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
01:02 <@vpnHelper> RSS Update - forum: How do I configure my server? <http://forums.openvpn.net/topic9010.html>
01:08 <@vpnHelper> RSS Update - forum: Ad Hoc wireless bridged to LAN not working with OpenVPN <http://forums.openvpn.net/topic8996.html#p16513>
01:24 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
01:35 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has joined #openvpn
01:35 < DJHenjin> hello, if i am setting up openvpn based on http://www.runpcrun.com/howtoopenvpn and i am not using a local DNS server do i need to push the domain option?
01:35 <@vpnHelper> Title: OpenVPN Windows HowTo | runPCrun - IT Support for London (at www.runpcrun.com)
01:51 -!- novaflash_away is now known as novaflash
01:57 -!- novaflash is now known as novaflash_away
02:11 < Mowee> Plop
02:13 < DJHenjin> i am getting 'sigusr1 [soft,tls-error] received process restarting' on the client i am trying to setup on my VPN
02:14 < DJHenjin> will PB configs in a moment
02:18 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has quit [Ping timeout: 255 seconds]
02:20 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has joined #openvpn
02:20 < DJHenjin> im back
02:22 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
02:25 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Operation timed out]
02:25 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has quit [Read error: Connection reset by peer]
02:27 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has joined #openvpn
02:27 < DJHenjin> sorry having lots of internet connection issues tonight
02:30 <@vpnHelper> RSS Update - forum: How to start OpenVPN as service under windows <http://forums.openvpn.net/topic9002.html#p16514>
02:34 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has quit [Read error: Connection reset by peer]
02:34 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has joined #openvpn
02:34 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has quit [Changing host]
02:34 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has joined #openvpn
02:36 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
02:36 <@vpnHelper> RSS Update - forum: How to access .. <http://forums.openvpn.net/topic9011.html>
02:41 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:45 -!- raidz is now known as raidz_afk
02:57 -!- dazo_afk is now known as dazo
02:58 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has quit [Ping timeout: 255 seconds]
03:06 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has joined #openvpn
03:06 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has quit [Changing host]
03:06 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has joined #openvpn
03:08 < durando> hey guys i'm having problems figuring out how to make openvpn bi directional, i am able to use the client side to connect to everything on the server side but the server side cannot see anything on the client side it seems
03:09 < DJHenjin> hey, i can now ping 10.8.0.1 connected to the VPN tunnel, but i cannot ping anything on my 192.168.0.0 network from the remote computer
03:10 < DJHenjin> btw durando, i havent gotten much response from here been trying for a while, hope that if anyone sees that im slowly making progress, they will be able to chime in
03:11 < durando> figures DJHenjin
03:11 < durando> great technology but a little difficult to impement 
03:11 < DJHenjin> i used to not be able to connect at all a couple hours ago, but now i can at least connect, but im gettign the same issue i got last time i tried setting this up a while ago
03:12 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
03:16 < DJHenjin> now to wait the 5 minutes it takes to restart my servers lol
03:16 -!- Ionic [ionic@ionic.de] has joined #openvpn
03:57 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:11 -!- rsc [~robert@fedora/rsc] has left #openvpn ["Linux - The future has already started!"]
04:16 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has quit [Read error: Connection reset by peer]
04:16 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 260 seconds]
04:18 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has joined #openvpn
04:18 -!- DJHenjin [~IceChat77@S01060024012c32c1.ed.shawcable.net] has quit [Changing host]
04:18 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has joined #openvpn
04:28 -!- _julian [~quassel@hmbg-5f766f73.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
04:30 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:30 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:30 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:32 -!- _julian [~quassel@hmbg-4d06adb9.pool.mediaWays.net] has joined #openvpn
04:47 -!- DJHenjin [~IceChat77@unaffiliated/djhenjin] has left #openvpn []
05:02 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
05:11 <@vpnHelper> RSS Update - forum: Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16516>
05:13 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
05:13 -!- IsilZha [~andreas@182.55.249.76] has quit [Ping timeout: 245 seconds]
05:14 -!- IsilZha [~andreas@182.55.249.76] has joined #openvpn
05:17 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 245 seconds]
05:17 <@vpnHelper> RSS Update - forum: lan DHCP requests <http://forums.openvpn.net/topic8852.html#p16517>
05:18 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
05:41 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16518>
05:46 -!- illsci [~jsabo@pool-96-255-235-187.washdc.fios.verizon.net] has joined #openvpn
05:46 <@vpnHelper> RSS Update - forum: Accessing OVPN client through OVPN server from outside ovpn <http://forums.openvpn.net/topic9012.html>
05:49 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
05:49 -!- mode/#openvpn [+v Axeman] by ChanServ
05:51 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 260 seconds]
05:54 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
06:01 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
06:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:16 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
06:21 -!- illsci [~jsabo@pool-96-255-235-187.washdc.fios.verizon.net] has quit [Ping timeout: 255 seconds]
06:26 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
06:31 -!- ViruSkin- [~gg@46.48.140.12] has joined #openvpn
06:32 -!- Boulet [~jerem@bdy93-5-82-235-83-239.fbx.proxad.net] has joined #openvpn
06:33 -!- ViruSkin- [~gg@46.48.140.12] has left #openvpn ["Reality is that which, when you stop believing in it, doesn't go away"]
06:51 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Ping timeout: 260 seconds]
06:53 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
07:02 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
07:02 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
07:02 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
07:17 -!- _julian [~quassel@hmbg-4d06adb9.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
07:18 -!- _julian [~quassel@hmbg-5f77ed82.pool.mediaWays.net] has joined #openvpn
07:36 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:37 -!- bauruine [~stefan@zux221-008-024.adsl.green.ch] has joined #openvpn
07:37 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has joined #openvpn
07:43 -!- donspaulding [~donspauld@c-67-173-34-83.hsd1.il.comcast.net] has joined #openvpn
07:54 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html>
08:06 <@vpnHelper> RSS Update - forum: Untrusted SSL Certificate <http://forums.openvpn.net/topic9014.html>
08:09 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:09 -!- mode/#openvpn [+v Axeman] by ChanServ
08:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:20 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
08:21 < Splex> is it possible to have a separate tls-remote entry for each <connection> block?
08:29 < ecrist> yes, i believe so
08:30 -!- MikeJansen [~mike@cpe-067-023-156-025.dhcp.wadsnet.com] has quit [Quit: Leaving.]
08:32 < Splex> ecrist: Options error: option 'tls-remote' cannot be used in this context
08:32 < ecrist> there you go
08:33 < krzee> i was thinking that would be an easier way to know than asking
08:34 < ecrist> I always answer 'i think so' to those types of questions
08:34 < krzee> i almost looked at the manual after you said you think so, then i decided he'ld test it soon anyways
08:35 < Splex> well, when i asked that, i am thinking it makes sense to have a separate 'verification' for each connection block..
08:35 < Splex> so.. is there some other means to do this?
08:35 <@vpnHelper> RSS Update - forum: OpenVPN AS not responsive on public ip address <http://forums.openvpn.net/topic9016.html>
08:36 < Splex> i.e. i want to match a server cert with the ip for the connection
08:38 < Splex> ensure that the connection being made to a particular IP is the intended CN/host
08:39 < krzee> you could prefix them like this:
08:39 < krzee> Name can also be a common name prefix, for example if you want a client to only accept connections to "Server-1", "Server-2", etc., you can simply use --tls-remote Server
08:42 < EugeneKay> Splex - SSL PKI really only checks hostnames against DNs. IMO, <connection> ought to support --tls-remote, but apparently it doesn't.
08:42 < EugeneKay> --ns-cert-type is a good option to use both client and server side
08:48 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16523>
08:57 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 258 seconds]
08:58 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
09:01 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16524>
09:05 -!- master_of_master [~master_of@87.181.65.165] has quit [Ping timeout: 260 seconds]
09:07 -!- master_of_master [~master_of@p57B53BA7.dip.t-dialin.net] has joined #openvpn
09:16 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
09:28 < Splex> EugeneKay: if i specify --tls-client, --ns-cert-type isn't neccesary, right?
09:29 < EugeneKay> Splex - every check helps ;-)
09:30 -!- rawplayer [~foo@2001:610:158:1020:216:3eff:fe64:6606] has quit [Ping timeout: 240 seconds]
09:30 <@vpnHelper> RSS Update - forum: Certificate error <http://forums.openvpn.net/topic9017.html>
09:31 < Splex> EugeneKay: true, which is why i want to also verify the common name, etc matches on the intended connection
09:32 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Changing host]
09:32 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
09:33 -!- rawplayer [~foo@2001:610:158:1020:216:3eff:fe64:6606] has joined #openvpn
09:35 -!- illsci [~jsabo@66.208.14.74] has joined #openvpn
09:35 < illsci> morning
09:44 -!- novaflash_away is now known as novaflash
09:49 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 258 seconds]
09:50 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:55 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16526>
09:58 < EugeneKay> Splex - about the best you can do for multiple-servers with the current code is to check against a CA, CRL, and the cert-type
09:58 < EugeneKay> You *could* share a CN across two different servers(not necessarily the same cert, just the same CN), but that's a bit daft.
09:59 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:02 < krzee> Splex, you saw what i told you?
10:03 -!- Boulet [~jerem@bdy93-5-82-235-83-239.fbx.proxad.net] has left #openvpn ["Ex-Chat"]
10:03 < illsci> hey krzee
10:03 < illsci> Do you have a few minutes to chat about the ovpn rip wiki you made?  
10:04 < illsci> I had some questions about the cube thing too
10:04 < Splex> krzee: I want to add a restriction to only allow a particular CN for an IP
10:06 < krzee> why didnt you say so?
10:06 < krzee> !client-connect
10:06 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
10:07 < krzee> illsci, i didnt write !rip
10:07 < Splex> krzee: thx..  what is the purpose of tls-remote if the verification can be done in client-connect?
10:07 < krzee> and what cube thing?
10:08 < krzee> Splex, well you use client-connect because its about giving a specific ip
10:09 < illsci> it's called cube-routed
10:09 < illsci> from cohesiveft.com
10:09 < Splex> krzee: what i want is for the client to abort the connection if the CN is not as expected for the particular server ip
10:10 < krzee> illsci, got a link that actually explains it instead of trying to sell stuff?
10:10 < illsci> I want to have two vpn concentrators and have all nodes establish tunnels to each of them but I want to see if there is a way for all the clients to always be on the same subnet
10:10 < illsci> I'm not trying to sell stuff
10:10 < Splex> even though the server credentials may be valid for the ca.crt
10:10 < krzee> illsci, the link cohesiveft.com is, not you
10:10 < illsci> You sent me this link the other day http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting
10:10 <@vpnHelper> Title: OpenVPN/RIPRouting - Secure Computing Wiki (at www.secure-computing.net)
10:11 < krzee> illsci, they dont need to be on the same subnet!
10:11 < illsci> hey before you start telling me what I need and everything
10:11 < illsci> I would like to finish talking about what I was talking about
10:11 < illsci> give me a second to find this link
10:11 < illsci> So after I read the rip wiki you sent me I looked through some of their other stuff and read this article 
10:11 < illsci> http://www.linuxjournal.com/article/9915?page=0,0
10:11 <@vpnHelper> Title: Building a Multisourced Infrastructure Using OpenVPN | Linux Journal (at www.linuxjournal.com)
10:12 < illsci> this is pretty much what I want to build.... I want to have two independant vpn concentrators so one can go down at anytime and the clients will still be able to talk to each other over a vpn and ideally they would use the same ip 
10:13 < illsci> like clienta and clientb's ip address never changes and I was hoping to not have to assign each client it's own network
10:13 < illsci> Ive set up a client server chain and now I want to make that better
10:14 < illsci> and thanks for all the help the other day... I would never have gotten it working without it
10:14 < krzee> but you do want seperate networks :-p
10:14 < illsci> well so this is my problem with that
10:14 < krzee> something you think will make things easier will actually make them harder
10:15 < illsci> so if im a client and I establish a tunnel to server A it's going to give me an ip that it's configured for....   but then if server a goes down and I failover to server b isn't that going to be an entirely different network prefix of ips?
10:16 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
10:16 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
10:16 < krzee> yes
10:16 <@vpnHelper> RSS Update - forum: Certificate error <http://forums.openvpn.net/topic9017.html#p16528> || Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16527>
10:16 < krzee> so?
10:17 < illsci> So when I put that hosts ip in dns 
10:17 < illsci> and it fails over to the other server and gets a new ip the services connected to that dns name will stop working
10:18 < illsci> I'm trying to find a way to avoid that 
10:18 < EugeneKay> You can use up-scripts to nsupdate
10:18 < illsci> yeah... so I can use dyndns... but I was hoping I could fix through openvpn and routing
10:18 < illsci> or some feature I'm not aware of or something
10:18 < illsci> this cubed-routed article basically shows a way of doing that
10:19 < illsci> sort of...
10:20 < EugeneKay> It's more for routes than DNS
10:20 < illsci> would you just accept it that each host can have one of two ip's at any given time and use dynamic dns updates to keep dns correct?
10:20 < illsci> this is going to be problematic for me though
10:20 < illsci> some servers cache dns on start up and won't refresh it
10:23 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16531> || Accessing OVPN client through OVPN server from outside ovpn <http://forums.openvpn.net/topic9012.html#p16530> || Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16529>
10:24 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:24 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:24 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:25 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:25 -!- jcran [~jcran@64.125.235.2] has quit [Quit: Ping timeout: -99999999999]
10:29 <@vpnHelper> RSS Update - forum: Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16533> || openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16532>
10:35 <@vpnHelper> RSS Update - forum: Accessing OVPN client through OVPN server from outside ovpn <http://forums.openvpn.net/topic9012.html#p16534>
10:36 -!- Cr4zi3 [killaz@184.95.44.187] has quit [Ping timeout: 260 seconds]
10:41 <@vpnHelper> RSS Update - forum: Accessing OVPN client through OVPN server from outside ovpn <http://forums.openvpn.net/topic9012.html#p16535>
10:41 -!- bauruine [~stefan@zux221-008-024.adsl.green.ch] has quit [Ping timeout: 255 seconds]
10:42 -!- Hydrant [~aj@unaffiliated/hydrant] has quit [Remote host closed the connection]
10:48 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
10:48 -!- jeev [~jeev@unaffiliated/jeev] has quit [Excess Flood]
10:48 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
10:49 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
10:53 <@vpnHelper> RSS Update - forum: OpenVPN and Cisco VPN terminate one anther on same net <http://forums.openvpn.net/topic9018.html> || Accessing OVPN client through OVPN server from outside ovpn <http://forums.openvpn.net/topic9012.html#p16536>
11:01 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
11:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:03 -!- raidz_afk is now known as raidz
11:18 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
11:36 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:41 <@vpnHelper> RSS Update - forum: Certificate error <http://forums.openvpn.net/topic9017.html#p16538>
11:49 -!- kyrix_ [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
11:57 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
11:59 <+madsage> jeev quit fludding
12:00 <+madsage> good morning openvpn
12:01 < ecrist> it's noon here.
12:01 < ecrist> 13 seconds earlier and you've have made it
12:01 < ecrist> 12:00:12 <+madsage> good morning openvpn
12:01 <+madsage> top of teh day
12:01 <+madsage> heh, yeah 10am mst still
12:01 <+madsage> GMT-7
12:02 <+madsage> man my openvpn is shit. i'm about ready to blast this box with a .44mag
12:05 <+madsage> well maybe i shoot the clients. my windows openvpn works perfectly. something with these damn dd-wrt devices. i shoot them
12:05 <+madsage> should^
12:05 <@vpnHelper> RSS Update - forum: How to access .. <http://forums.openvpn.net/topic9011.html#p16540> || openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16539>
12:05 -!- Cubox [~Cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.6-rc1"]
12:05 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
12:05 <+madsage> i think i will flash them to open-wrt and i bet issues go away.
12:09 -!- dazo is now known as dazo_afk
12:15 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:19 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 248 seconds]
12:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:22 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
12:22 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
12:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:22 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
12:23 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:33 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
12:36 -!- _julian_ [~quassel@hmbg-5f77d3a0.pool.mediaWays.net] has joined #openvpn
12:37 -!- _julian [~quassel@hmbg-5f77ed82.pool.mediaWays.net] has quit [Ping timeout: 256 seconds]
12:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
12:40 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
12:40 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 258 seconds]
12:47 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
12:54 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Quit: BRB]
12:55 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
12:56 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Client Quit]
12:59 -!- durando [~durando@cpe-76-178-221-232.maine.res.rr.com] has quit [Ping timeout: 260 seconds]
13:00 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
13:11 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
13:14 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
13:15 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 240 seconds]
13:16 <+madsage> FreeSWITCH Version 1.0.trunk (12861)
13:17 < ecrist> wrong channel
13:17 <+madsage> oops
13:18 <+madsage> my gpm has a mind of its own sometimes
13:19 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:20 < ecrist> gpm = gay penis muncher?
13:25 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
13:25 <+madsage> yeah, my gay linux penis muncher mouse daemon
13:38 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:38 -!- mode/#openvpn [+v Axeman2] by ChanServ
13:40 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
13:45 <+madsage> it has a habit of premature buffer ejaculation
13:45 <+madsage> heh
13:56 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
13:57 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has joined #openvpn
13:57 < deever> hi
13:57 < ecrist> not yet, but soon
13:57 < deever> ecrist: yes, right now! ;)
13:58 <+novaflash> i'm certain this has been asked before, but i've tried (very shortly) to get the openvpn daemon to pick up on my ovpn file and auto-connect. it's an autologin profile so only inline keys. i've stuck it in /etc/openvpn/ and named it balls.ovpn - i didn't see a status file in /var/run/ and i tried /etc/init.d/openvpn stop / start to see if that did anything. any hints for poor old silly me? ps, 
13:58 <+novaflash> running on debian 6 with apt-get install openvpn installed.
13:59 <+novaflash> going through man openvpn i didn't easily find anything (but i admit i was hasty)
13:59 < deever> novaflash: logs, errors?
14:01 <+novaflash> checking, just a sec
14:02 <+novaflash> just checking if i can find the log file
14:02 <+novaflash> !logs
14:02 <+novaflash> !log
14:02  * ecrist restarts vpnHelper
14:03 <+novaflash> oh aha
14:03 <+novaflash> oops.
14:03 <+novaflash> i don't have an openvpn folder or file /var/log/, strangely
14:04 <+novaflash> please note that running openvpn --config /etc/openvpn/balls.ovpn runs fine
14:05 <+novaflash> going to attempt to check /var/log/messages for messages while i set it up again with the openvpn daemon
14:05 <@raidz> balls.ovpn
14:05 <+novaflash> yeah
14:06 <+novaflash> it doesn't have a profanity filter built in, rite?
14:06 <@raidz> haha
14:08 < deever> can an openvpn client act as a kerberos client? i.e. get a TGT from the foreign KDC? or do i have to do the kerberos/gssapi login separately?
14:08 < rawplayer> no
14:08 < rawplayer> yes
14:08 < deever> mh...ok
14:09 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
14:09 -!- mode/#openvpn [+o vpnHelper] by ChanServ
14:09 < ecrist> !logs
14:09 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
14:09 <+novaflash> thanks ecrist
14:09 <@vpnHelper> RSS Update - forum: How do I configure my server? <http://forums.openvpn.net/topic9010.html#p16541> || How to access .. <http://forums.openvpn.net/topic9011.html#p16540> || openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16539> || Certificate error <http://forums.openvpn.net/topic9017.html#p16538> || OpenVPN and Cisco VPN terminate one anther on same net <http://forums.openvpn.net/topic9018.html> || Accessing OVPN client 
14:10 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 244 seconds]
14:12 <+novaflash> i've got balls.ovpn in /etc/openvpn and it is only a client profile file with key-only authentication (autologin). from command line i can connect it fine (you know, openvpn --config balls.ovpn --daemon). but from /etc/default/openvpn i deduce there is an init script that reads config files from somewhere (assume /etc/openvpn) and starts the connections automatically. i'm trying to find out 
14:12 <+novaflash> if i'm doing something wrong. but i get no log files, no messages, no tunnel being built. can anyone here help me figure this out?
14:13 <+novaflash> all i want is for the init script to start my connections automatically. i ASSUME this exists because of the /etc/default/openvpn file. if i'm wrong, please correct me.
14:30 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:39 -!- Axeman3 [~Axeman3@198.105.46.46] has joined #openvpn
14:40 <+madsage> your vpn has balls?
14:40 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
14:41 <+novaflash> madsage; ;)
14:41 <+madsage> i believe openvpn will parse any .conf in its config path
14:41 <+madsage> but i dont work here, just an enduser myself
14:41 <+novaflash> alright.. and is /etc/openvpn that config path?
14:42 <+madsage> yep i believe that is default
14:42 <+novaflash> alright... well okay, thanks. it's not picking up on my .ovpn file unfortunately - and i can't verify anywhere on any messages ;) 
14:43 <+madsage> i think .ovpn is for the client only, not linux daemon
14:43 <+madsage> the windows gui client
14:43 <+novaflash> i think i can disprove that
14:43 <+novaflash> when i run /usr/sbin/openvpn --config balls.ovpn it works fine
14:43 <+novaflash> connects, get ip, traffic flows, all is well
14:43 <+madsage> okay, again i'm no expert 
14:43 <+madsage> cool
14:43 <+madsage> i learned something then too
14:43 <+novaflash> i know, me neither, that's cool
14:44 <+novaflash> just trying to find out how to get this sorted. i mean, right now i use a command line in /etc/rc.local but hey, the daemon is there, so it ought to work, rite? ;)
14:44 <+madsage> but does it find it automagicaly? or you are specifying the file
14:44 <+madsage> with --config
14:44 <+madsage> just currious
14:44 <+novaflash> oh with --config i have to specify it manually
14:44 <+novaflash> exact line;
14:44 <+madsage> yeah
14:44 <+novaflash> /usr/sbin/openvpn --config /etc/openvpn/balls.ovpn --daemon
14:45 <+novaflash> the daemon thing sticks it in the background
14:45 <+madsage> rename it to .conf and you dont need to specify the file. but thats also fine
14:45 <+novaflash> hm i'll try renaming it to conf, see what it does, thanks for the tip
14:45 <+novaflash> maybe that's the whole problem
14:45 <+novaflash> it looking for .conf and not .ovpn
14:45 <+madsage> but nothing wrong with specifing it like that
14:45 <+madsage> yeah that could be an issue
14:46 <+novaflash> i know but i figured since it has an init script it saves me messing with /etc/rc.local
14:46 <+madsage> and why you would want to specify file with --config
14:46 <+madsage> if you needed that file extension
14:46 <+madsage> for whatever reason
14:46 <+novaflash> if i don't add --config (filenamehere) openvpn will spit out an error message and do nothing
14:47 <+madsage> i know my mine picks up anything with .conf in the /etc/openvpn path
14:47 <+novaflash> right okay
14:47 <+novaflash> that's what i'm going to try right now
14:47 <+novaflash> also, do you know where, if, openvpn logs anything?
14:47 <+madsage> cool
14:47 <+madsage> yeah, my default in /etc/openvpn/logs
14:48 <+novaflash> oh.. sad face here, no log
14:48 <+novaflash> debian has /var/log/ as default location for log files but there's nothing there with openvpn in the name
14:48 <+madsage> and itt should be owned by the user:group that openvpn runs as
14:48 <+novaflash> yes
14:48 <+madsage> oh ok, each dist may vary
14:48 <+novaflash> yes that's it
14:49 <+novaflash> renaming to conf is the trick
14:49 <+novaflash> now it picks up on it at boot time and all is well!
14:49 <+madsage> if you are using dist packages, who knows what they have changed.
14:49 <+novaflash> thanks madsafe - i'd never have found this out myself
14:49 <+madsage> cool man, glad to help
14:49 <+novaflash> true, they could have altered stuff in weird ways
14:50 <+novaflash> but it is debian, they usually have a very good system
14:50 <+novaflash> but thanks :) my problem is resolved
14:50 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 276 seconds]
14:54 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
15:04 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:08 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
15:19 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Quit: Leaving.]
15:20 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
15:23 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
15:29 -!- dollabill [~mike@199.44.8.98] has quit []
15:33 -!- Axeman3 [~Axeman3@198.105.46.46] has quit [Ping timeout: 260 seconds]
15:37 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:43 <@vpnHelper> RSS Update - forum: Certificate error <http://forums.openvpn.net/topic9017.html#p16543> || OpenVPN and Cisco VPN terminate one anther on same net <http://forums.openvpn.net/topic9018.html#p16542>
15:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
15:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:54 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
15:55 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:07 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:07 <@vpnHelper> RSS Update - forum: OpenVPN AS not responsive on public ip address <http://forums.openvpn.net/topic9016.html#p16544>
16:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
16:22 < reiffert> !factoids
16:22 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:29 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:30 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:31 <@vpnHelper> RSS Update - forum: Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16545>
16:55 -!- beerbro [~gustav@vi.etcpasswd.net] has quit [Ping timeout: 255 seconds]
17:01 -!- gustav- [~gustav@vi.etcpasswd.net] has joined #openvpn
17:47 -!- kyrix_ [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
18:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
18:20 <@vpnHelper> RSS Update - forum: OpenVPN and Cisco VPN terminate one anther on same net <http://forums.openvpn.net/topic9018.html#p16546>
18:21 -!- Clete2 [~Clete2@98.215.42.211] has joined #openvpn
18:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:34 -!- Denial [Denial@drgi.co.uk] has quit []
18:36 -!- fread2281 [~fread2281@70.56.210.56] has joined #openvpn
18:40 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
18:50 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
18:55 -!- illsci [~jsabo@66.208.14.74] has quit [Ping timeout: 252 seconds]
19:01 -!- raidz is now known as raidz_afk
19:04 -!- novaflash is now known as novaflash_away
19:08 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
19:08 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
19:10 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:10 -!- Clete2 [~Clete2@98.215.42.211] has quit [Ping timeout: 260 seconds]
19:10 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:17 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
19:17 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:34 -!- donspaulding [~donspauld@c-67-173-34-83.hsd1.il.comcast.net] has quit [Quit: Leaving.]
19:34 -!- deebee_ [~db@02d9d9db.bb.sky.com] has joined #openvpn
19:38 -!- raidz_afk is now known as raidz
19:39 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
19:40 -!- alexove [~alexove@190.42.98.41] has joined #openvpn
19:43 < alexove> Hello, i'm setting a openvpn server and i have problems :(
19:43 < alexove> can anyone help me please?
19:43 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
19:47 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
19:47 < ecrist> yes
19:48 < EugeneKay> !welcome
19:48 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:48 < EugeneKay> alexove ^
19:49 < alexove> jajajaja
19:49 < alexove> Ok
19:49 < alexove> i set up the server and connect one client
19:49 -!- _julian [~quassel@hmbg-4d06ff98.pool.mediaWays.net] has joined #openvpn
19:50 < alexove> the client can do ping to the server but can't do ping to LAN's machines
19:52 -!- _julian_ [~quassel@hmbg-5f77d3a0.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
19:53 < alexove> this is my server config file http://paste.debian.net/136150/
19:56 < alexove> and this is my client config file http://paste.debian.net/136151/
19:58 < ecrist> do the LAN machines know how to route to the VPN?
19:58 < alexove> i don't know
19:58 < alexove> how i can know it?
20:02 < ecrist> go to one of the LAN machines and type 'tracert <ip>'  if it's windows, and replace <ip> with the vpn client's IP address.
20:02 < ecrist> perhaps you should learn what a network is, first
20:04 < alexove> get an 1231 error
20:05 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
20:09 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
20:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
20:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:32 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:32 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:37 -!- adolfomaltez [~taro@190.62.210.173] has joined #openvpn
20:47 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
20:56 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Read error: Connection reset by peer]
20:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
20:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:59 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
21:03 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 260 seconds]
21:03 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
21:17 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:28 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
21:32 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
21:33 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:35 -!- alexove [~alexove@190.42.98.41] has left #openvpn ["Saliendo"]
21:45 -!- deebee_ [~db@02d9d9db.bb.sky.com] has quit [Ping timeout: 258 seconds]
21:48 -!- p3rror [~mezgani@174.143.241.32] has joined #openvpn
21:49 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
22:02 -!- fread2281 [~fread2281@70.56.210.56] has quit [Remote host closed the connection]
22:02 -!- W4lth3r is now known as W4lth3r|off
22:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 260 seconds]
22:13 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
22:50 <@vpnHelper> RSS Update - forum: Help with my network with openvpn <http://forums.openvpn.net/topic8855.html#p16547>
22:52 -!- p3rror [~mezgani@174.143.241.32] has quit [Ping timeout: 260 seconds]
23:04 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
23:14 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:56 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 258 seconds]
--- Day changed Thu Oct 13 2011
00:03 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:05 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Client Quit]
00:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
00:14 <@vpnHelper> RSS Update - forum: client-to-client problem <http://forums.openvpn.net/topic8944.html#p16548>
00:31 -!- adolfomaltez [~taro@190.62.210.173] has quit [Remote host closed the connection]
00:31 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html>
00:34 -!- donspaulding [~donspauld@70.14.108.161] has joined #openvpn
00:49 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:58 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:20 <@vpnHelper> RSS Update - forum: Disconnect reason within client-disconnect scope? <http://forums.openvpn.net/topic8991.html#p16551> || OpenVPN connected but no internet connection <http://forums.openvpn.net/topic9008.html#p16550>
01:26 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16552>
01:38 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16553>
01:44 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16554> || [Solved] client-to-client problem <http://forums.openvpn.net/topic9020.html#p16548>
01:50 -!- donspaulding [~donspauld@70.14.108.161] has quit [Quit: Leaving.]
02:00 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:07 < Mowee> Morning
02:27 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:34 -!- gustav- is now known as beerbroy
02:34 <@vpnHelper> RSS Update - forum: Certificate error <http://forums.openvpn.net/topic9017.html#p16556> || OpenVPN connected but no internet connection <http://forums.openvpn.net/topic9008.html#p16555>
02:35 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
03:00 -!- raidz is now known as raidz_afk
03:05 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
03:11 <@vpnHelper> RSS Update - forum: OpenVPN and Cisco VPN terminate one anther on same net <http://forums.openvpn.net/topic9018.html#p16557>
03:17 <@vpnHelper> RSS Update - forum: OpenVPN connected but no internet connection <http://forums.openvpn.net/topic9008.html#p16558>
03:24 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:31 -!- dazo_afk is now known as dazo
03:35 <@vpnHelper> RSS Update - forum: Help with my network with openvpn <http://forums.openvpn.net/topic8855.html#p16560> || Certificate error <http://forums.openvpn.net/topic9017.html#p16559>
03:48 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 276 seconds]
04:03 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
04:35 <@vpnHelper> RSS Update - forum: Access a server through VPN on a firewall from outside <http://forums.openvpn.net/topic9021.html>
04:45 -!- _julian [~quassel@hmbg-4d06ff98.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
04:46 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
04:46 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 240 seconds]
04:46 -!- _julian [~quassel@hmbg-4d0691ff.pool.mediaWays.net] has joined #openvpn
04:47 -!- test__ [~anandvenk@27.100.19.125] has joined #openvpn
04:47 < test__> Hi
04:47 < test__> How to programatically fine the version of openvpn installed
04:52 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
05:05 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 258 seconds]
05:07 -!- Denial [Denial@drgi.co.uk] has quit []
05:10 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
05:10 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16562>
05:14 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
05:14 -!- novaflash_away is now known as novaflash
05:16 <@vpnHelper> RSS Update - forum: Access a server through VPN on a firewall from outside <http://forums.openvpn.net/topic9021.html#p16563>
05:16 -!- luneff [~yury@109.165.22.30] has joined #openvpn
05:18 -!- s0k3 [~steven4re@41.206.13.3.vgccl.net] has joined #openvpn
05:20 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
05:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
05:34 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953.html#p16564>
05:38 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 244 seconds]
05:38 -!- test__ [~anandvenk@27.100.19.125] has quit [Quit: Leaving]
05:40 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
05:40 -!- mode/#openvpn [+o mattock] by ChanServ
05:42 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
06:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:12 -!- yell0_ [yello@178.162.154.183] has quit [Ping timeout: 255 seconds]
06:13 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
06:15 -!- ccesario [~ccesario@187.17.166.162] has quit [Remote host closed the connection]
06:16 -!- beerbroy is now known as beerbro
06:18 -!- Tamo [~x@cpc6-sgyl28-2-0-cust248.sgyl.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
06:19 -!- yell0 [~yello@unaffiliated/contempt] has joined #openvpn
06:20 -!- W4lth3r|off is now known as W4lth3r
06:24 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 260 seconds]
06:24 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:24 -!- mode/#openvpn [+o mattock] by ChanServ
06:24 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
06:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
06:33 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
06:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:58 -!- alexove [~alexove@190.42.103.224] has joined #openvpn
07:14 <@vpnHelper> RSS Update - forum: Untrusted SSL Certificate <http://forums.openvpn.net/topic9014.html#p16565>
07:19 < alexove> Hello
07:19 < alexove> i have a problem with a openvpn server
07:19 < alexove> my vpn clients can not to access to LAN machines
07:21 < ecrist> it's a routing issue, I told you that yesterday
07:22 < alexove> :-)
07:22 < alexove> how i can check where is the problem?
07:22 < alexove> i don't have any idea
07:22 < ecrist> I told you that yesterday, too.
07:23 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
07:28 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:36 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 255 seconds]
07:36 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
07:37 -!- alexove [~alexove@190.42.103.224] has quit [Ping timeout: 248 seconds]
07:45 < Optic> moo
07:47 -!- degrees [3ed51fd2@gateway/web/freenode/ip.62.213.31.210] has joined #openvpn
07:48 < degrees> hi there
07:48 < degrees> i need help, please.
07:51 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:55 < ecrist> degrees: great
07:56 < degrees> ecrist i have a problem write this http://forums.openvpn.net/topic7029.html but with version 2.2.1
07:56 <@vpnHelper> RSS Update - forum: Cannot access lan from VPN Server <http://forums.openvpn.net/topic9001.html#p16566>
07:56 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN with Windows 2008 x64 R2 : Installation Help (at forums.openvpn.net)
07:58 < degrees> on win 2003 and win 2008 32 bit its work correctly
07:58 -!- alexove [~alexove@190.42.103.224] has joined #openvpn
07:58 < degrees> sorry for my english? it not my main language
07:58 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 276 seconds]
07:59 < degrees> .
07:59 -!- alexove [~alexove@190.42.103.224] has quit [Client Quit]
08:02 < degrees> ecrist ?
08:03 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
08:04 < ecrist> degrees: I don't really want to read an entire forum post.  just tell me what your problem is
08:04 < ecrist> and don't pm me
08:10 < degrees> ecrist I have a Windows 2008 x64 R2 server, here i have OpenVPN 2.2.1 installed. But it fails to install the TAP-WIN32 Adapter V9 correctly. I run OpenVPN service, but in Network Connections window i see text TAP-WIN32 Adapter V9 cord unplugged
08:12 < ecrist> how do you know the adapter isn't getting installed correctly?
08:16 < degrees> because in win 2003 it work, but in win 2008 r2 x64 dosnt work - I did all the same
08:16 < degrees> and in win 2008 32 bit works too
08:18 < ecrist> I think you're wrong. I'm guessing the adapter is installed properly.  Can you show me the client logs, please?
08:18 < ecrist> !logs
08:18 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:19 < ecrist> Windows 2008 has different security configuration in the OS.
08:21 <@vpnHelper> RSS Update - forum: Untrusted SSL Certificate <http://forums.openvpn.net/topic9014.html#p16567>
08:23 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:23 < degrees> i cant to show you clients logs, but they are not connect to server, because the TAP-WIN32 Adapter have 0.0.0.0 ip address, not from config file (server.ovpn)
08:24 < ecrist> if you want help, show me the client logs from a connection attempt
08:24 < ecrist> at verb 5
08:29 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 248 seconds]
08:30 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
08:32 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:32 < degrees> Thu Oct 13 17:30:37 2011 us=593000 Current Parameter Settings: Thu Oct 13 17:30:37 2011 us=593000   config = 'client.ovpn' Thu Oct 13 17:30:37 2011 us=593000   mode = 0 Thu Oct 13 17:30:37 2011 us=593000   show_ciphers = DISABLED Thu Oct 13 17:30:37 2011 us=593000   show_digests = DISABLED Thu Oct 13 17:30:37 2011 us=593000   show_engines = DISABLED Thu Oct 13 17:30:37 2011 us=593000   genkey = DISABLED Thu Oct 13 17:30:37 2011 us=5
08:33 < ecrist> ok, dude, pastebin, don't paste to the channel
08:33 < ecrist> also, I want the ENTIRE log
08:33 < ecrist> not just the lines you think I want
08:34 < degrees> where can i past logs?
08:34 < ecrist> pastebin.org
08:38 < degrees> http://pastebin.com/UCf3F0Q9
08:38 < degrees> it is client.log
08:38 < ecrist> where's your server log?
08:41 < ecrist> degrees: it appears you have a firewall issue of some sort
08:41 < ecrist> it's unable to connect to your vpn server, which appears to be on the same network...
08:44 -!- reisi [koivunej@mustatilhi.cs.tut.fi] has quit [Quit: leaving]
08:46 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
08:49 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
08:50 < degrees> ecrist it is a clear OS witout a firewall
08:50 < degrees> stabdart firewall is down
08:50 < degrees> standart
08:51 < ecrist> degrees: the error is that your client cannot connect to the server.
08:51 < ecrist> it's got nothing to do with an incorrectly installed tap adapter, as far as I can see
08:51 < degrees> i can show you a  screenshot from a server, and you quickly understatnd me
08:51 < ecrist> don't care
08:52 < degrees> where i can paste a screenshot?
08:53 < degrees> ((((((((((
08:54 <+madsage> the tap always looks like its cable is unplugged. becuase tehre is no cable to a tap/tun device. its layer 2 or 3, a cable is layer 1.
08:55 -!- donspaulding [~donspauld@static-50-40-43-106.bltn.il.frontiernet.net] has joined #openvpn
08:57 < degrees> +madsage in win 2008 32 bit and win 2003 tap interface is UP, but in win 2008 r2 x64 - is down
08:57 < degrees> it have no IP from config
08:57 < degrees> it have 0.0.0.0 ip
08:57 <+madsage> oh i take that back. mine does show link when the tunnel is up.
08:57 < degrees> but service is running
08:57 <+madsage> i dont work here anyways
08:58 <+madsage> yeah, i havnt tried openvpn in server R2
08:58 < ecrist> degrees: from the command line of your 2008 machine, try pinging the vpn server
08:59 < degrees> in which address?
08:59 < ecrist> the vpn server
09:00 < degrees> i can ping? because tap interface has no ip, it has 0.0.0.0
09:01 < ecrist> ping the fucking VPN server.
09:01 < degrees> i cant ping
09:01 < degrees> ok
09:01 < ecrist> go away
09:02 -!- deebee_ [~db@02d9d9db.bb.sky.com] has joined #openvpn
09:02 < degrees> ping is ok
09:05 < degrees> when i installed openvpn on win 2003 in status of tap connection i can see the ip address added to a vpnserver from config (server.ovpn), but in R2 i cant
09:05 -!- master_of_master [~master_of@p57B53BA7.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
09:06 < degrees> in R2 i see 0.0.0.0
09:07 -!- master_of_master [~master_of@p57B55EC9.dip.t-dialin.net] has joined #openvpn
09:07 < ecrist> degrees: that address is added AFTER you connect to the vpn server
09:07 < ecrist> something is preventing you from connecting
09:08  * ecrist goes away
09:10 < degrees> hm... in win 2003 i can see, when interface is up. And i can see the icon of tap interface in tray, when service is running
09:13 < degrees> ecrist in win 2008 when i start service, how i can understand that all ok?
09:19 < ecrist> the log file
09:19 < ecrist> degrees: I'm guessing windows firewall is enabled on either the server or the client
09:20 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
09:20 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
09:20 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
09:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
09:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:34 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
09:34 -!- mode/#openvpn [+o mattock] by ChanServ
09:38 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16568>
09:47 -!- deebee_ [~db@02d9d9db.bb.sky.com] has quit [Quit: Lost terminal]
09:47 -!- ziplock [~ziplock@unaffiliated/ziplock] has joined #openvpn
09:50 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
09:52 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
09:56 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
10:05 -!- dazo is now known as dazo_afk
10:07 <@vpnHelper> RSS Update - forum: OpenVPN AS not responsive on public ip address <http://forums.openvpn.net/topic9016.html#p16569>
10:13 <@vpnHelper> RSS Update - forum: OpenVPN AS not responsive on public ip address <http://forums.openvpn.net/topic9016.html#p16570>
10:19 <@vpnHelper> RSS Update - forum: Untrusted SSL Certificate <http://forums.openvpn.net/topic9014.html#p16571>
10:20 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
10:20 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
10:25 <@vpnHelper> RSS Update - forum: Untrusted SSL Certificate <http://forums.openvpn.net/topic9014.html#p16572>
10:29 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:29 -!- mode/#openvpn [+o mattock] by ChanServ
10:38 -!- luneff [~yury@109.165.22.30] has quit [Quit: This computer has gone to sleep]
10:48 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
10:48 <@vpnHelper> RSS Update - forum: Routing to Interfaces (NIC) <http://forums.openvpn.net/topic9022.html>
10:51 -!- raidz_afk is now known as raidz
10:55 <@vpnHelper> RSS Update - forum: Peer to Peer communication between clients <http://forums.openvpn.net/topic8989.html#p16574>
10:56 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:04 < krzie> !confgen
11:04 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
11:06 < reiffert> oh, dennis ritchie has died.
11:06 < krzie> yes =/
11:07 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 258 seconds]
11:07 <@vpnHelper> RSS Update - forum: Routing to Interfaces (NIC) <http://forums.openvpn.net/topic9022.html#p16575>
11:19 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16576>
11:26 <@vpnHelper> RSS Update - forum: Peer to Peer communication between clients <http://forums.openvpn.net/topic8989.html#p16577>
11:31 -!- luneff [~yury@84.51.192.74] has joined #openvpn
11:41 <+madsage> mornin krzie
11:42 < krzie> moin
11:45 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 256 seconds]
11:45 -!- psychik [~psy@2a01:e35:1384:3c90:1e6f:65ff:feca:2202] has joined #openvpn
11:45 < psychik> hi
11:45 <+madsage> confgen? really? so many examples and tutorials to copy/paste from
11:45 <+madsage> hi psychik
11:46 < psychik> i try to complete installation of a vpn server and when adding thze iptables rules i get > http://pastebin.com/c6wmJYqF
11:46 < psychik> anyone has a clue ?
11:48 <+madsage> missing -t nat
11:48 <+madsage> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 
11:49 <+madsage> assuming thats what you are trying to do
11:50 < psychik> thanks
11:51 < psychik> it works
11:51 < psychik> =)
11:51 < krzie> madsage, you have officially  helped more people than jeev 
11:51 < krzie> ;]
11:53 <+madsage> lol
11:53 <+madsage> and you are welcome psychik
11:53 <+madsage> glad it helped
11:54 < psychik> ^^
12:01 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
12:02 < finetic> Does anyone know if OpenVPN server for debian by default maintains logs for which ip address connects?
12:02 < krzie> did you check the logs...?
12:03 < krzie> and there really is no "default"
12:03 < finetic> i am looking for a good tutorial on how i can setup an openvpn server so i can tunnel traffic through it 
12:04 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Read error: Connection reset by peer]
12:04 < ecrist> !hotwo
12:04 < ecrist> !howto
12:04 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:04 < krzie> !goal
12:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:04 < krzie> what exactly did you mean by "tunnel traffic through it" ?
12:04 < krzie> to a lan behind the vpn, to the internet, etc
12:04 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
12:05 < finetic> to the internet
12:05 < finetic> so the ip i use in my virtual machine is not visible to anywhere i connect
12:05 < finetic> skype, etc
12:05 < krzie> !redirect
12:05 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
12:06 < krzie> if you use bash, my confgen can help
12:06 < krzie> !confgen
12:06 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
12:06 < krzie> and you also want the howto that ecrist gave above
12:06 < krzie> for extra understanding
12:16 -!- psychik [~psy@2a01:e35:1384:3c90:1e6f:65ff:feca:2202] has quit [Quit: Quitte]
12:16 -!- psychik [~psy@2a01:e35:1384:3c90:1e6f:65ff:feca:2202] has joined #openvpn
12:17 < psychik> another question , when i try to connect tu my vpn i get this now > http://pastebin.com/tKgNj3qF
12:17 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:17 -!- s0k3 [~steven4re@41.206.13.3.vgccl.net] has quit []
12:18 < krzie> must be root :-p
12:18 < psychik> indeed
12:19 < psychik> thanks
12:19 < psychik> but when starting itr with init.d , i've no connection at all , no ping neither
12:20 < krzie> and when starting it manually?
12:20 < psychik> wait , I test
12:22 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
12:22 < psychik> no conection in brower neither in ping , a just could do a host cmd
12:22 < psychik> in wich log must i look ?
12:30 < Optic> mo
12:39 -!- yell0 [~yello@unaffiliated/contempt] has quit [Remote host closed the connection]
12:43 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
12:44 < finetic> when generatingt the certificates, should i do this in /usr/share/doc/openvpn/examples/easy-rsa / 1.0 or /2.0 ?
12:47 < krzie> 2.0
12:47 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
12:51 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:53 < finetic> ok
12:53 < finetic> the tut says i should copy the whole dir + subdirs /usr/share/doc/openvpn to /etc/openvpn
12:53 < finetic> is that ok to do?
12:56 <+madsage> yeah thats the default directory
13:00 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
13:00 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
13:02 -!- MikeJansen [~mike@cpe-067-023-147-094.static.wadsnet.com] has joined #openvpn
13:03 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
13:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
13:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:09 < finetic> I also don't see a server.conf example file anywhere
13:09 < finetic> where are these supposed to be?
13:12 <+madsage> in /etc/openvpn
13:13 <+madsage> check out some howto's should get some exmaples
13:13 < finetic> only update-resolv-conf
13:13 < finetic> no other files trhere
13:13 <+madsage> !confgen
13:13 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
13:13 < finetic> i just want a basic example file
13:14 <+madsage> !howto
13:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:14 < finetic> howto points to examples
13:14 <+madsage> yeah google is your friend too
13:16 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
13:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
13:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:29 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
13:29 -!- psychik [~psy@2a01:e35:1384:3c90:1e6f:65ff:feca:2202] has quit [Ping timeout: 244 seconds]
13:31 -!- dazo_afk is now known as dazo
13:32 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
13:32 -!- joako [~joako@opensuse/member/joak0] has joined #openvpn
13:32 < joako> Is there any way for DNS to work for Linux OpenVPN clients? The DNS is added to /etc/resolv but the hosts can't be accessed by hostname using a web browser
13:33 -!- psychik [~psy@2a01:e35:1384:3c90:1e6f:65ff:feca:2202] has joined #openvpn
13:35 -!- MikeJansen [~mike@cpe-067-023-147-094.static.wadsnet.com] has quit [Read error: Connection reset by peer]
13:48 -!- eahm [~irc@98.165.171.4] has joined #openvpn
13:50 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:01 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
14:03 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 258 seconds]
14:03 -!- joako [~joako@opensuse/member/joak0] has quit [Quit: Leaving]
14:03 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
14:06 -!- nicehs [~nicehs@189.90.242.253] has joined #openvpn
14:08 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:08 -!- mode/#openvpn [+v s7r] by ChanServ
14:19 -!- jeev is now known as thumbs
14:19 -!- thumbs is now known as jeev
14:26 < finetic> I've just setup a vpn server on debian. i connect with windows client. Everything goes ok, client says its connected and LAN icon with X in tray dissapears
14:26 < finetic> however, i do not have an internet connection
14:26 < finetic> i cannot ping or reach any host or ips
14:26 < finetic> any idea what I can do to debug?
14:29 -!- degrees [3ed51fd2@gateway/web/freenode/ip.62.213.31.210] has quit [Ping timeout: 252 seconds]
14:29 < hyper_ch> !configs
14:29 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
14:30 < hyper_ch> !logs
14:30 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
14:34 < finetic> ok
14:37 < krzie> hey dougy
14:37 < krzie> how much do i owe you?
14:38 < finetic> where i can find logs?
14:38 < krzie> !logfile
14:38 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
14:38 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:38 < finetic> ok
14:45 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
14:49 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
14:49 < finetic> hyper_ch: Oct 13 22:01:16 server ovpn-server[1043]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
14:49 < finetic> this is the only error that i could find in /var/log/syslog
14:49 < finetic> the only log i mean
14:51 -!- eahm [~irc@98.165.171.4] has quit [Remote host closed the connection]
14:52 < finetic> anyone maybe know?
14:52 < krzie> specify a logfilwe
14:52 < krzie> logfile*
14:53 < finetic> where can i do this?
14:53 < krzie> !logfile
14:53 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
14:53 < finetic> ok
14:56 < krzie> Dougy, i wanted to send you that $ right now, my guy is ready and all... but you still never sent me the info on how much like i keep asking you to
14:56 < krzie> send a pm on the forum
14:57 < krzie> ecrist, if dougy comes around looking for $ from me can you send it to him via paypal for me if it is small?  i need to get his paid out and he wont gimme the infos
14:57 < krzie> s/his/him/
14:59 < finetic> krzie: no errors
14:59 < finetic> set on error log level 6
14:59 < krzie> whats the problem?
15:00 < finetic> log file has now 464 lines, and when i for example in cmd.exe type ping 8.8.8.8 no error gets added tot it
15:00 < finetic> to
15:00 < krzie> why would it?
15:00 < finetic> well, nothing happens, i have no connection
15:00 < finetic> i mean, there should be something not working properly
15:00 < krzie> !redirect
15:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
15:00 < krzie> be sure you did all that, and that your firewall isnt blocking it from forwarding
15:00 < finetic> ok sec
15:01 -!- W4lth3r is now known as W4lth3r|off
15:12 < ecrist> krzie: sure.
15:12 < krzie> thanks
15:19 < finetic> !def1
15:19 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
15:39 < finetic> !ipforward
15:39 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:39 < finetic> !linipforward
15:39 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:39 < finetic> !nat
15:39 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:40 < finetic> !linnat
15:40 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
15:41 < finetic> !dns
15:41 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
15:42 < finetic> krzie: i am sure i did those all
15:45 < finetic> Is this correct in OpenVPN client log? Thu Oct 13 22:44:09 2011 ROUTE default_gateway=192.168.1.254 - thats the gateway of the router yes
15:45 < finetic> shouldnt it be the gateway of the server
15:46 < finetic> hmm nvm the one where i configged it correctly and that works also has this
15:47 < finetic> i really dont know what can be wrong
15:48 < finetic> i configured everything according to the howto and man
15:51 < finetic> I think i must have forgotten 1 piece of the puzzle but i dont really know where
15:52 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:52 < finetic> krzie: here?
15:52 -!- dazo is now known as dazo_afk
15:52 < finetic> krzee: .
15:54 < finetic> I had the same issue like 1 year ago when i installed my other vpn server
15:54 < finetic> but i really dont know how come
15:55 < finetic> pinging 10.8.0.1 works btw
15:55 < finetic> but nothing else does
16:01 <@vpnHelper> RSS Update - forum: WIN XP SP3 -Connected but cannot ping, but WIN 7 works fine. <http://forums.openvpn.net/topic9003.html#p16579>
16:05 -!- Yen [Yen@unaffiliated/yen] has quit []
16:07 < finetic> Anyone who can help me maybe?
16:08 < Dougy> !ubuntu
16:08 <@vpnHelper> "ubuntu" is dont use network manager!
16:09 < jeev> dont use ubuntu, harhahrarh
16:16 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
16:19 <@vpnHelper> RSS Update - forum: WIN XP SP3 -Connected but cannot ping, but WIN 7 works fine. <http://forums.openvpn.net/topic9003.html#p16580>
16:20 < krzee> finetic, i told you
16:20 <+madsage> ubunghole
16:20 < krzee> !redirect
16:20 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
16:20 < krzee> and check your firewall on the forward chain
16:21 <+madsage> jeev, what do you use these days
16:21 <+madsage> i build with cent anymore. getting lazy in my old age
16:22 <+madsage> tho i just built 6 debian vm's last week
16:23 <+madsage> i'm managing about 16 cent boxes a dozen or so windows server, and another dozen various slack/debian/ubung servers
16:23 < Dougy> jeev: 
16:23 < Dougy> someone in another IRC channel was asking me why networkmanager wasnt working
16:23 < Dougy> dolt
16:23 < Dougy> ok
16:23 < Dougy> bbl
16:24 <+madsage> Dougy you must know jeev well
16:25 < finetic> krzee: already did
16:25 < finetic> krzee: firewall on win xp disabled
16:26 < krzee> well its one of those
16:26 < krzee> either firewall, ip forwarding, or NAT
16:26 < krzee> (on your server)
16:26 < finetic> i'm 100% sure i did those 1-4
16:26 < krzee> oh or dns
16:26 < finetic> same
16:26 < krzee> (if you can ping 8.8.8.8 its dns)
16:26 < finetic> but i cannot ping 8.8.8.8 
16:27 < krzee> then its nat, firewall, or ip forwarding
16:27 < krzee> server is win xp?
16:27 < finetic> server is debian 6.0
16:27 < finetic> client is win xp
16:27 < krzee> !linnat
16:27 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
16:27 < krzee> !linipforward
16:27 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:27 < krzee> if its not one of those, it is your firewall
16:27 < finetic> firewall on xp is off
16:28 < krzee> i am not talking about your client
16:28 < krzee> [17:26]  <krzee> (on your server)
16:28 < finetic> its a basic debian netinst with nothing disabled (from hosting company)
16:28 < finetic> I alreadyd did: sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
16:28 < finetic> and
16:29 < finetic> sudo sysctl -w net.ipv4.ip_forward=1
16:29 < finetic> Is there anything else that can be the issue
16:30 < finetic> or anythinge else i can try
16:31 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:31 < nicehs> try this?-> http://pastebin.com/ybdHbxD0  i had similar problem and finally got access to the internet after doing that^^  im newb tho
16:32 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
16:32 < nicehs> (iptables)
16:32 < finetic> ok let me see
16:34 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:34 < finetic> tried it
16:34 < finetic> still same :(*
16:34 < nicehs> hm:\
16:35 < nicehs> tried install dnsmasq or similar? i did,not sure it made a diff tho (as said im newb,really new to linux n stuff just followd some tutorials)
16:38 -!- nicehs [~nicehs@189.90.242.253] has quit []
16:40 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
16:46 < finetic> where can i find this iptables config file?
16:52 < krzee> finetic, in your OS's help channel, or iptables -L
16:55 < finetic> ok
16:56 < finetic> i tried anything possible, but really cannot access the outside internet with this VPN
16:56 < finetic> !def1
16:56 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:57 < finetic> did #3 - in server config, done
16:57 < finetic> !ipforward
16:57 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:57 < finetic> !linipforward
16:57 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
16:58 < finetic> argh finally!
17:07 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
17:12 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
17:14 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
17:14 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
17:14 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Quit: >:o]
17:14 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
17:14 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:14 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
17:15 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
17:15 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
17:15 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
17:15 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:17 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
17:21 -!- novaflash is now known as novaflash_away
17:21 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
17:22 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 248 seconds]
17:31 < finetic> damn too soon
17:31 < finetic> just rebooted server and didnt work again
17:32 < finetic> !nat
17:32 < finetic> !linnat
17:32 < finetic> !linat
17:32 < finetic> oh damn
17:36 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 245 seconds]
17:39 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
17:43 -!- fread2281 [~fread2281@70-56-140-80.albq.qwest.net] has joined #openvpn
17:45  * ecrist restarts vpnHelper
17:45 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 258 seconds]
17:50 -!- fread2281 [~fread2281@70-56-140-80.albq.qwest.net] has quit [Ping timeout: 252 seconds]
17:50 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
17:51 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
17:52 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
17:52 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:53  * ecrist accidentally shut down the damn vmware box
17:54 -!- fread2281 [~fread2281@70-56-209-5.albq.qwest.net] has joined #openvpn
18:07 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 252 seconds]
18:11 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
18:11 -!- mode/#openvpn [+o vpnHelper] by ChanServ
18:13 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
18:23 -!- fread2281 [~fread2281@70-56-209-5.albq.qwest.net] has quit [Remote host closed the connection]
18:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
18:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:41 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
18:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:59 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
19:04 <@vpnHelper> RSS Update - forum: Want to use OpenVPN client in router instead of software! <http://forums.openvpn.net/topic9023.html>
19:22 -!- Denial [~Denial@drgi.co.uk] has quit []
19:31 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Read error: Connection reset by peer]
19:32 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
19:36 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Operation timed out]
19:36 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
19:37 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:58 -!- _julian_ [~quassel@hmbg-4d06c48a.pool.mediaWays.net] has joined #openvpn
20:01 -!- _julian [~quassel@hmbg-4d0691ff.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
20:16 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
20:41 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:48 -!- adolfomaltez [~taro@190.62.254.245] has joined #openvpn
21:04 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 256 seconds]
21:06 -!- adolfomaltez1 [~taro@190.62.220.97] has joined #openvpn
21:07 -!- adolfomaltez1 [~taro@190.62.220.97] has quit [Remote host closed the connection]
21:07 -!- adolfomaltez [~taro@190.62.254.245] has quit [Ping timeout: 255 seconds]
21:36 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has quit [Quit: AAAGH!  IT BURNS!]
21:41 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
22:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:36 -!- adolfomaltez [~taro@190.62.206.205] has joined #openvpn
22:41 -!- adolfomaltez [~taro@190.62.206.205] has quit [Ping timeout: 248 seconds]
22:42 -!- adolfomaltez [~taro@190.62.239.193] has joined #openvpn
22:45 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-wsomfqqypjgdlmop] has quit [Ping timeout: 260 seconds]
22:52 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-xcwbvkigtjkjypmw] has joined #openvpn
22:55 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Remote host closed the connection]
23:06 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
23:11 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
23:11 -!- r1ppa [~McBoingBo@mail.hrsg.ca] has quit [Quit: Leaving]
23:11 <@vpnHelper> RSS Update - forum: Unable to Ping Behind Server in Bridge Mode in OpenVPN <http://forums.openvpn.net/topic8987.html#p16582>
23:21 -!- donspaulding [~donspauld@static-50-40-43-106.bltn.il.frontiernet.net] has quit [Quit: Leaving.]
23:39 -!- IsilZha [~andreas@182.55.249.76] has quit [Ping timeout: 276 seconds]
23:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
23:43 -!- donspaulding [~donspauld@173.155.111.71] has joined #openvpn
23:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:54 -!- IsilZha [~andreas@182.55.249.1] has joined #openvpn
23:59 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16583>
--- Day changed Fri Oct 14 2011
00:04 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
00:17 <@vpnHelper> RSS Update - forum: Access a server through VPN on a firewall from outside <http://forums.openvpn.net/topic9021.html#p16585> || OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html>
00:32 -!- luneff [~yury@84.51.192.74] has joined #openvpn
00:56 -!- donspaulding [~donspauld@173.155.111.71] has quit [Quit: Leaving.]
01:16 -!- psychik [~psy@2a01:e35:1384:3c90:1e6f:65ff:feca:2202] has left #openvpn ["Quitte"]
01:27 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:36 <@vpnHelper> RSS Update - forum: Access a server through VPN on a firewall from outside <http://forums.openvpn.net/topic9021.html#p16586>
01:42 <@vpnHelper> RSS Update - forum: Want to use OpenVPN client in router instead of software! <http://forums.openvpn.net/topic9023.html#p16588> || openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953-15.html#p16587>
01:43 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
01:49 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
02:07 -!- mirco [~mirco@p508027D1.dip.t-dialin.net] has joined #openvpn
02:21 -!- mirco [~mirco@p508027D1.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
02:25 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:36 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16589>
02:37 -!- lahiru [~kvirc@119.235.3.224] has joined #openvpn
02:38 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
02:38 < lahiru> helo all
02:39 < lahiru> I installed openvpn-as virtual appliance VMWare ESXI
02:39 < lahiru> I did everything according to the installation guide
02:40 < lahiru> but the service doesnt work
02:40 < lahiru> i get the fillowing in openvpnas log
02:40 < lahiru> Server Agent initialization status: {'errors': {'web': [('error', "process started and then immediately exited:
02:41 < lahiru> wisted.internet.error.CannotListenError: Couldn't listen on 127.0.0.1:904: [Errno 99] Cannot assign requested address.")
02:41 < lahiru> can anyone help me on this please..?
02:41 <@vpnHelper> RSS Update - forum: Certificate error [Solved] <http://forums.openvpn.net/topic9017.html#p16591>
02:48 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16593> || OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16592>
02:54 <@vpnHelper> RSS Update - forum: Access a server through VPN on a firewall from outside <http://forums.openvpn.net/topic9021.html#p16594>
03:06 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16595>
03:07 -!- mirco [~mirco@80.128.101.130] has joined #openvpn
03:12 -!- bitterman [~yury@109.165.2.172] has joined #openvpn
03:12 <@vpnHelper> RSS Update - forum: Certificate error [Solved] <http://forums.openvpn.net/topic9017.html#p16596>
03:15 < lahiru> I installed openvpn-as virtual appliance VMWare ESXI
03:15 < lahiru> I did everything according to the installation guide
03:15 < lahiru> but the service doesnt work i get the fillowing in openvpnas log
03:15 < lahiru> Server Agent initialization status: {'errors': {'web': [('error', "process started and then immediately exited:
03:15 < lahiru> [ wisted.internet.error.CannotListenError: Couldn't listen on 127.0.0.1:904: [Errno 99] Cannot assign requested address.")
03:15 < lahiru> can anyone help me on this please..?
03:19 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
03:19 < EugeneKay> lahiru - #openvpn-as
03:25 -!- patelx [nebula@openvpn/corp/admin/patel] has joined #openvpn
03:25 -!- mode/#openvpn [+o patelx] by ChanServ
03:26 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:26 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:36 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16597>
03:42 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16598>
03:48 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16599>
03:51 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 258 seconds]
04:00 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
04:14 -!- bitterman [~yury@109.165.2.172] has quit [Quit: Leaving]
04:15 -!- luneff [~yury@109.165.2.172] has joined #openvpn
04:18 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16600>
04:20 < hyper_ch> that thread's going hot :)
04:27 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
04:35 -!- twister004 [~chatzilla@117.204.135.211] has joined #openvpn
04:36 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16601>
04:53 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
04:56 -!- twister004 [~chatzilla@117.204.135.211] has quit [Ping timeout: 252 seconds]
05:02 -!- mirco [~mirco@80.128.101.130] has quit [Quit: mirco]
05:03 -!- twister004 [~chatzilla@117.204.135.211] has joined #openvpn
05:05 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 245 seconds]
05:13 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16602>
05:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
05:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:18 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
05:40 -!- _julian_ [~quassel@hmbg-4d06c48a.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
06:00 -!- _julian [~quassel@hmbg-5f77c27f.pool.mediaWays.net] has joined #openvpn
06:00 <@vpnHelper> RSS Update - forum: VPN subnet and printer <http://forums.openvpn.net/topic9025.html>
06:09 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
06:10 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
06:11 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
06:12 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 244 seconds]
06:15 -!- _julian_ [~quassel@hmbg-5f76112b.pool.mediaWays.net] has joined #openvpn
06:16 -!- K1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:17 -!- _julian [~quassel@hmbg-5f77c27f.pool.mediaWays.net] has quit [Ping timeout: 256 seconds]
06:23 -!- twister004_ [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
06:25 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019.html#p16604>
06:26 -!- twister004 [~chatzilla@117.204.135.211] has quit [Ping timeout: 244 seconds]
06:26 -!- twister004_ is now known as twister004
06:31 -!- novaflash_away is now known as novaflash
06:37 <@vpnHelper> RSS Update - forum: VPN subnet and printer <http://forums.openvpn.net/topic9025.html#p16606> || Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019-15.html#p16605>
06:37 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 244 seconds]
06:37 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
06:37 -!- cpm [~Chip@pool-96-247-181-201.altnpa.east.verizon.net] has joined #openvpn
06:37 -!- cpm [~Chip@pool-96-247-181-201.altnpa.east.verizon.net] has quit [Changing host]
06:37 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:37 -!- K1ng [~k1ng@unaffiliated/k1ng] has quit [Quit: WOMEN.EXE: A great program, but it doesn't come with documentation..]
06:42 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
06:43 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
06:47 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 276 seconds]
06:53 <@vpnHelper> RSS Update - forum: VPN subnet and printer <http://forums.openvpn.net/topic9025.html#p16607>
06:54 -!- jaminja [~jaminja@host31-52-25-64.range31-52.btcentralplus.com] has joined #openvpn
06:54 -!- jaminja [~jaminja@host31-52-25-64.range31-52.btcentralplus.com] has quit [Changing host]
06:54 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
06:59 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:05 <@vpnHelper> RSS Update - forum: How do I configure my server? <http://forums.openvpn.net/topic9010.html#p16608>
07:12 -!- esde [~jdekker@unaffiliated/esde] has joined #openvpn
07:12 -!- _julian_ is now known as _julian
07:12 -!- esde [~jdekker@unaffiliated/esde] has left #openvpn []
07:40 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:45 -!- auduny [~ay@mail.vgnett.no] has left #openvpn []
07:47 <@vpnHelper> RSS Update - forum: How do I configure my server? <http://forums.openvpn.net/topic9010.html#p16610> || VPN subnet and printer <http://forums.openvpn.net/topic9025.html#p16609>
07:59 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 244 seconds]
08:05 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 252 seconds]
08:07 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
08:13 -!- Denial [Denial@drgi.co.uk] has quit [Ping timeout: 244 seconds]
08:13 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
08:18 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:18 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:18 -!- mode/#openvpn [+v Axeman] by ChanServ
08:19 -!- chokesmaster [~chokesmas@69.157.245.233] has quit []
08:20 -!- adolfomaltez [~taro@190.62.239.193] has quit [Remote host closed the connection]
08:23 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
08:29 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
08:38 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Connection reset by peer]
08:38 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
08:50 -!- madsage [sage@2001:470:c:1292::2] has quit [Ping timeout: 240 seconds]
08:50 -!- Splex [~splex@unaffiliated/splex] has left #openvpn []
09:03 -!- lahiru [~kvirc@119.235.3.224] has quit [Ping timeout: 255 seconds]
09:06 -!- master_of_master [~master_of@p57B55EC9.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
09:07 -!- master_of_master [~master_of@p57B53526.dip.t-dialin.net] has joined #openvpn
09:14 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
09:19 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
09:20 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
09:20 -!- luneff [~yury@109.165.2.172] has quit [Quit: This computer has gone to sleep]
09:41 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
09:46 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
09:51 -!- luneff [~yury@84.51.192.74] has joined #openvpn
09:51 -!- luneff [~yury@84.51.192.74] has quit [Remote host closed the connection]
09:53 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
09:53 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
09:59 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:05 -!- davlefou__ [~david@41.225.9.81] has joined #openvpn
10:05 -!- davlefou__ [~david@41.225.9.81] has left #openvpn ["Konversation terminated!"]
10:06 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
10:12 -!- luneff [~yury@84.51.192.74] has joined #openvpn
10:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
10:13 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
10:13 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
10:13 -!- ravel [ravel@175.136.82.14] has joined #openvpn
10:18 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:28 <@vpnHelper> RSS Update - forum: Peer to Peer communication between clients <http://forums.openvpn.net/topic8989.html#p16611>
10:30 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
10:34 <@vpnHelper> RSS Update - forum: How do I configure OpenVPN as a Gateway client for Witopia? <http://forums.openvpn.net/topic7684.html#p16612>
10:36 -!- donspaulding [~donspauld@173.155.111.71] has joined #openvpn
10:40 -!- andy [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
10:42 -!- donspaulding [~donspauld@173.155.111.71] has quit [Quit: Leaving.]
10:43 -!- andy [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Client Quit]
10:43 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
10:50 -!- madsage [sage@2001:470:c:1292::2] has joined #openvpn
11:01 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
11:01 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
11:01 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
11:22 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
11:27 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
11:27 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 258 seconds]
11:31 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
11:31 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
11:31 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
11:34 -!- novaflash is now known as novaflash_awayfo
11:41 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
11:47 -!- novaflash_awayfo is now known as novaflash
--- Log closed Fri Oct 14 11:58:31 2011
--- Log opened Fri Oct 14 11:58:38 2011
11:58 -!- ecrist_ [~ecrist@216.17.68.153] has joined #openvpn
11:58 -!- Irssi: #openvpn: Total of 146 nicks [5 ops, 0 halfops, 2 voices, 139 normal]
11:59 -!- Irssi: Join to #openvpn was synced in 38 secs
12:00 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Read error: Connection reset by peer]
12:00 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 255 seconds]
12:02 < Optic> driving into downtown toronto isn't difficult, but you don't really have to
12:02 < Optic> you could park at Yorkdale mall on the 401 and subway in
12:03 < Optic> oops
12:21 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
12:25 -!- ravel [ravel@175.136.82.14] has quit []
12:31 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
12:43 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Remote host closed the connection]
12:44 <@vpnHelper> RSS Update - forum: Access computers behind the openVPN Server <http://forums.openvpn.net/topic9019-15.html#p16613>
12:56 -!- You're now known as ecrist
13:00 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
13:12 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
13:17 < madsage> whats new
13:17 < madsage> kangaroos
13:29 < nifiga> hi
13:30 < nifiga> I have a cert for openvpn on my notebook. I'd like to put it on my another pc. Can my provider find out that I'm coming from another computer?
13:30 < nifiga> I mean mac address or something similar
13:31 < SviMik> yes, mac address of tap interface will be different.
13:31 < nifiga> Can I change it? 
13:33 < nifiga> Can other side see the mac of my interface btw? 
13:33 < SviMik> yes, you can try to chage it in openvpn's adapter settings
13:34 < nifiga> heh
13:34 < nifiga> actually it is random each time I create a tap interface :D
13:35 < nifiga> anything else except mac?
13:35 < SviMik> I think no :)
13:36 < SviMik> why your provider doesn't allow to change pc? usually it's not a problem
13:36 < nifiga> security :D
13:37 < SviMik> he can also see your IP address you are connecting from
13:39 < nifiga> it's ok. I can connect from everywhere, but I should use my notebook :)
13:40 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
13:41 < SviMik> (it's not openvpn related, but...) he can also scan your computer name if you are not blocking such things in firewall
13:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
13:44 < SviMik> it's also easy to change in Windows
13:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:46 < nifiga> I don't think he is using anything more than simple automatic checks
14:25 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
14:27 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
14:27 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
14:27 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
14:42 -!- s3r3n1t7 [~s3r3n1t7@unaffiliated/s3r3n1t7] has joined #openvpn
14:44 < s3r3n1t7> I'm trying to get up a site to site VPN connection and the connection itself is coming up from what I can see in the log files. However, from the 2 lans behind the 2 vms making the connections, there's no way to access the other subnet. From what I can see, there's no return path and google tells me I should add an iroute to the client config directory file. Is there an easy way to check if that file is being read by the other vm?
14:45 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
14:50 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
14:55 <@vpnHelper> RSS Update - forum: hoe to block p2p <http://forums.openvpn.net/topic9026.html>
14:56 < EugeneKay> !route
14:56 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
14:56 < EugeneKay> s3r3n1t7 ^
15:01 < s3r3n1t7> thank you EugeneKay, i'll read it
15:16 -!- novaflash is now known as novaflash_away
15:17 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
15:19 < s3r3n1t7> EugeneKay, if you don't mind. After reading the link you gave me I'm still not sure how I can check if the ccd is being read for this client. I'm still getting the log files, the ccd option is in the server config but pings still don't come through. 
15:19 < EugeneKay> The iroute entry in the ccd will cause the named route to NOT be pushed to the client
15:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
15:19 < EugeneKay> So, if the route isn't pushed, it worked.
15:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:25 < s3r3n1t7> Then from what i can see I've set it all up properly. The iroute that i've set for the client doesn't show up in the log files, so from what i can see it's not being pushed, added the routes in the server config, but i'm stumped why it's not working as it should ... 
15:29 < s3r3n1t7> disregard that, i made such a stupid typo
15:29 < s3r3n1t7> it works! <3
15:29 < s3r3n1t7> thanks EugeneKay!
15:30 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
15:40 -!- nicehs [~nicehs@189.90.242.253] has joined #openvpn
15:44 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
15:45 < nicehs> how if possible to disable all logging?  like client traffic and client connections.
15:45 < nicehs> also, tricky to setting up chained vpns?  im newb to linux&openvpn,think its something i can do without fking up many boxes in the process..?
15:49 < EugeneKay> Turn verb down
15:51 < nicehs> thx, but wont stuff still be logged in syslog or somehere, or nothng at all being logged by openvpn if verb=0 ?
15:52 < EugeneKay> Per the man page(which you should read), verb 0 == No output except fatal errors. 
15:52 < nicehs> ok thx
15:59 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
16:00 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:00 -!- NiveusLuna [~niveuslun@fedora/NiveusLuna] has joined #openvpn
16:00 < NiveusLuna> !welcome
16:00 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:01 < NiveusLuna> Oooh. I like.
16:01 < NiveusLuna> !howto
16:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:01 < NiveusLuna> Hum. The bot doesn't work via PM. Doesn't that make things a bit spammy in here?
16:03 < SviMik> yes, I also noticed it...
16:10 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
16:12 < NiveusLuna> Okay... I want to set up a vpn for secure web browsing. Is there a guide for that somewhere?
16:13 <@vpnHelper> RSS Update - forum: Native v6 support? <http://forums.openvpn.net/topic9027.html>
16:13 < EugeneKay> !blame
16:13 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
16:14 < NiveusLuna> Or do I just get to set it up normally, then create an http proxy?
16:15 < EugeneKay> !redirect
16:15 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
16:15 < EugeneKay> !def1
16:15 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:15 < EugeneKay> ^^
16:15 < NiveusLuna> thanks.
16:15 < EugeneKay> Basically, you push a route to the client which will override the default gateway(but not replace it)
16:16 < NiveusLuna> I've tried reading the docs, but none of it makes sense to me. >_>
16:16 < EugeneKay> OpenVPN(and existing connections) keep working via the real default GW because they are already established.
16:16 < NiveusLuna> I get to tell my router how to reach 10.0.0.0/8, too...
16:18 < NiveusLuna> Or maybe 192.168.7.0/24 would keep me from having to make such a route... bah. this would be so much easier if my server were also my router. >_>
16:19 < EugeneKay> I use a Core i3 with 8GB of ddr3 s my home router :-D
16:21 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:35 -!- nicehs_ [~nicehs@189.90.242.253] has joined #openvpn
16:36 -!- nicehs [~nicehs@189.90.242.253] has quit [Ping timeout: 248 seconds]
16:36 -!- nicehs_ is now known as nicehs
16:36 -!- corretico [~luis@201.201.44.82] has joined #openvpn
16:42 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
16:56 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
16:58 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
17:13 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
17:24 < nicehs> much more tricky to setup chained vpns than a single vpn?  im new to linux,openvpn,networking etc. in general,managing servers remotely afraid ill mess up n lose connection, wondering whether to try or not, hm..can anyone tell if they think its very complicated or not much worse than normal openvpn setup that i should be able to manage?
17:29 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 265 seconds]
17:29 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
17:29 < nifiga> nicehs, disable redirect-gateway and play with single routes and you won't break anything
17:30 < nicehs> k thx will try look into that then..
17:44 < vect0rx> I have to admit, the more I read, the simpler OpenVPN seems to be.  I had cooked it up to be way complex by assuming things from cfg files
17:48 < nicehs> ya,i have some default settings-template in my head for some servers now that works pretty smooth..few simple settings i change in config then few iptables rules. tho seems easy with these basics now it took me a while of googling to get there, gave up many times over the years on this way:d
17:49 < nicehs> the routing part seems the worst i think..weird stuff,hard to figure iptables n all:S
17:53 < SviMik> I started learning with TAP due to much easier routing
17:55 < SviMik> it doesn't requires iptables at all (or, a very simple rule if you need NAT, like NATing ordinary local network) 
17:58 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
18:11 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
18:25 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
18:34 -!- nicehs_ [~nicehs@189.90.242.253] has joined #openvpn
18:36 -!- nicehs [~nicehs@189.90.242.253] has quit [Ping timeout: 248 seconds]
18:46 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:51 -!- nicehs [~nicehs@189.90.242.253] has joined #openvpn
18:53 -!- nicehs_ [~nicehs@189.90.242.253] has quit [Ping timeout: 258 seconds]
18:53 -!- nicehs [~nicehs@189.90.242.253] has quit [Remote host closed the connection]
18:54 -!- nicehs [~nicehs@189.90.242.253] has joined #openvpn
18:56 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:07 -!- raidz is now known as raidz_afk
19:14 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:26 <@vpnHelper> RSS Update - forum: Using web hosting account for VPN tunnel <http://forums.openvpn.net/topic9004.html#p16616>
19:26 -!- NiveusLuna [~niveuslun@fedora/NiveusLuna] has left #openvpn []
19:27 -!- _julian_ [~quassel@hmbg-5f7664d3.pool.mediaWays.net] has joined #openvpn
19:28 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:28 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
19:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:28 -!- mode/#openvpn [+v Axeman] by ChanServ
19:30 -!- _julian [~quassel@hmbg-5f76112b.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
19:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
19:47 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:49 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
19:53 -!- gardar [~gardar@gardar.net] has joined #openvpn
19:53 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
19:54 -!- gardar [~gardar@gardar.net] has joined #openvpn
19:54 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
19:55 -!- gardar [~gardar@gardar.net] has joined #openvpn
19:55 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
19:55 -!- gardar [~gardar@gardar.net] has joined #openvpn
19:55 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
19:56 -!- gardar [~gardar@gardar.net] has joined #openvpn
20:01 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
20:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:19 -!- EugeneKay [eugene@itvends.com] has quit [Quit: ZNC - http://znc.in]
20:20 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
20:31 -!- gardar [~gardar@gardar.net] has joined #openvpn
20:37 -!- raidz_afk is now known as raidz
20:42 -!- nicehs [~nicehs@189.90.242.253] has quit []
21:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:11 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:18 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
21:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:27 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:52 -!- catsup [~d@75.119.194.231] has quit [Remote host closed the connection]
21:53 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
22:20 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
22:20 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
22:20 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:34 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:35 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:08 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
23:10 -!- luneff [~yury@84.51.192.74] has joined #openvpn
23:27 -!- ravel [ravel@175.136.82.14] has joined #openvpn
23:44 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
23:51 <@vpnHelper> RSS Update - forum: Force IP adresses to go throught the Server <http://forums.openvpn.net/topic9028.html>
--- Day changed Sat Oct 15 2011
00:30 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
00:58 -!- ravel_out [ravel@175.136.82.14] has joined #openvpn
01:01 -!- ravel [ravel@175.136.82.14] has quit [Ping timeout: 252 seconds]
01:11 -!- nicehs [~nicehs@189.90.242.253] has joined #openvpn
01:18 -!- nicehs [~nicehs@189.90.242.253] has left #openvpn []
01:33 <@vpnHelper> RSS Update - forum: hoe to block p2p <http://forums.openvpn.net/topic9026.html#p16618>
01:33 -!- nicehs [~nicehs@189.90.242.253] has joined #openvpn
01:35 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
01:36 < nicehs> hi, in the client file i can set http-proxy altho then i have to use TCP instead of UDP as i do now.  wondering, if I do try to connect to it thru proxy and set it to tcp, will it still forward all traffic on all ports normally even tho im connecting to the vpn-server thru a http proxy..? thought it was only for http traffic or did i miss something?  im trying to stay secure/hidden, want a 
01:36 < nicehs> way to connect to a vpn without my ip coming in contact with it, wanna setup other ips to relay traffic somehow wondering if this http-proxy setting can be enough.
01:39 <@vpnHelper> RSS Update - forum: Force IP adresses to go throught the Server <http://forums.openvpn.net/topic9028.html#p16619>
01:46 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
02:05 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
02:12 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:21 <@vpnHelper> RSS Update - forum: hoe to block p2p <http://forums.openvpn.net/topic9026.html#p16620>
02:23 -!- nicehs [~nicehs@189.90.242.253] has quit [Ping timeout: 260 seconds]
02:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
02:24 -!- nicehs [~nicehs@189.90.242.253] has joined #openvpn
02:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
02:33 -!- nicehs [~nicehs@189.90.242.253] has quit [Ping timeout: 252 seconds]
02:33 -!- nicehs [~nicehs@189.90.242.253] has joined #openvpn
02:46 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
02:49 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
02:58 -!- nicehs [~nicehs@189.90.242.253] has quit []
03:15 -!- nicehs [~nicehs@189.90.242.253] has joined #openvpn
03:19 -!- raidz is now known as raidz_afk
03:32 -!- nicehs [~nicehs@189.90.242.253] has quit [Ping timeout: 245 seconds]
03:40 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
03:40 < EugeneKay> w00t. The NIC I've been wanting to buy dropped down to $28.
03:43 < takamichi> Hey, are there any known issues with DNS settings being propegated to Linux clients?
03:44 < EugeneKay> Yes. It doesn't work. You need to use a client-side script to make them take effect.
03:46 < takamichi> Do you mean it doesn't work in all cases, or there is a known issue is some cases?
03:46 < takamichi> And do you know of any available examples scripts?
03:47 < EugeneKay> I mean, it doesn't work in linux.
03:47 < takamichi> ok
03:47 < EugeneKay> Linux dhclient is nothing like windows dhclient. 
03:47 < EugeneKay> !dhcp
03:47 <@vpnHelper> "dhcp" is redirect-gateway bypass-dhcp gets around the problem of DHCP packets to the local DHCP server being incorrectly routed into the tunnel. Available in 2.1
03:47 < EugeneKay> No, hat's not in
03:47 < EugeneKay> !factoids search dns
03:47 <@vpnHelper> 'pushdns', 'dns', 'splitdns', 'win-dns-vista-7', 'win-dns-xp', and 'win-dns'
03:48 < EugeneKay> !dns
03:48 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
03:48 < EugeneKay> !pushdns
03:48 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
03:48 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
03:48 < EugeneKay> See #4
03:48 < takamichi> ok awesone, thanks EugeneKay!
03:48 < EugeneKay> Depending upon distro, you may also be fighting the resolvd or resolvconfd, or whatever it's called.
03:49 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
03:49 < takamichi> I understand
03:52 < EugeneKay> Good.
04:13 -!- novaflash_away is now known as novaflash
04:19 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has joined #openvpn
04:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
04:43 -!- bzpzlr [~bzpzlr@121.1.54.50] has joined #openvpn
04:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:50 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
04:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
04:56 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has quit []
05:06 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 245 seconds]
05:07 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
05:09 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has joined #openvpn
05:09 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 248 seconds]
05:12 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
05:40 <@vpnHelper> RSS Update - forum: Force IP adresses to go throught the Server <http://forums.openvpn.net/topic9028.html#p16621>
05:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:58 <@vpnHelper> RSS Update - forum: Force IP adresses to go throught the Server <http://forums.openvpn.net/topic9028.html#p16622>
06:12 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
06:12 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
06:13 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
06:25 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 255 seconds]
06:26 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
06:30 -!- sigi [~sigius@93.125.185.45] has joined #openvpn
06:32 -!- _julian_ [~quassel@hmbg-5f7664d3.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
06:34 -!- _julian [~quassel@hmbg-4d06d0b6.pool.mediaWays.net] has joined #openvpn
06:46 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:46 -!- mode/#openvpn [+v s7r] by ChanServ
07:04 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 240 seconds]
07:05 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
07:16 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Ping timeout: 244 seconds]
07:26 -!- sigi [~sigius@93.125.185.45] has quit [Read error: Connection reset by peer]
07:26 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
07:36 -!- trumee [~trumee@cpc2-cmbg7-0-0-cust855.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
07:40 -!- trumee [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has joined #openvpn
07:44 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
07:44 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
08:09 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:12 -!- ravel_out [ravel@175.136.82.14] has quit [Ping timeout: 255 seconds]
08:15 -!- ravel [ravel@175.136.82.14] has joined #openvpn
08:20 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
08:51 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
08:54 -!- W4lth3r|off is now known as W4lth3r
09:05 -!- master_of_master [~master_of@p57B53526.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:07 -!- master_of_master [~master_of@p57B52388.dip.t-dialin.net] has joined #openvpn
09:11 -!- chokesmaster [~chokesmas@65.92.83.242] has joined #openvpn
09:14 -!- Denial [~Denial@drgi.co.uk] has quit []
09:17 -!- chokesmaster [~chokesmas@65.92.83.242] has quit []
09:19 -!- chokesmaster [~chokesmas@65.92.83.242] has joined #openvpn
09:19 -!- trumee [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
09:20 -!- bzpzlr [~bzpzlr@121.1.54.50] has quit [Quit: Lost terminal]
09:22 -!- trumee [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has joined #openvpn
09:22 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
09:41 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 276 seconds]
09:42 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:44 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
09:47 <@vpnHelper> RSS Update - forum: Force IP adresses to go throught the Server <http://forums.openvpn.net/topic9028.html#p16623>
09:52 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 258 seconds]
09:52 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
09:54 -!- dennisf [~defl@dhcp-077-251-205-084.chello.nl] has joined #openvpn
09:54 < dennisf> hi
09:56 < dennisf> I'm trying to set up a plain-vanilla-as-per-example tun VPN between 2 lans following (http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing) but after the inbound tun on the remote gate the packets are lost, all firewalls are disabled
09:56 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
09:57 < dennisf> anyone here care to lend a few braincells to solve the problem?
09:58 < cherwin> dennisf: Man, you gave so little information. Please elaborate. Also, the problem is your firewall, really.
10:00 < Olipro> firewall or sysctl forwarding
10:00 < Olipro> dennisf: what OS is the remote gate
10:00 < dennisf> just wanting to feel if there's anyone here. I'll elaborate. I've got 2 lans (192.168.5.0/24) and 192.168.3.254/24. 192.168.5.254 hosts the openvpn server (2 series) and 192.168.3.254 hosts the client. Server and client connect via tun. All firewalls ipsec on accept and -x'ed (incl the -t nat) ipv4 forwarding enabled.
10:01 < Olipro> WHAT OS
10:01 < dennisf> server is ubuntu 11.04 client is debian 
10:01 < Olipro> sysctl net.ipv4.conf.all.forwarding
10:01 < Olipro> ^result should be 1
10:01 < dennisf> root@gate:~# sysctl net.ipv4.conf.all.forwarding
10:01 < dennisf> net.ipv4.conf.all.forwarding = 1
10:01 < dennisf> root@dmgate:/etc/openvpn# cat /proc/sys/net/ipv4/ip_forward 
10:01 < dennisf> 1
10:02 < Olipro> and you want to route between which two addresses?
10:02 < dennisf> 192.168.3.0/24 to 192.168.5.0/24
10:02 < dennisf> over a 10.87.87.0/24 tunnel
10:04 < Olipro> over... what
10:04 < dennisf> over the public internet. Both server and client have a public ip as well. 
10:04 < Olipro> you're not explaining your topology well
10:05 < Olipro> 10.0.0.0/8 is RFC1918
10:05 -!- Denial [~Denial@drgi.co.uk] has quit []
10:05 < dennisf> I know, from the openvpn config on the server: server 10.87.87.0 255.255.255.0
10:05 < Olipro> give an example of the route a packet from a system in 192.168.3.0/24 would have to take in order to reach something in 192.168.5.0/24
10:07 -!- raidz_afk is now known as raidz
10:08 < dennisf> workstation->(192.168.5.1) - > server:eth0 (192.168.5.254) ->server:tun0(10.87.87.1) -> internet -> client: tun0(10.87.87.6) -> client:eth1(192168.3.254)
10:09 < dennisf> obviously there can be workstations after the client, but I can't ping the client via the 192.168.3.254 IP (I can via the 10.87.87.6 though)
10:09 < dennisf> me in this case is the 192.168.5.1
10:09 < dennisf> so from server tcpdump:
10:10 < dennisf> 17:09:41.593708 IP 192.168.5.1 > 192.168.3.254: ICMP echo request, id 6829, seq 2, length 64
10:10 < dennisf> 17:10:08.467012 IP 192.168.5.1 > 10.87.87.6: ICMP echo request, id 6831, seq 1, length 64
10:10 < dennisf> 17:10:08.476554 IP 10.87.87.6 > 192.168.5.1: ICMP echo reply, id 6831, seq 1, length 64
10:10 < Olipro> so um, the server correctly routes the packet to the client?
10:10 < dennisf> yep
10:10 < dennisf> I can even see them coming in at the client's tun0
10:10 < Olipro> mmm
10:10 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
10:10 < Olipro> rp_filter
10:11 < dennisf> let me try disabling that...
10:11 < dennisf> good one
10:11 < Olipro> or just bind the address to tun0...
10:11 -!- Denial- [Denial@drgi.co.uk] has joined #openvpn
10:12 < Olipro> sending a packet with a destination address bound to a separate interface is bad form
10:12 < dennisf> ok, so setting /proc/sys/net/ipv4/icmp_echo_ignore_all to 0 let's me ping 10.87.87.6, setting it to 1 does not
10:13 < dennisf> (on client that is)
10:13 < Olipro> umm... well yes
10:13 < Olipro> that's what it does
10:13 < dennisf> doesn't solve the riddle why the client machine does not forward the packet from the tun0 to the eth1
10:15 < dennisf> is there any debugging setting which helps there? as far as I can probe with tcpdump it enters tun0 and that's the end of the packet. no errors
10:15 < Olipro> sysctl net.ipv4.conf.all.rp_filter
10:15 -!- Denial [~Denial@drgi.co.uk] has quit [Ping timeout: 260 seconds]
10:15 < Olipro> it's not "forwarding" because the address belongs to eth0
10:15 < dennisf> root@gate:~# sysctl net.ipv4.conf.all.rp_filter
10:15 < dennisf> net.ipv4.conf.all.rp_filter = 0
10:16 < dennisf> Olipro, well ok, let's move the example one further then. I'll start pinging a host beyond the machine, 192.168.3.200
10:16 < Olipro> the correct solution is to assign 192.168.3.254 to tun0 on the client
10:17 < dennisf> as that's the lan interface for the machine as well, you're saying I should bridge tun0 and eth1 and assign 192.168.3.254 to the brdige then?
10:17 < Olipro> bridge them?
10:18 < Olipro> umm
10:18 < dennisf> the client machine is the default gateway for the lan behind it
10:18 < Olipro> you should be able to ping an address inside 192.168.3.0/24 that's behind the client box
10:19 < dennisf> ok, so same issue when I try that. I see packet on server tun0 and on client tun0 but not leaving the client machine
10:19 < Olipro> iptables -I FORWARD -j ACCEPT
10:19 < dennisf> Chain FORWARD (policy ACCEPT 3691 packets, 537K bytes)
10:19 < dennisf> all chains empty
10:20 < Olipro> net.ipv4.conf.all.forwarding ?
10:20 < dennisf> root@gate:~# sysctl net.ipv4.conf.all.forwarding
10:20 < dennisf> net.ipv4.conf.all.forwarding = 1
10:20 < Olipro> that's the client box yeah?
10:20 < dennisf> yea
10:20 < Olipro> ok, pastebin the contents of its "ip route"
10:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
10:21 < Olipro> and just to make sure nothing silly is happening, see if you can ping the target address successfully from the client
10:21 < EugeneKay> Olipro, you're a braver man than I.
10:22 < dennisf> yes I can, I'm logged on to it via the client
10:22 < dennisf> http://pastebin.com/iecL5u4S
10:22 < dennisf> EugeneKay, :-)
10:23 < Olipro> dennisf: iptables -t nat -vL
10:24 < dennisf> http://pastebin.com/gmmn4CCJ
10:24 < Olipro> and just to be clear, you're trying to ping an address in 192.168.3.0/24 that's *behind* the client - NOT the address bound to eth1 of the client
10:25 < dennisf> yes
10:25 < dennisf> the client has 192.168.3.254, the target I try to ping has 192.168.3.200
10:26 < dennisf> http://pastebin.com/7Ff4FdJ0
10:26 < Olipro> ok, and what route will 192.168.3.200 select to reply to the packet?
10:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:27 < dennisf> It's default route is the client as that is the default gateway of the lan. Though the packets are not even coming to 192.168.3.200 so it's not in the return channel
10:27 < dennisf> Route from the target: 0.0.0.0         192.168.3.254   0.0.0.0         UG    0      0        0 eth1
10:32 < Olipro> mm, tis rather strange
10:33 < Olipro> you said tcpdump on the client sees the packet coming in on tun0?
10:33 < dennisf> yes
10:33 < dennisf> root@gate:~# tcpdump icmp -i tun0 -n
10:33 < dennisf> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
10:33 < dennisf> listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
10:33 < dennisf> 17:40:03.454210 IP 192.168.5.1 > 192.168.3.200: ICMP echo request, id 7924, seq 1, length 64
10:33 < dennisf> that's the from client
10:34 < dennisf> but no packets on either lo, eth0 or eth1
10:37 < dennisf> so aside from tearing down the debian box and replacing it in the hope that that might help I've got no idea what's eating the packet... found no references to known Debian issues either (and would not expect to either...)
10:37 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
10:42 < dennisf> Olipro, thanks for the help
10:43 < dennisf> I was somewhat hoping that I made a glaring oops but apparently it's not that simple
10:43 < dennisf> have a good evening all
10:43 -!- dennisf [~defl@dhcp-077-251-205-084.chello.nl] has quit [Quit: Ex-Chat]
10:43 -!- djmitche [~djmitche@2001:470:1f11:826:4261:86ff:fef5:e224] has joined #openvpn
10:45 < djmitche> I'm having trouble with getting routes added on a connection - http://pastebin.mozilla.org/1356246 seems to show the routes added successfully, but none of those routes appear in 'route print'
10:46 -!- Denial- [Denial@drgi.co.uk] has quit []
10:49 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
10:54 < djmitche> ah, permissions problem (running as admin worked)
10:54 < djmitche> odd that it claimed to have succeeded :(
10:55 < djmitche> thanks for listening :)
10:55 -!- djmitche [~djmitche@2001:470:1f11:826:4261:86ff:fef5:e224] has left #openvpn []
11:16 -!- antii [~antii@unaffiliated/antii] has joined #openvpn
11:16 < antii> hmpf
11:16 < antii> openvpn client asks for credentials when im trying to connect to my server.. i havent specified any username password on the serverside :/
11:16 < Olipro> you see... the internet is like a series of tubes
11:20 < antii> lol forgot to specify .ovpn config..
11:20 < antii> well, im connected to the server now, but i dont get my servers ip :S
11:25 -!- Florin91 [~root@82.77.166.36] has joined #openvpn
11:37 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:42 -!- sia^pwnnt [115kluu@212.224.67.26] has quit [Ping timeout: 240 seconds]
11:46 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
11:53 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
11:53 -!- Florin91 [~root@82.77.166.36] has quit [Quit: Ex-Chat]
11:55 -!- sia^pwnnt [600epsi@owned.ninjasinpyjamas.biz] has joined #openvpn
12:01 <@vpnHelper> RSS Update - forum: Windwos 7+OpenVPN+user rights; nice solution for me <http://forums.openvpn.net/topic9030.html>
12:04 < antii> trying to route all traffic via openvpn, if i connect to my server i get a ip.. but webtraffic and so on goes through my own connection. http://pastebin.com/5sHKNipk
12:12 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has quit []
12:13 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has joined #openvpn
12:14 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has quit [Client Quit]
12:14 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has joined #openvpn
12:16 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
12:19 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
12:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
12:36 -!- Denial [Denial@drgi.co.uk] has quit []
12:49 <@vpnHelper> RSS Update - forum: Windwos 7+OpenVPN+user rights; nice solution for me <http://forums.openvpn.net/topic9030.html#p16625>
12:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
12:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:01 <@vpnHelper> RSS Update - forum: Windwos 7+OpenVPN+user rights; nice solution for me <http://forums.openvpn.net/topic9030.html#p16626>
13:07 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
13:08 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
13:14 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:14 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:14 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:15 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:45 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has left #openvpn []
14:19 -!- pierreghz [~pierreghz@cust-11-25-111-94.dyn.as47377.net] has joined #openvpn
14:23 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
14:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:30 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:30 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:42 -!- Denial [Denial@drgi.co.uk] has quit []
15:14 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Read error: Connection reset by peer]
15:23 -!- ravel [ravel@175.136.82.14] has quit []
15:46 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 256 seconds]
15:47 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 256 seconds]
15:47 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
15:48 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
15:52 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
16:18 -!- ehd [u1451@gateway/web/irccloud.com/x-gpodplaadexmywpm] has joined #openvpn
16:18 < ehd> hey
16:22 < EugeneKay> Is for horses
16:22 < krzie> and cows
16:23 < EugeneKay> and fat chicks
16:23 < krzie> right you are
16:23 < ehd> :)
16:23 -!- s3r3n1t7 [~s3r3n1t7@unaffiliated/s3r3n1t7] has quit [Read error: Connection reset by peer]
16:24 < ehd> i was wondering whether in server-bridge + tap mode i could have the tunnel clients use a real dhcp server which is running on the openvpn server
16:24 < EugeneKay> "TAP Bridging has been empirically shown to cause cancer, AIDS, and rape your cat. Do not use it."
16:25 < krzie> yes they could, but as EugeneKay alluded to, why would you be using bridge?
16:25 < ehd> tbh i don't have a reason, still need to grasp openvpn completely
16:26 < krzie> if you dont have a specific reason (a layer2 protocol that needs to access across the vpn) then its not the right way
16:26 < krzie> !tunortap
16:26 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
16:26 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
16:26 < krzie> you a linux user?
16:26 < krzie> (or any os with bash?)
16:26 < EugeneKay> Windows has bash >_>
16:26 < EugeneKay> The tty still sucks, but it has bash
16:26 < krzie> windows should be bashed
16:26 < ehd> linux server w/ os x clients
16:27 < krzie> my scripts may or may not support windows bash, untested and uncared about ;]
16:27 < ehd> i also have kvm domains running on the same box, they're using the aforementioned dhcp server
16:27 < krzie> ehd, you may like this:
16:27 < krzie> !confgen
16:27 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
16:27 < EugeneKay> Highly unlikely they will. Most windows bashes have ridiculously old gnu utils
16:27 < EugeneKay> Msysgit's bash has a version of grep from 2000.
16:28 < ehd> that's looking good, thank you
16:28 < krzie> it would depend mostly on bash itself
16:28 < krzie> like if it had heredocs, arrays, stuff like that
16:28 < EugeneKay> 3.15, it seems
16:29 < EugeneKay> Anyway..... don't use Bridged mode if your only purpose is to get DHCP. Please. Don't. Just don't.
16:29 < EugeneKay> I have a hammer you can smash your fingers with instead. It'll be more fun.
16:30 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
16:30 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
16:30 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
16:30 < ehd> i see your point, it really seems like a big pain in the ass to use tap when you don’t have to
16:31 < EugeneKay> TAP is fine to use. It's Bridged mode that's bad.
16:31 < krzie> +1
16:31 < krzie> although if theres no reason to use tap, ild still recommend tun
16:32 < EugeneKay> Until 2.3 is out, TAP+up scripts is the only realiable-ish way to get IPv6 payload
16:32 < krzie> right
16:32 < EugeneKay> -a
16:32 < ehd> ah, i see!
16:32 < krzie> and its the only way to do something like RIP/ospf over vpn without ptp tunnels
16:32 < EugeneKay> Though it should be pointed out that you can do 6in4 tunnels over tun interfaces.... but that's insanity to configure.
16:37 < ehd> awesome confgen script, thanks again
16:58 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has joined #openvpn
17:02 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
17:02 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
17:02 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
17:06 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
17:06 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16627>
17:07 < krzie> ehd, glad ya like it, you're welcome
17:17 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
18:03 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 258 seconds]
18:05 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has quit [Quit: La vérité, c'est que tu es mou et paresseux. Tout le portrait de mon oncle Émile : celui-là, il passait jamais au soleil parce que ça le fatiguait de traîner son ombre.]
18:05 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
18:59 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
19:04 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
19:04 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
19:04 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
19:46 -!- _julian_ [~quassel@hmbg-4d06b5e9.pool.mediaWays.net] has joined #openvpn
19:47 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 240 seconds]
19:49 -!- _julian [~quassel@hmbg-4d06d0b6.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
20:26 -!- novaflash is now known as novaflash_away
20:48 -!- r0ckY [~r0ckY@188-195-136-218-dynip.superkabel.de] has joined #openvpn
20:49 < r0ckY> hi, i have a problem connecting with an windows client (win 7 x64) to my network, which otherwise (other clients) works just fine
20:49 < r0ckY> i have verb 5 and it basically says nothing of interest :(
20:50 < r0ckY> the last line says "UDPv4 link remote: ip:port"
20:50 < r0ckY> and it stays there for a minute or so and then says "tls negotion failed"
20:53 < krzie> sounds like client's inet is firewalled
20:53 < krzie> possibly by the isp
20:53 < krzie> unless the server gets stuff in its logs during connect attempt...
20:54 < krzie> (assuming your config is right...)
20:56 < r0ckY> yeah, its the client firewall ... disabled and it works
20:57 < r0ckY> should have read the faq beforehand
20:57 < krzie> or the topic ;]
20:57 < r0ckY> funny thing is that it works for another connection on this client
20:57 < r0ckY> therefor i havent thought of it
21:02 < r0ckY> well, it doesnt work once again :( the server logs "TLS: Initial packet from [...]"
21:03 < r0ckY> and after 60 seconds "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)"
21:03 < r0ckY> any other things i could check
21:03 < r0ckY> can it be some wrong mtu setting? or wouldnt this be a problem in this state?
21:03 < ecrist> !mtu
21:03 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
21:03 < krzie> not at that point
21:04 < ecrist> !keepalive
21:04 < krzie> very unlikely ild say
21:04 < ecrist> see keepalive in the manual
21:04 < krzie> it never even gets to the tunnel eric
21:04 < ecrist> hi, krzie 
21:04 < krzie> no initial connection
21:04 < krzie> hey bro =]
21:05  * EugeneKay hides under a rock
21:05  * krzie sits on the rock
21:05  * ecrist poofs
21:05 < EugeneKay> w00t. Got a second Linode up for quintuply-redundant DNS
21:06 < EugeneKay> Next.... I can actually make my secondary MXes serve as caching relays
21:15 < r0ckY> so here is the full issue ... im multihomed, which works fine ... so ive got two ips for my openvpn server. i can connect to one of these, but not to the second. firewall settings should be fine as i find "TLS Initial packet" in both logs (server and client)
21:15 < r0ckY> so mtu would be the only thing i can think of, any other clues?
21:16 < krzie> netstat -ln, see if openvpn server is even listening on both ips or not
21:16 < krzie> ive never multihomed and im leaving work in a minute, so thats the end of my help ;]
21:22 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
21:22 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
21:22 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:22 -!- mode/#openvpn [+v Axeman] by ChanServ
21:33 -!- r0ckY [~r0ckY@188-195-136-218-dynip.superkabel.de] has quit [Ping timeout: 255 seconds]
21:47 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
21:55 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 240 seconds]
22:02 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
22:12 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has quit []
22:14 -!- inquirer [d897bf37@gateway/web/freenode/ip.216.151.191.55] has joined #openvpn
22:15 < inquirer> hello. May I ask where part of the source code of openvpn can I see the authentication process and how to bring up the tun device network?
22:18 -!- inquirer [d897bf37@gateway/web/freenode/ip.216.151.191.55] has left #openvpn []
22:34 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html>
22:36 -!- pierreghz_ [~pierreghz@cust-147-104-111-94.dyn.as47377.net] has joined #openvpn
22:39 -!- pierreghz [~pierreghz@cust-11-25-111-94.dyn.as47377.net] has quit [Ping timeout: 245 seconds]
22:41 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:45 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 244 seconds]
22:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
23:10 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:26 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
23:31 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Ping timeout: 240 seconds]
23:54 -!- up_the_irons [~garry@iron.arpnetworks.com] has joined #openvpn
--- Day changed Sun Oct 16 2011
00:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
00:17 -!- luneff [~yury@84.51.192.74] has joined #openvpn
00:43 < EugeneKay> he's buggered off, but the solution to r0ckY's issue is to use DNAT in the nat table.
00:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
00:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:49 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 252 seconds]
00:50 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 245 seconds]
00:50 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
01:15 -!- luneff [~yury@109.165.21.252] has joined #openvpn
02:02 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16629>
02:14 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
02:22 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
02:26 -!- EugeneKay is now known as EugeneSleep
02:33 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16630>
02:45 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16632>
02:47 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:02 < antii> hi
03:09 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16633>
03:13 -!- antii [~antii@unaffiliated/antii] has left #openvpn ["bye"]
03:21 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16634>
03:34 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 258 seconds]
03:35 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
03:41 -!- raidz is now known as raidz_afk
04:03 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 258 seconds]
04:05 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
04:15 <@vpnHelper> RSS Update - forum: Newbie has problems with OpenVPN client <http://forums.openvpn.net/topic9033.html>
04:41 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 258 seconds]
04:41 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
04:43 -!- bitterman [~yury@109.165.21.252] has joined #openvpn
04:45 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
04:45 -!- luneff [~yury@109.165.21.252] has quit [Ping timeout: 252 seconds]
04:53 -!- novaflash_away is now known as novaflash
04:54 -!- gallatin [~gallatin@dslb-188-109-174-191.pools.arcor-ip.net] has joined #openvpn
04:59 -!- `Orum [~egr@unaffiliated/orum] has joined #openvpn
05:02 < `Orum> In a situation where you have a client tracking a server using a dynamic DNS updater, if the client restarts due to ping-restart, and looks up the record which hasn't been updated yet (or cached and the TTL hasn't expired), will it ever restart again, or does that only work if it was connected at one point?
05:03 < `Orum> And if you set resolv-retry to a finite number, will that cause it to restart at some point?
05:03 < `Orum> or only if the lookup fails at some point?
05:16 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 260 seconds]
05:17 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
05:57 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16636>
06:07 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 260 seconds]
06:07 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
06:09 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16637>
06:19 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
06:21 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16638>
06:33 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16639>
06:40 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16640>
06:49 -!- bitterman [~yury@109.165.21.252] has quit [Ping timeout: 256 seconds]
06:52 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16641>
06:52 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Quit: reboot]
06:55 -!- luneff [~yury@109.165.96.234] has joined #openvpn
06:56 -!- pierreghz_ [~pierreghz@cust-147-104-111-94.dyn.as47377.net] has quit [Ping timeout: 248 seconds]
06:59 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
07:16 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16642>
07:34 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032.html#p16643>
07:34 -!- gallatin [~gallatin@dslb-188-109-174-191.pools.arcor-ip.net] has quit [Quit: Client exiting]
07:37 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Ping timeout: 252 seconds]
07:40 <@vpnHelper> RSS Update - forum: openvpn client lport hangs <http://forums.openvpn.net/topic9034.html>
07:52 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032-15.html#p16645>
07:54 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
08:03 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
08:03 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
08:08 -!- sia^pwnnt [600epsi@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 258 seconds]
08:16 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032-15.html#p16646>
08:20 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
08:20 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
08:33 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
08:34 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032-15.html#p16647>
08:40 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has joined #openvpn
08:43 < windrop> Any Windows 7 64-bit users in here?
08:45 < reiffert> windrop: probably yes
08:45 < windrop> reiffert: :>
08:47 < hyper_ch> people still use windows?
08:48 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:52 < windrop> I'm not sure what's going on. I get the connected and assigned IP message, but the IP won't change.
08:53 < windrop> And this is why I'd like to get in contact with Windows 7 64-bit users. What am I doing wrong?
08:59 < reiffert> I've got a shell and rsync problem, ideas? http://pastebin.com/B0SmhWT0
09:06 -!- master_of_master [~master_of@p57B52388.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
09:08 -!- master_of_master [~master_of@p57B552AB.dip.t-dialin.net] has joined #openvpn
09:14 -!- windrop [~windrop@h209n3-mael-a12.ias.bredband.telia.com] has left #openvpn []
09:28 <@vpnHelper> RSS Update - forum: IPTABLES secure Internet tunnel <http://forums.openvpn.net/topic7722.html#p16648>
09:34 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16649>
09:38 -!- mick_laptop [~mick@mickweiss.com] has quit [Changing host]
09:38 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
09:40 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032-15.html#p16650>
09:41 -!- raidz_afk is now known as raidz
09:43 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
09:46 <@vpnHelper> RSS Update - forum: openvpn client lport hangs <http://forums.openvpn.net/topic9034.html#p16651>
10:06 < ehd> mom
10:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
10:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:15 < ehd> meh, wrong window. sorry bout that.
10:15 < ehd> also, "mom" is abbrev. for "wait a second" in german :p
10:15 < krzee> ahh like moment
10:18 < ehd> right
10:19 < krzee> moinmoin
10:37 -!- luneff [~yury@109.165.96.234] has quit [Quit: This computer has gone to sleep]
10:52 -!- jemand [~quassel@brln-4db9ebf6.pool.mediaWays.net] has joined #openvpn
10:57 <@vpnHelper> RSS Update - forum: DNS queries through established client access tunnel <http://forums.openvpn.net/topic9035.html>
11:13 < jeev> that's weird, when krzee says "mom" he's calling for his milk
11:20 -!- luneff [~yury@84.51.192.74] has joined #openvpn
11:27 -!- Florin91 [~john@82.77.166.36] has joined #openvpn
11:27 < Florin91> Hi!
11:30 < krzee> jeev, your mom told you about that?
11:31 < krzee> she said i needed to keep it secret, weird she said something...
11:39 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
11:51 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 600 seconds]
11:56 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
12:20 < ehd> i have one remaining problem with my openvpn setup. i can't reach any hosts on the server's lan though i can reach the main server via its other ip 10.0.100.1 - my config is here https://gist.github.com/5843340f989279eb187e
12:20 <@vpnHelper> Title: openvpn configs Gist (at gist.github.com)
12:29 < ehd> havent seen anything hitting iptables either
12:30 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
12:30 < vect0rx> Is it a good idea to turn off LZO on DD-WRT routers to do openvpn?   being that their cpu's are like a couple hundred mhz
12:31 -!- Denial [~Denial@drgi.co.uk] has quit [Client Quit]
12:31 < vect0rx> or any other cpu-saving tips (I guess smaller sized keys or certain ciphers over others)
12:34 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
12:35 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
12:37 -!- adolfomaltez [~taro@190.62.179.253] has joined #openvpn
12:42 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Operation timed out]
12:52 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
12:58 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Quit: Reconnecting]
12:58 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
13:03 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032-15.html#p16653>
13:15 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:15 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:16 -!- adolfomaltez [~taro@190.62.179.253] has quit [Ping timeout: 245 seconds]
13:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
13:51 <@vpnHelper> RSS Update - forum: Repeater Bridge Clients Forced Through VPN Tunnel <http://forums.openvpn.net/topic9036.html>
14:00 < ehd> reading http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing ;-)
14:00 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
14:01 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:01 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:01 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:06 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
14:13 -!- `Orum [~egr@unaffiliated/orum] has left #openvpn []
14:15 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:15 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:18 -!- lex0tanil [~z@fsf/member/lex0tanil] has joined #openvpn
14:18 < lex0tanil> !welcome
14:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:18 < lex0tanil> !howto
14:18 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:21 -!- lex0tanil [~z@fsf/member/lex0tanil] has left #openvpn []
14:22 < |Mike|> lol?
14:24 -!- Denial [~Denial@drgi.co.uk] has quit []
14:25 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Quit: leaving]
14:25 -!- kloeri_ is now known as kloeri
14:25 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
14:26 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
14:27 < ehd> ohh, i see... the other hosts on the lan don’t know where to send the ping response to
14:31 < krzie> ahh must be:
14:31 < krzie> !route_outside_ovpn
14:31 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
14:34 < ehd> i added the route to the client, that worked
14:34 < ehd> erm
14:34 < ehd> i mean, i did "route add -net 10.8.1.0/24 gw 10.0.100.1" on the VM which is running on the server
14:34 < ehd> that did the trik
14:34 < ehd> s/k^/ck/
14:35 < ehd> wondering how i could automate that, maybe my configuring dnsmasq on the server
14:43 < krzie> or you could add the route to the router
14:44 < krzie> but ya, either way
14:44 < krzie> and you can automate that through your openvpn config
14:44 < krzie> see --route in the manual
14:46 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 255 seconds]
14:48 < krzie> d81
14:49 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
14:51 -!- Florin91 [~john@82.77.166.36] has quit [Remote host closed the connection]
14:55 < jeev> krzee, taht was a lame comeback
15:00 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has left #openvpn []
15:12 < krzie> jeev, you're a lame comeback
15:32 < ehd> ah i see! so if iadd the route to the router, and one of the virtual machines arp-asks "who is 1.3.3.7" the host will tell them due to the routing table?
15:33 -!- jemand [~quassel@brln-4db9ebf6.pool.mediaWays.net] has quit [Remote host closed the connection]
15:50 -!- Denial [Denial@drgi.co.uk] has quit []
15:58 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
16:03 -!- _Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
16:06 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
16:14 -!- taypen [~Stas@DSL212-143-220-82.bb.netvision.net.il] has joined #openvpn
16:14 < taypen> hey, if 2 clients connect to vpn via tun can they ping each other?
16:15 < taypen> ping through vpn
16:16 -!- EugeneSleep is now known as EugeneKay
16:17 < krzie> yes... ping their vpn ip
16:18 < taypen> i've just tried that... i have two clients one 10.1.0.6 other 10.1.0.10 they can ping the server 10.1.0.1 but cant ping each other
16:18 < krzie> !c2c
16:19 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
16:19 <@vpnHelper> clients
16:19  * EugeneKay wonders why the factoids page is 404ing
16:19 < krzie> its blocked because you dont have ip forwarding or your firewall blocks, but you can fix from within openvpn itself by reading above
16:19 < krzie> it is!?
16:19 < krzie> !factoids
16:19 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:19 < EugeneKay> It was 30 seconds ago.... now it works o.O
16:20 < EugeneKay> I'm not making it up, I swear
16:20 < krzie> ;]
16:21 < taypen> so i just need to put "client-to-client" in my openvpn.conf and allow this in iptables?
16:22 < krzie> not 'and'
16:22 < krzie> 'or'
16:22 < krzie> read what the bot told you
16:22 < krzie> try again
16:22 < krzie> !c2c
16:22 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
16:22 <@vpnHelper> clients
16:23 < taypen> ok, thanks
16:25 < EugeneKay> We need a "read" factoid
16:25 < EugeneKay> Oh... we have one
16:25 < EugeneKay> Derp
16:25  * EugeneKay crawls back under his rock
16:26 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:30 < taypen> ok, another maybe dumb question )
16:31 < taypen> if i want to allow clients to ping my local network "eth1" how can i do that/
16:31 < taypen> ?
16:31 < EugeneKay> Push routes for it to the relavent places, and allow it through your firewall.
16:33 < krzie> and enable ip forwarding
16:33 -!- share [share@unaffiliated/share] has joined #openvpn
16:33 < taypen> enabled
16:33 < share> hello
16:33 < share> how-to run Tor over VPN?
16:33 < share> oops VPN over Tor
16:34 < share> connect to Tor then connect to VPN
16:34 < krzie> see the socks settings in the manual
16:34 < krzie> just like you use tor from the commandline using tsocks or something similar... same deal except you tell openvpn to do it in the config
16:34 < EugeneKay> Make your OpenVPN server instance listen on all interfaces(and firewall non-Tor addresses), then have your client connect to the onion address.
16:35 < share> EugeneKay: never tried setting up a VPN
16:35 < share> :p
16:35 < krzie> EugeneKay, client can connect to normal ipv4 ip over tor if it uses the tor socks
16:35 < EugeneKay> Then set one up, and try it non-Tor first.
16:35 < share> krzie: OK so basically I configure VPN to use Socks
16:35 < EugeneKay> krzie - it can, but that's not as Torry
16:36 < krzie> well it depends, i didnt understand the question as "how do i host a ovpn server that can only be reached over tor?"
16:36 < krzie> i understood it as "how can i connect to a vpn server using tor"
16:36 < krzie> which may imply not even running the server yourself
16:36 < EugeneKay> The former makes more sense to me
16:36 < share> yes krzie second one.
16:36 < EugeneKay> ah well there you are
16:37 < share> how to connect to VPN using Tor
16:37 < krzie> like i said above =]
16:37 < EugeneKay> SOCKS it.
16:37 < share> ok
16:37 < krzie> same way you connect to any ipv4 ip using tor really
16:37 < krzie> by sending it through your local tor socks
16:37 < EugeneKay> "I keep my socks and underwear in the same drawer, will this cause tor issues?"
16:38 < share> lol
16:38 < krzie> in openvpn this is done in the client config using the socks options which you can easily find in the manual =]
16:38 < krzie> !man
16:38 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
16:38 < share> krzie: ok so I dont need external programs
16:38 < share> like socat
16:38 < share> ?
16:38 < share> just Tor and Openvpn
16:40 < krzie> well
16:40 < krzie> did i mention external programs like socat?
16:41 -!- IsilZha [~andreas@182.55.249.1] has quit [Ping timeout: 260 seconds]
16:41 < share> I think I read tsocks
16:41 < share> somewhere
16:41 < share> x)
16:42 < krzie> read to understand
16:42 < krzie> dont skim and pull out words
16:42 < krzie> [14:34]  <krzie> see the socks settings in the manual
16:42 < krzie> [14:34]  <krzie> just like you use tor from the commandline using tsocks or something similar... same deal except you tell openvpn to do it in the config
16:42 < EugeneKay> !read
16:42 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
16:42 < share> except
16:42 < share> is the keyword.
16:42 < krzie> EugeneKay, nice man! i forgot about that
16:42 < krzie> i need to break that one out more often!
16:42 < EugeneKay> So did I, until I dug through the factoids list
16:42 < EugeneKay> Right after suggesting it
16:42 < EugeneKay> :v
16:42 < krzie> lol nice
16:43 < share> "just like you use tor from the commandline using tsocks or something similar ... same deal (OK Im gonna use socat) except you tell openvpn to do it in the config (I didnt read this)
16:43 < share> :)
16:44 < EugeneKay> BroTip: Getting internet lawyery in a support channel WILL get you ignored
16:44 < krzie> right
16:44 < krzie> which is why i said:
16:44 < krzie> [14:42]  <krzie> read to understand
16:44 < krzie> [14:42]  <krzie> dont skim and pull out words
16:44 < share> lol
16:44 < krzie> reading to understand is NOT ignoring everything after you pull out a keyword
16:44 < share> I dont know the meaning of skimg
16:44 < share> skim
16:44 < share> my english sucks
16:44 < krzie> translate.google.com
16:45 < share> that's the worst to learn english
16:45 < share> :p
16:45 < krzie> not for a single word like skim
16:45 < krzie> either way
16:45 < krzie> you know what you need to do, go do it
16:46 < share> haha just translated it
16:46 < share> it doesnt make any sense :)
16:46 < share> yeah man thanks :)
16:48 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 244 seconds]
16:52 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
16:55 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
17:14 -!- IsilZha [~andreas@182.55.249.1] has joined #openvpn
17:56 -!- novaflash is now known as novaflash_away
17:57 -!- uuuppz [~uuuppz@78.129.207.46] has quit [Remote host closed the connection]
18:00 < vect0rx> heya folks
18:01 < vect0rx> vint cert did an interesting talk about artifical intelligence and how google translate works.
18:01 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has quit [Ping timeout: 240 seconds]
18:02 < vect0rx> it's a lot more brute force than you might think.   they take pre-translated bodies of work and basically feed them into google and tell google they're evquivalent.   No context/interpretation, but computational word/(likelly chained word) plucking
18:14 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
18:32 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Read error: Operation timed out]
18:32 < krzie> ya that is interesting
18:35 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
18:40 < vect0rx> how goes it, krzie?
18:42 < share> it doesn't connect to VPN using socks
18:43 < share> TCP connection established with [AF_INET]127.0.0.1:9050
18:44 < share> recv_socks_reply: Socks proxy returned bad reply
18:44 < share> TCP/UDP: Closing socket
18:44 < share> SIGTERM[soft,init_instance] received, process exiting
18:46 < share> hello?
19:02 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
19:07 -!- Denial [Denial@drgi.co.uk] has quit []
19:31 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has joined #openvpn
19:44 -!- _julian_ [~quassel@hmbg-4d06b5e9.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:47 -!- _julian [~quassel@hmbg-5f7641d7.pool.mediaWays.net] has joined #openvpn
20:02 -!- _Cr4zi3 is now known as Cr4zi3
21:33 <@vpnHelper> RSS Update - forum: how to set expiration per user? <http://forums.openvpn.net/topic9037.html>
22:12 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:51 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
22:57 -!- taypen [~Stas@DSL212-143-220-82.bb.netvision.net.il] has quit [Quit: Leaving]
23:07 -!- madsage [sage@2001:470:c:1292::2] has quit [Ping timeout: 240 seconds]
23:24 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
23:24 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
23:24 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
--- Day changed Mon Oct 17 2011
00:15 -!- dazo_afk is now known as dazo
00:18 -!- raidz is now known as raidz_afk
00:19 -!- raidz_afk is now known as raidz
00:21 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
00:27 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
00:28 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
00:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:54 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
01:09 -!- madsage [sage@2001:470:c:1292::2] has joined #openvpn
01:41 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 240 seconds]
01:42 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
02:04 < Mowee> Morning
02:05 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:06 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
02:07 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
02:11 -!- raidz is now known as raidz_afk
02:16 <@vpnHelper> RSS Update - forum: how to set expiration per user? <http://forums.openvpn.net/topic9037.html#p16657> || DNS queries through established client access tunnel <http://forums.openvpn.net/topic9035.html#p16656>
02:22 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032-15.html#p16658>
02:27 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 248 seconds]
02:27 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16659>
02:27 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:28 -!- Azrael808 [~peter@212.161.9.162] has quit [Client Quit]
02:29 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
02:44 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:46 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032-15.html#p16661>
02:53 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
02:53 -!- sigius [~sigius@93.125.185.45] has quit [Write error: Connection reset by peer]
03:04 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
03:04 <@vpnHelper> RSS Update - forum: Difference between TUN & TAP interfaces <http://forums.openvpn.net/topic9038.html>
03:05 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
03:07 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Ping timeout: 255 seconds]
03:09 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:10 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
03:10 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
03:12 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
03:28 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032-15.html#p16664> || Difference between TUN & TAP interfaces <http://forums.openvpn.net/topic9038.html#p16663>
03:39 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
03:39 <@vpnHelper> RSS Update - forum: Difference between TUN & TAP interfaces <http://forums.openvpn.net/topic9038.html#p16665>
03:40 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
03:42 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
03:42 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
03:42 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
03:59 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
04:12 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:12 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:12 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:19 -!- novaflash_away is now known as novaflash
04:21 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
04:22 <@vpnHelper> RSS Update - forum: openvpn on Centos 5.5 <http://forums.openvpn.net/topic8953-15.html#p16666>
04:27 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
04:41 <@vpnHelper> RSS Update - forum: OpenVPN seems to push wrong subnet mask to clients <http://forums.openvpn.net/topic9032-15.html#p16667>
04:41 -!- rawplayer [~foo@2001:610:158:1020:216:3eff:fe64:6606] has left #openvpn []
04:47 <@vpnHelper> RSS Update - forum: Server not waroking anymore <http://forums.openvpn.net/topic8958.html#p16670> || Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16669> || Difference between TUN & TAP interfaces <http://forums.openvpn.net/topic9038.html#p16668>
04:48 -!- netmike [~essiene@41.206.11.28.vgccl.net] has joined #openvpn
04:48 < netmike> hey folks... I've been reading DDD
04:48 < netmike> oops... sorry... will type that again :D
04:50 < netmike> hey folks... :D i need to connect to two different telco company servers over two different VPNs. I have a VPS and I'm hoping to use openvpn as I hear its simpler than ipsec, etc... i've read up quite a bit and have an idea of the routing vs bridging and other gotchas... what i'm not sure of though, is if this can work? and should I be setting up my openvpn instance as a client or a server
04:51 < netmike> also, i've not found any particular documentation mentioning that if I do a site-to-site, i should setup my end as a client or a server, or that I can do site-to-site to two different sites at the same time... 
04:51 < netmike> any pointers?
04:58 < ehd> is there a best practice for doing what update-resolv-conf does for OS X?
05:05 <@vpnHelper> RSS Update - forum: Server not waroking anymore <http://forums.openvpn.net/topic8958.html#p16672>
05:34 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:34 -!- mode/#openvpn [+v s7r] by ChanServ
05:34 < ehd> nevermind, realized the gui clients are doing that pretty well
05:41 <@vpnHelper> RSS Update - forum: [RESOLVED] Server not working anymore <http://forums.openvpn.net/topic8958.html#p16673>
05:45 -!- B0bby [~amine@41.248.110.101] has joined #openvpn
05:48 -!- cheche [cheche@46.25.80.67] has quit [Ping timeout: 248 seconds]
05:50 -!- cheche [cheche@46.25.80.67] has joined #openvpn
05:50 -!- netmike [~essiene@41.206.11.28.vgccl.net] has quit [Ping timeout: 252 seconds]
05:55 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
06:05 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
06:06 < B0bby> hello
06:09 < B0bby> I am using openvpn   version 2.1.0 in the server (the default that comes with the latest ubuntu-server), and openvon version 2.2.1 in the windows client, before the connection works and I was able to connect to the other side and do all staff, ping, vnc... but after some modifications in the config relative to some performance tuning.. I got thie error messages
06:10 < B0bby> Mon Oct 17 10:12:54 2011 ROUTE: route addition failed using CreateIpForwardEntry: Accès refusé.   [status=5 if_index=20]
06:10 < B0bby> Mon Oct 17 10:12:54 2011 Route addition via IPAPI failed [adaptive]
06:10 < B0bby> Mon Oct 17 10:12:54 2011 Route addition fallback to route.exe
06:13 < B0bby> and in the linux server station I got  different errors :
06:13 < B0bby> Mon Oct 17 10:12:54 2011 ROUTE: route addition failed using CreateIpForwardEntry: Accès refusé.   [status=5 if_index=20]
06:13 < B0bby> Mon Oct 17 10:12:54 2011 Route addition via IPAPI failed [adaptive]
06:13 < B0bby> Mon Oct 17 10:12:54 2011 Route addition fallback to route.exe
06:13 < B0bby> sorry 
06:13 < B0bby> Mon Oct 17 10:08:36 2011 VPN-Client/196.217.199.157:51446 Bad LZO decompression header byte: 0
06:13 < B0bby> Mon Oct 17 10:08:36 2011 VPN-Client/196.217.199.157:51446 FRAG_IN error flags=0xffffffff: FRAG_TEST not implemented
06:25 -!- zux [~zux@195.13.186.54] has joined #openvpn
06:28 < cherwin> B0bby: Run as Administrator.
06:29 < cherwin> B0bby: Also, what kind of Windows?
06:30 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
06:30 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
06:30 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
06:31 < B0bby> cherwin, it's a windows serven station
06:32 < zux> seven probably?
06:32 < B0bby> it's already connected with administrator 
06:32 < B0bby> zux, yes ! bingo 
06:33 < zux> this should be a better place to discuss it, than #slackware
06:33 < B0bby> zux, thank you
06:34 < B0bby> this is the complete file of logs in both server and client stations
06:34 < B0bby> http://pastebin.ca/2090746
06:34 < zux> this is certainly bad: Mon Oct 17 10:08:33 2011 196.217.199.157:51446 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1578', remote='link-mtu 1573'
06:34 < zux> WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
06:34 < zux> WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'
06:35 < B0bby> about the last two warnings it's not true
06:35 < B0bby> comp-lzo exists in both config 
06:35 < zux> it's true if it says so
06:35 < B0bby> file*
06:35 -!- SmashedGlass [~jumbo@41.55.215.34] has joined #openvpn
06:35 < zux> did you enable it yourself?
06:35 < B0bby> of course
06:35 < zux> did you restart the service?
06:36 < zux> suspicious silence :)
06:36 < zux> oh, that was the server side
06:37 < B0bby> no I am just checking again and again
06:37 < SmashedGlass> you are making zux twitch
06:37 < B0bby> I have the both machines don't worry
06:38 < zux> ok, can you pastebin both config files?
06:38 < zux> anyway, i think the main problem is here: ROUTE: route addition failed using CreateIpForwardEntry: Accès refusé.   [status=5 if_index=20]
06:39 < B0bby> ok
06:39 < B0bby> zux, in french it's a permission problem 
06:39 < B0bby> right ?
06:39 < zux> i'm not really sure what "Accès refusé." means, but i'm allmost certain it's "access denied"
06:39 < B0bby> access refused 
06:39 < B0bby> ok
06:39 < zux> can you kill the openvpn client and run it as administrator
06:39 < B0bby> ok
06:40 < zux> you should at least get a different error
06:45 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16674>
06:45 < B0bby> zux, I am connected to win7 as an administrator
06:46 < zux> that doesn't mean anything
06:46 < zux> well ok, first of all, are you running openvpn as a service or via openvpn-gui
06:46 < zux> ?
06:46 < B0bby> zux, it's openvpn HUI
06:46 < B0bby> GUI
06:47 < B0bby> the latest version 
06:47 < zux> HUI :D:D:D:D
06:47 < B0bby> lol
06:47 < zux> that's a good one :)
06:47 < zux> means dick in russian :)
06:47 < B0bby> it doesn't seem for me :P
06:47 < zux> ok, anyway
06:47 < zux> kill the gui
06:47 < B0bby> hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
06:47 < B0bby> ok 
06:47 < B0bby> then ?
06:48 < zux> and run it with the right mouse button and "Run as Administrator"
06:48  * SmashedGlass says "Use <enter> less if possible" ...
06:48 < B0bby> zux, ok 
06:48 < zux> even if you are logged in as administrator, W7 will run software with unprivileged user
06:48 < zux> those are the new safety features :)
06:49 < B0bby> zux, but I didn't have this problems before
06:49 < B0bby> just have this when added two or tree options
06:49 < zux> you might have started it with those privileges before
06:49 < B0bby> nothing modified for other options
06:50 < zux> yeah, but you restarted the client
06:50 < B0bby> no just clicking and running 
06:50 < zux> please try running it as administrator
06:50 < B0bby> it's done 
06:50 < zux> so, what error do you see now?
06:50 < B0bby> I will reconnect 
06:50 < SmashedGlass> zux: thats wierd, is this user named administratoré ?
06:52 < B0bby> zux http://pastebin.ca/2090751
06:52 < zux> Canadian french?
06:53 < B0bby> I am connected the light is green
06:53 < B0bby> but I can't ping 
06:53 -!- novaflash is now known as novaflash_away
06:53 -!- novaflash_away is now known as novaflash
06:53 < zux> yeah, that's a routing problem
06:54 < B0bby> Mon Oct 17 11:23:08 2011 196.217.158.66:54447 Re-using SSL/TLS context
06:54 < B0bby> Mon Oct 17 11:23:08 2011 196.217.158.66:54447 LZO compression initialized
06:54 < B0bby> Mon Oct 17 11:23:09 2011 196.217.158.66:54447 [VPN-Client] Peer Connection Initiated with [AF_INET]196.217.158.66:54447
06:54 < B0bby> (END) 
06:54 < SmashedGlass> whats the point of loging in as admin if you aren't, thats very bizarre
06:54 < zux> what does this mean?
06:54 < zux> L'op‚ration demand‚e n‚cessite une ‚l‚vation.
06:54 < zux> SmashedGlass, don't ask me
06:54 < B0bby> the operation asked needs a..
06:54 < zux> a what?
06:54 < B0bby> zux, ‚l‚vation it's not clear
06:55 < B0bby> lol
06:55 < zux> elevation of privileges?
06:55 < B0bby> yes
06:55 < B0bby> I think so
06:55 < B0bby> the operation asked needs an elevation 
06:55 < zux> so it's asking for higher privileges
06:56 < zux> did you really kill the openvpn process?
06:56 < SmashedGlass> wow it looks like M$ has really runed B0bby's day
06:56 < zux> right click on the icon > exit
06:56 < B0bby> SmashedGlass, it's not the first time.. but I am forced.. client are too afraid of running linux
06:56 < zux> SmashedGlass, i think their idea was to help (in means of security) to those users who just log in as administrator for every day tasks
06:57 < B0bby> zux, I will do something better
06:57 < SmashedGlass> B0bby: they sound like they have bigger issues
06:57 < B0bby> I will run XP machine where everyting is autorized
06:57 < zux> B0bby, i have actually put a linux router as a VPN box for such clients
06:57 < B0bby> then see if the problem persist
06:57 < zux> now i'm proud that only linux machines are connecting to my VPN :)
06:58 < zux> well ok, there is one W7 user, but he is administering himself
06:58 < B0bby> lol
06:58 < B0bby> I gonna install my XP station quickly
06:58 < B0bby> I will use my virtual box 
06:59 < zux> on a W7 box i usually follow a simple rule to debug such situations: Reboot > Runs as Administrator > Disable firewall
06:59 < zux> one of those almost allways works
07:00 < SmashedGlass> and people pay for this kind of thing, it just freaks me out, how they put there nose up to something free
07:00 < B0bby> zux, ok thank you
07:01 < B0bby> SmashedGlass, because they havent do self-learning.. somebody else has teached them
07:01 < zux> you can probably ping the other ends tap interface's ip address
07:03 < zux> the biggest problem at the place where i work  is that we are running AXAPTA
07:03 < zux> as you can guess, it doesn't run under linux...
07:05 < SmashedGlass> true
07:06 < zux> i'm moving to a terminal server configuration, most users will work there, after that, some workstations might be migrated to linux if all goes well
07:06 -!- SmashedGlass [~jumbo@41.55.215.34] has quit [Quit: brb]
07:08 -!- SmashedGlass [~jumbo@41.55.215.34] has joined #openvpn
07:12 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
07:12 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
07:12 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
07:15 -!- SmashedGlass [~jumbo@41.55.215.34] has quit [Quit: I need more free memory]
07:17 -!- netmike [~essiene@41.206.11.5.vgccl.net] has joined #openvpn
07:22 -!- SmashedGlass [~jumbo@197.110.213.70] has joined #openvpn
07:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
07:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:44 -!- SmashedGlass [~jumbo@197.110.213.70] has quit [Remote host closed the connection]
07:47 <@vpnHelper> RSS Update - forum: partial success <http://forums.openvpn.net/topic9039.html>
07:54 -!- netmike [~essiene@41.206.11.5.vgccl.net] has quit [Ping timeout: 256 seconds]
07:59 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16676>
08:17 -!- netmike [~essiene@41.206.11.14.vgccl.net] has joined #openvpn
08:19 -!- B0bby [~amine@41.248.110.101] has quit [Read error: Connection reset by peer]
08:26 -!- netmike [~essiene@41.206.11.14.vgccl.net] has quit [Quit: leaving]
08:34 -!- amine [~amine@41.248.110.101] has joined #openvpn
08:35 < amine> hello again zux 
08:35 -!- amine is now known as B0bby
08:36 < B0bby> zux, after rebooting the problem of permission has gone.. I will show you the logs  
08:37 < B0bby> zux, http://pastebin.ca/2090798
08:37 < B0bby> it seems that I have no client problem 
08:41 < B0bby> I think it's ok when I receive such thing in my server log ? 
08:41 < B0bby> Mon Oct 17 12:47:09 2011 196.217.158.66:54252 Re-using SSL/TLS context
08:41 < B0bby> Mon Oct 17 12:47:09 2011 196.217.158.66:54252 LZO compression initialized
08:41 < B0bby> Mon Oct 17 12:47:11 2011 196.217.158.66:54252 [VPN-Client] Peer Connection Initiated with [AF_INET]196.217.158.66:54252
09:00 -!- zux [~zux@195.13.186.54] has quit [Read error: Operation timed out]
09:02 -!- zux [~zux@195.13.186.54] has joined #openvpn
09:06 -!- master_of_master [~master_of@p57B552AB.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
09:08 -!- master_of_master [~master_of@p57B55667.dip.t-dialin.net] has joined #openvpn
09:11 < zux> good to hear
09:13 < B0bby> zux, thank you
09:13 < B0bby> but the problem is that I still can't ping the other side 
09:13 < zux> from the w7 or from the XP?
09:13 < B0bby> W7
09:13 < zux> so everything wokred in XP?
09:14 < B0bby> zux, no didn't try xp yet
09:14 < B0bby> it worked before I install it
09:14 < zux> ok, can you show me the config files, from both sides?
09:15 < B0bby> ok
09:19 < B0bby> zux, http://pastebin.ca/2090808
09:20 < zux> ok, what address are you trying to ping?
09:20 < B0bby> the default gateway
09:20 < B0bby> 192.168.1.1
09:21 < zux> line 21 and line 60
09:21 < B0bby> and any adress in the local LAN where the server reside
09:22 < zux> also, try to ping this address 192.168.1.91
09:22 < B0bby> zux, yes it's the MTU size
09:22 < B0bby> ok
09:22 < zux> why do they differ on the server and on the client?
09:22 < B0bby> it deosn't work too
09:23 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Quit: Leaving]
09:23 < zux> ok, on the windows machine, open a cmd and type ipconfig /all and pastebin the result
09:23 < B0bby> because I had some issues about that before
09:23 < zux> also type route print and pastebin that too
09:23 < B0bby> until I found a solution
09:23 < B0bby> zux, tap inteface is up
09:24 < zux> yes, but i need to see the address it's getting
09:24 < B0bby> and has the correct address 192.168.1.128
09:24 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
09:24 < zux> netmask?
09:24 < B0bby> correct
09:24 < B0bby> 255.255.255.0
09:24 < zux> ok, now the "route print"
09:24 < B0bby> in windows station ?
09:24 < zux> yes
09:24 < B0bby> wait
09:24 < zux> when the vpn is connected
09:25 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
09:25 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
09:25 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
09:31 -!- gladiatr [~sdspence@24.124.30.1] has joined #openvpn
09:31 -!- gladiatr [~sdspence@24.124.30.1] has quit [Changing host]
09:31 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:31 < gladiatr> hey all
09:43 < B0bby> zux, sorry my friend I was in the other office far from here
09:43 < B0bby> this is the table of routing 
09:43 < B0bby> http://pastebin.ca/2090816
09:45 -!- Charlie [d913f921@gateway/web/freenode/ip.217.19.249.33] has joined #openvpn
09:45 -!- Charlie is now known as Charlie1
09:45 -!- Charlie1 is now known as Charlie2
09:46 < zux> B0bby, can you try to disable the firewall on the w7 for a moment?
09:46 < zux> and test without it
09:46 < Charlie2> Good day, I have multiple OpenVPN instances running inside multiple screen windows. Is their an easy way to identify what process ID is linked to what network interface
09:46 < B0bby> zux, yes of course I did it
09:46 < zux> looks like it's all ok with the routing table, also i'm not an expert on windows routing table
09:47 < B0bby> zux, but what I found in the route table that the destination gateway is not set up
09:47 < zux> should it be?
09:47 < gladiatr> krzee, latest rescue project: http://tinyurl.com/43crb8e
09:47 < zux> are you going to access only the remote subnet via vpn or the whole internet?
09:48 < B0bby> zux, both 
09:48 < B0bby> is it possible
09:48 < zux> yes, i'm using internet via VPN when i'm not at work
09:49 < zux> from a linux machine of course
09:49 < B0bby> in my TAP interface ipconfig didn't show me a default gateway
09:49 < B0bby> I guess it's not normal
09:49 < B0bby> ok
09:49 < B0bby> Linux to linux is like romeo and julliette :P
09:49 < zux> yes, the default gateway should point to the router behind the VPN
09:50 < zux> do you have any other configuration on serverside?
09:50 < zux> it should prpbably push some more configuration to the client
09:50 < B0bby> like what ?
09:50 < B0bby> hmm
09:50 < zux> ehh, it's the end of the workday here, it's getting hard to concetrate for me
09:51 < zux> concentrate 
09:51 < B0bby> zux, am so sorry
09:51 < B0bby> I know but you are almost done.. I thing it's a small issue now
09:51 < zux> no, it's the jobs fault :D
09:51 < B0bby> my conf is there http://pastebin.ca/2090808
09:51 < B0bby> :)
09:52 < Charlie2> anyone? linking tunnel network interface to process ID?
09:52 < Charlie2> linux of course
09:52 < zux> ok, so we should first get you to be able to ping the remote subnet
09:53 < zux> Charlie2, don't know
09:53 < gladiatr> Charlie2, not that I can think of.  What I would do in that case is to statically assign tun interfaces via the dev-node directive
09:54 < Charlie2> gladiatr: I guess that would be a way problem is I have 200 tunnels here I'm dealing with all using a random list
09:55 < Charlie2> gladiatr: and the random list gets automatic-lay updated once a day
09:55 < gladiatr> oh.  I see.  so the client-end is what's running in your windows?
09:55 < B0bby> zux, how ?
09:58 < zux> i have only been using tun interface
09:58 < zux> how does the tap setup work?
09:58 < zux> on the server side, does the tap interface get it's own address?
09:59 < B0bby> zux, I was force to use Tap interface because I wanted to transport low level protocols like netbios..
09:59 < zux> it's probably ok to use it
09:59 < B0bby> my aim it to access the shared files in the remote network
10:00 < B0bby> to make people able to use sage applications
10:00 < B0bby> :s
10:00 < zux> i'll login to another vpn and have a look at the config
10:00 < zux> it's tap there
10:00 < B0bby> ok thank you
10:10 <@vpnHelper> RSS Update - forum: ipatables nat MASQUERADE: -i or -s or both? <http://forums.openvpn.net/topic9040.html>
10:11 < zux> hell no
10:11 < zux> what you want, is to bridge the remote subnet, with the client?
10:12 < zux> i'm using tap to bridge remote subnets, so you should probably use tun, not tap
10:12 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
10:12 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
10:12 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:12 -!- mode/#openvpn [+v Axeman] by ChanServ
10:12 < zux> B0bby, 
10:16 < zux> or no
10:17 < zux> we should get back to this tomorrow, because i think i'm starting to tell you bullshit
10:17 < zux> if you don't find a solution by that time
10:20 < dazo> B0bby: netbios runs fine over TCP/IP (not a "low layer protocol") ... but what you need when using TUN is to have a WINS service available ... otherwise Netbios depends a lot on broadcast traffic for discovery
10:21 < dazo> for broadcast traffic you need to bridge the internal network with the VPN TAP device
10:21 <@vpnHelper> RSS Update - forum: ipatables nat MASQUERADE: -i or -s or both? <http://forums.openvpn.net/topic9040.html#p16678>
10:22 < dazo> however, using TAP + bridging with broadcast traffic *will* slow down the VPN ... using WINS with a TUN setup is more often just as good, and will be more efficient over VPN
10:22 < zux> yep, i think your vpn setup might be ok, but you probably don't have a bridge on the server
10:22 < dazo> !tunortap
10:22 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over the
10:22 <@vpnHelper> vpn or (#4) lan gaming? use tap!
10:33 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
10:34 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
10:35 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:35 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:35 < LowKey> hello, i got issue on openvpn clients side , seems the DNS cannot work properly, any idea to fix this issue?
10:35 < LowKey> !configs
10:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
10:39 < B0bby> dazo, thanks for this immense information !
10:40 < B0bby> dazo, anyway, it seems that everything is ok with my TAP config.. the only problem that I am encountered now is about routing
10:41 < B0bby> dazo, I can't ping the other side from my client
10:41 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
10:41 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
10:42 -!- Axeman [~Axeman3@198.105.46.22] has joined #openvpn
10:42 -!- Axeman [~Axeman3@198.105.46.22] has quit [Changing host]
10:42 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:42 -!- mode/#openvpn [+v Axeman] by ChanServ
10:43 -!- zux [~zux@195.13.186.54] has quit [Ping timeout: 244 seconds]
10:45 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 248 seconds]
10:55 < ziplock> is it my imagination, or is there a lot more network traffic at client when routing all traffic thru the remove OpenVPN than when not?
10:56 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
10:58 < dazo> ziplock: if you're using TAP ... it might be more traffic, especially if bridging is used on client and/or server side ... however, for plain TUN setup + routing, only the traffic being routed through the tunnel would go there
10:59 < dazo> !route
10:59 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
11:00 < dazo> B0bby: sounds like this is of interest for you ... ^^^^
11:00 < dazo> if I understood your problem correctly
11:01 -!- raidz_afk is now known as raidz
11:01  * dazo heads out
11:01 < ziplock> dazo, thanks.  I'll keep investigating
11:02 -!- dazo is now known as dazo_afk
11:08 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:14 -!- Axeman2 [~Axeman3@198.105.46.46] has joined #openvpn
11:14 -!- Axeman2 [~Axeman3@198.105.46.46] has quit [Changing host]
11:14 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
11:14 -!- mode/#openvpn [+v Axeman2] by ChanServ
11:15 -!- Charlie2 [d913f921@gateway/web/freenode/ip.217.19.249.33] has quit [Quit: Page closed]
11:16 -!- p3rror [~mezgani@41.140.29.81] has joined #openvpn
11:18 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
11:19 -!- p3rror [~mezgani@41.140.29.81] has quit [Read error: Connection reset by peer]
11:20 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:46 -!- W4lth3r|off [~W4lth3r@524AFE06.cm-4-3d.dynamic.ziggo.nl] has joined #openvpn
11:51 -!- p3rror [~mezgani@41.140.42.223] has joined #openvpn
11:51 -!- W4lth3r|off [~W4lth3r@524AFE06.cm-4-3d.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
11:57 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
11:58 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Read error: Connection reset by peer]
12:10 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
12:16 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
12:22 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:32 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:39 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
12:48 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
13:18 -!- B0bby [~amine@41.248.110.101] has quit [Ping timeout: 258 seconds]
13:27 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
13:29 -!- mirco_ [~mirco@p5B285ADE.dip.t-dialin.net] has joined #openvpn
13:43 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
13:45 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
13:46 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 252 seconds]
13:48 -!- BodeyM [~bmarcocci@riverbank.fpdomain.com] has joined #openvpn
14:02 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:02 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:02 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:24 -!- pm2 [c7cc380f@gateway/web/freenode/ip.199.204.56.15] has joined #openvpn
14:26 < pm2> Hi - I'm having trouble with a OpenVPN client on Windows XP (using openvpn GUI) and a Linux server.  The client is able to connect initially, but then after several minutes it disconnects and starts trying to reconnect.  This disconnect/reconnect process repeats over and over.  I think I've had this problem before, and fixed it by tweaking the client config file, but I can't see to find the solution.  Does anyone know why this might be 
14:29 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
14:32 < Dougy> pm2: 
14:32 < Dougy> !configs
14:32 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
14:32 < Dougy> rather..
14:32 < Dougy> !all
14:32 <@vpnHelper> "all" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#' client.conf`), also include which OS and version of openvpn, include your routing tables, firewall settings and client/server logfiles or (#2) For more detailed instructions, look to: !logs !configs !interface
14:40 < Dougy> whois xbsite.com
14:40 < Dougy> err
14:44 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Go on, try it!]
14:46 < Dougy> so fffffffffffffffing tired
14:46 < Dougy> omg
14:46 < Dougy> bbl
14:48 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
14:48 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Remote host closed the connection]
14:52 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
14:53 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Remote host closed the connection]
14:53 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
14:55 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
14:55 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Client Quit]
14:56 -!- jemand [~quassel@brln-4db9c13b.pool.mediaWays.net] has joined #openvpn
14:56 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
14:57 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Client Quit]
14:57 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
14:57 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Client Quit]
14:59 -!- mirco_ [~mirco@p5B285ADE.dip.t-dialin.net] has quit [Quit: mirco_]
15:08 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
15:08 < pm2> One VPN client on Windows XP is giving me grief with these messages in syslog: swgh-tun/61.52.58.165:1066 MULTI: bad source address from client [10.0.80.90], packet dropped  -- This is happening on only one client, others are working fine.  Any idea what the problem might be?  I'll post config files in a second..
15:11 < pm2> Client/Server config here: http://pastebin.com/TCJ2A8HK
15:20 -!- jemand [~quassel@brln-4db9c13b.pool.mediaWays.net] has quit [Remote host closed the connection]
15:27 -!- cheche [cheche@46.25.80.67] has quit [Ping timeout: 248 seconds]
15:30 -!- cheche [cheche@46.25.80.67] has joined #openvpn
15:35 -!- pm2 [c7cc380f@gateway/web/freenode/ip.199.204.56.15] has quit [Quit: Page closed]
15:38 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
15:44 < krzie> sucks for him he didnt stick around a few more minutes
15:45 < krzie> but he was a webuser, thats how it goes with them
15:51 -!- YeTr2 [~william@pool-173-78-36-56.tampfl.fios.verizon.net] has joined #openvpn
15:56 -!- synx__ [18f99b62@gateway/web/freenode/ip.24.249.155.98] has joined #openvpn
15:57 < synx__> anyone have any experience setting up a synology unit with openvpn?
15:57 < synx__> !community
15:58 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
15:59 -!- novaflash is now known as novaflash_away
16:11 < krzie> whats a synology unit...?
16:12 < YeTr2> looks like a NAS gimmick
16:13 < reiffert> krzie: if you like to try one, it's a 1GB RAM dual core atom and/or mips andsoon, 2,4,5,6,200 bay box
16:13 < reiffert> krzie: start with a 411+, you small business customers will love it
16:13 < reiffert> krzie: note, the +.
16:13 < krzie> ahh gotchya
16:14 < reiffert> there is optware for it.
16:14 < reiffert> All I'm missing personaly is the bridging module in the kernel.
16:14 < reiffert> synx__: get optware for your box. it will work.
16:32 < YeTr2> I'm setting up some HA for openvpn. If a openvpn server goes down, how long till the client figures it out and tries to reconnect?
16:33 < Dougy> sup guise
16:33 -!- synx__ [18f99b62@gateway/web/freenode/ip.24.249.155.98] has quit [Quit: Page closed]
16:33 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Ping timeout: 258 seconds]
16:36 < reiffert> YeTr2: keep-alive long
16:39 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:40 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
16:51 < madsage> YeTr2, use a load balancer that proxies incoming public ip/port to the quickest responding backend ip/port. tehre are several opensores linux projects that can do this.
16:56 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
16:56 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
16:58 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
17:05 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
17:12 -!- p3rror [~mezgani@41.140.42.223] has quit [Read error: Operation timed out]
17:17 -!- Denial [Denial@drgi.co.uk] has quit []
17:18 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
17:22 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
17:39 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:50 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
18:09 -!- pm2 [4b86191b@gateway/web/freenode/ip.75.134.25.27] has joined #openvpn
18:13 -!- Grover_ [~Grover@c-76-102-201-175.hsd1.ca.comcast.net] has joined #openvpn
18:14 < Grover_> hello openVPN
18:15 < Grover_> im in a bit of a pickle, may i ask for some assistance?
18:17 < Grover_> !factoids
18:17 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
18:18 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
18:18 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
18:18 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:18 -!- mode/#openvpn [+v Axeman2] by ChanServ
18:20 < krzie> !ask
18:20 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
18:22 < Grover_> !ask
18:22 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
18:26 < Grover_> so i have a centos6 box. when i try to run openvpn, it gets to persistent state set to: ON then [FAILED]
18:26 < Grover_> im starting it through terminal
18:26 < Grover_> how can i debug this?
18:26 < Grover_> ie, log files error report/number etc
18:28 < krzie> !logfile
18:28 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
18:28 < krzie> also, start it from commandline first
18:28 < krzie> get it working that way, THEN try to get those linux scripts starting it right
18:29 < Grover_> !logfile
18:29 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
18:30 < Grover_> when you say commandline, you're refering to the bash terminal correct?
18:30 < krzie> yes... what else could i be referring to?
18:31 < Grover_> well because i said i was starting it in terminal, so i thought you were talking about somethign else. 
18:31 < krzie> [FAILED]
18:32 < krzie> that means you are starting it with the linux init scripts
18:32 < krzie> as opposed to just running openvpn from the commandline
18:32 < Grover_> oh
18:32 < krzie> but i see what you mean now
18:33 < Grover_> so this is a linux script thing, not an openvpn configuration thing?
18:33 < krzie> no idea, you'll need to get logs from openvpn to figure that out...
18:34 < Grover_> got it. 
18:34 <@vpnHelper> RSS Update - forum: need OpenVPN instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html>
18:38 < pm2> Hi - I'm having a problem where there's an overlap between the private IP addresses used at both ends of a client-server VPN connection.  Unfortunately I'm not in a position to change the IP addresses at either side.  Is there any way to configure the client so that it will be able to connect to the server correctly?
18:40 < krzie> !nathack
18:40 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
18:40 < krzie> if ANYTHING can help you it is that
18:41 < krzie> i certainly wont be supporting it, as its an ugly ugly hack and you should find a way to fix the real problem
18:41 < krzie> note, what you said is only a problem if you must share the lan over the vpn
18:41 < krzie> if you arent doing that, the address overlap does not matter
18:42 < pm2> krzie: Thanks for the pointer.  What I need to do is share the network connected to the server with the client.  I don't need to share the client's LAN.  (And, really, the client doesn't even need to access anything else on it's LAN once it makes a VPN connection)
18:42 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
18:47 < krzie> false
18:47 < krzie> it needs to access its default gateway!
18:48 < krzie> (or it wont have a connection to the vpn)
18:48 < pm2> Well, yeah, that's implied...
18:48 < krzie> thats not implied in "doesn't even need to access anything else on it's LAN"  otherwise i wouldnt have mentioned it
18:48 < krzie> (ive seen people wondering why they drop after connecting)
18:49 < pm2> Semantics aside, I understand that
18:49 < krzie> cool
19:02 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:08 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
19:09 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
19:11 -!- adolfomaltez [~taro@190.62.204.143] has joined #openvpn
19:21 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
19:23 -!- Grover_ [~Grover@c-76-102-201-175.hsd1.ca.comcast.net] has quit [Ping timeout: 244 seconds]
19:31 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:31 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
19:31 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:31 -!- mode/#openvpn [+v Axeman2] by ChanServ
19:43 -!- _julian_ [~quassel@hmbg-5f7633e9.pool.mediaWays.net] has joined #openvpn
19:46 -!- _julian [~quassel@hmbg-5f7641d7.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
19:51 -!- Netsplit *.net <-> *.split quits: share, agagag, R-66Y, caesay, MrWGW, adolfomaltez, rooth, beerbro, vect0rx, fremo_,  (+9 more, use /NETSPLIT to show all of them)
19:55 -!- Grover_ [~Grover@c-76-102-201-175.hsd1.ca.comcast.net] has joined #openvpn
19:55 -!- Netsplit over, joins: adolfomaltez, YeTr2, oc80z, LowKey, Essobi, agagag, share, rooth, Olipro, tjz (+9 more)
20:04 < Grover_> is there a test i can run to see if openvpn is properly configured and accessible?
20:37 -!- pm2 [4b86191b@gateway/web/freenode/ip.75.134.25.27] has quit [Quit: Page closed]
20:40 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:51 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:23 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
21:23 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
21:23 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:23 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:36 -!- MrPPS [~quassel@unaffiliated/mrpps] has joined #openvpn
21:40 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:41 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:50 -!- adolfomaltez1 [~taro@190.62.249.119] has joined #openvpn
21:51 -!- adolfomaltez [~taro@190.62.204.143] has quit [Ping timeout: 260 seconds]
21:52 -!- Grover_ [~Grover@c-76-102-201-175.hsd1.ca.comcast.net] has quit [Quit: Leaving]
21:58 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:59 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 276 seconds]
22:07 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
22:08 -!- bbeattie [~bbeattie@208.53.57.89] has joined #openvpn
22:08 < krzee> yes, you can try to access it with a client
22:08 < krzee> lol
22:10 <@vpnHelper> RSS Update - forum: DNS queries through established client access tunnel <http://forums.openvpn.net/topic9035.html#p16680>
22:14 < MrPPS> I have a product, OpenGear, which has OpenVPN by default - I'm trying to get it working with the Windows OpenVPN client. The server config is this: http://pastie.org/private/xbvtmcjgke7wjbc51lya   and the client config, as suggested by the OpenGear website, is this: http://pastie.org/private/trb8nynhwb2jxvifua   is there any reason this wouldn't work? The OpenVPN client just hangs there saying "Connecting", and wireshark picks up no communication
22:14 < MrPPS>  between the server, and it
22:14 < MrPPS> and I've tested this on 2 separate machines, and separate network connections
22:16 <@vpnHelper> RSS Update - forum: DNS queries through established client access tunnel <http://forums.openvpn.net/topic9035.html#p16681>
22:29 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
22:41 -!- adolfomaltez1 [~taro@190.62.249.119] has quit [Ping timeout: 258 seconds]
22:56 -!- JPeterso2 [~JPeterson@s213-103-209-64.cust.tele2.se] has joined #openvpn
22:59 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 255 seconds]
22:59 -!- JPeterso2 is now known as JPeterson
23:02 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 244 seconds]
23:04 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
23:13 -!- adolfomaltez [~taro@190.62.249.119] has joined #openvpn
23:16 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:19 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:45 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
--- Day changed Tue Oct 18 2011
00:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 260 seconds]
00:36 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 248 seconds]
00:43 -!- dxtr [ungo6h@unaffiliated/dxtr] has quit [Quit: leaving]
00:46 -!- dxtr [t5h7wx@dxtr.cc] has joined #openvpn
00:46 -!- zux [~zux@195.13.186.54] has joined #openvpn
00:50 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:55 -!- remoter [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
00:59 < remoter> Previously my vpn setup connects properly with internet connection but now it connects but no internet connection. What could be the problem?
01:03 < zux> hav eno idea
01:03 < zux> have no idea
01:05 < remoter> :(
01:05 < zux> doh, what happened between previously and now?
01:07 < remoter> that I was figuring out why.
01:08 < zux> is there an error?
01:09 < remoter> no error at all. it connects still but there is no internet connection.
01:09 < zux> well you might start with telling all the data you know, i don`t want to guess
01:13 -!- remoter [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Ping timeout: 265 seconds]
01:21 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:22 -!- dazo_afk is now known as dazo
01:24 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
01:27 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:28 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
01:28 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
01:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:28 -!- remoter [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
01:34 -!- mirco [~mirco@p5B28326A.dip.t-dialin.net] has joined #openvpn
01:34 <@vpnHelper> RSS Update - forum: DNS queries through established client access tunnel <http://forums.openvpn.net/topic9035.html#p16682>
01:34 -!- mirco [~mirco@p5B28326A.dip.t-dialin.net] has quit [Client Quit]
01:35 -!- mirco [~mirco@p5B28326A.dip.t-dialin.net] has joined #openvpn
01:37 < remoter> any idea on my problem?
01:37 -!- mirco [~mirco@p5B28326A.dip.t-dialin.net] has quit [Client Quit]
01:41 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:41 -!- remoter [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
01:56 -!- nibalizer [nibz@reaver.cat.pdx.edu] has joined #openvpn
01:57 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
01:58 < nibalizer> I'm having trouble figuring out if openvpn is free as in beer, I would like to run a private vpn server that clients can connect to
01:58 < nibalizer> can someone explain the useage/license/pricing/availability scheme
01:58 < zux> it's free beer as much as i know
01:58 < reiffert> openvpn runs unter GPL
01:58 < reiffert> Gnu Public License
01:59 < reiffert> there is also a commercial product, called access server.
01:59 < reiffert> !as
01:59 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
02:02 -!- novaflash_away is now known as novaflash
02:03 < nibalizer> okay thanks!
02:04 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 258 seconds]
02:09 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
02:13 -!- luneff [~yury@84.51.192.74] has quit [Quit: This computer has gone to sleep]
02:15 < Mowee> Morning
02:19 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:21 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Quit: Leaving]
02:34 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:34 -!- mode/#openvpn [+o mattock] by ChanServ
02:37 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
02:40 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
02:48 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
02:50 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
02:51 <@vpnHelper> RSS Update - forum: create new certificate entry 91: invalid expiry date <http://forums.openvpn.net/topic9042.html>
03:08 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:08 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:08 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:10 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16684>
03:11 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
03:27 -!- luneff [~yury@46.61.61.162] has joined #openvpn
03:58 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16687> || need OpenVPN instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16686> || create new certificate entry 91: invalid expiry date <http://forums.openvpn.net/topic9042.html#p16685>
04:04 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16688>
04:07 -!- Charlie2 [d913f921@gateway/web/freenode/ip.217.19.249.33] has joined #openvpn
04:08 -!- trumee [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
04:09 < Charlie2> Hi, I'm trying to link a process PID to an interface ID. In this case OpenVPN is creating a tunnel on tun1 for example, I have multiple instances of OpenVPN running. Is it possible to do a netstat with the PID number and network interface ID?
04:09 -!- trumee_ [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has joined #openvpn
04:10 <@vpnHelper> RSS Update - forum: Access a server through VPN on a firewall from outside <http://forums.openvpn.net/topic9021.html#p16689>
04:11 -!- trumee_ [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
04:11 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
04:11 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
04:11 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:12 -!- trumee [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has joined #openvpn
04:14 -!- luneff [~yury@46.61.61.162] has quit [Quit: Leaving]
04:16 <@vpnHelper> RSS Update - forum: create new certificate entry 91: invalid expiry date <http://forums.openvpn.net/topic9042.html#p16690>
04:20 -!- dxtr [t5h7wx@dxtr.cc] has quit [Changing host]
04:20 -!- dxtr [t5h7wx@unaffiliated/dxtr] has joined #openvpn
04:30 < LowKey> hello, i have issue with slow connection over openvpn , when i established connected, i got very slow connection. some time i can open any url on the website. but at first it fast, and come down after a minutes.
04:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
04:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:31 < LowKey> !config
04:31 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
04:31 < LowKey> !configs
04:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
04:32 -!- zux [~zux@195.13.186.54] has quit [Read error: Operation timed out]
04:33 < LowKey> here my config files http://pastebin.com/a9p0fRKm
04:34 < LowKey> my OS is centos 5.6 openvpn version is 2.2.0
04:37 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
04:43 -!- remoter [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has joined #openvpn
04:44 < remoter> I would like to ask if ISP can block both tcp and udp port 53.
04:46 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
04:46 <@vpnHelper> RSS Update - forum: openvpn 2.1.3 will not install in windows 7 64 bit <http://forums.openvpn.net/topic7075.html#p16691>
04:47 -!- remoter [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has left #openvpn []
04:48 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
05:44 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
05:46 < farciarz84> hi, I'm using openvpn to connect into my company. Each time I run it I have to privide a password which is not I really want to. Please help me how can I permanently store the password into openvpn that is could run without my effort. Thanks in advance.
05:52 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16692>
05:59 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has joined #openvpn
06:04 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
06:20 < Charlie2> Quick question, is their an easy way to use the logging option "log" but make it use the name of the tunnel it creates as the log filename etc.
06:20 < Charlie2> as I have multiple instances using random-route etc..
06:21 < EugeneKay> !configs
06:21 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
06:22 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:22 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:22 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:22 -!- mode/#openvpn [+v Axeman2] by ChanServ
06:22 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16693>
06:30 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
06:37 -!- Charlie2 is now known as GTX
06:40 <@vpnHelper> RSS Update - forum: OpenVPN Install Guides <http://forums.openvpn.net/topic2.html#p16694>
06:46 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16695>
06:58 -!- GTX [d913f921@gateway/web/freenode/ip.217.19.249.33] has quit [Ping timeout: 265 seconds]
07:00 -!- zux [~zux@195.13.186.54] has joined #openvpn
07:10 <@vpnHelper> RSS Update - forum: partial success <http://forums.openvpn.net/topic9039.html#p16696> || need OpenVPN AS instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16686>
07:13 -!- amine_ [~amine@41.140.42.237] has joined #openvpn
07:14 -!- amine_ is now known as Deim0s
07:14 < Deim0s> hello all
07:14 < Deim0s> zux, are you there ?
07:16 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16697>
07:20 < zux> yes, but not for long
07:30 < Deim0s> zux, lol ok.. just wanna say that I have the same problem of yesterday.. the only new thing is that it doesn't work in Linux too
07:30 < Deim0s> it's not a windows issue only... I got the same problem in linux too.. connected to the other side with success but no ping is possible
07:31 -!- zux [~zux@195.13.186.54] has quit [Ping timeout: 255 seconds]
07:35 -!- frenzy [17133525@gateway/web/freenode/ip.23.19.53.37] has joined #openvpn
07:36 < ecrist> Deim0s: what's your problem?
07:36 < frenzy> I would like to ask if it is possible for ISP to block udp port 53?
07:36 < ecrist> sure
07:37 < frenzy> why? isnt that neccesary for hostname lookups?
07:37 < EugeneKay> Outgoing, yes.
07:37 < EugeneKay> Though they may force you into using their DNS servers
07:38 < EugeneKay> Incoming is a whole different matter.
07:38 < ecrist> frenzy: an ISP can block anything they want.  if they *are* blocking port 53, they're likely preventing you from running your own DNS, or are forcing you to use theirs
07:38 < frenzy> How will I overcome this? 
07:39 < EugeneKay> Use a non-blocked port.
07:39 < frenzy> they have blocked most of the ports that I previously used
07:39 < ecrist> try 443?
07:39 < ecrist> or 80
07:39 < frenzy> they have blocked them too
07:40 < EugeneKay> Get inventive. There's 65,000 ports, they can't block 'em all.
07:40 < ecrist> EugeneKay: sure they an
07:40 < ecrist> can*
07:40 < EugeneKay> Then what are you paying them for? :-p
07:40 < ecrist> in pf it's as simple as 'block all'
07:40 < ecrist> I think frenzy just doensn't know what they're doing.
07:40 < frenzy> what do you mean ecrist?
07:41 < ecrist> well, you connected to IRC
07:41 < ecrist> so, there's some port that's not blocked.
07:42 < frenzy> ecrist, do you have idea what port cannot be blocked that by blocking it will arise real problem on their side?
07:43 < ecrist> what's your IP address?
07:43 < ecrist> 23.19.53.37, I'm guessing?
07:43 < frenzy> yes it is.
07:44 < frenzy> do you have idea on such port?
07:44 < ecrist> hang on
07:45 < frenzy> I just read an article on google that by block dns will destroy internet.
07:46 < Deim0s> ecrist, ok I have routing issues.. I am trying to connect two subnet 
07:48 < ecrist> frenzy: http://pastebin.com/v3ffaRKX
07:48 < ecrist> I see a few open ports there.
07:49 < ecrist> !route
07:49 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
07:49 < frenzy> ecrist how did you do that? 
07:49 < ecrist> frenzy: nmap
07:49  * ecrist goes away
07:50 < frenzy> will that tell me what port are opened that my isp did not blocked?
07:51 < Deim0s> ecrist, I am using bridging vpn mode server.. the tunnel is setup corectly the server assign me the right address.. and I have no errors in my log files
07:51 < Deim0s> the only problem I have is that I can't ping the clients behind the subnet
07:51 < Deim0s> nor the server vpn too
07:54 < Deim0s> ecrist, I have already used this tutorial.. but without success 
07:54 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
07:55 < farciarz84> hi, I'm using openvpn to connect into my company. Each time I run it I have to privide a password which is not I really want to + certificate. Please help me how can I permanently store the password into openvpn that is could run without my effort. Thanks in advance.
07:56 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:56 -!- mode/#openvpn [+v s7r] by ChanServ
07:56 -!- frenzy [17133525@gateway/web/freenode/ip.23.19.53.37] has quit []
08:01 < EugeneKay> Deim0s - your routing issues are connected to the fact that you're trying to use bridging.
08:03 -!- JohnTeddy [unstable@tor/regular/sid] has joined #openvpn
08:06 < JohnTeddy> This server side requires site to site VPN, do I need an external firewall in order to use site to site VPN?
08:09 < EugeneKay> farciarz84 - that depends what password you're referring to. If it's a --auth-user-pass one, then you need an OpenVPN client which has been built with the option to allow you to specify it from the command line or a file. The defaults, and packages included in most linux distros, do not allow this.
08:09 < EugeneKay> If it's the password to your cert's key, you can simply run it through openssl to get rid of the password
08:09 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
08:11 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 276 seconds]
08:11 < EugeneKay> (openssl rsa -in my.key out nopass.key)
08:11 < farciarz84> EugeneKay: I'll try this thank you. 
08:12 < EugeneKay> Note that removing this passphrase may cause your company admin to chase you down and beat you silly with a banana.
08:13 < EugeneKay> Same thing with using an openvpn client that'll save your password to a txt file. Those features are like that for a reason ;-)
08:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:16 -!- JPeterson [~JPeterson@s213-103-209-64.cust.tele2.se] has quit [Read error: Connection reset by peer]
08:17 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
08:18 -!- Deim0s [~amine@41.140.42.237] has quit [Ping timeout: 258 seconds]
08:20 -!- rommel092079 [17133525@gateway/web/freenode/ip.23.19.53.37] has joined #openvpn
08:20 -!- rommel092079 [17133525@gateway/web/freenode/ip.23.19.53.37] has left #openvpn []
08:25 -!- Deim0s [~amine@41.140.42.237] has joined #openvpn
08:25 < Deim0s> sorry EugeneKay, have you got my questions ?
08:26 < Deim0s> I have used bridging because I wanted to transport layer 2 level protocols such as the ones of Microsoft
08:26 < Deim0s> EugeneKay, the two networks are connected without problems.. simply the ping (indirectly the routing) can't pass..
08:27 < EugeneKay> You do not need bridging to run MS stuff over a VPN
08:27 < EugeneKay> !wins
08:27 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
08:28 < Deim0s> EugeneKay, OK ! so you think that such issues about routing are familiar with routing mode ?
08:29 < EugeneKay> Routing issues boil down to 1) routing and 2) firewalling
08:29 < Deim0s> EugeneKay, I mean I am so close from the target... just needed to configure the right routing
08:30 < Deim0s> EugeneKay, ok.. if I am connected to the opposite side.. anc check the logs.. and show me everything is OK ! I think the firewall issue is fixed ?
08:31 < EugeneKay> I have no idea, I'm not logged on to your system, checking things :-p
08:31 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 260 seconds]
08:31 < EugeneKay> If you can do what it is you're trying to do, by definition, it's working.
08:32 < Deim0s> EugeneKay, I mean the nat is correcte, the 1194 is open and traffic goes through without problem.. the server even assign me a new address..
08:32 -!- adolfomaltez [~taro@190.62.249.119] has quit [Remote host closed the connection]
08:32 < Deim0s> EugeneKay, yes this is what makes me crazy
08:33 < Deim0s> theoretically everything is ok
08:33 -!- zux [~zux@195.13.186.54] has joined #openvpn
08:35 < Deim0s> zux, I have you are free now :P
08:38 <+s7r> is there anything like a webinterface cpanel for the openvpn community project where you can see active users and add / remove users 
08:39 <+s7r> revoke certs, add configs, etC?
08:43 <@vpnHelper> RSS Update - forum: Is someone trying to access my openvpn server? <http://forums.openvpn.net/topic9043.html>
08:47 -!- technik234 [~masterofd@dslb-088-064-146-130.pools.arcor-ip.net] has joined #openvpn
08:48 < technik234> hello together i have a friend and they are roof man company and now they would ahve a little remote solution so i have thinked that a server is running in the office and they coudl connect via openvpn from remote to the company lan
08:48 < technik234> but does it work that they could also the local lan for printing?
08:48 -!- technikfreak [~ownpgroam@unaffiliated/technikfreak] has joined #openvpn
08:49 < technik234> or isn't it a good solution?
08:55 <@vpnHelper> RSS Update - forum: DNS queries through established client access tunnel <http://forums.openvpn.net/topic9035.html#p16699>
09:03 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
09:06 -!- master_of_master [~master_of@p57B55667.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
09:08 -!- master_of_master [~master_of@p57B557C2.dip.t-dialin.net] has joined #openvpn
09:11 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:12 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
09:14 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
09:14 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
09:26 -!- technik234 [~masterofd@dslb-088-064-146-130.pools.arcor-ip.net] has quit [Remote host closed the connection]
09:30 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 245 seconds]
09:55 -!- tty234 [telex@gateway/shell/anapnea.net/x-imgjbfbbqpqiocjs] has quit [Ping timeout: 258 seconds]
09:56 -!- tty234 [telex@gateway/shell/anapnea.net/x-oasxhsicdqyofbkf] has joined #openvpn
10:05 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
10:05 -!- zux [~zux@195.13.186.54] has quit [Ping timeout: 255 seconds]
10:07 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has quit [Remote host closed the connection]
10:16 -!- raomin_ [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
10:17 -!- raomin_ [~romain@240.22.66.86.rev.sfr.net] has quit [Remote host closed the connection]
10:19 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:25 <@vpnHelper> RSS Update - forum: OpenVPN + PPPoE conneciton in the same ETH on linux <http://forums.openvpn.net/topic9044.html>
10:32 -!- dazo is now known as dazo_afk
10:35 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:35 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:35 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:35 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 258 seconds]
10:35 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:39 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:39 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:39 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:40 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:42 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
10:46 -!- SOG [~SOG@14.153.238.58] has joined #openvpn
10:49 -!- raomin_ [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
10:49 -!- raomin_ [~romain@240.22.66.86.rev.sfr.net] has quit [Client Quit]
11:00 -!- chokesmaster [~chokesmas@65.92.83.242] has quit []
11:17 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
11:19 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
11:19 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
11:19 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
11:19 -!- mode/#openvpn [+v Axeman] by ChanServ
11:32 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:48 -!- chokesmaster [~chokesmas@65.92.83.242] has joined #openvpn
11:53 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:59 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:59 -!- Scenick [~irc@88.103.91.175] has joined #openvpn
12:02 <@vpnHelper> RSS Update - forum: need OpenVPN AS instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16701>
12:08 <@vpnHelper> RSS Update - forum: Want to establish VPN in a Organization Pease Help <http://forums.openvpn.net/topic9045.html>
12:15 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:19 -!- IsilZha [~andreas@182.55.249.1] has quit [Ping timeout: 255 seconds]
12:19 <@vpnHelper> RSS Update - forum: how to set expiration per user? <http://forums.openvpn.net/topic9037.html#p16704> || partial success <http://forums.openvpn.net/topic9039.html#p16703>
12:25 -!- bbeattie [~bbeattie@208.53.57.89] has quit [Read error: Connection reset by peer]
12:33 -!- Deim0s [~amine@41.140.42.237] has quit [Read error: Connection reset by peer]
12:35 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:48 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:50 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
12:50 <@vpnHelper> RSS Update - forum: partial success <http://forums.openvpn.net/topic9039.html#p16705>
12:56 <@vpnHelper> RSS Update - forum: need OpenVPN AS instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16706>
13:07 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
13:11 -!- Ionic [ionic@ionic.de] has joined #openvpn
13:32 <@vpnHelper> RSS Update - forum: How do I configure OpenVPN as a Gateway client for Witopia? <http://forums.openvpn.net/topic7684.html#p16707>
13:45 -!- SOG [~SOG@14.153.238.58] has quit [Read error: Connection reset by peer]
13:46 -!- SOG [~SOG@58.61.20.33] has joined #openvpn
13:50 <@vpnHelper> RSS Update - forum: need OpenVPN AS instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16708>
13:53 < farciarz84> EugeneKay: thx to the openssl solution - it works :)
13:54 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
13:56 < farciarz84> EugeneKay: you said admin from my company can chase me down. Why? and is he able to detect I'm not providing password anymore?
13:59 < krzee> no he cant
13:59 < krzee> it is only local
13:59 < krzee> it means your key is no longer encrypted, and once i get the file i can access your vpn
14:00 < krzee> you are undermining his security scheme, and he should beat you with that banana, odds are he'll never know
14:00 < SviMik> hi all. does anybody know, what happens when --ifconfig-pool-persist file is full? what rule is used to assign ip to new users?
14:01 < krzee> ipp is never taken as a rule
14:01 < krzee> its a suggestion, nothing more
14:01 < krzee> !ipp
14:01 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
14:01 < krzee> !iporder
14:01 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
14:02 < farciarz84> krzee: once you get the file nad password txt file you can access it either
14:02 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:02 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:02 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:02 < krzee> farciarz84, and the password.txt file should never exist
14:02 < farciarz84> krzee: password is so long that I never remember it and have to keep it in txt file:{
14:02 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:02 < krzee> well thats another example of:
14:02 < krzee> [15:00]  <krzee> you are undermining his security scheme, and he should beat you with that banana, odds are he'll never know
14:03 < SviMik> krzee so, which IP will be used next if I don't use --client-connect script nor --client-config-dir ?
14:03 < krzee> a piece of paper would be safer, i couldnt steal that from your computer after i owned you
14:04 < farciarz84> After he beat me, can I have key encrypted?;)
14:04 < krzee> SviMik, a dyanamic ip s specified by your ifconfig-pool, which is part of --server (see --server in the manual for details)
14:05 < farciarz84> is it so so unsafe that I should put shame on me?
14:05 < krzee> well
14:05 < SviMik> krzee I mean, it takes first free IP from the beginnig of pool? or there is a counter for it?
14:05 < hyper_ch> krzee: furball is sick :(
14:05 < krzee> in security for auth you can have:  something you are, something you have, something you know
14:05 < krzee> certs/keys are something you have
14:05 < krzee> passwords / passphrases are something you know
14:06 < krzee> he setup dual factor auth by forcing both
14:06 < krzee> you then turned something you know into something you have
14:06 < krzee> so back to single factor auth
14:06 < krzee> you undermined his security
14:07 < krzee> is it fataly insecure, i cant tell you 100%... is it less secure than he intended, absolutely
14:07 < SviMik> krzee I'm trying to understand, how openvpn is choosing IP from ifconfig-pool
14:08 < krzee> SviMik, why?  whats the real goal?
14:08 < krzee> hyper_ch, sorry to hear that
14:08 < SviMik> krzee I want to know how it works :)
14:09 < hyper_ch> krzee: but went to the vet doc today... she doesn't like the treatment though but I hope it'll help
14:10 < krzee> SviMik, you will understand it by reading the source... not from me giving you a rough idea
14:10 -!- trumee_ [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has joined #openvpn
14:10 -!- trumee [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has quit [Read error: No route to host]
14:14 -!- luneff [~yury@84.51.192.74] has joined #openvpn
14:44 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
14:44 -!- Axeman [~Axeman3@198.105.46.22] has joined #openvpn
14:44 -!- Axeman [~Axeman3@198.105.46.22] has quit [Changing host]
14:44 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:45 -!- mode/#openvpn [+v Axeman] by ChanServ
14:59 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
15:09 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:10 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
15:23 -!- Netsplit *.net <-> *.split quits: gladiatr, Agin, defswork, sigius, pwrcycle, chokesmaster, sigi, dropje
15:24 -!- Netsplit over, joins: chokesmaster, gladiatr, sigi, sigius, defswork, Agin, pwrcycle, dropje
15:27 -!- dollabill [~mike@199.44.8.98] has quit []
15:38 < farciarz84> krzee: I have vpn connection established on my router. I'd like to share it over my local network to some devices. How can I do it?
15:54 <@vpnHelper> RSS Update - forum: Remote Desktop Disconnecting <http://forums.openvpn.net/topic8900.html#p16709>
16:00 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
16:03 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:05 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 252 seconds]
16:13 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Remote host closed the connection]
16:21 < krzie> by reading my document on sharing lans
16:21 < krzie> !route
16:21 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
16:23 <@vpnHelper> RSS Update - forum: need OpenVPN AS instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16710>
16:43 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
16:47 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
16:59 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
17:01 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
17:03  * W4lth3r would like to remember everyone in here: The Android Ice Cream Sandwich launch will be in 3 hours - livestream on: http://www.youtube.com/android
17:07 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
17:08 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
17:22 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
17:33 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
17:35 < farciarz84> !tcpip
17:35 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
17:36 < farciarz84> thx krzee 
17:37 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Quit: Lost terminal]
17:40 -!- Denial [Denial@drgi.co.uk] has quit []
17:56 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:56 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:56 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:56 -!- mode/#openvpn [+v Axeman] by ChanServ
17:58 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:58 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
18:01 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
18:17 -!- novaflash is now known as novaflash_away
18:23 -!- justsighdudes [~root@unaffiliated/justsighdudes] has joined #openvpn
18:23 < justsighdudes> I'm trying to get routing to work. It only works when the firewall is disabled. How do I know what ports to open?
18:23 < justsighdudes> 1189 is open
18:25 < justsighdudes> err 1194
18:26 < krzie> well you mentioned trying to get routing to work
18:26 < krzie> routing to the internet through the vpn, or routing to a lan?
18:26 -!- SOG [~SOG@58.61.20.33] has quit [Quit: I will be back!]
18:26 < krzie> you likely need to allow tun+ in the forward chain
18:27 < krzie> its not about ports, only 1 port is needed for the connection
18:27 < krzie> however, ports is not the only thing firewalls block ;]
18:27 < krzie> btw, this is in the FIREWALL section of the manual too
18:28 < justsighdudes> routing to the internet. This wasn't the case when I set up openvpn last year. But too many variables have changed to blame it on one thing.
18:28 < justsighdudes> I use ufw. When it's disabled, routing works.
18:30 < Olipro> what OS?
18:30 < justsighdudes> Ubuntu server and client.
18:30 < Olipro> ufw sounds like some crappy iptables frontend
18:30 < Olipro> yup, so it is
18:30 < justsighdudes> Yeah, it is.
18:31 < Olipro> seriously, just do iptables commands directly
18:31 < Olipro> frontend wrappers are evil
18:31 < justsighdudes> ufw is so sleek though :(
18:31 < justsighdudes> ufw deny 22. boom.
18:31 < Olipro> iptables is so non-noobish
18:31 < justsighdudes> brb. Might disconnect. Going to try again.
18:32  * Olipro facepalms
18:32 < justsighdudes> And the status list is so easy to read.
18:32 < justsighdudes> Anyway, yeah. *crosses fingers*
18:32 < Olipro> iptables is to ufw as Visual Basic is to C++
18:32 < Olipro> er, reverse the latter two
18:35 < justsighdudes> hello?
18:35 < justsighdudes> Am I still here?
18:35 -!- justsighdudes [~root@unaffiliated/justsighdudes] has quit [Quit: leaving]
18:36 -!- root [~root@89.211.209.219] has joined #openvpn
18:36 -!- root is now known as Guest66944
18:36 < share> lol
18:36 -!- Guest66944 [~root@89.211.209.219] has left #openvpn []
18:37 -!- justsighdudes [~root@unaffiliated/justsighdudes] has joined #openvpn
18:37 < justsighdudes> A) I reject your comparison.
18:37 < justsighdudes> B) iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT  <- Didn't work :/
18:38 < justsighdudes> Guess it's back to basics with iptables for me. *sigh*
18:40 < justsighdudes> Ew. Unity's Alt-Tab brings up all instances of TABed to program.
18:45 < SviMik> justsighdudes try "iptables -A FORWARD -j ACCEPT" :)
18:45 < justsighdudes> Alright.
18:45 < justsighdudes> Going down.
18:45 -!- justsighdudes [~root@unaffiliated/justsighdudes] has quit [Quit: leaving]
18:47 -!- justsighdudes [~root@unaffiliated/justsighdudes] has joined #openvpn
18:47 < justsighdudes> SviMik: My hero.
18:47 < justsighdudes> How come your command worked while mine didn't?
18:47 < Olipro> justsighdudes: so um... -A is append
18:47 < Olipro> if there's a REJECT/DROP rule before that which is matching, guess what happens :)
18:48 < Olipro> also, you do realise that iptables commands take effect *immediately*
18:49 < Olipro> you don't need to save/restart
18:49 < SviMik> not exactly immediately... for new connections only
18:49 -!- IsilZha [~andreas@182.55.249.76] has joined #openvpn
18:49 < Olipro> no, for any subsequent packet passing through it
18:50 < Olipro> you're thinking of conntrack
18:50 < justsighdudes> Anyone know a good iptables tut?
18:50 < Olipro> >man iptables
18:51 < justsighdudes> I was thinking of one for more practical uses as opposed to every single use.
18:51 < justsighdudes> Or at least something that explains the concept of iptables.
18:51 < Olipro> um, well it's basically several tables containing various chains
18:51 < SviMik> justsighdudes my command just makes ACCEPT default policy for your firewall :)
18:51 < Olipro> the main table you'll deal with is filter
18:52 < Olipro> SviMik: no, your command adds an ACCEPT after any pre-existing rules to the filter/FORWARD chain
18:52 < Olipro> iptables -I FORWARD -j ACCEPT would ensure everything forwarded was accepted
18:52 < justsighdudes> Bah. I'll figure it out.
18:53 < Olipro> alternatively: iptables -F FORWARD; iptables -P FORWARD ACCEPT
18:53 < justsighdudes> Time to enjoy the internet in all its uncensored goodness.
18:54 < SviMik> Olipro in my case, my rule becomes the last, and it will match everything didn't matched by previous (REJECT/DROP) rules. so it is possible to say that this rule works as default for this chain
18:54 < justsighdudes> I wish 'murka would stand up for all people and not just people whose oil it can steal. /rant
18:55 < Olipro> yes, that's my point, you have no way of knowing what pre-existing rules there are
18:55 < Olipro> so your rule addition will only help if the issue is the default policy of his FORWARD chain
18:55 < Olipro> otherwise it's unlikely to do anything at all
18:55 < justsighdudes> What happens when something doesn't match anything (by default)?
18:55 < Olipro> if it matches nothing, it goes to the policy verdict of that particular chain
18:57 < Olipro> (such as DROP, REJECT, ACCEPT)
18:57 < justsighdudes> I'm guessing in my case it was either drop or reject?
18:58 < Olipro> iptables -vL FORWARD
18:58 < Olipro> see for yourself
18:59 < justsighdudes> Accept.
18:59 < EugeneKay> justsighdudes - a good iptables primer: http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables
18:59 <@vpnHelper> Title: Quick HOWTO : Ch14 : Linux Firewalls Using iptables - Linux Home Networking (at www.linuxhomenetworking.com)
18:59 < EugeneKay> It doesn't have anything about ip6tables, but the basics are the same.
18:59 < justsighdudes> EugeneKay: O_O
18:59 < justsighdudes> You're still alive?
19:00 < EugeneKay> Nope, this is all post-mortem twitches
19:00 < Olipro> the rigor-mortis erection is particularly disturbing
19:00 < justsighdudes> 3 lines without a single inappropriate reference. I'm impressed.
19:00 < Olipro> inb4 "who said it was rigor-mortis"
19:00 -!- mode/#openvpn [+o EugeneKay] by ChanServ
19:00 -!- Olipro was kicked from #openvpn by EugeneKay [Keep it clean, yo]
19:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:00 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
19:00 < Olipro> :<
19:01 < justsighdudes> Ooh damn. Op, too.
19:01 < justsighdudes> Seems Tommy raised you well.
19:02 < EugeneKay> You'll have to excuse me for not remember who you are :-p
19:02 < SviMik> -nvL works faster. I always use -n, because hostname resolution is very slow for me :)
19:02 < Olipro> mmm, true that
19:02 < EugeneKay> iptables should always be ip-based. hostname resolution is not to be trusted.
19:03 < Olipro> if it doesn't come with xtables-addons, it's not worth it
19:03 < justsighdudes> It's my new nickname. New identity in the online world. I'm in a country that watches everything we do here.
19:03 < EugeneKay> Tor :v
19:03 < Olipro> Iran?
19:04 < justsighdudes> I like my internet speeds at over 2kbps
19:04 < EugeneKay> I've never had a problem wasting excess bandwidth by runnign a Tor relay/exit node.
19:04 < justsighdudes> Saudi.
19:04 < EugeneKay> Ouch. Poor guy
19:05 < justsighdudes> I've been booze free for 6 months now. I'd kill for a cold beer.
19:05 < Olipro> I thought you could get a booze license if you're not muslim
19:05 < Olipro> or just go somewhere selling it under-the-table
19:06 < justsighdudes> Olipro: The license is in some neighboring countries. And I still haven't had the honor of finding a dealer.
19:06 < justsighdudes> Yes, people who sell alcohol here are called dealers.
19:07 < Olipro> for the princely sum of 50 Riyals
19:07 < justsighdudes> More like 1000 (around $250) for a bottle of black label
19:07  * EugeneKay sips his Corona
19:08  * Olipro knocks back his Arany Aszok
19:08 < justsighdudes> I need a silver bullet. It's not just a want anymore. I swear I'll never call it alcohol infused piss again.
19:09 < justsighdudes> I'm never leaving Philly (hint for EugeneKay) again.
19:10  * EugeneKay goes back to hiding under his rock
19:12 -!- raidz is now known as raidz_afk
19:19 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
19:20 -!- adolfomaltez [~taro@190.62.214.143] has joined #openvpn
19:23 <@vpnHelper> RSS Update - forum: Problems connecting DDWRT client to external openVPN server. <http://forums.openvpn.net/topic9047.html>
19:35 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
19:39 < netxshare> anyone around that can help me figure out why I can not access my local network when connecting via openvpn? here is my server.conf http://www.privatepaste.com/d4e0a0f0a5
19:40 < netxshare> I am able to connect and get a virtual ip fine, but I am unable to access anything on the network
19:42 < krzie> !route
19:42 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
19:43 < krzie> read that thoroughly and you'll be fine =]
19:44 < Olipro> and SNAT for the lazy
19:44 < krzie> no!
19:44 < krzie> nathack = bad, learning routing = good
19:44 < vect0rx> EugeneKay, have you run into any problems running a Tor exit node at all, nevermind bandwidth ones 
19:44 -!- _julian [~quassel@hmbg-4d06ead2.pool.mediaWays.net] has joined #openvpn
19:44 < EugeneKay> None.
19:44 < EugeneKay> It just runs
19:45 < vect0rx> Cool.  I noticed their web-based exit node list is offline as of the last few weeks
19:45 < EugeneKay> No it isn't? http://torstatus.blutmagie.de/index.php?SR=Bandwidth&SO=Desc
19:45 -!- _julian_ [~quassel@hmbg-5f7633e9.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
19:45 <@vpnHelper> Title: TorStatus - Tor Network Status (at torstatus.blutmagie.de)
19:46 < netxshare> okay thanks
19:47 < vect0rx> EugeneKay, I'm refering to the one that lets you query by terminating IP @ https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.2.3.4
19:47 <@vpnHelper> Title: Bulk Tor Exit Exporter (at check.torproject.org)
19:47 < EugeneKay> I think the note there is fairly self-explanatory
19:47 < vect0rx> but I've downloaded the source for it.. it looks like there's a special dns query that you can perform using ips and ports
19:48 < vect0rx> Yes it is.  I've taken notice of it and just mentioned it in the context of a Tor discussion.
19:48 -!- justsighdudes [~root@unaffiliated/justsighdudes] has quit [Ping timeout: 256 seconds]
19:49 < vect0rx> about 4-6 weeks ago or earlier the page was functional.   that is all.
19:50 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
19:51 < vect0rx> actually it didn't have a self-explanatory message until I inquired with them :)
19:51 < vect0rx> On sept 18th
19:51  * W4lth3r remembers everyone that the live stream of the Ice Cream Sandwich launch will start in 1 hour and 19 minutes at http://www.youtube.com/android
19:59 -!- share [share@unaffiliated/share] has left #openvpn []
20:05 -!- illsci [~jsabo@pool-96-255-235-187.washdc.fios.verizon.net] has joined #openvpn
20:05 < illsci> hey what's up
20:06 < illsci> Can you reuse signed certificates across a bunch of clients?
20:06 < illsci> so I don't have to sign tons of certs for clients
20:07 < krzie> !dupe
20:07 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
20:07 < vect0rx> it sort of defeats the purpose of using certificates as opposed to a shared key
20:07 -!- raidz_afk is now known as raidz
20:07 < krzie> if you do that, you better use password auth
20:08 < krzie> vect0rx, false, PSK doesnt come with forward security or multiple connections to 1 server
20:08 < vect0rx> oh I may have misread my bad
20:08 < vect0rx> need to lurk more answer less :)
20:08 < krzie> !forwardsecurity
20:08 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
20:09 < illsci> yeah..
20:10 < illsci> otherwise I would be using a preshared key
20:10 < illsci> thanks!
20:16 < illsci> Can you use the --float option to failover between openvpn peers
20:17 < krzie> failover between peers?  huh?
20:17 <@vpnHelper> RSS Update - forum: Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html>
20:17 < illsci> im reading the man page... have you read about the --float option?
20:17 < illsci> it says it will allow a remote peer to change its ip address
20:18 < illsci> If you had an active passive setup and behind a load balancer or something 
20:18 < illsci> perhaps you could vpn to the live host and should it fail, just fail over to the other maintaining the same ip connectivity?
20:19 < krzie> use a routing protocol for that
20:19 < illsci> we've talked about this...
20:19 < illsci> ip connectivity changes 
20:19 < illsci> god I wish I could figure this out... 
20:19 < krzie> ok well i dont know, test it if you like
20:19 < illsci> so you've never used it before?
20:19 < krzie> correct
20:20 < krzie> and when i do, ill be using a routing protocol and building a mesh
20:20 < illsci> hmm you know what
20:20 < illsci> so... I could bind the services to ips on the hosts local interfaces
20:21 < illsci> and have routes to those and put those in dns and then it wouldnt matter if it took path a or b to get there
20:21 < illsci> so a node could have tunnels to two vpn concentrators and just fail over
20:21 < krzie> thats kinda the point of running a routing protocol over the vpn isnt it?
20:21 < illsci> well up until right this second
20:22 < illsci> I always thought about it with having the tunnel ip having the service 
20:22 < illsci> and couldn't get past the fact that it would change... if you went through the other vpn concentrator
20:23 < illsci> i want to use client-to-client to allow them all to talk to each other
20:23 < illsci> but I guess you don't have to if you use dynamic routing right
20:24 < krzie> depends if you choose routed tap or PSK
20:24 < krzie> if client/server, yes
20:25 < krzie> (unless you work it out in your firewall because you want selective filtering)
20:26 < illsci> and you would recomend routed tap over PSK?
20:27 < illsci> hmm this is kinda flexible...
20:27 < ecrist> pooh
20:27 < krzie> well ild recommend choosing that yourself really
20:27 < krzie> sup eric
20:27 < ecrist> sup jeff
20:29 < krzie> chillen man
20:29 < ecrist> ditto
20:30  * W4lth3r would like to remember you: Just 30 minutes of waiting to go! The live stream will be on: http://www.youtube.com/android Have fun watching! :>
20:30 <@vpnHelper> Title: androiddeveloperss Channel - YouTube (at www.youtube.com)
20:30 -!- mode/#openvpn [+o ecrist] by ChanServ
20:30 -!- W4lth3r was kicked from #openvpn by ecrist [fuck off]
20:30 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:30 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:31 < illsci> hah
20:32 < krzie> lol
20:33 < krzie> it actually is a big announcement
20:33 < krzie> they're talking about it in most android chans
20:34 <@ecrist> no idea, just saw spam and fired up the boot
20:34 <@ecrist> :)
20:34 < krzie> =]
20:34 < jeev> krzie, Dougy said he's sending the server back
20:35 < krzie> sending what server back?  do you have any clue what you're talking about?
20:35 < jeev> sadly, no.
20:35 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:36 < krzie> how rare
20:36  * ecrist poofs
20:44 <@vpnHelper> RSS Update - forum: confused about configs <http://forums.openvpn.net/topic9049.html>
20:52 < netxshare> can openvpn be used to setup only local network access, so I would not have to worry about users using my internet connection?
20:55 < krzie> !local
20:55 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
20:57 < netxshare> thanks
20:58 < krzie> np
21:16 -!- adolfomaltez [~taro@190.62.214.143] has quit [Ping timeout: 260 seconds]
21:24 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
21:24 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
21:24 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:24 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:27 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:31 < Dougy> if anyone here needs to buy hard drives
21:31 < Dougy> do it now
21:31 < Dougy> prices going to go through the f'ing roof
21:34 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:39 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
21:39 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
21:39 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:39 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:51 -!- adolfomaltez [~taro@190.62.220.133] has joined #openvpn
22:01 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:04 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
22:05 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:07 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:09 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
22:10 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
22:19 -!- illsci [~jsabo@pool-96-255-235-187.washdc.fios.verizon.net] has quit [Ping timeout: 240 seconds]
22:32 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 260 seconds]
22:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:48 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:00 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 258 seconds]
23:22 -!- corretico [~luis@201.201.44.82] has joined #openvpn
--- Day changed Wed Oct 19 2011
00:06 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:08 <@vpnHelper> RSS Update - forum: openvpn 2.1.3 will not install in windows 7 64 bit <http://forums.openvpn.net/topic7075.html#p16716> || Can connect and ping server, but nothing else <http://forums.openvpn.net/topic8910.html#p16715>
00:19 -!- raidz is now known as raidz_afk
00:26 -!- raidz_afk is now known as raidz
00:26 <@vpnHelper> RSS Update - forum: need OpenVPN AS instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16717>
00:43 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
00:45 -!- chokesmaster [~chokesmas@65.92.83.242] has quit []
00:45 -!- Scenick [~irc@88.103.91.175] has quit [Ping timeout: 260 seconds]
00:46 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
00:46 -!- mode/#openvpn [+v s7r] by ChanServ
00:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:57 -!- JohnTeddy [unstable@tor/regular/sid] has left #openvpn []
00:58 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
00:58 -!- zux [~zux@195.13.186.54] has joined #openvpn
01:00 <+s7r> how can i have multiple vpn servers controlled by one 'master server' which issues the certs and keys for clients ?
01:03 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16718>
01:09 <@vpnHelper> RSS Update - forum: confused about configs <http://forums.openvpn.net/topic9049.html#p16719>
01:25 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 245 seconds]
01:27 <@vpnHelper> RSS Update - forum: Problems connecting DDWRT client to external openVPN server. <http://forums.openvpn.net/topic9047.html#p16720>
01:28 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
01:28 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
01:28 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
01:29 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Read error: Connection reset by peer]
01:43 -!- adolfomaltez [~taro@190.62.220.133] has quit [Ping timeout: 258 seconds]
01:45 <@vpnHelper> RSS Update - forum: VPS Install openvpn <http://forums.openvpn.net/topic9050.html>
01:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
01:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:46 -!- raidz is now known as raidz_afk
01:48 -!- adolfomaltez [~taro@190.62.243.152] has joined #openvpn
01:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
02:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
03:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
03:10 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
03:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
03:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:04 < EugeneKay> s7r - that's the definition of a PKI.
04:05 < EugeneKay> Just issue additional servert certs, one for each server. You'll want to enable cert-type checking(or even CN checking) on the client side as a good security practice.
04:06 <+s7r> where can i read more about pki
04:07 < EugeneKay> Wikipedia is a good place to start, or an O'Reilly book.
04:15 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
04:15 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16722>
04:45 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 260 seconds]
04:47 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
04:55 -!- alxgomz [~alxgomz@26.39.5.93.rev.sfr.net] has joined #openvpn
04:56 < alxgomz> hi am using openvpn with radiusplugin for auth and accounting. when authenticating radiusplugin does not send Framed-Protocol.. is it normal?
04:58 < alxgomz> radiusplugin.cnf contains Framed-Protocol=1 (but it only appears in accounting packets)
05:07 < alxgomz> here is the whole cfg http://pastebin.com/rw3j70Kb
05:07 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
05:26 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
05:26 -!- mode/#openvpn [+o mattock] by ChanServ
05:34 <@vpnHelper> RSS Update - forum: partial success <http://forums.openvpn.net/topic9039.html#p16723>
05:39 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
05:39 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
05:46 <@vpnHelper> RSS Update - forum: partial success <http://forums.openvpn.net/topic9039.html#p16724>
05:58 <@vpnHelper> RSS Update - forum: partial success <http://forums.openvpn.net/topic9039.html#p16725>
06:07 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:07 -!- Axeman2 [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:07 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:07 -!- mode/#openvpn [+v Axeman2] by ChanServ
06:08 < alxgomz> when disconnectiong a client, server does not see disconnection and I have to wait until the connection timeout.. any reason  why?
06:09 -!- Axeman [~Axeman3@knox.pace.edu] has joined #openvpn
06:09 -!- Axeman [~Axeman3@knox.pace.edu] has quit [Changing host]
06:09 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:09 -!- mode/#openvpn [+v Axeman] by ChanServ
06:12 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
06:21 < dropje> alxgomz: you might use 'explicit-exit-notify' in your client configs
06:23 < alxgomz> dropje: i am using nm-openvpn applet....can't see any option like this... do you know any? or do I have to use openvpn cli?
06:27 < EugeneKay> Probably because you're using UDP, but you didn't post any !configs, so I'm just pulling stuff out of various orifices.
06:29 < alxgomz> I posted this few lines upper in the discussion: http://pastebin.com/rw3j70Kb
06:30 < EugeneKay> "proto udp"
06:30 < EugeneKay> Are you familiar with the difference between TCP and UDP?
06:30 < alxgomz> am supposed to be yes
06:32 < alxgomz> but I don't understand why udp would prohibit the server from noticing a user disconnected
06:32 < EugeneKay> Then you don't understand the difference between TCP and UDP
06:32 < alxgomz> woudl you be kind enough to explain?
06:32 < dropje> EugeneKay: does openvpn send a FIN?
06:33 < EugeneKay> UDP as a protocol does not have explcit "connections", only packets which are sent to the other end. Unless the application sends an explicit disconnect signal, which IIRC OpenVPN does not, then the best you can do to detect the other end "disconnecting" is to wait 60 seconds for a lack of packets.
06:33 < EugeneKay> dropje - AFAIK, nope.
06:34 < alxgomz> yes unles the application sends a disconnect
06:34 < EugeneKay> "which IIRC OpenVPN does not"
06:34 < dropje> well if i take a look in our server logs i do see a SIGTERM[soft,remote-exit] received, client-instance exiting
06:34 < dropje> that would indicate a client SIGTERM
06:35 < alxgomz> so using udp do not prohibit server from knowing session (more than connection) state... ipsec (e.g) does not awit time-out even when using udp
06:35 < alxgomz> but that's not that important
06:35 < alxgomz> so using tcp instead would help?
06:36 < EugeneKay> Should, but it's a problem that realyl doesn't need to be solved. ;-)
06:36 < EugeneKay> If it bugs you that the tunnel stays up for 60s, turn your ping settings down to something like 5s
06:36 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
06:36 < alxgomz> it does in my case because i'm doing session accounting and need to know when the session goes down exactly
06:37 < EugeneKay> Then you're a candidate for TCP.
06:37 < EugeneKay> But be aware of the (very nasty) overhead problems.
06:37 < EugeneKay> IMO, the overhead from a short timeout is a better tradeoff than using TCP
06:38 < alxgomz> yep that's why I choosed udp first...
06:38 < EugeneKay> If you need something more precise than 5 seconds..... 
06:38  * EugeneKay shrugs
06:39 < alxgomz> yep it worth thinking yes
06:43 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
06:43 <@vpnHelper> RSS Update - forum: Is someone trying to access my openvpn server? <http://forums.openvpn.net/topic9043.html#p16727> || Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16726>
06:43 < dropje> EugeneKay: documentation of OpenVPN tells
06:43 < dropje> --explicit-exit-notify [n]
06:43 < dropje>  In UDP client mode or point-to-point mode, send server/peer an exit notification if tunnel isrestarted or OpenVPN process is exited. In client mode, on exit/restart, this option will tell the server to immediately close its client instance object rather than waiting for a timeout. The n parameter (default=1) controls the maximum number of retries that the client will atltempt to resend the exit notification message. 
06:43 < EugeneKay> Wasn't aware of that option, but looks good. It will only tell you about clean exits, though.
06:44 < dropje> EugeneKay: idd
06:53 < alxgomz> dropje: explicit-exit on client worksas expected
06:56 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
06:56 < vereteran> hi
06:56 < vereteran> i'm tyring to make client to route network
06:57 < alxgomz> is it a problem running openvpn in both routed and bridged mode on the same server?
06:59 < vereteran> for this i've added to openvpn-server.conf route 192.168.0.0 255.255.255.0 and iroute 192.168.0.0 255.255.255.0 to ccd/client. on client i've enabled ip forwarding (sysctl.conf: net.ipv4.ip_forward=1) and added 10.9.0.0/24 (vpn network) to iptables nat POSTROUTING for masquerading. issue is that i see server sending packets via tun0, but client doesn't get them. dmesg and iptables logs are clean. what am i doing wrong?
06:59 <@vpnHelper> RSS Update - forum: Using web hosting account for VPN tunnel <http://forums.openvpn.net/topic9004.html#p16728>
06:59 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
07:00 < dropje> alxgomz: i wouldn't say thats a problem as long as you run two individual instances on different ports.
07:04 < dropje> vereteran: from where are you testing to reach the client? from a random other client?
07:04 < vereteran> dropje, no, from server
07:06 < alxgomz> dropje: It seems like explicit-exit does not work in bridged mode.... does it make sense to you?
07:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:11 < alxgomz> hu..... a weird questio:
07:11 < dropje> vereteran: can you ping the client from the server side? if that doesnt work you will never be able to reach a host behind the client ofcourse
07:11 < alxgomz> is it possible to connect openvpn in briged mode and get IP in the subnet of the pub IP address
07:11 < alxgomz> the ip addr I connect to? :p
07:13 < dropje> alxgomz: i think i know what you mean but it there should be a real strong motivation to try to do this as it requires more than basic knowledge about routing
07:14 < dropje> and i think you're setup is running on a VPS or something or am i wrong here?
07:15 < alxgomz> dropje: maybe.. I don't know what my customer uses
07:16 <@vpnHelper> RSS Update - forum: Auto-tune mtu <http://forums.openvpn.net/topic624.html#p16729>
07:17 < EugeneKay> I wasn't aware T-Pain did networking
07:19 -!- meepmeep [meepmeep@212.24.104.229] has quit [Ping timeout: 260 seconds]
07:21 <@vpnHelper> RSS Update - forum: Openvpn dual authetication <http://forums.openvpn.net/topic9051.html>
07:28 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 276 seconds]
07:31 -!- DarthGandalf [~Vetinari@sbras240.ras.nsu.ru] has joined #openvpn
07:31 -!- DarthGandalf [~Vetinari@sbras240.ras.nsu.ru] has quit [Changing host]
07:31 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
07:39 < alxgomz> does openvpn understand the "Session-Timeout" radius attributes?
07:47 < alxgomz> or is there a way to setup time limit for the session to come up?
08:05 < vereteran> dropje, yes. pings are ok
08:05 < vereteran> sorry for the delay
08:05 < vereteran> boss...
08:10 < alxgomz> can I schedule client disconnection when client connects
08:11 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:11 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:11 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:12 -!- mode/#openvpn [+v Axeman] by ChanServ
08:22 -!- pavljiks [50e8ef09@gateway/web/freenode/ip.80.232.239.9] has joined #openvpn
08:22 < pavljiks> Hello, nice to see so many participiants :)
08:23 < pavljiks> just one short question: Trying to login into OpenVPN server using bridge configuration. When i try to listen what's happening on TAP interfeica using wireshark i see only broadcast messeges. 
08:23 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 260 seconds]
08:24 < pavljiks> what i mean't i can't ping/any other traffice except i hear ARP requests only
08:24 < pavljiks> what am i missing in configuration ?
08:28 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
08:28 -!- adolfomaltez [~taro@190.62.243.152] has quit [Remote host closed the connection]
08:40 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:46 < pavljiks> problem was ESXi limitation that's dissalov netowork card to switch to promissious mode
08:47 -!- pavljiks [50e8ef09@gateway/web/freenode/ip.80.232.239.9] has quit []
08:48 < alxgomz> dropje: do you know a way to limit user session duration to X seconds?
08:50 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
08:54 -!- vpnuser [17133525@gateway/web/freenode/ip.23.19.53.37] has joined #openvpn
08:55 < vpnuser> where can I see in the source code the part wherein it process the username/password authentication
08:56 -!- EugeneKay is now known as EugeneSicK
08:59 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has joined #openvpn
08:59 < vpnuser> guys I know you can help me
09:00 < vpnuser> you are experts here
09:06 -!- master_of_master [~master_of@p57B557C2.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
09:07 -!- vpnuser [17133525@gateway/web/freenode/ip.23.19.53.37] has quit []
09:08 -!- master_of_master [~master_of@p57B525BD.dip.t-dialin.net] has joined #openvpn
09:08 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
09:11 -!- illsci [~jsabo@66.208.14.74] has joined #openvpn
09:16 <@vpnHelper> RSS Update - forum: Star Topolgy - passing routes to all remote servers <http://forums.openvpn.net/topic9052.html>
09:34 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
09:38 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:38 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
09:39 -!- bauruine [~stefan@146-29.202-62.fix.bluewin.ch] has quit [Ping timeout: 252 seconds]
09:41 < Optic> mo
09:42 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
09:43 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:43 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:45 < takamichi> !logs
09:45 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:49 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Max SendQ exceeded]
09:54 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has quit [Remote host closed the connection]
09:54 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has joined #openvpn
09:55 -!- tjz [~pc@bb219-75-106-14.singnet.com.sg] has joined #openvpn
09:55 -!- tjz [~pc@bb219-75-106-14.singnet.com.sg] has quit [Changing host]
09:55 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
09:56 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
09:57 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Operation timed out]
10:01 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
10:01 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:03 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
10:05 <@vpnHelper> RSS Update - forum: Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16732>
10:11 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
10:11 -!- zux [~zux@195.13.186.54] has quit [Ping timeout: 260 seconds]
10:18 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:23 < gladiatr> alxgomz, there is no built-in way to accomplish what you are asking.  You can monitor connections programmatically via the management port, though
10:33 -!- rsc [~robert@fedora/rsc] has joined #openvpn
10:34 < rsc> "Options error: You must define CA file (--ca) or CA path (--capath)" <- can't I build simply a static site-to-site VPN without certificates just using key? Like in good old times?
10:38 -!- Blues-Man [~bluesman@87.19.119.201] has joined #openvpn
10:47 <@vpnHelper> RSS Update - forum: Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16734> || partial success <http://forums.openvpn.net/topic9039.html#p16733>
10:48 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:48 -!- mode/#openvpn [+v s7r] by ChanServ
10:56 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
10:58 -!- raidz_afk is now known as raidz
11:01 -!- bluesman_ [~bluesman@87.19.119.45] has joined #openvpn
11:02 < alxgomz> gladiatr: you mean a script taht check the session time in management interface and disconnect if time exceeded?
11:02 < gladiatr> yeah
11:03 -!- Blues-Man [~bluesman@87.19.119.201] has quit [Ping timeout: 240 seconds]
11:05 < alxgomz> gladiatr: can I launch such a script when session comes up instead of continuously monitor management interface?
11:06 <@ecrist> yes
11:06 <@ecrist> --up
11:06 -!- mode/#openvpn [-o ecrist] by ecrist
11:07 < alxgomz> ecrist: is it a problem if --up script sleeps and do not exit for a while?
11:07 < alxgomz> ecrist --up is executed on server or client?
11:09 <@vpnHelper> RSS Update - forum: partial success <http://forums.openvpn.net/topic9039.html#p16735>
11:10 < ecrist> alxgomz: read the man page
11:10 < gladiatr> alxgomz, sure.  As long as your openvpn user has permissions to do whatever deeds your script is endeavoring to commit, you can do it
11:10 < gladiatr> ecrist, pssht.  you and your man pages.  Prayer is superior to man pages :D
11:11 < ecrist> mea culpa
11:15 <+s7r> ecrist: how can i make a web panel to add / remove users .. add users for certain time limit, etc
11:18 < alxgomz> when killing a session from management interface the client is not notified?
11:20 < ecrist> s7r: by coding it
11:20 < ecrist> for $125 UDS/hr, paid up-front, I'll write it for you.
11:23 -!- novaflash_away is now known as novaflash
11:35 <+s7r> ecrist: how many hrs will it take?
11:35 <+s7r> :D
11:40 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 255 seconds]
11:46 < ecrist> s7r: about 40
11:50 -!- lillit [~chatzilla@46.208.72.206] has joined #openvpn
11:51 < alxgomz> ecrist: thanks I'll tell my customer :), who thinks I'm already too expensive ;) 
11:52 < ecrist> no problem.
11:52 < alxgomz> ecrist: can you write c++ as well?
11:53 < ecrist> I don't do c or c++, really, I don't do compiled languages and I stay away from object-oriented programming as much as possible.
11:54 < alxgomz> ecrist: so am afraid you can't help me :'(
11:54 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:54 -!- illsci [~jsabo@66.208.14.74] has left #openvpn []
11:54 < ecrist> alxgomz: it's OK.  I'll still sleep just fine.
11:55 < alxgomz> ecrist: not sure my customer will sleep as well as you :)
11:58 <+s7r> ecrist: 
11:58 <+s7r> pls give me your business email, where you accept orders 
11:58 <+s7r> for further discussion in case needed
11:59 <+s7r> promise on my voice on this channel i will not spam you with viagra pills or porn
11:59 <+s7r> :)))
12:01 -!- novaflash [~novaflash@openvpn/user/novaflash] has quit [Ping timeout: 258 seconds]
12:03 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
12:03 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
12:03 -!- novaflash [~novaflash@openvpn/user/novaflash] has joined #openvpn
12:03 -!- mode/#openvpn [+v novaflash] by ChanServ
12:03 -!- goodcoopr [~andrew@rrcs-24-172-25-66.midsouth.biz.rr.com] has joined #openvpn
12:03 < goodcoopr> anybody have any newer directions on how to create certs with the newer versions? i'm following some old directions and i'm getting all sorts of errors
12:03 < goodcoopr> on win7-64
12:10 -!- lillit [~chatzilla@46.208.72.206] has quit [Read error: Connection reset by peer]
12:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:18 < ecrist> s7r: my info is easy to come by
12:18 < ecrist> goodcoopr: ssl-admin
12:19 < goodcoopr> ssl-admin?
12:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:27 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:31 < krzie> !ssl-admin
12:31 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
12:41 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 252 seconds]
12:45 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has quit [Ping timeout: 252 seconds]
12:45 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
12:45 < krzie> [09:07]  <alxgomz> ecrist: is it a problem if --up script sleeps and do not exit for a while?
12:45 < krzie> actually yes
12:45 -!- ehd [u1451@gateway/web/irccloud.com/x-gpodplaadexmywpm] has quit [Ping timeout: 252 seconds]
12:46 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:46 < krzie> the scripts block the other functions of openvpn
12:46 < krzie> because single threaded
12:46 < krzie> 1 certain solution, and 1 i think would work
12:46 < krzie> the certain solution is to write a plugin in stead of a script, as this would run on a separate thread
12:47 -!- Dougy [me@openvpn/community/user/dougy] has quit [Ping timeout: 252 seconds]
12:47 -!- Dougy [me@tech.qsi.net] has joined #openvpn
12:47 < krzie> and i think having the script start another script in the background and then disowning it would work
12:47 < alxgomz> krzie: yes that what I thought
12:48 < alxgomz> ecrist: a.chapellon@horoa.net
12:49 < alxgomz> krzie: about the first solution, the thing is the time value I want the script to wait before disconnect already have to be read from the radiusplugin
12:50 < alxgomz> krzie: can plugin communicate between each other?
12:51 <@vpnHelper> RSS Update - forum: Star Topolgy - passing routes to all remote servers <http://forums.openvpn.net/topic9052.html#p16736>
12:51 -!- ehd [u1451@gateway/web/irccloud.com/x-vtpatdwnrimwceya] has joined #openvpn
12:52 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
12:53 < krzie> no idea
12:54 < krzie> they run as separate threads if that helps at all
12:54 -!- bluesman_ [~bluesman@87.19.119.45] has quit [Quit: Sto andando via]
12:57 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
12:57 <@vpnHelper> RSS Update - forum: Openvpn dual authetication <http://forums.openvpn.net/topic9051.html#p16737>
12:57 -!- mode/#openvpn [+o mattock] by ChanServ
13:03 <@vpnHelper> RSS Update - forum: need OpenVPN AS instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16738>
13:11 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
13:16 -!- Ionic [ionic@ionic.de] has joined #openvpn
13:45 <@vpnHelper> RSS Update - forum: Help setting up OpenVPN with With Windows <http://forums.openvpn.net/topic9053.html>
14:02 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:03 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:28 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
14:52 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
14:54 -!- innovate [5f22d0e0@gateway/web/freenode/ip.95.34.208.224] has joined #openvpn
15:04 < krzie> Dougy, i sent a couple extra $
15:04 < krzie> received it yet?
15:10 -!- Rewt` [rewt@otaku.sdf.org] has joined #openvpn
15:13 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
15:13 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
15:13 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
15:13 -!- mode/#openvpn [+v Axeman] by ChanServ
15:16 -!- riptide [~riptide@riptide.technomonk.net] has joined #openvpn
15:16 < riptide> test
15:17 < Rewt`> 1 2 3
15:18 < riptide> I'm trying to set up openvpn in a site to site vpn configuration with an amazon ec2 instance running openvpn
15:18 < riptide> I have the P2P tunnel up but I am having trouble routing through my openvpn box on my lan out to amazon
15:18 < EugeneSicK> !ipforward
15:18 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
15:19 < EugeneSicK> !linipforward
15:19 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
15:19 < riptide> I enabled ipforward in the kernel already
15:19 < riptide> and I have been trying different routes via the route command on my local machine
15:20 < riptide> Is this a routing table issue or is there an openvpn config that I may have overlooked?
15:20 < EugeneSicK> "Try it at random" usually doesn't work. 
15:21 < EugeneSicK> Draw out your subnets. Figure out what needs to have what route where. Set this up in the openvpn configs, and then try it.
15:28 < krzie> also
15:28 < krzie> !route_outside_ovpn
15:28 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
15:29 < krzie> oh wait
15:29 < krzie> i saw lan, misunderstood... thought you were routing the lan, now i see you're redirecting internet
15:29 < krzie> !redirect
15:29 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
15:29 < EugeneSicK> Somethign in my memory tells me that amazon EC2 has some insane networking setup
15:30 < krzie> theres only 3 things to do, if all 3 are done it is your firewall
15:30 < EugeneSicK> Which I refuse to decipher while sick
15:30 < krzie> =/ sick sucks
15:34 < riptide> I saw the --redirect-gateway option in the documention but the problem with that is that I want a split vpn setup
16:00 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
16:04 < riptide> Thanks for the suggestions, resolved the problem by adding a route to a network switch. I must have had a problem with the routes on my laptop
16:05 -!- riptide [~riptide@riptide.technomonk.net] has quit [Quit: leaving]
16:32 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 255 seconds]
16:38 -!- Rewt` [rewt@otaku.sdf.org] has quit [Quit: leaving]
16:41 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 248 seconds]
16:50 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
16:56 -!- corretico [~luis@201.201.44.82] has joined #openvpn
17:34 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:49 -!- Denial [Denial@drgi.co.uk] has quit [Ping timeout: 245 seconds]
17:57 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:57 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:57 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:57 -!- mode/#openvpn [+v Axeman] by ChanServ
17:58 <@vpnHelper> RSS Update - forum: Help setting up OpenVPN with With Windows <http://forums.openvpn.net/topic9053.html#p16740>
18:12 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:23 -!- innovate [5f22d0e0@gateway/web/freenode/ip.95.34.208.224] has quit [Quit: Page closed]
18:44 -!- novaflash is now known as novaflash_away
18:46 <@vpnHelper> RSS Update - forum: confused about configs <http://forums.openvpn.net/topic9049.html#p16741>
18:52 <@vpnHelper> RSS Update - forum: Very basic question on samba from a new user <http://forums.openvpn.net/topic9054.html>
18:53 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
18:58 -!- Inv1s1ble [~cassius@208.102.38.251] has joined #openvpn
18:58 <@vpnHelper> RSS Update - forum: Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16743>
19:01 -!- rjwill [~rjwill@c-174-57-26-176.hsd1.nj.comcast.net] has joined #openvpn
19:02 < rjwill> hello... was hopoing someone might be able to help me debug an openvpn setup
19:02 < rjwill> client connects fine
19:02 < Inv1s1ble> don't ask to ask...just ask. What's your setup? 
19:02 < Inv1s1ble> you got you config(s) in a pastebin?
19:02 < rjwill> i can 
19:03 < rjwill> i thin kit might be a fw issue and not openvpn
19:03 < rjwill> server has an external ip and lan ip
19:03 < rjwill> i can ping lan ip from client
19:03 < rjwill> through vpn
19:03 < rjwill> or routing
19:03 < rjwill> fw or routing issue
19:03 < Inv1s1ble> Have you tried turning off your firewall
19:04 < Inv1s1ble> When doing setup, I keep it off until I get everthing configured...make sure it works...then turn it back on and try to let the right stuff through 
19:05 < rjwill> i checked logs to see if anything was being blocked but let me try just to be sure
19:17 -!- raidz is now known as raidz_afk
19:17 < rjwill> nope not fw
19:18 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:18 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
19:20 < rjwill> tun0 ptp goes from client (10.240.0.6) to server (10.240.0.5). I can't ping 10.240.0.5, but I can ping 10.80.10.1 which is the ip of the internal lan interface
19:22 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
19:23 < Inv1s1ble> so you can get to the lan you need to right?
19:24 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:24 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
19:36 < rjwill> one of them
19:36 < rjwill> not others
19:37 < rjwill> i can't mess with this mroe further atm, but i appreciate your time
19:37 < rjwill> thanks
19:37 -!- rjwill [~rjwill@c-174-57-26-176.hsd1.nj.comcast.net] has quit [Quit: leaving]
20:01 -!- raidz_afk is now known as raidz
20:04 -!- raidz is now known as raidz_afk
20:08 -!- raidz_afk is now known as raidz
20:08 -!- raidz is now known as raidz_afk
20:10 -!- raidz_afk is now known as raidz
20:11 -!- raidz is now known as raidz_afk
20:13 -!- raidz_afk is now known as raidz
20:13 -!- raidz is now known as raidz_afk
20:15 -!- raidz_afk is now known as raidz
20:18 -!- raidz is now known as raidz_afk
20:19 -!- raidz_afk is now known as raidz
20:21 -!- Axeman2 [~Axeman3@knox.pace.edu] has joined #openvpn
20:21 -!- Axeman2 [~Axeman3@knox.pace.edu] has quit [Changing host]
20:21 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:21 -!- mode/#openvpn [+v Axeman2] by ChanServ
20:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
20:36 -!- TeckDepot [TeckDepot@just.irc.so] has joined #openvpn
20:56 -!- adolfomaltez [~taro@190.62.236.168] has joined #openvpn
21:13 <@vpnHelper> RSS Update - forum: Difference "route" & "push route" commands <http://forums.openvpn.net/topic9055.html>
21:13 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 240 seconds]
21:16 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
21:17 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
21:18 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:19 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html>
21:26 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:28 -!- InternetToughGuy [~InternetT@rrcs-65-34-25-74.se.biz.rr.com] has joined #openvpn
21:28 < InternetToughGuy> I'm having trouble with adito shutting down right after i start the service
21:35 -!- EugeneSicK is now known as EugeneKay
21:41 -!- InternetToughGuy [~InternetT@rrcs-65-34-25-74.se.biz.rr.com] has quit [Read error: Connection reset by peer]
21:42 -!- raidz is now known as raidz_afk
21:50 -!- raidz_afk is now known as raidz
21:51 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
21:51 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
21:53 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:56 -!- raidz is now known as raidz_afk
21:56 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
21:56 -!- mode/#openvpn [+o dazo_afk] by ChanServ
21:56 -!- raidz_afk is now known as raidz
21:57 -!- raidz is now known as raidz_afk
22:00 -!- raidz_afk is now known as raidz
22:01 -!- raidz is now known as raidz_afk
22:02 -!- raidz_afk is now known as raidz
22:13 -!- adolfomaltez [~taro@190.62.236.168] has quit [Ping timeout: 260 seconds]
22:13 <@vpnHelper> RSS Update - forum: VPN connection lost in seconds <http://forums.openvpn.net/topic9057.html>
22:13 -!- raidz is now known as raidz_afk
22:18 -!- raidz_afk is now known as raidz
22:18 -!- raidz is now known as raidz_afk
22:19 -!- raidz_afk is now known as raidz
22:30 -!- adolfomaltez [~taro@190.62.215.70] has joined #openvpn
22:40 -!- adolfomaltez [~taro@190.62.215.70] has quit [Ping timeout: 240 seconds]
22:40 -!- raidz is now known as raidz_afk
22:41 -!- raidz_afk is now known as raidz
22:50 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:57 -!- adolfomaltez [~taro@190.62.245.122] has joined #openvpn
23:01 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:04 -!- cherwin_ [1776628@xs8.xs4all.nl] has joined #openvpn
23:04 -!- finetic_ [~finetic@213.155.20.16] has joined #openvpn
23:05 -!- lazzer_ [~lazzer@vmlinux.org] has joined #openvpn
23:05 -!- Mowee [~Mowi@lendabrain.net] has quit [Read error: Operation timed out]
23:05 -!- Kateon [482392@xs8.xs4all.nl] has quit [Write error: Broken pipe]
23:05 -!- tty234 [telex@gateway/shell/anapnea.net/x-oasxhsicdqyofbkf] has quit [Read error: Operation timed out]
23:05 -!- yell0 [yello@unaffiliated/contempt] has quit [Read error: Operation timed out]
23:05 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Operation timed out]
23:05 -!- lazzer [~lazzer@vmlinux.org] has quit [Read error: Operation timed out]
23:05 -!- gardar [~gardar@gardar.net] has quit [Read error: Operation timed out]
23:05 -!- cherwin [1776628@xs8.xs4all.nl] has quit [Write error: Broken pipe]
23:05 -!- adolfomaltez [~taro@190.62.245.122] has quit [Ping timeout: 252 seconds]
23:05 -!- finetic [~finetic@213.155.20.16] has quit [Read error: Operation timed out]
23:05 -!- gardar [~gardar@gardar.net] has joined #openvpn
23:05 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
23:06 -!- gardar [~gardar@gardar.net] has joined #openvpn
23:06 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
23:06 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
23:06 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
23:06 -!- gardar [~gardar@gardar.net] has joined #openvpn
23:06 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
23:07 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
23:07 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:07 -!- tty234 [telex@gateway/shell/anapnea.net/x-ymyrzicatzzrcesl] has joined #openvpn
23:07 -!- gardar [~gardar@gardar.net] has joined #openvpn
23:07 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
23:07 -!- adolfomaltez [~taro@190.62.245.122] has joined #openvpn
23:07 -!- gardar [~gardar@gardar.net] has joined #openvpn
23:10 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
23:21 -!- TeckDepot [TeckDepot@just.irc.so] has quit [Quit: ZNC - http://znc.in]
23:22 -!- miorider [17133525@gateway/web/freenode/ip.23.19.53.37] has joined #openvpn
23:23 < miorider> guys may I ask for your help on compiling a tar file?
23:25 -!- miorider [17133525@gateway/web/freenode/ip.23.19.53.37] has left #openvpn []
23:48 -!- TeckDepot [TeckDepot@huh.uh.wtf.la] has joined #openvpn
23:53 -!- TeckDepot [TeckDepot@huh.uh.wtf.la] has left #openvpn []
23:59 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
23:59 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
23:59 -!- mode/#openvpn [+o mattock] by ChanServ
--- Day changed Thu Oct 20 2011
00:00 -!- ziplock [~ziplock@unaffiliated/ziplock] has quit [Ping timeout: 258 seconds]
00:00 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 258 seconds]
00:01 -!- Mowee [~Mowi@lendabrain.net] has quit [Ping timeout: 258 seconds]
00:01 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 258 seconds]
00:01 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
00:02 -!- Mowi [~Mowi@lendabrain.net] has joined #openvpn
00:02 -!- ziplock [~ziplock@static.236.244.46.78.clients.your-server.de] has joined #openvpn
00:03 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
00:03 -!- ziplock is now known as Guest76587
00:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
00:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:24 <@vpnHelper> RSS Update - forum: Is it possible to roll out a single cert for all clients? <http://forums.openvpn.net/topic9058.html>
00:30 <@vpnHelper> RSS Update - forum: confused about configs <http://forums.openvpn.net/topic9049.html#p16748>
00:33 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:35 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
00:35 <@vpnHelper> RSS Update - forum: Help setting up OpenVPN with With Windows <http://forums.openvpn.net/topic9053.html#p16749>
00:36 -!- raidz is now known as raidz_afk
00:37 -!- raidz_afk is now known as raidz
00:42 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16753> || Very basic question on samba from a new user <http://forums.openvpn.net/topic9054.html#p16752> || Is it possible to roll out a single cert for all clients? <http://forums.openvpn.net/topic9058.html#p16751> || Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16750>
00:48 <@vpnHelper> RSS Update - forum: Difference "route" & "push route" commands <http://forums.openvpn.net/topic9055.html#p16754>
00:54 -!- zux [~zux@212.93.105.74] has joined #openvpn
01:00 -!- zux [~zux@212.93.105.74] has quit [Ping timeout: 255 seconds]
01:00 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html> || How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16756> || Is it possible to roll out a single cert for all clients? <http://forums.openvpn.net/topic9058.html#p16755>
01:06 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16758>
01:12 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16760> || Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16759>
01:17 < EugeneKay> !beer
01:17 <@vpnHelper> RSS Update - forum: VPN connection lost in seconds <http://forums.openvpn.net/topic9057.html#p16761>
01:18 < EugeneKay> :-(
01:18 -!- _julian_ [~quassel@hmbg-5f77c7b7.pool.mediaWays.net] has joined #openvpn
01:19 -!- _julian [~quassel@hmbg-4d06ead2.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
01:20 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
01:24 <@vpnHelper> RSS Update - forum: Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16764> || Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16763> || Very basic question on samba from a new user <http://forums.openvpn.net/topic9054.html#p16762>
01:24 -!- _julian [~quassel@hmbg-4d06fa85.pool.mediaWays.net] has joined #openvpn
01:24 -!- _julian_ [~quassel@hmbg-5f77c7b7.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
01:30 <@vpnHelper> RSS Update - forum: Help setting up OpenVPN with With Windows <http://forums.openvpn.net/topic9053.html#p16765>
01:55 -!- zux [~zux@195.13.186.54] has joined #openvpn
02:10 -!- dazo_afk is now known as dazo
02:13 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:17 -!- cheche [cheche@46.25.80.67] has left #openvpn []
02:22 -!- Titania [~titania@221.120.122.106] has joined #openvpn
02:27 -!- Titania [~titania@221.120.122.106] has left #openvpn ["Goodbye :("]
02:40 -!- EugeneKay is now known as EugeneSleep
02:44 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:45 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:54 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 256 seconds]
03:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
03:10 -!- corretico [~luis@201.201.44.82] has joined #openvpn
03:36 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16766>
03:54 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
04:25 -!- kanyl [~kanyl@84.23.155.169] has quit [Ping timeout: 276 seconds]
04:43 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
04:49 -!- zux [~zux@195.13.186.54] has quit [Ping timeout: 260 seconds]
05:03 -!- finetic_ [~finetic@213.155.20.16] has quit [Ping timeout: 256 seconds]
05:10 -!- finetic [~finetic@213.155.20.16] has joined #openvpn
05:13 -!- novaflash_away is now known as novaflash
05:48 -!- _Dave123_ [Octo@nunk.deziweb.com] has joined #openvpn
05:49 < _Dave123_> whats a good vpn client for debian to connect to a openvpn server?
05:49 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
05:52 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
06:01 -!- dazo is now known as dazo_afk
06:07 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16767>
06:08 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 276 seconds]
06:08 < technikfreak> !help
06:08 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
06:09 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
06:13 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has joined #openvpn
06:17 -!- hyper_ch is now known as Sho__
06:17 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:17 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:17 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:17 -!- mode/#openvpn [+v Axeman] by ChanServ
06:17 -!- Sho__ is now known as hyper_ch
06:20 -!- beerbro [~gustav@vi.etcpasswd.net] has quit [Read error: Connection reset by peer]
06:24 -!- gustav- [~gustav@vi.etcpasswd.net] has joined #openvpn
06:33 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:36 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
06:57 -!- zux [~zux@195.13.186.54] has joined #openvpn
07:10 -!- dazo_afk is now known as dazo
07:10 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 258 seconds]
07:11 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
07:30 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
07:34 -!- novaflash is now known as novaflash_away
07:43 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
07:45 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
07:46 <@dazo> _Dave123_: I would suggest OpenVPN ... as OpenVPN is only compatible with OpenVPN ....
07:47 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 248 seconds]
07:55 -!- LarryB [~LarryB@c-76-104-36-165.hsd1.va.comcast.net] has joined #openvpn
08:01 -!- LarryB [~LarryB@c-76-104-36-165.hsd1.va.comcast.net] has quit [Read error: Connection reset by peer]
08:05 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:08 -!- adolfomaltez [~taro@190.62.245.122] has quit [Remote host closed the connection]
08:19 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
08:20 -!- laleshii [4f775b97@gateway/web/freenode/ip.79.119.91.151] has joined #openvpn
08:20 < laleshii> !welcome
08:20 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:21 < laleshii> !howto
08:21 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:21 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
08:21 < laleshii> !logs
08:21 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:22 -!- ehd [u1451@gateway/web/irccloud.com/x-vtpatdwnrimwceya] has quit [Remote host closed the connection]
08:22 < laleshii> !route
08:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
08:31 -!- laleshii [4f775b97@gateway/web/freenode/ip.79.119.91.151] has quit [Ping timeout: 265 seconds]
08:33 -!- ehd [u1451@gateway/web/irccloud.com/x-pwqzndyficqsnzlp] has joined #openvpn
08:33 -!- ehd [u1451@gateway/web/irccloud.com/x-pwqzndyficqsnzlp] has quit [Remote host closed the connection]
08:43 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
08:57 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:57 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:57 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:57 -!- mode/#openvpn [+v Axeman] by ChanServ
09:01 <@vpnHelper> RSS Update - forum: Help setting up OpenVPN with With Windows <http://forums.openvpn.net/topic9053.html#p16768>
09:02 -!- zux [~zux@195.13.186.54] has quit [Ping timeout: 240 seconds]
09:06 -!- master_of_master [~master_of@p57B525BD.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:08 -!- master_of_master [~master_of@p57B55EEC.dip.t-dialin.net] has joined #openvpn
09:10 -!- ehd [u1451@gateway/web/irccloud.com/x-gtlymvelnuyrpwom] has joined #openvpn
09:16 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 240 seconds]
09:29 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
09:50 <@vpnHelper> RSS Update - forum: Help setting up OpenVPN with With Windows <http://forums.openvpn.net/topic9053.html#p16769>
09:56 <@vpnHelper> RSS Update - forum: Help setting up OpenVPN with With Windows <http://forums.openvpn.net/topic9053.html#p16770>
10:13 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:13 -!- mode/#openvpn [+v s7r] by ChanServ
10:18 -!- Guest76587 [~ziplock@static.236.244.46.78.clients.your-server.de] has quit [Quit: Bye]
10:19 -!- Guest24384 [~ziplock@static.236.244.46.78.clients.your-server.de] has joined #openvpn
10:22 -!- Guest24384 [~ziplock@static.236.244.46.78.clients.your-server.de] has left #openvpn []
10:23 -!- ziplock [~ziplock@unaffiliated/ziplock] has joined #openvpn
10:23 -!- krzie is now known as krzee
10:27 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 260 seconds]
10:36 <@vpnHelper> RSS Update - forum: Help setting up OpenVPN with With Windows <http://forums.openvpn.net/topic9053.html#p16772> || Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16771>
10:36 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
10:49 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:49 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:49 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:51 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:51 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:51 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:51 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:03 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
11:05 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
11:06 -!- Ionic [ionic@ionic.de] has joined #openvpn
11:08 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:15 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
11:28 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
11:30 <@vpnHelper> RSS Update - forum: Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16773>
11:31 -!- Ionic [ionic@ionic.de] has joined #openvpn
11:36 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16774>
11:46 -!- dazo is now known as dazo_afk
11:46 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:53 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
12:10 -!- _Dave123_ [Octo@nunk.deziweb.com] has left #openvpn []
12:23 -!- EugeneSleep is now known as EugeneKay
12:48 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16775>
12:54 <@vpnHelper> RSS Update - forum: need OpenVPN AS instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16776>
12:55 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:59 -!- luneff [~yury@84.51.192.74] has joined #openvpn
13:01 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
13:03 -!- trumee_ is now known as trumee
13:12 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16777>
13:13 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
13:18 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16778>
13:22 < krzee> lol the setup he described is clearly in the howto
13:30 <@vpnHelper> RSS Update - forum: OpenVPN bridge can't access machines on local network <http://forums.openvpn.net/topic9060.html>
13:42 < ziplock> Are there any known issues running download managers thru a vpn client on an OSX box to an OpenVPN server?  Mine isn't working 
13:42 -!- iana_ [~ripe@sign.io] has joined #openvpn
13:46 -!- iana_ [~ripe@sign.io] has quit [Client Quit]
13:49 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16780>
13:50 -!- sk1 [~khannast@129.137.216.220] has joined #openvpn
13:51 < sk1> Has anyone had a problem where you can ping from one network to the other, and the pings work fine, but as soon as you try to make a TCP connect (say SSH), the pings die and have no route...then 5 minutes later the pings will start resolving again (the ssh can't connect either)
13:51 < sk1> I know ICMP is different from TCP, by how would a TCP connect change the ICMP routes?
13:51 < sk1> the server is on a windows box. I enabled IP Forwarding in the registry and rebooted too
13:55 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314-15.html#p16781>
13:58 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
14:10 -!- novaflash_away is now known as novaflash
14:10 -!- chokesmaster [~chokesmas@65.92.83.242] has joined #openvpn
14:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
14:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:28 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
14:28 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
14:28 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
14:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
14:37 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
14:49 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16782>
14:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Client Quit]
14:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:04 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
15:09 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
15:17 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
15:19 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
15:19 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
15:44 -!- sk1 [~khannast@129.137.216.220] has quit [Quit: leaving]
15:49 <@vpnHelper> RSS Update - forum: Machine-specific issue which is not caused by configs <http://forums.openvpn.net/topic8155.html#p16783>
15:49 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Ping timeout: 256 seconds]
15:56 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
16:07 <@vpnHelper> RSS Update - forum: confused about configs <http://forums.openvpn.net/topic9049.html#p16784>
16:11 -!- Yen [Yen@unaffiliated/yen] has quit [Remote host closed the connection]
16:35 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
16:52 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
17:13 <@vpnHelper> RSS Update - forum: OpenVPN on DDWRT build 24 SP2 <http://forums.openvpn.net/topic9061.html>
17:20 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
17:20 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
17:27 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
17:31 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16786>
17:37 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16787>
17:55 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
18:00 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
18:02 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
18:02 -!- mode/#openvpn [+o dazo_afk] by ChanServ
18:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:15 -!- novaflash is now known as novaflash_away
18:16 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 256 seconds]
18:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:21 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
18:21 -!- mode/#openvpn [+o dazo_afk] by ChanServ
18:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:25 -!- brushbox [~brushbox@203.14.171.110] has quit [Quit: Leaving.]
18:29 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:41 -!- Denial [Denial@drgi.co.uk] has quit []
18:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:08 <@vpnHelper> RSS Update - forum: Help creating a .p12 file for use with Android <http://forums.openvpn.net/topic9062.html>
19:36 -!- _julian_ [~quassel@hmbg-4d06d049.pool.mediaWays.net] has joined #openvpn
19:39 -!- _julian [~quassel@hmbg-4d06fa85.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
20:21 -!- treund [~treund@97.75.177.42] has joined #openvpn
20:37 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
20:38 <@vpnHelper> RSS Update - forum: Help creating a .p12 file for use with Android <http://forums.openvpn.net/topic9062.html#p16789>
20:53 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
21:00 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
21:08 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16791> || VPN connection lost in seconds <http://forums.openvpn.net/topic9057.html#p16790>
21:27 -!- gffa [~gffa@unaffiliated/gffa] has quit [Read error: Connection reset by peer]
21:28 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
21:56 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:02 -!- treund [~treund@97.75.177.42] has quit [Quit: leaving]
22:14 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:17 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:31 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
22:37 -!- tjz [~pc@bb219-74-189-233.singnet.com.sg] has joined #openvpn
22:37 -!- tjz [~pc@bb219-74-189-233.singnet.com.sg] has quit [Changing host]
22:37 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
22:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:27 <@vpnHelper> RSS Update - forum: Openvpn dual authetication <http://forums.openvpn.net/topic9051.html#p16793> || Newbie has problems with OpenVPN client <http://forums.openvpn.net/topic9033.html#p16792>
23:39 <@vpnHelper> RSS Update - forum: Using web hosting account for VPN tunnel <http://forums.openvpn.net/topic9004.html#p16794>
23:40  * EugeneKay belches loudly
23:43 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
--- Day changed Fri Oct 21 2011
00:13 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
00:16 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Operation timed out]
00:16 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Operation timed out]
00:32 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
00:32 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
00:48 -!- zux [~zux@195.13.186.54] has joined #openvpn
00:54 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
00:54 -!- twister004 [~chatzilla@59.90.104.109] has joined #openvpn
01:52 -!- alxgomz [~alxgomz@26.39.5.93.rev.sfr.net] has quit [Ping timeout: 276 seconds]
01:59 -!- gustav- is now known as beerbro
02:04 -!- beerbro [~gustav@vi.etcpasswd.net] has quit [Changing host]
02:04 -!- beerbro [~gustav@unaffiliated/beerbroy] has joined #openvpn
02:05 -!- beerbro is now known as beerbroy
02:12 -!- bram_ [~bram@217.119.232.20] has joined #openvpn
02:14 < Mowi> Morning
02:25 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:26 -!- alxgomz [~alxgomz@111.153.200.77.rev.sfr.net] has joined #openvpn
02:40 -!- dazo_afk is now known as dazo
02:45 <@vpnHelper> RSS Update - forum: need OpenVPN AS instructions for a rookie (Hyper-V) <http://forums.openvpn.net/topic9041.html#p16797> || Help creating a .p12 file for use with Android <http://forums.openvpn.net/topic9062.html#p16796> || confused about configs <http://forums.openvpn.net/topic9049.html#p16795>
02:49 -!- bram_ [~bram@217.119.232.20] has quit [Read error: Connection reset by peer]
02:50 -!- bram_ [~bram@217.119.232.20] has joined #openvpn
02:51 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16798>
02:57 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:02 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
03:02 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
03:02 <@vpnHelper> RSS Update - forum: OpenVPN on DDWRT build 24 SP2 <http://forums.openvpn.net/topic9061.html#p16799> || How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16778>
03:05 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
03:08 <@vpnHelper> RSS Update - forum: Help creating a .p12 file for use with Android <http://forums.openvpn.net/topic9062.html#p16803> || OpenVPN bridge can't access machines on local network <http://forums.openvpn.net/topic9060.html#p16802> || Help setting up OpenVPN with With Windows <http://forums.openvpn.net/topic9053.html#p16801> || How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16800>
03:14 <@vpnHelper> RSS Update - forum: How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16805> || VPN connection lost in seconds <http://forums.openvpn.net/topic9057.html#p16804>
03:20 -!- jemand [~quassel@brln-4d0c3595.pool.mediaWays.net] has joined #openvpn
03:24 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
03:35 -!- pyronik [~none@cpe-66-108-133-11.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
03:42 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:44 -!- IsilZha [~andreas@182.55.249.76] has quit [Ping timeout: 258 seconds]
03:51 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
03:51 -!- defswork_ [~andy@hns01-fw.internal.gxn.net] has joined #openvpn
03:55 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 255 seconds]
03:57 -!- IsilZha [~andreas@182.55.249.76] has joined #openvpn
03:57 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
04:03 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:03 -!- mode/#openvpn [+o mattock] by ChanServ
04:21 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 256 seconds]
04:21 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
04:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
04:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:34 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 244 seconds]
04:49 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:53 -!- ragnar [~ragnar@80.77.135.50] has joined #openvpn
04:53 < ragnar> hey, when I do a ./revoke-full <key>
04:53 < ragnar> is that enough?
04:53 < ragnar> or do I need to add something to my "openvpn.conf" file?
05:03 < EugeneKay> !crl
05:03 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
05:03 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
05:03 < EugeneKay> You need to add --crl-verify, pointing it at the CRL which was generated after you revoked.
05:03 < EugeneKay> I presume it was a client you revoked, not a server?
05:04 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
05:05 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:05 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 245 seconds]
05:08 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
05:08 -!- zux [~zux@195.13.186.54] has quit [Ping timeout: 256 seconds]
05:14 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 244 seconds]
05:15 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
05:16 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
05:17 < ragnar> is it the
05:17 < ragnar> crl.pem file?
05:18 < ragnar> its a client, yep
05:18 < EugeneKay> Yes.
05:19 < EugeneKay> Just have the server do crl-verify
05:22 -!- dazo is now known as dazo_afk
05:23 -!- zux [~zux@80.81.42.14] has joined #openvpn
05:23 < ragnar> thanks
05:26 -!- stsmith3 [~stsmith@ip66-104-100-163.z100-104-66.customer.algx.net] has joined #openvpn
05:27 < stsmith3> !configs
05:27 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
05:27 -!- rgouveia [~rgouveia@unaffiliated/rgouveia] has joined #openvpn
05:27 < stsmith3> !logs
05:27 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
05:28 < stsmith3> !welcome
05:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:28 < stsmith3> !goal
05:28 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:28 < rgouveia> hi all ...  in a bridge server config can I push dns names to the client?
05:29 < stsmith3> !interface
05:29 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
05:30 < stsmith3> !howto
05:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:30 < stsmith3> !redirect
05:30 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
05:30 < stsmith3> !ipforward
05:30 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
05:31 < stsmith3> !nat
05:31 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
05:32 <@vpnHelper> RSS Update - forum: OpenVPN bridge can't access machines on local network <http://forums.openvpn.net/topic9060.html#p16806>
05:33 -!- laleshii [4f775b97@gateway/web/freenode/ip.79.119.91.151] has joined #openvpn
05:33 < rgouveia> !dns
05:33 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
05:34 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
05:34 < rgouveia> !pushdns
05:34 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
05:34 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
05:36 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
05:37 -!- laleshii [4f775b97@gateway/web/freenode/ip.79.119.91.151] has quit [Client Quit]
05:43 -!- ragnar [~ragnar@80.77.135.50] has quit [Ping timeout: 258 seconds]
05:45 -!- ragnar [~ragnar@80.77.135.50] has joined #openvpn
05:48 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
05:53 -!- zux [~zux@80.81.42.14] has quit [Ping timeout: 240 seconds]
05:56 -!- cherwin_ is now known as cherwin
05:59 -!- jemand [~quassel@brln-4d0c3595.pool.mediaWays.net] has quit [Remote host closed the connection]
06:08 -!- zux [~zux@195.13.186.54] has joined #openvpn
06:16 -!- twister004 [~chatzilla@59.90.104.109] has quit [Quit: ChatZilla 0.9.87 [Firefox 6.0.2/20110902133214]]
06:25 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
06:34 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
06:34 -!- oc80z [oc80z@blea.ch] has joined #openvpn
06:36 -!- aef__ [~quassel@neoschlageter.raxys.net] has joined #openvpn
06:36 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Read error: Operation timed out]
06:36 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 248 seconds]
06:36 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
06:37 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Ping timeout: 260 seconds]
06:38 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:38 -!- mode/#openvpn [+o mattock] by ChanServ
06:39 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
06:39 -!- ph1l [~ph1l@gprs23.swisscom-mobile.ch] has joined #openvpn
06:42 -!- laleshii [4f775b97@gateway/web/freenode/ip.79.119.91.151] has joined #openvpn
06:42 < laleshii> Can someone please please help me with this ... https://forums.openvpn.net/post16806.html ... I'm starting to lose my senses :| .
06:42 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN bridge can't access machines on local network : Configuration (at forums.openvpn.net)
06:45 < krzie> why are you briding?
06:45 -!- ph1l [~ph1l@gprs23.swisscom-mobile.ch] has quit [Read error: Connection reset by peer]
06:45 < krzie> just cause the guide was on bridging?
06:46 < krzie> the very top of the page you linked to says this:
06:46 < krzie> " **You ONLY want to use dev tap if you are tunneling layer2 traffic, if you are using IP traffic you want tun. If you are using tap only for windows file sharing, look into running a WINS server instead."
06:47 < krzie> if all you want is to share a lan:
06:47 < krzie> !sample
06:47 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
06:47 < krzie> !route
06:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
06:47 < krzie> lose the bridge
06:47 < krzie> if you need a specific layer2 protocol, please say which one
06:47 < krzie> ^ @ laleshii 
06:48 -!- defswork_ [~andy@hns01-fw.internal.gxn.net] has quit [Remote host closed the connection]
06:51 -!- Inv1s1ble [~cassius@208.102.38.251] has quit [Read error: Connection reset by peer]
06:51 < laleshii> krzie: Correct me if I'm wrong but if I want to access the local network in which the server is ... I don't have to make a bridge between the local network and the VPN network?
06:51 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
06:52 -!- dazo_afk is now known as dazo
06:52 < krzie> i already corrected you on that
06:52 < krzie> [07:47]  <krzie> !route
06:52 < krzie> [07:47]  <vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
06:52 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
06:53 < krzie> right after:  [07:47]  <krzie> if all you want is to share a lan:
06:53 < krzie> you need to actually read what i say =]
06:53 < EugeneKay> !read
06:53 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
06:54 < krzie> i need to remember that factoid more!
06:55 < laleshii> krzie: sorry :|
06:56 < krzie> its ok, just read
07:01 -!- Inv1s1ble [~cassius@208.102.38.251] has joined #openvpn
07:14 -!- laleshii [4f775b97@gateway/web/freenode/ip.79.119.91.151] has quit [Ping timeout: 265 seconds]
07:15 < stsmith3> !linnat
07:15 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
07:21 -!- laleshii [52890a86@gateway/web/freenode/ip.82.137.10.134] has joined #openvpn
07:23 < laleshii> krzie: Can you please explain what extra route should I exactly add if I find myself on this case: Lets say our server is 10.10.2.10 on its lan, and uses 10.10.2.1 as its default route, and you want the 2.x lan to be accessible or able to access over the vpn.
07:23 -!- rsc [~robert@fedora/rsc] has left #openvpn ["Linux - The future has already started!"]
07:24 < laleshii> This extra route should be added on my wireless router which is actually 10.10.2.1 right?
07:25 < krzie> correct:
07:25 < krzie> !route_outside_ovpn
07:25 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
07:28 <@vpnHelper> RSS Update - forum: OpenVPN on DDWRT build 24 SP2 <http://forums.openvpn.net/topic9061.html#p16807>
07:29 -!- laleshii [52890a86@gateway/web/freenode/ip.82.137.10.134] has quit [Ping timeout: 265 seconds]
07:36 < stsmith3> secure-computing.net not being responsive
07:36 < ecrist> stsmith3: I'm beating the hell out of my internet connection
07:36 < ecrist> try again in a minute
07:36 < stsmith3> no prob
07:38 < stsmith3> got it from google's cache =)
07:38 -!- laleshii [5289082c@gateway/web/freenode/ip.82.137.8.44] has joined #openvpn
07:39 < laleshii> krzie: Thanks man ... everything worked well. Sorry for the trouble.
07:40 < krzie> no trouble, you're welcome
07:44 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 258 seconds]
07:47 < ecrist> heh
07:47 < ecrist> here's why secure-computing.net isn't responding
07:47 < ecrist> last pid: 33741;  load averages: 61.36, 59.37, 31.41                                            up 5+13:11:23  07:26:55
07:47 < ecrist> 232 processes: 38 running, 194 sleeping
07:50 < krzie> omfg
07:50 < krzie> thats some serious usage
07:50 < krzie> i dont think ive ever seen a box of mine work so hard
07:50 < krzie> in fact im not sure ive had hardware that could, lol
07:51 < ecrist> well, I restarted apache
07:51 < ecrist> last pid: 33821;  load averages:  1.12, 25.25, 23.45 
07:51 < krzie> wow, whats up in your web browser that would cause that much work?
07:51 < krzie> err
07:51 < krzie> webserver*
07:51 < ecrist> not sure
07:52 < ecrist> stsmith3: my webserver should be responding now.
07:53 < stsmith3> cool thanks
07:53 < ecrist> thanks for letting me know.
07:56 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16808>
08:00 -!- laleshii [5289082c@gateway/web/freenode/ip.82.137.8.44] has quit [Quit: Page closed]
08:11 -!- goodcoopr [~andrew@rrcs-24-172-25-66.midsouth.biz.rr.com] has quit [Remote host closed the connection]
08:11  * EugeneKay beats ecrist with a stick for good measure
08:14 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
08:16 -!- Axeman [~Axeman3@198.105.46.48] has joined #openvpn
08:16 -!- Axeman [~Axeman3@198.105.46.48] has quit [Changing host]
08:16 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:16 -!- mode/#openvpn [+v Axeman] by ChanServ
08:24 -!- cocoa117 [~cocoa117@wk-29-198.guest.rdg.ac.uk] has joined #openvpn
08:26 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
08:26 <@vpnHelper> RSS Update - forum: OpenVPN bridge can't access machines on local network <http://forums.openvpn.net/topic9060.html#p16810> || Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013.html#p16809>
08:32 <@vpnHelper> RSS Update - forum: Need help with my script <http://forums.openvpn.net/topic9063.html>
08:32 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
08:32 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
08:32 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
08:40 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 260 seconds]
08:40 -!- lazzer_ [~lazzer@vmlinux.org] has quit [Ping timeout: 240 seconds]
08:43 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:44 -!- researcher [17133525@gateway/web/freenode/ip.23.19.53.37] has joined #openvpn
08:45 < researcher> hello I would like to ask how openvpn come up  to be able to create tun tap for windows?
08:47 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
08:48 -!- researcher [17133525@gateway/web/freenode/ip.23.19.53.37] has quit [Client Quit]
08:48 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:52 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 260 seconds]
08:54 -!- alxgomz [~alxgomz@111.153.200.77.rev.sfr.net] has quit [Ping timeout: 252 seconds]
08:55 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has joined #openvpn
08:55 -!- cocoa117 [~cocoa117@wk-29-198.guest.rdg.ac.uk] has quit [Quit: Leaving]
09:00 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
09:05 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 255 seconds]
09:06 -!- master_of_master [~master_of@p57B55EEC.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:08 -!- master_of_master [~master_of@p57B5593B.dip.t-dialin.net] has joined #openvpn
09:10 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Remote host closed the connection]
09:15 -!- spditner [~simon@206-248-134-84.dsl.teksavvy.com] has joined #openvpn
09:16 < spditner> why might a client-connect shell script not be ran every time a particular client connects? It only seems to run the first time the server sees them.
09:18 < Optic> mo mo
09:20 -!- rgouveia [~rgouveia@unaffiliated/rgouveia] has left #openvpn []
09:23 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:25 < ecrist> spditner: I'd look at the logs
09:36 <@vpnHelper> RSS Update - forum: Help creating a .p12 file for use with Android <http://forums.openvpn.net/topic9062.html#p16812>
09:40 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 260 seconds]
09:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:43 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
09:48 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 260 seconds]
09:48 <@vpnHelper> RSS Update - forum: Scalability, UDP buffer code 105, learn-address problem <http://forums.openvpn.net/topic9064.html>
09:50 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
09:51 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:00 <@vpnHelper> RSS Update - forum: Need help with my script <http://forums.openvpn.net/topic9063.html#p16814>
10:10 < spditner> ecrist: the logs aren't showing any failures. First time, I see it say "[client] Peer Connection Initiated with x.x.x.x:1194", execute my script, followed by OPTIONS IMPORT: reading client specific options from: /tmp/openvpnxxx; 2nd time it connects, that block of code seems to be skipped.
10:10 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
10:12 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
10:12 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
10:12 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
10:13 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Client Quit]
10:14 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
10:14 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
10:14 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
10:18 < ragnar> exit
10:18 -!- ragnar [~ragnar@80.77.135.50] has quit [Quit: leaving]
10:19 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:19 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:19 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:20 -!- zux [~zux@195.13.186.54] has quit [Ping timeout: 255 seconds]
10:20 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 252 seconds]
10:28 -!- ehd is now known as evilhackerdude
10:34 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
10:35 -!- dazo is now known as dazo_afk
10:35 -!- Ionic [ionic@ionic.de] has joined #openvpn
10:36 -!- corretico [~luis@201.201.44.82] has joined #openvpn
10:42 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16815>
10:46 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 259 seconds]
10:46 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
10:46 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:59 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:59 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
11:00 <@vpnHelper> RSS Update - forum: OpenVPN AS server error: "Not an access server" <http://forums.openvpn.net/topic9065.html>
11:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
11:06 <@vpnHelper> RSS Update - forum: Help creating a .p12 file for use with Android <http://forums.openvpn.net/topic9062.html#p16818> || [newb Question] OpenVPN VPS <http://forums.openvpn.net/topic9066.html>
11:10 -!- oc80z [~oc80z@blea.ch] has quit [Excess Flood]
11:11 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:11 -!- luneff [~yury@84.51.192.74] has joined #openvpn
11:12 <@vpnHelper> RSS Update - forum: Help creating a .p12 file for use with Android <http://forums.openvpn.net/topic9062.html#p16819>
11:17 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
11:18 <@vpnHelper> RSS Update - forum: OpenVPN on DDWRT build 24 SP2 <http://forums.openvpn.net/topic9061.html#p16820>
11:20 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
11:31 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
11:32 -!- corretico [~luis@201.201.44.82] has joined #openvpn
11:32 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
11:32 -!- corretico [~luis@201.201.44.82] has joined #openvpn
11:45 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:45 -!- mode/#openvpn [+v s7r] by ChanServ
11:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
12:09 -!- nb [~nb@fedora/znc.nb] has quit [Quit: ZNC - http://znc.in]
12:32 -!- novaflash_away is now known as novaflash
12:37 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16821>
12:43 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html>
12:53 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 260 seconds]
12:58 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
12:58 -!- mode/#openvpn [+v Axeman] by ChanServ
12:58 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 260 seconds]
13:33 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
13:35 -!- novaflash is now known as novaflash_away
13:37 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
13:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 255 seconds]
14:21 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:21 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:25 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16823>
14:33 -!- MikeJansen [~217216X71@rrcs-24-56-87-226.ma.biz.rr.com] has quit [Quit: Leaving.]
14:46 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:46 -!- mode/#openvpn [+v s7r] by ChanServ
14:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
14:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:10 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Read error: Connection reset by peer]
15:10 -!- pierreghz [~pierreghz@cust-239-25-111-94.dyn.as47377.net] has joined #openvpn
15:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
15:22 -!- felixfoertsch [8b0b3020@gateway/web/freenode/ip.139.11.48.32] has joined #openvpn
15:41 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
15:42 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
15:54 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Ping timeout: 244 seconds]
16:02 <@vpnHelper> RSS Update - forum: Difference between OpenVPN Desktop and Connect clients? <http://forums.openvpn.net/topic9068.html>
16:08 <@vpnHelper> RSS Update - forum: Need help with my script <http://forums.openvpn.net/topic9063.html#p16825>
16:30 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
16:30 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
16:30 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
16:30 -!- mode/#openvpn [+v Axeman] by ChanServ
16:33 -!- Axeman2 [~Axeman3@knox.pace.edu] has joined #openvpn
16:33 -!- Axeman2 [~Axeman3@knox.pace.edu] has quit [Changing host]
16:33 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
16:33 -!- mode/#openvpn [+v Axeman2] by ChanServ
16:35 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
16:35 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 244 seconds]
16:35 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
16:36 -!- pierreghz [~pierreghz@cust-239-25-111-94.dyn.as47377.net] has quit [Ping timeout: 260 seconds]
16:38 <@vpnHelper> RSS Update - forum: Help with server / client access <http://forums.openvpn.net/topic9069.html>
16:40 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
16:44 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
17:08 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
17:09 -!- a [~d@ps38852.dreamhost.com] has joined #openvpn
17:09 -!- a is now known as Guest82583
17:09 -!- Netsplit *.net <-> *.split quits: SJr, mete, krzie, rkantos, corretico, JPeterson, catsup, EvilJStoker, havoc, freaky[t],  (+4 more, use /NETSPLIT to show all of them)
17:09 -!- JPeterso2 is now known as JPeterson
17:11 -!- Netsplit over, joins: corretico, Inv1s1ble, krzie
17:11 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
17:11 -!- Netsplit over, joins: havoc, EvilJStoker, rkantos, mete, RichardBronosky
17:11 -!- Netsplit over, joins: SJr
17:12 -!- mode/#openvpn [+o dazo_afk] by ChanServ
17:12 -!- Netsplit over, joins: dazo_afk
17:12 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
17:14 -!- Guest82583 [~d@ps38852.dreamhost.com] has left #openvpn []
17:16 -!- felixfoertsch [8b0b3020@gateway/web/freenode/ip.139.11.48.32] has left #openvpn []
17:16 -!- Axeman2 [~Axeman3@knox.pace.edu] has joined #openvpn
17:16 -!- Axeman2 [~Axeman3@knox.pace.edu] has quit [Changing host]
17:16 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:16 -!- mode/#openvpn [+v Axeman2] by ChanServ
17:18 -!- novaflash_away is now known as novaflash
17:18 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16827>
17:47 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
17:48 -!- rjwill [~rjwill@c-174-57-26-176.hsd1.nj.comcast.net] has joined #openvpn
17:48 < rjwill> hello all
17:51 < EugeneKay> Rawr
17:53 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:05 -!- LnL [~LnL@d54C4D6ED.access.telenet.be] has joined #openvpn
18:06 < LnL> how do I only route for instance 8.8.8.8 through the vpn connection?
18:08 < LnL> Anyone? I'm disabeling the server's settings with `route-nopull`
18:13 -!- Reith [~null@unaffiliated/reith] has joined #openvpn
18:14 < Reith> anyone knows a tool/patch works similar http://nihilex.com/obfuscated-openssh for openvpn?
18:14 <@vpnHelper> Title: Secret Handshake for Iran | ni hi lex (at nihilex.com)
18:16 -!- Denial [Denial@drgi.co.uk] has quit []
18:25 -!- LnL [~LnL@d54C4D6ED.access.telenet.be] has quit [Quit: [lnl release];]
18:25 < EugeneKay> Reith - there's --tls-auth, but I don't think that really "obfuscates" it as much as the SSH handshake is supposed to
18:26 < EugeneKay> I also don't know that the SSH handshake patch obfuscates it as much as it's supposed to.... it's hard to disguise a key-exchange and encrypted tunnel traffic.
18:26 < Reith> EugeneKay: thanks.. i'll try it
18:31 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
18:33 -!- dazo_afk [dazo@nat/redhat/x-qrubyknuzrbhguye] has joined #openvpn
18:33 -!- dazo_afk [dazo@nat/redhat/x-qrubyknuzrbhguye] has quit [Changing host]
18:33 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
18:33 -!- mode/#openvpn [+o dazo_afk] by ChanServ
18:46 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
18:46 < rjwill> if i see outgoing connections on an interface (via tcpdump) from a openvpn ip, does that mean masq/nat is not working?
18:47 < rjwill> server side. i can see the request come in on the tunnel 
18:48 < rjwill> then go out on anoher interface, but the source ip is the ip assigned by openvpn
18:48 -!- nb [~nb@fedora/znc.nb] has quit [Ping timeout: 244 seconds]
18:54 -!- Guest65639 [~nb@71.19.144.103] has joined #openvpn
18:56 -!- Guest65639 [~nb@71.19.144.103] has quit [Changing host]
18:56 -!- Guest65639 [~nb@fedora/znc.nb] has joined #openvpn
18:59 -!- Guest65639 [~nb@fedora/znc.nb] has left #openvpn []
18:59 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:00 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:04 < rjwill> got it going, was a nat issue
19:04 -!- rjwill [~rjwill@c-174-57-26-176.hsd1.nj.comcast.net] has quit [Quit: leaving]
19:12 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
19:13 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
19:13 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
19:13 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
19:13 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
19:25 -!- raidz is now known as raidz_afk
19:26 -!- novaflash is now known as novaflash_away
19:34 -!- _julian [~quassel@hmbg-4d06c6a9.pool.mediaWays.net] has joined #openvpn
19:37 -!- _julian_ [~quassel@hmbg-4d06d049.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
19:38 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
19:39 -!- Olipro_ is now known as Olipro
19:43 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
19:45 -!- Olipro_ is now known as Olipro
19:59 -!- researcher [~researche@23.19.53.37] has joined #openvpn
20:02 -!- researcher [~researche@23.19.53.37] has quit []
20:03 -!- raidz_afk is now known as raidz
20:15 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
20:15 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
20:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:15 -!- mode/#openvpn [+v Axeman] by ChanServ
20:16 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
20:16 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:16 -!- mode/#openvpn [+v Axeman2] by ChanServ
20:19 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314-15.html#p16828>
20:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
20:21 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 276 seconds]
20:23  * Dougy pokes at raidz 
20:27 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:28  * jeev pokes at Dougy
20:36 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:44 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has quit [Quit: AAAGH!  IT BURNS!]
20:48 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
20:54 < Pilif12p> Hi
20:55 < Pilif12p> To set up OpenVPN, do I have to open the port 1194 on iptables, or is that only used internally?
20:57 < krzie> assuming you run the server on port 1194 udp, you must open 1194 udp for the ip it listens on (like any listening service)
20:59 < Olipro> well, not necessarily
21:00 < Pilif12p> Something like "iptables -I INPUT -p udp --dport 1194 -j ACCEPT" should do that, right?
21:00 < Olipro> if you're using conntrack and outbound connections are allowed from one side, then setting each OpenVPN endpoint to attempt to connect to the UDP port of the other end should successfully punch a hole in a stateful firewall
21:00 < krzie> Olipro, what do you mean not necessarily?
21:01 < Pilif12p> nmap doesn't seem to see that port 1194 is open
21:01 < krzie> if the server blocks the port, nothing connects
21:01 < Olipro> it won't if nothing is listening on the port
21:01 < Olipro> for nmap to see something, the port must be open and something should be listening on the port
21:01 < krzie> even if something is listening, if you use --tls-auth then nmap cant see openvpn
21:01 < Olipro> ah yes, static key will scupper it
21:02 < krzie> nmap isnt the best tool for testing openvpn connectivity
21:02 < krzie> openvpn is ;]
21:02 < Pilif12p> krzee: I'm trying to connect to it, but I can't get in...
21:02 < Pilif12p> krzie, too
21:02 < Pilif12p> ah, you're the same person.. should'a figured that out
21:03 < krzie> ;]
21:03 < krzie> re: if your rule is right, i cant advise you on your firewall
21:04 < Pilif12p> well, Linode doesn't block ports by default, and I've never had issues with iptables blocking ports
21:04 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
21:05 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 244 seconds]
21:12 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 256 seconds]
21:16 < Pilif12p> krzie: I figured something out:  *   Autostarting VPN 'server'                                                                                         [fail] 
21:16 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
21:16 -!- mode/#openvpn [+o dazo_afk] by ChanServ
21:19 < Pilif12p> aha. "Fri Oct 21 21:18:56 2011 us=920289 Error: private key password verification failed"
21:39 <@raidz> anyone mention me?
21:44 < Pilif12p> ok, i got it to start
21:45 < Pilif12p> but do I have to change any settings in Firefox to get it to load via the VPN, and not my connection?
21:48 < Pilif12p> i'm *trying to* set it up so that you can only access our security interface/phpmyadmin/(sadly) webmin/our techops wiki via vpn, fwiw.
21:51 -!- troyt [~troyt@2001:5c0:1000:b::a06b] has joined #openvpn
22:13 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
22:17 < EugeneKay> Pilif12p - connect to the VPN servers' 10.8.0.1 address instead of the external one ;-)
22:18 < Pilif12p> EugeneKay: What do you mean?
22:18 < EugeneKay> Configure Apache to listen on all addresses, rather than just your public IP
22:18 < EugeneKay> Rather than loading http://host.example.com/, load up http://10.8.0.1/
22:18  * Pilif12p uses nginx
22:19 < EugeneKay> Same principle
22:34 -!- aef__ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:36 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:04 -!- Reith [~null@unaffiliated/reith] has quit [Quit: Killed kvirc with signal 9]
23:14 -!- bitterman [~yury@84.51.192.74] has joined #openvpn
23:17 -!- luneff [~yury@84.51.192.74] has quit [Ping timeout: 258 seconds]
--- Day changed Sat Oct 22 2011
00:08 -!- chantra [~chantra@unaffiliated/chantra] has quit [Ping timeout: 248 seconds]
00:16 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
00:18 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
01:01 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Quit: Leaving]
01:05 < hyper_ch> can you start openvpn somehow on tcp as well as udp? I mean running two instances shold do it, right?
01:07 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
01:24 < krzie> 2 instances, yes
01:24 < krzie> but remember not to overlap on address space, use routing
01:36 < hyper_ch> :(
01:36 < hyper_ch> for some reason, I get now low speeds on tcp again
01:36 < hyper_ch> it worked for months weel
01:36 < hyper_ch> before that, the same happened on udp
01:53 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
01:59 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 244 seconds]
02:04 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
02:11 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16829>
02:23 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p16830>
02:24 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
02:27 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 256 seconds]
02:59 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16831>
03:12 <@vpnHelper> RSS Update - forum: Help with server / client access <http://forums.openvpn.net/topic9069.html#p16832>
03:23 -!- novaflash_away is now known as novaflash
03:31 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:35 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:35 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:35 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:42 -!- jemand [~quassel@brln-4db9e0e9.pool.mediaWays.net] has joined #openvpn
03:43 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 258 seconds]
03:46 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
04:13 -!- madsage [sage@2001:470:c:1292::2] has quit [Ping timeout: 240 seconds]
04:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 256 seconds]
04:26 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
05:04 -!- pierreghz [~pierreghz@cust-252-65-111-94.dyn.as47377.net] has joined #openvpn
05:07 -!- ravel [ravel@175.136.82.14] has joined #openvpn
05:14 -!- star314 [~star314@starnet1.sinh.us] has joined #openvpn
05:15 < star314> Hi! Anyone here who runs OpenVPN on a Samsung Galaxy S2?
05:16 -!- Deim0s [~amine@41.141.139.107] has joined #openvpn
05:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
05:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:24 < Deim0s> hello
05:26 < hyper_ch> star314: no
05:26 < Deim0s> I am looking for a way to fix routing issues in windows 7 client connected to a distant freebsd server over Internet DSL 
05:27 < Deim0s> The setup in both side is correct (indicated by  logs), the only problem is that I can't ping the other side
05:28 < Deim0s> firewall is disables in both side.. the server assign me the IP address but I can't ping him 
05:29 < Deim0s> I have tried the bridging before.. and now using a simple configs for routing method but still have the same routing issue
05:29 < Deim0s> it becomes really frustrated :S
05:31 < EugeneKay> !android
05:31 <@vpnHelper> "android" is (#1) the easiest way to get openvpn on android is to run cyanogenmod, since it comes with tun / busybox / and i think the new version even includes openvpn! or (#2) if you already have tun/root/busybox you can use android-openvpn-installer and openvpn-settings from the market
05:31 < EugeneKay> star314 ^
05:31 < EugeneKay> Also, that factoid is outdated, given as CM includes full OpenVPN support nowadays
05:31  * EugeneKay pokes krzie with a stick
05:32 < star314> hyper_ch: I asked because on my Motorola Milestone I used the Cyanogenmod ROM that comes with OpenVPN preinstalled. I've also tried Cyanogenmod on my new GS2, but I like the original firmware better. So I'm trying to install OpenVPN on the rooted Samsung firmware.
05:32 < star314> EugeneKay: ^^^
05:33 < EugeneKay> star314 - if you're not using CM when it's available for your device, you can expect zero help from me on getting OpenVPN working.
05:33 < star314> hehe
05:33 < star314> ok
05:33 < EugeneKay> I refuse to beat my head against the wall dealing with "rooted stock deodexed XDKANG BACON SE 5.6A"
05:35 -!- raidz is now known as raidz_afk
05:36 < Deim0s> seems that krzee is the only one to help me 
05:37 < star314> EugeneKay: Perhaps I'll switch to CM in a month or so. I have been using CM for a very long time on my Milestone. The Samsung ROM features a lot of nice, new gimmicks, and as I know CM, it is nice to play with something new (until I get bored and switch to CM again).
05:37 < EugeneKay> Deim0s - configs + logs and iptables -L -t filter
05:37 < EugeneKay> (server end)
05:38 < Deim0s> EugeneKay, ok. 
05:39 < star314> EugeneKay: At the moment, not all features of the SG2 are not working in CM, e.g., two days ago, I installed the lastest version of CM and the FM radio did not work.
05:39 < EugeneKay> star314 - whine to $MAINTAINER :-p
05:40 < EugeneKay> Or sign up for Gerrit
05:49 -!- Deim0s [~amine@41.141.139.107] has quit [Ping timeout: 248 seconds]
05:54 -!- amine_ [~amine@41.251.106.68] has joined #openvpn
05:57 -!- bassliner [armin@irc.arje.de] has quit [Quit: wobwobwob]
05:59 -!- trumee [~trumee@cpc3-cmbg7-0-0-cust591.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
06:04 -!- amine_ [~amine@41.251.106.68] has quit [Quit: Leaving]
06:04 -!- amine_ [~amine@41.251.106.68] has joined #openvpn
06:04 -!- amine_ is now known as Deim0s
06:04 < Deim0s> EugeneKay, sorry my friend I lost my connection
06:04 < Deim0s> EugeneKay, this is the info asked : http://pastebin.com/PAdPNYMb
06:05 < Deim0s> I am not running iptables nor pf in my freebsd 
06:05 < EugeneKay> Oh, BSD.
06:05 < Deim0s> and the antivirus firewall is disabled in the windows station
06:05 < EugeneKay> Sorry, I don't know my arse from a hole in the ground in BSD, I doubt I'll be any help
06:05 < Deim0s> EugeneKay, I had the same issue with ubuntu-server 10.04
06:06 < Deim0s> The exactly same problem
06:06 < Deim0s> it's a windows routing issue.. the client lost the way  to send ping packets to the server
06:07 < Deim0s> I can turn on my linux server and show you the same thing 
06:08 < Deim0s> do you want ?
06:09 -!- madsage [sage@2001:470:c:1292::2] has joined #openvpn
06:09 < Deim0s> I have tried xp client too.. same problem.. tried to test the same thing from my home network.. same problem
06:15 < EugeneKay> Any particular reason you're using route-method ?
06:15 < EugeneKay> It "just works" on my windows boxen
06:16 < Deim0s> EugeneKay, I hear that it's necessary in Win Vista and win 7clients
06:16 < EugeneKay> Whoever you heard that from was wrong
06:16 < Deim0s> so the push method from the srver can works
06:16 < Deim0s> ok
06:16 < EugeneKay> Also, is OpenVPN being run with admin privileges?
06:17 < Deim0s> Also yes of course
06:18 < Deim0s> this is where I found the issue about route-method
06:18 < Deim0s> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
06:18 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
06:18 < EugeneKay> Read the firs line of the Caveats section again
06:19 -!- star314 [~star314@starnet1.sinh.us] has quit [Quit: Leaving]
06:19 < EugeneKay> It mentions nothing about vista/7
06:19 < Deim0s> EugeneKay, yes you are right.. I found the same info in my cookbook
06:20 < Deim0s> openvpn 2 cookbook
06:32 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
06:36 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 260 seconds]
06:39 -!- tjz [~pc@bb219-74-189-233.singnet.com.sg] has joined #openvpn
06:39 -!- tjz [~pc@bb219-74-189-233.singnet.com.sg] has quit [Changing host]
06:39 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
06:52 -!- jemand [~quassel@brln-4db9e0e9.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
07:09 -!- _nolife [~Lirezh@83-64-53-66.kocheck.xdsl-line.inode.at] has joined #openvpn
07:10 < _nolife> Hi, why can't I use "pull" and "push" in static key mode ?
07:10 < _nolife> I want a simple static key setup and push the ifconfig information to the client
07:16 -!- felixfoertsch [~chatzilla@safecamp-plus-2072.unibw-hamburg.de] has joined #openvpn
07:16 < _nolife> anyone an idea ?
07:17 < felixfoertsch> Hello!
07:18 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has joined #openvpn
07:19 -!- LuckyY [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 252 seconds]
07:19 < _nolife> I suppose ther eis no way to use push+pull in static key mode. looks like an artificial limitation;/
07:21 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
07:22 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:24 < ravel> hello
07:29 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
07:29 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
07:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:29 -!- mode/#openvpn [+v Axeman] by ChanServ
07:38 < EugeneKay> _nolife - It's because static key mode is "static" - you set it up, then leave it alone. It is kept intentionally simple to make it easy to work with(and hard to screw up)
07:40 < _nolife> Hm yea, well I thought about using static key mode in a commercial environment
07:40 < _nolife> It would be a bit easier if the client config file would only contain passive rules (pulling the config from the server)
07:41 < _nolife> Do you know how openvpn scales when it is started many times as binary? (instead of using the server mode that supports multiple clients)
08:09 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur <http://forums.openvpn.net/topic9070.html>
08:16 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
08:17 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
08:29 < ecrist> _nolife: never heard of anyone doing that
08:30 < ecrist> you're thinking using inetd or something?
08:32 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
08:36 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
08:40 <@vpnHelper> RSS Update - forum: Give users access to different individual private networks <http://forums.openvpn.net/topic9071.html>
08:53 -!- krish [~krish|wir@183.83.169.131] has joined #openvpn
08:53 < krish> guys, i am getting Options error: port number associated with --management directive is out of range when it try to start /etc/init.d/openvpn start
08:53 < krish> what am I missing?
08:56 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
08:56 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
08:58 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p16835>
09:05 -!- master_of_master [~master_of@p57B5593B.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:08 -!- master_of_master [~master_of@p57B5258A.dip.t-dialin.net] has joined #openvpn
09:09 -!- chantra [~chantra@unaffiliated/chantra] has quit [Ping timeout: 248 seconds]
09:09 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
09:14 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
09:14 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
09:21 -!- felixfoertsch [~chatzilla@safecamp-plus-2072.unibw-hamburg.de] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
09:32 <@vpnHelper> RSS Update - forum: Next OpenVPNAS release <http://forums.openvpn.net/topic8962.html#p16836>
09:34 < _nolife> exrist: No, actually custom scripts. I guess I'll give it a try. openvpn does not seem to require a lot of memory/cpu
09:35 -!- dxtr [t5h7wx@unaffiliated/dxtr] has quit [Quit: Lost terminal]
09:35 -!- dxtr [rz12ug@dxtr.cc] has joined #openvpn
09:35 < _nolife> I've a question regarding this setting on the client: "redirect-gateway def1 bypass-dns" . This works perfectly fine for me but what if I want to route to a specific network by using the original default gateway? Is there support to add another custom exception route?
09:36 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:36 -!- mode/#openvpn [+v s7r] by ChanServ
09:36 < _nolife> must be a common question but I did not find much online yet
09:50 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16837>
09:53 < _nolife> got it solved
10:05 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
10:17 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
10:20 < okamis_> Im trying to set up samba with openvpn, and Im wondering if I hsould go bridge or routed
10:20 < hyper_ch> !bridge
10:20 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
10:20 < hyper_ch> !tunortap
10:20 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
10:20 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
10:23 -!- jemand [~quassel@brln-4db9e0e9.pool.mediaWays.net] has joined #openvpn
10:23 < okamis_> hyper_ch: Im not really that hardcore so no knowledge about layer, especially layer2 traffic...
10:25 < hyper_ch> neither do I know
10:27 < okamis_> !wins
10:27 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
10:29 < okamis_> which is fastest, bridge or routing?
10:31 -!- LuckyY_ [~LuckY@s5147475e.adsl.wanadoo.nl] has quit [Ping timeout: 240 seconds]
10:36 < krzie> routing has lower overhead
10:36 < krzie> if you will reach an IP, its layer3
10:36 < krzie> if you will reach a mac address, its layer2
10:37 < okamis_> where can I read up about that?`
10:37 < hyper_ch> and what's layer1?
10:37 < krzie> !google OSI model
10:37 <@vpnHelper> OSI model - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/OSI_model>; The 7 Layers of the OSI Model - Webopedia.com: <http://www.webopedia.com/quick_ref/OSI_Layers.asp>; HowStuffWorks "How OSI Works": <http://computer.howstuffworks.com/osi.htm>
10:37 < krzie> there you guys go
10:37 < okamis_> fyi: the wiki link doesnt work
10:37 < hyper_ch> krzie: thx
10:38 < hyper_ch> and I thought OSI -> Open Source Initiative
10:38 < hyper_ch> but I was wrong
10:41 < okamis_> ah , the nlik works, just a ">" came in
10:55 -!- ravel [ravel@175.136.82.14] has quit []
10:55 < Pilif12p> How does a Windows machine connect to OpenVPN?
10:55 < Pilif12p> The client asks for username/password, but the server uses keys
10:55 < hyper_ch> Pilif12p: you need to start as administrator
10:55 < hyper_ch> and you need to set the keys in the config file
10:56 < Pilif12p> Okay
10:59 < Pilif12p> hyper_ch: ah, I can only find clients for access, not the other server
10:59 < hyper_ch> not sure what you mean
11:00 < Pilif12p> http://openvpn.net/index.php?option=com_content&id=357
11:00 <@vpnHelper> Title: Client Packages (at openvpn.net)
11:00 < Pilif12p> That's for OpenVPN access, is there a difference?
11:00 < hyper_ch> access server?
11:00 < hyper_ch> that's not supported here
11:00 < hyper_ch> check channel topic
11:01 < Pilif12p> i don't use access server.
11:01 < Pilif12p> but I have someone on windows who needs access to the vpn
11:01 < hyper_ch> he needs a configuration file and keys
11:01 < hyper_ch> and run it as admin
11:01 < krzie> it works the same as openvpn for linux
11:02 < krzie> except that you can choose to run it as a service (which actually is akin to linux startup scripts i guess)
11:02 < krzie> and of course paths are different
11:05 < Pilif12p> krzie: But it needs some sort of binary to run, does it not?
11:05 < krzie> it doesnt in linux?
11:05 < krzie> !download
11:05 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
11:05 < Pilif12p> ahh
11:12 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has quit [Quit: Page closed]
11:21 < Pilif12p> hyper_ch: Where is the config file?
11:21 < hyper_ch> usually in /etc/openvpn/client.conf
11:22 < Pilif12p> on Windows? :P
11:22 < hyper_ch> windows is too complicated for my simple brains
11:22 < hyper_ch> if it were as easy as linux I might be able to tell you
11:23 < Pilif12p> hehe
11:34 -!- Pilif12p is now known as GoHawks
11:47 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:00 -!- okamis [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
12:00 -!- okamis [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has quit [Client Quit]
12:01 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
12:02 < okamis_> where or how do I edit the ca , cert and dh parameters to point to the files i generated  in the pki section
12:14 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
12:22 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16838>
12:27 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
12:33 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
12:33 -!- mode/#openvpn [+o dazo_afk] by ChanServ
12:37 -!- p3rror [~mezgani@41.248.191.91] has joined #openvpn
12:37 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
12:37 < JoeGazz84> Hi. When I try to connect to my VPN I get this error - http://pastebin.com/FeMQmr3k
12:47 -!- raidz_afk is now known as raidz
12:52 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Read error: Operation timed out]
12:54 < Dougy> f
12:59 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
13:00 -!- ziplock [~ziplock@unaffiliated/ziplock] has left #openvpn []
13:01 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
13:03 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Changing host]
13:03 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
13:11 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:12 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:14 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
13:16 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
13:16 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16839>
13:18 -!- p3rror [~mezgani@41.248.191.91] has quit [Read error: Connection reset by peer]
13:27 -!- novaflash is now known as novaflash_away
13:29 -!- LuckyY [~LuckY@188.142.61.123] has joined #openvpn
13:31 -!- madsage [sage@2001:470:c:1292::2] has quit [Remote host closed the connection]
13:41 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16840>
13:41 < krzie> okamis_, in your config...
13:43 < |Mike|> d
13:45 -!- LucasAndrei [~LucasAndr@50.7.244.186] has joined #openvpn
13:47 < krzie> JoeGazz84, 
13:47 < krzie> !certverify
13:47 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
13:49 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
14:06 -!- LucasAndrei [~LucasAndr@50.7.244.186] has left #openvpn []
14:22 -!- madsage [sage@2001:470:c:1292::2] has joined #openvpn
14:23 < GoHawks> krzie: JoeGazz84 is who I'm helping, can that be run on Windows?
14:23 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
14:28 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:28 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html>
14:33 < madsage> jow_laptop, its workign thanks for the help. its acting right now.
14:35 < madsage> not sure what it was, i think the dhcp client on the windows machine i'm using was also not helping
14:36 < madsage> oh wait. maybe not. shit i still had it static assigned. 
14:37 < madsage> hey the dhcp and lan address should be on which interface, lan or the lan bridge
14:38 < EugeneKay> !tunortap
14:38 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:38 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
14:43 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
14:47 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
14:49 -!- Deim0s [~amine@41.251.106.68] has quit [Quit: Leaving]
14:51 -!- GoHawks is now known as Pilif12p
14:52 < okamis_> in my key map i dont have a dh.pem, but I do have a 1.pem and 2.pem, could they possibly be dh1.pem and dh2.pem?
14:55 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
14:57 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16842>
15:03 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16843>
15:31 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
15:36 -!- finetic [~finetic@213.155.20.16] has quit [Quit: leaving]
15:44 -!- krish [~krish|wir@183.83.169.131] has quit [Ping timeout: 240 seconds]
15:45 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16844>
16:35 -!- pierreghz_ [~pierreghz@cust-48-16-111-94.dyn.as47377.net] has joined #openvpn
16:37 -!- pierreghz [~pierreghz@cust-252-65-111-94.dyn.as47377.net] has quit [Ping timeout: 258 seconds]
16:53 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
16:58 < JoeGazz84> krzee: Ran that, got http://pastebin.com/5ZnNGFg3
17:02 < Pilif12p> ah
17:02 < Pilif12p> JoeGazz84: you forgot to add -CAfile
17:05 < JoeGazz84> I didn't know to do that...
17:20 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
17:33 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
17:42 < krzee> !certverify
17:42 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
17:42 < krzee> how did you not know?
17:42 < krzee> o_O
17:43 < krzee> ild clarify it, but i cant see how to
17:45 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has quit [Quit: Page closed]
17:49 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:58 < Pilif12p> krzee: probably because that was actually me running the commands, but he was on irc
18:00 < Pilif12p> krzee: but yeah, it said that it was okay
18:00 < krzee> md5 ca.crt on both sides
18:06 < Pilif12p> krzee: it's not gonna be the same, one is .conf and one .ovpn
18:06 < Pilif12p> (is it?)
18:06 < Pilif12p> er
18:06 < krzee> umm
18:06 < krzee> i said ca.crt
18:06 < Pilif12p> i know
18:06 < Pilif12p> i checked ca.crt against config.ovpn 9_9
18:07 < krzee> whats that have to do with the filename extension for your config
18:07 < krzee> lol
18:07 < krzee> you guys follow directions well i see
18:07 < Pilif12p> but they don't match
18:07 < Pilif12p> that's probably a problem
18:07 < krzee> yep
18:07 < krzee> not just *a* problem
18:07 < krzee> *the* problem
18:11 < Pilif12p> krzee: Now it matches, but same error...
18:11 < EugeneKay> krzee - could you update the !android factoid please? https://gist.github.com/1305857
18:11 <@vpnHelper> Title: EugeneKay's gist: 1305857 Gist (at gist.github.com)
18:12  * krzee gets excited
18:12 < krzee> nice, thanks
18:13 < krzee> (i thought you had made the patch for importing config into cm's interface)
18:13 < EugeneKay> Nope, not me.
18:13 < krzee> !android
18:13 <@vpnHelper> "android" is (#1) the easiest way to get openvpn on android is to run cyanogenmod, since it comes with tun / busybox / and i think the new version even includes openvpn! or (#2) if you already have tun/root/busybox you can use android-openvpn-installer and openvpn-settings from the market
18:13 < krzee> !forget android *
18:13 <@vpnHelper> Joo got it.
18:13 < krzee> !learn android as CyanogenMod includes an integrated OpenVPN client. You will need a !p12 to load your certificates.
18:13 <@vpnHelper> Joo got it.
18:13 < krzee> !learn android as If you can't get CM, get root/busybox/tun and grab android-openvpn-installer + openvpn-settings from Market
18:13 <@vpnHelper> Joo got it.
18:13 < EugeneKay> I did look into quite a while ago, though.
18:14 < EugeneKay> I don't think CM can import configs.... at least, I've never seen/'tried such an option
18:14 -!- novaflash_away is now known as novaflash
18:15 < krzee> no, it can not
18:16 < krzee> it really should be able to tho, it would be so easy
18:16 < krzee> i mean... when i setup android+ openvpn half the time i dont use any gui at all, i do it with adb shell
18:16 < krzee> with a normal openvpn config
18:17 < krzee> so literally, all they would have to do is copy it over and run openvpn with it, done
18:17 < EugeneKay> Patches welcome. :-p
18:18 < krzee> does it happen to be coded in bash?
19:03 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:04 <@vpnHelper> RSS Update - forum: No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16845>
19:10 < EugeneKay> Java :v
19:34 -!- _julian_ [~quassel@hmbg-5f765fab.pool.mediaWays.net] has joined #openvpn
19:37 -!- _julian [~quassel@hmbg-4d06c6a9.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
19:52 -!- Denial [Denial@drgi.co.uk] has quit []
20:00 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
20:09 -!- novaflash is now known as novaflash_away
20:14 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
20:23 -!- jemand [~quassel@brln-4db9e0e9.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
20:31 -!- Axeman [~Axeman3@knox.pace.edu] has joined #openvpn
20:31 -!- Axeman [~Axeman3@knox.pace.edu] has quit [Changing host]
20:31 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:31 -!- mode/#openvpn [+v Axeman] by ChanServ
20:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
21:05 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
21:05 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
21:05 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:05 -!- mode/#openvpn [+v Axeman] by ChanServ
21:13 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
21:17 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
21:17 -!- mode/#openvpn [+o dazo_afk] by ChanServ
21:41 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has joined #openvpn
21:43 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has quit [Excess Flood]
22:00 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:09 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
22:13 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:23 -!- patelx [nebula@openvpn/corp/admin/patel] has quit [Ping timeout: 240 seconds]
23:05 < EugeneKay> !configs
23:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
23:46 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
--- Day changed Sun Oct 23 2011
00:00 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
00:15 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Organize your IRC]
00:21 < madsage> krazee still around?
00:52 -!- Titania [~titania@221.120.122.106] has joined #openvpn
00:53 -!- chokesmaster [~chokesmas@65.92.83.242] has quit []
00:59 -!- Titania [~titania@221.120.122.106] has quit [Read error: Connection reset by peer]
01:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
01:08 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
01:08 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
01:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:43 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:16 -!- hashc [~hash@76.241.139.147] has joined #openvpn
02:25 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16846>
03:06 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Ping timeout: 252 seconds]
03:08 -!- hashc [~hash@76.241.139.147] has quit [Remote host closed the connection]
03:10 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
03:22 -!- jemand [~quassel@brln-4d0c0507.pool.mediaWays.net] has joined #openvpn
03:25 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
03:25 -!- corretico [~luis@201.201.44.82] has joined #openvpn
03:30 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 244 seconds]
03:39 -!- novaflash_away is now known as novaflash
03:43 -!- corretico [~luis@201.201.44.82] has joined #openvpn
03:45 -!- deever [~deever@static.172.68.46.78.clients.your-server.de] has quit [Ping timeout: 240 seconds]
03:46 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 255 seconds]
03:46 -!- MrPPS [~quassel@unaffiliated/mrpps] has quit [Ping timeout: 252 seconds]
03:47 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
03:49 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
04:16 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has quit [Ping timeout: 244 seconds]
04:16 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has joined #openvpn
05:30 < amero> how do you configure openvpn to enable ipv6 support?
05:31 < amero> im using ubuntu. their build of openvpn already has ipv6
05:34 -!- krish [~krish|wir@183.83.169.131] has joined #openvpn
05:37 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
05:39 -!- krish [~krish|wir@183.83.169.131] has quit [Read error: Connection reset by peer]
06:05 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 256 seconds]
06:12 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
06:12 -!- mode/#openvpn [+o dazo_afk] by ChanServ
06:42 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:46 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
06:49 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Remote host closed the connection]
07:00 -!- _nolife is now known as __nolife
07:14 <@vpnHelper> RSS Update - forum: Give users access to different individual private networks <http://forums.openvpn.net/topic9071.html#p16847>
07:34 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:34 -!- mode/#openvpn [+v s7r] by ChanServ
08:26 -!- raidz is now known as raidz_afk
08:32 -!- raidz_afk is now known as raidz
08:33 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:43 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
08:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
08:47 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
08:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:06 -!- master_of_master [~master_of@p57B5258A.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
09:09 -!- master_of_master [~master_of@p57B524D2.dip.t-dialin.net] has joined #openvpn
09:19 -!- Inv1s1ble [~cassius@208.102.38.251] has quit [Remote host closed the connection]
09:29 -!- amero [~amero@unaffiliated/amero] has quit [K-Lined]
09:29 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [K-Lined]
09:33 -!- raidz is now known as raidz_afk
09:36 -!- crypt2 [~crypt2@mail.upson.cc] has joined #openvpn
09:36 < crypt2> hello
09:36 < crypt2> question
09:36 < crypt2> i just set up openvpn 2.2.1 on a windows 2008 r2 sp1 node
09:36 < crypt2> when i bridge the tap nic with the eth0, it cannot gain access to the network i statically input
09:37 < crypt2> is this a known issue?
09:39 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
09:39 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [K-Lined]
09:41 < crypt2> any1?
09:44 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
09:44 < sedulous> can I use the same X.509 PKI for both OpenVPN and StrongSwan IPsec?
09:44 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
09:45 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
09:48 < __nolife> Can openvpn in static-key mode reject a second user that comes from a different IP on the same udp port? Right now this causes both connected clients to stop due to encryption problems
09:48 -!- jemand [~quassel@brln-4d0c0507.pool.mediaWays.net] has quit [Remote host closed the connection]
09:49 -!- raidz_afk is now known as raidz
09:49 < __nolife> i tried the max-clients setting but it's not workin in that mode
09:52 -!- raidz is now known as raidz_afk
10:36 < crypt2> any support here?
10:41 < jeev> crypt2, shut the hell up. ask your question and wait, do you expect people who are out or sleeping to wake up and answer your quetsion?
10:41 < jeev> question
10:41 < jeev> dont ask for support, ask your question. you asked, nobody will answer.. wait and ask again.
10:41 -!- crypt2 [~crypt2@mail.upson.cc] has left #openvpn []
10:41 < jeev> loser
10:55 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
10:56 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection timed out]
10:57 -!- corretico [~luis@201.201.44.82] has joined #openvpn
11:11 < krzie> __nolife, static key cant have a second client under any conditions
11:11 < krzie> you may be looking for client/server
11:31 -!- p3rror [~mezgani@41.140.182.66] has joined #openvpn
11:36 -!- raidz_afk is now known as raidz
11:59 <@vpnHelper> RSS Update - forum: Help with Start-Up Error <http://forums.openvpn.net/topic9073.html>
12:17 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
12:34 -!- raidz is now known as raidz_afk
12:38 -!- vasily [~vasily@dyn-64-46-125.dzer.fttbee.kis.ru] has joined #openvpn
12:44 -!- vasily [~vasily@dyn-64-46-125.dzer.fttbee.kis.ru] has quit [Quit: so long]
12:44 -!- vasily [~vpopov@dyn-64-46-125.dzer.fttbee.kis.ru] has joined #openvpn
12:47 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:53 -!- vpopov [~vasily@dyn-64-46-125.dzer.fttbee.kis.ru] has joined #openvpn
12:54 -!- vpopov [~vasily@dyn-64-46-125.dzer.fttbee.kis.ru] has quit [Read error: Connection reset by peer]
12:55 -!- raidz_afk is now known as raidz
12:58 -!- vasily [~vpopov@dyn-64-46-125.dzer.fttbee.kis.ru] has quit [Quit: so long]
12:58 -!- vasily [~vasily@dyn-64-46-125.dzer.fttbee.kis.ru] has joined #openvpn
13:08 -!- vasily [~vasily@dyn-64-46-125.dzer.fttbee.kis.ru] has quit [Read error: No route to host]
13:11 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:12 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:15 < vect0rx> 6400nomore
13:15 < vect0rx> err disregard lolllll
13:17 < krzee> weak pass
13:17 < vect0rx> i know right
13:18 < vect0rx> thank god it only had to be changed in a singular location :)
13:19 < krzee> reuse is bad
13:19 < EugeneKay> hunter2
13:19 < vect0rx> hehe
13:25 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
13:26 -!- raidz is now known as raidz_afk
13:37 -!- Denial [Denial@drgi.co.uk] has quit []
13:46 -!- pierreghz_ [~pierreghz@cust-48-16-111-94.dyn.as47377.net] has quit [Quit: Quitte]
13:53 -!- mordy [~mordy@71-80-218-26.dhcp.crcy.nv.charter.com] has joined #openvpn
13:54 < mordy> is it possible to write a client-side openvpn plugin?
13:55 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
13:55 -!- raidz_afk is now known as raidz
13:57 < mordy> i'd like to write a plugin that's able to provide the username and password, as well as intercept when the connection is broken, when an IP is assigned, get routing preferences etc. etc.
13:58 < EugeneKay> You can do anything at Zombo Com. The only limit is yourself.
13:58 < mordy> lol
13:59 < EugeneKay> It's open source, poke about in the code yourself. I think there's an #openvpn-dev channel that'll have people who knwo the codebase
13:59 < mordy> ahh ok
13:59 < EugeneKay> This is more of end-user help
14:00 < mordy> any idea on which network that channel would be? can't find it on freenode :/
14:00 < EugeneKay> This one? >_>
14:00 < EugeneKay> !dev
14:00 <@vpnHelper> "dev" is https://lists.sourceforge.net/lists/listinfo/openvpn-devel to sign up for devel mail list
14:00 < EugeneKay> !factoids
14:00 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
14:00 < EugeneKay> Hrm, nothing useful there
14:04 -!- wolfric [~wolfric@pdpc/supporter/student/wolfric] has quit [Remote host closed the connection]
14:10 <@vpnHelper> RSS Update - forum: Trying to compile the tap driver source code <http://forums.openvpn.net/topic9074.html>
14:17 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 244 seconds]
14:21 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
14:22 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
14:25 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
14:28 <@vpnHelper> RSS Update - forum: Can someone tell me the difference between these 3 packages? <http://forums.openvpn.net/topic9075.html>
14:48 -!- promet [~promet@cpe-69-201-179-24.nyc.res.rr.com] has joined #openvpn
14:58 < mordy> hrrm.. seems most client operations are done through the management interface
15:02 < promet> Pardon for the "not strictly OpenVPN" question, but Hello, I'm trying to setup OpenVPN on an Ubuntu Box, as per the instructions here: http://bit.ly/ktU60 . There is a step where you're supposed to copy some certs, keys, etc. to the client machine. My sftp refuses to copy with permission denials. Does anyone know why this might be? 
15:02 < promet> I am wondering if the permissions problem isn't opevpn particular
15:06 < promet> Yeah, I was trying to do it "commando"-line style, I will look into the admin-gui
15:12 -!- felixfoertsch [~chatzilla@safecamp-plus-7123.unibw-hamburg.de] has joined #openvpn
15:19 -!- felixfoertsch [~chatzilla@safecamp-plus-7123.unibw-hamburg.de] has quit [Ping timeout: 260 seconds]
15:22 <@vpnHelper> RSS Update - forum: Difference between OpenVPN Desktop and Connect clients? <http://forums.openvpn.net/topic9068.html#p16852>
15:22 -!- promet [~promet@cpe-69-201-179-24.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
15:29 -!- technikfreak [~ownpgroam@unaffiliated/technikfreak] has quit [Quit: have a real life]
15:35 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
15:38 -!- promet [~promet@cpe-69-201-179-24.nyc.res.rr.com] has joined #openvpn
15:43 -!- promet [~promet@cpe-69-201-179-24.nyc.res.rr.com] has quit [Ping timeout: 248 seconds]
15:46 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
15:49 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
15:51 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Client Quit]
15:58 -!- raidz is now known as raidz_afk
16:05 -!- okamis__ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
16:06 -!- okamis__ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has quit [Client Quit]
16:06 -!- okamis__ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
16:07 -!- okamis__ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has left #openvpn []
16:08 -!- okamis__ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
16:08 -!- okamis__ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has quit [Client Quit]
16:08 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has quit [Ping timeout: 265 seconds]
16:10 < sedulous> is it possible to use one shared X.509 PKI for both OpenVPN and StrongSwan/IPsec?
16:10 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
16:12 < okamis_> following the howto guide but think i missed something, the command openvpn "/path/to/server.conf" gives me no output
16:12 < okamis_> http://pastebin.com/GG0cSFvC
16:25 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
16:33 < EugeneKay> sedulous - sure.
16:35 < EugeneKay> OpenVPN isn't too picky about the cert signings, but it's recommended you set the nscerttype to server/client and such.
16:36 < sedulous> ok great. thanks EugeneKay 
16:36 < sedulous> that will simplify things
16:36 < EugeneKay> Note: Monkeys may fly out of your butt, all wrongs reserved.
16:37 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has quit [Quit: Page closed]
16:40 -!- raidz_afk is now known as raidz
16:41 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
16:49 -!- linkinations [bc7e4a76@gateway/web/freenode/ip.188.126.74.118] has joined #openvpn
16:51 < linkinations> Hello! is it possible to connect to the freenode server using a openvpn connection?
16:55 <+s7r> linkinations: of course
16:55 <+s7r> you can use the openvpn connection as default for all your internet traffic if you would like to
16:59 < linkinations> +s7r: How do I configure it?
17:00 <+s7r> push "redirect-gateway def1"
17:00 <+s7r> !push
17:00 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
17:00 <+s7r> !push gateway
17:01 < linkinations> Because whenever i try to import my .ovpn file from Anonine I get the error message saying it can't read it
17:02 < krzee> !redirect
17:02 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:02 < krzee> note, you dont need to redirect EVERYTHING, you can be more selective by just using --route
17:02 < krzee> and you dont *need* to push it, you can control it from the client config if you prefer
17:03 <+s7r> linkinations: that file might be corrupt in this case....
17:03 <+s7r> krzee: how you control it from the client config?
17:04 <+s7r> route all the internet traffic through the vpn without push gateway
17:04 < krzee> just dont use push
17:04 < krzee> !push
17:04 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
17:04 < krzee> "makes the command act as if it was in the client config"
17:04 < krzee> instead of pushing, you can just put in directly in the client config
17:05 < linkinations> well it seem to work when I use "sudo openvpn anonine.ovpn". It is when I try to import to network-manager I get the error...
17:05 <+s7r> doesn't the server has to allow you to route your internet traffic through it
17:05 < krzee> then the client has more control... they *should* do this in vpn provider setups so that we dont need to have !splitroute and !routeoverride  but many people just blindly push instead of thinking what will be better for * users
17:06 < krzee> s7r, of course, but it doesnt have to shove a default down your throat, it can allow you to decide to default route or just send some subnets (he only mentioned a freenode server...)
17:06 < krzee> !netman
17:06 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
17:07 <+s7r> krzee: a --route syntax can be added in the client config
17:07 <+s7r> with no notice to the server?
17:08 <+s7r> and traffic to that destination will be routed
17:08 < krzee> assuming the nat rule and ip forwarding is setup right, yes
17:08 < krzee> its the client routing table that matters once those 2 things are done right
17:09 < krzee> the server doesnt need to care if its only certain subnets or everything being routed over it
17:09 <+s7r> yes of course but you need to allow from the server at least *certain subnets*
17:10 < krzee> the server does not need to *push* anything
17:10 < krzee> the rest of redirect obviously needs to be properly configured
17:10 < krzee> "[15:02]  <krzee> note, you dont need to redirect EVERYTHING, you can be more selective by just using --route
17:10 < krzee> "
17:10 < krzee> thats only regarding push, i never said you dont need nat/ip forwarding
17:11 <+s7r> of course. example if the vpn server assigns for clients RFC1918 IPs, and the client wants to route even one subnet *freenode server* through the vpn, the server needs at least ip forwarding & postroutings
17:11 <+s7r> iptables magic
17:12 <+s7r> good to know. thanks. i always included push 'redirect gateway def1'
17:12 < krzee> ya thats common, and quite often thats exactly what is wanted
17:12 < krzee> however, if you arent 100% that every user will always want that, it goes better in client config
17:14 <+s7r> i had one config on a russian server, it has no push redirect gateway and no  route
17:14 <+s7r> but when I connect to it and open the browser I had the server's IP addr
17:14 <+s7r> i am reffering to the client config
17:14 <+s7r> don't have access to see what's in server config
17:21 < krzee> sure you do, at least anything pushed to you
17:21 < krzee> (in your log upon connecting)
17:22 <+s7r> yes but ... if in my client config there is no push or route...
17:22 <+s7r> why is the internet traffic redirected
17:22 <+s7r> what if i do not want redirection
17:23 < EugeneKay> Then don't launch openvpn :-p
17:23 < krzee> that is the point of what i told you!
17:23 < krzee> it is pushed to you by the server, they should have left it in the client config instead
17:23 < krzee> however, your answer is here:
17:23 < krzee> !route_override
17:23 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
17:23 <+s7r> in my case, it's push into server config direct, not in client as you said
17:24 < krzee> you still are not understanding
17:24 -!- felixfoertsch [~chatzilla@safecamp-plus-0018.unibw-hamburg.de] has joined #openvpn
17:24 < krzee> the server is pushing the option to the client
17:24 < krzee> they SHOULD have put it in the client instead
17:24 < krzee> me telling you that this can be done is how this conversation started
17:25 < felixfoertsch> Good evening. I installed dd-wrt (linux software) on my router. I configured the openvpn-client on that router. I got it to connect. Now I want to route the wlan and lan ports through the openvpn-client. How do I do that? Simply bridging the TAP device into br0 or NAT does not work.
17:25 < krzee> then you gave anecdotal evidence for me being right
17:25 <+s7r> krzee: thanks! got it but explained wrong. thanks
17:25 < krzee> felixfoertsch, dont need bridge for that
17:25 < krzee> !route
17:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
17:26 < EugeneKay> I give up on trying to get any work done today.
17:27 < EugeneKay> Weekends are fooking impossible on my ISP.
17:28 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
17:29 < felixfoertsch> !tcpip
17:29 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
17:33 -!- linkinations [bc7e4a76@gateway/web/freenode/ip.188.126.74.118] has quit [Ping timeout: 265 seconds]
17:35 < felixfoertsch> krzee: Thanks. 
17:36 < krzee> yw
17:36 < felixfoertsch> I actually think the error is a result from another problem.
17:36 -!- bitterman [~yury@84.51.192.74] has quit [Quit: Leaving]
17:36 < felixfoertsch> The log says the following: MANAGEMENT: Client connected from 127.0.0.1:5001; D MANAGEMENT: CMD 'state' ; MANAGEMENT: Client disconnected
17:36 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 244 seconds]
17:37 -!- dazo_afk [dazo@nat/redhat/x-rrqoxtwpzqwgotml] has joined #openvpn
17:37 -!- dazo_afk [dazo@nat/redhat/x-rrqoxtwpzqwgotml] has quit [Changing host]
17:37 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
17:37 -!- mode/#openvpn [+o dazo_afk] by ChanServ
17:37 < felixfoertsch> And it does not get a remote address, which is neccesarry, right?
17:41 < krzee> !confgen
17:41 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
17:44 < felixfoertsch> Perhaps I have to elaborate a bit. I can't configure the server. I want to achieve the following: http://img23.imageshack.us/img23/5008/internetsetup.png
17:45 < felixfoertsch> When running the config on my desktop pc, it works. Im currently online via the openvpn-client (with gui on windows).
17:46 < felixfoertsch> I basically copied the config onto the router and got it working. More or less.
17:49 < felixfoertsch> It puts out: Server: : SUCCESS Local Address: x.x.x.x Remote Address: Client: CONNECTED: SUCCESS Local Address: x.x.x.x Remote Address:
17:55 -!- felixfoertsch [~chatzilla@safecamp-plus-0018.unibw-hamburg.de] has quit [Ping timeout: 248 seconds]
17:57 -!- felixfoertsch [~chatzilla@safecamp-plus-7048.unibw-hamburg.de] has joined #openvpn
18:01 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:03 < felixfoertsch> !welcome
18:03 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:04 < felixfoertsch> !goal
18:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:07 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
18:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
18:09 -!- felixfoertsch [~chatzilla@safecamp-plus-7048.unibw-hamburg.de] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
18:10 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Remote host closed the connection]
18:11 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 244 seconds]
18:15 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
18:41 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
18:48 -!- MrPPS [~quassel@canyouget.in] has joined #openvpn
18:48 -!- MrPPS [~quassel@canyouget.in] has quit [Changing host]
18:48 -!- MrPPS [~quassel@unaffiliated/mrpps] has joined #openvpn
18:48 -!- brushbox1 [~brushbox@203.14.171.110] has joined #openvpn
18:50 -!- brushbox [~brushbox@203.14.171.110] has quit [Ping timeout: 252 seconds]
18:53 -!- Denial [Denial@drgi.co.uk] has quit []
18:55 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:19 -!- fread2281 [~fread2281@70-56-134-180.albq.qwest.net] has joined #openvpn
19:33 -!- _julian [~quassel@hmbg-4d06a043.pool.mediaWays.net] has joined #openvpn
19:33 -!- _julian_ [~quassel@hmbg-5f765fab.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:49 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
19:54 -!- adolfomaltez [~taro@190.62.201.35] has joined #openvpn
20:03 -!- brushbox1 [~brushbox@203.14.171.110] has quit [Quit: Leaving.]
20:13 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:26 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
20:27 -!- LowKey [rhel@unaffiliated/lowkey] has quit [Quit: changing servers]
20:47 -!- p3rror [~mezgani@41.140.182.66] has quit [Remote host closed the connection]
20:51 -!- corretico_ [~luis@200.12.40.25] has quit [Ping timeout: 240 seconds]
20:53 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
20:57 -!- adolfomaltez [~taro@190.62.201.35] has quit [Ping timeout: 252 seconds]
21:05 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Ping timeout: 245 seconds]
21:06 -!- fremo_ [~fremo@noc.toile-libre.net] has quit [Ping timeout: 260 seconds]
21:08 -!- nb [~nb@fedora/znc.nb] has quit [Quit: ZNC - http://znc.in]
21:09 -!- fremo_ [~fremo@noc.toile-libre.net] has joined #openvpn
21:11 -!- adolfomaltez [~taro@190.62.237.198] has joined #openvpn
21:12 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
21:12 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
21:14 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
21:15 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
21:15 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
21:17 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
21:17 -!- mode/#openvpn [+o dazo_afk] by ChanServ
21:27 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 256 seconds]
21:36 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
21:36 -!- mode/#openvpn [+o dazo_afk] by ChanServ
21:41 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
21:52 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
21:57 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html>
22:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:54 -!- dazo_afk [dazo@nat/redhat/x-aqgdtqmfzvgosjet] has joined #openvpn
22:54 -!- dazo_afk is now known as Guest17504
23:06 -!- dxtr [rz12ug@dxtr.cc] has quit [Changing host]
23:06 -!- dxtr [rz12ug@unaffiliated/dxtr] has joined #openvpn
23:10 -!- Ionic [ionic@ionic.de] has quit [Read error: Operation timed out]
23:10 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Write error: Broken pipe]
23:10 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-gtlymvelnuyrpwom] has quit [Read error: Operation timed out]
23:10 -!- aef [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:10 -!- Guest17504 [dazo@nat/redhat/x-aqgdtqmfzvgosjet] has quit [Ping timeout: 260 seconds]
23:11 -!- brushbox [~brushbox@203.14.171.110] has quit [Ping timeout: 258 seconds]
23:13 -!- Ionic [ionic@ionic.de] has joined #openvpn
23:21 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-bhpkrhxohyfsgvse] has joined #openvpn
23:22 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:25 -!- fread2281 [~fread2281@70-56-134-180.albq.qwest.net] has quit [Ping timeout: 240 seconds]
23:28 -!- fread2281 [~fread2281@70-56-128-7.albq.qwest.net] has joined #openvpn
23:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
23:37 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:49 -!- dazol [dazo@nat/redhat/x-rirrtsrmycgltzqw] has joined #openvpn
23:51 -!- vtcN [~tony@unaffiliated/thethe] has joined #openvpn
23:51 <@vpnHelper> RSS Update - forum: Authenticate/Decrypt pack: Missing Authentication Info <http://forums.openvpn.net/topic9078.html>
23:52 < vtcN> thats my thread in the RSS updater
23:54 < EugeneKay> To answer the question "What have I done wrong?"
23:54 < EugeneKay> !windows
23:54 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
23:58 < vtcN> only for my server
23:58 < vtcN> the rest of my systems are linux
23:58 < vtcN> i needed windows for my sagetv server otherwise i would have gone with ESXi
--- Day changed Mon Oct 24 2011
00:03 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
00:13 -!- vtcN [~tony@unaffiliated/thethe] has quit [Remote host closed the connection]
00:15 -!- vtcN [~tony@unaffiliated/thethe] has joined #openvpn
00:28 <@vpnHelper> RSS Update - forum: Authenticate/Decrypt pack: Missing Authentication Info <http://forums.openvpn.net/topic9078.html#p16856> || No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16855>
00:30 -!- brushbox [~brushbox@203.14.171.110] has quit [Quit: Leaving.]
00:34 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16857>
00:36 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
00:38 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 256 seconds]
00:40 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p16858>
00:40 < EugeneKay> vtcN - that's...... the problem? :-p
00:44 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
00:46 -!- luneff [~yury@84.51.192.74] has joined #openvpn
00:49 < krzie> vtcN, [00:51]  <vpnHelper> RSS Update - forum: Authenticate/Decrypt pack: Missing Authentication Info <http://forums.openvpn.net/topic9078.html>
00:49 <@vpnHelper> Title: OpenVPN Support Forum Authenticate/Decrypt pack: Missing Authentication Info : Server Administration (at forums.openvpn.net)
00:49 < krzie> that is you?
01:00 -!- adolfomaltez1 [~taro@190.62.234.18] has joined #openvpn
01:01 -!- adolfomaltez [~taro@190.62.237.198] has quit [Ping timeout: 240 seconds]
01:18 -!- raidz is now known as raidz_afk
01:37 -!- dazol is now known as dazo
01:37 -!- dazo [dazo@nat/redhat/x-rirrtsrmycgltzqw] has quit [Changing host]
01:37 -!- dazo [dazo@openvpn/community/developer/dazo] has joined #openvpn
01:48 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
01:52 <@vpnHelper> RSS Update - forum: Authenticate/Decrypt pack: Missing Authentication Info <http://forums.openvpn.net/topic9078.html#p16860> || selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p16859>
01:54 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 265 seconds]
01:58 <@vpnHelper> RSS Update - forum: Help with server / client access <http://forums.openvpn.net/topic9069.html#p16862> || TLS key negotiation failed to occur <http://forums.openvpn.net/topic9070.html#p16861>
02:01 -!- adolfomaltez1 [~taro@190.62.234.18] has quit [Ping timeout: 260 seconds]
02:02 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
02:04 <@vpnHelper> RSS Update - forum: Host to network virtual interface problem. <http://forums.openvpn.net/topic8940.html#p16863>
02:10 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p16864>
02:16 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
02:17 -!- adolfomaltez [~taro@190.62.222.136] has joined #openvpn
02:27 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:31 -!- adolfomaltez [~taro@190.62.222.136] has quit [Ping timeout: 245 seconds]
02:32 -!- dxtr [rz12ug@unaffiliated/dxtr] has quit [Quit: leaving]
02:32 -!- adolfomaltez [~taro@190.62.231.35] has joined #openvpn
02:34 -!- dxtr [oaoh48@dxtr.cc] has joined #openvpn
02:34 -!- dxtr [oaoh48@dxtr.cc] has quit [Remote host closed the connection]
02:35 -!- dxtr [rjr3aa@dxtr.cc] has joined #openvpn
02:35 -!- dxtr [rjr3aa@dxtr.cc] has quit [Remote host closed the connection]
02:38 -!- dxtr [iul3hv@dxtr.cc] has joined #openvpn
02:38 -!- dxtr [iul3hv@dxtr.cc] has quit [Changing host]
02:38 -!- dxtr [iul3hv@unaffiliated/dxtr] has joined #openvpn
02:41 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
02:48 -!- corretico_ [~luis@200.12.40.25] has quit [Quit: Leaving]
02:48 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
02:48 -!- Wildy [~lion@212.119.246.18] has quit [Client Quit]
02:49 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
02:59 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
03:02 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
03:12 -!- adolfomaltez [~taro@190.62.231.35] has quit [Ping timeout: 260 seconds]
03:24 -!- sigi [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 258 seconds]
03:24 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 258 seconds]
03:25 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:25 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
03:27 -!- adolfomaltez [~taro@190.62.249.29] has joined #openvpn
03:50 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html>
03:51 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
03:51 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
03:59 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:59 -!- mode/#openvpn [+v s7r] by ChanServ
04:07 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html>
04:18 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16867>
04:21 -!- adolfomaltez [~taro@190.62.249.29] has quit [Ping timeout: 260 seconds]
04:38 -!- __Derek__ [3b5a686d@gateway/web/freenode/ip.59.90.104.109] has joined #openvpn
04:38 < __Derek__> Hi
04:39 < __Derek__> My OpenVPN server is not my gateway, how do I propagate the vpn network route to all the LAN clients?
04:39 < __Derek__> my gateway is also a linux box with shorewall
04:42 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:00 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
05:00 < __Derek__> no one?
05:07 < krzie> !route_outside_openvpn
05:07 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) you do not need this if the vpn node IS the gateway for its lan
05:08 -!- adolfomaltez [~taro@190.62.253.222] has joined #openvpn
05:19 < __Derek__> I do have a route for the VPN network on my gateway
05:19 < __Derek__> the gateway can ping the VPN clients because of the route
05:20 < __Derek__> I want to avoid adding a route to every LAN system
05:21 < __Derek__> I'm not sure why the ICMP reply isn't going back to the VPN server even tho the route is in place
05:25 < __Derek__> !route
05:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
05:30 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
05:31 -!- stsmith3 [~stsmith@ip66-104-100-163.z100-104-66.customer.algx.net] has quit [Read error: Connection reset by peer]
05:41 -!- Denial [Denial@drgi.co.uk] has quit []
05:45 < __Derek__> looks like my route is fine.... shorewall is blocking it
05:58 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:05 -!- luneff [~yury@84.51.192.74] has joined #openvpn
06:11 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 244 seconds]
06:15 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
06:54 -!- imdea [~joel@193.145.14.94] has joined #openvpn
07:02 -!- dazo [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 256 seconds]
07:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
07:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:18 -!- raidz_afk is now known as raidz
07:19 -!- dazo [dazo@openvpn/community/developer/dazo] has joined #openvpn
07:19 -!- mode/#openvpn [+o dazo] by ChanServ
07:22 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
07:23 < imdea> Hi i have a doubt regarding ifconfig parameter when configuring an openvpn server. I've read the man page and it says that the first parameter will be the IP of the local VPN endpoint and the second one, will be the IP address of the remote VPN endpoint. 
07:24 < imdea> In my server, once that I start the openvpn if i do an 'ifconfig'
07:24 -!- afab [~afab@193.145.14.94] has joined #openvpn
07:24 < imdea> i can see in the tun0 interface the inet address set to what i put in the first parameter of ifconfig
07:26 < imdea> and next to it something that says: P-t-P: and the IP address of the "remote VPN endpoint", the thing is that either in the server or in my client when i connect i see this IP address of the remote VPN endpoint
07:26 < imdea> anyone could help me please?
07:27 -!- raidz is now known as raidz_afk
07:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
07:44 -!- imdea [~joel@193.145.14.94] has quit [Quit: Saliendo]
07:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:49 < Wildy> Anyone had success w/OSPF over OpenVPN tun mode?
08:00 <@vpnHelper> RSS Update - forum: Difference "route" & "push route" commands <http://forums.openvpn.net/topic9055.html#p16868>
08:02 -!- afab [~afab@193.145.14.94] has quit [Ping timeout: 244 seconds]
08:04 -!- __Derek__ [3b5a686d@gateway/web/freenode/ip.59.90.104.109] has left #openvpn []
08:06 <@vpnHelper> RSS Update - forum: Can someone tell me the difference between these 3 packages? <http://forums.openvpn.net/topic9075.html#p16871> || No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16870> || Difference between TUN & TAP interfaces <http://forums.openvpn.net/topic9038.html#p16869>
08:12 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16873> || Authenticate/Decrypt pack: Missing Authentication Info <http://forums.openvpn.net/topic9078.html#p16872>
08:23 -!- adolfomaltez [~taro@190.62.253.222] has quit [Remote host closed the connection]
08:24 -!- l0p3n [~defux@201-254.anonymous.at.anonine.com] has joined #openvpn
08:27 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 244 seconds]
08:28 -!- ZeitFight [~defux@201-254.anonymous.at.anonine.com] has joined #openvpn
08:28 < ZeitFight> [#python] tart my Ovpn-connection when I'm connected to public wifispots because I don't really know if I'm allowed too.
08:28 < ZeitFight> sorry wrong post
08:29 < ZeitFight> I have a question though.. I wonder if it's illegal to connect through OVPN while connected to a public WIFI-spot. Is it?
08:30 -!- Axeman [~Axeman3@198.105.46.48] has joined #openvpn
08:30 -!- Axeman [~Axeman3@198.105.46.48] has quit [Changing host]
08:30 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:30 -!- mode/#openvpn [+v Axeman] by ChanServ
08:32 -!- l0p3n [~defux@201-254.anonymous.at.anonine.com] has quit [Ping timeout: 258 seconds]
08:40 -!- ZeitFight [~defux@201-254.anonymous.at.anonine.com] has quit [Quit: leaving]
08:40 <@vpnHelper> RSS Update - forum: i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html>
08:57 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
08:57 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
08:57 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
09:07 -!- master_of_master [~master_of@p57B524D2.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:09 -!- master_of_master [~master_of@p57B52523.dip.t-dialin.net] has joined #openvpn
09:10 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
09:23 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
09:23 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
09:26 <@vpnHelper> RSS Update - forum: Difference "route" & "push route" commands <http://forums.openvpn.net/topic9055.html#p16877> || No data when Clearwire is client's ISP <http://forums.openvpn.net/topic9067.html#p16876> || Can someone tell me the difference between these 3 packages? <http://forums.openvpn.net/topic9075.html#p16875>
09:27 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
09:29 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
09:29 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:47 -!- vtcN [~tony@unaffiliated/thethe] has quit [Read error: Connection reset by peer]
09:50 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
09:51 -!- Wildy [~lion@212.119.246.18] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
09:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:58 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Ping timeout: 240 seconds]
09:59 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Remote host closed the connection]
10:00 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
10:04 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:18 -!- madsage [sage@2001:470:c:1292::2] has quit [Read error: Connection reset by peer]
10:23 -!- dazo [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
10:31 -!- dazo [dazo@openvpn/community/developer/dazo] has joined #openvpn
10:31 -!- mode/#openvpn [+o dazo] by ChanServ
10:38 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html>
10:43 -!- fread2281 [~fread2281@70-56-128-7.albq.qwest.net] has quit [Ping timeout: 276 seconds]
10:43 <@vpnHelper> RSS Update - forum: problem with public ip server-client <http://forums.openvpn.net/topic9083.html>
10:44 -!- fread2281 [~fread2281@70-56-128-31.albq.qwest.net] has joined #openvpn
10:45 -!- fread228_ [~fread2281@70-56-134-56.albq.qwest.net] has joined #openvpn
10:46 -!- fread22__ [~fread2281@70-56-209-101.albq.qwest.net] has joined #openvpn
10:48 -!- fread2281 [~fread2281@70-56-128-31.albq.qwest.net] has quit [Ping timeout: 258 seconds]
10:50 -!- fread228_ [~fread2281@70-56-134-56.albq.qwest.net] has quit [Ping timeout: 252 seconds]
10:58 -!- tom_m [~Tom@c-76-21-112-105.hsd1.ca.comcast.net] has joined #openvpn
10:58 < tom_m> hello
10:59 < tom_m> i have a question/problem i dont know if anyone maybe has some ideas on it or has time to brainstorm for a sec...
11:00 < tom_m> i've setup openvpn on a server and all the clients get a static ip and can sure enough see each other. at that ip. so i basically the goal is to allow remote workers to see each other's local webserver  for developing web sites. BUT... we want multiple webservers... so how do you get to access each client's local network?
11:01 < EugeneKay> !route
11:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
11:01 < tom_m> because say the client's host operating system vpn's in... but then they are running several virtual machines
11:01 < tom_m> because its not just one website, its several. not necessarily virtualhosts but several VMs
11:01 < EugeneKay> You'll need to push a route for each client's LAN(or Host-Only VM network, or whatever), and then an iroute entry in each client's ccd for their specific lan
11:02 < EugeneKay> You say you're using static addressing, so I presume you're alreading doing ccds
11:02 < tom_m> so if i have 10.8.2.1 for me... i'd need to have a 10.8.2.5 or something for another machine on my LAN ?
11:02 < tom_m> yea
11:02 < tom_m> hmm is there any discovery service or anything? so there's less config?
11:02 < EugeneKay> Nope.
11:03 < EugeneKay> If you can convince everybody to use contiguously-numbered LANs, the routing will be easier
11:03 < EugeneKay> Each client would get big fat route to a /20, and then each LAN(and thus, each client's iroute entry) would be a /28 or so.
11:04 < tom_m> well i can i guess because i'm distributing the VMs out. likely will use vagrant. so clients/contractors will download the virtualbox image from the web and just turn it on
11:05 < tom_m> if i can preconfigure it..
11:05 < tom_m> and then also setup DNS ... 
11:05 < tom_m> basically imagine a designer or someone who doesnt know how to setup a webserver. the goal is to say here run this command or download this image. turn it on. go build and test here and see ours there
11:06 < EugeneKay> I would argue that giving them a SFTP account and a MySQL user/pass/db is easier
11:06 < EugeneKay> By like, a lot.
11:07 < tom_m> ha :) yea
11:07 < EugeneKay> Or one of those WAMP one-click apps
11:07 < EugeneKay> Installing VirtualBox and OpenVPn is a bit much
11:07 < tom_m> yea except we have all sorts of server software so mampp/xampp etc is out. 
11:08 < tom_m> yea it was a treat :) but i feel like we're so close now. i have vhosts so i just setup a wildcard A record and then serveralias values on my server and it worked awesome
11:08 < tom_m> but how to automate such a thing
11:08 < tom_m> if it works out, it'll be easier than mampp/xampp for a user
11:10 < tom_m> anyway. thanks for the route idea. i may go down that way and try to figure out an automated way to handle it
11:16 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
11:21 -!- raidz_afk is now known as raidz
11:27 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:32 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
11:47 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
11:49 <@vpnHelper> RSS Update - forum: Difference "route" & "push route" commands <http://forums.openvpn.net/topic9055.html#p16880>
11:58 -!- imdea [~joel@193.145.14.94] has joined #openvpn
12:01 < imdea> anybody here?
12:05 -!- p3rror [~mezgani@41.248.223.220] has joined #openvpn
12:13 -!- dazo is now known as dazo_afk
12:22 -!- imdea [~joel@193.145.14.94] has quit [Quit: Saliendo]
12:31 -!- fread2281 [~fread2281@70-56-208-220.albq.qwest.net] has joined #openvpn
12:32 -!- fread22__ [~fread2281@70-56-209-101.albq.qwest.net] has quit [Ping timeout: 276 seconds]
12:32 -!- fread228_ [~fread2281@70-56-141-186.albq.qwest.net] has joined #openvpn
12:35 -!- fread2281 [~fread2281@70-56-208-220.albq.qwest.net] has quit [Ping timeout: 248 seconds]
13:11 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:12 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:12 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
13:35 < EugeneKay> Nobody but us robots
13:45 < reiffert> u,robot?
13:46 < hyper_ch> everybody robot
13:46 < reiffert> let's fuck for oil then
13:49 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p16881>
14:01 <@vpnHelper> RSS Update - forum: OVPN 2.2.0 + Mikrotiks + Windows Clients <http://forums.openvpn.net/topic9084.html>
14:04 -!- pdtpatrick1 [~pdtpdt@12.249.4.226] has joined #openvpn
14:05 < pdtpatrick1> Question .. Have anyone ran into a problem with Openvpn where it would connect but DNS won't work? It cannot resolve anything. However the same configurations work on Mac and Windows. Just for linux DNS does not get pulled
14:06 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:15 < reiffert> !dns
14:15 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
14:19 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
14:24 -!- Ionic [ionic@ionic.de] has joined #openvpn
14:25 < pdtpatrick1> reiffert, should i then add something like this in my openvpn.conf file ? 
14:25 < pdtpatrick1> push "dhcp-option DNS 129.95.96.50"
14:26 < pdtpatrick1> or would it be ... dhcp-option DNS <ipaddresshere> 
14:29 < reiffert> (#3) you might be looking for !pushdns
14:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
14:33 < reiffert> !pushdns
14:33 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
14:33 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
14:38 < pdtpatrick1> thanks 
14:40 -!- ZeitFight [~defux@202-246.anonymous.at.anonine.com] has joined #openvpn
14:40 -!- ZeitFight [~defux@202-246.anonymous.at.anonine.com] has quit [Client Quit]
14:40 -!- l0p3n [~defux@202-246.anonymous.at.anonine.com] has joined #openvpn
14:44 -!- l0p3n [~defux@202-246.anonymous.at.anonine.com] has quit [Client Quit]
14:47 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
14:48 -!- tom_m [~Tom@c-76-21-112-105.hsd1.ca.comcast.net] has left #openvpn []
14:50 -!- Axeman [~Axeman3@198.105.46.48] has joined #openvpn
14:50 -!- Axeman [~Axeman3@198.105.46.48] has quit [Changing host]
14:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:50 -!- mode/#openvpn [+v Axeman] by ChanServ
15:01 <@vpnHelper> RSS Update - forum: Span / Monitor port when using "client-to-client" mode? <http://forums.openvpn.net/topic9085.html>
15:04 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
15:28 -!- BodeyM [~bmarcocci@riverbank.fpdomain.com] has quit [Ping timeout: 248 seconds]
15:31 <@vpnHelper> RSS Update - forum: problem with public ip server-client <http://forums.openvpn.net/topic9083.html#p16884>
15:36 -!- krzee [krzee@hemp.ircpimps.org] has joined #openvpn
15:36 -!- krzee [krzee@hemp.ircpimps.org] has quit [Changing host]
15:36 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
15:44 -!- BodeyM [~bmarcocci@riverbank.fpdomain.com] has joined #openvpn
15:55 <@vpnHelper> RSS Update - forum: Need help with my script...OpenVPN keeps Restarting <http://forums.openvpn.net/topic9063.html#p16885>
16:01 <@vpnHelper> RSS Update - forum: OVPN 2.2.0 + Mikrotiks + Windows Clients <http://forums.openvpn.net/topic9084.html#p16886>
16:03 -!- IsilZha [~andreas@182.55.249.76] has quit [Ping timeout: 240 seconds]
16:03 -!- IsilZha [~andreas@182.55.249.192] has joined #openvpn
16:12 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
16:15 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
16:15 -!- vtcN [~tony@unaffiliated/thethe] has joined #openvpn
16:20 -!- fread2281 [~fread2281@70-56-133-225.albq.qwest.net] has joined #openvpn
16:21 -!- fread228_ [~fread2281@70-56-141-186.albq.qwest.net] has quit [Ping timeout: 258 seconds]
16:22 -!- pranq [pranq@unaffiliated/contempt] has quit [K-Lined]
16:25 -!- fread2281 [~fread2281@70-56-133-225.albq.qwest.net] has quit [Ping timeout: 244 seconds]
16:26 -!- fread2281 [~fread2281@70-56-208-184.albq.qwest.net] has joined #openvpn
16:30 -!- vtcN [~tony@unaffiliated/thethe] has quit [Remote host closed the connection]
16:32 -!- fread2281 [~fread2281@70-56-208-184.albq.qwest.net] has quit [Ping timeout: 240 seconds]
16:34 -!- fread2281 [~fread2281@70-56-129-103.albq.qwest.net] has joined #openvpn
16:35 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:35 -!- sjuxax [~jeff@unaffiliated/sjuxax] has joined #openvpn
16:35 < sjuxax> Hello. Any suggestions on a good free openvpn client for windows?
16:36 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p16887>
16:37 < krzee> sjuxax, yes, openvpn
16:37 < krzee> !download
16:37 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
16:38 < sjuxax> krzee: Thanks, I'll play with it.
16:38 < krzee> np
16:42 -!- fread228_ [~fread2281@70-56-210-111.albq.qwest.net] has joined #openvpn
16:45 -!- fread2281 [~fread2281@70-56-129-103.albq.qwest.net] has quit [Ping timeout: 260 seconds]
16:47 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
16:51 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:54 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
16:55 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
17:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
17:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
17:14 -!- novaflash is now known as novaflash_away
17:17 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
17:17 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
17:17 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:18 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:32 -!- Denial [Denial@drgi.co.uk] has quit []
17:37 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
17:46 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
17:48 -!- sjuxax [~jeff@unaffiliated/sjuxax] has left #openvpn []
17:50 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: No route to host]
18:02 -!- BodeyM [~bmarcocci@riverbank.fpdomain.com] has quit [Quit: Leaving]
18:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:13 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
18:13 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
18:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:48 -!- fread2281 [~fread2281@70-56-135-120.albq.qwest.net] has joined #openvpn
18:50 -!- fread228_ [~fread2281@70-56-210-111.albq.qwest.net] has quit [Ping timeout: 248 seconds]
18:53 -!- fread2281 [~fread2281@70-56-135-120.albq.qwest.net] has quit [Ping timeout: 256 seconds]
18:55 -!- fread228_ [~fread2281@70-56-141-106.albq.qwest.net] has joined #openvpn
19:00 <@vpnHelper> RSS Update - forum: Span / Monitor port when using "client-to-client" mode? <http://forums.openvpn.net/topic9085.html#p16888>
19:01 -!- p3rror [~mezgani@41.248.223.220] has quit [Ping timeout: 240 seconds]
19:06 <@vpnHelper> RSS Update - forum: Can someone tell me the difference between these 3 packages? <http://forums.openvpn.net/topic9075.html#p16889>
19:11 -!- JoeGazz84 is now known as JG84|Blog
19:34 -!- _julian_ [~quassel@hmbg-5f762dd5.pool.mediaWays.net] has joined #openvpn
19:35 -!- _julian [~quassel@hmbg-4d06a043.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
19:42 -!- JG84|Blog is now known as JoeGazz84
19:54 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:26 -!- Axeman [~Axeman3@198.105.46.48] has joined #openvpn
20:26 -!- Axeman [~Axeman3@198.105.46.48] has quit [Changing host]
20:26 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:26 -!- mode/#openvpn [+v Axeman] by ChanServ
20:37 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:40 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
20:41 -!- vtcN [~tony@unaffiliated/thethe] has joined #openvpn
20:42 -!- fread228_ [~fread2281@70-56-141-106.albq.qwest.net] has quit [Ping timeout: 260 seconds]
20:43 -!- fread2281 [~fread2281@70-56-133-215.albq.qwest.net] has joined #openvpn
20:47 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
20:53 -!- fread2281 [~fread2281@70-56-133-215.albq.qwest.net] has quit [Remote host closed the connection]
21:15 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
21:22 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
21:22 -!- mode/#openvpn [+o dazo_afk] by ChanServ
21:24 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
21:35 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
21:37 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
21:52 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 256 seconds]
22:01 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16890>
22:01 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:03 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has joined #openvpn
22:05 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has left #openvpn []
22:22 -!- chokesmaster [~chokesmas@65.92.83.242] has joined #openvpn
22:31 -!- adolfomaltez [~taro@190.62.247.90] has joined #openvpn
22:47 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:13 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has joined #openvpn
23:15 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has left #openvpn []
23:35 -!- Mowi [~Mowi@lendabrain.net] has quit [Ping timeout: 260 seconds]
23:37 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
23:52 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
--- Day changed Tue Oct 25 2011
00:00 -!- Guest26382 [dazo@nat/redhat/x-ckjlsrdjpudtmucj] has joined #openvpn
00:00 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
00:19 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16891>
00:25 < vtcN> quick question regarding the HOWTO on your website
00:25 <@vpnHelper> RSS Update - forum: Difference "route" & "push route" commands <http://forums.openvpn.net/topic9055.html#p16892>
00:25 < vtcN> "build-key-server server"
00:25 < vtcN> do i literally enter "server"
00:25 < vtcN> without quotes, or do i use my Common Name?
00:37 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html#p16893>
00:51 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
01:19 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16895> || OVPN 2.2.0 + Mikrotiks + Windows Clients <http://forums.openvpn.net/topic9084.html#p16894>
01:22 -!- Titania [~titania@208.79.15.250] has joined #openvpn
01:26 <@vpnHelper> RSS Update - forum: i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p16896>
01:38 <@vpnHelper> RSS Update - forum: i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p16897>
01:45 -!- Titania [~titania@208.79.15.250] has quit [Quit: Will return someday...]
01:45 -!- novaflash_away is now known as novaflash
01:46 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
01:46 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
01:46 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
01:53 -!- Guest26382 [dazo@nat/redhat/x-ckjlsrdjpudtmucj] has quit [Ping timeout: 276 seconds]
02:01 -!- novaflash is now known as novaflash_away
02:01 <@vpnHelper> RSS Update - forum: Authenticate/Decrypt pack: Missing Authentication Info <http://forums.openvpn.net/topic9078.html#p16898>
02:08 <@vpnHelper> RSS Update - forum: OPENVPN AND MTU <http://forums.openvpn.net/topic9086.html>
02:10 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
02:16 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
02:16 -!- mode/#openvpn [+o dazo_afk] by ChanServ
02:23 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:24 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
02:28 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
02:31 -!- dazo [dazo@openvpn/community/developer/dazo] has joined #openvpn
02:31 -!- mode/#openvpn [+o dazo] by ChanServ
02:38 <@vpnHelper> RSS Update - forum: Authenticate/Decrypt pack: Missing Authentication Info <http://forums.openvpn.net/topic9078.html#p16901> || i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p16900>
02:39 -!- dazo [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
02:47 -!- dazo [dazo@openvpn/community/developer/dazo] has joined #openvpn
02:47 -!- mode/#openvpn [+o dazo] by ChanServ
02:50 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16902>
03:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
03:08 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16903>
03:08 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Operation timed out]
03:09 < EugeneKay> vtcN - "server" is the CN
03:10 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
03:14 <@vpnHelper> RSS Update - forum: Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013-15.html#p16904>
03:19 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
03:20 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:33 -!- adolfomaltez [~taro@190.62.247.90] has quit [Ping timeout: 252 seconds]
03:34 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
03:42 < krzie> !script
03:42 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
03:47 < krzie> !route
03:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
03:49 -!- adolfomaltez [~taro@190.62.227.171] has joined #openvpn
03:50 <@vpnHelper> RSS Update - forum: Difference "route" & "push route" commands <http://forums.openvpn.net/topic9055.html#p16905>
03:55 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 258 seconds]
03:59 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:59 -!- mode/#openvpn [+v s7r] by ChanServ
04:00 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
04:06 <@vpnHelper> RSS Update - forum: Own client <http://forums.openvpn.net/topic9087.html>
04:09 -!- vasily [~vasily@net-38.nrpn.net] has joined #openvpn
04:18 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
04:18 -!- bram_ [~bram@217.119.232.20] has left #openvpn []
04:19 < LowKey> hello, i have 1 situation, i have setup openvpn, and i have 2 clients connected on it, the problem is, both can ping each other, but when client 1 want to send a message via net send command it failed to reach client 2, any solutions for this?
04:19 < krzie> yes, a wins server
04:19 < krzie> !wins
04:19 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
04:21 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:21 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:22 < LowKey> wins server?
04:23 < krzie> your problem is that net send uses netbios resolution, wins is a method of doing that over IP
04:23 < krzie> google it if ya like
04:23 < CybDev> nono, dont research it, just complain that it doesnt work! ;-)
04:26 < LowKey> yes i know it used over IP , like client one 10.8.0.5 client two 10.8.0.6 , it was unsuccessful to communicate with net send. i want to capture the packet using wireshark, need to make some research about openvpn is do encrption connection
04:27 < CybDev> wrong
04:27 < LowKey> wrong?
04:27 < LowKey> why
04:27 < CybDev> google it like krzie said
04:27 < LowKey> how can i prove openvpn used encrption connection.. without net send?
04:28 < CybDev> ping? 
04:29 < LowKey> ping just give connection over clients.. i can't capture any TCP connection, i like to send a message, and make is prove that message is encryted
04:29 < CybDev> then set up a tcp service, like a webserver, or a supersmall script to serve a socket connection
04:30 < CybDev> netcat perhaps?
04:30 < LowKey> i'm prefer to use net send. more simple..
04:31 < CybDev> if you say so
04:38 < krzie> you need wins for that!
04:38 < krzie> tun is layer3
04:38 < CybDev> you need a lot of crap for that
04:38 < CybDev> but like he said, "keep it simple"
04:38 < krzie> then run a different wins server, windows has them
04:39 < CybDev> also i thought netsend was disabled in windows vista and newer?
04:39 < CybDev> so even if he manages to resolve a name, it still wont work as expected :P
04:40 < CybDev> wouldnt be surprised if those netsend messages also are packed in some simple form
04:40 <@vpnHelper> RSS Update - forum: Custom Client <http://forums.openvpn.net/topic9088.html> || Custom Client <http://forums.openvpn.net/topic9087.html>
04:40 < CybDev> so it would "look" like encryption :P
04:40 -!- suso [~suso@91.227.224.1] has joined #openvpn
04:42 < suso> Hi i have a problem with openvpn on delian linux 
04:43 < EugeneKay> And I have a problem with dead hookers.
04:45 < suso> !config
04:45 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
04:45 -!- suso [~suso@91.227.224.1] has left #openvpn []
04:45 <@vpnHelper> RSS Update - forum: Custom Client <http://forums.openvpn.net/topic9090.html> || Custom Client <http://forums.openvpn.net/topic9089.html>
04:47 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
04:51 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
04:56 -!- vasily [~vasily@net-38.nrpn.net] has quit [Ping timeout: 258 seconds]
05:15 < krzie> lol
05:15 < krzie> hi i have a problem with how to ask questions
05:15 < CybDev> there is something wrong with something or something, help!
05:15 < CybDev> ^^
05:15 < krzie> ;]
05:18 < krzie> LowKey, after scrolling up, netcat would be more suited twords what you want, like CybDev said
05:18 < CybDev> shh
05:18 < CybDev> its needs to be encrypted!
05:18 < krzie> you say netsend because you want cleartext traffic to sniff
05:18 < CybDev> not like you can pack some text as data in a ping packet either
05:18 < CybDev> :P
05:19 < krzie> to prove openvpn is encrypting traffic
05:19 < krzie> netcat does just that, but over tcp instead of netbios
05:19 < krzie> (or udp of course)
05:22 < CybDev> yeah its a super simple socket app, no complex protocols or resolving or packing etc
05:22 < CybDev> but hey, netsend is simpler innit ^^
05:22 < CybDev> just requires a "custom" resolver, 2 tcp connections and a udp port for data transfer :P
05:23 < krzie> ;]
05:24 < krzie> custom resolver or layer2 bridge using tap, but thats a bad reason to be using tap/bridge
05:28 < CybDev> both!
05:28 < CybDev> also enables you to run netbios over ipx/spx and all the fun and joy that brings :P
05:35 -!- dazo is now known as dazo_afk
05:41 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16910>
05:43 -!- dazo_afk is now known as dazo
05:58 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
05:58 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16911>
06:00 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 260 seconds]
06:01 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
06:04 -!- vasily [~vasily@net-38.nrpn.net] has joined #openvpn
06:10 -!- novaflash_away is now known as novaflash
06:27 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
06:27 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
06:27 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:27 -!- mode/#openvpn [+v Axeman] by ChanServ
06:30 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Client Quit]
06:34 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 258 seconds]
06:40 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
06:42 < EugeneKay> net send. custom socket apps. ipx/spx
06:42  * EugeneKay retreats to under his rock
06:48 < LowKey> hurm
06:48 < LowKey> why someone can make it success via netsend
06:48 < LowKey> weird
06:48 < LowKey> :|
06:56 -!- corretico_ [~luis@200.12.40.25] has quit [Remote host closed the connection]
07:05 <@vpnHelper> RSS Update - forum: Custom Client <http://forums.openvpn.net/topic9087.html#p16912> || How do I configure OpenVPN as a Gateway client for Witopia? <http://forums.openvpn.net/topic7684.html#p16707>
07:11 <@vpnHelper> RSS Update - forum: how to set expiration per user? <http://forums.openvpn.net/topic9037.html#p16704> || Want to establish VPN in a Organization Pease Help <http://forums.openvpn.net/topic9045.html>
07:17 <@vpnHelper> RSS Update - forum: control up script <http://forums.openvpn.net/topic9091.html>
07:20 -!- adolfomaltez [~taro@190.62.227.171] has quit [Ping timeout: 240 seconds]
07:21 -!- tesco [4addd142@gateway/web/freenode/ip.74.221.209.66] has joined #openvpn
07:22 -!- tesco [4addd142@gateway/web/freenode/ip.74.221.209.66] has quit [Client Quit]
07:24 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
07:32 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:35 <@vpnHelper> RSS Update - forum: Unlimited Bandwith - Virtual private networks (VPNs) - 24/7 <http://forums.openvpn.net/topic9092.html>
07:35 -!- adolfomaltez [~taro@190.62.219.148] has joined #openvpn
07:41 <@vpnHelper> RSS Update - forum: Unlimited Bandwith - Fully anonymous private proxies - 24/7 <http://forums.openvpn.net/topic9093.html>
07:44 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
07:47 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16916>
07:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
07:57 -!- LowKey [rhel@unaffiliated/lowkey] has quit [Quit: changing servers]
07:58 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
07:58 <@vpnHelper> RSS Update - forum: cryptoapicert and ca <http://forums.openvpn.net/topic7352.html#p16917>
07:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:04 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
08:04 <@vpnHelper> RSS Update - forum: Custom Client <http://forums.openvpn.net/topic9087.html#p16918>
08:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
08:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:11 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html> || How to configure OpenVPN as described? <http://forums.openvpn.net/topic9056.html#p16919>
08:15 -!- adolfomaltez [~taro@190.62.219.148] has quit [Remote host closed the connection]
08:29 <@vpnHelper> RSS Update - forum: Authenticate/Decrypt pack: Missing Authentication Info <http://forums.openvpn.net/topic9078.html#p16921>
08:35 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16922>
08:38 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
08:41 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16923>
08:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:47 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p16924>
08:51 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:53 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html#p16925>
09:07 -!- master_of_master [~master_of@p57B52523.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:09 -!- master_of_master [~master_of@p57B53E73.dip.t-dialin.net] has joined #openvpn
09:11 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html#p16927> || ping-restart <http://forums.openvpn.net/topic9079.html#p16926>
09:38 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
09:40 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Client Quit]
09:41 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16928>
09:44 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Ping timeout: 252 seconds]
09:59 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:09 -!- vasily [~vasily@net-38.nrpn.net] has quit [Quit: so long]
10:09 -!- popov [~vasily@net-38.nrpn.net] has joined #openvpn
10:10 -!- popov [~vasily@net-38.nrpn.net] has quit [Remote host closed the connection]
10:11 -!- vasilyS [~vasily@net-38.nrpn.net] has joined #openvpn
10:24 <@vpnHelper> RSS Update - forum: OVPN 2.2.0 + Mikrotiks + Windows Clients <http://forums.openvpn.net/topic9084.html#p16930> || I have problem. <http://forums.openvpn.net/topic9082.html#p16929>
10:27 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
10:30 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html#p16931>
10:36 <@vpnHelper> RSS Update - forum: Setting up vpn server on my vps windows server <http://forums.openvpn.net/topic9095.html>
10:42 <@vpnHelper> RSS Update - forum: OpenVPN on OpenVZ VPS <http://forums.openvpn.net/topic9024.html#p16933>
10:59 -!- luneff [~yury@84.51.192.74] has joined #openvpn
11:02 -!- happy [~vasily@net-38.nrpn.net] has joined #openvpn
11:03 -!- happy [~vasily@net-38.nrpn.net] has quit [Read error: Connection reset by peer]
11:03 -!- vasilyS [~vasily@net-38.nrpn.net] has quit [Quit: so long]
11:03 -!- happylife [~happylife@net-38.nrpn.net] has joined #openvpn
11:06 <@vpnHelper> RSS Update - forum: TLS Record Layer <http://forums.openvpn.net/topic9096.html>
11:07 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:53 -!- dazo is now known as dazo_afk
12:03 -!- happylife [~happylife@net-38.nrpn.net] has quit [Read error: Operation timed out]
12:04 -!- ravel [ravel@175.136.82.14] has joined #openvpn
12:06 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
12:08 -!- ravel_out [~ravel_out@175.136.82.14] has joined #openvpn
12:48 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
12:51 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:53 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:55 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
13:05 -!- fulgore [~fulgore@glomsecurity.com] has quit [Quit: leaving]
13:06 <@vpnHelper> RSS Update - forum: Unable to right-click OpenVPN Gui after successful connect <http://forums.openvpn.net/topic8314-15.html#p16935>
13:10 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:10 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:10 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:10 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:12 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:12 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:14 -!- happylife [~happylife@cs181134059.pp.htv.fi] has joined #openvpn
13:20 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:40 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
13:47 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
13:51 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Client Quit]
14:07 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Quit: Leaving]
14:28 -!- nb [~nb@fedora/znc.nb] has quit [Quit: ZNC - http://znc.in]
14:33 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 255 seconds]
14:35 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
14:37 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16936>
14:38 -!- gladiatr [~sdspence@24.124.30.1] has joined #openvpn
14:38 -!- gladiatr [~sdspence@24.124.30.1] has quit [Changing host]
14:38 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
14:42 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 244 seconds]
14:42 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:47 -!- ciupicri|away [~ciupicri@unaffiliated/ciupicri] has joined #openvpn
14:47 -!- ciupicri|away is now known as ciupicri
14:47 < ciupicri> what does "WARNING: 'ifconfig' is used inconsistently, local='ifconfig 10.1.0.1 10.1.0.2', remote='ifconfig 10.2.0.1 10.2.0.2'" mean?
14:48 < krzee> it means your configs dont match
14:48 < |Mike|> what do ya think sir?
14:49 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
14:49 < |Mike|> morning krzee 
14:50 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
14:51 < krzee> moinmoin
14:51 < ciupicri> krzee, that's what I thought as well, except I don't think I've reversed the address
14:53 < krzee> they are different subnets
14:53 < krzee> 10.1 != 10.2
14:54 < ciupicri> krzee, right
14:55 < ciupicri> thanks for highlighting that to me
14:55 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
14:58 < krzee> np
14:58 -!- ciupicri is now known as ciupicri|away
15:00 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
15:04 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
15:10 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:50 -!- Denial- [Denial@drgi.co.uk] has joined #openvpn
15:50 -!- ciupicri|away is now known as ciupicri
15:52 -!- Denial- [Denial@drgi.co.uk] has quit [Client Quit]
15:53 -!- Denial [Denial@drgi.co.uk] has quit [Ping timeout: 258 seconds]
15:54 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:57 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
15:59 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 244 seconds]
15:59 < ciupicri> can I use the same port on the server for multiple simultaneous clients?
16:00 < krzee> yes if you use server mode
16:00 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
16:01 < ciupicri> krzee, thanks
16:05 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
16:12 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 244 seconds]
16:14 < __nolife> If you don't use servermode you'll get encryption errors
16:15 < __nolife> I've not found a way to restrict the port to a single peer/client
16:16 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
16:16 < ciupicri> __nolife, I see. In the end I think that I'll use temporary other ports, since it's easier and I've also found out how to deal with the selinux errors: semanage port -a -t openvpn_port_t -p udp NNN 
16:19 -!- ravel_out [~ravel_out@175.136.82.14] has quit []
16:19 -!- ravel [ravel@175.136.82.14] has quit []
16:19 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
16:21 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
16:22 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Client Quit]
16:31 <@vpnHelper> RSS Update - forum: Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16937>
16:43 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
16:50 -!- BlakHawk [blackhawk@exploits.dotslash.ca] has joined #openvpn
16:52 < BlakHawk> hey guys i have a quick question i was hoping someone in here could help me out with...
16:53 < BlakHawk> if i have my openvpn setup and i route all eth0 traffic through the tun0 interface what ip address will show up when connections are made?
16:53 < BlakHawk> would it still be my public ip address provided by my isp?
17:02 < krzee> no, it would be your server's ip
17:02 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
17:02 < krzee> !redirect
17:02 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:05 < reiffert> krzee: depends on routing vs nat.
17:07 < krzee> how so?  if its just routing that means the server gave out a routable ip, and that will be the source address
17:08 < krzee> if it was given a 1918 ip, then nat is needed to reach the server
17:08 < krzee> ok, i guess i am assuming the target is not on the servers lan, but he did say *all* eth0 traffic
17:10 -!- ciupicri [~ciupicri@unaffiliated/ciupicri] has left #openvpn ["Leaving"]
17:11 < BlakHawk> krzee thanks for the reply
17:11 < reiffert> krzee: why not route official ips over ovpn?
17:11 < krzee> reiffert, you can, but then *that* ip will show up
17:11 < reiffert> krzee: that is have tun0 a routeable ip?
17:11 < krzee> which is from the vpn server, not the client's ip
17:11 < krzee> which doesnt change my answer being right
17:11 < reiffert> krzee: oh that's exactly what I said before: it depends on routing vs nat.
17:12 < krzee> but it doesnt
17:12 < krzee> my answer was right on both
17:12 < krzee> either because you were given a routable ip, or because you NAT to an ip
17:13 < krzee> either way, if your traffic flows through the vpn server before going out, it is an ip from the server
17:13 < krzee> either the ip given to tun dev from server, or ip natted to at the server
17:13 < reiffert> erm.
17:13 < krzee> both correspond to my answer ;]
17:14 < reiffert> so your weberserver always thinks that his gateway is accessing it?
17:14 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
17:14 < BlakHawk> krzee even if tun0 is assigned a private ip address if all eth0 traffic is going through tun0 then the ip address that shows up will be the one assigned to tun0 ?
17:14 < krzee> reiffert, how is that related to the question which was very specific to routing all traffic over a vpn server?
17:15 < krzee> BlakHawk, yes, but if that is a rfc 1918 ip you must NAT the traffic for it to actually work
17:15 < reiffert> in case of routing, then server will see the official ip from the left most:    official ip[tun0<----->tun0]server ip[whatever<---->whatever]server   
17:15 < krzee> if it is a inet routable ip, then yes without nat needed
17:15 < krzee> no, the os will send out tun0 with the tun0 ip
17:16 < reiffert> you said, that someone will see the openvpn server's ip address, even when routing an official ip over the vpn.
17:16 < krzee> the tun0 ip came from the server!
17:16 < krzee> aka, NOT the ip given to the client by its ISP
17:16 < BlakHawk> so if i made a connection to another system going through tun0 the system would see this ip address 10.0.0.1 as long as i have my iptables with nat rules setup correctly..?
17:16 < reiffert> who cares what ip address eth0 carries?
17:17 < krzee> reiffert, him, he wanted to know if his tun ip or eth ip would show up
17:17 < BlakHawk> yup
17:17 < krzee> that *was* his question, and was the question i answered
17:17 < krzee> and my answer was correct
17:17 < reiffert> krzee: you'll never know if he's got additional official ip addresses that he will use for leftmost:tun0
17:18 < BlakHawk> well right now i have a private ip address assigned to my tun0 interface
17:18 < BlakHawk> i have iptables routing all traffic eth0 -> tun0
17:18 < BlakHawk> tun0 -> 10.0.0.1
17:19 < krzee> !redirect
17:19 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:19 < krzee> thats how you do it, it will work how you wanted
17:19 < krzee> i have work to do
17:19 < BlakHawk> thanks krzee
17:19 < krzee> np
17:19 < BlakHawk> !nat
17:19 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:20 < BlakHawk> ahh okay i get what he was saying about nat...
17:21 < BlakHawk> something like this..
17:21 < BlakHawk> iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o tun0 -j MASQUERADE
17:21 < krzee> !linnat
17:21 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
17:21 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Ping timeout: 244 seconds]
17:21 < krzee> its on the server, so -o eth0
17:22 < BlakHawk> great thanks..
17:22 < reiffert> welcome
17:22 < krzee> np
17:23 <@vpnHelper> RSS Update - forum: VPN'ed Server that Still Services Clients on Remote LAN <http://forums.openvpn.net/topic9097.html>
17:27 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
17:27 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
17:27 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
17:31 -!- novaflash is now known as bla_
17:32 -!- bla_ is now known as novaflash
17:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
17:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:03 -!- Denial [Denial@drgi.co.uk] has quit []
18:04 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
18:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:24 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has joined #openvpn
18:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:25 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has quit [Excess Flood]
18:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
18:39 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
18:39 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
18:40 -!- novaflash is now known as novaflash_away
18:40 -!- raidz is now known as raidz_afk
18:41 -!- raidz_afk is now known as raidz
18:43 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
19:06 -!- raidz is now known as raidz_afk
19:07 < rooth> If I want to deploy a scenario with ~5,000 concurrent connected devices all logging into one central location, what type of hardware would you recommend that can cope with that? The traffic-load on the tunnels would be very low, maybe just 10-20 kbit/s.
19:07 < rooth> .
19:07 < krzee> you wont want a single machine for that
19:08 < rooth> Cluster?
19:08 < krzee> openvpn is single threaded, you will need to run 1 instance per core to get max usage
19:08 < krzee> after a certain number of clients (cant tell you how many, sorry i have no clue) it will shit itself
19:08 < rooth> If so, what type of solution would you recommend.
19:08 < rooth> ok
19:09 < krzee> many instances of openvpn with their own subnets
19:09 < krzee> routing correctly implemented so they can still communicate 
19:09 < krzee> --remote-random
19:09 < krzee> and a ton of --remote entries
19:10 < krzee> or see if RR dns will do the job
19:10 < rooth> krzee: ok, will read up on it.
19:11 < krzee> if you ever see openvpn3 released (in years ild guess) then it will probably handle that question better
19:11 < krzee> but it'll require a full rewrite so dont hold your breath ;]
19:12 < rooth> krzee: =)
19:12 < krzee> https://community.openvpn.net/openvpn/wiki/RoadMap
19:12 <@vpnHelper> Title: RoadMap – OpenVPN Community (at community.openvpn.net)
19:13 < rooth> krzee: Just comparing with an ipsec-solution and the Cisco ASA5540, that they claim to handle 5,000 concurrent tunnels.
19:15 < rooth> krzee: Looking at an Astaro solution, they recommending clustering. However, for SSL VPN they can "only" cope with 250 tunnels whereas the max IPsec tunnels is specified to 1500 (per unit).
19:15 < EugeneKay> SSL has a bit more overhead than IPsec
19:15 < rooth> krzee: Not starting an argument here but is it due to hw-accelerators or the design of the vpn technology.
19:15 < rooth> EugeneKay: OK!
19:15 < EugeneKay> It ends up being done in userspace rather than as a kernel module
19:16 < EugeneKay> But because it's all SSL, you get all the flexibility and power of SSL PKI infrastrcuture, and userspace scripting means nice, easy configuration & customization is possible
19:17 < EugeneKay> I've not built a box for it myself, but my recommendation for a large OpenVPN innstallation would be a set of round-robin load-balanced 4-core boxes.
19:17 < rooth> EugeneKay: Of course, not arguing that =) But for larger installations it can be beneficial to use ipsec from a performance perspective?
19:17 < EugeneKay> Very much so, yes.
19:17 < rooth> EugeneKay: Thank you for your valuable feedback. 
19:17 < EugeneKay> !gbit
19:17 < rooth> krzee: Thank you, to you as well. Very grateful.
19:17 < EugeneKay> !factoids search gig
19:17 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
19:18 < EugeneKay> A good read, though it's more of "one big connection" than "bunch of lil ones"
19:18 < rooth> EugeneKay: Gotcha! At least I will know a bit more what I'm talking about towards the customer =)
19:19 < EugeneKay> And as krzee said, you'll also want to run multiple openvpn server instances per host. Single-threaded leads to race conditions.
19:20 < EugeneKay> Just a number I'm pulling out of my arse, but no more than 50 clients per openvpn process
19:20 < EugeneKay> Benchmark your use case ;-)
19:20 < rooth> =)
19:20 < krzee> rooth, everything you brought up is valid
19:20 < krzee> certainly not taking it as an argument
19:20 < rooth> I'll quote you on that on EugeneKay =)
19:21  * EugeneKay hides under a rock
19:21 < rooth> krzee: OK
19:21 < krzee> and it is actually possible that those could work better in this situation
19:21 < krzee> and ild say more like 200-250 per process
19:21 < krzee> (per core really)
19:21 < krzee> well
19:21 < krzee> each process lives on its own core
19:21 < krzee> dont forget to leave at least 1 for openssl
19:21 < krzee> also, talk to the guys in openvpn-as
19:21 < rooth> Very valuable information!
19:21 < EugeneKay> I say quad-core machines because single-processor boxes are cheaper-per-metric than dual-proc boards
19:22 < krzee> i have no clue, maybe they have done something for this
19:22 < EugeneKay> Yeah, AS guys run the thing commercially. 
19:22 < EugeneKay> I'm sure somebody would be glad to sell you an hour or two of professional consulting on it ;-)
19:22 < krzee> yes i agree, quad core = better bang for buck because less metal, possibly even multi-cpu quads
19:23 < krzee> i meant #openvpn-as
19:23 < krzee> !as
19:23 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
19:23 -!- newl [~newl@97.75.165.156] has joined #openvpn
19:23 < EugeneKay> I think 6-core intels are on parity-per-Ghz with 4-core ones
19:23 < EugeneKay> For the dual-socket models I looked at they are, anyway
19:23 < EugeneKay> E5620 vs E5645
19:24 < EugeneKay> $400 vs $600
19:28 < rooth> EugeneKay, krzee again, thank you for everything!
19:29 < krzee> np man
19:29 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 256 seconds]
19:30 < krzee> definitely check #openvpn-as tho, that is openvpn technologies corporate product
19:30 < krzee> if theres something brewing along the lines of your needs, theyd know something
19:32 < rooth> krzee: Yep, will do after reading up a little on things =)
19:32 -!- _julian [~quassel@hmbg-5f76009c.pool.mediaWays.net] has joined #openvpn
19:33 -!- _julian_ [~quassel@hmbg-5f762dd5.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
19:35 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
19:35 -!- corretico [~luis@201.201.44.82] has joined #openvpn
19:36 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
19:47 -!- raidz_afk is now known as raidz
19:50 -!- adolfomaltez [~taro@190.62.237.36] has joined #openvpn
19:55 -!- adolfomaltez1 [~taro@190.62.236.159] has joined #openvpn
19:57 -!- adolfomaltez [~taro@190.62.237.36] has quit [Ping timeout: 258 seconds]
20:16 <@vpnHelper> RSS Update - forum: Open VPN works everywhere but my home network - HELP! <http://forums.openvpn.net/topic9098.html>
20:26 -!- raidz is now known as raidz_afk
20:27 -!- raidz_afk is now known as raidz
20:33 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
21:10 -!- EugeneKay is now known as EugeneKaway
21:14 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:14 < krzie> !ping
21:14 <@vpnHelper> pong
21:21 -!- fread2281 [~fread2281@70-56-141-172.albq.qwest.net] has joined #openvpn
21:23 -!- adolfomaltez1 [~taro@190.62.236.159] has quit [Quit: Leaving.]
21:23 -!- adolfomaltez [~taro@190.62.236.159] has joined #openvpn
21:29 -!- fread2281 is now known as fread2281[afk]
21:37 -!- fread2281[afk] is now known as fread2281
21:39 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:40 < fread2281> lol
21:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
21:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
22:01 -!- fread2281 [~fread2281@70-56-141-172.albq.qwest.net] has quit [Quit: Linkinus - http://linkinus.com]
22:01 -!- fread2281 [~fread2281@70-56-141-172.albq.qwest.net] has joined #openvpn
22:10 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
22:10 -!- Xeross [~Xeross@2605:8900:1000:1001:2:0:f:2] has joined #openvpn
22:10 -!- Xeross [~Xeross@2605:8900:1000:1001:2:0:f:2] has quit [Changing host]
22:10 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
22:40 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:54 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has joined #openvpn
22:54 -!- nixusr [~nixusr@cpc2-hers4-2-0-cust777.6-3.cable.virginmedia.com] has quit [Changing host]
22:54 -!- nixusr [~nixusr@unaffiliated/nixusr] has joined #openvpn
23:12 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
23:17 <@vpnHelper> RSS Update - forum: VPN'ed Server that Still Services Clients on Remote LAN <http://forums.openvpn.net/topic9097.html#p16940>
23:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 248 seconds]
23:26 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
23:28 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:31 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
23:50 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:50 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
23:56 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
23:59 <@vpnHelper> RSS Update - forum: Dear Expert(I am requesting setup of openvpn + freeradius) <http://forums.openvpn.net/topic9099.html>
--- Day changed Wed Oct 26 2011
00:05 <@vpnHelper> RSS Update - forum: Open VPN works everywhere but my home network - HELP! <http://forums.openvpn.net/topic9098.html#p16943> || Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16942>
00:08 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
00:17 <@vpnHelper> RSS Update - forum: OVPN 2.2.0 + Mikrotiks + Windows Clients <http://forums.openvpn.net/topic9084.html#p16945> || Dear Expert(I am requesting setup of openvpn + freeradius) <http://forums.openvpn.net/topic9099.html#p16944>
00:23 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html#p16946>
00:25 -!- dazo_afk is now known as dazo
00:31 -!- jaminja [~jaminja@85.17.232.145] has joined #openvpn
00:31 -!- jaminja [~jaminja@85.17.232.145] has quit [Changing host]
00:31 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
00:46 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 244 seconds]
00:46 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
00:52 -!- vtcN [~tony@unaffiliated/thethe] has quit [Remote host closed the connection]
01:15 -!- novaflash_away is now known as novaflash
01:23 <@vpnHelper> RSS Update - forum: Dear Expert(I am requesting setup of openvpn + freeradius) <http://forums.openvpn.net/topic9099.html#p16947>
01:47 <@vpnHelper> RSS Update - forum: Dear Expert(Need assistance with Openvpn consulting !) <http://forums.openvpn.net/topic9099.html#p16947>
01:48 -!- happylife [~happylife@cs181134059.pp.htv.fi] has quit [Ping timeout: 258 seconds]
02:01 -!- ph1l [~ph1l@147.88.210.50] has joined #openvpn
02:02 -!- ph1l [~ph1l@147.88.210.50] has left #openvpn []
02:08 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:12 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
02:15 < Mowee> Morning
02:21 <@vpnHelper> RSS Update - forum: adaptive compression including time to (de)compress data <http://forums.openvpn.net/topic8883.html#p16948>
02:21 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:21 -!- mode/#openvpn [+o mattock] by ChanServ
02:26 <@vpnHelper> RSS Update - forum: Certificate request generator <http://forums.openvpn.net/topic9100.html>
02:26 -!- happylife [~happylife@213.28.38.191] has joined #openvpn
02:32 -!- dazo is now known as dazo_afk
02:45 -!- raidz is now known as raidz_afk
02:56 -!- raidz_afk [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 258 seconds]
02:56 -!- happylife [~happylife@213.28.38.191] has quit [Quit: so long]
02:57 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has joined #openvpn
02:57 -!- vasily [~vasily@213.28.38.191] has joined #openvpn
02:59 -!- vasily [~vasily@213.28.38.191] has quit [Client Quit]
02:59 -!- LowKey [rhel@unaffiliated/lowkey] has quit [Ping timeout: 244 seconds]
03:00 -!- vasily [~vasily@213.28.38.191] has joined #openvpn
03:01 -!- vasily [~vasily@213.28.38.191] has quit [Remote host closed the connection]
03:01 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079.html#p16950>
03:02 -!- vpopov [~vasily@213.28.38.191] has joined #openvpn
03:04 -!- vpopov [~vasily@213.28.38.191] has quit [Client Quit]
03:05 -!- vpopov [~happylife@213.28.38.191] has joined #openvpn
03:06 -!- vpopov [~happylife@213.28.38.191] has quit [Read error: Connection reset by peer]
03:07 -!- happylife [~happylife@213.28.38.191] has joined #openvpn
03:08 -!- happylife is now known as vasily
03:09 -!- vasily is now known as vpopov
03:11 -!- vpopov is now known as vasiliy
03:11 -!- vasiliy is now known as popov
03:12 -!- popov is now known as petrov
03:12 -!- petrov is now known as sidorov
03:13 -!- sidorov is now known as tobe
03:13 -!- tobe is now known as vasily
03:13 -!- vasily is now known as vasiliy
03:13 -!- vasiliy is now known as popov
03:14 -!- popov [~happylife@213.28.38.191] has quit [Quit: so long]
03:15 -!- luneff [~yury@84.51.192.74] has quit [Quit: Leaving]
03:16 -!- happylife [~happylife@213.28.38.191] has joined #openvpn
03:18 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
03:18 <@vpnHelper> RSS Update - forum: VPN connection fails after installing Samba <http://forums.openvpn.net/topic9101.html>
03:22 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:24 <@vpnHelper> RSS Update - forum: Custom GUI Client Program <http://forums.openvpn.net/topic9103.html> || Custom GUI Client Program <http://forums.openvpn.net/topic9102.html>
03:30 <@vpnHelper> RSS Update - forum: How to set up Windows 2003 server as OpenVPN server? <http://forums.openvpn.net/topic9104.html>
03:31 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:35 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
03:35 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
03:36 <@vpnHelper> RSS Update - forum: OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html>
03:45 < Olipro> and in ALL CAPS
03:46 < Olipro> I'm going to go with "no security flaw"
03:52 < krzie> lol
03:53 < krzie> "I did a PORT security scan"
03:53 < krzie> omgz a PORT security scan
03:55 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079-15.html#p16956>
04:08 -!- LowKey [rhel@unaffiliated/lowkey] has quit [Ping timeout: 244 seconds]
04:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Remote host closed the connection]
04:17 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
04:37 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079-15.html#p16957>
05:07 -!- fread2281 [~fread2281@70-56-141-172.albq.qwest.net] has quit [Read error: Connection reset by peer]
05:08 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
05:15 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
05:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Read error: Connection reset by peer]
05:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:40 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
05:48 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
05:48 -!- itai_michaelson [~itai@218.82.169.98] has joined #openvpn
05:49 < itai_michaelson> hi, can anyone tell me where i can find the connection log for openvpn on ubuntu ?
05:57 < krzie> !logfile
05:57 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
05:59 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
06:03 -!- itai_michaelson [~itai@218.82.169.98] has quit [Ping timeout: 240 seconds]
06:35 -!- luneff [~yury@84.51.192.74] has joined #openvpn
06:37 -!- luneff [~yury@84.51.192.74] has quit [Client Quit]
06:42 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
07:01 <@vpnHelper> RSS Update - forum: ping-restart <http://forums.openvpn.net/topic9079-15.html#p16958>
07:16 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:16 -!- mode/#openvpn [+v s7r] by ChanServ
07:25 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p16959>
07:26 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
07:28 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
07:29 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:29 -!- mode/#openvpn [+v s7r] by ChanServ
07:29 -!- adolfomaltez [~taro@190.62.236.159] has quit [Remote host closed the connection]
07:31 <@vpnHelper> RSS Update - forum: OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p16960>
07:32 -!- ada0 [bc19a04b@gateway/web/freenode/ip.188.25.160.75] has joined #openvpn
07:33 -!- ada0 [bc19a04b@gateway/web/freenode/ip.188.25.160.75] has quit [Client Quit]
07:34 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
07:37 -!- bauruine_ [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
07:37 <@vpnHelper> RSS Update - forum: OVPN 2.2.0 + Mikrotiks + Windows Clients <http://forums.openvpn.net/topic9084.html#p16963> || VPN connection fails after installing Samba <http://forums.openvpn.net/topic9101.html#p16962> || How to set up Windows 2003 server as OpenVPN server? <http://forums.openvpn.net/topic9104.html#p16961>
07:40 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
07:40 -!- mode/#openvpn [+o mattock] by ChanServ
07:41 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Read error: Operation timed out]
07:42 <@vpnHelper> RSS Update - forum: TLS Record Layer <http://forums.openvpn.net/topic9096.html#p16965> || VPN'ed Server that Still Services Clients on Remote LAN <http://forums.openvpn.net/topic9097.html#p16964>
07:47 <@vpnHelper> RSS Update - forum: control up script <http://forums.openvpn.net/topic9091.html#p16969> || OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p16968> || Authenticate/Decrypt pack: Missing Authentication Info <http://forums.openvpn.net/topic9078.html#p16967> || Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p16966> || Openvpn dual authetication <http://forums.openvpn.net/topic9051.html#p16793>
07:50 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
07:50 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
07:50 -!- mode/#openvpn [+o mattock] by ChanServ
07:53 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p16972> || Span / Monitor port when using "client-to-client" mode? <http://forums.openvpn.net/topic9085.html#p16971> || OPENVPN AND MTU <http://forums.openvpn.net/topic9086.html#p16970>
07:59 <@vpnHelper> RSS Update - forum: Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html> || Need help with my script...OpenVPN keeps Restarting <http://forums.openvpn.net/topic9063.html#p16973>
08:02 -!- _julian [~quassel@hmbg-5f76009c.pool.mediaWays.net] has quit [Remote host closed the connection]
08:05 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
08:05 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p16976> || Difference between TUN & TAP interfaces <http://forums.openvpn.net/topic9038.html#p16975>
08:05 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:07 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
08:08 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:08 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:12 <@vpnHelper> RSS Update - forum: OpenvpnAs and Pfsense Site-to-Site <http://forums.openvpn.net/topic9107.html>
08:18 <@vpnHelper> RSS Update - forum: Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16978>
08:20 -!- EugeneKaway is now known as EugeneKay
08:31 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
08:36 <@vpnHelper> RSS Update - forum: Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html#p16979>
08:36 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
08:40 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:40 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:40 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:40 -!- mode/#openvpn [+v Axeman] by ChanServ
08:43 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
08:48 <@vpnHelper> RSS Update - forum: Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html#p16980>
08:54 <@vpnHelper> RSS Update - forum: Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html#p16981>
09:00 <@vpnHelper> RSS Update - forum: control up script <http://forums.openvpn.net/topic9091.html#p16982>
09:07 -!- master_of_master [~master_of@p57B53E73.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
09:09 -!- master_of_master [~master_of@p57B54DB7.dip.t-dialin.net] has joined #openvpn
09:18 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p16983>
09:20 -!- YeTr2 [~william@pool-173-78-36-56.tampfl.fios.verizon.net] has quit [Ping timeout: 260 seconds]
09:24 <@vpnHelper> RSS Update - forum: control up script <http://forums.openvpn.net/topic9091.html#p16985> || Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p16984>
09:24 < gladiatr> whee..
09:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:29 <@vpnHelper> RSS Update - forum: Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html#p16986>
09:29 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
09:29 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
09:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:36 <@vpnHelper> RSS Update - forum: Connects but can't reach remote network <http://forums.openvpn.net/topic9108.html>
09:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:38 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
09:38 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
09:38 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:42 <@vpnHelper> RSS Update - forum: OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p16988>
09:48 <@vpnHelper> RSS Update - forum: openvpn connecting fine, but no connectivity once connected? <http://forums.openvpn.net/topic9110.html> || Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html#p16989>
09:50 -!- corretico_ [~luis@200.12.40.25] has quit [Remote host closed the connection]
09:53 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
09:53 <@vpnHelper> RSS Update - forum: openvpn connecting fine, but no connectivity once connected? <http://forums.openvpn.net/topic9110.html#p16993> || Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html#p16992>
10:00 <@vpnHelper> RSS Update - forum: Connects but can't reach remote network <http://forums.openvpn.net/topic9108.html#p16995> || OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p16994>
10:08 -!- _julian [~quassel@hmbg-5f77fabd.pool.mediaWays.net] has joined #openvpn
10:12 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:17 -!- corretico_ [~luis@200.12.40.25] has quit [Ping timeout: 260 seconds]
10:17 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
10:18 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
10:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
10:23 <@vpnHelper> RSS Update - forum: Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html#p16996>
10:28 <@vpnHelper> RSS Update - forum: LDAP Setup <http://forums.openvpn.net/topic9111.html>
10:46 <@vpnHelper> RSS Update - forum: LDAP Setup <http://forums.openvpn.net/topic9111.html#p16999> || Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p16998>
10:52 <@vpnHelper> RSS Update - forum: [Solved] ping-restart <http://forums.openvpn.net/topic9079-15.html#p17000>
10:54 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 244 seconds]
10:54 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
11:03 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
11:07 -!- bauruine_ [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Remote host closed the connection]
11:13 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
11:17 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has quit [Quit: All your VPN are belong to us]
11:18 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has joined #openvpn
11:18 -!- happylife [~happylife@213.28.38.191] has quit [Ping timeout: 256 seconds]
11:21 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has quit [Client Quit]
11:21 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has joined #openvpn
11:21 <@vpnHelper> RSS Update - forum: Problem connecting to SQL Server through OpenVpn tunnel <http://forums.openvpn.net/topic9048.html#p17002> || LDAP Setup <http://forums.openvpn.net/topic9111.html#p17001>
11:23 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has quit [Client Quit]
11:24 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:24 -!- mode/#openvpn [+o raidz] by ChanServ
11:29 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
11:40 -!- Blue_Ice [~Blue_Ice@unaffiliated/blue-ice/x-2052838] has joined #openvpn
11:43 < Blue_Ice> what is the expected order that a client should follow regarding route withdrawel. ie: I want to have 2 openvpn tunnels for redundancy. On server side a route is pushed with a specific metric (5 on primary side, 10 on backup side). The client sees both routes, but when I shut the primary openvpn server the route remains there. Even though the client has reached the keepalive treshold and has already restarted it's process as a result
11:43 < Blue_Ice> the ip remains visible on the tun interface, and the route remains installed in the rib
11:44 < Blue_Ice> which ofcourse defeats the purpose of such setup
11:50 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
11:51 -!- happylife [~happylife@cs181134059.pp.htv.fi] has joined #openvpn
11:52 <@vpnHelper> RSS Update - forum: openvpn connecting fine, but no connectivity once connected? <http://forums.openvpn.net/topic9110.html#p17003>
12:02 < Blue_Ice> ok, never mind. My own mistake, I had persist-tun in the client config
12:10 <@vpnHelper> RSS Update - forum: OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p17005>
12:16 <@vpnHelper> RSS Update - forum: OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p17007> || LDAP Setup <http://forums.openvpn.net/topic9111.html#p17006>
12:21 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:25 < krzie> Blue_Ice, be sure to not drop priviledges in that case
12:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:32 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
12:33 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 252 seconds]
12:35 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: reboot]
12:37 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
12:40 -!- pwrcycle [~pwrcycle@64.85.168.32] has joined #openvpn
12:42 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
12:44 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html#p17008>
12:51 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
12:52 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 248 seconds]
12:57 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html#p17009>
13:04 -!- NuxRo [~nux@unaffiliated/nuxro] has joined #openvpn
13:05 < NuxRo> Hi, is there a way to execute a script client side once a vpn connection is established? (sort of like client-connect but on the client machine)
13:05 < NuxRo> i want to automatically mount a nfs share via the vpn connection
13:12 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:13 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:33 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p17011> || Extranet and MySQL integration <http://forums.openvpn.net/topic9112.html>
13:39 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p17012>
13:45 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17013>
13:52 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:53 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:57 -!- NuxRo [~nux@unaffiliated/nuxro] has left #openvpn []
13:59 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
14:00 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
14:09 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
14:09 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
14:15 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
14:17 -!- dazo_afk is now known as dazo
14:21 <@vpnHelper> RSS Update - forum: RRAS <http://forums.openvpn.net/topic9113.html>
14:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:45 <@vpnHelper> RSS Update - forum: Reverse VPN tunnel? <http://forums.openvpn.net/topic9114.html>
15:03 -!- pwrcycle [~pwrcycle@64.85.168.32] has quit [Changing host]
15:03 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
15:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
15:08 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:30 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
15:30 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
15:30 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
15:43 <@vpnHelper> RSS Update - forum: SVC_RUN_EXCEPT-cannot start server <http://forums.openvpn.net/topic8696.html#p17016>
15:44 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
15:45 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
15:49 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
15:52 -!- Ionic [ionic@ionic.de] has joined #openvpn
15:52 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:18 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
16:18 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
16:19 <@vpnHelper> RSS Update - forum: openvpn connecting fine, but no connectivity once connected? <http://forums.openvpn.net/topic9110.html#p17017>
16:20 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
16:23 -!- corretico_ [~luis@200.12.40.25] has quit [Ping timeout: 240 seconds]
16:25 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17020> || OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p17019> || Reverse VPN tunnel? <http://forums.openvpn.net/topic9114.html#p17018>
16:31 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p17021>
16:47 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
16:59 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
17:01 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Client Quit]
17:01 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
17:04 -!- Agin_ [~Agin@greenzone.copyleft.no] has joined #openvpn
17:04 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:05 -!- Agin [~Agin@greenzone.copyleft.no] has quit [Read error: Operation timed out]
17:11 -!- novaflash is now known as novaflash_away
17:26 -!- Denial [Denial@drgi.co.uk] has quit []
17:29 -!- pdtpatrick1 [~pdtpdt@12.249.4.226] has quit [Remote host closed the connection]
17:29 -!- dazo is now known as dazo_afk
17:40 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
17:41 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
17:49 -!- nixusr [~nixusr@unaffiliated/nixusr] has quit [Quit: Connection to internet lost]
17:54 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
18:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:06 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
18:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:10 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
18:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:12 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:14 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Remote host closed the connection]
18:18 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
18:18 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Client Quit]
18:20 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
18:22 -!- invisiblek [~invisible@97-88-3-14.dhcp.roch.mn.charter.com] has joined #openvpn
18:22 < invisiblek> hmm. my client can get connected, gets an ip address but not traffic is passing...
18:22 < invisiblek> routing is set up, this has worked before....not sure what changed
18:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:25 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:26 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
18:28 < krzee> ild guess ip forwarding
18:28 < krzee> you probably enabled it the temp way before or something
18:28 < krzee> (of course thats a random guess)
18:28 < krzee> !linipforward
18:28 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
18:29 < invisiblek> no thats enabled
18:29 < krzee> if in linux, cat /proc/sys/net/ipv4/ip_forward
18:29 < invisiblek> i think i found it
18:29 < krzee> oh, firewall then?
18:29 < invisiblek> i had set up the route somewhere
18:29 < invisiblek> but i had it in there the temp way before
18:29 < krzee> oh lol, do that the openvpn way
18:29 < invisiblek> my route is wrong
18:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:34 < invisiblek> hmm, 
18:34 < invisiblek> openvpn is creating the route incorrectly
18:34 < krzee> not normally... whats the situation?
18:34 < invisiblek> saying the gateway is 10.11.12.2 when it should be 10.11.12.1
18:34 < krzee> thats how openvpn works
18:34 < krzee> (by default)
18:34 < krzee> !/30
18:34 < invisiblek> 10.11.12.2 doesn't exist
18:34 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
18:34 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
18:35 < krzee> i know, its internal to the openvpn process
18:35 < krzee> aka, thats how openvpn works (like i said above)
18:35 < invisiblek> ahh, i see
18:35 < invisiblek> P-t-P:10.11.12.2
18:35 < krzee> its an old work-around for windows lamesauce
18:35 < invisiblek> so that route looks fine then
18:35 < krzee> they found a better way tho
18:35 < krzee> !topology
18:35 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
18:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:39 < invisiblek> topology subnet looks better
18:40 < invisiblek> still cant get any traffic passing though :(
18:40 < invisiblek> route looks right now though
18:40 < invisiblek> hmm
18:42 < invisiblek> no firewalls involved by the way
18:43 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:44 < krzee> what os?
18:44 < krzee> theres almost always firewalls involved
18:44 < invisiblek> gentoo on the server
18:44 < invisiblek> android on the client
18:45 < invisiblek> this has worked before
18:45 < krzee> that means nothing
18:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:48 < invisiblek> how stupid lol
18:48 < EugeneKay> So, who wants to get drunk?
18:48 < invisiblek> didn't enable lzo-compression on the client
18:48 < invisiblek> (also enabled redirect gateway which i guess is fine for my needs)
18:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:49 -!- fread2281 [~fread2281@70-56-208-209.albq.qwest.net] has joined #openvpn
18:56 -!- fread2281 [~fread2281@70-56-208-209.albq.qwest.net] has quit [Ping timeout: 244 seconds]
18:56 -!- jkoby [~jkoby@unaffiliated/theblue] has joined #openvpn
19:00 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17022>
19:30 -!- invisiblek [~invisible@97-88-3-14.dhcp.roch.mn.charter.com] has left #openvpn ["Leaving"]
19:36 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17023>
19:47 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:48 -!- _julian_ [~quassel@hmbg-4d069948.pool.mediaWays.net] has joined #openvpn
19:49 -!- _julian [~quassel@hmbg-5f77fabd.pool.mediaWays.net] has quit [Read error: Operation timed out]
20:14 -!- xerootg [807be1e3@gateway/web/freenode/ip.128.123.225.227] has joined #openvpn
20:14 -!- fread2281 [~fread2281@70-56-128-73.albq.qwest.net] has joined #openvpn
20:16 -!- fread2281 [~fread2281@70-56-128-73.albq.qwest.net] has quit [Client Quit]
20:47 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
20:47 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Client Quit]
20:48 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
20:48 -!- xerootg [807be1e3@gateway/web/freenode/ip.128.123.225.227] has quit [Quit: Page closed]
21:04 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:14 -!- chokesmaster [~chokesmas@65.92.83.242] has quit []
21:55 -!- EugeneKay is now known as EugeneSleep
22:04 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:04 -!- vtcN [~tony@unaffiliated/thethe] has joined #openvpn
22:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
22:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:36 -!- adolfomaltez [~taro@190.62.205.108] has joined #openvpn
22:37 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
22:38 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:41 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
22:41 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
22:42 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
22:42 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
23:13 <@vpnHelper> RSS Update - forum: Scalability, UDP buffer code 105, learn-address problem <http://forums.openvpn.net/topic9064.html> || OpenVPN bridge can't access machines on local network <http://forums.openvpn.net/topic9060.html#p16810>
23:13 < amero> hello
23:14 < amero> does "redirect-gateway def1" also work for ipv6 traffic?
23:14 < amero> krzee
23:17 < krzie> no idea honestly
23:17 < krzie> never done any ipv6 routing
23:17 < krzie> only even have 1 machine with ipv6 access
23:17 < krzie> and only cause it was given, i didnt care ;]
23:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
23:48 -!- mosno [~mosno@unaffiliated/mosno] has joined #openvpn
--- Day changed Thu Oct 27 2011
00:01 -!- adolfomaltez [~taro@190.62.205.108] has quit [Ping timeout: 252 seconds]
00:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:17 -!- adolfomaltez [~taro@190.62.243.9] has joined #openvpn
00:24 -!- adolfomaltez [~taro@190.62.243.9] has quit [Ping timeout: 240 seconds]
00:25 -!- mosno [~mosno@unaffiliated/mosno] has quit [Quit: Leaving]
00:39 -!- adolfomaltez [~taro@190.62.251.97] has joined #openvpn
00:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
00:45 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
00:49 -!- adolfomaltez [~taro@190.62.251.97] has quit [Remote host closed the connection]
00:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:06 -!- mode/#openvpn [+o mattock] by ChanServ
01:19 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p17024>
01:36 -!- happylife [~happylife@cs181134059.pp.htv.fi] has quit [Ping timeout: 258 seconds]
01:37 -!- IsilZha [~andreas@182.55.249.192] has quit [Ping timeout: 255 seconds]
01:43 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p17025>
01:48 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:55 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p17026>
02:05 -!- happylife [~happylife@213.28.38.191] has joined #openvpn
02:24 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
02:24 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
02:24 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
02:25 <@vpnHelper> RSS Update - forum: SOLVED: VPN connection fails after installing Samba <http://forums.openvpn.net/topic9101.html#p17027>
02:29 -!- dazo_afk is now known as dazo
02:31 <@vpnHelper> RSS Update - forum: RRAS <http://forums.openvpn.net/topic9113.html#p17028>
02:38 -!- happylife [~happylife@213.28.38.191] has quit [Remote host closed the connection]
02:48 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
02:48 -!- happylife [~happylife@213.28.38.191] has joined #openvpn
02:50 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
02:50 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-bhpkrhxohyfsgvse] has quit [Quit: Connection closed for inactivity]
03:01 < Mowee> Hello :)
03:09 < Olipro> .jpg
03:14 -!- winter [~winter@unaffiliated/winter] has joined #openvpn
03:14 < winter> hello
03:14 < winter> anyone here willing to answer my questions?
03:17 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
03:19 -!- happylife [~happylife@213.28.38.191] has quit [Quit: so long]
03:20 -!- happylife [~happylife@213.28.38.191] has joined #openvpn
03:32 -!- corretico [~luis@201.201.44.82] has quit [Read error: No route to host]
03:45 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:51 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:06 -!- toortog [~toortog@notsecure.net] has quit [Read error: Connection reset by peer]
04:10 -!- mengu [~mengu@unaffiliated/mengu] has joined #openvpn
04:13 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p17029>
04:13 < mengu> hi. i was using fortinet's ssl vpn client -- fortinetsslvpn however after recent updates ubuntu 11.10 messed up. i have a .crt file, a .key file and a .pem file. how can i connect to that vpn via openvpn?
04:14 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 252 seconds]
04:16 -!- toortog [~toortog@38.111.17.107] has joined #openvpn
04:16 < mengu> anyone?
04:31 <@vpnHelper> RSS Update - forum: Windows 2003 OpenVPN client not adding route <http://forums.openvpn.net/topic9115.html>
04:37 <@vpnHelper> RSS Update - forum: Windows 2003 OpenVPN client not adding route <http://forums.openvpn.net/topic9115.html#p17031>
04:38 < mengu> has anyone tried connecting a fortinet vpn from openvpn?
04:39 -!- ravel [ravel@175.136.82.14] has joined #openvpn
04:43 <@vpnHelper> RSS Update - forum: OVPN 2.2.0 + Mikrotiks + Windows Clients <http://forums.openvpn.net/topic9084.html#p17032>
04:47 -!- novaflash_away is now known as novaflash
04:49 <@vpnHelper> RSS Update - forum: Windows 2003 OpenVPN client not adding route <http://forums.openvpn.net/topic9115.html#p17033>
05:19 -!- ido- [~wtf@46-117-183-242.bb.netvision.net.il] has joined #openvpn
05:19 < ido-> ugh. 'lo
05:21 < ido-> I have openvpn running on a server which is on lan-192.168.1.22 with vpn network being 10.8.0.1
05:21 < ido-> when i connect with a client i am able to print 10.8.0.1, and although i have added a route 'route add 192.168.1.0 mask 255.255.255.0 10.8.0.1', I am not able to ping 192.168.1.22
05:22 < ido-> what could cause this ?
05:28 -!- mengu [~mengu@unaffiliated/mengu] has quit [Remote host closed the connection]
05:40 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
05:41 -!- toortog [~toortog@38.111.17.107] has quit [Read error: Operation timed out]
05:41 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
05:42 -!- toortog [~toortog@notsecure.net] has joined #openvpn
05:49 <@vpnHelper> RSS Update - forum: control up script <http://forums.openvpn.net/topic9091.html#p17034>
05:52 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
05:55 <@vpnHelper> RSS Update - forum: Windows 2003 OpenVPN client not adding route <http://forums.openvpn.net/topic9115.html#p17036> || control up script <http://forums.openvpn.net/topic9091.html#p17035>
05:58 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has quit [Ping timeout: 252 seconds]
06:00 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:07 <@vpnHelper> RSS Update - forum: [SOLVED] OVPN 2.2.0 + Mikrotiks + Windows Clients <http://forums.openvpn.net/topic9084.html#p17037>
06:19 <@vpnHelper> RSS Update - forum: OpenVPN AS deployment questions <http://forums.openvpn.net/topic9009.html#p17038>
06:25 <@vpnHelper> RSS Update - forum: Connects but can't reach remote network <http://forums.openvpn.net/topic9108.html#p17039>
06:27 -!- toortog [~toortog@notsecure.net] has quit [Quit: changing servers]
06:28 -!- toortog [~toortog@38.111.17.107] has joined #openvpn
06:30 -!- ido- [~wtf@46-117-183-242.bb.netvision.net.il] has left #openvpn []
06:30 -!- ido- [~wtf@46-117-183-242.bb.netvision.net.il] has joined #openvpn
06:32 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
06:34 -!- robert83a2 [~robert83a@gandalf.topolauniverzal.com] has joined #openvpn
06:34 < robert83a2> hello all, I've created an OpenVPN server and client, client connects to server from client I can ping the server...and the computers behind it no problem
06:34 < robert83a2> the problem is the server is not able to ping computers behind client
06:35 < robert83a2> now I've read about iroute... but I'm confused
06:35 < robert83a2> do I need to specify iroute on the client config file ?
06:35 < robert83a2> iroute 192.168.140.0 255.255.255.0 ?
06:36 < robert83a2> client config : http://pastebin.com/VcVGi2c3
06:37 < robert83a2> server config : http://pastebin.com/uGE1p32v
06:45 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
06:50 < robert83a2> I wonder... 
06:50 < robert83a2> because both server and client is a router using ripv2
06:51 < robert83a2> what If I simply specify network 192.168.220.0 (that is the vpn client address as well as the vpn network)
06:51 < robert83a2> anyway will try this seems like this room is dead
06:53 -!- dazo is now known as dazo_afk
07:01 <@vpnHelper> RSS Update - forum: OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p17040>
07:07 <@vpnHelper> RSS Update - forum: Windows 2003 OpenVPN client not adding route <http://forums.openvpn.net/topic9115.html#p17041>
07:13 <@vpnHelper> RSS Update - forum: Adding a whole branch office to a vpn <http://forums.openvpn.net/topic9116.html>
07:15 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has joined #openvpn
07:25 -!- corretico [~luis@200.12.40.25] has joined #openvpn
07:25 <@vpnHelper> RSS Update - forum: OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p17045> || Windows 2003 OpenVPN client not adding route <http://forums.openvpn.net/topic9115.html#p17044> || Adding a whole branch office to a vpn <http://forums.openvpn.net/topic9116.html#p17043>
07:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
07:31 <@vpnHelper> RSS Update - forum: OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p17046>
07:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:37 <@vpnHelper> RSS Update - forum: OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p17047>
07:43 <@vpnHelper> RSS Update - forum: VPN + application authentication SSO <http://forums.openvpn.net/topic9117.html>
08:32 <@vpnHelper> RSS Update - forum: Strange path from Android system. <http://forums.openvpn.net/topic9118.html>
08:36 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:51 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
08:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:55 <@vpnHelper> RSS Update - forum: Strange path from Android system. <http://forums.openvpn.net/topic9118.html#p17051> || Push dhcp-options for Android. <http://forums.openvpn.net/topic9119.html>
09:02 <@vpnHelper> RSS Update - forum: Strange path from Android system. <http://forums.openvpn.net/topic9118.html#p17053> || VPN + application authentication SSO <http://forums.openvpn.net/topic9117.html#p17052>
09:04 -!- robert83a2 [~robert83a@gandalf.topolauniverzal.com] has quit []
09:04 -!- EugeneSleep is now known as EugeneKay
09:07 -!- master_of_master [~master_of@p57B54DB7.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
09:07 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
09:08 -!- master_of_master [~master_of@p57B52BB9.dip.t-dialin.net] has joined #openvpn
09:13 <@vpnHelper> RSS Update - forum: VPN + application authentication SSO <http://forums.openvpn.net/topic9117.html#p17057> || Push dhcp-options for Android. <http://forums.openvpn.net/topic9119.html#p17056> || Windows 2003 OpenVPN client not adding route <http://forums.openvpn.net/topic9115.html#p17055> || OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p17054>
09:17 -!- happylife [~happylife@213.28.38.191] has quit [Ping timeout: 255 seconds]
09:19 <@vpnHelper> RSS Update - forum: Push dhcp-options for Android. <http://forums.openvpn.net/topic9119.html#p17061> || OPENVPN SECURITY FLAW?? <http://forums.openvpn.net/topic9105.html#p17060> || VPN + application authentication SSO <http://forums.openvpn.net/topic9117.html#p17059> || I have problem. <http://forums.openvpn.net/topic9082.html#p17058>
09:22 -!- happylife [~happylife@213.28.38.191] has joined #openvpn
09:26 <@vpnHelper> RSS Update - forum: Strange path from Android system. <http://forums.openvpn.net/topic9118.html#p17062>
09:32 <@vpnHelper> RSS Update - forum: Strange path from Android system. <http://forums.openvpn.net/topic9118.html#p17064> || Push dhcp-options for Android. <http://forums.openvpn.net/topic9119.html#p17063>
09:37 -!- freeman_ [4addd142@gateway/web/freenode/ip.74.221.209.66] has joined #openvpn
09:37 -!- Mowee [~Mowi@lendabrain.net] has quit [Remote host closed the connection]
09:37 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
09:38 < freeman_> hi, can anyone give me suggestion what is best solution for ip over icmp?
09:44 <@vpnHelper> RSS Update - forum: Strange path from Android system. <http://forums.openvpn.net/topic9118.html#p17065>
09:46 -!- freeman_ [4addd142@gateway/web/freenode/ip.74.221.209.66] has left #openvpn []
09:47 < krzee> if he returns, answer is theres 1 solution: icmptx
09:52 < ido-> hey guys
09:52 < ido-> can anyone answer my question ?
09:52 < EugeneKay> Only if you aask it.
09:52 < ido-> ok
09:52 < krzee> !route
09:52 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
09:52 < ido-> my lan is on 192.168.1.0/255
09:53 < krzee> you may have missed this part:
09:53 < ido-> openvpn subnet is 10.8.1.0
09:53 < ido-> openvpn is configured as 'server 10.8.1.0', which means its ip is 10.8.1.1 and 10.8.1.2 with ip pool of .4 and on
09:54 < ido-> now, my question is, how to get vpn client to access lan
09:54 < ido-> i solved it by adding a route: route 192.168.1.0 mask 255.255.255.0 10.8.1.5
09:54 < krzee> !route_outside_vpn
09:54 < krzee> !route_outside_ovpn
09:54 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
09:54 < ido-> my question is why the gateway is 10.8.1.5 ?
09:55 < krzee> thats because:
09:55 < krzee> !/30
09:55 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
09:55 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
09:55 < krzee> you can change that with:
09:55 < krzee> !topology
09:55 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
09:57 < ido-> again, my question is why the gateway on the client should be 10.8.1.5 and not 10.8.1.1 ?
09:57 < krzee> go read the info given to you
09:57 < krzee> its explained in the links my bot just gave you
09:57 < krzee> i dont feel like copy/pasting for you, just click them :-p
09:59 < ido-> i'm reading allright.. :)
09:59 < ido-> still mixed up
09:59 < krzee> its a virtual ip only exists inside the openvpn process
09:59 < krzee> only exists as an old workaround for windows lamesauce
10:00 < krzee> they found a better way, which makes it work like you expected, which you see in !topology
10:04 < ido-> sweet. thanks
10:04 < ido-> i don't remember needing to have this problem in older versions (few years back)
10:08 < krzee> what problem?
10:08 <@vpnHelper> RSS Update - forum: Push dhcp-options for Android. <http://forums.openvpn.net/topic9119.html#p17066>
10:08 < krzee> dont go changing that stuff, openvpn knows how to add routes right
10:08 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
10:08 < krzee> you likely forgot to add the route back to the vpn on your lan's router (as i pointed out above)
10:08 < ido-> i just need to add the static route in the gateway of the local lan
10:08 < krzee> yep =]
10:08 < krzee> !route_outside_ovpn
10:08 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
10:08 < krzee> that ^
10:08 < ido-> (no, it wasn't the problem i was talking about)
10:09 -!- ido- [~wtf@46-117-183-242.bb.netvision.net.il] has left #openvpn []
10:19 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:23 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:23 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:24 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:24 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:25 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:25 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:26 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:26 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:26 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:26 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:29 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:29 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:31 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:31 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:31 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:31 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:32 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:32 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:33 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:33 -!- mode/#openvpn [+v s7r] by ChanServ
10:34 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
10:34 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
10:34 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:34 -!- mode/#openvpn [+v Axeman] by ChanServ
10:35 -!- ada0 [bc19a04b@gateway/web/freenode/ip.188.25.160.75] has joined #openvpn
10:36 -!- ada0 [bc19a04b@gateway/web/freenode/ip.188.25.160.75] has quit [Client Quit]
10:37 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:37 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:40 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has quit [Remote host closed the connection]
10:40 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:40 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:44 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:44 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:45 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:45 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:48 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p17067>
10:50 -!- fapi [~fapi@c-71-229-141-122.hsd1.co.comcast.net] has joined #openvpn
10:50 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:50 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:56 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:56 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:57 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:57 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
10:58 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
10:58 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
11:01 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
11:01 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
11:03 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
11:03 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
11:04 -!- happylife [~happylife@213.28.38.191] has quit [Ping timeout: 248 seconds]
11:07 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
11:07 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
11:08 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
11:08 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
11:18 -!- mode/#openvpn [+o ecrist] by ChanServ
11:18 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has joined #openvpn
11:18 -!- netxshare [~netxshare@2a01:608:ffff:3405::42] has quit [Excess Flood]
11:19 -!- mode/#openvpn [+b *!*@2a01:608:ffff:3405::42] by ecrist
11:19 -!- mode/#openvpn [-o ecrist] by ecrist
11:32 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
11:33 < krzee>  /system/xbin/mount -o rw,remount -t yaffs2 $(/system/xbin/grep /system /proc/mounts|/system/xbin/awk '{print $1}') $(/system/xbin/grep /system /proc/mounts|/system/xbin/awk '{print $2}')
11:33 < krzee> for the friggen win
11:34  * EugeneKay sneezes
11:34 < krzee> you STILL sick dude?
11:35 < EugeneKay> Nope, awwergies
11:35 < krzee> ahh
11:35 < EugeneKay> Did I show you my kitchen?
11:36 < krzee> negative
11:36 < EugeneKay> http://kashpureff.org/album/v/2011/2011-10-08/
11:36 <@vpnHelper> Title: 2011-10-08 (at kashpureff.org)
11:36  * krzee hopes that was code
11:36 < krzee> nope, no boobs... just kitchen
11:36 < krzee> lol
11:37 < krzee> (i see and enjoy your posts in #cyanogenmod)
11:37 < EugeneKay> >_>
11:37 < krzee> oh shit
11:37 < krzee> howd it catch fire?  that sucks
11:37 < EugeneKay> That would be "a woman doing her job"
11:37 < krzee> insurance?
11:37 < EugeneKay> Lil bro, deep frying, too much oil, too much heat, didn't listen when I said "wait until I can come supervise"
11:38 < krzee> damn man
11:38 < EugeneKay> Uh. Insurance?
11:38 < krzee> as in, you had it, they are covering it?
11:38 < EugeneKay> Hahahahahahaah
11:38 < EugeneKay> You don't understand
11:38 < EugeneKay> I live in a $20k house with 3 acres of land. The going rate for land around here is $6,000 per acre
11:39 < krzee> wow, where you live man?
11:39 < EugeneKay> Flippin, Arkansas.
11:39 < krzee> ahh
11:39 < EugeneKay> I own more in computers than the house
11:42 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
11:45 < ecrist> I owe $183k on a $60k house
11:45 < krzee> ouch
11:46 < EugeneKay> D'oh.
11:46 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 258 seconds]
11:46 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:46 < krzee> brb rebooting to recognize my new bluetooth adapter so i can get my magic trackpad rockin
11:47 -!- jhendricks [~jhendrick@adsl-76-204-8-234.dsl.klmzmi.sbcglobal.net] has joined #openvpn
11:48 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
11:58 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
12:01 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
12:03 < krzee> i knew i would love this magic trackpad
12:04 < krzee> turns out i was 100% correct
12:07 -!- ravel [ravel@175.136.82.14] has quit []
12:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 245 seconds]
12:22 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17068>
12:34 -!- mete [~mete@mete.shell.la] has quit [Quit: mete]
12:40 <@vpnHelper> RSS Update - forum: Strange path from Android system. <http://forums.openvpn.net/topic9118.html#p17069>
12:46 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p17070>
12:48 -!- prsn [~jake@wsip-70-167-17-57.ri.ri.cox.net] has joined #openvpn
12:49 < prsn> Hi! openvpn is failing, and not writing to any logfile, as far as I can tell. I added 'log /home/<me>/pub' to my conf, still nothing. Tried log-append and touched the file; nothing. Nothing in /var/log/messages, /var/log/openvpn.log doesn't exist
12:49 < prsn> any ideas?
12:52 < krzee> are you lowering priviledges?
12:52 <@vpnHelper> RSS Update - forum: Strange path from Android system. <http://forums.openvpn.net/topic9118.html#p17071>
12:52 < krzee> as in, using user / group in your config
12:52 < prsn> i don't think so?
12:52 < krzee> if so, you'll need to be sure that user has write permission to make the logfile where you said
12:52 < prsn> but yeah that pub directory
12:52 < krzee> think so?  shouldnt you look then!?
12:53 < prsn> is world writable
12:53 < krzee> it would also need +x on the dirs before it
12:53 < krzee> so if /home/me was 700 and /home/me/pub was 777 (example) then it still wouldnt work
12:54 < krzee> in that case if /home/me was made 711, it would work
12:54 < prsn> yeah, everything has +x
12:54 < prsn> and yes, I am using user openvpn/group openvpn
12:54 < prsn> does that normally make logging not work? o_O
12:55 < krzee> no, it but it could explain your --log not working
12:55 < krzee> as for it not being in the files you looked for in /var/log, is the command daemon in your config?
12:55 < EugeneKay> w00t. Google Apps Domains got Profiles/Plus today!
12:57 < prsn> krzee: I have a sectoin called Daemon Configuration
12:57 < krzee> a section?
12:57 < prsn> it has 'verb 3' and 'persist-key' and 'persist-tun'
12:58 -!- prsn [~jake@wsip-70-167-17-57.ri.ri.cox.net] has left #openvpn []
13:05 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
13:05 < krzee> but not daemon
13:05 < krzee> !logfile
13:05 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
13:06 < krzee> EugeneKay, you know how i can clear the android resolver cache (restart it maybe?) from CLI?
13:06 < krzee> (cm7)
13:06 < EugeneKay> Reboot
13:06 < krzee> grr
13:06 < krzee> i need it scripted, rebooting isnt a valid option
13:06 < krzee> when i start openvpn with server in RR dns, it chooses 1 at random, then never tries another if that is down
13:06 < krzee> on a normal machine it works as expected, not on android
13:07 < krzee> i figure worst case scenario i could restart the resolver every 5min or something
13:07 < krzee> but i certainly cant reboot
13:07 < EugeneKay> Yeah, I dunno.
13:07 < krzee> (this will go into production)
13:08 < EugeneKay> The CM openvpn client needs help
13:08 < krzee> im not using it from gui
13:08 < EugeneKay> Ahhh
13:08 < krzee> but it is the same openvpn binary running
13:08 < krzee> i hid everything away in /system so users wont be able to screw anything up
13:09 < krzee> works great until this resolver issue
13:11 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17072>
13:11 < EugeneKay> Interesting
13:12 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:13 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:14 < krzee> interesting to note, if i kill openvpn and restart, it randomly selects a server again from the rr dns
13:14 < krzee> it behaves differently on my computers... so im wondering if something was stripped from this android compile
13:17 -!- EvilGuru [~freddie@warzone2100/developer/EvilGuru] has left #openvpn []
13:19 < EugeneKay> Probably Android's DNS
13:20 < krzee> ya thats the assumption im working from
13:20 < krzee> i guess i can test that by clearing network settings from the gui
13:21 < krzee> if it works then i know i need to dig for the cli way
13:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
13:21 < EugeneKay> It looks like Network Location --> CLear Data will flush it
13:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:22 < krzee> ya thats what i saw too, although in cm7 network location isnt in applications
13:22 < EugeneKay> Go figure
13:30 -!- mete [~mete@mete.shell.la] has joined #openvpn
13:38 < krzee> if i change the network, it works again
13:38 < krzee> as in turn off data, turn it on
13:38 < krzee> or go wifi -> data
13:39 < krzee> so somewhere there IS a way
13:39 < krzee> however, i cant automate that part =/
13:40 < krzee> since openvpn doesnt have a script hook for a failed connect
13:40 < krzee> although that could be handy... i think ill add it to the wishlist
13:45 -!- tjz_ [~pc@bb219-74-189-233.singnet.com.sg] has joined #openvpn
13:45 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
13:47 <@vpnHelper> RSS Update - forum: new script hook <http://forums.openvpn.net/topic9121.html>
13:52 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
13:52 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
13:59 <@vpnHelper> RSS Update - forum: new script hook <http://forums.openvpn.net/topic9121.html#p17074>
14:07 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
14:17 <@vpnHelper> RSS Update - forum: new script hook <http://forums.openvpn.net/topic9121.html#p17075>
14:20 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
14:20 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
14:20 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
14:23 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
14:26 -!- decoder [~quassel@2a01:238:42b3:5200:fade:c0de:ba5e:beeb] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
14:27 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
14:27 -!- bassliner [armin@irc.arje.de] has joined #openvpn
14:27 < bassliner> is there a way to reference certificate files in a client.conf so that the relative path to them starts from where the config file is, instead of using the current directory?
14:29 < hyper_ch> bassliner: yes
14:29 < bassliner> oh wow
14:29 < bassliner> 8)
14:29 < bassliner> hyper_ch: how so?
14:29 < hyper_ch> ca ca.crt
14:30 < hyper_ch> if the ca.crt is in the same folder
14:30 < hyper_ch> as client.conf
14:32 < bassliner> hyper_ch: that's just what i have, but when i start openvpn via "openvpn some/folder/name/bla/bleh/client.conf", it's looking in the folder *i* am, not in some/folder/name/bla/bleh/ :-/
14:33 < hyper_ch> well, that's normal
14:33 < hyper_ch> I use init script
14:34 < bassliner> mh :-/
14:34 < bassliner> okay, thank you tho. :)
14:35 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html#p17076>
14:37 < ecrist> krzee: I haven't mailed that box yet, will soon.
14:37 < krzee> gotchya
14:37 < krzee> hyper_ch, that is false
14:38 < krzee> bassliner, you can use --cd before any of those directives
14:38 < krzee> like cd /path/to/certs
14:38 < krzee> then everything after will be relative to that path
14:38 < hyper_ch> krzee: :(
14:40 < bassliner> krzee: great. thank you.
14:40 < krzee> np
14:53 <@vpnHelper> RSS Update - forum: I have problem. <http://forums.openvpn.net/topic9082.html#p17077>
14:56 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
14:56 -!- MadTBone_ [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has joined #openvpn
14:57 < derekv> since I have waisted time getting this wrong before, the version of openvpn-gui i probably want is from openvpn.net, or the one from .se ? 
14:57 < krzee> !download
14:57 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
14:57 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has quit [Ping timeout: 276 seconds]
14:57 < krzee> =]
14:57 < derekv> nice thanks
14:57 < krzee> np
14:58 < derekv> anything new/improved/exciting in the last few months?
14:58 < krzee> i saved a ton of $ on my car insurance
14:58 < derekv> o,o^
14:58 < krzee> lol
15:00 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
15:00 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Ping timeout: 248 seconds]
15:00 < derekv> I'm not really sure what i was going for there
15:01 -!- MadTBone_ [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has quit [Ping timeout: 255 seconds]
15:12 < derekv> apperently i had something called "my certificate wizard" which I no longer have
15:13 -!- krzee [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
15:14 < derekv> oic its got bugs
15:14 < derekv> too bad could have been useful for me
15:15 < derekv> i don't see why i couldn't use whatever native tools to create a csr
15:15 < derekv> windows certificate store
15:17 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
15:19 < EugeneKay> !windows
15:19 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
15:19 < jasonmsp> argh.  disconnected.  Can anyone take a look and tell me whats going wrong here? VPN went from working to non working http://pastebin.com/mTkJBLDh
15:19 < EugeneKay> That's why ^
15:19 < derekv> gotta get paid, son
15:19 < EugeneKay> I use XCA to do all my key/cert creation and CA management and such
15:21 < derekv> ideally, i'd like the process to be : windows user downloads openvpn-gui and installs, follows some instructions I write up, producing a csr which they email to me.  i sign it and return it.  They place the csr and probably a config file in the appropriate spots following some more instructions
15:21 < derekv> but hopefully, its as easy as possible
15:21 < derekv> i'll makes some scripts to help
15:22 < derekv> I can't make them memorize passphrases that would protect keys sufficiently
15:22 < derekv> i don't have enough authority to say "just do it", i'm kindof in a weird position that way
15:22 < derekv> so i'm trying to make the best of the situation
15:36 -!- krzie is now known as krzee
15:38 < krzee> iirc theres talk of some windows CA software in the openvpn cookbook
15:38 < krzee> !book
15:38 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
15:38 < krzee> i love that lil book =]
15:39 < krzee> what i DONT love is this damned android resolver
15:43 < winter> is it possible to connect to openvpn from the server's address?
15:44 < krzee> routing loop waiting to happen
15:44 < krzee> but i dunno, never tried nor do i know why you would
15:45 < winter> i tried to test my config from my internal network, tried to test the connectivity from the outer interface and it didn't work
15:45 < winter> but my mate with different address connected without problems
15:45 < winter> so guess that it's not possible
15:52 < krzee> oh well ya that wouldnt be possible
15:53 < krzee> but to the local ip would be
15:53 < krzee> when you said same ip i had to assume same computer
15:53 < krzee> !local
15:53 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
15:53 < krzee> but ya, you wanna test from the outside world
15:53 < derekv> yea so it works so far
15:54 < krzee> anyways, sorry guys but i need to focus on my problem
15:54 < krzee> when im back to problem free ill be back helping more
15:54 < derekv> i mean, i can create an x509 request using certmgr in windows, sign it on the server with openssl, and sent the cert back to windows , at least
15:55 < krzee> <-- android resolver fubar'ing my openvpn failover, need a creative hack to restart openvpn every time it tries a host that is offline
15:55 < krzee> or a way to flush or even block the android resolver cache (i assume thats the issue)
15:55 < krzee> or a way to force openvpn to reload the network upon contacting an offline host
15:56 < krzee> etc
15:56 < krzee> so bbl =]
15:59 -!- newl [~newl@97.75.165.156] has joined #openvpn
16:05 -!- jhendricks [~jhendrick@adsl-76-204-8-234.dsl.klmzmi.sbcglobal.net] has quit [Quit: Leaving]
16:13 < derekv> heh, i can't ping internet from my firewall , but it works fine (lan traffic gets out fine)
16:13 < derekv> never seen that before
16:18 < derekv> lol, wonder why i had 'no state' on allow out on egress rule
16:20 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has left #openvpn []
16:22 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
16:41 <@vpnHelper> RSS Update - forum: Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html#p17078>
16:46 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:49 -!- mick_laptop [~mick@clamwin/admin/mickhome] has quit [Ping timeout: 248 seconds]
16:50 -!- mick_laptop [~mick@mickweiss.com] has joined #openvpn
16:53 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 240 seconds]
16:53 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p17079>
16:59 -!- vtcN [~tony@unaffiliated/thethe] has quit [Read error: Connection reset by peer]
17:04 -!- vtcN [~tony@unaffiliated/thethe] has joined #openvpn
17:04 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
17:05 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
17:05 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
17:05 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
17:12 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p17080>
17:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:17 < EugeneKay> krzee - use IP addresses? :v
17:29 <+s7r> if a client is surfing on the internet through the vpn server, can i configure so every page he is browsing will show up, a small line with my vpn name, etc?
17:30 -!- vect0rx [vectorx@countercultured.net] has quit [Ping timeout: 258 seconds]
17:31 < krzee> EugeneKay, i will be adding and removing servers over time, with no access to client configs
17:32 <+s7r> krzee: any ideas?
17:33 < krzee> s7r, force outbound web traffic through a proxy like squid
17:33 <+s7r> yeah, seams best solution. no way can do this with openvpn itself right?
17:34 <+s7r> except iptables rule to force traffic on tcp 80 & 443 via a proxy
17:34 < krzee> openvpn just tunnels traffic
17:34 < krzee> the only reason you can even hit that webpage is cause you used nat and let openvpn add routes for you
17:34 <+s7r> or how could I otherwise route *only web traffic* via proxy?
17:35 < krzee> openvpn does not know or care what you send over it
17:35 < krzee> so take ovpn out of the equation
17:35 < krzee> your new question is "how can i force web traffic through a proxy"
17:35 < krzee> google will help from there =]
17:35 < krzee> now its a normal business firewall policy
17:36 < krzee> instead of the vpn issue complicating it
17:39 <+s7r> :D
17:39 <+s7r> thanks
17:39 <+s7r> really. for pointing in the right direction
17:39 <+s7r> was thinking at openvpn itself
17:40 < krzee> np
17:57 -!- Denial [Denial@drgi.co.uk] has quit []
17:57 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059.html#p17081>
18:03 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
18:04 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:08 < EugeneKay> Hrm.
18:09 < EugeneKay> Use a pool of hostnames and change A records? Will it do remote-random properly?
18:09 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
18:09 < krzee> i guess that is a solution too
18:10 < krzee> and for now i could just make them all resolve to machines that work
18:11 < krzee> i think thats gunna work man, lets try it out
18:12 < EugeneKay> Yup. vpn1.example.com through vpn9.example.com
18:12 < krzee> exactly what i made them ;]
18:12 < EugeneKay> openvpn does the round-robin instead of dns
18:13 < krzee> yep, keeping it an openvpn issue is ++
18:13 < krzee> thanks man
18:13 < EugeneKay> Well, it'd be nice if Android wasn't FUCKING STUPID (tm) about such things
18:13 < EugeneKay> But it is a valid workaround
18:13 < krzee> it sure as hell would
18:13 < krzee> but ya, very valid workaround
18:18 < krzee> now for the moment of truth
18:18 < krzee> oh yes
18:18 < krzee> ^5 to EugeneKay 
18:18 < EugeneKay> Score.
18:19 < krzee> ok so tested initial connection, time to test failover when one dies with client connected
18:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:26 < EugeneKay> MASSIVE HEMORRAGE
18:27 < EugeneKay> What's this for, anyway? Setting up people's phones for work/
18:36 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
18:36 < krzee> ya, new biz
18:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:41 <@vpnHelper> RSS Update - forum: new script hook <http://forums.openvpn.net/topic9121.html#p17082>
18:48 < EugeneKay> Fun
18:52 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Remote host closed the connection]
19:01 -!- raidz is now known as raidz_afk
19:22 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
19:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
19:30 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
19:38 -!- raidz_afk is now known as raidz
20:20 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
20:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:49 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
21:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
21:34 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:38 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
21:40 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:44 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:44 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Quit: byebye]
21:45 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
21:51 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:06 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
22:12 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
22:25 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has joined #openvpn
22:25 < Some_Person> Is it possible to move my OpenVPN server to another machine without having to regenerate anything or whatnot?
22:26 < Some_Person> I'm planning to format the machine it's currently on
22:44 < EugeneKay> Sure. Tarball up your PKI and .conf files and move 'em.
22:44 < EugeneKay> openvpn doesn't check the CN of the certs against the server's hostname of it's own virtue, so it'll "just work"
22:55 -!- sploozer [~sploozer@pool-108-28-240-23.washdc.fios.verizon.net] has joined #openvpn
22:56 < sploozer> hello..I can setup openvpn remote access using certs just fine...but how do I setup remote access w/ pre-shared key authentication? is there any tutorial for that
23:00 < Some_Person> ok, thanks EugeneKay 
23:01 < sploozer> anyone?
23:01 < EugeneKay> PSK is silly, if you have PKI working. The HOWTO has a section on PSK, tho.
23:02 < sploozer> EugeneKay: I understand the different and the benefits of both..just want to configure to test things :)
23:02 < sploozer> difference*
23:03 < sploozer> the howto..only describes l2l w/ PSK
23:03 -!- EugeneKay is now known as EugeneYawn
23:03 < EugeneYawn> I don't touch PSK, sorry.
23:03  * EugeneYawn crawls into bed
23:03 < sploozer> night
23:03 -!- sploozer [~sploozer@pool-108-28-240-23.washdc.fios.verizon.net] has quit [Quit: Leaving]
23:04 < EugeneYawn> Bravo for doing the homework on it, though ;-)
23:05 < krzee> !forwardsecurity
23:05 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
23:05 < EugeneYawn> Yeah, but he said he's just after testing
23:05 < EugeneYawn> So pthhhhhhp
23:05 < krzee> heh
23:06 < krzee> even the manual gives a step by step on psk
23:06 < krzee> literally, command by command adding complexity
23:14 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:30 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:40 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 245 seconds]
23:54 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
--- Day changed Fri Oct 28 2011
00:00 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
00:07 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 240 seconds]
00:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:26 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:33 -!- jasonmsp1 [~jason1@unaffiliated/jasonmsp] has joined #openvpn
00:33 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has quit [Ping timeout: 258 seconds]
00:53 <@vpnHelper> RSS Update - forum: Attempting to force AD authentication for openvpn users <http://forums.openvpn.net/topic9059-15.html#p17083>
01:03 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
01:03 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
01:03 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
01:15 -!- ravel [ravel@175.136.82.14] has joined #openvpn
01:17 -!- ravel [ravel@175.136.82.14] has quit [Client Quit]
01:17 <@vpnHelper> RSS Update - forum: Open Vpn And Server 2008 r2 Core <http://forums.openvpn.net/topic9122.html>
01:17 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
01:20 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
01:20 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
01:20 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
01:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
01:34 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:35 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
01:52 -!- raidz is now known as raidz_afk
01:58 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
01:59 < Mowee> Morning
02:03 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
02:17 -!- dazo_afk is now known as dazo
02:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
02:55 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:58 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:20 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:20 -!- mode/#openvpn [+v s7r] by ChanServ
03:28 -!- troyt [~troyt@2001:5c0:1000:b::a06b] has quit [Ping timeout: 244 seconds]
03:30 -!- jasonmsp1 [~jason1@unaffiliated/jasonmsp] has quit [Ping timeout: 252 seconds]
03:36 -!- troyt [~troyt@2001:5c0:1400:b::bb75] has joined #openvpn
04:00 <@vpnHelper> RSS Update - forum: Website not working after connecting to a vpn server? <http://forums.openvpn.net/topic9106.html#p17085>
04:01 -!- _julian_ [~quassel@hmbg-4d069948.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
04:06 -!- _julian [~quassel@hmbg-5f761dbb.pool.mediaWays.net] has joined #openvpn
04:06 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 244 seconds]
04:16 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
04:18 <@vpnHelper> RSS Update - forum: Open Vpn And Server 2008 r2 Core <http://forums.openvpn.net/topic9122.html#p17086>
04:30 <@vpnHelper> RSS Update - forum: Open Vpn And Server 2008 r2 Core <http://forums.openvpn.net/topic9122.html#p17087>
04:39 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
05:06 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:06 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:28 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
05:30 -!- sypher [02e57d3d@gateway/web/freenode/ip.2.229.125.61] has joined #openvpn
05:30 < sypher> hi ... 
05:30 < sypher> guys, i have a question. I'm in a situation where i have diff .crt for servers but i don't get / know how to create a client certificate that will connect only to that server. 
05:31 < sypher> there's 3 openvpn servers on a single physical server machine. i've got a common ca.crt and different server.crt files (3 in total). what I'm trying to create is creating a client certificate that can only connect to *that* specific server.crt that i will specify, but i don't get how. can someone help me ? 
05:36 -!- trace29m [~Miranda@a190055.studnetz.uni-leipzig.de] has joined #openvpn
05:37 < trace29m> is it possible to run run openvpn that way that not all of the traffic of the clients run through the server?
05:39 < hyper_ch> trace29m: it is
05:40 < trace29m> when I used openvpn some years ago all of the traffic of the clients went through the server
05:40 < trace29m> might it be, that I did something wrong?
05:40 < hyper_ch> because of the default gateway
05:40 < hyper_ch> !def1
05:40 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
05:41 < trace29m> mhh how to search in google for this topic?
05:41 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p17088>
05:41 < hyper_ch> if you don't use def1, then you no traffic goes over the vpn in general and you have to bind programs to the vpn address
05:42 < sypher> hyper_ch: any help on my side? got any ideas/hints? I'm kinda lost. :( 
05:43 < hyper_ch> sypher: run an own CA on each server
05:43 < hyper_ch> and create an according client cert on that server
05:43 -!- intelcoree [~intelcore@218.242.15.2] has joined #openvpn
05:43 < intelcoree> hi, what is difference between the free openvpn client and access server?
05:44 < hyper_ch> intelcoree: no clue... but access server isn't supported here
05:44 < sypher> hyper_ch: current configuration works for old certificates issued to clients, but new certificats (new clients) built with build-key client can access all servers. 
05:44 < sypher> i dont understand why. basically, i think I'm missing some setting where i specify the build-key command to create a client certificate only for that specific server, not for the root certificate. 
05:44 < hyper_ch> sypher: no clue what you do then
05:44 < sypher> ok thanks anyway ...
05:48 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
06:10 -!- coraxx [~chatzilla@195.215.38.186] has joined #openvpn
06:13 -!- sypher [02e57d3d@gateway/web/freenode/ip.2.229.125.61] has quit [Quit: Page closed]
06:14 -!- trace29m [~Miranda@a190055.studnetz.uni-leipzig.de] has quit [Quit: www.miranda-fusion.de ... be part of it...]
06:19 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 252 seconds]
06:25 -!- EugeneYawn is now known as EugeneKay
06:27 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
06:27 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
06:27 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
06:36 <@vpnHelper> RSS Update - forum: License error: machine properties validation failed: <http://forums.openvpn.net/topic9123.html>
06:40 -!- happylife [~happylife@net-202.nrpn.net] has joined #openvpn
07:00 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
07:00 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Client Quit]
07:00 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
07:01 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 252 seconds]
07:01 -!- intelcoree [~intelcore@218.242.15.2] has quit []
07:02 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
07:03 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has joined #openvpn
07:18 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has joined #openvpn
07:43 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
07:51 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
07:51 < bjorneven> hi guys 
07:52 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
07:52 < bjorneven> simple problem.. a customer has Vista, and openvpn 2.2.1 won't install tap driver
07:52 < bjorneven> error 1450
07:52 < bjorneven> even when run as admin
07:52 -!- raidz_afk is now known as raidz
07:53 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:55 < bjorneven> Updating drivers for tap0901 from C:\Program Files (x86)\OpenVPN\driver\OemWin2…
07:55 < bjorneven> UpdateDriverForPlugAndPlayDevices failed, GetLastError=1450
08:02 -!- raidz is now known as raidz_afk
08:03 < ecrist> bjorneven: openvpn 2.2.1 works fine when installing the tap drivers on windows vista and windows 7 - there's likely a problem with your computer or permissions.
08:07 < bjorneven> it could be norton internet security
08:09 < Optic> moo
08:10 < ecrist> could be, but that's not really our problem. :P
08:12 < bjorneven> of course.. there could be some with similar experience though
08:13 < bjorneven> but what does the error itself mean? some suggested low ram or disk
08:13 < bjorneven> 6GB disk free and 8GB of total ram installed
08:19 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:33 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
08:33 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
08:33 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
08:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
08:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:51 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
08:52 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
08:56 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
09:02 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
09:07 -!- master_of_master [~master_of@p57B52BB9.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:08 -!- master_of_master [~master_of@p57B52636.dip.t-dialin.net] has joined #openvpn
09:11 -!- fapi [~fapi@c-71-229-141-122.hsd1.co.comcast.net] has quit [Quit: Think your current client is sexy? Check out Bersirc 2.2! [ http://www.bersirc.org/ - Open Source IRC ]]
09:12 < havoc> too bad openvpn can bind 2 process to the same local IP :(
09:13 < havoc> would be nice to be able to have a server listening on both udp:1194 and tcp:443, but have clients all on same subnet
09:15 <+s7r> havoc: you can have 2 openvpn process running one on tcp and one on udp
09:15 < havoc> I already do
09:15 <+s7r> and what is the problem?
09:15 < havoc> the issue is getting all the vpn clients on same subnet
09:15 <+s7r> you mean having the same pool 10.8.0.0/24 
09:15 <+s7r> ?
09:16 < havoc> I use DHCP, but yes
09:16 <+s7r> i am not sure if it works, never tried it. but i assume if it doesn't work this way you can create static routes between both subnets?
09:16 < havoc> not possible though as there are two processes
09:16 < havoc> s7r: then that is not the same subnet ;)
09:17 < havoc> that is two subnets, exactly what I have now
09:17 <+s7r> how do you assign addresses to clients?
09:17 < havoc> DHCP
09:17 <+s7r> via DHCP on the network or the same openvpn server acts as DHCP server too?
09:17 < havoc> both, depending on the ovpn server in question
09:18 <+s7r> for the one on tcp 443 for example
09:18 < havoc> anyway, I was saying it would be nice, but it's not possible as mroe than process cannot bind to the same address
09:19 < havoc> more than one process
09:19 <+s7r> correct
09:20 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Computer has gone to sleep]
09:20 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
09:20 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Client Quit]
09:21 < havoc> can a linux bridge have more than 2 interfaces?
09:22 < havoc> nm, blind alley
09:22 < havoc> and bridging TAP/TUN devices has its own drawbacks
09:24 < havoc> could create br0 consistin of tap0 and tap1
09:25 < havoc> downside is that both taps need to be up for bridge device to function
09:25 < hyper_ch> krzee mentioned the other day that each one needs to have the different ip... that you can't use udp and tcp on the same ip for that
09:25 < havoc> hyper_ch: yeah, one proto and poert per process
09:25 < havoc> and only one process can bind() to an address
09:26 < hyper_ch> gee, krzee is a chatter box... still need to find the passage
09:26 < havoc> I'm just wondering if I could bridge the two tun/tap devices and use the br iface for traffic endpoint
09:27 < havoc> not a big deal, just thinking about various configs
09:27 < havoc> also going to be switching everything from tap to tun sometime
09:39 < havoc> I may try that sometime
09:42 -!- sploozer [~sploozer@GERMANICA-T.edge3.NewYork1.Level3.net] has joined #openvpn
09:42 < sploozer> hello...i'm trying to get my openvpn client to connect....connnectivity is there and i'm using certs for auth...but it keeps returnign certificate not yet valid....both systems are synced to NTP
09:42 < sploozer> ideas?
09:44 <+s7r> sploozer: please be more specific
09:46 < sploozer> I'm using two fedora 13 systems both running live cds....let me check the error msg
09:46 < sploozer> maybe its because i'm using a live cd.
09:46 < hyper_ch> !config
09:46 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
09:46 < hyper_ch> !configs
09:46 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
09:46 < hyper_ch> !log
09:46 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:47 < hyper_ch> !logs
09:47 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:50 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
09:50 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
09:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:50 -!- mode/#openvpn [+v Axeman] by ChanServ
09:53 -!- intelcoree [~intelcore@218.242.15.2] has joined #openvpn
09:53 < intelcoree> hey, how do i install openvpn on my wireless router
09:53 < intelcoree> i want a vpn between my router and my server which is in another country on a vps
09:54 < sploozer> ok....on the client end: Verity error: depth=1 error certificate not ye valid....TLS ERROR: BIO read tls _read_plaintext error
09:54 < sploozer> error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate evrify failed
09:54 < sploozer> TLS Error: TLS handshake failed
09:54 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 245 seconds]
09:56 < sploozer> http://pastebin.com/1sgEbcBe
09:56 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
09:56 < sploozer> s7r: ?
09:57 <+s7r> intelcoree: depends on your router model. you should google for that
09:57 <+s7r> see if your router supports it 
09:57 <+s7r> sploozer: i am looking now
09:58 <+s7r> sploozer: could you pastebin your config too please?
09:58 < sploozer> client?
09:59 <+s7r> yes
09:59 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
10:00 -!- Ionic [ionic@ionic.de] has joined #openvpn
10:01 < intelcoree> advantages of installing openvpn on router as opposed to client computers?
10:01 < intelcoree> ddwrt router
10:02 < sploozer> http://pastebin.com/r2q7r0bp
10:02 < sploozer> s7r: http://pastebin.com/r2q7r0bp
10:04 < sploozer> hmm its working now
10:06 < sploozer> weird
10:06 < sploozer> didn't changea  thing
10:08 -!- spditner [~simon@206-248-134-84.dsl.teksavvy.com] has quit [Ping timeout: 260 seconds]
10:08 -!- _julian [~quassel@hmbg-5f761dbb.pool.mediaWays.net] has quit [Ping timeout: 256 seconds]
10:10 -!- _julian [~quassel@hmbg-5f761dbb.pool.mediaWays.net] has joined #openvpn
10:10 -!- sploozer [~sploozer@GERMANICA-T.edge3.NewYork1.Level3.net] has quit [Quit: Leaving]
10:16 -!- _julian [~quassel@hmbg-5f761dbb.pool.mediaWays.net] has quit [Quit: No Ping reply in 180 seconds.]
10:16 -!- _julian [~quassel@hmbg-5f761dbb.pool.mediaWays.net] has joined #openvpn
10:17 -!- Reith [~null@unaffiliated/reith] has joined #openvpn
10:18 < Reith> hi, any solution for TSL handshake blocked in China or Iran?
10:18 < Reith> tls-auth doesn't help
10:24 < Reith> is it possible to choose a TLS handshake except Diffie Hellman?
10:25 <+s7r> Reith: 
10:25 <+s7r> it's port blocked not TLS handshake
10:26 < Reith> s7r: what port? can i change it?
10:26 <+s7r> of course, if you have access to the vpn server :D
10:27 < Reith> s7r: yes. i have. but what you meen from port?! open vpn port? i changed it to 110. it's not problem
10:27 -!- intelcoree [~intelcore@218.242.15.2] has quit [Read error: Connection reset by peer]
10:27 <+s7r> yeah openvpn port should be 443
10:27 <+s7r> TCP
10:27 <+s7r> because they block TLS traffic on non-ssl ports as by default
10:28 <+s7r> at least i think so
10:28 <+s7r> Reith: where are you from?
10:28 < Reith> s7r: thanks. i'll try it
10:28 < Reith> s7r: Iran
10:28 <+s7r> and where is your server located?
10:28 <+s7r> the openvpn server where is it
10:28 -!- intelcoree [~intelcore@218.242.15.2] has joined #openvpn
10:29 -!- spditner [~simon@206-248-134-27.dsl.teksavvy.com] has joined #openvpn
10:29 < jeev> http://www.dslreports.com/shownews/Iran-Joins-Pakistan-Bans-Encryption-VPNs-116806 <- i love how it keeps saying "for the government to spy on" and shit but that's exactly what the U.S. is starting to do.
10:29 <@vpnHelper> Title: Iran Joins Pakistan, Bans Encryption, VPNs - To Help Protect You From the Bogeyman | DSLReports.com, ISP Information (at www.dslreports.com)
10:29 < jeev> The announcement by Iranian Telecommunications Minister Reza Taghipour insists the move is being made to combat a "soft war” being waged by Western countries against Iran (read: make it easier for the Iranian government to spy on its own citizens).
10:30 < jeev> kind of how america's protect against child porn act is made to "combat child porn" but it really isn't.
10:30 < Reith> s7r: UK
10:34 < Reith> s7r: no success with 443 port..
10:34 < Reith> s7r: TLS handshake fails again
10:35 <+s7r> protocol TCP?
10:35 <+s7r> may I ask you one thing- how do you connect to the openvpn server in order to change the ports?
10:36 < Reith> s7r: yes. tcp
10:36 < Reith> s7r: ssh
10:36 <+s7r> port 22?
10:36 < Reith> s7r: shure
10:36 < Reith> s7r: sure*
10:37 <+s7r> in this case, encryption is not blocked
10:37 <+s7r> because SSH uses also Diffie Hellman 
10:37 <+s7r> :D
10:37 <+s7r> try this
10:37 <+s7r> is it a dedicated server?
10:37 <+s7r> the server you have?
10:37 < Reith> s7r: i have vps.
10:37 <+s7r> change the ssh port from 22 to 443 for instance
10:37 <+s7r> and put openvpn to run on port 22
10:37 <+s7r> and see if it works this way
10:38 <+s7r> you connect to the server, via ssh, without VPN correct?
10:38 < Reith> s7r: i don't think it helps.. i changed port to 21 22 even 53.. 
10:38 < Reith> s7r: filtering is NOT on port number
10:38 <+s7r> but on what ?
10:38 -!- coppermine [~inside@unaffiliated/coppermine] has joined #openvpn
10:38 < Reith> s7r: it's on proccessing some patterns in tunnel
10:38 < coppermine> im frustated, cant get open right
10:38 < coppermine> openvpn
10:39 < intelcoree> advantages of installing openvpn on router as opposed to client computers?
10:39 < coppermine> is there a simple howot
10:39 <+s7r> Reith: it's not diffie hellman blocked
10:39 <+s7r> if diffie hellman was filtere you couldn't ssh to your vps in the UK
10:39 <+s7r> what operatin system are you on?
10:39 < coppermine> gentoo
10:39 <+s7r> Reith
10:39 < Reith> s7r: me Gentoo too. :)
10:39 <+s7r> ok
10:40 <+s7r> you have direct Iranian Ip addr?
10:40 <+s7r> and no vpn at this moment correct?
10:40 < Reith> s7r: yes. 
10:40 <+s7r> do you know to establish a ssh tunnel ?
10:40 <+s7r> dynamic port forwarding between you an the vps?
10:40 < Reith> s7r: yes. i'm using that
10:40 <+s7r> and that works?
10:41 < Reith> s7r: yes. but sometimes government blocks handshake
10:41 < Reith> s7r: and then there is a patch for openssh to obfuscate handshake
10:41 <+s7r> Reith: if the ssh tunnel works, then openvpn should work too
10:41 < Reith> s7r: http://nihilex.com/obfuscated-openssh
10:42 <@vpnHelper> Title: Secret Handshake for Iran | ni hi lex (at nihilex.com)
10:42 < Reith> s7r: i want something like that on openvpn :)
10:42 < intelcoree> advantages of installing openvpn on router as opposed to client computers?
10:43 <+s7r> Reith: dude your govt. is fucked up :)
10:43 < Reith> s7r: :)))
10:43 <+s7r> they make such huge investment to filter packages and prevent people from accesing youtube
10:44 <+s7r> i don't think that will help you
10:44 <+s7r> your ISP will throttle your encrypted connection and slow it down to the point you wouldn't want to use it any more
10:44 < intelcoree> what country you in reith
10:44 < Reith> inimino: iran
10:45 < intelcoree> they have internet in iran?
10:45 <+s7r> how is your tunnel working?
10:45 <+s7r> do they slow your tunnel down also?
10:45 < Reith> s7r: port 22 doesn't work either
10:46 < hyper_ch> ISPs who throttle are mean
10:46 < Reith> s7r: ssh tunnel? no. they block handshake often
10:46 < hyper_ch> isn't it illegal in Iran to use encrypted connections?
10:46 <+s7r> i just asked you above about ssh tunnel and you said that you are using it :)
10:46 < Reith> hyper_ch: i'm don't know what is legal in this country ;)
10:46 <+s7r> that is why i told that if ssh tunnel works, it means openvpn will work to ssl/tls is not blocked
10:46 < hyper_ch> http://www.techdirt.com/articles/20111027/00493916534/iran-outlaws-vpns-any-other-attempt-to-get-around-filters.shtml
10:47 <@vpnHelper> Title: Iran Outlaws VPNs Or Any Other Attempt To Get Around Filters | Techdirt (at www.techdirt.com)
10:47 < Reith> s7r: not. right Now it works..
10:47 < Reith> sorry for typos. i'm in hurry 
10:50 <+s7r> i really dont' understand
10:50 <+s7r> does the SSH TUNNEL WORK OR NOT
10:50 <+s7r> at this moment right now
10:50 <+s7r> when we are speaking
10:50 < Reith> s7r: NOW it works :)
10:51 < Reith> s7r: but sometimes they block handshake.. when i say sometimes i mean some special days for Iran history..
10:51 <+s7r> and openvpn should work too
10:52 < Reith> s7r: but handshake fails.. i even used --tls-auth to encrypt TLS handshake.. 
10:52 <+s7r> yes i have googled and saw that isps in Iran use package inspector and they block ALL encrypted connections no matter it's ssh, openvpn or simple https
10:52 <+s7r> yeah because they have a package inspector which notes the data is encrypted
10:52 <+s7r> :D
10:52 < coppermine> Oct 28 11:51:50 desert openvpn[18076]: TLS Error: TLS object -> incoming plaintext read error
10:52 < coppermine> Oct 28 11:51:50 desert openvpn[18076]: TLS Error: TLS handshake failed
10:52 < coppermine> i read the howto
10:52 < coppermine> and did it
10:52 <+s7r> they made terrible efforts to be able to do this
10:52 < coppermine> what cna I check
10:52 <+s7r> don't know if it's worth it
10:52 < Reith> s7r: some years ago yes. but know they have more sophisticated tools...
10:52 < Reith> now*
10:53 <+s7r> Reith: if they catch you with an encrypted vpn, can they do anything to you?
10:53 < coppermine> VERIFY ERROR: depth=0, error=unable to get local issuer certificate:
10:53 < Reith> coppermine: are you  in iran or china?
10:53 < coppermine> canada
10:53 < Reith> s7r: surely then can ! :D
10:54 <+s7r> like what?
10:54 <+s7r> give you a ticket
10:54 <+s7r> some fee penalty to pay
10:55 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
10:55 -!- troyt [~troyt@2001:5c0:1400:b::bb75] has quit [Ping timeout: 244 seconds]
10:55 <+s7r> what you have in iran does not sound like internet at all it sounds more like an intranet
10:55 -!- coppermine [~inside@unaffiliated/coppermine] has quit [Quit: Lost terminal]
10:55 <+s7r> i don't see the use in paying for such a service
10:56 < Reith> s7r: yes. they often call Natitional Internet.. only one intranet
10:56 < hyper_ch> s7r: if Iran can do it, so can your country
10:56 <+s7r> hyper_ch: yes they CAN but they WONT
10:56 < hyper_ch> it's to protect you
10:56 <+s7r> because it's not a dictature it's a democratic country
10:56 <+s7r> yeah :))
10:56 < hyper_ch> - from child pr0n
10:56 <+s7r> protect me from theirselves
10:56 <+s7r> yeah
10:56 < hyper_ch> - from fraudulent websites
10:56 <+s7r> :))
10:57 < hyper_ch> - from illegal music and videos
10:57 < hyper_ch> - from .......
10:57 <+s7r> Reith: are there any websites
10:57 <+s7r> from irna for example
10:57 <+s7r> Iran
10:57 <+s7r> i am courios if I can browse one from my location
10:57 <+s7r> if their websites are opened to the world
10:57 < Reith> s7r: sure! 
10:57 < hyper_ch> s7r: http://www.isna.ir/ISNA/NewsView.aspx?ID=News-1871681&Lang=P
10:57 <@vpnHelper> Title: ISNA - 10-24-2011 - 90/8/2 - سرويس: / جامعه اطلاعاتي -فناوري اطلاعات / شماره خبر: 1871681 (at www.isna.ir)
10:57 <+s7r> do they block ICMP also? I mean can you ping www.yahoo.com ?
10:57 < Reith> s7r: iran has good data centers..
10:58 <+s7r> because you can make ICMP tunnel also
10:58 < hyper_ch> Reith: you speak farsi?
10:58 < Reith> hyper_ch: yes
10:58 <+s7r> ahahhaha
10:58 <+s7r> isna.ir is hosted in the US
10:58 < Reith> s7r: what? ICMP tunnel?
10:58 <+s7r> yeah
10:58 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
10:58 <+s7r> can you ping facebook.com ?
10:58 < hyper_ch> s7r: you sure it's hosted in teh US?
10:59 <+s7r> yes
10:59 <+s7r> check for yourself
10:59 <+s7r> Reith: try to ping  69.171.229.11
10:59 <+s7r> see if it works
10:59 < Reith> s7r: it pings. no problem
10:59 <+s7r> then you can make ICMP tunnel :D
11:00 < hyper_ch> :)
11:00 <+s7r> and they can't throttle i assume they filter only tcp
11:00 < hyper_ch> so UDP open vpn should work?
11:01 < Reith> hyper_ch: for me doesn't works.
11:01 < hyper_ch> :(
11:01 < Reith> s7r: i should read about that. but if it's related to just changing port number, it shouldn't work. ;)
11:02 <+s7r> nope
11:02 <+s7r> do you have another iranian website
11:02 <+s7r> so we can see if all of them are hosted in the US
11:02 <+s7r> :D
11:02 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has quit [Remote host closed the connection]
11:03 < Reith> s7r: leader.ir for example
11:04 <+s7r> yeah this one is hosted in iran
11:07 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 256 seconds]
11:08 -!- disaster37 [3e3e8082@gateway/web/freenode/ip.62.62.128.130] has joined #openvpn
11:08 < disaster37> hi all I have problem with my openvpn site to site
11:08 < disaster37> it crash after 3 ou 4 days
11:09 < disaster37> I can ping site A from site B and in other order
11:09 < disaster37> In log I look that
11:09 < disaster37> http://pastebin.com/cX7rnuBu
11:09 < disaster37> It's strange, the 2 openvpn seems speak together
11:09 < disaster37> have you any idea ?
11:10 < disaster37> If I stop open vpn on site A and i stay one minute
11:10 < disaster37> after I restart openvpn on site A all work fine for 3 ou 4 days
11:12 -!- raidz_afk is now known as raidz
11:18 < disaster37> with iftop -i tun0
11:18 < disaster37> I view tx grown but RX stay at 257B
11:18 -!- Yoe [~wouter@samba.grep.be] has joined #openvpn
11:18 -!- coppermine [~inside@unaffiliated/coppermine] has joined #openvpn
11:18 < Yoe> what's this 'OpenVPN Connect' thing?
11:18 < coppermine> ok i created a tunnel and can ping it, how do i re-route all web traffic tru it on my clients?
11:20 -!- coppermine [~inside@unaffiliated/coppermine] has quit [Client Quit]
11:21 < disaster37> In log I view also http://pastebin.com/QgaD5cnt
11:23 <@vpnHelper> RSS Update - forum: RRAS <http://forums.openvpn.net/topic9113.html#p17090>
11:26 < disaster37> no idea ?
11:26 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
11:27 < Yoe> disaster37: that log entry seems to explain what the issue is. Do you have an actual question?
11:29 -!- jeev is now known as jeev2
11:29 -!- jeev2 is now known as jeev
11:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
11:31 -!- coppermine [~inside@unaffiliated/coppermine] has joined #openvpn
11:31 < coppermine> i added push "redirect-gateway def1"
11:31 < coppermine> push "dhcp-option DNS 8.8.8.8"
11:31 < coppermine> and set 1 to ip_forward
11:31 < coppermine> but traffic is not redirected
11:31 < coppermine> what do i need to do on the client
11:32 < disaster37> Yoe: what my vpn down after few days, and why I must stop deamon few second before restart it to all work fine ?
11:32 < disaster37> not what but why
11:33 < intelcoree> if i install openvpn on a router, will laptops that connect need certificates on each computer or not?
11:33 < Yoe> disaster37: which version are you running? What type of Internet connection do you have?
11:33 < Yoe> intelcoree: nope
11:33 < Yoe> intelcoree: at least not if they connect through the router
11:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:34 < Yoe> coppermine: I don't think openvpn supports 're-routing all web traffic through it on your clients', but could you explain what you're trying to do? Perhaps there's another solution
11:34 -!- coppermine [~inside@unaffiliated/coppermine] has quit [Client Quit]
11:34 < Yoe> well, sod it then
11:35 < disaster37> Yoe: OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 22 2010 on my 2 site with debian squeeze
11:35 < disaster37> The two connecion is adsl
11:36 < Yoe> is that the kind of adsl connection that drops and gives you a different IP address every so often?
11:36 < disaster37> but the adsl on site one is good and adsl on site 2 is good also
11:36 < disaster37> The IP are fix on two site
11:36 < Yoe> so that's not it then. Hrm, weird.
11:36 < Yoe> are you running over TCP or UDP?
11:37 < disaster37> udp
11:37 < disaster37> you should view my openvpn.conf ?
11:38 < Yoe> so when the connection is lost, if you give it a few minutes, does it return or does it stay gone?
11:39 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has quit [Ping timeout: 255 seconds]
11:40 < disaster37> My supervision tools display me that the vpn is broken since 13h
11:40 < disaster37> so when it crash, the vpn never connect against without I stop the deamon
11:41 < disaster37> The tun interface is still here
11:41 < disaster37> In log file I view that vpn send and receive packet
11:41 < disaster37> but with iftop -i tun0
11:41 < disaster37> packet is never received
11:42 < disaster37> and my vpn is setting to use the 8089 port
11:42 < Yoe> you have keepalive set in your config file, right?
11:42 < disaster37> and if you look http://pastebin.com/cX7rnuBu
11:42 < disaster37> It seems use 13572
11:43 < disaster37> it's normal ?
11:43 < disaster37> my openvpn config http://pastebin.com/9tsaSHBT
11:43 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:44 -!- disaster638 [3e23dfb3@gateway/web/freenode/ip.62.35.223.179] has joined #openvpn
11:45 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:45 < disaster37> Yoe: No keepalive on my config
11:46 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
11:47 < Yoe> might want to add that then
11:47 < Yoe> server-side, add a line that says 'keepalive 10 120'
11:47 < Yoe> it will test if the connection is 'up' every 10 seconds, and assume it isn't after 120
11:47 < Yoe> at which point the connection will automatically restart
11:48 < disaster37> I have configured openvpn site-to-site
11:48 < disaster37> so I must put this option on two server ?
11:48 < Yoe> you can add it to both, yes
11:48 < disaster37> I have used ping and ping-restart, it's the same ?
11:48 < Yoe> ah, yes
11:49 < disaster37> you can look my config here http://pastebin.com/9tsaSHBT
11:49 -!- intelcoree [~intelcore@218.242.15.2] has quit []
11:50 < Yoe> what's this 'route 192.1.1.0'
11:50 < Yoe> did you redact your file incorrectly, or does it actually say that?
11:51 -!- coppermine [~inside@modemcable103.174-176-173.mc.videotron.ca] has joined #openvpn
11:51 -!- coppermine [~inside@modemcable103.174-176-173.mc.videotron.ca] has quit [Changing host]
11:51 -!- coppermine [~inside@unaffiliated/coppermine] has joined #openvpn
11:51 < disaster37> route 192.1.1.0 255.255.255.0
11:51 < coppermine> how do i re-route all local traffic via vpn
11:51 < coppermine> using iptables
11:51 < coppermine> i tried the howoto on openvpn.org 
11:51 < disaster37> it's to specify that the site B use the network 192.1.1.0
11:52 < disaster37> coppermine: I think you can use postrouting with iptables
11:52 < coppermine> any howot
11:52 < coppermine> howto
11:52 < coppermine> do i need redirect def1 in server .conf?
11:52 < disaster37> Yoe: it's my actual config
11:53 < Yoe> disaster37: well, my point is that 192.1.x.x is assigned to 'BBN communications'. If that's your ISP, then never mind, otherwise you're doing something wrong
11:54 < disaster37> what is BBN communications ?
11:54 < Yoe> the owner of the netblock you're using
11:54 < Yoe> you probably meant to use 192.168.1.1
11:54 < Yoe> which is assigned for 'local usage'
11:55 < Yoe> 192.1.x.x is *not*
11:55 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
11:55 < disaster37> Ha yes ;)
11:56 < Yoe> if your local networks are *meant* to be accessed from just about anywhere, and you got that network address assigned by the people from BBN, then all is fine. Otherwise, you'll have issues if you try to connect to machines connected by BBN
11:56 < disaster37> but this route is put for only interface tun0
11:56 < Yoe> it's still wrong
11:56 < disaster37> so is not the interface that is plug on internet
11:56 < Yoe> that makes it even more wrong
11:57 < Yoe> you can use anything from 10.0.0.0 to 10.255.255.255, or anything from 172.16.0.0 to 172.31.255.255, or anything from 192.168.0.0 to 192.168.255.255 for any local purpose you want to, but anything else is assigned to other people
11:57 < disaster37> Yes I know local network plage
11:58 < Yoe> and by 'anything' I really mean 'anything'. They assigned the last few netblocks about a year ago
11:58 < disaster37> But when I arrived on company, the local network are already configured like this
11:58 < Yoe> so? complain and get it fixed.
11:59 < Yoe> it's *wrong*.
11:59 < Yoe> more to the point, if you ever accidentally misconfigure something so one of those IP addresses gets sent over the public Internet, you may be facing a lawsuit
12:00 < Yoe> not so with an RFC1918 IP
12:00 -!- happylife [~happylife@net-202.nrpn.net] has quit [Ping timeout: 258 seconds]
12:00 < disaster37> ok thanks
12:01 -!- coppermine [~inside@unaffiliated/coppermine] has quit [Read error: Operation timed out]
12:01 < Yoe> anyway, as to your problem: I think I've exhausted all my ideas now, sorry
12:05 < disaster37> Your are right about the network configuration, the local configuration is bad
12:05 <@vpnHelper> RSS Update - forum: Disconnect issue being analyzed <http://forums.openvpn.net/topic9124.html>
12:05 < disaster37> But i thinks is not the real problem of my openvpn
12:06 < disaster37> my first second route is 192.1.1.0 throuout tun0
12:06 -!- coppermine [~inside@modemcable103.174-176-173.mc.videotron.ca] has joined #openvpn
12:06 -!- coppermine [~inside@modemcable103.174-176-173.mc.videotron.ca] has quit [Changing host]
12:06 -!- coppermine [~inside@unaffiliated/coppermine] has joined #openvpn
12:06 < coppermine> anyone can help me redirect all local traffic tru vpn?
12:06 < coppermine> so that my ip shows as the vpn server ip
12:06 < disaster37> so the packet to 192.1.1.0 is never send on internet
12:06 < disaster37> it just routed on vpn
12:06 < disaster37> correct ?
12:06 < Yoe> coppermine: it might help if you stopped quitting all the time
12:07 < coppermine> when i try commands that dont work
12:07 < coppermine> it bogs the connection down
12:07 < coppermine> so i have to restart it
12:07 < coppermine> and come back
12:07 < Yoe> coppermine: what are you trying to do?
12:07 < coppermine> i just told you
12:07 < Yoe> you misunderstand
12:07 < coppermine> 13:06 < coppermine> anyone can help me redirect all local traffic tru vpn?
12:07 < coppermine> 13:06 < coppermine> so that my ip shows as the vpn server ip
12:07 < coppermine> my vpn tunnel works
12:08 < coppermine> http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
12:08 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:08 < coppermine> thats what i need help me
12:08 < coppermine> with
12:09 < disaster37> have you allow forward on your iptables
12:09 < coppermine> yes
12:09 < coppermine> echo 1 > /proc/sys/net/ipv4/ip_forward
12:09 < disaster37> and have your setting the postrouting rules ?
12:09 < coppermine> no, can u help me wti hthat
12:10 < disaster37> in your iptables script, you never have this iptables -t filter -P FORWARD DROP ?
12:10 < coppermine> i dont have a script
12:10 < coppermine> its not in the howto
12:11 < coppermine> just this line
12:11 < coppermine> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
12:11 < coppermine> the howto is at http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
12:11 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:11 < Yoe> coppermine: it's a howto, not a script that does everything for you.
12:11 < Yoe> coppermine: meaning, you have to actually think about it
12:12 < disaster37> It's seems good
12:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:12 < disaster37> Have you define route on openvpn config files
12:12 < coppermine> server or client
12:13 < disaster37> on your client
12:13 < coppermine> no
12:13 < disaster37> to use your server like gateway
12:13 < disaster37> Ho maybee it's on server conf
12:14 < disaster37> In your push rules your use ip or dns ?
12:14 < coppermine> i dont have push rules
12:16 < disaster37> How you tell your client to use the server VPN like gateway ?
12:16 < disaster37> and not the default gateway of your client
12:17 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:17 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:17 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:17 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has left #openvpn []
12:18 -!- coppermine [~inside@unaffiliated/coppermine] has quit [Read error: Operation timed out]
12:21 -!- intelcoree [~intelcore@218.242.15.2] has joined #openvpn
12:22 < intelcoree> im trying to find out if putting openvpn on router is good idea
12:22 < intelcoree> wont it be slow as routers cpu is slow?
12:22 < Yoe> it might be somewhat slow, yes, but VPNs will always be slower than unencrypted connections
12:22 < Yoe> what kind of router are we talking about?
12:22 < intelcoree> buffalo running ddwrt
12:23 < Yoe> and the other end?
12:23 < intelcoree> im just not sure of what advantages there are to having it on router, would the client laptops no longer need certificates on each laptop?
12:23 < intelcoree> so a guest can visit and use wireless and not need any certificates on his laptop
12:23 < intelcoree> ?
12:23 < intelcoree> other end is vps running centos
12:25 -!- Reith [~null@unaffiliated/reith] has quit [Quit: Killed kvirc with signal 9]
12:25 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
12:26 < disaster37> Thanks for your help
12:26 < disaster37> good evening
12:26 < disaster37> I will go
12:27 -!- disaster37 [3e3e8082@gateway/web/freenode/ip.62.62.128.130] has quit [Quit: Page closed]
12:27 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p17092>
12:27 < jasonmsp> log-append   /var/log/openvpn/openvpn.log    -- any reason why this isn't writing to the log file and it is still writing to the /etc/openvpn/openvpn.log?
12:29 < Yoe> intelcoree: the advantage would be that anyone behind your ddwrt box will be able to access the centos vps without issues, and that anyone who isn't there won't be. The disadvantage will be that anyone behind your ddwrt box will be able to access the centos vps without issues, and that anyone who isn't there wouldn't be
12:29 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has left #openvpn []
12:29 < Yoe> also, there will be performance differences, in that if there's only one VPN tunnel between one site and your VPS, there'll be less overhead and less encryption/decryption for the centos vps
12:30 < Yoe> yet at the same time if the ddwrt has to encrypt everything, it may not be able to keep up, as you've said
12:30 < Yoe> whether that's going to be the case very much depends on the processor in the ddwrt machine, and the amount of network traffic -- impossible to give you any reasonable answer on that one
12:33 < intelcoree> so client laptops wont need openvpn installed or any certificates?
12:33 < intelcoree> i.e they just connect via wireless to router
12:33 < Yoe> nope. But like I said, they won't be able to access the serve from 'elsewhere', then
12:34 < Yoe> that may or may not be what you want
12:34 < intelcoree> isnt this a security risk, wireless networks aren't impossible to hack 
12:34 < Yoe> yes, indeed
12:34 < intelcoree> i mean, i'd need a good wireless password i guess
12:34 < Yoe> that's what I mean with the 'disadvantage' that I said up there
12:35 < intelcoree> i'm not sure then... i have fiber internet i doubt a router has good enough cpu not to bottleneck it
12:36 < intelcoree> normally routers dont even advertise how good the cpu is
12:41 -!- nkoza [~NKoza@190.244.122.9] has joined #openvpn
12:41 < Yoe> if you have dd-wrt, you might be able to get a shell and peek at /proc/cpuinfo
12:42 < nkoza> how do you manage a roaming client that can connect from _any_ subnet, maybe one with the same network address as your HQ net?
12:43 < intelcoree> thanks yoe
12:43 < EugeneKay> Spank it if it tries to connect from the HQ net
12:44 < EugeneKay> I handle that case by firewalling outbound OpenVPN from the LAN behind my vpn server
12:44 < intelcoree> One last question, if i have say 4 laptops connected to the router, will the openvpn server on the vps see it as just one client connected?
12:45 < Yoe> not necessarily
12:45 < Yoe> depends on how you configure it
12:45 < Yoe> oh, hang on, you mean the openvpn server itself, as opposed to the server on the IP level
12:45 < Yoe> yes, there it would mean that
12:46 < intelcoree> i consider the openvpn on the router to be a client
12:46 < intelcoree> not server
12:46 < Yoe> yes, so do I :-P
12:46 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
12:46 < Yoe> what I meant was that on the IP level, the hosts in your local network _could_ be seen as individual hosts that you can ping from the centos vps
12:46 < Yoe> but that would depend on how you configure things
12:47 < intelcoree> ah
12:47 < intelcoree> dont need such a complicated setup
12:47 < Yoe> well, the only alternative is that your router does NAT, which actually is more complicated
12:48 < Yoe> anyway, need to go
12:48 < Yoe> bye
12:48 < intelcoree> thx
12:48 -!- Yoe [~wouter@samba.grep.be] has left #openvpn []
12:51 -!- intelcoree [~intelcore@218.242.15.2] has quit []
12:55 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
12:55 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
12:55 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
13:12 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:12 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:12 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:13 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:20 < hyper_ch> krzee: dazo: https://www.xkcd.com/970/
13:20 <@vpnHelper> Title: xkcd: The Important Field (at www.xkcd.com)
13:20 < hyper_ch> also check the hover
13:22 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
13:56 < hyper_ch> krzee: do I read that right: next generation ARM chips have also crypt functions embedded?  http://www.theregister.co.uk/2011/10/28/arm_holdings_arm_v8/
13:56 <@vpnHelper> Title: ARM specs out first 64-bit RISC chips • The Register (at www.theregister.co.uk)
13:57 < hyper_ch> While ARM v8 processors will be able to encode and decode AES encryption, and will support on-chip acceleration of the SHA-1 and SHA-256 hashing algorithms too.
13:57 <+s7r> hyper_ch: you from Iran?
13:57 < hyper_ch> s7r: no, why?
13:57 <+s7r> ah sorry
13:58 <+s7r> because that guy which i tried to help earlier
13:58 < hyper_ch> sweet... that means full disk encryption could arrive on cell phones
13:58 <+s7r> seamed to think so
13:58 < hyper_ch> ok...
13:58 <+s7r> i wanted to know more about their new policy
13:58 <+s7r> in blocking ALL SSL/TLS traffic
13:58 <+s7r> which seams abusive if you ask me 
13:58 < hyper_ch> no clue
13:59 <+s7r> and I am coruious if there are any ways around it
13:59 < hyper_ch> setup your own internet?
13:59 <+s7r> :))
13:59 <+s7r> how?
13:59 <+s7r> without upstream provider
13:59 < hyper_ch> shoot up a satelitte into orbit
13:59 <+s7r> it's more like they have NO internet all they have is one national intranet
14:02 < krzee> but they do have internet dont they...?
14:03 <+s7r> krzee: sort of...
14:03 < krzee> can you get icmp or DNS out of their firewall?
14:03 < krzee> you could always see how good at scrubbing that they arte
14:03 < krzee> are*
14:03 < krzee> your MTU will be complete crap, but it may work
14:03 <+s7r> only from some target IPs out of the country which are not blacklisted by them
14:04 < krzee> is it a blacklist or a whitelist...?
14:04 < krzee> if its a blacklist, you should always win
14:04 < krzee> (given you have resources)
14:04 <+s7r> not sure.. i wasnt' really intereted in this until earlier some guy joined the channel .. openvpn was not working on tcp/udp any port at all because all encrypted traffic was blocked... using deep package inspection
14:05 <+s7r> seams abusive. 
14:05 <+s7r> encryption is illegal in their country :D
14:05 <+s7r> so, no matter the traffic was openvpn, ssh, ssl, https - it does not work
14:05 <+s7r> :D
14:05 < krzee> well then openvpn wont be his solution
14:05 < krzee> but that doesnt mean theres no way
14:05 < krzee> tunnel in something else
14:05 < krzee> it doesnt need to be some recognized encryption method
14:05 <+s7r> i recommended him to go for icmp tunnel
14:05 < krzee> ive done openvpn over dns
14:06 < krzee> mtu sucked, but it worked
14:06 < krzee> i could browse web
14:06 <+s7r> how can you configure openvpn NOT to be a recognized encryption method, but still to be encrypted?
14:06 < krzee> by tunneling it in something else
14:06 < krzee> all they see is the outter layer
14:07 < krzee> how deep do they inspect icmp?  how deep do they inspect dns?  how deep do they inspect EVERY PROTOCOL
14:07 < krzee> anything can be tunneled over
14:07 <+s7r> deep enough.. apperantly :D
14:07 < krzee> you could tunnel in web POSTS
14:07 < krzee> seriously, ANYTHING
14:07 < krzee> hell you could tunnel over jpg
14:07 <+s7r> it is really the first guy whom i was not able to help to use openvpn and bypass any restrictions or survaillance
14:07 < krzee> it would SUCK, but it could be done
14:07 < krzee> using stego
14:08 < krzee> openvpn may not be able to do it
14:08 < krzee> hell, i know how i could recognize openvpn apart from anything else
14:08 < krzee> figured it out while reading up on how port sharing works
14:08 < krzee> but that doesnt matter
14:09 < krzee> if they trust things outside their country, that trust can be piggy-backed on
14:09 < krzee> will it be easy?  no
14:09 < krzee> will it be possible?  yes
14:09 < krzee> will someone like anonymous do it and give it to the people of that country?  yes in time
14:09 < krzee> :-p
14:10 < krzee> or most likely at least
14:11 < hyper_ch> krzee: seen that arm v8 link?
14:11 <+s7r> from what yo uare saying
14:12 <+s7r> you would be able to tunnel into something different, but still it won't be encrypted
14:12 <+s7r> correct?
14:12 < krzee> s7r, openvpn could be tunneled inside that tunnel as well if it was needed
14:12 < krzee> all that matters is the OUTSIDE of the tunnel
14:12 < krzee> thats all they see
14:12 < krzee> until they program the stripping of the outter tunnel
14:13 < krzee> hyper_ch, a bit, looks cool
14:13 < hyper_ch> aes, sha included... :)
14:13 <+s7r> if I tunnel openvpn into web post for example, will the traffic still be crypted?
14:13 <+s7r> and what disadvantages could i have? lower speed?
14:14 < krzee> s7r, isnt that what the openvpn tunnel does?
14:14 < krzee> anything inside openvpn is encrypted, even if thats then tunneled in something else
14:14 < krzee> yes, DEFINITELY lower speed
14:14 < krzee> mtu will be all fucked up
14:14 < krzee> dns tunneling mtu is like 400 sometimes
14:14 < krzee> but the thing is, it worked
14:14 <+s7r> yeah but it is possible
14:14 <+s7r> yeah that's the point
14:15 <+s7r> what is the tool
14:15 <+s7r> to tunnel openvpn into anything?
14:15 < krzee> lol
14:15 < krzee> whatever tool you make for the anything
14:15 < krzee> iodine exists for DNS
14:15 < krzee> icmptx exists for icmp
14:15 < krzee> nstx also exists for dns, but iodine is far better
14:15 < krzee> yarrick on ircnet #iodine made it
14:16 < krzee> you'll notice i made their routing script ;]
14:17 <+s7r> so, tunnel consists in 2 ends. does iodine has to run on both ends
14:17 <+s7r> or just at client?
14:17 < krzee> go read
14:17 < krzee> thats too silly of a question for me to want to tackle
14:18 < krzee> http://code.kryo.se/iodine/
14:18 <@vpnHelper> Title: kryo.se: iodine (IP-over-DNS, IPv4 over DNS tunnel) (at code.kryo.se)
14:21 < krzee> if it only ran on 1 side youd need some magic to unwrap the tunnel and do something smart with the ip traffic inside
14:21 < krzee> openvpn can run without encryption, would you then only need 1 side running openvpn? ;]
14:26 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17093>
14:29 -!- nkoza [~NKoza@190.244.122.9] has quit [Quit: Client exiting]
14:29 < coraxx> Question: does OpenVPN support different logon priviliges, so that one user get access to more addresses in the IP-range than others ?
14:31 < coraxx> Another question: How does one attach a Virtual OpenVPN-adapter to a bridge made with virtual-netcard adapter inside a virtual machine ...and still get the bridge functionality to work on the local network in linux
14:32 < krzee> coraxx, openvpn supports locking a user into his ip, and your firewall supports the rest
14:33 < krzee> coraxx, why bridge in the first place?  what layer2 proto do you need over the vpn?
14:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
14:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:45 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
14:45 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
15:21 -!- trace29m [~Miranda@a190055.studnetz.uni-leipzig.de] has joined #openvpn
15:22 < trace29m> how do I set !def1 in the config file? with push "redirect-gateway def1" ?
15:24 < trace29m> I want to set 0.0.0.0/1
15:28 < trace29m> I want that not all of the traffic goes through the vpn server
15:28 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
15:28 < krzee> then just set the route
15:28 < krzee> see --route in the manual
15:29 < krzee> !man
15:29 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
15:29 < krzee> you do not have to push, you can just put it in the client config... that is up to you
15:30 < trace29m> what route shall I set?
15:31 < krzee> didnt you just say 0.0.0.0/1?
15:32 < trace29m> I dont know if this is the right route
15:33 < krzee> well i couldnt possibly tell you what route you want unless you can help
15:34 < trace29m> ok ahm .... I have a openvpn server with IP 10.8.0.1 and clients with 10.8.0.* and I want that routes that make that all clients can communicate without that their traffic goes before through the server
15:36 < krzee> !c2c
15:36 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
15:36 <@vpnHelper> clients
15:36 < krzee> dont push any routes
15:36 < krzee> communicate by vpn ip after adding client-to-client
15:36 < krzee> done
15:36 < trace29m> I dont understand "communicate by vpn ip after adding client-to-client"
15:37 < krzee> when you connect to the vpn, it gives you an ip
15:37 < krzee> read what --client-to-client is, then add it to your server
15:37 < trace29m> thanks
15:37 < krzee> ohh wait
15:37 < krzee> without it going through the server?
15:37 < trace29m> yes
15:37 < krzee> openvpn doesnt do that
15:37 < krzee> the packets will go through the server
15:38 < trace29m> :/
15:38 < trace29m> ok thanks
15:38 < krzee> np
15:38 < trace29m> for something like that a free hamachi would be great
15:38 < trace29m> like wippien
15:38 < krzee> i told you how they can communicate over the vpn
15:39 < trace29m> yes
15:39 < krzee> cool, go use that then =]
15:39 < trace29m> no
15:39 < trace29m> Its not good enough
15:39 < trace29m> better openvpn
15:39 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
15:40 < krzee> https://forums.openvpn.net/topic141.html
15:40 <@vpnHelper> Title: OpenVPN Support Forum Idea for direct connections : Wishlist (at forums.openvpn.net)
15:53 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has joined #openvpn
15:55 -!- totorux [~quassel@gar13-2-82-239-234-199.fbx.proxad.net] has joined #openvpn
15:55 < totorux> Hi
15:56 < totorux> I have a  problrem, at my office we have a openvpn server
15:56 < totorux> it was working find
15:56 < totorux> but few days ago
15:56 < totorux> client can't connect
15:57 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
15:59 < reiffert> totorux: check that the certificates are still valid.
15:59 < totorux> They have this error: Fri Oct 28 20:18:24 2011 Attempting to establish TCP connection with XXX.XXX.XXX.XXX:1194
15:59 < totorux> Fri Oct 28 20:18:25 2011 TCP connection established with XXX.XXX.XXX.XXX:1194
15:59 < totorux> Fri Oct 28 20:18:25 2011 TCPv4_CLIENT link local: [undef]
15:59 < totorux> Fri Oct 28 20:18:25 2011 TCPv4_CLIENT link remote: XXX.XXX.XXX.XXX:1194
15:59 < totorux> Fri Oct 28 20:18:32 2011 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=FR/ST=**********/L=**********/O=**********/OU=**********/CN=**********/emailAddress=**********
15:59 < totorux> Fri Oct 28 20:18:32 2011 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
15:59 < totorux> Fri Oct 28 20:18:32 2011 TLS Error: TLS object -> incoming plaintext read error
15:59 -!- totorux was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
15:59 < reiffert> stop pasting nonsense.
15:59 -!- totorux [~quassel@gar13-2-82-239-234-199.fbx.proxad.net] has joined #openvpn
16:00 < totorux> sorry ...
16:00 < totorux> http://pastebin.com/NbjKcdmN
16:00 < totorux> this is a error in client side
16:01 < reiffert> what about server side?
16:01 < reiffert> however
16:01 < reiffert> 22:59 < reiffert> totorux: check that the certificates are still valid.
16:02 < totorux> reiffert: I check he still valid to 2020
16:03 < reiffert> ca, client and server cert?
16:03 < totorux> reiffert: yes
16:04 < reiffert> how do you check the expire date?
16:04 < totorux> reiffert:         Validity             Not Before: Oct 11 09:45:15 2010 GMT             Not After : Oct  8 09:45:15 2020 GMT
16:05 < reiffert> what system date/time is currently set on your server and client?
16:06 < totorux> reiffert: the server one is good, I don't know about the client on but I hope it's good to
16:06 < reiffert> what about other clients. are they able to connect?
16:07 < totorux> reiffert: no all client look to be down in same time
16:07 < reiffert> provide us the server log then.
16:07 < reiffert> and stop wasting your time by replacing numbers by XXX and names by *'s
16:10 < totorux> reiffert: http://pastebin.com/kW2LqRAQ
16:10 < totorux> reiffert: sorry ... but I need to
16:13 < reiffert> use a proper stop/start instead of sending USR1 and increase verbosity level to 4.
16:13 < reiffert> then please reprovide the server logs.
16:14 < reiffert> are these the server or the client logs?
16:14 < krzee> !topsecret
16:14 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
16:15 < reiffert> wssup?
16:15 < krzee> why are you using TCP?
16:15 < krzee> hey reif =]
16:15 < krzee> TCPv4_SERVER  its the server
16:16 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has left #openvpn ["Leaving"]
16:16 < krzee> first one was the client
16:16 < reiffert> krzee: http://www.youtube.com/watch?v=7XIBiDaGZYc
16:16 <@vpnHelper> Title: Was geht ab??? Fat scary movie scene!! - YouTube (at www.youtube.com)
16:16 < totorux> the fist was the client the secon sever
16:16 < reiffert> "was geht ab" == wssup
16:16 < totorux> second
16:17 < krzee> LOL i havnt seen that in hella long
16:17 < krzee> although i saw it in english lol
16:17 < totorux> krzee: I understand and if it wad my own sever it's was I will done, but I'm not sur than my client will be happy to sit some privat information over passtbin
16:17 < krzee> http://www.youtube.com/watch?v=EUEzWvlV348
16:17 <@vpnHelper> Title: Scary Movie Wassup - YouTube (at www.youtube.com)
16:19 < totorux> http://pastebin.com/LKHFNVQz
16:19 < reiffert> krzee: hahaha
16:19 < reiffert> totorux: customers. clients. hahahahaha.
16:20 < totorux> krzee: for the other question, I don't configure this server so I don't know the reason of those choise ...
16:20 < krzee> !tcp
16:20 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
16:20 < reiffert> Fri Oct 28 23:15:15 2011 us=671731 WARNING: This configuration may accept clients which do not present a certificate
16:20 < totorux> reiffert: yes :(
16:20 < reiffert> !configs
16:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
16:20 < krzee> and wtf is up with the version
16:21 < krzee> its 2.1RC
16:21 < krzee> update that man!
16:21 < krzee> reiffert, nice catch, thats no bueno
16:21 < reiffert> krzee: it's the secret customer that doesnt want to find anything about himself on google. so he doesnt use any software (that is able to work)
16:21 < totorux> actualy I just need to set this f***** server work again after to try to make my boss understand than we need to make upgade
16:22 < krzee> oh well they should go pay someone they trust for support
16:22 -!- trace29m [~Miranda@a190055.studnetz.uni-leipzig.de] has left #openvpn ["www.miranda-fusion.de ... be part of it..."]
16:22 < reiffert> totorux: restore your backup then
16:22 -!- dazo is now known as dazo_afk
16:23 < krzee> part of stuff running right is not using old versions with known bugs
16:23 < krzee> so if you want it to run right before you do things right, good luck
16:23 < reiffert> Fri Oct 28 23:15:15 2011 us=663739   auth_user_pass_verify_script = '/etc/openvpn/auth.pl'
16:23 < krzee> ahh password only
16:24 -!- Denyven [~Denyven@123.120.164.247] has joined #openvpn
16:24 < Denyven> Hey Guys
16:24 < krzee> o hai
16:24 < Denyven> I am getting a [NO_DATA] error
16:24 < reiffert> WE DIDNT CHANGE ANYTHING!
16:24 < krzee> oh ya?
16:24 < totorux> reiffert: but I'm not sur it will change anythings, we don't make any change on the server and it was running laste week
16:24 < Denyven> yes
16:24 < Denyven> what should I do?
16:24 < Denyven> I get it when I'm trying to connect
16:24 < krzee> totorux, something changed :-p
16:25 < krzee> maybe not on that machine
16:25 < krzee> but something did change
16:25 < totorux> krzee: I'm agree
16:25 < reiffert> totorux: paste etc/openvpn/auth.pl
16:25 < Denyven>  [NO_DATA] The requested name is valid but does not have an IP address. Thats the full error
16:26 < krzee> Denyven, 
16:26 < krzee> !logs
16:26 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
16:26 -!- Denyven [~Denyven@123.120.164.247] has left #openvpn []
16:26 < krzee> lol ok
16:27 < totorux> reiffert: http://pastebin.com/RBzbjjM3 , I contnue to learn many things about my compagny .... not good :(
16:29  * totorux will start to look for a new job in a more serius company ...
16:29 < reiffert> totorux: bash -x username=foo password=bar /etc/openvpn/auth.pl
16:30 < reiffert> erm. forget about that bash -x thing.
16:30 < reiffert> totorux: why is that, the perl script is looking fine, what made you switch your mind some lines ago>
16:30 < reiffert> ?
16:30 < reiffert> it's missing a sleep 1 after all.
16:31 < totorux> reiffert: because of the no crypted password I just see ...
16:31 < totorux> reiffert: if only it was the fiste time ...
16:32 < reiffert> hehe ;)
16:32 < krzee> isnt storing passwords in the ENV dangerous too?
16:32 < reiffert> krzee: nah.
16:32 < reiffert> krzee: it's the openvpn way.
16:32 < krzee> cleartext?
16:32 < reiffert> krzee: it's the openvpn way.
16:32 < krzee> ok
16:32 < reiffert> totorux is referring to $passdb
16:33 < totorux> so the fist idear it's a certificat problem (and the only) ...
16:33 < reiffert> totorux: 2.1rc7 is *ANCIENT* crap.
16:33 < reiffert> using tcp is a bad idea.
16:33 < reiffert> fix that.
16:33 < krzee> exactly
16:33 < reiffert> it's unusable anyway. just update.
16:34 < reiffert> then have all clients change their protocol from tcp to udp.
16:34 < reiffert> adjust your firewall settings from tcp to udp and you are done.
16:34 < reiffert> it's a matter of 30 seconds.
16:34 < krzee> +1
16:35 < totorux> did something can explaine than it was working one thime few hourse later and then a half a hour after don't work again ? (juste before we have a network cut)
16:35 < reiffert> 31 seconds? krzee belongs to the slow people.
16:36 < krzee> lol
16:36 < totorux> ok thank's for your help ;)
16:36 < reiffert> totorux: isp provider network voodoo bla bla bla
16:36 < krzee> +1 as in i fully agree ;]
16:36 < reiffert> 32s, look he ran into some trouble
16:36 < krzee> haha
16:36 < totorux> reiffert: ok
16:37  * krzee starts --'ing to see if reif is using signed ints or not
16:38 < reiffert> uhuuu, krzee obviously has had contact with extraterrestrical life ... signed and unsigned. what happend krzee?
16:38 < krzee> i hung out in here too long, it was bound to happen
16:41 < reiffert> krzee: 32 + 1 might be -31 btw ;)
16:42 < krzee> ya right what ancient system are you on
16:43 < reiffert> currently it's i5 on 570 hardware
16:43 < krzee> with 4bit?
16:44 < reiffert> krzee: log(32) to base(2) is 5.
16:44 < krzee> ok, with 5bit?
16:44 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
16:44 < reiffert> krzee: as far as someone told me, it's 128bit OS
16:45 < krzee> is there really 128bit hw?
16:45 < totorux> So thank's for helping, I will see tomorrow if it's work
16:46 < reiffert> krzee: I can't tell, it's black metal covered and quite big.
16:46 < krzee> look for the 128bit sticker
16:46 -!- totorux [~quassel@gar13-2-82-239-234-199.fbx.proxad.net] has quit [Read error: Connection reset by peer]
16:46 < reiffert> krzee: ROTFL
16:47 < reiffert> ah well we've been exchanging some pci-x cards while the machine ran just normally
16:48 < reiffert> disk n storage, fibrechannel, caching ones
16:49 < krzee> while it ran normally? you didnt turn it off first?
16:49 < reiffert> jup
16:50 < reiffert> we varied off the devices from the OS and plugged of the cards
16:51 < reiffert> to plug off that is
17:26 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
17:30 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:37 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
17:37 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
17:37 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:37 -!- mode/#openvpn [+v Axeman] by ChanServ
18:02 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Operation timed out]
18:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:14 -!- ]R[ [~Positive@2a01:e35:2ef2:d850:e350:e350:e350:e350] has joined #openvpn
18:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:28 < ]R[> is there any way to specify the path to the config file for openvpngui on windows ? 
18:28 < ]R[> to avoid keeping the config file in C:\Program Files (x86)\OpenVPN\config\ 
18:33 -!- disaster638 [3e23dfb3@gateway/web/freenode/ip.62.35.223.179] has quit [Ping timeout: 265 seconds]
18:33 < EugeneKay> Yes.
18:33 < EugeneKay> H/o a sec, lemem get my laptop.
18:34 -!- Denial [Denial@drgi.co.uk] has quit []
18:34 < EugeneKay> "C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe" --config_dir "C:\Documents and Settings\EugeneKay\.ssh\" --connect khresearch.ovpn --show_balloon 0 --silent_connection 1 --show_script_window 0
18:34 < EugeneKay> Make that the "target" of a shortcut
18:35 < EugeneKay> Fiddle config options to suit
18:36 < ]R[> thanks :)
18:37 < ]R[> i used the convenient right-click option "Start OpenVPN on this config file" for now, but it's using a cmd line windows not openvpngui heh 
18:44 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
18:46 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
18:57 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
19:01 -!- raidz is now known as raidz_afk
19:08 < derekv> the paid version doesn't work in freebsd still, correct?
19:11 < EugeneKay> derekv - #openvpn-as
19:12 < derekv> Thanks forgot.
19:17 -!- _julian_ [~quassel@hmbg-4d06d969.pool.mediaWays.net] has joined #openvpn
19:18 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
19:20 -!- _julian [~quassel@hmbg-5f761dbb.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
19:30 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 244 seconds]
19:34 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has joined #openvpn
19:34 -!- Axeman [~Axeman3@pool-98-113-32-56.nycmny.fios.verizon.net] has quit [Changing host]
19:34 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:34 -!- mode/#openvpn [+v Axeman] by ChanServ
19:51 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
19:52 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
20:00 < derekv> ok so just found out, dudes under me at one gig , somehow snuck a proposal past me , to the owners, to replace the firewall with a f-ing prosafe, and they got confused, and thought i approved it 
20:00 < derekv> this was like 2 weeks ago
20:00 < derekv> and their asking me to write up "what ports are open"
20:00 < derekv> so they can switch it out
20:00 < derekv> they have no fucking clue
20:00 < derekv> sorry for swear
20:01 < derekv> oh my god the more i think about this... what were they planning to do about the proxy...
20:12 < derekv> a prosafe... proposal says its an upgrade
20:13 < derekv> this is about them not having enough balls to log in and use vi
20:17 -!- kyrix [~ashley@chello213047159139.33.11.univie.teleweb.at] has quit [Quit: Ex-Chat]
20:19 -!- daguz1 [~leo@99-12-165-198.lightspeed.rlghnc.sbcglobal.net] has joined #openvpn
20:21 <@vpnHelper> RSS Update - forum: Best practices in storing OpenVPN keys / passwords? <http://forums.openvpn.net/topic9125.html>
20:22 < krzee> derekv, they thought you approved it... fire him and explain the confusion
20:24 < derekv> can't just fire complicated situation.  also i have to figure out just what happened.
20:24 < derekv> talking to them tommorow
20:24 < derekv> i don't think they have done any requirements gathering on the machine they want to replace before then went and decided on what to replace it with
20:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
20:27 <@vpnHelper> RSS Update - forum: Best practice for assigning IP addresses in private tunnels? <http://forums.openvpn.net/topic9126.html>
20:29 < EugeneKay> What the tits is a ProSafe
20:29 < EugeneKay> Ohgod
20:30 < EugeneKay> derekv - poor git
20:32 < derekv> http://www.netgear.com/business/
20:32 <@vpnHelper> Title: Business (at www.netgear.com)
20:32 < derekv> also look at that photo
20:32 < derekv> that thing is huge
20:32 < derekv> no way thats going to fit in the cabinet 
20:32 < EugeneKay> Their switches are decent if all you need is GbE and possibly some port-based VLANing
20:33 < EugeneKay> And the home dsl routers work pretty damn good
20:33 < derekv> i need to get out there and fix all the stuff they've done
20:33 < EugeneKay> But that's where it stops
20:33 < derekv> or i just need ot cut myself loose from the whole thing
20:48 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
20:48 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
20:48 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
20:55 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:23 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
22:00 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:02 -!- corretico [~luis@200.12.40.25] has quit [Ping timeout: 240 seconds]
22:04 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:16 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
22:50 -!- breakdown_ [~face@unaffiliated/prowl] has joined #openvpn
23:06 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:06 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:51 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
23:51 < Xgates> hi guys
23:53 < Xgates> for openvpn, generally speaking, using the various VPN providers you can find across the web, if you're just using OpenVPN from the terminal in Linux, once connected to the VPN, shouldn't you be automatically using the VPNs DNS? Or is this something that the vpn provider has to make sure is being pushed to you in the server conf and set in the client conf in order to work?
23:54 < Xgates> I just assumed when I connected to a vpn service I would have their dns requests automatically through the tunnel and not seeing them from the ISP
23:54 < Xgates> from the/my ISP...
23:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
--- Day changed Sat Oct 29 2011
00:04 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has quit [Quit: ZNC - http://znc.sourceforge.net]
00:04 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Quit: У меня есть более важные дела, чем холостой здесь.]
00:05 -!- Pilif12p [~Tanner@firefox/community/pilif12p] has joined #openvpn
00:09 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Ping Timeout (0 Nano seconds)]
00:13 -!- Pilif12p_ [~Pilif12p@techessentials.org] has joined #openvpn
00:15 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
00:15 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
00:16 -!- Pilif12p [~Tanner@firefox/community/pilif12p] has quit [Quit: Leaving.]
00:17 -!- Pilif12p_ [~Pilif12p@techessentials.org] has quit [Changing host]
00:17 -!- Pilif12p_ [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
00:17 -!- Pilif12p_ is now known as Pilif12p
00:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:31 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
00:32 <@vpnHelper> RSS Update - forum: ipv6 guide please? <http://forums.openvpn.net/topic9127.html>
00:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
00:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:00 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
01:18 -!- raidz_afk is now known as raidz
01:19 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 600 seconds]
01:19 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
01:25 -!- Bushmills [~Bushmills@scarydevilmonastery.net] has left #openvpn []
01:53 -!- raidz is now known as raidz_afk
01:55 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
01:55 < Xgates> hi guys
01:56 < Xgates> Can anyone tell me using Linux when connected through the VPN if this routing table is ok? http://pastebin.com/WZ3Jwk6t
02:00 < reiffert> it is ok.
02:00 < Xgates> someone was telling me I shouldn't have two gateways
02:00 < Xgates> hmm
02:00 < reiffert> ignore him.
02:01 < Xgates> here's what's odd, when I'm connected through my router and connect to the vpn I can ping and go online no problem but when I take the router off line and plug straight into the modem and connect to the vpn I can't ping and go online and I don't get that, how that could be possible
02:03 < Xgates> I figure going through a router should cause more problems for a OpenVPN then straight into the modem...
02:07 < Xgates> oh and going straight through the modem with  no firewall running either
02:08 < Xgates> anyone?
02:09 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
02:11 < reiffert> !goal
02:11 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:12 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
02:13 < Xgates> ok
02:14 < Xgates> I'm trying to use OpenVPN connected straight into my cable modem, but when I'm connected to the VPN I can't ping, I can only ping and get online when I'm connected through my router
02:15 < jasonmsp> # . /etc/openvpn/easy-rsa/2.0/build-key  - i'm getting this message http://pastebin.com/ZREBd0Gp
02:15 < reiffert> using your cable modem directly, will it bring you online without openvpn?
02:15 < Xgates> yes cable modem directly gets my online with my ISP
02:15 < Xgates> my/me...
02:15 < reiffert> prove.
02:16 < Xgates> ok what do you want me to show you?
02:16 < reiffert> !config
02:16 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
02:16 < reiffert> !configs
02:16 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
02:16 < reiffert> !logs
02:16 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
02:18 < Xgates> I'm just a client using a VPN service so just show you the client.conf and where does OpenVPN log to? To tell you the truth I don'
02:18 < Xgates> don't recall seeing any logs for OpenVPN...
02:19 < jasonmsp> any reason why that worked last night but isn't working today for new setups?
02:19 < jasonmsp> and if I run the clean all does it invalidate the old client certficates?
02:20 < jasonmsp> nevermind - you need to run vars first.  
02:21 < jasonmsp> duh
02:21 < reiffert> you need to source vars first.
02:23 < reiffert> running clean-all cleans up all, that is remove all certificates and keys, but it does not expire them.
02:23 < jasonmsp> great.  thanks!
02:26 < Xgates> reiffert: for logging on the client side how would I do this?
02:26 < Xgates> I'm only the client I don't have access to the servers...
02:30 < Xgates> this is the client.conf http://pastebin.com/z0NqR59n I'm using Slackware and running openvpn-2.2.1
02:31 < Xgates> oh my VPN connectivity worked fine on DSL through the modem, this is a new setup with cable...
02:31 < Xgates> the cable modem is the only one that connection won't let me ping through it
02:38 -!- Xgates [~Xgates@unaffiliated/xgates] has left #openvpn ["Ping Timeout (0 Nano seconds)"]
02:54 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has quit [Ping timeout: 248 seconds]
03:04 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
03:06 < jasonmsp> where is the database that keeps a record of the current active openvpn clients?
03:06 < hyper_ch> is there such a database?
03:07 < jasonmsp> Maybe I'm not using the right terms, but how does openvpn know what clients are active and which are not?
03:07 < hyper_ch> does openvpn has to know that?
03:09 < jasonmsp> Maybe not, I'm not sure.  But when a client is revoked with this command - . /etc/openvpn/easy-rsa/2.0/revoke-full client1  what changes in openvpn?
03:09 < hyper_ch> the client's certificate is being rendered invalid
03:10 < hyper_ch> but no clue about the actual mechanisms
03:10 < jasonmsp> yeah so my question is how is it doing that?
03:10 < hyper_ch> it's using magic :)
03:11 < hyper_ch> "sufficiently advanced technology is indistinguishable from magic"
03:11 < jasonmsp> nice
03:13 < jasonmsp> 1 out of 1 certificate requests certified, commit? [y/n]y
03:13 < jasonmsp> Write out database with 1 new entries
03:13 < jasonmsp> Data Base Updated
03:13 < jasonmsp> --- this is the output after building the server key...
03:13 < jasonmsp> ?
03:13 < hyper_ch> seems there is a database :)
03:43 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
03:46 -!- MRH3 [~chatzilla@62.49.242.2] has joined #openvpn
03:48 < MRH3> hi basic question does each client have it's own server ip allocated as well as in client 10.10.10.13 has 10.10.10.14 on the server, client 10.10.10.15 has 10.10.10.16 on the server etc...
03:50 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has quit [Ping timeout: 258 seconds]
03:52 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
03:53 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has left #openvpn []
04:17 < nibalizer> !goal
04:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:09 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has joined #openvpn
05:22 < jasonmsp> anyone have a logrotate script for openvpn?
05:33 -!- jasonmsp [~jason1@unaffiliated/jasonmsp] has left #openvpn []
05:35 -!- MRH3 [~chatzilla@62.49.242.2] has quit [Quit: ChatZilla 0.9.87 [SeaMonkey 2.4.1/20110928161145]]
05:51 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
06:02 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit [Ping timeout: 244 seconds]
06:14 -!- iamamoron [~Miranda@210.238.181.187] has joined #openvpn
06:15 < iamamoron> any ideas on what port and protocol to use in order for my road runner clients could still go through vpn without issues on ISP or remote filrewall rules?
06:16 < iamamoron> running it on TCP would really suffer the latency and a lot of time outs
06:20 < zalzice> i guess most ISP has port open on 80 and 443 if you dont want to mess with the firewall
06:23 -!- iamamoron [~Miranda@210.238.181.187] has quit [Read error: Connection reset by peer]
06:45 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
06:45 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
06:45 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
07:06 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:11 -!- userman [17133525@gateway/web/freenode/ip.23.19.53.37] has joined #openvpn
07:17 -!- userman [17133525@gateway/web/freenode/ip.23.19.53.37] has quit [Quit: Page closed]
07:19 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:32 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
07:35 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:35 -!- mode/#openvpn [+v s7r] by ChanServ
07:53 -!- raidz_afk is now known as raidz
08:03 -!- raidz is now known as raidz_afk
08:20 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
08:42 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
08:46 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:52  * ecrist uses syslog and newsyslog
08:57 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 258 seconds]
09:05 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:07 -!- master_of_master [~master_of@p57B52636.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
09:09 -!- master_of_master [~master_of@p57B55529.dip.t-dialin.net] has joined #openvpn
09:15 < hyper_ch> ecrist: what's newsyslog?
09:16 < krzee> rotates logs
09:17 < hyper_ch> doesn't logrotate do that?
09:26 <@vpnHelper> RSS Update - forum: problem with bridge + dchp from router <http://forums.openvpn.net/topic9128.html>
10:13 -!- raidz_afk is now known as raidz
10:15 -!- raidz is now known as raidz_afk
10:28 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
10:59 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
11:17 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:17 -!- mode/#openvpn [+v s7r] by ChanServ
11:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
11:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:35 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Computer has gone to sleep]
11:35 -!- robott [~robott@58.34.137.22] has joined #openvpn
11:35 < robott> hey
11:35 < robott> i have a question
11:36 < robott> i have just got a fiber connection it is 40mb down speed but is capped at 512kb upspeed. Would i get horrible performance using openvpn over this connection?
11:36 < robott> i mean, would the vpn be terribly slow even for download? my openvpn server would be on vps in another country
11:37 -!- Gud [~erik@78.70.22.214] has joined #openvpn
11:38 < Gud> !welcome
11:38 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:43 -!- breakdown_ [~face@unaffiliated/prowl] has quit [Quit: leaving]
11:46 -!- cyrtpkrd [~redbox@deadline.el8.ru] has joined #openvpn
11:48 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
11:49 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
12:04 -!- cyrtpkrd [~redbox@deadline.el8.ru] has quit [Read error: Connection timed out]
12:04 -!- cyrtpkrd [~redbox@deadline.el8.ru] has joined #openvpn
12:29 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
12:29 -!- ravel [~ravel_out@175.136.82.14] has joined #openvpn
12:35 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
12:52 -!- iana_ [~ripe@sign.io] has joined #openvpn
13:05 -!- kalken [~default@c83-254-101-75.bredband.comhem.se] has joined #openvpn
13:08 < kalken> hello. Does anyone know how i can run a command to update current route everytime something happens with a vpnconnection, that requires the tap-interface to be resetup?
13:08 < kalken> i'm trying with route-up now, but it seems only to be working when openvpn starts the first time
13:08 < kalken> and the ip-change does not seem to know what current "route" was set to
13:09 < kalken> wan is dhcp...
13:16 < krzee> !script
13:16 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
13:17 < krzee> a) "everytime something happens" means nothing
13:17 < krzee> b) whats a "route" and how is it different than a route?
13:17 < krzee> c) why would a script know about routes unless you make it do so?
13:17 < krzee> there is no d) ;]
13:20 < kalken> question was prettys simple actually. i need to run a script everytime tap-interface is setup after first initialisation (this is done by openvpn). i just need to know what parameter to use that knows about current gateway for the dhcp-connection to openvpn-server
13:21 < kalken> -route-up works, but its not run, everytime tap-interface is reinitialized by openvpn.
13:21 < kalken> and --ipchange does not know about route (according to the logs)
13:22 < kalken> e.g the route that openvpn gets through dhcp-server
13:22 < kalken> which actually is current gateway for tap-interface...
13:35 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
13:38 -!- robott [~robott@58.34.137.22] has quit [Ping timeout: 240 seconds]
13:38 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
13:39 -!- robott [~robott@58.34.137.22] has joined #openvpn
13:43 -!- iana_ [~ripe@sign.io] has quit [Quit: leaving]
13:57 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
13:58 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
13:59 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Client Quit]
14:01 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p17098>
14:03 -!- jhp [~jhp@zeus.jhprins.org] has joined #openvpn
14:03 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 258 seconds]
14:04 < jhp> Hi everyone. In my office network I have native IPv6 and I have an OpenVPN server running in TAP mode to connect to the office. On this OpenVPN tunnel, I also receive the router advertisements from the router, this way my client receives and IPv6 address and this works fine. 
14:04 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
14:05 < jhp> But when I try to reach a system on the office lan that is on IPv6 I can't reach it because, as far as I have found out till now, the neighbourhoud messages don't pass through the tunnel.
14:05 < jhp> I'm currently using OpenVPN 2.1. 
14:06 < ecrist> jhp: try 2.2.1, which is current
14:06 < ecrist> full IPv6 support isn't in the code yet, but tap (bridged) mode should work, since it operates at layer 2
14:06 < jhp> Should that one potentially fix it?
14:06 < jhp> ecrist: But that is also the note for version 2.1.
14:06 <@vpnHelper> RSS Update - forum: SVC_RUN_EXCEPT-cannot start server <http://forums.openvpn.net/topic8696.html#p17099>
14:07 < derekv> looks like probably they will install the prosafe and I will probably resign, which is probably for the best (for me, not for them)
14:08 < ecrist> jhp: not sure, but I know our policy is to only support the latest version. ;)
14:14 < ecrist> hyper_ch: man newsyslog on any unix box
14:15 < hyper_ch> ecrist: I don't have any unix box
14:21 < ecrist> google
14:25 < hyper_ch> google banned me :)
14:26  * ecrist thinks #openvpn will follow suit
14:27 -!- winbox [winbox@h168n5-mael-a12.ias.bredband.telia.com] has joined #openvpn
14:31 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 258 seconds]
14:31 -!- robott [~robott@58.34.137.22] has quit [Ping timeout: 245 seconds]
14:32 -!- robott [~robott@58.34.137.22] has joined #openvpn
14:33 < winbox> Why does my PC still use my regular IP even though I'm connected and got assigned a new IP?
14:33 -!- robott [~robott@58.34.137.22] has quit [Client Quit]
14:33 -!- aaaaa [~robott@58.34.137.22] has joined #openvpn
14:33 < ecrist> winbox: what are you talking about?
14:35 < jhp> ecrist: Tried. 2.2.1, but that doesn't fix it.
14:35 < jhp> But good to have a new version installed.
14:36 < ecrist> jhp: at this point, then, I'd suggest packet captures to see if you can figure out where the traffic is being dropped.
14:36 < ecrist> once you have that, and you've ruled out firewalls and the like, talk to the developers channel (evidence in-hand) or the developer mailing list
14:37 < winbox> ecrist: Why am I still seeing my regular IP when OpenVPN GUI tells me I'm connected?
14:37 < ecrist> winbox: where are you seeing your regular IP?
14:37 < winbox> ecrist: My own whois here for example.
14:38 < ecrist> openvpn isn't going to replace your IP address.
14:38 < winbox> ecrist: Or whatismyipaddress.com
14:38 < ecrist> and, unless your vpn server is redirecting ALL traffic, it's not going to show as different to the web at large.
14:39 < winbox> ecrist: I'm using OpenVPN to connect to my VPN provider.
14:39 < winbox> ecrist: But it does redirect all traffic.
14:40 < ecrist> winbox: your evidence suggests it doesn't
14:40 < ecrist> and if you're using a third-party provider, you'll have to talk to them, we cannot help you
14:41 < winbox> ecrist: I've just transfered to Windows from Mac OS X and it's the same OpenVPN provider I use.
14:41 < winbox> ecrist: I've never had this problem before.
14:41 < ecrist> talk to them, not us
14:43 -!- winbox [winbox@h168n5-mael-a12.ias.bredband.telia.com] has quit []
14:47 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
15:09 -!- ravel [~ravel_out@175.136.82.14] has quit []
15:12 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:21 -!- pablo [~pablo@freeshell.de] has joined #openvpn
15:21 < pablo> hi, does openvpn uses blocking or non blocking sockets for tcp connections?
15:24 < pablo> or both? which one by default?
15:34 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
15:40 -!- Pilif12p is now known as Pilif12phone
15:59 -!- MrWGW [MrWGW@74.124.192.8] has quit [Ping timeout: 260 seconds]
16:00 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
16:01 -!- Pilif12phone is now known as Pilif12p
16:12 -!- Kateon [482392@xs8.xs4all.nl] has quit [Ping timeout: 240 seconds]
16:14 <@vpnHelper> RSS Update - forum: Reverse VPN tunnel? <http://forums.openvpn.net/topic9114.html#p17100>
16:16 -!- cherwin [1776628@xs8.xs4all.nl] has quit [Ping timeout: 260 seconds]
16:18 -!- cherwin [1776628@xs8.xs4all.nl] has joined #openvpn
16:18 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
16:22 -!- dym [~patrick@unaffiliated/dym] has joined #openvpn
16:23 < dym> Hey - im having trouble establishing a VPN connection to a server. Unfortunately the logfiles dont seem to show any errors. How else could I debug the connection.
16:23 < krzie> !logs
16:23 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
16:24 < dym> ah sweet - didnt even see that verbose section
16:31 < dym> http://script.quakenet.org/paste/580413 <-- Here is the logs
16:34 -!- corretico_ [~luis@200.12.40.25] has quit [Ping timeout: 240 seconds]
16:35 -!- h8r [~niko@pppoe-132-148.ssi.bg] has joined #openvpn
16:35 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
17:20 <@vpnHelper> RSS Update - forum: Disconnect issue being analyzed <http://forums.openvpn.net/topic9124.html#p17101>
17:26 <@vpnHelper> RSS Update - forum: Best practice for assigning IP addresses in private tunnels? <http://forums.openvpn.net/topic9126.html#p17103> || Reverse VPN tunnel? <http://forums.openvpn.net/topic9114.html#p17102>
17:32 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17105> || Best practices in storing OpenVPN keys / passwords? <http://forums.openvpn.net/topic9125.html#p17104>
17:44 -!- aaaaa [~robott@58.34.137.22] has quit [Ping timeout: 265 seconds]
17:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
17:50 < krzie> dym, looks like a general network issue
17:50 < krzie> is 93.196.203.157 that client's ip?
17:50 < krzie> are you using verb 5?
17:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:56 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p17106>
18:02 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
18:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:09 -!- robott [~robott@58.34.137.22] has joined #openvpn
18:16 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
18:16 < Xgates> hi guys
18:17 < Xgates> with OpenVPN if I'm connected with my modem through a router I can get online without any problems, but if I just plug straight into the modem I can ping and do traceroutes just fine, but when I try to get online with Firefox it just sits there and won't go anywhere
18:18 < Xgates> I just spent 15 mins making logs to show OpenVPN in with the router and without if anyone can please help? I don't get why it doesn't go online straight into the modem
18:23 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
18:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:24 -!- raidz_afk is now known as raidz
18:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:30 -!- robott [~robott@58.34.137.22] has quit [Ping timeout: 265 seconds]
18:31 -!- robott [~robott@58.34.137.22] has joined #openvpn
18:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:50 -!- raidz is now known as raidz_afk
19:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:12 -!- aaaaa [~robott@58.34.143.32] has joined #openvpn
19:13 -!- robott [~robott@58.34.137.22] has quit [Ping timeout: 265 seconds]
19:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:16 -!- _julian [~quassel@hmbg-4d06fd13.pool.mediaWays.net] has joined #openvpn
19:19 -!- _julian_ [~quassel@hmbg-4d06d969.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
19:28 < pablo> hi, does openvpn uses blocking or non blocking sockets for tcp connections?
19:31 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Ping Timeout (0 Nano seconds)]
20:03 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
20:03 < Xgates> hi guys
20:04 < Xgates> sorry if anyone sees me bouncing back and forth, been testing out the vpn through my router, then straight into the modem and straight into the modem I can't get online, but it pings and traceroutes ok, plugged into the router it goes online ok
20:04 < Xgates> I have logs and my conf, anyone have any clue as to why I can't get online plugged straight into a modem, when I can going through a router?
20:18 -!- raidz_afk is now known as raidz
20:28 -!- _julian_ [~quassel@hmbg-5f764952.pool.mediaWays.net] has joined #openvpn
20:31 -!- _julian [~quassel@hmbg-4d06fd13.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
20:32 -!- aaaaa [~robott@58.34.143.32] has quit [Ping timeout: 265 seconds]
20:39 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Ping Timeout (0 Nano seconds)]
20:55 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Quit: leaving]
21:00 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:05 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
21:25 -!- ResQue [~ResQue@87-194-65-130.bethere.co.uk] has joined #openvpn
21:26 < ResQue> how can i installed a TUN/TAP driver so i can use OpenVPN
21:26 < ResQue> i get the error message "Cannot allocate TUN/TAP dev dynamically"
21:27 -!- raidz is now known as raidz_afk
21:29 < ResQue> i have tried "modprobe tun" the command runs but returns nothing 
21:29 < ResQue> then lsmod lists no tun modules loaded
21:47 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
21:47 < Xgates> hi guys 
21:50 < oc80z> openvpn --mktun --dev tun
21:50 < oc80z> try that, eh.
21:51 < Xgates> you talking to me oc80z ?
21:55 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:55 < ResQue> oc80z: i tried this i get the same error "Cannot allocate TUN/TAP dev dynamically"
21:55 < ResQue> any ideas how i can install uninstall this module
21:57 -!- ResQue [~ResQue@87-194-65-130.bethere.co.uk] has quit [Quit: Lost terminal]
22:04 < oc80z> oh, no.
22:05 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Ping timeout: 276 seconds]
22:07 -!- JoeGazz84 is now known as JoeGazz|Meeting
22:07 -!- ResQue [~ResQue@87-194-65-130.bethere.co.uk] has joined #openvpn
22:08 -!- Pilif12p is now known as Pilif12p|meeting
22:08 < ResQue> any ideas on how to fix this issue "Cannot allocate TUN/TAP dev dynamically"
22:08 -!- JoeGazz|Meeting is now known as JG|Meeting
22:08 < EugeneKay> Not a clue.
22:08 < EugeneKay> Remind me your OS?
22:09 -!- robott [~robott@58.34.143.32] has joined #openvpn
22:09 < ResQue> ubuntu
22:10  * EugeneKay runs screaming 
22:10 < ResQue> haha thanks anyway
22:10 < EugeneKay> Sorry to be so uselss :-p
22:10 < ResQue> i think the issue is the tun kernel module, but i have no idea how to uninstall/reinstall it
22:11 < EugeneKay> Sounds right. Tried forcibly unloading the kernel module?
22:11 < ResQue> its not loaded is the problem
22:11 < ResQue> lsmod show no tun module
22:11 < ResQue> how can i install it
22:12 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Read error: Connection reset by peer]
22:13 < EugeneKay> Good question. Guessing you need to apt-get something
22:13 -!- Denial [Denial@drgi.co.uk] has quit []
22:29 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
22:29 < Xgates> hi guys
22:30 < Xgates> does OpenVPN have to work behind a router for a client work to work properly and get online?
22:30 < EugeneKay> Nope.
22:31 < Xgates> My problem; connected through router gets me online ok, no router and plugged straight into the modem with no firewalls running, I can only do pings and traceroutes, tcpdump shows I'm connecting out and netcat shows port 80 open, but Firefox just sits and never loads a site
22:31 < ResQue> anyone have any advice on install tun drivers/models on ubuntu i can not seem to load the tun kernel module
22:31 < EugeneKay> Something other than OpenVPN is configured wrong.
22:32 < Xgates> what's there to configure when it works behind a router and  not into a modem? I don't get that....
22:32 < EugeneKay> Does your regular internet stuff work?
22:32 < EugeneKay> OpenVPN is not a magical internet box
22:32 < Xgates> By the way this happens in Slackware and Arch with two different VPN companies
22:32 -!- robott [~robott@58.34.143.32] has quit [Ping timeout: 265 seconds]
22:33 < Xgates> yes regular internet fine
22:34 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
22:34 < Xgates> let me ask this, what is the router going to do that makes this work?
22:35 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:35 < Xgates> it's a simple 4 port router it doesn't have any VPN pass through
22:35 < EugeneKay> You mention companies. Are you using the pay-for OpenVPN AS?
22:35 < Xgates> yeah VPN providers like Comodo, Xerobanks, Relakks, IPredator, etc...
22:36 < EugeneKay> We don't speak Access Server here, sorry. You're after #openvpn-as
22:36 < Xgates> ahhh so that's how we call it when using a vpn service ok
22:36 < Xgates> thanks
22:37 < Xgates> I thought this channel was for any and all OpenVPN chat?
22:38 < EugeneKay> The open source stuff, yes.
22:38 < Xgates> open source as in?
22:38 < EugeneKay> The open source openvpn client / server
22:38 < Xgates> well I'm using the open source openvpn client
22:39 -!- JG|Meeting [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
22:39 < Xgates> I compiled openvpn-2.2.1.tar.gz in Slackware
22:40 < Xgates> I have the config, logs and route logs of all this if it help to see
22:41 < EugeneKay> Sure, I'll take a look
22:41 < Xgates> a lot of people have looked at it, but no one can makes heads or tails out of it, everyone seems to be lost 
22:41 < Xgates> OK THANKS EugeneKay 
22:41 -!- robott [~robott@58.34.143.32] has joined #openvpn
22:41 < Xgates> one sec
22:46 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
22:47 < Xgates> EugeneKay: ok here we go;
22:47 < Xgates> config file; http://pastebin.com/NyjJpSHr
22:47 < Xgates> tcpdump on the modem; http://pastebin.com/9gPzV1aK
22:48 < Xgates> openvpn log through modem; http://pastebin.com/0w0N8tvn
22:48 -!- ResQue [~ResQue@87-194-65-130.bethere.co.uk] has quit [Ping timeout: 260 seconds]
22:48 < Xgates> openvpn log through router; http://pastebin.com/L6QJ8jDX
22:49 < Xgates> 'route' 'ip route' 'netcat'; http://pastebin.com/DEkKXeni
22:49 < Xgates> that's it :)
22:50 < EugeneKay> Stupid question. YOu're using route-method exe.... on a linux box?
22:50 -!- ResQue [~ResQue@m5.mullvad.net] has joined #openvpn
22:50 < Xgates> yeah didn't think about that one, that's what the VPN provider gave me...
22:50 < EugeneKay> Looks like it worked, though
22:50 < Xgates> wasn't sure if was causing a problem
22:53 < EugeneKay> LOOKS right. And you say iptables filter/nat tables are empty in both cases?
22:54 < Xgates> through the router I had iptables running, through the modem I shut if off
22:57 -!- tessier [~treed@kernel-panic/copilotco] has quit [Ping timeout: 255 seconds]
22:57  * EugeneKay thunks
22:57 < Xgates> yeah crazy hun
22:57 < Xgates> LOL
22:57 < Xgates> huh...
22:58 < Xgates> doesn't make sense it shouldn't work into the modem
23:01 -!- robott [~robott@58.34.143.32] has quit [Ping timeout: 265 seconds]
23:09 < Xgates> EugeneKay: here's the other problem, when going over the VPN websites are slower to make the connection to meaning, Firefox is sitting there saying 'Connecting' long then with my ISP IP, through the VPN on average it takes 8 secs to connect instead of 2-3 with the ISP
23:09 < Xgates> so not sure why the lag in waiting for getting the connection to the site...
23:09 < EugeneKay> Because it's going halfway around the globe and back :-p
23:09 < Xgates> after this 8 seconds then I arrive at the website and it loads gthe page
23:10 < EugeneKay> Handshakes take a lot longer
23:10 < EugeneKay> That's just how browsing-via-VPN works
23:10 < Xgates> sorry, didn't finish I had this VPN running through DSL at another ISP and it never did this, now I switched to a Cable company and it does it on this one and it's also a faster pipe too
23:11 < EugeneKay> ISPs suck
23:11 < Xgates> same VPN different ISP
23:11 < Xgates> stupid thing is, the other one was a 7mb line and it connected faster, this one is a 10mb line and it connects slower
23:12 < EugeneKay> Throughput has little to do with latency
23:12 < Xgates> yeah true
23:12 < EugeneKay> Every bit of latency difference gets multiplied 4-5x 
23:12 < Xgates> so looking over my pastebin, no reason why I shouldn't be getting online directly through the modem?
23:13 < EugeneKay> None that pops out at me
23:13 < EugeneKay> Other than "it hates you"
23:13 < Xgates> I wonder if this ISP doesn't really support VPN very well and using the router helps to by pass something to improve it
23:13 < EugeneKay> Feel free to wait on a second set of eyes, though
23:13 < Xgates> well, what could the router be doing to help this situation?
23:16 < Xgates> http://blogtiderising.wordpress.com/2007/08/18/why-vpn-doesnt-work-on-all-broadband/
23:19 -!- ResQue [~ResQue@m5.mullvad.net] has quit [Ping timeout: 256 seconds]
23:20 -!- ResQue [~ResQue@m4.mullvad.net] has joined #openvpn
23:25 < Xgates> brb going to try some things
23:25 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
23:25 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
23:25 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
23:25 < Xgates> thanks again EugeneKay 
23:26 < EugeneKay> Glad I could be totally useless? 
23:26  * EugeneKay shrugs
23:26 < EugeneKay> Wish ya luck, though
23:27 -!- ResQue [~ResQue@m4.mullvad.net] has quit [Ping timeout: 244 seconds]
23:29 -!- ResQue [~ResQue@m4.mullvad.net] has joined #openvpn
23:30 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Ping timeout: 240 seconds]
23:33 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
23:34 -!- ResQue [~ResQue@m4.mullvad.net] has quit [Ping timeout: 245 seconds]
23:35 -!- raidz_afk is now known as raidz
23:37 -!- ResQue [~ResQue@87-194-65-130.bethere.co.uk] has joined #openvpn
23:49 -!- robott [~robott@58.34.143.32] has joined #openvpn
23:56 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
23:56 -!- ResQue [~ResQue@87-194-65-130.bethere.co.uk] has quit [Ping timeout: 240 seconds]
23:57 -!- ResQue [~ResQue@m2.mullvad.net] has joined #openvpn
--- Day changed Sun Oct 30 2011
00:08 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
00:09 -!- ResQue [~ResQue@m2.mullvad.net] has quit [Ping timeout: 240 seconds]
00:11 -!- ResQue [~ResQue@94.46.240.199] has joined #openvpn
00:13 -!- robott [~robott@58.34.143.32] has quit [Ping timeout: 265 seconds]
00:16  * EugeneKay crawls under his rock
00:17 -!- ResQue [~ResQue@94.46.240.199] has quit [Ping timeout: 240 seconds]
00:31 -!- ResQue_ [~ResQue@87-194-65-130.bethere.co.uk] has joined #openvpn
00:31 < ResQue_> how can i stop openVPN from adding a defaukt route to the kernal routeing table
00:32 < ResQue_> i only want to pass dns info through the vpn, not all network data
00:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
00:46 -!- dataudiophile [~dataudiop@cpe-173-175-22-217.hot.res.rr.com] has joined #openvpn
00:49 -!- dataudiophile [~dataudiop@cpe-173-175-22-217.hot.res.rr.com] has left #openvpn ["Leaving"]
00:56 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
00:58 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
01:00 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:00 -!- Pilif12p|meeting is now known as Pilif12p
01:15 < ResQue_> could someone please show me an example of using the --up argument to call a .sh file or an echo command
01:16 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
01:36 <@vpnHelper> RSS Update - forum: OpenVPN Clients Automation <http://forums.openvpn.net/topic9129.html>
02:08 -!- novaflash [~novaflash@openvpn/user/novaflash] has quit [Ping timeout: 240 seconds]
02:09 -!- ResQue_ [~ResQue@87-194-65-130.bethere.co.uk] has quit [Quit: leaving]
02:10 -!- MrWGW [MrWGW@74.124.192.8] has quit [Ping timeout: 276 seconds]
02:11 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
02:13 -!- caemir is now known as petitpadawan
02:15 -!- petitpadawan is now known as caemir
02:15 -!- novaflash is now known as novaflash_away
02:24 <@vpnHelper> RSS Update - forum: problem with bridge + dchp from router <http://forums.openvpn.net/topic9128.html#p17108>
02:24 -!- novaflash_away is now known as novaflash
02:30 <@vpnHelper> RSS Update - forum: ipv6 guide please? <http://forums.openvpn.net/topic9127.html#p17109>
02:31 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
02:49 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
04:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
04:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:39 -!- pablo [~pablo@freeshell.de] has quit [Read error: Operation timed out]
04:41 -!- pablo [~pablo@freeshell.de] has joined #openvpn
04:43 -!- robott [~robott@58.34.143.32] has joined #openvpn
04:47 -!- robott [~robott@58.34.143.32] has quit [Ping timeout: 265 seconds]
04:49 -!- robott [~robott@58.34.143.32] has joined #openvpn
05:05 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:05 -!- mode/#openvpn [+v s7r] by ChanServ
05:09 -!- Laocoon [b221b801@gateway/web/freenode/ip.178.33.184.1] has joined #openvpn
05:09 < Laocoon> !welcome
05:09 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:10 < Laocoon> !route
05:10 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
05:14 -!- coraxx [~chatzilla@195.215.38.186] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928224103]]
05:24 -!- Laocoon [b221b801@gateway/web/freenode/ip.178.33.184.1] has quit []
05:36 < robott> is this connection good enough for using a vpn? The other end is a vps in a nearby country... i'm concerned about the upload speed
05:36 < robott> http://www.speedtest.net/result/1563376967.png
05:40 -!- raidz is now known as raidz_afk
05:40 <+s7r> robott: thats more than you need :)
05:40 <+s7r> do the test with a server on that site which is closes to where the vpn server will be
05:40 <+s7r> for accurate results
05:46 < robott> ok
05:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:01 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 265 seconds]
06:27 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
06:28 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
06:30 -!- mete [~mete@mete.shell.la] has quit [Read error: Operation timed out]
06:31 -!- mete [~mete@mete.shell.la] has joined #openvpn
06:33 -!- Laocoon [b221b801@gateway/web/freenode/ip.178.33.184.1] has joined #openvpn
06:34 < Laocoon> !weblcom
06:34 < Laocoon> !welcome
06:34 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:34 < Laocoon> !route
06:34 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
06:35 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
06:36 < Laocoon> !topology
06:36 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
06:42 < Laocoon> Hello there! I'm connecting my home network (192.168.42.0/24) to an external server through a VPN (192.168.43.0/24). The external server is the VPN server, my DD-WRT gateway being the openvpn client. I can ping the remote server on its VPN IP from the gateway, but I can't ping it from the LAN except if I add a specific route to the LAN computer. I understand that 192.168.x.Y are not routable subnets, but I'd suspect that the LAN comp
06:43 < Laocoon> If someone can help me, I'd me really grateful!
06:43 < Laocoon> *be*
06:46 < Laocoon> Anyone?
06:47 -!- Laocoon [b221b801@gateway/web/freenode/ip.178.33.184.1] has left #openvpn ["reconnecting"]
06:48 -!- Laocoon [~Laocoon@1-184-33-178.dsl.ovh.net] has joined #openvpn
06:49 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
07:40 -!- fread2281 [~fread2281@70-56-128-31.albq.qwest.net] has joined #openvpn
07:40 -!- LumberCartel [~LumberCar@96.53.47.42] has joined #openvpn
07:45 < LumberCartel> A special thanks to the developers and supports of OpenVPN...
07:45 < LumberCartel> It's working very well for me, and many of my clients.
07:45 < LumberCartel> Thanks folks!
07:47 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Quit: leaving]
07:55 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 256 seconds]
07:56 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
07:58 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
08:00 -!- LumberCartel [~LumberCar@96.53.47.42] has quit [Quit: RFCs the easy way -- http://www.openrfc.org/]
08:07 -!- mete [~mete@mete.shell.la] has joined #openvpn
08:11 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17110>
08:30 -!- Laocoon [~Laocoon@1-184-33-178.dsl.ovh.net] has quit [Quit: Laocoon]
08:33 -!- scandic [581c04b7@gateway/web/freenode/ip.88.28.4.183] has joined #openvpn
08:33 < scandic> hey *
08:36 < scandic> Someone here already managed to get a tap config running on centos 6? I do get a working connection and IP/netmask but I can't ping any other systems on the network
08:43 < reiffert> !howto
08:43 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:44 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:51 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
08:56 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 240 seconds]
08:57 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
09:02 < robott> how cruical is upload speed to vpn performance?
09:03 < robott> because say i'm using a vpn to browse internet, wont my speeds be greatly limited by poor upload from my home?
09:03 < robott> other end is vps
09:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
09:08 -!- master_of_master [~master_of@p57B55529.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:09 -!- master_of_master [~master_of@p57B52BA8.dip.t-dialin.net] has joined #openvpn
09:25 <+s7r> robott: 
09:25 <+s7r> depends on the vpn server and its internet connection
09:25 <+s7r> usually, vps are semi-dedicated servers meaning you should have at least 10mbps speed...
09:25 < h8r> hello, any tutorials how to forward port to VPN client?
09:25 <+s7r> h8r:be more specific
09:26 <+s7r> robott: it also depends how many vpn users you put on that vps :)
09:26 < h8r> s7r, server is on debian, client is on xp, vpn is working okay, i just need public port to the client 10.8.0.2
09:27 <+s7r> ok
09:28 <+s7r> the debian server has only one public IP?
09:28 < h8r> yes
09:28 < h8r> here are my rules http://pastebin.com/beMzy69W
09:29 < h8r> s7r, vpn is working okay, client has internet.. 
09:31 <+s7r> h8r: i understand
09:31 <+s7r> i think you should used direct IP and not interface e..g venet9
09:31 <+s7r> try this rule
09:31 <+s7r> iptables -t nat -A PREROUTING -s 188.241.115.211 -j DNAT --to 10.8.0.2
09:31 <+s7r> and see if it works
09:31 <+s7r> sorry please add also --dport
09:32 <+s7r> as that will forward all ports 
09:32 < h8r> only this rule
09:32 < h8r> or change my 3 rules without -i venet0
09:32 <+s7r> last 3 rules just comment them or delkete them temporary
09:33 < h8r> okay
09:33 <+s7r> and see if it works only with this
09:33 < h8r> and use that rule
09:33 < h8r> okay i'll test right now
09:33 <+s7r> for me it is working on ubutnu 10.10 .. that rule
09:33 <+s7r> but i am on dedicated 
09:33 <+s7r> i assume you are on vps / or some virtual since you have venet
09:33 <+s7r> it should work for you too anyways
09:33 < h8r> openvz has not masqurade module and from there starts the problems i think :D
09:33 < h8r> wait a sec i'll test, then i'll owe you a beer :)
09:34 <+s7r> yes exactly. its becasue of the openvz 
09:35 <+s7r> and it's better not to use interafaces name, but fixed IPs
09:35 < h8r> s7r, iptables v1.4.8: unknown option `--dport'
09:36 <+s7r> how come?
09:36 <+s7r> i saw you had a rule with --dport
09:37 < h8r> maybe not on the right place, let me paste you  iptables -t nat -A PREROUTING -s 188.241.115.211 --dport 1604 -j DNAT --to 10.8.0.2
09:37 <+s7r> iptables -t nat -a PREROUTING -s 188.241.115.211 -m tcp -p tcp --dport 1604 -j DNAT --to 10.8.0.2
09:38 < h8r> now doesn't complain about nothing. let me test if packets redirect okay.. what about udp ? same line again ?
09:38 <+s7r> exactly
09:38 <+s7r> -m udp -p udp
09:38 <+s7r> rest the same
09:38 <+s7r> i assume you configured the vpn server to assign 10.8.0.2 to that specific client always, right?
09:39 <+s7r> so the port will be forwarded to the right client
09:39 < h8r> s7r, yes, i did
09:39 < h8r> how to test that tcpdump -i venet0 'port 1604' ?
09:40 <+s7r> scan the VPS ip on port 1604
09:40 <+s7r> and see if it shows open
09:40 <+s7r> connect the client first
09:40 <+s7r> and run the app which will be listening on port 1604
09:40 < h8r> 1604/tcp filtered unknown
09:42 <+s7r> ?
09:42 < h8r> i got this while scanning from remote ip
09:42 <+s7r> let me 
09:42 <+s7r> is the app running and listening on that port
09:42 <+s7r> and the client is connected to the vps?
09:43 < h8r> client is connected to vps, has internet, app is running on that port.. a client is trying to connect to that port ( i can see it with tcpdump )
09:44 <+s7r> 188.241.115.211 isn't responding on port 1604 (icabrowser).
09:44 <+s7r> did you iptables-save
09:44 <+s7r> and iptables restart?
09:45 < h8r> i've just iptables-save
09:45 < h8r> maybe better reboot ?
09:45 <+s7r> no just iptables restart
09:45 <+s7r> but disconnect and re-connect from the vpn
09:45 < h8r> Bad argument `restart'
09:45 <+s7r> come on how can restart be a bad argument
09:46 <+s7r> where did you get the vps from?
09:46 <+s7r> intovps/
09:46 < h8r> nope ;) zhangLtd
09:46 < h8r> s7r, http://zhangltd.net/
09:46 <@vpnHelper> Title: Cheap Anonymous Offshore VPS (at zhangltd.net)
09:47 <+s7r> I know
09:47 <+s7r> but that is from intovps :)
09:47 <+s7r> and ip location is in Romania /CLUJ
09:47 <+s7r> anyways, try a restart and let's see if it works
09:47 < h8r> yep, maybe they are resellers
09:47 < h8r> okay :)
09:47 < h8r> reboot is my fav 
09:48 <+s7r> yes they are resellers
09:48 <+s7r> how much are you paying?
09:51 < h8r> s7r, 10euros/month
09:51 < h8r> i got is for testing. I 've wanted to learn how to setup vpn
09:52 < h8r> s7r, i've just rebooted.. nmap-ed from outside, still port is filtered, unknown
09:52 <+s7r> hmm
09:52 <+s7r> sure the app is running on the client
09:52 <+s7r> and the client has ip 10.8.0.2?
09:52 < h8r> yep
09:52 < h8r> i'm gonna nmap frmo vpn server, w8 a min
09:53 <+s7r> remove line 3 in your iptables
09:53 <+s7r> iptables -a FORWARD -j REJECT
09:53 <+s7r> remove this line permanently
09:53 < h8r> 1604/tcp open  unknown
09:53 < h8r> okay
09:54 <+s7r> and then save iptables and restart service iptables too
09:54 < h8r> do you want to check the output of iptables-save
09:54 < h8r> not sure i'm flushing and reconfiguring iptables while chaingin stuff
09:55 <+s7r> if you restart iptables it will flush all previous rules
09:55 <+s7r> and loat the iptables rules again as per how they were saved last time 
09:56 < h8r> i got the rules in chmoded +x script_file
09:57 < h8r> i execute it, then iptables-save and then reboot. is it right? 
09:57 <+s7r> yes. reboot more than enoguh you should just restart iptables
09:57 <+s7r> after you reboot check iptables file and see if all rules are as per you put them last time
10:03 < h8r> s7r, no luck :S
10:04 <+s7r> beats me than :-s
10:04 <+s7r> that is the rule for forwarding port
10:06 < hyper_ch> iptables rules don't last for reboots
10:07 < h8r> this is my current file with iptables rules: http://pastebin.com/Wmn0r7mp
10:07 < h8r> i execute it each time i boot, before that i flush tables with another script
10:07 < hyper_ch> why not putting flush and the rules into one .sh file?
10:09 < h8r> same thing... :S
10:10 < hyper_ch> my port forwaring looks like this:  http://pastebin.com/5M8KQHyu
10:11 < hyper_ch> and you need to have ipforward enabled on debian
10:11 <+s7r> he cannot use interfaces name as he is on vps
10:12 < hyper_ch> sucks to be on a vps
10:12 < hyper_ch> for € 15.-- + VAT you can already get a root server
10:12 <+s7r> from where?
10:13 <+s7r> what provider
10:13 < hyper_ch> OVh - the kimsufi servers
10:13 < hyper_ch> http://www.kimsufi.com
10:13 <@vpnHelper> Title: Kimsufi - votre gamme de serveurs dédiés à partir de 14.99 Euros/mois ! (at www.kimsufi.com)
10:13 < h8r> cat /proc/sys/net/ipv4/ip_forward 
10:13 < h8r> 1
10:13 < hyper_ch> I use one of those machines as my OpenVPN server
10:14 < hyper_ch> not that powerful, but for various tasks well suited
10:14 < h8r> hyper_ch,  nice link
10:14 < hyper_ch> here's the english site http://www.kimsufi.ie/
10:14 <@vpnHelper> Title: Kimsufi - your range of dedicated servers from €14.99 p/m! (at www.kimsufi.ie)
10:15 < h8r> 1tb hdd? 
10:15 <+s7r> wow
10:15 < h8r> wow :)
10:15 <+s7r> with windows so cheap
10:15 <+s7r> and also native ipv6 uh
10:15 < hyper_ch> why would you want a windows server???
10:15 < h8r> i would ask the same
10:15 < h8r> :D
10:15 < h8r> too much trouble
10:15 < hyper_ch> I don believe in ipv6
10:16 < hyper_ch> too bad the cpu is an atom
10:17 <+s7r> why dont you belive in ipv6
10:17 < hyper_ch> same reason I don't believe in 720p or 1080i/p
10:17 < hyper_ch> I see no benefit
10:17 <+s7r> eliminating nat does not seam a benefit
10:17 <+s7r> ?
10:17 <+s7r> :D
10:18 < hyper_ch> makes you way too trackable
10:18 <+s7r> it makes you as trackable as ipv4 does
10:18 < hyper_ch> it makes you more trackable
10:18 <+s7r> what you think you won't be able to make vpn on ipv6?
10:19 < hyper_ch> does openvpn even support ipv6?
10:20 <+s7r> there are some patches, yes, but it will be fully supported in the next major release
10:21 < hyper_ch> with a nat - you can only track to the router
10:21 < hyper_ch> if you are in different networks all the time, you can't be tracked easily
10:21 <+s7r> yes, a server with ipv6 connection can act as a router also
10:21 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 244 seconds]
10:21 <+s7r> it won't do nat because it's not necessary
10:22 <+s7r> and everything will work better without nat, nat is not something so constructive and so good
10:22 < h8r> i hate iptables :)
10:22 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
10:23 <+s7r> h8r: still no progress?
10:23 <+s7r> try with the configuration from hyper_ch 
10:23 < hyper_ch> I'm even as paranoid as to run a tor exit node on my server also... so that my traffic is mixed with other
10:24 < hyper_ch> and I need to fully encrypt my cellphone
10:24 < hyper_ch> and get openvpn to run on it
10:26 < h8r> does PREROUTING rules  must be before POSTROUTING or not a prob
10:27 < hyper_ch> I have no clue about iptables... I just was given that code in that order so I do run that in that order
10:30 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
10:30 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
10:30 < h8r> wow, now reports open! it goes with hyper_ch 's config
10:31 < hyper_ch> I know I rock
10:31 < hyper_ch> :)
10:31 < h8r> hell yeah :)
10:31 < h8r> s7r rocks too
10:31 < h8r> thanks.. let me step further :) now if the client-server connects.. i will go to eat something eah :D
10:32 <+s7r> 188.241.115.211 is responding on port 1604 (icabrowser)
10:32 < h8r> hell yeahh!
10:32 < hyper_ch> enjoy
10:33 <+s7r> it was important 
10:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
10:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:50 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
10:52 < hyper_ch> krzee: ping
10:56 < zalzice> Hi, I have been trying to figuring out how I can assign public ip addressen to clients via openvpn. I can manage to find any tutorial about that, but i found a book (OpenVPN 2 cookbook) that came very close for what i attend to do. But i cant manage to make it work. Here is my config http://pastebin.com/b02MpizA
10:56 < zalzice> I can't manage*
10:56 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:57 < zalzice> I will be very thankful if somebody could help me out
10:58 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
11:00 -!- BlakHawk [blackhawk@exploits.dotslash.ca] has quit [Quit: Lost terminal]
11:02 <+s7r> zalzice: you have a /24 assigned to your server?
11:03 < zalzice> yes
11:04 < zalzice> or, I have free public ip 200-254
11:04 < hyper_ch> you have 55 public ips? :)
11:04 < zalzice> yepp
11:04 < zalzice> its on university
11:04 < EugeneKay> You need to have the IP block routed to your server
11:05 < EugeneKay> It's no different than any other IP block you use in OpenVPN, really
11:05 < hyper_ch> EugeneKay: you assume he knows how to do it with any other ip block
11:05 < EugeneKay> You'll want to use subnet topology
11:06 < EugeneKay> hyper_ch - I answer the question at hand, then use the following questions to determine how much effort is gonna be required in teaching the student :-p
11:06 < hyper_ch> could you start with adam and eve?
11:06 -!- pablo [~pablo@freeshell.de] has left #openvpn []
11:06 < EugeneKay> "Don't eat the apple you stupid bint"
11:07 < zalzice> lol, well, the thing is that i just set the static ip and then route it to default gw xxx.xxx.xxx.1
11:07 < EugeneKay> Set what static IP? :-p
11:09 < zalzice> the public ip?
11:09 < zalzice> ;P
11:10 < EugeneKay> I think I need a better description of your IP setup before I can tell you much more
11:10 < zalzice> ok, i will try to explain how i normaly do it
11:11 < hyper_ch> that sounds like you should draw a sketch and upload it to imgurl
11:12 < zalzice> when i setup a server, i just assign a public ip to the server. for instance 199.166.131.100 and set default gw 199.166.131.1. And that goes for other servers too (199.166.131.101 netmask 255.255.25.0 gw 199.166.131.1)
11:13 < zalzice> and now i want to setup openvpn in a pool between 220-225 for openvpn clients
11:13 < hyper_ch> sketch/handdrawn image/....
11:13 < zalzice> ok
11:14 < hyper_ch> visualization is great for getting ideas and messages accross :)
11:17 < EugeneKay> Ok, so all these IPs are currently being setup "on" the server in question
11:18 < EugeneKay> In order for you to hand out IPs from this block successfully to clients you need to have them routed TO the server
11:18 < zalzice> http://imgur.com/1StuU
11:18 <@vpnHelper> Title: imgur: the simple image sharer (at imgur.com)
11:19 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 240 seconds]
11:19 < zalzice> i hope the picture help to visulize what im attending to do
11:19 < hyper_ch> zalzice: nice :)
11:19 < hyper_ch> but routing stuff is out of my league... I hope EugeneKay may be able to help
11:20 < zalzice> thanks
11:20 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
11:20 < EugeneKay> Yeah, that won't work, all using the same /24 like that
11:20 < EugeneKay> You'll need to speak to your sysadmin to get a smaller block of it routed
11:20 < zalzice> oh
11:20 < EugeneKay> Say, a /26 or /27
11:21 <+s7r> can't he just cut a /26 from that /24 ?
11:21 < EugeneKay> Sure. But it has to be routed from the upstream router
11:22 < zalzice> so i cant route it with the openvpn server?
11:22 < EugeneKay> Nyet.
11:22 < zalzice> damn
11:23 < zalzice> well, thanks for looking in to it :-)
11:23 <+s7r> EugeneKay: so if I have a /24, I can;t route samller block e .g. /26 without my isp / sysadmin approval?
11:24 < EugeneKay> If you're expected to being ARPing the /24, nope.
11:24 < EugeneKay> If the /24 is routed TO you, then it's no issue
11:24 <+s7r> how does the router know if it's me using that /24 or another
11:25 < EugeneKay> They don't. The way it's done in datacenters is port-based VLANs
11:25 < EugeneKay> In which case anybody on the far end of that wire is trusted to be in the named IP block
11:25 <+s7r> let's say the /24 is being shared with all my neighbours, from the same router. can't i just use my neighbours Ip and get him into a blackhole?
11:25 < krzee> hyper_ch, pong
11:26 < EugeneKay> You could, yes. 
11:26 < EugeneKay> ISPs with setups like /that/ also have MAC address watching, and will end up blackholing you if you try
11:26 < EugeneKay> But it's dead easy to spoof a MAC
11:26 <+s7r> yeah thats why i was asking. 
11:27 < krzee> however, they can recognize the mac spoofing as well
11:27 < hyper_ch> krzee: you can edit the opvenvpn wiki, right?
11:27 < EugeneKay> Sure.
11:27 < krzee> hyper_ch, yes, as can you
11:27 < hyper_ch> krzee: wikis are too complicated for me
11:27 <+s7r> and i dont udnerstand why that person can't take 10 IP from the /24 block and do whatever he wnats with them e.g. routing with openvpn
11:27 < krzee> liar
11:27 < hyper_ch> krzee: but thinking of the issue h8r had before, I thought it would be nice to add some iptable rules that shows how to route a port to a client
11:27 < krzee> hyper_ch, they are in the manual
11:27 < EugeneKay> Because if he does, somebody from the ISP will hunt them down with a foam cluebat
11:28 < hyper_ch> krzee: I'm even happy that I am able to turn on/off my computer
11:28 < hyper_ch> krzee: where?
11:29 <+s7r> so it's possible but not recommended :)
11:29 < krzee> hyper_ch, under "Firewall Setup:"
11:29 < krzee> weird place for it, right? :-p
11:29 < krzee> http://www.openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAY
11:29 <@vpnHelper> Title: OpenVPN 2.1 (at www.openvpn.net)
11:30 < krzee> OpenVPN's usage of a single UDP port makes it fairly firewall-friendly. You should add an entry to your firewall rules to allow incoming OpenVPN packets. On Linux 2.4+: 
11:30 < krzee> iptables -A INPUT -p udp -s 1.2.3.4 --dport 1194 -j ACCEPT 
11:30 < krzee>  This will allow incoming packets on UDP port 1194 (OpenVPN's default UDP port) from an OpenVPN peer at 1.2.3.4.
11:30 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 255 seconds]
11:30 < krzee> If you are using HMAC-based packet authentication (the default in any of OpenVPN's secure modes), having the firewall filter on source address can be considered optional, since HMAC packet authentication is a much more secure method of verifying the authenticity of a packet source. In that case: 
11:30 < krzee> iptables -A INPUT -p udp --dport 1194 -j ACCEPT 
11:30 < krzee>  would be adequate and would not render the host inflexible with respect to its peer having a dynamic IP address.
11:30 < krzee> hyper_ch, manual > wiki
11:31 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
11:31 < hyper_ch> krzee: I'm using that here  http://pastebin.com/5M8KQHyu
11:31 < krzee> hyper_ch, thats wonderful :-p
11:31 < krzee> but why the hell would you try to keep-state on udp
11:32 < hyper_ch> krzee: I found that somewhere
11:32 < hyper_ch> krzee: and it works :)
11:32 < krzee> especially if you use hmac
11:32 < krzee> do you understand how udp works hyper_ch?
11:32 < hyper_ch> krzee: as said, I have a simple brain
11:32 < hyper_ch> improvement is always welcomed
11:33 < krzee> udp is stateless, any attempt to keep-state on udp is a hack
11:33 < krzee> just using tls-auth is better
11:33  * hyper_ch is waiting for improved iptable rules
11:34 < krzee> i told you the problem, if you cant figure out how to delete those lines im sorry bout your luck
11:34 < hyper_ch> I just thought an example on how to portforward to a client would be nice in the wiki
11:34 < krzee> then add it
11:34 < hyper_ch> [17:32] <hyper_ch> krzee: as said, I have a simple brain
11:34 < krzee> i look like your bitch or something?
11:34 < hyper_ch> and you think the rules need improvement
11:34 < krzee> i also told you how/why they need improvement
11:34 <+s7r> =))))
11:35 < zalzice> lol :-)
11:36 <+s7r> zalzice: so, bottom line contact your sysadmin and ask to route a /26 TO YOU
11:36 <+s7r> then route that /26 on the openvpn server like you would the default 10.8.0.0/24
11:36 < krzee> (or he could do a bitnat hack)
11:36 < krzee> uglier, but would still work
11:36 < zalzice> yepp, but i dont think they going to do so, since this is just project
11:37 < zalzice> will try though
11:37 <+s7r> then how do you want to do it zalzice? what if another server in your university would want to use an IP address which you assign to an openvpn client
11:37 < krzee> what i mean by that is he could still use 10.8.0.0/24, give static ips to clients, and then setup a 1:1 nat for each client to have its own inet routable IP
11:37 < krzee> (talking bout zalzice)
11:37 < hyper_ch> krzee: you told me what's not good... but as you noticed, my knowledge on iptables is very limited, so even knowing what's not good doesn't make me able to improve it
11:38 < krzee> 1:1 nat aka bi-directional nat
11:38 <+s7r> :))))
11:38 <+s7r> you are so evil krzee
11:38 <+s7r> :D
11:38 < krzee> hyper_ch, if the issue is using keep-state on udp traffic, the fix would be NOT keeping state on udp, wtf dude
11:39 <+s7r> and you can NOT keep state on udp by removing --state syntax
11:39 <+s7r> by editing your iptables file with vi / nano or whatever and then saving and then restarting iptables
11:39 < zalzice> s7r: then i have problem. But its only 5-10 student that is using that /24 so i hope the best that no one using the 220-225
11:39 < krzee> hyper_ch, and telling me you cant edit a wiki when i know you code websites is a big -- for you
11:40 < hyper_ch> wikis are way more complicated than simple websites :)
11:40 <+s7r> zalzice: internet is more technic-like... you can't act on hopes and presumptions
11:40 < zalzice> krzee: sounds like something i would do
11:40 -!- fread228_ [~fread2281@70-56-211-25.albq.qwest.net] has joined #openvpn
11:40 <+s7r> what if somebody tries to use an IP
11:40 <+s7r> it could couse problems
11:40 <+s7r> best is to talk with sysadmin and get a /26 route it as it should, and do the work right
11:42 < zalzice> ok, i just hope they say yes
11:42 -!- fread2281 [~fread2281@70-56-128-31.albq.qwest.net] has quit [Ping timeout: 260 seconds]
11:44 <+s7r> EugeneKay: in an environment with port-based VLANs like in datacenter, what if I have a dedicated server with static assigned IP and for example 217.50.10.32 and I replace it with 217.50.10.33 
11:44 <+s7r> will this steal the IP from the server near me or so ?
11:44 < EugeneKay> .33 would be in your IP block :-p
11:45 <+s7r> so?
11:45 < EugeneKay> If you try to assign an IP from another IP block(one that isn't being listened to on your wire), the upstream router will just not care.
11:45 < EugeneKay> If you try to "steal" from another machine on your own wire, well, that's your problem.
11:46 -!- fread228_ [~fread2281@70-56-211-25.albq.qwest.net] has quit [Ping timeout: 240 seconds]
11:49 -!- fread2281 [~fread2281@70-56-129-63.albq.qwest.net] has joined #openvpn
11:54 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17111>
12:08 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 256 seconds]
12:09 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
12:21 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
12:21 -!- novaflash [~novaflash@openvpn/user/novaflash] has joined #openvpn
12:24 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
12:26 -!- Laocoon [~Laocoon@1-184-33-178.dsl.ovh.net] has joined #openvpn
12:46 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:55 -!- raidz_afk is now known as raidz
12:55 < hyper_ch> krphop: dazo_afk:  http://www.wired.co.uk/news/archive/2011-10/29/rossi-success
12:55 <@vpnHelper> Title: Success for Andrea Rossis E-Cat cold fusion system, but mysteries remain (Wired UK) (at www.wired.co.uk)
12:58 -!- Laocoon [~Laocoon@1-184-33-178.dsl.ovh.net] has quit [Quit: Enjoy life: hug a hedgedog!]
13:04 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:05 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:12 -!- newl [~newl@97.75.165.156] has joined #openvpn
13:15 -!- aaaaa [~robott@124.78.181.100] has joined #openvpn
13:15 -!- aaaaa [~robott@124.78.181.100] has quit [Client Quit]
13:15 -!- robott [~robott@58.34.143.32] has quit [Ping timeout: 265 seconds]
13:17 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
13:48 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:53 <@vpnHelper> RSS Update - forum: config Server.ovpn and Client.ovpn to access blocked site <http://forums.openvpn.net/topic9131.html>
13:57 -!- raidz is now known as raidz_afk
14:16 -!- robott [~robott@124.78.181.100] has joined #openvpn
14:34 -!- raidz_afk is now known as raidz
14:34 <@vpnHelper> RSS Update - forum: config server.ovpn and client.ovpn to access blocked site <http://forums.openvpn.net/topic9132.html>
14:40 -!- raidz is now known as raidz_afk
14:40 <@vpnHelper> RSS Update - forum: Has my OpenVPN connection been hacked? <http://forums.openvpn.net/topic9133.html>
14:41 -!- raidz_afk is now known as raidz
14:45 -!- raidz is now known as raidz_afk
15:40 -!- kalken [~default@c83-254-101-75.bredband.comhem.se] has quit [Ping timeout: 260 seconds]
15:53 <@vpnHelper> RSS Update - forum: config Server.ovpn and Client.ovpn to access blocked site <http://forums.openvpn.net/topic9131.html#p17115>
15:54 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 244 seconds]
16:00 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
16:01 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
16:08 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
16:23 <@vpnHelper> RSS Update - forum: config Server.ovpn and Client.ovpn to access blocked site <http://forums.openvpn.net/topic9131.html#p17116>
16:24 -!- deever [~deever@78.46.68.172] has joined #openvpn
16:24 < deever> hi
16:25 < deever> anyone here using debian and configuring openvpn start/stop via /etc/network/interfaces?
16:27 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
16:27 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
16:29 < hyper_ch> deever: no, I use debian init script
16:35 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17117>
16:47 <@vpnHelper> RSS Update - forum: Has my OpenVPN connection been hacked? <http://forums.openvpn.net/topic9133.html#p17118>
16:52 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:58 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
16:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
17:24 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
17:25 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Read error: Operation timed out]
17:32 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
17:40 -!- scandic [581c04b7@gateway/web/freenode/ip.88.28.4.183] has quit [Ping timeout: 265 seconds]
17:45 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Quit: Ex-Chat]
17:55 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 260 seconds]
17:58 < robott> is this cpu Atheros AR7240 rev 1.2 CPU (400MHz) enough to run openvpn without bottleneck?
17:58 < robott> have 30mb connection
17:58 < robott> 400MHz seems preety weak
18:00 <@vpnHelper> RSS Update - forum: help! no connection when connected. <http://forums.openvpn.net/topic9134.html>
18:13 -!- tbruff13 [~tbruff13@173.217.154.252] has joined #openvpn
18:13 < tbruff13> can someone help me please
18:14 < tbruff13> I need to figure out how to use cyberghost with network manager i can use it with kvnpc but there is no gateway for me to use it with network manager
18:15 < tbruff13> hello
18:19 < EugeneKay> !nm
18:19 < EugeneKay> !networkmanager
18:19 < EugeneKay> !netman
18:19 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
18:20 < Pilif12p> hi
18:20 < Pilif12p> where are logs put on a client?
18:21 < Pilif12p> oh, don't use the network manager you say?
18:21 < krzie> at least get everything running without it
18:22 < krzie> then if you wanna import your config, and know that anything that got broken is netmanager's fault, go ahead
18:23 < Pilif12p> wow, log setting 9 is very verbose 
18:23 < krzie> !logfile
18:23 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
18:24 < Pilif12p> i let it run for about 30 seconds, and have 7000 lines of log
18:24 < krzie> #2 ;]
18:26 < Pilif12p> I just ran openvpn --config client.config >> client.log
18:28 < Pilif12p> krzie: http://pastebin.mozilla.org/1368580 any idea what i could be doing wrong?
18:28 < Pilif12p> it worked fine until today, afaik
18:30 < Pilif12p> at some point I should probably buy you a beer :P
18:31 -!- LumberCartel [~LumberCar@96.53.47.42] has joined #openvpn
18:31 < LumberCartel> Hello folks.
18:32 < LumberCartel> I've noticed that sometimes when OpenVPN gets delayed in connecting to my server (due to Windows 7 slowless during StartUp or having to enter a wireless network password), that the drive mappings (to the server which runs Samba) don't work from a DOS prompt.
18:32 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
18:32 < LumberCartel> To fix this, I need to open "My Computer" and then double-click on the drive letter I'm trying to use.
18:33 < LumberCartel> After that, it works.
18:33 < LumberCartel> Is there a way to get OpenVPN to cause drive letters to get re-connected?
18:33 < LumberCartel> Thanks in advance.
18:33 < LumberCartel> Client is running 64-bit Windows 7 with current updates including SP1.
18:36 < reiffert> anyone into os x and routing?
18:36 < LumberCartel> Although I'm using OpenVPN v2.2.0, I've observed with behaviour with other versions of OpenVPN including v2.2.1.  This behaviour also occurs with Windows XP.
18:37 < reiffert> Hi there. en0 and en1 do share the same subnet 1.2.3.0/24. all communication takes place on en0 (which is because of the interface order). How can I tell the "route" command, to send all packets to destination host 1.2.3.4 via en1 instead of en0?
18:38 < LumberCartel> reiffert:  Check your "man route" pages for the -interface switch.  I see mention of it here on NetBSD, so hopefully it can be helpful to you as well.
18:39 < reiffert> been there.
18:39 < reiffert> route add -host -ifscope en1 1.2.3.4     would be what I like it to eat, but ...
18:39 < reiffert> route: writing to routing socket: Invalid argument
18:40 < LumberCartel> Hmm.
18:40 < reiffert> it's missing a gateway. however, there is no gateway that I could choose here.
18:41 < LumberCartel> What about setting up a private /30 on the interface you want to use as your gateway, and then forwarding to it instead?
18:42 < reiffert> there is a single machine connected to en1 which unfourtunately shares the same subnet then en0.
18:42 < LumberCartel> Surely MacOS X supports multiple IPs being bound to a single net.
18:42 < LumberCartel> s/net/interface/
18:42 < reiffert> I cant modify that machine that is connected to en1, but I need to access it (in order to change it's IP address)
18:43 < reiffert> And I cant ask someone to exchange network cables. It's 500km away from my place and all other people are to bed.
18:43 < LumberCartel> Maybe someone in the #MacOSX channel can help also.
18:43 < LumberCartel> Oh, remote, what fun.
18:43 < reiffert> been there.
18:44 < LumberCartel> Heheh.
18:44 < reiffert> so telling the machine that is carrying en0 and en1 to send packets to 1.2.3.4 via en1 is my only choice.
18:45 < krzie> [16:33]  <LumberCartel> Is there a way to get OpenVPN to cause drive letters to get re-connected?
18:45 < krzie> --up script
18:45 < LumberCartel> Usually the point of having two interfaces sharing the same subnet is so that eitehr interface can handle it.
18:45 < krzie> (or --route-up)
18:45 < krzie> reif, looking now
18:45 < LumberCartel> krzie:  Oh, on the client side?  I'll look into that.  Thank you.
18:46 < krzie> LumberCartel, np
18:46 < LumberCartel> krzie:  It's a minor annoyance, unless the internet connection is slow.  If this can solve it, then I can fix this annoyance for a few of my users too.  =)
18:48 -!- scanman [~scanman@bm3dconcept.com] has joined #openvpn
18:48 < scanman> hello
18:48 < LumberCartel> Hello scanman.
18:48 < scanman> hi
18:49 < scanman> I just finally set up openvpn, I'm wondering if it needs to run as Administrator or can I run it normally?
18:50 < krzie> correct
18:50 < krzie> on old windows you could run without admin as follows:
18:50 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 240 seconds]
18:50 < scanman> it seems to work both ways.. Im bridging btw..
18:50 < krzie> !win_noadmin
18:50 <@vpnHelper> "win_noadmin" is (#1) http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin-Rev1.1.html for HowTo Run OpenVPN as a non-admin user in Windows or (#2) and http://article.gmane.org/gmane.network.openvpn.user/24873 for vista
18:50 < krzie> if you say it works why are you asking?
18:51 < scanman> Ive read those docs
18:51 < krzie> why ask and then argue with the answer?
18:51 < krzie> if you know better than us, you have no need to ask
18:51 < scanman> well im wondering if it is secure
18:51 < scanman> Ive got private samba shares on the other end
18:51 < krzie> well that depends on who you ask, personally i say all bridge setups are less secure than routed
18:52 < krzie> so?
18:52 < krzie> !wins
18:52 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
18:52 < LumberCartel> scanman:  The only issue you might run into with not running as Administrator is routing -- but that only applies if the environment you're working in restricts users from altering network/routing settings.  I've only encountered this once where the administrator was super-paranoid.
18:52 < LumberCartel> (There may be other issues as well, but I haven't personally encountered any.)
18:52 < scanman> so if bridging, routes dont really need to be setup
18:53 < scanman> i'm the only user 
18:53 < scanman> I would rather not run it as admin obviously
18:54 < krzie> reiffert, how does this go:
18:54 < krzie> !certverify
18:54 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
18:54 < krzie> and then md5 both ca.crt's
18:54 < krzie> see if they match as well
18:55 < krzie> LumberCartel, you only encountered a correctly secured windows network one time?
18:55 < scanman> thanks LumberCartel
18:56 < LumberCartel> krzie:  Yes.  And even it wasn't 100% immune to SpyWare/virus infections.  =(
18:56 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
18:59 -!- scanman [~scanman@bm3dconcept.com] has quit [Quit: Segmentation fault. Core dumped...]
18:59 -!- scanman [~scanman@bm3dconcept.com] has joined #openvpn
18:59 < scanman> darn, lost my wifi
19:02 < scanman> other than the running as admin thing, openvpn seems pretty robust, It stayed connected 14 days in a row on my wifi, no drops
19:02 < reiffert> krzie: hm?
19:03 < tbruff13> I need to figure out how to use cyberghost with network manager i can use it with kvnpc but there is no gateway for me to use it with network manager
19:03 -!- tbruff13 [~tbruff13@173.217.154.252] has quit [Quit: Leaving]
19:05 < scanman> what would be the best way to audit my ovpn setup? (mostly for samba shares security) any suggestions?
19:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:06 < scanman> i'm on an "Untrusted" lan and I'm connected via a wifi link
19:07 < scanman> I dont really trust the nmap results on windows
19:07 <@vpnHelper> RSS Update - forum: problem with bridge + dchp from router <http://forums.openvpn.net/topic9128.html#p17121> || Has my OpenVPN connection been hacked? <http://forums.openvpn.net/topic9133.html#p17120>
19:09 < krzie> reiffert, its just a common cert error, so by itself it doesnt say much, that's the first move ild use to debug
19:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:11 -!- iGalin [~chatzilla@pool-108-25-190-122.atclnj.east.verizon.net] has joined #openvpn
19:13 < robott> is this cpu Atheros AR7240 rev 1.2 CPU (400MHz) enough to run openvpn without bottleneck?
19:13 < robott> 400MHz seems preety weak
19:13 < robott> am going to run openvpn on router with that cpu
19:13 < robott> have 30mb connection
19:14 < robott> 30Mbit down
19:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:16 < scanman> thanks you-guys! 
19:16 -!- scanman [~scanman@bm3dconcept.com] has left #openvpn ["Chow Mein!"]
19:26 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Read error: Operation timed out]
19:28 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
19:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:48 -!- LumberCartel [~LumberCar@96.53.47.42] has quit [Quit: RFCs the easy way -- http://www.openrfc.org/]
19:54 < Olipro> robott: it is sufficient
19:55 < Olipro> I run OpenVPN on a MIPS, compiled with gcc 4.5, all the optimisations and GCC Graphite/CLooG, and it runs just fine
19:55 < Olipro> barely consumes any processor time at all
19:59 -!- vtcN [~tony@unaffiliated/thethe] has quit [Ping timeout: 276 seconds]
20:01 -!- raidz_afk is now known as raidz
20:20 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 276 seconds]
20:20 < ecrist> !help
20:20 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
20:21 < jeev> no help for you
20:21 < ecrist> !learn net101 as A good video example is: http://www.youtube.com/watch?v=PBWhzz_Gn10
20:21 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
20:21 < ecrist> raar
20:21 < krzie> haha new spoof
20:21 < ecrist> krzie, will you learn that for me, please?
20:21 < jeev> so depressed, got a shitty ass lemon ssd for a customer, i dont have time to return it
20:21 < ecrist> I'm too lazy to fix vpnHelper atm
20:21 < krzie> !learn net101 as http://www.youtube.com/watch?v=PBWhzz_Gn10 for a good video example
20:21 <@vpnHelper> Joo got it.
20:22 < krzie> oh ya i forgot you fixed factoids ending in links
20:22 < krzie> lol habit
20:29 -!- _julian [~quassel@hmbg-4d06dbee.pool.mediaWays.net] has joined #openvpn
20:30 -!- _julian_ [~quassel@hmbg-5f764952.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
20:36 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
20:37 -!- fread2281 [~fread2281@70-56-129-63.albq.qwest.net] has quit [Ping timeout: 248 seconds]
20:39 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Ping timeout: 256 seconds]
20:43 -!- Denial [Denial@drgi.co.uk] has quit []
20:56 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
20:58 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:01 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
21:34 -!- iGalin [~chatzilla@pool-108-25-190-122.atclnj.east.verizon.net] has quit [Quit: ChatZilla 0.9.87 [SeaMonkey 2.4.1/20110928161145]]
21:52 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
21:55 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
21:55 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
21:55 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:57 -!- robott [~robott@124.78.181.100] has quit [Ping timeout: 265 seconds]
21:57 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:57 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
21:58 -!- robott [~robott@124.78.181.100] has joined #openvpn
22:09 -!- robott [~robott@124.78.181.100] has quit [Read error: Connection reset by peer]
22:09 -!- robott [~robott@124.78.181.100] has joined #openvpn
22:15 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
22:27 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p17122>
22:30 -!- adolfomaltez [~taro@190.62.240.147] has joined #openvpn
22:30 -!- robott [~robott@124.78.181.100] has quit [Ping timeout: 245 seconds]
22:47 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
23:35 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has quit [Ping timeout: 276 seconds]
23:40 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
23:41 -!- Titania [~io@221.120.122.106] has joined #openvpn
23:41 -!- Titania [~io@221.120.122.106] has quit [Client Quit]
--- Day changed Mon Oct 31 2011
00:13 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:20 -!- mobstah [elusive@beware.ruthless.org] has joined #openvpn
00:21 < mobstah> sup
00:21 < krzee> hey
00:21 < krzee> !confgen
00:21 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
00:21 < krzee> !route_override
00:21 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
00:21 < mobstah> do i need natd ?
00:21 < mobstah> or pf? ipdivert?
00:21 < krzee> yes
00:21 < mobstah> i have everything compiled in kernel incase needed
00:21 < krzee> unless you:
00:22 < krzee> !routebyapp
00:22 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
00:22 < mobstah> na
00:22 < krzee> !redirect
00:22 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
00:22 < krzee> !linnat
00:22 < mobstah> want everything to go through unless i set normal route in rc.conf
00:22 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
00:22 < krzee> !fbsdnat
00:22 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
00:24 < krzee> you can set the route in the vpn config, why do it in rc.conf?
00:24 < krzee> rc.conf is always active, the vpn config will just be active when needed, when the default route is overwritten by openvpn
00:24 < mobstah> dunno
00:24 < mobstah> ah
00:30 < mobstah> tap or tun
00:31 < mobstah> !def1
00:31 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
00:34 < krzee> tun
00:34 < krzee> my confgen wont make tap
00:35 < mobstah> ah k
00:35 < mobstah> and
00:35 < mobstah> if my lan is 10.10.10.x
00:35 < mobstah> do i need to use 192.168.x.x or something ?
00:36 < mobstah> to not cause any conflicts
00:36 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:36 < krzee> you can use any other subnet, doesnt need to be so far apart
00:36 < krzee> ie, 10.10.11.x is still safe :-p
00:36 < mobstah> ah thought so
00:36 < krzee> assuming 10.10.10.x means 10.10.10.0/24
00:36 < mobstah> just thought it might mess with the routes and shit
00:37 < krzee> not if you are sane when setting your routes
00:37 < mobstah> ok so this gen's server conf and client ?
00:37 < krzee> omg just run the thing dude
00:38 < mobstah> ahah
00:38 < mobstah> :P
00:38 -!- brushbox1 [~brushbox@174.24.233.220.static.exetel.com.au] has left #openvpn []
00:38 < mobstah> getting a error
00:38 < mobstah> shopt: not found
00:38 < mobstah> confgen.sh: 28: Syntax error: word unexpected (expecting ")")
00:38 < krzee> you must not have bash
00:39 < mobstah> ya i have bash
00:39 < krzee> [01:21]  <vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
00:39 <@vpnHelper> Title: svn - Revision 325: /trunk/openvpn-confgen (at www.secure-computing.net)
00:39 < krzee> bash --version
00:39 < mobstah> hm
00:39 < krzee> it may require bash4
00:39 < mobstah> wtf
00:39 < krzee> thats all i use
00:39 < mobstah> lol im in bash
00:39 < krzee> bash --version
00:39 < mobstah> but it just returned
00:39 < mobstah> with that cmd
00:39 < mobstah> └─(~/openvpn)-> bash --version
00:39 < mobstah> ┌─(root@BeWaRe)
00:39 < mobstah> └─(~/openvpn)-> echo $SHELL
00:39 < mobstah> /usr/local/bin/bash
00:40 < mobstah> weird
00:40 < krzee> /usr/local/bin/bash --version
00:40 < krzee> oh and no it doesnt need bash 4, just any bash
00:40 < krzee> go to the top of each file and change the #!
00:41 < krzee> to be #!/usr/local/bin/bash
00:41 < mobstah> i did that
00:41 < mobstah> right
00:41 < krzee> well it works everywhere else
00:41 < mobstah> bash-4.1.11         The GNU Project's Bourne Again SHell
00:41 < mobstah> yeah weird
00:41 < mobstah> lemme reinstall bash
00:43 < mobstah> got it now
00:43 < mobstah> hm i have openvpn 2.2.1
00:44 < mobstah> i need a different version of that also? 2.1.x ?
00:44 < krzee> no no
00:44 < krzee> 2.1 or above
00:44 < mobstah> ah ok
00:50 < mobstah> nice work
00:50 < mobstah> btw
00:50 < mobstah> gonna test it out now
00:50 < krzee> thx
00:55 < mobstah> nice
00:56 < mobstah> was able to ping
00:56 < mobstah> server from client
00:56 < mobstah> but locked all my inetz up and coudlnt ping anything else
00:56 < krzee> you didnt do nat yet, did you
00:56 < mobstah> must be the nat needing fix
00:56 < mobstah> i set it in  the pf.conf
00:57 < krzee> did you enable ip forwarding?
00:57 < mobstah> ya
00:57 < mobstah> net.inet.ip.forwarding: 1
00:57 < krzee> likely your nat
00:57 < krzee> but post logs if you wanna, like this:
00:57 < krzee> !logs
00:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
00:57 < krzee> !logfile
00:57 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
00:59 < krzee> cual OS?
01:00 < krzee> oops wrong chan, lol
01:00 < mobstah> ah
01:00 < mobstah> k
01:03 -!- mobstah [elusive@beware.ruthless.org] has quit [Read error: Connection reset by peer]
01:07 -!- mobsta [elusive@beware.ruthless.org] has joined #openvpn
01:07 -!- mobsta is now known as mobstah
01:07 < mobstah> thanks krzee
01:07 < mobstah> it works
01:07 < mobstah> what is needed to set the static route now ?
01:07 < mobstah> !help
01:07 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
01:07 < krzee> [01:21]  <krzee> !route_override
01:07 < krzee> [01:21]  <vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
01:07 <@vpnHelper> Title: OpenVPN Support Forum Split tunnel tweaks? : Scripting and Customizations (at forums.openvpn.net)
01:07 < mobstah> ah yes
01:08 < mobstah> thanks much
01:08 < mobstah> hm
01:11 < mobstah> gotit
01:11 < mobstah> sweet
01:12 < mobstah> awesome scripts bro
01:13 < krzee> thx
01:28 < reiffert> moin
01:37 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 244 seconds]
01:48 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has quit [Ping timeout: 256 seconds]
01:59 <@vpnHelper> RSS Update - forum: help! no connection when connected. <http://forums.openvpn.net/topic9134.html#p17123> || Cannot check status of OpenVPN server. <http://forums.openvpn.net/topic9013-15.html#p16904>
02:02 -!- ravel [~ravel_out@175.136.82.14] has joined #openvpn
02:03 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Read error: Connection reset by peer]
02:12 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:12 -!- mode/#openvpn [+o mattock] by ChanServ
02:21 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has joined #openvpn
02:37 -!- ravel [~ravel_out@175.136.82.14] has quit []
02:38 -!- raidz is now known as raidz_afk
02:39 -!- ravel [ravel@175.136.82.14] has joined #openvpn
02:56 -!- mobstah [elusive@beware.ruthless.org] has quit [Quit: leaving]
03:05 -!- mordy [~mordy@71-80-218-26.dhcp.crcy.nv.charter.com] has left #openvpn []
03:05 < bjorneven> norton av should be banned from ever being installed.. it craps on openvpn road warrior setups
03:05 < bjorneven> from 50kb/s to 2MB/s by just disabling the damned 
03:12 -!- happylife [~happylife@192.100.124.156] has joined #openvpn
03:19 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:34 -!- happylife [~happylife@192.100.124.156] has quit [Ping timeout: 240 seconds]
03:37 -!- happylife [~happylife@192.100.124.156] has joined #openvpn
03:37 < hyper_ch> bjorneven: if you'd use Linux/Unix you'd have no need for such tools like AV or PFW.... I still can't comprehend why people artificially want to slow down their computers
03:49 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
03:54 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:55 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 240 seconds]
03:55 < Mowee> morning
04:06 <@vpnHelper> RSS Update - forum: selinux blocks openvpn-auth-pam.so plugin <http://forums.openvpn.net/topic9077.html#p17124>
04:09 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
04:14 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 276 seconds]
04:17 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
04:17 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
04:20 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
04:42 <@vpnHelper> RSS Update - forum: Has my OpenVPN connection been hacked? <http://forums.openvpn.net/topic9133.html#p17125>
05:05 -!- dazo [dazo@openvpn/community/developer/dazo] has joined #openvpn
05:05 -!- mode/#openvpn [+o dazo] by ChanServ
05:13 < bjorneven> hyper_ch: not easy to control customers OS
05:19 < hyper_ch> but if it's installed on customers OS, what do you care?
05:21 < hyper_ch> krzee: http://www.reghardware.com/2011/10/31/boffin_says_ebook_readers_gain_mass_when_books_are_added/
05:21 <@vpnHelper> Title: Official: Kindles get heavier as you add e-books • reghardware (at www.reghardware.com)
05:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
05:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:32 -!- happylife [~happylife@192.100.124.156] has quit [Ping timeout: 240 seconds]
05:32 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Read error: Operation timed out]
05:39 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
05:56 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:56 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:56 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
06:02 -!- robott [~robott@124.78.181.100] has joined #openvpn
06:02 < robott> hi
06:02 < robott> i can't start the openvpn service on my linux box
06:02 < robott> i've done nothing wrong...
06:02 < robott> installed it from rpmforge repo, made the certificates and keys, made a server.conf... see... http://pastebin.com/CTP2hk2j
06:03 < robott> please help
06:05 < robott> server.conf http://pastebin.com/XWMCxDgc
06:15 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Ping timeout: 248 seconds]
06:23 -!- robott [~robott@124.78.181.100] has quit []
06:37 <@vpnHelper> RSS Update - forum: Open Vpn And Server 2008 r2 Core <http://forums.openvpn.net/topic9122.html#p17126>
06:38 -!- robott [~robott@124.78.181.100] has joined #openvpn
06:41 < robott> any1 here?
06:41 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
06:44 < cyrtpkrd> robott: when things aren't going right, set your logging to verb 10 or something
06:45 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
06:45 < cyrtpkrd> robott: pastebin your conf to me that does not look right, there should be a log file somewhere, in /var/logs or your /etc/openvpn
06:45 < cyrtpkrd> set log to append
06:46 -!- robott [~robott@124.78.181.100] has quit [Ping timeout: 260 seconds]
06:46 < cyrtpkrd> and mute 10
06:46 < cyrtpkrd> ahh I see your server.conf now
06:46 < cyrtpkrd> sec let me read it
06:48 < __nolife> In openvpn 2.1 the "inactive" argument doesn't work. Is that a known bug ?
06:55 <@vpnHelper> RSS Update - forum: Open Vpn And Server 2008 r2 Core <http://forums.openvpn.net/topic9122.html#p17127>
06:56 -!- robott [~robott@124.78.181.100] has joined #openvpn
06:57 < robott> !linat
06:57 < robott> !nat
06:57 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
06:57 < robott> !linnat
06:57 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
06:57 < robott> !ip 
06:58 < robott> !forward
06:58 < robott> !help
06:58 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
06:58 < robott> !ip_forward
07:05 -!- happylife [~happylife@192.100.124.156] has joined #openvpn
07:18 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
07:22 -!- Netsplit *.net <-> *.split quits: SJr, krzie, beerbroy, kloeri, amero, corretico, bjorneven, rooth
07:26 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
07:26 -!- corretico [~luis@201.201.44.82] has joined #openvpn
07:26 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
07:26 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
07:26 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
07:26 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
07:26 -!- beerbroy [~gustav@unaffiliated/beerbroy] has joined #openvpn
07:27 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has quit [Ping timeout: 252 seconds]
07:29 < robott> any1 here? quick question
07:29 < ecrist> !ask
07:29 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
07:30 -!- corretico_ [~luis@200.12.40.25] has quit [Ping timeout: 240 seconds]
07:30 < robott> how do i setup ip forwarding
07:30 < robott> its been a long time since i used openvpn
07:31 < robott> !ip
07:31 < robott> !ipforward
07:31 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
07:31 < robott> !linipforward
07:31 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
07:31 < robott> nice
07:31 < zalzice> echo 1 >> /proc/sys/net/ipv4/ip_forward
07:32 < robott> k
07:32 < robott> and other than that only nat which i've done
07:32 < ecrist> :)
07:32 < robott> i think iptable rules not necessary since my default policy is accept on all tables
07:33 < robott> its not working
07:33 < robott> can't visit websites but i can ping 10.8.0.1
07:33 < robott> i already did a nat forwarding thing 
07:33 < robott> and setup push gateway def1 in server.conf
07:34 < robott> what am i missing... hmm....
07:38 < robott> !linat
07:38 < robott> !linnat
07:38 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
07:40 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has joined #openvpn
07:42 -!- robott [~robott@124.78.181.100] has quit []
07:46 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
07:47 -!- dym [~patrick@unaffiliated/dym] has left #openvpn []
07:52 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has joined #openvpn
07:52 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:56 -!- robott [~robott@124.78.181.100] has joined #openvpn
07:56 < robott> !linnat
07:56 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
07:58 -!- adolfomaltez [~taro@190.62.240.147] has quit [Remote host closed the connection]
08:05 < robott> i have it working.. well i can ping 10.8.0.1 and i can visit websites only if i enter ip in browser
08:05 <@vpnHelper> RSS Update - forum: phantom processes <http://forums.openvpn.net/topic9135.html>
08:05 < robott> something is going wrong with dns lookup
08:05 < robott> any ideas? pleaseeeeeeeee
08:18 < zalzice> have you checked your resolv.conf?
08:23 <@vpnHelper> RSS Update - forum: Help me to Remote Authentication script <http://forums.openvpn.net/topic9136.html>
08:29 < robott> why
08:30 < robott> !linnat
08:30 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
08:30 < bjorneven> is there any magic to debugging slow samba file copy over openvpn ?
08:31 < bjorneven> 1MB/s w/o openvpn and 130kB/s with, could it be fragmentation?
08:32 < ecrist> bjorneven: start looking at packet dumps, test your mtu
08:32 < ecrist> !mtu
08:32 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
08:33 < bjorneven> thanks
08:35 <@vpnHelper> RSS Update - forum: phantom processes <http://forums.openvpn.net/topic9135.html#p17130>
08:35 -!- robott [~robott@124.78.181.100] has quit []
08:38 -!- raidz_afk is now known as raidz
08:43 < bjorneven> other things to consider when debugging slow samba over openvpn ?
08:43 < bjorneven> antivirus is disabled btw
08:44 -!- ravel [ravel@175.136.82.14] has quit [Ping timeout: 255 seconds]
08:47 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Read error: Connection reset by peer]
08:47 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
08:48 -!- raidz is now known as raidz_afk
08:49 < EugeneKay> There's nothing to debug; Samba is just a shitty protocol.
08:54 < reiffert> looser attitude
08:55 < EugeneKay> I wish. 
08:57 < EugeneKay> You can tcpdump it and try to find what's being overly-chatty and eating up time, but it's going to boil down to VPN overhead multiplied by SMB chattiness.
08:57 < EugeneKay> Samba is fine if you're over a LAN, but you need an internet protocol when working over the internet.
09:05 -!- master_of_master [~master_of@p57B52BA8.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:09 -!- master_of_master [~master_of@p57B54FFD.dip.t-dialin.net] has joined #openvpn
09:10 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:16 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
09:16 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
09:16 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:16 -!- mode/#openvpn [+v Axeman] by ChanServ
09:25 < bjorneven> on os x i get 2MB/s
09:25 < bjorneven> on some windows machines I get 50kb/s, and some others 2MB/s
09:26 < bjorneven> but gonna try wireshark tonight
09:26 < bjorneven> lousy way to spend a night
09:27 < EugeneKay> Any difference in client connection?
09:27 < EugeneKay> Ping time in particular
09:27 < bjorneven> haven't tried ping, but download speeds are good
09:28 < bjorneven> wifi to fiberlink with 30/30 link
09:28 < bjorneven> withing the same building
09:28 < bjorneven> (but different corp networks)
09:28 < EugeneKay> Interesting that you see that much variance between clients. 
09:28 < EugeneKay> Could be something windowsy, like DNS resolution order.
09:28 < EugeneKay> Samba's interaction with WINS and DNS is...... confusing
09:28 < bjorneven> enabled netbios , but haven't specified wins
09:29 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:29 < bjorneven> this is a pfsense box so some automagic have been done for me
09:29 < EugeneKay> I turn netbios and wins off. All my boxen have proper DNS care of my DHCP server
09:29 < bjorneven> have proper dns too
09:29 < bjorneven> so maybe I try turning netbios off
09:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:43 -!- mode/#openvpn [+v s7r] by ChanServ
09:51 -!- corretico_ [~luis@190.211.92.6] has joined #openvpn
09:52 -!- Rockfordal [~Rockford@213-21-122-220.customer.t3.se] has joined #openvpn
09:54 < Rockfordal> hello. anyone who can help me, i have performance issues when opening files through nfs on openvpn tunnel
09:55 <+s7r> try using udp if you use tcp
09:55 < Rockfordal> i am
09:55 -!- corretico__ [~luis@200.12.40.25] has joined #openvpn
09:55 <+s7r> just when opening files through nfs? rest works great?
09:56 < Rockfordal> it takes several seconds to open files with vim, and using a java editor it takes like 30 seconds switching between files in a project
09:56 < Rockfordal> i tried smb instead of nfs and it was the same, perhaps slower
09:56 <+s7r> i don't think the problem is in openvpn
09:57 < Rockfordal> the client is Linux Fedora 15, and the server Solaris 11 Express (old openvpn perhaps)
09:58 < Rockfordal> i have no problem with only nfs mounted to my local server, but i could try a tunnel to my local server or nfs directly to the remote server and compare to be more certain if its a openvpn problem or not
09:58 < Rockfordal> but is there any more things to try?
09:58 < Rockfordal> i have treid mtu 1400
09:58 -!- MadTBone_ [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has joined #openvpn
10:00 -!- dazo is now known as dazo_afk
10:00 -!- MadTBone_ [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has quit [Client Quit]
10:00 -!- MadTBone [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has joined #openvpn
10:02 -!- robert83a2 [~robert83a@gandalf.topolauniverzal.com] has joined #openvpn
10:03 < robert83a2> hello everyone, I'm trying to setup a openvpn client that has computers behind it, which should be able to ping every computer on
10:03 < robert83a2> the server side and vice versa, currently , the openvpn client itself can ping any computer behind openvpn server and vice versa.
10:03 < robert83a2> Both OpenVPN server and OpenVPN client are router computers (no iptables on them). server.conf http://pastebin.com/RMZfrw2X
10:03 < robert83a2> ccd : http://pastebin.com/s1Vi8NRs
10:03 < robert83a2> client.conf http://pastebin.com/7dvkLVdj
10:14 -!- beerbroy is now known as Hut-Josef
10:37 < ecrist> !route
10:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
10:37 < ecrist> !iroute
10:37 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
10:48 < Rockfordal> s7r: i have tested the same scenario now on LAN, and the problem only occurs with OpenVPN, so it does seem to be an OpenVPN issue.
10:49 < Rockfordal> (although it could also be related to Solaris since im using an older CSW package of OpenVPN on the server and ZFS filesystem)
10:50 < robert83a2> thank you, already fixed it
10:50 < robert83a2> using a new instance of openvpn
10:50 < robert83a2> I've created a dev tun
10:50 < robert83a2> I did not know I cannot do it with dev tap... 
10:50 < robert83a2> anyway a dev tun instance
10:50 < robert83a2> iroute in ccd
10:50 < robert83a2> now I can see the remote lan as my own :D yay!!! great software
10:50 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
10:58 < Rockfordal> Noone using nfs over openvpn who can explain why nano open file is fast, but vim open file is slow, and redcar editor is extremely slow over OpenVPN?
10:59 < ecrist> no clue
10:59 -!- happylife [~happylife@192.100.124.156] has quit [Ping timeout: 258 seconds]
11:00 < Rockfordal> is vim doing some kind of file locking that nano is not?
11:03 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
11:04 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:08 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
11:11 -!- Blues-Man [~bluesman@host28-21-dynamic.247-95-r.retail.telecomitalia.it] has joined #openvpn
11:27 -!- bauruine [~stefan@246-202.105-92.cust.bluewin.ch] has quit [Remote host closed the connection]
11:34 -!- raidz_afk is now known as raidz
11:56 <@vpnHelper> RSS Update - forum: phantom processes <http://forums.openvpn.net/topic9135.html#p17132>
12:03 -!- scoopex [~scoopex@85.214.140.184] has joined #openvpn
12:05 < scoopex> hi :-) i would like to give my openvpn users the same ip-adresses as there were working directly in the company! (because they need their firewall openings :-) is that possible?
12:05 < bassliner> scoopex: i have no idea why you plan to do this, but you're very likely running into knifes trying to achieve this.
12:06 < scoopex> in my understanding the openvpn gateway has to setup the ip address of the particular workstation and to do proxy-arp/nat for that ip-address...
12:07 < EugeneKay> You could do that, but it's easier to route it. Really.
12:07 < EugeneKay> Just fiddle your firewall rules to include the vpn subnet
12:10 < scoopex> so i have to change the individual rules of ~100 users :-(
12:11 < EugeneKay> You set up your workstations with that restive of a firewall?
12:15 < EugeneKay> restrictive*
12:21 -!- robert83a2 [~robert83a@gandalf.topolauniverzal.com] has quit []
12:21 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
12:22 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
12:23 -!- happylife [~happylife@cs181134059.pp.htv.fi] has joined #openvpn
12:29 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
12:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
12:31 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:33 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
12:34 -!- cyrtpkrd [~redbox@deadline.el8.ru] has quit [Quit: I dont know what else to do]
12:38 <@vpnHelper> RSS Update - forum: Aceess local network behind OpenVPN (tun setup) <http://forums.openvpn.net/topic9138.html> || map a network drive <http://forums.openvpn.net/topic9137.html>
12:44 <@vpnHelper> RSS Update - forum: Setting up vpn server on my vps windows server <http://forums.openvpn.net/topic9095.html#p17135>
12:53 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
13:04 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:05 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:07  * Blues-Man good blues bye
13:07 -!- Blues-Man [~bluesman@host28-21-dynamic.247-95-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
13:09 -!- Rockfordal [~Rockford@213-21-122-220.customer.t3.se] has quit [Quit: Lämnar]
13:10 -!- ]R[ [~Positive@2a01:e35:2ef2:d850:e350:e350:e350:e350] has quit [Ping timeout: 244 seconds]
13:12 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has joined #openvpn
13:13 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
13:15 -!- Enrique_ [be45ee73@gateway/web/freenode/ip.190.69.238.115] has joined #openvpn
13:15 < Enrique_> good time
13:15 -!- tonybordeaux [4c4fb5d6@gateway/web/freenode/ip.76.79.181.214] has joined #openvpn
13:16 < Enrique_> a question:
13:16 < Enrique_> i need connect my pc to a remote server, but not remote control else use sql server
13:16 < Enrique_> how i are in a lan
13:17 < tonybordeaux> Hello I have a question, when I try to create a diffie hellman with /build-dh, it says I cannot open config file c:\openssl/ssl/openssl.cnf. 
13:17 < Enrique_> how can do this? actually i use Teamveawer, but i need change this tool
13:17 < tonybordeaux> Is there a place I get openssl.cnf?
13:18 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
13:20 <@vpnHelper> RSS Update - forum: Aceess local network behind OpenVPN (tun setup) <http://forums.openvpn.net/topic9138.html#p17136>
13:30 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
13:42 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
13:42 -!- mode/#openvpn [+o mattock] by ChanServ
13:56 <@vpnHelper> RSS Update - forum: Has my OpenVPN connection been hacked? <http://forums.openvpn.net/topic9133.html#p17137>
14:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
14:10 < krzee> !winpath
14:10 <@vpnHelper> "winpath" is (#1) Remember on Windows to quote pathnames and use double backslashes, e.g.: "C:\\Program Files\\OpenVPN\\config\\foo.key" or (#2) also, you can use forward slashes to avoid needing double backslashes, but you still need quotes, e.g.: C:/Program Files/OpenVPN/config/foo.key (but surrounded by quotes)
14:11 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:25 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
14:26 <@vpnHelper> RSS Update - forum: Aceess local network behind OpenVPN (tun setup) <http://forums.openvpn.net/topic9138.html#p17138>
14:29 -!- Ionic [ionic@ionic.de] has joined #openvpn
14:29 -!- tonybordeaux [4c4fb5d6@gateway/web/freenode/ip.76.79.181.214] has quit [Ping timeout: 265 seconds]
14:30 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
14:31 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:31 -!- mode/#openvpn [+o mattock] by ChanServ
14:41 < Enrique_> server say 1194: Address already in use nd not connect
14:42 < Enrique_> server say "...1194: Address already in use" and not connect, what i can do?
14:42 < krzee> kill the other instance of openvpn that is already running
14:42 < Enrique_> i follow static-key-mini-howto
14:42 < Enrique_> how find other instance?
14:43 < krzee> by knowing how to use your os, i have to go to work
14:43 < krzee> (ps auxw|grep openvpn)
14:45 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
14:47 -!- Enrique_ [be45ee73@gateway/web/freenode/ip.190.69.238.115] has quit [Quit: Page closed]
14:48 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:48 -!- Enrique_ [be45ee73@gateway/web/freenode/ip.190.69.238.115] has joined #openvpn
14:48 -!- corretico_ [~luis@190.211.92.6] has quit [Ping timeout: 240 seconds]
14:48 < Enrique_> client sy me: Cannot resolve host address: myremote.mydomain: [HOST_NOT_FOUND] The specified host is unknown.  
14:49 < Enrique_> i do any wrong
14:49 < Enrique_> i follow static-key-mini-howto doc
15:01 -!- corretico_ [~luis@190.211.92.1] has joined #openvpn
15:02 <@vpnHelper> RSS Update - forum: Aceess local network behind OpenVPN (tun setup) <http://forums.openvpn.net/topic9138.html#p17139>
15:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
15:05 < hyper_ch> !dns
15:05 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
15:05 < hyper_ch> there is no IP address like  0.6.6.6 right?
15:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
15:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:08 -!- kalken [~default@c83-254-101-75.bredband.comhem.se] has joined #openvpn
15:10 < hyper_ch> krzee: I got some interesting link for you
15:10 < hyper_ch> krzee: http://syhw.posterous.com/two-amusing-side-channel-attacks
15:10 <@vpnHelper> Title: Two Amusing Side Channel Attacks - syhw's posterous (at syhw.posterous.com)
15:10 < hyper_ch> also for dazo_afk
15:15 < krzie> wow
15:15 < hyper_ch> krzie: I knew you'd like that
15:15 -!- MadTBone [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has quit [Read error: Connection reset by peer]
15:16 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
15:17 < hyper_ch> krzie: how can we turn that into money? :)
15:18 -!- MadTBone_ [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has joined #openvpn
15:18 < krzie> by selling your ass on the corner and sending me the $
15:18 < hyper_ch> :)
15:18 < hyper_ch> you're going to glue all your usb ports now?
15:19 < krzie> no, im gunna sell your usb port
15:19 < hyper_ch> you must have some pretty sensitive gadgets to measure that, right?
15:20 < krzie> not just that
15:20 < krzie> some serious skill to analyze it too
15:20 < hyper_ch> and you have those skills also, right?
15:20 < krzie> shit no
15:20 < EugeneKay> Well that's a hell of a thing.
15:20 < hyper_ch> no?
15:20 < hyper_ch> you just shattered my world view
15:20 < krzie> not just no, shit no
15:21  * hyper_ch goes crying into the corner
15:21 < EugeneKay> I'd like to point out that shotgun security is effective against such attacks.
15:21 < krzie> tbh im not sure if anyone here does
15:21 < krzie> EugeneKay, you have a remote shotgun?
15:21 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Ping timeout: 258 seconds]
15:21 < krzie> (which they allow at your colo)
15:22 < EugeneKay> No, but I do have a locked rack in a colo with decent entry requirements and rack monitoring
15:22 < hyper_ch> shotgun security?
15:22 < krzie> lol
15:22 < EugeneKay> If you try to attack my network, I chase you with a shotgun.
15:22 < krzie> time to make a !shotgun
15:22 < hyper_ch> :)
15:23 < EugeneKay> I live far enough out into the woods that I don't need to bother with WEP/WPA
15:23 < krzie> !learn shotgun as the most effective form of physical security
15:23 <@vpnHelper> Joo got it.
15:23 < krzie> !learn shotgun as <hyper_ch> shotgun security?   <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
15:23 <@vpnHelper> Joo got it.
15:24 < krzie> (i added a word)
15:24 < hyper_ch> I'm famous now
15:24 < EugeneKay> I'll allow it. :-p
15:24 < EugeneKay> !shotgun
15:24 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
15:24 < EugeneKay> \o/
15:24 < hyper_ch> aren't lightsabers better than shotguns?
15:24 < Enrique_> sorry i enabled ip forwarding, i connect server and client but nop ping between this pc, what wrong?
15:24 < EugeneKay> Range is a bit limited. You could THROW it, but....
15:25 < hyper_ch> what about lightsabers with integrated shotgun function?
15:25 < EugeneKay> Enrique_ - ping between where? 
15:25 < EugeneKay> Clients? Client to internet?
15:25 < hyper_ch> ip forwarding enabled on the server?
15:25 < Enrique_> sorry my bad english, the machine a not ping machine b
15:25 < Enrique_> and machine b not ping machine a
15:25 < Enrique_> yes
15:25 < hyper_ch> machine a and machine b both clients in the vpn?
15:26 < Enrique_> not machine b is server
15:26 < hyper_ch> does the server reply to ping normally?
15:26 < EugeneKay> Are you trying to ping the VPN ip address on both ends, or the public IP adress of the server, via the VPN?
15:26 < Enrique_> i think not call me abouit network is bad
15:27 < Enrique_> vpn address 10.8.0.1
15:27 < Enrique_> i use cmd for do ping
15:28 < Enrique_> dev tun  ifconfig 10.8.0.1 10.8.0.2  secret static.key
15:28 < Enrique_> in server
15:28 < hyper_ch> !configs
15:28 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
15:28 < Enrique_> ifconfig 10.8.0.2 10.8.0.1 in remote
15:29 < Enrique_> ok client config: remote 193.168.1.100|dev tun|ifconfig 10.8.0.2 10.8.0.1|secret "C:\\Program Files\\OpenVPN\\config\\static.key"
15:30 < hyper_ch> !pastebin
15:30 <@vpnHelper> Miscellany || Someone || end3r || OS X keychain patch
15:30 < hyper_ch> krzie: no pastebin?
15:30 < Enrique_> server config: dev tun|ifconfig 10.8.0.1 10.8.0.2|secret "C:\\Archivos de programa\\OpenVPN\\config\\static.key"
15:31 < EugeneKay> !pb
15:31 < EugeneKay> !paste
15:31 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
15:31  * EugeneKay deals with too many bots
15:32 -!- MadTBone_ [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has quit [Read error: Connection reset by peer]
15:32 < Enrique_> sorry i tray follow you, just a minute
15:32 -!- MadTBone_ [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
15:33 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
15:33 < Enrique_> im on windows 7 client and windows server 2003, server
15:34 < Enrique_> sorry eugenekay, but your link not function
15:34 < Enrique_> www.pastbin......
15:34  * EugeneKay blames the bot
15:36 -!- nongfushui [~robott@124.78.181.100] has joined #openvpn
15:37 < Enrique_> im lost  :'(
15:37 < nongfushui> i also lost
15:37 -!- kalken [~default@c83-254-101-75.bredband.comhem.se] has quit [Read error: Operation timed out]
15:42 < Enrique_> jeje
15:44 < Enrique_> pastebin is on linux?
15:45 < zalzice> Enrique_: please paste your config, www.pastebin.com
15:45 < Enrique_> thkx zalzice, previus link not work
15:48 < nongfushui> i can start up the vpn and ping 10.8.0.1, however my intention is route all my traffic through the vpn... but i can't visit any websites
15:48 < nongfushui> this is my server.conf and iptables script
15:48 < nongfushui> http://pastebin.com/KiNU1NBC
15:48 < nongfushui> thanks for any advice
15:49 < Enrique_> I use OPENVPN 2.1.1  Client os is windows 7 or windowsxp  Server side is Windows Server 2003  Client config file:   remote 193.168.1.100  dev tun  ifconfig 10.8.0.2 10.8.0.1  secret "C:\\Program Files\\OpenVPN\\config\\static.key"  comp-lzo  keepalive 10 60  ping-timer-rem  persist-tun  persist-key  Server Config file:  dev tun  ifconfig 10.8.0.1 10.8.0.2  secret "C:\\Archivos de programa\\OpenVPN\\config\\static.key"  comp-lzo  k
15:50 < Enrique_> http://pastebin.com/tBk7mVUX
15:51 < zalzice> nongfushui: can you ping the openvpn server? can you ping a public ip?
15:52 < nongfushui> i can ping 10.8.0.1 when the vpn tunnel is running, from my client laptop i cannot even ping google's ip address if it is running
15:53 < nongfushui> i just get 'request timed out.'
15:53 <@vpnHelper> RSS Update - forum: Aceess local network behind OpenVPN (tun setup) <http://forums.openvpn.net/topic9138.html#p17140>
15:55 < nongfushui> my internet setup is laptop --> buffalo wireless router --> ftth modem --> internet
15:57 < Enrique_> i suppose what i can connect my machines with simple instructions, i dont use iptables or scrip
15:58 < Enrique_> i only need use sql behind server openvpn
15:59 < zalzice> nongfushui: try to ping 8.8.8.8
15:59 < nongfushui> ok
16:00 < nongfushui> can't get request time out 100% loss
16:02 < zalzice> nongfushui: i found maybe a problem with your iptables
16:02 < zalzice> i dont know if this do a different
16:02 < zalzice> this is wrriten in your iptables:
16:02 < zalzice> iptables -t nat -A POSTROUTING -s 10.8.0.0./24 -o eth0 -j MASQUERADE  
16:02 < zalzice> what it should be: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
16:03 < zalzice> but i dont know if that do a different?
16:03 < zalzice> (missing the zero)
16:03 < nongfushui> maybe i am blind but i cant see it ha
16:03 < zalzice> 10.8.0./24
16:04 < zalzice> oh sorry, extra "."
16:04 < zalzice> not missing a zero:-)
16:04 < nongfushui> ahhhhhhhh
16:04 < nongfushui> nice i will try it
16:05 -!- dym [~patrick@unaffiliated/dym] has joined #openvpn
16:05 < Enrique_> and me?
16:05 < zalzice> Enrique_: can you connect to openvpn serveR?
16:05 < zalzice> and what ip do you get on client? and what ip is your server?
16:05 < Enrique_> using openvpn? no
16:06 < zalzice> well, what error messsage do you get?
16:06 < nongfushui> now i can ping 8.8.8.8 when vpn running
16:06 < nongfushui> let me check if can visit website though
16:06 < nongfushui> :)
16:06 < zalzice> nongfushui: nice:-)
16:06 < Enrique_> i note dhcp on server use 255.255.255.252 and tcp use 255.255.255.0
16:06 < nongfushui> ok can't visit google.com
16:06 < nongfushui> appears i have some dns problems?
16:06 < zalzice> yes
16:06 -!- Rockfordal [~Rockford@213-21-122-220.customer.t3.se] has joined #openvpn
16:06 < zalzice> !dns
16:06 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
16:07 < dym> COuld anyone give me a hand setting up a vpn connection to my server? i somehow doesnt work - here are logs: http://script.quakenet.org/paste/580413
16:07 < nongfushui> i will try adding push 8.8.8.8 to the server.conf
16:07 < krzie> what client os?
16:08 < Enrique_> not error message, only when i do ping 10.8.0.1 in client obtain "time out"
16:08 < dym> krzie: me?
16:09 < nongfushui> dude your a genius it works!!!!!!!!
16:09 < nongfushui> omg u saved me hours of work by noticing that errant dot
16:09 < zalzice> :-)
16:11 < zalzice> Enrique_: i really dont understand whats going on, so your client can connect and receive a ip?
16:11 < Enrique_> ok i start again. I install and connect client and server
16:12 < Enrique_> two function good (i think), but when i ping one or other time out  is answer
16:13 < Enrique_> this is the conf for both
16:13 < Enrique_> http://pastebin.com/tBk7mVUX
16:16 < zalzice> yeah i have been looking in to your config and i have no idea if that works or not, since i havent played with static key thingy
16:16 < zalzice> i just want to know if you can connect or not to the server
16:17 < Enrique_> ok, then how i can connect my pc to my customer's server? i need chech his sql table between my software
16:18 < Enrique_> i connect to server use teamviewer, but not with openvnc
16:18 < Enrique_> and then want use openvnc
16:19 < Enrique_> do you have a client/server working config files?
16:20 < Enrique_> not need connect multiples machines only one client to one server and use server's resource
16:22 -!- nongfushui [~robott@124.78.181.100] has quit []
16:23 < zalzice> I dont think i can help you out there
16:23 < Enrique_> ou
16:24 < zalzice> try to find some tutorial
16:24 < dym> Could anyone give me a hand setting up a vpn connection to my server? i somehow doesnt work - here are logs: http://script.quakenet.org/paste/580413
16:24 < zalzice> i bet you can find alot of windows openvpn server tutorial
16:25 < zalzice> dym: possible to paste config?
16:25 < zalzice> client & server
16:26 < Enrique_> ok, thkx, maybe i doubt use other tool
16:30 < krzie> dym, looks like a general networking error... check your firewall
16:30 < krzie> also be sure you arent keeping state on udp
16:30 < krzie> (i told you this yesterday)
16:33 -!- __phil__ [~chatzilla@64.134.223.130] has joined #openvpn
16:34 < dym> krzie: its all good. what needs to be checked other than the standard port?
16:37 < krzie> checked? lol i bet we found the problem
16:38 < dym> krzie: krzie there is no actual firewall.
16:39 < dym> the server has iptables, with 1194 allowed
16:39 < krzie> how is iptables not an actual firewall?
16:40 < dym> Are we gonna get stuck on such details?
16:40 < krzie> if its not a firewall what is it?
16:40 < krzie> yes, since its very likely your firewall
16:40 < dym> krzie: im allowing tcp 1194
16:40 < krzie> i know you meant udp
16:40 < krzie> since i can see thats open
16:40 < krzie> (the first packet makes it to the server)
16:41 < dym> in fact i ment tcp
16:41 < dym> is udp 1194 required?
16:42 < krzie> well you're using udp...
16:42 -!- __phil__ [~chatzilla@64.134.223.130] has left #openvpn []
16:45 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
16:46 < dym> krzie: right. still with udp allowed theres no connect
16:50 < dym> krzie: do i need any port forwards back to my client? its behind a nat.
16:51 < krzie> no
16:51 < krzie> [14:30]  <krzie> also be sure you arent keeping state on udp
16:51 < krzie> better yet, just post your entire iptables config
16:52 < dym> for that interface im only allowing 1194 for new connections
16:52 < dym> udp
16:53 < krzie> well there you go
16:53 < dym> could you elaborate?
16:53 < krzie> allow it in general, then use tls-auth in openvpn for securing it better than your failed attempt at keeping state on a stateless protocol could
16:54 < krzie> its allowing the first packet, then blocking
16:54 < krzie> stop only allowing new connections
16:54 < krzie> and just allow that port
--- Log closed Mon Oct 31 16:55:58 2011
--- Log opened Mon Oct 31 16:56:14 2011
16:56 -!- ecrist [~ecrist@jaguar-2-red.claimlynx.com] has joined #openvpn
16:56 -!- Irssi: #openvpn: Total of 145 nicks [5 ops, 0 halfops, 0 voices, 140 normal]
16:56 -!- Irssi: Join to #openvpn was synced in 39 secs
16:57 < dym> im now allowing new, related and established 1194 udp - still no change.
16:57 < dym> stops at: 2011-10-31 22:57:31 MANAGEMENT: >STATE:1320098251,WAIT,,,
16:58 < dym> server says: 60064 TLS: Initial packet from [AF_INET]93.196.203.157:60064, sid=bd6ef967 fbdc0bef
16:58 < dym> and i see udp packaged beeing sent back to the client
16:58 < dym> packages*
16:59 -!- Enrique_ [be45ee73@gateway/web/freenode/ip.190.69.238.115] has quit [Ping timeout: 265 seconds]
17:03 < reiffert> udp is stateless.
17:06 < dym> Okay, still - that doesnt solve the problem
17:08 < reiffert> and your problem is? try to sum up everything into 2 sentences.
17:10 < dym> Im trying to connect to a vpn server, which fails with no apparent error message other than network failure. im tryin to determine what error this could be. http://script.quakenet.org/paste/580413
17:11 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
17:11 < reiffert> 2011-10-29 23:24:58 WARNING: file 'client1.key' is group or others accessible
17:12 < reiffert> !configs
17:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
17:12 < reiffert> openvpn version?
17:12 < dym> 2.1.3-2
17:13 < EugeneKay> Hm. Bot doesn't work in PM? I thought it did. :-/
17:13 < reiffert> seeh !configs
17:13 < dym> reiffert: http://script.quakenet.org/paste/580417
17:14 < dym> client upcoming
17:16 -!- novaflash is now known as novaflash_away
17:16 <@vpnHelper> RSS Update - forum: Has my OpenVPN connection been hacked? <http://forums.openvpn.net/topic9133.html#p17141>
17:16 < reiffert> server conf looks ok to me
17:16 < dym> reiffert: client  - http://script.quakenet.org/paste/580418
17:17 < reiffert> increase debug to 10, paste logs again
17:17 < reiffert> s,debug,verbosity,
17:17 < dym> client or server?
17:17 < dym> or both?
17:17 < reiffert> both
17:18 < dym> jesus
17:18 < dym> thats a lot of output
17:18 < reiffert> client conf looks ok to me as well
17:18 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
17:18 < reiffert> lots of output sounds promising.
17:19 < dym> ok, there goes the timeout
17:22 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:23 -!- brushbox [~brushbox@203.14.171.110] has quit [Ping timeout: 252 seconds]
17:25 < dym> reiffert: server - http://pastebin.com/z2G80PHC
17:27 < reiffert> 2011-10-31 23:18:28 us=947446 WARNING: file 'client1.key' is group or others accessible
17:27 < reiffert> fix that.
17:28 < reiffert> cd "~/Library/Application Support/Tunnelblick/Configurations/"
17:28 < reiffert> chmod go-r client1.key
17:28 -!- nongfushui [~robott@208.111.39.186] has joined #openvpn
17:28 < dym> reiffert: http://pastebin.com/cbChmWSL - client
17:28 < nongfushui> .
17:29 < reiffert> dym: interesting you are trying to run tunnelblick in mode server.
17:29 < dym> errr
17:29 < reiffert> did that ever work before?
17:29 < dym> actually server is openvpn
17:29 < dym> mhhh
17:30 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
17:30 < reiffert> you said http://pastebin.com/z2G80PHC that this is the server.
17:30 < reiffert> you can clearly see, that this gets started by tunnelblick
17:30 < dym> sorry
17:30 < dym> thats client.
17:30 < dym> im a bit mixed up
17:30 < reiffert> and that one? http://pastebin.com/cbChmWSL
17:30 < dym> server wiill be there one a bit.
17:30 < reiffert> ;)
17:30 < dym> thats client too. sorry.
17:31 < reiffert> however, fix that warning message on you OS X
17:31 < dym> did that
17:31 < dym> posting server log now
17:33 < dym> reiffert: server - http://pastebin.com/YCU4dPcp
17:34 < dym> sorry for the mixup - long day.
17:34 < reiffert> are you sure that password that is required for extracting client1.key and that comes from your keychain is a valid one?
17:35 < reiffert> bingo
17:35 < reiffert> Cannot load certificate file client.crt: error:02001002:system library:fopen:No such file or directory: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib
17:35 < reiffert> line 3.
17:35 < dym> ill retry the connection with the permission fix now
17:35 < reiffert> why does it try to load the client.crt on your server side?
17:35 < dym> not sure
17:35 < reiffert> mixing up something?
17:36 < dym> it should only validate the signing by the ca
17:36 < reiffert> ca_file = 'keys/ca.crt'
17:36 < reiffert>  dh_file = 'keys/dh1024.pem'
17:36 < reiffert> cert_file = 'keys/server.crt'
17:36 < reiffert> priv_key_file = 'keys/server.key'
17:36 < reiffert> Oct 31 23:17:54 ayu ovpn-client[613]: Cannot load certificate file client.crt: error:02001002:system library:fopen:No such file or directory: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib
17:36 < dym> oh, dont even need cert and priv key on that side, do I?
17:36 < reiffert> Oct 31 23:17:54 ayu ovpn-client[613]: Exiting
17:36 < reiffert> ah, thats still a client message.
17:37 < reiffert> Oct 31 23:17:54 ayu ovpn-client[613]
17:37 -!- aef [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
17:37 < dym> huh
17:37 < dym> ayu is the server tho 
17:38 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
17:38 < reiffert> dym: but there has been an openvpn client running on ayu
17:38 < reiffert> note that it will start every .conf file from /etc/openvpn/
17:39 < dym> okay, only see the server now
17:39 < dym> urgh
17:39 < dym> there was a client.conf
17:39 < dym> removed it now.
17:40 < reiffert> ok, set verbose level down to 5, get rid of comp-lzo
17:40 < dym> k
17:40 < reiffert> then add:
17:40 < reiffert> mssfix
17:40 < reiffert> fragment 1300
17:40 < reiffert> tun-mtu 1500
17:40 < reiffert> restart server, restart tunnelblick
17:41 < dym> to both configs, that is?
17:41 < reiffert> yup
17:41 < dym> on it
17:42 < reiffert> and again, are you sure that the password is valid that comes from your keychain?
17:42 < reiffert> remove it from the keychain. spotlight -> keychain 
17:43 < dym> cant remember 100% to be fair
17:44 < dym> argh :/ cant remember the password
17:44 < nongfushui> is default blowfish good enough? i just want max speed but reasonable security of course..
17:44 < nongfushui> can't afford slow down due to encryption
17:45 < dym> reiffert: how do i proceed? :/
17:45 < reiffert> do as told
17:45 < reiffert> 23:40 < reiffert> restart server, restart tunnelblick
17:46 < dym> done, reconnected, cant connect due to lack of password
17:46 < reiffert> congrats.
17:46 < dym> (deleted entry from keychain)
17:46 < reiffert> create a new client key then
17:46 < dym> re-create certificates
17:52 -!- Pilif12p is now known as Gorilla12p
17:56 < dym> trying...
17:57 < dym> mhh
17:57 < dym> taking long
17:57 < dym> and i get a lot of odd "W"s in the log output
17:58 < dym> TLS Handshake failed
18:03 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:04 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Quit: GOSUB w/o RETURN]
18:16 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
18:21 < dym> reiffert: made it to a selfsigned cert error
18:34 -!- brushbox [~brushbox@203.14.171.110] has quit [Read error: Connection reset by peer]
18:34 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
18:34 < nongfushui> is default blowfish good enough? i just want max speed but reasonable security of course..
18:35 < krzie> yes, likely why its default
18:35 < krzie> dym, only W'S?
18:41 < nongfushui> aes slows down the connection right?
18:42 < krzie> why dont you test it
18:47 < nongfushui> because i wouldnt know how to measure performance 
18:47 < nongfushui> too many varliables
18:47 < nongfushui> basically i just wanted to know if its only cpu time that is used up instead of bandwidth
18:58 -!- nongfushui [~robott@208.111.39.186] has quit [Ping timeout: 252 seconds]
19:00 -!- raidz is now known as raidz_afk
19:01 -!- nongfushui [~robott@208.111.39.186] has joined #openvpn
19:01 <@vpnHelper> RSS Update - forum: Error accessing NAS via OpenVPN <http://forums.openvpn.net/topic9139.html>
19:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:14 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:17 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
19:17 -!- UnterPerro_ [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:17 -!- UnterPerro_ is now known as UnterPerro
19:19 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:26 -!- Gorilla12p is now known as Pilif12p
19:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:34 -!- Denial [Denial@drgi.co.uk] has quit []
19:38 < __nolife> What is the common solution to make openvpn change routes correctly after it dropped priviledges ?
19:40 < krzie> not to change routes after it drops permissions :-p
19:40 < krzie> (you could also configure sudo to allow that user to run that command without a password)
19:40 < __nolife> isn't it default behaviour ?
19:40 < __nolife> I don't have sudo
19:40 < krzie> no, default it adds routes, then drops permissions
19:41 < __nolife> the route and ip commands are built into openvpn
19:41 < __nolife> yes but when it exits it drops the route and sets ip to 0.0.0.0
19:41 < krzie> what os?
19:41 < __nolife> and both commands fail
19:41 < __nolife> linux
19:41 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
19:41 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
19:41 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:41 -!- mode/#openvpn [+v Axeman] by ChanServ
19:41 < krzie> i take it you are using --redirect-gateway
19:41 < krzie> right?
19:41 < __nolife> I use "inactive" and ping-exit
19:41 < krzie> and redirect-gateway...?
19:42 < __nolife> it's just the default routes it creates that are removed again
19:42 < krzie> lol i understand
19:42 < __nolife> nope not used
19:42 < krzie> !configs
19:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
19:43 < __nolife> Hm I don't think it's a config problem krzie, I drop privileges using "user and group" and openvpn tries to execute "ip" and "route" when closing/exiting. Both commands will require root rights
19:44 < __nolife> http://pastebin.com/aPLTXegN
19:44 < __nolife> but here is the conf
19:45 < krzie> oh its static key
19:45 < __nolife> yea
19:45 < krzie> why not just have the route in the system no matter what
19:45 < krzie> could use a static device
19:45 < __nolife> Can I make openvpn not drop route and change IP on exit? the commands will fail and create error logs. But as it drops the "tun" interface the route and ip should be handled by kernel I think
19:46 < krzie> no, but the errors wont matter
19:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:46 < __nolife> yea but I'll have thousands of restarts a day
19:46 < __nolife> ;)
19:46 < __nolife> that will completely fill up my error logs
19:46 < krzie> verb 0?
19:46 < __nolife> hm I'll try if they are supressed at 0, good idea
19:46 < krzie> or or
19:47 < krzie> use a static device, and see if it tries to remove routes when exiting still
19:47 < __nolife> I need hundreds of devices, don't think it will work with a static one (the system is already programmed like that)
19:48 < __nolife> verb0 doesn't stop the errors, I think cause openvpns consideres them as important (as they usually are)
19:49 < krzie> welp
19:49 < krzie> if you want no logs just direct the logfile to /dev/null
19:50 < krzie> you dont actually have a problem ;]
19:50 < krzie> (oh or dont drop privs, but i still would)
19:51 < __nolife> yea I'll keep the chroot and drop ;)
19:51 < __nolife> just didn't like the idea of removing all logs, thought this particular problem is likely happening to many people
19:51 < __nolife> as anyone using a chroot will have such errors as well as anyone with droped privs
19:53 < krzie> why tons of static key setups?
19:53 < krzie> PKI would be 100x easier, and more secure
19:54 < krzie> sounds like your setup is a throwback to openvpn version 1
19:55 < __nolife> I found it easier to do with static keys, I think my setup is not standard
19:55 < __nolife> that's why I've a unique static key for each user
19:56 < krzie> whats non standard about it?
19:56 < __nolife> using hundreds of public ips
19:56 < krzie> ...and?
19:56 < krzie> you mean each user is using hundreds of pub ips?
19:56 < krzie> err each has his own...?
19:56 < __nolife> most likely just 5-10
19:57 < __nolife> but yes, up to 100s
19:57 < krzie> so for every user, you use an ip for openvpn, and one for the user, right?
19:57 < __nolife> internally i use the 10/8 ips for the users and vpn (each one IP in a /32 network)
19:58 < __nolife> but externally the public ips as described
19:58 < krzie> ahh so you bi-nat?
19:58 < __nolife> ye
19:58 < __nolife> even a bit more complex
19:58 < krzie> lol
19:58 < __nolife> as I've the ips distributed on multiple servers ;)
19:58 < krzie> well, a) with client/server you could directly hand out public ips
19:59 < krzie> b) you could use static ips for internal, and still bi-nat
19:59 < krzie> and c) youd have logical admin work, which you certainly currently dont
20:00 < __nolife> I tried to do it with client/server at first but got stuck at some point, actually don't know what the problem was anymore
20:00 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
20:02 < krzie> *shrug* use whatever makes you happy i guess
20:02 < krzie> !forwardsecurity
20:02 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
20:03 < __nolife> yea I know static keys have disadvantages but I'm less in a high anonymity scenario
20:05 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
20:06 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
20:08 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
20:08 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Excess Flood]
20:09 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
20:09 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Excess Flood]
20:16 -!- nongfushui [~robott@208.111.39.186] has quit [Read error: Connection reset by peer]
20:17 -!- nongfushui [~robott@208.111.39.186] has joined #openvpn
20:21 -!- corretico__ [~luis@200.12.40.25] has quit [Quit: Leaving]
20:21 -!- nongfushui [~robott@208.111.39.186] has quit [Read error: Connection reset by peer]
20:22 -!- nongfushui [~robott@208.111.39.186] has joined #openvpn
20:22 -!- nongfushui [~robott@208.111.39.186] has quit [Client Quit]
20:27 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
20:31 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
20:31 -!- raidz_afk is now known as raidz
20:49 -!- corretico_ [~luis@190.211.92.1] has quit [Quit: Leaving]
20:56 <@vpnHelper> RSS Update - forum: OpenVPN with Hostizzle keeps restarting <http://forums.openvpn.net/topic9140.html>
20:58 -!- raidz is now known as raidz_afk
21:04 -!- Rockfordal [~Rockford@213-21-122-220.customer.t3.se] has quit [Read error: Connection reset by peer]
21:05 -!- Rockfordal [~Rockford@213-21-122-220.customer.t3.se] has joined #openvpn
21:12 -!- Flecks [~fleck@unaffiliated/fleck] has joined #openvpn
21:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
21:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:20 -!- Flecks [~fleck@unaffiliated/fleck] has quit [Ping timeout: 240 seconds]
21:24 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:24 -!- UnterPerro_ [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:27 -!- raidz_afk is now known as raidz
21:31 -!- Rockfordal [~Rockford@213-21-122-220.customer.t3.se] has quit [Quit: Lämnar]
21:52 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
21:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
21:57 -!- UnterPerro_ [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:58 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:20 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
22:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
23:04 -!- bjorneven_ [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
23:05 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Read error: Connection reset by peer]
23:07 -!- catsup [~d@ps38852.dreamhost.com] has quit [Ping timeout: 260 seconds]
23:08 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
23:08 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
23:08 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 248 seconds]
23:08 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
23:09 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
23:11 -!- a [~d@ps38852.dreamhost.com] has joined #openvpn
23:12 -!- a is now known as Guest84953
23:18 -!- brushbox [~brushbox@203.14.171.110] has left #openvpn []
23:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:27 -!- daguz1 [~leo@99-12-165-198.lightspeed.rlghnc.sbcglobal.net] has quit [Read error: Connection reset by peer]
23:28 -!- daguz1 [~leo@99-12-165-198.lightspeed.rlghnc.sbcglobal.net] has joined #openvpn
23:39 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
23:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:50 -!- vpners [17133524@gateway/web/freenode/ip.23.19.53.36] has joined #openvpn
23:51 < vpners> how can I improve vpn connection through http-proxy?
23:53 < vpners> any ideas?
23:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
23:59 -!- vpners [17133524@gateway/web/freenode/ip.23.19.53.36] has quit [Ping timeout: 265 seconds]
--- Day changed Tue Nov 01 2011
00:00 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:03 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
00:10 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
00:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
00:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:16 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
00:46 -!- brushbox1 [~brushbox@203.14.171.110] has joined #openvpn
00:47 -!- brushbox1 [~brushbox@203.14.171.110] has quit [Client Quit]
00:52 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
00:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
01:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 244 seconds]
01:09 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 260 seconds]
01:21 <@vpnHelper> RSS Update - forum: [Resolved] Aceess local network behind OpenVPN (tun setup) <http://forums.openvpn.net/topic9138.html#p17140>
01:26 -!- swg0101 [~swg0101@openvpn/user/swg0101] has joined #openvpn
01:26 -!- mode/#openvpn [+v swg0101] by ChanServ
01:27 -!- happylife [~happylife@cs181134059.pp.htv.fi] has quit [Ping timeout: 258 seconds]
01:33 <@vpnHelper> RSS Update - forum: Possible to get access to network via a openvpn server? <http://forums.openvpn.net/topic9141.html>
01:34 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:34 -!- mode/#openvpn [+o mattock] by ChanServ
01:35  * swg0101 pokes mattock
01:45 -!- vtcN- [~vtcN@unaffiliated/thethe] has quit [Read error: Connection reset by peer]
01:53 -!- raidz is now known as raidz_afk
01:53 -!- raidz_afk is now known as raidz
02:05 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 245 seconds]
02:06 -!- raidz is now known as raidz_afk
02:06 -!- raidz_afk is now known as raidz
02:09 -!- Hut-Josef [~gustav@unaffiliated/beerbroy] has quit [Quit: ZNC - http://znc.sourceforge.net]
02:13 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:13 -!- mode/#openvpn [+o mattock] by ChanServ
02:16 -!- raidz is now known as raidz_afk
02:21 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
02:22 -!- bjorneven_ is now known as bjorneven
02:26 -!- gustav- [~gustav@vi.etcpasswd.net] has joined #openvpn
02:27 -!- gustav- [~gustav@vi.etcpasswd.net] has quit [Changing host]
02:27 -!- gustav- [~gustav@unaffiliated/beerbroy] has joined #openvpn
02:27 -!- gustav- is now known as beerbro
02:48 -!- dym [~patrick@unaffiliated/dym] has quit [Ping timeout: 260 seconds]
03:03 -!- happylife [~happylife@192.100.124.156] has joined #openvpn
03:11 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
03:13 -!- happylife [~happylife@192.100.124.156] has quit [Ping timeout: 258 seconds]
03:15 <@vpnHelper> RSS Update - forum: openvpn connecting fine, but no connectivity once connected? <http://forums.openvpn.net/topic9110.html#p17145>
03:16 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
03:17 -!- happylife [~happylife@192.100.124.156] has joined #openvpn
03:18 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Client Quit]
03:20 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:20 -!- swg0101 is now known as swg0101_away
03:25 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:26 -!- Mimiko [~mimiko@77.89.245.38] has joined #openvpn
03:27 < Mimiko> hi
03:28 -!- Azrael808 [~peter@212.161.9.162] has quit [Client Quit]
03:30 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:40 -!- novaflash_away is now known as novaflash
03:43 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
03:43 < Mimiko> !welcome
03:43 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:44 -!- happylife [~happylife@192.100.124.156] has quit [Read error: Connection reset by peer]
03:44 < Mimiko> !goal
03:44 -!- happylife [~happylife@192.100.124.156] has joined #openvpn
03:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:49 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
03:50 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
03:55 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:55 -!- mode/#openvpn [+o mattock] by ChanServ
04:01 -!- jemand [~quassel@brln-4db9a5cc.pool.mediaWays.net] has joined #openvpn
04:03 <@vpnHelper> RSS Update - forum: Error accessing NAS via OpenVPN <http://forums.openvpn.net/topic9139.html#p17146>
04:04 -!- jhp [~jhp@zeus.jhprins.org] has quit [Quit: Changing server]
04:07 -!- happylife [~happylife@192.100.124.156] has quit [Ping timeout: 260 seconds]
04:10 -!- happylife [~happylife@192.100.124.156] has joined #openvpn
04:18 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Ping timeout: 244 seconds]
04:20 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
04:36 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
04:40 <@vpnHelper> RSS Update - forum: phantom processes <http://forums.openvpn.net/topic9135.html#p17147>
04:58 <@vpnHelper> RSS Update - forum: Openvpn AS NAT not working <http://forums.openvpn.net/topic9142.html> || OpenVPN AS server error: "Not an access server" <http://forums.openvpn.net/topic9065.html#p17148>
05:10 -!- jemand [~quassel@brln-4db9a5cc.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
05:13 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
05:34 <@vpnHelper> RSS Update - forum: Possible to get access to network via a openvpn server? <http://forums.openvpn.net/topic9141.html#p17150>
05:36 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
05:40 <@vpnHelper> RSS Update - forum: VPN top 10 <http://forums.openvpn.net/topic9143.html> || Error accessing NAS via OpenVPN <http://forums.openvpn.net/topic9139.html#p17153> || map a network drive <http://forums.openvpn.net/topic9137.html#p17152> || Windows 7 64 bit Installation Fails OpenVPN 2.2.1 <http://forums.openvpn.net/topic8440.html#p17151>
05:45 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
06:10 <@vpnHelper> RSS Update - forum: [SOLVED] phantom processes <http://forums.openvpn.net/topic9135.html#p17156> || OpenVPN with Hostizzle keeps restarting <http://forums.openvpn.net/topic9140.html#p17155>
06:29 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 276 seconds]
06:29 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
07:01 -!- dazo_afk is now known as dazo
07:17 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 260 seconds]
07:17 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
07:20 -!- amero [~amero@unaffiliated/amero] has left #openvpn ["Leaving [WeeChat 0.3.5]"]
07:40 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
07:44 -!- Mimiko [~mimiko@77.89.245.38] has quit [Remote host closed the connection]
07:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:05 -!- Auree [~Auree@95-26-138-47.broadband.corbina.ru] has joined #openvpn
08:11 < Auree> Hi, I'm trying to connect to the corporate VPN, our admins provided me with a login, a password, an IP address and no information how to configure the connection. I added the following line to my config: "auth-user-pass /etc/openvpn/up.txt" (the file contains my login and password), but it's obviously not enough as I get the following message: "Options error: You must define CA file (--ca) or CA path (--capath)". I understand that I am aske
08:11 < Auree> Could somebody please help me?
08:13 <@dazo> Auree: ask your admin to provide a complete openvpn configuration file ... they should be rather static, esp. when you use --auth-user-pass ... figuring out all details without knowing anything about the server config is going to be a too tough road to climb
08:20 -!- sentor [~user@2001:4bd8:2f:26:a00:27ff:fe4b:11e4] has joined #openvpn
08:26 < Auree> dazo: Yes, I understand, that would be the best solution :) Unfortunately it's impossible right now. I would like to at least find out how to make the client work without providing CA file.
08:31 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 255 seconds]
08:32 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:32 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:32 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:32 -!- mode/#openvpn [+v Axeman] by ChanServ
08:39 -!- Mimiko [~mimiko@77.89.245.38] has joined #openvpn
08:44 -!- Mimiko [~mimiko@77.89.245.38] has quit [Remote host closed the connection]
08:54 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
08:56 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:58 -!- Twinkletoes [~chatzilla@ipv4-91-143-176-244.static.as8844.net] has joined #openvpn
09:00 < Twinkletoes> When I try to connect (through a browser) to our OpenVPN server using the external IP - after logging in OK, I keep getting the message "Do you want to allow connections to <IP>" and it keeps looping on and on
09:01 < Twinkletoes> I've configured a virtual port on our firewall, with everything destined for that port, forwarded to the OpenVPN box.
09:01 < Twinkletoes> It works if I connect to the OpenVPN box from internal, using the internal IP address, but not external
09:01 < Twinkletoes> Any ideas?
09:04 -!- sentor [~user@2001:4bd8:2f:26:a00:27ff:fe4b:11e4] has quit [Remote host closed the connection]
09:04 -!- sentor [~user@2001:4bd8:2f:26:a00:27ff:fe4b:11e4] has joined #openvpn
09:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
09:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:08 -!- master_of_master [~master_of@p57B54FFD.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
09:08 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has left #openvpn []
09:08 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
09:09 -!- master_of_master [~master_of@p57B534DA.dip.t-dialin.net] has joined #openvpn
09:10 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Client Quit]
09:10 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
09:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
09:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:23 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Read error: Connection reset by peer]
09:23 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
09:24 -!- Mimiko [~mimiko@77.89.245.38] has joined #openvpn
09:27 <@vpnHelper> RSS Update - forum: Daily Disconnection Issue <http://forums.openvpn.net/topic9144.html>
09:29 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 244 seconds]
09:30 -!- Sandbro [~fine@221.232.151.68] has joined #openvpn
09:33 <@vpnHelper> RSS Update - forum: Daily Disconnection Issue <http://forums.openvpn.net/topic9144.html#p17158>
09:36 -!- Sandbro [~fine@221.232.151.68] has quit [Quit: 离开]
09:41 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:47 <@dazo> Auree: as you haven't received any other information ... are you really sure your setup is requiring OpenVPN?  Or would it be another VPN solution?  (like pptp?)
09:47 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 244 seconds]
09:48 < Auree> dazo: I don't kno, would it be easier?
09:48 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:49 <@dazo> Auree: OpenVPN clients only works with OpenVPN servers .... pptp clients only works with pptp servers ... and the same with IPSec, and other VPNs .... so without knowing what your server uses, it will be impossible to get this to work
09:50 <@dazo> it's like finding a needle in the universe
09:51 <@vpnHelper> RSS Update - forum: Daily Disconnection Issue <http://forums.openvpn.net/topic9144.html#p17159>
09:51 < Auree> I see
09:52 < Auree> I know there are GUI clients that support many types of VPN connections
09:52 < Auree> I will try one of them then
09:52 < Auree> thanks!
09:54 -!- Auree [~Auree@95-26-138-47.broadband.corbina.ru] has left #openvpn []
09:54 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
10:05 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:06 -!- Mimiko [~mimiko@77.89.245.38] has quit []
10:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
10:10 -!- catsup [~d@ps38852.dreamhost.com] has quit [Quit: leaving]
10:11 -!- Guest84953 [~d@ps38852.dreamhost.com] has left #openvpn []
10:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:19 -!- dazo is now known as dazo_afk
10:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
10:20 <@vpnHelper> RSS Update - forum: Daily Disconnection Issue <http://forums.openvpn.net/topic9144.html#p17160>
10:22 -!- dazo_afk is now known as dazo
10:28 -!- swg0101_away is now known as swg0101
10:35 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Remote host closed the connection]
10:39 <@vpnHelper> RSS Update - forum: Daily Disconnection Issue <http://forums.openvpn.net/topic9144.html#p17161>
10:43 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Ping timeout: 244 seconds]
10:47 < reiffert> 3 -
10:47 < hyper_ch> 2 -
10:48 < EugeneKay> 1 -
10:48 < reiffert> 7exec -o echo boom | figlet
10:48 < hyper_ch> :)
10:49 < hyper_ch> reiffert: did you see that really cool link I showed krzee last night=
10:49 < EugeneKay> :(){ :|:& };:
10:51 < hyper_ch> reiffert: in case you missed it http://syhw.posterous.com/two-amusing-side-channel-attacks
10:51 <@vpnHelper> Title: Two Amusing Side Channel Attacks - syhw's posterous (at syhw.posterous.com)
10:54 < reiffert> will it make my computer explode?
10:54 < reiffert> trying eugenes stuff on iseries ...
10:54 < hyper_ch> only slightly
10:54 < EugeneKay> IT WASNT ME I SWEAR TO CHRIST
10:55 < reiffert> omg
10:55 < hyper_ch> reiffert: yes?
10:55 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
11:00 -!- Ionic [ionic@ionic.de] has joined #openvpn
11:05 < krzee> EugeneKay, you swear to E CHRIST?
11:06 < hyper_ch> krzee: he was swearing? I just thought he was calling me
11:07  * EugeneKay hides under his rock
11:09 < hyper_ch> you own a rock? that's cool
11:12 -!- raidz_afk is now known as raidz
11:12 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
11:19 -!- swg0101 is now known as swg0101_away
11:23 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 256 seconds]
11:24 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
11:29 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
11:30 -!- corretico_ [~luis@200.12.40.25] has quit [Read error: Connection reset by peer]
11:32 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
11:39 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 260 seconds]
11:39 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
11:44 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Remote host closed the connection]
11:56 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
11:57 -!- swg0101_away is now known as swg0101
11:57 -!- tjz [~pc@bb219-74-189-233.singnet.com.sg] has joined #openvpn
11:57 -!- tjz [~pc@bb219-74-189-233.singnet.com.sg] has quit [Changing host]
11:57 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
12:02 -!- tjz_ [~pc@bb219-74-189-233.singnet.com.sg] has quit [Ping timeout: 260 seconds]
12:02 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 248 seconds]
12:04 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:05 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:07 <@vpnHelper> RSS Update - forum: client inside lan can not ping a server vpn <http://forums.openvpn.net/topic9145.html>
12:09 -!- happylife [~happylife@192.100.124.156] has quit [Read error: Operation timed out]
12:16 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:16 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
12:16 -!- corretico_ [~luis@200.12.40.25] has quit [Read error: Connection reset by peer]
12:16 -!- corretico_ [~luis@190.211.92.1] has joined #openvpn
12:18 -!- novaflash is now known as novaflash_away
12:20 -!- swg0101 is now known as swg0101_away
12:23 -!- beefman [~somebody@c-24-3-208-2.hsd1.pa.comcast.net] has joined #openvpn
12:24 < beefman> i'm starting openvpn on ubuntu with config from new employer (w/ cert locations adjusted appropriately)...  it kills all my internet access.  how do i configure it to use my normal ethernet connection for everything not on the remote network?
12:24 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 240 seconds]
12:25 < hyper_ch> beefman: what do your routes look like when you start the vpn?
12:25 < beefman> how do i find that out?
12:25 < hyper_ch> if I don't know something I usually ask google
12:26 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:27 -!- novaflash_away is now known as novaflash
12:27 -!- Mimiko [~mimiko@89.28.88.177] has joined #openvpn
12:28 < beefman> hyper_ch: i ahve default first, gateway is my router, then link-local, then 192.168.1.0 w/ * for gateway, then link-local again, then a couple w/ gateway on the remote network
12:28 < hyper_ch> !paste
12:28 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
12:29 < beefman> just a minute, i'll have to come back on that machine
12:30 -!- beefman [~somebody@c-24-3-208-2.hsd1.pa.comcast.net] has quit [Quit: Leaving]
12:30 < Mimiko> nyan
12:30 < Mimiko> anyone good on linux scripts?
12:30 -!- beefman [~darin@c-24-3-208-2.hsd1.pa.comcast.net] has joined #openvpn
12:31 < beefman> hyper_ch: http://pastebin.com/M9NJ9QhL
12:31 < derekv> anyone know how windows protects the local computer account's certificate store? 
12:31 < derekv> I know the user's is protected with their password (among other things)
12:32 < hyper_ch> beefman: I don't really know anything about routes
12:32 < beefman> hyper_ch: why'd you ask what the routes look like when i started openvpn?
12:32 < hyper_ch> because the routing decides where packages will be normally routed to/through
12:32 <@dazo> beefman: this line is probably causing you routing issues ...
12:32 <@dazo> #
12:32 <@dazo> 192.168.1.0     10.8.0.117      255.255.255.0   UG    0      0        0 tun0
12:33 < hyper_ch> hi dazo
12:33 < derekv> I was all happy i got the certificate store cryptoapi thing to work then realized it doesn't hardly matter if all users/processes can read the cert when its in the local computer store.
12:33 <@dazo> as you have default gateway 192.168.1.1 ... then it will try to route default gw via the tunnel, and not your local network ... and kaboom, packets gets lost
12:33 <@dazo> hyper_ch: hey!
12:33 < beefman> dazo: i'm pretty sure i understand that.  how do i make it not set that route?
12:33 < hyper_ch> dazo: seen the side channel attack thing I posted?
12:34 <@dazo> beefman: config files? ... should be some route statements in the client config ... or pushed routes from the server
12:34 <@dazo> hyper_ch: nope
12:34 < beefman> dazo: k ty
12:34 < hyper_ch> dazo: http://syhw.posterous.com/two-amusing-side-channel-attacks
12:34 <@vpnHelper> Title: Two Amusing Side Channel Attacks - syhw's posterous (at syhw.posterous.com)
12:35 < hyper_ch> ha, I was right with the routes.. but I don't really understand how they work :)
12:35 <@dazo> :)
12:36 < derekv> there's no way to get around the key protection issue is there? either its got a passphrase, or its just sitting there... how do other vpn systems do it? 
12:37 < Mimiko> derekv: under which account openvpn is starting?
12:37 <@dazo> hyper_ch: when a packet goes via the routing table, it tries the best match approach based on destination IP ... so here any IP (default) is routed via 192.168.1.1 ... then in this case ... all traffic sent to 192.168.1.1 is being sent via 10.8.0.117 ... which again causes the routing engine to look at the default gateway ... and you have a routing loop
12:39 < derekv> Mimiko: well, still messing with it, currently have it working where i use openvpn-gui (the version that comes with the windows installer), run as administrator, the cert is stored in the local computer account
12:39 <@dazo> in fact these two lines are conflicting:
12:39 <@dazo> #
12:39 <@dazo> 192.168.1.0     10.8.0.117      255.255.255.0   UG    0      0        0 tun0
12:39 <@dazo> #
12:39 <@dazo> 192.168.1.0     *               255.255.255.0   U     1      0        0 eth0
12:39 < hyper_ch> dazo: thx
12:40 <@dazo> you're welcome!
12:40 < hyper_ch> had a look at the link I gave you?
12:40 <@dazo> Looking now :)
12:40 -!- swg0101_away is now known as swg0101
12:41 < Mimiko> derekv: there no need hide individual certificate for users from users. If openvpn will run as system, just set the ntfs permisions to only system account under which OpenVPN will run. If different users will run OpenVPN GUi from same computer, then configure OpnVPN to take certificates from users home directory.
12:41 -!- beefman [~darin@c-24-3-208-2.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
12:42 <@dazo> hyper_ch: that's pretty impressive hacking!
12:43 < hyper_ch> wasn't me :) I just stumbled accross
12:44 < derekv> Mimiko: ok 
12:44 < derekv> brb
12:44 <@dazo> hyper_ch: even though, it so sounds like something you'd see on NCIS and such likes ...
12:44 < hyper_ch> NCIS and CSI are much better
12:44 <@dazo> they can do it by recording it with a tape recorder!
12:45 < hyper_ch> I still like how they can "enhance" videos
12:45 < hyper_ch> grainy 480x320 pics
12:45 < hyper_ch> from a video into high quality digital stills where you can see all details really sharp
12:46 <@vpnHelper> RSS Update - forum: Next step after the Static Key Mini-HOWTO <http://forums.openvpn.net/topic9146.html>
12:46 <@dazo> hehehe
12:47 -!- beefman [~darin@c-24-3-208-2.hsd1.pa.comcast.net] has joined #openvpn
12:50 < hyper_ch> dazo: like https://www.youtube.com/watch?v=gF_qQYrCcns
12:50 <@vpnHelper> Title: Crime Cops - YouTube (at www.youtube.com)
12:51 < hyper_ch> if I had those skillz
12:51 < hyper_ch> I could make a fortune
12:52 -!- beefman [~darin@c-24-3-208-2.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
12:52 < hyper_ch> you could store just everything in low quality
12:52 < hyper_ch> hence massively reduce disk usage
12:52 < hyper_ch> and "enhance, enhance, enhance, enhance" upon need
12:56 -!- swg0101 [~swg0101@openvpn/user/swg0101] has left #openvpn []
12:56 < reiffert> say i to gan everybody
12:57 -!- vdrandom [von@vdrandom.org] has joined #openvpn
12:57 < vdrandom> hey there. Have problems using ifconfig-push option on my debian server
12:58 <@dazo> hyper_ch: hehehe!
12:58 < hyper_ch> dazo: watched the video?
12:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:58 <@dazo> hyper_ch: I love the "Enhance the picture!" ... and the guy does on the keyboard: qwertyuiop
12:59 < hyper_ch> zoom in on the reflection
12:59 < hyper_ch> enhance
12:59 < hyper_ch> enhance
13:00 < hyper_ch> qwertz :9
13:00 <@dazo> hyper_ch: it's american keyboard, it's qwerty ;-)
13:00 < hyper_ch> that's why enhancing is failing for me when I do the same
13:00 < hyper_ch> d'oh
13:01 < reiffert> !howto
13:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:01 < hyper_ch> reiffert: how may we be of service to you?
13:02 <@dazo> hyper_ch: he might be wondering how to drink a beer ...
13:02 < hyper_ch> that's in the howto?
13:04 <@dazo> hyper_ch: at the very bottom 
13:04 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:04 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:04 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:04 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:06 < reiffert> nah, I've got gan on #macosx, searching for the best vpn software
13:06 < reiffert> already sent an invitation to #openvpn, let's hope that he will join
13:06 <@dazo> reiffert: tell him about pptp ...
13:06 <@dazo> :-P
13:07 < hyper_ch> the only way to be secure is to unplug the computer from the interwebs and put it into your bank deposit box
13:08 < reiffert> dazo: openvpn lacks mobile device support.
13:08 < reiffert> dazo: that is: officially.
13:08 < reiffert> 19:08 < gan> Uh no.  you did not mention that yet :)   reiffert: I really  appreciate your help and input.  Thank you.  Enough :-)  I now              feel fully informed  ;-)  Well I might join #openvpn anyway.   Thanks to @Kimble too.   I'll soon take up another question so we  can chat about that instead.
13:09 < reiffert> 19:09 < reiffert> there are several caveats within the other vpn software I  didnt inform you yet :p
13:09 < hyper_ch> reiffert: like?
13:10 < reiffert> what's 3des and md4 all about
13:10 -!- gan [~gan@c-380ae055.125-11-64736c12.cust.bredbandsbolaget.se] has joined #openvpn
13:10 < reiffert> say hi to gan
13:11 < reiffert> !pptp
13:11 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
13:11 <@vpnHelper> read about why to not use pptp or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
13:11 < gan> Hi, reiffert is now going to inform me about OpenVPN's amazingness.... but I'm actually already sold on it
13:11 < gan> :)
13:12 < reiffert> !notcompat
13:12 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible or (#2) openvpn only connects to openvpn
13:12 < reiffert> !ipsec
13:12 < reiffert> !l2tp
13:12 < reiffert> !factoids search ipsec
13:12 <@vpnHelper> No keys matched that query.
13:12 < reiffert> !factoids search --values l2tp
13:12 <@vpnHelper> No keys matched that query.
13:12 < gan> Thanks, I know to stay away from PPTP.  L2TP will be more interesting though.  It is the same as IPSEC right?
13:12 < reiffert> see, when vpnhelper doesnt know about the topic, than it's bad.
13:13 < gan> Then it must be very deep knowledge
13:13 < reiffert> :)
13:13 < hyper_ch> why isn't OpenVPN using TLS?
13:13 <@dazo> OpenVPN is using TLS
13:13 < reiffert> dazo: any input why l2tp is a bad thing?
13:13 < gan> it isn't?
13:13 <@dazo> reiffert: l2tp as in IPSec?
13:13 < hyper_ch> I thought it uses SSL
13:13 < reiffert> dazo: yup
13:13 < reiffert> dazo: lacking layer2 capabilties?
13:14 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
13:14 <@dazo> hyper_ch: SSL and TLS is basically the same thing ... it's just the handshake protocol which is different ... however, openssl (and polarssl) supports TLS - so it will use that one if configured so, according to encryption config
13:15 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
13:15 <@dazo> reiffert: l2tp is not my strong side ... but the general "trouble" with IPSec is that it requires OS kernel support ... so it is much more intrusive than pure user-space VPNs, like OpenVPN
13:15 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
13:16 <@dazo> imagine a security bug in IPSec ... and the attacker have access to the complete kernel space .... With OpenVPN, it will only be the access level OpenVPN is configured to have access to
13:16 < gan> dazo: makes sense
13:16 <@dazo> with complete kernel space, that also includes full access to RAM and hardware
13:17 <@dazo> But on dedicated VPN routers, IPSec is just as good ... as the harm a security issue is more limited to what you can do on the network
13:18 < gan> reiffert:  "L2TP", considering what that acronym means, lacking Layer 2 capability doesn't seem right...  ;-)
13:18 < gan> I'm assuming it is Layer 2 Transport Protocol
13:19 < gan> dazo: insightful comments
13:19 <@dazo> gan: OpenVPN supports Layer 2 as well, if you configure it to use TAP devices ... TUN devices are on layer 3
13:19 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
13:19 <@dazo> !tunortap
13:19 -!- vdrandom [von@vdrandom.org] has left #openvpn ["Oops. I accidentally the server... is this bad?"]
13:19 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over the
13:19 <@vpnHelper> vpn or (#4) lan gaming? use tap!
13:23 < reiffert> gan: oh, l2tp then really looks like I wanna try this.
13:25 < gan> L2TP is Layer 2 Tunneling Protocol, my bad
13:26 < derekv> I was wrong anyways , you can put it in the user's certificate store and the user can "run as admin", it'll work, doesn't have to be in "local computer"'s store for that.
13:29 < gan> reiffert: L2TP+IPSEC still becomes Layer 3 though, I think.  Why 
13:29 <@dazo> that sounds reasonable
13:29 < gan> So that explains it
13:29 <@dazo> IPSec depends on L2TP for the transport layer
13:30 < gan> Yes exactly, and you don't use L2TP by itself, if you want encryption.  I got myself confused for a while
13:30 <@dazo> http://en.wikipedia.org/wiki/L2tp#L2TP.2FIPsec
13:30 <@vpnHelper> Title: Layer 2 Tunneling Protocol - Wikipedia, the free encyclopedia (at en.wikipedia.org)
13:30 < gan> dazo:  Where do you think I got my knowledge? ;)
13:30 <@dazo> :)
13:31 < gan> !wins
13:31 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
13:31  * hyper_ch heard wins eats babies
13:32 <@dazo> hyper_ch: but not using wins eats everything it sees
13:34 < gan> OK I get it.  If you *don't* have a WINS server, broadcasting is instead the way to find Samba shares, and to get that to work properly you need a Layer 2 connection
13:40 <@dazo> correct!
13:40  * dazo heads out
13:40 < hyper_ch> you leave? just like that?
13:41 -!- dazo is now known as dazo_afk
13:42 -!- p3rror [~mezgani@41.248.104.131] has joined #openvpn
13:43 -!- mick_laptop [~mick@mickweiss.com] has quit [Changing host]
13:43 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
13:45 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:46 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:49 -!- tessier [~treed@mail.copilotco.com] has quit [Changing host]
13:49 -!- tessier [~treed@kernel-panic/copilotco] has joined #openvpn
13:49 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 260 seconds]
13:50 -!- gan [~gan@c-380ae055.125-11-64736c12.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
13:50 -!- gan [~gan@c-380ae055.125-11-64736c12.cust.bredbandsbolaget.se] has joined #openvpn
13:53 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
13:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
13:55 -!- corretico_ [~luis@190.211.92.1] has quit [Quit: Leaving]
13:56 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:56 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:56 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:56 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:12 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:16 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:16 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:16 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:37 -!- happylife [~happylife@cs181134059.pp.htv.fi] has joined #openvpn
14:46 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:46 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:46 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:46 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:58 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
15:28 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
15:30 -!- MrPPS [~quassel@unaffiliated/mrpps] has quit [Ping timeout: 240 seconds]
15:30 <@vpnHelper> RSS Update - forum: Certificate based VPN <http://forums.openvpn.net/topic9147.html>
15:31 -!- MrPPS [~quassel@canyouget.in] has joined #openvpn
15:31 -!- MrPPS [~quassel@canyouget.in] has quit [Changing host]
15:31 -!- MrPPS [~quassel@unaffiliated/mrpps] has joined #openvpn
15:31 -!- gan [~gan@c-380ae055.125-11-64736c12.cust.bredbandsbolaget.se] has quit [Ping timeout: 256 seconds]
15:33 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has quit [Ping timeout: 240 seconds]
15:36 -!- Pilif12p [~Pilif12p@techessentials.org] has joined #openvpn
15:36 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
15:36 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
15:38 -!- daguz1 [~leo@99-12-165-198.lightspeed.rlghnc.sbcglobal.net] has quit [Read error: Connection reset by peer]
15:38 -!- daguz1 [~leo@99-12-165-198.lightspeed.rlghnc.sbcglobal.net] has joined #openvpn
15:39 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
15:41 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
15:41 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:44 -!- sentor [~user@2001:4bd8:2f:26:a00:27ff:fe4b:11e4] has quit [Remote host closed the connection]
15:44 -!- sentor [~user@2001:4bd8:2f:26:a00:27ff:fe4b:11e4] has joined #openvpn
15:45 -!- amero [~amero@unaffiliated/amero] has quit [Ping timeout: 240 seconds]
15:45 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
15:46 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
15:46 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
15:46 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:49 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has joined #openvpn
15:51 < nknize> anyone have any experience reverse tethering ipad using openvpn?
15:51 < nknize> err iOS
15:56 < nknize> http://pastebin.com/4dBfU2XC   I know this is something simple that I'm missing… would appreciate any help 
15:57 < nknize> http://pastebin.com/7YdBnSTG    (ifconfig on iOS)
15:59 < nknize> http://pastebin.com/PaYq3tuv  (single packet captured using wireshark)
16:00 < nknize> have an SSH tunnel setup and forwarding openvpn port 1194 from iOS localhost to server ip
16:02 < nknize> http://pastebin.com/kRpQaisu   (server.ovpn)
16:03 < nknize> http://pastebin.com/3MDMrpAB (client.ovpn)
16:04 < nknize> I'm relatively new to OpenVPN so, again, any help would be greatly appreciated
16:06 <@vpnHelper> RSS Update - forum: Max number of concurrent users for this setup <http://forums.openvpn.net/topic9148.html>
16:09 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
16:18 <@vpnHelper> RSS Update - forum: Using iptables instead of redirect-gateway in config file <http://forums.openvpn.net/topic9149.html>
16:26 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
16:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:28 -!- Mimiko [~mimiko@89.28.88.177] has quit []
16:42 < derekv> badass , i can create a key in windows certificate store and associated csr from the command line 
16:43 < derekv> upload the csr to my ca
16:43 < derekv> sign it
16:43 < derekv> download the cert
16:43 < derekv> install into windows, use it to connect
16:43 < derekv> needs a writeup when I'm done
16:44 < derekv> trying to decide how to handle file upload / download so that it can be part of a script run on the client's machine
16:45 < derekv> most convient would be an sftp server on the firewall itself, but ... hmm
16:55 -!- rich_ [~rich@12.218.82.98] has joined #openvpn
16:56 -!- rich_ [~rich@12.218.82.98] has quit [Client Quit]
16:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:57 -!- rich_ [~rsb@12.218.82.98] has joined #openvpn
17:01 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 245 seconds]
17:05 -!- Pilif12p [~Pilif12p@techessentials.org] has quit [Changing host]
17:05 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
17:10 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
17:10 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Read error: Connection reset by peer]
17:10 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
17:11 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
17:12 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
17:12 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
17:12 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
17:19 < derekv> here's an interesting idea, i could set up a limited shell account that can sign certificates, and use one time passwords,  
17:19 < derekv> the install script prompts for the password
17:20 < derekv> so someone calls me up, like yo i need vpn on this new laptop 
17:20 < derekv> i just give them the next OTP
17:20 < derekv> and now I am the weakest link =]
17:22 < derekv> if i just have a directory i poll for new csr, this limited use doesn't need read access to the ca key
17:24 -!- Denial [Denial@drgi.co.uk] has quit [Read error: Connection reset by peer]
17:24 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
17:24 -!- Denial [Denial@drgi.co.uk] has quit [Remote host closed the connection]
17:31 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
17:41 < rich_> derekv or you could just have a seperate system that sms's them the second half of a password they know
17:42 -!- SJrX is now known as SJr
17:42 < rich_> that is, they always know the first 9 characters, and the second 9 are rcvd via sms each time they try to log in.
17:44 < derekv> rich_ i'd have to associate users to telephone numbers 
17:44 < derekv> rich_ although I think if you already had that information handy, it'd be good
17:45 < derekv> i'm trying to make this be part of an automated install script
17:46 < derekv> still want some admin involvement, but minimal ... if I have them email me the CSR, i still got to get it onto the machine, one more step 
17:46 -!- fread2281 [~fread2281@70-56-141-73.albq.qwest.net] has joined #openvpn
17:46 < derekv> but if i have them upload it directly to the machine, i'm opening up one more thing on my firewall
17:47 < derekv> the other alternative is to have them upload it to some other place, just have my script on the machine pull from that place , sign and send email
17:48 < derekv> which would be good
17:50 < derekv> but then I got to sign in
17:51 < derekv> this way, i can controll access by handing out the OTP's
17:51 < derekv> in the end, its probably a toss-up
17:52 < derekv> i'm making franken-ssl-admin
17:56 -!- amero [~amero@unaffiliated/amero] has joined #openvpn
18:01 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has quit [Ping timeout: 248 seconds]
18:03 < derekv> doing anything on windows that there isn't already a pupose built utility for is fail 
18:07 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has joined #openvpn
18:14 -!- _julian [~quassel@hmbg-4d06dbee.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
18:16 -!- _julian [~quassel@hmbg-4d06ffe4.pool.mediaWays.net] has joined #openvpn
18:17 -!- novaflash is now known as novaflash_away
18:19 -!- Denial [Denial@drgi.co.uk] has quit []
18:31 -!- gyyrog [~gyyrog@adsl-99-35-9-165.dsl.klmzmi.sbcglobal.net] has joined #openvpn
18:32 -!- gyyrog [~gyyrog@adsl-99-35-9-165.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
18:37 -!- patelx [nebula@openvpn/corp/admin/patel] has joined #openvpn
18:37 -!- mode/#openvpn [+o patelx] by ChanServ
19:03 -!- raidz is now known as raidz_afk
19:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:13 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:32 -!- rich_ [~rsb@12.218.82.98] has quit [Ping timeout: 240 seconds]
19:32 < ecrist> ping krzie 
19:32 < ecrist> ping krzee
19:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:39 -!- IsilZha [~andreas@182.55.249.202] has joined #openvpn
19:59 <@vpnHelper> RSS Update - forum: Error accessing NAS via OpenVPN <http://forums.openvpn.net/topic9139.html#p17167>
20:08 -!- raidz_afk is now known as raidz
20:19 -!- adolfomaltez [~taro@190.62.226.177] has joined #openvpn
20:19 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:20 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 256 seconds]
20:20 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
20:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:22 -!- p3rror [~mezgani@41.248.104.131] has quit [Remote host closed the connection]
20:24 -!- IsilZha [~andreas@182.55.249.202] has quit [Remote host closed the connection]
20:27 -!- _julian_ [~quassel@hmbg-5f77efcb.pool.mediaWays.net] has joined #openvpn
20:31 -!- _julian [~quassel@hmbg-4d06ffe4.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
20:31 -!- raidz is now known as raidz_afk
20:32 -!- raidz_afk is now known as raidz
20:42 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
--- Log closed Tue Nov 01 20:54:47 2011
--- Log opened Tue Nov 01 20:57:08 2011
20:57 -!- ecrist [~ecrist@jaguar-2-red.claimlynx.com] has joined #openvpn
20:57 -!- Irssi: #openvpn: Total of 140 nicks [5 ops, 0 halfops, 0 voices, 135 normal]
20:57 -!- Irssi: Join to #openvpn was synced in 31 secs
21:00 -!- quadDamage [~EmperorTo@jaguar-2-red.claimlynx.com] has joined #openvpn
21:09 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:12 -!- raidz is now known as raidz_afk
21:20 -!- vtcN- [~vtcN@96-42-66-224.dhcp.roch.mn.charter.com] has joined #openvpn
21:20 -!- vtcN- [~vtcN@96-42-66-224.dhcp.roch.mn.charter.com] has quit [Changing host]
21:20 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
21:21 -!- vtcN- [~vtcN@unaffiliated/thethe] has quit [Client Quit]
21:21 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
21:27 -!- raidz_afk is now known as raidz
21:28 -!- winter [~winter@unaffiliated/winter] has quit [Ping timeout: 276 seconds]
21:28 -!- winter [~winter@host-89-230-131-125.inowroclaw.mm.pl] has joined #openvpn
21:28 -!- winter is now known as Guest2212
21:29 -!- Guest2212 [~winter@host-89-230-131-125.inowroclaw.mm.pl] has quit [Changing host]
21:29 -!- Guest2212 [~winter@unaffiliated/winter] has joined #openvpn
21:30 -!- Guest2212 [~winter@unaffiliated/winter] has left #openvpn []
21:41 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
21:49 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
22:02 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:31 -!- jkoby [~jkoby@unaffiliated/theblue] has left #openvpn []
22:32 -!- nongfushui [~robott@208.111.39.186] has joined #openvpn
22:32 < nongfushui> any idea by what magnitude aes is slower than bf?
22:32 < nongfushui> for network
22:36 -!- Guest__ [~fread2281@70-56-131-18.albq.qwest.net] has joined #openvpn
22:37 -!- fread2281 [~fread2281@70-56-141-73.albq.qwest.net] has quit [Ping timeout: 258 seconds]
22:41 < EugeneKay> nongfushui - depends upon what the limiting factor is
22:42 < nongfushui> cpu wont be limiting anything on either end
22:42 < nongfushui> just wondering if aes 'takes up more space'
22:44 < EugeneKay> Eh. Lost in the noise, IMO.
22:44 < EugeneKay> Turn on lzo and you'll never know
22:46 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
22:51 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
22:57 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has joined #openvpn
22:59 -!- Guest__ [~fread2281@70-56-131-18.albq.qwest.net] has quit [Ping timeout: 240 seconds]
23:06 -!- fread2281 [~fread2281@70-56-141-97.albq.qwest.net] has joined #openvpn
23:17 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has quit [Ping timeout: 244 seconds]
23:35 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:36 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
23:37 -!- corretico [~luis@201.201.44.82] has joined #openvpn
23:54 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 240 seconds]
--- Day changed Wed Nov 02 2011
00:03 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
00:12 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
00:14 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
00:19 -!- beerbro [~gustav@unaffiliated/beerbroy] has quit [Ping timeout: 260 seconds]
00:20 -!- gustav- [~gustav@vi.etcpasswd.net] has joined #openvpn
00:21 -!- gustav- [~gustav@vi.etcpasswd.net] has quit [Changing host]
00:21 -!- gustav- [~gustav@unaffiliated/beerbroy] has joined #openvpn
00:32 -!- networkstaff [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
00:33 < networkstaff> how do you speedup vpn connection through http proxy?
00:34 -!- networkstaff [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
01:01 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
01:15 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has left #openvpn []
01:21 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
01:21 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
01:21 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
01:36 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:55 <@vpnHelper> RSS Update - forum: Daily Disconnection Issue <http://forums.openvpn.net/topic9144.html#p17170> || Max number of concurrent users for this setup <http://forums.openvpn.net/topic9148.html#p17169> || Certificate based VPN <http://forums.openvpn.net/topic9147.html#p17168>
01:59 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:59 -!- mode/#openvpn [+o mattock] by ChanServ
01:59 -!- nongfushui [~robott@208.111.39.186] has quit [Read error: Connection reset by peer]
01:59 -!- nongfushui [~robott@208.111.39.186] has joined #openvpn
02:01 <@vpnHelper> RSS Update - forum: client inside lan can not ping a server vpn <http://forums.openvpn.net/topic9145.html#p17171>
02:02 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 244 seconds]
02:09 -!- gustav- is now known as beerbro
02:17 -!- sentor [~user@2001:4bd8:2f:26:a00:27ff:fe4b:11e4] has quit [Remote host closed the connection]
02:17 -!- sentor [~user@2001:4bd8:2f:26:a00:27ff:fe4b:11e4] has joined #openvpn
02:19 -!- nongfushui [~robott@208.111.39.186] has quit []
02:26 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Read error: Operation timed out]
02:31 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
02:31 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
02:31 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
02:41 -!- happylife [~happylife@cs181134059.pp.htv.fi] has quit [Remote host closed the connection]
02:43 <@vpnHelper> RSS Update - forum: client inside lan can not ping a server vpn <http://forums.openvpn.net/topic9145.html#p17172>
02:45 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
02:46 < vpnuser> how can we speed up vpn connection that is using http-proxy option?
02:51 < vpnuser> help guys
02:51 -!- Mimiko [~mimiko@77.89.245.38] has joined #openvpn
02:51 < vpnuser> Mimiko can you help me here!
02:51 < Mimiko> how?
02:52 < vpnuser> how can we speed up vpn connection that is using http-proxy option?
02:52 < Mimiko> disable comp-lzo and see if it is going better
02:52 < Mimiko> is this a routed or bridged connection?
02:53 < vpnuser> routed
02:53 < vpnuser> i tried disabled comp-lzo, but no significant progress
02:53 -!- adolfomaltez [~taro@190.62.226.177] has quit [Ping timeout: 240 seconds]
02:54 < Mimiko> disable also cipher
02:54 < vpnuser> Mimiko, do you think that such proxy uses traffic shaping to minimize connection speed?
02:54 < Mimiko> disable any compresion and encoding algorithm
02:55 < Mimiko> oh, the proxies are made for shaping and limiting traffic
02:55 < vpnuser> is that possible?
02:55 < Mimiko> you even can not indicate any proxy anywhere but still go thru a hidden proxy
02:55 < vpnuser> what do you mean about that?
02:56 < Mimiko> at work I use hidden proxy to limit bandwith to users how start to download a lot
02:56 < Mimiko> the dont know that I use proxy
02:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
03:01 < vpnuser> hidden proxy? do you create such hidden proxy or just get one from googling?
03:03 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
03:06 < Mimiko> linux has such an app that you install with firewall also
03:06 < Mimiko> most serious firewalls on windows has built in proxy server that can be used as hidden also
03:11 < vpnuser> so if the proxy provider is limiting traffic then there is nothing I can do to improve the vpn which is using such http proxy?
03:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:12 -!- adolfomaltez [~taro@190.62.226.177] has joined #openvpn
03:16 <@vpnHelper> RSS Update - forum: Error accessing NAS via OpenVPN <http://forums.openvpn.net/topic9139.html#p17174> || Next step after the Static Key Mini-HOWTO <http://forums.openvpn.net/topic9146.html#p17173>
03:18 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
03:23 -!- nongfushui [~robott@208.111.39.186] has joined #openvpn
03:24 < nongfushui> im curious, i have a vpn setup and running with push redirect gateway in server.conf... all ip is going through it nicely but ssh is not 
03:24 < nongfushui> why ssh wont go through the vpn?
03:24 < nongfushui> wireshark shoes tcp packets
03:24 < Olipro> either you have a DNAT rule for SSH
03:25 < Olipro> or it's simply the IP of the host having an explicit/more specific route
03:26 < nongfushui> i have neither
03:27 < nongfushui> must be some setting on my win 7 client laptop
03:28 <@vpnHelper> RSS Update - forum: Daily Disconnection Issue <http://forums.openvpn.net/topic9144.html#p17175>
03:29 < nongfushui> or probably i'd need routed not bridged to stop it happening
03:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
03:31 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:32 < Mimiko> vpnuser - yes, nothing can be done
03:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:36 -!- kyrix [~ashley@mk046207255139.a1.net] has joined #openvpn
03:46 <@vpnHelper> RSS Update - forum: client inside lan can not ping a server vpn <http://forums.openvpn.net/topic9145.html#p17176>
03:56 -!- happylife [~happylife@213.28.38.234] has joined #openvpn
04:04 -!- nongfushui [~robott@208.111.39.186] has quit [Ping timeout: 245 seconds]
04:07 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:21 -!- novaflash_away is now known as novaflash
04:43 -!- nongfushui [~robott@208.111.39.186] has joined #openvpn
04:44 -!- dazo_afk is now known as dazo
04:54 -!- nongfushui [~robott@208.111.39.186] has quit [Ping timeout: 252 seconds]
05:08 -!- dpetrek [~kvirc@93-139-136-20.adsl.net.t-com.hr] has joined #openvpn
05:09 < dpetrek> hi
05:09 < dpetrek> i have problem with exporting openvpn client install packages
05:09 < dpetrek> there is one openvpn server defined
05:10 < dpetrek> one openvpn client defined
05:10 -!- happylife [~happylife@213.28.38.234] has quit [Ping timeout: 258 seconds]
05:10 < dpetrek> client export sees two install packages to export
05:11 < dpetrek> when i try to download windows installer, "could not find a valid certificate. failed to export config files" appears
05:11 < dpetrek> hi
05:12 -!- ARC_ [5bbb4502@gateway/web/freenode/ip.91.187.69.2] has joined #openvpn
05:12 < ARC_> Hi
05:12 -!- ARC_ is now known as Guest87136
05:15 -!- happylife [~happylife@213.28.38.234] has joined #openvpn
05:17 <@vpnHelper> RSS Update - forum: My connection it's continuously resetting <http://forums.openvpn.net/topic9150.html>
05:17 -!- Guest87136 [5bbb4502@gateway/web/freenode/ip.91.187.69.2] has quit [Quit: Page closed]
05:25 -!- Perun_ [perun@chao5.net] has joined #openvpn
05:28 -!- mete- [~mete@mete.shell.la] has joined #openvpn
05:29 -!- Netsplit *.net <-> *.split quits: zu, pwrcycle, Denial, aef_, MrWGW, kloeri, rkantos, krzie, master_of_master, caemir,  (+19 more, use /NETSPLIT to show all of them)
05:30 -!- Netsplit *.net <-> *.split quits: APTX_, R-66Y, chantra, Optic, ScriptFanix, meepmeep, corretico, fahadsadah, vtcN-, mete,  (+79 more, use /NETSPLIT to show all of them)
05:32 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
05:34 -!- Netsplit over, joins: GHAI
05:34 -!- Netsplit over, joins: openbsdnoob, nifiga, sobersabre, takamichi, Mowee
05:34 -!- Gud_ [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
05:34 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
05:34 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
05:34 -!- Netsplit over, joins: Denial, kyrix, ScriptFanix, Azrael808, adolfomaltez, Mimiko, sentor, mattock, beerbro, fread2281 (+1 more)
05:34 -!- quadDamage [~EmperorTo@jaguar-2-red.claimlynx.com] has joined #openvpn
05:34 -!- Netsplit over, joins: oc80z, MrPPS, aef_, @patelx, amero, caemir, daguz1, Pilif12p, amir, cyberspace- (+17 more)
05:34 -!- ServerMode/#openvpn [+oo mattock patelx] by verne.freenode.net
05:34 -!- Netsplit over, joins: tessier, dazo, derekv, deever, pwrcycle, MrWGW, novaflash, pa, dvl, zalzice (+1 more)
05:34 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
05:34 -!- Netsplit over, joins: LowKey, Xeross, nb, dxtr, _zero_, fremo_, fahadsadah, chantra, __nolife, RichardBronosky (+24 more)
05:34 -!- ServerMode/#openvpn [+oo dazo cron2] by verne.freenode.net
05:34 -!- Netsplit over, joins: krphop, Essobi, agagag, DeathWolf, R-66Y, caesay, bragon
05:34 -!- Blue_Ice [~Blue_Ice@sid.dupas.be] has joined #openvpn
05:34 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
05:34 -!- Netsplit over, joins: spditner
05:34 -!- freaky[t] [alpha@freakyonline.de] has joined #openvpn
05:34 -!- Netsplit over, joins: peper
05:34 -!- nickzxcv [~nick@schmalenberger.us] has joined #openvpn
05:34 <@vpnHelper> RSS Update - forum: My connection it's continuously resetting <http://forums.openvpn.net/topic9150.html#p17178>
05:34 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
05:35 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
05:37 -!- corretico [~luis@201.201.44.82] has joined #openvpn
05:43 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
05:51 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
05:57 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 258 seconds]
05:58 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
05:58 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:59 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
06:00 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
06:00 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has quit [Ping timeout: 240 seconds]
06:01 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
06:02 -!- mode/#openvpn [+v novaflash] by ChanServ
06:03 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
06:06 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
06:06 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
06:09 <@vpnHelper> RSS Update - forum: Get your website created by a creative and professional webs <http://forums.openvpn.net/topic9151.html>
06:10 -!- LnL [~LnL@d54C4D870.access.telenet.be] has joined #openvpn
06:15 -!- boeuf [~detys@193.48.172.167] has joined #openvpn
06:15 < boeuf> Hi
06:16 < boeuf> anyone managed to get openvpn to tunnel through stunnel?
06:16 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
06:19 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
06:20 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Client Quit]
06:20 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
06:21 < krzee> lol why bother
06:21 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Client Quit]
06:21 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
06:23 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Client Quit]
06:23 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
06:24 <@dazo> boeuf: wtf!?!?  why!??!
06:25  * havoc has, accidentally ;)
06:26 <@dazo> IIRC, stunnel only supports tunnelling TCP ... so you're forced to use TCP in the OpenVPN config ... and then when the OpenVPN tunnels TCP traffic ... you'll get TCP-in-TCP-in-TCP .... why not tunnel that traffic through a SSH port forwarding in addition!
06:27 <@dazo> That's not going to be an efficient tunnel
06:27 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
06:27 < havoc> not to mention additional complications if you're pushing routes
06:28 <@dazo> changing default routes will be tricky ... but otherwise, it's not so much complicated :)
06:28 < havoc> my servers all listen on udp:1194 and tcp:443, with redir-gw on tcp:443
06:28 <@dazo> ahh, yeah, that's raising the bar a bit more
06:28 < havoc> if you connect the redir first, then the udp it's a tunnel in a tunnel
06:28 < havoc> dazo: accidental only
06:28 <@dazo> :)
06:28 < havoc> dazo: I have my uses w/ both configs
06:29 < havoc> I had to tell them only use one or the other, never both ;)
06:29 <@dazo> havoc: don't use rm on those files ... use shred -n1000 ... those should not see the day of light!
06:29 < havoc> we need the tcp:443 w/ redir for some hotels and client sites
06:29 < havoc> but not redirecting is more effecient
06:30 < havoc> so they need both depending on location
06:31 < havoc> they especially love the redir when they're over seas
06:34 < havoc> I'm tempted to try bridging tap0/tap1 (udp:1194/tcp:443) to effectively have a single internal iface (br0) for ovpn listening on two ports
06:34 < havoc> when I have time :(
06:35 < havoc> the issue is that they're not static ifaces, linux bridging may not work so well with that
06:39 <@vpnHelper> RSS Update - forum: client inside lan can not ping a server vpn <http://forums.openvpn.net/topic9145.html#p17180>
06:45 <@vpnHelper> RSS Update - forum: Error accessing NAS via OpenVPN <http://forums.openvpn.net/topic9139.html#p17181> || Difference between TUN & TAP interfaces <http://forums.openvpn.net/topic9038.html#p16975>
06:53 -!- websearcher [17133524@gateway/web/freenode/ip.23.19.53.36] has joined #openvpn
06:56 < websearcher> is the purpose of http proxy is to limit traffic?
06:56 < krzee> no
06:56 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
06:57 < krzee> firewalls are for that
07:00 < websearcher> krzee, my isp blocked udp and tcp on direct connection but only allows tcp connection through their proxy. is there a work around with this so that I wont need to use their http proxy that is really slow.
07:00 < krzee> only if they messed up
07:01 < krzee> try this:
07:01 < krzee> host google.com 8.8.8.8
07:01 < krzee> if that works, try using port udp 53
07:02 < websearcher> where to put host google.com 8.8.8.8 ? server config?
07:02 < krzee> lol
07:02 < krzee> its a command
07:02 < krzee> but now im guessing you use windows
07:02 < websearcher> :)
07:02 < websearcher> hehehe
07:02 < websearcher> yes Im on windows
07:03 < krzee> from the windows cmd prompt type:
07:03 < krzee> nslookup google.com 8.8.8.8
07:04 < websearcher>  C:\Documents and Settings\User01>nslookup google.com 8.8.8.8 DNS request timed out.     timeout was 2 seconds. *** Can't find server name for address 8.8.8.8: Timed out Server:  UnKnown Address:  8.8.8.8  DNS request timed out.     timeout was 2 seconds. DNS request timed out.     timeout was 2 seconds. *** Request to UnKnown timed-out  C:\Documents and Settings\User01>
07:04 < websearcher> that was the result
07:04 < krzee> you're gunna need to use the http-proxy, or ask the admin to allow what you need
07:05 < websearcher> I have no choice then?
07:05 < krzee> that sounds rather repetitive, my last statement was clear
07:05 < websearcher> what is the best reason that will grant me for udp 53?
07:06 < krzee> udp 53 is dns, if they directly allowed that you could piggy-back =
07:06 < krzee> but they didnt, so they prolly didnt leave anything else
07:06 < krzee> talk to the admin or live with http-proxy, theres nothing we can do for you
07:07 < websearcher> ok. thanks krzee.  what could be the reason why using they http-proxy make the connection really slow while you said that only the firewall can do such limiting of traffic.
07:08 < krzee> tcp over tcp over tcp
07:08 < krzee> !tcp
07:08 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
07:08 < krzee> read the links to understand
07:10 < websearcher> is tcp-nodelay only for server conf only?
07:11 < krzee> read manual
07:11 < krzee> !man
07:11 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
07:11 < websearcher> krzee, is openvpn supports ppp?
07:13 < krzee> wtf?
07:13 -!- LuckyY [~LuckY@188.142.61.123] has joined #openvpn
07:17 -!- websearcher [17133524@gateway/web/freenode/ip.23.19.53.36] has quit [Quit: Page closed]
07:23 -!- dpetrek [~kvirc@93-139-136-20.adsl.net.t-com.hr] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.2 Shiny http://www.kvirc.net]
07:23 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
07:25 <@vpnHelper> RSS Update - forum: Max number of concurrent users for this setup <http://forums.openvpn.net/topic9148.html#p17182>
07:26 -!- boeuf [~detys@193.48.172.167] has quit [Ping timeout: 240 seconds]
07:32 -!- networkasst [17133524@gateway/web/freenode/ip.23.19.53.36] has joined #openvpn
07:35 -!- networkasst [17133524@gateway/web/freenode/ip.23.19.53.36] has left #openvpn []
07:36 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
07:38 -!- LnL [~LnL@d54C4D870.access.telenet.be] has left #openvpn ["[lnl release];"]
07:45 < __nolife> The system time is important when it comes to encryption with openvpn, is that right ?
07:47 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
07:48 < hyper_ch> __nolife: what makes you think so?
07:49 < __nolife> changing time on server seems to cause the connection to stop working
07:49 < hyper_ch> changing time on servers can cause all kind of things
07:51 < __nolife> like what else ?
07:51 < __nolife> mainly I just wanter to make sure that's the issue. that the time is part of the encryption protocol
07:52 < Blue_Ice> __nolife: changing time a few hours, or just the date entirely?
07:54 < __nolife> a few hours seems to be enough
07:54 <@vpnHelper> RSS Update - forum: client inside lan can not ping a server vpn <http://forums.openvpn.net/topic9145.html#p17184> || Max number of concurrent users for this setup <http://forums.openvpn.net/topic9148.html#p17183>
07:58 < __nolife> I'll try disable replay protection, maybe that removes the time
08:10 < krzee> it is important, you cant disable it when using certs
08:18 < ecrist> krzee see your pm
08:21 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:29 <@vpnHelper> RSS Update - forum: Max number of concurrent users for this setup <http://forums.openvpn.net/topic9148.html#p17185>
08:32 <@dazo> __nolife: synchronised timing is very important in encryption ... it can be different time zones and such stuff ... but if the clock jumps during an established connection, the tunnel will be re-negotiated
08:33 <@dazo> the date/timestamp is also used to check if certificates are valid or have expired
08:36 < __nolife> re-negotiation isn't an issue as long as it means the user doesn't see anything
08:36 < __nolife> my case is a bit special
08:37 < __nolife> I've multiple openvpn servers running and I'm connecting to all of them (not at the same time of course) in "one session" using the same established connection and client
08:37 -!- fread2281 [~fread2281@70-56-141-97.albq.qwest.net] has quit [Ping timeout: 240 seconds]
08:38 < __nolife> so even the time drift between the server plays a role
08:41 -!- fread2281 [~fread2281@70-56-134-51.albq.qwest.net] has joined #openvpn
08:48 <@vpnHelper> RSS Update - forum: client inside lan can not ping a server vpn <http://forums.openvpn.net/topic9145.html#p17186>
08:53 < krzee> personally i have ntpdate in my crontab
08:53 <@vpnHelper> RSS Update - forum: licensing.openvpn.net not found <http://forums.openvpn.net/topic9152.html>
09:00 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has quit [Ping timeout: 240 seconds]
09:00 -!- bigon [bigon@ubuntu/member/bigon] has quit [Ping timeout: 240 seconds]
09:01 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
09:01 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
09:01 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
09:01 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
09:06 <@vpnHelper> RSS Update - forum: Star Topolgy - passing routes to all remote servers <http://forums.openvpn.net/topic9052.html#p17189> || client inside lan can not ping a server vpn <http://forums.openvpn.net/topic9145.html#p17188>
09:07 -!- bigon [bigon@ubuntu/member/bigon] has quit [Ping timeout: 240 seconds]
09:07 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has quit [Ping timeout: 240 seconds]
09:07 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
09:07 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
09:07 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
09:08 -!- master_of_master [~master_of@p57B534DA.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
09:08 -!- ro_Ot [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
09:10 -!- master_of_master [~master_of@p57B539A7.dip.t-dialin.net] has joined #openvpn
09:13 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
09:17 -!- boeuf [~detys@193.48.172.168] has joined #openvpn
09:24 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
09:24 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
09:24 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:24 -!- mode/#openvpn [+v Axeman] by ChanServ
09:52 -!- Mimiko [~mimiko@77.89.245.38] has quit []
10:02 <@dazo> __nolife: time drift may play a role, depending on how much it drifts ... a few ms now and then might not be a problem ... but if it drifts many ms every day in one direction (only increasing or decreasing), it might be cause more issues ... but running ntpd is advisable, to not 
10:02 <@dazo> ntpdate during boot, and then ntpd in the background afterwards
10:05 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has quit [Ping timeout: 248 seconds]
10:09 < hyper_ch>  http://arstechnica.com/open-source/news/2011/11/two-decades-of-productivity-vims-20th-anniversary.ars  :)
10:09 <@vpnHelper> Title: Two decades of productivity: Vim's 20th anniversary (at arstechnica.com)
10:26 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:27 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
10:29 -!- Axeman2 [~Axeman3@198.105.46.46] has joined #openvpn
10:29 -!- Axeman2 [~Axeman3@198.105.46.46] has quit [Changing host]
10:29 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:29 -!- mode/#openvpn [+v Axeman2] by ChanServ
10:31 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
10:31 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 276 seconds]
10:31 -!- toortog [~toortog@38.111.17.107] has quit [Read error: Operation timed out]
10:32 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
10:32 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
10:32 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
10:32 < derekv> how old is vi then?
10:34 <@dazo> derekv: ehm ... 20 years?
10:35 <@dazo> From the article: "The Vim text editor was first released to the public on November 2, 1991—exactly 20 years ago today. "
10:38 < hyper_ch> vi!= vim
10:38 < hyper_ch> "The vi text editor was originally created in the late ’70s by Bill Joy, an early BSD developer who later went on to cofound Sun Microsystems."
10:38 <@dazo> ahh, well the article explains that as well ....
10:39  * dazo should probably go home to get some dinner
10:39 -!- raidz is now known as raidz_afk
10:39 < krzee> dazo: NO SOUP FOR YOU
10:40 <@dazo> krzee: then I'm going to get grumpy and add extra bugs into openvpn!
10:40 < krzee> sweet! new features!
10:40 <@dazo> exactly!
10:40 < krzee> --crash-random
10:40 <@dazo> --you-wish-this-wont-crash
10:40 < krzee> --script-noexec
10:40 <@dazo> --nop
10:41 < krzee> --route-break
10:41 <@dazo> --disable-clear-text-parallel-transmit
10:42 < krzee> --dns-nowork
10:42 < krzee> --cipher XOR
10:42 < krzee> lol
10:43 <@dazo> hehe
10:43 <@dazo> --blame-krzee-mode
10:43 < krzee> hrm, thats the wrong order!
10:43 < krzee> !blame
10:43 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
10:43 < krzee> oh right, you reserved the right to blame *
10:43 < krzee> lol
10:44 <@dazo> heh :)
10:45  * dazo heads out to get some fresh air and do some shopping :)
10:45 < hyper_ch> dazo: I thought you wanna go home and eat something
10:45 < hyper_ch> you change your opinion more often than your panties?
10:45 <@dazo> hyper_ch: details ... just realised I need to shop before eating ;-)
10:46 <@dazo> c'yall!
10:46 -!- dazo is now known as dazo_afk
10:48 -!- hyper_ch was kicked from #openvpn by vpnHelper [hi]
10:48 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
10:48 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has joined #openvpn
10:50 -!- happylife [~happylife@213.28.38.234] has quit [Ping timeout: 248 seconds]
10:51 -!- fread2281 [~fread2281@70-56-134-51.albq.qwest.net] has quit [Ping timeout: 258 seconds]
10:52 -!- fread2281 [~fread2281@70-56-131-245.albq.qwest.net] has joined #openvpn
10:58 -!- happylife [~happylife@213.28.38.234] has joined #openvpn
11:03 -!- raidz_afk is now known as raidz
11:12 <@vpnHelper> RSS Update - forum: Certificate Authentication with LDAP/AD <http://forums.openvpn.net/topic9153.html>
11:17 -!- sentor [~user@2001:4bd8:2f:26:a00:27ff:fe4b:11e4] has quit [Remote host closed the connection]
11:19 < jeev> got a place of business, direct connection to an https target sucks, it drops (through their POS cloud system) so i had to route through openvpn to make it stable.
11:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
11:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:42 <@vpnHelper> RSS Update - forum: Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html>
11:58 -!- fread228_ [~fread2281@70-56-210-191.albq.qwest.net] has joined #openvpn
11:59 -!- fread2281 [~fread2281@70-56-131-245.albq.qwest.net] has quit [Ping timeout: 245 seconds]
12:01 -!- fread2281 [~fread2281@70-56-141-166.albq.qwest.net] has joined #openvpn
12:02 < nknize> Uggghhhh.. Been wrestling with the same problem for a few days now… I would REALLY REALLY appreciate any assistance… I'll throw it out there and let folks chew on it.. 
12:02 < nknize>  I have an OpenVPN client (10.8.0.50) connecting to an OpenVPN server (10.8.0.1) over TCP…. I have a webserver running on a second machine (192.168.1.201).. I open a browser on the VPN client.. and try to navigate directly to 192.168.1.201… Monitoring wireshark shows the http request being sent from 10.8.0.50 to 192.168.1.201…. and a response is sent from 192.168.1.201 back to 10.8.0.50… but the VPN client never receives itâ€
12:03 -!- fread228_ [~fread2281@70-56-210-191.albq.qwest.net] has quit [Ping timeout: 248 seconds]
12:04 < nknize> VPN client continues to send request… and eventually times out.   It seems it is a routing issue, but I'm not an OpenVPN or routing expert.. again, would appreciate ANY help or thoughts
12:04 -!- fread228_ [~fread2281@70-56-131-169.albq.qwest.net] has joined #openvpn
12:05 -!- fread2281 [~fread2281@70-56-141-166.albq.qwest.net] has quit [Ping timeout: 240 seconds]
12:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:08 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
12:09 < EugeneKay> !configs
12:09 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
12:09 -!- fread228_ [~fread2281@70-56-131-169.albq.qwest.net] has quit [Ping timeout: 256 seconds]
12:09 < EugeneKay> And where are you running wireshark?
12:09 < EugeneKay> And please, fix whatever UTF wonkiness you have going on
12:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:13 < nknize> pastebin.com/ehkcEQ5k  (server.ovpn)
12:14 < EugeneKay> "with comments removed"
12:17 < nknize> pastebin.com/WvnZHutf (server.ovpn)
12:20 < nknize> pastebin.com/sXVTM4
12:20 < EugeneKay> You appear to be running the Server on Windows.
12:20 < nknize> (whoops… forget that last pastebin)
12:20 < nknize> correct
12:21 < nknize> pastebin.com/sXVTM40P
12:21 < EugeneKay> I assume you're aware of the reasons why this is a bad idea, and will understand if I go hide under my rock.
12:22 < nknize> I have no choice… this configuration is going to a client that only has a windows box to run OpenVPN
12:22 < nknize> I can suggest they purchase a new server or reconfigure an old.. but that won't be very cost effective for them
12:23 < krzee> EugeneKay, why is it a bad idea?
12:23 < nknize> to answer the first part of your assumption… I'm not an OpenVPN expert so I don't know why its a bad idea
12:23 < EugeneKay> Because Windows
12:23 -!- fread2281 [~fread2281@70-56-209-194.albq.qwest.net] has joined #openvpn
12:23 < krzee> openvpn runs just fine on windows
12:24 < krzee> !goal
12:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:24 < nknize> I would like to access the lan behind the server and access the internet over my vpn
12:24 < EugeneKay> Windows is a great desktop OS. But I'm an anti-MS-server bigot, remember?
12:25 < EugeneKay> That said.... it's gonna be a firewall or a routing or both issue
12:25 < EugeneKay> It always is
12:25 < krzee> oh
12:25 < krzee> !winnat
12:25 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows or (#2) http://www.nanodocumet.com/?p=14 for windows XP
12:25 < krzee> EugeneKay is right, this would be much easier in unix
12:26 < nknize> it resembles a routing issue… but the routing tables look correct per those two links… 
12:26 < krzee> EugeneKay, dont get me wrong, i dont use windows AT ALL
12:26 < krzee> in fact
12:26 < krzee> !windows
12:26 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
12:26 < nknize> I agree it would be easier… but I don't have that luxury with this client...
12:26 < krzee> however, if the admin *knows* windows then its fine for openvpn
12:26 < EugeneKay> I think we're basically in agreement, krzee :-p
12:27 < krzee> i subscribe to this school of thought:
12:27 < krzee> !bestos
12:27 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
12:27 < EugeneKay> I don't think anybody here has the Windows expertise to be able to help you debug NAT for a vpn server.
12:27 < EugeneKay> Sorry
12:28 < nknize> I'm not sure this requires anything other than routing table expertise...
12:28 < krzee> all you need for the routing table is:
12:29 < krzee> !def1
12:29 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:29 < krzee> and !route
12:29 < krzee> !route
12:29 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
12:29 < krzee> depending
12:29 < krzee> you mentioned sharing lans, which lans?
12:29 < krzee> just behind the server?
12:29 < nknize> yes.. just behind the server…
12:29 < krzee> ok well your nat rule will take care of everything anyways
12:29 < krzee> so ignore !route
12:30 < krzee> you need:
12:30 < krzee> !winipforward
12:30 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
12:30 < krzee> !winnat
12:30 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows or (#2) http://www.nanodocumet.com/?p=14 for windows XP
12:30 < krzee> !def1
12:30 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:30 -!- fread2281 [~fread2281@70-56-209-194.albq.qwest.net] has quit [Ping timeout: 256 seconds]
12:30 < krzee> thats the routing expertise... now good luck to ya =]
12:30 < EugeneKay> What would he need def1 for? Just after over-vpn access to the server's LAN
12:30 < krzee> EugeneKay, not what he said
12:30 < krzee> [13:24]  <krzee> !goal
12:30 < krzee> [13:24]  <vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:30 < krzee> [13:24]  <nknize> I would like to access the lan behind the server and access the internet over my vpn
12:31 < nknize> pastebin.com/YEi79i29 (windows routing table.. Note: I see nothing re: 10.8.0.1)
12:31 < EugeneKay> Ah, missed it
12:31 < krzee> nknize, what os?
12:31 < krzee> win what
12:31 < krzee> !logs
12:31 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
12:32 < nknize> xp pro sp 2  (don't judge ;-) … its a clients machine  )
12:32 < krzee> if he only needed server lan it would be no more difficult than linux or bsd, in fact other than the ipforwarding (easy) it would be the same
12:32 < krzee> xp is the last windows that i used
12:33 < krzee> awaiting logs, i already know the problem
12:33 < krzee> but it could be one of a few
12:33  * krzee bets "route addition by apapi failed"
12:34 < EugeneKay> I underestimated your MS knowledge, for somebody who doesn't use Windows
12:34 < krzee> you started openvpn as admin, right?
12:34 < nknize> pastebin.com/Rjm1VPkK  (while I get the logs here's the client routing table) 
12:34 < nknize> I did
12:34 < krzee> EugeneKay, i havnt used windows in like 7 or 8 years, before that i setup active directory and all that BS for clients
12:35 < krzee> and what i was just saying wasnt windows knowledge, it was openvpn knowledge, which i gained by being here helping for so long
12:35 < krzee> i didnt ask for your routing table
12:35 < krzee> i asked for the logfile
12:36 -!- boeuf [~detys@193.48.172.168] has quit []
12:36 < krzee> also, what are you talking about
12:36 < krzee> [13:31]  <nknize> pastebin.com/YEi79i29 (windows routing table.. Note: I see nothing re: 10.8.0.1)
12:36 < krzee> 10.8.0.1/32        10.8.0.49          UGSc        0        0   ppp0
12:36 < krzee> and also, wtf is up with "ppp0"
12:36 -!- fread2281 [~fread2281@70-56-134-203.albq.qwest.net] has joined #openvpn
12:36 < nknize> yeah.. I saw that...
12:36 < nknize> re: the 10.8.0.1
12:36 < nknize> ppp0 is a secure tunnel from an iPad
12:37 < nknize> the client is not another computer...
12:37 < krzee> ahh their hack
12:37 < krzee> got ya
12:37 < krzee> tunemu hack
12:37 < nknize> yes
12:37 < krzee> so that was the ipad routing table... and i had asked for logfile for windows machine
12:38 < krzee> which i cant help you more without
12:38 < nknize> nknize  12:34 http://pastebin.com/Rjm1VPkK  (while I get the logs here's the client routing table)
12:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:38 < krzee> i dont care about the routing table
12:38 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
12:39 < nknize> I'm getting the logs… have to reset the configuration… which requires an iPad reboot… hang on
12:39 < krzee> dont worry ill ask for what i want to look at
12:39 < venom00> hello, I've a kernel without tun/tap support, is there a way to use openvpn?
12:39 < krzee> i just need windows logs
12:39 < krzee> thats where your issue it'
12:39 < krzee> is*
12:39 -!- happylife [~happylife@213.28.38.234] has quit [Ping timeout: 240 seconds]
12:39 < venom00> (linux kernel)
12:39 < nknize> do you not care about the connection?  just start up?
12:39 < krzee> venom00, yes, by recompiling your kernel to have tuntap
12:39 < krzee> correct
12:40 < venom00> krzee, it's not that simple, I don't have the recent source code, it's difficult to obatain it from the producer
12:41 < venom00> he relased an old vesion
12:41 < krzee> venom00, sorry bout your luck, openvpn requires tuntap
12:41 < nknize> pastebin.com/vAZrC3eH (server startup log)
12:41 < venom00> I see, do you know viable alternatives to openvpn which doesn't?
12:42 < krzee> venom00, no
12:42 < venom00> OK, thanks anyway
12:42 < krzee> nknize, 
12:42 < krzee> !winroute
12:42 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file or (#2) many users also report it helps to add route-delay to give the interface extra time to get up or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access or (#4) make sure you are running openvpn as admin or (#5) http://openvpn.net/index.php/open-
12:42 <@vpnHelper> source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
12:43 < krzee> nknize, put this in your windows config:
12:43 < krzee> route-method exe
12:43 < krzee> also add:
12:43 < krzee> route-delay
12:43 < krzee> then start again and post the log
12:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:45 < nknize> pastebin.com/s2MQhiah 
12:46 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
12:49 < krzee> lemme see your server config
12:49 < krzee> ahh nm just found it above
12:49 < krzee> push "route 192.168.1.0 255.255.255.0"
12:49 < krzee> route 192.168.0.0 255.255.255.0
12:49 < krzee> wtf is that?
12:50 < krzee> remove both
12:50 < krzee> why are you using proto tcp?
12:50 < krzee> !tcp
12:50 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
12:50 < krzee> what do you think ipp.txt does?
12:50 < krzee> !ipp
12:50 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
12:51 < nknize> regarding your questions about push "route:    http://forums.openvpn.net/topic7392.html    from a response you gave to someone about sharing internet connection in windows…
12:51 <@vpnHelper> Title: OpenVPN Support Forum Internet Connection Sharing with openvpn : Server Administration (at forums.openvpn.net)
12:51 < krzee> and change to verb 5 for debugging
12:51 < nknize> it is verb 5… you pulled the older config
12:51 < nknize> http://pastebin.com/jFeBGkfy
12:51 < krzee> he didnt want the same thing as you
12:51 < krzee> he wanted to share his lan
12:51 < krzee> you want to redirect internet AND share your lan
12:52 < nknize> I'm using proto tcp because udp wouldn't connect from the iPad
12:52 < nknize> correct
12:52 -!- ]R[ [~Positive@2a01:e35:2ef2:d850:e350:e350:e350:e350] has joined #openvpn
12:52 < krzee> so forget that forum post where i helped someone with a different goal, im directly helping you now
12:52 < nknize> will do.. removing the route crap
12:53 < krzee> you'll want to figure out why your ipad couldnt do udp, but you can do that later
12:53 < krzee> tcp will work for this testing
12:53 < krzee> udp will be much better in the long run, but wont make a difference for getting the rest working
12:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:54 < nknize> removed the route crap…  pastebin.com/6cBnq8Rw
12:56 < krzee> ok there ya go
12:56 < krzee> did you use regedit to enable ip forwarding yet?
12:58 < nknize> no…. which help document is that in?
12:58 -!- happylife [~happylife@cs181134059.pp.htv.fi] has joined #openvpn
12:58 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
12:58 < krzee> [13:30]  <krzee> you need:
12:58 < krzee> [13:30]  <krzee> !winipforward
12:58 < krzee> [13:30]  <vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
12:58 < krzee> [13:30]  <krzee> !winnat
12:58 < krzee> [13:30]  <vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows or (#2) http://www.nanodocumet.com/?p=14 for windows XP
12:58 <@vpnHelper> Title: How to Enable TCP/IP Forwarding in Windows XP (at support.microsoft.com)
12:58 <@vpnHelper> Title: NAT in Windows 2003: Setup and Configuration (at www.windowsnetworking.com)
13:02 < krzee> in that NAT doc, NIC1 would be tuntap device, NIC2 would be your real ethernet card
13:08 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
13:10 < nknize> k… ipforward and winnat all set per documentation
13:13 < nknize> you're the man krzee
13:14 < nknize> that did the trick
13:15 < nknize> I can't thank you enough…  got both local network and internet connection working..
13:16 < nknize> I owe you at least a case of beer… that had me stumped for at least 2 days..
13:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
13:17 < EugeneKay> !donate
13:17 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel. or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc. or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
13:18 < nknize> :-)
13:18 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
13:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:26 < krzee> =]
13:26 < krzee> http://abclocal.go.com/kgo/livenow?id=8416152
13:26 <@vpnHelper> Title: ABC7 LIVE VIDEO: SKY7 over Oakland demonstrations (at abclocal.go.com)
13:27 < krzee> oakland california is having a general strike
13:30 < hyper_ch> hi krzee
13:31 < EugeneKay> "WE'RE CALIFORNIAN AND WE'RE PISSED OFF ABOUT STUFF"
13:31 < krzee> EugeneKay, i guess you didnt hear about the marine that cops in oakland put in critical condition
13:31 < krzee> with a 40mm CS canister to the head at point blank range
13:31 < EugeneKay> No, I ignore alarmist news media
13:32 < krzee> then they set off a flashbang next to his head when protestors went to try to help him
13:32 < krzee> news media? lol
13:32 < krzee> if it weasnt on youtube it would have never existed
13:32 < krzee> look up scott olsen
13:32 -!- raidz is now known as raidz_afk
13:32 < krzee> theres like 30K - 100K marines on board with occupy movement now... occupymarines.org
13:33 < EugeneKay> For every overreaching cop video there are 10 videos where the "victim" in question was being a total asshole threatening to kill the cop before he gets tased.
13:33 < EugeneKay> But that bit got edited out
13:33 < krzee> they really shouldnt have took out a marine at point blank range
13:33 < krzee> this marine was just standing there saying nothing
13:33 < krzee> but im glad you can decide on things without looking
13:33 < krzee> shoes extreme intelligence
13:33 < krzee> shows*
13:33 < EugeneKay> I haven't looked at this case, and I wouldn't be qualified to do so based upon a third-hand report of it on youtube
13:34 < EugeneKay> So, I won't. 
13:34 < krzee> wouldnt expect you to after previous comments
13:34 < EugeneKay> I beleive that the police are generally good people. However, there are bad apples, and it sounds like, from your description, a dumb incident worthy of criminal charges against the officer in question.
13:35 < EugeneKay> But this is #openvpn, not #politics, so I'm gonna crawl back under my rock
13:36 < krzee> i posted 1 link, you crawled out from your rock to talk politically
13:36 < krzee> :-p
13:36 < EugeneKay> Point
13:36 < EugeneKay> The video feed from the link you posted just zoomed in on a banner. "Death to capitalism"
13:36 < EugeneKay> I somehow don't see this working out for them.
13:37 < krzee> i somehow dont care what any single persons banner says
13:37 < EugeneKay> It was one of those parade-sized ones, with a whole group of protestors
13:37 < krzee> in fact theres already video showing police dressing as protestors and acting a fool in oakland
13:37 < krzee> didnt you crawl under a rock?
13:37 < EugeneKay> I've got DSL under here
13:38 < EugeneKay> It's really rather roomy
13:38 < krzee> lol nice
13:38 < krzee> the batcave
13:38 < EugeneKay> Whatever happene to the wall street protests?
13:38 < EugeneKay> Did they all go home when the "snowstorm" hit?
13:38 < krzee> still going on
13:38 -!- Gud_ is now known as Gud
13:40 < EugeneKay> Blah, ok, I should fix my VPN servers
13:40 -!- raidz_afk is now known as raidz
13:40 < krzee> they would have stopped by now if the police didnt keep getting violent
13:40 < krzee> or so i guess
13:46 < EugeneKay> Eh. Crowd dynamics are a hard one to guess
13:51 < krzee> well in spain (may 15th) they started with like 20-40 people, the cops got violent... within a month they had 100K people, and then everyone stopped
13:51 < krzee> they got organized and went home
13:51 < krzee> now when they go back out, they are in FULL force
13:51 < krzee> as they showed on oct 17th and will show again on nov 20th
13:51 <@vpnHelper> RSS Update - forum: encrypt web traffic client trough vpn tunnel <http://forums.openvpn.net/topic9155.html>
13:52 < EugeneKay> I can support organized demonstrations with a coherent image backing them. Mobs..... I avoid mobs.
13:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
13:53 < krzee> http://www.youtube.com/watch?v=NDBSCLXWfYI
13:53 <@vpnHelper> Title: Awesome Marine Takes On 30 Cops In Wallstreet Faceoff 2011 - YouTube (at www.youtube.com)
13:53 < krzee> you may like that one
13:54 < krzee> i know i do
13:54 < EugeneKay> What I see is somebody disgracing the name of the corps ;-)
13:54 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
13:54 -!- mode/#openvpn [+o mattock] by ChanServ
13:54 < krzee> hrm, thats what i think of anyone who swore to protect the constitution and then does not
13:55 < krzee> that rant started a movement that so far has about 100,000 marines organized in support of OWS
13:56 < EugeneKay> And a bunch of cops just trying to do their(tough as hell) job.
13:58 < krzee> hey feeding your family is good, but do so without denying people their constitutional rights... like the police force in albany new york that as a group denied the governor AND mayor, said they refused to arrest peaceful protestors
13:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:59 < EugeneKay> Common sense sometimes does break through.
13:59 < krzee> ok, well i dont accept the "im only breaking the consitution to feed my family" thing
13:59 < krzee> cause if the person really sees it that way, ild prefer if they didnt multiply
14:00 < EugeneKay> Hey now, let's not devolve all the way into eugenics before I've had something to drink
14:00 < krzee> :-p
14:01 < EugeneKay> Shifting paradigms without a clutch, I'm trying to figure out which of the TLS options I need here.
14:01 < krzee> hey hey, something on topic
14:01 < krzee> what ya lookin for?
14:02 < EugeneKay> I have a Root CA, which has issued a VPN CA cert
14:02 < krzee> ann intermediate ca's
14:02 < krzee> ahh*
14:02 < krzee> you can use --ca more than once
14:02 < EugeneKay> The VPN CA has then issued all of my client and server crts, which have ns-cert-typ set appropriately
14:03 < EugeneKay> Hm, OK.
14:03 < EugeneKay> So it would require that the other-end's cert be signed by both of the name --ca's?
14:03 < krzee> well i shoulda let you finish
14:03 < krzee> im not sure what the problem is yet ;]
14:03 < EugeneKay> At the moment I'm just using the VPN CA for --ca
14:04 < EugeneKay> I have two things I'm trying to solve
14:04 < EugeneKay> The first is working with the Root CA as the root of the chain of trust, so that I can revoke the VPN CA(and crl-verify will respect it) 
14:04 < EugeneKay> The second is ensuring that a theoretical attacker can't use a HTTPS CA-signed cert 
14:05 < krzee> the second will be easy enough
14:05 < krzee> assuming you have one
14:05 < EugeneKay> I do
14:05 < krzee> if you're using the vpn ca to check, it will certainly reject people from https ca
14:06 < hyper_ch> krzee: EugeneKay: http://www.theregister.co.uk/2011/11/02/railgun_durability_milestone/
14:06 <@vpnHelper> Title: US Navy in new electromagnetic railgun milestone • The Register (at www.theregister.co.uk)
14:06 < EugeneKay> hyper_ch - OLD! But cool.
14:06 < hyper_ch> EugeneKay: that's from today
14:06 < EugeneKay> And reddit had it up a few hours ago
14:06 < hyper_ch> people still use reddit? :)
14:06 < EugeneKay> I saw it there before here, didn't I?
14:06 < hyper_ch> s/people/geeks/
14:07 < hyper_ch> EugeneKay: maybe you just say reddit had it earlier so that you appear to be cool
14:07 < EugeneKay> Could you please restate that in the form of a sentence?
14:08 < EugeneKay> krzee - aye, but how do I solve the issue of possibly-revoked-vpn-ca?
14:08 < EugeneKay> Somethign with tls-verify, perhaps
14:08 < krzee> im not understanding what the issue is with your issue
14:09 -!- raidz is now known as raidz_afk
14:09 < krzee> you basically cant revoke the ca
14:09 < EugeneKay> Lemme rephrase
14:09 -!- raidz_afk is now known as raidz
14:09 < krzee> because its the only ca your entire pki uses
14:09 < krzee> as far s vpn
14:09 < EugeneKay> If I specify --ca twice, how would it check the end-cert provided?
14:09 < EugeneKay> Against both? Or "any" ?
14:09 < krzee> you see
14:10 < krzee> your ca on the server will be vpn ca, right>
14:10 < krzee> and thats what the crl needs to be signed by then
14:10 < EugeneKay> Server.crt and client.crt are both signed by VPN CA
14:10 < krzee> but the crl would be revoking the ca that signed it
14:10 < EugeneKay> The CRL that's revoking VPN CA would be signed by Root CA
14:12 < EugeneKay> Hm. This brings up a related question. Can --crl be called multiple times? Or work with concatenated crls to check for both CAs?
14:12 < krzee> then the root ca is needed on the server
14:12 < EugeneKay> That's the point, yes :-p
14:12 < krzee> try using --ca 2x on the server
14:12 < krzee> cool i called that one out before i even knew the problem
14:13 < EugeneKay> But if I'm using --ca root.crt, how do I keep it from working with --ca https.crt instead of --ca vpn.crt?
14:13 < krzee> and ive never even thought of using intermediate ca's
14:14 < krzee> ahh right, check what happens but if it does allow that you were right, tls-auth script
14:14 < EugeneKay> tls-verify*
14:15 < krzee> !script
14:15 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
14:15 < krzee> yes, tls-verify
14:15 < EugeneKay> auth is for the HMAC thing
14:15 < krzee> <-- sick, not all there
14:17 < EugeneKay> OK, looks like I'll need a tls-verify script that checks the issuer CN
14:18 < EugeneKay> And making that work on WIndows...... blah
14:21 < krzee> no no
14:22 < krzee> it only needs to exist on the server
14:22 < krzee> client will only get vpn ca
14:22 < krzee> so it wont be able to accept a server with https ca
14:22 < EugeneKay> I want clients to check for revocation as well
14:22 < EugeneKay> All the way up
14:22 < EugeneKay> I try not to half-ass things
14:23 < krzee> rouge servers?
14:23 < EugeneKay>  Unlikely, but I'm paranoid
14:24 < krzee> heh
14:24 < krzee> and how do you plan on distributing the new crl to every client
14:24 < krzee> and force them to use the right one
14:24 < krzee> lol
14:24 < EugeneKay> https://pki.khresear.ch/
14:24 <@vpnHelper> Title: Index of / (at pki.khresear.ch)
14:26 < krzee> openvpn config takes a url for --crl?
14:26 < EugeneKay> No, but wget does
14:26 < EugeneKay> I update 'em once a week
14:27 < krzee> have fun with that
14:27 < EugeneKay> Windows Task Scheduler works great
14:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
14:30 < EugeneKay> Actually, you know what? HTTPS certs don't have EKU specified
14:31 < EugeneKay> Ah wait, yes they do. But I have them set to "Microsoft Server". I can reissue the VPN ones with "IPSec End System" and "IPSec User", though.
14:32 < EugeneKay> And then use --remote-cert-eku on both ends 
14:32 < EugeneKay> Nothing under the HTTPS CA would be signed with those
14:33 -!- dym [~patrick@unaffiliated/dym] has joined #openvpn
14:34 < dym> Hey - I managed to establish a VPN connection to a remote server. now i'd like to access that server via the virtual net ip address, but this fails. its basicalls traffic from tun0 to loc as it seems. Im wondering how to enable the forward between those interfaces.
14:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:39 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:39 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:39 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:43 -!- thebishop [~thebishop@66.187.140.172] has joined #openvpn
14:45 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
14:45 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
14:45 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:45 -!- mode/#openvpn [+v Axeman] by ChanServ
14:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
14:53 < sedulous> does anyone have experience with running OpenVPN through the great Chinese firewall?
14:54 < sedulous> my chinese clients get disconnected after seconds, using openvpn over UDP. i guess 443/tcp is the only option
14:55 < EugeneKay> 443/tcp
14:56 < sedulous> i still have to get IPsec running as well, but I doubt it will be feasible
14:56 < sedulous> it's most likely simply blocked on the standard ports
14:56 < EugeneKay> You could also try UDP ports meant for $VIDEO_GAME
14:56 < sedulous> That's a good idea, EugeneKay!
14:58 < EugeneKay> I would setup as many "common" port sets as feasible, and use <connection> blocks along with --remote-random to jumble it up
14:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:58 < sedulous> Great
14:58 < sedulous> I'll do that
14:58 < EugeneKay> Server side you would just use iptables destination port forwards, and let OpenVPN listen on the standard 1194
14:58 -!- dazo_afk is now known as dazo
14:59 < sedulous> Testing is a bit tricky because I don't have an accessible box in china right now so that will help finding good ports faster
15:00 < Blue_Ice> "HA" openvpn (in udp mode) and a virtual ip don't really play well together ... it sends the udp return packets just based on the routing table .. instead of using the ip on which it got the packet. Thus using the first ip of the interface, and not the vip
15:01 < Blue_Ice> ended up using tcp mode, but I still find it lame
15:01 < EugeneKay> Port forwards, not address forwards
15:01 < sedulous> I will default to TCP now and try UDP once that works
15:10 -!- MadTBone_ [~MadTBone@gw1.msmnyc.edu] has quit [Quit: Leaving]
15:11 <@vpnHelper> RSS Update - forum: Can't ping server or other clients after connecting <http://forums.openvpn.net/topic9156.html>
15:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
15:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:17 < hyper_ch> krzee: fruball <3 new small box http://images.sjau.ch/img/3da75be8.jpg
15:19 < krzee> little guy wants to travel
15:20 < hyper_ch> well, the big box in the back is also <3 by my furballs... but the small one just arrived to day... so it's new and more exciting
15:21 < dym> UHHH hyper_ch they are sooo nice.
15:21 < dym> I wanted to get one. Arent they dead expensive?
15:21 < hyper_ch> dym: not boxes or furballs?
15:22 < hyper_ch> or the Kärcher RoboCleaner?
15:22 < dym> lol - i just disconnected my vpn, hence the connection was lagging and only top of the pic was revealed :D
15:22 <@vpnHelper> RSS Update - forum: Star Topolgy - passing routes to all remote servers <http://forums.openvpn.net/topic9052.html#p17194>
15:22 < dym> so yeah - the kaercher :D
15:22 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
15:23 < hyper_ch> dym: I've had mine for little less than a month now... I got it for about € 1000.--... it's expensive but quite worth it IMHO
15:23 < hyper_ch> I have yet to see the effects on my electricity bill
15:24 < hyper_ch> it's running non-stop during the day, at night wehn I go to sleep I turn it off
15:24 < dym> hyper_ch: i know there are cheaper knockoffs of the technology. thought about getting one.
15:24 < dym> hyper_ch: big appartment i guess?
15:24 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Ping timeout: 248 seconds]
15:24 < hyper_ch> btw, I saw the RC 4000 today - same tech just grey/black - and looks also nice... but I prefer the yellow one
15:24 < hyper_ch> dym: not that big... but I'm lazy... about 75 sqm
15:25 < hyper_ch> especially with my three furballs - their hair accumulates quickly
15:25 < dym> :D
15:25 < hyper_ch> the kärcher has a few drawbacks... along the walls and corners it's not as good because it lacks the side brushes of the roomba
15:25 < hyper_ch> it's also a pity that you can set times when it shall clean and when stop
15:26 < hyper_ch> but power cords and network cords are no hindranes
15:26 < hyper_ch> hindrance
15:26 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:26 < hyper_ch> as I have some elevated doorway, I got some rubber ramps that are usually used for wheelchairs so they can get over them easily... works perfectly... the last time my floor was that clean was probably when I moved in
15:27 < dym> hyper_ch: haha :D 
15:28 < dym> hyper_ch: im lazy too, but 1000 Euro is a bit over the top
15:28 < hyper_ch> well, you can get a roomba for € 250 or something but then you'd have to clean that every day
15:28 < hyper_ch> you probably could get the kärcher for € 900 in germany
15:29 < hyper_ch> the "normal" shops here sell it for like € 1500... I found an online shop in swiss for € 1000 :)
15:44 < hyper_ch> dym: those rubber ramps  https://www.youtube.com/watch?v=2YN_pb9xeog
15:44 <@vpnHelper> Title: video-2011-10-08-15-06-37.mp4 - YouTube (at www.youtube.com)
15:47 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Ping timeout: 255 seconds]
15:50 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
15:53 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
15:54 -!- corretico_ [~luis@200.12.40.25] has quit [Read error: Connection reset by peer]
15:55 -!- corretico_ [~luis@200.12.40.25] has joined #openvpn
15:55 -!- corretico_ [~luis@200.12.40.25] has quit [Read error: Connection reset by peer]
16:03 <@vpnHelper> RSS Update - forum: Disable encryption for one user ? <http://forums.openvpn.net/topic9157.html>
16:04 < hyper_ch> dym: you've been silent
16:10 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:10 < dym> hyper_ch: scusi, eating/watching tv
16:10 < dym> (:
16:10 < hyper_ch> you eat TVs?
16:10 < dym> while watching it, yes
16:10 < hyper_ch> :)
16:12 < dym> rough day (:
16:12 < hyper_ch> same here
16:12 < hyper_ch> but then, I come home and can admire my clean floor :)
16:12 < dym> stop teasing! :D
16:13 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:22 < hyper_ch> dym: the costs hold me off also quite some time... but all comments I read of people who have a roomba and a kärcher said, they should have gotten a kärcher directly
16:33 <@vpnHelper> RSS Update - forum: Certificate Authentication with LDAP/AD <http://forums.openvpn.net/topic9153.html#p17197> || Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17196>
16:39 <@vpnHelper> RSS Update - forum: Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17200> || Disable encryption for one user ? <http://forums.openvpn.net/topic9157.html#p17199> || Can't ping server or other clients after connecting <http://forums.openvpn.net/topic9156.html#p17198>
16:39 < dym> yeah, roomba was the one - hyper_ch 
16:40 < hyper_ch> which one?
16:43 -!- thebishop [~thebishop@66.187.140.172] has quit [Ping timeout: 255 seconds]
16:45 <@vpnHelper> RSS Update - forum: Disable encryption for one user ? <http://forums.openvpn.net/topic9157.html#p17202> || Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17201>
16:51 <@vpnHelper> RSS Update - forum: Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17203>
16:56 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
16:56 -!- h8r [~niko@pppoe-132-148.ssi.bg] has quit [Ping timeout: 260 seconds]
16:57 -!- h8r [~niko@pppoe-132-148.ssi.bg] has joined #openvpn
17:02 -!- fread2281 [~fread2281@70-56-134-203.albq.qwest.net] has quit [Ping timeout: 252 seconds]
17:07 -!- fread2281 [~fread2281@70-56-211-44.albq.qwest.net] has joined #openvpn
17:07 <@vpnHelper> RSS Update - forum: Can't ping server or other clients after connecting <http://forums.openvpn.net/topic9156.html#p17204>
17:14 -!- dannnnn [~robott@124.78.181.100] has joined #openvpn
17:17 < dannnnn> If i write chroot var/run/openvpn in the server configuration file, does /var/run/openvpn directory need to exist? Or does openvpn create this directory itself at run-time. 
17:25 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Ping timeout: 258 seconds]
17:32 <@vpnHelper> RSS Update - forum: Certificate Authentication with LDAP/AD <http://forums.openvpn.net/topic9153.html#p17205>
17:33 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
17:34 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
17:38 <@vpnHelper> RSS Update - forum: Can't ping server or other clients after connecting <http://forums.openvpn.net/topic9156.html#p17206>
17:44 <@vpnHelper> RSS Update - forum: OpenVPN Server to ww-drt OpenVPN Client <http://forums.openvpn.net/topic9158.html>
18:02 <@vpnHelper> RSS Update - forum: Certificate Authentication with LDAP/AD <http://forums.openvpn.net/topic9153.html#p17208>
18:11 -!- novaflash is now known as novaflash_away
18:20 -!- dazo is now known as dazo_afk
18:24 -!- __phil__ [~mac@wsip-70-182-139-210.oc.oc.cox.net] has joined #openvpn
18:24 -!- adolfomaltez [~taro@190.62.226.177] has quit [Ping timeout: 240 seconds]
18:30 < zalzice> EugeneKay: I just read the cyanogemod blog and notice a familiar nick. Great job supporting cyanogenmod :-)
18:30 < EugeneKay> The do what?
18:31 < zalzice> servers
18:31 < EugeneKay> Oh, my buildsluts
18:31 < zalzice> :-)
18:32 < EugeneKay> Yeah, company hardware that's otherwise sitting idle
18:33 < zalzice> good attention for idling servers
18:34  * EugeneKay shrugs
18:35 < EugeneKay> I'm donating 2 VMs right now. I could double it to four if I had disk spindles. :-p
18:35 < EugeneKay> I'm also gonna need more RAM for the things..... but that's ~$320
18:37 < dannnnn> is it normal for generating 4096.pem to take like 2 hours and counting?
18:38 < EugeneKay> Negatory.
18:38 < EugeneKay> Are you running this on a VPS?
18:39 < EugeneKay> 60 seconds would be a "long" time to make a ssl key
18:44 < dannnnn> yes
18:44 < dannnnn> on a vps
18:44 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
18:44 < dannnnn> dual core vps with xen 
18:44 < dannnnn> so i should cancel and start over?
18:44 < EugeneKay> Probably something involving an empty random device
18:44 < EugeneKay> Yeah, ctrl+c it
18:45 < dannnnn> lol that doesnt fill me with confidence
18:45 < dannnnn> how will i know if its a good ssl key even if it takes 60 seconds next time?
18:46 < EugeneKay> You can extract the private key and run it through a randomness checker
18:47 < EugeneKay> The issue is with your VPS
18:47 < dannnnn> ok
18:48 < dannnnn> but realise it IS a 4096 length...
18:48 < dannnnn> so its gonna take longer than standard anyway
18:50 -!- kyrix [~ashley@mk046207255139.a1.net] has quit [Quit: Ex-Chat]
18:51 -!- SJrX is now known as SJr
18:54 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:56 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has joined #openvpn
19:00 -!- fread2281 [~fread2281@70-56-211-44.albq.qwest.net] has quit [Ping timeout: 260 seconds]
19:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:06 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
19:06 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Client Quit]
19:07 -!- sirspazzolot [~Matt@c-68-40-234-80.hsd1.mi.comcast.net] has joined #openvpn
19:10 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has quit [Quit: Leaving.]
19:10 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has joined #openvpn
19:14 <@vpnHelper> RSS Update - forum: Help with unsecure disconnects revealing true ip. Iptable?? <http://forums.openvpn.net/topic9159.html>
19:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:24 -!- __phil__ [~mac@wsip-70-182-139-210.oc.oc.cox.net] has quit [Quit: __phil__]
19:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:31 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:33 -!- Denial [Denial@drgi.co.uk] has quit []
19:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:43 <@vpnHelper> RSS Update - forum: OpenVPN on DD-WRT router <http://forums.openvpn.net/topic9160.html>
19:45 -!- Netsplit *.net <-> *.split quits: civillian, dannnnn
19:46 -!- Netsplit over, joins: dannnnn
19:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:59 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 258 seconds]
20:05 -!- adolfomaltez [~taro@190.62.244.60] has joined #openvpn
20:06 -!- sirspazzolot [~Matt@c-68-40-234-80.hsd1.mi.comcast.net] has quit [Quit: Life beckons]
20:07 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
20:20 <@vpnHelper> RSS Update - forum: Can't ping server or other clients after connecting <http://forums.openvpn.net/topic9156.html#p17211>
20:23 < EugeneKay> dannnnn - I can make a 4096-bit key on a 5-year old Dell laptop in under 30 seconds
20:23 < dannnnn> lol
20:24 < EugeneKay> An hour is abnormallyl ong. Really.
20:24 < dannnnn> i've had 4 different vps with openvpn never did it faster than 5 minutes 
20:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:24 < EugeneKay> You've had crap VPSes with limited randomicity
20:24 < dannnnn> although second time i tried it took 1 minute
20:24 < EugeneKay> Lack of /dev/random-ness is common on VPSes
20:24 < dannnnn> ummm that makes no sense, the vps is centos 5.6
20:24 < krzee> isnt 1min faster than 4min?
20:24 < krzee> 5min*
20:25 < dannnnn> its randomness does not depend on the vps providor btu the image
20:25 < EugeneKay> You're sharing a /dev/random with dozens of people
20:25 -!- fread2281 [~fread2281@70-56-209-115.albq.qwest.net] has joined #openvpn
20:25 < EugeneKay> Wrong. It depends upon the hardwae 
20:25 < dannnnn> perhaps but it is still random
20:25 < dannnnn> (i hope)
20:26 < EugeneKay> You can peek at /proc/sys/kernel/random/entropy_avail if you like
20:26 < dannnnn> never heard of anyone discuss the 'quality' of random
20:26 < dannnnn> k
20:27 -!- _julian [~quassel@hmbg-4d06dbe3.pool.mediaWays.net] has joined #openvpn
20:27 < dannnnn> it says 
20:27 < dannnnn> 3606
20:27 < dannnnn> what does that mean lol
20:27 < EugeneKay> That's the amount of random bits available via /dev/random
20:27 < dannnnn> ok, good or bad
20:27 < EugeneKay> Good
20:27 < dannnnn> k
20:27 < dannnnn> great
20:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:28 < dannnnn> what does yours say? just wondering
20:28 < EugeneKay> Coupla different systems, 3602, 1099, 3470, 3, and 132
20:28 < dannnnn> im guessing u have linux since u know by heart the location of that 
20:29 < dannnnn> 3 is horrible i guess
20:29 < EugeneKay> Yeah. That's a VPS
20:30 -!- _julian_ [~quassel@hmbg-5f77efcb.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
20:31 < dannnnn> well its working well :)
20:31 < dannnnn> streaming blocked content in china now, starcraft 2 
20:31 < dannnnn> should i delete ca.key from the vps
20:32 < dannnnn> or just keep it there, it in /etc/openvpn now which i did chmod 700 to that dir
20:32 < EugeneKay> Ca.key will be needed to generate any new certificates
20:32 < dannnnn> yea i mean should i not have it on the server
20:32 < EugeneKay> If you trust your VPS' security, you can keep it there. I keep all my CA stuff locally.
20:33 < dannnnn> ah you use csr to set it up
20:33 < EugeneKay> Nah, I create all my keys/certs i nthe same place
20:33 < dannnnn> i'll winscp it to my laptop and put it in a truecrypt volume
20:33 < EugeneKay> The aforementioned 5-year old laptop which has sealed network jack
20:33 < dannnnn> paranoid i guess
20:34 < EugeneKay> I sneakernet everything off of it using a USB key which I format regularly
20:34 < dannnnn> ahhh
20:34 < EugeneKay> From there it crosses the wire inside of SSH
20:34 < dannnnn> sounds like fort knox setup
20:34 < EugeneKay> Not quite.
20:35 < EugeneKay> Verisign supposedly keeps their root CAs on a box only accessible via a serial port
20:35 < dannnnn> i read they had their root CA stolen
20:35 < dannnnn> or something
20:35 < dannnnn> few months ago
20:36 < EugeneKay> Comodo had some falsely issued certs
20:37 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
20:37 < EugeneKay> The other thing... DigiNotar. They used MS Certificate Services.
20:37 < EugeneKay> Bad idea
20:37 < dannnnn> lol im just thinking probably my laptop is more vulnerable than the vps in the usa
20:38 < dannnnn> china bought laptop running in china
20:38 < EugeneKay> TrueCrypt
20:39 < dannnnn> k
20:39 -!- adolfomaltez [~taro@190.62.244.60] has quit [Ping timeout: 240 seconds]
20:40 < dannnnn> so ca.key is the only file that really needs be kept safe... everythin else like server.key dont matter
20:40 < dannnnn> if they get server.key still can't make their own client keys
20:40 < dannnnn> so can't connect
20:43 -!- fread2281 [~fread2281@70-56-209-115.albq.qwest.net] has quit [Ping timeout: 240 seconds]
20:45 -!- fread2281 [~fread2281@70-56-134-34.albq.qwest.net] has joined #openvpn
20:47 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
20:48 < dannnnn> done
20:52 < dannnnn> changed the port from 1194 to 8888 so my isp doesnt know im using openvpn
20:52 < dannnnn> if i use default port its too obvious and they might throttle my connection if its obviously a vpn
20:57 < EugeneKay> Well, server.key is important to keep "safe", but your hands are kinda tied in that it needs to be accessible to the server to start openvpn
20:58 < EugeneKay> You could use hands-on service starting(having to type a password after restarting openvpn), but that is more trouble than its worth, IMO
20:58 -!- adolfomaltez [~taro@190.62.226.117] has joined #openvpn
20:58 < EugeneKay> As for ports, you can setup a bunch of UDP ports which games use, along with <connection> blocks client-side, and --remote-random to pick between them
20:59 < EugeneKay> On the server side you add an iptables rule to forward each of those destination ports back down to 1194, no problem.
21:04 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:12 -!- adolfomaltez [~taro@190.62.226.117] has quit [Ping timeout: 240 seconds]
21:14 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
21:16 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:18 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:19 -!- fread228_ [~fread2281@70-56-134-178.albq.qwest.net] has joined #openvpn
21:19 -!- fread2281 [~fread2281@70-56-134-34.albq.qwest.net] has quit [Ping timeout: 258 seconds]
21:22 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:24 -!- fread228_ [~fread2281@70-56-134-178.albq.qwest.net] has quit [Ping timeout: 258 seconds]
21:25 -!- fread2281 [~fread2281@70-56-134-202.albq.qwest.net] has joined #openvpn
21:31 -!- fread2281 [~fread2281@70-56-134-202.albq.qwest.net] has quit [Ping timeout: 244 seconds]
21:32 -!- fread2281 [~fread2281@70-56-134-226.albq.qwest.net] has joined #openvpn
21:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
21:51 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:52 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:52 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:54 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:54 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:55 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
22:07 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
22:16 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
22:22 -!- fread2281 [~fread2281@70-56-134-226.albq.qwest.net] has quit [Ping timeout: 256 seconds]
22:25 -!- fread2281 [~fread2281@70-56-133-138.albq.qwest.net] has joined #openvpn
22:34 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:37 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:01 < derekv> i chopped up ssl-admin into a new script it scans a directory, finds any csr's there, displays the CN, email and public key, admin says y/n, if yes, signs it, adds cryptoapicert line to config file , packs zip, and emails zip to the email in the csr 
23:02 < derekv> still needs a little refining
23:04 < ecrist> why would you chop up ssl-admin?
23:05 < ecrist> heh, and you email the vpn keys to the user?
23:05 < ecrist> what's the point of a vpn?
23:06 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:07 < derekv> keys never get emailed
23:07 < derekv> just certs =]
23:07 < derekv> private key never leaves client machine
23:07 < derekv> csr gets uploaded to server
23:08 < derekv> admin signs it, sends it back to client, 
23:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:09 < EugeneKay> Ew :-p
23:09 < derekv> i'll send you a copy of the frankenscript when im done, its not pretty, i'm learning perl as I go
23:09 < derekv> if anyone wants it that is
23:09 < EugeneKay> Github it
23:10 < derekv> yea i was thinking
23:10 < derekv> github or somesuch
23:10 < derekv> and a w/u on wiki
23:10 < EugeneKay> I recommend dual-licensing as WTFPL and GPLv3+
23:11 < EugeneKay> It enables you to just DO WHAT THE FUCK YOU WANT TO
23:11 < EugeneKay> And still maintain an air of legitimacy
23:14 < derekv> i don't know that i'm all that worried about it
23:14 < derekv> bsd style and call it done
23:15 < derekv> we're not talking about something thats going to take over the business
23:17 < derekv> the whole concept is that the certficate gets generated on a windows client in the certificate store, marked non-exportable, so its like a sort of drm and, additionally, some sort of protection.  a certificate request is generated, and uploaded
23:20 < derekv> so in fact the private key never moves off the client's computer, and can't without cracking the certificate store, so it's got some protection , not as good as a strong passphrase, but that just isn't going to work
23:20 < derekv> the passphrase
23:21 -!- quadDamage [~EmperorTo@jaguar-2-red.claimlynx.com] has quit [Disconnected by services]
23:26 -!- dannnnn [~robott@124.78.181.100] has quit []
23:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
23:47 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:49 < EugeneKay> I consider my sneakernet-to-SSH to be secure enough
23:50 < EugeneKay> And having a central key repo lets me fix lost-key issues
--- Day changed Thu Nov 03 2011
00:03 -!- fread2281 [~fread2281@70-56-133-138.albq.qwest.net] has quit [Ping timeout: 244 seconds]
00:05 -!- fread2281 [~fread2281@70-56-132-81.albq.qwest.net] has joined #openvpn
00:14 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
00:33 <@vpnHelper> RSS Update - forum: I need help... 2 vps and single pam athentication. <http://forums.openvpn.net/topic9161.html> || Can't ping server or other clients after connecting <http://forums.openvpn.net/topic9156.html#p17213> || OpenVPN Clients Automation <http://forums.openvpn.net/topic9129.html#p17212>
00:54 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:03 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
01:12 -!- venom00 [~venom00@net-188-218-177-38.cust.dsl.vodafone.it] has joined #openvpn
01:12 -!- venom00 [~venom00@net-188-218-177-38.cust.dsl.vodafone.it] has quit [Changing host]
01:12 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
01:15 <@vpnHelper> RSS Update - forum: [Resolution] licensing.openvpn.net not found <http://forums.openvpn.net/topic9152.html#p17215>
01:17 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Ping timeout: 255 seconds]
01:21 <@vpnHelper> RSS Update - forum: OpenVPN on DD-WRT router <http://forums.openvpn.net/topic9160.html#p17216>
01:27 <@vpnHelper> RSS Update - forum: OpenVPN Server to ww-drt OpenVPN Client <http://forums.openvpn.net/topic9158.html#p17218> || encrypt web traffic client trough vpn tunnel <http://forums.openvpn.net/topic9155.html#p17217>
01:33 <@vpnHelper> RSS Update - forum: I need help... 2 vps and single pam athentication. <http://forums.openvpn.net/topic9161.html#p17219>
01:42 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
01:42 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
01:42 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
01:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
01:42 -!- oc80z [oc80z@blea.ch] has joined #openvpn
01:44 -!- venom00 [~venom00@109.117.163.139] has joined #openvpn
01:44 -!- venom00 [~venom00@109.117.163.139] has quit [Changing host]
01:44 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
01:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:57 <@vpnHelper> RSS Update - forum: pam time restriction for openvpn login <http://forums.openvpn.net/topic9162.html>
02:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
02:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
02:39 <@vpnHelper> RSS Update - forum: Reverse VPN tunnel? <http://forums.openvpn.net/topic9114.html#p17221>
02:40 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
02:41 -!- novaflash_away is now known as novaflash
02:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
02:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
02:53 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has quit [Quit: Leaving.]
03:27 -!- happylife [~happylife@cs181134059.pp.htv.fi] has quit [Ping timeout: 258 seconds]
03:28 <@vpnHelper> RSS Update - forum: [SOLVED] Can't ping server or other clients after connecting <http://forums.openvpn.net/topic9156.html#p17223> || Reverse VPN tunnel? <http://forums.openvpn.net/topic9114.html#p17222>
03:32 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:33 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
03:49 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
04:01 -!- happylife [~happylife@213.28.38.234] has joined #openvpn
04:06 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:06 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:06 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:08 -!- dazo_afk is now known as dazo
04:17 <@vpnHelper> RSS Update - forum: encrypt web traffic client trough vpn tunnel <http://forums.openvpn.net/topic9155.html#p17224>
04:19 < |Mike|> heh?!
04:57 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
04:59 <@vpnHelper> RSS Update - forum: Max number of concurrent users for this setup <http://forums.openvpn.net/topic9148.html#p17225>
05:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
05:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:11 -!- corretico [~luis@201.201.44.82] has quit [Read error: Operation timed out]
05:12 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 252 seconds]
05:12 -!- corretico [~luis@201.201.44.82] has joined #openvpn
05:34 -!- dannnnn [~robott@208.111.39.186] has joined #openvpn
05:34 <@vpnHelper> RSS Update - forum: Max number of concurrent users for this setup <http://forums.openvpn.net/topic9148.html#p17226>
05:40 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
05:40 <@vpnHelper> RSS Update - forum: encrypt web traffic client trough vpn tunnel <http://forums.openvpn.net/topic9155.html#p17227>
05:44 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
05:47 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
05:48 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:57 <@vpnHelper> RSS Update - forum: encrypt web traffic client trough vpn tunnel <http://forums.openvpn.net/topic9155.html#p17228>
06:11 < Twinkletoes> Can certificates be used for anything other than appeasing the web browser?  I'd like a 2-stage authentication... 1. with certificate, 2. with ldap
06:12 <@dazo> Twinkletoes: re. web browser, sure it can be ... but you're in the wrong channel to ask about how to set up that
06:12 < Twinkletoes> Sorry, I didn't phrase my question well enough...
06:13 <@dazo> but for OpenVPN ... yes, that's very much doable ... you need to add a auth-pam or auth-ldap module to your openvpn server ... then you can do what you want
06:13 < Twinkletoes> In our previous VPn setup, the user's VPN client would submit a certificate which would allow communication through the VPn gateway, but was only authenticated by the username/password which was also supplied
06:13 < Twinkletoes> dazo: Is auth-ldap different from the OpenVPN LDAP setup I have working now?
06:13 <@dazo> probably not
06:14 <@dazo> but if you have certificates enabled in client and server config ... and require clients to use certificates and have LDAP auth configured ... then OpenVPN will require both
06:15 <@dazo> however, it will not map certificates up against a certain user account
06:15 < Twinkletoes> dazo: Ah... the "require" option I have not fouind
06:15 <@dazo> Twinkletoes: it requires by default, but if you use --client-cert-not-required in your server config, it's disabled
06:16 < Twinkletoes> dazo: Is it a GUI-editable option?
06:16 <@dazo> !??!  we're talking about the OpenVPN server side ... there's no GUI there
06:16 < Twinkletoes> dazo: web interface
06:16 <@dazo> web interface??!?  OpenVPN does not have a web interface
06:17 <@dazo> unless you talk about OpenVPN Access Server
06:17 <@dazo> !as
06:17 < Twinkletoes> dazo: OpenVPn Access Server?
06:17 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
06:17 < Twinkletoes> Ah, sorry - I understand the difference now
06:17 <@dazo> no worries!
06:17  * Twinkletoes thanks dazo very much :)
06:22 -!- raidz is now known as raidz_afk
06:26 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:28 -!- dannnnn [~robott@208.111.39.186] has quit [Ping timeout: 252 seconds]
06:44 -!- dannnnn [~robott@208.111.39.186] has joined #openvpn
06:48 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
06:57 <@vpnHelper> RSS Update - forum: OVPN Windows Client keeps reconnecting every 5 minutes. <http://forums.openvpn.net/topic9163.html>
07:07 -!- dannnnn [~robott@208.111.39.186] has quit [Ping timeout: 245 seconds]
07:08 -!- dannnnn [~robott@124.78.181.100] has joined #openvpn
07:20 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
07:25 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:31 -!- dannnnn [~robott@124.78.181.100] has quit [Ping timeout: 256 seconds]
07:41 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
07:45 <@vpnHelper> RSS Update - forum: encrypt web traffic client trough vpn tunnel <http://forums.openvpn.net/topic9155.html#p17230>
07:48 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
07:57 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
07:57 <@vpnHelper> RSS Update - forum: OVPN Windows Client keeps disconnecting and reconnecting <http://forums.openvpn.net/topic9163.html>
08:14 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
08:16 -!- Ionic [ionic@ionic.de] has joined #openvpn
08:16 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
08:16 -!- Gud_ [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
08:20 -!- Twinkletoes_ [~chatzilla@ipv4-91-143-176-244.static.as8844.net] has joined #openvpn
08:21 -!- Twinkletoes [~chatzilla@ipv4-91-143-176-244.static.as8844.net] has quit [Ping timeout: 252 seconds]
08:21 -!- Twinkletoes_ is now known as Twinkletoes
08:30 -!- amero [~amero@unaffiliated/amero] has quit [Quit: Leaving [WeeChat 0.3.6]]
08:31 -!- McBoingBo [~McBoingBo@mail.hrsg.ca] has joined #openvpn
08:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
08:35 -!- dannnnn [~robott@208.111.39.186] has joined #openvpn
08:37 < McBoingBo> guys I have users working from home and using VOIP, if I configure QoS for VOIP on their routers, will it even see the VPN traffic? Or do I have to configure QoS on the VPN server/client?
08:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:40 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
08:45 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
08:46 -!- Gud_ [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
08:57 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:57 <@vpnHelper> RSS Update - forum: VPN Automation <http://forums.openvpn.net/topic9164.html>
09:08 -!- master_of_master [~master_of@p57B539A7.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
09:09 -!- master_of_master [~master_of@p57B530DA.dip.t-dialin.net] has joined #openvpn
09:15 -!- dannnnn [~robott@208.111.39.186] has quit [Ping timeout: 258 seconds]
09:20 -!- Khas [~Khas@ewangunn.com] has joined #openvpn
09:22 < Khas> Hello.  I've got a number of machines connected to my domain.  Is there anyway to address them as machine1.mydomain.com?  I'm not sure this is done through openvpn, but I'm hoping someone here might at least point me in the right direction.  Do I have to set up bind for it?
09:26 -!- happylife [~happylife@213.28.38.234] has quit [Read error: Operation timed out]
09:27 -!- thebishop [~thebishop@66.187.140.174] has joined #openvpn
09:27 -!- happylife [~happylife@213.28.38.234] has joined #openvpn
09:28 <@vpnHelper> RSS Update - forum: Client configuration <http://forums.openvpn.net/topic9165.html>
09:28 -!- dannnnn [~robott@124.78.181.100] has joined #openvpn
09:29 -!- fread228_ [~fread2281@70-56-129-234.albq.qwest.net] has joined #openvpn
09:29 -!- dannnnn [~robott@124.78.181.100] has quit [Client Quit]
09:30 -!- fread2281 [~fread2281@70-56-132-81.albq.qwest.net] has quit [Ping timeout: 258 seconds]
09:30 < bjorneven> Khas: bind or dnsmasq
09:31 < bjorneven> Khas: I use the $GENERATE directive in bind and all my openvpn clients resolves to vpn$number.blabla.domain
09:31 < Khas> Is there a way to adapt that to use the hostname of the clients?
09:31 < bjorneven> Khas: yes, dynamic dns
09:31 < bjorneven> Khas: dnsmasq does that
09:32 < Khas> Aha, fantastic :-D
09:32 < bjorneven> common feature in dns forwarding solutions
09:32 < Khas> Cause at the moment they are all 10.1.0.x, but I'd like a way to talk to them from the internet.
09:33 < bjorneven> behind NAT ?
09:33 < bjorneven> then you need portforwarding too
09:33 < bjorneven> or bridging, if you have more than one public IP
09:33 < Khas> Yeah, looking things up now, seems openvpn in tap mode might be better, then the server handles the DHCP requests anyway
09:34 < bjorneven> i have dhcp on openvpn separate from my clients
09:34 -!- fread2281 [~fread2281@70-56-129-243.albq.qwest.net] has joined #openvpn
09:34 < Khas> I'm just using tun just now
09:34 -!- fread228_ [~fread2281@70-56-129-234.albq.qwest.net] has quit [Ping timeout: 252 seconds]
09:35 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
09:35 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:42 -!- Twinkletoes [~chatzilla@ipv4-91-143-176-244.static.as8844.net] has quit [Read error: Connection reset by peer]
09:44 -!- fread228_ [~fread2281@70-56-128-21.albq.qwest.net] has joined #openvpn
09:44 -!- fread2281 [~fread2281@70-56-129-243.albq.qwest.net] has quit [Ping timeout: 255 seconds]
09:46 -!- h8r [~niko@pppoe-132-148.ssi.bg] has quit [Read error: Connection reset by peer]
09:48 -!- EmperorTom [~EmperorTo@jaguar-2-red.claimlynx.com] has joined #openvpn
09:49 -!- EmperorTom is now known as quadDamage
09:49 -!- quadDamage is now known as Guest19533
09:50 -!- McBoingBo [~McBoingBo@mail.hrsg.ca] has quit [Read error: Connection reset by peer]
09:50 -!- McBoingBo [~McBoingBo@mail.hrsg.ca] has joined #openvpn
09:57 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
10:00 < McBoingBo> guys I have users working from home and using VOIP, if I configure QoS for VOIP on their routers, will it even see the VPN traffic? Or do I have to configure QoS on the VPN server/client?
10:06 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:06 < krzie> well you never mentioned if the voip goes over a vpn... but ill assume it does
10:06 < krzie> in which case, their router has no idea it is voip
10:07 < krzie> you would need QOS on their router to prefer voip, and on the vpn server as well (assuming more data goes over the vpn)
10:07 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
10:17 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
10:20 -!- Khas [~Khas@ewangunn.com] has quit [Quit: !]
10:23 -!- vtcN- [~vtcN@unaffiliated/thethe] has quit [Read error: Operation timed out]
10:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
10:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:36 -!- Guest19533 [~EmperorTo@jaguar-2-red.claimlynx.com] has left #openvpn []
10:38 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
10:39 -!- bauruine [~stefan@zux221-008-024.adsl.green.ch] has joined #openvpn
10:40 -!- raidz_afk is now known as raidz
10:41 -!- Yen [Yen@unaffiliated/yen] has quit []
10:43 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
10:47 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:50 <@vpnHelper> RSS Update - forum: encrypt web traffic client trough vpn tunnel <http://forums.openvpn.net/topic9155.html#p17233>
10:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
10:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:56 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
10:59 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 260 seconds]
11:00 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
11:01 -!- Khas [~Khas@ewangunn.com] has joined #openvpn
11:01 < Khas> I'm using samba over openvpn, is there a better (i.e. faster) solution? I'm only getting ~90kbps from my server
11:02 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:07 -!- fread2281 [~fread2281@70-56-128-242.albq.qwest.net] has joined #openvpn
11:08 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
11:08 -!- fread228_ [~fread2281@70-56-128-21.albq.qwest.net] has quit [Ping timeout: 252 seconds]
11:12 <@vpnHelper> RSS Update - forum: Disable encryption for one user ? <http://forums.openvpn.net/topic9157.html#p17234>
11:13 -!- Khas [~Khas@ewangunn.com] has quit [Ping timeout: 260 seconds]
11:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 240 seconds]
11:27 -!- venom00 [~venom00@109.112.213.56] has joined #openvpn
11:27 -!- venom00 [~venom00@109.112.213.56] has quit [Changing host]
11:27 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
11:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:32 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
11:47 -!- happylife [~happylife@213.28.38.234] has quit [Ping timeout: 258 seconds]
11:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
11:51 -!- bauruine [~stefan@zux221-008-024.adsl.green.ch] has quit [Remote host closed the connection]
11:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:55 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
12:05 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
12:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:06 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Ping timeout: 248 seconds]
12:06 -!- fread2281 [~fread2281@70-56-128-242.albq.qwest.net] has quit [Ping timeout: 240 seconds]
12:09 -!- fread2281 [~fread2281@70-56-134-178.albq.qwest.net] has joined #openvpn
12:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:16 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
12:20 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
12:24 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:33 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Ping timeout: 258 seconds]
12:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:35 -!- LowKey [rhel@unaffiliated/lowkey] has quit [Ping timeout: 276 seconds]
12:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:42 -!- dazo is now known as dazo_afk
12:54 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Ping timeout: 244 seconds]
12:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:04 -!- venom00 [~venom00@net-188-218-177-38.cust.dsl.vodafone.it] has joined #openvpn
13:04 -!- venom00 [~venom00@net-188-218-177-38.cust.dsl.vodafone.it] has quit [Changing host]
13:04 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
13:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
13:07 <@vpnHelper> RSS Update - forum: Infinite looping by openvpn server while trying to connect <http://forums.openvpn.net/topic9166.html>
13:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:26 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has joined #openvpn
13:33 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has joined #openvpn
13:43 <@vpnHelper> RSS Update - forum: VPN Connection problem <http://forums.openvpn.net/topic9167.html>
13:49 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:59 -!- fread228_ [~fread2281@70-56-132-61.albq.qwest.net] has joined #openvpn
13:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
14:00 -!- fread2281 [~fread2281@70-56-134-178.albq.qwest.net] has quit [Ping timeout: 252 seconds]
14:03 -!- fread2281 [~fread2281@70-56-132-9.albq.qwest.net] has joined #openvpn
14:03 -!- fread228_ [~fread2281@70-56-132-61.albq.qwest.net] has quit [Ping timeout: 248 seconds]
14:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:14 -!- bs0d [~bs0d@sa-184-60.saturn.infonet.ee] has joined #openvpn
14:15 < bs0d> Hello everybody.  I use OpenVPN in Windows. After configuration import, it has printed Initialization Sequence Completed. but in OpenVPN GUI 2 monitors are red, like no connection. I have no previous experience with openvpn, your assistance will be highly appreciated
14:17 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
14:22 < hyper_ch> bs0d: you need to run it as root
14:22 -!- abcdef [~robott@208.111.39.186] has joined #openvpn
14:22 < hyper_ch> or admin
14:22 < abcdef> openvpn rocks
14:23 < abcdef> im in china, openvpn server in california... http://www.speedtest.net/result/1571779708.png
14:23 < abcdef> its flyingggggg
14:23 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
14:23 < hyper_ch> abcdef: vpn-ing is still allowed in china?
14:23 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 276 seconds]
14:24 < abcdef> no idea, its not like they can stop me
14:24 < hyper_ch> sure they can
14:24 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
14:24 < abcdef> its a private server, yea they block some of the vpn providers but this different
14:25 < hyper_ch> they can do dpi
14:25 < hyper_ch> see that you encrypt your traffic
14:25 < abcdef> whats dpi mean
14:25 < hyper_ch> send a hit squad to your place
14:25 < hyper_ch> deep packet inspection
14:25 < abcdef> lol
14:25 < abcdef> i've never heard of such a raid and many expats use vpn here
14:26 < hyper_ch> vpns have been outlawed in syria a little while ago
14:26 < abcdef> you can't outlaw them as businesses would stop doing business in china
14:26 < abcdef> its a necessary thing
14:26 < hyper_ch> sorry, it was Iran http://www.payvand.com/news/11/oct/1254.html
14:27 <@vpnHelper> Title: Use of VPNs criminalized in Iran (at www.payvand.com)
14:27 < abcdef> lol Iran, i'm not suprised
14:28 < abcdef> sad country, glad i wasn't born there
14:29 < hyper_ch> well, people might say censorship in china isn't any better
14:30 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:32 < abcdef> i am just curious if china logs dns requets
14:32 -!- thebishop [~thebishop@66.187.140.174] has quit [Ping timeout: 252 seconds]
14:32 < abcdef> there's really only 2 isp's here so wouldnt be hard
14:32 < abcdef> both state owned
14:33 < hyper_ch> so you're native chinese?
14:33 < abcdef> no
14:33 < abcdef> british
14:33 < hyper_ch> :)
14:34 < hyper_ch> england... where people get extradited to countries known that torture people
14:34 < abcdef> you wouldnt think they do log dns right?
14:34 < abcdef> i mean, why wouldnt they
14:35 < hyper_ch> why wouldn't they?
14:35 < abcdef> two state owned isp for the entire country
14:35 < hyper_ch> but then, if you have a vpn, you run your dns also through it, right?
14:35 < hyper_ch> facebooks logs your every little behaviour
14:35 < hyper_ch> so compared to facebook, logging dns isn't a big deal
14:36 < abcdef> well im not an expert on dns but i do have the push dns option enabled in the server configuration for openvpn
14:36 < abcdef> and it appears to push it to my client, checked wireshark on wifi interface never see any dns packets
14:37 < bs0d> I have another question
14:37 < hyper_ch> question is whether you route all your traffic through the vpn
14:37 < abcdef> it does
14:38 < bs0d> I have to run openvpn --config my.conf every time for each session. And as long as I keep this console window open, it works. But when I close it, all the connections are propped and cannot be established again. 
14:38 < abcdef> only packets i see that arent in the vpn are ssdp or something
14:38 < bs0d> Is this the normal behaviour, or I am missing something?
14:38 < hyper_ch> bs0d: on irc it's customary to just (1) state your problem / ask your question (2) wait for an answer (3) sometimes even wait more for an answer (4) really wait for an answer
14:39 < hyper_ch> abcdef: good for you and you do connect to your server by IP or dns?
14:39 < hyper_ch> bs0d: no clue about openvpn on windows
14:39 < abcdef> just put the server ip in client.conf
14:39 < abcdef> the dns im pushing is 8.8.8.8
14:39 < hyper_ch> google dns :)
14:40 < abcdef> yea, opendns is also good
14:40 < hyper_ch> when you only connect to your server with IP, it means there's no dns request eitehr :)
14:40 < hyper_ch> 8.8.4.4 is the other google dns IIRC
14:40 < abcdef> if i dont push dns i do see dns requests going to my isp dns in wireshark
14:41 < abcdef> or alternativly i can just manually set dns in the wifi interaface options but now its set to auto
14:41 < abcdef> i just think these SSDP packets are annoying they are flooding my wireshark
14:41 < hyper_ch> you can filter them out
14:41 < abcdef> destination 239.255.255.250, NOTIFY
14:41 < abcdef> not sure what is causing them
14:42 < hyper_ch> whois 239.255.255.250
14:42 < hyper_ch> No whois server is known for this kind of object.
14:44 < abcdef> it's just local thing
14:44 < abcdef> the only other thing i noticed is that ssh doesn't go through the vpn
14:45 < abcdef> but that is encrypted anyway
14:45 < hyper_ch> i hvae no problem with ssh through the vpn
14:46 < abcdef> weird
14:46 < abcdef> must have its own route set up
14:47 -!- bs0d [~bs0d@sa-184-60.saturn.infonet.ee] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.3 Shiny(svn-3438) http://www.kvirc.net]
14:47 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
14:49 -!- thebishop [~thebishop@66.187.140.174] has joined #openvpn
14:51 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
15:00 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
15:10 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
15:14 -!- Guest98092 [~JoeGazz84@techessentials.org] has joined #openvpn
15:19 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:22 -!- Guest98092 [~JoeGazz84@techessentials.org] has quit [Changing host]
15:22 -!- Guest98092 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
15:22 -!- Guest98092 [~JoeGazz84@wikimedia/Joe-Gazz84] has left #openvpn []
15:23 -!- Guest98092 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
15:23 -!- Guest98092 [~JoeGazz84@wikimedia/Joe-Gazz84] has left #openvpn []
15:43 -!- fread228_ [~fread2281@70-56-131-138.albq.qwest.net] has joined #openvpn
15:44 -!- fread2281 [~fread2281@70-56-132-9.albq.qwest.net] has quit [Ping timeout: 252 seconds]
16:08 -!- eHAPPY [~typerazor@ip174-69-137-16.br.br.cox.net] has joined #openvpn
16:09 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
16:19 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
16:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:19 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
16:26 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
16:31 -!- dannnnn [~robott@124.78.181.100] has joined #openvpn
16:32 -!- abcdef [~robott@208.111.39.186] has quit [Read error: Connection reset by peer]
16:35 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
16:36 -!- thebishop [~thebishop@66.187.140.174] has quit [Read error: Operation timed out]
16:45 -!- Denial [Denial@drgi.co.uk] has quit []
16:50 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:52 -!- corretico [~luis@201.201.44.82] has joined #openvpn
16:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Excess Flood]
17:00 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:13 -!- dxtr [iul3hv@unaffiliated/dxtr] has quit [Read error: Connection reset by peer]
17:14 -!- dxtr [5icd8e@dxtr.cc] has joined #openvpn
17:15 -!- scampbell [~scampbell@c-68-41-182-105.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
17:24 <@vpnHelper> RSS Update - forum: [Help] Secure or Not? <http://forums.openvpn.net/topic9168.html>
17:30 -!- dxtr [5icd8e@dxtr.cc] has quit [Read error: Connection reset by peer]
17:30 <@vpnHelper> RSS Update - forum: Dynamic DNS <http://forums.openvpn.net/topic9169.html>
17:31 -!- dxtr [9l9y5e@dxtr.cc] has joined #openvpn
17:36 -!- dannnnn [~robott@124.78.181.100] has quit [Ping timeout: 260 seconds]
17:36 -!- novaflash is now known as novaflash_away
17:37 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has quit [Quit: Leaving.]
17:44 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:49 -!- fread2281 [~fread2281@70-56-129-45.albq.qwest.net] has joined #openvpn
17:49 -!- astruasdh [bd26ae85@gateway/web/freenode/ip.189.38.174.133] has joined #openvpn
17:49 < astruasdh> please, guys. in order to use IPSec, do I need special routers in the middle of the two hosts or the IP header is not modified?
17:50 -!- fread228_ [~fread2281@70-56-131-138.albq.qwest.net] has quit [Ping timeout: 252 seconds]
17:50 < EugeneKay> OpenVPN is not IPSec.
17:52 < astruasdh> yeah,,, but I am with this doubt, and maybe here someone can help me... do you know?
17:52 < EugeneKay> Nope.
17:53 < astruasdh> thanks
18:00 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
18:03 -!- dxtr [9l9y5e@dxtr.cc] has quit [Read error: Connection reset by peer]
18:04 -!- dxtr [wrykl4@dxtr.cc] has joined #openvpn
18:05 < EugeneKay> Sure.
18:10 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
18:12 -!- astruasdh [bd26ae85@gateway/web/freenode/ip.189.38.174.133] has quit [Quit: Page closed]
18:20 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:25 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
18:25 -!- dxtr [wrykl4@dxtr.cc] has quit [Read error: Connection reset by peer]
18:25 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:26 -!- dxtr [zsl03b@dxtr.cc] has joined #openvpn
18:29 -!- dxtr [zsl03b@dxtr.cc] has quit [Read error: Connection reset by peer]
18:31 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
18:31 -!- dxtr [32uwnd@dxtr.cc] has joined #openvpn
18:31 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:35 -!- dxtr [32uwnd@dxtr.cc] has quit [Read error: Connection reset by peer]
18:37 -!- Run32dll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
18:38 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:40 -!- dxtr [45uwfb@dxtr.cc] has joined #openvpn
18:42 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 245 seconds]
18:45 -!- dxtr [45uwfb@dxtr.cc] has quit [Read error: Connection reset by peer]
18:45 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
18:47 -!- dxtr [exb04n@dxtr.cc] has joined #openvpn
18:47 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
18:47 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:52 -!- dxtr [exb04n@dxtr.cc] has quit [Read error: Connection reset by peer]
18:52 -!- dxtr [594swt@dxtr.cc] has joined #openvpn
18:53 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
18:53 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
18:54 -!- hosters [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:55 -!- corretico [~luis@201.201.44.82] has joined #openvpn
18:56 < hosters> how can an ISP block tcp and udp ports but able to let users use their http proxy to connect to?
19:00 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
19:02 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Ping timeout: 252 seconds]
19:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:08 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
19:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:11 -!- dxtr [594swt@dxtr.cc] has quit [Read error: Connection reset by peer]
19:12 -!- hosters [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
19:12 -!- dxtr [xyo0tx@dxtr.cc] has joined #openvpn
19:18 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
19:19 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:20 -!- Yen [Yen@unaffiliated/yen] has quit []
19:25 -!- dxtr [xyo0tx@dxtr.cc] has quit [Read error: Connection reset by peer]
19:26 -!- dxtr [ajpau4@dxtr.cc] has joined #openvpn
19:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:31 -!- dxtr [ajpau4@dxtr.cc] has quit [Read error: Connection reset by peer]
19:33 -!- dxtr [krcngj@dxtr.cc] has joined #openvpn
19:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:45 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
19:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:12 -!- dxtr [krcngj@dxtr.cc] has quit [Read error: Connection reset by peer]
20:13 -!- dxtr [ljgua2@dxtr.cc] has joined #openvpn
20:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:21 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:23 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
20:24 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:25 -!- _julian_ [~quassel@hmbg-5f761cf2.pool.mediaWays.net] has joined #openvpn
20:29 -!- _julian [~quassel@hmbg-4d06dbe3.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
20:29 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:29 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
20:32 -!- ravel [ravel@175.136.82.14] has joined #openvpn
20:32 -!- ravel [ravel@175.136.82.14] has quit [Client Quit]
20:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:36 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
20:38 <@vpnHelper> RSS Update - forum: SOLVED: Error accessing NAS via OpenVPN <http://forums.openvpn.net/topic9139.html#p17239>
20:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:00 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Ping timeout: 260 seconds]
21:03 -!- dxtr [ljgua2@dxtr.cc] has quit [Read error: Connection reset by peer]
21:05 -!- dxtr [z9auuo@dxtr.cc] has joined #openvpn
21:06 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
21:07 -!- dxtr [z9auuo@dxtr.cc] has quit [Read error: Connection reset by peer]
21:08 -!- networkstaff [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
21:08 < networkstaff> any one here? I just have one question to ask.
21:10 -!- dxtr [jx40po@dxtr.cc] has joined #openvpn
21:14 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
21:20 -!- dxtr [jx40po@dxtr.cc] has quit [Read error: Connection reset by peer]
21:21 -!- dxtr [ynhxq7@dxtr.cc] has joined #openvpn
21:23 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
21:24 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
21:27 -!- networkstaff [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
21:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
21:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:44 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
21:45 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:49 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
21:54 -!- dxtr [ynhxq7@dxtr.cc] has quit [Read error: Connection reset by peer]
21:55 -!- dxtr [va34k0@dxtr.cc] has joined #openvpn
22:00 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:16 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:19 -!- fread2281 [~fread2281@70-56-129-45.albq.qwest.net] has quit [Ping timeout: 245 seconds]
22:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:24 -!- dxtr [va34k0@dxtr.cc] has quit [Read error: Connection reset by peer]
22:24 -!- dxtr [0s6r4z@dxtr.cc] has joined #openvpn
22:25 -!- fread2281 [~fread2281@70-56-211-83.albq.qwest.net] has joined #openvpn
22:28 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 248 seconds]
22:48 -!- dxtr [0s6r4z@dxtr.cc] has quit [Read error: Connection reset by peer]
22:49 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:49 -!- novaflash_away is now known as novaflash
22:50 -!- dxtr [70u95u@dxtr.cc] has joined #openvpn
22:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
23:03 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has joined #openvpn
23:03 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has left #openvpn []
23:07 -!- novaflash is now known as novaflash_away
23:11 -!- dxtr [70u95u@dxtr.cc] has quit [Read error: Connection reset by peer]
23:12 -!- dxtr [00cyhx@dxtr.cc] has joined #openvpn
23:14 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
23:26 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:35 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 276 seconds]
23:35 < EugeneKay> Nobody but us rocks.
23:36 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:51 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p17240>
23:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:58 -!- yos [~yos@seattle198.riseup.net] has joined #openvpn
--- Day changed Fri Nov 04 2011
00:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
00:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:36 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
00:38 -!- corretico [~luis@201.201.44.82] has joined #openvpn
00:40 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Read error: Connection reset by peer]
00:45 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
00:45 -!- corretico [~luis@201.201.44.82] has joined #openvpn
00:48 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
01:11 -!- corretico [~luis@201.201.44.82] has joined #openvpn
01:14 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:15 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
01:16 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 256 seconds]
01:26 -!- dannnnn [~robott@124.78.181.100] has joined #openvpn
01:33 -!- dxtr [00cyhx@dxtr.cc] has quit [Read error: Connection reset by peer]
01:34 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Quit: ChatZilla 0.9.87 [SeaMonkey 2.6a1/20110829214107]]
01:34 -!- dxtr [ujisro@dxtr.cc] has joined #openvpn
01:41 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 244 seconds]
01:42 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
01:43 -!- dxtr [ujisro@dxtr.cc] has quit [Read error: Connection reset by peer]
01:43 -!- dxtr [8tz408@dxtr.cc] has joined #openvpn
01:44 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 245 seconds]
01:50 -!- dxtr [8tz408@dxtr.cc] has quit [Read error: Connection reset by peer]
01:51 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
01:53 -!- dxtr [e1hidy@dxtr.cc] has joined #openvpn
01:59 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:59 -!- dannnnn [~robott@124.78.181.100] has quit []
02:00 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
02:03 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 255 seconds]
02:05 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
02:05 -!- dxtr [e1hidy@dxtr.cc] has quit [Read error: Connection reset by peer]
02:07 -!- dxtr [vqefl3@dxtr.cc] has joined #openvpn
02:10 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
02:10 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
02:19 <@vpnHelper> RSS Update - forum: Infinite looping by openvpn server while trying to connect <http://forums.openvpn.net/topic9166.html#p17241>
02:21 -!- novaflash_away is now known as novaflash
02:24 -!- yos [~yos@seattle198.riseup.net] has quit [Read error: Connection reset by peer]
02:25 <@vpnHelper> RSS Update - forum: VPN Connection problem <http://forums.openvpn.net/topic9167.html#p17243> || [Help] Secure or Not? <http://forums.openvpn.net/topic9168.html#p17242>
02:37 <@vpnHelper> RSS Update - forum: Dynamic DNS <http://forums.openvpn.net/topic9169.html#p17244>
02:42 -!- dxtr [vqefl3@dxtr.cc] has quit [Read error: Connection reset by peer]
02:42 -!- DaIRC55924 [~reise@75.127.123.241] has joined #openvpn
02:43 <@vpnHelper> RSS Update - forum: OVPN Windows Client keeps disconnecting and reconnecting <http://forums.openvpn.net/topic9163.html#p17245>
02:43 < DaIRC55924> Is there a way to use a single oepnvpn instance to do both tcp and udp? :x
02:43 -!- DaIRC55924 is now known as derp
02:43 -!- dxtr [ggf9j3@dxtr.cc] has joined #openvpn
02:47 -!- Mimiko [~mimiko@77.89.245.38] has joined #openvpn
02:47 < Mimiko> hello world
02:47 < Mimiko> krzeeeeee
02:48 -!- derp [~reise@75.127.123.241] has quit [Ping timeout: 260 seconds]
02:57 -!- Mimiko [~mimiko@77.89.245.38] has quit [Remote host closed the connection]
02:58 -!- kyrix [~ashley@194.24.138.7] has joined #openvpn
03:03 -!- Mimiko [~mimiko@77.89.245.38] has joined #openvpn
03:05 < Mowee> Morning
03:05 < Mimiko> nyan
03:05 -!- dxtr [ggf9j3@dxtr.cc] has quit [Read error: Connection reset by peer]
03:06 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
03:06 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
03:06 -!- dxtr [odde7h@dxtr.cc] has joined #openvpn
03:08 -!- corretico [~luis@201.201.44.82] has joined #openvpn
03:08 -!- dxtr [odde7h@dxtr.cc] has quit [Read error: Connection reset by peer]
03:11 -!- dxtr [hq13pv@dxtr.cc] has joined #openvpn
03:11 -!- dxtr [hq13pv@dxtr.cc] has quit [Read error: Connection reset by peer]
03:16 -!- dxtr [0ycx89@dxtr.cc] has joined #openvpn
03:17 -!- venom00 [~venom00@109.116.180.75] has joined #openvpn
03:17 -!- venom00 [~venom00@109.116.180.75] has quit [Changing host]
03:17 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
03:17 -!- dxtr [0ycx89@dxtr.cc] has quit [Read error: Connection reset by peer]
03:19 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
03:21 -!- dxtr [c1trtm@dxtr.cc] has joined #openvpn
03:23 <@vpnHelper> RSS Update - forum: client cannot browse internet - routing? <http://forums.openvpn.net/topic9171.html>
03:24 -!- dxtr [c1trtm@dxtr.cc] has quit [Read error: Connection reset by peer]
03:26 -!- dxtr [itmwcn@dxtr.cc] has joined #openvpn
03:27 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
03:29 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:35 -!- venom00 [~venom00@109.116.219.6] has joined #openvpn
03:35 -!- venom00 [~venom00@109.116.219.6] has quit [Changing host]
03:35 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
03:39 -!- dxtr [itmwcn@dxtr.cc] has quit [Read error: Connection reset by peer]
03:42 -!- dxtr [0cb39k@dxtr.cc] has joined #openvpn
03:46 -!- dxtr [0cb39k@dxtr.cc] has quit [Read error: Connection reset by peer]
03:51 -!- dxtr [vvc3va@dxtr.cc] has joined #openvpn
03:52 -!- dazo_afk is now known as dazo
03:55 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:56 -!- dxtr [vvc3va@dxtr.cc] has quit [Read error: Connection reset by peer]
03:58 -!- dxtr [dt5b0c@dxtr.cc] has joined #openvpn
04:17 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Ping timeout: 258 seconds]
04:32 -!- happylife [~happylife@net-33.nrpn.net] has joined #openvpn
04:58 < bjorneven> anyone know if openvpn can tag traffic with vlan ?
05:05 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
05:05 -!- dannnnn [~robott@208.111.39.186] has joined #openvpn
05:05 <@vpnHelper> RSS Update - forum: OVPN Windows Client keeps disconnecting and reconnecting <http://forums.openvpn.net/topic9163.html#p17247>
05:05 < dannnnn> how to get ssh packets to go over the vpn?
05:06 < bjorneven> solved with routes
05:06 < bjorneven> on client
05:06 < bjorneven> no specifics other than that
05:06 < bjorneven> fw on vpn must allow of course
05:07 < dannnnn> ok
05:08 -!- dxtr [dt5b0c@dxtr.cc] has quit [Read error: Connection reset by peer]
05:08 < dannnnn> thx
05:09 -!- dxtr [7njsdw@dxtr.cc] has joined #openvpn
05:11 -!- dxtr [7njsdw@dxtr.cc] has quit [Read error: Connection reset by peer]
05:14 -!- dxtr [e47i9f@dxtr.cc] has joined #openvpn
05:22 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Quit: Leaving]
05:29 -!- Mimiko [~mimiko@77.89.245.38] has quit [Remote host closed the connection]
05:34 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
05:34 -!- axelm7 [~Admin@201.255.35.59] has joined #openvpn
05:36 < axelm7> hi I am using openvpn gui to run my ovpn file on windows 7. I can connect fine but I can see in the log that the route add command is failing. If I run the client as administrator it works ok. What's the correct workaround?
05:37 < axelm7> do I have to disable the windows firewall on the tun adapter?
05:39 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:39 < axelm7> so many people here and nobody uses win7 ?
05:40 < bjorneven> I set it to permanently run as admin
05:40 < bjorneven> only solution afaik
05:40 < axelm7> you set c:\program files\openvpn\bin\openvpn.exe to run as admin?
05:41 -!- fread228_ [~fread2281@70-56-130-136.albq.qwest.net] has joined #openvpn
05:41 < bjorneven> openvpn gui
05:41 < bjorneven> made a flash video instructing my users doing the same
05:42 -!- fread2281 [~fread2281@70-56-211-83.albq.qwest.net] has quit [Ping timeout: 260 seconds]
05:42 < axelm7> so when win7 boots it will ask for privilege escalation for the gui?
05:42 < bjorneven> I have never run it at boot
05:42 < bjorneven> but yes it asks
05:42 < bjorneven> annoying
05:42 < bjorneven> you could try http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin.html
05:42 <@vpnHelper> Title: HowTo Run OpenVPN as a non-admin user in Windows (at openvpn.se)
05:42 < axelm7> this should run as service using NetworkService account
05:48 < axelm7> bjorneven, thans, that worked fine. I will remove the gui from the autostart
05:49 < axelm7> *thanks
05:50 < bjorneven> np
05:54 -!- dannnnn [~robott@208.111.39.186] has quit [Ping timeout: 258 seconds]
05:58 <@vpnHelper> RSS Update - forum: Star Topolgy - passing routes to all remote servers <http://forums.openvpn.net/topic9052.html#p17248>
06:04 <@vpnHelper> RSS Update - forum: Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html>
06:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
06:15 -!- Holister [~holister@75.92.109.172] has joined #openvpn
06:17 < Holister> I have a public ip on eth1, private lan 10.168 on br0, and another lan 10.136 on tun1.. if I do iptables -t nat -A PREROUTING -d ${LANIP}/32 -i eth1 -p tcp -m tcp --dport 4321 -j DNAT --to-destination 10.168.5.6:1234 it works, but if I change the --to to 10.136.7.8:1234 it doesn't... why is that?
06:19 < Holister> ${LANIP} should be ${INETIP} in that example... typed it wrong
06:20 -!- happylife [~happylife@net-33.nrpn.net] has quit [Read error: Operation timed out]
06:29 < axelm7> I have antoher question. Can someone recommend a low cost crypto accelerator compatible with openvpn and that can be accessed from virtualized guests running Linux_
06:30 -!- Mimiko [~mimiko@77.89.245.38] has joined #openvpn
06:31 -!- Admin_ [~Admin@201.255.35.59] has joined #openvpn
06:32 -!- Admin_ is now known as axelm8
06:35 -!- axelm7 [~Admin@201.255.35.59] has quit [Ping timeout: 258 seconds]
06:38 <@vpnHelper> RSS Update - forum: Star Topolgy - passing routes to all remote servers <http://forums.openvpn.net/topic9052.html#p17250>
06:39 < EugeneKay> Holister - my guessis you have another iptables rule blocking it before it gets there
06:40 < EugeneKay> axelm8 - sorry, never used a hardware crypto card. The -as guys might know, tho.
06:40 < EugeneKay> Or try getting the Xeons with integrated AES
06:41 < axelm8> The giuys at AS told me they were not using openssl lib with aesni yet
06:41 < axelm8> *guys
06:42 < EugeneKay> Then I really have no clue
06:42 < EugeneKay> Would you like a bagel? I do have those.
06:42 < axelm8> I was just thinking that the internet line is only 30 mbps so CPU based crypto should be good enough
06:42 < EugeneKay> !gigabit
06:42 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
06:44 < EugeneKay> Probably worth a read
06:44 <@vpnHelper> RSS Update - forum: Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17252> || Client configuration <http://forums.openvpn.net/topic9165.html#p17251>
06:48 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
06:48 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
06:48 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
06:50 <@vpnHelper> RSS Update - forum: OVPN Windows Client keeps disconnecting and reconnecting <http://forums.openvpn.net/topic9163.html#p17254> || client cannot browse internet - routing? <http://forums.openvpn.net/topic9171.html#p17253>
06:56 <@vpnHelper> RSS Update - forum: Star Topolgy - passing routes to all remote servers <http://forums.openvpn.net/topic9052.html#p17255>
07:02 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
07:02 <@vpnHelper> RSS Update - forum: Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17256>
07:04 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:06 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
07:17 -!- dannnnn [~robott@208.111.39.186] has joined #openvpn
07:19 -!- dannnnn [~robott@208.111.39.186] has quit []
07:24 -!- dannnnn [~robott@208.111.39.186] has joined #openvpn
07:24 -!- patelx [nebula@openvpn/corp/admin/patel] has quit [Ping timeout: 244 seconds]
07:27 < dannnnn> anyone know what route to add so my ssh goes over the vpn
07:28 < dannnnn> redirect gateway on server isn't letting ssh go over the vpn
07:30 -!- happylife [~happylife@213.28.38.178] has joined #openvpn
07:34 -!- corretico [~luis@201.201.44.82] has joined #openvpn
07:44 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 260 seconds]
07:49 -!- bretanika [bretanika@89.114.11.171] has quit [Ping timeout: 240 seconds]
07:51 < bjorneven> dannnnn: wireshark, check your assumptions
07:51 < bjorneven> dannnnn: there is nothing special about ssh, its just tcp 
07:52 < bjorneven> dannnnn: so use wireshark to sniff where the traffic is going
07:52 < bjorneven> dannnnn: and print out routing table to see that your ssh server would be on the route via the tunnel network
07:59 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
08:01 <@vpnHelper> RSS Update - forum: OVPN Windows Client keeps disconnecting and reconnecting <http://forums.openvpn.net/topic9163.html#p17258> || Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17257>
08:06 -!- bretanika [bretanika@89.114.11.171] has quit [Ping timeout: 240 seconds]
08:10 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
08:10 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
08:20 < dannnnn> if its just tcp it should be going over the vpn by default
08:22 < bjorneven> yes, but only if the ssh server is in the route 
08:22 < bjorneven> over the tunnel
08:23 < bjorneven> so check your tunnel
08:23 < bjorneven> use wireshark to see that traffic goes the right way, or tcpdump on the openvpn server
08:26 < dannnnn> ok
08:37 -!- axelm7 [~Admin@201.255.35.59] has joined #openvpn
08:40 -!- axelm8 [~Admin@201.255.35.59] has quit [Ping timeout: 240 seconds]
08:44 -!- Mimiko [~mimiko@77.89.245.38] has quit []
08:47 < dannnnn> ach can't work it out
08:47 < dannnnn> it doesnt matter anwayy as ssh is already encrypted
08:52 -!- dannnnn [~robott@208.111.39.186] has quit [Ping timeout: 244 seconds]
09:07 -!- happylife [~happylife@213.28.38.178] has quit [Ping timeout: 256 seconds]
09:08 -!- master_of_master [~master_of@p57B530DA.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
09:09 -!- master_of_master [~master_of@p57B53B91.dip.t-dialin.net] has joined #openvpn
09:12 -!- happylife [~happylife@213.28.38.178] has joined #openvpn
09:15 -!- dxtr [e47i9f@dxtr.cc] has quit [Read error: Connection reset by peer]
09:16 -!- dxtr [rfe3x5@dxtr.cc] has joined #openvpn
09:21 -!- happylife [~happylife@213.28.38.178] has quit [Ping timeout: 244 seconds]
09:21 -!- venom00 [~venom00@109.117.248.12] has joined #openvpn
09:21 -!- venom00 [~venom00@109.117.248.12] has quit [Changing host]
09:21 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
09:25 -!- happylife [~happylife@213.28.38.178] has joined #openvpn
09:25 <@vpnHelper> RSS Update - forum: Needing some help with 1 PC connecting but not working <http://forums.openvpn.net/topic9173.html>
09:25 -!- patelx [nebula@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
09:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
09:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:34 -!- dxtr [rfe3x5@dxtr.cc] has quit [Read error: Connection reset by peer]
09:35 -!- dxtr [s481j4@dxtr.cc] has joined #openvpn
09:37 -!- kyrix [~ashley@194.24.138.7] has quit [Quit: Ex-Chat]
09:37 <@vpnHelper> RSS Update - forum: Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17260>
09:41 -!- bretanika [~bretanika@89.38.199.142] has joined #openvpn
09:42 -!- dxtr [s481j4@dxtr.cc] has quit [Read error: Connection reset by peer]
09:43 <@vpnHelper> RSS Update - forum: Needing some help with 1 PC connecting but not working <http://forums.openvpn.net/topic9173.html#p17261>
09:44 -!- dxtr [ac2qcg@dxtr.cc] has joined #openvpn
09:46 -!- dxtr [ac2qcg@dxtr.cc] has quit [Read error: Connection reset by peer]
09:49 -!- dxtr [lfhabu@dxtr.cc] has joined #openvpn
09:51 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has joined #openvpn
09:52 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Quit: Leaving.]
09:59 -!- dxtr [lfhabu@dxtr.cc] has quit [Read error: Connection reset by peer]
09:59 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
09:59 -!- dxtr [q8m7rc@dxtr.cc] has joined #openvpn
10:01 <@vpnHelper> RSS Update - forum: How to gen client-cert for multi-server on the same machine <http://forums.openvpn.net/topic9174.html>
10:09 -!- dxtr [q8m7rc@dxtr.cc] has quit [Read error: Connection reset by peer]
10:11 -!- dxtr [duyhl3@dxtr.cc] has joined #openvpn
10:12 -!- dxtr [duyhl3@dxtr.cc] has quit [Read error: Connection reset by peer]
10:16 -!- dxtr [tzra7m@dxtr.cc] has joined #openvpn
10:17 -!- fread228_ [~fread2281@70-56-130-136.albq.qwest.net] has quit [Ping timeout: 256 seconds]
10:18 -!- dxtr [tzra7m@dxtr.cc] has quit [Read error: Connection reset by peer]
10:19 -!- fread2281 [~fread2281@70-56-134-104.albq.qwest.net] has joined #openvpn
10:21 -!- fread228_ [~fread2281@70-56-134-78.albq.qwest.net] has joined #openvpn
10:21 -!- dxtr [pgj6zh@dxtr.cc] has joined #openvpn
10:24 -!- fread2281 [~fread2281@70-56-134-104.albq.qwest.net] has quit [Ping timeout: 260 seconds]
10:25 -!- ryan0x2 [~ryan0x2@c-75-70-203-129.hsd1.co.comcast.net] has joined #openvpn
10:26 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Ping timeout: 240 seconds]
10:27 < ryan0x2> am having some trouble.  in OSX, trying to get a guest OS(XP in parallels) to always go through a vpn connected on the host (tun0), could do connection sharing or sharing from parallels, but tun0 doesn't show up in network preferences pane. any way to make it show up, or any ideas for a work around?
10:29 <@vpnHelper> RSS Update - forum: How to gen client-cert for multi-server on the same machine <http://forums.openvpn.net/topic9174.html#p17263>
10:29 -!- fread228_ [~fread2281@70-56-134-78.albq.qwest.net] has quit [Ping timeout: 258 seconds]
10:32 -!- fread2281 [~fread2281@70-56-208-246.albq.qwest.net] has joined #openvpn
10:36 < krzee> ryan0x2, i have that happen as a byproduct of how i do my vpn
10:36 < krzee> !routebyapp
10:36 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
10:37 < krzee> otherwise, no
10:37 < krzee> youd need to connect to the vpn on the actual vm otherwise
10:39 < ryan0x2> has to be a way, seems like a fairly reasonable scenario.  have tried running natd, etc. on the host os x but no packets hit the divert rule, i think may be something specific to parallels' virtual adapaters
10:39 < krzee> there is a way
10:40 < krzee> i told you, my VMs do it
10:40 < krzee> :-p
10:40 < ryan0x2> proxying thru socks is silly,  cmon.
10:40 < krzee> but if you're gunna start saying "there has to be a way using only exactly what i want to use" then ill stop paying attention
10:41 < krzee> thinking you can default route through in the way you're thinking is more silly
10:41 < krzee> you either need to do it in the VMs routing table, or not do it
10:41 < krzee> cause it wont be happening in the hosts routing table
10:42 < krzee> anyways, that was my answer... bbl
10:43 < ryan0x2> i've obv. added the route to 0.0.0.0/0 to use the gateway host-to-host connection (which has natd, plus the ipfw rules), packets just aren't hitting the divert rule.  thought maybe someone had experience w/ this, google seems short.
10:43 -!- ph1l [~ph1l@gprs19.swisscom-mobile.ch] has joined #openvpn
10:43 < ryan0x2> but thx for trying
10:44 < krzee> well hold up
10:44 < krzee> you saying now you accept running the vpn from the VM?
10:44 < krzee> or you're thinking you can do it all from the host?
10:44 < ryan0x2> i have to run the vpn from a host, its a requirement.  wish i could just do it from the vm i'd have already moved on with my day ;)
10:45 < krzee> ok, well ya it wont be happening
10:45 < ryan0x2> i shall venture to prove you wrong! but cheers, thx
10:45 < krzee> at least not how you're thinking
10:45 < krzee> np
10:45 < krzee> btw, a proper socks daemon can route udp packets
10:45 < krzee> i get no added latency, jitter, or speed reduction from this setup
10:46 < krzee> (as compared to ovpn without socks)
10:46 < krzee> all i get is extreme flexibility
10:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
10:46 < ryan0x2> i'd have to run the client on the vm though, ya?
10:46 < krzee> no
10:46 < krzee> nothing on the vm
10:47 < ryan0x2> 'proxifier' is your suggested app?
10:47 < ryan0x2> potentially this could work
10:47 < krzee> its what i use
10:47 < krzee> (on osx)
10:47 < ryan0x2> ok, will look, thanks much
10:47 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
10:47 < krzee> i think i paid $10 for it... one of the few apps i have bought, and i would do it again
10:47 < krzee> !sockd
10:47 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
10:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:57 -!- dxtr [pgj6zh@dxtr.cc] has quit [Read error: Connection reset by peer]
10:57 -!- dxtr [s2y76v@dxtr.cc] has joined #openvpn
11:05 -!- ryan0x2 [~ryan0x2@c-75-70-203-129.hsd1.co.comcast.net] has quit [Remote host closed the connection]
11:07 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has joined #openvpn
11:09 -!- venom00 [~venom00@net-188-218-177-38.cust.dsl.vodafone.it] has joined #openvpn
11:09 -!- venom00 [~venom00@net-188-218-177-38.cust.dsl.vodafone.it] has quit [Changing host]
11:09 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
11:11 -!- oribulus [~bretanika@89.38.199.142] has joined #openvpn
11:11 -!- oribulus [~bretanika@89.38.199.142] has quit [Client Quit]
11:15 -!- axelm7 [~Admin@201.255.35.59] has quit [Ping timeout: 255 seconds]
11:15 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:20 -!- dxtr [s2y76v@dxtr.cc] has quit [Read error: Connection reset by peer]
11:22 -!- dxtr [ymkobl@dxtr.cc] has joined #openvpn
11:23 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
11:23 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 256 seconds]
11:24 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
11:35 -!- ryan0x2 [~ryan0x2@c-75-70-203-129.hsd1.co.comcast.net] has joined #openvpn
11:42 -!- happylife [~happylife@213.28.38.178] has quit [Read error: Operation timed out]
11:44 -!- dxtr [ymkobl@dxtr.cc] has quit [Read error: Connection reset by peer]
11:47 -!- dxtr [vrth4j@dxtr.cc] has joined #openvpn
11:49 -!- dxtr [vrth4j@dxtr.cc] has quit [Read error: Connection reset by peer]
11:52 -!- dxtr [9oy621@dxtr.cc] has joined #openvpn
11:56 -!- ph1l [~ph1l@gprs19.swisscom-mobile.ch] has quit [Read error: Connection reset by peer]
11:59 -!- ph1l [~ph1l@gprs19.swisscom-mobile.ch] has joined #openvpn
11:59 -!- simoon [~nak@ip98-165-68-248.ph.ph.cox.net] has left #openvpn []
12:23 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
12:23 -!- dazo is now known as dazo_afk
12:26 <@vpnHelper> RSS Update - forum: Too much log noise <http://forums.openvpn.net/topic9176.html> || Group Permissions for LDAP Users <http://forums.openvpn.net/topic9175.html>
12:37 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has joined #openvpn
12:40 -!- fread228_ [~fread2281@70-56-132-143.albq.qwest.net] has joined #openvpn
12:40 -!- fread2281 [~fread2281@70-56-208-246.albq.qwest.net] has quit [Ping timeout: 244 seconds]
12:41 -!- ph1l [~ph1l@gprs19.swisscom-mobile.ch] has quit [Read error: Connection reset by peer]
12:46 -!- dxtr [9oy621@dxtr.cc] has quit [Read error: Connection reset by peer]
12:48 -!- fread228_ [~fread2281@70-56-132-143.albq.qwest.net] has quit [Ping timeout: 260 seconds]
12:49 -!- dxtr [nk7ieh@dxtr.cc] has joined #openvpn
12:49 -!- fread2281 [~fread2281@70-56-132-20.albq.qwest.net] has joined #openvpn
12:49 -!- ph1l [~ph1l@80-218-106-249.dclient.hispeed.ch] has joined #openvpn
12:52 < frankcui24> hi, could anyone explain the 'ping-timer-rem' option a little bit to me? i dont understand its usage very well through the help option.
12:54 < frankcui24> the help output says run the ping-exit and ping-restart only when we have the remote address. the remote address means the presences of --remote or not ??
12:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:57 -!- dxtr [nk7ieh@dxtr.cc] has quit [Read error: Connection reset by peer]
12:58 -!- dxtr [bkxj4m@dxtr.cc] has joined #openvpn
13:02 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:02 -!- mode/#openvpn [+v s7r] by ChanServ
13:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:06 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17266>
13:12 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
13:18 <@vpnHelper> RSS Update - forum: Group Permissions for LDAP Users <http://forums.openvpn.net/topic9175.html#p17267>
13:26 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:26 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:30 <@vpnHelper> RSS Update - forum: OpenVPN on DD-WRT router <http://forums.openvpn.net/topic9160.html#p17268>
13:39 -!- axelm7 [~Admin@190.244.31.91] has joined #openvpn
13:39 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
13:50 -!- ph1l1 [~ph1l@80-218-106-249.dclient.hispeed.ch] has joined #openvpn
13:51 -!- ph1l [~ph1l@80-218-106-249.dclient.hispeed.ch] has quit [Ping timeout: 258 seconds]
13:51 -!- dxtr [bkxj4m@dxtr.cc] has quit [Read error: Connection reset by peer]
13:56 -!- dxtr [czwq7c@dxtr.cc] has joined #openvpn
14:11 -!- dxtr [czwq7c@dxtr.cc] has quit [Read error: Connection reset by peer]
14:14 -!- dxtr [btiwbd@dxtr.cc] has joined #openvpn
14:17 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has quit [Ping timeout: 248 seconds]
14:18 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has joined #openvpn
14:36 <@vpnHelper> RSS Update - forum: VPN Connection problem <http://forums.openvpn.net/topic9167.html#p17270> || OVPN Windows Client keeps disconnecting and reconnecting <http://forums.openvpn.net/topic9163.html#p17269>
14:37 -!- ro_Ot [~Jikan@2001:41d0:2:401f::2] has quit [Quit: La vérité, c'est que tu es mou et paresseux. Tout le portrait de mon oncle Émile : celui-là, il passait jamais au soleil parce que ça le fatiguait de traîner son ombre.]
14:38 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
14:39 -!- bretanika [~bretanika@89.38.199.142] has quit []
14:40 -!- dannnnn [~robott@208.111.39.186] has joined #openvpn
14:42 <@vpnHelper> RSS Update - forum: [Help] Secure or Not? <http://forums.openvpn.net/topic9168.html#p17271>
14:44 -!- dxtr [btiwbd@dxtr.cc] has quit [Read error: Connection reset by peer]
14:45 -!- dannnnn [~robott@208.111.39.186] has quit [Ping timeout: 260 seconds]
14:45 -!- intelcore [~robott@208.111.39.186] has joined #openvpn
14:45 -!- dxtr [i8jjwa@dxtr.cc] has joined #openvpn
14:54 -!- intelcore [~robott@208.111.39.186] has quit [Ping timeout: 256 seconds]
14:54 -!- dannnnn [~robott@124.78.181.100] has joined #openvpn
15:12 -!- StFS [~stefan@gagnasetur.ru.is] has joined #openvpn
15:15 < StFS> Hello. I'm looking into using dnsmasq to handle DNS queries and directing them to the correct DNS server as appropriate. I have one (or more) VPN connections and for each of them I want DNS requests for hostnames under their domain name to be handled by the DNS servers behind that VPN. Does anybody know of a howto explaining how to set this up?
15:16 < StFS> preferrably I want this to happen automatically as I connect to the VPN
15:17 -!- dxtr [i8jjwa@dxtr.cc] has quit [Read error: Connection reset by peer]
15:18 -!- dxtr [gss0bv@dxtr.cc] has joined #openvpn
15:18 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p17272>
15:21 -!- ph1l1 [~ph1l@80-218-106-249.dclient.hispeed.ch] has quit [Quit: Leaving.]
15:29 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
15:29 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:34 -!- axelm7 [~Admin@190.244.31.91] has quit [Ping timeout: 258 seconds]
15:38 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
15:39 -!- axelm7 [~Admin@190.244.31.91] has joined #openvpn
15:40 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
15:44 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
15:45 -!- dxtr [gss0bv@dxtr.cc] has quit [Read error: Connection reset by peer]
15:47 -!- dxtr [r5ml5p@dxtr.cc] has joined #openvpn
15:54 <@vpnHelper> RSS Update - forum: Dynamic DNS <http://forums.openvpn.net/topic9169.html#p17273>
15:55 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
15:55 -!- axelm7 [~Admin@190.244.31.91] has quit [Ping timeout: 252 seconds]
15:55 -!- dazo_afk [dazo@nat/redhat/x-rfweoyaessnxoffc] has joined #openvpn
15:55 -!- dazo_afk is now known as Guest85343
16:07 -!- dxtr [r5ml5p@dxtr.cc] has quit [Read error: Connection reset by peer]
16:08 -!- dxtr [9oui87@dxtr.cc] has joined #openvpn
16:10 -!- axelm7 [~Admin@190.244.31.91] has joined #openvpn
16:11 -!- axelm7 [~Admin@190.244.31.91] has quit [Client Quit]
16:19 -!- dannnnn [~robott@124.78.181.100] has quit [Read error: Connection reset by peer]
16:19 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
16:20 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:24 <@vpnHelper> RSS Update - forum: Group Permissions for LDAP Users <http://forums.openvpn.net/topic9175.html#p17274>
16:30 <@vpnHelper> RSS Update - forum: Group Permissions for LDAP Users <http://forums.openvpn.net/topic9175.html#p17275>
16:31 -!- defsdoor [~andy@cpc15-sutt4-2-0-cust41.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:31 -!- dxtr [9oui87@dxtr.cc] has quit [Read error: Connection reset by peer]
16:32 -!- dxtr [m7ramf@dxtr.cc] has joined #openvpn
16:44 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
16:47 -!- WebDawg [~WebDawg@officialg0d.com] has joined #openvpn
16:47 < WebDawg> How do I create an additional tun interface in windows?
16:48 < WebDawg> Thanks.
16:48 < WebDawg> !goal create additional tun interface in windows.
16:55 < WebDawg> !goal to get someones attention to answer my question.
16:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
16:58 -!- dxtr [m7ramf@dxtr.cc] has quit [Read error: Connection reset by peer]
17:00 < krzee> !goal for people to read docs and/or chill the hell out and wait for someone to come around and feel like pointing to the right place in the docs
17:00 -!- dxtr [s3jo3r@dxtr.cc] has joined #openvpn
17:00 < krzee> http://openvpn.net/index.php/open-source/documentation/install.html?start=1
17:00 <@vpnHelper> Title: Installation Notes - Installation (Win32) (at openvpn.net)
17:00 < krzee> Notes -- Manual Install/Update/Uninstall of the TAP-Win32 kernel driver
17:00 < krzee> By installing multiple times, you will create additional TAP-Win32 adapter instances, which can be used for multiple concurrent VPN tunnels.
17:03 -!- dxtr [s3jo3r@dxtr.cc] has quit [Read error: Connection reset by peer]
17:05 -!- dxtr [23wuko@dxtr.cc] has joined #openvpn
17:07 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
17:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:09 < krzee> WebDawg, ^
17:09 -!- acdef [~robott@208.111.39.186] has joined #openvpn
17:09 < acdef> best value for MTU?
17:11 < krzee> default unless testing proves otherwise
17:13 < acdef> well im getting some 'backtrack replay' messages 
17:13 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
17:15 < krzee> you on wifi?
17:17 < krzee> --mute-replay-warnings
17:17 < krzee> Silence the output of replay warnings, which are a common false alarm on WiFi networks. This option preserves the security of the replay protection code without the verbosity associated with warnings about duplicate packets.
17:20 < WebDawg> Thanks.
17:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
17:23 -!- fread2281 [~fread2281@70-56-132-20.albq.qwest.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
17:26 < WebDawg> krzee, thanks.
17:28 < krzee> yw
17:28 < acdef> yes im on wifi
17:28 < acdef> you sure its ok to silence such warnings?
17:31 < acdef> i place that in server.conf or client.conf krzee?
17:31 < krzee> that question is a joke, right?
17:31 < acdef> no
17:32 < acdef> warnings are meant to.. .warn you something is wrong
17:32 < krzee> how bout putting it in the one you want to mute the replays on
17:32 < acdef> muting warnings seems backwards
17:32 < krzee> i cant answer that without directly quoting the manual which i just pasted to you, im leaving
17:35 -!- acdef [~robott@208.111.39.186] has left #openvpn []
17:36 < EugeneKay> "I wan't X to do Y, but I don't want Y"
17:37 < StFS> anybody know of a way to create a file (dnsmasq config file) when openvpn connection is established and then delete it when the connection is terminated?
17:48 < catsup> StFS: you probably want --ipchange
17:52 -!- abzic [sharpd@gateway/shell/bshellz.net/x-zztgpoygvyhaxwgq] has joined #openvpn
17:53 -!- abzic [sharpd@gateway/shell/bshellz.net/x-zztgpoygvyhaxwgq] has left #openvpn []
18:02 -!- dxtr [23wuko@dxtr.cc] has quit [Read error: Connection reset by peer]
18:04 -!- dxtr [2xjajp@dxtr.cc] has joined #openvpn
18:12 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:16 < StFS> catsup: well... I just noticed the --up and --down options... however they don't seem to be working for me for some reason
18:19 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17276>
18:20 < catsup> StFS: is your script running?
18:20 < StFS> catsup: you mean the script that I point to for --up?
18:20 < StFS> I've run it and it works if I run it manually yes
18:26 -!- dxtr [2xjajp@dxtr.cc] has quit [Read error: Connection reset by peer]
18:26 -!- dxtr [ei7c70@dxtr.cc] has joined #openvpn
18:37 -!- dxtr [ei7c70@dxtr.cc] has quit [Read error: Connection reset by peer]
18:38 -!- dxtr [0otadz@dxtr.cc] has joined #openvpn
18:39 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
18:40 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
18:40 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
18:40 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
18:56 < StFS> well I got it to work... I needed the #!/bin/bash line at the top of the script... but now I'm having problems with the down script... I need it to run as root but that doesn't seem to be possible
19:01 <@vpnHelper> RSS Update - forum: Grouped clients <http://forums.openvpn.net/topic9177.html>
19:02 -!- raidz is now known as raidz_afk
19:03 < krzee> of course its "possible"
19:03 < krzee> i bet you know 3 ways
19:03 < EugeneKay> Are you counting Mayan sacrifice?
19:03 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 260 seconds]
19:04 < StFS> krzee: ?
19:04 < krzee> you could not drop permissions
19:04 < krzee> you could setup sudo to allow the user permission to do that stuff
19:04 < StFS> krzee: well... yeah... not too fond of that
19:04 < StFS> well that's an idea
19:04 < krzee> you could make the script suid root
19:05 < EugeneKay> I'd go for the sudo route myself
19:05 < StFS> yeah... that sounds like a plan
19:05 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
19:05 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
19:05 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
19:06 < EugeneKay> setuid script is arguably more secure, but a PITA to make sure
19:06 < StFS> I don't know how to do that
19:06 < krzee> hows it a PITA to make sure?
19:07 < EugeneKay> If you're allowing variables to be passed
19:07 < krzee> well ya ild hope its not terribly written
19:07 < EugeneKay> It's not the sort of thing gramma sets up
19:07 < krzee> but i see what you mean... people using scripts written by others having no clue what they do under the hood and whatnot
19:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:08 < krzee> those same people would make the sudo route insecure
19:08 < krzee> or equally as insecure
19:08 < EugeneKay> "eh, its only root access"
19:11 < krzee> well i mean they'd set sudo to just allow the script
19:12 < krzee> which would be the same as sudo root
19:12 < krzee> err
19:12 < krzee> suid root*
19:12 -!- vpnuser [17133524@gateway/web/freenode/ip.23.19.53.36] has joined #openvpn
19:14 < vpnuser> good day
19:14 < vpnuser> can I ask how I can use dns on other port?
19:15 < krzee> only if you go to a dns channel
19:15 -!- vpnuser [17133524@gateway/web/freenode/ip.23.19.53.36] has quit [Client Quit]
19:16 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
19:17 -!- vpnuser [17133524@gateway/web/freenode/ip.23.19.53.36] has joined #openvpn
19:17 < vpnuser> thanks krzee
19:17 -!- vpnuser [17133524@gateway/web/freenode/ip.23.19.53.36] has left #openvpn []
19:22 < StFS> krzee: hmm... ok... stupid question... I did "chown root:root down-script ; chmod a+x down-script ; chmod u+s down-script" and inside it I do an echo "Running as user $USER" but what I get in the output is "Running as user "
19:22 < StFS> am I missing something?
19:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:23 < krzee> just make it run the command id
19:23 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 252 seconds]
19:23 < krzee> you assume EVERYTHING sets the $USER var that your shell did
19:24 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
19:24 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
19:24 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
19:24 < StFS> krzee: sorry... I'm a newbie... don't follow
19:25 < StFS> krzee: I get your second point... but make it run the command id?
19:25 < krzee> remove this line:
19:25 < krzee> "Running as user $USER"
19:25 < krzee> change it with this one:
19:25 < krzee> id
19:25 < krzee> that is the only thing in the script
19:27 -!- dxtr [0otadz@dxtr.cc] has quit [Read error: Connection reset by peer]
19:29 -!- novaflash is now known as novaflash_away
19:29 -!- dxtr [s0a8jx@dxtr.cc] has joined #openvpn
19:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:32 < StFS> krzee: ok got it... it's running as nobody: uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
19:39 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
19:40 < StFS> I guess the problem is that linux doesn't seem to allow suid shell scripts
19:41 < krzee> umm yes it does
19:41 < krzee> unless you have the filesystem mounted nosuid
19:42 < krzee> you should probably learn your os before trying to do all this
19:42 -!- ryan0x2 [~ryan0x2@c-75-70-203-129.hsd1.co.comcast.net] has quit [Remote host closed the connection]
19:45 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
19:45 < StFS> well, it's not working and I've found the same explanation in a number of discussion forums, that suid doesn't work on shell scripts
19:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:46 -!- gyyrog [~gyyrog@99.54.141.114] has joined #openvpn
19:47 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
19:48 < StFS> and this seems to be a pretty good explanation on why: http://www.faqs.org/faqs/unix-faq/faq/part4/section-7.html
19:48 <@vpnHelper> Title: Unix - Frequently Asked Questions (4/7) [Frequent posting]Section - How can I get setuid shell scripts to work? (at www.faqs.org)
19:50 < krzee> hah i guess ive never actually done it
19:50 < StFS> well... that may be a good thing given the security risks that seem to come from it
19:51 < StFS> but anyways... gotta go to bed... thanks for all your help. I'll do the sudo way tomorrow
19:53 -!- dxtr [s0a8jx@dxtr.cc] has quit [Read error: Connection reset by peer]
19:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:58 -!- dxtr [g6kn79@dxtr.cc] has joined #openvpn
20:00 < krzee> does make sense after reading that, thanx for the link
20:00 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:03 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:04 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
20:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:05 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 258 seconds]
20:06 -!- lazarus477 [~lazarus@78-72-27-45-no191.tbcn.telia.com] has joined #openvpn
20:07 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
20:07 < lazarus477> Does OpenVPN automatically tunnel all traffic when using the tun interface? I read that tunneling HTTP traffic was optional. I am also wondering if E-mail traffic gets tunneled.
20:08 < lazarus477> In my senario. The VPN server is in the local office but the email service is hosted by a service provider outside of the office network.
20:12 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
20:15 -!- dxtr [g6kn79@dxtr.cc] has quit [Read error: Connection reset by peer]
20:15 -!- dxtr [n4nat3@dxtr.cc] has joined #openvpn
20:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:22 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
20:22 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
20:22 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
20:25 -!- _julian_ [~quassel@hmbg-5f761cf2.pool.mediaWays.net] has quit [Read error: Operation timed out]
20:27 -!- _julian [~quassel@hmbg-5f7633a7.pool.mediaWays.net] has joined #openvpn
20:27 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 256 seconds]
20:32 -!- dxtr [n4nat3@dxtr.cc] has quit [Read error: Connection reset by peer]
20:33 -!- dxtr [ns8750@dxtr.cc] has joined #openvpn
20:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:36 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
20:36 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
20:36 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
20:37 -!- Denial [Denial@drgi.co.uk] has quit []
20:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:44 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 248 seconds]
20:45 -!- dxtr [ns8750@dxtr.cc] has quit [Read error: Connection reset by peer]
20:46 < lazarus477> A simple answer to my question would suffice. The technichal stuff I can work out on my own with the docs :-)
20:46 -!- dxtr [04hvuv@dxtr.cc] has joined #openvpn
20:47 < lazarus477> I already use OpenVPN since a few years back but never before looked into if my email traffic was getting tunneled. I have tunneled HTTP traffic though.
20:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:53 -!- dxtr [04hvuv@dxtr.cc] has quit [Read error: Connection reset by peer]
20:54 -!- dxtr [2tpof8@dxtr.cc] has joined #openvpn
20:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:57 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
20:57 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
20:57 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
20:57 -!- dxtr [2tpof8@dxtr.cc] has quit [Read error: Connection reset by peer]
20:59 -!- dxtr [ckru6i@dxtr.cc] has joined #openvpn
21:08 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Ping timeout: 240 seconds]
21:15 -!- zoidberg- [zoidberg@gateway/shell/xzibition.com/x-xcwbvkigtjkjypmw] has quit [Ping timeout: 240 seconds]
21:16 -!- vpnuser [17133524@gateway/web/freenode/ip.23.19.53.36] has joined #openvpn
21:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:17 < vpnuser> krzee no one is answering in dns channel for hours now
21:18 < vpnuser> I would like to know how I can use dns on other port in linux or centos
21:23 -!- vpnuser [17133524@gateway/web/freenode/ip.23.19.53.36] has quit [Ping timeout: 265 seconds]
21:26 -!- bragon [~Alexandre@81.93.247.165] has quit [Ping timeout: 260 seconds]
21:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
21:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:37 < krzee> im re-adding that webchat ignore
21:38 < krzee> booya [22:38]   *@*/web/* added to ignore list.
21:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
21:42 < lazarus477> Do I need to do any special config in order to have VPN client end E-mail traffic get routed over the VPN interface? The idea being to get a secure line when on a public internet connection such as at a hotel.
21:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:47 < krzee> lazarus477, 
21:47 < krzee> !redirect
21:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
21:48 < lazarus477> krzee: Thanks! I think I have already set things up then, I did setup to redirect all web/http traffic and that worked. But I shall read up on all them references the bot spat out, to make sure.
21:49 < krzee> but you dont just do that for web
21:49 < krzee> when you redirect-gateway you change your entire route to the internet
21:51 < lazarus477> krzee: Good, then I already have it setup :-)
21:51 < krzee> =]
21:51 < lazarus477> krzee: But when I set that up I was only focused on getting http traffic directed over the VPN, so I did not pay attention to what else would happen, or I forgot...
21:51 < lazarus477> krzee: Did that configuration like a year ago.
21:51 -!- gyyrog [~gyyrog@99.54.141.114] has quit [Remote host closed the connection]
21:52 < krzee> cool
21:52 < lazarus477> krzee: I thank you, your input was just the answer I was looking for, I shall read up on the docs.
21:53 < krzee> np
21:57 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
22:01 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has quit [Quit: Leaving]
22:07 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
22:12 -!- rommel092079_ [17133524@gateway/web/freenode/ip.23.19.53.36] has joined #openvpn
22:13 < rommel092079_> I would like to ask how can openvpn use udp 53 on server and client config?  that this means the by using udp 53 on its config, it uses dns?
22:14 -!- bragon [~Alexandre@81.93.247.165] has joined #openvpn
22:15 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Read error: Operation timed out]
22:18 -!- rommel092079_ [17133524@gateway/web/freenode/ip.23.19.53.36] has quit [Quit: Page closed]
22:19 -!- bragon [~Alexandre@81.93.247.165] has quit [Remote host closed the connection]
22:22 -!- LowKey [noc@unaffiliated/lowkey] has joined #openvpn
22:35 < EugeneKay> It uses the ports reserved for DNS, bypassing a common hole in firewalls.
22:35 < EugeneKay> Er
22:35 < EugeneKay> Using a common hole to bypass restrictions*
22:35 < EugeneKay> Oh. he's buggered off
22:35  * EugeneKay crawls back under rock
23:32 -!- bragon_ [~Alexandre@81.93.247.165] has joined #openvpn
23:39 -!- raidz_afk is now known as raidz
--- Day changed Sat Nov 05 2011
00:33 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
00:36 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 248 seconds]
01:08 -!- raidz is now known as raidz_afk
01:26 -!- raidz_afk is now known as raidz
01:44 -!- mode/#openvpn [+o krzee] by ChanServ
01:45 -!- mode/#openvpn [+b *!*@*/web/freenode/ip.23.19.*] by krzee
01:45 -!- mode/#openvpn [-o krzee] by krzee
02:05 < hyper_ch> hi EugeneKay
02:05 < EugeneKay> Mrh
02:06 < hyper_ch> you put a whole into dns?
02:06 < hyper_ch> :)=
02:06 < EugeneKay> What?
02:06 < hyper_ch> scroll almost 4h back :)
02:07  * EugeneKay still ost
02:07 < EugeneKay> Don't mess wit me when I've been drinkin
02:07 < hyper_ch> [04:35] <EugeneKay> Using a common hole to bypass restrictions*
02:07 < hyper_ch> EugeneKay: don't worry too much about it
02:07 < hyper_ch> it's early morning and my brains give all kinds of weird signals
02:07 < EugeneKay> 2AM hurr
02:08 < hyper_ch> do you happen to have a led backlit screen?
02:08 < EugeneKay> I've a Dell XPS 13 which I *think* is led lit
02:08 < EugeneKay> But I dunno - Dell sent it to me as a warranty replacement for a xps 1330, which I got for free :-p
02:12 < hyper_ch> Nevertheless, at under 0.9 inches thick at its thinnest point, with the LED backlit display
02:12 < hyper_ch> is led backlit really better than plain old lcd?
02:14 < hyper_ch> pondering about getting a 24" led backlit screen
02:14 < EugeneKay> I really can't tell the difference beetween my cheapy Acer monitors and my "led backlit" xps
02:14 < EugeneKay> It's just the kind of lightbub behind the led
02:14 < EugeneKay> lcd*
02:14 < EugeneKay> More important is TFT vs IPS
02:15 < hyper_ch> I just thought led would be brither and better readable even in bright surroundings
02:15 < EugeneKay> Meh
02:15 < EugeneKay> If you're at the beach, put away the damn laptop and whip out your junk for the hawt ladies :-p
02:15 < hyper_ch> s/beach/balcony/
02:16 < hyper_ch> how to find out if it's tft or ips?
02:17 < EugeneKay> Laptop or standalone screen?
02:17 < hyper_ch> standalone
02:17 < EugeneKay> Is it $150 or $400?
02:18 < hyper_ch> more like $150
02:18 < EugeneKay> then its TFT
02:18 < hyper_ch> what's the difference?
02:19 < EugeneKay> IPS has better color reproduction and vertical viewing angle
02:19 < EugeneKay> Like, LOTS better
02:19 < hyper_ch> ok
02:20 < hyper_ch> and what's the difference between a tv screen and a computer monitor?
02:21 < EugeneKay> TVs usually have "anti-motion compensation" features and such crap that make the signal worse
02:21 < EugeneKay> Monitors just display the input
02:22 < hyper_ch> and tvs come in bigger sizes because it's viewed further apart?
02:23 < EugeneKay> Yup. 1080p is 1080p :-p
02:26 < hyper_ch> :)
02:26 < hyper_ch> so, why are you not sleeping?
02:27 < hyper_ch> the asus is described with a vertial view angle of 160°
02:28 < hyper_ch> and as I don't do graphical stuff, I don't need perfect color reproduction
02:29 < EugeneKay> Because I'm busy being drunk
02:29 < EugeneKay> "viewing angles" are almost always made out of bullshitium
02:31 < hyper_ch> that's quite a common element, right?
02:32 < EugeneKay> Second only to hydrogen
02:34 < hyper_ch> I'm still not sure if I should get an ips or not
02:34 < EugeneKay> Are you planning to do photoshop or such ?
02:35 < hyper_ch> no
02:35 < EugeneKay> Then no
02:35 < hyper_ch> :)
02:35 < EugeneKay> I have a trio of $120 Acer TFT cheapies. They work grand
02:36 < hyper_ch> :)
02:36 < hyper_ch> vga port is already used on my netbook
02:36 < hyper_ch> hdmi is still free
02:37 < EugeneKay> ugh vga
02:37 < hyper_ch> what's wrong with vga port?
02:37 < EugeneKay> Analog is crap
02:38 < hyper_ch> the world is crap?
02:38 < EugeneKay> Yes.
02:38 < hyper_ch> :)
02:38 -!- mode/#openvpn [+v EugeneKay] by ChanServ
02:38  * EugeneKay abuses his powar
02:39 < hyper_ch> you just have voice
02:39 < hyper_ch> so no real power
02:39 <+EugeneKay> I have an op, too, but wearing it makes me look responsible
02:39 <+EugeneKay> I cant have that
02:40 < hyper_ch> you're one of those people that never want any responsability (and accountability)?
02:40 <+EugeneKay> Damn straight
02:41 < hyper_ch> :)
02:41 < hyper_ch> I think it's time to abuse my virgin washing machine
02:41 -!- mode/#openvpn [+v hyper_ch] by ChanServ
02:41 <+hyper_ch> I don't wanna talk
02:41 <+hyper_ch> I don't have time to talk :)
02:42 <+EugeneKay> Make time!
02:42 <+hyper_ch> and it makes me look like I have some clue about openvpn
02:42 <+EugeneKay> YOu're a regular, dangit
02:42 <+hyper_ch> regular noob
02:42 <+EugeneKay> Still a regular
02:42 <+hyper_ch> more noob than regular
02:44 <+EugeneKay> Regularly a n00b!
02:56 -!- jaminja [~jaminja@76.76.24.43] has joined #openvpn
02:56 -!- jaminja [~jaminja@76.76.24.43] has quit [Changing host]
02:56 -!- jaminja [~jaminja@unaffiliated/jaminja] has joined #openvpn
03:01 -!- lazarus477 [~lazarus@78-72-27-45-no191.tbcn.telia.com] has quit [Ping timeout: 258 seconds]
03:10 -!- EugeneKay is now known as EugeneDrunK
03:28 <@vpnHelper> RSS Update - forum: VPN Connection problem <http://forums.openvpn.net/topic9167.html#p17279> || [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p17278>
03:34 <@vpnHelper> RSS Update - forum: [Help] Secure or Not? <http://forums.openvpn.net/topic9168.html#p17280> || [Resoloved] Dynamic DNS <http://forums.openvpn.net/topic9169.html#p17273>
03:40 <@vpnHelper> RSS Update - forum: How to gen client-cert for multi-server on the same machine <http://forums.openvpn.net/topic9174.html#p17281>
03:40 -!- raidz is now known as raidz_afk
03:44 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
03:44 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
04:02 -!- novaflash_away is now known as novaflash
04:16 -!- dannnnn [~robott@208.111.39.186] has joined #openvpn
04:16 < dannnnn> access server is just openvpn with a gui ?
04:21 <+EugeneDrunK> dannnnn - It has a coupla interesting features. Ask #openvpn-as for the details.
04:45 < dannnnn> seems less secure since it needs alot more ports open on the server
04:58 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
05:00 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 240 seconds]
05:06 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
05:20 <@vpnHelper> RSS Update - forum: VPN Connection problem <http://forums.openvpn.net/topic9167.html#p17282>
05:32 <@vpnHelper> RSS Update - forum: client cannot browse internet - routing? <http://forums.openvpn.net/topic9171.html#p17283>
05:35 -!- dannnnn [~robott@208.111.39.186] has quit [Ping timeout: 255 seconds]
05:46 <+hyper_ch> why would open ports make anything less secure?
05:56 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
06:01 <+hyper_ch> EugeneDrunK: krzee: mattock: https://www.taz.de/t171/Social-networking/!81248/
06:01 <@vpnHelper> Title: Social networking: What facebook knows about you - taz.de (at www.taz.de)
06:06 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Ping timeout: 240 seconds]
06:16 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
06:30 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
06:33 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
06:45 <@vpnHelper> RSS Update - forum: Newbie has problems with OpenVPN client <http://forums.openvpn.net/topic9033.html#p17284>
07:12 -!- venom00 [~venom00@net-188-218-177-38.cust.dsl.vodafone.it] has joined #openvpn
07:12 -!- venom00 [~venom00@net-188-218-177-38.cust.dsl.vodafone.it] has quit [Changing host]
07:12 -!- venom00 [~venom00@unaffiliated/venom00] has joined #openvpn
07:14 -!- acdef [~robott@208.111.39.186] has joined #openvpn
07:25 -!- acdef [~robott@208.111.39.186] has quit [Ping timeout: 258 seconds]
07:25 -!- acdef [~robott@124.78.181.100] has joined #openvpn
07:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
07:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:43 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
08:06 < acdef> a
08:36 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 255 seconds]
08:36 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
08:48 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:56 -!- felixfoertsch [~chatzilla@safecamp-plus-0041.unibw-hamburg.de] has joined #openvpn
08:59 < felixfoertsch> Good afternoon. Anybody here who is in the mood to help a newbie with openvpn through some difficulties? I read a lot of wikis and documentation, but still can't figure out how to reach my goal. Therefore I need someone to guide me.
09:06 -!- master_of_master [~master_of@p57B53B91.dip.t-dialin.net] has quit [Read error: Operation timed out]
09:09 -!- pierreghz [~pierreghz@cust-82-25-111-94.dyn.as47377.net] has joined #openvpn
09:09 -!- master_of_master [~master_of@p57B541C4.dip.t-dialin.net] has joined #openvpn
09:11 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Ping timeout: 252 seconds]
09:12 < krzee> !goal
09:12 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:12 -!- gyyrog [~gyyrog@99.54.141.114] has joined #openvpn
09:17 < acdef> krzee do u like access server?
09:17 <+hyper_ch> hi krzee
09:17 <+hyper_ch> did you see the link I posted for you?
09:21 < acdef> every1 wants to know what krzee likes
09:22 <+hyper_ch> krzee likes me... sometimes
09:22 <+hyper_ch> :)
09:27 -!- patelx [nebula@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has quit [Read error: Connection reset by peer]
09:27 -!- patelx [nebula@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
09:31 < acdef> sometimes krzee goes crazy
09:31 < acdef> texas chainsaw massacre style
09:42 -!- cheesemaker [4addd142@gateway/web/freenode/ip.74.221.209.66] has joined #openvpn
09:46 < cheesemaker> my server and client config uses protocol udp at port 53. does that mean that it uses dns?
09:50 < cheesemaker> I guess all the people here are so busy
09:55 -!- cheesemaker [4addd142@gateway/web/freenode/ip.74.221.209.66] has quit [Quit: Page closed]
09:56 -!- acdef [~robott@124.78.181.100] has quit [Remote host closed the connection]
09:56 -!- acdef [~robott@124.78.181.100] has joined #openvpn
09:58 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 256 seconds]
09:58 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
10:31 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
10:37 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
10:46 -!- bassliner [armin@irc.arje.de] has quit [Quit: brb]
10:53 -!- dscott [~dscott@99-89-112-117.lightspeed.frokca.sbcglobal.net] has joined #openvpn
11:24 -!- dscott [~dscott@99-89-112-117.lightspeed.frokca.sbcglobal.net] has quit [Quit: leaving]
11:26 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
11:29 < smw> I have a server setup so the vpn network is 192.168.22.0 (10.0.0.0/8 is reserved for other uses). I am able to ping 192.168.22.1. On the server I have push "redirect-gateway def1 bypass-dhcp" uncommented. When I restart the vpn on both sides, I am still not getting the server's ip when I go to http://www.whatismyip.com/. Any ideas?
11:29 <@vpnHelper> Title: What Is My IP Address - Shows Your IP Address (at www.whatismyip.com)
11:29 < smw> I setup iptables, ipv4 forwarding, etc
11:29 < smw> but if that had failed, I would expect to fail to get to any website.
11:32 < smw> anyone here? :-)
11:37 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
11:37 < krzee> you may have setup iptables / ipforwarding, but odds are one of those 2 things is done wrong
11:38 < smw> krzee, I will make a pastebin
11:38 < krzee> acdef, i have never used access-server, i like the idea tho (for those who need one of the advantages it offers)
11:40 < smw> krzee, this doesn't look right :-\
11:40 < smw> http://paste.pocoo.org/show/503354/
11:42 < krzee> is this is the server?
11:43 <+hyper_ch> hi krzee
11:43 < smw> krzee, yes
11:44 < smw> krzee, it is an ubuntu lucid server on ec2 and I am sitting at my ubuntu linux client
11:44 < krzee> replace those 3 forward rules with
11:44 < krzee> iptables -A INPUT -i tun+ -j ACCEPT
11:45 < krzee> iptables -A FORWARD -i tun+ -j ACCEPT
11:45 < krzee> and do this, tell me the output
11:45 < krzee> cat /proc/sys/net/ipv4/ip_forward
11:46 < smw> krzee, I am going to restart the server, one sec
11:46  * krzee wonders if EugeneDrunK is really EugeneHangover yet
11:47 <+hyper_ch> krzee: could be... he's been drunk for hours now :)
11:48 < smw> krzee, what tables should I print?
11:48 < smw> nat and default?
11:48 < krzee> nat and -L
11:49 -!- gyyrog [~gyyrog@99.54.141.114] has quit [Remote host closed the connection]
11:49 < smw> krzee, http://paste.pocoo.org/show/503359/
11:53 < smw> krzee, I am sort of concerned that ip-192-168-22-0.ec2.internal/24 is there instead of 192.168.22.0/24
11:54 < smw> krzee?
11:55 < krzee> thats from your hosts file or something
11:55 < krzee> its fine
11:56 < krzee> you did not show iptables -L
11:57 < smw> http://paste.pocoo.org/show/503365/
11:57 < smw> krzee, ^
11:58 < krzee> what happened to:
11:58 < krzee> iptables -A INPUT -i tun+ -j ACCEPT
11:58 < krzee> iptables -A FORWARD -i tun+ -j ACCEPT
11:58 < smw> I put that in rc.local...
11:58 < smw> then I restarted
11:58 < smw> btw, http://paste.pocoo.org/show/503368/
11:58 < smw> that is my client
11:58 -!- patelx [nebula@75-54-230-125.lightspeed.sntcca.sbcglobal.net] has quit [Changing host]
11:58 -!- patelx [nebula@openvpn/corp/admin/patel] has joined #openvpn
11:59 < krzee> run them now then iptables -L
11:59 < smw> ok
12:00 < smw> http://paste.pocoo.org/show/503372/
12:00 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
12:01 < smw> krzee, this doesn't make sense :-\
12:01 < krzee> well you have no tun device yet...
12:01 < krzee> start openvpn, then run those commands again
12:02 < krzee> (im not really a linux guy, im discovering along with you ;] )
12:02 < smw> krzee, http://paste.pocoo.org/show/503375/
12:02 < smw> krzee, I have tun up
12:02 < krzee> oh you do
12:03 < smw> and I am able to ping
12:03 < krzee> can you ping 8.8.8.8?
12:03 < smw> from where?
12:03 < krzee> client
12:03 < smw> krzee, yes
12:03 < krzee> its connected to vpn?
12:03 < smw> but I appear to not be using the vpn
12:04 < krzee> from client show me netstat -rn
12:04 < smw> I already posted route ;-)
12:04 < smw> http://paste.pocoo.org/show/503379/
12:04 < smw> here it is again
12:05 -!- felixfoertsch [~chatzilla@safecamp-plus-0041.unibw-hamburg.de] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
12:05 < krzee> yes, but you posted it with resolution
12:05 < krzee> which i didnt care to look at
12:05 < krzee> this is not redirecting gateway
12:05 < krzee> show me client log
12:05 < krzee> verb 5
12:06 < smw> krzee, will do
12:06 < smw> krzee, how can I separate the log file?
12:06 < krzee> !logfile
12:06 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
12:06 < smw> thanks
12:07 < krzee> yw
12:07 < smw> "log /var/log/openvpn.log"
12:08 < smw> krzee, http://paste.pocoo.org/show/503382/
12:08 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
12:09 < smw> krzee, oh, and if during this I disappear. It means I lost internet because of changes we are making :-P.
12:10 < smw> it is probably a good sign actually...
12:10 < krzee> well you said:
12:10 < krzee> "On the server I have push "redirect-gateway def1 bypass-dhcp" uncommented."
12:10 < krzee> but you dont
12:11 < smw> oops...
12:11 < smw> it looks like I edited the wrong file  when I uncommented it
12:14 -!- smw [~smw@unaffiliated/smw] has quit [Read error: Connection reset by peer]
12:14 -!- smw_ [~smw@unaffiliated/smw] has joined #openvpn
12:14 < smw_> looks like it worked
12:14 -!- EugeneDrunK is now known as EugeneKay
12:14 < smw_> krzee, it was slow as hell... but I think I blame the micro ec2 instance. I will upgrade it.
12:15 < smw_> thanks :-)
12:15 -!- smw_ is now known as smw
12:17 < smw> krzee, if I were to remove the push and instead added redirect-gateway def1 bypass-dhcp to all my clients, would that work?
12:18 < smw> krzee, I have the people in china who want all data routed through there and I have the people in the US who will just want to get to services behind the VPN.
12:19 < smw> krzee, and the services behind the VPN should only be using the VPN for internal communication, not all traffic.
12:19 < smw> well not behind the VPN... more like on the VPN
12:26 -!- raidz_afk is now known as raidz
12:38 < krzee> [13:17]  <smw> krzee, if I were to remove the push and instead added redirect-gateway def1 bypass-dhcp to all my clients, would that work?
12:38 < krzee> yes
12:39 < smw> krzee, sweet :-)
12:59 -!- foidle [~john@adsl-74-178-137-247.sdf.bellsouth.net] has joined #openvpn
13:13 < Dougy> womp womp womp
13:21 -!- smw [~smw@unaffiliated/smw] has quit [Ping timeout: 258 seconds]
13:26 <@vpnHelper> RSS Update - forum: VPN Setup <http://forums.openvpn.net/topic9178.html>
13:28 -!- foidle [~john@adsl-74-178-137-247.sdf.bellsouth.net] has left #openvpn ["Leaving"]
13:28 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
13:28 < smw> anyone here use tunnelblick?
13:29 < smw> It is a mac frontend
13:31 -!- jaminja [~jaminja@unaffiliated/jaminja] has quit [Ping timeout: 245 seconds]
13:32 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
13:37 -!- acdef [~robott@124.78.181.100] has quit [Ping timeout: 260 seconds]
13:42 < smw> yay, got openvpn working completely
13:43 < smw> two clients, one of them a mac using a gui are able to talk to each other
13:46 -!- pierreghz [~pierreghz@cust-82-25-111-94.dyn.as47377.net] has quit [Ping timeout: 252 seconds]
13:54 -!- smw [~smw@unaffiliated/smw] has quit [Ping timeout: 255 seconds]
13:57 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
13:59 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
14:00 -!- pierreghz [~pierreghz@cust-190-95-111-94.dyn.as47377.net] has joined #openvpn
14:10 -!- smw [~smw@75.92.71.161] has joined #openvpn
14:10 -!- smw [~smw@75.92.71.161] has quit [Changing host]
14:10 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
14:12 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 252 seconds]
14:17 -!- Numeros [~Numeros@186.91.57.210] has joined #openvpn
14:18 < Numeros> hola
14:18 < Numeros> hello
14:20 -!- Pilif12p is now known as Pilif|meeting
14:26 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
14:27 -!- JoeGazz84 is now known as Joe|Meeting
14:42 -!- Pilif|meeting is now known as Pilif12p
14:47 -!- Joe|Meeting is now known as joeGazz84
14:47 -!- joeGazz84 is now known as JoeGazz84
14:57 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p17286>
15:03 -!- krzie [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
15:35 -!- patelx [nebula@openvpn/corp/admin/patel] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
15:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
15:45 <@vpnHelper> RSS Update - forum: Openvpn server ip changes between main and 2nd ip <http://forums.openvpn.net/topic9179.html>
15:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
16:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:19 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
16:20 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:43 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
16:51 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 256 seconds]
16:59 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
17:08 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
17:08 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
17:43 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
17:45 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
18:05 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
18:17 < Dougy> bitches
18:26 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
18:31 -!- novaflash is now known as novaflash_away
18:31 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
18:41 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
18:41 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
18:52 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
19:00 -!- aaaaaaaa [~robott@124.78.181.100] has joined #openvpn
19:00 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 248 seconds]
19:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:08 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:12 < aaaaaaaa> can i use dnsmasq with openvpn?
19:12 < aaaaaaaa> so i setup openvpn to push 10.8.0.1
19:12 < aaaaaaaa> then dnsmasq looks in etc/resolv.conf for the dns provider?
19:13 < krzee> dnsmasq is unrelated to openvpn, openvpn can do whatever you tell it to in a script
19:13 < krzee> !script
19:13 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
19:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:30 <+EugeneKay> Anybody ever fiddled with serial-port console access to linux boxen?
19:31 <+EugeneKay> Grub on up
19:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:52 -!- aaaaaaaa [~robott@124.78.181.100] has quit [Ping timeout: 244 seconds]
19:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:56 -!- An_Ony_Moose [~linus@skysimulation.de] has joined #openvpn
19:58 -!- acdef [~robott@208.111.39.186] has joined #openvpn
19:59 < An_Ony_Moose> I want to access the internet from other places (usually on windows xp computers, without administrative rights) via my home computer (running linux). Is OpenVPN what I need?
20:02 < krzee> it can do that
20:02 < krzee> oh wait
20:02 < krzee> without admin rights
20:02 < krzee> nope, openvpn isnt your solution
20:03 < krzee> if you just mean web access, you could use a socks server, or easier, ssh tunnels
20:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:03 < krzee> ssh -D<port> user@server
20:04 < krzee> then 127.0.0.1:port will be a socks server you can use to proxy through your sshd server's inet connection
20:06 < An_Ony_Moose> krzee: so on the restricted xp computer, ssh -D80 linus@home-ip?
20:07 < An_Ony_Moose> then set up x browser to use 127.0.0.1:80 as proxy?
20:07 < krzee> yep
20:07 < krzee> doesnt need to be 80, but ya
20:08 < An_Ony_Moose> thanks muchly :^)
20:08 < krzee> and theres a portable build of putty you'll likely wanna put on a usb
20:08 < krzee> so you can use ssh keys and whatnot
20:08 < An_Ony_Moose> yeah, that's why I'm asking
20:08 < An_Ony_Moose> I need to know what to dump on my USB stick
20:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:11 -!- acdef [~robott@208.111.39.186] has quit [Ping timeout: 244 seconds]
20:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:24 -!- _julian_ [~quassel@hmbg-5f77d0d5.pool.mediaWays.net] has joined #openvpn
20:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:27 -!- _julian [~quassel@hmbg-5f7633a7.pool.mediaWays.net] has quit [Ping timeout: 256 seconds]
20:32 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html>
20:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:45 <+EugeneKay> krzee, you ever played with one of Ye Olde serial port console servers?
20:48 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
20:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:59 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
21:04 -!- tjz [~pc@bb121-6-182-39.singnet.com.sg] has joined #openvpn
21:04 -!- tjz [~pc@bb121-6-182-39.singnet.com.sg] has quit [Changing host]
21:04 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
21:20 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:44 -!- Denial [Denial@drgi.co.uk] has quit []
21:49 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
22:12 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
22:17 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
22:17 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:19 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
22:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:26 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
22:33 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
22:34 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
22:41 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
22:44 <@vpnHelper> RSS Update - forum: OpenVPN on DD-WRT router <http://forums.openvpn.net/topic9160.html#p17289>
22:52 < ecrist> sup bitches
22:54 <+EugeneKay> Just spent $72.04 on obsolete serial port hardware
22:54 < ecrist> why?
22:55 <+EugeneKay> Console access to the stuff in my rack
22:57 < derekv> It may sound like a lot of money now, but it'll help you in the long term (LOL)
22:57 <+EugeneKay> Lot of help in the short term, too. I lost access to one of my NetApps for 12 hours after typoing an IP address
22:58 < derekv> did you get my pun??
22:58 <+EugeneKay> Yes. It was stupid.
22:58 < derekv> booo
22:59 <+EugeneKay> This is why I marginalized it by continuing the conversation without resortong to "lulz"
22:59 < derekv> its saturday live it up
22:59 <+EugeneKay> Drank all my beer lst night
23:00 < derekv> 72$ isn't even pocket change if your dealing with NetApps
23:00 <+EugeneKay> Beleve, me I know :-p
23:01 < ecrist> derekv: is english your second language?
23:01 <+EugeneKay> I'm trying to get a FAS2020 and four shelves of 144GB for free from a contact
23:01 < derekv> No?
23:02 <+EugeneKay> eBay price of about $7k :-p
23:02 < ecrist> derekv: http://www.google.com/url?sa=t&rct=j&q=oatmeal%20there&source=web&cd=1&ved=0CBoQFjAA&url=http%3A%2F%2Ftheoatmeal.com%2Fcomics%2Fmisspelling&ei=4ga2ToSbHcfm0QH_geXRBw&usg=AFQjCNFrDzP4MRrR8YfL_fohN5gtw5Blrw
23:02 < ecrist> gah
23:02 < ecrist> http://theoatmeal.com/comics/misspelling
23:03 < ecrist> fucking google
23:03 -!- Numeros [~Numeros@186.91.57.210] has quit [Read error: Connection reset by peer]
23:07 < derekv> You guys are not having a very good weekend, I'm sorry.
23:08 < derekv> SANs going down, people using the incorrect word on IRC
23:10 < ecrist> nah, I'm having a great weekend.
23:10 < ecrist> your lack of literacy doesn't affect the mood of my weekend.
23:10 < ecrist> :P
23:13 < derekv> It comes off as really pissy.
23:13 < ecrist> *shrug*
23:13 < derekv> Aside from that, 
23:14 < derekv> I was thinking of taking my script (based off your script), rolling it back into ssl-admin, putting it on github or something
23:15 < ecrist> derekv: if you submit the changes to me, I'm put it into ssl-admin
23:15 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
23:16 < ecrist> hell, if you want to run with it, I'll give you write access to the svn repo
23:20 < derekv> I could put my stuff in a branch.
23:22 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Go on, try it!]
23:22 < derekv> Lets see, I got it to email the package to the email listed in the certificate (adds a perl dependancy), add a line to the client.ovpn with the thumprint for the cryptoapicert option, and scan a directory for crt files and ask about each one. 
23:22 < derekv> not crt, csr rather.
23:23 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
23:24 < ecrist> can you email me a patch? (universal diff)
23:27 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
23:27 < derekv> I'll see what I can get tommorow... if I sent you what I have now, it wouldn't be useful as a patch, and it probably has my email hard coded in there etc
23:27 < ecrist> sweet
23:27 < ecrist> I'm always open to suggestions with ssl-admin
23:28 < derekv> Cool.
23:30 < derekv> And sorry about typos and slurred speech, I've had a "long day".  I think I need about a gallon of water right now.
23:30 < ecrist> no worries.  I'm just the resident troll
23:30 < ecrist> ;)
23:30 < derekv> =]
23:30 <+EugeneKay> svn repo -_-
23:35 < derekv> First perl effort, more or less.  Went rather well.  Appears to be as useful as it ... appears... ehm
23:58 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
--- Day changed Sun Nov 06 2011
00:09 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 248 seconds]
00:09 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
00:14 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 276 seconds]
00:14 -!- civillian [~nickn@180.148.126.100] has joined #openvpn
00:36 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
00:39 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:41 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
00:51 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
00:55 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
01:18 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
01:21 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:35 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
01:49 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
01:49 < orange-hand> Hi.
01:49 < orange-hand> so I want to sign up for a VPN service
01:49 < orange-hand> and I want to accept incoming connections
01:50 < orange-hand> is this possible? can someone point me to docs on that?
01:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
01:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:53 -!- LuckyY [~LuckY@188.142.61.123] has quit [Ping timeout: 258 seconds]
01:57 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
02:03 -!- LuckyY [~LuckY@188.142.61.123] has joined #openvpn
02:20 <@vpnHelper> RSS Update - forum: OpenVPN on DD-WRT router <http://forums.openvpn.net/topic9160.html#p17290>
02:26 <@vpnHelper> RSS Update - forum: client cannot browse internet - routing? <http://forums.openvpn.net/topic9171.html#p17291>
02:32 <@vpnHelper> RSS Update - forum: i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17292>
02:38 <@vpnHelper> RSS Update - forum: Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17293>
02:44 <@vpnHelper> RSS Update - forum: VPN Setup <http://forums.openvpn.net/topic9178.html#p17295> || i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17294>
02:50 <@vpnHelper> RSS Update - forum: OVPN Windows Client keeps disconnecting and reconnecting <http://forums.openvpn.net/topic9163.html#p17296>
02:55 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
02:58 < smw> Can anyone help me with DNS? My computer connects to the VPN on boot. When that happens I am unable to resolve domain names.
02:58 < smw> after adding google to /etc/resolv.conf it works
02:58 < smw> adding the following to the client config did not help dhcp-option DNS 8.8.8.8
02:58 < smw> dhcp-option DNS 8.8.4.4
03:03 <@vpnHelper> RSS Update - forum: client cannot browse internet - routing? <http://forums.openvpn.net/topic9171.html#p17300> || i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17299> || Openvpn server ip changes between main and 2nd ip <http://forums.openvpn.net/topic9179.html#p17298> || Confused by my results <http://forums.openvpn.net/topic9180.html#p17297>
03:05 -!- ravel [ravel@175.136.82.14] has joined #openvpn
03:10 <@vpnHelper> RSS Update - forum: Unable to access OpenVPN subnet in Server 2008 <http://forums.openvpn.net/topic9181.html>
03:16 <@vpnHelper> RSS Update - forum: client cannot browse internet - routing? <http://forums.openvpn.net/topic9171.html#p17302> || [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17299>
03:22 <@vpnHelper> RSS Update - forum: Unable to access OpenVPN subnet in Server 2008 <http://forums.openvpn.net/topic9181.html#p17303>
03:26 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Remote host closed the connection]
03:34 <@vpnHelper> RSS Update - forum: Unable to access OpenVPN subnet in Server 2008 <http://forums.openvpn.net/topic9181.html#p17304>
03:34 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
03:56 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
04:10 <@vpnHelper> RSS Update - forum: Unable to access OpenVPN subnet in Server 2008 <http://forums.openvpn.net/topic9181.html#p17305>
04:22 -!- corretico [~luis@201.201.44.82] has joined #openvpn
04:37 -!- novaflash_away is now known as novaflash
04:37 -!- venom00 [~venom00@unaffiliated/venom00] has quit [Ping timeout: 245 seconds]
04:39 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:46 <@vpnHelper> RSS Update - forum: client cannot browse internet - routing? <http://forums.openvpn.net/topic9171.html#p17306>
04:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
04:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:10 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
05:15 -!- Ionic [ionic@ionic.de] has joined #openvpn
05:25 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
05:49 -!- raidz is now known as raidz_afk
05:49 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:09 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
06:09 -!- JoeGazz84 [~JoeGazz84@techessentials.org] has joined #openvpn
06:09 -!- JoeGazz84 [~JoeGazz84@techessentials.org] has quit [Changing host]
06:09 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
06:14 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
06:19 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
07:00 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
07:04 -!- Ionic [ionic@ionic.de] has joined #openvpn
07:27 -!- smw [~smw@unaffiliated/smw] has quit [Quit: Leaving]
07:41 <@vpnHelper> RSS Update - forum: Grouped clients <http://forums.openvpn.net/topic9177.html#p17307>
08:00 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
08:08 -!- master_of_master [~master_of@p57B541C4.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
08:09 -!- master_of_master [~master_of@p57B52B22.dip.t-dialin.net] has joined #openvpn
08:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
08:35 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html#p17308>
08:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:42 -!- Valeryia [~Valery@sign.io] has joined #openvpn
08:44 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has joined #openvpn
08:50 -!- Valeryia [~Valery@sign.io] has quit [Quit: leaving]
10:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
10:06 -!- ravel [ravel@175.136.82.14] has quit []
10:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:10 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Excess Flood]
10:11 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
10:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
10:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:31 -!- gyyrog [~gyyrog@99.54.141.114] has joined #openvpn
10:47 <@vpnHelper> RSS Update - forum: Just two conceptual questions about OpenVPN <http://forums.openvpn.net/topic9182.html>
10:57 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
10:57 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:02 -!- gyyrog [~gyyrog@99.54.141.114] has quit [Ping timeout: 248 seconds]
11:06 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
11:06 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
11:06 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
11:07 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Read error: Connection reset by peer]
11:07 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
11:07 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
11:07 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
11:10 -!- jean [~quassel@host131-172-dynamic.51-79-r.retail.telecomitalia.it] has joined #openvpn
11:17 -!- gyyrog [~gyyrog@adsl-99-37-84-234.dsl.klmzmi.sbcglobal.net] has joined #openvpn
11:17 <@vpnHelper> RSS Update - forum: Unable to access OpenVPN subnet in Server 2008 <http://forums.openvpn.net/topic9181.html#p17310>
11:21 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
11:24 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
11:25 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
11:34 -!- jean [~quassel@host131-172-dynamic.51-79-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
11:44 -!- raidz_afk is now known as raidz
12:04 -!- gyyrog [~gyyrog@adsl-99-37-84-234.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
12:08 -!- MRH21 [~walter@188-220-37-249.zone11.bethere.co.uk] has joined #openvpn
12:11 < MRH21> hi I have been having trouble with 'cert expired' when the expiration date for CA and client and server certs have an expiration of 100yrs - anyone know if there is a hard limit?
12:13 < MRH21> (I have the same config with everything at 10 yrs and is working ok)
12:22 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
12:23 < Blue_Ice> MRH21: err, the next millenium bug? ^_^
12:25 < Blue_Ice> if you google openssl 100 year validity you get some interesting hits
12:25 < Blue_Ice> although I wonder why one would _want_ to create a 100y cert. That seems to defeat the purpose
12:28 < Blue_Ice> "a CA cert, created today, with 36500 days of validity, have the following valid period:from 2010-12-04 to 1974-10-04"
12:28 < Blue_Ice> already tried to read out the created cert files with openssl?
12:29 < MRH21> ah 74 was a good yr
12:29 <@vpnHelper> RSS Update - forum: OpenVPN on DD-WRT router <http://forums.openvpn.net/topic9160.html#p17311>
12:30 < MRH21> thanks that explains things
12:32 -!- mirco [~mirco@p5B2823E6.dip.t-dialin.net] has joined #openvpn
12:32 < MRH21> the script i used prob should have shown an error rather than allowing a CA cert to be created with those parameters
12:33 < Blue_Ice> MRH21: I'm not saying that that is your issue, just that it might be. Reading the cert out with openssl should reveal the truth
12:33 -!- mirco [~mirco@p5B2823E6.dip.t-dialin.net] has quit [Client Quit]
12:33 < Blue_Ice> "openssl x509 -in certificate.crt -text -noout"
12:33 < Blue_Ice> and then check start/end date
12:34 -!- mirco [~mirco@p5B2823E6.dip.t-dialin.net] has joined #openvpn
12:35 -!- mirco [~mirco@p5B2823E6.dip.t-dialin.net] has quit [Client Quit]
12:35 <@vpnHelper> RSS Update - forum: OpenVPN on DD-WRT router <http://forums.openvpn.net/topic9160.html#p17312>
12:36 -!- raidz is now known as raidz_afk
12:40 < MRH21> thanks for your help Blue
12:40 < MRH21> need to go find the usb drive with the cert on it
12:40 < MRH21> :)
12:42 <@vpnHelper> RSS Update - forum: Unable to access OpenVPN subnet in Server 2008 <http://forums.openvpn.net/topic9181.html#p17313>
12:48 -!- pierreghz_ [~pierreghz@cust-52-48-111-94.dyn.as47377.net] has joined #openvpn
12:49 -!- pierreghz [~pierreghz@cust-190-95-111-94.dyn.as47377.net] has quit [Read error: Operation timed out]
13:04 -!- MRH21 [~walter@188-220-37-249.zone11.bethere.co.uk] has quit [Read error: Connection reset by peer]
13:16 -!- mirco [~mirco@p5B2823E6.dip.t-dialin.net] has joined #openvpn
13:17 -!- kyrix [~ashley@194.24.138.7] has joined #openvpn
13:20 -!- novaflash is now known as novaflash_away
13:22 -!- Darkasakerionz [~Darkasake@84.120.216.243.dyn.user.ono.com] has joined #openvpn
13:23 < Darkasakerionz> Hi! I recently install a openvpn server and client, and works very well, but only point to point, I can't access to de internet, how can I fix that?. Thank you so so much.
13:23 < Darkasakerionz> I'm in Debian
13:32 <+hyper_ch> !dns
13:32 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
13:32 < Darkasakerionz> ?
13:34 <@vpnHelper> RSS Update - forum: sharing client user name and password <http://forums.openvpn.net/topic8162.html#p17314>
13:37 -!- BrandonS9248 [52e28040@gateway/web/freenode/ip.82.226.128.64] has joined #openvpn
13:37 < BrandonS9248> Hi there ! :)
13:39 < BrandonS9248> I easily created a openvpn server and connected myself to it
13:39 < BrandonS9248> But I can't figure out how to go on the internet
13:40 < Darkasakerionz> BrandonS9248, I have the same problem
13:43 < BrandonS9248> Darkasakerionz, have you tried something?
13:43 -!- hid3 [~arnoldas@78.157.71.116] has joined #openvpn
13:43 < Darkasakerionz> yes, a lot
13:43 < Darkasakerionz> route add default gw 10.8.0.1 tun
13:43 < Darkasakerionz> routes and so on
13:43 < Darkasakerionz> but don't work
13:44 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:44 < BrandonS9248> hum did not try that
13:44 < hid3> Hello everyone. I'm using OpenVPN client on Windows 7. However, when I connect to VPN server, the VPN's default gateway metric is much lower priority than my wireless or ethernet adapter's gateway metrics. As a result, the traffic does not get routed through OpenVPN. Any ideas how to change the metric or any other workaround for this?
13:44 < BrandonS9248> can you tell me more about it please?
13:45 < BrandonS9248> Darkasakerionz: are you on linux?
13:45 < Darkasakerionz> yep
13:45 < Darkasakerionz> I forward that tutorial
13:45 < Darkasakerionz> http://www.youtube.com/watch?v=FrZlsRo5t0I
13:45 <@vpnHelper> Title: Como crear una VPN - Linux a Linux - YouTube (at www.youtube.com)
13:45 < BrandonS9248> did you edit /etc/sysctl.conf
13:45 < Darkasakerionz> no
13:45 < Darkasakerionz> :S
13:45 < BrandonS9248> do that
13:46 < BrandonS9248> and change "net.ipv4.ip_forward=1"
13:46 < BrandonS9248> comment it out if it's commented
13:46 < BrandonS9248> on the server
13:46 < BrandonS9248> it will permit the server to forward IPv4 traffic
13:49 < Darkasakerionz> BrandonS9248, so, In your case, work?
13:49 < BrandonS9248> nope
13:49 < BrandonS9248> but I read it's useful
13:50 < hid3> Any ideas about the gefault GW/metric stuff?
13:51 < hid3> Lots of versions of OpenVPN has passed but this bug is still NOT fixed :(
13:56 < BrandonS9248> hid3: I'm sorry, but the only thing I can do to help you is trolling.... Like this: Y U NO USE UNIX?
13:57 <+EugeneKay> !def1
13:57 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:57 < hid3> ....
13:58 < hid3> Yes, I use Unix
13:58 < Darkasakerionz> EugeneKay, I write that: push "redirect-gateway def1"
13:58 < Darkasakerionz> And still don't work
13:58 < hid3> but I need to configure a client for my customer on Windows
13:58 <+EugeneKay> Not you, I haven't read up to your question yet
13:58 < hid3> And besides, not using unix shouldn't be an excuse
13:59 < Darkasakerionz> EugeneKay, it's the same
13:59 < Darkasakerionz> EugeneKay, well I use linux and it's for my private ussing
13:59 < BrandonS9248> hid3: that was just a little bit of humour, you know...
14:00 <+EugeneKay> !redirect
14:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:01 < BrandonS9248> EugeneKay: thanks ;)
14:01 < BrandonS9248> !ipforward
14:01 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:01 <+EugeneKay> To get internet-browsing-via VPN, you need to push a route for it to the clients(redirect-gateway def1), enable IP forwarding on the server(/proc/sys/net/conf/ipv4/ip_forward), add a MASQUERADE rule to your iptables NAT table, and DNS if desired.
14:02 < BrandonS9248> AH FINALLY! 
14:02 < BrandonS9248> Did all of that execepted the masquerade stuuf
14:02 < BrandonS9248> that may be why
14:03 <+EugeneKay> Yup.
14:03 <+EugeneKay> !nat
14:03 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:03 <+EugeneKay> !linnat
14:03 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
14:04 < BrandonS9248> the tutorial I'm using advices me to do :
14:05 <+EugeneKay> Tutorials are usually wrong.
14:05 < BrandonS9248> iptables -A FORWARD -j REJECT
14:05 <+EugeneKay> Very wrong.
14:05 < BrandonS9248> Is it usefull? 
14:05 < BrandonS9248> You'e right, that's why I pick up many of them and rely all the common instructions to find out what's good or wrong
14:08 <+EugeneKay> Writing a secure iptables setup is beyond the scope of my laziness
14:08 < BrandonS9248> Ahah, thank you anyway :)
14:09 -!- Darkasakerionz [~Darkasake@84.120.216.243.dyn.user.ono.com] has quit [Ping timeout: 240 seconds]
14:20 <@vpnHelper> RSS Update - forum: Unable to access OpenVPN subnet in Server 2008 <http://forums.openvpn.net/topic9181.html#p17315>
14:24 -!- pierreghz_ [~pierreghz@cust-52-48-111-94.dyn.as47377.net] has quit [Quit: Quitte]
14:35 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
14:47 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
14:56 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Excess Flood]
14:58 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
15:09 -!- dxtr [ckru6i@dxtr.cc] has quit [Quit: leaving]
15:15 -!- raidz_afk is now known as raidz
15:32 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Ping timeout: 248 seconds]
15:32 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
15:38 <@vpnHelper> RSS Update - forum: Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17316>
15:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
15:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:50 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 606 seconds]
16:03 -!- kyrix [~ashley@194.24.138.7] has quit [Quit: Ex-Chat]
16:05 < BrandonS9248> Hi there
16:06 < BrandonS9248> do anyone use an openvpn server and go on the internet with it?
16:07 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
16:08 <+EugeneKay> Yes.....?
16:12 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
16:12 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
16:13 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
16:14 < BrandonS9248> EugeneKay: May I take a look at your client.conf please?
16:14 < BrandonS9248> I'm afraid I made a mistake somewhere in mine
16:14 <+EugeneKay> It works the other way around :-p
16:15 <+EugeneKay> And you shouldn't need much - redirect-gateway def1 is usually pushed from the server, rather than specified by the client
16:17 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
16:17 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
16:18 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
16:18 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
16:18 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
16:23 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
16:29 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
16:30 < BrandonS9248> EugeneKay: Ok, I'm going to doublecheck everything then ;)
16:38 -!- kloeri_ is now known as kloeri
16:38 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 258 seconds]
16:58 -!- BrandonS9248 [52e28040@gateway/web/freenode/ip.82.226.128.64] has quit [Quit: Page closed]
17:00 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
17:00 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
17:06 < krzee> [18:15]  <EugeneKay> And you shouldn't need much - redirect-gateway def1 is usually pushed from the server, rather than specified by the client
17:06 < krzee> while that is often true, i dont like it
17:06 < krzee> then you get all sorts of people wanting to un-do that rule and add their own, which they CAN do either way
17:06 < krzee> in that light, i think the client config should have that in any sort of real deployments
17:07 <+EugeneKay> I say it depends upon the skill level of the client.
17:07 <+EugeneKay> If it's an IT department trying to set stuff up for a medical billing office, then the secretaries shouldn't have to worry about a thing.
17:07 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:22 -!- brushbox [~brushbox@203.14.171.110] has joined #openvpn
17:22 < krzee> i agree
17:22 < krzee> what you think they make their own configs?
17:23 < krzee> just put it in the config before you install it
17:23 < krzee> make it part of the standard client config you hand out
17:23 < krzee> then when that random person actually does know some stuff, he doesnt need this in order to undo the fact that you pushed everything
17:23 < krzee> !route_override
17:23 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
17:26 -!- novaflash_away is now known as novaflash
17:29 <+EugeneKay> Random technical knowledge should be squished. Viciously. ;-)
17:39 -!- novaflash is now known as novaflash_away
17:46 < krzee> lol
17:59 <@vpnHelper> RSS Update - forum: How to gen client-cert for multi-server on the same machine <http://forums.openvpn.net/topic9174.html#p17317>
18:05 -!- brushbox [~brushbox@203.14.171.110] has quit [Quit: Leaving.]
18:05 <@vpnHelper> RSS Update - forum: Just two conceptual questions about OpenVPN <http://forums.openvpn.net/topic9182.html#p17318>
18:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:11 <@vpnHelper> RSS Update - forum: Openvpn, 2-way tunnel (=reverse connection -from openvpn-ser <http://forums.openvpn.net/topic9080.html#p17319>
18:12 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
18:12 < smw> Anyone managed to get bonjour chat working over openvpn?
18:14 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
18:14 -!- rkantos [~robin2@109.169.55.199] has quit [Remote host closed the connection]
18:15 < Olipro> smw: you would need to use tap for that
18:15 < smw> Olipro, probably not worth it.
18:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:16 < Olipro> mmm
18:16 < smw> Olipro, why is tap needed?
18:16 < Olipro> because it operates at the MAC/Ethernet layer
18:17 < smw> Olipro, and tun doesn't? hm
18:17 < Olipro> ....No
18:17 < smw> Olipro, any downside to using tap?
18:17 < Olipro> yes, it's an additional overhead and protocol independent
18:18 < Olipro> well, the protocol independent bit is both an upside and a downside
18:18 -!- bs0d [~bs0d@sa-184-60.saturn.infonet.ee] has joined #openvpn
18:18 < Olipro> that really depends on the deployment situation
18:18 < bs0d> Hello everybody
18:19 < bs0d> I am newbie in openvpn, I cannot understand the --remote parameter. This should be the domain, hostname or an ip address of the remote peer. In case I am expecting connections from dynamic ips, from workstations which have no domain bound to them, what should I place in this parameter. Could it be just omitted?
18:20 < Olipro> yup
18:20 < Olipro> "local" will be of help though
18:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:29 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
18:29 < bs0d> so, if I run command to set up a simple tunnel with whatever host connects to my vpn server by running command ( --remote is omitted ): openvpn --dev tun1 --ifconfig 10.4.0.1 10.4.0.2, then whatever client connects to my openvpn server, will see this machine as 10.4.0.1 And his machine will be seen as 10.4.0.2? Or I am missing something obvious?
18:32 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Remote host closed the connection]
18:33 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
18:39 < smw> what does this mean from ifconfig? inet addr:192.168.22.6  P-t-P:192.168.22.5  Mask:255.255.255.255
18:39 < smw> what is the P-t-P?
18:39 < bs0d> Peer to peer ( P2P ) I assume
18:39 < bs0d> but Im not sure though
18:39 < smw> bs0d, I thought the same thing
18:40 < smw> no idea what P2P means in this context
18:40 < smw> also, I think it is point to point
18:40 < smw> not peer
18:40 < smw> (still haven't the foggiest idea what a p-t-p ip is)
18:44 -!- bs0d [~bs0d@sa-184-60.saturn.infonet.ee] has quit [Ping timeout: 240 seconds]
18:47 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
18:48 -!- Denial [Denial@drgi.co.uk] has quit []
18:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:56 -!- bs0d [~bs0d@sa-170-204.saturn.infonet.ee] has joined #openvpn
18:57 -!- bs0d [~bs0d@sa-170-204.saturn.infonet.ee] has left #openvpn []
18:57 -!- bs0d [~bs0d@sa-170-204.saturn.infonet.ee] has joined #openvpn
19:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:04 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
19:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:17 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
19:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:25 -!- _julian [~quassel@hmbg-5f760905.pool.mediaWays.net] has joined #openvpn
19:26 -!- _julian_ [~quassel@hmbg-5f77d0d5.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:32 -!- Pilif12p is now known as Pilif|stufy
19:32 -!- Pilif|stufy is now known as Pilif|study
19:34 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
19:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:38 < krzee> [20:41]  <smw> (still haven't the foggiest idea what a p-t-p ip is)
19:38 < krzee> as opposed to it being a subnet style, its a ptp style, you were correct, peer to peer
19:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:39 < krzee> its how the default topology in openvpn works
19:39 < krzee> !/30
19:39 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
19:39 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
19:42 -!- Pilif|study is now known as Pilif12p
19:47 -!- bs0d [~bs0d@sa-170-204.saturn.infonet.ee] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
20:14 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has quit [Quit: Leaving]
20:18 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
20:18 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
20:18 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:18 -!- mode/#openvpn [+v Axeman] by ChanServ
20:18 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
20:19 -!- gardar [~gardar@gardar.net] has joined #openvpn
20:19 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
20:20 -!- gardar [~gardar@gardar.net] has joined #openvpn
20:20 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
20:20 -!- gardar [~gardar@gardar.net] has joined #openvpn
20:36 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
20:40 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
20:41 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
20:42 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
20:52 -!- mirco [~mirco@p5B2823E6.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:58 -!- mirco [~mirco@p5B2836BF.dip.t-dialin.net] has joined #openvpn
21:09 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
21:17 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
21:22 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:33 -!- mirco [~mirco@p5B2836BF.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
21:34 -!- mirco [~mirco@p5B281D9B.dip.t-dialin.net] has joined #openvpn
21:58 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
22:14 -!- smw [~smw@unaffiliated/smw] has quit [Ping timeout: 240 seconds]
22:23 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Excess Flood]
22:24 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
22:25 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Excess Flood]
22:27 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
22:37 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
23:15 <+EugeneKay> Because it's french *badum-tish*
23:15 <+EugeneKay> Annnd wrong window
23:22 < dym> (:
23:37 -!- eHAPPY [~typerazor@ip174-69-137-16.br.br.cox.net] has quit []
23:53 -!- mirco [~mirco@p5B281D9B.dip.t-dialin.net] has quit [Quit: mirco]
23:59 -!- ravel [~ravel_out@175.136.82.14] has joined #openvpn
23:59 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
--- Day changed Mon Nov 07 2011
00:06 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:14 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
00:49 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:34 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
01:37 -!- sobersabre [~bilbo@85.64.9.157.dynamic.barak-online.net] has quit [Quit: leaving]
01:44 -!- Guest85343 [dazo@nat/redhat/x-rfweoyaessnxoffc] has quit [Changing host]
01:44 -!- Guest85343 [dazo@openvpn/community/developer/dazo] has joined #openvpn
01:47 -!- mode/#openvpn [+o Guest85343] by ChanServ
01:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
01:48 -!- Guest85343 is now known as dazo
01:48 -!- mode/#openvpn [-o dazo] by ChanServ
01:49 -!- novaflash_away is now known as novaflash
01:50 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:55 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:04 <@vpnHelper> RSS Update - forum: Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17320>
02:05 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
02:20 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:20 -!- mode/#openvpn [+o mattock] by ChanServ
02:22 <@vpnHelper> RSS Update - forum: Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17321>
02:27 < Mowee> morning
02:47 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
02:52 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:56 -!- raidz is now known as raidz_afk
03:14 -!- civillian [~nickn@180.148.126.100] has quit [Ping timeout: 276 seconds]
03:15 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
03:19 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has joined #openvpn
03:20 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
03:32 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has quit [Quit: mirco]
03:51 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:01 < hid3> just shut up and drive
04:01 -!- hid3 [~arnoldas@78.157.71.116] has left #openvpn []
04:06 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:07 < bjorneven> she said
04:16 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
04:29 <@vpnHelper> RSS Update - forum: VPN Connection problem <http://forums.openvpn.net/topic9167.html#p17322>
04:44 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
04:52 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:05 <@vpnHelper> RSS Update - forum: Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17323>
05:09 -!- Blues-Man [~bluesman@host28-21-dynamic.247-95-r.retail.telecomitalia.it] has joined #openvpn
05:09 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:09 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:11 <@vpnHelper> RSS Update - forum: OpenVPN as a service config problem <http://forums.openvpn.net/topic9183.html>
05:23 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html#p17325>
05:30 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
05:33 -!- Netsplit *.net <-> *.split quits: deever, ronnocol, CybDev, Optic, +EugeneKay, Fiouz, SJr, bigon, pranq, ]R[,  (+11 more, use /NETSPLIT to show all of them)
05:35 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has joined #openvpn
05:35 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has joined #openvpn
05:36 -!- Netsplit over, joins: SJr
05:36 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
05:37 -!- Netsplit over, joins: RichardBronosky, scoopex, nickzxcv, deever, |Mike|
05:37 -!- Netsplit over, joins: Fiouz, krphop
05:37 -!- Netsplit over, joins: nibalizer
05:38 -!- CybDev [cybdev@abducted.by.aliens.org] has joined #openvpn
05:38 -!- CybDev [cybdev@abducted.by.aliens.org] has quit [Changing host]
05:38 -!- CybDev [cybdev@unaffiliated/cybdev] has joined #openvpn
05:38 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Remote host closed the connection]
05:38 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
05:38 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
05:39 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Remote host closed the connection]
05:39 -!- Netsplit over, joins: Jikan
05:39 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
05:39 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Remote host closed the connection]
05:40 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
05:40 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Remote host closed the connection]
05:40 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
05:41 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Remote host closed the connection]
05:41 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
05:41 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
05:42 -!- ravel [~ravel_out@175.136.82.14] has quit []
05:43 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
05:46 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
05:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:53 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
05:54 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Read error: Operation timed out]
05:54 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has quit [Read error: Connection reset by peer]
05:55 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has joined #openvpn
05:58 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
05:58 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
05:58 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
06:12 -!- Blues-Man [~bluesman@host28-21-dynamic.247-95-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
06:16 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has quit [Quit: mirco]
06:21 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html#p17326>
06:23 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 240 seconds]
06:27 <@vpnHelper> RSS Update - forum: OpenVPN as a service config problem <http://forums.openvpn.net/topic9183.html#p17327>
06:47 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:47 -!- mode/#openvpn [+o mattock] by ChanServ
06:51 -!- p3rror [~mezgani@41.249.8.151] has joined #openvpn
06:59 -!- nickzxcv [~nick@schmalenberger.us] has quit [Ping timeout: 240 seconds]
07:03 -!- nickzxcv [~nick@2001:470:1:41::d8da:df73] has joined #openvpn
07:03 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
07:03 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
07:21 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has quit [Read error: Connection reset by peer]
07:22 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has joined #openvpn
07:27 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17328>
07:33 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:33 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has joined #openvpn
07:39 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has quit [Quit: mirco]
07:40 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has joined #openvpn
07:46 -!- Champi [Champi@rootshell.fr] has quit [Quit: Quit]
07:47 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Remote host closed the connection]
07:48 -!- Champi [Champi@rootshell.fr] has joined #openvpn
07:50 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
07:53 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
07:53 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Remote host closed the connection]
08:02 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has joined #openvpn
08:02 -!- mirco [~mirco@p5080771A.dip.t-dialin.net] has quit [Client Quit]
08:08 -!- master_of_master [~master_of@p57B52B22.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
08:09 -!- master_of_master [~master_of@p57B55998.dip.t-dialin.net] has joined #openvpn
08:11 -!- Netsplit *.net <-> *.split quits: EugeneKay, derekv, Optic, fremo_, LowKey, fbh, ]R[, ScriptFanix, sno-_, chantra,  (+12 more, use /NETSPLIT to show all of them)
08:11 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 248 seconds]
08:12 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 240 seconds]
08:12 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
08:12 -!- tessier [~treed@kernel-panic/copilotco] has quit [Read error: Operation timed out]
08:12 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
08:13 -!- daguz1 [~leo@99-12-165-198.lightspeed.rlghnc.sbcglobal.net] has quit [Ping timeout: 240 seconds]
08:13 -!- tessier [~treed@216.105.40.123] has joined #openvpn
08:13 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
08:13 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
08:13 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 240 seconds]
08:13 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 240 seconds]
08:13 -!- nibz [nibz@reaver.cat.pdx.edu] has joined #openvpn
08:13 -!- nibalizer [nibz@reaver.cat.pdx.edu] has quit [Read error: Connection reset by peer]
08:14 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
08:14 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
08:14 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 258 seconds]
08:14 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
08:14 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
08:14 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
08:14 -!- havoc [~havoc@208.87.120.111] has quit [Ping timeout: 276 seconds]
08:15 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
08:15 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
08:16 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
08:16 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
08:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:17 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
08:17 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
08:17 -!- Netsplit over, joins: ]R[, Optic, bigon, ScriptFanix, fahadsadah, EugeneKay, Xeross, Jikan
08:17 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
08:17 -!- Netsplit over, joins: LowKey, kenyon, cyberspace-, nb, fremo_, chantra, diytto, fbh, sno-_
08:17 -!- LowKey [noc@unaffiliated/lowkey] has quit [Ping timeout: 243 seconds]
08:17 -!- Netsplit over, joins: derekv
08:18 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Max SendQ exceeded]
08:18 -!- nb [~nb@fedora/znc.nb] has quit [Write error: Broken pipe]
08:18 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Quit: >:o]
08:18 -!- VampirePenguin [~vp@unaffiliated/vampirepenguin] has joined #openvpn
08:18 -!- diytto [~diytto@2001:470:25:59c::1337] has joined #openvpn
08:18 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
08:18 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
08:18 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:19 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
08:19 -!- deever [~deever@78.46.68.172] has joined #openvpn
08:19 -!- LowKey [rhel@unaffiliated/lowkey] has joined #openvpn
08:20 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
08:21 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
08:23 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
08:23 < VampirePenguin> i am running arch linux with 3.0-pf kernel. the vpn fires up fine and i can browse http, but whether using msmtp or a browser i can't access https .... the message log doesnt show any errors so i wouldnt necessarily know what to give you all
08:24 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
08:24 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has quit [Ping timeout: 260 seconds]
08:24 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
08:25 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
08:27 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
08:27 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has quit [Read error: Connection reset by peer]
08:28 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has joined #openvpn
08:29 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17329>
08:32 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
08:41 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 255 seconds]
08:42 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
08:43 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
08:44 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
08:45 -!- VampirePenguin [~vp@unaffiliated/vampirepenguin] has quit [Quit: VampirePenguin]
08:47 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
08:51 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:51 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:51 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:51 -!- mode/#openvpn [+v Axeman] by ChanServ
08:52 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 245 seconds]
08:56 -!- raidz_afk is now known as raidz
08:57 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
08:57 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:57 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
08:57 -!- sigius [~sigius@93.125.185.45] has quit [Read error: Connection reset by peer]
08:57 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
08:57 -!- troyt_ [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
09:03 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
09:05 -!- raidz is now known as raidz_afk
09:08 -!- whtsup [~hello@WimaxUser38143-63.wateen.net] has joined #openvpn
09:08 < whtsup> hi 
09:08 < whtsup> any one for help ?
09:08 < whtsup> plz 
09:09 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
09:09 < whtsup> ?
09:09  * hyper_ch points to toppic
09:10 < whtsup> if i remove comp-lzo from server config compression will be disable or not ?
09:10 <+hyper_ch> what's your guess?
09:11 < whtsup> i m newbie 
09:11 < whtsup> thts y i m asking 
09:11 < whtsup> i have google abt this matter 
09:11 <+hyper_ch> so, newbie's can't guess?
09:11 < whtsup> it saying u have to disable lzo and recompile openvpn ?
09:13 <+hyper_ch> where is it saying that?
09:13 < whtsup> i have google some sites 
09:13 < whtsup> i m asking from you 
09:14 < whtsup> will it disable if i remove this from server config 
09:14 < whtsup> ?
09:14 <+hyper_ch> whtsup: do you think removing it form server config disables it?
09:15 < whtsup> yes 
09:15 < whtsup> i think so .. 
09:15 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html>
09:15 <+hyper_ch> whtsup: I think the same :)
09:15 < whtsup> ok i got it 
09:15 <+hyper_ch> :)
09:15 < whtsup> and how to set mtu ?
09:15 < whtsup> another question 
09:15 <+hyper_ch> there's a directive for it but no clue what it is
09:16 < whtsup> ok
09:16 < whtsup> ty .. 
09:17 <+hyper_ch> yw
09:23 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
09:25 -!- whtsup [~hello@WimaxUser38143-63.wateen.net] has quit [Ping timeout: 260 seconds]
09:25 -!- whtsup [~hello@14.192.144.24] has joined #openvpn
09:25 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
09:27 -!- dxtr [~dxtr@ip-91-123-200-78.kna.citycloud.se] has joined #openvpn
09:41 -!- Holister [~holister@75.92.109.172] has quit [Ping timeout: 245 seconds]
09:45 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
09:48 -!- mirco [~mirco@p508028F3.dip.t-dialin.net] has joined #openvpn
09:48 -!- whtsup [~hello@14.192.144.24] has quit [Ping timeout: 258 seconds]
09:49 -!- ravel [ravel@175.136.82.14] has joined #openvpn
09:51 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 245 seconds]
09:51 < dxtr> Hey guys! There's no special procedures (except bridging) that will allow me to send broadcast traffic to the other clients connected to my VPN but not care about physical LANs, right?
09:52 < dxtr> What I mean is: I don't care if the VPN clients will see my LAn
09:52 < dxtr> LAN*
09:52 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:52 -!- spditner [~simon@206-248-134-27.dsl.teksavvy.com] has quit [Ping timeout: 255 seconds]
09:52 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
09:53 -!- mirco [~mirco@p508028F3.dip.t-dialin.net] has quit [Remote host closed the connection]
10:06 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Quit: changing servers]
10:06 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
10:16 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17331>
10:24 -!- raidz_afk is now known as raidz
10:24 -!- dxtr [~dxtr@ip-91-123-200-78.kna.citycloud.se] has quit [Changing host]
10:24 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
10:26 -!- incorrect [~fwest@host81-137-110-129.in-addr.btopenworld.com] has joined #openvpn
10:27 < incorrect> hi, i've setup a shared key site to site vpn, i am guessing there is something stopping the two gateways from seeing each other
10:28 < incorrect> i can see other machines on the network, just not openvpn servers
10:28 < incorrect> oh
10:29 < incorrect> i am stupid
10:29 -!- raidz is now known as raidz_afk
10:34 -!- dazo is now known as dazo_afk
10:35 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 248 seconds]
10:35 -!- Holister [~holister@108-66-219-113.uvs.irvnca.sbcglobal.net] has joined #openvpn
10:36 -!- dxtr [~dxtr@host-88-80-29-36.cust.prq.se] has joined #openvpn
10:49 -!- ravel [ravel@175.136.82.14] has quit []
10:51 -!- ravel_cmd [ravel.exe@175.136.82.14] has joined #openvpn
10:58 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
10:59 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
11:01 -!- raidz_afk is now known as raidz
11:05 -!- ravel_cmd [ravel.exe@175.136.82.14] has quit []
11:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
11:12 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
11:12 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
11:14 -!- incorrect [~fwest@host81-137-110-129.in-addr.btopenworld.com] has quit [Ping timeout: 240 seconds]
11:18 -!- mirco [~mirco@p5B281D9B.dip.t-dialin.net] has joined #openvpn
11:19 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:25 -!- spditner [~simon@206-248-134-157.dsl.teksavvy.com] has joined #openvpn
11:26 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
11:27 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
11:53 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
12:08 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Ping timeout: 255 seconds]
12:08 <@vpnHelper> RSS Update - forum: how to ping client tap ? <http://forums.openvpn.net/topic9185.html>
12:22 -!- _julian__ [~quassel@hmbg-5f763576.pool.mediaWays.net] has joined #openvpn
12:25 -!- _julian [~quassel@hmbg-5f760905.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
12:29 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
12:31 -!- Guest74324 [ionic@ionic.de] has joined #openvpn
12:42 -!- Ziaix [~npc@borntyping.co.uk] has joined #openvpn
12:42 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
12:50 <@vpnHelper> RSS Update - forum: VPN Connection problem <http://forums.openvpn.net/topic9167.html#p17334> || Cannot interact remotely after Connection with OpenVPN <http://forums.openvpn.net/topic9172.html#p17333>
12:52 -!- HorizonXP [~xitij@24-246-38-179.cable.teksavvy.com] has joined #openvpn
12:52 < HorizonXP> hey guys, i'm having trouble with my OpenVPN network, and i'm hoping you can help
12:53 < HorizonXP> i have an OpenVPN server running with several clients connecting to it. I've been running it on port 443. It's worked flawlessly until I belive, this past Saturday
12:53 < HorizonXP> most of my clients are able to connect fine
12:53 < HorizonXP> however, two clients, located in the same physical location, are no longer able to
12:54 < HorizonXP> the connection is made to the server, but then it is reset, and openvpn restarts
12:54 < |Mike|> firewall?
12:54 < HorizonXP> no changes were made as far as i know
12:54 < HorizonXP> |Mike|: firewall would prevent the connection being made in the first place, wouldn't it?
12:54 < HorizonXP> i can see the logs of both client and server
12:54 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
12:54 < |Mike|> Depends on the settings
12:56 < HorizonXP> unfortunately, i cannot modify the firewall
12:56 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html#p17335>
12:56 < HorizonXP> at least, not easily
12:57 < HorizonXP> |Mike|: how would i determine that the firewall is indeed the cause?
12:58 < |Mike|> shut it off?
12:58 < |Mike|> can you ping the VPN server's IP?
12:58 < HorizonXP> |Mike|: I can ping the VPN server's IP yes
12:58 < HorizonXP> i can't shut off the firewall, lol
12:59 < |Mike|> do you get a reply?
13:00 < HorizonXP> yes
13:00 < |Mike|> and you're still connected ?
13:01 < |Mike|> !mtu
13:01 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
13:01 < HorizonXP> |Mike|: i should tell you that i am connected to both the client and server via SSH, but not through OpenVPN
13:01 <@vpnHelper> RSS Update - forum: how to ping client tap ? <http://forums.openvpn.net/topic9185.html#p17336>
13:01 < |Mike|> haha, yeah
13:01 < HorizonXP> I'm using a Cisco VPN to do that
13:01 < |Mike|> why not the usual openvpn client?
13:02 < HorizonXP> that's what i'm trying to solve, lol
13:02 < HorizonXP> basically, this client is a database server in an enterprise network
13:02 < HorizonXP> the enterprise runs their own Cisco VPN which i can use to get to the client
13:03 < HorizonXP> however, i'd rather use OpenVPN to have my database server connect to my external server (which also runs the OpenVPN server)
13:03 < HorizonXP> it's a setup that has worked brilliantly until today
13:03 -!- p3rror [~mezgani@41.249.8.151] has quit [Read error: Connection reset by peer]
13:05 < HorizonXP> |Mike|: i just set verbosity to 7, and noticed this: TLS Warning: no data channel send key available:  [key#0 state=S_INITIAL id=0 sid=00000000 00000000] [key#1 state=S_UNDEF id=0 sid=00000000 00000000] [key#2 state=S_UNDEF id=0 sid=00000000 00000000]
13:05 < HorizonXP> that comes before Conection reset, restart [-1]
13:05 -!- mirco_ [~mirco@p5B282DDD.dip.t-dialin.net] has joined #openvpn
13:05 < HorizonXP> but after it establishes a TCP connection with the server on port 443
13:07 -!- mirco [~mirco@p5B281D9B.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
13:07 -!- mirco_ is now known as mirco
13:09 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:15 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
13:16 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Remote host closed the connection]
13:19 <@vpnHelper> RSS Update - forum: how to ping client tap ? <http://forums.openvpn.net/topic9185.html#p17337>
13:20 -!- HorizonXP [~xitij@24-246-38-179.cable.teksavvy.com] has quit [Remote host closed the connection]
13:23 -!- HorizonXP [~xitij@24-246-38-179.cable.teksavvy.com] has joined #openvpn
13:24 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:24 -!- HorizonXP [~xitij@24-246-38-179.cable.teksavvy.com] has quit [Client Quit]
13:24 -!- HorizonXP [~xitij@24-246-38-179.cable.teksavvy.com] has joined #openvpn
13:24 < HorizonXP> |Mike|: any ideas?
13:28 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
13:31 < HorizonXP> |Mike|: could this have to do with daylight savings?
13:31 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:33 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
13:35 < HorizonXP> hey guys, i'm having trouble with my OpenVPN connection
13:35 < HorizonXP> it was working fine until a couple of days ago
13:35 < HorizonXP> here's a log (verb 8) from the client side
13:35 < HorizonXP> http://pastebin.com/FVvjW6wW
13:35 < HorizonXP> i can connect to both the client and server via separate means
13:36 < HorizonXP> anyway, the client can ping the openvpn server, and port 443 seems to be open, as telnet server 443 didn't yield an error.
13:36 < HorizonXP> i'm stumped as to what could be causing this, since this config has worked flawlessly for almost 3 years now
13:37 < HorizonXP> heck, i even migrated servers a couple of months back, and it's still worked since then
13:37 < HorizonXP> i'm starting to suspect an issue with daylight savings or something
13:37 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 240 seconds]
13:43 <@vpnHelper> RSS Update - forum: client-connect command failed <http://forums.openvpn.net/topic9186.html>
13:48 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
13:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:55 <@vpnHelper> RSS Update - forum: how to ping client tap ? <http://forums.openvpn.net/topic9185.html#p17340> || client-connect command failed <http://forums.openvpn.net/topic9186.html#p17339>
14:01 <@vpnHelper> RSS Update - forum: How to gen client-cert for multi-server on the same machine <http://forums.openvpn.net/topic9174.html#p17341>
14:02 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
14:03 -!- Ziaix [~npc@borntyping.co.uk] has quit [Quit: leaving]
14:07 <@vpnHelper> RSS Update - forum: OpenVPN as a service config problem <http://forums.openvpn.net/topic9183.html#p17342>
14:11 -!- novaflash is now known as novaflash_away
14:15 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:16 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:16 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
14:19 <@vpnHelper> RSS Update - forum: how to ping client tap ? <http://forums.openvpn.net/topic9185.html#p17344> || Max number of concurrent users for this setup <http://forums.openvpn.net/topic9148.html#p17343>
14:29 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
14:29 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
14:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:29 -!- mode/#openvpn [+v Axeman] by ChanServ
14:30 -!- Jarpse [~jarpse@cruft.geek.cx] has joined #openvpn
14:31 < Jarpse> Hi.. any line I can put in my client config, so it won't accept the IP the server gives out? (glitch in pfSense, I want the dhcp on the local network to hand out. not the pfsense)
14:36 -!- NiveusLuna [~niveuslun@fedora/NiveusLuna] has joined #openvpn
14:36 <@vpnHelper> RSS Update - forum: how to ping client tap ? <http://forums.openvpn.net/topic9185.html#p17345>
14:39 < NiveusLuna> Hey. I'm trying to set up OpenVPN to provide secure web access using NAT. So far, I'm getting nothing but "google.com? wth is that?"
14:41 < NiveusLuna> server is a Fedora 15 machine, itself behind a NAT firewall.
14:41 < NiveusLuna> I don't know what's wrong, let alone how to fix it.
14:43 < Olipro> "getting nothing but google.com"
14:43 < Olipro> yes, that makes perfect sense, not incoherent at all
14:43 < NiveusLuna> Olipro: Perhaps you missed the quotes where I put them.
14:43 < NiveusLuna> Olipro: "google.com? wth is that?"
14:43 < NiveusLuna> Olipro: Unless your client sucks balls, please read better.
14:44 < EugeneKay> !route_outside_ovpn
14:44 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
14:44 < Olipro> google.com is a DNS address
14:44 < NiveusLuna> I know that, Olipro 
14:44 < EugeneKay> Or do you just want internet redirection?
14:44 < EugeneKay> !def1
14:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:45 < EugeneKay> !redirect
14:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
14:45 < EugeneKay> You'll definitely need !linnat, as well as !iptables
14:45 < NiveusLuna> iptables I *might* already have set up.
14:45 < EugeneKay> And, if you can manage, a Scientific Linux or CentOS disc. Fedora is a bad choice for servers, generally speaking ;-)
14:46 < NiveusLuna> I'm aware. Moves too quickly. But I'm not gonna migrate everything over SL until Fedora 15 goes EOL because I'm Lazy (tm)
14:46 < NiveusLuna> *over to
14:46 < NiveusLuna> !linnat
14:46 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
14:46 < EugeneKay> You've got about 7 months
14:46 < NiveusLuna> I'm aware.
14:47 < NiveusLuna> check the cloak
14:47 < EugeneKay> One gotcha with SL that I didn't figure out until recently: you have to manually update the -release package between minor versions.
14:47 < EugeneKay> Cloaks are for sissies
14:50 < NiveusLuna> grr.
14:50 < NiveusLuna> i try to ping the server's gateway, get "unreachable"
14:50 < NiveusLuna> not gonna be able to get out until that ping works.
14:50 < EugeneKay> Got a MASQUERADE rule in place for the vpn subnet?
14:51 < EugeneKay> You need to masquerade from the vpn subnet to the server's LAN
14:51 < NiveusLuna> http://fpaste.org/qdWB/ <-- does this count?
14:51 < EugeneKay> What's this on?
14:51 < NiveusLuna> p2p1 is the name of the ethernet NIC
14:51 < EugeneKay> and whats p2p1
14:51 < NiveusLuna> the server
14:52 < NiveusLuna> because fedora is retarded and decided to change it from "names everyone recognizes" to "names nobody recognizes"
14:52 < NiveusLuna> and somehow thought this was an awesome idea
14:52 < EugeneKay> Is it the LAN?
14:52 < NiveusLuna> it's the only nic
14:52 < NiveusLuna> it better be
14:52  * EugeneKay shakes head at fedora
14:52 < NiveusLuna> it's based on the manufacturer's pci id
14:52 < NiveusLuna> *sigh*
14:52 < EugeneKay> I would have a -s 10.8.0.0/24 qualifier in there as well, but yes, that looks right.
14:53 < EugeneKay> Any particular reason you're not using ACCEPT [0:0] as your default across the board?
14:54 < NiveusLuna> it's whatever system-config-firewall-tui set.
14:54 < NiveusLuna> i don't know iptables
14:54 < NiveusLuna> so
14:54 < NiveusLuna> i've no idea what it means
14:54 < EugeneKay> Ahh.... that crap.
14:54 < EugeneKay> Well, it oughta work :-p
14:54 < NiveusLuna> it doesn't.
14:55 < NiveusLuna> i can't ping the lan gateway
14:55 < EugeneKay> Try it with the -s
14:56 < EugeneKay> Oh, stupid observation
14:56 < EugeneKay> -A FORWARD -j REJECT --reject-with icmp-host-prohibited 
14:57 < NiveusLuna> ...
14:57 < NiveusLuna> what.
14:57 < NiveusLuna> would that do it?
14:57 < EugeneKay> Yes. Yes it would.
14:57 < EugeneKay> Crash course on iptables: http://www.linuxhomenetworking.com/wiki/index.php/File:Iptables.gif
14:57 <@vpnHelper> Title: File:Iptables.gif - Linux Home Networking (at www.linuxhomenetworking.com)
14:58 < EugeneKay> Packets never make it to POSTROUTING
14:59 < EugeneKay> try -A FORWARD -s 10.8.0.0/24 -j ACCEPT
14:59 < EugeneKay> (or -I, if you're doing it live)
15:00 < NiveusLuna> http://fpaste.org/VuWC/ <-- how would this work?
15:01 < EugeneKay> Opens up your VPN subnet to anybody who can route to it properly, but OK for testing 
15:02 < NiveusLuna> Woooooooo!
15:02 < NiveusLuna> it works!
15:02 < EugeneKay> ;-)
15:02 < NiveusLuna> http://fpaste.org/p9H9/ <-- how's this one?
15:03 < EugeneKay> The -s qualifier on the postrouting chain isn't even necessary, but it'll keep it from rewriting ALL traffic out the interface(eg, from any secondary IPs you might have) to come from that single addy
15:03 < EugeneKay> You should still have the default REJECT tacked onto FORWARD
15:05 < NiveusLuna> ...now it doesn't work again.
15:05 <@vpnHelper> RSS Update - forum: PPTP over OpenVPN <http://forums.openvpn.net/topic9187.html>
15:05 < EugeneKay> Derp
15:05 < NiveusLuna> http://fpaste.org/CIw9/ <-- what did I screw up? XD
15:06 < krzie> why do people insist on using keep-state for udp!?
15:06 < EugeneKay> Because the fedora system-config-firewall maintainer is a hack
15:06 < EugeneKay> Oh.... try using -i tun0 instead of -s on the forward
15:07  * EugeneKay checks his man page
15:08 < EugeneKay> Oughta work.... hrm.
15:11 < NiveusLuna> the server subnet is behind a NAT firewall already...
15:11 <@vpnHelper> RSS Update - forum: how to ping client tap ? <http://forums.openvpn.net/topic9185.html#p17347>
15:11 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
15:11 < EugeneKay> NAT isn't really a firewall
15:12 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
15:12 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
15:12 < NiveusLuna> It's got a firewall-like effect... sometimes.
15:12 < NiveusLuna> it works now. I can worry about securing it later. >_>
15:14 < EugeneKay> :-p
15:16 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
15:27 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:32 < HorizonXP> argh. so turns out it was some internal network issue. problem's solved.
15:37 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
15:37 <@vpnHelper> RSS Update - forum: PPTP over OpenVPN <http://forums.openvpn.net/topic9187.html#p17349> || How to gen client-cert for multi-server on the same machine <http://forums.openvpn.net/topic9174.html#p17348>
15:38 -!- michal` [~michal@rsbac/developer/michal] has joined #openvpn
15:39 < michal`> hey
15:39 < michal`> got a question (google provides no interesting answers)
15:39 < michal`> Authenticate/Decrypt packet error: packet HMAC authentication failed
15:39 < michal`> TLS Error: incoming packet authentication failed from x.x.x.x
15:39 < michal`> yes, i've googled for it
15:40 < EugeneKay> Is x.x.x.x a valid client?
15:40 < michal`> yes, it is a windows machine that can connect to other openvpns
15:40 < michal`> all around the world
15:40 < michal`> it has a public ip address (should not matter with openvpn)
15:40 < michal`> and is connected to say, eth1 of the router
15:41 < michal`> on eth0 of the same router there is a vlan 50
15:41 < EugeneKay> Are you using --tls-auth on the server side?
15:41 < michal`> inside that vlan is openvpn server
15:41 < krzie> its your --tls-auth file
15:41 < krzie> md5 that file on both sides
15:41 < michal`> yes, and other clients can connect to it
15:41 < EugeneKay> Does the client have the right tls-auth? ;-)
15:41 < krzie> and make sure you used it right (1/0)
15:41 < krzie> !hmac
15:41 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls static key
15:41 < michal`> i have resent it to them just in case ;)
15:41 <@vpnHelper> , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
15:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:44 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
15:45 < michal`> ok
15:45 < michal`> there is a right 1/0
15:45 < michal`> 1 on the client
15:45 < michal`> and everyone else can connect :)
15:45 < michal`> ta.key is correct, i can connect from home, they cannot
15:45 < michal`> miracle )
15:45 < michal`> ;)
15:54 -!- jeev is now known as dongie
15:54 -!- dongie is now known as jeev
15:54 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p17350>
16:12 < |Mike|> HorizonXP: sorry, had a skype conversation
16:12  * |Mike| needs to sleep 
16:16 < HorizonXP> |Mike|: it's ok, turns out it was a network issue
16:16 < HorizonXP> got them to fix it, but no idea what caused it
16:16 < HorizonXP> i'll find out from them soon enough
16:16 < HorizonXP> thanks for your help!
16:18 < |Mike|> hm, strange that you could connect via ssh but not by vpn :s
16:21 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
16:27 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
16:30 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
16:51 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
16:58 < HorizonXP> yes very
17:09 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
17:11 -!- mirco [~mirco@p5B282DDD.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
17:27 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Remote host closed the connection]
17:27 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
17:29 -!- Guest74324 [ionic@ionic.de] has quit [Excess Flood]
17:34 -!- Ionic [ionic@ionic.de] has joined #openvpn
17:38 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html#p17351>
18:02 -!- Denial [Denial@drgi.co.uk] has quit []
18:02 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:08 -!- tessier [~treed@216.105.40.123] has quit [Ping timeout: 260 seconds]
18:11 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
18:11 < Xgates> hi guys
18:12 < Xgates> There's a VPN service I'm trying out and they only give you a config file and a .key, I know they have a great reputation, but I thought it's bad not to at least include a ca.crt?
18:12 < Xgates> From what I read OpenVPN recommends a ca cert, client cert and key
18:13 < Xgates> It's my understanding without, I forget which one, a ca cert or client cert you could face problems with MITM attacks...
18:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:18 < EugeneKay> Paste the config?
18:20 -!- NiveusLuna [~niveuslun@fedora/NiveusLuna] has left #openvpn []
18:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:27 -!- troyt_ [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
18:29 < Xgates> Hi EugeneKay 
18:29 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:29 < Xgates> here ya go; http://pastebin.com/cq15YpFE
18:29 < EugeneKay> That'll be a static key setup
18:30 < Xgates> sorry what does this mean?
18:30 < Xgates> so with just this config a key that's pretty safe?
18:30 < Xgates> config a/and a key....
18:30 < EugeneKay> Eh, it's simple
18:30 < Xgates> yeah I'll say hehe
18:31 < EugeneKay> A full PKI is recommended because PKI > static keys
18:31 < Xgates> I'm just concerned about MITM and I thought you always wanted to use a cert for this?
18:31 -!- newl [~newl@97.75.165.156] has joined #openvpn
18:32 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
18:32 < Xgates> in the .key it starts out saying this; # 2048 bit OpenVPN static key
18:32 < Xgates> so what's a full PKI?
18:32 < EugeneKay> Certs all around
18:32 < Xgates> sorry don't understand what all around means?
18:33 < EugeneKay> http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
18:33 <@vpnHelper> Title: Static Key Mini-HOWTO (at www.openvpn.net)
18:33 < EugeneKay> PKI means you need CA, client, server certs
18:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:34 < Xgates> ok so config, ca.crt, client.crt and .key yeah?
18:35 < Xgates> hmm static key, don't like this one; :(
18:35 < Xgates> Lack of perfect forward secrecy -- key compromise results in total disclosure of previous sessions
18:35 < Xgates> errrr
18:36 < Xgates> ok so, just having this config and a static key can be safe enough, or it's not enough and it's bad?
18:36 < Xgates> I'm a Linux geek and a Tech, but I don't know everything, so anything with some intelligence I can say back to this provider you'd recommend me saying about only offering a config and key to see if I can get them to change this?
18:38 < Xgates> EugeneKay: by the way this is PRQ http://prq.se/ they're suppose to be quite respected amongst VPN providers out there
18:38 <@vpnHelper> Title: PRQ - Colocation, Dedicated Servers, Web hosting, VPN Tunnels, Privacy services. (at prq.se)
18:38 < Xgates> so I'm a bit shocked to only see a config and a key unless it'd doable...
18:38 < Xgates> unless it's...
18:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
18:41 < EugeneKay> Probably a test key
18:42 < Xgates> no this is not a test key I signed up for service with them, it's all the give, is just a config and key
18:43 < krzie> thats a vpn company!?
18:43 < krzie> LOL
18:43 < Xgates> it's my understanding without certs you have no real way to know who you're communicating with and could get a MITM
18:43 < krzie> Xgates, no but you will not have forward security
18:44 < Xgates> krzie: PRQ is actually suppose to be quite good, WikiLeaks used them or is still using them, seems like a lot of high profile people have gone to them to use
18:44 < krzie> the mitm issue comes when you do use PKI but you dont specially sign the server cert and then force clients to check for that
18:44 < Xgates> ok
18:44 < krzie> in which case other client certs would be valid for a fake server
18:44 < krzie> !forwardsecurity
18:44 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
18:44 < Xgates> so what is something good I should email back to them about this, what would you tell them if they only gave you a config and a key?
18:45 < krzie> well i wouldnt buy a vpn service, lol
18:46 < Xgates> well I'm checking it out, so anything you can tell me I should send to them to see what they'll say about it?
18:47 < krzie> you want me to invent your complaint for you?  as a completely uninterested 3rd party i decline to carew
18:47 < krzie> -w
18:48 < Xgates> sorry no not invent, I'm simply asking when you only use a config file and a .key what problems is this creating? So I can learn is what this is about and by learning I can then tell them what I know about this...
18:48 < Xgates> that's all...
18:48 < newl> i'm gonna have to complain about the carew -w  option
18:52 -!- fread2281 [~fread2281@70-56-141-131.albq.qwest.net] has joined #openvpn
18:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:53 -!- fread2281 [~fread2281@70-56-141-131.albq.qwest.net] has quit [Read error: Connection reset by peer]
18:54 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 258 seconds]
18:55 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:56 < vpnuser> hello I would like to ask  how to perform openvpn over ssh?
18:57 < Xgates> well I'll just let them know these things then, I guess this is enough to say; http://pastebin.com/3L4kg4Lr
18:57 < Xgates> sheesh I can't believe these guys...
18:57 < Xgates> hmm
18:59 < newl> vpnuser: do you know what openvpn is ? and what ssh is?
18:59 < vpnuser> newl: yes. I dont know how to setup ssh and how to work ssh with openvpn yet
19:02 < vpnuser> newl: can you assist me with it?
19:03 < newl> no body has ever done openvpn over ssh - 
19:04 < Xgates> newl: you might want to reconsider that last comment hehe; 
19:04 < Xgates> https://encrypted.google.com/#sclient=psy-ab&hl=en&source=hp&q=openvpn+over+ssh&pbx=1&oq=openvpn+over+ssh&aq=f&aqi=g1&aql=&gs_sm=e&gs_upl=1825l5548l0l5945l20l16l0l0l0l2l1378l9234l3-3.5.2.4.1l15l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=7de1449e07857063&biw=1366&bih=628
19:04 <@vpnHelper> Title: Google (at encrypted.google.com)
19:05 < Xgates> ssh -L1194:vpnserver:1194 user@webserver
19:05 < newl> ah tunnelling - he never said that
19:06 < vpnuser> xgates how can I setup ssh server and login into it without the use of password?
19:06 < Xgates> well he did say openvpn over ssh :)
19:06 < newl> i took it as 'a tunnel in a tunnel' 
19:06 < Xgates> vpnuser: you should always login with password
19:07 < Xgates> I guess you could possibly do something like adding ssh to sudo and gain access like that then
19:07 < Xgates> vpnuser: you are talking about tunneling in with ssh to the vpn?
19:07 < newl> Xgates: thanks for the google :) 
19:08 < Xgates> np
19:08 < vpnuser> i intend to use plink with it together with my program. and I dont want the users to manually login into ssh server using plink.
19:08 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Excess Flood]
19:08 < vpnuser> <Xgates> vpnuser: you are talking about tunneling in with ssh to the vpn?   <--- YES
19:08 < Xgates> vpnuser: sorry what OS you using?
19:08 < vpnuser> xgates: im using windows xp
19:08 < Xgates> ok when I saw plink hehe
19:09 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
19:09 < vpnuser> can you kindly teach me how to please
19:09 < Xgates> hmm not sure then with plink but if you're using it and others are going to use it then just keep it locked with a password as it should be and no one can access it
19:11 -!- raidz is now known as raidz_afk
19:11 < vpnuser> yes that is what I am thinking.  I am less knowledgeable on configuring ssh server but some basic results on google I just followed
19:12 < Xgates> vpnuser: https://encrypted.google.com/#sclient=psy-ab&hl=en&biw=1366&bih=628&source=hp&q=plink+howto&pbx=1&oq=plink+howto&aq=f&aqi=&aql=&gs_sm=e&gs_upl=30061l31461l1l31639l6l5l1l0l0l0l371l371l3-1l3l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=7de1449e07857063
19:12 <@vpnHelper> Title: Google (at encrypted.google.com)
19:12 < Xgates> SSH requires password authentication it's the point of it, a secure shell
19:13 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
19:13 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
19:13 < Xgates> I've never heard of ssh without it hehe
19:13 < newl> Xgates: https://encrypted.google.com/search?hl=en&q=openssh+without+password    <= google revenge for you sir ;)
19:13 <@vpnHelper> Title: openssh without password - Google Search (at encrypted.google.com)
19:15 < vpnuser> with putty, I need to input the port number for tunneling and on vpn client config I nid to use ssh-proxy directive is this right?
19:17 < reiffert> !notovpn
19:17 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
19:17 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Ping timeout: 248 seconds]
19:18 < newl> say no to vpn? that don't sound right to post in #openvpn ?? ;)
19:20 < reiffert> say yes to people who can read.
19:28 < vpnuser> reiffert, I guess it will be openvpn issue because my next question is if setting socks-proxy will be right to use
19:29 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Read error: Operation timed out]
19:29 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
19:30 -!- Xgates [~Xgates@212.117.176.12] has joined #openvpn
19:31 < vpnuser> or how to use now openvpn to tunnel with ssh
19:33 < smw> vpnuser, why are you using ovpn over ssh?
19:34 < vpnuser> smw: i just need to
19:34 < smw> vpnuser, Why do you need to?
19:36 -!- _julian [~quassel@hmbg-4d068be8.pool.mediaWays.net] has joined #openvpn
19:36 < smw> vpnuser?
19:37 -!- _julian__ [~quassel@hmbg-5f763576.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
19:38 -!- raidz_afk is now known as raidz
19:42 < vpnuser> smw: i just read it and I have purpose for it.
19:44 -!- Xgates [~Xgates@212.117.176.12] has quit [Quit: Ping Timeout (0 Nano seconds)]
19:48 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:09 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
20:17 -!- Holister [~holister@108-66-219-113.uvs.irvnca.sbcglobal.net] has quit [Ping timeout: 256 seconds]
20:20 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17352>
20:25 < newl> i once read about money 
20:26 < dxtr> That's cool
20:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
20:56 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:57 < vpnuser> guys can you help me setup socks5 proxy for openvpn use?
21:01 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
21:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:07 -!- Holister [~holister@75.92.109.172] has joined #openvpn
21:34 -!- dxtr [~dxtr@host-88-80-29-36.cust.prq.se] has quit [Changing host]
21:34 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
21:40 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
21:44 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:45 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:46 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:47 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
21:58 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:45 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 248 seconds]
22:47 -!- dxtr [2cbf64ba@host-88-80-29-36.cust.prq.se] has joined #openvpn
22:58 -!- Druid_ [~Druid@p5B05CE11.dip.t-dialin.net] has joined #openvpn
23:22 <+hyper_ch> krzie: https://www.youtube.com/watch?v=SqBw7XapJKk  -  two legged robot that cycles a bike
23:22 <@vpnHelper> Title: 二足歩行ロボットを自転車に乗せてみた - YouTube (at www.youtube.com)
23:33 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
23:33 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
23:42 -!- dxtr [2cbf64ba@host-88-80-29-36.cust.prq.se] has quit [Quit: leaving]
--- Day changed Tue Nov 08 2011
00:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
00:32 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:54 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
00:58 -!- dxtr [d389af79@host-88-80-29-36.cust.prq.se] has joined #openvpn
01:13 -!- mirco [~mirco@p5B284344.dip.t-dialin.net] has joined #openvpn
01:14 -!- nachos [~nnscript@CPE-143-238-36-82.lnse1.win.bigpond.net.au] has joined #openvpn
01:15 -!- jeev [~jeev@unaffiliated/jeev] has quit [Excess Flood]
01:15 -!- mirco [~mirco@p5B284344.dip.t-dialin.net] has quit [Client Quit]
01:16 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
01:16 < nachos> Hi, I'm trying to use OpenVPN to connect to my VPN provier through a proxy. the connection is fine, handshake goes through and there is no problems BUT after its all established I have no traffic on the line and the connection is dead.
01:17 < nachos> This is the log: http://pastebin.com/rP4wvunt
01:17 < nachos> Any help would be much apreciated.
01:19 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:19 < EugeneKay> !logs
01:19 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
01:19 < EugeneKay> That log isn't very helpful. Could you set verb to 5 nd paste the whole thing, from initiation until an attempt to use it?
01:19 < EugeneKay> !configs
01:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
01:19 < EugeneKay> Your end of the configs would be helpful too
01:26 -!- michal` [~michal@rsbac/developer/michal] has left #openvpn [">/dev/yachill"]
01:30 -!- lunetics [~Druid@p5B05CE11.dip.t-dialin.net] has joined #openvpn
01:31 -!- Druid_ [~Druid@p5B05CE11.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
01:33 <@vpnHelper> RSS Update - forum: OpenVPN as a service config problem <http://forums.openvpn.net/topic9183.html#p17353>
01:40 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
01:41 -!- novaflash_away is now known as novaflash
01:50 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
01:50 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
01:52 <@vpnHelper> RSS Update - forum: OpenVPN as a service config problem <http://forums.openvpn.net/topic9183.html#p17354>
02:02 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
02:03 < nachos> EugeneKay: sure thanks
02:05 -!- dazo_afk is now known as dazo
02:07 -!- novaflash is now known as novaflash_away
02:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:11 < nachos> how can I get the openVPN config from Viscosity?
02:14 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 245 seconds]
02:16 < nachos> EugeneKay: http://pastebin.com/HFEv92ih
02:17 < nachos> Error log and config are there.
02:17 < nachos> Tell me what you think, thanks.
02:18 -!- VampirePenguin [~vp@unaffiliated/vampirepenguin] has joined #openvpn
02:19 < VampirePenguin> http://pastie.org/2829699         For some reason on a OVPN connection I can reach http but not https sites. The log is provided.
02:24 -!- michal` [~michal@rsbac/developer/michal] has joined #openvpn
02:24 -!- lunetics [~Druid@p5B05CE11.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
02:29 -!- Druid_ [~Druid@p5B136548.dip.t-dialin.net] has joined #openvpn
02:33 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:43 -!- HorizonXP [~xitij@24-246-38-179.cable.teksavvy.com] has quit [Ping timeout: 245 seconds]
02:50 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
02:50 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
02:51 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:51 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:52 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Client Quit]
02:55 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
02:59 -!- VampirePenguin [~vp@unaffiliated/vampirepenguin] has quit [Quit: VampirePenguin]
02:59 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
03:07 -!- smw [~smw@unaffiliated/smw] has quit [Ping timeout: 248 seconds]
03:11 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p17355>
03:17 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17356>
03:18 -!- nachos [~nnscript@CPE-143-238-36-82.lnse1.win.bigpond.net.au] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
03:18 -!- nachos [~nnscript@64.9.130.229] has joined #openvpn
03:18 < nachos> Hi,
03:18 < nachos> Sorry I was disconnected. Here is my log EugeneKay EugeneKay: http://pastebin.com/HFEv92ih
03:19 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
03:23 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p17357>
03:32 < Mowee> Morning
03:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:51 -!- raidz is now known as raidz_afk
03:56 < bjorneven> morn
04:05 < bjorneven> anyone with openvpn on pfsense here?
04:07 -!- novaflash_away is now known as novaflash
04:28 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:28 -!- mode/#openvpn [+o mattock] by ChanServ
04:29 -!- happylife [~happylife@212.92.145.7] has joined #openvpn
04:34 -!- happylife is now known as vpopov
04:44 -!- brodul [~brodul@cpe-90-157-214-173.static.amis.net] has joined #openvpn
04:44 < brodul> is there a way to add a passwort to openvpn certificate
04:45 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
04:52 -!- brodul_ [~brodul@89-212-63-194.static.t-2.net] has joined #openvpn
04:52 -!- brodul [~brodul@cpe-90-157-214-173.static.amis.net] has quit [Read error: Connection reset by peer]
04:56 -!- brodul_ [~brodul@89-212-63-194.static.t-2.net] has quit [Ping timeout: 258 seconds]
04:58 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
05:24 -!- defswork_ [~andy@hns01-fw.internal.gxn.net] has joined #openvpn
05:25 -!- ravel_exe [ravel_exe@175.136.82.14] has joined #openvpn
05:28 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Ping timeout: 258 seconds]
05:30 -!- ravel_exe [ravel_exe@175.136.82.14] has quit [Client Quit]
05:33 <@vpnHelper> RSS Update - forum: how to ping client tap ? <http://forums.openvpn.net/topic9185.html#p17358>
05:36 -!- defswork_ [~andy@hns01-fw.internal.gxn.net] has quit [Ping timeout: 245 seconds]
05:36 -!- defswork_ [~andy@mx2.3gcomms.co.uk] has joined #openvpn
05:36 -!- ZoneOne [4addd142@gateway/web/freenode/ip.74.221.209.66] has joined #openvpn
05:37 < ZoneOne> I would like to ask how openvpn works 
05:38 < ZoneOne> I am on mobile broadband and it needs simcard to have connectivity to the ISP. Does the ISP detects this simcard number upon connection or not due to encryption of openvpn?
05:38 -!- ravel_exe [ravel_exe@175.136.82.14] has joined #openvpn
05:38 <@vpnHelper> RSS Update - forum: OpenVPN-AS - Ubuntu - Bridging <Help! Need by Saturday> <http://forums.openvpn.net/topic9188.html>
05:44 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:52 -!- defswork_ [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
06:00 -!- ZoneOne [4addd142@gateway/web/freenode/ip.74.221.209.66] has left #openvpn []
06:05 -!- Ronis_BR [~Ronis@187.106.150.130] has joined #openvpn
06:06 < Ronis_BR> hi all
06:06 < Ronis_BR> I want to create a route between two computers to use VNC
06:06 < Ronis_BR> I have already set up openvnc, so I can connect using ssh
06:06 < Ronis_BR> but, when I try vnc, I have the error no routes to the server
06:06 < Ronis_BR> I just don't know what to do, can anyone help me?
06:07 -!- Koter [~joby@1.202.46.19] has joined #openvpn
06:08 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
06:08 -!- rfxn [~ryanm84@bas1-montreal54-1279651403.dsl.bell.ca] has joined #openvpn
06:08 < dazo> Ronis_BR: sounds like firewall issues, if you can SSH between these boxes via the VPN
06:09 < Ronis_BR> dazo: I'll turn off firewall on both computers
06:09 < Koter> Good morning/evening. I have a question: Is there a way to *exclude* torrent traffic from my VPN connection? I am in China, and I would like to have a direct connection for torrents (as they are legal here), but use my VPN for everything else (as half of it is blocked). Can I do that?
06:09 < rfxn> I got openvpn all setup and client connected, i have openvpn set to Not route all client traffic through the vpn. I just want the client to route traffic for certain networks (public destinations) through the vpn, i.e: our company web server ip at i.e: 208.77.55.11
06:10 < dazo> Ronis_BR: also be sure that VNC is listening and accepting incoming traffic
06:10 < rfxn> is that possible? i've tried add like ip route add 208.77.55.11 via 10.10.75.1 on the client to test but its not working
06:10 < Ronis_BR> dazo: ok, it is firewall :D thanks, but, what part of firewall?!
06:11 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
06:11 < dazo> Koter: nope, not in OpenVPN ... you use firewall rules to block such things ... but for bittorent, you might need layer7 filtering
06:11 < dazo> Ronis_BR: dunno ...
06:11 < Ronis_BR> dazo: something in the server lets see
06:12 < Ronis_BR> dazo: ooops, my mistake :) I opened VNP ports and but forgot to open VNC :D
06:12 < Ronis_BR> dazo: thanks!!
06:12 < dazo> rfxn: yes, in server config: push "route <remote IP> 255.255.255.255 vpn_gateway"
06:12 < dazo> Ronis_BR: no worries!
06:12 < rfxn> ty sir
06:13 < Koter> dazo, so- use the firewall to control which connections go to the vpn and which go direct? Thanks.
06:14 < dazo> Koter: correct ... VPN is like a virtual network cable ... firewalls controls what is allowed to pass through this "cable"
06:15 < Koter> dazo, perfect. Now at least I know which man pages to start reading :P
06:15 < dazo> :)
06:16 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
06:18 < rfxn> hmm thats not working and i see the vpn client adding the route
06:18 < rfxn> but i cant reach the destination
06:19 < rfxn> and gateway is correct
06:19 < rfxn> Tue Nov  8 07:16:43 2011 /sbin/ip route add 174.36.xx.xx/32 via 10.10.75.1 metric 101
06:39 -!- Ziaix [~npc@borntyping.co.uk] has joined #openvpn
06:41 < Ziaix> Is anyone around that can give me a bit of help? I'm trying to set up a static vpn (one client, one server), and the server is giving an error about routes when I start it:
06:41 < Ziaix> Tue Nov  8 12:39:15 2011 /sbin/route add -net 10.10.10.1 netmask 255.255.255.0 gw 10.10.10.2
06:41 < Ziaix> route: netmask doesn't match route address
06:47 < bjorneven> 10.10.10.1 is not the net ?
06:49 < Ziaix> 10.10.10.1 and 10.10.10.2 is what I've used in the configs as the server and client, should I use something else?
06:50 -!- mattock [~mattock@213.141.100.28] has joined #openvpn
06:50 -!- mattock [~mattock@213.141.100.28] has quit [Changing host]
06:50 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:50 -!- mode/#openvpn [+o mattock] by ChanServ
06:52 < bjorneven> 10.10.10.1 is a client address in 255.255.255.0
06:52 < bjorneven> 10.10.10.0 is the network
06:58 -!- brodul [~brodul@88.200.89.55] has joined #openvpn
07:02 < dazo> rfxn: make sure the openvpn server allows forwarding and also NATs the traffic from the VPN
07:03 < dazo> (allows forwarding: sysctl net.ipv4.ip_forward is set to 1, and that firewall accepts it)
07:03 < rfxn> rp_filter is off and ip_forward is enabled
07:03 < rfxn> yup
07:03 < rfxn> is there an option in the openvpn-as interface to automatically make it nat traffic for the vpn?
07:03 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
07:04 < dazo> rfxn: that's a question more suited for #openvpn-as
07:04 < dazo> !as
07:04 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
07:05 < rfxn> doesnt appear so from what i can tell of the options available
07:12 < bjorneven> hm , what is openvpn-as ?
07:14 -!- Koter [~joby@1.202.46.19] has quit [Ping timeout: 260 seconds]
07:15 < dazo> bjorneven: it's basically OpenVPN + a webUI ... all bundled together as a closed source product
07:15 < dazo> (well, the webUI is closed, openvpn is open)
07:16 < bjorneven> so it installs an openvpn client via the web ui ?
07:16 < dazo> it also have a different OpenVPN client for Windows which is supposed to make deployments easier somehow
07:16 < bjorneven> okay, I just use openvpn GUI exported from pfSense
07:16 < bjorneven> 95% happy with that 
07:16 < dazo> that makes just as much sense
07:17 -!- w00 [~wu@89.47.247.2] has joined #openvpn
07:19 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
07:19 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
07:19 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
07:26 -!- brodul [~brodul@88.200.89.55] has quit [Remote host closed the connection]
07:27 -!- Koter [~joby@46.165.196.25] has joined #openvpn
07:28 -!- brodul [~brodul@88.200.89.55] has joined #openvpn
07:31 -!- Ronis_BR [~Ronis@187.106.150.130] has quit [Quit: Ex-Chat]
07:34 -!- brodul [~brodul@88.200.89.55] has quit [Remote host closed the connection]
07:45 -!- brodul [~brodul@88.200.89.55] has joined #openvpn
07:45 -!- Ziaix [~npc@borntyping.co.uk] has left #openvpn []
07:46 -!- ichat [~ichat@84.245.1.4] has joined #openvpn
07:51 -!- brodul [~brodul@88.200.89.55] has quit [Remote host closed the connection]
07:51 -!- brodul [~brodul@88.200.89.55] has joined #openvpn
07:55 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
07:56 -!- brodul [~brodul@88.200.89.55] has quit [Remote host closed the connection]
07:58 -!- brodul [~brodul@88.200.89.55] has joined #openvpn
08:00 -!- brodul [~brodul@88.200.89.55] has quit [Remote host closed the connection]
08:01 -!- ichat [~ichat@84.245.1.4] has left #openvpn []
08:03 -!- brodul [~brodul@88.200.89.55] has joined #openvpn
08:06 -!- master_of_master [~master_of@p57B55998.dip.t-dialin.net] has quit [Read error: Operation timed out]
08:08 -!- brodul_ [~brodul@cpe-90-157-214-173.static.amis.net] has joined #openvpn
08:09 -!- master_of_master [~master_of@p57B54F47.dip.t-dialin.net] has joined #openvpn
08:11 -!- brodul [~brodul@88.200.89.55] has quit [Ping timeout: 276 seconds]
08:18 -!- asoryan [~ryanm84@bas1-montreal54-1279651403.dsl.bell.ca] has joined #openvpn
08:18 -!- rfxn [~ryanm84@bas1-montreal54-1279651403.dsl.bell.ca] has quit [Read error: Connection reset by peer]
08:22 -!- statix [~statix@rrcs-208-125-52-150.nys.biz.rr.com] has joined #openvpn
08:31 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:32 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
08:36 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 255 seconds]
08:38 -!- Ronis_BR [~Ronis@187.106.150.130] has joined #openvpn
08:39 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
08:39 < Ronis_BR> hi all
08:39 < Ronis_BR> how can I set NetworkManager to use ifconfig IP_1 IP_2 command?
08:39 -!- Ronis_BR [~Ronis@187.106.150.130] has left #openvpn []
08:40 -!- Ronis_BR [~Ronis@187.106.150.130] has joined #openvpn
08:46 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 256 seconds]
08:49 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:00 < gladiatr> Ronis_BR, wrong channel
09:00 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
09:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
09:02 -!- brodul_ [~brodul@cpe-90-157-214-173.static.amis.net] has quit [Ping timeout: 252 seconds]
09:04 < Ronis_BR> gladiatr: so, what is the channel?
09:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
09:07 -!- kyrix [~ashley@188.22.99.86] has joined #openvpn
09:14 < gladiatr> probably for whatever distribution you're using.  networkmanager configuration isn't supported here
09:15 < Ronis_BR> ok
09:15 < gladiatr> if you have questions regarding "normal" (text configuration file) things, ask away :)
09:24 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
09:27 -!- pdbogen [~pdbogen@pdpc/supporter/student/OctalTHOR] has joined #openvpn
09:27 < pdbogen> Is there a way to have openvpn add an entry to /etc/hosts (and/or c:\windows\system32\drivers\etc\hosts ..)?
09:27 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 248 seconds]
09:27 < pdbogen> (Hmm. Aside from writing a script to do it, I mean. Something like the existing route commands?)
09:28 -!- kyrix [~ashley@188.22.99.86] has quit [Quit: Ex-Chat]
09:28 -!- kyrix [~ashley@188-22-99-86.adsl.highway.telekom.at] has joined #openvpn
09:31 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:40 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:40 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17360>
09:40 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
09:42 -!- _Sam--_ [~sam@fresco.kneedraggers.com] has joined #openvpn
09:43 < _Sam--_> ive been running openvpn on several servers for years.    im trying to change one of my vpn servers from TCP to UDP.    when i make the change, i can connect to the VPN with a client fine -- but the routing doesnt work anymore.    wheni change to proto tcp in both the client and server, its fine....any tips?
09:43 -!- kyrix [~ashley@188-22-99-86.adsl.highway.telekom.at] has quit [Quit: Ex-Chat]
09:43 < _Sam--_> the UDP port is being sent through the firewall fine to the VPN server...
09:43 < _Sam--_> the vpn connection succedes
09:44 < _Sam--_> but i get no proper routing when proto=tcp
09:44 < _Sam--_> er, when proto=udp[
09:44 < _Sam--_> i have two instances of openvpn running on the server for testing ...one listening on tcp, one on udp.
09:44 < _Sam--_> same exact config, except one is proto = udp
09:46 < _Sam--_> nm...duh, i think i know whats wrong.
09:46 < _Sam--_> the second instance of openvpn running is assigning the same IPs as the first one -- and creating duplicate IPs on the lan
09:48 -!- raidz_afk is now known as raidz
09:49 < gladiatr> pdbogen, no.  You're gonna have to break down and write a script
09:49 -!- ravel_exe [ravel_exe@175.136.82.14] has quit []
09:49 < gladiatr> _Sam--_, doh!
09:50 < _Sam--_> i thought that was the case...but no such luck :/
09:50 < havoc> I gotta get all my ovpn instances converted to tun
09:50 < _Sam--_> just changed the UDP server conf to assign new ips...got a new ip...and still get no routing when proto=udp
09:50 < _Sam--_> the routes are right in my face on the client computer -- i see it fine 
09:51 < _Sam--_> but when udp, i cannot get to the other side of the vpn link
09:51 < pdbogen> gladiatr: Hokay, fair enough.
09:51 <@vpnHelper> RSS Update - forum: I need help... 2 vps and single pam athentication. <http://forums.openvpn.net/topic9161.html#p17361>
09:52 < _Sam--_> is there anything else iw ould normally have to change on the client.conf or server.conf other than proto=XXX   ?
09:52 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Read error: Operation timed out]
09:52 < _Sam--_> i mean , in terms of switching from tcp to udp, that shouldbe all thats needed?
09:54 -!- raidz is now known as raidz_afk
09:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
09:55 -!- Koter [~joby@46.165.196.25] has quit [Quit: Leaving]
09:56 -!- HorizonXP [~xitij@24-246-38-179.cable.teksavvy.com] has joined #openvpn
09:56 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
09:57 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 260 seconds]
09:59 -!- Ronis_BR [~Ronis@187.106.150.130] has quit [Quit: Ex-Chat]
09:59 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
10:03 -!- jeev [~jeev@unaffiliated/jeev] has quit [Excess Flood]
10:04 -!- jeev [~jeev@unaffiliated/jeev] has joined #openvpn
10:08 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
10:21 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:28 < gladiatr> _Sam--_, there shouldn't be
10:33 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p17362>
10:33 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Read error: Connection reset by peer]
10:44 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
10:46 -!- raidz_afk is now known as raidz
10:48 -!- bretanika [bretanika@89.114.11.171] has quit []
10:50 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
11:08 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 256 seconds]
11:13 -!- dazo is now known as dazo_afk
11:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
11:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:40 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:40 -!- mode/#openvpn [+o mattock] by ChanServ
11:43 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 244 seconds]
11:48 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
12:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
12:12 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
12:12 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
12:12 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
12:15 <@vpnHelper> RSS Update - forum: Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17363>
12:21 <@vpnHelper> RSS Update - forum: Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17364>
12:24 -!- roxdragon [~gianni@unaffiliated/roxdragon] has joined #openvpn
12:24 < roxdragon> hi all
12:25 < roxdragon> i have a problem with openvpn http://paste.ubuntu.com/732264/
12:27 < pdbogen> It looks like it can't open dh.pem.
12:27 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 260 seconds]
12:28 < roxdragon> dh.open is in the server?
12:29 < roxdragon> i have dh.pem in /etc/openvpn
12:30 < roxdragon> -rw-r--r--   1 root root  245  8 nov 19.08 dh.pem
12:30 < roxdragon>  pdbogen 
12:30 < roxdragon> i used #  openvpn --config /etc/openvpn/server.conf 
12:32 < gladiatr> roxdragon, use a fully qualified path: /etc/openvpn/dh.pem
12:32 < gladiatr> or to whever it is
12:32 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Ping timeout: 252 seconds]
12:32 < roxdragon> in the server.conf?
12:33 < roxdragon> my file is 
12:33 < roxdragon> tls-server
12:33 < roxdragon> dh dh.pem
12:33 < roxdragon> ca ca.cert
12:33 < roxdragon> etc...etc..
12:33 < roxdragon> dh /etc/openvpn/dh.pem ?
12:34 < roxdragon> gladiatr, 
12:34 < gladiatr> roxdragon, yup.  Or you can put "cd /etc/openvpn" in your server.conf.  This will make /etc/openvpn the relative starting path for any files
12:37 < roxdragon> gladiatr,  cd /etc/openvpn
12:37 < roxdragon> dev tap
12:37 < roxdragon> ifconfig 10.0.0.1 255.255.255.0
12:37 < roxdragon> it's ok?
12:39 < roxdragon> r BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
12:39 < roxdragon> Tue Nov  8 19:33:03 2011 us=566982 Local Options hash (VER=V4): 'cd0491fc'
12:39 < roxdragon> Tue Nov  8 19:33:03 2011 us=567001 Expected Remote Options hash (VER=V4): '50f4a987'
12:39 < roxdragon> Tue Nov  8 19:33:03 2011 us=567024 UDPv4 link local (bound): [undef]
12:39 < roxdragon> Tue Nov  8 19:33:03 2011 us=567036 UDPv4 link remote: [undef]
12:45 -!- Netsplit *.net <-> *.split quits: zu, gardar, Ionic
12:46 -!- Netsplit over, joins: gardar, zu
12:46 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
12:48 -!- Ionic [ionic@ionic.de] has joined #openvpn
12:50 -!- derekv [~derekv@c-68-62-78-203.hsd1.mi.comcast.net] has left #openvpn []
12:54 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
12:56 < roxdragon> hi execute  openssl genrsa -out client.key
12:56 < roxdragon> # openssl req -new -key client.key -out rich.cli
12:56 < roxdragon> in client
12:56 < roxdragon> but error
12:57 < roxdragon> http://paste.ubuntu.com/732264/
13:07 < roxdragon> how to create certificate on client?
13:13 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Remote host closed the connection]
13:15 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17365>
13:17 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
13:17 < roxdragon> i have debian server and client debian
13:21 <@vpnHelper> RSS Update - forum: Shell that will generate new users with passwords <http://forums.openvpn.net/topic9189.html>
13:23 -!- CybDev [cybdev@unaffiliated/cybdev] has quit [Ping timeout: 276 seconds]
13:43 -!- zdadmin [~chad@209.119.38.226] has joined #openvpn
13:43 < zdadmin> is there a way to force client disconnect after <X> amount of time?
13:44 < zdadmin> I have setup a openVPN tunnel for my remote employees -> but wish to have the client disconnect every hr.  I need this because my employees are idiots and leave it connected 24/7 until I call them and tell them to get off!
13:45 < zdadmin> Since I am forcing all client traffic through gateway, this is a concern since it eats our bandwidth.
13:45 < zdadmin> Not sure if I would do this through OpenVPN server, OR possibly the client side software -> but I would like to push "disconnect = 1hr" or something like that to them.  Didn't see it on the OpenVPN howto though???
13:47 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:52 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
14:00 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:08 < reiffert> http://www.youtube.com/watch?v=JB-IFjb7aIs
14:08 <@vpnHelper> Title: Lagwagon - Stokin the Neighbors - YouTube (at www.youtube.com)
14:08 < reiffert> woups, wrong window.
14:08 < reiffert> anyway, enjoy!
14:16 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:16 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:25 -!- Ronis_BR [~Ronis@187.106.150.130] has joined #openvpn
14:27 < Ronis_BR> hi, when I connect to openvpn I loose internet connection... how can I avoid it?
14:28 <+hyper_ch> !welcome
14:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:28 < Ronis_BR> hyper_ch: thanks! :)
14:28 <+hyper_ch> :)
14:28 <+hyper_ch> !def1
14:28 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:29 < Ronis_BR> hyper_ch: goood!
14:33 < Ronis_BR> hyper_ch: it turns out it is just a setting in network manager :)
14:33 <+hyper_ch> :) I don't use network manager for my vpn :)
14:33 <+hyper_ch> !networkmanager
14:33 < reiffert> !nm
14:33 < Ronis_BR> hyper_ch: man, just give me a direction, using openvpn is it possible to access internet through the remote computer?
14:33 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Ping timeout: 248 seconds]
14:33 < reiffert> !ubuntu
14:33 <@vpnHelper> "ubuntu" is dont use network manager!
14:33 <+hyper_ch> reiffert: :)
14:34 < reiffert> !netman
14:34 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
14:34 <+hyper_ch> Ronis_BR: it depens on how the server is configured
14:34 < Ronis_BR> hyper_ch: hum
14:34 <+hyper_ch> Ronis_BR: you run the server?
14:34 < Ronis_BR> hyper_ch: yup
14:34 < Ronis_BR> hyper_ch: I have ssh access 
14:34 <+hyper_ch> !config
14:34 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
14:34 <+hyper_ch> !configs
14:34 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
14:35 <+hyper_ch> reiffert: krzee: http://gizmodo.com/5857530/judge-says-putting-disgusting-warning-pictures-on-cigarette-boxes-is-a-violation-of-free-speech
14:35 <@vpnHelper> Title: Judge Says Putting Disgusting Warning Pictures on Cigarette Boxes Is a Violation of Free Speech (at gizmodo.com)
14:38 < roxdragon> hi all
14:38 < roxdragon> i havve a problem with client
14:38 < roxdragon> http://paste.ubuntu.com/732398/
14:39 < krzee> !certverify
14:39 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
14:39 < krzee> post your client config too
14:39 < roxdragon> $ ls /etc/openvpn/     client.conf  rich.cli            zmo.key  client.key   update-resolv-conf
14:40 < roxdragon> i haven't ca.cert
14:40 < roxdragon> on client
14:40 < krzee> bbiaf from krzie
14:42 < roxdragon> krzee, client.conf?
14:42 < roxdragon> on my server: root@Server:~# ls /etc/openvpn/
14:42 < roxdragon> ca.cert  ca.srl  rich.ca   ser.cert	server.key	    zmo.key
14:42 < roxdragon> ca.key	 dh.pem  rich.ser  server.conf	update-resolv-conf
14:43 < EugeneKay> !howto
14:43 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:43 <+hyper_ch> hi krzee
14:44 < Ronis_BR> hyper_ch: man, I have no idea ;)
14:44 < Ronis_BR> hyper_ch: I thought it will be just a gateway question
14:44 <+hyper_ch> Ronis_BR: krzee took over your case :)
14:44 < EugeneKay> roxdragon - look at the table enumerating what computer needs what file
14:44 < Ronis_BR> krzee: thanks
14:44 < roxdragon> krzee, http://paste.ubuntu.com/732407/
14:44 < Ronis_BR> wait a second
14:44 <+hyper_ch> oh, he didn't
14:45 <+hyper_ch> Ronis_BR: I need configs
14:45 < Ronis_BR> hyper_ch: yup
14:47 < Ronis_BR> hyper_ch: server configuration http://pastebin.com/xxE0YiWJ
14:47 < Ronis_BR> hyper_ch: client configuration NM :)
14:48 <+hyper_ch> Ronis_BR: any reason why you use tcp?
14:48 <+hyper_ch> !client-to-client
14:48 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
14:48 <@vpnHelper> clients
14:48 < roxdragon> anyone can help me?
14:48 < Ronis_BR> hyper_ch: good
14:48 <+hyper_ch> any reason for client-to-client?
14:48 < Ronis_BR> hyper_ch: I'll disable it
14:49 < Ronis_BR> hyper_ch: I'm just trying to access the others devices
14:49 <+hyper_ch> Ronis_BR: I mean why use tcp instead of udp?
14:49 < Ronis_BR> hyper_ch: to have something more reliable?
14:49 <+hyper_ch> you shouldn't need to use client-to-client to access other devices
14:49 <+hyper_ch> !udp
14:49 <+hyper_ch> !proto
14:49 <+hyper_ch> :(
14:50 < Ronis_BR> :(
14:50 < Ronis_BR> will remove proto tcp to use UDP so
14:50 < Ronis_BR> and remove client-to-client
14:50 <+hyper_ch> proto udp
14:51 < Ronis_BR> it should be faster right
14:51 <+hyper_ch> yes
14:52 < roxdragon> hi all how to install an VPN network? I broswe in all my remote LAN
14:52 <+hyper_ch> Ronis_BR: what distro?
14:53 <+hyper_ch> !howto
14:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:53 -!- statix [~statix@rrcs-208-125-52-150.nys.biz.rr.com] has quit [Remote host closed the connection]
14:53 < Ronis_BR> hyper_ch: arhclinux
14:53 -!- statix [statix@rrcs-208-125-52-150.nys.biz.rr.com] has joined #openvpn
14:53 < roxdragon> #1 or #2?
14:53 <+hyper_ch> roxdragon: openvpn user and group is nobody there?
14:53 <+hyper_ch> Ronis_BR: : openvpn user and group is nobody there?
14:53 < reiffert> http://5.hidemyass.com/ip-1/encoded/Oi8vd3d3LnlvdXR1YmUuY29tL3dhdGNoP3Y9Qy1QSHVQT3FuSjQ%3D&f=norefer
14:54 < Ronis_BR> hyper_ch: yup
14:54 <+hyper_ch> Ronis_BR: well, rest looks fine.. how many clients in the vpn?
14:54 < Ronis_BR> just me :D eahuehauehuae
14:54 <+hyper_ch> Ronis_BR: and do you want to route all traffic through the vpn?
14:54 < Ronis_BR> hyper_ch: yes
14:55 <+hyper_ch> Ronis_BR: server is also arch?
14:55 < Ronis_BR> hyper_ch: the other machine is at my university and firewall kind blocks anything, so I need vpn to use VNC for example
14:55 < Ronis_BR> hyper_ch: yes
14:55 <+hyper_ch> ok, ipforward enabled on the server?
14:55 < Ronis_BR> hyper_ch: but, I need to access internet by my server to download scientif stuff
14:55 < reiffert> !configs
14:55 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
14:55 < Ronis_BR> hyper_ch: don't know, how can I check
14:55 <+hyper_ch> !ipforward
14:56 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:56 < reiffert> damn, fell in love with lagwagon
14:56 <+hyper_ch> !linipforward
14:56 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
14:56 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
14:56 < Ronis_BR> hyper_ch: no, I don't have ip forward
14:57 < Ronis_BR> but it is easy to enable here
14:58 <+hyper_ch> Ronis_BR: you'll need that
14:58 < Ronis_BR> no problem
14:58 < Ronis_BR> so I'll enable here
14:58 <+hyper_ch> then you might want to add something like that to server config http://pastebin.com/sitaeRxW
14:59 <+hyper_ch> redirect-gateway def1 tells the client to set a default route to the vpn server (hence all traffic is rerouted through the vpn)
14:59 < Ronis_BR> hyper_ch: I have to replace DNS to my dns server right?
14:59 <+hyper_ch> and in addition you may want to push some dns servers
14:59 <+hyper_ch> 192.168.2.1 should be your server
14:59 <+hyper_ch> not sure if you run a NS on it
14:59 <+hyper_ch> 8.8.4.4 is google
14:59 < Ronis_BR> hyper_ch: oh, just a second, I don't want to always use that connection
14:59 <+hyper_ch> the other two are opendns
14:59 < Ronis_BR> hyper_ch: is it a way to enable it on client
15:00 <+hyper_ch> well, start/stop the vpn client
15:00 <+hyper_ch> that would be one way
15:00 <+hyper_ch> or you add the route manually
15:00 <+hyper_ch> but I guess start/stop is easie
15:00 < Ronis_BR> hyper_ch: or I create two configurations, one with the route and other without right?
15:00 < Ronis_BR> hyper_ch: ops, are you speaking about the server?
15:00 <+hyper_ch> Ronis_BR: yes, it's server
15:00 < Ronis_BR> lets see so
15:01 <+hyper_ch> the server pushes those directives to the client
15:04 < Ronis_BR> lets see
15:04 <@vpnHelper> RSS Update - forum: [Debian6] Good .conf / No incoming from internet to client <http://forums.openvpn.net/topic9190.html>
15:04 < Ronis_BR> I might be disconnected :)
15:04 <+hyper_ch> :)
15:06 < Ronis_BR> hyper_ch: why should I need to set all these DNS?
15:07 <+hyper_ch> can you have too many dns servers?
15:07 < Ronis_BR> what?
15:07 <+hyper_ch> :) well, not sure if your server runs a dns server
15:07 <+hyper_ch> then you also have google and opendns
15:07 < Ronis_BR> yes, it has it own
15:07 < Ronis_BR> ops
15:07 < Ronis_BR> we have a DNS server in the net
15:07 < Ronis_BR> LAN btw
15:08 < Ronis_BR> it seems to be working, it is slowwwwwwwwwww :D
15:08 < Ronis_BR> lets see if I can do what I want
15:08 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 255 seconds]
15:09 <+hyper_ch> google is pretty quick
15:09 <+hyper_ch> after you changed your server to udp you also need to adjust the client
15:09 < Ronis_BR> it is working
15:09 < Ronis_BR> but I think it has a problem
15:09 < Ronis_BR> in what's my ip i'm seeing my ip :D
15:10 < Ronis_BR> ops, ip forward...
15:10 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
15:10 < Ronis_BR> lets see
15:11 < Ronis_BR> hyper_ch: If I try whatismyip than I should see my server's ip right?
15:11 <+hyper_ch> you should
15:11 < Ronis_BR> hyper_ch: didn't work :(
15:11 < Ronis_BR> I'm seeing my ip
15:11 <+hyper_ch> server and client config?
15:12 < Ronis_BR> client is nm
15:12 < Ronis_BR> server:
15:14 < Ronis_BR> hyper_ch: http://pastebin.com/6SCeYii9
15:14 <+hyper_ch> did you restart openvpn on the server?
15:14 < Ronis_BR> hyper_ch: it really seems that all my connections is being redirect to the server, but my ip still the sabe
15:14 < Ronis_BR> yup
15:15 <+hyper_ch> hmmm.... the IP should be the server's now
15:15 <+hyper_ch> krzee: any idea?
15:15 < Ronis_BR> let me se something
15:15 < gladiatr> wow. finally.  linux/kame and openbsd having bi-directional conversations over IPsec.  hookers 'n blow for me tonight.  if you're ever feeling frustrated by openvpn, spend a week with ipsec...
15:15 < Ronis_BR> NM configuration
15:16 <+hyper_ch> !ubuntu
15:16 <@vpnHelper> "ubuntu" is dont use network manager!
15:16 < Ronis_BR> hyper_ch: nothing
15:17 <+hyper_ch> don't know
15:17 < Ronis_BR> hyper_ch: :(
15:18 <+hyper_ch> don't use network manager :)
15:18 < Ronis_BR> hyper_ch: anything special in the client conf?
15:18 < Ronis_BR> I can test with it
15:18 <+hyper_ch> nothing special in there
15:19 < Ronis_BR> trying without NM
15:21 < Ronis_BR> hyper_ch: nothing
15:22 <+hyper_ch> Ronis_BR: one of my client configs  http://pastebin.com/38XzRKZh
15:22 < Ronis_BR> hyper_ch: http://pastebin.com/usTFL2RD client config
15:23 <+hyper_ch> why do you have tun0?
15:23 < Ronis_BR> dunno :)
15:23 < Ronis_BR> I followed wiki
15:23 <+hyper_ch> what does   route    tell you?
15:24 < Ronis_BR> empty?!
15:25 < Ronis_BR> veeeeery strange
15:25 < Ronis_BR> hyper_ch: http://pastebin.com/zf6YvTRE
15:26 <+hyper_ch> I still have problems reading the routing table
15:26 <+hyper_ch> someone else here - /me eyes reiffert - might help
15:28 < krzie> what about it?
15:28 < Ronis_BR> hyper_ch: I lost internet connection using this config
15:28 < Ronis_BR> hyper_ch: I just can't ping nothing
15:28 <+hyper_ch> which config?
15:28 < Ronis_BR> hyper_ch: client
15:29 < Ronis_BR> hyper_ch: I just can't ping nothing
15:29 <+hyper_ch> whcih client config?
15:29 < Ronis_BR> hyper_ch: the one I posted
15:29 <+hyper_ch> well, sue mine
15:29 < Ronis_BR> http://pastebin.com/usTFL2RD client config
15:30 < Ronis_BR> I'll try
15:33 < Ronis_BR> su
15:33 <+hyper_ch> su?
15:33 < Ronis_BR> hyper_ch: I need to go, will try later :)
15:33 < Ronis_BR> thanks!
15:34 <+hyper_ch> good luck
15:34 < Ronis_BR> hyper_ch: wrong place to become a super user :D
15:34 < Ronis_BR> eheheh
15:34 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Quit: Yippee-kay-yay]
15:34 < Ronis_BR> hyper_ch: thankkkks!!!!
15:37 -!- pdbogen [~pdbogen@pdpc/supporter/student/OctalTHOR] has left #openvpn []
15:42 -!- meepmeep [meepmeep@212.24.104.229] has joined #openvpn
15:47 < nibz> 4
15:48 < roxdragon> 5
15:54 <+hyper_ch> 6
15:55 < roxdragon> 7
15:55 < roxdragon> lol
16:08 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
16:08 < zdadmin> Is there any way to force VPN clients to "disconnect" after either static time, such as <1hr> OR, after timeout of <x> amount of time?
16:08 < zdadmin> If so, is there a string I can add to the OpenVPN server to accomplish this?
16:09 < krzie> "after timeout of <x> amount of time"  = ?
16:14 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Read error: Operation timed out]
16:21 < zdadmin> like if client is just connected to VPN but not passing any traffic.
16:22 < zdadmin> Basically I want to eliminate employees forgetting to "disconnect" from VPN when they are done using it... 
16:22 < krzie> oh ya
16:22 < zdadmin> Having 30 people connected via VPN just browsing youtube or something would really kill our bandwidth.
16:22 < zdadmin> But we are using Tunnelblick as the client - so you have to manually CONNECT and DISCONNECT... 
16:22 < krzie> well if they're browsing youtube they're using it
16:22 < zdadmin> Users will always forget to disconnect when they are done.
16:23 < zdadmin> Right -- so I would like to force a time limit of like 1hr or something--- ya it's annoying for them if they have to reconnect every 1hr, but it's better than having them forget to disconnect.
16:24 < krzie> no idea
16:24 < |Mike|> morning.
16:24 < krzie> maybe you could rwite a script that could interact with the management interface
16:24 < krzie> !management
16:24 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
16:26 -!- novaflash is now known as novaflash_away
16:30 < |Mike|> wtf is up with away nicks?
16:30 < |Mike|> Am I on Quakenet?
16:30 <+hyper_ch> yes
16:31 < |Mike|> Gee
16:32 <@vpnHelper> RSS Update - forum: change metric <http://forums.openvpn.net/topic9191.html>
16:44 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html>
16:44 -!- zdadmin [~chad@209.119.38.226] has quit [Quit: zdadmin]
16:53 -!- nibz is now known as nibalizer
17:15 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
17:16 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
17:16 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
17:21 -!- rained23 [~rained23@175.141.145.47] has joined #openvpn
17:22 < rained23> !configs
17:22 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
17:23 < rained23> hi , are different ISP need different configuration ?
17:23 < |Mike|> nope
17:25 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
17:28 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
17:37 -!- whtsup [~hello@WimaxUser38143-63.wateen.net] has joined #openvpn
17:37 < whtsup> how to check openvpn mtu setting 
17:39 < |Mike|> !mtu
17:39 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
17:40 < whtsup> i have to change in server config ?
17:40 < whtsup> or just in client 
17:44 < rained23> |Mike|, but why when I use DSL provider I able to use my VPN but not my WiMAX provider .
17:46 < whtsup> hello 
17:46 < whtsup> how to set 1400 mtu
17:46 < whtsup> ?
17:46 < rained23> i think it is tun-mtu 1400
17:47 < whtsup> but i m using tap 
17:47 < whtsup> it will be okay ?
17:47 < whtsup> dev tap i m using 
17:48 < |Mike|> --mtu-test in your normal client config 
17:48 < whtsup> i did it 
17:48 < whtsup> it show 1275 
17:48 < |Mike|> then set itto 1275 :
17:49 < whtsup> Wed Nov 09 04:20:32 2011 NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1277,1277] remote->local=[1277,1277]
17:49 < whtsup> how to set it 
17:49 < whtsup> please i dont know 
17:50 < whtsup> can u tell me plz mike ?
17:50 < |Mike|> read the wiki?
17:51 < whtsup> i read it 
17:51 < whtsup> but i m not getting 
17:51 < whtsup> i m newbie
17:51 < whtsup> what i have to add in client config 
17:51 < |Mike|> then read it again.
17:51 < whtsup> and in server config 
17:52 < whtsup> cant u tell me ?
17:55 < |Mike|> I don't know everything out of my head ;)
17:58 < rained23> |Mike|, as you said nope, what will be the cause of my issue regarding my VPN ?
17:58 < Ronis_BR> hyper_ch: ping
17:59 < rained23> |Mike|, I try to troubleshoot it, but when I think again if it's working in my DSL connection why would it works at my WiMax connection ...
18:00 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has quit [Excess Flood]
18:00 < |Mike|> why shouldn't it? :)
18:01 < rained23> I think it cause of configuration... 
18:01 < rained23> something espeacially for WiMAX connection
18:01 < rained23> but as you said Nope.
18:01 < rained23> I cant come out with any solution. as firewall, I think it's not the cause .
18:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:01 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
18:02 < |Mike|> what's the issue?
18:02 -!- Ronis_BR [~Ronis@187.106.150.130] has quit [Quit: Ex-Chat]
18:02 < whtsup> i need to change mtu 
18:02 < whtsup> i m using openvpn for voip 
18:02 < whtsup> over adsl connection 
18:02 < rained23> I can use the VPN in DSL Connection, when I use WiMAX connection then the problems come out, I connected to the VPN but I cant ping, browse or resolve my dns .
18:03 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
18:06 < |Mike|> then push dns...
18:06 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has left #openvpn ["Linkinus - http://linkinus.com"]
18:07 < whtsup> mike wht happen if i change mtu setting to 1000 
18:07 < whtsup> ?
18:08 < whtsup> mike is it good to set lower mtu for voip ?
18:11 < |Mike|> http://www.personalvpn.org/OpenVPN-mtu-size.htm
18:11 <@vpnHelper> Title: OpenVPN MTU settings (at www.personalvpn.org)
18:12 < rained23> |Mike|, I think the push DNS is not the problems, I already push the dns , what the point to have a dns even I cant ping or making a connection from the VPN
18:14 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Remote host closed the connection]
18:14 < |Mike|> configs..
18:16 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:23 -!- Denial [Denial@drgi.co.uk] has quit []
18:24 -!- whtsup [~hello@WimaxUser38143-63.wateen.net] has quit [Ping timeout: 258 seconds]
18:25 -!- rained23 [~rained23@175.141.145.47] has quit [Remote host closed the connection]
18:27 -!- tty234 [telex@gateway/shell/anapnea.net/x-ymyrzicatzzrcesl] has quit [Read error: Connection reset by peer]
18:28 -!- whtsup [~hello@14.192.144.24] has joined #openvpn
18:36 -!- Ronis_BR [~Ronis@187.106.150.130] has joined #openvpn
18:36 < Ronis_BR> hi all
18:36 < Ronis_BR> I want that my client uses my server IP to access internet. I have done tons of things but I can't do that
18:36 < Ronis_BR> can anyone help me?
18:40 < krzie> !redirect
18:40 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
18:41 < Ronis_BR> ?
18:41 < Ronis_BR> krzie: I'm already using it
18:41 < Ronis_BR> krzee: when I connect to vpn, I just can't access any website
18:41 < Ronis_BR> krzee: sorry
18:41 < krzie> if its not working, the problem is 1 of those 3 things, or your firewall
18:41 < Ronis_BR> krzie: I disabled the firewall (iptables)
18:42 < krzie> LOL
18:42 < krzie> then exactly how do you have NAT
18:42 < Ronis_BR> excelent questions
18:43 < Ronis_BR> krzie: can you help to configure it?
18:43 < krzie> i did
18:44 < krzie> !linnat
18:44 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
18:44 < krzie> !linipforward
18:44 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
18:44 < krzie> !def1
18:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:44 < krzie> that is all
18:44 < Ronis_BR> krzie: thanks, I just saw the last one :)
18:45 -!- roxdragon [~gianni@unaffiliated/roxdragon] has quit [Read error: Operation timed out]
18:49 -!- whtsup [~hello@14.192.144.24] has quit [Ping timeout: 245 seconds]
18:49 < Ronis_BR> krzie: it is still blocking my trafic
18:50 < krzie> [16:41]  <krzie> if its not working, the problem is 1 of those 3 things, or your firewall
18:50 < krzie> period
18:50 < Ronis_BR> krzie: iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE
18:50 < krzie> bbl
18:50 < Ronis_BR> krzie: is this rule right?
18:50 < Ronis_BR> krzie: i think i'm missing something
18:50 < Ronis_BR> in the servers firewall
18:51 < Olipro> probably a filter rule to allow it
18:51 < Olipro> check your filter/FORWARD chain
18:52 < Ronis_BR> hum Olipro good point
18:52 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:52 -!- Ronis_BR [~Ronis@187.106.150.130] has quit [Quit: Ex-Chat]
18:52 < vpnuser> can I ask about openvpn?
18:53 -!- whtsup [~hello@WimaxUser38143-63.wateen.net] has joined #openvpn
18:53 < vpnuser> if I use openvpn, does openvpn encapsulate the traffic in some kind of openvpn container?
18:54 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
18:56 < vpnuser> please answer guys
18:59 < Olipro> tun/tap
19:01 < vpnuser> olipro, what do you mean tun/tap
19:01 < Olipro> your question doesn't really make sense, so I'm guessing you're asking about how traffic can be encapsulated
19:01 < Olipro> you can encapsulate as point-to-point tun, or ethernet-layer tap
19:02 < smw> Olipro, what are the downsides to tap?
19:03 < smw> Olipro, what are the upsides also? I only know that bonjour will work with tap
19:03 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
19:03 < Olipro> downsides; greater overhead, greater scope for insecurity if you don't know what you're doing
19:03 < Olipro> upsides; protocol independent (hence why bonjour works)
19:05 < smw> Olipro, what protocol is it independent of? lol
19:05 < Olipro> the layer 3 protocol
19:05 < Olipro> you can use NetBEUI over TAP if it floats your boat
19:06 < Olipro> did you never figure out what the P in IP stands for?
19:07 < krzie> tap does not scale well at all
19:07 < krzie> ip = internet protocol
19:07 < krzie> tap tunnels layer2, which has no security built in
19:08 < krzie> and the rest of what Olipro said =]
19:08 < smw> yep, sounds like I want to stick to tun
19:08 < Olipro> well, even so, it's not necessarily less secure... depending on OS
19:08 < smw> I will use tap when I try to setup a lan gaming network without a lan :-P
19:09 < Olipro> if you're using tap on linux and you're competent with ebtables, you should be fine :)
19:09 < smw> tun for work
19:09 < smw> Olipro, eb what now? :-)
19:09 -!- raidz is now known as raidz_afk
19:14 -!- newl [~newl@97.75.165.156] has joined #openvpn
19:15 < krzie> Olipro, orly?
19:15 < krzie> Olipro, your ebtables will stop me from arp poisoning you over the vpn?
19:16 < Olipro> it can be used to do that, yes
19:17 < newl> krzie: you good enough hacker to arp poison are we?
19:19 < Olipro> pfft, ARP, all the cool kids do rogue IPV6 router advertisements
19:19 < Olipro> *v6
19:26 -!- whtsup [~hello@WimaxUser38143-63.wateen.net] has quit [Ping timeout: 240 seconds]
19:28 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
19:29 < krzie> Olipro, i dont even have ipv6 enabled on most my boxen
19:29 < krzie> newl, and who are you...?
19:30 -!- whtsup [~hello@14.192.144.24] has joined #openvpn
19:33 -!- _julian_ [~quassel@hmbg-4d06cc6b.pool.mediaWays.net] has joined #openvpn
19:34 < newl> boxen ? 
19:36 -!- _julian [~quassel@hmbg-4d068be8.pool.mediaWays.net] has quit [Ping timeout: 256 seconds]
19:39 -!- bar__ [~bar@82.166.200.207] has joined #openvpn
19:40 < bar__> Anyone here? :)
19:41 < bar__> I enabled ip forwarding on my vpn machine
19:41 < bar__> and added a FORWARD rule to my iptables
19:41 < bar__> iptables -A FORWARD -i tun+ -j ACCEPT
19:42 < bar__> then from my client machine (that is connected through openvpn) I try to ping some IP on my private network
19:43 < bar__> when I use tcpdump on the VPN machine, I can see the ICMP requests from the client machine:
19:44 < bar__> 20:44:10.872960 IP 10.55.66.6 > 192.168.178.86: ICMP echo request, id 6229, seq 3, length 64
19:44 -!- bar__ is now known as Bartzy
19:45 < Bartzy> and I can see the packet count on iptables -vL increment on the FORWARD rule I mentioned.
19:45 < Bartzy> but on the destination machine (192.168.178.86), I don't see anything with tcpdump (no ICMP request), and there's no firewall there.
19:45 < Bartzy> any idea ? :\
19:46 < EugeneKay> iptables -L
19:47 < Bartzy> pastebin ?
19:47 < EugeneKay> Please
19:49 < Bartzy> EugeneKay: http://pastebin.com/4TZr0kWX
19:49 < Bartzy> I deleted some lines from the INPUT chain...
19:49 < Bartzy> but it shouldn't matter :)
19:50 < EugeneKay> Are you doing NAT? Need that table, too
19:50 < Bartzy> EugeneKay: No, I don't
19:50 < Bartzy> I think it may have to do with the routing table on my vpn-machine ?
19:51 < EugeneKay> That was my line of thought
19:51 -!- raidz_afk is now known as raidz
19:51 < Bartzy> This is the routing table (I changed the last octet of my addresses to 'x'): http://pastebin.com/Gw6gbjrR
19:52 < Bartzy> EugeneKay: ^
19:52 < Bartzy> It seems that 192.168.178.86 should go to the 192.168.128.0/17 route
19:53 < Bartzy> if I do "ping 192.168.178.86" from the vpn machine it works (the vpn machine has an IP in the 192.168.128.0/17 segment). 
19:53 < EugeneKay> Gimem a minute, cleaning up my desk
19:53 < Bartzy> but if I do "ping -I 10.55.66.1 192.168.178.86" then it doesn't work (10.55.66.1 is the ip of the vpn machine on the TUN device).
19:53 -!- whtsup [~hello@14.192.144.24] has quit [Ping timeout: 240 seconds]
19:54 < Bartzy> sure, thanks!
19:59 -!- whtsup [~hello@WimaxUser38143-63.wateen.net] has joined #openvpn
19:59 -!- whtsup [~hello@WimaxUser38143-63.wateen.net] has quit [Client Quit]
20:04 < EugeneKay> Annnd my brain is having a hard time with this, for some reason
20:05 < Bartzy> :)
20:06 < Bartzy> I just don't understand how to debug this
20:28 -!- Ronis_BR [~Ronis@187.106.150.130] has joined #openvpn
20:28 < Ronis_BR> Olipro: thanks!!! It was the filter/FORWARD chain
20:29 -!- researcher_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
20:29 < Ronis_BR> Olipro: I set the permission and everything is fine now, if I enable openvpn, than my external IP is my server IP, if I turn down, then I come back to my default client IP, thanks!
20:29 < Ronis_BR> krzie: thanks you too man!!!
20:29 < researcher_> I would like to ask if I can browse in my browser with http and https on the address bar, does that mean my ISP have not blocked http and https ports?
20:29 < Ronis_BR> you guy here are very helpfull :)
20:29 < Ronis_BR> hyper_ch: thanks you too!
20:36 < researcher_> I would like to ask if I can browse in my browser with http and https on the address bar, does that mean my ISP have not blocked http and https ports?
20:41 -!- mulvane [~mulvane@unaffiliated/mulvane] has joined #openvpn
20:42 < mulvane> Anyone know a good fix to fix dhcp packet renewal if I forward all traffic from my vpn client behind my isp's cable modem to my vps?
20:42 < newl> if isp block http and https then what you got left to pay them for?
20:43 < mulvane> I'm thinking I should just write a transparent pf rule to forward all over and allow dhcp to my isp only.
20:48 -!- Ronis_BR [~Ronis@187.106.150.130] has quit [Quit: Ex-Chat]
20:57 < newl> you can't blocl dhcp any way
20:59 <@vpnHelper> RSS Update - forum: extra routing with Windows 7 and User Access Controls <http://forums.openvpn.net/topic8739.html#p17370>
20:59 < mulvane> Well, going by the docs and the setup I am trying to change to, it says DHCP becomes an issue if all traffic is redirected and the vpn server becomes the gateway
21:04 -!- HopsNBarley [~hops@nslu2-linux/HopsNBarley] has joined #openvpn
21:09 < HopsNBarley> using openvpn for the first time - very neat.  however pings client->server aren't working.  i see the packets come in via the rx counter in ifconfig tun0.  i do have an extensive iptables config on the server (ahah!) but I don't see any of those counters change.  I can ping server->client, so i know the basics are working fine.  where should I look?  Thanks!!
21:10 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
21:10 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
21:16 < newl> mulvane can you use static ips?
21:17 < mulvane> I wish I could
21:25 -!- researcher_ [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
21:28 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Read error: Connection reset by peer]
21:28 -!- inimino [~inimino@boshi.inimino.org] has quit [Ping timeout: 260 seconds]
21:29 -!- pranq [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
21:29 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
21:30 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
21:30 -!- inimino [~inimino@69.164.198.129] has joined #openvpn
21:51 -!- mulvane [~mulvane@unaffiliated/mulvane] has left #openvpn []
21:57 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:02 -!- xizhendu [~xizhendu@li388-5.members.linode.com] has joined #openvpn
22:04 < xizhendu> hi, will openvpn produce a version for android or iphone offically?
22:06 -!- asoryan [~ryanm84@bas1-montreal54-1279651403.dsl.bell.ca] has left #openvpn ["Leaving"]
22:15 -!- HorizonXP [~xitij@24-246-38-179.cable.teksavvy.com] has quit [Quit: leaving]
22:17 < EugeneKay> !android
22:17 <@vpnHelper> "android" is (#1) CyanogenMod includes an integrated OpenVPN client. You will need a !p12 to load your certificates. or (#2) If you can't get CM, get root/busybox/tun and grab android-openvpn-installer + openvpn-settings from Market
22:18 < EugeneKay> !iphone
22:18 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
22:18 <@vpnHelper> iPhone and iPad.
22:18 < EugeneKay> OpenVPN the company, to the best of my knowledge, has no plans for either platform.
22:36 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
22:41 -!- raidz is now known as raidz_afk
22:43 -!- koex [~koex@69.46.69.194] has joined #openvpn
22:47 -!- raidz_afk is now known as raidz
22:55 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
22:55 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:57 -!- Bartzy [~bar@82.166.200.207] has quit [Ping timeout: 248 seconds]
23:09 <@vpnHelper> RSS Update - forum: Tried OpenVPN AS default but problems with connectivity <http://forums.openvpn.net/topic9193.html>
23:13 -!- koex [~koex@69.46.69.194] has quit [Ping timeout: 240 seconds]
23:14 -!- koex [~koex@69.46.69.194] has joined #openvpn
23:21 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
23:23 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
23:23 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
23:33 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
23:33 -!- mode/#openvpn [+o dazo_afk] by ChanServ
23:33 < xizhendu> thanks EugeneKay 
23:56 -!- swg0101 [~swg0101@openvpn/user/swg0101] has joined #openvpn
23:56 -!- mode/#openvpn [+v swg0101] by ChanServ
23:56 -!- swg0101 [~swg0101@openvpn/user/swg0101] has left #openvpn []
--- Day changed Wed Nov 09 2011
00:13 -!- koex [~koex@69.46.69.194] has quit [Ping timeout: 276 seconds]
00:14 -!- koex [~koex@69.46.69.194] has joined #openvpn
00:41 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:54 -!- chokesmaster [~chokesmas@65.92.140.229] has joined #openvpn
00:56 -!- chokesmaster [~chokesmas@65.92.140.229] has quit [Client Quit]
00:57 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has joined #openvpn
01:06 -!- richardsonclay [~richardso@64-71-24-18.static.wiline.com] has joined #openvpn
01:07 -!- richardsonclay [~richardso@64-71-24-18.static.wiline.com] has quit [Client Quit]
01:09 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17372>
01:12 -!- koex [~koex@69.46.69.194] has quit [Ping timeout: 260 seconds]
01:13 -!- koex [~koex@69.46.69.194] has joined #openvpn
01:15 <@vpnHelper> RSS Update - forum: Shell that will generate new users with passwords <http://forums.openvpn.net/topic9189.html#p17374> || change metric <http://forums.openvpn.net/topic9191.html#p17373>
01:15 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
01:17 < attila_lendvai> hi! I'm trying to circumvent internet filtering... therefore I've managed to set up openvpn in routed mode, my openwrt router is connected to a vpn server. I've added route rules for blocked sites like this: '208.93.0.168    *               255.255.255.255 UH    0      0        0 tun0', but I'm stuck here... do I need to add a route rule on the server also? I get a fast connection refused when I try to telnet the http port
01:17  * attila_lendvai is not a network guru
01:18 < attila_lendvai> there's a firewall on the server
01:19 < HopsNBarley> you'll need to permit the virtual interface.  i'm a newb, but i just did iptable -A INPUT -i tun+ -j ACCEPT
01:19  * attila_lendvai tries
01:20 < HopsNBarley> iptables, sorry.
01:21 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html#p17375>
01:22 < attila_lendvai> no luck. my firewall is shorewall, I'll try to google on that trace...
01:22 < HopsNBarley> rule placement in the list matters. 
01:24  * attila_lendvai has found http://www.shorewall.net/OPENVPN.html and starts reading
01:24 <@vpnHelper> Title: OpenVPN Tunnels and Bridges (at www.shorewall.net)
01:30 -!- qubits [~zero@unaffiliated/qubits] has joined #openvpn
01:30 < qubits> hello
01:31 < qubits> Can you tell me some of the fastest and most secure ways to do filesharing off a linux server, such as an encrypted bridge and firewall controlled samba? 
01:31 < qubits> ipsec?
01:32 < qubits> I don't know much about ipsec. Kerberos/AD authentication for samba? Does this still leave my samba vulnerable to mitm and buffer overflows?
01:33 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17376>
01:39 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:39 -!- mode/#openvpn [+o mattock] by ChanServ
01:45 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html#p17377>
01:47 < bjorneven> morning
01:48 < attila_lendvai> this must be a joke... the complexity seems to be enormous around routing, while I can't see such a level of inherent complexity in the domain. it might be my lack of understanding, though...
01:48 < attila_lendvai> that shorewall doc just makes it even more confusing
01:51 < attila_lendvai> any help is appreciated. these are my routes: http://pastebin.com/VdFCJ8XC
01:54 < attila_lendvai> what do I need to do with tun0 on the server to have incoming traffic go on to the internet? bridge it with eth0?
02:00 < bjorneven> do you have ip forwarding enabled ?
02:03 -!- brodul [~brodul@cpe-90-157-214-173.static.amis.net] has joined #openvpn
02:03 <@vpnHelper> RSS Update - forum: security and Authentication <http://forums.openvpn.net/topic9194.html>
02:18 < attila_lendvai> bjorneven: I'm unable to answer that question.
02:18  * attila_lendvai goes on googling
02:20 < attila_lendvai> sysctl net.ipv4.ip_forward says that I don't
02:20 < bjorneven> it has to be enabled for routing to work
02:20 < bjorneven> on the server that is
02:21 < attila_lendvai> enabling it didn't bring sudden joy, but I guess one step closer
02:21 < bjorneven> disable firewall completely while debugging this
02:21 -!- xizhendu [~xizhendu@li388-5.members.linode.com] has quit [Quit: leaving]
02:21 < bjorneven> set it to accept all
02:22  * attila_lendvai just stops shorewall altogether for the time beeing
02:22 < bjorneven> you want all traffic to go over the openvpn tunnel?
02:23 < attila_lendvai> bjorneven: only certain sites, that are blocked in kazakhstan
02:23 < attila_lendvai> see my paste, I have two entries for now in the openwrt router
02:24 -!- koex [~koex@69.46.69.194] has quit []
02:24 < bjorneven> you dont need a route on the server to the sites
02:24 -!- Druid_ [~Druid@p5B136548.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
02:24 < bjorneven> only the client
02:24 -!- Druid_ [~Druid@p5B136519.dip.t-dialin.net] has joined #openvpn
02:24 < attila_lendvai> yes, that's my understanding, too
02:24 < bjorneven> the openvpn server only needs a default route to the internet gw
02:24 < attila_lendvai> hrm, then it should work now
02:25 < bjorneven> do you know that traffic goes over the tunnel?
02:26 < Mowee> Morning
02:26 < attila_lendvai> bjorneven: no, I don't know how to test that
02:26 < bjorneven> attila_lendvai: openvpn logs, + tcpdump 
02:27 -!- brodul [~brodul@cpe-90-157-214-173.static.amis.net] has quit [Ping timeout: 256 seconds]
02:27 < attila_lendvai> bjorneven: although, when I remove the route entry for livejournal.com then it just hangs (as other blocked sites). when I add it, I get a quick conn refused
02:27  * attila_lendvai tries to double check that the data gets through the vpn runnel
02:27 < attila_lendvai> s/runnel/tunnel/
02:28 < bjorneven> !tcpdump
02:28 < bjorneven> heh, anyway, check out tcpdump tool to sniff traffic on you interfaces
02:30 < attila_lendvai> bjorneven: accroding to 'tcpdump -vv -i tun0' on the server, the interface is quiet
02:31 < bjorneven> try your wan interface too
02:31 -!- dazo_afk is now known as dazo
02:33 < attila_lendvai> bjorneven: if you mean it on the server, then it's quite busy
02:33 < attila_lendvai> (I'm ssh-ing to the server, that prints the tcpdump output... :)
02:33 < attila_lendvai> luckily I quit before the universe would have blown up... :)
02:36 < attila_lendvai> bjorneven: one step closer: when I telnet from the router (vpn client) then I do see traffic on the server tun0 interface (previously I've tried from my laptop, wifi-connected to the router)
02:42 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:44  * attila_lendvai is stuck
02:46  * attila_lendvai is installing tcpdump on the router
02:47 < bjorneven> wise choice
02:48 -!- novaflash_away is now known as novaflash
02:49 < attila_lendvai> don't know what to test, though... now I see two issues: 1) the vpn server doesn't seem to connect tun0 to the internet. 2) for whatever reason when I try to telnet to livejournal.com from my laptop, the traffic is not redirected to the VPN tunnel by my router
02:49 < attila_lendvai> tun0 is quiet on the router when I try to telnet from my laptop
02:50 < attila_lendvai> but that's only problem 2), problem 1) is a showstopper before that
02:51 < attila_lendvai> ip forwarding is enabled now on both the VPN server and the router (VPN client)
02:55 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:02 -!- raidz is now known as raidz_afk
03:05 -!- w00 [~wu@89.47.247.2] has left #openvpn ["WeeChat 0.3.7-dev"]
03:15 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Remote host closed the connection]
03:23 -!- Bartzy [~bar@82.166.200.207] has joined #openvpn
03:28 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17379>
03:39 -!- raidz_afk [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 258 seconds]
03:40 <@vpnHelper> RSS Update - forum: Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17380>
03:45 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:45 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:45 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:45 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 258 seconds]
03:58 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p17381>
04:00 -!- raidz_afk [~raidz@31.7.62.195] has joined #openvpn
04:04 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
04:04 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17383> || openvpn iptables nat problem <http://forums.openvpn.net/topic9195.html>
04:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
04:40 -!- BenC[UK] [~bcummins@cpc2-lock3-2-0-cust77.6-1.cable.virginmedia.com] has joined #openvpn
04:40 < BenC[UK]> !goal
04:40 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:41 < BenC[UK]> Hi Guys
04:41 < BenC[UK]> I am trying to get openvpn server set up behind the firewalls at one of th offices - the problem is its a shared leased line, so I have to rely on others making the changes..
04:42 < BenC[UK]> I can connect to the server from a client
04:42 < BenC[UK]> but, I get no routing to the local network
04:43 < BenC[UK]> I am running pfsense as an esxi guest 
04:43 < BenC[UK]> and using two virtual network interfaces for wan/lan
04:44 < BenC[UK]> wan is set to 172.21.127.1/24 and lan is 172.21.27.30/24 - inthe openvpn configuration - I have it set to allocate 10.0.10.0/24 as the ip range, and int he local network I have 172.31.21.27.0/24 - when it connects, I get the 10.0.10.6 ip with 10.0.10.5 as the gateway
04:45 < BenC[UK]> I've not defined anyfirewall rules or anything - am I missing something?
04:47 < BenC[UK]> (I have set up all of the ssl certificates and they are working fine)
04:51 -!- Bartzy [~bar@82.166.200.207] has quit [Ping timeout: 240 seconds]
04:53 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17384>
05:17 <@vpnHelper> RSS Update - forum: openvpn iptables nat problem <http://forums.openvpn.net/topic9195.html#p17385>
05:25 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
05:25 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
05:35 < attila_lendvai> my goal is to avoid internet censorship of certain sites. my plan is to set up a VPN channel from my local openwrt router to a remote VPN server (this part works), and route access to some sites through that VPN (this part is where I'm stuck). pointers what to read is welcome.
05:47 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17386>
05:48 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
06:21 -!- nachos [~nnscript@64.9.130.229] has quit [Read error: Connection reset by peer]
06:23 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17387>
06:35 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17388>
06:56 -!- Bartzy [~bar@82.166.200.207] has joined #openvpn
07:04 -!- _julian_ is now known as _julian
07:06 <+hyper_ch> dazo: krzie: http://i.imgur.com/WiOMq.jpg
07:11 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17389>
07:12 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
07:12 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
07:16 -!- michal` [~michal@rsbac/developer/michal] has left #openvpn [">/dev/yachill"]
07:33 -!- bauruine [~stefan@gprs07.swisscom-mobile.ch] has joined #openvpn
07:47 -!- bauruine [~stefan@gprs07.swisscom-mobile.ch] has quit [Quit: Leaving]
07:47 -!- bauruine [~stefan@193.247.250.7] has joined #openvpn
08:02 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
08:06 -!- mick_laptop [~mick@clamwin/admin/mickhome] has quit [Ping timeout: 240 seconds]
08:06 -!- master_of_master [~master_of@p57B54F47.dip.t-dialin.net] has quit [Read error: Operation timed out]
08:06 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
08:07 -!- mick_laptop [~mick@mickweiss.com] has joined #openvpn
08:10 -!- bauruine [~stefan@193.247.250.7] has quit [Remote host closed the connection]
08:10 -!- master_of_master [~master_of@p57B54E40.dip.t-dialin.net] has joined #openvpn
08:12 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 240 seconds]
08:12 -!- PeterJanku [~Miranda@195.178.92.31] has joined #openvpn
08:13 < PeterJanku> Hi,is here someone who could help me with ldap plugin for openvpn?
08:13 -!- Koter [~joby@46.165.196.25] has joined #openvpn
08:24 <@vpnHelper> RSS Update - forum: OpenVPN-AS - Ubuntu - Bridging <Help! Need by Saturday> <http://forums.openvpn.net/topic9188.html#p17390>
08:24 < ecrist> !ask
08:24 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
08:24 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
08:27 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has joined #openvpn
08:27 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has quit [Changing host]
08:27 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
08:28 -!- Koter [~joby@46.165.196.25] has quit [Ping timeout: 240 seconds]
08:41 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:41 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17391>
08:45 -!- Koter [~joby@1.202.46.121] has joined #openvpn
08:46 < Koter> Right- connection timed out. Did my question come through before?
08:48 < ecrist> no
08:49 < ecrist> my !ask was directed at PeterJanku 
08:51 < PeterJanku> sorry, i had a phone. Im looking for solution that allows me to auhteticate users for my openvpn from my universitas ldap server.
08:52 < PeterJanku> Every guid on internet which I found used one user for connection ldap and authenticate proces consisted in searching user into the database.
08:52 -!- reisi [koivunej@mustatilhi.cs.tut.fi] has joined #openvpn
08:52 < PeterJanku> But in our database didnt content password.
08:52 < reisi> is there any way to save username+password in a openvpn config file?
08:53 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
08:54 < Koter> So, I'm running OpenVPN, the connection is fine, etc, but I want to send some traffic out over my normal network. Essentially, reverse-split-tunneling. Oh, and I want to do it specifically for one application (torrent client). I'm running Linux.
08:54 < Koter> I asked yesterday, and was told that the answer lay in my firewall, but I've been reading documentation for an hour and I'm getting abit dizzy. Is there an easy, or at least a Not-Incredibly-Painful way to do this?
08:54 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 255 seconds]
08:54 < reisi> Koter: run a virtualized instance for all your torrent needs 
08:54 < PeterJanku> So, recomended procedure is try to login to ldap server with user name and password. Is there any way how can I used user password (which user have to fill in openvpn login) for login into ldap?
08:56 < Koter> reisi, a VM would work- but I need everything EXCEPT torrents over the VPN- so I'd have to do everything inside except for torrenting :/... 
08:56 < Koter> See- I'm in china, where torrents are perfectly legal but you need a VPN for gchat and wordpress.
08:56 < Koter> I'd make a mother russia joke, but they're abit stale
08:57 < reisi> Koter: run the torrent virtualized instance so that it's bridged to your eth0
08:57 < PeterJanku> I want to configure openvpn so that the user enters a user name and password. OpenVPN tries to connect to ldap with these data, and if successful, allows the user to access the VPN.
08:57 < reisi> Koter: then you can go and put your normal traffic into tunnel
08:58 < PeterJanku> is it possible?
08:59 < Koter> reisi, ah, I see- that sounds good... and how do I bridge the VM to eth0? [*clueless here*]
09:01 < reisi> Koter: with virtualbox it's just a switch of a nic setting (in the vm options)
09:01 < PeterJanku> no idea?
09:01 < Koter> Really? Sweet.
09:01 < reisi> PeterJanku: sounds like pretty usual setup
09:02 < PeterJanku> :-) it is possible but I have to do that because I cant change ldap settup...
09:03 < reisi> PeterJanku: i've never integrated openvpn and ldap, while i've used ldap to provide authentication for some webapps
09:03 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184.html#p17392>
09:03 < reisi> PeterJanku: at least the manual doesn't contain anything about ldap
09:03 < reisi> PeterJanku: http://www.imped.net/oss/misc/openvpn-2.0-howto-edit.html#auth
09:03 <@vpnHelper> Title: OpenVPN 2.0 HOWTO (at www.imped.net)
09:05 < reisi> PeterJanku: you can use a script that'll just connect with the given parameters; looks like auth-pam.pl is provided as an example
09:05 < PeterJanku> oh, it looks like goodi idea. Thanks.
09:05 < reisi> PeterJanku: if you've got pam set up so that these people can also authenticate to the server as normal users using the exact same credentials then that example should immediatedly work
09:06 < reisi> PeterJanku: actually, if pam is what you'll need to use read on for the next header :) "Using shared object or dll plugins"
09:07 < PeterJanku> Im reading it;-)
09:07 < PeterJanku> thanks again
09:07 < reisi> PeterJanku: no problemos
09:16 -!- PeterJanku [~Miranda@195.178.92.31] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
09:16 -!- newl [~newl@97.75.165.156] has joined #openvpn
09:20 < reisi> so does anyone know how i could save my openvpn client username/password in the config file?
09:23 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
09:30 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
09:40 -!- bretanika [bretanika@89.114.11.171] has quit []
09:41 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
09:43 -!- bretanika [bretanika@89.114.11.171] has quit [Client Quit]
09:44 -!- Holister [~holister@75.92.109.172] has quit [Ping timeout: 245 seconds]
09:46 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
09:58 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
10:08 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:14 <@vpnHelper> RSS Update - forum: Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17393>
10:14 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
10:18 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Ping timeout: 252 seconds]
10:22 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
10:26 < newl> reisi: if you look at the man openvpn and search for password looks like a number of ways to load from a file
10:31 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
10:33 < reisi> newl: aah i had missed auth-user-pass, lets try that
10:37 < reisi> newl: apparently i missed it because it was already defined in my template configuration, without any parameter though
10:38 < newl> did it work?
10:39 < reisi> newl: yes, thanks
10:44 < newl> so the default config was good you just needed the 'up' ? and of course the file?
10:45 -!- Holister [~holister@108-66-219-113.uvs.irvnca.sbcglobal.net] has joined #openvpn
10:54 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
10:54 -!- Holister [~holister@108-66-219-113.uvs.irvnca.sbcglobal.net] has quit [Quit: That's it for today]
11:03 -!- bretanika [bretanika@89.114.11.171] has quit []
11:03 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 256 seconds]
11:03 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Excess Flood]
11:04 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
11:09 -!- raidz_afk [~raidz@31.7.62.195] has quit [Quit: All your VPN are belong to us]
11:10 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has joined #openvpn
11:10 -!- Koter [~joby@1.202.46.121] has quit [Ping timeout: 258 seconds]
11:17 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has quit [Quit: All your VPN are belong to us]
11:18 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:18 -!- mode/#openvpn [+o raidz] by ChanServ
11:19 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Client Quit]
11:19 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has joined #openvpn
11:19 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17394>
11:21 -!- raidz_afk [~raidz@stab-you-with-a.bluntshank.com] has quit [Client Quit]
11:22 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:22 -!- mode/#openvpn [+o raidz] by ChanServ
11:23 -!- Koter [~joby@46.165.196.25] has joined #openvpn
11:26 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17395>
11:29 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
11:31 < luckman212> does anyone know how to specify an alternate install path on the command line for the OpenVPN-Installer (Windows) ?  It tries to install to C:\Program Files\OpenVPN but I would like it to install to just C:\OpenVPN\ 
11:31 < luckman212> any takers?
11:38  * luckman212 watches tumbleweed blow by
11:40 -!- Bartzy [~bar@82.166.200.207] has quit [Ping timeout: 245 seconds]
11:41 -!- Bartzy [~bar@82.166.200.207] has joined #openvpn
11:42 < luckman212> nevermind -- figured it out myself!  thanks to me
11:46 < BenC[UK]> Hi guys
11:47 -!- jeev [~jeev@unaffiliated/jeev] has quit [Ping timeout: 260 seconds]
11:52 -!- Brandon [52e28040@gateway/web/freenode/ip.82.226.128.64] has joined #openvpn
11:52 < Brandon> Hi there! Is anyone alive?
11:55 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
11:58 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
12:02 <@vpnHelper> RSS Update - forum: Shell that will generate new users with passwords <http://forums.openvpn.net/topic9189.html#p17396>
12:05 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:08 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072.html#p17397>
12:09 < BenC[UK]> doesnt look like it Brandon 
12:11 < Brandon> BenC[UK] Well I gues you're a wilking dead so :-p
12:12 < BenC[UK]> Im looking  for help myself
12:12 < Brandon> What for?
12:13 -!- elops [jsjsy@94.187.59.205] has joined #openvpn
12:14 < elops> im getting some prob please when sourcing the vars script in 4.8
12:15 < elops> anyone?
12:18 < Brandon> elops: this IC is dead dude
12:18 < elops> IC ?
12:25 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Quit: No Ping reply in 180 seconds.]
12:25 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
12:25 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
12:25 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:28 -!- elops [jsjsy@94.187.59.205] has quit []
12:30 < Brandon> Stil anybody?
12:31 -!- Koter [~joby@46.165.196.25] has quit [Quit: Leaving]
12:31 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html#p17398>
12:40 < qubits> I'd like to lock out any services  like samba and sshd maybe(?) except for PC's running the openvpn software. That would be idea. What kind of configuration would employ that? Listen on localhost only or create a separate subnet for the bridge and listen only on that  bleve?
12:41 < newl> sounds like a job for iptables and block all ports
12:42 < newl> you the same qubits asking the exact opposite in #samba?
12:42 < qubits> yes..
12:42 < qubits> Trying to keep track
12:43 < qubits> so newl I'll certainly be setting up shorewall, psad, portsentry, fail2ban, and denyhosts
12:43 < qubits> I'd like to know how to use openvpn and iptables to allow connections only from vpn'd IPs
12:44 < Brandon> qubits: I recommend you ufw too
12:45 < qubits> pros/cons Brandon ?
12:45 < qubits> What makes it stand out next to shorewall or maybe fwbuilder
12:46 < Brandon> As far as I know, ufw is complementary to iptables, made by NetFilter too, and is usefull for specific software configurations
12:47 < Brandon> Also, do you have a working openvpn server qubits ?
12:47 < qubits> no but i've set a few up before
12:48 < Brandon> Would you help me a bit please? Just look after my conf and tell me if something is wrong : https://forums.openvpn.net/topic9190.html
12:48 <@vpnHelper> Title: OpenVPN Support Forum [Debian6] Good .conf / No incoming from internet to client : Installation Help (at forums.openvpn.net)
12:48 < qubits> I'll try..
12:49 < qubits> what manual did you use to set it up
12:49 < qubits> best is to find a guide online
12:49 < Brandon> The offical one
12:49 < Brandon> And plenty of tutorials
12:49 < qubits> sometimes guides are more straightforward
12:49 < qubits> whats the error
12:49 < qubits> did you check logfiles on the client?
12:49 < qubits> on the server?
12:49 < Brandon> I can connect to the server but no internet tunneling.
12:51 < Brandon> Yes, but I did sniffer and snoop into the log and packets, but all I see is that the server is connected to internet, and I'm connecter to the server, but the packets dont come to me.
12:51 < Brandon> There must be a mistake in my conf...
12:52 < qubits> why is tcp commented out
12:52 < Brandon> because I use UDP
12:52 < qubits> try with tcp while i read on
12:53 < Brandon> ok
12:53 < qubits> also triple check that all keypairs match up
12:53 < Brandon> they do because I am connected to the server right now
12:53 < spditner> anyone good with dns records?
12:54 < spditner> woops, wrong channel
12:54 -!- Bartzy [~bar@82.166.200.207] has quit [Ping timeout: 260 seconds]
12:54 < Brandon> spditner: say that too if your wife catches you cheating on her :-p
12:55 < qubits> spditner: whats up
12:56 < qubits> how can i use a create a separate ip for openvpn connected clients to connect to my daemons on? Does a new ip range get created when i start open vpn or do i need to create a tunnel or bridge?
12:57 < qubits> why isnt tls auth key defined Brandon, does it need to be?
12:57 < qubits> pastebin the logs on both sides
12:57 <@vpnHelper> RSS Update - forum: Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17399>
12:58 < Brandon> qubits, no I don't use tls auth key yet
12:58 < qubits> k, logs
12:58 < Brandon> I'm setting up tcp, I go to open ports on my home firewall too and reboot internet and server and sh*t... ;)
13:02 < qubits> disable all firewalls temporarily
13:02 < qubits> allow all traffic on the linux ones for now
13:02 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html#p17400>
13:05 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
13:08 -!- Bartzy [~bar@82.166.200.207] has joined #openvpn
13:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 248 seconds]
13:20 <@dazo> qubits: openvpn listens for connections on all IPs (0.0.0.0) by default, unless you use the --local option, which ties it to one particular IP
13:22 < qubits> i see
13:22 <@dazo> qubits: --tls-auth requires you to have created a static key in advance (openvpn --secret ta.key --genkey ... iirc) ... this one needs to be shared (copied securely) to the client as well ... then you can use '--tls-auth ta.key 0' on one side and '--tls-auth ta.key 1' on the other side
13:22 < qubits> I was just talking to Brandon about it. Should I use tls-auth?
13:22 < qubits> For my intent.
13:22 <@dazo> I would recommend it ... it's an extra layer of security
13:23 < qubits> Sounds good
13:23 <@dazo> and if you use UDP ... the openvpn UDP port will not be discovered with port scans if the packet doesn't have the right HMAC signature created by tls-auth
13:23 < qubits> beautiful
13:24 < qubits> so dazo heres my question
13:24 < qubits> If I want to prevent any connections at all to my samba or web ports..
13:24 < qubits> Should I listen on a separate IP or can I use iptables effectively for this
13:25 <@dazo> you are running openvpn on the same box as your web/samba server?
13:26 < qubits> yes
13:26 < qubits> i have a windows 7 box for browsing and media playing, a backtrack 5 r1 64 bit box as a fileserver and IDS
13:27 <@dazo> okay ... well, there are two ways to do this ... the best one would be to make sure your openvpn server gets started before your samba and web server .... then these boxes can listen only to the VPN IP address
13:27 < qubits> i was considering running DLNA through mediamonkey on my win7 box once it can access the music as a mounted drive
13:27 -!- McBoingBo [~McBoingBo@mail.hrsg.ca] has quit [Quit: Leaving]
13:27 <@dazo> the other option, which can be combined with the first one, is to use iptables (in addition)
13:28 < qubits> what could i do with it if it's only listening on the openvpn ip
13:28 <@dazo> iptables is a must anyway ... as you need to close down the ports from your "world" interface (where the risky Internet is connected)
13:28 < qubits> can i set a static for the client and allow only that via iptables
13:28 < qubits> of course
13:29 < qubits> if i setup openvpn should/could i lock ssh to the vpn?
13:29  * dazo brb
13:30 < qubits> Also, would SFS be overkill with openvpn? I could juse use openvpn instead because it will blanket everything inside the vpn
13:30 < qubits> :<
13:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:32 < Brandon> qubits: I'm back, sorry for the delay
13:32 < Brandon> Doesn't work with TCP neither, but I'll stick to tcp
13:32 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 260 seconds]
13:34 <@dazo> qubits: you need to make services listen to a particular interface, that interface needs to have been created before these services starts up ... so the "easiest" is to make sure OpenVPN is running before you start ssh, samba, apache, whatever ... then you configure all of them to only listen to the tun/tap interface OpenVPN have created
13:34 < qubits> Brandon: dazo may be of more help
13:34 < qubits> upload those logs?
13:34 < Brandon> Hi dazo
13:35 < qubits> ah so dazo, openvpn will automagically create new interfaces?
13:35 <@dazo> if you want to restrict access to only one single OpenVPN client ... then you need to use ccd (--client-config-dir) and assign a static IP to that user
13:35 <@dazo> Brandon: hey
13:35 < Brandon> qubits: yes, I'm getting and posting them on my topic
13:35 < EugeneKay> qubits - I would leave SSH listening on 0.0.0.0 as normal, but set the firewall to ignore :22 on all but tun0
13:35 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
13:35 < EugeneKay> But not allowing external SSHis going to end in locking yourself out.
13:35 < EugeneKay> It always does.
13:36 <@dazo> qubits: EugeneKay's suggestion is also good ... until the iptables fails ....
13:36 < qubits> the box is local EugeneKay 
13:36 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
13:36 < qubits> EXACTLY dazo
13:37 < qubits> which is why i mentioned listening on the specific IPs only
13:37 < qubits> the separate interface will have its own ip right dazo 
13:37 <@dazo> qubits: yeah, *but* that raises the challenge bar .... you need to be sure OpenVPN starts *before* any services that should be VPN only starts
13:38 < EugeneKay> dazo - all my iptables problems have boiled down to the computer doing exactly what the idiot in the chair told it to. :-p
13:38 <@dazo> qubits: yeah, if you read the man page ... you see --ifconfig ... that's how it is configured
13:39 <@dazo> EugeneKay: security bugs/0day attacks, stupid person turning off iptables, etc, etc
13:39 <@dazo> layers of security is never a bad thing :)
13:39 <@dazo> (which is why I even use tcpwrappers on services supporting that)
13:39 < EugeneKay> Indeed.
13:40 < EugeneKay> I trust iptables enough to not worry much about 0days, though.
13:41 < EugeneKay> Of course, I also don't leave telnet running.
13:41 <@dazo> it's not been much 0day stuff for iptables directly ... but there has been some in the NAT paths already ... mostly data leakage iirc, so there are issues ... but it's mostly safe
13:41 <@dazo> lol
13:41 < newl> EugeneKay: did you leave off ...' anymore' from you telnet post?
13:41 <@dazo> telnet client is a blessing ... telnet daemon is the devil
13:41 <@dazo> newl: cheeky! ;-)
13:42 < EugeneKay> newl - I started doing sysadmin after SSH-1 was deployed widely ;-)
13:42 < Brandon> dazo: please have a little mercy for the network interface wich leaded us to ssh :-p
13:43 <@dazo> Brandon: I'm not saying you shouldn't .... it's your choice :)  I'm just (IT) paranoid :)
13:43  * dazo trusts no IP which is not configured by himself
13:43 < EugeneKay> I don't even trust my own IPs >_>
13:44  * Brandon uses a 2024bits Diffie-Hellman key
13:44 < Brandon> * 2028 sorry
13:44 < EugeneKay> 48?
13:44 < Brandon> ... I'm tired. 
13:44 < EugeneKay> And DH is a key-exchange algorithm, not a key algorithm
13:45 < EugeneKay> RSA is your private/pubkey algo(or ought to be), and it should be 4096
13:45 < Brandon> It is 4096 since i'm paranoid too :)
13:46 < qubits> i use 4096 ssh keys with password auth disabled in ssh
13:46 < qubits> also protected with a pw
13:46 < Brandon> Thanks for the enlightment anyway EugeneKay
13:46 < qubits> and encrypted via efs
13:47 < EugeneKay> ssh-agent is a nifty thing.
13:47 < qubits> the efs key backup is saved to a  3 layer encrypted truecrypt volume
13:47 < qubits> so tell me about tcpwrappers
13:47  * dazo uses 4k and 8k RSA key and 4k DH
13:48 < qubits> like sasl?
13:48 <@dazo> qubits: tcpwrappers are /etc/host.deny and /etc/host.allow ... which is a bit tricky to get right
13:48 < EugeneKay> How well-supported is 8k rsa?
13:48 < qubits> i use denyhosts
13:48 <@dazo> EugeneKay: sometimes it work, but for SSH, it's really challenging
13:48 <@dazo> qubits: denyhosts is something else
13:49 <@dazo> but it updates /etc/hosts.deny, iirc
13:49 < qubits> portsentry utilizes hosts.deny
13:49 <@dazo> yeah ... anyhow ... tcpwrappers are a compiled in library which blocks or allows connections based on the contents of hosts.deny and hosts.allow
13:51 < newl> the good thing about tcpwrappers (libwrap) is entries in the host.allow and host.deny are instantly in effect
13:51 <@dazo> yeah
13:52 < newl> i alway wondered why apache never adapted libwrap
13:53 < qubits> how is it implemented then
13:54 < newl> what do you mean?
13:55 < qubits> can you implement it like jail or does the daemon have to use it
13:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
13:58 < newl> read what dazo wrote at :49 
13:59 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081.html#p17401>
13:59 <@dazo> newl: I think your clock is out-of-sync ;-)
13:59 <@dazo> qubits: the daemon have to have been built with tcpwrapper support
14:00 <@dazo> sshd usually is
14:01 <@dazo> newl: apache probably never adopted it, as the purpose of a web server is usually that it should be available to everyone and that the performance hit going via tcpwrappers was too high for a high performance web server
14:01 < qubits> i like to use php and .htaccess
14:02 < EugeneKay> PHP is a hell ofa drug.
14:02 < qubits> :D
14:02 <@dazo> .htaccess is one way how to restrict access ... PHP ... well, that's something not related to security at all
14:02 < Brandon> qubits, dazo and EugeneKay: I just put the logs in my topic : https://forums.openvpn.net/topic9190.html
14:02 <@vpnHelper> Title: OpenVPN Support Forum [Debian6] Good .conf / No incoming from internet to client : Installation Help (at forums.openvpn.net)
14:03 < Brandon> dazo: talking about web language security, do you find Ruby on rails safe?
14:03 < EugeneKay> You enabled forwarding in /etc/sysctl, did you echo 1 > /proc/sys/net/ipv4/ip_forward ?
14:03 < EugeneKay> (or reboot)
14:03 <@dazo> Brandon: anything dynamic is by default unsafe
14:04 < Brandon> EugeneKay, cat /proc/sys/net/ipv4/ip_forward = 1
14:04 <@dazo> but I don't know Ruby (with/without rails) enough to say if it's safe or not
14:04 < EugeneKay> "Ruby on Rails is the title of the lost Benny Hill episode."
14:05 < EugeneKay> Why are you MASQUERADEing 3x?
14:05 < Brandon> EugeneKay: because I desesperately made that
14:06 < EugeneKay> #2 oughta do it for that bit
14:06 < Brandon> since one was not efficient
14:07 < EugeneKay> Can you ping the server's external IP from the client once the vpn is up?
14:07 < Brandon> #2 ?
14:07 < EugeneKay> The seecond masquerade rule
14:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:07 < Brandon> EugeneKay: Yes I can, it pings great :-p
14:08 < EugeneKay> How about the server's default GW?
14:09 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:09 < Brandon> ping 192.168.0.254 works fine too
14:09 <@dazo> the first masq rule is more than enough
14:09 <@dazo> that's the one which will be hit first
14:09 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:11 < Brandon> dazo: alright got to fix that
14:12 <@dazo> Brandon: I'd probably try to run tcpdump on the VPN interface and eth0 ... to see if the traffic on the router goes the right way there
14:12 < Brandon> EugeneKay: Woaw! What just happenned ? I can't browse the internet but Liferea, my rss flux reader just... updates...
14:12 < Brandon> But only text is shown, not images
14:13 < EugeneKay> o.O
14:13 < Brandon> and it seems that this is the only thing working
14:13 < Brandon> dazo: tcpdump -i eth0 ?
14:13 <@dazo> Brandon: could be that Liferea already had some connections established before OpenVPN went up
14:14 <@dazo> Brandon: yeah, add -n to remove DNS lookups too
14:14 < Brandon> dazo: Yes maybe, because it auto-updates
14:15 -!- An_Ony_Moose [~linus@skysimulation.de] has left #openvpn []
14:15 < Brandon> dazo: I got an unstoppable flux of data wich show up so damn quickly
14:16 < Brandon> Like if it was the matrix 
14:16 <@dazo> I think I see the issue
14:16 <@dazo> iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
14:16 <@dazo> that only allows traffic from tun0 to eth0 ... but not any return traffic
14:16 <@dazo> so do:
14:16 <@dazo> (instead)
14:17 <@dazo> iptables -I FORWARD -i tun0 -o eth0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
14:17 <@dazo> iptables -I FORWARD 2 -i eth0 -o tun0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
14:17 <@dazo> then you'll get stateful firewalling
14:18 < Brandon> dazo: ok, editing the /etc/rc.local file right now
14:19 <@dazo> iptables -t filter -A INPUT -p tcp -dport80 -j ACCEPT .... this one also got a syntax error .... -dport80 isn't valid
14:19 <@dazo> --dport 80 on the other hand is
14:20 < Brandon> dazo: thanks, and about the masquerade line, I delete them all except for the first one ?
14:24 < Olipro> you always SNAT(MASQUERADE) on the outgoing interface that has the globally routable IP 
14:30 < Brandon> dazo: connection to server is fine, but still can't reach the internet.
14:37 < Olipro> you won't, if it's not NATting packets
14:39 < Brandon> Olipro: What do you mean exactly?
14:40 < Olipro> what rules do you have in nat/POSTROUTING
14:40 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
14:41 < Brandon> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
14:41 <@dazo> that rule should masq. everything going to the Internet
14:41  * dazo presumes eth0 is the interface with the public IP address
14:41 < Brandon> http://paste.ubuntu-fr-secours.org/plain-103242
14:42 <@dazo> Brandon: please pastebin the output of:  iptables-save
14:42 < Brandon> Oh no forgot that one, it's the old one
14:45 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
14:45 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
14:45 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
14:47 < Brandon> dazo: http://paste.ubuntu-fr-secours.org/plain-103243
14:47 < Brandon> those command are pretty revelant, hope the issue is there
14:48 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
14:49 <@dazo> Brandon: that tcpdump doesn't say me much ... serverip / myip ... that's just your internal traffic, right?
14:49 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 258 seconds]
14:49 <@dazo> try: tcpdump -i eth0 -n port ! 22
14:49 <@dazo> (filter out ssh traffic)
14:49 < Brandon> dazo: well the servip ip is the openvpn server ip
14:49 < reiffert> should be 'not port 22'
14:50 <@dazo> nah, port ! 22 works as well
14:50 <@vpnHelper> RSS Update - forum: WIN XP SP3 -Connected but cannot ping, but WIN 7 works fine. <http://forums.openvpn.net/topic9003.html#p17404> || VPN connection lost in seconds <http://forums.openvpn.net/topic9057.html#p17403> || Windows XP sp2 to sp3 upgrade breaks openvpn connection? <http://forums.openvpn.net/topic9154.html#p17402>
14:51 < Brandon> dazo: I'm learning a lot of great stuff, thank you so much anyway :)
14:52 < Brandon> dazo: should have done: tcpdump -i eth0 -n port ! 22 -c 10
14:52 <@dazo> skip the -c
14:52 < Brandon> but it won't stop if I skip it
14:52 <@dazo> ctrl-c ... after you see your traffic
14:52 < Brandon> didn't not that... thanks
14:53 < Brandon> *know
14:55 < Brandon> dazo, http://paste.ubuntu-fr-secours.org/plain-103246
14:56 <@dazo> okay, you have still much noise here ...
14:56 <@dazo> try:  tcpdump -i eth0 -n icmp
14:56 <@dazo> and then from your VPN client do ping 8.8.8.8
14:57 < Brandon> dazo: it works! 
14:57 < Brandon> it did not before you told me to change my iptables stuff
14:58 <@dazo> gah ... chasing an error which is non existent ... great!
14:58 <@dazo> :)
14:58 < Brandon> well I still can't go on internet
14:58 <@dazo> try to restart firefox
14:58 < Brandon> I tried with opera, epiphany, chromium and iceweasel
14:59 <@dazo> Let me then see the icmp traffic from tcpdump
14:59 <@dazo> and provide route -n from both server and VPN client
14:59 < Brandon> tcpdump icmp -n ?
14:59 <@dazo> tcpdump -i eth0 -n icmp
15:02 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
15:02 -!- mode/#openvpn [+o raidz] by ChanServ
15:04 < Brandon> dazo: OH DEAR GOD HOLY SH*T
15:04 <@dazo> !??!
15:05 < Brandon> dazo: 1 entire week spent in front of my laptop, trying to get it to work.
15:05 < Brandon> You are my hero dude.
15:05 <@dazo> I did nothing
15:05 < Brandon> It works, and an ip check prooves it.
15:05 <@dazo> cool!
15:06 < Brandon> The bizarre thing is that Liferea does not download the images
15:06 < Brandon> But I don't care, it just works
15:06 < Brandon> Thank you a LOT for this, you saved me hours of headache
15:06 < Brandon> and taught me a lot too ;)
15:07 <@dazo> iirc, liferead uses the gecko engine ... and that sometimes manages to keep the old route info ... I've seen that in Firefox from time to time even
15:07 <@dazo> that's good :) ... happy it works for you :)
15:07 < Brandon> dazo: well, looks like I yelled too soon...
15:07 < Brandon> But it workd for a few seconds, that's weird
15:08 <@dazo> what did you do in between?
15:08 <@dazo> do you have NetworkManager running screwing up your routing table?
15:08 < Brandon> nothing execpt refreshing all my pages
15:08 < Brandon> hey, you're right
15:08 < Brandon> gonna /etc/init.d restart that shit
15:09 <@dazo> that doesn't do much ... you're on an old NetworkManager version?  (old Debian?)
15:09 < Brandon> Squeeze debian; and I just did : service network-manager restart
15:10 < Brandon> does not do much
15:10 < Brandon> Reboot the whole thing?
15:10 <@dazo> I dunno ... you need to figure out why network manager insists on changing your routing table ... it often happens if it reconnects 
15:10 <@dazo> it also changes /etc/resolv.conf behind your back too
15:11 < Brandon> what a bastard
15:11 < Brandon> how about using /etc/network/interfaces ?
15:12 <@dazo> NM does a lot of good things - like allowing users to connect easily to wireless nets ... but it can be a pain too, as it believes all users are brain dead stupid
15:12 <@dazo> Brandon: I don't know debian ... so I don't know how that stuff works
15:12 < Brandon> alright it is a network interfaces wich is loaded at the very stratup of a system boot
15:13 < Brandon> the main info are in the file, pretty customizable and a lot of options
15:13 <@dazo> NM is two fold ... a system service started at boot ... and a user applet, which controls the system service
15:14 < Brandon> Unfortunately many softs just doesn't fit to it, as they belive the system is not connected to internet while it is with /etc/network/interfaces
15:14 < EugeneKay> !netman
15:14 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
15:16 < Brandon> EugeneKay: So you suggest me to use network-manager-openvpn-gnome ?
15:16 <@dazo> nah, that won't make things better
15:16 < EugeneKay> I suggest *not* using it.
15:17 <@dazo> except that for basic eth/wlan ... that's de-facto standard on all Linux distros these days
15:17  * Brandon does aptitude purge network-manager-openvpn
15:17 < krzie> i certainly suggest not using it to configure a vpn, but once you confirm your vpn works manually, if someone imports their working config into netman i could care less
15:18 <+hyper_ch> hi krzie
15:18 < krzie> i just hate when people use it while asking for help, a pointless extra piece of software during that phase, which can add issues
15:18 < krzie> hi
15:19 < Brandon> krzie, I never used it, just installed it in case it would be usefull
15:19 <+hyper_ch> krzie: seen the links?
15:19 < krzie> not sure
15:19 <+hyper_ch> krzie: http://i.imgur.com/WiOMq.jpg
15:20 <@dazo> hyper_ch: that's a great one!
15:20 <+hyper_ch> krzie: http://i.imgur.com/O2NkM.jpg
15:20 <@dazo> lol
15:20 < krzie> nice!
15:21 < Brandon> the last one is excellent
15:21 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
15:21 <@dazo> the first one is just painfully true!
15:22 <+hyper_ch> dazo: now just tell that the 750 million facebookers
15:22 <@dazo> hyper_ch: I've posted it on FB :-P
15:22 < krzie> tell a couple, they'll facebook it to the rest
15:22 < krzie> exhibit a ^
15:23 <+hyper_ch> hehe :)
15:24 <+hyper_ch> first half of the week is over :) second half is coming :)
15:27 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
15:33 < Brandon> dazo: should I put the "10.8.0.1" in my /etc/resolv.conf ?
15:33 < Brandon> I mean: nameserver 10.8.0.1 
15:33 <@dazo> Brandon: not really ... you should use some script hooks in OpenVPN to update that "on-the-fly"
15:34 <@dazo> otherwise you won't resolve anything when not having connected to the VPN
15:35 < Brandon> I will lookup for that tomorrow
15:35 < Brandon> Going to sleep, I leave in Paris and it is 22:35 for me (woke up at 6am)
15:35 < Brandon> Will update my topic if anything new
15:35 < Brandon> *live in
15:36 < Brandon> See you all ;)
15:38 -!- Brandon [52e28040@gateway/web/freenode/ip.82.226.128.64] has quit [Quit: Page closed]
15:44 -!- BenC[UK] [~bcummins@cpc2-lock3-2-0-cust77.6-1.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
15:44 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
15:48 -!- jeev [1004@216.59.33.80] has joined #openvpn
15:48 -!- jeev [1004@216.59.33.80] has quit [Changing host]
15:48 -!- jeev [1004@unaffiliated/jeev] has joined #openvpn
16:02 -!- BenC[UK] [~bcummins@cpc2-lock3-2-0-cust77.6-1.cable.virginmedia.com] has joined #openvpn
16:06 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has quit [Ping timeout: 240 seconds]
16:06 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
16:13 <@vpnHelper> RSS Update - forum: OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html>
16:21 -!- RyanP [~RyanP@unaffiliated/ryanp] has joined #openvpn
16:25 <@vpnHelper> RSS Update - forum: WIN XP SP3 -Connected but cannot ping, but WIN 7 works fine. <http://forums.openvpn.net/topic9003.html#p17406>
16:28 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
16:47 -!- mmbeck [mmbeck@home.akausal.de] has joined #openvpn
16:48 < mmbeck> is there a way to bind to a device instead of a specific host name or ip? the interface i need to bind to gets its ip via dhcp
16:52 < krzie> you can just not put an address (or use 0.0.0.0)
16:52 < krzie> and it will bind to ALL
16:52 < krzie> but a specific device only, no
16:52 < krzie> could do all then firewall it to only the one you want
16:53 < mmbeck> so i waste a port on all 9 interfaces instead of only on eth0.6 where the tunnel is actually established :(
16:54 < krzie> or mod the code... correct
16:54 < mmbeck> .oO(ferm.conf is already 93 lines long \o/)
16:56 < krzie> with comments im sure
16:56 < mmbeck> ok, only 63 without comments
16:57 < krzie> thats more than ive ever seen, by A LOT
16:58 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has joined #openvpn
16:59 < mmbeck> guess why i'm so glad to increase that number
16:59 -!- brushbox [~brushbox@174.24.233.220.static.exetel.com.au] has quit [Client Quit]
17:02 < krzie> no
17:04 < mmbeck> that wasn't meant to be understood literally
17:05 < EugeneKay> You could bind to one IP and then DNAT it
17:08 < mmbeck> interesting idea
17:10 -!- novaflash is now known as novaflash_away
17:17 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
17:19 -!- vpopov [~happylife@212.92.145.7] has quit [Ping timeout: 258 seconds]
17:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:28 -!- happylife [~happylife@212.92.145.7] has joined #openvpn
17:44 -!- dazo is now known as dazo_afk
18:02 <@vpnHelper> RSS Update - forum: Routing/Gateway Issue <http://forums.openvpn.net/topic9197.html>
18:03 -!- BenC[UK] [~bcummins@cpc2-lock3-2-0-cust77.6-1.cable.virginmedia.com] has left #openvpn []
18:12 -!- Denial [Denial@drgi.co.uk] has quit []
18:21 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:22 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
18:32 -!- MatToufoutu [~MaT@unaffiliated/mattoufoutu] has joined #openvpn
18:32 < MatToufoutu> !goal
18:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:33 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
18:34 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:37 < MatToufoutu> hello
18:37 < MatToufoutu> is it possible to have a single openvpn instance listen on multiple ports?
18:47 < krzie> no
18:48 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:55 < Olipro> MatToufoutu: separate config files
19:22 -!- Chokesmaster_ [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has joined #openvpn
19:25 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has quit [Ping timeout: 260 seconds]
19:26 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has joined #openvpn
19:26 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:27 -!- Chokesmaster_ [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has quit [Ping timeout: 252 seconds]
19:32 -!- _julian_ [~quassel@hmbg-5f77d9e1.pool.mediaWays.net] has joined #openvpn
19:35 -!- _julian [~quassel@hmbg-4d06cc6b.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
19:44 <@vpnHelper> RSS Update - forum: OpenVPN client for the iPhone and iPad <http://forums.openvpn.net/topic4568.html#p17408>
19:54 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
19:54 < vpnuser> help I am on dpi and openvpn traffic is dropped
19:59 -!- vpnuser [775d3322@gateway/web/freenode/ip.119.93.51.34] has left #openvpn []
20:23 -!- master_of_master [~master_of@p57B54E40.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:38 <@vpnHelper> RSS Update - forum: [Help] Secure or Not? <http://forums.openvpn.net/topic9168.html#p17409>
20:41 -!- rfxn [~ryanm84@bas1-montreal54-1279375707.dsl.bell.ca] has joined #openvpn
20:42 < rfxn> can openvpn handle pptp connections (i.e from mobile devices)
20:43 < krzie> !pptp
20:43 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to read
20:43 <@vpnHelper> about why to not use pptp or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
20:43 < krzie> !notcompat
20:43 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible or (#2) openvpn only connects to openvpn
21:08 <@vpnHelper> RSS Update - forum: Best practices in storing OpenVPN keys / passwords? <http://forums.openvpn.net/topic9125.html#p17410>
21:14 <@vpnHelper> RSS Update - forum: Best practice for assigning IP addresses in private tunnels? <http://forums.openvpn.net/topic9126.html#p17411>
21:16 -!- corretico [~luis@201.201.44.82] has joined #openvpn
21:18 -!- adolfomaltez [~taro@190.62.214.80] has joined #openvpn
21:22 -!- Blue_Ice [~Blue_Ice@sid.dupas.be] has quit [Read error: Operation timed out]
21:23 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
21:23 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:24 -!- Blue_Ice [~Blue_Ice@unaffiliated/blue-ice/x-2052838] has joined #openvpn
21:43 -!- master_of_master [~master_of@p57B53B4D.dip.t-dialin.net] has joined #openvpn
21:47 -!- Bartzy [~bar@82.166.200.207] has quit [Ping timeout: 256 seconds]
21:49 -!- adolfomaltez [~taro@190.62.214.80] has quit [Ping timeout: 248 seconds]
21:56 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
22:29 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has quit []
22:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:45 <@vpnHelper> RSS Update - forum: Too much log noise <http://forums.openvpn.net/topic9176.html#p17412>
23:04 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
23:09 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has joined #openvpn
23:09 -!- Olipro [~Olipro@20014C480100019B0000000000000000.access.pool.telekom.hu] has quit [Changing host]
23:09 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:11 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [K-Lined]
23:14 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
23:17 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:20 -!- RaveMaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:25 -!- RaveMaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
23:28 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
23:32 -!- ravemaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:38 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 240 seconds]
23:49 < ravemaster> openvpn traffic is being detected and dropped.  
23:52 -!- attila_lendvai [~attila_le@81.211.133.50] has joined #openvpn
23:52 -!- attila_lendvai [~attila_le@81.211.133.50] has quit [Changing host]
23:52 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
23:52 < WebDawg> ravemaster, ?
23:53 < ravemaster> WebDawg: my openvpn traffic is being detected thru deep packet inspection and its dropped, how can I prevent this.
23:54 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Read error: Connection reset by peer]
23:55 < WebDawg> deep packet?
23:55 < WebDawg> Should only see an SSL connection.
23:55 < WebDawg> Try tcp/udp or tunnel the openvpn connection out through SSH or something.
23:55 < WebDawg> A tunnel within a tunnel.
23:55 -!- zu [~zu@ks387228.kimsufi.com] has quit [Read error: Operation timed out]
23:56 -!- gardar [~gardar@gardar.net] has quit [Read error: Operation timed out]
23:57 -!- gardar [~gardar@gardar.net] has joined #openvpn
23:57 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
23:58 < ravemaster> WebDawg: I am only familiar with openvpn. Can you provide me information about this tunnel within a tunnel that you say SSH or something?
23:58 -!- gardar [~gardar@gardar.net] has joined #openvpn
23:58 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
23:58 < WebDawg> http://en.wikipedia.org/wiki/Tunneling_protocol
23:58 <@vpnHelper> Title: Tunneling protocol - Wikipedia, the free encyclopedia (at en.wikipedia.org)
23:58 < WebDawg> http://www.howtoforge.com/reverse-ssh-tunneling
23:58 <@vpnHelper> Title: Reverse SSH Tunneling | HowtoForge - Linux Howtos and Tutorials (at www.howtoforge.com)
23:59 -!- gardar [~gardar@gardar.net] has joined #openvpn
23:59 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
23:59 < WebDawg> Works both ways.
23:59 < WebDawg> http://www.nocrew.org/software/httptunnel.html
23:59 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
23:59 <@vpnHelper> Title: GNU httptunnel (at www.nocrew.org)
23:59 -!- gardar [~gardar@gardar.net] has joined #openvpn
23:59 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
23:59 < WebDawg> http://www.laboit.net/2009/05/15/implement-a-http-tunnel-on-a-linux-server/
23:59 <@vpnHelper> Title: Implement a HTTP tunnel on a Linux server » Labo IT (at www.laboit.net)
23:59 < WebDawg> etc
--- Day changed Thu Nov 10 2011
00:00 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:00 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
00:00 < ravemaster> what do I need here? do I need to install a ssh server?
00:00 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:00 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
00:01 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:01 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
00:01 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
00:01 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:01 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
00:02 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Read error: Operation timed out]
00:02 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
00:02 -!- gardar_ [~gardar@gardar.net] has quit [Excess Flood]
00:02 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:02 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
00:02 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 252 seconds]
00:03 < EugeneKay> MatToufoutu - you can use iptables to port-forward, but OpenVPN itself will only listen on a single address:port(or all addresses, one port)
00:03 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:03 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
00:03 -!- SJrX [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
00:04 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:04 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
00:04 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:05 < EugeneKay> ravemaster - the typical solutions to deep-packet-inspection avoidance are: UDP:443, UDP:53, TCP:443.
00:05 < EugeneKay> You /could/ do it over a SSH tunnel, but that's gonna be a buncha overhead
00:06 < ravemaster> Yes, Webdawg awhile ago gave me some reading and I am reading and studying them right now.  
00:06 < ravemaster> EugeneKay, can you also provide me input how this ssh tunnel can be setup and done
00:06 < EugeneKay> Where are you / what provider is doing this filtering?
00:06 <@vpnHelper> RSS Update - forum: phonic <http://forums.openvpn.net/topic9198.html>
00:06 < EugeneKay> Nope, I avoid tunneling traffic over SSH like the plague.
00:06 < ravemaster> my ISP is doing this filtering
00:07 < ravemaster> I cant use my openvpn if the openvpn traffic is under DPI
00:07 < WebDawg> You can get anything out.
00:08 < WebDawg> Its just how slow you want it to go.
00:08 < EugeneKay> What ISP? :-p
00:08 < WebDawg> Can have it going I mean.
00:09 < ravemaster> the smart comm. isp
00:12 < ravemaster> I really need assistance guys. I have no idea on tunnel inside tunnel.
00:12 < ravemaster> though yes I am reading the link WEbdawg gave me
00:16 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has joined #openvpn
00:16 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has quit [Changing host]
00:16 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
00:17 < WebDawg> ravemaster, what os's are you using?
00:18 < ravemaster> i have server on centos and client on windows
00:20 < WebDawg> hmm
00:21 < WebDawg> You would want to make a ssh server on centOS.
00:21 < WebDawg> See.
00:21 < WebDawg> You need to secure that shit.
00:21 < WebDawg> Its real late here man.
00:26 -!- ravemaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit []
00:44 -!- smw [~smw@unaffiliated/smw] has quit [Read error: Connection reset by peer]
01:47 -!- Bartzy [~bar@82.166.200.207] has joined #openvpn
01:48 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
01:52 -!- Bartzy [~bar@82.166.200.207] has quit [Ping timeout: 240 seconds]
02:18 < MatToufoutu> EugeneKay, ok, thank you
02:20 -!- jemand [~quassel@brln-4dbc58b2.pool.mediaWays.net] has joined #openvpn
02:21 -!- novaflash_away is now known as novaflash
02:22 -!- Druid_ [~Druid@p5B136519.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
02:27 -!- Druid_ [~Druid@p5B05DAE8.dip.t-dialin.net] has joined #openvpn
02:30 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
02:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
02:47 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:58 -!- dxtr [d389af79@host-88-80-29-36.cust.prq.se] has quit [Changing host]
02:58 -!- dxtr [d389af79@unaffiliated/dxtr] has joined #openvpn
03:09 -!- jemand [~quassel@brln-4dbc58b2.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
03:12 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
03:14 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
03:16 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
03:18 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
03:27 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:27 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:27 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:49 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:49 -!- mode/#openvpn [+v s7r] by ChanServ
04:04 -!- batrick [~batrick@nmap/developer/batrick] has quit [Ping timeout: 258 seconds]
04:05 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
04:13 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
04:13 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
04:15 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
04:21 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
04:22 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
04:24 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has quit [Ping timeout: 248 seconds]
04:29 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
04:30 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
04:34 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 260 seconds]
04:53 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
05:15 -!- Bartzy [~bar@82.166.200.207] has joined #openvpn
05:17 -!- dxtr [d389af79@unaffiliated/dxtr] has quit [Quit: Reconnecting]
05:17 -!- dxtr [45aa3c32@host-88-80-29-36.cust.prq.se] has joined #openvpn
05:21 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has joined #openvpn
05:22 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Read error: Connection reset by peer]
05:24 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has joined #openvpn
05:24 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has quit [Changing host]
05:24 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
05:40 -!- orange-hand-II [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
05:42 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Ping timeout: 248 seconds]
05:43 -!- noromamai [~noromamai@i206070.upc-i.chello.nl] has joined #openvpn
05:46 < noromamai> hi. i am trying to set up an openvpn server (*duh*) using bridging, but have run into a snag. everything went smoothly, until creating the bridge. i need to bridge eth1, but it's already bridged (for qemu). can i just use that or do i need to apply some specific magic?
05:53 < Bartzy> Hey
05:53 < Bartzy> anyone here ?
05:54 < noromamai> doesn't like look it, just me and i don't think i can be of much help
05:54 < EugeneKay> Nobody but us rocks.
05:54 < noromamai> heh
05:57 < EugeneKay> Bartzy - FWIW, that shubuntu guy is a total hack, and can be safely ignored
05:57 < Bartzy> EugeneKay: Great, seems like it, thanks
05:57 < Bartzy> EugeneKay: I still have that networking issue :)
05:58 < EugeneKay> It's a routing issue, guarantee it.
05:59 < EugeneKay> !route_outside_openvpn
05:59 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) you do not need this if the vpn node IS the gateway for its lan
06:00 < EugeneKay> !route
06:00 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
06:00 < EugeneKay> There's another one, but I can't remember it off the top of my head
06:00 < EugeneKay> Oh, and that site is down..... great.
06:09 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
06:11 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
06:12 -!- dazo_afk is now known as dazo
06:29 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
06:29 < krzee> hrm odd
06:30 < krzee> ecrist, web problem
06:30 < Bartzy> EugeneKay: I just can't wrap my head around why it doesn't work.
06:31 < krzee> Bartzy, whats the problem...
06:32 < Bartzy> krzee: I have a VPN gateway and anothe rhost
06:32 < Bartzy> both are connected to my internal LAN of 192.168.128.0/17
06:32 < Bartzy> on eth0
06:32 < Bartzy> the VPN gateway has a tun0 interface with a 10.55.66.1 address
06:33 < Bartzy> when I try to ping host-2 from the VPN gateway, it works (using the private segment)
06:33 < Bartzy> private=internal LAN
06:33 < dym> I use the private segment too
06:33 < krzee> whats each ones LAN ip, for easier discussing of them
06:33 < dym> Mostly on weekends.
06:33 < Bartzy> when I try to ping host-2 from the VPN gateway with the 10.55.66.1 (tun0) address, it doesn't work, host-2 doesn't even get the ICMP request
06:33 < Bartzy> I use ping -I 10.55.66.1 192.168.178.86 
06:33 < Bartzy> OK: 
06:34 < krzee> oh ok, is this the only host you need to tlk to from the vpn?
06:34 < Bartzy> host-2 eth0: 192.168.178.86
06:34 < krzee> talk*
06:34 < Bartzy> VPN gateway tun0: 10.55.66.1
06:34 < krzee> do you need the whole lan working or the single host?
06:34 < Bartzy> VPN gateway eth0: 192.168.191.72
06:34 < Bartzy> whole LAN
06:34 < Bartzy> it's just an example
06:34 < krzee> ok
06:34 < krzee> so you need to do this:
06:34 < Bartzy> I have many hosts on the internal network
06:35 < krzee> on your LAN router, you must add a route for 10.55.66.0 to use 192.168.191.72 as the gateway
06:35 < Bartzy> I don't have a LAN router, it's out of my control...
06:35 < krzee> which is what !route_outside_ovpn would tell you, if it were not down
06:35 < Bartzy> I can only add routes for each host
06:36 < krzee> oh ok, then you must do the annoying workaround which i put in !route (also down at the moment)
06:36 < Bartzy> which is tedious, but a must (I don't have access to my router :()
06:36 < Bartzy> br.
06:36 < Bartzy> brb.
06:36 < krzee> oh ok sounds like you know it
06:36 < krzee> same route, but on each lan machine
06:39 < Bartzy> OK, but I have a different issue!
06:39 < Bartzy> the ICMP requests aren't even getting into host-2
06:39 < Bartzy> I used tcpdump on host-2 to check it
06:39 < Bartzy> they go out the VPN gateway, but not getting into host-2.
06:39 < Bartzy> the route is not there, but even if it isn't, the request should get through :(
06:39 < krzee> firewall
06:40 < krzee> assuming all machines have the same friggen weird subnet
06:40 < krzee> (why the hell you using /17 anyways?)
06:42 -!- bauruine [~stefan@tuxli.ch] has joined #openvpn
06:42 < krzee> gunna have over 32000 hosts on the same lan?  :-p
06:43 < Bartzy> krzee: Not me, my provider uses it
06:43 < Bartzy> no firewall!
06:43 < krzee> if so may i suggest breaking up the broadcast domain a lil ;]
06:43 < krzee> firewall!
06:43  * krzee points @ topic
06:44 -!- bauruine [~stefan@tuxli.ch] has quit [Remote host closed the connection]
06:45 -!- bauruine [~stefan@gprs27.swisscom-mobile.ch] has joined #openvpn
06:46 < Bartzy> krzee: But I don't have a firewall on host-2
06:47 < krzee> something is blocking your icmp packets
06:47 < krzee> and its something unrelated to openvpn
06:47 < krzee> as you pointed out it doesnt need a return route to RECIEVE the packets
06:48 < krzee> so you can call it whatever you want, i call it a firewall
06:48 < krzee> either way, find it and stop it
06:48 < krzee> (or fix it)
06:51 -!- nachos [~nnscript@CPE-143-238-36-82.lnse1.win.bigpond.net.au] has joined #openvpn
06:52 < nachos> Hi, When trying to connect to a socks server ( SSH in -D mode ) I get a read error right after the connection is established. Anyone heard of this before?
06:52 < Bartzy> krzee: I will investigate further, thanks!
06:52 < nachos> I'll pull up the logs
06:52 < krzee> Bartzy, yw
06:53 < krzee> nachos, you trying to use udp for the vpn?
06:53 < krzee> real socks servers may do udp, but ssh's built in does not
06:53 < nachos> oh thats why
06:53 < krzee> yw ;]
06:53 < nachos> thats not good, thanks krzee
06:53 < nachos> im trying to tunnel out of my university.
06:54 < krzee> sounds like prison
06:54 < nachos> haha yeah
06:54 < nachos> so ssh doesnt offer UDP at all?
06:55 < nachos> pretty interesting
06:55 < krzee> ya its in their manual
06:55 < nachos> maybe if I do OpenVPN over PPP over SSH
06:55 < nachos> oh thanks
06:55 < krzee> oh hell no
06:55 < krzee> try a real socks server
06:55 < krzee> !sockd
06:55 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
06:55 < krzee> oh wait
06:56 < krzee> thats no good either
06:56 < krzee> cause ovpn doesnt do socks auth
06:56 < krzee> and you want the socks on the outside
06:56 < nachos> yeah
06:56 < nachos> yeah ive got a funny problem
06:56 < krzee> why do you even need to use socks?
06:56 < krzee> you sure you cant get out directly to openvpn...
06:56 < krzee> ?
06:56 < krzee> your uni doesnt even allow DNS to a 3rd party server?
06:56 < nachos> nah ive got problems with udp, i can tcp vpn out but not udp
06:56 < krzee> try this:
06:56 < krzee> nslookup ircpimps.org 8.8.8.8
06:57 < nachos> doesnt work
06:57 < nachos> oh wait, it does on another server
06:57 < nachos> one server has nslookup removed
06:57 < krzee> why answer before listening?
06:57 < nachos> to secure it
06:57 < krzee> (and testing)
06:57 < krzee> nslookup was deemed a security risk?
06:58 < nachos> yeah
06:58 < nachos> i got no idea
06:58 < krzee> but how and why!?
06:58 < nachos> there is no nc
06:58 < krzee> it does not need suid
06:58 < nachos> i got no idea
06:58 < krzee> just toss on a precompiled binary of it
06:59 < nachos> yeah that'll work
06:59 < krzee> static build of course
06:59 < nachos> what port does OpenVPN traffic run on
06:59 < krzee> whatever port you tell it to
06:59 < nachos> like 443 or whatever
06:59 < krzee> udp 53 might be a good one to try
06:59 < nachos> yeah i think so
06:59 < nachos> trick it into thinking its dns
07:00 < krzee> wont be tricking anything
07:00 < krzee> but most admins would just leave the whole port open if allowing it
07:00 < nachos> yeah
07:00 < krzee> as opposed to checking whats going through
07:06 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
07:08 -!- noromamai [~noromamai@i206070.upc-i.chello.nl] has left #openvpn []
07:10 < nachos> krzee: i have a bizzare problem
07:10 < nachos> i setup deelgate socks5 on it
07:10 < nachos> and everything is fine, udp connects everything is great all authenticated
07:11 < nachos> then there is absolutley no traffic on the line and the connection times out
07:19 < nachos> on port 443
07:19 < nachos> I dont get it at all
07:21 < Olipro> firewall?
07:21 < ecrist> krzee: ?
07:22 < nachos> how can it be, all the authentication was over 443... it should still work
07:26 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
07:29 <@vpnHelper> RSS Update - forum: OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17444> || OpenVPN-AS - Ubuntu - Bridging <Help! Need by Saturday> <http://forums.openvpn.net/topic9188.html#p17443> || Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html#p17442> || client-connect command failed <http://forums.openvpn.net/topic9186.html#p17440> || Confused by my results <http://forums.openvpn.ne
07:29 < ecrist> EugeneKay: that site is back online
07:31 < ecrist> although extremely slow
07:37 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17446> || Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html#p17445>
07:37 < ecrist> ok, it's behaving properly now
07:38 -!- _julian_ [~quassel@hmbg-5f77d9e1.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
07:39 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
07:39 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
07:39 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
07:39 < krzee> ecrist, web is down
07:39 < krzee> SCN
07:40 < ecrist> no it's not
07:40 < krzee> ok cool
07:40 < krzee> was ;]
07:42 < ecrist> yeah
07:42 < ecrist> kernel panic
07:44 < nachos> what do you think about my problem krzee?
07:45 < krzee> sucks your school is filtering outbound, glad i didnt do that organized uni BS
07:46 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
07:46 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
07:47 < nachos> yeah its crap as
07:47 <@vpnHelper> RSS Update - forum: Double bridging possible or reuse existing bridge? <http://forums.openvpn.net/topic9199.html>
07:48 < nachos> im a computerscience student.
07:48 < nachos> does openvpn run on the same port when its connected and when its authenticating
07:50 < krzee> only 1 port, yes
07:52 < nachos> that makes no sense
07:52 < nachos> why does it athenticate
07:52 < nachos> then nothing happens after
07:53 < krzee> firewall on tun device
07:53 < nachos> how does that work
07:54 < bjorneven> i ran my own cloud server hosting on uni network
07:54 < nachos> how can the firewall detect its a tun device
07:54 < krzee> nachos, read FIREWALL section of the manual, look specifically for all instances of tun+
07:54 < nachos> okay
07:59 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Remote host closed the connection]
08:01 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:03 -!- acdef [~robott@208.111.39.186] has joined #openvpn
08:04 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:12 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
08:14 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:16 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:24 < Bartzy> krphop: ?
08:24 < Bartzy> sorry.
08:24 < Bartzy> krzee: ?
08:34 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Ping timeout: 258 seconds]
08:42 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
08:50 -!- orange-hand-II is now known as orange-hand
09:09 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
09:11 <@vpnHelper> RSS Update - forum: OpenVPN Client Program customization <http://forums.openvpn.net/topic9200.html>
09:13 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Ping timeout: 240 seconds]
09:15 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
09:16 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Remote host closed the connection]
09:20 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
09:22 -!- iplux [~textual@br-sh-1.sceur.ch] has joined #openvpn
09:26 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Ping timeout: 240 seconds]
09:32 < Bartzy> Hi
09:32 < Bartzy> I'm doing NAT, I see that the packets are going through (by using tcpdump), but I don't get the answer back to the client.
09:32 < krzie> why NAT?
09:33 < Bartzy> krzie: Cause my provider (of the dedicated servers) is blocking all communications not from a specific set of IPs
09:33 < Bartzy> so I must use NAT :(
09:34 < Bartzy> krzie: You are krzee ? :)
09:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
09:36 < krzie> i am
09:37 < Bartzy> krzie: So that "firewall" you talked about? That's my provider blocking.. 
09:38 < Bartzy> and since I can't change that, I'll use NAT.. but any idea what's the problem?
09:38 < Bartzy> Now I see
09:38 < Bartzy> sorry
09:38 < Bartzy> Now I see the ICMP packets everywhere, but my actual client isn't getting the response.
09:42 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
09:42 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
09:44 < krzie> something in your firewall, thats all i know ;]
09:44 -!- zxzxzxzxzx [4fad8a26@gateway/web/freenode/ip.79.173.138.38] has joined #openvpn
09:44 -!- zxzxzxzxzx [4fad8a26@gateway/web/freenode/ip.79.173.138.38] has left #openvpn []
09:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- countd [~countd@unaffiliated/countd] has joined #openvpn
09:47 <@vpnHelper> RSS Update - forum: OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17450> || Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html#p17449>
09:50 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
09:53 <@vpnHelper> RSS Update - forum: [Mac OSx Lion - lladdr problem] <http://forums.openvpn.net/topic9201.html>
09:53 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
09:54 < Bartzy> krzie: But I see the requests and replies in tcpdump
09:54 < Bartzy> but it's not being translated back to the client's IP.
09:56 < krzie> then its your nat rule... which is in your firewall
09:56 < krzie> regardless, its your firewall
09:57 < krzie> (and not openvpn)
09:58 < Bartzy> krzie: What's MASQUERADE means ?
09:58 < krzie> !notovpn
09:58 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
09:58 <@vpnHelper> RSS Update - forum: Double bridging possible or reuse existing bridge? <http://forums.openvpn.net/topic9199.html#p17452> || Mac OSx Lion - lladdr problem <http://forums.openvpn.net/topic9201.html>
10:00 < Bartzy> krzie: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
10:00 < Bartzy> That means that all the traffic meant to go through eth0 and doesn't have eth0 IP as source IP will have it as source IP ?
10:00 < Bartzy> and will be translated back to the original IP when back ?
10:01 < Bartzy> Can I filter that better? iptables -t nat -A POSTROUTING -s 10.55.66.0/24 -d 192.168.128.0/17 -o eth0 -j MASQUERADE
10:01 < Bartzy> ?
10:03 < krzie> im not sure how i can possibly be more clear about this not being an openvpn issue... but feel free to keep trying
10:03 < krzie> im sure a linux firewall guru will be around sometime
10:03 < krzie> (but its not me)
10:04 < krzie> of course in THEIR help channel i bet they'll be around sooner, but your question is certainly not offtopic so go ahead and hope for it here if you like
10:04 <@vpnHelper> RSS Update - forum: Mac OSx Lion - lladdr problem <http://forums.openvpn.net/topic9201.html#p17454>
10:06 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
10:07 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:07 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
10:07 -!- bauruine [~stefan@gprs27.swisscom-mobile.ch] has quit [Read error: Connection reset by peer]
10:09 <@vpnHelper> RSS Update - forum: Mac OSx Lion - lladdr problem <http://forums.openvpn.net/topic9201.html#p17455>
10:15 <@vpnHelper> RSS Update - forum: Mac OSx Lion - lladdr problem <http://forums.openvpn.net/topic9201.html#p17456>
10:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:25 -!- p0ckets [~jkuan@207.6.38.69] has joined #openvpn
10:27 <@vpnHelper> RSS Update - forum: [RESOLVED]Routing/Gateway Issue <http://forums.openvpn.net/topic9197.html#p17457>
10:34 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:38 -!- Bartzy [~bar@82.166.200.207] has quit [Ping timeout: 240 seconds]
10:40 -!- Bartzy [~bar@82.166.200.207] has joined #openvpn
10:41 -!- p0ckets [~jkuan@207.6.38.69] has quit [Quit: Lost terminal]
10:44 -!- iplux [~textual@br-sh-1.sceur.ch] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
11:03 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
11:10 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html#p17458>
11:16 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
11:18 < orange-hand> Hi, is it possible to restrict usage of the VPN adaptor per-application?
11:18 < orange-hand> I want to have multiple VPN client adaptors, and have different applications use different VPN servers
11:18 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 260 seconds]
11:20 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
11:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
11:25 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 256 seconds]
11:27 < ecrist> orange-hand: sure, with a firewall or other software
11:27 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html#p17459>
11:27 < ecrist> it's not something openvpn does on it's own, though
11:27 -!- UnterPerro [~UnterPerr@131.94.186.10] has joined #openvpn
11:28 -!- guy__ [407212dd@gateway/web/freenode/ip.64.114.18.221] has joined #openvpn
11:28 < orange-hand> ecrist, is it possible to set permissions on the adaptor?
11:28 < orange-hand> and then bind the application to the adaptor?
11:29 < krzie> routing tables work based on routes, not applications
11:30 < krzie> theres a way to route by app (using socks and an app to redirect traffic through socks or not)  but even then you only get to use 1 exit server, not multiple
11:30 < krzie> so no
11:30 < krzie> well as far as i know, no
11:30 < krzie> maybe ecrist knows something else
11:31 < guy__> I've been trying to route traffic through a vpn I have set up but haven't been able to get it going. Does redirect-gateway def1 work with a static key?
11:31 < orange-hand> does socket binding to the adaptor not route through it?
11:32 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has joined #openvpn
11:32 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has quit [Changing host]
11:32 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
11:33 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 256 seconds]
11:50 <@vpnHelper> RSS Update - forum: OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17460>
11:51 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:03 -!- acdef [~robott@208.111.39.186] has quit [Read error: Connection reset by peer]
12:04 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 240 seconds]
12:08 -!- acdef [~robott@208.111.39.186] has joined #openvpn
12:17 < guy__> I've been trying to route traffic through a vpn I have set up but haven't been able to get it going. Does redirect-gateway def1 work with a static key?
12:23 -!- guy__ [407212dd@gateway/web/freenode/ip.64.114.18.221] has left #openvpn []
12:31 <@vpnHelper> RSS Update - forum: OpenVPN Client Program customization <http://forums.openvpn.net/topic9200.html#p17461>
12:32 < ecrist> orange-hand: openvpn doesn't do what you're trying to
12:36 < orange-hand> ecrist, any suggestions on something that does?
12:37 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
12:38 < stevefink> if I want to have a machine on the same subnet as the OpenVPN box be able to reach a client machine - where in the documentation should I be looking?
12:41 < ecrist> nope
12:42 -!- UnterPerro [~UnterPerr@131.94.186.10] has quit [Quit: UnterPerro lives to save another day]
12:44 <@raidz> ecrist: can you hop into #openvpn-devel
12:48 < stevefink> I added a route to the VPN subnet on a machine behind OpenVPN's subnet, but it still cannot reach clients. Hmm.
12:48 < stevefink> The OpenVPN box has no problem getting to the client.
12:51 < ecrist> sure raidz 
12:54 -!- Bartzy [~bar@82.166.200.207] has quit [Ping timeout: 245 seconds]
13:15 -!- Bartzy [~bar@82.166.200.207] has joined #openvpn
13:19 < krzie> stevefink, 
13:19 < krzie> !goal
13:19 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:19 < krzie> i dont understand what you're asking about...
13:23 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
13:26 < SviMik> hi all. does anybody know, how to make max-routes-per-client unlimited, and why routes are never expired?
13:27 < SviMik> I used max-routes-per-client 4096, but table got full in 5 days, and new clients on that network was not able to connect with another network
13:27 < SviMik> I use VPN server to bridge several networks with many clients
13:28 < krzie> you think operating systems can have unlimited routes?
13:28 < SviMik> no. but it is not OS problem - I mean internal openvpn routes
13:28  * Essobi ROUTES ALL TEH NETW0RKS!
13:28 < SviMik> the ROUTING TABLE in status file
13:28 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
13:29 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
13:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:29 -!- mode/#openvpn [+v Axeman] by ChanServ
13:29 < krzie> routing table in status file!?!?
13:29 < krzie> what you talkin bout willis
13:29 < SviMik> status openvpn-status.log
13:29 < SviMik> OpenVPN CLIENT LIST
13:29 < SviMik> Updated,Thu Nov 10 23:28:40 2011
13:29 < SviMik> Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
13:29 < SviMik> ....
13:29 < SviMik> ROUTING TABLE
13:29 < SviMik> Virtual Address,Common Name,Real Address,Last Ref
13:30 < SviMik> ...
13:30 -!- SviMik was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
13:30 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
13:30 < SviMik> so there I can see:
13:30 < SviMik> ROUTING TABLE
13:30 < SviMik> Virtual Address,Common Name,Real Address,Last Ref
13:30 < SviMik> 00:ff:51:44:9b:cc,br12,213.229.74.111:54193,Thu Nov 10 23:22:31 2011
13:30 < SviMik> 00:ff:f1:39:42:49,br10,188.64.170.188:47696,Thu Nov 10 23:28:39 2011
13:30 < krzie> oh, i dont deal with bridges, sry
13:31 < SviMik> and I see for example, that one of clients having 2048 records (after I configured max-routes-per-client 2048). and I need to restart openvpn server to cleanup this table
13:32 < krzie> you obviously out-grew a tap/bridge setup anyways
13:33 < SviMik> now I configured it to 4096, but it is not a solution. this table is growing every day, and old records are never cleaned up
13:34 < SviMik> so I need anyway to restart the server, soon or later...
13:34 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
13:34 < krzie> or stop using tap
13:34 < krzie> since you obviously outgrew it
13:35 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
13:35 -!- mode/#openvpn [+o raidz] by ChanServ
13:35 < SviMik> cron2 dazo mattock - anybody know about this (bug?) with (absence?) mechanism to clean up this table? should I write a bugreport?
13:36 < SviMik> krzie how to bridge few networks (at level 2) without tap? :)
13:37 < SviMik> I need a transparent bridge, as it would be connected with a cable
13:37 < krzie> why do you need a bridge?
13:38 < SviMik> *layer 2
13:38 < krzie> *WHY*
13:38 <@dazo> SviMik: I haven't read too carefully ... but quick glance tells me that it's the internal routing table in OpenVPN you're talking about ... and iirc, we've added a new feature in the development snapshot ... --stale-routes-check
13:38 < krzie> not *what*, but *why*
13:38 < krzie> !snapshots
13:39 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
13:39 <@dazo> SviMik: This is the patch http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=commit;h=3a957aaef3ae512b217dd475a846a0ea35aae49c
13:39 <@vpnHelper> Title: SourceForge - openvpn/openvpn-testing.git/commit (at openvpn.git.sourceforge.net)
13:41 <@dazo> SviMik: please try to test this one on your server ... and see if that helps it
13:41 < SviMik> krzie some programs for local network are not working otherwise. is it enough explanation?
13:41 <@dazo> SviMik: krzie will ask: Which programs?
13:42 <@dazo> SviMik: if it's programs which depends on broadcast traffic, then it's fine ... but if it's because of routes or such things .... bridging and TAP devices are more trouble than salvation
13:44 < SviMik> yes, some programs use broadcast traffic for other users discovery, for example
13:45 < krzie> actually
13:45 < krzie> thats too many broad answers in a row for me to care
13:45  * krzie wanders off
13:46 < reiffert> to?
13:46 < reiffert> towards?
13:46 < krzie> to germany to share a beer with reif and bush!
13:46 < reiffert> ah :)
13:46 < reiffert> Think that I should have some free time from dec 20th until jan 1th
13:46 < reiffert> st
13:56 -!- JGAN [d8e27f78@gateway/web/freenode/ip.216.226.127.120] has joined #openvpn
13:57 -!- axelm7 [~axelm7@186.135.10.55] has joined #openvpn
13:57 < JGAN> hello
13:57 < axelm7> hi
13:58 < JGAN> does anybody know of any good openvpn tutorials using e
13:58 < JGAN> webmin*
13:58  * JGAN is on an ipad... cant type <_<
13:59 < SviMik> my webmin does not support openvpn... at least, I can't see openvpn in menu there
14:00 < JGAN> its a 3rd party module
14:00 < JGAN> you have to install openvpn using terminal
14:00 < axelm7> I have a centos 5.7 box running openvpn behind my corporate firewall. At home I have a ddwrt router running openvpn client. NAT is disabled on the openvpn client. MY problem is that my pcs that are behind my home router are not able to connect or ping to any ip on the company network. can someone help me figyre out this routing / firewall issue?
14:00 < JGAN> and then add the module manually
14:01 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 260 seconds]
14:01 < JGAN> SviMik i can show you how to add the module, but idk how to set it up
14:01 < SviMik> I configured openvpn manually, so I don't need it anymore :)
14:03 < JGAN> oh ok haha
14:04 < JGAN> so
14:04 < JGAN> i actually found one tut
14:04 < JGAN> but i got to the point h
14:04 < JGAN> where i do 
14:05 < JGAN> hrllo jdsaf
14:05 < JGAN> lsdjila
14:05 < JGAN> lolz
14:05 < JGAN> im at school
14:05 < JGAN> and getting harassed sorry xD
14:05 < JGAN> anyways
14:05 < JGAN> when i do push "route ip_address"
14:05 < JGAN> what do i put in for the address?
14:06 -!- JGAN [d8e27f78@gateway/web/freenode/ip.216.226.127.120] has quit [Quit: Page closed]
14:08 <@vpnHelper> RSS Update - forum: [Resolved] Routing/Gateway Issue <http://forums.openvpn.net/topic9197.html#p17457>
14:11 -!- JGAN [~JGAN@128.151.71.71] has joined #openvpn
14:11 < JGAN> ok back sorry
14:11 < JGAN> does anybody know?
14:12 < SviMik> JGAN I found screensots of this module, I think it is more complicated than manual configuration
14:13 < JGAN> what do you mean?
14:14 <@dazo> JGAN: please go learn a bit more about basic TCP/IP networking first ... then you will surely understand what the 'route' feature is and which IP address to go in there
14:14 <@dazo> !tcpip
14:14 <@vpnHelper> RSS Update - forum: OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17462>
14:14 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
14:14 < SviMik> it is easier to write configuration file manually in text editor
14:14 <@dazo> JGAN: ... see that chapter
14:14 < SviMik> in webmin there are many fields which you probably will newer need
14:14 <@dazo> SviMik: true ... if you know something about networking to start with
14:14 < JGAN> ok thanks dazo
14:15 <+hyper_ch> hi dazo
14:15 <@dazo> JGAN: it's not to be mean or nasty to you ... but your question is a bit like "What's this gas pedal I have in my car?"
14:15 < SviMik> *never
14:17 <@dazo> JGAN: and to setup a VPN ... you do need to know a bit of networking basics to be able to set it up
14:18 <@dazo> hyper_ch: hey!
14:18 < JGAN> :P
14:18 < JGAN> haha
14:19 <+hyper_ch> [21:17] <dazo> JGAN: and to setup a VPN ... you do need to know a bit of networking basics to be able to set it up  --->   LIES!!!!!
14:19 <+hyper_ch> even I managed to get it setup
14:19 <+hyper_ch> but then, I besieged krzie like for a week or so
14:19 <@dazo> hyper_ch: hahaha ... yeah, I'm not falling into that trap ... my time is too precious ;-)
14:20 <@dazo> (and I presume others time here is precious too ;-))
14:20 < SviMik> JGAN just find a tutorial how to setup openvpn without webmin )
14:20 < JGAN> i did
14:20 < JGAN> but i got to the point where they added 
14:20 < JGAN> push "route ip_address"
14:21 <@dazo> oh gee ... what's the next advice from SviMik? ... Download Visual Studio and lets draw a new program?
14:21 < JGAN> and i just didnt know what to do for that
14:21 < JGAN> hey
14:21 < JGAN> i actually know c++
14:21 < JGAN> :D
14:21 < SviMik> :)
14:21 <@dazo> great! :)
14:21 <+hyper_ch> JGAN: you're on linux?
14:21 < JGAN> ubuntu
14:21 <+hyper_ch> and server?
14:22 < JGAN> what?
14:22 < JGAN> ubuntu server? ni
14:22 < JGAN> no*
14:22 <+hyper_ch> on what OS do you want to run the vpn server?
14:22 < JGAN> ubuntu 10.04
14:22 < axelm7> JGAN, in my centos box I have /etc/openvpn/vpnserver.conf. At the end of that file I have push "route 10.200.0.0 255.255.255.0"
14:22 < axelm7> push "route 10.80.0.0 255.240.0.0"
14:23 <+hyper_ch> dazo: anything wrong with just giving him configs?
14:24 <@dazo> hyper_ch: Give a man a hungry man a fish, and he survives one more day .... learn a man to fish, and he will not be hungry so easily
14:25 < axelm7> you should tell that to my government with its unemployment plans giving money for free to about 1 million people
14:25  * dazo likes to educate people ... not to do the quick shortcuts, because then they just come back like helpless addicts
14:25 < JGAN> hey
14:25 < JGAN> i know some basic networkin
14:25 < reiffert> !lart
14:25 < JGAN> so i know that what axelm7 said wont work
14:26 -!- Axeman2 [~Axeman3@198.105.46.46] has joined #openvpn
14:26 -!- Axeman2 [~Axeman3@198.105.46.46] has quit [Changing host]
14:26 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:26 -!- mode/#openvpn [+v Axeman2] by ChanServ
14:26 < SviMik> send a man to google... :D
14:26 <@dazo> JGAN: what do you know about network routing?
14:26 < JGAN> because my internal ip is different
14:26 < axelm7> JGAN, so you are telling me that my own rules down- t work on my network?
14:26 < axelm7> *don't
14:26 < JGAN> they work on yours
14:26 <+hyper_ch> dazo: :) and what if he just wants a kebab?
14:26 < JGAN> but not on mine
14:27 < axelm7> you asked how to push routes and I answered just that
14:27 <@dazo> hyper_ch: then tell him that's unhealthy!
14:27 < axelm7> you obviously have to use your own addresses
14:27 <+hyper_ch> they are not unhealthy... that's what they want to make you believe
14:27 <@dazo> hyper_ch: probably depends on where you get them ;-)
14:28 < JGAN> i asked what ips to use
14:28 < JGAN> ie gateway, router, dns, etc
14:28 <+hyper_ch> I actually read somewhere that the kebabs themselves (bread, meat, other stuff) isn't that bad... but the cocktail (or other dressing) makes it really unhealthy
14:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
14:29 <@dazo> JGAN: http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html ... lookup --route
14:29 <@vpnHelper> Title: OpenVPN 2.2 (at openvpn.net)
14:32 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 240 seconds]
14:32 < JGAN> ???
14:32 < JGAN> now im lost haha
14:32 < JGAN> what just happened xD
14:32 <@dazo> JGAN: what is it you didn't understand?
14:36 < JGAN> what kebabs have to do with anything?
14:37 < JGAN> haha
14:37 <+hyper_ch> kebabs are like 42
14:37 -!- acdef [~robott@208.111.39.186] has quit [Ping timeout: 240 seconds]
14:38 < krzie> [12:19]  <hyper_ch> but then, I besieged krzie like for a week or so
14:38 < krzie> [12:19]  <dazo> hyper_ch: hahaha ... yeah, I'm not falling into that trap ... my time is too precious ;-)
14:38 < krzie> [12:20]  <dazo> (and I presume others time here is precious too ;-))
14:38 < krzie> oh so true
14:38 < krzie> but it takes longer to convince half the people that come in to learn than it does to tell them the problem
14:38 < krzie> in fact the first one is often futile
14:39  * JGAN  ragequits
14:39 < krzie> sometimes i hold out and try to teach, other times im just beaten and give them the answer
14:39 < krzie> mmm kebabs are good
14:40 -!- axelm7 [~axelm7@186.135.10.55] has quit [Ping timeout: 256 seconds]
14:43 < stevefink> do I have to do anything special to have servers behind my OpenVPN subnet reach clients?
14:43 < stevefink> the inverse already works great where clients can reach servers behind the OpenVPN subnet
14:45 < krzie> !route
14:45 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
14:45 < stevefink> thanks krzie, will read this through
14:45 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
14:45 < krzie> yw
14:45 <+novaflash> krzie; hey i skimmed that document and i have more stupid questions that are already answered.
14:45 < krzie> lol
14:45  * krzie kills novaflash 
14:46 <+novaflash> so how's things?
14:46  * novaflash shrugs death off
14:47 < stevefink> krzie: just to make sure this is right, this document talks about client to client communication. i just want a machine on the same subnet as the OpenVPN gateway to speak to one client
14:47 < stevefink> krzie: this is still applicable in that case, correct?
14:48 -!- JGAN_ [~JGAN@128.151.71.71] has joined #openvpn
14:49 < krzie> it will never satisfy your need for a good hand holding
14:50 < krzie> but if you pay attention it will show you how to share lans either behind the server or behind the client, or both
14:50 -!- JGAN_ [~JGAN@128.151.71.71] has quit [Client Quit]
14:51 -!- JGAN [~JGAN@128.151.71.71] has quit [Ping timeout: 260 seconds]
14:51 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:51 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:51 -!- axelm7 [~axelm7@186.135.10.55] has joined #openvpn
15:01 -!- ePlus [~zuma@217.28.10.143] has joined #openvpn
15:01 < ePlus> good evening. n00b here
15:03 -!- Bartzy [~bar@82.166.200.207] has quit [Ping timeout: 256 seconds]
15:03 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
15:09 -!- dazo is now known as dazo_afk
15:15 -!- axelm7 [~axelm7@186.135.10.55] has quit [Ping timeout: 255 seconds]
15:18 -!- axelm7 [~axelm7@186.135.10.55] has joined #openvpn
15:22 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
15:22 < ePlus> i have just installed the openvpn as server
15:23 < ePlus> i can connect fine to it etc
15:23 < ePlus> but how can i create a pkcs12 cert to put on my android phone please?
15:24 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
15:24 -!- axelm8 [axelm7@186.135.10.55] has joined #openvpn
15:27 -!- axelm7 [~axelm7@186.135.10.55] has quit [Ping timeout: 245 seconds]
15:27 -!- axelm7 [~axelm7@186.135.10.55] has joined #openvpn
15:28 -!- axelm8 [axelm7@186.135.10.55] has quit [Ping timeout: 258 seconds]
15:29 <+novaflash> ePlus; report to #openvpn-as please
15:29 <+novaflash> that is
15:29 <+novaflash> if you are talking about openvpn access server
15:29 < ePlus> oh didn't realise there was a specific channel for as
15:29 < ePlus> thanks!
15:32 -!- zdadmin [~chad@209.119.38.226] has joined #openvpn
15:35 <@vpnHelper> RSS Update - forum: OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17463>
15:42 -!- Bartzy [~bar@77.125.76.8] has joined #openvpn
15:42 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
15:49 -!- NightMonkey [~NightMonk@pdpc/supporter/professional/nightmonkey] has joined #openvpn
15:51 < NightMonkey> Hi, good OpenVPN folks. I've got a nice working OpenVPN setup between a server and me. However, I'd like to add access for a second machine, but I don't have access to the gateway my servers are on to add a static route.
15:51 < NightMonkey> Can we merely add the static route to the machine's route table and have the good magic happen?
15:52 -!- treund [~treund@97.75.177.42] has joined #openvpn
15:52 -!- Brandon [52e28040@gateway/web/freenode/ip.82.226.128.64] has joined #openvpn
15:52 <+hyper_ch> you don't have access to the server?
15:52 < Brandon> Hi there 
15:52 < NightMonkey> hyper_ch: Oh, yes, I do.
15:53 < NightMonkey> And I see I wasn't too clear. I want to allow access to another machine behind the OpenVPN server, besides the OpenVPN server machine itself.
15:53 <+hyper_ch> so where's the problem?
15:53 < NightMonkey> (and I'm using routing, not bridging)
15:53 <+hyper_ch> NightMonkey: make that other machine also a client
15:54 < NightMonkey> Ah, that's an interesting idea!
15:54 < Brandon> NightMonkey: is it what you're looking for? http://www.openvpn.net/index.php/open-source/documentation/howto.html#scope
15:54 <@vpnHelper> Title: HOWTO (at www.openvpn.net)
15:55 <+hyper_ch> I just think it's the simplest way to achieve
15:55 <+hyper_ch> and maybe use CCD for the different clients to assign them static ips
15:56 < NightMonkey> Brandon: Yes, that's what I've done. But I don't have access to the server-side gateway to add a static route there.
15:57  * hyper_ch still votes for the make-it-a-client option (until dazo, krzie or someone else says it's a bad thing)
15:57 < Brandon> hyper_ch: Hi. I need to enter my client password at every startup of my laptop. Can't I put the password somewhere in /etc/init.d/openvpn ?
15:57 < Brandon> And I think the client way you'e offering is simplier
15:57 <+hyper_ch> Brandon: create a new certificate
15:57 <+hyper_ch> Brandon: because it sounds you have created one with a password
15:58 < Brandon> hyper_ch, but that's what I want to use! :-p
15:59 <+hyper_ch> doesn't make sens
15:59 <+hyper_ch> e
15:59 <+hyper_ch> why use a password if you want to auto-enter the password?
15:59 < Brandon> Isn't it more secure ?
15:59 <+hyper_ch> how?
15:59 < Brandon> (I'm pretty paranoid )
15:59 <+hyper_ch> as long as you have the cert only on your computer
15:59 <+hyper_ch> it's not more secure
16:00 <+hyper_ch> because you will have to store the password in plaintext also somewhere on your computer
16:00 <+hyper_ch> and as the cert should only be readable by root, it means that if someone can get a hold of your cert, they can also get hold of the plaintext password
16:00 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:01 <+hyper_ch> but that's just me
16:01 <+hyper_ch> but have a look at expect to autofill terminal dialogs
16:01 < Brandon> I see... I agree with that
16:01 < Gravitron> total openvpn noob here, any quick recommendations to check when the server fails to start?
16:01 <+hyper_ch> Gravitron: enable logging
16:01 <+hyper_ch> and then check the log
16:01 < Brandon> The only advantage will that it would slow down the hacker a little.
16:02 <+hyper_ch> if they get root access you're screwed anyway
16:02 < Brandon> Gravitron: set "verb 5" for testing
16:02 < Gravitron> aw, thank you
16:02 < Gravitron> in server.conf correct?
16:02 <+hyper_ch> for the server - yes
16:03 < Brandon> Gravitron: do NOT forget to put "verb 3" back when you're done
16:03 < Gravitron> do you happen to know where/how the logs are stored?
16:03 -!- andygraybeal [~andy.gray@obsidian.casanueva.com] has joined #openvpn
16:03 <+hyper_ch> or disable logging
16:03 <+hyper_ch> Gravitron: in /etc/openvpn
16:03 <+hyper_ch> if you don't give another path IIRC
16:03 < Brandon> Gravitron: /etc/openvn
16:03 < Gravitron> hrmm
16:03 < Gravitron> not there
16:03 <+hyper_ch> !configs
16:03 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
16:03 < Brandon> Gravitron: what hyper_hc said :-p
16:04 <+hyper_ch> Brandon: tab completion rocks
16:04 < Gravitron> gah this install is so fucked up anyway
16:04 < Gravitron> im just going to scrap it, then i'll be back lol
16:04 < Brandon> hyper_hc: Then I'm going to clean all my cert, because they all got a password 
16:05 <+hyper_ch> Brandon: you really should use tab completion
16:05 -!- kyrix [~ashley@mk046207255127.a1.net] has joined #openvpn
16:05 <+hyper_ch> happy cert creation
16:05 <+hyper_ch> well, as said, another option would be to use expect to have password auto-inserted
16:06 < Brandon> !tabcompletion
16:06 <+hyper_ch> Brandon: type "hyp" and then press the tab key
16:06  * Brandon does not actually know what tab completion is
16:07 <+hyper_ch> or even just "hy"
16:07 < Brandon> Oh, I see
16:07 <+hyper_ch> tab completion --> complete nickname with a tab stroke
16:07 < Brandon> I'm french and still have some issues understanding those kind of expressions since I'm used to the french one ;)
16:07 < Brandon> Thanks anyway
16:08 <+hyper_ch> tu dois use la completion de tab
16:08 < Brandon> merci :-p
16:09 <+hyper_ch> s/use/user
16:09 < Brandon> you should to: aptitude install french-dictionnary french-grammar in your head console
16:10 < Brandon> Did that for spanish and worked great! :D
16:10 -!- treund [~treund@97.75.177.42] has left #openvpn []
16:10 <+hyper_ch> why? I know everything important
16:11 < Brandon> Like what?
16:11 <+hyper_ch> J'aime bien que tu deviens la mère des mes enfants ;)
16:12 <+hyper_ch> c'est n'est pas si directe que "tu veux baiser?"
16:12 < Brandon> Me gustaría que para ser la madre de mis hijos ;)
16:12 < Brandon> hyper_ch: Nope, the first sentence is decent
16:13 <+hyper_ch> never tried it tough :)
16:13 < Brandon> "tu veux baiser?" is either for: prostitutes, drung girls or sex friends
16:13 < Brandon> *drunk
16:13 <+hyper_ch> s/baiser/faire de l'amour/
16:14 < Brandon> you got to try the first one with a pure english accent, any french girl would either laugh or agree to that
16:14 <+hyper_ch> I don't have an english accent :(
16:14 < Brandon> Then an australian accent ? :(
16:15 <+hyper_ch> I'm not australian either
16:15 < Brandon> You just got to roll the "r" 
16:15 -!- zebedee3 [~neil@027c163b.bb.sky.com] has joined #openvpn
16:15 <+hyper_ch> I have an accent that sounds like "k-k-k-k-k-k" in french ears
16:15 < Brandon> Hum... Indian?
16:15 <+hyper_ch> no, have a look at my name, it contains a clue
16:16 < Brandon> Chili ? 
16:16 <+hyper_ch> no
16:16 < Brandon> Chelsea ?
16:16 < Brandon> Chicago ?
16:16 <+hyper_ch> no, it's a country
16:16 <+hyper_ch> most people first think ch is china
16:16 < Brandon> China ? !D
16:16 <+hyper_ch> lol
16:16 < Brandon> lol
16:17 < Brandon> good timing
16:17 <+hyper_ch> it's much closer to france
16:17 <+hyper_ch> it's a neighbouring country of france
16:17 < Brandon> Chypre !
16:17 <+hyper_ch> are there so many countries with c? hmmm, never thought about it
16:17 <+hyper_ch> Brandon: Confoederatio Helvetica
16:18 < Brandon> Holy sh*t
16:18 <+hyper_ch> ?
16:18 < Brandon> Let me see that in my world map
16:18 <+hyper_ch> you're not from france?
16:18 < Brandon> Looks like we got another nickname in French for your country :-p
16:19 < Brandon> I live in Paris
16:19 <+hyper_ch> so you should know the neighbouring countries
16:19 <+hyper_ch> a nickname for my country? what is it?
16:19 <+hyper_ch> cornichons?
16:20 <+hyper_ch> chiens?
16:20 <+hyper_ch> chats?
16:20 < Brandon> OOOOOOH that's Switzerland you're talking about !
16:20 < Brandon> Dude why you told me the latin name lol
16:20 < Brandon> In French: Suisse
16:21 <+hyper_ch> Brandon: [C]onfoederatio [H]elvetica
16:21 < EugeneKay> I have a .ch domain name >_>
16:21 <+hyper_ch> EugeneKay: as have I :)
16:22 < Brandon> EugeneKay: Hi :)
16:22 < EugeneKay> My company name includes "research"
16:22 <+hyper_ch> EugeneKay: why do you have one?
16:22 -!- tessier [~treed@mail.copilotco.com] has quit [Changing host]
16:22 -!- tessier [~treed@kernel-panic/copilotco] has joined #openvpn
16:22 < EugeneKay> Cheap domain hack :-p
16:23 <+hyper_ch> te.ch ?
16:23 <+hyper_ch> nah, no two letter domains for ordinary citizens :(
16:23 < EugeneKay> No, khresear.ch
16:23 < EugeneKay> "K and H Research Company"
16:23 < Brandon> computers-me.ch ?
16:24 < EugeneKay> Hm. I wonder if astro-me.ch is taken
16:24 < EugeneKay> Ha, available.
16:24 < Brandon> Nice word games with me/mech 
16:25 < EugeneKay> No-dash is taken, tho
16:25 -!- kyrix [~ashley@mk046207255127.a1.net] has quit [Quit: Ex-Chat]
16:25 <+hyper_ch> chf 17/CH-TLD
16:25 <+hyper_ch> or LI-TLD
16:25 <+hyper_ch> as switch also handles the tlds for liechtenstein
16:25 < EugeneKay> US$19 nowadays
16:26 < EugeneKay> It was cheaper when I bought mine
16:26 < EugeneKay> But not much
16:26 <+hyper_ch> dollar has lost value
16:26 < Brandon> dollar actually has a value ? :/
16:27 < EugeneKay> I need to find somebody in the Cayman Islands(or with a business entity there). I want egn.ky for a URL shortener.
16:28 -!- axelm7 [~axelm7@186.135.10.55] has quit [Ping timeout: 256 seconds]
16:28 <+hyper_ch> hehehe :)
16:28 <+hyper_ch> EugeneKay: open a letterbox business address tehre
16:28 < EugeneKay> $500 to incorporate
16:29 < EugeneKay> Plus I'd need to pay a law office to act as my "agent"
16:29 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:29 < Brandon> EugeneKay: Do you really need that to buy those kind of domain ?
16:29 <+hyper_ch> £ 50 for a LLC in England
16:29 <+hyper_ch> can't you just move it then?
16:29 < EugeneKay> .ky registry requires a cayman's entity
16:30 < EugeneKay> Person or business is fine, I just don't know anybody, or somebody who has one
16:30 < EugeneKay> And it's not worth setting one up myself for this
16:33 <+hyper_ch> if there are no further costs involved
16:33 <+hyper_ch> why not?
16:39 < Gravitron> i hate openvz.
16:40 <+hyper_ch> what's openvz?
16:42 -!- novaflash is now known as novaflash_away
16:45 < Brandon> Got to go, see you all
16:46 -!- Brandon [52e28040@gateway/web/freenode/ip.82.226.128.64] has quit [Quit: [Je m'en vais.]]
16:52 -!- axelm7 [~axelm7@186.135.10.55] has joined #openvpn
16:54 < EugeneKay> It's chroot on steroids, masquerading as a VPS technology
16:56 <+hyper_ch> :)
16:57 <+hyper_ch> anyone here runs an own disapora server/node?
16:57 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:06 -!- JGAN [~JGAN@66.195.235.242] has joined #openvpn
17:06 -!- JGAN [~JGAN@66.195.235.242] has quit [Remote host closed the connection]
17:07 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
17:11 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
17:11 -!- ePlus [~zuma@217.28.10.143] has quit [Ping timeout: 260 seconds]
17:14 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
17:21 -!- zebedee3 [~neil@027c163b.bb.sky.com] has quit [Quit: Ex-Chat]
17:22 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:30 -!- axelm8 [~axelm7@186.135.10.55] has joined #openvpn
17:32 -!- axelm7 [~axelm7@186.135.10.55] has quit [Ping timeout: 256 seconds]
17:35 -!- axelm7 [axelm7@186.135.10.55] has joined #openvpn
17:39 -!- axelm8 [~axelm7@186.135.10.55] has quit [Ping timeout: 256 seconds]
17:42 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:46 -!- swg0101 [~swg0101@openvpn/user/swg0101] has joined #openvpn
17:46 -!- mode/#openvpn [+v swg0101] by ChanServ
17:51 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html#p17464>
17:54 -!- ruied [~ruied@po-217-129-154-119.netvisao.pt] has joined #openvpn
17:55 -!- Denial [~Denial@drgi.co.uk] has quit []
17:55 < ruied> hi, how do I check the format of a certificate, PEM; DER; PKCS#12?
17:56 -!- Bartzy [~bar@77.125.76.8] has quit [Ping timeout: 258 seconds]
17:57 <+swg0101> have you tried opening them in Notepad?
17:57 < EugeneKay> QUickest way is to look at it. PEM will be in a hex-encoded format, DER is binary. PKCS12 is hex-encoded(I think), but will be a lot larger than a pem cert.
17:57 < EugeneKay> Run it through openssl to confirm.
17:58 <+swg0101> pem is base64
17:58 < EugeneKay> Ah right, yeah. 
17:58 < EugeneKay> Not hex
17:58 <+swg0101> but yea... opening it and taking a look at it should tell u
17:58 <+swg0101> or give u an idea
17:58 <+swg0101> ;)
17:59 < EugeneKay> DER is easy to spot :-p
17:59 <+swg0101> got junk?
18:00 < ruied> EugeneKay, opening it with vim ? and check?
18:00 <+swg0101> usually PEM is the easiest to see
18:00 < EugeneKay> Yup.
18:00 <+swg0101> if you open it
18:00 <+swg0101> and see that your key has something like ---BEGIN...
18:00 <+swg0101> then it's PEM format
18:00 < EugeneKay> What's the header on p12 look like?
18:01 < EugeneKay> Ah, I have one here. It's binary format, too.
18:01 < EugeneKay> (why did I think it was base64?)
18:01 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
18:02 <+swg0101> mine has
18:02 <+swg0101> 0x3082
18:02 <+swg0101> as header
18:03 <+swg0101> although you can try downloading it
18:03 <+swg0101> and renaming it to .cer
18:03 <+swg0101> and see if you can open it in Windows
18:04 <+swg0101> but if you open it in a hex editor
18:04 <+swg0101> you will probably see some ASCII characters in there
18:04 <+swg0101> that resembles the certificate infromation
18:04 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
18:04 <+swg0101> p12 you probably only see junk
18:05 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
18:05 <+swg0101> for me both p12 and der has 0x3082 as header
18:11 -!- ravemaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:14 < ruied> I see a -----BEGIN CERTIFICATE-----
18:14 <+swg0101> then its PEM
18:15 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p17465>
18:17 < ruied> I've created certificates for openvpn and they are working with linux, but not with my yealink sip phone with openvpn... I was supspecting about the format of the certificate could it be a problem that the device can't read PEM crt?
18:19 <+swg0101> OpenVPN certs are always in PEM if I am not mistaken
18:20 -!- ravemaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
18:20 < ruied> can I convert my client.crt  and ca.crt DER format ?
18:20 <+swg0101> I don't see why you would want to do that
18:20 < ruied> swg0101, so the problem shouldn't be with the format type..
18:20 <+swg0101> it should not be
18:20 <+swg0101> I would check the logs
18:20 <+swg0101> and see
18:20 <+swg0101> why
18:21 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
18:21 < ruied> at the server side it doesn't reach any info from the phone, from the phone side I can't see any logs... it doesn't seems to have logs, but going to check...
18:22 <+swg0101> maybe a firewall then?
18:23 -!- tessier [~treed@kernel-panic/copilotco] has quit [Ping timeout: 255 seconds]
18:23 < ruied> swg0101, I was wondering about the crt formats, because, once I had a microtik router working with my openvpn linux server and I had to convert the format so the microtik could connect to my server....
18:23 < ruied> firewall is ok, at the moment I have 4 VPN's running...
18:24 <+swg0101> convert the format to what?
18:24 <+swg0101> but I would try to use the same configs on a comp
18:25 <+swg0101> and see if it connects first
18:25 < ruied> that's the question, don't remember, someone said to convert it and than it worked, but really can't remember...
18:26 < ecrist> sup bitches?
18:26 -!- tessier [~treed@mail.copilotco.com] has joined #openvpn
18:27 <+swg0101> hola
18:29 < EugeneKay> The usual. Noobs, everywhere.
18:29 < EugeneKay> ruied - got a PDF of the manual for the phone? I can poke at it
18:31 -!- tessier [~treed@mail.copilotco.com] has quit [Ping timeout: 260 seconds]
18:33 < ruied> EugeneKay, http://wiki.freeswitch.org/wiki/Yealink-SIP-T26P
18:33 <@vpnHelper> Title: Yealink-SIP-T26P - FreeSWITCH Wiki (at wiki.freeswitch.org)
18:33 < ruied> I have T38G, the conf is the same, but someone is complaining about a bug in openvpn... might be a bug
18:35 < EugeneKay> Oy. That looks complicated.
18:36 < EugeneKay> The crt/keys should be pretty simple,  no fancy p12 stuff like you get on Android
18:43 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html#p17466>
18:46 -!- swg0101 [~swg0101@openvpn/user/swg0101] has left #openvpn []
18:49 -!- treund [~treund@97.75.177.42] has joined #openvpn
19:03 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
19:05 -!- 18VAAI8J3 [~treed@mail.copilotco.com] has joined #openvpn
19:06 -!- axelm7 [axelm7@186.135.10.55] has quit [Ping timeout: 240 seconds]
19:09 -!- 18VAAI8J3 is now known as tessier
19:09 -!- tessier [~treed@mail.copilotco.com] has quit [Client Quit]
19:12 -!- _Sam--_ [~sam@fresco.kneedraggers.com] has left #openvpn []
19:13 -!- NightMonkey [~NightMonk@pdpc/supporter/professional/nightmonkey] has quit [Quit: Body blow! Body blow!]
19:31 <@vpnHelper> RSS Update - forum: Grouped clients <http://forums.openvpn.net/topic9177.html#p17467>
20:14 <@vpnHelper> RSS Update - forum: Grouped clients <http://forums.openvpn.net/topic9177.html#p17468>
20:31 -!- axelm7 [~axelm7@186.135.10.55] has joined #openvpn
20:40 -!- fapI [~fapi@c-71-229-141-122.hsd1.co.comcast.net] has joined #openvpn
20:41 -!- acdef [~robott@58.34.139.7] has joined #openvpn
20:41 < axelm7> hey guys. I am running openvpn server on centos 5.7. I would like to always give a known client teh same address so I can route back to that user's network.
20:44 < treund> static ips all around?
20:44 < axelm7> yes
20:45 < treund> sorry so what/where is the problem?
20:46 < axelm7> I would like to give vpn access to a bunch of pcs that are behind my ddwrt router which runs openvpn client. I understand that in order to avoid NATTing I have to set up some static routes
20:47 < axelm7> and for those routes to work I need the vpn clinet to always get the same address instead of the next one in the pool
20:50 < treund> hope this helps http://forums.opensuse.org/english/get-technical-help-here/network-internet/412452-assign-openvpn-clients-static-ip-addresses.html
20:50 <@vpnHelper> Title: Assign OpenVPN clients "static" ip addresses (at forums.opensuse.org)
20:50 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
20:50 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
20:50 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:50 -!- mode/#openvpn [+v Axeman2] by ChanServ
20:52 -!- fapI [~fapi@c-71-229-141-122.hsd1.co.comcast.net] has quit [Quit: Bye]
20:58 < qubits> which directory should i keep my configuration files in
20:58 < qubits> usr/share/open vpn or /etc/vpn?
20:58 < qubits> I have stuff in both
20:59 < treund> which dir does an strace of openvpn show being tried first ;)
21:13 -!- Jimmy_Kash [~Jimmy_Kas@115-64-100-52.static.tpgi.com.au] has joined #openvpn
21:14 < Jimmy_Kash> hey do you guys help with setting up a PPTP vpn on ubuntu server?
21:16 < EugeneKay> !pptp
21:16 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
21:16 <@vpnHelper> read about why to not use pptp or (#2) Why not to use pptp: http://en.wikipedia.org/wiki/Pptp#Security_of_the_PPTP_protocol
21:16 -!- nachos [~nnscript@CPE-143-238-36-82.lnse1.win.bigpond.net.au] has quit [Read error: Connection reset by peer]
21:16 < EugeneKay> !notopenvpn
21:16 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
21:19 < treund> you should but a : in your bot output like    pptp is :
21:19 < EugeneKay> !blame
21:19 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
21:19 < EugeneKay> Wait, shit. That means it's my problem.
21:22 -!- chrismsnz [~csmith@203-89-163-139.static.ubs.maxnet.co.nz] has joined #openvpn
21:23 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:24 < Jimmy_Kash> my bad guys
21:24 -!- Spinkzeit [~boat@115-64-100-52.static.tpgi.com.au] has joined #openvpn
21:24 < EugeneKay> We're glad to help with OpenVPN, if you'd like to reconsider
21:24 < Jimmy_Kash> I would very much so
21:25 < Jimmy_Kash> I basically have a server where I download everything to and run a few scripts.  I just wanted a 2 easy way of vpning (not a word i am sure) in and transferring files and using the servers net connection
21:26 < EugeneKay> !redirect
21:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
21:26 < EugeneKay> Use the !howto for getting a basic network going, then apply !redirect as above 
21:27 < Jimmy_Kash> see the pptpd setup took 2 seconds
21:27 < chrismsnz> Hi guys, I think I have a routing issue with my VPN and i'm looking for some help
21:27 < Jimmy_Kash> is openvpn fairly straight forward?
21:27 < treund> Jimmy_Kash: and ftpd/tls or https ruled out ? why
21:27 < Jimmy_Kash> because I am a dirty n00b?
21:27 < EugeneKay> Fairly, yes. Hardest part is getting the SSL PKI going - most of the HOWTO is walking you through the easy-rsa stuff.
21:28 < EugeneKay> If it's one-server-one-client you can do it quick 'n dirty with shared-key, but that doesn't scale.... full stop.
21:28 < Jimmy_Kash> yeah its literally a torrent server I have setup
21:28 < Jimmy_Kash> so quidk 'n dirty sounds like it will fit in just fine
21:29 < EugeneKay> See the howto, ctrl-f for "static key"
21:29 < EugeneKay> Some caveats apply, they're covered in that doc
21:30 < Jimmy_Kash> EugeneKay thanks man
21:30 < Jimmy_Kash> EugeneKay: You are the onnly person to actually try and help out - i appreciate it
21:31 < chrismsnz> I have a site-to-site setup where the "client side" vpn node can access anything on the remote site, but the local network can not
21:31 < chrismsnz> and the remote network can not access the local network, either
21:32 < EugeneKay> Is the client-side node the default GW for its LAN?
21:32 < EugeneKay> And the same for the server and its LAN, I suppose.
21:33 < EugeneKay> Heck, here. 
21:33 < EugeneKay> !route
21:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
21:34 < chrismsnz> yes and yes
21:34 < chrismsnz> both are default gateways for their respective LAN's
21:34 < EugeneKay> That makes it easy
21:34 < chrismsnz> that's what I thought ;)
21:35 < EugeneKay> Configs?
21:35 < EugeneKay> Jimmy_Kash - y'welcome... normally I just hide under my rock :-p
21:37 < chrismsnz> the configs are generated by pfsense on the remote side, and tomato vpn on the local side
21:37 < EugeneKay> !pfsense
21:37 <@vpnHelper> "pfsense" is dont use the web gui for configuring openvpn, you need to understand the config and logfiles
21:38 < chrismsnz> I'm sure this is actually their problem/bug as it was all working until last night when i did a point release upgrade - just wondering if i was missing anything
21:39 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
21:40 < axelm7> trund, that really helped. I got it working
21:41 -!- Jimmy_Kash [~Jimmy_Kas@115-64-100-52.static.tpgi.com.au] has left #openvpn []
21:44 -!- master_of_master [~master_of@p57B53B4D.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
21:45 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
21:45 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
21:45 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:45 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:45 -!- master_of_master [~master_of@p57B52975.dip.t-dialin.net] has joined #openvpn
21:51 -!- treund [~treund@97.75.177.42] has left #openvpn []
22:02 -!- vtcN- [~vtcN@unaffiliated/thethe] has quit [Remote host closed the connection]
22:03 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
22:06 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:11 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:15 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
22:16 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
22:24 -!- chrismsnz [~csmith@203-89-163-139.static.ubs.maxnet.co.nz] has quit [Quit: leaving]
22:27 -!- axelm7 [~axelm7@186.135.10.55] has quit [Ping timeout: 240 seconds]
22:28 -!- mode/#openvpn [+v EugeneKay] by ChanServ
22:29 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 260 seconds]
22:29 -!- dxtr [45aa3c32@host-88-80-29-36.cust.prq.se] has quit [Quit: leaving]
22:32 -!- dxtr [~dxtr@2a00:16d8:2:300::2] has joined #openvpn
22:32 -!- dxtr [~dxtr@2a00:16d8:2:300::2] has quit [Changing host]
22:32 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
22:33 -!- attila_lendvai [~attila_le@81.211.133.38] has joined #openvpn
22:33 -!- attila_lendvai [~attila_le@81.211.133.38] has quit [Changing host]
22:33 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
22:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 260 seconds]
22:37 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:05 -!- zdadmin [~chad@209.119.38.226] has quit [Ping timeout: 260 seconds]
23:38 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 255 seconds]
23:50 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
23:58 -!- ravemaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
23:58 < ravemaster> WebDawg: man can I ask your help on ssh. badly needed
--- Day changed Fri Nov 11 2011
00:01 -!- Spinkzeit [~boat@115-64-100-52.static.tpgi.com.au] has quit [Read error: Connection reset by peer]
00:01 -!- Spinkzeit [~boat@115-64-100-52.static.tpgi.com.au] has joined #openvpn
00:05 < ravemaster> need your help guys
00:06 -!- ravemaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Quit: Page closed]
00:06 <+EugeneKay> !ask
00:06 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
00:13 -!- Dsbeerf [~Dsbeerf@modemcable095.79-160-184.mc.videotron.ca] has joined #openvpn
00:14 -!- Dsbeerf [~Dsbeerf@modemcable095.79-160-184.mc.videotron.ca] has quit [Changing host]
00:14 -!- Dsbeerf [~Dsbeerf@about/networking/255.255.255.255/Dsbeerf] has joined #openvpn
00:15 < Dsbeerf> hello, i have a server with openvpn on it and when i connect on the openvpn server i got a 10.x but it dont hide my ip i mean i dont use the server ip someone have an idea ? i tried googling forum etc found nothing
00:16 <+EugeneKay> !configs
00:16 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
00:16 -!- mode/#openvpn [+o EugeneKay] by ChanServ
00:19 -!- EugeneKay changed the topic of #openvpn to: Welcome to the OpenVPN community support channel  || PLEASE read the entire topic! || Current Release: 2.2.1 (6-July-2011) || Your problem is your firewall, really. || First time here? Use !welcome and !goal || Access Server? /join #openvpn-as || We're not psychic - please !pastebin your !configs and !logs and a description of your problem || If English isn't your first language, please
00:19 <@EugeneKay> Grah
00:20 -!- EugeneKay changed the topic of #openvpn to: Welcome to the OpenVPN community support channel  || PLEASE read the entire topic! || Current Release: 2.2.1 (6-July-2011) || Your problem is your firewall, really. || First time here? Use !welcome and !goal || Access Server? /join #openvpn-as || We're not psychic - please !pastebin your !configs and !logs and a description of your problem || English not your first language? Say so!
00:22 < Dsbeerf> http://pastebin.com/yp8WxN9K
00:22 < Dsbeerf> here
00:23 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Read error: Connection reset by peer]
00:26 <@EugeneKay> OpenVPN, by default, is just a "private network" running over a set of tunnels. 
00:26 <@EugeneKay> You're trying to send your client's internet traffic over the VPN tunnel, right?
00:26 -!- bauruine [~stefan@217.150.228.163] has joined #openvpn
00:26 < Dsbeerf> yes
00:26 <@EugeneKay> !redirect
00:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
00:27 <@EugeneKay> Basically, you need to tell the client to use the VPN network for its default gateway(redirect-gateway def1). 
00:27 <@EugeneKay> You can do this server-side, with a push command, or client side, with just the redirect-gateway def1 command.
00:27 < Dsbeerf> so is just part of the client side ?
00:28 < Dsbeerf> ok
00:30 < Dsbeerf> !def1
00:30 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
00:37 < Dsbeerf> humm i add to server.conf push "redirect-gateway def1
00:37 < Dsbeerf> rebooted but still not working
00:37 < Dsbeerf> i should miss something :S
00:38 <@EugeneKay> !logs
00:38 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
00:38 < Dsbeerf> ok sorry
00:39 -!- dazo_afk is now known as dazo
00:40 < Dsbeerf> http://pastebin.com/eVDXCgSE
00:40 < Dsbeerf> here again and sorry for the paste here again
00:41 <@EugeneKay> You're missing a " on your push ;-)
00:45 -!- Spinkzeit [~boat@115-64-100-52.static.tpgi.com.au] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
00:48 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has joined #openvpn
00:48 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has quit [Changing host]
00:48 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
00:48 < Dsbeerf> ahhh stupid me 
00:48 < Dsbeerf> sorry :(
00:49 < Dsbeerf> thanks for the help
00:49 < Dsbeerf> gonna try it now
00:52 -!- Dsbeerf [~Dsbeerf@about/networking/255.255.255.255/Dsbeerf] has quit [Read error: Connection reset by peer]
00:53 -!- Dsbeerf [~Dsbeerf@modemcable095.79-160-184.mc.videotron.ca] has joined #openvpn
00:53 < Dsbeerf> everything got timedout :(
00:53 <@EugeneKay> Did you set up the rest of the stuff in !redirect?
00:54 < Dsbeerf> !redirect
00:54 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
00:54 < Dsbeerf> with iptable ?
00:55 <@EugeneKay> Yup, also ip_forward
00:55 <@EugeneKay> Read the !factoids ;-)
00:55 < Dsbeerf> !ipforward
00:55 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
00:55 < Dsbeerf> !linipforward
00:55 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
00:56 < Dsbeerf> !nat
00:56 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
00:56 < Dsbeerf> !linnat
00:56 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
00:59 < Dsbeerf> !openvzlinnat
00:59 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
01:01 -!- Dsbeerf [~Dsbeerf@modemcable095.79-160-184.mc.videotron.ca] has quit [Read error: Connection reset by peer]
01:08 -!- Dsbeerf [~Dsbeerf@94.249.185.122] has joined #openvpn
01:08 < Dsbeerf> ok evry thing is working now
01:09 < Dsbeerf> thanks so much :)
01:09 -!- novaflash_away is now known as novaflash
01:16 -!- Dsbeerf [~Dsbeerf@94.249.185.122] has quit []
01:17 <@EugeneKay> Always amazing how many problems the bot solve
01:17 <@EugeneKay> +s
01:32 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
01:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:42 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:54 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
01:55 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
01:58 -!- ePlus [~zuma@217.28.10.143] has joined #openvpn
02:04 <@vpnHelper> RSS Update - forum: OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17469>
02:10 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p17471> || Confused by my results <http://forums.openvpn.net/topic9180.html#p17470>
02:15 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
02:23 -!- Druid_ [~Druid@p5B05DAE8.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
02:25 <+hyper_ch> EugeneKay: :)
02:25 <@EugeneKay> :-?
02:26 -!- Druid_ [~Druid@p5B05D65A.dip.t-dialin.net] has joined #openvpn
02:31 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
02:35 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
02:38 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
02:38 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
02:52 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p17472>
02:56 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:56 -!- RyanP [~RyanP@unaffiliated/ryanp] has quit [Remote host closed the connection]
03:05 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Ping timeout: 248 seconds]
03:08 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
03:18 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
03:18 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
03:26 -!- acdef [~robott@58.34.139.7] has quit []
03:27 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:43 -!- bretanika [bretanika@89.114.11.171] has quit []
03:52 -!- ruied [~ruied@po-217-129-154-119.netvisao.pt] has quit [Ping timeout: 260 seconds]
03:55 -!- ruied [~ruied@po-217-129-154-119.netvisao.pt] has joined #openvpn
04:05 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:05 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:07 -!- MatToufoutu [~MaT@unaffiliated/mattoufoutu] has quit [Ping timeout: 244 seconds]
04:08 -!- MatToufoutu [~MaT@unaffiliated/mattoufoutu] has joined #openvpn
04:23 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
04:24 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
04:24 -!- axelm7 [~axelm7@186.135.3.147] has joined #openvpn
04:28 -!- axelm7 [~axelm7@186.135.3.147] has quit [Ping timeout: 256 seconds]
04:36 -!- EugeneKay is now known as EugeneSleep
04:51 <@vpnHelper> RSS Update - forum: Double bridging possible or reuse existing bridge? <http://forums.openvpn.net/topic9199.html#p17473>
05:00 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 256 seconds]
05:03 <@vpnHelper> RSS Update - forum: Double bridging possible or reuse existing bridge? <http://forums.openvpn.net/topic9199.html#p17474>
05:08 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has joined #openvpn
05:08 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has quit [Changing host]
05:08 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
05:21 -!- axelm7 [~axelm7@186.135.3.147] has joined #openvpn
05:24 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
05:27 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html>
05:29 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has joined #openvpn
05:30 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 248 seconds]
05:44 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
05:46 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 258 seconds]
05:57 <@vpnHelper> RSS Update - forum: OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17476>
06:03 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17477>
06:09 <@vpnHelper> RSS Update - forum: VPN top 10 <http://forums.openvpn.net/topic9143.html#p17480> || OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17479> || topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17478>
06:11 -!- ravemaster [4addd142@gateway/web/freenode/ip.74.221.209.66] has joined #openvpn
06:12 < ravemaster> I would like how do you suppress the log error TCP/UDP: Incoming packet rejected from 10.8.0.2:137[2], expected peer address: 74.221.209.66:443 (allow this incoming source address/port by removing --remote or adding --float)
06:14 < ravemaster> hello
06:14 -!- ravemaster [4addd142@gateway/web/freenode/ip.74.221.209.66] has quit [Client Quit]
06:14 <@vpnHelper> RSS Update - forum: Windows 7 64 bit Installation Fails OpenVPN 2.2.1 <http://forums.openvpn.net/topic8440.html#p17481>
06:14 -!- ravemaster [~researche@74.221.209.66] has joined #openvpn
06:15 < ravemaster> how do you suppress error TCP/UDP: Incoming packet rejected from 10.8.0.2:137[2], expected peer address: sampleserverip:443 (allow this incoming source address/port by removing --remote or adding --float)
06:15 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
06:15 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
06:15 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:15 -!- mode/#openvpn [+v Axeman2] by ChanServ
06:21 <@vpnHelper> RSS Update - forum: multi-client vlan-pvid setting <http://forums.openvpn.net/topic7989.html#p17482>
06:24 -!- ravemaster [~researche@74.221.209.66] has quit [Ping timeout: 245 seconds]
06:28 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
06:38 < axelm7> hi guys, I remember having seen a tutorial somewhere explaining how to set up a VPN with clients, contractors and system administrator. There were different subnets and multiple ovpn instances. Anybody know where that tutorial is?
06:45 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17483>
06:53 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
06:53 -!- mode/#openvpn [+o raidz] by ChanServ
06:54 -!- davlefou [~david@41.225.194.107] has joined #openvpn
06:54 < davlefou> Hi,
06:55 < davlefou> i have an openvpn, when i type "dig google.fr" it ok, but it don't work with ping google.fr
06:55 < davlefou> Can you help me?
07:03 <@vpnHelper> RSS Update - forum: unknown opcode received <http://forums.openvpn.net/topic9203.html>
07:19 < axelm7> davlefou, what do you mean by "I have an OpenVPN"?
07:21 < davlefou> i use openvpn with an server et an client!
07:23 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 260 seconds]
07:33 <@vpnHelper> RSS Update - forum: OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17485>
07:34 < davlefou> axelm7: it seems peuhraps came from /proc/sys/net/ipv4/conf/tap0/rp_filter 
07:37 -!- axelm7 [~axelm7@186.135.3.147] has quit [Ping timeout: 240 seconds]
07:38 < davlefou> it sould be came from server vpn.
07:47 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has joined #openvpn
07:47 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has quit [Changing host]
07:47 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
07:50 -!- andygraybeal [~andy.gray@obsidian.casanueva.com] has quit [Remote host closed the connection]
07:51 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
07:51 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
07:51 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:51 -!- mode/#openvpn [+v Axeman] by ChanServ
07:55 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 258 seconds]
08:01 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
08:09 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17486>
08:14 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
08:15 -!- stephan48 [stephan@opennic/stephan] has left #openvpn []
08:15 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294.html#p17487>
08:21 <@vpnHelper> RSS Update - forum: Can connect to VPN but can't ping clients behind the VPN <http://forums.openvpn.net/topic9204.html>
08:25 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:25 -!- mode/#openvpn [+v s7r] by ChanServ
09:10 <@vpnHelper> RSS Update - forum: openvpn route add not working <http://forums.openvpn.net/topic9205.html>
09:22 <@vpnHelper> RSS Update - forum: Double bridging possible or reuse existing bridge? <http://forums.openvpn.net/topic9199.html#p17490>
09:28 <@vpnHelper> RSS Update - forum: openvpn route add not working <http://forums.openvpn.net/topic9205.html#p17491>
09:28 -!- datruth [datruth@gotpot.org] has joined #openvpn
09:29 < datruth> can non-admin users use openvpn? on windowsxp/7 systems?
09:31 < ecrist> yes, if openvpn is configured to run with admin rights
09:31 < ecrist> datruth: try google, that question is asked all the time
09:32 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:33 < datruth> I tried a few registry hacks but my keys are encrypted with passwords and it just seems to fail
09:33 <@vpnHelper> RSS Update - forum: multi-client vlan-pvid setting <http://forums.openvpn.net/topic7989.html#p17492>
09:36 < datruth> ahh finally cpau looks good
09:40 <@vpnHelper> RSS Update - forum: Can connect to VPN but can't ping clients behind the VPN <http://forums.openvpn.net/topic9204.html#p17494> || openvpn route add not working <http://forums.openvpn.net/topic9205.html#p17493>
09:46 <@vpnHelper> RSS Update - forum: unknown opcode received <http://forums.openvpn.net/topic9203.html#p17497> || topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17496> || [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p17495>
09:47 -!- Synthead [~max@173-165-179-126-atlanta.hfc.comcastbusiness.net] has joined #openvpn
09:47 < Synthead> is there a configuration option that I can set where the server can communicate with the client, but the client cannot make connections to the server?
09:48 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
09:52 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17498>
10:02 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:03 -!- MatToufoutu [~MaT@unaffiliated/mattoufoutu] has quit [Remote host closed the connection]
10:03 <@vpnHelper> RSS Update - forum: openvpn route add not working <http://forums.openvpn.net/topic9205.html#p17499>
10:03 -!- MatToufoutu [~MaT@unaffiliated/mattoufoutu] has joined #openvpn
10:08 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
10:08 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:08 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17502> || openvpn route add not working <http://forums.openvpn.net/topic9205.html#p17501> || OpenVPN SSH Tunnel <http://forums.openvpn.net/topic9196.html#p17500>
10:11 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
10:14 <@vpnHelper> RSS Update - forum: openvpn route add not working <http://forums.openvpn.net/topic9205.html#p17503>
10:20 <@vpnHelper> RSS Update - forum: openvpn route add not working <http://forums.openvpn.net/topic9205.html#p17505> || topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17504>
10:25 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:26 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17506>
10:32 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:32 -!- mode/#openvpn [+o mattock] by ChanServ
10:48 -!- Synthead [~max@173-165-179-126-atlanta.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
10:48 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:50 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
10:53 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
11:02 <@vpnHelper> RSS Update - forum: OpenVPN Client Program customization <http://forums.openvpn.net/topic9200.html#p17507>
11:03 -!- b0gatyr [~b0gatyr@unaffiliated/b0gatyr] has joined #openvpn
11:04 < b0gatyr> hey guys, how do I set a domain-search on a client config file?
11:04 < b0gatyr> search domain being pushed by the server is not the one I want.
11:04 < b0gatyr> and I don't have access to that server
11:04 < orange-hand> Hi, my openvpn starts without complaining, but there is no tun device
11:05 < orange-hand> when I use --mktun, I get "Hi, I am getting "Note: Cannot open TUN/TAP dev /dev/net/tun: Permission denied"
11:05 < b0gatyr> can I just use "dhcp-option Domain ..." on the client config?
11:05 < orange-hand> modprobe tun says no such module
11:30 -!- Druid_ [~Druid@p5B05D65A.dip.t-dialin.net] has quit []
11:49 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
11:53 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
11:54 -!- me345 [~me345@adsl-71-131-134-78.dsl.sntc01.pacbell.net] has joined #openvpn
11:55 -!- tty234 [telex@gateway/shell/anapnea.net/x-kfneyhjzkbnonzwl] has joined #openvpn
12:04 -!- Synthead [~max@173-165-179-126-atlanta.hfc.comcastbusiness.net] has joined #openvpn
12:15 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
12:19 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 258 seconds]
12:32 <+hyper_ch> dazo: http://digitallife.today.msnbc.msn.com/_news/2011/11/10/8739346-man-calls-911-five-times-to-complain-about-broken-iphone
12:32 <@vpnHelper> Title: Digital Life - Man calls 911 five times to complain about broken iPhone (at digitallife.today.msnbc.msn.com)
12:33 -!- HopsNBarley [~hops@nslu2-linux/HopsNBarley] has quit [Quit: Leaving]
12:45 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17508>
12:51 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 240 seconds]
12:57 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17509>
13:12 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:15 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17510>
13:21 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17511>
13:33 -!- ePlus [~zuma@217.28.10.143] has quit [Read error: Connection reset by peer]
13:35 -!- EugeneSleep is now known as EugeneKay
14:10 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
14:50 -!- happylife [~happylife@212.92.145.7] has quit [Ping timeout: 258 seconds]
14:53 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:53 -!- happylife [~happylife@212.92.145.7] has joined #openvpn
14:53 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:01 < gladiatr> ls -l
15:03 <+EugeneKay> drwx------ 3 eugenekay eugenekay 4096 Dec 9 1988 eugenekay/
15:03  * gladiatr chuckles
15:07 <+EugeneKay> Hrm, there isnt a trailing slash in proper ls -l output
15:12 < gladiatr> it depends on your shell
15:12 <+EugeneKay> bash 4 lyfe
15:28 < datruth> Is there no way to run openvpn in a non admin account with encrypted keys?
15:30 < gladiatr> there is no way
15:30 < jeev> pico for life
15:30 < datruth> this is a disaster
15:30 < datruth> ;(
15:31 < jeev> aint that da truth.
15:31 < gladiatr> I believe that's referred to as hyperbole
15:32 < datruth> how could I apply a .patch file to a windows exe file?
15:33 <+EugeneKay> You.... can't.... what?
15:35 < datruth> didn't know if it could be done or not I seen a .patch file that was supposed to allow the user the password prompt for hte key
15:44 -!- An_Ony_Moose [~linus@skysimulation.de] has joined #openvpn
15:45 < An_Ony_Moose> is there any chance of accessing an VPN from a windows computer without admin rights?
15:53 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
16:01 -!- Synthead [~max@173-165-179-126-atlanta.hfc.comcastbusiness.net] has quit [Quit: p33 ba115]
16:05 -!- novaflash is now known as novaflash_away
16:14 -!- An_Ony_Moose [~linus@skysimulation.de] has left #openvpn []
16:49 -!- newl [~newl@97.75.165.156] has joined #openvpn
16:55 -!- dazo is now known as dazo_afk
17:19 -!- me345 [~me345@adsl-71-131-134-78.dsl.sntc01.pacbell.net] has quit [Read error: Connection reset by peer]
17:26 -!- vtcN- [~vtcN@unaffiliated/thethe] has quit [Remote host closed the connection]
17:27 -!- davlefou [~david@41.225.194.107] has left #openvpn ["Konversation terminated!"]
17:55 -!- countd [~countd@unaffiliated/countd] has quit [Read error: Operation timed out]
18:17 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
18:23 < datruth> what admin rights does openvpn need to work properly
18:25 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
18:26 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
18:27 -!- Ionic [ionic@ionic.de] has joined #openvpn
18:28 < datruth> maybe I can create a special group to it
18:39 < newl> you'll need necessary privileges to close and reopen the TUN/TAP interface. <- from man openvpn
18:39 < datruth> Hrmm okay I just need to find what access right does that
18:41 < newl> ls -l /dev/   will give you a start
18:41 < datruth> newl: i'm on windows
18:42 < newl> oh sorry ... moment of silence follows
18:43 < datruth> heheh
18:51 -!- MatToufoutu [~MaT@unaffiliated/mattoufoutu] has left #openvpn ["Quitte"]
18:59 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 244 seconds]
18:59 < datruth> could openvpn be comparable to windows 2008 vpn?
19:02 < newl> isn't windows 2008 vpn pptp?
19:03 < datruth> I thought it could do l2pt
19:03 < datruth> ipsec
19:04 < newl> you can do strongswan to windows 7 .. don't know any more then that - probably openvpn is way to go easily betwix different os
19:05 < datruth> I think openvpn is the way to go to but becuase of the limited access in non-admin account this creates a huge problem
19:07 -!- fapI [~fapi@c-71-229-141-122.hsd1.co.comcast.net] has joined #openvpn
19:08 -!- fapI [~fapi@c-71-229-141-122.hsd1.co.comcast.net] has quit [Client Quit]
19:16 <@vpnHelper> RSS Update - forum: unknown opcode received <http://forums.openvpn.net/topic9203.html#p17512>
19:22 -!- dxtr [~dxtr@2a00:16d8:2:300::2] has joined #openvpn
19:22 -!- dxtr [~dxtr@2a00:16d8:2:300::2] has quit [Changing host]
19:22 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
19:31 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has joined #openvpn
19:34 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has left #openvpn []
19:54 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Remote host closed the connection]
19:55 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
20:00 -!- dxtr [~dxtr@2a00:16d8:2:300::2] has joined #openvpn
20:00 -!- dxtr [~dxtr@2a00:16d8:2:300::2] has quit [Changing host]
20:00 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
20:05 -!- baobei [~robott@58.34.139.7] has joined #openvpn
20:06 < baobei> Hi. How to setup the pki certs/keys while keeping the ca.key on a stand alone machine disconnected from internet for entire procesS?
20:06 < baobei> Don't like the idea of making the ca.key on the server as per the How To
20:07 <+EugeneKay> Use a flash drive.
20:08 <+EugeneKay> I use XCA running on a non-networked laptop(from 5 years ago), and a small flash drive to move files on/off.
20:11 < baobei> i mean i'm not sure how to do it, i need to create a csr?
20:11 < Essobi> Yea, I have some hand rolled scripts I use with the easyrsa 2.0.
20:11 < baobei> there's no how to on the internet about this
20:12 <+EugeneKay> Depends how you want to do your server.key and client.key generation. If you want to keep them at the place-of-use, you would need .csr
20:12 < baobei> i just know how to use easy-rsa on my linux server then winscp to windows pc
20:12 <+EugeneKay> I prefer to generate all of mine in a single location(my laptop), and then disseminate them securely along with the .crts(flash drive to desktop, SSH to destination)
20:20 -!- ravel_exe [ravel_exe@175.136.85.157] has joined #openvpn
20:25 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
20:26 -!- Denial [Denial@drgi.co.uk] has quit []
21:06 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:09 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
21:38 -!- up_the_irons [~garry@iron.arpnetworks.com] has quit [Quit: WeeChat 0.3.0]
21:42 -!- master_of_master [~master_of@p57B52975.dip.t-dialin.net] has quit [Read error: Operation timed out]
21:44 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:46 -!- master_of_master [~master_of@p57B52439.dip.t-dialin.net] has joined #openvpn
22:02 -!- ravel_exe [ravel_exe@175.136.85.157] has quit []
22:09 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has joined #openvpn
22:09 -!- attila_lendvai [~attila_le@62-84-55-107.customers.almanet.kz] has quit [Changing host]
22:09 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has joined #openvpn
22:34 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:08 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Quit: Reconnecting]
23:08 -!- dxtr [~dxtr@2a00:16d8:2:300::2] has joined #openvpn
23:08 -!- dxtr [~dxtr@2a00:16d8:2:300::2] has quit [Changing host]
23:08 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
23:10 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Client Quit]
23:10 -!- dxtr [10dc7430@2a00:16d8:2:300::2] has joined #openvpn
23:10 -!- dxtr [10dc7430@2a00:16d8:2:300::2] has quit [Changing host]
23:10 -!- dxtr [10dc7430@unaffiliated/dxtr] has joined #openvpn
23:17 <@vpnHelper> RSS Update - forum: Redirect active connections to a OpenVPn tunnel <http://forums.openvpn.net/topic9206.html>
23:40 -!- attila_lendvai [~attila_le@unaffiliated/attila-lendvai/x-3126965] has quit [Ping timeout: 240 seconds]
23:53 -!- SJrX is now known as SJr
--- Day changed Sat Nov 12 2011
00:22 -!- jmazaredo [~IceChat77@121.54.29.50] has joined #openvpn
00:23 < jmazaredo> hi, is there a way to only use open vpn as the medium of connection and dont use the local lan?
00:24 < jmazaredo> when my vpn drops it auto revert to the local what i want to accomplish is only use vpn
00:42 <+EugeneKay> Sure. Set your firewall to drop traffic going out your LAN interface that isn't destined for the VPN server
00:43 < jmazaredo> will try :D
00:43 < jmazaredo> thanks!
00:43 <+EugeneKay> You could also do it by eliminating the "default" gateway, and instead setting only a route for the vpn server via the default gw
00:44 <+EugeneKay> That will still allow it to speak to other machines on the LAN, tho
00:44 < jmazaredo> eliminating the gateway? so how am i suppose to go outside if no gateway?
00:45 <+EugeneKay> "default gateway" just means "0.0.0.0/0" as a route
00:45 < jmazaredo> so i delete that?
00:45 < jmazaredo> delete all routing?
00:46 <+EugeneKay> Aye. You need a route for the vpn server's IP(using the old Gateway as your next-hop).
00:46 <+EugeneKay> It's not as airtight, tho
00:46 < jmazaredo> my setup is a vm ( nat'd) 
00:48 < jmazaredo> well ill just try to use fw
00:48 < jmazaredo> think its kinda hard
00:48 < jmazaredo> :D
00:49 -!- LowKey [rhel@unaffiliated/lowkey] has left #openvpn ["Leaving"]
00:49 <+EugeneKay> I presume you're trying to prevent "leaking" your actual IP?
00:49 < jmazaredo> yes
00:49 <+EugeneKay> I would use the firewall method, then
00:50 < jmazaredo> drop all packets going out from lan
00:50 < jmazaredo> so if vpn disconnects i wont have internet
00:50 <+EugeneKay> Basically, yes. Except to the VPN server.
00:51 < jmazaredo> so i just allow the vpn program out and no other stuff is that correct?
00:51 <+EugeneKay> note that if your config uses a hostname, you'll never be able to reconnect because the DNS lookups are being dropped. Switch it to IP :-p
00:51 <+EugeneKay> Yup.
00:51 < jmazaredo> hehee
00:51 < jmazaredo> ok will try that 
00:54 -!- jmazaredo_ [~IceChat77@121.54.29.50] has joined #openvpn
00:55 -!- jmazaredo [~IceChat77@121.54.29.50] has quit [Ping timeout: 240 seconds]
00:59 -!- jmazaredo_ [~IceChat77@121.54.29.50] has quit [Ping timeout: 240 seconds]
01:29 <@vpnHelper> RSS Update - forum: Can connect to VPN but can't ping clients behind the VPN <http://forums.openvpn.net/topic9204.html#p17514>
01:34 -!- jokar [~mohsen@188.75.84.162] has joined #openvpn
01:34 < jokar> all:
01:34 < jokar> hello all
01:35 < jokar> can i use openvpn for bypass filtering?
01:35 < jokar> :-/
01:35 < jokar> like tor
01:37 < jokar> can you help me?
01:38 < jokar> o/ all:
01:57 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:46 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
02:46 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
02:46 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
03:07 -!- jokar [~mohsen@188.75.84.162] has quit [Ping timeout: 258 seconds]
03:12 -!- zebedee3 [~neil@027c163b.bb.sky.com] has joined #openvpn
03:13 -!- jokar [~mohsen@188.75.84.162] has joined #openvpn
04:00 -!- novaflash_away is now known as novaflash
04:33 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
04:43 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
04:53 -!- jeev [1004@unaffiliated/jeev] has quit [Read error: Operation timed out]
04:55 -!- jeev [~email@99-9-136-92.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
04:58 -!- jeev__ [1004@216.59.33.80] has joined #openvpn
05:03 -!- jeev__ [1004@216.59.33.80] has quit [Ping timeout: 258 seconds]
05:14 -!- orange-hand-II [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
05:14 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Ping timeout: 248 seconds]
05:27 -!- jeev__ [1004@216.59.33.80] has joined #openvpn
05:33 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
05:52 < jokar> all:
05:52 < jokar> can you help me?
05:56 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:08 -!- ravel_exe [~ravel_exe@175.136.85.157] has joined #openvpn
06:08 -!- baobei [~robott@58.34.139.7] has quit []
06:15 -!- pierreghz [~pierreghz@cust-47-104-111-94.dyn.as47377.net] has joined #openvpn
06:24 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
06:34 -!- pierreghz [~pierreghz@cust-47-104-111-94.dyn.as47377.net] has quit [Quit: Quitte]
06:34 < jokar> can i use openvpn for bypass filtering?
06:37 -!- zebedee3 [~neil@027c163b.bb.sky.com] has quit [Quit: Ex-Chat]
06:39 -!- pierreghz [~pierreghz@cust-47-104-111-94.dyn.as47377.net] has joined #openvpn
06:48 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
07:05 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
07:05 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
07:14 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
07:14 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
07:14 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:33 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
07:47 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
07:53 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
08:07 <@vpnHelper> RSS Update - forum: How much resources does 4 users consume on VPS <http://forums.openvpn.net/topic9207.html>
09:10 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
09:13 <@vpnHelper> RSS Update - forum: How much resources does 4 users consume on VPS <http://forums.openvpn.net/topic9207.html#p17516>
09:26 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
09:37 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
10:05 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 276 seconds]
10:11 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:14 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
10:25 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
10:26 -!- jokar [~mohsen@188.75.84.162] has left #openvpn []
10:27 -!- jeev [~email@99-9-136-92.lightspeed.irvnca.sbcglobal.net] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
10:27 -!- jeev__ is now known as jeev
10:27 -!- jeev [1004@216.59.33.80] has quit [Changing host]
10:27 -!- jeev [1004@unaffiliated/jeev] has joined #openvpn
10:34 -!- vpopov [~happylife@46.251.84.160] has joined #openvpn
10:35 -!- vpopov [~happylife@46.251.84.160] has quit [Read error: Connection reset by peer]
10:35 -!- vpopov [~happylife@46.251.84.160] has joined #openvpn
10:37 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
10:38 -!- vpopov [~happylife@46.251.84.160] has quit [Read error: Connection reset by peer]
10:38 -!- vpopov [~happylife@46.251.84.160] has joined #openvpn
11:19 -!- vpopov [~happylife@46.251.84.160] has quit [Quit: Leaving]
11:19 -!- vpopov [~happylife@46.251.84.160] has joined #openvpn
11:37 -!- pierreghz_ [~pierreghz@cust-47-104-111-94.dyn.as47377.net] has joined #openvpn
11:40 -!- pierreghz [~pierreghz@cust-47-104-111-94.dyn.as47377.net] has quit [Ping timeout: 260 seconds]
11:49 -!- pierreghz__ [~pierreghz@cust-47-104-111-94.dyn.as47377.net] has joined #openvpn
11:52 -!- pierreghz_ [~pierreghz@cust-47-104-111-94.dyn.as47377.net] has quit [Ping timeout: 260 seconds]
11:58 -!- vpopov [~happylife@46.251.84.160] has quit [Read error: Connection reset by peer]
12:04 -!- cyrus_mc [~cyrus@72-254-177-128.client.stsn.net] has joined #openvpn
12:05 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:15 -!- vpopov [~happylife@46.251.84.160] has joined #openvpn
12:31 < cyrus_mc> Issue when connected to my VPN. After connected I SSH to a system over the VPN. Everything works fine until output of commands that seem to produce a lot of output lock up. The VPN itself isn't locked up, since I just close the SSH connection and re-connect
12:53 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
13:26 -!- WebDawg [~WebDawg@officialg0d.com] has quit [Read error: Operation timed out]
13:31 -!- WebDawg [~WebDawg@officialg0d.com] has joined #openvpn
13:39 -!- cyrus_mc [~cyrus@72-254-177-128.client.stsn.net] has quit [Quit: leaving]
14:06 -!- bittracker [~bittracke@g230121118.adsl.alicedsl.de] has joined #openvpn
14:07 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
14:08 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
14:09 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:20 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html#p17517>
14:44 -!- Jonas29 [~chatzilla@modemcable086.102-179-173.mc.videotron.ca] has joined #openvpn
14:44 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180.html#p17518>
14:44 < Jonas29> hello all
14:45 < Jonas29> do you have a person that he speak french. I would have help with openvpn
14:46 <+EugeneKay> I took a couple classes in high school, but I can't speak it, sorry.
14:48 -!- newl [~newl@97.75.165.156] has joined #openvpn
14:48 < Jonas29> ok because I am faced with an annoying problems
14:51 < Jonas29> I use windows vista and openvpn
14:51 < Jonas29> and I subscribe at a vpn service to function with openvpn
14:52 < Jonas29> or to connect at openvpn. I must right clique run as admin and enter to password
14:53 < Jonas29> I would like know if possible to connect at a vp
14:54 <+EugeneKay> !win_noadmin
14:54 <@vpnHelper> "win_noadmin" is (#1) http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin-Rev1.1.html for HowTo Run OpenVPN as a non-admin user in Windows or (#2) and http://article.gmane.org/gmane.network.openvpn.user/24873 for vista
14:56 -!- newl [~newl@97.75.165.156] has left #openvpn []
14:58 < Jonas29> EugeneKay:  trhe first link is validate to windows vista or juste to windows previous
14:59 <+EugeneKay> First link is for XP. You want the second one.
15:03 < Jonas29> EugeneKay:  I do not really handling
15:05 < Jonas29> do you want to explan
15:05 < Jonas29> do you want to explain
15:06 <+EugeneKay> Read the second link.
15:10 < Jonas29> I am in the second link
15:15 <+EugeneKay> Sorry I can't be of much help - I don't use openvpn on windows much.
15:17 -!- Jonas29 [~chatzilla@modemcable086.102-179-173.mc.videotron.ca] has quit [Ping timeout: 240 seconds]
15:23 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
15:34 -!- Jonas29 [~chatzilla@modemcable086.102-179-173.mc.videotron.ca] has joined #openvpn
15:41 -!- dxtr_ [98404f9a@2a00:16d8:2:300::2] has joined #openvpn
15:55 -!- krzie [krzee@hemp.ircpimps.org] has joined #openvpn
15:55 -!- krzie [krzee@hemp.ircpimps.org] has quit [Changing host]
15:55 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:59 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:03 <@vpnHelper> RSS Update - forum: unknown opcode received <http://forums.openvpn.net/topic9203.html#p17521> || Can connect to VPN but can't ping clients behind the VPN <http://forums.openvpn.net/topic9204.html#p17520> || topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17519>
16:09 <@vpnHelper> RSS Update - forum: Redirect active connections to a OpenVPn tunnel <http://forums.openvpn.net/topic9206.html#p17522>
16:14 -!- bittracker [~bittracke@g230121118.adsl.alicedsl.de] has quit [Quit: Verlassend]
16:27 -!- Jonas29 [~chatzilla@modemcable086.102-179-173.mc.videotron.ca] has quit [Ping timeout: 240 seconds]
16:37 -!- newl [~newl@97.75.165.156] has joined #openvpn
16:56 -!- pierreghz__ [~pierreghz@cust-47-104-111-94.dyn.as47377.net] has quit [Quit: Quitte]
16:57 -!- orange-hand-II [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Ping timeout: 248 seconds]
17:00 -!- novaflash is now known as novaflash_away
17:11 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
18:13 -!- vpopov [~happylife@46.251.84.160] has quit [Read error: No route to host]
18:19 -!- Denial [~Denial@drgi.co.uk] has quit []
18:23 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
18:58 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
19:28 -!- kralor [~kralor@hackincorp.net] has joined #openvpn
19:30 < kralor> hey guys, I'm trying to figure out how to connect to a VPN server and then be able to browse internet from there
19:30 < kralor> any help?
19:33 < krzie> !redirect
19:33 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
19:34 < kralor> !nat
19:34 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
19:34 < kralor> !linnat
19:34 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
19:38 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:00 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:01 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Remote host closed the connection]
20:32 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
21:20 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
21:21 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:23 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
21:23 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:26 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
21:27 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:30 -!- Jonas29 [~chatzilla@vpn2.freedom-ip.com] has joined #openvpn
21:34 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
21:35 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
21:36 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Excess Flood]
21:37 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
21:43 -!- Pilif12p is now known as Pilif|Meeting
21:44 -!- Jonas29 [~chatzilla@vpn2.freedom-ip.com] has quit [Ping timeout: 240 seconds]
21:44 -!- master_of_master [~master_of@p57B52439.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
21:46 -!- master_of_master [~master_of@p57B55319.dip.t-dialin.net] has joined #openvpn
22:01 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:25 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
22:26 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
22:29 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
22:31 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
22:32 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
22:33 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:33 -!- ravemaster [4addd142@gateway/web/freenode/ip.74.221.209.66] has joined #openvpn
22:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:35 < ravemaster> may I ask where can I see in the in the source code the messages that appear on the log file of openvpn
22:37 < ravemaster> please answer me guys
22:42 -!- ravemaster [4addd142@gateway/web/freenode/ip.74.221.209.66] has quit [Ping timeout: 265 seconds]
22:52 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
23:35 < ecrist> lol
23:35 -!- Pilif|Meeting is now known as Pilif12p
23:53 -!- mgorbach [~mgorbach@209-128-67-099.bayarea.net] has joined #openvpn
23:54 < mgorbach> I'm trying to set up a TAP openpvn connection between visocity on a mac and my synology box. I'm getting a TLS error. Can anyone help?
23:54 < mgorbach> Nov 12 21:53:55: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
23:54 < mgorbach> Nov 12 21:53:55: TLS Error: TLS handshake failed
23:54 < mgorbach> Nov 12 21:53:55: SIGUSR1[soft,tls-error] received, process restarting
23:57 < krzee> general network error
23:57 < ecrist> !logs
23:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
23:58 < krzee> either the server isnt running, you're using the wrong ip/port/protocol on the client,  the server's firewall has an issue, or the client's isp is blocking it
--- Day changed Sun Nov 13 2011
00:07 < mgorbach> Fixed that, looks like there as a configuration and the server didn't come up initially.
00:08 < mgorbach> I would appreciate some help trying to set up TAP bridging such that it works with bonjour.
00:08 < mgorbach> So far, I can connect via TAP and I get an IP, but I can only see and access bonjour devices on the specific machine I'm connecting to, not on the entire netowrk.
00:09 < mgorbach> http://pastebin.com/47BXSXwV
00:09 < mgorbach> Is my config file
00:10 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
00:10 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
00:11 < mgorbach> I think maybe the subnet is configured correctly?
00:15 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has quit [Quit: ZNC - http://znc.sourceforge.net]
00:15 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Quit: У меня есть более важные дела, чем холостой здесь.]
00:15 <@vpnHelper> RSS Update - forum: failed to find gid for group openvpn <http://forums.openvpn.net/topic9208.html>
00:16 -!- Pilif12p [~Tanner@firefox/community/pilif12p] has joined #openvpn
00:19 < krzee> !learn timeout as if you see "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)"  then your problem is likely one of the following:  either the server isnt running, your client is connecting to the wrong ip/port/protocol,  the server's firewall/nat has an issue, or the client's isp blocks it
00:19 <@vpnHelper> Joo got it.
00:19 < krzee> !timeout
00:19 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
00:20 < mgorbach> krzee: I'm not seeing a TLS error any more. I can log in just fine. What I'm trying to understand is why I seem to be connecting only to the machine running the openvpn server, as opposed to the whole network.
00:22 < krzee> ya i was just teaching my bot
00:22 < krzee> i dont do tap setups
00:22 < mgorbach> ah, ok. Just wish I knew more about what the "route" statements in the config file actually did.
00:23 < krzee> if you need layer2 lan sharing you need server-bridge
00:23 < krzee> along with some other stuff
00:23 < krzee> first, you sure you need layer2?
00:24 < mgorbach> I beleive I do. I'm looking to set access the bonjour serivces on the remote network, and that's mDNS, so I beleive that is done through broadcast (layer2).
00:24 < mgorbach> *to access the bonjour
00:25 < krzee> ahh ok
00:25 < krzee> no idea what bonjour is, but ill assume it requires layer2 ;]
00:25 < krzee> (ive heard of it)
00:25 < krzee> !bridge
00:25 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
00:26 < mgorbach> Bonjour is just Apple's name for mDNS. Which is multicast used for autodiscovery of network services.
00:26 < mgorbach> And yes, from the little I know of the OSI stack, is layer 2.
00:26 < krzee> i wont be able to help you with that, but thats what you need for sharing layer2 to the lan
00:26 < krzee> you were mixing methods
00:26 < krzee> route commands and such is layer3
00:27 < mgorbach> Ah, I see. Yeah I'm a config file that was used for layer 3.
00:27 < mgorbach> Also, are there disadvantages to bridging?
00:27 < krzee> yep
00:28 < krzee> doesnt scale well at all, extra overhead, layer2 wasnt made with security in mind
00:30 < mgorbach> At this point it's really just one or two clients, never more than that.
00:30 -!- mgorbach [~mgorbach@209-128-67-099.bayarea.net] has left #openvpn []
00:30 -!- mgorbach [~mgorbach@209-128-67-099.bayarea.net] has joined #openvpn
00:30 < mgorbach> Is there a chance it would slow down the remote network I would be connecting to
00:32 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
00:35 < krzee> sure, however much network its using to send to you is that much less it can use for other things
00:35 -!- Pilif12p_ [~Pilif12p@techessentials.org] has joined #openvpn
00:36 < krzee> how noticeable that is depends on how much traffic its sending to your clients, and how much it can send
00:40 -!- Pilif12p [~Tanner@firefox/community/pilif12p] has quit [Quit: If you haven't found it yet, keep looking. Don't settle. As with all matters of the heart, you'll know when you find it. And, like any great relationship, it just gets better and better as the years roll on.  --Steve Jobs]
00:56 < mgorbach> hmm, this looks strangely difficult to set up. Looks like you need a bridge interface (br0) through the linux kernel, which requires a module or support compiled in.
00:58 < krzee> yep
00:59 < krzee> bridging is more complicated to setup
01:00 < krzee> and if the server is remote, i suggest having an ipkvm or something, cause you may lock up your network while testing
01:00 < krzee> or at least someone on hand to reboot
01:10 < mgorbach> krzee: Thankfully, the girlfriend is around to do that ;)
01:21 <+hyper_ch> hi krzee
01:44 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
01:46 -!- LumberCartel [~LumberCar@96.53.47.42] has joined #openvpn
01:46 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:03 -!- LumberCartel [~LumberCar@96.53.47.42] has quit [Quit: RFCs the easy way -- http://www.openrfc.org/]
02:15 <@vpnHelper> RSS Update - forum: Can connect to VPN but can't ping clients behind the VPN <http://forums.openvpn.net/topic9204.html#p17524>
02:17 <+EugeneKay> That's not what girlfriends are usually around for
02:17 <+EugeneKay> #justsayin
02:19 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
02:40 -!- novaflash_away is now known as novaflash
02:42 < mgorbach> Anyone know about public / private key authentication for openvpn?
02:42 < mgorbach> I'm trying to understand, doesn't the server need public keys for each client?
02:42 <+EugeneKay> It's SSL PKI based. 
02:43 <+EugeneKay> The server checks that the client's certificate(akin to a ssh pubkey, but not quite) is signed by the CA it has on file.
02:43 < mgorbach> Ah, interesting.
02:43 <+EugeneKay> And the reverse for clients
02:43 < mgorbach> And the way it gets the client public certificate is because the client sends it during authentication?
02:43 <+EugeneKay> You should also be checking that the cert types(client/server) are correct, to prevent a client cert from being used to impersonate a server, but that is optional.
02:44 <+EugeneKay> Correct.
02:44 < mgorbach> Ah, that makes sense. I've only dealt with SSH authentication thus far.
02:44 <+EugeneKay> The certificates, much like ssh or gpg pubkeys, are public.
02:44 <+EugeneKay> But the central signign authority is used, rather than a list of valid pubkeys
02:45 < mgorbach> And the CA is what you generate with easy_rsa?
02:45 <+EugeneKay> easy-rsa will generate a lot of things, the CA being the first one.
02:45 < mgorbach> Makes sense.
02:45 < mgorbach> Lastly, what is the DH file that easy_rsa makes?
02:46 < mgorbach> I'm just following guides, but also trying to understand what the hell I'm actually doing and why.
02:46 <+EugeneKay> Just some magic numbers for the Diffie-Helman exchange. Wikipedia it for a proper writeup.
02:46 <+EugeneKay> SSHd uses a similar thing, /etc/ssh/moduli
02:46 < mgorbach> Is it shared with the client?
02:47 <+EugeneKay> Kind of. Please, let Wikipedia explain how DH works :-p
02:59 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Remote host closed the connection]
02:59 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
03:02 < krzee> !pki
03:02 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
03:02 <@vpnHelper> specially as a server (see !servercert)
03:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
03:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
03:47 <+EugeneKay> Oooh, didn't know that existed.
03:47 <+EugeneKay> Handy.
03:47 <+EugeneKay> Also, damn you OS x
04:10 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:37 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
04:45 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
04:47 -!- wamty [wamty@63.216.116.219] has joined #openvpn
04:47 < wamty> I'm trying to set up an ipsec vpn but my openbsd gateway is between a nat router... can it be done?
04:47 < krzee> !notovpn
04:47 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
04:47 < krzee> !notcompat
04:47 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible or (#2) openvpn only connects to openvpn
04:48 < wamty> hmmm
04:48 < wamty> what should i do then?
04:48 < wamty> i thought that openvpb is my solution
04:52 < wamty> krzee: i wouldnt call ipsec's protocol proprietary ?
04:52 < wamty> is it proprietary?
04:55 < dym> wamty: try #strongswan
04:59 < krzee> IPsec over UDP and IPsec over TCP are proprietary to Cisco.
05:00 < krzee> IPsec over Nat-T is an open standard... but either way is not supported here
05:27 -!- mmbeck [mmbeck@home.akausal.de] has quit [Ping timeout: 245 seconds]
05:27 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
05:30 -!- ravel_exe [~ravel_exe@175.136.85.157] has quit []
05:36 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
05:37 -!- jemand [~quassel@brln-4db9e987.pool.mediaWays.net] has joined #openvpn
05:56 -!- TomFyuri [~Tom_Fyuri@moloko.TeNeT.Odessa.UA] has joined #openvpn
05:58 <@vpnHelper> RSS Update - forum: TCP: connect to 174.127.64.104:443 failed <http://forums.openvpn.net/topic9209.html>
06:05 -!- wamty [wamty@63.216.116.219] has quit [Ping timeout: 258 seconds]
06:08 -!- vpopov [~happylife@46.251.84.160] has joined #openvpn
06:08 -!- wamty [wamty@178.135.85.112] has joined #openvpn
06:34 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:43 -!- TomFyuri [~Tom_Fyuri@moloko.TeNeT.Odessa.UA] has left #openvpn []
07:25 -!- Netsplit *.net <-> *.split quits: datruth, statix, R-66Y, chantra, Optic, vpopov, dvl, ScriptFanix, vtcN-, sia^pwnnt,  (+81 more, use /NETSPLIT to show all of them)
07:25 -!- Netsplit *.net <-> *.split quits: Jarpse, Dougy, amir, Essobi, qubits, stevefink, beerbro
07:28 -!- Netsplit over, joins: cron2, stevefink, _zero_
07:28 -!- Netsplit over, joins: zalzice, civillian, nickzxcv, ronnocol, Champi, fahadsadah, ]R[, EugeneKay, spditner, kenyon (+24 more)
07:28 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
07:28 -!- Netsplit over, joins: StFS, Nowak, nifiga, Fleck, dym, caesay, R-66Y, +oc80z
07:28 -!- ServerMode/#openvpn [+ovv cron2 EugeneKay oc80z] by verne.freenode.net
07:28 -!- Netsplit over, joins: gardar, qubits, kloeri
07:28 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
07:28 -!- Netsplit over, joins: +novaflash, Jarpse, Essobi, beerbro, amir, Dougy, EvilJStoker, MrWGW, APTX, RichardBronosky (+14 more)
07:28 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9210.html>
07:28 -!- Netsplit over, joins: b0gatyr, zu, rooth, agagag, sia^pwnnt, MrPPS, __nolife
07:28 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
07:28 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
07:28 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
07:28 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
07:28 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
07:28 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
07:29 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
07:30 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
07:30 -!- Ionic [ionic@ionic.de] has joined #openvpn
07:30 -!- mgorbach [~mgorbach@209-128-67-099.bayarea.net] has joined #openvpn
07:30 -!- dxtr_ [98404f9a@2a00:16d8:2:300::2] has joined #openvpn
07:30 -!- ruied [~ruied@po-217-129-154-119.netvisao.pt] has joined #openvpn
07:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:30 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
07:30 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
07:30 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
07:30 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
07:30 -!- diytto [~diytto@2001:470:25:59c::1337] has joined #openvpn
07:30 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
07:30 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
07:30 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
07:30 -!- fremo_ [~fremo@noc.toile-libre.net] has joined #openvpn
07:30 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
07:30 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
07:30 -!- sno-_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
07:30 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
07:30 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
07:30 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
07:30 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
07:30 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:31 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
07:31 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
07:32 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:44 -!- Netsplit *.net <-> *.split quits: R-66Y, datruth, statix, chantra, Optic, vpopov, ScriptFanix, vtcN-, corretico, kralor,  (+75 more, use /NETSPLIT to show all of them)
07:45 -!- Netsplit over, joins: +novaflash, kralor, tty234, Gud, vereteran, gladiatr, mick_laptop, deever, RichardBronosky, APTX (+2 more)
07:47 -!- R-66Y [~nobody@elegua.za.net] has joined #openvpn
07:47 -!- caesay [~caesay@socialshock.net] has joined #openvpn
07:47 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:47 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
07:47 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
07:47 -!- sno-_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
07:47 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
07:47 -!- chantra [~chantra@unaffiliated/chantra] has joined #openvpn
07:47 -!- fremo_ [~fremo@noc.toile-libre.net] has joined #openvpn
07:47 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
07:47 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
07:47 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
07:47 -!- diytto [~diytto@2001:470:25:59c::1337] has joined #openvpn
07:47 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
07:47 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
07:47 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
07:47 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
07:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:47 -!- ruied [~ruied@po-217-129-154-119.netvisao.pt] has joined #openvpn
07:47 -!- dxtr_ [98404f9a@2a00:16d8:2:300::2] has joined #openvpn
07:47 -!- mgorbach [~mgorbach@209-128-67-099.bayarea.net] has joined #openvpn
07:47 -!- Ionic [ionic@ionic.de] has joined #openvpn
07:47 -!- Dougy [me@tech.qsi.net] has joined #openvpn
07:47 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:47 -!- beerbro [~gustav@unaffiliated/beerbroy] has joined #openvpn
07:47 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
07:47 -!- Jarpse [~jarpse@cruft.geek.cx] has joined #openvpn
07:47 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
07:47 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
07:47 -!- qubits [~zero@unaffiliated/qubits] has joined #openvpn
07:47 -!- gardar [~gardar@gardar.net] has joined #openvpn
07:47 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
07:47 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
07:47 -!- nifiga [niko@luchshe.vdalnete.ru] has joined #openvpn
07:47 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
07:47 -!- StFS [~stefan@gagnasetur.ru.is] has joined #openvpn
07:47 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
07:47 -!- scoopex [~scoopex@85.214.140.184] has joined #openvpn
07:47 -!- inimino [~inimino@69.164.198.129] has joined #openvpn
07:47 -!- reisi [koivunej@mustatilhi.cs.tut.fi] has joined #openvpn
07:47 -!- datruth [datruth@gotpot.org] has joined #openvpn
07:47 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:47 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
07:47 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
07:47 -!- statix [statix@rrcs-208-125-52-150.nys.biz.rr.com] has joined #openvpn
07:47 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has joined #openvpn
07:47 -!- ServerMode/#openvpn [+v oc80z] by verne.freenode.net
07:47 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
07:47 -!- Pilif12p_ [~Pilif12p@techessentials.org] has joined #openvpn
07:47 -!- vpopov [~happylife@46.251.84.160] has joined #openvpn
07:47 -!- jemand [~quassel@brln-4db9e987.pool.mediaWays.net] has joined #openvpn
07:47 -!- corretico [~luis@201.201.44.82] has joined #openvpn
07:47 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
07:47 -!- WebDawg [~WebDawg@officialg0d.com] has joined #openvpn
07:47 -!- dxtr [10dc7430@unaffiliated/dxtr] has joined #openvpn
07:47 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
07:47 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
07:47 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
07:47 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
07:47 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
07:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:47 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
07:47 -!- spditner [~simon@206-248-134-157.dsl.teksavvy.com] has joined #openvpn
07:47 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
07:47 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has joined #openvpn
07:47 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
07:47 -!- Champi [Champi@rootshell.fr] has joined #openvpn
07:47 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
07:47 -!- nickzxcv [~nick@2001:470:1:41::d8da:df73] has joined #openvpn
07:47 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
07:47 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
07:47 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
07:47 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
07:47 -!- ServerMode/#openvpn [+vo EugeneKay cron2] by verne.freenode.net
07:47 -!- stevefink [steve@shell.vaerchi.com] has quit [Excess Flood]
07:47 -!- stevefink [steve@shell.vaerchi.com] has joined #openvpn
07:48 -!- caesay is now known as Guest79480
07:50 -!- dym [~patrick@osnabrueck.it] has joined #openvpn
07:50 -!- dym [~patrick@osnabrueck.it] has quit [Changing host]
07:50 -!- dym [~patrick@unaffiliated/dym] has joined #openvpn
07:52 <@vpnHelper> RSS Update - forum: unknown opcode received <http://forums.openvpn.net/topic9203.html#p17527>
08:04 <@vpnHelper> RSS Update - forum: Confused by my results <http://forums.openvpn.net/topic9180-15.html#p17528>
08:16 <@vpnHelper> RSS Update - forum: **help** TCP: connect to 174.127.64.104:443 failed <http://forums.openvpn.net/topic9211.html>
08:29 -!- DeathWolf [~DeathWolf@87-98-185-196.ovh.net] has left #openvpn []
08:33 -!- kanyl_ [~kanyl@84.23.155.169] has joined #openvpn
08:35 -!- kanyl_ [~kanyl@84.23.155.169] has quit [Changing host]
08:35 -!- kanyl_ [~kanyl@unaffiliated/kanyl] has joined #openvpn
08:36 -!- kanyl_ is now known as kanyl
08:57 -!- Pilif12p_ [~Pilif12p@techessentials.org] has quit [Changing host]
08:57 -!- Pilif12p_ [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
08:58 -!- Pilif12p_ is now known as Pilif12p
09:45 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
09:45 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
09:47 <@vpnHelper> RSS Update - forum: help me i was blocked using openvpn(udp) in my country. pls <http://forums.openvpn.net/topic9212.html>
09:47 -!- wamty [wamty@178.135.85.112] has left #openvpn []
09:53 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
10:03 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 245 seconds]
10:05 <@vpnHelper> RSS Update - forum: hide your server ip <http://forums.openvpn.net/topic9213.html>
10:54 -!- jeff007 [~jeff@zaclarise.net] has joined #openvpn
10:59 < jeff007> so!
11:01 < jeff007> bonjour, je configure un serveur openvpn ... mon adressage en reseau local est 192.168.1.0/24 ... Que me proposeriez vous comme adresse local?
11:05 < kralor> celle que tu veux vraiment :p
11:07 < jeff007> Merci pour ta réponse kralor... Dois-je modifier ma configuration actuelle ? 
11:10 < jeff007> tu me conseillerais quel type d'adressage? 
11:34 -!- jeff007 [~jeff@zaclarise.net] has quit [Ping timeout: 256 seconds]
11:34 -!- jeff007 [~jeff@zaclarise.net] has joined #openvpn
11:36 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
11:47 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
12:05 -!- jeff007 [~jeff@zaclarise.net] has quit [Ping timeout: 256 seconds]
12:15 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17532>
12:18 -!- troyt [~troyt@c-67-166-68-75.hsd1.ut.comcast.net] has quit [Ping timeout: 260 seconds]
12:19 -!- jeff007 [~jeff@zaclarise.net] has joined #openvpn
12:23 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
12:23 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
12:23 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
12:25 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
12:33 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:44 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
12:45 <@vpnHelper> RSS Update - forum: OpenVPN: Keeps restarting and/or Connection timeout <http://forums.openvpn.net/topic9214.html>
12:50 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
12:51 < jeff007> so! j'ai le message NOTE: the current --script-security setting may allow this configuration to call user-defined scripts ... que dois-je faire,
12:51 < jeff007> Auriez vous une idée? ;)
13:07 <+hyper_ch> jeff007: english?
13:09 < jeff007> no i'm french no body's perfect ;)
13:11 -!- sirspazzolot [~Matt@c-68-40-234-80.hsd1.mi.comcast.net] has joined #openvpn
13:12 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
13:17 -!- jeff007 [~jeff@zaclarise.net] has quit [Ping timeout: 260 seconds]
13:38 < sirspazzolot> If anyone can help me start my server, that'd be cool. My problem (or what I think to be the problem) is outlined in http://pastie.org/2858114
13:38 < sirspazzolot> which includes my config file and all that lovely stuff
13:38 < sirspazzolot> in short, ta.key is broken.
13:39 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17535> || TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9210.html#p17534>
13:40 < reiffert> sirspazzolot: the answer is quite simple:
13:40 < reiffert> 20:38 < sirspazzolot> in short, ta.key is broken.
13:41 < sirspazzolot> ordinarily I'd be laughing at your smartassery with you but I've had a bad morning
13:41 < sirspazzolot> sorry for not being amused.
13:41 < reiffert> You are welcome. I had to work from 7 am to 7 pm today.
13:42 < reiffert> And work isn't over yet. Already wrote some invoices and now I've got another 14hrs until my paper has to be done.
13:43 < reiffert> So what keeps you from creating a new ta.key?
13:43 < sirspazzolot> work and school suck.
13:43 < sirspazzolot> y'know, come to think of it, I hadn't tried that. I doubt it'll work, but why the hell not
13:43 < reiffert> school's already out on my side ;)
13:43 < sirspazzolot> lucky
13:44 < reiffert> now it's always on the run for new victims and customers.
13:51 -!- newl [~newl@97.75.165.156] has joined #openvpn
13:51 <@vpnHelper> RSS Update - forum: openvpn options/parameters <http://forums.openvpn.net/topic9215.html>
13:57 < sirspazzolot> generating new keys gives the same problem
14:01 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
14:04 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
14:12 < sirspazzolot> is it possible to not use the part of openvpn requiring ta.key?
14:13 < sirspazzolot> this is a personal server nobody will ever actually know about. it's not like I need to be as secure as possible.
14:13 < reiffert> oh yeah, thats possible. just follow the official howto
14:13 < reiffert> !howto
14:13 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:15 < sirspazzolot> I've been through the howto. it explained what tls-auth is but not how to avoid using it
14:17 < reiffert> !tls
14:17 < newl> why avoid it ? it is good for you
14:17 < reiffert> !factoids search tls
14:17 <@vpnHelper> 'tls-cipher' and 'tls-auth'
14:17 < reiffert> !tls-auth
14:17 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make
14:17 <@vpnHelper> the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
14:18 < sirspazzolot> commenting out the tls-auth line in the config file does nothing over here
14:19 < sirspazzolot> newl, I want to avoid it because it's broken and I'm bored of trying to fix it, and it's more security than is necessary for me personally
14:19 < sirspazzolot> this server will be secure by obscurity. nobody will know it exists. it is running out of my bedroom
14:19 < sirspazzolot> lemme rephrase that. it's not that it's broken, it's that I can't get it to work.
14:21 < newl> so yours is broken ;)
14:22 < sirspazzolot> yup.
14:28 < sirspazzolot> http://pastie.org/2858114 I guess I'll go ahead and repost my pastie thing here
14:42 -!- mgorbach [~mgorbach@209-128-67-099.bayarea.net] has quit [Quit: Leaving...]
15:09 -!- mete- [~mete@mete.shell.la] has left #openvpn []
15:10 -!- mete [~mete@mete.shell.la] has joined #openvpn
15:17 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
15:17 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
15:20 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
15:22 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:52 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9210.html#p17537>
15:56 -!- vpopov [~happylife@46.251.84.160] has quit [Read error: Operation timed out]
15:59 -!- newl [~newl@97.75.165.156] has left #openvpn []
16:04 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9210.html#p17538>
16:04 -!- bigon [bigon@ubuntu/member/bigon] has quit [Ping timeout: 240 seconds]
16:05 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has quit [Ping timeout: 240 seconds]
16:05 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has joined #openvpn
16:06 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
16:06 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
16:06 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
16:10 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9210.html#p17539>
16:16 <@vpnHelper> RSS Update - forum: openvpn options/parameters <http://forums.openvpn.net/topic9215.html#p17542> || failed to find gid for group openvpn <http://forums.openvpn.net/topic9208.html#p17541> || TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9210.html#p17540>
16:22 <@vpnHelper> RSS Update - forum: unknown opcode received <http://forums.openvpn.net/topic9203.html#p17544> || OpenVPN: Keeps restarting and/or Connection timeout <http://forums.openvpn.net/topic9214.html#p17543>
16:51 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
16:52 <@vpnHelper> RSS Update - forum: Ping does not work through a tunnel ( Server: Win 2003 SBS) <http://forums.openvpn.net/topic8464.html#p17545>
16:54 -!- jeev [1004@unaffiliated/jeev] has left #openvpn []
17:06 -!- datruth [datruth@gotpot.org] has quit [Read error: Connection reset by peer]
17:06 -!- datruth [datruth@gotpot.org] has joined #openvpn
17:07 -!- nifiga [niko@luchshe.vdalnete.ru] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:08 -!- nifiga [niko@luchshe.vdalnete.ru] has joined #openvpn
17:12 -!- novaflash is now known as novaflash_away
17:17 -!- nickzxcv [~nick@2001:470:1:41::d8da:df73] has quit [Remote host closed the connection]
17:30 -!- Denial [Denial@drgi.co.uk] has quit []
17:49 -!- scoopex [~scoopex@85.214.140.184] has quit [Ping timeout: 256 seconds]
17:49 -!- Guest79480 [~caesay@socialshock.net] has quit [Ping timeout: 256 seconds]
17:49 -!- inimino [~inimino@69.164.198.129] has quit [Ping timeout: 256 seconds]
17:49 -!- Fleck [~fleck@unaffiliated/fleck] has quit [Ping timeout: 256 seconds]
17:49 -!- scoopex [~scoopex@85.214.140.184] has joined #openvpn
17:50 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
17:50 -!- caesay [~caesay@socialshock.net] has joined #openvpn
17:50 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
17:51 -!- caesay is now known as Guest35100
18:00 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
18:02 -!- me345 [~me345@adsl-71-131-134-78.dsl.sntc01.pacbell.net] has joined #openvpn
18:08 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
18:13 -!- ruied [~ruied@po-217-129-154-119.netvisao.pt] has quit [Read error: Connection reset by peer]
18:23 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
18:34 -!- ravemaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has joined #openvpn
18:35 -!- ravemaster [775d3322@gateway/web/freenode/ip.119.93.51.34] has quit [Client Quit]
18:37 -!- ravemaster [~ravemaste@119.93.51.34] has joined #openvpn
18:43 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
18:48 -!- ravemaster [~ravemaste@119.93.51.34] has quit []
19:00 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:13 -!- yovielito [~yovielito@cpe-67-246-117-242.twcny.res.rr.com] has joined #openvpn
19:13 < yovielito> hi
19:14 -!- yovielito [~yovielito@cpe-67-246-117-242.twcny.res.rr.com] has quit [Client Quit]
19:17 <+EugeneKay> Rawr
19:52 -!- jemand [~quassel@brln-4db9e987.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
19:59 -!- bauruine [~stefan@217.150.228.163] has quit [Ping timeout: 258 seconds]
20:02 -!- me345 [~me345@adsl-71-131-134-78.dsl.sntc01.pacbell.net] has quit [Read error: Connection reset by peer]
20:10 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
20:12 -!- bauruine [~stefan@217.150.237.100] has joined #openvpn
20:17 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
20:22 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
21:09 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Quit: Leaving]
21:09 <@vpnHelper> RSS Update - forum: unknown opcode received <http://forums.openvpn.net/topic9203.html#p17546>
21:31 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:44 -!- master_of_master [~master_of@p57B55319.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
21:45 -!- master_of_master [~master_of@p57B5211C.dip.t-dialin.net] has joined #openvpn
21:51 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
21:51 < smw> can I do route !X.X.X.X/X to blacklist ip ranges?
21:52 < smw> Also, if anyone has a list of China IPs... let me know :-)
21:52 < smw> right now I am looking at countryipblocks.net
21:53 <+EugeneKay> !notopenvpn
21:53 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
21:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
21:56 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:56 < smw> EugeneKay, this seems like an openvpn problem. I want to use redirect-gateway def1 bypass-dhcp but I want to blacklist some ips on the client side
22:01 <+EugeneKay> You can push a bunch of smaller routes to work around the ones you want to block, or use redirect-gateway and then use iptables to drop the traffic.
22:02 < smw> EugeneKay, but if I drop the traffic, will it go to another one of their routes?
22:02 <+EugeneKay> Nope.
22:03 < smw> EugeneKay, pretty much I want the vpn to route every ip that is not in china through it. Are you saying there is no way to do that?
22:03 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
22:03 < smw> I have the list of IPs to route btw.
22:03 <+EugeneKay> Not without a lot of push "route" commands, nope.
22:04 < smw> EugeneKay, is too many push route commands bad?
22:04 <+EugeneKay> Only in that you end up filling up the routing table
22:05 < smw> EugeneKay, too much? http://paste.pocoo.org/show/507531/
22:05 <+EugeneKay> Ohhh yeah.
22:05 <+EugeneKay> That'll cause crying.
22:05 < smw> lol
22:06 < smw> is there anything capable of handling that?
22:06 <+EugeneKay> Especially when you invert that selection ;-)
22:06 < smw> invert?
22:06 < smw> I can't say don't route then?
22:06 <+EugeneKay> You need to push routes for the blocks that you do want access to, not the ones you don't.
22:06 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
22:06 <+EugeneKay> So you would need to push routes for every block NOT mentioned there
22:07 < smw> ok...
22:07 < smw> next idea is to feed that directly into the routing table
22:07 < smw> on mac it is probably not difficult
22:07 < smw> on windows?
22:07  * smw thinks this is rather futile.
22:07 <+EugeneKay> It is.
22:08 <+EugeneKay> Just firewall t if you don't want redirected clients visiting China
22:08 <+EugeneKay> And post a note to the users: "Not for accessing China"
22:08 < smw> EugeneKay, this is for people in china
22:09 <+EugeneKay> Ah, I see.
22:09 < smw> EugeneKay, I want the to proxy everything except local china traffic through the vpn
22:09 <+EugeneKay> That makes more sense.... still the same technical issues.
22:09 < smw> :-\
22:15 < smw> EugeneKay, would that list not work for local routing tables?
22:16 <+EugeneKay> That is a lot of routes
22:16 <+EugeneKay> I think it's below the "too many" threshold, but.... ergh.
22:17 < smw> lol
22:17 < smw> most of those are probably not even needed
22:17 < smw> what I really need is a list of IPs from non-residential ISPs
22:18 < smw> that would probably narrow it down considerably, right?
22:20 < probonono> Hi. I'm trying to diagnose a "can't ping server" problem from a Win7 client (this is my first openvpn installation). I notice that after connecting there's no route to 10.8.0.1/32 or 10.8.0.0/30. However manually adding those routes doesn't resolve it.
22:26 < probonono> The server is on a FreeBSD box which uses pf. I've added logging to the pf rules but I'm not seeing evidence of blocked packets there, although I'm unsure of whether the pf rules for the tun i/f are adequate.
22:27 < probonono> Can anyone suggest whether this is likely a client issue, or have a link to a reference example/guide to setting up pf?
22:30 < smw> EugeneKay, perhaps I can load that into the routing table of a hardware router? dd-wrt or something that supports openvpn
22:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 258 seconds]
22:36 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:36 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
22:39 -!- ravemaster [~ravemaste@119.93.51.34] has joined #openvpn
22:44 -!- _Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
22:44 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Ping timeout: 244 seconds]
22:45 -!- _Cr4zi3 is now known as Cr4zi3
23:00 < ravemaster> TLS Error: Unroutable control packet received from etc...
23:02 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
23:02 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
23:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:13 -!- Guest35100 [~caesay@socialshock.net] has left #openvpn []
23:14 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
23:18 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 248 seconds]
23:18 <+EugeneKay> smw - you can, but that is a lot of routes.
23:18 <+EugeneKay> Performance would suffer, and dd-wrt are NOT "hardware router" ;-)
23:19 < ravemaster> TLS Error: Unroutable control packet received from etc...  why is this?
23:20 <+EugeneKay> ravemaster - a quick google of the error message suggests that the clocks are wrong.
23:23 < smw> EugeneKay, I hope IANA had the foresight to give each country a continuous block of IPs.
23:23 < smw> EugeneKay, I mean for the new ipv6
23:24 <+EugeneKay> http://www.iana.org/assignments/ipv6-unicast-address-assignments/ipv6-unicast-address-assignments.xml
23:24 <@vpnHelper> Title: IPv6 Global Unicast Address Assignments (at www.iana.org)
23:25 < smw> EugeneKay, ok fine, I hope APNIC and the other regional ones assigned continuous blocks to countries
23:26 <+EugeneKay> Fat chance.
23:26 < smw> yeah... I know
23:26 <+EugeneKay> Blocks are assigned to ISPs, which can be sorted largely by country, but no, they're not contiguous.
23:26 < smw> :-\
23:27 < smw> so, is China telecom one ISP? :-P
23:27 < smw> China Telecom*
23:30 -!- sirspazzolot [~Matt@c-68-40-234-80.hsd1.mi.comcast.net] has quit [Quit: Life beckons]
23:46 < ravemaster> Eugenekay do you know what is the current update of the new openvpn version
23:47 <+EugeneKay> Not the foggiest.
23:49 < ravemaster> thanks
23:49 -!- ravemaster [~ravemaste@119.93.51.34] has quit []
23:58 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
--- Day changed Mon Nov 14 2011
00:11 -!- tjz [~pc@bb121-7-128-226.singnet.com.sg] has joined #openvpn
00:11 -!- tjz [~pc@bb121-7-128-226.singnet.com.sg] has quit [Changing host]
00:11 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
00:14 -!- bauruine [~stefan@217.150.237.100] has quit [Ping timeout: 260 seconds]
00:30 -!- genmode [~ravemaste@119.93.51.34] has joined #openvpn
00:32 < genmode> guys please help on openvpn over ssh tunnel 
01:00 -!- genmode [~ravemaste@119.93.51.34] has quit []
01:38 -!- ravemaster [~ravemaste@119.93.51.34] has joined #openvpn
01:38 < ravemaster> where can I see the complete list of openvpn log messages?
01:40 < ravemaster> people ?
01:44 -!- ravemaster [~ravemaste@119.93.51.34] has quit []
02:08 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:21 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
02:27 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:42 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has joined #openvpn
02:47 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
02:47 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
02:49 -!- gnude [~gnude@p578bb787.dip0.t-ipconnect.de] has joined #openvpn
03:03 <@vpnHelper> RSS Update - forum: failed to find gid for group openvpn <http://forums.openvpn.net/topic9208.html#p17547>
03:09 <@vpnHelper> RSS Update - forum: hide your server ip <http://forums.openvpn.net/topic9213.html#p17549> || failed to find gid for group openvpn <http://forums.openvpn.net/topic9208.html#p17548>
03:11 < gnude> hello, i need help with a vpn problem
03:12 < gnude> i want to connect two networks over vpn. it works. from one network i can use the network from the vpn client. see (and ping) all computer there.
03:12 < gnude> but the other way. the client see only the vpn server, no oter computer in the network
03:12 < gnude> i dont know where is the error
03:14 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
03:14 -!- mode/#openvpn [+o dazo_afk] by ChanServ
03:16 -!- dazo_afk is now known as dazo
03:17 -!- gnude [~gnude@p578bb787.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
03:17 -!- gnude [~gnude@p578bb787.dip0.t-ipconnect.de] has joined #openvpn
03:19 -!- gnude [~gnude@p578bb787.dip0.t-ipconnect.de] has quit [Client Quit]
03:19 -!- gnude1 [~gnude@p578bb787.dip0.t-ipconnect.de] has joined #openvpn
03:21 <@vpnHelper> RSS Update - forum: OpenVPN: Keeps restarting and/or Connection timeout <http://forums.openvpn.net/topic9214.html#p17550>
03:49 -!- novaflash_away is now known as novaflash
03:51 <@vpnHelper> RSS Update - forum: OpenVPN: Keeps restarting and/or Connection timeout <http://forums.openvpn.net/topic9214.html#p17551>
04:03 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17552>
04:09 <@vpnHelper> RSS Update - forum: failed to find gid for group openvpn <http://forums.openvpn.net/topic9208.html#p17554>
04:09 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
04:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
04:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
04:20 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has joined #openvpn
04:20 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has joined #openvpn
04:20 <@vpnHelper> RSS Update - forum: failed to find gid for group openvpn <http://forums.openvpn.net/topic9208.html#p17555>
04:21 -!- MarKsaitis [~MarKsaiti@94-30-69-205.xdsl.murphx.net] has quit [Read error: Connection reset by peer]
04:26 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:26 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:26 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17556>
04:28 -!- mape2k [~mape2k@2001:6f8:997:1000:221:86ff:fe98:93a2] has quit [Quit: Leaving]
04:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:54 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
05:15 <@vpnHelper> RSS Update - forum: failed to find gid for group openvpn <http://forums.openvpn.net/topic9208.html#p17557>
05:24 -!- HeyWooduOpenSour [~Hyf99d7YH@c-174-49-213-244.hsd1.pa.comcast.net] has joined #openvpn
05:25 -!- mmbeck [mmbeck@home.akausal.de] has joined #openvpn
05:25 < HeyWooduOpenSour> i was wondering if anybody please knew what the best way would be to use openVPN on a device to enable VPN for a network? 
05:26 < HeyWooduOpenSour> does anybody happen to know?
05:26 < HeyWooduOpenSour> I know I can't use my router
05:26 <@vpnHelper> RSS Update - forum: failed to find gid for group openvpn <http://forums.openvpn.net/topic9208.html#p17558>
05:26 < HeyWooduOpenSour> i mean the router will work for pass-through but that's about it
05:27 < HeyWooduOpenSour> I mean I can't use a third-party firmware to enable or use openvpn
05:41 -!- gnude1 [~gnude@p578bb787.dip0.t-ipconnect.de] has left #openvpn []
05:57 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17559>
06:01 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Read error: Connection reset by peer]
06:01 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has joined #openvpn
06:03 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
06:07 -!- steven_j [steve@217-14-8-234-dhcp-osl.bbse.no] has joined #openvpn
06:07 < steven_j> !welcome
06:07 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:08 < steven_j> !redirect
06:08 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
06:08 < steven_j> !ipforward
06:08 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
06:08 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17560>
06:09 < steven_j> !route
06:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
06:09 < steven_j> !tcpip
06:09 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
06:10 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:12 < steven_j> Hi all i got som question ive been trying to google last 2days ,maybe someone here could answer it for me :)
06:12 < steven_j> ive been trying to find out if it is possible with openvpn, to have openvpn server on one location and  5clients all from diffrent location, and then 
06:12 < steven_j> get client to communicate direct with openvpn instead of client->vpn->client ?
06:12 < steven_j> so traffic goes from client->client instead of client->vpn->client
06:21 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p17561>
06:27 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17562>
06:36 -!- bauruine [~stefan@cust.static.46-14-244-193.swisscomdata.ch] has quit [Ping timeout: 240 seconds]
06:51 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p17563>
07:04 < ecrist> steven_j: no, that's not possible
07:13 -!- jeff007 [~jeff@zaclarise.net] has joined #openvpn
07:32 -!- genmode [~researche@180.194.160.204] has joined #openvpn
07:33 < genmode> where can I see the complete list of openvpn messages for the log messages?
07:39 <@vpnHelper> RSS Update - forum: **help** TCP: connect to 174.127.64.104:443 failed <http://forums.openvpn.net/topic9211.html#p17564>
07:40 -!- novaflash is now known as novaflash_away
07:40 -!- novaflash_away is now known as novaflash
07:41 -!- genmode [~researche@180.194.160.204] has quit [Ping timeout: 252 seconds]
07:42 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has quit [Ping timeout: 248 seconds]
07:43 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has joined #openvpn
07:51 -!- ravel_exe [~ravel_exe@175.136.85.157] has joined #openvpn
07:54 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has quit [Ping timeout: 248 seconds]
07:59 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has joined #openvpn
08:06 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
08:11 -!- nknize [~Adium@68-113-195-188.dhcp.ftwo.tx.charter.com] has quit [Ping timeout: 248 seconds]
08:13 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:18 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
08:23 -!- genmode [~researche@180.194.159.47] has joined #openvpn
08:24 < genmode> help install my ssh tunnel
08:28 <@vpnHelper> RSS Update - forum: no disconnection of a client with same cn <http://forums.openvpn.net/topic9216.html>
08:28 < krzee> help build my igloo
08:28 -!- genmode [~researche@180.194.159.47] has quit [Ping timeout: 244 seconds]
08:35 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
08:35 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Client Quit]
08:35 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
08:36 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
08:36 -!- jeff007 [~jeff@zaclarise.net] has quit [Ping timeout: 240 seconds]
08:40 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
08:41 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
08:42 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
08:53 -!- ravel_exe [~ravel_exe@175.136.85.157] has quit []
08:56 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
08:56 -!- jeff007 [~jeff@zaclarise.net] has joined #openvpn
09:10 <@vpnHelper> RSS Update - forum: no disconnection of a client with same cn <http://forums.openvpn.net/topic9216.html#p17566>
09:28 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
09:29 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:29 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
09:38 -!- _quadDamage [~EmperorTo@jaguar-2-red.claimlynx.com] has joined #openvpn
10:10 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
10:11 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:27 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
10:28 < SviMik> hi all. a small question... After a remove user's cert (crt,csk,key files) user is still able to connect. is it a bug, or how to remove user properly?
10:29 < SviMik> (I know I can restart openvpn server - it should help. but I don't wish to kick other users)
10:30 < SviMik> I can block this user with iptables - but he can change IP and connect again (without cert on the server!)
10:32 < SviMik> (and the line from index.txt (a file with cert list) is also removed)
10:32 < ecrist> SviMik: you need to revoke the certificate, and check a CRL in your config
10:32 < ecrist> !crl
10:32 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
10:32 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
10:33 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
10:33 < ecrist> keep in mind you need a copy of the certificate to revoke it
10:33 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
10:33 < datruth> SviMik: either that or use an allow_clients list
10:33 < ecrist> datruth: allow_clients is hacky
10:33 < datruth> it works
10:34 < ecrist> datruth: allow_clients is hacky
10:34 < datruth> still works :)
10:34 < ecrist> still hacky
10:36 < SviMik> so the crl file is checked every time when a user connects?
10:36 < ecrist> yes
10:38 < datruth> It'll be so nice if openvpn could work properly without admin rights
10:38 < datruth> maybe sometime in the future this will happen
10:38 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:39 < ecrist> datruth: it's not up to openvpn, really
10:39 < ecrist> it's up to the OS
10:39 < ecrist> you can't change routing tables on ANY OS without admin rights
10:39 < datruth> Yeah thats why I'm now looking into Simple VPN Appliance
10:44 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
10:48 < SviMik> I wondering, why OpenVPN GUI does not ask admin rights before adding a route, or when it failed?
10:50 < SviMik> after route add returns an error - GUI  silently continues to work, and even hide the log window, as enything is ok
10:52 < SviMik> so our users are very confused, when it looks like connected but actually doesn't work
10:55 -!- romain_ [d589b286@gateway/web/freenode/ip.213.137.178.134] has joined #openvpn
10:55 < datruth>  SviMik yep that'll happen
10:55 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:55 < datruth> SviMik: Do you encrypt your certs with a password?
10:56 < datruth> SviMik: You might be able to set it up as a service and grant the user access to start/stop the service
10:56 < romain_> Hey everybody. I would like to know if OpenVPN provides an authorization module ?
10:57 < SviMik> no. why should I encrypt them?
10:57 < datruth> SviMik: was wondering if you did or not because if so the service method will not work
10:58 < ecrist> romain_: yes
11:00 < SviMik> datruth actually we provide a VPN service to many users (134 users online right now). they should setup anything on their own! how can they configure a service, if they forget even about admin rights, even with a VIDEO how to install and launch openvpn :)
11:01 < romain_> @ecrist : Ok thanks. What type of authorization is it possible to have ? I donc't know if you know the XACML standard that allows to implement fine-grained access control. Is it possible to easily add our authorization module
11:03 < SviMik> back to user removal. I removed cert, restarted openvpn server - and this user is still back! how it is possible??
11:04 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
11:05 < SviMik> where openvpn server found this cert? it is not exists on hard disk anymore, and should not exist in the memory because openvpn server is restarted
11:06 < datruth> SviMik: Just because the cert is gone from the hard disk doesn't mean the user won't beable to connect.
11:06 < SviMik> why?
11:06 < datruth> SviMik: the cert needs to be revoked and indexed
11:06 < SviMik> how can he connect without cert on the server?
11:07  * SviMik doesn't understand how it works
11:07 < datruth> SviMik: did you verify the cert was reovked?
11:08 < datruth> SviMik: do you have a crl.pem file?
11:08 -!- romain__ [d589b286@gateway/web/freenode/ip.213.137.178.134] has joined #openvpn
11:09 -!- romain_ [d589b286@gateway/web/freenode/ip.213.137.178.134] has quit [Ping timeout: 265 seconds]
11:09 < SviMik> datruth I removed all crt,csr,key,pem files corresponding to this user
11:10 < SviMik> can I revoke it now? :)
11:10 < datruth> SviMik: nope
11:10 < SviMik> so... what to do?
11:10 < romain__> Is it possible to eaisly implement another access control model in openVPN ?
11:10 < datruth> SviMik: perhaps if you get a copy of the cert perhaps
11:10 < SviMik> I need to ban this client. how can I do it?
11:10 < datruth> SviMik: you can try hacking it out of the index.txt
11:11 < datruth> And you most likely have #*.pem 
11:12 < datruth> SviMik: or perhaps you might wanna use that allow_clients list 
11:13 < SviMik> datruth nope. I removed this line from index.txt and removed #*.pem  file
11:14 < datruth> SviMik: you have 3 options as I see it 1.) try to recover the files you deleted and revoke it 2.) use allow_client list 3.) this is overkill but you can always just turn off openvpn
11:16 < SviMik> datruth 1) impossible 2) it will take a while to modify my script to maintain allow_client list, but user should be banned now 3) I don't wish to ban another 152 clients
11:17 < datruth> SviMik: lol okay good luck to you! :)
11:18 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
11:18 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
11:18 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
11:18 < SviMik> and again I'm wondering... how it is possible, that openvpn accepts a client, if there is no cert on the server?
11:20 < datruth> As anyone here been able to run openvpn as a service and still allow for encrypted passworded certificate?
11:20 < datruth> As/Has*
11:28 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17567>
11:30 -!- dxtr_ [98404f9a@2a00:16d8:2:300::2] has quit [Quit: leaving]
11:32 -!- dxtr [10dc7430@unaffiliated/dxtr] has quit [Quit: Lost terminal]
11:33 -!- dxtr [c4a530b1@2a00:16d8:2:300::2] has joined #openvpn
11:33 -!- dxtr [c4a530b1@2a00:16d8:2:300::2] has quit [Changing host]
11:33 -!- dxtr [c4a530b1@unaffiliated/dxtr] has joined #openvpn
11:38 -!- romain__ [d589b286@gateway/web/freenode/ip.213.137.178.134] has quit [Quit: Page closed]
11:48 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:52 <@vpnHelper> RSS Update - forum: Unable to access VPN client <http://forums.openvpn.net/topic9217.html>
12:04 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094.html#p17569>
12:10 <@vpnHelper> RSS Update - forum: TightVNC problem <http://forums.openvpn.net/topic9218.html>
12:29 -!- mick_laptop [~mick@mickweiss.com] has quit [Changing host]
12:29 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
12:30 -!- jeff007 [~jeff@zaclarise.net] has quit [Quit: Quitte]
12:41 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:54 -!- Atomic007za [~gavin@41-132-58-239.dsl.mweb.co.za] has joined #openvpn
12:55 < Atomic007za> hi
12:55 < Atomic007za> anybody home?
12:56 < Atomic007za> I have a problem with openvpn
12:57 < Atomic007za> the client can ping the server LAN IP but the Server cant ping the Client IP
12:59 <@vpnHelper> RSS Update - forum: TightVNC problem <http://forums.openvpn.net/topic9218.html#p17571>
13:20 -!- kyrix [~ashley@mk046207255200.a1.net] has joined #openvpn
13:23 <@vpnHelper> RSS Update - forum: OpenVPN Client Program customization <http://forums.openvpn.net/topic9200.html#p17572>
13:25 < krzee> server cant ping client lan ip or client vpn ip?
13:32 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Remote host closed the connection]
13:38 < Atomic007za> !wecome
13:38 < Atomic007za> !welcome
13:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:39 < Atomic007za> !howto
13:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:56 -!- _julian [~quassel@hmbg-5f765ca2.pool.mediaWays.net] has joined #openvpn
13:59 <@vpnHelper> RSS Update - forum: Can connect to VPN but can't ping clients behind the VPN <http://forums.openvpn.net/topic9204.html#p17573>
14:00 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
14:01 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
14:05 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Quit: ZNC - http://znc.in]
14:06 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
14:08 -!- Gnewt [~vector@submarine.gnewt.at] has joined #openvpn
14:08 < Gnewt> Can I have multiple concurrent sessions with one password?
14:10 -!- kyrix [~ashley@mk046207255200.a1.net] has quit [Quit: Ex-Chat]
14:13 -!- mmbeck [mmbeck@home.akausal.de] has quit [Ping timeout: 244 seconds]
14:15 -!- mmbeck [mmbeck@home.akausal.de] has joined #openvpn
14:15 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:22 < ecrist> yes
14:27 < Atomic007za> how can I get OpenVPN client to see server IP range and visa versa. Can only ping from Client lan Side and get Server LAN side, but not the otherway around
14:30 < ecrist> everyone needs to know how to route in both directions.
14:30 < Atomic007za> http://pastebin.com/2af0acq7
14:33 < krzee> !route
14:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
14:33 < krzee> !clientlan
14:33 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
14:33 <@vpnHelper> better explanation
14:35 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:36 < Atomic007za> I am sure I have that right
14:36 < Atomic007za> http://pastebin.com/QQw1j418
14:38 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Remote host closed the connection]
14:40 -!- b0gatyr [~b0gatyr@unaffiliated/b0gatyr] has left #openvpn []
14:49 -!- _julian_ [~quassel@hmbg-4d06c445.pool.mediaWays.net] has joined #openvpn
14:52 -!- _julian [~quassel@hmbg-5f765ca2.pool.mediaWays.net] has quit [Ping timeout: 256 seconds]
14:53 -!- _julian [~quassel@hmbg-5f765030.pool.mediaWays.net] has joined #openvpn
14:53 -!- _julian_ [~quassel@hmbg-4d06c445.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
14:57 -!- _julian [~quassel@hmbg-5f765030.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
14:58 -!- _julian [~quassel@hmbg-5f765b6f.pool.mediaWays.net] has joined #openvpn
15:06 < Atomic007za> !iroute
15:06 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
15:06 < Atomic007za> !ccd
15:06 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
15:09 < Atomic007za> !clientlan
15:09 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
15:09 <@vpnHelper> a better explanation
15:09 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
15:13 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
15:13 -!- _julian_ [~quassel@hmbg-4d06f68a.pool.mediaWays.net] has joined #openvpn
15:14 -!- _julian [~quassel@hmbg-5f765b6f.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
15:15 -!- Ionic [ionic@ionic.de] has joined #openvpn
15:23 -!- _julian [~quassel@hmbg-5f761437.pool.mediaWays.net] has joined #openvpn
15:24 -!- _julian_ [~quassel@hmbg-4d06f68a.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
15:33 -!- novaflash is now known as novaflash_away
15:39 <@vpnHelper> RSS Update - forum: OpenVPN Client Program customization <http://forums.openvpn.net/topic9200.html#p17574>
15:44 -!- gremly [~gremly@200.106.218.64] has quit [Read error: Operation timed out]
15:48 -!- dazo is now known as dazo_afk
15:49 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
17:07 -!- _julian [~quassel@hmbg-5f761437.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
17:09 -!- _julian [~quassel@hmbg-4d06be3d.pool.mediaWays.net] has joined #openvpn
17:13 -!- _julian_ [~quassel@hmbg-5f7609ad.pool.mediaWays.net] has joined #openvpn
17:14 -!- _julian [~quassel@hmbg-4d06be3d.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
17:32 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094-15.html#p17575>
17:38 -!- Peejhay [~Peejhay@121.1.11.164] has joined #openvpn
17:38 <@vpnHelper> RSS Update - forum: Can connect to VPN but can't ping clients behind the VPN <http://forums.openvpn.net/topic9204.html#p17576>
17:38 < Peejhay> .
17:44 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 258 seconds]
17:44 -!- Peejhay [~Peejhay@121.1.11.164] has left #openvpn []
17:54 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
17:58 -!- _julian_ [~quassel@hmbg-5f7609ad.pool.mediaWays.net] has quit [Read error: Operation timed out]
17:58 -!- _julian [~quassel@hmbg-4d06aad7.pool.mediaWays.net] has joined #openvpn
18:03 -!- _julian [~quassel@hmbg-4d06aad7.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
18:05 -!- _julian [~quassel@hmbg-5f761514.pool.mediaWays.net] has joined #openvpn
18:09 -!- _julian_ [~quassel@hmbg-5f767fa8.pool.mediaWays.net] has joined #openvpn
18:12 -!- _julian [~quassel@hmbg-5f761514.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
18:20 -!- Denial [Denial@drgi.co.uk] has quit []
18:36 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
18:49 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:50 -!- _julian_ [~quassel@hmbg-5f767fa8.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
18:56 -!- _julian [~quassel@hmbg-5f7620bf.pool.mediaWays.net] has joined #openvpn
19:07 -!- _julian_ [~quassel@hmbg-5f760da5.pool.mediaWays.net] has joined #openvpn
19:11 -!- _julian [~quassel@hmbg-5f7620bf.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
20:07 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:42 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:11 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Quit: changing servers]
21:18 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
21:26 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Quit: changing servers]
21:26 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094-15.html#p17577>
21:29 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
21:35 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Quit: changing servers]
21:35 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
21:42 -!- genesis_ [~ravemaste@119.93.51.34] has joined #openvpn
21:43 < genesis_> i would like to ask where can I see the complete list of messages that the openvpn log creates?
21:43 < genesis_> please. thanks
21:44 -!- master_of_master [~master_of@p57B5211C.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
21:45 < krzee> genesis_, the source code
21:45 < krzee> do you have a different question?
21:46 -!- master_of_master [~master_of@p57B55EF6.dip.t-dialin.net] has joined #openvpn
21:46 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Read error: Connection reset by peer]
22:19 -!- Gravitron [~admin@64.93.227.72] has joined #openvpn
22:19 -!- Gravitron [~admin@64.93.227.72] has quit [Changing host]
22:19 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:21 < Gravitron> hey, anyone with experience installing OpenVPN on an OpenVZ vps want to help/guide me through the install? I've tried like 15 times, but the server fails to start everytime. And i promise, I'm gracious for any help!
22:23 < genesis_> krzee: yes I glance over each file of the source code but I dont see the list. can you tell me what file is that?
22:25 < genesis_> please
22:26 < genesis_> please, I need to know because I will be incorporating it on my personal gui.
22:32 < genesis_> just this once guys. I just nid to know where.  I really move over each file but I did not see it.  kindly tell em.
22:32 < genesis_> just this once guys. I just nid to know where.  I really move over each file but I did not see it.  kindly tell me.
22:34 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Ping timeout: 240 seconds]
22:40 -!- aef_ [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:43 < genesis_> brb
22:43 -!- genesis_ [~ravemaste@119.93.51.34] has quit []
22:44 <+EugeneKay> !openvz
22:44 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
22:45 < Gravitron> second link is dead FYI, but thanks EugeneKay
22:46  * EugeneKay pokes krzee 
22:46 <+EugeneKay> Gravitron - it looks like you'll need to get your VPS host to set you up with a tun device
22:47 < Gravitron> already did that
22:47 < Gravitron> cat /dev/net/tun returns FIle descriptor is in a bad state, which means tun is enabled
22:54 -!- _julian [~quassel@hmbg-4d06ecf6.pool.mediaWays.net] has joined #openvpn
22:54 -!- genesis_ [~ravemaste@119.93.51.34] has joined #openvpn
22:55 -!- _julian_ [~quassel@hmbg-5f760da5.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
22:58 < genesis_> still waiting for any replies fro you guys
22:58 < genesis_> kindly help
23:00 -!- genesis_ [~ravemaste@119.93.51.34] has quit []
23:06 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:08 -!- _julian [~quassel@hmbg-4d06ecf6.pool.mediaWays.net] has quit [Read error: Operation timed out]
23:13 < Gravitron> EugeneKay: any insights? http://pastebin.com/iES2WQ7Z
23:13 <+EugeneKay> I think your problem is that you don't have a file named dh1024.pem
23:14 <+EugeneKay> Are you using an absolute path to it? A relative path? Relative to what? :-p
23:14 < Gravitron> im not sure, i just ran ./build-dh lol
23:14 < Gravitron> and i dont know where it put it
23:14 -!- _julian [~quassel@hmbg-4d0697fb.pool.mediaWays.net] has joined #openvpn
23:14 <+EugeneKay> It puts it in the cert dir, usually.
23:15 <+EugeneKay> You probably want to have everything(server.key, server.crt, ca.crt, dh.pem) in /etc/openvpn/, and a 'cd /etc/openvpn' entry in your openvpn.conf file.
23:17 < Gravitron> yes, my keys (server.key, dh1024.pem) are in the keys folder of easy-rsa (which is in /etc/openvpn
23:17 < Gravitron> )
23:17 < Gravitron> should i move them to the /etc/openvpn folder?
23:17 <+EugeneKay> Yus. That's your "working directory"
23:17 < Gravitron> ok
23:17 < Gravitron> wow, if that's been the problem...
23:17 < Gravitron> im gonna feel really stupid
23:18 <+EugeneKay> Nah, you should feel like a n00b
23:18 <+EugeneKay> :-p
23:18 < Gravitron> lol
23:19 < Gravitron> well it appears to be working...
23:19 <+EugeneKay> \o/
23:19 < Gravitron> "initialization sequence completed"
23:19 < Gravitron> probably a good thing :D
23:19 < Gravitron> but it hasn't given me my cursor back...
23:21 <+EugeneKay> What hasn't?
23:23 <+EugeneKay> You're running it from the shell with `openvpn` ?
23:26 -!- Gravitro_ [~admin@64.93.227.72] has joined #openvpn
23:26 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
23:26 < Gravitro_> EugeneKay:
23:26 <+EugeneKay> Rawr
23:26 < Gravitro_> ok, so it works
23:26 < Gravitro_> but DNS lookup failed, should I re-comment the DNS parts of server.conf?
23:27 < Gravitro_> i uncommented them cause this guide said to
23:27 <+EugeneKay> I have no idea what you're trying to do. :-p
23:27 < Gravitro_> just route my connection
23:27 < Gravitro_> the client connects to the server
23:27 <+EugeneKay> !redirect
23:27 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
23:27 <+EugeneKay> !pushdns
23:27 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
23:27 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
23:27 < Gravitro_> zomg
23:28 < Gravitro_> !def1
23:28 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
23:28 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
23:29 < Gravitro_> EugeneKay, um, can you hook me up with some higher-level explanation?
23:29 <+EugeneKay> That really is it :-p
23:30 < Gravitro_> !ipforwarding
23:30 < Gravitro_> !ipforward
23:30 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
23:30 <+EugeneKay> You get it setup to where you can ping the VPN server's ip, and then you get the redirect stuff going
23:30 <+EugeneKay> I loathe blog entry guides because they are always, ALWAYS wrong.
23:30 < Gravitro_> yea, i've notice that xD
23:31 < Gravitro_> and the "automatic" scripts
23:33 -!- rmacd [~rmacd@W158.N155.queensu.ca] has joined #openvpn
23:33 < Gravitro_> and EugeneKay, mind taking a look at this? http://pastebin.com/evfXewmj
23:33 < Gravitro_> i already stopped the server...
23:34 <+EugeneKay> Something is still bound to the socket
23:34 <+EugeneKay> ps -ef |grep vpn
23:34 < Gravitro_> and thanks for your help, i know helping people like me can be somewhat annoying
23:34 < Gravitro_> root      1386     1  0 05:19 ?        00:00:00 openvpn server.conf
23:34 < Gravitro_> root     15559 30621  0 05:35 pts/1    00:00:00 grep --color=auto vpn
23:35 <+EugeneKay> And there's the process that has the port in use ;-)
23:35 < Gravitro_> :D
23:37 < Gravitro_> hmm, well i still can connect to the VPN, but no luck actually using it. Enough of a victory for today. thanks EugeneKay
23:38 <+EugeneKay> Well, if you can ping 10.8.0.1, you're 75% there
23:38 < Gravitro_> while connected?
23:38 <+EugeneKay> Yeah
23:38 < Gravitro_> ok let me try that
23:38 <+EugeneKay> OR whatever Ip the openvpn server has
23:40 < Gravitro_> ping works :D
23:40 <+EugeneKay> Good. 
23:41 < rmacd> Hi, I'm battling to make heads or tails of what's going on right now. I've got a PBX (voip/asterisk) sitting behind a public-facing firewall. Between the firewall and the PBX server, sits OpenVPN. The OpenVPN client sits on the same machine as the PBX server. The firewall (shorewall) is correcting dnat'ing the incoming data and - after doing a tcpdump (using TCP, for testing) - the data's being received by the vpn-client/pbx box's tun0 interface correct
23:41 < rmacd> It's addressed with the NAT'd destination address. BUT. For some reason, I've managed to screw up the routing at the client's end, resulting in data being /replied/ to (ack's included) - via the original src address - and so, discarded. The final part of the puzzle is getting routing going without having to tunnel *all* data from the client back over the VPN. Any ideas? Am I plain silly?
23:41 < Gravitro_> im not going to lie, i have no clue where to go from here, but it's encouraging nonetheless
23:42 <+EugeneKay> Gravitro_ - you need to enable ip_forwarding, MASQUERADE, and push "redirect-gateway def1"
23:42 <+EugeneKay> That's about it.
23:42 < Gravitro_> i thought i did that
23:43 <+EugeneKay> All of it? Then it oughtab e working.
23:43 < Gravitro_> i can't use MASQUERADE
23:43 < Gravitro_> but
23:43 < Gravitro_> iptables -A INPUT -p udp --dport 1194 -j ACCEPT
23:43 < Gravitro_> iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source my.server.ip
23:43 <+EugeneKay> How about SNAT?
23:43 < Gravitro_> lol ^
23:43 <+EugeneKay> AH well
23:43 < Gravitro_> and then echo 1 > /proc/sys/net/ipv4/ip_forward for forwarding
23:44 <+EugeneKay> Yup
23:44 < Gravitro_> so…lol.
23:44 <+EugeneKay> !logs
23:44 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
23:44 < Gravitro_> ookkk
23:45 < Gravitro_> EugeneKay, how can i set where the logs output
23:45 < Gravitro_> or do you know where they output by default?
23:45 <+EugeneKay> --log
23:46 <+EugeneKay> Default is to terminal
23:46 <+EugeneKay> Or syslog, if you're running it as a service
23:47 < Gravitro_> ok
23:51 <@vpnHelper> RSS Update - forum: openvpn issue on a clone machine <http://forums.openvpn.net/topic9219.html>
23:56 -!- rmacd [~rmacd@W158.N155.queensu.ca] has quit [Quit: rmacd]
--- Day changed Tue Nov 15 2011
00:00 -!- Jimmy_Kash [Jimmy_Kash@115-64-100-52.static.tpgi.com.au] has joined #openvpn
00:01 < Jimmy_Kash> Hey guys, nomatter what I do when setting up openvpn, once I get to ./build-ca it tells me "Plkease edit the vars script to reflect your configuration..."
00:01 < Gravitro_> what the fuck
00:01 < Gravitro_> EugeneKay: "Tue Nov 15 06:02:12 2011 us=819445 TCP/UDP: Socket bind failed on local address [AF_INET]169.63.40.45:1194: Cannot assign requested address"
00:01 < Gravitro_> *herp*
00:02 <+EugeneKay> It hates you
00:02 < Gravitro_> oh, lulz
00:02 < Gravitro_> im an idiot
00:03 < Gravitro_> ok, so EugeneKay, it's initialized, should I try connect and report what it says?
00:03 <+EugeneKay> Sure.
00:04 < Jimmy_Kash> +EugeneKay: You got a moment to maybe help me?
00:04 <+EugeneKay> Jimmy_Kash - I'm not an easy-rsa expert, sorry.
00:04 < Jimmy_Kash> +EugeneKay: no problem mate
00:04 < Jimmy_Kash> thx
00:05 <+EugeneKay> Have you tried editing the 'vars' file, though? The script is fairly straightforward in its error messages
00:05 < Jimmy_Kash> +EugeneKay: ha yeah i did try that
00:05 < Jimmy_Kash> +EugeneKay: I have done this before and had no problems. For some reason it just no rikey
00:05 < Gravitro_> Jimmy_Kash: try the pkitool
00:06 < Gravitro_> maybe it will work
00:06 < Jimmy_Kash> Gravitro_: How do i do that sorry?
00:06 < Jimmy_Kash> Gravitro_: I assume mr google will know this
00:06 < Gravitro_> yea, its in like every guide on earth
00:06 < Gravitro_> EugeneKay: http://d.gr-v-ty.com/HGjc
00:06 <@vpnHelper> Title: Screen shot 2011-11-15 at 01:05:13.png (at d.gr-v-ty.com)
00:07 <+EugeneKay> Firewall issue.
00:07 <+EugeneKay> Though.... it's connected, and RWing.... Hrm.
00:07 < Gravitro_> :/
00:08 < Gravitro_> it's something with that dhcp bypass i think
00:16 -!- rmacd [~rmacd@dynamic-64-118-27-9.wtccommunications.ca] has joined #openvpn
00:20 < rmacd> Thought I might try re-phrase what I'd been wondering about earlier, I've had a look through some docs: If I've a service running on one of my VPN clients (say, a http server) and the dest address is correct when it's hitting the client's end of tun0 interface, how can I ensure that the service responds correctly - i.e. doesn't try to route outwith the VPN? At the moment, ACKs are going via default (client) route so session is never 
00:22 < rmacd> So far, the only way I can get it all working is by setting the client's default route to the tun0 interface - but of course, then I can't have the client do much else of use.
00:22 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
00:22 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
00:30 -!- Jimmy_Kash [Jimmy_Kash@115-64-100-52.static.tpgi.com.au] has quit []
00:30 -!- dazo_afk is now known as dazo
00:33 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
00:33 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
00:33 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
00:36 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:02 <@vpnHelper> RSS Update - forum: openvpn issue on a clone machine <http://forums.openvpn.net/topic9219.html#p17580> || [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17579>
02:10 -!- novaflash_away is now known as novaflash
02:17 -!- rmacd [~rmacd@dynamic-64-118-27-9.wtccommunications.ca] has quit [Quit: rmacd]
02:25 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:30 -!- novaflash is now known as novaflash_away
02:34 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has joined #openvpn
02:44 -!- _julian_ [~quassel@hmbg-4d0699ab.pool.mediaWays.net] has joined #openvpn
02:46 -!- _julian [~quassel@hmbg-4d0697fb.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
02:47 -!- rfxn [~ryanm84@bas1-montreal54-1279375707.dsl.bell.ca] has quit [Ping timeout: 255 seconds]
02:47 <@vpnHelper> RSS Update - forum: OpenVPN server on Windows, troubleshooting help <http://forums.openvpn.net/topic9220.html>
03:00 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:04 -!- rfxn [~ryanm84@69.157.150.142] has joined #openvpn
03:30 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17582>
04:00 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
04:00 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
04:06 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
04:10 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
04:12 <@vpnHelper> RSS Update - forum: OpenVPN server on Windows, troubleshooting help <http://forums.openvpn.net/topic9220.html#p17583>
04:12 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
04:13 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:21 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
04:30 <@vpnHelper> RSS Update - forum: Mac OSx Lion - lladdr problem <http://forums.openvpn.net/topic9201.html#p17584>
04:58 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
05:00 <@vpnHelper> RSS Update - forum: Help: TLS Error <http://forums.openvpn.net/topic9221.html> || Mac OSx Lion - lladdr problem <http://forums.openvpn.net/topic9201.html#p17585>
05:12 <@vpnHelper> RSS Update - forum: Mac OSx Lion - lladdr problem <http://forums.openvpn.net/topic9201.html#p17588>
05:16 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:16 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:16 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:17 -!- LumberCartel [~LumberCar@96.53.47.42] has joined #openvpn
05:18 <@vpnHelper> RSS Update - forum: Help: TLS Error <http://forums.openvpn.net/topic9221.html#p17590> || OpenVPN server on Windows, troubleshooting help <http://forums.openvpn.net/topic9220.html#p17589>
05:24 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Quit: Leaving.]
05:24 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
05:24 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
05:24 -!- steven_j [steve@217-14-8-234-dhcp-osl.bbse.no] has quit [Quit: Lost terminal]
05:26 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
05:30 <@vpnHelper> RSS Update - forum: OpenVPN server on Windows, troubleshooting help <http://forums.openvpn.net/topic9220.html#p17592>
05:31 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
05:32 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Max SendQ exceeded]
05:35 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
05:36 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Max SendQ exceeded]
05:39 -!- p3rror [~mezgani@41.140.152.102] has joined #openvpn
05:43 <@vpnHelper> RSS Update - forum: Mac OSx Lion - lladdr problem <http://forums.openvpn.net/topic9201.html#p17593>
05:43 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 260 seconds]
05:45 -!- ravel_exe [~ravel_exe@175.136.85.157] has joined #openvpn
05:49 -!- luptenschteiner [~User@unaffiliated/probonono] has joined #openvpn
05:50 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 244 seconds]
06:01 -!- p3rror [~mezgani@41.140.152.102] has quit [Ping timeout: 240 seconds]
06:13 <@vpnHelper> RSS Update - forum: Generating configuration files from a CSR <http://forums.openvpn.net/topic9222.html>
06:42 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
07:05 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
07:07 -!- Ionic [ionic@ionic.de] has joined #openvpn
07:07 <@vpnHelper> RSS Update - forum: failed to activate licence <http://forums.openvpn.net/topic9223.html>
07:25 <@vpnHelper> RSS Update - forum: OpenVPN Client Program customization <http://forums.openvpn.net/topic9200.html#p17596>
07:28 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
07:28 < LumberCartel> Good night folks.
07:28 -!- LumberCartel [~LumberCar@96.53.47.42] has quit [Quit: RFCs the easy way -- http://www.openrfc.org/]
07:37 <@vpnHelper> RSS Update - forum: Redirect-Gateway Extreme Speed Issues <http://forums.openvpn.net/topic9094-15.html#p17597>
07:51 -!- mfaroukg [~sameh@78.154.210.55] has joined #openvpn
07:52 < mfaroukg> any one has problem with 64 bit ubuntu?
07:54 -!- mfaroukg [~sameh@78.154.210.55] has left #openvpn []
07:55 -!- mfaroukg [~sameh@78.154.210.55] has joined #openvpn
07:55 < mfaroukg> ? /join #openvpn-as
07:56 < mfaroukg>  !welcome 
07:57 -!- ravel_cmd [ravel_exe@175.136.85.157] has joined #openvpn
07:58 < mfaroukg> hello, I have problem with VPN . any one can help?
07:59 -!- ravel_exe [~ravel_exe@175.136.85.157] has quit [Ping timeout: 240 seconds]
08:00 -!- ravel_exe [ravel_exe@175.136.85.157] has joined #openvpn
08:03 -!- ravel_cmd [ravel_exe@175.136.85.157] has quit [Ping timeout: 260 seconds]
08:09 <+EugeneKay> !ask
08:09 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
08:10 <+EugeneKay> Oh, he's buggered off.
08:10 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has joined #openvpn
08:13 -!- TomFyuri [~Tom_Fyuri@moloko.TeNeT.Odessa.UA] has joined #openvpn
08:15 < TomFyuri> Is there some decent tutorial regarding tap bridge? I'm trying to test vpn network with 2 my friends using pidgin bonjour lol. I've made a local network bridge (lan eth and tap so br0) and pings go fine between us. But there is... no broadcast? Do they have to have gateway? Or what am i missing...
08:17 -!- chandoo [~chandoo@ool-44c4dabf.dyn.optonline.net] has quit [Quit: Leaving]
08:26 -!- Koter [~joby@1.202.39.210] has joined #openvpn
08:27 < Koter> After upgrading to ubuntu 11.10, I keep getting "Cannot allocate TUN/TAP dev dynamically". Can't connect. Any ideas?
08:33 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
08:34 -!- joby_ [~joby@75.125.151.194] has joined #openvpn
08:34 -!- joby_ is now known as Koter_
08:34 < Koter> *facepalm*
08:34 < Koter> Never mind, problem caused by my own idiocy. 30 minutes on google because I forgot a 'sudo' somewhere.
08:34 -!- Koter [~joby@1.202.39.210] has quit [Quit: Leaving]
08:35 -!- MadTBone_ [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has joined #openvpn
08:35 < Koter_> Odd how that synced after I got here.
08:35 -!- Koter_ is now known as Koter
08:35 -!- Ionic [ionic@ionic.de] has joined #openvpn
08:35 -!- MadTBone_ [~MadTBone@rrcs-24-213-162-187.nyc.biz.rr.com] has quit [Read error: Connection reset by peer]
08:36 -!- MadTBone_ [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
08:38 -!- MadTBone_ [~MadTBone@gw1.msmnyc.edu] has quit [Read error: Operation timed out]
08:38 -!- MadTBone_ [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
08:38 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Ping timeout: 258 seconds]
08:51 <@vpnHelper> RSS Update - forum: topology subnet explanation <http://forums.openvpn.net/topic9202.html#p17598>
08:53 < rooth> !tls-auth
08:53 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make the
08:53 <@vpnHelper> tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
08:57 <@vpnHelper> RSS Update - forum: Generating configuration files from a CSR <http://forums.openvpn.net/topic9222.html#p17599>
08:57 -!- Koter [~joby@75.125.151.194] has quit [Ping timeout: 240 seconds]
09:03 -!- TomFyuri [~Tom_Fyuri@moloko.TeNeT.Odessa.UA] has quit [Quit: Leaving.]
09:05 -!- mfaroukg [~sameh@78.154.210.55] has quit [Quit: Leaving.]
09:09 -!- mfaroukg [~sameh@78.154.210.55] has joined #openvpn
09:10 < mfaroukg> any one can help for pppt?
09:10 < mfaroukg> pptp*
09:12 < mfaroukg> is the vpn pptp working fine for the 64 bit ubuntu?
09:12 -!- beerbro [~gustav@unaffiliated/beerbroy] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:14 -!- beerbro [~gustav@109.75.184.199] has joined #openvpn
09:16 < ecrist> mfaroukg: we don't du pptp here
09:16 < ecrist> we do openvpn, as the channel name suggests
09:21 < mfaroukg> what is the correct channel for such problem ?
09:28 < ecrist> no clue
09:28 < ecrist> but, it's not here.
09:35 -!- dazo is now known as dazo_afk
09:44 <+EugeneKay> ecrist - the second link for !openvz is dead
09:44 < ecrist> !openvz
09:44 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) See http://www.zoleet.com/index.php/basic-openvpn-server-ubuntu-and-debian-openvz for a decent howto on openVZ. We're not sure how well it works, if you find something better, let us know.
09:44 < ecrist> !forget openvz 2
09:44 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:44 < ecrist> raar
09:44 <+EugeneKay> gzip!
09:45 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
09:48 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:48 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:49 < ecrist> !whoami
09:49 <@vpnHelper> I don't recognize you.
09:51 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
09:52 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:52 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:53 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
09:55 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:55 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:56 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
09:57 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
09:57 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:57 < ecrist> !forget openvz 2
09:57 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:57 < ecrist> RAAAR
09:59 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
10:00 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:00 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:00 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
10:01 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:01 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:02 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
10:02 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:03 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:03 < ecrist> FML you fucking bot
10:03 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
10:04 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:04 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:04 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
10:05 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:05 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:05 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Client Quit]
10:07 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
10:07 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:08 < ecrist> !forget openvz 2
10:08 <@vpnHelper> Joo got it.
10:09 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:09 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:09 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:09 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:21 <+EugeneKay> Heh
10:32 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
10:32 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
10:33 -!- novaflash_away is now known as novaflash
10:34 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:49 <@vpnHelper> RSS Update - forum: Get a new IP from OpenVPN server? <http://forums.openvpn.net/topic9224.html>
10:52 -!- ravel_cmd [~ravel_exe@175.136.85.157] has joined #openvpn
10:54 -!- ravel_exe [ravel_exe@175.136.85.157] has quit [Ping timeout: 260 seconds]
11:01 -!- Gravitro_ [~admin@64.93.227.72] has quit [Quit: Computer has gone to sleep.]
11:03 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 245 seconds]
11:15 -!- mfaroukg [~sameh@78.154.210.55] has left #openvpn []
11:21 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
11:28 -!- Gravitron [~admin@64.93.237.76] has joined #openvpn
11:29 -!- Gravitron [~admin@64.93.237.76] has quit [Changing host]
11:29 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
11:32 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
11:33 < orange-hand> hi, is there a way to run openvpn without having it begin on startup?
11:33 < orange-hand> or, to run openvpn not as a service, and/or with a different configuration directory?
11:35 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 245 seconds]
11:39 -!- Gravitron [~admin@64.93.237.76] has joined #openvpn
11:39 -!- Gravitron [~admin@64.93.237.76] has quit [Changing host]
11:39 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
11:43 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
12:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 245 seconds]
12:17 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
12:19 <@vpnHelper> RSS Update - forum: Can connect to VPN but can't ping clients behind the VPN <http://forums.openvpn.net/topic9204.html#p17602>
12:20 -!- Atomic008za [~gavin@41-132-58-239.dsl.mweb.co.za] has joined #openvpn
12:23 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
12:23 -!- Atomic009za [~gavin@41-132-58-239.dsl.mweb.co.za] has joined #openvpn
12:23 < Atomic009za> hi
12:25 <@vpnHelper> RSS Update - forum: Get a new IP from OpenVPN server? <http://forums.openvpn.net/topic9224.html#p17604> || topology subnet explanation <http://forums.openvpn.net/topic9202-15.html#p17603>
12:30 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has left #openvpn ["Leaving"]
12:30 -!- jeff007 [~jeff@2a01:e35:2f38:5b80:21d:92ff:fec9:baa4] has joined #openvpn
12:33 -!- ravel_exe [ravel_exe@175.136.85.157] has joined #openvpn
12:36 -!- ravel_cmd [~ravel_exe@175.136.85.157] has quit [Ping timeout: 244 seconds]
12:37 < jeff007> after restart openvpn i've this alerts : SIOCSIFADDR: Permission denied  SIOCSIFFLAGS: Permission denied ... so openvpn work with user openvpn and group openvpn ... and options: persist-key persist-tun ... where is problem? can you help me? I would like too chroot openvpn is there any one to help me?
12:39 < Atomic007za> run mine as nobody
12:40 -!- Atomic009za [~gavin@41-132-58-239.dsl.mweb.co.za] has quit []
12:40 -!- Atomic008za [~gavin@41-132-58-239.dsl.mweb.co.za] has quit []
12:41 < jeff007> nobody and nogroup is it better?
12:41 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:41 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:41 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:41 < Atomic007za> i think so, will start up fine
12:41 < Atomic007za> well mine does
12:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:42 < jeff007> i try it...
12:47 < Atomic007za> my problem, cant get server to ping client LAN IP
12:47 < Atomic007za> http://pastebin.com/pE0PdJi6
12:48 < Atomic007za> any ideas?
12:48 < Atomic007za> anyone
12:48 < Atomic007za> have been battling for 3 days
12:48 < jeff007> it's the same... after openvpn restart there is alert: SIOCDELRT: Operation not permitted with nobody and nogroup
12:51 < jeff007> there is no alert when openvpn word root
13:06 < datruth> Atomic007za: you have client-to-client in your config?
13:06 < Atomic007za> yes, on server conf
13:06 < datruth> jeff007: do those groups/user exisit?
13:07 < datruth> Atomic007za: perhaps you will need that setting in your client config
13:07 < datruth> Atomic007za: perhaps its a firewall issue
13:08 < datruth> jeff007: what distro you running openvpn on?
13:11 < Atomic007za> datruth: says: Options error: --client-to-client requires --mode server
13:11 < Atomic007za> datruth: the tunnel IP can ping each other
13:12 < Atomic007za> I think you may be right but port 1194 is open on bith sides
13:13 < datruth> Atomic007za: ahh client-to-client is an server option only
13:13 < datruth> Atomic007za: so your able to connect to the vpn
13:13 < datruth> but you can't ping?
13:15 < Atomic007za> the 10.8.0.2(server) can ping the 10.8.0.6 (client)
13:15 < Atomic007za> and
13:15 < Atomic007za> the 172.16.3.2 (client) can ping the 172.16.2.2(server) 
13:15 < Atomic007za> but
13:16 < Atomic007za> the 172.16.2.2(server) cant ping the 172.16.3.2(client)
13:16 < datruth> umm
13:16 < datruth> Why do you have 10.x and 172.x
13:16 < Atomic007za> and the 10.8.0.6 (client and also ping the 10.8.0.2(server)
13:17 -!- stsmith3 [~stsmith@207.86.232.19] has joined #openvpn
13:17 < datruth> Why isn't openvpn handing out 10.x addresses to clients that connect to it
13:18 < Atomic007za> one client side LAN is 172.16.3 the other server side LAN is 172.16.2 
13:18 < Atomic007za> and
13:18 < Atomic007za> OpenVPN come out with 10.8. by default
13:18 < Atomic007za> should I change it?
13:19 < datruth> client side lan hrmmm
13:19 < datruth> Whats your setup? Internet+Unix Server+Clients?
13:19 < Atomic007za> subnets are /24
13:20 < Atomic007za> LAN=LINUX=INTERNET=LINUX=LAN
13:20 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
13:20 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
13:21 < Atomic007za> Any ideas?
13:21 < datruth> Atomic007za: if you have a openvpn server that hands out 10.x addresses and your client who connects to your vpn has their own lan 172.x you will have to work on some routing
13:21 < Atomic007za> I did
13:21 < datruth> Atomic007za: if you just want to ping them then your client should also have 10.x addresses with their 172.x why not just ping the 10.x ip?
13:21 < Atomic007za> conf setup: http://pastebin.com/pE0PdJi6
13:23 < datruth> Atomic007za: what I see different is your 172.x ip have two diffrent gateways
13:23 < datruth> Maybe route 172.16.12.0 255.255.255.0 10.8.0.2 will do it
13:25 < Atomic007za> the 172.16.12. are VOIP phones, the LINUX box also as IP 172.16.12.2
13:26 < Atomic007za> the 172.16.2. are PC's and the have a gateway of 172.16.2.2
13:26 < datruth> The two subnets are on the same network?
13:26 < Atomic007za> yes
13:26 < datruth> Then its a routing issue
13:26 <+hyper_ch> hi
13:27 < Atomic007za> will try ur sugestion and get back to u soon, thx for the help so far
13:27 < datruth> *nods*
13:36 < jeff007> user openvpn and group openvn are created on my ubuntu
13:37 < Atomic007za> datruth: I am at this moment not trying to connect the clients, I am merly trying to ping 172.16.3.2 from 172.16.2.2 which are the LAN IP's of the linux box
13:37 < Atomic007za> and openvpn pushes route to the client
13:38 < Atomic007za> is the routes that openvpn is pushing wrong?
13:38 < datruth> Atomic007za: Firewall/IP Forwarding/Routing <--- one of these 3 things if not all is your problem
13:39 < Atomic007za> I am not even worried about 172.16.12/13 range
13:39 < datruth> Atomic007za: the route looks to be ok except with the different gateways
13:39 < Atomic007za> so if we just look at 172.16.2 connecting to 172.16.3 
13:40 < Atomic007za> do thows look right?
13:40 < Atomic007za> as far as the gateways are concerned?
13:40 < datruth> Atomic007za: I can't answer that I do not know enough about your network design
13:43 < Atomic007za> the default gateway would be to the internet, which I did not put onto pastebin, sorry
13:46 < Atomic007za> so for now, my network looks like this LANClient(172.16.3.2)VPNCLient(10.8.0.5)---------VPNServer(10.8.0.2)LANServer(172.16.2.2)
13:47 < datruth> Does that mean Internet+Router+Server+Client?
13:50 <@vpnHelper> RSS Update - forum: Get a new IP from OpenVPN server? <http://forums.openvpn.net/topic9224.html#p17605>
13:50 < Atomic007za> no
13:51 < Atomic007za> the LANClient and VPNClient is a Linux box the "2" nics in it. as for the other.
13:52 < Atomic007za> its the same senario, just that its the VPN Server
13:53 < Atomic007za> does that make sence?
13:53 < datruth> Not really but as I stated above 1 of the 3 things if not all is your problem
13:54 < Atomic007za> I know ;-(, but hae been trying to figure out what it is for the last 3 days.
13:54 < Atomic007za> a bit grenat this stuff
13:55 < datruth> What is your firewall?
13:55 < Atomic007za> its ClearOS
13:55 < datruth> So ClearOS is your firewall? 
13:56 < Atomic007za> well iptables is but CLearOS has a novice way of setting it up
13:57 < Atomic007za> have you worked with ClearOS before?
13:59 < datruth> no but I've worked with iptables
13:59 < datruth> I bet iptables might be your problem
14:00 < ecrist> !iptables
14:00 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
14:01 < Atomic007za> will try that now
14:07 -!- jeff007 [~jeff@2a01:e35:2f38:5b80:21d:92ff:fec9:baa4] has quit [Ping timeout: 240 seconds]
14:19 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has quit []
14:30 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
14:30 < orange-hand> hm
14:30 < orange-hand> I think openvpn is routing my incoming traffic to sshd over the vpn
14:30 < orange-hand> is this possible?
14:45 < stsmith3> im trying to connect from the server back to the client...that should work, right?
14:45 < stsmith3> error is: GET INST BY VIRT: 10.28.16.152 [failed]
14:46 < stsmith3> i found the faq entry and tried adding iroute...maybe i did it wrong?
14:47 < datruth> Atomic007za: still with us? Did that work?
14:48 < stsmith3> reading http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
14:57 < Atomic007za> I am still here
14:59 < Atomic007za> baby woke up
15:08 < Atomic007za> got to /sbin/iptables -F
15:09 < Atomic007za> server stopped responding
15:09 < Atomic007za> ;-*
15:09 < Atomic007za> its back
15:12 < Atomic007za> no, it did not work
15:12 -!- zdadmin [~chad@209.119.38.226] has joined #openvpn
15:12 < Atomic007za> in the server.conf file
15:12 < Atomic007za> theyrefer to a ccd folder
15:12 < Atomic007za> with a common name
15:13 < Atomic007za> what is the coomon name?
15:14 < Atomic007za> client-config-dir ccd
15:14 < Atomic007za> what should the name be?
15:15 < Atomic007za> from http://openvpn.net/index.php/open-source/documentation/howto.html#scope
15:15 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:16 < Atomic007za> http://openvpn.net/index.php/open-source/documentation/howto.html#scope
15:16 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:17 < Atomic007za> the daemon will check this directory for a file which matches the common name of the connecting client
15:17 < Atomic007za> is that the Linux box name?
15:19 < stsmith3> any advice on troubleshooting?
15:19 < stsmith3> how can i verify that the server has applied the iroute directive?
15:22 < Atomic007za> stsmith3: sorry to answer your q with another q, but what did you call the file in the ccd? and where did you get the name from? 
15:22 < stsmith3> carpathia
15:22 < stsmith3> from the common name in the client cert
15:22 < stsmith3> VERIFY OK: depth=0, /C=US/ST=OH/L=Columbus/O=Manta_Media__Inc./CN=carpathia/emailAddress=stsmith@manta.com
15:23 < stsmith3> I see some stuff from the ccd being applied: SENT CONTROL [carpathia]: 'PUSH_REPLY .... 
15:25 < stsmith3> but im not spotting anything about the iroute in the rather verbose output
15:25 < stsmith3> (the iroute applies to the server as i understand it))
15:34 <@vpnHelper> RSS Update - forum: Log Messages <http://forums.openvpn.net/topic9225.html>
15:45 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
15:45 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
15:45 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:45 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:52 -!- _julian [~quassel@hmbg-4d06963a.pool.mediaWays.net] has joined #openvpn
15:53 -!- _julian_ [~quassel@hmbg-4d0699ab.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
16:06 -!- _julian_ [~quassel@hmbg-4d06d5f0.pool.mediaWays.net] has joined #openvpn
16:06 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:06 -!- zdadmin [~chad@209.119.38.226] has quit [Quit: zdadmin]
16:07 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
16:07 -!- _julian [~quassel@hmbg-4d06963a.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
16:12 < Atomic007za> stsmith3:
16:12 < Atomic007za> OPTIONS IMPORT: reading client specific options from: ccd/openvpn
16:13 < Atomic007za> when you start the server
16:16 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
16:22 < Atomic007za> hi Datruth: thanks for the help. I came right
16:24 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:33 < stsmith3> Atomic007za, sigh, it was not reading the ccd. needed the full path for client-config-dir -- had thought it was relative to /etc/openvpn
16:33 < stsmith3> working now, thanks for the help
16:34 < stsmith3> --ccd-exclusive was helpful
16:41 -!- novaflash is now known as novaflash_away
16:57 -!- _julian [~quassel@hmbg-4d06aa60.pool.mediaWays.net] has joined #openvpn
16:57 -!- _julian_ [~quassel@hmbg-4d06d5f0.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
17:01 -!- _julian_ [~quassel@hmbg-4d06bfe5.pool.mediaWays.net] has joined #openvpn
17:02 -!- _julian [~quassel@hmbg-4d06aa60.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
17:16 -!- _julian_ [~quassel@hmbg-4d06bfe5.pool.mediaWays.net] has quit [Read error: Operation timed out]
17:17 -!- _julian [~quassel@hmbg-4d06cd42.pool.mediaWays.net] has joined #openvpn
17:18 -!- patelx [~nebula@openvpn/corp/admin/patel] has joined #openvpn
17:18 -!- mode/#openvpn [+o patelx] by ChanServ
17:34 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html>
17:42 -!- patelx [~nebula@openvpn/corp/admin/patel] has quit [Ping timeout: 245 seconds]
18:03 -!- Gravitron [~admin@64.93.227.79] has joined #openvpn
18:03 -!- Gravitron [~admin@64.93.227.79] has quit [Changing host]
18:03 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
18:06 -!- yell0 [yello@unaffiliated/contempt] has quit [Ping timeout: 258 seconds]
18:11 -!- Gravitron [~admin@unaffiliated/gravitron] has left #openvpn ["Textual IRC Client: http://www.textualapp.com/"]
18:11 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
18:12 < Gravitron> hey, could someone try to debug this for me, no clue what's going on, connecting to VPN works, ping works, but actually connecting to the rest of the internet doesn't. http://d.gr-v-ty.com/HGjc
18:12 <@vpnHelper> Title: Screen shot 2011-11-15 at 01:05:13.png (at d.gr-v-ty.com)
18:12 < Gravitron> thanks :D
18:12 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
18:13 -!- Denial [Denial@drgi.co.uk] has quit []
18:16 <+EugeneKay> It looks like the SNAT rule needs to be run on the OpenVZ host
18:16 <+EugeneKay> FWIW
18:18 < Gravitron> EugeneKay, you mean like this? iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source server.ip
18:19 <+EugeneKay> Oh sorry, that wasn't OpenVPN
18:19  * EugeneKay derp
18:19 < Gravitron> lol
18:20 <+EugeneKay> Sorry, I really dunno about OpenVZ. I suspect that the lack of MASQUERADE means that SNAT might not be working as well
18:21 < Gravitron> hrmm
18:22 < Gravitron> EugeneKay: do i have to do the def1 redirect and DNS stuff?
18:22 <+EugeneKay> If your client has their DNS set to something like 8.8.8.8 anyway, you can skip it
18:22 <+EugeneKay> You need the def1
18:24 < Gravitron> hrmm
18:28 < Gravitron> it's definitely a DNS issue
18:28 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17610> || Log Messages <http://forums.openvpn.net/topic9225.html#p17609> || Get a new IP from OpenVPN server? <http://forums.openvpn.net/topic9224.html#p17608>
18:36 < Gravitron> EugeneKay: i dont need any sort of DNS stuff installed on the server correct?
18:36 <+EugeneKay> Nope.
18:36 -!- _julian [~quassel@hmbg-4d06cd42.pool.mediaWays.net] has quit [Read error: Operation timed out]
18:38 -!- _julian [~quassel@hmbg-5f762d43.pool.mediaWays.net] has joined #openvpn
18:44 < Gravitron> GOD WHAT THE F**!
18:44 < Gravitron> i am so frustrated -.-
18:47 -!- _julian_ [~quassel@hmbg-5f761c2d.pool.mediaWays.net] has joined #openvpn
18:49 -!- _julian [~quassel@hmbg-5f762d43.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
19:03 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:18 < krzie> !openvznat
19:18 <@vpnHelper> "openvznat" is a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP>
19:19 -!- Atomic007za [~gavin@41-132-58-239.dsl.mweb.co.za] has quit []
19:45 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
19:46 < Gravitron> krzie: just ran that, problem persists. but thanks, perhaps it is part of the solution
19:46 < krzie> ip forwarding is enabled on the server?
19:47 < krzie> (and allowed in the forward chain)
19:47 < Gravitron> i believe so
19:48 < Gravitron> echo 1 > /proc/sys/net/ipv4/ip_forward
19:48 < Gravitron> i ran that ^
19:48 < Gravitron> so yes, although im not sure if it's allowed in the forward chain
19:48 < krzie> thats only valid til reboot
19:48 < krzie> cat /proc/sys/net/ipv4/ip_forward
19:48 < krzie> is it still 1?
19:48 -!- ravel_exe [ravel_exe@175.136.85.157] has quit []
19:49 < Gravitron> yes
19:49 < krzie> 1sec lemme rtfm for ya on the forward chain
19:49 < krzie> !man
19:49 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
19:50 < krzie> iptables -A INPUT -i tun+ -j ACCEPT
19:50 < krzie> iptables -A FORWARD -i tun+ -j ACCEPT
19:50 < Gravitron> i'm running 2.1 fyi
19:50 < Gravitron> ok
19:52 < Gravitron> :/ still not working, could enabling DNS servers on the client help?
19:53 < Gravitron> and krzie, it doesn't matter which 10.0.8.x IP the client connects to right?
19:54 < krzie> you dont need me to tell you if its a dns problem
19:54 < krzie> ping an ip, lol
19:56 < krzie> and you used 10.0.8;.x as your subnet?
19:56 < krzie> if so, i hope you changed the NAT rule to match...
19:57 -!- kralor [~kralor@hackincorp.net] has quit [Ping timeout: 276 seconds]
19:57 -!- Gravitro_ [~admin@64.93.227.79] has joined #openvpn
19:58 < Gravitro_> yes, the subnet is on 10.8.0.0
19:58 < Gravitro_> wait hrm
19:58 < Gravitro_> well i used the command with 10.8.0.0
19:58 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Read error: Connection reset by peer]
19:58 < Gravitro_> i typed it incorrectly earlier
19:59 -!- _julian [~quassel@hmbg-4d06998a.pool.mediaWays.net] has joined #openvpn
20:00 -!- Gravitro_ [~admin@64.93.227.79] has quit [Client Quit]
20:00 -!- Gravitron [~admin@64.93.227.79] has joined #openvpn
20:00 -!- Gravitron [~admin@64.93.227.79] has quit [Changing host]
20:00 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
20:01 < Gravitron> krzie/ EugeneKay , if i gave you access to the server, would you be willing to look at the setup?
20:02 < Gravitron> it's a pretty shitty server and there's literally nothing else on it, so i dont really care lol
20:02 <+EugeneKay> My standard consulting rates are $60/hour, but I don't touch OpenVZ.
20:02 -!- _julian_ [~quassel@hmbg-5f761c2d.pool.mediaWays.net] has quit [Ping timeout: 256 seconds]
20:02 < Gravitron> oh shit!
20:07 -!- _julian_ [~quassel@hmbg-5f762c14.pool.mediaWays.net] has joined #openvpn
20:07 -!- _julian [~quassel@hmbg-4d06998a.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
20:09 < Gravitron> i feel like i should just get a better VPS
20:14 -!- kralor [~kralor@hackincorp.net] has joined #openvpn
20:17 <+EugeneKay> I recommend Linode.
20:23 <+EugeneKay> http://linux.org/docs/ldp/howto/Bandwidth-Limiting-HOWTO/
20:27 -!- _julian [~quassel@hmbg-5f76502e.pool.mediaWays.net] has joined #openvpn
20:30 -!- _julian_ [~quassel@hmbg-5f762c14.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
20:35 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
20:35 < Gravitro_> wow i fail, i had an inncorrect ip in for my SNAT entry in iptables
20:36 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 276 seconds]
20:37 <+EugeneKay> -_-
20:37 < Gravitro_> i apologize.
20:37 < Gravitro_> my noobyness is truly nooby
20:38 < krzie> [17:56]  <krzie> and you used 10.0.8;.x as your subnet?
20:38 < krzie> [17:56]  <krzie> if so, i hope you changed the NAT rule to match...
20:38 < krzie> ;]
20:39 < Gravitro_> krzie: no it's worse than that, i entered my external ip incorrectly xD
20:43 -!- _julian [~quassel@hmbg-5f76502e.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
20:43 -!- Gravitro_ [~admin@69.163.40.45] has quit [Read error: Connection reset by peer]
20:44 -!- _julian [~quassel@hmbg-4d06e003.pool.mediaWays.net] has joined #openvpn
20:47 -!- Gravitron [~admin@64.93.227.79] has joined #openvpn
20:47 -!- Gravitron [~admin@64.93.227.79] has quit [Changing host]
20:47 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
20:52 -!- _julian_ [~quassel@hmbg-5f765b44.pool.mediaWays.net] has joined #openvpn
20:53 -!- _julian [~quassel@hmbg-4d06e003.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
21:07 <@vpnHelper> RSS Update - forum: How to config server to accept more than one client <http://forums.openvpn.net/topic9227.html>
21:10 -!- luptenschteiner is now known as probonono
21:12 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 260 seconds]
21:12 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has quit [Ping timeout: 256 seconds]
21:13 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
21:14 -!- Gravitron [~admin@64.93.227.79] has joined #openvpn
21:14 -!- Gravitron [~admin@64.93.227.79] has quit [Changing host]
21:14 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
21:21 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
21:23 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 260 seconds]
21:36 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
21:42 -!- master_of_master [~master_of@p57B55EF6.dip.t-dialin.net] has quit [Read error: Operation timed out]
21:46 -!- master_of_master [~master_of@p57B55FA6.dip.t-dialin.net] has joined #openvpn
21:49 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17612>
21:51 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:55 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17613>
22:10 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:06 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Remote host closed the connection]
23:09 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
23:21 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 244 seconds]
23:33 -!- vtcN [~vtcN@unaffiliated/thethe] has joined #openvpn
23:35 -!- vtcN- [~vtcN@unaffiliated/thethe] has quit [Ping timeout: 240 seconds]
--- Day changed Wed Nov 16 2011
00:04 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:21 -!- luckyruby [~luckyruby@125-187.96-97.tampabay.res.rr.com] has joined #openvpn
00:27 -!- dazo_afk is now known as dazo
00:28 < luckyruby> are openvpn clients allowed to share client certs or should they each have their own?
00:35 -!- luckyruby [~luckyruby@125-187.96-97.tampabay.res.rr.com] has left #openvpn ["Leaving..."]
00:48 -!- vtcN [~vtcN@unaffiliated/thethe] has quit [Remote host closed the connection]
00:56 <@vpnHelper> RSS Update - forum: Get a new IP from OpenVPN server? <http://forums.openvpn.net/topic9224.html#p17614>
01:18 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
01:38 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17615>
01:56 -!- novaflash_away is now known as novaflash
02:11 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:11 -!- mode/#openvpn [+o mattock] by ChanServ
02:14 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17616>
02:24 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:31 -!- dym [~patrick@unaffiliated/dym] has quit [Quit: Lost terminal]
02:51 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17618> || Can connect to VPN but can't ping clients behind the VPN <http://forums.openvpn.net/topic9204.html#p17617>
03:20 -!- Mowee [~Mowi@lendabrain.net] has quit [Remote host closed the connection]
03:26 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p17619>
03:40 -!- Gud [~erik@78-70-22-214-no94.business.telia.com] has quit [Quit: leaving]
03:43 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
03:43 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
03:43 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:49 -!- repot [~repot@unaffiliated/repot] has joined #openvpn
04:15 <@vpnHelper> RSS Update - forum: Openvpn and Oracle RAC <http://forums.openvpn.net/topic9228.html>
04:28 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:23 -!- _julian [~quassel@hmbg-4d0689a0.pool.mediaWays.net] has joined #openvpn
05:23 -!- _julian_ [~quassel@hmbg-5f765b44.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
05:36 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
05:37 -!- qsp [~bmflavio@46.50.15.229] has joined #openvpn
05:39 < qsp> !welcome
05:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:39 < qsp> !wiki firewall
05:39 < qsp> !howto
05:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:45 <@vpnHelper> RSS Update - forum: Get a new IP from OpenVPN server? <http://forums.openvpn.net/topic9224.html#p17622> || Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p17621>
05:47 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
05:50 -!- ravel_exe [ravel_exe@175.136.85.157] has joined #openvpn
05:55 < qsp> !pastebin
05:55 <@vpnHelper> Unable to download feed.
06:00 < qsp> !pastebin http://pastebin.com/rFNQuB7s
06:00 <@vpnHelper> Error: 'http://pastebin.com/rFNQuB7s' is not a valid integer.
06:02 < qsp> hello, good afternoon. i believe i'm having troubles with my firewall. perhaps some of you could give me some keypoints on what is wrong. i've configure a routed openvpn, and client can ping the server and vice-versa, both to 10.8.0.1 and the servers nic addres 10.20.131.96
06:03 < qsp> nevertheless i can't ping further. i've created a pastebin to demonstrate the problem, routes and also an output of traceroute. http://pastebin.com/rFNQuB7s
06:04 < qsp> so, it all seems to work well where openvpn is concerned, but i can't make the ip forwarding work correctly. the client, 10.20.131.99, has a route back to the server (10.20.131.96)
06:04 < qsp> the client in the server's subnet, i mean. also, pcs on the server subnet can ping 10.8.0.1, but not further.
06:09 <+hyper_ch> dazo: krzie: http://spectrum.ieee.org/automaton/robotics/medical-robots/robot-controls-human-arm
06:09 <@vpnHelper> Title: Watch This Robot Control a Person's Arm Using Electrodes - IEEE Spectrum (at spectrum.ieee.org)
06:10 < stsmith3> I'm trying to get a site-to-site vpn up into the Rackspace cloud. It's working, but it seems like -- based on watching traffic with tcpdump go out the src but never arrive at the dst -- RS's network drops packets with private ips that it doesn't know about.
06:12 < stsmith3> One solution is to have each of my rackspace cloud servers act as an openvpn client so that all the traffic goes through a tunnel and thus won't get dropped.
06:12 < stsmith3> Any other ideas? Am I trying to do something crazy?
06:13 < stsmith3> Also interested in any experience doing similar with AWS.
06:14 <+hyper_ch> I don't follow what works and what doesn't
06:17 < stsmith3> Will try to explain. I have rsvpnsrv and rsother. I have a route in rsother that says for the non-rs subnet use rsvpnsrv as the gateway. Packed goes out eth1 on rsother but never arrives at rsvpnsrv.
06:18 < stsmith3> rsother is not an openvpn client. I was planning to just use routing. A solution would be to make rsother an openvpn client so the traffic bound for the remote subnet is tunneled.
06:18 <+hyper_ch> !configs
06:18 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
06:18 <+hyper_ch> !goal
06:18 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:18 <+hyper_ch> !welcome
06:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:18 <+hyper_ch> !route
06:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
06:21 -!- Netsplit *.net <-> *.split quits: kralor, Nowak, oc80z, @dazo
06:24 -!- Netsplit over, joins: @dazo, Nowak, kralor, oc80z
06:25 < stsmith3> hyper_ch: thanks, i've read all those and think i understand them. the issue i encountered isnt with openvpn, it's that rackspace's network (which I don't control) drops packets that it doesn't like.
06:25 <+hyper_ch> if it's not vpn related we can't really help
06:25 < stsmith3> even though it's not an openvpn issue, i thought someone here might have encountered it and have advice
06:25 < stsmith3> or have feedback on my proposed solution
06:37 -!- qsp [~bmflavio@46.50.15.229] has quit [Ping timeout: 248 seconds]
06:40 -!- dazo is now known as dazo_afk
06:47 -!- beerbro [~gustav@109.75.184.199] has quit [Quit: ZNC - http://znc.sourceforge.net]
06:48 -!- beerbro [~gustav@109.75.184.199] has joined #openvpn
07:11 -!- jeff007 [~jeff@zaclarise.net] has joined #openvpn
07:18 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
07:19 -!- zu [~zu@ks387228.kimsufi.com] has quit [Quit: Lost terminal]
07:22 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
07:26 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
07:28 -!- StFS [~stefan@gagnasetur.ru.is] has left #openvpn []
07:33 -!- ravel_exe [ravel_exe@175.136.85.157] has quit [Ping timeout: 258 seconds]
07:36 -!- kyrix [~ashley@mk046207255200.a1.net] has joined #openvpn
07:40 <@vpnHelper> RSS Update - forum: OpenVPN Client Program customization <http://forums.openvpn.net/topic9200.html#p17623>
07:43 -!- repot [~repot@unaffiliated/repot] has quit [Quit: Leaving]
07:43 -!- repot [~repot@93-173-165-244.bb.netvision.net.il] has joined #openvpn
07:43 -!- repot [~repot@93-173-165-244.bb.netvision.net.il] has quit [Changing host]
07:43 -!- repot [~repot@unaffiliated/repot] has joined #openvpn
07:43 -!- repot [~repot@unaffiliated/repot] has quit [Remote host closed the connection]
07:44 -!- Netsplit *.net <-> *.split quits: Fleck, reisi, zu
07:44 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:48 -!- Netsplit over, joins: zu, Fleck, reisi
07:57 -!- bauruine [~stefan@12-169.105-92.cust.bluewin.ch] has joined #openvpn
07:57 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has joined #openvpn
08:08 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 240 seconds]
08:22 <@vpnHelper> RSS Update - forum: Openvpn and Oracle RAC <http://forums.openvpn.net/topic9228.html#p17624>
08:25 -!- reisi_ [koivunej@mustatilhi.cs.tut.fi] has joined #openvpn
08:25 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
08:28 <@vpnHelper> RSS Update - forum: Log Messages <http://forums.openvpn.net/topic9225.html#p17626> || How to setup an IP phone with an OpenVPN client <http://forums.openvpn.net/topic9229.html>
08:28 -!- zu_ [~zu@ks387228.kimsufi.com] has joined #openvpn
08:33 -!- Netsplit *.net <-> *.split quits: Fleck, reisi, bauruine, zu
08:33 <@vpnHelper> RSS Update - forum: Configure openvpn at a virtual server <http://forums.openvpn.net/topic9230.html>
08:38 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has quit [Ping timeout: 260 seconds]
08:39 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has joined #openvpn
08:40 -!- bauruine [~stefan@12-169.105-92.cust.bluewin.ch] has joined #openvpn
08:45 -!- datruth [datruth@gotpot.org] has left #openvpn []
08:46 -!- Fleck [~fleck@unaffiliated/fleck] has joined #openvpn
08:49 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:16 -!- tty234 [telex@gateway/shell/anapnea.net/x-kfneyhjzkbnonzwl] has quit [Ping timeout: 276 seconds]
09:17 -!- tty234 [telex@gateway/shell/anapnea.net/x-ntmeekjtkpnuwkau] has joined #openvpn
09:31 -!- ravel_exe [~ravel_exe@175.136.85.157] has joined #openvpn
09:36 -!- ravel_exe [~ravel_exe@175.136.85.157] has quit [Ping timeout: 258 seconds]
09:42 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
09:44 <@vpnHelper> RSS Update - forum: How to setup an IP phone with an OpenVPN client <http://forums.openvpn.net/topic9229.html#p17629> || Log Messages <http://forums.openvpn.net/topic9225.html#p17628>
10:26 <@vpnHelper> RSS Update - forum: How to setup an IP phone with an OpenVPN client <http://forums.openvpn.net/topic9229.html#p17630>
10:32 <+hyper_ch> krzie: "Do not track" header on its way to become a webstandard  http://www.w3.org/2011/11/dnt-pr.html.en
10:32 <@vpnHelper> Title: W3C Announces First Draft of Standard for Online Privacy (at www.w3.org)
10:32 <@vpnHelper> RSS Update - forum: How to setup an IP phone with an OpenVPN client <http://forums.openvpn.net/topic9229.html#p17631>
10:33 < krzie> heh
10:33 < krzie> optional non-tracking
10:33 < krzie> how cute
10:34 <+hyper_ch> krzie: it could become enforceable in the US  http://commerce.senate.gov/public/?a=Files.Serve&File_id=85b45cce-63b3-4241-99f1-0bc57c5c1cff
10:41 < krzie> lol right, cause they are so good at enforcing digital laws
10:41 < krzie> think the NSA will honor the "do not track" while they have legit backdoor access to the major carrier hotels?
10:41 < krzie> lol
10:42 <+hyper_ch> so, gotta get home
10:44 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:46 -!- dazo_afk is now known as dazo
10:49 -!- bauruine [~stefan@12-169.105-92.cust.bluewin.ch] has quit [Remote host closed the connection]
10:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:56 -!- jeff007 [~jeff@zaclarise.net] has quit [Quit: Quitte]
10:56 <@vpnHelper> RSS Update - forum: Openvpn and Oracle RAC <http://forums.openvpn.net/topic9228.html#p17632>
11:02 <@vpnHelper> RSS Update - forum: Openvpn and Oracle RAC <http://forums.openvpn.net/topic9228.html#p17633>
11:08 <@vpnHelper> RSS Update - forum: How to setup an IP phone with an OpenVPN client <http://forums.openvpn.net/topic9229.html#p17634>
11:24 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 276 seconds]
11:31 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
11:34 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
11:34 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:38 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
11:39 <@vpnHelper> RSS Update - forum: Openvpn and Oracle RAC <http://forums.openvpn.net/topic9228.html#p17635>
11:39 < grendal-prime> i have one windows box that for whatever reason, when i reboot it..the tap device comes up disabled.
11:39 < grendal-prime> every time
11:39 < grendal-prime> if i enable the device the thing connects fine.  This is a winxp box
11:40 < grendal-prime> i do get a "createfile failed on tap device" error. but im sure that is the case because the tap device..is...well disabled
11:40 < grendal-prime> anyone else run into this?
11:40 < grendal-prime> they tried a reinstall and that didnt fix it. I dont think they tried to totally uninstall and then reinstall.
11:41 < grendal-prime> and for what its worth you couldnt fill a thimball with what i know about windows.
11:41 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
11:55 -!- _julian_ [~quassel@hmbg-4d06d85f.pool.mediaWays.net] has joined #openvpn
11:56 -!- _julian [~quassel@hmbg-4d0689a0.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
11:57 < reiffert> grendal-prime: google thinks that you are fighting that ugly world on yourself.
12:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 258 seconds]
12:23 -!- stevefink [steve@shell.vaerchi.com] has quit [Quit: .]
12:36 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
12:54 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:58 < grendal-prime> ya no kidding
13:09 <@vpnHelper> RSS Update - forum: Log Messages <http://forums.openvpn.net/topic9225.html#p17636>
13:24 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:32 -!- sevard [~sev@unaffiliated/sevard] has joined #openvpn
13:32 < sevard> !welcome
13:32 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:33 < sevard> !goal
13:33 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:34 < sevard> !goal I would like example configs for a server configured for RA (Road Warrior) VPN using IKE/ISAKMP
13:34 < sevard> !howto
13:34 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:35 < sevard> the howto is SSL centric.
13:35 < sevard> !wiki
13:35 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
13:43 -!- Streppelchen [~volkermau@p57A4AAB9.dip.t-dialin.net] has joined #openvpn
13:44 < Streppelchen> hey all. i'm trying to get openvpn running,did everything on serverside and the server is running without any errors, tho the client now tells me "VERIFY ERROR: could not extract CN from X509 subject string". any idea what could be wrong here? (english is not my first language,just to mention it)
13:50 -!- sevard [~sev@unaffiliated/sevard] has left #openvpn []
13:53 < Streppelchen> i guess i found the error
13:55 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:00 -!- _julian [~quassel@hmbg-4d06c2da.pool.mediaWays.net] has joined #openvpn
14:01 -!- _julian_ [~quassel@hmbg-4d06d85f.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
14:03 < Streppelchen> ok now i'm getting VERIFY ERROR: depth=1, error=self signed certificate in certificate chain:
14:04 -!- _julian_ [~quassel@hmbg-4d06b4e8.pool.mediaWays.net] has joined #openvpn
14:05 < Olipro> Streppelchen: and which part of that error is unclear to you?
14:06 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
14:06 -!- _julian [~quassel@hmbg-4d06c2da.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
14:10 < Streppelchen> well the error itself is pretty clear to me,i jsut don't understand why i'm getting it at all
14:11 < Streppelchen> i used the ca_cert as ca option in the cnfig,what is wrong obviously,so i don't see which one i should be using
14:11 < Streppelchen> but i'm getting close to understanding it
14:12 -!- reisi_ is now known as reisi
14:13 < Streppelchen> at least i thought so
14:13 < Streppelchen> so which of the files should i use for the ca option?
14:14 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
14:15 < Streppelchen> from my understanding,the ca stuff is only serverside(key authority),right so far?
14:18 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
14:18 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
14:18 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
14:21 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
14:29 < Streppelchen> huh strange,now it seems to work...at least half...it stays at connecting now...hope it works
14:29 < Streppelchen> it verifies the certs now without problems...how long would it normally take to make the connection?
14:33 < Streppelchen> http://pastebin.com/LjBnNa3q any idea? syslog doesn't show anything
14:51 <@vpnHelper> RSS Update - forum: Configure openvpn at a virtual server <http://forums.openvpn.net/topic9230.html#p17637>
14:55 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has joined #openvpn
14:57 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has left #openvpn []
14:58 -!- kyrix [~ashley@mk046207255200.a1.net] has quit [Ping timeout: 252 seconds]
14:59 < orange-hand> Hi, is there a way for me to run some route commands after the vpn is setup?
15:00 < orange-hand> my server sends a bad routing rule which messes up some other things
15:00 < orange-hand> I'd like to automatically delete that particular rule
15:14 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Ping timeout: 248 seconds]
15:31 -!- kyrix [~ashley@mk046207255007.a1.net] has joined #openvpn
15:36 -!- kyrix [~ashley@mk046207255007.a1.net] has quit [Quit: Ex-Chat]
15:37 -!- kyrix [~ashley@mk046207255007.a1.net] has joined #openvpn
15:38 -!- _julian_ [~quassel@hmbg-4d06b4e8.pool.mediaWays.net] has quit [Read error: Operation timed out]
15:42 -!- _julian [~quassel@hmbg-4d06e65e.pool.mediaWays.net] has joined #openvpn
15:45 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
15:46 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:47 -!- kyrix [~ashley@mk046207255007.a1.net] has quit [Ping timeout: 245 seconds]
15:48 -!- _julian [~quassel@hmbg-4d06e65e.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
15:50 -!- _julian [~quassel@hmbg-4d06a26f.pool.mediaWays.net] has joined #openvpn
15:57 -!- twobitsprite [~isaac@li24-165.members.linode.com] has joined #openvpn
15:58 < twobitsprite> good afternoon, etc... I'm trying to set up a vpn to a server from two clients using static keys... when I try it with UDP I get warnings about replays, etc, and the connection is flakey.. when I switch to UDP, only one of them can connect at a time...
15:58 < twobitsprite> do I need two instances on the server running at a time for this to work?
15:59 <+EugeneKay> Static key will only work 1 server <---> 1 client.
15:59 <+EugeneKay> If you wan multiple clients you should build a SSL PKI.
16:06 < twobitsprite> ok, thanks
16:13 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has joined #openvpn
16:13 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17638>
16:16 -!- orange-hand [~orange-ha@gateway/tor-sasl/orange-hand] has quit [Client Quit]
16:19 -!- llunved [~llunved@kreetago.llunved.net] has joined #openvpn
16:26 -!- _julian [~quassel@hmbg-4d06a26f.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
16:26 -!- _julian [~quassel@hmbg-4d06f031.pool.mediaWays.net] has joined #openvpn
16:29 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
16:36 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
16:38 <@vpnHelper> RSS Update - forum: How to rename "openvpn" user <http://forums.openvpn.net/topic9231.html>
16:39 -!- _julian_ [~quassel@hmbg-4d06e9fe.pool.mediaWays.net] has joined #openvpn
16:42 -!- _julian [~quassel@hmbg-4d06f031.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
16:47 < llunved> I am trying to set up a openvpn tls-server and I am running into the following error: VERIFY ERROR: depth=0, error=unsupported certificate purpose: /O=MYREALM/CN=my.internal.client.fqdn
16:47 -!- _julian_ [~quassel@hmbg-4d06e9fe.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
16:48 < llunved> On the server this is. Playing around with remote-cert-tls, -ku, -eku, tls-remote, etc. does not change things. 
16:48 < llunved> Plus the error listing the Subject of my client cert in the unsupported purpose context is kind of confusing.
16:49 < llunved> I have two theories: a) the client cert actually has weird purpose settings: "SSL client : No ... SSL server : Yes ... Any Purpose : Yes" - but shouldn't I be able to work around that with config options?
16:49 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17640>
16:50 -!- _julian [~quassel@hmbg-4d069d28.pool.mediaWays.net] has joined #openvpn
16:50 < llunved> b) the Subject of the cert does not match the reverse lookup of the client's public IP... 
16:50 < llunved> Any idea?
16:51 <+EugeneKay> What did you use to make up the certs?
16:51 < llunved> They have been issued by a free-ipa server
16:52 <+EugeneKay> They probably aren't signed correctly for OpenVPN use. Could you post one of the public .crts?
16:52 < llunved> Where do you want it? Bit long for c&p here ;-)
16:53 <+EugeneKay> !pastebin
16:53 <+EugeneKay> I hate this bot
16:53 <+EugeneKay> !paste
16:53 <+EugeneKay> !pb
16:53 <@vpnHelper> Unable to download feed.
16:53 <+EugeneKay> Fuck it, you get the idea.
16:53 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
16:53 <+EugeneKay> Oh, NOW he pays attention.
16:54 <+EugeneKay> And of course pastebin.ca is dead
16:54 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
16:54 < smw> !goal
16:54 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:57 < llunved> EugeneKay, http://pastebin.ch/6848
16:58 <+EugeneKay> This is a client cert?
16:58 < llunved> Yes... 
16:59 <+EugeneKay> "Certificate purposes:" "SSL 
16:59 <+EugeneKay> client 
16:59 <+EugeneKay> : No"
16:59 < llunved> Yes
16:59 < llunved> However, I should be able to work around that in the openvpn config, right?
16:59 < llunved> I did ask people on #freeipa if that is a bug or intentionally ;-)
16:59 <+EugeneKay> I dunno, actually.
17:00 <+EugeneKay> I tend not to try to fight such things
17:00 < llunved> The certs *should* be client AND server...
17:00 < llunved> So I guess its' a bug
17:00 -!- novaflash is now known as novaflash_away
17:00 < llunved> It also has Any Purpose : Yes - but perhaps that is more philosophical than I thought...
17:00 <+EugeneKay> Try --remote-cert-ku
17:01 <+EugeneKay> Actually, that's the x509v3 key usage section, not the certificate purposes section.... hrm.
17:01 < llunved> So I tried using things like "remote-cert-tls server", "remote-cert-ku f0"
17:02 < llunved> All that does not change anything.
17:02 < llunved> Plus I am still confused that it complains *before* the verification against the CA cert
17:03 <+EugeneKay> I *think* its becaus the client cert being presented has SSLClient set to No, so it fails out before it even gets to CA checking.
17:03 < llunved> Until now I have seen the key usage errors only come after the CA validation and the with error messages like: ++ Certificate has key usage  00f0, expects 00a0
17:03 < llunved> Hmm.
17:03 <+EugeneKay> That is to say, the "client" cert you list there is meant to take the Server role in a TLS handshake
17:04 <+EugeneKay> Are you sure you don't have the cert mixed up?
17:04 < llunved> But what about "remote-cert-tls server" ?
17:05 <+EugeneKay> Thats KU and EKU fields. TLS client/server type is more low-level, having to do with the TLS handshake .
17:05 < llunved> hmm. i see
17:05 < llunved> and it's nothing to set in the csr i think...
17:06 <+EugeneKay> I don't know jack about IPA, so I can't really help you there. 
17:06 <+EugeneKay> Other than "get the right kind of cert"
17:06 -!- statix [statix@rrcs-208-125-52-150.nys.biz.rr.com] has quit [Remote host closed the connection]
17:07 -!- statix [~statix@rrcs-208-125-52-150.nys.biz.rr.com] has joined #openvpn
17:07 < smw> Can someone help me? I start the vpn on the client side and it says "ok". Then no tun interface shows up. config: http://paste.ubuntu.com/740686/ log: http://paste.ubuntu.com/740688/
17:09 <+EugeneKay> smw - the connection is never getting established. You have a firewall somewhere in between thats blocking the connection or the return packets.
17:10 < smw> ah! I think I setup aws to allow tcp not udp
17:10 < smw> thanks
17:10 <+EugeneKay> !tcp
17:10 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
17:12 < smw> hm, still doen't work :-\
17:12 < llunved> EugeneKay, thanks for the advise... I'll go back to whining at the guys in #freeipa ;-)
17:12 < smw> EugeneKay, I am using udp. But I allowed TCP only
17:12 <+EugeneKay> Allow UDP? :-p
17:13 < smw> EugeneKay, apparently that did not work
17:13 < smw> I am going to disable the AMZN firewall and try again
17:13 <+EugeneKay> /topic:  || Your problem is your firewall, really. || 
17:13 <+EugeneKay> ;-)
17:14 < smw> EugeneKay, very true. But when you said it was being denied, I figured out I did something wrong. Anyways, it still isn't working after allowing all tcp and udp
17:15 < smw> so there are multiple problems
17:15 < smw> any one of which would be causing this :-P
17:15 <+EugeneKay> Did you enable the port outgoing from your client?
17:15 < smw> my client works with another openvpn server with roughly the same config
17:16 < smw> I am replicating it because my users want the server in Singapore instead of Virginia :-P.
17:16 -!- dazo is now known as dazo_afk
17:17 -!- ravel_exe [~ravel_exe@175.136.85.157] has joined #openvpn
17:17 -!- mick72 [~mick72@as1-109.opole.dialup.inetia.pl] has joined #openvpn
17:18 < mick72> !goal
17:18 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:19 < mick72> hi
17:20 < smw> I think !goal in the topic is a good way to see who reads the topic. lol
17:20 < smw> mick72, I did the same thing when I entered today :-P
17:21 -!- mmbeck [mmbeck@home.akausal.de] has left #openvpn []
17:26 < smw> EugeneKay, still not working. The openvpn server log does not show any mention of my client connecting
17:26 < smw> EugeneKay, any ideas?
17:26 < mick72> I have server with few internet facing interfaces and I want to use to access internet over my vpn connections. I want to be able to assign clients outgoing internet traffic to particular interface, so that client1 will use interface1 for it's internet traffic, while client2 will use interface2.
17:26 <+EugeneKay> Firewall somewhere. Try a different port.
17:27 < krzie> mick72, which part do you need help with?
17:27 < krzie> ALL?  or have you gotten redirect working already?
17:27 < mick72> assigning each client's internet traffic to particular interface.
17:28 < krzie> ok at that point
17:28 < krzie> !static
17:28 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
17:28 < krzie> !linnat
17:28 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
17:28 < krzie> give each client a static IP, nat that static vpn ip to whatever inet facing IP you want =]
17:29 <+EugeneKay> krzie - !pastebin #2 is obsolete as well
17:29 -!- ravel_exe [~ravel_exe@175.136.85.157] has quit [Ping timeout: 244 seconds]
17:29 < krzie> !pastebin
17:30 <@vpnHelper> Unable to download feed.
17:30 < krzie> !paste
17:30 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
17:30 < krzie> *shrug* looks fine to me
17:31 <+EugeneKay> Times out in failfox for me
17:32 < krzie> !forget pastebin 2
17:32 <@vpnHelper> Joo got it.
17:32 <+EugeneKay> Using wget, IPv6 comes back as No Route to Host, and IPv4 is hung at "HTTP Request Sent"
17:36 -!- _julian_ [~quassel@hmbg-4d06ad5e.pool.mediaWays.net] has joined #openvpn
17:36 < mick72> krzie - thanks. Out of curiosity, if I used -I PREROUTING -o eth0 in that example, then packet could still be sent via say, eth1 if routing table would deem it more optimal? 
17:37 -!- _julian [~quassel@hmbg-4d069d28.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
17:37 < mick72> and postrouting will send it via eth0 no matter what routing table says?
17:38 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
17:38 < mick72> uhm, wait, I don't think that's how it works.
17:41 -!- ravel_exe [ravel_exe@175.136.85.157] has joined #openvpn
17:43 < smw> EugeneKay, I have managed to prove it is a firewall problem. However, I have no idea what is blocking it...
17:43 < smw> whatever it is it is server side
17:43  * smw <3 netcat
17:43 <+EugeneKay> From the client, traceroute -U -p 1194 hostname.com
17:46 < smw> EugeneKay, many hops... this is taking awhile
17:47 < mick72> krzie - If I understand it correctly, ass this does, is changing source IP of packet leaving server, but packetiself would be still send via interface routing table sees as most optimal?
17:47 < smw> EugeneKay, http://paste.pocoo.org/show/509001/
17:47 < smw> EugeneKay, also, I proved it is a firewall problem by setting up nc -ul 1194 on the server and trying to connect from the client
17:47 <+EugeneKay> Your firewall issue is somewhere near the beginning of the * * *
17:47 < mick72> sorry, I'm sleepy.
17:48 < smw> EugeneKay, what you are saying is that amazon is firewalling me and definitely not the local instance?
17:48 < smw> local server*
17:48 <+EugeneKay> My best guess, yes.
17:51 < mick72> AS I understand crrecty, all SNAT will do is just changing source ip of packet I sending away to internet, but determination on which eth packet will be put still depends on routing table?
17:54 -!- mick72 [~mick72@as1-109.opole.dialup.inetia.pl] has quit [Quit: IRC webchat at http://irc2go.com/]
17:55 -!- mick72 [~mick72@as1-109.opole.dialup.inetia.pl] has joined #openvpn
17:55 < mick72> .
17:57 < smw> EugeneKay, any of this look wrong on the server? http://paste.pocoo.org/show/509004/
18:10 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 244 seconds]
18:14 <@vpnHelper> RSS Update - forum: Log Messages <http://forums.openvpn.net/topic9225.html#p17641>
18:16 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has left #openvpn []
18:23 -!- ravel_exe [ravel_exe@175.136.85.157] has quit []
18:26 <@vpnHelper> RSS Update - forum: OpenVPN for bridging VMware Fusion OS X guest to ESX guests? <http://forums.openvpn.net/topic9232.html>
18:44 -!- Denial [Denial@drgi.co.uk] has quit []
19:08 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Quit: Leaving.]
19:16 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:18 < HeyWooduOpenSour> does anybody please know how to setup and use openvpn?
19:19 < HeyWooduOpenSour> is openvpn run on a server, is it an os in itself, or can a combination of options be used?
19:21 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
19:22 < smw> HeyWooduOpenSour, to answer your first question. Of course we know how to setup openvpn... this is #openvpn
19:23 < smw> HeyWooduOpenSour, 2nd, openvpn is not an OS.
19:34 < HeyWooduOpenSour> LOL, I knew somebody would say that
19:34 < HeyWooduOpenSour> to the first question part
19:35 < HeyWooduOpenSour> ok I didn't think OpenVPN is not an OS, but wasn't sure if it was an option. thanks for your help.
19:35 < HeyWooduOpenSour> how do you setup and use openvpn?
19:36 < krzie> !howto
19:36 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:37 < HeyWooduOpenSour> I wasn't sure what OSes you could run openvpn on or which they could be ported to? I know it can be used (as software,obviously I guess lol) on linux or linux-type applications, such linux routers or DD-WRT and other similar projects like that
19:37 < HeyWooduOpenSour> ok cool, thanks
19:37 < HeyWooduOpenSour> !howto
19:37 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:37 < HeyWooduOpenSour> it runs on/within windows too, right?
19:37 <+EugeneKay> I know there are servers for Windows(XP on up), Linux/BSD and kin, including OS X.
19:38 <+EugeneKay> CLients are also available for iOS, Android, and Blackberry(I think?)
19:38 -!- aef_ [~quassel@neoschlageter.raxys.net] has quit [Read error: Connection reset by peer]
19:38 < HeyWooduOpenSour> ok thanks for the info
19:38 < krzie> blackberry?  i think not
19:38  * EugeneKay shrugs
19:39 <+EugeneKay> I'm right, but only when I'm sure I'm right.
19:39 < HeyWooduOpenSour> lol. true
19:42 < krzie> and to clarify, there is no distinction between client and server support
19:42 < krzie> if openvpn runs, it could be either
19:43 < krzie> (you could technically put a server on an android, iphone, etc)
19:43 < krzie> cause its the same binary, just the config changes the mode it runs in
19:46 -!- _julian [~quassel@hmbg-4d06a7e0.pool.mediaWays.net] has joined #openvpn
19:49 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has joined #openvpn
19:49 -!- _julian_ [~quassel@hmbg-4d06ad5e.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
19:49 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:54 <+EugeneKay> Could. But the common gui implementations for those platforms are client-only.... so :-p
19:55 < krzie> gui shmui
19:55 < krzie> i dont have a single openvpn gui running anywhere
19:56 < krzie> with android installs, openwrt installs, osx installs, bsd installs, linux installs
19:56 < krzie> i guess if i had it running on windows that would stop being trye
19:56 < krzie> true*
19:56 <+EugeneKay> The windows GUI is just a cli wrapper. It even outputs into a console window.
19:57 < krzie> is there any opensource openvpn gui that isnt a cli wrapper?
19:57 < krzie> (i figure access server could be exempt)
19:58 <+EugeneKay> I mean, it really is JUST a wrapper. The CM one on Android, for example, doesn't take a .conf
19:58 < krzie> yes, thats my beef with it
19:58 <+EugeneKay> Patches welcome :v
19:58 < krzie> however, openvpn-settings on android does take a .conf
19:58 < krzie> when its coded in bash ill be happy to submit a patch
19:58 <+EugeneKay> Android..... isn't bash :-p
19:59 < krzie> im not learning a language just to fix their implementation which i wont use 
19:59 <+EugeneKay> Did I ever tell you about the time I registered HTC PENIS as a valid device in the CM servers?
19:59 < krzie> lol
19:59 < krzie> did you then try to flash it onto your penis?
20:00 <+EugeneKay> Nope, just submitted bogus info to their stats servers.
20:00 < krzie> the smallest htc phone yet!
20:00 <+EugeneKay> All it needs is a few(un-checked) variables POSTed to a webform, along with a md5 of a device hash.
20:00 <+EugeneKay> So, I built a bash script.
20:00 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 245 seconds]
20:01 <+EugeneKay> Anyway, </tangent>
20:04 -!- HeyWooduOpenSour [~Hyf99d7YH@c-174-49-213-244.hsd1.pa.comcast.net] has left #openvpn []
20:09 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
20:12 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
20:18 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
20:23 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has quit [Quit: Leaving]
21:09 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 255 seconds]
21:10 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
21:41 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17643>
21:45 -!- master_of_master [~master_of@p57B55FA6.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
21:46 -!- master_of_master [~master_of@p57B52F27.dip.t-dialin.net] has joined #openvpn
22:01 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
22:01 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
22:01 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:05 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
22:11 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:08 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
23:20 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:20 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:34 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
23:35 -!- oc80z [oc80z@blea.ch] has joined #openvpn
--- Day changed Thu Nov 17 2011
00:11 <@vpnHelper> RSS Update - forum: Two Client Connections from the same Router <http://forums.openvpn.net/topic9233.html>
00:21 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
00:22 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
00:34 -!- dazo_afk is now known as dazo
00:38 < smw> Hi all. I setup a server with the same config as another server I have. When using a client with only the server ip changed, I do not seem to be able to connect.
00:38 < smw> neither show any problems and I can nc to the port on the server from the client
00:38 < smw> any ideas?
00:39 < smw> I mean I can nc when both the client and server are nc. When openvpn is on, I send random text but don't get a response.
00:40 < smw> the last entry on the server config is just Thu Nov 17 06:34:18 2011 Initialization Sequence Completed
01:08 -!- LumberCartel [~LumberCar@96.53.47.42] has joined #openvpn
01:35 -!- _julian [~quassel@hmbg-4d06a7e0.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
01:38 -!- _julian [~quassel@hmbg-5f77d0f3.pool.mediaWays.net] has joined #openvpn
01:41 -!- LumberCartel is now known as PhilKenSebben
01:44 -!- _julian_ [~quassel@hmbg-5f766985.pool.mediaWays.net] has joined #openvpn
01:45 -!- _julian [~quassel@hmbg-5f77d0f3.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
01:47 -!- PhilKenSebben [~LumberCar@96.53.47.42] has left #openvpn ["RFCs the easy way -- http://www.openrfc.org/"]
01:48 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:52 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:56 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:02 -!- _julian_ [~quassel@hmbg-5f766985.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
02:02 -!- _julian [~quassel@hmbg-5f76233d.pool.mediaWays.net] has joined #openvpn
02:04 <@vpnHelper> RSS Update - forum: OpenVPN for bridging VMware Fusion OS X guest to ESX guests? <http://forums.openvpn.net/topic9232.html#p17646> || New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17645>
02:06 -!- novaflash_away is now known as novaflash
02:10 -!- smw [~smw@unaffiliated/smw] has quit [Read error: Connection reset by peer]
02:23 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:26 -!- _julian_ [~quassel@hmbg-5f77d532.pool.mediaWays.net] has joined #openvpn
02:28 -!- _julian [~quassel@hmbg-5f76233d.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
02:43 -!- scyld [~operacyjn@unaffiliated/wasyl] has joined #openvpn
02:44 < scyld> Hello everyone!
02:44 < scyld> I have a question about redirect-gateway.
02:45 < scyld> Suppose I do not trust my openvpn gateway administrator and I'm affraid that he can put redirect-gateway to push options and watch my entire network traffic. How can I make it not possible from client side?
02:52 <@dazo> scyld: don't use redirect-gateway in that scenario ... but, if you don't trust the OpenVPN server - why would you use the VPN to start with ...
02:55 <+hyper_ch> overwrite the routes given by your vpn provide by your own again
02:56 <@dazo> use --route-nopull ... and set up manually the needed routes
02:56 <+hyper_ch> :)
02:56 <@dazo> (by adding --route statements to the client config)
02:56 <+hyper_ch> I didn't know you could do that
02:57 <@dazo> every day is a day to learn new things ;-)
03:12 <+hyper_ch> I fear I forget more things than I learn
03:12 <+hyper_ch> dazo: are you on diaspora?
03:12 <@dazo> hyper_ch: not yet ... I'm in the process of setting up my own pod
03:12 <+hyper_ch> you wanna join mine?
03:12 <+hyper_ch> :)
03:12 <+hyper_ch> I already have 4 users
03:12 <@dazo> nah, I want the fun of setting up my own :)
03:13 <+hyper_ch> I, me, myself and Phreedom :)
03:13 <@dazo> how is it to install and configure?
03:13 <@dazo> hehe
03:13 <@dazo> and does it require a lot of resources?
03:13 <+hyper_ch> it's not that bad... but you'll need a valid class 1 ssl cert -->  startssl.com
03:13 <+hyper_ch> dazo: not that much for me as user
03:13 <@dazo> ahh, makes sense
03:13 <@dazo> how is the server load?
03:14 <+hyper_ch> diaspora  6550  0.1  1.0 265056 124664 pts/13  S+   08:31   0:11 ruby ./script/websocket_server.rb
03:14 <+hyper_ch> diaspora  6552  0.2  1.0 276560 133880 pts/13  S+   08:31   0:16 ruby1.8 /home/diaspora/ruby/1.8/bin/thin start -p 3000 -e production
03:14 <@dazo> not too bad
03:14 <+hyper_ch> server can handle it easy
03:14 <+hyper_ch> have you looked at the installation?
03:14 <@dazo> a while ago, just haven't had time to do it yet
03:15 <@dazo> but it's getting closer :)
03:15 <+hyper_ch> IMHO you're better of using RVM for ruby gem installation with always the path assignemnet   --path /home/USER
03:15 < scyld> ok, thanks I'll try route-nopull.
03:15 <+hyper_ch> I tried system wide gem installation but a user with restriced access has troubles with it
03:15 <+hyper_ch> also, production mode is a lot faster than development mode
03:15 <@dazo> good to know
03:15 <@dazo> yeah, I want production mode
03:15 <@dazo> any web proxy in front?
03:16 <+hyper_ch> by default it runs in development mode
03:16 <+hyper_ch> dazo: no need
03:16 <+hyper_ch> a few other issues I had was configurting it right through the vpn
03:16 <+hyper_ch> port 80 is not re-directed to the diaspora vpn client
03:16 <@dazo> well, depends on how much you trust the "internal" web server to tackle all the nasty scanners :)
03:16 <+hyper_ch> so I had to set a rule on apache to auto-forward to ssl on the internet
03:17 <@dazo> mm
03:17 <+hyper_ch> just a few more things to figure out when your server is not directly connected :)
03:17 <@dazo> yeah
03:17 <+hyper_ch> dazo: if you wanna have a peek:  https://diaspora.sjau.ch
03:17 <@vpnHelper> Title: DIASPORA* ALPHA (at diaspora.sjau.ch)
03:17  * dazo looks
03:18 <+hyper_ch> right now I'm trying to figure out how to inject messages... I would like to auto-post some commits done on a project :)
03:19 < scyld> oh one more thing... how can I stop openvpn to modify my /etc/resolv.conf - provider wants to use his dns server, but I don't... (yes I can turn immutable for  that file but... sometimes I use windows too ;))
03:19 <+hyper_ch> my id:   hyper_ch@diaspora.sjau.ch    --  but  "hyper_ch" should also find me
03:19 <+hyper_ch> !dns
03:19 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
03:20 <+hyper_ch> !pushdns
03:20 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
03:20 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
03:20 <+hyper_ch> hmmm, all about "pushing" it but not about "preventing push"
03:20 < scyld> yeah...
03:27 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 245 seconds]
03:35 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has joined #openvpn
03:53 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:56 <@dazo> scyld: just remove any scripts or plugins which does that update ... on Linux you have to explicit enable it via --up or some --plugin
03:56 <+hyper_ch> dazo: is your diaspora server up yet? :)
03:56 <@dazo> hyper_ch: nope ... no time right now :)
03:57 <+hyper_ch> :)
04:02 < scyld> dazo: but I do want to use that scripts... but not for that one vpn provider ;)
04:03 <@dazo> scyld: yeah, remove calling that script from "that one vpn provider"'s config file
04:04 < scyld> there is no call in config... only push DNS 1.2.3.4...
04:04 <@dazo> scyld: then your config does not update your resolv.conf
04:04 < scyld> i.e. dhcp-option DNS 192.168.168.254
04:04 <@dazo> well, remove that from your config then
04:05 < scyld> it is not in config file... it's from push ;)
04:05 <@dazo> if you have push stuff ... then a script will pick that up ... so disable that script in your config
04:06 < scyld> how... I don't hae anything about scripting in that vpn config file :\
04:06 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
04:06 <@dazo> !configs
04:06 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
04:06 < scyld> just a moment :>
04:07 < scyld> http://wklej.org/id/629226/
04:08 <@vpnHelper> Title: Wklejka #629226 | Wklej.org (at wklej.org)
04:09 <@dazo> scyld: you need to figure out where this is happening:
04:09 <@dazo> Thu Nov 17 10:48:59 2011 /etc/openvpn/up.sh SoredVPN 1500 1558 192.168.168.1 255.255.255.0 init
04:09 <@dazo> how do you start this VPN client?
04:09 < scyld> gentoo init script.
04:11 <@dazo> scyld: okay, it's Gentoo init scripts which adds --up /etc/openvpn/up.sh  ... if DETECT_CLIENT=yes in /etc/conf.d/openvpn
04:11 < scyld> heh thast script adds:
04:11 < scyld>                 args="${args} --up-delay --up-restart"
04:11 < scyld>                 args="${args} --script-security 2"
04:11 < scyld>                 args="${args} --up /etc/openvpn/up.sh"
04:11 < scyld>                 args="${args} --down-pre --down /etc/openvpn/down.sh"
04:12 <@dazo> yeah, so don't set DETECT_CLIENT ... or for this particular VPN provider, don't use the init script
04:12 < scyld> so it's gentoo fault ;)
04:12 <@dazo> just do openvpn --config vpn.conf
04:12 < scyld> not cool ;)
04:12 <@dazo> it works
04:12 <@dazo> so that's cool
04:13 < scyld> not clean solution ;)
04:13 < scyld> dirty hack
04:13 <@dazo> starting openvpn manually, is not a dirty hack
04:13  * dazo brb
04:13 < scyld> it is ;p
04:14 < scyld> how do I stary openvpn manually on windows? I have it as a service...
04:14 < scyld> I would have to stop using services and start all my vpns manually :(
04:15 < reiffert> windows-r
04:15 < reiffert> cmd
04:15 < reiffert> cd c:\programs\openvpn\bin
04:15 < reiffert> openvpn.exe parameters that you need
04:15 < reiffert> done.
04:15 -!- _julian [~quassel@hmbg-4d06c6e2.pool.mediaWays.net] has joined #openvpn
04:15 -!- tjz [~pc@bb121-7-128-226.singnet.com.sg] has joined #openvpn
04:15 -!- tjz [~pc@bb121-7-128-226.singnet.com.sg] has quit [Changing host]
04:15 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
04:15 -!- EugeneK [eugene@itvends.com] has joined #openvpn
04:15 < reiffert> else start an instance of openvpn gui, klick on it and have openvpn launch like configured.
04:15 <+hyper_ch> hi reiffert
04:16 < reiffert> hyper hyper
04:16 < scyld> I know, i know... but you seems not to see the point - I'm a lazy person and do not want to do all this stuff manually ;)
04:16 < reiffert> scyld: pay someone.
04:16 < scyld> that what openvpn service is for ;)
04:16 < reiffert> 11:14 < scyld> how do I stary openvpn manually on windows? I have it as a service...
04:16 < reiffert> Please find the answer to your question above.
04:16 <+hyper_ch> don't run windows :)
04:17 -!- _julian_ [~quassel@hmbg-5f77d532.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
04:18 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 244 seconds]
04:18 -!- EugeneK is now known as EugeneKay
04:18 < scyld> reiffert: echh, lazy persons use services to not manually playing with 7-10 vpn's because it's even freaking hard to remember which is for what ;)
04:19 < reiffert> scyld: you asked me about a and I answered according your question.
04:19 < reiffert> according to
04:19 < scyld> but if I move stupid.ovpn out of config dir... it will not be started by serwice :>
04:19 < scyld> worth trying :>
04:19 < reiffert> scyld: you are a lazy person. lazy people dont do if's.
04:20 -!- _julian [~quassel@hmbg-4d06c6e2.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
04:22 < scyld> reiffert: ok, lazy was a bad work... person which wants all that to work as much automatic and the least absorbing and reliably and so on ;)
04:23 < reiffert> scyld: those people pay for a system engineer.
04:23 -!- _julian [~quassel@hmbg-5f762bb0.pool.mediaWays.net] has joined #openvpn
04:23 < scyld> system engineer to start one openvpn service? ;)
04:24 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
04:24 < reiffert> scyld: system engineer to make you feel comfortable.
04:24 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 240 seconds]
04:24 < reiffert> automatic, least absorbing, reliability bla bla bla
04:24 < scyld> ohh, no need for sys eng. You are almost good enought ;)
04:25 < reiffert> scyld: let's see how long I can keep you from solving your problem and make you feel uncomfortable after all.
04:25 -!- kyrix_ [~ashley@chello212186126012.11.vie.surfer.at] has joined #openvpn
04:26 < scyld> haha yes, you can do it for a long time ;)
04:26 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
04:28 <@vpnHelper> RSS Update - forum: Cath 22 "Search" is really unhelpful... <http://forums.openvpn.net/topic9234.html>
04:29 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has quit [Ping timeout: 240 seconds]
04:34 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:35 -!- kyrix_ [~ashley@chello212186126012.11.vie.surfer.at] has quit [Quit: Ex-Chat]
04:38 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
04:38 -!- _julian_ [~quassel@hmbg-5f7666b4.pool.mediaWays.net] has joined #openvpn
04:42 -!- _julian [~quassel@hmbg-5f762bb0.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
04:51 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
05:05 <@vpnHelper> RSS Update - forum: [Resolved] i want to open a VPN site via OpenVPN <http://forums.openvpn.net/topic9081-15.html#p17648>
05:08 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Quit: У меня есть более важные дела, чем холостой здесь.]
05:08 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:17 -!- bauruine [~stefan@12-169.105-92.cust.bluewin.ch] has joined #openvpn
05:23 -!- beerbro [~gustav@109.75.184.199] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:25 -!- beerbro [~gustav@apollon.ais-salzburg.at] has joined #openvpn
05:25 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
05:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
05:36 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
05:40 -!- Pilif12p [~Pilif12p@techessentials.org] has joined #openvpn
06:05 <@vpnHelper> RSS Update - forum: Two Client Connections from the same Router <http://forums.openvpn.net/topic9233.html#p17649>
06:11 <@vpnHelper> RSS Update - forum: vpn is not working <http://forums.openvpn.net/topic9235.html>
06:23 <@vpnHelper> RSS Update - forum: vpn is not working <http://forums.openvpn.net/topic9235.html#p17651>
06:23 -!- corretico [~luis@201.201.44.82] has joined #openvpn
06:29 <@vpnHelper> RSS Update - forum: vpn is not working <http://forums.openvpn.net/topic9235.html#p17653> || How to setup an IP phone with an OpenVPN client <http://forums.openvpn.net/topic9229.html#p17652>
06:30 -!- Rolybrau [~Rolybrau@17-21.3-85.cust.bluewin.ch] has joined #openvpn
06:30 -!- Rolybrau [~Rolybrau@17-21.3-85.cust.bluewin.ch] has quit [Changing host]
06:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:46 -!- _julian [~quassel@hmbg-4d06cc73.pool.mediaWays.net] has joined #openvpn
06:47 -!- _julian_ [~quassel@hmbg-5f7666b4.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
06:50 -!- _julian [~quassel@hmbg-4d06cc73.pool.mediaWays.net] has quit [Read error: Operation timed out]
06:52 -!- _julian [~quassel@hmbg-4d069caf.pool.mediaWays.net] has joined #openvpn
06:55 -!- bangert [quasselcor@gentoo/developer/bangert] has joined #openvpn
06:55 < bangert> !welcome
06:55 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:56 < bangert> !goal
06:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:59 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
07:00 -!- _julian_ [~quassel@hmbg-5f77ea83.pool.mediaWays.net] has joined #openvpn
07:02 -!- _julian [~quassel@hmbg-4d069caf.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
07:08 < probonono> Hi. I've used the example configs. I expected to have to include a "redirect-gateway" option before a deault route would be set on connecting clients. However upon connection a default route is being added regardless. How can I prevent a default route from being set?
07:15 <@vpnHelper> RSS Update - forum: OpenVPN + Linux Client Problem <http://forums.openvpn.net/topic9236.html>
07:21 <@vpnHelper> RSS Update - forum: OpenVPN + Linux Client Problem <http://forums.openvpn.net/topic9236.html#p17655>
07:34 < krzee> probonono, if you are just using openvpn (not network manager or something) then you must either have redirect-gateway in client config or push redirect-gateway in server config... 
07:39 <@vpnHelper> RSS Update - forum: OpenVPN + Linux Client Problem <http://forums.openvpn.net/topic9236.html#p17656>
07:52 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 248 seconds]
07:53 < probonono> krzee, hmm, apparently the semicolon char is not being interpreted as a comment in the server's config file. Inserted a "#" and that's fixed it.
07:54 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
07:54 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
08:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:06 < probonono> Hmm, must have been pebkac. Just reverted the edit and now it's fine.
08:15 < probonono> krzee, thanks. Your advice was very helpful.
08:23 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:28 -!- _julian [~quassel@hmbg-5f77f621.pool.mediaWays.net] has joined #openvpn
08:29 -!- _julian_ [~quassel@hmbg-5f77ea83.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
08:38 -!- bauruine [~stefan@12-169.105-92.cust.bluewin.ch] has quit [Ping timeout: 276 seconds]
08:40 -!- bauruine [~stefan@12-169.105-92.cust.bluewin.ch] has joined #openvpn
08:49 -!- _julian_ [~quassel@hmbg-5f760e2b.pool.mediaWays.net] has joined #openvpn
08:51 -!- _julian [~quassel@hmbg-5f77f621.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
08:53 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has joined #openvpn
08:55 <@vpnHelper> RSS Update - forum: How to setup an IP phone with an OpenVPN client <http://forums.openvpn.net/topic9229.html#p17657>
08:57 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:57 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:57 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:57 -!- mode/#openvpn [+v Axeman] by ChanServ
09:01 -!- _julian [~quassel@hmbg-4d06f025.pool.mediaWays.net] has joined #openvpn
09:02 -!- _julian_ [~quassel@hmbg-5f760e2b.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
09:03 -!- kyrix_ [~ashley@93.83.182.188] has joined #openvpn
09:06 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has quit [Ping timeout: 240 seconds]
09:06 <@vpnHelper> RSS Update - forum: Two Client Connections from the same Router <http://forums.openvpn.net/topic9233.html#p17658>
09:07 -!- _julian_ [~quassel@hmbg-5f77fd34.pool.mediaWays.net] has joined #openvpn
09:08 -!- kyrix_ [~ashley@93.83.182.188] has quit [Quit: Ex-Chat]
09:08 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has joined #openvpn
09:09 -!- _julian [~quassel@hmbg-4d06f025.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
09:11 -!- _julian [~quassel@hmbg-4d06c38f.pool.mediaWays.net] has joined #openvpn
09:12 -!- _julian_ [~quassel@hmbg-5f77fd34.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
09:16 -!- kyrix_ [~ashley@93.83.182.188] has joined #openvpn
09:17 -!- _julian_ [~quassel@hmbg-5f77ffcb.pool.mediaWays.net] has joined #openvpn
09:17 <@vpnHelper> RSS Update - forum: Two Client Connections from the same Router <http://forums.openvpn.net/topic9233.html#p17659>
09:18 -!- _julian [~quassel@hmbg-4d06c38f.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
09:19 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has quit [Ping timeout: 240 seconds]
09:20 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
09:33 -!- _julian [~quassel@hmbg-4d06c5cf.pool.mediaWays.net] has joined #openvpn
09:34 -!- proffial [~Alphonse@mon45-5-78-247-181-59.fbx.proxad.net] has joined #openvpn
09:34 -!- _julian_ [~quassel@hmbg-5f77ffcb.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
09:38 -!- _julian_ [~quassel@hmbg-4d06816b.pool.mediaWays.net] has joined #openvpn
09:40 -!- _julian [~quassel@hmbg-4d06c5cf.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
09:45 < proffial> hi all. did someone try to setup an OpenVpn on a Proxmox VM ? I can access the VPN, I can ping from the client the OpenVPN Server on his both IP, put I can't ping through the OpenVPN Server a computer (XXX) on the network. (When I am connected by SSH on OpenVPN Server I can ping the computer (XXX))
09:46 < proffial> do you have any idea ?
09:46 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
09:46 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
09:51 < krzie> proffial, you talking about accessing the lan that is behind the openvpn server?
09:51 < proffial> krzie yes
09:51 < krzie> !serverlan
09:51 < krzie> !route
09:51 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation
09:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
09:53 < proffial> !ipforward
09:53 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
09:53 -!- _julian [~quassel@hmbg-4d0699ff.pool.mediaWays.net] has joined #openvpn
09:53 -!- _julian_ [~quassel@hmbg-4d06816b.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
09:53 -!- LumberCartel [~LumberCar@96.53.47.42] has joined #openvpn
09:57 -!- _julian_ [~quassel@hmbg-4d06a3be.pool.mediaWays.net] has joined #openvpn
09:58 -!- _julian [~quassel@hmbg-4d0699ff.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
09:59 -!- LumberCartel [~LumberCar@96.53.47.42] has left #openvpn ["RFCs the easy way -- http://www.openrfc.org/"]
09:59 -!- bauruine [~stefan@12-169.105-92.cust.bluewin.ch] has quit [Remote host closed the connection]
10:00 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
10:01 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
10:01 -!- _julian [~quassel@hmbg-4d068a2d.pool.mediaWays.net] has joined #openvpn
10:03 -!- _julian_ [~quassel@hmbg-4d06a3be.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
10:04 -!- _julian_ [~quassel@hmbg-4d0685a1.pool.mediaWays.net] has joined #openvpn
10:06 -!- _julian [~quassel@hmbg-4d068a2d.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
10:08 < proffial> !tcpip
10:08 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
10:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:52 <@vpnHelper> RSS Update - forum: OpenVPN + Linux Client Problem <http://forums.openvpn.net/topic9236.html#p17660>
10:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:58 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
11:15 -!- smw [~smw@unaffiliated/smw] has quit [Ping timeout: 252 seconds]
11:15 -!- kyrix_ [~ashley@93.83.182.188] has quit [Quit: Ex-Chat]
11:15 -!- smw [~smw@76.89.149.37] has joined #openvpn
11:15 -!- smw [~smw@76.89.149.37] has quit [Changing host]
11:15 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
11:18 < proffial> !firewall
11:18 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
11:18 -!- Pilatus [~Pilatus@ks355380.kimsufi.com] has joined #openvpn
11:21 < Pilatus> i would like to bind my apache to my openvpn 
11:21 < Pilatus> can anybody show me the lines 
11:21 < Pilatus> ?
11:23 < smw> Pilatus, in apache just bind to your vpn ip
11:24 < smw> instead of Listen 80. Do Listen 10.0.0.1:80
11:24 < smw> where 10.8.0.1 is your apache server's ip
11:24 < Pilatus> can i add more lines then one ?
11:24 < smw> yes
11:25 < smw> Apache allows that
11:25 < Pilatus> okay thanks 4 helping me
11:32 -!- mick72 [~mick72@as1-109.opole.dialup.inetia.pl] has quit [Quit: IRC webchat at http://irc2go.com/]
11:35 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 258 seconds]
11:38 < proffial> hi all, how do you know if you have a firewall running on your vpn server ?
11:38 < smw> proffial, using linux?
11:38 < proffial> yes ubuntu
11:39 < smw> proffial, what I do is run nc -ul 1194 on the server and then try to connect to it with nc -u host 1194 on the client
11:39 < smw> proffial, if what you type on the client shows up on the server, there is no firewall
11:40 < proffial> ok
11:40 < proffial> so I have no firewall
11:40 < proffial> so do you have an idea why 
11:40 < smw> nc worked from client to server?
11:40 < proffial> When I connect with my client I can ping the openServer
11:41 < proffial> I can ping his other adress on the internal network
11:41 < proffial> but I can't ping anybody else
11:41 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
11:41 < smw> you need to first enable IPv4 forwarding on the server
11:42 < smw> then you need to setup firewall rules. What is your goal
11:42 < smw> !goal
11:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:42 < krzie> ip forwarding is enabled if he can ping the lan ip of server
11:42 < krzie> he needs:
11:42 < krzie> !route_outside_ovpn
11:42 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
11:43 < proffial> ip forwarding is ok
11:43 < proffial> well that's a firewall problem, wich one do you use ?
11:43 < proffial> I have nothing on this server
11:43 < krzie> no not firewall
11:43 < krzie> router
11:43 < krzie> see above factoid from my bot
11:44 < krzie> ^
11:44 < proffial> you are french ?
11:44 < krzie> i am not
11:45 < proffial> ok just you are connected in france ... ok so Factoid ? what did you mean ?
11:45 < krzie> !route_outside_ovpn
11:45 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route, or (#2) you do not need this if the vpn node IS the gateway for its lan
11:47 < proffial> yes I made it
11:47 < proffial> but It didn't work
11:47 < krzie> well theres something wrong with it
11:47 < krzie> cause thats your problem ;]
11:47 < proffial> in fact my OpenVpn is on a Proxmox
11:48 < krzie> dunno what a proxmox is
11:49 < proffial> its an openVz virtualisation 
11:49 < oc80z> trying to spec out a server that can handle 500-600 connections 
11:49 < proffial> my OpenVpn server is on an OpenVz Vm
11:51 < smw> krzie, I have the following 3 rules in iptables. Any idea why routing outside the vpn does not work? iptables -A INPUT -i tun+ -j ACCEPT
11:51 < smw> iptables -A FORWARD -i tun+ -j ACCEPT
11:51 < smw> iptables -t nat -A POSTROUTING -s 192.168.22.0/24 -o eth0 -j MASQUERADE
11:51 < smw> I am using 192.168.22.0/24 for my vpn
11:52 < oc80z> any advice, or experience with 500/600 ovpn connections, 
11:52 < oc80z> bout to fire it off, so, ill report, but , any info would be appreciated eh.
11:53 < krzie> proffial, ok well your problem is either the route i said, or soemthing to do with your VM... make sure the host OS has a route like the router
11:53 < krzie> and make sure the host has ip forwarding as well
11:54 <@vpnHelper> RSS Update - forum: Log Messages <http://forums.openvpn.net/topic9225.html#p17661>
11:55 < krzie> i wont be trying to troubleshoot your VM software... apply the same principals of routing to it and you should figure it out (unless its something specific to your virtualization stuff)
11:55 < proffial> well from my VN Server I can ping everybody
11:56 < proffial> and when I ping the internal IP of the Server, from the client it's ok ...
11:57 < proffial> could it be something with iptables ? firewall ? how do you said to the openvpn server to allow the trafic to go through ? is it juste ip forwarding ?
11:59 < krzie> you arent pinging with VPN source address
11:59 < krzie> understand routing, then apply it to vpns
11:59 < krzie> ;)
12:01 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
12:02 < proffial> ok thanks just one other question, you don't need to setup any iptables if you don't have any firewall on you openvpn server is that right ?
12:03 < krzie> depends... but iptables on your server is not your problem
12:03 < proffial> ok
12:03 < proffial> thanks
12:09 < krzie> since you can ping the server lan ip, you know your firewall and ipforwarding are correct
12:09 < krzie> if it was not a virtual machine, ild be 100% that its the router's route that i told you
12:09 < krzie> since you have added complexity of it being a vm, its either what i said or something to do with the vm
12:09 < krzie> for example, i bet the host machine has no idea how to reach the vpn subnet
12:10 < krzie> and the host machine may or may not have ip forwarding enabled...
12:10 < krzie> (but it should)
12:14 < proffial> I see what you mean, with traceroute I can check everything ... thanks
12:17 < proffial> Ok well is it possible to allow the ipforwarding only in one side ? because that's what I have in fact 
12:18 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
12:18 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
12:18 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
12:19 < proffial> I have to leave bye and thanks a lors krzie
12:19 < proffial> !quit
12:19 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
12:19 -!- proffial [~Alphonse@mon45-5-78-247-181-59.fbx.proxad.net] has left #openvpn []
12:24 <@vpnHelper> RSS Update - forum: OpenVPN + Linux Client Problem <http://forums.openvpn.net/topic9236.html#p17662>
12:42 -!- Pilif12p [~Pilif12p@techessentials.org] has quit [Changing host]
12:42 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
12:50 -!- llunved [~llunved@kreetago.llunved.net] has quit [Ping timeout: 276 seconds]
12:54 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:00 -!- TimothyA [~Administr@sub-190-88-112ip163.rev.onenet.an] has joined #openvpn
13:00 < TimothyA> hello, I have a problem with OpenVPN-AS: iptables service not started because of error (SVC_RUN_EXCEPT)
13:01 < TimothyA> Service deferred error: iptables capabilities error: ('Error verifying iptables capabilities when running following command', ('/sbin/iptables', '-A', 'FORWARD', '-d', '127.77.88.99', '-m', 'mark', '--mark', '0x12345678/0x12345678', '-j', 'DROP'))
13:01 <+hyper_ch> TimothyA: for AS /j #openvpn-as
13:02 < TimothyA> ah..
13:04 <@dazo> now, that's an interesting iptables command from AS ...
13:05  * krzie kicks AS
13:05  * hyper_ch cheers at krzie's great kick
13:05 <@vpnHelper> RSS Update - forum: OpenVPN + Linux Client Problem <http://forums.openvpn.net/topic9236.html#p17663>
13:05  * krzie then blames dazo
13:05 <@dazo> !blame
13:05 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
13:06  * dazo blames hyper_ch 
13:09 -!- MadTBone_ [~MadTBone@gw1.msmnyc.edu] has quit [Quit: Leaving]
13:10 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
13:13 -!- Netsplit over, joins: Dougy
13:13 -!- Netsplit *.net <-> *.split quits: gardar, kloeri, Jarpse, Essobi, pranq, beerbro, qubits
13:13 -!- qubits [~zero@ip-97-74-121-225.ip.secureserver.net] has joined #openvpn
13:13 -!- Netsplit over, joins: Essobi
13:13 -!- Netsplit over, joins: kloeri
13:13 -!- Netsplit over, joins: gardar
13:13 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
13:13 -!- Netsplit over, joins: Jarpse
13:13 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
13:14 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:14 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
13:14 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:14 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
13:14 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
13:15 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:15 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
13:15 -!- Streppelchen [~volkermau@p57A4AAB9.dip.t-dialin.net] has quit []
13:16 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:16 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
13:16 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:16 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
13:17 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:17 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
13:17 -!- mode/#openvpn [+o ecrist] by ChanServ
13:17 -!- mode/#openvpn [+b *!*@gardar.net] by ecrist
13:18 -!- mode/#openvpn [-bb *!*@2a01:608:ffff:3405::42 *!*@*/web/freenode/ip.23.19.*] by ecrist
13:18 -!- Pilatus [~Pilatus@ks355380.kimsufi.com] has left #openvpn ["bye"]
13:25 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:51 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
13:59 -!- dazo is now known as dazo_afk
14:09 -!- TimothyA1 [~Administr@63.223.120.157] has joined #openvpn
14:10 -!- TimothyA [~Administr@sub-190-88-112ip163.rev.onenet.an] has quit [Ping timeout: 240 seconds]
14:14 -!- eKKiM [~eKKiM@d54C5D0BE.access.telenet.be] has joined #openvpn
14:14 < eKKiM> !configs
14:14 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
14:16 < eKKiM> Hi, i see some VPN Server hosters provide a dedicated ip
14:16 < eKKiM> but i am wondering how they configure the server to do this.
14:16 < eKKiM> Does anyone have a quick example or link where it is explained?
14:31 < Olipro> it's called "routing"
14:33 < krzie> depends how they do it, either they have a routable subnet they use in --server or they just use bidirectional NAT on the server for your vpn ip to nat to their routable ip
14:34 < krzie> but ya, basically as Olipro said ;]
14:34 -!- dazo_afk is now known as dazo
14:35 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Quit: Leaving]
14:36 < eKKiM> Hmm i see
14:36 < eKKiM> is is also possible to mix it?
14:36 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has joined #openvpn
14:37 < eKKiM> some users on shared ip some others on personal public?
14:37 < krzie> mix it?  you clearly didnt understand what i said
14:37 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
14:37 -!- Transformer [~Transform@ool-4a59e397.dyn.optonline.net] has quit [Excess Flood]
14:37 < krzie> that has nothing to do with what i said
14:37 -!- gustav- [~gustav@apollon.ais-salzburg.at] has joined #openvpn
14:37 < krzie> what i said was 2 ways they can give each client their own public ip
14:37 < krzie> however, yes to your last question
14:37 < eKKiM> yes i know
14:37 < krzie> by correctly configuring NAT
14:38 < krzie> and using some static vpn ips, and allowing others to just grab from a pool
14:38 < krzie> !static
14:38 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
14:38 < eKKiM> aha
14:39 < eKKiM> and i i used a routable subnet
14:39 < eKKiM> if i*
14:39 < eKKiM> k nvm
14:39 < krzie> then youd be handing out routable ips, of course they could not be shared...
14:39 < eKKiM> i think i got it
14:39 < krzie> thats like asking if vpn clients could share a vpn ip
14:40 < krzie> well actually, not like, is *IS* asking that
14:40 < eKKiM> =)
14:40 < eKKiM> Thanks for your information
14:40 < krzie> yw
14:42 < eKKiM> just found a howto on openvpn forums
14:42 < eKKiM> https://forums.openvpn.net/topic8559.html
14:42 <@vpnHelper> Title: OpenVPN Support Forum How-to: Tunnel WAN IP assigned to specific users : Examples (at forums.openvpn.net)
14:45 < krzie> !learn redirect_ips as https://forums.openvpn.net/topic8559.html for more info on giving users their own internet routable IPs
14:45 <@vpnHelper> Joo got it.
14:46 < krzie> !learn redirect_ips as it is also possible to directly hand out the ips from --server, jjk explains how to do this in his book (!book) which krzee highly recommends reading
14:46 <@vpnHelper> Joo got it.
14:46 < krzie> thanks eKKiM =]
14:47 < eKKiM> !book
14:47 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
14:48 < krzie> i learned a shitton when i read that book, and i had already been here helping people for years, its truely a gem of info
14:48 < krzie> if you plan on using openvpn a lot and want to really know how to get the most from it, that book belongs in your reference material
14:50 < eKKiM> it looks interesting indeed.
14:50 < eKKiM> might be a good christmas present
14:50 < eKKiM> ^^
14:51 -!- TimothyA [~Administr@sub-190-88-112ip163.rev.onenet.an] has joined #openvpn
14:54 -!- TimothyA1 [~Administr@63.223.120.157] has quit [Ping timeout: 244 seconds]
14:56 -!- gustav- is now known as beerbo
14:56 -!- beerbo is now known as beerbro
14:58 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:58 -!- TimothyA1 [~Administr@63.223.120.157] has joined #openvpn
14:59 -!- TimothyA [~Administr@sub-190-88-112ip163.rev.onenet.an] has quit [Ping timeout: 240 seconds]
15:08 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
15:12 -!- eKKiM [~eKKiM@d54C5D0BE.access.telenet.be] has quit [Quit: IRC webchat at http://irc2go.com/]
15:15 -!- smw [~smw@unaffiliated/smw] has quit [Read error: Connection reset by peer]
15:18 -!- TimothyA [~Administr@sub-190-88-112ip163.rev.onenet.an] has joined #openvpn
15:23 -!- TimothyA1 [~Administr@63.223.120.157] has quit [Ping timeout: 276 seconds]
15:35 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
15:59 -!- Mowee [~Mowi@lendabrain.net] has quit [Quit: I don't discriminate, I hate everyone.]
16:04 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
16:11 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
16:27 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
16:27 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
16:27 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
16:46 -!- scyld [~operacyjn@unaffiliated/wasyl] has quit [Read error: Operation timed out]
16:47 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17664>
16:50 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
16:53 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 240 seconds]
16:54 -!- _julian [~quassel@hmbg-5f765577.pool.mediaWays.net] has joined #openvpn
16:55 -!- Gravitron [~admin@64.93.227.79] has joined #openvpn
16:55 -!- Gravitron [~admin@64.93.227.79] has quit [Changing host]
16:55 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:56 -!- _julian_ [~quassel@hmbg-4d0685a1.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
17:01 -!- dkr [~dkr@67.132.255.16] has quit [Read error: Operation timed out]
17:04 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
17:04 -!- sir_tyrion [~sir_tyrio@unaffiliated/sir-tyrion/x-0257901] has joined #openvpn
17:05 < sir_tyrion> !welcome
17:05 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:05 < sir_tyrion> !howto
17:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:10 -!- _julian_ [~quassel@hmbg-4d06b1f9.pool.mediaWays.net] has joined #openvpn
17:11 -!- _julian [~quassel@hmbg-5f765577.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
17:14 < sir_tyrion> !iki
17:14 < sir_tyrion> !wiki
17:14 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
17:18 -!- wmp [~wmp@sored/admin/wmp] has joined #openvpn
17:19 < wmp> hello
17:19 < wmp> this is my openvpn config: http://wklej.org/id/629743
17:19 <@vpnHelper> Title: Wklejka #629743 | Wklej.org (at wklej.org)
17:19 < wmp> when i have unhashed last line, i cant connect to anything host
17:20 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:20 < wmp> how to fix this? I wnt to have routing over vpn default to all hosts
17:22 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
17:30 -!- _julian [~quassel@hmbg-4d06f78f.pool.mediaWays.net] has joined #openvpn
17:31 -!- _julian_ [~quassel@hmbg-4d06b1f9.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
17:35 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
17:48 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
17:48 < grendal-prime> this is odd..how do you ifdown tun0?
17:52 < wmp> grendal-prime: with unhashed?
17:52 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
17:55 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:57 < grendal-prime> ya
17:57 < grendal-prime> just you know how do i kill off a tunel.
17:58 < grendal-prime> i made a script for establishing a connection via bash script.  from a desktop i can click it and it runs...logs in . i have it leave the terminal window open..normally if i ctrl cancel the connection it closes out the tun..but..that is not the case with this
17:58 -!- _julian [~quassel@hmbg-4d06f78f.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
18:00 -!- rfxn [~ryanm84@69.157.150.142] has quit [Read error: Connection reset by peer]
18:00 -!- _julian [~quassel@hmbg-4d06b094.pool.mediaWays.net] has joined #openvpn
18:00 -!- rfxn [~ryanm84@69.157.150.142] has joined #openvpn
18:03 <@dazo> grendal-prime: if you're sure there's no openvpn process using the tun device ... run: openvpn --rmtun --dev tun0
18:03 <@dazo> if you run openvpn --mktun --dev tun0 ... this device will be created will be a persistent device, until --rmtun is called
18:04 <@dazo> (it's also possible to use tunctl too)
18:14 < grendal-prime> right
18:14 < grendal-prime> thanks
18:14 < grendal-prime> that work in windows as well?
18:15 < grendal-prime> because..other teams that use windows are always have ing "issues" with connections going down
18:15 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
18:16 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:16 -!- _julian [~quassel@hmbg-4d06b094.pool.mediaWays.net] has quit [Read error: Operation timed out]
18:17 -!- _julian [~quassel@hmbg-5f7674bf.pool.mediaWays.net] has joined #openvpn
18:22 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 244 seconds]
18:34 -!- Denial [Denial@drgi.co.uk] has quit []
18:39 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
18:40 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
18:42 -!- TimothyA [~Administr@sub-190-88-112ip163.rev.onenet.an] has quit [Read error: Connection reset by peer]
19:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
19:20 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:29 -!- _julian_ [~quassel@hmbg-5f760738.pool.mediaWays.net] has joined #openvpn
19:32 -!- _julian [~quassel@hmbg-5f7674bf.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
20:04 -!- cali_ [~cali@91.220.163.18] has joined #openvpn
20:04 < cali_> How can I prohibit dhcp from deleting my routes on windows?
21:10 -!- sno-_ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 240 seconds]
21:11 -!- sno- [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
21:11 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
21:11 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
21:16 -!- dazo is now known as dazo_afk
21:16 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has joined #openvpn
21:16 -!- Clete2 [~Clete2@c-98-215-42-211.hsd1.il.comcast.net] has left #openvpn []
21:21 -!- HAPPYFUNBRO [~wump@cpe-67-246-46-27.nycap.res.rr.com] has joined #openvpn
21:23 < HAPPYFUNBRO> hey dudes. so I've set up my VPN server & client, and am able to connect properly, but my IP address is not changing when I'm connected to the VPN. any ideas on why this is the case?
21:25 < EugeneKay> !redirect
21:25 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
21:28 < HAPPYFUNBRO> !ipforward
21:28 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
21:28 < HAPPYFUNBRO> !linipforward
21:28 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
21:29 < HAPPYFUNBRO> !NAT
21:29 <@vpnHelper> "NAT" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
21:30 < HAPPYFUNBRO> !linnat
21:30 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
21:33 < HAPPYFUNBRO> hm
21:33 < HAPPYFUNBRO> well
21:33 < HAPPYFUNBRO> that sorta worked
21:42 < HAPPYFUNBRO> well
21:43 < HAPPYFUNBRO> now I can't hit any web pages via URL or IP through the client
21:43 < EugeneKay> !dns
21:43 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
21:43 < HAPPYFUNBRO> yeah, I jkust did that
21:43 < HAPPYFUNBRO> shouldn't I be able to access websites via IP though?
21:44 < HAPPYFUNBRO> (without DNS lookups?)
21:44 < EugeneKay> Yup. Probably a firewall issue.
21:44 < HAPPYFUNBRO> yeah
21:44 < HAPPYFUNBRO> because I can access a local site just fine
21:44 < HAPPYFUNBRO> ok, so debian filewall stuff
21:44 < HAPPYFUNBRO> how to open this ish up yo?
21:45 < EugeneKay> !iptables
21:45 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
21:45 -!- master_of_master [~master_of@p57B52F27.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
21:46 < HAPPYFUNBRO> sounds scary
21:46 < HAPPYFUNBRO> how do I reenable my current rules after disabling them?
21:47 -!- master_of_master [~master_of@p57B55FD5.dip.t-dialin.net] has joined #openvpn
21:47 < EugeneKay> -D the rule 
21:47 < EugeneKay> Use -L to find the rulenum you want to -D
21:48 < HAPPYFUNBRO> hm
21:49 < HAPPYFUNBRO> correct me if I'm wrong, but it does not appear that anything is firewalled: http://pastebin.com/7977ji0H
21:50 < EugeneKay> Looks empty, yup.
21:50 < EugeneKay> Which linipforward did you do?
21:50 < HAPPYFUNBRO> #1
21:50 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
21:50 < HAPPYFUNBRO> !portforward
21:50 < HAPPYFUNBRO> !forwarding
21:52 < HAPPYFUNBRO> yeah
21:52 < HAPPYFUNBRO> option 1 and I just set option 2 as well
21:53 < HAPPYFUNBRO> also, I can ping sites from the VPN server
21:55 < HAPPYFUNBRO> !pushdns
21:55 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
21:55 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
21:55 < EugeneKay> YOu did the /proc/sys thing?
21:55 < HAPPYFUNBRO> yes
21:55 < HAPPYFUNBRO> echo 1 > /proc/sys/net/ipv4/ip_forward
21:55 < HAPPYFUNBRO> as root
21:55 < EugeneKay> Hm.
21:55 < EugeneKay> iptables -L -t nat
21:56 < HAPPYFUNBRO> http://pastebin.com/dV4S8QgJ
21:56 < HAPPYFUNBRO> this is the server directive in my openvpn.conf: server 172.17.0.0 255.255.255.0
21:57 < EugeneKay> Well, there'syour problm
21:57 < HAPPYFUNBRO> oh?
21:57 < EugeneKay> You're only masquerading for 172.17.0.0/32, not /24 ;-)
21:57 < EugeneKay> Delete both those rules, and add the right one
21:57 < HAPPYFUNBRO> oh, so it needs to be a /24 to include all the 172.17.0.x ips?
21:58 < EugeneKay> Yup. This is how subnetting works.
21:58 < HAPPYFUNBRO> ok
21:58 < HAPPYFUNBRO> I'm definitely taking a networking course (or two) in college
22:00 < HAPPYFUNBRO> EugeneKay how do you find the rule number?
22:01 < EugeneKay> Oh, what's the damn switch for it
22:02 < EugeneKay> --line-numbers
22:02 < EugeneKay> I coulda sworn there was a short switch for it
22:03 < HAPPYFUNBRO> the f
22:03 < HAPPYFUNBRO> iptables -t nat -D 2 should work, for rule #2 right?
22:03 < EugeneKay> WHen you delete the first one, the second becomes #1 ;-)
22:03 < HAPPYFUNBRO> main:/etc/openvpn# iptables -t nat -D 1
22:03 < HAPPYFUNBRO> iptables: Bad rule (does a matching rule exist in that chain?)
22:04 < EugeneKay> You need a chain as well for -D. man iptables ;-)
22:04 < HAPPYFUNBRO> yeah, I just realized that
22:04 < HAPPYFUNBRO> thanks
22:04 < HAPPYFUNBRO> :D
22:05 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 244 seconds]
22:06 < HAPPYFUNBRO> NICE!
22:06 < HAPPYFUNBRO> vpn yeah yeah yeha!
22:06 < EugeneKay> 'grats
22:06 < HAPPYFUNBRO> thanks. btw, this will forward all traffic through, right?
22:07 < EugeneKay> !def1
22:07 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
22:07 < HAPPYFUNBRO> ok
22:07 < EugeneKay> "yes"
22:07 < EugeneKay> Existing connections are not broken
22:07 < HAPPYFUNBRO> good. my curren't school's firewall rules are no fun
22:08 < HAPPYFUNBRO> / they block irc and severely inhibit email usage
22:08 < EugeneKay> Go figure.
22:08 < HAPPYFUNBRO> not a problem anymore though
22:08 < EugeneKay> Well, you get a bit of extra lag :-p
22:09 < HAPPYFUNBRO> laggy internet is better than no internet
22:09 < HAPPYFUNBRO> !
22:12 -!- novaflash is now known as novaflash_away
22:24 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
22:53 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
22:55 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 258 seconds]
22:57 -!- aef__ [~quassel@neoschlageter.raxys.net] has joined #openvpn
22:57 <@vpnHelper> RSS Update - forum: vpn is not working <http://forums.openvpn.net/topic9235.html#p17666>
23:01 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:22 -!- MaxPrt [~kvirc@mail.protocomtech.com.au] has joined #openvpn
23:23 < MaxPrt> hello. Is it possible to set up an openvpn connection only for a specific application? (ie. browser, p2p client)?
23:23 < MaxPrt> on linux
23:26 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:26 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:26 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
23:26 -!- oc80z [oc80z@blea.ch] has joined #openvpn
--- Day changed Fri Nov 18 2011
00:00 < krzee> kinda
00:01 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 244 seconds]
00:07 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:09 <+hyper_ch> good morning krzee
00:09 < krzee> moin
00:09 <+hyper_ch> you're up early
00:09 < krzee> MaxPrt, only way to possibly route by app is like this:
00:09 < krzee> !routebyapp
00:09 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (google it) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
00:10 <+hyper_ch> krzee: what about an app that can already be bound to a certain ip - like the vpn ip?
00:11 < krzee> that doesnt fit his examples
00:12 <+hyper_ch> his example doesn't fit my question :)
00:12 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:14 <+hyper_ch> gotta get to work now
00:15 < krzee> of course you can run servers on the vpn ip only
00:25 -!- MaxPrt [~kvirc@mail.protocomtech.com.au] has quit [Quit: KVIrc 4.0.4 Insomnia http://www.kvirc.net/]
00:41 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p17667>
00:59 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p17668>
01:01 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
01:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:17 < EugeneKay> hyper_ch - sure, you can bind to the VPN ip. You'll need to bounce the service every time the VPN restarts, though. A better option is to listen on *, and then firewall the non-vpn interfaces.
01:18 < EugeneKay> IMO, anyway
01:18 -!- _julian_ [~quassel@hmbg-5f760738.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
01:19 <+hyper_ch> EugeneKay: firewall non-vpn interface won't work where you want to have app1 go through eth0 and app2 through tun0
01:20 < EugeneKay> On the same port?
01:20 -!- _julian [~quassel@hmbg-4d069875.pool.mediaWays.net] has joined #openvpn
01:20 <+hyper_ch> no, not same port
01:21 <+hyper_ch> but some applications offer to be bound to a local IP so I assume when you do so, it'll get routed through the vpn
01:21 < EugeneKay> Oh, you mean outbound app-routing
01:21 < EugeneKay> Rather, outbound routing per-app
01:21 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:22 <+hyper_ch> there's a difference?
01:22 < EugeneKay> In terminology only
01:22 <+hyper_ch> well that's what I meant... I guess
01:22 <@vpnHelper> RSS Update - forum: openvpn-confgen <http://forums.openvpn.net/topic4683.html#p17669>
01:23 < EugeneKay> Yeah, not exactly sure how to do that. Prerouting trcisk with iptables, maybe.
01:23 < EugeneKay> I was thinking more along the lines of accepting connections to services
01:23 <+hyper_ch> well, rtorrent has a config option "bind = localip"
01:24 < EugeneKay> Right. You can bind to an address, but routing might still dictate that it goes out of eth0, say.
01:24 <+hyper_ch> so I tend to think you can tell it then that it will send through that localip and if that's tun0 it'll be vpned and if it's eth0 it'll not be vpn
01:24 <+hyper_ch> ah, I see what you mean :)
01:24 < EugeneKay> Not sure on how to solve that problem, and I'm not digging through man pages at 1:30AM :-p
01:25 <+hyper_ch> :)
01:31 -!- HAPPYFUNBRO [~wump@cpe-67-246-46-27.nycap.res.rr.com] has quit [Ping timeout: 245 seconds]
01:47 <@vpnHelper> RSS Update - forum: vpn is not working <http://forums.openvpn.net/topic9235.html#p17670>
01:53 <@vpnHelper> RSS Update - forum: Log Messages <http://forums.openvpn.net/topic9225.html#p17672> || OpenVPN + Linux Client Problem <http://forums.openvpn.net/topic9236.html#p17671>
02:05 -!- novaflash_away is now known as novaflash
02:16 -!- novaflash is now known as novaflash_away
02:25 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:27 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
02:32 -!- jemand [~quassel@brln-4d0c10a3.pool.mediaWays.net] has joined #openvpn
02:42 -!- ravemaster [~ravemaste@119.93.51.34] has joined #openvpn
02:43 -!- ravemaster [~ravemaste@119.93.51.34] has quit [Client Quit]
03:16 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
03:27 <@vpnHelper> RSS Update - forum: Configure openvpn at a virtual server <http://forums.openvpn.net/topic9230.html#p17673>
03:49 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
03:59 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
04:07 -!- dazo_afk is now known as dazo
04:12 -!- novaflash_away is now known as novaflash
04:18 -!- openbsdnoob [~openbsdno@88.79.221.61] has quit [Ping timeout: 248 seconds]
04:23 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-xadsihfdqetynmuq] has joined #openvpn
04:23 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
04:24 -!- evilhackerdude is now known as ehd
04:34 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:40 <@vpnHelper> RSS Update - forum: [SOLVED] Configure openvpn at a virtual server <http://forums.openvpn.net/topic9230.html#p17675> || vpn is not working <http://forums.openvpn.net/topic9235.html#p17674>
04:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
04:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:46 <@vpnHelper> RSS Update - forum: OpenVPN + Linux Client Problem <http://forums.openvpn.net/topic9236.html#p17676>
04:51 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:53 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Ping timeout: 244 seconds]
04:53 -!- bragon_ is now known as bragon
05:04 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
05:46 <@vpnHelper> RSS Update - forum: OpenVPN + Linux Client Problem <http://forums.openvpn.net/topic9236.html#p17677>
06:25 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
06:35 -!- ravemaster [17133525@gateway/web/freenode/ip.23.19.53.37] has joined #openvpn
06:39 -!- ravemaster [17133525@gateway/web/freenode/ip.23.19.53.37] has quit [Ping timeout: 265 seconds]
06:57 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has quit []
07:03 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
07:04 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 244 seconds]
07:04 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
07:08 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
07:28 -!- jemand [~quassel@brln-4d0c10a3.pool.mediaWays.net] has quit [Read error: Connection reset by peer]
07:31 <@vpnHelper> RSS Update - forum: Site to Site VPN with overlapping IP addresses <http://forums.openvpn.net/topic8362.html#p17678>
07:43 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-45.html#p17679>
07:56 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
08:00 < EugeneKay> Yawn.
08:09 < bjorneven> ah friday and it's weekend
08:09 < bjorneven> work weekend probably
08:11 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
08:12 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
08:12 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:24 -!- _julian_ [~quassel@hmbg-5f77cb4b.pool.mediaWays.net] has joined #openvpn
08:26 < rooth> are there other types of weekends you mean?
08:26 -!- _julian [~quassel@hmbg-4d069875.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
08:27 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
08:27 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 244 seconds]
08:28 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
08:28 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
08:28 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:29 -!- _julian [~quassel@hmbg-5f77cbe0.pool.mediaWays.net] has joined #openvpn
08:30 -!- _julian_ [~quassel@hmbg-5f77cb4b.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
08:31 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
08:31 -!- p3rror [~mezgani@41.140.28.219] has joined #openvpn
08:32 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 255 seconds]
08:35 -!- _julian_ [~quassel@hmbg-5f77cd39.pool.mediaWays.net] has joined #openvpn
08:37 -!- _julian [~quassel@hmbg-5f77cbe0.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
08:41 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:44 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
09:26 -!- kush [~kush@wifi-2022-23-public.unh.edu] has joined #openvpn
09:28 < kush> hey guys, I am trying to connect to a VPN server that does masquerading of IP addresses, and as a result, i want my public IP to be the one assigned by the VPN server, however, I am behind a NAT at the moment, we have a private DNS server inside our local address space, is there any way that i can tell openvpn to send all DNS traffic to my LOCAL dns server(through eth0) and send ALL non-dns traffic through TAP0?
09:30 < kush> right now all traffic is going through tap0, so i just need to find out how to make an exception either for a given IP address, or for DNS traffic, preferably just for a given IP address
09:30 -!- _julian [~quassel@hmbg-4d06c65b.pool.mediaWays.net] has joined #openvpn
09:30 -!- _julian_ [~quassel@hmbg-5f77cd39.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
09:39 < kush> anyone?
09:39 < kush> i just need help adding a route to my client configuration file
09:39 < kush> send an ip to my private subnet instead of my tap interface
09:45 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has joined #openvpn
09:46 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
09:55 < kush> anyone alive in here?
09:55 < progsurfer11> yes
09:57 < kush> if i hav a tap interface setup to push all my traffic through, how do i selectively route 1 ip address through my local subnet insteadof through that tap interface?
09:57 < kush> i think that in my client's .ovpn file i need to add some route line, but im not sure how to do it
09:57 < kush> and i can't find any goog documentation on it
09:58 <+hyper_ch> krzee: http://code.google.com/intl/de-DE/speed/webp/gallery2.html
09:58 <@vpnHelper> Title: Lossless and Alpha - GalleryWebP - Google Code (at code.google.com)
10:02 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 248 seconds]
10:08 -!- kush [~kush@wifi-2022-23-public.unh.edu] has quit [Read error: Operation timed out]
10:09 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has quit [Read error: Connection reset by peer]
10:10 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has joined #openvpn
10:18 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:19 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
10:20 -!- HAPPYFUNBRO [~wump@cpe-67-246-46-27.nycap.res.rr.com] has joined #openvpn
10:26 -!- jemand [~quassel@brln-4d0c10a3.pool.mediaWays.net] has joined #openvpn
10:29 -!- jemand [~quassel@brln-4d0c10a3.pool.mediaWays.net] has quit [Remote host closed the connection]
10:47 <@vpnHelper> RSS Update - forum: W7Server - Embedded Linux GSM Router <http://forums.openvpn.net/topic9237.html#p17681>
10:55 -!- oktay [~oktay@217.131.162.89] has joined #openvpn
10:56 < oktay> Hey guys. Where can I find docs on linking two seperate networks but allowing clients connected to either one to access the whole thing?
11:01 < oktay> I kinda see how that would work. But I can't figure out the routes part of it. I don't want to push a route that would cause the local network to go through the other vpn.
11:18 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has quit [Ping timeout: 244 seconds]
11:19 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 245 seconds]
11:20 < oktay> i want 'iroute' ?
11:21 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
11:24 -!- jemand [~quassel@brln-4d0c10a3.pool.mediaWays.net] has joined #openvpn
11:31 -!- grendal-prime [~sgraham@71-154-139-54.ded.pacbell.net] has joined #openvpn
11:32 < oktay> ok so it's in the config sample
11:37 < oktay> thanks anyway.
11:37 -!- oktay [~oktay@217.131.162.89] has quit [Quit: leaving]
11:40 -!- jemand [~quassel@brln-4d0c10a3.pool.mediaWays.net] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
11:40 < EugeneKay> Well, at least he found the answer before he left angstily.
11:56 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
11:56 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has quit [Ping timeout: 252 seconds]
11:58 -!- grendal-prime [~sgraham@71-154-139-54.ded.pacbell.net] has quit [Ping timeout: 240 seconds]
11:59 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has joined #openvpn
12:03 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:10 -!- grendal-prime [~sgraham@2001:470:822a:205:226:c7ff:fecd:a1e2] has joined #openvpn
12:13 -!- _julian_ [~quassel@hmbg-4d06d507.pool.mediaWays.net] has joined #openvpn
12:14 -!- _julian [~quassel@hmbg-4d06c65b.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
12:20 -!- _julian [~quassel@hmbg-4d06f6e9.pool.mediaWays.net] has joined #openvpn
12:22 -!- _julian_ [~quassel@hmbg-4d06d507.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
12:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 260 seconds]
12:23 -!- HAPPYFUNBRO [~wump@cpe-67-246-46-27.nycap.res.rr.com] has quit [Ping timeout: 276 seconds]
12:31 -!- _julian_ [~quassel@hmbg-4d06a457.pool.mediaWays.net] has joined #openvpn
12:33 -!- _julian [~quassel@hmbg-4d06f6e9.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
12:35 -!- dazo is now known as dazo_afk
12:48 <@vpnHelper> RSS Update - forum: IPTABLES secure Internet tunnel <http://forums.openvpn.net/topic7722.html#p17682>
12:55 -!- HAPPYFUNBRO [~wump@151.103.96.207] has joined #openvpn
13:00 <@vpnHelper> RSS Update - forum: TLS handshake issues when using udp over a tcp connection <http://forums.openvpn.net/topic9238.html>
13:01 -!- _julian_ [~quassel@hmbg-4d06a457.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
13:03 -!- _julian [~quassel@hmbg-5f77f0d0.pool.mediaWays.net] has joined #openvpn
13:12 <@vpnHelper> RSS Update - forum: Win7 & Srever 2k8 - VPN Connets but cannot access each other <http://forums.openvpn.net/topic9239.html>
13:17 -!- HAPPYFUNBRO [~wump@151.103.96.207] has quit [Read error: Connection reset by peer]
13:19 -!- Jarpse [~jarpse@cruft.geek.cx] has quit [Ping timeout: 240 seconds]
13:19 -!- HAPPYFUNBRO [~wump@72.26.193.254] has joined #openvpn
13:24 <@vpnHelper> RSS Update - forum: OpenVPN wont Connect with PF Enabled <http://forums.openvpn.net/topic9240.html>
13:29 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:29 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:39 -!- Jarpse [~jarpse@cruft.geek.cx] has joined #openvpn
13:43 -!- Yen [Yen@unaffiliated/yen] has quit []
13:51 -!- HAPPYFUNBRO [~wump@72.26.193.254] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
14:05 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:48 <@vpnHelper> RSS Update - forum: OpenVPN wont Connect with PF Enabled <http://forums.openvpn.net/topic9240.html#p17686>
14:54 <@vpnHelper> RSS Update - forum: Site to Site VPN with overlapping IP addresses <http://forums.openvpn.net/topic8362.html#p17687>
15:00 <@vpnHelper> RSS Update - forum: Win7 & Srever 2k8 - VPN Connets but cannot access each other <http://forums.openvpn.net/topic9239.html#p17688>
15:09 -!- Gravitron [~admin@64.93.225.31] has joined #openvpn
15:09 -!- Gravitron [~admin@64.93.225.31] has quit [Changing host]
15:09 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:13 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
15:13 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
15:30 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
15:39 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:47 -!- bangert [quasselcor@gentoo/developer/bangert] has left #openvpn []
15:55 -!- vpopov [~happylife@dyn-50-92.dzer.fttbee.kis.ru] has joined #openvpn
16:17 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
16:18 <@vpnHelper> RSS Update - forum: Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580-15.html#p17689>
16:55 <@vpnHelper> RSS Update - forum: TLS handshake issues when using udp over a tcp connection <http://forums.openvpn.net/topic9238.html#p17690>
16:59 -!- vpopov [~happylife@dyn-50-92.dzer.fttbee.kis.ru] has quit [Read error: No route to host]
17:01 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853-15.html#p17691>
17:02  * EugeneKay installs central heating under his rock
17:03 -!- statix [~statix@rrcs-208-125-52-150.nys.biz.rr.com] has quit []
17:13 <@vpnHelper> RSS Update - forum: OpenVPN wont Connect with PF Enabled <http://forums.openvpn.net/topic9240.html#p17692>
17:20 -!- aef__ [~quassel@neoschlageter.raxys.net] has quit [Remote host closed the connection]
17:52 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
17:52 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:07 < reiffert>   
18:25 <@vpnHelper> RSS Update - forum: OpenVPN Clients Automation <http://forums.openvpn.net/topic9129.html#p17693>
18:34 -!- cyberspace- [20253@ninthfloor.org] has quit [Quit: leaving]
18:35 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
18:37 -!- grendal-prime [~sgraham@2001:470:822a:205:226:c7ff:fecd:a1e2] has quit [Ping timeout: 244 seconds]
18:43 <@vpnHelper> RSS Update - forum: Dropped UDP fragment problem <http://forums.openvpn.net/topic9241.html>
18:47 -!- _julian [~quassel@hmbg-5f77f0d0.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
18:49 <@vpnHelper> RSS Update - forum: Configuration: route specific traffic over Openvpn <http://forums.openvpn.net/topic8853-15.html#p17695>
18:49 -!- _julian [~quassel@hmbg-5f7643d1.pool.mediaWays.net] has joined #openvpn
18:52 -!- p3rror [~mezgani@41.140.28.219] has quit [Read error: Connection reset by peer]
19:01 -!- _julian_ [~quassel@hmbg-5f76110b.pool.mediaWays.net] has joined #openvpn
19:05 -!- _julian [~quassel@hmbg-5f7643d1.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
19:06 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
19:19 <@vpnHelper> RSS Update - forum: Too much log noise <http://forums.openvpn.net/topic9176.html#p17696>
19:26 -!- _julian_ [~quassel@hmbg-5f76110b.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:31 -!- _julian [~quassel@hmbg-5f76044d.pool.mediaWays.net] has joined #openvpn
19:33 -!- _julian_ [~quassel@hmbg-4d06f287.pool.mediaWays.net] has joined #openvpn
19:35 -!- _julian [~quassel@hmbg-5f76044d.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
19:38 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 258 seconds]
19:39 -!- Denial [Denial@drgi.co.uk] has quit []
19:39 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
19:46 -!- _julian_ [~quassel@hmbg-4d06f287.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:51 -!- _julian [~quassel@hmbg-5f77c2fe.pool.mediaWays.net] has joined #openvpn
20:35 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
20:35 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Read error: Connection reset by peer]
20:59 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:11 -!- appleguru [~appleguru@155.48.163.179] has joined #openvpn
21:12 < appleguru> hey all, looking to learn a bit more about the different VPN options and their requirements
21:12 < appleguru> al
21:12 < appleguru> anyone up for 20 questions? 8)
21:12 < appleguru> !welcome
21:12 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:13 < appleguru> !goal
21:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:14 < appleguru> coolness… goal: I would like to set up a VPN so I can access a LAN over the internet, ideally from an iPhone using the built in VPN clients
21:16 -!- _julian_ [~quassel@hmbg-4d06e130.pool.mediaWays.net] has joined #openvpn
21:18 -!- _julian [~quassel@hmbg-5f77c2fe.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
21:19 < appleguru> anyone have any experience with the cisco RV042?
21:41 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:43 -!- master_of_master [~master_of@p57B55FD5.dip.t-dialin.net] has quit [Read error: Operation timed out]
21:46 -!- _julian_ [~quassel@hmbg-4d06e130.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
21:46 -!- _julian [~quassel@hmbg-5f77e2db.pool.mediaWays.net] has joined #openvpn
21:47 -!- master_of_master [~master_of@p57B55A9F.dip.t-dialin.net] has joined #openvpn
21:47 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 258 seconds]
21:53 -!- _julian [~quassel@hmbg-5f77e2db.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
21:54 -!- _julian [~quassel@hmbg-5f77e3ff.pool.mediaWays.net] has joined #openvpn
21:58 -!- _julian_ [~quassel@hmbg-4d06b5b8.pool.mediaWays.net] has joined #openvpn
21:59 -!- _julian [~quassel@hmbg-5f77e3ff.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:04 -!- Gravitron [~admin@64.93.225.31] has joined #openvpn
22:04 -!- Gravitron [~admin@64.93.225.31] has quit [Changing host]
22:04 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:08 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
22:09 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
22:20 -!- _julian_ [~quassel@hmbg-4d06b5b8.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
22:21 -!- catsup [d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
22:21 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
22:21 -!- _julian [~quassel@hmbg-4d06ab5b.pool.mediaWays.net] has joined #openvpn
22:25 -!- _julian_ [~quassel@hmbg-5f7644a7.pool.mediaWays.net] has joined #openvpn
22:26 -!- _julian [~quassel@hmbg-4d06ab5b.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
22:29 -!- _julian [~quassel@hmbg-4d06cebe.pool.mediaWays.net] has joined #openvpn
22:29 -!- _julian_ [~quassel@hmbg-5f7644a7.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:35 -!- _julian_ [~quassel@hmbg-4d06bc74.pool.mediaWays.net] has joined #openvpn
22:35 -!- _julian [~quassel@hmbg-4d06cebe.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
22:39 -!- _julian [~quassel@hmbg-4d06fb30.pool.mediaWays.net] has joined #openvpn
22:40 -!- _julian_ [~quassel@hmbg-4d06bc74.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
22:42 -!- _julian [~quassel@hmbg-4d06fb30.pool.mediaWays.net] has quit [Read error: Operation timed out]
22:47 -!- _julian [~quassel@hmbg-5f7667b5.pool.mediaWays.net] has joined #openvpn
22:52 -!- _julian [~quassel@hmbg-5f7667b5.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
22:53 -!- _julian [~quassel@hmbg-4d06d0c7.pool.mediaWays.net] has joined #openvpn
22:58 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:12 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has joined #openvpn
23:16 <@vpnHelper> RSS Update - forum: Open Vpn and Steam <http://forums.openvpn.net/topic9242.html>
23:29 -!- appleguru [~appleguru@155.48.163.179] has quit [Quit: appleguru]
23:58 -!- _julian_ [~quassel@hmbg-4d06cc7c.pool.mediaWays.net] has joined #openvpn
23:59 -!- _julian [~quassel@hmbg-4d06d0c7.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
--- Day changed Sat Nov 19 2011
00:02 -!- _julian_ [~quassel@hmbg-4d06cc7c.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
00:02 -!- _julian [~quassel@hmbg-4d06dc94.pool.mediaWays.net] has joined #openvpn
00:23 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
00:27 -!- _julian_ [~quassel@hmbg-5f7668e6.pool.mediaWays.net] has joined #openvpn
00:28 -!- _julian [~quassel@hmbg-4d06dc94.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
00:36 -!- _julian [~quassel@hmbg-5f763e4c.pool.mediaWays.net] has joined #openvpn
00:39 -!- _julian_ [~quassel@hmbg-5f7668e6.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
00:43 -!- _julian [~quassel@hmbg-5f763e4c.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
01:00 -!- _julian [~quassel@hmbg-4d06b2ff.pool.mediaWays.net] has joined #openvpn
01:09 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
01:10 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
01:20 -!- grendal-prime [~sgraham@c-67-187-145-117.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
01:24 -!- _julian [~quassel@hmbg-4d06b2ff.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
01:25 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
01:25 -!- _julian [~quassel@hmbg-4d06d7aa.pool.mediaWays.net] has joined #openvpn
01:25 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
01:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
01:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:43 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
01:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:46 <@vpnHelper> RSS Update - forum: OpenVPN wont Connect with PF Enabled <http://forums.openvpn.net/topic9240.html#p17698>
01:52 -!- _julian [~quassel@hmbg-4d06d7aa.pool.mediaWays.net] has quit [Read error: Operation timed out]
01:53 -!- _julian [~quassel@hmbg-5f7676d3.pool.mediaWays.net] has joined #openvpn
01:57 -!- _julian_ [~quassel@hmbg-5f77f9c4.pool.mediaWays.net] has joined #openvpn
01:59 -!- _julian [~quassel@hmbg-5f7676d3.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
02:18 -!- _julian_ [~quassel@hmbg-5f77f9c4.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
02:19 -!- _julian [~quassel@hmbg-5f77fd87.pool.mediaWays.net] has joined #openvpn
02:28 <@vpnHelper> RSS Update - forum: W7Server - Embedded Linux GSM Router <http://forums.openvpn.net/topic9237.html#p17699>
02:34 <@vpnHelper> RSS Update - forum: W7Server - Embedded Linux GSM Router <http://forums.openvpn.net/topic9237.html#p17700>
02:38 -!- ronnocol [~lance@2001:1868:214::bad:babe] has quit [Ping timeout: 244 seconds]
02:39 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
02:54 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
03:04 -!- ronnocol [~lance@2001:1868:214::bad:babe] has quit [Ping timeout: 244 seconds]
03:04 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
03:06 -!- vpopov [~happylife@dyn-50-92.dzer.fttbee.kis.ru] has joined #openvpn
03:10 -!- ronnocol [~lance@2001:1868:214::bad:babe] has quit [Ping timeout: 244 seconds]
03:11 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
03:12 -!- _julian [~quassel@hmbg-5f77fd87.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
03:13 -!- _julian [~quassel@hmbg-5f77c76a.pool.mediaWays.net] has joined #openvpn
03:21 -!- _julian_ [~quassel@hmbg-4d06e5f3.pool.mediaWays.net] has joined #openvpn
03:23 -!- _julian [~quassel@hmbg-5f77c76a.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
03:29 -!- _julian_ [~quassel@hmbg-4d06e5f3.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
03:48 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has joined #openvpn
05:05 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
05:07 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 248 seconds]
05:08 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
05:08 -!- mode/#openvpn [+o vpnHelper] by ChanServ
05:10 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
05:22 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
05:22 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
05:30 -!- vpopov [~happylife@dyn-50-92.dzer.fttbee.kis.ru] has quit [Read error: Connection reset by peer]
05:35 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
06:06 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:41 <@vpnHelper> RSS Update - forum: Windows 7 64 bit Installation Fails OpenVPN 2.2.1 <http://forums.openvpn.net/topic8440.html#p17702> || ippool <http://forums.openvpn.net/topic9243.html>
06:47 <@vpnHelper> RSS Update - forum: IFCONFIG POOL free & easy <http://forums.openvpn.net/topic9243.html>
08:19 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:11 -!- michl [~mich@dslb-084-056-099-236.pools.arcor-ip.net] has joined #openvpn
10:03 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
10:18 -!- vtcN- [~vtcN@unaffiliated/thethe] has quit [Ping timeout: 240 seconds]
10:35 -!- appleguru [~appleguru@155.48.163.179] has joined #openvpn
10:35 -!- appleguru [~appleguru@155.48.163.179] has quit [Client Quit]
10:44 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:48 <@vpnHelper> RSS Update - forum: ip pool range help <http://forums.openvpn.net/topic9244.html>
11:21 -!- no1special [~subinacls@unaffiliated/no1special] has joined #openvpn
12:17 -!- darknase [~darknase@178.73.193.207] has joined #openvpn
12:17 < darknase> !welcome
12:17 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:18 < darknase> !goal
12:18 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:21 <+hyper_ch> someone really reads the channel topic?
12:30 -!- michl [~mich@dslb-084-056-099-236.pools.arcor-ip.net] has quit [Remote host closed the connection]
12:31 < darknase> Well I found that those who can read are usually have the advantage ;)
12:42 <+hyper_ch> :)
13:36 <@vpnHelper> RSS Update - forum: bridge networks together. <http://forums.openvpn.net/topic9245.html>
13:39 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
13:55 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17705>
14:19 <@vpnHelper> RSS Update - forum: ip pool range help <http://forums.openvpn.net/topic9244.html#p17706>
14:33 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 240 seconds]
14:41 -!- _julian [~quassel@hmbg-4d06ede9.pool.mediaWays.net] has joined #openvpn
14:43 <@vpnHelper> RSS Update - forum: bridge networks together. <http://forums.openvpn.net/topic9245.html#p17708> || VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17707>
14:49 <@vpnHelper> RSS Update - forum: Open Vpn and Steam <http://forums.openvpn.net/topic9242.html#p17709>
14:55 <+hyper_ch> krzee: http://it.slashdot.org/story/11/11/19/2011228/full-disk-encryption-hard-for-law-enforcement-to-crack  -   "[T]here are three main problems with full disk encryption (FDE): First, evidence-gathering goons can turn off the computer (for transportation) without realizing it's encrypted, and thus can't get back at the data (unless the arrestee gives up his password, which he doesn't have to do); second, if the analysis team doesn't know that 
14:55 <@vpnHelper> Title: Full Disk Encryption Hard For Law Enforcement To Crack - Slashdot (at it.slashdot.org)
14:55 <+hyper_ch> the disk is encrypted, it can waste hours trying to read something that's ultimately unreadable; and finally, in the case of hardware-level disk encryption, tampering with the device can trigger self-destruction of the data. The paper does go on to suggest some ways to ameliorate these issues, but ultimately the researchers aren't hopeful: 'Research is needed to develop new techniques and technology for breaking or bypassing full disk encryption.'
14:55 <+hyper_ch> "
14:56 <+hyper_ch> "Well, yes, but it turns out that real federal intelligence agencies, like the FBI, CIA, and NSA, also have a problem cracking encrypted hard disks — and according to a new research paper, this is a serious risk to national security." ---> I wonder, what isn't a serious risk to 'national security'
15:01 <@vpnHelper> RSS Update - forum: bridge networks together. <http://forums.openvpn.net/topic9245.html#p17711> || IPTABLES secure Internet tunnel <http://forums.openvpn.net/topic7722.html#p17710>
15:01 -!- fx [~fx@unaffiliated/fx] has joined #openvpn
15:01 < fx> !welcome
15:01 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:02 < fx> !goal
15:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:03 < fx> ok, Hi, I would like to connect two lans together over internet. Only tools we can use are one linux machine at either lan
15:07 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html#p17712>
15:07 <+hyper_ch> !tunortap
15:07 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
15:07 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
15:07 <+hyper_ch> !tunortap!ptp
15:07 <+hyper_ch> !ptp
15:07 <+hyper_ch> !p-t-p
15:11 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:19 -!- fx [~fx@unaffiliated/fx] has quit [Ping timeout: 248 seconds]
15:34 < no1special> looking for information for mesh openvpn config
15:35 < EugeneKay> There isn't any. Mesh is not supported.
15:35 < EugeneKay> You can get something approaching it with a routing daemon and 2+ server nodes
15:36 < no1special> so cant really have every node act as a server and client ?
15:36 < EugeneKay> Nope.
15:36 < EugeneKay> You can run two instances(a server and a client one) on each computer involved, but you'll still need a routing daemon to keep it straight.
15:37 < no1special> ny documentation for the setup you are describing 
15:37 < no1special> any*
15:37 < no1special> would an access server operate this way ?
15:37 < no1special> openvpn-as
15:38 < EugeneKay> I've no clue about AS at all.
15:38 < no1special> but just in the essence of the topology its all interconnected hub and spoke 
15:38 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
15:38 < no1special> with routing daemon 
15:38 < EugeneKay> I don't know of any documentation on it, but you can find (crappy blog) HOWOs via google
15:39 < no1special> yep, not a problem - just needed direction w00t ty EugeneKay 
15:39 < EugeneKay> The routing daemon stuff is gonna be fairly basic IGP or OSPF or such. Quagga is a good place to start.
15:40 < no1special> perfect :) ty for the launch pad
15:40 < EugeneKay> Its up to you whether to run it just at the hub(with each spoke connected to only one hub), or on all nodes(each spoke connected to all hubs).
15:41 < EugeneKay> The first method will be easier to configure+maintain, the second will give you better performance, assuming you're in a geographically disparate setup
15:41 < no1special> the 2nd scenario for sure
15:42 < EugeneKay> I wish you good luck with it, then. You'll need it ;-)
15:42 < no1special> w00t, i only have a few hours into research 
15:42 < no1special> ty i will need it
15:43 < EugeneKay> I think OSPF is your best bet
15:43 < EugeneKay> You can even, if you're feeling masochistic, run 6in4 tunnels over it for some hawt IPv6 action.
15:47 <@vpnHelper> RSS Update - forum: Newbie has problems with OpenVPN client <http://forums.openvpn.net/topic9033.html#p17713>
16:03 -!- fx [~fx@cpc4-mort5-2-0-cust186.croy.cable.virginmedia.com] has joined #openvpn
16:03 -!- fx [~fx@cpc4-mort5-2-0-cust186.croy.cable.virginmedia.com] has quit [Changing host]
16:03 -!- fx [~fx@unaffiliated/fx] has joined #openvpn
16:05 <@vpnHelper> RSS Update - forum: W7Server - Embedded Linux GSM Router <http://forums.openvpn.net/topic9237.html#p17715> || VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17714>
16:11 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p17716>
16:16 -!- Gravitron [~admin@64.93.225.31] has joined #openvpn
16:16 -!- Gravitron [~admin@64.93.225.31] has quit [Changing host]
16:16 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:21 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
16:21 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
16:21 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
16:21 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:23 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Client Quit]
16:55 -!- fx [~fx@unaffiliated/fx] has quit [Ping timeout: 244 seconds]
17:00 -!- fx [~fx@cpc4-mort5-2-0-cust186.croy.cable.virginmedia.com] has joined #openvpn
17:00 -!- fx [~fx@cpc4-mort5-2-0-cust186.croy.cable.virginmedia.com] has quit [Changing host]
17:00 -!- fx [~fx@unaffiliated/fx] has joined #openvpn
17:03 <@vpnHelper> RSS Update - forum: OpenVpn connection problem with secret key <http://forums.openvpn.net/topic9246.html>
17:14 -!- fx [~fx@unaffiliated/fx] has quit [Ping timeout: 240 seconds]
17:15 <@vpnHelper> RSS Update - forum: bridge networks together. <http://forums.openvpn.net/topic9245.html#p17718>
17:28 -!- fx [~fx@cpc4-mort5-2-0-cust186.croy.cable.virginmedia.com] has joined #openvpn
17:28 -!- fx [~fx@cpc4-mort5-2-0-cust186.croy.cable.virginmedia.com] has quit [Changing host]
17:28 -!- fx [~fx@unaffiliated/fx] has joined #openvpn
17:28 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
17:31 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
17:33 <@vpnHelper> RSS Update - forum: Insorg.org - Elite VPN and proxy services <http://forums.openvpn.net/topic9247.html>
17:49 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
17:50 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
18:38 -!- no1special [~subinacls@unaffiliated/no1special] has quit [Read error: Operation timed out]
18:48 -!- no1special [~subinacls@207.171.33.65.cfl.res.rr.com] has joined #openvpn
19:11 -!- _julian_ [~quassel@hmbg-4d06d731.pool.mediaWays.net] has joined #openvpn
19:11 -!- _julian [~quassel@hmbg-4d06ede9.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:12 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:37 -!- _julian [~quassel@hmbg-5f767239.pool.mediaWays.net] has joined #openvpn
19:38 -!- _julian_ [~quassel@hmbg-4d06d731.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
19:39 -!- no1special [~subinacls@207.171.33.65.cfl.res.rr.com] has quit [Read error: Operation timed out]
19:48 -!- _julian [~quassel@hmbg-5f767239.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:49 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
19:50 -!- _julian [~quassel@hmbg-5f763428.pool.mediaWays.net] has joined #openvpn
19:52 -!- fx [~fx@unaffiliated/fx] has quit [Ping timeout: 276 seconds]
20:06 -!- _julian_ [~quassel@hmbg-5f77d402.pool.mediaWays.net] has joined #openvpn
20:07 -!- _julian [~quassel@hmbg-5f763428.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
20:13 -!- _julian [~quassel@hmbg-4d06c475.pool.mediaWays.net] has joined #openvpn
20:14 -!- _julian_ [~quassel@hmbg-5f77d402.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
20:36 -!- _julian [~quassel@hmbg-4d06c475.pool.mediaWays.net] has quit [Read error: Operation timed out]
20:37 -!- _julian [~quassel@hmbg-5f77d96f.pool.mediaWays.net] has joined #openvpn
21:00 -!- Denial [Denial@drgi.co.uk] has quit []
21:02 -!- _julian [~quassel@hmbg-5f77d96f.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
21:06 -!- _julian [~quassel@hmbg-5f767971.pool.mediaWays.net] has joined #openvpn
21:18 -!- _julian_ [~quassel@hmbg-5f767d4e.pool.mediaWays.net] has joined #openvpn
21:20 -!- _julian [~quassel@hmbg-5f767971.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
21:42 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 258 seconds]
21:45 -!- master_of_master [~master_of@p57B55A9F.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
21:47 -!- master_of_master [~master_of@p57B55711.dip.t-dialin.net] has joined #openvpn
21:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
21:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:31 -!- pr0zoid [pr0zoid@24-246-5-196.cable.teksavvy.com] has joined #openvpn
22:32 -!- Gravitron [~admin@64.93.224.32] has joined #openvpn
22:32 -!- Gravitron [~admin@64.93.224.32] has quit [Changing host]
22:32 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:35 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
22:36 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 248 seconds]
22:53 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:35 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9210.html#p17540>
23:41 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
23:41 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
23:41 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
--- Day changed Sun Nov 20 2011
00:41 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17720>
01:06 <@vpnHelper> RSS Update - forum: ip pool range help <http://forums.openvpn.net/topic9244.html#p17721>
01:06 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
01:06 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
01:18 -!- kloeri_ is now known as kloeri
01:24 <@vpnHelper> RSS Update - forum: ip pool range help <http://forums.openvpn.net/topic9244.html#p17723> || VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17722>
01:27 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:33 < qubits> hail
01:34 -!- qubits [~zero@ip-97-74-121-225.ip.secureserver.net] has quit [Changing host]
01:34 -!- qubits [~zero@unaffiliated/qubits] has joined #openvpn
02:00 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html#p17724>
02:18 -!- vpopov [~happylife@dyn-37-70.dzer.fttbee.kis.ru] has joined #openvpn
02:30 -!- darknase [~darknase@178.73.193.207] has quit [Ping timeout: 240 seconds]
02:36 <@vpnHelper> RSS Update - forum: ip pool range help <http://forums.openvpn.net/topic9244.html#p17725>
02:48 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17726>
03:05 -!- funyun [~lolwhut@cpe-65-25-100-144.neo.res.rr.com] has joined #openvpn
03:06 < funyun> hi. someone here helped me setup openvpn on my server. when i would type "openvpn --config /etc/openvpn/server.conf" my vpn would work. but now i have updated from debian lenny to squeeze and this no longer works. can anyone help me?
03:15 <+hyper_ch> funyun: enable logging
03:16 < funyun> hyper_ch: how do i do that?
03:16 <+hyper_ch> !log
03:16 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
03:16 <+hyper_ch> !logging
03:16 <+hyper_ch> !logs
03:16 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
03:17 <+hyper_ch> there's options that enable logging
03:18 < funyun> hyper_ch: do you know how i enable it?
03:18 < funyun> i typed whoami and it says root
03:19 <+hyper_ch> you enable it in the config files
03:19 <+hyper_ch> !howto
03:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:21 < funyun> hyper_ch: i don't see anything about enabling logging
03:22 <+hyper_ch> man openvpn
03:23 < funyun> hyper_ch: still nothing
03:24 <+hyper_ch> I don't think you read through that long man page in 1 minute
03:25 < funyun> i searched for logging and it doesn't mention it
03:26 <+hyper_ch> as said, you haven't read it
03:27 < funyun> so i should read an hour long page to find a single command that might not even be in there? come on dude, help me out
03:28 <+hyper_ch> I already did... you just refuse to do any work
03:29 < funyun> hyper_ch: it'd be like if you asked me to borrow a pencil. i would let you borrow one, i wouldn't give you an instruction book on how to make one from scratch. i just need a little help
03:31 <+hyper_ch> that analogy doesn't hold up... because in your case, you have all the tools you need to solve the problem
03:31 <+hyper_ch> however in the pencil case I don't
03:31 <+hyper_ch> the book alone doesn't suffice
03:33 < funyun> but in my case i don't have the knowledge to suffice. i don't know what any of this stuff means. i'm new to linux. none of this makes sense to me
03:34 -!- vpopov [~happylife@dyn-37-70.dzer.fttbee.kis.ru] has quit [Ping timeout: 252 seconds]
03:38 < funyun> hyper_ch: does ChocoCooks still come on here?
03:43 < funyun> hi. someone here helped me setup openvpn on my server. when i would type "openvpn --config /etc/openvpn/server.conf" my vpn would work. but now i have updated from debian lenny to squeeze and this no longer works. can anyone help me?
03:47 -!- Varazir [mircwars@c-94-255-163-169.cust.bredband2.com] has joined #openvpn
03:48 < Varazir> funyun: stop PM me 
03:49 < Varazir> funyun: ask in the channel,
03:49 -!- vpopov [~happylife@dyn-56-47.dzer.fttbee.kis.ru] has joined #openvpn
03:49 < funyun> nobody is awake
03:50 < funyun> Varazir: you're my only chance
03:50 <+hyper_ch> Varazir: he's very impatient
03:51 < funyun> i'm not, i just want someone to point me in the right direction. and not tell me to read an entire man page looking for something i would have no clue if i find
03:51 < Varazir> funyun: I use openvpnAS 
03:52 <+hyper_ch> as said, very impatient
03:52 < Varazir> hehe 
03:53 < Varazir> you have to state first where you are trying to login 
03:54 < funyun> Varazir: someone here helped me setup openvpn on my server. when i would type "openvpn --config /etc/openvpn/server.conf" my vpn would work. but now i have updated from debian lenny to squeeze and this no longer works.
03:55 -!- happylife [~happylife@212.92.145.7] has quit [Ping timeout: 258 seconds]
03:55 < Varazir> error msg ? 
03:56 <+hyper_ch> Varazir: I told him to enable logging
03:56 < funyun> Varazir: http://pastebin.com/bPtw9SpM
03:57 < Varazir> "TCP/UDP: Socket bind failed on local address [undef]:1194: Address already in use" to me it sound the service is allready running :P or somthing is running on that port
03:58 -!- happylife [~happylife@212.92.145.7] has joined #openvpn
03:59 < funyun> Varazir: when i try to connect with tunnelblick, it allows me to connect, but i can't browse the net
03:59 < Varazir> do you get a ip adress ? 
03:59 < funyun> when i try to browse?
04:00 < funyun> it just acts as if it's trying to connect
04:00 < funyun> to a webpage
04:00 < funyun> but never does
04:00 < Varazir> try to connect with tunnelblick, it allows me to connect, I guess that the client has connected to the server 
04:00 < Varazir> it should give you a new ip adress 
04:01 < funyun> okay. i'll try
04:02 < Varazir> you could try run a trace route command 
04:05 -!- funyun [~lolwhut@cpe-65-25-100-144.neo.res.rr.com] has quit [Read error: Connection reset by peer]
04:29 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
04:35 -!- darknase [darknase@p5B39BC09.dip.t-dialin.net] has joined #openvpn
04:42 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
04:46 -!- Ionic [ionic@ionic.de] has joined #openvpn
04:53 -!- pierreghz [~pierreghz@cust-169-28-111-94.dyn.as47377.net] has joined #openvpn
05:05 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
05:31 -!- dkr [~dkr@67.132.255.16] has quit [Ping timeout: 258 seconds]
05:32 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 276 seconds]
05:32 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
05:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
05:45 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
05:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:01 -!- agagag [~anton@83.167.185.34] has joined #openvpn
06:39 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
06:39 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
07:24 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:36 -!- Netsplit *.net <-> *.split quits: __nolife, nibalizer, freaky[t], sia^pwnnt, Varazir, Gnewt, MrPPS
07:36 -!- freaky[t]_ [alpha@freakyonline.de] has joined #openvpn
07:36 -!- Gnewt_ [~vector@submarine.gnewt.at] has joined #openvpn
07:36 -!- Netsplit over, joins: Varazir
07:36 -!- Netsplit over, joins: __nolife, sia^pwnnt
07:36 -!- MrPPS [~quassel@canyouget.in] has joined #openvpn
07:36 -!- MrPPS [~quassel@canyouget.in] has quit [Changing host]
07:36 -!- MrPPS [~quassel@unaffiliated/mrpps] has joined #openvpn
07:36 -!- Netsplit over, joins: nibalizer
07:43 -!- darknase [darknase@p5B39BC09.dip.t-dialin.net] has quit [Quit: I was raided by the FBI and all I got to keep was this lousy quit message!]
07:54 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:59 -!- pierreghz_ [~pierreghz@cust-103-104-111-94.dyn.as47377.net] has joined #openvpn
08:02 -!- pierreghz [~pierreghz@cust-169-28-111-94.dyn.as47377.net] has quit [Ping timeout: 248 seconds]
08:35 -!- Denial [Denial@drgi.co.uk] has quit []
08:40 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
08:51 -!- vpopov [~happylife@dyn-56-47.dzer.fttbee.kis.ru] has quit [Ping timeout: 240 seconds]
08:58 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
09:04 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
09:39 -!- STF [5fd2ee1d@gateway/web/freenode/ip.95.210.238.29] has joined #openvpn
09:40 < STF> hey guzs how to create a tun device under macosx?
09:47 -!- catsup [~d@ps38852.dreamhost.com] has quit [Ping timeout: 240 seconds]
09:50 -!- STF [5fd2ee1d@gateway/web/freenode/ip.95.210.238.29] has quit [Ping timeout: 265 seconds]
10:23 -!- vpopov [~happylife@dyn-56-47.dzer.fttbee.kis.ru] has joined #openvpn
10:32 -!- catsup [d@ps38852.dreamhost.com] has joined #openvpn
10:43 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:44 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:59 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
11:00 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has quit [Quit: ZNC - http://znc.sourceforge.net]
11:00 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Quit: У меня есть более важные дела, чем холостой здесь.]
11:06 -!- Pilif12p [~Pilif12p@techessentials.org] has joined #openvpn
11:09 -!- Pilif12p [~Pilif12p@techessentials.org] has quit [Changing host]
11:09 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
11:13 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
11:26 -!- me345 [~me345@adsl-71-131-134-78.dsl.sntc01.pacbell.net] has joined #openvpn
11:30 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
11:30 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
11:30 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:31 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:51 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:56 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:17 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:17 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:17 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:21 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
12:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:21 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:29 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
12:31 -!- pierreghz_ [~pierreghz@cust-103-104-111-94.dyn.as47377.net] has quit [Read error: Connection reset by peer]
13:05 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:05 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:05 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:05 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:07  * cron2 is back
13:07 <@cron2> (and needs lots of sleep now, and then lots of work to catch up with three weeks of non-officeness)
13:27 < reiffert> .oO Nur noch kurz die Welt retten ...
13:40 <+hyper_ch> again?
13:49 < EugeneKay> NEVAR
13:57 -!- krzie [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
13:57 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
13:58 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
13:59 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:05 < krzie> ecrist, webserver is down
14:06 <+hyper_ch> he broke it!!!!
14:13 -!- neronin [~neronin@c80-217-187-217.bredband.comhem.se] has joined #openvpn
14:14 -!- me345 [~me345@adsl-71-131-134-78.dsl.sntc01.pacbell.net] has quit [Remote host closed the connection]
14:15 < neronin> Does anyone here know if i need an openvpn client to be able to access an openvpn server, or does it work with any other vpn client as well? The reason i ask is because my android phone doesnt have an openvpn client but just androids built in one
14:22 < EugeneKay> !android
14:22 <@vpnHelper> "android" is (#1) CyanogenMod includes an integrated OpenVPN client. You will need a !p12 to load your certificates. or (#2) If you can't get CM, get root/busybox/tun and grab android-openvpn-installer + openvpn-settings from Market
14:23 < EugeneKay> OpenVPN only works with OpenVPN. It doesn't speak PPTP, IPsec, or any other stuff. It is a separate protocol.
14:23 < EugeneKay> CM has openvpn support in the vpn settings menu thingy, and it works pretty good. I'm happy with it.
14:24 < neronin> EugeneKay:  i tried those openvpn apps from the market, but i dont think the tun.ko i found is working. So i never got it to work
14:25 < neronin> and yes i know CM has it, but the rom for my phone isn't really super stable as far as i have read
14:25 < EugeneKay> What device?
14:27 < neronin> LG Optimus 2X, P990
14:27 < EugeneKay> Should work fine. That's a cyanogen-maintained device, IIRC.
14:28 < neronin> As far as I have read from people running it has few annoying issues, and im too satisfied with mine to mess it up
14:28  * EugeneKay shrugs
14:40 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
14:41 < Rienzilla> hi, would it be off topic to ask a question regarding tunnelblick here?
14:41 < Rienzilla> or is there a separate channel for it somewhere
14:41 < EugeneKay> Yes, but we don't mind. I don't know what it is, so I'll just shrug and hide under a rock, but ask away.
14:44 < Rienzilla> ok well tunnelblick is an openvpn front-end for mac osx. I'm trying to get my openvpn configurations from my windows machine to work on my mac, but they don't. The problem is that, on windows, I had multiple tun/tap adapters each with a different name, which I referenced with a dev-statement in openvpn's config file. I can't find where to name the tapdevices on osx, so the openvpn connection fails because it has no tap device. Any ideas?
14:49 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:49 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:49 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:49 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:03 < krzie> you dont need to name it
15:03 < krzie> just use dev tap
15:03 < krzie> it'll make one as needed
15:04 < krzie> and then figure out if you actually need tap, tun is better unless you have a reason to specifically need layer2 over the vpn
15:18 < Rienzilla> hehe I have had that discussion before here :-)
15:18 < Rienzilla> I use both tuns and taps. But, auto-allocating tun or tapdevices will just work?
15:21 < Rienzilla> awesome
15:21 < Rienzilla> thanks krzie 
15:21 < krzie> np
15:26 < Olipro> unless you need a protocol other than IPv4 or IPv6, you quite probably don't
15:26 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
15:32 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
16:00 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
16:00 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
16:35 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
16:54 -!- neronin [~neronin@c80-217-187-217.bredband.comhem.se] has quit [Quit: Leaving]
17:04 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
17:23 -!- JoeGazz84 is now known as JoeGazz84|Vaca
17:39 -!- Denial [Denial@drgi.co.uk] has quit []
18:12 -!- corretico [~luis@201.201.44.82] has joined #openvpn
18:25 -!- ShutterBC [~ShutterBC@146-115-73-165.c3-0.lex-ubr1.sbo-lex.ma.cable.rcn.com] has joined #openvpn
18:40 <@ecrist> krzie: working on the web server issue
18:40 <@ecrist> that box keeps hanging.
18:40 < krzie> ahh werd
18:41 < krzie> i saw you tried to reach me yesterday, related to that?
18:47 <@vpnHelper> RSS Update - forum: OpenVPN for bridging VMware Fusion OS X guest to ESX guests? <http://forums.openvpn.net/topic9232.html#p17761> || Newbie problem HELP! <http://forums.openvpn.net/topic9250.html#p17760> || Loopback-Connection <http://forums.openvpn.net/topic9251.html#p17759> || Private subnet access throught VPN client <http://forums.openvpn.net/topic9252.html#p17756> || VPN Client IP not showing up in server logs... <http://forums.openvp
19:18 -!- mgorbach [~mgorbach@pool-108-49-195-25.bstnma.fios.verizon.net] has joined #openvpn
19:32 -!- _julian [~quassel@hmbg-5f7675db.pool.mediaWays.net] has joined #openvpn
19:33 -!- _julian_ [~quassel@hmbg-5f767d4e.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
19:40 -!- datruth [datruth@gotpot.org] has joined #openvpn
19:41 < datruth> I'm running FreeBSD 8.2 trying to crontab openvpn but it seems that I can only run the command from command line otherwise I get an if_tun module not loaded
19:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
19:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:51 -!- datruth [datruth@gotpot.org] has left #openvpn []
19:55 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
19:59 -!- ravemaster [~ravemaste@119.93.51.34] has joined #openvpn
20:11 <@vpnHelper> RSS Update - forum: Newbie problem HELP! <http://forums.openvpn.net/topic9248.html#p17762>
20:20 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:32 < ravemaster> how does isp detects that such traffic is of openvpn?
20:39 < krzie> depends on the isp, no way for me to know
20:39 < krzie> (since i dont work at your isp)
20:58 < ravemaster> coz it seems that they know that my traffic is openvpn.  I was thinking if the new upcoming version will resolve this kind of problem?
21:00 -!- JoeGazz84|Vaca is now known as JoeGazz|Around
21:10 -!- ravemaster [~ravemaste@119.93.51.34] has quit []
21:29 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:38 -!- vpopov [~happylife@dyn-56-47.dzer.fttbee.kis.ru] has quit [Ping timeout: 248 seconds]
21:38 -!- ravel_exe [ravel_exe@175.143.232.104] has joined #openvpn
21:43 -!- master_of_master [~master_of@p57B55711.dip.t-dialin.net] has quit [Read error: Operation timed out]
21:47 -!- master_of_master [~master_of@p57B55FC3.dip.t-dialin.net] has joined #openvpn
21:50 -!- ShutterBC [~ShutterBC@146-115-73-165.c3-0.lex-ubr1.sbo-lex.ma.cable.rcn.com] has left #openvpn []
22:21 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
22:37 -!- ravel_exe [ravel_exe@175.143.232.104] has quit []
22:46 -!- datruth [datruth@gotpot.org] has joined #openvpn
22:47 < datruth> Question: I've been trying to connect to OpenVPN on udp 1194 but it doesn't appear that my network even see's me connecting unless I change to port 53 or move to tcp why is this?
22:59 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
22:59 -!- UnterPerro_ [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:59 -!- UnterPerro_ is now known as UnterPerro
23:39 -!- isaac_lau [3a1a584e@gateway/web/freenode/ip.58.26.88.78] has joined #openvpn
23:39 < isaac_lau> hi all
23:39 < isaac_lau> i need some help here
23:40 < isaac_lau> i having problem when i want to connect 2 site together
23:40 < isaac_lau> i have done the configuration as show in the HOW TO guide
23:40 < isaac_lau> but i still not able to connect my machine at client side back to office with client side vpn server connected
23:43 < datruth> Yo know i'd like to beable to be connected to my vpn and still connect to the office network hrmm
--- Day changed Mon Nov 21 2011
00:00 -!- isaac_lau [3a1a584e@gateway/web/freenode/ip.58.26.88.78] has quit [Ping timeout: 265 seconds]
00:28 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
01:13 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
01:13 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
01:13 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
01:22 -!- hilltop [~benste@8ta-151-119-73.telkomadsl.co.za] has joined #openvpn
01:24 < hilltop> anybody succeded bridging a vpn server into a ppp0 connection - i want to share my internet connection on ubuntu but only upon successful VPN connection
01:37 -!- hilltop [~benste@8ta-151-119-73.telkomadsl.co.za] has quit [Ping timeout: 252 seconds]
02:22 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:22 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:27 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 244 seconds]
02:27 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
02:27 -!- corretico [~luis@201.201.44.82] has quit [Read error: Operation timed out]
02:28 -!- dazo_afk is now known as dazo
02:28 -!- corretico [~luis@201.201.44.82] has joined #openvpn
02:32 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
02:36 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:37 -!- mode/#openvpn [+o mattock] by ChanServ
02:46 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 260 seconds]
02:55 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:59 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
03:11 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
03:14 -!- LumberCartel [~LumberCar@96.53.47.42] has joined #openvpn
03:22 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
03:32 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
03:33 -!- kswtch [~kswtch@riker.schizzr.de] has joined #openvpn
03:33 < kswtch> !welcome
03:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:35 -!- happylife [~happylife@212.92.145.7] has quit [Quit: So long]
03:38 -!- happylife [~happylife@212.92.145.7] has joined #openvpn
03:41 < kswtch> Hi all, how can I tell my openvpn client _not_ to overwrite my resolv.conf? I have no control over the server and I'm getting the DNS option pushed to my client. 
03:50 < LumberCartel> kswtch:  Can you run the OpenVPN client as an account that does NOT have access to update /etc/resolv.conf?
03:51 < LumberCartel> kswtch:  This web site mentions something about resolv.conf as well; I'm not sure if it will be directly helpful, but perhaps it will get you headed in the right direction:  http://www.subvs.co.uk/openvpn_resolvconf
03:52 < LumberCartel> kswtch:  See also:  http://ubuntuforums.org/showthread.php?t=1019222
03:54 < kswtch> LumberCartel: thank you. I am dropping root privileges right before the initialization sequence completes. But all settings are made at this point. I'm checking your links right now.
03:55 < LumberCartel> kswtch:  I found those by using Google to search for these keywords:  openvpn "resolv.conf"
03:55 < LumberCartel> The quotation marks are important.
04:06 <@dazo> kswtch: how do you start openvpn? command line/init.d script?  or NetworkManager?
04:06 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has quit [Ping timeout: 240 seconds]
04:06 < kswtch> LumberCartel: the first link gave me a hint how I can ignore the pushed DNS option. I'll see if I can modify the script to fit my needs. Thank you very much. (by the way: google location based search in combination with noscript doesn't yield any good search results)
04:07 < LumberCartel> kswtch:  I was hoping it would get you there.
04:07 < kswtch> dazo: I'm using a script in init.d. (Gentoo user here)
04:07 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
04:08 <@dazo> kswtch: if command line/init.d ... it should be enough to remove any --up .... ahh ... gentoo adds --up by default in init.d ... you need to modify that script to take out that --up line, or to start openvpn via rc.local (not using the init.d/openvpn) or similar approaches 
04:08 -!- Fleck [~fleck@unaffiliated/fleck] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
04:12 < kswtch> dazo: ha, I never noticed gentoo is running its own up script everytime. And it's modifying my resolv.conf! What the heck. Thanks for pointing it out. I guess I edit the gentoo script to fit my needs.
04:13 <@dazo> kswtch: there's also a config variable you can set in /etc/conf.d/openvpn ... something auto-detect client related, you might want to disable that
04:13 <@dazo> kswtch: I didn't know that myself either, until late last week where another Gentoo user asked exactly the same question
04:14 <@dazo> (it's probably the first Linux distro I've seen which does this)
04:14 <@dazo> (in init.d script, that is)
04:19 < kswtch> dazo: Problem is solved. As you suggested I looked in /etc/conf.d/openvpn and there is an entry PEER_DNS="yes". Change it to "no" and no DNS information is send to resolvconf. I'm pretty sure this option is quite new as I have used gentoo and openvpn for years now.
04:23 <@dazo> !learn gentoo as Gentoo will update /etc/resolv.conf automatically if started via /etc/init.d/openvpn. To disable this, set PEER_DNS="no" in /etc/conf.d/openvpn
04:23 <@vpnHelper> Joo got it.
04:23 <@dazo> kswtch: thx a lot!
04:23 <@dazo> !gentoo
04:23 <@vpnHelper> "gentoo" is (#1) http://gentoo.linuxhowtos.org/openvpn/openvpn.htm or (#2) Gentoo will update /etc/resolv.conf automatically if started via /etc/init.d/openvpn. To disable this, set PEER_DNS="no" in /etc/conf.d/openvpn
04:37 -!- LumberCartel [~LumberCar@96.53.47.42] has quit [Quit: RFCs the easy way -- http://www.openrfc.org/]
04:48 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
04:58 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:58 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:58 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:01 -!- andreyy [~andy@109.62.254.210] has joined #openvpn
05:06 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
05:17 -!- andreyy [~andy@109.62.254.210] has left #openvpn []
05:20 -!- andreyy [~andy@109.62.254.210] has joined #openvpn
05:41 -!- alex88 [4f1d8164@gateway/web/freenode/ip.79.29.129.100] has joined #openvpn
05:41 < alex88> hi guys, how can i set server to not push gateway to clients? for now i've only set ifconfig-pool and push "dhcp-options DNS 10.8.0.1"
05:57 < andreyy> do you mean default gw ?
06:00 < alex88> yeah
06:00 < alex88> so the vpn server won't be the gateway for clients
06:00 < alex88> i remember there was an option in client or server like "no-route" or no-pull/push don't remember now
06:03 < andreyy> route-nopull
06:07 < alex88> oh great, thank you andreyy 
06:09 < andreyy> íåçà÷òî, you are welcome
06:11 -!- ehd [u1451@gateway/web/irccloud.com/x-xadsihfdqetynmuq] has quit [Quit: Connection closed for inactivity]
06:18 -!- ravel_exe [ravel_exe@175.143.232.104] has joined #openvpn
06:57 -!- andreyy [~andy@109.62.254.210] has left #openvpn []
07:12 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:33 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
07:41 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:42 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
07:46 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
08:00 -!- rfxn [~ryanm84@69.157.150.142] has quit [Ping timeout: 240 seconds]
08:03 -!- alex88 [4f1d8164@gateway/web/freenode/ip.79.29.129.100] has quit [Ping timeout: 265 seconds]
08:08 -!- dazo is now known as X-|
08:08 -!- X-| is now known as dazo
08:17 <@vpnHelper> RSS Update - forum: [SOLVED] openvpn route add not working <http://forums.openvpn.net/topic9205.html#p17779> || VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17778> || Private subnet access throught VPN client <http://forums.openvpn.net/topic9252.html#p17774> || Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192.html#p17771> || [Debian6] Good .conf /
08:32 -!- novaflash is now known as novaflash_away
08:33 -!- novaflash_away is now known as novaflash
08:36 -!- ravel_exe [ravel_exe@175.143.232.104] has quit [Ping timeout: 260 seconds]
08:36 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
08:37 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
08:39 -!- Khas [95ff6337@gateway/web/freenode/ip.149.255.99.55] has joined #openvpn
08:40 < Khas> Hello.  I'm trying to connect to my OpenVPN server using an android phone (using CM7), but for some reason it's not working.  Not entirely sure how to go about fixing it.  The same config works on multiple desktop machines.  Can anyone help me narrow it down?
08:40 < EugeneKay> CM client or openvpn-settings?
08:41 < Khas> Haha you're here too :-P
08:41 < Khas> CM client, although I added the missing options using the command line switches
08:41 < Khas> It claims it connects initially, but then doesn't.
08:42 < EugeneKay> IIRC, there's no logs client-side with the cm client... server-side ones, please?
08:42 < EugeneKay> (it's something)
08:42 < EugeneKay> And what extra config options?
08:44 < Khas> name, server, ca cert, user cert (all wrapped up in a p12), port, proto, device, compression, redirect all set as normal.  It's lost the damned extra arguments, grr.
08:44 < Khas> Ah, that's cause I reflashed.
08:45 < EugeneKay> :-p
08:45 < Khas> I basically took a desktop config, and added as arguments the bits I couldn't set in the cm client
08:45 < EugeneKay> Which ones are those? It "just works" for me without any funky options.
08:47 < Khas> resolv-retry infinite, persistent-key, persistent-tun, I had to define the ta.key, nobind.
08:47 < Khas> I wasn't sure what settings were there as default.
08:47 < EugeneKay> Those should all work.
08:48 < Khas> As default?
08:48 < EugeneKay> I mean, they shouldn't cause problems when specified 
08:48 < EugeneKay> Try feeding the .conf into openvpn-settings.
08:48 -!- rfxn [~ryanm84@bas1-montreal54-1279375978.dsl.bell.ca] has joined #openvpn
08:49 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Quit: Leaving]
08:50 < Khas> is that an app on the market?
08:50 < EugeneKay> !android
08:50 <@vpnHelper> "android" is (#1) CyanogenMod includes an integrated OpenVPN client. You will need a !p12 to load your certificates. or (#2) If you can't get CM, get root/busybox/tun and grab android-openvpn-installer + openvpn-settings from Market
08:53 -!- novaflash is now known as novaflash_away
09:00 -!- ravel_exe [ravel_exe@175.143.232.104] has joined #openvpn
09:02 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
09:03 < Khas> Do I need to install the openvpn installer as well?  Or will it use the stuff in CM?
09:06 -!- novaflash_away is now known as novaflash
09:12 -!- Wildy [~lion@212.119.246.18] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
09:15 <@vpnHelper> RSS Update - forum: Private subnet access throught VPN client <http://forums.openvpn.net/topic9252.html#p17780>
09:18 < EugeneKay> It'll use the cm stuff
09:18 < EugeneKay> It ust does the openvpn binary and tun module.
09:23 -!- countd [~countd@unaffiliated/countd] has joined #openvpn
09:26 < Khas> it claims it's connected using openvpn-settings
09:26 < Khas> (Sorry, had to copy everything across)
09:27 < Khas> Logs show it's connected.
09:27 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has quit [Ping timeout: 244 seconds]
09:28 < Khas> Ok, so it's connected but the DNS options haven't been pushed to it
09:29 < Khas> I think it'll be better setting it up as a layer 2 instead of a layer 3.  Want to use DNS masq.
09:29 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has joined #openvpn
09:30 < EugeneKay> YOu're on your own with that :-p
09:33 -!- Khas_ [95ff6337@gateway/web/freenode/ip.149.255.99.55] has joined #openvpn
09:33 -!- Khas [95ff6337@gateway/web/freenode/ip.149.255.99.55] has quit [Ping timeout: 265 seconds]
09:34 < Khas_> Grr.
09:34 < Khas_> As I was saying, it's appending the domain to the host I'm sending to DNS, again.
09:34 < Khas_> I was sure I'd fixed that.
09:36 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has quit [Ping timeout: 255 seconds]
09:42 < Khas_> Aha
09:42 < Khas_> That requires not sending dns-option domain.
09:42 < Khas_> Yeah, layer 2 will be better I think.
09:43 -!- syoma [~syoma@200.75.4.226] has joined #openvpn
09:44 < syoma> juajuajua nice topic
09:44 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has joined #openvpn
09:44 < syoma> if possible create a invert connection
09:46 < Khas_> ?
09:48 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has quit [Ping timeout: 244 seconds]
09:48 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has joined #openvpn
09:49 -!- Khas_ [95ff6337@gateway/web/freenode/ip.149.255.99.55] has quit [Quit: Page closed]
09:51 -!- |Kai| [~Kai@94-192-233-238.zone6.bethere.co.uk] has joined #openvpn
09:53 < |Kai|> Hi, is there anybody here who can walk me through an OpenVPN install on Windows 7 64 bit please, I'm having great difficulty with it, have spent all day trying with no luck whatsoever
09:53 < |Kai|> The problem appears to be that it keeps trying to create a TAP32 interface, even when I've installed the TAP64 drivers
09:54 < |Kai|> It's the OpenVPN GUI, not the server that I'm struggling with
09:54 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
09:55 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has quit [Ping timeout: 244 seconds]
09:56 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has joined #openvpn
10:11 -!- Bartzy [~bar@82.166.200.207.fix.netvision.net.il] has joined #openvpn
10:11 < Bartzy> Hi
10:12 < Bartzy> I'm having packet loss problems inside my tunnel, using UDP and TAP
10:12 -!- codehotter [52cc0f92@gateway/web/freenode/ip.82.204.15.146] has joined #openvpn
10:12 -!- codehotter [52cc0f92@gateway/web/freenode/ip.82.204.15.146] has quit [Changing host]
10:12 -!- codehotter [52cc0f92@unaffiliated/codehotter] has joined #openvpn
10:12 -!- codehotter [52cc0f92@unaffiliated/codehotter] has quit [Changing host]
10:12 -!- codehotter [52cc0f92@gateway/web/freenode/ip.82.204.15.146] has joined #openvpn
10:13 < Bartzy> I'm getting ~15% packet loss inside the tunnel (pinging a host). Outside the tunnel (same host) - 0% packet loss.
10:13 < codehotter> Can I use openvpn to differentiate between clients? Say Alice client with certificate A should be allowed to resource X and Bob with certificate B should be allowed to both X and Y, etc?
10:14 < codehotter> !welcome
10:14 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:14 -!- ravel_exe [ravel_exe@175.143.232.104] has quit [Ping timeout: 240 seconds]
10:14 < codehotter> !goa
10:14 < codehotter> !goal
10:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:14 < codehotter> Well, I just did!
10:15 -!- progsurfer11 [~progsurfe@50-13-209-251.gar.clearwire-wmx.net] has quit [Ping timeout: 260 seconds]
10:17 < EugeneKay> Sure. 
10:17 < EugeneKay> !ccd
10:17 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
10:18 < EugeneKay> !static
10:18 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
10:18 < EugeneKay> Assign static IPs to clients using ccd, then firewall as appropriate.
10:18 < EugeneKay> codehotter 
10:18 < EugeneKay> ^
10:18  * EugeneKay spanks his enter key
10:21 < codehotter> EugeneKay: perfect!
10:21 < codehotter> OpenVPN is pretty cool.
10:22 < EugeneKay> Yurp.
10:23 -!- codehotter [52cc0f92@gateway/web/freenode/ip.82.204.15.146] has left #openvpn []
10:28 -!- vpopov [~happylife@dyn-56-47.dzer.fttbee.kis.ru] has joined #openvpn
10:28 -!- tty234 [telex@gateway/shell/anapnea.net/x-ntmeekjtkpnuwkau] has quit [Quit: leaving]
10:30 -!- tty234 [telex@gateway/shell/anapnea.net/x-sbarieizgdhckikj] has joined #openvpn
10:33 -!- tty234 [telex@gateway/shell/anapnea.net/x-sbarieizgdhckikj] has quit [Client Quit]
10:34 -!- tty234 [telex@gateway/shell/anapnea.net/x-sreczuniysywrecb] has joined #openvpn
10:34 -!- |Kai| [~Kai@94-192-233-238.zone6.bethere.co.uk] has quit [Remote host closed the connection]
10:35 -!- |Kai| [~Kai@94-192-233-238.zone6.bethere.co.uk] has joined #openvpn
10:39 -!- qubits [~zero@unaffiliated/qubits] has quit [Ping timeout: 240 seconds]
10:40 -!- qubits [~zero@ip-97-74-121-225.ip.secureserver.net] has joined #openvpn
10:43 <@vpnHelper> RSS Update - forum: OpenvpnAs and Pfsense Site-to-Site <http://forums.openvpn.net/topic9107.html#p17781>
10:47 -!- |Kai| [~Kai@94-192-233-238.zone6.bethere.co.uk] has quit [Quit: Ex-Chat]
10:48 -!- Bartzy [~bar@82.166.200.207.fix.netvision.net.il] has quit [Ping timeout: 258 seconds]
10:59 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has joined #openvpn
11:13 <@vpnHelper> RSS Update - forum: Dropped UDP fragment problem <http://forums.openvpn.net/topic9241.html#p17782>
11:33 -!- countd [~countd@unaffiliated/countd] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
11:39 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has quit [Ping timeout: 258 seconds]
11:45 -!- dazo is now known as dazo_afk
12:00 -!- countd [~countd@unaffiliated/countd] has joined #openvpn
12:03 -!- countd [~countd@unaffiliated/countd] has quit [Client Quit]
12:05 -!- syoma [~syoma@200.75.4.226] has quit [Quit: leaving]
12:13 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has joined #openvpn
12:13 -!- bar__ is now known as Bartzy
12:13 < Bartzy> Hi
12:13 < Bartzy> Hi,
12:14 < Bartzy> anyone answered my question about the packet loss ? :|
12:14 < Bartzy> I was disconnected
12:17 < reiffert> Bartzy: no answer yet.
12:18 < Bartzy> reiffert: OK, thanks
12:21 -!- guntha [~guntha_@pool-74-102-8-168.nwrknj.fios.verizon.net] has joined #openvpn
12:27 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:27 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:27 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:35 <@ecrist> I didn't see a question...
12:36 <@ecrist> I saw two statements
12:40 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 244 seconds]
12:49 < Bartzy> ecrist: I have a 10-15% packet loss with UDP on port 443
12:49 < Bartzy> with TCP on port 443, I have no packet loss, but the RTT is much higher (inside the tunnel).. around 600ms average instead of 250ms in UDP.
12:50 < EugeneKay> Sounds like your connection is dropping packets like hot cakes.
12:50 < Bartzy> EugeneKay: When I ping the vpn gateway external IP, no packet loss.
12:51 < EugeneKay> Ping uses small packets by efault. Crank it up to 1400 bytes and let it run for 5 min.
12:51 < Bartzy> but I ping the tunnel anyway
12:52 < Bartzy> so it's small packets inside the tunnel too
12:52 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
12:53 < Bartzy> EugeneKay: Just ran 500 packets of 1400 bytes to the external public IP of the vpn gateway
12:53 < Bartzy> from my connection.. no packet loss at all. My connection seems fine.
12:54 <@ecrist> Bartzy: do you know what the difference between TCP and UDP is?
12:55 <@ecrist> when you switch to TCP, you stop seeing packet loss inside the tunnel because TCP on the tunnel itself ensures every packets makes it
12:55 < Bartzy> ecrist: UDP is connection-less, TCP isn't, TCP needs confirmation for packets 
12:55 < Bartzy> OK
12:55 < Bartzy> but the RTT times are much much higher
12:55 < Bartzy> sometimes >1 second
12:55 <@ecrist> on a lossy connection, your latency will go up because the VPN has to resend dropped packets
12:55 <@ecrist> all you're doing by switching to TCP is trading one problem for another.
12:55 < Bartzy> ecrist: But my connection isn't lossy.
12:56 <@ecrist> talk to your ISP and find out WHY you're dropping packets
12:56 <@ecrist> Bartzy: apparently it is
12:56 <@ecrist> !tcp
12:56 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
12:56 < EugeneKay> Something is dropping the packets.
12:56 < Bartzy> ecrist: I just tried pinging big ICMP packets to the public IP of the openvpn gateway, no packet loss at all.
12:56 <@ecrist> talk to your ISP
12:56 <@ecrist> openvpn isn't dropping your packets
12:56 < EugeneKay> ICMP != UDP
12:56 <@ecrist> something in the middle is, though.
12:56 < Bartzy> ecrist: My ISP won't help me. no other way around it ?
12:57 <@ecrist> figure it out
12:57 <@ecrist> we aren't magical packet-loss fairies.
12:57 < EugeneKay> Get a better ISP.
12:59 < Bartzy> OK - I have another question.
12:59 < Bartzy> is there anyway to improve RTT times in general ?
13:00 < Bartzy> and the 2nd question - Connect times should be 10-15 seconds ?
13:01 < Bartzy> and if my connection IS lossy - isn't TCP is better (slower overall connection, but at least works) ?
13:01 <@ecrist> 12:57:14 < EugeneKay> Get a better ISP.
13:02 <@ecrist> Bartzy: yes, if UDP proves unusable, go to TCP
13:02 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 248 seconds]
13:02 < Bartzy> ecrist: Actually, the TCP connections inside the tunnel (such as SSH or whatever) will ensure reachability...
13:03 <@ecrist> thanks for the lesson captain network guy
13:05 < Bartzy> no problem Mr. ironic :)
13:05 < Bartzy> Thanks for the help. I'll call the ISP and hear them tell me they don't know what UDP is
13:05 < Bartzy> :)
13:06 < Bartzy> But at least it's good to know it's not going to be a problem for all the employess
13:06 < Bartzy> ecrist: Should I use tun-mtu 1500 and mssfix 1400 when using UDP ?
13:08 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
13:08 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:08 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
13:10 < Bartzy> EugeneKay: Indeed ICMP != UDP, but what can I tell my ISP? That? Can't I try some "UDP ping" before I call them, to see if this is really a UDP issue?
13:11 < EugeneKay> Nothing, they're idiots.
13:11 < EugeneKay> You're screwed.
13:11 < EugeneKay> But you already knew this.... so why are you asking us?
13:15 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
13:15 -!- mode/#openvpn [+o vpnHelper] by ChanServ
13:15 <@vpnHelper> RSS Update - forum: openssl.cnf not found in easy-rsa/2.0 <http://forums.openvpn.net/topic8819.html#p17783>
13:20 < Bartzy> EugeneKay: There's no UDP ping utility to test ?
13:21 < EugeneKay> I don't believe so, but its trivial to set up a test app.... like OpenVPN ;-)
13:22 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
13:26 -!- mgorbach [~mgorbach@pool-108-49-195-25.bstnma.fios.verizon.net] has quit [Remote host closed the connection]
13:27 -!- mgorbach [~mgorbach@pool-108-49-195-25.bstnma.fios.verizon.net] has joined #openvpn
13:34 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:45 -!- _julian_ [~quassel@hmbg-5f763188.pool.mediaWays.net] has joined #openvpn
13:45 -!- _julian [~quassel@hmbg-5f7675db.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
13:47 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
13:48 -!- luptenschteiner [~User@unaffiliated/probonono] has joined #openvpn
13:49 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 244 seconds]
14:12 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
14:19 < Bartzy> ecrist, EugeneKay: Maybe you have an answer to my question about tun-mtu 1500 and mssfix 1400 ? Is it a good idea to use these values ?
14:22 < reiffert> traceroute uses udp btw
14:23 < krzee> umm
14:23 < krzee> traceroute uses icmp
14:23 < reiffert> traceroute uses udp
14:24 < reiffert> (to be honest, it can be run using both)
14:24  * hyper_ch thought traceroute uses magic
14:24 < krzee> real traceroute uses butterfly wings
14:24 < reiffert> hyper_ch thinks that he can think.
14:25 < krzee> http://xkcd.com/378/
14:25 <@vpnHelper> Title: xkcd: Real Programmers (at xkcd.com)
14:25 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
14:25 <+hyper_ch> sufficiently advanced technology is indistinguishable from magic
14:25 < reiffert> krzee: wanna overtake my server at www.hetzner.de saving 150 EUR setup costs?
14:25 < krzee> nah i can only use usa servers right now
14:25 < krzee> thanks tho
14:26 < reiffert> k
14:26 <@ecrist> !mtu
14:26 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
14:26 <+hyper_ch> reiffert: which server?
14:26 <@ecrist> reiffert: which server?
14:27 <@ecrist> why you getting rid of it?
14:27 <+hyper_ch> ecrist: he's got a bigger server now
14:27 <@ecrist> ah
14:27 <+hyper_ch> (me just says things without having a clue)
14:27 < reiffert> hyper_ch: EQ4, model name	: Intel(R) Core(TM) i7 CPU         920  @ 2.67GHz
14:27 < reiffert> 2 x 750GB HDD, 8GB RAM
14:27 <+hyper_ch> how much monthly?
14:28 < reiffert> 49 EUR
14:28 <+hyper_ch> I have an ancient server at hetzner
14:28 <+hyper_ch> I could switch it over
14:28 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
14:28 <+hyper_ch> ecrist: you want it?
14:28 <@ecrist> nah
14:28 <@ecrist> I have been looking for a new home for my stuff, though.
14:29 <+hyper_ch> reiffert: when will it be available?
14:30 <+hyper_ch> ecrist: hetzner provides good service
14:30 < reiffert> hyper_ch: november 30th
14:30 <+hyper_ch> too little time for me
14:30 < reiffert> k
14:31 <@vpnHelper> RSS Update - forum: Dropped UDP fragment problem <http://forums.openvpn.net/topic9241.html#p17785> || VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17784>
14:31 < reiffert> you could switch over afterwards anyway.
14:32 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Remote host closed the connection]
14:32 <+hyper_ch> what do you mean?
14:32 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
14:32 <+hyper_ch> I know what you mean
14:33 <+hyper_ch> I just don't really have the time at the moment :(
14:33 < reiffert> hyper_ch: take my server, and do whatever you want to do. e.g. migrate your system to the new system in march 2012.
14:34 <+hyper_ch> I'll do it some other time :)
14:35 -!- Varazir [mircwars@c-94-255-163-169.cust.bredband2.com] has quit [Quit: Reconnecting]
14:35 -!- Varazir [mircwars@c-94-255-163-169.cust.bredband2.com] has joined #openvpn
14:36 <+hyper_ch> reiffert: http://www.kanzlei-blaufelder.com/herzlichen-gluckwunsch-sie-haben-17-300-euro-gewonnen/
14:36 <@vpnHelper> Title: Herzlichen Glückwunsch! Sie haben 17.300 Euro gewonnen! - Kanzlei Blaufelder (at www.kanzlei-blaufelder.com)
14:39 -!- vpopov [~happylife@dyn-56-47.dzer.fttbee.kis.ru] has quit [Ping timeout: 276 seconds]
14:42 < reiffert> hyper_ch: herzlichen glueckwunsch, sie haben nix gewonnen!
14:42 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 245 seconds]
14:42 <+hyper_ch> reiffert: court came to a different conclusion :)
14:43 <@vpnHelper> RSS Update - forum: Setting Up A Router <http://forums.openvpn.net/topic7199.html#p17787> || Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192-15.html#p17786>
14:48 -!- Ionic [ionic@ionic.de] has quit [Excess Flood]
14:53 -!- Ionic [ionic@ionic.de] has joined #openvpn
14:57 -!- _julian [~quassel@hmbg-4d068a47.pool.mediaWays.net] has joined #openvpn
14:59 -!- _julian_ [~quassel@hmbg-5f763188.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
15:05 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
15:05 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
15:05 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
15:25 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Quit: Leaving.]
15:25 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
15:30 -!- _julian_ [~quassel@hmbg-4d06b9db.pool.mediaWays.net] has joined #openvpn
15:32 -!- _julian [~quassel@hmbg-4d068a47.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
15:56 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Changing host]
15:56 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
16:01 -!- qubits [~zero@ip-97-74-121-225.ip.secureserver.net] has quit [Changing host]
16:01 -!- qubits [~zero@unaffiliated/qubits] has joined #openvpn
16:04 -!- _julian_ [~quassel@hmbg-4d06b9db.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
16:08 -!- _julian [~quassel@hmbg-4d06c122.pool.mediaWays.net] has joined #openvpn
16:15 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 245 seconds]
16:15 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:19 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
16:20 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 276 seconds]
16:20 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
16:29 -!- Gravitron [~admin@64.93.224.32] has joined #openvpn
16:29 -!- Gravitron [~admin@64.93.224.32] has quit [Changing host]
16:29 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:31 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 244 seconds]
16:32 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
16:33 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 258 seconds]
16:34 -!- Gravitro_ [~admin@69.163.40.45] has quit [Client Quit]
16:43 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:45 <@vpnHelper> RSS Update - forum: Dropped UDP fragment problem <http://forums.openvpn.net/topic9241.html#p17788>
16:46 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
16:48 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 260 seconds]
16:49 -!- asoryan [~ryanm84@bas1-montreal54-1279375978.dsl.bell.ca] has joined #openvpn
16:49 -!- rfxn [~ryanm84@bas1-montreal54-1279375978.dsl.bell.ca] has quit [Read error: Connection reset by peer]
16:53 < datruth> !udp
16:53 < datruth> !proto
16:57 -!- mgorbachlaptop [~mgorbach@pool-108-49-195-25.bstnma.fios.verizon.net] has joined #openvpn
17:01 -!- mgorbach [~mgorbach@pool-108-49-195-25.bstnma.fios.verizon.net] has quit [Ping timeout: 276 seconds]
17:02 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
17:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
17:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:16 -!- JoeGazz|Around is now known as JG84|Food
17:25 <@vpnHelper> RSS Update - forum: Private subnet access throught VPN client <http://forums.openvpn.net/topic9252.html#p17789>
17:31 -!- asoryan [~ryanm84@bas1-montreal54-1279375978.dsl.bell.ca] has quit [Read error: Connection reset by peer]
17:31 -!- asoryanm [~ryanm84@bas1-montreal54-1279375978.dsl.bell.ca] has joined #openvpn
17:33 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
17:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
17:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:49 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
18:09 -!- neronin [~neronin@c80-217-187-217.bredband.comhem.se] has joined #openvpn
18:11 < neronin> Hi all. I'm having an issue with connecting to the internet through my vpn server and cant figure out how to solve it. Both server and client is on the same LAN, behind the same router. I can connect to the server just fine and get a 10.8.0.* IP. But I cant get through to the internet. Do i have to do something with IPTables?
18:13 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192-15.html#p17790>
18:15 -!- _julian_ [~quassel@hmbg-4d06a26d.pool.mediaWays.net] has joined #openvpn
18:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.2]
18:17 -!- _julian [~quassel@hmbg-4d06c122.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
18:25 <@vpnHelper> RSS Update - forum: Redirect active connections to a OpenVPn tunnel <http://forums.openvpn.net/topic9206.html#p17791>
18:32 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:35 -!- neronin [~neronin@c80-217-187-217.bredband.comhem.se] has quit [Ping timeout: 260 seconds]
18:54 -!- Denial [Denial@drgi.co.uk] has quit []
18:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:10 -!- _julian [~quassel@hmbg-5f77d9fe.pool.mediaWays.net] has joined #openvpn
19:11 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:11 -!- _julian_ [~quassel@hmbg-4d06a26d.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
19:43 -!- JG84|Food is now known as JG84|Around-ish
19:43 -!- JG84|Around-ish is now known as JG84|Around|ish
19:43 -!- JG84|Around|ish is now known as JG84|Around-ish
19:49 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17792>
20:19 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
20:45 -!- luptenschteiner is now known as probonono
20:58 -!- JG84|Around-ish is now known as JG84|Sleep
21:02 <@vpnHelper> RSS Update - forum: creating and revoking certificates for clients <http://forums.openvpn.net/topic9253.html#p17793>
21:11 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:12 -!- _julian [~quassel@hmbg-5f77d9fe.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
21:13 -!- _julian [~quassel@hmbg-5f77f550.pool.mediaWays.net] has joined #openvpn
21:20 -!- _julian_ [~quassel@hmbg-5f7646e1.pool.mediaWays.net] has joined #openvpn
21:22 -!- _julian [~quassel@hmbg-5f77f550.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
21:24 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:35 -!- mgorbachlaptop [~mgorbach@pool-108-49-195-25.bstnma.fios.verizon.net] has quit [Quit: Leaving...]
21:45 -!- _julian_ [~quassel@hmbg-5f7646e1.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
21:45 -!- master_of_master [~master_of@p57B55FC3.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
21:47 -!- master_of_master [~master_of@p57B55A84.dip.t-dialin.net] has joined #openvpn
21:48 -!- _julian [~quassel@hmbg-5f765051.pool.mediaWays.net] has joined #openvpn
22:01 -!- _julian [~quassel@hmbg-5f765051.pool.mediaWays.net] has quit [Read error: Operation timed out]
22:02 -!- _julian [~quassel@hmbg-5f77fe21.pool.mediaWays.net] has joined #openvpn
22:09 -!- isaac_lau [cabc6095@gateway/web/freenode/ip.202.188.96.149] has joined #openvpn
22:11 < isaac_lau> hi i have 1 issues here, my openvpn connected but my pc disconnected from the intranet, but still can access internet, juz cannot access others pc on the network, which configuration have been wrongly configurated?
22:14 <@vpnHelper> RSS Update - forum: Setting Up A Router <http://forums.openvpn.net/topic7199.html#p17794>
22:19 < isaac_lau> anyone can help me?
22:33 -!- ssfdre38 [~admin@unaffiliated/ssfdre38] has joined #openvpn
22:34 < ssfdre38> for the client end, on linux, do they need to install openvpn deamon to get client access or no?
22:39 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
22:40 < isaac_lau> anyone here? i need some help here
23:09 < datruth> isaac_lau: you should add routes to connect back to your lan connected pc's
23:10 < datruth> ssfdre38: yes they'll need to openvpn deamon
23:21 < isaac_lau> datruth u means from router?
23:26 < ssfdre38> datruth, is there a GUI for all platforms
23:27 < datruth> idk
23:27 < isaac_lau> hi datruth, where should i add routes to connect back to my lan connected pc?
23:28 < datruth> isaac_lau: is that vpn on your lan or on a remote site?
23:30 < isaac_lau> i have 2 site now, 1 is my office site, another is my client site, i want to connect whole network from my client back to my office
23:31 < isaac_lau> but biw when my client vpn server conneted to the openvpn it connection with my client network disconnected
23:31 < isaac_lau> *now
23:32 < datruth> With the multiple sites you have maybe you might want to work on the routing side of things then place openvpn somewhere on the network and allow it to connect to different parts of the network
23:34 < isaac_lau> hmm..i have setup a router at my client side, but once the vpn server connected to the openvpn the connection to router disconnected as well, i cant even ping to my router
23:35 < isaac_lau> it is coz by my setting for open vpn?
23:39 < datruth> isaac_lau: pastebin your openvpn settings
23:39 < Pilif12p> hi. where are the client logs stored at?
23:40 < isaac_lau> how to paste all here?
23:40 < datruth> Pilif12p: /var/log perhaps
23:40 < datruth> isaac_lau: use pastebin.com
23:40 < Pilif12p> datruth: I didn't see it in there.
23:41 < Pilif12p> nope, nothing in there
23:41 < Pilif12p> about VPN, at least.
23:41 < datruth> Pilif12p: perhaps your conf file is logging it else where
23:42 < Pilif12p> datruth: it is not
23:42 < Pilif12p> oh, now I remember what I did
23:42 < Pilif12p> connect via cli, and print it to a file
23:43 < isaac_lau> datruth http://pastebin.com/ej1tewnB
23:43 < datruth> isaac_lau: remove your routes
23:43 < datruth> all of the 192* stuff 
23:43 < datruth> and try again
23:43 < datruth> :>
23:44 < isaac_lau> u means ->route 192.168.1.0 255.255.255.0 this?
23:44 < datruth> yes anything with 192* remove it
23:44 < datruth> you run this on windows?
23:45 < isaac_lau> yes
23:45 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
23:45 < datruth> interesting didn't know they had a vpn for windows
23:45 < datruth> vpn server that is
23:46 < Pilif12p> http://pastebin.mozilla.org/1387055 <-- my error log
23:50 < isaac_lau> datruth issues solved..but other machine on my client side cannot connect to the office side..:(
23:50 < datruth> Pilif12p: you using the verify-cn script?
23:50 < datruth> isaac_lau: then perhaps they need to connect to the vpn?
23:51 < Pilif12p> datruth: is that installed with openvpn?
23:51 < isaac_lau> coz i thking to route all just through a vpn server..:(
23:51 < datruth> Pilif12p: I think it ships with openvpn as a sample script what  does your config look like?
23:52 < datruth> isaac_lau: if you said problem solved?
23:52 < Pilif12p> client or server?
23:52 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
23:52 < datruth> Pilif12p: server
23:52  * datruth wishes he could connect over udp traffic
23:53 < isaac_lau> now when connected to openvpn my vpnserver can still ping the router and intranet..but..i cannot connect other machine on my client network to office
23:53 < Pilif12p> datruth: http://pastebin.mozilla.org/1387056
23:54 < datruth> isaac_lau: so lets forget about your other machines for a second can you access everything via vpn?
23:55 < datruth> Pilif12p: lol
23:55 < datruth> not really much configuring
23:55 < Pilif12p> datruth: I should probably make one that's not from a template, shouldn't I?
23:55 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
23:55 < datruth> Pilif12p: would be nice what about your client conf?
23:56 < isaac_lau> yes i can
23:56 < Pilif12p> datruth: it's uh, not much different than the template :P
23:56 < datruth> I bet
23:56 -!- SOG [~SOG@113.108.118.58] has quit [Client Quit]
23:57 < datruth> isaac_lau: ok so now do your other clients connect to the vpnserver as well?>
23:57 < Pilif12p> i actually just followed Linode's guide.
23:58 < isaac_lau> nope
23:58 < datruth> isaac_lau: then thats your problem then?
23:58 < isaac_lau> coz my idea is to connect juz vpn server and route all client to connect it 
23:59 < datruth> isaac_lau: every client has their own routing table
23:59 < datruth> isaac_lau: if your going to be lazy about it just enable a cert and duplicate-cn and they can all connect via one cert at the same time (<--- BAD IDEA)
--- Day changed Tue Nov 22 2011
00:01 < datruth> isaac_lau: if you just want to access the office etc from any of your client pc's then install the same cert to all pc's and just use it when your own the pc
00:01 < isaac_lau> hmm..let me thk of it, coz if using same cert i dun thk is a gud idea
00:01  * datruth prepares for bed
00:02 < datruth> isaac_lau: no its not
00:02 < datruth> isaac_lau: why do your client pc's need access to the office?
00:02 < isaac_lau> coz actually we have HQ and also the estate side
00:02 < isaac_lau> estate side represent the client 
00:03 < isaac_lau> and we got do some file sharing etc
00:04 < datruth> I guess if all else fails you can hire an admin... I'm available atm.
00:05 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
00:05 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
00:05 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:12 < datruth> speaking of hiring someone I need to find a web dev
00:14 < Pilif12p> now it seems I can connect
00:14 < Pilif12p> but my IP doesn't change, nor can I access internal IP addresses
00:15 < Pilif12p> oh, Tue Nov 22 00:13:30 2011 us=676845 TLS Error: TLS handshake failed
00:16 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:18 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
00:18 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
00:18 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:18 < datruth> gn folks
00:19 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:22 -!- _julian [~quassel@hmbg-5f77fe21.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
00:23 -!- _julian [~quassel@hmbg-4d069ced.pool.mediaWays.net] has joined #openvpn
00:27 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:29 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:29 <@vpnHelper> RSS Update - forum: openvpn stops working after a server reboot <http://forums.openvpn.net/topic9254.html>
00:36 -!- isaac_lau [cabc6095@gateway/web/freenode/ip.202.188.96.149] has quit [Ping timeout: 265 seconds]
01:04 -!- eahm [~irc@ip98-165-171-4.ph.ph.cox.net] has joined #openvpn
01:05 -!- eahm [~irc@ip98-165-171-4.ph.ph.cox.net] has quit [Remote host closed the connection]
01:05 -!- _julian_ [~quassel@hmbg-4d068e5e.pool.mediaWays.net] has joined #openvpn
01:08 -!- _julian [~quassel@hmbg-4d069ced.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
01:11 <@vpnHelper> RSS Update - forum: New Win2k8 R2 OpenVPN Server fails - Tap 32 <http://forums.openvpn.net/topic9226.html#p17796>
01:17 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192-15.html#p17797>
01:21 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:25 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:35 -!- neronin [~neronin@c80-217-187-217.bredband.comhem.se] has joined #openvpn
01:36 < neronin> Hi all. I'm having an issue with connecting to the internet through my vpn server and cant figure out how to solve it. Both server and client is on the same LAN, behind the same router. I can connect to the server just fine and get a 10.8.0.* IP. But I cant get through to the internet. Do i have to do something with IPTables oe is there a simple setting in the conf file?
01:37 -!- Isaac__ [3c35e27b@gateway/web/freenode/ip.60.53.226.123] has joined #openvpn
01:38 < Isaac__> hi, is there anyone knoe why i only can ping the OpenVPN ip but not the server IP? e.g i can only ping 10.8.0.x but not 192.168.0.x
01:50 -!- neronin [~neronin@c80-217-187-217.bredband.comhem.se] has quit [Ping timeout: 244 seconds]
02:06 -!- neronin [~neronin@m80-170-68-172.cust.tele2.se] has joined #openvpn
02:21 -!- chokesmaster [~chokesmas@bas5-sherbrooke40-1096584421.dsl.bell.ca] has quit [Ping timeout: 244 seconds]
02:30 <@vpnHelper> RSS Update - forum: Private subnet access throught VPN client <http://forums.openvpn.net/topic9252.html#p17798>
02:33 -!- ssfdre38 [~admin@unaffiliated/ssfdre38] has quit [Quit: Leaving]
02:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:35 < neronin> I actually solved my above issue myself, I found the following guide: http://library.linode.com/networking/openvpn/debian-5-lenny
02:35 <@vpnHelper> Title: Secure Communications with OpenVPN on Debian 5 (Lenny) – Linode Library (at library.linode.com)
02:41 -!- neronin [~neronin@m80-170-68-172.cust.tele2.se] has quit [Ping timeout: 245 seconds]
02:47 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
02:48 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
02:55 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
03:03 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:03 -!- Isaac__ [3c35e27b@gateway/web/freenode/ip.60.53.226.123] has quit [Quit: Page closed]
03:05 -!- Bartzy [~bar@82.166.200.207.fix.netvision.net.il] has quit [Ping timeout: 258 seconds]
03:06 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has joined #openvpn
03:31 -!- imdea [~joel@193.145.14.94] has joined #openvpn
03:32 < imdea> Hi how do i do so that when i type: /etc/init.d/openvpn start (in my client) it automatically connects with the server and authenticates against him?
03:59 -!- imdea [~joel@193.145.14.94] has quit [Ping timeout: 244 seconds]
04:01 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
04:12 -!- imdea [~joel@193.145.14.94] has joined #openvpn
04:15 <@vpnHelper> RSS Update - forum: Hide Real IP port:80 <http://forums.openvpn.net/topic9255.html>
04:24 -!- imdea [~joel@193.145.14.94] has quit [Quit: Saliendo]
04:24 -!- kralor [~kralor@hackincorp.net] has left #openvpn []
04:30 -!- sarah_rose [~sarah_ros@app23.chatmosphere.org] has joined #openvpn
04:31 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
04:32 -!- sarah_rose [~sarah_ros@app23.chatmosphere.org] has quit [Client Quit]
04:56 -!- helena381 [~helena@212-123-181-26.ip.telfort.nl] has joined #openvpn
04:57 < helena381> hello
05:03 -!- happylife [~happylife@212.92.145.7] has quit [Quit: So long]
05:05 -!- helena381 [~helena@212-123-181-26.ip.telfort.nl] has quit [Quit: IRC webchat at http://irc2go.com/]
05:14 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
05:14 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
05:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:21 <@vpnHelper> RSS Update - forum: Problem with resolvconf <http://forums.openvpn.net/topic9256.html>
05:43 -!- Diffen [~diffen@80.78.212.242] has joined #openvpn
05:50 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 244 seconds]
05:55 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has left #openvpn []
05:58 -!- Diffen [~diffen@80.78.212.242] has quit [Quit: This computer has gone to sleep]
06:04 -!- dazo_afk is now known as dazo
06:30 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:34 -!- Diffen [~diffen@80.78.212.242] has joined #openvpn
06:51 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192-15.html#p17801>
06:59 -!- mechbangirc [~mechbangi@mbl-65-157-196.dsl.net.pk] has joined #openvpn
07:04 < mechbangirc> I am a noob in openvpn/vpn. Situation: Around 10 clients need to connect to a company server dedicated for VPN both clients and server are behind NAT. Server has FQDN via dyndns. Clients should be able to connect to other servers @ company LAN but not whole LAN should be accessible. There is no need for clients to reach each other over VPN. Clients have their own separate networks. I figured out that I should setup TAP devices on server
07:04 < mechbangirc>  and clients. I am not interested in DHCP. Clients can have static IP. I am indifferent about static key or certificates.  Could anyone please point me in right direction about where to find server/client configuration. Thanks
07:09 -!- eworm [~eworm@mail.bildungscentrum.de] has joined #openvpn
07:09 < eworm> Hey everybody!
07:10 < eworm> I'm running openvpn from git.
07:11 < eworm> I just noticed that scripts (at least route-up) is run from working directory /, so I have to give absolute pathes in the config.
07:11 < eworm> Is this intentional?
07:15 <@ecrist> yes
07:19 < eworm> so if I want relative pathes I have to set "script-security 2 system"?
07:20 < eworm> I don't like absolute pathes in my config...
07:20 < mechbangirc> I figured out I need ethernet bridging
07:23 -!- countd [~countd@unaffiliated/countd] has joined #openvpn
07:30 < eworm> uh, it's a problem of how openvpn is launched...
07:30 -!- eworm [~eworm@mail.bildungscentrum.de] has quit [Quit: leaving]
07:33 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 258 seconds]
07:33 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has joined #openvpn
07:34 -!- mechbangirc [~mechbangi@mbl-65-157-196.dsl.net.pk] has quit [Quit: Leaving]
07:38 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
07:38 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
07:38 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
07:39 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:54 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:09 -!- _julian [~quassel@hmbg-5f77c98c.pool.mediaWays.net] has joined #openvpn
08:09 -!- _julian_ [~quassel@hmbg-4d068e5e.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
08:10 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
08:11 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
08:22 -!- _julian_ [~quassel@hmbg-4d06a3ae.pool.mediaWays.net] has joined #openvpn
08:25 -!- _julian [~quassel@hmbg-5f77c98c.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
08:32 <@vpnHelper> RSS Update - forum: Problem with resolvconf <http://forums.openvpn.net/topic9256.html#p17802>
08:34 -!- mgorbach [~mgorbach@pool-108-49-195-25.bstnma.fios.verizon.net] has joined #openvpn
08:39 -!- Diffen [~diffen@80.78.212.242] has quit [Quit: This computer has gone to sleep]
08:42 -!- Axeman [~Axeman3@198.105.46.22] has joined #openvpn
08:42 -!- Axeman [~Axeman3@198.105.46.22] has quit [Changing host]
08:42 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:42 -!- mode/#openvpn [+v Axeman] by ChanServ
08:55 -!- _julian [~quassel@hmbg-4d06c26d.pool.mediaWays.net] has joined #openvpn
08:56 -!- _julian_ [~quassel@hmbg-4d06a3ae.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
08:59 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:59 -!- mgorbach [~mgorbach@pool-108-49-195-25.bstnma.fios.verizon.net] has quit [Quit: Leaving...]
09:07 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 240 seconds]
09:13 -!- vadimq_ [~vadim@76.Red-80-32-164.staticIP.rima-tde.net] has joined #openvpn
09:13 < vadimq_> hi, what's the setting for the connection timeout on UDP? I only found a TCP one
09:15 < EugeneKay> See the man page on --keepalive
09:16 -!- isaac1 [b63e8c60@gateway/web/freenode/ip.182.62.140.96] has joined #openvpn
09:17 -!- asoryanm [~ryanm84@bas1-montreal54-1279375978.dsl.bell.ca] has quit [Ping timeout: 248 seconds]
09:18 <@vpnHelper> RSS Update - forum: Private subnet access throught VPN client <http://forums.openvpn.net/topic9252.html#p17803>
09:24 < vadimq_> EugeneKay: doesn't seem to work. I tried keepalive 10 60, 5 minutes later, openvpn still doesn't say anything when trying to connect to an address that doesn't answer
09:24 <@vpnHelper> RSS Update - forum: OpenVPN single sign-in script for multi-server VPN service <http://forums.openvpn.net/topic8966.html#p17804>
09:24 -!- Diffen [~diffen@80.78.212.242] has joined #openvpn
09:31 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
09:35 -!- isaac1 [b63e8c60@gateway/web/freenode/ip.182.62.140.96] has quit [Quit: Page closed]
09:36 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has quit [Read error: Operation timed out]
09:39 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has joined #openvpn
09:50 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:11 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has quit [Ping timeout: 240 seconds]
10:16 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has joined #openvpn
10:16 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
10:28 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has quit [Ping timeout: 276 seconds]
10:30 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has joined #openvpn
10:35 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:38 -!- Diffen [~diffen@80.78.212.242] has quit [Quit: This computer has gone to sleep]
10:48 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
11:05 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
11:05 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
11:06 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
11:37 -!- ravel_exe [ravel_exe@175.143.232.104] has joined #openvpn
11:48 -!- ben__ [~chatzilla@212.172.205.133] has joined #openvpn
11:51 -!- _julian [~quassel@hmbg-4d06c26d.pool.mediaWays.net] has quit [Read error: Operation timed out]
11:52 -!- _julian [~quassel@hmbg-5f7618fb.pool.mediaWays.net] has joined #openvpn
11:52 < ben__> Hi, I've setup a net to net VPN using openvpn 2.1.3 on both sides, when I try to ping the computers on the other side I don't get a reply, tcpdump tells me that the packets arrive but they don't get routed, I did a "echo 1 > /proc/sys/net/ipv4/ip_forward" on both sides. any Idea what's wrong?
11:54 < ben__> server config: http://pastebin.com/0gav8vGa output of /etc/openvpn/ccd/ben_w510_laptop is http://pastebin.com/BYsM7JPw and client config: http://pastebin.com/fq6Yq2tv
11:59 < pwrcycle> ben__: did you add: -A FORWARD -s 10.8.0.0/24 -j ACCEPT   && -A INPUT -i tun0 -j ACCEPT to iptables?
12:00 < pwrcycle> ben__: like the /topic says, the problem is your firewall, really :)
12:04 < ben__> pwrcycle: what network would 10.8.0.0/24 would be for me? the "transfernet" that I use 172.28.0.0/24
12:06 < ben__> pwrcycle: I've tryed that and it didn't help, see iptables -L here: http://pastebin.com/KUwV7gYY
12:07 < pwrcycle> ben__: 10.8.0.0/24 is the block used in the howto, so yeah, use whatever block you chose to set..
12:09 < pwrcycle> ben__: iptables is much easier to read from the flat file than from the running printout.
12:09 < pwrcycle> be	i suggest you iptablessave and work from that, but up to you..
12:10 < pwrcycle> ben__: and you don't have an ACCEPT from the tun0 interface: -A INPUT -i tun0 -j ACCEPT
12:10 < pwrcycle> tcpdump on tun0 and see if you see your pings there, then tcpdump on your eth0 and see if you seee them routed past iptables.
12:12 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has joined #openvpn
12:12 -!- dazo is now known as dazo_afk
12:14 < pwrcycle> ben__: you should probably have these two lines also: -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT && -A INPUT -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT
12:14 < ben__> pwrcycle: I chanced the "transfernet" to 10.8.0.0/24 and added the iptables rules, when I listen on tun0 I see the ping but when I listen to the interface they should be routed at I see nothing
12:15 < pwrcycle> ben__: ok, so your vpn is setup correctly, you just need to get your forwarding and iptables rules correct.
12:15 < ben__> yes, I know that it's not really a OpenVPN Issue
12:15 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has quit [Ping timeout: 240 seconds]
12:16 < ben__> pwrcycle: I really appreciate your help and patience
12:16 < pwrcycle> ben__: everything i know came from the howto, re-read it. all you need is there.
12:16 < ben__> pwrcycle: Alrigth, thanks
12:16 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has joined #openvpn
12:18 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
12:23 -!- mape2k [~mape2k@2001:6f8:133b:0:21f:3bff:fe27:21a9] has quit [Quit: Leaving]
12:23 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has quit [Quit: AAAGH!  IT BURNS!]
12:29 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has quit [Ping timeout: 260 seconds]
12:31 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
12:31 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
12:33 < EugeneKay> !howto
12:33 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:33 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has joined #openvpn
12:33 -!- grendal-prime [~sgraham@2001:470:822a:205:226:c7ff:fecd:a1e2] has joined #openvpn
12:34 < grendal-prime> heyguys...i got some people that are stating that after they upgrade their windows clients to openvpn 2.14 they can no longer rdp into that box?
12:48 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 252 seconds]
12:48 -!- Gravitron [~admin@64.93.224.32] has joined #openvpn
12:48 -!- Gravitron [~admin@64.93.224.32] has quit [Changing host]
12:48 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
13:08 -!- _julian [~quassel@hmbg-5f7618fb.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
13:10 -!- _julian [~quassel@hmbg-5f77f2f6.pool.mediaWays.net] has joined #openvpn
13:13 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 260 seconds]
13:15 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
13:19 -!- happylife [~happylife@46.251.83.126] has joined #openvpn
13:21 -!- _julian_ [~quassel@hmbg-5f77f514.pool.mediaWays.net] has joined #openvpn
13:22 -!- _julian [~quassel@hmbg-5f77f2f6.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
13:28 < ben__> pwrcycle: thanks for you help, I got it. OpenVPN didn't run on the default GW, I did see ARP Requests that didn't got resolved ... yeah it was the firewall, thanks a ton
13:30 -!- _julian_ [~quassel@hmbg-5f77f514.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
13:34 < pwrcycle> ben__: :) kool. you're welcome. 
13:37 < EugeneKay> !book
13:37 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
13:39 -!- happylife [~happylife@46.251.83.126] has quit [Quit: Leaving]
13:39 -!- vasily [~happylife@46.251.83.126] has joined #openvpn
13:40 -!- vasily [~happylife@46.251.83.126] has quit [Read error: Connection reset by peer]
13:40 -!- vpopov [~happylife@46.251.83.126] has joined #openvpn
13:52 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
13:52 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
14:00 -!- ben__ [~chatzilla@212.172.205.133] has quit [Read error: Connection reset by peer]
14:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
14:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:05 -!- ravel_exe [ravel_exe@175.143.232.104] has quit []
14:13 <@vpnHelper> RSS Update - forum: OpenVPN to enforce users to update their AV before connectin <http://forums.openvpn.net/topic9257.html>
14:16 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
14:21 -!- batrick [~batrick@nmap/developer/batrick] has quit [Read error: Operation timed out]
14:22 -!- inimino [~inimino@boshi.inimino.org] has quit [Read error: Operation timed out]
14:25 -!- mechbangirc [~mechbangi@mbl-65-157-196.dsl.net.pk] has joined #openvpn
14:25 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
14:26 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
14:29 < mechbangirc> I have setup server and client over tun adapter (routing mode). I am not able to ping other LAN nodes @ server side. I used ngrep to figure out the issue, server has only one NIC (eth0), ofcourse NATed. eth0 1194 gets incoming packet as well as tun0 gets incoming packet. IP forwarding in sysctl.conf is set to 1. What am I missing? PS server has iptables and nothing is blocked also no nat rules in there.
14:30 < mechbangirc> should I provide server/client conf files?
14:33 <@ecrist> !route
14:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
14:33 <@ecrist> !welcome
14:33 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:35 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
14:39 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Read error: Connection reset by peer]
14:51 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Ping timeout: 240 seconds]
14:52 < mechbangirc> ecrist: I dont need client-to-client communication, dont know what is ccd and if I really need it. http://pastebin.com/JhV4yiTK conf+routing+ifconfigs
14:52 <@ecrist> try the man page...
15:03 < mechbangirc> ecrist: so in my understanding all the clients should have different network?
15:04 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
15:05 -!- ehd [u1451@gateway/web/irccloud.com/x-wpehotnchrjmxcyd] has joined #openvpn
15:05 -!- ehd is now known as evilhackerdude
15:10 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
15:22 -!- mechbangirc [~mechbangi@mbl-65-157-196.dsl.net.pk] has quit [Quit: Leaving]
15:39 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
15:42 -!- vpopov [~happylife@46.251.83.126] has quit [Quit: Leaving]
15:49 <@vpnHelper> RSS Update - forum: Hide Real IP port:80 <http://forums.openvpn.net/topic9255.html#p17807> || OpenVPN to enforce users to update their AV before connectin <http://forums.openvpn.net/topic9257.html#p17806>
15:51 < EugeneKay> Ok, WTF am I missing.
15:52 < EugeneKay> I'm getting unsupported certificate purpose on a server cert
15:53 < EugeneKay> Server's cert http://pastebin.com/qQPzXTce
15:53 < krzie> your openssl.cnf doesnt have that section
15:54 < EugeneKay> XCA generated
15:54 < krzie> huh?
15:54 < EugeneKay> It's from XCA, not openssl
15:54 < krzie> whatever, it doesnt have that section
15:54 <@vpnHelper> RSS Update - forum: creating and revoking certificates for clients <http://forums.openvpn.net/topic9253.html#p17808>
15:54 < krzie> or whatever
15:54 < krzie> i can only help you generate certs on openssl
15:55 < krzie> you sure XCA isnt using openssl?
15:55 < EugeneKay> What's the section name? I'm trying to find it so I can regenerate
15:55 < EugeneKay> Internally, yes
15:55 < krzie> well then it has a openssl.cnf
15:55 < krzie> and said conf doesnt have the section in it
15:55 < krzie> ssl-admin used to also not have that section, i patched its openssl.cnf to have it
15:55 < EugeneKay> What section?
15:55 -!- dkr [~dkr@67.132.255.16] has quit [Quit: Leaving]
15:55 < krzie> thats why i remember that
15:56 < krzie> look at the openssl.cnf in easy-rsa
15:57 < EugeneKay> I see it, in the [ server ] block
15:57 < krzie> https://community.openvpn.net/openvpn/browser/easy-rsa/2.0/openssl.cnf?rev=411e89ae6fa195885dc13c594235893c22cb33d8
15:57 < krzie> yep
15:57 <@vpnHelper> Title: /easy-rsa/2.0/openssl.cnf – OpenVPN Community (at community.openvpn.net)
15:57 < krzie> thats her =]
15:57 < EugeneKay> CA is set to false, nscerttpe is server, nscomment is irrelavent. I have the subject and authority key identifiers
15:58 < EugeneKay> eku is..... ah.
15:58 < EugeneKay> XCA has that as "microsoft server"
15:58 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 7.0.1/20110928134238]]
15:59 < EugeneKay> I think that's the same EKU, anyway.
16:00 -!- guntha [~guntha_@pool-74-102-8-168.nwrknj.fios.verizon.net] has quit [Quit: Leaving]
16:00 <@vpnHelper> RSS Update - forum: Private subnet access throught VPN client <http://forums.openvpn.net/topic9252.html#p17809>
16:04 < EugeneKay> And magically, it works. -_-
16:08  * EugeneKay grumbles
16:14 < EugeneKay> At least its only two certs I have to reissue
16:20 < EugeneKay> It annoys me slightly that openvpn expects chained certs in the opposite order from `openssl verify`
16:23 < EugeneKay> !route
16:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
16:29 < rooth> !active*directory
16:30 < rooth> !active
16:30 < EugeneKay> !activedirectory
16:30 <@vpnHelper> "activedirectory" is http://amigo4life.googlepages.com/openvpn for the guide of how to auth against AD
16:32 < rooth> EugeneKay: Thank you.... of course I should've tried it =)
16:41 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806.html#p17810>
16:52 -!- JG84|Sleep is now known as JG84|Around-ish
16:56 -!- Gravitron [~admin@64.93.224.32] has joined #openvpn
16:56 -!- Gravitron [~admin@64.93.224.32] has quit [Changing host]
16:56 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:56 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
17:01 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
17:03 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 258 seconds]
17:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
17:27 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
17:30 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 276 seconds]
17:53 <@vpnHelper> RSS Update - forum: WinXP client to Linux (Ubuntu 10.04) cannot see lan <http://forums.openvpn.net/topic9258.html>
17:58 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:01 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
18:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:02 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
18:17 -!- Lau_ [3c35e27b@gateway/web/freenode/ip.60.53.226.123] has joined #openvpn
18:18 < Lau_> hi i want to ask y my server side cannot ping/connect my client subnet?
18:19 -!- Denial [Denial@drgi.co.uk] has quit []
18:19 < Lau_> i have done the configuration for the router for routing and in the conf file i have added client-to-client as well
18:19 < Lau_> but still not able to ping/connect
18:28 -!- grendal-prime [~sgraham@2001:470:822a:205:226:c7ff:fecd:a1e2] has quit [Quit: Ex-Chat]
18:30 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
18:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
18:32 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
18:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:40 -!- wmp [~wmp@sored/admin/wmp] has left #openvpn ["Konversation terminated!"]
18:41 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
18:42 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
18:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
18:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:55 -!- adolfomaltez [~taro@190.62.201.140] has joined #openvpn
19:01 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has left #openvpn []
19:07 < EugeneKay> What's the suggested way to --mktun at boot? rc.local?
19:07 < EugeneKay> Hm, that looks like it'll start after openvpn.
19:21 < krzie> the whole point of it is you only do that once
19:22 < krzie> oh nevermind
19:22 < krzie> once per boot is correct
19:23 < krzie> personally i'ld start it however you start openvpn
19:25 < Lau_> erm..anyone have any idea y my server side cannot ping client side subnet? even i already put iroute in ccd
19:26 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
19:26 -!- corretico [~luis@201.201.44.82] has joined #openvpn
19:27 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
19:27 < EugeneKay> Lau_ - any of a dozen things. First to check is routing, then firewall.
19:28 < krzie> must be a webchat user ;]
19:28 < EugeneKay> Webchat doesn't show the /topic ?
19:28 < krzie> im sure it does, but i have webchat on ignore
19:28 < krzie> makes my irc experience so much better
19:28 < EugeneKay> Hehehe
19:29 < EugeneKay> I make do with ignoring join/parts/nickchanges 
19:29 < Lau_> i have disable the firewall as well..but still no luck
19:29 < Lau_> the route i also added in my router
19:32 < Lau_> the route i add in my router for client side is 1st  destination 10.8.0.0 mask 255.255.255.0 and gw is my client machine,2nd destination 192.168.0.0 mask 255.255.255.0 and gw is my client machine
19:33 < Lau_> the route i add in my router for server side is 1st  destination 10.8.0.0 mask 255.255.255.0 and gw is my server machine,2nd destination 192.168.1.0 mask 255.255.255.0 and gw is my server machine
19:33 < Lau_> but when i try to ping the subnet 192.168.1.0/24 all give me request timeout
19:34 < datruth> lau as I said yesterday you'll need to figure out your routing issues first
19:36 < Lau_> routing issues?
19:36 < datruth> Lau_: connect your network together then decide where to place the openvpn at.
19:38 < Lau_> datruth but i have already connect my network together, for the client machine i was able to ping the subnet behind my vpn server, but my vpn server not able to ping my subenet behind my client machine
19:39 < datruth> Lau_: without the vpn can you server/client network talk to each other?
19:40 < Lau_> datruth without the vpn connection cannot
19:40 < datruth> Ok so there ya go
19:40 < datruth> first you need to fix that
19:40 < datruth> then worry about the vpn
19:41 < Lau_> datruth but both the server and client network is in 2 seperate place how should i make them to talk to each other..o.O
19:41 < datruth> Lau_: routing....
19:44 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:48 < Lau_> datruth i cant really get it but my network is something similar like this http://www.secure-computing.net/wiki/images/archive/9/90/20081009100024!Ovpn_routing.jpg
19:48 < Lau_> but i cannot connect it ..:(
19:50 < datruth> Lau_: perhaps you should look in to what routing is and what it does. Regardless you need to connect network a and b to gether so your vpn clients can access either network or parts of the network.
19:51 -!- sir_tyrion [~sir_tyrio@unaffiliated/sir-tyrion/x-0257901] has left #openvpn []
19:57 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 276 seconds]
20:07 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
20:08 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
20:14 < EugeneKay> krzie - you wouldn't happen to know of a good set of scripts that wrap `route` into sudo, suitable for user with --route-up and --route-noexec, would you?
20:14 < krzie> dunno what you mean
20:15 < EugeneKay> When dropping with --user openvpn, you run into the problem of not being able to refiddle the routes on a restart
20:15 < EugeneKay> The way to get around it eems to be to grant sudo privs for running route, and then wrap it in a script
20:16 < EugeneKay> The man page says you can use --route-up scripts to do this
20:17 < EugeneKay> Same thing with the ifconfig commands
20:28 <@vpnHelper> RSS Update - forum: creating and revoking certificates for clients <http://forums.openvpn.net/topic9253.html#p17812>
20:40 -!- bar__ [~bar@82.166.200.207.fix.netvision.net.il] has quit [Ping timeout: 248 seconds]
20:56 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 245 seconds]
21:02 -!- Lau_ [3c35e27b@gateway/web/freenode/ip.60.53.226.123] has quit [Ping timeout: 265 seconds]
21:09 < krzie> ahh ok
21:09 < krzie> no i havnt seen pre-made scripts for it
21:10 < krzie> although granted i have never looked for any
21:17 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
21:22 -!- newl [~newl@97.75.165.156] has joined #openvpn
21:24 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
21:43 -!- master_of_master [~master_of@p57B55A84.dip.t-dialin.net] has quit [Read error: Operation timed out]
21:43 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
21:44 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:47 -!- master_of_master [~master_of@p57B559B2.dip.t-dialin.net] has joined #openvpn
21:50 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:01 -!- JG84|Around-ish is now known as JG84|zzz
22:08 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has left #openvpn []
22:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:04 <@vpnHelper> RSS Update - forum: Newbie problem HELP! <http://forums.openvpn.net/topic9250.html#p17813>
23:32 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
--- Day changed Wed Nov 23 2011
00:07 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
00:10 <@vpnHelper> RSS Update - forum: config for random port <http://forums.openvpn.net/topic9259.html>
00:17 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
00:53 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 252 seconds]
00:59 <@vpnHelper> RSS Update - forum: Unable to access OpenVPN subnet in Server 2008 <http://forums.openvpn.net/topic9181.html#p17815>
01:02 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
01:05 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192-15.html#p17816>
01:11 -!- dazo_afk is now known as dazo
01:11 <@vpnHelper> RSS Update - forum: Where is a problem? <http://forums.openvpn.net/topic9260.html> || Hide Real IP port:80 <http://forums.openvpn.net/topic9255.html#p17817>
01:17 <@vpnHelper> RSS Update - forum: Newbie problem HELP! <http://forums.openvpn.net/topic9250.html#p17821> || Where is a problem? <http://forums.openvpn.net/topic9260.html#p17820> || WinXP client to Linux (Ubuntu 10.04) cannot see lan <http://forums.openvpn.net/topic9258.html#p17819>
01:23 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 244 seconds]
01:23 <@vpnHelper> RSS Update - forum: config for random port <http://forums.openvpn.net/topic9259.html#p17822>
01:37 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
01:41 <@vpnHelper> RSS Update - forum: Problem with resolvconf <http://forums.openvpn.net/topic9256.html#p17823>
02:00 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
02:14 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
02:17 <@vpnHelper> RSS Update - forum: WinXP client to Linux (Ubuntu 10.04) cannot see lan <http://forums.openvpn.net/topic9258.html#p17824>
02:24 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Quit: Leaving]
02:30 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:36 -!- qubits is now known as g0d
03:01 -!- happylife [~happylife@212.92.145.7] has joined #openvpn
03:18 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:35 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
03:37 <@vpnHelper> RSS Update - forum: WinXP client to Linux (Ubuntu 10.04) cannot see lan <http://forums.openvpn.net/topic9258.html#p17825>
03:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
03:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
03:49 <@vpnHelper> RSS Update - forum: Where is a problem? <http://forums.openvpn.net/topic9260.html#p17827> || WinXP client to Linux (Ubuntu 10.04) cannot see lan <http://forums.openvpn.net/topic9258.html#p17826>
03:55 <@vpnHelper> RSS Update - forum: Problem with resolvconf <http://forums.openvpn.net/topic9256.html#p17828>
04:01 <@vpnHelper> RSS Update - forum: OpenVPN induces high ping + slow speed <http://forums.openvpn.net/topic9261.html#p17830>
04:07 <@vpnHelper> RSS Update - forum: Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192-15.html#p17831>
04:13 <@vpnHelper> RSS Update - forum: config for random port <http://forums.openvpn.net/topic9259.html#p17832>
04:33 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 252 seconds]
04:35 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
04:48 -!- Gravitron [~admin@12.235.36.252] has joined #openvpn
04:48 -!- Gravitron [~admin@12.235.36.252] has quit [Changing host]
04:48 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
04:53 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 248 seconds]
04:53 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
04:56 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:56 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:56 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:07 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
05:12 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 244 seconds]
05:21 <@vpnHelper> RSS Update - forum: Connection not routing through VPN <http://forums.openvpn.net/topic9262.html> || client-connect command failed <http://forums.openvpn.net/topic9186.html#p17833>
05:22 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 260 seconds]
05:27 <@vpnHelper> RSS Update - forum: Push dhcp-options for Android. <http://forums.openvpn.net/topic9119.html#p17835>
05:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
05:35 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:10 -!- Jare_ [~jare@diz6.kyla.fi] has joined #openvpn
06:15 < Jare_> my client sends some packets into the openvpn tunnel, which have the current public interface ip as their source ip and not the tun interface ip. Is there anything i can do besides asking someone to fix their program?
06:15 <@vpnHelper> RSS Update - forum: Newbie problem HELP! <http://forums.openvpn.net/topic9250.html#p17836>
06:24 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has quit []
06:45 <@vpnHelper> RSS Update - forum: Connection not routing through VPN <http://forums.openvpn.net/topic9262.html#p17837>
06:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:55 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
07:17 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
07:17 -!- adolfomaltez [~taro@190.62.201.140] has quit [Remote host closed the connection]
07:31 -!- happylife [~happylife@212.92.145.7] has quit [Remote host closed the connection]
07:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
07:45 <@vpnHelper> RSS Update - forum: Connection not routing through VPN <http://forums.openvpn.net/topic9262.html#p17838>
07:51 <@vpnHelper> RSS Update - forum: OpenVPN induces high ping + slow speed <http://forums.openvpn.net/topic9261.html#p17839>
08:16 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:21 <@vpnHelper> RSS Update - forum: config for random port <http://forums.openvpn.net/topic9259.html#p17840>
08:27 <@vpnHelper> RSS Update - forum: Connection not routing through VPN <http://forums.openvpn.net/topic9262.html#p17841>
08:39 <@vpnHelper> RSS Update - forum: Push dhcp-options for Android. <http://forums.openvpn.net/topic9119.html#p17843> || Is there other special configuration needed based on ISP ? <http://forums.openvpn.net/topic9192-15.html#p17842>
08:42 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
08:43 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:45 <@vpnHelper> RSS Update - forum: OpenVPN induces high ping + slow speed <http://forums.openvpn.net/topic9261.html#p17845> || Newbie problem HELP! <http://forums.openvpn.net/topic9250-15.html#p17844>
08:49 -!- jhp [~jhp@zeus.jhprins.org] has joined #openvpn
08:50 < jhp> Hi everyone. Can I use multiple CA's with their respective keys in one instance of a OpenVPN server? I know I can create multiple instances with all their own config and certificates etc.
08:51 < EugeneKay> Sure, its called a Stacked CA.
08:52 < EugeneKay> You concatenate the ca crts together. It'll accept any client which has a cert signed by any of the CAs.
08:52 < jhp> So, if I create a CA Crt file with both certs below each other, then I'm basicly done?
08:52 < EugeneKay> Yup.
08:53 < EugeneKay> Intermediate CAs are done by concatenating them after the client cert.
08:53 < jhp> And then, when the old one is fased out, I can just take it out of the config file and all history of that old CA and keys is gone.
08:53 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has joined #openvpn
08:53 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has quit [Changing host]
08:53 -!- luptenschteiner [~User@unaffiliated/probonono] has joined #openvpn
08:53 < EugeneKay> The server will no onger accept certs from that CA, if that's what you mean.
08:54 < jhp> Great.
08:54 < EugeneKay> And yes, this is a great way to change CAs
08:54 < EugeneKay> (with slow client rollout)
08:54 < jhp> And I don't need to sign the new CA with the old CA key or something like that?
08:54 < EugeneKay> Nope. It checks against /any/ of the certs in the ca file, rather than all.
08:54 < jhp> Perfect.
08:55 < EugeneKay> The "chain" method has to go via the client cert file, like I said :-p
08:55 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 244 seconds]
08:55 < jhp> Ok, so that is not something I want.
08:56 < EugeneKay> Are you doing CRL checking, too?
09:01 < jhp> Well, I want to do that, but the prefious admin here revoked the certificate of the CA itself. Probebly by mistake.
09:02 < EugeneKay> D'oh.
09:02 < jhp> I never noticed that until I wanted to configure a CRL here.
09:02 < jhp> I noticed that the Cert of the CA itself (Serial: 00) was in the revocation list.
09:02 < EugeneKay> You could just un-revoke it
09:02 < jhp> How ???
09:03 < EugeneKay> Remove it from the list.
09:03 < jhp> TinyCA2 doesn't give me that option. And the cert isn't in the index file either.
09:03 < EugeneKay> Ahhhh okay.
09:04 < jhp> I have for a long time tried to use the command line to issue certificates, until I found tinyca2 and thought, ah that is a lot easier. 
09:04 < EugeneKay> I use XCA. A bit of fiddling to get the templates right, but it serves me well.
09:04 <@ecrist> !ssl-admin
09:04 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
09:05 < jhp> I use RedHat based distro's.
09:05 < EugeneKay> I use a Windows laptop from 2004 with a sealed RJ-45 jack and the WiFi card removed.
09:06 < jhp> And you transport the certs using a memorystick?
09:06 < EugeneKay> Yup. 
09:06 < jhp> Good sollution. As long as you make sure you backup that laptop somewhere. Or at least the CA store.
09:06 <@vpnHelper> RSS Update - forum: OpenVPN induces high ping + slow speed <http://forums.openvpn.net/topic9261.html#p17847> || route and nat howto? (I do not know the correct title) <http://forums.openvpn.net/topic9263.html>
09:07 < EugeneKay> Its stored in a TrueCrypt volume, which I also sneakernet off and backup offsite
09:09 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
09:10 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:14 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Read error: Connection reset by peer]
09:15 < jhp> EugeneKay: But do you have a quick way to unrevoke the cert of the CA ?
09:16 < jhp> If I need to do this on the commandline, it's fine with me.
09:16 < EugeneKay> Not off he top of my head
09:20 < jhp> The option is not in the man pages.
09:20 < jhp> So I guess that it is not an option that is normally possible.
09:27 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 244 seconds]
09:29 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
09:31 <@vpnHelper> RSS Update - forum: Connection not routing through VPN <http://forums.openvpn.net/topic9262.html#p17848>
09:32 -!- rsc [~robert@fedora/rsc] has joined #openvpn
09:33 < rsc> 150 MBit/s via OpenVPN tunnel (tap device) - is that possible with two standard Intel servers (Xeon)? Will that cause a lot of load?
09:35 < EugeneKay> !gigabit
09:35 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
09:40 < rsc> EugeneKay: should it scale same for tap + bridge like with tun?
09:40 < EugeneKay> I've never done 100mbit+ performance tests, so I have no clue.
09:41 < EugeneKay> I can tell you that TAP+Bridging is the chief cause of cancer, AIDS, and dead cats.
09:41 < rsc> how else could it be solved?
09:42 < EugeneKay> What are you solving that needs Bridging?
09:43 < rsc> one big network (one broadcast domain) but two locations and one WLAN in between
09:44 < EugeneKay> Segment it? That's what routing is for? :-p
09:44 < rsc> well...yes. But no, not possible in this case.
09:45 < EugeneKay> Unless you have a reason to need to do broadcast across a WAN.... don't.
09:45 < rsc> DHCP, "plug and play" devices
09:46 < EugeneKay> It's not hard to run two DHCP servers, and what's "plug and play" ?
09:46 < rsc> devices which are broadcasting or multicasting
09:48 < EugeneKay> And.... why do they need to broadcast across the wan?
09:49 < rsc> because these devices are at both ends of the WLAN and they need to communicate with each other
09:49 < EugeneKay> You're answering with a "what" and a "how". I'm asking "why"
09:50 < rsc> because that's how it works and to what I am forced.
09:51 < EugeneKay> My advice is to rethink the application to work sanely.
09:52 < EugeneKay> Doing bridging is painful enough. Trying it at 100mbit+ is.... going to be exciting.
09:56 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:01 <@vpnHelper> RSS Update - forum: Native v6 support? <http://forums.openvpn.net/topic9027.html#p17849>
10:40 -!- luptenschteiner [~User@unaffiliated/probonono] has quit [Read error: Connection reset by peer]
10:41 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has joined #openvpn
10:41 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has quit [Changing host]
10:41 -!- luptenschteiner [~User@unaffiliated/probonono] has joined #openvpn
10:42 -!- vpopov [~happylife@46.251.83.126] has joined #openvpn
10:44 <@vpnHelper> RSS Update - forum: route and nat howto? (I do not know the correct title) <http://forums.openvpn.net/topic9263.html#p17850>
10:55 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
10:55 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
10:55 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:55 -!- mode/#openvpn [+v Axeman] by ChanServ
11:02 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
11:14 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
11:23 -!- Apocryphe [~Apocryphe@81-64-43-253.rev.numericable.fr] has joined #openvpn
11:26 -!- dazo is now known as dazo_afk
11:28 < Apocryphe> Hi, I have windows 7 with 2 interfaces: my network card, my VPN adapter, and I have a windows 7 virtual machine. I would like to ensure that my virtual machine never goes out of my network card, but always use my VPN interface. How do I get my real IP on my physical machine, and my IP VPN on my virtual machine?
11:29 < Apocryphe> I tried changing the order of interfaces and custom bind on vmware my vpn adapter....
11:30 < Apocryphe> I tried with create bridge and change metric
11:30 < Apocryphe> I tried with route persistant...
11:30 < Apocryphe> but i m noob in network
11:32 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
11:32 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
11:32 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
11:32 -!- mode/#openvpn [+v Axeman] by ChanServ
12:04 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
12:05 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
12:13 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
12:25 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
12:34 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has joined #openvpn
12:39 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
12:39 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
12:39 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
12:39 -!- mode/#openvpn [+v Axeman] by ChanServ
12:48 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
12:51 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:51 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:51 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:52 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
12:59 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
13:04 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
13:04 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:04 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
13:04 -!- oc80z [oc80z@blea.ch] has joined #openvpn
13:07 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
13:07 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
13:07 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:07 -!- mode/#openvpn [+v Axeman] by ChanServ
13:10 -!- BoomSie [~gideon@84-245-27-118.dsl.cambrium.nl] has quit [Quit: Ex-Chat]
13:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
13:20 <@vpnHelper> RSS Update - forum: Requesting help to get comp-lzo working <http://forums.openvpn.net/topic9264.html>
13:21 -!- jeev [1004@unaffiliated/jeev] has joined #openvpn
13:21 < jeev> !factoids
13:21 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
13:28 < jeev> grr, when i'm testing vpn behind dd-wrt, it's sending the packets as a 192.168.1.x to the destination,
13:32 < jeev> dd-wrt client, using route dst 255.255.255.255 for policy, i'm going to enable 'nat'
13:33 < jeev> yaym, that was it
13:39 < jeev> http://svn.dd-wrt.com:8000/ticket/2151 bah!
13:39 <@vpnHelper> Title: #2151 (OpenVPN Client 'Policy based routing' feature broken) – DD-WRT (at svn.dd-wrt.com:8000)
13:40 < krzee> i had the same issue, also solved with a nat rule
13:40 < jeev> i'm scurred to use redirect-gateway, it's in africa.
13:40 < jeev> i want to do source based routing.
13:40 < krzee> however, i still have 1 issue
13:41 < jeev> i just want a single ip to be sent out the vpn
13:41 < jeev> what's your problem
13:41 < krzee> if the machine connecting to a vpn ip through it is already connected and trying when the router boots, it starts sending before the nat rule and the nat rule doesnt apply until the sequence numbers restart (the connection is restarted)
13:42 < jeev> oh fark
13:42 < krzee> but its cause i solved the issue with a nat rule on startup (which obviously loads too late)
13:42 < jeev> oh, i am not doing that kind though
13:42 <+hyper_ch> hi krzee
13:42 < krzee> i need to figure out how to do my rule within the uci framework
13:42 < jeev> you're having it connect to an IP at the vpn ?
13:42 < krzee> hey hyper_ch 
13:42 < jeev> inside the vpn network ?
13:43 < krzee> jeev, something plugged into the router, yes
13:43 < krzee> so it can only connect over the vpn
13:43 < jeev> my situation is, i have like 20 systems connected to the dd-wrt router, dd-wrt router connects to vpn.. just fine now, nat is working. i just need one of those internal ips to be forced out the default gateway (VPN) the rest can remain the same
13:43 < jeev> so i dont want to do use redirect-gateway
13:44 < krzee> so use route
13:44 < jeev> for source?
13:44 < jeev> route does source?
13:44 < krzee> route ip.ip.ip.ip netmask
13:45 < krzee> will tell the client that anything in that network goes over the vpn
13:45 < Olipro> CIDR works just as well
13:45 < krzee> Olipro, no it doesnt
13:45 < Olipro> ...with iproute2
13:45 < Olipro> ;)
13:45 < krzee> umm, we're talking about openvpn
13:45 < jeev> what are you saying ? route will work with source based ip?
13:45 < jeev> route 192.168.11.50 255.255.255.255 will send it out the vpn ?
13:45 < krzee> oh
13:46 < krzee> maybe i dont get what you want
13:46 < krzee> you want all of 1 clients traffic to leave out the vpn?
13:46 < jeev> yes
13:46 < krzee> sorry dude, thats redirect-gateway
13:46 < Olipro> krzee: ip route add x.x.x.x/y
13:46 < jeev> but that will be the entire lan
13:46 < krzee> Olipro, from in a openvpn config?
13:47 < Olipro> oh right, within openvpn conf
13:47 < Olipro> well... you could do it as an upscript I suppose
13:47 < krzee> jeev, oh i dunno, something unrelated to openvpn then... im gunna go shower
13:47 < krzee> just got done beating up a tire for training
13:47 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
13:49 < jeev> hmm
13:54 < jeev> got source working but it's coming as 10.10.10.10 ;)
13:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:59 -!- evilhackerdude is now known as ehd
14:00 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17852>
14:04 -!- ehd is now known as evilhackerdude
14:09 < jeev> krzee, redirect-gateway didn't work on client config
14:15 -!- vpopov [~happylife@46.251.83.126] has quit [Ping timeout: 258 seconds]
14:15 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
14:16 < dupondje> Hi! Got some weird issue here with my OpenVPN. Got a openvpn client on my Windows 7 computer. The connection is being used as Default Gateway
14:17 < dupondje> This works perfectly, but the strange thing is, that all of a sudden, Windows 7 seems to add another default route with a lower metric.
14:17 < dupondje> Any idea where that comes from ?
14:19 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17853>
14:19 < Olipro> dupondje: you can just get OpenVPN to set a default route in two parts
14:19 < Olipro> so you end up with 0.0.0.0/1 and 128.0.0.0/1
14:20 < Olipro> it'll trump any default route, regardless of metric
14:20 < dupondje> Olipro: I could do that indeed, but still its weird that the additional route gets added out of nowhere :s
14:21 < jeev> bad source address... from wan
14:21 < Apocryphe> Ok, pro wake up, i will try my question
14:21 < jeev> wtf
14:21 < Olipro> not necessarily... are you using tap?
14:21 < jeev> wan ip
14:21 < Olipro> if you're using tap, and the Win7 client starts talking to a DHCP server through the OpenVPN tunnel...
14:21 < dupondje> Olipro: yes
14:21 < jeev> i put redirect-gateway def1 in ccd for that specific client. i couldn't connect, it was bad source address
14:22 < dupondje> Olipro: the gateway it adds is my internal router, nothing to do with the vpn connection
14:22 < dupondje> so it doesnt get it trough the vpn connection
14:23 < Olipro> it doesn't matter what it adds as gateway
14:23 < Olipro> DHCP discovery happens with a broadcast solicitation
14:23 < Olipro> at the ethernet MAC level
14:25 < Apocryphe> I have windows 7 with 2 interfaces: my network card, my VPN adapter, and more I have a windows 7 virtual machine custom bind with VPN adapter interface. How do I get my real IP on my physical machine, and my IP VPN on my virtual machine?
14:25 < EugeneKay> VMware?
14:25 < Apocryphe> yes
14:26 < Apocryphe> but it doesnt matter
14:26 < EugeneKay> You need to do Internet Connection Sharing between the VPN interface and the Host-Only network.
14:26 < dupondje> hmz Olipro and any idea how it can be solved ?
14:26 < Apocryphe> if virtual box...
14:26 < dupondje> using tun ?
14:26 < Olipro> use tun or filter with ebtables
14:27 < Apocryphe> EugeneKay: humm... i bind with vpn adapter in custom properties of vmware 
14:27 < dupondje> ebtables ? ;) its winblows ... :D
14:27 < Apocryphe> is enough?
14:27 < EugeneKay> VMware Bridged to the VPN interface? That could work too
14:27 < Apocryphe> yes
14:27 < EugeneKay> Try it and see.
14:28 < Olipro> dupondje: both ends are windows?
14:29 < dupondje> Olipro: I guess only client. But the server I don't manage :)
14:29 < Olipro> oh, I see
14:29 < Olipro> in any case, if it's tap, you should be able to forego the OpenVPN routing config
14:29 < Olipro> just let it pull an address and route from their DHCP server
14:29 < Olipro> that is presumably what they intended anyway
14:29 < Apocryphe> i don t understand... EugeneKay
14:29 < Olipro> alternatively, get Windows Firewall to block DHCP on the interface
14:30 < Olipro> or disable the DHCP client service
14:30 < Apocryphe> EugeneKay: on virtual network setting editor
14:30 < Apocryphe> i have : bridged custom on tap
14:30 < dupondje> You know if there are some logs of the DHCP announces somewhere in the Event Viewer?
14:30 < EugeneKay> Right
14:30 < Apocryphe> cool
14:31 < Apocryphe> EugeneKay: ok in this situation... my physical machin have VPN IP
14:31 < Apocryphe> i wish the real IP
14:31 < Apocryphe> and my VM have VPN IP (i belive)
14:33 < Apocryphe> VMnet1 bridged to tap win32 adapter
14:33 < Apocryphe> EugeneKay: i tried changing the order of interfaces and custom bind on vmware my vpn adapter....
14:33 < Apocryphe> changing metric, and route persist
14:33  * EugeneKay shrugs
14:33 < EugeneKay> I've never tried such magic myself, so I dunno
14:34 < EugeneKay> Windows networking is wonky on the best of days. Maybe Olipro will have a better idea
14:34 < Apocryphe> ok ok :)
14:35 < Apocryphe> thanks !
14:35 < Olipro> I haven't been reading what you want to achieve
14:35 < Olipro> you want the VM to be on your physical network
14:35 < Olipro> and to route traffic to the host?
14:36 < Apocryphe> Olipro: I wish to ensure that the traffic will never go on my real IP
14:36 < Apocryphe> this is my need
14:36 < Olipro> your... real IP
14:37 < Olipro> what exactly do you mean by that
14:37 < Apocryphe> hum...
14:37 < Apocryphe> Internet Service Provider
14:37 < Olipro> right, a globally routable IP
14:37 < Olipro> presumably, you are establishing the OpenVPN tunnel to a host on the internet
14:38 < Apocryphe> yes
14:38 < Olipro> ...so you must do it from your internet IP address
14:38 < Olipro> private IP addresses are just that, private.
14:38 < Olipro> they don't get routed over the internet
14:39 < Apocryphe> ok my test is simple :
14:39 < Apocryphe> firefox : whatismyip.com : on my physical machin i wish my IP provider
14:39 < Apocryphe> and for my VM i wish my VPN IP
14:40 < Apocryphe> this is what I want to get
14:40 < Olipro> fine, you still have to /establish/ the tunnel over your public IP
14:40 < Apocryphe> yes of course
14:40 < Olipro> set the VM guest's NIC to use NAT
14:41 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-wpehotnchrjmxcyd] has left #openvpn []
14:41 < Apocryphe> ok
14:41 < Olipro> your VM guest will need to initiate the OpenVPN connection, or you can get VMWare to port forward
14:42 < Apocryphe> (i use a vpntunnel.se service, i m french it s for HADOPI crazy law)
14:45 < Apocryphe> is the machine to initiate the VPN connection? (i wish if the vpn connection crash, don't reveal my real ip)
14:45 -!- _julian [~quassel@hmbg-4d0695b7.pool.mediaWays.net] has joined #openvpn
14:45 < datruth> Apocryphe: maybe using ssh might be easier?
14:45 < Apocryphe> how ?
14:46 < dupondje> redirect-gateway def1 => can only be used on server side right ?
14:46 < datruth> Apocryphe: well if you have an ssh server you can use that as your proxy
14:47 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
14:47 < Apocryphe> it s not very good
14:48 < datruth> just a suggestion
14:48 < Apocryphe> the software obliged to implement "proxy manager"
14:48 < Apocryphe> by defaut the soft send 0.0.0.0 - windows give the first interface
14:49 < Apocryphe> the problem is not native to bind a soft with a interface
14:50 -!- newl [~newl@97.75.165.156] has joined #openvpn
14:50 < Apocryphe> it s a simple problem
14:50 < Apocryphe> but the solution...
14:54 < Apocryphe> proceed step by
14:55 < Apocryphe> I connect with the client home vpntunnel.se use openvpn
14:56 < Apocryphe> firefox : whatismyip.com tell me IP_SWEEdish
14:56 < Apocryphe> ok
14:57 < EugeneKay> Olipro, did I show you this? http://util.khresear.ch/myip
14:57 < Apocryphe> how can get my Provider IP without disconnecting my adapter VPN ?
14:57 <@vpnHelper> Title: What is my IP? (at util.khresear.ch)
14:58 < Apocryphe> with route command ? with create bridged miniport ? with openvpn.config ?
14:58 < Apocryphe> with ordered interface ? change metric ?
14:59 < datruth> Apocryphe: maybe you should look into a firewall? Perhaps you can use that to nat whatever traffic you want over whatever ip you want
15:00 < Apocryphe> datruth: overkill solution ? don't you find ?
15:00 < Apocryphe> I am a developer, I now understand why I hate the network...
15:00 < Apocryphe> datruth: the firewall don' work with interface...
15:01 < Apocryphe> it s strange software :)
15:01 < datruth> maybe what you want isn't possiable on the strange software your using
15:02 < Apocryphe> the firewall it s strange software
15:02 < Apocryphe> i use firefox, uTorrent...
15:03 < Apocryphe> :)
15:03 -!- buntfalke [~nobody@unaffiliated/buntfalke] has joined #openvpn
15:04 < datruth> I think ssh would be easy to use for that
15:05 < Apocryphe> datruth: yes but it s not generic solution
15:05 < Apocryphe> for all software
15:05 < datruth> you only mentioned firefox and uTorrent
15:05 < Olipro> EugeneKay: no, but you did now, what about it?
15:05 < Olipro> I find ip4.me and ip6.me to be quicker
15:05 < Apocryphe> datruth: yes it s exacly
15:06 < EugeneKay> I just thought you might like the fact that it's curl-able.
15:06 < Apocryphe> It sounds incredible that I want does not exist
15:06 < Apocryphe> it disturbs me
15:07 < Apocryphe> it s for curiosity...
15:08 < Apocryphe> datruth: thank you for looking! it s very friendly
15:31 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 244 seconds]
15:32 -!- elops [sjyes@77.42.177.93] has joined #openvpn
15:32 < elops> I need some help w/ OpenVPN on obsd 4.8, just need to config it as a bridge so I can get to multiple networks on the vpn server, I'm kind of sleep deprived today, are there any tuts, I know I need to make the bridge on the server and change the server conf
15:33 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 244 seconds]
15:34 -!- newl [~newl@97.75.165.156] has left #openvpn []
15:35 < EugeneKay> !tunortap
15:35 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against
15:35 <@vpnHelper> you over the vpn or (#4) lan gaming? use tap!
15:35 < elops> ?
15:36 < elops> english is not my first language
15:36 < elops> what do u mean pls?
15:36 < elops> which should o use?
15:36 < EugeneKay> Don't use Bridging(TAP) unless you have a very good reason.
15:36 < elops> what should I use?
15:37 < elops> in my case
15:37 -!- buntfalke [~nobody@unaffiliated/buntfalke] has quit []
15:37 < EugeneKay> Routed(TUN) subnets work great.
15:37 < elops> here is my case:
15:37 < elops> I need to get to one or two interfaces on the openvpn server
15:37 < elops> how would I go about doing that
15:37 < EugeneKay> !howto
15:37 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:38 < elops> yes but can u point me in the right direction?
15:38 < elops> I need to be able to get to sis1 on the server from home
15:38 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
15:39 < EugeneKay> Not sure what sis1 is(I don't speak BSD, sorry), but its usually a matter of pushing a route to the client. The howto covers all this and more.
15:39 < elops> EugeneKay...ive read the tut Sir
15:39 < EugeneKay> ls -alh ~/.ssh
15:40 < elops> "Expanding the scope of the VPN to include additional machines on either the client or server subnet." I'd imagine is a good place to start?
15:40 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
15:40 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
15:41 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:41 < EugeneKay> Yup.
15:41 < EugeneKay> !route
15:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
15:41 < EugeneKay> Worth a read as well, but it sounds like you're only worried about server lans.
15:42 < elops> thankss!
15:42 < elops> :P
15:42 < elops> need to be able to get to client radios, its a small wireless network on Nanostation M2's
15:43 < elops> I just think I'm too braindead today to do any of the conf, but maybe some reading, thank you for links
15:45 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 258 seconds]
15:46 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has quit [Excess Flood]
15:48 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has joined #openvpn
15:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
16:02 -!- elops [sjyes@77.42.177.93] has quit [Ping timeout: 276 seconds]
16:11 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
16:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:41 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
16:46 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Client Quit]
16:53 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
16:58 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:10 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
17:10 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
17:10 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
17:10 -!- mode/#openvpn [+v Axeman] by ChanServ
17:16 -!- novaflash is now known as novaflash_away
17:33 < jeev> i've never gotten t he multi source error from a wan ip before.
17:33 < jeev> my dd-wrt client to openvpn server
17:34 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:34 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:35 -!- datruth_ [datruth@gotpot.org] has joined #openvpn
17:37 -!- datruth [datruth@gotpot.org] has quit [Ping timeout: 276 seconds]
17:53 -!- JG84|zzz is now known as JG84|DND
17:55 -!- Lau_ [3c35e27b@gateway/web/freenode/ip.60.53.226.123] has joined #openvpn
17:59 < Lau_> hi, i wonder why my centos server when connected with the openvpn, the machine behind my vpn server cannot ping it, but when connected with windows xp it can?
18:05 < |Mike|> topic.
18:06 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
18:21 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
18:21 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has left #openvpn []
18:23 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
18:29 < jeev> krzee
18:31 < krzie> jeev
18:34 -!- ephcon [~ephcon@fredri.cc] has joined #openvpn
18:37 < EugeneKay> EugeneKay 
18:44 < jeev> hmm
18:44 < jeev> so my issue is that under dd-wrt's additional config, i put redirect-gateway and pretty much lost everything.
18:44 < jeev> i get the multi error from the WAN ip now
18:44 -!- stones_ [~anthony@pool-173-77-115-209.nycmny.east.verizon.net] has joined #openvpn
18:45 < stones_> Hi, once I install OpenVPN does it hide my ips for everything? http, ftp, etc?
18:46 < EugeneKay> The simplistic answer is "maybe"
18:47 < krzie> !redirect
18:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
18:47 < EugeneKay> With a proper "redirect-gateway def1", any new connections that would flow via your default gateway(ie, internet traffic) will flow through OpenVPN instead. 
18:47 < |Mike|> cupcake direct pwwawawa!
18:47 < krzie> it will only do what you said if you configure it to
18:48 < EugeneKay> Existing connections will remain open, and stuff to your LAN will remain unaffected because the route for that is "more specific" than the def1 gateway
18:48 < jeev> krzie
18:49 < |Mike|> wtf is up with openvpn-nl?
18:49 < krzie> jeev
18:49 < krzie> |Mike|, what *is* openvpn-n1?
18:50 < |Mike|> Fox-it stuff
18:50 < |Mike|> https://openvpn.fox-it.com/
18:50 <@vpnHelper> Title: OpenVPN-NL (at openvpn.fox-it.com)
18:50 < krzie> umm
18:50 < krzie> that page claims its modded for use by dutch gov
18:50 < jeev> great, i think the power went out
18:51 < krzie> but the patches for that arent done yet afaik
18:51 < EugeneKay> It means it has Iranian backdoors built in
18:51 < jeev> iran's government is 31337
18:51 -!- stones_ [~anthony@pool-173-77-115-209.nycmny.east.verizon.net] has quit [Ping timeout: 260 seconds]
18:51 < krzie> the openvpn changes for the dutch gov to use openvpn are being merged into openvpn
18:51 < krzie> it wont even use openssl
18:52 < jeev> fark man the power went out where the dd-wrt router is in africa
18:52 < krzie> will use polar ssl
18:52 < |Mike|> indeed.
18:52 < EugeneKay> wtf is poalr ssl
18:52 < |Mike|> aes only
18:52 < krzie> http://www.polarssl.org/
18:52 <@vpnHelper> Title: Light-weight, modular cryptographic and SSL/TLS library - PolarSSL (at www.polarssl.org)
18:52 < krzie> personally ild rather use blowfish than AES
18:53 -!- stones_ [~anthony@pool-173-77-117-252.nycmny.east.verizon.net] has joined #openvpn
18:53 < |Mike|> two-fish.
18:54 < EugeneKay> One fish, two fish, red fish, blow fish?
18:54 < jeev> no, i use the one made outside springfield nuclear power plant, threefish
18:54 < EugeneKay> Blinky!
18:54 < krzie> nice |Mike| thanx
18:54 -!- Lau_ [3c35e27b@gateway/web/freenode/ip.60.53.226.123] has quit [Ping timeout: 265 seconds]
18:55 < |Mike|> krzie: yw, i haven't red everything on their website yet tho.
18:55 < jeev> krzie, is there an explanation for the multi source address error for the wan address?
18:56 -!- Denial [Denial@drgi.co.uk] has quit []
18:57 < krzie> yes, your vpn client is sending packets over the vpn with source address of its wan adapter... i had the same issue, solved it with nat on the client itself (on openwrt... i thought we talked about this)
18:57 <@vpnHelper> RSS Update - forum: Windows 7 as OpenVPN server with redirect-gateway <http://forums.openvpn.net/topic7806-15.html#p17854>
18:59 < jeev> no man, my issue was the source packets were coming from 192.168 when i'd tcpdump on the openvpn SERVER, so 192.168.x ips were sending packets to the destination 192.168.x - vpn server - destination.
18:59 < jeev> earlier, i tried to redirect-gateway i think through ccd and it was giving me multi from wan ip
18:59 < jeev> i've never seen that before
19:00 < krzie> i have
19:00 < jeev> nat is enabled, it's functioning fine
19:00 < krzie> a number of times here in the channel, than myself when i started using openwrt
19:00 < jeev> ifigure i might as well just use redirect-gateway
19:00 < jeev> but it wont work bah
19:01 < jeev> i can't even test it now, the damn thing is offline now
19:02 < |Mike|> stupid dutch..
19:02 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
19:02 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
19:02 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:02 -!- mode/#openvpn [+v Axeman] by ChanServ
19:20 < krzie> |Mike|, how so?
19:21 < krzie> that project has led to good work on openvpn, they should be thanked =]
19:22 < krzie> including modularizing the ssl stuff so that it isnt just married to openssl, an important step twords the mythological openvpn3
19:22 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has joined #openvpn
19:22 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
19:22 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
19:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
19:23 < stones_> I am trying to install openvpn through yum and getting: Missing Dependency: nss = 3.12.7-2.el5.centos
19:23 < stones_> any one know how ot fix this?
19:24 < stones_> nss-tools-3.12.7-2.el5.centos.i386 from installed has depsolving problems
19:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:27 < stones_> let me try an update
19:28 < krzie> dunno it just installed for me
19:28 < krzie> using yum on centos5
19:28 < krzie> to get 2.2.1 i needed to add a repo, forget which one
19:32 -!- _julian_ [~quassel@hmbg-4d06e708.pool.mediaWays.net] has joined #openvpn
19:34 -!- _julian [~quassel@hmbg-4d0695b7.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:56 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:18 -!- gyyrog [~gyyrog@99.54.136.50] has joined #openvpn
20:21 -!- JG84|DND is now known as JG|ZZZ
20:29 -!- adolfomaltez [~taro@190.62.206.66] has joined #openvpn
20:40 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
20:47 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
20:52 -!- JG|ZZZ is now known as JG84|-_-
20:55 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:09 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:09 -!- mode/#openvpn [+v Axeman] by ChanServ
21:11 -!- luptenschteiner is now known as probonono
21:13 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
21:13 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:13 <@vpnHelper> RSS Update - forum: WinXP client to Linux (Ubuntu 10.04) cannot see lan <http://forums.openvpn.net/topic9258.html#p17855>
21:17 -!- JG84|-_- is now known as JG84|Night
21:29 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has joined #openvpn
21:45 -!- master_of_master [~master_of@p57B559B2.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
21:47 -!- master_of_master [~master_of@p57B5556E.dip.t-dialin.net] has joined #openvpn
21:49 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:01 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
22:01 <@vpnHelper> RSS Update - forum: route and nat howto? (I do not know the correct title) <http://forums.openvpn.net/topic9263.html#p17856>
22:21 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
22:46 -!- ephcon [~ephcon@fredri.cc] has quit [Ping timeout: 276 seconds]
23:21 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 248 seconds]
23:24 -!- Gravitron [~admin@cpe-76-92-159-145.kc.res.rr.com] has joined #openvpn
23:29 -!- Gravitron [~admin@cpe-76-92-159-145.kc.res.rr.com] has quit [Ping timeout: 244 seconds]
23:43 -!- happylife [~happylife@212.92.145.7] has joined #openvpn
23:47 -!- Pilif12p is now known as Tannerbaum
--- Day changed Thu Nov 24 2011
00:26 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
00:34 -!- happylife is now known as vpopov
00:53 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
01:14 -!- Optic [~Optic@2607:f748:1200:f8:21b:21ff:fe28:d964] has left #openvpn []
01:30 -!- kswtch [~kswtch@riker.schizzr.de] has left #openvpn []
01:42 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:51 <@vpnHelper> RSS Update - forum: Openvpn between two computers in the same network <http://forums.openvpn.net/topic8908.html#p17857>
02:20 -!- _julian [~quassel@hmbg-4d06ba6c.pool.mediaWays.net] has joined #openvpn
02:21 -!- _julian_ [~quassel@hmbg-4d06e708.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
02:40 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:51 <@vpnHelper> RSS Update - forum: client-connect command failed <http://forums.openvpn.net/topic9186.html#p17859> || creating and revoking certificates for clients <http://forums.openvpn.net/topic9253.html#p17858>
02:57 <@vpnHelper> RSS Update - forum: Requesting help to get comp-lzo working <http://forums.openvpn.net/topic9264.html#p17860>
02:58 -!- clone3g [~clon3man@206-248-132-19.dsl.teksavvy.com] has joined #openvpn
03:03 -!- vpopov [~happylife@212.92.145.7] has quit [Ping timeout: 258 seconds]
03:06 -!- vpopov [~happylife@212.92.145.7] has joined #openvpn
03:14 <@vpnHelper> RSS Update - forum: Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html>
03:16 -!- clone3g [~clon3man@206-248-132-19.dsl.teksavvy.com] has quit [Remote host closed the connection]
03:40 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
03:41 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
03:50 -!- _julian_ [~quassel@hmbg-4d06ef7d.pool.mediaWays.net] has joined #openvpn
03:52 -!- _julian [~quassel@hmbg-4d06ba6c.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
04:11 -!- _julian [~quassel@hmbg-4d06a3e5.pool.mediaWays.net] has joined #openvpn
04:12 -!- _julian_ [~quassel@hmbg-4d06ef7d.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
04:20 -!- _julian_ [~quassel@hmbg-4d06ddd0.pool.mediaWays.net] has joined #openvpn
04:21 -!- _julian [~quassel@hmbg-4d06a3e5.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
04:22 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:29 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:29 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:44 -!- Carbon_Monoxide [~cmonxide@036.145.198.203.static.netvigator.com] has quit [Ping timeout: 252 seconds]
04:56 -!- novaflash_away is now known as novaflash
05:22 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:43 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
05:55 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-45.html#p17862>
06:03 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
06:07 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:31 <@vpnHelper> RSS Update - forum: Requesting help to get comp-lzo working <http://forums.openvpn.net/topic9264.html#p17863>
06:31 -!- kyrix [~ashley@mk046207255007.a1.net] has joined #openvpn
06:37 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 240 seconds]
06:39 -!- adolfomaltez [~taro@190.62.206.66] has quit [Read error: Connection reset by peer]
06:42 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
06:42 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
06:44 -!- JG84|Night is now known as [AFK]
06:45 -!- [AFK] is now known as JG84|Busy
06:49 -!- Silent [~silent@109.67.232.84] has joined #openvpn
06:49 < Silent> Hello.
06:50 < Silent> Could anyone please point me at a guide on setting up an OpenVPN client?
06:50 < Silent> I already have the server up on FreeBSD
06:50 < Silent> And certificates for both the server and the client(Gentoo Linux)
07:03 -!- Silent [~silent@109.67.232.84] has left #openvpn []
07:07 < Rienzilla> hmmm
07:07 < Rienzilla> This is weird
07:07 < Rienzilla> trying to instal newest openvpn on windows vista
07:07 < Rienzilla> oh never mind
07:08 < Rienzilla> after 5 minutes of hanging on the tap install it continues
07:08 < Rienzilla> weird
07:12 <@vpnHelper> RSS Update - forum: How don't use the default VPN interface / only on my VM <http://forums.openvpn.net/topic9266.html>
07:27 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
07:30 < Cybertinus> !welcome
07:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:33 < Cybertinus> !route
07:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
07:38 < Cybertinus> !iporder
07:38 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
07:45 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has joined #openvpn
08:04 < krzee> happy thanksgiving to any of you who do that
08:12 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:12 -!- Khas [92b0a426@gateway/web/freenode/ip.146.176.164.38] has joined #openvpn
08:12 < Khas> !configs
08:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
08:13 < Khas> I'm trying to set up a layer 2 openvpn setup, but I'm having trouble creating the bridge interface.  Is this the right place to ask for help or should I go elsewhere?
08:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
08:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:35 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has joined #openvpn
08:35 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has quit [Changing host]
08:35 -!- luptenschteiner [~User@unaffiliated/probonono] has joined #openvpn
08:37 -!- probonono [~User@unaffiliated/probonono] has quit [Disconnected by services]
08:37 -!- luptenschteiner is now known as probonono
08:37 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
08:39 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
08:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
08:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
09:04 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has joined #openvpn
09:04 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has quit [Changing host]
09:04 -!- luptenschteiner [~User@unaffiliated/probonono] has joined #openvpn
09:06 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 244 seconds]
09:07 -!- betatesteur0693 [~Meclancie@64.189.64.86.rev.sfr.net] has joined #openvpn
09:28 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
09:35 -!- gyyrog [~gyyrog@99.54.136.50] has quit [Remote host closed the connection]
09:36 -!- Perun_ [perun@chao5.net] has quit [Quit: Reconnecting]
09:36 -!- Perun [perun@chao5.net] has joined #openvpn
09:53 -!- Dweezahr [~Dweezahr@flits102-34.flits.rug.nl] has joined #openvpn
10:01 -!- Ionic [ionic@ionic.de] has quit [Ping timeout: 244 seconds]
10:14 -!- betatesteur0693 [~Meclancie@64.189.64.86.rev.sfr.net] has left #openvpn []
10:18 < Khas> If I have an interface with a public IP, I can't use that to bridge the vpn connections from tap0, can I?  I'd have to create an intermediate virtual adapter?
10:19 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 276 seconds]
10:26 < jeev> bah, ok it's back up and it's still not working
10:36 <@vpnHelper> RSS Update - forum: Bridged Access Server and Client <http://forums.openvpn.net/topic9267.html>
10:47 -!- luptenschteiner is now known as probonono
10:47 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
10:47 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
10:52 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
10:53 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:54 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:54 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
11:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 260 seconds]
11:22 <@vpnHelper> RSS Update - forum: Bridging with only external IP <http://forums.openvpn.net/topic9268.html>
11:25 -!- Khas [92b0a426@gateway/web/freenode/ip.146.176.164.38] has quit [Ping timeout: 265 seconds]
11:31 -!- happylife [~happylife@46.251.83.126] has joined #openvpn
11:33 < Olipro> any of you chaps use OSPF over an openvpn PtP tunnel?
11:33 < krzie> not i, what issues have you been having tho?
11:34 < Olipro> the two OSPF instances don't see eachother
11:34 < krzie> at some point ill be implementing some sort of dynamic routing protocol over vpn
11:34 < Olipro> I suspect it's something to do with how OpenVPN sets up the PtP link
11:34 < krzie> you sure its all ipv4 traffic they use?
11:34 < krzie> try using tap just to check if that works
11:35 < Olipro> it works over tap no problem 
11:35 < krzie> intardasting
11:35 < Olipro> OSPF can work over a PtP tun just fine
11:36 < Olipro> but I think what upsets it is the fact that OpenVPN uses this odd fake peer mechanism
11:36 < krzie> http://www.myfacewhen.net/uploads/37-intredasting.jpg
11:36 < Olipro> i.e. if my client has IP 10.0.0.10
11:36 < EugeneKay> !blame
11:36 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
11:36 < Olipro> and the server has 10.0.0.1
11:36 < EugeneKay> So who do I blame for this hangover? Myself?
11:36 < Olipro> the peer address for the client ends up as 10.0.0.9
11:37 < Olipro> so pinging 10.0.0.1 goes via the imaginary 10.0.0.9
11:37 < EugeneKay> Use subnet instead of net30?
11:38 < EugeneKay> IIRC windows doesn't need net30 anymore
11:38 < Olipro> both clients are linux
11:39 < Olipro> so um
11:39 < Olipro> what config option stops it using this odd getup
11:39 < EugeneKay> !topology
11:39 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
11:39 < EugeneKay> "--topology net30" is the default for Windows compatibility with older versions
11:40 < Olipro> sexual
11:40 < EugeneKay> If you wait a few minutes, I'll have some fresh vomit for you.
11:40 < Olipro> hair of the dog is what you need
11:41 < EugeneKay> My dog needs a wash.
11:41 < EugeneKay> Stinky bastard.
11:42 < EugeneKay> So Olipro, what are you OSPFing anyway?
11:43 < Olipro> remote server and my network here
11:43 < EugeneKay> Ah, no fancy HA stuff?
11:44 < Olipro> not... yet
11:44 < EugeneKay> Hehe
11:46 < EugeneKay> One of the items on my todo list is to write some wrappers to handle ip setup & routing(via sudo) so that I can run openvpn as an unprived user from the start, instead of post-init.
11:46 < EugeneKay> This'll also mean fiddling with the init script, I expect.
11:52 -!- Khas [95ff6337@gateway/web/freenode/ip.149.255.99.55] has joined #openvpn
12:11 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
12:13 < Khas> I'm connecting to my vpn server using openvpn on android.  It's not using the correct DNS server that's being fed to it by the server config, although this is working on the same client config (it gets the correct dns server).  Anyone know why this would be?
12:13 < Khas> *same client config on a Windows machine
12:15 < EugeneKay> CM?
12:22 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 260 seconds]
12:23 -!- smerz [~smerz@smerz.demon.nl] has quit [Quit: Ex-Chat]
12:24 < Khas> Yeah, but I'm using openvpn-settings.
12:25 < Khas> Once that works, I'll try making the cm client work properly
12:26 -!- Khas [95ff6337@gateway/web/freenode/ip.149.255.99.55] has quit [Quit: Page closed]
12:31 < EugeneKay> Not sure if it supports altering the DNS prop
12:31 < EugeneKay> I *believe* the CM one does, because it's a system app.
12:43 <@vpnHelper> RSS Update - forum: Openvpn is setup properly but does not connect <http://forums.openvpn.net/topic9269.html>
12:53 < Olipro> EugeneKay: if you're using topology subnet, is there another option required to allow forwarding traffic destined for other subnets
12:54 < Olipro> I added a route to 10.0.0.0/8 through the tun interface on one end, but nothing is seen on the other
12:54 -!- Khas [~AndChat@ewangunn.com] has joined #openvpn
12:54 < EugeneKay> The usual routing options
12:54 < Olipro> or rather, OSPF did, so, good that that's working at least
12:56 -!- yell0 [yello@unaffiliated/contempt] has quit [Remote host closed the connection]
12:56 < Khas> Stupid connection
12:56 < datruth_> Khas: what rom you using for your android vpn? I can't seem to find the tun adapter anywhere
12:57 < Khas> Cm7
12:57 < datruth_> ahh
12:57 < datruth_> built in vpn configuration?
12:58 < Khas> Sort of. Using the built in drivers, with openvpn-settings
12:58 < Khas> !android
12:58 <@vpnHelper> "android" is (#1) CyanogenMod includes an integrated OpenVPN client. You will need a !p12 to load your certificates. or (#2) If you can't get CM, get root/busybox/tun and grab android-openvpn-installer + openvpn-settings from Market
12:58 < datruth_> hrmm
12:58 < EugeneKay> If you don't have CM, you need to get a tun driver for your kernel. XDA oughta have it.
12:58 < datruth_> where can I get /root/busybox/tun?
12:58 < EugeneKay> But XDA is lulz
12:59 < Khas> Haha yes
12:59 < datruth_> I take it the tun driver will work with any kernel?
12:59 < EugeneKay> No.
12:59 < datruth_> damn
12:59 < EugeneKay> "for your kernel"
12:59 < Khas> Anyway, yeah, any reason push options aren't sent to android? Are they just windows options?
13:00 < EugeneKay> Khas - IIRC openvpn-settings will log. Turn up verb to 5, connect, and then pastebin it.
13:00 < datruth_> Khas: the push options work all my clients on linux/mac and windows
13:00 < EugeneKay> I *believe* you can set the log option in the CM client too, via the advanced config
13:00 < Khas> Ok. be right back then :-) 
13:00 -!- Khas [~AndChat@ewangunn.com] has quit [Read error: Connection reset by peer]
13:01 < EugeneKay> Gah, damnit, I found a typo in CM, and I don't have a build environment handy.
13:01 < EugeneKay> So I can't submit a damned patch
13:01 < datruth_> ;/
13:02  * datruth_ wonders if his nook could connect to th evpn
13:05 -!- Khas [~AndChat@ewangunn.com] has joined #openvpn
13:06 < Khas> So where would the logs be?
13:06 < EugeneKay> Wherever you set --log to be ;-)
13:06 < EugeneKay> I think it defaults to logcat
13:07 < Khas> Ta. What's the path for logcat again?
13:08 < EugeneKay> -_-
13:09 < EugeneKay> http://developer.android.com/guide/developing/tools/adb.html#logcat
13:09 <@vpnHelper> Title: Android Debug Bridge | Android Developers (at developer.android.com)
13:10 < Olipro> EugeneKay: mmm, with topology subnet, any packet with a destination outside of the VPN's subnet is never received
13:10 < EugeneKay> Sounds like you're routing it wrong
13:10 < Khas> Or firewall
13:11 < EugeneKay> Olipro isn't the type to use protection
13:11 < Khas> I'll check logcat when I get home, easier than on the phone
13:11 < Olipro> nope, not the routing
13:11 < Khas> Haha
13:12 < EugeneKay> Just set --log /sdcard/openvpn.log in your conf
13:12 < Olipro> ip route add 10.0.0.1 via 192.168.0.8 dev ukvpn
13:12 < Olipro> tcpdump on 192.168.0.8 shows the packet is never received
13:12 < EugeneKay> Are you using client-to-client ?
13:13 < Olipro> yes
13:13 < Olipro> I need iroute
13:13 < EugeneKay> iroute works fine without it
13:13 < Olipro> no no, the issue with this is OpenVPN itself
13:13 < EugeneKay> (AFAIK, anyway... lemme read the man page on it...)
13:14 < Olipro> the route is correct, but OpenVPN has no idea who the packet should go to
13:14 < EugeneKay> Hm.
13:14 < Olipro> you need iroute to create an internal route so OpenVPN knows what to do with packets destined for stuff outside of the tunnel subnet
13:16 < Olipro> or... I could just disable client-to-client, probably
13:17 < EugeneKay> Man page does indeed say --iroute works in conjunction with --client-to-client..... but my config works fine with iroute sans --client-to-client, so I dunno.
13:17 < EugeneKay> Try it and see what explodes
13:18 < Olipro> using iroute if you're not using client-to-client should be unnecessary
13:18 < Olipro> since there's only one possible physical endpoint a packet could be destined for; providing the kernel knows to send it to the tunnel interface, that should be sufficient
13:19  * EugeneKay runs through that in his head
13:20 < EugeneKay> Wouldn't openvpn still need to know which client to send it to somehow? Or is that handled by the fact that its routed "via 10.8.0.2"
13:21 -!- dazo_afk is now known as dazo
13:22 < EugeneKay> Oh, and without --iroute yu would still get a route pushed to that client for its own LAN
13:22 < EugeneKay> Which would be bad juju
13:23 < Olipro> right, if you've got multiple clients and you're just doing away with client-to-client to stop them talking to eachother, sure
13:25 < EugeneKay> I'm too hungover to be thinking this hard
13:25 < datruth_> lol
13:25 < Olipro> it'd arguably be better if the OpenVPN process would just check the routing table to see where it should go
13:25 < Olipro> the "via" that you specify to the kernel for routing a particular subnet is lost since a tun interface has no upper layer
13:27 < Olipro> would certainly beat having to reload OpenVPN whenever you add a new route
13:36 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
13:40 -!- Khas [~AndChat@ewangunn.com] has quit [Remote host closed the connection]
14:12 -!- happylife [~happylife@46.251.83.126] has quit [Ping timeout: 258 seconds]
14:32 -!- gyyrog [~gyyrog@99.54.136.50] has joined #openvpn
14:43 -!- gyyrog [~gyyrog@99.54.136.50] has quit [Remote host closed the connection]
14:43 -!- r1ppa [~McBoingBo@mail.hrsg.ca] has joined #openvpn
14:44 < r1ppa> is it not ideal to delete a users certificate once they are removed from the company, the policy here seems to be to revoke, any ideas why revoke is safer/better?
14:45 <@vpnHelper> RSS Update - forum: Push dhcp-options for Android. <http://forums.openvpn.net/topic9119.html#p17868>
15:07 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
15:29 -!- _julian [~quassel@hmbg-5f760284.pool.mediaWays.net] has joined #openvpn
15:29 -!- Ionic [ionic@ionic.de] has joined #openvpn
15:32 -!- _julian_ [~quassel@hmbg-4d06ddd0.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
15:35 -!- _julian [~quassel@hmbg-5f760284.pool.mediaWays.net] has quit [Read error: Operation timed out]
15:36 -!- _julian [~quassel@hmbg-4d06c38b.pool.mediaWays.net] has joined #openvpn
15:36 < krzee> r1ppa, well
15:37 < krzee> when you revoke the cert no longer even passes ssl tests
15:37 < krzee> so it gets rejected earlier in the session than, say, --disable in a ccd entry
15:37 < krzee> if you're going to consider the certificate as "dirty" you revoke it
15:37 < krzee> lost, stolen, etc
15:38 < krzee> i would reject it if the person was fired
15:38 < krzee> if the person is seasonal, i would use --disable
15:38 < krzee> instead of revoking / reissuing each time you bring him back
15:39 < krzee> if we assume there is bugs in openvpn, but we just have not found them... then revoking should be the safest
15:48 < r1ppa> thanks!
15:48 < EugeneKay> I need a DVD case.
16:03 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
16:06 -!- kenyon [~kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 244 seconds]
16:07 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
17:02 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:13 -!- Netsplit *.net <-> *.split quits: havoc, datruth_, vpopov, gffa, Nowak, oc80z
17:13 -!- Netsplit *.net <-> *.split quits: tty234, Dougy, _zero_, g0d, nifiga, zalzice, MrPPS, EugeneKay, @dazo, Rolybrau,  (+62 more, use /NETSPLIT to show all of them)
17:13 -!- Netsplit *.net <-> *.split quits: RichardBronosky, MrWGW, vadimq_, mick_laptop, deever, cali_, +novaflash
17:14 -!- Netsplit over, joins: Tick-Tock, bauruine, kenyon, Ionic, r1ppa, Rolybrau, EugeneKay
17:14 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
17:14 -!- Netsplit over, joins: kyrix, krzee, ScriptFanix, Olipro, |Mike|, dupondje, Apocryphe, rsc, jhp, Xeross (+49 more)
17:15 -!- Netsplit over, joins: +novaflash, _julian, Dweezahr, vadimq_, g0d, JG84|Busy, cali_, mick_laptop, deever, RichardBronosky (+8 more)
17:15 -!- JG84|Busy [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Quit: У меня есть более важные дела, чем холостой здесь.]
17:16 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:16 -!- JoeGazz84 [~JoeGazz84@wikimedia/Joe-Gazz84] has joined #openvpn
17:21 -!- JoeGazz84 is now known as JG|Dinner
17:26 -!- vtcN- [~vtcN@unaffiliated/thethe] has quit [Remote host closed the connection]
17:30 -!- novaflash is now known as novaflash_away
17:31 -!- dazo is now known as dazo_afk
18:01 -!- kyrix [~ashley@mk046207255007.a1.net] has quit [Quit: Ex-Chat]
18:08 -!- Dweezahr [~Dweezahr@flits102-34.flits.rug.nl] has quit [Ping timeout: 276 seconds]
18:09 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html>
18:39 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:50 -!- Denial [Denial@drgi.co.uk] has quit []
19:32 -!- adolfomaltez [~taro@190.62.214.63] has joined #openvpn
19:41 -!- JG|Dinner is now known as JG84|Busy
19:48 -!- _julian_ [~quassel@hmbg-5f7645fa.pool.mediaWays.net] has joined #openvpn
19:52 -!- _julian [~quassel@hmbg-4d06c38b.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
19:55 -!- diffen3 [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:56 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 244 seconds]
20:24 -!- nb is now known as nb--
20:24 -!- nb-- is now known as nb-_
20:28 -!- nb-_ is now known as nb
20:38 -!- JG84|Busy [~JoeGazz84@wikimedia/Joe-Gazz84] has quit [Changing host]
20:38 -!- JG84|Busy [~JoeGazz84@TechEssentials/JoeGazz84] has joined #openvpn
20:53 -!- JG84|Busy is now known as JG84|36HRDND
20:56 -!- adolfomaltez [~taro@190.62.214.63] has quit [Ping timeout: 240 seconds]
21:12 -!- adolfomaltez [~taro@190.62.225.58] has joined #openvpn
21:22 <@vpnHelper> RSS Update - forum: OpenVPN: Keeps restarting and/or Connection timeout <http://forums.openvpn.net/topic9214.html#p17870>
21:25 -!- _julian [~quassel@hmbg-5f766fe9.pool.mediaWays.net] has joined #openvpn
21:27 -!- _julian_ [~quassel@hmbg-5f7645fa.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
21:27 <@vpnHelper> RSS Update - forum: Installing OpenVPN server on Windows <http://forums.openvpn.net/topic9271.html>
21:45 -!- master_of_master [~master_of@p57B5556E.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
21:46 -!- master_of_master [~master_of@p57B521A9.dip.t-dialin.net] has joined #openvpn
22:45 -!- gyyrog [~gyyrog@99.54.136.50] has joined #openvpn
22:52 <@vpnHelper> RSS Update - forum: Help PLease....connected but can't browse <http://forums.openvpn.net/topic8788.html#p17872>
23:34 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
23:34 -!- adolfomaltez [~taro@190.62.225.58] has quit [Ping timeout: 260 seconds]
23:38 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
23:38 -!- ph1l2 [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
23:39 -!- ph1l3 [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
23:42 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 244 seconds]
23:42 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
23:42 -!- ph1l2 [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 245 seconds]
23:57 -!- ph1l3 [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
--- Day changed Fri Nov 25 2011
01:09 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
01:20 -!- Dweezahr [~Dweezahr@flits102-34.flits.rug.nl] has joined #openvpn
01:28 <@vpnHelper> RSS Update - forum: Connection not routing through VPN <http://forums.openvpn.net/topic9262.html#p17873>
01:42 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 260 seconds]
02:08 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has joined #openvpn
02:09 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:18 -!- spditner [~simon@206-248-134-157.dsl.teksavvy.com] has quit [Ping timeout: 245 seconds]
02:20 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
02:30 -!- diffen3 [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
02:40 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:44 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
02:46 <@vpnHelper> RSS Update - forum: Installing OpenVPN server on Windows <http://forums.openvpn.net/topic9271.html#p17875> || OpenVPN: Keeps restarting and/or Connection timeout <http://forums.openvpn.net/topic9214.html#p17874>
03:22 -!- vadimq_ [~vadim@76.Red-80-32-164.staticIP.rima-tde.net] has left #openvpn []
03:34 -!- h8R [~niko@pppoe-132-148.ssi.bg] has joined #openvpn
03:35 < h8R> Hello. Anybody has a snippet for firehol.conf on how to forward port on vpn server to a client?
03:47 < Olipro> can openvpn have two separate connections that feed into the same tap interface?
03:52 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
03:52 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
03:52 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:52 < h8R> Olipro, not sure that i understand your question, but I have several clients on single openvpn server
03:53 < Olipro> it's more of a curiousity
03:53 < Olipro> since tap operates at the ethernet level
03:53 < Olipro> you could have separate OpenVPN instances feeding into a single tap device
03:56 < h8R> not sure, maybe some one more advanced will help you
04:05 <@vpnHelper> RSS Update - forum: Access to Server failed <http://forums.openvpn.net/topic9272.html>
04:13 -!- novaflash_away is now known as novaflash
04:16 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
04:17 <@vpnHelper> RSS Update - forum: Openvpn is setup properly but does not connect <http://forums.openvpn.net/topic9269.html#p17877>
04:20 -!- spditner [~simon@206-248-134-157.dsl.teksavvy.com] has joined #openvpn
04:21 -!- dazo_afk is now known as dazo
04:23 <@vpnHelper> RSS Update - forum: Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17879> || W7Server - Embedded Linux GSM Router <http://forums.openvpn.net/topic9237.html#p17878>
04:51 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has joined #openvpn
04:51 -!- Carbon_Monoxide [~cm@061093232225.ctinets.com] has quit [Read error: Connection reset by peer]
05:03 -!- gyyrog [~gyyrog@99.54.136.50] has quit [Remote host closed the connection]
05:48 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
05:50 -!- Gnewt_ is now known as Gnewt
06:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
06:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:07 -!- ravel_exe [ravel_exe@175.142.202.9] has joined #openvpn
06:30 <@vpnHelper> RSS Update - forum: Installing OpenVPN server on Windows <http://forums.openvpn.net/topic9271.html#p17880>
06:34 -!- carbon_monoxide_ [~cm@061093232225.ctinets.com] has quit [Quit: Leaving]
06:36 <@vpnHelper> RSS Update - forum: Openvpn between two computers in the same network <http://forums.openvpn.net/topic8908.html#p17882> || Windows 7 64 bit Installation Fails OpenVPN 2.2.1 <http://forums.openvpn.net/topic8440.html#p17881>
06:39 -!- adolfomaltez [~taro@190.62.225.58] has joined #openvpn
06:42 <@vpnHelper> RSS Update - forum: Push dhcp-options for Android. <http://forums.openvpn.net/topic9119.html#p17883>
06:44 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:48 <@vpnHelper> RSS Update - forum: How To Control DHCP Lease In OpenVPN <http://forums.openvpn.net/topic9273.html> || Installing OpenVPN server on Windows <http://forums.openvpn.net/topic9271.html#p17885> || Access to Server failed <http://forums.openvpn.net/topic9272.html#p17884>
06:55 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
06:56 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
06:56 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
07:00 <@vpnHelper> RSS Update - forum: Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17887>
07:06 <@vpnHelper> RSS Update - forum: Installing OpenVPN server on Windows <http://forums.openvpn.net/topic9271.html#p17890> || How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17889> || Bridging with only external IP <http://forums.openvpn.net/topic9268.html#p17888>
07:09 -!- corretico [~luis@201.201.44.82] has joined #openvpn
07:13 -!- ravemaster [~researche@184.22.194.198] has joined #openvpn
07:19 -!- ravemaster [~researche@184.22.194.198] has quit []
07:25 -!- adolfomaltez [~taro@190.62.225.58] has quit [Remote host closed the connection]
07:30 <@vpnHelper> RSS Update - forum: Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17891>
07:33 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
07:36 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 248 seconds]
07:40 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
07:40 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:51 <@vpnHelper> RSS Update - forum: Server generates 'status=1' when pushing routes <http://forums.openvpn.net/topic9274.html>
08:16 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:52 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
08:58 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
09:02 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
09:02 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
09:05 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
09:05 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
09:05 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:05 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
09:06 < FeileX> Good morning all.
09:06 < FeileX> Wondering if anyone might have some sugestions for me.
09:07 < FeileX> I currently have 5 servers hosted with rackspacecloud. I have recently brought up another server, and made it into an openvpn box.
09:07 < FeileX> Good news is, OpenVPN works exactly like I expect it to.  :)
09:08 < FeileX> Bad news, I cant seem to figure out how i want to configure it. :P
09:08 < EugeneKay> Verrrry carefully.
09:08 < EugeneKay> !goal
09:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:08 < FeileX> A short blurb on RSC, I get 2 IPs, one external, one internal.
09:08 < FeileX> hmm, lets try that...
09:09 <@vpnHelper> RSS Update - forum: WHS install, having trouble generating client keys... <http://forums.openvpn.net/topic9275.html>
09:09 < FeileX> !goal I want to have dns pushed to clients, read from the /etc/hosts file
09:10 < FeileX> I guess it doesnt have to be read from the hosts file, it could be configured, I just dont know exactly what I need
09:10 < EugeneKay> You can push dns servers(to windows clients, mostly), but not specific hosts entries
09:10 < EugeneKay> !dns
09:10 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
09:10 < EugeneKay> !pushdns
09:10 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
09:10 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
09:11 < FeileX> in the past, I have just manually updated each servers hosts file with the name and internal IP
09:11 < EugeneKay> What are you running the VPN between? Your rackspace boxen?
09:11 < FeileX> that worked, for pc to pc inside the cloud, but not for entries via VPN
09:12 < FeileX> Home PC -> VPN box (In cloud) 
09:12 < EugeneKay> AH okay, that makes sense.
09:12 < EugeneKay> So your problem is chiefly DNS-based.
09:12 < FeileX> VPN maskurades 172.x data to the 10.180 internal network
09:13 < FeileX> so I can activly ping, ssh, browse to 10.180.xxx.xxx (web server), or sql server or ......
09:13 < EugeneKay> My advice is to create a subdomain called internal.yourdomain.com, and just make that part of the public DNS infrastructure.
09:13 < FeileX> as long as i know it;s IP
09:13 < FeileX> public to the world, or public the boxes I own.
09:13 < FeileX> DNS is not my forte
09:14 < FeileX> if you have any doc/reading recomendations, I'd love those too
09:14 < EugeneKay> TO the world. The address will remain inside of a private block.
09:14 < FeileX> hmm, I dont follow
09:14 < EugeneKay> `dig gateway.private.ca.khresear.ch`
09:15 < EugeneKay> That's my gateway server on my Private network at my CA site.
09:15 < FeileX> So, I register web001.internal.foo.com ...... ahhh
09:15 < FeileX> interesting
09:16 < FeileX> so even though someone could dig at it, there is no way they could ever get to it, cuz its un-routable to the world
09:16 < EugeneKay> Right. 
09:16 < EugeneKay> You should still firewall it properly at the edge router, mind.
09:16 < FeileX> So, do you own the HW in that or are some of thsoe cloud based?
09:17 < EugeneKay> Colo, I own it all except the rack itself(which I rent).
09:17 < FeileX> IE, do you think it would be feasible to run some sort of dns server/service to handle anything like that, or just manually edit the dns zones for the domain?
09:17 < FeileX> *for me to run*
09:18 < EugeneKay> How are you doing DNS now?
09:18 < EugeneKay> cPanel somewhere? or running BIND?
09:18 < FeileX> */etc/hosts  :)
09:18 < EugeneKay> Ew ew ew :-p
09:18 < FeileX> lol yea
09:18 < FeileX> the IPs i get in the cloud are static, so I never though about running anything like that
09:18 < EugeneKay> You don't have a cpanel somewhere for yourdomain.com ?
09:18 < FeileX> nope.
09:19 < EugeneKay> Lawdy. 
09:19 < EugeneKay> Well, get one.
09:19 < EugeneKay> A domain, that is.
09:19 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17894>
09:19 -!- Khas [95ff6337@gateway/web/freenode/ip.149.255.99.55] has joined #openvpn
09:19 < FeileX> I have a domain
09:19 < Khas> Afternoon all :-)
09:19 < EugeneKay> Well then it should have a panel attached
09:19 < FeileX> Ahh, you mean like the dns zones and such
09:20 < Khas> EugeneKay: do you do any work? ;-P
09:20 < EugeneKay> Aye
09:20 < EugeneKay> Khas - all the time.
09:20 < FeileX> yea, I have that.
09:20 < EugeneKay> Just add records in that
09:20 < FeileX> ok
09:20 < EugeneKay> What's the provider on it?
09:20 < FeileX> rackspacecould
09:20  * EugeneKay ews some more, but OK
09:20 < FeileX> orly?
09:20 < FeileX> reasons why?
09:21 < EugeneKay> <3 Linode
09:21 < FeileX> ahh
09:21 < EugeneKay> Chiefly, price
09:21 < EugeneKay> Secondly, performance.
09:21 < Khas> Sounds like someone is trying to do what I've done.
09:21 < EugeneKay> http://journal.uggedal.com/vps-performance-comparison/
09:21 <@vpnHelper> Title: Journal of Eivind Uggedal (at journal.uggedal.com)
09:22 < EugeneKay> tl;dr Linode kicks everybody else's ass.
09:22 < Khas> My god, Linode is shite compared to mine
09:23 < FeileX> ahhh crap.. i started a pissing match...  :P
09:23 < Khas> No, I'm just suprised
09:24 < Khas> I must have got a good deal
09:24 < EugeneKay> Post benchmarks or gtfo :-p
09:24 < Khas> Yeah, I'm reading that bit now, think I will do some at some point
09:24 < Khas> I meant even the package stuff for the price I get
09:24 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:26 < EugeneKay> I've found that Linode isn't the cheapest, but they are the best overall - performance, reliability, support, attitude.
09:26 < FeileX> very cool
09:26 < EugeneKay> But enough trying to convert you..... just go add the internal records to your DNS panel.
09:27 < FeileX> Eugene, back to the question of dns...
09:27 < EugeneKay> It probably doesn't have a subdomain feature per se, but you can do it by adding "web001.internal" (instead of "web001") as an A record
09:27 < FeileX> if I add web001.private.foo.com, is there anyway I can setup my windows client to access it by just its hostname?
09:28 < FeileX> Umm, yea, i have full subdomains
09:28 < FeileX> i have about 8 right now.
09:28 < EugeneKay> Ah, goody.
09:28 < FeileX> trac.  svn.  mail.  ....
09:28 < Khas> You trying to set up outside access to your VPN clients?
09:28 < EugeneKay> If foo.com is ap ublically accessible domain, you should be able to look up that internal address anywhere.
09:29 < FeileX> right, but if i wanted to do a ping web001, rather than ping web001.private.foo.com
09:29 < EugeneKay> Ah,t hat's a Windows setting
09:29 < FeileX> or is that just asking to much?
09:29 < FeileX> lol
09:29 < EugeneKay> You need to configure DNS Search Domains
09:29 < Khas> Wouldn't that just use client-to-client?
09:29 < Khas> Ahhh
09:29 < Khas> Hateful things, that buggers up windows for me.
09:30 < Khas> If i set the search domain, it will append it to every DNS request.
09:30 < Khas> google.com.mydomain.com
09:30 < EugeneKay> Open up network connection, properties(any connection), IPv4 TCP/IP, Advanced, DNS tab.
09:30 < EugeneKay> Choose "append these suffixes(in order)"
09:30 < EugeneKay> Add the domains you'd like it to search when given an unqualified domain name.
09:30 < FeileX> got it
09:30 -!- sp00fz [~sp00fz@88.200.89.222] has joined #openvpn
09:31 < Khas> EugeneKay: isn't it easier to push it with a DHCP option on the server?
09:31 < FeileX> seems easier than having the rest of the dev team edit thier windows hosts file
09:31 < EugeneKay> I don't think you /can/ push that option.
09:31  * EugeneKay look
09:31 < Khas> You can indeed :-D
09:31 < Khas> DOMAIN
09:31 < Khas> That's how I know it buggered up my windows DNS lookups to my DNS server lol
09:31 < EugeneKay> Ah, yes you can
09:31 < EugeneKay> Yup
09:32 < EugeneKay> --dhcp-optiion DOMAIN private.example.com
09:32 < EugeneKay> -i
09:32 < FeileX> https://community.openvpn.net/openvpn/ticket/86 ?
09:32 <@vpnHelper> Title: #86 ([win32/win64] push "dhcp-option DOMAIN" adds suffix to the tun adapter) – OpenVPN Community (at community.openvpn.net)
09:33 < Khas> Haha
09:33 < EugeneKay> I dunno about that, I'm going by the man page
09:33 < EugeneKay> !man
09:33 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
09:33 < Khas> Why am I not surprised it's MS not implementing standards.
09:33 < EugeneKay> !windows
09:33 <@vpnHelper> "windows" is (#1) pcs are like air conditioners, they work fine unless you open windows or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
09:34 < Khas> Hahaha
09:34 < EugeneKay> Try it, see if it works.
09:34 < FeileX> #2 made me spit coffee on the keyboard....
09:34 < FeileX> yea, trying now.
09:34 < FeileX> well, as soon as the zones probogate
09:34 < FeileX> errr
09:34 < EugeneKay> If so, makes your life easy. If not, do it the hard way.
09:34 < FeileX> wow
09:34 < FeileX> i cannot spell today
09:35 < EugeneKay> Close enough.
09:35 < Khas> It does work, but you'll find the problem that it'll append it to -every- DNS request.
09:35 < Khas> I'm still trying to figure out a way round it, but from that bug it looks fubared.
09:36 < FeileX> Another question for you guru's.... 
09:36 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 244 seconds]
09:36 < FeileX> what kinda speed reduction might I see if I VPN all of my servers to the vpn box...
09:37 < Khas> I have some string here...
09:37 < Khas> Care to estimate its length? ;-)
09:37 < FeileX> IE, not have ssh / mysql / memcached bound to eth1, but to tun0
09:37 < FeileX> hmm
09:37 < EugeneKay> CPU usage will go up.
09:37 < EugeneKay> You'll get a few ms on every request
09:38 < FeileX> maybe ssh and mysql are bad examples...
09:38 < FeileX> those are both secure channels already
09:38 < EugeneKay> If you have a Private LAN for those boxen, just use that.
09:38 < Khas> I redirect all traffic through my VPN, and it's noticably slower.
09:38 -!- kyrix [~ashley@mk046207255200.a1.net] has joined #openvpn
09:38 < FeileX> its private... to the world, but still visiable to all of the other host accounts on RSC
09:39 < EugeneKay> Gotcha.
09:39 < EugeneKay> So it's just an unrouted LAN
09:39 < EugeneKay> Hm.
09:39 < FeileX> ye
09:39 < FeileX> a
09:39 < Khas> h
09:39 < Khas> ;-)
09:39 < EugeneKay> WHAT
09:39 -!- sp00fz [~sp00fz@88.200.89.222] has quit [Quit: Leaving]
09:39 < Khas> !dns
09:39 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
09:40 < Khas> !privoxy
09:40 < Khas> hmm
09:40 < EugeneKay> I've not thought bout that use case much, as I own my whole private net :-p
09:41 < FeileX> nice.
09:41 < FeileX> we could do that... it just gets a bit spendy
09:41 < EugeneKay> Aye
09:41 < FeileX> for a startup, 5 servers, costs us about 120 a month, 2 1gb, 2 512, and 1 256 (vpn box)
09:41 < EugeneKay> I guess you could do it over OpenVPN, but you will see a good bit of CPU usage(pick one of the "cheaper" ciphers for the lan openvpn), and a ms or two on each request.
09:42 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
09:42 < FeileX> the deeper I get into the vpn rabit hole, the more I like it...
09:42 < EugeneKay> I *think* Linode's private IPs are on a dedicated VLAN, but I'm not 100% sure.
09:42 -!- kralor [~kralor@hackincorp.net] has joined #openvpn
09:43 < EugeneKay> (asking #linode right now)
09:43 < Khas> FeileX: tell me about it
09:43 < Khas> At the moment I'm trying to set up a transparent privoxy server so that all HTTP requests are stripped of ads and tracking cookies etc.
09:43 < Khas> After that, I'll be setting up tor
09:44 < Khas> So all I need to do is connect a client to the VPN server, and viola, instant anon and privacy on t'interwebs.
09:44 < FeileX> ahhh privacy  :)
09:44 < Khas> Yup :-)
09:44 < Khas> Can never get perfect privacy, but always worth trying for
09:45 < FeileX> Ok, so not knowing a lot about DNS records (CNAME/A)... do I want the private subdomain to be its own A name, or make it a CNAME off of foo.com?
09:45 < EugeneKay> Ah nope, Linode private addresses are shared.
09:45 < Khas> Problem is trying to find out how to bloody do it.  I could use bind with fake DNS entries for ad servers, but that's doesn't help with cookies etc.  But privoxy runs as an actual proxy, which would require further config on the client side, which I don't want.
09:46 < EugeneKay> Unless it gives you the option of making private.example.com it's own zone, you don't need/want to create a record for it at all.
09:46 < Khas> FeileX: what are you trying to achieve?
09:46 < EugeneKay> Only the hosts within private.example.com
09:46 < FeileX> ok, I'll fidle around a bit
09:47 < Khas> It sounds awfully familiar to something I want to do.
09:47 < EugeneKay> He's setting up developer access to a LAN via the vpn
09:48 < EugeneKay> Just a --push "route 10.0.0.0 255.255.255.0" and off you go
09:48 < Khas> Yeah, sounds like what I want to do.
09:48 < FeileX> yup, at least thats the goal.... I want to make it as simple as possible.
09:49 < Khas> The solution I've been investigating is to use a layer 2 openvpn config, then use dnsmasq to dynamically keep track of vpn clients, and update dns so I can call 'host.mydomain.com'
09:49 < Khas> Where host is a vpn client
09:49 < EugeneKay> Ugh, that's daft.
09:49 < FeileX> nice
09:50 < Khas> EugeneKay: too many firewalls kicking around in between :-(
09:50 < FeileX> but, i dont have any reason to allow dev1 access to dev2's pc
09:50 < EugeneKay> You should either statically assign VPN IPs(via a ccd entry), or use a script to do the dyndns update.
09:50 < Khas> Can I do mac->vpn ip addressing?
09:50 < EugeneKay> !static
09:50 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
09:51 < EugeneKay> It's based upon the common name of the client
09:51 < Khas> Hmm.
09:51 < Khas> Might look in to that.
09:51 < Khas> But first I want to get the whole server working as I'd like.
09:51 < Khas> Then I can start optomising if necessary
09:51 < Khas> Especially with correct spelling.
09:52 < EugeneKay> Grammer is overated
09:52  * Khas silently rages.
09:52 < EugeneKay> If you want to do it scripting, you'll want the --client-connect hook.
09:52 < Khas> Oh hold on
09:52 < Khas> ffs
09:53 < Khas> I can set up privoxy as a proxy, and then just use iptables to redirect any port 80 outbound requests to the privoxy port.
09:53 < Khas> I am a mong.
09:53 < EugeneKay> Yes, you are.
09:55 < Khas> Thanks hun.
09:55 < FeileX> !pushdns
09:55 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
09:55 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
09:57 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Read error: Connection reset by peer]
10:00 < FeileX> ok, so I have the A name setup, and have set the push domain option in my config file
10:01 < FeileX> I can access resources by apollo.private.example.com
10:02 < FeileX> but, apollo by itself still doesnt work.... I am guessing thats the windows bug
10:02 < FeileX> I'm gonna try that add extention option
10:02 < EugeneKay> Yeah. Windows is the gay gay gay.
10:02 < EugeneKay> I hope it get some sick.
10:02 < FeileX> yea, well, i have the gay.... 
10:02 < FeileX> and a few of the devs do too
10:02 < FeileX> the others have the mac.... not sure I want to get that either...
10:03 < EugeneKay> No, the other sort :-p
10:03 < EugeneKay> http://uncyclopedia.org/Mr_winkler_is_GAY
10:03 <@vpnHelper> Title: Mr winkler is GAY - Uncyclopedia, the content-free encyclopedia (at uncyclopedia.org)
10:04 < FeileX> lolz
10:04 < FeileX> !pushdomain
10:04 < FeileX> :(
10:04 < FeileX> lol
10:04 < EugeneKay> !man
10:04 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
10:06 <@vpnHelper> RSS Update - forum: Static source code analysis of openvpn <http://forums.openvpn.net/topic9276.html>
10:06 < FeileX> wow... i must be tired....
10:07 < FeileX> the man woman joke just popped into my head....
10:07 < EugeneKay> Oh god wtf is this sstatic code analysis
10:07 < EugeneKay> Kill it with fire!
10:09 < FeileX> hehe
10:10 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
10:15 < danielsh> question.  if box A is outbound-firewalled, box B isn't, box A can ssh to B, and I'd like A's outgoing access to route through B (so as to bypass the firewall),
10:15 < danielsh> can I use openvpn to implement that?  and if so, would I need root on B?
10:16  * danielsh (I can't think of a reason I'd need root on B if I can 'ssh -L' from A to B.)
10:17 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
10:19 -!- ravel_exe [ravel_exe@175.142.202.9] has quit []
10:20 -!- gyyrog [~gyyrog@99.54.136.50] has joined #openvpn
10:21 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
10:21 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
10:21 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
10:24 <@vpnHelper> RSS Update - forum: Use of multiple NIC's <http://forums.openvpn.net/topic9277.html>
10:26 < EugeneKay> Yes, yes.
10:27 -!- spditner [~simon@206-248-134-157.dsl.teksavvy.com] has left #openvpn []
10:28 < FeileX> Khas, you still here?
10:30 < danielsh> EugeneKay: (assuming that was at me) Thanks for the answers.  How would I go about solving the same problem without root on B?
10:30 < danielsh> I have done it before for a single outbound blocked IP/port tuple, 
10:30 < EugeneKay> No idea. Probably involving ssh tunneling.
10:30 < danielsh> via ssh -L x:N:y:M, and virtual interface mapped to x, 
10:30 < danielsh> but that doesn't scale well.
10:31 < EugeneKay> Indeed.
10:32  * danielsh wonders if ssh has a multiplexing limit he might run into...
10:32 < EugeneKay> Probably.
10:32 -!- Tannerbaum is now known as GoHawks
10:33 < FeileX> if you have to ask.... Then invoke rule 34.
10:33 < FeileX> http://www.urbandictionary.com/define.php?term=Rule%2034
10:33 <@vpnHelper> Title: Urban Dictionary: Rule 34 (at www.urbandictionary.com)
10:49 -!- pr0zoid [pr0zoid@24-246-5-196.cable.teksavvy.com] has quit []
10:50 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
10:53 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:53 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:53 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:53 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:54 < FeileX> hmmmm....
10:54 < FeileX> EugeneKay, you still here?
10:54 < EugeneKay> No.
10:54 < FeileX> got a question on "standards"
10:55 < EugeneKay> I don't have any :-p
10:55 < FeileX> given that we have a few devs, and each has his own login name....
10:55 < FeileX> do you think it would be better to generate a key pair for the username, and have them use that on any box they touch (lappy, PC..)
10:56 < FeileX> or build indvidule keys per host name?
10:56 < EugeneKay> I build a pair per box, because it is conceivable to be using multiple at once.
10:56 < FeileX> thats what i was thinking too
10:56 -!- gyyrog [~gyyrog@99.54.136.50] has quit [Remote host closed the connection]
10:57 < EugeneKay> Or if you leave your desktop connected accidentally, you'd have issues with connecting the laptop
10:57 < EugeneKay> Because it would get in a fight with the desktop, each bumping the other.
10:57 < FeileX> any way to make openvpn force the CN == hostname?
10:57 < FeileX> nevermind, that just sounds stupid
10:57 < EugeneKay> !tls-verify
10:57 < EugeneKay> !factoids search tls
10:57 <@vpnHelper> 'tls-cipher' and 'tls-auth'
10:58 < EugeneKay> Bah.
10:58 < EugeneKay> tls-verify lets oyu execute a verification script. You can do whatever you like inside it.
10:58 < EugeneKay> But checking rDNS against the CN will fall over for dynamic remote IPS, so it is in fact, stupid.
10:59 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
10:59 < EugeneKay> For "machine" clients I make the CN equal to their FQDN
11:00 < EugeneKay> For "people" clients, I make it username@mydomain.com/hostname
11:00 < EugeneKay> Wait, o I don't, / isn't allowed.
11:00  * EugeneKay looks up his cert
11:00 < EugeneKay> It's -, not /
11:01 < FeileX> mkay
11:02 < FeileX> I wonder how well that will play with dnsmasq...
11:02  * EugeneKay shrugs
11:03 < EugeneKay> I don't touch it
11:03 < FeileX> I have dnsmasq setup now to "learn" the IPs 
11:03 < EugeneKay> My advice is to statically hand out VPN client IPs via ccd
11:03 < FeileX> so that my logging scripts can say "Connection from 1.2.3.4 -- john.private...."
11:03 < EugeneKay> If you want to have DNS mapping of the private IP block, you'll need to run BIND somewhere.
11:04 < FeileX> mkay
11:05 < FeileX> one last question before i go take a nap....
11:05 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
11:06 < FeileX> Do you see any reason why I couldnt use certs for SSH auth over vpn?
11:06 < EugeneKay> Er, what?
11:06 < datruth_> how can you create certs per box?
11:07 < FeileX> IE, my host box has my pvt key, my server1 has my public key, and I ssh into server1 by vpning over the vpn server?
11:07 < EugeneKay> SSH pubkeys have little-to-nothing to do with SSL PKI auth
11:07 < FeileX> these keys are not the same as the VPN keys
11:07 < EugeneKay> And ssh works just fine via the vpn
11:07 < FeileX> ok
11:08 < FeileX> i have been doing it password wise... figured it was time to move to keys
11:08 < FeileX> only downside to that is not being able to ssh from anywhere... but I do most, if not all of my work from here anyways.
11:09 < EugeneKay> You can leave PasswordAuthentication on ;-)
11:09 < FeileX> yea, I have it locked down to no root, and only my username...
11:09 < FeileX> thats probably safe enough.... I dont plan on being tortured by the CIA for my password....
11:10 < EugeneKay> Why would they need to torture you? Rackspace probably wouldn't even ask for a warrant if they ahd a CIA badge.
11:10 < FeileX> gp
11:11 < EugeneKay> Not that it's something you should be worried about, unless you're planning to blow up $GOVT_BUILDING or sell kiddy porn.
11:11 < FeileX> then again, all of the charges are paid by a shell corperation, funded by a non profit, from pre-paid credit cards
11:11 < FeileX> nah, mostly just staying away from all of those damn dict attacts
11:11 < EugeneKay> Meh, those shenanigans will only attract the attention of the IRS, and only if you don't give them any money.
11:12 < EugeneKay> So long as they get their cut, they're happy.
11:12 < FeileX> but my password is alpha numeric, with 16+ chars, so i figure I'm fine
11:12 < EugeneKay> !@*% help :-p
11:12 < FeileX> its just the thing of.... you think you are fine, until you're not
11:12 < EugeneKay> Ayup.
11:12 < FeileX> yea, but repeated twice.  :P
11:13 < EugeneKay> An easy way to deal with dict attacks is to move SSH off :22
11:13 -!- SOG [~SOG@168.70.16.99] has joined #openvpn
11:13 < FeileX> yea, thats a good idea too.  but that breaks standards... ;)
11:13 < EugeneKay> pfffft. SRV records are there for a reason
11:14 < EugeneKay> No SSH client /uses/ them, but it's standards compliant ;-)
11:14 < FeileX> lol true
11:16 < FeileX> well thank you for your help.  :)  doubt I could have figured it all out on my own.
11:16 < FeileX> at least not all in one night
11:18 < datruth_> EugeneKay: can you point me to some docs about creating certs per box?
11:18 < EugeneKay> datruth_ - not sure what you mean. YOu just create a cert.
11:18 < datruth_> oh no way to bind it to the machine only?
11:19 < EugeneKay> tls-verify with some regex magic on the CN, if it has static IPs and valid rDNS
11:20 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 240 seconds]
11:20 < datruth_> hrmm ok i already use tls-verify to check the common name before they can connect fully
11:21 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
11:23 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
11:24 < EugeneKay> remote-verify-eku is one I found that works nice.
11:24 < EugeneKay> I sign my vpn certs with IPsec Tunnel / IPsec Client extended usage(in addition to the normal Server / Client usage)
11:25 < datruth_> sounds complicated is the ipsec tunnel seperate from openvpn?
11:26 < EugeneKay> It's just a x509 flag.
11:26 < EugeneKay> --remote-verify-eku on the server and client sides is used to check for the presence of the flag on the certificate, in addition to the CA checks
11:27 < EugeneKay> I use it to ensure that the certs are actually from my VPN Intermediate CA
11:27 < EugeneKay> (no other certificates have those usages marked)
11:28 < datruth_> hrmm
11:29 < datruth_> so if I enable that on my server would it need to be enabled on the client side to?
11:29 < datruth_> how can I find out the digital signature of my cert?
11:30 < EugeneKay> openssl x509 -text -in your.crt
11:30 < EugeneKay> Look at the Extended Key Usage section
11:31 < datruth_> TLS Web Client Authentication
11:32 < EugeneKay> Yeah, so you'd need to make up fresh certs
11:32 < EugeneKay> (as expected, I did this special :-p)
11:32 < datruth_> I take it it's not supposed to say that?
11:33 < EugeneKay> No, what you have is the default
11:33 < EugeneKay> For the eku stuff I'm talking about you'll need a fresh cert which also has the IPsec usages listed
11:34 < datruth_> Can you point me to how I can create a cert like that?
11:34 < datruth_> currently i am using .p12 style certs
11:35 < EugeneKay> I do it with XCA. Not sure what fields you'd need to play with in openssl.cnf to do it.
11:38 < datruth_> hrmm damn
11:40 < datruth_> where can I get xca from then?
11:40 < EugeneKay> First result on google.
11:41 < datruth_> ahh graphical stuff
11:41 < EugeneKay> Yup. Clicky clicky.
11:42 < datruth_> so I guess xca must change openssl.cnf for that?
11:43 < datruth_> and do I have to run xca on the same server the vpn is on?
11:44 < EugeneKay> No idea what it's doing under the hood. I run it on a non-networked laptop.
11:45 < datruth_> hrmm ok perhaps I'll install it on my my ubuntu laptop
11:45 < datruth_> after your done you just move the certs to the server i take it?
11:45 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
11:46 < EugeneKay> Yup.
11:46 < datruth_> Are you using templates?
11:46 < datruth_> ahh I think yes
11:48 -!- SOG [~SOG@168.70.16.99] has quit [Ping timeout: 252 seconds]
11:48 < EugeneKay> Yup.
11:49 < EugeneKay> I should export them one of these days.
11:49 < datruth_> now I just need to get a template going that will create .p12 certs with that extra layer of security
11:49 < EugeneKay> .p12 you do via exporting the cert
11:49 < EugeneKay> Choose PKCS #12 format
11:49 < datruth_> I guess i'll have to wipe all my certs and start fresh from xca
11:49 < EugeneKay> Nope, it imports great.
11:49 < datruth_> oh
11:50 < datruth_> so I don't need to create another ca / server cert
11:50 < datruth_> ?
11:50 < EugeneKay> Correct. Just import your certs and keys.
11:50 < datruth_> oh just for the user or everything?
11:50 < EugeneKay> Whatevr you'd like to XCA manage :-p
11:51 < EugeneKay> I would advise importing your CA key and all certs.
11:51 < EugeneKay> You have to mark the CA cert as "trusted"(right click, hunt around for it), and then it'll let you manage CA stuff(including CRL generation!)
11:52 < datruth_> hrmm
11:52  * datruth_ downloads his certs
11:52 < datruth_> good thing im the only user atm
11:52 < EugeneKay> I do all of my key generation inside XCA, so all my keys are kept there.
11:53 < EugeneKay> There's a few servers I have(Netapps, rawr) which will only spit out a CSR, so I have to import+sign those.
11:53 < EugeneKay> A lil roundabout, but hey, it works!
11:54 < datruth_> hrmm
11:55 < datruth_> do I need to create a template before I import?
11:55 < EugeneKay> Nope.
11:55 < EugeneKay> You do need to save a Database, though
11:55 < datruth_> yeah I got that
11:56 < datruth_> certs tab and import?
11:56 < EugeneKay> Yup
11:56 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 245 seconds]
11:57 < datruth_> do I import the keys to?
11:59 < EugeneKay> If you want to manage them with XCA(create new certs using those same keys), yes.
12:00 < datruth_> so then I wouldn't need to import the .crt's just the keys?
12:01 < EugeneKay> YOu should import all the crts, so you can revoke them if need be.
12:01 < datruth_> its just me and the server
12:01 < EugeneKay> Then laod up everything :-p
12:03 < datruth_> ok so I have everything imported now do I need to create a template?
12:03 -!- Khas [95ff6337@gateway/web/freenode/ip.149.255.99.55] has quit [Ping timeout: 265 seconds]
12:06 < EugeneKay> I would recommend it, yes.
12:07 < datruth_> I take it I export the vpn server cert to a template and change it?
12:08 < EugeneKay> Yeah
12:08 < datruth_> I did that but i'm not sure how to set the key usage
12:09 < EugeneKay> Key Usage ab, EKU is on the right side ;-)
12:09 < EugeneKay> tab*
12:09 -!- SOG [~SOG@183.11.12.41] has joined #openvpn
12:09 -!- SOG [~SOG@183.11.12.41] has quit [Client Quit]
12:10 < datruth_> yeah I can select it but I cant give it a value?
12:10 < EugeneKay> That is giving it a value 
12:10 < EugeneKay> You want "Microsoft Server" and "IPSec Tunnel" for the server template, and MS Client / IPSec User for the client template.
12:11 < EugeneKay> (MS Server/Client is just another name for the OID as listed by openssl, "TLS Web Client Authentication")
12:12 < datruth_> for the key usage do I want just key agreement>
12:12 < datruth_> ?
12:13 < datruth_> Or just digital signature and key encipherment?
12:14 < EugeneKay> The easy-rsa pack uses "keyUsage = digitalSignature, keyEncipherment
12:14 < EugeneKay> " for the server
12:14 < EugeneKay> And "keyUsage = digitalSignature" for the clients.
12:15 < krzee> trippy, you were just learning this like days ago
12:15 < EugeneKay> I pick up quick ;-)
12:15 < krzee> i meant more that someone comes in for info on it so soon after
12:15 < krzee> but yes =]
12:15 < EugeneKay> Heh
12:15 < EugeneKay> XCA is a hell of a thing
12:17 < datruth_> if I export my user cert to a template the internal name is grayed out will that be the name for other certs I create?
12:17 < EugeneKay> Internal Name you fill in at cert create name. It's purely for XCA usage - it needs a unique identifier within the xdb.
12:19 < datruth_> ok so I got my templates now I think do I now recreate my user/server cert?
12:19 -!- happylife [~happylife@46.251.83.126] has joined #openvpn
12:20 < EugeneKay> As long as oyu're going through this trouble, switch your Hash Algorithm(File, Options) up to SHA-512.
12:20 < EugeneKay> And yes, just create fresh certs. Select your CA cert, then New Certificate. 
12:20 < EugeneKay> Choose the template(near the bottom), and Apply All, then switch to the Subject tab and fill in the details.
12:22 < datruth_> Hrmm would I select the template I want then new cert?
12:23 < EugeneKay> No, you do it through the Certificates Tab on the main window
12:23 < EugeneKay> Highlight the CA cert so it knows to use that one as the signer for your new cert.
12:24 < datruth_> my ca should be trusted?
12:24 < EugeneKay> Aye.
12:25 < datruth_> when creating the cert down at the bottom I select the template?
12:25 < EugeneKay> That's what I said.
12:25 < datruth_> oh sorry I missed that
12:25 < EugeneKay> ;-)
12:26 < datruth_> hrmm do I need to generte a new key?
12:26 < datruth_> I select the template hit apply all then ok and it complains about not having a private key
12:26 < EugeneKay> You can reuse the existing one, or make a enw one if it'll make you feel better.
12:27 < EugeneKay> Yeah, under Subject, you need to check "reused keys" or such
12:27 < datruth_> found it
12:28 < datruth_> cert will nolonger be valid than the signer?
12:28 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p17897>
12:28 < EugeneKay> Up to you how long to make it valid for.
12:28 < datruth_> is it a bad idea to make it never expire?
12:28 < EugeneKay> My Root CA cert expires in 2099, my intermediate CAs are 10 eyars, and my cert-certs are 400 days.
12:30 < datruth_> ok so a new server cert was created but under the CA colum it says no
12:31 < EugeneKay> That column means it's not a CA certificate
12:31 < datruth_> I know so I've missed a step?
12:31 < EugeneKay> Nope, that's normal.
12:31 < EugeneKay> Your server shouldn't be a CA
12:32 < datruth_> ok so now I can proceed with the user cert
12:32 < datruth_> do I use my server cert to sign user certs?
12:32 < EugeneKay> No, it isn't a CA :-p
12:33 < datruth_> ok so now I what copy the keys/crts/p12 files over to the vpn server?
12:34 < EugeneKay> Aye, same as you would with easy-rsa
12:34 < EugeneKay> But with clicky!
12:34 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
12:35 < datruth_> do I need to generate another DH parementer?
12:35 < EugeneKay> No reason to
12:35 < datruth_> and do I delete all the old imported crts?
12:35 < datruth_> except for the ca ofcourse
12:36 < EugeneKay> If they're no longer gonna be used, you should revoke them and generate a CRL 
12:37 < datruth_> except the old ca/server cert?
12:37 < EugeneKay> The CA you' need, don't revoke that.
12:38 < datruth_> gotcha
12:38 < datruth_> export crt to p12 + certifcate chain is this what I need or the regular?
12:38 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:38 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
12:38 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:39 < EugeneKay> Just the p12
12:39 -!- kyrix [~ashley@mk046207255200.a1.net] has quit [Ping timeout: 240 seconds]
12:39 < EugeneKay> cert chain would nclude the CA, which you don't need for openvpn
12:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:40 < datruth_> ok after I export do I import the new p12 file?
12:45 < datruth_>  ahh things look better when you close and re-open the db
12:45 < datruth_> what I don't get his how do I copy over the certs to the vpn server?
12:45 < datruth_> scp?
12:47 < EugeneKay> However you like
12:47 < datruth_> what about the index.txt file and the #.pem files?
12:48 < EugeneKay> Not needed. 
12:48 < datruth_> hrmm must be something created by easy-rsa?
12:49 < EugeneKay> Well, by openssl.
12:49 < EugeneKay> The .pems are just copies of the certs and such
12:49 < datruth_> so all I need to do is copy over the ca.crt the server crt and key and the user.p12 file to the vpn server?
12:49 < EugeneKay> XCA keeps all that inernally in the DB
12:49 < EugeneKay> See the what-needs-what in the !howto page
12:49 < EugeneKay> Nice handy table
12:50 < datruth_> !howto
12:50 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:50 < datruth_> thanks for all the info
12:50 < EugeneKay> Sure
12:53 < datruth_> XCA is a nice tool, I think I'll use it more once I learn more about it.
12:54 < EugeneKay> It beats the pants off of doing it at CLI
12:54 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:54 -!- TypoNe [~itsme@195.197.184.87] has left #openvpn []
12:57 < datruth_> rmm I guess the only certs that needs to be on the vpn server is the ca/server cert and key
13:03 < datruth_> epps now I can no longer connect via vpn :(
13:05 -!- master_of_master [~master_of@p57B521A9.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
13:06 < EugeneKay> And the dh 
13:07 < datruth_> how can I find my oid?
13:17 < datruth_>  remote-cert-tls server is the same and -remote-cert-eku?
13:22 < datruth_> Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server' <-- why is the SHA1 keysize still 128 I changed it to 512 in xca
13:27 <@vpnHelper> RSS Update - forum: WHS install, having trouble generating client keys... <http://forums.openvpn.net/topic9275.html#p17898>
13:27 < EugeneKay> remote-cert-tls server does as it saysi n the man page
13:27 < EugeneKay> Dunno. I'd have to look :-p
13:31 < datruth_> yeah the new certs will not let me connect but my old one will do I need to alter my server.conf?
13:32 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Read error: Connection reset by peer]
13:32 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p17902> || apf cannot ping other computers on openvpn <http://forums.openvpn.net/topic9278.html> || Server generates 'status=1' when pushing routes <http://forums.openvpn.net/topic9274.html#p17900> || Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17899>
13:33 -!- GoHawks is now known as Pilif12p
13:37 < datruth_> I think I needed to sign my user certs with my server cert the user certs are self signed certs
13:38 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17903>
13:38 < datruth_> perhaps thats why I cant connect
13:41 < datruth_> nope 
13:41 < datruth_> ;/
13:52 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:03 < datruth_> glad I didnt revoke my orignal certs
14:03 < datruth_> i'd be screwed right
14:06 < EugeneKay> Who-signs-what is a question of what CA you're using 
14:06 < EugeneKay> Everything signed by the same CA.crt is the usual way
14:08 < datruth_> Well I've done all the stuff I needed in xca I got the certs over to the server I've added remote-cert-eku and remote-cert-tls client and yet I still can't connect
14:08 < datruth_> doing something wrong?
14:10 < EugeneKay> I'm not psychic, I can't read your lgos without them :-p
14:31 <@vpnHelper> RSS Update - forum: Network Config Help <http://forums.openvpn.net/topic9279.html>
14:31 -!- novaflash is now known as novaflash_away
14:31 < datruth_> I'll post them
14:38 < datruth_> EugeneKay: client/server logs http://pastebin.com/UShVkRCU
14:41 < EugeneKay> You're checking against the wrong cert as your CA
14:41 < EugeneKay> Or, something.
14:41 < EugeneKay> The server is self-signed? That's wrong. It should be CA-signed.
14:42 -!- mdupont [~mdupont@cl-1773.dus-01.de.sixxs.net] has joined #openvpn
14:42 -!- mdupont [~mdupont@cl-1773.dus-01.de.sixxs.net] has quit [Changing host]
14:42 -!- mdupont [~mdupont@flossk/mdupont] has joined #openvpn
14:42 < datruth_> maybe I should create everything new in the XCA? new ca etc?
14:43 < EugeneKay> Could help with sanity.
14:44 < datruth_> new request for ca?
14:44 < EugeneKay> No, justm ake up a new CA cert.
14:44 < EugeneKay> Use the built-in CA tempalte
14:45 < datruth_> any thing for key usage that should be selected?
14:45 < mdupont> hi all, anyone have some ideas about http://stackoverflow.com/questions/8262083/how-to-reliably-get-outgoing-masking-of-ip-address my question here?
14:45 <@vpnHelper> Title: perl - How to reliably get outgoing masking of IP address? - Stack Overflow (at stackoverflow.com)
14:50 -!- happylife [~happylife@46.251.83.126] has quit [Ping timeout: 252 seconds]
14:53 -!- kyrix [~ashley@mk046207255007.a1.net] has joined #openvpn
14:57 < datruth_> Do I have to select critical for the extentions/key usage options to take effect>
14:57 < datruth_> ?
15:02 -!- master_of_master [~master_of@p57B5447C.dip.t-dialin.net] has joined #openvpn
15:11 -!- mdupont [~mdupont@flossk/mdupont] has quit [Ping timeout: 244 seconds]
15:13 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p17905>
15:22 < datruth_> created a new b new ca new server cert and new user cert still the same error
15:23 < datruth_> maybe with that setup I cant use .p12 files?
15:24 -!- mdupont [~mdupont@cl-1773.dus-01.de.sixxs.net] has joined #openvpn
15:24 < datruth_> EugeneKay?
15:25 -!- mdupont [~mdupont@cl-1773.dus-01.de.sixxs.net] has quit [Changing host]
15:25 -!- mdupont [~mdupont@flossk/mdupont] has joined #openvpn
15:26 < EugeneKay> Mrh? p12 is just a cert/key combo format.
15:27 < datruth_> yeah I thought it would combine the ca key a user cert together
15:27 < datruth_> but I am getting the exact same results
15:27 < datruth_> same error
15:28 < EugeneKay> Something's not right with your PKI layout, then. ;-)
15:29 < datruth_> how? all I've done exported the cert to the .p12 file
15:29 < EugeneKay> I dunno. Do you have a proper hierarchial tree layout showing in XCA?
15:29 <@vpnHelper> RSS Update - forum: Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17906>
15:29 < EugeneKay> You should have a CA cert, and then the server & client certs below it
15:30 < datruth_> I do
15:31 < datruth_> but I figured out I need to export to p12 with certificate chain
15:31 < datruth_> now I have a new error
15:31 < datruth_> ;/
15:32 < datruth_> after verify ok the connection just drops
15:32 < datruth_> EugeneKay: on the server side of openvpn what else do I need other then remote-cert-eku?
15:32 < EugeneKay> Well, the normally stuff :-p
15:33 < EugeneKay> remote-cert-ku 80 and remote-cert-eku "IPSec User"
15:33 < datruth_> remote-cert-tls client is needed to?
15:34 < EugeneKay> No, that's covered by -ku 80
15:34 < datruth_> the client side needs the same only IPSec tunnel?
15:34 < EugeneKay> Correct.
15:36 < datruth_> Fri Nov 25 16:35:53 2011 ++ Certificate has key usage  00a0, expects 0080
15:36 < datruth_> Fri Nov 25 16:35:53 2011 VERIFY KU ERROR
15:36 < datruth_> so my user cert isn't configured right?
15:37 < EugeneKay> Just that you have a different set of fields from me
15:37 < EugeneKay> Change it to require a0 :-p
15:37 < datruth_> for both server and client?
15:37 < EugeneKay> No, they'll be different between client and server
15:38 < EugeneKay> I forget how to see the ku field with openssl, with Windows it's shown in the cert properties.
15:40 < datruth_> Fri Nov 25 16:39:55 2011 Validating certificate extended key usage
15:40 < datruth_> Fri Nov 25 16:39:55 2011 ++ Certificate has EKU (str) TLS Web Server Authentication, expects IPSec Tunnel
15:40 < datruth_> Fri Nov 25 16:39:55 2011 ++ Certificate has EKU (oid) 1.3.6.1.5.5.7.3.1, expects IPSec Tunnel
15:40 < datruth_> Fri Nov 25 16:39:55 2011 ++ Certificate has EKU (str) IPSec Tunnel, expects IPSec Tunnel
15:40 < EugeneKay> Yup, that's right.
15:40 <@vpnHelper> RSS Update - forum: wrong "connected since" time in Server <http://forums.openvpn.net/topic8785.html#p17907>
15:40 < datruth_> hrmm something with my client conf?
15:40 < EugeneKay> It checks by string first for each eku, then by OID.
15:41 < datruth_> after that I get disconnected
15:41 < EugeneKay> Well.... it shouldn't, not for that o.O
15:41 < EugeneKay> It says success for me after that :-p
15:41 < datruth_> tls-verify prolly would stop me?
15:41 < EugeneKay> If your tls-verify script isn't being fuflfilled, yeah
15:42 < datruth_> so I need to allow the server cert and the user cert?
15:42 < EugeneKay> I dunno. I don't do tls-verify scripts :-p
15:43 < datruth_> hrm i'll take it out for a sec then
15:43 < EugeneKay> For me, the EKU stuff is being used in place of a tls-verify
15:44 < datruth_> nope same stuff if I disable tls-verify I still get droped after it verify's the server cert
15:44 < EugeneKay> What's the server side saying?
15:47 < datruth_> on the server side ++ Certificate has key usage  00a0, expects 0080
15:47 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17908>
15:48 < datruth_> so they need to be the same
15:48 < datruth_> the ku for client/server
15:48 < datruth_> I just now connected setting them both to be the same
15:48 < datruth_> is that normal?
15:49 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
15:50 < datruth_> tls-client
15:50 < datruth_> remote-cert-ku a0
15:50 < datruth_> remote-cert-eku "IPSec Tunnel"
15:50 < datruth_> tls-remote "/CN=vpnserv"
15:50 < datruth_> tls-auth "/home/datruth/guru/ta.key" 1
15:50 < datruth_> the above is all I need for the client?
15:50 < EugeneKay> They should be different, depending upon what you picked as your KU in the cert
15:51 < EugeneKay> If you set both to have the same KU, then yes, they should be the same
15:53 < datruth_> should they be different or does it matter?
15:54 < datruth_> And where is the option to set the KU cause I didn't see it
15:54 < EugeneKay> It was next to the EKU when you made the cert
15:56 < datruth_> in xca I don't see anything ewith eku either
15:57 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
15:58 < datruth_> EugeneKay: should the ku's be different or does it even matter?
15:58 < EugeneKay> Doesn't really matter, but I like to roll with the minimum necessary
15:58 < EugeneKay> And it's there, you set it to IPsec Tunnel / Client ;-)
15:59 < datruth_> hrmm for the server I did ipsec tunnel and for the client I did ipsec user
16:00 < datruth_> for the ca I just used ms server I think
16:00 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
16:00 < EugeneKay> The KU stuff is right next to that
16:01 -!- gremly [~gremly@200.106.218.64] has quit [Read error: Operation timed out]
16:02 < datruth_> yeah digitalsignature and key encipherment I did for both server and user cert
16:02 < datruth_> just trying to find out why mine isn't different
16:04 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:08 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
16:14 -!- kyrix [~ashley@mk046207255007.a1.net] has quit [Remote host closed the connection]
16:17 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
16:17 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
16:19 < datruth_> I guess I need a firewall to stop vpn users from using me as a default gw?
16:20 < reiffert> datruth_: depends.
16:21 < datruth_> reiffert: I disabled the push redirect-gateway def1 option from the server but in the client I can just do redirect-gateway
16:21 < datruth_> Is there an option to stop it?
16:21 < reiffert> no.
16:21 < datruth_> So any other way than a firewall?
16:21 < reiffert> datruth_: depends.
16:22 < datruth_> depends on what?
16:23 -!- diytto [~diytto@2001:470:25:59c::1337] has quit [Ping timeout: 240 seconds]
16:23 < reiffert> if your openvpn server is supposed to route packets from one interface to another and/or your openvpn service is setup to do network address translation.
16:24 < reiffert> openvpn service = openvpn server
16:24 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 258 seconds]
16:24 < datruth_> the server does hand out 10. ip addresses
16:25 < reiffert> irrelvant details.
16:25 < datruth_> thats fine I'll use a firewall since all my clients get static ip addresses
16:25 < reiffert> there is another dependency: bridging.
16:26 < datruth_> I'm not doing any bridging
16:26 < reiffert> I dont care.
16:27 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:28 -!- mode/#openvpn [+o raidz] by ChanServ
16:28 -!- dazo is now known as dazo_afk
16:32 < datruth_> reiffert: yeah i know you dont
16:36 < datruth_> EugeneKay: thanks for helping me add an extra layer of security to my vpn and for the easy xca tool
16:38 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
16:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:58 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
16:58 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
16:58 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:08 -!- diytto [~diytto@2001:470:25:59c::1337] has joined #openvpn
17:22 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
17:32 <@vpnHelper> RSS Update - forum: Route: Waiting for TUN/TAP interface to come up... <http://forums.openvpn.net/topic7467-15.html#p17909>
17:48 -!- novaflash_away is now known as novaflash
18:02 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
18:02 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Ping timeout: 240 seconds]
18:05 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
18:08 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
18:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
18:13 -!- Dweezahr [~Dweezahr@flits102-34.flits.rug.nl] has quit [Ping timeout: 248 seconds]
18:13 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
18:14 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has quit [Ping timeout: 240 seconds]
18:17 -!- Pilif12p [~Pilif12p@techessentials.org] has joined #openvpn
18:20 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
18:21 -!- Pilif12p [~Pilif12p@techessentials.org] has quit [Changing host]
18:21 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
18:38 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17910>
19:12 -!- Denial [Denial@drgi.co.uk] has quit []
19:37 -!- _julian_ [~quassel@hmbg-5f763e0d.pool.mediaWays.net] has joined #openvpn
19:40 -!- _julian [~quassel@hmbg-5f766fe9.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
20:04 < EugeneKay> I have pie.
20:21 < datruth_> me to
20:21 < datruth_> what kind?
20:26 < datruth_> !push
20:26 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
20:26 < datruth_> !redirect-gateway
20:26 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has joined #openvpn
20:26 < datruth_> !redirect
20:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
20:26 < datruth_> !def1
20:27 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
20:27 < fuho> Hi, I am trying to set up OpenVPN server on my VPS, and am having trouble with some terminology, cn I just shoot questions?
20:28 < datruth_> fuho: thats prolly best
20:28 < datruth_> someone might answer in time
20:31 < datruth_> EugeneKay: with no firewall in play would wouldn't openvpn connect over udp?
20:31 < fuho> ok, so.. cat /etc/network/interface returns two interfaces, venet0:1 and venet0:0, do I have to somehow install tap and tun to get OpneVPN working?
20:32 < fuho> actually there is a third interface venet0 which has ip 127.0.0.2
20:36 < EugeneKay> Ought to.
20:39 < datruth_> fuho: have you installed openvpn?
20:40 < fuho> datruth_: yes
20:41 < datruth_> so when running openvpn you dont have a tap device?
20:41 < fuho> datruth_: Actually I am using Webmin this time, it lets me set all the parmats in web interface, so I actually don't see the output of openvpn
20:42 < fuho> It asks for Device (tun or tap) and then there is a textfield for Brdidge device, in which I guess I should type in a chosoen name.
20:43 < fuho> ..unfortunately there is no manual for this module.. :(
20:44 < fuho> but underneath there is Network Device for Brdige which is an empty select field, so I think I should have set up some other interface in advance
20:47 -!- JG84|36HRDND is now known as JG|Around
20:47 <@vpnHelper> RSS Update - forum: OpenVPN: Keeps restarting and/or Connection timeout <http://forums.openvpn.net/topic9214.html#p17911>
20:52 < datruth_> not sure on that
20:53 < datruth_> I can only seem to connect ot the vpn on udp port 53?
20:57 < datruth_> traffic is a couple secs faster than over tcp but I wonder why only port 53
21:02 < fuho> Do I have to set up bridge manually in interfaces file?
21:16 < datruth_> ahh my isp is filtering udp 
21:16 < datruth_> gah!
21:21 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
21:23 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
21:43 < datruth_> replay-persist and mute-replay-warnings is this only for server side config?
21:58 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:13 < datruth_> does --no-replay give me more speed on the vpn over udp?
22:19 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
22:28 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has joined #openvpn
22:28 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has quit [Changing host]
22:28 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
23:18 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
23:21 -!- SJr [~sjr@S0106001310248d84.vc.shawcable.net] has left #openvpn ["Leaving"]
23:31 < FeileX> EugeneKay any recomendations on debugging connectvity issues? :P
23:31 < EugeneKay> Spank it.
23:31 < FeileX> tried...
23:31 < FeileX> windows just slaps back
23:32 < FeileX> So, I have the VPN up and running, and I can connect
23:32 < FeileX> but, I cannot hit any of my lan resources
23:32 < FeileX> I have DNS working via host.private.foo.com
23:33 < FeileX> and ping host resolves the proper 10. addy
23:33 < FeileX> but I cannot ssh, http, or anything
23:35 < datruth_> FeileX: firewall maybe??
23:35 < FeileX> thinking so....
23:35 < datruth_> FeileX: what firewall you using?
23:36 < FeileX> not sure if its the forwarding rules, or the rules on the targeted host
23:36 < FeileX> iptables on all servers, winbloze on my desktop
23:36 < datruth_> Are you doing masquerade?
23:37  * datruth_ is abit rusty on iptables
23:37 < FeileX> yea
23:38 < FeileX> internal server -> server http works
23:38 < datruth_> FeileX: iptables log catching anything?
23:38 < FeileX> however desktop -> vpn -> server does not
23:39 < FeileX> no, been looking at those for an hour or so
23:39 < FeileX> not seeing anything dropped that shouldnt be
23:39 < datruth_> tcpdump showing the traffic comming in?
23:40 < FeileX> good question
23:40 < FeileX> I was going to see if there was anyway to configure wireshark to show traffic going out on the openvpn tunnel
23:41 < datruth_> duno
23:46 < FeileX> I can see back and forth traffic on the eth0 udp 1194 port on the VPN host
23:46 < FeileX> looks like its a heart beat or something, hits every second or so, 
23:51 < datruth_> hrmm
23:52 < FeileX> any recomendations on decoding the vpn data to raw traffic?
--- Day changed Sat Nov 26 2011
00:13 <@vpnHelper> RSS Update - forum: Having an issue connecting to server <http://forums.openvpn.net/topic9280.html>
00:19 < FeileX> Ok, it does seem to be a problem with port forwarding...
00:19 < FeileX> when I attempt to SSH into its eth0 address (locked down by iptables) i get an instant denied message
00:20 < FeileX> but when I try and ssh into the 10. address that "should" be exposed by the VPN, it just times out.
00:30 < datruth_> maybe you should setup up a rule to pass in and out all vpn traffic off the 10. ip subnet
00:35 < FeileX> getting closer....
00:35 < FeileX> it seemed that ipp got screwed up...
00:35 < FeileX> My windows host showed 172.16.0.10 as it's IP, but the server said it was .08
00:35 < FeileX> cleared out ipp.txt, and that got better
00:35 <@vpnHelper> RSS Update - forum: Having an issue connecting to server <http://forums.openvpn.net/topic9280.html#p17913>
00:36 < datruth_> working now?
00:36 < FeileX> now getting a "MULTI: bad source address from client " message when i try and ping internal resources
00:36 < datruth_> and werid
00:37 < datruth_> hrmm maybe you might need to check your server config
00:37 < FeileX> yea, might
00:41 <@vpnHelper> RSS Update - forum: Server generates 'status=1' when pushing routes <http://forums.openvpn.net/topic9274.html#p17914>
00:47 -!- kralor [~kralor@hackincorp.net] has left #openvpn []
00:48 < FeileX> How to fix the errors "MULTI: bad source address from client [192.168.100.249], packet dropped" or "GET INST BY VIRT: 192.168.100.249 [failed]"?
00:48 < FeileX> These errors occur because OpenVPN doesn't have an internal route for 192.168.100.249. Consequently, it doesn't know how to route the packet to this machine, so it drops the packet.
00:48 < FeileX> Use client-config-dir and create a ccd file for your client containing the iroute option to tell OpenVPN that the 192.168.100.0/24 network is available behind this client.
00:48 < FeileX> but...
00:48 < FeileX> I'm not sure if thats really what i want..
00:49 < FeileX> if I ping 10.180.x.x (eth1 on one of the servers, networked to the vpn server also, on eth1), shouldnt it just route from my desktop (192.168.0.199), but VPNed as (172.16.0.6)?
00:50 < FeileX> I dont see why I'd need an iroute for that, cuz I am not trying to connect to the 192.168.0.0/24 network.
00:50 < FeileX> The exact error I am seeing is:
00:50 < FeileX> GET INST BY VIRT: 172.16.0.6 [failed]
00:50 < FeileX> MULTI: bad source address from client [172.16.0.6], packet dropped
00:51 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Ping timeout: 240 seconds]
01:00 < Olipro> yes, you need an iroute
01:01 < Olipro> if you have topology subnet, the server endpoint needs to know what address(es) in the subnet go to which physical client
01:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
01:22 -!- cute_banget [cute_bange@180.241.201.18] has joined #openvpn
01:23 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
01:24 -!- cute_banget [cute_bange@180.241.201.18] has left #openvpn []
01:27 -!- popov [~happylife@46.251.83.126] has joined #openvpn
01:27 -!- popov [~happylife@46.251.83.126] has quit [Remote host closed the connection]
01:28 -!- happylife [~happylife@46.251.83.126] has joined #openvpn
01:35 -!- spopescu [~na@p5.eregie.pub.ro] has joined #openvpn
01:36 < spopescu> !welcome
01:36 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:36 <+hyper_ch> hi spopescu
01:36 < spopescu> !goal
01:36 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:36 < spopescu> !howto
01:36 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
01:37 <+hyper_ch> !blame
01:37 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
01:38 < spopescu> Hello all. I'm curious: I have openvpn installed in a virtual machine and it hangs while sending the password. Could this be because I have a pppoe connection on the host?
01:38 <+hyper_ch> !ppoe
01:38 <+hyper_ch> !pppoe
01:39 < spopescu> !pppoe
01:39 <+hyper_ch> any reason why you need password?
01:39 <+hyper_ch> the pppoe connection shouldn't matter IMHO
01:39 < spopescu> well i'm trying to connect to the infrastructure at https://www.hacking-lab.com
01:40 < spopescu> i'm curious about owasp top 10
01:40 < spopescu> and they offer a means of trying things out
01:40 < spopescu> but i have to connect via vpn with my username and password
01:41 <+hyper_ch> hmmm, enable logging
01:41 <@vpnHelper> RSS Update - forum: Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17915>
01:48 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17916>
02:07 < Olipro> EugeneKay you hairy flange
02:07 < Olipro> there's a new XCA out
02:07 < EugeneKay> Olipro you nshaven minge
02:07 < Olipro> http://sourceforge.net/projects/xca/files/xca/0.9.1/
02:07 <@vpnHelper> Title: xca - Browse /xca/0.9.1 at SourceForge.net (at sourceforge.net)
02:07 < EugeneKay> Yes, as of April.
02:08 < Olipro> except... that EXE wasn't made available until this month
02:08 < Olipro> sourceforge dates it at 2011-11-07
02:08 < Olipro> and I checked the site back in August, and this wasn't there then
02:08 < EugeneKay> Right, but the sauce is April
02:08 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:08 < Olipro> I'm calling shenanigans
02:09 < EugeneKay> Your inability to compile it yourself is a prsonal issue
02:09 < Olipro> pffft
02:09 < Olipro> I can, I just didn't think it was actively worked upon
02:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
02:31 -!- spopescu [~na@p5.eregie.pub.ro] has quit [Quit: Leaving]
02:33 -!- Dweezahr [~Dweezahr@flits102-34.flits.rug.nl] has joined #openvpn
02:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
02:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:06 <@vpnHelper> RSS Update - forum: Netsh error <http://forums.openvpn.net/topic9281.html>
03:08 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has joined #openvpn
03:16 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:25 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
03:28 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
03:38 -!- beerbro [~gustav@apollon.ais-salzburg.at] has quit [Read error: Connection reset by peer]
03:43 -!- gustav- [~gustav@apollon.ais-salzburg.at] has joined #openvpn
04:24 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
04:54 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17918>
05:02 -!- Carbon_Monoxide [~cmonxide@059148118175.ctinets.com] has quit [Quit: Leaving]
05:06 <@vpnHelper> RSS Update - forum: DHCP lease renewal in bridged VPN <http://forums.openvpn.net/topic9282.html>
05:23 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
05:23 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
06:02 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:16 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
06:16 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
06:43 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
06:44 -!- vtcN- [~vtcN@unaffiliated/thethe] has quit [Client Quit]
06:59 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Read error: Connection reset by peer]
07:02 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:19 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
07:25 <@vpnHelper> RSS Update - forum: creating and revoking certificates for clients <http://forums.openvpn.net/topic9253.html#p17920>
08:02 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
08:06 -!- reisi_ [~koivunej@mustatilhi.cs.tut.fi] has joined #openvpn
08:06 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
08:08 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
08:09 -!- reisi [koivunej@mustatilhi.cs.tut.fi] has quit [Ping timeout: 244 seconds]
08:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
08:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:37 <@vpnHelper> RSS Update - forum: WHS as internet gateway with Open VPN anonymisation service <http://forums.openvpn.net/topic9283.html>
08:38 -!- happylife [~happylife@46.251.83.126] has quit [Ping timeout: 248 seconds]
08:41 -!- happylife [~happylife@46.251.83.126] has joined #openvpn
08:52 -!- reisi [koivunej@mustatilhi.cs.tut.fi] has joined #openvpn
08:55 -!- reisi_ [~koivunej@mustatilhi.cs.tut.fi] has quit [Ping timeout: 260 seconds]
09:04 -!- reisi_ [koivunej@mustatilhi.cs.tut.fi] has joined #openvpn
09:07 -!- reisi [koivunej@mustatilhi.cs.tut.fi] has quit [Ping timeout: 244 seconds]
09:07 <@ecrist> ping krzee
09:08 <@ecrist> or krzie
09:08 <+hyper_ch> hi ecrist
09:08 <@ecrist> hi, hyper_ch
09:08 <+hyper_ch> ecrist: happy saturday to you :9
09:08 <@ecrist> ditto
09:08 <+hyper_ch> do you also plan on killing a turkey?
09:09 <@ecrist> that was two days ago
09:10 <+hyper_ch> awwww, poor turkey
09:11 <+hyper_ch> what has that poor turkey ever done to you to deserve such a miserable end?
09:11 <@ecrist> nom nom nom
09:11 <@ecrist> it tasted great
09:11 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 248 seconds]
09:11 <+hyper_ch> :)
09:12 <+hyper_ch> so you ate that 20 lbs turkey all on your own?
09:13 <@ecrist> no, of course not
09:14 <+hyper_ch> :)
09:14 <+hyper_ch> I should get a sandwich toaster again
09:16 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 244 seconds]
09:22 <+hyper_ch> ecrist: what else do you eat besides stuffed turkey?
09:23 <@ecrist> pretty much anything
09:23 <@ecrist> or, are you just talking about for thanksgiving?
09:30 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:33 -!- Perun [perun@chao5.net] has quit [Ping timeout: 258 seconds]
09:33 -!- _julian [~quassel@hmbg-5f77c086.pool.mediaWays.net] has joined #openvpn
09:34 -!- Perun [perun@chao5.net] has joined #openvpn
09:35 -!- _julian_ [~quassel@hmbg-5f763e0d.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
09:57 -!- _julian [~quassel@hmbg-5f77c086.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
10:06 -!- _julian [~quassel@hmbg-5f763816.pool.mediaWays.net] has joined #openvpn
10:11 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 240 seconds]
10:14 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 244 seconds]
10:14 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
10:14 -!- webmind [~webmind@yavin.puscii.nl] has joined #openvpn
10:15 -!- webmind [~webmind@yavin.puscii.nl] has left #openvpn []
10:16 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
10:18 -!- _julian [~quassel@hmbg-5f763816.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
10:23 -!- _julian [~quassel@hmbg-5f77c71c.pool.mediaWays.net] has joined #openvpn
10:24 -!- Gravitro_ [~admin@cpe-65-28-68-253.kc.res.rr.com] has joined #openvpn
10:24 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Read error: Connection reset by peer]
10:26 < EugeneKay> Gobble gobble
10:29 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:36 <+hyper_ch> hi krzee
10:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
10:45 -!- Rolybrau [~Rolybrau@176-133.79-83.cust.bluewin.ch] has joined #openvpn
10:45 -!- Rolybrau [~Rolybrau@176-133.79-83.cust.bluewin.ch] has quit [Changing host]
10:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
10:59 -!- Gravitro_ [~admin@cpe-65-28-68-253.kc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:06 -!- barbosa [~barbosa@187.113.34.183] has joined #openvpn
11:10 -!- barbosa [~barbosa@187.113.34.183] has quit [Client Quit]
11:10 -!- barbosa [~barbosa@187.113.34.183] has joined #openvpn
11:11 -!- barbosa [~barbosa@187.113.34.183] has left #openvpn []
11:16 -!- xTheElySiaNx [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
11:25 -!- _julian_ [~quassel@hmbg-4d06c5b6.pool.mediaWays.net] has joined #openvpn
11:27 -!- eugenmayer [~EugenMaye@frbg-4d028e4f.pool.mediaWays.net] has joined #openvpn
11:27 < eugenmayer> Hello guys. Using OpenVPN for years now, iam running into troubles with our mobile clients, as they only have IPsec clients
11:28 -!- _julian [~quassel@hmbg-5f77c71c.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
11:28 < eugenmayer> i dont want to replace our openVPN setup with something like strongswan .. so is it possible to use IPsec to connect to an openVPN server, which serves up to 4 openVPN nets?
11:28 < eugenmayer> usually, every openVPN net has its own openVPN server for the OpenVPN clients
11:30 <+hyper_ch> eugenmayer: android?
11:31 < eugenmayer> actually both
11:31 < eugenmayer> ios and android
11:32 <+hyper_ch> you can install openvpn on android somehow.... but never tried it
11:32 < EugeneKay> !android
11:32 < EugeneKay> !ios
11:32 <+hyper_ch> and if you use iOS.... well, pity you
11:33 < EugeneKay> Oh, the bot is down.
11:33 < eugenmayer> Well actually i would not start relgious wars here
11:33 <+hyper_ch> EugeneKay: you killed it
11:33 < EugeneKay> http://secure-computing.net/factoids.php
11:33 < eugenmayer> iam the androis user ( ipad ) and to be honest, iam more then satisfied.
11:33  * datruth_ wants vpn on his android
11:33 < EugeneKay> see "android" and "iphone" in that link.
11:33 < datruth_> can't find a damn kernel for my rom with the tun driver
11:33 < EugeneKay> Use CM :-p
11:34 < datruth_> bah!
11:34 < eugenmayer> and it does not make a lot of difference regarding the mobile platforms yet, i have no idea why openVPN support is lacking that wide
11:34 < EugeneKay> There's no official client because it's a small-fish market.
11:34 < eugenmayer> I think its strategical
11:34 < EugeneKay> There's only unofficial clients for iOS because Apple doesn't believe VPNs are thinking different.
11:35 < EugeneKay> Android has support only on rooted / unlocked devices because the carriers enjoy raping you.
11:35 < eugenmayer> EugeneKay: with a jailbrake it does work, but i dont want to do that ( and cant, as IPAD2 + iOs 5
11:35 < EugeneKay> OpenVPN may or may not make it into AOSP upstream.... so far, it hasn't.
11:35 <+hyper_ch> I will look into vpn for android once android devices can be fully encrypted
11:35 < eugenmayer> But back to the topic
11:36 < eugenmayer> basically i can actually connect site-2-site with IPsec
11:36 < datruth_> maybe a simple vpn appliance might be the key?
11:36 < EugeneKay> No clue. This is #openvpn, not #ipsec.
11:36 < eugenmayer> so i could actually simple connect with my client using IPsec into the "networks" of my openVPN server. There, i would firewall the clients to limit their access if needed
11:37 < EugeneKay> I suppose you could. Routing would be up to you.
11:37 < eugenmayer> Why so defensive. Iam on you side, i want to keep the OpenVPN net
11:37 < EugeneKay> There's no defense. It's just...... not openvpn? 
11:37 < eugenmayer> but i have to find a solution, before the solution ends up replacing openVPN with strongswan or similar 
11:37 < eugenmayer> EugeneKay: just looked that way
11:38 < eugenmayer> No offence of my side, just trying to find my ways arround
11:38  * EugeneKay shrugs
11:38 < eugenmayer> i dont actually believe those apple guys are looking forward to implement openVPN support. They simply dont want to 
11:38 < EugeneKay> I've exactly zero IPsec experience. Best I can say is toss it at the wall, see what sticks.
11:39  * hyper_ch tosses EugeneKay at the wall.,... and he notices that he doesn't stick
11:39 < EugeneKay> I'm not wearing my velcro suit
11:40 <+hyper_ch> :)
11:40 < eugenmayer> :)
11:40 < eugenmayer> Thank you anyway!
11:41 < EugeneKay> Sure. Let us know what happens, that sounds interesting.
11:41 < eugenmayer> i will
11:41 < eugenmayer> basically what iam going for is a mix of openvpn and ipsec
11:41 < eugenmayer> while the main infrastructure is using openVPN only and ipsec is for "roadwarrior with mobiles" only
11:44 <+hyper_ch> EugeneKay: do you have a disapora id?
11:44 < EugeneKay> Nope.
11:44 <+hyper_ch> awwww
11:45 < EugeneKay> Meh.
11:45 < EugeneKay> I'm amused by an open standard that's closed-invite ;-)
11:46 <+hyper_ch> EugeneKay: only the main pod is closed invite
11:46 <+hyper_ch> each other pod can set it as they want
11:46 <+hyper_ch> or you can even run your won pod... like I do
11:46 <+hyper_ch> wanna join mine?
11:46 < EugeneKay> That's like saying that only the Microsoft version of Windows is closed source.
11:46 <+hyper_ch> no it's not
11:46 < EugeneKay> Technically you're correct, as there are fringe clones(ReactOS, say), but it's so, so wrong.
11:46 <+hyper_ch> pods communicate with each other
11:47 <+hyper_ch> it doesn't really matter what pod you're on
11:47 < EugeneKay> Sorry, I'm just not hipster enough.
11:47 -!- eugenmayer [~EugenMaye@frbg-4d028e4f.pool.mediaWays.net] has quit [Quit: Leaving.]
11:47 <+hyper_ch> awwwwwwww
11:48 <+hyper_ch> but you are
12:23 -!- eugenmayer [~EugenMaye@HSI-KBW-046-005-230-195.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
12:25 -!- gustav- is now known as beerbro
12:36 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Read error: Connection reset by peer]
12:42 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
12:46 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
12:49 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Client Quit]
12:57 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
12:59 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
13:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:22 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has quit [Ping timeout: 244 seconds]
13:24 -!- eugenmayer [~EugenMaye@HSI-KBW-046-005-230-195.hsi8.kabel-badenwuerttemberg.de] has quit [Quit: Leaving.]
13:25 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 245 seconds]
13:27 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
13:31 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Read error: Operation timed out]
13:42 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
13:50 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 240 seconds]
13:51 -!- sia^pwnnt [115kluu@owned.ninjasinpyjamas.biz] has joined #openvpn
14:00 -!- mdupont [~mdupont@flossk/mdupont] has quit [Ping timeout: 240 seconds]
14:00 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
14:10 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
14:10 -!- jacob11 [~shiva@genije.org] has joined #openvpn
14:10 < jacob11> hello 
14:10 < jacob11> is there any tutorial for openvpn configuration? I want my clients to connect easily with "openvpn config" 
14:12 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 258 seconds]
14:13 < jacob11> any help pls?
14:19 < jacob11> :(
14:19 -!- mdupont [~mdupont@ip-92-50-78-150.unitymediagroup.de] has joined #openvpn
14:27 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:29 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
14:39 < Olipro> jacob11: read the documentation; for them to connect "easily" you should provide each client with a ready made set of configuration files and keys
14:40 < jacob11> ok I have vps that has public IP on eth0 
14:40 < jacob11> should I use tun or tap device in server.conf?
14:46 < jacob11> i'm getting Starting virtual private network daemon: server tun0 failed!
14:47 < jacob11> in server.conf there is line dev tun 
14:47 < jacob11> no tun0 
14:47 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
14:50 -!- jacob11 [~shiva@genije.org] has quit [Remote host closed the connection]
14:50 -!- Gravitron [~admin@76.92.159.145] has joined #openvpn
14:50 -!- Gravitron [~admin@76.92.159.145] has quit [Changing host]
14:50 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
14:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:51 -!- jacob11 [~shiva@genije.org] has joined #openvpn
14:51 < jacob11> damn
14:55 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
14:56 < jacob11> anyone?
15:05 -!- master_of_master [~master_of@p57B5447C.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
15:07 -!- master_of_master [~master_of@p57B54945.dip.t-dialin.net] has joined #openvpn
15:21 -!- master_of_master [~master_of@p57B54945.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
15:27 -!- master_of_master [~master_of@p57B54945.dip.t-dialin.net] has joined #openvpn
15:28 <@ecrist> what?
15:29 < jacob11> i need help with certs 
15:30 < jacob11> i get this error
15:30 < jacob11> Sat Nov 26 22:25:14 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
15:30 < jacob11> Sat Nov 26 22:25:14 2011 Cannot load private key file [[INLINE]]: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
15:30 < jacob11> Sat Nov 26 22:25:14 2011 Error: private key password verification failed
15:30 < jacob11> Sat Nov 26 22:25:14 2011 Exiting
15:30 < jacob11> i copied client.key client.csr and client.crt to client machine 
15:30 <@ecrist> looks to me like you have an encrypted key and you're not using the right password
15:31 < jacob11> there's no password
15:31 < jacob11> it's blank 
15:31 <@ecrist> 15:30:12 < jacob11> Sat Nov 26 22:25:14 2011 Error: private key password verification failed
15:31 <@ecrist> oh, but there is
15:31 < jacob11> how can that be when I set blank password
15:31 <@ecrist> I don't know, I didn't generate your certificates.
15:32 < jacob11> i generate them with "./easy-rsa/build-key" client right
15:32 <@ecrist> easy-rsa is a tool to do so, but I don't know if that's what you used. ;)
15:32 < jacob11> yes I did 
15:33 <@ecrist> and, in all honesty, I'm not the best with easy rsa, I prefer raw openssl or ssl-admin
15:33 <@ecrist> !ssl-admin
15:33 <@ecrist> blast, damn bot
15:33 < jacob11> so hhow can i create cert with openssl and sign it 
15:33 < jacob11> so clients can connect 
15:35 <@ecrist> did you read the howto on the openvpn site?
15:37 -!- Jare_ [~jare@diz6.kyla.fi] has left #openvpn []
15:37 < jacob11> yeah just did, i'm a bit in a hurry 
15:37 < jacob11> i managed to get it working 
15:38 < jacob11> can I add all keys in client.conf 
15:38 <@ecrist> keep in mind, we're not here to do the work for you.  we wrote the docs, it's up to you to use them.
15:38 < jacob11> sorry 
15:38 < Olipro> I recommend xca for creating and managing your certs
15:38 < Olipro> xca.sf.net
15:39 <@ecrist> ssl-admin is well supported here. 
15:39 <@ecrist> :P
15:40 < Olipro> based on perl
15:40 < Olipro> ewww
15:41 < Olipro> is it me, or is the website for ssl-admin buggered
15:41 <@ecrist> I don't understand why that matters.
15:41 <@ecrist> which site, Olipro 
15:41 < Olipro> www.secure-computing.net/ssl-admin/
15:42 <@ecrist> grr, it appears to be.
15:42 <@ecrist> I need new hardware for that box, I think.
15:43 < Olipro> and some IPv6
15:43 < Olipro> some IPv6 love
15:44 <@ecrist> yeah, that too
15:44 <@ecrist> I had it for a while, but have since reconfigured the network and never reconfigured IPv6
15:44 < EugeneKay> What we need is a bot
15:45 <@ecrist> hrm
15:45 <@ecrist> last pid: 10320;  load averages: 14.42,  3.40,  1.27                                                                                             up 4+06:31:35  14:06:19
15:45 <@ecrist> 113 processes: 50 running, 52 sleeping, 5 zombie, 6 lock
15:45 <@ecrist> EugeneKay: working on that, too
15:45 < Olipro> 14.42 O_o
15:45 <@ecrist> all apache
15:45 < EugeneKay> Dat DoS
15:45 < Olipro> perhaps you need to update it
15:45 <@ecrist> since I moved that machine to ESXi, apache just goes insane for some reason.
15:45 <@ecrist> no, it's current
15:45 <@ecrist> I think this hardware is buggy
15:46 < EugeneKay> What's the host?
15:46 <@ecrist> EugeneKay: the machine the bot lives on was rebooted this morning for some file system maintenace stuff
15:46 < EugeneKay> The hardware :-p
15:50 <@ecrist> raar
15:50 <@ecrist> http://pastebin.com/5KLuUwaW
15:51 < EugeneKay> That's a thing.
15:53 <@ecrist> https://skitch.com/ecrist/gmunw/esxi-home
15:54 < EugeneKay> Ah, a lil single-socket.
15:56 <@ecrist> yeah
15:57 <@ecrist> I'm considering a Dell R610
15:58 < EugeneKay> Stop making me drool 
15:59 <@ecrist> I can get one nicely configured for about $4k
15:59 < EugeneKay> Sounds about right
16:00 <@ecrist> dual quad core procs, 32GB memory, 6 146G 15k SAS, DRAC6 enterprise, dual power
16:00 < EugeneKay> Only 32GB of ram? What a waste for ESXi :-p
16:00 <@ecrist> I don't think I'd put ESXi on that one
16:01 <@ecrist> but, that's the exact machine we have at $work for our network test env.
16:01 < EugeneKay> Especially as the 610s have triple channel. Go for 48GB.
16:02 < jacob11> i managed to get everything working with the OpenVPN except one thing. Can I force all clients to use openvpn as their default gateway?
16:02 < krzie> push "redirect-gateway def1"
16:02 < krzie> in server config
16:02 <@ecrist> OS: FreeBSD 8.2-RELEASE CPU: Intel(R) Xeon(R) CPU E5520 @ 2.27GHz (2261.01-MHz K8-class CPU) RAM: 24GB UP: 59 days 5:14 USERS: 3 LOAD: 0.02 0.05 0.01 (76 processes:  1 running, 75 sleeping)
16:03 < krzie> (this assumes you have already gotten redirect-gateway working... if you have not you also need to configure NAT and ip forwarding on the server
16:03 < krzie> ^ jacob11 
16:03 < EugeneKay> Well, you can't force them. Clients can ignore pushed routes.
16:03 <@ecrist> EugeneKay: those stats are the machine I IRC from
16:03 < xTheElySiaNx> <@ecrist> dual quad core procs, 32GB memory, 6 146G 15k SAS, DRAC6 enterprise, dual power
16:03 <@ecrist> it's an R610
16:03 < xTheElySiaNx> these, ecrist?
16:03 < jacob11> ok thanks 
16:03 < EugeneKay> E5520s are nice chips
16:03 < jacob11> i'll try that now 
16:03 <@ecrist> xTheElySiaNx: ?
16:03 < EugeneKay> I have em in my R410s
16:04 < xTheElySiaNx> are those the stats of the box you're using?
16:04 < krzie> EugeneKay, true, but it is a pita
16:04 <@ecrist> EugeneKay: we like them.  we use a pair of R610s for our NAS heads connected to an MD3000
16:04 < EugeneKay> Though I think they're discontinued in favor of 5620s now
16:04 <@ecrist> they do all our DHCP, NFS, Samba, and LDAP
16:04 < EugeneKay> I <3 NetApps
16:05 < krzie> EugeneKay, since theres no config option to just ignore redirect-gateway, you either ignore EVERYTHING or create /2 route entries to override the /1 route entries that override the default route
16:05 < EugeneKay> --route-noexec + custom up script ;-)
16:05 < krzie> right, aka pita
16:05 <@ecrist> next generation we'll probably go with either Compellent gear or something from iX systems, I know lead engineers both places
16:06 < krzie> but of course you're correct, it cant be *forced*
16:06 < EugeneKay> And being technically correct is the BEST kind of correct.
16:06 < krzie> and damn ecrist, you're looking to buy a gibson
16:08 <@ecrist> potentially.
16:08 <@ecrist> I'm moving out of this house in the next 6-8 months, so I'm looking for a more permanent home for my stuff
16:08 <@ecrist> I'm probably going to just stick in the racks at $work and get another subnet
16:09 <@ecrist> native IPv6, too, there.
16:09 < EugeneKay> Thats cheating
16:09 < krzie> right on
16:10 < krzie> you buying a house>?
16:10 <@ecrist> we own our house now
16:10 < krzie> oh sweet
16:10 < krzie> buying another?
16:10 <@ecrist> selling, going to rent as we're looking to move to FL
16:10 < krzie> oh i see
16:10 <@ecrist> there's a chance we'll scrap the FL plans and buy another house, though.
16:10 <@ecrist> I want land, we've looked at a couple places with 100+ acres
16:10 < krzie> any specific part of florida?
16:11 <@ecrist> Clearwater, or just north
16:11 <@ecrist> I can get a ranch-style home with 10 acres, horse pasture and stables for about $135k 10mi north of Clearwater and 10mi east of the ocean.
16:11 <@ecrist> that's a few years out, though
16:12 <@ecrist> need to wait until my stepson turns 12, then he can pick which parent to live with, and we can move without permission from his dad.
16:12 < krzie> shit thats an amazing price
16:13 <@ecrist> the wife found some places up here that cheap, too.  one had 122 acres, 4 bed, 3 bath, 24' x 48' pole shed, 3-car detached garage, 2-car attached for like $175k
16:15 -!- jacob111 [~shiva@genije.org] has joined #openvpn
16:15 < jacob111> krzie, 
16:15 -!- jacob11 [~shiva@genije.org] has quit [Ping timeout: 258 seconds]
16:15 < jacob111> i tried what you recommended
16:16 < jacob111> now when I connect to openvpn everything disconnects
16:16 < jacob111> i added forwarding 
16:16 < krzie> [14:02]  <krzie> (this assumes you have already gotten redirect-gateway working... if you have not you also need to configure NAT and ip forwarding on the server
16:16 < jacob111> cat /proc/sys/net/ipv4/ip_forward
16:16 < jacob111> 1
16:16 < jacob111> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
16:16 < krzie> !linnat
16:16 <@ecrist> jacob111: you're going to need to do nat, too
16:16 < jacob111> i've done not 
16:16 < jacob111> nat
16:16 < jacob111> with iptables
16:16 < krzie> oh vpnhelper is down
16:17 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
16:17 < krzie> jacob111, and 10.8.0.0/24 is the subnet in your --server config option in server config?
16:17 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
16:17 -!- mode/#openvpn [+o vpnHelper] by ChanServ
16:17 < krzie> and the rest of your firewall is ok with it?
16:17 < jacob111> server 10.8.0.0 255.255.255.0
16:17 < krzie> (ie, forward chain...)
16:18 < jacob111> root@openvpn-clients:/etc/openvpn# iptables -L FORWARD
16:18 < jacob111> Chain FORWARD (policy ACCEPT)
16:18 < jacob111> target     prot opt source               destination
16:19 < jacob111> i'm using this line 
16:20 < jacob111> push "redirect-gateway def1 bypass-dhcp"
16:20 < jacob111> maybe def1 bypass-dhcp shouldnt suppose to be there?
16:21 < krzie> thats not the problem
16:21 < krzie> its likely your firewall
16:21 < jacob111> but everything is set right
16:23 < krzie> try accepting tun+ on the forward chain
16:23 < krzie> i know it says default accept, but add it anyways
16:27 < jacob111> still not working 
16:30 < jacob111> any more suggestions
16:32 < krzie> something firewall related =]
16:32 < jacob111> should I enable dns in server.conf 
16:33 < jacob111> maybe thats it 
16:33 < krzie> oh right, see if you can ping an ip
16:35 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p17933>
16:36 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
16:36 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
16:38 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
16:38 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
16:38 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
16:38 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:49 -!- jacob111 [~shiva@genije.org] has quit [Remote host closed the connection]
16:49 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
16:55 < FeileX> Anyone online who is good with routes?
16:55 < FeileX> I see this from route -n
16:55 < FeileX> 72.16.0.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
16:55 < FeileX> 172.16.0.0      172.16.0.2      255.255.255.0   UG    0      0        0 tun0
16:55 < FeileX> 50.57.191.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
16:55 < FeileX> 10.182.96.0     0.0.0.0         255.255.224.0   U     0      0        0 eth1
16:55 < FeileX> 10.191.192.0    10.182.96.1     255.255.192.0   UG    0      0        0 eth1
16:55 < FeileX> 169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
16:55 < FeileX> 169.254.0.0     0.0.0.0         255.255.0.0     U     1003   0        0 eth1
16:55 -!- FeileX was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
16:56 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
16:56 < FeileX> do
16:56 < FeileX> doh
16:56 < FeileX> I guess VPNHelper is still alive and kicking... literealy
16:57 < FeileX> and that first line is 172
16:59 -!- jacob11 [~shiva@genije.org] has joined #openvpn
17:00 < jacob11> i managed to get forwarding to work 
17:00 < jacob11> but when I connect from client
17:00 < jacob11> everything disconnects and reconnects
17:06 < krzie> jacob11, not a shocker when you change your default gateway to make all your packets come from another location
17:06 < krzie> jacob11, was it dns?  firewall?
17:06 < jacob11> dns 
17:07 < krzie> ahh werd, good catch =]
17:12 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
17:13 < jacob11> is the same client configuration as in linux used in windows ovpn file?
17:16 < jacob11> i'm getting 
17:16 < jacob11> Sun Nov 27 00:16:27 2011 Options error: Unrecognized option or missing parameter
17:16 < jacob11> (s) in [PUSH-OPTIONS]:5: topology (2.0.9)
17:17 < krzie> update
17:17 < krzie> !download
17:17 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
17:20 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Ping timeout: 258 seconds]
17:21 < jacob11> found it thanks 
17:22 < krzie> np
17:23 < jacob11> OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul  1 2011
17:24 < jacob11> still error
17:25 < krzie> but certainly not the same error
17:25 < krzie> seeing as that error was 100% related to you using 2.0.9 on that client
17:27 < FeileX> woooooot, figured it out...
17:27 < FeileX> for some reason, having a custom learn-address script caused everything to foobar
17:37 -!- vtcN- [~vtcN@unaffiliated/thethe] has left #openvpn ["break();"]
17:43 -!- Dweezahr [~Dweezahr@flits102-34.flits.rug.nl] has quit [Ping timeout: 260 seconds]
17:44 < jacob11> now i cant create client certs 
17:44 < jacob11> root@openvpn-clients:/etc/openvpn# easy-rsa/build-key client2
17:44 < jacob11> easy-rsa/build-key: line 7: ./pkitool: No such file or directory
17:44 < jacob11> on the other terminal window (which runs openvpn server) i can create certs with build-key 
17:45 < jacob11> when i stop openvpn server
17:49 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:50 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has quit []
17:50 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has joined #openvpn
17:52 < jacob11> and do i HAVE to use openvpn client as a root user?
17:53 <@ecrist> it needs to be started as root
17:53 <@ecrist> but it can drop it's own privs
17:53 < FeileX> !man
17:53 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
17:53 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has quit [Remote host closed the connection]
18:00 < jacob11> ok 
18:00 < jacob11> but when i connect/disconnect shouldnt I switch to local isp 
18:01 < jacob11> instead of disconnceting 
18:01 < jacob11> and reconnecting to local isp 
18:07 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
18:09 -!- irule [~usuario@187.140.123.17] has joined #openvpn
18:17 -!- JG|Around is now known as JoeGazz84
18:23 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:23 -!- mode/#openvpn [+v Axeman] by ChanServ
18:25 -!- jacob11 [~shiva@genije.org] has quit [Remote host closed the connection]
18:31 -!- novaflash is now known as novaflash_away
18:32 -!- novaflash_away is now known as novaflash
18:37 -!- jacob11 [~shiva@genije.org] has joined #openvpn
18:37 < jacob11> i cannot start openvpn with init script but I can with openvpn command 
18:37 < jacob11> Starting virtual private network daemon: client server tun0 failed
18:37 < jacob11> ^ this I get
18:38 <@ecrist> we don't support init scripts
18:38 <@ecrist> they're maintained by the distribution packager
18:38 <@ecrist> unless you're on FreeBSD, in which case, I maintain that port
18:38 <@ecrist> :)
18:38 < krzie> i dont even use the init scripts on my centos install
18:38 < krzie> they do stuff i dont want
18:38 < krzie> instead of modding them, i just dont use them *shrug*
18:40 < jacob11> can I start openvpn in daemon mode?
18:41 -!- jacob11 [~shiva@genije.org] has quit [Remote host closed the connection]
18:41 < krzie> sure, --daemon
18:41 -!- jacob11 [~shiva@genije.org] has joined #openvpn
18:41 < krzie> [16:41]  * jacob11 has quit (Remote host closed the connection)
18:41 < krzie> [16:41]  <krzie> sure, --daemon
18:41 < krzie> [16:41]  * jacob11 (~shiva@genije.org) has joined #openvpn
18:41 < jacob11> lol
18:41 < jacob11> thansk
18:41 <@ecrist> jacob11: try reading the damn man page
18:42 < jacob11> lol i'm sorry 
18:42 < jacob11> i guess i'm too lazy 
18:42 < jacob11> :/
18:42 <@ecrist> no lol
18:42 < krzie> the funny part was that you actually called it "daemon mode"
18:42 < jacob11> yes it is :) 
18:42 -!- jacob11 was kicked from #openvpn by ecrist [quit being lazy or the kick becomes +b]
18:43 <@ecrist> now I can lol
18:43 < krzie> lol
18:44 <@ecrist> myself and some others have been pointing him to the man page all day
18:44 <@ecrist> his response is generally, no lol, or I'm in a hurry, lol
18:44  * ecrist likes the +o
18:45 < krzie> =]
18:45 < irule> hi, I just setup openvpn, everything looks good, started the client and it has no errors but there are no virtual network devices with ifconfig -a, whats up? this is an ubuntu 11.10
18:46 < krzie> !logs
18:46 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
18:46 <@ecrist> irule: do you have a tun/tap kernel module loaded?
18:46 < irule> dunno >s
18:46  * krzie bets "it has no errors" is incorrect
18:50 < FeileX> I know this isnt the right channel, but I figured I'd ask and see if anyone has any ideas....  
18:50 < FeileX> Tring to work with dnsmasq, hoping to get it to work with openvpn
18:50 -!- mode/#openvpn [+v EugeneKay] by ChanServ
18:51 < FeileX> So far, I think its working... kinda, but dnsmasq isnt doing everything I want it too.  :)
18:52 < FeileX> Has anyone had any exp with dnsmasq?
18:52 < krzie> try asking a complete question
18:53 -!- stones_ [~anthony@pool-173-77-117-252.nycmny.east.verizon.net] has quit [Ping timeout: 260 seconds]
18:53 < FeileX> doh.  figured that part1 out... tring to ping the wrong host name.... looks like I misspelled my hostname on my windows box.  LOL
18:53 < FeileX> Ok, complete question....
18:54 < irule> firewall problem, opened ports and I am inside haha
18:54 < FeileX> I want dnsmasq to append a dns name on to the end of un qualified requests...
18:55 < FeileX> IE, I have A names setup in my dns for apollo.private.example.com
18:55 < FeileX> if I ping apollo.private.example.com, dnsmasq goes tothe resolv.conf nameserver, and returns the propper 10. address
18:55 < krzie> ya i dunno
18:55 < FeileX> however, if I do a ping apollo, it failes
18:55 < krzie> i mean i could check the dnsmasq docs... but so could you
18:56 < irule> what are the specific steps to add clients? I just created one, should I uild the Diffie Hellman parameters again every time I create a client?
18:56 < FeileX> for some reason, it doesnt see to be appending the dns name
18:56 < krzie> and if i choose between those 2, ill choose you do it ;]
18:56 < FeileX> yea, I have checked , and I "seem" to be doing everything correct.  lo
18:56 < FeileX> lol
18:56 < krzie> irule, the dh file has nothing to do with clients
18:57 < irule> oh cool :)
18:57 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
18:58 < irule> . /etc/openvpn/easy-rsa/2.0/build-key 1-more-client, copy keys and configure, is that it?
18:58 < FeileX> if you sourced vars alread . ./vars
18:59 < krzie> ya what FeileX said
18:59 < krzie> also, this is in the howto
18:59 < krzie> !pki
18:59 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
18:59 <@vpnHelper> specially as a server (see !servercert)
19:00 < FeileX> Also, I'd recomend genning your keys only on the client that will use them, and then just signing the request (csr) file on the server
19:00 < FeileX> that way you don't move the key over any "possibly" insecure channels
19:00 < krzie> ^ ++
19:02 < FeileX> server:  edit vars; source vars ". ./vars"; build server key "./build-key-server"; build DH "./build-dh"
19:03 <@ecrist> we sign all our certs and generate CSRs for users on a box and ship them to our SFTP server, where users can download them through our webpage
19:04 < FeileX> client (windows?) :  edit vars; source vars "vars.bat"; build key "build-key.bat" (ignore errors about no ca), copy %keyname%.csr to server
19:04 < krzie> i generate them on a box that has no network cable, then i manually distribute them myself (physically)
19:04 < FeileX> server:  move the key.csr to the keys dir; sign the key "./sign-reg %keyname%"
19:05 < krzie> each system revolves around what makes sense for the exact setup... but in general FeileX's advice was good =]
19:05 < FeileX> copy keyname.crt back to host
19:05 < FeileX> err client
19:06 < FeileX> ecrist, so the client genns his key, and sends you the csr
19:06 < FeileX> ?
19:06 < FeileX> or is there a different work flow?
19:07 < krzie> FeileX, he just makes sure there is no insecure channel when he distributes the key/cert
19:07 < FeileX> mkay
19:07 < krzie> by using sftp and https (likely with login/pass)
19:08 < krzie> but dont get scared, your way is the recommended way =]
19:08 < krzie> ecrist is just a rebel ;]
19:08 < FeileX> hehe
19:08 < krzie> (and knows enough to get away with being one)
19:09 < FeileX> ehhh, i might want to be a rebel...
19:09 < krzie> as is painfully obvious by his very cool spoof! lol
19:09 < FeileX> i want to be able to control the CNs that my clients choose
19:09 < FeileX> so, other than just not signing thier keys... any recomendations?
19:13 < krzie> gen their csr, or dont sign it if you dont like it
19:13 < krzie> those are the 2 options
19:13 < krzie> if you were able to mod it but keep the same key, thered be a big problem
19:17 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:18 < FeileX> yea
19:18 < FeileX> hmmm.... to tunnel... or not to tunnel....
19:26 < krzie> that is *not* the question (normally, here)
19:26 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
19:28 < irule> http://pastebin.com/EdHZZ5Kp does this look correct? my setup is not working
19:30 < krzie> except for the old version, sure
19:37 -!- _julian [~quassel@hmbg-4d069b0c.pool.mediaWays.net] has joined #openvpn
19:39 <@ecrist> FeileX: we gen the whole thing, we only use openvpn internally and for staff
19:39 <@ecrist> we use ssl-admin to do everything.
19:40 -!- _julian_ [~quassel@hmbg-4d06c5b6.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:43 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
19:48 < irule> is it fine when the server is not listening on 1194 acording to netstat -planet?
19:50 -!- Jikan [~Jikan@2001:41d0:2:401f::2] has left #openvpn ["Les escargots n’aiment pas les Français. C’est pourquoi les Français doivent se méfier des escargots qui, sous des dehors bon enfant, cachent en réalité une âme de fauve prêt à bondir."]
20:05 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
20:12 < FeileX> irule, mine does not showup under -planT
20:13 < FeileX> but, if you do a -a, you should see it
20:13 < FeileX> I'm no guru, but I dont think udp connections can bind to a listening state?
20:13 < FeileX> again, not sure on that though
20:14 < irule> FeileX I am pulling my hair here, all I get is connection refused :s
20:15 < irule> right now I forwarded 443 into 1194 TCP, I telnet to that and I get the connection refused from outside
20:15 < irule> so I must hustle my modem before I can concentrate on actual openvpn problems
20:15 < FeileX> so, are you setting up a VPN for access to differnt lan?
20:15 < irule> yes 
20:16 < FeileX> ok.
20:16 < irule> I am accessing the server with ssh
20:16 < FeileX> so, are the risk of sounding repeditive.... can you post your server.conf / client.conf/ and iptables-save outputs?  besure to strip out any public IPs
20:17 < irule> sure
20:17 < FeileX> and is the vpn server on a dedicated box, or a vps?
20:17 < FeileX> and, what does ifconfig show?
20:21 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Ping timeout: 258 seconds]
20:24 < irule> FeileX http://pastebin.com/EZht0BtT  my iptables is not in because I am sure it is wide open for testing
20:25 < irule> FeileX it is a dedicated server at an office
20:26 < irule> FeileX ifconfig at the server has a tun0 all setup, my client is not connecting
20:27 < FeileX> the reason I need to see the iptables-save output is to see if the natting rules are in place
20:27 < irule> I got a couple calls from my customer asking wether they can turn the new pc off at night, PLEASE LEAVE IT ON! -oh, will it give me a much higher power bill? -NO! just an extra buck ;P haha
20:29 < irule> well I had to configure a thomson STS585 aDSL modem, I setup ssh and working, plus accepting 443 but redirecting to linux:1194
20:29 < irule> then the server is at ALLOW ALL at the moment :s
20:30 < FeileX> ok, without seeing the rule set, i can;t comment on it ;)
20:30 < FeileX> have you setup masqurading the output?
20:30 < irule> the modems?
20:30 < FeileX> no, the vpnserver;s
20:30 < FeileX> you can connect to the VPN server right?
20:31 < FeileX> or does that fail out also?
20:31 < irule> internet <-> modem  <-> linux <-> lan   ...yes with ssh
20:31 < irule> I already setup squid server to let antivirus update
20:31 < FeileX> so, you can go client -> ssh -> server, or client -> vpn -> vpnserver -> ssh -> lan?
20:31 < irule> yes
20:32 < FeileX> which one?  :P
20:32 < irule> I can ssh from internet through modem into the linux server :)
20:32 < FeileX> ok, and that does not touch the VPN?
20:33 < irule> well, right now I cant reach port 1194 through the adsl modem
20:33 < FeileX> ok
20:33 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
20:33 < irule> I telnet public-ip 443 and get connection refused
20:34 < irule> the modem is configured to get wan:443 and translate to server:1194
20:34 < FeileX> so what is your network topology?  internet -> adsl -> lan?
20:34 < FeileX> or is there a server behind the adsl that is doing your routing?
20:34 < irule> inteternet <-> adsl <-> linux <-> switch <-> lan :)
20:34 < FeileX> on
20:34 < FeileX> ok
20:35 < irule> that should be good right?
20:35 < FeileX> so, why do you want to have your VPN over 443?
20:35 < FeileX> are you not planning on ever serving up https?
20:36 < irule> a few minutes ago I routed wan:1194 to linux:1194 and I got a connection refused 
20:36 < irule> so I ve been playing with adsl modem config to no avail
20:37 < FeileX> what is the adsl router brand/ part number?
20:37 < irule> httpd? dont think so, all these guys want is access to a MS-DOS based invoicing program, hehehe -Looosers ha
20:37 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
20:37 < irule> THOMSON ST585
20:38 < irule> I played with other ports before, atm 22, 80 and 81 work porpperly, but I did take a while of reconfiguring to get them right
20:38 < FeileX> ok.
20:39 < FeileX> also, is there any reason you are using TCP in your configs, instead of UPD?
20:39 < irule> piece of adsl grrr haha
20:39 < FeileX> udp
20:39 < irule> to be able to telnet
20:39 < krzie> ehh?
20:40 < FeileX> ehhh was my though too, i even had an eyebrow raise a bit
20:40 < FeileX> ummm, there should be no reason to telnet into a VPN
20:40 < irule> telnet does udp too?
20:40 < irule> I want to TEST 1194 with telnet hehe
20:40 < irule> you can sit down now haha
20:41 < irule> is that good?
20:41 < FeileX> i'd just test it with a vpn client...
20:41 < FeileX> but thats just me
20:41 < irule> the client is timing out
20:41 < FeileX> ok... but getting back to the routeing...
20:42 < FeileX> assuming your ADSL router has an IP...
20:42 < FeileX> what port do you telnet too?
20:42 < FeileX> IE telnet 1.2.3.4 XXX
20:45 < irule> from client I run "telnet office-public-ip 443"
20:45 < irule> I get a connection refused
20:46 -!- happylife [~happylife@46.251.83.126] has quit [Ping timeout: 244 seconds]
20:46 < irule> within local server, I "telnet localhost 1194" and there is a positive response plus tun0 is there
20:46 < FeileX> and how are you forwarding the 443 conecntion to the linux box?
20:46 < irule> I am glad you noticed no error in the config
20:46 < FeileX> well, kinda...
20:46 < FeileX> you are set to listen on 1194
20:46 < irule> hmm, I will paste images since the thing is web based ok
20:47 < FeileX> but, unless you are doing some wierd port mapping, 443 isnt going to get to 1194
20:47 < FeileX> my recomendation is to use 1194 on the router, and push that to the linux box
20:52 < FeileX> looks like the ST585 can do port translation... did you set that up?
20:54 < irule> http://imagepaste.nullnetwork.net/viewimage.php?id=2832 and http://imagepaste.nullnetwork.net/viewimage.php?id=2833
20:55 < irule> "traducir a" means "translate to" in the linuxvpn definition at the second image
20:55 < irule> FeileX yes I did :)
20:56 < irule> FeileX on the rist image I have 22, 80 and 81 also setup and they work propperly, but not vpn's grr
20:57 < irule> ping *
20:57 < irule> 0 replies make me feel alone :(
20:57 < FeileX> sory
20:57 < FeileX> umm
20:57 < irule> :D
20:58 < FeileX> what are the 2 blank columns in the second image?
20:58 < irule> trigger protocol and trigger port
20:58 < FeileX> k
20:59 < FeileX> Can you try setting it up to go through 1194 on the router?
20:59 < FeileX> doh
21:00 < FeileX> also, if your client config file is set to 1194, its going to try 1194, not 443
21:00 < FeileX> nevermind, your client config file is for 443
21:00 < FeileX> but, can you try and just do 1194 -> 1194?
21:01 < irule> I will try again, using 1194 - 1194
21:01 < FeileX> just for simpliclitys sake?
21:01 < irule> sure
21:02 < irule> still timing out
21:02 < FeileX> ok
21:02 < irule> :s
21:03 < FeileX> can you ssh into the adsl firewall?
21:03 < FeileX> nevermind... you have that forwarded to the server
21:03 < FeileX> hmm
21:03 <+EugeneKay> Bypass the 4096bit encryption by overriding the secondary passthrough to the ATM ethernet!
21:03 < irule> I can ssh into public IP and I log into linux server
21:04 < FeileX> can you post your iptables-save output from the linux box?
21:04 < irule> sure
21:04 < FeileX> i am really thinking this has something to do witht hat
21:04 < FeileX> either that... or openvpn isnt actually running
21:04 < irule> it is blank
21:04 < FeileX> o.O
21:05 < FeileX> completly blank?
21:05 < irule> yes heh
21:05 < FeileX> umm
21:05 < irule> that is client
21:05 < FeileX> on the server....
21:05 < FeileX> the linux box, is iptables-save also blank?
21:06 < irule> sorry this is server http://pastebin.com/5rBCbv68
21:07 < irule> wide open for testing ;)
21:07 < FeileX> k, looking
21:09 < FeileX> if you do 'service openvpn status'
21:09 < FeileX> what do you see?
21:10 < irule> " * VPN 'server' is running" on the server
21:10 < FeileX> ok.
21:11 < FeileX> add this to your server.conf file
21:11 < FeileX> log-append  /var/log/openvpn.log
21:11 < FeileX> restart the server; service openvpn restart;
21:11 < FeileX> and then paste the output of /var/log/openvpn.log
21:12 < FeileX> and by restart the server, i mean resetart the openvpn server.  not the server machine
21:12 < FeileX> :)
21:14 < irule> " * VPN 'client' is running"
21:14 < irule> http://pastebin.com/PSH3dpnM
21:14 < irule> FeileX -not the server machine -lol ...I am not THAT clueless hahaha
21:16 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
21:16 < irule> netstat -planet |grep vpn   tcp        0      0 0.0.0.0:1194            0.0.0.0:*               LISTEN      0          108772      11713/openvpn 
21:16 < irule> so the server is fine
21:17 < FeileX> ok
21:17 < FeileX> if you telnet to 1194, can you conenct?
21:18 < FeileX> or does it still time out?
21:19 < irule> well it is not very clear, "telnet 192.168.1.253 1194" from server says :  Trying 192.168.1.253... Connected to 192.168.1.253. Escape character is '^]'.  (about 20 seconds of no answer)   Connection closed by foreign host. 
21:20 < FeileX> o.O
21:20 < krzie> if you are testing firewall, do it with nc on both sides
21:20 < krzie> you dont test openvpn with telnet
21:20 < irule> but from the client I get "Trying 189.161.164.249..." only, so I have only the modem to blame
21:20  * krzie goes away again
21:21 < irule> nc?
21:21 < FeileX> Like krzie said... try testing with a vpn client
21:21 < FeileX> make sure to update your client config to 1194
21:22 < FeileX> do you have any other linux boxes in that lan?
21:22 < krzie> nc, netcat
21:22 < irule> no, this is the first linux I give them, but I have other linux at other offices
21:23 < irule> now may I nc to test?
21:25 < krzie> on both sides
21:25 < krzie> not nc on 1 side and openvpn on the other
21:26 < krzie> you are testing general networking stuff, not openvpn
21:26 < krzie> when you get the general network stuff solved, you move on to openvpn
21:26 < irule> http://pastebin.com/nD9tPiT1 client just stays there
21:27 < krzie> and that means *drum roll*  you have a general networking issue
21:27 < irule> yeah yeah thanks anyways hehe
21:27 < krzie> likely because your server is not on 1.1.1.1 :-p
21:27 < irule> of course not, remember you told me to remove public IPs ;)
21:28 < FeileX> 1.1.1.1
21:28 < FeileX> :P
21:28 < krzie> i sure as hell did not
21:28 < irule> hehe ok
21:28 < krzie> in fact i generally go with this when i see that
21:28 < krzie> !topsecret
21:28 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
21:28 < FeileX> besides, you posted it above already  :P
21:28 < FeileX>  <irule> but from the client I get "Trying 189.161.164.249..." only, so I have only the modem to blame
21:28 < krzie> although right now i dont care, cause im not paying much attention anyways
21:28 < FeileX> but anyways
21:28 < krzie> ;]
21:29 < irule> haha of course sorry
21:29 < irule> you win he
21:29 < FeileX> well, i wouldnt put public IPs on pastebin
21:29 < FeileX> but, in here should be fine
21:29 < FeileX> we can trust vpnHelper  :)
21:31 < krzie> !tell FeileX i can not be trusted
21:31 < FeileX> :P
21:32 < FeileX> go back to cracking SHA keys with your amazon cloud... :P
21:32 < irule> guess what
21:32 < irule> I forwarded preset port telnet 23, configured client and server and now it works! hahaha
21:34 < FeileX> really?
21:34 < irule> btw its not like they are handling wikileaks material in a mom and pop hardware store haha
21:34 < irule> yes, the thomson is to blame here he
21:34 < FeileX> wierd
21:34 < irule> may be a BSD or something haha
21:35 < irule> thanks of course for the support hehe
21:37 < FeileX> np
21:38 < FeileX> now that your networking problems are solved... i forsee issues with openvpn  :P
21:38 < irule> ok, so I guess I should do port forwarding from tun0 to pc within the lan to complete my objective, right?
21:39 < krzie> lol FeileX you read my mind
21:40 < FeileX> well, first off... what is your objctive?
21:42 < irule> vpn client access to a samba share within the lan :)
21:42 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has joined #openvpn
21:42 < Some_Person> What is the meaning of this message: "TCP/UDP: Socket bind failed on local address [undef]: Address already in use"?
21:42 < irule> yes I told the guy that if his laptio gets stolen, I would have to give him his backups back hehe
21:42 <+EugeneKay> Well, it means that it couldn't bind to the socket on that address/port because it's already in use
21:43 < FeileX> Means that the application cannot bind to an address/port cuz somethin else already did
21:43 < krzie> likely not something else, you already have openvpn running
21:43 < Some_Person> oh, thank you
21:43 < Some_Person> my bad
21:43 < irule> the 1st openvpn instance took the socket, so the second instance cant take it
21:43 < krzie> EugeneKay, wow, how did you decipher that?
21:43 < irule> hehehe
21:44 <+EugeneKay> Magic decoder ring
21:44 < FeileX> damn, i want that
21:44 < krzie> oooo i want one!
21:44 < irule> kewl
21:44 < Some_Person> hmm, well it connected this time, but I can't access the net through it
21:44 < krzie> is it a he-man one?
21:44 < FeileX> irule:  So all you are doing is setting up for samba sharing?
21:44 < krzie> !redirect
21:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
21:45 < FeileX> do you have a samba share already setup?
21:45 < irule> FeIliX yes, the trick is that I am giving access to a win XP smb server in the lan, not directly from the linux server
21:45 < Some_Person> traffic is flowing through the VPN already
21:46 < Some_Person> so I guess I need to deal with IP forwarding and/or NAT
21:46 < FeileX> irule, i doubt your are this lucky, but it is worth a shot.....
21:46 < FeileX> once your client is connected....
21:46 < irule> yes, fortunately I already set it up for squid
21:46 < Some_Person> !ipforward
21:46 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
21:46 < Some_Person> !linipforward
21:46 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
21:46 < krzie> irule, 
21:46 < krzie> !serverlan
21:46 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation
21:46 < FeileX> can you kust do \\%SMB_IP$\c$ ?
21:48 < FeileX> ahh, good point, his server config isnt pushign the lan
21:48 < Some_Person> hmm, I already have net.ipv4.ip_forward=1 in sysctl.conf
21:48 < Some_Person> !nat
21:48 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
21:48 < irule> thanks for the tips, but that is for monday since the jerkoffs did not leave the windows smb share on, so I cant test or anything, and its time for sheep counting haha thanks a lot!
21:48 < FeileX> Some_Person, you'll need to set it in /proc/sys/net/.... first
21:49 < Some_Person> FeileX: So just run "echo 1 > /proc/sys/net/ipv4/ip_forward"?
21:49 < FeileX> for it to take imendet affect.... or reboot your server for the sysctl
21:49 < FeileX> yup  :)  echo 1 > /proc/sys/net/ipv4/ip_forward 
21:50 < krzie> (or you could always set it using sysctl ;] )
21:50 < FeileX> shhhh
21:50 < irule> Some_Person this is my running script very short, it does that ip forwarding http://pastebin.com/jgpjakRP
21:50 < krzie> Some_Person, 
21:50 < Some_Person> ok, something else is still wrong
21:50 < krzie> !linnat
21:50 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
21:51 < Some_Person> I hate iptables
21:51 < Some_Person> I probably screwed it all up earlier
21:51 < irule> iptables does nifty tricks haha
21:52 < Some_Person> Is there some way to reset iptables or something?
21:52 < FeileX> yes there is.  :)
21:52 < krzie> !iptables
21:52 < Some_Person> I probably need that
21:52 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
21:52 < FeileX> ok fine. that does it
21:52 < FeileX> lol 
21:52 < irule> Some_Person the reset is in the script I just gave you http://pastebin.com/jgpjakRP
21:53 < krzie> FeileX, this ones for you =]
21:53 < krzie> !factoids
21:53 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
21:53 < Some_Person> hmm, but my server's interface is (I think) "venet0", not eth0
21:54 < irule> Some_Person ok do your adjustments hehe
21:54 < krzie> lol
21:54 < Some_Person> also it seems to have no local IP, just a public one
21:54 < irule> cool
21:55 < irule> my script is for a server with 2 nics, 1 is lan and 2 is wan
21:55 < Some_Person> (it's a dirt cheap VPS)
21:55 < irule> 2 nics is a requirement for port forwarding hehe
21:55 < krzie> umm no
21:56 < krzie> you're in a help channel that requires virtual adapters to exist
21:56 < krzie> so ya... that was false
21:56 < irule> dirt cheap VPS are boring haha I had one with squid for hulu hehe
21:56 < Some_Person> It's a $15/year VPS running Debian
21:57 < krzie> Some_Person, what software do they use for virtualization?  venet0 makes me think of vmware
21:57 < FeileX> Some_Person, so what are you trying to do.... VPN into a lan, or just vpn your home traffic to the internets on the outside of the VPS
21:57 < krzie> but ive never seen vmware for vps's
21:57 < Some_Person> I want to use the VPS as a VPN server
21:57 < krzie> !goal
21:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:57 < irule> easy
21:58 < irule> !goal
21:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:58 < Some_Person> I would like to access the internet over my VPN, hosted on the VPS
21:58 < irule> hahaha
21:58 < Some_Person> clear enough?
21:58 < krzie> !linnat
21:58 < FeileX> yup
21:58 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
21:58 < krzie> !linipforward
21:58 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
21:58 < krzie> and redirect-gateway def1 in client config
21:59 < krzie> booya done (unless your virtual machine software has issues)
21:59 < Some_Person> Already have redirect-gateway def1 and I've already done both the temp and perm solutions there
21:59 < krzie> since you didnt say which software it is, i couldnt know
21:59 < Some_Person> I'm assuming NAT is the problem at this point
22:00 < Some_Person> What's the command to completely reset iptables?
22:01 < FeileX> !iptables
22:01 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
22:01 < FeileX> iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z
22:01 < FeileX> sets all to accept (so you dont get locked out) flushes all rules; zeros all tables
22:02 < FeileX> *zeros all counters
22:03 < Some_Person> ok, so now I just need to figure out what to set for openvpn
22:03 < krzie> do you have the bot on ignore  or something?
22:04 < FeileX> http://www.openvpn.net/index.php/open-source/documentation/howto.html#redirect
22:04 <@vpnHelper> Title: HOWTO (at www.openvpn.net)
22:04 < krzie> [19:58]  <vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
22:04 <@vpnHelper> Title: Linux 2.4 NAT HOWTO (at netfilter.org)
22:06 < Some_Person> Well, I ran "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE", but I got "iptables: No chain/target/match by that name."
22:06 < Some_Person> (and yes, I see the bot)
22:07 < FeileX> sounds like you do'nt have a nat table
22:08 < Some_Person> what does that mean?
22:08 -!- irule [~usuario@187.140.123.17] has quit [Ping timeout: 244 seconds]
22:09 < krzie> it prolly means your provider uses openvz
22:09 < FeileX> iptables -L -t nat
22:09 < Some_Person> Is that bad?
22:10 < FeileX> try that.  if it comes back with no table, then it doest exist.
22:10 < krzie> nope, but it does matter
22:10 < Some_Person> it's just blank
22:10 < krzie> which is why i asked you 2x what software they use
22:10 < krzie> !openvznat
22:10 <@vpnHelper> "openvznat" is a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP>
22:10 < Some_Person> I'm new to this stuff; had no idea what "openvz" was
22:11 < FeileX> https://forums.openvpn.net/topic7722.html
22:11 <@vpnHelper> Title: OpenVPN Support Forum IPTABLES secure Internet tunnel : Routing and Firewall Scripts (at forums.openvpn.net)
22:11 < FeileX> Take a look at the openVS section
22:11 < krzie> hey cool!
22:11 < Some_Person> ok, thank you
22:12 < Some_Person> and I'm sorry for annoying y'all
22:12 < krzie> nah man you're fine
22:13 < FeileX> ok, I'm gonna take off.... got a cute girl who wants my attention.  
22:13 < FeileX> so, sadly you guys all lose that battle
22:13 < Some_Person> It's working now
22:13 < Some_Person> thank you
22:13 < FeileX> good good :)
22:13 < krzie> nice =]
22:13 < krzie> FeileX, have a g'nite ;]
22:14 < krzie> (sounds like you will!)
22:14 < FeileX> lol
22:14 < FeileX> ehhh, i'll be back later.  I run on a 28 hour day....
22:14 < Some_Person> hmm, speed test looks pretty good
22:14 < FeileX> http://xkcd.com/320/
22:14 <@vpnHelper> Title: xkcd: 28-Hour Day (at xkcd.com)
22:14 < Some_Person> http://www.speedtest.net/result/1614883184.png
22:14 < krzie> if i ever get out of work ill be doing the same
22:16 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:17 < Some_Person> anyway, I appreciate the help
22:17 < krzie> np
22:18 < krzie> lol @ xkcd, not sure how i hadnt seen that one
22:18 < krzie> nah i must have, but long ago
22:27 -!- d9b [nonuser@207.204.240.173] has joined #openvpn
22:28 -!- d9b [nonuser@207.204.240.173] has quit [Client Quit]
22:28 -!- d9b [nonuser@207.204.240.173] has joined #openvpn
22:29 < d9b> !welcome
22:29 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:35 < d9b> forgive my ignorance but im trying to setup a openvpn client on debian.. part of my config package from the provider included a xxx.ovpn file, do I use that as my config file or do I manually create a .conf?
22:35 < krzie> thats your config
22:36 < d9b> k thats what I thought, thanks
22:38 < datruth_> !30
22:38 < krzie> !/30
22:38 -!- Slowvpn [43b9edf3@gateway/web/freenode/ip.67.185.237.243] has joined #openvpn
22:38 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
22:38 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
22:38 < Slowvpn> Hi everyone!
22:38 < datruth_> !topology
22:38 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
22:40 < datruth_> !mitm
22:40 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: ns-cert-type server in the client config
22:40 < Slowvpn> I know you have heard this a hundred times, but my AceVPN is really slow and my regular bandwidth is 20 Mbit. Anyone?
22:41 < datruth_> !iporder
22:41 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
22:41 < Slowvpn> I have already tried the reg fix, no help.
22:41 < datruth_> !static
22:41 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
22:42 < datruth_> dunno what acevpn is
22:42 < krzie> feel free to do one of these if you want:
22:42 < krzie> !msg
22:42 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key> or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
22:42 < krzie> !factoids
22:42 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
22:43 < datruth_> !ccd
22:43 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
22:44 < datruth_> hrmm I think i've done all I can to make openvpn secure as I can
22:45 < Slowvpn> !welcome
22:45 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:46 < Slowvpn> !logs
22:46 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
22:47 < Slowvpn> !howto
22:47 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:51 < Slowvpn> !pastebin
22:51 <@vpnHelper> Unable to download feed.
22:52 < Slowvpn> !pastebin
22:52 <@vpnHelper> Unable to download feed.
22:52 < Slowvpn> !logs
22:52 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
22:54 < Slowvpn> Sat Nov 26 20:52:12 2011 OpenVPN 2.2.0 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Oct  4 2011 Sat Nov 26 20:52:12 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Sat Nov 26 20:52:12 2011 LZO compression initialized Sat Nov 26 20:52:12 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ] Sat Nov 26 20:52:12 2011 Socket Buffers: R=[8192->8192] S=[8192->81
22:54 < Slowvpn> !logs
22:54 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
22:54 < krzie> LOL i forgot i had webchat on ignore for a second, thought the bot was flipping out
22:54 < Slowvpn> !pastebin
22:54 <@vpnHelper> Unable to download feed.
22:55 < Slowvpn> !welcome and !goal
23:03 < Slowvpn> !logs
23:03 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
23:05 < datruth_> lol krzie 
23:07 -!- Slowvpn [43b9edf3@gateway/web/freenode/ip.67.185.237.243] has quit [Quit: Page closed]
23:08 -!- non [nonuser@207.204.240.150] has joined #openvpn
23:08 -!- non [nonuser@207.204.240.150] has quit [Client Quit]
23:09 -!- d9b [nonuser@207.204.240.173] has quit [Ping timeout: 260 seconds]
23:14 -!- Denial [Denial@drgi.co.uk] has quit []
23:22 -!- xTheElySiaNx is now known as Mp5shooter
--- Day changed Sun Nov 27 2011
00:00 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
00:11 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
00:13 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
00:15 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p17934>
00:36 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 244 seconds]
00:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
00:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:09 <@vpnHelper> RSS Update - forum: OpenVPN client on Windows 7 <http://forums.openvpn.net/topic9286.html#p17936> || [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p17935>
01:18 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has joined #openvpn
01:27 <@vpnHelper> RSS Update - forum: OpenVPN client on Windows 7 <http://forums.openvpn.net/topic9286.html#p17937>
01:33 -!- Essobi [~Essobi@74-128-75-198.dhcp.insightbb.com] has quit [Ping timeout: 260 seconds]
01:48 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 244 seconds]
01:51 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
02:15 <@vpnHelper> RSS Update - forum: OpenVPN client on Windows 7 <http://forums.openvpn.net/topic9286.html#p17938>
02:20 -!- Essobi [~Essobi@74-128-72-207.dhcp.insightbb.com] has joined #openvpn
02:26 -!- mdupont [~mdupont@ip-92-50-78-150.unitymediagroup.de] has quit [Changing host]
02:26 -!- mdupont [~mdupont@flossk/mdupont] has joined #openvpn
02:30 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:10 -!- Dweezahr [~Dweezahr@flits102-34.flits.rug.nl] has joined #openvpn
03:15 -!- Dweezahr [~Dweezahr@flits102-34.flits.rug.nl] has quit [Read error: No route to host]
03:15 <@vpnHelper> RSS Update - forum: OpenVPN client on Windows 7 <http://forums.openvpn.net/topic9286.html#p17939>
03:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
03:36 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
03:55 <+hyper_ch> !goal
03:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:41 -!- j-a-b-b-a [~Jabbe@p5B280F6F.dip0.t-ipconnect.de] has joined #openvpn
05:44 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 252 seconds]
05:46 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
05:59 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Ping timeout: 244 seconds]
06:05 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
06:06 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
06:21 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:37 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
06:40 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:41 -!- corretico_ [~luis@201.201.44.82] has quit [Quit: Leaving]
06:54 -!- michl [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
06:54 -!- mich [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
06:55 -!- mich is now known as fjutscha
06:56 -!- fjutscha [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has left #openvpn []
07:01 -!- ibins [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
07:02 -!- catsup [d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
07:03 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
07:04 -!- ibins [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
07:07 -!- ibins [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
07:08 -!- ibins [~mich@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Client Quit]
07:14 -!- michl [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
07:17 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:32 -!- ravemaster [b816c2c6@gateway/web/freenode/ip.184.22.194.198] has joined #openvpn
07:36 -!- ravemaster [b816c2c6@gateway/web/freenode/ip.184.22.194.198] has quit [Quit: Page closed]
08:01 -!- chute [~chute@84.121.89.190.dyn.user.ono.com] has joined #openvpn
08:51 -!- `Ile` [~kvirc@77-46-178-184.dynamic.isp.telekom.rs] has joined #openvpn
08:55 -!- Gravitron [~admin@76.92.159.145] has joined #openvpn
08:55 -!- Gravitron [~admin@76.92.159.145] has quit [Changing host]
08:55 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
08:57 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
08:57 < `Ile`> !welcome
08:57 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:58 -!- newl [~newl@97.75.165.156] has joined #openvpn
09:08 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
09:08 -!- newl [~newl@97.75.165.156] has joined #openvpn
09:09 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 258 seconds]
09:11 < chute> !howto
09:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:11 < chute> !goal
09:11 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:14 -!- newl [~newl@97.75.165.156] has left #openvpn []
09:21 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
09:23 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html>
09:24 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:24 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
09:28 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:29 -!- `Ile` [~kvirc@77-46-178-184.dynamic.isp.telekom.rs] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
09:30 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Read error: Connection reset by peer]
09:33 < FeileX> Still here chute?
09:35 <@vpnHelper> RSS Update - forum: Getting this to work. <http://forums.openvpn.net/topic9288.html>
09:37 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
09:41 <@vpnHelper> RSS Update - forum: Getting this to work. <http://forums.openvpn.net/topic9288.html#p17942>
09:47 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17943>
09:55 < chute> yes
09:55 < chute> Hello FeileX
09:56 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
09:57 < FeileX> Hey ehy
09:57 < FeileX> *hey
09:58 < FeileX> so, whats up, and whats broken?  :)
09:58 < krzee> moinmoin FeileX 
09:59 < FeileX> krzee, didnt you have some other vowels in your name  o.O?
09:59 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17944>
10:01 < FeileX> brb, food.  5 min.
10:04  * FeileX is back.... mhmmmm Turkey...
10:04 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17945>
10:04 -!- dupondje [~dupondje@artemis.dupie.be] has left #openvpn []
10:05 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
10:06 < FeileX> Chute, still alive over there?
10:18 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
10:20 -!- h8R [~niko@pppoe-132-148.ssi.bg] has quit [Remote host closed the connection]
10:40 -!- _julian [~quassel@hmbg-4d069b0c.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
10:44 < krzee> FeileX, my 2nd client is krzie
10:44 < reiffert> h4x0r
10:44 < krzee> moin reif
10:47 -!- _julian [~quassel@hmbg-4d06a6b7.pool.mediaWays.net] has joined #openvpn
11:16 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 240 seconds]
11:16 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:18 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
11:18 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
11:21 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-15.html#p17947>
11:21 <@ecrist> krzee: https://forums.openvpn.net/topic9289.html  ;)
11:21 <@vpnHelper> Title: OpenVPN Support Forum Using Private Messages to solicit help. : Off Topic, Related (at forums.openvpn.net)
11:26 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:26 -!- mode/#openvpn [+o mattock] by ChanServ
11:32 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17948>
11:34 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
11:36 < datruth_>  /join #openvpn-devel
11:36 < datruth_> ;/
11:44 < chute> Yes, Feilix :)
11:45 < FeileX> ahh ok
11:45 -!- chute [~chute@84.121.89.190.dyn.user.ono.com] has quit [Quit: Leaving]
11:45 < FeileX> or... not
11:45 < FeileX> i guess 45 seconds is to long to wait after being gone for an hour....
11:47 < FeileX> krzee, you active still?
11:47 <+hyper_ch> !blame
11:47 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
11:47 <+hyper_ch> oh bot, where art though?
11:48 <+hyper_ch> there it iss :)
11:48 <+hyper_ch> FeileX: as you can see, krzee is busy blaming dazo
11:51 < FeileX> very true...
11:51 < FeileX> http://forums.openvpn.net/topic8857-15.html#p17947  uggg....
11:51 < FeileX> lol
11:51 <@vpnHelper> Title: OpenVPN Support Forum VPN Client IP not showing up in server logs... : Server Administration - Page 2 (at forums.openvpn.net)
11:51 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
11:56 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17949>
12:08 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17950>
12:24 < krzee> FeileX, are you mimiko?
12:25 < krzee> because this line:
12:25 < krzee> 0 0 REJECT all -- !lo any anywhere 127.0.0.0/8 reject-with icmp-port-unreachable
12:26 < krzee> is saying that everything from 127.* that comes over any interface except loopback should be dropped
12:26 < krzee> which is correct, those should be dropped
12:31 < reiffert> 0 bytes and 0 packets have hit, eh?
12:55 < Olipro> the kernel will drop martians at ingress, so iptables will never have to deal with them
13:04 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has joined #openvpn
13:09 < EugeneKay> Yip yip yip?
13:09 < FeileX> I am no mimiko
13:09 < FeileX> If you are talking about the forums, I am FeileX on there too
13:13 < FeileX> Sorry...  my webserver just took a dump...
13:14 < FeileX> and decided not to mount the FS on the way back up
13:14 < FeileX> so i am working on that.....
13:15 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has joined #openvpn
13:16 < fuho> Hi, I am trying to set up OpenVPN on my VPS. When I cat /dev/net/tun I get File descriptior in bad state.
13:16 < fuho> How do I set up tun/tap, so I can use the bridge mode?
13:17 < EugeneKay> !layer2
13:17 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
13:17 < EugeneKay> !tunortap
13:17 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
13:17 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
13:17 < EugeneKay> You don't want bridging.
13:18 < fuho> EugeneKay: Which one has less overhead?
13:18 < EugeneKay> TUN.
13:18 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17951>
13:18 < EugeneKay> (and routed mode)
13:19 < datruth_> to bad openvpn can't run in a jail
13:19 < EugeneKay> Except it can.
13:19 < datruth_> err?
13:19 <+hyper_ch> prisoners do get computer access nowadays
13:19 < EugeneKay> !fbsdjail
13:19 <@vpnHelper> "fbsdjail" is <thei0s> krzie: if you are interested in the solution: I needed to add to hosts rc.conf the creation of tun0 device, create a special devfs ruleset with tun0 unhiden, configure that it is used in the devfs mount point inside chroot in my jail and specify openvpn --dev tun0 parameter and it seems that this is it... so, thank you for assistance and ideas
13:20 <+hyper_ch> :)
13:20 < EugeneKay> Dunno about doing it inside of a linux chroot, but that's basically what !openvz is.
13:21 < datruth_> wow okay so I just need to find outwhat ruleset I need to make tun0 unhiden
13:21 < Olipro> no, you ask the OpenVZ host to enable the tun interface for your container
13:21 < EugeneKay> He doesn't have openvz, you tool
13:22 < EugeneKay> I was using it as a comparison point.
13:22 < Olipro> you expect me to read back more than 5 lines?
13:22 < Olipro> psh
13:22 < fuho> Hey, I do have OpenVZ and am having problems getting OpenVPN setup.
13:23 < fuho> is there anything I should know
13:26 < fuho> I got the "supposrt" to enable tun/tap for me, so now I get "cat: /dev/net/tun: File descriptor in bad state" I thought this is a good sign.
13:26 < EugeneKay> !openvz
13:26 <@vpnHelper> "openvz" is http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn
13:27 < fuho> I read that already all it says is to read http://openvpn.net
13:27 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
13:28 < fuho> (After config steps above, which I did)
13:28 < EugeneKay> Sorry, I don't speak OpenVZ.... Olipro?
13:29 < fuho> After this, do I ahev to somehow create these interfaces? because I can't see them in etc/network/interfaces.
13:29 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
13:29 < fuho> I am sorry if I am not explaining myself correctly I am doing my almost best :) I am very noobish concerning networking.
13:29 < Olipro> if tun has actually been enabled on your container, you can use OpenVPN as you would on any other system
13:30 < Olipro> i.e. dev_type tun, dev blah
13:30 < EugeneKay> He seems to be saying that the tun device isn't actually there
13:30 < fuho> the device is i think
13:30 < fuho> but the interface isnt
13:30 < fuho> should I pastebin the output from cat?
13:31 < Olipro> no
13:31 < Olipro> just setup an OpenVPN config and start it
13:31 < fuho> Well, thats what I am trying to do
13:31 < Olipro> check interface status with ifconfig or ip link
13:31 < fuho> ifconfig
13:31 < fuho> sry wrong window
13:31 < EugeneKay> Olipro - my new phone shipped :-D
13:32 < Olipro> what did you get
13:32 < EugeneKay> HTC Amaze
13:32 < fuho> ifconfig doesnt show tun or tap
13:32 < fuho> just venet
13:33 < Olipro> fine
13:33 < Olipro> just deal with OpenVPN
13:33 < Olipro> the interface will be created when you start the daemon
13:35 < fuho> I think i need a tap device name for that, don't I?
13:36 < Olipro> you can use an arbitrary name for the dev option providing you explicitly state it using the dev-type option
13:36 < Olipro> --dev-type tap --dev ilikeboobies
13:36 < fuho> in /usr/share/webmin/openvpn/br_scripts/bridge_start ?
13:36 < Olipro> I'm probably giving EugeneKay ideas now
13:37 < Olipro> I don't use webmin, or whatever that is
13:37 < Olipro> so that's for you to figure out
13:37 < fuho> webim is just a wrapper
13:37 < EugeneKay> ohgodwebmin
13:37 < fuho> openvpn is still the same right
13:38 < Olipro> ...yes
13:38 < Olipro> so why are you using some awful wrapper
13:39 < fuho> for quick creation of virtual hosts
13:40 < fuho> opnevpn --dev-type tap --dev whatever seems to run
13:41 < fuho> so there must be something with the "wrapper" probbaly
13:41 < datruth_> hrmm
13:42 < datruth_> so I wounder once openvpn is installed on the jail should I destroy the tun0 interface and kill off openvpn and start it from the jail?
13:43 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has quit [Remote host closed the connection]
13:45 < fuho> to hell with webmin
13:50 -!- newl [~newl@97.75.165.156] has joined #openvpn
13:55 < fuho> Is there a reason to install OpenVPN 2.1.4 instead of 2.2.1?
13:55 -!- happylife [~happylife@46.251.83.126] has joined #openvpn
13:55 < EugeneKay> No. Newer is better.
13:55 < fuho> I read about some bug in new version.
13:55 <+hyper_ch> EugeneKay: even if a new version is full of regressions?
13:56 < EugeneKay> Such as?
13:56 < fuho> So there is nothing I should know about before installing that vesrion?
13:56 < krzee> there is a log of changes, fyi
13:56 < krzee> !changelog
13:56 <@vpnHelper> "changelog" is (#1) http://www.openvpn.net/changelog.html to see the openvpn changelog or (#2) For OpenVPN 2.2 changelog , see http://www.openvpn.net/index.php/open-source/documentation/change-log/425-changelog-for-openvpn-22.html
13:56 < fuho> I really don't know thats why I am asking here, I read it in one tutorial
13:57 < fuho> Tutorial to get OpenVPN working on Tomato routers
13:57  * newl erases answer to fuho
13:58 < fuho> But what is the difference between 2.1 and 2.2 bracnch?
13:59 < EugeneKay> hyper_ch - I can't be bothered to poke through the minutae of the changelog, so, are there any regressions of note between 2.1 and 2.2 that you would care to point out?
13:59 < EugeneKay> OpenVPN, to the best of my knowledge, knows better than to make a Major change in a Minor version ;-)
13:59 <+hyper_ch> EugeneKay: I didn't say there were any... I just spoke generally
14:00 < EugeneKay> Regressions generally appen in Major versions, so.... just update to the new stuff. Please.
14:00 -!- Gravitron [~admin@cpe-76-92-159-145.kc.res.rr.com] has joined #openvpn
14:01 < fuho> ok
14:01 -!- Gravitron [~admin@cpe-76-92-159-145.kc.res.rr.com] has quit [Changing host]
14:01 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
14:02 < EugeneKay> fuho - What packaging are you looking at that's doing the 2.1.4 ---> 2.2.1 jump? EPEL?
14:02 < fuho> EugeneKay: I am installing fresh I jsut completely reinstalled my VPS after I got fed up with Webmin
14:03 < EugeneKay> Ah.
14:03 < fuho> EugeneKay: I am on Ubuntu 11.04 64b so will use APT
14:04 <+hyper_ch> why 11.04?
14:04 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
14:04 -!- Confiscative [confiscati@feather.perl6.nl] has joined #openvpn
14:04 < fuho> I read about 10.04 LTS having problems wit random 100% CPU on 10.04
14:05 <+hyper_ch> why now 11.10?
14:05 < fuho> Also was hoping for latest versiuons of software
14:05 < Confiscative> !welcome
14:05 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 244 seconds]
14:05 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:05 <+hyper_ch> since 11.04 is no lts release
14:05 < Confiscative> !wiki
14:05 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
14:06 < EugeneKay> That's akin to reading that diesel semis have problems with getting stuck at 100% and buying a gasoline minicar instead.
14:06 < fuho> hyper_ch: I know its not, but I will probably reinstall the VPS 6 times before christmas, I am not using it for anything serious, I am just learning
14:06 < EugeneKay> LTSes are stable. That's why its a LTS.
14:06 < EugeneKay> The internet is full of people who don't have a clue what they're talking about, most of them in forum posts.
14:07 < fuho> LTS have longer supposrt, I dont think it necesarily means it will be more stable than later releases
14:07 < fuho> or better fit 
14:07 <+hyper_ch> fuho: at the end of the 5 year support it will be more stabl
14:07 < fuho> yes, then yes :)
14:07 < EugeneKay> The fact that they're pushed to corporations and such as being stable means that they're stable.
14:07 <+hyper_ch> if you want stable, you go with debian stable
14:08 < EugeneKay> Har har
14:08 < datruth_> nice so the vpn works under a jail but everytime I restart the jail I get the following error ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
14:08 < fuho> hyper_ch: I wanted to, but I never have the balls to do the switch, I am used to Ubuntu
14:08 < datruth_> anyone know what  thats about?
14:08 < fuho> I dont even know how much different would it really be
14:08 <+hyper_ch> debian is like ubuntu
14:08 <+hyper_ch> or ubuntu is like debian
14:08 <+hyper_ch> and you can get sudo easily also
14:08 < EugeneKay> "Ubuntu is an ancient African word which means 'I can't configure Debian'"
14:09 < fuho> like is important word here, I still consider myslef a noob
14:09 <+hyper_ch> all my debian servers were sudodized
14:09 < Confiscative> Hi. I'm running OpenVPN using the graphical frontend Tunnelblick on OSX. I would like to capture traffic (with an application such as Wireshark) between an web-application I'm using (port 80) and a server that can only be reached through the VPN I'm connected to. Could anybody please point me in the right direction on how to do this?
14:09 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has left #openvpn ["Leaving"]
14:10 < EugeneKay> Wireshark man pages would be a good place to start. There's nothing special about OpenVPN as a network interface, from the client end, as far as wireshark is concerned.
14:10 < fuho> hyper_ch: Another reason that held me back from Debian was that it has older vesrions of everything, last time I checked they were still shipping with python 2.5
14:10 < datruth_> nevermind figured it out
14:10 <+hyper_ch> debian stable has 2.6 meanwhile
14:12 < fuho> Funny thing thoughm now looking at the packages for Ubuntu 11.04 and I think they have 2.2.0 in repos
14:12 < fuho> so I will still have to install from source :(
14:12 < fuho> If I install from source, can I still apt-get upgrade?
14:13 < fuho> I can't right?
14:14 < Confiscative> EugeneKay: Ah, thanks. In Wireshark, I had a filter set for port 80, but somehow when capturing interface 'tun0' (to which OpenVPN is configured), it can't determine the port, so it displayed nothing. With the filter off I can now see the HTTP traffic though.
14:15 < EugeneKay> fuho - 2.2.0 is still good stuff, only a few small changes
14:17 < datruth_> interresting in the jail the openvpn proc doesn't die even if the jail gets stop'd
14:18 < fuho> EugeneKay: Thats what Ubuntu said. But when I actually apt-get installed it installed 2.1.3
14:18 < EugeneKay> Sounds like Ubuntu. 
14:20 < EugeneKay> Maybe there's a different package for 2.2.x? 
14:21 < fuho> Looks like there isn't maybe if i swith to diffeent repo?
14:22 < fuho> 2.1.3 is the current one for DEbian too, so thats probbaly why
14:22 < EugeneKay> I really dunno, I don't Ubuntu.
14:23 < fuho> EugeneKay: Is there anthing really bad about 2.1.3
14:23 < fuho> ?
14:23 < EugeneKay> No, it's perfectly servicable.
14:24 < EugeneKay> But if the newer package was available, you should use that.
14:24 < EugeneKay> Since it isn't, dunworryboudit
14:24 < FeileX> well, you could look at the change log, that would have all the differences
14:24 < FeileX> !changelog
14:24 <@vpnHelper> "changelog" is (#1) http://www.openvpn.net/changelog.html to see the openvpn changelog or (#2) For OpenVPN 2.2 changelog , see http://www.openvpn.net/index.php/open-source/documentation/change-log/425-changelog-for-openvpn-22.html
14:25 < fuho> FeileX: Thanks, changelog is divided into 2.1 and 2.2, they toverlap timewise, therefore I belive they are being developed simultaneously
14:25 < fuho> Which will make it later difficuilt ẗo switch to 2.2 from 2.1.x, buit that shouldn matter
14:25 < fuho> Kind of offtopic question
14:26 < datruth_> In FreeBSD how can I create the tun device at boot time?
14:26 < fuho> If I compute dh 4096, can I then reuse it in future installations, or do I ahev to wait an hour every time i reinstall openvpn
14:26 -!- datruth_ is now known as datruth
14:27 < EugeneKay> You can reuse it, sure. They're public numbers for most intents and purposes(see the Wikipedia page on Diffie-Helman Key Exchange)
14:27 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
14:28 < EugeneKay> If the server is compromised, you ought to change your .dh, same as your server.key
14:30 < datruth> ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address <-- this error seems to be normal?
14:31 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17952>
14:32 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 252 seconds]
14:35 < datruth> maybe if running openvpn in the jail I can run it as root or still good to run it as nobody?
14:35 < fuho> Hmm, decided to install from soure and getting no acceptable C compiler found in $PATH
14:36 < fuho> can't belive gcc isn't installed, will apt-get it
14:41 < newl> you need more then that  do you have libc etc
14:42 < fuho> I am looking at it right now, it is tellimng me : LZO headers not found, but I instlled LZO library already
14:42 < fuho> and LZO is actually why I am implementing openVPN :)
14:43 < krzie> try a compile option
14:43 < krzie> what OS are you in?
14:44 < fuho> Ubuntu 11.04
14:44 < datruth> anyone know?
14:45 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 260 seconds]
14:45 < fuho> Hmm I have liblzo 2.03 which version is OpenVPN compatible with?
14:46 < krzie> fuho, you checked google, of course, right
14:46 < krzie> ?
14:47 < krzie> !google lzo2 openvpn
14:47 <@vpnHelper> OpenVPN Support Forum • OpenVPN Install Guides : Tutorials: <https://forums.openvpn.net/topic2.html>; BuildingOnWindows – OpenVPN Community: <https://community.openvpn.net/openvpn/wiki/BuildingOnWindows>; Antwort: Re: Antwort: Re: [Openvpn-users] How to be sure lzo2 ...: <http://openvpn.net/archive/openvpn-users/2005-09/msg00335.html>
14:47 < krzie> looks like a yes :p-
14:47 < fuho> krzie: I wouldnt ssay so, I forgot to install dev version :(
14:48 < krzie> fuho, you could just install openvpn from your package manager you know
14:48 < fuho> Now configure stops at OpenSSL, so I guess I am missing OpenSSL
14:48 < fuho> krzie: Yes, but ubuntu unly has 2.1.3 in the repo
14:48 < krzie> i would say you need a different repo
14:48 < krzie> just guessing tho
14:50 < krzie> http://permalink.gmane.org/gmane.network.openvpn.devel/4880
14:50 <@vpnHelper> Title: OpenVPN apt repositories now available (at permalink.gmane.org)
14:50 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
14:51 < krzie> hit #8 from google:  repository ubuntu openvpn 2.2.1
14:51 < krzie> (first one i clicked tho(
14:51 < fuho> ...Currently
14:51 < fuho> supported distributions are Debian Lenny (5.x) and Ubuntu Lucid Lynx
14:51 < fuho> (10.04) in i386 and amd64 flavours...
14:52 < fuho> thanks though. I am trying to learn as much as I can so I don't mind building it
14:52 < krzie> that was in august, give it a try?
14:52 < krzie> oh ok, then you shouldnt need to ask questions on compiling it every step of the way, it compiles like a normal unix app ;]
14:53 < fuho> :) Which is very not normal for me, but you are right I should ask less and try to figure it out more myself.
14:56 < SviMik> hi all. does anybody know how to recover index.txt from keys directory? I tried to use google, but there is no explanation of the file format
14:57 < krzie> recover?
14:58 < SviMik> my index.txt was partially destroyed by mistake
14:58 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
14:58 < krzie> ouch
14:58 < SviMik> but all other files (certs) are ok
14:58 < krzie> ild look at the source code to easy-rsa and ssl-admin to see how they handle it
14:59 -!- Gravitron [~admin@76.92.159.145] has joined #openvpn
14:59 -!- Gravitron [~admin@76.92.159.145] has quit [Changing host]
14:59 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:00 < datruth> krzie: do you know how to get the device going via boot time??
15:01 -!- gyyrog_ [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
15:05 -!- master_of_master [~master_of@p57B54945.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
15:06 < krzie> "get the device going" ?
15:07 -!- master_of_master [~master_of@p57B54855.dip.t-dialin.net] has joined #openvpn
15:16 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
15:27 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p17953>
15:28 -!- newl [~newl@97.75.165.156] has left #openvpn []
15:30 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
15:33 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Remote host closed the connection]
15:33 < datruth> krzie: nevermind figured it out
15:44 -!- happylife [~happylife@46.251.83.126] has quit [Ping timeout: 260 seconds]
15:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
16:06 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
16:24 < datruth> seems like in a freebsd jail running openvpn I can't connect anywhere after connecting to the vpn 
16:30 -!- Rolybrau [~Rolybrau@34-185.78-83.cust.bluewin.ch] has joined #openvpn
16:30 -!- Rolybrau [~Rolybrau@34-185.78-83.cust.bluewin.ch] has quit [Changing host]
16:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:36 -!- JoeGazz84 is now known as JG84|Dinner
16:39 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
16:39 -!- michl [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Remote host closed the connection]
16:39 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Remote host closed the connection]
16:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:41 -!- Netsplit *.net <-> *.split quits: caesay, Olipro, caemir, scoopex, Ionic, sia^pwnnt, sigius
16:41 -!- reisi [koivunej@mustatilhi.cs.tut.fi] has joined #openvpn
16:41 -!- Netsplit *.net <-> *.split quits: ph1l
16:41 -!- Netsplit *.net <-> *.split quits: deever, cali_, +novaflash, g0d, mick_laptop, MrWGW, RichardBronosky
16:41 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
16:41 -!- Netsplit *.net <-> *.split quits: mdupont, krzie, peper, SviMik, Mowee, reisi_, probonono
16:41 -!- mick_laptop [~mick@mickweiss.com] has joined #openvpn
16:41 -!- g0d [~zero@ip-97-74-121-225.ip.secureserver.net] has joined #openvpn
16:41 -!- Netsplit over, joins: Mowee, sia^pwnnt
16:41 -!- krzie [krzee@hemp.ircpimps.org] has joined #openvpn
16:41 -!- Netsplit over, joins: cali_
16:41 -!- caesay [~caesay@socialshock.net] has joined #openvpn
16:41 -!- krzie [krzee@hemp.ircpimps.org] has quit [Changing host]
16:41 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
16:41 -!- Netsplit over, joins: sigius
16:41 -!- Netsplit over, joins: peper
16:41 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
16:41 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has quit [Excess Flood]
16:41 -!- Netsplit over, joins: deever
16:41 -!- Netsplit over, joins: MrWGW
16:41 -!- Netsplit over, joins: scoopex
16:41 -!- mdupont [~mdupont@2a01:198:200:6ec::2] has joined #openvpn
16:41 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has joined #openvpn
16:42 -!- caesay is now known as Guest27716
16:42 -!- Netsplit over, joins: caemir
16:42 -!- probonono [~User@150.101.103.111] has joined #openvpn
16:42 -!- probonono [~User@150.101.103.111] has quit [Changing host]
16:42 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
16:43 -!- Netsplit over, joins: RichardBronosky
16:44 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:44 -!- mick_laptop [~mick@mickweiss.com] has quit [Changing host]
16:44 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
16:44 -!- Ionic [ionic@ionic.de] has joined #openvpn
16:44 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
16:56 <@vpnHelper> RSS Update - forum: Netsh error <http://forums.openvpn.net/topic9281.html#p17954>
16:56 < fuho> is there a standart directore where shoul I keep server certs, keys and config?
16:56 < fuho> directory
16:57 < datruth> anyone succussfully running vpn in a freebsd jail
16:57 < datruth> !fbsdjail
16:57 <@vpnHelper> "fbsdjail" is <thei0s> krzie: if you are interested in the solution: I needed to add to hosts rc.conf the creation of tun0 device, create a special devfs ruleset with tun0 unhiden, configure that it is used in the devfs mount point inside chroot in my jail and specify openvpn --dev tun0 parameter and it seems that this is it... so, thank you for assistance and ideas
16:58 < SviMik> fuho same directory where you keep ca.crt (actually it can be any directory)
16:58 < fuho> so no standard?
16:58 < krzie> not really
16:59 < fuho> right now I have it in /usr/locla/src/openvpn-2.2.1/easy_rsa/keys
16:59 < krzie> linux distros usually look for them in /etc/openvpn
16:59 < krzie> but that only matters to the init.d scripts
16:59 < krzie> i forget where freebsd looks for them
16:59 < EugeneKay> fuho - I use /etc/pki/vpn/, which is the red hat standard. The "normal" place is /etc/openvpn/keys/
16:59 < krzie> i dont use init scripts packaged with any OS's
16:59 < EugeneKay> You should probably keep your easy-rsa stuff somewhere more secure, like on a flash drive ;-)
17:00 < fuho> ok, I will move it to /etc/openvpn/keys
17:00 < krzie> (for openvpn i mean)
17:00 < fuho> The main problem though is tht the client wont connect though
17:00 < SviMik> path to ca.crt is specified in config file. openvpn will look for certs in same directory
17:00 < EugeneKay> !logs
17:00 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
17:01 < fuho> before I post logs what is the uttermost minimum i have to have in server.conf and client.conf to connect?
17:01 < fuho> jsut to test it
17:01 < EugeneKay> !howto
17:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:05 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:07 < krzie> fuho, pointless question is pointless
17:07 <@vpnHelper> RSS Update - forum: OpenVPN: Keeps restarting and/or Connection timeout <http://forums.openvpn.net/topic9214.html#p17956> || creating and revoking certificates for clients <http://forums.openvpn.net/topic9253.html#p17955>
17:08 < krzie> and since you seem to want your hand held, try my script... it will attempt to hold your hand with you
17:08 < krzie> !confgen
17:08 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
17:12 < fuho> How is it pointless?
17:13 < fuho> Used the conf from HOWTO, still no luck. Reading the whole thing again.
17:13 < krzie> cause you want to waste someones time helping you strip your config, then put the stuff back in after
17:14 < krzie> just set it up how you want, actually try things without asking, and ask when you run into a problem which you cant find the answer to using the manual / howto
17:14 < krzie> just use my confgen, it will hold your hand
17:14 < krzie> it will generate working configs =]
17:15 < fuho> krzie: Well thanks then, will try it now.
17:15 < krzie> np
17:20 < Mp5shooter> if only openswan had such an active community
17:20 < Mp5shooter> :P
17:20 < krzie> thanks =]
17:20 < Mp5shooter> :)
17:21 < krzie> couple yrs ago this place was dead, there was no forum, only the mail list had any activity
17:21 < Mp5shooter> ooh
17:24 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
17:24 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
17:24 < krzie> we've certainly come a long way
17:25 -!- mode/#openvpn [+v EugeneKay] by ChanServ
17:28 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
17:30 <@ecrist> that's cost a lot of work, too.
17:30 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:37  * SviMik finally recreated the index.txt :)
17:40 < krzie> =] x2
17:41 < SviMik> the second column was actually expiration date (looks like a random numbers at first glance, that made me stuck)
17:46 < krzie> fuho, hows my script treating you?
17:47 < fuho> krzie: Haven't tried it yet. Tryingto figure out what is going on
17:48 < fuho> if my log ends with Initialization Sequence Completed does it mean everything went better than expected?
17:51 < krzie> not necessarily
17:55 < fuho> Hmm, maybe I should explain my motives. What I am trying to achive is a tunnel between my router and my VPS, the plan was to have the tunnel encrypted (after i check the tunnel works) and the data on it compresses using LZO. I thought I could increase the possible bandwith of my home connection. Is it possible?
17:57 < fuho> If the overhead is +- 10%, the compression (which i hope is on average more efficient than 90% of original) should theoretically increase the troughput of the setup tight?
17:57 < fuho> right?
17:58 < krzie> increase your bandwidth?  lolno
17:58 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
17:58 < fuho> Not bandwith, but throughput
17:58 < krzie> you will more likely find LESS throughput
17:59 <+EugeneKay> Most internet traffic(webpages in particular) are already compressed once or twice
17:59 < SviMik> all traffic-intensive applications use binary data which is not compressable
17:59 < krzie> you're mangling your route to go through the server before going to the internet, in almost all situations it will be slower
17:59 <+EugeneKay> JPGs are fairly uncompressable, and then they're gzipped by most webservers. LZO will just add overhead.
18:02 < fuho> But if I am downloading some large text file (say 100GB ) the bottleneck is what is my provider, if I have VPN on backbone, why can't I download through the VPS compress the packets and send them to the router and uncompress them there, after the router I haev Gbit network again.
18:03 <+EugeneKay> The extra lag on all connections and the overhead on uncompressible makes it pointless at best.
18:03 < SviMik> usually LZO compression is enough just to compensate overhead, if we talking about most common internet traffic
18:04 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:04 < SviMik> it is very uncommon situation, if you download large uncompressed(!) text files :)
18:05 < SviMik> remember, that most web-servers are compressing text files automatically
18:05 <+EugeneKay> And rsync has the -z flag ;-)
18:05 < fuho> Alright, so it won't help. Is compression common on servers?
18:05 < krzie> and if you are making something custom, ild expect you bzip or gzip it anyways
18:06 < krzie> depends what you mean by "servers"
18:06 <@ecrist> web servers, yes
18:06 <@ecrist> nearly all webserver gzip content these days
18:06 < krzie> right
18:06 < fuho> what about smaba sharing for example?
18:06 < fuho> samba
18:06 < krzie> lol doubt it
18:07 <@ecrist> as far as I know, the SMB protocol does not do compression
18:07 < SviMik> samba does not use compression as I know
18:07 < krzie> [16:05]  <krzie> and if you are making something custom, ild expect you bzip or gzip it anyways
18:07 < krzie> =]
18:08 < krzie> but all this is moot, theres nothing wrong with using lzo
18:08 < fuho> hmm, that suck I though I was onto something.
18:08 < krzie> just dont expect much out of it, your connection will not be faster
18:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
18:09 < SviMik> I always enable lzo. it is fast and never make worse anyway
18:10 < fuho> So ahev you tested the speed with LZO, without LZO and without VPN. For exmaple on speedtest.net?
18:11  * datruth moves openvpn back to the host system
18:11 < SviMik> pointless. speedtest.net use uncompressable data to test your actual bandwidth, even if you are using compression
18:12 < datruth> doesn't seem to work well under jails
18:12 -!- corretico [~luis@201.201.44.82] has joined #openvpn
18:13 < fuho> Anyone tested it with iperf perhaps then?
18:14 <@ecrist> fuho: I'm sure people have, we're not aware of any posted results, though.
18:14 <@ecrist> it wouldn't be hard to come up with some
18:14 < fuho> I will definitely test it once I manage to set it up ;)
18:36 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
18:41 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
18:42 < fuho> test
18:42 < fuho> What does the rWrWrWrWrW on lcinet and RwRwRwRw on server mean?
18:42 < fuho> lcinet = client
18:43 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Ping timeout: 244 seconds]
18:51 <@ecrist> read and Write
18:51 <@ecrist> try the man page
18:57 -!- gyyrog [~gyyrog@99.54.136.50] has joined #openvpn
19:08 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Read error: Connection reset by peer]
19:09 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:14 -!- Peti4 [bc8f1625@gateway/web/freenode/ip.188.143.22.37] has joined #openvpn
19:14 < Peti4> hi
19:15 < Peti4> anyone can help me client-to client settings becouse i tried anythind and don't working
19:16 -!- gyyrog [~gyyrog@99.54.136.50] has quit [Read error: Connection reset by peer]
19:17 -!- gyyrog [~gyyrog@adsl-99-88-229-106.dsl.klmzmi.sbcglobal.net] has joined #openvpn
19:28 -!- Peti4 [bc8f1625@gateway/web/freenode/ip.188.143.22.37] has left #openvpn []
19:29 < datruth> woo0h00 finally asll is working
19:29 -!- JG84|Dinner is now known as JoeGazz84
19:29 -!- gyyrog_ [~gyyrog@adsl-99-88-229-221.dsl.klmzmi.sbcglobal.net] has joined #openvpn
19:32 -!- gyyrog [~gyyrog@adsl-99-88-229-106.dsl.klmzmi.sbcglobal.net] has quit [Ping timeout: 258 seconds]
19:43 -!- Denial [Denial@drgi.co.uk] has quit []
19:44 -!- Peti4 [bc8f1625@gateway/web/freenode/ip.188.143.22.37] has joined #openvpn
19:45 < Peti4> client to client ubuntu 10.04 don't working pls help
19:54 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
19:59 -!- _julian_ [~quassel@hmbg-4d06b65f.pool.mediaWays.net] has joined #openvpn
20:02 -!- _julian [~quassel@hmbg-4d06a6b7.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
20:32 -!- xTheElySiaNx [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
20:32 -!- xTheElySiaNx is now known as Mp5shooter
20:44 < Peti4> anyone here?
20:45 <@ecrist> 137 people
20:45 <@ecrist>  [137 nicks (@6 %0 +2 129)] 
20:55 -!- SOG [~SOG@113.108.118.58] has joined #openvpn
20:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
20:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:00 < krzie> ecrist, http://www.thewebsiteisdown.com/
21:00 <@vpnHelper> Title: The Website Is Down (at www.thewebsiteisdown.com)
21:00 < krzie> im sure you've seen that...
21:00 < krzie> but right now, it is true ;]
21:01 -!- SOG [~SOG@113.108.118.58] has quit [Quit: I will be back!]
21:13 -!- Peti4 [bc8f1625@gateway/web/freenode/ip.188.143.22.37] has quit [Quit: Page closed]
21:15 -!- gyyrog_ [~gyyrog@adsl-99-88-229-221.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
21:24 -!- gyyrog [~gyyrog@adsl-99-88-229-221.dsl.klmzmi.sbcglobal.net] has joined #openvpn
21:31 <@vpnHelper> RSS Update - forum: OpenVPN and n2n (newbie question) <http://forums.openvpn.net/topic9290.html>
21:59 -!- gyyrog [~gyyrog@adsl-99-88-229-221.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
22:17 -!- Gravitron [~admin@64.93.146.178] has joined #openvpn
22:17 -!- Gravitron [~admin@64.93.146.178] has quit [Changing host]
22:17 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:21 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
22:24 -!- j_a_b_b_a [~Jabbe@p5B28070B.dip0.t-ipconnect.de] has joined #openvpn
22:24 -!- dioz [~dioz@2001:470:1f11:12a9::1] has joined #openvpn
22:25 <@vpnHelper> RSS Update - forum: OpenVPN not working with port forwarding <http://forums.openvpn.net/topic9291.html>
22:26 -!- Gravitron [~admin@64.93.145.58] has joined #openvpn
22:26 -!- Gravitron [~admin@64.93.145.58] has quit [Changing host]
22:26 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:27 -!- j-a-b-b-a [~Jabbe@p5B280F6F.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
22:30 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 245 seconds]
22:31 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
22:31 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
22:31 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:43 -!- ravemaster [~ravemaste@119.93.51.34] has joined #openvpn
22:48 -!- ravemaster [~ravemaste@119.93.51.34] has quit []
23:01 -!- mirco [~mirco@tmo-103-111.customers.d1-online.com] has joined #openvpn
23:08 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has quit [Ping timeout: 248 seconds]
23:10 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has joined #openvpn
23:10 < fuho> Hi, can somebody please help me set up some sort of routing on the vps? Client can connect, receives address 10.8.1.2 I can ping server from client, but cant access internet
23:12 <@vpnHelper> RSS Update - forum: Diff between tun/tap and some specific routing methods <http://forums.openvpn.net/topic9292.html>
23:14 < datruth> fuho: firewall issue maybe?
23:15 < fuho> I think its my fault, I spoke toio soon again, reading the manual now, sorry fo rinterupting.
23:20 -!- ph1l1 [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Quit: Leaving.]
23:31 -!- mirco [~mirco@tmo-103-111.customers.d1-online.com] has quit [Remote host closed the connection]
23:33 -!- mirco_ [~mirco@tmo-103-111.customers.d1-online.com] has joined #openvpn
23:37 <+hyper_ch> dazo_afk: krzee: ecrist:  http://hackertyper.com/
23:37 <@vpnHelper> Title: Hacker Typer (at hackertyper.com)
23:49 -!- mirco_ [~mirco@tmo-103-111.customers.d1-online.com] has quit [Read error: Connection reset by peer]
23:54 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has quit [Ping timeout: 248 seconds]
23:55 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has joined #openvpn
--- Day changed Mon Nov 28 2011
00:17 -!- datruth [datruth@gotpot.org] has quit [Quit: @pooof]
00:24 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
00:32 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has left #openvpn []
00:33 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
00:36 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:55 -!- mirco [~mirco@tmo-103-111.customers.d1-online.com] has joined #openvpn
01:01 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:06 <@vpnHelper> RSS Update - forum: VPN Client IP not showing up in server logs... <http://forums.openvpn.net/topic8857-30.html#p17960>
01:15 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
01:24 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
01:24 -!- novaflash [~novaflash@openvpn/user/novaflash] has joined #openvpn
01:26 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:32 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Read error: Connection reset by peer]
01:36 -!- `Ile` [~kvirc@77-46-178-184.dynamic.isp.telekom.rs] has joined #openvpn
01:50 < FeileX> Ping.
01:50 < FeileX> anyone alive?  :)
01:54 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17961>
02:02 < `Ile`> i am
02:09 -!- dazo_afk is now known as dazo
02:11 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 244 seconds]
02:12 -!- mirco [~mirco@tmo-103-111.customers.d1-online.com] has quit [Read error: Connection reset by peer]
02:14 -!- mirco [~mirco@tmo-103-111.customers.d1-online.com] has joined #openvpn
02:14 -!- mirco [~mirco@tmo-103-111.customers.d1-online.com] has quit [Read error: Connection reset by peer]
02:25 <@vpnHelper> RSS Update - forum: OpenVPN not working with port forwarding <http://forums.openvpn.net/topic9291.html#p17963> || Diff between tun/tap and some specific routing methods <http://forums.openvpn.net/topic9292.html#p17962>
02:25 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
02:33 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:37 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:43 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:49 <@vpnHelper> RSS Update - forum: Netsh error <http://forums.openvpn.net/topic9281.html#p17964>
02:54 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:54 <@vpnHelper> RSS Update - forum: Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17965>
03:25 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 260 seconds]
03:31 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17966>
03:37 <@vpnHelper> RSS Update - forum: Netsh error <http://forums.openvpn.net/topic9281.html#p17968> || Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17967>
03:46 -!- Coffe [~niszsse@2001:9b0:112:abba::2] has joined #openvpn
03:47 < Coffe> Hello, can i get connecting clients to get dhcp ip from my normal dhcp server ? so all my revese dns lookups will work ?
04:00 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Excess Flood]
04:02 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
04:07 -!- `Ile` [~kvirc@77-46-178-184.dynamic.isp.telekom.rs] has quit [Ping timeout: 252 seconds]
04:19 <@vpnHelper> RSS Update - forum: Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17969>
04:25 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:26 <+EugeneKay> Coffe - you can, using Bridging mode(and dev TAP), but it's a terrible idea. You can, howeve,r use a script to  do the DDNS updates instread
04:26 <+EugeneKay> !nsupdate
04:26 <@vpnHelper> "nsupdate" is http://scarydevilmonastery.net/client_connect_nsupdate for a script Bushmills wrote to solve the question How can my vpn update my nameserver?
04:27 <@dazo> Coffe: yeah, that's doable ... but you'll have to resort to TAP devices, and possibly bridging .... may I suggest writing your own DDNS updater, and use the --learn-address hook
04:27 <@dazo> ?
04:27 <@dazo> ahh!  we have !nsupdate nowadays :)
04:27 <+EugeneKay> Though that is really a terrible script. YOu should write yourself a better one.
04:28 <+EugeneKay> Here's one I wrote for Dynamic DNS updates, it's a good place to start. https://github.com/EugeneKay/scripts/blob/master/bash/nsupdater.sh
04:28 <@vpnHelper> Title: bash/nsupdater.sh at master from EugeneKay/scripts - GitHub (at github.com)
04:28 <@dazo> EugeneKay: what's wrong about that script?
04:29 <@dazo> $common_name, probably
04:29 <+EugeneKay> No variable checking is the biggy
04:29 <@dazo> yeah, that as well
04:29 <@dazo> well, it's stripped down enough go get the idea :)
04:30 <+EugeneKay> I also object to the use of $var instead of ${var}, sh instead of bash, lack of full commentary & explanation, and use of EOF syntax.
04:30 <+EugeneKay> Oh, and it doesn't unset variables.
04:31 <+EugeneKay> None of that is strictly necessary, but that's what they said about airbags and seatbelts, once upon a time.
04:39 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
04:40 <@dazo> hehe
04:40  * dazo will not object to any of these points ...
04:44 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:44 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:46 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 244 seconds]
04:47 -!- dazo is now known as dazo_afk
04:57 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
05:16 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
05:24 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
05:24 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
05:24 -!- Usafcjf is now known as FeileX
05:27 <@vpnHelper> RSS Update - forum: Problem using two routers dd-wrt <http://forums.openvpn.net/topic9293.html>
05:28 -!- mode/#openvpn [+v EugeneKay] by ChanServ
05:28 -!- sniz- [~Frank@67.21.75.194] has joined #openvpn
05:30 < sniz-> http://pastebin.com/ux1PAX7P  error starts on line 49... only happens in linux (sabayon & ubuntu)
05:30 < sniz-> I was able to connect to it ONCE... i think... i could've been sleepnerding
05:39 < sniz-> and i'm using 2.2.0, and i think i triade 2.2.1? maybe
05:47 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 240 seconds]
05:48 -!- barbosa [~barbosa@189.27.121.216.dynamic.adsl.gvt.net.br] has joined #openvpn
05:48 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
05:52 < FeileX> sniz-, can you also post your server and client config files?
05:53 < sniz-> i don't know about the server files, since i don't operate the server... 1 second
05:53 < FeileX> ok
05:59 < sniz-> http://pastebin.com/uiCvw5Wd
06:02 < FeileX> hmm
06:02 < FeileX> not sure.
06:02 < FeileX> i'm pretty new, and I;ve never worked on a dev tun client before...
06:02 < FeileX> !tun
06:02 < FeileX> !tunnel
06:02 < FeileX> !goal
06:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:04 < sniz-> the only things i could google up were stuff about android haha
06:04 < sniz-> think i found something for ubuntu, but all it said was install ifconfig... and i was like "uhh"
06:05 -!- barbosa [~barbosa@189.27.121.216.dynamic.adsl.gvt.net.br] has quit [Ping timeout: 244 seconds]
06:06 < Coffe> Tnx EugeneKay  and dazo_afk 
06:08 -!- sniz- [~Frank@67.21.75.194] has quit [Quit: Leaving]
06:08 < Coffe> i am in bridge mode now.. 
06:09 -!- sniz- [~Frank@67.21.75.194] has joined #openvpn
06:09 < sniz-> oops
06:09 < FeileX> !factoids search tun
06:09 <@vpnHelper> 'mactuntap', 'tunortap', 'tunnelblick', and 'multi_process_incoming_tun'
06:09 < FeileX> grr
06:09 < FeileX> umm....
06:10 < sniz-> know of any other linux clients? that will atleast accept a .ovpn?
06:10 < sniz-> i've tried seperating it myself... but not sure i was getting the right stuff in the config for each section
06:12 < FeileX> it is interesting that you have multliple remote's
06:12 < sniz-> ?
06:12 < FeileX> that maybe fine, I;ve just never seen it in any of the config files I've read through
06:12 < FeileX> remote 67.21.75.194 1194 udp
06:12 < FeileX> remote 67.21.75.194 443 tcp
06:12 < sniz-> oh
06:13 < FeileX> I guess it could just choose one of them randomly... 
06:13 < FeileX> try with just udp, and then just with tcp
06:13 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
06:13 < sniz-> so, maybe remove one of the lines? and vice versa?
06:14 < FeileX> yea, or just coment it out.
06:14 < FeileX> also... since you pasted your private key, you need to tell your provider to revoke it, and build you a new one...
06:14 < sniz-> i'll try it... imma look a bit more and get some more ideas, i hate rebooting haha.. and i can't connect to irc @ work without the vpn :D
06:15 < sniz-> FeileX, i totally deleted a bunch of stuff from all the certs ;p
06:15 < sniz-> i'm not a complete wrecking ball haha
06:15 < FeileX> ok
06:15 < Coffe> EugeneKay,  why is bridge/tap such a bad ide ?
06:16 < FeileX> still, I;d have to look, but some parts of the certs are seperated... ie, the first 160 bits are one part, .....
06:16 <+EugeneKay> !bridge
06:16 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
06:16 <+EugeneKay> !tunortap
06:16 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
06:16 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
06:16 <+EugeneKay> !layer2
06:16 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
06:17 <+EugeneKay> That's why ^
06:19 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
06:20 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:20 < Coffe> ok, i think i did wollow the guide on the page when i did set this up some years ago ..
06:22 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
06:24 -!- sniz- [~Frank@67.21.75.194] has quit [Quit: Leaving]
06:25 < Coffe> so , with 5 sub networks , and about 25 road warriors , it would be better to have rotuing and not bridge ?
06:25 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p17971>
06:41 -!- sniz- [~Frank@67.21.75.194] has joined #openvpn
06:41 < sniz-> yup... still getting that error..
06:42 < sniz-> it wont connect via that udp at all either.. so i'm probably gonna leave that out of my config, just so it'll speed up the connection process
06:42 < sniz-> i tried to chmod +x the /usr/bin/openvpn... just for shits and giggles too
06:48 < FeileX> the error log looks like something is getting pushed wrong, but I;m not sure
06:52 < krzee> FeileX, link to error log?
06:52 < sniz-> from what i'm seeing, those push errors aren't really an error
06:53 < krzee> Coffe, yes
06:53 < sniz-> just stuff for window's clients, and the linux clients ignores it
06:55 < sniz-> gonna try this one config... pretty much just sounds like DNS problems
06:55 < sniz-> didn't even try pinging any ips
06:55 <@vpnHelper> RSS Update - forum: Problem to connect Site-to-Site routing with openvpn <http://forums.openvpn.net/topic9265.html#p17972>
06:56 < krzee> ... want me to look at the log sniz-?
06:56 < sniz-> surely
06:56 < krzee> link?
06:56 < sniz-> http://pastebin.com/ux1PAX7P
06:56 < Coffe> as i understand it.. i have to do more subneting,
06:57 < krzee> Coffe, subnetting?
06:57 < krzee> oh you're talking about the /30 subnets
06:57 < krzee> !topology
06:57 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
06:58 < Coffe> seens like i have to do some major changes to our toplogy then that we have today .
06:59 < krzee> sniz-, does 2.2.1 give those same errors?
06:59 < krzee> Coffe, how so?
07:00 <@ecrist> krzee: what website is down?
07:00 < Coffe> as if i create new subnets , i have to have this settings in all other offices.. 
07:00 < krzee> ecrist, none now, i was unable to access secure-computing.net last night but it works today
07:00 <@ecrist> odd
07:00 < krzee> and bri is cute ;]
07:01 <@ecrist> ;)
07:01 <@ecrist> met her Saturday  night
07:01 < sniz-> krzee, yeh... but i think those push errors aren't really my problem anymore
07:02 < krzee> sniz-,  i agree, what is the problem?
07:02 < sniz-> on the ovpn forums, people are saying that those are commands that the servers are sending, but it's only for windows clients
07:02 < krzee> (rather, what is the symptom?)
07:02 < sniz-> websites arent working
07:03 <@ecrist> !goal
07:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:03 < krzee> oh so you're trying to redirect internet over the vpn?
07:03 < sniz-> that would be correct
07:03 < krzee> can you ping 8.8.8.8 after connecting?
07:04 < sniz-> i guess it's not configuring a dns tables when it's connected... if that's the case
07:04 < sniz-> i'm about to try, i'm on windows now, can't connect to irc, or even goto most websites without the vpn ;]
07:05 <@ecrist> I'm guessing you're missing NAT on the vpn server end of things
07:05 < sniz-> it works under windows
07:05 < sniz-> can't change the server, it's just a service i subscribe to
07:06 < krzee> ahh, then its very likely dns, just use 8.8.8.8 as your nameserver and it should work
07:06 < sniz-> i'll be right back... maybe
07:06 -!- sniz- [~Frank@67.21.75.194] has quit [Quit: Leaving]
07:11 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:11 -!- sniz- [~Frank@67.21.75.194] has joined #openvpn
07:11 < sniz-> well hot damn
07:12 < sniz-> so, anyreason why it would work under windows, and not linux?
07:12 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
07:13 < krzee> you changed the NS like i said?
07:13 < sniz-> btw, it is a DNS issue... working now with google's awesome power
07:13 < sniz-> 8.8.8.8 and 8.8.4.4
07:13 < krzee> then yes, in windows you were using your ISP's nameserver
07:14 < krzee> in linux you were using a publicly available nameserver
07:14 < krzee> err no, backwards sorry
07:14 < krzee> anyways, you ISP doesnt allow dns requests from outside its ip range, so that it wont be used for dns amplification attacks
07:15 < sniz-> so where is the windows client getting it's dns from?
07:15 < sniz-> i definately don't have any named for it
07:15 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
07:15 -!- mirco_ is now known as mirco
07:15 < krzee> i had it backwards
07:15 < krzee> windows is using dns from your ISP
07:16 < krzee> manually override it to use 8.8.8.8 and 8.8.4.4 like you said, then it'll be fine
07:16 < sniz-> it should be getting it from my isp, and linux was too.. according to resolv
07:16 < krzee> oh then dns is being pushed
07:16 < krzee> windows handles that naturally
07:16 <@ecrist> are you pushing DNS in the server config?
07:16 < krzee> linux needs a script
07:16 < krzee> ecrist, he doesnt run the server
07:16 <@ecrist> ahhhh
07:16 < krzee> [09:05]  <sniz-> can't change the server, it's just a service i subscribe to
07:17 < krzee> !pushdns
07:17 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
07:17 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
07:17 < krzee> #4
07:17 < sniz-> maybe the server is pushing dns, just not working with the linux client... amybe?
07:17  * ecrist wonders why sniz- isn't using their support
07:17 < krzee> sniz-, (#4) in unix you'll use the update-resolv-conf script
07:17 < krzee> sniz-, actually ecrist has a strong point too, you really should be using their support
07:18 < krzee> its a pain in the ass to figure out what the server is doing from the client's behavior
07:18 <@ecrist> our general SOP here is third-party vpn service users need to use their support, not us
07:18 < sniz-> yeah, i emailed them, but i figured i'd try figuring it out in the meantime 
07:18 < krzee> you mean youd try having us figure it out ;]
07:19 < krzee> anyways, it's figured out
07:19 < sniz-> bingo ;p
07:19 < sniz-> it's working, and it's much appreciated ;]
07:19 < krzee> you need the update-resolv-conf script as i said above =]
07:19 < krzee> then you'll accept the pushed nameservers
07:19 <@ecrist> or add static routes for your ISPs DNS servers
07:20 < krzee> assuming you want dns going out your provider, personally i prefer it going through the tunnel
07:20 < krzee> ^ @ ecrist 
07:21 -!- dazo_afk is now known as dazo
07:21 < krzee> hey dazo 
07:21 < krzee> Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.2.0)
07:22 < krzee> is that cause its a linux client, or cause it is not 2.2.1?
07:22 <@dazo> it's because it's Linux client .... it's a Windows only option, afaics
07:22 < krzee> cool =]
07:22 < krzee> thx
07:22 < sniz-> guess i wasn't even using 2.2.1, it was 2.2.0 and 2.1.4
07:23 <@dazo> :)
07:23 < sniz-> man, i'm totally ditching this distro, all the packages are usually out of date
07:23 <@dazo> which distro?
07:23 < sniz-> sabayon ;p
07:24 <@dazo> ahh, okay ... if it had been some enterprise distro, they might look outdated on the version number - but contents wise, they're quite up-to-date... but sabayon is probably not classified as an enterprise distro :)
07:24 < krzee> ill classify it as a "ild google it if i cared" distro
07:25 <@dazo> haha
07:25 < sniz-> it's gentoo, but binary
07:25 <@dazo> just that sounds odd ... 
07:26 < krzee> and terrible
07:27 <@dazo> Either you're good/mad/crazy enough to go for Gentoo completely ... or you choose debian/Fedora/ScientificLinux/RHEL or such likes
07:28 <+EugeneKay> Mmmmm Science....
07:28 <@dazo> but a "binarised" source distro ... yuck!
07:30 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
07:31 < sniz-> yeah, it sounded good to me at first, but after a couple weeks of playing around with it... it;s just not worth it, the dependency issues are outragous
07:32 <@dazo> I would guess so
07:32 < krzee> if you knew why gentoo is cool, youd know that a binary version of it is suck
07:32 <@dazo> touché
07:32 < sniz-> i want to say firefox was like, a 80mb install...
07:33 <@dazo> sounds like that's including debug info
07:33 <@dazo> (symbols in binaries + debugging code)
07:33 < sniz-> debug, languages, other useless stuff, and dependencies it doesn't even really need
07:50 -!- lam [~lam@host84-53-dynamic.6-87-r.retail.telecomitalia.it] has joined #openvpn
07:50 <@vpnHelper> RSS Update - forum: webmain vpn wont start <http://forums.openvpn.net/topic9287.html#p17974> || apf cannot ping other computers on openvpn <http://forums.openvpn.net/topic9278.html#p17973>
07:50 < lam> hi 
07:50 < lam> :)
07:50 -!- sniz- [~Frank@67.21.75.194] has quit [Ping timeout: 248 seconds]
07:50 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
07:53 -!- sniz- [~Frank@67.21.75.194] has joined #openvpn
07:56 <@vpnHelper> RSS Update - forum: Problem using two routers dd-wrt <http://forums.openvpn.net/topic9293.html#p17975>
07:57 -!- lam [~lam@host84-53-dynamic.6-87-r.retail.telecomitalia.it] has left #openvpn []
07:59 -!- sniz- [~Frank@67.21.75.194] has left #openvpn ["Leaving"]
08:02 <@vpnHelper> RSS Update - forum: OpenVPN and n2n (newbie question) <http://forums.openvpn.net/topic9290.html#p17976>
08:03 -!- ravemaster [79362ce5@gateway/web/freenode/ip.121.54.44.229] has joined #openvpn
08:05 < ravemaster> webdawg: are you here man?
08:08 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17978> || Netsh error <http://forums.openvpn.net/topic9281.html#p17977>
08:28 -!- ravemaster [79362ce5@gateway/web/freenode/ip.121.54.44.229] has quit [Ping timeout: 265 seconds]
08:29 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 258 seconds]
08:35 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
08:48 -!- fuho [~fuho@ool-43548e6f.dyn.optonline.net] has quit [Remote host closed the connection]
08:50 <@vpnHelper> RSS Update - forum: Problems to get openvpn work on a strato v-server <http://forums.openvpn.net/topic9294.html>
08:51 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 240 seconds]
08:54 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:08 -!- mne [~mne@amnesiac.seclab.tuwien.ac.at] has joined #openvpn
09:08 -!- mne [~mne@amnesiac.seclab.tuwien.ac.at] has quit [Changing host]
09:08 -!- mne [~mne@unaffiliated/mne] has joined #openvpn
09:09 < mne> Hi. In the openvpn client config, how do I get the IP address of the remote server ? I would like to add a route like "route 10.0.0.0 255.0.0.0 <server ip>"
09:09 < mne> I know that i can push routes from the server, but I would still need to know the IP address of the server
09:10 < mne> It seems to change wih each client ..
09:13 < mne> In the openvpn examples I can see that it is possible to use "up" scripts for that. Is there a way to do this from inside the client.conf ? I do not want to call separate shell scripts.
09:14 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
09:15 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
09:26 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 248 seconds]
09:30 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 244 seconds]
09:33 <@dazo> mne: try to use this "macro"/key word: vpn_gateway
09:34 <@dazo> mne: if you look closely at --route in the man page, you'll see vpn_gateway, net_gateway and remote_host being described
09:35 < mne> dazo, right, I misunderstood this in the manpage. I thought this would be only for shell scripts. I'll try it, thanks
09:36 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 244 seconds]
09:36 < mne> it works, excellent, thanks again !
09:39 <@vpnHelper> RSS Update - forum: Building released openvpn version for windows <http://forums.openvpn.net/topic9295.html>
09:45 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p17982> || Private subnet access throught VPN client <http://forums.openvpn.net/topic9252.html#p17981>
09:47 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
09:48 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Quit: http://quassel-irc.org - Converse confortavelmente. Em qualquer lugar.]
09:48 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:53 -!- atan [~atan@unaffiliated/atan] has joined #openvpn
10:02 -!- mne [~mne@unaffiliated/mne] has quit [Quit: Leaving]
10:02 -!- Coffe [~niszsse@2001:9b0:112:abba::2] has quit [Quit: Leaving]
10:05 -!- dollabill [~mike@c-98-230-37-224.hsd1.fl.comcast.net] has joined #openvpn
10:12 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
10:20 -!- atan [~atan@unaffiliated/atan] has quit [Remote host closed the connection]
10:22 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
10:34 -!- vpopov is now known as happylife
10:38 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
10:39 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
10:42 -!- atan [~atan@unaffiliated/atan] has joined #openvpn
10:44 < atan> I am trying to connect from one Windows 7 machine to another with OpenVPN and route traffic from the remote computer over the other. I have enabled the IP forwarding flag in the registry, enabled connection sharing for this other adapter and have route-method exe, route-delay 2, redirect-gateway def1 in my client config but still the traffic isn't all getting redirected
10:44 < atan> Oh wait, snap, now it works
10:44  * atan puts head in sand
10:44 < atan> Thanks fellas!
10:44 -!- atan [~atan@unaffiliated/atan] has left #openvpn []
10:49 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
10:49 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
10:49 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
10:52 -!- _julian__ [~quassel@hmbg-4d068b58.pool.mediaWays.net] has joined #openvpn
10:55 -!- _julian_ [~quassel@hmbg-4d06b65f.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
11:02 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
11:07 <@vpnHelper> RSS Update - forum: Problem using two routers dd-wrt <http://forums.openvpn.net/topic9293.html#p17983>
11:13 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
11:21 -!- ravel_exe [ravel_exe@175.142.202.9] has joined #openvpn
11:23 -!- convide [52c01b27@gateway/web/freenode/ip.82.192.27.39] has joined #openvpn
11:24 -!- convide [52c01b27@gateway/web/freenode/ip.82.192.27.39] has left #openvpn []
11:31 -!- sgp [~smerp@foresight/developer/sgp] has joined #openvpn
11:43 <@vpnHelper> RSS Update - forum: apf cannot ping other computers on openvpn <http://forums.openvpn.net/topic9278.html#p17984>
11:46 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
11:51 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:54 -!- tty234 [telex@gateway/shell/anapnea.net/x-sreczuniysywrecb] has quit [Read error: Connection reset by peer]
11:59 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
12:01 -!- Confiscative [confiscati@feather.perl6.nl] has left #openvpn []
12:02 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
12:04 -!- ravel_exe [ravel_exe@175.142.202.9] has quit []
12:10 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
12:10 < dupondje> Some small question. I would like to make that my computer is unable to connect to the internet WITHOUT vpn. Any idea how I could fix that ? :)
12:18 -!- probonono [~User@unaffiliated/probonono] has quit [Read error: Connection reset by peer]
12:19 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
12:22 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:25 <@vpnHelper> RSS Update - forum: OpenVPN client on Windows 7 <http://forums.openvpn.net/topic9286.html#p17985> || [Resolved] Problem using two routers dd-wrt <http://forums.openvpn.net/topic9293.html#p17983> || China VPN <http://forums.openvpn.net/topic9296.html> || Private subnet access throught VPN client <http://forums.openvpn.net/topic9252.html#p17809>
12:31 < krzee> dupondje, 
12:31 < krzee> !def1
12:31 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:31 -!- vasily__ [~happylife@46.251.83.126] has joined #openvpn
12:32 < krzee> dont use def1 and it is how you said?
12:37 <@vpnHelper> RSS Update - forum: OpenVPN and Sonicwall Firewall Config???? <http://forums.openvpn.net/topic9297.html>
12:45 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
12:45 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
12:46 -!- tty234 [telex@gateway/shell/anapnea.net/x-mxifoaoiflleascq] has joined #openvpn
12:51 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
12:52 -!- papsky [~papsky@CPE-121-221-75-214.lns7.wel.bigpond.net.au] has joined #openvpn
12:55 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
13:00 -!- dollabill [~mike@c-98-230-37-224.hsd1.fl.comcast.net] has quit [Ping timeout: 260 seconds]
13:00 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has joined #openvpn
13:00 -!- ph1l [~ph1l@141-215.105-92.cust.bluewin.ch] has quit [Changing host]
13:00 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
13:03 -!- tty234 [telex@gateway/shell/anapnea.net/x-mxifoaoiflleascq] has quit [Ping timeout: 252 seconds]
13:03 -!- j-a-b-b-a [~Jabbe@p5B28070B.dip0.t-ipconnect.de] has joined #openvpn
13:03 -!- j_a_b_b_a [~Jabbe@p5B28070B.dip0.t-ipconnect.de] has quit [Ping timeout: 244 seconds]
13:14 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has joined #openvpn
13:16 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
13:20 -!- papsky [~papsky@CPE-121-221-75-214.lns7.wel.bigpond.net.au] has quit [Quit: Leaving]
13:33 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 244 seconds]
13:35 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has quit [Ping timeout: 248 seconds]
13:41 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
13:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 244 seconds]
13:41 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has joined #openvpn
14:00 -!- tty234 [telex@gateway/shell/anapnea.net/x-sckofjbzpwwlrdul] has joined #openvpn
14:05 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.2]
14:06 -!- vasily__ [~happylife@46.251.83.126] has quit [Ping timeout: 260 seconds]
14:06 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
14:16 -!- barbosa_ [~barbosa@189.27.121.216.dynamic.adsl.gvt.net.br] has joined #openvpn
14:20 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
14:24 <@dazo> dupondje: if you want to block everything when VPN is not connected, you'll need to block that in the local firewall on your VPN client ... and only allow outgoing VPN traffic on the eth/wlan devices ... but to have a 100% bulletproof system here requires completely unprivileged users, with strict access control ... in the moment they gain admin/root privileges, they can easily update the firewall and soften it up again
14:24 <@dazo> "only allow outgoing VPN on the eth/wlan devices" ... VPN traffic to your VPN server, that is.
14:28 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
14:29 < krzie> unless of course what you really want is for it to just break
14:29 < krzie> in which case, leaving off def1 is plenty... you will have no default route if your vpn disconnects
14:29 <@dazo> heh, that's just details :-P
14:30 <@dazo> yeah, true
14:30 <@dazo> well, actually, openvpn might in many cases restore the default route if it has privilege to do so when disconnecting
14:31 < krzie> oh ya?
14:31 < krzie> ok, then leave off def1, and drop privileges =]
14:31 <@dazo> :)
14:32 <+EugeneKay> I need to sit down and think about my init/wrapper script idea a bunch
14:32 < krzie> oh hey yanno if i ever requested the feature of --redirect-gateway-ignore for clients?
14:32 < krzie> so thered be a single option for clients to ignore redirect-gateway
14:32 <+EugeneKay> It ought to be possible to do openvpn entirely unprivileged, by abusing sudo for the ip addresses + routing.
14:32 <+EugeneKay> And a persistent tun device.
14:32 < krzie> EugeneKay, ya sounds reasonable
14:33 <+EugeneKay> It's just a matter of writing the bash to do it.
14:33 <+EugeneKay> Unless there were to be an official --sudo option :-p
14:33 < krzie> lol
14:33 <@dazo> it's even possible to do it way more elegant, with some code changes ... using capabilities in Linux ... where openvpn can be granted allowance to modify network config (ip addr/route), even when running unprivileged
14:34 < krzie> oh nice EugeneKay, i get to throw your answer back at you!
14:34 <@dazo> I haven't had time to really dig into that code, but I've been poking briefly at it
14:34 < krzie> patches accepted!
14:34 <@dazo> :)
14:34 <+EugeneKay> I'll write the bash and github it, but no way I'll touch adding a --sudo
14:34  * dazo leans back and expects patches from EugeneKay :-)
14:34 <+EugeneKay> I know enough to know I don't know enough.
14:35 <@dazo> that's what I said 3-4 years ago as well ....
14:35 <@dazo> just look where that led me! :-P
14:35 <+EugeneKay> I've gotten as far as investigating the environment variables and planning a script workflow, but nothing has hit the editor yet.
14:36 <@dazo> :)
14:39 -!- masch [~quassel@big.masch.it] has joined #openvpn
14:39 < masch> hi 
14:42 < masch> i'd like to use my vpn for playing game with ma friends. i enabled client-to-client and "ping" works if i disable the firewalls but the games dont "see each other" if you know what i'm talking about (sry for baaad english) 
14:42 <@vpnHelper> RSS Update - forum: OpenVPN client on Windows 7 <http://forums.openvpn.net/topic9286.html#p17987>
14:43 <@dazo> masch: what kind of game?  does it depend on pure TCP/IP traffic? (you can provide IP addresses) or does it depend on broadcast?  If the latter, you might need to look at using --dev tap
14:44 < masch> most of the games depend on broadcast i think (for example WarCraft 3) 
14:44 <@dazo> !tunortap
14:44 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over the
14:44 <@vpnHelper> vpn or (#4) lan gaming? use tap!
14:44 < masch> can i just change this in the config ? "dev tap" ? 
14:45 < masch> oh okay
14:45 < masch> i want tap1 
14:45 <@dazo> masch: that's a good first step ... that will at least provide broadcast traffic on the VPN network
14:45 < masch> thx
14:45 <@dazo> if you need broader scope (crossing over to lans), you'll need to look at bridging as well
14:46 <+EugeneKay> If you need crossing LANs, no you don't. 
14:46 <@dazo> for broadcast traffic to cross between a VPN link ... not?
14:47 <+EugeneKay> Rethink your needs :-p
14:47 <@dazo> hehe ... fair enough :)
14:47 < krzie>  <EugeneKay> If you need crossing LANs, no you don't [need crossing LANs] .
14:47 <+hyper_ch> krzie: oh noes:  http://gizmodo.com/5863078/engineered-avian-flu-could-kill-half-the-worlds-humans
14:47 <@vpnHelper> Title: Engineered Avian Flu Could Kill Half the World's Humans (at gizmodo.com)
14:48 <+EugeneKay> They don't need to reengineer avian flu, they can just bottle my farts.
14:48  * dazo looks down to Iran
14:49 < krzie> damn and they wasted stuxnet on stopping nukes
14:50 <@dazo> heh
14:50 <+hyper_ch> :)
14:51  * dazo decides to log off for today ... time to do some other fun things ;)
14:52 <+hyper_ch> dazo: like?
14:52 -!- dazo is now known as dazo_afk
14:54 <+EugeneKay> That's what Iran gets for building nukes on Windows.
14:56 <+hyper_ch> you know, that this airborn avian flu will just render nukes only half effective
14:59 < masch> the windoze client from openvpn.se is the same as the one from openvpn.com?
15:01 < masch> *.net
15:01 < krzie> !download
15:01 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
15:01 < masch> ohh thanks
15:02 < krzie> yw
15:05 -!- master_of_master [~master_of@p57B54855.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
15:07 -!- master_of_master [~master_of@p57B5519E.dip.t-dialin.net] has joined #openvpn
15:11 -!- JoeGazz84 is now known as JG84|Away
15:14 < masch> okay. race 07 don't works
15:14 < masch> warcraft 3 the same
15:14 < masch> :-/ i think i need somethink else
15:16 < masch> !bridge
15:16 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
15:16 < krzie> is the machine running openvpn the machine playing the game>
15:16 < krzie> ?
15:17 < masch> the openvpn server is a dedicated server
15:18 < masch> but the client is running on the machine thats playing the game
15:18 < masch> !layer2
15:18 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
15:19 < krzie> then you dont need a bridge
15:19 < masch> okya
15:19 < krzie> a bridge is for when youd need layer2 to the lan
15:19 < masch> i stoped the firewall
15:20 < masch> but broadcasts still don't work :-(
15:20 < krzie> dunno
15:20 < krzie> i dont do layer2
15:22 < masch> :-/ 
15:22 <@vpnHelper> RSS Update - forum: Client stuck on connecting <http://forums.openvpn.net/topic9298.html>
15:22 < masch> i don't have a problem with this not working. but my friends keep crying T_T
15:29 -!- barbosa [~barbosa@189.27.121.216.dynamic.adsl.gvt.net.br] has joined #openvpn
15:31 -!- barbosa [~barbosa@189.27.121.216.dynamic.adsl.gvt.net.br] has quit [Client Quit]
15:31 -!- barbosa_ [~barbosa@189.27.121.216.dynamic.adsl.gvt.net.br] has quit [Ping timeout: 252 seconds]
15:45 < masch> i think i have to bridge the clients local network to the vpn to enable broadcast O.o
15:50 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 258 seconds]
15:52 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p17989>
15:54 -!- happylife [~happylife@212.92.145.7] has quit [Ping timeout: 252 seconds]
15:56 -!- happylife [~happylife@212.92.145.7] has joined #openvpn
15:56 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:58 < masch> maybe i'm really dump
15:58 < masch> but why should i bridge the VPN to my Server LAN?
15:58 < masch> that don't sounds clever to me
16:01 < krzie> i just explained why you dont need to
16:01 < krzie> so if you think yourself into doing it, dont add the word clever in there :-p
16:02 < krzie> hell even dazo told you that... he is basically lead community dev
16:02 < krzie> (which i say since he manages the git)
16:06 < masch> krzie: but every fucking website in this world tells me "if you want win7 broadcasting to your vpn => bridge" 
16:08 < masch> krzie: sry for the rude words. i'm just not in a good mood
16:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
16:15 -!- `Ile` [~kvirc@109-93-67-224.dynamic.isp.telekom.rs] has joined #openvpn
16:16 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 258 seconds]
16:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:18 < krzie> they dunno what they're talking about, very common with the web and openvpn
16:19 < krzie> you do need dev tap
16:19 < krzie> dont need bridge unless you need layer2 to the lan
16:25 < masch> krzie: but if i need broadcasts, i need layer2
16:25 < masch> or?
16:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
16:25 < krzie> "to the lan"
16:26 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
16:26 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
16:26 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:26 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
16:26 < farciarz84> hi I got such error  Cannot ioctl TUNSETIFF tun0: Inappropriate ioctl for device (errno=25)
16:26 < farciarz84> what's wrong?
16:26 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
16:28 < masch> krzie: the problem is this: i can't tell WarCraft 3 or any game the "subnet" to send the broadcast to
16:28 < masch> all of them are sending their broadcasts to the physical adapter
16:29 < krzie> and you have client-to-client?
16:30 < masch> yes
16:30 < masch> i can ping everyone
16:30 < krzie> cool, you know everything i know about openvpn in regards to your setup then
16:31 < masch> but that don't helps if the game is sending broadcasts to 192.168.1.255 and my vpn is 10.0.0.X 
16:31 < krzie> i have no idea if theres some sort of layer2 packet forwarding sysctl in linux or something
16:31 < masch> krzie: should i past my config
16:31 < krzie> not for me, i dont do layer2 setups
16:31 < masch> okay
16:31 < krzie> but your problem isnt openvpn from what you have said
16:31 < krzie> sounds more like this:
16:31 < krzie> [14:31]  <krzie> i have no idea if theres some sort of layer2 packet forwarding sysctl in linux or something
16:32 < krzie> although really client-to-client should negate the need for one
16:38 < masch> krzie: i think what i need is a tool that clones all broadcasts that are send to my physical netwrok and send them to the vpn
16:39 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
16:39 < krzie> post the configs for the hell of it
16:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:40 -!- farciarz94 [~farciarz@dynamic-78-8-61-124.ssp.dialog.net.pl] has joined #openvpn
16:40 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Ping timeout: 244 seconds]
16:42 < masch> http://paste.pocoo.org/show/514201/
16:57 < krzie> umm dude
16:57 < krzie> 192.2.0.0 is your subnet?
16:58 < krzie> its not a 1918 subnet...
16:58 < krzie> !1918
16:58 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
16:59 -!- farciarz94 [~farciarz@dynamic-78-8-61-124.ssp.dialog.net.pl] has quit [Quit: Lost terminal]
17:20 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
17:20 < Xgates> hi guys
17:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
17:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:23 < Xgates> A VPN service I'm using, I'm not sure these people know what they're doing, when I connect from the cmd line in Linux I get these two messages back;, along with what the config looks like;
17:24 < Xgates> http://pastebin.com/bxff9EL6
17:24 < Xgates> any help would be greatly appreciated to figure this out...
17:24 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
17:24 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
17:27 < krzie> sorry, theres no way for us to support that
17:27 < krzie> you need their support
17:28 < Xgates> you don't know what those two messages mean?
17:28 < Xgates> no typical solution for those?
17:28 < krzie> we'ld need access to their configs (and from the looks of it, a clue-bat) to help with this one
17:28 < krzie> i do know
17:28 < krzie> i just dunno wtf they are thinking/doing
17:28 < krzie> if this config is the answer, i have never heard of the question
17:29 < krzie> sorry, hope you either a) get help from them or b) did not pay much
17:29 < Xgates> sorry you lost me there...
17:29 < Xgates> let me back this up...
17:29 < krzie> back it up right to their support
17:29 < Xgates> looking at that config and the second message about ifconfig, can you see how to change the config for that?
17:29 < krzie> cause nobody here will be able to help with this complete crap of a config... if you ran the server ild help you do it better
17:30 < krzie> let me answer you again
17:30 < krzie> [15:27]  <krzie> you need their support
17:30 < Xgates> got it...
17:30 < Xgates> BUT if you're saying it's crap, then it looks like they don't realize something you do, so that is why I'm asking... 
17:31 < Xgates> So if you don't mind telling me so I can learn something here what is crap about it I should tell them?
17:32 < krzie> oh i just realized what they're doing
17:32 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:33 < krzie> they directly hand out an real ip
17:33 < krzie> but they specify which ip in your confiog
17:33 < Xgates> yeah it's a static setup
17:33 < krzie> still terribly done
17:33 < krzie> they should NOT give your config that sort of power
17:33 < krzie> they should handle everything about addressing on their side
17:33 < krzie> yours should just pull that sort of stuff
17:34 < krzie> anyways, maybe try commenting --client
17:34 < krzie> oh no
17:34 < Xgates> ahhh ok well if it's not to much 1). I like to learn as a Linux geek so I get a better understanding to steer clear of those that don't and 2). So I can take this back to them, in case they're learning a bit and they can make the right changes...
17:34 < krzie> ya i dunno, you need help from them
17:35 < krzie> !static
17:35 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
17:35 < Xgates> ok so should tell them to handle all the addressing on their side and not on my client
17:35 < krzie> thats how you configure static ips from the server
17:35 < krzie> well they really wont give a shit about your opinion on that
17:35 < krzie> dont expect them to
17:35 < krzie> lol
17:35 < krzie> they arent the ones in here asking for help... likely cause they arent looking for it ;]
17:36 < Xgates> Actually they do, hehe, cause when I first started with them, they weren't giving out Certs so I explained a bit about my IT background as a Tech and Geek and they made certs and changed their service, so they are listening to me cause they see I have some experience to help them
17:36 < Xgates> They're asking me...
17:37 < Xgates> but I don't know everything just a little and a little to see problems when they occur like this...
17:37 < krzie> ahh
17:38 < krzie> well ya, show them --server in the manual and static ips from my bot above
17:38 < krzie> and:
17:38 < krzie> !topology
17:38 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
17:38 < krzie> they dont need dev tap
17:38 < krzie> they used dev tap as to not waste IPs
17:38 < krzie> but since 2.1 we have been able to achieve the same goal with dev tun, and lower overhead
17:39 < Xgates> ok I see static and topology information you gave me
17:39 < Xgates> ahh ok about tap I was wondering that too
17:39 < Xgates>  --server in the manual ?
17:39 < krzie> they used dev tap because:
17:39 < krzie> !/30
17:39 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
17:40 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
17:40 < krzie> however, topology subnet fixes that issue
17:40 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:40 < Xgates> ok so show them all this? --> they used dev tap because: and the info below it, ending saying, however, topology subnet fixes that issue?
17:43 < krzie> honestly, i dont care what you show them, smarter thing would be to tell them to come here
17:43 < krzie> lol
17:43 < Xgates> krzie: ahh ok I'll mention coming here too, but just in case they don't, if you'd  be so kind, here is what I've written so far;
17:43 < Xgates> http://pastebin.com/KKYesXt3
17:44 < Xgates> btw krzie THANKS a lot for all this, I really appreciate it :)
17:44 < krzie> yw
17:47 < Xgates> how's that pastebin info look?
17:47 < Xgates> I added this to the email also;   :)
17:47 < krzie> *shrug* looks fine i guess
17:47 < Xgates> To be honest, if anyone is having problems with this, I highly recommend someone joining the Freenode IRC server where OpenVPN has a chat channel so you can get help to fix these issues...     irc.freenode.net #openvpn
17:47 < Xgates> ok cool krzie THANKS again :)
17:48 < krzie> yw
17:48 < krzie> why wouldnt you move to a service that knows what they are doing?
17:48 < Xgates> well I'll let ya know how this goes hehe :)
17:48 < krzie> if this is their openvpn config, i wouldnt expect much from them
17:49 < Xgates> well they are suppose to be good, I just think they haven't stepped it up and need to, so if they do, maybe they'll be ok...
17:50 < Xgates> One thing I do know about them, is there was a big Government investigation that went on for a few years over them and some other VPNs and when the police came into bust them and get info they couldn't get anything out of them or their customers, so they stood up against a government attack on them
17:50 < Xgates> so that looked good to me...
17:51 < krzie> ahh ok
17:51 < krzie> well thats explains that ;]
17:51 -!- `Ile` [~kvirc@109-93-67-224.dynamic.isp.telekom.rs] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
17:52 < Xgates> LOL
17:52 < Xgates> well not really but they are strong in terms of privacy from attack
17:53 < krzie> i wasnt being sarcastic
17:55 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
18:00 < Xgates> ok
18:00 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 255 seconds]
18:03 < Xgates> ok email sent, I forgot the topology section but added that, so now just wait and see...
18:03 < Xgates> THANKS again :)
18:03 < krzie> np
18:04 < Xgates> if it wasn't for that government attack they stood up against, I wouldn't waste my time on them, cause it's so hard to tell how well a VPN can take the pressure if it falls on them...
18:04 < krzie> not just a vpn service
18:05 < krzie> anyone
18:05 < Xgates> but after this, if they can't get this config going, I'll move on...
18:05 < Xgates> yeah...
18:05 < Xgates> sometimes because VPN services can be so difficult knowing what's on the other end, I play sometimes with Tor
18:06 < Xgates> but not to often hehe
18:06 < krzie> you could always tor to the vpn service
18:07 < Xgates> well, that you mention that, another VPN I use, they have a VPN proxy, so I put that in Tor and connect it through the VPN
18:07 < Xgates> not sure it helps much...
18:07 -!- _julian__ [~quassel@hmbg-4d068b58.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
18:27 -!- JG84|Away is now known as JG|HW
18:30 -!- j-a-b-b-a [~Jabbe@p5B28070B.dip0.t-ipconnect.de] has quit [Ping timeout: 244 seconds]
18:39 < dioz> !timeout
18:39 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
18:40 < dioz> are people still suggesting using ping to keep tunnels active?
18:40 < dioz> mine seems to disconnect after like 4 mintues of inactivity
18:45 -!- novaflash is now known as novaflash_away
18:54 < krzie> --keepalive
18:55 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has quit [Remote host closed the connection]
19:00 -!- Denial [Denial@drgi.co.uk] has quit []
19:00 < krzie> i have no idea when people were suggesting that, or why
19:01 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Ping Timeout (0 Nano seconds)]
19:14 -!- JG|HW is now known as JoeGazz84
19:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
19:32 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:38 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:56 -!- ravemaster [~ravemaste@119.93.51.34] has joined #openvpn
19:56 < ravemaster> what software to check what are the open ports opened by the ISP?
19:56 <+EugeneKay> man nmap
20:02 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
20:04 -!- ravemaster [~ravemaste@119.93.51.34] has quit []
20:14 -!- master_of_master [~master_of@p57B5519E.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:19 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
20:21 -!- master_of_master [~master_of@p57B54457.dip.t-dialin.net] has joined #openvpn
20:37 -!- teonanacatl [teo@eris.feh.name] has joined #openvpn
20:38 < teonanacatl> hi
20:44 < teonanacatl> i've set up a static key vpn with one client and one server. the client is running windows 7 and is connected to the server. now i'd like to route all the internet traffic through that VPN-connection. does anybody have a hint for me on how to do that in a simple manner? (maybe it's not directly related to openvpn, but i have no idea how to solve that problem)
20:45 < krzie> !redirect
20:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
20:45 < krzie> you did not mention the server OS (or i missed it)
20:45 < teonanacatl> it's debian linux
20:46 < krzie> !linnat
20:46 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
20:46 < krzie> !linipforward
20:46 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
20:47 < teonanacatl> !def1
20:47 < krzie> and redirect-gateway def1 on the client
20:47 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
20:47 < teonanacatl> so, does the server enforce the correct routing on the client-side with this setup?
20:48 < krzie> enforce?
20:48 < krzie> you may think of it like that if you control the client... but its more like a suggestion that is listened to by default
20:49 < krzie> if the client tries, he can change it
20:49 < teonanacatl> yeah, that's what i mean. sorry
20:50 < teonanacatl> i'll give it a try. thank you, krzie 
20:50 < krzie> yw
20:53 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:57 -!- JoeGazz84 is now known as [AFK]
21:14 < teonanacatl> redirect-gateway def1 seems to work. i've enabled ip_forward now and set up NAT, but the client doesn't have access to the internet. i cleared all the iptables rules and tried it with the NAT-one only, which should work normally
21:14 < teonanacatl> mh
21:16 < teonanacatl> (it's not the DNS, i tried to ping a DNS server)
21:21 < teonanacatl> ok, there was a typo
21:21 < teonanacatl> it's working now. :-)
21:26 < krzie> =]
21:32 < teonanacatl> mh, except for the push. works fine, if i put "redirect-gateway def1" directly in the client's config, but i would prefer the push-way
21:47 < krzee> then the "client" would need --pull
21:47 < krzee> since you dont have server/client
21:51 < teonanacatl> ok, i get the point
21:52 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Quit: changing servers]
21:55 < dioz> so according to wireshark when i'm streaming large multimedia files that is done outside my tunnel
21:55 < dioz> outside my redirect-gateway def1
21:56 < dioz> i can see my localip connecting to the hostip for the content
21:56 < dioz> instead of just seeing my localip > remote-gateway  UDP traffic
21:59 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
22:51 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
22:51 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:20 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Quit: Leaving.]
23:39 -!- Jarpse [~jarpse@cruft.geek.cx] has quit [Ping timeout: 244 seconds]
23:41 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
23:42 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
23:49 <@vpnHelper> RSS Update - forum: Browser can not browse <http://forums.openvpn.net/topic9072-15.html#p17992> || tunneling <http://forums.openvpn.net/topic8104.html#p17991> || VPN top 10 <http://forums.openvpn.net/topic9143.html#p17990>
--- Day changed Tue Nov 29 2011
00:00 -!- mgorbach [~mgorbach@pool-108-45-112-248.washdc.fios.verizon.net] has joined #openvpn
00:00 < mgorbach> Anyone here have experience with setting up a bridge on linux for use with openvpn?
00:01 < krzee> i have experience with explaining to people why they dont need to use a bridge
00:01 < krzee> so lets start there
00:01 < krzee> why do you need a bridge?
00:01 < mgorbach> krzee I have a single-person "road warrior VPN" I'm tryign to set up
00:02 < mgorbach> And I want mdns / bonjour to work over it
00:02 < mgorbach> For that, it seems to me I need to forward broadcast packets, which needs a layer2 bridge
00:02 < krzee> why?
--- Log closed Tue Nov 29 00:04:38 2011
--- Log opened Tue Nov 29 00:04:57 2011
00:04 -!- ecrist [~ecrist@jaguar-2-red.claimlynx.com] has joined #openvpn
00:04 -!- Irssi: #openvpn: Total of 133 nicks [5 ops, 0 halfops, 2 voices, 126 normal]
00:05 < mgorbach> Hmm, a reboot would do it
00:05 -!- Irssi: Join to #openvpn was synced in 30 secs
00:05 < krzee> just be sure to give yourself enough time too ;]
00:06 < mgorbach> So, what I'm trying to understand is, what is the IP te bridge is "configured" with
00:06 < mgorbach> Is it the same IP as eth0 has (the one given out by the network's DHCP server)?
00:06 < krzee> ya im not the right guy for bridging questions
00:06  * krzee goes back to idle
00:06 < krzee> im sure someone else will come along who knows more
00:07 < krzee> or you could try the forum
00:10 -!- _quadDamage [~EmperorTo@jaguar-2-red.claimlynx.com] has joined #openvpn
00:13 <+EugeneKay> How to set up bridging: set up routing.
00:13 < krzee> EugeneKay, he actually needs it
00:13 < mgorbach> Whoah, lots of people seem to be against briding around here ;)
00:13 < mgorbach> Is it that it doesn't scale well that causes people to dislike it?
00:13 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
00:14 <+EugeneKay> Technically, he wants it. I don't think he has cancer that'll be cured by a TAP device.
00:15 <+EugeneKay> Ah, bonjour. I have no idea.
00:15 <+EugeneKay> Other than "pick a sane protocol"
00:16 < mgorbach> I'm an Apple guy coming back to linux after a long while, so I'm sticking to old habits it seems.
00:17 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:17 <@vpnHelper> RSS Update - forum: OpenVPN client on Windows 7 <http://forums.openvpn.net/topic9286.html#p17993>
00:24 <@vpnHelper> RSS Update - forum: OpenVPN and Sonicwall Firewall Config???? <http://forums.openvpn.net/topic9297.html#p17994>
00:25 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
00:26 -!- Cr4zi3 [killaz@66.55.76.11] has joined #openvpn
00:27 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:36 <@vpnHelper> RSS Update - forum: adaptive compression including time to (de)compress data <http://forums.openvpn.net/topic8883.html#p17995>
00:48 <@vpnHelper> RSS Update - forum: How To Control DHCP Lease In OpenVPN <http://forums.openvpn.net/topic9273.html#p17997> || How don't use the default VPN interface / only on my VM <http://forums.openvpn.net/topic9266.html#p17996>
00:53 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
00:53 <@vpnHelper> RSS Update - forum: Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p17998>
01:06 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:06 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
01:06 -!- mgorbach [~mgorbach@pool-108-45-112-248.washdc.fios.verizon.net] has quit [Quit: Leaving...]
01:12 <@vpnHelper> RSS Update - forum: Windows 7 64 bit Installation Fails OpenVPN 2.2.1 <http://forums.openvpn.net/topic8440.html#p18000> || Redirect active connections to a OpenVPn tunnel <http://forums.openvpn.net/topic9206.html#p17999>
01:14 -!- _julian [~quassel@hmbg-5f7634f0.pool.mediaWays.net] has joined #openvpn
01:18 <@vpnHelper> RSS Update - forum: DHCP lease renewal in bridged VPN <http://forums.openvpn.net/topic9282.html#p18001>
01:30 -!- dazo_afk is now known as dazo
01:30 <@vpnHelper> RSS Update - forum: OpenVPN and Sonicwall Firewall Config???? <http://forums.openvpn.net/topic9297.html#p18003> || StoneVPN <http://forums.openvpn.net/topic7203.html#p18002>
01:30 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
01:31 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
01:34 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Quit: Leaving.]
01:36 <@vpnHelper> RSS Update - forum: Client stuck on connecting <http://forums.openvpn.net/topic9298.html#p18004>
01:37 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:39 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:42 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:42 <@vpnHelper> RSS Update - forum: OpenVPN and Sonicwall Firewall Config???? <http://forums.openvpn.net/topic9297.html#p18006> || openvpn stops working after a server reboot <http://forums.openvpn.net/topic9254.html#p18005>
02:02 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
02:14 -!- jungfranckianer1 [~sallner@elcoco.ethz.ch] has joined #openvpn
02:15 < jungfranckianer1> !goal
02:15 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:16 < jungfranckianer1> !welcome
02:16 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:16 < jungfranckianer1> !route
02:16 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
02:17 < jungfranckianer1> !tcpip
02:17 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
02:18 <@vpnHelper> RSS Update - forum: W7Server - Embedded Linux GSM Router <http://forums.openvpn.net/topic9237.html#p18007>
02:25 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Read error: Operation timed out]
02:28 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
02:35 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
02:44 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
02:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:45 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:05 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
03:14 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
03:14 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
03:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
03:19 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Read error: Operation timed out]
03:22 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
03:41 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:50 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p18008>
03:51 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 244 seconds]
03:54 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Ping timeout: 245 seconds]
03:55 -!- fremo_ [~fremo@noc.toile-libre.net] has quit [Ping timeout: 240 seconds]
04:03 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
04:03 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
04:04 -!- Inumedia [~Inumedia@unaffiliated/inumedia] has joined #openvpn
04:05 < Inumedia> I'm using the GADMIN-OpenVPN server administrator tool on Ubuntu 11.10 and just generated my certificate, how do I restart the VPN server so I can active it?
04:08 -!- Inumedia [~Inumedia@unaffiliated/inumedia] has quit [Remote host closed the connection]
04:12 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 244 seconds]
04:15 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
04:16 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
04:16 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
04:23 -!- Inumedia [~Inumedia@unaffiliated/inumedia] has joined #openvpn
04:26 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
04:31 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
04:39 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
04:41 -!- nobo_ [b249c8c6@gateway/web/freenode/ip.178.73.200.198] has joined #openvpn
04:42 < nobo_> Hi, I cant connect to freenode.net while my vpn is running, any ideas
04:46 -!- tarn [~tarn@41.84.64.98] has joined #openvpn
04:47 < tarn> hi all. could anyone please help me with an openvpn connectivity issue?
04:50 -!- g0d [~zero@ip-97-74-121-225.ip.secureserver.net] has quit [Ping timeout: 260 seconds]
04:50 -!- g0d [~zero@ip-97-74-121-225.ip.secureserver.net] has joined #openvpn
04:52 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
04:52 -!- tarn [~tarn@41.84.64.98] has quit [Quit: tarn]
05:00 -!- probonono [~User@unaffiliated/probonono] has quit [Read error: No route to host]
05:00 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
05:20 <@vpnHelper> RSS Update - forum: Issue with OpenVPN connection via public IP <http://forums.openvpn.net/topic9299.html>
05:20 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:22 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
05:25 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
05:25 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
05:26 <@vpnHelper> RSS Update - forum: Issue with OpenVPN connection via public IP <http://forums.openvpn.net/topic9299.html#p18010>
05:31 -!- Inumedia [~Inumedia@unaffiliated/inumedia] has quit [Remote host closed the connection]
05:32 <@vpnHelper> RSS Update - forum: DHCP lease renewal in bridged VPN <http://forums.openvpn.net/topic9282.html#p18013> || W7Server - Embedded Linux GSM Router <http://forums.openvpn.net/topic9237.html#p18012> || adaptive compression including time to (de)compress data <http://forums.openvpn.net/topic8883.html#p18011>
05:38 <@vpnHelper> RSS Update - forum: How To Control DHCP Lease In OpenVPN <http://forums.openvpn.net/topic9273.html#p18015> || Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18014>
05:42 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
05:48 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 244 seconds]
05:48 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 255 seconds]
05:48 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
05:53 -!- cali_ [~cali@91.220.163.18] has quit [Ping timeout: 244 seconds]
05:54 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
05:58 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Excess Flood]
06:00 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
06:00 -!- cali_ [~cali@91.220.163.18] has joined #openvpn
06:01 -!- nobo_ [b249c8c6@gateway/web/freenode/ip.178.73.200.198] has quit [Quit: Page closed]
06:02 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p18016>
06:08 <@vpnHelper> RSS Update - forum: Issue with OpenVPN connection via public IP <http://forums.openvpn.net/topic9299.html#p18018> || Workgroup browsing not working (WXP client, Linux server) <http://forums.openvpn.net/topic8580-15.html#p18017>
06:17 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
06:34 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
06:39 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p18019>
06:41 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:55 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:59 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 240 seconds]
07:00 -!- countd [~countd@unaffiliated/countd] has quit [Ping timeout: 244 seconds]
07:01 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 260 seconds]
07:02 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Ping timeout: 245 seconds]
07:03 <@vpnHelper> RSS Update - forum: OpenVPN with Google authenticator like 2FA (windows client) <http://forums.openvpn.net/topic9300.html>
07:04 -!- fremo [~fremo@noc.toile-libre.net] has quit [Ping timeout: 248 seconds]
07:06 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:12 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
07:13 -!- fremo_ [~fremo@noc.toile-libre.net] has joined #openvpn
07:13 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
07:13 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
07:14 -!- corretico [~luis@201.201.44.82] has joined #openvpn
07:14 <@vpnHelper> RSS Update - forum: Issue with OpenVPN connection via public IP <http://forums.openvpn.net/topic9299.html#p18021>
07:27 <@vpnHelper> RSS Update - forum: [Resolved] Issue with OpenVPN connection via public IP <http://forums.openvpn.net/topic9299.html#p18021>
07:33 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:34 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
07:39 <@vpnHelper> RSS Update - forum: Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18022>
07:41 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:45 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:45 <@vpnHelper> RSS Update - forum: OpenVPN with Google authenticator like 2FA (windows client) <http://forums.openvpn.net/topic9300.html#p18023>
07:51 <@vpnHelper> RSS Update - forum: Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18024>
07:56 -!- _zero_ [~zero@noc.toile-libre.net] has quit [Ping timeout: 248 seconds]
07:56 -!- fremo_ [~fremo@noc.toile-libre.net] has quit [Ping timeout: 258 seconds]
07:57 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
07:57 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
08:03 -!- _julian_ [~quassel@hmbg-5f77ce97.pool.mediaWays.net] has joined #openvpn
08:05 -!- _julian [~quassel@hmbg-5f7634f0.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
08:13 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has joined #openvpn
08:13 -!- luptenschteiner [~User@ppp103-111.static.internode.on.net] has quit [Changing host]
08:13 -!- luptenschteiner [~User@unaffiliated/probonono] has joined #openvpn
08:13 -!- probonono [~User@unaffiliated/probonono] has quit [Read error: Connection reset by peer]
08:15 -!- luptenschteiner is now known as probonono
08:23 -!- _julian [~quassel@hmbg-5f77d808.pool.mediaWays.net] has joined #openvpn
08:24 -!- _julian_ [~quassel@hmbg-5f77ce97.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
08:27 -!- mgorbach [~mgorbach@pool-108-45-112-248.washdc.fios.verizon.net] has joined #openvpn
08:27 <@vpnHelper> RSS Update - forum: PAM athentication, Please read, something is inside for you! <http://forums.openvpn.net/topic9301.html>
08:30 -!- Netsplit *.net <-> *.split quits: SigmaProjects, krzie, corretico, peper
08:30 -!- Netsplit over, joins: peper
08:31 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:36 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:36 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
08:36 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
08:39 <@vpnHelper> RSS Update - forum: Check my log <http://forums.openvpn.net/topic9302.html>
08:41 -!- mgorbach [~mgorbach@pool-108-45-112-248.washdc.fios.verizon.net] has quit [Quit: Leaving...]
08:47 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:55 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
08:59 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
08:59 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
09:00 -!- _julian_ [~quassel@hmbg-5f763b6e.pool.mediaWays.net] has joined #openvpn
09:00 -!- _julian [~quassel@hmbg-5f77d808.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
09:08 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:09 <@vpnHelper> RSS Update - forum: What is the eeffect of adding proxy on tcp tunnel? <http://forums.openvpn.net/topic9303.html> || Check my log <http://forums.openvpn.net/topic9302.html#p18027> || Create users for PAM authentication with PHP script <http://forums.openvpn.net/topic9301.html>
09:09 -!- Axeman [~Axeman3@198.105.46.22] has joined #openvpn
09:09 -!- Axeman [~Axeman3@198.105.46.22] has quit [Changing host]
09:09 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:09 -!- mode/#openvpn [+v Axeman] by ChanServ
09:15 <@vpnHelper> RSS Update - forum: Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18029>
09:17 -!- happylife [~happylife@212.92.145.7] has quit [Quit: So long]
09:27 <@vpnHelper> RSS Update - forum: Check my log <http://forums.openvpn.net/topic9302.html#p18032> || What is the eeffect of adding proxy on tcp tunnel? <http://forums.openvpn.net/topic9303.html#p18031> || Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18030>
09:33 -!- ginooe [~Adium@136-mi3-3.acn.waw.pl] has joined #openvpn
09:33 <@vpnHelper> RSS Update - forum: What is the eeffect of adding proxy on tcp tunnel? <http://forums.openvpn.net/topic9303.html#p18033>
09:33 < ginooe> hi
09:33 < ecrist> not yet. ;)
09:33 < ginooe> it is possible to run managment console on loopback and tun interface ?
09:38 < ecrist> no
09:38 < ecrist> afaik, you can only run it on one interface
09:39 < ecrist> you can use an ssh tunnel to access it on the loopback interface, though.
09:39 -!- michal` [~michal@rsbac/developer/michal] has joined #openvpn
09:40 < michal`> hey
09:40 < michal`> 1500 users, 20Mbit/sec bandwidth
09:40 < michal`> how much horsepower do i really need? Because i think not much, it's only 20Mbit/sec...
09:40 -!- _julian [~quassel@hmbg-4d0685eb.pool.mediaWays.net] has joined #openvpn
09:41 < michal`> actualy, i do not believe in 1500 users on 20Mbit/sec... 13Kbit/sec per user? ;)
09:41 < michal`> but!
09:41 < michal`> will OpenVPN handle easily bandwidth near say, 100Mbit/sec?
09:41 -!- _julian_ [~quassel@hmbg-5f763b6e.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
09:41 < ecrist> OpenVPN will only handle about 250 users per instance
09:41 < ecrist> OpenVPN cares not about the bandwidth, as long as your hardware can handle it
09:42 < michal`> thx for the first information, please share some experiences about hardware
09:42 < michal`> i'm trying to size it
09:42 < ecrist> I don't know.
09:42 < ecrist> try google
09:42 < michal`> google told me it's going to be easy
09:43 < ecrist> I run a small openvpn network, low bandwidth, and few users
09:46 < ginooe> ok, something else - it is possible to connect on server to process (maybe by managment console) and push some information via echo and read it in client managment console ?
09:46 < ginooe> i want to use same connection to transfer some control information from server to client 
09:47 < michal`> ok, thx for the users/instance
09:47 < michal`> cya
09:47 -!- michal` [~michal@rsbac/developer/michal] has left #openvpn [">/dev/yachill"]
09:48 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
09:50 <@vpnHelper> RSS Update - forum: Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18035> || Check my log <http://forums.openvpn.net/topic9302.html#p18034>
09:55 -!- chruck [~chruck@204.28.100.132] has joined #openvpn
09:56 < chruck> !welcome
09:56 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:56 < ecrist> you get a star
09:56 < chruck> :^)
09:57 < chruck> !dns
09:57 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
09:57 < chruck> !pushdns
09:57 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
09:57 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
10:00 < chruck> Okay, I don't think I have the answer I'm looking for, can I ask now?
10:00 < chruck> :^)
10:00 < chruck> whoops, I asked to ask
10:00 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p18036>
10:00 -!- cali_ [~cali@91.220.163.18] has quit [Ping timeout: 258 seconds]
10:01 < chruck> I have a "dhcp-option DNS a.b.c.d" in my config
10:01 < chruck> and the client is adding "nameserver a.b.c.d" to the end of /etc/resolv.conf
10:01 < chruck> Is there any way I can get it at the top?
10:02 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
10:02 < chruck> My specific problem:  chat.example.com points to my external IP address via my external DNS
10:02 < chruck> but my internal IP on my internal DNS
10:03 < chruck> when I "nslookup chat.example.com" while on the OpenVPN, it resolves to the external IP
10:03 < chruck> because my ISP's nameserver is the one resolving
10:03 -!- cali_ [~cali@91.220.163.18] has joined #openvpn
10:03 < chruck> because it is before my internal DNS
10:04 < chruck> how can I get my internal DNS at the top of /etc/resolv.conf
10:05 < chruck> It seems the only answer I can find is to alter each client's --up script
10:05 <@vpnHelper> RSS Update - forum: Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18037>
10:06 < chruck> ecrist?  You seem to be the only one alive in here?
10:06 < pwrcycle> chruck: after you edit your resovl.conf, did you restart the service?
10:07 < pwrcycle> and after you reboot, check again to see if the settings remained, some OSes re-write resolve.conf on boot.
10:07 < chruck> pwrcycle: are you referring to the OpenVPN server or client?
10:08 < pwrcycle> chruck: the client.
10:08 < pwrcycle> it's easy to get the server to push the DNS down the tunnel, it's harder to get the client to use that DNS.
10:08 -!- ginooe [~Adium@136-mi3-3.acn.waw.pl] has quit [Quit: Leaving.]
10:08 -!- fellipe [~fellipe@201.29.179.244] has joined #openvpn
10:08 < chruck> pwrcycle: if I manually edit resolv.conf, it works as expected
10:08 < fellipe> hi everyone
10:09 < fellipe> my vpnc starts but does not work. [52546.570639] UDP: bad checksum. From 174.133.??.??:4500 to 10.0.0.252:4500 ulen 108. any idea?
10:09 < chruck> I want it to be done automatically for all my clients
10:09 < pwrcycle> chruck: not easy on varying OSes.
10:09 < chruck> pwrcycle: I think my problem is the "harder to get the client to use that DNS"
10:10 < pwrcycle> ie, if the client has set 192.168.1.1 as his resolv, then that will mostly likely be used instead of the VPN dns, because it's local. 
10:10 < chruck> pwrcycle: can it be done from the server, or do I have to do it at each client?
10:10 < pwrcycle> if the client has set dhcp all the way, then it seems easier for the vpn client to set resolv correctly.
10:10 -!- ph1l1 [~ph1l@41-234.197-178.cust.bluewin.ch] has joined #openvpn
10:10 <@vpnHelper> RSS Update - forum: Check my log <http://forums.openvpn.net/topic9302.html#p18038>
10:10 < pwrcycle> chruck: you'll need to do it on both
10:11 < pwrcycle> in your server config, you'll want to "push xxx" something.  check howto
10:11 < pwrcycle> but you'll need the client config to use that "push" info.
10:11 < chruck> pwrcycle: they already are, just not in the order I want
10:13 < chruck> How do I _pre_pend my DNS
10:13 < pwrcycle> chruck: on server example: push "dhcp-option DNS 4.2.2.1"
10:14 < cjs226> my server is running fine but I'm being asked to rotate the server's private key password.  can i just use ssh-keygen to change the server.key's passphrase?
10:14 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 240 seconds]
10:14 < chruck> pwrcycle: got it
10:14 -!- _julian [~quassel@hmbg-4d0685eb.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
10:14 < pwrcycle> chruck: my config notes say that windows doesn't always respect that setting though, so you'll just have to check.
10:15 < fellipe> my vpnc starts but does not work. [52546.570639] UDP: bad checksum. From 174.133.??.??:4500 to 10.0.0.252:4500 ulen 108. any idea?
10:15 < fellipe> ??
10:15 <@vpnHelper> RSS Update - forum: Check my log <http://forums.openvpn.net/topic9302.html#p18040> || Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18039>
10:15 < fellipe> :(
10:15 < chruck> pwrcycle: okay, I don't think you're understanding me.  I already have "push dhcp-option dns X".
10:15 < chruck> pwrcycle: and it appends it to /etc/resolv.conf
10:16 < chruck> how do I PREpend it?
10:16 < chruck> or clobber my existing DNS in resolv.conf?
10:16 < chruck> or can it be done?
10:17 -!- cali_ [~cali@91.220.163.18] has quit [Ping timeout: 244 seconds]
10:18 < pwrcycle> i've only ever pre-pended bgp, not dns.
10:19 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
10:19 < pwrcycle> in the openvpn config, i think you're telling the client what DNS to use. you can specify the server itself i suppose, 10.8.0.1, or you can set some external like 4.2.2.1
10:19 -!- dazo is now known as dazo_afk
10:19 < pwrcycle> i just skip the internal lookup because the server's got to send the packet out anyway, so just tell the client to look external anyhow is what i do.
10:19 < pwrcycle> not sure that gets to your question though.
10:21 < pwrcycle> ah, are you asking how openvpn can re-order the client's resolve.conf?
10:21 < ecrist> openvpn cannot, but it can call a script to do it for you.
10:21 < ecrist> sed and awk are your friends. ;)
10:22 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Excess Flood]
10:23 < pwrcycle> fellipe: check your TLS authenitication
10:23 -!- fellipe [~fellipe@201.29.179.244] has quit [Quit: Saindo]
10:24 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
10:27 -!- cali_ [~cali@91.220.163.18] has joined #openvpn
10:27 < chruck> ecrist: this is the --up script?
10:27 < ecrist> sure
10:28 < chruck> pwrcycle: yes, I am asking how to re-order client's resolv.conf
10:28 < chruck> ecrist: so, I'll have to modify this --up script on all clients?
10:28 < ecrist> if you're trying to reorder the resolv.conf,yes
10:29 < chruck> the OpenVPN server can't push an --up script?
10:30 < ecrist> no
10:32 -!- cali_ [~cali@91.220.163.18] has quit [Ping timeout: 255 seconds]
10:32 -!- _julian [~quassel@hmbg-5f77e702.pool.mediaWays.net] has joined #openvpn
10:32 < chruck> ecrist: I was afraid of that
10:32 < chruck> ecrist: pwrcycle thank you both for your help
10:33 < ecrist> no problem.
10:34 -!- cali_ [~cali@91.220.163.18] has joined #openvpn
10:38 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Excess Flood]
10:38 <@vpnHelper> RSS Update - forum: Check my log <http://forums.openvpn.net/topic9302.html#p18041>
10:39 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
10:41 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
10:44 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
10:46 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 252 seconds]
10:47 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:56 -!- _julian [~quassel@hmbg-5f77e702.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
10:56 -!- cali_ [~cali@91.220.163.18] has quit [Ping timeout: 252 seconds]
10:57 -!- ph1l1 [~ph1l@41-234.197-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
11:00 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
11:14 -!- _julian [~quassel@hmbg-5f761582.pool.mediaWays.net] has joined #openvpn
11:14 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
11:14 <@vpnHelper> RSS Update - forum: How can I rotate the server's password? <http://forums.openvpn.net/topic9304.html>
11:14 -!- cali_ [~cali@91.220.163.18] has joined #openvpn
11:16 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
11:17 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Read error: Connection reset by peer]
11:17 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
11:23 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:26 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
11:26 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:27 -!- _julian [~quassel@hmbg-5f761582.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
11:29 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
11:29 -!- _julian [~quassel@hmbg-4d06fbdc.pool.mediaWays.net] has joined #openvpn
11:35 -!- _julian_ [~quassel@hmbg-5f764b35.pool.mediaWays.net] has joined #openvpn
11:36 -!- _julian [~quassel@hmbg-4d06fbdc.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
11:38 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270.html#p18043>
11:39 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:40 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:41 -!- _julian_ [~quassel@hmbg-5f764b35.pool.mediaWays.net] has quit [Read error: Operation timed out]
11:43 -!- _julian [~quassel@hmbg-4d06fbdc.pool.mediaWays.net] has joined #openvpn
12:02 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:02 -!- mode/#openvpn [+v s7r] by ChanServ
12:08 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html>
12:10 -!- p3rror [~mezgani@41.140.32.221] has joined #openvpn
12:27 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
12:36 -!- `Ile` [~kvirc@178.222.163.68] has joined #openvpn
12:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 244 seconds]
12:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:41 -!- nagnewb [465a3e25@gateway/web/freenode/ip.70.90.62.37] has joined #openvpn
12:59 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
13:03 -!- _julian [~quassel@hmbg-4d06fbdc.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
13:07 -!- newl [~newl@97.75.165.156] has joined #openvpn
13:12 -!- scoopex [~scoopex@85.214.140.184] has left #openvpn []
13:13 -!- jungfranckianer1 [~sallner@elcoco.ethz.ch] has quit [Ping timeout: 240 seconds]
13:14 -!- newl_ [~newl@97.75.165.156] has joined #openvpn
13:16 -!- newl [~newl@97.75.165.156] has quit [Ping timeout: 272 seconds]
13:21 <@vpnHelper> RSS Update - forum: Client slow when cpu busy (i.e youtube) <http://forums.openvpn.net/topic8044.html#p18045>
13:27 <@vpnHelper> RSS Update - forum: Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18046>
13:29 -!- nbca [~phraktal@phraktal.baconseed.org] has joined #openvpn
13:34 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Read error: Connection reset by peer]
13:37 -!- probonono [~User@unaffiliated/probonono] has quit [Read error: Connection reset by peer]
13:38 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
13:40 -!- agagag [~anton@83.167.185.34] has quit [Ping timeout: 245 seconds]
13:40 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
13:41 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 260 seconds]
13:41 -!- scalloped [~I@46.19.137.140] has joined #openvpn
13:47 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
13:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 244 seconds]
13:50 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 245 seconds]
14:04 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
14:30 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has joined #openvpn
14:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
14:30 -!- gladiatr [~sdspence@160.15.124.24.cm.sunflower.com] has quit [Changing host]
14:30 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
14:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:35 -!- nbca [~phraktal@phraktal.baconseed.org] has left #openvpn []
14:39 -!- r1ppa [~McBoingBo@mail.hrsg.ca] has left #openvpn ["Leaving"]
14:44 -!- nagnewb [465a3e25@gateway/web/freenode/ip.70.90.62.37] has quit [Ping timeout: 265 seconds]
15:18 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
15:21 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:24 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Client Quit]
15:31 -!- quietone [~quietone@121-98-80-11.bitstream.orcon.net.nz] has joined #openvpn
15:31 < quietone> !welcome
15:31 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:32 < quietone> !goal
15:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:39 <@vpnHelper> RSS Update - forum: openvpn stops working after a server reboot <http://forums.openvpn.net/topic9254.html#p18048> || OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18047>
15:46 < quietone> i've never used this and I've been asked to revoke a user. Done some reading but still not sure what to do. Do you know a good guide? CentOS 5.7
15:49 < krzie> !crl
15:49 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that will
15:49 <@vpnHelper> create the CRL file for you. ssl-admin will also build a crl for you
15:49 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 244 seconds]
15:51 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
15:51 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
15:52 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
15:52 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
15:52 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
15:54 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
15:55 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:57 < quietone> !easy-rsa
15:57 <@vpnHelper> RSS Update - forum: openvpn stops working after a server reboot <http://forums.openvpn.net/topic9254.html#p18049>
15:58 < quietone> krzie, I can't fine easy-rsa
15:58 < krzie> howd you make your certs?
15:59 < quietone> krzie, I didn't and I don't really know how to do that either
16:00 < krzie> then i cant help you
16:00 < krzie> you need the pki stuff that made the certs
16:05 < quietone> krzie, oh dear.
16:10 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270-15.html#p18050>
16:10 -!- `Ile` [~kvirc@178.222.163.68] has quit [Ping timeout: 255 seconds]
16:14 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit []
16:14 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
16:32 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
16:42 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
16:52 -!- p3rror [~mezgani@41.140.32.221] has quit [Ping timeout: 248 seconds]
17:04 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
17:04 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:10 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:22 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18051>
17:23 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
17:25 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
17:25 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
17:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:36 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
17:50 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
17:57 -!- guntha [~guntha_@pool-74-102-8-168.nwrknj.fios.verizon.net] has joined #openvpn
18:04 -!- quietone [~quietone@121-98-80-11.bitstream.orcon.net.nz] has quit [Quit: Leaving]
18:10 < scalloped> !howto
18:10 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:17 -!- Denial [Denial@drgi.co.uk] has quit []
18:19 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
18:24 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
18:27 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:33 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
18:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
18:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
18:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:00 -!- sgp [~smerp@foresight/developer/sgp] has quit [Read error: Connection reset by peer]
19:04 <@vpnHelper> RSS Update - forum: Getting this to work. <http://forums.openvpn.net/topic9288.html#p18052>
19:05 -!- sgp [~smerp@foresight/developer/sgp] has joined #openvpn
19:05 -!- sgp [~smerp@foresight/developer/sgp] has quit [Remote host closed the connection]
19:14 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Read error: Connection reset by peer]
19:14 -!- gyyrog [~gyyrog@adsl-99-88-229-221.dsl.klmzmi.sbcglobal.net] has joined #openvpn
19:41 -!- gyyrog_ [~gyyrog@99.54.140.185] has joined #openvpn
19:43 -!- gyyrog [~gyyrog@adsl-99-88-229-221.dsl.klmzmi.sbcglobal.net] has quit [Ping timeout: 260 seconds]
19:48 -!- guntha [~guntha_@pool-74-102-8-168.nwrknj.fios.verizon.net] has quit [Ping timeout: 244 seconds]
19:53 -!- guntha [~guntha_@pool-74-102-8-168.nwrknj.fios.verizon.net] has joined #openvpn
20:19 -!- master_of_master [~master_of@p57B54457.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
20:21 -!- master_of_master [~master_of@p57B543D5.dip.t-dialin.net] has joined #openvpn
20:44 -!- newbie [~I@46.19.137.140] has joined #openvpn
20:44 -!- newbie is now known as Guest87126
20:46 -!- scalloped [~I@46.19.137.140] has quit [Ping timeout: 258 seconds]
20:53 -!- Pilif12p is now known as Tannerbaum
21:10 -!- vasily__ [~happylife@46.251.83.126] has joined #openvpn
21:11 -!- vasily__ [~happylife@46.251.83.126] has quit [Read error: Connection reset by peer]
21:11 -!- vpopov [~happylife@46.251.83.126] has joined #openvpn
21:13 -!- [AFK] is now known as [AFK|Sleep]
21:16 -!- SOG [~SOG@113.108.118.60] has joined #openvpn
21:17 -!- vpopov [~happylife@46.251.83.126] has quit [Ping timeout: 245 seconds]
21:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
21:27 -!- Guest87126 [~I@46.19.137.140] has quit [Quit: KVIrc 4.0.4 Insomnia http://www.kvirc.net/]
21:28 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
21:28 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
21:28 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:52 -!- gyyrog_ [~gyyrog@99.54.140.185] has quit [Remote host closed the connection]
21:59 -!- newl_ [~newl@97.75.165.156] has quit [Quit: leaving]
22:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:04 -!- probonono [~User@unaffiliated/probonono] has quit [Read error: No route to host]
22:07 -!- probonono [~User@ppp103-111.static.internode.on.net] has joined #openvpn
22:07 -!- probonono [~User@ppp103-111.static.internode.on.net] has quit [Changing host]
22:07 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
22:11 -!- probonono [~User@unaffiliated/probonono] has quit [Read error: No route to host]
22:12 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
23:12 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
23:12 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
23:12 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
23:41 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
23:42 < Haraken> quick question, I have setup openvpn so I can connect to my server's local network but I'm trying to make it so I can route all of my internet through the server as well... could someone point me in the right direction of doing this?
23:43 < dioz> --redirect-gateway
23:44 < dioz> and ip masquerading maybe?
23:45 < dioz> you'd also have to push other information required
23:45 < dioz> such as dns
23:45 < dioz> https://we.riseup.net/debian/personal-vpn
23:45 < Haraken> dioz, thanks I think that was enough to help me find a tutorial on google
23:45 <@vpnHelper> Title: Personal VPN - debian grimoire - Groups - we.riseup.net (at we.riseup.net)
23:45 < Haraken> ah thank you for that as well
23:45 < Haraken> was looking over this https://forums.openvpn.net/topic7806.html
23:45 <@vpnHelper> Title: OpenVPN Support Forum Windows 7 as OpenVPN server with redirect-gateway : Examples (at forums.openvpn.net)
23:46 < dioz> they also get called remote gateways
23:48 < Haraken> ahh
--- Day changed Wed Nov 30 2011
00:00 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
00:04 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270-15.html#p18053>
00:10 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18054>
00:10 -!- Mimiko [~mimiko@77.89.245.38] has joined #openvpn
00:11 < Mimiko> !pastebin
00:11 <@vpnHelper> Unable to download feed.
00:12 -!- Mimiko [~mimiko@77.89.245.38] has quit [Client Quit]
00:15 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:20 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
00:31 <@vpnHelper> RSS Update - forum: OpenVPN Elliptic Curves (SHA512, ECDSA, ECDH, Linux, Debian) <http://forums.openvpn.net/topic8404-45.html#p17862>
00:54 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
01:13 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
01:19 < Haraken> I got it so i can route traffic through my server now, only thing I have left that I'm trying to figure out is how to set it to a different ip address that shows
01:29 < dioz> that is a good question
01:29 < dioz> i believe it uses the same interface that it's listening on
01:30 < dioz> i think you would use routes for that
01:30 < dioz> tbh
01:36 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:58 -!- Apocryphe [~Apocryphe@81-64-43-253.rev.numericable.fr] has quit [Quit: KVIrc 4.0.4 Insomnia http://www.kvirc.net/]
02:00 -!- dazo_afk is now known as dazo
02:01 -!- novaflash_away is now known as novaflash
02:05 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
02:06 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:09 -!- Haraken [~ryuk@unaffiliated/haraken] has quit [Quit: insert quit message]
02:11 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
02:37 <@vpnHelper> RSS Update - forum: How can I rotate the server's password? <http://forums.openvpn.net/topic9304.html#p18056> || Check my log <http://forums.openvpn.net/topic9302.html#p18055>
02:39 -!- _julian [~quassel@hmbg-4d06b27e.pool.mediaWays.net] has joined #openvpn
02:40 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
02:44 <@vpnHelper> RSS Update - forum: [SOLVED] Use of multiple NIC's <http://forums.openvpn.net/topic9277.html#p18046> || [SOLVED] What is the eeffect of adding proxy on tcp tunnel? <http://forums.openvpn.net/topic9303.html#p18033>
02:51 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:15 <@vpnHelper> RSS Update - forum: OpenVPN with Google authenticator like 2FA (windows client) <http://forums.openvpn.net/topic9300.html#p18057>
03:18 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
03:19 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:25 -!- ginooe [~Adium@136-mi3-3.acn.waw.pl] has joined #openvpn
03:25 < ginooe> hi
03:27 < ginooe> it is possible to use managment console on server to push some echo command to client after connection is established ?
03:36 -!- _julian [~quassel@hmbg-4d06b27e.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
03:38 -!- _julian [~quassel@hmbg-4d06ac8a.pool.mediaWays.net] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203.html#p18058>
03:42 <+EugeneKay> ginooe - AFAIK, no. http://www.openvpn.net/index.php/open-source/documentation/miscellaneous/79-management-interface.html
03:42 <@vpnHelper> Title: Management Interface (at www.openvpn.net)
03:43 <+EugeneKay> Oh, echo commands. That's a yes.
03:43 <+EugeneKay> (I think.... read the docs)
03:43 <+EugeneKay> AFAIK, t's not possible to push routes tho
03:44 -!- Perun [perun@chao5.net] has quit [Remote host closed the connection]
04:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
04:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:26 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
04:26 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
04:26 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:27 <@vpnHelper> RSS Update - forum: DHCP lease renewal in bridged VPN <http://forums.openvpn.net/topic9282.html#p18059>
04:32 -!- beerbro [~gustav@apollon.ais-salzburg.at] has quit [Ping timeout: 244 seconds]
04:52 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
04:52 -!- gustav- [~gustav@apollon.ais-salzburg.at] has joined #openvpn
04:55 -!- gustav- is now known as beerbro
04:57 <@vpnHelper> RSS Update - forum: PAM Athentication using a script based on PHP or Html, help! <http://forums.openvpn.net/topic9301.html>
05:01 <@dazo> !as
05:01 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
05:01 -!- batouzo [~batouzo@ip-1-141.gemini.net.pl] has joined #openvpn
05:03 <@vpnHelper> RSS Update - forum: PAM Athentication using a script based on PHP or Html, help! <http://forums.openvpn.net/topic9301.html#p18061>
05:09 <@vpnHelper> RSS Update - forum: StoneVPN <http://forums.openvpn.net/topic7203-15.html#p18062>
05:12 -!- SOG [~SOG@113.108.118.60] has quit [Quit: I will be back!]
05:25 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
05:25 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
05:28 < batouzo> hmm got a basic question
05:29 < batouzo> so I have laptop now in Hotel and a Server in hostin1 and later in hosting2 etc
05:29 < batouzo> with OpenVPN I will be able, on laptop, to always do  ssh 10.50.1.2 and it will always connect me into th server no matter where it is now located, right?
05:29 <+EugeneKay> If that's how you build your network, sure.
05:30 < batouzo> will such connection, on transport level, be send directly to the server (perhaps using some central server for randevouz and updating each client transport IP),  or will entire traffic between all computers in such VPN must go through one centrall VPN server/router thing?  
05:31 < batouzo> because I would prefer best to have more p2p style connections if possible,  and using central server just for randevouz and authentication e.g. central list of certificates
05:31 <+EugeneKay> OpenVPN is point-to-point. It'd go via whatever server oyu have set as the vpn server.
05:31 <+EugeneKay> And then via whatever routes you have set
05:32 < batouzo> so how it will look for say a hackerspace with 10 users-laptops sometimes sitting in LAN in office, sometimes being at home or at hotel,   that want to SSH into each other?
05:32 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
05:32 < batouzo> we should set-up one central VPN server, with constant public IP, and every of 10 clients will connect into it to use VPN? 
05:32 <+EugeneKay> The "best" way would be to set up static VPN IPs for each client(on the vpn network), and then give dns names to those IPs. 
05:33 <+EugeneKay> s/best/easiest
05:33 <+EugeneKay> Then you can just ssh to a dns name via the vpn server
05:33 < batouzo> so lets take user A and user B that roam 
05:33 < batouzo> I will, in VPN, given them IP 10.50.1.1 and 10.50.1.2
05:33 <+EugeneKay> The "best" way would involve a dynamic DNS updating script, and you only turn on the VPN client when you're someplace that needs the VPN(eg, when you're not in a branch office)
05:34 < batouzo> and DNS names userA.vpn and userB.vpn
05:34 <+EugeneKay> Mmmhmmm
05:35 < batouzo> you can use VPN always, to have strong authentication that given IP is actually the computer you think it is. Even in LAN. Otherwise say wifi can be hijacked/spoofed
05:35 < batouzo> (and encryption, even in LAN, for same reason)
05:35 <+EugeneKay> !shotgun
05:35 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
05:35 <+EugeneKay> If you can't trust your LAN, who can you trust? ;-)
05:35 < batouzo> yeap that is layer 1
05:35 < batouzo> vpn is layer 2
05:35 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
05:35 < batouzo> if I run out of shells 
05:36 < batouzo> EugeneKay: the vpn gateway sitting in safe, that who
05:36 < batouzo> :)
05:36 <+EugeneKay> My house is out in the woods. I don't even bother with a WEP password on my wifi.
05:37 <+EugeneKay> Nearest neighbors are 1/4 mile away, through heavy trees. Attenuates 2.4Ghz rather well.
05:37 < batouzo> yeap
05:37 < batouzo> so the 2 users
05:37 < batouzo> and user A want to SSH into userB  who is now in some hotel and does not even have a public IP there (nat)
05:38 <+EugeneKay> Their traffic would have to go over the vpn link, via the server.
05:38 <+EugeneKay> You'll have quite a big of lag
05:38 < batouzo> so user A connects to VPN-GW (gateway),  so does user B,  and then user A can SSH into B, right?
05:39 < batouzo> and then packets travel: A --> GW --> B
05:39 <+EugeneKay> Sure, if your firewall rules allow it.
05:39 <+EugeneKay> Yup.
05:39 < batouzo> if user B would have an accesible public IP 
05:39 < batouzo> can we do it such that, user A just connects to GW to confirm that VPN 10.50.1.2 (userB.vpn domani) uses key/cert 0x12345678
05:40 < batouzo> and then connect directly A-->B (on IPv4 level)
05:40 <+EugeneKay> Not without a lot of scripting and headache.
05:40 < batouzo> bypassing the VPN-GW for speed, but still having the same security
05:40 < batouzo> oh :(  because that would be super cool, wouldn't it?
05:40 <+EugeneKay> It'd be nice, but full-mesh is a long ways away.
05:41 <+EugeneKay> If we're talking cross-country distances, you can play tricks with multiple VPN servers and routing daemons.
05:41 < batouzo> with current design, can I have two identical GWs for failsafe
05:41 < batouzo> e.g. they would synchronize list of allowed clients/certs, and if one is down the other one will be used by everyone automatically
05:41 <+EugeneKay> Yup. See the <connection> syntax.
05:41 <+EugeneKay> You can do explicit try-fail ordering, or random.
05:42 < batouzo> woot
05:42 <+EugeneKay> You can also use that to try different port:proto combos in order of preference
05:42 < batouzo> what is the best tutorial, to set up on linux clients and gateway the A-->GW-->B scenario
05:42 <+EugeneKay> !howto
05:42 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:42 <+EugeneKay> Once you get that, start adding stuff until it breaks
05:42 <+EugeneKay> Msot of the howto is easy-rsa. If you have a PKI already, it's a breeze.
05:43 < batouzo> what with DNS names
05:43 < batouzo> userA.vpn  userB.vpn
05:43 <+EugeneKay> That's up to you to figure out. OpenVPN supports pushing dns servers to windows clients(and nix ones with a helper script).
05:43 < batouzo> currently, just-in-LAN, I enter this in /etc/hosts on the internet gateway which every computer uses as DNS server
05:43 < batouzo> how to do it in above scenario
05:43 <+EugeneKay> I recommend using a clientA.vpn.yourdomain.com, with the RFC1918 IPs left out in the open.
05:43 < batouzo> just make every computer use say 10.50.99.99 as DNS servere, and the DNS server would be one of the VPN clients, ro soemthing speciall?
05:44 < batouzo> its too.much.to.type.com
05:44 <+EugeneKay> If you want hostname.vpn stuff, the easy way is to push a DNS server option of the server's VPN ip.
05:44 <+EugeneKay> But the fact that it's not publically resolvable can cause issues down the line.
05:44 <+EugeneKay> Pick a short domain name ;-)
05:45 < batouzo> what is the technical name for "VPN gateway"?
05:45 <+EugeneKay> Server? 
05:45 <+EugeneKay> It's only a gateway if you're using redirect-gateway ;-)
05:46 < batouzo> hmm
05:47  * EugeneKay crawls under his rock and Zzzzzzzs
05:47 < batouzo> we had 3 computers in above example
05:47 < batouzo> user A, user B, and the gatway to which both connect?
05:54 -!- Usafcjf is now known as FeileX
05:54 <+hyper_ch> hi EugeneKay
06:00 < batouzo> ok can anyway tell me if above is correct? we need 3 computers right?
06:00 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
06:09 -!- sno- is now known as sno_
06:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
06:10 -!- sno_ is now known as sno___
06:12 -!- sno___ is now known as mrsno_
06:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:22 -!- _julian_ [~quassel@hmbg-5f77c763.pool.mediaWays.net] has joined #openvpn
06:22 -!- satonio [~satonio@125.Red-80-38-106.staticIP.rima-tde.net] has joined #openvpn
06:23 < satonio> hi, i'm getting "Destination Port Unreachable" when i try to ping a node different from the server, how can i fix it?
06:23 < satonio> i mean node-node, communications with the server work as expected
06:23 -!- _julian [~quassel@hmbg-4d06ac8a.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
06:23 < satonio> node-server server-node
06:23 < satonio> but not node-node
06:24 < satonio> ie from 10.8.1.2 ping 10.8.1.3 fails
06:24 < satonio> but from 10.8.1.1 works, and from 10.8.1.2 to 10.8.1.1 works too
06:25 < satonio> any idea about how to fix it?
06:26 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:37 -!- _julian_ [~quassel@hmbg-5f77c763.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
06:39 -!- _julian [~quassel@hmbg-4d068533.pool.mediaWays.net] has joined #openvpn
06:43 -!- countd [~countd@unaffiliated/countd] has joined #openvpn
06:43 -!- countd [~countd@unaffiliated/countd] has quit [Remote host closed the connection]
06:44 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 244 seconds]
07:08 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18063>
07:15 -!- ph1l1 [~ph1l@17-234.197-178.cust.bluewin.ch] has joined #openvpn
07:16 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 244 seconds]
07:17 -!- kyrix [~ashley@mk046207255200.a1.net] has joined #openvpn
07:20 -!- dazo is now known as dazo_afk
07:20 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
07:24 -!- ph1l1 [~ph1l@17-234.197-178.cust.bluewin.ch] has quit [Ping timeout: 260 seconds]
07:27 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
07:27 -!- dazo_afk is now known as dazo
07:35 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:46 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
07:57 -!- ginooe [~Adium@136-mi3-3.acn.waw.pl] has quit [Quit: Leaving.]
07:57 -!- ravemaster [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has joined #openvpn
08:00 -!- ravemaster [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has quit [Client Quit]
08:01 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:08 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18064>
08:11 -!- dupondje [~dupondje@artemis.dupie.be] has left #openvpn []
08:19 -!- tjz [~pc@bb119-74-162-234.singnet.com.sg] has joined #openvpn
08:19 -!- tjz [~pc@bb119-74-162-234.singnet.com.sg] has quit [Changing host]
08:19 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
08:24 -!- ginooe [~Adium@178.181.242.35.nat.umts.dynamic.t-mobile.pl] has joined #openvpn
08:25 -!- ginooe [~Adium@178.181.242.35.nat.umts.dynamic.t-mobile.pl] has quit [Client Quit]
08:28 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Quit: Leaving.]
08:30 -!- ginooe [~Adium@178.181.242.35.nat.umts.dynamic.t-mobile.pl] has joined #openvpn
08:32 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
08:32 -!- ginooe [~Adium@178.181.242.35.nat.umts.dynamic.t-mobile.pl] has quit [Client Quit]
08:37 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:51 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:52 -!- _julian_ [~quassel@hmbg-5f77e0e7.pool.mediaWays.net] has joined #openvpn
08:54 -!- _julian [~quassel@hmbg-4d068533.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
09:01 -!- ja-s [~chruck@204.28.100.132] has joined #openvpn
09:04 -!- chruck [~chruck@204.28.100.132] has quit [Ping timeout: 252 seconds]
09:04 -!- ja-s is now known as chruck
09:09 -!- ginooe [~Adium@6-pra-5.acn.waw.pl] has joined #openvpn
09:22 -!- ginooe [~Adium@6-pra-5.acn.waw.pl] has quit [Read error: Connection reset by peer]
09:23 -!- ginooe [~Adium@6-pra-5.acn.waw.pl] has joined #openvpn
09:27 -!- ginooe [~Adium@6-pra-5.acn.waw.pl] has quit [Read error: Connection reset by peer]
09:27 -!- ginooe [~Adium@6-pra-5.acn.waw.pl] has joined #openvpn
09:29 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
09:41 -!- Bruk0ut [~Bruk0ut@unaffiliated/brukout] has joined #openvpn
09:51 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270-15.html#p18065>
09:58 -!- pierreg [~sh@lasso.shrug.volia.net] has joined #openvpn
09:58 < pierreg> Hey
09:58 < pierreg> Is this the correct channel with pptp issues?
10:01 < pierreg> Probably not, talk to you later
10:01 <@vpnHelper> RSS Update - forum: Destination Port Unreachable node-to-node <http://forums.openvpn.net/topic9306.html>
10:01 -!- pierreg [~sh@lasso.shrug.volia.net] has left #openvpn ["Leaving"]
10:07 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18067>
10:11 -!- ginooe [~Adium@6-pra-5.acn.waw.pl] has quit [Quit: Leaving.]
10:18 -!- ginooe [~Adium@6-pra-5.acn.waw.pl] has joined #openvpn
10:45 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:01 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
11:21 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
11:25 -!- dazo is now known as dazo_afk
11:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
11:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:37 <@vpnHelper> RSS Update - forum: Check my log <http://forums.openvpn.net/topic9302.html#p18068>
11:47 -!- vpopov [~happylife@149.62.3.49] has joined #openvpn
11:52 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:02 -!- Varazir [mircwars@c-94-255-163-169.cust.bredband2.com] has quit [Quit: bbl I hope]
12:14 -!- probonono [~User@unaffiliated/probonono] has quit [Read error: Connection reset by peer]
12:15 -!- probonono [~User@ppp103-111.static.internode.on.net] has joined #openvpn
12:15 -!- probonono [~User@ppp103-111.static.internode.on.net] has quit [Changing host]
12:15 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
12:19 <@vpnHelper> RSS Update - forum: How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270-15.html#p18069>
12:26 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18072> || How to reach computers in the openvpn server network? <http://forums.openvpn.net/topic9270-15.html#p18071> || Destination Port Unreachable node-to-node <http://forums.openvpn.net/topic9306.html#p18070>
12:26 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:28 -!- satonio [~satonio@125.Red-80-38-106.staticIP.rima-tde.net] has quit [Quit: Saliendo]
12:30 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:30 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:30 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:44 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18073>
13:04 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
13:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:20 <@vpnHelper> RSS Update - forum: Site to Site VPN with overlapping IP addresses <http://forums.openvpn.net/topic8362.html#p18074>
13:27 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
13:28 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
13:29 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
13:29 -!- mirco_ is now known as mirco
13:37 <+hyper_ch> http://techcrunch.com/2011/11/30/quadcopter-art-project-the-robots-are-building-forts  the robots are taking over
13:37 <@vpnHelper> Title: Quadcopter Art Project: The Robots Are Building Forts | TechCrunch (at techcrunch.com)
13:49 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
13:50 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
13:50 -!- `Ile` [~kvirc@93-87-225-150.dynamic.isp.telekom.rs] has joined #openvpn
13:50 -!- `Ile` [~kvirc@93-87-225-150.dynamic.isp.telekom.rs] has quit [Client Quit]
13:51 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 244 seconds]
13:51 -!- mirco_ is now known as mirco
14:08 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18075>
14:14 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p18076>
14:22 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 244 seconds]
14:46 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit []
14:48 -!- guntha [~guntha_@pool-74-102-8-168.nwrknj.fios.verizon.net] has quit [Quit: Leaving]
14:52 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 245 seconds]
14:54 -!- kyrix [~ashley@mk046207255200.a1.net] has quit [Ping timeout: 260 seconds]
15:03 -!- batouzo [~batouzo@ip-1-141.gemini.net.pl] has quit [Quit: Leaving]
15:06 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
15:09 -!- [AFK|Sleep] is now known as [AFK]
15:10 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:16 -!- vpopov [~happylife@149.62.3.49] has quit [Ping timeout: 260 seconds]
15:20 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
15:20 <@vpnHelper> RSS Update - forum: Bridged Access Server and Client <http://forums.openvpn.net/topic9267.html#p18077>
15:21 -!- newl [~newl@97.75.165.156] has joined #openvpn
15:23 -!- Denial [Denial@drgi.co.uk] has quit [Ping timeout: 244 seconds]
15:23 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
15:24 < sled-dog> how free is the community edition? am I restricted to 2 licences per server?
15:25 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
15:33 -!- Test123 [4f8256c5@gateway/web/freenode/ip.79.130.86.197] has joined #openvpn
15:34 < Test123> hello everybody...
15:34 < Test123> is it possible to establish a vpn connection between a router and open vpn server running on windows 7 x64?
15:42 < Essobi> i give up... Is it?
15:43 < Test123> yes really is it?
15:43 < krzie> sled-dog, community edition is 100% free
15:43 < krzie> (as in beer)
15:43 < krzie> it's access-server that costs $
15:44 < Test123> krzie was that for me?
15:46 < Essobi> ... he said sled-dog.
15:47  * Essobi points at sled-dog 
15:49 < Test123> ok sorry
15:51 < Essobi> Test123: Yes you can.  depends on the router thou...
15:51 < Test123> ok let me be a little more spicific, router is draytek vigor 2920, vpn will be pptp with pap/chap login and no compression
15:51 < Essobi> Think some of the DD-WRT and other variants have openvpn support.
15:52 < Essobi> Never touched a draytek.
15:52 < Test123> is there a tutorial to accomplish what i want?
15:53 < Test123> on the other hand i have never touched openvpn
15:54 < sled-dog> so what's access-server? the non-free edition?
15:57 -!- ginooe [~Adium@6-pra-5.acn.waw.pl] has quit [Quit: Leaving.]
15:57 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 252 seconds]
16:01 < Test123> guys could anyone please help me?
16:06 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
16:15 < krzie> right
16:15 < krzie> ^@ sled-dog 
16:19 < sled-dog> thanks
16:45 -!- Al_nz1 [~bigal.nz@118-93-15-230.dsl.dyn.ihug.co.nz] has joined #openvpn
16:45 < Al_nz1> Could anyone please help with a openvpn problem. the log shows some sort of key exchange failure: http://pastebin.com/eyuCmi4G
16:49 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
16:49 < krzie> looks like a problem with your certs a1
16:49 < Al_nz1> krzie: ok, any idea what?
16:49 < krzie> !certverify
16:49 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
16:52 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 258 seconds]
16:55 -!- SpiderFred [~SpiderFre@135.119.broadband14.iol.cz] has joined #openvpn
17:00 < Al_nz1> krzie: i think it was a time issue
17:00 < Al_nz1> fixed now :-)
17:02 < krzie> ahh right
17:07 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 240 seconds]
17:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
17:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:11 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
17:16 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:26 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
17:26 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
17:36 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
17:40 -!- madsage [~sage@io.ioio.com] has joined #openvpn
17:40 < madsage> hey whats up krazee
17:44 < SpiderFred> !welcome
17:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:45 < SpiderFred> !configs
17:45 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
17:47 < SpiderFred> hi sorry to bother bother but I am not able to find out how to use vpn as proxy, I can connect with --config file.conf but whan next? Am I suppose to bind it to some port on localhost or something?
17:54 -!- Al_nz1 [~bigal.nz@118-93-15-230.dsl.dyn.ihug.co.nz] has quit [Read error: Connection reset by peer]
17:55 <+EugeneKay> !redirect
17:55 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
18:11 -!- SpiderFred [~SpiderFre@135.119.broadband14.iol.cz] has quit [Quit: Lost terminal]
18:19 -!- novaflash is now known as novaflash_away
18:44 -!- Denial [Denial@drgi.co.uk] has quit []
18:46 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
18:58 -!- newl [~newl@97.75.165.156] has left #openvpn []
19:00 -!- ravemaster [~androirc@119.93.51.34] has joined #openvpn
19:02 < ravemaster> can i ask help how to openvpn over ssh instruction to setup
19:06 -!- _julian [~quassel@hmbg-4d06f838.pool.mediaWays.net] has joined #openvpn
19:07 < krzie> i guess, but its a bad bad bad idea
19:07 < krzie> !tcp
19:07 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
19:07 < krzie> assuming your traffic you are tunneling is tcp, you will have tcp over tcp over tcp
19:07 < krzie> which will meltdown
19:07 -!- _julian_ [~quassel@hmbg-5f77e0e7.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
19:07 < krzie> if you want to use ssh tunneling, use it, and dont use openvpn
19:07 < krzie> if you wanna use openvpn, use it, but dont use ssh tunneling
19:08 -!- ravemaster [~androirc@119.93.51.34] has quit [Read error: Connection reset by peer]
19:08 < krzie> with that said, i dont care what you do, so if you want to do what you asked about, do the normal ssh tunneling stuff, then use one of the options starting with --sock in the manual
19:08 < krzie> just search for --sock
19:16 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:02 <@vpnHelper> RSS Update - forum: Install config issues <http://forums.openvpn.net/topic9307.html>
20:20 -!- master_of_master [~master_of@p57B543D5.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
20:21 -!- master_of_master [~master_of@p57B544AF.dip.t-dialin.net] has joined #openvpn
20:51 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
20:55 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:55 -!- mode/#openvpn [+v Axeman] by ChanServ
20:57 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
21:07 -!- TheCops [~mdb@2001:470:1d:5b3:20c:29ff:fee7:997e] has joined #openvpn
21:09 -!- TheCops [~mdb@2001:470:1d:5b3:20c:29ff:fee7:997e] has left #openvpn []
21:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
21:11 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:19 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
21:19 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
21:19 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:19 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:19 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
21:25 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 248 seconds]
21:32 <@vpnHelper> RSS Update - forum: OpenVPN Server configured with 255.255.255.0 but XP no like? <http://forums.openvpn.net/topic9305.html#p18079>
21:38 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
21:42 -!- Axeman [~Axeman3@knox.pace.edu] has joined #openvpn
21:42 -!- Axeman [~Axeman3@knox.pace.edu] has quit [Changing host]
21:42 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:42 -!- mode/#openvpn [+v Axeman] by ChanServ
21:45 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:47 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
22:09 <@vpnHelper> RSS Update - forum: PAM Athentication using a script based on PHP or Html, help! <http://forums.openvpn.net/topic9301.html#p18080>
22:11 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
22:24 -!- hilarie [~hillz@iptv-static-219-135.kpunet.net] has joined #openvpn
22:25 < hilarie> Hello... setting up openvpn on a remote server, and its telling me this alot... "string is too long, it needs to be less than  2 bytes long" is it just doing its thing?
22:26 < hilarie> Oh, and its on the ./pkitool --initca phase from https://help.ubuntu.com/10.10/serverguide/C/openvpn.html
22:26 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
22:28 < hilarie> when I say alot, I mean it seems to be a loop
22:28 < hilarie> !welcome
22:28 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:29 < hilarie> !howto
22:29 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:32 < hilarie> export KEY_COUNTRY="US" #May only be 2 characters
22:32 < hilarie> Went ahead and fixed that one for you
22:36 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
22:36 -!- UnterPerro_ [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:36 -!- UnterPerro_ is now known as UnterPerro
22:38 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
23:34 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
23:34 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
23:34 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
--- Day changed Thu Dec 01 2011
00:21 -!- dazo_afk is now known as dazo
00:34 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:00 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 244 seconds]
01:10 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
01:30 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:43 <@vpnHelper> RSS Update - forum: Check my log <http://forums.openvpn.net/topic9302.html#p18081>
01:49 <@vpnHelper> RSS Update - forum: Push DNS to a linux client. <http://forums.openvpn.net/topic7109.html#p18082>
01:51 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
02:08 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:11 -!- ginooe [~Adium@136-mi3-3.acn.waw.pl] has joined #openvpn
02:37 <@vpnHelper> RSS Update - forum: Bridged Access Server and Client <http://forums.openvpn.net/topic9267.html#p18083>
02:43 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p18084>
02:47 -!- jungfranckianer1 [~sallner@elcoco.ethz.ch] has joined #openvpn
03:07 -!- kyrix [~ashley@mk046207255007.a1.net] has joined #openvpn
03:16 -!- ginooe [~Adium@136-mi3-3.acn.waw.pl] has left #openvpn []
03:22 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
03:44 -!- kyrix [~ashley@mk046207255007.a1.net] has quit [Quit: Ex-Chat]
03:44 -!- kyrix [~ashley@mk046207255007.a1.net] has joined #openvpn
03:54 -!- Diffen [~diffen@80.252.168.82] has joined #openvpn
03:55 -!- novaflash_away is now known as novaflash
03:56 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
04:00 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
04:03 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:27 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:37 -!- Wildy [~lion@212.119.246.18] has joined #openvpn
04:37 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:37 -!- mode/#openvpn [+o mattock] by ChanServ
04:41 -!- Diffen [~diffen@80.252.168.82] has quit [Quit: This computer has gone to sleep]
04:51 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 248 seconds]
04:56 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
05:00 -!- MarteleiroRoboc [~Marteleir@MAIL.VOLPITI.com.br] has joined #openvpn
05:01 < MarteleiroRoboc> Hi guys, "no free --ifconfig-pool addresses are available", max clients sets to 200, How i can clean de leases by openvpn?
05:02 < MarteleiroRoboc> or it is another problem? :(
05:12 -!- dazo is now known as dazo_afk
05:13 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
05:18 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 255 seconds]
05:26 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
05:26 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
05:32 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
05:32 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
05:35 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
05:35 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
05:35 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
05:37 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:45 -!- JunkyMonkey [a14c5c4e@gateway/web/freenode/ip.161.76.92.78] has joined #openvpn
05:53 <@vpnHelper> RSS Update - forum: Check my log <http://forums.openvpn.net/topic9302.html#p18085>
06:05 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 244 seconds]
06:07 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:12 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 245 seconds]
06:23 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
06:33 < Test123> hi all, is it possible to establish a vpn connection between a router and open vpn server?
06:35 -!- JunkyMonkey [a14c5c4e@gateway/web/freenode/ip.161.76.92.78] has quit [Quit: Page closed]
06:37 < krzee> MarteleiroRoboc, that would require some ESP... can you pastebin your configs like this:
06:37 < krzee> !configs
06:37 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
06:46 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:46 -!- mirco [~mirco@p508072CC.dip.t-dialin.net] has joined #openvpn
07:00 <@vpnHelper> RSS Update - forum: Auto Mount Network Share Ubuntu <http://forums.openvpn.net/topic9308.html>
07:01 -!- mirco [~mirco@p508072CC.dip.t-dialin.net] has quit [Quit: mirco]
07:18 -!- dazo_afk is now known as dazo
07:23 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
07:26 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:30 <@vpnHelper> RSS Update - forum: Auto Mount Network Share Ubuntu <http://forums.openvpn.net/topic9308.html#p18087>
07:36 <@vpnHelper> RSS Update - forum: Destination Port Unreachable node-to-node <http://forums.openvpn.net/topic9306.html#p18088>
07:39 -!- _julian_ [~quassel@hmbg-5f76346a.pool.mediaWays.net] has joined #openvpn
07:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
07:41 -!- _julian [~quassel@hmbg-4d06f838.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
07:41 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
07:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:49 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:53 -!- hilarie [~hillz@iptv-static-219-135.kpunet.net] has quit [Ping timeout: 252 seconds]
08:00 <@vpnHelper> RSS Update - forum: Cannot access VPN server from server LAN <http://forums.openvpn.net/topic9309.html>
08:05 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has joined #openvpn
08:06 <@vpnHelper> RSS Update - forum: Auto Mount Network Share Ubuntu <http://forums.openvpn.net/topic9308.html#p18091> || Cannot access VPN server from server LAN <http://forums.openvpn.net/topic9309.html#p18090>
08:07 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:09 -!- tjz [~pc@bb119-74-162-234.singnet.com.sg] has joined #openvpn
08:09 -!- tjz [~pc@bb119-74-162-234.singnet.com.sg] has quit [Changing host]
08:09 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
08:18 <@vpnHelper> RSS Update - forum: Auto Mount Network Share Ubuntu <http://forums.openvpn.net/topic9308.html#p18092>
08:19 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
08:19 -!- mode/#openvpn [+o mattock] by ChanServ
08:20 -!- ZoB [Dan@DanIRC.net] has joined #openvpn
08:22 -!- gremly [~gremly@200.106.218.64] has quit [Ping timeout: 245 seconds]
08:29 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
08:31 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
08:35 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:36 <@vpnHelper> RSS Update - forum: Auto Mount Network Share Ubuntu <http://forums.openvpn.net/topic9308.html#p18094>
08:39 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
08:43 -!- Wildy [~lion@212.119.246.18] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
08:46 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
08:48 <@vpnHelper> RSS Update - forum: VOIP over OpenVPN <http://forums.openvpn.net/topic9310.html>
08:56 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
08:56 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
08:58 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
09:11 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Remote host closed the connection]
09:19 -!- MarKsaitis_ [~MarKsaiti@195.59.185.18] has joined #openvpn
09:22 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 244 seconds]
09:41 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Ping timeout: 258 seconds]
09:42 -!- mm_freak [~milch@62.141.42.39] has joined #openvpn
09:42 < mm_freak> hello there
09:43 < mm_freak> my VPN is established as a UDP/tun channel through an interface called wlan0 on the client side…  whenever that interface goes down, openvpn starts to eat 100% CPU time and fails to reestablish the connection
09:43 < mm_freak> is this a known problem?
09:45 < ecrist> how many users?
09:46 < ecrist> on slow hardware, or with lots of users, it's a known problem. ;)
09:51 -!- MarKsaitis__ [~MarKsaiti@195.59.185.18] has joined #openvpn
09:52 <@vpnHelper> RSS Update - forum: Bridged Access Server and Client <http://forums.openvpn.net/topic9267.html#p18096>
09:53 -!- MarKsaitis_ [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 244 seconds]
09:58 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
10:02 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
10:05 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
10:05 -!- jungfranckianer1 [~sallner@elcoco.ethz.ch] has quit [Quit: Leaving.]
10:06 -!- kyrix [~ashley@mk046207255007.a1.net] has quit [Quit: Ex-Chat]
10:08 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
10:08 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
10:08 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
10:10 -!- Axeman [~Axeman3@198.105.46.22] has joined #openvpn
10:10 -!- Axeman [~Axeman3@198.105.46.22] has quit [Changing host]
10:10 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:10 -!- mode/#openvpn [+v Axeman] by ChanServ
10:14 < mm_freak> ecrist: recent hardware, one user
10:14 < ecrist> recent tells me nothing
10:14 < ecrist> for all I know you're running it on an android phone
10:14 < mm_freak> it only happens when the WLAN connection goes down
10:15 < mm_freak> no, it's a linux laptop, x86_64, 1.8 GHz
10:15 < mm_freak> hardware speed cannot be the problem
10:16 < mm_freak> when the WLAN connection goes down and reestablishes itself, openvpn just takes 100% CPU and fails to reestablish the connection
10:16 < mm_freak> after restarting openvpn it works again
10:17 <+hyper_ch> dear krzee, are you there?
10:18 < mm_freak> http://hpaste.org/54757 ⇐ this is my configuration
10:19 < ecrist> !!
10:19 < ecrist>    
10:19 < ecrist> !logs
10:19 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
10:19 <+hyper_ch> !welcome
10:19 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:20 < mm_freak> alright…  i hope the network goes down again soon =)
10:20 < mm_freak> anyway, i hoped it's a known problem
10:21 < krzee> hyper_ch, YES
10:21 < krzee> oops c/l
10:22 < ecrist> mm_freak: it's not a known problem.
10:22 <+hyper_ch> krzee: how do you calculate network sizes? I mean what's a /4 /8 /16... and is it the same for ipv4 and ipv6?
10:22 < krzee> hyper_ch, 
10:22 < krzee> !google cidr cheatsheet
10:22 <@vpnHelper> CIDR SUBNET MASK CHEATSHEET & ICMP TYPE CODES: <http://oav.net/mirrors/cidr.html>; CIDR Prefix # of former class C nets: <http://morse.colorado.edu/~epperson/courses/routing-protocols/cidr-cs.html>; CIDR Cheatsheet - Internet Security Guru: <http://www.internetsecurityguru.com/cidr.html>
10:23 < krzee> google moar
10:23 <+hyper_ch> krzee: :) thx
10:23 < krzee> yw
10:23 < krzee> !cidr
10:23 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
10:23 < krzee> haha i thought i did that
10:23 <+hyper_ch> so, if I owned an /1 ip space, I would be pretty awesoem, right?
10:24 < krzee> you would own half the possible ips, aka not possible
10:24 < krzee> !def1
10:24 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
10:27 <+hyper_ch> krzee: how does that convert to ipv6?
10:29 -!- MarKsaitis__ [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 260 seconds]
10:30 < krzee> your real question is how my google search converts to ipv6
10:31 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
10:31 <+hyper_ch> krzee: can you be rented?
10:32 < krzee> i can, but i dont actually use ipv6
10:32  * ecrist does
10:32 < ecrist> and I can be rented
10:32 <+hyper_ch> :)
10:32 < ecrist> most can't afford me, though.
10:32 < ecrist> :D
10:32 <+hyper_ch> ecrist: I didn't know you're a female :)
10:32 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Read error: Connection reset by peer]
10:33 < ecrist> I'm not.
10:33 < krzee> unless you're a sexy female, then you can afford ecrist 
10:33 <+hyper_ch> :)
10:34 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Client Quit]
10:34 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
10:34 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
10:39 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html>
10:39 -!- reisi [koivunej@mustatilhi.cs.tut.fi] has quit [Ping timeout: 248 seconds]
10:52 -!- reisi [~koivunej@mustatilhi.cs.tut.fi] has joined #openvpn
11:12 -!- reisi [~koivunej@mustatilhi.cs.tut.fi] has quit [Read error: Connection reset by peer]
11:15 -!- frankcui24 [~frankcui2@blk-11-125-86.eastlink.ca] has quit [Quit: Leaving]
11:18 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
11:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:39 <@vpnHelper> RSS Update - forum: Prevention of revealing IP should a server go down <http://forums.openvpn.net/topic9312.html>
11:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:47 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
11:47 -!- mode/#openvpn [+v Axeman2] by ChanServ
11:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
11:57 -!- probonono [~User@unaffiliated/probonono] has quit [Read error: Connection reset by peer]
11:58 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
12:11 -!- mm_freak [~milch@62.141.42.39] has left #openvpn []
12:15 -!- dazo is now known as dazo_afk
12:24 -!- jay_ [~jay@212.96.10.253] has joined #openvpn
12:35 <@vpnHelper> RSS Update - forum: How To Control DHCP Lease In OpenVPN <http://forums.openvpn.net/topic9273.html#p18099>
12:49 < jay_> anyone know any free vpns ?
12:50 < krzee> nope
12:52 < jay_> krzee, what are you using ?
12:52 < krzee> my own servers
12:52 < ecrist> ditto
12:53 < ecrist> aw, where'd my @ go?
12:53 < krzee> vpnHelper has it, just tell him you want it ;]
12:53 <@vpnHelper> Error: Spurious "]".  You may want to quote your arguments with double quotes in order to prevent extra brackets from being evaluated as nested commands.
12:53 < krzee> lol
12:53 < krzee> vpnHelper, shuttup
12:56 <+hyper_ch> krzee: when arguing with a bot you can only lose :)
12:57 < krzee> not if you run the bot
13:05 < ecrist> and have root on the box the bot runs on
13:05 < ecrist> ;)
13:07 < krzee> yepyep!
13:07 < krzee> he's always a kill -9 away from losing the argument
13:07 < ecrist> Ctl-C
13:07 < ecrist> he's in a screen, remember?
13:09 < krzee> yep, but kill -9 would certainly still work
13:19 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
13:29 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:29 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:29 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:32 < jeev> fark man, wtf
13:32 < jeev> Options error: option 'route' cannot be used in this context
13:32 < jeev> the VPN was just working, i copied the folder to turn it into a server, ran it on a different instance/port and now this is broken
13:33 < jeev> rebooting the vpn server i guess cause i can, will clear my mind
13:39 < jeev> oh, cause i have nopull i think for route
13:47 -!- MarteleiroRoboc [~Marteleir@MAIL.VOLPITI.com.br] has quit []
14:16 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
14:16 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:28 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
14:30 -!- krzee [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
14:33 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
14:37 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
14:45 -!- [AFK] is now known as [AFK|OO]
14:45 -!- [AFK|OO] is now known as [AFK|OOO]
14:46 <+hyper_ch> krzee: ecrist: dazo_afk: EugeneKay: https://www.schneier.com/blog/archives/2011/12/full-disk_encry.html
14:46 <@vpnHelper> Title: Schneier on Security: Full-Disk Encryption Works (at www.schneier.com)
14:50 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
14:56 -!- krzee [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
15:03 -!- poster_ [~poster@cpe-107-10-147-179.columbus.res.rr.com] has joined #openvpn
15:03 -!- poster_ [~poster@cpe-107-10-147-179.columbus.res.rr.com] has quit [Client Quit]
15:06 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
15:13 -!- Essobi [~Essobi@74-128-72-207.dhcp.insightbb.com] has quit [Read error: Connection reset by peer]
15:18 -!- Essobi [~Essobi@74-128-72-207.dhcp.insightbb.com] has joined #openvpn
15:23 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
15:26 < Test123> guys does the connection between a hardware router and a software vpn server has a special terminology?
15:38 <+EugeneKay> Nope.;
15:43 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 8.0.1/20111120135848]]
15:45 -!- Furao [~Furao@pc-201-238-30-200.cm.vtr.net] has joined #openvpn
15:47 < Test123> i don't want to bug you all with what i want to do (have mentioned it many times) but could please somebody tell me if it is possible to connect a router to the openvpn server? and if yes where to look as i am not familiar with openvpn...
15:48 < Furao> if the router support openvpn yes
15:48 < Test123> you mean it is something that will be included in the router features?
15:49 < Furao> which router?
15:49 < Test123> draytek 2710 or 2820 or 2920
15:49 < Test123> draytek vigor to be exact
15:50 < Furao> maybe they use openvpn for their vpn ssl
15:51 < Furao> ask them :)
15:51 -!- novaflash is now known as novaflash_away
15:52 < Test123> so in order to do that i must get openvpn compatible routers...
15:52 < Furao> build your own
15:52 < Test123> ???
15:52 < Test123> is that possible?
15:52 < Furao> yes
15:52 < Test123> with the draytek ones too?
15:52 < Furao> what do you think this draytek router is built on top of what?
15:53 < Furao> I mean, get some embeded computer with few network interfaces
15:53 < Furao> install linux or some bsd
15:53 < Test123> i don't think i can tell...
15:53 < Furao> Someone ever seen something like this? http://pastebin.com/ZT5ZZXF7 when some monitoring application try to put the tun (or eth)  interface as promisc openvpn can't receive any packet it timeout and it connect itself back to the other end
15:54 < Furao> I have this setup running in 300 locations all the same hardware and software but this specific one fail each time
15:56 < Furao> Test123: it's probably linux, iptables, quagga, vrrpd, openvpn + custom web interface
15:56 < Test123> i see in their app notes that they have a guide on how to accomplish that with 2000 server. is that any similar?
15:57 < Test123> http://www.draytek.com/user/SupportAppnotesDetail.php?ID=160
15:57 <@vpnHelper> Title: DrayTek Corp - Headquarters of DrayTek Vigor IP telephony, VPN, Firewall, Security (at www.draytek.com)
15:57 < Furao> PPTP is an other protocol
15:58 < Furao> incompatible with openvpn
15:58 < Test123> wow, to be honest i tought that open vpn was a platform that could support pptp, ipsec and l2tp, did not know that vpn is one of them...
15:59 < Furao> so you did not read at all
15:59 < Furao> not even wikipedia
15:59 < Furao> http://en.wikipedia.org/wiki/Openvpn
15:59 <@vpnHelper> Title: OpenVPN - Wikipedia, the free encyclopedia (at en.wikipedia.org)
16:01 < Test123> i see...
16:04 < Test123> so i suppose what i think of doing cannot be done with the draytek routers... it has to be one with openvpn protocol implemented
16:09 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 245 seconds]
16:22 < Furao> a router do not always have to be an appliance or embeded computer
16:28 < Test123> it is the application that i have that requires a router on one side...
16:37 -!- Furao [~Furao@pc-201-238-30-200.cm.vtr.net] has quit [Ping timeout: 244 seconds]
16:39 -!- Furao [~Furao@pc-201-238-30-200.cm.vtr.net] has joined #openvpn
16:43 < Test123> Furao? you think it is possible to install an openvpn server inside a dvr device?
16:48 -!- Test123 [4f8256c5@gateway/web/freenode/ip.79.130.86.197] has left #openvpn []
16:57 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:11 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:15 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:18 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:22 -!- Furao [~Furao@pc-201-238-30-200.cm.vtr.net] has quit [Ping timeout: 244 seconds]
17:27 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
17:27 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
17:33 -!- hilarie [~hillz@dsl-static-201-048.kpunet.net] has joined #openvpn
17:33 -!- Guest27716 [~caesay@socialshock.net] has quit [Changing host]
17:33 -!- Guest27716 [~caesay@unvanquished/associate/caesay] has joined #openvpn
17:34 -!- Guest27716 [~caesay@unvanquished/associate/caesay] has left #openvpn []
17:35 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
17:38 -!- hilarie [~hillz@dsl-static-201-048.kpunet.net] has quit [Ping timeout: 244 seconds]
17:39 -!- mirco [~mirco@p5B282D9C.dip.t-dialin.net] has joined #openvpn
17:46 -!- hilarie [~hillz@iptv-dhcp-212-190.kpunet.net] has joined #openvpn
17:47 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
17:49 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
17:50 -!- hilarie [~hillz@iptv-dhcp-212-190.kpunet.net] has quit [Ping timeout: 255 seconds]
17:54 -!- mirco [~mirco@p5B282D9C.dip.t-dialin.net] has quit [Quit: mirco]
17:56 -!- Denial [Denial@drgi.co.uk] has quit []
17:58 -!- mirco [~mirco@p5B282D9C.dip.t-dialin.net] has joined #openvpn
18:29 <@vpnHelper> RSS Update - forum: Cannot access VPN server from server LAN <http://forums.openvpn.net/topic9309.html#p18100>
18:32 -!- mirco [~mirco@p5B282D9C.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
18:33 -!- master_of_master [~master_of@p57B544AF.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
18:34 -!- mirco [~mirco@p5B282D9C.dip.t-dialin.net] has joined #openvpn
18:35 -!- master_of_master [~master_of@p57B544AF.dip.t-dialin.net] has joined #openvpn
19:15 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
19:16 -!- jay_ [~jay@212.96.10.253] has quit [Quit: Leaving]
19:24 -!- mirco [~mirco@p5B282D9C.dip.t-dialin.net] has quit [Quit: mirco]
19:31 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
19:51 -!- _julian [~quassel@hmbg-5f767b5c.pool.mediaWays.net] has joined #openvpn
19:54 -!- _julian_ [~quassel@hmbg-5f76346a.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
19:57 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has joined #openvpn
20:07 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 244 seconds]
20:16 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 260 seconds]
20:20 -!- master_of_master [~master_of@p57B544AF.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
20:22 -!- master_of_master [~master_of@p57B543EC.dip.t-dialin.net] has joined #openvpn
20:22 < BlaKHawk> hmm...
20:25 -!- Gravitron [~admin@131.238.204.197] has joined #openvpn
20:25 -!- Gravitron [~admin@131.238.204.197] has quit [Changing host]
20:25 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
20:26 -!- centau [4e8fc9bc@gateway/web/freenode/ip.78.143.201.188] has joined #openvpn
20:27 -!- nibalizer [nibz@reaver.cat.pdx.edu] has left #openvpn ["WeeChat 0.3.5"]
20:27 < centau> lo. when i set up openvpn the first time, i remember there being limitations on what the win32 TAP driver would accept in terms of addresses. did i imagine this table, or is it no longer relevant?
20:28 < centau> er... i seem to remember seeing it documented in a table on the openvpn site, i mean
20:29 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
20:30 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 255 seconds]
20:33 < centau> ah, never mind, is in the howto
20:38 -!- centau [4e8fc9bc@gateway/web/freenode/ip.78.143.201.188] has quit [Ping timeout: 265 seconds]
21:38 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:48 <@vpnHelper> RSS Update - forum: Openvpn between two computers in the same network <http://forums.openvpn.net/topic8908.html#p18101>
21:55 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
22:17 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 244 seconds]
22:25 <@vpnHelper> RSS Update - forum: how to add another client cert in openvpn <http://forums.openvpn.net/topic9313.html>
22:52 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
22:59 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 244 seconds]
23:08 -!- tjz [~pc@bb219-74-60-116.singnet.com.sg] has joined #openvpn
23:08 -!- tjz [~pc@bb219-74-60-116.singnet.com.sg] has quit [Changing host]
23:08 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
23:09 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:11 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
23:11 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
23:11 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
23:43 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
23:50 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has quit [Quit: Lost terminal]
23:59 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
--- Day changed Fri Dec 02 2011
00:17 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:29 -!- _me_ [~myself@ppp-40-139.28-151.libero.it] has joined #openvpn
00:30 < _me_> !welcome
00:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:31 -!- _me_ [~myself@ppp-40-139.28-151.libero.it] has left #openvpn []
00:38 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Read error: Connection reset by peer]
00:42 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
00:45 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Read error: Connection reset by peer]
00:58 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
01:02 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
01:40 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:41 -!- mirco [~mirco@p5B283710.dip.t-dialin.net] has joined #openvpn
02:01 -!- mirco [~mirco@p5B283710.dip.t-dialin.net] has quit [Quit: mirco]
02:44 -!- dazo_afk is now known as dazo
02:51 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
02:53 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
02:56 -!- BlackBishop [dexter@ipv6.d3xt3r01.tk] has joined #openvpn
02:57 < BlackBishop> can I make openvpn listen on udp6 too ?
03:03 -!- BlackBishop [dexter@ipv6.d3xt3r01.tk] has left #openvpn []
03:04 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
03:08 -!- BlackBishop [dexter@ipv6.d3xt3r01.tk] has joined #openvpn
03:09 < BlackBishop> or .. could I at least force my client to connect via ipv4 ? it's trying to connect via ipv6 now, and I don't seem to get how to make it listen on :::1194
03:15 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18110> || How To Control DHCP Lease In OpenVPN <http://forums.openvpn.net/topic9273.html#p18109> || Cannot access VPN server from server LAN <http://forums.openvpn.net/topic9309.html#p18108> || VOIP over OpenVPN <http://forums.openvpn.net/topic9310.html#p18107> || how to add another client cert in openvpn <http://forums.openv
03:16 < BlackBishop>  ow .. 2.3. :| mhmmm
03:26 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18111>
03:30 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18112>
03:37 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:37 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
03:41 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
03:45 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
04:02 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:09 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
04:09 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:42 -!- mdupont [~mdupont@2a01:198:200:6ec::2] has quit [Ping timeout: 240 seconds]
04:48 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
04:49 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
04:49 -!- Tony1 [~Tony@p5083B20F.dip.t-dialin.net] has joined #openvpn
04:49 < Tony1> Moin
05:05 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:05 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
05:13 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
05:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:26 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
05:26 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
05:57 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:09 -!- Tony1 [~Tony@p5083B20F.dip.t-dialin.net] has left #openvpn []
06:11 -!- Furao [~Furao@pc-20-248-30-200.cm.vtr.net] has joined #openvpn
06:52 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18113>
06:58 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18114>
07:04 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18115>
07:10 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18116>
07:11 -!- AL13N_work [~alien@91.183.52.232] has joined #openvpn
07:12 < AL13N_work> the new 2.2.1 has tap-win32 driver 9.6 and the code requires the buggy 9.8, and on top of that, pkcs11 isn't built for it, can the 2.2.1 be rebuilt please?
07:22 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18117>
07:25 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-htnbklulomphtfmb] has joined #openvpn
07:26 < evilhackerdude> hi there
07:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
07:34 < evilhackerdude> any idea how i can make openvpn clients to report their hostname with a . in front to the dhcp/dns server (dnsmasq in this case)?
07:34 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18118>
07:35 < evilhackerdude> ah, nevermind the dnsmasq thing, that was actually the other IP subnet the machines are running in
07:35 < evilhackerdude> ok, need to do some more research now :)
07:37 < evilhackerdude> oh well actually the problem is entirely unrelated to openvpn. ^H^H^H :)
07:40 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311.html#p18121>
07:43 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
07:46 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18122>
07:49 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:52 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18123>
07:58 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18124>
08:04 -!- ravel_exe [~ravel_exe@175.142.202.9] has joined #openvpn
08:16 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18125>
08:22 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18126>
08:26 < AL13N_work> i'm having an odd issue, the tapdriver works for 2x win 7 ultimate(64), but silently exists (not work) on win 7 pro(64)
08:26 < AL13N_work> i get no warnings, the signing is ok and everything, but there is no tap device
08:26 < AL13N_work> :-S
08:28 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18127>
08:29 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:31 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:31 -!- mode/#openvpn [+v Axeman] by ChanServ
08:33 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18128>
08:39 < ecrist> AL13N_work: reinstall on that box.  what version of openvpn are you working on?
08:39 < ecrist> 2.2.1?
08:39 < ecrist> and no, we aren't going to rebuild 2.2.1, that package works fine
08:42 -!- Stinnah [~Stinnah@91.183.52.232] has joined #openvpn
08:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:45 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Connection reset by peer]
08:45 -!- BlackBishop [dexter@ipv6.d3xt3r01.tk] has left #openvpn []
08:47 -!- Stinnah [~Stinnah@91.183.52.232] has left #openvpn ["Leaving"]
08:52 < AL13N_work> ecrist: can you install that, and check with --version if [PKCS11] is in there?
08:52 < AL13N_work> also
08:53 < ecrist> install what?
08:53 < AL13N_work> 2.2.1
08:53 < ecrist> i've got it installed
08:53 < AL13N_work> also, tap-win32 setup has 9.6
08:53 < AL13N_work> and 9.8 is required
08:53 < AL13N_work> i've had to rebuild it mysql to get things working
08:54 < AL13N_work> *myself
08:54 < AL13N_work> argh
08:54 < ecrist> AL13N_work: 2.2.1 works, and has for quite some time.
08:54 < ecrist> I don't know where you're getting all these version problems from.
08:54 < AL13N_work> also, apparenlty the win7 pro machine can't do make the tap device and with hdwiz it does work
08:54 < AL13N_work> i wonder too
08:55 < AL13N_work> but i'm not making this up
08:55 < AL13N_work> anyway, stuff works, i'll just use my build, so, i'm just letting you guys know
09:00 -!- novaflash_away is now known as novaflash
09:01 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Read error: Connection reset by peer]
09:34 < ecrist> AL13N_work: you really haven't told us anything useful...
09:36 -!- teonanacatl [teo@eris.feh.name] has quit [Quit: leaving]
09:48 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:03 < defswork> brain phart
10:17 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18129>
10:23 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18130>
10:30 -!- iplux [~iplux@br-sh-1.sceur.ch] has joined #openvpn
10:46 -!- iplux [~iplux@br-sh-1.sceur.ch] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
11:03 -!- ravel_exe [~ravel_exe@175.142.202.9] has quit [Ping timeout: 244 seconds]
11:08 -!- ravel_exe [ravel_exe@175.136.171.245] has joined #openvpn
11:12 -!- ravel_exe [ravel_exe@175.136.171.245] has quit [Ping timeout: 244 seconds]
11:17 -!- ravel_exe [ravel_exe@175.142.240.191] has joined #openvpn
11:19 -!- Furao [~Furao@pc-20-248-30-200.cm.vtr.net] has quit [Ping timeout: 252 seconds]
11:29 <@vpnHelper> RSS Update - forum: Connecting a Windows 7 Client <http://forums.openvpn.net/topic9314.html>
11:33 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
11:35 <@vpnHelper> RSS Update - forum: How To Control DHCP Lease In OpenVPN <http://forums.openvpn.net/topic9273.html#p18132>
11:41 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:43 -!- ravel_exe [ravel_exe@175.142.240.191] has quit [Ping timeout: 258 seconds]
11:51 -!- ravel_exe [~ravel_exe@175.142.201.78] has joined #openvpn
11:53 -!- ravel_cmd [ravel_exe@175.143.234.13] has joined #openvpn
11:55 -!- ravel_exe [~ravel_exe@175.142.201.78] has quit [Ping timeout: 248 seconds]
12:11 <@vpnHelper> RSS Update - forum: increase TLS handshake timeout during login? <http://forums.openvpn.net/topic9315.html>
12:36 <@vpnHelper> RSS Update - forum: How don't use the default VPN interface / only on my VM <http://forums.openvpn.net/topic9266.html#p18134>
12:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 255 seconds]
12:40 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
13:12 -!- ravel_exe [ravel_exe@175.143.234.13] has joined #openvpn
13:12 -!- ravel_cmd [ravel_exe@175.143.234.13] has quit [Read error: Connection reset by peer]
13:20 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
13:30 <@vpnHelper> RSS Update - forum: VPN connecting but not working <http://forums.openvpn.net/topic9316.html>
13:38 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
13:46 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:46 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:46 <@dazo> krzee: you got my reply?
13:46 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:48 <@vpnHelper> RSS Update - forum: VPN connecting but not working <http://forums.openvpn.net/topic9316.html#p18136>
14:12 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:18 -!- dazo is now known as dazo_afk
14:19 -!- chruck [~chruck@204.28.100.132] has left #openvpn []
14:21 -!- vpopov [~happylife@46.251.80.89] has joined #openvpn
14:43 -!- vpopov [~happylife@46.251.80.89] has quit [Read error: Operation timed out]
15:17 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 248 seconds]
15:18 -!- Ionic [ionic@ionic.de] has quit [Ping timeout: 248 seconds]
15:20 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:21 -!- Wayland [5d682a88@gateway/web/freenode/ip.93.104.42.136] has joined #openvpn
15:22 < Wayland> !welcome
15:22 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:22 -!- Ionic [ionic@ionic.de] has joined #openvpn
15:23 < Wayland> !sample
15:23 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
15:23 < Wayland> !goal
15:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:42 -!- dollabill [~mike@199.44.8.98] has quit [Ping timeout: 245 seconds]
15:45 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
15:53 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
15:55 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p18137>
16:28 -!- Wayland [5d682a88@gateway/web/freenode/ip.93.104.42.136] has quit [Ping timeout: 265 seconds]
16:34 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
16:41 -!- novaflash is now known as novaflash_away
16:49 <@vpnHelper> RSS Update - forum: how to add another client cert in openvpn <http://forums.openvpn.net/topic9313.html#p18138>
17:09 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:26 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
17:26 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
18:02 -!- ponyofdeath [~vladi@cpe-75-80-175-217.san.res.rr.com] has joined #openvpn
18:03 < ponyofdeath> hi, is there something special i need to add after having an successfull openvpn connection from client to server to try and add routes on the server to reach subnets on the client side?
18:03 < ponyofdeath> currently i have SNAT on both sides and am adding routes like so Dec  2 14:39:52 gypsyops kernel: [3182903.425937] INGRESS IN=eth2 OUT= MAC=00:02:b3:aa:93:70:00:30:b8:d6:5e:40:08:00 SRC=120.61.23.157 DST=75.80.175.217 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=47244 PROTO=TCP SPT=13390 DPT=59445 WINDOW=0 RES=0x00 ACK RST URGP=0 
18:03 < ponyofdeath> sorry
18:04 < ponyofdeath> route add -net 10.126.0.0 netmask 255.255.0.0 gw 10.97.97.2 or route add -net 10.126.0.0 netmask 255.255.0.0 dev tun0
18:04 < ponyofdeath> i can see them going out my tun0 interface but i dont see them coming out on the client side tun
18:04 < ponyofdeath> ping that i
18:05 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:25 <@vpnHelper> RSS Update - forum: PrivateTunnel.com : Terms and Conditions : Disclosure <http://forums.openvpn.net/topic8902.html#p18139>
18:26 -!- luptenschteiner [~User@unaffiliated/probonono] has joined #openvpn
18:26 -!- probonono [~User@unaffiliated/probonono] has quit [Read error: No route to host]
18:42 < krzee> ponyofdeath, 
18:42 < krzee> !route
18:42 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
18:42 < krzee> !clientlan
18:42 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
18:42 <@vpnHelper> better explanation
18:56 <@vpnHelper> RSS Update - forum: How to pass SIP calls over OpenVPN Tunnel <http://forums.openvpn.net/topic8865.html#p18140>
19:06 -!- luptenschteiner [~User@unaffiliated/probonono] has quit [Read error: No route to host]
19:10 -!- probonono [~User@ppp103-111.static.internode.on.net] has joined #openvpn
19:10 -!- probonono [~User@ppp103-111.static.internode.on.net] has quit [Changing host]
19:10 -!- probonono [~User@unaffiliated/probonono] has joined #openvpn
19:13 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has joined #openvpn
19:16 < BlaKHawk> hey is anyone here using any kind of vpn provider and openvpn as their vpn client ?
19:49 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has quit [Read error: Connection reset by peer]
19:49 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has joined #openvpn
19:50 -!- _julian_ [~quassel@hmbg-4d0686a9.pool.mediaWays.net] has joined #openvpn
19:53 -!- _julian [~quassel@hmbg-5f767b5c.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:54 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has left #openvpn []
19:55 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has joined #openvpn
19:57 -!- Denial [Denial@drgi.co.uk] has quit []
19:58 -!- Siphon11a [~Siphon11@98.125.213.132] has joined #openvpn
20:00 -!- Siphon11 [~Siphon11@207-118-44-224.dyn.centurytel.net] has joined #openvpn
20:03 -!- Siphon11a [~Siphon11@98.125.213.132] has quit [Ping timeout: 260 seconds]
20:13 < Siphon11> Does anyone in here use OpenWRT?
20:20 -!- master_of_master [~master_of@p57B543EC.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
20:21 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
20:21 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
20:21 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:22 -!- master_of_master [~master_of@p57B54C46.dip.t-dialin.net] has joined #openvpn
20:22 < ponyofdeath> krzee: thanks
20:24 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
20:24 <@vpnHelper> RSS Update - forum: [REQ] How To Make OpenVPN server Management <http://forums.openvpn.net/topic9317.html>
20:29 -!- corretico [~luis@201.201.44.82] has joined #openvpn
20:40 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:40 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:53 < krzee> BlaKHawk, Siphon11, neither of you guys actually asked a question that i would now be able to try to ask
20:54 < Siphon11> Hello krzee
20:54 < krzee> s/ask$/help/
20:54 < krzee> hey
20:54 < Siphon11> I'm using OpenWRT and I have my openVPN settings all plugged in, but I am getting this error: Sorry, 'Auth' password cannot be read from a file
20:55 < krzee> !peauth
20:55 < krzee> !pwauth
20:55 < krzee> grr
20:55 < krzee> !authfule
20:55 < krzee> !authfile
20:55 < krzee> sorry
20:55 < krzee> !pwfile
20:55 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h or (#2) see --auth-user-pass in the manual (!man) for more info or (#3) if you're using this with the windows service, you will need --askpass
20:55 < BlaKHawk> i am thinking of purchasing a vpn package from a vpn provider and they use openvpn as their client and i am using linux through vmware and i am wondering if there is any kind of different process required to use opevpn when using linux through vmware?
20:55 < krzee> there we go
20:56 < krzee> BlaKHawk, you need to get support from them
20:56 < krzee> we cant answer questions about their setup
20:56 < Siphon11> Hmm I see
20:57 < BlaKHawk> krzee: i get that but i was hoping you could answer in general terms...
20:57 < krzee> cant
20:58 <+EugeneKay> BlaKHawk - #vmware would be a better place to ask about the implications of VMing an application.
20:58 < BlaKHawk> k
20:58 <+EugeneKay> The answer to your question is "it's vmware, that shit just works"
20:59 <+EugeneKay> There's no foolishness with TTYs like you have in Xen or the lulz that is openvz
20:59 -!- Siphon11 [~Siphon11@207-118-44-224.dyn.centurytel.net] has left #openvpn []
21:01 < BlaKHawk> you guys have a vmware section on your openvpn website...
21:02 <+EugeneKay> That's OpenVPN commercial. This is open-source support.
21:02 < BlaKHawk> okay i was hoping that maybe someone here had a setup similar to the one i was asking...
21:03 <+EugeneKay> I do; I told you already; it "just works" because VMware is a proper hypervisor and the application doesn't care.
21:03 < Olipro> yo dawg, we heard you like computers
21:04 < Olipro> so we put a computer inside your computer
21:04 <+EugeneKay> http://eugenekay.com/img/vmware.jpg
21:04 < Olipro> so you can run an operating system while you run an operating system
21:04 < Olipro> ahaha
21:05 < BlaKHawk> EugenKay: okay i get so your saying that more that likely it will just work
21:05 < Olipro> it WILL just work
21:05 < BlaKHawk> okay thank you 
21:18 -!- tabakhase [t4b4kh453@unaffiliated/tabakhase] has joined #openvpn
21:18 < tabakhase> hi there
21:19 < tabakhase> i want to "bridge my windows to a server where he should bring me further into eth0" server: eth0=10.0.0.0:255.240.0.0 eth1=real.online.ip
21:20 < tabakhase> on the server a "ifconfig 10.0.0.0 255.240.0.0" sets me the correct subnet on windows, i can also talk to the server but nothing "further" and other hosts connected to eth0 cant reach me
21:24 < tabakhase> winconfig, serverconfig, server ifconfig: http://nopaste.php-quake.net/115093
21:28 < tabakhase> i may need to add that the server is a openvz VM using bridgetNetworking, working just fine
21:29 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has quit [Quit: Lost terminal]
21:49 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has joined #openvpn
21:50 -!- Hilarie [~Hilarie2@212.7.210.65] has joined #openvpn
22:02 -!- ravel_exe [ravel_exe@175.143.234.13] has quit [Ping timeout: 244 seconds]
22:12 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
22:14 -!- ravel_exe [ravel_exe@175.143.234.13] has joined #openvpn
22:23 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
22:25 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:11 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
23:17 <@vpnHelper> RSS Update - forum: How don't use the default VPN interface / only on my VM <http://forums.openvpn.net/topic9266.html#p18142>
23:32 -!- ravel_exe [ravel_exe@175.143.234.13] has quit []
23:44 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
23:46 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
23:52 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has quit [Quit: leaving]
--- Day changed Sat Dec 03 2011
00:57 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Ping timeout: 260 seconds]
01:49 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 260 seconds]
02:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:13 -!- newegggg [~newegggg@208.111.39.186] has joined #openvpn
03:13 < newegggg> hi
03:14 < newegggg> sometimes my openvpn connection becomes unbearably slow (like dial up suddenly). And the only solution is to restart the laptop, that fixes it. Any idea whats up? I'm running windows 7
03:16 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
03:20 -!- newegggg [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
03:24 -!- newegggg [~newegggg@208.111.39.186] has joined #openvpn
03:25 -!- newegggg [~newegggg@208.111.39.186] has quit [Client Quit]
03:25 -!- newegggg [~newegggg@208.111.39.186] has joined #openvpn
03:25 < newegggg> any1?
03:29 -!- newegggg [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
03:29 -!- newegggg [~newegggg@208.111.39.186] has joined #openvpn
03:31 -!- newegggg [~newegggg@208.111.39.186] has quit [Client Quit]
03:31 -!- asdfasdfasdf [~newegggg@208.111.39.186] has joined #openvpn
03:37 -!- asdfasdfasdf [~newegggg@208.111.39.186] has quit []
03:54 -!- ravel_exe [ravel_exe@175.143.234.13] has joined #openvpn
03:59 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
03:59 -!- Inumedia [~Inumedia@unaffiliated/inumedia] has joined #openvpn
04:02 < Inumedia> I'm trying to setup OpenVPN server on a wireless connection, could someone point me to a tutorial on how to do the network bridging for this?
04:02 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
04:03 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:03 < Inumedia> o-o
04:14 -!- Inumedia [~Inumedia@unaffiliated/inumedia] has quit [Remote host closed the connection]
05:08 < hyper_ch> !bridge
05:08 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
05:08 < hyper_ch> !tunortap
05:08 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
05:08 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
05:25 -!- ravel_cmd [ravel_exe@175.142.247.6] has joined #openvpn
05:26 -!- ravel_exe [ravel_exe@175.143.234.13] has quit [Ping timeout: 252 seconds]
05:27 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
05:27 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
05:36 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
05:47 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:58 -!- kyrix [~ashley@mk089144206072.a1.net] has joined #openvpn
06:07 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:30 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 258 seconds]
06:51 -!- Migi32 [~migi@178-117-98-59.access.telenet.be] has joined #openvpn
06:54 -!- corretico [~luis@201.201.44.82] has joined #openvpn
06:54 < Migi32> hi. The VPN I want to connect to is "inside" another VPN. So I need to connect to the first VPN before I can connect to the second VPN. Is this possible with OpenVPN?
06:54 -!- corretico [~luis@201.201.44.82] has quit [Read error: Connection reset by peer]
06:54 -!- corretico [~luis@201.201.44.82] has joined #openvpn
07:01 -!- corretico [~luis@201.201.44.82] has quit [Quit: Leaving]
07:05 -!- Migi32 [~migi@178-117-98-59.access.telenet.be] has quit [Ping timeout: 244 seconds]
07:05 -!- Migi32 [~migi@vpnb007.ugent.be] has joined #openvpn
07:05 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 244 seconds]
07:17 <@vpnHelper> RSS Update - forum: Client on same LAN IP range as server causing problems. <http://forums.openvpn.net/topic9318.html>
07:18 -!- ravel_cmd [ravel_exe@175.142.247.6] has quit []
07:22 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 244 seconds]
07:34 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
07:40 -!- barefoot [~magic@mail.pharmed.co.za] has joined #openvpn
07:40 < barefoot> hi all
07:40 < barefoot> has anyone here dealt with openvpn on vyatta
07:51 -!- Migi32 [~migi@vpnb007.ugent.be] has quit [Ping timeout: 260 seconds]
07:51 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
07:52 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:00 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 252 seconds]
08:07 -!- Migi32 [~migi@178-117-98-59.access.telenet.be] has joined #openvpn
08:08 -!- bragon [~Alexandre@81.93.247.165] has quit [Remote host closed the connection]
08:08 -!- tty234 [telex@gateway/shell/anapnea.net/x-sckofjbzpwwlrdul] has quit [Ping timeout: 252 seconds]
08:09 -!- tty234 [telex@gateway/shell/anapnea.net/x-etigozmpctiggoku] has joined #openvpn
08:12 -!- bragon [~Alexandre@81.93.247.165] has joined #openvpn
08:34 -!- Bruk0ut [~Bruk0ut@unaffiliated/brukout] has quit [Ping timeout: 252 seconds]
08:40 -!- novaflash_away is now known as novaflash
08:42 -!- kyrix [~ashley@mk089144206072.a1.net] has quit [Ping timeout: 244 seconds]
08:45 < barefoot> having issues --client-config-dir
08:46 < krzee> such as...
08:47 < krzee> if you speak in complete questions, people will be able to answer when they see it instead of needing to ask for more info
08:49 < barefoot> apologies for that one, the issue that i am currently experiencing is that, my server is just not getting the route for the client side. client side is able to connect to the server side, however the server side is not able to connect to the client side, can see the client side openvpn interface, just not seeing client lan side
08:52 < krzee> !route
08:52 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
08:52 < krzee> !clientlan
08:52 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
08:52 <@vpnHelper> better explanation
08:53 < barefoot> i do have ip forwarding enabled, i have the ccd setup client config pointing to it, whats not happening is the client config is not adding the remote route to my routing table
08:54 < krzee> well the client with the lan shoudnt be adding a route for its own lan
08:54 < krzee> in fact that gets ignored because of the iroute, which is good
08:56 < barefoot> think that came out wrong, my server config file is not adding the remote route to my server routing table, its in my ccd iroute has the correct route
08:57 < barefoot> the push route is working fine
08:58 < barefoot> --comp-lzo --push route 192.168.10.0 255.255.255.0 --push route 192.168.25.0 255.255.255.0 --push route 172.17.1.0 255.255.255.0 --client-config-dir home/vyatta/ccd/ route 10.8.68.0 255.255.253.0
09:02 < krzee> where is "route 10.8.68.0 255.255.253.0"
09:02 < krzee> in the ccd im guessing?
09:02 < krzee> and what network is 10.8.68.0 255.255.253.0
09:08 < barefoot> that is the client side network
09:08 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
09:08 < barefoot> its the local lan on the other side of the openvpn interface
09:21 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Ping timeout: 244 seconds]
09:36 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:41 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:41 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
09:41 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:47 -!- barefoot [~magic@mail.pharmed.co.za] has quit [Read error: Connection reset by peer]
09:47 -!- magic_1 [magic@41.112.10.191] has joined #openvpn
09:50 -!- vpopov [~happylife@46.251.80.89] has joined #openvpn
09:51 -!- magic_1 [magic@41.112.10.191] has quit [Ping timeout: 244 seconds]
09:51 -!- magic_1 [~magic@mail.virtuallogistics.co.za] has joined #openvpn
09:54 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
09:55 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Remote host closed the connection]
09:59 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
10:02 -!- magic_1 [~magic@mail.virtuallogistics.co.za] has quit []
10:16 -!- Bruk0ut [~Bruk0ut@193.104.35.125] has joined #openvpn
10:18 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
10:21 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 248 seconds]
10:21 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
10:24 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
10:45 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
10:51 -!- Bruk0ut [~Bruk0ut@193.104.35.125] has quit [Changing host]
10:51 -!- Bruk0ut [~Bruk0ut@unaffiliated/brukout] has joined #openvpn
11:02 -!- pm2 [62e46298@gateway/web/freenode/ip.98.228.98.152] has joined #openvpn
11:05 < pm2> Hi - I have a VPN setup for an office network.  I have a user that wants to install QuickBooks on her home PC and access the data file over the VPN, that's shared via SMB.  We tested this, and it's incredibly slow.  RDP works quickly enough, but accessing the file over SMB is really slow.
11:05 < pm2> Is there anything that can be done to improve the speed?  Or is RDP the way to go?
11:08 < hyper_ch> !configs
11:08 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
11:08 < hyper_ch> !samba
11:08 <@vpnHelper> "samba" is (#1) http://openvpn.net/faq#samba-routing for using samba with a routed tun, or use NETBIOS with a bridge or (#2) http://www.openvpn.net/howto#samba if you run samba on linux and use tun mode
11:14 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
11:17 -!- pm2 [62e46298@gateway/web/freenode/ip.98.228.98.152] has quit [Ping timeout: 265 seconds]
11:22 -!- pm2 [62e46298@gateway/web/freenode/ip.98.228.98.152] has joined #openvpn
11:22 < pm2> You may need to update that first samba link
11:27 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
11:29 < pm2> Here's my config - this is OpenVPN 2.1_rc11  running on Debian.  The client in question is Win 7, the smb shares are shared from a Windows Server 2003 machine
11:30 < pm2> http://pastebin.com/AC9TH9SR
11:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:34 < pm2> The file size is also about 200MB - is that just going to be too big in general for this to work smoothly?
11:34 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
11:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:44 -!- rawplayer [~foo@2001:610:158:1020:216:3eff:fe64:6606] has joined #openvpn
11:44 < rawplayer> hi
11:48 -!- pa1i [pali@gentoo.informel.pl] has joined #openvpn
11:48 -!- pa1i [pali@gentoo.informel.pl] has left #openvpn []
12:11 < tabakhase> so, certbased bridgeVPN on openvz running
12:12 < tabakhase> but ether i missied smth or my brain makes it weird:
12:12 < tabakhase> "revoke certs"? basicly banning users?
12:12 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
12:13 < tabakhase> i read about uname+password auth, but couldnt i create a "blacklist" of cn or better serials of certs?
12:16 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
12:17 -!- madsage [~sage@io.ioio.com] has quit [Disconnected by services]
12:17 -!- madsage [~sage@io.ioio.com] has joined #openvpn
12:17 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
12:18 -!- madsage [~sage@io.ioio.com] has quit [Disconnected by services]
12:18 -!- madsage [~sage@io.ioio.com] has joined #openvpn
12:18 < hyper_ch> pm2: don't use tcp
12:18 < hyper_ch> pm2: use udp
12:18 < hyper_ch> !udp
12:19 < pm2> Why would TCP be so much slower?
12:20 < hyper_ch> someone else might be better at explaining that
12:20  * hyper_ch eyes krzee
12:20 < hyper_ch> !protocol
12:20 < hyper_ch> !tcp
12:20 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
12:20 < hyper_ch> there we go :)
12:23 < krzee> yes hyper_ch?
12:24 < hyper_ch> krzee: [19:19] <pm2> Why would TCP be so much slower?
12:24 < krzee> ahh
12:24 < krzee> ya you got it at !tcp
12:24 < krzee> (i have webchat on ignore)
12:24 < hyper_ch> I had to try hard to find it
12:24 < hyper_ch> awww :)
12:25 < pm2> cool thanks
12:35 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
12:43 < hyper_ch> pm2: did a change to udp improve thigns?
12:46 < pm2> still working on it...
12:46 < hyper_ch> :)
12:59 < Olipro> is there a fix for "SENT CONTROL [blah.host.name]: 'PUSH_REQUEST' (status=1)"
13:00 < Olipro> at the first connection to the OpenVPN server, this doesn't happen, but it does for all subsequent ones
13:03 -!- pm2 [62e46298@gateway/web/freenode/ip.98.228.98.152] has quit [Ping timeout: 265 seconds]
13:22 -!- guifort [~guifort@ns208662.ovh.net] has joined #openvpn
13:25 -!- ZoB [Dan@DanIRC.net] has quit [Quit: leaving]
13:36 -!- guifort [~guifort@ns208662.ovh.net] has quit [Quit: Quitte]
13:36 <@vpnHelper> RSS Update - forum: Where to Download VARS Files? <http://forums.openvpn.net/topic9319.html>
13:56 -!- `Ile` [~kvirc@109-92-76-185.dynamic.isp.telekom.rs] has joined #openvpn
14:03 -!- beerbro [~gustav@apollon.ais-salzburg.at] has quit [Ping timeout: 244 seconds]
14:10 -!- gustav- [~gustav@sockensaft.garagenwein.at] has joined #openvpn
14:44 -!- novaflash [~novaflash@openvpn/user/novaflash] has quit [Ping timeout: 255 seconds]
14:45 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
14:45 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
14:45 -!- novaflash [~novaflash@openvpn/user/novaflash] has joined #openvpn
14:46 -!- vpopov [~happylife@46.251.80.89] has quit [Ping timeout: 244 seconds]
14:59 -!- Migi32 [~migi@178-117-98-59.access.telenet.be] has quit [Ping timeout: 244 seconds]
15:05 -!- `Ile` [~kvirc@109-92-76-185.dynamic.isp.telekom.rs] has quit [Ping timeout: 240 seconds]
15:07 <@vpnHelper> RSS Update - forum: Where to Download VARS Files? <http://forums.openvpn.net/topic9319.html#p18146> || Getting this to work. <http://forums.openvpn.net/topic9288.html#p18145>
15:11 -!- me345 [~me345@adsl-75-15-183-164.dsl.bkfd14.sbcglobal.net] has joined #openvpn
15:13 <@vpnHelper> RSS Update - forum: Connecting a Windows 7 Client <http://forums.openvpn.net/topic9314.html#p18147>
15:18 -!- `Ile` [~kvirc@93-87-240-62.dynamic.isp.telekom.rs] has joined #openvpn
15:19 < hyper_ch> krzee: hmmm... I get through UDP vpn only 1/5 of the speed as when I use tcp
15:53 -!- riganta [~zongo@86-41-67-29-dynamic.b-ras2.chf.cork.eircom.net] has joined #openvpn
15:54 < riganta> Greetings, 
15:55 < riganta> I get this error when trying to start openvpn --> http://pastebin.com/XFvnYQTx
15:56 < riganta> checked on the internet and a lot of people are saying a lot things but no dice trying to solve the issue
15:59 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
15:59 <@vpnHelper> RSS Update - forum: Where to Download VARS Files? <http://forums.openvpn.net/topic9319.html#p18148>
16:06 -!- `Ile` [~kvirc@93-87-240-62.dynamic.isp.telekom.rs] has quit [Ping timeout: 252 seconds]
16:08 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
16:14 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
16:21 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
16:31 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
16:32 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
16:32 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
16:36 -!- Mowee [~Mowi@lendabrain.net] has quit [Remote host closed the connection]
16:37 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
16:37 < ecrist> !factoids
16:37 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:37 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
17:00 <@vpnHelper> RSS Update - forum: Where to Download VARS Files? <http://forums.openvpn.net/topic9319.html#p18149>
17:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
17:11 < tabakhase> wow... took 12 hours  to setup vpn-gateway on a openvz VM
17:14 -!- riganta [~zongo@86-41-67-29-dynamic.b-ras2.chf.cork.eircom.net] has quit [Remote host closed the connection]
17:15 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:27 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
17:27 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
17:30 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
17:31 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:33 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:46 < krzie> tabakhase, sounds like you have been initiated ;]
17:49 < tabakhase> now "know what to do" not a big thing annymore... bridge from HN no problem, on the VM (hard to find) DEVNODES="net/tun:rw ", ('not documented'?) CAPABILITY="NET_ADMIN:on " and a (clear, but not findable with the real error message) FEATURES="bridge:on "
17:50 < tabakhase> then the bridge in the VM is 'normal' exept the point that inside the openvpn init.d script i was needed to add the "openvpn --mktun --dev tap0; brctl addif br0 tap0" for linking that bridge
17:51 < tabakhase> and very last: allso add a "openvpn --rmtun --dev tap0" on stop otherwise openvz will fail and become unable to close/restart/kill the container
17:51 < tabakhase> with these informations-> everything just fine
17:53 < krzie> ive never seen any of that
17:53 < krzie> (i also dont use openvz, nor do i support bridges
17:53 < tabakhase> ;)
17:54 < krzie> would be really cool to have a writeup on what you learned
17:54 < krzie> !wiki
17:54 <+EugeneKay> I was about to say..... bridging.... openvz.... why?
17:54 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
17:54  * ecrist supports bridges
17:54 < krzie> if you are interested =]
17:54 <+EugeneKay> I burn bridges.
17:55 < tabakhase> wki... i realy need to start a blog or smth.. solving hundrets of weird problems where i "should write down the sollution googleIndexAble"... but time therefore... no...
17:55 < ecrist> why not post to our trac/wiki with a howto?
17:56 < tabakhase> same as my "cisco says it can not work like that" 2.5-arm ACE_Loadbalancing
17:57 < krzie> tabakhase, but if its on some blog it'll just become one of the thousands of blog entries that we end up ignoring ;]
17:57 < krzie> we have 2 wiki's =]
17:57 < krzie> 1 that we've been using for a long time, and an official one that is a bit newer
17:57 < tabakhase> krzie but when i wanne make millions from SEO anf backlinks \o/    m(
17:58 < ecrist> lol
17:58 < krzie> right, gl with that ;)
17:58 < ecrist> these days my wiki is high on page one for many openvpn searches, and I don't even have adwords on it.
17:59 < krzie> my routing doc has to be one of the more popular ovpn writeups out there... and im pretty sure after the yrs it has been up ild still get around nothing
17:59 < krzie> lol
18:00 < ecrist> yeah, probably
18:00 < krzie> but it does help lots of people
18:00 < krzie> and thats what its there for =]
18:01 < tabakhase> basic its mostly not about "no docu" mutch more worse is incorrect or incomplete doku...
18:02 < ecrist> tabakhase: so, do something about it
18:02 < krzie> which is the standard when you just google something
18:02 < ecrist> krzie and I write much of the docs these days
18:02 < krzie> googling for help with openvpn sucks
18:02 < ecrist> we don't use openvz, so the odds of us writing that one are nil
18:02 < krzie> too much crap out there
18:02 < krzie> exactly
18:02 < krzie> and from what you said helped you, i KNOW i wont be helping anyone with it
18:03 < krzie> unless of course you make a writeup, and i point my bot to it
18:05 < tabakhase> writeup for now is a 60lines .txt file.. i might generate a clean&readable version when im done with that project and the settup is veryfied
18:06 < krzie> plus, just 1 good writeup can help as many people as if you hangout in here with us for a long time... ive helped countless people in here and ild bet you that my writeup helped more people than i did directly
18:22 -!- mirco [~mirco@p5B282FE7.dip.t-dialin.net] has joined #openvpn
18:28 <@vpnHelper> RSS Update - forum: unable to write 'random state' -- should I be worried? <http://forums.openvpn.net/topic9320.html>
18:28 < mirco> Hi hi, I've setup a cert based server… Prob is I can't ping the internal server IP, other IP's in the server subnet are fine!
18:37 < krzie> !route
18:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
18:39 < mirco> krzie: I've set a route with "route 10.11.3.0 255.255.255.0"
18:40 < krzie> client lan or server lan?
18:40 < mirco> this is on client side...
18:40 < krzie> o i think i understand the question now
18:41 < mirco> sounds great
18:41 < krzie> oh its the clients lan?
18:41 < mirco> no this is the server lan
18:41 < krzie> and the entire server lan except the server itself are responding to your pings?
18:41 < mirco> I'll make a plan, wait a sec
18:41 < mirco> yeap
18:42 < krzie> then its your firewall
18:42 < krzie> on the server
18:42 < mirco> iptables -L -v doesn't show a rule on tun0
18:42 < mirco> and I haven't set on in the script
18:43 < krzie> its your firewall
18:43 <+EugeneKay> You need to allow the vpn subnet to access the lan address
18:43 <+EugeneKay> This is a fundamental tenet of stateful firewalls in routed situations
18:44  * krzie points @ the topic
18:44 < krzie> Your problem is your firewall, really. ;]
18:44 < mirco> krzie: I'll google me the iptables call… THX
18:45 < krzie> EugeneKay just told you what to do
18:45 < krzie> hes the guy i asked that time i needed help with openvpn and iptables... ild listen to him if i were you ;]
18:46 <+EugeneKay> !spoonfeeding
18:46 <@vpnHelper> "spoonfeeding" is http://www.mp3car.com/the-faq-emporium/53368-faq-what-is-spoon-feeding.html
18:46 < mirco> krzie: I read it, but as I don't use iptables so often I need to find the iptabels call
18:47 < tabakhase> "Usually these people also require the use of bedpans and/or diapers." :D
18:47 < mirco> he he
18:48 < krzie> lol
18:53 <+EugeneKay> Oh, wow.
18:53 <+EugeneKay> I'm a tardcase
18:54 <+EugeneKay> --iproute :v
18:54 <+EugeneKay> All I have to do is fiddle the init script
18:55 < Olipro> mirco: iptables is a userspace tool for configuring packet filtering, mangling, marking and NATting rules
18:55 < Olipro> the very fact you're calling it an "iptables call" implies that you are frankly doomed
18:56 < Olipro> so, what subnets are you trying to route between?
18:56 < mirco> Olipro: I know, I'm running my firewall script from an /etc/init.d 
18:56 < Olipro> you have your VPN clients on 10.11.3.0/24, right?
18:58 < mirco> client is on 10.10.10./24, server on 10.11.3./24 vpn subnet is 172.11.1/24
19:00 < Olipro> so 10.10.10.0/24 is actual clients?
19:00 < Olipro> not a VPN
19:01 < mirco> this is the net my machine is currently in, but could also be another one if me or someone else is somewhere else...
19:02 < mirco> or short: yeap
19:05 -!- me345 [~me345@adsl-75-15-183-164.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
19:05 < mirco> iptables -I INPUT 4 -p udp --dport 520 -i tun0 -j DROP
19:05 < mirco> sorry
19:05 < mirco> iptables -I INPUT -i tun0 -j ACCEPT
19:05 < mirco> last one fixed it for me!
19:05 < krzie> weird, that looks familiar
19:05 < krzie> oh thats cause it is in the manual
19:05 < krzie> ;]
19:12 < mirco> hmm now I can ping but still can't use the dns-server
19:12 < krzie> firewall
19:12 < krzie> !notovpn
19:12 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
19:14 <@vpnHelper> RSS Update - forum: Ip forwarding via IPTABLES <http://forums.openvpn.net/topic9321.html>
19:19 < rawplayer> !udp
19:19 < rawplayer> !tcp
19:19 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
19:25 <+EugeneKay> Any idea who manages the linux init script?
19:29 < mirco> EugeneKay: me
19:29 < mirco> I've added $IPTABLES -A INPUT -i tun0 -j ACCEPT
19:32 < krzie> LOL
19:32 < krzie> i dont think thats what he meant mirco
19:32 < krzie> EugeneKay, im not sure, try the dev channel maybe
19:32 <+EugeneKay> !dev
19:32 <@vpnHelper> "dev" is https://lists.sourceforge.net/lists/listinfo/openvpn-devel to sign up for devel mail list
19:32 < krzie> openvpn-deve;
19:33 < krzie> err typo but you get it
19:33 <+EugeneKay> Ah +el
19:33 < mirco> krzie: thx
19:33 <+EugeneKay> <3
19:33 < krzie> mirco, for what?
19:33 < mirco> telling
19:33 < krzie> ahh np
19:33 < krzie> but what i said that was more helpful if you use it was this:
19:33 < krzie> [17:12]  <krzie> !notovpn
19:33 < krzie> [17:13]  <vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
19:49 -!- _julian [~quassel@hmbg-4d06b0c2.pool.mediaWays.net] has joined #openvpn
19:49 -!- _julian_ [~quassel@hmbg-4d0686a9.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:52 -!- Guest30323 [~Death@localtel.eagleits.net] has joined #openvpn
19:53 -!- zalzice_ [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
19:55 -!- twobitsp1ite [~isaac@li24-165.members.linode.com] has joined #openvpn
19:55 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
19:56 -!- nifigase [niko@luchshe.vdalnete.ru] has joined #openvpn
19:56 -!- civillia1 [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
19:57 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 245 seconds]
19:57 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 245 seconds]
19:57 -!- nifiga [niko@luchshe.vdalnete.ru] has quit [Ping timeout: 245 seconds]
19:57 -!- twobitsprite [~isaac@li24-165.members.linode.com] has quit [Ping timeout: 245 seconds]
19:57 -!- civillian [~nickn@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 245 seconds]
19:57 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
19:57 -!- Dougy [me@tech.qsi.net] has quit [Ping timeout: 245 seconds]
19:58 -!- Dougy [me@tech.qsi.net] has joined #openvpn
20:10 -!- saliak [~kailas@pool-96-238-35-109.prvdri.fios.verizon.net] has joined #openvpn
20:11 < saliak> So i'm using openvpn-als (adito) and i'm not sure if I'm misunderstanding what a vpn does, or it's not working correctly.  I connect to my server from outside my home network, login, and start the agent.  at that point, should it look like i'm on my home network?  for example, i should be able to browse for my network shares?  
20:13 < krzie> openvpn-as you mean, right?
20:14 < krzie> !as
20:14 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
20:14 < krzie> this channel if for the community version, you actually get professional support as part of the license you're paying for
20:15 < krzie> (and we dont know access-server here)
20:16 <+EugeneKay> !iki
20:16 <+EugeneKay> !wiki
20:16 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
20:20 -!- master_of_master [~master_of@p57B54C46.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:22 -!- master_of_master [~master_of@p57B520E0.dip.t-dialin.net] has joined #openvpn
20:27 <@vpnHelper> RSS Update - forum: Where to Download VARS Files? <http://forums.openvpn.net/topic9319.html#p18152>
20:28 <+EugeneKay> I presume I should use the Official one
20:29 <+EugeneKay> Annnd of course the recapctha box is broken
20:29 < krzie> well thats up to you
20:30 < krzie> i use the unofficial
20:30 < krzie> we been using that since before the official existed, ecrist runs it
20:30 <+EugeneKay> And the unofficial one has no Register link -_-
20:30 < krzie> 1sec lemme look
20:31 < krzie> lol
20:31 < krzie> ecrist, ^
20:31 <+EugeneKay> You do not have permission to create this user account, for the following reason:
20:31 <+EugeneKay> The action you have requested is limited to users in the group: Administrators.
20:32  * EugeneKay pokes ecrist with a stick
20:32 < krzie> but do you need to be added to edit stuff?
20:32 <+EugeneKay> Yurp.
20:34 < krzie> lol
20:34 < krzie> i guess the official one then
20:34 <+EugeneKay> Can't captcha :-p
20:34 -!- mirco_ [~mirco@p5B285DE6.dip.t-dialin.net] has joined #openvpn
20:34 < krzie> hahah
20:35 < krzie> i think that will need to be fixed by either mattock or maybe ecrist 
20:35 <+EugeneKay> It *might* be related to the fact that I'm accessing it over IPv6
20:37 <+EugeneKay> Nope, broken with IPv6 off, too.
20:37 -!- mirco [~mirco@p5B282FE7.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
20:37 -!- mirco_ is now known as mirco
20:37  * EugeneKay grumbles
21:00 -!- mirco [~mirco@p5B285DE6.dip.t-dialin.net] has quit [Quit: mirco]
21:02 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:02 -!- saliak [~kailas@pool-96-238-35-109.prvdri.fios.verizon.net] has quit [Ping timeout: 244 seconds]
21:07 -!- probonono [~User@unaffiliated/probonono] has quit [Ping timeout: 248 seconds]
21:09 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
21:22 -!- Denial [Denial@drgi.co.uk] has quit []
21:25 <@vpnHelper> RSS Update - forum: connected to server but no ping response <http://forums.openvpn.net/topic9322.html>
21:30 -!- saliak [~kailas@ip68-9-228-184.ri.ri.cox.net] has joined #openvpn
21:34 < ecrist> sup bitches?
21:34 < ecrist> EugeneKay: what's the issue
21:34 < ecrist> "root is me"
21:34 <+EugeneKay> Many issues :-p
21:35 <+EugeneKay> I'm doing a writeup on running openvpn entirely as an unpriv'ed user from the init-script
21:35 <+EugeneKay> I wanted to toss it onto the unoficcial wiki, but account reg is disabled. And the official wiki has a broken recaptcha
21:37 < ecrist> lol
21:37 <+EugeneKay> So, I'm doing it as a GIst instead
21:37 < ecrist> the disabled reg is on purpose
21:38 < ecrist> you should be able to create an account on the unofficial wiki now
21:38 < ecrist> let me look at the official wiki, see if I can't fix the captcha stuff quick
21:39 <+EugeneKay> It was whining about a bad referrer. My guess is somethign with the token is fubared.
21:39 < ecrist> hrm, you're talking about the recaptcha on https://community.openvpn.net/pwm right?
21:39 <@vpnHelper> Title: Password Self Service (at community.openvpn.net)
21:39 < ecrist> that one just worked for me.
21:40 <+EugeneKay> I get a blank box. Clicking refresh icon gives "Input error: Invalid referer"
21:43 < ecrist> I assume you're on an HE tunnel?
21:44 <+EugeneKay> Aye, but it's broken over v4 as well
21:44 < ecrist> from my system, it works, and I'm over IPv4
21:44 < ecrist> try accessing it again, now, over ipv4
21:45 <+EugeneKay> still the same
21:45 < ecrist> flush your cache?
21:46 < ecrist> oh, I see your problem.
21:46 < ecrist> you're coming from Arkasas.
21:46 < ecrist> you're gonna have to fix that.
21:46 < ecrist> :P
21:46 <+EugeneKay> IE did it, but it whined about HTTPS violation
21:46 <+EugeneKay> HA!
21:47 <+EugeneKay> The North Arkansas Telephone Company strikes again
21:47 < ecrist> lol
21:49 < ecrist> weird
21:50 < ecrist> firefox fails to allow me to store security exception if I manually use the IPv6 address in the address bar
21:50 < ecrist> https://skitch.com/ecrist/gptm2/firefox
21:50 <@vpnHelper> Title: ecrist | skitch.com (at skitch.com)
21:51  * EugeneKay shrugs
21:51 <+EugeneKay> I'll just make my account in IE :-p
21:51 < ecrist> it's still something mattock or myself should figure out, though.
21:53 <+EugeneKay> Anyway.... 
21:53 <+EugeneKay> https://gist.github.com/1429097
21:53 <@vpnHelper> Title: OpenVPN as unprivileged user Gist (at gist.github.com)
21:54 -!- corretico [~luis@201.201.44.82] has joined #openvpn
22:00 <@vpnHelper> RSS Update - forum: connected to server but no ping response <http://forums.openvpn.net/topic9322.html#p18154>
22:02  * ecrist poofs for the night
22:11 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
22:11 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
22:13 <+EugeneKay> And a few more changes to that gist. Somebody take a read over it before I put 'er up on the wiki?
22:26 <@vpnHelper> RSS Update - forum: unable to write 'random state' -- should I be worried? <http://forums.openvpn.net/topic9320.html#p18155>
22:44 <@vpnHelper> RSS Update - forum: Where to Download VARS Files? <http://forums.openvpn.net/topic9319.html#p18156>
22:50 -!- saliak [~kailas@ip68-9-228-184.ri.ri.cox.net] has quit [Quit: saliak]
23:15 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
23:38 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 240 seconds]
23:38 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Ping timeout: 252 seconds]
23:41 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
--- Day changed Sun Dec 04 2011
00:11 <+EugeneKay> Hey, one of you guys with bot-powers, could you add this as !user or !unpriv or some such? https://community.openvpn.net/openvpn/wiki/UnprivilegedUser
00:12 <@vpnHelper> Title: UnprivilegedUser – OpenVPN Community (at community.openvpn.net)
00:30 -!- vpopov [~happylife@46.251.80.89] has joined #openvpn
00:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
00:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:48 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
00:49 -!- oc80z [oc80z@blea.ch] has joined #openvpn
00:50 -!- Zimsky [zimsky@rozznet.net] has joined #openvpn
01:40 -!- Guest30323 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
01:44 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
02:08 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
02:09 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
02:12 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
02:12 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
02:22 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:26 -!- vpopov [~happylife@46.251.80.89] has quit [Ping timeout: 248 seconds]
02:50 <+EugeneKay> !static
02:50 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
02:56 <+EugeneKay> So.... next I guess I should build a dynamic update script, or something.
02:57 -!- kloeri_ is now known as kloeri
03:10 -!- `Ile` [~kvirc@109-92-70-63.dynamic.isp.telekom.rs] has joined #openvpn
03:21 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
03:32 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 244 seconds]
03:38 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
03:44 -!- `Ile` [~kvirc@109-92-70-63.dynamic.isp.telekom.rs] has quit [Quit: Changing server...]
03:44 -!- `Ile` [~kvirc@109-92-70-63.dynamic.isp.telekom.rs] has joined #openvpn
03:51 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
04:04 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
04:05 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
04:51 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
04:55 <@vpnHelper> RSS Update - forum: China VPN <http://forums.openvpn.net/topic9296.html#p18157>
04:57 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Ping timeout: 258 seconds]
05:02 -!- jungfranckianer1 [~sallner@elcoco.ethz.ch] has joined #openvpn
05:06 -!- `Ile` [~kvirc@109-92-70-63.dynamic.isp.telekom.rs] has quit [Ping timeout: 258 seconds]
05:08 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
05:18 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
05:21 -!- `Ile` [~kvirc@178.222.173.155] has joined #openvpn
05:26 -!- mirco [~mirco@p5B285DE6.dip.t-dialin.net] has joined #openvpn
05:31 -!- mirco [~mirco@p5B285DE6.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
05:40 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has joined #openvpn
05:41 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has quit [Changing host]
05:41 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
05:54 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Read error: Connection reset by peer]
05:54 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:54 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
06:03 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Quit: danielsh]
06:06 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
06:20 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18159> || Cath 22 "Search" is really unhelpful... <http://forums.openvpn.net/topic9234.html#p18158>
06:30 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Read error: Connection reset by peer]
06:31 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
06:31 <@vpnHelper> RSS Update - forum: Ip forwarding via IPTABLES <http://forums.openvpn.net/topic9321.html#p18160>
06:39 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Read error: Connection reset by peer]
06:40 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
06:44 <@vpnHelper> RSS Update - forum: Ip forwarding via IPTABLES <http://forums.openvpn.net/topic9321.html#p18161>
06:53 -!- catsup [~d@ps38852.dreamhost.com] has quit [Remote host closed the connection]
06:54 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
--- Log closed Sun Dec 04 07:46:52 2011
--- Log opened Sun Dec 04 07:47:13 2011
07:47 -!- ecrist_ [~ecrist@jaguar-2-red.claimlynx.com] has joined #openvpn
07:47 -!- Irssi: #openvpn: Total of 5 nicks [0 ops, 0 halfops, 0 voices, 5 normal]
07:47 -!- Irssi: Join to #openvpn was synced in 39 secs
07:48 -!- WebDawg [~WebDawg@officialg0d.com] has joined #openvpn
07:48 -!- papsky [~papsky@119.11.8.218] has joined #openvpn
07:49 -!- Haraken [~ryuk@sigh.haraken.tsu-ji.jp] has joined #openvpn
07:52 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
07:52 -!- cali_ [~cali@91.220.163.18] has joined #openvpn
07:52 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:52 -!- Bruk0ut [~Bruk0ut@unaffiliated/brukout] has joined #openvpn
07:52 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
07:52 -!- Blue_Ice [~Blue_Ice@sid.dupas.be] has joined #openvpn
07:52 -!- tabakhase [t4b4kh453@rps9289.ovh.net] has joined #openvpn
07:52 -!- deever [~deever@78.46.68.172] has joined #openvpn
07:52 -!- dxtr [5d080d72@2a00:16d8:2:300::2] has joined #openvpn
07:52 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
07:52 -!- g0d [~zero@ip-97-74-121-225.ip.secureserver.net] has joined #openvpn
07:52 -!- civillia1 [~nickn@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
07:52 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
07:52 -!- Gnewt_ [~vector@submarine.gnewt.at] has joined #openvpn
07:52 -!- chantra [~chantra@ns353511.ovh.net] has joined #openvpn
07:52 -!- sia^pwnnt [8440sl1c3@owned.ninjasinpyjamas.biz] has joined #openvpn
07:52 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
07:52 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has joined #openvpn
07:52 -!- Olipro [~Olipro@2001:470:706d::] has joined #openvpn
07:52 -!- bigon [bigon@anor.bigon.be] has joined #openvpn
07:52 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
07:52 -!- Pilif12p [~Pilif12p@69.164.210.153] has joined #openvpn
07:52 -!- DarthGandalf [~Vetinari@sbras240.ras.nsu.ru] has joined #openvpn
07:52 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
07:52 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
07:52 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
07:52 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
07:52 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
07:52 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:52 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
07:52 -!- defswork [~andy@mx2.3gcomms.co.uk] has joined #openvpn
07:52 -!- Essobi [~Essobi@74-128-72-207.dhcp.insightbb.com] has joined #openvpn
07:52 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:52 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
07:52 -!- tty234 [telex@gateway/shell/anapnea.net/x-etigozmpctiggoku] has joined #openvpn
07:52 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
07:52 -!- twobitsp1ite [~isaac@li24-165.members.linode.com] has joined #openvpn
07:52 -!- nifigase [niko@luchshe.vdalnete.ru] has joined #openvpn
07:52 -!- Dougy [me@tech.qsi.net] has joined #openvpn
07:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:52 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
07:52 -!- Zimsky [zimsky@rozznet.net] has joined #openvpn
07:52 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
07:52 -!- jungfranckianer1 [~sallner@elcoco.ethz.ch] has joined #openvpn
07:52 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
07:52 -!- `Ile` [~kvirc@178.222.173.155] has joined #openvpn
07:52 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:52 -!- ServerMode/#openvpn [+o dazo_afk] by zelazny.freenode.net
07:52 -!- _zero__ [~zero@noc.toile-libre.net] has joined #openvpn
07:52 -!- fremo__ [~fremo@noc.toile-libre.net] has joined #openvpn
07:52 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
07:52 -!- MrPPS [~quassel@canyouget.in] has joined #openvpn
07:52 -!- fbh [fbh@lucifer.frands.net] has joined #openvpn
07:52 -!- ponyofdeath [~vladi@cpe-75-80-175-217.san.res.rr.com] has joined #openvpn
07:52 -!- _quadDamage [~EmperorTo@jaguar-2-red.claimlynx.com] has joined #openvpn
07:52 -!- gustav [~gustav@sockensaft.garagenwein.at] has joined #openvpn
07:52 -!- rawplayer [~foo@2001:610:158:1020:216:3eff:fe64:6606] has joined #openvpn
07:52 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
07:52 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
07:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:52 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
07:52 -!- Cain [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
07:52 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
07:52 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has joined #openvpn
07:52 -!- diytto [~diytto@2001:470:25:59c::1337] has joined #openvpn
07:52 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
07:52 -!- Champi [Champi@rootshell.fr] has joined #openvpn
07:52 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
07:52 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
07:52 -!- Ionic [ionic@ionic.de] has joined #openvpn
07:52 -!- Xeross [~Xeross@2605:8900:1000:1001:2:0:f:2] has joined #openvpn
07:52 -!- Cr4zi3 [killaz@66.55.76.11] has quit [Excess Flood]
07:53 -!- bauruine [~stefan@217.150.224.233] has joined #openvpn
07:53 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
07:53 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
07:53 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
07:53 -!- caesay_ [~caesay@socialshock.net] has joined #openvpn
07:53 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
07:53 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
07:53 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:53 -!- master_of_master [~master_of@p57B520E0.dip.t-dialin.net] has joined #openvpn
07:53 -!- zalzice_ [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
07:53 -!- _julian [~quassel@hmbg-4d06b0c2.pool.mediaWays.net] has joined #openvpn
07:53 -!- Mowee [~Mowi@lendabrain.net] has joined #openvpn
07:53 -!- madsage [~sage@io.ioio.com] has joined #openvpn
07:53 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
07:53 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
07:53 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
07:53 -!- bragon [~Alexandre@81.93.247.165] has joined #openvpn
07:53 -!- Hilarie [~Hilarie2@212.7.210.65] has joined #openvpn
07:53 -!- AL13N_work [~alien@91.183.52.232] has joined #openvpn
07:53 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
07:53 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
07:53 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
07:53 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
07:53 -!- dioz [~dioz@2001:470:1f11:12a9::1] has joined #openvpn
07:53 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
07:53 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
07:53 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
07:53 -!- [AFK|OOO] [~JoeGazz84@TechEssentials/JoeGazz84] has joined #openvpn
07:53 -!- jeev [1004@unaffiliated/jeev] has joined #openvpn
07:53 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
07:53 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
07:53 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
07:53 -!- __nolife [~Lirezh@83-64-53-66.kocheck.xdsl-line.inode.at] has joined #openvpn
07:53 -!- freaky[t]_ [alpha@freakyonline.de] has joined #openvpn
07:53 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
07:53 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
07:53 -!- mrsno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
07:53 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
07:53 -!- stsmith3 [~stsmith@207.86.232.19] has joined #openvpn
07:53 -!- mete [~mete@mete.shell.la] has joined #openvpn
07:53 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
07:53 -!- LuckyY [~LuckY@188.142.61.123] has joined #openvpn
07:53 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
07:53 -!- GHAI [~joti@cthulhu-isp.net] has joined #openvpn
07:53 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
07:53 -!- cherwin [1776628@xs8.xs4all.nl] has joined #openvpn
07:53 -!- ServerMode/#openvpn [+oo vpnHelper raidz] by zelazny.freenode.net
07:53 -!- R-66Y [~nobody@elegua.za.net] has joined #openvpn
07:54 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
07:56 -!- papsky [~papsky@119.11.8.218] has quit [Ping timeout: 244 seconds]
07:56 -!- fahadsadah [~fahad@equal.cluenet.org] has joined #openvpn
07:57 -!- kenyon [~kenyon@darwin.kenyonralph.com] has joined #openvpn
07:57 -!- jhp [~jhp@zeus.jhprins.org] has joined #openvpn
08:02 -!- mode/#openvpn [+ov cron2 oc80z] by ChanServ
08:02 -!- Haraken [~ryuk@sigh.haraken.tsu-ji.jp] has quit [Changing host]
08:02 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
08:02 -!- DarthGandalf [~Vetinari@sbras240.ras.nsu.ru] has quit [Changing host]
08:02 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
08:02 -!- Olipro [~Olipro@2001:470:706d::] has quit [Changing host]
08:02 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:02 -!- Xeross [~Xeross@2605:8900:1000:1001:2:0:f:2] has quit [Changing host]
08:02 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
08:02 -!- tabakhase [t4b4kh453@rps9289.ovh.net] has quit [Changing host]
08:02 -!- tabakhase [t4b4kh453@unaffiliated/tabakhase] has joined #openvpn
08:02 -!- kenyon is now known as Guest65337
08:02 -!- jhp is now known as 14WAAABHD
08:02 -!- Cain is now known as Guest31887
08:02 -!- fahadsadah is now known as Guest58241
08:03 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
08:04 -!- Guest8139 [~nb@2605:2700:1:1001::2] has joined #openvpn
08:06 -!- 14WAAABHD [~jhp@zeus.jhprins.org] has quit [Quit: leaving]
08:07 -!- Netsplit over, joins: rawplayer
08:07 -!- Netsplit *.net <-> *.split quits: EugeneKay, Champi, Guest31887, Xeross, Guest58241, Guest8139, diytto
08:07 -!- Kateon [482392@xs8.xs4all.nl] has quit [Ping timeout: 248 seconds]
08:08 -!- Netsplit over, joins: Champi
08:08 -!- Netsplit over, joins: diytto, EugeneKay
08:08 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
08:09 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
08:10 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
08:10 < hyper_ch> krzie: you know what SPDY is?
08:12 -!- corretico [~luis@201.201.44.82] has joined #openvpn
08:12 -!- corretico [~luis@201.201.44.82] has quit [Remote host closed the connection]
08:12 -!- corretico_ [~luis@201.201.44.82] has joined #openvpn
08:13 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has joined #openvpn
08:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:22 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
08:25 -!- You're now known as ecrist
08:32 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
08:32 -!- novaflash [~novaflash@openvpn/user/novaflash] has joined #openvpn
09:00 -!- kyrix [~ashley@mk089144206072.a1.net] has joined #openvpn
09:00 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:29 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:29 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
09:29 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:29 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
09:30 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:30 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
09:32 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:39 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has joined #openvpn
09:45 -!- Pilif12p [~Pilif12p@69.164.210.153] has quit [Changing host]
09:45 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
09:45 -!- Pilif12p is now known as Tannerbaum
09:49 -!- jungfranckianer1 [~sallner@elcoco.ethz.ch] has quit [Quit: Leaving.]
10:02 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
10:23 -!- Mrmarkfraser [~mrfraser@S0106001e6807ccc3.fm.shawcable.net] has joined #openvpn
10:23 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:25 < Mrmarkfraser> so what is openvpn
10:29 < Mrmarkfraser> ok, I see the website
10:29 < `Ile`> XD
10:29 < ecrist> lol
10:36 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Remote host closed the connection]
10:37 < Mrmarkfraser> what does it cost, after the free trial
10:45 -!- Mrmarkfraser [~mrfraser@S0106001e6807ccc3.fm.shawcable.net] has quit [Quit: Rooms • iPhone IRC Client • http://www.roomsapp.mobi]
10:54 < magic_1> guys, is there a way that i can have multiple networks in one ccd file
11:10 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has quit [Ping timeout: 244 seconds]
11:13 <@vpnHelper> RSS Update - forum: Building Openvpn 2.1.3 and dependencies on windows <http://forums.openvpn.net/topic9323.html>
11:21 < tabakhase> =) routing working, vpn-gateway "itself" working all on openvz virtuals :D
11:23 < tabakhase> now my setup looks like 10.1.* servers, 10.2.* moreServers,  10.15.255.254 internetGateway,  10.14.0.1 VPN
11:24 < tabakhase> is there a way to have a nice "user XY access to 10.1." && "user Z access to 10.1. and 10.15"
11:24 < tabakhase> ive seen that userDir stuff, but im missing a link how to do "that"
11:27 < tabakhase> echo "allow 10.2.0.0/16" > users/name    would be awesome
12:50 -!- vpopov [~happylife@46.251.80.89] has joined #openvpn
13:01 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Quit: danielsh]
13:01 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
13:02 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Client Quit]
13:03 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
13:03 -!- Guest65337 [~kenyon@darwin.kenyonralph.com] has left #openvpn []
13:16 -!- fahadsadah [~fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
13:20 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
13:40 -!- sigius [~sigius@93.125.185.45] has quit [Read error: Connection reset by peer]
13:44 <@vpnHelper> RSS Update - forum: Static Routing Question <http://forums.openvpn.net/topic9324.html>
13:57 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
14:03 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:07 < tabakhase> could i use the "generic" /etc/network/interfaces on my debian for doing the "openvpn --mktun --dev tap0" step?
14:17 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:18 < krzee> tabakhase, sounds like a good question for #debian
14:19 < tabakhase> krzee hm, isnt it more dedicated to openvpn itself? i think i remember some forum saying that "openvpn seems to not rly work with generic tap devices"
14:20 < krzee> really?
14:20 < krzee> they say that openvpn has its own special tap device?
14:21 < krzee> (tun / tap module comes with linux, not with openvpn)
14:22 < krzee> but also i misunderstood what you were asking
14:22 < krzee> i thought you were asking if that could run the exact command "openvpn --mktun --dev tap0" for you
14:22 < krzee> now i get what you meant
14:27 < tabakhase> hm, letting if do it could be an option...
14:27 < tabakhase> atm. im having a mdified /etc/init.d/openvpn
14:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: ZNC, Courtesy of OpenWRT]
14:29 < krzee> i dont even use the init scripts
14:49 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:52 -!- vpopov [~happylife@46.251.80.89] has quit [Remote host closed the connection]
14:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:03 <@vpnHelper> RSS Update - forum: Where to Download VARS Files? <http://forums.openvpn.net/topic9319.html#p18164>
15:08 < EugeneKay> tabakhase - If you're using the standard init scripts, you can create /etc/openvpn/openvpn.sh to do it
15:09 < EugeneKay> No modification needed.
15:09 < krzie> hey, cool
15:09 -!- `Ile` [~kvirc@178.222.173.155] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
15:09 < krzie> someone has been digging through the init scripts ;]
15:10 < EugeneKay> Aye. And I created a mod for them for su support.
15:10 < krzie> =]
15:10 < krzie> did you talk to ecrist bout getting on the wiki?
15:11 < EugeneKay> Yeah, it's a Firefox issue. Signed up using IE. 
15:11 < EugeneKay> https://community.openvpn.net/openvpn/wiki/UnprivilegedUser
15:11 <@vpnHelper> Title: UnprivilegedUser – OpenVPN Community (at community.openvpn.net)
15:22 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:23 < ecrist> krzie: I was more careful at this point. ;)
15:24 < ecrist> I've got 75 cartridge casings polished and ready for primer, powder, and bullets
15:24 < ecrist> :D
15:24 < ecrist> and a couple dozen .45 ACP for _quadDamage
15:28 < EugeneKay> Sexy.
15:33 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p18165>
15:36 -!- Mrmarkfraser [~mrfraser@S0106001e6807ccc3.fm.shawcable.net] has joined #openvpn
15:41 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:41 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:41 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:48 -!- Mrmarkfraser [~mrfraser@S0106001e6807ccc3.fm.shawcable.net] has left #openvpn []
16:21 < tabakhase> redone my openvz bridging setup, works \o/   i realy need to write this down...
16:22 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
16:22 < Xgates> hii guys
16:23 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:23 -!- nb [~nb@fedora/znc.nb] has quit [Read error: No route to host]
16:24 < ecrist> tabakhase: please do
16:24 < ecrist> !wiki
16:24 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
16:24 < EugeneKay> Hey ecrist, could you add !unpriv to the bot? 
16:24 < ecrist> what is it?
16:24 < EugeneKay> https://community.openvpn.net/openvpn/wiki/UnprivilegedUser
16:25 <@vpnHelper> Title: UnprivilegedUser – OpenVPN Community (at community.openvpn.net)
16:25 < ecrist> !learn noroot as See !unpriv for a writeup by EugeneKay
16:25 <@vpnHelper> Joo got it.
16:25 < ecrist> !learn unpriv as see https://community.openvpn.net/openvpn/wiki/UnprivilegedUser for a write-up by EugeneKay on how to run OpenVPN without root/admin permissions.
16:25 <@vpnHelper> Joo got it.
16:25 < Xgates> with OpenVPN, is it just as easy to set someone up to share a static ip, as it is to setup someone on their own static ip? I'm not sure why someone offering a VPN service would put customers on their own static IP, personally I don't like the idea and think that sharing a static is safer...
16:25 < ecrist> !noroot
16:25 <@vpnHelper> "noroot" is See !unpriv for a writeup by EugeneKay
16:25 < ecrist> !unpriv
16:25 <@vpnHelper> "unpriv" is see https://community.openvpn.net/openvpn/wiki/UnprivilegedUser for a write-up by EugeneKay on how to run OpenVPN without root/admin permissions.
16:26 < EugeneKay> Sexy.
16:26 < tabakhase> and you know it
16:26 < EugeneKay> Xgates - the question of which public IP is displayed is purely an iptables one.
16:26 < ecrist> Xgates: there's lots of reasons, and many different ways to configure openvpn
16:28 < Xgates> I mean the actual IP being displayed from the server when you are online...
16:28 < ecrist> yup
16:28 < ecrist> we know what you mean.
16:28 < Xgates> given static to just one customer...
16:28 < ecrist> we know what you mean.
16:28 < Xgates> ok, I just don't think this is as safe as sharing a static IP with thousands....
16:28 < Xgates> or can it be?
16:28 < Olipro> ...what
16:28 < ecrist> different uses for everyone
16:28 < EugeneKay> Depends what the provider's audit policy is.
16:29 < ecrist> depends on how a user is utilizing the vpn
16:29 < EugeneKay> As for as anonymity, many-users-on-one-IP is best, but one ban affects everybody.
16:29 < Olipro> are you talking about routing a global unicast to someone's VPN endpoint vs using NAT
16:29 < Olipro> if you have enough address space to do the former, it's superior to the latter
16:29 < EugeneKay> No, he's talking about redirect-gateway services.
16:29 < Xgates> I'm just talking about using a VPN service you find out there on the internet from some company...
16:29 < EugeneKay> And SNATing many customers to one IP vs one IP<--> customer
16:29 < Olipro> right, so using the VPN server as your default route
16:30 < Olipro> well as I said before, if you have 1 IP per customer, don't NAT it, assign it directly to their interface
16:30 < Xgates> I just thought with a mitm or someone sniffing it somewhere, could easily find the one person on the static over thousands sharing on the static...
16:30  * EugeneKay shrugs
16:30 < EugeneKay> If you want anonymity, don't use a commercial VPN service.
16:31 < Xgates> yes I know, but if we're saying Tor is a better option here, I don't know that is really such a great option...
16:32 < Xgates> I'm just talking more about small end-users wanting an option...
16:34 < tabakhase> but mew
16:34 < ecrist> Xgates: some people use a vpn service to  get a static IP somewhere they aren't present physically
16:34 < ecrist> or, they want to host a server with a static IP, and their ISP doesn't offer one
16:34 < ecrist> as long as they're connected to the VPN, they have their static IP.
16:34 < tabakhase> in bridged mode a useer can always "jump out" just by setting a route on his local OR by setting netmask on the eth1 (lan) interface...
16:34 < Xgates> yes, I'm talking about using a VPN service located in another part of the world, as a small end-user...
16:35 < ecrist> it's not just a 'don't figure out I'm browsing porn' measure
16:35 < ecrist> Xgates: so ami
16:35 < Xgates> tabakhase: what do you mean jump out?
16:35 < ecrist> I need to get back to this ldap shit now that my shells are done
16:36 < Xgates> EugeneKay: what do you suggest for anonymity?
16:36 < EugeneKay> Don't use a computer.
16:36 < Xgates> hehe
16:36 < EugeneKay> ecrist - before you do, care to give this a once-over, any obvious issues I missed? https://github.com/EugeneKay/scripts/blob/master/bash/ip-wrap.sh
16:36 <@vpnHelper> Title: bash/ip-wrap.sh at master from EugeneKay/scripts - GitHub (at github.com)
16:36 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
16:37  * ecrist looking
16:37 < Xgates> so no one here uses any VPN service? You guys just run your own servers?
16:37 < EugeneKay> It's just a stupid-simple wrapper to make sure openvpn doesn't try to do something like ip addr add dev eth0
16:37 < EugeneKay> I do, yup.
16:37 < Xgates> which use a service or run your own server?
16:38 < EugeneKay> Own servers.
16:38 < Xgates> so this is for your own private or you run a service?
16:38 < tabakhase> Xgates ServerConf: server-bridge 10.14.1.1 255.255.0.0 10.14.100.1 10.14.200.0     while br0 = inet addr:10.14.1.1  Mask:255.240.0.0     by default client only gets a 10.14.0.0 255.255.0.0 route, but when he "just adds" 10.1.0.0 255.255.0.0 10.14.1.1  as a route he can reach 10.1.1.1
16:38 < ecrist> I only run servers, i don't pay anyone for such.
16:38 < EugeneKay> My own corproate network
16:40 < Xgates> tabakhase: but what does jumping out mean?
16:40 < Xgates> what is the point here?
16:40 < tabakhase> Xgates "reaching 10.1.1.1 while "server-bridge 10.14.1.1 255.255.0.0" whould result in 10.14.*.*"
16:40 < ecrist> Xgates: not only do most in here run servers of their own, we specifically won't support end users of a service provider.
16:41 < ecrist> doing such is against channel policy
16:41 < Xgates> OpenVPN offers their own service, so as an example I would think this is reputable and this is all I'm trying to look out, big business, credible services to use...
16:41 < ecrist> indeed, we don't even support the openvpn-provided service
16:41 < EugeneKay> !as
16:41 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:41 < ecrist> our stance is that's up to their support staff
16:42 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
16:42 < ecrist> many of whom are here, in this channel. ;)
16:42 < ecrist> EugeneKay: script looks sane to me.
16:42 < ecrist> except it's in bash. ;)
16:42 < Xgates> ahh sorry access server I guess you guys mentioned that before, my bad...
16:43 < EugeneKay> It's sh-compatible(I checked), but I go with bash because it isn't the 1970s anymore.
16:43 < ecrist> your match syntax isn't sh compat
16:44 < EugeneKay> It isn't? Hrm, it worked.....
16:44 < ecrist> I avoid sh because I'm a freebsd guy, and I avoid things not in base freebsd
16:44 < Xgates> ok let me ask this then, I'm a Tech and a Geek, of course I'll be the first to admit I don't know everything, but who does it what I say, so, how hard would it be for an end-user to set up their own server to run for another box to give them their own privacy, security, anonymity, without using someone else's own servers, is there some where I can read how to do, for this purpose?
16:44 < EugeneKay> Oh, that was before I removed the extra lines
16:44 < EugeneKay> sh whines if you collapse it like that?
16:45 < EugeneKay> Xgates - next to impossible, !howto
16:45 -!- Hilarie [~Hilarie2@212.7.210.65] has quit [Quit: out!]
16:46 < ecrist> Xgates: look into tor
16:46 < ecrist> openvpn doesn't really "do" what you're looking for
16:46 < EugeneKay> Tor is the better option if you're after anonymity. OpenVPN is a more low-level tool meant for building networks.
16:46 < ecrist> EugeneKay: shit, that match syntax seems to work.
16:47 < ecrist> fuck me proper
16:47  * EugeneKay puts on his top-hat and drops his pantaloons
16:47 < ecrist> oh, wait
16:47 < Xgates> well I'm after anything I can get that is better then sitting on your own ips facing the net, so I went more for OpenVPN thinking this is a safer bet over Tor and it's exit nodes, as long as you go with a credible reliable company offering the VPN...
16:48 < krzie> [14:44]  <ecrist> I avoid sh because I'm a freebsd guy, and I avoid things not in base freebsd
16:48 < EugeneKay> It seems to work as-is on sh 4.1.
16:48 < krzie> i assume you meant you avoid bash
16:48 < ecrist> ecrist@Swordfish:~-> sh --version
16:48 < ecrist> GNU bash, version 3.2.48(1)-release (x86_64-apple-darwin11)
16:48 < ecrist> Copyright (C) 2007 Free Software Foundation, Inc.
16:48 < tabakhase> seems im ending up with multiple vpns... one for me and one for cooworkers to go to the DEV env....
16:48 < Xgates> I also didn't say anonymity EugeneKay until you brought it up I know OpenVPN doesn't really offer much here, I was more concerned about a single user on a static ip...
16:49 < ecrist> EugeneKay: the sh command is hard-linked to bash on Mac OS X, where I tested your code
16:49 < Xgates> I think OpenVPN offers better security then Tor
16:49 < EugeneKay> Though looking again, it seems that sh on loonix is bash run in sh-mode.
16:49 < EugeneKay> Yeah
16:49 < ecrist> when I use a proper sh, syntax errors abound
16:49 < Xgates> and privacy to a point...
16:49  * EugeneKay shrugs
16:49 < ecrist> ecrist@folsom-1:~-> sh
16:49 < ecrist> $ if [[ "foo" =~ ^f(oo|ar)$ ]]; then echo "YAY"; else echo "NAY"; fi;
16:49 < ecrist> Syntax error: "(" unexpected (expecting "then")
16:49 < tabakhase> Xgates at night is colder than outside
16:50 < Xgates> what is that suppose to mean?
16:50 < Xgates> hehe
16:50 < ecrist> Xgates: you're starting to annoy.
16:50 < ecrist> trollish behavior will be treated as such.
16:50 < ecrist> And it's 5pm here, and I'm drinking, so you'll get all that comes along with that, as well. ;)
16:50 < Xgates> I'm not being a troll I;m just trying to learn stuff
16:51 < ecrist> tor and openvpn serve disparate purposes.
16:51 < Xgates> of course they do...
16:51 < tabakhase> ecrist 5?! in 10 minutes it will be tomorrow in here
16:51 < ecrist> tor is more an anonymizer, whereas openvpn creates virtual private networks, and the name implies.
16:51 < ecrist> tabakhase: I'm in Minnesota
16:51 < ecrist> (USA)
16:52 < ecrist> I don't expect people outside the US to know all our states.
16:52 < tabakhase> ecrist europe/germany ;-)
16:52 < ecrist> I've always wanted to go to germany and bang a lot of hot german women.
16:52 < tabakhase> youre welcome, ive got a room on spare in my flat
16:53 < tabakhase> berlin ^^
16:53 < Xgates> yes I know these things on the simpler levels of the technology, I'm not a hardcore geek that understandings all the inner workings but I've been around Tor as long as it's been around from it's beginning, but I don't find it to be a safe choice, when compared to OpenVPN, even for it's lack of anonymity 
16:54 < tabakhase> Xgates vpn brings you somewhere, tor kicks you out of the bus somewhere in the dessert
16:54 < Xgates> EugeneKay: the howto bot command you gave before, was that suppose to give someone info I could check online for setting up a server?
16:56 < Xgates> that's an interesting way of telling it tabakhase :)
16:58 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
16:58 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
16:58 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
17:00 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
17:02  * ecrist now poofs to continue working on openvpn forum ldap plugin
17:28 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Ping timeout: 244 seconds]
17:36 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
17:42 -!- kyrix [~ashley@mk089144206072.a1.net] has quit [Quit: Ex-Chat]
18:02 -!- Denial [Denial@drgi.co.uk] has quit []
18:17 -!- civillia1 [~nickn@174.202.49.122-static.velocitynet.com.au] has left #openvpn []
18:23 -!- SteveXVII [~nullun@thezoo.in] has joined #openvpn
18:26 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Ping Timeout (0 Nano seconds)]
18:27 < tabakhase> great
18:27 < tabakhase> now im having multiple nixs with multiple tunnels/bridges for multiple vpns
18:28 < tabakhase> now "jail" ing them with smth thats not 'fakeable' iptables -A FORWARD -p ALL -i br1 -d \! 10.14.1.1/20 -j DROP
18:37 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
18:54 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
18:58 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
19:05 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
19:05 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
19:19 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:27 -!- mode/#openvpn [+v EugeneKay] by ChanServ
19:33 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:47 -!- _julian_ [~quassel@hmbg-5f77eae9.pool.mediaWays.net] has joined #openvpn
19:48 -!- _julian [~quassel@hmbg-4d06b0c2.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:56 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
20:11 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
20:12 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
20:12 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
20:12 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:12 -!- mode/#openvpn [+v Axeman] by ChanServ
20:18 -!- saliak [~kailas@ip68-9-228-184.ri.ri.cox.net] has joined #openvpn
20:19 -!- saliak [~kailas@ip68-9-228-184.ri.ri.cox.net] has quit [Client Quit]
20:20 -!- master_of_master [~master_of@p57B520E0.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
20:22 -!- master_of_master [~master_of@p57B540F4.dip.t-dialin.net] has joined #openvpn
20:33 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
20:37 -!- Essobi_ [~Essobi@74-128-55-37.dhcp.insightbb.com] has joined #openvpn
20:41 -!- Essobi [~Essobi@74-128-72-207.dhcp.insightbb.com] has quit [Ping timeout: 252 seconds]
20:47 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
21:13 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:16 < tabakhase> can i handOver the userCN to a tls-verify-script?
21:17 < tabakhase> seems im just getting the CA one... wtf
21:23 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
21:23 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
21:23 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:23 -!- mode/#openvpn [+v Axeman] by ChanServ
21:24 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Client Quit]
21:36 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
21:36 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
21:36 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:42 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
21:50 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
21:50 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
21:50 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:01 < tabakhase> <3 client-connect ...
22:07 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:07 -!- xizhendu [~xizhendu@li388-5.members.linode.com] has joined #openvpn
22:24 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
22:33 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has quit [Ping timeout: 255 seconds]
22:48 -!- corretico_ [~luis@201.201.44.82] has quit [Ping timeout: 240 seconds]
22:49 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
22:55 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
23:40 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
23:59 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
--- Day changed Mon Dec 05 2011
00:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
00:23 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
00:31 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
00:38 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:50 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:06 <@vpnHelper> RSS Update - forum: Lans behind OpenVPN <http://forums.openvpn.net/topic98.html#p18166>
01:24 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:28 -!- AL13N_work [~alien@91.183.52.232] has quit [Ping timeout: 248 seconds]
01:30 -!- Guest46131 [~root@218.248.24.19] has joined #openvpn
01:34 -!- Guest46131 [~root@218.248.24.19] has quit [Quit: Leaving]
01:42 <@vpnHelper> RSS Update - forum: Client on same LAN IP range as server causing problems. <http://forums.openvpn.net/topic9318.html#p18167>
01:44 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:48 <@vpnHelper> RSS Update - forum: Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html> || Client on same LAN IP range as server causing problems. <http://forums.openvpn.net/topic9318.html#p18168>
01:54 <@vpnHelper> RSS Update - forum: connected to server but no ping response <http://forums.openvpn.net/topic9322.html#p18171> || Where to Download VARS Files? <http://forums.openvpn.net/topic9319.html#p18170>
02:00 <@vpnHelper> RSS Update - forum: increase TLS handshake timeout during login? <http://forums.openvpn.net/topic9315.html#p18172>
02:13 -!- kyrix [~ashley@mk089144206072.a1.net] has joined #openvpn
02:32 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:32 -!- mode/#openvpn [+o mattock] by ChanServ
02:35 -!- gustav is now known as beerbro
02:37 <@vpnHelper> RSS Update - forum: How To Control DHCP Lease In OpenVPN <http://forums.openvpn.net/topic9273.html#p18173>
02:49 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18176> || Static Routing Question <http://forums.openvpn.net/topic9324.html#p18175> || Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18174>
02:50 -!- jungfranckianer [~sallner@elcoco.ethz.ch] has joined #openvpn
02:55 <@vpnHelper> RSS Update - forum: unable to write 'random state' -- should I be worried? <http://forums.openvpn.net/topic9320.html#p18177>
02:56 -!- newegggg [~newegggg@208.111.39.186] has joined #openvpn
02:57 < newegggg> why does openvpn becomes extremely slow and random times on my laptop?
02:57 < newegggg> i need to restart to fix it
02:57 < newegggg> at*
03:00 -!- mirco [~mirco@dslb-084-059-001-253.pools.arcor-ip.net] has joined #openvpn
03:00 <@vpnHelper> RSS Update - forum: Client on same LAN IP range as server causing problems. <http://forums.openvpn.net/topic9318.html#p18178>
03:07 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
03:17 <@vpnHelper> RSS Update - forum: Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18179>
03:24 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has joined #openvpn
03:34 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:53 <@vpnHelper> RSS Update - forum: VPN connecting but not working <http://forums.openvpn.net/topic9316.html#p18180>
03:58 -!- mirco [~mirco@dslb-084-059-001-253.pools.arcor-ip.net] has quit [Ping timeout: 248 seconds]
04:04 -!- AL13N_work [~alien@91.183.52.232] has joined #openvpn
04:04 <@vpnHelper> RSS Update - forum: Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18181>
04:12 -!- Cain [~Geek@unaffiliated/cain] has quit [Excess Flood]
04:12 -!- Guest33364 [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
04:32 -!- newegggg [~newegggg@208.111.39.186] has quit []
04:36 <@vpnHelper> RSS Update - forum: Static Routing Question <http://forums.openvpn.net/topic9324.html#p18182>
04:43 -!- dazo_afk is now known as dazo
04:44 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:44 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:46 -!- sigius [~sigius@93.125.185.45] has quit [Ping timeout: 244 seconds]
04:59 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
05:30 -!- _julian__ [~quassel@hmbg-4d06da55.pool.mediaWays.net] has joined #openvpn
05:31 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
05:31 -!- _julian_ [~quassel@hmbg-5f77eae9.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
05:45 -!- Guest33364 [~Geek@2001:41d0:1:f38f::1337] has left #openvpn []
05:46 -!- Cain [~Geek@2001:41d0:1:f38f::1337] has joined #openvpn
05:46 -!- Cain is now known as Guest49082
05:47 -!- Guest49082 [~Geek@2001:41d0:1:f38f::1337] has left #openvpn []
05:48 -!- Cain [~Geek@unaffiliated/cain] has joined #openvpn
06:07 <@vpnHelper> RSS Update - forum: Problems to get openvpn work on a strato v-server <http://forums.openvpn.net/topic9294.html>
06:31 <@vpnHelper> RSS Update - forum: easy-rsa pki <http://forums.openvpn.net/topic9326.html>
06:35 -!- iplux [~iplux@br-sh-1.sceur.ch] has joined #openvpn
06:45 -!- corretico [~luis@201.201.44.82] has joined #openvpn
06:49 -!- ravemaster [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has joined #openvpn
06:50 < ravemaster> Can I use one ip for protocol tcp and udp on two server conf?
06:55 <@vpnHelper> RSS Update - forum: VPN connecting but not working <http://forums.openvpn.net/topic9316.html#p18184>
07:18 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 258 seconds]
07:20 < ecrist> ravemaster: yes
07:21 < ravemaster> can you show me, I cant see any example of it on the openvpn manual on the openvpn.net
07:21 < ecrist> you just run two instances of the server process, each with a different protocol
07:22 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has joined #openvpn
07:23 -!- ivenkys [~ivenkys@unaffiliated/ivenkys] has quit [Quit: leaving]
07:23 -!- mode/#openvpn [+o ecrist] by ChanServ
07:23 -!- mode/#openvpn [+b *!*@unaffiliated/ivenkys] by ecrist
07:25 < ravemaster> ok but with only one ip? is that possible? wont openvpn complain that the ip is already used?
07:38 -!- dollabill [~mike@199.44.8.98] has joined #openvpn
07:41 <@vpnHelper> RSS Update - forum: OpenVPN single sign-in script for multi-server VPN service <http://forums.openvpn.net/topic8966.html#p18185>
07:43 -!- mrcoodles [~mrcoodles@f79-118-198-3.pitesti.rdsnet.ro] has joined #openvpn
07:44 -!- kyrix [~ashley@mk089144206072.a1.net] has quit [Ping timeout: 244 seconds]
07:46 <@ecrist> ravemaster: no,  because you're binding to separate protocols
07:46 < ravemaster> ok. thanks
07:46 < ravemaster> appreciate it.
07:52 -!- Blue_Ice [~Blue_Ice@sid.dupas.be] has quit [Changing host]
07:52 -!- Blue_Ice [~Blue_Ice@unaffiliated/blue-ice/x-2052838] has joined #openvpn
07:53 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 255 seconds]
07:54 < ravemaster> ecrist, can I not put port in the server conf?
08:05 -!- kyrix [~ashley@mk089144206135.a1.net] has joined #openvpn
08:07 -!- ravemaster [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has quit [Quit: Page closed]
08:12 -!- [AFK|OOO] is now known as JoeGazz84
08:35 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has quit [Quit: This computer has gone to sleep]
08:43 <@vpnHelper> RSS Update - forum: W7Server - Embedded Linux GSM Router <http://forums.openvpn.net/topic9237.html#p18186>
08:52 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
08:54 <@vpnHelper> RSS Update - forum: Routing Site-to-Site VPN traffic through the VPN <http://forums.openvpn.net/topic9327.html>
09:03 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
09:33 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 244 seconds]
09:43 <@vpnHelper> RSS Update - forum: easy-rsa pki <http://forums.openvpn.net/topic9326.html#p18188>
09:45 -!- Essobi_ is now known as Essobi
09:48 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
09:54 -!- j-chris [~j-chris@80.214.0.120] has joined #openvpn
09:54 < j-chris> hello
09:56 < j-chris> i would know if is possible to compress an vpn connection ?
09:57 < j-chris> for dicentred X server
09:59 < j-chris> for hunt the ko
09:59 <@vpnHelper> RSS Update - forum: Static Routing Question <http://forums.openvpn.net/topic9324.html#p18189>
10:08 < defswork> comp_lzo
10:10 < krzee> !lzo
10:11 < krzee> !compress
10:11 < krzee> heh, i tried
10:12 -!- ugo` [~user@host-78-149-123-206.as13285.net] has joined #openvpn
10:12 < ugo`> Hi all, I'm a bit stuck on a server config problem: I have a vnc server
10:12 < ugo`>        which is working. I have a gateway which I setup as a vnc client, from
10:12 < ugo`>        which I can connect to the vnc server correctly. My problem is that
10:12 < ugo`>        when I try to connect to the vnc from a computer that's behind the
10:12 < ugo`>        gateway, I can't access the computers on the other side of the
10:12 < ugo`>        vnc... I'm not sure where to look. Any help greatly appreciated.
10:13 < j-chris> i wouldi like to have an desktop in data center for high debit connection and a X server for low debit connection max 1Go per month
10:13 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
10:13 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
10:13 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
10:14 < j-chris> it's possible by vpn and lzo ??
10:17 -!- ugo` [~user@host-78-149-123-206.as13285.net] has left #openvpn ["ERC Version 5.3 (IRC client for Emacs)"]
10:20 -!- jungfranckianer [~sallner@elcoco.ethz.ch] has quit [Ping timeout: 244 seconds]
10:20 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:22 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
10:25 -!- Gravitron [~admin@64.93.145.58] has joined #openvpn
10:25 -!- Gravitron [~admin@64.93.145.58] has quit [Changing host]
10:25 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
10:48 -!- budoboy [~budoboy@ip-216-17-133-159.rev.frii.com] has joined #openvpn
10:49 -!- budoboy [~budoboy@ip-216-17-133-159.rev.frii.com] has left #openvpn []
10:54 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
11:01 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
11:09 -!- samradio [~samradio@ip-216-17-133-130.rev.frii.com] has joined #openvpn
11:10 < samradio> Can anyone help me with the Connect script not running on Linux command line client?
11:11 -!- budoboy [~budoboy@ip-216-17-133-159.rev.frii.com] has joined #openvpn
11:12 < budoboy> Hello
11:13 -!- dazo is now known as dazo_afk
11:14 < samradio> Can anyone help me with the Connect script not running on Linux command line client?
11:14 -!- iplux [~iplux@br-sh-1.sceur.ch] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
11:19 -!- gremly [~gremly@200.106.218.64] has quit [Ping timeout: 240 seconds]
11:20 < samradio> !welcome
11:20 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:21 -!- budoboy [~budoboy@ip-216-17-133-159.rev.frii.com] has left #openvpn []
11:21 < samradio> !goal
11:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:26 -!- kbarry [~chatzilla@76.252.176.116] has joined #openvpn
11:28 -!- j-chris [~j-chris@80.214.0.120] has quit [Ping timeout: 252 seconds]
11:28 <@vpnHelper> RSS Update - forum: Static Routing Question <http://forums.openvpn.net/topic9324.html#p18190>
11:28 < kbarry> Trying to use a Router with Tomato Firmware as an Access Point (All the clients need Static IP's) I'm more familiar with Server.
11:29 < kbarry> I'm sure i need to turn off the DHCP Server on the Router, but what else do i need to do? Is "Bridge" the same as "Access Point?
11:29 < kbarry> Maybe someone knows of a tut on this subject (Having a hard time finding it online.
11:38 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
11:42 -!- kbarry [~chatzilla@76.252.176.116] has quit [Ping timeout: 240 seconds]
11:46 -!- kbarry [~chatzilla@76.252.176.116] has joined #openvpn
11:46 <@vpnHelper> RSS Update - forum: Only IP address being given out? <http://forums.openvpn.net/topic9328.html>
11:53 -!- kbarry [~chatzilla@76.252.176.116] has quit [Ping timeout: 244 seconds]
11:53 < hyper_ch> good evening nice folks
11:54 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 258 seconds]
11:54 -!- kbarry [~chatzilla@76.252.176.116] has joined #openvpn
11:54 -!- kbarry [~chatzilla@76.252.176.116] has quit [Client Quit]
12:02 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:02 -!- mode/#openvpn [+o raidz] by ChanServ
12:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:09 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
12:09 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
12:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
12:16 <@vpnHelper> RSS Update - forum: Force push "redirect-gateway" on ONE client only <http://forums.openvpn.net/topic9329.html>
12:20 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Quit: danielsh]
12:21 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
12:21 -!- danielsh [~danielsh@apache/committer/danielsh] has quit [Client Quit]
12:22 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
12:25 -!- kyrix [~ashley@mk089144206135.a1.net] has quit [Ping timeout: 252 seconds]
12:30 -!- samradio [~samradio@ip-216-17-133-130.rev.frii.com] has quit [Quit: samradio]
12:41 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
12:41 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
13:06 -!- astrostl [~astrostl@68-188-73-250.static.stls.mo.charter.com] has joined #openvpn
13:19 -!- astrostl [~astrostl@68-188-73-250.static.stls.mo.charter.com] has quit []
13:29 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:29 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:32 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:32 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:32 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:32 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:33 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:33 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:33 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:33 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:33 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:33 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:33 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:33 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:34 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:34 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:34 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:34 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:34 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:34 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:34 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
13:42 -!- kyrix [~ashley@mk089144206135.a1.net] has joined #openvpn
13:46 -!- j-chris [~j-chris@80.214.0.114] has joined #openvpn
13:56 -!- astrostl [~astrostl@68-188-73-250.static.stls.mo.charter.com] has joined #openvpn
13:57 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
14:04 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
14:05 -!- kantlivelong [~kantlivel@68.195.251.2] has joined #openvpn
14:05 < kantlivelong> is there a maxium amount of connections for openvpn?
14:05 -!- dollabill [~mike@199.44.8.98] has quit []
14:05 < cjs226> my openvpn server is working but only uses certs for auth.  how can i also force a server-wide password that i can then rotate?
14:07 < kantlivelong> err
14:07 < kantlivelong> im looking to move away from our MPLS
14:08 -!- j-chris [~j-chris@80.214.0.114] has quit [Ping timeout: 245 seconds]
14:09 -!- novaflash is now known as novaflash_away
14:11 <@vpnHelper> RSS Update - forum: open special input ports for special users (port forward) <http://forums.openvpn.net/topic9330.html>
14:15 -!- Guifort_ [~Guifort@LOrleans-166-27-21-1.w193-250.abo.wanadoo.fr] has joined #openvpn
14:27 <@ecrist> kantlivelong: a single instance of openvpn is good up to about 250 connections
14:28 <@ecrist> in our experiences
14:28 < kantlivelong> ecrist: connections being within or actual vpn tunnels?
14:28 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18194>
14:33 <@ecrist> actual open connections
14:35 < kantlivelong> ecrist: do you know if openvpn supports failover interface and failover endpoint?
14:35 <@vpnHelper> RSS Update - forum: Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18195>
14:38 -!- npnth [~npnth@pdpc/supporter/active/npnth] has joined #openvpn
14:39 < npnth> Hello, I'm in a bit of a weird situation.  I had been using VirtualBox + bridged adapter + Sonicwall global client to connect to my company's vpn, but I'm wondering if openvpn can do the same thing.
14:40 < npnth> I know close to 0 about how everything is set up, and I've never actually set up an openvpn configuration before.
14:42 < npnth> All I really have to go on is a cryptic comment from our ex-sysadmin that support should be enabled, plus the xml config for the sonicwall client.  Is there some guide for how to write an openvpn config that's friendlier than the man page?
14:43 <@ecrist> kantlivelong: what do you mean?
14:43 <@ecrist> npnth: openvpn ONLY connects to openvpn
14:44 < npnth> ecrist: Oh, wow, I must really be misunderstanding things.  Sorry for the spam, then.
14:44 -!- npnth [~npnth@pdpc/supporter/active/npnth] has left #openvpn []
14:44 < kantlivelong> ecrist: example
14:44 <@ecrist> and, no, the man page is the one true source
14:44 < kantlivelong> ecrist: we have 2 wan connections at every location
14:45 < kantlivelong> ecrist: If WAN1 is down then use WAN2
14:45 < kantlivelong> if remote end WAN1 is down use remotes WAN2
14:45 < kantlivelong> complete WAN redundency
14:45 <@ecrist> that's up to your networking stuff, not really a function of openvpn
14:46 <@ecrist> openvpn CAN have multiple remote lines in the config though, and it will cycle through them trying to make a connection.
14:46 < kantlivelong> okay7
14:46 < kantlivelong> ecrist: but doesnt it specific interface?
14:47 <@ecrist> no.
14:47 < kantlivelong> ah
14:47 < kantlivelong> must be my router :P
14:47 < kantlivelong> it gives me any
14:47 < kantlivelong> i just dunno how it prioritizes
14:59 -!- j-chris [~j-chris@80.214.8.120] has joined #openvpn
15:15 -!- Guifort_ [~Guifort@LOrleans-166-27-21-1.w193-250.abo.wanadoo.fr] has quit [Quit: Quitte]
15:23 -!- j-chris [~j-chris@80.214.8.120] has quit [Ping timeout: 252 seconds]
15:23 -!- j-chris [~j-chris@80.214.8.33] has joined #openvpn
15:53 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
15:57 -!- sia^pwnnt [8440sl1c3@owned.ninjasinpyjamas.biz] has quit [Remote host closed the connection]
16:03 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:10 -!- Hilarie [~Hilarie@212.7.210.65] has joined #openvpn
16:11 < Hilarie> I am connecting to an open vpn on my ubuntu 11.04, and to do so, I must sudo openvpn --config client.ovpn but then, I can't do anything else on my computer that requires sudo, is there a workaround for this?
16:12 <+EugeneKay> You should be using the init scripts to launch openvpn
16:13 -!- BlaKHawk [blackhawk@blackhats.zeroday.us] has joined #openvpn
16:13 < BlaKHawk> hey i have a question i was hoping someone could try and help me clear up...
16:13 < Hilarie> but I want to be able to toggle it on and off
16:13 <+EugeneKay> !ask
16:13 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
16:13 <+EugeneKay> Hilarie - service openvpn start; service openvpn stop ;-)
16:14 < BlaKHawk> i am thinking of purchasing a vpn service and the vpn service uses openvpn as their client and i want to setup the vpn connection on my linux distro the thing is, my linux distro is through vmware so what i am wondering is if there is any special setup required to establish a vpn connection on linux when using vmware ?
16:15 < BlaKHawk> or am i going to have to setup the vpn connection on 
16:15 < BlaKHawk> my windows box and in theory then linux in wmware should have the vpn connection right?
16:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:17 < BlaKHawk> does anyone here have a setup simliar to mine and if you do what did you end up doing?
16:17 <+EugeneKay> You were here the other day; your question was asked & answered. VMware runs fine with openvpn client. Additionally, we do NOT support vpn services.
16:18 < BlaKHawk> actually i never got a clear answer really...
16:18 < BlaKHawk> but thank you for remembering me 
16:19 < BlaKHawk> i tried asking the vpn service but they were not sure which is why i am back, hoping maybe someone new is in here with a setup similar to mine
16:20 <+EugeneKay> It's vmware. It works. I used openvpn on vmware every day, zero issues.
16:20 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit []
16:26 < BlaKHawk> do you set up openvpn on your linux side or on the windows side ?
16:27 < kantlivelong> bah got booted
16:27 < kantlivelong> how does openvpn work for alot of site-to-site vpns?
16:30 <+EugeneKay> BlaKHawk - VMware ESXi doesn't have a "windows side" ;-)
16:30 < BlaKHawk> i heard somewhere that i can connect the guest os (linux) directly to the vpn server by using my network card by bridging, anyone have any ideas on what this means?
16:30 <+EugeneKay> kantlivelong - same as any otherp point-to-point tunnel. The easiest way, generally, is to run it on the router/gateway at both ends.
16:30 < BlaKHawk> i have heard of briding network cards before...
16:31 < BlaKHawk> EugeneKay: =-P
16:31 < kantlivelong> hmm
16:31 <+EugeneKay> !route
16:31 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
16:31 < kantlivelong> is there a maximum?
16:31 < kantlivelong> IE we have 9 sites
16:31 < kantlivelong> we need them to all be interconnected
16:31 <+EugeneKay> I'm sure there is, but it's something obscene like 65,000
16:31 < kantlivelong> so each router would have a policy per site
16:31 < kantlivelong> well actually technically sites dont need to talk to eachother..
16:31 < kantlivelong> hmm
16:32 <+EugeneKay> You're more likely to run into bandwidth / CPU constraints on the central server.
16:32 < kantlivelong> just to the main site
16:32 < kantlivelong> eh our pipe is only 10mb
16:32 < kantlivelong> :P
16:32 -!- newegggg [~newegggg@208.111.39.186] has joined #openvpn
16:32 <+EugeneKay> You may be interested in the --client-to-client directive(or the lack thereof).
16:32 < kantlivelong> for an entire site?
16:32 < newegggg> am routing all my internet traffic through openvpn... it works great until i open any bittorrent client on my pc... after a minute or so the connection stops working
16:32 <+EugeneKay> It's set on the server
16:32 < newegggg> any ideas?
16:33 <+EugeneKay> newegggg - BitTorrent uses lots and ots of open ports. It's probably your openvpn provider(which we do not support) shitlisting you.
16:33 < kantlivelong> EugeneKay: wouldnt i need X policies on all routers? 1 policy per endpoint?
16:33 < newegggg> i don't have an openvpn provider
16:33 < newegggg> i have a vps which i installed openvpn on myself
16:33 <+EugeneKay> kantlivelong - depends what your router is. With iptables you can just specify -i tun0
16:34 <+EugeneKay> And firewall 'em all the same
16:34 < kantlivelong> EugeneKay: i might be missing sumthin :P
16:34 < kantlivelong> so A,B, and C call all comunicate with eachother?
16:34 <+EugeneKay> If you don't use client-to-client you can firewall individual clients(on the server) such that they can't ever speak to each other
16:34 < kantlivelong> or does B and C require to go through A?
16:34 <+EugeneKay> It always goes via the Hub.
16:34 < newegggg> closing the torrent client and restarting the openvpn connection fixes it...
16:34 < kantlivelong> ah
16:34 <+EugeneKay> Openvpn doesn't do mesh networking; full stop.
16:34 < kantlivelong> ah
16:35 < kantlivelong> so for B&C to talk they gotta go through A?
16:35 <+EugeneKay> Correct.
16:35 < kantlivelong> bummer
16:35 < kantlivelong> wee bit of a bottleneck
16:35 < newegggg> it happens on two different laptops...
16:35 < newegggg> is it a server issue?
16:35 -!- j-chris [~j-chris@80.214.8.33] has quit [Quit: Quitte]
16:35 < newegggg> please help 
16:35 < kantlivelong> granted B & C never really communicate
16:35 <+EugeneKay> If you have servers A&B, and clients C-E, you can set it such that each client talks to both servers, and they use OSPF(via quagga) to determine the best path to the other client.
16:36 < kantlivelong> EugeneKay: its all routers.. ptp
16:36 < kantlivelong> no client sslvpns
16:36 <+EugeneKay> Server and Client only refers to their position as a Hub or Spoke in openvpn
16:36 <+EugeneKay> ;-)
16:36 < kantlivelong> ah
16:36 < kantlivelong> blasted
16:37 < kantlivelong> so our main site would use server mode
16:37 < kantlivelong> and endpoints client mode
16:37 <+EugeneKay> Full-mesh networking is technically possible, but it gets geometrical, quickly.
16:37 <+EugeneKay> Correct.
16:37 <+EugeneKay> Though how geographically dispersed are we talking here?
16:37 < kantlivelong> i see i see
16:37 < kantlivelong> same state
16:37 < kantlivelong> :P
16:38 < kantlivelong> different counties
16:38 <+EugeneKay> It may be worth it to you to buy a dedicated server in the "middle".... ah OK.
16:38 <+EugeneKay> So not too far at all
16:38 < kantlivelong> we currently have a MPLS
16:38 <+EugeneKay> Cross-country things start to get interesting.
16:38 < kantlivelong> im just not happy with it
16:38 <+EugeneKay> What's the ping time btween branches and the central?
16:38 < kantlivelong> its too restrictive
16:38 < kantlivelong> <13ms
16:38 <+EugeneKay> Then no worries at all.
16:38 <+EugeneKay> Worst-case, you get ~30ms of ping time from B to C
16:39 <+EugeneKay> Instead of 15
16:39 < kantlivelong> rarely does B~C talk
16:39 <+EugeneKay> So woop-de-doo
16:39 < kantlivelong> mostly all to the main site
16:39 < kantlivelong> terminal servers
16:39 <+EugeneKay> Gotcha.
16:39 <+EugeneKay> Openvpn should be great for you, then.
16:39 < kantlivelong> however
16:39 < kantlivelong> we have voip...
16:39 < newegggg> sounds like he's setting up a pedo vpn
16:39 < kantlivelong> so thats the bottleneck now that i think of it
16:39 <+EugeneKay> 30ms is well within the jitter specs of voip
16:40 < kantlivelong> 9 sites all going through a 10mb pipe though
16:40 <+EugeneKay> Bandwidth on your central may be a bit much
16:40 < kantlivelong> ack
16:40 <+EugeneKay> Can you buy a 100mb feed at the carrier's colo?
16:40 < kantlivelong> were on fiber so shouldnt be a problem
16:40 < kantlivelong> just pricy
16:40 <+EugeneKay> Drop a 1U in there and use that as your center ;-)
16:40 < kantlivelong> direct fiber feed
16:40 < kantlivelong> ive got 2x1U :P
16:41 < kantlivelong> a decent pfsense router
16:41 <+EugeneKay> Yeah, with fiber it's simply a matter of setting it from 10mb to 100mb. The glass has already been run.
16:41 < kantlivelong> hrm
16:41 < kantlivelong> yeah
16:41 <+EugeneKay> And the glass is the $$$
16:41 < kantlivelong> just overpriced :P
16:41 < kantlivelong> i think its the MPLS thats the expensive part
16:41 < kantlivelong> mesh would be better..
16:42 < kantlivelong> then again the MPLS isnt really mesh
16:42 < kantlivelong> it is but not when the edge router fails....
16:42  * EugeneKay shrugs
16:42 < kantlivelong> eh
16:42 <+EugeneKay> Up to you, mate.
16:42 < kantlivelong> damnit all
16:42 < kantlivelong> ipsec blows too
16:42 <+EugeneKay> Draw it out, figure the prices, flip a coin ;-)
16:43 < kantlivelong> i like openvpn definitly for sslvpn for users
16:45 -!- krzie [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
16:45 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
16:47 <@vpnHelper> RSS Update - forum: Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18196>
16:50 < BlaKHawk> okay well after trying out a trial vpn service i setup openvpn and their vpn client on windows 
16:50 < BlaKHawk> since windows is my host os on my laptop i established the vpn connection on windows
16:51 < BlaKHawk> when i load linux in vmware i went to whatismyip.com
16:51 < BlaKHawk> linux now has the vpn connection as well!
16:52 < BlaKHawk> so if anyone has a similar setup to mine if you set the vpn connection on the host os whether it is linux or windows when you load vmware any guest os will have the anonymous vpn connection as well
16:52 < BlaKHawk> "vmware it just works!" 
16:53 -!- Netsplit *.net <-> *.split quits: master_of_master
16:53 < Hilarie> okay, so I don't think I understood.. how can I run a vpn client, as a daemon(?) right now, I sudo openvpn --config client.ovpn and it connects, but then I can't sudo anything else
16:56 -!- Netsplit over, joins: master_of_master
17:12 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
17:12 < farciarz84> hi, I have set up vpn client onto my router tun0 interface. I'd like packages from my network come trough tun0 only when accessing 3 ip/hosts. How to set up iptables to block other packages may come trough tun0?
17:15 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:22 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Read error: No route to host]
17:25 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
17:31 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:43 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
17:44 -!- _zero__ [~zero@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
17:44 -!- fremo__ [~fremo@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
17:44 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
17:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
17:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:49 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
17:51 -!- Gravitron [~admin@131.238.237.196] has joined #openvpn
17:51 -!- Gravitron [~admin@131.238.237.196] has quit [Changing host]
17:51 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
17:55 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
17:55 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 244 seconds]
17:57 < tabakhase> hm
17:57 < tabakhase> route-gateway 10.15.255.254  inside the client seems to has no effect?
17:58 < krzie> things the server pushes override what the client says
17:58 < krzie> push it in a ccd entry, then it will matter
18:00 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 240 seconds]
18:02 < tabakhase> server is pushing "nothing", now a redirect-gateway  in the client seems to mather
18:03 < tabakhase> on the server i can see I 10.14.1.11 -> 213.165.64.75 8:0  floating in the bridge while im still connected to vpn (that disconnected when i just "hard" added the route on the client)
18:03 < tabakhase> that i can see the go but no response is another issue
18:06 < krzie> push it in a ccd entry, then it will override the setting that is being pushed already
18:07 < krzie> and i bet you do push it... if you think not post me your client log of it connecting
18:07 < krzie> and ill check for you
18:08 < krzie> you using tap, or tun with topology subnet?
18:14 < tabakhase> le server: http://nopaste.php-quake.net/117879    le client: http://nopaste.php-quake.net/117880
18:14 < tabakhase> i can see inet access from client floating to server, somewhere i need to add the info "use gateway on 10.15.255.254"
18:15 -!- newegggg [~newegggg@208.111.39.186] has quit [Ping timeout: 268 seconds]
18:17 -!- BlaKHawk [blackhawk@blackhats.zeroday.us] has quit [Quit: Lost terminal]
18:26 < tabakhase> spec. route-gateway 10.15.255.254 and  redirect-gateway  dosnt make anny difference
18:29 < krzie> did you read the manual?
18:30 < krzie> --server-bridge DOES push the setting i told you that you were pushing
18:30 < krzie> For example, server-bridge 10.8.0.4 255.255.255.0 10.8.0.128 10.8.0.254 expands as follows: 
18:30 < krzie> mode server
18:30 < krzie> tls-server
18:30 < krzie> ifconfig-pool 10.8.0.128 10.8.0.254 255.255.255.0
18:30 < krzie> push "route-gateway 10.8.0.4"
18:32 < tabakhase> so my client conf route-gateway 10.15.255.254  gets overwritten by the server pushing me "himself" as a gateway?
18:36 < krzie> yep, as expected
18:36 < krzie> thats why you dont need to route-gateway when you use --route
18:37 < krzie> i strongly recommend that you actually read (in the manual) about the config options you use
18:41 < tabakhase> added a route-gateway 10.15.255.254  on the server but client still sets "the server" as gateway, when i remove that routing manual and setup routing via the "real" gateway on the client manual ive got internet \o/
18:41 < krzie> well dude, the server SHOULD be the gateway
18:41 < krzie> what are you actually trying to do?
18:41 < tabakhase> vpnserver on 10.14.1.1 while "rest of the world as we know it" is on 10.15.255.254
18:42 -!- Denial [Denial@drgi.co.uk] has quit []
18:42 < krzie> umm, so just dont push redirect-gateway
18:42 < krzie> (assuming 10.15.255.254 is the normal default gateway)
18:43 < krzie> if that assumption is not correct, you should probably be more specific
18:44 < tabakhase> on the server the default gateway is eth0, but vpn clients should use another one (the 10.15.)
18:44 < krzie> so the 10.15.255.254 is over the vpn?
18:45 < tabakhase> jep
18:45 < krzie> just add 2 routes with /1
18:45 < krzie> 0.0.0.0/1 and 128.0.0.0/1
18:46 < krzie> that way you can specify the gateway (using the route config option)
18:46 < tabakhase> 128.?
18:46 < krzie> basically re-inventing def1
18:46 < krzie> !def1
18:46 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:47 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has quit [Quit: AAAGH!  IT BURNS!]
18:51 -!- troyt [~troyt@2001:5c0:1000:b::a06b] has joined #openvpn
18:53 < tabakhase> hm could i set these in client config?  or the "activate" of these or so? i want to have the option to "redirect internet also yes/no" on the client side while beeing on the sma vpn with the same ca//user
18:53 < tabakhase> so ccd would fail in my case
18:53 <@ecrist> have two vpn server instances
18:53 <@ecrist> one that hands out the redirect gateway and one that doesn't
18:55 < tabakhase> no way to combine them? so "client settings __always__ getting overwritten and there is no way to stop that"
18:55 <@ecrist> what do you mean?
18:55 < krzie> yes, you just put them in the client config
18:55 <@ecrist> you can do a --route-no-pull
18:55 < krzie> with --route
18:56 < krzie> you dont need to route-gateway
18:56 < krzie> --route has the option for gateway
18:56 <@ecrist> tabakhase: try reading the man page
18:56 < krzie> (which youd know if you looked at the manual, like i said earlier)
18:58 < tabakhase> im having it opene here
18:58 < tabakhase> but unable to glue the parts together
19:04 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
19:04 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
19:04 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
19:09 < tabakhase> its saying that "server-bridge" is expanden, fine so far, cant i just overwrite the params in "expanded state" or smth like that...
19:11 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
19:13 < krzie> wtf are you talking about?
19:13 < krzie> still talking about --route-gateway?
19:16 < tabakhase> server-bridge 10.15.255.254 255.240.0.0 10.14.1.10 10.14.1.253
19:16 < krzie> ...and?
19:16 < tabakhase> combined with a redirect-gateway def1  on the client seems to do the trick, decision on client side, routing still working to local, after disconnect routing correctly restored on client
19:17 < krzie> why are you using redirect-gateway def1?
19:17 < krzie> oh ok, you said it is working?
19:18 < tabakhase> without "def1" on disconnect my client gets fucked up with not restoring the old route (to local router)
19:18 < tabakhase> and yes, seems to work just fine
19:18 < krzie> well ya, thats why def1 exists ;]
19:18 < krzie> ok cool =]
19:19 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
19:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:21 < tabakhase> within that senario the vpn server itself is "not having" an ip address, is that correct?
19:22 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:22 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
19:25 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has joined #openvpn
19:26 < krzie> i dont bridge, try ifconfig -a to check that
19:26 < krzie> or look at the manual
19:26 < krzie> i wont be doing that for ya anymore
19:26 < krzie> !spoonfeeding
19:27 <@vpnHelper> "spoonfeeding" is http://www.mp3car.com/the-faq-emporium/53368-faq-what-is-spoon-feeding.html
19:27 < tabakhase> theres another issue annyway..
19:33 < tabakhase> hm, ok just an outdated routing
19:42 -!- _julian [~quassel@hmbg-5f76505d.pool.mediaWays.net] has joined #openvpn
19:44 < BlaKHawk> does anyone here have any recommendations for a vpn service ?
19:45 -!- _julian__ [~quassel@hmbg-4d06da55.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:46 < krzie> not i
19:46 < BlaKHawk> i have been looking around but i was hoping someone here might have some suggestions
19:47 < krzie> check the forum
19:47 < krzie> we made a section for that
19:48 < krzie> dunno how much it has tho
20:02 -!- carlasouza [~CarlaSouz@unaffiliated/carlasouza] has joined #openvpn
20:03 < carlasouza> hey guys, how do I connect to a openvpn server that does not require certificate? I'm using this line
20:03 < carlasouza> openvpn --client --comp-lzo --nobind --dev tap0 --auth-user-pass --remote <IP>
20:03 < carlasouza> but it gives me 
20:03 < carlasouza> Options error: You must define CA file (--ca) or CA path (--capath)
20:03 < krzie> !AUTHPASS
20:03 <@vpnHelper> "AUTHPASS" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
20:04 < krzie> oops c/l
20:05 < carlasouza> krzie: I tried #1 and got this: Options error: --auth-user-pass-verify requires --mode server
20:06 < carlasouza> same for #2
20:06 < carlasouza> same for #3. The thing is that the server is already configurated and working to authenticate only with usernames (ccd). I'm just trying to connect from a ubuntu client using the command line
20:07 -!- fremo [~fremo@noc.toile-libre.net] has quit [Read error: Connection reset by peer]
20:07 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
20:14 < tabakhase> :D my dropbox LAN discovery is now spamming my server vlan xD
20:14 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
20:14 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
20:17 < krzie> carlasouza, then use a working config
20:17 < krzie> !--
20:17 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
20:20 -!- master_of_master [~master_of@p57B540F4.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:22 -!- master_of_master [~master_of@p57B54102.dip.t-dialin.net] has joined #openvpn
20:25 <@vpnHelper> RSS Update - forum: Port Forwarding to Client for IP Camera <http://forums.openvpn.net/topic9331.html>
20:32 < carlasouza> krzie: thansk for you awnser :)
20:32 -!- carlasouza [~CarlaSouz@unaffiliated/carlasouza] has left #openvpn ["WeeChat 0.3.4"]
20:45 -!- Gnewt_ is now known as Gnewt
20:50 -!- ananie [~ananie@85.17.29.117] has joined #openvpn
20:51 < ananie> Hi, I have a friend trying to help with openvpn server settings, and this is what it says when client trys to connect
20:51 < ananie> WARNING: Since you are using --dev tap, the second argument to --ifconfig must be a netmask, for example something like 255.255.255.0. (silence this warning with --ifconfig-nowarn)
20:52 < ananie> he don't understand what can I tell him to try and fix?
20:52 < ananie> I think he just needs to add netmask that is wrong or missing?
20:54 < tabakhase> thats at least what the error message is saying
20:55 < ananie> ok I guess it's pretty clear to see then, but I want to check....
20:55 < ananie> thanks
20:55 -!- ananie [~ananie@85.17.29.117] has quit [Quit: Ping Timeout (0 Nano seconds)]
20:56 < tabakhase> im just gessing, so dont blame on me when im wrong, i used openvpn first time less than 72hours ago :D
21:04 <+EugeneKay> The actual problem there is that he's using bridging(dev tap)
21:08 < tabakhase> my bridging is working just fine =) but yes it had taken some time and a shitload of modifications
21:11 < krzie> his problem was likely static ip related
21:11 < krzie> !static
21:11 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
21:13 <+EugeneKay> I'm cold.
21:20 < tabakhase> im tied.. 4:20am in here -.-
21:22 < tabakhase> leavinf now, kthxbye
21:22 < krzie> happy 420
21:22 < krzie> ill bbl too
21:26 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 252 seconds]
21:26 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
21:28 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
21:37 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
22:02 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Remote host closed the connection]
22:10 -!- newegggg [~newegggg@124.78.164.55] has joined #openvpn
22:15 -!- newegggg [~newegggg@124.78.164.55] has quit [Ping timeout: 252 seconds]
22:51 -!- astrostl [~astrostl@68-188-73-250.static.stls.mo.charter.com] has quit []
23:53 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has quit [Quit: Lost terminal]
--- Day changed Tue Dec 06 2011
00:17 <@vpnHelper> RSS Update - forum: open special input ports for special users (port forward) <http://forums.openvpn.net/topic9330.html#p18199> || Bridged Access Server and Client <http://forums.openvpn.net/topic9267.html#p18198>
00:17 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
00:35 <@vpnHelper> RSS Update - forum: Prevention of revealing IP should a server go down <http://forums.openvpn.net/topic9312.html#p18200>
00:37 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
00:46 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
00:46 <@vpnHelper> RSS Update - forum: How don't use the default VPN interface / only on my VM <http://forums.openvpn.net/topic9266.html#p18201>
00:53 <@vpnHelper> RSS Update - forum: Force push "redirect-gateway" on ONE client only <http://forums.openvpn.net/topic9329.html#p18202>
01:03 -!- novaflash_away is now known as novaflash
01:04 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has joined #openvpn
01:05 <@vpnHelper> RSS Update - forum: OpenVPN single sign-in script for multi-server VPN service <http://forums.openvpn.net/topic8966.html#p18203>
01:10 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
01:10 <@vpnHelper> RSS Update - forum: [REQ] How To Make OpenVPN server Management <http://forums.openvpn.net/topic9317.html#p18204> || [Resolved] connected to server but no ping response <http://forums.openvpn.net/topic9322.html#p18171>
01:11 < farciarz84> good morning
01:13 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:17 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-15.html#p18205>
01:18 < farciarz84> I've set up vpn client onto my router. How to limit packages going trough tun0? I want to restrict that only when accessing 3 ip addresses/host packages going there. 
01:35 -!- bauruine [~stefan@217.150.224.233] has quit [Remote host closed the connection]
01:39 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has quit [Ping timeout: 248 seconds]
01:57 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Read error: Connection reset by peer]
02:12 -!- AL13N_work [~alien@91.183.52.232] has left #openvpn []
02:13 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
02:17 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has joined #openvpn
02:17 < farciarz84> Hi, I need some help with defining iptables rules. I would like to block packages that may come trough tun0 onto my router with exception to 3 hosts.
02:19 < hyper_ch> krzee: dazo_afk: ecrist: http://techcrunch.com/2011/12/05/dnscrypt-encrypts-your-dns-traffic-because-theres-always-someone-out-to-get-you/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29
02:23 <+EugeneKay> OpenDNS is such garbage
02:23 < hyper_ch> EugeneKay: why?
02:23 < hyper_ch> what bad thing has OpenDNS ever done to you?
02:23 <+EugeneKay> Big reason is they return their own search pages instead of NXDOMAIN
02:24 < hyper_ch> EugeneKay: well, they did put the secureDNS into github... so you can setup your own nameserver and integrate it
02:24 -!- BlaKHawk [blackhawk@exploits.dotslash.ca] has quit [Quit: leaving]
02:24 < hyper_ch> farciarz84: iptables works with host names?
02:26 < bjorneven> sounds expensive
02:26 < hyper_ch> what is?
02:26 < bjorneven> filtering hosts, not ip's
02:27 < hyper_ch> well, I was unaware of iptables being able to use hostnames instead of IP addresses
02:28 < bjorneven> any secure way to get openvpn to store username and password ?
02:28 < bjorneven> on windows anyway
02:28 < farciarz84> hyper_ch: whatever, ip can be either
02:29 < bjorneven> my mac os x client does this, stores it in a keychain
02:29 < bjorneven> tunnelblick or something
02:29 < hyper_ch> secure and windows are two terms mutually exclusive IMHO :)
02:29 < bjorneven> the only way I have figured out is storing in a plain text file
02:31 < hyper_ch> bjorneven: I just use passwordless keys
02:32 < bjorneven> so you distribute clients with certificates instead
02:33 < bjorneven> haven't thought about that
02:49 < hyper_ch> yes, and if I don't want a client anymore, I revoke the cert
02:50 < hyper_ch> of course it'd be better if the certs also have a password... but I do trust mx *nix and full harddisk encryption
02:51 < bjorneven> the problem here is that there are so many passwords to remember, and they forget this each time they are out travelling and call me instead
02:53 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has joined #openvpn
02:56 -!- kyrix [~ashley@mk089144206135.a1.net] has quit [Ping timeout: 248 seconds]
02:56 < hyper_ch> bjorneven: consider passwordless certificates
02:56 < hyper_ch> !howto
02:57 <+EugeneKay> I have all of my passwords stored in a plain txt file inside of a TrueCrypt volume, whose passphrase is quite long.
02:57 <+EugeneKay> The individual passes are mostly just spat-out random characters.
02:58 < hyper_ch> for websites I use pwdhash.com
02:58 < hyper_ch> enter domain name and master password and you'll get a hashed one
02:58 < hyper_ch> there's even an addon for FF and Chromium
02:58 < bjorneven> why not use 16 char passwords with normal words
02:58 < bjorneven> instead of cryptic ones
02:59 <+EugeneKay> Because there's no way I'd remember several hundred normal-word phrases
02:59 < hyper_ch> in some instances you can't use too long passphrases
02:59 < bjorneven> both true
02:59 <+EugeneKay> My options are to rotate a coupla passphrases, use the same one everywhere, or write 'em down someplace.
02:59 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
02:59 <+EugeneKay> I choose #3 ;-)
02:59 < hyper_ch> my smartcard with my digital signature can only have 8-12 chars
03:00 < bjorneven> i just wanted to make a point about cryptic pwd ppl use, instead of choosing a long one they can remember
03:00 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
03:00 < hyper_ch> bjorneven: you use firefox? hashpwd addon is really nice for FF
03:00 < bjorneven> idiotic password rules sometimes block those though
03:00 < bjorneven> hyper_ch: im on mosaic 0.99
03:00 < bjorneven> eh
03:00 < bjorneven> :D
03:00 <+EugeneKay> I wish more sites supported PKI auth
03:00 < hyper_ch> :)
03:00 <+EugeneKay> I would KILL to be able to use a smartcard 
03:01 <+EugeneKay> Wham, bam, done.
03:01 < hyper_ch> plese don't kill me
03:01 <+EugeneKay> Remove my card from the reader, I'm un-authenticated. Easy.
03:01 < hyper_ch> it's not that simple as I've found out :(
03:01 <+EugeneKay> It's a heckuva lot simpler than TrueCrypt volumes
03:01 < bjorneven> I bought a opengpg smart card ones
03:01 < hyper_ch> how do you even implement pki auth?
03:02 <+EugeneKay> And it's a solution that even stupid users could work out
03:02 < bjorneven> encrypted my mails with thunderbird and opengpg plugin
03:02 < hyper_ch> you underestimate the stupidness of users
03:02 < hyper_ch> btw, I have one issue: when my email cert expires, I can't read the encrypted email anymore, right?
03:02 <+EugeneKay> Explain it to them in simple terms. You need a keycard, and the keycard needs a password. Easy.
03:04 < hyper_ch> :)
03:04 <+EugeneKay> It doesn't have to be any more complicated than starting a car.
03:04 < hyper_ch> it has to
03:04 < hyper_ch> :)
03:04 <+EugeneKay> It is, because programmers suck.
03:05 < hyper_ch> so, website XXX offers pki auth
03:05 < hyper_ch> how will it know that I'm me?
03:05 < hyper_ch> I have to give them my public cert, right?
03:05 <+EugeneKay> That's how PKI works, yup.
03:05 < hyper_ch> and what when the cert expires?
03:05 <+EugeneKay> It's no different than they know that you're hyper_ch.
03:05 < hyper_ch> you'll get a new know
03:05 < hyper_ch> a new one
03:05 <+EugeneKay> You better update it :-p
03:05 < hyper_ch> but that will be incompatible to the previous public key?
03:06 < hyper_ch> so you'll have to update it everywhere before it expires?
03:06 <+EugeneKay> If it has the same private key, they can compar moduli
03:06 < hyper_ch> how can it be the same private key?
03:06 < hyper_ch> isn't the private key altered because of a different expiration date?
03:06 <+EugeneKay> Nope.
03:07 <+EugeneKay> Expiration deals with the public cert only(on x.509 pki, anyway)
03:07 <+EugeneKay> You can sign the same private key as much as you like.
03:07 <+EugeneKay> It's good practice to change private keys when you get a fresh pubkey, but not necessary.
03:07 <+EugeneKay> s/pubkey/cert/
03:09  * EugeneKay crawls under rock to zzzz
03:12 < hyper_ch> EugeneKay: good :)
03:13 < hyper_ch> happy zzzzing
03:23 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has joined #openvpn
03:26 < hyper_ch> krzee: dazo_afk: ecrist: EugeneKay: google is splitting up the web even more http://googlewebmastercentral.blogspot.com/2011/12/new-markup-for-multilingual-content.html
03:33 -!- _julian [~quassel@hmbg-5f76505d.pool.mediaWays.net] has quit [Quit: No Ping reply in 180 seconds.]
03:34 -!- _julian [~quassel@hmbg-5f76505d.pool.mediaWays.net] has joined #openvpn
03:42 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:04 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
04:04 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
04:05 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has quit [Quit: Ex-Chat]
04:11 -!- mrcoodles [~mrcoodles@f79-118-198-3.pitesti.rdsnet.ro] has quit [Quit: Lost terminal]
04:12 -!- sia^pwnnt [115kluu@server1.bouncer4you.de] has joined #openvpn
04:18 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has joined #openvpn
04:52 -!- dazo_afk is now known as dazo
04:52 -!- farciarz94 [~farciarz@dynamic-78-8-48-201.ssp.dialog.net.pl] has joined #openvpn
04:53 -!- farciarz84 [~farciarz@unaffiliated/farciarz84] has quit [Ping timeout: 252 seconds]
05:17 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
05:37 -!- dazo is now known as dazo_afk
05:38 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
05:38 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
05:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:58 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:00 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit []
06:01 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
06:10 -!- AcidBurn` [moi_moi.fr@lau18-1-82-246-196-145.fbx.proxad.net] has joined #openvpn
06:10 < AcidBurn`> bonjour
06:10 < AcidBurn`> French ?
06:13 < bjorneven> not me
06:33 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 248 seconds]
06:34 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:38 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
06:47 < AcidBurn`> I can not install openvpn. Could someone help me please?
06:49 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
06:50 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
06:51 -!- oc80z [oc80z@blea.ch] has joined #openvpn
06:55 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
07:10 -!- d12fk [~heiko@exit0.net] has joined #openvpn
07:11 -!- d12fk [~heiko@exit0.net] has left #openvpn ["?RETURN WITHOUT GOSUB"]
07:12 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has quit [Quit: This computer has gone to sleep]
07:20 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:29 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Quit: Leaving]
07:30 < bjorneven> AcidBurn`: be more specific
07:31 < AcidBurn`> French ?
07:33 < bjorneven> no
07:35 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:56 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
07:57 < farciarz94> Hi, I need some help with defining iptables rules. I would like to block packages that may come trough tun0 onto my router with exception to 3 hosts. Please tell me how the rule should look like
08:00 < bjorneven> farciarz94:  you asked earlier and did not respond to questions
08:01 < bjorneven> farciarz94: but this is not openvpn related directly is it ?
08:02 < farciarz94> it's not 
08:02 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
08:02 < farciarz94> but prehabs you have eperience with that 
08:03 < farciarz94> on #netfilter nobody wants to help me
08:03 < bjorneven> yes make 3 rules that -j DROP the src ip incoming on tun0
08:03 < bjorneven> #linux perhaps
08:04 < farciarz94> bjorneven: problably I should have POLICY DROP and -j ACCEPPT
08:04 < bjorneven> maybe 
08:05 < bjorneven> iptables -A INPUT -s the.ip  -i tun0  -j DROP
08:05 < bjorneven> something like that
08:19 <@ecrist> #netfilter is the proper place
08:25 -!- stsmith3 [~stsmith@207.86.232.19] has quit [Read error: Connection reset by peer]
08:42 -!- kopf [kopf@spoon.netsoc.tcd.ie] has joined #openvpn
08:44 < kopf> trying to connect to my home vpn, it seems to connect (e.g. http://pastebin.com/UXD2b1bZ ) but no tap interface on my localhost is created (ubuntu 11.10)
08:44 < kopf> client config is http://pastebin.com/QYbRPtEh
08:46 < kopf> server config I can't get to right now, but it's a router running tomatousb with a TAP openvpn-server running over UDP port 443, which is forwarded (can connect over telnet when I forward using the same rule only with TCP instead of UDP)
08:46 < kopf> anyone know what might be up?
08:46 -!- thebishop [~thebishop@66.187.140.174] has joined #openvpn
08:47 < thebishop> hello, is it possible to assign openvpn groups with ldap groups?
08:47 <@ecrist> kopf: do you have the tun/tap kernel driver installed?
08:47 <@ecrist> thebishop: I don't understand your question
08:47 -!- runa [~asd@190.210.67.161] has joined #openvpn
08:48 < runa> heyas. I've configured a fixed ip addr in ipp.txt but openvpn is assigning a different one to my client. any hints?
08:48 <@ecrist> !ccd
08:48 < kopf> ecrist: I believe so - I can connect to a different vpn using TUN.
08:48 -!- Irssi: #openvpn: Total of 133 nicks [5 ops, 0 halfops, 1 voices, 127 normal]
08:49 <@ecrist> hrm, where did vpnHelper go?
08:49 < kopf> ecrist: http://pastebin.com/EKXcE8QY result of lsmod
08:49 < thebishop> ecrist, as in, openvpn connects a user to the proper subnet based on their ldap group
08:49 < runa> ecrist: was that for me?
08:51 <@ecrist> thebishop: you can do that, but you'll have to write the scripts to handle that
08:52 <@ecrist> client-connect is what you're looking for in the man page
08:53 < thebishop> ecrist, ok thanks
08:59 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
08:59 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:15 < runa> any hints about openvpn server not obeying my ipp.txt and assigning other ip addresses?
09:15 <@ecrist> runa, you need ccd, not ipp.txt
09:15 <@ecrist> !static
09:15 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
09:17 < runa> ecrist: tnx
09:17 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:18 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:19 -!- DJ-Ineedateam1 [~DJ@c-76-121-245-174.hsd1.wa.comcast.net] has joined #openvpn
09:27 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
09:27 -!- runa [~asd@190.210.67.161] has quit [Read error: Connection reset by peer]
09:54 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has quit [Quit: Ex-Chat]
09:55 < kopf> ecrist: i've managed to get something half-working using the gnome-network applet, and exported that config as a file which is here http://pastebin.com/9tQVsmKM . However, when I connect, I can't reach any computers, I think because my eth0 is 192.168.0.x and my home network is 192.168.1.x. Any ideas?
10:00 <@ecrist> both ends need to be able to route to eachother
10:05 < kopf> ecrist: i'm bridging, though
10:06 -!- DJ-Ineedateam1 [~DJ@c-76-121-245-174.hsd1.wa.comcast.net] has left #openvpn ["Leaving"]
10:11 <@ecrist> so?
10:12 <@ecrist> if you're on different subnets, you need to route between the two
10:12 < thebishop> i'm following this guide http://openvpn.net/index.php/access-server/docs/admin-guides/411-access-server-post-auth-script.html to assign vpn group by ldap group.  But when i run ./sacli, it says "ERROR: unknown command 'auth.module.post_auth_script'"
10:12 <@vpnHelper> Title: Access Server Post-Auth Script/Host Checking (at openvpn.net)
10:13 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:13 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:18 < tabakhase> so, sleept some hours, eaten some stuff, chilled a round, 5pm and time to start going further \o/
10:20 <@ecrist> thebishop: we don't support access server here
10:20 <@ecrist> !as
10:20 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
10:23 -!- thebishop [~thebishop@66.187.140.174] has quit [Ping timeout: 252 seconds]
10:31 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:39 < tabakhase> what exacly is the "split" between openvpn itself and that special "access server" your talking about?
10:40 < tabakhase> isnt every openvpn server kind of a access server?
10:45 <@ecrist> AS is a commercial product
10:46 < tabakhase> but same software? so a service like a vpn exitNode for cloaking your traffic?
10:47 -!- kopf [kopf@spoon.netsoc.tcd.ie] has left #openvpn []
10:47 <@ecrist> it's different, and incompatible
11:19 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:19 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:21 -!- bjorneven_ [~quassel@122.85-200-248.bkkb.no] has joined #openvpn
11:23 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Ping timeout: 240 seconds]
11:23 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Ping timeout: 240 seconds]
11:24 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
11:27 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
11:27 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
11:27 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:32 -!- Azrael808 [~peter@31.107.11.153] has joined #openvpn
11:32 -!- Azrael808 [~peter@31.107.11.153] has quit [Read error: Connection reset by peer]
11:39 <@vpnHelper> RSS Update - forum: How To Control DHCP Lease In OpenVPN <http://forums.openvpn.net/topic9273.html#p18226>
11:41 -!- LuckyY [~LuckY@188.142.61.123] has quit [Read error: Connection reset by peer]
11:42 -!- LuckyY [~LuckY@188.142.61.123] has joined #openvpn
11:51 <@vpnHelper> RSS Update - forum: OpenVPN single sign-in script for multi-server VPN service <http://forums.openvpn.net/topic8966.html#p18227>
12:03 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html>
12:27 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
12:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:33 <@vpnHelper> RSS Update - forum: Force push "redirect-gateway" on ONE client only <http://forums.openvpn.net/topic9329.html#p18230> || route ADD on Windows... <http://forums.openvpn.net/topic9334.html>
12:49 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 252 seconds]
12:50 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:02 -!- folivora [bomshiva@koekaniini.kelju.fi] has joined #openvpn
13:21 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:21 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Excess Flood]
13:22 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 244 seconds]
13:36 < Hilarie> How on ubuntu 11.04 would I start openvpn as a daemon, right now, when I start it, I sudo openvpn --config client.ovpn but that makes it so I can't use sudo for anything else
13:45 <@vpnHelper> RSS Update - forum: PAM Athentication using a script based on PHP or Html, help! <http://forums.openvpn.net/topic9301.html#p18231>
13:49 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
13:52 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
13:52 -!- mode/#openvpn [+v Axeman] by ChanServ
14:15 <@vpnHelper> RSS Update - forum: openvpn on linux <http://forums.openvpn.net/topic9335.html>
14:32 -!- thebishop [~thebishop@66.187.140.174] has joined #openvpn
14:36 < thebishop> hello, I used this guide http://openvpn.net/index.php/access-server/docs/admin-guides/411-access-server-post-auth-script.html to set up vpn authentication such that users are assigned to vpn groups (subnets) by LDAP group assignment.  i got the script loaded, but after restart, vpn authentication was completely broken, and the lots said the script failed looking for a "memberOf" attribute
14:36 <@vpnHelper> Title: Access Server Post-Auth Script/Host Checking (at openvpn.net)
14:36 < thebishop> *the logs, i mean
14:37 < Hilarie> thebishop access server help can be found at #openvpn-as
14:37 < thebishop> Hilarie, thanks
14:38 -!- corretico [~luis@201.201.44.82] has quit [Ping timeout: 240 seconds]
14:40 <@ecrist> thebishop: we don't care what guide you used
14:40 <@ecrist> we do not support access server, though
14:40 <@ecrist> I've told you that before
14:40 <@ecrist> !as
14:40 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
14:40 < thebishop> ecrist, sorry, i posted before and then got disconnected
14:40 < thebishop> must've missed your response
14:41 <@ecrist> you were disconnected 3 minutes after I posted
14:41 <@ecrist> 10:20:18 <@ecrist> thebishop: we don't support access server here
14:41 <@ecrist> 10:20:19 <@ecrist> !as
14:41 < thebishop> ecrist, i believe you
14:42 -!- kantlivelong [~kantlivel@68.195.251.2] has left #openvpn []
15:00 < Hilarie> ecrist do you know of a way to run openvpn client without it taking over my ability to sudo, right now, I sudo openvpn --config client.ovpn but then I can't sudo
15:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
15:02 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
15:02 <@ecrist> not sure why sudo stops working for you.
15:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:02 < Hilarie> it says it can't get a lock when I try and do something else, the same thing that happens when you are sudoing something, and want to open up synaptec
15:02 < Hilarie> Its keeping its Sudo powers for some reason after I run
15:04 <@ecrist> that's an odd issue
15:04 <@ecrist> I'd ask some people in the sudo channel
15:04 <@ecrist> not really an openvpn issue
15:05 <+EugeneKay> Hilarie - I told you yesterday - use the init scripts, don't run it from a terminal.
15:05 <@ecrist> there's nothing wrong with running it from the terminal
15:05 < Hilarie>  I don't understand what init scripts are, and then I couldn't scroll that far back up when I had time to look at it
15:06 <@ecrist> Hilarie: your sudo issue isn't related to openvpn
15:06 <+EugeneKay> That's one interpretation of it.
15:06 < Hilarie> its not a sudo issue... its openvpn isn't giving up admin privilidges when it should
15:07 < Hilarie> got a run (cab driver) will look into init scripts next downtime
15:07 <@ecrist> :(
15:07 <@ecrist> root@alcatraz:~-> postqueue -p | tail -1
15:07 <@ecrist> -- 43474 Kbytes in 772 Requests.
15:13 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
15:37 <@vpnHelper> RSS Update - forum: Cannot find KDC for requested realm (0x9a) <http://forums.openvpn.net/topic9336.html>
15:43 -!- thebishop [~thebishop@66.187.140.174] has quit [Quit: Leaving]
16:07 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Read error: Operation timed out]
16:18 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
16:21 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit []
16:27 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
16:29 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has joined #openvpn
16:30 < grendal-prime> im having a hell of a time creating a crt
16:30 < grendal-prime> ca -days 3650 -batch -out /etc/openvpn/keys/test2-ca/client-3.crt -in /etc/openvpn/keys/test2-ca/client-3.csr
16:31 < grendal-prime> key and csr are there but when i try and create the crt... with that line i get...
16:31 <@vpnHelper> RSS Update - forum: How can I rotate the server's password? <http://forums.openvpn.net/topic9304.html#p18234>
16:31 < grendal-prime> Error opening CA private key ./demoCA/private/cakey.pem
16:33 < grendal-prime> basically its using the wrong config file..isnt there a way to specify the location of the CA
16:34 < grendal-prime> because everytime i try and use the -config /etc/openvpn/openvpn-ssl.cnf i get a wack error about line 10 of config.
16:34 < grendal-prime> error on line 10 of config file '/etc/openvpn/openvpn-ssl.cnf'
16:37 <@vpnHelper> RSS Update - forum: [SOLVED] How To Control DHCP Lease In OpenVPN <http://forums.openvpn.net/topic9273.html#p18236> || route ADD on Windows... <http://forums.openvpn.net/topic9334.html#p18235>
16:44 < grendal-prime> grrrr this is soooo frustrating
16:49 <@vpnHelper> RSS Update - forum: How to use keep alive in client script <http://forums.openvpn.net/topic9337.html>
16:50 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
16:51 -!- Gravitro_ [~admin@69.163.40.45] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
16:53 -!- farciarz94 [~farciarz@dynamic-78-8-48-201.ssp.dialog.net.pl] has quit [Quit: Lost terminal]
17:01 <@vpnHelper> RSS Update - forum: How to use keep alive in client script <http://forums.openvpn.net/topic9337.html#p18238>
17:02 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:05 -!- novaflash is now known as novaflash_away
17:09 -!- Gravitron [~admin@64.93.225.254] has joined #openvpn
17:09 -!- Gravitron [~admin@64.93.225.254] has quit [Changing host]
17:09 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
17:14 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 268 seconds]
17:14 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
17:14 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
17:14 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
17:37 <@vpnHelper> RSS Update - forum: [solved] How to use keep alive in client script <http://forums.openvpn.net/topic9337.html#p18239>
17:50 <@vpnHelper> RSS Update - forum: Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18241> || [solved] How to use keep alive in client script <http://forums.openvpn.net/topic9337.html#p18240>
17:52 -!- grendal-prime [~sgraham@2001:470:822a:200:1e75:8ff:fe48:dfef] has left #openvpn ["Ex-Chat"]
18:02 -!- Denial [Denial@drgi.co.uk] has quit []
18:29 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:29 -!- mode/#openvpn [+v Axeman] by ChanServ
18:37 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
18:44 <@vpnHelper> RSS Update - forum: route ADD on Windows... <http://forums.openvpn.net/topic9334.html#p18242>
18:53 -!- AcidBurn` [moi_moi.fr@lau18-1-82-246-196-145.fbx.proxad.net] has quit [Read error: Connection reset by peer]
19:05 -!- kaushal [~kaushal@14.97.193.24] has joined #openvpn
19:05 < kaushal> Hi
19:05 < kaushal> is there a CLI to start connect to openvpn server on MAC Operating System ?
19:06 < kaushal> I use tunnelBlick but it really sucks
19:11 < kaushal> checking again ?
19:12 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
19:16 -!- ravemaster [~ravemaste@122.2.46.76] has joined #openvpn
19:18 < ravemaster> hello guys. I have 2 vps, server1 and server2. I would like to use server2 to connect but the username and password are stored in server1. How can I connect to server2 using username and passwords from server1?
19:18 < Hilarie> are you using PAM authentication?
19:18 < Hilarie> oh, stored, no idea
19:18 < ravemaster> I am using username password authentication
19:19 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
19:19 < ravemaster> Is there a script that will sync username and password between two or more servers?
19:21 < ravemaster> help please
19:25 < kaushal> can someone please comment ?
19:41 -!- _julian_ [~quassel@hmbg-5f76497a.pool.mediaWays.net] has joined #openvpn
19:43 -!- kaushal [~kaushal@14.97.193.24] has quit [Quit: leaving]
19:45 -!- _julian [~quassel@hmbg-5f76505d.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:46 -!- ravemaster [~ravemaste@122.2.46.76] has quit []
19:56 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
19:56 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
19:56 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
19:56 -!- mode/#openvpn [+v Axeman] by ChanServ
20:14 -!- amir [~amir@unaffiliated/amir] has quit [Quit: Do not meddle in the affairs of dragons, for you are crunchy, and taste good with ketchup!]
20:14 -!- swerff [~xchat@184.175.131.5] has joined #openvpn
20:14 < swerff> anyone got a moment? i think i'm having a brain fart, and to make it more n00b i'm following a guide, i don't think it's outdated either.
20:15 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
20:15 < swerff> pkitool --initca keeps spitting out i need to source my vars, which i have already
20:20 -!- master_of_master [~master_of@p57B54102.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
20:22 -!- master_of_master [~master_of@p57B53F7A.dip.t-dialin.net] has joined #openvpn
20:25 -!- WebDawg [~WebDawg@officialg0d.com] has quit [Ping timeout: 244 seconds]
20:26 -!- swerff [~xchat@184.175.131.5] has left #openvpn ["Leaving"]
20:29 -!- WebDawg [~WebDawg@officialg0d.com] has joined #openvpn
20:40 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
21:09 -!- mgorbachlaptop [~mgorbach@69.sub-174-252-42.myvzw.com] has joined #openvpn
21:10 < mgorbachlaptop> Can someone help me troubleshoot a bridged openvpn setup? I am able to connect, and the bridge is up, but I am unable to ping even the server computer from the client, not to mention other machines on the server's net.
21:17 -!- ravemaster [~ravemaste@122.2.46.76] has joined #openvpn
21:18 < mgorbachlaptop> Config file is here: http://pastebin.com/58YcCzL2
21:20 -!- ravemaster [~ravemaste@122.2.46.76] has quit [Client Quit]
21:20 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
21:24 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
21:24 -!- mode/#openvpn [+v Axeman] by ChanServ
21:25 -!- rommel092079 [~ravemaste@122.2.46.76] has quit [Client Quit]
21:25 -!- ravemaster [~ravemaste@122.2.46.76] has joined #openvpn
21:26 < ravemaster> hello, I would like to use rsync for my servers.  I am using username and password authentication. What files should I rsync ?
21:30 -!- ravemaster [~ravemaste@122.2.46.76] has quit []
21:37 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
21:48 < mgorbachlaptop> Ah, got it working. I forgot to bring up the tap0 interface after the bridge was up.
21:48 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:01 -!- mgorbach_2 [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
22:02 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 259 seconds]
22:02 -!- mgorbachlaptop [~mgorbach@69.sub-174-252-42.myvzw.com] has quit [Read error: Connection reset by peer]
22:06 -!- mgorbach_2 [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Ping timeout: 268 seconds]
22:13 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Quit: I use a bouncer, this should have never happened]
22:13 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 252 seconds]
22:14 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
22:16 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
22:16 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
22:24 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 260 seconds]
22:24 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
22:25 -!- Gravitron [~admin@64.93.145.58] has joined #openvpn
22:25 -!- Gravitron [~admin@64.93.145.58] has quit [Changing host]
22:25 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:32 -!- l0rd_hex [~rubit_man@S0106000024c61290.ed.shawcable.net] has joined #openvpn
22:33 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
22:34 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
22:34 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
22:34 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:51 <+EugeneKay> Olipro, a-ping
22:52 -!- bigterd [~xchat@184.175.131.5] has joined #openvpn
22:52 < l0rd_hex> hey guys, is it possible to have two different configs from the same client (from the server's point of view), what I would like is a lite-VPN config where only traffic to my home network is encrypted and a heavy-vpn where everything is encrypted
22:53 < bigterd> alright, someone drop me a pm of some good tutorals based on 2.0 setups...i've tried numerous and have nothing but errors. trying to do this on a pair of identical openbsd 5.0 boxes...
22:53 <+EugeneKay> !howto
22:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:53 <+EugeneKay> !freebsd
22:53 <@vpnHelper> "freebsd" is http://www.secure-computing.net/wiki/index.php/OpenVPN_Server
22:54 < l0rd_hex> bigterd: kernel-panic.it has a great tutorial for OpenVPN on OpenBSD
22:54 < bigterd> i'm using that one right now
22:54 < l0rd_hex> me too!
22:54 < bigterd> really want to try and set it up for my first time, i want something simple, 
22:54 < l0rd_hex> the kernel-panic one is super simple
22:55 < l0rd_hex> even I was able to route teh datas
22:55 < l0rd_hex> and I'm not even wearing pants!
22:55 < l0rd_hex> you can be a bigterd and not a bigtard
22:56 < bigterd> i'm doing soething terribly wrong then.
22:56 < l0rd_hex> did you change the push option in the server config?
22:56 < l0rd_hex> he has like push "route 172.16.0.0 ...."
22:57 < l0rd_hex> I had to change that to the IP range on my internal network
22:57 < l0rd_hex> also I think pf is enabled by default so you might need a 'pass quick on...' rule for 1194 udp
22:57 < bigterd> annot load certificate file /etc/openvpn/keys/server.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
22:58 < l0rd_hex> did you copy the server.crt from the easy-rsa/2.0/keys dir
22:58 < l0rd_hex> ?
22:59 < l0rd_hex> bigterd: you should have your ca.crt dh1024.pem (or 2048, etc) and server.crt file in your /etc/openvpn/ directory, keys/ is fine but that's exactly how he has it in the config
23:00 < l0rd_hex> and then your server.key file in the chmod 700'd /etc/openvpn/private folder
23:02 -!- bigterd [~xchat@184.175.131.5] has quit [Ping timeout: 240 seconds]
23:03 -!- bigterd [~xchat@184.175.131.5] has joined #openvpn
23:04 < l0rd_hex> chop chop suey, tom chop suey
23:04 < bigterd> i missed all that.
23:06 < bigterd> wtf? normal user has openvpn, root it says command not found
23:06 < bigterd> i used pkg_add too
23:09 < l0rd_hex> bigterd: http://www.ualberta.ca/~jpm1/stuff/vpn.txt
23:09 < l0rd_hex> try 'which openvpn`
23:09 < l0rd_hex> oops, no backtick
23:10 < l0rd_hex> you probably don't have /usr/local/sbin path'd
23:10 < l0rd_hex> if you get my drift brotha
23:26 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
23:39 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:45 -!- xizhendu [~xizhendu@li388-5.members.linode.com] has quit [Quit: leaving]
--- Day changed Wed Dec 07 2011
00:02 -!- spacemoose2000 [8ef4a486@gateway/web/freenode/ip.142.244.164.134] has joined #openvpn
00:03 < spacemoose2000> I have become spacemoose, destroyer of lichen
00:03 <+EugeneKay> I'm gonna go with "no"
00:03 < spacemoose2000> no lichen in space?
00:04 < spacemoose2000> I eat the lichen that grows on VPN tunnels
00:04 <+EugeneKay> The only space moose I know of had a habit of pooping in urinals.
00:04 < spacemoose2000> I am 2000X better than he
00:04 <+EugeneKay> Which kinda makes him unwelcome here.
00:05 < spacemoose2000> did the poop travel via TLS to the urinal?
00:05 <+EugeneKay> Did you have an OpenVPN question?
00:05 < spacemoose2000> no, I'm actually just testing to see if my irssi ignores actually worked or not
00:06 <+EugeneKay> Well, clean up your mess afterwards, because I'm not dealing with it.
00:06  * l0rd_hex has a OpenVPN question
00:06 <+EugeneKay> !ask
00:06 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
00:07 < l0rd_hex> aye aye, I asked earlier to a deafening response 
00:07 < l0rd_hex> but
00:07  * EugeneKay has the attention span of a g-nat.
00:08 < hyper_ch> hi EugeneKay
00:09 < l0rd_hex> can a server have two configurations for one client? sometimes I want to have a lite-VPN where only traffic to my home network is encrypted but other times I want a heavy-VPN where all traffic is encrypted and sent through my home network (for cafes and such)
00:09 < l0rd_hex> maybe the client can ignore the pushes from the server and I'll have two client configs?
00:09 <+EugeneKay> The easy way would be to use !ccd and two different certificates for hte same physical client.
00:09 < hyper_ch> l0rd_hex: use CCD with different keys and then let the client chose according the cert
00:10 < hyper_ch> yey, I was right :)
00:10 <+EugeneKay> Launch a different vpn connection depending upon where you are.
00:10 < l0rd_hex> ohh, neato I didn't even think about that
00:10 < l0rd_hex> thanks amigos
00:10 <+EugeneKay> Actually, you don't even need two certs.
00:10 < hyper_ch> you don't?
00:10  * l0rd_hex hits spacemoose2000 with his car
00:10 <+EugeneKay> You can do your "redirect-gateway def1" client-side with the second connection profile.
00:10 -!- spacemoose2000 [8ef4a486@gateway/web/freenode/ip.142.244.164.134] has quit [Quit: DEAD]
00:11 < hyper_ch> but that sounds a lot more complicated
00:11 <+EugeneKay> It's actually simpler.
00:11 < l0rd_hex> second connection being the heavy?
00:11 <+EugeneKay> You move the ccd entry to the client ;-)
00:11 <+EugeneKay> Yeah.
00:11 < l0rd_hex> cool, yeah I figured there was a way to force it from the client
00:11 <+EugeneKay> Make your default to be lightweight, and then have a second profile with the redirect. Wham, bam, done.
00:11 < l0rd_hex> well not force but ignore
00:11 <+EugeneKay> Basically, do it the other way around.
00:11 < l0rd_hex> wham, bam, thank you EugeneKay 
00:12 < l0rd_hex> this is blowing my mind
00:12 <+EugeneKay> You *could* have a fancy script to determine your public IP and automagically do the routing, but it's easier to just use a second conf.
00:12 <+EugeneKay> "redirect-gateway def1" just adds two routes :-p
00:13 < l0rd_hex> I'd rather have the satisfaction of deciding (and knowing for sure) what kinda stuff I'm VPN'in
00:13 <+EugeneKay> Indeed.
00:13 < l0rd_hex> if I push a gateway does the DNS automagically follow? 
00:13 < l0rd_hex> I guess it would
00:13 <+EugeneKay> New DNS lookups will go via the default route
00:13 < l0rd_hex> sweet
00:13 <+EugeneKay> You probably want to ignore DHCP dns servers anyway. I do.
00:14 <+EugeneKay> Windows client?
00:14 < l0rd_hex> yeah, I usually use my university's anyways
00:14 < l0rd_hex> Linux client
00:14 <+EugeneKay> Ah okay.
00:14 < l0rd_hex> but will probably extend this to my windows machine at work
00:14 <+EugeneKay> That would make scripting easier :-p
00:15 < l0rd_hex> gotta keep spacemoose outta my datas
00:15 <+EugeneKay> Unless you have a bastard hackjob windows install like I do, with a full bash
00:15 < l0rd_hex> heh
00:15 < l0rd_hex> I have my plain ole Win 7 desktop and then a really crappy Dell laptop beside running Arch Linux
00:16 < l0rd_hex> I would like to someday, make a usb boot key based around arch and use openvpn on it too
00:27 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has quit [Ping timeout: 255 seconds]
00:56 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
01:11 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18243>
01:17 <@vpnHelper> RSS Update - forum: route ADD on Windows... <http://forums.openvpn.net/topic9334.html#p18244>
01:23 <@vpnHelper> RSS Update - forum: Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html#p18247> || Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18246> || Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18245>
01:29 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18248>
01:40 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
01:40 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
01:53 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18249> || [SOLVED] Openvpn connected, but unable to reach the Network <http://forums.openvpn.net/topic8743.html#p18247>
01:54  * EugeneKay sneezes
02:02 < jeev> GAZUNTITE
02:17 <@vpnHelper> RSS Update - forum: Only IP address being given out? <http://forums.openvpn.net/topic9328.html#p18250>
02:23 <@vpnHelper> RSS Update - forum: openvpn on linux <http://forums.openvpn.net/topic9335.html#p18251>
02:28 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 252 seconds]
02:28 <@vpnHelper> RSS Update - forum: route ADD on Windows... <http://forums.openvpn.net/topic9334.html#p18252>
02:28 -!- kyrix [~ashley@mk089144206072.a1.net] has joined #openvpn
02:29 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:35 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- It'll be on slashdot one day...]
02:37 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:41 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
02:45 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Read error: Operation timed out]
02:50 -!- novaflash_away is now known as novaflash
03:02 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
03:05 <@vpnHelper> RSS Update - forum: Setting up Openvpn client <http://forums.openvpn.net/topic9338.html> || openvpn on linux <http://forums.openvpn.net/topic9335.html#p18253>
03:17 -!- bjorneven_ is now known as bjorneven
03:27 -!- dazo_afk is now known as dazo
04:21 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:37 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:49 -!- TruPilot [~kb@99-41-190-174.lightspeed.cicril.sbcglobal.net] has joined #openvpn
04:50 < TruPilot> !welcome
04:50 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:50 < TruPilot> !man !/30
04:51 < TruPilot> !/30
04:51 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
04:51 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
04:51 < TruPilot> !man keys
04:51 < TruPilot> !man
04:51 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
04:51 < TruPilot> Hi everyone... :-)
04:52 < TruPilot> I'm trying to figure out how I tell openvpn to find all the key files in a the keys directory since it doesn't seem to want to look for them there by default in my CentOS 5.7 installation.
04:59 -!- JoeGazz84 [~JoeGazz84@TechEssentials/JoeGazz84] has quit [Quit: У меня есть более важные дела, чем холостой здесь.]
04:59 -!- Tannerbaum [~Pilif12p@firefox/community/pilif12p] has quit [Quit: ZNC - http://znc.sourceforge.net]
04:59 < TruPilot> Never mind - I had to symlink the easy-rsa/keys directory up one level. :-/
04:59 < TruPilot> Same with easy-rsa/ccd
05:06 -!- JoeGazz84 [~JoeGazz84@TechEssentials/JoeGazz84] has joined #openvpn
05:08 -!- Pilif12p [~Pilif12p@69.164.210.153] has joined #openvpn
05:10 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
05:11 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
05:13 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
05:13 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
05:24 <@dazo> TruPilot: OpenVPN doesn't need to know about key files, other than the server key file, server cert file and ca cert file ... the rest OpenVPN doesn't need to know about
05:24 <@dazo> The easy-rsa stuff should ideally not be located on the same box as the OpenVPN server at all
05:25 <@dazo> and especially not the CA key file
05:29 <@vpnHelper> RSS Update - forum: multicast <http://forums.openvpn.net/topic9339.html>
05:30 -!- kyrix [~ashley@mk089144206072.a1.net] has quit [Ping timeout: 252 seconds]
05:32 < hyper_ch> dazo: krzee: ecrist: EugeneKay:  http://seclists.org/nmap-hackers/2011/5
05:32 <@vpnHelper> Title: Nmap Hackers: C|Net Download.Com is now bundling Nmap with malware! (at seclists.org)
05:33 <@dazo> hyper_ch: thx!  That means we should beware of what they do to OpenVPN as well ....
05:34 < hyper_ch> dazo: you might want to check it out
05:34  * hyper_ch firing up VM
05:43 < hyper_ch> dazo: they also use the wrapper
05:43 <@dazo> f*ck!
05:44 < hyper_ch> not sure if they alter someting
05:45 < hyper_ch> dazo: they also want to add babylon toolbar
05:45 < hyper_ch> I'll have screenshots up soon
05:46 <@dazo> hyper_ch: please, could you post this to -users mailing list?  to make people aware of this?
05:48 < hyper_ch> I'm not on the user mailing list
05:50 < hyper_ch> where is the mailing list?
05:51 < hyper_ch> dazo: http://images.sjau.ch/img/26237c40.png
05:51 < hyper_ch> http://images.sjau.ch/img/a20598a6.png
05:52 <@dazo> hyper_ch: mailing lists ... http://sourceforge.net/mail/?group_id=48978
05:52 <@vpnHelper> Title: SourceForge.net: Mailing Lists for OpenVPN (at sourceforge.net)
05:52 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
05:53 < hyper_ch> Your subscription request has been received, and will soon be acted upon. Depending on the configuration of this mailing list, your subscription request may have to be first confirmed by you via email, or approved by the list moderator. If confirmation is required, you will soon get a confirmation email which contains further instructions. 
05:53 <@vpnHelper> RSS Update - forum: not routing <http://forums.openvpn.net/topic9340.html#p18257>
05:56 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
05:57 <@dazo> hyper_ch: http://insecure.org/news/download-com-fiasco.html
05:57 <@vpnHelper> Title: Download.Com Caught Adding Malware to Nmap & Other Software (at insecure.org)
05:57 <@dazo> hyper_ch: Ping mattock if it takes too long
05:58 < hyper_ch> mattock: ping
06:00 -!- amir [~amir@80-219-10-9.dclient.hispeed.ch] has joined #openvpn
06:00 -!- amir [~amir@80-219-10-9.dclient.hispeed.ch] has quit [Changing host]
06:00 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:02 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
06:02 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
06:02 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
06:11 <@vpnHelper> RSS Update - forum: not routing <http://forums.openvpn.net/topic9340.html#p18258>
06:13 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:13 -!- mode/#openvpn [+v Axeman] by ChanServ
06:19 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
06:19 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
06:19 -!- renihs_ [~arf@83-65-34-34.arsenal.xdsl-line.inode.at] has joined #openvpn
06:28 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 260 seconds]
06:41 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
06:46 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
06:49 -!- Zimsky [zimsky@rozznet.net] has left #openvpn ["Leaving"]
07:00 -!- ravel_exe [ravel_exe@175.142.247.6] has joined #openvpn
07:05 < hyper_ch> dazo: still nothing from the mailing list
07:07 <@dazo> mattock: ^^  can you get hyper_ch approved for the ML?
07:09 -!- Zimsky [zimsky@rozznet.net] has joined #openvpn
07:14 < hyper_ch> dazo: any reason why you don't want to write a message?
07:15 <@dazo> hyper_ch: no, not really ... just so that you can get some credit as well ;-)
07:15 -!- Ile [~Ile@kaniserver.net] has joined #openvpn
07:15 <@dazo> (and I got a lot of balls in the air already ... need to get rid of quite some of them ...)
07:16 -!- Ile is now known as `Ile`
07:16 -!- rommel092079 [~rave@184.22.182.246] has joined #openvpn
07:23 < hyper_ch> dazo: I don't need credits
07:24 < hyper_ch> and I have also lots of balls, countless balls, juggling that need to be done
07:27 < rommel092079> guys can I ask for your help. I have 2 servers, main and slave. I am using username and password for authentication. so I am going to use rsync to do syncing of records between servers. what files or directories that I need to sync?
07:28 < rommel092079> I want to know if the /etc/passwd, /etc/shadow, and /etc/group are the files that I need to sync.
07:31 < rommel092079> I need help.
07:35 <@dazo> !download
07:35 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore
07:37 <@dazo> !learn download as "Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html
07:37 <@vpnHelper> Error: No closing quotation
07:37 <@dazo> !learn download as Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html
07:37 <@vpnHelper> Joo got it.
07:37 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
07:37 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:39 < rommel092079> @dazo can you tell me what files do I need to sync?
07:39 <@dazo> rommel092079: you don't need sync in openvpn
07:42 < rommel092079> because if I use the second server ip on my server conf and I dont have records of username and password in the second server, I cant connect to vpn because the username and password are store in the main server.
07:43 < rommel092079> please advice sir
07:43 <@dazo> this isn't strictly an openvpn question ... but it's related to PAM ... so you can either hack around syncing passwd/shadow/group files ... or you can do it in a better way, setting up LDAP for centralised authentication
07:43 <@ecrist> LDAP would be proper in this instance
07:44 < rommel092079> can you kindly give me proper reading on setting up LDAP. I have not read about it.
07:47 <@dazo> rommel092079: http://lmgtfy.com/?q=Linux+LDAP+authentication+setup
07:47 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
07:48 < rommel092079> thank you
07:49 < rommel092079> i will be reading now. 
07:49 -!- rommel092079 [~rave@184.22.182.246] has quit []
08:03 -!- Axeman [~Axeman3@198.105.46.46] has joined #openvpn
08:03 -!- Axeman [~Axeman3@198.105.46.46] has quit [Changing host]
08:03 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:03 -!- mode/#openvpn [+v Axeman] by ChanServ
08:09 -!- astrostl [~astrostl@68-188-73-250.static.stls.mo.charter.com] has joined #openvpn
08:30 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
08:33 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
08:37 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
08:38 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
08:38 -!- mode/#openvpn [+o mattock] by ChanServ
08:40 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
08:46 -!- astrostl [~astrostl@68-188-73-250.static.stls.mo.charter.com] has left #openvpn []
08:52 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
09:01 -!- Twinkletoes [~chatzilla@ipv4-91-143-176-244.static.as8844.net] has joined #openvpn
09:02 < Twinkletoes> I would like to link several remote sites together with the head office site, effectively creating a WAN, such that users in any site can access resources in an of the other connected sites.  Is that possible using OpenVPN?
09:04 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 252 seconds]
09:10 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
09:21 -!- kyrix [~ashley@mk089144206072.a1.net] has joined #openvpn
09:29 < hyper_ch> dazo: still nothing :(
09:29 <@dazo> I haven't seen mattock around lately either .... he might be soaked into something as well :/
09:30 < hyper_ch> Twinkletoes: I tend to think it is
09:30 < hyper_ch> dazo: will you write it then?
09:30 <@dazo> Yeah, I'll do it
09:31 < hyper_ch> yey :)
09:31 < hyper_ch> still got the screenshot links?
09:36 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18260> || [SOLVED] not routing <http://forums.openvpn.net/topic9340.html#p18259>
09:39 <@dazo> hyper_ch: yeah, I do
09:47 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 248 seconds]
09:57 <@ecrist> lol
09:57 <@ecrist> http://i.imgur.com/mCUfG.jpg
10:01 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
10:02 -!- mindcruft [~gerard@static-108-27-36-18.nycmny.fios.verizon.net] has joined #openvpn
10:20 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
10:20 -!- mgorbachlaptop [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
10:22 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
10:22 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
10:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:32 < hyper_ch> ecrist == Retz ?
10:33 <@ecrist> ?
10:33 < hyper_ch> ecrist: in that image, the reply of Retz is surrounded with a red border... and since you paste that image, I assume you gave that one?
10:33 -!- mgorbach_2 [~mgorbach@169.sub-174-254-165.myvzw.com] has joined #openvpn
10:34 -!- mgorbach_ [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
10:35 -!- mgorbach_ [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
10:35 -!- mgorbachlaptop [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
10:38 -!- mgorbach_2 [~mgorbach@169.sub-174-254-165.myvzw.com] has quit [Ping timeout: 240 seconds]
10:40 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
10:43 -!- yell0 [yello@unaffiliated/contempt] has joined #openvpn
10:43 <@ecrist> no, found it, just thought it was funny
10:43 < hyper_ch> ecrist: :)
10:44 < hyper_ch> and I thought my comment was also funny :(
10:46  * l0rd_hex misses spacemoose
10:50 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 240 seconds]
10:51 <@dazo> Twinkletoes: yes, that is doable ... you just need proper routing and firewalling ... and each site (client and server side) LAN needs to be on separate IP segments
10:51 -!- kyrix [~ashley@mk089144206072.a1.net] has quit [Ping timeout: 244 seconds]
10:51 <@dazo> (separate IP segments ... at least to make it easier to setup and manage, and you will have best VPN performance that way)
11:03 -!- kyrix [~ashley@mk089144206072.a1.net] has joined #openvpn
11:06 <@vpnHelper> RSS Update - forum: How can I rotate the server's password? <http://forums.openvpn.net/topic9304.html#p18261>
11:15 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:17 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:17 -!- mode/#openvpn [+o mattock] by ChanServ
11:28 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
11:28 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
11:28 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:28 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:32 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
11:36 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
11:42 <@vpnHelper> RSS Update - forum: Cannot find KDC for requested realm (0x9a) <http://forums.openvpn.net/topic9336.html#p18262>
11:48 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:48 -!- mode/#openvpn [+o raidz] by ChanServ
11:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
11:52 -!- `Ile` [~Ile@kaniserver.net] has quit [Remote host closed the connection]
11:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:53 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
12:39 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 252 seconds]
12:45 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
12:50 < danielsh> hi. I notice that openvpn tcp-server quits as soon as the client quits. How do I stop this from happening?
12:50 < danielsh> I assume that passing --inetd or '--mode server --tls-server' will stop this behaviour.
12:53 <@ecrist> !man
12:53 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
12:54 <@vpnHelper> RSS Update - forum: Problem with shares <http://forums.openvpn.net/topic9341.html>
12:56 < danielsh> I actually read it
12:56 < danielsh> a few times even
12:56 < danielsh> want to give a more precise reference?
13:06 <@vpnHelper> RSS Update - forum: Cannot find KDC for requested realm (0x9a) <http://forums.openvpn.net/topic9336.html#p18264>
13:08 -!- Pilif12p [~Pilif12p@69.164.210.153] has quit [Changing host]
13:08 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
13:08 -!- Pilif12p is now known as Tannerbaum
13:09  * danielsh still wonders how to have the daemon not quit when a client disconnect.
13:12 <@vpnHelper> RSS Update - forum: Cannot find KDC for requested realm (0x9a) <http://forums.openvpn.net/topic9336.html#p18265>
13:24 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
13:26 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
13:26 -!- mode/#openvpn [+o raidz] by ChanServ
13:36 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
13:37 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
13:37 -!- mode/#openvpn [+o raidz] by ChanServ
13:54 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 244 seconds]
14:22 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:41 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
14:46 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
14:55 -!- nifigase [niko@luchshe.vdalnete.ru] has quit [Quit: ZNC - http://znc.sourceforge.net]
15:01 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
15:02 < kunago> Hello here. Has anyone every tried to reach a remote desktop computer over VPN? I am failing to set some proper iptables rules to forward a port to that chosen computer.
15:05 -!- cali_ [~cali@91.220.163.18] has quit [Ping timeout: 252 seconds]
15:05 < kunago> Could someone give me a hint on what I am doing wrong here? http://pastebin.com/qwbeBLY6
15:05 < krzie> kunago, i do it often
15:05 -!- cali_ [~cali@91.220.163.18] has joined #openvpn
15:05 < krzie> you shouldnt need to port forward
15:05 < krzie> oh unless the server is on a lan ip
15:06 < krzie> but thats just for connecting into the vpn
15:06 < kunago> The server has the public IP and I need it to reach the remote computer.
15:06 < krzie> what remote computer
15:06 < krzie> is it on the server lan?
15:07 < kunago> The server is 172.17.10.1 and the computer on 172.17.1.211 (both using 255.255.255.0 mask). The VPN is 172.17.10.0, the other is just a lan.
15:09 < krzie> and the server is also on the computer's lan of 172.17.1.x/24 ?
15:09 < kunago> So I am calling www.www.com:3389 computer which goes to the public IP of my VPN server (172.17.10.1 on tun0). From that server I need to forward the port 3389 to the computer 172.17.1.211.
15:09 < kunago> No, it is not but I am pushing the whole subnets so every machine sees each other.
15:10 < krzie> where is that lan?
15:11 < hyper_ch> hi krzie
15:11 < kunago> The LAN is 172.17.1.0/24, the VPN is 172.17.10.0/24 (not sure about the subnet).
15:11 < hyper_ch> dazo: any reaction?
15:11 < krzie> i said WHERE
15:11 < kunago> Sorry, but what do you mean by where?
15:11 < krzie> well its not behind the server...
15:11 < krzie> it is not internet routable...
15:11 < kunago> No, its behind a VPN client.
15:12 < krzie> ok
15:12 < krzie> finally
15:12 < krzie> !clientlan
15:12 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
15:12 <@vpnHelper> better explanation
15:12 < kunago> I have all this set.
15:12 < krzie> then try disabling the windows firewall
15:12 < kunago> Using a different one but it's disabled when testing.
15:13 < krzie> and try making the iptables rule more permissive for testing
15:13 < hyper_ch> krzie: you've heard abou cnet?
15:13 < krzie> like just allow forwarding from vpn to lan
15:13 < krzie> yes hyper_ch, nothing new
15:13 < kunago> krzie: In the FORWARD or PREROUTING part?
15:13 < hyper_ch> krzie: do you actually have a neural interface so everythign on the web goes directly into your brain?
15:13 < krzie> toolbars automatically being installed if you dont opt-out, i dont like it but im not surprised
15:14 < krzie> hyper_ch, yes, DNI
15:14 < hyper_ch> :)
15:14 < krzie> kunago, in both, be permissive for testing, get it to work, then start getting harder
15:14 < kunago> krzie: Well, trying this whole tonight but ok, I won't give up. :-)
15:15 < krzie> !route
15:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
15:15 < krzie> thats everything you need to know about lans behind openvpn (except your firewall stuff)
15:16 < kunago> I have actually set and read all this. I can directly connect to RDP from inside the VPN (different lan on the VPN still) but not from outside. By outside I mean calling the server's public IP.
15:18 < krzie> umm
15:18 < krzie> you arent supposed to do it from outside
15:18 < krzie> wtf
15:18 < krzie> you are trying to now bypass all that vpn security you implimented!?
15:18 < krzie> you just said "i can do it right, but i cant do it wrong"
15:19 < kunago> I just need one port forward from outside to a particular computer on the LAN, it's not reachable otherwise.
15:19 < krzie> but you dont want to do that!!!!
15:19 < krzie> thats what people do when they dont know about vpns
15:19 < krzie> wtf are you doing man?
15:19 < krzie> you dont want it reachable to non vpn users!!!
15:20 < kunago> krzie: You might know of a better way to achieve this perhaps? Because I have not come up with one.
15:20 < krzie> yes, only vpn users can remote desktop
15:20 < krzie> thats the fuckin point!
15:20 < krzie> why did you even setup a vpn if you didnt understand that?
15:21 < krzie> how did you even end up asking this question in here?
15:21 < krzie> you have the vpn working right, and your question is how to do everything wrong and not use the vpn
15:21 < kunago> krzie: Oh well, sorry for asking then.
15:21 < krzie> i mean what you said can be done, but it makes NO sense to want to... especially after you did the most secure thing and already made it work correctly
15:22 < kunago> I get the point you are saying.
15:23 < krzie> so... what is the problem you were hoping to solve with that?
15:24 < kunago> I was hoping to reach a computer otherwise unreachable from the outside. Because on that one particular LAN I don't have a public IP to able to portforward from a router directly.
15:25 < krzie> right, but you were right to do it using openvpn
15:25 < krzie> you dont need any port forwarding once inside the vpn
15:25 < krzie> unless there is a nat between the vpn node and the machine you are reaching... but odds are there is not
15:26 < krzie> i see what you were thinking now tho
15:26 < krzie> you googled for how to reach your goal, you found 2 different ways... you did the hard one first (openvpn + sharing the lan) and now you were wondering about the second
15:26 < kunago> I don't want that user to reach the whole VPN, no way. Just trying him to reach a particular PC's RDP. Nothing else.
15:27 < krzie> thats fine, your firewall entry will stop that, plus you do not need to give it a route to the entire lan
15:27 < l0rd_hex> hey guys, I have some leftover muffins in the breakroom if you're interested
15:27 < l0rd_hex> I think there is a banana walnut
15:27 < krzie> you can make the route entry 255.255.255.0
15:27 < krzie> l0rd_hex, weed muffins?
15:28 < krzie> "krzie> you can make the route entry 255.255.255.0" <--- i mean 255.255.255.255
15:28 < l0rd_hex> ABSOLUTELY NOT
15:28 < l0rd_hex> ... yes
15:28 < krzie> ok then
15:28 < EugeneKay> Mar-uh-ju-wanna is an evil, horrid drug which will drive you insane and cause the death of your mother!
15:30 < kunago> krzie: You mean in the user's openvpn config and in the CCD folder ..?
15:31 < krzie> kunago, whereever you set the route for the clients to know where to reach the lan
15:31 < krzie> could be in the server config with a push, or in the client configs, or in a ccd entry for the clients that get that route
15:31 < krzie> (with a push)
15:33 <@vpnHelper> RSS Update - forum: VERY lost newbie in need of help <http://forums.openvpn.net/topic9342.html>
15:39 <@vpnHelper> RSS Update - forum: Destination Host Unreachable <http://forums.openvpn.net/topic9343.html>
15:40 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
15:42 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
15:45 <@vpnHelper> RSS Update - forum: OpenVPN AS server error: "Not an access server" <http://forums.openvpn.net/topic9065.html#p18268>
15:45 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
15:45 -!- Bheam [~Bheam@121.54.44.231] has joined #openvpn
15:46 < Bheam> hey hey
15:46 < Bheam> is it hard to set up openvpn on a server to route all my traffic through it?
15:47 -!- kyrix [~ashley@mk089144206072.a1.net] has quit [Quit: Ex-Chat]
15:47 < Bheam> i'm on 3g and transparent proxies are messing up my connections, so need to redirect it all through one connection
15:50 < krzie> !redirect
15:50 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
15:51 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
15:51 < Bheam> is it enough security to set up a key?
15:52 < Bheam> the services out there that allow users to connect, how do they connect access with usernames/passwords?
15:53 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 8.0.1/20111120135848]]
15:54 < krzie> !authpass
15:54 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
15:54 < krzie> certs are more secure than passwords
15:56 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
15:58 -!- Beam [~Bheam@121.54.44.231] has joined #openvpn
15:58 -!- Bheam [~Bheam@121.54.44.231] has quit [Read error: Connection reset by peer]
15:59 < Beam> just one more thing
15:59 < Beam> does openvpn auto reconnect if losing connection? kinda unstable :p
16:01 < krzie> depending on your settings, yes
16:04 -!- TruPilot [~kb@99-41-190-174.lightspeed.cicril.sbcglobal.net] has quit [Quit: Leaving.]
16:04 < Beam> cool
16:04 -!- Beam [~Bheam@121.54.44.231] has quit []
16:05 -!- TruPilot [~kb@99-41-190-174.lightspeed.cicril.sbcglobal.net] has joined #openvpn
16:07 -!- TruPilot [~kb@99-41-190-174.lightspeed.cicril.sbcglobal.net] has quit [Client Quit]
16:17 -!- Twinkletoes_ [~chatzilla@ipv4-91-143-176-244.static.as8844.net] has joined #openvpn
16:19 -!- Twinkletoes [~chatzilla@ipv4-91-143-176-244.static.as8844.net] has quit [Ping timeout: 248 seconds]
16:19 -!- Twinkletoes_ is now known as Twinkletoes
16:20 -!- kunago [~Miris@201.239.broadband12.iol.cz] has left #openvpn ["Leaving."]
16:30 <@dazo> hyper_ch: not so much reaction on the ML ... but on #openvpn-devel, it's been some general discussion about it
16:47 -!- frank___ [74e965d7@gateway/web/freenode/ip.116.233.101.215] has joined #openvpn
16:47 < frank___> hello, hoping to get some help on installation on my laptop
16:48 < frank___> I have installed the exe, but not sure about configuration files, etc and after looking through all the documentation, still extremely inclear
16:48 < frank___> unclear
16:49 < frank___> !Staff
16:49 < frank___> !welcome
16:49 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:51 < frank___> any idea where i can get simple instructions on installation? part of the issue is i am in china and the pages keep getting blocked and i keep missing support because of the 16 hour time change
16:55 < frank___> this is what i get when connecting
16:55 < frank___> Thu Dec 08 06:40:16 2011 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul  1 2011
16:56 < frank___> Thu Dec 08 06:48:32 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
16:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
17:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:00 < frank___> any support people online?
17:07 -!- frank___ [74e965d7@gateway/web/freenode/ip.116.233.101.215] has quit [Quit: Page closed]
17:16 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:47 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 252 seconds]
17:50 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:51 -!- TruPilot [~kb@99-41-190-174.lightspeed.cicril.sbcglobal.net] has joined #openvpn
17:52 -!- TJNII [~TJNII@tjnii.com] has joined #openvpn
17:53 < TJNII> I have a theory question:  All the guides for directing all traffic through the VPN imply that it works by changing the default route on the host.  In that case how does the client continue to access the VPN server?
17:57 -!- TruPilot [~kb@99-41-190-174.lightspeed.cicril.sbcglobal.net] has quit [Ping timeout: 244 seconds]
18:01 -!- Denial [Denial@drgi.co.uk] has quit []
18:02 < EugeneKay> It only affects new conenctions. The vpn conenction is considered "established"
18:03 < EugeneKay> You would need to sign out/in of things like AIM for the effect to be seen
18:06 < TJNII> I see
18:06 < TJNII> So can it flush the whole table so only the VPN accessable network can be accessed?
18:36 -!- dazo is now known as dazo_afk
18:38 -!- ravel_exe [ravel_exe@175.142.247.6] has quit [Ping timeout: 252 seconds]
18:39 < EugeneKay> You don't need to.
18:39 < EugeneKay> !def1
18:39 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:40 < EugeneKay> Or do you mean restart all other connections? You can't, really.... I think?
18:42 < TJNII> I mean what about routes that do not require a gateway.  So the locally connected network.  I have a IT security restriction that when the VPN is open the client can only access the VPN network.
18:43 < TJNII> Based onb what I've read / what you said if I override the default gateway the locally connected network would still be accessable.
18:43 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Read error: Connection reset by peer]
18:54 -!- ravel_exe [~ravel_exe@175.142.247.6] has joined #openvpn
18:54 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
18:56 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:57 < mgorbach> Anyone using an openvpn bridge with gentoo?
19:00 < TJNII> Gentoo as a client or server?
19:01 < mgorbach> Server
19:02 < mgorbach> I'm having trouble getting gentoo's init system to bring up the bridge AFTER openrc has started and created tap
19:02 < krzie> why not have openvpn call it?
19:03 < mgorbach> Have openvpn add tap0 to the bridge you mean?
19:03 < krzie> first off, why bridging/
19:04 < mgorbach> I need broadcast packets to go through (specifically for mDNS / bonjour)
19:04 < krzie> werd
19:04 < krzie> http://openvpn.net/bridge.html
19:04 < krzie> see how they got scripts at the bottom?
19:05 < mgorbach> Yeah I've read the scripts. Have executed them manually and confirmed that things work.
19:05 < krzie> i dont do bridges, but i will guess that those are for --up and --down
19:05 < krzie> !scripts
19:05 < mgorbach> But I'm not clear on how to make openvpn exec scripts when it comes up and down.
19:05 < krzie> !script
19:05 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
19:06 < mgorbach> Hmm, those look like command line arguments.
19:06 < mgorbach> Can I configure it with openvpn.conf?
19:07 < krzie> !--
19:07 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
19:08 < mgorbach> Ah, got it. Thanks vpnHelper :)
19:08 < krzie> !bot
19:08 <@vpnHelper> "bot" is I'm a bot.. just a bot. krzee and ecrist are my maintainers, and I haven't said anything, if you'd notice, the person who spoke just before me gave a !command to make me speak :P
19:08 < krzie> ;]
19:13 < tabakhase> people are awesome
19:13 < tabakhase> and sometimes they just have toooo much luck... like me today :D
19:14 < krzie> ;]
19:15 < tabakhase> srysly, made homeoffice sinc friday until today (so mon+tue) because here i have ma testENV for vpn gateway stuff and so on (4 notebooks + desktop)   
19:16 < mgorbach> Hmm, seems to work so far ...
19:16 < tabakhase> today ive gine intoo the office for kind of no reason arround 15 oclock
19:16 < tabakhase> about 15:30 the girl from the entrance came in, a packet, my new thinkpad just arrived <3<3<3 expected delivery was "beginning next year"
19:17 < mgorbach> Sweet. Annoyign that I can make openrc do my bidding, but still. Thanks krzie, that was surprisingly easy!
19:18 < krzie> =] np
19:19 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
19:20 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 252 seconds]
19:24 < tabakhase> waa, and now im filled with glühwein, i should get outer here...
19:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:31 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
19:36 -!- Rundll_ [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
19:40 -!- _julian [~quassel@hmbg-5f77c2e2.pool.mediaWays.net] has joined #openvpn
19:44 -!- _julian_ [~quassel@hmbg-5f76497a.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:44 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
19:46 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
19:48 < rommel092079> can have the reading about LDAP again. sorry I lost the link.
19:48 <@ecrist> try google
19:48 <@ecrist> seriously
19:49 <@ecrist> or keeping a log, it's been a feature of IRC clients for quite some time now
19:49 <@ecrist> !factoids
19:49 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
19:50 <@ecrist> good day
19:50 < rommel092079> yes I am googling. anyway ok ecrist. sorry
19:50 -!- rommel092079 [~ravemaste@122.2.46.76] has quit [Client Quit]
19:50 < krzie> lol i hadnt put together that rommel and ravemaster are the same person
19:50 < krzie> i think you banned him at least twice
19:50 <@ecrist> yes
19:50 <@ecrist> dazo and I had this discussion earlier today
19:50 <@ecrist> you didn't you we were his computer how-to concierge, eh?
19:51 <@ecrist> s/you/know/
19:51 < krzie> that yoda-fies it
19:51 < krzie> know didn't you
19:51 < krzie> ;]
19:51 <@ecrist> heh
19:51  * ecrist poofs
19:51 <@ecrist> mw3 beckons
19:52 < krzie> right on =]
19:52 <@ecrist> followed shortly by cheryl
19:52 < krzie> how bout beth (iirc)
19:52 <@ecrist> rihanna, I'm still working on
19:52 < krzie> oh no... bri
19:53 <@ecrist> the b was me mis-hearing her name
19:53 <@ecrist> I thought briana, but it's rihanna
19:53 < krzie> ahh
19:53 <@ecrist> thought, my advances are welcome. ;)
19:53 <@ecrist> muahahahahaha
19:53 <@ecrist> my life is so great!
19:53 <@ecrist> l8r man
19:53 < krzie> later =]
20:08 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
20:20 -!- master_of_master [~master_of@p57B53F7A.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:22 -!- master_of_master [~master_of@p57B54060.dip.t-dialin.net] has joined #openvpn
20:30 -!- xizhendu [~xizhendu@li220-212.members.linode.com] has joined #openvpn
20:39 < xizhendu> guys, is there any opensource software which can run webvpn?
20:40 < rommel092079> yes there is xizhendu. but I did not record it because I am not interested. but just to let you know. I have seen one.
20:40 < krzie> dunno what webvpn is, but i know its not openvpn
20:44 < xizhendu> krzie: just google "webvpn", it can be used to connect internal resources by web explorer than we have another vpn client to run.
20:44 < krzie> i would if i cared, but no
20:44 < krzie> this is the openvpn help channel, if you dont want help with openvpn, YOU google it
20:44 < krzie> lol
20:46 < xizhendu> so my question is that would openvpn source webvpn feature in future? 
20:46 < xizhendu> krzie: ;)
20:46 < krzie> no, they are nothing similar
20:46 < krzie> nor compatible
20:48 < krzie> you might like openvpn-as tho
20:48 < krzie> !as
20:48 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
20:49 < xizhendu> thanks honey vpnHelper 
20:49 < xizhendu> and krzie 
20:49 < krzie> !bot
20:49 <@vpnHelper> "bot" is I'm a bot.. just a bot. krzee and ecrist are my maintainers, and I haven't said anything, if you'd notice, the person who spoke just before me gave a !command to make me speak :P
20:56 < rommel092079> krzie, do you know of any software that will check what ports are open by the ISP/
21:00 < krzie> netcat and a brain
21:01 < krzie> or some tool which listens on all ports, and nmap
21:01 < krzie> but no
21:01 < krzie> and once again, this is the openvpn help channel
21:01 < rommel092079> yes. thanks
21:01 -!- rommel092079 [~ravemaste@122.2.46.76] has quit []
21:24 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Quit: Leaving...]
21:27 <@ecrist> krzie: you forgot nmap
21:50 <@vpnHelper> RSS Update - forum: Setting up Openvpn client <http://forums.openvpn.net/topic9338.html#p18269>
21:50 -!- ravel_exe [~ravel_exe@175.142.247.6] has quit []
21:55 -!- sam_s [446780e6@gateway/web/freenode/ip.68.103.128.230] has joined #openvpn
21:55 < sam_s> your website is down
21:56 < EugeneKay> !factoids
21:56 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
21:56 < sam_s> any mirror to download the vpn client?
21:56 < EugeneKay> !download
21:56 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html
21:57 < EugeneKay> Hm. Guessing you want Windows?
21:57 < sam_s> so no mirror then?
21:57 < sam_s> yeah win7 64bit
21:58 < EugeneKay> No official one I know of, I don't even have a copy of ith andy here.
21:58 < EugeneKay> Hrm.
21:58 < sam_s> dang
21:59 < sam_s> i saw a download on softpedia, but i trust them about as much as a guy with candy in a dark alley
21:59 < EugeneKay> http://swupdate.openvpn.org/community/releases/openvpn-2.2.1-install.exe
21:59 < EugeneKay> Managed to scrape that ought of google cache
21:59 < sam_s> w00t
21:59 < sam_s> thanks
22:01 -!- krzee [nobody@66.11.114.212] has joined #openvpn
22:01 -!- krzee [nobody@66.11.114.212] has quit [Changing host]
22:01 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:02 < EugeneKay> -gh
22:38 <@vpnHelper> RSS Update - forum: Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18270>
22:58 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:20 -!- mode/#openvpn [+v EugeneKay] by ChanServ
23:33 -!- GHAI [~joti@cthulhu-isp.net] has quit [Read error: Operation timed out]
23:34 -!- freaky[t]_ [alpha@freakyonline.de] has quit [Ping timeout: 260 seconds]
23:34 -!- mrsno_ [~sno@static.153.209.46.78.clients.your-server.de] has quit [Ping timeout: 258 seconds]
23:34 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-htnbklulomphtfmb] has quit [Ping timeout: 244 seconds]
23:34 -!- deever [~deever@78.46.68.172] has quit [Ping timeout: 240 seconds]
23:34 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Ping timeout: 252 seconds]
23:34 -!- MrPPS [~quassel@canyouget.in] has quit [Ping timeout: 240 seconds]
23:34 -!- Blue_Ice [~Blue_Ice@unaffiliated/blue-ice/x-2052838] has quit [Ping timeout: 252 seconds]
23:35 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 248 seconds]
23:35 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 248 seconds]
23:36 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
23:36 -!- Blue_Ice [~Blue_Ice@sid.dupas.be] has joined #openvpn
23:36 -!- Blue_Ice [~Blue_Ice@sid.dupas.be] has quit [Changing host]
23:36 -!- Blue_Ice [~Blue_Ice@unaffiliated/blue-ice/x-2052838] has joined #openvpn
23:36 -!- GHAI [~joti@cthulhu-isp.net] has joined #openvpn
23:37 -!- freaky[t] [~alpha@freakyonline.de] has joined #openvpn
23:37 -!- MrPPS [~quassel@canyouget.in] has joined #openvpn
23:37 -!- MrPPS [~quassel@canyouget.in] has quit [Changing host]
23:37 -!- MrPPS [~quassel@unaffiliated/mrpps] has joined #openvpn
23:37 -!- mrsno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
23:38 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
23:39 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:39 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:41 -!- vereteran [~vereteran@88.198.170.117] has joined #openvpn
23:42 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
23:44 -!- vereteran [~vereteran@88.198.170.117] has quit [Max SendQ exceeded]
23:45 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Read error: Operation timed out]
23:46 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
23:52 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
23:52 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
23:52 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
23:52 -!- oc80z [oc80z@blea.ch] has joined #openvpn
23:52 -!- deever [~deever@78.46.68.172] has joined #openvpn
23:54 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
--- Day changed Thu Dec 08 2011
00:11 -!- jeev is now known as aol
00:11 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-pjrrvvzdtgbjwfpa] has joined #openvpn
00:12 -!- aol is now known as jeev
00:21 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
00:21 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
00:27 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
00:46 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:51 -!- sam_s [446780e6@gateway/web/freenode/ip.68.103.128.230] has quit [Quit: Page closed]
00:52 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
01:00 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:08 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
01:14 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p18271>
01:24 -!- Darr [566249d7@gateway/web/freenode/ip.86.98.73.215] has joined #openvpn
01:24 < Darr> Hi
01:24 < Darr> i need a help to connect my vpn
01:24 < Darr> openvpn
01:25 < Darr> i downloaded windows installer 
01:25 < Darr> and install it 
01:25 < Darr> but when i double click on it it doesnt show anything 
01:25 < Darr> that is it trying to connect or not 
01:29 -!- Darr [566249d7@gateway/web/freenode/ip.86.98.73.215] has quit [Quit: Page closed]
01:29 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:30 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
01:30 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
01:30 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:39 <@vpnHelper> RSS Update - forum: Advanced configuration on a per-client basis <http://forums.openvpn.net/topic9344.html>
02:06 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
02:21 <@vpnHelper> RSS Update - forum: How can I rotate the server's password? <http://forums.openvpn.net/topic9304.html#p18273>
02:23 -!- sickn3ss [~sickn3ss@unaffiliated/sickn3ss] has joined #openvpn
02:23 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:23 < sickn3ss> Hey guys, how could I add multiple tap interfaces in Windows 7, I need to connect to multiple VPN's at the same time
02:24 < danielsh> run multiple instances of openvpn then?
02:26 < sickn3ss> danielsh, it doesn't automatically create them
02:27 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18276> || Destination Host Unreachable <http://forums.openvpn.net/topic9343.html#p18275> || Problem with shares <http://forums.openvpn.net/topic9341.html#p18274>
02:27 < beerbro> sickn3ss just install legacy hardware over windows, u can select a tun/tap device there
02:27 < sickn3ss> beerbro, ok I'll try
02:27 < sickn3ss> thanks
02:28 <+EugeneKay> sickn3ss - the OpenVPN installer should make a Start Menu entry to add TAP device
02:29 < beerbro> uh yeah thats true
02:29 < sickn3ss> EugeneKay, I tried that, ... maybe I didn't try it as admin though will reboot and try again as admin to make sure
02:29 <+EugeneKay> Admin is the key
02:29 < beerbro> my key is 123
02:32 < danielsh> sickn3ss: I don't use window, can't help with that, sorry
02:32 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-15.html#p18278> || Cannot find KDC for requested realm (0x9a) <http://forums.openvpn.net/topic9336.html#p18277>
02:32 < sickn3ss> np
02:45 <@vpnHelper> RSS Update - forum: Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18279>
02:45 -!- sickn3ss [~sickn3ss@unaffiliated/sickn3ss] has left #openvpn ["Leaving"]
02:49 < danielsh> (repeat from yesterday) how to cause openvpn tcp-server not to quit when when a client disconnects?
02:51 < danielsh> My best guess so far is that enabling one or more of --inetd, --mode server, --topology, --ifconfig-pool will sort this.  (Currently the tunnel uses a shared key and plain --ifconfig.)
03:17 -!- dazo_afk is now known as dazo
03:58 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
04:00 -!- defswork [~andy@mx2.3gcomms.co.uk] has quit [Quit: Ex-Chat]
04:06 -!- Denial- [Denial@drgi.co.uk] has joined #openvpn
04:08 -!- Denial [Denial@drgi.co.uk] has quit [Ping timeout: 240 seconds]
04:36 -!- Hxcan [~root@183.17.40.6] has joined #openvpn
04:51 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-30.html#p18280>
04:58 -!- Hxcan [~root@183.17.40.6] has left #openvpn ["Konversation terminated!"]
05:02 -!- dxtr [5d080d72@2a00:16d8:2:300::2] has quit [Changing host]
05:02 -!- dxtr [5d080d72@unaffiliated/dxtr] has joined #openvpn
05:03 <@vpnHelper> RSS Update - forum: SIGTERM[soft,init_instance] received, process exiting <http://forums.openvpn.net/topic9311-30.html#p18281>
05:18 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:31 -!- cpm [~Chip@c-71-58-93-57.hsd1.pa.comcast.net] has joined #openvpn
05:31 -!- cpm [~Chip@c-71-58-93-57.hsd1.pa.comcast.net] has quit [Changing host]
05:31 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
05:43 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
05:51 -!- danielsh [~danielsh@apache/committer/danielsh] has left #openvpn []
05:56 -!- JPeterso2 [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
05:59 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has quit [Ping timeout: 252 seconds]
05:59 -!- JPeterso2 is now known as JPeterson
06:15 -!- _julian [~quassel@hmbg-5f77c2e2.pool.mediaWays.net] has quit [Read error: Operation timed out]
06:16 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit []
06:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 244 seconds]
06:21 <@vpnHelper> RSS Update - forum: Unable to access VPN client <http://forums.openvpn.net/topic9217.html#p18282>
06:33 -!- rommel092079 [~rave@184.22.182.246] has joined #openvpn
06:33 < rommel092079> what is the meaning when the log just keep repeating SENT CONTROL and after 11 times of repeating, it restarts.
06:37 -!- bigterd [~xchat@184.175.131.5] has left #openvpn ["Leaving"]
06:38 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:50 < rommel092079> hello !
06:50 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Quit: Leaving]
06:50 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:50 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18283>
06:54 -!- rommel092079 [~rave@184.22.182.246] has quit []
06:57 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
07:02 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:10 <@ecrist> good morning peeps
07:10 -!- mode/#openvpn [-o ecrist] by ecrist
07:35 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
07:35 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
07:43 <@vpnHelper> RSS Update - forum: installing openvpn on linux (missing tmp-ca.cert) <http://forums.openvpn.net/topic9345.html>
07:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
07:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:20 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:42 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html>
08:59 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
09:03 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
09:03 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:22 -!- dschuett [~dschuett@mail.lonemountaintruck.com] has joined #openvpn
09:24 < dschuett> i am trying to run an "up" script on my openvpn client and i'm getting this error:  openvpn_execve: external program may not be called unless '--script-security 2' or higher is enabled.  Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier.
09:24 < dschuett> any ideas? All the script does is a route del -net .....
09:27 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
09:27 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
09:29 <@vpnHelper> RSS Update - forum: How can I rotate the server's password? <http://forums.openvpn.net/topic9304.html#p18286>
09:34 < krzie> [19:01]  <krzie> or some tool which listens on all ports, and nmap    [19:27]  <ecrist> krzie: you forgot nmap
09:34 < krzie> did not!
09:35 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
09:35 -!- mindcruft [~gerard@static-108-27-36-18.nycmny.fios.verizon.net] has left #openvpn ["WeeChat 0.3.5"]
09:48 -!- ecrist_ [~ecrist@kenny.secure-computing.net] has joined #openvpn
09:49 -!- ecrist_ [~ecrist@kenny.secure-computing.net] has quit [Client Quit]
09:58 -!- dschuett1 [~dschuett@mail.lonemountaintruck.com] has joined #openvpn
10:00 -!- dschuett [~dschuett@mail.lonemountaintruck.com] has quit [Ping timeout: 240 seconds]
10:02 < krzie> http://arstechnica.com/tech-policy/news/2011/12/adobe-scrambles-to-patch-acrobat-zero-day-hack.ars
10:03 <@vpnHelper> Title: Adobe scrambles to patch Acrobat zero-day hack (at arstechnica.com)
10:05 < hyper_ch> krzie: http://webwereld.nl/nieuws/108815/weer-certificatenleverancier-overheid-gehackt.html
10:05 <@vpnHelper> Title: Weer certificatenleverancier overheid gehackt | Webwereld (at webwereld.nl)
10:06 < ecrist> gah
10:07 < hyper_ch> ecrist: you speak dutch?
10:08 < ecrist> no
10:08 < ecrist> it's a dirty language
10:10 < krzie> ehh?
10:13 < pwrcycle> krzie: whenever i put my ubuntu netbook to sleep, and have openvpn running, when i open it back up, all routing is wrong, and i have to kill the daemon. is there any way for openvpn to detect the sockets are down and to exit?
10:13 < pwrcycle> by wrong, i mean doesn't route anything correctly.
10:15 < krzie> it doesnt reconnect?
10:15 < krzie> do you have a keepalive?
10:16 < krzie> are you dropping privileges?
10:17 < pwrcycle> krzie: yes: keepalive 59 126
10:17 < krzie> lol
10:18 < pwrcycle> krzie: i found that behind my home router, if i didn't send a packet >2min, then the router lost NAT table.
10:18 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Quit: Leaving...]
10:19 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
10:19 < krzie> ic
10:24 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Ping timeout: 252 seconds]
10:31 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
10:32 < pwrcycle> krzie: what do you suggest for keep-alive?
10:32 < krzie> hey if that works its fine
10:33 < krzie> i was just chuckling about the slightly off from normal numbers, but theres nothing wrong with them
10:34 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Client Quit]
10:45 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
10:45 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
10:58 <@vpnHelper> RSS Update - forum: UBUNTU OPENVPN apache and proftp not accesible <http://forums.openvpn.net/topic9347.html>
11:02 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 244 seconds]
11:12 -!- stones_ [~anthony@static-70-107-216-88.nycmny.east.verizon.net] has joined #openvpn
11:13 < stones_> Hi all. I would like to setup a VPN for my office so that I can use a my server's hostname/dns instead of showing my actual IP. I am wanting to get this work for http, ftp, ssh, pretty much any protocol so I don't have to worry about separate bouncers for each protocol. Is this possible with OpenVPN? If so, could someone point me to a step by step guide that would help me accomplish this? Thanks in advance!
11:16 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
11:16 -!- oc80z [oc80z@blea.ch] has joined #openvpn
11:17 < hyper_ch> stones: your employer allows such a thing?
11:24 < stones_> Its my business...
11:25 < ecrist> !def1
11:25 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
11:25 < hyper_ch> stones_: then you can easily do that with def1
11:25 < hyper_ch> howdy ecrist
11:26 < stones_> could you point me to an easy doc to follow? I will be using CentOS
11:27 < stones_> What exactly is OpenVPN useful for
11:27 < stones_> If you don't mind me asking, from reading I assumed that OpenVPN was built for what I am asking for. I'd also like to be able to access our network from outside
11:28 < hyper_ch> stones_: openvpn provides an encrypted tunnel/connection between you (as client), the server and other vpn-clients in the network
11:28 < hyper_ch> using def1, it means that the routes are set in a way, that all traffic is routed through that encrypted connection
11:29 < hyper_ch> !howto
11:29 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:31 < hyper_ch> ecrist: what do you think of my short summary?
11:38 < stones_> Definitely understand it better now :)
11:39 < hyper_ch> stones_: asking in here is better than in private
11:42 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
11:42 < zoredache> !welcome
11:42 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:43 < zoredache> !goal
11:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:43 < zoredache> !mitm
11:43 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: ns-cert-type server in the client config
11:44 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit []
11:44 < zoredache> !ipv6
11:44 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options) or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
11:45 < hyper_ch> zoredache: did you read the channel topic?
11:47 < zoredache> hyper_ch: yes, it told me to ready !welcome and !goal
11:47 < hyper_ch> wow, you're probably the 4th or 5th user who actually reads it :) at least as far as I noticed
11:49 < zoredache> Not sure that your bot answers my question though.  Or any of the online howtos...  So bridge mode is required for multi-point ipv6, that is clear.   So I need to setup bridging. My question is, does the bridge on the server actually have to have a physical device as a member
11:50 < zoredache> can I just create the tap device and add that to the bridge?  Then treat it as a router on the openvpn server?
11:50 <@vpnHelper> RSS Update - forum: Problem with shares <http://forums.openvpn.net/topic9341.html#p18288>
11:50 < hyper_ch> zoredache: what are you trying to do?
11:51 < zoredache> I want ipv6 tunneled, but I do not want to bridge the VPN into my existing networks.
11:52 < zoredache> I want the linux box to route it, so I can setup netfilter policies and so on.
11:52 < hyper_ch> what do you mean by you do not want to bridge the vpn in to your existing networks?
11:52 < hyper_ch> on the server or on the client?
11:53 < zoredache> on the server.
11:53 < zoredache> so the bridge-setup script shows using brctl to add both the tap interface and an existing ethernet interface to the bridge.
11:53 < zoredache> my question is, will it work without adding the ethernet interface to the bridge.  
11:54 < hyper_ch> I still fail to comprehend what you try to achieve... someone else must help
11:54 < zoredache> I want it to act like a multi-point tun setup, but I also want ipv6
11:55 < zoredache> Anyway, I have an idea about how I think it should work, I may have to just test it...
11:56  * hyper_ch needs pics of what the final thing should look like
11:57 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
12:01 -!- bendix [~ice@86.35.39.239] has joined #openvpn
12:01 < bendix> Hi
12:01 < bendix> is anyone alive?
12:01 < bendix> I've setup an openvpn server and client
12:01 < bendix> and I have this IP on the client
12:02 < bendix> tun0: inet addr:10.10.10.6  P-t-P:10.10.10.5  Mask:255.255.255.255
12:02 < bendix> I need to add an alias ip for this
12:02 < bendix> like
12:02 < bendix> tun0:0 inet addr:10.10.10.7
12:02 < bendix> is there a way to do this?
12:03 < bendix> I hope somebody can help me with this..
12:05 < zoredache> bendix: can you tell us why you would need that?  Oh, and the <enter> key is not punctuation.  Type a whole message at once please?  
12:06 < bendix> ok zoredache
12:07 < krzie> bendix, not with that sort of setup
12:07 < krzie> !topology
12:07 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
12:08 < bendix> so, I have a pmta server that send emails thru multiple emails. I need to use a whole class of IPs from another server so I've created the tunnel using openvpn
12:09 < bendix> I was able to make this to work for a single IP., the IP that openvpn client has been added on the client server. Not I need to add other IPs on tun0 and to masquerade them with SNAT on the openvpn server to go out thru their reserver real IPs
12:09 < bendix> now* I need
12:10 < bendix> do you understand what I am trying to do? 
12:11 < krzie> not really, and i lost interest now that i feel its spam related
12:11 < krzie> dont get me wrong, i know a few people in the industry... but you get to help yourself in my opinion ;]
12:11 < bendix> so, then pmta send email thru 10.10.10.6 this will go out thru main IP of openvpn server and when send emails thru 10.10.10.7 this will go out rhtu second IP of openvpn server
12:12 < bendix> krzie this is not a spam related
12:12 < krzie> right, cause other people need to dynamically change outgoing IP for emails, lol
12:12 < bendix> I am working on a company that have clients and help them to send emails
12:13 < bendix> I can prove this, so, this is not spam, ok/
12:13 < hyper_ch> negativia non sunt probanda
12:14 < bendix> so, can somebody help me with this? is there a way to do this?
12:15 < bendix> I know I can add a secondary server.conf and to run another instance on a different port..
12:15 < bendix> but I don't want to have too many openvpn processes tun
12:15 < bendix> run*
12:17 < zoredache> I don't understand why you have to add more ip addresses on the server interface to do the snat.
12:17 < zoredache> can't you snat based on the IP of the sending client?
12:17 < bendix> ok, but then how I can use the openvpn server IPs?
12:17 < bendix> I have only 1 client
12:17 < bendix> on the powermta server
12:18 < zoredache> the IP address of the VPN interface of the sending client.
12:18 < bendix> yes zoredache, but I don't have multiple clients, I have just 1 client
12:18 < zoredache> you have lost me...
12:19 < bendix> ok, let me explain again
12:19 < bendix> I have a powermta software on a server from where we are sending emails, on this server we have a lot of real IPs too
12:20 < bendix> now we have 2 customers that wants to send their emails from their IPs located on their server
12:20 < bendix> I am trying to tunnel these Ips on our pmta server and setup pmta to send emails thru these virtual IP added by openvpn client
12:21 -!- Denial- [Denial@drgi.co.uk] has quit [Ping timeout: 248 seconds]
12:21 < bendix> I've made everything to work for this single IP added by openvpn client, but, I need to add multiple vpn IPs in order to snat them on the clinet server and allow the client to send emails from those of his IPs
12:22 < bendix> I hope you get it..
12:23 < bendix> so, I don't have multiple clients, only one, installed on our pmta server and we need to have multiple 10.10.10.x IPs there
12:23 < zoredache> bendix: what do mean?  when a second client connects it will get an address from the pool
12:24 < bendix> yes, but I don't have a second client, I need this new address to be on the same client added as alias or such
12:27 < bendix> anyone?..
12:27 < zoredache> You are sure you can configure the application to bind to a specific source address to send?
12:27 < bendix> yes, I already did this
12:29 < bendix> I did this with the IP assigned by openvpn client 10.10.10.6 and now I need to do this for other IPs like this one, and these IPs needs to be on the same VPN with openvpn server
12:29 -!- gffa [~gffa@unaffiliated/gffa] has quit [Read error: Operation timed out]
12:30 < bendix> without to run other openvpn instances for this
12:30 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
12:31 < zoredache> so you want the vpn client to get multiple addresses within the vpn subnet...  I am almost certain you can do that in a bridged setup.  
12:32 < zoredache> maybe as krzie, mentioned it could be done in the 'subnet' topoloty
12:32 < krzie> yep ;]
12:34 < bendix> yes, this is what i want, multiple vpn addressed from vpn subnet..
12:35 < bendix> so, how I can do this?..
12:36 < krzie> i gave you the answer before i lost interest
12:36 < krzie> your problem is:
12:36 < zoredache> bendix: no idea, I just read about it for the first time a few minutes ago.  I am now reading the documentation.
12:36 < krzie> !/30
12:36 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
12:36 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
12:36 < krzie> your solution is:
12:37 < krzie> !topology
12:37 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
12:38 < bendix> ok, thank you krzie and zoredache, I will read this and try it
12:38 < bendix> thank you again, and sorry for disturbing, brb
12:49 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
12:51 < dschuett1> i'm connecting to a openvpn server and it is pushing a route to the 192.168.1.0 network that i don't want
12:52 < dschuett1> i try to add an up script to delete the route, but the script always fails with "script failed with error 7"
12:52 < dschuett1> or status 7
12:52 < dschuett1> how can i delete a route when the client connects? - Without having to do it manually?
12:56 < zoredache> add debugging code to your script to figure out why it is failing with an error 7 and then fix that?
12:56 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
12:57 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
12:57 -!- mode/#openvpn [+o mattock] by ChanServ
12:59 < dschuett1> zoredache: what would you recommend to use for debugging code?
13:00 < zoredache> what scripting language?
13:01 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
13:01 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
13:04 < dschuett1> zoredache: shell
13:06 < dschuett1> the first reason i thought it failed is because i wasn't sure if the route was added before the script ran, but then i made the script sleep for 15 seconds before deleting the route... still didn't work.
13:07 < zoredache> As with most scripts the first thing you should check is environment (PATHS), then check permissions.  
13:07 < zoredache> Maybe you could simply add a line that dumps the route table out to a file at the top of the script  ip route show > /tmp/blah
13:13 -!- fr00d [~andi@sandbox2.sixhop.de] has joined #openvpn
13:13 < fr00d> Hello!
13:14 < fr00d> I have some problems with my openvpn instance which does not work anymore. :( I'm getting this error while connecting with my client: Authenticate/Decrypt packet error: packet HMAC authentication failed TLS Error: incoming packet authentication failed from $myip:$myport
13:14 < fr00d> Can somebody tell me what could be wrong?
13:14 < fr00d> I double checkt with md5sum that the ta.key file is the same on both sides.
13:14 < dschuett1> zerodache: i figured it out. i just had to use route-up instead of just up along with route-delay 5
13:17 <@dazo> fr00d: looks like your --tls-auth key have changed ... that needs to be the same on both sides ... and one side needs a 0 and the other side a 1 as the second argument
13:18 <@dazo> that error does not come from anything else ... if it suddenly happened and you have really not done any config changes ... try to switch to TCP from UDP and see if that fixes it ... if that is the solution, your packets gets mangled on the way somewhere/somehow
13:21 -!- cjs226 [~cjs226@71.40.79.154] has joined #openvpn
13:29 < fr00d> Ok, I found the problem.
13:30 < fr00d> I wanted to update the openvpn server to use a new cert. Some parts ran with the old configuration.
13:31 < fr00d> Is that possible to setup two client configurations on one host which both connect to the same server? I'd like to be able to switch the server configuration with always being able to connect to this special client from the server.
13:31 < fr00d> With "the same server" I mean the same ip address.
13:32 -!- diffen3 [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
13:34 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
13:43 -!- dschuett1 [~dschuett@mail.lonemountaintruck.com] has left #openvpn []
13:44 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:49 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
14:06 -!- dazo is now known as dazo_afk
14:06 -!- JGAN [~JGAN@cpe-184-153-103-177.rochester.res.rr.com] has joined #openvpn
14:06 -!- JGAN [~JGAN@cpe-184-153-103-177.rochester.res.rr.com] has left #openvpn []
14:20 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
14:20 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
14:20 -!- [1]SigmaProjects is now known as SigmaProjects
14:35 < krzie> fr00d, running at the same time? no
14:35 < krzie> but you can have both there, and run whichever one you choose
14:35 < fr00d> I want both clients running at the same time but not both servers.
14:36 < fr00d> The one client will fail the other should work, right?
14:36 < krzie> oh different servers now?
14:36 < krzie> sure
14:36 < fr00d> No, it's the same server (ip) but different server instances.
14:36 < krzie> if they use the same PKI you can just have 2 --remote entries in the client config and only run 1
14:43 <@vpnHelper> RSS Update - forum: generating certificate <http://forums.openvpn.net/topic9348.html>
15:01 <@vpnHelper> RSS Update - forum: My openvpn speed scales to 1/10th <http://forums.openvpn.net/topic9349.html>
15:03 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:07 -!- Hilarie [~Hilarie@212.7.210.65] has quit [K-Lined]
15:08 < novaflash> whee k-line
15:22 <+EugeneKay> My lines go to M
15:36 -!- krzee [nobody@66.11.114.212] has joined #openvpn
15:36 -!- krzee [nobody@66.11.114.212] has quit [Changing host]
15:36 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:09 -!- cjs226 [~cjs226@71.40.79.154] has quit []
16:16 -!- diffen3 [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
16:37 <@vpnHelper> RSS Update - forum: Route client traffic via OpenVPN - only one client though <http://forums.openvpn.net/topic9350.html>
16:43 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:58 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
16:59 -!- bendix [~ice@86.35.39.239] has quit []
17:19 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
17:22 < zoredache> in the bridging guide (http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html) the bridge-start script sets the tap interface into promiscous mode.  Why is this required?  I ask because I had manually setup my bridge, and didn't set this, and yet the VPN seems to work.
17:22 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
17:22 <+EugeneKay> !layer2
17:22 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
17:22 -!- novaflash is now known as novaflash_away
17:26 < zoredache> EugeneKay: was that supposed to answer my question somehow? 
17:26 <+EugeneKay> Any particular reason you're using bridging? Or just because the blog you read said to?
17:27 < zoredache> because I want to use ipv6, and that doesn't seem to be supported un a multi-point tun setup
17:28 <+EugeneKay> tun doesn't support ipv6, tun-ipv6 and tap devices do. 
17:28 <+EugeneKay> Routing works just fine over a tap device
17:28 <+EugeneKay> Or, 6in4 tunnels work fine over a tun device.
17:29 < zoredache> I have real IPv6 address space, and I don't see why it would be a good idea to setup another tunnel...
17:30 <+EugeneKay> So use a tap device in routed mode. 
17:30 <+EugeneKay> Don't use bridged mode unless you have a good reason.
17:31 < zoredache> That still doesn't answer why the official docs seem to suggest that setting up a bridge requires setting the interfaces into promiscous mode.
17:32 <+EugeneKay> Because that's how bridging works
17:32 < zoredache> I have been reading the bridge-utils docs and BRIDGING-HOWTO.  Neither of those documents say that is required.
17:33 < zoredache> in my test setup it doesn't seem to have been required.
17:34 <+EugeneKay> That just means that it did it automagically without telling you. Check your syslog.
17:34 <+EugeneKay> Promiscuous mode is a flag that tells the interface to not filter traffic by MAC, and instead pass it through. Without this, bridging couldn't work because the traffic destined for vpn MACs would get filtered at the NIC.
17:35 < zoredache>  ip link : 3: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc ...
17:35 < zoredache> notice the lack of the PROMISC flag...
17:35 <+EugeneKay> No, for the eth interface that you're bridging to.
17:36 < zoredache> EugeneKay: the script that is part of the guide sets promisc on the tap interface in addition to any physical interfaces...
17:37 < zoredache> I agree it would be needed on the physical interfaces...
17:37 <+EugeneKay> Well that's silly. 
17:37 <+EugeneKay> The guide is clearly broken; don't use it.
17:37 <+EugeneKay> Or bridging. Because bridging is bad.
17:38 < zoredache> why is bridging bad?
17:39 <+EugeneKay> Overhead.
17:42 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:54 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:59 <@vpnHelper> RSS Update - forum: Routing browser traffic through VPN <http://forums.openvpn.net/topic9351.html>
18:17 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
18:31 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
18:38 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
18:45 -!- Denial [Denial@drgi.co.uk] has quit []
18:50 -!- vtcN- [~vtcN@unaffiliated/thethe] has joined #openvpn
18:50 -!- vtcN- [~vtcN@unaffiliated/thethe] has left #openvpn []
19:03 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has quit [Quit: leaving]
20:14 < krzee> anyone in here know linux-ha?
20:14 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.5]
20:18 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html>
20:20 -!- master_of_master [~master_of@p57B54060.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:22 -!- master_of_master [~master_of@p57B543F8.dip.t-dialin.net] has joined #openvpn
20:27 <+EugeneKay> krzee - I use keepalived
20:28 <+EugeneKay> I've fiddled with heartbeat, but ultimately decided I didn't need all the fancy stuff.
20:46 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 248 seconds]
21:13 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit []
21:18 <@vpnHelper> RSS Update - forum: Error svc_run_except <http://forums.openvpn.net/topic8473.html#p18294>
21:21 < krzee> oh god another one
21:34 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
21:36 < rommel092079> how do I create a server config that the log will show like this UDPv4 link local (bound): [undef]:80
21:36 < rommel092079> UDPv4 link remote: 0.0.0.0:0
21:36 < rommel092079> UDPv4 link local (bound): [undef]:80
21:36 < rommel092079> UDPv4 link remote: 0.0.0.0:0
21:38 < rommel092079> i need your advice guys, I have not encountered this one.
21:46 < rommel092079> anyone here guys?
21:47 < rommel092079> how to I get UDPv4 link remote: 0.0.0.0:0
21:50 -!- rommel092079 [~ravemaste@122.2.46.76] has quit []
22:21 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
22:30 <@vpnHelper> RSS Update - forum: Windows 7 64 bit Installation Fails OpenVPN 2.2.1 <http://forums.openvpn.net/topic8440.html#p18295>
22:49 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:09 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
23:09 < rommel092079> how do I configure server.conf that will when I client connects, the log will present UDPv4 link remote:0.0.0.0:0
23:16 < Olipro> rommel092079: connect a client and watch what happens
23:16 < Olipro> increase verb as appropriate
23:21 < rommel092079> Olipro, when I connect a client the result has UDPv4 link remote:serverip:80
23:34 -!- rommel092079 [~ravemaste@122.2.46.76] has quit []
23:39 <+EugeneKay> Olipro, you git
23:58 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
--- Day changed Fri Dec 09 2011
00:00 <@vpnHelper> RSS Update - forum: Disconnect issue being analyzed <http://forums.openvpn.net/topic9124.html#p18296>
00:00 -!- diegoviola [~diego@host-1-211.b15.cvc.com.py] has joined #openvpn
00:00 < diegoviola> hi
00:01 < diegoviola> can openvpn connect to fortinet vpn?
00:01 < diegoviola> i need to connect to a fortinet vpn from linux
00:01 <+EugeneKay> Fortinet is not OpenVPN.
00:02 < diegoviola> ok
00:06 <@vpnHelper> RSS Update - forum: Bridging Zeroshell to openvpnas <http://forums.openvpn.net/topic9353.html>
00:21 < diegoviola> I'm trying to figure out if I can connect to that VPN with existing open source utilities, I don't want to install their proprietary utilities to connect to their VPN.
00:22 < diegoviola> I read it uses ipsec/ssl?
00:22 < diegoviola> sorry if i'm offtopic
00:22 <+EugeneKay> Not a clue, but it ain't OpenVPN.
00:22 <+EugeneKay> I doubt anybody else (sober) here has touched it either.
00:23 < diegoviola> no problem, thanks
00:26 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
00:28 < rommel092079> guys I know I have probably asked this question but can I put 3 ports to bind in one server.conf file?
00:29 <+EugeneKay> No, but you can use iptables to DNAT the other 2 ports to the first port.
00:29 <+EugeneKay> Or run multiple instances(with different subnets/configs)
00:49 < rommel092079> eugenekay, can you give me DNAT example please
00:49 <+EugeneKay> iptables -t nat -A PREROUTING -p udp --dport 1234 -j DNAT --to-destination 11.22.33.44:1194
00:55 -!- diegoviola [~diego@host-1-211.b15.cvc.com.py] has quit [Ping timeout: 240 seconds]
01:10 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
01:40 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
01:44 < rommel092079> EugeneKay, sorry long reply. I just got from office meeting. So the dnat sample you gave was if I have originally on my server.conf port 1194, then with dnat, I can use 1234 as port in my client.conf?
01:44 <+EugeneKay> Ay.
01:44 < rommel092079> Ay.?
01:44 <+EugeneKay> "yes"
01:44 <+EugeneKay> Also listening on 11.22.33.44 ;-)
01:45 < rommel092079> I have read that local directive can be optional in server.conf right?
01:45 <+EugeneKay> Can be, es
01:47 < rommel092079> can I do this: iptables -t nat -A PREROUTING -p udp --dport 1234:5555 -j DNAT --to-destination 11.22.33.44:1194
01:48 < rommel092079> I just extended 1234 up to 5555 so that I wont be creating so many iptable entries. can I?
01:48 <+EugeneKay> Yup, that's the syntax for --dport
01:49 < rommel092079> thanks so much for confirming EugeneKay. Very helpful.
01:51 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
01:52 -!- rommel092079 [~ravemaste@122.2.46.76] has quit []
02:12 -!- novaflash_away is now known as novaflash
02:17 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:26 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
02:53 <@vpnHelper> RSS Update - forum: Connection problems between server and internet with OpenVPN <http://forums.openvpn.net/topic9325.html#p18298>
03:13 -!- pranq [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
03:17 <@vpnHelper> RSS Update - forum: OpenVPN AS server error: "Not an access server" <http://forums.openvpn.net/topic9065.html#p18299>
03:20 -!- fr00d [~andi@sandbox2.sixhop.de] has left #openvpn []
03:21 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
03:22 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
03:22 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18300>
03:28 <@vpnHelper> RSS Update - forum: UBUNTU OPENVPN apache and proftp not accesible <http://forums.openvpn.net/topic9347.html#p18303> || Setting up Openvpn client <http://forums.openvpn.net/topic9338.html#p18302> || My openvpn speed scales to 1/10th <http://forums.openvpn.net/topic9349.html#p18301> || [resolved] Force push "redirect-gateway" on ONE client only <http://forums.openvpn.net/topic9329.html#p18230>
03:43 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
03:44 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
03:45 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18304>
03:51 <@vpnHelper> RSS Update - forum: Route client traffic via OpenVPN - only one client though <http://forums.openvpn.net/topic9350.html#p18305>
03:57 <@vpnHelper> RSS Update - forum: VERY lost newbie in need of help <http://forums.openvpn.net/topic9342.html#p18309> || Tunnel-to-tunnel VOIP possible? <http://forums.openvpn.net/topic9354.html> || generating certificate <http://forums.openvpn.net/topic9348.html#p18307> || installing openvpn on linux (missing tmp-ca.cert) <http://forums.openvpn.net/topic9345.html#p18306>
04:03 <@vpnHelper> RSS Update - forum: Disable encryption for one user ? <http://forums.openvpn.net/topic9157.html#p18312> || Install config issues <http://forums.openvpn.net/topic9307.html#p18311> || Advanced configuration on a per-client basis <http://forums.openvpn.net/topic9344.html#p18310>
04:09 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18316> || Routing browser traffic through VPN <http://forums.openvpn.net/topic9351.html#p18315> || Problem with shares <http://forums.openvpn.net/topic9341.html#p18314> || tunneling <http://forums.openvpn.net/topic8104.html#p18313>
04:15 <@vpnHelper> RSS Update - forum: Tunnel-to-tunnel VOIP possible? <http://forums.openvpn.net/topic9354.html#p18317>
04:22 -!- evildead [~laurentl@office-nat.ladtech.fr] has joined #openvpn
04:23 < evildead> hello all
04:23 < evildead> i know it is an openvpn-gui problem but maybe you have the solution
04:24 < evildead> i got an openssl error when trying to change password 
04:26 < evildead> it seems the problem doesnt exist with the 2.1.4 version but i need to use the 2.2.1 one
04:27 < evildead> is there any openvpn command to use instead using the openvpn-gui ?
04:31 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:33 <@vpnHelper> RSS Update - forum: Help! Windows 2008 R2 SP1 kills openvpn routing <http://forums.openvpn.net/topic9355.html>
04:36 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:36 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:36 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:45 <@vpnHelper> RSS Update - forum: Help! Windows 2008 R2 SP1 kills openvpn routing <http://forums.openvpn.net/topic9355.html#p18319>
04:46 -!- diffen3 [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
04:48 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 252 seconds]
04:57 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18320>
05:15 <@vpnHelper> RSS Update - forum: Problem with shares <http://forums.openvpn.net/topic9341.html#p18321>
05:19 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
05:19 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
05:21 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
05:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
05:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:45 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:52 -!- rommel092079 [~rave@184.22.182.246] has joined #openvpn
05:53 < rommel092079> I have problem. I am connected but the connection is very slow.  
05:56 < hyper_ch> rommel092079: udp?
05:56 < rommel092079> yes
05:56 < hyper_ch> tried tcp?
05:57 < rommel092079> we cant connect using tcp on this certain isp.
05:57 < hyper_ch> well, for some reasons I get a better speed with tcp
05:57 < hyper_ch> while udp should be better
05:58 < rommel092079> our isp have detected that several have been using vpn already that is why they are blocking this. and we found a config that is open but it is very slow in connection.
05:59 < hyper_ch> a config that is open?
05:59 < rommel092079> I mean port that is open.
05:59 < hyper_ch> maybe the ISP throttles
05:59 < hyper_ch> I don't know
06:00 < rommel092079> I am also thinking that they throttles.
06:00 < rommel092079> but how come if we are not connected without the vpn, the connection is fine.
06:00 < hyper_ch> using the same port for connection?
06:01 < hyper_ch> well, the ISP can do DPI and see that the packages are encrypted
06:01 < hyper_ch> I think
06:01 < rommel092079> I am thinking that too.
06:01 -!- Zimsky [zimsky@rozznet.net] has quit [Ping timeout: 240 seconds]
06:01 < hyper_ch> or your config is crappy :)
06:02 <@vpnHelper> RSS Update - forum: Routing browser traffic through VPN <http://forums.openvpn.net/topic9351.html#p18322>
06:02 < hyper_ch> !configs
06:02 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
06:02 < rommel092079> so does it mean that if the traffic is encrypted, they will throttle it
06:03 < renihs_> never heard of an ISP doing that
06:03 < hyper_ch> who knows what ISPs are really doing :)
06:03 < renihs_> that would have to stated in your contract
06:03 < hyper_ch> renihs_: not necessarily
06:03 < renihs_> well not throttling encrypted connections
06:04 < renihs_> hyper_ch, yes, at least in europe 
06:04 < rommel092079> but this is happening to us 
06:04 < renihs_> you cant sell a product not stating the terms 
06:04 < hyper_ch> renihs_: not necessarily
06:04 < hyper_ch> renihs_: sure you can
06:04 < renihs_> well maybe in some odd country :)
06:04 < hyper_ch> renihs_: if you don't state terms, then the law is applicable as such
06:05 < rommel092079> can you advice for solutions
06:05 < hyper_ch> but with own terms you can often deviate
06:05 < renihs_> if you sell e.g 10mbits and you throttle it down like 500kbs than thats ...well 
06:05 < renihs_> not allowed
06:05 < hyper_ch> renihs_: why not?
06:05 < rommel092079> I need solution guys
06:05 < renihs_> hyper_ch, its called fraud
06:05 < renihs_> unless defined somewhere
06:05 < hyper_ch> renihs_: not fraud
06:06 < renihs_> ok whatever
06:06 < hyper_ch> fraud requires criminal intent
06:06 < renihs_> it would be here
06:06 < renihs_> that *is* criminal intent, to sell something you dont keep
06:06 < renihs_> for profit
06:06 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
06:06 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
06:06 < hyper_ch> renihs_: no, that's not criminal intent
06:06 < hyper_ch> renihs_: that's a normal contract dispute
06:06 < renihs_> lol
06:06 < renihs_> anyhow
06:06 < renihs_> it would be fraud here
06:07 < hyper_ch> where is here?
06:07 < renihs_> europe
06:07 <@vpnHelper> RSS Update - forum: UBUNTU OPENVPN apache and proftp not accesible <http://forums.openvpn.net/topic9347.html#p18323>
06:07 < renihs_> excluding french
06:07 < hyper_ch> then I disagree
06:07 < hyper_ch> I still disagree
06:07 < renihs_> in france encryption is prohibited
06:07 < renihs_> well i am sure you are a master of the law :)
06:07 < hyper_ch> I disagree on that also
06:07 < hyper_ch> renihs_: actually, do have a masters degree in law
06:07 < hyper_ch> s/do/I do/
06:08 < renihs_> obviously...
06:08 < rommel092079> are you just going to keep chatting there guys. are you just going to ignore me asking for help
06:08 < hyper_ch> rommel092079: read the backlog, I gave you a pointer
06:08 < renihs_> y, i am out of the discussion anyways, i would ask your provider if they throttle :)
06:08 < rommel092079> pointer?
06:08 < renihs_> if you really think thats the cause
06:08 < rommel092079> hyper_ch, pointer?
06:09 < hyper_ch> yes, pointer
06:09 < rommel092079> hmmm. i havent notice. can you repeat that please
06:09 < renihs_> also i just had a legal argue with a provider not fullfilling his 20mbits (only 15 peak) and wow, what a surprise, we won
06:09 < hyper_ch> renihs_: that means?
06:10 < rommel092079> hyper_ch, hmmm. i havent notice. can you repeat that please
06:10 < hyper_ch> !configs
06:10 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
06:10 < hyper_ch> !welcome
06:10 < renihs_> that means you cant sell 20mbits and only deliver half of it, unless you have it defined somewhere under "fair use" or stating that you will throttle 
06:10 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:10 < hyper_ch> !help
06:10 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
06:10 < hyper_ch> !howto
06:10 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:11 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:12 -!- evildead [~laurentl@office-nat.ladtech.fr] has quit [Remote host closed the connection]
06:12 < rommel092079> hyper_ch: I have a working config before and now I can connect but with very slow connection.  So I guess there is nothing wrong with my config.
06:13 -!- evildead [~laurentl@office-nat.ladtech.fr] has joined #openvpn
06:15 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
06:22 -!- Manu18 [moi_moi.fr@lau18-1-82-246-196-145.fbx.proxad.net] has joined #openvpn
06:22 < Manu18> bonjour
06:40 -!- rommel092079 [~rave@184.22.182.246] has quit []
07:03 <@vpnHelper> RSS Update - forum: OpenVPN with Google authenticator like 2FA (windows client) <http://forums.openvpn.net/topic9300.html#p18324>
07:08 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
07:08 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
07:08 <@vpnHelper> RSS Update - forum: generating certificate <http://forums.openvpn.net/topic9348.html#p18326> || Can't get access to remote LAN - connects though <http://forums.openvpn.net/topic9356.html>
07:10 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
07:10 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
07:16 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
07:16 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
07:18 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
07:18 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
07:18 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
07:18 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
07:24 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
07:24 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
07:27 <@vpnHelper> RSS Update - forum: Can't get access to remote LAN - connects though <http://forums.openvpn.net/topic9356.html#p18327>
07:29 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
07:29 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
07:33 <@vpnHelper> RSS Update - forum: Disable encryption for one user ? <http://forums.openvpn.net/topic9157.html#p18330> || UBUNTU OPENVPN apache and proftp not accesible <http://forums.openvpn.net/topic9347.html#p18329> || generating certificate <http://forums.openvpn.net/topic9348.html#p18328>
07:40 < Manu18> y a pas de
07:41 < Manu18> Francais pour un soucis technique
07:41 < ecrist> we speak english here.
07:44 < Manu18> don't speak english
07:45 < renihs_> what a surprise
07:45 <@vpnHelper> RSS Update - forum: Routing browser traffic through VPN <http://forums.openvpn.net/topic9351.html#p18333> || Problem with shares <http://forums.openvpn.net/topic9341.html#p18332> || whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18331>
07:45 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
07:45 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
07:46 -!- Zimsky [~zimsky@rozznet.net] has joined #openvpn
07:46 -!- Zimsky [~zimsky@rozznet.net] has quit [Excess Flood]
07:51 <@vpnHelper> RSS Update - forum: Can't get access to remote LAN - connects though <http://forums.openvpn.net/topic9356.html#p18334>
07:55 -!- Xymski [zimsky@rozznet.net] has joined #openvpn
07:58 -!- Xymski is now known as Zimsky
08:01 -!- rommel092079 [~rave@184.22.182.246] has joined #openvpn
08:05 -!- Manu18 [moi_moi.fr@lau18-1-82-246-196-145.fbx.proxad.net] has quit [Ping timeout: 252 seconds]
08:07 -!- Manu18 [moi_moi.fr@lau18-1-82-246-196-145.fbx.proxad.net] has joined #openvpn
08:11 -!- samael [~earendil@ip-196-134.sn1.eutelia.it] has joined #openvpn
08:11 < samael> hello
08:13 -!- evildead [~laurentl@office-nat.ladtech.fr] has left #openvpn []
08:14 -!- dazo_afk is now known as dazo
08:16 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 255 seconds]
08:20 -!- renihs_ [~arf@83-65-34-34.arsenal.xdsl-line.inode.at] has quit [Quit: narf]
08:23 -!- rommel092079 [~rave@184.22.182.246] has quit []
08:25 -!- Manu18 [moi_moi.fr@lau18-1-82-246-196-145.fbx.proxad.net] has quit [Ping timeout: 240 seconds]
08:26 -!- Manu18 [moi_moi.fr@lau18-1-82-246-196-145.fbx.proxad.net] has joined #openvpn
08:28 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:28 -!- Manu18 [moi_moi.fr@lau18-1-82-246-196-145.fbx.proxad.net] has left #openvpn []
08:29 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
08:30 -!- dazo is now known as dazo_afk
08:38 -!- dazo_afk is now known as dazo
08:52 <@vpnHelper> RSS Update - forum: can't use my vpn configuration - private key password failed <http://forums.openvpn.net/topic9357.html>
08:52 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
08:58 <@vpnHelper> RSS Update - forum: web-Access via OpenVPN <http://forums.openvpn.net/topic9358.html> || Routing browser traffic through VPN <http://forums.openvpn.net/topic9351.html#p18336>
09:10 <@vpnHelper> RSS Update - forum: Can't get access to remote LAN - connects though <http://forums.openvpn.net/topic9356.html#p18338>
09:27 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
09:27 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18339>
09:27 -!- oc80z [oc80z@blea.ch] has joined #openvpn
09:49 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:55 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 252 seconds]
10:04 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Ping timeout: 252 seconds]
10:10 <@vpnHelper> RSS Update - forum: OpenVPN client for the iPhone and iPad <http://forums.openvpn.net/topic4568.html#p18340>
10:10 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:10 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:10 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:11 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:18 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:18 -!- mode/#openvpn [+v Axeman] by ChanServ
10:32 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
10:37 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
10:39 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Quit: ZNC - http://znc.in]
10:43 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
10:43 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
10:43 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
10:53 -!- samael [~earendil@ip-196-134.sn1.eutelia.it] has quit [Ping timeout: 268 seconds]
10:58 <@vpnHelper> RSS Update - forum: Can only ping/access Router and OpenVPN Server <http://forums.openvpn.net/topic9356.html#p18338>
10:58 -!- Twinkletoes [~chatzilla@ipv4-91-143-176-244.static.as8844.net] has quit [Quit: ChatZilla 0.9.87-rdmsoft [XULRunner 1.9.0.17/2009122204]]
11:03 <@vpnHelper> RSS Update - forum: [SOLVED] Connection problems between server and internet <http://forums.openvpn.net/topic9325.html#p18341>
11:09 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Quit: Leaving...]
11:14 <@vpnHelper> RSS Update - forum: Connecting a Windows 7 Client <http://forums.openvpn.net/topic9314.html#p18342>
11:14 < l0rd_hex> route
11:14 < l0rd_hex> !route
11:14 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
11:24 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 248 seconds]
11:25 < l0rd_hex> !rooty-tooty
11:31 <+Axeman> !axeman
11:33 < l0rd_hex> !pizzabagels
11:36 <@dazo> l0rd_hex: don't mention food ... you make me hungry!
11:37 < l0rd_hex> dazo: why not eat some foods?
11:37 < l0rd_hex> like a porkchop?
11:37 < l0rd_hex> or a breakfast burrito
11:38 <@dazo> l0rd_hex: far away from the office
11:38  * dazo recommends to not push limits ....
11:38  * dazo got power! :-P
11:38 < l0rd_hex> dazo, you're a growing boy and you need your food stuffs
11:39 < novaflash> i could go for a big nice pizza
11:39 < novaflash> lots of cheeze
11:39 < novaflash> mmmm
11:40 < l0rd_hex> I believe Herman Cain is back to making pizzas
11:40 <@dazo> oh gee .... 
11:40 < novaflash> really!
11:40  * dazo ponders ... should I kick or should I go ....
11:40  * dazo goes 
11:40 < novaflash> bye :)
11:56 <@vpnHelper> RSS Update - forum: can't use my vpn configuration - private key password failed <http://forums.openvpn.net/topic9357.html#p18344> || Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18343>
12:02 <@vpnHelper> RSS Update - forum: Connecting a Windows 7 Client <http://forums.openvpn.net/topic9314.html#p18346> || Can only ping/access Router and OpenVPN Server <http://forums.openvpn.net/topic9356.html#p18345>
12:13 -!- mode/#openvpn [+o ecrist] by ChanServ
12:14 -!- samael [~earendil@ip-196-134.sn1.eutelia.it] has joined #openvpn
12:14 <@vpnHelper> RSS Update - forum: openvpn redirect-gateway <http://forums.openvpn.net/topic9359.html>
12:16 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
12:17 -!- bretanika [bretanika@89.114.11.171] has quit [Client Quit]
12:17 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
12:19 -!- kick_me [~Adium@2001:470:5:1d2:618c:d1b:21e:2655] has joined #openvpn
12:20 <@vpnHelper> RSS Update - forum: Disconnect issue being analyzed <http://forums.openvpn.net/topic9124.html#p18348>
12:22 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
12:22 -!- kick_me is now known as ecrist_m
12:23 -!- ecrist_m is now known as ecrist_mac
12:24 -!- ecrist_mac [~Adium@2001:470:5:1d2:618c:d1b:21e:2655] has quit [Changing host]
12:24 -!- ecrist_mac [~Adium@freebsd/contributor/openvpn.community.support.ecrist] has joined #openvpn
12:24 -!- mode/#openvpn [+o ecrist_mac] by ChanServ
12:27 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:27 -!- mode/#openvpn [+o raidz] by ChanServ
12:29 -!- Cain [~Geek@unaffiliated/cain] has left #openvpn []
12:47 -!- ecrist_mac [~Adium@freebsd/contributor/openvpn.community.support.ecrist] has quit [Remote host closed the connection]
12:47 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
12:56 -!- kick_me [~Adium@2001:470:5:1d2:618c:d1b:21e:2655] has joined #openvpn
12:57 -!- samael [~earendil@ip-196-134.sn1.eutelia.it] has quit [Quit: Read error: 113 (Niente rutti all'oste)]
13:00 <@vpnHelper> RSS Update - forum: Can only ping/access Router and OpenVPN Server <http://forums.openvpn.net/topic9356.html#p18349>
13:09 -!- kick_me [~Adium@2001:470:5:1d2:618c:d1b:21e:2655] has quit [Quit: Leaving.]
13:10 -!- ecrist_mac [~ecrist@2001:470:5:1d2:618c:d1b:21e:2655] has joined #openvpn
13:10 -!- ecrist_mac [~ecrist@2001:470:5:1d2:618c:d1b:21e:2655] has quit [Changing host]
13:10 -!- ecrist_mac [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has joined #openvpn
13:11 -!- mode/#openvpn [+o ecrist_mac] by ChanServ
13:28 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 248 seconds]
13:33 <@vpnHelper> RSS Update - forum: Connecting a Windows 7 Client <http://forums.openvpn.net/topic9314.html#p18350>
13:35 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
13:48 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:51 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 258 seconds]
13:53 -!- bretanika [bretanika@89.114.11.171] has quit []
13:53 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
13:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
14:00 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 8.0.1/20111120135848]]
14:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:14 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
14:22 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
14:23 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
14:23 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
14:23 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
14:23 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
14:24 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
14:39 -!- `Ile` [~kvirc@77-46-176-68.dynamic.isp.telekom.rs] has joined #openvpn
14:58 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:05 -!- dazo is now known as dazo_afk
15:07 -!- ecrist_mac [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has left #openvpn []
15:19 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has joined #openvpn
15:35 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
15:40 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
15:43 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 255 seconds]
16:09 -!- diffen3 [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Read error: Connection reset by peer]
16:10 -!- diffen3 [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
16:13 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
16:20 <@vpnHelper> RSS Update - forum: Problem with shares <http://forums.openvpn.net/topic9341.html#p18351>
16:24 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
16:37 -!- `Ile` [~kvirc@77-46-176-68.dynamic.isp.telekom.rs] has quit [Ping timeout: 252 seconds]
16:40 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
16:40 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
16:40 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
16:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:19 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
17:40 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:56 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Quit: Leaving...]
17:57 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
17:57 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
17:58 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
17:58 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
18:19 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
18:37 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
19:01 -!- rommel092079 [~rave@184.22.182.246] has joined #openvpn
19:17 -!- stones_ [~anthony@static-70-107-216-88.nycmny.east.verizon.net] has quit [Quit: Leaving]
19:36 -!- rommel092079 [~rave@184.22.182.246] has quit [Ping timeout: 240 seconds]
19:45 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 252 seconds]
19:57 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:02 <@vpnHelper> RSS Update - forum: My openvpn speed scales to 1/10th <http://forums.openvpn.net/topic9349.html#p18352>
20:05 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
20:06 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:14 <@vpnHelper> RSS Update - forum: download speed is VERY SLOW <http://forums.openvpn.net/topic9360.html>
20:16 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
20:20 -!- master_of_master [~master_of@p57B543F8.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:22 -!- master_of_master [~master_of@p57B52AEB.dip.t-dialin.net] has joined #openvpn
20:33 -!- newl [~newl@97.75.165.156] has joined #openvpn
20:41 -!- diffen3 [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
20:54 -!- Denial [Denial@drgi.co.uk] has quit []
20:59 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:37 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
21:52 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
21:52 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
21:52 -!- [1]SigmaProjects is now known as SigmaProjects
21:54 -!- zalzice_ [~Thomas@25.79-160-109.customer.lyse.net] has quit [Read error: Operation timed out]
21:54 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
22:02 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:12 -!- ravel_exe [~ravel_exe@175.142.247.6] has joined #openvpn
22:33 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18354>
22:44 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
22:44 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
23:09 -!- jeev [1004@unaffiliated/jeev] has quit [Read error: Operation timed out]
23:09 -!- jeev [1004@unaffiliated/jeev] has joined #openvpn
23:15 <@vpnHelper> RSS Update - forum: push/pull config? <http://forums.openvpn.net/topic9361.html>
23:42 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
23:44 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:49 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
23:50 -!- media-786 [~media-786@unaffiliated/firippu] has joined #openvpn
23:51 -!- ravel_exe [~ravel_exe@175.142.247.6] has quit []
23:55 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has quit [Read error: Connection reset by peer]
23:58 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has joined #openvpn
--- Day changed Sat Dec 10 2011
00:01 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
00:14 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
00:17 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
00:18 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:21 -!- media-786 [~media-786@unaffiliated/firippu] has quit [Read error: Connection reset by peer]
00:51 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
00:58 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
00:58 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
00:58 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
01:11 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 248 seconds]
01:15 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
02:07 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:33 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:35 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:36 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:48 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:55 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
02:56 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:57 <@vpnHelper> RSS Update - forum: download speed is VERY SLOW <http://forums.openvpn.net/topic9360.html#p18357> || My openvpn speed scales to 1/10th <http://forums.openvpn.net/topic9349.html#p18356> || [resolved] Connecting a Windows 7 Client <http://forums.openvpn.net/topic9314.html#p18350> || openvpn redirect-gateway loop <http://forums.openvpn.net/topic9359.html>
03:07 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
03:07 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
03:07 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18359> || Problem with shares <http://forums.openvpn.net/topic9341.html#p18358> || Push options priority <http://forums.openvpn.net/topic9361.html>
03:07 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
03:07 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
03:22 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
03:45 -!- bretanika [bretanika@89.114.11.171] has quit []
03:54 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
03:55 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:14 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
04:33 -!- samael [~earendil@ip-196-134.sn1.eutelia.it] has joined #openvpn
04:33 < samael> hi
04:47 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9362.html>
04:48 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:49 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
05:15 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
05:25 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:00 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Read error: Connection reset by peer]
06:06 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9362.html#p18361>
06:15 -!- `Ile` [~kvirc@77-46-176-68.dynamic.isp.telekom.rs] has joined #openvpn
06:18 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:34 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
06:51 -!- sigius [~sigius@93.125.185.45] has joined #openvpn
06:57 < _zero_> A
07:14 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
07:15 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
07:18 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 244 seconds]
07:30 <@vpnHelper> RSS Update - forum: I can connect to Openvpn but cannot see or Ping the internal <http://forums.openvpn.net/topic9363.html>
08:00 <@vpnHelper> RSS Update - forum: I can connect to Openvpn but cannot see or Ping the internal <http://forums.openvpn.net/topic9363.html#p18363>
08:21 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
08:21 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
08:27 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
08:30 < kunago> Hello guys. Could I get some help with VPN config? I have this server and some CCD config: http://pastebin.com/5s52jbLi. In here, every subnet can see and communicate with each other because the route is pushed to each client. Now I would like to make a change and have some subnets closed to other. In this paste http://pastebin.com/mn7qCT1z I have a server config that does not push any subnets on its own. Instead, I am pushing the subnets in each
08:30 -!- kunago [~Miris@201.239.broadband12.iol.cz] has left #openvpn ["Leaving."]
08:30 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
08:40 -!- kunago [~Miris@201.239.broadband12.iol.cz] has left #openvpn ["Leaving."]
08:40 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
08:41 < kunago> !welcome
08:41 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:43 < kunago> So nobody has an idea about the server and ccd configs?
08:49 -!- kunago [~Miris@201.239.broadband12.iol.cz] has left #openvpn ["Leaving."]
09:01 -!- kunago [~Miris@201.239.broadband12.iol.cz] has joined #openvpn
09:28 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
09:30 <@vpnHelper> RSS Update - forum: Problem with shares <http://forums.openvpn.net/topic9341.html#p18364>
09:32 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has joined #openvpn
09:46 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 244 seconds]
09:46 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
09:48 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
09:48 <@vpnHelper> RSS Update - forum: Problem with shares <http://forums.openvpn.net/topic9341.html#p18365>
09:51 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
09:51 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
09:51 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
09:51 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
10:00 <@vpnHelper> RSS Update - forum: Problem with shares <http://forums.openvpn.net/topic9341.html#p18366>
10:10 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
10:12 <@vpnHelper> RSS Update - forum: Problem with shares <http://forums.openvpn.net/topic9341.html#p18367>
10:17 -!- danielsh [~danielsh@apache/committer/danielsh] has joined #openvpn
10:21 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:25 -!- danielsh [~danielsh@apache/committer/danielsh] has left #openvpn []
10:37 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has joined #openvpn
10:41 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
10:41 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
10:44 -!- `Ile` [~kvirc@77-46-176-68.dynamic.isp.telekom.rs] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
10:46 -!- mgorbach [~mgorbach@pool-108-20-201-143.bstnma.fios.verizon.net] has quit [Quit: Leaving...]
10:46 -!- trispace [~trispace@chello212017114137.18.11.vie.surfer.at] has joined #openvpn
10:52 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
10:53 -!- trispace [~trispace@chello212017114137.18.11.vie.surfer.at] has left #openvpn []
11:04 -!- kunago [~Miris@201.239.broadband12.iol.cz] has left #openvpn ["Leaving."]
11:50 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
11:56 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:59 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
12:02 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:02 -!- mode/#openvpn [+v s7r] by ChanServ
12:04 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
12:04 < okamis_> !welcome
12:04 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:05 < okamis_> !interface
12:05 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
12:06 < okamis_> hi, I can get an ip from my vpn but I cant ping my server http://pastebin.com/ti7ea6X0
12:08 < okamis_> !logs
12:08 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
12:09 -!- Cybertinus [~Cybertinu@tunnel3304.ipv6.xs4all.nl] has quit [Remote host closed the connection]
12:13 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:14 < okamis_> !howto
12:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:22 -!- newegggg [~newegggg@208.111.39.186] has joined #openvpn
12:22 < newegggg> hi
12:22 < newegggg> openvpn works great, until i try to download a torrent... after about a minute the connection crawls to a stop from 1.4Mb/s to like 4kb/s down speed
12:22 -!- travelinrob [~mint@c-66-176-81-117.hsd1.fl.comcast.net] has joined #openvpn
12:22 < newegggg> have openvpn running on my own vps and the provider assures me they do no traffic shaping or rate limiting
12:23 < newegggg> any ideas? 
12:23 < newegggg> i'm in china and only way i can download torrents is through vpn
12:23 < travelinrob> greetings. i'm running mint 12 live via usb. my vpn won't connect and i'm looking for troubleshooting advice. is there a command i can run to start the vpn from commandline to see any errors?
12:28 < hyper_ch> enable log
12:33 < travelinrob> hyper_ch: i don't know how to connect to the vpn via terminal or how to enable the log.
12:33 < hyper_ch> !howto
12:33 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:33 < travelinrob> thank you
12:33 < newegggg> why wont torrents work over the vpn?
12:33 < newegggg> come onnnnnnnnnn
12:34 < newegggg> it makes no sense
12:34 < hyper_ch> newegggg: they do work
12:35 < newegggg> i've tried it on two different clients, two different laptops
12:35 < newegggg> after one minute of downloading very fast the torrent slows to a crawl, and then i have to reset the connection even to visit a website
12:35 < hyper_ch> newegggg: works fine for me
12:37 < okamis_> newegggg: I remembere dl with utorrent, its just that my router couldnt handle the speed it locked itself up
12:37 < hyper_ch> okamis_: more like the concurrent connections and not the speed
12:38 < newegggg> i have fios internet i doubt its the router
12:38 < newegggg> but, maybe my firewall is too strict on the server
12:38 < newegggg> i block all outgoing connections and incomming connections
12:38 < newegggg> except 8888 on which openvpn runs
12:39 < newegggg> i'll try relaxing it a little
12:39 < hyper_ch> newegggg: you need other ports also
12:39 < newegggg> it just happened again
12:39 -!- newegggg [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
12:39 < hyper_ch> actually, you don't need
12:39 < hyper_ch> but on the vpn server you need to forward the ports to your client
12:40 -!- zhanx [~zhanx@cpe-24-59-155-185.twcny.res.rr.com] has joined #openvpn
12:40 < hyper_ch> he quit
12:41 -!- newegggg [~newegggg@208.111.39.186] has joined #openvpn
12:42 < zhanx> ok made the changes to my server's /etc/network/interfaces as described here and now no internet on it https://help.ubuntu.com/community/OpenVPN
12:42 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
12:43 < newegggg> is it normal for openvpn to not be able to hand many connections?
12:44 < hyper_ch> newegggg: what torrent client are you using
12:45 -!- newegggg [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
12:48 -!- newegggg [~newegggg@208.111.39.186] has joined #openvpn
12:52 < okamis_> excuse me i need some help, I can get an ip from my vpn but I cant ping my server http://pastebin.com/ti7ea6X0
12:52 -!- newegggg [~newegggg@208.111.39.186] has quit [Ping timeout: 240 seconds]
12:55 -!- dani [~newegggg@208.111.39.186] has joined #openvpn
12:56 < dani> could it be that torrents require one's public internet ip to be pingable
12:56 < dani> i had ping disabled, have made an exception in the firewall and it appears to be fine now
12:56 -!- dani is now known as Guest27486
12:56 -!- Guest27486 [~newegggg@208.111.39.186] has left #openvpn []
13:20 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
13:24 -!- Gravitron [~admin@64.93.225.245] has joined #openvpn
13:24 -!- Gravitron [~admin@64.93.225.245] has quit [Changing host]
13:24 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
13:29 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
13:29 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
13:29 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
13:29 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
13:42 -!- okamis_ is now known as okamis
13:53 -!- zhanx [~zhanx@cpe-24-59-155-185.twcny.res.rr.com] has left #openvpn ["Leaving"]
13:58 -!- gremly [~gremly@200.106.218.64] has quit [Ping timeout: 240 seconds]
14:17 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
14:37 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:50 -!- travelinrob [~mint@c-66-176-81-117.hsd1.fl.comcast.net] has quit [Quit: Leaving]
15:19 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:24 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 255 seconds]
15:24 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:28 -!- sfdimino [62d280b7@gateway/web/freenode/ip.98.210.128.183] has joined #openvpn
15:29 -!- sfdimino [62d280b7@gateway/web/freenode/ip.98.210.128.183] has quit [Client Quit]
15:31 < pwrcycle> anyone here use kvpn? i'm having a DNS problem after connect.
15:39 < krzie> dunno what kvpn is... but this is the openvpn help channel in case that helps
15:39 -!- Guest27486 [~newegggg@208.111.39.186] has joined #openvpn
15:39 -!- Guest27486 [~newegggg@208.111.39.186] has left #openvpn []
15:40 < hyper_ch> hi krzie
15:42 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
16:03 < krzie> high
16:03 < hyper_ch> krzie: you're quick today
16:03 < krzie> ohya?
16:03 < Olipro> that's what she said
16:03 < krzie> ooo
16:03 < hyper_ch> :)
16:04 < hyper_ch> Olipro: she's allowed to speak in your home?
16:04 < Olipro> only on occasions when I unchain her from the kitchen sink
16:04 < Olipro> </rabid_chauvinism>
16:04 < hyper_ch> :)
16:05 < Olipro> so, since it's christmas and all... you know what'd make a nice present?
16:05 < Olipro> a new release of OpenVPN that supports IPv6 fully
16:05 < hyper_ch> two cats?
16:05 < Olipro> I'm running on devel builds and it's tiresome :(
16:05 < krzie> its actually coming soon
16:06 < krzie> 2.3 is a big release tho
16:06 < hyper_ch> 20gb?
16:06 < Olipro> well, I'm overstating, I made a package on the OBS that pulls the weekly builds off of that server ecrist runs
16:06 < krzie> im sure you prefer it comes out working correctly as opposed to it coming out sooner
16:06 < Olipro> secure-computing.net
16:06 < krzie> right
16:06 < krzie> !snapshots
16:06 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
16:06 < krzie> there =]
16:06 < Olipro> yes, those
16:07 < Olipro> so, if you're an OpenSUSE user who's not afraid of using weekly snapshots...
16:07 < Olipro> I have a package for you
16:07 < Olipro> comes with a package for quagga-0.99.20 at no extra charge!
16:07 < krzie> oh cool you do dynamic routing on your vpn?
16:08 < Olipro> yeah, I use BGP
16:08 < krzie> shit quagga does bgp?
16:08 < Olipro> of course
16:08 < krzie> shows what i know, i thought it was rip only
16:08 < krzie> lol
16:08 < Olipro> nooo
16:08 < krzie> ive never actually had the opportunity to use dynamic routing protocols
16:09 < Olipro> OSPF, OSPF6, BGP, RIP, RIPNG and ISIS
16:09 < krzie> when the network im designing grows a bit and i need to go mesh ill be checking in with you ;]
16:09 < Olipro> I find BGP works rather well for me since I essentially have my router here peered to servers in various countries, and I route prefixes as desired
16:10 < Olipro> such as Hulu, BBC etcetera
16:10 < Olipro> with a bit of redundancy so if a BGP session to one peer goes down, it has another with the same prefix to fall back to
16:11 < Olipro> although one of my servers has peering to dn42, so I've got a somewhat mindbending route-map setup on that one to keep all the prefixes separate
16:12 < okamis> Hi, I have set up a vpn server and I get an ip from it but I cant ping server or see them http://pastebin.com/ti7ea6X0
16:12 < krzie> very cool
16:12 < pwrcycle> !route
16:12 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
16:13 < okamis> Im sure I went for bridge
16:13 < Olipro> openvpn will create a tap interface
16:13 < Olipro> it won't automagically turn it into a bridge
16:13 < pwrcycle> Olipro: what do you use for an openvpn client?
16:13 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
16:14 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
16:14 < Olipro> pwrcycle: are you talking about a GUI?
16:14 < pwrcycle> okamis: check the routing on your server, esp. iptables forwarding tun0 > eth0
16:14 < pwrcycle> Olipro: yes, i'm looking forsomething that will auto-reconnect.
16:14 < Olipro> I never use OpenVPN on windows, it sucks to be perfectly frank
16:14 < Olipro> however, if I'm on my laptop somewhere
16:15 < Olipro> what I *do* have is a small Gentoo VM
16:15 < Olipro> I disable all IP protocols from the windows host and the Gentoo VM gets the internet
16:15 < Olipro> from there it establishes an OpenVPN tunnel and provides it to the Windows Host via a VMWare host-only network adapter over a bridge
16:15 < okamis> pwrcycle: Im sorry to say this, but I have limited knowledge about how iptables and anything about network
16:15 < Olipro> that way, the Windows host thinks it's in my network with no fiddling
16:16 < Olipro> just get the Gentoo VM to connect to the OpenVPN tunnel and everything works as-is
16:16 < krzie> [14:14]  <Olipro> I never use OpenVPN on windows, it sucks to be perfectly frank
16:16 < krzie> i disagree, openvpn works the same on windows as on unix
16:16 < pwrcycle> okamis: then read the howto, then read it again. then tcpdump on tun0 on the client and the server to see where your packets are getting lost.
16:16 < krzie> its the operating system windows which sucks
16:16 < krzie> not openvpn on windows
16:16 < pwrcycle> Olipro: what version of windows?
16:16 < okamis> !howto
16:16 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:16 < Olipro> if you want to look at it that way too, sure
16:17 < Olipro> it's mainly an issue of personal taste too, but I'm not terribly fond of the TAP adapter driver
16:17 < Olipro> Windows 7
16:17 < Olipro> in any case, the Gentoo VM only consumes 24MB of RAM
16:17 < Olipro> so meh
16:17 < krzie> damn, nice vm
16:18 < Olipro> it's Gentoo, it only runs as much crap as you emerge into it
16:18 < Olipro> and it's x86_64
16:18 < krzie> ya ive run gentoo
16:18 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
16:18 < krzie> but it sounds like you trimmed the kernel a bit too
16:19 < Olipro> well, it's full-on with networking features, but yeah, I kept out any unnecessary fluff
16:20 < krzie> i had my gentoo kernel below 2MB, with selinux/pax and whatnot still in
16:20 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
16:20 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:20 < krzie> and still kept the gui stuff (device drivers and whatnot)
16:22 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
16:23 < okamis> pwrcycle: would tcpdump be equal to a tracert on windows?
16:23 < Olipro> no
16:23 < Olipro> traceroute would be equal to a tracert
16:24 < Olipro> seriously, how is that not obvious
16:24 < krzie> must be a webchat user
16:24 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:24 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
16:24 < okamis> very funny
16:25 < Olipro> oh yes, you have webchat users on ignore
16:25 < SviMik> hi all. I use openvpn for internet access. does anybody know how to make internet inaccesible in case of vpn server failure? I mean that all connections should go through vpn, or not to go at all in case of any vpn failure (windows 7)
16:25  * Olipro goes for another can of ottakringer
16:26 < Olipro> SviMik: yeah, once OpenVPN has done the redirect-gateway, delete your default route
16:27 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:27 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
16:27 < SviMik> should I do it manually each time?
16:27 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:27 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
16:28 < Olipro> windows is unlikely to re-add it until DHCP renews
16:28 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:28 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
16:29 < Olipro> but you can always be prudent and check it anyway
16:30 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
16:30 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
16:30 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
16:30 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
16:30 < SviMik> windows will re-add this after reboot :)
16:30 < Olipro> well yes, rebooting would get it re-added
16:34 < SviMik> and I may forget to delete it...
16:35 < Olipro> then your best bet would be to configure a manual IP on the interface
16:35 < Olipro> with no default gateway
16:37 < SviMik> and will it work with openvpn? then I need to add route manually?
16:38 < SviMik> the redirect-gateway should add a route to vpn server, but openvpn have to know a gateway for this
16:40 < Olipro> it will work just fine providing you add an explicit route to the VPN server
16:41 < Olipro> presumably you'd prefer the client to have no internet connectivity than have it and unintentionally connect directly without you wanting it to
16:50 < SviMik> I can't add a route to vpn config, because openvpn tries to connect first, and only then to add routes...
16:50 <+EugeneKay> The short answer is to do it via firewalling.
16:50 <+EugeneKay> The long answer is I have absolutely no clue how to accomplish that with Windows Firewall
16:51 < Olipro> SviMik: no, not to VPN config, to windows, with the route command
16:52 < Olipro> or with netsh, whichever floats your boat
16:58 < SviMik> can't add a route... is something wrong here? route add 80.79.125.12 mask 255.255.255.0 192.168.1.254
16:59 < SviMik> 80.79.125.12 - VPN server, 192.168.1.254 - my router, 192.168.1.64 - my ip
16:59 < SviMik> The route addition failed: The parameter is incorrect.
17:01 < SviMik> sorry, found mistake
17:02 < okamis> sweet, was able to windump http://pastebin.com/tuw4HU6z
17:02 < okamis> would that be correct sir ^^
17:02 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
17:06 < SviMik> NOTE: unable to redirect default gateway -- Cannot read current default gateway from system
17:07 < SviMik> how to redirect-gateway in this case?
17:08 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
17:10 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:11 -!- mode/#openvpn [+o raidz] by ChanServ
17:11 < SviMik> (of course I can add a route again manually... but let assume I don't know gateway ip in vpn network)
17:14 < krzie> you on ppp or something?
17:14 < SviMik> no
17:15 < krzie> pastebin the entire log
17:15 -!- Denial [Denial@drgi.co.uk] has quit []
17:16 < SviMik> krzie if you just connected: I removed the default gateway, do disable intenet while openvpn is not connected
17:16 < SviMik> so it is expected error, that openvpn can't detect default gateway now
17:18 < SviMik> and I added explicit route to VPN server
17:19 < SviMik> now openvpn can connect, but can do redirect-gateway
17:19 < SviMik> *can't
17:19 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
17:20 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
17:20 < SviMik> krzie is log still necessary?
17:30 -!- JoeGazz84 [~JoeGazz84@TechEssentials/JoeGazz84] has quit [Quit: У меня есть более важные дела, чем холостой здесь.]
17:30 -!- Tannerbaum [~Pilif12p@firefox/community/pilif12p] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:30 -!- okamis [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has quit [Quit: Page closed]
17:33 -!- JoeGazz84 [~JoeGazz84@TechEssentials/JoeGazz84] has joined #openvpn
17:34 -!- Pilif12p [~Pilif12p@69.164.210.153] has joined #openvpn
17:43 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
17:56 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
17:57 < krzie> well that was interesting
17:58 < krzie> asked for a log, got explanations of other things he did after i asked for the log, but no log
18:03 <+EugeneKay> There was a clown(elsewhere) the other day who pasted his root password..... and then didn't change it.
18:04 < krzie> lol
18:04 <+EugeneKay> A helpful soul rm -rf /boot && init 0'ed for him before any real damage could be had.
18:04 < krzie> quite helpful
18:05 <+EugeneKay> I suppose moving /etc/shadow elsewhere would have done the trick too
18:30 -!- newl [~newl@97.75.165.156] has joined #openvpn
18:34 -!- samael [~earendil@ip-196-134.sn1.eutelia.it] has quit [Quit: bye]
18:39 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 244 seconds]
18:40 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
19:17 -!- sigius [~sigius@93.125.185.45] has quit [Read error: Connection reset by peer]
19:28 <@vpnHelper> RSS Update - forum: download speed is VERY SLOW <http://forums.openvpn.net/topic9360.html#p18368>
19:34 -!- Pilif12p [~Pilif12p@69.164.210.153] has quit [Changing host]
19:34 -!- Pilif12p [~Pilif12p@firefox/community/pilif12p] has joined #openvpn
19:34 -!- Pilif12p is now known as Tannerbaum
19:34 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
19:53 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
20:13 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 252 seconds]
20:16 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
20:19 -!- master_of_master [~master_of@p57B52AEB.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:23 -!- master_of_master [~master_of@p57B52C59.dip.t-dialin.net] has joined #openvpn
20:41 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
20:49 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
20:56 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
21:48 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 268 seconds]
21:59 -!- Denial [Denial@drgi.co.uk] has quit []
22:01 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:24 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has quit []
22:24 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has joined #openvpn
22:34 <@vpnHelper> RSS Update - forum: [HELP NEEDED] Limited Data Rate <http://forums.openvpn.net/topic9364.html>
22:52 <@vpnHelper> RSS Update - forum: ISP block vpn <http://forums.openvpn.net/topic9365.html>
22:53 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
23:04 <@vpnHelper> RSS Update - forum: help me i was blocked using openvpn(udp) in my country. pls <http://forums.openvpn.net/topic9212.html#p18371>
23:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
23:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
23:28 -!- dym [~patrick@unaffiliated/dym] has joined #openvpn
23:28 < dym> Hey - is there any way i could assign public ip addresses to clients connecting to a vpn server? the server itself has a /26 subnet available. 
23:29 -!- ravemaster [~ravemaste@122.52.137.73] has joined #openvpn
23:29 < ravemaster> can I ask how to create socks proxy,some tutorial
23:29 <+EugeneKay> dym - sure. Is the /26 routed to you?
23:30 < dym> to the server, yes
23:30 < dym> what i want to do is assign the address to the tun of the client
23:30 < dym> well
23:30 < dym> as in have every client assigned his own ip
23:30 <+EugeneKay> Then it's just like any other routed config, but with the public IP space in the --ifconfig directive instead of 10.8.0.0
23:30 < dym> oh
23:31 < dym> is the ip to be configured as an interface on the server?
23:31 < ravemaster> EugeneKay, can I ask tutorial for socks proxy that I can use with openvpn?
23:31 <+EugeneKay> ravemaster - I know nothing about SOCKS proxying, sorry
23:31 <+EugeneKay> dym - no, for that it needs to be routed TO you by your isp
23:32 < dym> EugeneKay: well - its routed to the server 
23:32 < dym> but does it have to be assigned to one of the vpn servers interfaces?
23:32 <+EugeneKay> No, explicitly not.
23:32 < dym> okay
23:32 < ravemaster> OK. do know any site that I can set working socks proxy? I have tried xroxy but their socks proxy does not work with openvpn
23:32 <+EugeneKay> !factoids search socks
23:32 <@vpnHelper> No keys matched that query.
23:33 <+EugeneKay> !factoids search sock
23:33 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
23:33 <+EugeneKay> That's the closest I know of ;-)
23:33 < ravemaster> thats for me? the site is not opening.
23:33 <+EugeneKay> Yup. Oh well. :-p
23:34 <+EugeneKay> Like I said, I have zero idea about socks, sorry.
23:34 < ravemaster> ok. thanks man
23:34 -!- ravemaster [~ravemaste@122.52.137.73] has quit []
23:34 <+EugeneKay> dym - your firewallign will also need to allow it
23:35 <+EugeneKay> !static
23:35 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
23:35 <+EugeneKay> That will probably also be of interest to you
23:35 <+EugeneKay> !topology
23:35 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
23:35 <+EugeneKay> And use of --topology subnet
23:38 < dym> mhhh
23:38 < dym> guess im just gonna have to play about with it a bit
23:38 <+EugeneKay> Yup, best way.
23:40 <+EugeneKay> If you're not doing routed, it's baically the same, but you need to have the IPs on the server, and then SNAT it per-client.
23:40 <+EugeneKay> And DNAT for incoming, if that's how you roll
23:42 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
23:44 < takamichi> !pastebin
23:44 <@vpnHelper> Unable to download feed.
23:46 < takamichi> I've got a problem with a Win7 client and routing - http://pastebin.com/Kuay6mVX - Is anyone avail to help?
--- Day changed Sun Dec 11 2011
00:10 -!- rommel092079 [~ravemaste@122.52.137.73] has joined #openvpn
00:12 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
00:15 -!- rommel092079 [~ravemaste@122.52.137.73] has quit []
00:20 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
00:25 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
00:25 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 248 seconds]
00:33 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
00:40 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
00:42 -!- rommel092079 [~ravemaste@122.52.137.73] has joined #openvpn
00:42 < rommel092079> how to hide openvpn traffic?
00:48 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:49 < rommel092079> how to hide openvpn traffic? layer7 firewall is able to detect this and drop the traffic as per reading from google.
00:59 < rommel092079> advice guys
01:02 <+EugeneKay> !hmac
01:02 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls static
01:02 <@vpnHelper> key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
01:03 <+EugeneKay> You can use that to obfuscate the contents somewhat, but the behaviour(long-running connection to a specific port at a specific IP) is next to impossible to hide.
01:08 < rommel092079> EugeneKay, do you mean use tls key on openvpn conf to hide openvpn traffic? 
01:08 <+EugeneKay> Yes?
01:09 < rommel092079> why with question mark?
01:09 <+EugeneKay> It's kind of obvious that the thing I just had the bot post about is what I mean :-p
01:09 <+EugeneKay> Not sure what else I might mean 
01:10 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
01:11 < rommel092079> EugeneKay, do you know if dpi employes layer 7 firewall?
01:11 <+EugeneKay> Not a clue.
01:11 < takamichi>  Can ayone suggest any directives which may resolve this routing problem? I've tried 'route-method exe' and 'route-delay 20' already- http://pastebin.com/Kuay6mVX 
01:11 < rommel092079> EugeneKay, why tls will hide openvpn traffic though, can you expound more?
01:12 <+EugeneKay> Not really. I'm not big on the underlying math.
01:14 < rommel092079> ok. thanks EugeneKay.
01:15 < rommel092079> takamichi your problem on the pastebin you presented is about disabled dhcp client service
01:16 < rommel092079> it means your dhcp client service on your windows might not be running
01:22 < rommel092079> EugeneKay, still there? I read that dpi identify / clasify traffic based on signatureof the packet. so if it is openvpn signature, it will drop it.  Therefore, it hmac will add additional hmac signature, therefore it will not be considered as openvpn traffic right?  I just re-read that part when you said, obfuscate the content, is content means packet?
01:22 <+EugeneKay> That's the idea, yeah.
01:22 <+EugeneKay> Though I've no idea what mechanisms the firewall in questin actually uses
01:24 < rommel092079> I see. In the wikipedia about dpi, it also says "End points can utilize encryption and obfuscation techniques to evade DPI actions in many cases."  <--- do we have other obfuscation technique other than hmac?
01:33 -!- rommel092079 [~ravemaste@122.52.137.73] has quit []
01:34 <+EugeneKay> Not that I'm aware of. Best you can do is run it over a port normally associated with other TLS services, such as 443, and hope for a false negative
01:34 <+EugeneKay> That would also mean TCP, which is crap
01:51 < Olipro> he left, dear
01:52 < Olipro> takamichi: not without seeing what your routing table looks like after setup, no
01:53 <+EugeneKay> Meh. I have join/parts hidden.
02:12 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
02:18 < takamichi> EugeneKay - Thanks, I'll investigate the dhcp client service
02:18 <+EugeneKay> Sure, but I had nothing to do with it. 
02:18 <+EugeneKay> I hate Windows, as much as I use it.
02:18 < takamichi> Olipro - Thanks
02:25 < hyper_ch> EugeneKay: very little?
02:26 <+EugeneKay> Quite a bit, actually. It's on all my lap+desktops, and then I do AD stuff a good bit for the VMware/NetApp integration
02:27 < hyper_ch> why do you like to torture yourself with it?
02:27 <+EugeneKay> Ever used GNOME 3? ;-)
02:27 < hyper_ch> KDE > Gnome
02:28 <+EugeneKay> If you throw enough billions at software devs, eventually they'll make a nice system. Windows 7 / Office 2010 are good examples of this principle in action.
02:29 < hyper_ch> I tend to disagree
02:30 <+EugeneKay> Worksforme, and it does 3D games :-p
02:31 < hyper_ch> office 2010 does 3d games?
02:32 <+EugeneKay> No, W7 does -_-
02:32 <+EugeneKay> Though I've not tried Office macros much
02:32 < hyper_ch> who needs 3d games anyway
02:33 <+EugeneKay> <----
02:33 < hyper_ch> you don't need them
02:34 <+EugeneKay> Killing space aliens is a hobby of mine
02:34 < hyper_ch> so you like to play space invaders?
03:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
03:30 <@vpnHelper> RSS Update - forum: [REQ] How To Make OpenVPN server Management <http://forums.openvpn.net/topic9317.html#p18204>
03:31 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:47 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 244 seconds]
04:46 -!- pqatsi [~leleobhz@unaffiliated/leleobhz] has joined #openvpn
05:23 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
05:23 -!- ibins [~michl@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has joined #openvpn
06:09 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:10 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
06:10 -!- pqatsi [~leleobhz@unaffiliated/leleobhz] has quit [Ping timeout: 268 seconds]
06:10 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:13 -!- ibins [~michl@2001:6f8:1c60:7777:ee9b:5bff:fed3:7cc0] has quit [Quit: ibins]
06:16 -!- roentgen [~arthur@79.117.77.134] has joined #openvpn
06:16 -!- roentgen [~arthur@79.117.77.134] has quit [Changing host]
06:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:23 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:38 -!- catsup [~d@ps38852.dreamhost.com] has quit [Read error: Connection reset by peer]
06:38 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
07:03 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
07:07 -!- dym [~patrick@unaffiliated/dym] has left #openvpn []
07:09 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:39 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
07:44 < FeileX> Anybody active?
07:47 < hyper_ch> FeileX: you are
07:50 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 268 seconds]
07:54 < FeileX> hehe, thanks hyper_ch
07:54 < FeileX> Question for ya, maybe...
07:54 < FeileX> You know if there is anyway to have the DNS option that is pushed by OpenVPN to be secondary?
07:55 < FeileX> IE, always check with my ISP, but only check with my VPN dns afterwards?
07:56 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
08:11 < hyper_ch> you can push dns servers... one or more
08:11 < hyper_ch> so, push your ISPs and then your other desired ones
08:15 < FeileX> ah ok
08:15 -!- rommel092079 [~rave@184.22.182.246] has joined #openvpn
08:17 < rommel092079> EugeneKay, tls-auth ta.key is this am I suppose to add in my config?
08:17 < rommel092079> !hmac
08:17 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
08:17 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
08:22 < rommel092079> kay I ask how to create ta.kay. thanks
08:24 -!- rommel092079 [~rave@184.22.182.246] has quit []
08:44 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:45 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
09:04 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
09:07 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
09:30 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
09:40 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
09:51 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:56 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:58 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Read error: Connection reset by peer]
09:58 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
10:25 <@vpnHelper> RSS Update - forum: Simulate OpenVPN - Suggestions <http://forums.openvpn.net/topic9366.html>
10:39 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 244 seconds]
10:40 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
10:41 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
10:41 -!- oc80z [oc80z@blea.ch] has joined #openvpn
10:59 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 268 seconds]
11:09 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
11:23 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
11:23 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
11:23 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
11:25 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18373>
11:59 -!- me345 [~me345@75.15.183.164] has joined #openvpn
12:23 < FeileX> gentoo....
12:23 < FeileX> woof
12:26 < jeev> yup, slackware, ROARRRRRRR
12:38 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
12:49 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
13:30 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 244 seconds]
13:31 -!- bretanika [bretanika@89.114.11.171] has quit []
13:34 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
13:51  * WebDawg http://www.youtube.com/watch?feature=player_embedded&v=G9qZZVqSQdo
13:51 <@vpnHelper> Title: The Saving American Democracy Amendment - YouTube (at www.youtube.com)
14:00 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
14:00 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
14:00 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
14:01 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:02 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
14:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:40 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 252 seconds]
14:41 -!- pqatsi [~leleobhz@unaffiliated/leleobhz] has joined #openvpn
14:42 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
14:44 < pqatsi> I have a server configured with tls/dh/tls-auth. In one client (Ubuntu Oneiric) it works very well, but in client for android (Ovpn v2.1.1) the connection dont complete and i got in server a "Authenticate/Decrypt packet error: packet HMAC authentication failed" and "TLS Error: incoming packet authentication failed from [AF_INET]ip:clientport"
14:44 < pqatsi> can be android client version a issue?
14:45 < pqatsi> im testing both clients from same nated network and my server is inside a vps, so no NAT for incomming in server
14:56 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18374>
15:23 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
15:23 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
15:25 < krzie> !hmac
15:25 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls static key
15:25 <@vpnHelper> , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
15:29 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has quit [Ping timeout: 268 seconds]
15:30 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
15:32 < krzie> pqatsi, ^
15:32 < pqatsi> krzie: same key, why works in my desktop and not in android?
15:33 < pqatsi> i transfered all keys and confs via sftp, so i can imagine its corrupted or changed
15:34 < pqatsi> krzie: this is because i think in a version issue or even the fact im using same nated connection to reach server
15:34 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
15:34 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
15:34 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:34 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:44 <@vpnHelper> RSS Update - forum: Setting up Openvpn client <http://forums.openvpn.net/topic9338.html#p18375>
15:49 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:51 -!- SteveXVII [~nullun@thezoo.in] has quit []
16:07 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 244 seconds]
16:09 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
16:18 -!- Netsplit over, joins: R-66Y, cherwin
16:18 -!- Netsplit *.net <-> *.split quits: Denial, WebDawg, Bruk0ut, Zimsky, @raidz, Mp5shooter, Diffen, tty234, ScriptFanix, zu,  (+89 more, use /NETSPLIT to show all of them)
16:18 -!- caesay [~caesay@socialshock.net] has joined #openvpn
16:18 -!- Netsplit over, joins: bragon, Kateon
16:18 -!- jeev__ [1004@216.59.33.80] has joined #openvpn
16:18 -!- Netsplit over, joins: peper
16:18 -!- Netsplit over, joins: MrWGW, sled-dog, master_of_master, JoeGazz84, Zimsky, luckman212, hyper_ch, GHAI, Olipro, yell0 (+2 more)
16:18 -!- caesay is now known as Guest84799
16:18 -!- Netsplit over, joins: Xeross, fahadsadah, fridim_, caemir, Diffen, bauruine, JPeterson, deever, mcp, cali_ (+13 more)
16:19 -!- Netsplit over, joins: Fiouz
16:19 -!- me345 [~me345@75.15.183.164] has quit [Max SendQ exceeded]
16:19 -!- jeev__ is now known as jeev
16:19 -!- jeev [1004@216.59.33.80] has quit [Changing host]
16:19 -!- jeev [1004@unaffiliated/jeev] has joined #openvpn
16:19 -!- Netsplit over, joins: MrPPS, sia^pwnnt, tabakhase, kloeri, Bruk0ut
16:19 -!- Netsplit over, joins: mete, openbsdnoob, pqatsi, Tannerbaum, cyberspace-, +EugeneKay, diytto
16:19 -!- Agin_ [~Agin@greenzone.copyleft.no] has joined #openvpn
16:19 -!- Netsplit over, joins: _quadDamage, chokesmaster, APTX_, evilhackerdude, mrsno_, amir, dkr, fbh, Deathvalley122, |Mike|
16:20 -!- JoeGazz84 [~JoeGazz84@TechEssentials/JoeGazz84] has quit [Quit: У меня есть более важные дела, чем холостой здесь.]
16:20 -!- JoeGazz84 [~JoeGazz84@TechEssentials/JoeGazz84] has joined #openvpn
16:20 -!- Netsplit over, joins: @raidz, @dazo_afk, @vpnHelper, Mowee, madsage, FeileX, freaky[t], LuckyY, krphop_, dvl (+3 more)
16:21 -!- Netsplit over, joins: inimino
16:21 -!- batrick [~batrick@batbytes.com] has joined #openvpn
16:21 -!- me345 [~me345@adsl-75-15-183-164.dsl.bkfd14.sbcglobal.net] has joined #openvpn
16:21 -!- Netsplit over, joins: Rolybrau, Mp5shooter, gffa, zu, Dougy
16:21 -!- me345 [~me345@adsl-75-15-183-164.dsl.bkfd14.sbcglobal.net] has quit [Max SendQ exceeded]
16:21 -!- me345 [~me345@adsl-75-15-183-164.dsl.bkfd14.sbcglobal.net] has joined #openvpn
16:21 -!- Netsplit over, joins: Ionic
16:23 -!- dioz [~dioz@2001:470:1f11:12a9::1] has joined #openvpn
16:25 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
16:25 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
16:25 -!- folivora [bomshiva@koekaniini.kelju.fi] has joined #openvpn
16:25 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
16:25 -!- twobitsprite [~isaac@li24-165.members.linode.com] has joined #openvpn
16:25 -!- gustav [~gustav@sockensaft.garagenwein.at] has joined #openvpn
16:25 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
16:25 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has joined #openvpn
16:25 -!- __nolife [~Lirezh@83-64-53-66.kocheck.xdsl-line.inode.at] has joined #openvpn
16:25 -!- tty234 [telex@gateway/shell/anapnea.net/x-fvlfjgbhsvenzion] has joined #openvpn
16:25 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
16:26 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
16:26 -!- novaflash [~novaflash@openvpn/user/novaflash] has joined #openvpn
16:29 -!- oc80z [oc80z@blea.ch] has joined #openvpn
16:30 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
16:32 -!- Netsplit *.net <-> *.split quits: TJNII
16:33 -!- Netsplit over, joins: TJNII
16:34 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
16:48 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html>
16:51 -!- me345 [~me345@adsl-75-15-183-164.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
17:01 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
17:28 -!- affix0 [~ident@042-120-128-083.dynamic.caiway.nl] has quit [Quit: —I-n-v-i-s-i-o-n— 3.3 (November '11)]
17:44 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:11 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
18:11 < rommel092079> guys when connection,I am stuck at SENT CONTROL [ihide]: 'PUSH_REQUEST' (status=1) then restarts the process. what is the problem here?
18:28 < rommel092079> guys when connection,I am stuck at SENT CONTROL [ihide]: 'PUSH_REQUEST' (status=1) then restarts the process. what is the problem here?
18:48 -!- rommel092079 [~ravemaste@122.2.46.76] has quit [Read error: Connection reset by peer]
19:04 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
19:28 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
19:33 -!- troyt [~troyt@2001:5c0:1000:b::a06b] has quit [Ping timeout: 252 seconds]
19:52 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 248 seconds]
19:58 -!- pqatsi [~leleobhz@unaffiliated/leleobhz] has quit [Quit: leaving]
19:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
19:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:00 -!- tjz [~pc@bb219-74-60-116.singnet.com.sg] has joined #openvpn
20:00 -!- tjz [~pc@bb219-74-60-116.singnet.com.sg] has quit [Changing host]
20:00 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
20:01 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:01 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
20:01 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
20:21 -!- master_of_master [~master_of@p57B52C59.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:23 -!- master_of_master [~master_of@p57B55A82.dip.t-dialin.net] has joined #openvpn
20:37 <@vpnHelper> RSS Update - forum: What DNS is used when connected thought openVPN <http://forums.openvpn.net/topic9368.html>
20:49 <@vpnHelper> RSS Update - forum: What DNS is used when connected thought openVPN <http://forums.openvpn.net/topic9368.html#p18378>
21:46 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
21:47 < rommel092079> EugeneKay, I am stuck at SENT CONTROL in log file status. what could be happening?
22:01 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
22:14 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
22:37 -!- corretico [~luis@190.211.93.11] has joined #openvpn
22:58 -!- rommel092079 [~ravemaste@122.2.46.76] has quit []
23:55 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
--- Day changed Mon Dec 12 2011
00:04 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
00:52 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
00:53 < rommel092079> guys in my log, I am stuck at SENT CONTROL. what is the problem? how can it be solved?
01:00 -!- MrWGW [MrWGW@74.124.192.8] has quit [Ping timeout: 255 seconds]
01:02 < rommel092079> !hmac
01:02 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
01:02 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
01:02 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
01:07 <@vpnHelper> RSS Update - forum: Simulate OpenVPN - Suggestions <http://forums.openvpn.net/topic9366.html#p18381> || Setting up Openvpn client <http://forums.openvpn.net/topic9338.html#p18380>
01:10 -!- gustav is now known as beerbro
01:19 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18383> || whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18382>
01:39 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 252 seconds]
01:48 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
01:48 -!- mode/#openvpn [+o raidz] by ChanServ
01:51 -!- rommel092079 [~ravemaste@122.2.46.76] has quit []
01:55 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18385> || Can only ping/access Router and OpenVPN Server <http://forums.openvpn.net/topic9356.html#p18384>
01:56 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
01:56 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
02:01 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18386>
02:05 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
02:07 <@vpnHelper> RSS Update - forum: TLS Error: TLS key negotiation failed to occur within 60 sec <http://forums.openvpn.net/topic9362.html#p18387>
02:14 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:15 -!- dazo_afk is now known as dazo
02:16 -!- _julian [~quassel@hmbg-5f76130b.pool.mediaWays.net] has joined #openvpn
02:25 <@vpnHelper> RSS Update - forum: Simulate OpenVPN - Suggestions <http://forums.openvpn.net/topic9366.html#p18388>
02:32 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:37 <@vpnHelper> RSS Update - forum: can't use my vpn configuration - private key password failed <http://forums.openvpn.net/topic9357.html#p18389>
03:03 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
03:08 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
03:20 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
03:26 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
03:26 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
03:26 <@vpnHelper> RSS Update - forum: can't use my vpn configuration - private key password failed <http://forums.openvpn.net/topic9357.html#p18392> || whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18391> || Simulate OpenVPN - Suggestions <http://forums.openvpn.net/topic9366.html#p18390>
03:38 -!- xizhendu is now known as xizhendu|off
03:45 <@vpnHelper> RSS Update - forum: can't use my vpn configuration - private key password failed <http://forums.openvpn.net/topic9357.html#p18394> || speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html>
04:13 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
04:13 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
04:21 <@vpnHelper> RSS Update - forum: ICMP Redirect (For Host)/Internet traffic via OpenVPN <http://forums.openvpn.net/topic9370.html>
04:23 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
04:33 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
04:34 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
04:40 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
05:02 -!- fbh [fbh@lucifer.frands.net] has quit [Changing host]
05:02 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
05:13 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
05:15 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:15 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
05:26 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
05:28 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:39 <@vpnHelper> RSS Update - forum: ICMP Redirect (For Host)/Internet traffic via OpenVPN <http://forums.openvpn.net/topic9370.html#p18397> || Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18396>
05:45 <@vpnHelper> RSS Update - forum: speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18399> || I can connect to Openvpn but cannot see or Ping the internal <http://forums.openvpn.net/topic9363.html#p18398>
05:51 <@vpnHelper> RSS Update - forum: Push options priority <http://forums.openvpn.net/topic9361.html#p18401> || Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18400>
05:59 -!- corretico [~luis@190.211.93.11] has quit [Remote host closed the connection]
06:03 <@vpnHelper> RSS Update - forum: speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18402>
06:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
06:14 -!- kyrix [~ashley@mk089144206135.a1.net] has joined #openvpn
06:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:33 -!- bjorneven [~quassel@122.85-200-248.bkkb.no] has quit [Remote host closed the connection]
06:45 <@vpnHelper> RSS Update - forum: Simulate OpenVPN - Suggestions <http://forums.openvpn.net/topic9366.html#p18403>
06:45 -!- rommel092079 [~rave@112.198.82.185] has joined #openvpn
06:47 < rommel092079> when I use ta.key on my server config, I am seeing 'Using 160 bit message hash 'SHA1' for HMAC authentication'.  Can I increase the 160 bit message hash to much higher value?
06:55 < rommel092079> guys I need your help please
06:57 <@ecrist> rommel092079: not without adjusting things in the source.  I don't think you need to worry about that.
07:01 < rommel092079> ecrist, I wanted to increase it. does the auth sha1 relates to this hmac bit? what if I use sha2, is that possible?  I wiki the sha1 and yes it is 160bit and there is sha2 that has 256 and 512 bit.  I wanted it to be on 512 or higher bit. please direct me.
07:03 <@ecrist> no, leave it alone, or figure it out yourself.
07:06 -!- rommel092079 [~rave@112.198.82.185] has quit [Read error: Connection reset by peer]
07:07 -!- cpm [~Chip@pool-108-15-147-111.altnpa.east.verizon.net] has joined #openvpn
07:07 -!- cpm [~Chip@pool-108-15-147-111.altnpa.east.verizon.net] has quit [Changing host]
07:07 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:21 -!- `Ile` [~kvirc@77-46-176-68.dynamic.isp.telekom.rs] has joined #openvpn
07:25 <@dazo> gee, that rommel guy doesn't have much clue between hashing and encryption algorithms ... 
07:25 <@ecrist> right
07:45 -!- kyrix [~ashley@mk089144206135.a1.net] has quit [Quit: Ex-Chat]
07:48 -!- bauruine [~stefan@186-51.192-178.cust.bluewin.ch] has joined #openvpn
07:49 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
08:15 <@vpnHelper> RSS Update - forum: Setting up vpn server on my vps windows server <http://forums.openvpn.net/topic9095.html#p18404>
08:19 -!- get [~get@unaffiliated/get] has joined #openvpn
08:19 < get> hi all
08:20 < get> any way to use openvpn on ipad with no jailbreak ?
08:20 <@ecrist> no
08:21 < get> own
08:21 <@vpnHelper> RSS Update - forum: Difference between OpenVPN Desktop and Connect clients? <http://forums.openvpn.net/topic9068.html#p18405>
08:21 < get> shame
08:22 < get> so im stucking on a brand new ipad2 with ios 5.0.1 and no way to get it workin with my vpn ... nice job from apple.
08:23 <@ecrist> you can set up a PPTP vpn, I think those are supported
08:25 < get> yes but i have already openvpn 
08:25 < get> i have also ipsec from cisco, but i get no intranet dns resolution
08:25 <@ecrist> trust me, we fell your pain, but there's nothing we can do about it
08:25 < get> cause i have .local domain.
08:25 < get> ecrist: i beleve it
08:26 < get> sorry for my rusty english.
08:27 <@ecrist> no worries
08:28 < get> and apple didnt include the already app on their appstore
08:29 < get> ... i have to check if i can jailbreak the device ..
08:32 <@ecrist> google Redsn0w
08:36 < get> great,
08:36 < get> another issue
08:36 < get> i have deleted the 3 files i have created for testing with no prior revoke
08:36 < get> created by easy-rsa
08:37 -!- Axeman [~Axeman3@198.105.46.22] has joined #openvpn
08:37 -!- Axeman [~Axeman3@198.105.46.22] has quit [Changing host]
08:37 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:37 -!- mode/#openvpn [+v Axeman] by ChanServ
08:37 < get> any way to revoke the "deleted" user?
08:42 -!- bauruine [~stefan@186-51.192-178.cust.bluewin.ch] has quit [Remote host closed the connection]
08:42 <@ecrist> no, you need the certificate
08:45 < get> grrr.
08:45 < get> there is no way to rip the user manually off
08:45 < get> i need to create the user again
08:45 < get> with same username
08:46 < krzee> you need a new pki
08:46 < krzee> all clients and the server, new ca all together
08:49 -!- rommel092079 [~rave@184.22.193.208] has joined #openvpn
08:50 -!- Axeman2 [~Axeman3@198.105.46.46] has joined #openvpn
08:50 -!- Axeman2 [~Axeman3@198.105.46.46] has quit [Changing host]
08:50 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:50 -!- mode/#openvpn [+v Axeman2] by ChanServ
08:50 < rommel092079> I got Assertion failed at crypto.c:162 after Initialization Sequence Completed
08:53 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
08:53 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
08:56 <@vpnHelper> RSS Update - forum: Additional IP-adresses in 1 OpenVPN-tunnel [Newbie] <http://forums.openvpn.net/topic9371.html>
09:00 < rommel092079> ok. this is solve.
09:00 -!- rommel092079 [~rave@184.22.193.208] has quit []
09:01 < hyper_ch> howdy krzee
09:01 < krzee> oops i forgot to ignore him on this client (rommel)
09:02 < hyper_ch> why would you want to do that?
09:02 < hyper_ch> and do you have me ignored on any client?
09:02 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
09:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
09:08 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:14 < get> i have solved it
09:15 < get> i have created a new user with different name
09:15 < get> so i only need the files to connect to openvpn, the rest is validated thru ldap agains our DC
09:15 < get> so i have to provide my domain\username and password everytime i start openvpn
09:21 < hyper_ch> get: any reason why you use ldap auth?
09:22 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-pjrrvvzdtgbjwfpa] has quit [Remote host closed the connection]
09:25 < get> hyper_ch: yes, we have this policy at office
09:26 < get> to validate all users thru active directory
09:26 < hyper_ch> ok
09:27 < get> and now we are using the cisco ipsec option
09:27 < get> and get same error like described here https://discussions.apple.com/thread/2643177?start=0&tstart=0
09:27 <@vpnHelper> Title: iPhone Cisco VPN using IPSEC - DNS not...: Apple Support Communities (at discussions.apple.com)
09:29 < get> thats why im trying to get openvpn workin.
09:29 < hyper_ch> good luck :) you'll manage
09:35 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
09:36 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:51 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-fjjbhvfnkcryzxvv] has joined #openvpn
10:20 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html>
10:26 -!- ibins [~Michael@dslb-084-056-126-107.pools.arcor-ip.net] has joined #openvpn
10:43 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
10:50 <@vpnHelper> RSS Update - forum: Additional IP-adresses in 1 OpenVPN-tunnel [Newbie] <http://forums.openvpn.net/topic9371.html#p18408>
10:56 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18409>
11:01 -!- lJ6il [~lJ6il@21.138.10.109.rev.sfr.net] has joined #openvpn
11:01 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:02 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
11:02 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
11:02 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:03 < lJ6il> Hi there I don't know where to find an answer to my problem... And i know it's a bit "offtopic" here but... I'm trying to buy an account on vpntunnel.se and it redirects me on a secured page named "Payex". Does someone know this site ? I know Paypal but I don't know this one and I don't know how to check if i can trust this
11:03 < hyper_ch> lJ6il: there's many credit card processors
11:03 < hyper_ch> did you google for payex?
11:04 < lJ6il> Yes... 
11:05 < lJ6il> No one tells they are liars or rubbers, but noone tells about them
11:05 < hyper_ch> don't know then
11:06 < lJ6il> ok thanks hyper_ch ;)
11:06 < hyper_ch> http://images.piccsy.com/cache/images/clikr-fun-fun-fun-fun---clikr-179116-500-520.jpg
11:08 <@vpnHelper> RSS Update - forum: SOLVED: Tap driver install fail on Windows XP SP3 <http://forums.openvpn.net/topic8485.html#p18411> || speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18410>
11:10 -!- get [~get@unaffiliated/get] has quit [Ping timeout: 268 seconds]
11:21 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 252 seconds]
11:23 -!- andj [~adriaan@openvpn/community/developer/andj] has joined #openvpn
11:23 -!- mode/#openvpn [+o andj] by ChanServ
11:24 -!- dazo is now known as dazo_afk
11:24 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
11:27 -!- get [~get@212.162.18.90] has joined #openvpn
11:30 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
11:31 -!- `Ile` [~kvirc@77-46-176-68.dynamic.isp.telekom.rs] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
11:35 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
11:36 < hyper_ch> http://www.cs.dartmouth.edu/reports/abstracts/TR2011-705/
11:36 <@vpnHelper> Title: Dartmouth TR2011-705 (at www.cs.dartmouth.edu)
11:43 -!- lJ6il [~lJ6il@21.138.10.109.rev.sfr.net] has quit [Quit: Quitte]
11:45 -!- get [~get@212.162.18.90] has quit [Ping timeout: 252 seconds]
11:46 < krzee> hyper_ch, ;]
11:46 < hyper_ch> krzee: to which?
11:46 < krzee> [11:02]  <hyper_ch> why would you want to do that?
11:46 < krzee> [11:02]  <hyper_ch> and do you have me ignored on any client?
11:46 < hyper_ch> ah :)
11:46 < krzee> then i disappeared for a bit
11:47 < hyper_ch> krzee: http://images.piccsy.com/cache/images/clikr-fun-fun-fun-fun---clikr-179116-500-520.jpg
11:47 -!- get [~get@212.162.18.90] has joined #openvpn
11:49 < hyper_ch> krzee: so you didn't ignore me... you just disappeared?
11:50 < krzee> lol ya
11:50 < krzee> never ignored you
11:50 < krzee> that guy has been coming for a long long time, he has never once tried to help himself
11:50 < krzee> unless ignored
11:50 < krzee> i figure paying attention to him would only be a disservice to him
11:51 < krzee> ;]
11:56 -!- MarKsaitis [~MarKsaiti@88.96.60.78] has joined #openvpn
12:10 < Essobi> lulz
12:11 -!- get [~get@212.162.18.90] has quit [Quit: Lost terminal]
12:11 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:11 -!- mode/#openvpn [+v s7r] by ChanServ
12:24 -!- MarKsaitis [~MarKsaiti@88.96.60.78] has quit [Ping timeout: 268 seconds]
12:29 -!- dkr [~dkr@67.132.255.16] has quit [Quit: Leaving]
12:34 -!- lJ6il [~lJ6il@109.10.138.21] has joined #openvpn
12:37 -!- Agin_ is now known as Agin
12:38 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
12:40 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
13:22 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
13:25 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
13:37 < lJ6il> hello there. I have an account on vpntunnel.se since 2 hours. It's the first time I use a VPN. I configured it as it is written in the howto. I can connect, but when i try to surf on the web (google.com for example), firefox says "looking up..." and maybe 30 seconds after, it says the connection couldn't be etablished. I don't understand very well.
13:37 < lJ6il> I'm on Archlinux and I use NetworkManager. Are there ports in firewall i should open, maybe ? Thanks
13:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 248 seconds]
13:45 <@ecrist> lJ6il: we don't support third-party tunnels
13:45 <@ecrist> you'll need to get support from them
13:45 < lJ6il> ok thanks ecrist ;)
13:54 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
13:58 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has joined #openvpn
13:59 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
13:59 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
14:00 -!- mode/#openvpn [+o raidz] by ChanServ
14:01 -!- gremly [~gremly@200.106.218.64] has quit [Read error: Connection reset by peer]
14:03 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:05 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
14:06 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
14:06 -!- mode/#openvpn [+o raidz] by ChanServ
14:10 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 240 seconds]
14:12 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
14:13 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
14:14 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
14:14 -!- mode/#openvpn [+o raidz] by ChanServ
14:17 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 252 seconds]
14:18 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
14:22 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 240 seconds]
14:25 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
14:36 < fridim_> lJ6il, follow their howto, it just works.
14:40 < lJ6il> fridim_:  I works on a VM running Windows. On my archlinux, it just doesn't work and I don't know why
14:40 < lJ6il> it works*
14:40 < lJ6il> on a VM running Windows*
14:41 < fridim_> check that the routes are well pushed,  check thant the vpn server respond well when the tunnel is created, ... and as ecrist said, just ask support from them :)
14:42 < fridim_> and use  openvpn command instead of networkmanager
14:42 < fridim_> better output ;)
14:43 < lJ6il> Yeah, i'm going to try this (openvpn directly) for now... Thanks. To check that the vpn server responds I just ping the gateway they gave me ?
14:44 < fridim_> yep
14:44 < fridim_> if the gateway responds and if your routes are good, then it should work. If not, ask them.
14:44 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Read error: Operation timed out]
14:45 < lJ6il> ok thanks you fridim_ :)
14:45 < fridim_> np
14:45 < lJ6il> thank you*
14:46 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has quit []
14:46 <@ecrist> !networkmanager
14:46 <@ecrist> !ubuntu
14:46 <@vpnHelper> "ubuntu" is dont use network manager!
14:59 -!- lJ6il [~lJ6il@109.10.138.21] has quit [Ping timeout: 240 seconds]
15:12 -!- lJ6il [~lJ6il@178.73.193.215] has joined #openvpn
15:21 < Olipro> what changed in the new OpenVPN source? calling a --up script with an arg from a config file no longer works
15:22 < pwrcycle> Olipro: are you uing security-level 3 (i think that's it)
15:22 < Olipro> no, 2
15:24 < Olipro> 3 -- allow password to be passed to scripts via env
15:25 < Olipro> in my config file I have:
15:25 < Olipro> up /etc/openvpn/up-script.sh 2001:db8::1/64
15:25 < Olipro> which has recently stopped working in the latest devel snapshots
15:26 < hyper_ch> you use ipv6?
15:26 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
15:26 < Olipro> shocking, I know
15:26 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Client Quit]
15:26 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
15:26 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
15:27 < hyper_ch> Olipro: are you canadian?
15:27 < Olipro> nope
15:27 < hyper_ch> I met two people today who use IPv6
15:27 < hyper_ch> I think it's a conspiracy!!!
15:28 < Olipro> get with the times
15:28 < hyper_ch> conspiracy... I tell you
15:33 -!- twobitsprite [~isaac@li24-165.members.linode.com] has left #openvpn []
15:34 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
15:34 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
15:34 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
15:35 -!- oc80z [oc80z@blea.ch] has joined #openvpn
15:35 -!- lJ6il [~lJ6il@178.73.193.215] has quit [Read error: Operation timed out]
15:35 -!- lJ6il [~lJ6il@109.10.138.21] has joined #openvpn
15:37 < Olipro> well that was simple enough
15:37 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:37 < Olipro> just used setenv to create a var with the address
15:41 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 252 seconds]
15:57 <@vpnHelper> RSS Update - forum: ICMP Redirect (For Host)/Internet traffic via OpenVPN <http://forums.openvpn.net/topic9370.html#p18412>
16:02 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
16:06 -!- CorvetteZR1 [~scratchi@194.34.234.216.sta.connection.ca] has joined #openvpn
16:06 < CorvetteZR1> hello.  is there anyway to enable cryptodev on a windows xp openvpn client?
16:07 < CorvetteZR1> when i add engine cryptodev to the client config, it fails to connect with error - OpenSSL error: cannot load engine 'cryptodev'
16:08 < CorvetteZR1> do i have to install some libs on windows to make this work?  any ideas?
16:09 -!- lJ6il [~lJ6il@109.10.138.21] has quit [Ping timeout: 248 seconds]
16:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
16:19 -!- lJ6il [~lJ6il@178.73.193.215] has joined #openvpn
16:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:23 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
16:26 -!- lJ6il [~lJ6il@178.73.193.215] has quit [Ping timeout: 252 seconds]
16:34 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:37 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:41 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
16:52 -!- KaiForce [~chatzilla@adsl-70-228-67-209.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.87 [Firefox 8.0.1/20111120135848]]
17:05 -!- ibins [~Michael@dslb-084-056-126-107.pools.arcor-ip.net] has quit [Remote host closed the connection]
17:12 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Read error: Operation timed out]
17:37 -!- MarKsaitis__ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:39 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 255 seconds]
17:41 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
17:41 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
17:43 <@vpnHelper> RSS Update - forum: Disable split tunneling <http://forums.openvpn.net/topic9373.html>
18:01 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
18:02 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Ping timeout: 252 seconds]
18:07 -!- CorvetteZR1 [~scratchi@194.34.234.216.sta.connection.ca] has quit [Quit: Leaving]
18:08 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:18 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
18:20 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 252 seconds]
18:21 -!- MarKsaitis__ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
18:22 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
18:33 -!- rommel092079 [~ravemaste@184.22.182.246] has joined #openvpn
18:34 < rommel092079> guys I am stuck at Sent Control and then restarts the process.  what is the matter?
18:35 < rommel092079> it is supposed to be after that sent control process, the next step should be PUSH: Received control message, butI dont arrive there.
18:37 -!- MarKsaitis__ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
18:40 -!- Arctic [~arctic@64.107.219.222] has joined #openvpn
18:41 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
18:41 < Arctic> !welcome
18:41 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:42 < rawplayer> !goal
18:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:42 < rawplayer> !/30
18:42 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
18:42 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
18:42 < rawplayer> !topology
18:42 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
18:42 < krzie> =]
18:45 < rommel092079> krzie, can you help me with my problem
18:48 -!- rommel0920 [~ravemaste@122.2.46.76] has joined #openvpn
18:48 < rommel0920> krzie can you help
18:49 < rommel0920> or anybody kindly
18:50 -!- rommel092079 [~ravemaste@184.22.182.246] has quit [Ping timeout: 245 seconds]
18:54 -!- Arctic [~arctic@64.107.219.222] has quit [Ping timeout: 252 seconds]
19:04 -!- rommel0920 [~ravemaste@122.2.46.76] has quit []
19:09 -!- Denial [Denial@drgi.co.uk] has quit []
19:16 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 252 seconds]
19:16 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has joined #openvpn
19:35 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18414>
19:36 -!- adolfomaltez [~taro@190.62.215.67] has joined #openvpn
19:38 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
19:41 -!- MarKsaitis__ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
19:52 -!- gyyrog [~gyyrog@adsl-99-155-144-113.dsl.klmzmi.sbcglobal.net] has joined #openvpn
19:56 -!- _julian_ [~quassel@hmbg-5f767d7a.pool.mediaWays.net] has joined #openvpn
20:00 -!- _julian [~quassel@hmbg-5f76130b.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
20:07 -!- xizhendu|off is now known as xizhendu
20:08 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
20:17 -!- zalzice_ [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
20:17 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 268 seconds]
20:19 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
20:22 -!- master_of_master [~master_of@p57B55A82.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:23 -!- master_of_master [~master_of@p57B5403C.dip.t-dialin.net] has joined #openvpn
20:24 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
20:29 -!- oc80z [oc80z@blea.ch] has quit [Changing host]
20:29 -!- oc80z [oc80z@openvpn/user/oc80z] has joined #openvpn
20:31 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
20:37 -!- gyyrog [~gyyrog@adsl-99-155-144-113.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
20:38 -!- gyyrog [~gyyrog@adsl-99-155-144-113.dsl.klmzmi.sbcglobal.net] has joined #openvpn
20:41 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Read error: Operation timed out]
20:44 -!- adolfomaltez [~taro@190.62.215.67] has quit [Ping timeout: 240 seconds]
20:45 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
20:56 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
21:01 -!- adolfomaltez [~taro@190.62.219.136] has joined #openvpn
21:11 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18415>
21:19 < TJNII> So a thought just crossed my mind... I want to set up a OpenVPN cluster.  If I use a routing config instrad of bridging where the clients get a RFC1918 address and the server NATs, if a server fails will the user's connections get dropped on failover?
21:19 < TJNII> I'd assume so, whereas with a bridge the client could keep its direct IP and the connection would resume when the ARP tables catch up.
21:20 < TJNII> hmm.. Perhaps I should set up both and test.
21:25 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
21:25 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
21:25 < rommel092079> guys, please help. I am stuck in SENT CONTROL.
21:28 -!- adolfomaltez [~taro@190.62.219.136] has quit [Ping timeout: 240 seconds]
21:28 < rommel092079> I have this question, I used no-ip.org account to be used in my remote directive and with that, I can see that it can connect outside to internet because it detects the ip address of my remote server. but after that I am stuck at SENT CONTROL in the log file.
21:37 < krzee> general networking issue, unrelated to openvpn
21:38 < krzee> TJNII, please let us know hor your testing goes, that would be a great addition to our wiki =]
21:39 < TJNII> krzee: Rodger
21:39 < TJNII> I just got the green light for a vSphere cluster, so I think a nice test of 3 routing, 3 bridging would be very nice.
21:39 < krzee> thing is, if ips will float, you cant go tun
21:39 < krzee> cause then you'd need dynamic iroutes, which dont exist (although there was talk of it before)
21:40 < krzee> but with tap no iroute needed
21:40 < krzee> still a matter of routed vs bridge (routed is better unless bridging is needed)
21:41 < krzee> so maybe after that you throw on a routing protocol, and this is where i drop off cause i havnt played with any real routing protocols, but would like to
21:42 < TJNII> There is a network guy at work who always enjous a good question: I think I should bounce this one off him tomorrow. :)
21:42 < krzee> im interested in how it goes =]
21:43 -!- adolfomaltez [~taro@190.62.252.15] has joined #openvpn
21:54 < rommel092079> krzee, what do you mean general networking issue?  previously the config works but now its stuck in sent control? what is happening why it is stuck there?
22:03 -!- micah_chatt [443c1f10@gateway/web/freenode/ip.68.60.31.16] has joined #openvpn
22:05 < micah_chatt> does anyone know why my dns only works for my local network?
22:06 < micah_chatt> I've setup my openvpn server to push DNS settings with my internal dns 
22:06 < micah_chatt> but when I connect with my laptop, I can't get outside sites
22:07 < micah_chatt> i know my DNS server is properly configured, since it works in my datacenter
22:10 -!- micah_chatt [443c1f10@gateway/web/freenode/ip.68.60.31.16] has quit [Quit: Page closed]
22:10 < TJNII> mick_laptop: Are you routing or bridging?
22:11 < TJNII> Good of him to wait for an answer.
22:14 < TJNII> What I was thinking:  default bind9 installs on RHEL/Cent (and likely others) reject recursive requests from subnets which are not local.  If there was a router somewhere between the DNS server and his client that might do it.
22:15 <+EugeneKay> Default bind only accepts ::1 and 127.0.0.1 for recursive, not "local subnets"
22:15 < TJNII> Well than that's worse, now isn't it?
22:16 <+EugeneKay> Ayup. And it's probably his issue.
22:16 < rommel092079> EugeneKay, I have added already hmac and ta.key on my config but still I am stucked on SENT CONTROL
22:16 <+EugeneKay> Or firewalling. It's always firewalling.
22:17 <+EugeneKay> rommel092079 - I have no idea. I had no idea yesterday, or the day before. Never seen that message. Best guess? You have something misconfigured
22:17 <+EugeneKay> Maybe incorrect direction parameter on --tls-auth
22:18 < rommel092079> ta.key 0 on server and 1 on client
22:19 < rommel092079> I used no-ip.org account to be used in my remote directive and with that, I can see that it can connect outside to internet because it detects the ip address of my remote server. but after that I am stuck at SENT CONTROL in the log file.
22:24 < TJNII> Man, I wish I could remember the details of bind9 only recursing on locally attached networks.  (Un)fortunatly it was easy enough to debug I don't remember the details.
22:24 -!- rommel092079 [~ravemaste@122.2.46.76] has quit []
22:28 <+EugeneKay> It's pretty easy. allow-recursive { lan netmask; };
22:28 -!- Rundll [~thomas@ppp105-140.static.internode.on.net] has quit [Remote host closed the connection]
22:28 <+EugeneKay> Er
22:28 -!- GetsEclectic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has joined #openvpn
22:29 <+EugeneKay> allow-recursion*
22:30 < GetsEclectic> when i set the ip/mask on my 'network bridge' to what i specified in the server config, my internet stops working
22:30 < GetsEclectic> am i doinitrite?
22:30 < GetsEclectic> it's almost working but i get destination host unreachable when i try to ping the remote network
22:30 <+EugeneKay> !layer2
22:30 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
22:31 <+EugeneKay> Don't use bridging.
22:31 -!- adolfomaltez [~taro@190.62.252.15] has left #openvpn []
22:32 < GetsEclectic> yeah i suppose i could set it up routed but i was hoping to try to play some lan games over it
22:33 <+EugeneKay> In that case, bridging is what you're after.
22:34 < GetsEclectic> yeah well i'll see if i can get it working routed first
22:35 < TJNII> GetsEclectic: What are you doing with the IPs now?
22:35 < TJNII> What IP are you specifying in the config?
22:35 < GetsEclectic> server-bridge 10.42.37.5 255.255.255.0 10.42.37.50 10.42.37.100
22:36 < TJNII> What is the IP of your local network?
22:36 < TJNII> IP range, I should say
22:37 < GetsEclectic> 192.168.1.0
22:38 <+EugeneKay> /24 ?
22:38 < GetsEclectic> i think i could ping 10.42.37.50 but that was the local machine's ip
22:38 <+EugeneKay> If you're doing bridging, IIRC you need to specify the LAN 
22:39 < TJNII> GetsEclectic: You want to bridge, yes?  So you want the client to be on the local subnet, correct?
22:39 < GetsEclectic> ah yeah
22:39 < TJNII> So why are you using two different subnets?
22:40 < GetsEclectic> i should really fix the 192.168.1 that my router is using
22:40 < GetsEclectic> doinitwrong
22:40 < TJNII> GetsEclectic: http://openvpn.net/index.php/manuals/427-openvpn-22.html <- Read what the option to server-bridge are
22:40 <@vpnHelper> Title: OpenVPN 2.2 (at openvpn.net)
22:40 < TJNII> Then I think things will become a bit clearer.
22:41 < GetsEclectic> ok thanks
22:46 <@vpnHelper> RSS Update - forum: help me i was blocked using openvpn(udp) in my country. pls <http://forums.openvpn.net/topic9212.html#p18416>
22:48 < TJNII> GetsEclectic: Did that help?
22:49 -!- GetsEclectic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has quit [Read error: Operation timed out]
22:49 < TJNII> ...guess not.
23:00 -!- GetsEclectic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has joined #openvpn
23:00 < GetsEclectic> workin like a charm
23:00 < GetsEclectic> thanks
23:01 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
23:01 < TJNII> Glad to hear it!
23:02 < GetsEclectic> hm well i can get to my gateway on my home network now, but i enabled forcing everything through the vpn in the config
23:02 < GetsEclectic> and i get get to google on the client
23:02 < GetsEclectic> some kind of routing problem i guess
23:03 < GetsEclectic> but it looked like it added the right routes when it connected
23:03 < GetsEclectic> er can't get to google
23:04 < GetsEclectic> ah maybe my gw config is wrong
23:05 < TJNII> So you can ping the router?  (I'm guessing 192.168.1.1?)
23:06 < GetsEclectic> yeah i got it
23:06 < GetsEclectic> just had the gateway set wrong
23:07 < TJNII> What did you settle on for your server-bridge line?
23:08 < GetsEclectic> all that work to get a 500 ms ping to google.com :P
23:08 < GetsEclectic> i moved everything to 192.168.1.0
23:08 < GetsEclectic> my home router is a piece of crap from verizon
23:08 < GetsEclectic> so i didn't want to mess with it too much
23:08 < GetsEclectic> easier to fix my openvpn config
23:09 < GetsEclectic> we'll see what sort of havoc i wreak on the corporate network tomorrow
23:09 < TJNII> Something like "server-bridge 192.168.1.1 255.255.255.0 192.168.0.200 192.168.0.250" ?
23:09 < GetsEclectic> yeah
23:09 < TJNII> s/192.168.0/192.168.1/
23:09 < GetsEclectic> yup
23:10 < GetsEclectic> i used 220-240
23:10 < GetsEclectic> for some reason
23:10 < TJNII> Probably a good choice
23:10 < TJNII> That doesn't overlap your DHCP range, does it?
23:10 < GetsEclectic> no
23:10 < GetsEclectic> i think the verizon router starts at 192.168.1.2
23:10 < TJNII> Cool
23:11 < GetsEclectic> shouldn't be too many hosts on either side so i think it'll be ok
23:12 < GetsEclectic> gonna see if i can get on battle.net from work tomorrow
23:12 < GetsEclectic> we've been playing starcraft because sc2 needs bnet
23:12 < GetsEclectic> gotta prepare for diablo 3 as well of course
23:12 < GetsEclectic> not sure how terrible the latency will be
23:13 < GetsEclectic> my home connection is fios and i live about two miles from work so hopefully it'll be pretty decent
23:14 < TJNII> "and i live about two miles from work" Haha, but you can never tell.  I live about 10 miles from work but my connections go through Georgia
23:14 < TJNII> (I don't live anywhere remotely close to Georgia)
23:14 < GetsEclectic> yeah some weird routes out there
23:14  * GetsEclectic blames ospf
23:14 < GetsEclectic> or something
23:14 < TJNII> Or Texas, which is better...
23:15 < GetsEclectic> i suppose i could vpn in now and traceroute back home
23:16 < GetsEclectic> who knows where anything goes around here
23:16 < GetsEclectic> lots of traffic
23:23 < GetsEclectic> traceroute wouldn't tell me anything :\
23:23 < GetsEclectic> i blame cisco
23:26 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
23:28 < rommel092079> guys openvpn supports tls/ssl but on the anonyproz article says that it is not real https. how can we archieve real https traffic from or with openvpn?
23:42 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
23:47 -!- rommel092079 [~ravemaste@122.2.46.76] has left #openvpn []
--- Day changed Tue Dec 13 2011
00:09 -!- gyyrog [~gyyrog@adsl-99-155-144-113.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
00:19 <@vpnHelper> RSS Update - forum: Difference between OpenVPN Desktop and Connect clients? <http://forums.openvpn.net/topic9068.html#p18417>
00:19 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
00:19 -!- zalzice_ [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 268 seconds]
00:21 -!- zalzice [~Thomas@79.160.109.25] has joined #openvpn
00:25 <@vpnHelper> RSS Update - forum: Additional IP-adresses in 1 OpenVPN-tunnel [Newbie] <http://forums.openvpn.net/topic9371.html#p18419> || help me i was blocked using openvpn(udp) in my country. pls <http://forums.openvpn.net/topic9212.html#p18418>
00:31 <@vpnHelper> RSS Update - forum: Simulate OpenVPN - Suggestions <http://forums.openvpn.net/topic9366.html#p18420>
00:37 -!- andj [~adriaan@openvpn/community/developer/andj] has left #openvpn ["PING 1323758278"]
00:43 <@vpnHelper> RSS Update - forum: I can connect to Openvpn but cannot see or Ping the internal <http://forums.openvpn.net/topic9363.html#p18421>
00:46 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: All your VPN are belong to us]
00:46 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
00:46 -!- mode/#openvpn [+o raidz] by ChanServ
00:52 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
01:25 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18423> || ICMP Redirect (For Host)/Internet traffic via OpenVPN <http://forums.openvpn.net/topic9370.html#p18422>
01:31 <@vpnHelper> RSS Update - forum: Disable split tunneling <http://forums.openvpn.net/topic9373.html#p18426> || ICMP Redirect (For Host)/Internet traffic via OpenVPN <http://forums.openvpn.net/topic9370.html#p18425> || Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18424>
01:42 < hyper_ch> krzee: dazo_afk: ecrist: EugeneKay: http://stearns.house.gov/uploads/Zuckerberg%20letter.pdf
01:42 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
01:42 <+EugeneKay> Why not Zoidberg?
01:43 < hyper_ch> Zoidberg doesn't have 800 million minions
01:46 < l0rd_hex> hyper_ch: I dunno, he lays alotta eggs
01:47 < hyper_ch> l0rd_hex: you're welcomed to open that pdf also :)
01:48 < l0rd_hex> hyper_ch: SUMMARIZE 
01:49 < hyper_ch> l0rd_hex: the US Congress asks some interesting questions regarding Facebook and privacy
01:49 < l0rd_hex> like how to login?
01:50 < hyper_ch> l0rd_hex: have a read
01:50 < hyper_ch> l0rd_hex: or let some program read it aloud for you
01:50  * l0rd_hex is illiterate :(
01:50 < hyper_ch> hence have kmouth read it out aloud for you
01:51 < l0rd_hex> KDE has a restraining order against me
01:51 < hyper_ch> then use OS X
01:51 < l0rd_hex> Steve job's zombie bones haunt my cpu
01:52 < hyper_ch> poor you
01:53 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 252 seconds]
01:55 < l0rd_hex> yup, livin' in a great society 
01:58 < l0rd_hex> lol longer than the constitution
01:58 < l0rd_hex> shorter than the bible!
01:59 < hyper_ch> there is no "the" bible
01:59 < hyper_ch> there is only "a" bible
01:59 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
02:00 < l0rd_hex> oh I mean the Chest T. Field version known and "the" bible 
02:00 < l0rd_hex> like the King Rick James version, etc
02:00 < hyper_ch> they all sound english
02:01 < l0rd_hex> well you sound swiss!
02:01 < hyper_ch> I don't recall Jesus having spoken english
02:01 < l0rd_hex> oh he was like bilingual 
02:02 < l0rd_hex> also you know him?
02:02 < l0rd_hex> Him?
02:02 < hyper_ch> "Him" is a finnish band
02:03 < l0rd_hex> we get TV from the states here, and there is this ad from Michigan and it's interviewing a whole bunch of people
02:03 < hyper_ch> interviewing whom?
02:03 < l0rd_hex> and they're like "well Jesus was a carpenter" "he was a black man!" "he was white" "he was a hippie" "he knew how to fight with a knife!" 
02:04 < l0rd_hex> and I just imagine the bible lovin' folk I know in the states ragin' at this art gallery
02:05 -!- rommel092079 [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has joined #openvpn
02:05 < hyper_ch> l0rd_hex: all we know for sure is that Jesus was a bowler - https://www.youtube.com/watch?v=jQxM9XEyQPI
02:05 <@vpnHelper> Title: The big Lebowski - Jesus Quintana (HD) extract - YouTube (at www.youtube.com)
02:05 < l0rd_hex> different jebus
02:05 <@vpnHelper> RSS Update - forum: Routing problems? <http://forums.openvpn.net/topic9374.html>
02:07 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
02:07 < rommel092079> guys, I am using no-ip.org in my client config. during connection, my server ip is detect from my no-ip account.  so I conclude that openvpn has connected outside to internet.  but just up to SENT CONTROL in the  log, my connection stuck there.  What could be the problem?
02:07 < hyper_ch> where is no-ip being used?
02:07 < rommel092079> remote myip.no-ip.org 1195
02:08 < rommel092079> like that
02:09 < l0rd_hex> rommel092079: can you tcpdump "udp and port 1194" on your server to be sure?
02:09 < l0rd_hex> er 1195
02:09 < l0rd_hex> I think it's 1194 by default
02:09 < rommel092079> lord_hex, how do you tcp dump?  what am I suppose to use? and what to look on tcp dump?
02:10 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
02:10 < l0rd_hex> rommel092079: eh, are you running Linux / unix?
02:10 < rommel092079> i tried to increase the verb of the conf to 8 to see whats going on before and after SENT CONTROL
02:10 < l0rd_hex> rommel092079: I'm not really an expert on OpenVPN but determining if traffic is flowing is important
02:11 < l0rd_hex> tcpdump is just a program, you'll have to run it as root though so be careful
02:11 < l0rd_hex> it displays all of the traffic your network card sees
02:14 -!- rommel092079 [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has quit [Ping timeout: 258 seconds]
02:14 -!- rommel092079_ [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has joined #openvpn
02:14 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Ping timeout: 244 seconds]
02:15 < rommel092079_> I can see STATE S_ACTIVE and STATE S_GOT_KEY before the SENT CONTROL appears. Would that matter?
02:15 < l0rd_hex> mmm I think that verifies a connection is being made 
02:15 < l0rd_hex> so don't worry about the tcpdump stuff
02:15 < rommel092079_> what should I possible look on that log to check that it will definitely connect to the internet
02:16 < l0rd_hex> rommel092079_: can you post your server config?
02:16 < rommel092079_> pastebin?
02:16 < l0rd_hex> sure
02:16 < rommel092079_> ok
02:16 < l0rd_hex> just be sure to remove anything confidential
02:20 < rommel092079_> lord_hex: I would like to say that this config works well before. but lately this week, its not making me connected anymore.
02:20 < rommel092079_> http://pastebin.com/k60ReAfk
02:20 < l0rd_hex> oh, it's worked in the past?
02:21 < l0rd_hex> any changes, to the config... firewalls, etc?
02:21 < rommel092079_> yes but lately this past week, it did not work anymore. there are no changes to the config or firewalls or anything.
02:22 < l0rd_hex> so your server config says "port 1194" but you mentioned "remote myip.no-ip.org 1195
02:22 < l0rd_hex> eariler, was that just a typo?
02:22 < rommel092079_> I typed wrong in 1195 it was 1194
02:24 < l0rd_hex> okay
02:24 < rommel092079_> now upon analysing the log, I can say that it connected to the internet somehow since my no-ip.org hostname was resolve to my server ip properly. but it did not pursue since it hangs in the SENT CONTROL part of the log?
02:25 < l0rd_hex> hmm I think this problem is out of my league, sorry rommel092079_ 
02:26 < rommel092079_> lord_hex, no one else around this time of the day ?
02:27 < rommel092079_> I was hoping the devel team can tell me what is happening during the connection to understand better how it is connecting to the internet.
02:27 < rommel092079_> but the devel team dont want us to post question in the devel channel
02:30 < l0rd_hex> yeah, it's really just for development related stuff not tech support
02:30 < l0rd_hex> take a read through the docs, I bet you'll figure it out
02:30 < l0rd_hex> might want to trim down your server conf, there is a lot of strange (to me) material in there
02:32 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
02:33 < l0rd_hex> I'm gonna hit the hay though
02:34 < l0rd_hex> good luck rommel092079_ 
02:34 < rommel092079_> those options on my server conf are important to me in the effort that my ISP is filtering my vpn traffic.  I have read the docs so many times now.  Now I guess I want to know how openvpn process works in the connecting process to better understand why it works this way.  I dont know why this is was not included in the openvpn explanation. 
02:35 < l0rd_hex> rommel092079_: have you played with the management interface and googled chunks of your logs?
02:37 < rommel092079_> I have not played on management interface though.  I have no idea on it yet. About googling, yes I did but no good results.
02:37 < l0rd_hex> tried the forums?
02:39 < rommel092079_> yes, I search in the forum but no result about it too.  If only there is an explanation how openvpn connection process, I can better understand it.  
02:40 < rommel092079_> How can I possibly bring my problem to the devel team ?
02:41 < rommel092079_> if not problem, how can I possibly ask this question to the devel team?
02:43 < l0rd_hex> no, don't bother the dev team with a tech support issue, post on the forums 
02:43 <@vpnHelper> RSS Update - forum: ICMP Redirect (For Host)/Internet traffic via OpenVPN <http://forums.openvpn.net/topic9370.html#p18428>
02:44 < rommel092079_> maybe I will post. I have no other option.  anyway, thanks for your time man.
02:44 < l0rd_hex> no problem, posting is a good idea - sometimes things make more sense when you write them all down
02:48 -!- rommel092079_ [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has quit [Ping timeout: 258 seconds]
02:49 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Remote host closed the connection]
03:16 <@vpnHelper> RSS Update - forum: Simulate OpenVPN - Suggestions <http://forums.openvpn.net/topic9366.html#p18430> || Connection to network resources problems. <http://forums.openvpn.net/topic9375.html>
03:27 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
03:27 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
03:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:36 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
03:39 <@vpnHelper> RSS Update - forum: Connection to network resources problems. <http://forums.openvpn.net/topic9375.html#p18431>
03:46 <@vpnHelper> RSS Update - forum: Connection to network resources problems. <http://forums.openvpn.net/topic9375.html#p18433>
03:52 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
04:06 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
04:11 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
04:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:34 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 268 seconds]
04:35 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
04:58 <@vpnHelper> RSS Update - forum: speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18435> || Help ! newbie problem!! <http://forums.openvpn.net/topic9376.html>
04:58 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 268 seconds]
04:59 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
05:01 -!- Usafcjf [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
05:01 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has joined #openvpn
05:37 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
05:43 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 252 seconds]
05:43 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
05:52 <@vpnHelper> RSS Update - forum: Additional IP-adresses in 1 OpenVPN-tunnel [Newbie] <http://forums.openvpn.net/topic9371.html#p18436>
05:56 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
06:06 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 240 seconds]
06:09 -!- sled-dog [~luser@65.124.95.55] has joined #openvpn
06:25 < raomin> Hi, I have 2 openvpn server in round robin DNS. One of them is off.
06:26 < raomin> despite "server-poll-timeout 5", clients keeps trying on the same server...
06:27 < raomin> although OpenVPN does notice the 2 addresses : "RESOLVE: NOTE: vpn.xxxxxx resolves to 2 addresses"
06:27 < raomin> any idea ?
06:32 < pwrcycle> raomin: are you using the openvpn directly on the client or another client interface?
06:33 < raomin> Clients launch OpenVPN service (windows)
06:35 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
06:39 < raomin> btw, I don't know if there is anyone /official/ from openvpn.net here, but the 2.2 manual html page doesn't have the <connection> html encoded... so they don't show on the page...
06:40 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
06:43 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
06:46 <@vpnHelper> RSS Update - forum: buildin client openvpn router to buy. <http://forums.openvpn.net/topic9377.html>
06:58 <@vpnHelper> RSS Update - forum: buildin client openvpn router to buy. <http://forums.openvpn.net/topic9377.html#p18438>
07:01 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
07:07 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:10 <@vpnHelper> RSS Update - forum: help me i was blocked using openvpn(udp) in my country. pls <http://forums.openvpn.net/topic9212.html#p18439>
07:16 <@vpnHelper> RSS Update - forum: Can only ping/access Router and OpenVPN Server <http://forums.openvpn.net/topic9356.html#p18440>
07:19 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has joined #openvpn
07:22 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:33 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
07:39 -!- FeileX [~Feilen@c-50-135-217-212.hsd1.wa.comcast.net] has quit [Quit: and, I am out, Laters]
07:52 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
07:57 -!- sled-dog [~luser@65.124.95.55] has quit [Ping timeout: 245 seconds]
07:58 -!- dazo_afk is now known as dazo
08:02 -!- sled-dog [~luser@65.124.95.55] has joined #openvpn
08:21 -!- rommel092079 [~rave@184.22.182.246] has joined #openvpn
08:21 < rommel092079> guys I have technical question about openvpn connection. anybody here
08:21 <@vpnHelper> RSS Update - forum: Disable split tunneling <http://forums.openvpn.net/topic9373.html#p18441>
08:30 < zalzice> !welcome
08:30 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:30 < zalzice> rommel092079: ^^
08:39 < rommel092079> zalzice, yes can you help
08:39 <@vpnHelper> RSS Update - forum: Connection is stuck <http://forums.openvpn.net/topic9378.html>
08:39 < rommel092079> can you kindly help
08:40 < rommel092079> I have also posted on the forum "connection is stuck"
08:44 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 240 seconds]
08:44 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
08:55 < rommel092079> no one today?
09:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
09:09 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
09:13 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Quit: Leaving.]
09:14 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Ping timeout: 252 seconds]
09:15 <@ecrist> rommel092079: more people would help you if you followed the channel guidelines on getting help
09:18 < rommel092079> ecrist, what guidelines are those?
09:18 <@ecrist> !welcome
09:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:18 <@ecrist> also, try reading the channel topic
09:18 < rommel092079> !topic
09:20 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
09:21 <@ecrist> um, /topic
09:22 < Olipro> "connection is stuck" - if that qualifies as a technical question, I'll go fetch the bottle of whiskey and revolver
09:23 < rommel092079> i am making my pastebin 
09:24 < rommel092079> http://pastebin.com/ZKAQnJy1   and   https://forums.openvpn.net/topic9378.html
09:24 <@vpnHelper> Title: OpenVPN Support Forum Connection is stuck : Server Administration (at forums.openvpn.net)
09:24 < rommel092079> there you go guys. please kindly help me.
09:25 < Olipro> rommel092079: your cipher option doesn't match, nore does your tls-cipher
09:25 < Olipro> it should be identical on both server AND CLIENT
09:25 < Olipro> same for auth and prng
09:25 < rommel092079> ow sorry. I have copy the wrong client conf
09:25 <@vpnHelper> RSS Update - forum: Is the Windows client simply slower? <http://forums.openvpn.net/topic9379.html> || OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18443>
09:26 < rommel092079> but they have same directives for both server and client
09:26 < rommel092079> Olipro, ow sorry. I have copy the wrong client conf
09:26 < rommel092079> but they have same directives for both server and client
09:26 < Olipro> paste the correct ones please
09:26 < rommel092079> ok
09:28 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:29 < rommel092079> Olipro, http://pastebin.com/08bBE9cj
09:31 < Olipro> rommel092079: I don't think RSA-SHA512 is appropriate for the auth option
09:31 < Olipro> use just "SHA512"
09:32 < Olipro> same for prng
09:33 < Olipro> RSA-SHA512 is a signature scheme, and as far as I can imagine, not suitable with the expected HMAC-friendly scheme
09:34 < rommel092079> I checked it with openvpn --show-digests, and its RSA-SHA512 is available
09:35 < Olipro> mmm, just try it as hash only
09:35 < Olipro> in any case, using RSA along with SHA512 is a bad idea in and of itself
09:35 < Olipro> using RSA to authenticate every packet is a massive overhead
09:36 < Olipro> and you're not providing yourself any real additional security over the existing TLS mechanism for key exchange
09:37 < rommel092079> EugeneKay adviced me to use HMAC to obfuscate more the vpn traffic. so when reading the manpage, I suppose having higher alg might produce better result
09:37 < Olipro> HMAC, yes
09:37 < Olipro> use SHA512
09:37 < Olipro> not RSA-SHA512
09:38 < Olipro> the point of HMAC is to verify a packet hasn't been tampered with en-transit; SHA512 is suitable for that
09:39 < rommel092079> now I tested openvpn --secret ta.key --cipher SHA512 --test-crypto and it says Cipher Algorithm 'sha512' not found (OpenSSL) then Exitin. What could it be?
09:39 < Olipro> if you run openvpn --showdigests, are you saying that you have RSA-SHA512, but not SHA512
09:39 < Olipro> I don't think so somehow
09:39 < rommel092079> am I doing it properly.
09:40 < rommel092079> even with sha1, it says not found
09:40 < Olipro> no, you're not
09:40 < Olipro> it's not a cipher
09:40 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 240 seconds]
09:40 < rommel092079> ah ok. i will just take your advice and use sha512
09:40 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:41 < rommel092079> any other advice, why i am stucked on SENT CONTROL?
09:41 < Olipro> oh dear god
09:41 < Olipro> right, I'm looking at your configuration again
09:41 < Olipro> your client doesn't have a certificate
09:41 < Olipro> like... at all
09:43 < cherwin> ecrist: I admire your helpfulness.
09:43 < rommel092079> Olipro, what about this? ca ca.crt, cert server.crt 
09:43 < Olipro> you can't just throw in "client-cert-not-required" and still have all the TLS security
09:43 < Olipro> you need to create a certificate for your client if you *actually* want a secure implementation
09:43 < Olipro> if you must though
09:44 < Olipro> you need to define the ca certificate on the client, at a minimum
09:44 < rommel092079> I have ca.crt right? isnt that it?
09:44 < Olipro> yes
09:45 < rommel092079> so I have certificate for my client. you mean i will remove the client-cert-not-required" option there?
09:47 -!- yell0 [yello@unaffiliated/contempt] has quit [Remote host closed the connection]
09:47 < Olipro> rommel092079: ca alone is not a client certificate
09:48 < Olipro> you did generate these certificates yourself right...
09:48 < rommel092079> yes I did
09:48 < rommel092079> I have the ca.key too
09:48 <@ecrist> cherwin: ?
09:48 < Olipro> that is for signing further certificates
09:49 < Olipro> it should not exist on any of your VPN machines
09:49 < rommel092079> ok
09:49 < Olipro> and preferably not anywhere accessible on the internet
09:49 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
09:49 < rommel092079> anyway, I have only ca.crt and server.crt for certificate
09:50 < Olipro> anyway, you can either add just the ca cert to the client, in which case you need to retain the client-cert-not-required option
09:50 < Olipro> or you can go and generate a client certificate
09:50 < Olipro> in which case you can remove that and it's up to you whether you still want password authentication
09:51 < rommel092079> hmmm. but I need password authentication because the users are many and there numbers change per day.
09:52 < rommel092079> Olipro, anyway can you tell me how to generate a client certificate. going back to manpage, I can only see, ca.cert, server.cert and server.key on the client.conf example.
09:53 < Olipro> with whatever it is you use to generate certificates and keys
09:53 < Olipro> I use xca
09:53 < Olipro> you use whatever you use
09:54 < rommel092079> i use ./build-ca to build cert and ./build-key-server for key which I got from google
09:55 < rommel092079> but with ./build-ca, only ca.crt and server.crt were created
09:57 < rommel092079> please teach me how
09:58 <@ecrist> rommel092079: there is a howto on the openvpn site about how to build certificates
09:58 <@vpnHelper> RSS Update - forum: DNS Round robin : client not failing over <http://forums.openvpn.net/topic9380.html>
09:59 < krzee> !pki
09:59 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
09:59 <@vpnHelper> specially as a server (see !servercert)
10:01 < rommel092079> ecrist, thanks. I saw it. I just forget where I saw that.
10:01 < rommel092079> krzee thanks too
10:02 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:04 < rommel092079> after this has been done, any other reason why I am stucked on SENT CONTROL?
10:05 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:06 <@ecrist> rommel092079: post your logs
10:07 <@ecrist> we ask you for your logs and you refuse to post them.
10:07 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 252 seconds]
10:07 <@ecrist> the entire log, not just SENT CONTROL
10:10 < rommel092079> ah ok. sorry
10:10 < rommel092079> i will
10:12 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
10:13 < rommel092079> I cant edit the server ip in may pastebin because that is so many, so I will just leave it on your hands guys
10:14 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:14 < rommel092079> ecrist, this is it --->>>>  http://pastebin.com/im9s6YxK
10:15 < rommel092079> that is the log that my openvpn connection stucks on SENT CONTROL
10:15 <@vpnHelper> RSS Update - forum: Help ! newbie problem!! <http://forums.openvpn.net/topic9376.html#p18446>
10:22 < rommel092079> ecrist, are you there guys, I am still here waiting for your advice. 
10:23 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
10:23 < krzee> again, with verb 5 instead
10:24 < rommel092079> ok. I will be back cause I need to disconnect first. brb
10:24 < krzee> and you have to give time after asking something or pasting something... we have jobs and lives, we just do this stuff in spare time, usually while doing a few other things (although sometimes when just bored)
10:24 -!- rommel092079 [~rave@184.22.182.246] has quit []
10:25 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:29 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
10:33 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 252 seconds]
10:33 -!- rommel092079 [~rave@184.22.182.246] has joined #openvpn
10:34 < rommel092079> krzee, http://pastebin.com/AD7RCSaK
10:35 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:35 -!- mode/#openvpn [+v Axeman] by ChanServ
10:37 < rommel092079> ecrist, krzee. guys?
10:41 -!- barfoo365 [~barfoo365@2.27.150.43] has joined #openvpn
10:42 < barfoo365> If I want to connect to my Windows XP network from my workplace using OpenVPN, what package do i need?  Does the client package need to be on both sides?
10:44 < rommel092079> krzee, man are you there? I am waiting man, any update?
10:53 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
10:57 -!- rommel092079 [~rave@184.22.182.246] has quit []
11:03 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
11:04 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
11:06 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
11:06 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:06 -!- mode/#openvpn [+o raidz] by ChanServ
11:07 < zalzice> lol, the rommel guy is pretty annoying:-P
11:09 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:09 < krzee> not just pretty
11:09 < krzee> VERY
11:10 < krzee> hes on ignore on my other client
11:24 -!- raomin_ [~romain@86.66.22.240] has joined #openvpn
11:24 -!- raomin_ [~romain@86.66.22.240] has quit [Remote host closed the connection]
11:31 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
11:36 <@dazo> barfoo365: you need openvpn installed on both sides.  There's no client/server separate package (in the community version) ... it can act as both ... other than that, reading the howto carefully should get you pretty easily started
11:36 <@dazo> !howto
11:36 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:38 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:45 -!- barfoo365 [~barfoo365@2.27.150.43] has quit []
12:03 < zalzice> krzee: lol :-)
12:13 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
12:25 -!- oc80z [oc80z@openvpn/user/oc80z] has quit [Excess Flood]
12:26 -!- oc80z [oc80z@blea.ch] has joined #openvpn
12:26 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:27 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
12:30 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
12:30 -!- mode/#openvpn [+v Axeman] by ChanServ
12:33 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
12:36 -!- olli23 [~sYsT3m@31-17-54-33-dynip.superkabel.de] has joined #openvpn
12:38 < olli23> hi, is it possible to set up ethernet bridged vpn, where the dhcp server is at the client side, not at the servers?
12:39 < rawplayer> sure
12:41 < olli23> good
12:41 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
12:45 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
12:52 -!- mrcoodles [~mrcoodles@f79-118-195-121.pitesti.rdsnet.ro] has joined #openvpn
12:53 < mrcoodles> hello everyone, quick question, is there a way to overwrite push "redirect gateway def1" on a per client basis ?
13:06 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
13:09 -!- twobitsprite [~isaac@li24-165.members.linode.com] has joined #openvpn
13:09 < twobitsprite> good afternoon
13:10 < twobitsprite> I have an internal web app which doesn't support https (don't get me started...), and I'm looking for a way to force the connection over some sort of host-to-host encrypted tunnel...
13:11 < twobitsprite> I'm looking in to openvpn, but I can't figure out how to get it to, say, redirect port 80 on the client system to be routed through the tunnel
13:11 < twobitsprite> both client and server are windows systems (unfortunately)
13:11 < twobitsprite> any ideas on how I could make this work?
13:18 -!- dschuett [~dschuett@mail.lonemountaintruck.com] has joined #openvpn
13:22 < dschuett> is it normal to get this every couple minutes in /var/log/syslog? : Dec 13 13:21:25 gateway ovpn-server[4815]: MULTI: Learn: 192.168.1.1 -> gwish/97.92.155.123:42160
13:26 < dschuett> ^^ that is on the server
13:34 -!- mrcoodles [~mrcoodles@f79-118-195-121.pitesti.rdsnet.ro] has quit [Quit: Lost terminal]
13:39 <@dazo> twobitsprite: you need to set up routes, which routes the traffic via the tunnel ... then it'll work out just fine ... and you don't need to worry about port redirects at all
13:40 <@dazo> twobitsprite: make sure you route the IP address of your web server via the tunnel ... and that your web server knows the route to your VPN .... then it'll all work out
13:41 <@dazo> dschuett: those messages are not uncommon ... but if it is the same client which is repeated through out your log ... it might be some issues with that client, reconnecting a lot .... need to see configs and complete logs to be able to say more
13:43 < dschuett> dazo: it is infact the same client in the logs. Here are my client and server configs: http://pastie.org/private/906tfdy9mbxnforfhfh3g
13:44 <@dazo> olli23: that's probably possible .... as a bridged VPN, is basically comparable to a network cable between to switches ... but if it's clever, that's a completely different question
13:45 <@dazo> dschuett: your configs looks clean at first glance ... so need more verbose server logs to be able to maybe tell more
13:46 <@dazo> but I sense this might be related to connection issues ... however, server logs might tell a bit more .... esp. with --verb 4
13:46 < olli23> dazo: yes, I'm already testing my setup..
13:46 <@dazo> olli23: you are aware of the drawbacks of tap and bridged networks?
13:48 < olli23> dazo: you mean the broadcast traffic?
13:48 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 276 seconds]
13:48 <@dazo> olli23: yeah, and that it might be a lot of it over the VPN tunnel
13:49 <@dazo> esp. if you got Windows clients in your network
13:49 < dschuett> dazo: this help at all?: http://pastie.org/private/dvtrpraa3kfzybanqi3gea
13:51 <@dazo> dschuett: that's very verbose ... but I see some failures here which looks like connection failures .... if you could pastebin the complete log from openvpn server starts and until you disconnect it, it might be easier ... and --verb 4 should be enough here
13:51 <@vpnHelper> RSS Update - forum: Connection to network resources problems. <http://forums.openvpn.net/topic9375.html#p18447>
13:51 < olli23> dazo: I think this shouldn't be a real problem, it's a small subnet (~24 windows clients), 100MBit/s uplink between the servers
13:51 <@dazo> olli23: how many openvpn clients?
13:52 < dschuett> dazo: is there a way to output the logs to a txt file?
13:52 <@dazo> dschuett: --log
13:52 < olli23> dazo: 4-5 at the same time
13:53 <@dazo> olli23: okay, then the openvpn server will be busy pushing broadcast traffic to all of these 4-5 clients in parallel ... this will definitely slow down your VPN ... you will most probably notice a throughput drop in tap compared to tun in this case .... esp. with broadcast happy clients
13:53 <@dazo> olli23: why do you need the broadcast traffic?
14:00 < olli23> dazo: I need a server setup, where all other clients get their ips from a dhcp server from another client's lan, I don't know a better way to do it
14:00 <@dazo> olli23: why do you need that?  why not be subnet agnostic and just have each client as a separate subnet and let routing via the VPN tackle the rest?
14:01 <@dazo> olli23: you're about to step into the single-point-of-failure trap ... if the VPN link to your DHCP server drops down, all other sites are useless
14:04 < dschuett> dazo: http://pastie.org/private/mhwfbw4oqn5thcxcbhwcqg
14:05 <@dazo> dschuett: ahh, you do some routing of LAN behind the client?
14:06 < olli23> dazo: you're absolutely right, but the setup should not be used in a production environment
14:07 < dschuett> dazo: just allowing subnets to talk to eachother (client-to-client)
14:07 < dschuett> is that what you mean?
14:07 <@dazo> dschuett: you probably need to look into 'iroute'
14:08 <@dazo> dschuett: I see that your route both 192.168.0/24 and 192.168.1/24 ... and I believe one of them needs to be an iroute
14:08 <@dazo> !route
14:08 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
14:09 <@dazo> dschuett: one of them must be an iroute, where you add a route to the LAN behind the OpenVPN client .... otherwise, the OpenVPN server gets confused where it should route the packets to that subnet
14:10 < dschuett> dazo: hmmm, ok so on my server.conf i probobably need to use iroute 192.168.1.0 255.255.255.0 instead of route
14:11 <@dazo> dschuett: yeah, I beleive so
14:11 < dschuett> i guess i didn't know that would make a difference the kernal's routing table show that everything should be routing correctly
14:11 <@dazo> dschuett: if you look at the !route wiki ... you'll get some better explanations
14:11 < dschuett> ok, thanks so much for your help!
14:11 <@dazo> dschuett: you're welcome!
14:16 -!- olli23 [~sYsT3m@31-17-54-33-dynip.superkabel.de] has quit [Ping timeout: 276 seconds]
14:32 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
14:39 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18448>
14:45 <@vpnHelper> RSS Update - forum: Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html>
14:47 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:57 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18450>
15:01 -!- dazo is now known as dazo_afk
15:13 -!- dschuett [~dschuett@mail.lonemountaintruck.com] has left #openvpn []
15:21 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18451>
15:33 <@vpnHelper> RSS Update - forum: OpenVPN IPv6 support <http://forums.openvpn.net/topic9382.html>
15:53 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
16:14 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
16:16 -!- novaflash is now known as novaflash_away
16:20 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
16:21 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit []
16:23 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Ping timeout: 252 seconds]
16:25 -!- dioz [~dioz@2001:470:1f11:12a9::1] has quit [Read error: Operation timed out]
16:30 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
16:41 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
16:43 -!- dioz [~dioz@2001:470:1f11:12a9::1] has joined #openvpn
16:51 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:00 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 245 seconds]
17:11 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
17:14 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 240 seconds]
17:14 -!- [1]SigmaProjects is now known as SigmaProjects
17:22 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:22 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:22 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 252 seconds]
17:25 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
17:25 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:26 -!- mode/#openvpn [+o raidz] by ChanServ
17:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:29 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 252 seconds]
17:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:05 -!- Denial [Denial@drgi.co.uk] has quit []
18:08 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 252 seconds]
18:11 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
18:17 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
18:18 < rommel092079> ecrist, krzee, have you seen where's my problem on SENT CONTROL coming from?
18:27 < rommel092079> so!
18:27 -!- rommel092079 [~ravemaste@122.2.46.76] has quit []
18:40 -!- newl [~newl@97.75.165.156] has joined #openvpn
18:53 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
19:02 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
19:04 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
19:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 252 seconds]
19:14 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
19:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:22 <@vpnHelper> RSS Update - forum: Disable split tunneling <http://forums.openvpn.net/topic9373.html#p18453>
19:25 -!- g0d [~zero@ip-97-74-121-225.ip.secureserver.net] has left #openvpn []
19:35 < TJNII> The most basic OpenVPN failover/HA setup is where you set up a bunch of identical servers and point the clients at them with multiple "remote" directives, correct?
19:36 < krzie> yep, nearly identical
19:36 < krzie> cant be the same subnet if they are to interact with eachother
19:36 < TJNII> Okay, just wanted to make sure my theory wasn't off.
19:37 < TJNII> Why can't they be on the same subnet?
19:37 < krzie> they can be if you accept that they wont route to eachother
19:38 < TJNII> Aah, if the clients are to interact with each other, correct?
19:39 < krzie> well ya
19:40 < TJNII> Okay, makes sense.
19:40 < TJNII> That doesn't fit my use case so I hadn't thought about it.
19:40 < krzie> how you gunna be sure the clients ONLY connect to the server you wanted?
19:40 < krzie> what happens if the connection failed for some reason other than the server being down?
19:42 < TJNII> "how you gunna be sure the clients ONLY connect to the server you wanted?"  Well, if I specify 3 servers and they decide to make up a 4th, then they're on their own and its not my problem.
19:42 < krzie> no no
19:42 < krzie> ok so lets say
19:42 < krzie> you are designing a network
19:42 < krzie> some clients will end up on each server
19:43 < krzie> thats ok?
19:43 < TJNII> Yes
19:43 < krzie> oh ok
19:43 < krzie> then ya may as well use --remote-random as well
19:43 < krzie> randomizes the --remote entries
19:44 < krzie> a poor mans load balance ;]
19:44 < TJNII> The clients don't need to connect to each other, they need to connect to servers on a subnet accessable via openvpn.  So the client to client restrictions are not an issue.
19:44 < krzie> heh
19:44  * newl this poor man guy must have a huge storage place for all the stuff he has
19:44 < TJNII> Yea, I'll likely use --remote-random
19:44 < krzie> same servers?
19:45 < TJNII> No, 1 /18 full of boxen
19:45 < krzie> but im saying
19:45 < krzie> [17:44]  <TJNII> The clients don't need to connect to each other, they need to connect to servers on a subnet accessable via openvpn.  So the client to client restrictions are not an issue.
19:45 < krzie> the servers they connect to
19:46 < TJNII> krzie: Sorry, I'm not following what you're driving to
19:46 < krzie> for every single vpn node the clients connect to different servers?
19:46 < TJNII> I'll have a small pool of openvpn servers
19:46 < TJNII> Shared randomly by clients
19:46 < krzie> and then application servers behind those openvpn servers
19:46 < TJNII> Essentially
19:47 < krzie> but will those openvpn servers use the SAME application servers?
19:47 < krzie> or will each vpn node have its own application server?
19:47 < TJNII> OpenVPN gives access into the subnet.  It is up to the client to acccess what they need from there, depending on their requirements.
19:47 < krzie> then you still need every vpn server to have its own subnet
19:48 < krzie> thats why i was asking all the questions
19:48 < TJNII> You mean the RFC1918 subnet for the clients?
19:48 < krzie> correct
19:48 < TJNII> Why is that?
19:48 < krzie> cause when you hit the application server, you do so with your vpn ip
19:48 < TJNII> The OpenVPN servers sill be implementing NAT as I don't control the router.
19:49 < krzie> when it tries to route back to you, how will it reach you?
19:49 < TJNII> I plan to NAT the RFC1918 addresses into the target address space
19:49 < krzie> omfg you will have NO idea who is doing what
19:49 < krzie> donnnnnnnt do that
19:49 < krzie> lol
19:49 < krzie> add a static route to return to vpns to the application servers instead of to the router
19:50 < TJNII> On a /18?
19:50 < TJNII> Not an option
19:50 < krzie> whats the /18 have to do with anything?
19:50 < TJNII> 16k hosts
19:50 < krzie> all to be reached over the vpn?
19:50 < TJNII> Ayup.
19:50 < krzie> lol
19:51 < TJNII> The VPN is a failsafe for things that won't go over the firewall.
19:51 < krzie> you need access to that router
19:51 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
19:51 < krzie> it will be a nightmare to deal with that setup after the fact if you use nat
19:51 < TJNII> Oh, I agree that is the best.  I also know I have a better change of marrying a supermodel tomorrow.
19:51 < krzie> you will never know who is doing what
19:51 < TJNII> Except for the OpenVPN logs...
19:52 < krzie> well tell whoever is in charge that unless you can add routes to that router you will never know who did what
19:52 < krzie> openvpn logs wont tell you much
19:52 < krzie> very very very little
19:52 < krzie> you will have no way to know who hacked your webserver over the vpn, for example
19:53  * newl isn't that why you use openvpn to begin with?
19:53 < krzie> newl, huh?
19:54 < newl> to prevent hacking
19:54 < newl> ie secure connection
19:54 < TJNII> Well, it is a internal VPN which will be tightly access controlled.  Plus IT says they want a log of all NAT events, and I entend to give that to them.  And yes, I'm (a little bit spitefully) aware of how big that log will be.
19:54 < krzie> not really, but ok
19:55 -!- _julian [~quassel@hmbg-5f764265.pool.mediaWays.net] has joined #openvpn
19:55 < krzie> TJNII, hey man its your shit, im just letting you know its being done wrong... do with that knowledge what you want
19:55 < TJNII> I may switch to a bridge, though.  I believe that will be better for the users, failover better, and eliminate the need for a NAT.
19:55 < krzie> how many users?
19:55 < TJNII> Not many
19:56 < krzie> that means nothing
19:56 < TJNII> I don't know exactly what is is going to look like but I'd say <50 is a safe estimate.
19:56 < krzie> to someone on a /18 a couple thousand arent many
19:56 < TJNII> Depends on how many groups ignored our requests for their ports and protocols when we were configuring the firewall.
19:58 -!- _julian_ [~quassel@hmbg-5f767d7a.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
19:58 < krzie> ya under 50 you should be ok with a bridge
19:58 < krzie> im guessing
19:58 < krzie> just dont go much higher
19:59  * TJNII nods
20:00 < TJNII> I will bring up your NAT concern with the IT security manager.  I hadn't thought about that.  I don't think it is a major concern with this environment and logging requirements, though.
20:06 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
20:12 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 244 seconds]
20:19 -!- MikeJansen1 [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
20:20 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Ping timeout: 252 seconds]
20:21 -!- master_of_master [~master_of@p57B5403C.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:21 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
20:23 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
20:23 -!- master_of_master [~master_of@p57B54067.dip.t-dialin.net] has joined #openvpn
20:28 < TJNII> So another question.  Disregarding any NAT and assuming all the clients are behind routing OpenVPN servers with discreet RFC1918 pools, doesn't basic failover cause all open TCP connections to be dropped?  If a client failsover to another server it is going to get a different IP by virtue of the pools being discreet.  In this case it will start sending packats from its new IP.  I'm not sure how the state machine on the client will react, but since the state mach
20:28 < TJNII> ine on the server will be for the old IP it will treat any incoming packets as unknown and RST them, correct?
20:30 < TJNII> TCP isn't my forte, so let me know if my theory is wrong. :)
20:32 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18454>
20:42 < krzie> shouldnt be hard for you to test
20:44 < TJNII> Testing is nice, but sometimes it is better to know the theory.
20:44 < krzie> not with your question
20:44 < TJNII> Well, if it is so obvious what is the answer?
20:44 < krzie> if i knew 100% i would have told you
20:45 < krzie> what i do know is that some theory wont tell you what you asked for, testing will
20:45 < krzie> if it works contrary to some theory, does the theory help you?  :p-
20:45 < krzie> i can theorize that yes, RST will be sent
20:46 < krzie> although its entirely possible that the connections will simply timeout
20:47  * TJNII nods
20:47 < TJNII> Anyone here have a routing failover setup who can comment?
20:48 < krzie> why would you need failover to test that?
20:48 < krzie> just disconnect a client and see if the server sent RSTs
20:48 < krzie> rather disconnect a client who is actively transfering data to a machine in the server lan
20:48 < krzie> but ya
20:48 < TJNII> krzie: Because that is not the scope of the problem at all
20:49 < TJNII> I want to know if, on failover, the connections will remain open
20:49 < krzie> no, they will not
20:49 < TJNII> Why not?
20:49 < krzie> your mentioning of RSTs made me think the question was if it would actively close the connection or passively let it timeout
20:50 < TJNII> What can be changed so that they won't?
20:50 < krzie> probably nothing
20:54 < krzie> but i dunno to be honest
20:55 < krzie> however, if it were possible youd need to somehow sync NAT states, and make sure that all clients are using static vpn IPs
20:56 < krzie> clients on same static vpn ips is easy enough...
20:56 < krzie> !static
20:56 < TJNII> That's what I was thinking
20:56 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
20:56 < krzie> however, the sync'ed nat states is harder
20:56 < krzie> iirc bsd has pfsync that should handle that
20:56 < krzie> and i dunno if it would then work or not
20:56 < TJNII> For this thought experiment let's disregard the NAT.
20:57 < krzie> what im pretty sure of is that nobody around here is doing what you want... you'll need to actually test it
20:57 < krzie> nat cant be ignored, its an important part of the question
20:57 < TJNII> Eh?  "<TJNII> So another question.  Disregarding any NAT..."
20:58 < krzie> without nat you will have every server on a different subnet
20:58 < krzie> then the client cant have the same ip
20:58 < krzie> so ya, i dont care if you say "disregarding the nat"  it still cant be disregarded
20:59 < krzie> or if i do disregard the nat... your failover doesnt work cause you have all servers on the same subnet :-p
21:01 < TJNII> Well, NAT won't work in this case because the OpenVPN servers will have different IPs.  So without some form of HA IP failover NAT won't work, either.  I'm guessing some sort of shared IP pool is required, but that brings up the problem of the IP moving from the routing perspective.
21:01 < TJNII> I'm currently of the option that you have to bridge for this to work.
21:02 < TJNII> As then the server shift is handled by the ARP tables catching up, not IPs moving around.
21:04 < krzie> in which case you should be able to test that on-lan without openvpn
21:04 < krzie> (unless you already know)
21:05 < TJNII> Not 100% sure, but 95%.  Yes, that is an easy test.
21:05 < TJNII> The TCP question was in the spirit that, if I was right, how do I build off that to find a solution.  However, the points you raised about NAT and routing enforce my belief that there isn't one.
21:09 -!- Gravitron [~admin@64.93.145.58] has joined #openvpn
21:09 -!- Gravitron [~admin@64.93.145.58] has quit [Changing host]
21:09 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
21:13 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
21:14 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 245 seconds]
21:20 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
21:20 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
21:20 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:26 < bigpaws> site to site VPN 2 year running. Now TLS handshake is failing. 
21:27 < krzee> !logs
21:27 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
21:28 < bigpaws> http://pastebin.com/Cs9megWT
21:29 < krzee> lol
21:30 < krzee> well there could be other important stuff, but ill go with this if you want me to assume theres nothing else wrong
21:30 < krzee> !timeout
21:30 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
21:31 -!- MikeJansen1 [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Quit: Leaving.]
21:31 < bigpaws> I am replacing a router. I beleive that packets are getting dropped
21:32 < EugeneKay> bigpaws - *complete* logs.
21:32 -!- GetsEcle1tic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has joined #openvpn
21:33 < EugeneKay> "2 years running" says to me that your certificates expired.
21:33 < bigpaws> Certificate are 10 years
21:33 < TJNII> So you replaced the router and now it doesn't work?  Seems like a smoking gun to me...
21:33 < bigpaws> Router has not been replaced yet
21:33 < EugeneKay> tcpdump the server, it's probably your firewall.
21:34 < bigpaws> ok
21:34 -!- GetsEclectic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has quit [Read error: Operation timed out]
21:57 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:13 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18455>
22:16 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
22:36 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
22:59 -!- vect0rx [vectorx@countercultured.net] has joined #openvpn
22:59  * vect0rx waves
23:00  * EugeneKay particles
23:00 < krzee> lol
23:01 < vect0rx> failed @ bridging two dd-wrt LANs tonight due to "certification is not valid yet" errors.  I'm hoping that it just started working in a few hrs given some stuff about UTC vs other time zones that i've read
23:01 < krzee> timezones done matter
23:01 < krzee> except for people setting the time manually with wrong timezone or something similar
23:01 < krzee> odds are one of your clocks are wrong, ntpdate on both sides
23:02  * vect0rx amplification by stimulated emission of radiations
23:02 < vect0rx> yeah my CA server and both dd-wrt routers are all seemingly synced.. the routers have same time/NTP server
23:03 < vect0rx> no longer have access to the client tonight so troubleshooting won't be possilbe till tmw... thinking of just re-issuing everything after another time check
23:03 < krzee> !certverify
23:03 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
23:03 < vect0rx> ah ty krzee
23:04 < krzee> but remember to also check md5 of the ca.crt's
23:04 < krzee> since each is actually checked against the other side's
23:04 < vect0rx> actually the md5s would be a bit off for certain
23:04 < krzee> not the same ca?
23:04 < vect0rx> because the dd-wrt startup stripts add whitespace betwore and after the "---------" lines
23:04 < krzee> inside the ca.crt??
23:05 < vect0rx> yeah can I paste the url to the instructions that I followed?
23:05 -!- dioz [~dioz@2001:470:1f11:12a9::1] has quit [Read error: Operation timed out]
23:05 < krzee> you can but im not going to read them, sorry
23:05 < vect0rx> basucally there's some echo "[newline]------ past cert here ----[newline]" > output.file stuff
23:06 < krzee> interesting
23:06 < vect0rx> to whomever may be curious or familiar, then http://www.dd-wrt.com/wiki/index.php/OpenVPN_-_Site-to-Site_Bridged_VPN_Between_Two_Routers
23:06 <@vpnHelper> Title: OpenVPN - Site-to-Site Bridged VPN Between Two Routers - DD-WRT Wiki (at www.dd-wrt.com)
23:07 < vect0rx> I'll probably not solve it tonight as I have no phys/net access to the client side
23:08 < krzee> that script doesnt have whitespace
23:08 < krzee> if you do, you did it
23:10 < vect0rx> the echo adds a newline before the dashed line.. could have been mysef or the dd-wrt interface though.   On the CA machine the openssl stuff verifies properly so thanks for that
23:14 < krzee> np
23:15 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 252 seconds]
23:15 < krzee> if its the dd-wrt interface, it would do it the same on both sides ;]
23:16 < krzee> it verified there, keep going
23:16 < vect0rx> yes it does actually so the md5s between the dd-wrt devices would be the same as where the CA machine would have different whitespace :)
23:16 -!- skaalid [~liv@173.208.45.218] has joined #openvpn
23:16 < vect0rx> unless i botched the web interface on one of them :)
23:18 -!- skaalid [~liv@173.208.45.218] has left #openvpn []
23:18 -!- dioz [~dioz@2001:470:1f11:12a9::1] has joined #openvpn
23:20 < vect0rx> Will get it straightened out tomorrow.. i had a pretty simple example from the openvpn book working back in october (PC to EC2 instance) but managed to get distracted with dayjob, and what not
--- Day changed Wed Dec 14 2011
00:10 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:15 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 240 seconds]
00:26 -!- Mp5shooter [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
00:30 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
00:34 <@vpnHelper> RSS Update - forum: Does This Client Config Look Ok? <http://forums.openvpn.net/topic9383.html>
00:34 -!- Daala [~Daala@213.229.116.54] has joined #openvpn
00:36 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:38 < Daala> Hi all
00:38 < Daala> I made this post; https://forums.openvpn.net/topic9383.html if anyone can be kind to look at to see how this client config looks?
00:38 <@vpnHelper> Title: OpenVPN Support Forum Does This Client Config Look Ok? : Configuration (at forums.openvpn.net)
00:40 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:41 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:44 < Daala> new section posted in the wrong place before; https://forums.openvpn.net/topic9384.html
00:44 <@vpnHelper> Title: OpenVPN Support Forum Does This Client Config Look Ok? : Configuration (at forums.openvpn.net)
00:45 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
00:46 <@vpnHelper> RSS Update - forum: Does This Client Config Look Ok? <http://forums.openvpn.net/topic9384.html> || Post Mistake.... <http://forums.openvpn.net/topic9383.html>
00:52 <@vpnHelper> RSS Update - forum: PrivateTunnel.com : Terms and Conditions : Disclosure <http://forums.openvpn.net/topic8902.html#p18458>
00:56 -!- Daala [~Daala@213.229.116.54] has quit [Ping timeout: 244 seconds]
01:04 <@vpnHelper> RSS Update - forum: Two Sites connected, TAP, VMWare, Duplicate Packets <http://forums.openvpn.net/topic9385.html>
01:14 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Remote host closed the connection]
01:15 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:15 <@vpnHelper> RSS Update - forum: Difference between OpenVPN Desktop and Connect clients? <http://forums.openvpn.net/topic9068.html#p18460>
01:16 -!- _julian_ [~quassel@hmbg-5f764265.pool.mediaWays.net] has joined #openvpn
01:17 -!- zalzice_ [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
01:19 -!- _julian [~quassel@hmbg-5f764265.pool.mediaWays.net] has quit [Quit: No Ping reply in 180 seconds.]
01:19 -!- zalzice [~Thomas@79.160.109.25] has quit [Remote host closed the connection]
01:19 -!- sled-dog [~luser@65.124.95.55] has quit [Ping timeout: 245 seconds]
01:21 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
01:21 <@vpnHelper> RSS Update - forum: OpenVPN IPv6 support <http://forums.openvpn.net/topic9382.html#p18461>
01:26 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:26 <@vpnHelper> RSS Update - forum: Would You Use A VPN Provider That Gives You A Static IP? <http://forums.openvpn.net/topic9386.html>
01:40 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
01:41 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 245 seconds]
01:43 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
01:50 -!- xizhendu is now known as xdu|pto
01:51 -!- xdu|pto [~xizhendu@li220-212.members.linode.com] has quit [Quit: leaving]
01:51 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
01:57 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
01:59 < rommel092079> krzee, what is the problem on my SENT CONTROL stuck issue? have you found out?
02:02 -!- rkantos [~robin2@109.169.55.199] has joined #openvpn
02:03 -!- rommel092079 [~ravemaste@122.2.46.76] has quit []
02:08 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
02:08 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:13 -!- novaflash_away is now known as novaflash
02:17 -!- dazo_afk is now known as dazo
02:30 <@vpnHelper> RSS Update - forum: Would You Use A VPN Provider That Gives You A Static IP? <http://forums.openvpn.net/topic9386.html#p18464> || Is the Windows client simply slower? <http://forums.openvpn.net/topic9379.html#p18463>
02:36 <@vpnHelper> RSS Update - forum: [SOLVED] Connection to network resources problems. <http://forums.openvpn.net/topic9375.html#p18466> || Does This Client Config Look Ok? <http://forums.openvpn.net/topic9384.html#p18465> || Bridging Zeroshell to openvpnas <http://forums.openvpn.net/topic9353.html>
02:42 <@vpnHelper> RSS Update - forum: DNS Round robin : client not failing over <http://forums.openvpn.net/topic9380.html#p18467>
02:48 <@vpnHelper> RSS Update - forum: speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18469> || OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18468>
02:49 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
03:06 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:06 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
03:14 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:24 <@vpnHelper> RSS Update - forum: Multiple clients on OpenVPN - Routing Issue <http://forums.openvpn.net/topic9387.html>
03:36 <@vpnHelper> RSS Update - forum: Does This Client Config Look Ok? <http://forums.openvpn.net/topic9384.html#p18471>
03:39 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
03:42 <@vpnHelper> RSS Update - forum: Would You Use A VPN Provider That Gives You A Static IP? <http://forums.openvpn.net/topic9386.html#p18472>
03:48 <@vpnHelper> RSS Update - forum: Help ! newbie problem!! <http://forums.openvpn.net/topic9376.html#p18473>
04:09 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has joined #openvpn
04:12 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
04:20 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 252 seconds]
04:24 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
04:24 -!- diytto [~diytto@2001:470:25:59c::1337] has quit [Quit: >:o]
04:25 -!- diytto [~diytto@2001:470:25:59c::1337] has joined #openvpn
04:30 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18474>
04:49 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:03 -!- noisebleed_ [~quassel@piggy.inescn.pt] has joined #openvpn
05:03 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 255 seconds]
05:11 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has quit [Quit: This computer has gone to sleep]
05:12 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has joined #openvpn
05:24 <@vpnHelper> RSS Update - forum: Does This Client Config Look Ok? <http://forums.openvpn.net/topic9384.html#p18476> || Is the Windows client simply slower? <http://forums.openvpn.net/topic9379.html#p18475>
05:25 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
05:30 <@vpnHelper> RSS Update - forum: Multiple internet connection using iptables <http://forums.openvpn.net/topic9388.html#p18480> || Would You Use A VPN Provider That Gives You A Static IP? <http://forums.openvpn.net/topic9386.html#p18479> || Is the Windows client simply slower? <http://forums.openvpn.net/topic9379.html#p18478>
05:32 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
05:36 <@vpnHelper> RSS Update - forum: Help ! newbie problem!! <http://forums.openvpn.net/topic9376.html#p18481>
05:42 < EugeneKay> Yawn.
05:42 <@vpnHelper> RSS Update - forum: Multiple clients on OpenVPN - Routing Issue <http://forums.openvpn.net/topic9387.html#p18482>
05:48 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:48 <@vpnHelper> RSS Update - forum: Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18483>
05:55 <@vpnHelper> RSS Update - forum: Help ! newbie problem!! <http://forums.openvpn.net/topic9376.html#p18486> || Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html> || Connection is stuck <http://forums.openvpn.net/topic9378.html#p18484>
06:01 <@vpnHelper> RSS Update - forum: Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18487>
06:02 -!- mode/#openvpn [+v EugeneKay] by ChanServ
06:19 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18489> || Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18488>
06:25 <@vpnHelper> RSS Update - forum: Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18490>
06:34 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
06:43 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18492> || Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18491>
06:48 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
06:50 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:50 -!- mode/#openvpn [+v Axeman] by ChanServ
06:56 -!- Axeman2 [~Axeman3@knox.pace.edu] has joined #openvpn
06:56 -!- Axeman2 [~Axeman3@knox.pace.edu] has quit [Changing host]
06:56 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
06:56 -!- mode/#openvpn [+v Axeman2] by ChanServ
06:57 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
06:58 -!- louiscyfer [~louisponc@216.218.212.68] has joined #openvpn
06:58 -!- Axeman3 [~Axeman3@knox.pace.edu] has joined #openvpn
06:59 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
07:00 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:00 -!- mode/#openvpn [+v Axeman] by ChanServ
07:02 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
07:03 -!- Axeman3 [~Axeman3@knox.pace.edu] has quit [Ping timeout: 248 seconds]
07:08 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
07:11 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
07:19 <@vpnHelper> RSS Update - forum: Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18493>
07:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
07:25 <@vpnHelper> RSS Update - forum: Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18494>
07:31 <@vpnHelper> RSS Update - forum: speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18495>
07:43 <@vpnHelper> RSS Update - forum: Is the Windows client simply slower? <http://forums.openvpn.net/topic9379.html#p18496>
07:52 -!- louiscyfer [~louisponc@216.218.212.68] has quit [Quit: louiscyfer]
08:01 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18497>
08:43 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18498>
08:46 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 255 seconds]
08:49 <@vpnHelper> RSS Update - forum: urgent: admin page gives error 102 <http://forums.openvpn.net/topic9390.html> || Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18499>
09:00 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has quit [Quit: This computer has gone to sleep]
09:07 <@vpnHelper> RSS Update - forum: DNS Round robin : client not failing over <http://forums.openvpn.net/topic9380.html#p18501>
09:18 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
09:18 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
09:18 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
09:47 <@vpnHelper> RSS Update - forum: Multiple clients on OpenVPN - Routing Issue <http://forums.openvpn.net/topic9387.html#p18503> || OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18502>
09:52 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 240 seconds]
09:52 -!- noisebleed_ [~quassel@piggy.inescn.pt] has quit [Ping timeout: 240 seconds]
10:05 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18504>
10:05 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:08 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:11 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18505>
10:17 <@vpnHelper> RSS Update - forum: Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18506>
10:19 -!- Gravitron [~admin@131.238.207.176] has joined #openvpn
10:19 -!- Gravitron [~admin@131.238.207.176] has quit [Changing host]
10:19 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
10:23 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
10:23 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
10:29 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
10:30 -!- ssn [~ssn@erft-4d07ca66.pool.mediaWays.net] has joined #openvpn
10:30 < ssn> hi guys
10:31 < ssn> my networkmanager openvpn setup stopped working
10:31 < ssn> nm-openvpn[9179]: MANAGEMENT: Socket bind failed on local address 127.0.0.1:1194: Cannot assign requested address
10:31 < ssn> how do i fix this?
10:34 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has quit [Ping timeout: 252 seconds]
10:35 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has joined #openvpn
10:36 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 252 seconds]
10:40 <@ecrist> ssn: don't use network manager
10:40 <@ecrist> we don't support it, it sucks balls
10:42 < jeev> ask krzee, he knows about ball sucking
10:45 -!- ssn [~ssn@erft-4d07ca66.pool.mediaWays.net] has left #openvpn []
10:47 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
10:54 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
10:54 -!- mode/#openvpn [+o raidz] by ChanServ
10:56 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Read error: Connection reset by peer]
10:57 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
11:07 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 252 seconds]
11:08 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
11:09 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:09 <+EugeneKay> I prefer the chocolate salty ones myself
11:16  * jeev walks away
11:19 <+EugeneKay> Not a South Park fan, eh
11:23 -!- dazo is now known as dazo_afk
11:35 < jeev> yea but i dont watch it
11:35 < jeev> ;)
11:44 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has joined #openvpn
11:45 < manolitos> Hello, Is openvpn clients compatible with connecting with RRAS VPN server?
11:46 < manolitos> maybe the question is more if  RRAS a standards following vpn server?
11:48 <@ecrist> no
11:48 <@ecrist> openvpn is good to connect to openvpn
11:50 < manolitos> It seems like nobody knows but as far as i can understand, VPN is a protocol with some standards. Whoever develops software that is vpn client or server should respect this standards thus making all vpn clients snd servers compatible, right?
11:59 <@ecrist> no
11:59 <@ecrist> you're WAY off-base
11:59 <@ecrist> VPN is an idea, and there are many implementations of that idea
12:03 < manolitos> yes, i checked it also out and it seems like an idea
12:03 < hyper_ch> howdy ecrist
12:04 <@ecrist> manolitos: you're statement above is wrong.  simple as that.
12:04 <@ecrist> openvpn only works with openvpn
12:05 < manolitos> mm.. can openVPN server check the credentials from a windows domain controler?
12:06 <@ecrist> sure, but you need to write a script to handle that
12:06 <@ecrist> similar things are covered in the howto or man page
12:07 < manolitos> yes.. i think i will go that way instead of rras
12:07 < manolitos> thanx, it is more clear for me now
12:45 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
12:53 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 240 seconds]
12:56 < krzee> !activedirectory
12:56 <@vpnHelper> "activedirectory" is http://amigo4life.googlepages.com/openvpn for the guide of how to auth against AD
12:58 <@ecrist> !ad
12:58 <@ecrist> !learn ad as see !activedirectory
12:58 <@vpnHelper> Joo got it.
12:58 < krzee> !learn ad as [activedirectory]
12:58 <@vpnHelper> Joo got it.
12:58 < krzee> ;]
12:58 < krzee> !forget ad 1
12:58 <@vpnHelper> Joo got it.
12:58 < krzee> !ad
12:58 <@vpnHelper> "ad" is "activedirectory" is http://amigo4life.googlepages.com/openvpn for the guide of how to auth against AD
12:59 <@ecrist> that's great, krzee, until !activedirectory changes.
12:59 < krzee> ahh ok
12:59 < krzee> !forget ad *
12:59 <@vpnHelper> Joo got it.
12:59 < krzee> !learn ad as see !activedirectory
12:59 <@vpnHelper> Joo got it.
13:04 <@vpnHelper> RSS Update - forum: urgent: admin page gives error 102 <http://forums.openvpn.net/topic9390.html#p18507>
13:16 <@vpnHelper> RSS Update - forum: Additional IP-adresses in 1 OpenVPN-tunnel [Newbie] <http://forums.openvpn.net/topic9371.html#p18508>
13:22 <@vpnHelper> RSS Update - forum: DNS Round robin : client not failing over <http://forums.openvpn.net/topic9380.html#p18509>
13:22 < hyper_ch> krzee: my furball is so cute sleeping on my lap
13:23 <+EugeneKay> Pics
13:23 < krzee> heh
13:25 < hyper_ch> I woke her up :(
13:26 < hyper_ch> EugeneKay: http://images.sjau.ch/img/f6a63c82.jpg
13:27 <+EugeneKay> Mraow
13:27 < hyper_ch> but what's really annoying is when I go to bed sleeping
13:27 <@vpnHelper> RSS Update - forum: Connection is stuck <http://forums.openvpn.net/topic9378.html#p18511> || speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18510>
13:27 < krzee> http://httpcats.herokuapp.com/
13:27 <@vpnHelper> Title: HTTP Status Cats (at httpcats.herokuapp.com)
13:27 < hyper_ch> they come also... and the lean themselves towards me
13:27 < hyper_ch> however each of them sleeps on another side of me
13:27 <+EugeneKay> http://eugenekay.com/404
13:27 <@vpnHelper> Title: 404 - Page not found (at eugenekay.com)
13:28 < hyper_ch> the one on that big on my left and the other on my right
13:28 < hyper_ch> so, I can't really move anymore because I'll wake them up
13:29 -!- ptrone [~ptrone@125.182.100.97.cfl.res.rr.com] has joined #openvpn
13:29 <+EugeneKay> My dog just kinda sprawls on the couch all day long
13:30 < krzee> http://httpcats.herokuapp.com/508.jpg
13:30 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
13:30 < krzee> http://httpcats.herokuapp.com/599.jpg
13:31 < hyper_ch> lol
13:32 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
13:34 <@vpnHelper> RSS Update - forum: Routing problems? <http://forums.openvpn.net/topic9374.html#p18513> || OpenVPN IPv6 support <http://forums.openvpn.net/topic9382.html#p18512>
13:35 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:35 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:37 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
13:42 -!- zalzice_ is now known as zalzice
14:11 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
14:16 <@vpnHelper> RSS Update - forum: Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18514>
14:29 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
14:52 < vect0rx> hey krzee, that dd-wrt to dd-wrt vpn I configured started working at 1:09am PST (even though the cert said 1:09am GMT).   I think it's a dd-wrt thing
14:53 < vect0rx> Even though all of the clocks were synched on PST>  I found a few forum postings with similar experiences.
14:53 < vect0rx> It's odd.  Although I had some other problems afterwards.
14:58 <@vpnHelper> RSS Update - forum: Would You Use A VPN Provider That Gives You A Static IP? <http://forums.openvpn.net/topic9386.html#p18515>
15:13 -!- ptrone [~ptrone@125.182.100.97.cfl.res.rr.com] has quit []
15:14 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
15:20 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
15:30 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
15:30 -!- Yen [Yen@unaffiliated/yen] has joined #openvpn
15:35 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:46 <@vpnHelper> RSS Update - forum: RDNS & VPN Locations - Could This Be A Bad Thing? <http://forums.openvpn.net/topic9391.html>
15:55 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
15:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
15:58 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:09 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:18 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
16:19 <@ecrist> Olipro: are you following me?
16:20 < Olipro> ecrist: what?
16:20 <@ecrist> 15:58:59 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #pcbsd
16:21 < Olipro> ...no
16:21 <@ecrist> it was my attempt at humor
16:21 < Olipro> oh, I see
16:21 < Olipro> har... har.
16:21 < Olipro> :P
16:23 <@ecrist> didn't know you were a BSD guy
16:25 -!- bretanika [bretanika@89.114.11.171] has quit []
17:02 <@vpnHelper> RSS Update - forum: Log volume of traffic tunneled by a user <http://forums.openvpn.net/topic9392.html>
17:13 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
17:24 -!- Yen [Yen@unaffiliated/yen] has quit []
17:32 <@vpnHelper> RSS Update - forum: Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18518>
18:04 -!- Denial [Denial@drgi.co.uk] has quit []
18:32 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 244 seconds]
18:33 -!- newl [~newl@97.75.165.156] has joined #openvpn
18:41 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
19:15 <@vpnHelper> RSS Update - forum: Does This Client Config Look Ok? <http://forums.openvpn.net/topic9384.html#p18519>
19:19 -!- JoeK [~Joseph@ip-66-228-36-238.makaiwell.com] has joined #openvpn
19:20 < JoeK> can the openvpn client auto-start (win32) and auto-connect?
19:20 < JoeK> with the system, that is
19:56 -!- _julian [~quassel@hmbg-5f761d1e.pool.mediaWays.net] has joined #openvpn
19:57 -!- _julian_ [~quassel@hmbg-5f764265.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
20:21 -!- master_of_master [~master_of@p57B54067.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
20:23 -!- master_of_master [~master_of@p57B53FD9.dip.t-dialin.net] has joined #openvpn
20:27 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
20:32 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
20:58 -!- gyyrog [~gyyrog@adsl-99-155-151-75.dsl.klmzmi.sbcglobal.net] has joined #openvpn
21:00 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
21:24 -!- gyyrog [~gyyrog@adsl-99-155-151-75.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
21:27 <@vpnHelper> RSS Update - forum: Can connect to Server, unable to access outside network <http://forums.openvpn.net/topic9393.html>
21:27 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
21:31 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:39 <@vpnHelper> RSS Update - forum: [solved] unable to access outside network <http://forums.openvpn.net/topic9393.html>
22:03 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
22:03 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:03 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has joined #openvpn
23:09 <@vpnHelper> RSS Update - forum: OpenVPN Site to Site Connection Using DD-WRT Capable Routers <http://forums.openvpn.net/topic7049.html#p18521>
23:27 <@vpnHelper> RSS Update - forum: Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18522>
--- Day changed Thu Dec 15 2011
00:06 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Read error: Connection reset by peer]
00:10 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
00:18 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
00:30 -!- Pilatus [~Pilatus@ks355380.kimsufi.com] has joined #openvpn
00:54 -!- Xeross [~Xeross@unaffiliated/xeross] has quit [Ping timeout: 252 seconds]
00:55 -!- billow [~billow.la@222.209.150.99] has joined #openvpn
00:55 -!- Pilatus [~Pilatus@ks355380.kimsufi.com] has quit [Quit: bye]
00:57 -!- Xeross [~Xeross@unaffiliated/xeross] has joined #openvpn
00:59 < billow> Hi all,I need any help that I have two openVPN servers A anb B,but now I want to communicate between A and B via VPN.Does It can work?if it's OK,how to configure the A and B?
01:01 < billow> Who can tell me the answer,thanks a lot!
01:17 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 240 seconds]
01:17 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
01:30 <@vpnHelper> RSS Update - forum: Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18524> || Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18523>
01:36 <@vpnHelper> RSS Update - forum: Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18525>
02:00 <@vpnHelper> RSS Update - forum: speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18527> || Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18526>
02:30 <@vpnHelper> RSS Update - forum: Tunnel Connections through VPN <http://forums.openvpn.net/topic9394.html>
02:34 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Read error: Connection reset by peer]
03:12 <@vpnHelper> RSS Update - forum: Log volume of traffic tunneled by a user <http://forums.openvpn.net/topic9392.html#p18530> || RDNS & VPN Locations - Could This Be A Bad Thing? <http://forums.openvpn.net/topic9391.html#p18529>
03:18 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
03:25 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:28 -!- billow [~billow.la@222.209.150.99] has left #openvpn []
03:48 <@vpnHelper> RSS Update - forum: OpenVPN IPv6 support <http://forums.openvpn.net/topic9382.html#p18531>
03:49 <+EugeneKay> Yawn.
03:54 <@vpnHelper> RSS Update - forum: Messages Warning vs Error during connection <http://forums.openvpn.net/topic9395.html>
04:05 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
04:16 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
04:30 <@vpnHelper> RSS Update - forum: Ubuntu lat-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18533>
04:30 -!- dazo_afk is now known as dazo
04:31 -!- supasnashbuhl [6d5af7d9@gateway/web/freenode/ip.109.90.247.217] has joined #openvpn
04:34 < supasnashbuhl> Hello, I'm writing an install and start up script for a complete linux noob, so that she can connect to her uni vpn. I can't test the connection because i don't want her to give me her username and password so i have to ask you a few things: What happens if openvpn client.conf connects? Does it continue running in foreground, so that disconnecting should be done with ctrl-c? Should disconnecting be done with sigterm in genera
04:35 < supasnashbuhl> what is the usual procedure? "openvpn client.conf &" and for disconnect "killall openvpn"?
04:38 < supasnashbuhl> !welcome
04:38 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:38 < supasnashbuhl> !goal
04:38 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:39 < supasnashbuhl> come on.. over 100 idling here and no one can help?
04:40 < supasnashbuhl> i think these are pretty simple questions, that anyone that has ever used openvpn on linux commandline could answer
04:42 <@vpnHelper> RSS Update - forum: Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18534>
04:54 <@vpnHelper> RSS Update - forum: Log volume of traffic tunneled by a user <http://forums.openvpn.net/topic9392.html#p18536> || Tunnel Connections through VPN <http://forums.openvpn.net/topic9394.html#p18535>
05:28 < supasnashbuhl> !logs
05:28 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
05:32 <@dazo> supasnashbuhl: it's usually too early ... most people in europe is at work ... and the US people haven't arrived yet
05:33 <@dazo> supasnashbuhl: if you don't have --daemon, openvpn will run in the foreground in a terminal .... if you add --daemon, it will detatch and go into the background
05:35 <@dazo> supasnashbuhl: to stop it, killall -TERM openvpn, is one way to do it ... or you can look into the --management options .... and you can write a simple script which connects to the managment interface (via a TCP connection) where you can disconnect more gracefully
05:41 < supasnashbuhl> okay thanks @dazo. I figured out the --deamon option too. How can i check if the connection has been actually established?
05:42 < supasnashbuhl> because with --deamon it just goes into background after username and password has been entered and doesn't give any feedback if they were right.
05:43 <@dazo> supasnashbuhl: unless you have some "retry indefinitely" options, the daemon will just die 
05:43 <@dazo> but then again ... using the management interface can provide you with this info
05:43 < supasnashbuhl> so i can check with pidof openvpn?
05:43 < supasnashbuhl> what would be a good time to wait?
05:43 <@dazo> yeah, that might work
05:43 <@dazo> I'd probably wait for 30 seconds
05:43 < supasnashbuhl> 10 sec?
05:43 < supasnashbuhl> okay
05:44 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:44 < supasnashbuhl> or i can check every 5 seconds and if pidof openvpn isn'
05:44 < supasnashbuhl> t empty after 30 seconds all went well
05:44 <@dazo> supasnashbuhl: I have a suggestion!  If you write a "openvpn starter" in python .... it can start openvpn with the management interface, connect to that interface and check if the connection has been established ... and also take care of tearing down the connection as when your user wants to disconnect
05:45 < supasnashbuhl> okay.. I've never written any python thoguh.. :P
05:45 < supasnashbuhl> *though
05:46 < supasnashbuhl> not possible in bash script?
05:49 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
05:53 <@dazo> supasnashbuhl: doing TCP connections stuff in bash isn't that trivial .... and python is dead simple
05:53 <@dazo> (it's not more difficult than bash, really)
05:56 < supasnashbuhl> well i'd need some instructions then..
06:00 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit []
06:00 <@vpnHelper> RSS Update - forum: Additional IP-adresses in 1 OpenVPN-tunnel [Newbie] <http://forums.openvpn.net/topic9371.html#p18538> || Problem connecting to OpenVpn useing username/password <http://forums.openvpn.net/topic9396.html>
06:12 <@vpnHelper> RSS Update - forum: Problem connecting to OpenVpn useing username/password <http://forums.openvpn.net/topic9396.html#p18539>
06:18 <@dazo> supasnashbuhl: http://www.diveintopython.net/
06:18 <@vpnHelper> Title: Dive Into Python (at www.diveintopython.net)
06:22 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:29 -!- noisebleed_ [~quassel@lula.inescn.pt] has joined #openvpn
06:29 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
06:37 <@vpnHelper> RSS Update - forum: Problem connecting to OpenVpn useing username/password <http://forums.openvpn.net/topic9396.html#p18540>
06:45 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
06:45 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 240 seconds]
06:46 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:55 <@vpnHelper> RSS Update - forum: speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18541>
07:07 <@vpnHelper> RSS Update - forum: Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18542>
07:13 <@vpnHelper> RSS Update - forum: Problem connecting to OpenVpn useing username/password <http://forums.openvpn.net/topic9396.html#p18543>
07:19 <@vpnHelper> RSS Update - forum: speed is down when 15 or 20 clients connected <http://forums.openvpn.net/topic9369.html#p18544>
07:23 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-fjjbhvfnkcryzxvv] has quit [Remote host closed the connection]
07:25 <@vpnHelper> RSS Update - forum: Problem connecting to OpenVpn useing username/password <http://forums.openvpn.net/topic9396.html#p18545>
07:38 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
07:42 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-dlfbiqxsjjzoeuho] has joined #openvpn
07:47 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
08:00 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has joined #openvpn
08:11 <@vpnHelper> RSS Update - forum: Problem connecting to OpenVpn useing username/password <http://forums.openvpn.net/topic9396.html#p18546>
08:13 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
08:21 -!- rommel092079 [~rave@184.22.182.246] has joined #openvpn
08:22 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has joined #openvpn
08:22 <@vpnHelper> RSS Update - forum: is this possible? <http://forums.openvpn.net/topic9397.html>
08:22 < rommel092079> guys here is my only hope for my question to be answered about connection stucked up in SENT CONTROL
08:23 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-dlfbiqxsjjzoeuho] has quit [Remote host closed the connection]
08:24 <@ecrist> logs?
08:27 < rommel092079> ecrist, I have given the log and also all the information thru pastebin the other day but I didnt here from you guys and from krzee.  krzee asked me another log for verb 5 but after that I havent heard from krzee.
08:29 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-zkbakliodtpdyxqk] has joined #openvpn
08:30 <@ecrist> rommel092079: I apologize, but I don't sit in here just waiting patiently for people to help
08:30 <@ecrist> I didn't see your log.  If you want me to help, post a new one.
08:30 <@ecrist> otherwise, kindly piss off. :)
08:30 < rommel092079> i will try to post
08:30 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Read error: Connection reset by peer]
08:31 < krzie> ya actually i got tired of seeing so many requests for help and just tossed ya on ignore, you must be using a new host
08:31 < krzie> you've been around for yrs, never seen you try to help yourself
08:31 < rommel092079> no i did not krzie
08:31 <@ecrist> 08:31:44 [Freenode] -!- rommel092079 [~rave@184.22.182.246
08:32 < krzie>  *!*ravemaste@*
08:32 < krzie> heheh
08:32 < krzie> anyways, post logs
08:33 < rommel092079> i will post now
08:38 -!- ravemaster [~rave@184.22.182.246] has joined #openvpn
08:39 < ravemaster> http://pastebin.com/dtGEjahA
08:39 < ravemaster> krzie, http://pastebin.com/dtGEjahA
08:39 -!- rommel092079 [~rave@184.22.182.246] has quit [Ping timeout: 252 seconds]
08:41 < ravemaster> are you there guys?
08:42 < krzie> thats more than verb 5
08:42 <@ecrist> ravemaster: !configs
08:44 < ravemaster> again
08:44 < krzie> by using higher than verb 5 you are completely spamming those logs full of crap
08:45 < ravemaster> here, http://pastebin.com/UiDB4Rdd
08:45 < krzie> !logs
08:45 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:45 < krzie> see how that says verb 5?  :-p
08:45 < krzie> and the server...?
08:45 -!- ravemaster [~rave@184.22.182.246] has quit [Remote host closed the connection]
08:46 -!- rave [~rave@184.22.182.246] has joined #openvpn
08:46 < krzie> [06:45]  <krzie> and the server...?
08:46 < rave> http://pastebin.com/UiDB4Rdd
08:46 < rave> server?
08:47 < krzie> you know, the thing the client connects to
08:47 < rave> server conf?
08:47 < krzie> give this another read
08:47 < krzie> !logs
08:47 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:47 < krzie> i know its long
08:47 < krzie> but read it entirely
08:48 < hyper_ch> hi krzie
08:48 < krzie> hey hyper
08:48 < hyper_ch> krzie: what's up?
08:49 < krzie> bout to grab a cup of coffee
08:49 < krzie> and yourself?
08:49 <@vpnHelper> RSS Update - forum: connection stucks <http://forums.openvpn.net/topic9398.html>
08:50 < hyper_ch> krzie: I just had one :)
08:50 < hyper_ch> krzie: done all important work before xmas :)
08:51 < rave> here guys http://pastebin.com/421ccK8R
08:51 <@ecrist> rave: we need to see the server log, too
08:51 <@ecrist> at verb 5
08:52 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has quit [Quit: This computer has gone to sleep]
08:53 < rave> I cant provide it now guys. I did not include a log for it in the server.  that is all I can provide now. but if I have the server log guys, what am I suppose to look?
08:53 < krzie> good thing you hid 184.22.182.246
08:53 < krzie> cause that would be sooo dangerous to leave in there
08:53 < rave> :)
08:54 < krzie> !topsecret
08:54 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
08:54 < krzie> server log or i cant help you
08:54 <@ecrist> we don't support folks that can't provide the server log
08:54 < hyper_ch> krzie: oh, I love that :)
08:55 < rave> I cant provide now. but what am I suppose to look if I have that.
08:55 <@ecrist> errors
08:55 <@ecrist> look for the errors
08:55 < krzie> pastebin
08:55 < rave> like what error ecrist
08:55 <@dazo> and warnings
08:55 < krzie> hyper_ch, =]
08:55 <@dazo> anything which is not correct
08:55 < hyper_ch> !krzee
08:55 <@ecrist> well, if I knew what errors, I wouldn't need to see your log
08:55 < hyper_ch> !krzie
08:55 < krzie> lol ecrist =]
08:56 < rave> geez, so unlucky I dont have it.
08:56 < hyper_ch> ecrist: you can't mindread logs over the intertubes?
08:57 < rave> dazo, is there a possibility that there is an explanation in the openvpn site that the connection process of openvpn will be explain as to how openvpn tries to connect to internet
08:57 <@ecrist> not yet, but I'm sure I'll receive the upgrade soon enough.
08:57 <@ecrist> no
08:57 < krzie> !security
08:57 <@vpnHelper> "security" is "secure" is (#1) http://openvpn.net/howto.html#security for hardening, or (#2) http://openvpn.net/index.php/documentation/security-overview.html for security overview
08:58 < krzie> iirc #2 talks about some of that
08:58 < krzie> but not likely what you're talking about
08:58 <@dazo> rave: you question is impossible for me to parse ....
08:59 < krzie> erroneous!
08:59  * krzie gets "@" envy
08:59 <@vpnHelper> RSS Update - forum: company A ipaddress ==> company B use <http://forums.openvpn.net/topic9399.html>
08:59 -!- gdfuego [~gdfuego@about/security/staff/pdpc.active.gdfuego] has joined #openvpn
09:00 -!- mode/#openvpn [+o krzie] by vpnHelper
09:00 -!- gdfuego [~gdfuego@about/security/staff/pdpc.active.gdfuego] has left #openvpn []
09:00 -!- MaxSan [~Admin@91.125.132.118] has joined #openvpn
09:00 -!- mode/#openvpn [+v novaflash] by krzie
09:00 < MaxSan> hey people
09:00 -!- mode/#openvpn [+o krzie] by ecrist
09:00 < MaxSan> can anyone help me please
09:00 <@krzie> !ask
09:00 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
09:00 < MaxSan> my server is configured to relay traffic
09:00 < rave> dazo, why? what is wrong? cant you guys provide some kind of explanation or information how openvpn connect?
09:01 < hyper_ch> !howto
09:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:01 < MaxSan> it connects fine, but how do i actually idrect MY traffic through the server?
09:01 < rave> like the manual in openvpn website
09:01 <@krzie> rave, what do you mean by "how connect"
09:01 < hyper_ch> MaxSan: def1
09:01 < hyper_ch> !def1
09:01 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:01 <@krzie> MaxSan, 
09:01 <@krzie> !redirect
09:01 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
09:01 -!- Irssi: #openvpn: Total of 135 nicks [6 ops, 0 halfops, 2 voices, 127 normal]
09:01 < hyper_ch> right, !redicrect is better
09:02 <@dazo> rave: openvpn connects to the internet just as any other program which uses connects to the internet
09:02 < MaxSan> im on windows 7
09:02 < MaxSan> it works on my friends linux machine
09:02 <@krzie> MaxSan, and what os on the server?
09:02 < MaxSan> archlinux
09:02 <@krzie> ohhh ok MaxSan, your friends linux client works on this server?
09:02 < MaxSan> yeh
09:02 <@krzie> if so, post a client log file at verb 5
09:02 < MaxSan> its configured fine i just dont know how to make MY traffic go via the connected VPN
09:03 <@krzie> !logs
09:03 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:03 <@krzie> but for this i only need the client
09:03 <@krzie> also post the client config file
09:03 < rave> krzie, like, LZO compression initialized, then UDPv4 link local (bound): [undef]:53, UDPv4 link remote: 184.22.182.246:9200, then  Control Channel: TLSv1, etc, then SENT CONTROL [ihide]: 'PUSH_REQUEST' (status=1), then Successful ARP Flush on interface etc, until  Initialization Sequence Completed.....
09:04 <@krzie> rave, totally depends on what options the client AND the server use
09:05 < MaxSan> capi?
09:05 <@krzie> huh?
09:06 < MaxSan> where is log file
09:06 <@krzie> !logfile
09:06 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
09:07 < rave> krzie, yes, but what I want to know like what do openvpn needs or passes before it moves to another step in the procedure. because as I also read the log, I see this one "TLS: found match, session[0], sid=aa1c8f97 179ba3ef" on the log that connects properly but not on the log that did not connect.   I guess there is some kind of packet matching before it proceeds to another step.
09:07 <@krzie> your verb is up way too high
09:07 <@ecrist> rave: we're done helping you until you provide the server logs
09:07 <@dazo> +1
09:07 <@krzie> +1
09:09 < rave> actually I made the verb 9 because I though it would be best since it will present complete information
09:09 <@krzie> right, and you did that after we had done this at least 3 times
09:09 <@krzie> !logs
09:09 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:09 < rave> :(
09:09 <@krzie> which proves you wont even read 2 lines that we send you... which is how you made my ignore list with your other host
09:10 <@krzie> anyways, feel free to come back when you have the server log
09:10  * krzie waves
09:10 < rave> yeah, its may fault I did not know that it should only be 5. thanks anyway for accomodating me for the time.
09:11 -!- rave [~rave@184.22.182.246] has quit []
09:11 <@krzie> evidently choke is not a valid dcc type
09:18 <@ecrist> you should try force-choke
09:18 <@ecrist> 09:18:35 [Freenode] [ctcp(krzie)] FORCE-CHOKE
09:23 <@krzie> [07:18]  * Received a CTCP FORCE-CHOKE from ecrist
09:28 -!- rave [~rave@184.22.182.246] has joined #openvpn
09:28 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
09:33 < rave> krzie, ecrist --> http://pastebin.com/PGMF4k2i, server log
09:34 < rave> still there guys?
09:34 <@vpnHelper> RSS Update - forum: Tunnel Connections through VPN <http://forums.openvpn.net/topic9394.html#p18551> || Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18550>
09:35 <@ecrist> I should say something about running the current version, but differences between 2.2.0 and 2.2.1 are minor
09:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
09:38 <@ecrist> rave: at a cursory glace, it appears you have users connecting from a LAN that uses the same IP subnet you want to use on the VPN
09:45 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has joined #openvpn
09:45 < orudie> does openvpn use ipsec ?
09:45 <@krzie> !notcompat
09:45 <@vpnHelper> "notcompat" is (#1) ipsec and pptp are NOT compatibile with openvpn... openvpn is uses SSL, pptp and ipsec both use proprietary protocols, and therefor CAN NOT be compatible or (#2) openvpn only connects to openvpn
09:46 < orudie> great thanks
09:46 <@krzie> np
09:46 < rave> ecrist, but why all of us cant connect?
09:47 <@krzie> unknown paste id
09:49 -!- rave [~rave@184.22.182.246] has quit []
10:12 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 252 seconds]
10:22 < Olipro> that is some legendarily poor grammar on !notcompat
10:22 < Olipro> "openvpn is uses SSL"
10:27 <+EugeneKay> Especially as it uses TLS
10:28 -!- rave [~rave@184.22.182.246] has joined #openvpn
10:30 < rave> while having this stuck problem, I read in google that it maybe caused by dpi and I read that openvpn does not really shows ssl connection when using port 443 that is why they present stunnel to use so that the initial traffic will look like real https.  is that true?
10:37 < rave> guys please answer!
10:40 <@ecrist> what are you asking, rave?
10:41 <@ecrist> you're about one demand away from +b
10:41 <@ecrist> !forget notcompat
10:41 <@vpnHelper> Error: 2 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
10:41 <@ecrist> !forget notcompat *
10:41 <@vpnHelper> Joo got it.
10:42 <@ecrist> !learn notcompat as IPSEC and PPTP are _not_ compatible with OpenVPN.  OpenVPN uses SSL whereas PPTP and IPSEC use proprietary protocols and therefore cannot be compatible.
10:42 <@vpnHelper> Joo got it.
10:42 <@ecrist> !learn notcompat as OpenVPN only connects to OpenVPN
10:42 <@vpnHelper> Joo got it.
10:42 <@ecrist> Olipro: ^^^
10:43 < Olipro> I know the commands
10:43 < Olipro> but I figured you'd have configured it not to listen to anyone but admins
10:43 < rave> ecrist, sorry if it looks like a demand. but I did say please hoping someone are still around.
10:44 <@ecrist> Olipro: I wasn't suggesting you fix it, but that I had done so, at your recommendation.
10:44 < Olipro> :)
10:48 -!- rave [~rave@184.22.182.246] has quit [Ping timeout: 248 seconds]
10:50 < MaxSan> seriously wtf
10:50 < MaxSan> why wont windows go via this tunnel
10:50 < MaxSan> using a differenrt open vpn client now its connecting just like the last one
10:51 <@krzie> MaxSan, did you give me that log?
10:51 <@krzie> last i saw i was asking you for your client log and client config
10:52 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
10:52 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
10:52 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:52 <@krzie> since i have ideas why, but i am unable to divine the reason... ill need what i asked for
10:52 -!- noisebleed_ [~quassel@lula.inescn.pt] has quit [Ping timeout: 252 seconds]
10:53 < MaxSan> i didnt have any log from other client but this one does
10:53 < MaxSan> il copypasta
10:53 < MaxSan> in pastebin
10:53 <@krzie> "other client"  where are these different openvpn clients for windows that you are using...?
10:53 <@krzie> !download
10:53 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html
10:54 <@krzie> #1 is the only place you should be getting from
10:54 < MaxSan> http://pastebin.com/W55bcmzj
10:54 < MaxSan> yup thats exactly it
10:54 < MaxSan> what i have installed ^^
10:55 <@krzie> and config...
10:55 < MaxSan> oh sorry
10:56 <@krzie> are you running this as admin?
10:56 < MaxSan> yeh
10:56 <@krzie> like "runas - admin in the menu"
10:56 <@krzie> err
10:56 <@krzie> yanno what i mean i think
10:56 <@krzie> compat mode - runas admin
10:56 < MaxSan> http://pastebin.com/ds2kCPT5
10:56 < MaxSan> yeh
10:57 <@krzie> ahh ok
10:57 <@krzie> add these:
10:57 <@krzie> route-method exe
10:57 <@krzie> route-delay
10:58 < MaxSan> and give it a restart? :)
10:58 <@krzie> then try again, use verb 4 now
10:58 <@krzie> then repaste new log 
10:58 < MaxSan> whats verb 4?
10:58 <@krzie> see how your client config has verb 6
10:58 <@krzie> ...
11:00 < MaxSan> not sure what this verb is at all lol
11:00 <@krzie> !man
11:00 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
11:00 <@krzie> you should know what everything in your config does
11:00 <@krzie> the manual will tell ya
11:01 < MaxSan> it was a friend who set it up
11:01 < MaxSan> but he doesnt know windows just linux
11:02 < MaxSan> http://pastebin.com/6XKCwRXi
11:04 <@krzie> change verb to 4
11:04 <@krzie> then i will look
11:04 <@krzie> (since it was such a simple direction, i will wait for the new paste)
11:08 <@krzie> and where it says dev tun0
11:08 <@krzie> make it say dev tun
11:08 <@krzie> (remove the 0)
11:08 <@krzie> change verb 6 to verb 4
11:08 <@krzie> then paste your new log
11:08 < MaxSan> ok one sec
11:08 < MaxSan> sorry was checking cooker
11:11 < MaxSan> http://pastebin.com/gQ8MTy0Q
11:11 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
11:11 < MaxSan> thats verb4 and remove the 0 from tun
11:13 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
11:14 < MaxSan> thank for the help btw krzie id of been at a loss without you xD
11:17 <@krzie> yw
11:18 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Quit: Leaving.]
11:18 <@krzie> try this is your client config, then paste me the new log
11:18 <@krzie> ip-win32 netsh
11:19 -!- MaxSan [~Admin@91.125.132.118] has left #openvpn []
11:19 <@krzie> heh or that
11:19 -!- MaxSan [~Admin@91.125.132.118] has joined #openvpn
11:19 < MaxSan> hit worng button lol
11:20 <@krzie> MaxSan, 
11:20 <@krzie> [09:18]  <krzie> try this is your client config, then paste me the new log
11:20 <@krzie> [09:18]  <krzie> ip-win32 netsh
11:20 < MaxSan> sorry missed last message
11:22 < MaxSan> Thu Dec 15 17:21:42 2011 us=346000 OPTIONS IMPORT: route options modified
11:22 < MaxSan> Thu Dec 15 17:21:42 2011 us=346000 ROUTE default_gateway=192.168.1.254
11:22 < MaxSan> Thu Dec 15 17:21:43 2011 us=345000 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set address Local Area Connection 3 static 10.8.0.6 255.255.255.252
11:22 < MaxSan> The object already exists.
11:22 < MaxSan> Thu Dec 15 17:21:58 2011 us=711000 ERROR: netsh command failed: returned error code 1
11:22 < MaxSan> Thu Dec 15 17:22:02 2011 us=704000 NETSH: command failed
11:22 < MaxSan> Thu Dec 15 17:22:02 2011 us=704000 Exiting
11:22 -!- MaxSan was kicked from #openvpn by vpnHelper [Flooding detected. Please use http://pastebin.com for posting logs or configs.]
11:22 -!- MaxSan [~Admin@91.125.132.118] has joined #openvpn
11:23 < MaxSan> dam thought id get away with a few lines lol
11:23 < MaxSan> Thu Dec 15 17:21:58 2011 us=711000 ERROR: netsh command failed: returned error code 1
11:25 <@krzie> ip-win32 ipapi
11:25 <@krzie> and careful, the bot'll ban next time i think
11:25 <@ecrist> yup
11:26 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
11:26 < MaxSan> http://pastebin.com/pe3xqFAv
11:30 <@krzie> whoa whoa
11:31 <@krzie> go to tcp/ip properties for tap-win32
11:31 < MaxSan> sec
11:31 <@krzie> double check that it is set to "obtain an ip address automatically"
11:35 < MaxSan> it wasnt
11:35 < MaxSan> for v4 yeh?
11:36 < MaxSan> food is ready, i changed it to automatically obtain
11:36 <@krzie> new log
11:37 < MaxSan> http://pastebin.com/cJ5EGuu2
11:37 < MaxSan> brb food is ready
11:40 <@krzie> now that you checked "obtain an ip address automatically", remove the line: ip-win32 ipapi
11:41 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
11:43 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
11:55 < MaxSan> http://pastebin.com/LUApiJ1r
12:02 < MaxSan> sorry about that break krzie cant let the effort of food get cold
12:02 < MaxSan> :)
12:02 <@krzie> lets see the latest config
12:03 <@krzie> no worries =]
12:03 <@krzie> im also doing stuff, i may drop off from time to time as well
12:03 < MaxSan> ohhhh i was speaking to boy who setup the server
12:03 < MaxSan> he says his is different cause of access or something
12:04 < MaxSan> difference between bridgedn routed
12:04 < MaxSan> ?
12:04 <@krzie> he is using routed
12:04 <@krzie> so are you
12:04 < MaxSan> yeh
12:04 < MaxSan> do i need bridged?
12:04 <@krzie> shit no
12:04 < MaxSan> he aint so sure himself
12:05 <@krzie> we need to try some stuff we already did
12:05 <@krzie> because for some reason you had unchecked obtain automatically
12:06 <@krzie> no idea why you had done that... and dunno what else you had done
12:06 <@krzie> In Control Panel / Administrative Tools / Services, make sure that the DHCP Client Service is started.
12:07 -!- MaxSan [~Admin@91.125.132.118] has quit [Quit: Leaving.]
12:09 -!- MaxSan [~Admin@91.125.132.118] has joined #openvpn
12:10 <@krzie> [10:05]  <krzie> we need to try some stuff we already did
12:10 <@krzie> [10:05]  <krzie> because for some reason you had unchecked obtain automatically
12:10 <@krzie> [10:06]  <krzie> no idea why you had done that... and dunno what else you had done
12:10 <@krzie> [10:06]  <krzie> In Control Panel / Administrative Tools / Services, make sure that the DHCP Client Service is started.
12:10 < MaxSan> fkinp1pqs,lv
12:10 < MaxSan> .ev9bf1c-31o==t
12:10 <@krzie> jhdfmhds
12:10 < MaxSan> its started
12:10 < MaxSan> sorry lol
12:10 <@krzie> it was started already?
12:11 < MaxSan> yeh
12:12 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 240 seconds]
12:19 < MaxSan> in network pannel it says this method has no internet access
12:19 < MaxSan> is that regular?
12:19 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
12:20 -!- rave [~rave@184.22.182.246] has joined #openvpn
12:20 < rave> how can I wrap openvpn with real https ?
12:21 <@ecrist> what?
12:21 <@ecrist> there is no 'real https'
12:21 < hyper_ch> openvpn > real https :)
12:21 <@ecrist> https is SSL encryption wrapped around HTTP
12:21 <@raidz> ^^
12:22 < hyper_ch> in soviet russia http wraps ssl
12:22 <@ecrist> ugh
12:23 < rave> anonyproz tells while openvpn can use port tcp 443 but its not real https thus can be filtered
12:24 < rave> so they proposes openvpn to use socks proxy made out of ssh over ssl
12:24 <@ecrist> openvpn doesn't do anything to hide what it is
12:26 < rave> but anonyproz.com suggests it to bypass dpi. while it can be kinda solution, but is there any way openvpn to use ssl natively as they say? 
12:26 < MaxSan> no more ideas krzie? lol
12:31 < rave> any advice guys
12:33 <@ecrist> none rave
12:34 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 252 seconds]
12:36 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
12:36 < rave> ok. 
12:36 -!- rave [~rave@184.22.182.246] has quit []
12:37 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
12:37 <@vpnHelper> RSS Update - forum: OpenVPN IPv6 support <http://forums.openvpn.net/topic9382.html#p18553> || Two Sites connected, TAP, VMWare, Duplicate Packets <http://forums.openvpn.net/topic9385.html#p18552> || [resolved] unable to access outside network <http://forums.openvpn.net/topic9393.html>
12:45 <@krzie> MaxSan, 
12:46 <@krzie> [10:02]  <krzie> lets see the latest config
12:46 <@krzie> i wanna see where we are
12:46 <@krzie> since ive had you make a number of changes
12:46 <@krzie> some before, some after we found that you had turned off dhcp on your tap adapter
12:47 <@krzie> now that we found that, we have to try some things we tried before we fixed that
12:47 < MaxSan> http://pastebin.com/QUv0N5sm
12:49 < hyper_ch> krzie: http://www.youtube.com/watch?v=ZPoqNeR3_UA
12:49 <@vpnHelper> Title: Star Trek TNG Ambient Engine Noise (Idling for 24 hrs) - YouTube (at www.youtube.com)
12:54 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
12:55 <@krzie> MaxSan, now try
12:56 < MaxSan> check my IP you mean?
12:56 < MaxSan> It should match my servers IP rite?
12:58 <@krzie> www.secure-computing.net/ip.php
12:58 <@krzie> should show your server's ip, yes
12:58 <@krzie> oh wait no
12:58 <@krzie> lol
12:58 <@krzie> now add this to your client config
12:58 <@krzie> redirect-gateway def1
12:59 <@krzie> THEN connect and go to that link ;]
12:59 < MaxSan> hehe ook
13:01 <@krzie> btw the config you started with, would not redirect internet over the vpn, even in linux
13:01 < MaxSan> timeout?
13:01 <@krzie> which means the guy who runs the server may not have stuff setup for that
13:01 <@krzie> haha yep
13:01 <@krzie> just cause you have a vpn does not mean you can route your internet over it
13:02 <@krzie> get him in here if he wants help getting his server setup for that
13:02 <@krzie> he'll need:
13:02 <@krzie> !linipforward
13:02 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
13:02 <@krzie> !linnat
13:02 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
13:02 < MaxSan> harassing him atm too lol
13:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
13:29 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
14:04 -!- supasnashbuhl [6d5af7d9@gateway/web/freenode/ip.109.90.247.217] has quit [Ping timeout: 258 seconds]
14:09 -!- madsage [~sage@io.ioio.com] has quit [Quit: BitchX-1.1-final -- just do it.]
14:15 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Excess Flood]
14:17 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:20 -!- gyyrog [~gyyrog@fw01.empiricsolutions.com] has joined #openvpn
14:20 <@vpnHelper> RSS Update - forum: Browser could only browse for 2-3minutes then go blank /stop <http://forums.openvpn.net/topic9400.html> || company A ipaddress ==> company B use <http://forums.openvpn.net/topic9399.html#p18554> || Connection is stuck <http://forums.openvpn.net/topic9378.html#p18548>
14:25 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
14:25 <@vpnHelper> RSS Update - forum: Messages Warning vs Error during connection <http://forums.openvpn.net/topic9395.html#p18556>
14:25 -!- gyyrog [~gyyrog@fw01.empiricsolutions.com] has quit [Read error: Connection reset by peer]
14:25 -!- gyyrog [~gyyrog@fw01.empiricsolutions.com] has joined #openvpn
14:30 -!- gyyrog_ [~gyyrog@fw01.empiricsolutions.com] has joined #openvpn
14:31 -!- gyyrog [~gyyrog@fw01.empiricsolutions.com] has quit [Read error: Connection reset by peer]
14:31 <@vpnHelper> RSS Update - forum: Can only ping/access Router and OpenVPN Server <http://forums.openvpn.net/topic9356.html#p18558> || [resolved] ICMP Redirect /Internet traffic via OpenVPN <http://forums.openvpn.net/topic9370.html#p18557>
14:36 <@vpnHelper> RSS Update - forum: Disable split tunneling <http://forums.openvpn.net/topic9373.html#p18559>
14:48 <@vpnHelper> RSS Update - forum: Multiple clients on OpenVPN - Routing Issue <http://forums.openvpn.net/topic9387.html#p18560> || Ubuntu lan-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18533>
14:49 -!- MaxSan [~Admin@91.125.132.118] has quit [Ping timeout: 252 seconds]
14:57 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Quit: Leaving]
15:00 <@vpnHelper> RSS Update - forum: Browser could only browse for 2-3minutes then go blank /stop <http://forums.openvpn.net/topic9400.html#p18561>
15:01 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 240 seconds]
15:03 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
15:19 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 244 seconds]
15:21 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
15:25 -!- dioz [~dioz@2001:470:1f11:12a9::1] has quit [Ping timeout: 248 seconds]
15:37 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 248 seconds]
15:37 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
15:38 -!- GetsEclectic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has joined #openvpn
15:39 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
15:39 < sled-dog> I'm assuming that after I run ./build-dh I can go back and add client certs, right?
15:39 < sled-dog> additional ones, I mean
15:40 -!- GetsEcle1tic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has quit [Read error: Operation timed out]
15:43 -!- JoeGazz84 is now known as Eyore
15:58 -!- orudie [~paul@ool-4b7f8ec4.static.optonline.net] has quit [Quit: бэм бэм бэм бэм бэм бэм бэм бля !]
15:59 -!- pa [~pa@unaffiliated/pa] has quit [Read error: Connection reset by peer]
15:59 <@vpnHelper> RSS Update - forum: RDNS & VPN Locations - Could This Be A Bad Thing? <http://forums.openvpn.net/topic9391.html#p18562>
16:01 -!- dioz [~dioz@2001:470:1f11:12a9::1] has joined #openvpn
16:18 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit []
16:18 -!- novaflash is now known as novaflash_away
16:18 -!- GetsEcle1tic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has joined #openvpn
16:19 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has joined #openvpn
16:21 -!- GetsEclectic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has quit [Ping timeout: 240 seconds]
16:36 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
16:40 -!- gyyrog_ [~gyyrog@fw01.empiricsolutions.com] has quit [Remote host closed the connection]
16:50 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:52 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:52 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:01 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:24 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:36 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 240 seconds]
17:38 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
17:45 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Ping timeout: 240 seconds]
17:45 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has joined #openvpn
17:48 <+EugeneKay> sled-dog - build-dh has nothing to do with certs, so, yes ;-)
17:49 <+EugeneKay> The only thing you need to do before running build-key is . ./vars
17:50 <+EugeneKay> Do NOT clean-all, or run build-ca again
18:00 <@vpnHelper> RSS Update - forum: virtual interfaces eth0:1 <http://forums.openvpn.net/topic7800.html#p18563>
18:03 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
18:05 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
18:17 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Quit: Ex-Chat]
18:18 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
18:19 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
18:27 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
18:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
18:40 -!- dazo is now known as dazo_afk
19:01 -!- Denial [Denial@drgi.co.uk] has quit []
19:02 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
19:18 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
19:18 < BenLue> Hey Guys
19:20 < BenLue> Can anyone give me tutorial to install openvpn on HTC DHD (rooted)
19:20 < BenLue> !welcome
19:20 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:20 < BenLue> !goal
19:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:21 < BenLue> !iporder
19:21 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
19:26 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 252 seconds]
19:34 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Quit: Leaving.]
19:34 -!- MikeJansen1 [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
19:35 -!- MikeJansen1 [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Client Quit]
19:35 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
19:46 -!- newl [~newl@97.75.165.156] has joined #openvpn
19:50 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
19:52 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has quit []
19:55 -!- _julian_ [~quassel@hmbg-5f77f2d9.pool.mediaWays.net] has joined #openvpn
19:55 -!- _julian [~quassel@hmbg-5f761d1e.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
20:19 <@vpnHelper> RSS Update - forum: Routing problems? <http://forums.openvpn.net/topic9374.html#p18564>
20:21 -!- master_of_master [~master_of@p57B53FD9.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
20:23 -!- master_of_master [~master_of@p57B540FE.dip.t-dialin.net] has joined #openvpn
20:29 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
20:30 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:31 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
21:05 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 240 seconds]
21:05 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
21:16 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
21:18 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
21:22 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
21:31 -!- newl [~newl@97.75.165.156] has left #openvpn []
21:54 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
22:03 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
22:03 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
22:04 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has joined #openvpn
22:11 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Remote host closed the connection]
22:12 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
22:29 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Quit: Changing server]
22:36 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
22:37 <@vpnHelper> RSS Update - forum: RDP connection problems and mtu-test <http://forums.openvpn.net/topic9401.html>
22:43 -!- mil-dude [~luser@173.221.87.2.nw.nuvox.net] has joined #openvpn
22:44 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
22:47 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 245 seconds]
22:47 -!- mil-dude [~luser@173.221.87.2.nw.nuvox.net] has quit [Ping timeout: 245 seconds]
22:57 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:13 <@vpnHelper> RSS Update - forum: Two Sites connected, TAP, VMWare, Duplicate Packets <http://forums.openvpn.net/topic9385.html#p18566>
23:33 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
23:51 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
23:58 -!- diytto [~diytto@2001:470:25:59c::1337] has quit [Ping timeout: 268 seconds]
--- Day changed Fri Dec 16 2011
00:08 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
00:09 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Read error: Connection reset by peer]
00:12 <@vpnHelper> RSS Update - forum: Can VPN Services Provide End to End Encryption? <http://forums.openvpn.net/topic9402.html> || [resolved]Two Sites connected, TAP,VMWare, Duplicate Packets <http://forums.openvpn.net/topic9385.html#p18566>
00:18 <@vpnHelper> RSS Update - forum: RDP connection problems and mtu-test <http://forums.openvpn.net/topic9401.html#p18568>
00:22 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
00:30 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
00:37 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
00:51 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:16 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:21 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Read error: Connection reset by peer]
01:23 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
01:24 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
01:30 <@vpnHelper> RSS Update - forum: Help with a simple configuration to connect a pc and router <http://forums.openvpn.net/topic9381.html#p18569>
01:36 <@vpnHelper> RSS Update - forum: Tunnel Connections through VPN <http://forums.openvpn.net/topic9394.html#p18570>
01:53 -!- novaflash_away is now known as novaflash
02:12 -!- dazo_afk is now known as dazo
02:27 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
02:30 <@vpnHelper> RSS Update - forum: Minimum possible resource and packet overhead. <http://forums.openvpn.net/topic9403.html>
03:01 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:06 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
03:08 -!- olli23 [~sYsT3m@213.209.107.106] has joined #openvpn
03:09 < olli23> hi, does the --route-nopull parameter also work, if the ip information were not assigned by the openvpn dhcp server, but from an external server?
03:12 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
03:16 <@vpnHelper> RSS Update - forum: Can VPN Services Provide End to End Encryption? <http://forums.openvpn.net/topic9402.html#p18572>
03:17 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has joined #openvpn
03:21 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:26 <@vpnHelper> RSS Update - forum: how to start openvpn without sudo <http://forums.openvpn.net/topic9404.html>
03:30 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 240 seconds]
03:30 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:50 <@vpnHelper> RSS Update - forum: Help in getting openvpn-auth-pam.so to work properly <http://forums.openvpn.net/topic9405.html>
03:56 -!- olli23 [~sYsT3m@213.209.107.106] has quit [Quit: AnacønÐa · "In order to get a loan you must first prove you don't need it"]
03:57 -!- taruti [taruti@ultra.violetti.org] has joined #openvpn
03:58 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
04:02 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
04:08 -!- taruti [taruti@ultra.violetti.org] has left #openvpn []
04:09 -!- beerbro [~gustav@sockensaft.garagenwein.at] has quit [Quit: ZNC - http://znc.sourceforge.net]
04:21 -!- gustav_ [~gustav@sockensaft.garagenwein.at] has joined #openvpn
04:21 -!- gustav_ is now known as beerbro
04:28 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:31 < hyper_ch> [Thursday 11 August 2011] [06.17:39] <nijet99>  well, my question has already been answered so I won't continue to idle in here :)
04:31 < hyper_ch> [Thursday 11 August 2011] [06.17:41] <nijet99>  thx ES
04:31 < hyper_ch> [Thursday 11 August 2011] [06.17:47] <ES>       np
04:31 < hyper_ch> that's the last entry in my logs
04:31 < hyper_ch> wrong channel :)
04:35 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
04:37 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Read error: Connection reset by peer]
04:42 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
04:46 -!- rave [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has joined #openvpn
04:48 < rave> I have seen a client configuration that it include a <ca>certificate data</ca>.  my question is how can I put it like this way like --client --remote servername port.    Is this the right way --<ca>certificate data</ca> ?
04:49 < rave> I would like to ask because this is not included as I read in the manpage
04:49 < rave> I hope someone can answer. thanks
05:06 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 244 seconds]
05:08 -!- bangert [quasselcor@gentoo/developer/bangert] has joined #openvpn
05:10 <@dazo> rave: the <ca>, <cert> and <key> tags are only for embedding those files into the configuration file
05:13 < bangert> is there a way to force or require the username in password auth to the client certificate common-name
05:13 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 276 seconds]
05:13 <@dazo> bangert: no, that's completely local and it's OpenSSL asking for that password ... no possibility to force it
05:14 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
05:14 <@dazo> bangert: if you want to force password authentication, you need to enable that on the server side and use username/password authentication .... that can be in addition to client certs, or instead of if you want that instead
05:15 < rave> dazo, what is the proper usage of it? because I tried using this way --<ca>certificate data</ca> but it exits
05:15 <@dazo> !--
05:15 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
05:16 <@dazo> rave: ^^^ ... when you do --<ca> ... is that inside the config file?   I interpret it as from the command line, as in this case will not work .... for config files. do:
05:16 <@dazo> <ca>
05:16 <@dazo> {paste content of ca file}
05:16 <@dazo> </ca>
05:16 <@dazo> -------
05:16 <@dazo> that's it
05:16 < rave> yes that is --<ca>certificate data</ca> is inside the config
05:16 <@dazo> remove '--'
05:16 < rave> no
05:16 < rave> i mean in the command line
05:17 <@dazo> you cannot use this from the command line
05:17 < rave> line openvpn --client --<ca>certificate data</ca>
05:17 <@dazo> that won't work
05:17 <@dazo> the command line is limited in length
05:17 < rave> how can I make it use in the command line?
05:17 < rave> is there a way?
05:17 < bangert> dazo: thanks
05:18 < rave> dazo, does that mean, it can never be put in command line? 
05:18 <@dazo> rave: you cannot embed certificates from the command line
05:19 < rave> there's no other way?
05:19 <@dazo> no
05:19 < rave> ok. thanks
05:19 < rave> that is what I wanted to know.
05:19 <@dazo> you can dump the data to a file, and do --ca file .... or you can create a config file 'on-the-fly' and embed all data there and call openvpn with this config file .... but nothing else
05:20 < rave> yes I will agree on this. currently what I do is dump the data to a file, and do --ca file
05:22 < rave> dazo, may I ask why there is an option in openvpn about bind and nobind?  I would like to know how nobind works since its says it relies on ip stack.
05:24 <@dazo> rave: that's dependent on the platform you're running OpenVPN on ... on Linux with UDP it will use the same local port as server port for establishing a connection ... so if the server is on port 1194, the local port will also be 1194 ... this blocks running multiple openvpn instances in parallel
05:24 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
05:24 <@dazo> if you're using --nobind ... it will behave more like TCP, where the local port is a random port between 1024 and 65535
05:27 <@dazo> the --bind option is the opposite of --nobind .... and on most platforms --bind behaves like described above ... however on Windows, it seems to default to a --nobind behaviour
05:27 < rave> I see. so openvpn will randomize port between 1024 and 65535.  i was just puzzled because it stated on manpage that it relies on "ip stack" which I am confused what stack is that :)
05:28 <@dazo> well, it's the IP stack which does this randomisation
05:28 <@dazo> it just depends on the implementation of the IP stack
05:29 < rave> may I ask what is that ip stack. the server is linux and client on windows
05:29 <@dazo> rave: IP stack is the implementation of the TCP/IP support in the operating system
05:30 < rave> i guess I should not deal  on this more right.  anyway, I am satisfied with the explanation. thanks again.
05:37 < rave> dazo, I am just confused that i would like to know why anonyproz says openvpn does not producee real https traffic when using port tcp 443. so their solution is ssh over  ssl with stunnel.  I have read about stunnel on wiki that stunnel use ssl language natively. can you possibly tell me more about  this so I can better understand openvpn. TIA.
05:39 -!- lophlo [588ca508@gateway/web/freenode/ip.88.140.165.8] has joined #openvpn
05:39 < lophlo> which protocol or program should i use to communicate safely with a group of people on the internet?
05:39 < hyper_ch> lophlo: all depends
05:40 < lophlo> the group needs to talk by writing (like irc) and by voice (like a conference)
05:40 < hyper_ch> run your own ircd and and openvpn server and freeswitch server
05:42 < hyper_ch> and get some sip phones that support openvpn
05:42 -!- rave [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has quit [Quit: Page closed]
05:42 < hyper_ch> but then, it all depends what you define as "securely"
05:42 < hyper_ch> dazo: krzee, EugeneKay, ecrist all tried to help rave...
05:43 < lophlo> hyper_ch: only people invited should be able to access the communications
05:43 < lophlo> hyper_ch: no one else should be able to hear or to read what's being said
05:43 <@dazo> hyper_ch: yeah, I know ... I'm probably just bored .... :-P
05:44 < hyper_ch> lophlo: that doesn't really help any further
05:45 < lophlo> hyper_ch: i don't really understand your question i think
05:45 < lophlo> hyper_ch: if i use ircd and a freeswitch server, what would openvpn be for?
05:45 < hyper_ch> lophlo: to have encrypted tunnels between the fs server and sip clients
05:45 < hyper_ch> and to have encrypted tunnels between the ircd and irc clients
05:46 < hyper_ch> it all depends what you mean with "safely"
05:46 <@dazo> lophlo: your question is very broad ... as there are many ways to do safe communication .... you can enable encryption on ircd or freeswitch (I presume), requiring all your users to have encryption aware software as well
05:46 < hyper_ch> but if you're truly paranoid, you'd not trust electronic communication at all
05:46 < lophlo> hyper_ch: what possible definitions could there be for safely?
05:46 < hyper_ch> lophlo: there's a lot of them
05:46 < lophlo> hyper_ch: ye but no choice i can only be electronic
05:46 < lophlo> it can*
05:47 < hyper_ch> with freeswitch, you have a PBX stack
05:47 < hyper_ch> you can connect to it with sip phones
05:47 < hyper_ch> so you have voice and maybe even video communication
05:47 < hyper_ch> and openvpn just encrypts all data back an forth, so no middle man knows what's going on
05:47 < lophlo> hyper_ch: you can connect with a computer as well? and if you can talk you can also probably write, so why use ircd?
05:48 <@dazo> lophlo: then you can have safe communication just like that ..... or you can use VPN (both instead or in addition too, depending on what you like).  With VPN you will get a virtual network where all communication between VPN clients and servers are encrypted .... then your irc/freeswitch users can connect *via* this VPN network ... and the communication gets encrypted, even if the irc or VoIP traffic is not encrypted from the software
05:48 < lophlo> i see
05:49 -!- bangert [quasselcor@gentoo/developer/bangert] has left #openvpn []
05:49 < hyper_ch> sip has no "write" support.. only video and audio
05:49 <@dazo> VPN = Virtual Private Network .... it's like a normal network, just that the traffic going between VPN server and clients gets encrypted on-the-fly
05:50 < hyper_ch> and when you use keys in the VPN, only people with the keys can access it
05:50 < hyper_ch> and as said, there are some sip phones that do support openvpn
05:50 < lophlo> dazo: who would run the vpn server? and how to make people communicate with freeswitch through this vpn server?
05:52 < hyper_ch> rent a server
05:52 < hyper_ch> supply one
05:52 < hyper_ch> people will have to get according certificates to access the VPNed services
05:52 < hyper_ch> but do you really need a fully encrypted communication between users
05:53 < lophlo> yes
05:53 < hyper_ch> or do you just sort of want to make sure only authorized people can access the services
05:53 < lophlo> it needs to be encrypted
05:53 < lophlo> but once the clients have accessed the vpn server, they just open freeswitch and and talk like usual?
05:54 < hyper_ch> freeswitch is a PBX software
05:54 < hyper_ch> people can use a software based sip client
05:54 < hyper_ch> or people can use a hardware sip phone - but it will need to support openvpn then
05:55 < lophlo> ok i see
05:55 < lophlo> but the freeswitch server would run on the vpn server or what?
05:55 < hyper_ch> sort of
05:56 < hyper_ch> you should setup freeswitch to only accept connections from the vpn
05:56 < lophlo> can anyone install a server vpn at home?
05:57 < hyper_ch> yes, but what for?
05:57  * dazo disappears for a while
05:57 < lophlo> so that people connect to it, as you said right?
05:58 < hyper_ch> they will need to install the client
05:58 < hyper_ch> and yes, people can do tht
05:58 < hyper_ch> as openvpn is opensource software, freely available
05:58 < hyper_ch> dazo: noooooooo
05:58 < lophlo> ye, that looks good :)
05:58 < lophlo> i made him run away :p
06:01 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
06:04 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
06:18 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
06:18 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
06:18 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:19 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Quit: EvilJStoker is gone :(]
06:24 <@vpnHelper> RSS Update - forum: Autologin doesn't work. <http://forums.openvpn.net/topic9406.html>
06:28 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Quit: Leaving]
06:33 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
06:35 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
07:01 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18576>
07:07 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18577>
07:28 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has joined #openvpn
07:32 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit []
07:49 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
08:00 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 244 seconds]
08:02 -!- Diffen [~diffen@78-69-119-137-no42.tbcn.telia.com] has quit [Quit: This computer has gone to sleep]
08:03 -!- rave [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has joined #openvpn
08:05 < rave> guys going back to wiki on dpi, states that "DPI can identify and classify traffic based on a signature database that includes information extracted from the data part of a packet, allowing finer control than classification based only on header information".  What is that data part of the packet?
08:05 -!- lophlo [588ca508@gateway/web/freenode/ip.88.140.165.8] has quit [Ping timeout: 258 seconds]
08:07 < rave> when openvpn encrypts the traffic, does that include the whole packet (header, payload and trailer)?
08:08 < rave> guys please lets talk. I want to know more about this encryption thing, what and how it works.
08:09 < rawplayer> rave: 
08:09 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
08:09 < rawplayer> setup a vpn connection
08:09 < rawplayer> and sniff your traffic
08:09 < rawplayer> and then draw a conclusion
08:09 < rave> rawplayer, what should I use to sniff my traffic?
08:09 < rawplayer> and then tell us your conclusion :)
08:09 < rawplayer> tcpdump
08:10 < rave> is that for windows based application to use?
08:10 < rawplayer> try wireshark
08:10 < rawplayer> it makes more sense to draw a conclusion then hearing a conclusion from someone else without even noticing _why_ something works
08:11 < rave> ok. what should I look on this sniffing?
08:12 < hyper_ch> rave: audit the source code and you'll know what it does
08:12 < rawplayer> lol
08:13 <@dazo> rave: openvpn takes packets from the virtual NIC (tun/tap device), compresses it (if lzo is enabled), encrypts it using SSL, encapsulates it with some OpenVPN information and sends it to the other side
08:13 <@dazo> the other side evaluates the OpenVPN headers (encapsulation), extracts the SSL data and pushed it be decrypted, decompresses it if needed and pushes that data out to the tun/tap device 
08:14 < rave> dazo, if encrypting it with ssl, is the whole packet being encrypted? like is the protocol, port, etc are encrypted?
08:14 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:14 <@dazo> rave: well, yeah ... otherwise it would be pretty lame
08:15 <@dazo> openvpn may (or probably the SSL library) also encrypt several packets in one go before sending it to the remote host
08:17 < rave> because I am analyzing base on the wiki about dpi about how to evade dpi "End points can utilize encryption and obfuscation techniques to evade DPI actions in many cases."  so if this is the case, openvpn with its encryption should have the capacity to evade dpi, right?
08:17 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Quit: Ex-Chat]
08:17 <@dazo> rave: what do you mean with dpi?
08:17 < rave> because wiki on dpi talks about eavesdropping too
08:17 < rave> dazo: deep packet inspection
08:19 <@dazo> well, there are many ways of doing eavesdropping, and I don't understand most of these techniques ... but there are no information in the communication between the client and server which are easily identifiable via dpi 
08:19 <@ecrist> rave: openvpn doesn't hide itself, but dpi isn't going to reveal *what* is happening within the VPN
08:19 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:19 <@dazo> it is detectable that it is openvpn traffic, and that's basically it
08:20 <@dazo> the only reason it is detected as openvpn traffic, is that it has it's own encapsulation (a openvpn header) before the SSL packet
08:20 < rave> dpi isnt going to reveal what is happening within the vpn because of the encryption right, but doesnt hide itself thereby it is detectable as openvpn traffic.
08:20 <@ecrist> correct
08:21 < rave> "own encapsulation (a openvpn header) before the SSL packet" <--- cant it be possible the the ssl packet before the openvpn header?
08:21 < rave> or its just made that way
08:21 <@ecrist> it's just made that way
08:22 < rave> i see.
08:22 <@ecrist> and there isn't really any movement to change that
08:22 <@dazo> rave: the ssl protocol is strictly designed for TCP .... openvpn allows SSL over UDP, because of this extra header
08:23 < rave> ssl over udp? do you mean that we can use port 443 proto udp on our server conf?
08:25 <@dazo> yes, of course
08:27 < rave> anyway, I havent read about DPI is reading encapsulation but rather ip header and data part (and possibly also the header) of a packet.   I am thinking now that if DPI cannot detect the protocol and ports and etc and dpi dont read encapsulation, then can I eliminate that dpi drops openvpn traffic?
08:28 < rave> or am I wrong that dpi can actually read openvpn encapsulation (openvpn traffic) and drops it.
08:30 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
08:31 <@dazo> rave: you cannot hide the source and destination IP or ports between the openvpn server and openvpn client ... that is required to be able to route the traffic, and must be readable by anyone passing the packets .... eavesdropping the contents of the packet being routed (the SSL data) is a completely different story
08:31 < rave> ah ok.
08:32 < rave> so perhaps dpi is sniffing those ip and ports especially if are constantly on traffic for long hours?
08:35 <@dazo> and it can read the beginning of the data payload (which comes after proto/IP/port info) and do a guestimate on what kind of traffic it contains ... it will be possible to identify it is OpenVPN traffic, due to the format of that information (it contains plain-text readable sequence numbers and a few other bits which are insensitive in the TCP/IP world) ... and based on that classify the complete packet as OpenVPN traffic .... but going from 
08:35 <@dazo> there to see what happens inside the tunnel, that's way harder and most likely not much possible
08:36 < rave> ok.
08:36 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has joined #openvpn
08:38 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
08:38 < rave> dazo, relating to openvpn encryption against dpi, do you have any advised to bypass dpi problem?
08:41 <@dazo> rave: you cannot avoid dpi in general ... and to avoid openvpn traffic being identified as openvpn traffic, you need to redesign the complete openvpn protocol - which will *not* happen
08:42 < rave> other than redesigning the openvpn, any other advice that I can research on?
08:42 <@dazo> it is not possible
08:43 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Ping timeout: 268 seconds]
08:43 <@dazo> well, you can tunnel openvpn traffic via stunnel or ssh port forwarding .... but gee, if you do that, you'll come back crying due to performance and stability troubles
08:43 <@dazo> so to sum it up .... don't bother, it is currently not possible
08:44 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
08:44 < rave> yes, I have tried openvpn via stunnel and I have cried as you said  :)
08:45 < rave> anyway, thanks for the talk dazo
08:45 -!- rave [7d3cf0d7@gateway/web/freenode/ip.125.60.240.215] has quit [Quit: Page closed]
08:48 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Ping timeout: 252 seconds]
08:55 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
08:56 -!- gyyrog [~gyyrog@fw01.empiricsolutions.com] has joined #openvpn
08:58 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
09:00 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
09:01 -!- p3rror [~mezgani@2001:470:1f0b:c66:1::2] has quit [Read error: Connection reset by peer]
09:09 -!- diytto [diytto@zebra689.server4you.net] has joined #openvpn
09:15 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 252 seconds]
09:22 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
09:24 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
09:46 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
09:59 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
10:00 -!- kyrix [~ashley@chello212186126012.11.vie.surfer.at] has quit [Quit: Ex-Chat]
10:05 -!- MarKsaitis [~MarKsaiti@195.59.185.18] has quit [Ping timeout: 268 seconds]
10:06 -!- noisebleed_ [~quassel@kermit.inescn.pt] has joined #openvpn
10:07 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 245 seconds]
10:09 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
10:13 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 248 seconds]
10:27 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 276 seconds]
10:28 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
10:33 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Read error: Operation timed out]
10:37 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 240 seconds]
10:38 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
10:45 <@vpnHelper> RSS Update - forum: Help in getting openvpn-auth-pam.so to work properly <http://forums.openvpn.net/topic9405.html#p18578>
10:49 -!- dazo is now known as dazo_afk
10:54 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
11:17 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:17 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
11:17 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
11:20 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
11:26 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
11:43 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 252 seconds]
11:45 -!- kanyl [~kanyl@84.23.155.169] has joined #openvpn
11:47 -!- kanyl [~kanyl@84.23.155.169] has quit [Changing host]
11:47 -!- kanyl [~kanyl@unaffiliated/kanyl] has joined #openvpn
11:56 -!- gyyrog [~gyyrog@fw01.empiricsolutions.com] has quit [Remote host closed the connection]
12:00 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
12:07 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 240 seconds]
12:09 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
12:09 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
12:11 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
12:14 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
12:21 -!- pa [~pa@host96-16-dynamic.57-82-r.retail.telecomitalia.it] has joined #openvpn
12:21 -!- pa [~pa@host96-16-dynamic.57-82-r.retail.telecomitalia.it] has quit [Changing host]
12:21 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:25 < hyper_ch> !confgen
12:25 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
12:44 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
12:57 -!- noisebleed_ [~quassel@kermit.inescn.pt] has quit [Ping timeout: 240 seconds]
13:08 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
13:26 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:33 < hyper_ch> krzee: ecrist: EugeneKay: https://www.schneier.com/blog/archives/2011/12/more_on_the_cap.html
13:33 <@vpnHelper> Title: Schneier on Security: More on the Captured U.S. Drone (at www.schneier.com)
13:44 <@vpnHelper> RSS Update - forum: Tinfoil Hat config check/verification <http://forums.openvpn.net/topic9407.html>
13:47 -!- gyyrog [~gyyrog@fw01.empiricsolutions.com] has joined #openvpn
13:55 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Ping timeout: 252 seconds]
13:56 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
14:13 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
14:14 <@ecrist> hyper_ch: I know that guy.
14:15 < hyper_ch> bruce schneier?
14:15 <@ecrist> aye
14:17 < hyper_ch> EugeneKay: http://www.schneierfacts.com/fact/567
14:17 <@vpnHelper> Title: Bruce Schneier Facts (at www.schneierfacts.com)
14:17 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
14:24 < hyper_ch> !keepalive
14:56 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:03 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 252 seconds]
15:04 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
15:12 < vect0rx> 
15:21 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
15:24 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
15:35 -!- EmperorTom [~EmperorTo@75-134-132-11.dhcp.roch.mn.charter.com] has joined #openvpn
15:36 -!- EmperorTom [~EmperorTo@75-134-132-11.dhcp.roch.mn.charter.com] has quit [Client Quit]
15:41 -!- EmperorTom [~EmperorTo@75-134-132-11.dhcp.roch.mn.charter.com] has joined #openvpn
15:42 -!- EmperorTom [~EmperorTo@75-134-132-11.dhcp.roch.mn.charter.com] has quit [Client Quit]
15:43 -!- EmperorTom [~EmperorTo@75-134-132-11.dhcp.roch.mn.charter.com] has joined #openvpn
15:52 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
15:53 < okamis_> hi, it works but I want to change the server ip to something else, and If I do I get fail http://pastebin.com/q0aihCu2
15:54 < okamis_> the server actual ip is 10.1.1.101
15:55 -!- MadTBone [~MadTBone@gw1.msmnyc.edu] has quit [Quit: Leaving]
16:06 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
16:16 -!- p3rror [~mezgani@41.140.42.191] has joined #openvpn
16:20 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:27 -!- gyyrog [~gyyrog@fw01.empiricsolutions.com] has quit [Remote host closed the connection]
16:34 -!- kbarry [~chatzilla@rrcs-24-153-167-49.sw.biz.rr.com] has joined #openvpn
16:36 < kbarry> I want to Create a VPN between places of business thats always connected, and also allow remote access to the network (for home users and so forth)
16:37 < krzee> !route
16:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
16:38 < krzee> 1 office is a server, 1 office is a client (as are all the road warriors)
16:38 < krzee> you want to share the lans of the server, and the client which is an office
16:39 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has left #openvpn []
16:39 < kbarry> krzee i have plans to get 2 identicle devices
16:39 < kbarry> like DD-WRT compliant device
16:39 < kbarry> quick question,
16:40 < kbarry> I probably need to read that entire link first.
16:40 < kbarry> then ask questions.
16:42 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit []
16:44 -!- p3rror [~mezgani@41.140.42.191] has quit [Ping timeout: 240 seconds]
16:45 < krzee> wow, i already like you
16:45 < krzee> yes, do finish before asking =]
16:51 < kbarry> Ok, i read it over. Lets see how much i understood.
16:52 < kbarry> I am going to need to do something with my Modem/Router from my ISP
16:52 < kbarry> so that traffic can get to the VPN device.
16:52 < kbarry> I am really asking a question here, but i assume that the VPN device will probably be behind my modem/router?
16:53 -!- EmperorTom [~EmperorTo@75-134-132-11.dhcp.roch.mn.charter.com] has quit [Remote host closed the connection]
16:56 < kbarry> Server--ServerRouter/Modem--ISP--ClientRouter/Modem--Client
16:56 < kbarry> I'm guessing that if the client and server's lans are accessible.
16:57 -!- treund [~treund@97.75.177.42] has joined #openvpn
16:57 -!- p3rror [~mezgani@41.248.106.200] has joined #openvpn
16:57 < JoeK> i want to install openvpn on a client in my workplace; the problem is after a few hours the computer needs to log in via HTTP (making any GET request) or all net traffic is denied
16:57 < krzee> you only need 1 ip forwarded to the server
16:58 < JoeK> is there something openvpn can do to keep up with that?
16:58 < krzee> JoeK, sucks for you
16:58 < krzee> no, i suggest a crontab
16:58 < krzee> kbarry, you only need 1 ip forwarded to the server, none to the clients
16:58 < krzee> err 1 port*
17:01 < kbarry> ok. So let me put this in my own words. I am a client device, trying to send a packet to the VPN, which is located on the public static ip of 192.168.1.1 (for simplicity)
17:02 < kbarry> The packet is sent, and when it gets tot he static ip, my modem/router sees that its for port...... 5 (whatever special poart it is)
17:02 < krzee> it works the same as web traffic
17:02 < krzee> the same way the return web traffic finds its way to the client, so does the return vpn traffic
17:03 -!- twobitsprite [~isaac@li24-165.members.linode.com] has quit [Ping timeout: 252 seconds]
17:03 < krzee> (your router keeps a NAT table, etc etc, general networking)
17:04 < kbarry> and says "Ohh, all packets on this port go strait to the VPN device at xxx.xxx.xxx.xxx)
17:04 < kbarry> Ok,
17:04 < kbarry> I believe i follow.
17:04 < kbarry> So, for road warriors,
17:04 < kbarry> what does "getting conencted" involve?
17:04 < kbarry> Is there like a window exe or gui, or...... how does a windows user get connected?
17:05 < kbarry> I'm guessing i can get a router to "Stay" connected to the Server.
17:06 -!- treund [~treund@97.75.177.42] has left #openvpn []
17:06 < kbarry> and i am guessing that its possible to have a router/device connecting as a client all the time, to "ACT" like an accesspoint/switch
17:06 < kbarry> And let, say, the DHCP server of the other location handle the DHCP for all locations?
17:07 < kbarry> I'm such a noob i am confused how connecting with a VPN..... what if there are network conflicts, or maybe there are not, because the VPN connection acts like a new network interface, and thus gets its own special IP
17:11 < JoeK> kbarry: the vpn makes a virtual adapter of which all your normal traffic is put through once a tunnel connection is made
17:11 < JoeK> i recommend the use of a VPN firewall; eg; a device that has the sole purpose of making a tunnel
17:12 < JoeK> i know dd-wrt comes with this feature
17:12 < kbarry> I have a Sonicwall  that my office tossed out a few years ago when it upgraded
17:12 < krzee> kbarry, 
17:12 < krzee> 2 routers can stay connected
17:12 < kbarry> Its a Sonicwall TZ 170
17:13 < krzee> you wouldnt need anything else except a properly configured router
17:13 < krzee> then for the road warriors, yes you could use the windows gui
17:13 < krzee> or it could run in the background as a windows service
17:13 < kbarry> Ok, So, Sonicwall as my server,
17:13 < kbarry> Another device as my persistent client
17:14 < kbarry> (at locations B)
17:14 < krzee> !vpn
17:14 < kbarry> B
17:14 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
17:15 < kbarry> *reading*
17:17 < kbarry> ok
17:17 < kbarry> Are you saying i can use the SonicWall insead of a device running OpenVPN?
17:19 < kbarry> Secondly, What does a device need to be capable of doing in order to make a connection to the server device? (What would it be called?) I am guessing that a DD-WRT capable device, like the Buffalo Airstation can make the persistent connection?
17:19 < JoeK> kbarry: stop thinking too much
17:20 < kbarry> hahahahaha.
17:20 < JoeK> you are hurting my brain
17:20 < kbarry> JoeK: I'm such a noob with VPN
17:20 < JoeK> anything that can sustain a persistant connection would do fine with a vpn
17:20 < JoeK> think of a vpn, in laymens terms, as a transparant proxy
17:20 < JoeK> you can have 2 dd-wrt devices running, one as a server, and one as a client, and visa versa
17:21 < JoeK> if the sonicwall, has the ability to perform as a server, then the dd-wrt would be able to connect to it
17:21 < kbarry> Ok,
17:21 < kbarry> question. If i am on my laptop connected n the same network as the client device, 
17:22 < kbarry> where does my DHCP address come from?
17:22 < JoeK> the client device
17:22 < JoeK> the 'client vpn' device will just be routing all normal traffic through the tunnell, that is it
17:22 <@vpnHelper> RSS Update - forum: Does OpenVPN Provide Perfect Forward Secrecy? <http://forums.openvpn.net/topic9408.html> || Can VPN Services Provide End to End Encryption? <http://forums.openvpn.net/topic9402.html#p18580>
17:22 < JoeK> you wouldnt really be able to tell if the network even was using a tunnell unless you knew
17:23 < JoeK> its the same as directly cabling the 'client device' to the 'server device', except its all done virtually
17:23 < JoeK> you can have the client give DHCP or have the 'server network' assign it
17:24 < kbarry> ohhhhhh
17:24 < kbarry> a light just went on. If i connect to LANs with DHCPs, 
17:24 < kbarry> there may be ip conflicts
17:25 < JoeK> no
17:25 < kbarry> why am i not getting this?
17:25 < JoeK> actually, yes
17:25 < JoeK> caught me on that one
17:25 < kbarry> Ok, There might be ip conflicts.
17:25 < JoeK> its best to have a single DHCP server
17:26 < kbarry> right now, the Modems on both ends are acting as the DHCP servers.
17:26 < kbarry> when the client and server and conencted does it matter what is the DHCP server?
17:27 < JoeK> the client device and server device would be using their external ip addresses
17:27 < JoeK> the problem is the devices on each lan
17:27 < kbarry> sure. 
17:27 < kbarry> I think i follow that.
17:27 < kbarry> might be soemthing like
17:27 < JoeK> as long as there is a dhcp server accessible it should play out fine
17:27 < kbarry> Ok.
17:28 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 240 seconds]
17:29 < kbarry> not that i know what i am talking about, but i think that the Sonicwall uses IPsec.
17:29 < JoeK> you are just overthinking this
17:29 < JoeK> like i said, a vpn is practically the equal of directly plugging in your LANs into a single device
17:29 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:30 < JoeK> if you hook in two routers as clients, then each lan would not have ip conflict problems, but be hidden from each other
17:30 < kbarry> transparent proxy was a good description
17:30 < JoeK> eg: following same networking principals
17:30 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
17:30 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
17:30 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
17:31 < kbarry> do you use DD-WRT on any devices?
17:35 -!- BenLue [NoMail@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
17:38 -!- p3rror [~mezgani@41.248.106.200] has quit [Ping timeout: 240 seconds]
17:53 -!- BenLue [NoMail@178-83-34-83.dynamic.hispeed.ch] has quit [Read error: Connection reset by peer]
17:54 -!- BenLue [NoMail@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
17:55 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
18:03 < JoeK> kbarry: i do
18:06 -!- BenLue [NoMail@178-83-34-83.dynamic.hispeed.ch] has quit [Ping timeout: 255 seconds]
18:08 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
18:09 -!- kbarry [~chatzilla@rrcs-24-153-167-49.sw.biz.rr.com] has quit [Remote host closed the connection]
18:21 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 268 seconds]
18:25 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has quit [Ping timeout: 255 seconds]
18:25 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
18:36 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has quit [Read error: Connection reset by peer]
18:37 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
18:41 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has quit [Ping timeout: 252 seconds]
18:41 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
18:42 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
18:55 -!- TJNII [~TJNII@tjnii.com] has quit [Ping timeout: 240 seconds]
19:09 -!- JodaZ [~joda@ns387141.ovh.net] has joined #openvpn
19:18 -!- BenLue is now known as S1lv3R
19:51 -!- _julian [~quassel@hmbg-4d06e2ec.pool.mediaWays.net] has joined #openvpn
19:55 -!- _julian_ [~quassel@hmbg-5f77f2d9.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
20:09 <@vpnHelper> RSS Update - forum: Ldap cant pull from Active directory. <http://forums.openvpn.net/topic9409.html>
20:21 <@vpnHelper> RSS Update - forum: Ldap cant pull from Active directory. <http://forums.openvpn.net/topic9409.html#p18583>
20:22 -!- master_of_master [~master_of@p57B540FE.dip.t-dialin.net] has quit [Ping timeout: 268 seconds]
20:23 -!- master_of_master [~master_of@p57B54E36.dip.t-dialin.net] has joined #openvpn
20:50 -!- p3rror [~mezgani@41.249.2.203] has joined #openvpn
21:04 -!- Denial [Denial@drgi.co.uk] has quit []
21:07 -!- me345 [~me345@adsl-75-15-183-164.dsl.bkfd14.sbcglobal.net] has joined #openvpn
21:10 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
21:10 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
21:18 -!- me345 [~me345@adsl-75-15-183-164.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
21:26 -!- rommel092079 [~ravemaste@122.2.46.76] has joined #openvpn
21:26 -!- rommel092079 is now known as rave
21:28 < rave> dazo, guys, I have port-share serverip 443 for my server config. I have it because I have running httpd port 443 on ssl.conf but when I run server.conf, it exits because address already in use.
21:28 < rave> what to do?
21:43 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
21:53 -!- rave [~ravemaste@122.2.46.76] has quit [Ping timeout: 240 seconds]
22:04 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
22:04 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has joined #openvpn
22:20 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has joined #openvpn
22:40 -!- p3rror [~mezgani@41.249.2.203] has quit [Ping timeout: 240 seconds]
22:42 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
22:45 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Read error: Operation timed out]
22:49 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
23:14 -!- Gravitron [~admin@cpe-24-209-29-182.cinci.res.rr.com] has joined #openvpn
23:14 -!- Gravitron [~admin@cpe-24-209-29-182.cinci.res.rr.com] has quit [Client Quit]
23:59 -!- Harley [~Harley@182.149.54.213] has joined #openvpn
--- Day changed Sat Dec 17 2011
00:01 < Harley> hello would anyone be able to offer some help support please - have a unix OpenVPN server with a mac client using tunnelblick -- connects just fine but cannot browse the web. on another client (ubuntu) works just fine.. 
00:06 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
00:27 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
00:43 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
01:06 < takamichi> Hey, I'm trying to resolve an issue where our users can connect but there routing is not working. I uploaded the log files last week but was asked to provide a copy of the routing tables as well. I've put everything together in one paste, the logs, routing tables and client and server config files - http://pastebin.com/PtaL8W59 - I'd really appreciate any advice you may have.
01:06 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
01:09 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
01:09 -!- mode/#openvpn [+o raidz] by ChanServ
02:02 < hyper_ch> Harley: stop using mac then :) you use the same config for both and both are connected at the same time
02:02 < hyper_ch> takamichi: should everything be routed through the vpn?
02:26 < takamichi> hyper_ch: yes
02:26 < takamichi> hyper_ch: including dns lookups obviously.
02:26 < hyper_ch> !def1
02:26 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
02:27 < hyper_ch> !route
02:27 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
02:27 < hyper_ch> !ipforward
02:27 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
02:30 < takamichi> !winipforward
02:30 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
02:32 < takamichi> hyper_ch: Do you believe that using the def1 flag would help? We are pushing redirect-gateway without this flag because we don't need a fallback.
02:33 < takamichi> hyper_ch: Our routing is working correcty according to a few hundred of our users who are having no issues with the same config.
03:03 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 252 seconds]
03:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
03:09 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
03:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
03:26 < takamichi> As far as I can see the routing table after the user connects looks correct. the default gateway is specified and has the lowest metric.
03:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
03:41 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
03:47 < Harley> hyper_ch: haha yes same time.. same config.. 
03:47 <@vpnHelper> RSS Update - forum: One OpenVPN for Multiple IPs <http://forums.openvpn.net/topic8552-30.html#p18584>
03:51 < hyper_ch> Harley: different clients need different keys
03:51 < hyper_ch> keys/certs
03:51 < Harley> hyper_ch: it connects okay and the way the config is set up i was told it is not keeping track of single vs multiple tunnels
03:52 < Harley> hyper_ch: when the tun is up i can TraceRoute and it runs as expected but no web traffic
03:52 < hyper_ch> then you have wrong routes
03:52 < hyper_ch> !configs
03:52 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
03:52 < hyper_ch> !config
03:52 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
03:52 < hyper_ch> !logs
03:52 < hyper_ch> !log
03:52 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
03:52 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
03:55 < Harley> hyper_ch: thanks wil get the conf and post for comment -- appreciate the help
04:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:30 <@vpnHelper> RSS Update - forum: Tunnel Connections through VPN <http://forums.openvpn.net/topic9394.html#p18585>
04:36 -!- ewilded [~ewilded@n0life.pl] has joined #openvpn
05:09 < ewilded> Hello guys, I am having issue with the client to obtain the IP address, here are the details: http://pastie.org/3030735 , at least please tell me how to set it manually (inet + ptp option) to test connectivity.
05:35 -!- rave [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has joined #openvpn
05:36 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
05:37 < rave> dazo, my current setup was openvpn on ssh over stunnel.  I remember you said yesterday openvpn and stunnel only.  can you tell me how its done?
06:02 -!- rave [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has quit [Ping timeout: 258 seconds]
06:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
06:24 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
06:24 <@vpnHelper> RSS Update - forum: Redirect-Gateway for certain IP-range only <http://forums.openvpn.net/topic9410.html>
06:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
06:25 < Mowee> Hey
06:29 < hyper_ch> !port
06:29 < hyper_ch> !howto
06:29 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:31 < takamichi> hyper_ch: Did you have some time to review the routing table I pasted? I can't find anything wrong and I've read the docs carefully. Any clues would be greatly appreciated.
06:32 < hyper_ch> I can't read routing tables
06:34 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
06:34 -!- mode/#openvpn [+o cron2] by ChanServ
06:43 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 240 seconds]
06:44 -!- hyper_ch [~hyper_ch@adsl-84-227-167-252.adslplus.ch] has joined #openvpn
06:46 < hyper_ch> ecrist: are you there?
06:48 -!- hyper__ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has joined #openvpn
06:50 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 268 seconds]
06:55 -!- kbarry [~chatzilla@adsl-65-70-249-65.dsl.bumttx.swbell.net] has joined #openvpn
06:56 -!- hyper__ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has quit [Read error: Operation timed out]
06:56 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:56 -!- hyper_ch [~hyper_ch@adsl-84-227-167-252.adslplus.ch] has quit [Disconnected by services]
06:56 -!- hyper__ch is now known as hyper_ch
06:56 -!- hyper__ch [~hyper_ch@adsl-84-227-167-252.adslplus.ch] has joined #openvpn
06:56 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Disconnected by services]
06:57 -!- hyper__ch is now known as hyper_ch
06:57 -!- hyper_ch is now known as 16SAADZI4
06:57 -!- 18WAANQQM [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:57 -!- 16SAADZI4 [~hyper_ch@adsl-84-227-167-252.adslplus.ch] has quit [Remote host closed the connection]
07:02 -!- 18WAANQQM is now known as hyper_ch
07:16 -!- unixSnob [~unixSnob@cpe-98-28-11-38.columbus.res.rr.com] has joined #openvpn
07:16 < unixSnob> i'm having problems running openvpn over SSH (port forwarding).. has anyone tried this?  everything appears to initialize okay, but connections time out
07:22 < krzee> openvpn running on tcp, right?
07:25 -!- kbarry [~chatzilla@adsl-65-70-249-65.dsl.bumttx.swbell.net] has quit [Read error: Connection reset by peer]
07:26 -!- kbarry [~chatzilla@adsl-65-70-249-65.dsl.bumttx.swbell.net] has joined #openvpn
07:30 < unixSnob> krzee: yes
07:30 < unixSnob> krzee: i first got everything working with "proto udp" (naked openvpn, not over ssh)
07:31 < unixSnob> Then I changed proto
07:31 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
07:31 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
07:31 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
07:31 < krzee> just making sure, since ssh wont tunnel udp
07:31 < unixSnob> proto is "tcp-server" on the server, and "tcp-client" on the client
07:31 < krzee> if you are using --server you can just use proto tcp
07:31 < krzee> if you're using ptp you need those
07:32 < unixSnob> hmm.. not sure
07:32 < unixSnob> what does "--server" translate to in the conf file?
07:32 < krzee> !man
07:32 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
07:32 < unixSnob> ah, mode.. 
07:33 < ewilded> Hey, could you please look at this - http://pastie.org/3031227  ? It's some sort of IP configuration retrieving problem, I almost solved it.
07:33 < unixSnob> my mode is server.. so I should perhaps switch to plain tcp
07:33 -!- mete [~mete@84.200.4.144] has joined #openvpn
07:33 < krzee> shouldnt fix the problem tho
07:34 < krzee> oh whoa im wrong
07:34 < krzee> i guess ive never actually needed tcp
07:34 < krzee> looks like it is tcp-server and tcp-client
07:35 < krzee> hadnt read that part of the manual for a long time
07:35 < unixSnob> okay, i'll leave it as tcp-server/tcp-client
07:35 < krzee> ya you had it right, i was wrong that it could be different
07:36 < unixSnob> ultimately i just need to run openvpn through an ISP that blocks it
07:36 < krzee> have you checked how well they block it?
07:36 < krzee> like server on udp 53
07:37 < unixSnob> i did try putting the server on port 80
07:37 < unixSnob> what's 53?
07:37 < krzee> or on tcp 443 with --port-share
07:37 < krzee> udp 53 is dns
07:37 < krzee> they may be blocking ports, check how well they are scrubbing
07:38 < unixSnob> okay, but i would think port 80 would be sufficient.. I can use the web, and even https
07:38 < krzee> !learn port-share as When run in TCP server mode, share the OpenVPN port with another application, such as an HTTPS server. If OpenVPN senses a connection to its port which is using a non-OpenVPN protocol, it will proxy the connection to the server at host:port. Currently only designed to work with HTTP/HTTPS, though it would be theoretically possible to extend to other protocols such as ssh. Not implemented on Windows.
07:38 <@vpnHelper> Joo got it.
07:38 < krzee> but no
07:38 < krzee> port 443 is expected to be encrypted
07:39 < krzee> and then, with port-share a program or person who checks will see that the service is a secure website
07:39 < unixSnob> i don't think i need the port sharing.. there are no other services on the host.. I can hijack and repurpose any port
07:39 < unixSnob> i'll try 443
07:40 < krzee> if you can get around proxying over this ssh tunnel, you really really want to
07:40 < krzee> !tcp
07:40 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
07:40 < krzee> link #1 explains tcp over tcp
07:40 < krzee> with your setup with the tunnel, it would be tcp over tcp over tcp
07:40 < krzee> which is just a big pile of fuckup waiting to happen
07:41 < unixSnob> okay, thanks.  it is just a temporary need for a few weeks.. but I'll try different ports
07:42 < krzee> seems you can ssh, see if you could run openvpn on port 22 tcp if udp 53 didnt work
07:43 < unixSnob> i'm also thinking a pure SSH tunnel might work by itself.. but seems like lots of effort with openvpn already configured (with decent ISPs)
07:44 < unixSnob> i'll try ports 443 and 22
07:44 < krzee> did you try udp 53?
07:45 < unixSnob> if that doesn't work, then i'll perhaps have to try the pure SSH approach
07:45 < krzee> thats the best thing if you can
07:45 < unixSnob> no, i'll try that too
07:45 < krzee> you want udp
07:45 < unixSnob> okay, thanks.  
07:45 < krzee> try udp 5060 too
07:45 < krzee> thats the SIP port
07:45 < unixSnob> i could also do udp over 22, no?
07:47 < krzee> hell yes, any port it works on is great
07:47 < hyper_ch> port 22 is not suitable... isn't scp using 22 udp?
07:47 < krzee> hyper_ch, scp uses tcp 22 just like the sshd daemon it runs over :-p
07:47 < hyper_ch> hi krzee
07:48 < krzee> greetings!
07:48 < unixSnob> hyper_ch: i've moved ssh to a higher port number for security reasons, so i believe it's available 
07:48 < krzee> dont move ssh to a port over 1024
07:50 < unixSnob> krzee: why not?  i've been using it on 2xxx fine
07:50 < krzee> cause you dont need to be root to start a process on 1025+
07:50 < unixSnob> i figure the lower ports are more likely to be scanned
07:51 < unixSnob> thanks for the tip
07:51 < krzee> np
07:57 < unixSnob> krzee: with port udp 53, it gets blocked.  initialization works, but then I see a constant stream of this error (even when no data is sent) => read UDPv4 [EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH]: No route to host (code=113)
07:58 < krzee> !logs
07:58 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:01 < unixSnob> http://pastebin.com/0vSjRfXm
08:01 < krzee> hehe
08:01 < krzee> you need to update that
08:01 < krzee> Sat Dec 17 08:55:08 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:4: topology (2.0.9)
08:02 < krzee> thats breaking your connection
08:02 < krzee> !download
08:02 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html
08:03 < unixSnob> krzee: the version works, because i've used it with other ISPs.  That's just a warning, apparently
08:03 < krzee> no
08:03 < krzee> im not guessing
08:03 < krzee> update now
08:03 < krzee> lol
08:04 < unixSnob> i have two different client configs, both broken in the same way just after connecting to another ISP
08:04 < unixSnob> just 3 days ago, on another ISP, both VPNs worked
08:04 < unixSnob> in fact, it even worked on the new ISP, for *1* day
08:05 < krzee> ok well ill bbl
08:05 < krzee> go update
08:05 < unixSnob> then I think they discovered i was tunneling.. and next morning suddenly both VPNs fail
08:05 < krzee> prolly same day the server started using topology subnet
08:05 < krzee> bbl
08:05 < unixSnob> krzee: i don't have that option at the moment.. stuck with the latest version for my obsolete distro
08:06 < unixSnob> krzee: i control one of the servers
08:06 < krzee> then comment out topology subnet on it and restart the server
08:24 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Excess Flood]
08:25 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
08:26 -!- cali_ [~cali@91.220.163.18] has quit [Ping timeout: 252 seconds]
08:27 < unixSnob> krzee: i don't think it's possible to get rid of that error message.  The server did not specify a topology option at all.  The man page states that the server will push the topology setting to the client.  In this case, the client doesn't understand the topology setting at all (not even "topology net30")
08:28 < unixSnob> but as a test, i did add "topology net30" to the server, which makes no difference
08:29 < unixSnob> anyway, it's a red herring.  the old client has been demonstrated to worth with this server and another one.  The error just means that the client doesn't understand the option that the server is pushing
08:29 < unixSnob> s/worth/work/
08:31 <+EugeneKay> If you're running a version too old to understand --topology, update.
08:31 < unixSnob> it would be nice if the server could be told not to push that option, for the sake of clean logs
08:33 < unixSnob> EugeneKay: i don't update for the sake of updating.  I'm not someone who just needs to see a bigger version number.  Updating in my particular situation at the moment would be like rebuilding a whole car because a brake pad is bad -- would risk more harm than worthwhile
08:33 < unixSnob> the tools work.  They just need to be told how to circumvent an ISP block
08:34 <+EugeneKay> If you want to use a car analogy, you're driving a 1975 Pacer.
08:34 < unixSnob> if there was not a tsunami in Japan and a flood in Thailand, I would have updated by now
08:34 <+EugeneKay> It might drive fine, but, good god man.
08:35 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
08:35 <+EugeneKay> I, and most other people in here, will not support a version that old because we don't know it. It's old.
08:36 < unixSnob> EugeneKay: i understand that.. but i'm trapped, and at the mercy of my situation
08:36 <+EugeneKay> Sorry, don't know what else to tell you.
08:43 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:59 -!- kbarry [~chatzilla@adsl-65-70-249-65.dsl.bumttx.swbell.net] has quit [Remote host closed the connection]
09:13 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
09:16 <@ecrist> hyper_ch: I am now
09:17 < hyper_ch> ecrist: too late, I forgot
09:17 <@ecrist> *shrug*
09:26 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Read error: Connection reset by peer]
09:27 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 252 seconds]
09:28 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
09:37 < JodaZ> openssl pkcs12 -export -in client1.crt -inkey client1.key -out client1.p12
09:37 < JodaZ> will this be usable on the clients ?
09:40 < ibins> You might add the CA certificate.
09:41 < JodaZ> with -CAfile or -CAkey ?
09:41 < ibins> -CAfile You NEVER EVER distribute the CA key!!!
09:42 < ibins> And it's called -CA cacert.crt instead of -CAfile
09:43 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
09:43 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
09:43 < JodaZ> -CA doesn't work, ibins
09:44 < ibins> Is the file in pem format?
09:44 < JodaZ> i dunno, its having base64  with ---- delimiters in it
09:44 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 240 seconds]
09:45 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:45 < JodaZ> but it doesn't accept -CA it shows me the list of possible parameters if i try
09:45 < JodaZ> it has -CAkey and -CAfile in there
09:45 < ibins> OK, then it should already be pem.
09:45 < ibins> Try CAfile then :-)
09:45 < ibins> my openssl doesn't show me any -CAfile, but a -CA
09:47 < ibins> Oh, sorry! My fault. I typed "openssl x509" instead of "openssl pkcs12"
09:49 < JodaZ> Sat Dec 17 16:47:54 2011 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@myhost.mydomain
09:49 < JodaZ> Sat Dec 17 16:47:54 2011 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
09:49 < JodaZ> Sat Dec 17 16:47:54 2011 TLS Error: TLS object -> incoming plaintext read error
09:51 < JodaZ> any idea, ibins ?
09:52 < ibins> give me a little moment, please. This time I want to do it before posting another stupid text :-)
09:55 < ibins> -chain is necessary
09:55 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18587>
09:55 < ibins> openssl pkcs12 -export -in client1.crt -inkey client1.key -CAfile ca.crt -chain -out client1.p12
09:58 < ibins> Skip password with enter twice, when you do not want to encrypt the p12 file
09:59 < JodaZ> yup, can connect now
09:59 < JodaZ> i used to nat thru the box with the openvpn on it
10:00 < JodaZ> using
10:00 < JodaZ> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
10:00 < JodaZ> echo 1 > /proc/sys/net/ipv4/ip_forward
10:00 < JodaZ> what do i need to set in the server.conf for that to work ?
10:01 < ibins> Is 10.8.0.0/24 the pool of the VPN IP addresses?
10:01 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 252 seconds]
10:02 < JodaZ> i dunno, i used the default config
10:03 < ibins> If this is the case: You must not masquerade these pakets, but the pakets leaving eth0. 
10:03 < JodaZ> well, i do
10:03 < ibins> Remove the "-s 10.8.0.0/24" and try again 
10:04 < JodaZ> *_*
10:04 < ibins> You want to masquerade the VPN packets, not the packets, that become enwrapped within the VPN packets :-)
10:05 < JodaZ> doesn't work
10:05 < JodaZ> it used to work with that "-s 10.8.0.0/24"
10:06 < JodaZ> how do i set the pool of vpn addresses to 10.8.0.0/24 ?
10:07 < ibins> Back to a previous question: What are your addresses in your servers config line with "server IP Netmask"?
10:08 < JodaZ> server 10.8.0.0 255.255.255.0
10:08 < ibins> Did you remove the previous iptables rules from nat chain?
10:09 < ibins> iptables -t nat -F POSTROUTING
10:10 < JodaZ> now it seems to work (dns doesn't so i don't know if i am really going thru the vpn)
10:11 <@vpnHelper> RSS Update - forum: Advice on openvpn deployment <http://forums.openvpn.net/topic9411.html>
10:11 < JodaZ> ibins, but it worked with the -s before, why wouldn't it work anymore ?
10:12 < ibins> Maybe I do not understand your setup.
10:13 < ibins> You can watch "ifconfig" at the RX and TX packets of the tun device
10:13 < ibins> Then you know, if you use the tunnel or not
10:14 < JodaZ> ah, it works with the -s before
10:14 < JodaZ> i think it was just a dns problem
10:14 < JodaZ> had to set dhcp dns
10:15 < JodaZ> push "dhcp-option DNS 8.8.8.8"
10:16 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has joined #openvpn
10:20 < JodaZ> thanks, ibins
10:21 < ibins> you are welcome, even if I do not understand your setup :-)
10:22 < JodaZ> its a dedicated server which i just openvpn in and then forward to the internet
10:22 < JodaZ> its a glorified proxy more or less
10:33 -!- rave [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has joined #openvpn
10:34 < rave> dazo could you help me to setup stunnel to use with openvpn
10:38 < pwrcycle> rave: why would you want openvpn+stunnel.  vpn is an encrypted tunnel already.
10:39 < pwrcycle> rave: but if you wanted to, i think in iptables you would route the tun0 to the stunnel ip instead of eth0.
10:40 < rave> pwrcycle, i would like to do openvpn on stunnel to wrap vpn traffic on ssl
10:40 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
10:41 < pwrcycle> rave: vpn is already ssl though? what is the benefit?
10:41 < rave> I have create the stunnel config and started the stunnel server and client but I dont know how to use in openvpn client the stunnel client
10:41 < pwrcycle> rave: but in that case, i think you'd establish the stunnel, then point your vpnclient to the stunnel IP to create the connection.
10:41 < pwrcycle> rave: i don't think that's a good idea.
10:42 < rave> how to point the vpnclient to the stunnel ip that is my current problem
10:42 < pwrcycle> openvpn is already an ssl tunnel, you're not gaining any extra security, and you'll bound to cause more latency.
10:43 < rave> pwrcycle, dazo and I talked about this yesterday but what I did was vpn on ssh over stunnel(ssl)
10:43 < rave> I am removing the ssh now in the equation
10:43 < rave> how to point the vpnclient to the stunnel ip that is my current problem that i want to achieve 
10:45 < pwrcycle> rave: mind if i ask why?
10:45 < pwrcycle> rave: i usuually do ssh over vpn, not the other way around.
10:46 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
10:50 -!- rave [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has quit [Ping timeout: 258 seconds]
11:01 <@vpnHelper> RSS Update - forum: user-auth-verify Win7 write error <http://forums.openvpn.net/topic9412.html> || RDP connection problems and mtu-test <http://forums.openvpn.net/topic9401.html#p18589>
11:13 <@ecrist> pwrcycle: you're best off ignoring him
11:13 -!- unixSnob [~unixSnob@cpe-98-28-11-38.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
11:28 -!- ewilded [~ewilded@n0life.pl] has left #openvpn []
11:38 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 240 seconds]
11:58 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
12:05 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
12:10 -!- unixSnob [~unixSnob@cpe-98-28-11-38.columbus.res.rr.com] has joined #openvpn
12:33 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
12:56 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Excess Flood]
12:56 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:23 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Excess Flood]
13:23 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:37 -!- Harley [~Harley@182.149.54.213] has quit [Remote host closed the connection]
13:38 -!- Harley [~Harley@182.149.54.213] has joined #openvpn
13:43 -!- Harley [~Harley@182.149.54.213] has quit [Ping timeout: 276 seconds]
13:43 <@vpnHelper> RSS Update - forum: OpenVPN Config for Client <http://forums.openvpn.net/topic9413.html>
13:53 -!- Harley [~Harley@182.149.54.213] has joined #openvpn
14:00 -!- zzattack [f@163-68-ftth.onsneteindhoven.nl] has joined #openvpn
14:01 < zzattack> i can no longer connect my clients to my server, get clients show something like Local Options hash (VER=V4): '2c50bd2c', Expected Remote Options hash (VER=V4): '0ddbb6e3'
14:01 < zzattack> the server shows the same with the hashes swapped
14:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:18 -!- totorux [~quassel@gar13-2-82-239-234-199.fbx.proxad.net] has joined #openvpn
14:19 -!- totorux [~quassel@gar13-2-82-239-234-199.fbx.proxad.net] has quit [Remote host closed the connection]
14:28 < krzee> zalzice, 
14:28 < krzee> !logs
14:28 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
14:29 < krzee> unixSnob, you need to update, your version of openvpn is VERY old, if you dont like our answers feel free to try somewhere else so they can tell you the same thing
14:43 -!- unixSnob [~unixSnob@cpe-98-28-11-38.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
15:20 -!- mirco [~mirco@p5B283182.dip.t-dialin.net] has joined #openvpn
15:22 <+EugeneKay> You would think a unix snob would know that old software is deprecated because it has issues which have been fixed by recent versions
15:22 <+EugeneKay> Especially in security-related software.
15:34 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
15:40 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Excess Flood]
15:41 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:42 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Excess Flood]
15:42 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:47 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
15:49 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Excess Flood]
15:49 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
16:53 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
16:53 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has joined #openvpn
17:00 -!- radioxid [~radioxid@nlr28-1-78-237-60-197.fbx.proxad.net] has quit [Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/]
17:02 -!- treund [~treund@97.75.177.42] has joined #openvpn
17:17 < pwrcycle> hi all
17:17 < pwrcycle> ww
17:24 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Excess Flood]
17:25 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
17:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:59 -!- treund_ [~treund@97.75.177.42] has joined #openvpn
17:59 -!- treund [~treund@97.75.177.42] has quit [Quit: Reconnecting]
18:06 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
18:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
18:25 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
18:25 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
18:25 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:25 -!- mode/#openvpn [+v Axeman] by ChanServ
18:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:41 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
18:43 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Excess Flood]
18:43 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
19:07 -!- Harley [~Harley@182.149.54.213] has quit [Remote host closed the connection]
19:08 -!- Harley [~Harley@182.149.54.213] has joined #openvpn
19:36 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
19:39 -!- rave [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has joined #openvpn
19:48 -!- mirco [~mirco@p5B283182.dip.t-dialin.net] has quit [Quit: mirco]
19:50 -!- _julian_ [~quassel@hmbg-5f765e09.pool.mediaWays.net] has joined #openvpn
19:51 < rave> OPENVPN APPEAL --- >>>    http://pastebin.com/Yudxk02b
19:52 -!- rave [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has quit [Quit: Page closed]
19:53 -!- _julian [~quassel@hmbg-4d06e2ec.pool.mediaWays.net] has quit [Ping timeout: 245 seconds]
19:59 < Olipro> Letter from an idiot
20:02 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 240 seconds]
20:03 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 252 seconds]
20:06 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
20:06 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
20:06 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:06 -!- mode/#openvpn [+v Axeman] by ChanServ
20:06 <@ecrist> he's been on that bandwagon for a long time
20:07 <@ecrist> and, honestly, it's not the worst suggestion out there.
20:20 -!- master_of_master [~master_of@p57B54E36.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:20 -!- zzattack [f@163-68-ftth.onsneteindhoven.nl] has quit [Remote host closed the connection]
20:23 -!- master_of_master [~master_of@p57B55086.dip.t-dialin.net] has joined #openvpn
20:30 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has joined #openvpn
20:34 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
20:41 -!- leroux [~leroux_@108-79-20-223.lightspeed.hstntx.sbcglobal.net] has joined #openvpn
20:43 -!- leroux [~leroux_@108-79-20-223.lightspeed.hstntx.sbcglobal.net] has quit [Read error: Connection reset by peer]
20:44 -!- leroux [~leroux_@108-79-20-223.lightspeed.hstntx.sbcglobal.net] has joined #openvpn
20:44 < leroux> Hello. I have my openvpn server and client setup. I can ping the local peers but not any external sites.
20:44 < leroux> !pastebin
20:44 < leroux> 0.o
20:44 < leroux> Oh, I guess it's not a cmd.
20:44 <@vpnHelper> Unable to download feed.
20:45 < leroux> Anyways.
20:45 < leroux> Any reason ping won't work to other sites?
20:45 < leroux> I tried disabling my firewalls as well.
20:45 < leroux> And that didn't work...
20:48 -!- treund_ [~treund@97.75.177.42] has left #openvpn []
20:50 -!- leroux [~leroux_@108-79-20-223.lightspeed.hstntx.sbcglobal.net] has quit [Quit: Leaving]
21:01 < zalzice> krzee: i think you meant: zzattack and not zalzice:-)
21:02 <+EugeneKay> !paste
21:02 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
21:16 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has joined #openvpn
21:23 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
21:26 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
21:33 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has joined #openvpn
22:04 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
22:05 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has joined #openvpn
22:09 -!- Denial [Denial@drgi.co.uk] has quit []
22:11 -!- mgorbach [~mgorbach@c-67-164-72-249.hsd1.ca.comcast.net] has joined #openvpn
22:21 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
22:24 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
22:24 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
22:24 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
22:30 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:33 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has quit [Ping timeout: 244 seconds]
22:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
22:35 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has joined #openvpn
22:45 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
22:56 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
23:56 -!- Harley [~Harley@182.149.54.213] has quit [Remote host closed the connection]
23:57 -!- Splex [~splex@unaffiliated/splex] has joined #openvpn
--- Day changed Sun Dec 18 2011
00:06 < Splex> on linux openvpn 2.2.1, i have --writepid /var/run/openvpn/openvpn.pid  if /var/run/ is missing the openvpn directory, openvpn will not start.   once i create the dir, openvpn starts fine.  Is this behavior intended?
00:09 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
00:25 < krzee> Splex, if it cant write the pid it shouldnt start
00:25 < krzee> if you are defining a pid you likely have a reason you need it
00:25 < krzee> so it should stop you, and make you fix the problem
00:38 < Splex> cd /
00:38 < Splex> oops
00:39 < Splex> krzee: i am using a script to start openvpn, so.. the script should create the directories?
00:47 < krzee> once the dir is made, it is there
00:48 < krzee> or, use a dir that already exists in your os
00:49 < krzee> not sure why the script would need to do it
01:10 -!- mgorbach [~mgorbach@c-67-164-72-249.hsd1.ca.comcast.net] has quit [Quit: Leaving...]
01:31 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
02:02 <@vpnHelper> RSS Update - forum: OpenVPN Config for Client <http://forums.openvpn.net/topic9413.html#p18593> || Does OpenVPN Provide Perfect Forward Secrecy? <http://forums.openvpn.net/topic9408.html#p18592>
02:13 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
02:14 -!- caesay [~caesay@socialshock.net] has joined #openvpn
02:14 <@vpnHelper> RSS Update - forum: Redirect-Gateway for certain IP-range only <http://forums.openvpn.net/topic9410.html#p18594>
02:14 -!- caesay is now known as Guest25224
02:15 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has joined #openvpn
02:16 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 240 seconds]
02:16 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
02:16 -!- Guest84799 [~caesay@socialshock.net] has quit [Ping timeout: 240 seconds]
02:16 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 240 seconds]
02:17 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:36 < hyper_ch> hmmm, I still don't get good speeds.... when I use 1191 TCP I crawl at max download to me home... when I use some UDP part, it crawls at 400KB/s... about a third of what I should get
02:39 < hyper_ch> when I use 1191 TCP I get speeds of 1.2 MB dl to me
02:44 <@vpnHelper> RSS Update - forum: user-auth-verify Win7 write error <http://forums.openvpn.net/topic9412.html#p18595>
02:56 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18596>
02:57 < Splex> hyper_ch: perhaps ISP issue such as packet shaping?
02:57 < hyper_ch> Splex: the problem is my home connection to the vpn server
02:57 < hyper_ch> when I use 1191 tcp it works at great speed
02:57 < hyper_ch> but the rest of the vpn suffers
02:58 < hyper_ch> when I use xxx UDP the rest of the vpn works great but my home connection to it suffers
02:58 < hyper_ch> my isp isn't traffic shaping I think
02:59 < Splex> what do you mean 'the rest of the vpn suffers'?
02:59 < hyper_ch> Splex: well, I have various machiens and servers vpned
03:00 < hyper_ch> when I use 1191 UDP they get transfer speeds of 9-10 MB/s
03:00 < hyper_ch> when I use 1191 TCP it drops to about 3-4 MB/s
03:00 < hyper_ch> on my home connection, I have 15mbit download, when I use 1191 UDP I only get about 400KB/s download speed
03:01 < hyper_ch> when I use TCP I get about 1.2 MB/s download speed
03:01 < Splex> id suspect your isp is dropping some udp packets
03:02 < hyper_ch> how to find that out?
03:02 <@vpnHelper> RSS Update - forum: RDP connection problems and mtu-test <http://forums.openvpn.net/topic9401.html#p18597>
03:10 < Splex> hyper_ch: maybe you could try using hping: http://www.hping.org/
03:10 <@vpnHelper> Title: Hping - Active Network Security Tool (at www.hping.org)
03:13 < hyper_ch> what is that?
03:14 < Splex> hyper_ch: advanced ping tool.  you can ping with packets other than ICMP.. such as UDP packets, etc.. 
03:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
03:15 < hyper_ch> apt hping3
03:19 < hyper_ch> Splex: how to use it?
03:22 < hyper_ch> another option would be to run two openvpn servers... on on tcp and on upd
03:22 < hyper_ch> but how would I connect the two networks
03:25 < Splex> hyper_ch: are you running in tap or tun mode?
03:25 < hyper_ch> tun
03:25 < Splex> then, you would need to enable forwarding and adjust the routing table to route the packets from one tun interface to another
03:26 < hyper_ch> you say this so easily :)
03:26 < Splex> ;)
03:26 < hyper_ch> ipv4 forwarding is already enabled
03:26 < Splex> hyper_ch: i mean, iptables
03:26 < Splex> as well as ipv4 forwarding
03:26 < hyper_ch> but they can't be on the same network, right?
03:26 < Splex> hyper_ch: what do you mean?
03:27 < hyper_ch> both servers using 10.8.0.x
03:28 < Splex> you would need to have different subnets... for routing purposes
03:29 < hyper_ch> iptables is complicated... I'm already happy that I worked out normal port fowarding on it :)
03:31 < Splex> hyper_ch: what i mean with iptables, is basically just 'iptables -A FORWARD -i tun+ -j ACCEPT'
03:31 < hyper_ch> tun+?
03:31 < Splex> and any other interfaces you want to foward
03:31 < Splex> tun+ matches all tun interfaces
03:31 < hyper_ch> and then still routing required
03:31 < Splex> right
03:32 < hyper_ch> this is getting too complicated
03:32 < hyper_ch> becuase also ccd entries must be adjust and so on
03:32 < hyper_ch> :(
03:34 < Splex> well, im thinking... the other clients won't need to know..  its just a matter of adding an extra route on your server
03:35 < Splex> for the tun device of the tcp openvpn
03:38 < hyper_ch> question is also how to start a second instance
03:38 < Splex> ?
03:38 < hyper_ch> how to start a second server :)
03:38 < Splex> just.. start it?
03:39 < hyper_ch> and how to tell it to use a different config
03:39 < hyper_ch> with an init script
03:40 < Splex> how do you start it now?
03:40 < hyper_ch> init script
03:40 < Splex> what distro?
03:40 < hyper_ch> debian
03:40 < Splex> if the init script is anything like the one in archlinux, then it will load all /etc/openvpn/*.conf
03:47 < hyper_ch> ok, tun0 and 1 are running
03:47 < hyper_ch> added that iptable rule you told me
03:47 < hyper_ch> still need to get the routing done I guess
03:47 < hyper_ch> !brdige
03:48 < hyper_ch> !bridge
03:48 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
03:48 < hyper_ch> !routing
03:48 < hyper_ch> !route
03:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
03:50 -!- `Ile` [~kvirc@79-101-215-83.dynamic.isp.telekom.rs] has joined #openvpn
03:50 -!- `Ile` [~kvirc@79-101-215-83.dynamic.isp.telekom.rs] has quit [Client Quit]
04:03 -!- phantomcircuit [~phantomci@bitcoinica.intersango.com] has joined #openvpn
04:03 < phantomcircuit> !welcome
04:03 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:03 < phantomcircuit> !goal
04:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:03 < phantomcircuit> !route
04:03 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
04:08 < phantomcircuit> ok cant figure this out
04:09 -!- _julian_ [~quassel@hmbg-5f765e09.pool.mediaWays.net] has quit [Read error: Operation timed out]
04:10 < phantomcircuit> I have a server with a public ip and a vm with a private ip (10.1.238.88/16) I'm trying to access the vm's private from a client but cant
04:10 < phantomcircuit> https://privatepaste.com/download/c4a35de084
04:10 < phantomcircuit> thoughts?
04:24 < Splex> phantomcircuit: ip forwarding/iptables/routing issue
04:24 < phantomcircuit> i just realized that and looked at iptables rules
04:24 < phantomcircuit> https://privatepaste.com/54d49a6b3a
04:24 < phantomcircuit> that seems weird to me
04:28 <@vpnHelper> RSS Update - forum: Revoke trable "ca: not found" <http://forums.openvpn.net/topic9414.html>
04:29 -!- _julian [~quassel@hmbg-4d06a730.pool.mediaWays.net] has joined #openvpn
04:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:49 -!- ]R[ [Gonzo@2a01:e35:2ef2:d850:e350:e350:e350:e350] has quit [Read error: Connection reset by peer]
04:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
04:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:52 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:02 -!- ]R[ [Gonzo@hunting.bin-laden.biz] has joined #openvpn
05:02 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
05:04 < takamichi> Hey, what could cause a connection-reset 8 seconds after a successful TCP connection? Surely if the connection suceeds, then there can't be anything blocking the connection? Check the log, around line 52 - http://pastebin.com/JCMHS4tJ
05:17 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Ping timeout: 240 seconds]
05:22 <@vpnHelper> RSS Update - forum: Openvpn on Netgear DGN2200 with modfs <http://forums.openvpn.net/topic9415.html>
05:34 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
05:39 -!- hyper__ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has joined #openvpn
05:39 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Disconnected by services]
05:39 -!- hyper__ch is now known as hyper_ch
05:39 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
05:39 -!- hyper_ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has left #openvpn []
05:55 -!- hyper__ch is now known as hyper_ch
05:55 -!- hyper__ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has joined #openvpn
05:55 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Disconnected by services]
05:55 -!- hyper__ch is now known as hyper_ch
05:55 -!- hyper_ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has quit [Remote host closed the connection]
06:02 -!- hyper_ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has joined #openvpn
06:03 -!- hyper_ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has left #openvpn []
06:04 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:05 -!- mirco [~mirco@p5B2833C4.dip.t-dialin.net] has joined #openvpn
06:11 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:12 -!- hyper_ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has joined #openvpn
06:15 -!- hyper_ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has left #openvpn []
06:26 < hyper__ch> hi ecrist
06:26 <@vpnHelper> RSS Update - forum: Redirect-Gateway for certain IP-range only <http://forums.openvpn.net/topic9410.html#p18600>
06:32 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 240 seconds]
06:37 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:37 -!- hyper__ch is now known as hyper_ch
06:37 -!- hyper__ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has joined #openvpn
06:37 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Disconnected by services]
06:38 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:39 -!- hyper__ch [~hyper_ch@adsl-84-227-4-216.adslplus.ch] has left #openvpn []
06:49 -!- rave [~rave@184.22.182.246] has joined #openvpn
06:50 < rave> guys, I am doing this iptable iptables -t nat -A PREROUTING -p udp --dport 1:65535 -j DNAT --to-destination serverip:1194. does this mean that if I put in my client config remote serverip:444 I can still connect to server?
06:58 < rawplayer> wtf lol
06:58 < rawplayer> this means that you forward every port to your vpn end point
07:00 < rave> just an example. that what I want to know if that is right
07:04 -!- rave [~rave@184.22.182.246] has quit [Ping timeout: 248 seconds]
07:08 -!- Danskmand [~Danskmand@dslb-178-004-187-214.pools.arcor-ip.net] has joined #openvpn
07:16 -!- BaNzoun3t [Alex@235.75-65-87.adsl-dyn.isp.belgacom.be] has joined #openvpn
07:16 < BaNzoun3t> hi
07:18 < BaNzoun3t> I've trouble to connect my virtual machine to my vpn, i get that error "UDPv4 [ECONNREFUSED]: Connection refused (code=111)
07:18 < BaNzoun3t> may you help me?
07:18 < BaNzoun3t> my client.conf works on my windows system
07:19 < BaNzoun3t> but when i try on virtual machine (xubuntu) it doesn't work :(
07:21 < BaNzoun3t> so!
07:23 < BaNzoun3t> !goal
07:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:24 < Danskmand> Howdy :-) - I got a rooted Galaxy S2 that I have installed openvpn on. Worked lovely connecting to my Server through UMTS....Until today, when I connect, I get a "giving SU-rights to openvpn" and nothing happens. When I connect again, I am prompted for my password, but half in typing, I get a "unable to read private key from management console2
07:24 <@vpnHelper> RSS Update - forum: Openvpn on Netgear DGN2200 with modfs <http://forums.openvpn.net/topic9415.html#p18601>
07:24 < Danskmand> Wait a minute ! - Now it worked !!!
07:25 < Danskmand> But still, what can I do to prevent this ?
07:27 < Danskmand> Plus, I get a connect, but it keeps disconnecting/reconnecting successfully...
07:27 < BaNzoun3t> i looked over internet but it didn't help
07:55 -!- rave [~rave@184.22.182.246] has joined #openvpn
07:56 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has joined #openvpn
07:57 -!- gffa [~gffa@5249FBAA.cm-4-2d.dynamic.ziggo.nl] has quit [Changing host]
07:57 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
08:04 -!- rave [~rave@184.22.182.246] has quit [Ping timeout: 252 seconds]
08:05 <@ecrist> sup hyper_ch 
08:08 -!- BaNzoun3t [Alex@235.75-65-87.adsl-dyn.isp.belgacom.be] has quit [Ping timeout: 240 seconds]
08:09 -!- BaNzoun3t [Alex@86.144-242-81.adsl-dyn.isp.belgacom.be] has joined #openvpn
08:10 < hyper_ch> ecrist: ha, I was already helped :)
08:10 < hyper_ch> had some routing push issues
08:14 < BaNzoun3t> nobody can help me? :(
08:16 < hyper_ch> !config
08:16 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
08:16 < hyper_ch> !log
08:16 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
08:16 < hyper_ch> !configs
08:16 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
08:16 < hyper_ch> !logs
08:16 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:16 < hyper_ch> BaNzoun3t: read above
08:19 <@vpnHelper> RSS Update - forum: Openvpn on Netgear DGN2200 with modfs <http://forums.openvpn.net/topic9415.html#p18602>
08:24 < BaNzoun3t> www.paste.maxux.net/166524231
08:24 < BaNzoun3t> my log
08:25 < hyper_ch> configs still missing
08:25 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has quit [Read error: No route to host]
08:25 < hyper_ch> can you even ping between the host and guest?
08:25 < BaNzoun3t> yes
08:26 -!- Magix [~magix@52494D2A.cm-4-2b.dynamic.ziggo.nl] has joined #openvpn
08:26 < Magix> !welcome
08:26 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:26 < Magix> !goal
08:26 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:27 < Magix> Hello
08:28 < BaNzoun3t> http://paste.maxux.net/166624231
08:28 < BaNzoun3t> the client conf
08:28 < BaNzoun3t> The server is not the problem my friends can connect to it
08:28 < BaNzoun3t> i can either with windows
08:34 -!- pwrcycle_ is now known as pwrcycle
08:35 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
08:35 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
08:50 < Magix> I would like to access the internet over my vpn
08:50 < Magix> is that possible?
08:50 <@ecrist> yes
08:50 <@ecrist> !def1
08:50 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
08:51 -!- catsup [~d@ps38852.dreamhost.com] has quit [Quit: Lost terminal]
08:51 < hyper_ch> and also
08:51 < hyper_ch> !ipforward
08:51 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
08:51 < Magix> is there a setup log for Debian?
08:52 < Magix> http://www.monkeedev.co.uk/blog/2009/03/06/setting-up-openvpn-in-debianubuntu/
08:52 <@ecrist> a what?
08:52 <@vpnHelper> Title: Setting up OpenVPN in debian/ubuntu « A Million Monkeys (at www.monkeedev.co.uk)
08:52 < Magix> would this help
08:52 < Magix> guide*
08:52 <@ecrist> we don't read/debug howtos on other sites, sorry
08:52 <@ecrist> !wiki
08:52 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
08:52 < hyper_ch> !howto
08:52 < Magix> is there a setup guide?
08:52 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:52 < hyper_ch> Magix: apt-get install openvpn
08:52 < Magix> Okay
08:52 < hyper_ch> set configs
08:52 < hyper_ch> generate keys
08:52 < hyper_ch> restart server and client
08:53 < Magix> its now installing the packages
08:53 < Magix> Restarting virtual private network daemon.:.
08:53 < Magix> insserv: warning: script 'K01nova-agent' missing LSB tags and overrides
08:53 < Magix> insserv: warning: script 'nova-agent' missing LSB tags and overrides
08:53 < Magix> now
08:53 < Magix> what command is for me to do next
08:53 < Magix> I am completely new to VPN
08:53 < Magix> I know what it is
08:54 < Magix> etc
08:54 < hyper_ch> Magix: on the server, setup a CA
08:54 < Magix> but I have never setupped a server
08:54 < hyper_ch> !howto
08:54 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:54 < hyper_ch> check the CA part in there
08:55 < Magix> in what folder do I have to be?
08:55 < Magix> mkdir /etc/openvpn/easy-rsa
08:55 < Magix> cp /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa
08:55 < Magix> hm?
08:56 < hyper_ch> Magix: doesn't matter
08:56 < hyper_ch> it's using absolute paths
08:56 < hyper_ch> so whatever folder you're currently in has no effect on the commands
08:57 < Magix> cd /etc/openvpn/easy-rsa
08:57 < Magix> source ./vars
08:57 < Magix> ./clean-all
08:57 < Magix> ./build-ca
08:57 < Magix> I did that now
08:57 < krzee> anyone here ever used dnsd on busybox?
08:57 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has joined #openvpn
08:57 < hyper_ch> Magix: now you need to create keys
08:57 < hyper_ch> read on in the howto
08:57 <@ecrist> does this look like #krzees-awesome-personal-support-channel krzee?
08:57 < krzee> !pki
08:57 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
08:57 <@vpnHelper> specially as a server (see !servercert)
08:57 < krzee> ecrist, yes, isnt it?
08:58 <@ecrist> :D
08:58 < krzee> ;]
08:58 < hyper_ch> isn't krzee the secret overlord of this channel?
08:58  * hyper_ch bows before the almighty krzee
08:58 < Magix> root@samantha:/etc/openvpn/easy-rsa# ./build-dh
08:58 < Magix> Generating DH parameters, 1024 bit long safe prime, generator 2
08:58 < Magix> This is going to take a long time
08:58 < Magix> :)
08:58 <+EugeneKay> !paste
08:58 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
08:59 < hyper_ch> EugeneKay: he only pasted 2 lines :)
08:59 < krzee> sup EugeneKay 
08:59 <+EugeneKay> hyper_ch - did it ever occur to youthat I wanted the link for mysefl?
08:59 < hyper_ch> EugeneKay: know.... :)
08:59 <+EugeneKay> krzee -  lounging in bed, dreading getting out of it today
08:59 < hyper_ch> s/know/no/
09:00 < hyper_ch> krzee: EugeneKay: ecrist:  http://images.sjau.ch/img/a3834a68.jpg
09:00 < hyper_ch> krzee: EugeneKay: ecrist:  http://images.sjau.ch/img/13f03f26.jpg
09:01 < krzee> cats are like children, everyone thinks theirs are cute
09:01 <@ecrist> why the fuck are you linking pictures of your cats?
09:01 <@ecrist> nobody cares
09:01 <+EugeneKay> I care. <3 cats
09:02 <@ecrist> *nobody*
09:02 < krzee> lol
09:02  * krzee points out his hostmask
09:02 < krzee> [krzee] (nobody@openvpn/community/support/krzee): k
09:02 < krzee> nobody!
09:02 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
09:02 <@ecrist> lol
09:02 < krzee> but tbh, i didnt care either
09:03 < krzee> not even nobody cares!
09:03 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has left #openvpn []
09:03 < hyper_ch> ecrist: everybody <3 cats
09:03 < Magix> Starting virtual private network daemon: server failed!
09:03 <@ecrist> I hate cats
09:03 <@ecrist> I really really do
09:03 < krzee> Magix, start openvpn the openvpn way. instead of your OS's init script
09:03 <@ecrist> Magix: you should fix that
09:03 < hyper_ch> you just haven't met the right furball yet
09:03 <+EugeneKay> They're fun, until they try to kill you in your sleep.
09:03 < krzee> just start it from the cli
09:04 < Magix> http://pastebin.com/Affguwc0
09:04 < Magix> thats my configuration
09:04 < krzee> !logfile
09:04 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
09:04 < krzee> !logs
09:04 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:04 -!- S1lv3R [~Ben@178-83-34-83.dynamic.hispeed.ch] has quit [Ping timeout: 268 seconds]
09:04 < krzee> push .route
09:04 < krzee> no
09:04 < Magix> /var/log/openvpn-status.log
09:04 < Magix> that one is empty
09:04 < krzee> i didnt ask for that one
09:05 < krzee> did !logfile say to use --status?
09:05 < Magix> no
09:05 < Magix> !man --log
09:05 < krzee> !man
09:05 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
09:05 < krzee> why are you bridging?
09:06 < krzee> why are you using tcp?
09:06 < krzee> you cannot push .route, but you can push route
09:06 < Magix> okay
09:06 < Magix> I just totally folowed this: http://www.monkeedev.co.uk/blog/2009/03/06/setting-up-openvpn-in-debianubuntu/
09:06 <@vpnHelper> Title: Setting up OpenVPN in debian/ubuntu « A Million Monkeys (at www.monkeedev.co.uk)
09:06 < krzee> !goal
09:06 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:06 < Magix> I would like to access the internet over my vpn
09:06 < krzee> lets start over
09:06 <+EugeneKay> Do not follow blog posts. They are wrong, they are old, they are written by fools.
09:07 <+EugeneKay> (that could be set as !blog with the bot)
09:07 < krzee> !confgen
09:07 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
09:07 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:07 < krzee> !learn blog as Do not follow blog posts. They are wrong, they are old, they are written by fools.
09:07 <@vpnHelper> Joo got it.
09:07 < krzee> !forget blog
09:07 <@vpnHelper> Joo got it.
09:07 < krzee> !learn blog as Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools.
09:07 < hyper_ch> EugeneKay: now that you mention it, I should update my blog post :)
09:07 <@vpnHelper> Joo got it.
09:07 <@ecrist> !forget blog
09:07 <@vpnHelper> Joo got it.
09:08 < hyper_ch> !lear blog as test
09:08 < hyper_ch> !learn blog as test
09:08 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:08 < Magix> root@samantha:~/openvpn-confgen# sh confgen.sh
09:08 < Magix> confgen.sh: 22: shopt: not found
09:08 <+EugeneKay> hyper_ch - what you should do is make a wiki entry so other people can update it when they find your wrongness
09:08 <@ecrist> !learn blog as Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
09:08 <@vpnHelper> Joo got it.
09:08 < krzee> i hate when people why did you sh?
09:08 < krzee> lol
09:08 < krzee> why did you sh?
09:08 < hyper_ch> EugeneKay: wikis are beyond my capabilities :(
09:08 < Magix> wops
09:08 < Magix> :$
09:10 < krzee> Magix, after this you get to learn dnsd so you can find why it wont work for me =]
09:10 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 248 seconds]
09:10 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
09:11 < Magix> if my goal is with the acess the internet over the vpn
09:11 < Magix> should I use
09:11 < Magix> Will the server share its LAN with the VPN?
09:11 < Magix> Default: no
09:11 < Magix> (y/n)
09:11 < krzee> n
09:11 < Magix> Do you want clients to send all their internet traffic through the server?
09:11 < Magix> Default: no
09:11 < Magix> (y/n)
09:11 < krzee> if your goal was sharing your server lan over the vpn, that would be yes
09:11 < Magix> I wish to use internet over the VPN :)
09:11 < krzee> dude, if you need help answering those questions, you are beyond my help
09:12 < Magix> can't you just provide me the answer
09:12 < Magix> its the first time I did this
09:12 < krzee> not without you providing it
09:12 < krzee> do you want your client to send internet traffic over the server?
09:13 < krzee> can i get a troll-vote?
09:13 < hyper_ch> krzee: I think he wants def1
09:13 < krzee> no shit hyper_ch 
09:13 < krzee> but how can he say:
09:13 < krzee> [11:11]  <Magix> if my goal is with the acess the internet over the vpn
09:13 < krzee> then not know the answer to:
09:13 < krzee> [11:11]  <Magix> Do you want clients to send all their internet traffic through the server?
09:14 < Magix> yes
09:14 < Magix> I just want to be sure
09:14 < krzee> which makes me think its trollage
09:14 < Magix> Sorry, it isn't
09:14 < Magix>  English not your first language? Say so! -- it is not my first language by the way
09:14 < Magix> Dutch is.
09:15 <@ecrist> oh, then you're an automatic troll. :)
09:15 < krzee> lol
09:15 <@ecrist> kinda lithe ze germans
09:15 <@ecrist> like*
09:16 <+EugeneKay> I blame the Swiss. THey're too neutral.
09:16 < hyper_ch> EugeneKay: hey!!!
09:16 < Magix> well
09:16 <@ecrist> The swiss are the poster child for apathy
09:16 < Magix> Germans :(
09:16 < Magix> anyways
09:16 < Magix>  magix.ovpn  samantha.conf
09:16 < hyper_ch> ecrist: at least we have a democracy
09:16 < Magix> this is that I have generated right now
09:16 < krzee> cool
09:16 < Magix> now what?
09:17 < krzee> looks like a linux user and a windows user
09:17 < Magix> yep
09:17 < krzee> now do you already have certs made?
09:17 < Magix> yes.
09:17 < krzee> make sure the filenames are correct for each user
09:17 < krzee> for the certs, in their configs
09:17 < Magix> okay
09:18 < krzee> is your server the linux user?
09:18 < Magix> yes.
09:18 < krzee> !linnat
09:18 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
09:18 < krzee> you want:
09:18 < krzee> iptables -t nat -A POSTROUTING -s 10.8.1.0/24 -o eth0 -j MASQUERADE
09:18 < krzee> (but the program should have told you that)
09:18 < Magix> Done
09:18 < Magix> yep
09:18 < krzee> !linipforward
09:19 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
09:19 < krzee> it told you that too, right?
09:19 < Magix> I already did that
09:19 < krzee> ok
09:19 < krzee> so start openvpn =]
09:19 < krzee> oh and pastebin your server config
09:20 <@ecrist> hyper_ch: I'll admit,  the swiss have more favorable gun laws than most of  Europe, so you have that.
09:20 < Magix> http://pastebin.com/G2UeBrcA
09:20 < Magix> where to put my generated config? :)
09:21 < krzee> toss it in /etc/openvpn/
09:21 < krzee> did you make a ta.key?
09:23 < Magix> hm
09:23 < Magix> nope
09:23 < krzee> !hmac
09:23 < Magix> 01.pem  02.pem  ca.crt  ca.key  dh1024.pem  index.txt  index.txt.attr  index.txt.attr.old  index.txt.old  magix.crt  magix.csr  magix.key  magix.p12  samantha.crt  samantha.csr  samantha.key  serial  serial.old
09:23 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls static key
09:23 <@vpnHelper> , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
09:23 < krzee> the configs are setup for it
09:24 < krzee> just openvpn --genkey --secret ta.key
09:24 < krzee> and use the same file on both sides
09:24 < Magix> done
09:24 < Magix> ta.key, where should I put that on my windows?
09:24 < krzee> same place as the certs
09:25 -!- kanyl1 [~on@84.23.155.169] has joined #openvpn
09:25 < Magix> done.
09:26 < krzee> unless theres some issue, you should have a working setup
09:26 < Magix> now just
09:26 -!- kanyl1 [~on@84.23.155.169] has quit [Client Quit]
09:26 < Magix> easy-rsa  ipp.txt  samantha.conf  server.conf.old  update-resolv-conf
09:26 < Magix> what I got in /etc/openvpn
09:26 < Magix> so
09:26 < Magix> what command do I use now
09:26 < Magix> to start it
09:27 < krzee> openvpn samantha.conf
09:27 < Magix> Sun Dec 18 09:27:22 2011 us=290125 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 22 2010
09:27 < Magix> Sun Dec 18 09:27:22 2011 us=290384 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
09:27 < Magix> Sun Dec 18 09:27:22 2011 us=290756 Cannot open dh2048.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
09:27 < Magix> Sun Dec 18 09:27:22 2011 us=290775 Exiting
09:27 < Magix> woops
09:27 < krzee> !dh
09:27 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
09:27 < Magix> okay
09:27 -!- kanyl1 [~on@84.23.155.169] has joined #openvpn
09:28 < Magix> Generating DH parameters, 1024 bit long safe prime, generator 2
09:28 < krzee> only goes on the server
09:28 < krzee> in the same dir as the certs
09:28 < Magix> yep
09:29 < Magix> I used build-dh
09:29 < Magix>  dh1024.pem 
09:29 < Magix> is what I have
09:30 < krzee> change it in your config
09:30 < Magix> Sun Dec 18 09:30:54 2011 us=423711 Initialization Sequence Completed
09:31 < Magix> now open: magix.opvn in windows?
09:31 < krzee> yes
09:31 -!- kanyl1 [~on@84.23.155.169] has quit [Client Quit]
09:31 -!- kanyl1 [~on@84.23.155.169] has joined #openvpn
09:32 -!- kanyl1 [~on@84.23.155.169] has quit [Client Quit]
09:32 < Magix> it opens notepad 
09:33 < Magix> krzee: it opened notepad
09:34 < krzee> did you install openvpn...?
09:34 < krzee> !download
09:34 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html
09:34 < Magix> oh
09:34 < Magix> rightclick
09:34 < krzee> LOL
09:34 < Magix> start with open vpn
09:34 < Magix> Sun Dec 18 16:34:04 2011 cd to 'C:\Program Files (x86)\OpenVPN\easy-rsa\keys' fa
09:34 < Magix> iled: The system cannot find the file specified.   (errno=2)
09:34 < Magix> Sun Dec 18 16:34:04 2011 Exiting
09:34 < Magix> Press any key to continue...
09:34 < Magix> woops
09:34 < Magix> let me chck
09:34 < krzee> it should be registered with openvpn...
09:34 < krzee> feel free to read it before pasting to me, you should try to help yourself before asking for it
09:35 < Magix> my pad
09:35 < Magix> bad*
09:35 < krzee> np
09:35 < Magix> connected! :D
09:36 -!- Xigam [~magix@magix.nl.vu] has joined #openvpn
09:37 < Xigam> okay
09:37 < Xigam> Nice
09:37 < Xigam> it works
09:37 < Xigam> Oh man I love you so <#
09:37 < krzee> yw =]
09:38 < Xigam> huge spam @ both though
09:38 < Xigam> haha
09:39 <+EugeneKay> krzee - I just looked up the docs for dnsd.... the line "in special cases like A records" makes me say "good luck that, bro"
09:39 < krzee> lol ya
09:39 < krzee> limited stuff on the phone im playing in
09:39 <+EugeneKay> with+
09:39 < Xigam> http://magix.megapowers.net/img/eLQcQ.png
09:40 < Xigam> krzee, are those speeds fast?
09:40 -!- Magix [~magix@52494D2A.cm-4-2b.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
09:40 < krzee> faster than i get, your stuff will depend on your connections
09:42 < Xigam> Nice
09:42 < Xigam> Thanks for your nice support
09:42 < krzee> you're welcome
09:43 < krzee> really i shouldnt even have a shell on this phone, but i used the openvpn script interface to get sshd working with pubkey
09:43 < krzee> @ EugeneKay ^
09:44 -!- Magix [~magix@52494D2A.cm-4-2b.dynamic.ziggo.nl] has joined #openvpn
09:44 <+EugeneKay> Are we talking about a voip phone here/
09:44 < krzee> yep
09:44 <+EugeneKay> Heh
09:44 <+EugeneKay> Nice
09:44 < krzee> it doesnt respect hosts my file
09:44 < krzee> err
09:45 < krzee> it doesnt respect my hosts file
09:45 < krzee> but im telling it to respekt mah authoritay
09:46 -!- Xigam [~magix@magix.nl.vu] has quit [Ping timeout: 252 seconds]
09:47 <+EugeneKay> Hehe
09:47 < krzee> oh EugeneKay thats not even the right doc
09:47 < krzee> thats some other dnsd
09:47 <+EugeneKay> Oh? There's a different dnsd? -_-
09:47 < krzee> ya, nice huh
09:47 <+EugeneKay> YOu'd think people could be more inventive ith their naming
09:48 < krzee> http://pastebin.com/4jJME7iU
09:48 <+EugeneKay> Oh, did I tell you I got a toll-free voip # ?
09:48 < krzee> its a busybox dnsd =]
09:48 < krzee> nah, how much per minute?
09:48 <+EugeneKay> Toll-free is 2.4c, I think
09:49 <+EugeneKay> It's voip.ms
09:49 < krzee> werd
09:49 <+EugeneKay> I also have a block of 10 consecutive numbers for extensions
09:50 <@ecrist> we're paying 1.9 cents on POTS
09:50 -!- kanylen [~on@84.23.155.169] has joined #openvpn
09:50 < hyper_ch> EugeneKay: you run freeswitch?
09:50 <+EugeneKay> No, currently using their built-in panel stuff.
09:51 -!- kanyl [~kanyl@unaffiliated/kanyl] has quit [Quit: leaving]
09:51 <@ecrist> which we plug into a freeswitch box
09:51 <+EugeneKay> I've fiddled with Asterisk, plotting to eventually bring it all to an in-house server, but not today.
09:51 <@ecrist> a FreeBSD box, of course. ;)
09:52 < hyper_ch> freeswitch > asterisk
09:52 < krzee> +1
09:53 <+EugeneKay> * wins me over because the packages for it are in EPEL.
09:53 <+EugeneKay> I absolutely despise maintaining my own rpms
09:53 < hyper_ch> EugeneKay: even I managed to compile FS painlessly
09:53 <@ecrist> I've heard good things about both asterisk and freeswitch
09:53 <@ecrist> we opted, two years ago, to use freeswitch
09:53 < krzee> fs wins me over cause its so rapidly developed and stable that its best to always use git head
09:53 <@ecrist> haven't regretted it
09:53 <+EugeneKay> It's not compiling that bugs me, it's keeping on top of things
09:53 <@ecrist> despite the up-hill battle to get it supported on freebsd
09:53 <+EugeneKay> Somebody else has figured that out, I'll let them do it
09:54 < hyper_ch> "keeping on top of things" - not sure if I understand
09:54 -!- kanylen [~on@84.23.155.169] has quit [Remote host closed the connection]
09:54 <+EugeneKay> Building+deploying the new version
09:54 < krzee> hardly necessary
09:54 <+EugeneKay> Not hard for one package, but "If you give a mouse a cookie"
09:55 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has joined #openvpn
09:55 < hyper_ch> I haven't updated FS and FPBX for months
09:56 < krzee> when i had part of a voip company we ran xen so we could run multiple asterisk servers per metal, because asterisk crashes and takes down the server with it
09:56 < krzee> freeswitch not only does not do that, but also far outperforms asterisk
09:56 < krzee> (fs wasnt mature enough to use back then)
09:57 < hyper_ch> why did you leave the company?
09:57 < krzee> the industry disapeared ;]
09:57 < krzee> remember when futurephone was giving away free phonecalls?
09:57 < hyper_ch> no
09:57 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 252 seconds]
09:57 < krzee> i was with a company that was using the same idea, but differently
09:58 <@vpnHelper> RSS Update - forum: Openvpn on Netgear DGN2200 with modfs <http://forums.openvpn.net/topic9415.html#p18603>
09:58 < krzee> ok, well nevermind then :-p
09:58 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
09:58 < hyper_ch> never heard of futurephone
09:59 -!- Kanyl [~on@unaffiliated/kanyl] has joined #openvpn
10:00 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
10:03 <+EugeneKay> Looks like freeswitch only provides binaries for Ubuntu and Debian
10:03  * EugeneKay grumbles
10:03 < hyper_ch> you sure?
10:03 <+EugeneKay> that's what the wiki says
10:04 < hyper_ch> btw, you want some web gui to administrate it?
10:04 <+EugeneKay> God no.
10:04 < hyper_ch> why so?
10:05 <+EugeneKay> Because web guis are eeeevil
10:05 < hyper_ch> not this one :)
10:05 -!- catsup [~d@ps38852.dreamhost.com] has quit [Quit: leaving]
10:06 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
10:08 <@ecrist> webguis suck for *
10:09 -!- _julian_ [~quassel@hmbg-5f767221.pool.mediaWays.net] has joined #openvpn
10:09 -!- newl [~newl@97.75.165.156] has joined #openvpn
10:10 -!- _julian [~quassel@hmbg-4d06a730.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
10:12 < takamichi> Does anyone know offhand what the latest version of the pre-compiled tap drivers are?
10:14 < hyper_ch> EugeneKay: http://www.fusionpbx.com :)
10:14 <@vpnHelper> Title: FusionPBX.Com (at www.fusionpbx.com)
10:14  * EugeneKay burns it with fire
10:14 < hyper_ch> don't you wanna first see how sucky and evil it is?
10:17 <@ecrist> takamichi: I think 9 something
10:17 <@ecrist> hyper_ch: take it out of the channel, please
10:17 < takamichi> @ecrist: Thanks, 9.0.0.8 is the latest I can find.
10:17 <@ecrist> that sounds right
10:18 < takamichi> ecrist: cool, thanks
10:18 <@ecrist> fwiw, we're in the process of rolling 2.2.2
10:18 <@ecrist> but I think the tap driver version is unchanged
10:18 < takamichi> ecrist: Im compiling our brand new 2.2.1 build. When do you think 2.2.2 will be downloadable?
10:18 <@ecrist> next week or just after the 1st of Jan
10:19 <@ecrist> I think we're just waiting on getting James to sign the packages
10:19 <@ecrist> oh, speaking of, I need to sign the weekly snapshot
10:19 < takamichi> ecrist: well then, you've just given me some extra time off this holiday! I'll continue with it in Jan.
10:20 <@ecrist> :D
10:20 <@ecrist> glad I could help
10:21 < takamichi> ecrist: Is there a changelog published anywhere for 2.2.2 or do I need to read the commits?
10:22 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 245 seconds]
10:22 <@ecrist> at this point, there's not a changelog yet
10:22 <@ecrist> you're best bet is really to read the commit logs
10:22 < takamichi> ok thanks
10:23 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
10:24 -!- newl [~newl@97.75.165.156] has left #openvpn []
10:40 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 276 seconds]
10:42 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
10:48 -!- hexad0m [~greg@host-78-145-211-246.as13285.net] has joined #openvpn
10:49 < hexad0m> !welcome
10:49 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:50 < hexad0m> !howto
10:50 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:51 < hexad0m> !route
10:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
10:53 -!- hexad0m [~greg@host-78-145-211-246.as13285.net] has left #openvpn []
10:53 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18604>
10:54 -!- pranq [pranq@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
10:54 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
10:56 -!- ibins [~Michael@2001:6f8:1c60:7777:21a:4dff:fe66:600c] has quit [Quit: Verlassend]
11:08 -!- Tannerbaum [~Pilif12p@firefox/community/pilif12p] has left #openvpn ["Leaving."]
11:15 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Quit: Leaving.]
11:19 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18605>
11:34 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
11:34 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
11:37 <@vpnHelper> RSS Update - forum: user-auth-verify Win7 write error <http://forums.openvpn.net/topic9412.html#p18606>
12:01 <@vpnHelper> RSS Update - forum: user-auth-verify Win7 write error <http://forums.openvpn.net/topic9412.html#p18607>
12:06 -!- mgorbach [~mgorbach@c-67-164-72-249.hsd1.ca.comcast.net] has joined #openvpn
12:19 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18608>
12:25 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18609>
12:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
12:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:49 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18611> || OpenVPN Config for Client <http://forums.openvpn.net/topic9413.html#p18610>
12:55 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18613> || OpenVPN Config for Client <http://forums.openvpn.net/topic9413.html#p18612>
13:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
13:15 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
13:16 <+EugeneKay> !noroot
13:16 <@vpnHelper> "noroot" is See !unpriv for a writeup by EugeneKay
13:16 <+EugeneKay> !unpriv
13:16 <@vpnHelper> "unpriv" is see https://community.openvpn.net/openvpn/wiki/UnprivilegedUser for a write-up by EugeneKay on how to run OpenVPN without root/admin permissions.
13:31 <@vpnHelper> RSS Update - forum: Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18615> || user-auth-verify Win7 write error <http://forums.openvpn.net/topic9412.html#p18614>
13:37 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:42 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
13:51 -!- Magix [~magix@52494D2A.cm-4-2b.dynamic.ziggo.nl] has quit []
13:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:02 <@vpnHelper> RSS Update - forum: OpenVPN client for the iPhone and iPad <http://forums.openvpn.net/topic4568.html#p18616>
14:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
14:14 -!- Danskmand1 [~Danskmand@dslb-094-219-025-008.pools.arcor-ip.net] has joined #openvpn
14:15 -!- Danskmand [~Danskmand@dslb-178-004-187-214.pools.arcor-ip.net] has quit [Read error: Operation timed out]
14:21 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:37 -!- mgorbach [~mgorbach@c-67-164-72-249.hsd1.ca.comcast.net] has quit [Quit: Leaving...]
14:47 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:50 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18618> || Help: Openvpn server suddenly stopped working <http://forums.openvpn.net/topic9416.html>
14:52 -!- newl [~newl@97.75.165.156] has joined #openvpn
15:03 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has joined #openvpn
15:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
15:58 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
16:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:16 -!- Firsti [~petteri@ip-87-108-60-139.customer.academica.fi] has joined #openvpn
16:17 < Firsti> Oh. Here's much people
16:17 < Firsti> Can anyone help me with route problems in Windows 7?  I've google trough whole internet, it seems like many users have same problems with windows 7/2008
16:18 < krzie> !logs
16:18 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
16:18 < krzie> be sure you started openvpn as admin
16:18 < Firsti> Yes.  done that.  i've tried all things.  Admin stuff, register-.dns, route-delay/method, manually added route etc
16:19 < Firsti> Network is work, not public.  Nothing works
16:19 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
16:19 < Firsti> But I can ping my default route, openvpn-server
16:19 < krzie> is that the long version of "ok, let me paste those logs" ?
16:19 < krzie> :-p
16:19 < Firsti> WAit a second
16:20 < krzie> k
16:20 < Firsti> Here https://forums.openvpn.net/topic9346.html 
16:20 <@vpnHelper> Title: OpenVPN Support Forum Route problems in Windows 7/2008 : Server Administration (at forums.openvpn.net)
16:20 < Firsti> There's logs too
16:20 < Firsti> No errors, no route errors in logs.  nothing
16:20 < krzie> there is 1 log there
16:21 < krzie> oh actually
16:21 < Firsti> What log you want more? server-side?
16:21 < krzie> i dont understand your windows stuff
16:21 < krzie> i only speak english
16:22 < Firsti> I know that's abit problem, but.  There's nothing visible wrong in logs.  Routers, everything works fine.  Windows XP with all same settings is working fine
16:22 < krzie> well i would have wanted both logs at verb 5 (like !logs said to do) but at this point you'll need someone else
16:22 < krzie> since i dont understand
16:22 < Firsti> Hm, wait
16:23 < krzie> your server using topology subnet?
16:24 < krzie> and you're wrong about no errors
16:24 < krzie> theres most certainly an error in your logfile on the forum post
16:25 <+EugeneKay> I would try to debug that log, but I am sooooo not working with Windows in something than English.
16:25 < krzie> and now i see that you are setting stuff manually, which is wrong
16:25 < krzie> looks like JJK was probably onto your problem
16:25 < krzie> EugeneKay, same
16:25 < Firsti> But there was no errors with routing?  I'm currently taking logs here.  And I tried setting up stuff manually, normally its automatic
16:26 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 252 seconds]
16:26 < krzie> you shouldnt be setting the gateway manually on your tap device
16:26 < Firsti> It's disabled now.  I tried it but it didn't help
16:26 < krzie> and that public/private crap for the windows interface was a big win7 issue awhile back, i bet jjk is right
16:28 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
16:29 < krzie> !win7
16:29 <@vpnHelper> "win7" is http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/8a3e9b05-353b-4250-a023-066a085e9657 for a workaround to the windows 7 unidentified network issue you get when using redirect-gateway
16:31 < Firsti> I'll check that one but, http://pastebin.com/UYCQv525 <- there is client log.  and here is server log/server cfg/client cfg http://pastebin.com/QMcMcjS4
16:31 < krzie> ys sorry but i wont be looking at those logs more
16:31 < krzie> whoa whoa
16:31 < krzie> dev tap... why?
16:32 < Firsti> Why not?  not sarcasm
16:32 < krzie> and why are you tuning your MTU stuff?
16:32 < Firsti> In fact, I don't even remember
16:32 < krzie> do you know the difference between tun and tap?
16:32 < Firsti> Should tun be better?
16:32 < krzie> better depends on the goal
16:32 < krzie> do you know the difference?
16:32 < Firsti> No, I can't remember it right now
16:33 < krzie> !tunortap
16:33 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
16:33 < Firsti> This is pretty old network I have here
16:33 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
16:33 < Firsti> Well in fact, I have pretty many games in this network.  Maybe that's why I have tap enabled
16:34 < krzie> so your server is a gameserver?
16:34 < krzie> because you arent allowing clients to communicate with eachother
16:35 < krzie> so if the server is not a gameserver, then this cant possible help you play games over layer2
16:35 < Firsti> Hmm no.  I have some game servers on clients.  My vpn-clients are able to communicate with eachother now.  Only win7/2008 are not
16:36 < Firsti> !wins
16:36 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
16:36 <@vpnHelper> RSS Update - forum: Minimum possible resource and packet overhead. <http://forums.openvpn.net/topic9403.html#p18619>
16:38 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
16:39 < Firsti> So you think tun would be much better here for me in every way?
16:42 < krzie> dunno
16:42 <@vpnHelper> RSS Update - forum: Help in getting openvpn-auth-pam.so to work properly <http://forums.openvpn.net/topic9405.html#p18622> || OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18621> || how to start openvpn without sudo <http://forums.openvpn.net/topic9404.html#p18620>
16:43 < krzie> if you have game stuff, and its working, leave it i guess
16:43 < krzie> its certainly not your win7 issue
16:43 < Firsti> Hmm.  OK.  You think it's server-side?  or..?
16:44 < krzie> no its definitely client side
16:44 < Firsti> Oh.  You mean it's probably my vpn client configure problem?
16:45 < krzie> [14:26]  <krzie> and that public/private crap for the windows interface was a big win7 issue awhile back, i bet jjk is right
16:46 < krzie> i still bet on jjk
16:46 < krzie> but i wont be able to help more since i dont speak your computer's language
16:46 <@ecrist> krzie: fwiw, you're going to notice my web server being a bit 'wonky' for a while
16:46 < Firsti> jjk?
16:47 < krzie> the person helping you on the forum
16:47 < krzie> ecrist, cool, what ya upto?
16:47 <@ecrist> krzie: did that server ever arrive?
16:47 < Firsti> oh OK
16:47 < krzie> oh yes it did, thank you man
16:47 <@ecrist> apache seems to want to eat all of my processor since the move to this VM
16:47 < krzie> how much was that shipping again eric?  i wanna send some $ to ya
16:47 <@ecrist> like, a load average of 5
16:47 < krzie> oh shit
16:47 < krzie> crazy
16:48 <@ecrist> it was exactly $32.55
16:48 <@vpnHelper> RSS Update - forum: Tinfoil Hat config check/verification <http://forums.openvpn.net/topic9407.html#p18623>
16:48 < krzie> hey thats not bad at all
16:48 <@ecrist> not too bad, considering that includes packaging
16:48 < krzie> and it was headed clear across the country
16:49 <@ecrist> well, I'm in fly-over territory, so only about half way. ;)
16:49 -!- gyyrog [~gyyrog@99.155.149.146] has joined #openvpn
16:50 <@ecrist> gah
16:50 <@ecrist> krzie: http://pastebin.com/ixnq51nG
16:51 < krzie> damn thats weird
16:51 <@ecrist> yeah
16:51 < Firsti> Thanks anyway.  I'm gonna try something
16:51 <@ecrist> I'm hoping it's something in my config, or an out-of-date module
16:51 < krzie> ild guess the latter
16:52 <@ecrist> someone in #httpd suggested I run strace on one of the processes
16:52 < krzie> could be worthwhile
16:53 <@ecrist> I'm probably going to migrate my web/mail to rootbsd, btw
16:53 <@ecrist> I have a couple folks hosting on my box that I am charging for these days, that are going to pay a lions share of the hosting
16:53 <@ecrist> that, and we're moving in <6 mo
16:54 -!- iuri [~iuri@200-185-244-245.user.ajato.com.br] has joined #openvpn
16:55 < iuri> How do I solve the TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) ? btw, my firewall has already 1194 opened 
16:56 < krzie> !timeout
16:56 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
16:56 < iuri> I also followed the  Troubleshooting howto http://www.imped.net/oss/misc/openvpn-2.0-howto-edit.html
16:56 <@vpnHelper> Title: OpenVPN 2.0 HOWTO (at www.imped.net)
16:57 < iuri> the server is running Sun Dec 18 22:28:07 2011 Initialization Sequence Completed
16:57 < iuri> i believe the error is on the client side
16:57 < iuri> The IP and port are correctly set UDPv4 link remote: [AF_INET]206.192.23.166:1194
16:58 < iuri> How do I check if my router's firewall os blocking 1194 port?
16:58 < krzie> general networking question is not an openvpn question  ;]
16:59 < iuri> I already went to the router's config section and nothing is wrong
16:59 < iuri> ;(
17:01 -!- mirco [~mirco@p5B2833C4.dip.t-dialin.net] has quit [Quit: mirco]
17:02 <@ecrist> krzie: it seems I'm being DDoSed by MSN
17:04 <@ecrist> they've probably done this for quite some time, but I was on faster hardware before
17:07 < jeev> i rooted msn's servers, it's me.
17:08  * ecrist pulls out banhammer, solves problem
17:09  * ecrist adds 157.54.0.0/15, 157.60.0.0/16, 157.56.0.0/14, 65.52.0.0/14, 180.76.0.0/16 to <shit_heads> table in pf ruleset
17:09 < Firsti> lolz
17:10  * jeev starts attacking from 157.53.0.0/16
17:11 <@ecrist> you rooted an Indonesian ISP, too?
17:11 < jeev> i rooted everything baby
17:12 <@ecrist> just shows how 1337 I am, I suppose
17:12 < jeev> how are you 1337, cause i'm attacking you ?
17:12 <@ecrist> you root ALL of microsoft, and some po-dunk ISP in ID, just to attack me
17:13 < jeev> oh yea, i didn't like what you did last summer.
17:13 <@ecrist> your sister is easy, what can I say?
17:13 <@ecrist> and your mom
17:13 < Firsti> Sounds good
17:13 < jeev> sucks for you, my sister was a guy at first.
17:14 < jeev> i dont know what you did with him but i dont want to know
17:14 <@ecrist> *shrug* a hole's a hole
17:15 < jeev> nasty
17:15 < jeev> i want the Core i7-3930K
17:15 <@ecrist> krzie: problem solved with my web server
17:16 < Firsti> I have CPU MB86904, running 110MHz
17:16 < Firsti> It's pretty cool, and probably obsolete
17:17 <@ecrist> OS: FreeBSD 8.2-RELEASE CPU: Intel(R) Xeon(R) CPU E5520 @ 2.27GHz (2261.01-MHz K8-class CPU) RAM: 24GB UP: 81 days 6:28 USERS: 3 LOAD: 0.03 0.04 0.01 (77 processes:  1 running, 76 sleeping)
17:17 < jeev> i've got a 5420 somewhere
17:17 < Firsti> hw.machine = sparc
17:17 < Firsti> hw.model = SUNW,SPARCstation-5 (MB86904 @ 110 MHz, on-chip FPU)
17:17 < Firsti> hw.ncpu = 1
17:17 < Firsti> hw.physmem = 142282752
17:18 <@ecrist> I don't list disks because that's silly
17:18 < Firsti> I have original disk here from 1994! 
17:18 < Firsti> It's still in use and works fine
17:18 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:20 <@ecrist> those persistent fucks
17:20 <@ecrist> 207.46.0.0/16
17:20 <@ecrist> added
17:24 -!- gyyrog [~gyyrog@99.155.149.146] has quit [Remote host closed the connection]
17:28 -!- mgorbach [~mgorbach@173-11-70-186-SFBA.hfc.comcastbusiness.net] has joined #openvpn
17:30 < jeev> ok now check the ips.
17:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
17:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:51 <@vpnHelper> RSS Update - forum: Does OpenVPN Provide Perfect Forward Secrecy? <http://forums.openvpn.net/topic9408.html#p18624>
17:51 -!- iuri [~iuri@200-185-244-245.user.ajato.com.br] has quit [Ping timeout: 276 seconds]
18:01 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 252 seconds]
18:04 < krzie> ecrist, by MSN???  how so?
18:09 <@vpnHelper> RSS Update - forum: Does OpenVPN Provide Perfect Forward Secrecy? <http://forums.openvpn.net/topic9408.html#p18625>
18:15 -!- Danskmand1 [~Danskmand@dslb-094-219-025-008.pools.arcor-ip.net] has left #openvpn []
18:16 -!- Klapo [~Klapo@maroon.sored.pl] has joined #openvpn
18:18 < Klapo> Hello guys, I have a small question.. how should my client config looks, when I want all my network traffic go throught connected openvpn to server?
18:18 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has joined #openvpn
18:29 <+EugeneKay> !def1
18:29 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:29 <+EugeneKay> Klapo ^
18:30 <+EugeneKay> 'redirect-gateway def1' needs to be in either your server config in concert with 'push', or client-side.
18:30 <+EugeneKay> Other than that, just the general get-my-vpn-working stuff.
18:39 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
18:39 <@vpnHelper> RSS Update - forum: Failed to activate license. <http://forums.openvpn.net/topic9417.html>
18:55 -!- Denial [Denial@drgi.co.uk] has quit []
19:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:10 < Klapo> EugeneKay: okay, gonna take a look leter. for now I don't have anymore nerves
19:10 < Klapo> thanks
19:14 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has joined #openvpn
19:21 -!- _julian [~quassel@hmbg-4d06e625.pool.mediaWays.net] has joined #openvpn
19:24 -!- _julian_ [~quassel@hmbg-5f767221.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
19:33 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has quit [Quit: Page closed]
19:36 -!- gyyrog [~gyyrog@adsl-99-155-149-146.dsl.klmzmi.sbcglobal.net] has quit [Remote host closed the connection]
19:37 -!- BaNzoun3t [Alex@86.144-242-81.adsl-dyn.isp.belgacom.be] has quit [Ping timeout: 276 seconds]
19:41 -!- mgorbach [~mgorbach@173-11-70-186-SFBA.hfc.comcastbusiness.net] has quit [Quit: Leaving...]
19:45 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
19:46 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
19:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
19:51 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has joined #openvpn
19:51 < rave> I have this iptables -t nat -A PREROUTING -p udp --dport 1:65535 -j DNAT --to-destination serverip:1194, does it mean that if my client uses port 500 in their config, I can still connect to my server at port 1194?
19:52 -!- gyyrog [~gyyrog@99.155.149.146] has joined #openvpn
19:57 <@ecrist> krzie: their spider wasn't obeying robots.txt
19:58 <@ecrist> I was getting THOUSANDS of connections from MSN and Baidu
20:10 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has quit [Quit: Page closed]
20:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:19  * jeev let off the ddos
20:20 < krzie> wow, how incredibly broken
20:21 -!- master_of_master [~master_of@p57B55086.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
20:23 -!- master_of_master [~master_of@p57B54093.dip.t-dialin.net] has joined #openvpn
20:27 <@ecrist> krzie: I fixed it by blocking quite literally nearly 1 million IPs
20:27 <@ecrist> all the IPs that I saw making connections belonged to really really large allocations
20:27 <@ecrist> around /15, /14, /16, etc
20:31 < jeev> i told you i own a lot of ips.
20:32 -!- jeev was kicked from #openvpn by ecrist [but i pwn YOU]
20:39 <@vpnHelper> RSS Update - forum: How To Properly Use route and iroute? <http://forums.openvpn.net/topic9418.html>
20:45 -!- Irssi: #openvpn: Total of 128 nicks [6 ops, 0 halfops, 2 voices, 120 normal]
20:45 <@ecrist> heh, he didn't even come back.
20:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
20:57 < krzie> oh dont worry, you couldnt lose him in a nuclear holocaust ;]
20:57 -!- jeev [1004@unaffiliated/jeev] has joined #openvpn
20:57 < jeev> wat
20:57 < jeev> i didn't even notice
20:58 < jeev> how could i get kicked in my own channel
20:58 < krzie> told ya
20:59 < jeev> must be a bug in ircd, i'll update it next week
21:01 <@ecrist> you should fix chanserv, too, that bitch is a liar
21:01 -!- Firsti [~petteri@ip-87-108-60-139.customer.academica.fi] has left #openvpn ["foobar"]
21:05 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 252 seconds]
21:07 < jeev> fix it yourself, i have better things to do, like spying on people
21:07  * ecrist makes jeev founder
21:08 < jeev> what? access list shows you as founder also? what is wrong with this bug man
21:08 <@ecrist> right?
21:09 < jeev> [07:08pm] -ChanServ- You are not authorized to perform this operation.
21:09 < jeev> and it's not even oping me now
21:09 < jeev> i've got to kill chanserv, stupid bot
21:09 <@ecrist> 21:08:59 -!- Irssi: Starting query in Freenode with chanserv
21:09 <@ecrist> 21:08:59 <ecrist> info #openvpn
21:09 <@ecrist> 21:09:00 -ChanServ(ChanServ@services.)- Information on #openvpn:
21:09 <@ecrist> 21:09:00 -ChanServ(ChanServ@services.)- Founder    : ecrist
21:09 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
21:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:11 -!- isilion1 [~Choms@89.7.138.36] has joined #openvpn
21:12 < isilion1> hi
21:13  * ecrist poofs
21:13 < isilion1> i need to set up a vpn network for 4 servers, now they are in two separate subnets of the same net. i would appreciate some documentation please (im not too deep into networking; so far, the two subnets don't see each other)
21:14 < jeev> ecrist, you hacked my server?
21:26 < isilion1> !welcome
21:26 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:27 <@ecrist> jeev: ?
21:27 < isilion1> !route
21:27 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
21:35 < jeev> i dont know how you stole foundership of the channel but you'll be getting a letter from lionel hutz
21:36 < jeev> ecrist, my attorney, a.k.a. lionel hutz. see you in court
21:36 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has joined #openvpn
21:39 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:05 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
22:05 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has joined #openvpn
22:10 < jeev> moment of silence for kim jong il
22:11 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:12 < jeev> ok that's enough
22:12 < jeev> that was a 2 moment moment of silence for a dictator, you guys must've liked him
22:17 < Olipro> isilion1: are you using tun or tap?
22:19 < Olipro> I remember when a couple of guys thought I was on their IRC server
23:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:09 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
23:14 < hyper_ch> hmmm, I really have performance problems with my vpn :(
23:32 < hyper_ch> ecrist: do you have any idea why I have such speed problems:  http://images.sjau.ch/img/960330e3.png
23:42 < sunzofman> interesting problem. I have three computers with eleven users. running openvpn-gui on windows client, would like these eleven users to share the three computers. is it wise or possible to store several different certs on a client machine?
23:48 < hyper_ch> sunzofman: you can't start openvpn at bootup?
23:49 < hyper_ch> !confgen
23:49 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
23:52 -!- harovali [~harovali@r186-52-99-3.dialup.adsl.anteldata.net.uy] has joined #openvpn
23:53 < harovali> hi, simple question: when I generate the client keys with the master ca.crt and ca.key, do all the clients data need be the same when asked to fill them ?
23:53 < harovali> they are going to be used to connect to a single openvpn server
23:54 < hyper_ch> !topology
23:54 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
23:54 < hyper_ch> !client-to-client
23:54 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
23:54 <@vpnHelper> clients
--- Day changed Mon Dec 19 2011
00:10 -!- gyyrog [~gyyrog@99.155.149.146] has quit [Remote host closed the connection]
00:40 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has joined #openvpn
00:41 < rave> what is needed to compile openvpn source code?
00:41 < rave> what is the main file of the source code? like in vb6, there is the prj file.
00:53 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has quit [Quit: Page closed]
00:54 -!- UnterPerro_ [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
00:54 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
00:54 -!- UnterPerro_ is now known as UnterPerro
01:04 <@vpnHelper> RSS Update - forum: user-auth-verify Win7 write error <http://forums.openvpn.net/topic9412.html#p18628>
01:10 -!- UnterPerro_ [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
01:10 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
01:10 -!- UnterPerro_ is now known as UnterPerro
01:10 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
01:13 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
01:16 <@vpnHelper> RSS Update - forum: How To Properly Use route and iroute? <http://forums.openvpn.net/topic9418.html#p18630> || Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18629> || [resolved] Connection established, no traffic.. <http://forums.openvpn.net/topic9367.html#p18615>
01:22 <@vpnHelper> RSS Update - forum: Help: Openvpn server suddenly stopped working <http://forums.openvpn.net/topic9416.html#p18631>
01:40 -!- dazo_afk is now known as dazo
01:40 <@vpnHelper> RSS Update - forum: Advice on openvpn deployment <http://forums.openvpn.net/topic9411.html#p18633> || Can VPN Services Provide End to End Encryption? <http://forums.openvpn.net/topic9402.html#p18632>
01:45 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
01:46 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
01:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
01:52 <@vpnHelper> RSS Update - forum: Bridge for clients in different networks <http://forums.openvpn.net/topic9419.html>
01:53 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
01:58 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
01:58 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
02:02 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has joined #openvpn
02:03 < rave> what is the effect is I allow inbound and outbound ports 1:65535?
02:04 < l0rd_hex> rave: a spacewolf will bite you on your birthday
02:04 < rave> hahaha
02:05 < rave> my birthday has already passed
02:05 < l0rd_hex> then the next birthday
02:05 < l0rd_hex> all birthdays in fact
02:06 < rave> hahahaha. You really want that spacewolf to bite me huh. :)
02:06 < rave> but really, whats the effect? could you answer the question. ty
02:06 < l0rd_hex> I don't, I wouldn't wish it on my worse enemy.. the spacewolf is directly controlled by openvpn
02:07 < l0rd_hex> I don't really know, what syntax are you talking about.. the client or server?
02:07 < rave> on the server
02:08 < l0rd_hex> rave: what's the line you're using in the config?
02:09 < l0rd_hex> like port 1:65535 ?
02:09 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
02:09 < rave> just the basics but I would like to open all the ports 1-65535 using iptables and redirect to the openvpn port that I assign so that the client can try any ports they wish to connect
02:10 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
02:11 < l0rd_hex> oh, I see
02:11 < l0rd_hex> well that's kindof a bad idea because your fw will have all ports open and listening
02:11 < l0rd_hex> what's wrong with 1194?
02:12 < rave> theres nothing wrong I have that 1194 on my server conf. but if the clients cannot connect to it, they can edit the ovpn file and change it to any ports they wish without having me to open the port before they can use it.
02:13 < l0rd_hex> rave: oh, I see
02:14 < l0rd_hex> so you'd basically be redirecting all traffic to port 1194 of your server?
02:14 < rave> yes
02:14 < l0rd_hex> hmm, sounds interesting... I think it might work
02:15 < rave> yes it worked I already tried it. my issue now is security on my server since I opened all the ports. :)
02:16 < l0rd_hex> rave: ahh, well I guess if you're directing everything to the same service you'd be ok
02:17 < rave> you mean the openvpn service !
02:18 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
02:18 < rave> to be specific, I redirect to specific IP and 1194 port
02:18 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
02:19 < l0rd_hex> yup
02:19 <@vpnHelper> RSS Update - forum: Bridge for clients in different networks <http://forums.openvpn.net/topic9420.html>
02:19 < l0rd_hex> I really only use pf so I'm not the best person to talk to
02:21 < rave> thats ok atleast I get ideas from you. thanks man.
02:27 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has left #openvpn []
02:38 -!- manolitos [~manos@pd956c12f.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
02:51 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
02:51 < hyper_ch> hi dazo
02:51 <@dazo> hyper_ch: hey!
02:51 < hyper_ch> dazo: you're a openvpn guru, right?
02:52 <@dazo> hyper_ch: I begin to know a little bit about it :)
02:52 < hyper_ch> dazo: here's my problem http://images.sjau.ch/img/960330e3.png
02:53 < hyper_ch> when I use TCP on server and clients, I get good "home speeds" but the other server only uses about 1/4 of what it could
02:53 < hyper_ch> when I use UDP on server and clients, my home speed is slow but the other server gets full speed
02:53 < hyper_ch> when I run two openvpn servers, on udp for the other server and one tcp to me, I get even slower speeds
02:54 <@dazo> hyper_ch: that might be due to the line you have at home got some issues with UDP traffic ... some ISPs caps UDP traffic 
02:54 <@dazo> well, that combo sounds really odd
02:54 < hyper_ch> dazo: but why would the UDP and TCP servers make it even slower?
02:54 < hyper_ch> why does that combo sound odd?
02:54 <@dazo> that the performance drops
02:54 <@dazo> that sounds odd ... I believe you, but don't understand why
02:55 < hyper_ch> well, I do push the routes for each subnet to every client
02:56 < hyper_ch> that means the 10.8.1 clients also have a 10.8.0 route pushed for tunX
02:56 < hyper_ch> and vice-versa
02:56 < hyper_ch> but one more thing
02:56 < hyper_ch> topology subnet - what would I put now into the CCD for pushing an IP?
02:57 < hyper_ch> could I just put "ifconfig-push 10.8.1.12"
02:57 < hyper_ch> this far I have "ifconfig-push 10.8.1.12 10.8.1.11"
02:57 <@dazo> hyper_ch: I believe you could do that ... otherwise with netmask as second arg
02:58 < hyper_ch> well, the topology subnet doens't give much info....
02:58 < hyper_ch> !topology
02:58 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
02:58 < hyper_ch> "clients receive addresses ending in .2, .3, ...." --> this means no IP pushed
02:59 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
02:59 < hyper_ch> btw, the speeds measurements are from filezilla and from rtorrent
02:59 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
03:00 < hyper_ch> krzee mentioned a while back that there is better measurment of speed in the vpn
03:01 < hyper_ch> dazo: and do you know how I can find out if my ISP mangles with UDP?
03:02 <@dazo> hyper_ch: in general it just sounds so, as the your performance in general stinks with UDP ... but I don't know any other way .... maybe running iperf directly?
03:03 < hyper_ch> well, I think my ISP started mangling with UDP because some time in april I change from UDP to TCP because of that sudden performance drop. It worked fine for months before
03:04 < hyper_ch> TCP on the other server was also fine for quite some time... only recently I noticed that I couldn't get more than 3MB/s
03:07 <@dazo> ovpn with TCP is just a "emergency" solution when UDP stinks :/
03:07 <@dazo> (due to this TCP over TCP issue)
03:08 < hyper_ch> could you try the performance on your end?
03:15 <@dazo> hyper_ch: on my connections, you mean?
03:15 -!- biggi_mat [c15ff27e@gateway/web/freenode/ip.193.95.242.126] has joined #openvpn
03:15 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
03:15 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
03:17 < biggi_mat> Hello there. I have a question regarding disabling IP changes: my current configuration is so that on client connect I assign a static IP based on CN. How can I disable the client to change its IP address? If I as a client change the default IP on my TAP driver it...changes and everything goes on normally. I need clients to have the IPs assigned as I say because of firewalling. Any hints?
03:20 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:20 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
03:25 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:26 < hyper_ch> dazo: well, I'm pondering about giving you access to my vpn and you could test tcp/udp and see how it performs for you
03:26 <@dazo> hyper_ch: ahh, I can sure run some tests for you
03:27 < hyper_ch> and once you're done, I can figure out how to revoke certs ;)
03:27 < hyper_ch> I need to do a few things first at work and will get you the stuff later
03:27 <@dazo> sure, no worries!
03:30 < biggi_mat> So...there is no way of preventing client IP changes and thus accessing restricted areas? Is there a way of limiting CNs to ip A, B, range C, but not to D and E for example*
03:30 < biggi_mat> ?
03:31 <@dazo> biggi_mat: nope ... but you can check-out eurephia, which does firewall updates on-the-fly based on username/password + certificates
03:31 <@dazo> !eurephia
03:31 <@dazo> http://www.eurephia.net/
03:31 <@vpnHelper> "eurephia" is http://www.eurephia.net/
03:31 <@vpnHelper> Title: eurephia :: a flexible OpenVPN authentication module (at www.eurephia.net)
03:31 < biggi_mat> dazo: this is a "nope" to both of my ways of thinking*
03:32 < biggi_mat> Oh for christ sake, ?, not * ! :<
03:32 < biggi_mat> I'll check eurephia out. Thank you
03:33 < biggi_mat> Oh come on...sqlite?
03:34 <@dazo> biggi_mat: sqlite is great embedded sql service ... one guy is working on a mysql driver, and I've started a postgresql server ... but for now, sqlite is the only alternative
03:34 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
03:34 < biggi_mat> Alternative to what? Probably the only option :<
03:35 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
03:35 < biggi_mat> dazo: I wouldn't want to put more daemons/servers/points of failure to my gateway, I'm sure you can understand that
03:35 <@dazo> biggi_mat: which is why sqlite is a good alternative ... there is no additional daemons
03:36 < biggi_mat> Alright
03:36 <@dazo> biggi_mat: the current implementation of eurephia, is that openvpn loads the eurephia module, which includes  the embedded sqlite engine
03:36 <@vpnHelper> RSS Update - forum: Help: Openvpn server suddenly stopped working <http://forums.openvpn.net/topic9416.html#p18636>
03:36 < biggi_mat> Just a question - to use eurephia the debian openvpn package is useless?
03:36 <@dazo> biggi_mat: no, not at all ... the debian packages is eurephia "compatible"
03:37 <@dazo> I even believe eurephia is packaged for debian as well
03:37 < biggi_mat> Awesome. So I just git clone git://eurephia.git.sourceforge.net/gitroot/eurephia/eurephia.git  ?
03:37 < biggi_mat> dazo: doesn't look like that, aptitude doesn't find it
03:37 <@dazo> biggi_mat: which debian version are you on?
03:37 < biggi_mat> Unless it's not in official repositories
03:37 < biggi_mat> dazo: squeeze
03:38 <@dazo> hmm ... it should have been there, iirc ... I discussed this with the package maintainer ages ago, around when squeeze was being released
03:38  * dazo checks
03:38 <@dazo> biggi_mat: http://www.eurephia.net/documentation/eurephia/1.0/html/Administrators_Tutorial_and_Manual/ch02s02.html
03:38 <@vpnHelper> Title: 2.2. Debian (at www.eurephia.net)
03:39 < biggi_mat> http://packages.debian.org/search?searchon=contents&keywords=eurephia&mode=path&suite=stable&arch=any
03:39 <@vpnHelper> Title: Debian -- Package Contents Search Results -- eurephia (at packages.debian.org)
03:39 <@dazo> huh?
03:40 < biggi_mat> Official debian packages aren't familiar with eurephia, it seems :<
03:40 < biggi_mat> I mean repositories, not packages
03:40 <@dazo> I'll try to locate the debian maintainer and ask about it
03:40 < biggi_mat> Cool
03:40 < biggi_mat> But in the meantime
03:41 < biggi_mat> I can use git clone git://eurephia.git.sourceforge.net/gitroot/eurephia/eurephia.git I take it?
03:42 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:42 <@dazo> yeah should work as well ... look at the compile instructions in the documentation, it should be pretty clear
03:42 <@dazo> http://packages.debian.org/sid/eurephia .... http://packages.debian.org/wheezy/eurephia
03:42 <@vpnHelper> Title: Debian -- Details of package eurephia in sid (at packages.debian.org)
03:42 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
03:42 <@dazo> hmmm ... never made it to squeeze, it seems :/
03:42 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
03:44 < biggi_mat> :(
03:44 < biggi_mat> Hum, dazo may I ask what exactly of openssl is needed? It here says something's missing - crypto module or something
03:45 <@dazo> biggi_mat: where do you see that?
03:45 < biggi_mat> Oh I think I know why it never made to squeeze
03:45 < biggi_mat> dazo: when running configure
03:45 <@dazo> it needs openssl-dev
03:46 < biggi_mat> http://pastebin.com/hPZZgtmF
03:46 <@dazo> and the openssl package, in general
03:47 <@dazo> hmm ... those RAND_* stuff should be in openssl/openssl-dev, though 
03:48 < biggi_mat> Yeh, I figured it out. The package in debian is called  libcurl4-openssl-dev
03:48 < biggi_mat> The libcurl part was rather confusing
03:48 <@dazo> uhh!??  that's really odd
03:49 < biggi_mat> Well, it works now :)
03:49 <@dazo> cool!
03:51 < biggi_mat> Hum, judging by the wiki the output of make install should be a lot more then I got
03:51 < biggi_mat> Something somewhere went wrong!
03:51 <@dazo> biggi_mat: please read the compile and install guide ... it will explain a lot more of the features you can enable 
03:54 < Klapo> http://pastebin.com/aYADFSix guys I need help
03:54 <@dazo> !welcome
03:54 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:54 <@dazo> Klapo: ^^^
03:55 < Klapo> oh
03:55 < biggi_mat> Of course, working on it
03:56 < Klapo> !goal
03:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:57 < biggi_mat> dazo: since the openvpn from debian repo is rather "sourceless", how should I specify openvpn-src?
03:57 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
03:58 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
03:58 <@dazo> biggi_mat: ahh, just clone the openvpn.git repo .... or all you basically need, is the openvpn-plugin.h .... and point openvpn-src at the dir with this file
03:58 < hyper_ch> dazo: finally I got free time :)
03:58 <@dazo> hyper_ch: I don't :-P
03:58 < hyper_ch> !howto
03:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:58 < hyper_ch> I forgot how to create certs :)
03:58 <@dazo> whoops :)
03:59 < Klapo> well ok, my goal is make connection between client and server (with redirect-gateway), there are my server.conf , client.ovpn, log from client, some pings... I'm working on OpenWRT (server side) and Windows (client side), pastes: http://pastebin.com/aYADFSix
03:59 < Klapo> dazo: :)
04:00 <@dazo> Klapo: now you need to wait until someone have time to help out ... sometimes it goes quick, otherwise it may take a (little) while
04:00  * dazo unfortunately got his pipes filled up at the moment
04:00 < Klapo> sure, thanks for help anyway
04:07 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
04:08 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
04:08 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
04:10 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:15 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
04:16 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
04:17 -!- BaNzoun3t [~Alex@86.144-242-81.adsl-dyn.isp.belgacom.be] has joined #openvpn
04:20 -!- BaNzoun3t [~Alex@86.144-242-81.adsl-dyn.isp.belgacom.be] has quit [Client Quit]
04:20 <@dazo> biggi_mat: I saw that I hadn't pushed out some fixes in the git tree of eurephia, but it's updated now
04:20 < biggi_mat> Cool
04:20 < biggi_mat> Thanks
04:21  * dazo has been running those changes on a production server since the where committed
04:21 <@dazo> I consider them pretty safe :)
04:21 < biggi_mat> :)
04:21 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
04:24 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
04:24 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
04:25 < hyper_ch> dazo: pm for you
04:29 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
04:29 <@vpnHelper> RSS Update - forum: Internal / External LAN-Interface on openVPNas <http://forums.openvpn.net/topic9421.html>
04:29 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
04:34 < hyper_ch> !client-to-client
04:34 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
04:34 <@vpnHelper> clients
04:35 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
04:36 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
04:42 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
04:42 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
04:48 < biggi_mat> dazo: how could I check if eurephia is now actually working with my previously configured openvpn?
04:48 < biggi_mat> I restarted openvpn daemon and tried connecting with a test account and it all worked well...so uh
04:48 <@dazo> biggi_mat: then it's probably not been loaded .... check out eurephia log features
04:48  * dazo need to run for a lunch meeting ... already late :-/
04:49 < biggi_mat> Bon apetit in that case then
04:49 <@dazo> thx
04:51 < hyper_ch> !tcp-nodelay
04:51 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
04:52 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
04:52 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
04:57 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
04:57 <@vpnHelper> RSS Update - forum: IPTABLES - Portforwarding <http://forums.openvpn.net/topic7823.html#p18638>
04:57 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
04:58 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 252 seconds]
05:03 -!- hyper_ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has joined #openvpn
05:04 -!- hyper__ch [~hyper_ch@158-184.79-83.cust.bluewin.ch] has joined #openvpn
05:04 -!- hyper_ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has quit [Disconnected by services]
05:04 < hyper__ch> hmmm, that topology subnet behaves weird
05:04 < hyper__ch> !topology
05:04 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
05:05 < hyper__ch> how do I push an ip with topology subnet?
05:06 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
05:06 -!- hyper_ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has joined #openvpn
05:07 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
05:09 <@vpnHelper> RSS Update - forum: Bridge for clients in different networks <http://forums.openvpn.net/topic9419.html#p18639>
05:14 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
05:14 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
05:14 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
05:20 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
05:20 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
05:22 -!- hyper__ch [~hyper_ch@158-184.79-83.cust.bluewin.ch] has quit [Remote host closed the connection]
05:24 -!- hyper_ch [~hyper_ch@static.2.139.40.188.clients.your-server.de] has quit [Ping timeout: 244 seconds]
05:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:30 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
05:31 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
05:33 < hyper_ch> !tls-auth
05:33 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make
05:33 <@vpnHelper> the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
05:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:39 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
05:40 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
05:41 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
05:48 -!- speakman [~daniel@unaffiliated/speakman] has joined #openvpn
05:48 < speakman> Hi folks! Is it possible to route through an tun0 tunnel?
05:48 < speakman> I've set /proc/sys/net/ipv4/ip_forward to 1 but no packets seems to be 
05:48 < speakman> forwared
05:50 < hyper_ch> speakman: issue !goal
05:50 < speakman> trying to route two networks together
05:50 < hyper_ch> then just add a route
05:51 < hyper_ch> but I don't think that's your goal
05:51 < speakman> the openvpn server has no problem routing it's local network to any connecting host. But I need the host to act as a router for it's local network as well.
05:51 < hyper_ch> speakman: issue !welcome
05:51 < speakman> ?
05:51 < hyper_ch> just type it
05:51 < speakman> issue !welcome
05:51 < speakman> !welcome
05:51 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:53 < hyper_ch> speakman: "See !route for lans behind openvpn."
05:57 < speakman> !route
05:57 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
05:59 < speakman> !goal
05:59 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:08 <@vpnHelper> RSS Update - forum: Can Connect a Client but Cannot Access Web Pages <http://forums.openvpn.net/topic9422.html>
06:23 < hyper_ch> speakman: so, what do you try to do?
06:25 < speakman> just link two networks together through an openvpn tunnel
06:25 < hyper_ch> !route
06:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
06:26 < speakman> Yes I've read that. It's pretty much exactly that. But I remember someone saying pure ip routering can't be done over tun0
06:27 < speakman> Or was it tap0?
06:29 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
06:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
--- Log closed Mon Dec 19 06:42:53 2011
--- Log opened Mon Dec 19 06:43:12 2011
06:43 -!- ecrist_ [~ecrist@jaguar-2-red.claimlynx.com] has joined #openvpn
06:43 -!- Irssi: #openvpn: Total of 135 nicks [6 ops, 0 halfops, 2 voices, 127 normal]
06:43 -!- Irssi: Join to #openvpn was synced in 44 secs
06:46 -!- masch_ [~quassel@big.masch.it] has joined #openvpn
06:46 -!- Haraken [~ryuk@unaffiliated/haraken] has quit [Ping timeout: 244 seconds]
06:46 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 244 seconds]
06:46 -!- __nolife [~Lirezh@83-64-53-66.kocheck.xdsl-line.inode.at] has quit [Ping timeout: 244 seconds]
06:46 -!- agagag [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 244 seconds]
06:46 -!- bragon [~Alexandre@81.93.247.165] has quit [Ping timeout: 244 seconds]
06:46 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 244 seconds]
06:46 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 244 seconds]
06:46 -!- l0rd_hex [~rubit_man@S0106000024c61290.ed.shawcable.net] has quit [Ping timeout: 244 seconds]
06:46 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 244 seconds]
06:46 -!- _julian [~quassel@hmbg-4d06e625.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
06:46 -!- masch [~quassel@big.masch.it] has quit [Ping timeout: 244 seconds]
06:46 -!- __nolife [~Lirezh@83-64-53-66.kocheck.xdsl-line.inode.at] has joined #openvpn
06:46 -!- cherwin_ [1776628@xs8.xs4all.nl] has joined #openvpn
06:46 -!- l0rd_hex [~rubit_man@S0106000024c61290.ed.shawcable.net] has joined #openvpn
06:47 -!- cherwin [1776628@xs8.xs4all.nl] has quit [Ping timeout: 240 seconds]
06:47 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Ping timeout: 240 seconds]
06:47 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
06:47 -!- biggi_mat [c15ff27e@gateway/web/freenode/ip.193.95.242.126] has quit [Ping timeout: 258 seconds]
06:47 -!- _julian__ [~quassel@hmbg-4d06e625.pool.mediaWays.net] has joined #openvpn
06:47 -!- bragon_ [~Alexandre@81.93.247.165] has joined #openvpn
06:47 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has joined #openvpn
06:48 -!- agagag_ [~anton@eudaimonia.goto10.org] has joined #openvpn
06:50 -!- vereteran-x [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
06:52 -!- Netsplit *.net <-> *.split quits: SigmaProjects, dioz, mete, |Mike|, pa, DarthGandalf, rkantos, GetsEcle1tic, diytto
06:52 -!- You're now known as ecrist
06:52 -!- Haraken [~ryuk@sigh.haraken.tsu-ji.jp] has joined #openvpn
06:52 -!- Netsplit over, joins: SigmaProjects, mete, pa, diytto, GetsEcle1tic, dioz, rkantos, DarthGandalf, |Mike|
06:53 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
06:55 -!- Haraken [~ryuk@sigh.haraken.tsu-ji.jp] has quit [Changing host]
06:55 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
06:55 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit []
06:55 -!- Denial [Denial@drgi.co.uk] has quit [Read error: Connection reset by peer]
06:56 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:57 -!- Netsplit *.net <-> *.split quits: SigmaProjects, dioz, mete, |Mike|, pa, Haraken, rkantos, GetsEcle1tic, DarthGandalf, diytto
06:59 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Read error: Operation timed out]
07:00 -!- Netsplit over, joins: Haraken, SigmaProjects, mete, pa, diytto, GetsEcle1tic, dioz, rkantos, DarthGandalf, |Mike|
07:01 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
07:04 -!- Kanyl [~on@unaffiliated/kanyl] has quit [Remote host closed the connection]
07:05 -!- Kanyl [~on@unaffiliated/kanyl] has joined #openvpn
07:08 <@vpnHelper> RSS Update - forum: Bridge for clients in different networks <http://forums.openvpn.net/topic9419.html#p18641>
07:09 <+EugeneKay> speakman - of course you can do a pure routed network over tun interfaces. I do it all the time.
07:09 <+EugeneKay> You need to use a tap interface if you want to do bridging, but bridging is not what you want to d.
07:09 <+EugeneKay> +o
07:10 -!- novaflash is now known as novaflash_away
07:10 -!- isilion1 [~Choms@89.7.138.36] has quit [Read error: No route to host]
07:17 < speakman> nope, no bridging
07:17 < speakman> I have to revisit all configuration. Can't figure why it doesn't work.
07:18 < speakman> What tools do you guys use for finding out where the traversal stops?
07:25 < sunzofman> interesting problem. I have three computers with eleven users. running openvpn-gui on windows client, would like these eleven users to share the three computers. is it wise or possible to store several different certs on a client machine?
07:29 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
07:31 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
07:33 -!- bragon_ is now known as bragon
07:34 <+EugeneKay> traceroute, usually.
07:34 < speakman> ok
07:34 <+EugeneKay> sunzofman - you want to run it as a service
07:34 < speakman> yep, seems like it's the vpn client not forwarding packets
07:35 < speakman> shouldn't "echo 1 > /proc/sys/net/ipv4/ip_forward" be enough?
07:36 <+EugeneKay> You probably have a DROP on your FORWARD table
07:36 < speakman> The client itself doesn't have any trouble reaching any nodes of the remote network
07:37 < speakman> There's no netfilter rules existing
07:37 <+EugeneKay> And do you have proper routing setup, with iroute inside of a ccd?
07:37 < speakman> iroute?
07:37 <+EugeneKay> That's a no, then.
07:37 <+EugeneKay> !route
07:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
07:37 < speakman> I'm trying to set this up manually
07:37 < speakman> isn't iroute a vpn thing?
07:38 <+EugeneKay> It is.
07:38 <+EugeneKay> The server needs a roue to the subnet. doing it just "via tun0" won't do the trick, openvpn needs to know which tunnel to send it down
07:39 <+EugeneKay> YOu can route it via 10.8.0.X, but that's not the same as what iroute does
07:39 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
07:39 < sunzofman> EugeneKay: yes, I simply want to run the gui on the desktop allow their specific certificate to authenticate
07:40 <+EugeneKay> sunzofman - then you don't want the service, you just want a bunch of shortcuts, one per user's start menu
07:41 <+EugeneKay> "C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe" --config_dir "C:\Users\EugeneKay\.ssh\" --connect client-khresearch.ovpn --show_balloon 0 --silent_connection 1 --show_script_window 0
07:41 <+EugeneKay> Make that the "target" of the shortcuts you create, modified appropriately per-user.
07:41 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372.html#p18642>
07:42 <+EugeneKay> Each user will need a different .ovpn, along with their key/cert.
07:43 < speakman> EugeneKay: should I be using "dev tap" or "dev tun"? 
07:43 <+EugeneKay> !tunortap
07:43 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
07:43 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
07:47 < speakman> does it matter when doing level 3 routing?
07:47 < speakman> I remember changing that once due to one device wasn't able to do simple routing
07:47 < sunzofman> EugeneKay: so would then have to tightly control the user accounts on each windows client? win7 is more robust than xp..
07:48 <+EugeneKay> speakman - tun is by definition able to do simple routing; the only time you need tap is as above.
07:49 <+EugeneKay> sunzofman - yup. you can/should specify a password on each key if that's gonna be a concern, and some sort of auto-disconnect would be a good idea.
07:49 <+EugeneKay> Also want to disable fast user switching
07:50 <+EugeneKay> I think there's a way you can have it disconnect when the screensaver is activated
07:50 < sunzofman> EugeneKay: could you point to some docs describing my sort of scenario? i would guess that hardware constraints are somewhat common :-)
07:51 <+EugeneKay> Nope, sorry. Windows is not known for its documentation.
07:51 < sunzofman> EugeneKay: you have been very helpful. thx 
07:51 < speakman> How can I securely switch to tap from tun when the remote box is _very_ far away?
07:52 <+EugeneKay> sunzofman - It looks --inactive would be help for you
07:52 <+EugeneKay> speakman - you don't need tun for routing. Full stop.
07:52 < speakman> on the other hand - routing should work usnig tap0 as well?
07:52 < speakman> exactly...
07:52 <+EugeneKay> Er
07:52 <+EugeneKay> tap*
07:52 <+EugeneKay> Sorry, it's too early.
07:52 < speakman> If I could just get routing working, I could do optimization last.
07:52 <+EugeneKay> tun si what you want. You can use tap, but it's overhead.
07:53 < speakman> Does it really matter? Since I already got tun working, can't I just keep it until I've got routing working?
07:53 <+EugeneKay> Yes. This is what I'm saying. Use tun.
07:54 -!- Entomoo [81531f01@gateway/web/freenode/ip.129.83.31.1] has joined #openvpn
07:56 < speakman> ??
07:57 < speakman> I'm using tap right now and everything is working. Do I really have to move to tun to get routing working?
07:57 < speakman> everything except routing, of course
07:58 <+EugeneKay> You just said you're using tun; now oyu say you're using tap. Please make up your mind.
07:59 <+EugeneKay> tap provides everything tun does, plus more. This adds overhead and is not recommended unless you have a specific need for tap. 
07:59 < speakman> Oops, you're right, it was a misstyping. I'm on tap0 nothing else.
07:59 <+EugeneKay> You dont' have to use tun for routing, but it is a good idea, and I reserve the right to point and laugh if issues are caused by it.
07:59 < speakman> Be my guest :)
08:00 < speakman> I'll go for tun dev when I get routing working
08:01 <+EugeneKay> I recommend setting up routing as the writeup in !route says, not assembling it manually.
08:01 < speakman> !route
08:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
08:02 < speakman> what's client-to-client?
08:02 <+EugeneKay> !c2c
08:02 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind
08:02 <@vpnHelper> other clients
08:03 <+EugeneKay> Reduces routing overhead, bypasses the firewall.
08:03 < speakman> ok
08:21 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
08:21 -!- mode/#openvpn [+v Axeman] by ChanServ
08:26 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18643>
08:28 -!- harovali [~harovali@r186-52-99-3.dialup.adsl.anteldata.net.uy] has quit [Read error: Connection reset by peer]
08:30 -!- harovali [~harovali@r190-64-97-185.dialup.adsl.anteldata.net.uy] has joined #openvpn
08:31 -!- biggi_mat [c15ff27e@gateway/web/freenode/ip.193.95.242.126] has joined #openvpn
08:31 <@vpnHelper> RSS Update - forum: PAM Athentication using a script based on PHP or Html, help! <http://forums.openvpn.net/topic9301.html#p18644>
08:32 < biggi_mat> Hello again. After I've setup eurephia I'm getting a following issue when connecting to ovpn: TLS Error: Auth Username/Password was not provided by peer
08:32 < biggi_mat> How so?
08:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
08:38 < biggi_mat> Oh, I see
08:39 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has joined #openvpn
08:44 <@vpnHelper> RSS Update - forum: Using web hosting account for VPN tunnel <http://forums.openvpn.net/topic9004.html#p18645>
08:46 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:48 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
08:54 -!- harovali [~harovali@r190-64-97-185.dialup.adsl.anteldata.net.uy] has quit [Ping timeout: 240 seconds]
09:02 < hyper_ch> hi EugeneKay
09:07 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 240 seconds]
09:20 < biggi_mat> dazo: I would like to speak with you when possible :)
09:25 -!- _julian [~quassel@hmbg-4d06a6cf.pool.mediaWays.net] has joined #openvpn
09:26 <@vpnHelper> RSS Update - forum: Bridge for clients in different networks <http://forums.openvpn.net/topic9419.html#p18647> || Advice on openvpn deployment <http://forums.openvpn.net/topic9411.html#p18646>
09:26  * EugeneKay milks the Entomoo 
09:27 < Entomoo> mmmm.. bug milk.  Yummy.
09:27 -!- _julian__ [~quassel@hmbg-4d06e625.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
09:27 < Entomoo> oh wait...I'm still on the lazy nick.
09:28 -!- _julian__ [~quassel@hmbg-4d06d450.pool.mediaWays.net] has joined #openvpn
09:28 -!- Entomoo is now known as Entomo
09:28 < Entomo> Better
09:29 -!- _julian [~quassel@hmbg-4d06a6cf.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
09:32 <@vpnHelper> RSS Update - forum: OpenVPN Site-To-Site without static key but 2 fixed IPs <http://forums.openvpn.net/topic9372-15.html#p18649> || Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18648>
09:41 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 252 seconds]
09:41 -!- takamichi [~pri@217.23.4.104] has joined #openvpn
09:44 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
09:45 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has joined #openvpn
09:56 -!- noisebleed_ [~quassel@piggy.inescn.pt] has joined #openvpn
09:57 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
10:00 -!- ph1l [~ph1l@pdpc/supporter/active/ph1l] has quit [Read error: Connection reset by peer]
10:01 <@dazo> biggi_mat: I'm back
10:05 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
10:05 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
10:05 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
10:20 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
10:23 -!- okamis_ [2eef7d06@gateway/web/freenode/ip.46.239.125.6] has quit [Quit: Page closed]
10:32 -!- takamichi [~pri@217.23.4.104] has quit [Ping timeout: 252 seconds]
10:33 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
10:37 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
10:39 < havoc> what's the "common" OpenVPN client for Mac OSX?
10:39 < havoc> I have no macs but need to set it up for a friend who uses macs exclusively
10:40 < dxtr> havoc: Uhm.. the openvpn client?
10:40 <+EugeneKay> !download
10:40 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html
10:40 < dxtr> There's a gui called tunnelblick though
10:40 < havoc> dxtr: thanks, I was unaware there was one for OSX
10:40 < havoc> ah
10:40 < havoc> tunnelblick, I think I've heard of that, thanks
10:40 < havoc> I just needed a name to go on :)
10:41 <+EugeneKay> !tunnelblick
10:41 <@vpnHelper> "tunnelblick" is http://www.tunnelblick.net - Free OpenVPN GUI Client for Mac OS X
10:42 <+EugeneKay> I wonder if tunnelblick is ever gonna get rolled in the same as the windows gui was
10:48 -!- ibins [~moros@dslb-084-056-096-055.pools.arcor-ip.net] has joined #openvpn
10:48 -!- ibins [~moros@dslb-084-056-096-055.pools.arcor-ip.net] has quit [Client Quit]
10:49 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
10:57 <@vpnHelper> RSS Update - forum: How To Properly Use route and iroute? <http://forums.openvpn.net/topic9418.html#p18650>
11:12 -!- _julian [~quassel@hmbg-5f761c58.pool.mediaWays.net] has joined #openvpn
11:13 -!- _julian__ [~quassel@hmbg-4d06d450.pool.mediaWays.net] has quit [Ping timeout: 244 seconds]
11:19 -!- _julian__ [~quassel@hmbg-5f77f681.pool.mediaWays.net] has joined #openvpn
11:19 -!- _julian [~quassel@hmbg-5f761c58.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
11:21 -!- noisebleed_ [~quassel@piggy.inescn.pt] has quit [Quit: No Ping reply in 180 seconds.]
11:21 <@vpnHelper> RSS Update - forum: Server code modification to allow the cipher to be optional <http://forums.openvpn.net/topic9423.html>
11:21 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
11:21 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
11:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
11:23 -!- _julian [~quassel@hmbg-5f77f6cf.pool.mediaWays.net] has joined #openvpn
11:25 -!- _julian__ [~quassel@hmbg-5f77f681.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
11:27 -!- Azrael808 [~peter@62.200.86.169] has joined #openvpn
11:29 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
11:29 -!- _julian [~quassel@hmbg-5f77f6cf.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
11:31 -!- _julian [~quassel@hmbg-4d06b13d.pool.mediaWays.net] has joined #openvpn
11:37 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: mattock]
11:38 -!- noisebleed_ [~quassel@lula.inescn.pt] has joined #openvpn
11:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 248 seconds]
11:43 -!- _julian [~quassel@hmbg-4d06b13d.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
11:44 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
11:45 -!- _julian [~quassel@hmbg-5f7636b2.pool.mediaWays.net] has joined #openvpn
11:51 <@vpnHelper> RSS Update - forum: VPN routing to LAN in tap <http://forums.openvpn.net/topic9425.html> || Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html>
11:56 -!- Azrael808 [~peter@62.200.86.169] has quit [Ping timeout: 252 seconds]
12:25 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 240 seconds]
12:51 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 276 seconds]
12:53 -!- ponyofdeath [~vladi@cpe-75-80-175-217.san.res.rr.com] has quit [Quit: leaving]
12:58 < ecrist> tunnelblick is the SHIT
13:03 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18654>
13:12 -!- _julian [~quassel@hmbg-5f7636b2.pool.mediaWays.net] has quit [Ping timeout: 276 seconds]
13:13 -!- _julian [~quassel@hmbg-4d06ad1d.pool.mediaWays.net] has joined #openvpn
13:22 -!- xtro [~xtro@g231188017.adsl.alicedsl.de] has joined #openvpn
13:23 -!- xtro [~xtro@g231188017.adsl.alicedsl.de] has left #openvpn []
13:34 -!- noisebleed_ [~quassel@lula.inescn.pt] has quit [Ping timeout: 244 seconds]
13:41 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:41 -!- hyper__ch is now known as hyper_ch
13:41 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Disconnected by services]
13:44 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:54 -!- dazo is now known as dazo_afk
13:57 -!- Entomo [81531f01@gateway/web/freenode/ip.129.83.31.1] has quit [Quit: Page closed]
13:58 -!- ]R[ [Gonzo@hunting.bin-laden.biz] has quit [Remote host closed the connection]
14:00 < hyper_ch> !mtu
14:00 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
14:01 < hyper_ch> does mtu only work with udp or also tcp?
14:06 -!- Bruk0ut [~Bruk0ut@unaffiliated/brukout] has quit [Ping timeout: 252 seconds]
14:07 -!- Bruk0ut [~Bruk0ut@193.104.35.125] has joined #openvpn
14:07 <+EugeneKay> Of course it works with both
14:11 < hyper_ch> hmmm, I added mtu-test to the client config
14:11 < hyper_ch> where should I get the result?
14:11 < ecrist> did you read the link above?
14:11 < ecrist> the one you called from the bot?
14:11 < hyper_ch> that mtu debugging guide uses icmps
14:12 < hyper_ch> not the mtu-test of openvpn
14:13 < ecrist> did you read the man page?
14:14 < ecrist> --mtu-test
14:14 < ecrist> To empirically measure MTU on connection startup, add the --mtu-test option to your configuration. OpenVPN will send ping packets of various sizes to the remote peer and measure the largest packets which were successfully received. The --mtu-test process normally takes about 3 minutes to complete.
14:14 < hyper_ch> and where do I get the results?
14:15 < hyper_ch> it doesn't say there
14:15 < ecrist> try it
14:15 < ecrist> try it
14:15 < ecrist> you will see
14:15 < hyper_ch> I did
14:15 < hyper_ch> nothing happens
14:15 < ecrist> read the logs?
14:18 < hyper_ch> the log has some really, really long lines that make it very hard to scroll
14:19 -!- Bruk0ut [~Bruk0ut@193.104.35.125] has quit [Changing host]
14:19 -!- Bruk0ut [~Bruk0ut@unaffiliated/brukout] has joined #openvpn
14:19 -!- Bruk0ut [~Bruk0ut@unaffiliated/brukout] has left #openvpn []
14:19 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 252 seconds]
14:20 < hyper_ch> but besides that, nothing in there
14:21 < hyper_ch> now I got it
14:21 < hyper_ch> NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1541]
14:24 -!- ]R[ [Gonzo@hunting.bin-laden.biz] has joined #openvpn
14:25 <@vpnHelper> RSS Update - forum: VPN routing to LAN in tap <http://forums.openvpn.net/topic9425.html#p18655>
14:25 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
14:27 < hyper_ch> hmmm, still trying to figure out why perforamnce is so bad
14:28 -!- parabyte [~anonymous@li140-216.members.linode.com] has joined #openvpn
14:28 < parabyte> hello
14:28 < parabyte> :)
14:28 < parabyte> :)
14:28 < parabyte> hope all is well
14:28 < parabyte> im using openvpn for some bonding
14:29 < parabyte> openvpn session on each adsl connection and using linux bonding to bond them together
14:29 < parabyte> anyone got any tips to improve my available bandwidth
14:29 < parabyte> just want to squeeze abit more performance out of this
14:29 < hyper_ch> maybe that helps https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
14:29 <@vpnHelper> Title: Gigabit_Networks_Linux – OpenVPN Community (at community.openvpn.net)
14:32 < parabyte> each adsl connection is 6 megabits
14:32 < parabyte> im getting 10.50 megabits bond
14:35 < parabyte> hyper_ch, thanks looks interesting
14:38 < parabyte> how i change the tap mtu
14:39 < hyper_ch> I don't think you can
14:39 < parabyte> ifconfig mtu 
14:40 < parabyte> would that be the same
14:43 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18656>
14:43 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 240 seconds]
14:44 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has joined #openvpn
14:54 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
14:55 < hyper_ch> I think when the tun interface fails on one of my clients, it also deletes the default routes
15:08 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:10 -!- converge [~converge@unaffiliated/joaop] has joined #openvpn
15:46 -!- smeagle [c242af52@gateway/web/freenode/ip.194.66.175.82] has joined #openvpn
15:47 -!- smeagle [c242af52@gateway/web/freenode/ip.194.66.175.82] has left #openvpn []
16:03 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
16:11 -!- converge_ [~converge@187.55.221.96] has joined #openvpn
16:12 < converge_> im trying to setup a vpn client but im not able to connect to the server, can someone help me ? http://pastebin.com/WZ4SnxtW
16:12 -!- converge [~converge@unaffiliated/joaop] has quit [Quit: Linkinus - http://linkinus.com]
16:19 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:22 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit []
16:27 -!- converge_ [~converge@187.55.221.96] has quit [Quit: Linkinus - http://linkinus.com]
16:38 < biggi_mat> dazo_afk: http://pastebin.com/aic08Gm0  when you'll be around...
16:40 -!- andrew_ [~andrew@ip98-177-171-181.ph.ph.cox.net] has joined #openvpn
16:40 < andrew_> hi
16:40 < andrew_> can someone help me with a openvpn/routing issue
16:40 -!- andrew_ is now known as Guest32394
16:41 -!- caemir [~caemir@unaffiliated/caemir] has quit [Read error: Operation timed out]
16:43 -!- Guest32394 [~andrew@ip98-177-171-181.ph.ph.cox.net] has left #openvpn []
16:43 < |Mike|> gffa: 
16:43 < |Mike|> erm
16:44 < |Mike|> dipshit guesst
16:45 -!- hwgasdfasdf [~andrew@ip98-177-171-181.ph.ph.cox.net] has joined #openvpn
16:45 < hwgasdfasdf> ok, let me try again
16:45 < hwgasdfasdf> can someone help me with an openvpn/routing issue
16:45 < hwgasdfasdf> I have 2 client, each with a subnet
16:46 < hwgasdfasdf> a host on client 1's subnet can't ping something on client 2's subnet, but client 2 can ping the host
16:46 < hwgasdfasdf> looking at the traffic with tcpdump, the last place the traffic shows up is on the server's tun interface
16:46 < hwgasdfasdf> it never shows up on client 2's tun interface
16:47 < parabyte> hwgasdfasdf, read a few routing howto's
16:47 < parabyte> i had same issue i spent a whole day and read up on routing and sorted it out
16:47 < hwgasdfasdf> oh, trust me, I know how routing works
16:47 < parabyte> always ask god? lol
16:48 < parabyte> i never used tun with openwrt 
16:48 < parabyte> always bonded tap ;)
16:48 < hwgasdfasdf> the strange thing is client 2 can ping a machine on client 1's subnet
16:48 < hwgasdfasdf> but going the other way, the traffic stops at the tun interface on the server
16:49 < hwgasdfasdf> there's no iptables on the server
16:51 < |Mike|> topic please
16:52 < hwgasdfasdf> !pastebin
16:52 < hwgasdfasdf> oops
16:53 <@vpnHelper> Unable to download feed.
16:53 < |Mike|> lol
16:53 < rawplayer> :o
16:54 < hwgasdfasdf> !welcome
16:54 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:54 < hwgasdfasdf> !goal
16:54 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:55 < hwgasdfasdf> goal: connect 2 private subnets hanging off 2 different openvpn clients to the same server
17:00 < hwgasdfasdf> !pastebin http://pastebin.com/h7T9pxx2
17:00 <@vpnHelper> Error: 'http://pastebin.com/h7T9pxx2' is not a valid integer.
17:01 < hwgasdfasdf> what's the argument to pastebin?
17:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
17:02 < hwgasdfasdf> oh, I may have just noticed my problem
17:04 -!- parabyte [~anonymous@li140-216.members.linode.com] has quit [Ping timeout: 244 seconds]
17:04 < hwgasdfasdf> nope
17:04 < hwgasdfasdf> !pastebin
17:04 <@vpnHelper> Unable to download feed.
17:06 < |Mike|> krzie: 
17:07 < |Mike|> krzee: 
17:09 -!- parabyte [~anonymous@li140-216.members.linode.com] has joined #openvpn
17:09 < hwgasdfasdf> oh, yup, now I found my problem
17:09 < hwgasdfasdf> I'm such an idiot :(
17:11 <+EugeneKay> !paste
17:11 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
17:11 <+EugeneKay> No idea why !pastebin is broken.
17:19 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has joined #openvpn
17:20 < krzie> i do
17:21 < krzie> eric named the pastebin rss pastebin
17:21 < krzie> same reason !forum is broken
17:21 -!- gffa [~gffa@unaffiliated/gffa] has quit [Quit: sleep]
17:26 -!- eedy31 [~tborr@AToulouse-553-1-168-159.w92-156.abo.wanadoo.fr] has joined #openvpn
17:27 < eedy31> hi
17:28 <+EugeneKay> Ah.
17:35 -!- gyyrog [~gyyrog@66-227-134-70.dhcp.trcy.mi.charter.com] has quit [Remote host closed the connection]
17:35 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:43 -!- parabyte [~anonymous@li140-216.members.linode.com] has quit [Read error: Operation timed out]
17:48 -!- hwgasdfasdf [~andrew@ip98-177-171-181.ph.ph.cox.net] has left #openvpn ["Konversation terminated!"]
17:51 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
17:54 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18658> || How To Properly Use route and iroute? <http://forums.openvpn.net/topic9418.html#p18657>
17:57 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has joined #openvpn
17:57 < rave> I have this rule iptables -t nat -A PREROUTING -p udp -d serverip --dport 1:65535 -j DNAT --to-destination serverip:1194 and after setting it up, I cannot connect to my server using putty or bitvise tunnelier. please help
17:58 -!- parabyte [~anonymous@217.155.45.247] has joined #openvpn
17:59 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has quit [Client Quit]
17:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:26 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has joined #openvpn
18:27 < rave> TLS Error: unknown opcode received  <-- what should I do
18:36 -!- rave [7a022e4c@gateway/web/freenode/ip.122.2.46.76] has quit [Quit: Page closed]
18:48 -!- rave [~rave@184.22.182.246] has joined #openvpn
18:48 -!- ravemaster [~rave@122.2.46.76] has joined #openvpn
18:49 < ravemaster> TLS Error: unknown opcode received from 172.29.2.155:137 op=25 < - - what should I do guys. I googled but no answers there
18:52 -!- rave [~rave@184.22.182.246] has quit [Ping timeout: 268 seconds]
19:05 -!- Denial [Denial@drgi.co.uk] has quit []
19:05 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:26 -!- _julian_ [~quassel@hmbg-5f762afd.pool.mediaWays.net] has joined #openvpn
19:28 -!- _julian [~quassel@hmbg-4d06ad1d.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:28 -!- eedy31 [~tborr@AToulouse-553-1-168-159.w92-156.abo.wanadoo.fr] has left #openvpn []
19:49 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
19:51 < ravemaster> TLS Error: unknown opcode received from 172.29.2.155:137 op=25 < - - what should I do guys. I googled but no answers there
20:22 -!- master_of_master [~master_of@p57B54093.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
20:24 -!- master_of_master [~master_of@p57B53F46.dip.t-dialin.net] has joined #openvpn
20:33 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
20:34 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:49 -!- ravemaster [~rave@122.2.46.76] has quit []
21:12 -!- parabyte [~anonymous@217.155.45.247] has quit [Ping timeout: 240 seconds]
21:19 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:25 -!- parabyte [~anonymous@li300-122.members.linode.com] has joined #openvpn
22:07 -!- parabyte [~anonymous@li300-122.members.linode.com] has quit [Quit: Leaving]
22:20 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
22:26 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
22:27 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:54 <@vpnHelper> RSS Update - forum: whats wrong with my config <http://forums.openvpn.net/topic9352.html#p18659>
22:55 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
23:00 <@vpnHelper> RSS Update - forum: [HELP] Could someone please help me (portforwarding) <http://forums.openvpn.net/topic9426.html>
23:09 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
23:16 < hyper_ch> hi krzie
23:48 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Read error: Connection reset by peer]
23:49 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
23:54 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
--- Day changed Tue Dec 20 2011
00:00 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has quit [Read error: No route to host]
00:06 <@vpnHelper> RSS Update - forum: Can Connect a Client but Cannot Access Web Pages <http://forums.openvpn.net/topic9422.html#p18662> || Internal / External LAN-Interface on openVPNas <http://forums.openvpn.net/topic9421.html#p18661>
00:21 -!- rave [~rave@122.2.46.76] has joined #openvpn
00:30 < rave> guys, I would like to ask what is the use of socks-proxy directive?
00:30 <@vpnHelper> RSS Update - forum: Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18663> || Would You Use A VPN Provider That Gives You A Static IP? <http://forums.openvpn.net/topic9386.html#p18515>
00:37 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18664>
00:37 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
00:37 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
01:06 < rave> I would like to state again - guys, I would like to ask what is the use of socks-proxy directive?
01:11 -!- rave [~rave@122.2.46.76] has quit []
01:22 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
01:25 <@vpnHelper> RSS Update - forum: Need help with OpenVPN client connecting to server <http://forums.openvpn.net/topic9427.html>
01:43 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
01:49 <@vpnHelper> RSS Update - forum: tun up problem <http://forums.openvpn.net/topic9428.html>
01:55 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
02:13 <@vpnHelper> RSS Update - forum: Help: Openvpn server suddenly stopped working <http://forums.openvpn.net/topic9416.html#p18668> || OpenVPN Clients Automation <http://forums.openvpn.net/topic9129.html#p18667>
02:19 <@vpnHelper> RSS Update - forum: Need help with OpenVPN client connecting to server <http://forums.openvpn.net/topic9427.html#p18669>
02:36 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
02:36 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
02:42 -!- dazo_afk is now known as dazo
02:44 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
02:47 <@dazo> biggi_mat: where is your database located?  and have you given a full path to it in the openvpn config file?  And have you read the yellow note here?  http://www.eurephia.net/documentation/eurephia/1.0/html/Administrators_Tutorial_and_Manual/chap-Administrators_Manual-ConfigOVPN_Chapter.html#id613681
02:47 <@vpnHelper> Title: Chapter 6. Configure OpenVPN (at www.eurephia.net)
02:47 <@dazo> biggi_mat: that's the common errors in this case
02:49 <@vpnHelper> RSS Update - forum: [HELP] Could someone please help me (portforwarding) <http://forums.openvpn.net/topic9426.html#p18670>
02:50 < biggi_mat> dazo: my database is located in /etc/openvpn/eurephiadb (which is the default I think?). The full path has been given in server.conf where the plugin is defined.
02:50 < biggi_mat> Oh, yellow note about the temporary files
02:50 < biggi_mat> That _may_ be it
02:51 < biggi_mat> Let's see!
02:51 <@dazo> biggi_mat: yeah ... The default is to move this db til /var/lib/eurephia/eurephiadb ... I'd recommend you to do the same
02:51 < biggi_mat> I can try!
02:51 <@dazo> then the /var/lib/eurephia directory can have the proper write access
02:51 <@dazo> (without compromising /etc/openvpn)
02:54 < biggi_mat> dazo: seems this was indeed it. Thank you very much
02:54 < biggi_mat> dazo: one more thing that goes through my mind: is it possible to not have auth-user-pass with eurephia?
02:54 < biggi_mat> I seem to have missed this answer on google
02:54 <@dazo> biggi_mat: you're welcome! :)  This happened after SQLite 3.7 (or 3.6?) ... and it drove me mad until I figured out the change :)
02:54 <@vpnHelper> RSS Update - forum: Virtual Appliance DHCP DNS server??? <http://forums.openvpn.net/topic9429.html> || Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18672> || tun up problem <http://forums.openvpn.net/topic9428.html#p18671>
02:54 < biggi_mat> Hehe :)
02:55 < biggi_mat> I belive you, it's quite a hidden one :)
02:55 <@dazo> biggi_mat: no, eurephia is to provide user/password auth ... but if you do the typical "PAM way" or other scripts/plug-ins, they don'
02:56 < biggi_mat> Alright, I guess it's not such big of a deal
02:56 <@dazo> don't check the certificates against the user account .... so Jane Doe could use John Doe's certificate and her username/password and still get access
02:56 <@dazo> (or wise versa)
02:59 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
02:59 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
02:59 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
02:59 <@vpnHelper> RSS Update - forum: Server code modification to allow the cipher to be optional <http://forums.openvpn.net/topic9423.html#p18674>
03:00 -!- janjust [~janjust@openvpn/community/support/janjust] has left #openvpn []
03:02 < biggi_mat> dazo: I won't quit bugging you just yet, unfortunately :(
03:02 <@dazo> biggi_mat: hehe ... that's the challenge of being an open source developer ;-)
03:02 <@dazo> biggi_mat: bug me all you want and need :)
03:04 < biggi_mat> dazo: okay :)
03:04 < biggi_mat> http://pastebin.com/Pj375mCz ->this is puzzlin me
03:05 <@dazo> biggi_mat: you probably haven't read the documentation too well ;-) .... read this chapter and you'll probably see the bigger picture ;-) http://www.eurephia.net/documentation/eurephia/1.0/html/Administrators_Tutorial_and_Manual/chap-Administrators_Manual-UserAccessMgmt_Chapter.html
03:05 <@vpnHelper> Title: Chapter 7. User and access management (at www.eurephia.net)
03:05 < biggi_mat> Alrighty, I probably should pay more attention to documentation indeed :< 
03:06 < biggi_mat> Thanks for now :<
03:06 <@dazo> this one hits your particular error: http://www.eurephia.net/documentation/eurephia/1.0/html/Administrators_Tutorial_and_Manual/usrmgmt_reg_usercertlink.html
03:06 <@vpnHelper> Title: 7.3.2.3. Registering a user-certificate link - finalising the user access (at www.eurephia.net)
03:07 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
03:07 < biggi_mat> Yeah...obviusly..god, I hate being this superficial
03:08 <@dazo> :)
03:08 < biggi_mat> Wierd thing though, I added it but for now it isn't working. I'll play around with it more
03:09 <@dazo> biggi_mat: did you activate the user account as well?
03:10 < biggi_mat> Of course not :)
03:10 <@dazo> you'll find it in the following sections of the docs ;-)
03:10 < biggi_mat> :)
03:18 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 240 seconds]
03:18 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:20 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
03:25 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 245 seconds]
03:28 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
03:28 < hyper_ch> good morning dazo
03:28 <@dazo> good morning :)
03:28 < hyper_ch> I still have routing issues
03:29 < hyper_ch> btw, I noticed that when the connection gets severed somehow, the default gateway also gets removed
03:29 < hyper_ch> but I don't know why
03:31 < hyper_ch> I'll show you logs
03:32 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 248 seconds]
03:32 < hyper_ch> dazo: http://pastebin.com/CeL3zzda
03:33 <@dazo> hyper_ch: you mean these two lines?
03:33 <@dazo> #
03:33 <@dazo> #
03:33 <@dazo> Mon Dec 19 21:53:50 2011 us=860644 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
03:33 <@dazo> #
03:33 <@dazo> Mon Dec 19 21:53:50 2011 us=861349 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
03:34 < hyper_ch> I thought that's the issue Mon Dec 19 21:53:50 2011 us=859915 /sbin/route del -net 91.121.147.34 netmask 255.255.255.255
03:34 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
03:34 -!- Kanyl [~on@unaffiliated/kanyl] has quit [Remote host closed the connection]
03:34 -!- Kanyl [~on@unaffiliated/kanyl] has joined #openvpn
03:35 <@dazo> ahh, no, not really ... that route is the route to make sure the OpenVPN client can access the OpenVPN server - despite the default gw being changed
03:35 <@dazo> and when using 'def1' .... you get those two extra routes which are deleted (which I pasted here)
03:35 < hyper_ch> well, those are the logs entry after I altered the server config and then this client wouldn't reconnect
03:36 <@dazo> unless the original default gw isn't deleted ... which would be 0.0.0.0/0.0.0.0 .... then it should be able to connect
03:36 < hyper_ch> one more thing, can I add routes for 10.8.1.0 and 10.8.2.0
03:36 < hyper_ch> and then add def1
03:36 <@dazo> yeah, that's no problem .... that's just explicit routes
03:36 < hyper_ch> so that those subnets are still routed thhrough accordingly?
03:37 <@dazo> yeah
03:37 < hyper_ch> then I'll do a trible setup
03:37 < hyper_ch> udp
03:37 < hyper_ch> tcp
03:37 < hyper_ch> and tcp no-delay
03:37 < hyper_ch> and I can then easily switch to whatever seems to work best
03:37 <@dazo> when a packet hits the routing table ... It will start on the top of the routing table ... if it matches the network+subnet, it will send the packet to the defined gw ... if no match, it goes to the next line
03:38 < hyper_ch> and the default gw is "the last" entry through which all packages are routed that are not specified above, right?
03:38 < hyper_ch> hence the two "internet-wide" rules above the default gw will always be a hit?
03:39 <@dazo> the default gw is usually defined like this: 0.0.0.0         192.168.3.1       0.0.0.0         UG    0      0        0 eth0
03:39 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 244 seconds]
03:39 <@dazo> and that's the trick with 'def1' ... as it adds two extra routes instead of rewriting this route
03:39 < hyper_ch> I see
03:40 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
03:40 < hyper_ch> btw, what's another good tcp port besides 1194?
03:40 <@dazo> it adds 0.0.0.0 netmask 128.0.0 ..... and 128.0.0.0 netmask 128.0.0.0 .... which then is effectively the same as 0.0.0.0/0.0.0.0 .... but it won't delete the default gw if openvpn stops
03:40 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
03:40 <@dazo> hyper_ch: which ever port which is not too commonly used for other services :)
03:41 < hyper_ch> ok :)
03:41  * dazo never uses default ports for OpenVPN nor SSH
03:41 < hyper_ch> why not?
03:41 <@dazo> to avoid port scan attacks
03:41 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
03:41 <@vpnHelper> RSS Update - forum: Server code modification to allow the cipher to be optional <http://forums.openvpn.net/topic9423.html#p18676> || Need help with OpenVPN client connecting to server <http://forums.openvpn.net/topic9427.html#p18675>
03:41 < hyper_ch> :)
03:41 < hyper_ch> btw, how to revoke that cert I setup for you?
03:42 <@dazo> if port 1194 or port 22 is open .... and and many scanners knows about these ports and the service being used there .... you'll get more interesting 
03:42 <@dazo> Did you use easy-rsa?
03:42 < hyper_ch> yes
03:42 <@dazo> hyper_ch: You use the revoke-full script
03:43 <@dazo> then you get a crl.pem file ... which you then need to add to the OpenVPN config
03:43 < hyper_ch> I did now ./revoke-full dazo
03:44 < hyper_ch> error 23 at 0 depth lookup:certificate revoked
03:44 <@dazo> that's an interesting message ....
03:44 < hyper_ch> http://pastebin.com/ecDLDYCR
03:45 <@dazo> I think that's a clean message ... try: openssl crl -in crl.pem -noout -text
03:46 <@vpnHelper> RSS Update - forum: Advice on openvpn deployment <http://forums.openvpn.net/topic9411.html#p18677>
03:47 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:47 < hyper_ch> dazo: http://pastebin.com/QDgdBzC6
03:48 < hyper_ch> it seems to be revoked
03:48 < hyper_ch> now adding it to server conf?
03:49 <@dazo> hyper_ch: it sure does .... so it should just be to reload openvpn with 'crl crl.pem' .... and that's it :)
03:49 < hyper_ch> btw, in the config files, can you do a clue?
03:49 < hyper_ch> can you due an include?
03:49 <@dazo> yeah ... use 'config common.conf'
03:49 < hyper_ch> when I run three instances of the server, most config options are the same
03:49 < hyper_ch> sweet :)
03:50  * hyper_ch gives dazo a big, chocolated coated cookie
03:50 <@dazo> mmmmmmmmm
03:50 <@dazo> hyper_ch: you can buy one to me at fosdem in February :-P
03:50 < hyper_ch> but won't openvpn parse common.conf on it's own?
03:50 < hyper_ch> I thought openvpn loads all .confs in the dir
03:50 < hyper_ch> or at least the init script does
03:50 < hyper_ch> so I could rename it differently?
03:50 <@dazo> hyper_ch: well, call it common.inc :)
03:51 < hyper_ch> sweet
03:51 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 255 seconds]
03:52 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
03:53 < hyper_ch> one more things, have configs to be in a given order or something?
03:55 <@dazo> nope ... openvpn reads things in the order you give them .... so if you set the same parameter several times, it's the last one which counts
03:57 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 244 seconds]
03:58 < hyper_ch> I see
03:59 < hyper_ch> this could be a common.inc
03:59 < hyper_ch> http://pastebin.com/dzFfAPa9
03:59 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
03:59 <@dazo> yeah, definitely
04:01 < hyper_ch> verb 5 and mute 50 added
04:01 <@dazo> verb 5 is very verbose though
04:01  * dazo usually uses verb 3 or verb 4 
04:01 < hyper_ch> well, I have logs disabled by default
04:02 <@dazo> ahh, okay ... then it makes somewhat more sense
04:02 < hyper_ch> and this can be the server.conf  http://pastebin.com/rGhM67UB
04:02 < hyper_ch> (or one of them)
04:03 < hyper_ch> btw, can you actually use variables in the config?
04:03 <@dazo> yeah
04:03 <@dazo> no, no variables ... but I've been thinking about it
04:03 <@dazo> would actually be cool if the config could be lua scripts or something similar ... so you can do 'if' statements and such things
04:03 < hyper_ch> because I differentiate by logs and ccds using  _DESCRIPTION
04:03 <@dazo> yeah
04:04 < hyper_ch> so if I coulde set a var in the main server conf
04:04 < hyper_ch> I could even more offload to the common.inc
04:09 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit [Ping timeout: 268 seconds]
04:09 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has joined #openvpn
04:11 < hyper_ch> hmmm, looking at the wikipedia list of ports used
04:11 < hyper_ch> 123 UDP is for NTP
04:11 < hyper_ch> so I guess I can use 123 TCP
04:12 < hyper_ch> or 161
04:16 < Olipro> TCP for OpenVPN?
04:17 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 245 seconds]
04:17 < hyper_ch> Olipro: yes
04:18 < Olipro> that's a very bad idea
04:19 < hyper_ch> I know
04:19 < Olipro> unless you're running it over TCP because someone will hunt you down and flay you if they discover you're using a VPN, don't
04:19 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
04:20 < hyper_ch> Olipro: I know
04:20 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html>
04:25 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Ping timeout: 240 seconds]
04:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:39 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:51 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
04:51 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
04:56 -!- hyper_ch [~hyper_ch@144-97.78-83.cust.bluewin.ch] has joined #openvpn
04:56 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18679>
04:57 < hyper_ch> dazo: why do I get:   16:28695 CRL: cannot read: ./easy-rsa2/keys/crl.pem: Permission denied (errno=13)
04:57 < hyper_ch> it's in the same folder as the other keys
04:57 < hyper_ch> and permissions are 644
04:57 < hyper_ch> (as are the other keys
04:57 <@dazo> hyper_ch: I would actually move that crl file to where you have your configs
04:58 < hyper_ch> dazo: I have all certs and keys there
04:58 <@dazo> well, but openvpn doesn't care about those certs and keys (unless the server cert and key are used from that dir)
05:00 < hyper_ch> dazo: that's why I did add the path
05:00 <@dazo> hmm .... I dunno
05:01 < hyper_ch> http://pastebin.com/gM7RG78F
05:01 < hyper_ch> it works for the rest
05:02 <@dazo> in general having CA key on the same box as your openvpn server insn't a clever thing ... so I usually just have all the CA stuff on a different box ... and just have ca.crt, server.crt, server.key and optionally the crl file on the openvpn server ... so I honestly don't know ...
05:02 <@vpnHelper> RSS Update - forum: WARNING: Failed running command (--up/--down): external prog <http://forums.openvpn.net/topic9431.html>
05:02 <@dazo> hyper_ch: and there are no chroot involved?
05:02 <@dazo> (via init.d scripts)
05:03 < hyper_ch> dazo: the init script alters user and group to openvpn
05:03 < hyper_ch> does the clr.pem need write access?
05:03 <@dazo> no, shouldn't need that .... that's a signed file ... (signed with the CA key)
05:03 <@dazo> so modifying would just break it
05:04 < hyper_ch> -rw-r--r-- 1 root root 1188 2009-08-16 15:31 ca.crt
05:04 < hyper_ch> -rw------- 1 root root  887 2009-08-16 15:31 ca.key
05:04 < hyper_ch> -rw-r--r-- 1 root root  508 2011-12-20 10:43 crl.pem
05:04 < hyper_ch> again I have the problem that the other server isn't reconnecting
05:05 < hyper_ch> maybe I should use IP address instead of hostname?
05:05 <@dazo> hmm ... you probably need to use strace to see what happens
05:05 <@dazo> on the other server, using IP might make sense yeah ... if it is dns lookup it fails at
05:05 < hyper_ch> dazo: how can I strace it?
05:06 < hyper_ch> as soon as I reset the vpn or alter some settings
05:06 < hyper_ch> I can access that other box anymore
05:06 < hyper_ch> s/can/can't/
05:06 < hyper_ch> I'll change it to the IP
05:06 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
05:07 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
05:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
05:08 <@vpnHelper> RSS Update - forum: WARNING: Failed running command (--up/--down): external prog <http://forums.openvpn.net/topic9431.html#p18681>
05:09 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
05:09 -!- hyper_ch [~hyper_ch@144-97.78-83.cust.bluewin.ch] has quit [Disconnected by services]
05:09 -!- hyper__ch is now known as hyper_ch
05:09 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:09 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:09 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:09 -!- hyper__ch [~hyper_ch@144-97.78-83.cust.bluewin.ch] has joined #openvpn
05:09 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Disconnected by services]
05:09 -!- hyper__ch is now known as hyper_ch
05:11 < hyper_ch> hmmm
05:11 < hyper_ch> weird
05:12 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
05:12 -!- hyper_ch [~hyper_ch@144-97.78-83.cust.bluewin.ch] has quit [Disconnected by services]
05:12 -!- hyper__ch is now known as hyper_ch
05:12 -!- hyper__ch [~hyper_ch@144-97.78-83.cust.bluewin.ch] has joined #openvpn
05:12 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has quit [Disconnected by services]
05:12 -!- hyper__ch is now known as hyper_ch
05:13 -!- hyper_ch [~hyper_ch@144-97.78-83.cust.bluewin.ch] has quit [Remote host closed the connection]
05:13 -!- hyper__ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
05:13 -!- hyper__ch is now known as hyper_ch
05:13 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18682>
05:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:16 < hyper_ch> now I think I have it again
05:18 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
05:18 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
05:23 < hyper_ch> !clr-verfify
05:25 < janjust> !crl-verify
05:26 < janjust> eh? that topic is missing?
05:26 < janjust> !cert
05:26 < janjust> !welcome
05:26 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:26 < hyper_ch> janjust: I have a problem with crl-verify.... ovpn complains about it not being able to read
05:26 < hyper_ch> yet permissions are 0644 root:root
05:26 < janjust> is the CRL valid? is openvpn runnign as root or as another user?
05:27 < hyper_ch> crl is valid... i think... I did use the easy-rsa revoke script
05:27 < hyper_ch> and ovpn gets set to "openvpn" user and group
05:27 < janjust> try running 'openssl crl -text -noout -in <full path to CRL>'
05:27 < hyper_ch> the other certs, with same permissions and same location, are read fine
05:27 < janjust> make sure the directory in which the CRL sits is accessible to the user openvpn
05:28 < hyper_ch> that might be the rpoblem
05:28 < hyper_ch> the keys folder isn't accessbile
05:29 < janjust> yep, and the crl is generated by default in that directory; you'll need to copy it over to another dir
05:29 < janjust> just like you've done for the .crt and .key files
05:30 < hyper_ch> but why doesn't it complain about the ca and other files?
05:30 -!- converge [~converge@unaffiliated/joaop] has joined #openvpn
05:30 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
05:32 < janjust> because you copied them over ?
05:32 < hyper_ch> janjust: no
05:32 < janjust> so you're using the full path to the 'keys' folder for ca, cert, and key?
05:33 < hyper_ch> yes
05:33 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
05:33 < hyper_ch> well, not full path
05:33 < janjust> hmmm then the CRL should also be accessible
05:33 < hyper_ch> suing   ./easy-rsa/keys/ca.crt
05:33 < janjust> oh but wait... makes sense
05:33 < janjust> the ca, cert and key files are read at startup *by root*
05:33 < janjust> the CRL is not
05:34 < hyper_ch> ah.... ok
05:34 < janjust> so root can read the files, then privs are dropped and the CRL is inaccessible
05:34 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:34 < janjust> a quick&dirty trick is to link the file , e.g. 'cd easy-rsa ; ln keys/crl.pem
05:34 < janjust> the file easy-rsa/crl.pem is then accessible 
05:34 < hyper_ch> or using full path?
05:35 < janjust> won't work - the keys directory is not accessible to the user openvpn, with or without full path
05:37 < hyper_ch> then I'll just copy the crl.pem into the openvpn folder
05:37 < janjust> that's also fine, but you'd need to do that every time you update the CRL
05:38 < hyper_ch> I don't intend to revoke many certs :)
05:38 < janjust> hehe, keep in mind that CRLs have a life span (listed in the output of -text)
05:38 < hyper_ch> that means?
05:39 < janjust> the normal period for easy-rsa is 1 year
05:39 < hyper_ch> time for lunch
05:39 < janjust> it means that after the CRL has expired ALL clients will be refused access
05:39 < hyper_ch> not sure if I follow you
05:40 < hyper_ch> if I revoke just a single cert
05:40 < hyper_ch> all others should still be fine, right?
05:40 < janjust> yep, UNLESS the CRL has expired - that's the downside of using CRLs
05:40 < janjust> so once you start using CRLs you have to make sure they remain valid
05:44 <@dazo> eek ... I wasn't aware of that ... that's something which should be emphasized clearer in the docs if it's not there already
05:44 < janjust> there are more issues with CRLs
05:45 < janjust> you can't stack em (I always thought you could) ; openvpn breaks if it cannot read the CRL when a client connects
05:45 <@dazo> yeah, the stacking is nasty
05:45 -!- Damascene [~house@unaffiliated/uaa] has joined #openvpn
05:46 < Damascene> Hi, I'm trying to use the openvpn that is bundled with pfsense and I get these errors: http://fpaste.org/SmW4/ 
05:46 < janjust> note that this is not openssl related, polarssl is just as nasty, even nastier
05:47 <@dazo> Damascene: VERIFY ERROR: depth=0, error=self signed certificate   .... that's the problem
05:47 <@dazo> Damascene: you can't use self-signed certificates with OpenVPN
05:47 < janjust> Damascene:  it seems you don't have the right ca cert loaded for your server
05:49 < Damascene> :S
05:50 < Damascene> that certificate is the one for Web Configuration that comes with pfsense. the other certificate which I generated at the client side is not shown
05:50 < Damascene> even though I installed it there
05:51 < janjust> make sure the openvpn server process on the pfsense box uses the cert generated on the client side
05:51 < janjust> don't know how the pfsense gui does that
05:52 < Damascene> is there some command I can run to know that/
05:52 < Damascene> ?
05:53 < janjust> dunno, I'm not familar with pfsense
05:54 < Damascene> what would you do to know it if you where on Linux?
05:54 -!- noisebleed_ [~quassel@kermit.inescn.pt] has joined #openvpn
05:55 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
05:55 < janjust> Damascene:  just use YourFavSearchEngine: http://doc.pfsense.org/index.php/VPN_Capability_OpenVPN
05:55 <@vpnHelper> Title: VPN Capability OpenVPN - PFSenseDocs (at doc.pfsense.org)
05:56 < Damascene> :) that one is for version 1.2 of the software (pfSense) I'm on version 2, thank you any way
05:58 < Damascene> could some one check if my client configuration is working? http://fpaste.org/oggi/
06:01 < Damascene> It's now seeing server certificate with other errors. the previous error was my mistake
06:04 < Damascene> "unsupported certificate purpose"???
06:06 < janjust> Damascene:  how did you generate the server cert? try the client config without 'ns-cert-type server'
06:13 -!- takamichi [~pri@c127-2.i07-32.onvol.net] has quit []
06:17 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Read error: Connection reset by peer]
06:17 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
06:24 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
06:24 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:25 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
06:26 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
06:31 <@vpnHelper> RSS Update - forum: WARNING: Failed running command (--up/--down): external prog <http://forums.openvpn.net/topic9431.html#p18683>
06:38 -!- rave [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has joined #openvpn
06:39 < rave> dazo and all, I would like to ask what is the purpose of socks-proxy directive?
06:40 <@dazo> rave: do you need to use a SOCKS proxy to access the Internet?
06:41 < hyper_ch> janjust: expiring and not stacking?
06:41 < rave> I may need to.  I have not used it ever since. I used http proxy though. 
06:41 < hyper_ch> !socks-proxy
06:42 <@dazo> rave: --socks-proxy is needed when you need to use a SOCKS based proxy to access the Internet .... --http-proxy is used instead of --socks-proxy if you need to use an HTTP proxy to access the Internet
06:42 <@vpnHelper> RSS Update - forum: Internal / External LAN-Interface on openVPNas <http://forums.openvpn.net/topic9421.html#p18684>
06:43 < rave> dazo, I was wondering because setting up ssh and using putty says it does makes socks5 proxy. i was wondering if socks-proxy could wrapped the vpn traffic. still this same problem that I am looking forward to find a solution, sorry if I need to ask if I am right.
06:44 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
06:44 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
06:44 <@dazo> rave: don't do that ... you'll still get the TCP-over-TCP issues, which will make you cry in the end ... --socks-proxy and --http-proxy requires OpenVPN to be in TCP mode (iirc) so you'll just add another layer of TCP wrapping, and it will make you suffer
06:45 <@dazo> those features are not there to improve anything else than making connectivity work when there are no other options available
06:45 <@dazo> !tcp
06:45 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
06:45 < rawplayer> dazo: thats easy to say
06:45 < rawplayer> sometimes there is no other option
06:45 < rave> I forgot to mention about last time that I used vpn with ssh over ssl with stunnel that made me cry. :)      I was hoping if you can give me input about using vpn over stunnel only.
06:45 < rawplayer> because of corporate policy and network setup
06:46 <@dazo> rawplayer: as I said .... it's only available there to be used when there are no other options available ...
06:47 < rave> I dont know how to put in the ovpn file the connect ip and port stunnel.conf
06:48 < rawplayer> dazo: i didnt read that
06:48 < rawplayer> sorry
06:48 <@dazo> rave: openvpn over anything is going to hurt you, some way or another ... and that's questions related to stunnel needs to go to the stunnel community .... here people know openvpn
06:48 < rave> do you know a channel of stunnel 
06:49 <@dazo> rave: do I look like Google?
06:49 < rawplayer> :P
06:49 < rave> nope ;)  
06:49 < rawplayer> try ##networking
06:49 < rave> ok
06:50 < janjust> hyper_ch:  that was about CRLs : they cannot be stacked and you need to keep them up to date
06:51 -!- rave [b816b6f6@gateway/web/freenode/ip.184.22.182.246] has left #openvpn []
06:51 < hyper_ch> but what do you mean by they cannot be stacked?
06:51 < hyper_ch> and why would a crl expire?
06:51 < janjust> hyper_ch:  it's possible to support multiple CA'
06:51 < janjust> by stacking the ca.pem files
06:52 < janjust> unfortunately that does not apply to CRL files
06:52 < hyper_ch> so only one crl.pem file per CA
06:52 < janjust> and ALL CRLs expire - just run 'openssl crl -text -noout -in CRL.pem' to see the expiration date
06:52 < janjust> nope hyper_ch : you can use multiple CAs but only the CRL for one of them
06:53 < hyper_ch> ok
06:53 < janjust> if you need to support many CAs and their CRLs you're better off using --capath
06:54 < hyper_ch> na, no need for that
06:54 < hyper_ch> but I'm still buffled about expiring revocation
06:54 < janjust> it's not the revocation that expires; it's the CRL itself that expires
06:54 < hyper_ch> (still stupid)
06:55 <@dazo> it's to enforce admins to make sure the CRLs are up-to-date ;-)
06:55 < hyper_ch> but aren't admins lazy
06:55 <@dazo> exactly ;-)
06:56 <@dazo> "I rest my case" ;-)
06:56 < hyper_ch> but making them do extra works goes about their ethos :)
06:56 <@dazo> :)
06:57  * dazo heads out for lunch
06:57 < hyper_ch> s/about/against/
06:57  * janjust signing off
06:57 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
06:57 < hyper_ch> bye jan
06:58 -!- dazo is now known as dazo_afk
06:58 <@vpnHelper> RSS Update - forum: Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18685>
06:58  * hyper_ch steals dazo's lunch
07:00 < biggi_mat> Hey again, back to this "project" of mine - Tue Dec 20 13:55:10 2011 us=811711 10.1.1.234:54033 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /opt/openvpn/eurephia/current/lib/eurephia/eurephia-auth.so <<- this fail should...mean what? I'm quite sure passwords were correct
07:01 < biggi_mat> Oh, by the way -it says "attempt from blacklisted Username" but checking eurephiadm blacklist --list shows empty list
07:04 < Damascene> I've removed ns-cert-type server from client config but client keep saying "unsupported certificate purpose" I've followed this guide to generate the certificate http://doc.pfsense.org/index.php/VPN_Capability_OpenVPN
07:04 <@vpnHelper> Title: VPN Capability OpenVPN - PFSenseDocs (at doc.pfsense.org)
07:09 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18686>
07:11 < Damascene> this is a cool add-on on your forum
07:17 < hyper_ch> !howto
07:17 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:17 < hyper_ch> Damascene: the howto has a link regarding certificate generation
07:18 < Damascene> while I was generating it asked me for password, what is that for?
07:18 < hyper_ch> you can protect a cert with a password
07:19 < hyper_ch> then, whenever the cert is being accessed, a password must be supplied
07:20 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit []
07:26 < Damascene> what is KEY_CN?
07:27 < Damascene> is there some guide for those  mysterious thing?
07:27 < Damascene> things
07:29 < hyper_ch> where do you see that?
07:29 < Damascene> in vars.bat
07:29 < hyper_ch> that sounds like windows
07:30 < Damascene> yes, I know and I hate it, but the world is not a perfect place :)
07:31 < hyper_ch> key_cn isn't in mine
07:32 < ecrist> KEY_CN is what CN is used for the KEY
07:32 < ecrist> it's an openssl env var
07:32 < ecrist> man openssl
07:32 < hyper_ch> ecrist: my vars doesn't contain that
07:32 < ecrist> iirc, I use it for ssl-admin
07:32 < hyper_ch> btw, what is tsl-auth good for?
07:33 < Damascene> man openssl does not contain the letters CN
07:33 < hyper_ch> !tls-auth
07:33 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to make
07:33 <@vpnHelper> the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
07:33 < hyper_ch> tls-auth - does it offer any improvement in speed?
07:34 < ecrist> http://www.openssl.org/docs/apps/config.html
07:34 <@vpnHelper> Title: OpenSSL: Documents, config(5) (at www.openssl.org)
07:34 < ecrist> Damascene: since you're incapable of using google.
07:35 < Damascene> https://encrypted.google.com/search?hl=ar&client=ubuntu&hs=n5f&channel=fs&q=KEY_CN&oq=KEY_CN&aq=f&aqi=&aql=&gs_sm=e&gs_upl=576024l576145l0l576341l2l2l0l0l0l0l0l0ll0l0
07:35 <@vpnHelper> Title: KEY_CN - بحث Google‏ (at encrypted.google.com)
07:35 < Damascene> I'm
07:35 < Damascene> but look at the results
07:36 < Damascene> and where exactly CN in the link you gave me?
07:38 < hyper_ch> ecrist: google is known to hate some people
07:39 < ecrist> apparently
07:40 < hyper_ch> it hates me
07:40 < hyper_ch> usually when I should look something up before asking.... but honestly, it jsut hates me
07:40 < ecrist> Damascene: read the script that has that, you'll see it is used to set some other variable
07:40 < ecrist> generally, KEY_CN is used to set the default common name
07:41 < biggi_mat> Why would this be printed in the log? It kind makes little sense to me... Tue Dec 20 14:39:32 2011 us=267000 VERIFY OK: depth=0, /C=SI/ST=SL/L=test/O=test/CN=gw/emailAddress=test@test Tue Dec 20 14:39:36 2011 us=276000 TCP/UDP: Closing socket
07:41 < Damascene> thank you
07:42 < ecrist> biggi_mat: line 1 is saying that the certificate listed is valid.  the second line is indicating the socket is closed
07:42 < ecrist> I'm guessing they're printed to the log since both things are true
07:45 -!- biggi_mat [c15ff27e@gateway/web/freenode/ip.193.95.242.126] has quit [Ping timeout: 258 seconds]
08:05 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has joined #openvpn
08:07 < Damascene> http://fpaste.org/n244/ new errors, this is pfsense log
08:08 < ecrist> seems pretty straight forward to me
08:09 < Damascene> let me get the log from the client
08:09 < ecrist> the time on the machine that created the certificates is ahead of the clock you're running that openvpn on
08:09 < ecrist> VERIFY ERROR: depth=1, error=certificate is not yet valid:
08:09 < Damascene> errr
08:09 < ecrist> that tells you right there
08:10 < Damascene> that is windows fault
08:10 < ecrist> well, that's your fault
08:10 < ecrist> even windows will keep time with an NTP server
08:10 < Damascene> well, if it just understand hardware clock as linux does then there would be no problem
08:11 < Damascene> it's dual boot system
08:11 < ecrist> windows does hardware clock just fine, and even deals well with a hardware clock set to UTC
08:12 -!- pielgrzym [~pielgrzym@31-187-4-194.home.aster.pl] has joined #openvpn
08:12 < Damascene> ok, I'll try to fix that
08:12 < pielgrzym> hello
08:12 < ecrist> hi pielgrzym 
08:14 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
08:14 < pielgrzym> I have a machine: production01, with vpn for administrative purposes and port 80 for outside world to serve stuff. Now I figoured I can run a reverse proxy with nginx to a machine that is occupying 10.8.0.8 address in vpn network so I could forward my django testserver to an outside world domain easy to use by clients. Now the question is - it this a huge security risk? What are the possible attack vectors enabled by such configuration?
08:15 < pielgrzym> 10.8.0.8 is my laptop fixed ip when it connects to vpn
08:16 -!- rix1234 [~dks@114.143.161.178] has joined #openvpn
08:16 < pielgrzym> this enables me to show instantly the changes to coworkers/clients not being restrained to certain location/ip and without inconvenient ip based urls
08:17 < pielgrzym> the proxy is secured by normal http auth, when my laptop is not connected to vpn the proxy is down
08:17 < rix1234> Hi all...is it necessary that the vpn server needs two interface cards?
08:17 < ecrist> rix1234: no
08:18 < pielgrzym> only attack vector I see is to compromise the developed application via reverse proxy and continue attacking from my laptop directly
08:19 <@vpnHelper> RSS Update - forum: Multiple clients on OpenVPN - Routing Issue <http://forums.openvpn.net/topic9387.html#p18687>
08:26 -!- biggi_mat [c15ff27e@gateway/web/freenode/ip.193.95.242.126] has joined #openvpn
08:32 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:34 -!- Irssi: #openvpn: Total of 136 nicks [4 ops, 0 halfops, 2 voices, 130 normal]
08:35 -!- mode/#openvpn [+o ecrist] by ChanServ
08:37 < rix1234> ecrist, so would the vpn server be accessible to both networks...I am setting up a vpn network in my local LAN?
08:37 -!- converge [~converge@unaffiliated/joaop] has left #openvpn ["Linkinus - http://linkinus.com"]
08:37 <@ecrist> well, I know nothing of your network setup
08:45 -!- Splex_ [~splex@n219079143223.netvigator.com] has joined #openvpn
08:45 < biggi_mat> Hello again. Why would I be getting TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned ? I am connecting to openvpn server with eurephia with openvpn client, client having p12 cert
08:46 < hyper_ch> what's eurephia?
08:50 -!- Netsplit *.net <-> *.split quits: Haraken, pa, mete, Splex, rkantos, sled-dog, DarthGandalf, SigmaProjects, dioz, diytto,  (+2 more, use /NETSPLIT to show all of them)
08:50 -!- Netsplit over, joins: Haraken, SigmaProjects, mete, pa, diytto, GetsEcle1tic, dioz, rkantos, DarthGandalf, |Mike|
08:52 < biggi_mat> hyper_ch: http://www.eurephia.net/
08:52 <@vpnHelper> Title: eurephia :: a flexible OpenVPN authentication module (at www.eurephia.net)
08:53 < hyper_ch> :)
09:01 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
09:02 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
09:04 <@ecrist> biggi_mat: we need full log, at verb 5
09:04 <@ecrist> server and client
09:04 <@ecrist> and configs
09:04 <@ecrist> !logs
09:04 <@ecrist> !configs
09:04 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
09:05 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has joined #openvpn
09:05 -!- maxJadi [~maxJadi@mehdi.kjm.sgsnet.se] has quit [Changing host]
09:05 -!- maxJadi [~maxJadi@pontarius/mahdi] has joined #openvpn
09:06 -!- dazo_afk is now known as dazo
09:09 < biggi_mat> dazo: unfortunately for you, just the man I've been waiting on :)
09:09 <@dazo> biggi_mat: I'll be available in about an hour ... in a (phone) meeting now
09:09 < biggi_mat> :<
09:10 <@ecrist> biggi_mat: your issue is unrelated to eurephia
09:11 < biggi_mat> ecrist: server: http://pastebin.com/81gCXMbn
09:11 < Damascene> openvpn[50907]: 84.235.73.238:4241 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
09:11 < Damascene> do you know what is my mistake here?
09:11 < biggi_mat> ecrist: client: http://pastebin.com/xYAe7a67
09:12 <@ecrist> Damascene: same as i told biggi_mat !logs and !configs
09:12 < biggi_mat> Damascene: I suggest you listen to us now, since I'm having a similar thing
09:12 < Damascene> that was from the logs
09:12 <@ecrist> biggi_mat: that's not verb 5, is it?
09:12 < biggi_mat> ecrist: might be 6
09:12 < Damascene> :)
09:12 <@ecrist> Damascene: I want the entire log, both client and server
09:13 <@ecrist> biggi_mat: still looking for configs
09:13 < Damascene> ok
09:13 < biggi_mat> The bigger the better, they say! Or not?
09:13 <@ecrist> not, it's a lot of extra crap for me to wade through
09:13 < biggi_mat> ecrist: http://pastebin.com/ZFNdq5gX  server.conf
09:14 < biggi_mat> Aaand last but not least: http://pastebin.com/F7tb6YZ8 client.conf
09:14 <@ecrist> biggi_mat: your problem is you're not passing a certificate
09:14 < biggi_mat> ecrist: could you please elaborate?
09:15 < biggi_mat> ecrist: you have cert, ca and key options in mind?
09:15 <@ecrist> biggi_mat: according to your configs, your server is looking for each client to have a client certificate and key pair, you're not passing one to the server
09:16 <@ecrist> see line 11 in your client.conf
09:16 <@ecrist> it's commented out
09:16 < biggi_mat> Right, I'm fairly aware of that
09:16 <@ecrist> well, that's the problem.
09:16 < biggi_mat> So if I don't want that, I should comment out these two options in server.conf and leave the ca option?
09:16 <@ecrist> the server is expecting a certificate, and the client isn't overring one
09:16 <@ecrist> no, add this to the server config
09:16 <@ecrist> --client-cert-not-required
09:16 < Damascene> here is from client, http://fpaste.org/3mjw/ and here is from the server http://fpaste.org/Cw02/ thanks in advance
09:17 <@ecrist> biggi_mat: at the very least, I'd suggest using a certificate, even if your clients all use the same one
09:17 <@ecrist> though, I'd use separate certificates for them, too
09:17 < biggi_mat> ecrist: the p12 is there for that, isn't it?
09:17 < biggi_mat> But I guess client-cert-not-required cancles that as well
09:18 < biggi_mat> Though it's quite unconvinient giving clients three files, or not?
09:18 < biggi_mat> I wanted to go around that
09:18 <@ecrist> if you don't want to do that, just use the option above and omit it all together
09:18 < biggi_mat> Alright, I won't in that case then
09:19 <@ecrist> biggi_mat: you have a ca directive above, and --pkcs12 is probably getting confused, since it anticipates replace ca, cert, and key
09:20 < hyper_ch> ecrist: regarding udp/tcp.... isn't UDP putting less strain on an ISP because the transmitted packages contain less overhead and hence all transfers are "smaller" compared to tcp?
09:20 <@ecrist> no, sorry, you don't reading the wrong file
09:20 <@ecrist> hyper_ch: I doubt the ISP gives two shits
09:22 < hyper_ch> well, mine seems to do
09:22 < biggi_mat> Basically, I've put in ca, cert and key directives in client.conf and I'm getting the same error again, with pkcs12 directive commented out. I belive that is because I'm just confused at this point - ecrist can I ask you to single-sentenced tell me what you suggest doing when I _should_ be using certificates?
09:23 -!- maxJadi [~maxJadi@pontarius/mahdi] has quit [Quit: Leaving]
09:24 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
09:24 <@ecrist> ca on client and server should match
09:25 <@ecrist> cert/key should be a unique cert/key pair for each client and the server
09:25 <@ecrist> that's all
09:30 < biggi_mat> ecrist: that's how it's done
09:30 < biggi_mat> Wierd stuff
09:32 <@ecrist> it may be related to eurephia, then.
09:32 <@ecrist> should probably wait for dazo
09:38 < biggi_mat> May be, shit do I know
09:38 < biggi_mat> Took the very same files and put them in client 
09:38 < biggi_mat> The very same ca.crt that is loaded on server
09:38 <@ecrist> try pulling out the eurephia stuff
09:39 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
09:39 < biggi_mat> ecrist: works like a charm :)
09:40 -!- noisebleed_ [~quassel@kermit.inescn.pt] has quit [Ping timeout: 252 seconds]
09:41 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 248 seconds]
09:41 <@ecrist> well, we know what the problem is, then
09:43 < biggi_mat> ecrist: indeed :)
09:47 -!- `Ile` [~kvirc@109-92-85-237.dynamic.isp.telekom.rs] has joined #openvpn
09:47 <@vpnHelper> RSS Update - forum: Can Connect a Client but Cannot Access Web Pages <http://forums.openvpn.net/topic9422.html#p18688>
09:53 -!- Splex_ [~splex@n219079143223.netvigator.com] has left #openvpn []
09:54 -!- scyld [~operacyjn@unaffiliated/wasyl] has joined #openvpn
09:55 < scyld> Hello.
09:55 < scyld> Here, have a look: http://pastebin.com/EAgLAphn
09:56 < scyld> Can you tell me what is wrong with client7? It reconnects all the time...
09:56 < scyld> I tell you what we did... i.e. me migrated openvpn gatewat from tap to tun :>
09:57 < scyld> And this is my first problem - one client is constantly reconecting...
09:57 <+EugeneKay> A client log would give the reason for the reconnects.
09:58 < scyld> But... he is a moron (client), could it be that he droped new config and did not delete old one (tap device)?
09:59 <+EugeneKay> No clue. Get smarter clients. :-p
09:59 < scyld> oh no, it can't be I have changed the port :(
10:00 -!- rix1234 [~dks@114.143.161.178] has quit [Quit: Ex-Chat]
10:00 < scyld> Ok, I will get a log maybe ;)
10:00 < scyld> Second problem is worst...
10:01 < scyld> "Bad LZO decompression header byte: 0"
10:01 < scyld> wtf is that?
10:02 < scyld> that client is also reconnecting but faster, after 6-10 log lines like that...
10:03 <+EugeneKay> LZO isn' working right? Disable it.
10:04 < scyld> heh... but why?
10:04 < scyld> wrong software?
10:04 < scyld> i.e. openvpn version?
10:04 < scyld> can I disable lzo just for 1 client?
10:04 < scyld> push "comp-lzo no" ?
10:06 < scyld> in ccd ofc. while all other clients have lzo enabled?
10:06 <+EugeneKay> Dunno, never tried it.
10:06 <+EugeneKay> Worth a go
10:08 < scyld> nope... not working :9
10:08 < scyld> there is still that error :(
10:10 <+EugeneKay> Client logs would help a bunch. Not much I can debug from that server log, sorry.
10:14 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
10:14 < scyld> Heh, the client has Windows with GUI...
10:14 < scyld> so where is the log?
10:15 < scyld> because there is no log defined in .ovpn file...
10:25 <@ecrist> either lzo is enabled, or it is not
10:25 <@ecrist> you can not disable per-client
10:28 < scyld> manual says it can be done.
10:28 < scyld> In a server mode setup, it is possible to selectively turn compression on or off for individual clients.
10:29 < scyld> First, make sure the client-side config file enables selective compression by having at least one --comp-lzo directive, such as --comp-lzo no. This will turn off compression by default, but allow a future directive push from the server to dynamically change the on/off/adaptive setting.
10:38 <@dazo> biggi_mat: so ... your issue is this message?  error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
10:38  * dazo haven't cared to read too much of the scrollback
10:41 <@dazo> quick look at the configs, they look fine
10:41 < Damascene> my client cannot connect http://fpaste.org/5buh/
10:42 <@dazo> biggi_mat: and eurephia demands a client certificate ... which needs to be registered in the database (eurephiadm certs) and the user account (eurephiadm users) needs to be "connected" using eurephiadm usercerts
10:42 < Damascene> http://fpaste.org/qtvu/
10:42 < Damascene> sorry the other one got deleted
10:43 <@dazo> Damascene: you still have issues with self-signed certificate .... line 236 .... you must solve this first
10:44 < Damascene> oh my god
10:45 < Damascene> what kind of error is that?
10:45 <@dazo> it's an error from OpenSSL
10:45 < Damascene> why does not it says something useful that I can debug
10:45 < Damascene> *say
11:09 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
11:09 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
11:11 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18689>
11:11 <@dazo> Damascene: it does say that very clearly, it even points you at which certificate is self-signed ...
11:11 <@dazo> #
11:11 <@dazo> Tue Dec 20 19:36:33 2011 us=669000 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=SA/ST=NA/L=Riyadh/O=RabwahOffice/OU=openvpnou/CN=openvpnca/name=openvpn3/emailAddress=server@islamhouse.com
11:12 <@dazo> depth=1 means it's a CA certificate ... error= tells you what the problem is .... VERIFY ERROR, that the certificate could not be verified properly
11:12  * dazo struggles to see that this is not clear enough
11:12 < Damascene> it's clear for you, I'm not as expert as you, right?
11:14 <@dazo> I don't consider myself an expert on SSL stuff
11:14 <@dazo> I understand the SSL protocol ... but the CA and certificate stuff is still pretty magic to me :)
11:16 < Damascene> you are right on that :) 
11:32 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
11:41 -!- mirco [~mirco@p5B285305.dip.t-dialin.net] has joined #openvpn
11:51 -!- mirco [~mirco@p5B285305.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
11:53 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has joined #openvpn
11:54 < biggimat> dazo, hey, I'm home now so I'm here 
11:54 < biggimat> I added user, cert and usercert entry with eurephiadm
11:54 < biggimat> IDs match
11:55 <@dazo> biggimat: can you pastebin the output of 'eurephiadm usercerts --list' ?
11:55 <@dazo> and then the eurephia log of the connection attempt?
11:55 < biggimat> But of course, just a second
11:56 < Damascene> what exactly "unsupported certificate purpose" means?
11:57 <@vpnHelper> RSS Update - forum: Internal / External LAN-Interface on openVPNas <http://forums.openvpn.net/topic9421.html#p18690>
11:58 <@dazo> Damascene: in which context?
11:58 <@dazo> Damascene: I'm guessing you try to sign a certificate using a self-signed certificate which is not "flagged" as a CA certificate
11:58 < biggimat> dazo, http://pastebin.com/GKeb0N1u
11:59 <@dazo> biggimat: can you also pastebin the output of: eurephiadm certs --list
11:59 < biggimat> dazo, oh sorry, eurephia.log by itself only says: 
11:59 < biggimat> [2011-12-20 18:56:29 CET] ** WARNING **    [0] {/opt/openvpn/eurephia/eurephia/database/sqlite/edb-sqlite.c:430} Attempt from blacklisted IP Address: 10.1.1.234
11:59 <@dazo> ahh, there you go
12:00 < Damascene> dazo, this context http://fpaste.org/vmlr/
12:00 <@dazo> biggimat: eurephiadm attempts -R -i 10.1.1.234 && eurephiadm blacklist -D -i 10.1.1.234
12:01 <@dazo> that should clean up the blacklisting
12:01 < biggimat> dazo, http://pastebin.com/Vw8QjqLf
12:02 < scyld> Damascene: maybe you are trying to use client cert as a server cert...
12:02 <@dazo> biggimat: make sure you also don't have any other blacklisted items and/or attempts .... IP address is usually the last thing getting blocked
12:02 < biggimat> dazo, cleared it, let's see
12:03 <@dazo> Damascene: scyld is correct ... the server is either not using a server certificate, or the client is not using a client certificate
12:03 < biggimat> dazo, nope, still the same
12:03 < biggimat> :<
12:03 < Damascene> thank you
12:03 <@dazo> biggimat: what does the eurephia log say now? .... and did you check eurephiadm blacklist --list and eurephiadm attempts --list ?
12:04 < biggimat> It still classifies it as blacklisted
12:04 <@dazo> you need to reset or delete the attempts log as well, or else it gets kicked into the blacklist instantly
12:04 < biggimat> How can I delete that log?
12:04 <@dazo> biggimat: eurephiadm attempts --help ;-)
12:05 <@dazo> and the same for the the blacklist as well 
12:05 < biggimat> dazo, doesn't help much since the --list is empty
12:05 < biggimat> Which sucks really
12:06 <@dazo> biggimat: the blacklist or attempts?  that's two different lists
12:06 < biggimat> Both
12:06 <@dazo> just to be sure ... eurephiadm modify the same database file as OpenVPN uses?
12:06 <@dazo> otherwise, I need to see the eurephia log by now
12:07 < biggimat> dazo, it should, I don't remember setting anything else up
12:07 < biggimat> UNLESS!
12:07 <@dazo> cat ~/.eurephia/eurephiadm.cfg ;-)
12:07 < biggimat> Unless eurephia....unless I forgot....yeah...
12:07 <@vpnHelper> RSS Update - forum: [HELP] Could someone please help me (portforwarding) <http://forums.openvpn.net/topic9426.html#p18691>
12:07 < biggimat> That's what I was looking for, thanks
12:07 < biggimat> Hahaha
12:07 < biggimat> dazo, guess what?
12:07 <@dazo> it pointed on the wrong db?
12:08 < biggimat> It's pointed in the /etc thing from before you suggested moving to var/lib
12:08 <@dazo> yeah :)
12:10 < biggimat> dazo, I guess I came a little further
12:11 < biggimat> It seems my certificates are wrong 
12:11 < biggimat> It matches the ca.crt because of the email and stuff I guess
12:11 < biggimat> Which...makes sense since I've got ca in my client.conf?
12:12 < biggimat> Humtidum...I went wrong somewhere
12:12 <@dazo> biggimat: try openssl x509 -noout -fingerprint -subject -in $CERT ... do that on your certificates, and that will give you the info which needed in eurephia
12:12 <@vpnHelper> RSS Update - forum: Need help with OpenVPN client connecting to server <http://forums.openvpn.net/topic9427.html#p18693> || Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18692>
12:13 < biggimat> Alright, thank you
12:13 <@dazo> biggimat: and remember that the CA certificate needs to be registered with depth 1 .... client certificates as depth 0
12:13 < biggimat> Yup
12:13 < biggimat> Got that
12:13 <@dazo> goodie :)
12:13 <@dazo> I think you've practically solved it by now :)
12:16 < biggimat> Sure hope so :)
12:18 <@vpnHelper> RSS Update - forum: Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18694>
12:21 < hyper_ch> dazo - is ther any reason why I have two route entries per pushed route:
12:21 < hyper_ch> 10.8.0.0        10.8.0.1        255.255.255.0   UG    0      0        0 tun2
12:21 < hyper_ch> 10.8.0.0        *               255.255.255.0   U     0      0        0 tun2
12:21 <@dazo> hmm ... you probably don't need to push the route of which the client is already a part of
12:22 < hyper_ch> let me check
12:22 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
12:22 -!- Damascene [~house@unaffiliated/uaa] has left #openvpn ["Ex-Chat"]
12:23 < hyper_ch> how can I check through which gateway a package is actually sent? tcpdump?
12:27 <@dazo> yeah, that's definitely the easiest
12:29 -!- Damascene [~house@unaffiliated/uaa] has joined #openvpn
12:29 < Damascene> Hi, do you know how do I do something like this "openssl x509 -in LDAPserver-cert.pem -text -noout" with crt and key files? I want to debug some error
12:29 < Damascene> http://www.openldap.org/lists/openldap-software/200704/msg00286.html
12:29 <@vpnHelper> Title: Re: TLS/SSL problem - unsupported certificate purpose (at www.openldap.org)
12:30 < hyper_ch> dazo: can it be that tcpdump results in lag for showing?
12:30 <@dazo> hyper_ch: that lag is not long in that case ... max some milliseconds
12:31 < hyper_ch> it was a few secs
12:31 < hyper_ch> I sent through about 4-5 pings
12:31 < hyper_ch> and then switched back to the tcpdump term
12:31 < hyper_ch> and after switching back it appeared there
12:31 < hyper_ch> could be tmux though
12:31 <@dazo> that's odd ... I've never seen such long delays
12:31 < hyper_ch> but things are routed fine :)
12:32 <@dazo> but that delay is concerning
12:32 < hyper_ch> maybe I should expand my 3 subnets to 6
12:32 < hyper_ch> one set enabled/disabled comp-lzo
12:32 < hyper_ch> nah, 3 should be fine for testing now
12:32 < hyper_ch> btw, the   config common.inc    works wonders :)
12:32 <@dazo> nice! :)
12:33 < hyper_ch> but still speed issues
12:34 <@dazo> hyper_ch: hehe ... speaking of tcpdump ... http://ht.ly/1ggmAq
12:34 <@vpnHelper> Title: tcpdump fu | Linux Journal (at ht.ly)
12:35 <@dazo> hyper_ch: I wonder if those speed issues is caused by the delay you see in tcpdump
12:35 < hyper_ch> dazo: I like that http://danielmiessler.com/study/tcpdump/
12:35 <@vpnHelper> Title: A Tcpdump Tutorial and Primer | danielmiessler.com (at danielmiessler.com)
12:35 <@dazo> that would really explain the slow-down
12:35 <@dazo> on through-put
12:35 < hyper_ch> I have 15mbit dl
12:35 < hyper_ch> and right now I'm pulling at 250KB
12:36 <@dazo> yeah, and if packets are delayed with a second ... that might match pretty well
12:36 <@dazo> with *seconds*
12:36 < hyper_ch> so, what could cause that delay
12:36 <@dazo> dunno
12:37 <@dazo> routing loops, iptables, faulty hardware, buggy driver, kernel bugs, openvpn bugs ... basically whatever
12:37 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
12:38 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
12:38 < hyper_ch> after 10 secs it finally appeared on tcpdump
12:39 <@dazo> that's really not normal .... do you run tcpdump with -n?
12:39 <@dazo> if DNS lookups are slow, that might cause some of the issues
12:39 < hyper_ch> no, just tcpdump -i tunX
12:41 < hyper_ch> why would it need dns lookups?
12:41 <@dazo> it tries to resolv IPs to hostnames
12:41 <@dazo> -n disables that
12:41 < hyper_ch> can I disable that?
12:41 < hyper_ch> ah ok
12:41 < hyper_ch> yeah, that caused it
12:42 < hyper_ch> started to show up immediately
12:44 <@dazo> goodie! then that makes more sense .... then the general performance issue is something which might make more sense too ... without knowing where to look
12:44 < hyper_ch> but what could it be :(
12:44 < hyper_ch> over udp I get now at least 400 KB
12:44 < hyper_ch> that's better than the 250 before
12:46 <@dazo> I don't have complete understanding of your total setup ... how many openvpn processes/daemons are running ... with more clients using both UDP and TCP independently ... but I fear it is related to this
12:46 < hyper_ch> dazo: In the beginning I was using UDP
12:46 < hyper_ch> then in april, my transfer just dropped
12:46 < hyper_ch> I switched to tcp
12:46 < hyper_ch> that went also well for a while
12:46 < hyper_ch> but then the openvpn client --> internet just couldn't get more than 3MB anymore
12:47 < hyper_ch> and now I get slow homespeed
12:47 < hyper_ch> dazo: I'm the only client on the whole thing
12:47 < hyper_ch> well, only user
12:47 < hyper_ch> I showed you the graphic last night... what don't you understand there
12:47 <@dazo> hyper_ch: try setting up iperf on your server ... and run iperf from your home computer ... that will measure the raw speed on your server/client connection - outside OpenVPN
12:48 < hyper_ch> no matter what I do, I just can't get the speeds anymore
12:48 < hyper_ch> !iperf
12:48 <@dazo> hyper_ch: how I understand it ... as you said your "backend" server was using 
12:49 <@dazo> UDP ... and you connected using TCP .... that indicates two openvpn processes on your openvpn server for me
12:49 <@dazo> http://iperf.sourceforge.net/
12:49 <@vpnHelper> Title: Iperf (at iperf.sourceforge.net)
12:49 -!- treund [~treund@97.75.177.42] has joined #openvpn
12:49 < hyper_ch> dazo: I tried all kinds of different connection
12:49 < hyper_ch> only tcp
12:49 < hyper_ch> only udp
12:49 < hyper_ch> my connection to the server with tcp
12:49 < hyper_ch> connection server to the other client with udp
12:50 <@dazo> yeah, but you loose the core issue I try to point out .... How MANY openvpn processes do you have running on the server your home client connects to?
12:50 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
12:50 <@dazo> are there more openvpn server processes running?  (mixed TCP/UDP indicates that)
12:51 <@dazo> there are a lot of such "small" details which are crucially important now
12:52 < hyper_ch> dazo: there are three openvpn servers running
12:53 < hyper_ch> [  3]  0.0-11.1 sec  1.38 MBytes  1.04 Mbits/sec
12:53 < hyper_ch> that's iperf result
12:53 < hyper_ch> [  3]  0.0-10.2 sec  1.50 MBytes  1.23 Mbits/sec
12:54 < hyper_ch> [  3]  0.0-10.4 sec  1.50 MBytes  1.21 Mbits/sec
12:54 < hyper_ch> forget the first one
12:54 <@dazo> okay, so in a single OpenVPN server process environment, the core performance should be somewhere in that range
12:55 <@dazo> I just wonder .... maybe some of the performance loss might actually be because the traffic on your server goes:  <openvpn-server1>--<tun device1>-<kernel/routing>-<tun device 2>--<openvpn-server2> .... and as each openvpn server does encryption, and we know with JJKs testing that OpenSSL is a bottleneck for throughput performance
12:55 < hyper_ch> with UDP I get  [  3] WARNING: did not receive ack of last datagram after 10 tries
12:56 <@dazo> okay, so you have UDP connection issues ... that's for sure
12:56 < hyper_ch> dazo: using 15mbit shouldn't lead to openssl bottleneck
12:57 < hyper_ch> and I try single OpenVPN server
12:57 < Damascene> I've fixed "unsupported certificate purpose" now I get "self signed certificate in certificate chain" any clue on that?
12:57 < hyper_ch> that's what I've been using for ages
12:57 < hyper_ch> and then it became worse
12:57 <@dazo> Damascene: you have done it wrong with signing the client or server certificate again ... it's the same issues as you started with
12:58 <@dazo> Damascene: your server and client certificates *must* be signed by a CA key/certificate .... this CA certificate *cannot* be the server nor the client certificate
12:58 <@dazo> hyper_ch: true
12:58 <@dazo> hyper_ch: I honestly don't know
12:59  * dazo need to go now
12:59 < Damascene> could you please tell me if the steps on the following page are good? http://doc.pfsense.org/index.php/VPN_Capability_OpenVPN
12:59 <@vpnHelper> Title: VPN Capability OpenVPN - PFSenseDocs (at doc.pfsense.org)
12:59 < hyper_ch> dazo: I don't know either :(
12:59 < hyper_ch> thx thouzgh
13:00 <@dazo> Damascene:  If you follow this step by step and paste the correct CA cert and server key/cert in the right webUI fields ... this should work out .... http://doc.pfsense.org/index.php/VPN_Capability_OpenVPN#Setup_Easy-RSA
13:00 <@vpnHelper> Title: VPN Capability OpenVPN - PFSenseDocs (at doc.pfsense.org)
13:01 <@dazo> Damascene: but be 100% sure you do all these steps 100% correct ... one mistake here, and it's all messed up
13:01 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has quit [Ping timeout: 252 seconds]
13:01  * dazo really goes
13:02 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has joined #openvpn
13:02 -!- dazo is now known as dazo_afk
13:02 < Damascene> dazo, the only problem that the interface have changed a bit and know there is tow pages.  "CAs" and "Certificates" in the first I pasted ca.cert and in the later server.key and server.crt
13:14 <@vpnHelper> RSS Update - forum: Can Connect a Client but Cannot Access Web Pages <http://forums.openvpn.net/topic9422.html#p18695>
13:15 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
13:24 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
13:28 -!- LuckyY [~LuckY@188.142.61.123] has quit [Ping timeout: 252 seconds]
13:30 < Damascene> when I generate certificate it asks me if I want to sign. could that cause the self singed error?
13:32 -!- LuckY [~LuckY@188.142.61.123] has joined #openvpn
13:34 -!- mete [~mete@84.200.4.144] has quit [Disconnected by services]
13:35 < krzee> !certverify
13:35 <@vpnHelper> "certverify" is verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt
13:35 < krzee> make sure to also check that the ca.crt is = on both sides
13:35 -!- mete- [~mete@mete.shell.la] has joined #openvpn
13:50 < Damascene> openssl verify -CAfile server1.ca server1.cert 
13:50 < Damascene> server1.cert: /C=SA/ST=NA/L=RIYADH/O=RabwahOffice/OU=Internet/CN=server/name=ovpn/emailAddress=server@example.com, error 20 at 0 depth lookup:unable to get local issuer certificate
13:51 < krzee> problem what making your certs
13:51 < krzee> start over
13:51 < krzee> !pki
13:51 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
13:51 <@vpnHelper> specially as a server (see !servercert)
13:52 < Damascene> !servercert
13:52 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key or (#2) this will help with !mitm
13:54 -!- treund [~treund@97.75.177.42] has left #openvpn []
13:57 < krzee> just follow the link in #1 of !pki
14:01 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
14:06 < Damascene> thanks
14:07 < jeev> openvpn vs stupid cisco vpn appliance ?
14:07 <+EugeneKay> I should do a writeup on making a PKI for OpenVPN with XCA
14:12 < jeev> what are the benefits of openvpn over cisco? ipsec interop sucks ?
14:15 <@ecrist> jeev: ?
14:16 <+EugeneKay> jeev - it's Open, and it's a VPN.
14:16 < jeev> how hsould i convince a cisco asa user
14:16 <+EugeneKay> How much money does he have?
14:16 < jeev> tell them that the cisco is 'a stupid appliance' ?
14:16 < jeev> not sure.
14:17 < jeev> why's that matter
14:17 <+EugeneKay> Not much, or a bunch?
14:17 < jeev> i'd say not much over a bunch
14:17 <+EugeneKay> Tell him it's free.
14:17 < jeev> what if they already have an asa
14:18 <+EugeneKay> Then he's already a lost cause.
14:18 < jeev> he is willing.
14:18 <+EugeneKay> Oh, just a lil nudging? Wellt hatss doable
14:18 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
14:18 < jeev> i need a good reason
14:19 <+EugeneKay> The feature list is a pretty good set of reasons
14:19 < |Mike|> lol.
14:20 <+EugeneKay> "It's open source, it's SSL, it's UDP, it works over NAT, it runs on $EVERYTHING, it handles routing & network setup, it cures cancer, it comes with a puppy."
14:21 < jeev> hmm, it's also safe for the testicles
14:21  * ecrist notes jeev has gone back to his trollish ways
14:21 <+EugeneKay> Trolls are tasty, but a bit chewy
14:25 < hyper_ch> s/puppy/furball/
14:25 < jeev> wat
14:25 < jeev> what trollish ways
14:27 < jeev> lets assume 5 connections to openvpn, only a 5mbit up/down. could we assume that it wont stress out an atom?
14:27 < hyper_ch> jeev: atom can handle that
14:28 < hyper_ch> I can read write at 20/MBs on my fully encrypted harddisk on my atom
14:30 -!- LuckY [~LuckY@188.142.61.123] has quit [Disconnected by services]
14:30 < jeev> seems to be fair enough eh ?
14:30 < rawplayer> !OpenVPN-NL
14:30 < rawplayer> !OpenVPN
14:32 <@vpnHelper> RSS Update - forum: Free providers? <http://forums.openvpn.net/topic8391.html#p18696>
14:37 -!- LuckyY [~LuckY@188.142.61.123] has joined #openvpn
14:38 <@vpnHelper> RSS Update - forum: Help: Openvpn server suddenly stopped working <http://forums.openvpn.net/topic9416.html#p18697>
14:41 -!- Damascene [~house@unaffiliated/uaa] has quit [Quit: Ex-Chat]
15:02 <@vpnHelper> RSS Update - forum: Routing - Configuring for accessing client router machines <http://forums.openvpn.net/topic9432.html>
15:32 <@vpnHelper> RSS Update - forum: possible ways to establish ddns updates for openvpn clients <http://forums.openvpn.net/topic9433.html>
15:49 -!- Mowee [~Mowi@lendabrain.net] has quit [Excess Flood]
15:56 -!- cehteh [~ct@HSI-KBW-085-216-123-195.hsi.kabelbw.de] has joined #openvpn
15:59 < cehteh> hi, i have a small problem, using resolvconf, when the openvpn pushes the dns servers, then its only added to the existing dns servers but doesnt replaces them, how do you commonly handle that? not using resolvconf and writing a update script by yourself?
16:00 < cehteh> (i have a split dns setup and want to query the internal zones when the vpn is up)
16:00 -!- treund [~treund@97.75.177.42] has joined #openvpn
16:08 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
16:09 -!- Gravitron [~admin@rrcs-74-87-108-163.west.biz.rr.com] has joined #openvpn
16:09 -!- Gravitron [~admin@rrcs-74-87-108-163.west.biz.rr.com] has quit [Changing host]
16:09 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:11 -!- dkr [~dkr@67.132.255.16] has quit [Quit: Leaving]
16:12 -!- cjs226 [~cjs226@rrcs-71-40-79-154.sw.biz.rr.com] has quit []
16:14 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 268 seconds]
16:14 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
16:14 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
16:14 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:27 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
16:30 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 276 seconds]
16:43 <+EugeneKay> I make my internal DNS public.
16:44 < treund> nice
16:44 <+EugeneKay> It's also not "internal" by virtue of the fact that it's all IPv6able
16:44 < Olipro> so I can AXFR it?
16:44 <+EugeneKay> The A records just happen to be inside of 10.0.0.0/8
16:45 <+EugeneKay> Nope, but you can query it.
16:45 < Olipro> well, it's not exactly public then
16:45 < Olipro> aside from whatever you can discover
16:45 < Olipro> unless you're using NSEC records
16:45 <+EugeneKay> Publically-accessible, you pedant.
16:45 -!- treund [~treund@97.75.177.42] has left #openvpn []
16:45 < Olipro> then it's easily enumerable
16:47 < cehteh> EugeneKay: i make some things public, but since its behind NAT some internal ip's are different from external ones
16:47 < cehteh> ipv6 for the rescue :P .. someday
16:47 <+EugeneKay> cehteh - so put it inside of a network subzone
16:47 <+EugeneKay> host.internal.doma.in vs host.doma.in
16:48 < cehteh> ugly, isnt it?
16:48 <+EugeneKay> Not really?
16:48 < cehteh> i want to contact mail.mydomain.org from outside when vpn is down as well as from inside, or when vpn is up
16:48 <+EugeneKay> So route it
16:49 <+EugeneKay> Split horizon DNS is a pile of trouble and should be avoided
16:49 < cehteh> i hope so as soon v6 gets wider deployed (and i have native v6 here at home)
16:58 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
17:01 < cehteh> good, have it working with my own update-resolv-conf hack
17:25 -!- JoeK [~Joseph@ip-66-228-36-238.makaiwell.com] has quit [Ping timeout: 240 seconds]
17:25 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has quit [Ping timeout: 240 seconds]
17:26 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has joined #openvpn
17:26 -!- JoeK [~Joseph@ip-66-228-36-238.makaiwell.com] has joined #openvpn
17:31 -!- LuckyY_ [~LuckY@188.142.61.123] has joined #openvpn
17:33 -!- LuckyY [~LuckY@188.142.61.123] has quit [Ping timeout: 245 seconds]
17:43 <@vpnHelper> RSS Update - forum: 192.168.113.3:1194 failed? Server errors on start up with co <http://forums.openvpn.net/topic9434.html>
17:44 -!- rave [~rave@122.2.46.76] has joined #openvpn
17:45 < rave> can I have a directive local 0.0.0.0 on my server.conf. What I know is that location serverip
17:46 -!- Netsplit *.net <-> *.split quits: sled-dog
17:49 <@vpnHelper> RSS Update - forum: Traffic Not Routing Properly OpenBSD Routed VPN <http://forums.openvpn.net/topic9435.html>
17:51 -!- Netsplit over, joins: sled-dog
17:53 -!- rave [~rave@122.2.46.76] has quit []
17:54 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
18:06 -!- `Ile` [~kvirc@109-92-85-237.dynamic.isp.telekom.rs] has quit [Remote host closed the connection]
18:25 -!- zu [~zu@ks387228.kimsufi.com] has quit [Read error: Operation timed out]
18:27 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
18:33 -!- zu_ [~zu@ks387228.kimsufi.com] has joined #openvpn
18:37 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 245 seconds]
18:37 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 245 seconds]
18:54 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
18:57 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
19:04 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 245 seconds]
19:08 -!- sled-dog [~luser@65.124.95.55] has joined #openvpn
19:09 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has joined #openvpn
19:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
19:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:13 -!- sled-dog [~luser@65.124.95.55] has quit [Ping timeout: 245 seconds]
19:17 -!- Eyore is now known as JoeGazz84
19:22 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
19:25 -!- _julian [~quassel@hmbg-4d06e67d.pool.mediaWays.net] has joined #openvpn
19:27 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
19:28 -!- _julian_ [~quassel@hmbg-5f762afd.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
19:31 <@vpnHelper> RSS Update - forum: Can Connect a Client but Cannot Access Web Pages <http://forums.openvpn.net/topic9422.html#p18702>
19:49 -!- Denial [~Denial@drgi.co.uk] has quit []
19:53 -!- BenLue [NoMail@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
19:55 < BenLue> so1
19:55 < BenLue> so!
19:55 < BenLue> (o;
19:57 < BenLue> Ich hab mal testweise openvpn aufn Debian Server installiert! Ports habe ich weitergeleitet iptables im Router eingegeben. VVon Intern kann ich connecten aber von draussen nicht
19:57 < BenLue> Muss ich nochwas beachten?
19:59 < krzie> you speak english?
19:59 < BenLue> not good but i will try
20:00 < krzie> cool
20:00 < Olipro> that's good because we don't speak German
20:00 < krzie> iwill try to be clear
20:00 < BenLue> I have installed Openvpn! i have forwardet my vpn port to my Server and entry the iptables
20:01 < BenLue> I can connect intern but from outside isnt working
20:01 < Olipro> does the OpenVPN server have a public IP
20:01 < krzie> does the server log show a connection attempt?
20:01 < krzie> !timeout
20:01 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
20:03 < BenLue> http://pastebin.com/CT4enPcm
20:03 < BenLue> i will connect via dyndns
20:03 < Olipro> the source address is an RFC1918
20:03 < BenLue> dyndns i updatet with my ip
20:03 < Olipro> are you performing DNAT
20:04 < BenLue> i use dd-wrt Router
20:04 < Olipro> dd-wrt is a linux distribution, that's not very useful information
20:04 < krzie> ok so it IS getting data
20:05 < krzie> Wed Dec 21 02:59:38 2011 192.168.2.10:53417 TLS: Initial packet from [AF_INET]192.168.2.10:53417, sid=ccc9a5c9 6c13309f
20:05 < BenLue> logg from connection try
20:06 < BenLue> yes
20:06 < krzie> oh no, was that the client or server log you showed us?
20:06 < BenLue> server side
20:06 < krzie> ok
20:06 < krzie> so ya, it does get some data
20:07 < BenLue> i need some iptable entrys more than iptables -A INPUT -p udp --sport 1194 -j ACCEPT and iptables -A OUTPUT -p udp --dport 1194 -j ACCEPT ?
20:07 < Olipro> that largely depends on your client config
20:07 < Olipro> it would be more useful to see a full iptables dump
20:10 < BenLue> iptable -L ?
20:11 < BenLue> iptables -L ?
20:11 < Olipro> iptables-save would be better
20:12 < BenLue> -sh: iptables-save: not found
20:12 < krzie> with those router firmwares, dont use iptables -A
20:12 < krzie> use iptables -I
20:14 < Olipro> fine, iptables -L will do
20:15 < krzie> and iptables -t nat -L
20:15 < krzie> sice -L wont show nat table
20:17 -!- cehteh [~ct@HSI-KBW-085-216-123-195.hsi.kabelbw.de] has left #openvpn ["Client exiting"]
20:18 < BenLue> Olipro; http://pastebin.com/WKeUswq1
20:20 -!- master_of_master [~master_of@p57B53F46.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:24 < BenLue> and http://pastebin.com/NhdLJ027
20:24 -!- master_of_master [~master_of@p57B53D88.dip.t-dialin.net] has joined #openvpn
20:24 < BenLue> i dount know why isnt works
20:27 < BenLue> any more ideas?
20:28 < krzie> could be realted to keeping state on udp maybe
20:28 < krzie> but i dunno iptables too well
20:28 < krzie> so i cant suggest the test-fix
20:29 < krzie> at least not in commands, just as the idea
20:35 <@vpnHelper> RSS Update - forum: Need help with OpenVPN client connecting to server <http://forums.openvpn.net/topic9427.html#p18703>
20:39 < BenLue> Olipro?
20:39 < Olipro> what UDP port does the server listen on?
20:42 < BenLue> 1194
20:44 < krzie> Olipro, what ya think bout my idea of the problem?
20:44 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has quit [Ping timeout: 252 seconds]
20:44 < krzie> since at least 1 packet makes it through, but thats all
20:44 < krzie> i know udp keepstate has caused issues with ovpn for some others before
20:44 < BenLue> okay i have disabled my Windows Firewall i become this msg clientside now: Wed Dec 21 03:44:31 2011 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
20:46 < Olipro> his iptables rules aren't preventing it
20:47 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
20:50 < BenLue> what is error code (code=10054) ?
20:51 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
20:52 < krzie> Olipro, how do you know?
20:52 < krzie> its definitely letting a first packet through
20:52 < krzie> then it resets the connection
20:52 < Olipro> UDP is stateless
20:52 < krzie> and he is using keep-state on it
20:52 < krzie> which is my point
20:52 < Olipro> that has nothing to do with intermediate hops
20:52 < krzie> firewalls TRY to keepstate on udp if you tell them to, and often suck
20:52 < Olipro> only the endpoint can terminate it
20:53 < Olipro> no, Netfilter uses a simple TIME_WAIT on UDP
20:53 < Olipro> it has no knowledge of the encapsulated data
20:53 < krzie> right, i never said anything contrary
20:53 < Olipro> OpenVPN sees a "connection reset" as part of its own protocol
20:53 < krzie> i bet if he changes to tcp the problem goes away
20:53 < krzie> cause his firewall will correctly keep-state on ity
20:54 < Olipro> no
20:54 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
20:54 < Olipro> if his firewall were the cause, there wouldn't have been the connection reset
20:54 < Olipro> the packet from the openvpn client to tell it to reset would not have been received
20:55 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
20:55 < krzie> oh i see what you're saying, udp wouldnt RST a connection
20:55 < krzie> ya thats true i would think
21:01 < BenLue> okay i have new error: Wed Dec 21 04:00:28 2011 TCP/UDP: Incoming packet rejected from 192.168.2.14:1194[2], expected peer address: myip (allow this incoming source address/port by removing --remote or adding --float)
21:02 < krzie> why you connecting from the same lan?
21:02 < krzie> will that be normal?
21:02 < BenLue> i will test it
21:03 < BenLue> i havnt other lan atm
21:03 < krzie> ahh ok
21:03 < krzie> !configs
21:03 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
21:12 -!- Kanyl [~on@unaffiliated/kanyl] has quit [Ping timeout: 252 seconds]
21:16 -!- Kanyl [~on@unaffiliated/kanyl] has joined #openvpn
21:17 < BenLue> krzie; client.ovpn = http://pastebin.com/1513S60V
21:18 < BenLue> Server.conf http://pastebin.com/ehtG1UKz
21:19 < BenLue> ovpn server with debian and win7 Client
21:22 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
21:22 -!- rave [~rave@122.2.46.76] has joined #openvpn
21:22 -!- rave [~rave@122.2.46.76] has left #openvpn []
21:23 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
21:24 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
21:27 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
21:33 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 244 seconds]
21:55 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
21:59 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has joined #openvpn
22:03 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
22:26 -!- ponyofdeath [~vladi@cpe-75-80-175-217.san.res.rr.com] has joined #openvpn
22:48 -!- nutcase [~nutcase@ir0nic.com] has joined #openvpn
23:04 <@vpnHelper> RSS Update - forum: openvpn stops working after a server reboot <http://forums.openvpn.net/topic9254.html#p18704>
23:16 <@vpnHelper> RSS Update - forum: Routing: Configuring for accessing subnet clients +iptables <http://forums.openvpn.net/topic9432.html>
23:16 -!- nutcase [~nutcase@ir0nic.com] has quit [Quit: BAI]
23:21 -!- shteyngart [thumper@i.dont.get.mad.i.get.stabby.net] has joined #openvpn
23:29 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:59 -!- rave [~rave@122.2.46.76] has joined #openvpn
23:59 -!- rave [~rave@122.2.46.76] has left #openvpn []
--- Day changed Wed Dec 21 2011
00:03 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 244 seconds]
00:15 <@vpnHelper> RSS Update - forum: 192.168.113.3:1194 failed? Server errors on start up with co <http://forums.openvpn.net/topic9434.html#p18705>
00:21 <@vpnHelper> RSS Update - forum: Can Connect a Client but Cannot Access Web Pages <http://forums.openvpn.net/topic9422.html#p18706>
00:26 -!- scyld [~operacyjn@unaffiliated/wasyl] has quit [Quit: leaving]
00:34 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
00:55 -!- rix1234 [~rix1234@114.143.161.178] has joined #openvpn
00:57 -!- rave [~rave@122.2.46.76] has joined #openvpn
00:59 -!- rave [~rave@122.2.46.76] has left #openvpn []
01:04 -!- rave [~rave@122.2.46.76] has joined #openvpn
01:04 < rave> guys what are the directive to remove to totally remove the vpn encryption?
01:04 < rave> ofcourse I know those directives but perhaps theres more
01:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
01:07 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:08 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
01:08 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
01:16 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
01:16 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
01:26 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:28 -!- rave [~rave@122.2.46.76] has quit []
01:33 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
01:33 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
01:38 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:41 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
01:49 < _slax0r_> hello, I've got a openvpn server sitting behind a router, and the server is pushing the route, so the clients can access the whole network that the server is sitting on, and so in my router on the server network I've got in the config, dest: 10.8.0.0(vpn network) gw: 172.16.98.2(local IP of VPN server), but everytime a client tries to download or upload anything from the server side network or the vpn server it
01:49 < _slax0r_>  self, the whole network grinds to a halt, and the transfer goes like 10KB/s
01:50 < _slax0r_> I get that VPN can be CPU consuming, but that would just be consuming for the client and the server, not the router and whole network, why do I get such behaviour? or better yet, how to solve it?
01:57 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:59 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
01:59 -!- mirco_ is now known as mirco
02:03 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within <http://forums.openvpn.net/topic9436.html>
02:04 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
02:05 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
02:10 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:16 -!- dazo_afk is now known as dazo
02:18 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
02:19 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has joined #openvpn
02:20 -!- scyld [~operacyjn@unaffiliated/wasyl] has joined #openvpn
02:20 <@vpnHelper> RSS Update - forum: 192.168.113.3:1194 failed? Server errors on start up with co <http://forums.openvpn.net/topic9434.html#p18709> || possible ways to establish ddns updates for openvpn clients <http://forums.openvpn.net/topic9433.html#p18708>
02:26 < scyld> Hello.
02:26 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within <http://forums.openvpn.net/topic9436.html#p18710>
02:27 < scyld> I hav a problem with "Bad LZO decompression header byte: 0" in server logs and "FRAG_IN error flags=0xfa287f34: spurrious FRAG_WHOLE flags
02:27 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has quit [Remote host closed the connection]
02:27 < scyld> "in client logs.
02:27 < scyld> any help?
02:28 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has joined #openvpn
02:31 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
02:31 <@vpnHelper> RSS Update - forum: Routing: Configuring for accessing subnet clients +iptables <http://forums.openvpn.net/topic9432.html#p18711>
02:37 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within <http://forums.openvpn.net/topic9436.html#p18713> || 192.168.113.3:1194 failed? Server errors on start up with co <http://forums.openvpn.net/topic9434.html#p18712>
02:40 -!- kostas__ [~kostas@naigrig2.static.otenet.gr] has quit [Remote host closed the connection]
02:47 < scyld> I have a problem with "Bad LZO decompression header byte: 0" in server logs and "FRAG_IN error flags=0xfa287f34: spurrious FRAG_WHOLE flags" on the clent side. How to fix that?
02:49 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within <http://forums.openvpn.net/topic9436.html#p18714>
02:55 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 268 seconds]
02:55 <@vpnHelper> RSS Update - forum: Need help with OpenVPN client connecting to server <http://forums.openvpn.net/topic9427.html#p18715>
03:09 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has left #openvpn ["Leaving"]
03:11 -!- cyberspace- [~cyberspac@ninthfloor.org] has joined #openvpn
03:19 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:22 < scyld> I have a problem with "Bad LZO decompression header byte: 0" in server logs and "FRAG_IN error flags=0xfa287f34: spurrious FRAG_WHOLE flags" on the clent side. How to fix that?~
03:22 < scyld> Any help?
03:28 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:37 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18716>
03:52 <@dazo> scyld: make sure "comp-lzo" settings are the same on client and server ... and if one side don't have it at all, the other side can also not have it
03:53 <@dazo> scyld: make sure "comp-lzo" settings are the same on client and server ... and if one side don't have it at all, the other side can also not have it
03:53 <@dazo> scyld: make sure "comp-lzo" settings are the same on client and server ... and if one side don't have it at all, the other side can also not have it
03:54  * dazo answered 3 times, as the question was asked 3 times
03:54 < scyld> dazo, both sides have "comp-lzo" nothing more...
03:55 <@dazo> scyld: well, that error is related to the comp-lzo option ... nothing else .... no ccd config in addition changing it?
03:55 <@vpnHelper> RSS Update - forum: Can Connect a Client but Cannot Access Web Pages <http://forums.openvpn.net/topic9422.html#p18717>
03:55 < scyld> no
03:55 <@dazo> scyld: both sides running the same OpenVPN version?
03:56 <@dazo> (or at least 2.1.4 or newer)
03:56 < scyld> ow wait, yep, dam it...
03:56 < scyld> client send me wrong logs :(*
03:59 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Read error: Connection reset by peer]
03:59 -!- twister004_ [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
03:59 -!- twister004_ is now known as twister004
04:01 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18718>
04:13 <@vpnHelper> RSS Update - forum: WARNING: Failed running command (--up/--down): external prog <http://forums.openvpn.net/topic9431.html#p18719>
04:18 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 268 seconds]
04:20 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
04:22 -!- noisebleed [~quassel@kermit.inescn.pt] has joined #openvpn
04:22 -!- noisebleed [~quassel@kermit.inescn.pt] has quit [Changing host]
04:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:26 -!- cyberspace- [~cyberspac@ninthfloor.org] has quit [Ping timeout: 252 seconds]
04:36 -!- cyberspace- [~cyberspac@ninthfloor.org] has joined #openvpn
04:39 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
04:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
04:40 -!- cyberspace- [~cyberspac@ninthfloor.org] has quit [Ping timeout: 252 seconds]
04:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:49 < scyld> ok, that error was because of old openvpn version on client side. ufff
04:50 <@dazo> scyld: just curious ... how old was the client?  and which version was the server?
04:51 < scyld> client: OpenVPN 2.1.3 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Aug 20 2010
04:52 < scyld> server: 2.1.4(22:42:32 17.12.2011)(iproute2 ssl -eurephia -examples -ipv6 -minimal -pam -passwordsave -pkcs11 -selinux -static -userland_BSD)
04:52 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:52 < scyld> server is x86_64 running on gentoo.
04:52 < scyld> tfu, x86 ;)
04:52 <@dazo> scyld: that client version ... is that before or after the upgrade?
04:53 < scyld> before
04:53 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
04:53 -!- mirco_ is now known as mirco
04:53 < scyld> now is 2.1.4
04:53 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
04:53 <@dazo> odd ... never heard about issues with 2.1.3 client and 2.1.4 server
04:54 < scyld> yah, some clients are using that version and it works with the same config... just that one was causing trouble.
04:55 <@dazo> this is the *only* difference between 2.1.3 and 2.1.4 - and it only affects Windows ... http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn.git;a=commitdiff;h=b5da875c06d7ea028d32f369873eb700c82d93d4
04:55 <@vpnHelper> Title: SourceForge - openvpn/openvpn.git/commitdiff (at openvpn.git.sourceforge.net)
04:55 <@dazo> sorry, it affects other clients as well ... I remembered wrong
04:56 < scyld> pitty I do not have logs from client
04:57 <@dazo> mm
04:57 < scyld> user has deleted them
04:57 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 244 seconds]
04:57 <@dazo> (2.1.2 and 2.1.3 had a single windows only fix ... that's my mix)
04:57 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:05 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18720>
05:07 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:11 <@vpnHelper> RSS Update - forum: WARNING: Failed running command (--up/--down): external prog <http://forums.openvpn.net/topic9431.html#p18721>
05:16 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 240 seconds]
05:21 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:26 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 240 seconds]
05:27 < hyper_ch> dazo: ecrist: krzee: Proof-of-concept code showing how to crash vulnerable Win 7 boxes has been leaked: the simple HTML script, when opened in Apple's Safari web browser, quickly leads to the kernel triggering a page fault in an unmapped area of memory, which halts the machine at a blue screen of death. - http://www.theregister.co.uk/2011/12/21/win_7_bug_crash_risk/
05:27 <@vpnHelper> Title: A simple HTML tag will crash 64-bit Windows7 • The Register (at www.theregister.co.uk)
05:27 <@dazo> yeah, saw that one .... even a fun discussion about people discussing if this is nasty or just a lol thing on twitter too ...
05:28 < hyper_ch> :)
05:28  * dazo considers to add that snippet on a few of his web pages (which basically doesn't reveal any information at all)
05:28 <@dazo> (just for the bloody fun of it .... :-P)
05:30 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
05:33 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:39 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
05:45 -!- Spudage_ [~Spudage@ppp118-209-80-175.lns20.mel4.internode.on.net] has joined #openvpn
05:46 < Spudage_> !welcome
05:46 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:49 -!- Spudage_ [~Spudage@ppp118-209-80-175.lns20.mel4.internode.on.net] has left #openvpn ["Leaving"]
05:57 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has joined #openvpn
05:57 -!- simplechat [~simplecha@123-243-79-139.static.tpgi.com.au] has quit [Changing host]
05:57 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
06:18 <@vpnHelper> RSS Update - forum: WARNING: Failed running command (--up/--down): external prog <http://forums.openvpn.net/topic9431.html#p18723> || Openvpn icon remains yellow when "verb 0" is used <http://forums.openvpn.net/topic9437.html>
06:21 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 252 seconds]
06:34 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:38 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
06:39 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 252 seconds]
06:49 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
06:52 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has joined #openvpn
06:54 <@vpnHelper> RSS Update - forum: OpenVPN Clients Automation <http://forums.openvpn.net/topic9129.html#p18724>
07:01 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
07:15 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
07:15 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has quit [Read error: No route to host]
07:22 -!- luckman212_ [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
07:25 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Ping timeout: 240 seconds]
07:41 -!- mode/#openvpn [+v EugeneKay] by ChanServ
07:42 <@vpnHelper> RSS Update - forum: Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18725>
07:47 < krzee> hyper_ch, ya what a shocker :-p
07:48 <+EugeneKay> Misleading story is misleading
07:48 <+EugeneKay> It's a SAFARI bug in Windows.
07:49 < krzee> safari with direct kernel access...
07:49 < krzee> by low priv user
07:50 <+EugeneKay> Yes, memory corruption does that.
07:50 <+EugeneKay> Yes, it is shameful that it can happen
07:50 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
07:50 < krzee> it is a win7 bug too tho
07:52 <+EugeneKay> Indeed. But misleading story is still misleading - it ain't a vulnerability sane people will see.
07:52 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
07:54 <+EugeneKay> Ooooh, my miter saw shipped
07:54 <@vpnHelper> RSS Update - forum: Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18726>
07:55 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
07:56 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
08:16 -!- cafk [~Bizzare@p15142144.pureserver.info] has joined #openvpn
08:16 < cafk> Is having a "redirect-gateway def1" a sane thing to do in a server file? :)
08:22 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
08:27 <+EugeneKay> On the server? No. As a --push? Yes.
08:31 < cafk> http://pastie.org/3052491 << anything wrong with that?
08:31 < cafk> Im getting a "NOTE: unable to redirect default gateway -- Cannot obtain current remote host address
08:31 < cafk> server side
08:32 < cafk> (and after the connection is established, the tunnel isnt working)
08:32 <@dazo> cafk: don't use redirect-gateway on the server side ... that's nonsense
08:32 < cafk> fair enough :D
08:33 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
08:33 <@dazo> for the client side ... you probably need to add: route-gateway 10.8.0.1
08:34 <@dazo> cafk: also remote the ifconfig on the client side ... replace it with: pull
08:35 <@dazo> (the server will push the VPN IP address)
08:35 <@dazo> uhm ... strike that
08:35 <@dazo> you're doing a p2p setup
08:36 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
08:36 <@dazo> p2p setups don't push VPN IP addresses ... esp. when not using ifconfig-pool ... my fault
08:36 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Ping timeout: 240 seconds]
08:41 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
08:41 <@vpnHelper> RSS Update - forum: Virtual Adapter TAP-Win32 Provider V9 <http://forums.openvpn.net/topic9438.html>
08:42 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
08:44 <+EugeneKay> krzee - can I smack the stupid people?
08:46 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
08:57 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
09:00 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346.html#p18728>
09:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
09:12 < krzee> EugeneKay, /ctcp <nick> smack?
09:12 <@vpnHelper> RSS Update - forum: Virtual Adapter TAP-Win32 Provider V9 <http://forums.openvpn.net/topic9438.html#p18729>
09:12 <+EugeneKay> Oooooh
09:12 <+EugeneKay> I like it.
09:13 < cafk> dazo: eww, p2p setup?
09:13 < cafk> ohh nvm, I misunderstood
09:13 < cafk> yeah.
09:13 < cafk> Its point to point
09:13 < cafk> The weird thing thois
09:13 < cafk> I tried this on this local machine, but the local routes are incorrect and not redirecting all traffic through the tunnel
09:16 < cafk> http://pastie.org/3052648
09:16 < cafk> First comes part of the output of the client, and the routes I have
09:16 <+EugeneKay> Line 37 -_-
09:16 < cafk> note that youporn.com is just a placeholder for the ip address of my server ;)
09:17 < cafk> http://pastie.org/3052656  << for reference these are the config files I use
09:18 <+EugeneKay> So, 10.10.1.0/24 is your client's LAN on eth0
09:19 < cafk> yes
09:19 <+EugeneKay> What's all this garbage with 192.168
09:19 < cafk> 192.168 is for VirtualBox
09:20 <+EugeneKay> Ah okay
09:21 <+EugeneKay> Well there's an issue; you're using tcp.
09:21 < cafk> It's a necessity
09:22 < cafk> I have a rather restrictive proxy/firewall setup - port 443 tcp is the only way out ;)
09:22 <+EugeneKay> Sensible.
09:23 <+EugeneKay> Well, I've never seen that error message. Care to post complete logs?
09:23 <@ecrist> !tcp
09:24 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
09:24 <@ecrist> cafk: if 443 is the only way out, I'm surprised you can use IRC
09:24 < cafk> ecrist: Im currently at a buddys place, setting everything up.
09:24 <@ecrist> also, you must not like VOIP, streaming media, ICMP, and other such things
09:24 <+EugeneKay> ICMP is overrated.
09:25 < cafk> ecrist: They work just fine from experience through a TCP OpenVPN tunnel
09:25 -!- Damascene [~house@unaffiliated/uaa] has joined #openvpn
09:25 < cafk> In any case, if I had a choice Id use UDP - but I dont.
09:25 < cafk> As for the logs, give me a second
09:27 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has joined #openvpn
09:27 < mightor> hi when I run the config file I get an error here is the log
09:27 < mightor> http://pastebin.com/AkWN5n4k
09:27 < Damascene> Hi, I've been able to make openvpn works on pfsense after many problems, and I admit I didn't notice some important things. I will put part of the blame on windows coping technology as it didn't really override the old files even though it appeared that it did.
09:27 < cafk> EugeneKay: http://pastie.org/private/aibqqwb2vnovtfsnvhg
09:28 < mightor> it says tunnelbrick was unable to start openvpn to connect openfreevpn, for detauls check the log in the vpn details window
09:28 < mightor> m using OSX
09:28 <+EugeneKay> Which Windows is this, cafk ?
09:28 < Damascene> Now I want to know what is the recommended way to run openvpn client for non-admin user, please
09:29 < Damascene> I found something about running as service ,but is it the best way?
09:29 < hyper_ch> Damascene: via init script at boot up
09:29 < cafk> win7
09:29 < Damascene> on windows client?
09:30 < hyper_ch> Damascene: same reply... but first convert windows to linux :)
09:30 < Damascene> I'm working hard on that but some software needs to run on it.
09:30 <+EugeneKay> Stupid question. That command prompt has Admin privs, right?
09:33 -!- norc [~norc@p15142144.pureserver.info] has joined #openvpn
09:33 < norc> EugeneKay: Nevermind. This is the person who was writing from cafk. It's working
09:33 < norc> EugeneKay: Guess his routing table is either fucked up, or whatever. In any case, its working. ;-)
09:33 < Damascene> so, should I go with the service thing?
09:33 < mightor> tried again, same error
09:33 < norc> EugeneKay: Thank you in any case.
09:33 <+EugeneKay> norc - reboot usually cleans out the routing table well. Windows, le sigh.
09:34 < mightor> is my firewall software interfeating
09:34 < norc> EugeneKay: It's not necessary to completely reboot to get the old routing table back, but yeah.
09:36 < mightor> i better send the config file data
09:37 < mightor> http://pastebin.com/h4wsSUSg
09:38 < mightor> can someone help
09:38 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
09:38 <+EugeneKay> Sorry, I don't speak Mac.
09:39 <+EugeneKay> Looks like it's an issue with the tun kernel module? 
09:40 < mightor> ok where is the located
09:40 <+EugeneKay> I'm just tossing a dart at the wall here, I really have no idea.
09:40 < mightor> ok
09:41 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
09:47 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Ping timeout: 240 seconds]
09:48 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has quit [Quit: Page closed]
09:53 -!- dazo is now known as dazo_afk
09:53 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:53 -!- mode/#openvpn [+v Axeman] by ChanServ
09:58 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
10:05 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
10:12 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
10:15 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Ping timeout: 268 seconds]
10:17 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:18 -!- mode/#openvpn [+v Axeman2] by ChanServ
10:18 -!- thebishop [~thebishop@c-68-83-234-9.hsd1.pa.comcast.net] has joined #openvpn
10:19 -!- Axeman3 [~Axeman3@198.105.46.46] has joined #openvpn
10:20 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
10:23 -!- Axeman3 [~Axeman3@198.105.46.46] has quit [Client Quit]
10:23 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
10:32 <@vpnHelper> RSS Update - forum: Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18730>
10:44 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18731>
10:46 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
10:48 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
10:50 <@vpnHelper> RSS Update - forum: Routing: Configuring for accessing subnet clients +iptables <http://forums.openvpn.net/topic9432.html#p18732>
10:52 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:55 -!- rix1234 [~rix1234@114.143.161.178] has quit [Quit: Leaving]
11:01 -!- wedge [lordsilenc@bigfoot.xh.se] has joined #openvpn
11:03 -!- cocoa117 [~cocoa117@91.228.3.212] has joined #openvpn
11:20 <@vpnHelper> RSS Update - forum: Virtual Adapter TAP-Win32 Provider V9 <http://forums.openvpn.net/topic9438.html#p18733>
11:26 -!- icosahedral [neal@binarysoup.org] has joined #openvpn
11:33 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:43 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 240 seconds]
11:43 < Damascene> have you seen a situation where vpn client can connect to some client connected to the server but not all, especially windows clients
12:01 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
12:01 -!- mode/#openvpn [+o mattock] by ChanServ
12:20 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
12:21 -!- BenLue [NoMail@178-83-34-83.dynamic.hispeed.ch] has quit [Ping timeout: 248 seconds]
12:21 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:21 -!- mode/#openvpn [+o raidz] by ChanServ
12:23 -!- Azrael808 [~peter@178.102.211.63] has joined #openvpn
12:24 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has joined #openvpn
12:25 -!- Seb [~Seb@untangle/dev/seb] has joined #openvpn
12:25 < Seb> hi fellows
12:26 < Seb> i get pushed a "redirect-gateway def1,route-gateway 178.73.218.1" from a server I don't control, is there any environment variable that gateway address will end up in ?
12:26 < hyper_ch> not sure if I understand
12:26 < Seb> I'd like to re-use it in an up or route-up script (without accepting the "redirect-gateway" option, which I avoid right now by passing route-nopull)
12:27 < hyper_ch> Seb: def1 adds two routes
12:27 < Seb> I've used "env > /tmp/foo" in my route-up script, but I don't see "178.73.218.1" anywhere in there
12:27 < hyper_ch> you can add tehm yourself if you want
12:27 < Seb> sure, but I refuse the redirect-gateway altogether
12:27 < Seb> so i'm wondering how to programmatically retrieve that 178.73.218.1 value
12:28 < hyper_ch> why do you add that specifically?
12:28 < Seb> add what ?
12:28 < Seb> :)
12:28 < hyper_ch> 178.73.218.1
12:28 < Seb> i want to add a route through that only for a given host on my LAN
12:29 < hyper_ch> I'm not following what you try to achieve, sorry
12:29 < Seb> the question therefore remains, can I access that "remote gateway I was pushed" from a route-up script ?
12:30 < Seb> for instance, the ifconfig_local env. variable holds the IP I was pushed by the openvpn server; is there a variable I can use to get the IP of the gateway ?
12:30 -!- raidz_ [~raidz@stab-you-with-a.bluntshank.com] has joined #openvpn
12:31 < Seb> hyper_ch: well, the openvpn client in my case is the edge router for my network, and I'm trying to route some of my LAN clients through this openvpn tunnel
12:32 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
12:32 -!- raidz_ is now known as raidz
12:32 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
12:32 -!- icosahedral [neal@binarysoup.org] has quit [Quit: leaving]
12:33 -!- raidz [~raidz@stab-you-with-a.bluntshank.com] has quit [Changing host]
12:33 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:40 -!- Azrael808 [~peter@178.102.211.63] has quit [Ping timeout: 268 seconds]
12:45 < Damascene> have you seen a situation where vpn client can connect to some client connected to the server but not all, especially windows clients
12:46 -!- mirco [~mirco@p5B2821F6.dip.t-dialin.net] has joined #openvpn
12:48 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Quit: mattock]
12:49 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
12:51 -!- Damascene [~house@unaffiliated/uaa] has quit [Ping timeout: 244 seconds]
12:52 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
12:53 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
13:04 -!- Damascene [~house@176.45.42.41] has joined #openvpn
13:04 -!- Damascene [~house@176.45.42.41] has quit [Changing host]
13:04 -!- Damascene [~house@unaffiliated/uaa] has joined #openvpn
13:08 < wedge> I have a debian machine with several public IP as aliases. The OpenVPN will be a road warrior setup. Is it possible to setup openvpn so that clients will get a specific public IP?
13:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
13:10 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
13:11 < hyper_ch> wedge: setup a vpn
13:12 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:12 < hyper_ch> set iptables to forward all of a specific IP's public traffic to that openvpn ip
13:13 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
13:15 < krzee> yes, 1 option is the bi-nat (like hyper_ch said)
13:15 < krzee> another is to get a subnet routed to you and use the entire subnet in --server
13:16 < hyper_ch> and the third option?
13:18 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 252 seconds]
13:18 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
13:20 -!- cocoa117 [~cocoa117@91.228.3.212] has quit [Ping timeout: 248 seconds]
13:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 252 seconds]
13:37 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
13:40 -!- Damascene [~house@unaffiliated/uaa] has quit [Quit: Ex-Chat]
13:40 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
13:45 <@vpnHelper> RSS Update - forum: Ubuntu OpenVPN Client ping problem ! Mac Client no problem <http://forums.openvpn.net/topic9440.html> || up, down-pre, and down scripts not being executed <http://forums.openvpn.net/topic9439.html>
13:57 <@vpnHelper> RSS Update - forum: Log volume of traffic tunneled by a user <http://forums.openvpn.net/topic9392.html#p18736>
14:03 <@vpnHelper> RSS Update - forum: Disable split tunneling <http://forums.openvpn.net/topic9373.html#p18737>
14:09 <@vpnHelper> RSS Update - forum: Need help with OpenVPN client connecting to server <http://forums.openvpn.net/topic9427.html#p18739> || Advice on openvpn deployment <http://forums.openvpn.net/topic9411.html#p18738>
14:11 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has joined #openvpn
14:11 < mightor> hi can somebody help
14:11 < mightor> my VPN configuration isnt working
14:14 < mightor> http://pastebin.com/AkWN5n4k   http://pastebin.com/h4wsSUSg
14:15 < mightor> heres the error log and the code of the kext file .ovpn file
14:15 < mightor> I was unable to extract an oddly formatted compressed folder
14:16 < mightor> I think it was name client.tap
14:20 -!- Denial [Denial@drgi.co.uk] has quit []
14:23 -!- brad[] [~brad@TMA-1.brad-x.com] has joined #openvpn
14:24 < brad[]> I folks. I need to add a route statement to the machine running the OpenVPN server when a specific client connects 
14:24 < brad[]> Hi even.
14:24 < brad[]> route add -net 10.10.0.0/24 dev tun0 <-- specifically this 
14:27 -!- Kanyl [~on@unaffiliated/kanyl] has quit [Ping timeout: 255 seconds]
14:30 < krzie> brad[], the route is for the lan behind the client?
14:30 < brad[]> krzee: It's actually for the LAN behind the server to be able to communicate with the client 
14:30 < krzie> but with the client's LAN ip
14:30 < krzie> right...?
14:31 < brad[]> krzie: Yes, though this client has an IP that's unique to it - not shared by any other clients or networks (10.10.0.1)
14:32 < brad[]> Other VPN clients are using 172.30.x.x and the server has 192.168.0, 192.168.1 and 192.168.2 behind it 
14:32 < brad[]> physically connected
14:32 < krzie> either way
14:32 < krzie> it needs an iroute too
14:32 < krzie> !clientlan
14:32 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
14:32 <@vpnHelper> better explanation
14:32 < krzie> and the server can have the route always
14:32 < krzie> (when the vpn is running)
14:33 < krzie> so you just put this in the server config: route 10.10.0.0 255.255.255.0
14:33 < krzie> and in the client's ccd entry:
14:33 < krzie> iroute 10.10.0.0 255.255.255.0
14:33 < brad[]> krzie: I have an /etc/openvpn/ccd/HOSTNAME containing 'iroute 10.10.0.0 255.255.255.0' is that the correct form? Accompanied by 'route 10.10.0.0 255.255.255.0' in the server config file?
14:33 < brad[]> hm.
14:33 <+EugeneKay> !route
14:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
14:34 < krzie> !ccd
14:34 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
14:34 < krzie> its not ccd/HOSTNAME unless HOSTNAME and COMMON-NAME happen to be equal
14:34 < brad[]> krzie: Will iroute apply to LAN clients or only fellow VPN clients?
14:34 < krzie> to the server
14:34 < krzie> !iroute
14:34 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
14:35 -!- Kanyl [~on@unaffiliated/kanyl] has joined #openvpn
14:35 < krzie> if you want other clients to also get a route, you put this in the server config too:
14:35 < krzie> push "route 10.10.0.0 255.255.255.0"
14:35 < krzie> and that client needs ip forwarding enabled
14:36 < krzie> iroute modifies a routing table that is internal to the openvpn server process
14:37 < brad[]> ok
14:37 < brad[]> related question
14:37 < brad[]> the following is the routing table entry that works correctly when I manually add it using route add -net 10.10.0.0/24 dev tun0:
14:37 < brad[]> 10.10.0.0       0.0.0.0         255.255.255.0   U         0 0          0 tun0
14:38 < brad[]> However when I specify route 10.10.0.0 255.255.255.0 in the server config file, I have this: 
14:38 < BenLue> morning
14:38 < brad[]> 10.10.0.0       172.30.0.2        255.255.255.0   U         0 0          0 tun0
14:38 < brad[]> the 172..30.* IP being that of this side of the openvpn gateway
14:38 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
14:38 < BenLue> krzie my ovpn works now, i have tested with my HTC DHD
14:39 < BenLue> but it is normal, i havnt the ip from my HomeNet?
14:41 -!- Kanyl [~on@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
14:44 < krzie> BenLue, depends on your setup, but you should likely just have a vpn ip, you dont need one from your home net, you just setup routing correctly instead
14:44 < krzie> like this:
14:44 < krzie> !route
14:44 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
14:45 < krzie> brad[], ok... but the one openvpn added is right... you didnt add a gateway on your manual route
14:45 < krzie> if you're wondering why it uses .2, type !/30
14:46 < brad[]> The one I add manually works tohugh, whereas the one OpenVPN adds doesn't 
14:46 <@ecrist> brad[]: how many personalities are in the brad[] array?
14:46 < brad[]> Where a workstation on the LAN is then able to contact the OpenVPN client 
14:46 < krzie> you arent testing this over the same lan... right?
14:47 < krzie> echo "${brad[*]}"
14:47 < hyper_ch> hello there krzie
14:47 < hyper_ch> and ecrist
14:47 < krzie> yellow
14:50 <@ecrist> foreach ($brad as $person => $personality){ unset($brad[$personality]); exit; }
14:55 < brad[]> krzie: What do you mean not testing it over the same LAN?
14:58 <+EugeneKay> cat ecrist >> #irp 
15:04 < krzie> brad[], as in, your client and server are not currently on the same lan, right?
15:07 < brad[]> krzie: No
15:08 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has quit [Ping timeout: 258 seconds]
15:11 < krzie> brad[], let me see your configs without comments, like this:
15:11 < krzie> !configs
15:11 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
15:12 < brad[]> Sec
15:16 < brad[]> http://pastebin.com/Sa0XpcvA
15:16 < brad[]> @ krzie 
15:17 -!- REDSHIFT_ [522759d0@gateway/web/freenode/ip.82.39.89.208] has joined #openvpn
15:18 < REDSHIFT_> does anybody have openvpn and tunnelblick on OSX
15:18 < krzie> try putting 10.10.0.2 as the gateway for that route
15:18 < krzie> gateway config option can use a gateway
15:20 < krzie> i dont see an iroute in the ccd entry
15:31 -!- KaiserBeto [~KaiserBet@157.22.52.2] has joined #openvpn
15:31 -!- BenLue [~Ben@178-83-34-83.dynamic.hispeed.ch] has left #openvpn []
15:47 <@vpnHelper> RSS Update - forum: Change lport & rport given a binary from provider? [Linux] <http://forums.openvpn.net/topic9441.html>
15:49 -!- KaiserBeto [~KaiserBet@157.22.52.2] has left #openvpn []
15:49 -!- REDSHIFT_ [522759d0@gateway/web/freenode/ip.82.39.89.208] has quit [Ping timeout: 258 seconds]
15:50 -!- newl [~newl@97.75.165.156] has joined #openvpn
15:56 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
15:59 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
16:05 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
16:09 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
16:14 < krzie> spamhaus has been wiped from the internet for a bit
16:15 -!- newl [~newl@97.75.165.156] has joined #openvpn
16:15 < krzie> big ddos, i heard an ISP dropped them for it
16:16 < raidz> lol
16:17 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
16:17 <@vpnHelper> RSS Update - forum: Client routing and martian prob <http://forums.openvpn.net/topic9442.html>
16:17 < raidz> their website looks up from here krzie
16:18 < raidz> really slow though
16:19 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
16:22 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
16:24 < krzie> weird, from here i dont even get dns for their website
16:28 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
16:29 <@vpnHelper> RSS Update - forum: Routing: Configuring for accessing subnet clients +iptables <http://forums.openvpn.net/topic9432.html#p18742>
16:52 -!- Kanyl [~on@unaffiliated/kanyl] has joined #openvpn
17:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
17:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:17 <@vpnHelper> RSS Update - forum: Change lport & rport given a binary from provider? [Linux] <http://forums.openvpn.net/topic9441.html#p18744> || Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18743>
17:21 -!- newl [~newl@97.75.165.156] has left #openvpn []
17:23 -!- TJNII [~TJNII@tjnii.com] has joined #openvpn
17:23 <@vpnHelper> RSS Update - forum: Routing: Configuring for accessing subnet clients +iptables <http://forums.openvpn.net/topic9432.html#p18746> || Client routing and martian prob <http://forums.openvpn.net/topic9442.html#p18745>
17:26 -!- newl [~newl@97.75.165.156] has joined #openvpn
17:29 <@vpnHelper> RSS Update - forum: Virtual Adapter TAP-Win32 Provider V9 <http://forums.openvpn.net/topic9438.html#p18748> || up, down-pre, and down scripts not being executed <http://forums.openvpn.net/topic9439.html#p18747>
17:31 -!- mirco [~mirco@p5B2821F6.dip.t-dialin.net] has quit [Quit: mirco]
17:33 < TJNII> That's me!
17:33  * TJNII hits refresh on the forums
17:41 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18749>
17:47 <@vpnHelper> RSS Update - forum: Client routing and martian prob <http://forums.openvpn.net/topic9442.html#p18750>
17:55 -!- rave [~rave@122.2.46.76] has joined #openvpn
17:56 -!- rave [~rave@122.2.46.76] has quit [Client Quit]
17:57 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
18:37 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
18:41 -!- Denial [Denial@drgi.co.uk] has quit []
18:48 <@vpnHelper> RSS Update - forum: Change lport & rport given a binary from provider? [Linux] <http://forums.openvpn.net/topic9441.html#p18751>
18:50 -!- newl [~newl@97.75.165.156] has quit [Ping timeout: 255 seconds]
18:53 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Quit: AAAGH!  IT BURNS!]
18:54 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has joined #openvpn
18:55 -!- newl [~newl@97.75.165.156] has joined #openvpn
19:24 -!- _julian_ [~quassel@hmbg-5f76313d.pool.mediaWays.net] has joined #openvpn
19:27 -!- _julian [~quassel@hmbg-4d06e67d.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
19:36 <@vpnHelper> RSS Update - forum: Routing: Configuring for accessing subnet clients +iptables <http://forums.openvpn.net/topic9432.html#p18752>
20:18 -!- krzie [krzee@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
20:22 -!- master_of_master [~master_of@p57B53D88.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:24 -!- master_of_master [~master_of@p57B5408C.dip.t-dialin.net] has joined #openvpn
20:30 <@vpnHelper> RSS Update - forum: Traffic Not Routing Properly OpenBSD Routed VPN <http://forums.openvpn.net/topic9435.html#p18753>
20:37 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
20:38 -!- WebDawg [~WebDawg@officialg0d.com] has quit [Quit: ZNC - http://znc.in]
20:39 -!- twister004_ [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
20:40 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Ping timeout: 240 seconds]
20:40 -!- twister004_ is now known as twister004
20:40 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has quit [Ping timeout: 240 seconds]
20:43 -!- WebDawg [~WebDawg@officialg0d.com] has joined #openvpn
20:46 -!- newl_ [~newl@97.75.165.156] has joined #openvpn
20:46 -!- newl [~newl@97.75.165.156] has quit [Quit: Reconnecting]
20:48 -!- WebDawg [~WebDawg@officialg0d.com] has quit [Client Quit]
20:49 -!- WebDawg [~WebDawg@officialg0d.com] has joined #openvpn
20:56 -!- TJNII [~TJNII@tjnii.com] has quit [Ping timeout: 276 seconds]
21:06 <@vpnHelper> RSS Update - forum: openvpn multiple instances route issue? <http://forums.openvpn.net/topic9443.html>
21:06 -!- newl_ [~newl@97.75.165.156] has left #openvpn []
21:28 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
22:09 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
22:12 <@vpnHelper> RSS Update - forum: Packets enter but never exit <http://forums.openvpn.net/topic9444.html>
22:36 <@vpnHelper> RSS Update - forum: Site to Site problems. <http://forums.openvpn.net/topic9445.html>
22:48 <@vpnHelper> RSS Update - forum: OpenVPN Clients Automation <http://forums.openvpn.net/topic9129.html#p18757>
23:23 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
23:44 -!- norc [~norc@p15142144.pureserver.info] has quit [Ping timeout: 240 seconds]
23:53 -!- lusis [u2537@gateway/web/irccloud.com/x-riejrsdhgjnksksk] has joined #openvpn
23:53 < lusis> hey all. quick question. I'm routing all my traffic through our tunnel and it works fine. I'm trying to add push route exclusions as well. Those routes get pushed but the interface is incorrect so they don't actually work
23:54 < lusis> i.e. if I want to exclude, say, stackoverflow's ip address (because our openvpn server is on ec2), I have this in the server config: push "route 64.34.119.12 255.255.255.255 net_gateway"
23:55 < lusis> the route gets created correctly on the client side except for the interface. Thus the traffic is still attempting to route through the tunnel
23:55 < lusis> 64.34.119.12    192.168.1.2     255.255.255.255 UGH       0 0          0 tun0
23:55 < lusis> thoughts?
--- Day changed Thu Dec 22 2011
00:08 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has quit [Ping timeout: 240 seconds]
00:08 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has joined #openvpn
00:22 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
00:23 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Client Quit]
00:25 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
00:30 <@vpnHelper> RSS Update - forum: TLS key negotiation failed to occur within <http://forums.openvpn.net/topic9436.html#p18758>
01:19 < hyper_ch> ecrist: krzee: dazo_afk: EugeneKay: http://www.bbc.co.uk/news/technology-16289426
01:19 <@vpnHelper> Title: BBC News - Irish privacy watchdog calls for Facebook changes (at www.bbc.co.uk)
01:19 -!- mode/#openvpn [+o EugeneKay] by ChanServ
01:19 -!- hyper_ch was kicked from #openvpn by EugeneKay [Unnecessary pinging]
01:19 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
01:19 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
01:24 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346-15.html#p18759>
01:35 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:57 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
01:57 -!- faLUCE [~ocs@85.20.236.68] has joined #openvpn
01:57 < faLUCE> hi. I need to send udp packets to a client behind a nat. I tried some nat-traversal tools with udp hole punching, but they don't work because the client's firewall changes the port of outcoming packets. I tried a VPN (pptp) as well, but it introduces too much overhead, even if not encrypted. What can I do?
01:58 < faLUCE> does openvpn add overhead?
02:05 < hyper_ch> it does... but not that much IMHO
02:05 < faLUCE> hyper_ch: how much?
02:05 <@vpnHelper> RSS Update - forum: Virtual Adapter TAP-Win32 Provider V9 <http://forums.openvpn.net/topic9438.html#p18760>
02:06 < hyper_ch> let me fetch my magic crystal ball and start divining by querying the ghosts of google
02:08 < faLUCE> hyper_ch: I searched about that, but can't find an accurate answer
02:08 < hyper_ch> well, you could also just use tcpdump or something and analyse a package and see how much the openvpn wrapper adds
02:09 < hyper_ch> well, I don't notice much overhead - when I get it run properly
02:09 < faLUCE> hyper_ch: no, I don't want to configure a service "so to try"
02:09 < faLUCE> I need infos before doing experiments
02:10 < hyper_ch> I was taught to not trust infos until I have verified them myself
02:10 < hyper_ch> at least regarding the important parts
02:12 < faLUCE> hyper_ch: but I need a "~" value
02:13 < faLUCE> not a precise value
02:13 < hyper_ch> 42
02:17 < hyper_ch> on my 15mbit connection I can get dl speed of 1.2MB/s using openvpn over tcp
02:25 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
02:36 <@vpnHelper> RSS Update - forum: Packets enter but never exit <http://forums.openvpn.net/topic9444.html#p18761>
02:37 < hyper_ch>  oh noes, a black hole that eats packets and never lets them go :)
02:42 -!- Seb [~Seb@untangle/dev/seb] has left #openvpn []
02:44 -!- ||arifaX [~arifaX@unaffiliated/arifax/x-427475] has joined #openvpn
03:05 -!- mirco [~mirco@tmo-097-138.customers.d1-online.com] has joined #openvpn
03:28 <@vpnHelper> RSS Update - forum: openvpn multiple instances route issue? <http://forums.openvpn.net/topic9443.html#p18762>
03:32 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has joined #openvpn
03:32 < mightor> Hi can somebody help
03:34 <@vpnHelper> RSS Update - forum: Change lport & rport given a binary from provider? [Linux] <http://forums.openvpn.net/topic9441.html#p18765> || Error with address length ? <http://forums.openvpn.net/topic9430.html#p18764> || Routing: Configuring for accessing subnet clients +iptables <http://forums.openvpn.net/topic9432.html#p18763>
03:39 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Quit: Nettalk6 - www.ntalk.de]
03:39 <@vpnHelper> RSS Update - forum: Virtual Adapter TAP-Win32 Provider V9 <http://forums.openvpn.net/topic9438.html#p18766>
03:42 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:45 -!- LuckyY_ [~LuckY@188.142.61.123] has quit [Ping timeout: 240 seconds]
03:45 <@vpnHelper> RSS Update - forum: how to start openvpn without sudo <http://forums.openvpn.net/topic9404.html#p18767>
03:45 < mightor> how do you stop kexts that dont begin with 'apple'
03:45 < mightor> sudo /System/Library/StartupItems/]namehere] stop
03:45 < mightor> isnt working
03:45 < mightor> sudo /System/Library/StartupItems/[name] stop
03:54 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
04:02 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-15.html#p18768>
04:07 < mightor> why does tun.kext keep failing to loa
04:07 < mightor> d
04:12 -!- LuckyY [~LuckY@188.142.61.123] has joined #openvpn
04:14 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-30.html#p18770> || [SOLVED] how to start openvpn without sudo <http://forums.openvpn.net/topic9404.html#p18769>
04:19 < mightor> is there anybody here!
04:20 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-30.html#p18775> || Change lport & rport given a binary from provider? [Linux] <http://forums.openvpn.net/topic9441.html#p18774> || Client routing and martian prob <http://forums.openvpn.net/topic9442.html#p18773> || Virtual Adapter TAP-Win32 Provider V9 <http://forums.openvpn.net/topic9438.html#p18771>
04:25 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
04:32 <@vpnHelper> RSS Update - forum: Virtual Adapter TAP-Win32 Provider V9 <http://forums.openvpn.net/topic9438.html#p18776>
04:37 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has left #openvpn []
04:38 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18777>
04:44 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-30.html#p18780> || Error with address length ? <http://forums.openvpn.net/topic9430.html#p18778>
04:45 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
04:46 < reiffert> Moin.
04:48 < reiffert> Imagine that the owner of a openvpn-server wants to track the openvpn-clients and wants to know: - when did a client connect, - how long did he stay connected, - how many bytes did pass the tunnel, etc. How to gather these data?
04:55 < hyper_ch> hi reiffert
04:55 < hyper_ch> you turne into evilbook?
04:55 < hyper_ch> wanting to track everything :)
05:04 -!- mirco [~mirco@tmo-097-138.customers.d1-online.com] has quit [Quit: mirco]
05:09 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:10 < reiffert> Nah, just asking stupid questions cause I missed your stupid answers so sadly.
05:10 -!- caemir is now known as caemiur
05:10 -!- caemiur is now known as caemir
05:20 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:23 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
05:23 -!- mode/#openvpn [+o mattock] by ChanServ
05:32 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
05:35 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
05:39 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:51 <@vpnHelper> RSS Update - forum: Split tunnel tweaks? <http://forums.openvpn.net/topic7161.html#p18781>
05:58 -!- cafk [~Bizzare@p15142144.pureserver.info] has left #openvpn []
06:03 <@vpnHelper> RSS Update - forum: Client routing and martian prob <http://forums.openvpn.net/topic9442.html#p18782>
06:09 <@vpnHelper> RSS Update - forum: Create ovpn client file <http://forums.openvpn.net/topic7731.html#p18783>
06:16 < biggi_mat> dazo_afk: would you by any chance be present?
06:19 < reiffert> !forward
06:19 < reiffert> !factoids search forward
06:19 <@vpnHelper> 'winipforward', 'linipforward', 'fbsdipforward', 'linportforward', 'osxipforward', 'ipforward', and 'forwardsecurity'
06:19 < reiffert> !winipforward
06:19 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
06:20 < reiffert> I need to forward/nat tcp and udp ports from one interface to the other. Using Windows 7.
06:20 < reiffert> !factoids search nat
06:20 <@vpnHelper> 'nat', 'linnat', 'pfnat', 'freebsdnat', 'bsdnat', 'donate', 'winnat', 'openvzlinnat', 'nathack', 'openvznat', 'fbsdnat', and 'openbsdnat'
06:20 < reiffert> !winnat
06:20 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows or (#2) http://www.nanodocumet.com/?p=14 for windows XP
06:23 < reiffert> ah. netsh ftw
06:24 < reiffert> unfourtunately windows 2008 server only.
06:24 < reiffert> fortunaltely?
06:24 < reiffert> two wrongs = one right?
06:27 <@vpnHelper> RSS Update - forum: Client routing and martian prob <http://forums.openvpn.net/topic9442.html#p18784>
06:33 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:33 <@vpnHelper> RSS Update - forum: Create ovpn client file <http://forums.openvpn.net/topic7731.html#p18785>
06:48 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has joined #openvpn
06:48 < mightor> hi is anybody around
06:50 < mightor> gahhhit keeps failing to unload kext files
06:51 < mightor> Failed to unload com.logmein.hamachi - (libkern/kext) kext (kmod) start/stop routine failed."Failed to unload com.logmein.hamachi - (libkern/kext) kext (kmod) start/stop routine failed."
06:51 < reiffert> !notovpn
06:51 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
06:52 < reiffert> e.g. #macosx
06:52 < mightor> I need to unload them
06:52 < mightor> in order to get openvpn to work
06:52 < reiffert> unloading os x kernel extensions is not part of openvpn, is it?
06:53 < mightor> no its the OS im using
06:53 < mightor> macOSX is a usless channel
06:53 < reiffert> well kextunload would unload os x kernel extensions.
06:53 < mightor> as is ##mac
06:53 < mightor> okay
06:53 < reiffert> how could you tell, you are not on #macosx.
06:53 < mightor> prior to being here
06:54 -!- fprior [be0bbc86@gateway/web/freenode/ip.190.11.188.134] has joined #openvpn
06:54 < mightor> it worked when I tried it on another file
06:54 < mightor> oh sorry, it did not!
06:55 < mightor> well ill explain my real problem
06:55 < mightor> when I try and connect I get openvpnstart status #247: Loading tun.kext
06:56 < reiffert> thats because hamachi is already loading and running a tun.kext on its own. right.
06:56 < mightor> it fails because (I think) there is preloaded kext files there
06:57 < mightor> ok any idea how to unload it
06:57 < reiffert> I was facing that particular problem once and IIRC I solved the thing by telling hamachi to use the tun.kext that comes with tunnelblick and/or the one that I was compiling with the help of macports. However, I dont remember if that made hamachi to stop work.
06:57 < reiffert> ing
06:57 < mightor> I uninstalled the hamachi
06:57 < mightor> I hate it when it leaves crap behind like this
06:58 < reiffert> well then get rid of the tun.kext that comes from hamachi. unload, delete the .kext directory, reboot or smth similar.
06:58 < reiffert> be sure to check all the "load automatically" stuff in os x, Library/Launchwhatever/*
06:58 < mightor> the tun.kext file is not part of hamachi
06:58 < reiffert> and system/library/launchwhatever
06:59 < mightor> hamachi is some application I had
06:59 < reiffert> do as I say.
06:59 < mightor> ok
07:02 < mightor> It isnt letting me unload the directory
07:02 < mightor> whats the command again
07:02 < reiffert> rm -rf tun.kext/
07:02 < reiffert> and then reboot that bunny
07:04 < mightor> ok I delelted tun.kext in /applications/tunnelblick/contents/resources
07:04 < mightor> and unloaded the kext directory
07:05 < mightor> is this right
07:06 < mightor> ill reboot. brb i have run.kext backed up snyhow
07:06 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has quit [Quit: Page closed]
07:09 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has joined #openvpn
07:10 < mightor> ok that woked
07:10 < mightor> but now It keeps dissconnecting when I connect
07:10 < mightor> ive heard of this problem
07:13 <@vpnHelper> RSS Update - forum: Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18786>
07:19 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-30.html#p18787>
07:19 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
07:24 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
07:31 < fprior> Hi all, I've a trouble with OpenVpn Management Interface: when a client click on Disconnect option in OpenVpn Gui (Windows), not appear Disconnect event on openvpn server  and command "status" show client  stay connected. Is it normal ?
07:33 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
07:33 -!- mode/#openvpn [+o mattock] by ChanServ
07:33 < mightor> "2011-12-22 13:32:08 Cannot load certificate file client.crt: error:02001002:system library:fopen:No such file or directory: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib 2011-12-22 13:32:08 Exiting"
07:34 < reiffert> Cannot load certificate file client.crt
07:34 < reiffert> No such file or directory
07:35 < mightor> lucky I have a copy of it
07:35 < krzee> !path
07:35 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
07:35 < mightor> where do I paste it
07:37 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-30.html#p18788>
07:37 < reiffert> afk
07:38 < krzee> moin reif
07:39 < mightor> ok now it says it connected in the log but it still disconnects
07:41 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
07:42 -!- biggi_mat [c15ff27e@gateway/web/freenode/ip.193.95.242.126] has quit [Ping timeout: 258 seconds]
07:45 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
07:50 < mightor> here is what I get in the log http://pastebin.com/bpywgzGF
07:54 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
08:02 -!- rooth [rooth@ge.mig.en.redfox.nu] has quit [Ping timeout: 252 seconds]
08:03 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
08:03 < mightor> anbody there
08:04 < mightor> brb
08:04 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has quit [Quit: Page closed]
08:07 -!- newl [~newl@97.75.165.156] has joined #openvpn
08:09 -!- thebishop [~thebishop@c-68-83-234-9.hsd1.pa.comcast.net] has quit [Remote host closed the connection]
08:12 -!- olli23 [~sYsT3m@31-17-56-111-dynip.superkabel.de] has joined #openvpn
08:14 -!- Denial [Denial@drgi.co.uk] has quit []
08:15 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has joined #openvpn
08:16 < mightor> ok I am still getting the could not locate file error
08:16 < mightor> but they are there!
08:16 < mightor> http://pastebin.com/HZWdK6m6
08:18 < olli23> hi, what needs to be changed in client.conf so that the default gateway is not overwritten by the openvpn server?
08:19 < hyper_ch> olli23: isn't it simplre to remove def1 on the server?
08:19 <@ecrist> !configs
08:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
08:19 <@ecrist> mightor: ^^^
08:20 < mightor> ok my bad, its done now but now I get this despite it finding the files:
08:20 < olli23> hyper_ch: i can't do any changes at the server side, because it's a paid service
08:20 < hyper_ch> ah
08:20 < mightor> http://pastebin.com/NmmC9zmZ
08:21 < hyper_ch> !def1
08:21 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
08:21 < hyper_ch> !man
08:21 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
08:21 < mightor> I download the open VPN configuration
08:22 <@ecrist> mightor: I see no problems in that log.
08:22 <@ecrist> it says you're connected
08:22 < olli23> ok, I also can use redirect-gateway at client side?
08:22 < mightor> hmm thats odd
08:22 <@ecrist> olli23: you can, but if the server isn't set up right, it won't work
08:22 -!- newl [~newl@97.75.165.156] has left #openvpn []
08:23 < olli23> ecrist: ok
08:23 < mightor> should I downgrade 
08:23 < mightor> the version of tunnelblick
08:23 <@ecrist> mightor: upgrade.  3.2 was released a couple days ago
08:24 <@ecrist> and tunnelblick is working just fine
08:24 < mightor> im using that
08:24 < mightor> but beta 32
08:24 < mightor> is this ok in OSX snow lepoard
08:24 <@ecrist> yes
08:24 < mightor> hmm
08:26 < mightor> the open vpn version is 2.2.1
08:26 <@ecrist> IT'S FINE
08:26 <@ecrist> your problem isn't the version of openvpn, not sure what you're looking for
08:26 < mightor> I dont know why it isnt working thats all
08:27 -!- ||arifaX [~arifaX@unaffiliated/arifax/x-427475] has quit []
08:27 <@vpnHelper> RSS Update - forum: OpenVPN 2.2.2 released <http://forums.openvpn.net/topic9446.html>
08:29 < mightor> 2011-12-22 14:28:43 Cannot load certificate file client.crt: error:02001002:system library:fopen:No such file or directory: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib
08:29 < mightor> it says that in the log
08:29 < mightor> the file is right there in system>library
08:32 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
08:32 <@vpnHelper> RSS Update - forum: Specifying which TAP-WIN32 to use <http://forums.openvpn.net/topic9447.html>
08:33 -!- thebishop [~thebishop@66.187.140.174] has joined #openvpn
08:34 <@ecrist> mightor: it needs to be in ~/Library/openvpn
08:34 < mightor> ok
08:35 <@ecrist> Welcome to the OpenVPN community support channel  || PLEASE read the entire topic! || Current Release: 2.2.2 (22-Dec-2011) || Your problem is your firewall, really. || First time here? Use !welcome and !goal || Access Server? /join #openvpn-as || We're not psychic - please !pastebin your !configs and !logs and a description of your problem || English not your first language? Say so!
08:35 -!- ecrist changed the topic of #openvpn to: Welcome to the OpenVPN community support channel  || PLEASE read the entire topic! || Current Release: 2.2.2 (22-Dec-2011) || Your problem is your firewall, really. || First time here? Use !welcome and !goal || Access Server? /join #openvpn-as || We're not psychic - please !pastebin your !configs and !logs and a description of your problem || English not your first language? Say so!
08:39 < mightor> http://pastebin.com/s1qheUVZ
08:41 < mightor> still keeps disconnecting 
08:41 < mightor> I must have the macbook from hell
08:41 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
08:42 <@ecrist> mightor: your log doesn't show anything
08:42 <@ecrist> !logs
08:42 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:43 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
08:43 -!- mode/#openvpn [+o mattock] by ChanServ
08:43 <@vpnHelper> RSS Update - forum: Specifying which TAP-WIN32 to use <http://forums.openvpn.net/topic9447.html#p18792>
08:43 < mightor> how do you make them verbose 5
08:43 <@ecrist> !man
08:43 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
08:48 < mightor> http://pastebin.com/0wKKdgAF
08:49 <@ecrist> !configs
08:49 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
08:50 < mightor> http://pastebin.com/xGqd38w3
08:51 < mightor> how do I put in the OS and version
08:51 <@ecrist> and WHERE on your system is the config file located?
08:52 <@ecrist> and where are the certificate files located?
08:52 < mightor> users/openvpn/configurations
08:53 < mightor> certificates are located in ~/Library/openvpn
08:53 < mightor> and in
08:53 < mightor> users/openvpn/configuration
08:53 < mightor> users/openvpn/configurations
08:54 < mightor> actually the thing in users/openvpn/configurations is a shortcut
08:54 < mightor> it is really in /Users/krisfinney/Library/Application Support/Tunnelblick
08:56 < mightor> maybe teamviewer would be a good idea to use to get help
08:56 < mightor> but I wont learn as much
08:57 <@ecrist> mightor: you're doing it wrong
08:57 < mightor> ok
08:57 <@ecrist> create ~/Library/openvpn
08:57 <@ecrist> put ALL of your files in there
08:58 < mightor> library or system/library
08:58 < mightor> ok
08:59 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
09:01 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
09:01 -!- mode/#openvpn [+o mattock] by ChanServ
09:01 -!- mattock [~samuli@openvpn/corp/admin/mattock] has left #openvpn []
09:04 -!- thebishop [~thebishop@66.187.140.174] has quit [Ping timeout: 252 seconds]
09:08 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
09:08 -!- norc_ [~norc@p15142144.pureserver.info] has joined #openvpn
09:11 < mightor> it keeps opening a new configuration folder when I run the app
09:11 < mightor> will I paste the config there too
09:14 < mightor> the openvpn directory is in ~/Library/openvpn and contains ca.crt, client.crt, freeopenvpn.ovpn and a folder named keys wich has
09:14 < mightor> ca, crt is in a folder named 'keys'
09:15 <@ecrist> why did you put the 'keys' in a separate folder?
09:15 < mightor> I was told to before
09:15 <@ecrist> wtf did i tell  you to do?
09:15 < mightor> it was somebody here
09:16 < mightor> I did it and it keeps making a new folder when i run the program
09:16 < mightor> which is how it was before
09:16 <@ecrist> i'm done helping you
09:16 < mightor> its in /users/library.application support/tunnelblick
09:17 < mightor> the folder in library still isnt working despite if its in the keys folder or not
09:19 < mightor> brb
09:20 < mightor> I just did what you told me and it is still doing the same thing
09:41 -!- dazo_afk is now known as dazo
09:51 <@vpnHelper> RSS Update - forum: openvpn multiple instances route issue? <http://forums.openvpn.net/topic9443.html#p18793>
09:52 -!- cjs226 [~cjs226@99-61-65-242.lightspeed.austtx.sbcglobal.net] has quit []
09:52 < mightor> somebody please help!
09:54 <@ecrist> mightor: I told you what to do, and you didn't listen.
09:54 < mightor> I did to it!
09:54 < mightor> it was already there
09:55 < mightor> the only one that had the keys folder was in application support
09:55 < mightor> it still isnt working anyhow so whats the problem
09:55 <@dazo> mightor: I don't have time to help ... but now, you're setup is a mess .... the best way is now to uninstall everything and start from the beginning, step by step - and do it slowly according to ecrist's description
09:56 <@dazo> fixing a messed setup when not having complete understanding makes things just worse .... and ecrist knows what he talks about
09:58 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
10:03 < mightor> ok I installed it again now I get the opening message saying 'there are no vpn configuratiosn installed'
10:03 <@vpnHelper> RSS Update - forum: openvpn multiple instances route issue? <http://forums.openvpn.net/topic9443.html#p18794>
10:03 < mightor> I already have them
10:04 < mightor> OK this is the problem
10:04 < mightor> I said I have them so it asked me to drag them into the new folder it creates
10:04 < mightor> now it is asking me again!
10:04 < mightor> ok ill drag them over and see if it goes away
10:05 < mightor> WOOHOO IT WORKED
10:05 < mightor> its busy connecting atm
10:09 < mightor> is it normal for it to be slow when it first connects
10:11 < mightor> this is the current log
10:11 < mightor> http://pastebin.com/ZVByZC0M
10:11 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
10:12 <@dazo> mightor: you really don't read well ...
10:12 <@dazo> what do you really think lines 19-38 means?
10:13 < mightor> it times out and trys again
10:13 < mightor> but it seems to have stopped doing that, hence the last line?
10:13 <@dazo> and why do you think it times out and tries again?
10:14 < mightor> because it is unable to connect
10:14 <@dazo> and why?
10:14 < mightor> there is a number of reasons
10:14 <@dazo> such as?
10:15 < mightor> hmm
10:15 < mightor> i dont know
10:16 <@dazo> Is the server reachable?
10:16 < mightor> what does 2011-12-22 16:10:33 NOTE: --mute triggered...
10:16 < mightor> at this time, no
10:16 <@ecrist> !man
10:16 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
10:16 <@ecrist> I need to write a man page parser for vpnHelper
10:17 <@ecrist> so I can do !man mute and have it print that part of the man page
10:17 <@dazo> (that'd be great .... but I think I've said that before :))
10:17 <@ecrist> heh, probably
10:17 <@ecrist> this would involve me learning python, though
10:17 <@ecrist> and I really have no desire to learn python
10:17 <@ecrist> the next language I'm going to learn will be C/C++
10:18 < mightor> do you know of any other IP's and ports
10:18 < mightor> that you think might work
10:18 < hyper_ch> a lot of people say that python is a great language
10:18 < mightor> I have ahd a hard time finding some in google
10:18 <@dazo> mightor: which server do you connect to?
10:18 <@ecrist> mightor: are you running a VPN server?
10:18 < mightor> Im not hosting a server
10:18 < mightor> the server is:
10:18 < mightor> 174.127.64.104:443174.127.64.104:443
10:19 < mightor> 174.127.64.104:443
10:19 <@ecrist> where do you get that address from?
10:19 < mightor> the openvpn config file
10:19 <@ecrist> who gave you the config file?
10:19 < mightor> I dont renember very well
10:19 < mightor> I got it from a website
10:20  * dazo is so tempted to refresh his /kick skills now ....
10:20 <@ecrist> you need to run a server
10:20 <@ecrist> or you need to purchase access to someone else's server
10:20 < mightor> is there a free account one
10:20 <@ecrist> probably, but we don't know
10:20 <@ecrist> we don't host servers for people
10:21 < mightor> when I googled I could not find anything
10:21 <@ecrist> this channel to help help those trying to setup a server and the like
10:21 < mightor> maybe I was googing it wrong
10:21 <@ecrist> !goal
10:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:21 < mightor> ill try networking
10:21 < mightor> what sort of server do I need
10:21 <@ecrist> why are you trying to set up openvpn?
10:22 < mightor> because I want to use a vpn on my computer
10:22 <@dazo> why?
10:22 <@ecrist> what are you going to do with the vpn?
10:23 < mightor> omegle.com keeps bugging all the time with my setup
10:23 < mightor> others say it is not going ot for them
10:23 < mightor> my old proxy used to work, to a point
10:23 <@ecrist> I have no idea what you're trying to say
10:23 < mightor> the website holders have not fixed it in a long time
10:23 <@ecrist> mightor: you're in the wrong place
10:23 <@ecrist> we can't help you
10:24 < mightor> I thought the config file was a sample VPN server that did not need an account
10:24 < mightor> :O
10:24 <@dazo> mightor: if you don't know what VPN is or how it can help you, and don't know the requirements for a VPN setup ... this is definitely not something you should play with now
10:24 < mightor> VPN can make the internet connection faster
10:24 < mightor> I know that
10:25 <@dazo> LOL
10:25 <@ecrist> mightor: no, it cannot
10:25 <@dazo> You gotta be kidding ....
10:25 <@ecrist> a VPN will only SLOW your connection
10:25 < mightor> well id be damned
10:25 <@dazo> (usually, not much though, but it will definitely not make it faster)
10:25 < mightor> im not sure what to ask in ##networking
10:26 <@ecrist> you're adding encryption and additional packet headers to every single packet, that results in reduced space for your real data, and additonal routing latency
10:26 < mightor> I need a server that is free but has an account so I can connect to it using a client
10:26 <@ecrist> try tor
10:26 <@ecrist> but openvpn isn't what you should be using
10:26 <@dazo> mightor: just forget about VPN ... that is not what you are looking for
10:27 <@dazo> yeah, TOR sounds better
10:27 < mightor> tor is windows
10:27 < mightor> ive found it hard finding another vpn or proxy for mac 
10:27 < mightor> I use hotspot shield 
10:27 <@ecrist> tor is not windows
10:27 <@dazo> TOR is multiplatform ... I even have TOR on my Nokia N900
10:27 <@ecrist> https://www.torproject.org/docs/tor-doc-osx.html.en
10:28 <@vpnHelper> Title: Tor Project: Mac OS X Install Instructions (at www.torproject.org)
10:28 <@ecrist> there you go, mightor 
10:30 -!- novaflash_away is now known as novaflash
10:30 < mightor> wait a minute..
10:30 < mightor> it is in my downloads folder already
10:30 < mightor> ok ill extract it
10:30 < mightor> I may need some help setting it up
10:32 <@ecrist> we're not going to help you
10:32 <@ecrist> this isn't a tor support channel
10:32 <@dazo> mightor: try #tor on oftc
10:32 < mightor> ok
10:32 < mightor> thanks
10:33 <@dazo> (there's also a #tor channel here on FreeNode, but it's probably less people here)
10:34 < mightor> it works but is there a way to speed it up
10:35 < mightor> it is the page, it says 'connecting to server' for a quile
10:35 -!- mightor was kicked from #openvpn by ecrist [go to #tor]
10:36 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has joined #openvpn
10:36 < mightor> ok..
10:37 <@dazo> mightor: step carefully now ... that kick was a strong warning ... only openvpn related topics are accepted from you here now ... from what we understand so far, we in #openvpn *can not* help you.
10:38 < mightor> ok
10:38 < mightor> ill keep that in mind
10:38 <@dazo> thx!
10:38 -!- homer5439 [4de495da@gateway/web/freenode/ip.77.228.149.218] has joined #openvpn
10:39 -!- homer5439 [4de495da@gateway/web/freenode/ip.77.228.149.218] has quit [Client Quit]
10:41 -!- biggi_mat [c15ff27e@gateway/web/freenode/ip.193.95.242.126] has joined #openvpn
10:42 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Remote host closed the connection]
10:42 -!- mirco [~mirco@tmo-097-84.customers.d1-online.com] has joined #openvpn
10:43 < biggi_mat> Hello there! I'm having routing issues - when a client connects to VPN he can not access any of the machines in the LAN of the VPN server (10.1.1.0/24). Here's how I'm pushing things: push "route 10.1.0.0 255.255.0.0". Any hint what I've missed?
10:44 <@ecrist> !route
10:44 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
10:47 < biggi_mat> This thing doesn't open :<
10:47 <@dazo> biggi_mat: routing is one important thing ... firewalling is the other one ... and if you still use eurephia, it can even do dynamic firewall updates based on combo of username/certificate
10:47 <@dazo> ecrist: your webserver is a bit slow now
10:47 <@ecrist> dazo: I see that
10:48 <@ecrist> already looking into it
10:48 < biggi_mat> I am using eurephia, but this isn't the issue now. I don't know how to route, dazo :)
10:48 < biggi_mat> ecrist: if this url which you gave me is your serve then...you have a problem :)
10:49 -!- luckman212_ [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
10:49 <@ecrist> it is, working on it
10:49  * ecrist needs a new server
10:49 <@ecrist> last pid: 59349;  load averages:  9.64,  3.28,  1.29                                                                    up 3+18:29:53  10:46:34
10:49 <@ecrist> 91 processes:  12 running, 78 sleeping, 1 zombie
10:50 <+EugeneKay> BRAINS?
10:50 < biggi_mat> :o
10:50 -!- mirco [~mirco@tmo-097-84.customers.d1-online.com] has quit [Ping timeout: 240 seconds]
10:51 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
10:52 <@dazo> biggi_mat: I see you tried to ping me earlier today
10:52 < biggi_mat> dazo: *shrug* maybe
10:52  * dazo is closing up at work the next hours ... preparing for Christmas holidays
10:52 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
10:53 < biggi_mat> dazo: in any case, I'm a happy gnome at this point when it comes to eurephia. I want to thank you for the help!
10:53 < biggi_mat> Now just to sort this routing out, and I'll be a damn happy panda
10:54 <@dazo> biggi_mat: nice to hear! :)
10:55 < SviMik> hi all. is there a way to parse/view crl.pem file?
10:55 < biggi_mat> Ping request goes through but reply doesn't return
10:55 <@dazo> SviMik: use openssl crl -in crl.pem -noout -text .... iirc
10:55 -!- mirco [~mirco@p5B2844DE.dip.t-dialin.net] has joined #openvpn
10:56 <@dazo> biggi_mat: make sure you have proper return routing as well ... so that the remote box routes the VPN traffic through the proper OpenVPN ... this is crucial in setups where OpenVPN is not running on the default gateway of the LAN
10:57 <@ecrist> ok, that link should work now
10:57 <@vpnHelper> RSS Update - forum: openvpn multiple instances route issue? <http://forums.openvpn.net/topic9443.html#p18795>
10:57 < SviMik> dazo thx, it works :)
10:57 <@dazo> (remote box in this context - the box on your LAN ... sorry, that was unclear of me)
10:57 <@dazo> SviMik: cool!
10:57 <@ecrist> biggi_mat: ^^^
10:59 -!- rave [~rave@184.22.182.246] has joined #openvpn
10:59 <@ecrist> go away, rave
10:59 < rave> why ecrist. what is the problem?
11:10 -!- mightor [522759d0@gateway/web/freenode/ip.82.39.89.208] has quit [Ping timeout: 258 seconds]
11:12 -!- rave [~rave@184.22.182.246] has quit []
11:26 -!- krzie [krzee@openvpn/community/support/krzee] has joined #openvpn
11:37 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has joined #openvpn
11:42 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
11:43 <@vpnHelper> RSS Update - forum: OpenVPN visibility question. <http://forums.openvpn.net/topic9449.html>
11:47 -!- kyrix [~ashley@91-115-62-42.adsl.highway.telekom.at] has joined #openvpn
12:09 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Quit: Leaving.]
12:25 <@vpnHelper> RSS Update - forum: Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18797>
12:26 -!- olli23 [~sYsT3m@31-17-56-111-dynip.superkabel.de] has quit [Ping timeout: 240 seconds]
12:37 <@vpnHelper> RSS Update - forum: Client routing and martian prob <http://forums.openvpn.net/topic9442.html#p18798>
12:39 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
12:49 -!- troyt [~troyt@PariahZero.broker.freenet6.net] has quit [Ping timeout: 252 seconds]
12:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:06 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has joined #openvpn
13:11 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Remote host closed the connection]
13:11 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
13:12 -!- gh0strider [blackhawk@poizon.org] has joined #openvpn
13:17 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has joined #openvpn
13:19 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
13:22 -!- sunzofman [~sunzofman@c-76-112-187-140.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
13:33 -!- apex44 [~sYsT3m@31-17-56-111-dynip.superkabel.de] has joined #openvpn
13:34 < apex44> hi, every time I connect to a vpn server, the default gateway is changed to the vpn server, but I want to keep the gateway from my local router, is there an option like no-pull-gateway?
13:41 < hyper_ch> apex44: had a look at all the options openvpn provides like invoking    man openvpn?
13:42 <@ecrist> we'll make a troll out of you yet, hyper_ch 
13:43 < hyper_ch> I'm not there yet?
13:43 < hyper_ch> awwwww :(
13:44 < hyper_ch> how much longer do I still have to wait for the troll badge?
13:44 < hyper_ch> dazo: I think I have now a working setup for my udp/tcp problem
13:44 <@ecrist> just ask for a claok, you'll get your +v badge
13:45 <@dazo> apex44: look for --route-no-pull in the man page ... but needed routes needs to be set up manually then in your config
13:45 <@dazo> hyper_ch: nice!  what did you change?
13:45 < hyper_ch> well, the server now by default runs UDP
13:45 < hyper_ch> and when I connect to it, I use TCP
13:46 < hyper_ch> having 10.8.0.x running UDP
13:46 < hyper_ch> 10.8.1.x running TCP
13:46 < hyper_ch> and 10.8.2.x runnding TCP with no-delay option
13:46 <@dazo> and performance wise?
13:46 < hyper_ch> the other client gets with rtorrent now 8-9 MB/ps
13:47 < hyper_ch> and when I use TCP for local download I'm at 1.1 MB/s right now
13:47 < hyper_ch> so performance is there for both
13:47 <@dazo> nice!
13:47 <@vpnHelper> RSS Update - forum: Is there a way to automate the original default gateway? <http://forums.openvpn.net/topic9450.html>
13:48 < hyper_ch> :)
13:49 < apex44> dazo: I also need the gateway from the vpn, my goal is to set up policy based routing, where alls web traffic is redirected to the vpn. the problem is, linux always uses the vpn interface as the default gateway, no matter what metric or whatever is set up
13:51 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
13:51 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
13:51 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
13:51 <@dazo> apex44: then you probably need to look more at the --up and --route-up script hooks ... and use iproute2 or similar tools to set up these routes how you'd like
13:52 <@dazo> most likely you still need --route-nopull as well
13:52  * hyper_ch gives dazo a big chocolate coated cookie with crispy suff on it
13:53 < apex44> dazo: ok, I'll try this, thanks
13:53 <@vpnHelper> RSS Update - forum: Client get IP but can't browse through intranet <http://forums.openvpn.net/topic9424.html#p18800>
13:54 <@dazo> hyper_ch: you'd better come to FOSDEM and provide these cookies there ... I think the cookie pile have become decently high lately :-P
13:54 < hyper_ch> when and where is fosdem?
13:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:55 < hyper_ch> feb. 30?
13:57 <@dazo> hyper_ch: hehehe ... feb 4-5, 2012 :)
13:57 <@dazo> in Brussels
13:57 -!- fprior [be0bbc86@gateway/web/freenode/ip.190.11.188.134] has quit [Quit: Page closed]
13:57 <@dazo> http://fosdem.org/2012/
13:57 <@vpnHelper> Title: fosdem.org (at fosdem.org)
13:57 < hyper_ch> it's been a while since I was in Bruxelles
13:57 < hyper_ch> since my friend from Paris finished her kinési studies there and moved to Bordeaux I haven't been there
13:58 < hyper_ch> so, if I go there, I just need to look for the largest pile of cookies and you'll be right next to it?
13:58 <@dazo> :)
13:58 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Remote host closed the connection]
13:58 <@vpnHelper> RSS Update - forum: Route problems in Windows 7/2008 <http://forums.openvpn.net/topic9346-15.html#p18801>
13:58 <@dazo> We're probably 4-5 people from the OpenVPN developers group in Europe who will come there
13:59 <@dazo> so we will probably arrange something unofficial meeting somewhere/somehow
13:59 < hyper_ch> dazo: ULB Campus Solbosch, Brussels, Belgium, Europe, Earth.  --> this is not exact enough
13:59 < hyper_ch> which solar system? which galaxy? which universe?
14:00 <@dazo> hahahaha
14:00 <@dazo> If you're able to travel between galaxies and universes, we definitely need to have a talk!
14:00 < hyper_ch> FOSDEM Beer Event --> Belgium has lots of beers... I've only tasted about 50-60 brands this far
14:01 < hyper_ch> "If you're able to travel between galaxies and universes" ->  /me acts surprised: You are not able to do that?
14:02 <@dazo> :)
14:03 <@dazo> hyper_ch: I'm doing OpenVPN ... that's its own universe ... haven't been able to escape from that yet ;-)
14:03 < hyper_ch> so, what's to do there?
14:03 < hyper_ch> at FosDem
14:05 <@dazo> for OpenVPN nothing concrete is planned yet ... it will be some unofficial hacking meeting probably, some planning and get to know people we usually just meet on irc .... but I hope it's possible to join some of the dev rooms and lightning talks as well
14:05 <@dazo> Hopefully we're close around an alpha/beta release for the v2.3 tree
14:06 -!- Beave [~champ@bundy.vistech.net] has joined #openvpn
14:07 < hyper_ch> :)
14:17 <+EugeneKay> Sexy
14:28 < hyper_ch> will EugeneKay also be there?
14:29 <+EugeneKay> I am everywhere
14:33 <@vpnHelper> RSS Update - forum: DNS Round robin : client not failing over <http://forums.openvpn.net/topic9380.html#p18802>
15:03 <@vpnHelper> RSS Update - forum: route and nat howto? (I do not know the correct title) <http://forums.openvpn.net/topic9263.html#p18803>
15:05  * krzie checks under his desk for a eugene kay
15:08  * dazo releases a fart under his desk to gas EugeneKay out of there
15:08 <+EugeneKay> You fool! You'll kill us all!
15:08  * dazo whistles innocently
15:08 <@vpnHelper> RSS Update - forum: up, down-pre, and down scripts not being executed <http://forums.openvpn.net/topic9439.html#p18804>
15:10 <+EugeneKay> w00t. Just balanced my bank account
15:11 < hyper_ch> EugeneKay: then I can use your CC again :)
15:11 <+EugeneKay> I'm gonna say "no", as I don't have a credit card
15:12 <+EugeneKay> Debit or gtfo
15:12 < hyper_ch> ha, banks think you're not credit worthy and decline to issue a CC
15:13 <+EugeneKay> Nope, I don't have one because I don't liek them.
15:13 <+EugeneKay> I take pride in owning every single thing I have.
15:13 <+EugeneKay> No mortgage on my home, no car loan, no credit card, nothing. 
15:14 < hyper_ch> :)
15:14 <@vpnHelper> RSS Update - forum: up, down-pre, and down scripts not being executed <http://forums.openvpn.net/topic9439.html#p18805>
15:14  * dazo use CC when shopping online .... because he don't trust he will get money back if it's a fraud
15:15 <+EugeneKay> Closest thing to a shady retailer I use is eBay, and PayPal dispute resolution has found in my favor every time I've had a crap Hong Kong seller not ship my 99c trinket.
15:20 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
15:31 <@vpnHelper> RSS Update - forum: [ASK] running openvpn server on port udp 53 - windows 2008 <http://forums.openvpn.net/topic9451.html>
15:34 -!- Cr4zi3 [killaz@crazie2-1-pt.tunnel.tserv12.mia1.ipv6.he.net] has quit [Ping timeout: 252 seconds]
15:40 -!- dazo is now known as dazo_afk
15:48 -!- gremly [~gremly@200.106.218.64] has quit [Quit: WeeChat 0.3.6]
16:01 <@vpnHelper> RSS Update - forum: Disconnect problem <http://forums.openvpn.net/topic9452.html>
16:07 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
16:07 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
16:23 -!- kyrix [~ashley@91-115-62-42.adsl.highway.telekom.at] has quit [Quit: Ex-Chat]
16:30 -!- newl [~newl@97.75.165.156] has joined #openvpn
16:42 -!- MikeJansen [~mike@cpe-067-023-159-090.dhcp.wadsnet.com] has quit [Read error: Connection reset by peer]
16:43 -!- pranq [pranq@unaffiliated/contempt] has quit [Ping timeout: 268 seconds]
16:44 -!- pranq [pranq@unaffiliated/contempt] has joined #openvpn
17:26 <@vpnHelper> RSS Update - forum: DNS Round robin : client not failing over <http://forums.openvpn.net/topic9380.html#p18810> || Disconnect problem <http://forums.openvpn.net/topic9452.html#p18809> || Is there a way to automate the original default gateway? <http://forums.openvpn.net/topic9450.html#p18808>
17:32 <@vpnHelper> RSS Update - forum: [ASK] running openvpn server on port udp 53 - windows 2008 <http://forums.openvpn.net/topic9451.html#p18812> || openvpn multiple instances route issue? <http://forums.openvpn.net/topic9443.html#p18811>
17:34 -!- gh0strider [blackhawk@poizon.org] has quit [Quit: Lost terminal]
17:52 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 252 seconds]
18:14 <@vpnHelper> RSS Update - forum: openvpn multiple instances route issue? <http://forums.openvpn.net/topic9443.html#p18813>
18:34 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has quit [Ping timeout: 240 seconds]
18:34 -!- Denial [Denial@drgi.co.uk] has quit []
18:56 -!- apex44 [~sYsT3m@31-17-56-111-dynip.superkabel.de] has quit [Ping timeout: 240 seconds]
19:14 -!- Jids [~Jids@CPEf46d04abb2bc-CM000a739c0010.cpe.net.cable.rogers.com] has joined #openvpn
19:17 -!- grabes [~grabes@24.102.254.76.res-cmts.sm.ptd.net] has joined #openvpn
19:18 < grabes> Is it possible to push the route of the openvpn server to the client for routing?  I have a server on subnet A then openvpn server listening on B, however I cant push subnet A to the client if its homed on the server itself.  Is that correct?
19:22 -!- _julian [~quassel@hmbg-4d06cc35.pool.mediaWays.net] has joined #openvpn
19:23 -!- _julian_ [~quassel@hmbg-5f76313d.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:33 -!- grabes [~grabes@24.102.254.76.res-cmts.sm.ptd.net] has left #openvpn []
19:46 < vocis> i am doing my best to understand your question
19:46 < vocis> but so far no cookie
19:53 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Ping timeout: 276 seconds]
19:54 -!- Xeross [~Xeross@unaffiliated/xeross] has left #openvpn ["Kthxbai"]
19:56 < Jids> how does one connect to an openvpn server that's behind a router? should the port be opened or should the virtual machine be dmz'd?
19:57 <+EugeneKay> Jids - Behind a NAT "router"? You need to forward the incomingport to the openvpn server
20:05 < Jids> EugeneKay: only a single port? if i'm hosting a server that i want to vpn into, how would that work?
20:05 <+EugeneKay> openvpn works over a single port, so yes, one udp(or tcp) port.
20:07 < newl> netstat -anp   will show you what the server port is
20:07 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
20:20 -!- master_of_master [~master_of@p57B5408C.dip.t-dialin.net] has quit [Read error: Operation timed out]
20:23 < Jids> EugeneKay: i'm being told to set it up like so: router -> vpn server -> router -> multiple machines
20:23 < Jids> how would that work with openvpn? the client sends traffic for multiple ports to the vpn server which then forwards it out through the router to whichever machine it's destined for?
20:24 -!- master_of_master [~master_of@p57B53D1D.dip.t-dialin.net] has joined #openvpn
20:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
20:39 -!- TJNII [~TJNII@tjnii.com] has joined #openvpn
20:44 < TJNII> Anyone running OpenVPN behind a load balancer?
20:45 < newl> lol you still on that load balancer thing ... you don't need it 
20:46 < newl> why exactly are you fixated on it?
20:47 < TJNII> Because if you use "redirect-gateway def1" with multiple servers and the server you are connect to fails, OpenVPN fails to failover as it tries to contact the other servers over the tunnel.
20:47 < TJNII> Load balancer is one possible fix as then the clients only know of the one IP
20:48 <+EugeneKay> To be frank, that's just plain silly.
20:49 <+EugeneKay> <connection> blocks are built to do that already. If you want to do it server side, use keepalived
20:50 < newl> TJNII: are you pursuaded?
20:50 < TJNII> What?  You can't compensate for server failure server side.  In this scenario a server has gone down for some reason.
20:51 <+EugeneKay> http://lmgtfy.com/?q=keepalived
20:51 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
20:51 < newl> i guess not ... i'll go back to my cobol
20:51 <+EugeneKay> That is exactly what keepalived does.
20:54 < TJNII> So, if I'm reading this right, keepalived is basically a load balancer.
20:59 <+EugeneKay> Nope. Keepalived is failover facility, at it's base
21:00 -!- mirco [~mirco@p5B2844DE.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
21:01 -!- mirco [~mirco@p5B285C6A.dip.t-dialin.net] has joined #openvpn
21:24 <@vpnHelper> RSS Update - forum: How to use auth-user-pass in OpenVPN? <http://forums.openvpn.net/topic9453.html>
21:40 -!- gremly [~gremly@200.106.218.64] has joined #openvpn
21:42 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
21:45 -!- gremly [~gremly@200.106.218.64] has quit [Client Quit]
21:56 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:30 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Ping timeout: 240 seconds]
22:38 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
22:56 -!- twister004_ [~chatzilla@74-84-125-57.client.mchsi.com] has joined #openvpn
22:57 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Read error: Connection reset by peer]
22:57 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
23:01 -!- twister004_ [~chatzilla@74-84-125-57.client.mchsi.com] has quit [Ping timeout: 252 seconds]
23:43 -!- norc_ [~norc@p15142144.pureserver.info] has quit [Ping timeout: 240 seconds]
23:45 -!- norc_ [~norc@p15142144.pureserver.info] has joined #openvpn
--- Day changed Fri Dec 23 2011
00:03 -!- Azdin [~chatzilla@fw2.yeg.alentus.net] has joined #openvpn
00:04 < Azdin> Hi.
00:05 < Azdin> I am trying to set up a connection between my work machine and my home machine.  My work machine is behind a firewall.  I have installed (what I think anyway) is the OpenVPN ... package?
00:05 < Azdin> Both are windows OS
00:05 < Azdin> Windows 7
00:06 < Azdin> I just need a virtual network connection so that I can remote desktop.
00:06 < Azdin> Can anyone assist?
00:10 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 252 seconds]
00:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 268 seconds]
00:16 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:16 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
00:22 < Azdin> hello?
00:28 < hyper_ch> hi Azdin
00:28 < Azdin> Hi
00:28 < Azdin> Can you help me?
00:28 < hyper_ch> depends on the question
00:29 < Azdin> How do I set up two computers so they are on a VPN?
00:29 < hyper_ch> set one up as vpn server
00:29 < Azdin> Okay.
00:29 < hyper_ch> set the other one up as vpn client
00:29 < Azdin> Alright one sec
00:29 < hyper_ch> and make according configs
00:29 < Azdin> My work computer is behind a firewall
00:29 < hyper_ch> and generate keys
00:29 < hyper_ch> Azdin: then your home machine will be the server?
00:29 < Azdin> Ooookay
00:30 < hyper_ch> you do try to connect from work to home, right?
00:30 < Azdin> Both
00:30 < Azdin> Mainly I want to remote from home to work
00:30 < hyper_ch> that might be difficult
00:30 < hyper_ch> if you're firewalled
00:31 < hyper_ch> to establish a tunnel you'd have to bypass the firewall at work
00:31 < hyper_ch> as I think that will be difficult
00:31 < Azdin> Well, here's the thing
00:31 < Azdin> I used to use Hamachi
00:31 < hyper_ch> the server probably ought to be your home computer
00:31 < Azdin> And they said no to that
00:31 < Azdin> But they said I could use OpenVPN
00:31 < hyper_ch> will the forward a port to your work computer?
00:32 < Azdin> Probably not. But why couldn't I connect with my home machine?
00:32 -!- mirco [~mirco@p5B285C6A.dip.t-dialin.net] has quit [Quit: mirco]
00:32 < hyper_ch> because a server needs to be accessible somehow
00:32 < hyper_ch> if you're firewalled
00:33 < Azdin> Right, so why couldn't my home machine be the server?
00:33 < hyper_ch> you can't access the openvpn server on your work computer if you install it there
00:33 < hyper_ch> so server needs to be your home computer
00:33 < Azdin> Perfect! I can do that
00:33 < Azdin> So first...
00:33 < Azdin> How do I configure my work machine?
00:33 < hyper_ch> do you have a static ip address on your home connection
00:33 < hyper_ch> ?
00:33 < Azdin> static? Eh... No. BUt it never changes
00:34 < hyper_ch> you might want to get a dnydns domain
00:34 < hyper_ch> so if your ip address changes, it will be updated in the dns
00:34 < Azdin> I'm not worried. If the ip address changes, I can deal with it then and update necessary config files.
00:35 < Azdin> It hasn't changed in the past 8 years, I have no reason to believe it will anytime soon
00:35 < Azdin> So what do I have to do on my work machine first?
00:36 < hyper_ch> install openvpn
00:36 < hyper_ch> make a client config.. similar to that:  http://pastebin.com/1THB0wCF
00:36 < hyper_ch> run openvpn as root
00:36 < Azdin> I don't understand any of that, except maybe the remote part which I'm assuming the X's are replaced with my home ip?
00:37 < hyper_ch> !howto
00:37 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:37 < hyper_ch> then have fun reading :)
00:37 < Azdin> That's a lot to read
00:37 < hyper_ch> well, it's nearly weekend / xmas
00:38 < hyper_ch> so plenty of time to read
00:39 < Azdin> Do I need to use certs at all?
00:41 < hyper_ch> it is strongly encouraged
00:42 < hyper_ch> and the server config would look something like this:   http://pastebin.com/Kuz3pBbt
00:42 < hyper_ch> of course you'd set correct paths
00:43 < hyper_ch> and a ccd entry like this:  http://pastebin.com/PrfKKs1S
00:43 < hyper_ch> !ccd
00:43 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
00:45 < hyper_ch> those configs should work more or less
00:45 < hyper_ch> just need adjustment to your case
00:45 < hyper_ch> then of course, at home, you need to forward the according port
00:45 < Azdin> Dare I ask why I should go through the painstaking effort to try and generate certificates for client and server?
00:45 < hyper_ch> 1194 udp in this case
00:46 < hyper_ch> Azdin: would you leave you housedoor unlocked and put a sign into your front yard telling you're away on vacation?
00:46 < Azdin> This is painfully complicated
00:46 < hyper_ch> follow the howto
00:47 < hyper_ch> it's has a section explaining how to setup a CA
00:47 < hyper_ch> on linux it'd be a piece of cake :)
00:47 < Azdin> Okay, so do I generate this CA on the server or client?
00:48 < hyper_ch> preferrably on the server
00:48 < hyper_ch> but in the end it shouldn't matter as only the certificates are important IIRC
00:49 < Azdin> So do I need a CA ?
00:49 < hyper_ch> that's what you do when you create certs
00:49 < hyper_ch> you'll become a CA by creating according certs
00:49 < Azdin> Well, I'll have to do this from home.
00:50 < Azdin> What do I set up from work for now?
00:50 < Azdin> The client key? Or is that handed out by the server?
00:50 < hyper_ch> you first create a CA cert
00:50 < hyper_ch> based on that CA cert, you can create one or more client cert
00:51 < Azdin> And a server cert according to this.
00:51 < hyper_ch> you can create all the certs already on the work computer... IIIRC
00:51 < Azdin> So a CA cert -> Server cert -> Client cert (for work)
00:51 < hyper_ch> and setup the work computer as client already
00:51 < Azdin> Ah.
00:51 < Azdin> k.
00:51 < hyper_ch> and then just take home ca cert and server cert
00:54 < Azdin> Now I have no idea where it stuck those keys
00:59 < Azdin> k
00:59 < Azdin> found em
00:59 < hyper_ch> do you have access to two computers at work?
00:59 < Azdin> No.
01:00 < Azdin> So I'll be testing this when I get home
01:00 < hyper_ch> how powerfull is the computer?
01:00 < Azdin> weak-ass
01:00 < Azdin> Well, it's alright
01:00 < hyper_ch> just thought, you could setup a client and server at work for testing :)
01:00 < hyper_ch> as you have only one computer
01:00 < hyper_ch> I thought you could setup a virtual machine
01:01 < Azdin> Naw. It's a good idea, but I don't think this PC could manage.
01:01 < Azdin> I'll test it when I get home
01:01 < Azdin> k, so.
01:01 < Azdin> I need the CA, the server, and the client keys on the client machine?
01:03 < Azdin> ah, just the CA and client keys
01:03 < hyper_ch> there's a table that tells you where what certs/files belong to
01:05 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Ping timeout: 252 seconds]
01:06 < Azdin> k. I think it's running
01:07 < Azdin> Yah, it's failing to connect then restarts
01:07 < Azdin> That's normal, since the server is not running yet.
01:09 < Azdin> I'm still not clear on this though. Once a connection has been established, how do I remote?
01:09 < Azdin> I need some kind of IP address between the two machines.
01:11 < Azdin> Ah. I see
01:14 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
01:19 -!- _slax0r_ [~fire@cpe-92-37-58-220.dynamic.amis.net] has joined #openvpn
01:22 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
01:27 < hyper_ch> with the configs I gave you, the server will be 10.8.0.1
01:27 < hyper_ch> and with the ccd entry, the client will be 10.8.10
01:27 -!- _slax0r_2 [~fire@mail.proplatform.net] has joined #openvpn
01:30 -!- _slax0r_ [~fire@cpe-92-37-58-220.dynamic.amis.net] has quit [Ping timeout: 248 seconds]
01:32 < Azdin> 10.8.10 ?
01:33 < hyper_ch> 10.8.0.10
01:33 < hyper_ch> you create a subnet 10.8.0.x
01:33 < hyper_ch> server will be .1
01:33 < hyper_ch> and the ccd entry will make the client 10
01:33 < hyper_ch> as for the ccd entry
01:33 < Azdin> k. now I'm confused again
01:33 < hyper_ch> the file in the ccd directory needs to be the same name as issued when creating the client certificate
01:34 < Azdin> So this isn't automated? I need to run a command on the client machine?
01:34 < hyper_ch> if you named the client "badabing"
01:34 < hyper_ch> when creating the client cert
01:34 < Azdin> Right.
01:34 < hyper_ch> then the file in the ccd directory needs to be named "badabing"
01:34 < Azdin> ccd directory?
01:34 < hyper_ch> so it matches the cert with the ccd entry
01:34 < hyper_ch> !ccd
01:34 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
01:35 < hyper_ch> well, you probably don't require a ccd... but if you want to grow the vpn a bit, it's good to know what client gets what IP address
01:35 < hyper_ch> Azdin: you don't need to set any routes and stuff
01:35 < hyper_ch> if the connection is established, it will all be automagically set - according to the config files
01:35 < Azdin> Okay, but do I have to run a command on the client machine once it's connected?
01:36 <@vpnHelper> RSS Update - forum: UDP connection doesn't seem to work <http://forums.openvpn.net/topic9454.html>
01:36 < hyper_ch> Azdin: what command do you want to run
01:36 < Azdin> Well I just want to remote desktop to my work machine
01:36 < hyper_ch> just connect to it using IP 10.8.0.10
01:36 < Azdin> So I need to mstsc /v:###.###.###.###
01:37 < hyper_ch> I don't use Windows
01:37 < hyper_ch> all I need is SSH access
01:37 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has joined #openvpn
01:37 < Azdin> Okay, but how do I know what IP the client has once it's connected?
01:37 < hyper_ch> Azdin: you set it in the CCD
01:37 < hyper_ch> [07:43] <hyper_ch> and a ccd entry like this:  http://pastebin.com/PrfKKs1S
01:37 < hyper_ch> [08:34] <vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
01:38 < Azdin> That just looks like a command.
01:38 < hyper_ch> Azdin: that's the connent of a ccd file
01:38 < Azdin> Alright, is this on the client or server?
01:38 < hyper_ch> [08:34] <vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
01:38 < Azdin> k.
01:38 < Azdin> So common name would be client as I've chosen
01:38 < hyper_ch> you specify a ccd dir
01:38 < hyper_ch> on the server
01:39 < hyper_ch> you create a file with the common name that you have used for client certificate
01:39 < hyper_ch> you put that content in there
01:39 < Azdin> Right
01:39 < Azdin> Got it
01:39 < hyper_ch> then when client connects
01:39 < hyper_ch> it transmitts common name to server
01:39 < hyper_ch> the server looks up the ccd dir
01:39 < hyper_ch> if there's a file with the same common name
01:39 < hyper_ch> if there is, it will run its content
01:39 < Azdin> I see
01:39 < hyper_ch> hence pushing the ip 10.8.0.10 to the client
01:39 < Azdin> Handy
01:40 < Azdin> But I'd need to set this up at home.
01:40 < Azdin> That'll have to wait a bit
01:40 < hyper_ch> you could also put other stuff in there
01:40 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
01:40 < hyper_ch> e.g. use def1 to route all clinet traffic through the openvpn server
01:40 < hyper_ch> or you could push some DNS servers
01:41 < Azdin> All I want is a connection between my home machine and work machine.
01:41 < hyper_ch> so, that's all you need in the CCD
01:42 < hyper_ch> here's a bit a bigger one http://pastebin.com/pKUqWgDZ
01:42 < hyper_ch> but that's not needed
01:42 < hyper_ch> all you need is the ifconfig-push 10.8.0.10 255.255.255.0
01:43 < Azdin> k.
01:43 < hyper_ch> and do some readup in the howto
01:43 < hyper_ch> !howto
01:43 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
01:55 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
01:56 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
02:03 -!- biggi_mat [c15ff27e@gateway/web/freenode/ip.193.95.242.126] has quit [Quit: Page closed]
02:05 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html>
02:23 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Ping timeout: 276 seconds]
02:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:30 -!- _slax0r_2 [~fire@mail.proplatform.net] has quit [Ping timeout: 240 seconds]
02:32 -!- Azdin [~chatzilla@fw2.yeg.alentus.net] has quit [Disconnected by services]
02:32 -!- Azdin` [~chatzilla@S01060014bf8f5ff1.ed.shawcable.net] has joined #openvpn
02:32 < Azdin`> Hey
02:32 -!- Azdin [~chatzilla@fw2.yeg.alentus.net] has joined #openvpn
02:32 < Azdin`> hello?
02:35 < Azdin`> Are you still there?
02:35 -!- Azdin [~chatzilla@fw2.yeg.alentus.net] has quit [Disconnected by services]
02:35 -!- Azdin` is now known as Azdin
02:36 -!- Azdin_ [~chatzilla@fw2.yeg.alentus.net] has joined #openvpn
02:36 -!- _slax0r_ [~fire@cpe-92-37-58-220.dynamic.amis.net] has joined #openvpn
02:46 < Azdin> Okay I think I know what's wrong. My home OS is a 64-bit OS, and for some reason, it's not adding the 64-bit TAP adapter.
02:46 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
02:46 <@vpnHelper> RSS Update - forum: UDP connection doesn't seem to work <http://forums.openvpn.net/topic9454.html#p18817>
02:51 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
02:53 <@vpnHelper> RSS Update - forum: WARNING: Failed running command (--up/--down): external prog <http://forums.openvpn.net/topic9431.html#p18821> || [ASK] running openvpn server on port udp 53 - windows 2008 <http://forums.openvpn.net/topic9451.html#p18820> || Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18819> || OpenVPN visibility question. <http://forums.openvpn.net/topic9449.html#p18818>
02:56 < Azdin> This is brutal, I can't get it to work
02:56 < Azdin> I keep getting the error: "All TAP-Win32 adapters on this system are currently in use."
02:59 -!- _slax0r_ [~fire@cpe-92-37-58-220.dynamic.amis.net] has quit [Ping timeout: 240 seconds]
03:04 -!- codemarauder [~nishant@115.240.67.69] has joined #openvpn
03:04 -!- bretanika [bretanika@89.114.11.171] has joined #openvpn
03:04 < Azdin> I seem to have made progress. I can ping the machine.
03:05 < codemarauder> when I restart my openvpn server, clients can not connect again automatically as the route 0.0.0.0/1 is still in place on them and they can't resolve the server.
03:21 -!- alex88 [~alex88@unaffiliated/alex88] has joined #openvpn
03:23 < alex88> hi guys, i have 3 hosts currently running vm, each host has a virtual network interface bridged between the vm, how can i bridge those virtual networks of each machine and be fault tolerant? i was thinking to run a openvpn server and the other 2 hosts with clients, but if server dies also the remaining 2 hosts will be separated right?
03:42 -!- faLUCE [~ocs@85.20.236.68] has quit [Remote host closed the connection]
03:55 < Azdin> I have been at this for hours and I STILL cannot get this damn thing to work. Can anyone help?
03:56 < Azdin> The server starts fine, and it APPEARS the client connects just fine as well
03:56 < Azdin> But I cannot push an ip to the client that I can connect to.
04:02 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
04:07 < Azdin> Okay, I think the client already has an IP address, but I cannot remote to the machine at all. i can't even ping it.
04:11 <@vpnHelper> RSS Update - forum: How to use auth-user-pass in OpenVPN? <http://forums.openvpn.net/topic9453.html#p18823> || WARNING: Failed running command (--up/--down): external prog <http://forums.openvpn.net/topic9431.html#p18822>
04:24 -!- Azdin_ [~chatzilla@fw2.yeg.alentus.net] has quit [Ping timeout: 268 seconds]
04:29 -!- raomin [~romain@240.22.66.86.rev.sfr.net] has quit [Quit: leaving...]
04:43 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Quit: ChatZilla 0.9.87 [Firefox 8.0.1/20111120135848]]
04:52 -!- bretanika [bretanika@89.114.11.171] has quit []
04:54 <@vpnHelper> RSS Update - forum: Routing problem <http://forums.openvpn.net/topic9456.html>
05:09 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:10 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
05:10 -!- mirco_ is now known as mirco
05:12 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 268 seconds]
05:13 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
05:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
05:14 -!- mode/#openvpn [+o mattock] by ChanServ
05:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:23 -!- ciphergoth [~paul@host238.lshift.net] has joined #openvpn
05:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:24 < ciphergoth> I believe that with the right iptables magic, I can arrange for only a certain user's packets to go through the VPN, is that right?  Is there a recipe anywhere showing howt o do it?
05:33 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:35 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
05:35 -!- mirco_ is now known as mirco
05:41 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 252 seconds]
05:43 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
05:48 <@vpnHelper> RSS Update - forum: [ASK] running openvpn server on port udp 53 - windows 2008 <http://forums.openvpn.net/topic9451.html#p18825>
05:50 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 255 seconds]
05:52 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
05:58 -!- biggi_mat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has joined #openvpn
06:00 -!- biggimat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has quit [Ping timeout: 240 seconds]
06:06 <@vpnHelper> RSS Update - forum: [ASK] running openvpn server on port udp 53 - windows 2008 <http://forums.openvpn.net/topic9451.html#p18826>
06:12 <@vpnHelper> RSS Update - forum: WARNING: Failed running command (--up/--down): external prog <http://forums.openvpn.net/topic9431.html#p18828> || Routing problem <http://forums.openvpn.net/topic9456.html#p18827>
06:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
06:27 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
06:29 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
06:29 -!- mirco_ is now known as mirco
06:36 <@vpnHelper> RSS Update - forum: Routing problem <http://forums.openvpn.net/topic9456.html#p18829>
06:48 <@vpnHelper> RSS Update - forum: Bridged vpn with mapped ip addresses (NETMAP) <http://forums.openvpn.net/topic9457.html>
06:49 -!- codemarauder [~nishant@115.240.67.69] has quit [Ping timeout: 248 seconds]
07:06 <@vpnHelper> RSS Update - forum: OpenVPN visibility question. <http://forums.openvpn.net/topic9449.html#p18831>
07:18 <@vpnHelper> RSS Update - forum: OpenVPN visibility question. <http://forums.openvpn.net/topic9449.html#p18832>
07:19 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Quit: leaving]
07:19 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
07:28 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 268 seconds]
07:30 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18834> || UDP connection doesn't seem to work <http://forums.openvpn.net/topic9454.html#p18833>
07:35 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
07:35 -!- mode/#openvpn [+o mattock] by ChanServ
07:35 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
07:35 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:12 -!- Harley [~Harley@110.184.141.95] has joined #openvpn
08:14 < Harley> hello looking for help with a vpnissues.. have a unix openvpn server. with 2 clients. 1 unix the other os x with tunnelblicj. Unix to unix is fine but unix to mac :-( 
08:14 < Harley> each client has its own key
08:14 < Harley> both clients connect just fine.
08:14 < Harley> on the unix all internet traffic goes to the vpn
08:14 < Harley> on the mac none goes
08:15 < reiffert> !logs
08:15 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
08:15 < reiffert> !paste
08:15 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
08:16 < Harley> thanks.. hold onpls
08:21 < Harley> http://www.pastebin.ca/2096039
08:22 < Harley> client log
08:28 -!- Jids [~Jids@CPEf46d04abb2bc-CM000a739c0010.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
08:39 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
08:39 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
08:39 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:39 < hyper_ch> x
08:40 < hyper_ch> dazo_afk: ecrist: EugeneKay: krzee:  http://www.csee.wvu.edu/~ross/pubs/AbazaEarSymmetry_BTAS2010.pdf
08:56 -!- Damascene [~house@unaffiliated/uaa] has joined #openvpn
08:58 < Damascene> Hi, I've setup OpenVPN through pfsenes, I can reach some client over vpn from the remote machine and do ping but that is only for few machines. Most of the network are still hidden. What should I do?
08:59 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
09:07 < vocis> first thing - check if they travel the proper route
09:07 < vocis> see if openvpn sets the proper routes
09:08 < vocis> see if your firewall does not block anything
09:08 < hyper_ch> if in doubt, apply magic
09:08 < vocis> absolutely
09:10 <@ecrist> vocis: wtf are you?  we're not used to people being HELPFUL in here.
09:10 <@ecrist> sheesh
09:10 < hyper_ch> ecrist: typically noobs :)
09:10 < vocis> heh
09:10 < vocis> well buddy those times are over
09:10 < Damascene> what magic I can apply any way?
09:10 < vocis> the NEW WORLD ORDER
09:10 < vocis> not the law of the jungle
09:11 < hyper_ch> best to use automagic
09:18 < ciphergoth> is there a way to arrange for only outbound packets matching a particular iptables match rule to go via the vpn?  I want to use --uid-owner userid
09:20 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Ping timeout: 240 seconds]
09:25 < Olipro> iptables doesn't perform routing, so providing your purpose is only filtering, yes
09:27 < Olipro> ciphergoth: ^
09:27 < hyper_ch> but in iptables you can say that incoming packages on port xxxx should go to machine yyyy
09:27 < hyper_ch> that sounds to me like routing
09:27 < Olipro> no, that's NAT
09:27 < ciphergoth> since I asked here I found this: http://serverfault.com/questions/95813/only-tunnel-certain-applications-via-openvpn
09:28 <@vpnHelper> Title: linux - Only tunnel certain applications via OpenVPN - Server Fault (at serverfault.com)
09:28 < ciphergoth> iptables sets a mark on the packet
09:28 < ciphergoth> and then the routing system uses that to route it
09:28 < Olipro> yes, you can use a packet mark
09:28 < ciphergoth> but I don't understand iproute2
09:29 < Olipro> you can also use CONNMARK along with packet mark for speedier processing
09:29 < ciphergoth> CONNMARK?
09:29 -!- alex88 [~alex88@unaffiliated/alex88] has left #openvpn []
09:29 < Olipro> yes, a CONNMARK associates with an entire connection state via iptables conntrack
09:30 < ciphergoth> ah neat
09:30 < Olipro> if you set a connmark, you can check other associated packets for the mark and immediately assign the CONNMARK to MARK
09:30 < Olipro> and of course, any packets without a connmark can go through your usual rule matching
09:31 < ciphergoth> OTOH this is a 3GHz box sending packets down a home broadband connection
09:31 < ciphergoth> so I don't suppose it's going to eat much of my CPU no matter what
09:31 < Olipro> so, what is it that you don't understand about iproute2?
09:33 -!- sled-dog [~luser@173.221.87.2.nw.nuvox.net] has joined #openvpn
09:33 < Olipro> the echo into rt_tables is unnecessary, that's purely so you can write "vpn" instead of "200"
09:33 -!- mil-dude [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
09:37 -!- sled-dog [~luser@173.221.87.2.nw.nuvox.net] has quit [Ping timeout: 252 seconds]
09:39 < ciphergoth> Olipro: aha that helps
09:40 -!- biggi_mat [~biggi_mat@89-212-191-144.dynamic.t-2.net] has quit [Read error: Connection reset by peer]
09:40 < ciphergoth> I've never had to use iproute2, I don't know the first thing about it
09:40 <@ecrist> we don't support firewalls here
09:40 <@ecrist> you'll have to ask more detailed questions in an appropriate channel
09:40 < Olipro> in your case, #Netfilter
09:41 <@ecrist> best to get your questions answered by the people who know the right answer.
09:42 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
09:42 -!- mil-dude is now known as sled-dog
09:44 -!- codemarauder [~nishant@115.242.9.162] has joined #openvpn
09:45 -!- Jids [~Jids@CPEbcaec5a74e28-CM001692569168.cpe.net.cable.rogers.com] has joined #openvpn
09:45 < reiffert> !factoids search iphone
09:45 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
09:45 < ciphergoth> well i guess the OpenVPN-specific question is
09:45 <@vpnHelper> iPhone and iPad.
09:46 < ciphergoth> if I'm using "ip route add table vpn eql nexthop via <remotevpnip> dev tap0" to route through the VPN
09:46 < ciphergoth> I need to change the config so it doesn't route everything through it by default, right?
09:46 <@ecrist> openvpn doesn't do any policy-based routing
09:51 < vocis> but you can still do it
09:51 < vocis> ip rule ..
09:52 <@ecrist> yup, pf, ipfilter, ipfw, and others, can do it
09:52 <@ecrist> we just don't support those here
09:52 <@ecrist> I can support pf, but only because I know it
09:52 < vocis> it means you're just too lazy to write an answer ;p
09:53 <@ecrist> no
09:53 <@ecrist> there are a number of things we chose not to support here
09:53 <@ecrist> 1) firewall rules and/or policy-based routing
09:53 <@ecrist> 2) init/startup scripts (they're all different, and all suck)
09:53 < vocis> as in, channel rules?
09:53 <@ecrist> yes
09:54 < vocis> nice policy
09:54 <@ecrist> we fully support openvpn itself, though.
09:54 < vocis> then you can only expect people to come here and ask routing questions, init script questions etc.
09:55 <@ecrist> exactly
09:55 < vocis> "not supporting" those questions could just as well be replaced by "i refuse to answer them" instead of telling people off
09:55 <@ecrist> 3) any how-to not on the openvpn official sites or the secure-computing wiki
09:55 <@ecrist> !wiki
09:55 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
09:55 < vocis> bbl
09:55  * vocis &
09:58 -!- Damascene [~house@unaffiliated/uaa] has quit [Ping timeout: 240 seconds]
10:08 -!- codemarauder [~nishant@115.242.9.162] has left #openvpn []
10:08 < Harley> hello looking for help with a vpnissues.. have a unix openvpn server. with 2 clients. 1 unix the other os x with tunnelblicj. Unix to unix is fine but unix to mac :-( each client has its own key. both clients connect just fine. On the unix all internet traffic goes to the vpn. on the mac none goes
10:08 < Harley> cleint log -- http://www.pastebin.ca/2096039
10:11 -!- Damascene [~house@176.45.107.221] has joined #openvpn
10:11 -!- Damascene [~house@176.45.107.221] has quit [Changing host]
10:11 -!- Damascene [~house@unaffiliated/uaa] has joined #openvpn
10:23 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
10:24 < Damascene> traceroute stops at vpn IP for one ip and continue for the other, what does that mean?
10:27 <@ecrist> that the routing stops there, or is being blocked by a firewall
10:28 < Damascene> who to tell the deference? I don't think there is a firewall running there
10:28 <@ecrist> well, start by figuring that out
10:28 < Damascene> any way I can not ping the other way around
10:29 < Damascene> I could use a help
10:29 <@ecrist> then, see if the IP that stops at the VPN is in the routing tables
10:29 < Damascene> should every ip on the network be in the routing table? I can ping 192.168.1.5 but not 192.168.1.4
10:35 <@ecrist> every IP, or an associated network/mask should be in the routing table, yes
10:37 < Damascene> I'll try to use that to figure what is the real problem. thanks
10:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
10:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:23 < vocis> well i have seen a weird thing on kernel 3.1.5
11:23 < vocis> where a node sends arp requests to networks that are not within its own netmask
11:23 < vocis> i could only solve it with a reboot
11:26 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
11:39 <@ecrist> linux sucks
11:39 <@ecrist> use a real OS
11:39 <@ecrist> ;)
11:40 < vocis> yes
11:40 < vocis> i am
11:40 < vocis> but getting it to work is a PITA on Xen
11:40 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
11:41 <@ecrist> which one is that?
11:42 < Damascene> http://fpaste.org/jkbo/ is my routing table using route at windows
11:42 < Damascene> * at linux
11:42 <@ecrist> !logs
11:42 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
11:42 <@ecrist> !configs
11:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
11:43 < Damascene> 192.168.1.0 is the lan network 192.168.200.0 is the vpn network, as I said everything is working for some machines
11:44 <@ecrist> is openvpn running as an administrator on the windows machine?
11:44 < Damascene> yes
11:44 <@ecrist> and where are the logs?
11:44 < Damascene> it's not easy to copy windows log, wait a minute
11:44 <@ecrist> I don't really care.  I can't help you without it
11:49 < Damascene> here it is ,http://fpaste.org/tda5/ from windows vpn client
11:50 -!- Harley [~Harley@110.184.141.95] has quit [Remote host closed the connection]
11:58 < Damascene> ecrist, could you please look at the routing table?
11:58 <@ecrist> just a few minutes,
11:59 <@ecrist> Damascene: I'm not helping you until you paste your logs
12:00 < Damascene> ok
12:02 < Damascene> ecrist, http://fpaste.org/vygv/
12:05 < Damascene> client configuration http://fpaste.org/oped/
12:06 -!- mirco [~mirco@p5B284F49.dip.t-dialin.net] has joined #openvpn
12:07 < Damascene> server config http://fpaste.org/fPUB/
12:13 < vocis> ecrist, FreeBSD
12:13 -!- mode/#openvpn [+o vocis] by ecrist
12:13 <@ecrist> muhahaha
12:13 <@vocis> wooo
12:14 <@vocis> I have tried to get 1386 working, but to no avail
12:14 <@vocis> after a kernel recompilation it wouldn't start
12:14 <@vocis> switched to amd64, there the compile was in order until it loaded the netdev
12:15 <@ecrist> I've never had luck with Xen
12:15 <@ecrist> with any OS
12:15 <@vocis> luckily i found - http://lists.freebsd.org/pipermail/freebsd-xen/2011-January/000764.html
12:15 <@vpnHelper> Title: xn0: Error 2 parsing device/vif/0/mac [PATCH] (at lists.freebsd.org)
12:15 <@ecrist> virtualbox and vmware run it fine, though.
12:15 <@vocis> yes, newer Xen versions also run BSD perfectly
12:16 <@vocis> but unfortunately it seems that linux and bsd are byproducts for them
12:16 <@vocis> netbsd hasn't really bothered to update it, freebsd has no way to be the dom0
12:16 <@vocis> and those things suck :)
12:18 -!- Harley [~Harley@182.149.70.35] has joined #openvpn
12:20 <@vocis> ecrist, openvpn uses either openssl or polarssl, but would it be useful to have it use linux kernel crypto?
12:20 <@vocis> i noticed that linux kernels support serpent, tnepres, anubis and so on
12:21 < Damascene> ecrist, ?
12:21 <@vocis> and i've wondered why openssl does not
12:21 <@ecrist> vocis: I'm not familiar with any of those
12:21 <@ecrist> are they SSL?
12:21 < Olipro> they're crypto algorithms...
12:22 < Olipro> SSL isn't a crypto algorithm
12:22 <@ecrist> that's what I was thinking.  
12:23 -!- Harley [~Harley@182.149.70.35] has quit [Ping timeout: 276 seconds]
12:23 <@vocis> oh
12:23 < Olipro> vocis: you could modify OpenVPN to use the kernel's crypto (where available on the system) but what benefit do you expect to gain from it?
12:23 < Olipro> (and you'd still need Open/PolarSSL for the TLS)
12:24 -!- cjohnston [~cjohnston@ubuntu/member/pdpc.supporter.active.cjohnston] has joined #openvpn
12:24 -!- cjohnston [~cjohnston@ubuntu/member/pdpc.supporter.active.cjohnston] has left #openvpn []
12:25 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has joined #openvpn
12:25 < ac3xor> ello ello
12:26 <@ecrist> I should op everyone as a festivus present
12:26 < ac3xor> !welcome
12:26 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:26 <@ecrist> record the shenanigans for posterity
12:26  * hyper_ch is really pondering to attend Fosdem
12:26 < ac3xor> hey i had a question mayb some1 here could help with
12:27 <@vocis> well, i would think the benefit is more crypto algorithms, but apparently i am not getting the geste ;)
12:27 <+EugeneKay> !ask
12:27 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
12:27 <+EugeneKay> vocis - OpenVPN relies upon TLS for it's traffic encapsulation & crypto. Submit all patches to the openssl project.
12:27 < ac3xor> im trying to connect to my openvpn sitting on a tomato router through my laptop running ubuntu
12:27 < hyper_ch> ac3xor: let me fetch my magic crystal ball and divine over the internet if I can help you
12:27 <@vocis> i'm a sysadmin, not a dev
12:28 <+EugeneKay> Then this discussion is hypothetical at best.
12:28 < ac3xor> and when i run
12:28 <@vocis> recently i became intricately aware of how different those two disciplines are
12:28 <@vocis> yes, indeed
12:28 <+EugeneKay> !logs
12:28 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
12:28 <+EugeneKay> ac3xor ^
12:28 < ac3xor> when i run the /etc/init.d/open start it says autostarting
12:28 < ac3xor> but
12:28 <@vocis> not that i can't code, i can, but as a sysadmin :)
12:28 < ac3xor> hmm
12:29 < ac3xor> good idea
12:29 < ac3xor> gimme a sec lemme bot it up
12:30 <@vocis> ac3xor, also please understand that the enter key is not an interpunction mark. Use an emdash '--', comma ',', period '.' or ellipsis '...' instead
12:30 <+EugeneKay> !enter
12:31 <+EugeneKay> Hrm, I thought there was a factoid for that.
12:31 <+EugeneKay> "The enter key is not a punctuation mark."
12:31 <+EugeneKay> Ah, I have it as an alias.
12:31 <@vocis> :)
12:31 <@vocis> i used to, but i've used it so often that i memorised it and didn't need to keep it when i moved from irssi to weechat
12:32 < ac3xor> would you rather i use punctuation?
12:32 < hyper_ch> it's
12:32 < hyper_ch> really
12:32 < hyper_ch> hard
12:32 < hyper_ch> to
12:32 <+EugeneKay> Yes, that's why we brought it up
12:32 < hyper_ch> read if every word is on a new line
12:33 < ac3xor> Oh, sorry I'm more of a i/m guy and I'm just used to using the enter key as such.
12:33 < ac3xor> Sorry
12:33 <+EugeneKay> It's annoying in IMs, too.
12:33 < hyper_ch> irc is also instant messaging
12:33 < ac3xor> indeed
12:34 < hyper_ch> just not one-to-one but one-to-many (usually)
12:34 < ac3xor> So what cmd would I run in my ubuntu laptop to procure the proper log file?(This is the Client)
12:34 <+EugeneKay> If you're using the --log directive it ill be in the file specified. If not, it'll be interspersed in your syslog, /var/log/syslog(I think?)
12:35 < Damascene> ecrist, is there some problem in the logs?
12:35 <@vocis> you don't run a command, you configure openvpn
12:35 < hyper_ch> (1) use command line to start openvpn... you might get info there --> sudo -i ; cd /etc/openvpn ;  openvpn client.conf  (or wahtever config file is called)
12:35 < ac3xor> Right i did that.
12:36 < hyper_ch> any errors?
12:36 < ac3xor> I just want to know why it never created a tun0 interface.
12:36 < hyper_ch> !logs
12:36 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
12:36 < hyper_ch> !configs
12:36 <@vocis> try 'modprobe tun'
12:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
12:36 -!- Damascene [~house@unaffiliated/uaa] has quit [Quit: Ex-Chat]
12:37 < ac3xor> nothing happend.
12:38 < ac3xor> Gimme a sec, ill pastebin the config file.
12:38 <@vocis> please read http://www.catb.org/~esr/faqs/smart-questions.html while you are at it
12:38 <@vpnHelper> Title: How To Ask Questions The Smart Way (at www.catb.org)
12:38 -!- mode/#openvpn [+o EugeneKay] by ChanServ
12:38 -!- EugeneKay changed the topic of #openvpn to: Welcome to the OpenVPN community support channel || PLEASE read the entire topic || Current Release: 2.2.2 (22-Dec-2011) || First time here? Use !welcome and !goal || Access Server? /join #openvpn-as || We're not psychic -- please !paste your !configs and !logs and a description of your problem || Your problem is your firewall, really. || Merry Chrismahanukwanzadan!
12:38  * EugeneKay decks the halls
12:39 -!- mode/#openvpn [+vvv hyper_ch Ionic Olipro] by EugeneKay
12:42 <@vocis> well i'm honored, but i think i should build up a bit more credit before i join the big kahunas of #openvpn 
12:42 <@vocis> so..
12:43 -!- mode/#openvpn [+v-o vocis vocis] by vocis
12:43 <+vocis> tee hee
12:44 < ac3xor> http://pastebin.com/LsmpXXt6
12:44 < ac3xor> thats the client config.
12:44 <@EugeneKay> !configs
12:44 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
12:44 < ac3xor> awww i forgot to take comments out =/.
12:45 < ac3xor> Gimme 1 more sec.
12:46  * hyper_ch thinks vocis is too helpfull and needs to get kicked from #openvpn :)
12:46 <+vocis> ha
12:46 <+vocis> i'm trying to quit but it's just like smoking
12:46 <+vocis> someone says something stupid and i refute it
12:47 <+hyper_ch> vocis: just put on your ignore list *@*
12:47 <+vocis> of course there are hard core smokers who do it more than i
12:47 <+hyper_ch> :)
12:49 <+vocis> that will just bring pure agony ;p
12:50 < ac3xor> ugh I ran the wrong command and cleared out all my certs and settings.
12:50 < ac3xor> -_-
12:50 <@EugeneKay> "D'oh"
12:50 < ac3xor> yep
12:51 <+hyper_ch> just restore from your backups
12:51 <@EugeneKay> Note to self: do a writeup on XCA 
12:54 -!- Gravitron [~admin@69.163.40.45] has joined #openvpn
12:54 -!- Gravitron [~admin@69.163.40.45] has quit [Changing host]
12:54 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
12:55 <@vpnHelper> RSS Update - forum: UDP connection doesn't seem to work <http://forums.openvpn.net/topic9454.html#p18835>
12:55 < ac3xor> ok
12:55 < ac3xor> http://pastebin.com/7LyXz12u
12:55 < ac3xor> Without comments.
12:56 < ac3xor> So why wouldnt my tun interface start?
12:57 <@ecrist> ac3xor: the regex above is better, but whatever
12:57 < ac3xor> whats a regex?
12:57 <@ecrist> regular expression
12:57 < ac3xor> ah
12:57 <@ecrist> anyhow, where's your logs?
12:57 < ac3xor> the grep cmd?
12:58 <@ecrist> grep -vE '^#|^;|^$'
12:58 <@ecrist> the part between the single quotes is a regex
12:58 < ac3xor> gotcha
12:58 <@ecrist> and that grep would have gotten rid of the white space, too
12:58 <+hyper_ch> regex is as complicated as quantum physics
12:58 <@ecrist> hyper_ch: no it isn't
12:58 <+hyper_ch> it is!
12:58 -!- mode/#openvpn [-v hyper_ch] by ecrist
12:59 <@ecrist> no
12:59 <@ecrist> that regex was pretty simple
12:59 < ac3xor> lol
12:59 < hyper_ch> awwww .(
12:59 < hyper_ch> !mod power abuse !!!!
12:59 < ac3xor> lemme give it another try.
12:59 -!- Azdin_ [~chatzilla@S01060014bf8f5ff1.ed.shawcable.net] has joined #openvpn
12:59 < hyper_ch> ac3xor: server config is missing
13:00 -!- hyper_ch was kicked from #openvpn by ecrist [that's abuse, bitch]
13:00 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:00  * hyper_ch feels so violated
13:00 < ac3xor> lol
13:01 < hyper_ch> ac3xor: gonna post server config?
13:01 < ac3xor> lets see, so if the configuration is seeting on a tomato router, where would the file be?
13:02 < hyper_ch> don't you have ssh access to it?
13:02 < hyper_ch> in the end, tomato is linux so it should be /etc/openvpn/*conf
13:02 < ac3xor> this is true lemme try.
13:02 < ac3xor> gimme a min.
13:02 -!- Azdin [~chatzilla@S01060014bf8f5ff1.ed.shawcable.net] has quit [Ping timeout: 255 seconds]
13:02 -!- Azdin_ is now known as Azdin
13:03 < ac3xor> ill use the regex this time for sure.
13:03 -!- mode/#openvpn [+vvvv Denial shteyngart WebDawg APTX] by ecrist
13:03 -!- mode/#openvpn [+vvvv ppr DarthGandalf raidz phantomcircuit] by ecrist
13:03 -!- mode/#openvpn [+vvvv tty234 Gravitron GetsEcle1tic krzee] by ecrist
13:03 -!- mode/#openvpn [+vvvv Diffen ScriptFanix Zimsky Blue_Ice] by ecrist
13:03 -!- mode/#openvpn [+vvvv Agin RichardBronosky dxtr Nowak] by ecrist
13:03 -!- mode/#openvpn [+vvvv mcp dvl pielgrzym mirco] by ecrist
13:03 -!- mode/#openvpn [+vvvv Cr4zi3 Gnewt kloeri amir] by ecrist
13:03 -!- mode/#openvpn [+vvvv nb norc_ ciphergoth Rolybrau] by ecrist
13:03 -!- mode/#openvpn [+vvvv cyberspace- mrsno_ chokesmaster lusis] by ecrist
13:03 -!- mode/#openvpn [+vvvv scampbell krzie diytto ponyofdeath] by ecrist
13:03 <@ecrist> muhahahahaha
13:03 -!- mode/#openvpn [+vvvv pa JPeterson sled-dog __nolife] by ecrist
13:03 -!- mode/#openvpn [+vvvv R-66Y ronnocol _zero_ Klapo] by ecrist
13:03 -!- mode/#openvpn [+vvvv JodaZ MrWGW catsup EvilJStoker] by ecrist
13:03 -!- mode/#openvpn [+vvvv ]R[ TJNII LuckyY openbsdnoob] by ecrist
13:03 -!- mode/#openvpn [+vvvv chantra Azdin Kateon GHAI] by ecrist
13:03 -!- mode/#openvpn [+vvvv zalzice scyld l0rd_hex dioz] by ecrist
13:03 -!- mode/#openvpn [+vvvv Dougy Tick-Tock mick_laptop evilhackerdude] by ecrist
13:03 -!- mode/#openvpn [+vvvv rooth beerbro sia^pwnnt Champi] by ecrist
13:03 < Jids> well, that's one way to spam
13:03 -!- mode/#openvpn [+vvvv zu_ inimino bigon vect0rx] by ecrist
13:03 -!- mode/#openvpn [+vvvv Fiouz Beave cherwin_ ac3xor] by ecrist
13:03 -!- mode/#openvpn [+vvvv brad[] master_of_master deever JoeGazz84] by ecrist
13:03 -!- mode/#openvpn [+vvvv pranq agagag_ jeev Mp5-] by ecrist
13:03 -!- mode/#openvpn [+vvvv fremo rkantos Kanyl folivora] by ecrist
13:03 -!- mode/#openvpn [+vvvv Guest25224 hyper_ch tabakhase tjz] by ecrist
13:04 -!- mode/#openvpn [+vvvv caemir oc80z reiffert Essobi] by ecrist
13:04 -!- mode/#openvpn [+vvvv gffa fahadsadah freaky[t] cali] by ecrist
13:04 -!- mode/#openvpn [+vvvv Jids wedge bigpaws bragon] by ecrist
13:04 -!- mode/#openvpn [+vvvv MrPPS krphop_ JoeK batrick] by ecrist
13:04 -!- mode/#openvpn [+vvvv pwrcycle _quadDamage fbh rawplayer] by ecrist
13:04 -!- mode/#openvpn [+vvvv speakman _julian havoc Haraken] by ecrist
13:04 -!- mode/#openvpn [+vvvv mete- SigmaProjects meepmeep_ |Mike|] by ecrist
13:04 <+vocis> at least it woke you up
13:04 -!- mode/#openvpn [+vvv masch_ vereteran-x Deathvalley122] by ecrist
13:04 !services. [ChanServ:#openvpn] ecrist set flags +O on *!*@*.
13:05 <@ecrist> let the games begin
13:05 <+Jids> uh-oh
13:05 <@vpnHelper> RSS Update - forum: [Resolved] Log volume of traffic tunneled by a user <http://forums.openvpn.net/topic9392.html#p18838> || [Resolved] up, down-pre, and down scripts not being executed <http://forums.openvpn.net/topic9439.html#p18837> || Disconnect problem <http://forums.openvpn.net/topic9452.html#p18836>
13:07 <@ecrist> heh, even irssi told me it was a bad idea
13:07 <@ecrist> 13:02:53 -!- Irssi: Doing this is not a good idea. Add -YES option to command if you really mean it
13:07 -!- mode/#openvpn [-o ecrist] by ecrist
13:08 < ecrist> before I do any more damage
13:08 <+raidz> weeee
13:08 -!- Irssi: #openvpn: Total of 137 nicks [5 ops, 0 halfops, 131 voices, 1 normal]
13:10 < ecrist> it got quiet in here all of a sudden
13:10 <+hyper_ch> ecrist: your abuse of me scared everyone
13:12 < ecrist> understandable, I suppose
13:12 < ecrist> I'm feeling punchy today.
13:12 <+hyper_ch> but you should spread x-mas love
13:13 <+hyper_ch> not x-mas violence
13:13 < ecrist> it's not x-mas love, it's festivus love
13:14 <+ac3xor> hmm so i ssh'd to my router what cmd would I use to copy the config file?
13:15 < ecrist> cp
13:15 <+hyper_ch> cat file.conf
13:15 <+hyper_ch> can't you mark it then with the mouse?
13:15 <+ac3xor> ah good idea!
13:15 <+hyper_ch> or:   scp user@router:/path/to/file /tmp/server.conf
13:15 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18839>
13:16 <+hyper_ch> or you could use automagic
13:18  * jeev devoices ecrist
13:20 <+ac3xor> ok, so as far as i can see there is no .conf file for the server config i can take screenshot of the web ui if you like.
13:20 <+hyper_ch> somewhere there must be a config
13:20 <+hyper_ch> I think
13:21 <+ac3xor> there is a config.ovpn
13:21 <+hyper_ch> then that's it
13:29 <+ac3xor> when i try to scp it says connection refused -_-.
13:34 <+ac3xor> brb
13:34 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has quit [Quit: Leaving]
13:40 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has joined #openvpn
13:40 -!- mode/#openvpn [+o ac3xor] by ChanServ
13:40 <@ac3xor> back
13:43 <@ac3xor> http://pastebin.com/gT5ybbmb
13:43 <@ac3xor> server
13:45 <@ac3xor> u guys still here?
13:46 <+reiffert> no.
13:46 -!- reiffert [~thomas@mail.reifferscheid.org] has left #openvpn []
13:46 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
13:46 -!- mode/#openvpn [+o reiffert] by ChanServ
13:46 <@reiffert> whats that voice thing all about?
13:46 -!- mode/#openvpn [-o reiffert] by reiffert
13:48 <@ac3xor> so?
13:52 <@ac3xor> where did u guys go?
14:00 <@EugeneKay> Bed.
14:02 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Remote host closed the connection]
14:02 < ecrist> reiffert: I'm just being annoying
14:02 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
14:02 -!- mode/#openvpn [+o vocis] by ChanServ
14:03 !services. [ChanServ:#openvpn] ecrist set flags -O on *!*@*.
14:08 < reiffert> ecrist: free op for all - because ecrist has turned into santa claus?
14:14 <@ac3xor> so can any1 help?
14:21 <@ac3xor> =/
14:21 <@ac3xor> can any1 direct me to a place where i could get some help?
14:22 <@EugeneKay> reiffert - deck the halls!
14:31 < reiffert> EugeneKay: http://www.youtube.com/watch?v=_W-fIn2QZgg
14:31 <@vpnHelper> Title: acdc-big balls - YouTube (at www.youtube.com)
14:33 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has quit [Remote host closed the connection]
14:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
14:54 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:12 -!- scyld [~operacyjn@unaffiliated/wasyl] has quit [Quit: leaving]
15:37 -!- treund [~treund@97.75.177.42] has joined #openvpn
15:54 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
16:30 -!- diytto [diytto@zebra689.server4you.net] has quit [Quit: >:o]
16:31 -!- diytto [~diytto@2001:470:26:59c::2] has joined #openvpn
16:31 -!- diytto [~diytto@2001:470:26:59c::2] has quit [Excess Flood]
16:36 <+Azdin> hello
16:36 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
16:44 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Quit: vocis]
16:45 <@vpnHelper> RSS Update - forum: Disconnect problem <http://forums.openvpn.net/topic9452.html#p18840>
16:53 -!- treund [~treund@97.75.177.42] has quit [Ping timeout: 255 seconds]
17:04 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
17:07 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
17:09 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18841>
17:17 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has quit [Quit: AAAGH!  IT BURNS!]
17:19 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
17:19 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has quit [Client Quit]
17:22 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
17:28 -!- Jids [~Jids@CPEbcaec5a74e28-CM001692569168.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
17:39 -!- vlt [~dm@suez.activ-job.com] has joined #openvpn
17:40 < vlt> Hello. I need to run an OpenVPN client on a Windows 7 machine. I installed ovpn 2.2.2.  Where to put the conf file now to make it run automatically?
17:40 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
17:41 <+|Mike|> vlt: ^^ rtfm :)
17:42 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 244 seconds]
17:46 <@EugeneKay> vlt - "wherever you like"
17:47 < vlt> Is there something like /etc/openvpn on Windows?
17:47 <@EugeneKay> Not really, no.
17:47 < vlt> hmmm
17:47 <@EugeneKay> You can install it as a service, but I prefer to use Startup/ 
17:48 <@EugeneKay> I keep my stuff in %HOME%/.ssh/ along with my other stuff(PuTTY ssh key, etc), that's up to you
17:49 <@EugeneKay> My laptop(which doesn't have it autostart) has a shortcut to connect to the vpn instance I want
17:49 <@EugeneKay> "C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe" --config_dir "C:\Documents and Settings\EugeneKay\.ssh\" --connect client-khresearch.ovpn --show_balloon 0 --silent_connection 1 --show_script_window 0
17:50 <@EugeneKay> "Target" of the shortcut is set to ^^
17:50 < vlt> EugeneKay: Thank you.
17:50 <@EugeneKay> That should be Users, not Documents and Settings. Stupid legacy stuff.
17:52 < vlt> Wait ... Putting it into a user's autostart means it won't connect until someone logs in, right?
17:53 < vlt> Then I think I need it running as a service. Possible?
17:54 <@EugeneKay> Correct. Yup, yes. No idea how.
17:55 <@EugeneKay> "Run OpenVPN as a service by putting one or more .ovpn configuration files in \Program Files\OpenVPN\config and starting the OpenVPN Service, which can be controlled from Start Menu -> Control Panel -> Administrative Tools -> Services. "
17:55 < vlt> Sounds not too complicated. I'll try that.
17:57 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18842>
18:08 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
18:09 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18844>
18:12 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
18:14 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
18:28 < vlt> EugeneKay: It works. :-)
18:28 <@EugeneKay> Score.
18:28 -!- Harley [~Harley@110.185.145.95] has joined #openvpn
18:32 -!- treund [~treund@97.75.177.42] has joined #openvpn
18:47 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
19:05 < Harley> hello looking for help with a vpnissues.. have a unix openvpn server. with 2 clients. 1 unix the other os x with tunnelblicj. Unix to unix is fine but unix to mac :-( each client has its own key. both clients connect just fine. On the unix all internet traffic goes to the vpn. on the mac none goes. cleint log -- http://www.pastebin.ca/2096039 on the mac if use tr  hits the vpn. but no browser traffic
19:09 <+l0rd_hex> Harley: can you ping your server on the OS X box?
19:09 < Harley> l0rd_hex: when connected or offline?
19:09 <+l0rd_hex> for instance, I can ping 10.0.0.12 (which is my server's internal IP address) when openvpn has connected
19:10 < Harley> l0rd_hex: 99% sure yes. but will check again
19:12 -!- Harley_ [~Harley@110.185.145.95] has joined #openvpn
19:13 < Harley_> l0rd_hex: when connected i can ping 10.8.0.10 
19:13 -!- Harley [~Harley@110.185.145.95] has quit [Read error: Connection reset by peer]
19:14 -!- flosoft_ [4d6d663c@gateway/web/freenode/ip.77.109.102.60] has joined #openvpn
19:14 <@vpnHelper> RSS Update - forum: Ubuntu lan-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18845>
19:14 < flosoft_> Hi guys
19:14 <+l0rd_hex> Harley_: okay so the problem is probably with your routes
19:14 < Harley_>  l0rd_hex: when connected i can ping 10.8.0.10
19:14 < Harley_> l0rd_hex: thanks
19:15 <+l0rd_hex> connect to your vpn on the mac and then examine your routes
19:15 < flosoft_> I was wondering if someone had an idea why I get this error on Tunnelblick (Lion): Sat Dec 24 02:09:21 2011 77.109.102.60:1194 TLS Error: TLS handshake failed
19:15 < flosoft_> that's from the server log
19:15 < Harley_> l0rd_hex: in the setup i ha ve tried  both with and without "push "route 192.168.10.0 255.255.255.0""
19:17 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has quit [Ping timeout: 252 seconds]
19:17 < Harley_> l0rd_hex: suggestions on how to resolve the routes issues?
19:18 <+l0rd_hex> Harley_: connect to your server and check the routes on the mac
19:18 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has joined #openvpn
19:19 -!- flosoft_ [4d6d663c@gateway/web/freenode/ip.77.109.102.60] has quit [Quit: Page closed]
19:19 < Harley_> l0rd_hex: gotya.. any helpful commands to look at?
19:20 <+l0rd_hex> route
19:21 < Harley_> l0rd_hex: ;-) ah-ha
19:21 <+l0rd_hex> I think also netstat -r :P
19:22 -!- Dougy [me@tech.qsi.net] has quit [Ping timeout: 252 seconds]
19:22 < Harley_> l0rd_hex: think i need the "push "route 192.168.10.0 255.255.255.0"" line or no?
19:22 -!- Dougy [me@tech.qsi.net] has joined #openvpn
19:22 -!- starcraftcats [~newegggg@208.111.39.186] has joined #openvpn
19:22 < starcraftcats> https://forums.openvpn.net/topic9458.html
19:22 <@vpnHelper> Title: OpenVPN Support Forum Put ta.key in Windows crypto store? : Server Administration (at forums.openvpn.net)
19:22 <+l0rd_hex> yup, but you said your server is 10.8.x.x?
19:22 < Harley_> l0rd_hex: correct
19:23 <+l0rd_hex> Harley_: so I tink you would push 10.8.0.0
19:23 <+l0rd_hex> I have never played with that though
19:23 <+l0rd_hex> so I presume you are pushing the wrong subnet route
19:23 <+l0rd_hex> but I'm not sure why your unix box would work
19:23 -!- _julian_ [~quassel@hmbg-5f76495b.pool.mediaWays.net] has joined #openvpn
19:24 < Harley_> okay.. off to play around some more
19:24 < Harley_> ty
19:24 -!- _julian [~quassel@hmbg-4d06cc35.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
19:25 -!- Harley_ [~Harley@110.185.145.95] has quit [Remote host closed the connection]
19:25 <@vpnHelper> RSS Update - forum: Put ta.key in Windows crypto store? <http://forums.openvpn.net/topic9458.html>
19:31 -!- mirco [~mirco@p5B284F49.dip.t-dialin.net] has quit [Quit: mirco]
19:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 268 seconds]
19:48 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18847>
19:50 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:16 -!- Guest53236 [~Jids@CPEf46d04abb2bc-CM000a739c0010.cpe.net.cable.rogers.com] has joined #openvpn
20:22 -!- master_of_master [~master_of@p57B53D1D.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:24 -!- master_of_master [~master_of@p57B5526F.dip.t-dialin.net] has joined #openvpn
20:31 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
20:52 -!- Guest53236 [~Jids@CPEf46d04abb2bc-CM000a739c0010.cpe.net.cable.rogers.com] has left #openvpn []
20:52 -!- Jids [~Jids@CPEf46d04abb2bc-CM000a739c0010.cpe.net.cable.rogers.com] has joined #openvpn
20:56 -!- Denial [Denial@drgi.co.uk] has quit []
21:03 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
21:12 <@vpnHelper> RSS Update - forum: End to end encryption. <http://forums.openvpn.net/topic9459.html>
21:16 -!- treund [~treund@97.75.177.42] has left #openvpn []
21:34 -!- Azdin [~chatzilla@S01060014bf8f5ff1.ed.shawcable.net] has quit [Quit: ChatZilla 0.9.88 [Firefox 8.0.1/20111120135848]]
22:16 -!- vereteran-x [~vereteran@static.88-198-170-117.clients.your-server.de] has quit [Excess Flood]
22:19 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
22:25 -!- Chorca [~chris@68.204.88.230] has joined #openvpn
22:27 -!- starcraftcats [~newegggg@208.111.39.186] has quit []
22:29 -!- RichardBronosky [~RichardBr@slice1.bronosky.com] has quit [Ping timeout: 240 seconds]
22:29 < Chorca> Heyhey. Having an issue on Ubuntu with being able to ping my tun0 IP, but not the P-t-P gateway.. not sure which errors in the logs are actually errors. 
22:30 -!- RichardBronosky_ [~RichardBr@slice1.bronosky.com] has joined #openvpn
22:32 < Chorca> Related log: http://pastebin.com/hbpgAN6a
22:32 < Chorca> Routes appear to set properly, can ping .41, but not .42
22:35 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 240 seconds]
22:36 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
22:42 < Chorca> others are able to connect to the VPN, so it looks to be on the client side
22:45 -!- omegatotal|werk [4825f464@gateway/web/freenode/ip.72.37.244.100] has joined #openvpn
22:51 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
23:05 -!- Gravitro_ [~admin@76.92.159.145] has joined #openvpn
23:06 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 244 seconds]
23:42 -!- norc_ [~norc@p15142144.pureserver.info] has quit [Ping timeout: 252 seconds]
23:48 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 252 seconds]
23:49 -!- norc_ [~norc@p15142144.pureserver.info] has joined #openvpn
23:52 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
--- Day changed Sat Dec 24 2011
00:01 -!- omegatotal|werk [4825f464@gateway/web/freenode/ip.72.37.244.100] has quit [Quit: Page closed]
00:18 <@vpnHelper> RSS Update - forum: Dear Expert(Need assistance with Openvpn consulting !) <http://forums.openvpn.net/topic9460.html>
00:55 -!- Chorca [~chris@68.204.88.230] has left #openvpn []
01:45 -!- phantomcircuit is now known as ga
01:46 -!- ga is now known as ge
01:46 -!- ge is now known as gf
01:46 -!- gf is now known as gg
01:46 -!- gg is now known as gh
01:46 -!- gh is now known as phantomcircuit
03:20 -!- mirco [~mirco@p5B28207B.dip.t-dialin.net] has joined #openvpn
03:27 -!- mirco [~mirco@p5B28207B.dip.t-dialin.net] has quit [Quit: mirco]
03:38 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
03:53 <@vpnHelper> RSS Update - forum: Disconnect problem <http://forums.openvpn.net/topic9452.html#p18850>
03:55 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:55 -!- mode/#openvpn [+o mattock] by ChanServ
04:00 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
04:02 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 248 seconds]
04:05 -!- zamba [marius@flage.org] has joined #openvpn
04:05 -!- frojnd [~frojnd@86.58.21.55] has joined #openvpn
04:05 < frojnd> Hi there.
04:05 < zamba> frojnd: hi there! :)
04:05 < frojnd> :D
04:06 < frojnd> hi zamba 
04:07 < frojnd> Ok. Let me explain what my problem is. I'm trying to configure openvpn server on a tomato firmware. I've followed this guide: http://blog.johnso.org/2009/08/how-to-setup-openvpn-in-tomato.html it's plain and simple setup with static keys
04:07 <@vpnHelper> Title: Hacks and Slash: How to Setup Openvpn in Tomato (at blog.johnso.org)
04:07 < zamba> frojnd: i suggest running openwrt on that router instead ;)
04:07 < frojnd> the only two modification to this tutorial I made was set the port to 1194 and firewall to Automatic
04:09 < frojnd> Now when I try to connect with linux client outside of the network this router is placed logs foor linux client says: http://paste.pocoo.org/show/525280/
04:10 < frojnd> Any my connect.ovpn looks like: http://paste.pocoo.org/show/525281/
04:11 < frojnd> Let me says that I've changed default network mask where tomato router is placed from 192.168.1.1 to 92.6.1.1
04:11 < frojnd> anso this shouldn't be a problem
04:12 < frojnd> I've tried to loose all errors so I've removed redirect-gateway from connect.ovpn the logs after removeing it says: http://paste.pocoo.org/show/525179/
04:12 < frojnd> so it's error free...
04:13 < frojnd> I know this is in conflict with what I wannt to achieve (to have my client's computer send all trafic through my router)
04:15 < frojnd> But I don't get any IPs. ifconfig -a says: http://paste.pocoo.org/show/525283/
04:15 < frojnd> so you can see there are some packages under tap0
04:15 < frojnd> no IP though
04:16 < frojnd> But this is only if I remove redirect-gateway from client's config file
04:18 < frojnd> if it's there then I have errors like: http://paste.pocoo.org/show/525280/ and ifconfig -a looks like: http://paste.pocoo.org/show/525285/
04:28 < frojnd> zamba: yeah... the problem is that I have to work with what I currently have :/
04:28 < frojnd> zamba: if I had openvrt the problem would be long solved 
04:29 < frojnd> openwrt*
04:29 < frojnd> Anyone here? :)
04:29 <+hyper_ch> no
04:30 < frojnd> It's a mess huh :)
04:30 < frojnd> if anyone red my jibberish talking.. I don't know how to explain better
04:32 < reiffert> you are doing well.
04:32 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
04:33 < reiffert> what came to mind on my side is: tomato is an ancient and old version of openwrt, aint it?
04:33 < frojnd> reiffert: well actually I'm using tomato's mode Toastman mod. Which is like august this year last version or the one I'm using
04:35 < reiffert> forget about that then..
04:38 <+hyper_ch> tomato isn't old
04:45 < frojnd> Well if you think you can help me and you have some constructive suggestion please let me know. I'd much appreciate it.
04:58 <@vpnHelper> RSS Update - forum: Disconnect problem <http://forums.openvpn.net/topic9452.html#p18851>
05:40 -!- mirco [~mirco@p5B28207B.dip.t-dialin.net] has joined #openvpn
05:55 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
06:19 -!- Deathvalley122 [~Death@localtel.eagleits.net] has quit [Ping timeout: 248 seconds]
06:28 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
06:55 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
07:41 <@vpnHelper> RSS Update - forum: Thousands of Console entries from net.openvpn.client on Mac <http://forums.openvpn.net/topic9462.html> || Thousands of Console entries from net/openvpn.client on Mac <http://forums.openvpn.net/topic9461.html>
07:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
07:41 -!- Rolybrau [~Rolybrau@212-172.78-83.cust.bluewin.ch] has joined #openvpn
07:41 -!- Rolybrau [~Rolybrau@212-172.78-83.cust.bluewin.ch] has quit [Changing host]
07:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:47 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
07:47 -!- Damascene [~house@unaffiliated/uaa] has joined #openvpn
07:47 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:49 < Damascene> Hi,Hi, On my OpenVPN setup I was able to ping some machines but not Windows7 nor Servers. I installed wireshark on one of them and it seems that it gets the ping but and in wireshark it appear that there is a replay but it mention something about checksum error
07:57 -!- mirco [~mirco@p5B28207B.dip.t-dialin.net] has quit [Quit: mirco]
08:13 <+hyper_ch> !welcome
08:13 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:16 -!- Jids [~Jids@CPEf46d04abb2bc-CM000a739c0010.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
08:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
08:33 -!- Harley [~Harley@li385-19.members.linode.com] has joined #openvpn
08:34 -!- Harley_ [~Harley@182.151.167.134] has joined #openvpn
08:36 < Harley_> hello.. anyone free to help a mac user with OPENvpn to unix server.. having what I think is routing issues...
08:36 < Harley_> connection goes just fine.
08:36 < Harley_> can ping the server
08:36 < Harley_> can tr any site
08:37 < Harley_> but no web traffic is flowing over the connection
08:38 -!- Harley [~Harley@li385-19.members.linode.com] has quit [Ping timeout: 276 seconds]
08:38 <+hyper_ch> he was patient
08:39 <+hyper_ch> ah, nah, just his other nick left
08:39 <+hyper_ch> Harley_: issue:  !welcome
08:39 <+hyper_ch> and do what it says there
08:39 < Harley_> !welcome
08:39 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:40 < Harley_> hyper_ch: my local lan is 192.168.1.x and another client is 192.168.10.x
08:40 < Harley_> !route
08:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
08:42 < Damascene> I got it working any way thanks. I added a route to the machine in lan to see the vpn client
08:43 < Harley_> !redirect
08:43 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
08:44 < Harley_> trying to get the 2nd client up and running... logs can be seen here. http://www.pastebin.ca/2096039
08:44 < Harley_> first client connect that is unix to unix.. but mac to unix.. arghhh
08:49 < Harley_> !goal
08:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:49 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090557.dsl.bell.ca] has quit [Ping timeout: 255 seconds]
08:50 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090820.dsl.bell.ca] has joined #openvpn
08:51 < Harley_> goal connect my mac using tunnelblick to our vpn server unix to route all my internet traffic via the vpn. Currently we have this working for another client Unix to Unix now trying os x to unix. Using same client.conf with seperate keys. connects just fine. Can ping, can tr. but no web traffic.. believe is a routing issue.
08:57 -!- Harley_ [~Harley@182.151.167.134] has quit [Ping timeout: 276 seconds]
08:59 -!- Harley [~Harley@182.151.167.134] has joined #openvpn
09:02 -!- Harley_ [~Harley@182.151.167.134] has joined #openvpn
09:03 -!- Harley [~Harley@182.151.167.134] has quit [Read error: Connection reset by peer]
09:03 < Harley_> hello
09:03 < Harley_> http://www.pastebin.ca/2096167 of ipv4 routing table when connected
09:11 -!- Harley_ [~Harley@182.151.167.134] has quit [Ping timeout: 276 seconds]
09:12 -!- Harley [~Harley@182.151.167.134] has joined #openvpn
09:16 < Harley> think the default route maybe related to the problem looking closer at the route table when connected
09:16 < Harley> default            192.168.1.1        UGSc           28      460     en0
09:16 < Harley> is showing
09:16 < Harley> any help onhow to delete on a mac.. just to test the theory
09:23 -!- Harley [~Harley@182.151.167.134] has quit [Ping timeout: 276 seconds]
09:24 -!- Harley [~Harley@182.151.167.134] has joined #openvpn
09:24 < Harley> nope that did not work
09:24 < Harley> arghhh
09:28 < Harley> anyone able to help? am lost
09:30 < Olipro> so the default route goes to the VPN server?
09:31 < Olipro> do you also have an explicit route to the VPN server that goes over your real internet connection
09:31 < Harley> Olipro: believe you are talking to me... i put the route table on http://www.pastebin.ca/2096167 i tired to delete line 04 and no change...
09:33 < Olipro> is 192.168.1.1 pingable
09:33 < Harley> when the vpn is up?
09:33 < Olipro> up or down
09:34 < Harley> down yes.
09:34 < Harley> up. need to connect... be right back
09:34 < Olipro> is this a view of your routing table when the VPN is up?
09:35 < Harley> yes can ping 192.168.1.1 -- up or down...
09:35 < Harley> and the view is when up
09:35 < Olipro> also, why do you have two routes for openvpn DNS names that go to lo0
09:35 -!- Harley [~Harley@182.151.167.134] has left #openvpn ["Leaving..."]
09:35 -!- Harley [~Harley@182.151.167.134] has joined #openvpn
09:35 < Harley> 23:35 Harley: yes can ping 192.168.1.1 -- up or down...
09:36 < Harley> 23:35 Harley: and the view is when up\
09:36 < Olipro> <Olipro> also, why do you have two routes for openvpn DNS names that go to lo0
09:36 < Harley> Olipro: not sure.... 
09:36 < Olipro> is that the server you're connecting to?
09:38 < Harley> Olipro: you referring to links 15, 16, 17,
09:38 < Olipro> yes
09:38 < Harley> the ans is nope
09:38 < Harley> no clue where that comes from
09:39 < Olipro> are you able to ping 10.8.0.13 when the VPN is up
09:39 < Olipro> or 10.8.0.14
09:40 < Harley> i can ping the 10.8.0.0 subnet
09:40 < Harley> and I can also TR and it hits the VPN
09:40 < Olipro> subnets don't respond, hosts do
09:40 < Olipro> what hosts respond to your ping
09:40 < Harley> and if i run route get www.youtube.com  shows the vpn again
09:41 < Harley> ping 10.8.0.13
09:41 < Harley> PING 10.8.0.13 (10.8.0.13): 56 data bytes
09:41 < Harley> Request timeout for icmp_seq 0
09:41 < Harley> Request timeout for icmp_seq 1
09:41 < Harley> cRequest timeout for icmp_seq 2
09:41 < Harley> Request timeout for icmp_seq 3
09:41 < Harley> Request timeout for icmp_seq 4
09:41 < Harley> and .14 also replied. 
09:41 < Harley> tested that earlier
09:41 < Olipro> .13 isn't replying
09:41 < Olipro> which indicates it's either dead, or not an assigned address
09:42 < Harley> ping 10.8.0.14
09:42 < Harley> PING 10.8.0.14 (10.8.0.14): 56 data bytes
09:42 < Harley> 64 bytes from 10.8.0.14: icmp_seq=0 ttl=64 time=349.624 ms
09:42 < Harley> 64 bytes from 10.8.0.14: icmp_seq=1 ttl=64 time=352.095 ms
09:42 < Harley> 64 bytes from 10.8.0.14: icmp_seq=2 ttl=64 time=341.305 ms
09:42 < Harley> tun0: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1500
09:42 < Harley> 	inet 10.8.0.14 --> 10.8.0.13 netmask 0xffffffff 
09:42 < Harley> 	open (pid 92434)
09:42 < Olipro> your routing table shows that the routes are expected to go via 10.8.0.13
09:43 < Olipro> I guess you're using the /30 subnet config
09:43 < Harley> Olipro: you are talking line 05? "10.8/24            10.8.0.13          UGSc            1        0    tun0 "
09:43 < Harley> not sure about the subnet config
09:44 < Olipro> multiple lines
09:44 < Olipro> is the openvpn tunnel being used purely as point-to-point
09:44 < Olipro> or is it multi-client
09:44 < Harley> Olipro: not sure understand your question
09:45 < Olipro> are your running it so only one client connects to the server at a time
09:45 < Olipro> or multiple simultaneous clients
09:45 < Harley> multiple clients
09:46 < Harley> really appreciate your help
09:46 < Olipro> ok, alter your routing table so that 0/1 and 128/1 go via 10,8,0,14
09:46 < Harley> on the mac?
09:47 < Harley> line 3 and line 18?
09:48 < Olipro> zes
09:48 < Olipro> *yes
09:48 < Harley> okay...
09:49 < Harley> hmmm any help on how to do that manually on os x?
09:49 < Olipro> I don!t use mac OS, I presume you use the route command
09:49 < Olipro> Hungarian keyboard layout is the worst
09:49 < Harley> Olipro: haha
09:50 < Harley> Olipro: the .13 and .14 are not the right IP's the server has fixed... 10.8.0.9 or .10
09:50 < Harley> Olipro: sigh
09:50 < Olipro> Iif you're using sub30, they are
09:50 < Olipro> switch it to 14 and see if it starts working
09:51 < Harley> sorryr.. looking at the route table when connected i see different host number for the ed block
09:51 < Olipro> take a look at the "topology" option for OpenVPN config
09:51 < Harley> d* block
09:51 < Harley> client config?
09:51 < Olipro> client and server
09:52 <+novaflash> hey guys. quick question; is there a way to refresh the list of config files in the openvpn gui without closing all connections, closing the client, starting the client anew, starting my connections?
09:52 < Harley> no topology in either file
09:52 <+novaflash> this is as client in windows 7 by the way
09:52 < Olipro> which means it defaults to net30
09:53 < Olipro> which in turn means the IP you route "via" is technically a non-existent IP
09:53 < Harley> Olipro: okay.. so... this is a problem from what you are saying....
09:53 < Olipro> it's not a problem, you just need to specify the correct IP for via
09:53 < Olipro> or none at all if your OS will let you
09:53 < Olipro> depends how it treats p2p links
09:54 < Harley> Olipro: let me try. i can set a static Ip... 
09:54 < Harley> Thanks.. for help. hope here when back..
09:58 -!- Harley [~Harley@182.151.167.134] has quit [Read error: Connection reset by peer]
09:58 -!- Harley [~Harley@182.151.167.134] has joined #openvpn
09:59 < Harley> Olipro: back.. not working but...
10:00 < Harley> http://pastebin.ca/2096168 so the .13 and .14 IPs were weird.. this is better and more what it shold be,.
10:00 < Harley> Olipro: so still need to change the sub30 to sub14?
10:01 < Olipro> there's no such thing as sub14
10:01 < Harley> Olipro: do.. mis understood your comment "switch it to 14 and see if it starts working"
10:02 < Olipro> yes, I meant the via address for your routes
10:02 < Olipro> but you can try switching to topology subnet on the server and clinet
10:02 < Olipro> *client
10:02 < Olipro> you'll need to restart Openvpn of course
10:03 < Harley> how to change the topology in the sever / client conf file? what kind or risk does that create for the other connection?
10:04 < Olipro> add "topology subnet" somewhere
10:05 < Olipro> it shouldn't break anything
10:05 < Harley> okay
10:05 < Olipro> the server just needs an iroute for each client
10:06 < Olipro> actually, that's only if you need to route traffic behind clients
10:06 < Olipro> it'll automatically handle irouting to the client's assigned endpoint address
10:07 < Harley> Olipro: reading http://openvpn.net/archive/openvpn-users/2005-09/msg00079.html
10:07 <@vpnHelper> Title: [Openvpn-users] New subnet topology feature ready for testing (at openvpn.net)
10:07 < Olipro> 2005...
10:07 < Harley> Olipro: yikes
10:07 < Harley> damm google
10:08 < Olipro> the basic gist of it is this: providing you don't need to route traffic to subnets behind your clients, subnet is fine for you
10:08 < Olipro> and if you do, you can configure iroutes on a per-client basis
10:09 < Harley> okay adding "topology subnet" to server and client conf files to restart
10:14 -!- Harley_ [~Harley@li385-19.members.linode.com] has joined #openvpn
10:14 < Harley_> Olipro: you here?
10:15 < Olipro> yes
10:15 < Harley_> Olipro: owe you a big beer! seems to be workin!!
10:15 -!- Harley [~Harley@182.151.167.134] has quit [Ping timeout: 276 seconds]
10:15 < Harley_> i am on the VPN now
10:15 < Harley_> i can also ping the other client
10:15 < Olipro> happy days
10:15 < Harley_> Olipro: awsome.. thank you so much!!!!
10:16 < Olipro> no problem
10:16 < Harley_> Olipro: wish could do more than say thanks.. this is huge for me!
10:17 < Olipro> :)
10:21 < Harley_> Olipro: thanks again!! off to sleep
10:23 < Olipro> interesting
10:23 < Olipro> I wonder what version is bundled into the WNDR3800
10:26 -!- Harley_ [~Harley@li385-19.members.linode.com] has quit [Remote host closed the connection]
10:29 -!- Kanyl [~on@unaffiliated/kanyl] has quit [Ping timeout: 240 seconds]
10:45 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:45 -!- mode/#openvpn [+v Axeman] by ChanServ
10:46 -!- Damascene [~house@unaffiliated/uaa] has quit [Quit: Ex-Chat]
10:56 -!- converge [~converge@unaffiliated/joaop] has joined #openvpn
10:57 -!- me345 [~me345@adsl-71-131-129-120.dsl.sntc01.pacbell.net] has joined #openvpn
11:05 -!- converge [~converge@unaffiliated/joaop] has quit [Quit: Linkinus - http://linkinus.com]
11:08 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
11:19 -!- Jids [~Jids@CPE001b1160e318-CM001225422682.cpe.net.cable.rogers.com] has joined #openvpn
11:38 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
11:38 -!- mode/#openvpn [+v Axeman] by ChanServ
11:51 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:51 -!- mode/#openvpn [+o raidz] by ChanServ
11:57 -!- Harley [~Harley@li385-19.members.linode.com] has joined #openvpn
12:04 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
12:33 -!- me345 [~me345@adsl-71-131-129-120.dsl.sntc01.pacbell.net] has quit [Remote host closed the connection]
13:04 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
13:05 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:08 -!- masch_ is now known as masch
13:16 -!- Harley [~Harley@li385-19.members.linode.com] has quit [Remote host closed the connection]
13:34 -!- jeev [1004@unaffiliated/jeev] has quit [Ping timeout: 255 seconds]
13:35 -!- ac3xor [~ac3xor@c-66-229-31-32.hsd1.fl.comcast.net] has joined #openvpn
13:35 -!- jeev [1004@unaffiliated/jeev] has joined #openvpn
13:35 < ac3xor> i need some help is anyone on that could possibly help me?
13:39 -!- ac3xor [~ac3xor@c-66-229-31-32.hsd1.fl.comcast.net] has left #openvpn []
13:48 <@EugeneKay> !ask
13:48 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
13:49 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
14:33 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 248 seconds]
14:40 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has joined #openvpn
14:41 < mgorbach> Anyone able to help me out with the performnce of my openvpn? I'm attempting to transfer something via AFP and it's pretty much non-functional.
14:41 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
14:42 -!- mode/#openvpn [+v Axeman] by ChanServ
15:00 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
15:08 -!- Jids [~Jids@CPE001b1160e318-CM001225422682.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
15:22 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 252 seconds]
15:39 -!- mirco [~mirco@p5B28207B.dip.t-dialin.net] has joined #openvpn
15:50 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Read error: Operation timed out]
15:51 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Ping timeout: 252 seconds]
15:52 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
15:52 -!- nb [~nb@fedora/znc.nb] has quit [Excess Flood]
15:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
15:53 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
15:53 -!- vect0rx [vectorx@countercultured.net] has quit [Ping timeout: 252 seconds]
15:53 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
15:54 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
15:56 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
15:57 <+krzie> mgorbach, you using udp or tcp?  bridging or routing?
15:57 <+krzie> have you tested your mtu?
15:57 -!- Guest45243 [~nb@delta.bebout.us] has joined #openvpn
15:59 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 268 seconds]
15:59 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
16:00 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
16:08 <@vpnHelper> RSS Update - forum: Put ta.key in Windows crypto store? <http://forums.openvpn.net/topic9458.html#p18855> || End to end encryption. <http://forums.openvpn.net/topic9459.html#p18854>
16:14 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18857> || Disconnect problem <http://forums.openvpn.net/topic9452.html#p18856>
16:26 <@vpnHelper> RSS Update - forum: Disconnect problem <http://forums.openvpn.net/topic9452.html#p18858>
16:27 < ecrist> Merry Christmas folks.  :)
16:47 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:47 -!- mode/#openvpn [+o raidz] by ChanServ
16:48 -!- ac3xor [~ac3xor@c-66-229-31-32.hsd1.fl.comcast.net] has joined #openvpn
16:48 < ac3xor> anyone able to help me troubleshoot my vpn
16:50 -!- ac3xor [~ac3xor@c-66-229-31-32.hsd1.fl.comcast.net] has quit [Client Quit]
16:50 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
16:56 -!- mirco [~mirco@p5B28207B.dip.t-dialin.net] has quit [Quit: mirco]
17:00 < mgorbach> krzie: Tried TCP and UDP
17:01 < mgorbach> Tested MTU using the mtu-test mode, seems fine.
17:01 < mgorbach> Running with tap bridging.
17:02 <+rawplayer> zalig kerstfeest allemaal \o/
17:07 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
17:16 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
17:16 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:16 -!- mode/#openvpn [+o raidz] by ChanServ
17:23 -!- cst87 [~cst87@24-246-46-21.cable.teksavvy.com] has joined #openvpn
17:23 < cst87> !welcome
17:23 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:24 < cst87> !goal
17:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:28 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
17:29 -!- cst87 [~cst87@24-246-46-21.cable.teksavvy.com] has quit [Ping timeout: 240 seconds]
17:32 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Client Quit]
17:35 -!- cst87 [~cst87@24-246-46-21.cable.teksavvy.com] has joined #openvpn
17:37 -!- cst87 [~cst87@24-246-46-21.cable.teksavvy.com] has quit [Client Quit]
17:47 -!- mirco [~mirco@p5B28207B.dip.t-dialin.net] has joined #openvpn
17:49 -!- vect0rx [vectorx@countercultured.net] has joined #openvpn
17:57 -!- LuckyY is now known as pong
17:57 -!- pong is now known as luckyy
17:57 -!- mirco [~mirco@p5B28207B.dip.t-dialin.net] has quit [Quit: mirco]
17:57 -!- luckyy is now known as LuckyY
17:58 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has quit [Quit: Leaving...]
18:00 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
18:10 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
18:16 <@vpnHelper> RSS Update - forum: Route in VPN subnet <http://forums.openvpn.net/topic9463.html>
18:27 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
19:20 -!- _julian [~quassel@hmbg-4d06e5e8.pool.mediaWays.net] has joined #openvpn
19:23 -!- zamba [marius@flage.org] has left #openvpn ["WeeChat 0.3.6"]
19:23 -!- _julian_ [~quassel@hmbg-5f76495b.pool.mediaWays.net] has quit [Ping timeout: 252 seconds]
19:33 -!- Denial [Denial@drgi.co.uk] has quit []
19:42 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
19:47 -!- simtet [~simtet@24-246-46-21.cable.teksavvy.com] has joined #openvpn
19:49 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
20:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:18 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 252 seconds]
20:21 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
20:22 -!- master_of_master [~master_of@p57B5526F.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
20:24 -!- master_of_master [~master_of@p57B52701.dip.t-dialin.net] has joined #openvpn
20:32 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
21:02 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:06 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
21:10 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
21:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
21:25 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
21:26 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
21:26 -!- mode/#openvpn [+o raidz] by ChanServ
21:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 268 seconds]
21:28 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
21:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
21:50 -!- Guest45243 [~nb@delta.bebout.us] has quit [Changing host]
21:50 -!- Guest45243 [~nb@fedora/znc.nb] has joined #openvpn
21:50 -!- Guest45243 [~nb@fedora/znc.nb] has left #openvpn []
21:50 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
21:53 -!- Gravitro_ [~admin@76.92.159.145] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
21:53 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
22:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
22:25 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
22:28 -!- simtet [~simtet@24-246-46-21.cable.teksavvy.com] has quit [Quit: simtet]
22:28 <@vpnHelper> RSS Update - forum: Some clients work while others don't with the same conf <http://forums.openvpn.net/topic9464.html>
22:50 -!- tjz [~pc@unaffiliated/tjz] has quit [Quit: bbl.]
23:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
23:15 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
23:40 -!- norc_ [~norc@p15142144.pureserver.info] has quit [Ping timeout: 240 seconds]
23:56 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
--- Day changed Sun Dec 25 2011
00:03 -!- norc [~norc@p15142144.pureserver.info] has joined #openvpn
00:32 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:20 <@vpnHelper> RSS Update - forum: [HELP] Could someone please help me (portforwarding) <http://forums.openvpn.net/topic9426.html#p18861>
01:40 <+l0rd_hex> WISHING YOU ALL A FUNKY FUNKY CHRISTMAS http://www.youtube.com/watch?v=9jf-GVIxy9c
01:40 <@vpnHelper> Title: New Kids On The Block - FUnky, Funky Christmas(Arsenio Hall) - YouTube (at www.youtube.com)
02:02 <@vpnHelper> RSS Update - forum: Disconnect problem <http://forums.openvpn.net/topic9452.html#p18862>
02:02 -!- agagag_ [~anton@eudaimonia.goto10.org] has quit [Ping timeout: 255 seconds]
02:08 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
02:14 <@vpnHelper> RSS Update - forum: OpenVPN visibility question. <http://forums.openvpn.net/topic9449.html#p18863>
02:26 <@vpnHelper> RSS Update - forum: openvpn multiple instances route issue? <http://forums.openvpn.net/topic9443.html#p18864>
02:32 <@vpnHelper> RSS Update - forum: route and nat howto? (I do not know the correct title) <http://forums.openvpn.net/topic9263.html#p18865>
03:01 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
03:06 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
03:06 -!- mode/#openvpn [+o mattock] by ChanServ
03:16 <@vpnHelper> RSS Update - forum: Ubuntu OpenVPN Client ping problem ! Mac Client no problem <http://forums.openvpn.net/topic9440.html#p18866>
03:32 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:33 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
03:36 <@vpnHelper> RSS Update - forum: Openvpn icon remains yellow when "verb 0" is used <http://forums.openvpn.net/topic9437.html#p18868> || Bridged vpn with mapped ip addresses (NETMAP) <http://forums.openvpn.net/topic9457.html#p18867> || [resolved] Openvpn server suddenly stopped working <http://forums.openvpn.net/topic9416.html#p18697>
03:42 <@vpnHelper> RSS Update - forum: Disable split tunneling <http://forums.openvpn.net/topic9373.html#p18869>
04:08 -!- rudenstam [~rudentop@pdpc/supporter/student/rudenstam] has joined #openvpn
04:08 < rudenstam> !welcome
04:08 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:09 < rudenstam> !goal
04:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:12 <@vpnHelper> RSS Update - forum: [resolved] Client routing and martian prob <http://forums.openvpn.net/topic9442.html#p18798>
04:16 -!- rudenstam [~rudentop@pdpc/supporter/student/rudenstam] has quit [Ping timeout: 276 seconds]
04:18 <@vpnHelper> RSS Update - forum: [Resolved] Log volume of traffic tunneled by a user <http://forums.openvpn.net/topic9392.html#p18871> || UDP connection doesn't seem to work <http://forums.openvpn.net/topic9454.html#p18870>
04:24 <@vpnHelper> RSS Update - forum: Ubuntu lan-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18872>
04:36 <@vpnHelper> RSS Update - forum: Some clients work while others don't with the same conf <http://forums.openvpn.net/topic9464.html#p18873>
04:42 <@vpnHelper> RSS Update - forum: Route in VPN subnet <http://forums.openvpn.net/topic9463.html#p18874>
04:48 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 255 seconds]
04:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
04:49 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
04:55 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has quit [Read error: Connection reset by peer]
05:06 <@vpnHelper> RSS Update - forum: Split tunnel tweaks? <http://forums.openvpn.net/topic7161.html#p18876> || OpenVPN 2.2.2 released <http://forums.openvpn.net/topic9446.html#p18875> || [resolved]Change lport & rport given a binary from provider? <http://forums.openvpn.net/topic9441.html#p18774>
05:10 -!- guifort [~guifort@ks34643.kimsufi.com] has joined #openvpn
05:12 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
05:17 -!- guifort [~guifort@ks34643.kimsufi.com] has quit [Read error: Connection reset by peer]
05:17 <@vpnHelper> RSS Update - forum: Site to Site problems. <http://forums.openvpn.net/topic9445.html#p18878> || Routing problem <http://forums.openvpn.net/topic9456.html#p18877>
05:17 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
05:18 -!- guifort [~guifort@ks34643.kimsufi.com] has joined #openvpn
05:22 <@vpnHelper> RSS Update - forum: [resolved] Can Connect a Client but Cannot Access Web Pages <http://forums.openvpn.net/topic9422.html#p18717> || VPN routing to LAN in tap <http://forums.openvpn.net/topic9425.html#p18655>
05:37 -!- guifort [~guifort@ks34643.kimsufi.com] has quit [Ping timeout: 252 seconds]
06:19 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
07:21 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
07:21 -!- mode/#openvpn [+o mattock] by ChanServ
07:59 -!- tjz [~pc@bb119-74-162-65.singnet.com.sg] has joined #openvpn
07:59 -!- tjz [~pc@bb119-74-162-65.singnet.com.sg] has quit [Changing host]
07:59 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
08:11 -!- rudenstam [~rudentop@c-4c0872d5.311-80-64736c10.cust.bredbandsbolaget.se] has joined #openvpn
08:15 -!- ]R[ [Gonzo@hunting.bin-laden.biz] has quit [Ping timeout: 268 seconds]
08:15 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
08:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
08:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
08:17 < rudenstam> !route
08:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
08:17 < rudenstam> !tcpip
08:17 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
08:21 -!- rudenstam [~rudentop@c-4c0872d5.311-80-64736c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
08:59 <@vpnHelper> RSS Update - forum: Some clients work while others don't with the same conf <http://forums.openvpn.net/topic9464.html#p18879>
08:59 -!- guifort [~guifort@ns208662.ovh.net] has joined #openvpn
09:00 -!- guifort_ [~guifort@ns208662.ovh.net] has joined #openvpn
09:00 -!- guifort [~guifort@ns208662.ovh.net] has quit [Read error: Connection reset by peer]
09:01 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
09:13 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
09:13 -!- rudenstam [~rudentop@c-4c0872d5.311-80-64736c10.cust.bredbandsbolaget.se] has joined #openvpn
09:14 -!- guifort_ is now known as guifort
09:31 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
09:31 -!- rudenstam [~rudentop@c-4c0872d5.311-80-64736c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
09:37 -!- guifort [~guifort@ns208662.ovh.net] has quit [Quit: Quitte]
09:44 -!- rudenstam [~rudentop@c-4c0872d5.311-80-64736c10.cust.bredbandsbolaget.se] has joined #openvpn
10:23 -!- JackW [~jack@27.Red-2-142-115.dynamicIP.rima-tde.net] has joined #openvpn
10:36 -!- rudenstam [~rudentop@c-4c0872d5.311-80-64736c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 276 seconds]
10:42 -!- gizmobay [~gizmobay@ip98-165-216-111.ph.ph.cox.net] has joined #openvpn
10:42 < gizmobay> can openvpn forward the pulse audio to the remote guest?
10:53 <@vpnHelper> RSS Update - forum: Some clients work while others don't with the same conf <http://forums.openvpn.net/topic9464.html#p18881> || [Draft] Accessing LAN resources when OpenVPN is not LAN's GW <http://forums.openvpn.net/topic9465.html>
10:59 -!- scyld [~operacyjn@unaffiliated/wasyl] has joined #openvpn
11:07 <+TJNII> openvpn won't really "forward" pulse.  What openvpn will do is allow the two endpoints to communicate openly and they can send pulse to each other.
11:08 < gizmobay> Thanks I use x2go since I can listen to my audio remotely but x2go has some overhead. Is VPN better for this?
11:09 <+TJNII> I don't know, I'm not familiar with x2go
11:09 < gizmobay> I see
11:10 < gizmobay> With VPN, how would I listen to my audio remotely?
11:10 <+TJNII> VPN lets your remote computer act as if it is on your local LAN.
11:11 <+TJNII> So what VPN will allow you to do is use protocols that won't traverse the internet from your local PC to your home PC.
11:11 < gizmobay> okay thanks I will give it a try
11:12 <+TJNII> s/home/remote/
11:32 -!- rudenstam [smartnude@h59ec2c92.selusol.sta.perspektivbredband.net] has joined #openvpn
11:33 < JackW> am setting up openvpn for the first time, so a little unsure about what needs doing.  i notice that vars contains 2 KEY_EMAIL variables?  do i set either one, and comment out the other?
11:37 < JackW> i also note that KEY_CN KEY_NAME KEY_OU PKCS11_MODULE_PATH are set to changeme, do i need to edit these too, and if so what do i set them to?
11:51 -!- rudenstam [smartnude@h59ec2c92.selusol.sta.perspektivbredband.net] has quit [Ping timeout: 244 seconds]
12:12 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
12:12 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has joined #openvpn
12:13 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 248 seconds]
12:30 -!- gizmobay [~gizmobay@ip98-165-216-111.ph.ph.cox.net] has quit [Remote host closed the connection]
12:38 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Read error: Connection reset by peer]
12:39 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
12:58 -!- mcp [~mcp@wolk-project.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
13:12 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
13:14 -!- rudenstam [smartnude@h59ec2c92.selusol.sta.perspektivbredband.net] has joined #openvpn
13:26 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
13:33 -!- rudenstam [smartnude@h59ec2c92.selusol.sta.perspektivbredband.net] has quit [Ping timeout: 240 seconds]
13:35 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18882>
14:09 < reiffert> any ideas how to relay multicast packets with destination 224.0.0.1/ from ethernet to ppp devices?
14:12 < hyper_ch> magic?
14:12 < hyper_ch> or maybe even automagic?
14:18 <@vpnHelper> RSS Update - forum: UDP connection doesn't seem to work <http://forums.openvpn.net/topic9454.html#p18883>
14:35 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
14:35 <@vpnHelper> RSS Update - forum: Some clients work while others don't with the same conf <http://forums.openvpn.net/topic9464.html#p18884>
14:41 -!- mgorbach [~mgorbach@75.6.130.131] has joined #openvpn
15:03 -!- GetsEcle1tic [~getseclec@pool-108-46-182-138.nycmny.fios.verizon.net] has quit [Read error: Connection reset by peer]
16:00 <@vpnHelper> RSS Update - forum: Some clients work while others don't with the same conf <http://forums.openvpn.net/topic9464.html#p18885>
16:38 < JackW> hmm, noob to openvpn :)  do i need to run the build-dh script for each server key/crt pair i generate or will it be the same for all servers based on the keylength?  not that i'm setting up multiple server, rather just to clarify the point as i'm updating the arch wiki as i'm installing
16:39 < EugeneKay> A set of DH paramaters is just magic numbers used by a TLS server.
16:39 < EugeneKay> You ought to use different ones for each server, but it isn't really necessary.
16:40 < EugeneKay> The build-dh script is jut a quick wrapper for an openssl command
16:43 <+krzie> merry christmas guys
16:47 -!- ShadowE989 [~ShadowE98@74-47-218-61.dr02.rmny.wv.frontiernet.net] has joined #openvpn
16:47 < JackW> EugeneKay: ok thanks.  i'll leave that part a little fuzzy until i understand it better then.  better created without the script if you are creating several server certificates?
16:48 < EugeneKay> If you're using the easy-rsa package, just use the build-dh script.
16:48 < EugeneKay> But easy-rsa is NOT necessary for an openvpn pki, just makes it easy(ish)
17:01 -!- ShadowE989 [~ShadowE98@74-47-218-61.dr02.rmny.wv.frontiernet.net] has quit [Read error: Connection reset by peer]
17:18 < JackW> ok, so then i can write that the generated dh{n}.pem file can be used to any server?
17:18 < JackW> i'll make sure about adding a note about what easy-rsa really is
17:19 < JackW> by any server
17:21 < JackW> or maybe a better question, can i, and if so how use the build-dh script to create pem files for different servers?
17:36 -!- rudenstam [smartnude@h59ec2c92.selusol.sta.perspektivbredband.net] has joined #openvpn
17:37 -!- rudenstam [smartnude@h59ec2c92.selusol.sta.perspektivbredband.net] has quit [Client Quit]
17:49 -!- mete- [~mete@mete.shell.la] has quit [Read error: Connection reset by peer]
17:49 -!- mete [~mete@mete.shell.la] has joined #openvpn
17:50 < EugeneKay> IIRC, the script as-is only generates a single dh filename
17:50 < EugeneKay> But, if you look at it, you can see that it is literally one line of openssl 
17:51 -!- mete [~mete@mete.shell.la] has quit [Client Quit]
17:53 -!- mete [~mete@mete.shell.la] has joined #openvpn
17:54 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
17:55 < JackW> EugeneKay: yeah i looked at the script.  i suppose i need to man the subject or read the documentation.  the archwiki is normally of quite hih quality, but for openvpn it sucked big time.  thanks for the clarifications, it's kinda hard the first day with a new topic
17:55 -!- mete [~mete@mete.shell.la] has quit [Client Quit]
18:10 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Quit: This computer has gone to sleep]
18:16 < JackW> on unix, do the certs/keys/pem and config files go into /etc/openvpn/ ?
18:17 <+krzie> JackW, openvpn itself doesnt care
18:17 <+krzie> hell, my /etc/openvpn is empty
18:20 < JackW> krzie: sure i meant by default, i guess i'd better go read the default conf examples then
18:20 <+krzie> theres no "default" either
18:21 <+krzie> they go in whatever path you put in the configs
18:21 <+krzie> now, the linux init.d scripts have a default for the configs, /etc/openvpn like you said
18:21 < JackW> there are sample configs no?  not talking about a custom installation
18:21 <+krzie> then in the configs, use full paths
18:21 <+krzie> !path
18:21 <@vpnHelper> "path" is It is a good idea to use full paths in your config.
18:21 < JackW> i don't have init.d scripts :)
18:22 <+krzie> you installed from source?
18:22 < JackW> no, i installed the archlinux package
18:23 <+krzie> ok well ive never used arch, but most linux has a startup/shutdown script for openvpn
18:23 <+krzie> (which is not part of openvpn, but rather part of the packaging from that package maintainer)
18:23 -!- mgorbach [~mgorbach@75.6.130.131] has quit [Quit: Leaving...]
18:23 <+krzie> that decides where the config goes, and everything else is based on whats in the config
18:23 <+krzie> you might like this:
18:24 <+krzie> !confgen
18:24 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
18:24 < JackW> i seem to have examples in /usr/share/openvpn/examples/  so i will go with those for now
18:25 <+krzie> whatever makes ya happy
18:25 <+krzie> my confgen will generate configs for you based on your answering questions tho
18:26 <+krzie> which will give a correct setup for: client/server, lans behind vpn node[s], or redirect client's internet over vpn
18:26 < JackW> the package installs the server startup script in /etc/rc.d (archlinux for init.d) and that points to /etc/openvpn
18:27 <+krzie> cool
18:27 <+krzie> ahh ya im more used to calling it rc.d too
18:27 < JackW> thanks, i'll have a look at your scripts if i need them
18:27 <+krzie> i call it init.d here cause so many linux people come through here
18:27 < JackW> i have a rc.conf too :)
18:29 <+krzie> arch trying to take gentoo's title of being most friendly for fbsd users?
18:33 < EugeneKay> I hate you, Java.
18:35 < JackW> dunno, but it feel kinda like home, ran freebsd servers years ago when i was working in it
18:35 < JackW> working in information tech
18:39 -!- mirco [~mirco@p5B285EF1.dip.t-dialin.net] has joined #openvpn
18:39 -!- mirco [~mirco@p5B285EF1.dip.t-dialin.net] has quit [Remote host closed the connection]
18:44 < JackW> what does a ; mean in the config files?  that the line is commented out?
18:59 < JackW> actually reading the gentoo wiki is a good idea too :)
19:11 -!- Klapo [~Klapo@maroon.sored.pl] has left #openvpn []
19:14 < ecrist> the man page is priceless
19:14 < ecrist> but, a semi-colon denotes the beginning of a comment
19:18 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
19:19 -!- _julian [~quassel@hmbg-4d06e5e8.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:20 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 252 seconds]
19:20 -!- [1]SigmaProjects is now known as SigmaProjects
19:21 -!- _julian [~quassel@hmbg-5f762745.pool.mediaWays.net] has joined #openvpn
19:29 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
19:46 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
19:47 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Client Quit]
19:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
20:15 -!- Denial [Denial@drgi.co.uk] has quit []
20:22 -!- master_of_master [~master_of@p57B52701.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:24 -!- master_of_master [~master_of@p57B54098.dip.t-dialin.net] has joined #openvpn
20:32 -!- Gravitron [~admin@65.28.68.253] has joined #openvpn
20:32 -!- Gravitron [~admin@65.28.68.253] has quit [Changing host]
20:32 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
20:41 -!- Rolybrau [~Rolybrau@59-178.79-83.cust.bluewin.ch] has joined #openvpn
20:41 -!- Rolybrau [~Rolybrau@59-178.79-83.cust.bluewin.ch] has quit [Changing host]
20:41 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:44 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
21:30 -!- Sparxz [~mark@213-94-252-200-dynamic.b-ras1.dbn.dublin.eircom.net] has joined #openvpn
21:58 -!- Sparxz [~mark@213-94-252-200-dynamic.b-ras1.dbn.dublin.eircom.net] has left #openvpn ["Konversation terminated!"]
22:28 -!- JackW [~jack@27.Red-2-142-115.dynamicIP.rima-tde.net] has quit [Ping timeout: 240 seconds]
22:28 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18886>
22:40 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit [Ping timeout: 276 seconds]
22:50 -!- gffa_ [~gffa@unaffiliated/gffa] has joined #openvpn
22:55 -!- Netsplit *.net <-> *.split quits: +gffa
23:17 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
23:39 -!- norc [~norc@p15142144.pureserver.info] has quit [Ping timeout: 252 seconds]
--- Day changed Mon Dec 26 2011
00:10 <@vpnHelper> RSS Update - forum: UDP connection doesn't seem to work <http://forums.openvpn.net/topic9454.html#p18887>
00:16 <@vpnHelper> RSS Update - forum: Some clients work while others don't with the same conf <http://forums.openvpn.net/topic9464.html#p18888>
00:40 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Quit: vocis]
01:45 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
01:48 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 252 seconds]
01:49 -!- oc80z [oc80z@blea.ch] has joined #openvpn
02:19 -!- _zoom_ [~NISSB@196.1.219.122] has joined #openvpn
02:19 < _zoom_> hi, how to push vpn server as default gw to clients?
02:20 < hyper_ch> !def1
02:20 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
02:20 < hyper_ch> !route
02:20 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
02:21 < hyper_ch> !push
02:21 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
02:28 <@vpnHelper> RSS Update - forum: Ubuntu lan-to-lan configuration <http://forums.openvpn.net/topic9389.html#p18889>
03:09 -!- _zoom_ [~NISSB@196.1.219.122] has quit [Quit: Leaving.]
03:11 <@vpnHelper> RSS Update - forum: Ubuntu lan-to-lan configuration <http://forums.openvpn.net/topic9389-15.html#p18890>
03:53 <@vpnHelper> RSS Update - forum: PAM Athentication using a script based on PHP or Html, help! <http://forums.openvpn.net/topic9301.html#p18891>
03:56 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
04:11 <@vpnHelper> RSS Update - forum: Error with address length ? <http://forums.openvpn.net/topic9430.html#p18892>
04:32 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has joined #openvpn
04:33 -!- Diffen [~diffen@78-82-119-12.tn.glocalnet.net] has quit [Client Quit]
04:33 -!- JackW [~jack@139.Red-2-142-142.dynamicIP.rima-tde.net] has joined #openvpn
04:47 <@vpnHelper> RSS Update - forum: Free providers? <http://forums.openvpn.net/topic8391.html#p18893>
04:53 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
04:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
04:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
05:19 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Quit: Nettalk6 - www.ntalk.de]
05:22 -!- c1de0x [~c1de0x@208.111.44.254] has joined #openvpn
05:37 < c1de0x> hi all.
05:38 < c1de0x> i'm struggling with a complex config. i have a linux based router. i've got a vpn set up (point to point) with the router box as the vpn client
05:39 < c1de0x> i need to route traffic from a specific box on the subnet served by the router over the vpn.
05:39 < c1de0x> (its a tunnel)
05:41 < hyper_ch> use def1 for that client
05:43 < c1de0x> well. the client is not connected directly to the vpn at all.
05:43 < c1de0x> it is sitting on a subnet.
05:43 < c1de0x> the gateway/router box is the only box which is a client of the vpn.
05:43 < hyper_ch> then make him also a client
05:44 < c1de0x> i want it to FORWARD the traffic from the cleint box through the tunnel
05:44 < c1de0x> (i can't make it a client... i need to do this 'transparent proxy' style)
05:45 < c1de0x> i've set up an iptables rule to mark packets from my client, and then use a fwmark rule to set a default route for that specific host
05:46 < c1de0x> then i've set up masquerading on tun0 (to go from my 10.10.0.0 lan net to the 10.8.0.0 vpn net)
05:46 < c1de0x> (that's on the gateway/router box)
05:46 < c1de0x> and then on the vpn server, i've set up masquerading on eth0 (to go from 10.8.0.0 vpn net to internet)
05:47 < c1de0x> now tcpdump shows that a ping is going all the way through to an internet box.
05:47 < c1de0x> but for some reason the response isn't getting out of the tun0 on the router/gateway box.
05:48 < c1de0x> (i.e. the ping response shows up in the tun0 interface, but not on the eth1 interface)
05:48 < c1de0x> any idea how i can debug this?
05:59 <@vpnHelper> RSS Update - forum: Dear Expert(Need assistance with Openvpn consulting !)Posted <http://forums.openvpn.net/topic9466.html>
06:33 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:55 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:55 -!- TaRkF [~dag43@ns2.gblnet.ru] has joined #openvpn
06:55 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
06:55 < TaRkF> hi
06:56 < TaRkF> I've set up a openvpn (client - server) using a tap device
06:56 < TaRkF> now they can't ping each other
06:57 < TaRkF> client has 10.0.0.2 (tap0) and server 10.0.0.1 (tap1)
06:57 < TaRkF> routes are present
06:57 < TaRkF> 10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tap0
06:57 < TaRkF> any idea what the issue could be?
06:58 < hyper_ch> !welcome
06:58 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:01 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:05 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
07:05 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:07 -!- _zoom_ [~NISSB@196.1.219.122] has joined #openvpn
07:12 -!- _zoom_ [~NISSB@196.1.219.122] has left #openvpn []
07:31 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
07:55 -!- TaRkF [~dag43@ns2.gblnet.ru] has left #openvpn []
08:09 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:12 -!- mirco [~mirco@tmo-097-162.customers.d1-online.com] has joined #openvpn
08:23 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:30 -!- mirco [~mirco@tmo-097-162.customers.d1-online.com] has quit [Ping timeout: 252 seconds]
09:10 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
09:32 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Read error: Connection reset by peer]
09:34 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
09:46 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has joined #openvpn
09:46 < ac3xor> hello everyone.
09:56 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has quit [Quit: Leaving]
10:08 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 252 seconds]
10:10 -!- rix1234 [~rix1234@114.143.161.178] has joined #openvpn
10:13 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
10:13 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
10:13 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
10:16 -!- rix1234 [~rix1234@114.143.161.178] has quit [Quit: Leaving]
10:21 -!- rix1234 [~rix1234@114.143.161.178] has joined #openvpn
10:21 -!- rix1234 [~rix1234@114.143.161.178] has left #openvpn []
10:23 -!- norc [~norc@p15142144.pureserver.info] has joined #openvpn
10:34 < JackW> hoping that someone has a moment to check the following wiki for accuracy, up until section 3 setting up the server (mainly deals with the easy-rsa scripts).  been hard at work and hope i've gotten it right so far: https://wiki.archlinux.org/index.php/OpenVPN
10:34 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
10:43 < hyper_ch> JackW: issue:  !howto
10:43 < hyper_ch> !tutorials
10:43 < JackW> hyper_ch: i am reading them, did you find any grave issues?
10:44 < hyper_ch> JackW: I don't read it
10:44 < hyper_ch> !howto
10:44 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:44 < JackW> ah ok :)
10:44 < hyper_ch> and krzee says that third party howtos usually suck
10:45 < JackW> i hope mine doesn't, but it's customary in arch circles to take pride in the accuracy of our wiki, thus the request for proof reading :)
10:45 < hyper_ch> just link to the openvpn howto :)
10:46 < JackW> that's not the arch way :)
10:46 < JackW> even though it is linked in the first paragraph
10:50 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Ping timeout: 240 seconds]
10:55 <+krzee> why is it using tap
10:57 <+krzee> why do you have so much commented stuff in there, for example you have a learn address script in the config commented out which you never talk about
10:57 <+krzee> just link to the howto like hyper_ch said
10:57 <+krzee> then we wont have to tell people to stop using yours and to use something that will teach them instead
11:00 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Read error: Operation timed out]
11:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
11:09 < JackW> krzee: that original page i started with is of very low quality, haven't done all of it yet.  so far i've only done the first 3 section, up to but not including setting up the server.
11:10 < JackW> so mainly the description of openvpn, some hyper links and the section dealing with using the easy-rsa scripts.  the rest still remains to be done
11:11 < JackW> suppose i'll push on and ask for comments once i've done the entire page.  probably less waste of everyone's time.  thanks for having a look though!
11:13 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
11:14 -!- me345 [~me345@adsl-71-131-129-120.dsl.sntc01.pacbell.net] has joined #openvpn
11:24 <@vpnHelper> RSS Update - forum: Error connecting trought http proxy... <http://forums.openvpn.net/topic9467.html>
11:28 -!- me345 [~me345@adsl-71-131-129-120.dsl.sntc01.pacbell.net] has quit [Read error: Connection reset by peer]
11:30 <@vpnHelper> RSS Update - forum: UDP connection doesn't seem to work <http://forums.openvpn.net/topic9454.html#p18896>
11:44 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
12:06 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit []
12:06 <@vpnHelper> RSS Update - forum: [SOLVED] Error with address length ? <http://forums.openvpn.net/topic9430.html#p18897>
12:31 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has joined #openvpn
12:31 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has quit [Changing host]
12:31 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
12:32 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Client Quit]
12:33 -!- Gravitron [~admin@65.28.68.253] has joined #openvpn
12:33 -!- Gravitron [~admin@65.28.68.253] has quit [Changing host]
12:33 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
12:34 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Client Quit]
12:44 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
12:53 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
13:32 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Ping timeout: 240 seconds]
13:37 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has joined #openvpn
13:45 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
13:47 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Client Quit]
13:55 <@vpnHelper> RSS Update - forum: End to end encryption. <http://forums.openvpn.net/topic9459.html#p18898>
14:04 -!- Gravitron [~admin@65.28.68.253] has joined #openvpn
14:04 -!- Gravitron [~admin@65.28.68.253] has quit [Changing host]
14:04 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
14:08 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
14:22 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 240 seconds]
14:25 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
14:25 <@vpnHelper> RSS Update - forum: OpenVPN 2.2.2 released <http://forums.openvpn.net/topic9446.html#p18899>
14:28 < EugeneKay> JackW - I would advise pointing people at the openvpn howto, but keep the arch-specific stuff, such as the need for a tun/tap module in the kernel if you've custom compiled.
14:29 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 240 seconds]
14:29 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
14:31 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
14:33 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
14:35 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 252 seconds]
14:37 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
14:46 < JackW> EugeneKay: yeah, i'm gonna strip the article and just use a simple example using pki authorization suitable for private or small business use.  just to make it easy for the majority to get up and running.
14:47 < JackW> we kinda pride ourselves on the quality of our wiki, and in the case of openvpn it was in a catastrophic state :(
14:50 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 252 seconds]
14:51 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
14:52 -!- Zimsky [zimsky@rozznet.net] has quit [Ping timeout: 240 seconds]
14:53 -!- Zimsky [~Zimsky@rozznet.net] has joined #openvpn
14:54 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 268 seconds]
15:09 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has joined #openvpn
15:09 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has quit [Changing host]
15:09 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:09 -!- gffa_ is now known as gffa
15:10 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has quit [Quit: Leaving...]
15:25 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:49 -!- mirco [~mirco@tmo-097-76.customers.d1-online.com] has joined #openvpn
15:56 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 252 seconds]
15:58 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
16:08 -!- phantomcircuit [~phantomci@bitcoinica.intersango.com] has quit [Read error: Connection reset by peer]
16:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
16:23 -!- phantomcircuit [~phantomci@50.57.81.35] has joined #openvpn
16:28 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:44 -!- phantomcircuit [~phantomci@50.57.81.35] has left #openvpn ["Leaving"]
17:06 -!- mirco [~mirco@tmo-097-76.customers.d1-online.com] has quit [Quit: mirco]
17:09 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
17:18 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
17:42 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
17:50 -!- ponyofdeath [~vladi@cpe-75-80-175-217.san.res.rr.com] has quit [Ping timeout: 240 seconds]
18:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
18:09 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:49 -!- norc__ [~norc@p15142144.pureserver.info] has joined #openvpn
18:49 -!- norc [~norc@p15142144.pureserver.info] has quit [Read error: Connection reset by peer]
19:01 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Connection reset by peer]
19:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:18 -!- _julian_ [~quassel@hmbg-4d06fe0a.pool.mediaWays.net] has joined #openvpn
19:20 -!- _julian [~quassel@hmbg-5f762745.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
19:43 -!- pwrcycle_ is now known as pwrcycle
19:44 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
19:44 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
19:51 -!- Denial [Denial@drgi.co.uk] has quit []
20:01 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
20:14 -!- ponyofdeath [~vladi@cpe-75-80-175-217.san.res.rr.com] has joined #openvpn
20:23 -!- master_of_master [~master_of@p57B54098.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:24 -!- master_of_master [~master_of@p57B53E3F.dip.t-dialin.net] has joined #openvpn
21:08 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has joined #openvpn
21:08 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has quit [Changing host]
21:08 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
21:17 -!- ponyofdeath [~vladi@cpe-75-80-175-217.san.res.rr.com] has quit [Read error: Operation timed out]
21:20 -!- ponyofdeath [~vladi@cpe-75-80-175-217.san.res.rr.com] has joined #openvpn
21:25 -!- lusis [u2537@gateway/web/irccloud.com/x-riejrsdhgjnksksk] has quit [Remote host closed the connection]
21:25 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-zkbakliodtpdyxqk] has quit [Remote host closed the connection]
21:26 -!- lusis [u2537@gateway/web/irccloud.com/x-mmgemgbvtdumlavg] has joined #openvpn
21:34 -!- Secret [~Secret@78.157.114.78] has joined #openvpn
21:46 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-qzqfuzytiymrpupv] has joined #openvpn
21:53 -!- JackW [~jack@139.Red-2-142-142.dynamicIP.rima-tde.net] has quit [Ping timeout: 252 seconds]
22:44 <@vpnHelper> RSS Update - forum: [win 7 x64 client] Ping required after location is changed <http://forums.openvpn.net/topic8294-30.html#p18900>
22:45 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
22:50 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
23:05 -!- norc__ [~norc@p15142144.pureserver.info] has quit [Ping timeout: 268 seconds]
23:18 -!- norc [~norc@p15142144.pureserver.info] has joined #openvpn
23:18 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has joined #openvpn
23:28 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
23:28 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has quit [Quit: Leaving...]
23:37 -!- c1de0x [~c1de0x@208.111.44.254] has quit [Quit: Coyote finally caught me]
23:38 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has joined #openvpn
--- Day changed Tue Dec 27 2011
00:03 -!- norc [~norc@p15142144.pureserver.info] has quit [Ping timeout: 240 seconds]
01:05 -!- RainFlying [~RainFlyin@114.113.197.131] has joined #openvpn
01:49 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
02:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
02:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
02:07 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
02:25 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18901>
02:28 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
02:31 <@vpnHelper> RSS Update - forum: UDP connection doesn't seem to work <http://forums.openvpn.net/topic9454.html#p18902>
02:43 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18903>
02:47 -!- lusis [u2537@gateway/web/irccloud.com/x-mmgemgbvtdumlavg] has quit [Excess Flood]
02:53 -!- lusis [u2537@gateway/web/irccloud.com/x-wokjlyqjjijogezt] has joined #openvpn
03:08 -!- danielvs [~daniel@gw1.krzn.de] has joined #openvpn
03:09 < danielvs> hi
03:12 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Quit: leaving]
03:13 < danielvs> anybody there?
03:14 < hyper_ch> no
03:15 < danielvs> okay
03:20 -!- danielvs [~daniel@gw1.krzn.de] has left #openvpn []
03:25 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has joined #openvpn
03:32  * EugeneKay tickles hyper_ch 
03:33 < hyper_ch> tickling is mean
03:33 < hyper_ch> there's an international law forbidding the unwanted tickling of hyper_ch under penalty of death
03:33 < EugeneKay> Death is a temporary condition
03:38 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Remote host closed the connection]
03:39 < hyper_ch> EugeneKay: I thought death is a lasting condition
03:39 < EugeneKay> Booze conquers all
03:40 < hyper_ch> EugeneKay: you're russian?
03:40 < EugeneKay> Eugene Evgenevich Kashpureff
03:40 < EugeneKay> Or, "extremely"
03:40 < hyper_ch> :)
03:41 < EugeneKay> Though my actualy heritage is suprisingly mixed. Dad's dad was only quarter-Russian, but you'd never know from the family portraits
03:41 < EugeneKay> Mom's side of the family was stereotypical American mutt, descended from Nordic ancestry mostly
03:47 < hyper_ch> :)
03:52 <@vpnHelper> RSS Update - forum: Error connecting trought http proxy... <http://forums.openvpn.net/topic9467.html#p18904>
03:54 < hyper_ch> so you're part communist and part scandinavian :)
04:04 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18905>
04:08 < EugeneKay> Negatory. Family was pre-revolutionary russkie
04:22 -!- zalzice [~Thomas@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 252 seconds]
04:25 -!- noisebleed [~quassel@lula.inescn.pt] has joined #openvpn
04:25 -!- noisebleed [~quassel@lula.inescn.pt] has quit [Changing host]
04:25 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:59 <@vpnHelper> RSS Update - forum: OpenVPN connection point-to-point <http://forums.openvpn.net/topic9468.html>
05:05 -!- CaBa [caba@unique-inter.net] has joined #openvpn
05:05 < CaBa> hi
05:05 < CaBa> is there any way to disable the 'Need IPv6 code in mroute_extract_addr_from_packet' messages to appear in the server syslog when a windows client connect with v6 enabled on the tun device?
05:05 < CaBa> i don't have control over the clients configuration
05:05 < CaBa> so a server-side solution would be highly appreciated
05:20 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
05:20 -!- mode/#openvpn [+o mattock] by ChanServ
05:35 -!- JackW [~jack@148.Red-95-127-51.staticIP.rima-tde.net] has joined #openvpn
05:41 <@vpnHelper> RSS Update - forum: OpenVPN connection point-to-point <http://forums.openvpn.net/topic9468.html#p18908> || Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18907>
05:44 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
05:49 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 248 seconds]
05:53 <@vpnHelper> RSS Update - forum: Error connecting trought http proxy... <http://forums.openvpn.net/topic9467.html#p18909>
05:59 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
06:00 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:03 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:03 -!- mode/#openvpn [+o mattock] by ChanServ
06:04 -!- Diffen [~diffen@c-a27ce555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: Leaving]
06:04 -!- meepmeep_ is now known as meepmeep
06:11 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 252 seconds]
06:30 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
06:30 -!- mode/#openvpn [+o mattock] by ChanServ
06:32 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
06:35 <@vpnHelper> RSS Update - forum: SSL Offleading <http://forums.openvpn.net/topic7899.html#p18910>
06:44 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
06:45 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:47 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
06:57 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:58 -!- kyrix [~ashley@88-117-66-21.adsl.highway.telekom.at] has joined #openvpn
07:01 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
07:05 -!- poster [~poster@cpe-107-10-147-179.columbus.res.rr.com] has joined #openvpn
07:08 -!- c1de0x [~c1de0x@208.111.44.254] has joined #openvpn
07:08 -!- c1de0x [~c1de0x@208.111.44.254] has quit [Excess Flood]
07:08 -!- poster [~poster@cpe-107-10-147-179.columbus.res.rr.com] has quit [Client Quit]
07:13 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:16 -!- c1de0x [~c1de0x@208.111.44.254] has joined #openvpn
07:18 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
07:35 <@vpnHelper> RSS Update - forum: Bridging without server-brigde mode in config server <http://forums.openvpn.net/topic9469.html>
07:41 <@vpnHelper> RSS Update - forum: Client connected but can't ping inside network <http://forums.openvpn.net/topic9470.html>
07:51 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
07:53 <@vpnHelper> RSS Update - forum: Client connected but can't ping inside network <http://forums.openvpn.net/topic9471.html>
07:59 <@vpnHelper> RSS Update - forum: Client connected but can't ping inside network <http://forums.openvpn.net/topic9470.html#p18914>
08:19 < JackW> anyone know a good link that discusses iptables configuration in the context of using openvpn?
08:48 -!- oc80z [oc80z@blea.ch] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:48 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has joined #openvpn
08:49 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
08:49 -!- kyrix [~ashley@88-117-66-21.adsl.highway.telekom.at] has quit [Quit: Ex-Chat]
09:02 -!- matsim [~matsim@dilatino.soleus.nu] has joined #openvpn
09:21 -!- norc_ [~norc@p15142144.pureserver.info] has joined #openvpn
09:23 -!- caemir [~caemir@unaffiliated/caemir] has quit [Ping timeout: 240 seconds]
09:23 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-30.html#p18915>
09:26 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
09:27 -!- bauruine [~stefan@cust.static.46-14-176-113.swisscomdata.ch] has quit [Ping timeout: 244 seconds]
09:29 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has joined #openvpn
09:29 < ac3xor> any here that can offer me some help?
09:29 <+|Mike|> topic ^^
09:30 < ac3xor> so no?
09:31 <+|Mike|> Topic for #OpenVPN: Welcome to the OpenVPN community support channel || PLEASE read the entire topic 
09:31 < ac3xor> guess ill check back another time.
09:31 <+|Mike|> so please read the whole topic.
09:32 < ac3xor> !welcome
09:32 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:32 < JackW> ac3xor: i might be able to help, since i'm working on setting things up and writing a wiki article
09:32 < JackW> ac3xor: don't expect too much though :)
09:32 < ac3xor> oh man that would rock.
09:33 < ac3xor> i think im having a simple problem i just dont know where to begin to troubleshoot it.
09:33 <+|Mike|> !configs
09:33 <+|Mike|> !logs
09:33 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
09:33 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In Tunnelblick, right-click and select copy to copy log text to clipboard.
09:33 < ac3xor> lemme run to pastebin
09:33 < ac3xor> gimme 1 sec
09:33 < JackW> |Mike|: good idea :)
09:35 <+|Mike|> (that's why I wrote "topic ^^" )
09:36 < ac3xor> How come when i try to use that regex it doesnt work.
09:36 < ac3xor> gives me a >
09:37 <+|Mike|> ````````
09:37 <+|Mike|> you shouldn't copy/paste the ` 's
09:38 < matsim> G'day, i'm questioning about bridge vs. routing mode in the OpenVPN FAQ where it says (sorry for short c&p)...
09:38 < matsim> "you would like to allow browsing of Windows file shares across the VPN without setting up a Samba or WINS server."
09:38 < ac3xor> http://pastebin.com/eF2MpVCq
09:38 < ac3xor> ^ thats the server config
09:39 < matsim> What I'd want to get is a is: client -> vpn-gate -> windows 2k8r2 fileserver
09:39 < ac3xor> http://pastebin.com/6vdmjpkB
09:39 < ac3xor> ^thats the client
09:40 < ac3xor> when i run /etc/init.d/openvpn start it says autostarting.
09:40 < ac3xor> But when i try to ifconfig tun0 it says:
09:41 < ac3xor> device not found
09:42 <+|Mike|> hehe
09:42 <+|Mike|> !tunortap
09:42 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you over
09:42 <@vpnHelper> the vpn or (#4) lan gaming? use tap!
09:43 < ac3xor> So i should be using tap is what your saying?
09:44 < JackW> matsim: do you know the difference between osi l2 (ethernet) l3 (ip) network layers, if not see: http://en.wikipedia.org/wiki/OSI_model  the short answer is that you need to use L2 bridging since ms doesn't use ip for this
09:44 <@vpnHelper> Title: OSI model - Wikipedia, the free encyclopedia (at en.wikipedia.org)
09:45 < ac3xor> oh, thats for the other guy. =/
09:46 < ac3xor> any ideas why my tun device wont show up?
09:48 < JackW> ac3xor: no, that is far from a default config, and i'm still a noob with openvpn.  i'd suggest using the examples server/client configs until you get up to speed
09:49 < matsim> JackW: I do know, but WINS sounded too much like 'dark age of NT' :)
09:49 < JackW> note that i use the tun device, and so far i haven't had to ifconfig it.  where are the log files?
09:50 < JackW> matsim: and sorry, i don't know enough to help you with this, since i'm exclusively unix nowdays
09:50 < matsim> JackW: I'd be too if my users werent ;)
09:52 < JackW> ac3xor: also note that openvpn created the tun device for me, and it is seen by ifconfig.  maybe you ought to start with a simple server/client config based on the example configs too.  also beware of firewalls
10:02 < ac3xor> Well thanks either way.
10:02 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has quit [Quit: Leaving]
10:02 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Remote host closed the connection]
10:22 < JackW> do i need iptable rules for the tun devices when using them with openvpn?
10:23 < hyper_ch> JackW: depends$
10:25 < JackW> hyper_ch: on what?  do you have a good link explaining it?
10:25 < hyper_ch> !welcome
10:25 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:25 < hyper_ch> !goal
10:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:27 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has quit [Remote host closed the connection]
10:28 < JackW> goal is understanding in what cases i would need iptables for openvpn.  is it the case that in the example client/server configuration it's not needed because it's not used?  ifconfig shows the tun device configured with the ip addresses used by the vpn
10:30 < JackW> ifconfig also shows traffic passing through the device
10:31 < JackW> at the moment i have just established a point to point link a ping through it
10:31 < JackW> and ping through it
10:32 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
10:32 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:38 < JackW> ok, i suppose i'd better do it the ubuntu way, set it all up, then remove iptables rules one by one and see what happens :)
10:39 < JackW> maybe i missed some documentation, but i find the subject of firewalls and iptables very thin in the official openvpn documentation
10:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 240 seconds]
10:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:38 -!- me345 [~me345@adsl-75-15-176-192.dsl.bkfd14.sbcglobal.net] has joined #openvpn
11:43 -!- me345 [~me345@adsl-75-15-176-192.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
11:44 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit []
11:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
12:04 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:25 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
12:37 -!- flashuni [~flashuni@adsl-70-136-253-158.dsl.scrm01.sbcglobal.net] has joined #openvpn
12:39 < flashuni> Hey all! I am doing an openvpn server setup and wondering if you need both a diffie-hellman key and a tls-auth key? Is it an either or kind of thing?
12:42 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:43 < hyper_ch> flashuni: create a CA as explained in the howto.. not tls-auth required then
12:44 < hyper_ch> !howto
12:44 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:46 < flashuni> hyper_ch: thanks!
12:46 < hyper_ch> flashuni: if you never worked with a CA, there's a table that shows which key/cert needs to be on what computer :)
12:46 < hyper_ch> good luck
12:52 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has joined #openvpn
12:52 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has quit [Changing host]
12:52 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
12:57 -!- flashuni [~flashuni@adsl-70-136-253-158.dsl.scrm01.sbcglobal.net] has quit [Quit: flashuni]
13:02 -!- Azrael808 [~peter@dandlgreen.demon.co.uk] has joined #openvpn
13:02 -!- Azrael808 [~peter@dandlgreen.demon.co.uk] has quit [Client Quit]
13:12 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455.html#p18916>
13:54 <@vpnHelper> RSS Update - forum: Layer 2 bridging not working <http://forums.openvpn.net/topic9472.html>
13:57 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
14:22 -!- JackW [~jack@148.Red-95-127-51.staticIP.rima-tde.net] has quit [Quit: Konversation terminated!]
14:27 < krzee> hyper_ch, !pki goes right to that section of the howto =]
14:31 -!- JackW [~jack@10.Red-2-140-58.dynamicIP.rima-tde.net] has joined #openvpn
14:46 -!- madsage [c7668431@gateway/web/freenode/ip.199.102.132.49] has joined #openvpn
14:54 <@vpnHelper> RSS Update - forum: Route in VPN subnet <http://forums.openvpn.net/topic9463.html#p18918>
15:02 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
15:10 -!- c1de0x [~c1de0x@208.111.44.254] has quit [Excess Flood]
15:18 -!- pielgrzym [~pielgrzym@31-187-4-194.home.aster.pl] has left #openvpn ["= Hejka / Hi peeps :]"]
15:26 -!- Gravitro_ [~admin@69.163.40.45] has joined #openvpn
15:27 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Ping timeout: 240 seconds]
15:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:38 -!- mode/#openvpn [+v EugeneKay] by ChanServ
16:00 <@vpnHelper> RSS Update - forum: Disconnect problem <http://forums.openvpn.net/topic9452.html#p18919>
16:07 -!- Gravitro_ [~admin@69.163.40.45] has quit [Ping timeout: 240 seconds]
16:25 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Ping timeout: 240 seconds]
16:36 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-30.html#p18920>
16:54 <@vpnHelper> RSS Update - forum: Layer 2 bridging not working <http://forums.openvpn.net/topic9472.html#p18921>
16:55 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
17:00 <@vpnHelper> RSS Update - forum: Accessing office network from home <http://forums.openvpn.net/topic9473.html>
17:06 <@vpnHelper> RSS Update - forum: End to end encryption. <http://forums.openvpn.net/topic9459.html#p18923>
17:18 <@vpnHelper> RSS Update - forum: I can connect to Openvpn but cannot see or Ping the internal <http://forums.openvpn.net/topic9363.html#p18924>
17:24 <@vpnHelper> RSS Update - forum: bridged mode same subnet <http://forums.openvpn.net/topic9474.html>
17:28 -!- Gravitron [~admin@65.28.68.253] has joined #openvpn
17:28 -!- Gravitron [~admin@65.28.68.253] has quit [Changing host]
17:28 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
17:30 <@vpnHelper> RSS Update - forum: Some clients work while others don't with the same conf <http://forums.openvpn.net/topic9464.html#p18926>
17:47 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
18:05 -!- cherwin_ [1776628@xs8.xs4all.nl] has quit [Read error: Operation timed out]
18:09 -!- `Ile` [~kvirc@93-87-120-72.dynamic.isp.telekom.rs] has joined #openvpn
18:09 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
18:10 -!- `Ile` [~kvirc@93-87-120-72.dynamic.isp.telekom.rs] has quit [Client Quit]
18:12 -!- Kateon [482392@xs8.xs4all.nl] has quit [Ping timeout: 255 seconds]
18:22 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
18:25 -!- cherwin [1776628@xs8.xs4all.nl] has joined #openvpn
19:02 -!- Novae [~Novae@unaffiliated/novae] has joined #openvpn
19:03 < Novae> Morning guys, is it possible to specifiy a specific TAP/TUN device rather than the next available on FreeBSD/Linux, such as force a VPN to use tap2 rather than tap0?
19:14 <+EugeneKay> Yes. Specify the adapter number in your --dev
19:16 -!- _julian_ [~quassel@hmbg-4d06fe0a.pool.mediaWays.net] has quit [Read error: Operation timed out]
19:18 -!- _julian [~quassel@hmbg-4d06e5ca.pool.mediaWays.net] has joined #openvpn
19:18 <@vpnHelper> RSS Update - forum: vpn connection works... until tls soft-reset... <http://forums.openvpn.net/topic9475.html>
19:24 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has quit [Quit: Leaving...]
19:24 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has joined #openvpn
19:29 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has quit [Ping timeout: 255 seconds]
19:44 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
19:47 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Client Quit]
20:10 < Novae> EugeneKay: thanks :)
20:24 -!- master_of_master [~master_of@p57B53E3F.dip.t-dialin.net] has quit [Ping timeout: 268 seconds]
20:24 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
20:25 -!- master_of_master [~master_of@p57B53D19.dip.t-dialin.net] has joined #openvpn
20:41 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
20:43 -!- krzie [krzee@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
20:49 <@vpnHelper> RSS Update - forum: OpenVPN connection point-to-point <http://forums.openvpn.net/topic9468.html#p18928>
21:04 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
21:07 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
21:19 -!- JackW [~jack@10.Red-2-140-58.dynamicIP.rima-tde.net] has quit [Ping timeout: 252 seconds]
21:20 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Remote host closed the connection]
21:20 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
21:25 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has joined #openvpn
21:28 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
21:29 -!- mgorbach [~mgorbach@adsl-75-6-130-131.dsl.skt2ca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
21:33 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Quit: Colloquy crashed.]
22:04 -!- skaalid [~skaalid@pdpc/supporter/active/skaalid] has joined #openvpn
22:07 -!- skaalid [~skaalid@pdpc/supporter/active/skaalid] has left #openvpn []
22:28 -!- Denial [Denial@drgi.co.uk] has quit []
23:57 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
23:59 -!- norc_ [~norc@p15142144.pureserver.info] has quit [Read error: Connection reset by peer]
--- Day changed Wed Dec 28 2011
00:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
00:03 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
00:03 -!- norc_ [~norc@p15142144.pureserver.info] has joined #openvpn
00:31 < Novae> so i'm having some troube with routing some traffic over a tunnel, i have a routed tunnel between my two sites that works in that both sites are able to ping the remote end points but if i try to route traffic through the remote endpoint to else where(out on the internet for example) i don't see any traffic on the remote tun device
00:43 < Novae> some network configuration http://pastebin.com/jemy5F9u
01:10 -!- mgorbach [~mgorbach@70-36-196-254.dsl.static.sonic.net] has joined #openvpn
01:41 <@vpnHelper> RSS Update - forum: Please Take me! <http://forums.openvpn.net/topic9476.html>
01:47 <@vpnHelper> RSS Update - forum: A Letter From Satan <http://forums.openvpn.net/topic9478.html> || See and Learn........ <http://forums.openvpn.net/topic9477.html>
01:50 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
01:52 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Remote host closed the connection]
01:54 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
02:03 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
02:06 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Ping timeout: 276 seconds]
02:15 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
02:17 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
02:29 -!- c1de0x [~c1de0x@208.111.44.254] has joined #openvpn
02:32 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Ping timeout: 276 seconds]
02:44 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
02:47 <@vpnHelper> RSS Update - forum: OpenVPN connection point-to-point <http://forums.openvpn.net/topic9468.html#p18932>
02:53 <@vpnHelper> RSS Update - forum: vpn connection works... until tls soft-reset... <http://forums.openvpn.net/topic9475.html#p18934> || Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455-15.html#p18933>
02:59 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html>
03:29 -!- RainFlying [~RainFlyin@114.113.197.131] has quit []
03:46 -!- Novae [~Novae@unaffiliated/novae] has quit [Ping timeout: 240 seconds]
03:53 -!- JackW [~jack@73.Red-95-126-136.staticIP.rima-tde.net] has joined #openvpn
04:06 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18936>
04:08 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
04:11 < JackW> i think i have a firewall problem, nmap on the server interfaces like localhost, the ip of the nic, etc shows the udp port opened, from outside the lan it's shown as closed.  unfortunately i don't have another machine running on the lan that i can connect to where i can easily install an openvpn client config or nmap.  should i get a response from the port if i switch to tcp and telnet to it?
04:28 -!- Novae [~Novae@unaffiliated/novae] has joined #openvpn
04:29 < Novae> damn it, my client seg faulted :( did anyone happen to mention a remedy to my problem? :P
04:49 < JackW> i'll repeat in desperation :)  if i run openvpn in server configuration using a tcp port, should "telnet host port" show some kind of banner?
04:50 < JackW> hmm, suppose i can try on localhost myself. why is that an idea always comes 2 secs after asking for help :)
04:55 < JackW> ok, it must be my nat router or provider
05:06 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18937>
05:19 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
05:21 -!- noisebleed [~quassel@piggy.inescn.pt] has joined #openvpn
05:21 -!- noisebleed [~quassel@piggy.inescn.pt] has quit [Changing host]
05:21 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
05:23 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:24 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Read error: Connection reset by peer]
05:27 < JackW> ah solved, must have been either firefox through socks that lied, or the fritzbox that lied about actually having created a forward.  think i've spent 4 hours or something like that for nothing :(
05:41 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
05:42 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-30.html#p18938>
05:46 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:07 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18939>
06:39 < Novae> solved!, kind of any way it related to the use of iroute. I have anothr question now though, can i set up a general iroute directive say 0.0.0.0/0 so that i can just use the hosts routing table to dictate what traffic should travel down the VPN.
06:48 < Novae> this would allow me to change in realtime the traffic going over the VPN without having to restart the tunnel.
07:06 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
07:08 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
07:08 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has joined #openvpn
07:14 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
07:20 < hyper_ch> krzee: http://gizmodo.com/5871531/the-eye-of-satan-is-watching-you-from-space
07:20 <@vpnHelper> Title: The Eye of Satan Is Watching You From Space (at gizmodo.com)
07:20 < hyper_ch> krphop_: howdy
07:32 -!- Denial [~Denial@drgi.co.uk] has joined #openvpn
08:34 <+_quadDamage> is anyone using Tunnelblick for ovpn that has noticed their connection renegotiating frequently, since upgrading tunnelblick to 3.2?
08:35 -!- JoeyJoeJo [~brian@pool-173-71-223-79.clppva.fios.verizon.net] has joined #openvpn
08:36 < JoeyJoeJo> I just setup openvpn on my ddwrt router. My client is on a 50/50 internet connection and the server is 25/25 but I can only transfer files via Samba at about 300kb/s. Is this normal?
08:42 < hyper_ch> JoeyJoeJo: issue !welcome
08:42 < JoeyJoeJo> !welcome
08:42 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:57 -!- matse_ [~matse@139.11.42.26] has joined #openvpn
08:58 < matse_> is it possible to use 2 vpn connections at a time? I go online via a vpn connection (university network) and want to use another vpn connection from another country to access youtube content, but if i connect to the second one i get "/usr/sbin/ip route add... RTNETLINK answers: File exists"
09:00 -!- matse_ is now known as matse
09:00 -!- matse [~matse@139.11.42.26] has quit [Changing host]
09:00 -!- matse [~matse@fsf/member/matse] has joined #openvpn
09:01 -!- khussein78 [~khussein7@31.154.81.85] has joined #openvpn
09:06 < hyper_ch>  a
09:06 < hyper_ch> matse: both openvpn?
09:06 < matse> hyper_ch: yes
09:06 < hyper_ch> you're on linux?
09:06 < matse> hyper_ch: yes
09:06 < hyper_ch> matse: you have an init script to start openvpn?
09:07 < matse> hyper_ch: i start my first connection (university network) by script, the second by hand
09:07 < matse> hyper_ch: so just calling "openvpn *.conf" is what the script does
09:07 < hyper_ch> on ubuntu, if have an init script that just runs all *conf files in /etc/openvpn
09:08 < hyper_ch> so I have two client configs in there
09:08 < hyper_ch> and a common.inc
09:08 < hyper_ch> I'll pastebin it
09:08 < matse> hyper_ch: exactly, but i guess i can only have one gateway
09:08 < matse> the connection to the second vpn server establishes but it wants to change my gateway and this is what fails
09:10 < hyper_ch> matse: http://pastebin.com/tCkwpgxB
09:10 < hyper_ch> matse: you have to set according routes
09:10 < matse> hyper_ch: yes, that's my problem, i don't know hot wo do this...
09:10 < hyper_ch> you run one of the servers?
09:10 < matse> hyper_ch: no
09:11 < hyper_ch> there's a config option that disallows server pushed routes I think
09:11 < hyper_ch> !disallow
09:11 < hyper_ch> that's not it
09:11 < reiffert> matse: yeah, thats possible, but all networks involved have to be different subnets.
09:12 < matse> reiffert: i guess that's the case, two completely different servers, i gues i have to change the config of my second vpn then?
09:12 < reiffert> matse: which is what openvpn claims is not the case when having a look at your error messge.
09:12 < hyper_ch> matse: you're lucky... the openvpn-expert reiffert takes over now :)
09:13 < reiffert> matse: that is:
09:13 < reiffert> University Network A
09:13 < reiffert> VPN Network to University B
09:13 < reiffert> Your Home Network C
09:13 < reiffert> Youtube Network D
09:13 < reiffert> VPN Network to Youtube E
09:13 < reiffert> all of them have to be different networks.
09:14 < reiffert> none of their routes must conflict.
09:14 < madsage> morning
09:14 < matse> reiffert: oh i see, but i guess they shouldn't conflict, should they?
09:14 -!- khussein78 [~khussein7@31.154.81.85] has quit [Ping timeout: 255 seconds]
09:14 < matse> i mean they have all unique ips, but really i'm no expert...
09:15 < reiffert> matse: yeah, having them conflict is exactly what you need.
09:15 < reiffert> next.
09:15 < matse> reiffert: so what shall i do?
09:15 < reiffert> ask hyper_ch what to do.
09:15 < matse> hyper_ch: any help? :D
09:16 < hyper_ch> reiffert: you're the expert
09:16 < matse> i want following route: myPC -> UniversityVPN-Server -> "youbube"VPN-Server -> Internet
09:18 < hyper_ch> I don't think you can do that yourself
09:19 < matse> hyper_ch: damn...
09:21 < JackW> matse: can you ping all the vpn "servers"? if you could get a proxy/socks server on network D, then you could use that for the other country youtube
09:22 < JackW> maybe you could get a ssh login on network D, and use that to create a socks proxy?
09:22 < JackW> but sorry i am still a bit new to this and have to run now...
09:28 -!- JackW [~jack@73.Red-95-126-136.staticIP.rima-tde.net] has quit [Ping timeout: 240 seconds]
09:42 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
09:52 -!- jdpond [~Jack_D._P@mediawiki/jpond] has joined #openvpn
09:53 < jdpond> !welcome
09:53 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:53 < jdpond> !howto
09:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:54 < jdpond> !goal
09:54 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:57 <@vpnHelper> RSS Update - forum: OpenVPN Setup help (HIRE) <http://forums.openvpn.net/topic9480.html>
10:13 -!- mgorbach [~mgorbach@70-36-196-254.dsl.static.sonic.net] has quit [Quit: Leaving...]
10:27 -!- JackW [~jack@248.Red-2-142-142.dynamicIP.rima-tde.net] has joined #openvpn
10:34 < jdpond> Internet<-->Firewall<-->eth0(10.x.0.0)<-->OpenVPN Sever<-->eth1(10.y.0.0)<-->Internal Lan(s).  Is it better to us tunneling or a bridged interface?  In setting this up, is the local interface eth0 or eth1.  I'm also assuming this is a routed configuration?
10:35 < CaBa> is there any way to disable the 'Need IPv6 code in mroute_extract_addr_from_packet' messages to appear in the server syslog when a windows client connect with v6 enabled on the tun device?
10:35 < CaBa> (except to disable v6 in the client)
10:36 <+EugeneKay> Disable v6 on the client.
10:36 <+EugeneKay> Or try one of the snapshot 2.3 pre-releases which has said IPv6 code
10:37 < CaBa> yeah, i'll tell all the users "hey, please disable v6 so that my logfile is not spammed"
10:38 -!- matse [~matse@fsf/member/matse] has quit [Ping timeout: 252 seconds]
10:40 <+EugeneKay> If you don't like the advice given and the product, you are entitled to a full refund.
10:40 < hyper_ch> EugeneKay: where can I file for refund?
10:41 <+EugeneKay> Or, ignore the spurious log entries and move on with your life.
10:41 <+EugeneKay> hyper_ch - take it up with your credit card company
10:41 < hyper_ch> awwww :(
10:43 < JackW> EugeneKay: suppose a cron script and some sed magic could do the trick :)
10:43 <+EugeneKay> I'm sure.
10:44 < JackW> or a line or 2 in the source
10:44 <+EugeneKay> It smacks of debug code which snuck into production
10:47 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
10:48 < JackW> i can't comment on that, but if it's a problem just solve it :)
10:49 < JackW> actually that was meant for hyper_ch :)
10:49 < hyper_ch> which comment?
10:50 < JackW> hyper_ch: to solve it if it's annoying and then just move on. 
10:51 < hyper_ch> JackW: what problem?
10:52 < CaBa> that originated from me, not from hyper_ch ;) and anyway, i doubt a patch that removes that output would be accepted, otherwise why did it make it into the release :P
10:52 < JackW> beh, sorry wasn't meant for you either :(  was meant for Caba...  sorry for the noise
10:52 < hyper_ch> :)
10:52 < JackW> saw the comment about the refund :)
10:53 < CaBa> apart from that it might not even be in there by now, i'm on 2.1.0rc11 (debian lenny)
10:53 < hyper_ch> I like refunds
10:53 < CaBa> hrhr
10:53 < hyper_ch> I think paying for something and then getting a refund is better
10:53 < hyper_ch> than paying for it and not getting a refund
10:54 < JackW> best would be not paying for something and getting a refund :)
10:55 < hyper_ch> :)
10:55 <+EugeneKay> Sounds like gubamint talk to me.
10:57 < JackW> i came to the conclusion that the best a debian (or derrived) user can do, is to learn how to create their own packages from source.  otherwise it seems like one goes from one problem to another, at least with stable (stale) versions
10:59 < JackW> have my wiki done and my openvpn setup (example server/client config) to the point that the connection is established and can ping both ways.  now onto making it actually do something useful :)
11:07 <@vpnHelper> RSS Update - forum: [SOLVED] how to start openvpn without sudo <http://forums.openvpn.net/topic9404.html#p18769> || Routing: Configuring for accessing subnet clients +iptables <http://forums.openvpn.net/topic9432.html#p18763> || Packets enter but never exit <http://forums.openvpn.net/topic9444.html#p18761> || TLS key negotiation failed to occur within <http://forums.openvpn.net/topic9436.html#p18758>
11:13 <@vpnHelper> RSS Update - forum: Error connecting trought http proxy... <http://forums.openvpn.net/topic9467.html#p18942> || Client connected but can't ping inside network <http://forums.openvpn.net/topic9471.html#p18941>
11:15 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit []
11:19 <@vpnHelper> RSS Update - forum: Accessing office network from home <http://forums.openvpn.net/topic9473.html#p18943> || [resolved] Route in VPN subnet <http://forums.openvpn.net/topic9463.html#p18918>
11:29 < JackW> something not clear to me in the documentation is:  after following the howto and setting up a basic server/client connection to the point that the client can ping the ip address of the servers tun interface and vice versa, should the client be able to use services on the host machine using the tun ip address?
11:32 < JackW> the tun device of the server is allowed in the iptables input chain on the server, but even disabling iptables on the server doesn't help, so don't think it's a firewall issue
11:33 < JackW> suppose the services aren't bound to the tun device on the server
11:37 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Ping timeout: 255 seconds]
11:43 <@vpnHelper> RSS Update - forum: Accessing office network from home <http://forums.openvpn.net/topic9473.html#p18944>
11:49 <@vpnHelper> RSS Update - forum: Accessing office network from home <http://forums.openvpn.net/topic9473.html#p18945>
11:55 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455-15.html#p18946>
11:59 < JackW> does vpn have a facility to publish routes to private vpn ip nets to my lan router, or is that something that i have to configure statically on the lan router itself?
12:00 -!- mocas [~mocas@87.196.121.23] has joined #openvpn
12:00 < mocas> hi
12:00 < mocas> how can i config my server to only accept connections from one mac address?
12:24 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
13:02 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18947>
13:03 < hyper_ch> mac addresses can be faked
13:05 < hyper_ch> dazo_afk: reiffert: krzee: EugeneKay: bauruine: https://secure.dslreports.com/shownews/Security-Flaw-Found-in-WiFi-Protected-Setup-WPS-117597
13:05 <@vpnHelper> Title: Security Flaw Found in Wi-Fi Protected Setup (WPS) - Allowing Brute Force Hack of PIN in Roughly Two Hours | DSLReports.com, ISP Information (at secure.dslreports.com)
13:08 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18948>
13:32 -!- zxy_ [~zxy@95.80.44.240] has joined #openvpn
13:34 < zxy_> Hi, I would like remote clients to access internal network, not just the server, the server runs sbs2008, can openvpn forward and route traffic or do I have to do it with sbs?
13:40 < bigpaws> !bridge
13:40 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man)
13:45 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
13:48 -!- Onewhohelp [~Onewhohel@unaffiliated/onewhohelps] has joined #openvpn
13:51 -!- Onewhohelp [~Onewhohel@unaffiliated/onewhohelps] has quit [Quit: ChatZilla 0.9.88 [Firefox 7.0.1/20110928134238]]
14:14 <@vpnHelper> RSS Update - forum: How to use DDNS ervice <http://forums.openvpn.net/topic9481.html>
14:16 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
14:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
14:38 <@vpnHelper> RSS Update - forum: Accessing office network from home <http://forums.openvpn.net/topic9473.html#p18950>
14:45 < madsage> jeev is a terrorist
14:45 < madsage> haha
14:45 < madsage> jeev wake up, you are being insulted
14:46 < hyper_ch> madsage: there's roughly 7bn potential terrorists out there on this rock alone.... not counting all the other rocks in the known/unkonwn universe / other universes / parallel dimensions
14:46 < madsage> hyper, jeev is an old friend of mine. just razzing him. i meant nothing 
14:47 < madsage> but i agree, terrorism is perspective
14:47 < madsage> and cowardly
14:47 < hyper_ch> there's 7bn terrorists out there just waiting to blow you up :)
14:47 < madsage> i know man, its crazy
14:48 < hyper_ch> :)
14:48 < JackW> not to mentions that there are 7bn potential users too :)
14:50 < madsage> terrorists everywhere
14:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
14:51 < hyper_ch> I bet they even hide under your bed
14:51 < madsage> nope, i check it every night. 
14:52 < hyper_ch> and the closet?
14:52 < hyper_ch> behind the door?
14:53 < madsage> i have a terrorist sniffing dog
14:53 < madsage> he guards the house
14:54 < madsage> heh, ok i better quite before i offend somebody
14:54 < madsage> dammit jeev, where are you
14:54 < madsage> quite/quit
14:57 -!- `Ile` [~kvirc@109-93-224-98.dynamic.isp.telekom.rs] has joined #openvpn
14:58 < JackW> apart from from adding a static route to the server side lan router, enabling ipv4 forwarding in the kernel and setting the lan interface into promiscous mode, adding an accept rule for the tun device on the firewall pushing the route to the client, what could potentially cause a server to be unable to communicate with the server's lan?
14:58 < JackW> cause a client to be unable
15:00 -!- smerz [~smerz@smerz.demon.nl] has joined #openvpn
15:05 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
15:07 -!- `Ile` [~kvirc@109-93-224-98.dynamic.isp.telekom.rs] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
15:08 < JackW> in the following line from the faq, what does it's internal address refer too?  the ip of the lan interface? If you are using routing rather than ethernet bridging mode and would like connecting clients to see the whole LAN rather than only the server machine itself, you need to add an internal LAN route to the LAN gateway so that the private OpenVPN subnet (declared in theserver, ifconfig, or ifconfig-pool directives) is routed to 
15:08 < JackW> the OpenVPN server machine (i.e. its internal address).
15:10 < JackW> i suppose so, but find the meaning more than ambigous
15:11 < JackW> or maybe it's time to break out wireshark or similar :)
15:14 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html>
15:39 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Quit: Nettalk6 - www.ntalk.de]
15:41 -!- zxy_ [~zxy@95.80.44.240] has quit [Quit: Lost terminal]
15:56 -!- Gravitron [~admin@cpe-76-92-159-145.kc.res.rr.com] has joined #openvpn
15:56 -!- Gravitron [~admin@cpe-76-92-159-145.kc.res.rr.com] has quit [Changing host]
15:56 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:57 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has joined #openvpn
16:08 -!- _slax0r_ [~fire@93-103-130-148.static.t-2.net] has quit [Quit: Nettalk6 - www.ntalk.de]
16:15 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
16:17 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
16:20 <@vpnHelper> RSS Update - forum: Subnet Conflicts <http://forums.openvpn.net/topic9483.html>
16:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:38 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
16:39 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Client Quit]
16:40 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
16:41 -!- iDiytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
16:44 -!- iDiytto is now known as diytto
16:45 -!- diytto is now known as iDiytto
17:01 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 252 seconds]
17:07 -!- iDiytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Quit: Colloquy crashed.]
17:08 -!- iDiytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
17:10 -!- iDiytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Client Quit]
17:14 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 268 seconds]
17:16 -!- EugeneKay [eugene@hosted.by.khresear.ch] has joined #openvpn
17:23 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
17:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:47 -!- EugeneKay [eugene@hosted.by.khresear.ch] has quit [Quit: ZNC - http://znc.in]
17:48 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
17:50 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
17:52 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
17:53 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:58 -!- does [~sick@a85-138-4-150.cpe.netcabo.pt] has joined #openvpn
17:59 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
18:00 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:08 <@vpnHelper> RSS Update - forum: OpenVPN App for Bada! <http://forums.openvpn.net/topic9484.html>
18:32 <@vpnHelper> RSS Update - forum: Ubuntu 11.10 TUN help <http://forums.openvpn.net/topic9485.html>
18:38 <@vpnHelper> RSS Update - forum: OpenVPN App for Bada! <http://forums.openvpn.net/topic9484.html#p18955>
18:40 -!- kalken [~default@c83-248-128-69.bredband.comhem.se] has joined #openvpn
18:41 < kalken> hello! A short question (i cant find any info on the internet). Is it possible to add routes for a tap-interface to a special table instead of main-routing table (as done default). Im running linux
18:41 < kalken> tap is configured via dhcp
18:41 < kalken> and i want to add policy based routing when its configured
18:50 < krzee> sure, add them with a script instead of the normal way
18:50 < krzee> !script
18:50 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
18:51 < kalken> krzee: so maybe thats an answer then? i need to make my own scripts to be able to add a route to another table than main?
18:51 < krzee> thats what i would do, i dont believe --route supports it inside openvpn
18:51 < krzee> but the script interface lets you do most things
18:53 < kalken> yes i can see i get variables to --up so its probably ok
18:53 < krzee> make an up script run the env command to see them all
18:53 < krzee> you'll see them in your logs
18:55 < kalken> ah great tip!
18:55 < kalken> tnx
18:55 < krzee> np
18:55 < kalken> i have the template for my rules already in main so its basically just pattern-matching from there :D
18:55 < krzee> =]
18:55 < kalken> main routing table thatis :D
19:00 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
19:10 -!- Gravitron [~admin@76.92.159.145] has joined #openvpn
19:10 -!- Gravitron [~admin@76.92.159.145] has quit [Changing host]
19:10 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
19:17 -!- _julian_ [~quassel@hmbg-5f77ed6b.pool.mediaWays.net] has joined #openvpn
19:18 -!- _julian [~quassel@hmbg-4d06e5ca.pool.mediaWays.net] has quit [Ping timeout: 240 seconds]
19:20 -!- norc_ [~norc@p15142144.pureserver.info] has left #openvpn []
19:30 -!- Denial [~Denial@drgi.co.uk] has quit []
19:34 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 252 seconds]
19:44 -!- Abutec [~Circuit@c-76-97-40-105.hsd1.ga.comcast.net] has joined #openvpn
19:45 < Abutec> !welcome
19:45 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:46 < Abutec> Anyone got a sec to tell me if this will work?
19:47 < Abutec> !goal
19:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:48 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
19:48 < Abutec> "goal" Access a remote network thru a server
19:49 -!- Abutec [~Circuit@c-76-97-40-105.hsd1.ga.comcast.net] has quit []
19:50 -!- does [~sick@a85-138-4-150.cpe.netcabo.pt] has quit [Ping timeout: 240 seconds]
19:53 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
19:54 -!- does [~sick@a85-138-4-150.cpe.netcabo.pt] has joined #openvpn
19:54 <+TJNII> !ask
19:55 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
20:04 < JackW> can i use CIDR notation in the config files?
20:04 < krzee> !man
20:04 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
20:04 < krzee> JackW, check the manual
20:06 < JackW> krzee: i can't find any mention of it, but was hoping the man page was out of date.  but ok i'll google those too
20:07 < JackW> or rather i'll google the online documentation
20:09 -!- does [~sick@a85-138-4-150.cpe.netcabo.pt] has quit [Ping timeout: 252 seconds]
20:13 < JackW> beh, i only find one mention from 2004 (for 2.0-test27) in the 2.2 changelog that --iroute supports it, still doesn't really answer my question.  maybe better avoid it then..
20:13 < krzee> heh
20:14 < krzee> you could always try it too
20:14 < krzee> but ya, ild avoid it
20:16 -!- does [~sick@a85-138-4-150.cpe.netcabo.pt] has joined #openvpn
20:17 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
20:18 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
20:18 < JackW> too bad, that would have been convinient :)
20:22 -!- master_of_master [~master_of@p57B53D19.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
20:24 -!- master_of_master [~master_of@p57B5558A.dip.t-dialin.net] has joined #openvpn
20:34 -!- smerz [~smerz@smerz.demon.nl] has quit [Remote host closed the connection]
20:46 -!- does [~sick@a85-138-4-150.cpe.netcabo.pt] has quit []
20:46 -!- kalken [~default@c83-248-128-69.bredband.comhem.se] has left #openvpn ["WeeChat 0.3.5"]
21:32 -!- Gravitron [~admin@76.92.159.145] has joined #openvpn
21:32 -!- Gravitron [~admin@76.92.159.145] has quit [Changing host]
21:32 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
21:42 -!- jpms [~hurin@201.197.12.206] has joined #openvpn
21:57 <@vpnHelper> RSS Update - forum: lan server can't connect to client or lan client <http://forums.openvpn.net/topic9486.html>
22:03 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
22:04 -!- Gravitron [~admin@cpe-76-92-159-145.kc.res.rr.com] has joined #openvpn
22:04 -!- Gravitron [~admin@cpe-76-92-159-145.kc.res.rr.com] has quit [Changing host]
22:04 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
22:13 < jpms> hey all, if I    ./build-server-key --server  vpnservername, then I will create a certificate destined to be used by a vpn server right? how can I build a client certificate? I am also using ./build-server-pass, but I am not sure. Which nsCertType builds by default?
22:14 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
22:14 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18957>
22:29 -!- NormanYMineta [~User@69.46.69.194] has joined #openvpn
22:31 -!- JackW [~jack@248.Red-2-142-142.dynamicIP.rima-tde.net] has quit [Ping timeout: 252 seconds]
22:32 < NormanYMineta> Has someone a moment for a stupid newbie?
22:32 <@vpnHelper> RSS Update - forum: openvpn -GUI (tap driver 32/64 and enable-passwd-save) <http://forums.openvpn.net/topic9487.html>
22:48 -!- jpms [~hurin@201.197.12.206] has left #openvpn []
23:15 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18959>
23:15 -!- NormanYMineta [~User@69.46.69.194] has quit []
23:27 <@vpnHelper> RSS Update - forum: [Resolved] Log volume of traffic tunneled by a user <http://forums.openvpn.net/topic9392.html#p18960>
23:30 -!- fittriaziz [fit@183.78.40.223] has joined #openvpn
23:30 < fittriaziz> !welcome
23:31 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:31 < fittriaziz> !goal
23:31 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:31 < fittriaziz> !howto
23:31 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:33 < fittriaziz> !goal creating vpn connection over udp 53
23:33 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18961>
23:36 < fittriaziz> can i get help here?
23:38 -!- cron2 [~gert@openvpn/community/developer/cron2] has quit [Ping timeout: 255 seconds]
23:39 -!- cron2 [~gert@kirk.greenie.muc.de] has joined #openvpn
23:40 -!- mgorbach [~mgorbach@96.241.54.213] has joined #openvpn
--- Day changed Thu Dec 29 2011
00:15 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit [Ping timeout: 252 seconds]
00:16 -!- gko [~gko@220-135-201-90.HINET-IP.hinet.net] has joined #openvpn
00:19 <@vpnHelper> RSS Update - forum: [resolved] Accessing office network from home <http://forums.openvpn.net/topic9473.html#p18950>
00:20 -!- gko [~gko@220-135-201-90.HINET-IP.hinet.net] has quit [Ping timeout: 252 seconds]
00:21 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
00:25 <@vpnHelper> RSS Update - forum: How to use DDNS ervice <http://forums.openvpn.net/topic9481.html#p18964> || lan server can't connect to client or lan client <http://forums.openvpn.net/topic9486.html#p18963> || Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p18962>
00:31 <@vpnHelper> RSS Update - forum: Ubuntu 11.10 TUN help <http://forums.openvpn.net/topic9485.html#p18966> || Subnet Conflicts <http://forums.openvpn.net/topic9483.html#p18965>
00:34 < mgorbach> Anyone around able to help with VPN performance?
01:16 -!- _slax0r_ [~fire@cpe-92-37-58-220.dynamic.amis.net] has joined #openvpn
01:21 -!- _slax0r_ [~fire@cpe-92-37-58-220.dynamic.amis.net] has quit [Ping timeout: 276 seconds]
01:25 <@vpnHelper> RSS Update - forum: Client-Server recipe from JanJust book TLS Failure <http://forums.openvpn.net/topic9488.html>
01:28 -!- mgorbach [~mgorbach@96.241.54.213] has quit [Ping timeout: 240 seconds]
01:52 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
01:55 <@vpnHelper> RSS Update - forum: [ask] server behind router <http://forums.openvpn.net/topic9489.html> || UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18968>
01:55 -!- mgorbach [~mgorbach@96.241.54.213] has joined #openvpn
02:07 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18970>
02:13 <@vpnHelper> RSS Update - forum: [ask] server behind router <http://forums.openvpn.net/topic9489.html#p18972> || UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18971>
02:16 -!- Beave [~champ@bundy.vistech.net] has quit [Read error: Operation timed out]
02:19 -!- Beave [~champ@bundy.vistech.net] has joined #openvpn
02:19 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18973>
02:31 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18974>
02:44 -!- mgorbach [~mgorbach@96.241.54.213] has quit [Quit: Leaving...]
02:45 -!- Netsplit *.net <-> *.split quits: cali, pwrcycle, APTX, +dioz, +rkantos, +|Mike|, +WebDawg, DarthGandalf, +Haraken, +Cr4zi3,  (+1 more, use /NETSPLIT to show all of them)
02:49 -!- Netsplit over, joins: pwrcycle, DarthGandalf, APTX, jeev, cali, +|Mike|, +Cr4zi3, +WebDawg, +Haraken, +dioz (+1 more)
02:53 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has joined #openvpn
02:53 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
02:54 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has quit [Read error: Connection reset by peer]
02:55 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has joined #openvpn
03:00 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has quit [Client Quit]
03:05 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has joined #openvpn
03:06 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has quit [Read error: Connection reset by peer]
03:10 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18975>
03:22 <@vpnHelper> RSS Update - forum: Put ta.key in Windows crypto store? <http://forums.openvpn.net/topic9458.html#p18976>
03:31 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has joined #openvpn
03:46 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p18977>
04:03 -!- JackW [~jack@80.27.165.250] has joined #openvpn
04:16 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18978>
04:18 -!- fittriaziz [fit@183.78.40.223] has quit []
04:24 -!- starcraftcats [~newegggg@61.170.211.238] has joined #openvpn
04:24 < starcraftcats> hi
04:25 < starcraftcats> to stop all non vpn traffic do i just need to make windows firewall only allow outbound traffic to 1194?
04:32 -!- starcraftcats [~newegggg@61.170.211.238] has quit [Ping timeout: 255 seconds]
04:44 -!- starcraftcats [~newegggg@208.111.39.186] has joined #openvpn
04:45 -!- rasyid7 [~3333@69.163.36.67] has joined #openvpn
04:45 <@vpnHelper> RSS Update - forum: [ask] server behind router <http://forums.openvpn.net/topic9489.html#p18979>
04:48 -!- starcraftcats [~newegggg@208.111.39.186] has quit [Ping timeout: 255 seconds]
04:52 -!- JackW [~jack@80.27.165.250] has quit [Remote host closed the connection]
04:53 -!- JackW [~jack@80.27.165.250] has joined #openvpn
05:01 -!- starcraftcats [~newegggg@208.111.39.186] has joined #openvpn
05:09 -!- cron2 [~gert@kirk.greenie.muc.de] has quit [Changing host]
05:09 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
05:12 -!- jdpond [~Jack_D._P@mediawiki/jpond] has left #openvpn []
05:15 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has quit [Ping timeout: 252 seconds]
05:16 <@vpnHelper> RSS Update - forum: [ask] server behind router <http://forums.openvpn.net/topic9489.html#p18981> || UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18980>
05:18 < JackW> is there any reason like interoperability between differing openvpn versions or vpn implementations, or maybe performance issues on older hardware, that would make using a higer dh parameters value, tlsauth, longer rsa or symetric keys a potential problem?
05:18 < JackW> or maybe better said, is there a good reason not to use them?
05:19 -!- starcraftcats [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
05:20 -!- starcraftcats [~newegggg@208.111.39.186] has joined #openvpn
05:22 -!- JackW [~jack@80.27.165.250] has quit [Remote host closed the connection]
05:22 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p18984> || Ubuntu 11.10 TUN help <http://forums.openvpn.net/topic9485.html#p18983>
05:22 -!- JackW [~jack@80.27.165.250] has joined #openvpn
05:24 < starcraftcats> how does openvpn decide what porn to use on the client?
05:24 < starcraftcats> can i force the openvpn server to always use a specific port on the client instead of random
05:24 < starcraftcats> port* lol
05:24 < JackW> beh, it seems my crappy connection caused me to get dropped from the irc server...:(  i'll repeat my question
05:24 < JackW> is there any reason like interoperability between differing openvpn versions or vpn implementations, or maybe performance issues on older hardware, that would make using a higer dh parameters value, tlsauth, longer rsa or symetric keys a potential problem?
05:24 < JackW> or maybe better said, is there a good reason not to use them?
05:25 -!- Algo2 [~na@206.246.157.118] has joined #openvpn
05:26 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Remote host closed the connection]
05:26 < Algo2> !welcome
05:26 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:26 < Algo2> !howto
05:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:26 < Algo2> !route
05:26 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
05:26 < Algo2> !sample
05:26 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
05:27 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
05:27 < Algo2> !howto for beginners
05:27 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p18986> || lan server can't connect to client or lan client <http://forums.openvpn.net/topic9486.html#p18985>
05:27 < JackW> starcraftcats: see the port directive in server.conf
05:28 < JackW> that is the only way to specify ports (afaik)
05:29 < starcraftcats> that just specifies what port openvpn should listen to on the server side
05:29 < starcraftcats> i mean make it so it so the client laptop uses only one port to connect to it
05:30 < JackW> iirc most ip protocols work in this manner
05:31 < JackW> maybe ask in #netfilter, you will probably get a more exhaustive answer in that channel
05:31 < starcraftcats> ok
05:31 < starcraftcats> thx
05:32 < starcraftcats> just seemed strange that a vpn only has 2 endpoints in a simple setup, but on the client end i need every port open as it'll just select a random one
05:32 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479.html#p18988> || Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p18987>
05:33 < JackW> i don't know what's up with my irc connection at the moment, i hope my query about hardening the security go through.  i'll idle a few hours before repeating :)
05:36 -!- JackW [~jack@80.27.165.250] has quit [Remote host closed the connection]
05:36 -!- starcraftcats [~newegggg@208.111.39.186] has quit [Ping timeout: 255 seconds]
05:36 -!- JackW [~jack@80.27.165.250] has joined #openvpn
05:36 -!- pranq [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
05:36 -!- starcraftcats [~newegggg@208.111.39.186] has joined #openvpn
05:37 < Algo2> Can someone send me a sample opvn client config file?  I'm behind a firewall that's blocking every page your bot lists (plus everything I've searched for online).  I already have a vpn host and openvpn on a flash drive, thought that would be enough
05:38 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p18990> || UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479-15.html#p18989>
05:49 -!- chaot_s [~home-fron@d54C408EC.access.telenet.be] has joined #openvpn
05:51 < chaot_s> hi all, i would like to know why openvpn starts and works when i start in on ssh shell with : openvpn /path/config.conf though when i use service openvpn start i get failed and nothing happens except an error in de vpn log file.
05:52 < chaot_s> the error i get when started with service: Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: script-security (2.0.9)
05:53 -!- Algo2 [~na@206.246.157.118] has left #openvpn []
05:54 < chaot_s> acording to yum info i'm running 2.1.4
06:02 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
06:02 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p18991>
06:09 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p18992>
06:15 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479-15.html#p18994>
06:20 < chaot_s> anyone?
06:20 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479-15.html#p18995>
06:25 -!- rasyid7 [~3333@69.163.36.67] has quit [Ping timeout: 252 seconds]
06:26 <@vpnHelper> RSS Update - forum: Problem connecting Windows 7 to OpenVPN <http://forums.openvpn.net/topic9333.html#p18996>
06:30 -!- Muad`Dib [~shadok@ran75-2-78-192-139-52.fbxo.proxad.net] has joined #openvpn
06:31 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479-15.html#p18997>
06:40 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:45 < JackW> think my irc connection problem is a thing of the past, was claws-mail going crazy using the entire vpn connection and making the wan connection drop irc packets :(  I'll repeat my security query once more, sorry for any inconvinience!
06:46 < JackW> is there a good/any reason like interoperability between differing openvpn versions or vpn implementations, or maybe performance issues on older hardware, that would make using a higer dh parameters value, tlsauth, longer rsa or symetric keys a potential problem?
06:50 < EugeneKay> The TLS stuff is all fairly stable. Openssl doesn't change much
06:52 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Read error: Connection reset by peer]
06:53 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has joined #openvpn
06:55 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p18999> || Windows Server 2008 R2 x64 can't bind socket <http://forums.openvpn.net/topic9490.html>
07:00 < JackW> EugeneKay: thanks
07:07 <@vpnHelper> RSS Update - forum: UDP working fine , TCP not connecting <http://forums.openvpn.net/topic9479-15.html#p19000>
07:19 <@vpnHelper> RSS Update - forum: [ask] server behind router <http://forums.openvpn.net/topic9489.html#p19001>
07:36 -!- Muad`Dib [~shadok@ran75-2-78-192-139-52.fbxo.proxad.net] has quit [Remote host closed the connection]
07:39 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
07:40 < SviMik> hi all. I have a question: how to specify custom gateway IP for redirect-gateway option?
07:41 < SviMik> if I use "redirect-gateway def1", then the gateway IP is fixed to current VPN server's IP, but I need another IP from VPN network
07:42 < SviMik> I can write routes manually, but in this case I need to know gateway IP of every user (to create route to VPN server), and write routes to every user manually, that's impossible.
07:49 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p19002>
07:49 < SviMik> I tried to use:
07:49 < SviMik> route-metric 2
07:49 < SviMik> redirect-gateway def1
07:49 < SviMik> route 0.0.0.0 128.0.0.0 10.116.128.1 1
07:49 < SviMik> route 128.0.0.0 128.0.0.0 10.116.128.1 1
07:49 < SviMik> but this doesn't work. "redirect-gateway" is still using metric 1, and I can't override these routes with route command
07:52 < SviMik> the only working configuration is without redirect-gateway, just routes:
07:52 < SviMik> route 80.79.xx.xx 255.255.255.255 192.168.1.254
07:52 < SviMik> route 0.0.0.0 128.0.0.0 10.116.128.1 1
07:52 < SviMik> route 128.0.0.0 128.0.0.0 10.116.128.1 1
07:52 < SviMik> but in this case I need to know internet gateway IP (192.168.1.254 in this case). redirect-gateway does this automatically
07:55 <@vpnHelper> RSS Update - forum: [ask] server behind router <http://forums.openvpn.net/topic9489.html#p19003>
08:00 <@vpnHelper> RSS Update - forum: Windows Server 2008 R2 x64 can't bind socket <http://forums.openvpn.net/topic9490.html#p19004>
08:07 <@vpnHelper> RSS Update - forum: How to setup multiple openvpn access server and link them? <http://forums.openvpn.net/topic9491.html>
08:11 -!- pranq [~pranq@unaffiliated/contempt] has joined #openvpn
08:18 < cron2> !routing
08:18 < cron2> !rout
08:18 < cron2> !route
08:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
08:19 < SviMik> cron2 was it for me? :)
08:20 < cron2> no, that was for me
08:20 < cron2> couldn't find that URL but knew that vpnHelper has it :)
08:20 < SviMik> ah, ok :)
08:21 < SviMik> cron2 could you say something about my question?
08:21 < cron2> sorry, never used redirect-gateway - but you've answered your question already "not use redirect-gateway, just use routes"
08:21 < SviMik> you are first who seems to be online here...
08:22 < cron2> are you using tap mode, or tun mode?
08:22 < SviMik> tap
08:22 < SviMik> with "just use routes" I should write them individually for every client... it is impossible
08:23 < cron2> any specific reason for using tap?  with tun, you can use the same route for every client (because the target will be the openvpn server anyway)
08:25 < cron2> I never use tap unless I have to use bridging due to other constraints I have no influence on
08:25 < SviMik> I already have a vpn network with tap
08:25 < SviMik> I can't change it now.
08:26 < cron2> well
08:26 < cron2> you could use per-client config to push routes with individual gateway addresses
08:26 < cron2> (--client-config-dir)
08:26 -!- folivora [bomshiva@koekaniini.kelju.fi] has quit [Ping timeout: 240 seconds]
08:29 < SviMik> cron2 before I could redirect all internet traffic to gateway inside vpn network, the first route should be for vpn connection itself, and it is very client-specific.
08:30 < SviMik> so I need to add something like: route {VPN_server_ip} 255.255.255.255 {user's real gateway}
08:31 < cron2> I think you can do that, there are some keywords that get replaced by these
08:31 < SviMik> but I don't know {user's real gateway}. redirect-gateway detects it automatically on client side
08:32 < SviMik> and of course it's impossible to detect it on server side :)
08:32 < cron2> try "net_gateway" for {user's real gateway}, there is code inside route.c that will replace this string with the local gateway
08:32 < cron2> {VPN_server_ip} could be specified as "vpn_gateway"
08:33 < cron2> so:
08:33 < cron2> push "route vpn_gateway 255.255.255.255 net_gateway"
08:33 < SviMik> ok, I will try it now
08:33 < cron2> (though I'm not 100% sure about vpn_gateway - there's also "remote_host" that could do this bit)
08:33 < cron2> but vpn_gateway you already know :)
08:38 < cron2> need  to go
08:38 < SviMik> cron2 it woks! awesome! thanx :)
08:41 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
08:41 < SviMik> now I don't have to write a long instruction for users "how to find out your gateway ip"
08:47 <@vpnHelper> RSS Update - forum: How to setup multiple openvpn access server and link them? <http://forums.openvpn.net/topic9491.html#p19007> || Windows Server 2008 R2 x64 can't bind socket <http://forums.openvpn.net/topic9490.html#p19006>
09:11 <@vpnHelper> RSS Update - forum: How to setup multiple openvpn access server and link them? <http://forums.openvpn.net/topic9491.html#p19008>
09:53 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
09:58 -!- wedge [lordsilenc@bigfoot.xh.se] has quit [Ping timeout: 276 seconds]
09:58 -!- wedge [lordsilenc@bigfoot.xh.se] has joined #openvpn
09:58 <@vpnHelper> RSS Update - forum: bridged mode same subnet <http://forums.openvpn.net/topic9474.html#p19010> || Client-Server recipe from JanJust book TLS Failure <http://forums.openvpn.net/topic9488.html#p19009>
10:05 <@vpnHelper> RSS Update - forum: [ask] server behind router <http://forums.openvpn.net/topic9489.html#p19011>
10:10 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Ping timeout: 276 seconds]
10:17 <@vpnHelper> RSS Update - forum: How to use DDNS ervice <http://forums.openvpn.net/topic9481.html#p19012>
10:18 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
10:23 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:27 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Ping timeout: 276 seconds]
10:27 < cron2> SviMik: great :)
10:33 < hyper_ch> krzee: http://allthingsd.com/20111222/google-will-pay-mozilla-almost-300m-per-year-in-search-deal-besting-microsoft-and-yahoo/
10:33 <@vpnHelper> Title: Google Will Pay Mozilla Almost $300M Per Year in Search Deal - Kara Swisher - News - AllThingsD (at allthingsd.com)
10:45 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
10:52 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
10:55 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit [Ping timeout: 252 seconds]
10:59 <@vpnHelper> RSS Update - forum: Setup on server connected directly to WAN. <http://forums.openvpn.net/topic9492.html> || How to use DDNS ervice <http://forums.openvpn.net/topic9481.html#p19013>
11:05 <@vpnHelper> RSS Update - forum: How to use DDNS ervice <http://forums.openvpn.net/topic9481.html#p19016> || Setup on server connected directly to WAN. <http://forums.openvpn.net/topic9492.html#p19015>
11:11 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
11:17 <@vpnHelper> RSS Update - forum: Setup on server connected directly to WAN. <http://forums.openvpn.net/topic9492.html>
11:18 -!- starcraftcats [~newegggg@208.111.39.186] has quit [Ping timeout: 244 seconds]
11:29 -!- matse [~matse@fsf/member/matse] has joined #openvpn
11:29 < matse> does anybody know if i share an ip with different people when using hide my ass vpn?
11:35 < vocis> not while you are using it
11:36 < matse> ok thanks
11:44 -!- matse [~matse@fsf/member/matse] has left #openvpn []
11:44 -!- matse [~matse@fsf/member/matse] has joined #openvpn
11:49 -!- matse [~matse@fsf/member/matse] has quit [Quit: leaving]
11:54 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Quit: vocis]
11:57 < krzee> hmm i wonder how he knows that answer
11:57 < krzee> since it might be wrong...
12:06 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Quit: Ex-Chat]
12:13 -!- shantanu [~shantanu@59.97.201.24] has joined #openvpn
12:13 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
12:13 < shantanu> hi
12:14 < shantanu> when I try to start vpn i get Thu Dec 29 11:17:21 2011 Insufficient key material or header text not found in file '/etc/openvpn/private/server.key
12:15 < shantanu> any help on this?
12:18 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
12:31 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:31 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:31 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:31 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:32 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:32 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:32 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:32 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:33 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:33 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:33 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:33 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:34 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:34 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:34 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:34 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:35 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:35 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:35 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:35 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:36 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:36 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:37 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:37 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:37 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:37 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:38 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:38 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:38 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:40 -!- dioz [~dioz@2001:470:1f11:12a9::1] has quit [Write error: Broken pipe]
12:40 <@vpnHelper> RSS Update - forum: Windows 7 machine will not connect <http://forums.openvpn.net/topic9493.html>
12:44 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
12:44 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:44 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:44 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:44 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Excess Flood]
12:45 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:46 -!- dioz [~dioz@2001:470:1f11:12a9::1] has joined #openvpn
12:46 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
12:46 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
12:47 -!- diytto [~diytto@72-24-33-63.cpe.cableone.net] has left #openvpn []
12:50 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
12:54 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
13:03 -!- starcraftcats [~newegggg@61.170.211.238] has joined #openvpn
13:07 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
13:07 -!- Netsplit *.net <-> *.split quits: _julian_
13:08 -!- shantanu [~shantanu@59.97.201.24] has quit [Ping timeout: 240 seconds]
13:08 -!- _julian [~quassel@hmbg-5f77ed6b.pool.mediaWays.net] has joined #openvpn
13:12 -!- mgorbach [~mgorbach@96.241.54.213] has joined #openvpn
13:13 -!- mgorbachlaptop [~mgorbach@96.241.54.213] has joined #openvpn
13:13 -!- mgorbach [~mgorbach@96.241.54.213] has quit [Read error: Connection reset by peer]
13:13 -!- kjellski [~kjellski@2001:67c:20a1:1122:3cb8:a5c2:286:e84a] has joined #openvpn
13:14 < mgorbachlaptop> Anyone around able to help with VPN performance? I'm having trouble dealing with what looks like MTU issues.
13:14 < hyper_ch> what performance issues?
13:15 < mgorbachlaptop> Getting 30KBps in an SCP transfer over the VPN, getting 1.2 MBps for the same transfer outside of the VPN.
13:16 < hyper_ch> UDP?
13:17 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Quit: Ex-Chat]
13:17 < mgorbachlaptop> UDP
13:17 < mgorbachlaptop> Routed Network
13:17 < mgorbachlaptop> (With Masquerading)
13:18 < hyper_ch> tried TCP?
13:18 < mgorbachlaptop> At first even VNC was completely unusable. I tried setting a fragment value of 1000 and it seemed to improve, but SCP performance is still terrible.
13:18 < hyper_ch> my ISP somehow mangles with UDP for me
13:18 < hyper_ch> so I had to change to TCP
13:19 < mgorbachlaptop> Didn't seem to improve things.
13:21 < kjellski> could anyone lead me to a good tutorial to set up openvpn on a debian server and a mac osx client?
13:21 -!- shantanu [~shantanu@216.17.109.65] has joined #openvpn
13:21 < mgorbachlaptop> Actually, hmm.
13:21 < mgorbachlaptop> Seeing something unexepcted. When I transfer from the machine that is the VPN server itself, via its VPN-only IP, its fast.
13:21 < hyper_ch> kjellski: yes
13:21 < hyper_ch> !confgen
13:21 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/
13:22 < hyper_ch> kjellski: the confgen script helps you create configs
13:22 < mgorbachlaptop> When I transfer over the VPN from machines on the VPN servers network, but not the server itself, it's extremely slow.
13:22 < hyper_ch> and for the CA use
13:22 < hyper_ch> !pki
13:22 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
13:22 <@vpnHelper> signed specially as a server (see !servercert)
13:22 < kjellski> hyper_ch, tanks a lot!
13:23 < hyper_ch> mgorbachlaptop: not sure what you mean?    client1 <-> server  that's ok?
13:23 < hyper_ch> mgorbachlaptop: and    client1 <-> server <-> client2    that's slow?
13:23 < mgorbachlaptop> Apparently so.
13:23 < mgorbachlaptop> 1 MBps vs 35 KBps
13:23 < hyper_ch> but what setup? first or second?
13:24 < mgorbachlaptop> The client1 <-> server <-> client 2 is slow.
13:24 < mgorbachlaptop> client1 <-> server is fast
13:25 < mgorbachlaptop> Could IP masquering slow things down massively or something?
13:26 < hyper_ch> what about   server <-> client2 ?
13:26 < hyper_ch> is that slow or fast?
13:26 < mgorbachlaptop> From the VPN server to a VPN client?
13:26 < hyper_ch> for me the problem was that another client to the server was fast with udp
13:26 < hyper_ch> but server to me was slow
13:26 < hyper_ch> so I run now two openvpn servers
13:26 < hyper_ch> one using UDP for client2 and server
13:26 < hyper_ch> and one using TCP for clien1 (me) and server
13:27 < hyper_ch> mgorbachlaptop: http://images.sjau.ch/img/960330e3.png
13:28 < hyper_ch> I run now the last scenario on there (the third one)
13:28 < hyper_ch> and with some tweaking I get now the 1.2 MB/S on a 15mbit connection
13:29 < hyper_ch> mgorbachlaptop: what are your configs like?
13:29 < hyper_ch> !configs
13:29 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
13:29 < mgorbachlaptop> hyper_ch: What ISP?
13:29 < hyper_ch> mgorbachlaptop: is that important what ISP I use?
13:30 < hyper_ch> mgorbachlaptop: well, Sunrise
13:31 < mgorbachlaptop> http://pastebin.com/JrjRn9rk
13:32 < mgorbachlaptop> Didn't you say your ISP was mangling UDP somehow?
13:32 < hyper_ch> mgorbachlaptop: it seems like it... so I changed my home connection to the openvpn server to TCP
13:32 < hyper_ch> and the openvpn server to the other client still to UDP
13:32 < hyper_ch> and now I got good speeds
13:32 < hyper_ch> I just have to run two openvpn instances
13:33 < hyper_ch> actually wrong
13:33 < hyper_ch> I run two openvpn instances on the server
13:33 < hyper_ch> and two instances on the other client
13:34 < mgorbachlaptop> Weird
13:34 < mgorbachlaptop> Client -> Any computer on the VPN subnet is fast
13:34 < mgorbachlaptop> Client -> Any computer on the server's subnet I mean
13:34 < mgorbachlaptop> Meanwhile Server -> Client is fast. Any other computer on the server's subnet -> Client is slow.
13:34 < hyper_ch> well, I just experimented around
13:35 < hyper_ch> it's weird :)
13:35 < mgorbachlaptop> It seems like it can't be UDP issues from me though, because transfer to and from the VPN server itself over the VPN tunnel is very fast.
13:36 < hyper_ch> don't really know
13:36 < hyper_ch> you could run multiple instance in different subnets and try to figure out what is the fast connection from the other client to the server
13:36 < hyper_ch> and if you could go accross subnets if that improves speed
13:37 -!- kjellski [~kjellski@2001:67c:20a1:1122:3cb8:a5c2:286:e84a] has quit [Quit: This computer has gone to sleep]
13:37 < mgorbachlaptop> Oddly, I have bridged config file too. I tried that and the same thing happens. Downloading from the VPN server itself is fast. Downloading from anywhere else on the subnet is slow.
13:37 < hyper_ch> no clue, sorry
13:38 < mgorbachlaptop> May need to go to the forums or the mailing list with this, sigh.
13:49 < ecrist> with what?
13:49 < hyper_ch> hi ecrist
13:52 < mgorbachlaptop> ecrist: My OpenVPN performance issues.
13:52 < ecrist> mgorbachlaptop: check and verify your MTU is set properly
13:52 < ecrist> !mtu
13:52 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
13:54 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:54 < mgorbachlaptop> ecrist: I've played with the MTU settings quit a bit. Lowering them down to 1000 improved performance, but I am still seeing TCP retransmit issues, and SCP to machines on the server's subnet is still very slow.
13:55 < JackW> given running as nobody:nobody in a chroot, what is the reccomended ownership and permissions of the chroot and it's files?  nobody:nobody and 700?
13:55 < ecrist> JackW: what ever works for you.
13:55 < ecrist> mgorbachlaptop: something seems wonky in your setup
13:56 < ecrist> we use a bridged VPN config at $work and don't have to do anything and do many transfers and even VOIP without a problem.
13:57 < mgorbachlaptop> ecrist: Yeah something is wonky, but I can't figure out what.
13:57 < mgorbachlaptop> Just posted the long writeup to OpenVPN-users
13:57 < ecrist> I'd start looking at tcpdump data
13:57 < mgorbachlaptop> Wondering if somehow my airport extreme gateway is to blame.
13:59 < mgorbachlaptop> Basically performance downloading to clients is good to the server itself, but horrible on the server's subnet. Performance uploading from clients is pretty good all around.
14:00 < mgorbachlaptop> ecrist: Also do you use AFP or SMB over the bridged VPN?
14:00 < ecrist> both, actually
14:01 < mgorbachlaptop> I have bridges setup that is mostly working, but I decided to fall back to routed for now to get these performance issues sorted, since it's simpler and these issues are affecting both configs.
14:01 < mgorbachlaptop> ecrist: And it performs fine?
14:01 < ecrist> and don't blame the AP extreme, my home network and the remote office use one, without problems
14:01 < ecrist> mgorbachlaptop: performs great
14:02 < mgorbachlaptop> Yeah on my bridged setup I can't even successfully start an AFP transfer, though I can list files through AFP.
14:02 < ecrist> collisions in the domain?
14:05 < mgorbachlaptop> ecrist: You mean like IP address collisions?
14:05 < ecrist> mgorbachlaptop: on a crummy connection, I get 492287 bytes/sec to an AFP share
14:05 < mgorbachlaptop> not bad
14:06 < mgorbachlaptop> Yeah something is wrong with my setup. Are you on FiOS by chance?
14:06 < ecrist> no
14:07 < ecrist> Comcast 
14:07 < mgorbachlaptop> Wondering if it's something ISP related for me. Seems odd though that performance would be good to the VPN server then.
14:07 < ecrist> we even have a comcast connection at our DC so comcast users stay on-net
14:20 < mgorbachlaptop> Well, go to know that is at least theoretically possible to get good performance in my use-cases.
14:20 -!- mgorbachlaptop [~mgorbach@96.241.54.213] has quit [Quit: Leaving...]
14:41 -!- bigon [bigon@anor.bigon.be] has quit [Changing host]
14:41 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
14:41 -!- ServerMode/#openvpn [+v bigon] by leguin.freenode.net
14:44 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
14:52 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p19018>
14:53 -!- shantanu [~shantanu@216.17.109.65] has quit [Ping timeout: 248 seconds]
15:09 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has joined #openvpn
15:40 <@vpnHelper> RSS Update - forum: How to use DDNS ervice <http://forums.openvpn.net/topic9481.html#p19019>
15:46 <@vpnHelper> RSS Update - forum: vpn connection works... until tls soft-reset... <http://forums.openvpn.net/topic9475.html#p19020>
15:57 -!- JoeGazz84 is now known as Santa_Claus
16:03 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 252 seconds]
16:03 <@vpnHelper> RSS Update - forum: vpn connection works... until tls soft-reset... <http://forums.openvpn.net/topic9475.html#p19021>
16:06 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has joined #openvpn
16:07 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has quit [Ping timeout: 248 seconds]
16:09 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
16:42 -!- scampbell [~scampbell@c-98-224-240-62.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
16:46 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
16:47 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
17:27 -!- mgorbach [~mgorbach@96.241.54.213] has joined #openvpn
17:44 -!- rasyid7 [~3333@69.163.36.67] has joined #openvpn
17:50 -!- newl [~newl@97.75.165.156] has joined #openvpn
17:56 < mgorbach> Any OpenVPN performance experts out there? If so, would appreciate your help with the routed VPN performance issue I posted today on the mailing list.
17:56 < EugeneKay> Somewhere, out there, over the rainbow.
18:11 <@vpnHelper> RSS Update - forum: [ask] server behind router <http://forums.openvpn.net/topic9489.html#p19022>
18:12 -!- mgorbach [~mgorbach@96.241.54.213] has quit [Quit: Bye!]
18:21  * newl rainbows? haven't they all be repossed already?
18:33 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
18:33 -!- mode/#openvpn [+v Axeman] by ChanServ
18:34 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
18:47 -!- tjz [~pc@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
18:49 -!- mgorbach [~mgorbach@pool-108-7-229-195.bstnma.fios.verizon.net] has joined #openvpn
18:51 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 240 seconds]
18:52 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
18:54 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
18:57 -!- mgorbach is now known as zz_mgorbach
18:59 -!- zz_mgorbach is now known as mgorbach
19:11 -!- mgorbach [~mgorbach@pool-108-7-229-195.bstnma.fios.verizon.net] has quit [Quit: ZNC - http://znc.in]
19:14 -!- _julian_ [~quassel@hmbg-4d069d8a.pool.mediaWays.net] has joined #openvpn
19:15 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has joined #openvpn
19:17 -!- _julian [~quassel@hmbg-5f77ed6b.pool.mediaWays.net] has quit [Ping timeout: 255 seconds]
19:20 -!- JackW [~jack@80.27.165.250] has quit [Quit: Konversation terminated!]
19:22 -!- mgorbach_ [~mgorbach@pool-108-7-229-195.bstnma.fios.verizon.net] has joined #openvpn
19:22 -!- mgorbach_ [~mgorbach@pool-108-7-229-195.bstnma.fios.verizon.net] has left #openvpn []
19:24 -!- JackW [~jack@46.Red-2-142-128.dynamicIP.rima-tde.net] has joined #openvpn
19:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
19:35 <@vpnHelper> RSS Update - forum: Python build script for building OpenVPN on Windows <http://forums.openvpn.net/topic9494.html> || vpn connection works... until tls soft-reset... <http://forums.openvpn.net/topic9475.html#p19023>
19:35 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
19:41 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
19:44 -!- mgorbach [~mgorbach@pool-108-7-229-195.bstnma.fios.verizon.net] has joined #openvpn
20:02 -!- erroar [~erroar@p4FC31431.dip.t-dialin.net] has joined #openvpn
20:05 -!- starcraftcats is now known as danthemannn
20:07 < erroar> hi, sometimes i see people configure their vpn daemon to listen on port 443 with UDP transport.. im curious here as 443 is used to circumvent restrictive firewalls etc. but do such firewalls really allow udp on 443 (besides tcp)? is it a common case or is it rather nonsense
20:11 -!- danthemannn [~newegggg@61.170.211.238] has quit [Read error: Connection reset by peer]
20:11 < EugeneKay> Irrationally protective firewalls aren't always written by the brightest blokes.
20:12 -!- danthemannn [~newegggg@208.111.39.186] has joined #openvpn
20:14 -!- kill [~3333@69.163.36.67] has joined #openvpn
20:14 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
20:16 -!- rasyid7 [~3333@69.163.36.67] has quit [Ping timeout: 276 seconds]
20:17 -!- caemir [~caemir@unaffiliated/caemir] has quit [Excess Flood]
20:17 < newl> the port doesn't care what protocol it has using it - except icmp
20:18 <+TJNII> ..That's...100% wrong.
20:19 <+TJNII> There are TCP ports and UDP ports.  The port is implemented by the TCP or UDP protocol
20:19 -!- kill [~3333@69.163.36.67] has quit [Ping timeout: 248 seconds]
20:20 <+TJNII> Okay, I read that too fast.  I thought you were saying port n is port n regardless of protocol...
20:20 <+TJNII> as in TCP / UDP protocol
20:21 < EugeneKay> The newb writing the rules doesn't bother to specify whether it's TCP or UDP he's blocking. He just clicks Any.
20:22 <+TJNII> EugeneKay: Yep, I got what you were saying.  Nice phrasing, btw.
20:23 -!- Denial [Denial@drgi.co.uk] has quit []
20:23 -!- master_of_master [~master_of@p57B5558A.dip.t-dialin.net] has quit [Ping timeout: 268 seconds]
20:24 < erroar> yes seems so, but so you have to know this before setting up the daemon.. i guess, i have to stick with tcp :(
20:25 -!- master_of_master [~master_of@p57B53B24.dip.t-dialin.net] has joined #openvpn
20:26 -!- rasyid7 [~3333@69.163.36.67] has joined #openvpn
20:27 -!- erroar [~erroar@p4FC31431.dip.t-dialin.net] has quit [Quit: Lost terminal]
20:29 < EugeneKay> Or run both, with UDP failing over to TCP client-side.
20:29 < EugeneKay> Standard linux init scripts will run one instance for each of the config files present ;-)
20:30 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has quit [Quit: ZNC - http://znc.in]
20:31 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
20:32 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
20:44 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
20:47 -!- me345 [~me345@75.15.180.69] has joined #openvpn
20:47 <@vpnHelper> RSS Update - forum: Setting up Openvpn client <http://forums.openvpn.net/topic9338.html#p19025>
20:52 < newl> how does openvpn guarantee the packets are delivered with udp?
20:52 < newl> in the tpc encrypted packet?
20:55 < EugeneKay> Openvpn does not. The payload's TCP connection does it.
20:56 < newl> so it is 'faster' to use the udp in the tcp encrypted then tcp inside tcp encrypted
20:57 < EugeneKay> "Yes" ? Your phrasing confuses me, but I think you have the idea
20:57 < newl> rephrase -> no need to use tcp inside tcp encrypted as udp works okay
20:58 < EugeneKay> UDP as the carrier is the preferred way
20:59 < newl> sorry about this next one --- why not use udp in ssl/tcp for web servers too?
20:59 < JackW> tunneling tcp inside tcp can have bad performance implications, better to tunnel tcp inside of udp if you can.
21:00 < EugeneKay> You need to pick a layer to do the packets-arrive-correctly bit at.
21:00 < EugeneKay> OpenVPN uses UDP because it doesn't have to care - the payload takes care of it.
21:01 < EugeneKay> HTTP assumes that the underlying connection will handle it. Hence, TCP on HTTP and HTTP/TLS
21:02 < EugeneKay> This is how TCP/IP actually works.
21:44 < ecrist> newl: OpenVPN doesn't give a shit about the packets
21:44 < ecrist> specifically with UDP
21:45 < ecrist> take it in -> encrypt it -> send it .... keepalive? COOL!
21:45 < ecrist> if ($keepalive) { cool(); } else { reconn(); };
21:45 < ecrist> with TCP, TCP handles the 'care if the packet is received'
21:46 < ecrist> openvpn really doesn't care, still
21:46 -!- mgorbach [~mgorbach@pool-108-7-229-195.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
21:50 -!- twister004 [~chatzilla@mail.goi.ritsnet.co.in] has quit [Read error: Connection reset by peer]
21:50 -!- xatltb [~me345@adsl-75-15-180-69.dsl.bkfd14.sbcglobal.net] has joined #openvpn
21:51 -!- twister004 [~chatzilla@59.90.104.109] has joined #openvpn
21:51 -!- me345 [~me345@75.15.180.69] has quit [Read error: Connection reset by peer]
21:52 -!- danthemannn [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
21:53 -!- danthemannn [~newegggg@208.111.39.186] has joined #openvpn
22:01 -!- newl [~newl@97.75.165.156] has quit [Quit: leaving]
22:08 -!- zeshoem [~zee@bas1-toronto46-1177856746.dsl.bell.ca] has joined #openvpn
22:10 -!- twister004 [~chatzilla@59.90.104.109] has quit [Read error: Connection reset by peer]
22:11 -!- twister004 [~chatzilla@59.90.104.109] has joined #openvpn
22:16 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
22:16 -!- Axeman [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
22:16 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
22:16 -!- mode/#openvpn [+v Axeman] by ChanServ
22:17 -!- itai [~itai@218.82.171.105] has joined #openvpn
22:22 -!- itai [~itai@218.82.171.105] has quit [Quit: Leaving]
22:38 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit [Ping timeout: 255 seconds]
22:38 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
22:40 -!- xatltb [~me345@adsl-75-15-180-69.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
22:40 -!- me345 [~me345@adsl-75-15-180-69.dsl.bkfd14.sbcglobal.net] has joined #openvpn
22:42 -!- me345 [~me345@adsl-75-15-180-69.dsl.bkfd14.sbcglobal.net] has quit [Read error: Connection reset by peer]
22:46 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
22:49 -!- luckman212 [~irc@pool-108-41-8-176.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
22:55 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit [Ping timeout: 248 seconds]
23:03 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
23:03 -!- karmst [~karmst@176.102.65.158] has joined #openvpn
23:03 < karmst> Hello
23:04 < karmst> need some help with OpenVPN on PFSense
23:06 < EugeneKay> !ask
23:06 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please or (#2) http://www.latinsud.com/answer/ or (#3) http://www.catb.org/~esr/faqs/smart-questions.html to learn how to get help
23:06 -!- JackW [~jack@46.Red-2-142-128.dynamicIP.rima-tde.net] has quit [Ping timeout: 240 seconds]
23:07 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit [Ping timeout: 240 seconds]
23:11 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:17 < karmst> pptp it says the firewall rules are built automagically
23:17 < karmst> but they aren't
23:22 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
23:23 < ecrist> this isn't a PPTP support channel
23:31 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit [Ping timeout: 248 seconds]
23:33 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has joined #openvpn
23:36 < EugeneKay> !notopenvpn
23:36 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
23:41 -!- [1]karmst [~karmst@176.102.65.158] has joined #openvpn
23:43 < ecrist> I need to make the bot more intelligent.
23:43 < ecrist> two mods it needs
23:43 < ecrist> 1) a manpage mod, that takes --arg and prints the appropriate section of the man pag
23:43 -!- gko [~gko@114-34-168-13.HINET-IP.hinet.net] has quit []
23:44 < ecrist> 2) a regex mod that prints things based on a matched regex
23:44 -!- karmst [~karmst@176.102.65.158] has quit [Ping timeout: 240 seconds]
23:44 -!- [1]karmst is now known as karmst
23:52 < karmst> ok
23:52 < karmst> well instead of openvpn I would like to use IPSec Mobile
23:52 < ecrist> no
23:52 < ecrist> go away
23:53 < karmst> Is there a step by step guide for this for pfsense 2.0?
23:53 < ecrist> try #pfsense
23:53 < ecrist> sulrich is helpful
23:53 < ecrist> and authoritative
--- Day changed Fri Dec 30 2011
00:00 -!- karmst [~karmst@176.102.65.158] has left #openvpn []
00:08 -!- magicblaze007 [~magicblaz@c-68-63-40-199.hsd1.fl.comcast.net] has joined #openvpn
00:08 < magicblaze007> anyone around?
00:12 < magicblaze007> knock knock
00:20 -!- danthemannn [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
00:20 -!- magicblaze007 [~magicblaz@c-68-63-40-199.hsd1.fl.comcast.net] has left #openvpn []
00:31 -!- SeahorseFlava [~flavasaz2@76.192.218.246] has joined #openvpn
00:40 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
00:42 -!- SeahorseL [~flavasaz2@76.192.218.246] has joined #openvpn
00:43 -!- SeahorseFlava [~flavasaz2@76.192.218.246] has quit [Remote host closed the connection]
00:45 -!- SeahorseL [~flavasaz2@76.192.218.246] has quit [Remote host closed the connection]
00:45 -!- SeahorseL [~flavasaz2@76.192.218.246] has joined #openvpn
00:56 -!- SeahorseFlava [~flavasaz2@76.192.218.246] has joined #openvpn
00:56 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has quit [Ping timeout: 252 seconds]
00:58 -!- SeahorseL [~flavasaz2@76.192.218.246] has quit [Remote host closed the connection]
00:59 -!- SeahorseFlava [~flavasaz2@76.192.218.246] has quit [Remote host closed the connection]
00:59 -!- SeahorseL [~flavasaz2@76.192.218.246] has joined #openvpn
01:02 -!- SeahorseL [~flavasaz2@76.192.218.246] has quit [Remote host closed the connection]
01:02 -!- SeahorseL [~flavasaz2@76.192.218.246] has joined #openvpn
01:04 <@vpnHelper> RSS Update - forum: Windows 7 machine will not connect <http://forums.openvpn.net/topic9493.html#p19026>
01:05 -!- krzie [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
01:05 -!- SeahorseL [~flavasaz2@76.192.218.246] has quit [Remote host closed the connection]
01:41 -!- rasyid7 [~3333@69.163.36.67] has quit [Read error: Connection reset by peer]
01:47 -!- zeshoem [~zee@bas1-toronto46-1177856746.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
01:47 -!- zeshoem [~zee@bas1-toronto46-1177856379.dsl.bell.ca] has joined #openvpn
01:49 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has joined #openvpn
02:12 < hyper_ch> lol, someone's selling an apple 5-year employee award for $2k on ebay http://techcrunch.com/2011/12/30/idol/
02:12 <@vpnHelper> Title: Someone Is Selling An Apple Five Year Employee Award On eBay, For $2K | TechCrunch (at techcrunch.com)
02:20 < EugeneKay> Lulz
02:26 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has quit [Ping timeout: 276 seconds]
02:27 -!- JackW [~jack@88.Red-95-127-64.staticIP.rima-tde.net] has joined #openvpn
02:27 <@vpnHelper> RSS Update - forum: Windows 7 machine will not connect <http://forums.openvpn.net/topic9493.html#p19028> || [ask] server behind router <http://forums.openvpn.net/topic9489.html#p19027>
02:34 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p19029>
02:36 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
03:00 -!- danthemannn [~newegggg@208.111.39.186] has joined #openvpn
03:00 < danthemannn> hey
03:01 < danthemannn> despite changing my linux server to the correct time zone, my openvpn logs in var/messages are still in n totally wrong time zone
03:01 < danthemannn> does the openvpn server have a place somewhere that i can set the timezone?
03:04 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
03:06 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
03:11 < EugeneKay> danthemannn - timestamps in syslog are managed by your syslog daemon, not openvpn
03:11 < EugeneKay> Kick it.
03:11 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
03:12 -!- danthemannn [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
03:27 -!- SOG [~SOG@113.108.118.60] has joined #openvpn
03:29 -!- datums_nb [~datums@cpe-72-130-119-162.socal.res.rr.com] has quit [Read error: Connection reset by peer]
03:38 -!- SOG [~SOG@113.108.118.60] has quit [Quit: I will be back!]
03:41 -!- zalzice [~zalzice@25.79-160-109.customer.lyse.net] has joined #openvpn
03:47 <@vpnHelper> RSS Update - forum: handshake failed in running Openvpn !! <http://forums.openvpn.net/topic9495.html>
03:48 -!- caemir [~caemir@78.129.43.30] has joined #openvpn
03:48 -!- caemir [~caemir@78.129.43.30] has quit [Changing host]
03:48 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
03:53 <@vpnHelper> RSS Update - forum: Openvpn logs won't use correct time zone <http://forums.openvpn.net/topic9496.html>
03:53 -!- danthemannn [~newegggg@208.111.39.186] has joined #openvpn
03:53 < danthemannn> hi
03:53 < danthemannn> https://forums.openvpn.net/post19031.html#p19031
03:53 <@vpnHelper> Title: OpenVPN Support Forum Openvpn logs won't use correct time zone : Server Administration (at forums.openvpn.net)
03:54 < danthemannn> please post if any idea or type here
03:54 < danthemannn> thx
04:01 -!- dantheman [~newegggg@208.111.39.186] has joined #openvpn
04:01 -!- danthemannn [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
04:02 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
04:16 -!- master_of_master [~master_of@p57B53B24.dip.t-dialin.net] has quit [Read error: Operation timed out]
04:17 <@vpnHelper> RSS Update - forum: handshake failed in running Openvpn !! <http://forums.openvpn.net/topic9495.html#p19032>
04:20 -!- master_of_master [~master_of@p57B55733.dip.t-dialin.net] has joined #openvpn
04:29 -!- dantheman [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
04:29 <@vpnHelper> RSS Update - forum: handshake failed in running Openvpn !! <http://forums.openvpn.net/topic9495.html#p19034>
04:29 -!- dantheman [~newegggg@208.111.39.186] has joined #openvpn
04:33 -!- dantheman is now known as dancashew
04:34 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Quit: Ex-Chat]
04:35 -!- dancashew is now known as pizzahutrocks
04:35 -!- pizzahutrocks is now known as pizzahut
04:35 -!- pizzahut [~newegggg@208.111.39.186] has left #openvpn []
04:53 <@vpnHelper> RSS Update - forum: Openvpn logs won't use correct time zone <http://forums.openvpn.net/topic9496.html#p19035>
05:11 <@vpnHelper> RSS Update - forum: handshake failed in running Openvpn !! <http://forums.openvpn.net/topic9495.html#p19037>
05:37 -!- JoeyJoeJo [~brian@pool-173-71-223-79.clppva.fios.verizon.net] has quit [Ping timeout: 240 seconds]
06:05 <@vpnHelper> RSS Update - forum: Linking 2 VPN servers, routing issue with movable clients <http://forums.openvpn.net/topic9497.html>
06:23 -!- Lachezar [~lachezar@78.90.107.63] has joined #openvpn
06:24 < Lachezar> Hello all... Merry ... Chrismahanukwanzadan :)
06:24 < Lachezar> Can I use OpenVPN to establish multiple tunnels betwen machines behind masquerading firewalls?
06:35 < gladiatr> Lachezar: lol.  Are you talking about multiple tunnels on the same pair of machines?
06:42 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html>
06:58 < Lachezar> gladiatr: No, Multiple machines (>2 anyway) with N-to-N tunnels.
06:58 < Lachezar> gladiatr: Kinda like a LAN party, but P2P style...
06:59 < Lachezar> gladiatr: Not N-to-N, my bad: N 1-on-1 tunnels (everyone to everyone else).
06:59 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19040>
07:05 < gladiatr> hrm... you could conceivably do that.  If I'm thinking what I think you're thinking, you would need to have each person running an openvpn process acting as a server and many openvpn/client processes... seems a little cumbersome to me.
07:05 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19041>
07:05 < gladiatr> An alternative might be to pick someone to be the "server" and have everyone else connect to that node
07:07 < Lachezar> gladiatr: My main concern is how to create ONE tunnel between TWO peers, BOTH behind a MASQ firewalls.
07:07 < Lachezar> gladiatr: Single server would mean heavy network conjestion in one place.
07:08 < Lachezar> gladiatr: My idea is to make a VPN between the computers of my family members.
07:08 < Lachezar> gladiatr: Ideally a V-LAN with multicast, broadcast and unicast on all protocols working.
07:09 < Lachezar> gladiatr: Think of my kid and my brother's kid playing LAN games with each other, and my sister dropping in.
07:12 -!- Zimsky [~Zimsky@rozznet.net] has quit [Ping timeout: 240 seconds]
07:15 -!- Zimsky [~Zimsky@rozznet.net] has joined #openvpn
07:19 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
07:19 -!- mode/#openvpn [+v Axeman] by ChanServ
07:22 < JackW> Lachezar: use the default server and client example scripts, then forward a port on the server side lan to the server machine.   and you will need to use L2 ethernet routing (bridging)
07:23 < JackW> that means you will need to read some and modify the scripts a bit
07:24 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19042>
07:24 < JackW> but you could get real fancy and use sevarel servers, load balancing, etc
07:30 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19043>
07:36 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19044>
07:37 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has joined #openvpn
07:38 -!- benste [~benste@41.2.134.58] has joined #openvpn
07:39 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
07:40 < benste> hi - I'm trying to setup a VPN server on my ubuntu, to securely share my internet connection which is a ppp0
07:40 < benste> trying to set up a tunnel - i know end up that i do have a p2p and can't ping the server even though the vpn is successfully connected
07:40 < benste> in additio my main problem might be routing - but i think i've solved that - please help me
07:40 < benste> I'll nopaste my config in a second
07:42 <@vpnHelper> RSS Update - forum: handshake failed in running Openvpn !! <http://forums.openvpn.net/topic9495.html#p19047> || OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19046>
07:43 < benste> ?
07:43 < ObamaIsAGangsta> this is irc, wait 24 hours
07:44 < ObamaIsAGangsta> if some1 knows they'll respond
07:44 < JackW> i get a Linux ip addr del failed: external program exited with error status: 254 in my log?  is that because i run with dropped privs as nobody:nobody?
07:45 < JackW> benste: the question is too general to parse...  can you ping from sever to client and vice versa?
07:47 < benste> ObamaIsAGangsta: ?? - I'Ve never seen an IRC which acts like that on freenode - all others are within 5/10 min
07:47 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19048>
07:47 < benste> here is my config
07:48 < benste> http://paste.ubuntu.com/787830/
07:48 < benste> i assumed line 96 is the important one
07:48 < benste> but doesn't look like it's applied
07:49 < ObamaIsAGangsta> dude its FREE support
07:49 < ObamaIsAGangsta> wtf do u expect
07:50 < ObamaIsAGangsta> if u want 5 minute support use access server
07:50 < benste> ObamaIsAGangsta: didn't want to be rude - know how it works - just never seen a community project which takes that long
07:51 < benste> but that's fine - I'll have to go on trying it myself
07:51 < benste> thanks for the info that it will take longer here
07:52 < benste> ObamaIsAGangsta: but maybe you could give me one hint - what are the ";" at the beginng of config items meant to be in server.cfg ? 
07:52 < benste> are they obsolete ?
07:52 < ObamaIsAGangsta> they comment out that line
07:52 < benste> ups
07:53 < benste> thought that would only be #
07:53 < benste> thanks
07:53 < benste> I'll have to change the config then
07:53 < ObamaIsAGangsta> both do same thing
07:53 < ObamaIsAGangsta> ; tells u, delete this if u want to use the line
07:53 < benste> kk thanks
07:54 < benste> k
07:58 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19049>
07:58 < ObamaIsAGangsta> you might want to read the manual
07:58 < ObamaIsAGangsta> http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html
07:59 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
07:59 < ObamaIsAGangsta> its in depth
07:59 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has left #openvpn []
08:01 < JackW> the manpage is the best resource of them all for openvpn :)
08:02 -!- benste [~benste@41.2.134.58] has quit [Ping timeout: 240 seconds]
08:04 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19050>
08:10 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19054> || New installation on Vmware esxi 5.0 - use appliance or not? <http://forums.openvpn.net/topic9499.html>
08:16 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19055>
08:34 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498.html#p19056>
08:40 <@vpnHelper> RSS Update - forum: OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498-15.html#p19057>
08:40 -!- forgotten [forgotten@is.undroppable.co.uk] has joined #openvpn
08:42 < forgotten> Hi, i'm trying to setup openvpn  server and 1 client using a static key.  creating tun0.conf and reading that file when starting openvpn, server is 10.10.10.1   client is 10.10.10.2.  it says i should be able to ping back and forth on these addresses at this point.. all i am getting in the verb 6 on client window is  Connection Refused type of errors.
08:47 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
08:48 -!- JackW [~jack@88.Red-95-127-64.staticIP.rima-tde.net] has quit [Remote host closed the connection]
08:52 < gladiatr> heya krzie
08:52 < krzie> hey
08:54 -!- JackW [~jack@88.Red-95-127-64.staticIP.rima-tde.net] has joined #openvpn
08:59 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has joined #openvpn
09:00 < ecrist> sup krzie?
09:02 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has quit [Read error: Connection reset by peer]
09:02 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has joined #openvpn
09:06 -!- Secret [~Secret@78.157.114.78] has quit [Read error: Operation timed out]
09:09 < hyper_ch> hi krzie
09:09 < hyper_ch> krzie: seen the WPS security issue?
09:09 <@vpnHelper> RSS Update - forum: Down script to fix route issue <http://forums.openvpn.net/topic9500.html> || OpenVPN on CentOS 6 using webmin <http://forums.openvpn.net/topic9498-15.html#p19058>
09:10 -!- Secret [~Secret@78.157.114.78] has joined #openvpn
09:13 -!- zebedee3_ [~neil@2001:470:1f09:436:8ea9:82ff:fea9:e604] has joined #openvpn
09:16 -!- zalzice [~zalzice@25.79-160-109.customer.lyse.net] has quit [Ping timeout: 240 seconds]
09:17 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has quit [Ping timeout: 268 seconds]
09:17 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has joined #openvpn
09:18 -!- zalzice [~zalzice@25.79-160-109.customer.lyse.net] has joined #openvpn
09:22 <@vpnHelper> RSS Update - forum: Windows 7 machine will not connect <http://forums.openvpn.net/topic9493.html#p19060>
09:26 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has quit [Ping timeout: 255 seconds]
09:29 -!- ObamaIsAGangsta [~newegggg@61.170.211.238] has joined #openvpn
09:34 -!- ObamaIsAGangsta [~newegggg@61.170.211.238] has quit [Ping timeout: 252 seconds]
09:34 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has joined #openvpn
09:40 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has quit [Ping timeout: 240 seconds]
09:40 -!- bauruine_ [~stefan@2001:8e0:100b:dead:2677:3ff:fe1a:2078] has joined #openvpn
09:41 -!- ObamaIsAGangsta [~newegggg@61.170.211.238] has joined #openvpn
09:44 -!- corretico [~luis@190.211.94.6] has joined #openvpn
09:50 -!- ObamaIsAGangsta [~newegggg@61.170.211.238] has quit [Remote host closed the connection]
09:50 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has joined #openvpn
09:52 -!- bauruine [~stefan@2001:8e0:100b:dead:216:eaff:feb3:722a] has quit [Ping timeout: 252 seconds]
09:53 -!- Axeman [~Axeman3@openvpn/user/axeman] has joined #openvpn
09:53 -!- mode/#openvpn [+v Axeman] by ChanServ
09:54 -!- houms [~houms@wsip-98-191-169-18.dc.dc.cox.net] has joined #openvpn
09:54 < houms> good day all i am trying to test openvpn from command line and would like to know how to pass the key password 
09:54 < hyper_ch> how to pass the key password?
09:54 < hyper_ch> ah
09:55 < hyper_ch> openvpn --help
09:55 < hyper_ch> that should return the command line options
10:01 < houms> not sure i know what needs to be defined. looking through help. when i do openvpn /path/to/config.ovpn i get http://privatepaste.com/4a802d0a1a
10:06 < houms> nevermind figured it out
10:07 -!- zebedee3_ [~neil@2001:470:1f09:436:8ea9:82ff:fea9:e604] has quit [Ping timeout: 260 seconds]
10:08 < hyper_ch> great
10:12 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
10:12 -!- mode/#openvpn [+v Axeman2] by ChanServ
10:12 < houms> though the help did not "help" i just had to cd into the directory the files where in. What i don't understand is why i cannot access the LAN from this one machine. I have verified that it works just not from this machine
10:15 -!- Axeman [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
10:19 -!- houms [~houms@wsip-98-191-169-18.dc.dc.cox.net] has quit [Quit: Konversation terminated!]
10:23 -!- JackW [~jack@88.Red-95-127-64.staticIP.rima-tde.net] has quit [Quit: Konversation terminated!]
10:23 -!- zebedee3_ [~neil@027c034b.bb.sky.com] has joined #openvpn
10:24 -!- twister004 [~chatzilla@59.90.104.109] has quit [Quit: ChatZilla 0.9.88 [Firefox 9.0.1/20111220165912]]
10:25 -!- Lachezar [~lachezar@78.90.107.63] has quit [Quit: Going home...]
10:27 -!- JackW [~jack@228.Red-95-127-57.staticIP.rima-tde.net] has joined #openvpn
10:50 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has quit [Ping timeout: 240 seconds]
10:50 <@vpnHelper> RSS Update - forum: [resolved] Windows 7 machine will not connect <http://forums.openvpn.net/topic9493.html#p19060>
10:50 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has joined #openvpn
11:02 <@vpnHelper> RSS Update - forum: WHS as internet gateway with Open VPN anonymisation service <http://forums.openvpn.net/topic9283.html#p19061>
11:03 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has quit [Ping timeout: 252 seconds]
11:04 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has joined #openvpn
11:09 < krzie> sup ecrist 
11:09 < krzie> hyper_ch, yeo
11:09 < krzie> yep*
11:09 < hyper_ch> :)
11:09 < hyper_ch> krzie: https://diaspora.encroa.ch/uploads/images/scaled_full_8752658573b679b7b3fe.png
11:10 < ecrist> moved 6 of the 8 domains I manage from godaddy yesterday
11:10 < hyper_ch> to?
11:10 < ecrist> namecheap
11:10 < krzie> good work
11:11 < ecrist> the other two are domains I just manage, and can't just move them on a whim
11:11 < ecrist> they'll move next spring when they renew, though.
11:11 < hyper_ch> I have no godaddy domain :)
11:13 -!- zebedee3_ [~neil@027c034b.bb.sky.com] has quit [Ping timeout: 260 seconds]
11:30 -!- ObamaIsAGangsta [~newegggg@208.111.39.186] has quit [Ping timeout: 252 seconds]
11:31 -!- ObamaIsAGangsta [~newegggg@61.170.211.238] has joined #openvpn
11:32 <@vpnHelper> RSS Update - forum: Disconnected after inactivity <http://forums.openvpn.net/topic9501.html>
11:36 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
11:37 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
11:37 -!- mode/#openvpn [+o mattock] by ChanServ
11:38 <@vpnHelper> RSS Update - forum: New installation on Vmware esxi 5.0 - use appliance or not? <http://forums.openvpn.net/topic9499.html#p19063>
11:40 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Ping timeout: 248 seconds]
11:43 -!- mariachi [~mariachi@pa3-84-90-208-244.netvisao.pt] has joined #openvpn
11:44 < mariachi> !welcome
11:44 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:44 -!- chokesmaster [~chokesmas@bas8-sherbrooke40-2925090820.dsl.bell.ca] has quit []
11:52 < hyper_ch> hi mariachi
11:57 -!- kbarry [1899a731@gateway/web/freenode/ip.24.153.167.49] has joined #openvpn
11:59 < kbarry> I want to establish a persistant connections between two LAN's (2 seperate offices). I am thinking i can have 2 devices (routers probably running DD-wrt + OpenVPN)
12:03 < mariachi> hyper_ch: hey! I'm kind of baffled here, that's why I haven't asked anything yet hehe. My vpn used to work perfectly and today it doesn't. I switched wireless router, but all the vpn passthroughs are enabled like before. the config file hasn't changed. I don't control the server. I'll paste the output of openvpn in a minute
12:03 -!- mariachi [~mariachi@pa3-84-90-208-244.netvisao.pt] has quit [Quit: WeeChat 0.3.6]
12:04 < hyper_ch> !route
12:04 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
12:04 < hyper_ch> kbarry: read the above article
12:06 < kbarry> thanks for the link. reading.
12:06 -!- mariachi [~mariachi@pa3-84-90-208-244.netvisao.pt] has joined #openvpn
12:10 < mariachi> hyper_ch: http://pastebin.com/A42zsFsK I'm using arch linux, kernel 3.1.6 with tun built-in. For browsing I use privoxy+polipo if I connect using this config I can't access any site
12:10 < mariachi> I used to
12:12 < hyper_ch> Fri Dec 30 18:07:42 2011 us=751182 ERROR: Linux route add command failed: external program exited with error status: 2
12:12 < hyper_ch> and that's no config
12:14 < hyper_ch> !configs
12:14 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
12:14 -!- cali [~cali@unaffiliated/cali] has quit [Read error: Operation timed out]
12:15 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Ping timeout: 248 seconds]
12:16 -!- mariachi [~mariachi@pa3-84-90-208-244.netvisao.pt] has quit [Ping timeout: 244 seconds]
12:18 -!- mariachi [~mariachi@pa3-84-90-208-244.netvisao.pt] has joined #openvpn
12:19 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
12:31 -!- iDiytto [~diytto@72-24-33-63.cpe.cableone.net] has joined #openvpn
12:33 -!- spacedust [~info@unaffiliated/cosmicblue] has joined #openvpn
12:33 < spacedust> hi, openvpn is using BF-CBC 128bit cipher by default, is that strong enough for modern world stuff ? :)
12:35 < hyper_ch> what does Dr. Google tell you about it?
12:37 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Remote host closed the connection]
12:38 -!- mariachi [~mariachi@pa3-84-90-208-244.netvisao.pt] has quit [Quit: WeeChat 0.3.6]
12:40 < ObamaIsAGangsta> just use AES 256 there isn't any speed different on modern hardware
12:41 < hyper_ch> there is speed difference if your hardware supports aes-ni :)
12:42 < spacedust> ObamaIsAGangsta: i just left this unchanged and now looking to know more about it
12:42 < spacedust> hyper_ch: i have no idea if my hw supports that or not :) probably yes
12:42 < hyper_ch> spacedust: what cpu?
12:42 < hyper_ch> second gen i3/5/7?
12:43 < spacedust> hyper_ch: nope before that core2duo
12:43 < kbarry> hyper_ch I have actually read that document before. In the article each Lan behind the client/server was a different IP set (i dno't nkow the proper term). If i want to connect two lan's should they be different ranges? (10.10.2 and 10.10.3 for example)
12:43 < hyper_ch> then no aes-ni
12:43 < ObamaIsAGangsta> lol core2duo does not support aes-ni
12:43 < hyper_ch> kbarry: not sure what your trying
12:43 < hyper_ch> you can have different lans with same ips in the same subnet
12:43 < hyper_ch> I think
12:44 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
12:44 < ObamaIsAGangsta> i came here to ask about keepalive
12:44 < kbarry> i have a store, and a home. I'd like to be at home, on my wireless, and because i am connected to my lan at home, i can ping/remote into computers at work.
12:44 < ObamaIsAGangsta> i dont understand it... 
12:44 < ObamaIsAGangsta> keepalive 10 60.... each side pings eachother every 10 seconds?
12:44 < ObamaIsAGangsta> then sends a response?
12:44 < hyper_ch> kbarry: why not make each computer a vpn client?
12:45 < kbarry> if i make my at hmoe rouyter a client, and my at work router the server, 
12:46 < kbarry> wouldn't it allow any computer at home to access the work network?
12:46 < kbarry> In my mind i am thinking about when a foreign computer enters the network (At home) and i want to use it to access the work network.
12:46 < hyper_ch> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
12:46 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
12:47 < hyper_ch> the vpn creates a different subnet with own routing
12:47 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
12:47 < hyper_ch> you need to setup routing for the lan behind it otherwise it won't work
12:47 < hyper_ch> or something like that
12:47 < hyper_ch> but easiest route would be to make each computer a client in the vpn
12:47 < hyper_ch> IMHO
12:47 < hyper_ch> but that's only feasable for small networks
12:48 -!- iDiytto [~diytto@72-24-33-63.cpe.cableone.net] has quit [Ping timeout: 260 seconds]
12:48 < kbarry> ok. Question: Can OpenVPN be setup so that, say a friend brings a computer to my home, i can grap it, and without any files other than the openvpn client, i can get it connected to my work network?
12:48 < hyper_ch> kbarry: OR you use different subnets for home and work
12:49 < hyper_ch> kbarry: e.g. at home use 10.0.0.x
12:49 < hyper_ch> and at work use 10.0.1.x
12:49 < kbarry> why different subnets? I mean, why not the same subnet?
12:49 < hyper_ch> you need to route it
12:49 < hyper_ch> otherwise you can't access it
12:50 < kbarry> do i understand you to say that routing is required no matter what the subnets are? or only in the case that the subnets are the same?
12:50 < hyper_ch> with the routes commands you can tell your openvpn router that the subnet 10.0.1.x is behind the vpn tunnel
12:50 < hyper_ch> you need to have different subnets for routing
12:50 < hyper_ch> you can't have a machine at home with ip 10.0.0.5
12:50 < hyper_ch> and one at work with 10.0.0.5
12:50 < hyper_ch> how would your computer and the router know which one you want to access?
12:50 < ObamaIsAGangsta> maybe what he needs is tap
12:51 < kbarry> got it,
12:51 < ObamaIsAGangsta> dont need to bother with routes then
12:51 < hyper_ch> but if you have 10.0.0.x at home
12:51 < hyper_ch> and 192.168.0.x at work
12:51 < hyper_ch> those are different subnets
12:51 < kbarry> That is loud and clear. I guess i have always been confused about communication between different subnets.
12:51 < hyper_ch> I just prefer 10.0.x.y
12:52 < hyper_ch> that command in the server config "route 10.10.1.0 255.255.255.0" says
12:52 < kbarry> what if home were 10.0.0.1-10 and work were 10.0.0.11-20
12:52 < hyper_ch> that the subnet 10.10.1.x can be accessed through the tunX vpn tunnel
12:52 < ObamaIsAGangsta> do you think keepalive 10 30 is too low value
12:52 < hyper_ch> you probably could do that with the subnet mask
12:52 < hyper_ch> but IMHO it's simpler to have different subnets
12:52 < ObamaIsAGangsta> sorry to interject
12:53 < kbarry> Is openvpn configurable where all one needs is a computer running the client, the ip address, and credentials?
12:54 < kbarry> (no files transferred before hand_
12:54 < kbarry> between the client and the serevr)
12:54 -!- brian_ [~brian@pool-173-71-223-79.clppva.fios.verizon.net] has joined #openvpn
12:54 < hyper_ch> kbarry: there's tls-auth... that might do that but never used it
12:54 < hyper_ch> ObamaIsAGangsta: I use keepalive 10 180
12:54 < hyper_ch> which is default I think
12:55 < kbarry> as i understand it now, you need to setup each device with th server.
12:55 < hyper_ch> any reason why you want to change that?
12:55 < ObamaIsAGangsta> well, if the connection drops, the sooner it starts up again the better
12:55 < hyper_ch> kbarry: yes, or you route lans accordingly
12:55 < kbarry> ok.
12:55 < hyper_ch> how many computers at home?
12:55 < kbarry> So, device to device i need to setup the rout config,
12:55 < hyper_ch> how many computers at work?
12:55 < kbarry> 3-6
12:56 < hyper_ch> you use dhcp at home or work?
12:56 < kbarry> 7 at work, 5 or so at home
12:56 < ObamaIsAGangsta> am i right in saying that keepalive doesnt mean if the connection is idle, i.e open but no traffic... it means if the connection is dead
12:56 < ObamaIsAGangsta> as in no packets can pass
12:56 < kbarry> Both.
12:56 < ObamaIsAGangsta> right?
12:56 < hyper_ch> ObamaIsAGangsta: what does the man page say to this command?
12:57 < kbarry> hyper_ch, btw thanks for taking the time to answer my questions.
12:57 < hyper_ch> if you use on any subnet at home or work DHCP then it's simple to change subnet
12:57 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
12:57 < hyper_ch> just change it in the router
12:57 < ObamaIsAGangsta> i've read it 
12:57 < ObamaIsAGangsta> the man page makes it sound like, if i walk away from my computer for a coffee, then after 120 seconds the connection will restart
12:58 < ObamaIsAGangsta> because then there is no activity over the tunnel for 120 seconds
13:00 < ObamaIsAGangsta> anyway the man wasn't useful as it didnt say u need to specify keepalive on both server and client
13:00 < ObamaIsAGangsta> had it only on server and my connection kept dropping after extended periods of inactivity
13:01 < hyper_ch> I only have keepalive on the server
13:01 < hyper_ch> not in the clients
13:01 < hyper_ch> IIRC
13:03 <@vpnHelper> RSS Update - forum: Porting OpenVpn Client only <http://forums.openvpn.net/topic9184-30.html#p19064>
13:04 < ObamaIsAGangsta> windows is finiky, some configs dont get pushed from the server for whatever reason
13:04 < hyper_ch> why would anyone want to torture themselves with windows....
13:06 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has joined #openvpn
13:07 < Some_Person> Is there a way to make all programs except one go through the VPN?
13:08 -!- madsage [c7668431@gateway/web/freenode/ip.199.102.132.49] has quit [Ping timeout: 258 seconds]
13:08 -!- Netsplit *.net <-> *.split quits: jeev, +WebDawg, +rkantos, +Cr4zi3, pwrcycle, APTX, +|Mike|, noisebleed, master_of_master, dioz,  (+1 more, use /NETSPLIT to show all of them)
13:08 < spacedust> hyper_ch: i have no idea :)
13:08 < hyper_ch> Some_Person: can you bind that one program to an specific IP?
13:08 < hyper_ch> or interface?
13:08 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
13:08 -!- mode/#openvpn [+o raidz] by ChanServ
13:09 < Some_Person> hyper_ch: I don't know. I'll try to find out
13:10 < Some_Person> The program in question is a ZNC server
13:11 < ecrist> Some_Person: not with openvpn
13:11 < ecrist> you're asking about something called policy-based routing, and it's generally a function of a firewall
13:12 < kbarry> hyper_ch do you have any recommendations for devices to use as server and client (routers, Buffalo, linksys, etc?)
13:12 < ecrist> dell + freebsd  :)
13:15 -!- someperson [~Some_Pers@91.227.125.201] has joined #openvpn
13:15 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has quit [Read error: Connection reset by peer]
13:15 -!- someperson [~Some_Pers@91.227.125.201] has quit [Read error: Connection reset by peer]
13:16 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has joined #openvpn
13:16 -!- Netsplit *.net <-> *.split quits: Denial, +ppr, kbarry, @raidz, DarthGandalf, +shteyngart, TypoNe, Zimsky, @mattock, vocis,  (+111 more, use /NETSPLIT to show all of them)
13:19 -!- JackW [~jack@228.Red-95-127-57.staticIP.rima-tde.net] has quit [Remote host closed the connection]
13:22 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has joined #openvpn
13:22 -!- chantra [~chantra@ns353511.ovh.net] has joined #openvpn
13:22 -!- Gnewt [~vector@submarine.gnewt.at] has joined #openvpn
13:22 -!- mick_laptop [~mick@clamwin/admin/mickhome] has joined #openvpn
13:22 -!- _zero_ [~zero@noc.toile-libre.net] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv chantra Gnewt mick_laptop _zero_] by wolfe.freenode.net
13:22 -!- Blue_Ice [~Blue_Ice@unaffiliated/blue-ice/x-2052838] has joined #openvpn
13:22 -!- R-66Y [~nobody@elegua.za.net] has joined #openvpn
13:22 -!- GHAI [~joti@cthulhu-isp.net] has joined #openvpn
13:22 -!- JPeterson [HydraIRC@s213-103-209-64.cust.tele2.se] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv Blue_Ice R-66Y GHAI JPeterson] by wolfe.freenode.net
13:22 -!- deever [~deever@78.46.68.172] has joined #openvpn
13:22 -!- Essobi [~Essobi@74-128-55-37.dhcp.insightbb.com] has joined #openvpn
13:22 -!- Champi [Champi@rootshell.fr] has joined #openvpn
13:22 -!- rawplayer [~foo@2001:610:158:1020:216:3eff:fe64:6606] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv deever Essobi Champi rawplayer] by wolfe.freenode.net
13:22 -!- dxtr [5d080d72@unaffiliated/dxtr] has joined #openvpn
13:22 -!- bigon [bigon@ubuntu/member/bigon] has joined #openvpn
13:22 -!- ronnocol [~lance@2001:1868:214::bad:babe] has joined #openvpn
13:22 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv dxtr bigon ronnocol Fiouz] by wolfe.freenode.net
13:22 -!- openbsdnoob [~openbsdno@88.79.221.61] has joined #openvpn
13:22 -!- Agin [~Agin@greenzone.copyleft.no] has joined #openvpn
13:22 -!- mrsno_ [~sno@static.153.209.46.78.clients.your-server.de] has joined #openvpn
13:22 -!- _quadDamage [~EmperorTo@jaguar-2-red.claimlynx.com] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv openbsdnoob Agin mrsno_ _quadDamage] by wolfe.freenode.net
13:22 -!- fbh [fbh@unaffiliated/fbh] has joined #openvpn
13:22 -!- Santa_Claus [~JoeGazz84@TechEssentials/JoeGazz84] has joined #openvpn
13:22 -!- freaky[t] [~alpha@freakyonline.de] has joined #openvpn
13:22 -!- vpnHelper [~vpn@openvpn/bot/vpnHelper] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvo fbh Santa_Claus freaky[t] vpnHelper] by wolfe.freenode.net
13:22 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
13:22 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
13:22 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
13:22 -!- Nowak [nowak@warsaw.freeearthfoundation.com] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv krphop_ dvl havoc Nowak] by wolfe.freenode.net
13:22 -!- dazo_afk [dazo@openvpn/community/developer/dazo] has joined #openvpn
13:22 -!- inimino [~inimino@boshi.inimino.org] has joined #openvpn
13:22 -!- batrick [~batrick@batbytes.com] has joined #openvpn
13:22 -!- Ionic [ionic@ionic.de] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+ovvv dazo_afk inimino batrick Ionic] by wolfe.freenode.net
13:22 -!- fremo [~fremo@noc.toile-libre.net] has joined #openvpn
13:22 -!- tty234 [telex@gateway/shell/anapnea.net/x-fvlfjgbhsvenzion] has joined #openvpn
13:22 -!- novaflash [~novaflash@openvpn/user/novaflash] has joined #openvpn
13:22 -!- MrWGW [MrWGW@74.124.192.8] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv fremo tty234 novaflash MrWGW] by wolfe.freenode.net
13:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:22 -!- beerbro [~gustav@sockensaft.garagenwein.at] has joined #openvpn
13:22 -!- JodaZ [~joda@ns387141.ovh.net] has joined #openvpn
13:22 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv ScriptFanix beerbro JodaZ ppr] by wolfe.freenode.net
13:22 -!- Guest25224 [~caesay@socialshock.net] has joined #openvpn
13:22 -!- catsup [~d@ps38852.dreamhost.com] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vv Guest25224 catsup] by wolfe.freenode.net
13:22 -!- speakman [~daniel@unaffiliated/speakman] has joined #openvpn
13:22 -!- masch [~quassel@big.masch.it] has joined #openvpn
13:22 -!- __nolife [~Lirezh@83-64-53-66.kocheck.xdsl-line.inode.at] has joined #openvpn
13:22 -!- l0rd_hex [~rubit_man@S0106000024c61290.ed.shawcable.net] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv speakman masch __nolife l0rd_hex] by wolfe.freenode.net
13:22 -!- bragon [~Alexandre@81.93.247.165] has joined #openvpn
13:22 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
13:22 -!- JoeK [~Joseph@ip-66-228-36-238.makaiwell.com] has joined #openvpn
13:22 -!- zu_ [~zu@ks387228.kimsufi.com] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv bragon EvilJStoker JoeK zu_] by wolfe.freenode.net
13:22 -!- shteyngart [thumper@i.dont.get.mad.i.get.stabby.net] has joined #openvpn
13:22 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:22 -!- Mp5- [~Mp5@99-59-223-143.lightspeed.jcvlfl.sbcglobal.net] has joined #openvpn
13:22 -!- brad[] [~brad@TMA-1.brad-x.com] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv shteyngart cyberspace- Mp5- brad[]] by wolfe.freenode.net
13:22 -!- LuckyY [~LuckY@188.142.61.123] has joined #openvpn
13:22 -!- rooth [rooth@ge.mig.en.redfox.nu] has joined #openvpn
13:22 -!- TJNII [~TJNII@tjnii.com] has joined #openvpn
13:22 -!- ciphergoth [~paul@host238.lshift.net] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvvv LuckyY rooth TJNII ciphergoth] by wolfe.freenode.net
13:22 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
13:22 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
13:22 -!- vlt [~dm@suez.activ-job.com] has joined #openvpn
13:22 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has joined #openvpn
13:22 -!- Dougy [me@tech.qsi.net] has joined #openvpn
13:22 -!- vereteran [~vereteran@static.88-198-170-117.clients.your-server.de] has joined #openvpn
13:22 -!- RichardBronosky_ [~RichardBr@slice1.bronosky.com] has joined #openvpn
13:22 -!- frojnd [~frojnd@86.58.21.55] has joined #openvpn
13:22 -!- Deathvalley122 [~Death@localtel.eagleits.net] has joined #openvpn
13:22 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
13:22 -!- vect0rx [vectorx@countercultured.net] has joined #openvpn
13:22 -!- nb [~nb@fedora/znc.nb] has joined #openvpn
13:22 -!- agagag [~anton@eudaimonia.goto10.org] has joined #openvpn
13:22 -!- fahadsadah [fahad@unaffiliated/fahadsadah] has joined #openvpn
13:22 -!- scyld [~operacyjn@unaffiliated/wasyl] has joined #openvpn
13:22 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
13:22 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
13:22 -!- evilhackerdude [u1451@gateway/web/irccloud.com/x-qzqfuzytiymrpupv] has joined #openvpn
13:22 -!- lusis [u2537@gateway/web/irccloud.com/x-wokjlyqjjijogezt] has joined #openvpn
13:22 -!- CaBa [caba@unique-inter.net] has joined #openvpn
13:22 -!- dkr [~dkr@67.132.255.16] has joined #openvpn
13:22 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
13:22 -!- matsim [~matsim@dilatino.soleus.nu] has joined #openvpn
13:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:22 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
13:22 -!- Kateon [482392@xs8.xs4all.nl] has joined #openvpn
13:22 -!- krzee [krzee@openvpn/community/support/krzee] has joined #openvpn
13:22 -!- c1de0x [~c1de0x@208.111.44.254] has joined #openvpn
13:22 -!- Novae [~Novae@unaffiliated/novae] has joined #openvpn
13:22 -!- mocas [~mocas@87.196.121.23] has joined #openvpn
13:22 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
13:22 -!- cron2 [~gert@openvpn/community/developer/cron2] has joined #openvpn
13:22 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
13:22 -!- Beave [~champ@bundy.vistech.net] has joined #openvpn
13:22 -!- chaot_s [~home-fron@d54C408EC.access.telenet.be] has joined #openvpn
13:22 -!- pranq [~pranq@unaffiliated/contempt] has joined #openvpn
13:22 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
13:22 -!- wedge [lordsilenc@bigfoot.xh.se] has joined #openvpn
13:22 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
13:22 -!- sled-dog [~luser@65-124-95-55.dia.static.qwest.net] has joined #openvpn
13:22 -!- DarthGandalf [~Vetinari@znc/developer/DarthGandalf] has joined #openvpn
13:22 -!- tjz [~pc@unaffiliated/tjz] has joined #openvpn
13:22 -!- _julian_ [~quassel@hmbg-4d069d8a.pool.mediaWays.net] has joined #openvpn
13:22 -!- Tick-Tock [~Tick-Tock@2607:f358:1:fed5:22:0:b683:4295] has joined #openvpn
13:22 -!- zeshoem [~zee@bas1-toronto46-1177856379.dsl.bell.ca] has joined #openvpn
13:22 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has joined #openvpn
13:22 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
13:22 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:22 -!- caemir [~caemir@unaffiliated/caemir] has joined #openvpn
13:22 -!- Zimsky [~Zimsky@rozznet.net] has joined #openvpn
13:22 -!- forgotten [forgotten@is.undroppable.co.uk] has joined #openvpn
13:22 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:22 -!- zalzice [~zalzice@25.79-160-109.customer.lyse.net] has joined #openvpn
13:22 -!- bauruine_ [~stefan@2001:8e0:100b:dead:2677:3ff:fe1a:2078] has joined #openvpn
13:22 -!- corretico [~luis@190.211.94.6] has joined #openvpn
13:22 -!- ObamaIsAGangsta [~newegggg@61.170.211.238] has joined #openvpn
13:22 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
13:22 -!- spacedust [~info@unaffiliated/cosmicblue] has joined #openvpn
13:22 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:22 -!- brian_ [~brian@pool-173-71-223-79.clppva.fios.verizon.net] has joined #openvpn
13:22 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
13:22 -!- master_of_master [~master_of@p57B55733.dip.t-dialin.net] has joined #openvpn
13:22 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has joined #openvpn
13:22 -!- dioz [~dioz@2001:470:1f11:12a9::1] has joined #openvpn
13:22 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
13:22 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:22 -!- jeev [1004@unaffiliated/jeev] has joined #openvpn
13:22 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
13:22 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+oovv mattock raidz |Mike| Cr4zi3] by wolfe.freenode.net
13:22 -!- WebDawg [~WebDawg@officialg0d.com] has joined #openvpn
13:22 -!- Haraken [~ryuk@unaffiliated/haraken] has joined #openvpn
13:22 -!- rkantos [~robin2@109.169.55.199] has joined #openvpn
13:22 -!- ServerMode/#openvpn [+vvv WebDawg Haraken rkantos] by wolfe.freenode.net
13:22 -!- Netsplit *.net <-> *.split quits: +catsup, forgotten, +ciphergoth, +bragon, Denial, vocis, @mattock, +ppr
13:22 -!- JackW [~jack@228.Red-95-127-57.staticIP.rima-tde.net] has joined #openvpn
13:22 -!- Netsplit over, joins: @mattock, forgotten, Denial, vocis, +ciphergoth, +bragon, +catsup, +ppr
13:23 -!- Netsplit *.net <-> *.split quits: Some_Person, +Gnewt, SigmaProjects, +TJNII, +__nolife, +chantra, Novae, cron2, scyld, pranq,  (+9 more, use /NETSPLIT to show all of them)
13:25 -!- Netsplit over, joins: cron2, +novaflash, +chantra, JackW, Some_Person, zalzice, pranq, chaot_s, SigmaProjects, Novae (+9 more)
13:27 -!- [1]SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has joined #openvpn
13:27 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has quit [Read error: Connection reset by peer]
13:28 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
13:28 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
13:28 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has joined #openvpn
13:29 -!- SigmaProjects [~SigmaProj@cpe-66-75-87-13.socal.res.rr.com] has quit [Ping timeout: 240 seconds]
13:29 -!- [1]SigmaProjects is now known as SigmaProjects
13:31 -!- noisebleed [~quassel@gentoo/contributor/noisebleed] has quit [Remote host closed the connection]
13:33 -!- SOG [~SOG@168.70.16.99] has joined #openvpn
13:35 <@vpnHelper> RSS Update - forum: Windows 7 Client question <http://forums.openvpn.net/topic9502.html>
13:52 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
13:52 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
14:09 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
14:10 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Read error: Connection reset by peer]
14:39 < spacedust>  WARNING: 'link-mtu' is used inconsistently,
14:39 < spacedust> WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CFB', remote='cipher BF-CBC'
14:39 < spacedust> how the heck  i've set both to AES-128-CFB
14:41 < spacedust> Assertion failed at crypto.c:162
14:45 -!- bwallen [~bwallen@static-108-28-88-66.washdc.fios.verizon.net] has joined #openvpn
14:46 < bwallen> How can I make all of my traffic go over my openvpn tunnel? RIght now only traffic that is destined for the remote network goes over the tunnel.
14:50 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
14:52 -!- SOG [~SOG@168.70.16.99] has quit [Quit: I will be back!]
14:58 -!- chaot_s [~home-fron@d54C408EC.access.telenet.be] has quit []
15:24 -!- zebedee3 [~neil@2001:470:1f09:436:8ea9:82ff:fea9:e604] has joined #openvpn
15:27 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 276 seconds]
15:30 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Ping timeout: 248 seconds]
15:41 -!- zebedee3_ [~neil@2001:470:1f09:436:8ea9:82ff:fea9:e604] has joined #openvpn
15:47 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
16:23 < EugeneKay> !def1
16:23 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:23 < EugeneKay> bwallen ^
16:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Ping timeout: 252 seconds]
16:24 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
16:26 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
16:28 -!- spozen [~spozen@63-25-45-175.38cloud.com] has joined #openvpn
16:30 < spozen> Hi, quick question: is it possible to add "push" line to the client configuration file? I trying to get split tunneling to work you see..
16:31 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:32 < EugeneKay> According to the man page, no.
16:33 < EugeneKay> You can play jiggery-pokery with --up scripts
16:34 < spozen> ok where do i find futher info on that? Like documentation etc..
16:48 -!- pythonirc101 [~pythonirc@c-68-63-40-199.hsd1.fl.comcast.net] has joined #openvpn
16:50 < EugeneKay> Man page tells you what variables are available. Most of it you have to figure out on your own.
16:50 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455-15.html#p19067>
16:50 < pythonirc101> I've never used openvpn. Here is my problem. I've many laptops, L1, L2, L3 ... Ln -- all of them change IPs/networks (and all of them are running local webservers). I've a central server C that runs a webserver as well.  I would like to connect http://L?.C.com to the local webservers sitting on the laptops. Is this something that is doable using openvpn? 
16:52 < EugeneKay> pythonirc101 - you'd like to make http://COMMON-NAME.example.com available by reverse-proxying from the central server? Sure.
16:52 < EugeneKay> !static
16:52 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
16:53 < EugeneKay> Use static addressing for the VPN clients, which is based upon the common-name field in your PKI, then set up your Apache ProxyReverse to use those addresses.
16:53 < EugeneKay> The actual subdomain blah.example.com should point to the central server, of course.
16:53 < pythonirc101> EugeneKay: indeed. So openvpn will give these laptops a fixed ip that the server can use for reverse proxying?
16:53 < EugeneKay> A fixed IP on the VPN, es.
16:54 < pythonirc101> is it easy to download and install openvpn clients on these laptops without user interaction?
16:54 < EugeneKay> If you're using a /24 for your VPN subnet(and --topology subnet), which is fairly standard, then I would recommend making your ifconfig-pool be the first halfo f the block, and your static pool the second half.
16:54 < EugeneKay> No different than any other software package. What OS?
16:54 < pythonirc101> I've to support windows/linux/mac
16:55 -!- spozen [~spozen@63-25-45-175.38cloud.com] has quit [Ping timeout: 255 seconds]
16:55 < EugeneKay> You poor git.
16:55 < pythonirc101> I know... :( How many machines can one central server support in such a case? is this solution scalable?
16:55 < EugeneKay> Usually ends up limited by bandwidth before CPU.
16:55 < EugeneKay> !gigabit
16:55 <@vpnHelper> RSS Update - forum: Wrong routes set to the client <http://forums.openvpn.net/topic9482.html#p19068>
16:55 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
16:56 < EugeneKay> Closest thing to a scaling doc I know of ^
16:56 -!- spozen [~spozen@90-227-185-46-no129.tbcn.telia.com] has joined #openvpn
16:57 < pythonirc101> lets say I spend time and configure such a server...what if a client is already using openvpn...is it easy for me to automatically modify the settings so that he gets a static ip on my network as well?
16:58 < EugeneKay> Sure, it's all server-side.
16:58 < EugeneKay> All that static ddressing requires is a ccd entry.
16:58 < EugeneKay> !ccd
16:58 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
16:58 -!- rawplayer [~foo@2001:610:158:1020:216:3eff:fe64:6606] has quit [Ping timeout: 252 seconds]
16:59 < pythonirc101> EugeneKay: is there any other tool that is easier to work with for this problem that you can think of ?
16:59 < EugeneKay> Easier? No. Harder? Plenty.
17:00 < pythonirc101> what are the hard options I have? 
17:01 < EugeneKay> Something involving cross-platform bash scripting and dynamic DNS updates.
17:01 < EugeneKay> Or you could reverse SSH tunnel
17:01 < pythonirc101> EugeneKay: with dynamic dns updates, isn't it true that one has to fix routers at times -- in my case, my client might be sitting in a starbucks with a fixed router
17:01 < EugeneKay> It's a stupid option because you'd need to have a public IP for all the clients ;-)
17:02 < pythonirc101> EugeneKay: ssh tunneling is actually easier to do...the only problem I have is that I've to give these clients - one login per user on my machine...
17:02 < EugeneKay> And that's why THAT one is stupid.
17:02 < pythonirc101> even with openvpn, I've to give some kind of key, isn't it?
17:03 < EugeneKay> It's PKI based, but that's all the access they get.
17:03 < EugeneKay> YOu'll want to firewall the openvpn interface appropriately, but it's no more access than they would get over eth0
17:03 < EugeneKay> Except possibly if they find a security exploit in openvpn. Unlikely, but possible.
17:04 < pythonirc101> how much work am I looking at if I try to do it using openvpn?
17:05 < EugeneKay> If you're an experienced admin, maybe an hour or two.
17:05 < EugeneKay> Biggest setup step is gonna be getting the client machines working with it.
17:05 < pythonirc101> where is the windows installer that I will give to my clients?
17:05 < EugeneKay> !download
17:05 <@vpnHelper> "download" is (#1) http://www.openvpn.net/download to download OpenVPN or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html
17:05 < EugeneKay> !osx
17:05 <@vpnHelper> "osx" is (#1) http://www.viscosityvpn.com/ (PAY) or (#2) http://www.tunnelblick.net/ (FREE)
17:06 < pythonirc101> also, note that I won't be there for the install on the clients...I'm installing a lot of things on the client using an installer...and would like to add this to that set...hope that is doable
17:06 < EugeneKay> Sure, if you know how to do installer scripting.
17:06 < EugeneKay> For automagic start, OpenVPN includes a Windows Service
17:07 < EugeneKay> When the Service starts, it automagically runs any configs it finds in program files\openvpn\config\
17:07 < pythonirc101> so that's where I'll put my config -- or if it exists, modify it?
17:07 < EugeneKay> By default, only thing in that folder is a README file
17:08 < EugeneKay> You'll want to drop the client.ovpn, client.crt, client.key, tls-auth.key if you're using it, and ca.crt into that folder
17:15 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Ping timeout: 248 seconds]
17:17 <@vpnHelper> RSS Update - forum: [Help] Problem To Connect to the Server <http://forums.openvpn.net/topic9503.html>
17:18 -!- JackW [~jack@228.Red-95-127-57.staticIP.rima-tde.net] has quit [Remote host closed the connection]
17:18 -!- JackW [~jack@228.Red-95-127-57.staticIP.rima-tde.net] has joined #openvpn
17:35 <@vpnHelper> RSS Update - forum: OpenVPN+Shorewall. Internal routing OK, external fails <http://forums.openvpn.net/topic9504.html>
17:48 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has quit [Ping timeout: 252 seconds]
17:50 -!- Novae [~Novae@unaffiliated/novae] has quit [Ping timeout: 240 seconds]
17:50 < JackW> whee, openvpn over udp, polip on the client laptop and squid on my lan, have almost made this 128/64kbit 3g connection usable for web browsing :)
17:50 -!- Novae [~Novae@lightblast.info] has joined #openvpn
17:50 -!- Novae [~Novae@lightblast.info] has quit [Changing host]
17:50 -!- Novae [~Novae@unaffiliated/novae] has joined #openvpn
17:55 -!- bigpaws [~bigpaws@c-68-37-125-150.hsd1.nj.comcast.net] has joined #openvpn
18:02 -!- zebedee3_ [~neil@2001:470:1f09:436:8ea9:82ff:fea9:e604] has quit [Ping timeout: 260 seconds]
18:02 -!- zebedee3 [~neil@2001:470:1f09:436:8ea9:82ff:fea9:e604] has quit [Ping timeout: 260 seconds]
18:24 -!- JackW1 [~jack@228.Red-95-127-57.staticIP.rima-tde.net] has joined #openvpn
18:24 -!- JackW [~jack@228.Red-95-127-57.staticIP.rima-tde.net] has quit [Remote host closed the connection]
18:35 <@vpnHelper> RSS Update - forum: automatic reconnect potable openvpn <http://forums.openvpn.net/topic9505.html>
18:42 <@vpnHelper> RSS Update - forum: automatic reconnect potable openvpn <http://forums.openvpn.net/topic9505.html#p19072>
18:42 -!- spozen [~spozen@90-227-185-46-no129.tbcn.telia.com] has quit [Ping timeout: 255 seconds]
18:42 -!- spozen [~spozen@63-25-45-175.38cloud.com] has joined #openvpn
18:46 -!- fokkle [~fokkle@adsl-74-178-141-89.sdf.bellsouth.net] has joined #openvpn
18:47 < fokkle> does anyone here know about setting up gateway redirect?  I had it working on a vista client but no luck so far on ubuntu.
18:49 < fokkle> the server hasn't changed, only the client, and the client has the same config file, cert, priv key and ca.
18:53 < fokkle> previously (on the vista client), packet cap showed all http requests going to the vpn server.
18:53 < fokkle> now (though the vpn works), http requests going directly to the web servers--not redirected.
18:53 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 240 seconds]
18:54 < fokkle> i'm running openvpn 2.1 on ubuntu 10.04 lts 64-bit (not sure those details help, but covering the bases)
19:05 -!- spozen [~spozen@63-25-45-175.38cloud.com] has quit [Ping timeout: 252 seconds]
19:07 -!- spozen [~spozen@90-227-185-46-no129.tbcn.telia.com] has joined #openvpn
19:08 < EugeneKay> ip -4 route on the client
19:10 < fokkle> !paste
19:10 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
19:10 < fokkle> http://pastebin.com/vGQEScKU
19:13 -!- _julian [~quassel@hmbg-4d06930c.pool.mediaWays.net] has joined #openvpn
19:14 -!- spozen [~spozen@90-227-185-46-no129.tbcn.telia.com] has quit [Ping timeout: 240 seconds]
19:14 -!- spozen [~spozen@63-25-45-175.38cloud.com] has joined #openvpn
19:16 <@vpnHelper> RSS Update - forum: automatic reconnect potable openvpn <http://forums.openvpn.net/topic9505.html#p19073>
19:16 -!- _julian_ [~quassel@hmbg-4d069d8a.pool.mediaWays.net] has quit [Ping timeout: 268 seconds]
19:19 < forgotten> do i need to enable any special options on my system for it to accept openvpn connections?  all i can get is:  read UDPv4 [ECONNREFUSED]: Connection refused (code=111)   :(
19:19 < fokkle> forgotten, this is the server? listening on the default port (1194)?  make sure you have that port open on your firewall.
19:20 < fokkle> are you testing locally or remotely?  where is the client relative the server?
19:21 < forgotten> fokkle: I have it setup for UDP 1194 forwarding to the 192.168.1.17 server address
19:21 < forgotten> from my netgear router
19:22 < forgotten> does the connection have to come from outside ur network?
19:22 < fokkle> forgotten, ok, that's fine.  how about the firewall?
19:22 < forgotten> don't have a firewall running to my knowledge
19:22 < fokkle> you can connect loopback (from local).
19:22 <+TJNII> You won't be able to access your server uting your public IP from within your network.
19:22 <+TJNII> It is a limitation of your router.
19:23 < fokkle> TJNII, what makes you say that?  i've tested my vpn many times from local.
19:23 < forgotten> can it come from a 192.168* address tho? not anything public
19:23 < fokkle> never had a problem with it.
19:23 < fokkle> the originating local ip doesn't matter.
19:23 <+TJNII> fokkle: Because most routers will not forward the request if it comes from within the same subnet you are forwarding to.
19:23 < forgotten> cool
19:24 < forgotten> do i need to have ipv4 forwarding enabled in sysctl.conf ?
19:24 < fokkle> TJNII, i didn't know that.  i've only done it with 2 routers.
19:24 <+TJNII> fokkle: I've never had it work with consumer grade hardware.
19:25 -!- someperson [~Some_Pers@99-99-216-248.lightspeed.hstntx.sbcglobal.net] has joined #openvpn
19:25 < fokkle> cisco linksys wrt54g
19:25 < forgotten> so i should connect to connect from an outside source then TJNII ?
19:25 < fokkle> that's my current router.
19:25 < forgotten> before i say it doesn't work
19:25 < forgotten> try to connect**
19:25 < fokkle> forgotten, from what he says it sounds like a good idea--coffee shop...
19:25 < forgotten> wow i must be tired
19:25 < forgotten> naa f coffe shop
19:26 < forgotten> Android ftw
19:26 < fokkle> do you want to post the log from the server?
19:26 < forgotten> where is the log kept?
19:26 <+TJNII> forgotten: To test the entirety of your setup, yes.  That is the best route.  You should be able to connect via the server's 192.168 ip as well.
19:27 < forgotten> TJNII: wel shucks.. i must be doing something wrong then.. i'm setting up the VPN to be 10.10.10.* as tun0 interfaces on both client/server
19:27 < forgotten> .1 and .2
19:27 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has quit [Ping timeout: 240 seconds]
19:27 < fokkle> not sure where the log will be on your system but how about the output from the client?
19:28 < forgotten> 1 sec
19:28 <+TJNII> forgotten: Pastebin your configs
19:29 < forgotten> http://www.wyliebayes.com/client.txt
19:29 -!- someperson is now known as Some_Person
19:29 -!- Some_Person [~Some_Pers@99-99-216-248.lightspeed.hstntx.sbcglobal.net] has quit [Changing host]
19:29 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has joined #openvpn
19:29 < forgotten> is client output
19:30 < fokkle> forgotten, you don't have to upload output.logs etc  you can use pastebin.com, etc.  fyi
19:30 < forgotten> never done that before
19:31 < fokkle> just makes it easier for irc  ;)
19:31 < fokkle> well, it looks like it's being dropped.
19:31 < fokkle> are you sure you don't have firewall blocking at router or vpn server?
19:31 <+TJNII> forgotten: On your server, check that openvpn is running (pgrep openvpn) and your firewall rules.  (iptables -L)
19:31 < forgotten> http://pastebin.com/BXbe9XN2 
19:32 < forgotten> iptables -L shows nothing loading
19:32 < forgotten> loaded*
19:32 < forgotten> im running it like this so i can watch it.. root@windwalker:/etc/openvpn# openvpn --config /etc/openvpn/tun0.conf -verb 6
19:32 < forgotten> so i know its running.. same on client
19:34 <+TJNII> Hmm... I don't currently have access to my config to compare, but don't you need a "server" directive in your server's config?
19:34 < fokkle> TJNII, that's right--i was just looking my own configs--"server" on the server conf--"client" in the client conf
19:35 < forgotten> hrmm yes i think ur right!
19:36 < fokkle> nothing else jumping out at me yet.  this is a little different from mine because i'm using ssl instead of static keys....
19:36 < fokkle> try it.
19:36 < forgotten> should that be the 192.168 or 10.10 ?
19:37 < fokkle> all you have to put is "server" (no quotes) on a line by itself in the server conf
19:37 < fokkle> like wise "client" in the client conf.
19:37 -!- brian_ [~brian@pool-173-71-223-79.clppva.fios.verizon.net] has quit [Quit: Leaving]
19:37 < fokkle> no ip.
19:38 < fokkle> may not solve it but i think he's right it should be there.
19:38 < forgotten> Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/tun0.conf:2: server (2.1.3)
19:39 < fokkle> you're getting that for the server line?  it's on line 2?
19:39 <+TJNII> server needs option
19:39 <+TJNII> *options
19:39 <+TJNII> See the manual
19:39 < forgotten> ya lookin it up
19:40 < fokkle> forgotten, i dug out a config file (not mine)....
19:41 < fokkle> should be "server [server ip] [subnet mask]
19:41 < fokkle> so i was wrong :P
19:42 < forgotten> tried that too but i need way more i think, needs ssh keys and such, can't get away with just a static key
19:45 <+TJNII> Yes, you need more keys.
19:46 <+TJNII> At the minimum the server needs a public/private key pair and (iirc) a DH key.
19:47 < EugeneKay> !pki
19:47 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
19:47 <@vpnHelper> signed specially as a server (see !servercert)
19:47 <+TJNII> forgotten: I recommend you read the OpenVPN How-To.
19:48 < pythonirc101> When one uses tunnelr -- what does one get? can one build a client pool using tunnelr? is anyone using tunnerlr here?
19:49 < forgotten> i find the openvpn howto extremely confusing see i didn't build it from source and have none of the little ./scripts they keep referring too
19:49 -!- fokkle [~fokkle@adsl-74-178-141-89.sdf.bellsouth.net] has left #openvpn ["Ex-Chat"]
19:49 <+TJNII> forgotten: What distro?
19:49 < forgotten> debian
19:49 <+TJNII> It didn't install all that as documentation?
19:50 < EugeneKay> Yes, you do. They're in.... /usr/share/openvpn/
19:50 < EugeneKay> I do believe
19:50 < forgotten> root@windwalker:/usr/share/openvpn# ls
19:50 < forgotten> verify-cn
19:50 < EugeneKay> !easy-rsa
19:51 < EugeneKay> !certs
19:51 <@vpnHelper> "certs" is (#1) use !easy-rsa-unix for easy-rsa or (#2) use !ssl-admin for ecrists copy of ssl-admin to make and manage your certs
19:51 < EugeneKay> !easy-rsa-unix
19:51 <@vpnHelper> "easy-rsa-unix" is http://www.freebsddiary.org/openvpn-easy-rsa.php for a writeup of making certs with easy-rsa in fbsd, only the dir changes for linux
19:51 < EugeneKay> No idea where the Deb package would put easy-rsa if not /usr/share/openvpn
19:52 < pythonirc101> EugeneKay: can we use tunner.com for the stuff that I was asking you earlier? What are the pros and cons of using them -- if at all we can use them
19:52 < EugeneKay> Their website doesn't load with NoScript on, so that's one black mark against them right off the bat
19:52 <+TJNII> /usr/share/doc/openvpn/examples/easy-rsa/
19:52 <+TJNII> forgotten: ^
19:52 < EugeneKay> And once it does load I get a page about domain parking at googlesyndication
19:53 < EugeneKay> So I'm gonna go with "No, you cannot"
19:53 <+TJNII> http://packages.debian.org/squeeze/amd64/openvpn/filelist
19:53 <@vpnHelper> Title: Debian -- Filelist of package openvpn/squeeze/amd64 (at packages.debian.org)
19:53 < pythonirc101> EugeneKay: https://www.tunnelr.com/
19:53 <@vpnHelper> Title: Tunnelr VPN Service Provider - SSH Tunnels - VPN Tunnels (at www.tunnelr.com)
19:53 < EugeneKay> Ah, tunnelr. Not tunner ;-)
19:53 < EugeneKay> Makes a difference
19:54 < forgotten> this is the Howto i was following to make the server
19:54 < EugeneKay> They look like a vanilla VPN redriect provider. Not the sort of thing you're after.
19:54 < forgotten> with Static keys
19:54 < pythonirc101> yes, sorry for the typo
19:54 < forgotten> http://wiki.debian.org/HowTo/openvpn
19:54 <@vpnHelper> Title: HowTo/openvpn - Debian Wiki (at wiki.debian.org)
19:55 < pythonirc101> EugeneKay: if there is a vanilla VPN that I can provide to my clients -- each getting a static/dynamic/dhcp ip -- I'm set, right?
19:55 < EugeneKay> Well, static would be best :-p
19:55 < forgotten> yes it would be for me
19:56 < pythonirc101> my main server will just reverse proxy on them?
19:56 < forgotten> the Man page says its best for easy config as well
19:58 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
19:59 < EugeneKay> It'd be best if you centralize it to your server - no external service dependencies for one, and less lag for another
20:00 < pythonirc101> EugeneKay: if I get 100 users...my server will croak, isn't it?
20:00 < pythonirc101> or say 1000 for that matter...
20:00 < forgotten> im only going to have myself lol not to worried
20:00 < pythonirc101> As far as I understand tunnelr will kill me as well in that case...
20:01 < EugeneKay> You can add another server with round-robin balancing
20:02 < pythonirc101> EugeneKay: are there ever any applications that install openvpn as part of themselves and use it ? 
20:02 < forgotten> LOOOOOOL
20:02 < EugeneKay> Not that I'm familiar with
20:02 < forgotten> you guys will never believe what it was
20:02 < EugeneKay> forgotten - Hitler reincarnated as a party balloon?
20:03 < forgotten> my mom 0day'd me and changed my config
20:03 < forgotten> no just playin
20:03 < forgotten> remote 192.168.1.17     instead of liquid.wyliebayes.com
20:04 < forgotten> might need to change this to get in from the outside world tho i think
20:14 -!- Denial [Denial@drgi.co.uk] has quit []
20:21 -!- magicblaze007 [~magicblaz@c-68-63-40-199.hsd1.fl.comcast.net] has joined #openvpn
20:22 < forgotten> doesn't work 3g =/   would an Nmap scan show that port open if server is running?
20:26 < forgotten> whoot fixed :D
20:35 < forgotten> so once ur connected to the VPN from the outside world and I can ping 10.10.10.1  then i can force my default route to go through that interface on the local network?  it will get all its routing info from the server?
20:35 < forgotten> through the tun0 interface
21:07 -!- vocis [~vocis@gateway/tor-sasl/voidzero] has left #openvpn []
21:29 -!- lusis [u2537@gateway/web/irccloud.com/x-wokjlyqjjijogezt] has quit [Excess Flood]
21:29 -!- lusis [u2537@gateway/web/irccloud.com/x-qssekjifawkonkrd] has joined #openvpn
22:13 -!- pythonirc101 [~pythonirc@c-68-63-40-199.hsd1.fl.comcast.net] has left #openvpn []
22:20 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
22:54 -!- corretico [~luis@190.211.94.6] has quit [Remote host closed the connection]
23:01 -!- forgotten [forgotten@is.undroppable.co.uk] has left #openvpn []
23:03 -!- JackW1 [~jack@228.Red-95-127-57.staticIP.rima-tde.net] has quit [Quit: Konversation terminated!]
23:25 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Read error: Operation timed out]
23:28 -!- ObamaIsAGangsta [~newegggg@61.170.211.238] has quit []
23:28 -!- babble [~coyote@unaffiliated/coyote] has joined #openvpn
23:29 -!- minorhero [~pparadias@69.165.194.156] has joined #openvpn
23:41 -!- vect0rx [vectorx@countercultured.net] has quit [Quit: ircII EPIC4-2.10.1 -- Are we there yet?]
23:47 -!- minorhero [~pparadias@69.165.194.156] has quit [Remote host closed the connection]
23:48 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
23:58 < Dougy> krzie: brock lesnar
--- Day changed Sat Dec 31 2011
00:53 < jeev> fart bresner
00:54 < EugeneKay> Trent Reznor
00:54 < jeev> windows 3.11
00:58 < EugeneKay> I remember Doom on that
01:16 < jeev> i remember "AH-64D LONGBOW"
01:18 < jeev> commache 3 was it ?
01:18 < jeev> anyway
01:18 < jeev> i need sl33p
01:25 -!- me345 [~me345@adsl-71-131-128-130.dsl.sntc01.pacbell.net] has joined #openvpn
01:29 -!- Guest25224 is now known as caesay
01:29 -!- caesay [~caesay@socialshock.net] has quit [Changing host]
01:29 -!- caesay [~caesay@unvanquished/associate/caesay] has joined #openvpn
01:29 -!- ServerMode/#openvpn [+v caesay] by sendak.freenode.net
01:38 -!- babble [~coyote@unaffiliated/coyote] has quit [Quit: Leaving]
01:43 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Remote host closed the connection]
02:04 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
02:04 -!- mode/#openvpn [+o mattock] by ChanServ
02:14 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
02:39 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Quit: Ex-Chat]
03:04 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has quit [Quit: UnterPerro]
03:33 -!- me345 [~me345@adsl-71-131-128-130.dsl.sntc01.pacbell.net] has quit [Read error: Connection reset by peer]
03:35 -!- JackW [~jack@11.Red-2-142-27.dynamicIP.rima-tde.net] has joined #openvpn
03:44 <@vpnHelper> RSS Update - forum: OpenVPN+Shorewall. Internal routing OK, external fails <http://forums.openvpn.net/topic9504.html#p19074>
03:50 <@vpnHelper> RSS Update - forum: OpenVPN+Shorewall. Internal routing OK, external fails <http://forums.openvpn.net/topic9504.html#p19076> || Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455-15.html#p19075>
03:50 -!- aegidos [~admin@p54B5B7DC.dip.t-dialin.net] has joined #openvpn
03:51 < aegidos> good morning
03:52 < aegidos> someone familiar with DNS problems when using openvpn to connect from the outside? connecting network drives inside my LAN is possible but i always get page timeouts when browsing :-( changing resolve.conf didn't work for me: http://www.macuser.de/forum/f15/openvpn-dns-problem-253707/
03:53 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
03:53 < aegidos> i can access my network from the outside, so dyndns works.
03:53 < aegidos> now im in the "inside" of my LAN and want to connect via Tunnelblick, but DNS doesn't work
03:53 < aegidos> some ideas?
03:56 <@vpnHelper> RSS Update - forum: OpenVPN+Shorewall. Internal routing OK, external fails <http://forums.openvpn.net/topic9504.html#p19077>
04:06 -!- Serious_Sam [kvirc@shpd-95-53-197-174.vologda.ru] has joined #openvpn
04:08 < Serious_Sam> Hi there! The problem is following. I have OpenVPN installed on my Windows XP SP3. And sometimes when my Windows starts my tun interface hangs in state "Acquiring network address". What is the reason of this behaviour?
04:12 < hyper_ch> I'd blame Windows
04:16 -!- pdr44 [~luky@88-117-49-89.adsl.highway.telekom.at] has joined #openvpn
04:17 < pdr44> hi, i have a problem i the openvpn icon in windows is green, but i can only reach the 10.8.0.1 linux server
04:18 < pdr44> www.myip.is says that i use my ip from my ISP
04:18 < pdr44> not the ip adress from the remote server
04:18 < hyper_ch> !def1
04:18 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
04:19 -!- master_of_master [~master_of@p57B55733.dip.t-dialin.net] has quit [Read error: Operation timed out]
04:23 -!- master_of_master [~master_of@p57B54453.dip.t-dialin.net] has joined #openvpn
04:31 -!- JackW1 [~jack@11.Red-2-142-27.dynamicIP.rima-tde.net] has joined #openvpn
04:31 -!- JackW [~jack@11.Red-2-142-27.dynamicIP.rima-tde.net] has quit [Remote host closed the connection]
04:37 < Serious_Sam> Now I use static IP. But it is just temp work around.
04:39 -!- Serious_Sam [kvirc@shpd-95-53-197-174.vologda.ru] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.3 Shiny(svn-3438) http://www.kvirc.net]
04:42 <@vpnHelper> RSS Update - forum: OpenVPN+Shorewall. Internal routing OK, external fails <http://forums.openvpn.net/topic9504.html#p19078>
04:44 < pdr44> thank you it worked
04:44 < pdr44> now all my traffic is routing to my root
04:46 -!- pdr44 [~luky@88-117-49-89.adsl.highway.telekom.at] has quit []
05:00 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 240 seconds]
05:21 -!- Cubox [~Cubox@unaffiliated/cubox] has joined #openvpn
05:21 < Cubox> Hello
05:22 < Cubox> I have check with wireshark, and the trafic between computer and server where is hosted the vpn is not encrypted
05:29 < Cubox> And, how to set a static ip to client of my vpn ?
05:30 -!- aegidos [~admin@p54B5B7DC.dip.t-dialin.net] has quit [Quit: aegidos]
05:31 -!- bauruine_ [~stefan@2001:8e0:100b:dead:2677:3ff:fe1a:2078] has quit [Remote host closed the connection]
05:32 < EugeneKay> Not sure you mean by "between computer and server where is hosted"
05:32 < EugeneKay> !static
05:32 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
05:32 < Cubox> thanks
05:33 < Cubox> EugeneKay: my computer is called Nefarian
05:33 < Cubox> my server server
05:33 < Cubox> and google is named google
05:33 < Cubox> when i try to go on google;com
05:33 < Cubox> crypted
05:33 < Cubox> when i try to go on my server
05:33 < Cubox> not crypted
05:33 -!- aegidos [~admin@p54B5B7DC.dip.t-dialin.net] has joined #openvpn
05:33 < EugeneKay> That is a SSL webserver issue, not an OpenVPN one.
05:34 < Cubox> my server not have SSL
05:34 < EugeneKay> Then I fail to see the unexpected behaviour?
05:37 < Cubox> Oh
05:37 < Cubox> Communication between server where is "hosted" the openvpn server and the client don't "passent" (french word) in the vpn
05:37 -!- bauruine [~stefan@2001:8e0:100b:dead:2677:3ff:fe1a:2078] has joined #openvpn
05:38 < hyper_ch> Cubox: I fail to comprehend what the issue is
05:38 < hyper_ch> hi EugeneKay
05:38 < EugeneKay> Are you using the public address of the VPN server or the VPN address?
05:39 < Cubox> the vpn adress
05:40 < Cubox> will try with GTranslate
05:40 < EugeneKay> Take your time. My French is far too horrible for me to understand you, so I appreciate the effort.
05:40 < Cubox> all communications that pass through the server does not go through the vpn.
05:41 < Cubox> hmm
05:41 < EugeneKay> Traffic destined for the VPN address of the server has to go through the vpn tunnel. This is the only way it can get there.
05:41 < EugeneKay> I suspect that you're not actually using the vpn address, hence wireshark is showing it unencrypted.
05:41 < Cubox> all communications for the server does not go through the vpn
05:41 < hyper_ch> !configs
05:41 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
05:42 < Cubox> okey
05:42 < Cubox> my iptables entry is
05:42 < EugeneKay> !paste
05:42 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
05:42 < hyper_ch> je comprends français mais je ne peux pas le parler très bien
05:42 < Cubox> /sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
05:42 < hyper_ch> je n'ai aucune idée de la grammaire et les temps
05:43 < EugeneKay> If you want to send all your traffic through the VPN you will need to use an option for that.
05:43 < EugeneKay> !def1
05:43 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
05:43 < Cubox> server
05:43 < Cubox> http://pastebin.com/sXb9Cb8h
05:44 < EugeneKay> Looks right. 
05:44 < Cubox> http://pastebin.com/bTzN6yP0
05:44 < Cubox> client
05:45 < Cubox> so, i finish my mario kart party, wait
05:45 < hyper_ch> sur le client, qu'est-ce que le commandement de "route" montir?
05:46 < hyper_ch> et peut-être tu dois user l'address IP sur le client et pas le nom de domaine?
05:47 < Cubox> can you speak english, sorry but i understand better than your french :|
05:47  * EugeneKay giggles
05:47 < hyper_ch> what does the route command return
05:47 < Cubox> ok
05:48 < Cubox> http://pastebin.com/4EkgxA35
05:49 < hyper_ch> eugene, do I read this right that def1 is not being pushed there?
05:49 < hyper_ch> probably because that client has no static ip and the def1 is pushed with bypass-dhcp?
05:50 < Cubox> oh
05:50 < Cubox> this is my second question
05:50 < Cubox> how to setup static ip to clients ?
05:50 < Cubox> :)
05:50 < hyper_ch> Cubox: make a "ccd" folder
05:50 < Cubox> where ?
05:50 < Cubox> /etc/openvpn ?
05:50 < hyper_ch> on the server
05:50 < hyper_ch> mkdir /etc/openvpn/ccd
05:51 < hyper_ch> and inside that ccd folder create file named like the commonname of your certificate
05:51 < EugeneKay> I wanna say that's the issue, yup.
05:51 < hyper_ch> that would be "Groat"
05:51 < hyper_ch> no file extension, nothing... only "Groat"
05:52 < hyper_ch> and now you can put things in there
05:52 < hyper_ch> !ccd
05:52 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
05:52 < Cubox> root@e-noob /etc/openvpn/ccd # ls
05:52 < Cubox> Groat  Nefarian  Neltharion
05:52 < hyper_ch> also add "client-config-dir ccd" in the server config
05:53 < Cubox> done
05:53 < hyper_ch> Cubox: also add to the server   "topology subnet"
05:54 < Cubox> what does do this ?
05:54 < hyper_ch> and in the Groat file add like:     ifconfig-push 10.8.0.2 255.255.255.0
05:54 < hyper_ch> the topology subnet makes it so that only one ip is being used instead of two
05:54 < Cubox> okey
05:55 < Cubox> and, for others, 10.8.9.3
05:55 < Cubox> and, for others, 10.8.0.3
05:55 < Cubox> will try
05:55 < hyper_ch> Cubox: you can give them any you want
05:55 < hyper_ch> of course restart server and client :)
05:55 < hyper_ch> and then do the "route" again
05:55 < Cubox> done
05:55 < Cubox> okey
05:56 < Cubox>           inet adr:10.8.0.3  P-t-P:10.8.0.3  Masque:255.255.255.0
05:56 < Cubox> \o/
05:56 < hyper_ch> and route?
05:57 < hyper_ch> you'll have any dhcp-clients in your vpn?
05:58 -!- aegidos [~admin@p54B5B7DC.dip.t-dialin.net] has quit [Quit: aegidos]
05:58 < Cubox> i don't have understand the last question
05:58 -!- spozen [~spozen@63-25-45-175.38cloud.com] has quit [Quit: leaving]
05:59 < hyper_ch> well, in your def1 command you say to bypass all dhcp clients (all clients that get assigned just some random ip address for the vpn becaue they have no CCD entry with a static ip address)
05:59 < Cubox> go to eat, will be back in 10 minutes
06:00 < hyper_ch> only 10 minutes eating?
06:00 < hyper_ch> eating should be a place for relax... eat slowly and enjoy :)
06:06 < hyper_ch> EugeneKay: http://assets.cubbi.es/uploads/3af57688-ae6d-428f-b5b1-246faaab0b30.jpg
06:10 -!- aegidos [~admin@p54B5B7DC.dip.t-dialin.net] has joined #openvpn
06:16 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has joined #openvpn
06:16 < Cubox> re
06:16 < Cubox> 16 minutes
06:17 < hyper_ch> so it works now?
06:17 < Cubox> http://pastebin.com/ASTkWPQQ hyper_ch 
06:18 < Cubox> Will test
06:18 < hyper_ch> that still doesn't look correct
06:18 < Cubox> oh
06:18 < Cubox> :/
06:20 < hyper_ch> Cubox: remove the def1 bypass dhcp from the server config
06:20 < Cubox> 'k
06:20 < hyper_ch> and just put     push "redirect-gateway def1"     into the Groat file
06:20 < Cubox> 187 push "redirect-gateway def1 bypass-dhcp"
06:20 < hyper_ch> restart server and client
06:20 < hyper_ch> and then route again
06:20 < Cubox> i remove ?
06:21  * Cubox will just comment
06:22 < hyper_ch> commenting is the same as removing :) sort of
06:23 < Cubox> yes
06:24 -!- aegidos [~admin@p54B5B7DC.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
06:24 < Cubox> http://pastebin.com/dQe0bSRi
06:25 -!- fridim_ [~fridim@2a01:e35:2ece:f2d0:223:4eff:fe6c:c754] has quit [Ping timeout: 240 seconds]
06:26 -!- Zimsky [~Zimsky@rozznet.net] has quit [Ping timeout: 240 seconds]
06:27 -!- Zimsky [~Zimsky@rozznet.net] has joined #openvpn
06:32 < Cubox> hyper_ch: not
06:32 < Cubox> hyper_ch: netcat e-noob.eu 80
06:32 < Cubox> GET /
06:32 < Cubox> and wireshark can view the content
06:32 < hyper_ch> Cubox: you're ok if I give you some configs now?
06:33 < hyper_ch> server, client and ccd
06:33 < hyper_ch> and test if that works?
06:33 < Cubox> okey
06:34 < hyper_ch> just rename your .conf files to something else
06:34 < hyper_ch> like .conf.org or .conf.old
06:36 < Cubox> 'k
06:37 < Cubox> root@e-noob /etc/openvpn/ccd # ls
06:37 < Cubox> Groat.old  Nefarian.old  Neltharion.old
06:38 < Cubox> root@e-noob /etc/openvpn # mv E-Noob.conf E-Noob.conf.old
06:38 < Cubox> root@Groat:/etc/openvpn# mv Groat.conf Groat.conf.old
06:38 < Cubox> done
06:39 < hyper_ch> http://pastebin.com/8TAi3y9D
06:40 < hyper_ch> Cubox: that should be adjusted to your keys
06:40 < hyper_ch> but make sure first
06:41 < Cubox> okey
06:42 < hyper_ch> don't worry about the order of the commands
06:42 < hyper_ch> I have it a bit "special" because I use a seperate file that contains all the "common" config options for the three openvpn instances that I run
06:45 -!- aegidos [~admin@p54B5B7DC.dip.t-dialin.net] has joined #openvpn
06:45 < Cubox> oh
06:45 < aegidos> okay i tried to add postroute and masquerade to iptables but didn't work either...
06:45 < aegidos> http://forums.openvpn.net/topic9504.html#p19078
06:45 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN+Shorewall. Internal routing OK, external fails : Server Administration (at forums.openvpn.net)
06:45 < aegidos> internat traffic works but external fails :-D thx
06:46 < hyper_ch> what do you mean extrernal fails?
06:47 < Cubox> Starting virtual private network daemon: E-Noob failed!
06:47 < Cubox> okey
06:47 < aegidos> dns resoultion
06:47 < hyper_ch> Cubox: on server or client?
06:47 < Cubox> I have comment this
06:47 < aegidos> if i want to get out of my vpn, the browser is not able to find the ip adress to for example techcrunch.com
06:47 < Cubox> user openvpn
06:47 < Cubox> group openvpn
06:48 < Cubox> and config common.inc
06:48 < hyper_ch> Cubox: then remove that
06:48 < hyper_ch> sorry, remove config common.inc
06:48 < Cubox> Starting virtual private network daemon: E-Noob.
06:48 < Cubox> yeah
06:50 < aegidos> hm
06:50 < aegidos> in my fritzbox i added a static rout
06:50 < aegidos> route from 10.8.0.0 to the internal IP adress of my debian server
06:52 < Cubox> http://pastebin.com/TYEttHEF
06:53 < aegidos> Kernel IP routing table
06:53 < aegidos> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
06:53 < aegidos> 10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
06:53 < aegidos> localnet        *               255.255.255.0   U     0      0        0 eth0
06:53 < aegidos> 10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
06:53 < aegidos> default         192.168.178.1   0.0.0.0         UG    0      0        0 eth0
06:53 < Cubox> hyper_ch: http://pastebin.com/TYEttHEF
06:55 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:56 < aegidos> ah http://pastebin.com/HdXeAycM
06:57 < hyper_ch> Cubox: that could be fine
06:57 < hyper_ch> Cubox: does it work now?
06:58 < Cubox> i test
06:59 < Cubox> no
07:01 < Cubox> Clear data
07:02 < hyper_ch> is that routing of the client?
07:02 < Cubox> hmm
07:02 < Cubox> data between server and client do not pass on openvpn
07:02 -!- zebedee3_ [~neil@027c034b.bb.sky.com] has joined #openvpn
07:03 -!- zebedee3 [~neil@2001:470:1f09:436:8ea9:82ff:fea9:e604] has joined #openvpn
07:03 < hyper_ch> I don't know what's goig on
07:03 < hyper_ch> it should be working
07:04 < hyper_ch> those configs work for me
07:04 < hyper_ch> aegidos: push dns servers to the client
07:05 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 260 seconds]
07:05 < aegidos> how to push dns servers to the client?
07:05 < hyper_ch> !dns
07:05 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
07:05 < aegidos> manually adding them on the client in network settings?
07:05 < hyper_ch> !pushdns
07:05 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
07:05 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
07:06 < Cubox> hyper_ch: :/
07:06 < aegidos> !pushdns
07:06 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
07:06 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
07:06 < aegidos> thy i will try it
07:06 < hyper_ch> Cubox: hmmm....
07:06 < hyper_ch> Cubox: ifconfig    on the client
07:06 < hyper_ch> what do you get?
07:07 < Cubox>           inet adr:10.8.0.8  P-t-P:10.8.0.8  Masque:255.255.255.0
07:07 < Cubox> for tun0
07:08 < hyper_ch> so the CCD entry gets read
07:08 < hyper_ch> otherwise it wouldn't be my 10.8.0.8
07:08 < hyper_ch> but why isn't the def1 working
07:09 < hyper_ch> cat /etc/openvpn/ccd/Groat
07:09 < hyper_ch> can you pastebin it?
07:09 < hyper_ch> !def1
07:09 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
07:10 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:11 < Cubox> https://cubox.pad.partipirate.org/openvpn
07:11 < Cubox> i'm bored about pastebin
07:12 < aegidos> obviously it's also a problem for IRC... if my client is connected via the vpn tunnel my chat doesn't work anymore
07:12 < aegidos> or is it ?
07:13 < hyper_ch> Cubox: it should be working :(
07:13 < Cubox> :/
07:14 < Cubox> little question, what does the client-to-client option ?
07:14 < Cubox> do *
07:14 < hyper_ch> !client-to-client
07:14 <@vpnHelper> "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
07:14 <@vpnHelper> clients
07:19 < Cubox> !ping-timer-rem
07:19 < Cubox> what is this option hyper_ch ?
07:20 < aegidos> i will take a reboot
07:20 -!- bauruine [~stefan@2001:8e0:100b:dead:2677:3ff:fe1a:2078] has quit [Ping timeout: 260 seconds]
07:20 -!- aegidos_ [~admin@p54B5B7DC.dip.t-dialin.net] has joined #openvpn
07:22 -!- aegidos_ [~admin@p54B5B7DC.dip.t-dialin.net] has left #openvpn []
07:22 < aegidos> okay now i added 8.8.8.8 to my resolve.conf
07:22 < aegidos> reboot of the server is in progress
07:22 < aegidos> do i have to reboot client too?
07:23 < hyper_ch> just add the push-dns option in the server config
07:23 < hyper_ch> Cubox: not really sure abou thtat option, use the man page
07:23 < Cubox> okey
07:24 < Cubox> hmm, i have read this option
07:24 < Cubox> for what use ? Does i need it ?
07:25 -!- spozen [~spozen@90-227-185-46-no129.tbcn.telia.com] has joined #openvpn
07:29 < spozen> ok so I have been reading about split tunneling.. And if I understand the man pages correctly you should be able to add "route 173.225.132.37 255.255.255.255 net_gateway" to your config file
07:30 < spozen> However this does not help me bypass the VPN tunnel... What am I doing wrong?
07:30 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
07:32 < aegidos> no default route is set on my client ... http://pastebin.com/e6FJHgn3
07:36 < hyper_ch> !welcome
07:36 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:37 < spozen> Also after OpenVPN adds my routes it ends with the line "/sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5" Shouldn't this be done BEFORE my routes are added?
07:37 -!- aegidos [~admin@p54B5B7DC.dip.t-dialin.net] has quit [Quit: aegidos]
07:37 < spozen> !route
07:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
07:42 < Cubox> hyper_ch: so, what I do ? :/
07:42 < hyper_ch> Cubox: no clue, it should work
07:43 < hyper_ch> spozen: what do your routes look like=
07:44 < spozen> http://pastebin.ca/2097789
07:45 < hyper_ch> Unable to connect
07:45 < spozen> what do you mean?
07:46 < hyper_ch> that's what I get when I browse that site
07:46 < hyper_ch> you're from british columbia?
07:47 < spozen> nope i'll try pastebin.com instead
07:48 < spozen> http://pastebin.com/xECz0WF8
07:49 < hyper_ch> I asked for your routes
07:49 < hyper_ch> on linux:  route
07:49 < Cubox> !interface
07:49 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
07:49 < hyper_ch> on OSX: route
07:49 < hyper_ch> on Windows... no clue
07:49 < Cubox> !topology
07:49 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
07:50 < hyper_ch> Cubox: what openvpn version are you useing?
07:50 < hyper_ch> Cubox: on client and server
07:50 < Cubox> OpenVPN 2.2.0 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul  4 2011
07:50 < Cubox> client
07:50 < Cubox> OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 21 2010
07:50 < Cubox> server
07:51 < hyper_ch> 2.1 is required for topology
07:51 < Cubox> i have it 
07:51 < hyper_ch> still weird, it should work
07:51 < Cubox> :/
07:51 < hyper_ch> the client gets the correct vpn ip pushed
07:51 < hyper_ch> why isn't it also pushing def1 properly
07:51 < spozen> I'm running Debian 6, Do you want me to run "netstat -rn" or what is the correct command for retrieving the routes? 
07:51 < hyper_ch> enable log on the client and restart openvpn
07:52 < hyper_ch> pastebin the log
07:52 < Cubox> hyper_ch: how to ?
07:52 < hyper_ch> spozen: route
07:52 < hyper_ch> that's all that's needed
07:52 < Cubox> ;log     /tmp/openvpn.log
07:52 < Cubox> this ?
07:52 < hyper_ch> Cubox: yes
07:52 < Cubox> 'k
07:52 < hyper_ch> on my client, I always enable openvpn log
07:52 < hyper_ch> but I log to /tmp so it gets removed after a reboot :)
07:52 < hyper_ch> well, on one of my clients
07:52 < hyper_ch> my work/home netbook
07:53 < spozen> Do I need to be connected to the VPN before running the "route" command?
07:53 < hyper_ch> spozen: yes
07:53 < hyper_ch> and you need to run it on the client
07:53 <@vpnHelper> RSS Update - forum: web-Access via OpenVPN <http://forums.openvpn.net/topic9358.html#p19079>
07:53 < spozen> ok one moment then
07:53 -!- spozen [~spozen@90-227-185-46-no129.tbcn.telia.com] has quit [Quit: leaving]
07:54 < Cubox> (wait)
07:54 < Cubox> (mario kart lagging)
07:56 -!- JackW1 [~jack@11.Red-2-142-27.dynamicIP.rima-tde.net] has quit [Remote host closed the connection]
07:57 -!- spozen [~spozen@63-25-45-175.38cloud.com] has joined #openvpn
07:57 < Cubox> wtf
07:57 < Cubox> Sat Dec 31 14:52:57 2011 us=937720 SENT CONTROL [E-Noob]: 'PUSH_REQUEST' (status=1)
07:57 < Cubox> WWRRWRSat Dec 31 14:53:00 2011 us=7099 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 180,redirect-gateway def1,ifconfig 10.8.0.8 255.255.255.0'
07:58 -!- JackW1 [~jack@11.Red-2-142-27.dynamicIP.rima-tde.net] has joined #openvpn
07:58 < hyper_ch> Cubox: pastebin the log
08:01 < Cubox> okey
08:02 < Cubox> https://cubox.pad.partipirate.org/openvpn
08:03 < hyper_ch> Cubox: 
08:03 < hyper_ch> Sat Dec 31 14:53:00 2011 us=43327 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
08:03 < hyper_ch> Sat Dec 31 14:53:00 2011 us=52312 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
08:03 < hyper_ch> on the client, run again the "route" command
08:04 < hyper_ch> according to the log, it should add both halfs of the internet and assign as gateway 10.8.0.1
08:04 < hyper_ch> which is the vpn server
08:06 -!- scyld [~operacyjn@unaffiliated/wasyl] has quit [Quit: leaving]
08:06 < Cubox>  paste on the pad
08:06 < spozen> Ok, now it seems to be working. But IDK it was the same before then suddenly it switched over to the VPN tunnel. http://pastebin.com/FfK3r0UU
08:07 < hyper_ch> Cubox: and how do you check if the traffic is encrypted?
08:08 < hyper_ch> spozen: it works... good :)
08:08 < hyper_ch> and why do you have a gazillion crashplan entries?
08:09 < spozen> Because I tried "route    central.crashplan.com 255.255.255.255 net_gateway" before and it didn't work
08:09 < hyper_ch> :)
08:10 < Cubox> hyper_ch: wireshark
08:10 < Cubox> and a netcat e-noob.eu 80
08:10 < Cubox> GET /
08:10 < hyper_ch> Cubox: and how with wireshark?
08:10 < Cubox> i just catch the packet
08:10 < hyper_ch> and not sure what that netcat should do
08:10 < Cubox> hmm
08:10 < hyper_ch> Cubox: but where do you catch the packet?
08:11 < hyper_ch> Cubox: if you brows to www.whatismyip.com
08:11 < hyper_ch> with a browser on that computer now, what IP does it retunr?
08:11 < hyper_ch> your home IP or your vpn server one?
08:11 < Cubox> have a lot of openvpn pachets
08:12 < Cubox> packet*
08:12 < hyper_ch> WHERE do you capture them? on what interface?
08:12 < Cubox> eth0
08:13 < hyper_ch> Cubox: if you brows to www.whatismyip.com
08:13 < hyper_ch> with a browser on that computer now, what IP does it retunr?
08:13 < Cubox> what ip ?
08:13 < Cubox> hmm
08:14 < Cubox> I have many openvpn connecton who go to the server
08:14 -!- magicblaze007 [~magicblaz@c-68-63-40-199.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
08:14 < Cubox> my server
08:14 < hyper_ch> so it works
08:14 < Cubox> no
08:15 < hyper_ch> it does
08:15 < hyper_ch> traffic is routed through the vpn
08:16 < hyper_ch> and pirate pad is a pain as you can't go back to older versions
08:16 < hyper_ch> hence pastebin is preferred
08:16 < Cubox> okey
08:17 < Cubox> but, when i go on e-noob.eu with my browser
08:17 < hyper_ch> anyway, whatismyip shows your server IP
08:17 < hyper_ch> so traffic is routed through the vpn
08:17 < hyper_ch> all works fine
08:17 < Cubox> no
08:17 < Cubox> when i go on e-noob.eu with my browser
08:18 < Cubox> on wireshark, i see HTTP packets
08:18 < hyper_ch> pastebin
08:18 < hyper_ch> incl. wireshark settings
08:18 < Cubox> hmm
08:22 < hyper_ch> or just pastebin the log at first
08:22 < spozen> Ok - like I said now my backup is running through the VPN tunnel again.. And my route table is excatly the same as before
08:23 < Cubox> so
08:23 < Cubox> hyper_ch: open this with wireshark, default settings (just installed)
08:23 < Cubox> http://e-noob.eu/tmp/openvpn
08:23 < Cubox> At the top, i have refresh the whatismyip page
08:23 < hyper_ch> spozen: I don't know what you try to achieve
08:23 < Cubox> but affter, it's the e-noob.eu page
08:24 < hyper_ch> Cubox: can you rename it to .txt
08:24 < hyper_ch> or just pastebin it
08:24 < spozen> hyper_ch: I am trying to get "split tunnling" to work. I don't want ALL my traffic tunneled
08:25 < Cubox> http://e-noob.eu/tmp/openvpn.txt
08:25 < hyper_ch> spozen: no clue
08:27 <@vpnHelper> RSS Update - forum: automatic reconnect potable openvpn <http://forums.openvpn.net/topic9505.html#p19081> || Openvpn between two computers in the same network <http://forums.openvpn.net/topic8908.html#p19080>
08:28 < hyper_ch> Cubox: looks fine to me
08:29 < spozen> hyper_ch: But you are familiar with "redirect-gateway def1" right? The server forces all traffic over VPN etc.. 
08:29 < Cubox> hyper_ch: but
08:29 < hyper_ch> spozen: I am
08:29 < Cubox> hyper_ch: look the http packets
08:29 < Cubox> we can view the content
08:30 < hyper_ch> there is one http packet
08:30 < hyper_ch> rest is all openvpn
08:30 < Cubox> hmm
08:30 < hyper_ch> and that one uses ipv6
08:31 < hyper_ch> or ask in wireshark if that's fine
08:31 < hyper_ch> for me it looks like it but then I don't know too much about it anyway
08:31 < Cubox> 26110.517270192.168.1.1178.47.163.170HTTP652GET / HTTP/1.1 
08:31 < hyper_ch> spozen: I am
08:31 < Cubox> packet 261
08:31 < hyper_ch> Source: fe80::9537:d4f7:61a0:caa7
08:32 < Cubox> no
08:32 < Cubox> 192.168.1.11
08:32 < spozen> hyper_ch: But you are not aware of anyway to cicumvent that on client side?
08:33 < hyper_ch> Cubox: what do your routes look like again on the client?
08:33 < hyper_ch> spozen: add a specific route that does things differently
08:34 < spozen> And how do I do that? :)
08:35 < hyper_ch> spozen: http://lartc.org/
08:35 < Cubox> http://pastebin.com/Ex9M2Hf3
08:35 <@vpnHelper> Title: Linux advanced Routing & Traffic Control HOWTO (at lartc.org)
08:36 < hyper_ch> Cubox: that looks again different than before
08:36 < Cubox> oh
08:36 < hyper_ch> before there were the two half internet routes added by def1
08:36 < hyper_ch> are you using different clients all the time?
08:37 < Cubox> no
08:37 < Cubox> its the same
08:37 < Cubox> i will look again log
08:37 < hyper_ch> [15:03] <hyper_ch> Sat Dec 31 14:53:00 2011 us=43327 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
08:37 < hyper_ch> [15:03] <hyper_ch> Sat Dec 31 14:53:00 2011 us=52312 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
08:37 < Cubox> nothing now
08:37 < hyper_ch> it added those routes before
08:37 -!- zebedee3 [~neil@2001:470:1f09:436:8ea9:82ff:fea9:e604] has quit [Quit: Ex-Chat]
08:37 -!- zebedee3_ [~neil@027c034b.bb.sky.com] has quit [Quit: Ex-Chat]
08:38 < Cubox> nothing new *
08:38 < hyper_ch> run those commands manually
08:38 < hyper_ch> and then pastebin route again
08:38 < Cubox> http://pastebin.com/Un5dFsnH
08:38 < Cubox> it's not the new route
08:39 < Cubox> okey
08:39 < Cubox> root@Groat:/tmp# /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
08:39 < Cubox> SIOCADDRT: Le fichier existe
08:39 < Cubox> the fild exist
08:39 < hyper_ch> restart that computer
08:39 < Cubox> okey
08:40 < hyper_ch> you only route half of the internet through the vpn as you can see with teh dest 128.0.0.0 subnet 128.0.0.0 gw 10.8.0.1 route
08:51 < Cubox> re
08:51 < Cubox> i will paste you the route
08:52 < Cubox> http://pastebin.com/X5JMDBUG
08:54 < hyper_ch> whis is this rout default         livebox         0.0.0.0         UG    0      0        0 eth0 ?
08:55 < Cubox> whis ?
08:55 < hyper_ch> why is
08:55 < Cubox> dunno
08:55 < Cubox> livebox is my … box
08:55 < hyper_ch> that's fine
08:56 < hyper_ch> my routes are nicely sorted
08:56 < hyper_ch> it should work
08:56 < hyper_ch> well, don't really know
08:56 < Cubox> I try
08:58 < Cubox> sigh
08:58 < Cubox> seem to not work
08:58 < hyper_ch> it does work
08:59 < hyper_ch> livebox is your server?
08:59 < Cubox> on apache2 access logs
08:59 < Cubox> 90.3.41.38 - - [31/Dec/2011:15:58:37 +0100] "GET /favicon.ico HTTP/1.1" 404 501 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.2 (KHTML, like Gecko) Ubuntu/11.10 Chromium/15.0.874.106 Chrome/15.0.874.106 Safari/535.2"
08:59 < Cubox> 90.3.41.38 is my public home ip
08:59 < Cubox> hyper_ch: it's my home box
08:59 < hyper_ch> but you have this route:  vps.e-noob.eu   livebox         255.255.255.255 UGH   0      0        0 eth0
09:00 < Cubox> a box is a router
09:00 < hyper_ch> vps.e-noob.eu and e-noob.eu have same IP address
09:01 < Cubox> yes
09:01 < hyper_ch> so when you say that *.e-noob.eu needs to be accessed, it goes through eth0
09:01 < Cubox> yes
09:01 < hyper_ch> if you want to go through the vpn, use 10.8.0.1 to access it
09:01 < Cubox> but, why it's go through eth0 ?
09:01 < hyper_ch> because of that route
09:01 < Cubox> oh
09:02 < hyper_ch> there is still a route required to connect your box to the server somehow
09:02 < hyper_ch> tun0 just encrypts traffic and then sends through eth0
09:02 < Cubox> how to remove this route
09:02 < hyper_ch> I don't think you can
09:02 < Cubox> :/
09:02 < Cubox> 'k
09:02 < hyper_ch> but I don't really know
09:02 < hyper_ch> anyway, the vpn is working
09:02 < hyper_ch> if you want to access the vpn server through the vpn, use 10.8.0.1
09:02 < Cubox> so, in /etc/hosts i put *.e-noob.eu 10.8.0.1
09:03 < hyper_ch> or make a hosts entry
09:03 < hyper_ch> Cubox: you can try
09:03 < Cubox> thanks
09:03 < Cubox> I will set my old config
09:03 < Cubox> use *
09:13 < spozen> what is a "inet prefix"?
09:27 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:27 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:28 < Cubox> I reboot, and test …
09:30 < Cubox> And now my phone don't have vpn :'(
09:32 < Cubox> ooooooh
09:32 <@vpnHelper> RSS Update - forum: Linking 2 VPN servers, routing issue with movable clients <http://forums.openvpn.net/topic9497.html#p19082>
09:33 < Cubox> It don't find the server...
09:33 < Cubox> Because he only now the vpn adress
09:33 < Cubox> He can't connect to him
09:33  * Cubox facepalm
09:34 -!- spozen [~spozen@63-25-45-175.38cloud.com] has quit [Quit: leaving]
09:52 < Cubox> Hey hyper_ch 
09:52 < Cubox> I think the issue is solved
09:52 < Cubox> BUE
09:52 < Cubox> But *
09:54 < Cubox> On local network, i can't access to my xens
09:54 < Cubox> It's a routing problem
09:54 < hyper_ch> then add according routes
09:55 < Cubox> I don't know these routes
09:55 < Cubox> I have this
09:55 < Cubox> # Accès internet des xen
09:55 < Cubox> /sbin/iptables -t nat -A POSTROUTING -s 192.168.5.0/24 -j MASQUERADE
09:55 < Cubox> to give to xens internet access
09:55 < Cubox> I just want to connect openvpn and xen
09:56 < Cubox> I don't know how to do this
09:56 < Cubox> hyper_ch: do you know what routes I have to add ?
09:57 < hyper_ch> probably you need to add 192.16.8.0.0 255.255.255.0 to eth0
09:57 < hyper_ch> or something
09:57 < hyper_ch> I don't know
09:57 < Cubox> hmm
09:58 < Cubox> okey, thanks
10:01 <@vpnHelper> RSS Update - forum: [resolved]Linking 2 VPN servers+routing movable subnets <http://forums.openvpn.net/topic9497.html#p19082>
10:01 < Olipro> which subnets do you want to route between?
10:03 -!- bauruine [~stefan@2001:8e0:100b:dead:2677:3ff:fe1a:2078] has joined #openvpn
10:03 < Cubox> Olipro: 10.8.0.0 with 192.168.5.0
10:03 < Cubox> All openvpn and xen
10:03 -!- tjz [~pc@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
10:04 < Olipro> are you using tun or tap
10:05 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:06 < Cubox> tun
10:09 < krzie> lans are behind server or client?
10:09 < Cubox> server
10:09 < krzie> !serverlan
10:09 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation
10:10 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:10 < krzie> your xen may require its own sort of ip forwarding setting too, i would not know
10:10 < Cubox> !route_outside_openvpn
10:10 <@vpnHelper> "route_outside_openvpn" is (#1) http://www.secure-computing.net/wiki/index.php/Graph for a cool graph explaining the route you need to add to your gateway, explained better in section: ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) you do not need this if the vpn node IS the gateway for its lan
10:10 < krzie> the host likely needs a route like the above i would think ^
10:10 < Cubox> the server is the gateway
10:10 < krzie> the xen host
10:11 < krzie> like the os that xen runs in
10:11 < Cubox> I don't have understant :/
10:11 < Cubox> understand
10:11 < krzie> xen is installed on your os, then you have openvpn inside a xen setup, right?
10:13 < Cubox> no
10:13 < Cubox> xen dom0 is the xen server
10:14 < Cubox> dom0 = host
10:14 < Cubox> raaaah
10:14 < Cubox> xen host is the openvpn server
10:14 < krzie> oh ok
10:15 < krzie> and all lans are xen vm's?
10:16 < krzie> is ip forwarding enabled, firewall allowing ip forwarding?
10:16 < Cubox> what do you mean by lans
10:16 < krzie> for tun+
10:16 < Cubox> firewall allow all
10:16 < krzie> foreign subnets that will route over the vpn
10:16 < Cubox> I have openvpn, and openvpn clients
10:17 < krzie> add a firewall allow entry for tun+ in forward chain anyways
10:17 < Cubox> I want to connect this to the lan, xen machines
10:17 < Cubox> krzie: i don't know exactly what iptables entry to add
10:17 < krzie> also enable --client-to-client
10:17 < Cubox> it's enabled
10:18 < Cubox> but the iptables command to route the two networks
10:18 < Cubox> i don't know :/
10:18 < krzie> iptables -I INPUT -i tun+ -j ACCEPT
10:18 < krzie> iptables -I FORWARD -i tun+ -j ACCEPT
10:19 < krzie> now show me iptables -L -t nat
10:20 < krzie> i want to see you have nothing there
10:20 < krzie> then do this:
10:20 < krzie> !configs
10:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
10:20 < Cubox> hmm
10:20 < Cubox> I'm not sure
10:20 < Cubox> wait, afk
10:20 < krzie> not sure what? i gave you exact commands
10:21 < JackW1> just seeking a quick confimation :) net.ipv4.ip_forward=1 just needs to be set on a machine that wants to forward from lan/wan interface to the tun/tap interfaces right? 
10:21 < krzie> yes
10:21 < JackW1> or from
10:21 < krzie> for packets to forward from 1 interface to another
10:21 < JackW1> thz
10:21 < JackW1> thx
10:21 < krzie> firewall must also allow it
10:21 < JackW1> sure, that's a given :)
10:22 < krzie> this is even true on the server for traffic going from 1 client to another, unless you use --client-to-client
10:23 < krzie> !c2c
10:23 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind other
10:23 <@vpnHelper> clients
10:23 < JackW1> if you don't wanna restrict access this seems to work fine for iptables:
10:23 < JackW1> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT                                           
10:23 < JackW1> -A FORWARD -s 10.8.0.0/24 -j ACCEPT                                                                 
10:23 < JackW1> -A FORWARD -j REJECT                                                                                
10:24 < JackW1> with 10.8.0.0/24 being the subnet to allow through
10:26 < JackW1> another question :)  is there no support in openvlan to use routing protocols to advertise connected subnets?
10:27 < Olipro> krzie: if you enable client-to-client, you need to setup iroutes on the server
10:27 < krzie> false
10:27 < krzie> !iroute
10:27 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
10:27 < Olipro> ...yes
10:28 < Olipro> he wants to route to subnets /behind/ the client, does he not
10:28 < krzie> he does not
10:29 < krzie> at least not Cubox 
10:29 < krzie> i dunno what JackW1 is doing
10:29 < Olipro> heh, ok
10:29 < krzie> but c2c is for client to client traffic
10:29 < krzie> iroute is for traffic to a foreign subnet behind a client
10:29 < krzie> foreign as in not the vpn ip
10:30 < JackW1> at the moment i just connect a client lan to a server lan.  but am writing a wiki page for archlinux, so need to know alot to not lead everyone astray and send even more confused people here :)
10:30 < krzie> !route
10:30 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
10:30 < krzie> i hope you already read that
10:31 < Olipro> I'd hope someone documenting things for arch linux would already be familiar with routing >_>
10:31 < JackW1> i also see a log msg about not being able to delete a published route when disconnecting.  suppose that is because i drop privs and run as nobody, so the server or client can't run ip from iproute2 ?
10:31 < krzie> oh great another writeup going on some os specific page
10:32 < krzie> that'll be sure to help confuse googlers out of using the howto
10:32 < JackW1> https://wiki.archlinux.org/index.php/OpenVPN if you wanna look, but is just in it's infancy :)
10:32 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
10:33 < krzie> even cooler, an incomplete one!
10:33 < JackW1> in any case it's a lot better than what was there before, so it's not really like i'm doing something new, just improving it's quality quite a lot
10:34 < JackW1> it links to the openvpn documentation for more info...
10:35 < krzie> wow that just made me see that docs page needs updating, lol
10:36 < JackW1> at least it describes the pki generation, basic server/client config, testing the connection, connecting a client lan to a server and a server lan to client.  still skips the iptables instructions though
10:36 -!- magicblaze007 [~magicblaz@c-68-63-40-199.hsd1.fl.comcast.net] has joined #openvpn
10:36 < JackW1> krzie: please do, because i found the openvpn docs a little scattered.  to be honest i think the openvpn man page is the best of them all :)
10:37 < krzie> it is by far the best
10:37 < krzie> !man
10:37 <@vpnHelper> "man" is (#1) http://openvpn.net/man for 2.0 manual or (#2) http://openvpn.net/man-beta.html for 2.1 manual or (#3) http://openvpn.net/index.php/open-source/documentation/manuals/427-openvpn-22.html for 2.2 manual or (#4) the man pages are your friend!
10:37 < krzie> and the 2.2 man isnt on the docs page
10:37 < JackW1> haha.
10:38 < JackW1> still wonder about routing protocols though, RIP, BGP, etc
10:38 < krzie> best to use routed tap when doing that
10:38 < krzie> gets around the iroute problem you'ld otherwise have
10:38 < JackW1> i guess there is no support for that, but maybe scripting can do it
10:39 < krzie> could also be done with ptp links for all connections, but thats more to manage
10:39 < JackW1> yeah, i'm gonna do tap, and then ipv6 too :)
10:39 < krzie> ipv6 works in routed, well is still being developed
10:39 < krzie> !ipv6
10:39 < JackW1> but have to start somewhere :)
10:39 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for ipv6 payload patch (adds some nice ipv6 options) or (#2) see !snapshots for a release with ipv6 patches in it, report how it works to help it get included in a stable release
10:44 -!- magicblaze007 [~magicblaz@c-68-63-40-199.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
10:47 < Cubox> re
10:47 < Cubox> krzie: i will reexplain
10:47 < Cubox> krzie: port 4242 is open in the main server
10:47 < Cubox> and redirect on 192.168.5.2
10:47 -!- Denial [Denial@drgi.co.uk] has joined #openvpn
10:47 < Cubox> with /sbin/iptables -A PREROUTING -t nat -p tcp -d 78.47.163.170 --dport 4242 -j DNAT --to 192.168.5.2
10:48 < Cubox> I want, an openvpn client (10.8.0.2) to connect to 10.8.0.2 and it will redirect to 192.168.6.
10:48 < Cubox> I want, an openvpn client (10.8.0.2) to connect to 10.8.0.2 and it will redirect to 192.168.5.2 
10:49 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
10:50 < krzie> https://community.openvpn.net/openvpn/ticket/187   there =]
10:50 <@vpnHelper> Title: #187 (web documentation link missing 2.2 links) – OpenVPN Community (at community.openvpn.net)
10:51 < krzie> Cubox, huh?
10:54 < JackW1> Cubox: would be better to pastebin your client/server openvpn and iptables config files
10:55 < krzie> ya i asked for that 30min ago ;]
10:55 < JackW1> krzie: i suppose the best way to fix the iproute2 permissions probs would be to create a openvpn user/group and give that network permissions
10:56 < krzie> sure
10:56 < krzie> err wait, how so
10:56 < krzie> what permission problems are you talking about
10:57 < JackW1> when i run as nobody i get an error in the log about not being able to execute ip route
10:58 < krzie> when it closes
10:58 < krzie> doesnt matter, the route goes away when the device gets closed
10:58 < krzie> its a meaningless error
10:59 < JackW1> ah, yeah i saw that the route went away.  just like clean logs :)
10:59 < krzie> pointless addition of privileges is pointless
10:59 < JackW1> that's true, but shouldn't it at least be a warning then :)
11:00 < krzie> the route command errors to openvpn for trying
11:00 < krzie> the error isnt from openvpn
11:00 < krzie> openvpn passes it on like it should
11:02 < JackW1> hmm
11:03 < Cubox> Okey, back to the old method
11:03 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Remote host closed the connection]
11:04 < Cubox> I want a solution to pass the communications who goes on the server (openvpn) on the tun module (for openvpn)
11:04 < Cubox> without use 10.8.0.1
11:04 < krzie> huh?
11:09 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
11:09 < JackW1> am gonna link http://openvpn.net/index.php/manuals/427-openvpn-22.html on my wiki page too :)
11:09 <@vpnHelper> Title: OpenVPN 2.2 (at openvpn.net)
11:38 < Cubox> !config
11:38 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
11:38 < Cubox> >.<
11:38 < Cubox> !configs
11:38 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
11:41 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Remote host closed the connection]
11:43 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
11:44 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Client Quit]
11:46 < Cubox> Oh, and i have another problem
11:46 < Cubox> On my phone, i have set the vps as a daemon
11:46 < Cubox> But… when switch from 3g/wifi i don't have any internet access :/
11:47 < Cubox> same with my computer, when i loose internet connection a little instant, i have to restart the openvpn daemon
11:49 -!- Santa_Claus is now known as NewYearsEve
11:49 -!- NewYearsEve is now known as NewYearsDay
11:58 -!- me345 [~me345@adsl-71-131-128-130.dsl.sntc01.pacbell.net] has joined #openvpn
11:58 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Read error: Operation timed out]
11:58 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
12:06 -!- mattock [~samuli@openvpn/corp/admin/mattock] has joined #openvpn
12:06 -!- mode/#openvpn [+o mattock] by ChanServ
12:09 < krzie> Cubox, thats the vpn gui you use, im guessing android
12:09 < krzie> since i know the android vpn gui stops reconnecting after failed attempt
12:10 < krzie> whereas i run it via cli on android, and it does reconnect
12:14 < Some_Person> My VPS (running OpenVPN) just rebooted, and now OpenVPN isn't working properly. I can connect to it, but it isn't giving me access to the internet. Please help me
12:14 < krzie> you prolly did the ip forwarding temp solution
12:14 < krzie> or didnt make your nat permanent
12:14 < krzie> or both
12:14 < krzie> !redirect
12:14 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
12:15 < krzie> !linipforward
12:15 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
12:15 < Some_Person> It's an OpenVZ VPS, if that helps
12:15 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
12:16 < Some_Person> I have "net.ipv4.ip_forward = 1" in my sysctl.conf
12:17 -!- mattock [~samuli@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
12:18 < SviMik> hi all. is it possible (theoretically) to decrypt traffic, if I get client's keys?
12:18 < krzie> iptables -L -t nat
12:18 < hyper_ch> hi krzie
12:18 < krzie> with the keys, yes
12:18 < krzie> hi hyper_ch 
12:18 < SviMik> krzie even without server's key?
12:18 < krzie> SviMik, how do you think the client does it...?
12:19 < krzie> ild expect you need the negotiation captured too tho
12:19 < SviMik> I don't know... HTTPS works somehow... but there is no preinstalled keys
12:19 < krzie> yes there is
12:20 < krzie> the trusted CA crt's
12:20 < krzie> not "keys" but preinstalled trust
12:20 < krzie> learn more about PKI
12:20 < krzie> !pki
12:20 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was signed
12:20 <@vpnHelper> specially as a server (see !servercert)
12:20 < krzie> erm thats not a good link
12:20 < krzie> !google how pki works
12:20 <@vpnHelper> How PKI Works: <http://technet.microsoft.com/en-us/library/cc977676.aspx>; Tell me how PKI works in Plain English: <http://download.microsoft.com/documents/uk/technet/learning/downloads/security/BCS_PKI_part1.ppt>; Tutorial: An introduction to Public Key Infrastructure (PKI) - YouTube: <http://www.youtube.com/watch?v=EizeExsarH8>
12:20 < SviMik> krzie I can use self-signed keys for SSL. and it still works.
12:21 < krzie> SviMik, yes, if you manually trust the crt
12:21 < hyper_ch> SviMik: you need ssl cert?
12:21 < krzie> ca crt*
12:21 < Some_Person> I can't get it to work :-(
12:21 < Some_Person> !nat
12:21 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
12:22 < Some_Person> !linnat
12:22 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
12:22 < Some_Person> !openvzlinnat
12:22 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
12:22 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Ping timeout: 248 seconds]
12:23 < Some_Person> "container.ip"? Is that the public IP of my VPS, or something else?
12:25 < krzie> take it from context... "is since openvz cant do NAT inside containers"
12:26 < Some_Person> Crap, I think I found the problem: http://paste.ubuntu.com/789035/
12:26 < Some_Person> How the hell would tun disappear after a reboot?
12:28 < krzie> dunno, i dont admin your box
12:30 < Some_Person> makes no sense to me
12:36 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has joined #openvpn
12:37 -!- ac3xor [~ac3xor@c-98-242-190-19.hsd1.fl.comcast.net] has quit [Client Quit]
12:41 -!- Serious_Sam [kvirc@shpd-95-53-197-174.vologda.ru] has joined #openvpn
--- Log closed Sat Dec 31 12:46:47 2011
--- Log opened Sat Dec 31 12:47:00 2011
12:47 -!- ecrist [~ecrist@jaguar-2-red.claimlynx.com] has joined #openvpn
12:47 -!- Irssi: #openvpn: Total of 132 nicks [2 ops, 0 halfops, 61 voices, 69 normal]
12:47 -!- Secret [~Secret@78.157.114.78] has joined #openvpn
12:47 -!- Irssi: Join to #openvpn was synced in 29 secs
12:48 < sroy2> Hello, is it possible to restrict openvpn connections to a subdomain and not an ip? someone would be able to connect to me.mydomain.com but not 1.2.3.4 (even if that is the ip of the domain?)
12:49 -!- tabakhase [t4b4kh453@rps9289.ovh.net] has joined #openvpn
12:57 -!- sroy2 [5dcce274@gateway/web/freenode/ip.93.204.226.116] has quit [Ping timeout: 258 seconds]
13:02 <+TJNII> Hmmm... unless the OpenVPN packet structure contains the domain name the client system resolved, I don't believe so.  Now, restricting it to only one IP and any associated domains is simple.  Restricting to only tne domain and not the IP associated with it, not so much.  Why would you want to that, though?
13:03 -!- Serious_Sam [kvirc@shpd-95-53-197-174.vologda.ru] has quit [Remote host closed the connection]
13:03 -!- Serious_Sam [kvirc@shpd-95-53-197-174.vologda.ru] has joined #openvpn
13:08 -!- MrPPS_ [~quassel@canyouget.in] has joined #openvpn
13:09 -!- MrPPS [~quassel@unaffiliated/mrpps] has quit [Ping timeout: 252 seconds]
13:15 -!- mjejwa [~me345@adsl-71-131-128-130.dsl.sntc01.pacbell.net] has quit [Remote host closed the connection]
13:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Read error: Operation timed out]
13:50 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:59 < Some_Person> argh, I doubt there's even anyone there right now to enable tun for me :-(
13:59 < Some_Person> New Years Eve, not to mention that it's a British company so it's late over there
14:01 < Cubox> krzie: on my android, i am using the daemon
14:06 < Some_Person> Why can't these VPS companies just set up a big "Enable tun" button or something in their management thingy rather than making you contact them to manually do it?
14:11 -!- gffa [~gffa@unaffiliated/gffa] has quit [Remote host closed the connection]
14:12 -!- gffa [~gffa@unaffiliated/gffa] has joined #openvpn
14:17 -!- DoktorJ [41605745@gateway/web/freenode/ip.65.96.87.69] has joined #openvpn
14:17 < DoktorJ> !welcome
14:18 <@vpnHelper> "welcome" is Start with !goal || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki !mitm || Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:18 < DoktorJ> !/30
14:18 <@vpnHelper> "/30" is (#1) http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html (sorry for the long link, they wont fix the anchors) explains why routed clients each use 4 ips or (#2) you can avoid this behavior by reading !topology or (#3) so by default, first client is .6, then .10 .14 .18 etc etc or (#4) use
14:18 <@vpnHelper> openvpn --show-valid-subnets to see the subnets you can use in net30
14:19 < DoktorJ> !topology
14:19 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
14:19 < DoktorJ> !iporder
14:19 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
14:19 < DoktorJ> !static
14:19 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
14:20 < hyper_ch> hi DoktorJ
14:20 < DoktorJ> hey
14:20 < DoktorJ> having trouble with my client config files :P
14:21 < DoktorJ> i finally got the VPN itself working the way i want (client connects, can access specified computers on the server's LAN)
14:21 < DoktorJ> but if i specify an IP for the client, the adapter isn't picking that IP up it seems
14:23 < DoktorJ> lol just figured it out
14:23 < DoktorJ> "ifconfig-push 10.88.1.10 255.255.0.0" seems much happier than "ifconfig-push 10.88.1.10 10.88.1.9" :P
14:24 < DoktorJ> i'd switched my configuration to tap (had been using tun)
14:25 < DoktorJ> and i didn't realize the ifconfig-push directive needed to be written differently between tun/net30 and tap
14:25 < krzie> !static
14:25 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
14:25 < krzie> =]
14:25 < DoktorJ> yup, just read that
14:25 < krzie> oh right
14:25 < krzie> hey hey you even found it yourself
14:25 < DoktorJ> :D
14:25 < krzie> ^5
14:25 < DoktorJ> ^5
14:26 < DoktorJ> it's cool that the various commands suggest other commands to follow up with
14:26 < DoktorJ> or i probably would've never found that
14:26 -!- mode/#openvpn [+v DoktorJ] by ChanServ
14:26  * DoktorJ dances
14:27 <+DoktorJ> my boss isn't going to kill me now ^_^
14:27 <+DoktorJ> since i can now assign static ips to various clients, i can use iptables to control which servers they have access to... which is exactly what we needed
14:28 <+DoktorJ> (honestly, being a holiday "can we do this?" side project, he probably wouldn't have killed me if i hadn't been able to get it done... but everyone will be much happier that the answer is "yes" :D)
14:30 < krzie> but you said  you use tap
14:30 < krzie> the client can just ifconfig to another ip, and it will work
14:30 <+DoktorJ> hrmmm
14:30 < krzie> the only way you can really bust that is with tun and net30 (the other style static ips)
14:30 <+DoktorJ> that's what i was trying
14:30 < krzie> or maybe a --learn-address script for the firewall configs
14:31 <+DoktorJ> but i was having trouble getting the client to talk to the server's LAN in a tun configuration 
14:31 -!- krzie [nobody@openvpn/community/support/krzee] has left #openvpn []
14:31 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
14:33 <+DoktorJ> is it possible to get tun/net30 to allow the client to talk to the server's LAN?
14:33 < Cubox> krzie: Yes, but, on any deconnection of internet, i have to restart the daemon to re enable internet
14:33 < Cubox> on computer, and android
14:37 < hyper_ch> DoktorJ: you just have to push a route
14:37 <+DoktorJ> i did, it didn't seem to help :(
14:38 < hyper_ch> what's the server subnet?
14:38 < hyper_ch> and whats your local subnet?
14:38 < Cubox> Hey, re hyper_ch 
14:38 < hyper_ch> hi Cubox
14:38 < Cubox> I have another question
14:39 <+DoktorJ> server's subnets (it has two interfaces) are 10.153.99.128/25 and 10.153.59.96/27
14:39 < Cubox> When i lost the internet connection, i can't access the net
14:39 <+DoktorJ> mine is 10.0.1.0/24
14:39 < Cubox> but, when the internet connection work well, i have to restart openvpn to let internet work
14:39 < hyper_ch> DoktorJ: with topology you should be able to push them
14:39 < Serious_Sam> Hi there! Guys I use OpenVPN on Windows XP SP3
14:40 < hyper_ch> you just need to know the right subnet mask.. that's something I can't really calculate - I suck at that thing
14:40 <+DoktorJ> i'll go play around with it some more
14:41 <+DoktorJ> i've taken my current conf and renamed it to server.WORKING.conf so i don't lose what i have ^_^
14:41 < hyper_ch> DoktorJ: in the server config add:   push "route 10.8.10.0 255.255.255.0"
14:41 < hyper_ch> as example
14:41 < Serious_Sam> And I have a problem with it. Sometimes there is "Acquiring network address" in network connection on Windows startup. I need to restart OPenVPN Service in this situation. What is wrong?
14:41 < hyper_ch> DoktorJ: now you just need to set right ip and subnet for it
14:45 <+DoktorJ> okay wtf happened :P
14:45 <+DoktorJ> "TCP/UDP: Socket bind failed on local address [undef]:21194: Address already in use"
14:45 <+DoktorJ> this when i attempted to restart openvpn
14:46 < Cubox> I think the adress is in use
14:46 < Cubox> ;)
14:46 <+DoktorJ> -_-
14:46 < Cubox> (sorry)
14:47 < Cubox> You got this on the client ?
14:47 <+DoktorJ> no, on the server
14:47 < Cubox> oh
14:47 <+DoktorJ> (i'm running it on 21194)
14:47 < Cubox> okey
14:48 <+DoktorJ> it WAS running, i did "service openvpn restart"
14:48 < Cubox> o.O
14:48 <+DoktorJ> which should STOP the service (thus unbinding that port) and START it (where it should be able to rebind the now unbound port)
14:48 <+DoktorJ> i'm going to see if shutdown -r now wins
14:48 < Cubox> \o\
14:50 < Cubox> why do openvpn add this route on the client ? vps.e-noob.eu   livebox         255.255.255.255 UGH   0      0        0 eth0
14:50 < Cubox> I want to remove it :/
14:52 <+DoktorJ> have you removed it manually?
14:52 < Cubox> So, it's a bad idea
14:52 <+DoktorJ> does it  break anything if you do?
14:52 < Cubox> All internet traffic was beak
14:52 < Cubox> break *
14:52 < Cubox> I want to pass on tun the traffic who have to go on the server !
14:52 < Cubox> without access to 10.8.0.1
14:53 <+DoktorJ> so you want all internet traffic to go through the server?
14:53 < Cubox> all
14:53 < Cubox> yes
14:53 < Cubox> but, i want to access to  the server, via openvpn
14:53 <+DoktorJ> you should theoretically be able to...
14:53 <+DoktorJ> what's your full route?
14:54 < Cubox> DoktorJ: traffic who go on the server are not encrypte
14:54 < Cubox> encrypted *
14:54 < Cubox> http://pastebin.com/rD445Zf5
14:57 <+DoktorJ> do a "route -n" ?
14:57 < Cubox> server/client ?
14:57 < Cubox> https://cubox.pad.partipirate.org/openvpn
14:59 < Cubox> DoktorJ: 
15:02 -!- NewYearsDay is now known as JG84
15:06 -!- DoktorJ is now known as Doktor_J
15:06 <+Doktor_J> f** you nickserv -_-
15:10 <+Doktor_J> i win
15:12 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: pIRC v2.2 < Personal IRC Team > http://ircworld.ru and http://xirc.ru/]
15:13 < Serious_Sam> Does anybody use OpenVPN on Windows?
15:15 <+Doktor_J> i use the windows client, but my server is linux
15:18 < Serious_Sam> Doktor_J: What Windows?
15:19 <+Doktor_J> win7
15:22 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
15:24 <+Doktor_J> rofl... i take my working config, switch it back over to tun/subnet (which wasn't working before) and now it works
15:24 <+Doktor_J> go figure
15:24 <+Doktor_J> +1 internets to krzie and hyper_ch for the help :D
15:25 < hyper_ch> if you have openvpn 2.1+ then you could use topology and don't need a /30
15:26 -!- Gravitron [~admin@65.28.68.253] has joined #openvpn
15:26 -!- Gravitron [~admin@65.28.68.253] has quit [Changing host]
15:26 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
15:28 <+Doktor_J> yeah, i'm on subnet topology now
15:28 <+Doktor_J> i'd thought there was a reason i didn't want to use it, but if there was, i can't remember it :P
15:28 < hyper_ch> :)
15:28 <+Doktor_J> and with tun, clients can't arbitrarily set their IP, right?
15:29 < hyper_ch> using openvpn client/server older than 2.1 would be a reason
15:29 < krzee> only reason not to is if you need static vpn ips, and cant allow them to change those
15:29 < hyper_ch> Doktor_J: if you don't use CCD and ipp.txt then the server just assigns them an ip
15:29 < krzee> hyper_ch, and then you can ifconfig to another
15:29 < krzee> but with net30 that breaks the connection
15:29 < hyper_ch> :)
15:30 < hyper_ch> krzee: it's amazing what you know about openvpn :)
15:30 < krzee> thx ;]
15:30 < krzee> i believe you could fix that with a --learn-address script
15:31 <+Doktor_J> hmmm
15:31 <+Doktor_J> with topology subnet, i tried manually changing the client ip
15:31 <+Doktor_J> and it seems to not be working
15:32 < krzee> its been tested and does work
15:32 < krzee> you must have done something wrong i guess
15:34 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
15:37 <+Doktor_J> so what do i need to do then, to keep people from doing that?
15:37  * Doktor_J is confused now
15:38 < krzee> either: A) net30
15:38 < krzee> or B) i think a --learn-address script
15:39 < hyper_ch> C) hire krzee :)
15:39 < krzee> !script
15:39 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
15:40 <+Doktor_J> now with tun/net30, i need to use the different ifconfig-push in the ccd right?
15:41 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Ping timeout: 248 seconds]
15:41 < hyper_ch> !net30
15:41 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
15:42 < hyper_ch> !ccd
15:42 <@vpnHelper> "ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
15:42 < hyper_ch> !push
15:42 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
15:42 < hyper_ch> !route
15:42 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT or (#3) See !tcpip for more info about a more basic networking guide
15:49 <+Doktor_J> okay this is pissing me off
15:49 <+Doktor_J> "Socket bind failed on local address [undef]:21194: Address already in use" again
15:50 <+Doktor_J> how do i unbind a port?  openvpn is NOT running (confirmed via ps ax) but netstat -nl still has tcp        0      0 0.0.0.0:21194               0.0.0.0:*                   LISTEN
15:51 < hyper_ch> try to restart the machine?
15:51 < hyper_ch> that's what I do if ifdown/ifup fails
15:54 <+Doktor_J> yeah, it's just a pain in the ass
15:54 < hyper_ch> has happened 3-4 times on debian when I really f*** up the settings :)
15:55 -!- c1de0x [~c1de0x@208.111.44.254] has quit [Excess Flood]
15:56 <+Doktor_J> i'm just thankful these cloud systems are speedy little buggers
15:56 <+Doktor_J> restarts only take about 2 minutes
15:56 < hyper_ch> I don't believe in clouds I didn't setup
15:57 <+Doktor_J> lol i know the feeling
15:58 < hyper_ch> I have yet to setup my own private cloud
15:58 <+Doktor_J> i'm doing this for work though
15:58 <+Doktor_J> so i work with what they give me
15:59 <+Doktor_J> and am thankful that, within the cloud account we've got, they pretty much give me free reign
15:59 <+Doktor_J> spin up new machines, fiddle with the networks/routing (occasionally breaking things), etc
16:00 <+Doktor_J> and yay, tun/net30/ccd are all playing toegether :D
16:01 <+Doktor_J> next up... can i get two-factor authentication going with google authenticator... :P
16:01 <+Doktor_J> (this is just brownie-point work now)
16:01 <+Doktor_J> of course, since i'm currently in a "contract-to-hire" position, i'll take all the brownie points i can get
16:05 <@vpnHelper> RSS Update - forum: automatic reconnect potable openvpn <http://forums.openvpn.net/topic9505.html#p19083>
16:17 <@vpnHelper> RSS Update - forum: OpenVPN with Google authenticator like 2FA (windows client) <http://forums.openvpn.net/topic9300.html#p19084>
16:22 -!- c1de0x [~c1de0x@208.111.44.254] has joined #openvpn
16:41 < krzee> Doktor_J, sure, if you can script it
16:41 < krzee> !pwauth
16:41 < krzee> !authpass
16:41 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
16:49 -!- Gravitron [~admin@65.28.68.253] has joined #openvpn
16:49 -!- Gravitron [~admin@65.28.68.253] has quit [Changing host]
16:49 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
16:53 -!- Doktor_J_ [41605745@gateway/web/freenode/ip.65.96.87.69] has joined #openvpn
16:54 -!- Doktor_J [41605745@gateway/web/freenode/ip.65.96.87.69] has quit [Ping timeout: 258 seconds]
16:56 -!- Serious_Sam [kvirc@shpd-95-53-197-174.vologda.ru] has quit [Quit: When two people dream the same dream, it ceases to be an illusion. KVIrc 3.4.3 Shiny(svn-3438) http://www.kvirc.net]
16:59 <@vpnHelper> RSS Update - forum: Please Help- Login Window issues on Windows 7 64bit <http://forums.openvpn.net/topic9506.html>
17:00 < Doktor_J_> krzee: thanks for that last bit of info... i'm thinking of turning off the certs, since username + password + OTP would still satisfy 2FA
17:01 < Doktor_J_> (something you know = username + password, something you have = OTP)
17:01 < Secret> Happy New Year
17:02 -!- Doktor_J_ is now known as Doktor_J
17:05 < Some_Person> If tun doesn't appear under lsmod, does that absolutely mean it's not enabled?
17:06 < krzee> certs are stronger than l/p
17:06 < krzee> Some_Person, it means the module isnt loaded
17:07 < krzee> of course it doesnt NEED to be a module
17:07 < krzee> could be statically compiled into the kernel
17:07 < Some_Person> Well, it is showing up as tun0 under ifconfig
17:08 < krzee> then its obviously loaded, lol
17:08 < Some_Person> seriously?
17:08 < Some_Person> In that case, why the hell isn't my server working?
17:08 < krzee> if ifconfig has a tun device, your kernel knows about tun devices
17:09 < Some_Person> Ok, I have an OpenVZ VPS with OpenVPN running on it. It was working fine until I rebooted the server earlier
17:10 < Some_Person> I can connect to it, but I cannot access the internet through it (everything just times out)
17:10 < krzee> why would you think that has to do with the tun device?
17:10 < krzee> !redirect
17:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns
17:10 < Some_Person> Because I thought that tun had to show up under lsmod for it to work
17:10 < krzee> its either your nat, your firewall (which is nat) or your ip forwarding
17:10 < Some_Person> It's not a DNS problem
17:11 < krzee> oh right, or a dns problem
17:11 < krzee> lol
17:11 < Some_Person> So I guess NAT or IP forwarding
17:11 < krzee> easy enough to test...
17:12 < Some_Person> !ipforward
17:12 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
17:12 < Some_Person> !linipforward
17:12 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware
17:12 < krzee> cat /proc/sys/net/ipv4/ip_forward
17:12 < krzee> is it 0 or 1?
17:12 < Some_Person> 1
17:12 < krzee> ok then its nat (firewall) or firewall
17:12 < Some_Person> !nat
17:12 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:13 < krzee> so the problem is in your firewall
17:13 < Some_Person> !linnat
17:13 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
17:13 < krzee> tell me 2 things tho
17:13 < Some_Person> !openvzlinnat
17:13 < krzee> a) can you ping 8.8.8.8?
17:13 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
17:13 < Some_Person> krzee: From where?
17:13 < krzee> b) can you ping the internall vpn ip of the server?
17:13 < krzee> from the client when connected (for both)
17:13 < Some_Person> I dunno what the internal vpn ip is
17:13 < krzee> heh
17:13 < krzee> !configs
17:13 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries
17:14 < Some_Person> Can I just pastebin you the server config? I'm sorry, but I'm really a noob at this
17:15 < Some_Person> Though I guess the internal vpn ip is "10.8.0.0"
17:15 < Doktor_J> well it'd be 10.8.0.1 (since the server grabs the first ip in the specified subnet)
17:16 < Some_Person> This is my config: http://paste.ubuntu.com/789257/
17:16 < Some_Person> It was working before
17:17 < Some_Person> I can ping 10.8.0.1 from a client
17:19 < Some_Person> but not 8.8.8.8
17:19 < Some_Person> So is this an NAT issue?
17:19 < krzee> yes
17:20 < krzee> vpn ip for server is 10.8.0.1
17:20 < krzee> because of --server
17:20 < Some_Person> ok, so how do I go about fixing this?
17:20 < krzee> fix your iptables
17:20 < krzee> iptables -L -t nat
17:20 < Some_Person> krzee: no output
17:21 < krzee> ya, you dont have a nat setup at all
17:21 < krzee> [15:13]  <vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
17:21 < Some_Person> container.ip = 10.8.0.1?
17:21 < krzee> no
17:21 < krzee> thats the vpn server ip
17:21 < Some_Person> oh
17:24 < Some_Person> Well, we're getting there
17:24 < Some_Person> Now everything seems to redirect to the server
17:24 < Some_Person> (i.e. www.google.com shows the default page for Apache)
17:25 < krzee> host google.com
17:25 < Some_Person> ?
17:25 < krzee> and host google.com 8.8.8.8
17:25 < krzee> they are commands...
17:27 < Some_Person> It's not a DNS issue
17:27 < krzee> was that what i asked?
17:27 < Some_Person> Where do you want me to run that? connected client? or on the server?
17:27 < krzee> the client
17:28 < krzee> yes, connected
17:28 < Some_Person> weird
17:28 < Some_Person> http://paste.ubuntu.com/789258/
17:31 < krzee> heh ya weird
17:31 < Some_Person> So why the heck is everything redirecting to my server?
17:32 < krzee> try host google.com. 8.8.8.8
17:32 < krzee> with the trailing .
17:32 < Some_Person> Host google.com not found: 5(REFUSED)
17:33 < krzee> nslookup google.com 8.8.8.8
17:33 < krzee> and with trailing .
17:34 < krzee> and without 8.8.8.8
17:34 < krzee> pastebin all of them together pls
17:35 < krzee> then pastebin iptables -L and iptables -L -t nat
17:35 < Some_Person> http://paste.ubuntu.com/789265/
17:36 < Some_Person> iptables commands on the server? or a client?
17:37 < Some_Person> I suspect when it's trying to connect to 8.8.8.8, it's hitting my VPS which doesn't do anything
17:38 < Some_Person> 192.168.1.254 is my actual router here
17:39 < Some_Person> any ideas?
17:39 < Some_Person> for some reason it's just redirecting all traffic to itself
17:41 < Some_Person> hello?
17:41 < Some_Person> I *really* want this to work at 6:00
17:42 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
17:42 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has joined #openvpn
17:42 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has quit [Changing host]
17:42 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
17:44 < krzee> iptables stuff on the server
17:44 < krzee> btw, thats where you ran that iptables command i gave you earlier... right?
17:45 < Some_Person> yes
17:47 < Some_Person> http://paste.ubuntu.com/789274/
17:49 < Some_Person> is that not right?
17:50 < krzee> 91.227.125.201 is the vps ip?
17:50 < Some_Person> yes
17:51 < krzee> afaik it should work with that nat entry
17:51 < krzee> but i never used openvz
17:51 < Some_Person> well, something isn't working
17:51 < Some_Person> I shouldn't get my VPS through any IP
17:52 < Some_Person> anyone?
17:56 < krzee> iptables -A INPUT -i tun+ -j ACCEPT
17:57 < krzee> iptables -A FORWARD -i tun+ -j ACCEPT
17:58 < krzee> on the server of course
17:58 < Some_Person> Nope
17:58 < krzee> and show me the EXACT command you typed in to make that nat entry
17:59 < Some_Person> iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination 91.227.125.201
17:59 < Some_Person> It's still redirecting everything on the client to the VPS itself
17:59 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
18:01 < krzee> ya i dunno then
18:01 < krzee> http://forum.openvz.org/index.php?t=msg&goto=8117
18:01 <@vpnHelper> Title: OpenVZ Forum: Support » *SOLVED* OpenVPN in VPS : Masquerade (at forum.openvz.org)
18:01 < krzee> worked for a guy on that forum
18:02 < krzee> you may need to seek openvz help, since the problem here is that it doesnt support MASQERADE
18:04 < Some_Person> I definitely had the damn thing working before
18:05 <+TJNII> Are you trying to do a outbound NAT with DNAT?
18:06  * TJNII is late to the party, hpoing he read that wrong
18:06 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has joined #openvpn
18:06 -!- Gravitron [~admin@cpe-65-28-68-253.kc.res.rr.com] has quit [Changing host]
18:06 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
18:06 < krzee> TJNII, its a workaround for openvz since they dont have MASQERADE
18:06 < krzee> it has worked for others
18:06 <+TJNII> But it should be SNAT
18:06 < krzee> seems not to be working for him tho
18:06 <+TJNII> Change the Source IP
18:06 < krzee> but when you SNAT you need MASQERADE
18:06 < krzee> no?
18:06 <+TJNII> No, you don't
18:06 <+TJNII> MASQUERADE is a sloppy SNAT
18:06 < EugeneKay> MASQUERADE is a shortcut for SNAT
18:06 < krzee> ok, see if you can get him working
18:07 <+TJNII> It tries to figure out the source IP for dynamic hosts
18:07 < krzee> if you can, then we'll change the bot to know how
18:07 <+TJNII> SNAT requires the source IP explicitly.
18:07 <+TJNII> Some_Person: Try SNAT not DNAT
18:08 < Some_Person> How do I remove the thing that's there now?
18:08 <+TJNII> iptables -t nat -F
18:09 <+TJNII> That will flush your nat rules
18:10 < Some_Person> iptables v1.4.8: unknown option `--to-destination'
18:10 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Read error: Connection reset by peer]
18:11 <+TJNII> just --to
18:12 -!- mode/#openvpn [+o EugeneKay] by ChanServ
18:12 <@vpnHelper> RSS Update - forum: please help me <http://forums.openvpn.net/topic9507.html>
18:12 < Some_Person> iptables: Invalid argument. Run `dmesg' for more information.
18:12 <+TJNII> iptables -t nat -A POSTROUTING -s internalnet/netmask -o eth[public] -j SNAT --to [public ip]
18:12 -!- Gravitron [~admin@unaffiliated/gravitron] has joined #openvpn
18:12 < Some_Person> "eth[public]"? should I use venet0?
18:13 <+TJNII> Whatever device the outbound traffic is on
18:13 -!- EugeneKay changed the topic of #openvpn to: Welcome to the OpenVPN community support channel || PLEASE read the entire topic || Current Release: 2.2.2 (22-Dec-2011) || First time here? Use !welcome and !goal || Access Server? /join #openvpn-as || We're not psychic -- please !paste your !configs and !logs and a description of your problem || Your problem is your firewall, really. || Pope Gregory, eat your heart out
18:13 < Some_Person> What should I put in place of netmask?
18:14 <+TJNII> Well, your SNATing from a internal network.  What is that network?
18:14 <+TJNII> What network range did you pick for your clients?
18:14 < Some_Person> internal network = the thing that gives my server 10.8.0.1?
18:15 < Some_Person> sorry, but I'm really a noob at all this
18:16 <+TJNII> What did you put in your --server directive?
18:16 < Some_Person> Here, just look at my server config: http://paste.ubuntu.com/789257/
18:19 <+TJNII> Okay, so you chose 10.8.0.0 with a netmask of 255.255.255.0  That will set up openVPN to give clients addresses in that network
18:20 <+TJNII> So all your clients will be in the 10.8.0.0/24 network.
18:20 <+TJNII> So your -s option should be "-s 10.8.0.0/255.255.255.0"
18:23 <+TJNII> Some_Person: Do you have a static public IP?
18:26 < Some_Person> TJNII: Yes, the server does
18:27 < Some_Person> TJNII: It's working!! Thank you very much!
18:28 <+TJNII> NP.
18:28 < krzee> what was the EXACT command?
18:28 <+TJNII> What distro are you on?
18:28 <+TJNII> iptables -t nat -A POSTROUTING -s [vpnnet]/[netmask] -o eth[public] -j SNAT --to [public ip]
18:29 <+TJNII> But MASQUERADE is the preferred method if the server has a dynamic IP.
18:29 < krzee> !learn openvznat as someone else got it working with:  iptables -t nat -A POSTROUTING -s <vpn_subnet>/<netmask> -o eth<public> -j SNAT --to <public ip>
18:29 <@vpnHelper> Joo got it.
18:29 < krzee> thanks =]
18:30 <+TJNII> Some_Person: What distro are you using?
18:44 -!- JG84 is now known as NewYearsEve
18:48 -!- Axeman3 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
18:54 < Doktor_J> errrr.... why would i not have openvpn-auth-pam.so on my system? o_O
18:57 < Doktor_J> nm, it just seems to be off in a different place from where i expected it to be...
18:57 < Doktor_J> find -name ftw
19:04 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has quit [Ping timeout: 240 seconds]
19:11 -!- _julian_ [~quassel@hmbg-4d06f94a.pool.mediaWays.net] has joined #openvpn
19:15 -!- _julian [~quassel@hmbg-4d06930c.pool.mediaWays.net] has quit [Ping timeout: 260 seconds]
19:17 -!- someperson [~Some_Pers@99-99-216-248.lightspeed.hstntx.sbcglobal.net] has joined #openvpn
19:24 -!- someperson is now known as Some_Person
19:24 -!- Some_Person [~Some_Pers@99-99-216-248.lightspeed.hstntx.sbcglobal.net] has quit [Changing host]
19:24 -!- Some_Person [~Some_Pers@unaffiliated/someperson/x-249303] has joined #openvpn
19:26 -!- Gravitron [~admin@unaffiliated/gravitron] has quit [Quit: Computer has gone to sleep.]
19:35 -!- JackW1 [~jack@11.Red-2-142-27.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
19:37 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has quit [Ping timeout: 248 seconds]
19:42 -!- |Mike| [mike@vps-2a01-4f8-101-1c1-b23f-f6e5.twenty-five.nl] has joined #openvpn
20:05 -!- NewYearsEve is now known as Happy_New_Year
20:14 -!- Happy_New_Year is now known as JG84
20:28 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
20:33 -!- Axeman3 is now known as Axeman
20:34 -!- Axeman is now known as Guest64263
20:36 -!- Guest64263 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Quit: Sorry Gotta Run!]
20:43 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has joined #openvpn
20:43 -!- Axeman2 [~Axeman3@pool-173-52-72-139.nycmny.fios.verizon.net] has quit [Changing host]
20:43 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has joined #openvpn
20:43 -!- mode/#openvpn [+v Axeman2] by ChanServ
21:51 -!- Denial [Denial@drgi.co.uk] has quit []
22:24 -!- resha [70c64e8b@gateway/web/freenode/ip.112.198.78.139] has joined #openvpn
22:27 < resha> I have question about connection. I am using mobile broadband, now, when i connect the mobile broadband first I cannot connect to internet but when I connect first with openvpn before the broadband, I can connect to internet. what is the logic on this?
22:44 -!- resha [70c64e8b@gateway/web/freenode/ip.112.198.78.139] has quit [Quit: Page closed]
22:50 <@EugeneKay> Uh, what?
22:55 <+Axeman2> er... if you have no internet, what exactly is openvpn connecting to??
22:55 <+Axeman2> okay, i'll show myself out. 
22:59 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
23:14 -!- UnterPerro [~UnterPerr@c-174-61-29-146.hsd1.fl.comcast.net] has joined #openvpn
23:42 -!- Axeman2 [~Axeman3@openvpn/user/axeman] has quit [Quit: Sorry Gotta Run!]
23:54 <@vpnHelper> RSS Update - forum: Unable to reach the server network with net30 <http://forums.openvpn.net/topic9455-15.html#p19087>
--- Day changed Sun Jan 01 2012